{
  "statistics": {
    "processing": [
      {
        "name": "CAPE",
        "time": 48.558
      },
      {
        "name": "AnalysisInfo",
        "time": 0.019
      },
      {
        "name": "BehaviorAnalysis",
        "time": 0.268
      },
      {
        "name": "Debug",
        "time": 0.001
      },
      {
        "name": "NetworkAnalysis",
        "time": 0.0
      },
      {
        "name": "UrlAnalysis",
        "time": 0.0
      },
      {
        "name": "script_log_processing",
        "time": 0.0
      },
      {
        "name": "ProcessMemory",
        "time": 0.0
      }
    ],
    "signatures": [
      {
        "name": "packer_themida",
        "time": 0.0
      },
      {
        "name": "stealth_network",
        "time": 0.0
      },
      {
        "name": "disable_driver_via_blocklist",
        "time": 0.0
      },
      {
        "name": "disable_driver_via_hvcidisallowedimages",
        "time": 0.0
      },
      {
        "name": "disable_hypervisor_protected_code_integrity",
        "time": 0.0
      },
      {
        "name": "pendingfilerenameoperations_Operations",
        "time": 0.0
      },
      {
        "name": "anomalous_deletefile",
        "time": 0.0
      },
      {
        "name": "antiav_360_libs",
        "time": 0.0
      },
      {
        "name": "antiav_ahnlab_libs",
        "time": 0.0
      },
      {
        "name": "antiav_avast_libs",
        "time": 0.0
      },
      {
        "name": "antiav_bitdefender_libs",
        "time": 0.0
      },
      {
        "name": "antiav_bullguard_libs",
        "time": 0.0
      },
      {
        "name": "antiav_emsisoft_libs",
        "time": 0.0
      },
      {
        "name": "antiav_qurb_libs",
        "time": 0.0
      },
      {
        "name": "antiav_servicestop",
        "time": 0.0
      },
      {
        "name": "antiav_apioverride_libs",
        "time": 0.0
      },
      {
        "name": "antidebug_guardpages",
        "time": 0.0
      },
      {
        "name": "antidebug_ntcreatethreadex",
        "time": 0.0
      },
      {
        "name": "antiav_nthookengine_libs",
        "time": 0.0
      },
      {
        "name": "antidebug_outputdebugstring",
        "time": 0.0
      },
      {
        "name": "antidebug_setunhandledexceptionfilter",
        "time": 0.0
      },
      {
        "name": "antidebug_windows",
        "time": 0.0
      },
      {
        "name": "antiemu_wine_func",
        "time": 0.0
      },
      {
        "name": "antisandbox_cuckoo",
        "time": 0.0
      },
      {
        "name": "antisandbox_cuckoocrash",
        "time": 0.0
      },
      {
        "name": "antisandbox_foregroundwindows",
        "time": 0.0
      },
      {
        "name": "antisandbox_mouse_hook",
        "time": 0.0
      },
      {
        "name": "mouse_movement_detect",
        "time": 0.0
      },
      {
        "name": "antisandbox_sboxie_libs",
        "time": 0.0
      },
      {
        "name": "antisandbox_sboxie_objects",
        "time": 0.0
      },
      {
        "name": "antisandbox_script_timer",
        "time": 0.0
      },
      {
        "name": "antisandbox_sleep",
        "time": 0.0
      },
      {
        "name": "antisandbox_sunbelt_libs",
        "time": 0.0
      },
      {
        "name": "antisandbox_suspend",
        "time": 0.0
      },
      {
        "name": "antisandbox_unhook",
        "time": 0.0
      },
      {
        "name": "hardware_id_profiling",
        "time": 0.0
      },
      {
        "name": "antivm_directory_objects",
        "time": 0.0
      },
      {
        "name": "antivm_display",
        "time": 0.0
      },
      {
        "name": "antivm_generic_disk",
        "time": 0.0
      },
      {
        "name": "antivm_generic_scsi",
        "time": 0.0
      },
      {
        "name": "antivm_generic_services",
        "time": 0.0
      },
      {
        "name": "antivm_generic_system",
        "time": 0.0
      },
      {
        "name": "antivm_checks_available_memory",
        "time": 0.0
      },
      {
        "name": "detect_virtualization_via_recent_files",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_libs",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_window",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_events",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_libs",
        "time": 0.0
      },
      {
        "name": "antivm_wmi",
        "time": 0.0
      },
      {
        "name": "api_spamming",
        "time": 0.0
      },
      {
        "name": "api_uuidfromstringa",
        "time": 0.0
      },
      {
        "name": "bcdedit_command",
        "time": 0.0
      },
      {
        "name": "bootkit",
        "time": 0.0
      },
      {
        "name": "direct_hdd_access",
        "time": 0.0
      },
      {
        "name": "physical_drive_access",
        "time": 0.0
      },
      {
        "name": "potential_overwrite_mbr",
        "time": 0.0
      },
      {
        "name": "read_file_raw_disk_access",
        "time": 0.0
      },
      {
        "name": "suspicious_iocontrol_codes",
        "time": 0.0
      },
      {
        "name": "browser_needed",
        "time": 0.0
      },
      {
        "name": "firefox_disables_process_tab",
        "time": 0.0
      },
      {
        "name": "amsi_enumeration",
        "time": 0.0
      },
      {
        "name": "regsvr32_squiblydoo_dll_load",
        "time": 0.0
      },
      {
        "name": "suspicious_ntdll_disk_load",
        "time": 0.0
      },
      {
        "name": "direct_syscall_evasion",
        "time": 0.0
      },
      {
        "name": "unbacked_syscall_execution",
        "time": 0.0
      },
      {
        "name": "uac_bypass_cmstp",
        "time": 0.0
      },
      {
        "name": "uac_bypass_eventvwr",
        "time": 0.0
      },
      {
        "name": "uac_bypass_windows_Backup",
        "time": 0.0
      },
      {
        "name": "privilege_elevation_check",
        "time": 0.0
      },
      {
        "name": "dotnet_code_compile",
        "time": 0.0
      },
      {
        "name": "queries_computer_name",
        "time": 0.0
      },
      {
        "name": "queries_user_name",
        "time": 0.0
      },
      {
        "name": "creates_largekey",
        "time": 0.0
      },
      {
        "name": "creates_nullvalue",
        "time": 0.0
      },
      {
        "name": "access_windows_passwords_vault",
        "time": 0.0
      },
      {
        "name": "dump_lsa_via_windows_error_reporting",
        "time": 0.0
      },
      {
        "name": "lsass_credential_dumping",
        "time": 0.0
      },
      {
        "name": "critical_process",
        "time": 0.0
      },
      {
        "name": "query_fips_reconnaissance",
        "time": 0.0
      },
      {
        "name": "cryptopool_domains",
        "time": 0.0
      },
      {
        "name": "dead_connect",
        "time": 0.0
      },
      {
        "name": "dead_link",
        "time": 0.0
      },
      {
        "name": "debugs_self",
        "time": 0.0
      },
      {
        "name": "decoy_document",
        "time": 0.0
      },
      {
        "name": "decoy_image",
        "time": 0.0
      },
      {
        "name": "deletes_consolehost_history",
        "time": 0.0
      },
      {
        "name": "deletes_shadow_copies",
        "time": 0.0
      },
      {
        "name": "deletes_system_state_backup",
        "time": 0.0
      },
      {
        "name": "dep_bypass",
        "time": 0.0
      },
      {
        "name": "dep_disable",
        "time": 0.0
      },
      {
        "name": "disables_mappeddrives_autodisconnect",
        "time": 0.0
      },
      {
        "name": "disables_spdy",
        "time": 0.0
      },
      {
        "name": "disables_wfp",
        "time": 0.0
      },
      {
        "name": "add_windows_defender_exclusions",
        "time": 0.0
      },
      {
        "name": "mountpoints_volume_discovery",
        "time": 0.0
      },
      {
        "name": "dll_load_uncommon_file_types",
        "time": 0.0
      },
      {
        "name": "dllload_suspicious_directory",
        "time": 0.0
      },
      {
        "name": "document_script_exe_drop",
        "time": 0.0
      },
      {
        "name": "driver_load",
        "time": 0.0
      },
      {
        "name": "install_kernel_driver_service",
        "time": 0.0
      },
      {
        "name": "malformed_dll_loading",
        "time": 0.0
      },
      {
        "name": "dynamic_function_loading",
        "time": 0.0
      },
      {
        "name": "encrypted_ioc",
        "time": 0.0
      },
      {
        "name": "registers_vectored_exception_handler",
        "time": 0.0
      },
      {
        "name": "exec_crash",
        "time": 0.0
      },
      {
        "name": "process_creation_suspicious_location",
        "time": 0.0
      },
      {
        "name": "exploit_getbasekerneladdress",
        "time": 0.0
      },
      {
        "name": "exploit_gethaldispatchtable",
        "time": 0.0
      },
      {
        "name": "exploit_heapspray",
        "time": 0.0
      },
      {
        "name": "downloads_from_filehosting",
        "time": 0.0
      },
      {
        "name": "generic_phish",
        "time": 0.0
      },
      {
        "name": "http_request",
        "time": 0.0
      },
      {
        "name": "infostealer_browser",
        "time": 0.0
      },
      {
        "name": "infostealer_browser_password",
        "time": 0.0
      },
      {
        "name": "infostealer_cookies",
        "time": 0.0
      },
      {
        "name": "infostealer_keylog",
        "time": 0.0
      },
      {
        "name": "captures_screenshot",
        "time": 0.0
      },
      {
        "name": "injection_createremotethread",
        "time": 0.0
      },
      {
        "name": "creates_suspended_process",
        "time": 0.0
      },
      {
        "name": "injection_explorer",
        "time": 0.0
      },
      {
        "name": "injection_module_stomping_probing",
        "time": 0.0
      },
      {
        "name": "injection_needextension",
        "time": 0.0
      },
      {
        "name": "injection_network_traffic",
        "time": 0.0
      },
      {
        "name": "injection_runpe",
        "time": 0.0
      },
      {
        "name": "injection_rwx",
        "time": 0.0
      },
      {
        "name": "section_mapping_injection",
        "time": 0.0
      },
      {
        "name": "injection_themeinitapihook",
        "time": 0.0
      },
      {
        "name": "apc_injection",
        "time": 0.0
      },
      {
        "name": "resumethread_remote_process",
        "time": 0.0
      },
      {
        "name": "injection_write_exe_process",
        "time": 0.0
      },
      {
        "name": "injection_write_process",
        "time": 0.0
      },
      {
        "name": "internet_dropper",
        "time": 0.0
      },
      {
        "name": "interprocess_comms_mutex",
        "time": 0.0
      },
      {
        "name": "interprocess_comms_named_pipe",
        "time": 0.0
      },
      {
        "name": "interprocess_comms_shared_memory",
        "time": 0.0
      },
      {
        "name": "escalate_privilege_via_named_pipe",
        "time": 0.0
      },
      {
        "name": "ipc_namedpipe",
        "time": 0.0
      },
      {
        "name": "js_phish",
        "time": 0.0
      },
      {
        "name": "js_suspicious_redirect",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_internet_explorer_exporter",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_run_exe_helper_utility",
        "time": 0.0
      },
      {
        "name": "execute_ps_via_syncappvpublishingserver",
        "time": 0.0
      },
      {
        "name": "malicious_dynamic_function_loading",
        "time": 0.0
      },
      {
        "name": "reads_memory_remote_process",
        "time": 0.0
      },
      {
        "name": "unbacked_exception_filter",
        "time": 0.0
      },
      {
        "name": "unbacked_process_mitigation_alteration",
        "time": 0.0
      },
      {
        "name": "thread_unbacked_memory",
        "time": 0.0
      },
      {
        "name": "unbacked_api_resolution",
        "time": 0.0
      },
      {
        "name": "unbacked_dotnet_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_library_load",
        "time": 0.0
      },
      {
        "name": "unbacked_memory_apc_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_memory_protection_alteration",
        "time": 0.0
      },
      {
        "name": "unbacked_mutex_creation",
        "time": 0.0
      },
      {
        "name": "unbacked_process_creation",
        "time": 0.0
      },
      {
        "name": "unbacked_veh_registration",
        "time": 0.0
      },
      {
        "name": "unbacked_com_instantiation",
        "time": 0.0
      },
      {
        "name": "unbacked_crypto_operations",
        "time": 0.0
      },
      {
        "name": "unbacked_delay_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_file_dropping",
        "time": 0.0
      },
      {
        "name": "unbacked_process_enumeration",
        "time": 0.0
      },
      {
        "name": "unbacked_registry_modification",
        "time": 0.0
      },
      {
        "name": "unbacked_service_manipulation",
        "time": 0.0
      },
      {
        "name": "unbacked_token_manipulation",
        "time": 0.0
      },
      {
        "name": "unbacked_wmi_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_bind_shell",
        "time": 0.0
      },
      {
        "name": "unbacked_dns_resolution",
        "time": 0.0
      },
      {
        "name": "unbacked_memory_network_connection",
        "time": 0.0
      },
      {
        "name": "unbacked_named_pipe_creation",
        "time": 0.0
      },
      {
        "name": "unbacked_useragent_retrieval",
        "time": 0.0
      },
      {
        "name": "mimics_filetime",
        "time": 0.0
      },
      {
        "name": "amsi_bypass_via_com_registry",
        "time": 0.0
      },
      {
        "name": "access_auto_logons_via_registry",
        "time": 0.0
      },
      {
        "name": "access_boot_key_via_registry",
        "time": 0.0
      },
      {
        "name": "create_suspicious_lnk_files",
        "time": 0.0
      },
      {
        "name": "credential_access_via_windows_credential_history",
        "time": 0.0
      },
      {
        "name": "dll_hijacking_via_microsoft_exchange",
        "time": 0.0
      },
      {
        "name": "dll_hijacking_via_waas_medic_svc_com_typelib",
        "time": 0.0
      },
      {
        "name": "execute_file_downloaded_via_openssh",
        "time": 0.0
      },
      {
        "name": "execute_safe_mode_from_suspicious_process",
        "time": 0.0
      },
      {
        "name": "execute_scripts_via_microsoft_management_console",
        "time": 0.0
      },
      {
        "name": "execute_suspicious_processes_via_windows_mssql_service",
        "time": 0.0
      },
      {
        "name": "execution_from_self_extracting_archive",
        "time": 0.0
      },
      {
        "name": "ip_address_discovery_via_trusted_program",
        "time": 0.0
      },
      {
        "name": "load_dll_via_control_panel",
        "time": 0.0
      },
      {
        "name": "network_connection_via_suspicious_process",
        "time": 0.0
      },
      {
        "name": "potential_location_discovery_via_unusual_process",
        "time": 0.0
      },
      {
        "name": "store_executable_registry",
        "time": 0.0
      },
      {
        "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent",
        "time": 0.0
      },
      {
        "name": "suspicious_java_execution_via_win_scripts",
        "time": 0.0
      },
      {
        "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File",
        "time": 0.0
      },
      {
        "name": "uses_restart_manager_for_suspicious_activities",
        "time": 0.0
      },
      {
        "name": "modify_desktop_wallpaper",
        "time": 0.0
      },
      {
        "name": "modify_zoneid_ads",
        "time": 0.0
      },
      {
        "name": "move_file_on_reboot",
        "time": 0.0
      },
      {
        "name": "multiple_useragents",
        "time": 0.0
      },
      {
        "name": "network_anomaly",
        "time": 0.0
      },
      {
        "name": "network_bind",
        "time": 0.0
      },
      {
        "name": "etherhiding_smart_contract_call",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_archive",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_free_webhosting",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_generic",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_interactsh",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_opensource",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_pastesite",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_payload",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_serviceinterface",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_socialmedia",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_telegram",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_tempstorage",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_temp_urldns",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_urlshortener",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_useragent",
        "time": 0.0
      },
      {
        "name": "network_cnc_smtps_exfil",
        "time": 0.0
      },
      {
        "name": "network_cnc_smtps_generic",
        "time": 0.0
      },
      {
        "name": "network_dns_idn",
        "time": 0.0
      },
      {
        "name": "network_dns_suspicious_querytype",
        "time": 0.0
      },
      {
        "name": "network_dns_tunneling_request",
        "time": 0.0
      },
      {
        "name": "network_document_http",
        "time": 0.0
      },
      {
        "name": "explorer_http",
        "time": 0.0
      },
      {
        "name": "network_fake_useragent",
        "time": 0.0
      },
      {
        "name": "legitimate_domain_abuse",
        "time": 0.0
      },
      {
        "name": "suspicious_communication_trusted_site",
        "time": 0.0
      },
      {
        "name": "network_document_file",
        "time": 0.0
      },
      {
        "name": "network_tor",
        "time": 0.0
      },
      {
        "name": "office_com_load",
        "time": 0.0
      },
      {
        "name": "office_dotnet_load",
        "time": 0.0
      },
      {
        "name": "office_mshtml_load",
        "time": 0.0
      },
      {
        "name": "office_vb_load",
        "time": 0.0
      },
      {
        "name": "office_wmi_load",
        "time": 0.0
      },
      {
        "name": "office_cve2017_11882",
        "time": 0.0
      },
      {
        "name": "office_cve2017_11882_network",
        "time": 0.0
      },
      {
        "name": "office_cve_2021_40444",
        "time": 0.0
      },
      {
        "name": "office_cve_2021_40444_m2",
        "time": 0.0
      },
      {
        "name": "office_flash_load",
        "time": 0.0
      },
      {
        "name": "office_postscript",
        "time": 0.0
      },
      {
        "name": "office_suspicious_processes",
        "time": 0.0
      },
      {
        "name": "office_write_exe",
        "time": 0.0
      },
      {
        "name": "decompress_exe",
        "time": 0.0
      },
      {
        "name": "persistence_via_autodial_dll_registry",
        "time": 0.0
      },
      {
        "name": "persistence_autorun",
        "time": 0.0
      },
      {
        "name": "persistence_autorun_tasks",
        "time": 0.0
      },
      {
        "name": "persistence_bootexecute",
        "time": 0.0
      },
      {
        "name": "persistence_registry_script",
        "time": 0.0
      },
      {
        "name": "powershell_network_connection",
        "time": 0.0
      },
      {
        "name": "powershell_download",
        "time": 0.0
      },
      {
        "name": "powershell_request",
        "time": 0.0
      },
      {
        "name": "createtoolhelp32snapshot_module_enumeration",
        "time": 0.0
      },
      {
        "name": "enumerates_running_processes",
        "time": 0.0
      },
      {
        "name": "process_interest",
        "time": 0.0
      },
      {
        "name": "process_needed",
        "time": 0.0
      },
      {
        "name": "ransomware_iocp_asynchronous_encryption",
        "time": 0.0
      },
      {
        "name": "kernel_crypto_driver_abuse",
        "time": 0.0
      },
      {
        "name": "mass_data_encryption",
        "time": 0.0
      },
      {
        "name": "ransomware_extension_hijack",
        "time": 0.0
      },
      {
        "name": "mass_file_modification_access",
        "time": 0.0
      },
      {
        "name": "ransomware_attribute_stripping",
        "time": 0.0
      },
      {
        "name": "ransomware_file_modifications",
        "time": 0.0
      },
      {
        "name": "mass_ransom_note_drop",
        "time": 0.0
      },
      {
        "name": "ransomware_message",
        "time": 0.0
      },
      {
        "name": "reads_self",
        "time": 0.0
      },
      {
        "name": "recon_beacon",
        "time": 0.0
      },
      {
        "name": "recon_programs",
        "time": 0.0
      },
      {
        "name": "recon_systeminfo",
        "time": 0.0
      },
      {
        "name": "accesses_recyclebin",
        "time": 0.0
      },
      {
        "name": "script_created_process",
        "time": 0.0
      },
      {
        "name": "script_network_activity",
        "time": 0.0
      },
      {
        "name": "suspicious_js_script",
        "time": 0.0
      },
      {
        "name": "javascript_timer",
        "time": 0.0
      },
      {
        "name": "secure_login_phishing",
        "time": 0.0
      },
      {
        "name": "securityxploded_modules",
        "time": 0.0
      },
      {
        "name": "get_clipboard_data",
        "time": 0.0
      },
      {
        "name": "sets_autoconfig_url",
        "time": 0.0
      },
      {
        "name": "spoofs_procname",
        "time": 0.0
      },
      {
        "name": "stack_pivot",
        "time": 0.0
      },
      {
        "name": "stack_pivot_file_created",
        "time": 0.0
      },
      {
        "name": "stack_pivot_process_create",
        "time": 0.0
      },
      {
        "name": "set_clipboard_data",
        "time": 0.0
      },
      {
        "name": "stealth_childproc",
        "time": 0.0
      },
      {
        "name": "stealth_file",
        "time": 0.0
      },
      {
        "name": "stealth_system_procname",
        "time": 0.0
      },
      {
        "name": "stealth_timeout",
        "time": 0.0
      },
      {
        "name": "stealth_window",
        "time": 0.0
      },
      {
        "name": "queries_keyboard_layout",
        "time": 0.0
      },
      {
        "name": "queries_locale_api",
        "time": 0.0
      },
      {
        "name": "terminates_remote_process",
        "time": 0.0
      },
      {
        "name": "uiautomationcore_load",
        "time": 0.0
      },
      {
        "name": "user_enum",
        "time": 0.0
      },
      {
        "name": "mmc_dll_script_load",
        "time": 0.0
      },
      {
        "name": "mmc_dotnet_load",
        "time": 0.0
      },
      {
        "name": "virus",
        "time": 0.0
      },
      {
        "name": "webmail_phish",
        "time": 0.0
      },
      {
        "name": "persists_dev_util",
        "time": 0.0
      },
      {
        "name": "spawns_dev_util",
        "time": 0.0
      },
      {
        "name": "alters_windows_utility",
        "time": 0.0
      },
      {
        "name": "overwrites_accessibility_utility",
        "time": 0.0
      },
      {
        "name": "Potential_Lateral_Movement_Via_SMBEXEC",
        "time": 0.0
      },
      {
        "name": "potential_WebShell_Via_ScreenConnectServer",
        "time": 0.0
      },
      {
        "name": "uses_Microsoft_HTML_Help_Executable",
        "time": 0.0
      },
      {
        "name": "wiper_zeroedbytes",
        "time": 0.0
      },
      {
        "name": "wmi_create_process",
        "time": 0.0
      },
      {
        "name": "wmi_script_process",
        "time": 0.0
      },
      {
        "name": "antianalysis_tls_section",
        "time": 0.0
      },
      {
        "name": "antivirus_clamav",
        "time": 0.0
      },
      {
        "name": "antivirus_virustotal",
        "time": 0.0
      },
      {
        "name": "bad_certs",
        "time": 0.0
      },
      {
        "name": "bad_ssl_certs",
        "time": 0.0
      },
      {
        "name": "banker_zeus_p2p",
        "time": 0.0
      },
      {
        "name": "banker_zeus_url",
        "time": 0.0
      },
      {
        "name": "binary_yara",
        "time": 0.0
      },
      {
        "name": "bot_athenahttp",
        "time": 0.0
      },
      {
        "name": "bot_dirtjumper",
        "time": 0.0
      },
      {
        "name": "bot_drive",
        "time": 0.0
      },
      {
        "name": "bot_drive2",
        "time": 0.0
      },
      {
        "name": "bot_madness",
        "time": 0.0
      },
      {
        "name": "byod_loldrivers_match",
        "time": 0.0
      },
      {
        "name": "byod_novel_driver",
        "time": 0.0
      },
      {
        "name": "byod_post_load_exploitation",
        "time": 0.0
      },
      {
        "name": "byod_driver_service_install",
        "time": 0.0
      },
      {
        "name": "com_spawned_process",
        "time": 0.0
      },
      {
        "name": "phishing_kit_detected",
        "time": 0.0
      },
      {
        "name": "family_proxyback",
        "time": 0.0
      },
      {
        "name": "flare_capa_antianalysis",
        "time": 0.0
      },
      {
        "name": "flare_capa_collection",
        "time": 0.0
      },
      {
        "name": "flare_capa_communication",
        "time": 0.0
      },
      {
        "name": "flare_capa_compiler",
        "time": 0.0
      },
      {
        "name": "flare_capa_datamanipulation",
        "time": 0.0
      },
      {
        "name": "flare_capa_executable",
        "time": 0.0
      },
      {
        "name": "flare_capa_hostinteraction",
        "time": 0.0
      },
      {
        "name": "flare_capa_impact",
        "time": 0.0
      },
      {
        "name": "flare_capa_lib",
        "time": 0.0
      },
      {
        "name": "flare_capa_linking",
        "time": 0.0
      },
      {
        "name": "flare_capa_loadcode",
        "time": 0.0
      },
      {
        "name": "flare_capa_malwarefamily",
        "time": 0.0
      },
      {
        "name": "flare_capa_nursery",
        "time": 0.0
      },
      {
        "name": "flare_capa_persistence",
        "time": 0.0
      },
      {
        "name": "flare_capa_runtime",
        "time": 0.0
      },
      {
        "name": "flare_capa_targeting",
        "time": 0.0
      },
      {
        "name": "threatfox",
        "time": 0.0
      },
      {
        "name": "log4shell",
        "time": 0.0
      },
      {
        "name": "mimics_extension",
        "time": 0.0
      },
      {
        "name": "network_country_distribution",
        "time": 0.0
      },
      {
        "name": "network_cnc_http",
        "time": 0.0
      },
      {
        "name": "network_ip_exe",
        "time": 0.0
      },
      {
        "name": "network_dga",
        "time": 0.0
      },
      {
        "name": "network_dga_fraunhofer",
        "time": 0.0
      },
      {
        "name": "network_dyndns",
        "time": 0.0
      },
      {
        "name": "network_excessive_udp",
        "time": 0.0
      },
      {
        "name": "network_http",
        "time": 0.0
      },
      {
        "name": "network_icmp",
        "time": 0.0
      },
      {
        "name": "network_irc",
        "time": 0.0
      },
      {
        "name": "network_open_proxy",
        "time": 0.0
      },
      {
        "name": "network_questionable_http_path",
        "time": 0.0
      },
      {
        "name": "network_questionable_https_path",
        "time": 0.0
      },
      {
        "name": "network_smtp",
        "time": 0.0
      },
      {
        "name": "network_torgateway",
        "time": 0.0
      },
      {
        "name": "origin_langid",
        "time": 0.0
      },
      {
        "name": "origin_resource_langid",
        "time": 0.0
      },
      {
        "name": "overlay",
        "time": 0.0
      },
      {
        "name": "pe_deep_entrypoint",
        "time": 0.0
      },
      {
        "name": "packer_unknown_pe_section_name",
        "time": 0.0
      },
      {
        "name": "packer_aspack",
        "time": 0.0
      },
      {
        "name": "packer_aspirecrypt",
        "time": 0.0
      },
      {
        "name": "packer_bedsprotector",
        "time": 0.0
      },
      {
        "name": "packer_confuser",
        "time": 0.0
      },
      {
        "name": "packer_enigma",
        "time": 0.0
      },
      {
        "name": "packer_entropy",
        "time": 0.0
      },
      {
        "name": "packer_mpress",
        "time": 0.0
      },
      {
        "name": "packer_nate",
        "time": 0.0
      },
      {
        "name": "packer_nspack",
        "time": 0.0
      },
      {
        "name": "packer_smartassembly",
        "time": 0.0
      },
      {
        "name": "packer_spices",
        "time": 0.0
      },
      {
        "name": "packer_themida",
        "time": 0.0
      },
      {
        "name": "packer_titan",
        "time": 0.0
      },
      {
        "name": "packer_upx",
        "time": 0.0
      },
      {
        "name": "packer_vmprotect",
        "time": 0.0
      },
      {
        "name": "packer_yoda",
        "time": 0.0
      },
      {
        "name": "pdf_annot_urls_checker",
        "time": 0.0
      },
      {
        "name": "pe_cert_invalid_signature",
        "time": 0.0
      },
      {
        "name": "pe_cert_self_signed",
        "time": 0.0
      },
      {
        "name": "pe_cert_suspicious_issuer",
        "time": 0.0
      },
      {
        "name": "polymorphic",
        "time": 0.0
      },
      {
        "name": "punch_plus_plus_pcres",
        "time": 0.0
      },
      {
        "name": "procmem_yara",
        "time": 0.0
      },
      {
        "name": "recon_checkip",
        "time": 0.0
      },
      {
        "name": "sigma_events",
        "time": 0.0
      },
      {
        "name": "static_authenticode",
        "time": 0.0
      },
      {
        "name": "invalid_authenticode_signature",
        "time": 0.0
      },
      {
        "name": "static_dotnet_anomaly",
        "time": 0.0
      },
      {
        "name": "static_java",
        "time": 0.0
      },
      {
        "name": "static_pdf",
        "time": 0.0
      },
      {
        "name": "contains_pe_overlay",
        "time": 0.0
      },
      {
        "name": "static_pe_anomaly",
        "time": 0.0
      },
      {
        "name": "pe_compile_timestomping",
        "time": 0.0
      },
      {
        "name": "static_pe_pdbpath",
        "time": 0.0
      },
      {
        "name": "static_rat_config",
        "time": 0.0
      },
      {
        "name": "static_versioninfo_anomaly",
        "time": 0.0
      },
      {
        "name": "browser_credential_theft_headless",
        "time": 0.0
      },
      {
        "name": "suricata_alert",
        "time": 0.0
      },
      {
        "name": "suspicious_html_body",
        "time": 0.0
      },
      {
        "name": "suspicious_html_name",
        "time": 0.0
      },
      {
        "name": "suspicious_html_title",
        "time": 0.0
      },
      {
        "name": "volatility_devicetree_1",
        "time": 0.0
      },
      {
        "name": "volatility_handles_1",
        "time": 0.0
      },
      {
        "name": "volatility_ldrmodules_1",
        "time": 0.0
      },
      {
        "name": "volatility_ldrmodules_2",
        "time": 0.0
      },
      {
        "name": "volatility_malfind_1",
        "time": 0.0
      },
      {
        "name": "volatility_malfind_2",
        "time": 0.0
      },
      {
        "name": "volatility_modscan_1",
        "time": 0.0
      },
      {
        "name": "volatility_svcscan_1",
        "time": 0.0
      },
      {
        "name": "volatility_svcscan_2",
        "time": 0.0
      },
      {
        "name": "volatility_svcscan_3",
        "time": 0.0
      },
      {
        "name": "whois_create",
        "time": 0.0
      },
      {
        "name": "accesses_mailslot",
        "time": 0.0
      },
      {
        "name": "accesses_netlogon_regkey",
        "time": 0.0
      },
      {
        "name": "accesses_public_folder",
        "time": 0.0
      },
      {
        "name": "accesses_sysvol",
        "time": 0.0
      },
      {
        "name": "writes_sysvol",
        "time": 0.0
      },
      {
        "name": "adds_admin_user",
        "time": 0.0
      },
      {
        "name": "adds_user",
        "time": 0.0
      },
      {
        "name": "overwrites_admin_password",
        "time": 0.0
      },
      {
        "name": "antianalysis_detectfile",
        "time": 0.002
      },
      {
        "name": "antianalysis_detectreg",
        "time": 0.026
      },
      {
        "name": "modify_attachment_manager",
        "time": 0.0
      },
      {
        "name": "antiav_detectfile",
        "time": 0.005
      },
      {
        "name": "antiav_detectreg",
        "time": 0.122
      },
      {
        "name": "antiav_srp",
        "time": 0.0
      },
      {
        "name": "antiav_whitespace",
        "time": 0.0
      },
      {
        "name": "antidebug_devices",
        "time": 0.001
      },
      {
        "name": "antiemu_windefend",
        "time": 0.0
      },
      {
        "name": "antiemu_wine_reg",
        "time": 0.0
      },
      {
        "name": "antisandbox_cuckoo_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_fortinet_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_joe_anubis_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_sboxie_mutex",
        "time": 0.0
      },
      {
        "name": "antisandbox_sunbelt_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_threattrack_files",
        "time": 0.0
      },
      {
        "name": "antivm_bochs_keys",
        "time": 0.002
      },
      {
        "name": "antivm_generic_bios",
        "time": 0.001
      },
      {
        "name": "antivm_generic_diskreg",
        "time": 0.005
      },
      {
        "name": "antivm_hyperv_keys",
        "time": 0.002
      },
      {
        "name": "antivm_parallels_keys",
        "time": 0.007
      },
      {
        "name": "antivm_recentdocs",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_devices",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_files",
        "time": 0.002
      },
      {
        "name": "antivm_vbox_keys",
        "time": 0.014
      },
      {
        "name": "antivm_vmware_devices",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_files",
        "time": 0.001
      },
      {
        "name": "antivm_vmware_keys",
        "time": 0.009
      },
      {
        "name": "antivm_vmware_mutexes",
        "time": 0.0
      },
      {
        "name": "antivm_vpc_files",
        "time": 0.0
      },
      {
        "name": "antivm_vpc_keys",
        "time": 0.005
      },
      {
        "name": "antivm_vpc_mutex",
        "time": 0.0
      },
      {
        "name": "antivm_xen_keys",
        "time": 0.007
      },
      {
        "name": "ketrican_regkeys",
        "time": 0.001
      },
      {
        "name": "bitcoin_opencl",
        "time": 0.0
      },
      {
        "name": "enumerates_physical_drives",
        "time": 0.0
      },
      {
        "name": "bot_russkill",
        "time": 0.0
      },
      {
        "name": "browser_addon",
        "time": 0.0
      },
      {
        "name": "chromium_browser_extension_directory",
        "time": 0.0
      },
      {
        "name": "browser_helper_object",
        "time": 0.0
      },
      {
        "name": "browser_security",
        "time": 0.001
      },
      {
        "name": "browser_startpage",
        "time": 0.0
      },
      {
        "name": "executes_headless_browser",
        "time": 0.0
      },
      {
        "name": "suspicious_browser_arguments",
        "time": 0.0
      },
      {
        "name": "ie_disables_process_tab",
        "time": 0.0
      },
      {
        "name": "odbcconf_bypass",
        "time": 0.0
      },
      {
        "name": "squiblydoo_bypass",
        "time": 0.0
      },
      {
        "name": "squiblytwo_bypass",
        "time": 0.0
      },
      {
        "name": "bypass_chromium_protection",
        "time": 0.0
      },
      {
        "name": "bypass_firewall",
        "time": 0.002
      },
      {
        "name": "checks_uac_status",
        "time": 0.0
      },
      {
        "name": "uac_bypass_cmstpcom",
        "time": 0.0
      },
      {
        "name": "uac_bypass_delegateexecute_sdclt",
        "time": 0.0
      },
      {
        "name": "uac_bypass_fodhelper",
        "time": 0.0
      },
      {
        "name": "cape_extracted_content",
        "time": 0.0
      },
      {
        "name": "clears_logs",
        "time": 0.0
      },
      {
        "name": "cmdline_obfuscation",
        "time": 0.0
      },
      {
        "name": "cmdline_switches",
        "time": 0.0
      },
      {
        "name": "cmdline_terminate",
        "time": 0.0
      },
      {
        "name": "cmdline_forfiles_wildcard",
        "time": 0.0
      },
      {
        "name": "cmdline_http_link",
        "time": 0.0
      },
      {
        "name": "cmdline_long_string",
        "time": 0.0
      },
      {
        "name": "cmdline_reversed_http_link",
        "time": 0.0
      },
      {
        "name": "long_commandline",
        "time": 0.0
      },
      {
        "name": "powershell_renamed_commandline",
        "time": 0.0
      },
      {
        "name": "copies_self",
        "time": 0.0
      },
      {
        "name": "credwiz_credentialaccess",
        "time": 0.0
      },
      {
        "name": "enables_wdigest",
        "time": 0.0
      },
      {
        "name": "vaultcmd_credentialaccess",
        "time": 0.0
      },
      {
        "name": "file_credential_store_access",
        "time": 0.0
      },
      {
        "name": "file_credential_store_write",
        "time": 0.0
      },
      {
        "name": "kerberos_credential_access_via_rubeus",
        "time": 0.0
      },
      {
        "name": "registry_credential_dumping",
        "time": 0.0
      },
      {
        "name": "registry_credential_store_access",
        "time": 0.001
      },
      {
        "name": "registry_lsa_secrets_access",
        "time": 0.0
      },
      {
        "name": "comsvcs_credentialdump",
        "time": 0.0
      },
      {
        "name": "cryptomining_stratum_command",
        "time": 0.0
      },
      {
        "name": "deepfreeze_mutex",
        "time": 0.0
      },
      {
        "name": "deletes_executed_files",
        "time": 0.0
      },
      {
        "name": "disables_app_launch",
        "time": 0.0
      },
      {
        "name": "disables_auto_app_termination",
        "time": 0.0
      },
      {
        "name": "disables_appv_virtualization",
        "time": 0.0
      },
      {
        "name": "disables_backups",
        "time": 0.001
      },
      {
        "name": "disables_browser_warn",
        "time": 0.001
      },
      {
        "name": "disables_context_menus",
        "time": 0.0
      },
      {
        "name": "disables_cpl_disable",
        "time": 0.0
      },
      {
        "name": "disables_crashdumps",
        "time": 0.0
      },
      {
        "name": "disables_event_logging",
        "time": 0.0
      },
      {
        "name": "disables_folder_options",
        "time": 0.0
      },
      {
        "name": "disables_notificationcenter",
        "time": 0.0
      },
      {
        "name": "disables_power_options",
        "time": 0.0
      },
      {
        "name": "disables_restore_default_state",
        "time": 0.0
      },
      {
        "name": "disables_run_command",
        "time": 0.0
      },
      {
        "name": "disables_smartscreen",
        "time": 0.0
      },
      {
        "name": "disables_startmenu_search",
        "time": 0.0
      },
      {
        "name": "disables_system_restore",
        "time": 0.0
      },
      {
        "name": "disables_uac",
        "time": 0.0
      },
      {
        "name": "disables_wer",
        "time": 0.0
      },
      {
        "name": "disables_windows_defender",
        "time": 0.0
      },
      {
        "name": "disables_windows_defender_logging",
        "time": 0.0
      },
      {
        "name": "removes_windows_defender_contextmenu",
        "time": 0.0
      },
      {
        "name": "removes_windows_defender_updates",
        "time": 0.0
      },
      {
        "name": "windows_defender_powershell",
        "time": 0.0
      },
      {
        "name": "disables_windows_file_protection",
        "time": 0.0
      },
      {
        "name": "disables_windowsupdate",
        "time": 0.0
      },
      {
        "name": "disables_winfirewall",
        "time": 0.0
      },
      {
        "name": "folder_enumeration",
        "time": 0.0
      },
      {
        "name": "discover_registry_mount_points",
        "time": 0.0
      },
      {
        "name": "adfind_domain_enumeration",
        "time": 0.0
      },
      {
        "name": "domain_enumeration_commands",
        "time": 0.0
      },
      {
        "name": "driver_filtermanager",
        "time": 0.0
      },
      {
        "name": "dropper",
        "time": 0.0
      },
      {
        "name": "dll_archive_execution",
        "time": 0.0
      },
      {
        "name": "lnk_archive_execution",
        "time": 0.0
      },
      {
        "name": "script_archive_execution",
        "time": 0.0
      },
      {
        "name": "excel4_macro_urls",
        "time": 0.0
      },
      {
        "name": "escalate_privilege_via_ntlm_relay",
        "time": 0.0
      },
      {
        "name": "spooler_access",
        "time": 0.0
      },
      {
        "name": "spooler_svc_start",
        "time": 0.0
      },
      {
        "name": "mapped_drives_uac",
        "time": 0.0
      },
      {
        "name": "hides_recycle_bin_icon",
        "time": 0.0
      },
      {
        "name": "infostealer_bitcoin",
        "time": 0.003
      },
      {
        "name": "infostealer_ftp",
        "time": 0.042
      },
      {
        "name": "infostealer_im",
        "time": 0.024
      },
      {
        "name": "infostealer_mail",
        "time": 0.007
      },
      {
        "name": "Evade_Execution_Via_ASPNet_Compiler",
        "time": 0.0
      },
      {
        "name": "Evade_Execute_Via_DeviceCredentialDeployment",
        "time": 0.0
      },
      {
        "name": "Evade_Execution_Via_Filter_Manager_Control",
        "time": 0.0
      },
      {
        "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_appvlp",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_pcalua",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_OpenSSH",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_pcalua",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_PesterPSModule",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_ScriptRunner",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_ttdinject",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_VisualStudioLiveShare",
        "time": 0.0
      },
      {
        "name": "Execute_Msiexec_Via_Explorer",
        "time": 0.0
      },
      {
        "name": "execute_remote_msi",
        "time": 0.0
      },
      {
        "name": "execute_suspicious_powershell_via_runscripthelper",
        "time": 0.0
      },
      {
        "name": "execute_suspicious_powershell_via_sqlps",
        "time": 0.0
      },
      {
        "name": "Indirect_Command_Execution_Via_ConsoleWindowHost",
        "time": 0.0
      },
      {
        "name": "Perform_Malicious_Activities_Via_Headless_Browser",
        "time": 0.0
      },
      {
        "name": "Register_DLL_Via_CertOC",
        "time": 0.0
      },
      {
        "name": "Register_DLL_Via_MSIEXEC",
        "time": 0.0
      },
      {
        "name": "Register_DLL_Via_Odbcconf",
        "time": 0.0
      },
      {
        "name": "Scriptlet_Proxy_Execution_Via_Pubprn",
        "time": 0.0
      },
      {
        "name": "ie_martian_children",
        "time": 0.0
      },
      {
        "name": "office_martian_children",
        "time": 0.0
      },
      {
        "name": "mimics_icon",
        "time": 0.0
      },
      {
        "name": "masquerade_process_name",
        "time": 0.007
      },
      {
        "name": "mimikatz_modules",
        "time": 0.0
      },
      {
        "name": "ms_office_cmd_rce",
        "time": 0.0
      },
      {
        "name": "mount_copy_to_webdav_share",
        "time": 0.0
      },
      {
        "name": "potential_protocol_tunneling_via_legit_utilities",
        "time": 0.0
      },
      {
        "name": "potential_protocol_tunneling_via_qemu",
        "time": 0.0
      },
      {
        "name": "suspicious_execution_via_dotnet_remoting",
        "time": 0.0
      },
      {
        "name": "modify_certs",
        "time": 0.0
      },
      {
        "name": "dotnet_clr_usagelog_regkeys",
        "time": 0.0
      },
      {
        "name": "modify_hostfile",
        "time": 0.0
      },
      {
        "name": "modify_oem_information",
        "time": 0.0
      },
      {
        "name": "modify_security_center_warnings",
        "time": 0.0
      },
      {
        "name": "modify_uac_prompt",
        "time": 0.0
      },
      {
        "name": "network_dns_blockchain",
        "time": 0.0
      },
      {
        "name": "network_dns_opennic",
        "time": 0.0
      },
      {
        "name": "network_dns_paste_site",
        "time": 0.0
      },
      {
        "name": "network_dns_reverse_proxy",
        "time": 0.0
      },
      {
        "name": "network_dns_temp_file_storage",
        "time": 0.0
      },
      {
        "name": "network_dns_temp_urldns",
        "time": 0.0
      },
      {
        "name": "network_dns_url_shortener",
        "time": 0.0
      },
      {
        "name": "network_dns_doh_tls",
        "time": 0.0
      },
      {
        "name": "suspicious_tld",
        "time": 0.0
      },
      {
        "name": "network_tor_service",
        "time": 0.0
      },
      {
        "name": "office_code_page",
        "time": 0.0
      },
      {
        "name": "office_addinloading",
        "time": 0.0
      },
      {
        "name": "office_perfkey",
        "time": 0.0
      },
      {
        "name": "office_macro",
        "time": 0.0
      },
      {
        "name": "changes_trust_center_settings",
        "time": 0.0
      },
      {
        "name": "disables_vba_trust_access",
        "time": 0.0
      },
      {
        "name": "office_macro_autoexecution",
        "time": 0.0
      },
      {
        "name": "office_macro_ioc",
        "time": 0.0
      },
      {
        "name": "office_macro_malicious_prediction",
        "time": 0.0
      },
      {
        "name": "office_macro_suspicious",
        "time": 0.0
      },
      {
        "name": "rtf_aslr_bypass",
        "time": 0.0
      },
      {
        "name": "rtf_anomaly_characterset",
        "time": 0.0
      },
      {
        "name": "rtf_anomaly_version",
        "time": 0.0
      },
      {
        "name": "rtf_embedded_content",
        "time": 0.0
      },
      {
        "name": "rtf_embedded_office_file",
        "time": 0.0
      },
      {
        "name": "rtf_exploit_static",
        "time": 0.0
      },
      {
        "name": "office_security",
        "time": 0.0
      },
      {
        "name": "accesses_office_username",
        "time": 0.0
      },
      {
        "name": "office_anomalous_feature",
        "time": 0.0
      },
      {
        "name": "office_dde_command",
        "time": 0.0
      },
      {
        "name": "packer_armadillo_mutex",
        "time": 0.0
      },
      {
        "name": "packer_armadillo_regkey",
        "time": 0.0
      },
      {
        "name": "persistence_ads",
        "time": 0.0
      },
      {
        "name": "persistence_safeboot",
        "time": 0.0
      },
      {
        "name": "persistence_ifeo",
        "time": 0.0
      },
      {
        "name": "persistence_silent_process_exit",
        "time": 0.0
      },
      {
        "name": "persistence_rdp_registry",
        "time": 0.0
      },
      {
        "name": "persistence_rdp_shadowing",
        "time": 0.0
      },
      {
        "name": "persistence_service",
        "time": 0.0
      },
      {
        "name": "persistence_shim_database",
        "time": 0.0
      },
      {
        "name": "powershell_scriptblock_logging",
        "time": 0.0
      },
      {
        "name": "powershell_command_suspicious",
        "time": 0.0
      },
      {
        "name": "powershell_history_save_mod",
        "time": 0.0
      },
      {
        "name": "powershell_renamed",
        "time": 0.0
      },
      {
        "name": "powershell_reversed",
        "time": 0.0
      },
      {
        "name": "powershell_variable_obfuscation",
        "time": 0.0
      },
      {
        "name": "prevents_safeboot",
        "time": 0.0
      },
      {
        "name": "cmdline_process_discovery",
        "time": 0.0
      },
      {
        "name": "ransomware_extensions_generic",
        "time": 0.0
      },
      {
        "name": "ransomware_extensions_known",
        "time": 0.004
      },
      {
        "name": "ransomware_files",
        "time": 0.006
      },
      {
        "name": "ransomware_recyclebin",
        "time": 0.0
      },
      {
        "name": "ransomware_revil_regkey",
        "time": 0.0
      },
      {
        "name": "reads_password_database",
        "time": 0.0
      },
      {
        "name": "recon_fingerprint",
        "time": 0.001
      },
      {
        "name": "rdptcp_key",
        "time": 0.0
      },
      {
        "name": "uses_rdp_clip",
        "time": 0.0
      },
      {
        "name": "uses_remote_desktop_session",
        "time": 0.0
      },
      {
        "name": "removes_networking_icon",
        "time": 0.0
      },
      {
        "name": "removes_pinned_programs",
        "time": 0.0
      },
      {
        "name": "removes_security_maintenance_icon",
        "time": 0.0
      },
      {
        "name": "removes_startmenu_defaults",
        "time": 0.0
      },
      {
        "name": "removes_username_startmenu",
        "time": 0.0
      },
      {
        "name": "sniffer_winpcap",
        "time": 0.0
      },
      {
        "name": "spreading_autoruninf",
        "time": 0.0
      },
      {
        "name": "stealth_hidden_extension",
        "time": 0.0
      },
      {
        "name": "stealth_hiddenreg",
        "time": 0.0
      },
      {
        "name": "stealth_hide_notifications",
        "time": 0.0
      },
      {
        "name": "stealth_webhistory",
        "time": 0.0
      },
      {
        "name": "sysinternals_psexec",
        "time": 0.0
      },
      {
        "name": "sysinternals_tools",
        "time": 0.0
      },
      {
        "name": "language_check_registry",
        "time": 0.0
      },
      {
        "name": "tampers_etw",
        "time": 0.0
      },
      {
        "name": "lsa_tampering",
        "time": 0.0
      },
      {
        "name": "tampers_powershell_logging",
        "time": 0.0
      },
      {
        "name": "territorial_disputes_sigs",
        "time": 0.04
      },
      {
        "name": "uses_adfind",
        "time": 0.0
      },
      {
        "name": "uses_ms_protocol",
        "time": 0.0
      },
      {
        "name": "owa_web_shell_files",
        "time": 0.0
      },
      {
        "name": "web_shell_files",
        "time": 0.0
      },
      {
        "name": "web_shell_processes",
        "time": 0.0
      },
      {
        "name": "dotnet_csc_build",
        "time": 0.0
      },
      {
        "name": "mavinject_lolbin",
        "time": 0.0
      },
      {
        "name": "multiple_explorer_instances",
        "time": 0.0
      },
      {
        "name": "script_tool_executed",
        "time": 0.0
      },
      {
        "name": "suspicious_certutil_use",
        "time": 0.0
      },
      {
        "name": "suspicious_command_tools",
        "time": 0.005
      },
      {
        "name": "suspicious_mpcmdrun_use",
        "time": 0.0
      },
      {
        "name": "suspicious_ping_use",
        "time": 0.0
      },
      {
        "name": "uses_powershell_copyitem",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities",
        "time": 0.005
      },
      {
        "name": "uses_windows_utilities_appcmd",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_csvde_ldifde",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_cipher",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_clickonce",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_curl",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_dsquery",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_esentutl",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_finger",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_mode",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_ntdsutil",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_nltest",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_setx",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_xcopy",
        "time": 0.0
      },
      {
        "name": "wmic_command_suspicious",
        "time": 0.0
      },
      {
        "name": "scrcons_wmi_script_consumer",
        "time": 0.0
      }
    ],
    "reporting": [
      {
        "name": "BinGraph",
        "time": 0.0
      }
    ]
  },
  "target": {
    "category": "file",
    "file": {
      "name": "MediaCreationTool_22H2.exe",
      "path": "/opt/CAPEv2/storage/binaries/690c8a63769d444fad47b7ddecee7f24c9333aa735d0bd46587d0df5cf15cde5",
      "guest_paths": "",
      "size": 19463448,
      "crc32": "A0FB5841",
      "md5": "aa2ad37bb74c05a49417e3d2f1bd89ce",
      "sha1": "1bf5f814ffe801b4e6f118e829c0d2821d78a60a",
      "sha256": "690c8a63769d444fad47b7ddecee7f24c9333aa735d0bd46587d0df5cf15cde5",
      "sha512": "fab34ccbefbcdcec8f823840c16ae564812d0e063319c4eb4cc1112cf775b8764fea59d0bbafd4774d84b56e08c24056fa96f27425c4060e12eb547c2ae086cc",
      "rh_hash": null,
      "ssdeep": "196608:MmtHa+5hH1km/Sf7byFXKEBmih9S5rQ5FNFl001p4Ki:Y+5RB/SDbyFBH9eQD/l00/4",
      "type": "PE32 executable (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1DA17DF0176E99214F1B36B34A9B59291096BBC119935C43EEE7C760DCB3F9B08A7C732",
      "sha3_384": "92641da0240d5fed25e1c3be44f123674c5cda19e370139f457192e6ee2cb8b3f0b783af24f8e36dfa1cc5e0b6ba56d2",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x00400000",
        "entrypoint": "0x000729b0",
        "ep_bytes": "e8a0070000e979fdffffff250cd74700",
        "peid_signatures": null,
        "reported_checksum": "0x01290880",
        "actual_checksum": "0x01290880",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "SetupPrep.pdb",
        "imports": {
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x47d000",
                "name": "GetTokenInformation"
              },
              {
                "address": "0x47d004",
                "name": "SetSecurityDescriptorGroup"
              },
              {
                "address": "0x47d008",
                "name": "RegQueryValueExW"
              },
              {
                "address": "0x47d00c",
                "name": "OpenThreadToken"
              },
              {
                "address": "0x47d010",
                "name": "AddAccessAllowedAce"
              },
              {
                "address": "0x47d014",
                "name": "DuplicateTokenEx"
              },
              {
                "address": "0x47d018",
                "name": "SetSecurityDescriptorControl"
              },
              {
                "address": "0x47d01c",
                "name": "GetLengthSid"
              },
              {
                "address": "0x47d020",
                "name": "RegDeleteValueW"
              },
              {
                "address": "0x47d024",
                "name": "CreateProcessAsUserW"
              },
              {
                "address": "0x47d028",
                "name": "RegOpenKeyExW"
              },
              {
                "address": "0x47d02c",
                "name": "InitializeAcl"
              },
              {
                "address": "0x47d030",
                "name": "InitializeSecurityDescriptor"
              },
              {
                "address": "0x47d034",
                "name": "CheckTokenMembership"
              },
              {
                "address": "0x47d038",
                "name": "FreeSid"
              },
              {
                "address": "0x47d03c",
                "name": "OpenProcessToken"
              },
              {
                "address": "0x47d040",
                "name": "RegSetValueExW"
              },
              {
                "address": "0x47d044",
                "name": "RegSetKeySecurity"
              },
              {
                "address": "0x47d048",
                "name": "CopySid"
              },
              {
                "address": "0x47d04c",
                "name": "RegCreateKeyExW"
              },
              {
                "address": "0x47d050",
                "name": "RegFlushKey"
              },
              {
                "address": "0x47d054",
                "name": "AllocateAndInitializeSid"
              },
              {
                "address": "0x47d058",
                "name": "RegDeleteKeyW"
              },
              {
                "address": "0x47d05c",
                "name": "SetTokenInformation"
              },
              {
                "address": "0x47d060",
                "name": "GetAce"
              },
              {
                "address": "0x47d064",
                "name": "SetSecurityDescriptorOwner"
              },
              {
                "address": "0x47d068",
                "name": "RegQueryInfoKeyW"
              },
              {
                "address": "0x47d06c",
                "name": "RegEnumKeyW"
              },
              {
                "address": "0x47d070",
                "name": "RegCloseKey"
              },
              {
                "address": "0x47d074",
                "name": "RegNotifyChangeKeyValue"
              },
              {
                "address": "0x47d078",
                "name": "SetSecurityDescriptorDacl"
              },
              {
                "address": "0x47d07c",
                "name": "GetTraceEnableLevel"
              },
              {
                "address": "0x47d080",
                "name": "AdjustTokenPrivileges"
              },
              {
                "address": "0x47d084",
                "name": "RegEnumValueW"
              },
              {
                "address": "0x47d088",
                "name": "InitiateSystemShutdownExW"
              },
              {
                "address": "0x47d08c",
                "name": "SetSecurityInfo"
              },
              {
                "address": "0x47d090",
                "name": "RegUnLoadKeyW"
              },
              {
                "address": "0x47d094",
                "name": "QueryAllTracesW"
              },
              {
                "address": "0x47d098",
                "name": "GetTraceLoggerHandle"
              },
              {
                "address": "0x47d09c",
                "name": "StopTraceW"
              },
              {
                "address": "0x47d0a0",
                "name": "UnregisterTraceGuids"
              },
              {
                "address": "0x47d0a4",
                "name": "RegisterTraceGuidsW"
              },
              {
                "address": "0x47d0a8",
                "name": "GetTraceEnableFlags"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x47d114",
                "name": "DeleteFileW"
              },
              {
                "address": "0x47d118",
                "name": "CloseHandle"
              },
              {
                "address": "0x47d11c",
                "name": "GetNativeSystemInfo"
              },
              {
                "address": "0x47d120",
                "name": "LoadLibraryW"
              },
              {
                "address": "0x47d124",
                "name": "FindResourceExW"
              },
              {
                "address": "0x47d128",
                "name": "ResetEvent"
              },
              {
                "address": "0x47d12c",
                "name": "LoadResource"
              },
              {
                "address": "0x47d130",
                "name": "GetOverlappedResult"
              },
              {
                "address": "0x47d134",
                "name": "SetFilePointerEx"
              },
              {
                "address": "0x47d138",
                "name": "LocalFree"
              },
              {
                "address": "0x47d13c",
                "name": "MoveFileExW"
              },
              {
                "address": "0x47d140",
                "name": "ReplaceFileW"
              },
              {
                "address": "0x47d144",
                "name": "LockFileEx"
              },
              {
                "address": "0x47d148",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x47d14c",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x47d150",
                "name": "CreateProcessW"
              },
              {
                "address": "0x47d154",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x47d158",
                "name": "FreeLibrary"
              },
              {
                "address": "0x47d15c",
                "name": "CopyFileW"
              },
              {
                "address": "0x47d160",
                "name": "WideCharToMultiByte"
              },
              {
                "address": "0x47d164",
                "name": "SystemTimeToTzSpecificLocalTime"
              },
              {
                "address": "0x47d168",
                "name": "GetSystemTime"
              },
              {
                "address": "0x47d16c",
                "name": "DosDateTimeToFileTime"
              },
              {
                "address": "0x47d170",
                "name": "GetSystemWindowsDirectoryW"
              },
              {
                "address": "0x47d174",
                "name": "MoveFileW"
              },
              {
                "address": "0x47d178",
                "name": "IsWow64Process"
              },
              {
                "address": "0x47d17c",
                "name": "GetDriveTypeW"
              },
              {
                "address": "0x47d180",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x47d184",
                "name": "FlushFileBuffers"
              },
              {
                "address": "0x47d188",
                "name": "LockResource"
              },
              {
                "address": "0x47d18c",
                "name": "GetCurrentThread"
              },
              {
                "address": "0x47d190",
                "name": "SetEvent"
              },
              {
                "address": "0x47d194",
                "name": "CreateFileA"
              },
              {
                "address": "0x47d198",
                "name": "VerifyVersionInfoW"
              },
              {
                "address": "0x47d19c",
                "name": "IsValidLocale"
              },
              {
                "address": "0x47d1a0",
                "name": "VerSetConditionMask"
              },
              {
                "address": "0x47d1a4",
                "name": "IsValidCodePage"
              },
              {
                "address": "0x47d1a8",
                "name": "MapViewOfFile"
              },
              {
                "address": "0x47d1ac",
                "name": "CreateFileMappingW"
              },
              {
                "address": "0x47d1b0",
                "name": "CreatePipe"
              },
              {
                "address": "0x47d1b4",
                "name": "GetUserDefaultUILanguage"
              },
              {
                "address": "0x47d1b8",
                "name": "GetSystemDefaultUILanguage"
              },
              {
                "address": "0x47d1bc",
                "name": "SearchPathW"
              },
              {
                "address": "0x47d1c0",
                "name": "OutputDebugStringA"
              },
              {
                "address": "0x47d1c4",
                "name": "SleepConditionVariableSRW"
              },
              {
                "address": "0x47d1c8",
                "name": "WakeAllConditionVariable"
              },
              {
                "address": "0x47d1cc",
                "name": "AcquireSRWLockExclusive"
              },
              {
                "address": "0x47d1d0",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x47d1d4",
                "name": "GetLastError"
              },
              {
                "address": "0x47d1d8",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x47d1dc",
                "name": "InitializeCriticalSectionAndSpinCount"
              },
              {
                "address": "0x47d1e0",
                "name": "GetTickCount64"
              },
              {
                "address": "0x47d1e4",
                "name": "LocalFileTimeToFileTime"
              },
              {
                "address": "0x47d1e8",
                "name": "GetTimeZoneInformation"
              },
              {
                "address": "0x47d1ec",
                "name": "Sleep"
              },
              {
                "address": "0x47d1f0",
                "name": "GetExitCodeProcess"
              },
              {
                "address": "0x47d1f4",
                "name": "MultiByteToWideChar"
              },
              {
                "address": "0x47d1f8",
                "name": "CreateEventW"
              },
              {
                "address": "0x47d1fc",
                "name": "GetLogicalDriveStringsW"
              },
              {
                "address": "0x47d200",
                "name": "SetFileAttributesW"
              },
              {
                "address": "0x47d204",
                "name": "GetSystemDirectoryW"
              },
              {
                "address": "0x47d208",
                "name": "OpenEventW"
              },
              {
                "address": "0x47d20c",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x47d210",
                "name": "CreateFileW"
              },
              {
                "address": "0x47d214",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x47d218",
                "name": "SetFilePointer"
              },
              {
                "address": "0x47d21c",
                "name": "FindClose"
              },
              {
                "address": "0x47d220",
                "name": "CreateHardLinkW"
              },
              {
                "address": "0x47d224",
                "name": "CreateMutexW"
              },
              {
                "address": "0x47d228",
                "name": "UnlockFileEx"
              },
              {
                "address": "0x47d22c",
                "name": "SetEndOfFile"
              },
              {
                "address": "0x47d230",
                "name": "GetVersionExW"
              },
              {
                "address": "0x47d234",
                "name": "SetThreadPreferredUILanguages"
              },
              {
                "address": "0x47d238",
                "name": "GetLocaleInfoW"
              },
              {
                "address": "0x47d23c",
                "name": "GetPrivateProfileIntW"
              },
              {
                "address": "0x47d240",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x47d244",
                "name": "GlobalUnlock"
              },
              {
                "address": "0x47d248",
                "name": "GlobalLock"
              },
              {
                "address": "0x47d24c",
                "name": "MulDiv"
              },
              {
                "address": "0x47d250",
                "name": "FindResourceW"
              },
              {
                "address": "0x47d254",
                "name": "SizeofResource"
              },
              {
                "address": "0x47d258",
                "name": "QueryDosDeviceW"
              },
              {
                "address": "0x47d25c",
                "name": "RaiseException"
              },
              {
                "address": "0x47d260",
                "name": "DuplicateHandle"
              },
              {
                "address": "0x47d264",
                "name": "GetShortPathNameW"
              },
              {
                "address": "0x47d268",
                "name": "HeapSize"
              },
              {
                "address": "0x47d26c",
                "name": "HeapReAlloc"
              },
              {
                "address": "0x47d270",
                "name": "IsDebuggerPresent"
              },
              {
                "address": "0x47d274",
                "name": "VirtualQuery"
              },
              {
                "address": "0x47d278",
                "name": "GetPriorityClass"
              },
              {
                "address": "0x47d27c",
                "name": "GetThreadPriority"
              },
              {
                "address": "0x47d280",
                "name": "OutputDebugStringW"
              },
              {
                "address": "0x47d284",
                "name": "GetExitCodeThread"
              },
              {
                "address": "0x47d288",
                "name": "SetThreadPriority"
              },
              {
                "address": "0x47d28c",
                "name": "SetPriorityClass"
              },
              {
                "address": "0x47d290",
                "name": "CreateThread"
              },
              {
                "address": "0x47d294",
                "name": "FormatMessageW"
              },
              {
                "address": "0x47d298",
                "name": "GetPrivateProfileSectionW"
              },
              {
                "address": "0x47d29c",
                "name": "GetFileTime"
              },
              {
                "address": "0x47d2a0",
                "name": "FileTimeToSystemTime"
              },
              {
                "address": "0x47d2a4",
                "name": "CompareFileTime"
              },
              {
                "address": "0x47d2a8",
                "name": "CopyFileExW"
              },
              {
                "address": "0x47d2ac",
                "name": "SetFileInformationByHandle"
              },
              {
                "address": "0x47d2b0",
                "name": "GetFileInformationByHandle"
              },
              {
                "address": "0x47d2b4",
                "name": "DeviceIoControl"
              },
              {
                "address": "0x47d2b8",
                "name": "GetFileInformationByHandleEx"
              },
              {
                "address": "0x47d2bc",
                "name": "SetCurrentDirectoryW"
              },
              {
                "address": "0x47d2c0",
                "name": "GetCurrentDirectoryW"
              },
              {
                "address": "0x47d2c4",
                "name": "GetFinalPathNameByHandleW"
              },
              {
                "address": "0x47d2c8",
                "name": "GetLongPathNameW"
              },
              {
                "address": "0x47d2cc",
                "name": "SetLastError"
              },
              {
                "address": "0x47d2d0",
                "name": "GetTickCount"
              },
              {
                "address": "0x47d2d4",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x47d2d8",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x47d2dc",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x47d2e0",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x47d2e4",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x47d2e8",
                "name": "GetStartupInfoW"
              },
              {
                "address": "0x47d2ec",
                "name": "SetEnvironmentVariableW"
              },
              {
                "address": "0x47d2f0",
                "name": "WaitForMultipleObjects"
              },
              {
                "address": "0x47d2f4",
                "name": "GetModuleFileNameW"
              },
              {
                "address": "0x47d2f8",
                "name": "SetFileTime"
              },
              {
                "address": "0x47d2fc",
                "name": "TerminateProcess"
              },
              {
                "address": "0x47d300",
                "name": "ExpandEnvironmentStringsW"
              },
              {
                "address": "0x47d304",
                "name": "WriteFile"
              },
              {
                "address": "0x47d308",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x47d30c",
                "name": "FindNextFileW"
              },
              {
                "address": "0x47d310",
                "name": "GetFullPathNameW"
              },
              {
                "address": "0x47d314",
                "name": "GetCommandLineW"
              },
              {
                "address": "0x47d318",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x47d31c",
                "name": "CompareStringW"
              },
              {
                "address": "0x47d320",
                "name": "GetFileSizeEx"
              },
              {
                "address": "0x47d324",
                "name": "FindFirstFileW"
              },
              {
                "address": "0x47d328",
                "name": "ReadFile"
              },
              {
                "address": "0x47d32c",
                "name": "CreateDirectoryW"
              },
              {
                "address": "0x47d330",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x47d334",
                "name": "GetProcAddress"
              },
              {
                "address": "0x47d338",
                "name": "HeapAlloc"
              },
              {
                "address": "0x47d33c",
                "name": "GetModuleHandleExW"
              },
              {
                "address": "0x47d340",
                "name": "HeapFree"
              },
              {
                "address": "0x47d344",
                "name": "GetVersionExA"
              },
              {
                "address": "0x47d348",
                "name": "UnmapViewOfFile"
              }
            ]
          },
          "USER32": {
            "dll": "USER32.dll",
            "imports": [
              {
                "address": "0x47d5f4",
                "name": "GetKeyState"
              },
              {
                "address": "0x47d5f8",
                "name": "GetFocus"
              },
              {
                "address": "0x47d5fc",
                "name": "IsChild"
              },
              {
                "address": "0x47d600",
                "name": "GetNextDlgTabItem"
              },
              {
                "address": "0x47d604",
                "name": "GetWindowLongW"
              },
              {
                "address": "0x47d608",
                "name": "RedrawWindow"
              },
              {
                "address": "0x47d60c",
                "name": "CopyRect"
              },
              {
                "address": "0x47d610",
                "name": "DrawFocusRect"
              },
              {
                "address": "0x47d614",
                "name": "SetWindowLongW"
              },
              {
                "address": "0x47d618",
                "name": "SystemParametersInfoW"
              },
              {
                "address": "0x47d61c",
                "name": "GetDC"
              },
              {
                "address": "0x47d620",
                "name": "GetSysColor"
              },
              {
                "address": "0x47d624",
                "name": "GetClientRect"
              },
              {
                "address": "0x47d628",
                "name": "GetParent"
              },
              {
                "address": "0x47d62c",
                "name": "InvalidateRect"
              },
              {
                "address": "0x47d630",
                "name": "LoadStringW"
              },
              {
                "address": "0x47d634",
                "name": "PostMessageW"
              },
              {
                "address": "0x47d638",
                "name": "GetSystemMenu"
              },
              {
                "address": "0x47d63c",
                "name": "GetSysColorBrush"
              },
              {
                "address": "0x47d640",
                "name": "ClientToScreen"
              },
              {
                "address": "0x47d644",
                "name": "GetSystemMetrics"
              },
              {
                "address": "0x47d648",
                "name": "IsWindowVisible"
              },
              {
                "address": "0x47d64c",
                "name": "FillRect"
              },
              {
                "address": "0x47d650",
                "name": "AdjustWindowRectEx"
              },
              {
                "address": "0x47d654",
                "name": "SetCursor"
              },
              {
                "address": "0x47d658",
                "name": "LoadCursorW"
              },
              {
                "address": "0x47d65c",
                "name": "TrackMouseEvent"
              },
              {
                "address": "0x47d660",
                "name": "EnableWindow"
              },
              {
                "address": "0x47d664",
                "name": "EnableMenuItem"
              },
              {
                "address": "0x47d668",
                "name": "DrawTextW"
              },
              {
                "address": "0x47d66c",
                "name": "CharUpperW"
              },
              {
                "address": "0x47d670",
                "name": "GetWindowRect"
              },
              {
                "address": "0x47d674",
                "name": "MessageBoxW"
              },
              {
                "address": "0x47d678",
                "name": "ScreenToClient"
              },
              {
                "address": "0x47d67c",
                "name": "SendMessageW"
              },
              {
                "address": "0x47d680",
                "name": "SetTimer"
              },
              {
                "address": "0x47d684",
                "name": "PostThreadMessageW"
              },
              {
                "address": "0x47d688",
                "name": "KillTimer"
              },
              {
                "address": "0x47d68c",
                "name": "LoadImageW"
              }
            ]
          },
          "MFC42u": {
            "dll": "MFC42u.dll",
            "imports": []
          },
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x47d704",
                "name": "iswspace"
              },
              {
                "address": "0x47d708",
                "name": "bsearch"
              },
              {
                "address": "0x47d70c",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x47d710",
                "name": "__setusermatherr"
              },
              {
                "address": "0x47d714",
                "name": "__p__fmode"
              },
              {
                "address": "0x47d718",
                "name": "_cexit"
              },
              {
                "address": "0x47d71c",
                "name": "_exit"
              },
              {
                "address": "0x47d720",
                "name": "realloc"
              },
              {
                "address": "0x47d724",
                "name": "_errno"
              },
              {
                "address": "0x47d728",
                "name": "_wtoi"
              },
              {
                "address": "0x47d72c",
                "name": "free"
              },
              {
                "address": "0x47d730",
                "name": "towlower"
              },
              {
                "address": "0x47d734",
                "name": "_wcstoui64"
              },
              {
                "address": "0x47d738",
                "name": "wcstoul"
              },
              {
                "address": "0x47d73c",
                "name": "towupper"
              },
              {
                "address": "0x47d740",
                "name": "_vscwprintf"
              },
              {
                "address": "0x47d744",
                "name": "_vsnprintf"
              },
              {
                "address": "0x47d748",
                "name": "_wcsicmp"
              },
              {
                "address": "0x47d74c",
                "name": "wcsrchr"
              },
              {
                "address": "0x47d750",
                "name": "exit"
              },
              {
                "address": "0x47d754",
                "name": "wcsncmp"
              },
              {
                "address": "0x47d758",
                "name": "__set_app_type"
              },
              {
                "address": "0x47d75c",
                "name": "__wgetmainargs"
              },
              {
                "address": "0x47d760",
                "name": "_amsg_exit"
              },
              {
                "address": "0x47d764",
                "name": "__p__commode"
              },
              {
                "address": "0x47d768",
                "name": "_XcptFilter"
              },
              {
                "address": "0x47d76c",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x47d770",
                "name": "wcsstr"
              },
              {
                "address": "0x47d774",
                "name": "wcschr"
              },
              {
                "address": "0x47d778",
                "name": "_purecall"
              },
              {
                "address": "0x47d77c",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x47d780",
                "name": "memcpy_s"
              },
              {
                "address": "0x47d784",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x47d788",
                "name": "__RTDynamicCast"
              },
              {
                "address": "0x47d78c",
                "name": "_ftol2"
              },
              {
                "address": "0x47d790",
                "name": "memcmp"
              },
              {
                "address": "0x47d794",
                "name": "memcpy"
              },
              {
                "address": "0x47d798",
                "name": "_initterm"
              },
              {
                "address": "0x47d79c",
                "name": "_wcmdln"
              },
              {
                "address": "0x47d7a0",
                "name": "memmove"
              },
              {
                "address": "0x47d7a4",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x47d7a8",
                "name": "_controlfp"
              },
              {
                "address": "0x47d7ac",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x47d7b0",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x47d7b4",
                "name": "_onexit"
              },
              {
                "address": "0x47d7b8",
                "name": "__dllonexit"
              },
              {
                "address": "0x47d7bc",
                "name": "_unlock"
              },
              {
                "address": "0x47d7c0",
                "name": "_lock"
              },
              {
                "address": "0x47d7c4",
                "name": "memset"
              }
            ]
          },
          "COMCTL32": {
            "dll": "COMCTL32.dll",
            "imports": [
              {
                "address": "0x47d0b0",
                "name": "InitCommonControlsEx"
              }
            ]
          },
          "ole32": {
            "dll": "ole32.dll",
            "imports": [
              {
                "address": "0x47d828",
                "name": "CoUninitialize"
              },
              {
                "address": "0x47d82c",
                "name": "CoCreateInstance"
              },
              {
                "address": "0x47d830",
                "name": "CoInitializeEx"
              }
            ]
          },
          "SHELL32": {
            "dll": "SHELL32.dll",
            "imports": [
              {
                "address": "0x47d5ec",
                "name": "CommandLineToArgvW"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x47d7cc",
                "name": "NtSetInformationThread"
              },
              {
                "address": "0x47d7d0",
                "name": "NtShutdownSystem"
              },
              {
                "address": "0x47d7d4",
                "name": "RtlAllocateHeap"
              },
              {
                "address": "0x47d7d8",
                "name": "RtlNtStatusToDosError"
              },
              {
                "address": "0x47d7dc",
                "name": "NtSetInformationFile"
              },
              {
                "address": "0x47d7e0",
                "name": "RtlDosPathNameToNtPathName_U_WithStatus"
              },
              {
                "address": "0x47d7e4",
                "name": "RtlFreeHeap"
              },
              {
                "address": "0x47d7e8",
                "name": "NtWriteFile"
              },
              {
                "address": "0x47d7ec",
                "name": "RtlInitUnicodeString"
              },
              {
                "address": "0x47d7f0",
                "name": "NtReadFile"
              },
              {
                "address": "0x47d7f4",
                "name": "RtlReAllocateHeap"
              },
              {
                "address": "0x47d7f8",
                "name": "NtClose"
              },
              {
                "address": "0x47d7fc",
                "name": "RtlExpandEnvironmentStrings"
              },
              {
                "address": "0x47d800",
                "name": "NtQueryInformationFile"
              },
              {
                "address": "0x47d804",
                "name": "NtWaitForSingleObject"
              },
              {
                "address": "0x47d808",
                "name": "NtOpenFile"
              },
              {
                "address": "0x47d80c",
                "name": "NtDuplicateToken"
              },
              {
                "address": "0x47d810",
                "name": "RtlGetVersion"
              },
              {
                "address": "0x47d814",
                "name": "RtlRaiseStatus"
              },
              {
                "address": "0x47d818",
                "name": "NtYieldExecution"
              },
              {
                "address": "0x47d81c",
                "name": "RtlAdjustPrivilege"
              },
              {
                "address": "0x47d820",
                "name": "NtSetInformationProcess"
              }
            ]
          },
          "USERENV": {
            "dll": "USERENV.dll",
            "imports": [
              {
                "address": "0x47d694",
                "name": "DestroyEnvironmentBlock"
              },
              {
                "address": "0x47d698",
                "name": "CreateEnvironmentBlock"
              }
            ]
          },
          "WTSAPI32": {
            "dll": "WTSAPI32.dll",
            "imports": [
              {
                "address": "0x47d6e0",
                "name": "WTSQueryUserToken"
              }
            ]
          },
          "WDSCORE": {
            "dll": "WDSCORE.dll",
            "imports": [
              {
                "address": "0x47d6b8",
                "name": "WdsSetupLogMessageW"
              },
              {
                "address": "0x47d6bc",
                "name": "ConstructPartialMsgVW"
              },
              {
                "address": "0x47d6c0",
                "name": "WdsGenericSetupLogInit"
              },
              {
                "address": "0x47d6c4",
                "name": "CurrentIP"
              },
              {
                "address": "0x47d6c8",
                "name": "WdsSetupLogDestroy"
              }
            ]
          },
          "RPCRT4": {
            "dll": "RPCRT4.dll",
            "imports": [
              {
                "address": "0x47d5d8",
                "name": "I_RpcMapWin32Status"
              },
              {
                "address": "0x47d5dc",
                "name": "UuidToStringW"
              },
              {
                "address": "0x47d5e0",
                "name": "RpcStringFreeW"
              },
              {
                "address": "0x47d5e4",
                "name": "UuidFromStringW"
              }
            ]
          },
          "GDI32": {
            "dll": "GDI32.dll",
            "imports": [
              {
                "address": "0x47d0c8",
                "name": "CreateICW"
              },
              {
                "address": "0x47d0cc",
                "name": "CreateSolidBrush"
              },
              {
                "address": "0x47d0d0",
                "name": "DeleteObject"
              },
              {
                "address": "0x47d0d4",
                "name": "DeleteDC"
              },
              {
                "address": "0x47d0d8",
                "name": "StretchBlt"
              },
              {
                "address": "0x47d0dc",
                "name": "CreateCompatibleDC"
              },
              {
                "address": "0x47d0e0",
                "name": "BitBlt"
              },
              {
                "address": "0x47d0e4",
                "name": "SetBrushOrgEx"
              },
              {
                "address": "0x47d0e8",
                "name": "SetBkMode"
              },
              {
                "address": "0x47d0ec",
                "name": "GetStockObject"
              },
              {
                "address": "0x47d0f0",
                "name": "GetObjectW"
              },
              {
                "address": "0x47d0f4",
                "name": "GetDeviceCaps"
              },
              {
                "address": "0x47d0f8",
                "name": "CreateFontIndirectW"
              },
              {
                "address": "0x47d0fc",
                "name": "CreateDIBSection"
              },
              {
                "address": "0x47d100",
                "name": "TranslateCharsetInfo"
              },
              {
                "address": "0x47d104",
                "name": "CreateDCW"
              },
              {
                "address": "0x47d108",
                "name": "EnumFontFamiliesExW"
              },
              {
                "address": "0x47d10c",
                "name": "SetTextColor"
              }
            ]
          },
          "Cabinet": {
            "dll": "Cabinet.dll",
            "imports": []
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x47d5c4",
                "name": "VariantInit"
              },
              {
                "address": "0x47d5c8",
                "name": "VariantClear"
              },
              {
                "address": "0x47d5cc",
                "name": "SysFreeString"
              },
              {
                "address": "0x47d5d0",
                "name": "SysAllocString"
              }
            ]
          },
          "VERSION": {
            "dll": "VERSION.dll",
            "imports": [
              {
                "address": "0x47d6a8",
                "name": "GetFileVersionInfoExW"
              },
              {
                "address": "0x47d6ac",
                "name": "GetFileVersionInfoSizeExW"
              },
              {
                "address": "0x47d6b0",
                "name": "VerQueryValueW"
              }
            ]
          },
          "WIMGAPI": {
            "dll": "WIMGAPI.DLL",
            "imports": [
              {
                "address": "0x47d6d0",
                "name": "WIMUnmountImage"
              },
              {
                "address": "0x47d6d4",
                "name": "WIMInitFileIOCallbacks"
              },
              {
                "address": "0x47d6d8",
                "name": "WIMSetFileIOCallbackTemporaryPath"
              }
            ]
          },
          "bcrypt": {
            "dll": "bcrypt.dll",
            "imports": [
              {
                "address": "0x47d6e8",
                "name": "BCryptDestroyHash"
              },
              {
                "address": "0x47d6ec",
                "name": "BCryptCloseAlgorithmProvider"
              },
              {
                "address": "0x47d6f0",
                "name": "BCryptFinishHash"
              },
              {
                "address": "0x47d6f4",
                "name": "BCryptOpenAlgorithmProvider"
              },
              {
                "address": "0x47d6f8",
                "name": "BCryptHashData"
              },
              {
                "address": "0x47d6fc",
                "name": "BCryptCreateHash"
              }
            ]
          },
          "UxTheme": {
            "dll": "UxTheme.dll",
            "imports": [
              {
                "address": "0x47d6a0",
                "name": "IsAppThemed"
              }
            ]
          }
        },
        "exported_dll_name": null,
        "exports": [],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x0007d83c",
            "size": "0x000001a4"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x00081000",
            "size": "0x00a8150c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x0128db58",
            "size": "0x000021c0"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x00b03000",
            "size": "0x000066d4"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x00015bf0",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x00004de4",
            "size": "0x00000018"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x00004d38",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x0007d000",
            "size": "0x00000838"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x00077b30",
            "size_of_data": "0x00077c00",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.36"
          },
          {
            "name": ".data",
            "raw_address": "0x00078000",
            "virtual_address": "0x00079000",
            "virtual_size": "0x00003170",
            "size_of_data": "0x00000c00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "4.65"
          },
          {
            "name": ".idata",
            "raw_address": "0x00078c00",
            "virtual_address": "0x0007d000",
            "virtual_size": "0x00002bd4",
            "size_of_data": "0x00002c00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.84"
          },
          {
            "name": ".boxload",
            "raw_address": "0x0007b800",
            "virtual_address": "0x00080000",
            "virtual_size": "0x00000040",
            "size_of_data": "0x00000200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "0.73"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x0007ba00",
            "virtual_address": "0x00081000",
            "virtual_size": "0x00a82000",
            "size_of_data": "0x00a81600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "1.76"
          },
          {
            "name": ".reloc",
            "raw_address": "0x00afd000",
            "virtual_address": "0x00b03000",
            "virtual_size": "0x000066d4",
            "size_of_data": "0x00006800",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.74"
          }
        ],
        "overlay": {
          "offset": "0x00b03800",
          "size": "0x0078c518"
        },
        "resources": [
          {
            "name": "IMAGE",
            "offset": "0x00084714",
            "size": "0x000007e5",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.33"
          },
          {
            "name": "IMAGE",
            "offset": "0x00084efc",
            "size": "0x0000078b",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.29"
          },
          {
            "name": "IMAGE",
            "offset": "0x00085688",
            "size": "0x000007bd",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.29"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x00085e48",
            "size": "0x000211d8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.84"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x000a7020",
            "size": "0x000211d8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.37"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x000c81f8",
            "size": "0x000211d8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.64"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x000e93d0",
            "size": "0x000211d8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.31"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x0010a5a8",
            "size": "0x000211d8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.60"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x0012b780",
            "size": "0x000211d8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.29"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x0014c958",
            "size": "0x00097428",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.69"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x001e3d80",
            "size": "0x00097428",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.20"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x0027b1a8",
            "size": "0x000da8b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.63"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x00355a5c",
            "size": "0x000da8b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.17"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x00430310",
            "size": "0x00097428",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.77"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x004c7738",
            "size": "0x00097428",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.17"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x0055eb60",
            "size": "0x000da8b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.65"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x00639414",
            "size": "0x000da8b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.15"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x00713cc8",
            "size": "0x00097428",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.51"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x007ab0f0",
            "size": "0x00097428",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.15"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x00842518",
            "size": "0x000da8b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.44"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x0091cdcc",
            "size": "0x000da8b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.13"
          },
          {
            "name": "RT_ICON",
            "offset": "0x009f7680",
            "size": "0x00000668",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.80"
          },
          {
            "name": "RT_ICON",
            "offset": "0x009f7ce8",
            "size": "0x000002e8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.88"
          },
          {
            "name": "RT_ICON",
            "offset": "0x009f7fd0",
            "size": "0x000001e8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.61"
          },
          {
            "name": "RT_ICON",
            "offset": "0x009f81b8",
            "size": "0x00000128",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.60"
          },
          {
            "name": "RT_ICON",
            "offset": "0x009f82e0",
            "size": "0x00000ea8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.35"
          },
          {
            "name": "RT_ICON",
            "offset": "0x009f9188",
            "size": "0x000008a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.11"
          },
          {
            "name": "RT_ICON",
            "offset": "0x009f9a30",
            "size": "0x000006c8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.49"
          },
          {
            "name": "RT_ICON",
            "offset": "0x009fa0f8",
            "size": "0x00000568",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.49"
          },
          {
            "name": "RT_ICON",
            "offset": "0x009fa660",
            "size": "0x0000424f",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.91"
          },
          {
            "name": "RT_ICON",
            "offset": "0x009fe8b0",
            "size": "0x000025a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.43"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00a00e58",
            "size": "0x000010a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.60"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00a01f00",
            "size": "0x000009e8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.62"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00a028e8",
            "size": "0x00000468",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.98"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00a02d50",
            "size": "0x00000668",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.80"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00a033b8",
            "size": "0x000002e8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.88"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00a036a0",
            "size": "0x000001e8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.61"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00a03888",
            "size": "0x00000128",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.60"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00a039b0",
            "size": "0x00000ea8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.35"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00a04858",
            "size": "0x000008a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.11"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00a05100",
            "size": "0x000006c8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.49"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00a057c8",
            "size": "0x00000568",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.49"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00a05d30",
            "size": "0x0000424f",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.91"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00a09f80",
            "size": "0x000025a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.43"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00a0c528",
            "size": "0x000010a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.60"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00a0d5d0",
            "size": "0x000009e8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.62"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00a0dfb8",
            "size": "0x00000468",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0e420",
            "size": "0x000000fc",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.60"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0e51c",
            "size": "0x000000f8",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.63"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0e614",
            "size": "0x000000d0",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.50"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0e6e4",
            "size": "0x00000138",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.22"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0e81c",
            "size": "0x000000fc",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0e918",
            "size": "0x0000010c",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0ea24",
            "size": "0x00000110",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.70"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0eb34",
            "size": "0x0000010a",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0ec40",
            "size": "0x000000de",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0ed20",
            "size": "0x00000106",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0ee28",
            "size": "0x000000d6",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.47"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0ef00",
            "size": "0x00000104",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0f004",
            "size": "0x000000f0",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.97"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0f0f4",
            "size": "0x000000c8",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0f1bc",
            "size": "0x000000d0",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0f28c",
            "size": "0x00000120",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0f3ac",
            "size": "0x0000010a",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0f4b8",
            "size": "0x00000110",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.17"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0f5c8",
            "size": "0x000000f8",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0f6c0",
            "size": "0x000000f8",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0f7b8",
            "size": "0x000000ec",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.55"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0f8a4",
            "size": "0x000000e6",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0f98c",
            "size": "0x000000fa",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0fa88",
            "size": "0x000000ec",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0fb74",
            "size": "0x000000fe",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.64"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0fc74",
            "size": "0x000000e0",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0fd54",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0fe48",
            "size": "0x000000ec",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.02"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a0ff34",
            "size": "0x000000f2",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a10028",
            "size": "0x00000110",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a10138",
            "size": "0x00000104",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1023c",
            "size": "0x000000c4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.39"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a10300",
            "size": "0x0000010c",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.02"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1040c",
            "size": "0x00000104",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a10510",
            "size": "0x00000106",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a10618",
            "size": "0x00000106",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a10720",
            "size": "0x00000106",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a10828",
            "size": "0x000000f0",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.97"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a10918",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.46"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a109f4",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a10ae8",
            "size": "0x000000d6",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.55"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a10bc0",
            "size": "0x000000ec",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a10cac",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.95"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a10da0",
            "size": "0x000000da",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "2.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a10e7c",
            "size": "0x00000100",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.59"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a10f7c",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a11070",
            "size": "0x000000f8",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a11168",
            "size": "0x00000110",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.02"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a11278",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.48"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a11354",
            "size": "0x000000e2",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a11438",
            "size": "0x00000114",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1154c",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.70"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a11628",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.55"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a116f4",
            "size": "0x000000fe",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "2.94"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a117f4",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a118e8",
            "size": "0x0000010a",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a119f4",
            "size": "0x00000108",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a11afc",
            "size": "0x000000f6",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a11bf4",
            "size": "0x000000f0",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.55"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a11ce4",
            "size": "0x000000ea",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.92"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a11dd0",
            "size": "0x00000102",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a11ed4",
            "size": "0x000000ea",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.95"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a11fc0",
            "size": "0x00000118",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.63"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a120d8",
            "size": "0x00000102",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a121dc",
            "size": "0x000000fe",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.62"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a122dc",
            "size": "0x000000fa",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.93"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a123d8",
            "size": "0x00000108",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a124e0",
            "size": "0x00000104",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a125e4",
            "size": "0x000000e2",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.94"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a126c8",
            "size": "0x000000d2",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.70"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1279c",
            "size": "0x00000120",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.02"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a128bc",
            "size": "0x00000114",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "2.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a129d0",
            "size": "0x00000130",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a12b00",
            "size": "0x00000110",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.02"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a12c10",
            "size": "0x000000f2",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.95"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a12d04",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a12dbc",
            "size": "0x000000d0",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.26"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a12e8c",
            "size": "0x000000ce",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a12f5c",
            "size": "0x000000d4",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.90"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a13030",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a130fc",
            "size": "0x000000ca",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "2.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a131c8",
            "size": "0x000000d0",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.28"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a13298",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.72"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a13354",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.73"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a13420",
            "size": "0x000000d8",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.85"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a134f8",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a135b0",
            "size": "0x000000ce",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a13680",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1375c",
            "size": "0x000000c0",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1381c",
            "size": "0x000000ac",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "2.93"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a138c8",
            "size": "0x000000c2",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "2.77"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1398c",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a13a58",
            "size": "0x000000d2",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.85"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a13b2c",
            "size": "0x000000c8",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.76"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a13bf4",
            "size": "0x000000ce",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "2.85"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a13cc4",
            "size": "0x000000da",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a13da0",
            "size": "0x000000c6",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.76"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a13e68",
            "size": "0x000000ce",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a13f38",
            "size": "0x000000ce",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.82"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a14008",
            "size": "0x000000d8",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.18"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a140e0",
            "size": "0x000000c6",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a141a8",
            "size": "0x000000ce",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.23"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a14278",
            "size": "0x000000ce",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a14348",
            "size": "0x000000d4",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1441c",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.95"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a144f8",
            "size": "0x000000be",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a145b8",
            "size": "0x000000c6",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a14680",
            "size": "0x000000e8",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.88"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a14768",
            "size": "0x000000d0",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "2.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a14838",
            "size": "0x000000e8",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "2.88"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a14920",
            "size": "0x000000d8",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.85"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a149f8",
            "size": "0x000000c6",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.76"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a14ac0",
            "size": "0x00000170",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.44"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a14c30",
            "size": "0x0000018c",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a14dbc",
            "size": "0x00000178",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.37"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a14f34",
            "size": "0x00000182",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a150b8",
            "size": "0x00000176",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a15230",
            "size": "0x00000198",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a153c8",
            "size": "0x00000194",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.71"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1555c",
            "size": "0x0000016a",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a156c8",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1583c",
            "size": "0x0000017c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a159b8",
            "size": "0x00000160",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.39"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a15b18",
            "size": "0x00000190",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a15ca8",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a15e1c",
            "size": "0x0000016a",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.53"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a15f88",
            "size": "0x00000168",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.46"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a160f0",
            "size": "0x00000194",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a16284",
            "size": "0x0000016e",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.11"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a163f4",
            "size": "0x00000196",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1658c",
            "size": "0x0000017a",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a16708",
            "size": "0x00000184",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1688c",
            "size": "0x0000018e",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.63"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a16a1c",
            "size": "0x00000186",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a16ba4",
            "size": "0x0000018a",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a16d30",
            "size": "0x00000192",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a16ec4",
            "size": "0x000001a2",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a17068",
            "size": "0x0000015c",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a171c4",
            "size": "0x00000190",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.59"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a17354",
            "size": "0x00000192",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a174e8",
            "size": "0x0000016c",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a17654",
            "size": "0x0000018e",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a177e4",
            "size": "0x00000192",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a17978",
            "size": "0x00000170",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.35"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a17ae8",
            "size": "0x0000016a",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a17c54",
            "size": "0x0000019a",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.18"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a17df0",
            "size": "0x00000182",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a17f74",
            "size": "0x0000017a",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.11"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a180f0",
            "size": "0x0000017c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1826c",
            "size": "0x0000017e",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a183ec",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.17"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a18464",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a184d8",
            "size": "0x0000006c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "2.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a18544",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.90"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a185bc",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a18630",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "2.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a186a4",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1871c",
            "size": "0x00000070",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1878c",
            "size": "0x00000070",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.85"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a187fc",
            "size": "0x00000070",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1886c",
            "size": "0x00000070",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a188dc",
            "size": "0x00000070",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1894c",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.76"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a189c0",
            "size": "0x00000070",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.95"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a18a30",
            "size": "0x00000070",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a18aa0",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a18b14",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.73"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a18b88",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a18bfc",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a18c70",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a18ce8",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a18d5c",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a18dd4",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.82"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a18e48",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.18"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a18ec0",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a18f34",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a18fac",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a19020",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a19098",
            "size": "0x0000007c",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.90"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a19114",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.85"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1918c",
            "size": "0x0000006c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a191f8",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a1926c",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a192e0",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a19354",
            "size": "0x00000070",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00a193c4",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.78"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a19438",
            "size": "0x000004c2",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.95"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a198fc",
            "size": "0x000005fe",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.80"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a19efc",
            "size": "0x00000252",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.62"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1a150",
            "size": "0x000005e6",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1a738",
            "size": "0x00000562",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1ac9c",
            "size": "0x00000614",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1b2b0",
            "size": "0x0000066a",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.94"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1b91c",
            "size": "0x000004ae",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1bdcc",
            "size": "0x00000532",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1c300",
            "size": "0x000006ea",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1c9ec",
            "size": "0x000004bc",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.95"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1cea8",
            "size": "0x000005a0",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.51"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1d448",
            "size": "0x0000065e",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1daa8",
            "size": "0x00000368",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.86"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1de10",
            "size": "0x00000316",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.20"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1e128",
            "size": "0x00000538",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1e660",
            "size": "0x000005da",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1ec3c",
            "size": "0x0000065a",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1f298",
            "size": "0x0000057c",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1f814",
            "size": "0x00000532",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.39"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a1fd48",
            "size": "0x00000642",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.85"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2038c",
            "size": "0x0000064a",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a209d8",
            "size": "0x000005c0",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.50"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a20f98",
            "size": "0x000005b0",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a21548",
            "size": "0x00000522",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.10"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a21a6c",
            "size": "0x00000508",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a21f74",
            "size": "0x0000061e",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.92"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a22594",
            "size": "0x00000608",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a22b9c",
            "size": "0x00000568",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a23104",
            "size": "0x000005f4",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.47"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a236f8",
            "size": "0x0000051e",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.51"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a23c18",
            "size": "0x0000023a",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a23e54",
            "size": "0x00000668",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.20"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a244bc",
            "size": "0x00000620",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a24adc",
            "size": "0x0000067e",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.20"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2515c",
            "size": "0x00000734",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a25890",
            "size": "0x00000654",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a25ee4",
            "size": "0x000003fc",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.94"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a262e0",
            "size": "0x000005e0",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.76"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a268c0",
            "size": "0x000001d6",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.86"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a26a98",
            "size": "0x00000594",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2702c",
            "size": "0x00000584",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a275b0",
            "size": "0x00000626",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a27bd8",
            "size": "0x0000068a",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.85"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a28264",
            "size": "0x000004c4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a28728",
            "size": "0x000004ce",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a28bf8",
            "size": "0x0000068a",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a29284",
            "size": "0x0000043c",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.84"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a296c0",
            "size": "0x00000544",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.53"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a29c04",
            "size": "0x000005f4",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2a1f8",
            "size": "0x000002f4",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "5.04"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2a4ec",
            "size": "0x00000290",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.47"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2a77c",
            "size": "0x000005d2",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2ad50",
            "size": "0x00000560",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2b2b0",
            "size": "0x000005c4",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.58"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2b874",
            "size": "0x00000584",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2bdf8",
            "size": "0x000005a6",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2c3a0",
            "size": "0x00000596",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.82"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2c938",
            "size": "0x000005ae",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2cee8",
            "size": "0x00000572",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.54"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2d45c",
            "size": "0x000004ca",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2d928",
            "size": "0x000004de",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.01"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2de08",
            "size": "0x0000052a",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.61"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2e334",
            "size": "0x0000054c",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.91"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2e880",
            "size": "0x000005de",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2ee60",
            "size": "0x000004ce",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2f330",
            "size": "0x0000059a",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2f8cc",
            "size": "0x000004de",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2fdac",
            "size": "0x000001d4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.83"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a2ff80",
            "size": "0x000004da",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a3045c",
            "size": "0x00000636",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a30a94",
            "size": "0x000005de",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a31074",
            "size": "0x0000064c",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a316c0",
            "size": "0x0000068a",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a31d4c",
            "size": "0x0000055c",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a322a8",
            "size": "0x0000379c",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.53"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a35a44",
            "size": "0x00004068",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.61"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a39aac",
            "size": "0x00002848",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.75"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a3c2f4",
            "size": "0x0000317c",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.47"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a3f470",
            "size": "0x00003eb4",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.93"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a43324",
            "size": "0x000041b6",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.01"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a474dc",
            "size": "0x0000459e",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.73"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a4ba7c",
            "size": "0x00003a2e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.87"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a4f4ac",
            "size": "0x00003fca",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.94"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a53478",
            "size": "0x00004346",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a577c0",
            "size": "0x00003508",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a5acc8",
            "size": "0x00003d1e",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.03"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a5e9e8",
            "size": "0x000043e6",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.91"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a62dd0",
            "size": "0x00002d4c",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.83"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a65b1c",
            "size": "0x00002cd0",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.75"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a687ec",
            "size": "0x00003ebc",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "2.94"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a6c6a8",
            "size": "0x00003dd4",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.92"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a7047c",
            "size": "0x00003e68",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.09"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a742e4",
            "size": "0x00003e50",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a78134",
            "size": "0x00003dfc",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "2.98"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a7bf30",
            "size": "0x00004212",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.66"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a80144",
            "size": "0x00003e8c",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a83fd0",
            "size": "0x00003f70",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a87f40",
            "size": "0x00003c2a",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.94"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a8bb6c",
            "size": "0x00003ad6",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.83"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a8f644",
            "size": "0x00003c70",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.06"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a932b4",
            "size": "0x00004080",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.68"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a97334",
            "size": "0x00003eb4",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a9b1e8",
            "size": "0x00003bee",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.94"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00a9edd8",
            "size": "0x00003dae",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00aa2b88",
            "size": "0x00003aba",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.97"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00aa6644",
            "size": "0x000027b0",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.66"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00aa8df4",
            "size": "0x000039ec",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "2.88"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00aac7e0",
            "size": "0x000041d4",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.91"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ab09b4",
            "size": "0x000040c2",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "2.93"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ab4a78",
            "size": "0x000035be",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ab8038",
            "size": "0x0000430c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00abc344",
            "size": "0x00003ecc",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.98"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ac0210",
            "size": "0x00000fcc",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.87"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ac11dc",
            "size": "0x0000139a",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.77"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ac2578",
            "size": "0x000007e8",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ac2d60",
            "size": "0x00001004",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.57"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ac3d64",
            "size": "0x0000116a",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.18"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ac4ed0",
            "size": "0x0000136e",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ac6240",
            "size": "0x000014d8",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.89"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ac7718",
            "size": "0x00001026",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.15"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ac8740",
            "size": "0x00001170",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ac98b0",
            "size": "0x0000141e",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00acacd0",
            "size": "0x00000de0",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.85"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00acbab0",
            "size": "0x0000117a",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00accc2c",
            "size": "0x000012fe",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.12"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00acdf2c",
            "size": "0x00000abe",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.85"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ace9ec",
            "size": "0x00000a48",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "4.92"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00acf434",
            "size": "0x00001264",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ad0698",
            "size": "0x00001190",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.20"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ad1828",
            "size": "0x00001298",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.39"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ad2ac0",
            "size": "0x000012e2",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ad3da4",
            "size": "0x00001292",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ad5038",
            "size": "0x000012f0",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.86"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ad6328",
            "size": "0x0000119a",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ad74c4",
            "size": "0x0000116a",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ad8630",
            "size": "0x0000116c",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.15"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ad979c",
            "size": "0x00000fcc",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.13"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ada768",
            "size": "0x000010a2",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00adb80c",
            "size": "0x0000123e",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.92"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00adca4c",
            "size": "0x00001158",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00addba4",
            "size": "0x0000114c",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.18"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00adecf0",
            "size": "0x00001092",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00adfd84",
            "size": "0x00001014",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae0d98",
            "size": "0x000007be",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae1558",
            "size": "0x00001044",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.15"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae259c",
            "size": "0x000013f6",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.13"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae3994",
            "size": "0x0000130c",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae4ca0",
            "size": "0x0000132a",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae5fcc",
            "size": "0x000013b2",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae7380",
            "size": "0x0000124e",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae85d0",
            "size": "0x0000002c",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "1.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae85fc",
            "size": "0x00000042",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.47"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8640",
            "size": "0x00000024",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "0.90"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8664",
            "size": "0x0000002c",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8690",
            "size": "0x0000002c",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "0.99"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae86bc",
            "size": "0x0000002c",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "1.03"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae86e8",
            "size": "0x0000002e",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.71"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8718",
            "size": "0x00000030",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "1.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8748",
            "size": "0x0000002e",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8778",
            "size": "0x00000036",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "1.45"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae87b0",
            "size": "0x0000002e",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.71"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae87e0",
            "size": "0x0000002e",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8810",
            "size": "0x0000002a",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "0.91"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae883c",
            "size": "0x00000028",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8864",
            "size": "0x00000026",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "1.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae888c",
            "size": "0x00000032",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "1.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae88c0",
            "size": "0x00000032",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "1.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae88f4",
            "size": "0x0000002c",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.18"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8920",
            "size": "0x00000032",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "1.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8954",
            "size": "0x0000002e",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "1.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8984",
            "size": "0x0000003c",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "2.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae89c0",
            "size": "0x0000002a",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "0.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae89ec",
            "size": "0x0000002e",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8a1c",
            "size": "0x0000002e",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "1.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8a4c",
            "size": "0x00000036",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.13"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8a84",
            "size": "0x0000003e",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.61"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8ac4",
            "size": "0x00000042",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8b08",
            "size": "0x0000002a",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "0.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8b34",
            "size": "0x00000032",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8b68",
            "size": "0x00000034",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.53"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8b9c",
            "size": "0x00000028",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "0.83"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8bc4",
            "size": "0x00000024",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "0.90"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8be8",
            "size": "0x00000030",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "1.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8c18",
            "size": "0x00000032",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "1.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8c4c",
            "size": "0x00000030",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "1.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8c7c",
            "size": "0x00000036",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "1.45"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8cb4",
            "size": "0x00000026",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "0.70"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8cdc",
            "size": "0x0000005c",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "2.94"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8d38",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.67"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8d88",
            "size": "0x00000044",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "2.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8dcc",
            "size": "0x0000005e",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.56"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8e2c",
            "size": "0x00000048",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8e74",
            "size": "0x0000007e",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "2.57"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8ef4",
            "size": "0x00000056",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.95"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8f4c",
            "size": "0x00000056",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae8fa4",
            "size": "0x0000005c",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9000",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9050",
            "size": "0x00000052",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.76"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae90a4",
            "size": "0x0000007a",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.69"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9120",
            "size": "0x0000004a",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.11"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae916c",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae91bc",
            "size": "0x00000050",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.00"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae920c",
            "size": "0x0000004c",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "2.18"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9258",
            "size": "0x0000004a",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.15"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae92a4",
            "size": "0x0000004c",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae92f0",
            "size": "0x00000052",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9344",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "2.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9394",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "2.71"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae93e4",
            "size": "0x00000050",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9434",
            "size": "0x00000054",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9488",
            "size": "0x00000048",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.11"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae94d0",
            "size": "0x00000050",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.80"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9520",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.67"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9598",
            "size": "0x00000052",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.84"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae95ec",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae963c",
            "size": "0x00000050",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae968c",
            "size": "0x00000062",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.68"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae96f0",
            "size": "0x00000058",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9748",
            "size": "0x00000044",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "2.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae978c",
            "size": "0x0000004a",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.11"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae97d8",
            "size": "0x0000004a",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "2.08"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9824",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "2.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9874",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae98c4",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9914",
            "size": "0x00000092",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.50"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae99a8",
            "size": "0x0000007e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.06"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9a28",
            "size": "0x0000008e",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9ab8",
            "size": "0x00000076",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9b30",
            "size": "0x00000092",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9bc4",
            "size": "0x0000007e",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9c44",
            "size": "0x00000110",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9d54",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9e20",
            "size": "0x000000c0",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9ee0",
            "size": "0x000000e4",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ae9fc4",
            "size": "0x000000d8",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.18"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00aea09c",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.41"
          },
          {
            "name": "RT_RCDATA",
            "offset": "0x00aea190",
            "size": "0x0000ded0",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "5.13"
          },
          {
            "name": "RT_GROUP_ICON",
            "offset": "0x00af8060",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.08"
          },
          {
            "name": "RT_GROUP_ICON",
            "offset": "0x00af811c",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.13"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00af81d8",
            "size": "0x000003ac",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.60"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00af8584",
            "size": "0x000003d4",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.87"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00af8958",
            "size": "0x000003a4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.60"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00af8cfc",
            "size": "0x000003b4",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.57"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00af90b0",
            "size": "0x000003c4",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.53"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00af9474",
            "size": "0x000003ac",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.54"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00af9820",
            "size": "0x000003e4",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.04"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00af9c04",
            "size": "0x000003b0",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.52"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00af9fb4",
            "size": "0x000003c4",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afa378",
            "size": "0x000003cc",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.55"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afa744",
            "size": "0x000003c4",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.72"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afab08",
            "size": "0x000003b4",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afaebc",
            "size": "0x000003c8",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.52"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afb284",
            "size": "0x000003a8",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afb62c",
            "size": "0x000003ac",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.63"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afb9d8",
            "size": "0x000003b4",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.55"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afbd8c",
            "size": "0x000003bc",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.52"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afc148",
            "size": "0x000003d0",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afc518",
            "size": "0x000003d0",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.52"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afc8e8",
            "size": "0x000003c0",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.52"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afcca8",
            "size": "0x000003cc",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.96"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afd074",
            "size": "0x000003dc",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afd450",
            "size": "0x000003c8",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.57"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afd818",
            "size": "0x000003c0",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.53"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afdbd8",
            "size": "0x00000398",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.80"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afdf70",
            "size": "0x000003ac",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.58"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afe31c",
            "size": "0x000003c8",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.94"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afe6e4",
            "size": "0x000003d4",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afeab8",
            "size": "0x000003c4",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00afee7c",
            "size": "0x000003bc",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00aff238",
            "size": "0x000003bc",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.60"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00aff5f4",
            "size": "0x000003a4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.61"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00aff998",
            "size": "0x000003e4",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.53"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00affd7c",
            "size": "0x000003d0",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.53"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00b0014c",
            "size": "0x000003e4",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.53"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00b00530",
            "size": "0x000003e4",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.55"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00b00914",
            "size": "0x000003c4",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.55"
          },
          {
            "name": "RT_MANIFEST",
            "offset": "0x00b00cd8",
            "size": "0x00001831",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.65"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "‎‎إعداد Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0401 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Инсталираща програма на Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Всички права запазени."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Операционна система Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0402 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 安裝程式"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0404 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Instalace Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Všechna práva vyhrazena."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Operační systém Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0405 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 Installation"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Alle rettigheder forbeholdes."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operativsystem"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0406 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 Setup"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Alle Rechte vorbehalten."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Betriebssystem Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0407 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Εγκατάσταση των Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Με επιφύλαξη κάθε νόμιμου δικαιώματος."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Λειτουργικό σύστημα Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0408 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 Setup"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10:n asennus"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Kaikki oikeudet pidätetään."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® -käyttöjärjestelmä"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x040b 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Installation de Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Tous droits réservés."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Système d’exploitation Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x040c 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "‏‏‎‎תוכנית ההתקנה של Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x040d 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 telepítő"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Minden jog fenntartva."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® operációs rendszer"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x040e 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Installazione di Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Tutti i diritti riservati."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Sistema operativo Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0410 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 セットアップ"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0411 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 설치 프로그램"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0412 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 Setup"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Alle rechten voorbehouden."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows®-besturingssysteem"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0413 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Installasjonsprogram for Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Med enerett."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Operativsystemet Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0414 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Instalator systemu Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Wszelkie prawa zastrzeżone."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "System operacyjny Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0415 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Instalação do Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Todos os direitos reservados."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Sistema Operacional Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0416 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Instalare Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Toate drepturile rezervate."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Sistem de operare Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0418 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Программа установки Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Корпорация Майкрософт. Все права защищены."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Операционная система Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0419 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Program za instalaciju sustava Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Sva prava pridržana."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Operacijski sustav Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x041a 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Inštalátor systému Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Všetky práva vyhradené."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x041b 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Installationsprogram för Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Med ensamrätt."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Operativsystemet Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x041d 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "ตั้งค่า Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation สงวนลิขสิทธิ์"
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "ระบบปฏิบัติการ Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x041e 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 Kurulumu"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Tüm hakları saklıdır."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® İşletim Sistemi"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x041f 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Програма інсталяції Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Корпорація Майкрософт. Усі права захищені."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Операційна система Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0422 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Namestitveni program za Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Vse pravice pridržane."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Operacijski sistem Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0424 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 installiprogramm"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Kõik õigused kaitstud."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Operatsioonisüsteem Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0425 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 uzstādīšana"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Visas tiesības paturētas."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Operētājsistēma Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0426 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "„Windows 10“ sąranka"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© „Microsoft Corporation“. Visos teisės ginamos."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Operacinė sistema „Microsoft® Windows®“"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0427 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 安装程序"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0804 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Programa de instalación de Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Todos los derechos reservados."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Sistema operativo Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x080a 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Configuração do Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Todos os direitos reservados."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Sistema Operativo Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0816 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Programa de instalación de Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Todos los derechos reservados."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Sistema operativo Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0c0a 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Programme d'installation de Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Tous droits réservés."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Système d’exploitation Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0c0c 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Instalacija izdanja Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupPrep.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Sva prava zadržana."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupPrep.exe"
          },
          {
            "name": "ProductName",
            "value": "Operativni sistem Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x241a 0x04b0"
          }
        ],
        "imphash": "d715fe1c9f60fa2c4d89588b638bb8e6",
        "timestamp": "1974-05-29 19:08:33",
        "icon": "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAHWUlEQVR4nO2YWWwdVxnHf+fMzF1tX+9xYqfOWieOs7goTVpKKTRKA6qgEAgg9QGE1IJ4QEjwgEBVQJHgDd7KS5/Y1JKoKUFUKk1YwhZKA01j4pSgJk0c3zhNvNxt7sxZeLj32jderh3HYZH8l0ajq/HM+f3Pd77vfMewrGXdkcR/cjClVGU8UXXZqgvXde3tfFMuJeBcUkoJpZQEHCACRMtX5KkffTG19Vv9KxbLctcjUAaXgAt4vzr3avzrL35z85XRK525Yr6jsalttVvvxZ0xdfDCocFrtxsB965QM7lcRHkM79iZX6S+cfSZnZfGh3Z3PrTlPTv6PrK2Y013R/qdi5dO/eDosace+GyGqSW1YN2VCJThK7Me3f3dh3a+MXT2ka599z+y64Pv22liNtrlrlSv/vAnR66cPv+znhU9fz35tV8PAfp2I7DkBqbBx3sPbvvARCzc1/e5xz6ZaK1rinoea1gd/PK5517I/evG4QuHBk8ARUAB9n9hCVWWTWzLwe17/DY+9uDnP3MgiBdcZRT9Yqt+4dnv/1ikiy9dODT4WyAE9GLgYYmrUHn2HSCy7dv3vd9fIZ547xeePODH867RPuvcbv5w6pXfi3Tx5TPPnP4d4JcNmMXAwxIaqFo63p7v7ds2osce3fX0J/ZPREZdUKz0ulFhfmjg8Imf/vxLL55cCnhY2ggIwAMSg+nzO/q//NH9oadixoRoAe10cPzZ51/etfb+gTUt3VmWAL4y6Jx6/cyZMaVNSmk9y9PSuLY8vBAgpeTc9UFOqFOEH+7gph3GxSMiEnQHLaSOZNm7fi/KaLQxWAvWWrBgqfqNQEqBHwSkb9wYevpTB7rmYqyZxEWlUtb1ePPsmwR+sUQrxCS1rdyxuI6LF4nwm6vH8b7aQ54MHlEytsBK0c7bJwbovdHJXyZOEyqFVgZjbfkbt8LH43GaWppJNqS4OjSUqsVY04DSmn8MDHD0rY2zPhcChJA4nqQuHsGLTnAh1cp9TophO4JAcN2Oso5NXB7uIFj1JFecNnxlMAassVhrMMZijMEajTEGozV63PBg+EeK+XwtxPlzQCs18yUBUoLnusRiLnXxCA3JKHnzNo27GxhnHM96jOssaXWDKBGcCUOqrpmIA54UeNIihQEsTIfXpXtjfR3SrV3paz4VgBSzeBQl+GjUJR5xSCYipOqiXB15l7beFBmuEaiAa2qUTJijGA2I4pCKRXAxSCyBAmEFRmusnQlvtCIWjSIdZ/EGJl1U/xQgpQNOnpHCWUYnBvE8F8+RuK5kk7eDN8LLZMIco8VRtAoICfCV5shr38FYizYWYywdqe20JPsRtg47DV4rjRBiMs8Wb2C6HyFxXMl4eB65d4Q9ux+gmQQxPASSi1yEQDHmj5MvZsAPeD32N9Z8pYvAL1Io+gS+TxAEvPXaTdanJe3J3TPgjdZY7NIaEFIiHYmUDu112xk/KRisv0Rsi+JdP02DiSM0hIFPpjCGKgRQDDn/zz9z3tdQVBCGOM1rWXdlMz3XHqY52YdSM+FVqKqOOXOrZhJbqup8Bd5xkI5DJJKiI9WPc7wNddGjIdZMNshhghC/WCCfz2JzBcgWIRtAzod8AKl7WD98L73DD9Oe3IqwSbTW6GnwKgzLY9d2UNtAeQYq8I7j4Lgu0nWx0iHitbKisZ9rz9/EvBPFTSTJ5ifw8xmKmSzkgpKBfAi+hlQn3SMbaBpop62uD0EjKtRoNRNehyEWOzWDizFQ8m9vgXe8kgEhHTQOkUgnO1Z/mvHDOcxQBD/mkcmOYbJ+adb9AAoB1HfSNbaBjsFOtqzaD6YVP1CEYYiaBV6FIVg7H/98BkpJVA1fuQvXBemgrCAW66av8+P4L4G+HmPCjaNyBcirUhQaVrIidw+dg91saX8CR3RQCBRhMDe8DlXV7rxIA5UPTIev3HEcrJCEBhLxjfR2PE7klQSpfAu6vrU0+w0raSp0s+bcRja3PY4jOyn4Jdha8KUN1M57vqxZhay1WOys8KVkliAkGkFRGerjvWxq1+g/HSOzbYJ0XZ561cWGwR42tX6IiNNNvlBaNmFYG14rhUXOa2GeMlrqFOeCl1KCFBgLaCgaTUO8l41NRcLTmsKqkPWXe7i35TGi7noKvl4wvNGahZzx54lA6fVa8BWf2loMBqMtqdg2+lrraBn5O+2tfcScLgq+JgiCBcMbYya/vfgIlF+eD97aqa5SWwNW48ouVjeuQmlDwQ9RSt02/HwVaF4DlQqwEHhb1RJbY27pbbRW8ybsjJmvSNT+x0ntCAiIJ5JIvXD42brK2TaphcA7Ut7ZRiaFoLm1+b8CXxnfmDtIYj8MiSeSPNpwivpEgojnTRmoOgaWkr3Ud1QmrFKCbbmhstXPytUN62BxYNq7Ukq01lzPZCnkcos3MJwezqXT6WQhl8f1PISQ5TVZDV85lNvyGRewZsoAUz3V5N+Xd/ipuZ3ZMmil8AsFlNbFmg6WtaxlLWtZy1rWspb1/6t/Ay5Oahn19l3HAAAAAElFTkSuQmCC",
        "icon_hash": "60608a07d112ace9d7a180ee9deaa3d4",
        "icon_fuzzy": "bc85df9c7cdf2d8ba0f53a0f681e6f31",
        "icon_dhash": "6060f0d8ecfc4000",
        "imported_dll_count": 20
      },
      "data": null,
      "strings": [
        ",LgCA",
        "te pred prv",
        "Potpuno",
        "o&,v$K",
        "wZc#w",
        "~ze t(~",
        "G8U#j2",
        "Dq6.@",
        "ati uporabni",
        "s. Tas darbojas ar sist",
        " Microsoft Corporation. Med ensamr",
        "rm]ko",
        "X9oUF",
        "DYyqp",
        " ocorrendo em um local da rede e pode ter atingido uma interrup",
        "su1U,",
        "hB^=-",
        "a de instalare a mo",
        ".Nj5M",
        "@Instalacijski program ne mo",
        "u, jGd",
        "ar-MA",
        "Guida",
        "Prebacivanje: / installdrivers <lokacija> ",
        " wyst",
        "http://www.w3.org/XML/1998/namespace",
        "uXj S",
        "PHAMD",
        "e^.k?",
        ",E|zO",
        "ml-IN",
        ")\\P!r",
        "<glyf",
        "v@\"ya",
        "* JJt",
        "$(G!|b",
        "gpMJlv",
        "Error retrieving process exit code!  Error = 0x%X",
        "SrX50wD",
        "' 0{~",
        "Qc%Q]",
        "Pl%@Gx",
        "zswi|",
        "b.kY7",
        "w i w ",
        "&g+Ldx]+",
        "0n+Ogp",
        "Ex,\"9",
        "}t;i ",
        "seau au chemin d",
        ",$]Yg",
        ".CRT$XIY",
        "Hh_.Kh",
        "BjUAl",
        "#YOhme",
        "al*#T,",
        "Akcja: W przypadku niepowodzenia Instalator skopiuje lub przeka",
        "k\"Y4M",
        "]\\k;[",
        "dHY_!",
        "E?{Q=",
        "o*aG#",
        "\\C)\\#",
        "^32Dt",
        "M/!qw",
        "w+8UA",
        "o[RC}",
        "az-Cyrl-AZ",
        "\"WBIK",
        "ESD\\Download",
        "ste znova.dAk nain",
        ">^y{B",
        ":Q;Zy^U",
        ":K$Kb",
        "Ej6@%",
        "\\*]D&B@",
        "N)Pee",
        "Ayuda",
        "}H`wi",
        "_hq>l",
        "d+w}ogdd",
        "4a^tu@P",
        "u@ZY!",
        "O9jgf",
        "=8T[Hj",
        "naamilise v",
        "!wj{O",
        "l{@qk",
        "_nmKQ!",
        "ZB1lC",
        "Aktion: F",
        "e:;F_{2",
        "i/R3+!8g!",
        "1&^ArW",
        "4tf#T",
        "UsV'<",
        "wB1jg",
        "gezhet",
        "4#5s5_h",
        "D[jhP",
        "X\\*/iR7",
        "installation d",
        "&D6IT",
        "z\\lll",
        "#&\\}W",
        "&\"/%HbP",
        "k6|5'",
        "{:k9\\Z",
        "e.ELe programme d",
        "V}<{8",
        "]O5)m",
        "-u76jq",
        "jsn9s",
        "m_viT",
        "\"cZTL",
        "FileCount",
        "& pBT",
        "FN#YF",
        "n se est",
        ": / Postoobe <location>\\setupcomplete.cmd ",
        "CG<IsR\"",
        "3'6y+",
        "U~Eg?x!",
        "VgGv16",
        " sa in",
        "!c&f<",
        "3H.},d",
        "bY8sF",
        "Veiksmas: nurodo, ar s",
        "+>N]x",
        "'92KL",
        "'bU!#",
        "9<9l9",
        "As:nb",
        "bZGwS'",
        ";C;l;v;",
        "kErwq",
        "%Q!n[?",
        ": / PBRUpdate",
        "IZKa)f",
        ":IvY4",
        "ho umiestnenia. Setuprolback.cmd je prisp",
        "@=EAS",
        ";M+5YF",
        "$C95H",
        "nario d",
        "2!/[s",
        "^QTdQr",
        "vEYtU",
        "e=8^:",
        "Pyu#1A$",
        "\\#.]|Mr",
        "SetSecurityDescriptorDacl",
        "4 5;5f5",
        "e\\gd'",
        "w(IO<X=",
        "3;kU{",
        "2QyT`",
        "]jXGqR",
        "JNdh'",
        "4eGha\"`",
        "3#3H3^3i3",
        ")5m~P",
        "dZlv^",
        "z!!NO",
        "?pm+A",
        "LockFileEx",
        "(<Z{q&O",
        "~/\\lO",
        "Ot_O<`otrK",
        "xjg2m",
        "#Zn>4",
        "DQ<E/",
        "~]no{",
        "5;edW",
        "b9[,f",
        " : / Postrollback <location> ",
        "jQ>hj",
        "gzr<c",
        "}nj$:T",
        "(3,U{",
        "KK'''",
        " driver.infs, ",
        "Otvaod3",
        "installation ",
        "4Kw2M[",
        "YQc>y",
        "E<wh%@",
        "^K6j7,",
        ";}R?!",
        "D\\UTB",
        ":J;5j",
        "0?4$A0",
        ")W3=G,",
        "Ay7\"9F",
        "e>Q\"`s",
        "SetupCleanupTask",
        "3U{ewt&%",
        "P,/PnYi",
        "?f]WwQg",
        "d|W`04",
        "|ba=XF?",
        "U#AGf",
        "]k3DWp1",
        "| yM8",
        "W9a32",
        "cfv^)",
        "$bTyp",
        "^|#|,",
        "y>][dg",
        "7`E\\J",
        "&`w6O",
        "6C6k6",
        "7S2IS",
        "292H2b2p2",
        "Por ejemplo: setup.exe / auto upgrade / Telemetry enable",
        "anje poteka z omre",
        "cb#d3M",
        "-50XX",
        " permisiunile utilizatorului",
        "L]\"n8",
        "f8LU}",
        "QHkx',",
        "tNMIq5\"^",
        ") G}.",
        ";XGy#",
        "WVhp)A",
        "2n*gn",
        "yCzKe",
        "'YOH<",
        "/PE'!",
        "2M2W2",
        "Ld~FO",
        " a telemetria gerada pela instala",
        "bY8/|",
        "{I^?Q5",
        "2.t )",
        "JC]lHC]lMC]",
        ".}x&y",
        "2^F;2",
        "L%9fR",
        "ee5:g",
        "S`ubM`",
        "JOp.7",
        " napr",
        "<!<'<E<V<[<a<",
        "fYs8 ",
        "@%EIl",
        " c%+GN",
        "Detet",
        ". Upozor",
        "\\0t-A",
        "6cu/YF",
        "<FP|mj",
        ">eara3i",
        "[%Z#DW",
        "wa$yB",
        "gt. Dabei werden alle Unterordner des angegebenen Speicherorts von Setup rekursiv durchsucht. ",
        "Example: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        ">[f<=|",
        "444C4P4f4s4",
        ".;+dg",
        "kVxgJj",
        "aAkhA",
        ";\"<E<h<",
        "Fw-%2",
        "($5^=a",
        ")V3R%r",
        "y]z1F",
        "*q.x&",
        "ppp@@@@@@@@@@@@@@@@@@@@@",
        "h=\"Lk\"",
        "PCZ\"i",
        "[.c^&",
        "&fAET-",
        "95@DS`",
        "qk~_[x~i",
        "1zW`t",
        "eE^ S?",
        "ventana",
        "*4I}/",
        "S4j35L",
        "nR\"CC",
        "Z`K-!K",
        "Ak3msy",
        "9x>j ",
        "@v[l}q7",
        "CDlpRegistrar::RegisterResponseFactory",
        "H<&04",
        "[<qU(2",
        "Vj+}E",
        "PripravljanjeCNamestitveni program ne more zagnati podedovane izku",
        "Xj7j<",
        "yet, start PC-en p",
        "Aktion: Der PC wird bei der Ausf",
        " nytt, og pr",
        ":MrOr",
        "; ;-;8;L;`;",
        "0Dzjv(",
        " nytt.",
        "I$54o",
        "J&1~1+",
        "xel: / DynamicUpdate <parameter> ",
        "galement collecter des journaux et autres informations de diagnostic ",
        ":;F^{",
        "~We]L",
        "Alternatively, a deployment engineer may want to collect logs and other diagnostic information from test PCs in the event of a failure. The following command line instructs set-up invoke the setuprollback.cmd script after an installation failure : ",
        "79n\\+A",
        "tyZ4g",
        "fz\\pB",
        "jlok miatt nem tud elindulni. Ha kor",
        " le programme d",
        "l24Uob",
        "<#sS:Y",
        "MZS[q",
        "n6otT",
        "klenmeye haz",
        "sX1.[-",
        ".5{,~Go",
        "ff-Latn-SN",
        "nQ']J",
        "fD#6*",
        "[-`ZQ",
        "')U#a",
        " komputery w dziale z systemu Windows 7 Enterprise. Chce to zrobi",
        ">!>&>2>=>Q>n>u>{>",
        "0W0f0K0",
        "$;T:b",
        "2<2<A",
        ")H:8i",
        "SPCleanupInstallationDrive: Failure while building path to Setup Platform working directory. Error: 0x%08X",
        "Qe+Zn;",
        "fi-FI",
        "*4QT!",
        "Y8kbx*",
        "x^fMk",
        "$Er du sikker p",
        "b+b`XS",
        "?hx|yn",
        ", at du vil afslutte?(Er du klar til at installere Windows 10?",
        "m=WYx",
        "g G~3",
        "R+xT3",
        "2wR]_",
        "ivatel",
        "HU17J",
        "A6Vq~",
        ":4;J;X;",
        "9@oeL",
        "aZw${",
        "l*:Yyt|",
        "enja gotovog proizvoda (poznato kao OOBE). Slede",
        "Vt-5(",
        "ar-DZ",
        "ZI4%[",
        "JxFAX",
        "&!m/N4",
        "k~,e<;",
        "3&]RWS",
        "ibb-NG",
        "e/`&-",
        "U<f_Y<)",
        "&bS';",
        "xq>*o",
        "ynSqoM|C",
        "5$6>6K6{6",
        "lg8zd+",
        "&!u_U{.",
        "-|9|%|5",
        "]cu9k",
        "@QY/)*",
        "r%J}i0",
        ",K$3Qd",
        "UwRYF",
        "FS_iB#w",
        "Ej9ch[",
        "d$Jsv",
        "HXd c",
        "DGl/BP,j",
        "2]fon",
        "\\ka5v",
        "wlX\\BT",
        "UnlockFileEx",
        "8'979=9c9s9y9",
        "9+9c9",
        "o9\\Rm|*",
        "RlCcNQv",
        "]-%^!'",
        "g#KUF&",
        "f>|[[",
        "n>:zp",
        "_aAdv",
        "@Kr$w=",
        "%'\\&eZ",
        "Ro0K9",
        "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5",
        "Pc=\":",
        ":8@2H",
        "o corretamente. Reinicie o computador e tente executar a Instala",
        "9,t[Po",
        "+y9)A",
        " kapat",
        "<?^gj~",
        "Namestitveni program za Windows 10",
        "?$f4K",
        "*/BR*",
        "H67)N",
        "L>}YL",
        "Anahtar: / pkey <",
        "ite in",
        "k4git",
        "G}s\"y",
        "Exemplo : setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "k-r-3",
        ">zHksuO",
        "A14 &",
        "Px#sZ",
        "xdk5;",
        "041B04B0",
        "bL|r.m2M",
        "GWzC` ",
        "|b6Epk",
        "s.FL|K[U",
        "PT(/T",
        "`.data",
        "9'9C9~9",
        "EDUNpT",
        "*G.9_",
        "VWh,t@",
        "Estamos preparando algunas cosas",
        "V./,\\v",
        "N0_07",
        "n. La UI de instalaci",
        "t.[/P",
        "rz\\Dc%",
        "MTNlA",
        "Por ejemplo: setup.exe / auto upgrade / quiet",
        "jvs^KMy",
        "j`K^y",
        "1 <~d",
        "ad: setup.exe / auto upgrade / PBRupdate disable",
        "%nr>pL",
        ",#.jCd",
        "Mi*1~R",
        "Sp_^P",
        "d{%tt",
        "edzJU",
        "cfffffffff",
        "V JC$W",
        "MA7re",
        "N.,M}",
        "\\Ue;QKIwI",
        "I<E*F\"",
        "AW_,E=",
        "g*,b.",
        "Betriebssystem Microsoft",
        "^d)Uq@",
        "$#nx%",
        "!F<4*",
        "\"Qq6f",
        "}>aT\\",
        "        loadFrom=\"%systemroot%\\system32\\gdi32full.dll\"",
        "bCr9yN+",
        "gning efter, download og installation af opdateringer). ",
        "W?ygd",
        "m'h+]",
        "O1j|t",
        "CSetupDialogSplash",
        "G+t7z",
        "(_`?v",
        "q\"WssNG",
        "Parametri: niso na voljo ",
        "W2>2 ",
        "IJWg4",
        "7'8f8",
        "KrgcP",
        "8Jnn1",
        "r g3<",
        "0f $5",
        ")r#`C",
        "eV1?Z",
        "yfemc",
        "F{Q`v",
        "\\vG0p",
        "_\\p}n",
        "#w#6[",
        "o: injeta o arquivo",
        "dik a telep",
        "'R|V~",
        "ao%|,",
        "  wpx.dll",
        "%LX@ ",
        "Switch: / Postoobe <locatie>\\setupcomplete.cmd ",
        "6#696F6L6S6e6w6",
        ">bk]X.Yq",
        "Checking cleanup registry value...",
        "[ av8",
        "~yrCg",
        "Parameter: / auto <migreringsvalg> ",
        "=|20Fd",
        "l\"4{q",
        "'Tn6.5r",
        " po zako",
        "XsnSw",
        "| Xt'h!u",
        "affiche, mais souhaite que les utilisateurs finals parcourent manuellement l",
        "3B#D1",
        "t$)IMC",
        "8pS6J",
        "0954&m",
        "s argumentai gali b",
        "ts parametrs Enable, uzst",
        "Vx$,0$",
        "YSh_n",
        "x<hs~[",
        "`Ct/Kc",
        "Ag%k'",
        "zV-W+",
        "ImZCO",
        "CAAUZ",
        "yKl~~",
        "\"kL|q",
        "Na primer: setup.exe / auto upgrade DynamicUpdate je onemogu",
        "-9^g.0",
        "^g-Rd",
        "\"%<2O",
        "Vp,$<",
        "qBmfM",
        "hCJ,7",
        "6G6W6j6y6",
        "KTYMF7",
        "Parametri: N/A ",
        "c6@t8'F.H%",
        "s*[mJ",
        "wp=:D",
        "Dh:_L",
        " verze. Po jeho vlo",
        "tenirii%Instalarea nu poate lansa Install.exe",
        "a 0|>",
        "ls&Y96Vq4Q",
        "VE}'U",
        "jVD\\]",
        "40F6z",
        "dzis: / quiet ",
        "*2P;+",
        "@Mt+4E",
        " Microsoft Corporation. Tutti i diritti riservati.",
        "Schalter: / Telemetry <Parameter> ",
        "hcH^>",
        "a=7Hs",
        "Perjungimas: / DynamicUpdate <parametras> ",
        " nadgraditi sistem Windows 7 Enterprise. Ne ",
        " je naopak pro p",
        "38xEv",
        "8\"8*818}8",
        "0j@#B",
        "Kontrolli ",
        "zenlemek i",
        "_4<y}",
        "ffh&f",
        "W=+T=",
        "/dk.\"O",
        "*8;mI",
        "x Qa=",
        "@ZPzOzi(",
        "e biti presko",
        "j4Y#$",
        "4O7-uu",
        "cessaire lors de la mise ",
        "`_3HGt:X",
        "w&P >",
        "v1]<+",
        "].d)uH&s8",
        "  MediaSetupUIMgr.dll",
        "@\"RwF u^",
        "baEk+%m",
        "@{ nfWS",
        "dvGvgv*",
        "9De geselecteerde architectuur komt niet overeen met uw pc",
        "/ZT~p`",
        "AAg>H",
        " disk ozna",
        "dzu, apmekl",
        "yPLY,2",
        "Example : setup.exe / auto upgrade",
        "4ewXz|",
        "RKUS. Seda l",
        "Xz|+-P",
        "foJan",
        ")&9C)",
        ".4~q]d",
        "a|Kaq",
        "Bk@%&",
        "8!8?8G8S8p8",
        "6g7|c29}",
        "cOS<'",
        "lEr20",
        "Example: setup.exe / auto upgrade / PBRupdate disable",
        "TpkVk(`\"",
        "aX>eg",
        "pida (tambi",
        "d~&?;:7H",
        ":5i<g",
        "Neu beginnen",
        "!<I$e",
        "={`>Y",
        "g($t'",
        "Indstillinger: Lokal filsti eller netv",
        "5{:pkvf{",
        " cesta UNC k soubor",
        "igused kaitstud.",
        ".w{pR<",
        "393S3`3",
        "(ovp|",
        ",Nf>s",
        "74Y~`Z",
        "G{,?3",
        "p_V+w",
        "mfgfg",
        "ymrJh",
        "`! NB",
        "Cu2eV",
        "v4AtW",
        "fOe^YCiJ*7tRK",
        ",~vYl",
        ")e<-W",
        "nxZ+NzN",
        "_^.Vr",
        "]gRdws",
        "L'architettura selezionata non corrisponde al tuo PC. Ad esempio, se il tuo PC esegue la versione a 64 bit di Windows, devi usare la versione a 64 bit dello strumento. Riprova a eseguire lo strumento e assicurati di selezionare l'architettura corretta.>Si ",
        "Q{%_5",
        "eWQ:\"",
        "}[{Q,",
        " Full ",
        ")Bz& {",
        "AeS9T.",
        "|MeV5[",
        "E+OGs",
        "v<S%y",
        "}mXp%n$",
        "AAMufCE",
        "UeM/5",
        "^6h_ov",
        "hkKYO",
        "h^i']",
        "!Z_a*",
        "5&5C5J5^5h5",
        "IM2ps",
        "j)/UWy",
        "/&RWKR",
        "V T-z",
        "8{f:Fy",
        ")UZqy(",
        "e najti zahtevane razli",
        " Elp<",
        "te-IN",
        "`h\"lBc",
        "nbe&O",
        "_A-D/6",
        "Qo>1S",
        " komputera",
        "I)S%;>",
        "Acquista",
        "^vL,l",
        "wWinMain",
        "Lgg?E",
        "'{#P>",
        "[A2+H^",
        "Nh|Gc",
        "vIZ,`f",
        "yo-NG",
        "6'7C7{7",
        "Vqw9[Ce",
        "ar-KW",
        "kenleri kullan",
        "t+H+`,",
        "Available UI Languages",
        "pStopSetupPlatformETWSession: Failure while stopping trace at [%s]. Error: 0x%08X",
        "86?EK",
        ">nUyL",
        "`EEK+",
        "tdVB}W",
        "x3zAqZC",
        "`TlLs",
        "Configurazione",
        "61n$K",
        "JI<JI+",
        "HdUt+I",
        "ritettyyn sijaintiin. Huomaa, ett",
        "?a45{5",
        "w/;#tZM;#",
        "rer du \"setup.exe /?\" i rotkatalogen p",
        "C;Zgm",
        "@VQjE",
        "X\"v3}o'",
        " podporov",
        "N>PkF",
        "is69Yv",
        ".+-YRv",
        "anas programma instal",
        "9!2yq",
        "o';XE8P",
        "Exemplo: setup.exe / auto upgrade / showoobe full",
        "$dF71",
        ")^Q-m",
        "yEz;p",
        "zB['>",
        "?Y$mw",
        "M4Cw8T",
        "3JU]b",
        " OOBE(",
        "Bjh|7",
        "+=R@T",
        "7:7T7a7",
        "8QA[9",
        ";:&0&",
        "(u7bLub",
        "UCS-2",
        "~6tG.",
        ":gqMJw",
        "8Installiprogramm ei saa kasutajaliidese keelt m",
        "X%e]%",
        "@?pC4",
        "c\\.zS",
        "s: %d%%",
        ",rn(0",
        ",F|*1;0g",
        " viet",
        "nMcSa",
        ")O#yq",
        "/BsR/",
        "1xtQ`I",
        ")@#Z2",
        "0SX&l",
        "hn\\&5d",
        "kleri ve di",
        "Verwenden Sie den anderen Installationsdatentr",
        "rL*6m",
        "RegQueryValueExW",
        "(/,\"?",
        "ky-KG",
        "e4X! ",
        "EDQQL",
        "e9F_:(",
        "i instala",
        "ritykset: k",
        ";Vs8B",
        "\\`+1|",
        ">+>i>",
        "p!nj:",
        "U<Ux8$2",
        "g]3V~",
        "5Rm,A",
        "GetProcessHeap",
        "Zb&:v+U",
        "Opzione: / Postrollback <percorso> ",
        "~{/%O$",
        "8m'\\vi",
        "^4g:^YSd",
        "]fE*$5?",
        "5F?W ",
        "W^f>!",
        "ide: setup.exe / auto upgrade / migratealldrivers none",
        "kx<U@",
        "x\"mE+",
        "iz<$=}:>",
        "EJGPu",
        "9NSAq",
        "5T#Qn I",
        "Windows 10 Kurulumu",
        ";Ftu;",
        "GaUgv",
        "?oRRx",
        "&;ojzmV",
        "gl_.'F",
        "l galite netur",
        "=IZuC",
        "n^b1U^",
        ":`<ny",
        "\\?Acl",
        "rq'#:",
        "p;-!,",
        "9|!67",
        "n z6O",
        "I7|N>",
        "Ool]O_",
        "1Die Installation von Windows 10 wird vorbereitet.",
        "?-?5?B?X?",
        "iQSOK_V",
        ":wz's4",
        "b@{?z",
        " specific.wim ",
        "S.{|D",
        "gj\\W.h",
        "d8:P)('",
        "yG4d[",
        "Whz/6",
        "[Z+oA",
        "~&<!<-",
        "Anahtar : / quiet ",
        "[j4M0<3",
        "z09G[",
        "n de medios y las pantallas de progreso se muestran de forma predeterminada, pero est",
        "\"u0s[",
        ":J-be",
        "0qL2_I",
        "las2xC",
        "qOEbi.b",
        "/9wA%.",
        "0(0R0Y0g0n0",
        "kB:tMHg",
        "{w`6_",
        ">VbHK",
        "RegValueEnumAction::Enumerate: Failed to query key info: %s\\%s (error %d)",
        "p>sH+YM :",
        "velet: Megadja a telep",
        "7kT~c",
        "8\\<,^",
        "t9]AW",
        "H[Jv%<",
        " selecionou n",
        "h}o,}",
        "&JkJ2",
        "X:sA6;",
        "$:K`l0B",
        "'D~\"R",
        "HvS4j",
        "6S=`g",
        "&Ty,>",
        "A=G%;v",
        "bsearch",
        "$uTrt",
        "omtPM",
        "F66D#",
        "dh\\#j=",
        "a+k{@",
        "*h~OyP",
        "%^c7oY5",
        "M{#t>",
        "kM]mpw",
        "BsLhn",
        "})16h",
        "PWPVP",
        "Tg6 R",
        "htifh",
        "X>nG=",
        "L:vfJ",
        "ierul setuprollback.cmd din loca",
        "CgpF`",
        "]9:[_",
        "w)]313j",
        "R}Y!]K",
        "TsIRM",
        "?nJ^h",
        "}sQ>@",
        "r%j*5",
        "w~mty",
        ";~X[y",
        "Parametere: Lokal bane eller UNC-nettverksbane til en mappe som inneholder.inf-filer ",
        " ++PD",
        "ne+L?o=",
        "$0|,e",
        "} nMx{)",
        "fmT@W",
        " pliku Install.exe",
        "qFuZ)",
        "6Wz*c",
        ",CF\"t",
        "=wsQBo",
        "|nTkI#e",
        "9k<Ht9",
        "<pt84~Y8'",
        "`cmap",
        ")*XCe",
        "m=sq.",
        "        loadFrom=\"%systemroot%\\system32\\riched32.dll\"",
        "(e-7e",
        "U+8}8",
        "gfc_W",
        "5'8^w",
        "2CDd3&",
        "^SI;x7",
        "2~<3MI~",
        "9(i-Pwxc",
        "sSs'9",
        "{g>:D",
        "t1,E6",
        "0xhru",
        "/E@)h",
        "]&+N4z",
        "@K9vO",
        "?>?b?z?",
        "/p7A];R-`",
        "7@HX(*r",
        "E82ma",
        "Lv)!e\"[",
        "d[vU;",
        "LLc>+9",
        "=8V=?=sy",
        "&xEb_",
        "Si<x^M",
        "6@? 2lh",
        "OS;cu",
        "7Q)TM",
        " tietokonetta uudelleen automaattisesti, kun se saa alatason k",
        "terek: Helyi f",
        "Comutator: / migratealldrivers <parametru> ",
        "ka bir ",
        "{vNbn",
        "JN5 w",
        "wT~|T",
        "Parameters : Enable; Disable ",
        "GEdF\\",
        "@@@@@@@@@@@@@@@@@@@@@@@@",
        "ierele de instalare ",
        "6OGxT",
        "Descargar",
        ")BN_Q",
        "gx.6<",
        "0L0zv",
        " nurodyt",
        "1[*iC",
        "Y<=\\{~",
        "B]+A#O",
        "ytkownika. Jest on uruchamiany z uprawnieniami systemowymi. ",
        "Applying SetupDU from a directory: [%s]",
        "|IJ#o",
        "W{j=3=m",
        "N8iY?",
        "8z[H2",
        "%Qj/v",
        "s visus uzst",
        "uS<f,",
        "041D04B0",
        "Continuar desde donde lo dej",
        "F4<bSi",
        "(E3GL",
        "o11W<<",
        "nhT;(",
        "])qR7",
        "`*< \\",
        "U+(jD",
        "eobvi",
        "#3\\^*PC",
        "5!x6;",
        "77xvcg~-",
        " 350 MB ",
        "ubw<z",
        "^\"=N.",
        "\"Y5kW",
        "u*VVVVh",
        "N9wP-",
        "fo<g{K",
        ":e=LZ",
        "t v p",
        "%qG<B",
        "CDlpTask::Cancel",
        "?.26X",
        "I6q)Y",
        "\"*_~h",
        "y zbierane dzienniki i inne informacje diagnostyczne z komputer",
        "hI%tz",
        "QCf+~5",
        "~~{w{ok",
        "ppp@@@@@@@@@PPP",
        "dh%8C",
        "SRC;4",
        ":,aUu",
        "I&dC*~",
        "bmA^ ",
        ")+j<\\a",
        "6$6(6,64686<6D6H6L6`6p6",
        "tAHsH",
        "anas in",
        "o mostradas por padr",
        "15:*}b",
        "\"Ee)V.",
        "7s*_<",
        "yP~$?",
        "z}e/r",
        "z+3;t",
        ":UKp8",
        "8,dvV{",
        "cx&xJIs",
        "RfTpt",
        "l1/X2|",
        "YS#e?",
        "E=x:P",
        "xg\\\"^",
        "j$V#F*hx#",
        "/w6Ew",
        "i>0?Y",
        " Microsoft Corporation. Visas ties",
        "uW,n!nM|",
        "Exemplo: setup.exe / auto upgrade / noreboot",
        "03jd{",
        "cuter interactivement OOBE. Aussi lorsque / showoobe est d",
        "0?O$A0",
        "; ;$;(;,;0;4;8;<;@;D;H;L;P;`;p;x;",
        "$CCwI(",
        "uft6Das Legacy-Setup-Programm kann nicht gestartet werden.4Die Datei ",
        "M1#g~",
        "nT2#u",
        ",t;y%b",
        "yytd'",
        "Jatka siit",
        "^:_)n",
        "wH3h>",
        "v7;<Y",
        "t7p09",
        "+E0K6",
        "1qy2s",
        "v4o,0iq",
        "Z+noL",
        "IL^d&",
        "Pridobi",
        "Exemple : setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "Usa l'altro DVD di installazione con la dicitura %s bit. Dopo averlo inserito, il programma di installazione di Windows 10 verr",
        "4sor>",
        "d*Q,!s",
        "GetSystemMetrics",
        "6Preparazione dell'installazione di Windows 10 in corso",
        ",Det g",
        "!YJ1'v",
        "_ZW8olwp",
        "bYt]W",
        "CN +wy",
        "C_^wSW}}",
        "t\\\\3E",
        "eY&m2",
        "5*;~i\"",
        ":WIIc",
        "EventRegister",
        "~Z8Ay{",
        "Rd[w}",
        "n. Si has iniciado previamente el programa de instalaci",
        "1pTM>",
        "utakse kasutaja sisendit ainult ",
        "X`ik7",
        "sIi}M{",
        "WINDLP",
        "te se, ",
        "fiTXtXML:com.adobe.xmp",
        "+\\.'bR2",
        "metros: ruta de acceso al archivo local o ruta de red UNC a un archivo con el nombre setupcomplete.cmd ",
        "})`}q",
        "y-Yy;i",
        "mu. Tas darbojas ar t",
        "q0p91",
        "~yERq",
        "Q{_s2",
        "\"ohJ1",
        "gGp)Z#",
        "7Ar\\3",
        "Q.;*dG",
        ">4)}_}",
        "_fYai",
        "@vtt4",
        "re oppgaver etter at installasjonen mislykkes og PC-en stilles tilbake til det forrige operativsystemet. Det kj",
        "i enged",
        "aduje aspo",
        "C?ow9",
        "8&'81",
        ")<iyI",
        "Mwc$DI9l",
        ".=$PQE",
        "L ho$",
        "UYSX(e",
        "v79z!",
        "s uzst",
        "vi)Z[",
        "9MP_ ",
        "to su automatizovani. Ovo prebacivanje tako",
        "?>}AWC",
        "ctWls(",
        "$3Y9J",
        "M4X0-$",
        "_;nAn",
        ";&;5nu",
        ")>+T>'",
        "E@&03",
        "g eller UNC-n",
        "fk,tH",
        "y{q\\L",
        "o e acesso",
        "E6K%V",
        "KL=/t",
        "!V0Xt",
        "S^^^AAQUQII",
        "re installasjonsprogrammet for Windows 10 p",
        " PBR.",
        "~'I?*:",
        "]-j%x",
        ".VX|)",
        "_Bn<-~",
        "0$0)0/0I0Y0i0n0t0",
        " PC-ul dvs. ruleaz",
        "*58[*",
        "}t:`&",
        "0V-7C",
        "q|`&/",
        "ei utilizator",
        "#Vx\"&6",
        "skor keletkezett telemetriai adatokat. ",
        "berom sp",
        "5 _ZxB",
        "29M])",
        "3R4c4i4",
        ")zyZ}",
        "~e#.1",
        "he|g7",
        "a4?r=O0W",
        "qy+8^g",
        "kw%-H+",
        "4lQAu",
        "#W67vJ",
        " architektura neodpov",
        "6!7E7^7t7",
        "|h,1\"",
        "~Qshm",
        "Mb4eSn",
        "]_/6w",
        "no pou",
        "Y|OZ8;",
        "7Plxz",
        "?'Ax++",
        "GrdhX",
        "re opgaver, efter at installationen er mislykket, og pc",
        "MKA: Tento prep",
        "ttelep",
        "!9FbC#",
        "2P{;q",
        "IcAoly",
        "dM}C|",
        "X*w)iJ",
        "N=,<M|",
        "E{Sv%",
        "Bk<#g",
        "h|FR2",
        "Pjl,15",
        "cznik / PBRUpdate ma parametr Disable, Instalator nie zaktualizuje ani nie utworzy partycji PBR. ",
        "Beispiel: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "10 |@",
        "T3Ts W8RI",
        "xel: / Telemetry <parameter> ",
        "n y el equipo ha vuelto al SO anterior. Se ejecuta con los mismos privilegios del usuario o los procesos que iniciaron la instalaci",
        ",F8BA",
        "av!T6<2",
        ":!|Jb",
        ".<:')9#173",
        "Fvk__",
        "=bu^;",
        "            <!--This Id value indicates the application supports Windows Vista/Server 2008 functionality -->",
        "<=Clm",
        "tor neaktualizuje ani nevytvor",
        "gf[Ks",
        ">}`QT",
        "q~Jf~",
        "@@Tu8",
        "Tu@e%",
        "fRPWDj",
        "vrstom disku",
        "m.Q]{",
        "N.0:n",
        ":U&S;",
        "urirati ni stvarati PBR particiju ",
        "cia pokra",
        "\\1*U-",
        "L6(mG4L",
        "Microsoft Code Signing PCA 20100",
        "oP%aGB",
        " Kj]g",
        "nak rendelkeznie kell enged",
        "jcCu6",
        "Yvv#g",
        "|}}?i",
        "\\Oa_(",
        "aCec2H",
        "Jx#b{",
        " cesta ke konkr",
        "rqi4*",
        "8*G#o\\@'",
        "+F>W%",
        ".?AVCUpdateScenarioCtrl@@",
        "_{WvLO",
        "+4N_b",
        "=<9#.",
        "lem veya kullan",
        "nieur de d",
        "ja letiltja a telep",
        "GetPriorityClass",
        "Z/P;?",
        "*OMkD^",
        "NOZN/[",
        ">(0$y?",
        "PWNdHE(",
        "et]'1",
        "wOF:5",
        "VV04[",
        "\"%HER",
        "SRVRRG9",
        "jZ8mQa#",
        "b2&9*",
        "3U_fuhS",
        "'J'>k",
        "cILXz",
        "h@eZ\"",
        "CDlpRegistrar::GetTransport",
        "        loadFrom=\"%systemroot%\\system32\\cryptbase.dll\"",
        "~K7f6 G",
        "z\"az>K",
        "-t:>h6",
        "{S=q^",
        "r5yzH",
        "st-ZA",
        "smapp",
        ")%sXlK",
        "PH{gT+p",
        "~o;p0",
        "c:yW0~0Y0",
        "Ou/{rfY",
        "YIUu*",
        "wyQgE'",
        "'/U/h>",
        "\"=\"cH",
        "/RollbackSys %s",
        "8\"O\\@",
        "tVM&&",
        "y/m+T",
        " pokrenuta. Funkcionalna ispravka je mo",
        "fC]KU]",
        "(t;x@",
        "\"k3GL",
        "kai ie",
        "j7k&T",
        "RU<`g",
        "^{XwFW",
        "o.4pu",
        "0j9oa",
        "E4`TJ",
        "/nQvg_",
        "        name=\"riched20.dll\"",
        "Pv|T ",
        "}a?Y4%",
        "424m4",
        "?IV^eO",
        "Qo\\:]",
        "K05I99",
        ">f(Y(O",
        "CreateDIBSection",
        "u;F[Si",
        "ab-#Ji",
        "SI,Jv",
        "/H?%~",
        "o?w0:",
        "Parametrai: vietinio failo kelias arba UNC tinklo kelias iki failo setupcomplete.cmd ",
        ">s/b$t",
        "Iz)O0",
        "Mp<)k",
        "I+sRWF",
        "rqlnn",
        "862m/",
        "g@#?9",
        "            <supportedOS Id=\"{35138b9a-5d96-4fbd-8e2d-a2440225f93a}\"/>",
        "[\"}1_",
        "a%\"VA3",
        "9gpok",
        "6u^\\b",
        "d4ge(",
        "Rksm&",
        "0zzM0",
        "kyguB",
        "lr?u{",
        "'+%PX",
        "t az illeszt",
        "4xc?[",
        "ba-RU",
        "UuI&G",
        "1Kui65ON",
        "M &v+",
        "@j8>O",
        "o2Xw.",
        "O_;9nG",
        "DFMBydT/",
        "?!e^I",
        "S<!zJ",
        "HNN e]%",
        "q OQ+",
        "/Finalize",
        "USERENV.dll",
        ".32z2",
        "-?D_z",
        "p/AZv",
        "7J.T6yUt",
        "ESjcj",
        "Yys-w{",
        "3%:YPl/e",
        "Y\"Id{P]",
        "|}t}ti",
        "aw[$L",
        "@eUS;",
        "uir*|\\",
        "r%G4_",
        " valitsinta tulee k",
        "is2ZoW%",
        "04080<0@0D0L0X0x0",
        "n aparezca, pero s",
        "~nQvC[5Rr",
        "yP\\TrI",
        "xR8<I",
        "vN!fW",
        "%a&/z",
        "2\"Ci+MY",
        "+P3ZpK",
        "4'!e!",
        "]3'+S",
        "Asennusohjelman k",
        " 6FZc",
        "oNYzox",
        "G`&:&",
        "xlVkt",
        "4g|l7",
        "CDlpManager::GetState",
        "dku. Na p",
        "2ISf'H",
        "a\\Uq\\",
        "CDlpRegistrar::GetTransportFactory",
        ")ICM-",
        "GetVersionExW",
        "u\"1d0",
        "        name=\"msvcp_win.dll\"",
        "gfvfvwfM",
        "lp{Fj",
        "OpBO&",
        "e9#6R_o",
        "xo}Vl\\",
        "Beispiel: setup.exe / auto upgrade DynamicUpdate disable",
        "p2fQ>&|",
        "B$g#Q",
        "qOZsBi",
        "Found tracing session: name=[%s], logfilename=[%s]",
        "g4D2QA",
        "I[AmO",
        "O\\0vVz",
        "*VSl)",
        "@@{X,wi",
        "%s bitai",
        "x<r3P",
        "SsvIx",
        "64WT/",
        "Forb_",
        "Q)R2:J",
        "!Q&#IV Ab",
        "Comparing file versions:",
        "WbC^2QPb",
        "R_FEn+",
        "nJjHh",
        "U>S6IY",
        "rio na atualiza",
        "om:/t",
        "0PLhg",
        "ide: setup.exe / auto upgrade DynamicUpdate disable",
        "cuter des t",
        "3DRvx:",
        "k,e6/j",
        "85i%Z",
        "$Microsoft Ireland Operations Limited1",
        "fASF~}",
        "\\/g%Q",
        "o pode determinar o idioma da interface do usu",
        "CDlpFile::GetError",
        "cc`)9!",
        "n^nRc]",
        "^6#61",
        "\\)|d=",
        "]=]v$",
        "RW0~0[0",
        "D>$x{",
        ";\\:nG4i",
        "{;vY%",
        "]{SI7",
        "sd-Deva-IN",
        ",cn[O",
        "%05JTO",
        "Nxa5|",
        "H4_n{l",
        "ti naudojami pakeisti ",
        "ho riadka. V pr",
        "appeler le script setuprollback.cmd apr",
        "wH\\Fw",
        "n9i;/",
        "&Dc:L",
        "0@;?u",
        "7(?Xe",
        "bcdB%",
        "Zx(X+",
        "}n.b`",
        "Toiminto: m",
        "\\=%ei",
        "Yf}Jf",
        "Underst",
        "TV&8)",
        "FKZBe",
        "x6--;H",
        "~ x&jY",
        " \"Enable\", ",
        "i: %1!s!",
        "_LKIB|",
        "swy?wo;",
        "GH9_ t_",
        "{p1b7",
        "_-H{|!",
        "<)~&_U",
        "rtuseks on seatud Disable, ei v",
        "k'}XQG=|,w",
        "_7(3W",
        "Sklopka: / auto <odabir migracije> ",
        "LAf)M",
        "&c'\\K",
        "fna~%",
        "Na6Z~",
        "^o7.\"!",
        "9G-0v",
        "klad: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "fsnHAP",
        "%bX0R",
        "M}8-Q",
        "+A2Q|r",
        "4cj+g3",
        "rankos egzempliorius. Gali b",
        "`a1uV",
        "ql-24",
        "/\\4c.",
        "(d:=HH:",
        "|'{:d'-",
        "s{eoQ",
        "Eylem : Belirtilen konumdan setupcomplete.cmd dosyas",
        "V{y!oV",
        "du+&u",
        "}6{,zP+",
        "Z3uQW",
        "deI_Z",
        "Dv*?A/^Qn*w",
        "\\9Fvk",
        "Cw{ra",
        "u medija koji u mapi izvora sadr",
        ":0;I;];h;",
        "Z18#9E",
        "Na przyk",
        " o caricher",
        ">Db+L",
        "97u\"3",
        "XmkK<",
        "zg,hG",
        "#=./<p",
        "dek se d",
        "|LaSa",
        "M~UN~",
        "DeleteFileW",
        "n oletusarvon mukaan, mutta ne on automatisoitu. T",
        "/:q2=",
        "]D?(n",
        "_D^:bxK",
        "(7I^2",
        "Estamos realizando algunos preparativos",
        "iN|ki",
        "sz2=o",
        "a e~j",
        "xvwvf",
        "*X~n{",
        "XtDtJtUtO",
        "j&M@`LG",
        "_J(Z?@q",
        "y\"#kb",
        "lBwb[",
        "Windows Update",
        "qxxTj",
        "s5B~#dsv",
        "-gRLu",
        "ckAZv",
        "FZYZ|",
        "enjer primene mo",
        "}Z}Zx",
        "O}Vca",
        "CUpdateScenarioCtrl::ProjectEsdFile",
        "WOG?/",
        "BoxDeletePath: Last file path: [%s]",
        "$Windows.~LS",
        "F+HiCu",
        "=$=,=4=<=D=L=T=\\=d=l=t=",
        "r~SKo",
        " utiliza",
        "nxF#7~",
        "VF0VCc",
        "]6rtlY",
        "/>#LS",
        "<]W74",
        "U4wT(",
        "tirilmesi veya olu",
        "Exemplo: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "L+u`p",
        "-lQG4",
        "[[\\BL",
        "/SessionId",
        "~$6j(k",
        "~uv8w",
        ")|1;\"x!5",
        "hrend des Installationsprozesses werden alle am angegebenen Speicherort gefundenen Dateien ",
        "~qr3;",
        "} #|~+",
        "vOM6l#",
        "'%%MOO",
        "/[/$(",
        "[+&))A",
        "&2]fn",
        " de la mise ",
        "Valitsemasi arkkitehtuuri ei vastaa tietokonettasi. Esimerkiksi jos tietokoneessasi on k",
        "3eAMo",
        "Vz9X'(",
        "/-TM9o",
        "t?W%{",
        "'n<CW",
        " program syst",
        "|O?zg2w",
        "3gQ\"D",
        "-:(~O",
        "K)PRk",
        "!6Y>4",
        "YKiGd",
        "programokat a telep",
        "On=b|",
        "^E]&]",
        "EnableMenuItem",
        "\":jQD",
        "rCdZ@",
        "kO,km",
        "Dajz3",
        "u.rDd",
        ":F@p>",
        "],-CH",
        "=L\"*8",
        "X[9GV",
        "PgUw>",
        " pid.txt-tiedoston sources-kansiossa. ",
        "Zg#nP#",
        "{OEEq",
        "8O9x9",
        "SSP~Q",
        "0!0U0",
        "CfL5w",
        "re yerel dosya yolu veya UNC a",
        "7t}B/s",
        "+yJsH/",
        "SafeOS",
        "F:Fm$",
        "k|I{P",
        "dia sous licence en volume ou un m",
        "YW9/)",
        "7jXffja",
        "OPOMBA: to stikalo uporabljajte le v okoljih za presku",
        "s;!;W",
        "nr8OA",
        "BMW8Z{",
        "l=QW ",
        "rV= |",
        " uE?Y",
        "8|VA{",
        "kkel> ",
        "i.h{-",
        "pM{=X",
        "(>G4R",
        "37vZz=",
        "E)O\"/",
        "wt(Mf",
        ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:",
        "tte / Telemetry v",
        "Xb8b,",
        "eg 2Mmru,h`",
        ".$Moep",
        "d_mI\\C",
        "Haszn",
        "98n|%",
        "lf}7)",
        "qxjEhM",
        "f7KKYK",
        "wUtzWE^",
        "n de cargas, omisi",
        "\\J<zK)",
        "n de Windows se pueden usar los siguientes argumentos de la l",
        "Leelawadee UI",
        ": / installfrom <um",
        "YS2:DKZi",
        "kas, galutinis vartotojas turi interaktyviai paleisti OOBE. Arba, kai / showoobe nustatytas kaip N",
        "[==XT",
        ">W:F<",
        " wymaganej wersji pliku XML>B",
        "zyfj+",
        "MJ3LL",
        "aI<Fas",
        "8I&#:",
        "64w#R",
        "Bii:9",
        "5_/4Nmk",
        "i_B\"1",
        "I>mDgY",
        "(H4D4^d",
        "CDlpManager::Reset",
        "zv.Dy",
        "/SetupDUPath",
        "Cabinet.dll",
        "G7g^*",
        "K`0<\\",
        "Gjsws",
        "g\"&eV",
        " varsay",
        "QQ/n/",
        "-d[6n",
        "kim vmesnikom namestitvenega programa in napredkom so privzeto prikazani, vendar so avtomatizirani. To stikalo predpostavlja tudi te privzete konfiguracije: pogodba EULA se sprejme, dinami",
        "E37LU)",
        "tkata?",
        "n>2_C",
        "S+?vZ<",
        "7D~m,",
        "Parametrit: Full; None ",
        "q5Oz%",
        "metros : Enable; Disable ",
        "TJ:,E+%=",
        "O8~+G",
        "<Is%\"+",
        "O {x5r",
        "_U@;o",
        "iek tiek vietos ir bandykite dar kart",
        "7>FNv",
        "@2n!q_",
        "Yehj.",
        "Installasjonsprogrammet for Windows 10 tar ikke kommandolinjeargumenter. I ledeteksten kj",
        "j P7ds",
        "6Jy(.eZ",
        "N:T7Yo",
        "vZK#f:",
        "b(6=:<",
        "=E>R>",
        "\"K^ UA",
        "QfH8p7",
        " vain testaamiseen ja testiymp",
        "]//5+{",
        "eyjOp",
        "tk\\wdL",
        "enite ra",
        "<A9\"@",
        "5P\\+1",
        "`Nfd3:",
        "lSh?e",
        "er67t",
        "='0#n",
        "1\"%>%",
        "aH}8%",
        "@[,4@",
        "a opravila v prej",
        "5`x[_O",
        "lZmZ&ej",
        "VerQueryValueW",
        "3$3(3@3D3\\3l3|3",
        "Ds+AE[",
        "LocalFileTimeToFileTime",
        "|SO_:",
        "q,[\\\\?",
        "jdD$2",
        " nytt",
        "3{b^b",
        ".plx(m",
        "5P~.NMMF",
        "FImzR",
        "\"NX|W",
        "V!>c([",
        "(V@q<",
        "c@>e)",
        "M$OHV",
        "n&SW#",
        "1p:n F",
        "f's h",
        "+<&ES",
        "*ZT4:",
        "wg|^n",
        "I1FzM",
        "041504B0",
        "]:Ll5",
        "kdA1H",
        "/Vdn#",
        "\\\\?\\UNC",
        "iu pentru a rula instalarea. Elibera",
        "rA`T5",
        "Seg&uinte",
        "JOmu`",
        "o consegue iniciar a experi",
        "ra sa nezhoduje s va",
        "8$8(888H8L8d8h8",
        "~%iyu",
        "5j]4L",
        "Y.1{HR",
        "MH|NQ",
        " sijainnista. Setuprolback.cmd on mukautettu komentosarja, joka suorittaa teht",
        "KH>qp",
        "VX=;6[a",
        "~uDc1z",
        "^6q$@",
        "eE^scQ",
        "Ll eR",
        "d5fXI",
        "a=L@GL",
        "r Windows n",
        "\"'80Xh",
        "c+<m{2wl",
        "0@+$A0",
        "es-PR",
        "j45~6~",
        "=*uEm",
        "Xq0=F",
        "j2Pw?N",
        " parametr Full, koncov",
        "ASFy'",
        "?{Yzm",
        "Esempio: setup.exe / auto upgrade / postrollback \\Condivisione\\script\\setuprollback.cmd",
        "f\"2:n",
        "%~>!~",
        "):Aq#(>",
        "1JSKOO'1",
        "Ls.#7",
        "0GgTQ",
        "+dQbI",
        "tre autoris",
        ".a_ 4O-z",
        "OB^54U",
        "%E0&Jv6%",
        "hX:49",
        "?V?]?c?h?s?",
        "rfMzC",
        "Nnd4r",
        "P[u\\K9",
        "eren Windows XP",
        "nu tekrar ",
        "<N^/O",
        "bqm[Y",
        "Bv-[)k",
        "?I^g8X",
        "\\~r3;",
        "7YI7i2Uw",
        "o e voltar para %1!s!. Deseja continuar?",
        "DKsCUY",
        "0p=G+n",
        "J{>\"\\",
        "D$pSVW",
        "'FC=P",
        "R^hqm",
        "v>/vQ",
        "cijas avota datu nes",
        "aftIA",
        "0!0&020B0V0`0g0m0r0~0",
        "Parametrar: Ej till",
        "U2+oS",
        "h\\;u6K",
        "(yyNrx=",
        "xMXa\"z",
        "D.F8s",
        "C!p29",
        "{>4x`-h",
        "?{Dk{",
        "3?CIB",
        "*bT,.^",
        "OsUninstallWarning: Execute file found [%s].",
        "ram, ja j",
        "1*1:1@1X1n1t1",
        "21272[2",
        "JfV0W",
        "W9M.[",
        "&h+Vd",
        "Cleanup value missing... assuming no cleanup.",
        "=7\\Gz",
        "jX:BQ",
        "Radnja: Ubacuje datoteku setuprollback.cmd sa odre",
        "Ettevalmistamine",
        "ca-ES",
        "7,o-C",
        " driver.infs ",
        "3yI#I",
        "SPOr~",
        "b0]_B",
        "rc;:G",
        "w instalacyjnych. Je",
        "A Windows 10 telep",
        "{H13'",
        "/Install %s",
        "Forbered",
        "/ZhP[",
        "lQ,Z,",
        "CDlpTask::GetActionFriendlyName",
        "(@LDf",
        "e namestite to razli",
        "H\\O6n1",
        "mogat",
        "z#Z45",
        "o7\">kt",
        "lineasennuksen k",
        "o+>Y}@m",
        "41?|Z",
        ")o<X ",
        ">`J.2",
        "lreiz palaist Windows 10 uzst",
        "()]7 ,",
        "3d;;|)",
        "6#7b7",
        "_8OIA6",
        "TL90B",
        "b=^sY",
        "^k>YjO",
        "7] I|\\",
        "\"|?{ ",
        "BG@2]@",
        "yMJ)yl=",
        "@C1-/",
        ". Kai / migratealldrivers nustatytas kaip N",
        "l/g 1",
        "On1^o",
        "Su`.)",
        "3h?)i",
        "0f0D0",
        "-BsU9",
        "hlasu s licen",
        "]HX(-",
        "(m=U!",
        "=/&\\Z",
        "PDb0R1$",
        "6V;kc",
        "x'23<n",
        "n podr",
        "WVgrl",
        "$vP}U",
        "wIFM8",
        "lreiz un noteikti atlasiet pareizo arhitekt",
        "R_i<0J",
        "yzi@[NJ",
        "Uq}wM",
        "Un administrateur souhaite mettre ",
        "jkcO]",
        "n actualizar",
        "vQ1Tg",
        "H;ZwL.^D-",
        "jKLGX>",
        "8Xo;Hk",
        "$,/K0",
        "'F&1ob",
        "en-NZ",
        "glicherweise nicht aus, um einen Kopiervorgang an Speicherorten auszuf",
        "e se sa istim privilegijama kao korisnik ili proces koji je pokrenuo instalaciju. ",
        "m;N$d>",
        "=!|jR",
        "memcmp",
        "mbolo del sistema, ejecuta \"setup.exe /?\" en el directorio ra",
        "WgtIq",
        "rMHXPx",
        "x{Q]Pe",
        "695I[",
        ",oBRcd",
        "kb6*[",
        "cute avec les m",
        "P]qXu7hEE",
        "_?\\?1",
        "wLHj6",
        "Y9{B&V",
        "V_(vC",
        "C_L?W9",
        "X4G\"5",
        "w2`T1)4",
        "f^1Y%",
        "R{=xe",
        "VWj 3",
        "<\"\\=&",
        ")T?@+",
        ":)FMQ",
        "_=3c>5",
        "uj@1m",
        "/,E92",
        ".?AV?$CAutoWdsLibFree@PBG@RAII@@",
        "^WoL9m",
        ",P>*2D/v.",
        "kVSek{1",
        "auju kop",
        "TNP.2",
        "2XZp,,\\h",
        "04-%X",
        "j+u:2d",
        "])>9vC^{",
        "7>q5*",
        "Fj,GF",
        "q`_ 3",
        "n=@u#",
        "BoxResult",
        "P)W`i",
        " Egf]C",
        "mqGY7Z",
        "9h[~_",
        "i8S~6",
        "k@Jx`",
        "z7;{^",
        "q2U[U",
        "F-LN,Ob",
        "FnG> }8x4",
        "7KC{.WO",
        "s*0jE'",
        "*A\"H.",
        "0Pa8q",
        "y]&>y",
        "w7qWh",
        "1pbFvP",
        ">Xz^oS",
        "1&1I1Y1",
        "h)jCw",
        "{Qyg>}",
        "A-7''",
        "702G@",
        " gerekti",
        "+H{jW",
        "na pot UNC do datoteke z imenom setuprollback.cmd ",
        "@tZ{4",
        "Er is geconstateerd dat de installatie wordt uitgevoerd vanaf een netwerklocatie en dat er mogelijk een netwerkonderbreking heeft plaatsgevonden. Voer de installatie opnieuw uit",
        "(FRu6",
        "VE&dP",
        "c6ec|:O ",
        "*5rs0",
        "w}{:{",
        "Lk1K|",
        "r Windows 10 accepterar inte kommandoradsargument. K",
        "xBx<2",
        "C>/or",
        "CDlpTask::Resume",
        "s!,q'",
        "'7V$7",
        "|//-d&:",
        "}10;L3",
        "`0jxbG",
        "9Zy#2",
        "0;5(:X",
        " \"/ migratealldrivers\" ",
        "o a invocar o script setuprollback.cmd ap",
        "ra nem illik az ",
        "\\gB$p",
        "JVAAs",
        "Cleaning parent folder: [%s]...",
        "ajq8X",
        "ZMH$B",
        ": All; None ",
        ")EDTzKKt+",
        "5Pfi`C",
        ",^f\\}",
        "nea de comandos indica al programa de instalaci",
        "Scenario ",
        "7xUYs",
        "j1su4n83",
        "_,g_j",
        "Te.,L",
        "tTw~r",
        "d,\"0;",
        "OLEAUT32.dll",
        ";Please try running Setup again from a Command Prompt window",
        "u54\\-",
        "47fsN",
        "E\\\"*l",
        "#E+zG",
        "jE\\Er",
        "S^|:+\"eE",
        "7m!5j",
        "sB>v$",
        "<;k<,\\",
        "CSVVVVhT/A",
        "~xG.2",
        "-z{\"I",
        "^Xnt'",
        "MgE/Zn",
        "$8o>3$(",
        "9{7?<",
        "zVjHq",
        "v[3bv=>",
        "Qr_9F",
        "FP#_7Z=/",
        "oi)6c",
        "Asenna",
        " o defec",
        ")!),>*",
        "v_H>U",
        "dK4!i",
        "&JgtQ",
        "n Kommandotolken",
        ":+=9Q",
        "ZegO1%S",
        "m;:7\" ",
        "$>@%:H",
        "6 6,686D6P6\\6h6t6",
        "0K0i0F0K0",
        "duotis. Kai kompiuteris bus kit",
        "\\$windows.~bt\\",
        ">#>W>k>v>",
        "u{q5{+",
        "2-71J",
        "~{Kq*",
        "6b1Z#",
        "xu,#I",
        "i';H;9",
        "vCXVX",
        "Ea5OO&S",
        "C fy1",
        "u|cYY",
        "kla darb",
        "ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp",
        "TX+M]",
        "0P1_1x1",
        " 3Na~k",
        "@\"8a\"",
        "{  rwe2",
        "~~~~~yyyyxxxxxx",
        "6 Dg*",
        "u.e8)",
        "+UN9,",
        "aDM_K",
        "X5Uzl",
        "Installimiseks valmistumine ",
        " JaO0",
        "_dW|>",
        "uzvq-",
        "6s7z7",
        "yRWTT",
        "5\"525B5R5b5r5",
        "O>)>&",
        "wZw@l",
        "onnistunut ja tietokoneeseen on palautettu sen aiempi k",
        "~9~msH",
        " deneyin.",
        "~?Mb&",
        "Hw</t",
        ")c+< ",
        "2EL9b",
        "+pPGg!",
        "}12Pt",
        "rer bagudkompatible operativsystemopgaver. N",
        "Parametrai: vietinio failo kelias arba tinklo kelias iki specific.wim ",
        "$:3+:",
        "G=G&c",
        "=WOvqmr",
        "'mKU6",
        "sr-SP-Cyrl",
        "~R{@>+u#Rt+~",
        "Vh0K@",
        "[qUm$V",
        "xP/$,",
        ".rsrc$02",
        "oCr[9",
        "?7Rh0",
        "sszes almapp",
        "bDeeh",
        "Un technicien de d",
        "\"Tgf'L(",
        "74z*4vO3",
        "OO,y>",
        "s%a7pQ",
        "Is.K1",
        "xCMOM",
        ".;5v->",
        "U-;>F*",
        "6u6i;",
        "RMZ)d",
        "={Cu`~_",
        "YF/up",
        ")*/'6",
        "`03*:",
        "PRaV;",
        "W;n~/",
        "De)g5",
        "#JEg~",
        "<$|s&",
        "CDlpManager::CreateAction",
        "N?XhKb8",
        "3yZ}U",
        "bersprungen, und die Komponenten werden auf ihre Standardeinstellungen festgelegt. ",
        ")+uU*",
        "K}NN~",
        "D%KT+PCM",
        "Mcul:",
        "lh',g",
        "VIVQN",
        "3)BO&Au",
        "(&N)USetup.exe ",
        " tuotantok",
        "(Mxn5",
        "Valmistelemme paria asiaa",
        ")^#)Mw",
        "FrqYi",
        "&m0vO",
        "Rk1sb",
        "vQm9/oG",
        "Pokretanje instalacije nije dobro pro",
        "[9@gV",
        "1&kBh",
        "%zE>x",
        "/%9p%",
        "ndaren m",
        "~N;ps",
        "A+IQ@",
        "ljs eventuellt installationsgr",
        "41$eb",
        "W=neG",
        "MZ|Vo",
        "*Are\\",
        "{1uWa",
        ",@<wp",
        "v0N\"7",
        "rn9Ln.",
        "ZJ\"^6~/",
        ".?AV?$CZeroInit@VCMediaScenarioCtrl@@$00@@",
        "gX]bX",
        "Eksempel: setup.exe / auto upgrade / noreboot",
        "appli Param",
        "TM;6U",
        "GfYxs{",
        "j_\\+1",
        " Id)FQ",
        "aj 7T6",
        "ra neatitinka j",
        "S_chWur",
        "4n_ct",
        "terek: Upgrade; DataOnly; Clean ",
        "ohK598",
        "5=C_6",
        "<DD-uD",
        "NSIB;E%",
        "@hPz\"",
        "#Hf>B",
        "*O8wB",
        "8S}*&e",
        "D~b}AMd",
        "TAhn[",
        ">CuC<I",
        "9_hx(E",
        "Switch : / Postoobe <placering>\\setupcomplete.cmd ",
        "VofE?",
        ":h)O`",
        "2d%jt",
        "installation ne migrera pas les pilotes dans le cadre de l",
        "jY`^#",
        "$nG'Q",
        "~mK, ",
        "#R*EWA",
        "+AM5>",
        "ltL~u1Z",
        "_KIPV",
        "I6?0*Cl",
        "040204B0",
        "lteni az ",
        "testes. Ela n",
        "SYSTEM\\Setup\\MoSetup\\Volatile",
        "Tahoma",
        "D&jct1^",
        "@W#]Mt",
        "2>K&@r>2",
        "Pn\\(7",
        "Commutateur : / showoobe <param",
        "9jJx{",
        "metros: All; None ",
        "'z[\\YF",
        "Radnja: Ubacuje datoteku setupcomplete.cmd sa odre",
        "#?mKc",
        "YU@gSE",
        "SKKA_",
        "b\\F0C",
        "4y9m,-5",
        "@)cT'>",
        "NJ(.=",
        "nA%ev",
        "x9'IIx4",
        ",9Mm3",
        ">wdHPQ",
        "5 v*3\\",
        "040704B0",
        ":\"vH[",
        "F<$kS",
        "p5t>i",
        ",QF1/",
        "rL%98",
        "t_(;{",
        "ef9YeV",
        "XCe6V",
        "6Ck;V=a",
        "/:hvs",
        "R8=imE",
        ",~A26",
        "cgajq_",
        "J ,OEK",
        "s$36u+r{M&",
        "Valitsin: / DynamicUpdate <parametri> ",
        "igesti k",
        "F/'Hw",
        "9_]y;-",
        "zh-SG",
        "-e{9\\",
        "DcSPv",
        "?Pv~u",
        "nzT%G",
        "WdsRemoveDirectory: Unable to clear attributes on [%s]; GLE = 0x%x",
        "Schalter: / DynamicUpdate <Parameter> ",
        "03X]$I",
        "n completa a Windows vNext, que requiere la entrada de usuario solo una vez cuando el PC llegue a OOBE : ",
        "n Windows 7 Enterprise under natten. Hon vill inte att installationsgr",
        "tBs\\(O",
        "EbU.Q6",
        "o\"$Doi",
        ": setup.exe / auto upgrade",
        " toista asennuslevy",
        "Esempio: setup.exe / auto upgrade DynamicUpdate disable",
        "xJA;l",
        ":~yzz",
        "=HDLN",
        "D\":_x",
        "b)5VPi ",
        "Gdu$;",
        "y)}^N",
        "&xO(oz'",
        "5C#d~",
        "DataOnly",
        "rtuseks on seatud All, proovib installiprogramm installimise k",
        "'h;MW",
        "7Ji])",
        "mkv)dMC",
        "NhZ>i",
        "CDlpTask::GetActionInterfaces",
        "ppp@@@@@@@@@```",
        "&Edellinen",
        "Stikalo: / quiet ",
        "&v&6&",
        "/ Telemetry",
        "=tj8EE7",
        "s.,&w",
        "a%G@$'2",
        "&E0QLe",
        "Create",
        "+nX<J@~",
        "Y8_:t",
        "a3pXo",
        "%s \"%s\"",
        "_>D+l",
        ",mbz)",
        ";X;at",
        "<i?*2}",
        "(}~s~?",
        ":DT&U",
        "pertoire racine de votre m",
        ")Z&7l)",
        "VGGVb<e",
        "0hxUA",
        "_>I):",
        "*?1Ww",
        "J'F99",
        "L$(+L$ +D$",
        "cZ[D3-++",
        "QQSV3",
        "=(=4=@=L=X=d=p=|=",
        ",0YtS",
        "{h_R2",
        "r\"'sY\\6",
        "C]Twd",
        "B(*%n",
        "zey i",
        "e ako s",
        "C.UrD",
        "xeln antar f",
        "*Ta'P",
        "7+Ie3x9",
        "HA3rf.",
        "        name=\"coremessaging.dll\"",
        ":+v6;",
        "n no puede iniciar Install.exe",
        "Primer: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "a(ZZ!",
        "sa, kurulum PBR b",
        " el a teljes friss",
        "uFhi>",
        ".?AV?$CAutoCleanupBase@PAG@RAII@@",
        "h88Yc",
        "6N\"=E-6W",
        "o a invocar o script setuprollback.cmd depois de uma falha de instala",
        "n: inserta el archivo setuprollback.cmd de la ubicaci",
        "{5TD^",
        "g=\\sK",
        "0?\\$@0",
        "l\\zUX",
        "ti k predch",
        ">)?A?G?P?W?",
        "Pk{]w",
        "products.cab",
        "d ^vXK",
        " 2EY+",
        "&X223!R",
        "M^cKg _",
        " : setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "\".!R+",
        "^'s1Ro",
        "gI+i~",
        "ttelse",
        "T&yTU-",
        "I#[i`!",
        "G#Ke\\yUw",
        "wZTK^",
        "ka efter, ladda ned och installera uppdateringar). ",
        "irD't",
        "tLy2[",
        "mA;Pz@",
        "t atra",
        "9)>N)",
        "G$45p",
        ",rL:X",
        "_y[z[hBf",
        "m2FMp",
        "&Oca=",
        "Bx$Y8",
        "Visitez",
        "S6(*0",
        "o : Injeta o ficheiro setuprollback.cmd file a partir da localiza",
        "[`mi!)",
        ": / pkey <term",
        "+`yd,",
        ";l+5(^",
        "0^0j0t0",
        "l!Ixm$`}",
        "`3mwZY7",
        "U0vW0",
        "r'[nS<",
        ";Aj&(\\W",
        "=)!!OE3",
        ">~Bq_",
        "7\\lN/",
        "$~e}f'}",
        "Example : setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "BPGPb;,",
        "towupper",
        "stas naudojimas ",
        "UnregisterTraceGuids",
        "n o creaci",
        "Nainstalovat",
        "@<\\Kic",
        ".=A<A",
        "mn-Mong-MN",
        "e}|s$",
        "T}4RQ",
        "4Y?L;",
        "\\MFr#",
        "_917w",
        "utilisateur qu",
        "?]h3d",
        ":`;{;",
        "<ir9O",
        "P%HLm",
        "C$o9l",
        " migrowane w ramach instalacji. ",
        "W]R>*",
        "@;pH=",
        "GsSvmu",
        "9aCyv",
        "e.,2xJPlN",
        "\"w`\\I",
        "Wr{<Qn",
        "5P$=(",
        "_P8\"7M",
        "GetStockObject",
        "V*_xwD",
        "fk*fBG9",
        "f?K[U",
        " nedeniyle ba",
        "KQJzT",
        "6H}\"p",
        "0|qw0",
        ">Kfr}y",
        "PPHk{",
        "^5zh>",
        "t;>kC",
        "\\iXQ<",
        "H;Dz@",
        "[_AUr",
        "JLNqo+",
        "AK.^%<",
        "hI92rr`mm",
        "-R5C2",
        "m0#yix",
        "ches apr",
        ")Tn,GC;",
        "js}S6",
        "s(hmvk",
        ".?AVIScenarioCtrl@@",
        "a\\UA.",
        "x+Q`V",
        "}FPW@",
        "SetupHost.Exe",
        "oNL71",
        " arabiriminin g",
        "UGo%=",
        "aT5-aw#",
        "adne sterowniki nie b",
        "Exemple : setup.exe / auto upgrade / quiet",
        "`'^:sE",
        "R-9H/",
        "B&A:(",
        "-:^5W",
        "p3cqI",
        "_Gl r;_",
        "k0aSz",
        "OMLvjWcElu",
        "D8 s&/",
        "rnek : setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "4iNC#S",
        "4%Z|V`",
        "[hR6q",
        "+\\tNL",
        "s`U@U",
        "z1d }Wj8",
        "U{7LH\\4",
        "{*.LI",
        ".Zy5}",
        "LbEeU",
        ":'Mpv;y",
        ":':`:v:",
        "o poder",
        ",psQy",
        "\\,m9w",
        "?GP$)B",
        "$/n:&",
        "\\hetA",
        "qsJZ}",
        "d9a<c",
        "3un2,",
        "1::&*a`",
        "666P6]6y6",
        "\"!2\"J",
        "nsefladen",
        "5C6l6",
        "BU0cK",
        "c2:ry",
        "indicateur quiet supprimera toute installation UX, y compris la restauration UX ",
        "rH1,f;g'[",
        "OrgQr",
        "Cx8UzV",
        "K$EEE...",
        "$'4G,",
        "z&{RU",
        "\"#&I7",
        "4/t#>bb",
        "S;]ts",
        "zI]HK",
        "}pdXo",
        "tX`HI",
        "Fj@w)",
        "273>3",
        "{4~{&li",
        "Du kan ikke bruge kommandolinjeargumenter i Windows 10 Installation. K",
        "ciu z okna pr",
        "#N^,Z",
        ",@}!Y",
        "~io-;",
        "J,@V@",
        "X2.Fi",
        "qwIy {",
        "G-L*s",
        "VWh`$A",
        "m, vynechanie softv",
        "k2\\L2\\|v",
        "B50Wu&",
        "ema\"N",
        "#%0D3P",
        "?\"tv1K",
        "a a interface de utilizador da instala",
        "unalnikov pridobiti dnevnike in druge diagnosti",
        ":c/E[~",
        "CK]}c",
        "wT@rw",
        "[]N+Mu",
        "ria: Windows XP com Service Pack 3.",
        "qPWS^",
        "[z6fy4",
        "J]@R[",
        "=4=N=[=",
        "Instalace Windows 10-Instala",
        "V:,Z~b",
        "th=wu",
        ":'R9~D",
        "*rk6W:",
        "==v576",
        "ciju no testa datoriem, ja rodas atteice. ",
        ": / Postrollback <umiestnenie> ",
        "MwX'R",
        "7aF_tI",
        ";yP=x'",
        "hrt wird, reichen die zugeh",
        "%51X~",
        "Parametry: lokalne lub sieciowe (UNC) ",
        "r2(+\\I",
        "U}6T<",
        "W)R^hB",
        "vUyQU",
        "8qzI ",
        "fh$p,Y=",
        "nv(fn",
        "b\"dLD",
        "iC[0m",
        "unalnik in/ali uporabnik dovoljenja ter omre",
        "w6r/&?",
        "!BKH.0",
        "bkXuI%",
        "Hq7qv",
        ">@[HK",
        "aucun pilote. ",
        "iz|b+\\",
        " la telemetr",
        "ZR:w^ll",
        "en-MY",
        "J?Sv.",
        "*Zi'y",
        "`X!4E",
        "`y..b",
        "0r&RF",
        "i dup",
        "_4<{]",
        "+VEtF",
        "eZf\\8",
        "?g7UP",
        "GetFileVersionInfoExW",
        "Defer",
        "7J.)['hR$",
        "installation va collecter et t",
        "e?7vx",
        "*I/;U",
        "  ,>U",
        "Esempio: setup.exe / auto upgrade / noreboot",
        "tor skop",
        "s|`_c",
        "Exempel: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "}y_\\u",
        "3zKykZ",
        "Q|%^k",
        "j6<Rd",
        "l5Y[f",
        "62'rl",
        "F'5qaIM",
        "8!93R",
        "efhBk",
        "e+TvD",
        " }h)+",
        "=8>Q>",
        "cqwP]",
        " hingegen auf ",
        "u.|?w",
        "m9Vw3",
        " operazioni di Aggiornamento dinamico (ricerca, download e installazione di aggiornamenti). ",
        "F!1r7",
        "tre suppose ",
        "&;ReO`<",
        "\"h\\[0",
        "]K?I3",
        ">fCnu",
        ">7>h>o>",
        "Zho J",
        "4]JSw",
        "pO\\Q}%w",
        "iFu'7",
        "WGVYfe|:",
        "CQY[.",
        "#JEN)",
        "}NLS/<q_(l",
        "Npf)>",
        "Azione: il programma di installazione non riavvier",
        "f212G<?",
        "jjW5D",
        "9jb_qDg'",
        "$MH'mf",
        "=R]rW",
        "Source directory [%s] has older files; will not copy it",
        "CUpdateScenarioCtrl::CreateCommandLine",
        "{{|:W",
        "b*STA",
        ".}xMk",
        "Gv0${",
        "s\"+>_E",
        "NKX%*",
        "3Z3r3}3",
        "Na primer: setup.exe / auto nadogradnja",
        "4I;: ",
        "n uudelleen seuraavan kerran, asennusta jatketaan. ",
        "o{}G~'",
        " cesta UNC ke slo",
        "0JY=`",
        "YtwZa<",
        "]a~(Ip",
        ";.b\"w%",
        "Q}Jf+}(G7",
        "kgZ<1+",
        "om re",
        "6/3&iG",
        "45$MC ",
        "Windows 10 Setup%Windows 10 Setup wordt al uitgevoerd.kDeze versie van Windows wordt niet ondersteund. De vereiste minimumversie is Windows XP met Service Pack 3.",
        "?1?B?G?M?",
        "id-ID",
        "cE#k<",
        "0T?e:",
        "#[bM&",
        "tp04V",
        "8Y%=dWS0S",
        "Lq,'x",
        " 'QZ@",
        " niveau Windows. Les arguments de ligne de commande suivants permettent de modifier le comportement de l",
        ">)G~*",
        "Ejemplo: setup.exe / auto upgrade / PBRupdate disable",
        "_TM\\_",
        "8!8(8/8O8V8]8d8",
        "_`#]+",
        "~?uWo",
        "`;'`K pl",
        "JxQR^s",
        "I@nAt",
        "v4z1+",
        "ScenarioCtrlHelpers::SetStateInRegistry",
        "$*(HII",
        "v.KMF",
        "]L3B9",
        "jHiDZ\"4",
        "{I0ng",
        "t3C;]",
        "UW^JfL+",
        "PaIsj",
        "='>v>",
        "\\8|4n",
        "_jV\"o8",
        "ete n",
        "9E9_9l9",
        "~e~\\-",
        "/[.l7",
        "wo-SN",
        "J;M-p",
        "j<#<=",
        "Va\"qO)q",
        "@ZpG+",
        "lne prejs",
        "q~_!Q=",
        "@Rmbe$",
        ":;}3<",
        "  %s: %s",
        ";q&slK",
        "N`tAn",
        "~Q|0%",
        "}G:DH<",
        "-?S;Z-",
        "d:^Etw",
        ">NK9I%u@",
        "PPP@@@@@@@@@ppp",
        ">ug~I",
        "%6WU@",
        "2{g1Zf",
        "&5e@}k",
        "Aq/R>",
        "2_$\";",
        "Handling: Ved fejl kopierer eller overf",
        "W5{D:X",
        "9bK\\lJvAc",
        "b<IIG5",
        "Ajutor",
        " votre PC",
        "i(!Sn",
        "#~Rfc",
        "\"rJgy",
        "L$_c?v8",
        "@@@PPP",
        ">Zav]{",
        "#cP6'",
        "rmG9M",
        "(-'W3",
        "Prebacivanje: / pkey <",
        "ete mo",
        "s4?R'",
        "Z9h:m<x",
        "%? KG9",
        "ErI'y",
        "C;ADk",
        "yc'~A",
        "m=Ktju",
        "Tr?Y1",
        "?9?F?d?~?",
        "<xT<9",
        "=#=>=g=",
        "e et les composants sont d",
        "*)x}!",
        "?Q2!c-Z",
        "4gU$$",
        "F<E)A",
        "#w+VF",
        "ciGx^e",
        "PPP@@@@@@@@@@@@@@@```",
        "Ta@Da",
        "nARe8",
        "GetUpdateReserveManager",
        "iva_ZN",
        "Tq&AA",
        "uY<aW_",
        "6<pxk",
        "Sw%T9",
        "o do Windows. O requisito m",
        "bory driver.inf do zadan",
        "r{DB$",
        "#_V?j",
        "y?k1X2",
        "uO]<Z",
        "0<I%D",
        "Switch : / pkey <product key> ",
        "/`f6C3",
        "*i}9?",
        "WS}$/Hn",
        "#YAnX",
        "Unable to hardlink: [%s] -> [%s] (not same device)",
        ",]NnY",
        "jvuj3",
        "wxbgV8",
        "WaitForMultipleObjects",
        "H@\"d ",
        "AElKI",
        "ey;$V",
        "rPw4X",
        "i1rTH",
        "HE'|j",
        "rstegangskj",
        "+e_ca",
        "*}R#\\]",
        "e prikupiti i prenijeti telemetriju koju je generirala instalacija. No kada je / Telemetry postavljena kao onemogu",
        "<|_+V>@",
        "4OKl0",
        "1nija{",
        "9)A9N6",
        " chov",
        "metro : / showoobe <par",
        "GxvMxN",
        "=`m<e",
        "*S4E^cb",
        "WgLkXA",
        "&((SI",
        "Nm%1t",
        "Administraator soovib ",
        "4VW+]",
        "tTPU`",
        "nds f",
        "=Proovige installiprogram k",
        "X&Yia",
        "GetTokenInformation",
        "5f>jc",
        "   @@@000",
        "72:I1",
        "anas programma jau darbojas.q",
        "sr-Cyrl-RS",
        "c&g:pg",
        "j>W@^",
        "j/f7X",
        "v#R'.",
        "M+\"Fd",
        "nOJa%X",
        "dzie ponownie, tym razem wybieraj",
        "?R29dLA",
        "rQK-9U",
        "FH `d",
        ";)nYO",
        "nlV}7mg",
        "i+>aT",
        "QnHJV",
        "#0t6+%B",
        "=fB-\"SN",
        ",IZ '",
        "/Boot %s",
        "rksadgang til den angivne filsti. Kommandoen k",
        "q!k]G",
        "vnu architekt",
        "`e<j=Q",
        ",j=<XW\\",
        "f(=:<",
        "D72$t",
        "^S.e|y",
        "B35P&",
        "w^`%&$",
        "CjM9y",
        "es-BO",
        "X]Dcu",
        "bFXyDL%",
        "W?XrY",
        "%}bAY",
        "9,I%tr",
        "xRIto`'{",
        "T$SI4{",
        ":'5wB",
        "sY[mU~]5",
        "!whq!",
        "NXouq",
        "Ordner mit .inf-Dateien. ",
        "2JLNNNpp0",
        "`t%FWo",
        ":Xq;\"/",
        "$@*f:",
        "nBssFXb",
        "9UM&N\\RG<\"",
        "J&Bc9",
        "%9UZut",
        "tted taastatakse. ",
        "F;/}d",
        "Xzno_D+S",
        "9]\\WIFS",
        " festgelegt ist, wird die PBR-Partition durch Setup nicht aktualisiert oder erstellt.",
        ":Rs28",
        "*7<:5:",
        "'}(\\\"",
        "<sUV4",
        "9/[k_f",
        "VPQjB",
        "Exempel: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "NN\\J ",
        "^YIha",
        "E|Z9@",
        "]cq[I",
        "yyyb2b",
        "#012&K",
        "\\F0E;",
        "QA9ya",
        "!~q\"K",
        "1;q<ETa",
        " ejecutando desde una ubicaci",
        "q*e-<",
        " \"v^k",
        "!JOzL",
        "wcsstr",
        ">$?C?I?e?p?w?",
        "%!_^R",
        "6Kz.Iq",
        "o9X`m",
        "$5oO\"5",
        "(dgq(",
        "6q?q/",
        "^Intenta",
        "lPc`-6",
        "V~R`Z",
        "$[GX$8",
        "x&0|U",
        ".xmK38",
        "E+)9k",
        "oq9uV",
        "Bb!'!",
        "LhRVM`",
        "O<F;+a",
        "lQ,2F*",
        "cx'9V",
        "Sistema Operacional Microsoft",
        "]ASW2",
        "CUZpTHW",
        "xk2DB",
        "'`6d0fc",
        "1URUJM",
        "@g@Na!",
        "m:qNG5",
        "3WO+A",
        "tora. Pravdepodobne prebieha aktualiz",
        "\\9VKK",
        "4DLIU",
        "2!2&21282>2R2}2",
        "his alistab mis tahes installiprogrammi UX-i, sh tagasip",
        "DUO>k}",
        "Wm/~?",
        ">F?xS",
        "Bv?IP3",
        "h/n,hiS<",
        "una da izaberete ta",
        "<+<1<C<I<\\<b<",
        "Ambf]",
        "#CGyo",
        "]{P:GQ",
        "`````2!!",
        "%)gCI",
        "Y1 na",
        "x6Sr}U$",
        "HeapFree",
        "9'x;*I",
        "nm0_F",
        "/ZOdo",
        "t}EB.",
        "H>!r\\",
        "SCef:/}",
        "9Fj@}",
        "t\"dv:",
        "0}RNv",
        "9Z.'r}",
        "hren.",
        "*#LUDm",
        "-p:s,c",
        "E5l.a Z",
        "rbereder installationen av Windows 10#Installationsprogram f",
        "ki programi",
        " wszystko b",
        ",xp(o",
        "nMZjv?",
        "0PsRW",
        "B1_SML",
        "hxu2T",
        "kkulcsot. Ez a param",
        "JHCpXE4x(",
        "ole32.dll",
        "WE:2|_o",
        "es para mais informa",
        "r du opgraderer med volumenlicenserede medier eller medier, der indholder filen pid.txt i kildemappen. ",
        " a mo",
        "kynYg",
        "c}9M=a",
        "rma komutu verir : ",
        "4d2Hb",
        "j9uVQ",
        "{m@Eq",
        "'mGN41",
        ".[SFN",
        "N1&4Yv",
        "=u!+yZ",
        "X6b.M",
        "b=Ssg",
        "\\IH[hUp",
        "xe\\|,F",
        "!mi=^G)",
        "6?6x6",
        "=r\\H>",
        "-.H>^",
        "% TeO",
        ". Lis",
        "Voorbereiding",
        "T~/_Ly~pe",
        "|&CG,",
        "(Z.M2=",
        "i instalaci zobrazovalo u",
        "%+;B6",
        "$ zx?",
        "Iz]~-",
        "-l*q0",
        "*\"V-w",
        "/RollbackUser %s",
        "Nq-X;",
        "|0)[p-",
        "jsist",
        "#6_ePx",
        "j<o;o",
        "NL5wL",
        ".rX-V2",
        "|x=E6",
        "Action : When / migratealldrivers is set to All, setup will attempt to migrate all drivers as part of the installation.In contrast, when / migratealldrivers is set to None, setup will not migrate any drivers as part of the installation. ",
        "&<0%}b",
        "SXB;Yo9",
        "{^|t?M",
        "kFH1=",
        "9Eg4mb",
        "sEntB",
        "tU+tts5",
        "FSeri",
        "9=\"W/",
        "CJN?*o#)/",
        ";5<;<F<M<_<q<v<",
        "ur-PK",
        "~OWoPO",
        "E|d%%",
        ",<A7@",
        "idkWKs",
        "+Z7-}",
        "tkTfE",
        "RrIUU",
        "GetClientRect",
        "ZKx8I",
        ")Xx*Hx",
        ".Nu6<Ro#",
        "zv2 AI",
        "Microsoft Corporation1",
        "Wk]f,g~E",
        "1'2ce",
        "h[1=z;",
        "I-\\QH",
        "niQ1[",
        " partir d'un r",
        "Z2(`=",
        "Rj,US",
        ".?AV?$CAutoCleanupBase@PBG@RAII@@",
        "=psye",
        "%E|*Wz",
        ")z_$t_",
        "h&^/w",
        "H[]j&",
        "l&4!e",
        "?#?7?",
        "a argumente iz naredbenog retka. U naredbenom retku pokrenite \"setup.exe /?\" iz korijenskog direktorija instalacijskog medija.",
        "!fXV\"B",
        "-<OP.",
        "Rollback",
        "[o76dM",
        "5<PGhWq",
        "8,8X8",
        "I})D@",
        "dia sur le disque dur",
        "installation. Lorsque / Telemetry est d",
        "iQO&ET",
        "lvV:p",
        "TotalBytes",
        "Ge)/*",
        "i gerektirerek, Windows vNext",
        "^H(mS",
        "trMKZ",
        "p1e}E",
        ";duLA",
        "%Uv(-",
        "i;@@r[",
        "HJ@r8i",
        "G#zoQQ",
        "pYi2]",
        "7 7$7<7X7\\7`7d7h7l7p7t7x7|7",
        "Parametre: Cesty k lok",
        "Qbsq`_",
        "a[2M?",
        "$WINDOWS.~BT",
        "%Klargj",
        "9Tub;",
        "Ja*KR",
        "'.%t.",
        "M%#SP",
        "y3A9#",
        "b\"tWC",
        "Qol/O",
        "5%<ezW",
        "iu-Latn",
        "Toiminto: asennusohjelma lis",
        "6/#^_A",
        "H;Ya&",
        "]yLuC",
        " Instalatora systemu Windows, gdy jest ju",
        "1v<k:]",
        "SriHl",
        "'(%}SS",
        ")v)]Q",
        "|'G\"f",
        "ka-GE",
        "jRqd:",
        "~D4o\"a",
        "Uy`)G",
        "KsP_W",
        ";Q#sD",
        "/dgPq",
        "*xRKn",
        "j9vQ5",
        "?0d5\"",
        "353G3P3b3",
        ":@V9LE.7",
        "_e:5%",
        "w_^6e",
        "!k$[]",
        "EPSi6",
        "cA~sR",
        "  DiagTrackRunner.exe",
        "7HR_R",
        "omG'9 ",
        "Do>cmg",
        "/b*kB",
        "<{*\\]{",
        "$bYHi",
        "35Ne6||",
        "Wa2[m)z",
        "S : Ezt a kapcsol",
        "kc2zT",
        "B-vHCsC",
        "0_04X@bk0",
        "BoxMovePath: Using target path [%s].",
        " UI-spr",
        "8{3;$9",
        "Tj``hhddllbbjjffnnaaiie%",
        "CDlpRegistrar::CreateAction",
        ">d`CM0",
        "0h0m0",
        " possibile avviare correttamente il programma di installazione. Riavvia il PC e prova a eseguire di nuovo il programma di installazione di Windows 10.",
        "7!9Oy",
        "7(7-72777<7A7F7^7d7~7",
        "Preparar",
        "idla. ",
        "/Pw}q",
        "ss_8=",
        "f:UYpU",
        "!vN8.N",
        "WxK)t",
        "azR*%",
        "/]i~d",
        "x~V!*d",
        "NGdiK)ro#X",
        ";Q!/Y?&z",
        "u4>Z!GE<",
        "stup k zadan",
        "=kxSU",
        "2`S)%",
        "[j&kr",
        "&zqrjq",
        ")coL5",
        "e izvaja drug primerek programa Setup. Morda poteka posodobitev funkcij. ",
        " s,IRP",
        "CSetupLangIniLoader::Initialize:     Language pack file: %s",
        "<\\t4f",
        "zF4AEPdQ\\0",
        "rja be az eszk",
        "CMediaScenarioCtrl::PopulateWorkingDir",
        "Uc#qT",
        "[2AbN",
        "CDlpRegistrar::RegisterActionFactory",
        "znw'HK",
        "[J<#t",
        "q@..A",
        "o pode ser iniciada devido ",
        "llil|^",
        "/_i/F",
        "9:9A9t9",
        "[k^Sh!~",
        "&:uofw",
        "R%'uj\"",
        "G%=El+:",
        "wm+(tY",
        "rYT^wk",
        "# D`L",
        "fL_CvZ",
        "gd ]5L",
        "i>1qq",
        "m=&l5",
        "o de m",
        "ig-NG",
        "liti: / installfrom <asukoht> ",
        "181UZlgFzQ",
        "\\~*n)",
        "'R1^L",
        "N[)Y5",
        "p(pJz",
        "zlTAf#",
        "NQj+4",
        "https://go.microsoft.com/fwlink/?LinkId=530045",
        "uw'4ZkU",
        "m(S1X",
        "~$\\oA8",
        "Fb;@R,",
        ";$;,;",
        "po&&g",
        "/+;ToN",
        "[Ex\"E",
        "Exemple : setup.exe / auto upgrade / noreboot",
        "Jw|Da",
        "Dge&t",
        "-_~HD",
        "PYa1TP",
        "^mYaH3i",
        "cd#PpG",
        "e+cCK",
        "rA7He",
        "yg@`8",
        "DeleteFileEx: Unable to remove [%s]; GLE = 0x%x",
        "Ft&[R;",
        "AO$r^AO",
        "C1vTh|$",
        "PB/FH",
        "):jol",
        "turulan telemetrileri toplar ve kar",
        "6=\\oKm",
        "`fMR2",
        "LRuYm",
        " a v testovac",
        "w,Y'rV",
        "PO~sA",
        "e#C|Q",
        "kYJNr,",
        ">lWw\"t",
        "<X#-LK",
        "CRX^q",
        "Parametre: neuveden",
        "Eb7D')",
        "e^,*U",
        ".7tQ4",
        "lkomstprogrammet hoppas ",
        "qu]Ar",
        "Llf7q",
        "V!J]VSc",
        "0-;-=",
        "va vyhrazena.",
        ":v6]_",
        "e`Jc~",
        "l,^/,k`",
        "Sa$r5",
        "j7A<`",
        "7]/NE",
        ";AA6:",
        ";rQv5_",
        "g0GC7",
        "cZ,^l1e,R",
        "@C$Grw",
        ">} M+",
        "sit p",
        "Y Wne",
        "{qW19",
        "shoz olyan helyekre, amelyekhez felhaszn",
        "Q)3=U",
        "}L86l",
        "Ze}D}",
        "=mwA'",
        "Sources\\winre.wim",
        "oNwC6N",
        "#g#m2",
        "Uu%2,",
        "les installimisega seotud telemeetriaandmeid. ",
        "}Yy7Q",
        "CAzureScenarioCtrl::DetectResumeMode",
        "\\\\n+w6=6",
        "lXkf7",
        "JJejss",
        "lti fel a telep",
        " DRUr<",
        "gaRrvOZ",
        "stroj zkuste spustit znova.zKe spu",
        "x:|x&",
        "wv;?9",
        "ukCk7p",
        "x}N_s",
        "BA.LkJ",
        "6F-3%lX",
        "[Yqv__n",
        "/@$$?/",
        "6!7_7l7s7",
        "6xh@d^",
        "!MrH(",
        "KRSO[Z",
        "xaf_{49/",
        "dwgu1",
        "ajte ponovno pokrenuti alat.iDa biste pokrenuli instalaciju, treba nam najmanje 350 MB. Oslobodite malo prostora pa poku",
        "%<B\\I|",
        "=ktSU",
        "Pn$y`",
        "lnit o ",
        "l6Kxi",
        "PKq|t",
        "]A~}a",
        "vl0~}",
        "A]S]W",
        "6@kn ",
        "%ngz8+}",
        "Z#!%E#",
        "c~1F\\O;y@",
        "n>2SYY",
        "  pidgenx.dll",
        "R7j/q",
        "s de que se produzca un error en la instalaci",
        ", negal",
        "]mq6o/",
        "nite miesto a potom to sk",
        ".?AV?$CZeroInit@V?$CDlpAutoDelayLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@$00@@",
        "EtXEG4",
        "<!zy9",
        ".lHH^",
        "?ejV6#",
        "Zi]o}",
        "?^65`",
        "A06f:08H",
        "o: ap",
        "0n{%n",
        "f`Cd$",
        "IA7Rf",
        "{58J>w",
        "O/6 5",
        "rket med %s-bit. N",
        "CDlpRegistrar::GetResponseFactory",
        "T#'rYt",
        "<G^+V",
        "\\$$F*",
        "^l~;/HIF",
        "poaq9",
        "StateMatch: Current mode is Install - Attempting to resume...",
        "#F!SxFa",
        "sg*Jd=m",
        "+vYz5",
        "Gebruiksscenario ",
        "Clk$p",
        "3u1%tU",
        "y>^6~X",
        ">W@H;",
        "l0WAn",
        "!%&WY",
        "S\"=@Z",
        "<|;]h",
        "{b<|DQ",
        "V5]G9",
        "Ae~E+",
        "[}sp&",
        "                 level=\"requireAdministrator\"",
        "n desde una ventana de s",
        "Schalter: / Postoobe <Speicherort>\\setupcomplete.cmd ",
        "        name=\"fltlib.dll\"",
        "Qp'i4",
        ")eoTn",
        "VSjb3M",
        "R?b `",
        "]1`A=",
        "e da utvrdi jezik korisni",
        "@#~\\}\"",
        "z+eYk",
        "Config",
        "CDlpManager::GetTaskCount",
        "b8p9`QwA",
        "kernel32.dll",
        "nainte de prima conectare a utilizatorului. Ruleaz",
        ")jJ;|2",
        "!;8V11",
        " x1I\\",
        "n de Windows mientras se est",
        "C<q05",
        "i selectat-o nu corespunde PC-ului dvs. De exemplu, dac",
        "KoNgOk",
        "+jHPp",
        "te de la ",
        "SetTextColor",
        "Pokra",
        "Conmutador: / quiet ",
        "T'Qd9",
        "^:8<4",
        "Ph !A",
        "&q) q)",
        "@w6Po",
        "7kuW-",
        "nsker, at slutbrugerne skal gennemg",
        "Yfn]V",
        "jp<~-",
        "~;8,$",
        "kX}%{/d",
        "<Sl^m",
        " na hodnotu All, in",
        "Eksempel: setup.exe / auto upgrade / postoobe c: \\script\\setupcomplete.cmd",
        "W{9lN",
        "%cm`&U",
        "jhNY( 'p",
        "latmada bir sorun olu",
        "O:_%3",
        "jXUC@4",
        "f&7xr",
        "Y\\u4F",
        "W<cD7-Nz7^",
        "hZP4P",
        "en genstartes, forts",
        "cRO]U",
        "0c<ST",
        "6o:<C",
        " ou carregar",
        "k=^~L[",
        "Uyumlulu",
        "C.a%g",
        "mu Windows nejde spustit kv",
        "VE>C|",
        "9 9-9K9e9r9",
        "th6e=",
        "3\"U2\"",
        "nds som parameter f",
        "\"Z6WG",
        "TYMuI4]r",
        "3o<I1\\M",
        "*U.^wv",
        "/3j>p",
        "si[Y_",
        "pk=_aE|*",
        "~~[IK`",
        ")=\"+#",
        "9]L+.",
        "G_w^ti ",
        "CDlpTask::CheckUserInterruptEx",
        "t 64bitovou verzi n",
        "Commutateur : / quiet ",
        "kler.L",
        "!PbpIt",
        "SetupPrep.pdb",
        "|h\\oD",
        "$|O'S",
        "O4WE9",
        "| fql",
        "Setup wird vorbereitet ",
        "d_)~Y",
        "<Uw8J",
        "SE^@O",
        ".tls$ZZZ",
        "uC+#1GO{",
        ".J^rU",
        "#Two,]A",
        "Preparazione in corso: %d%%",
        "We've detected the install is occurring from a network location and may have hit an intermittent network interruption. Please try setup again",
        "cxZHM8e",
        "k}er}",
        "/XFvg",
        "bQl9?",
        "i instalaci aktualizuje nebo vytvo",
        "E~9n.",
        "3}nMqDE",
        "pLTSbT",
        "lti. A telep",
        "bJ!P ",
        "w|\\.0%",
        ";$;,;4;<;D;L;T;\\;d;l;t;|;",
        ">!$rk",
        "_'o?]",
        "om vstup pou",
        "U,5rp=",
        "PP<n:",
        "aA4sW{",
        ">@Q2I",
        ";rMd2I",
        "Rk&Et8",
        "5(/|%",
        "]2Ij+-",
        "[xU%{",
        ":r!0l",
        "woOo}L",
        "}($_P!y",
        "+I}UK-",
        "1u2De",
        "IDR_SETUP_FONT",
        ",Nqm0A",
        "*>e~:7",
        "}~hqIRM",
        "Na primer: setup.exe / auto upgrade / Telemetry enable",
        "CSetupLangIniLoader::Initialize: Cannot set current directory to '%s'. (hr = 0x%x)",
        "iYjYfi",
        "xZ<'v",
        "RuwO;",
        "hltAO",
        "yMN\\C",
        "e u kontekstu sistema, pa mo",
        "l|pov",
        ",&H^K5",
        "ZnQfO",
        "vLN\"Q",
        "Udu3._",
        "za&>M",
        "y|ppy",
        "Rb21$",
        ",&IW)W",
        "unarom",
        "E-ds2",
        "YZ!E~",
        "8OWM<",
        "tfen bir Komut ",
        ".?AVCSetupDialogSplash@@",
        "zJa.g",
        "d<V i",
        "CDlpManager::GetWorkingPath",
        " ha tillatelser og nettverkstilgang til den angitte filbanen. Denne kommandoen kj",
        "mu. Sp",
        ":rUb)T5Q",
        "Fy<2G",
        "p260K",
        "ekilde ba",
        "ak automatizovan",
        "WF^tztAtw",
        "\"W+v`",
        "]+1Rr",
        "$HFopb",
        "V6]6\"uo)b",
        "fwi$}",
        "`;#TR",
        "h7o'r",
        "N;j6'",
        "oZWKbGM",
        ";_(7A",
        "fK3=g7E#",
        "-'NBB%",
        "A }/u",
        "}.hf!",
        "GEq^q4",
        "SjvvF",
        "4(444@4L4X4d4p4|4",
        "tajZP",
        "<^L=T#",
        "Switch: / noreboot ",
        "}2gY&",
        "cessitent des autorisations utilisateur.",
        "KE`.-tE",
        "rHa_1?",
        "WtK^?",
        "r / PBRUpdate er angivet til Disable, vil installationsprogrammet ikke opdatere eller oprette PBR-partitionen ",
        "T4l!_",
        "[:V9&1tG5",
        "#b=23",
        ": setup.exe / auto upgrade / Telemetry enable",
        "4 dh6",
        "?jR}`",
        "KtGDItG\\Y",
        "o^&xb",
        "RF{\\e",
        "n)IZL",
        ";|p?3",
        "/Selfhost %s",
        "HYGn ",
        "hakemistossa.",
        "<[YT\";{",
        "GOb>/",
        "F`R%2",
        "j.Yfr",
        "6D6K6u6",
        ")~WS4",
        "2}8A!",
        "oVqh4n@",
        "ak maj",
        "eQw}5",
        "jIeh(",
        "@q1UWL~",
        ":CwWK*lS",
        "TV.@3",
        "jra az eszk",
        "e!0`sa",
        "~pc{)",
        " diegia sistem",
        "8Pa!p",
        "Naozaj chcete skon",
        "o(xBTx",
        "*_Ot[",
        "TF83kt",
        "\\ ('aE",
        "efke&",
        "Remapping DBG_TERMINATE_PROCESS to MOSETUP_E_TERMINATE_PROCESS...",
        "\"+vMr",
        "_\"6 T",
        "6( g\"",
        "+!O<y",
        "'e9+(",
        "a$TC%m",
        "6B6V6a6",
        "?JAL\"",
        "BoxMovePath: Moving [%s] -> [%s]...",
        " z navedene poti. Datoteka ",
        "1lV((",
        "Odj`iof",
        "#4B_i",
        "1?3]Z",
        "w&td9",
        "xhB5Rp",
        "ch dat, p",
        "$p~ro",
        ">{?S}",
        "SetupDU files found in CmdLine.",
        "%erw]",
        "]8@K:.",
        "8\"=0oz",
        "diom alebo m",
        "%3kYwc",
        "Ji 6,",
        "6kk3C",
        "ka 64 bitu versija. M",
        ",ev6'",
        "uwkwP9 ",
        "ag/D+",
        "_iLXk",
        "b{?gW",
        "njo prvega zagona. S spodnjo ukazno vrstico je mogo",
        "n keer gebruikersinvoer vereist in de",
        ")C*g`[",
        "===i=",
        "qOF}@",
        "M^-e}",
        "d|cSt",
        "JE,#G",
        "*UA;H",
        "pe69;",
        "ke programe u sklopu instalacije. U suprotnom, ako je / migratealldrivers postavljen na ",
        "d{W_`",
        "/J6Bna~",
        "Oi\"t$",
        ">:&r[^",
        "1~psDv",
        "A:Heh",
        "F8p.z",
        "@hR)'",
        "[/Ol6",
        ")W<\\w'C",
        "w@N8N",
        "bcooy",
        "rITNM",
        "WxFg|",
        "8YZdK",
        "#r[HH",
        ":V%V(I[yu]a",
        "o para Windows vNext, requerendo a interven",
        "]^au$",
        "l EPvm",
        "/g~Oi",
        ". Setuprolback.cmd est un script personnalis",
        "~*17%",
        "]\\oI6<~35",
        "|}f=e>",
        " telemetry ",
        "&Y36Cya",
        "9jfRw",
        "$4C =",
        "_n2hV.",
        "tS84j",
        "LB};\"",
        "ojcn\"",
        "na#u-",
        "|r;1|",
        ")`KdI",
        "yyyooo@@@",
        ")o!.U",
        " \"%s-bit\". ",
        "3P8BM8A{8@",
        "Na primer: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "#Y`$s",
        "lVJ7.",
        "d0lZDN",
        "Re\"y5",
        "r / PBRUpdate ",
        "]^c[7",
        "QIz70?",
        "'$:n;q",
        "Se verific",
        "[#ogr",
        "9 9(90989@9H9P9X9`9h9x9",
        "Error launching rollback command: hr = [0x%X]",
        "5%\\SS3+++",
        "AjhCG",
        "FBf;E",
        "{6>ewk",
        "Y<5s3",
        "XW*i-l",
        "^uOxB",
        "`xMWK&d",
        "7|OB2",
        "xKicr",
        " program sa nepodarilo spr",
        "?0#1~",
        "*Q=|)#",
        "$hmtxO",
        "'028x`",
        "u^AvW",
        "Q!y1`",
        "2Y\\!G{",
        "+i=cq",
        "Vi har registreret, at installationen foreg",
        "]rC90",
        ")_D>Doq",
        "fz0ma0%",
        "i+$b$s",
        "lck8^/T",
        " Enable, ",
        "GetObjectW",
        "ci no",
        "tmenetileg megszakadt a h",
        "Bz Ws!",
        "&36X$k",
        "*ob_kN",
        "ytkownika). ",
        "JNyL[",
        "x;IUk",
        "gj .a",
        "Or4P_",
        ">/R9^-YE",
        "XkRp4",
        "aT937*Un",
        "NtClose",
        "Segoe UI Bold",
        "fX[(Wlx",
        "Toiminto: kun valitsimen / showoobe asetus on Full, k",
        "OWSO|@",
        "JK#JwQ",
        "~Np<%",
        "JT%C?",
        "R2/h`",
        "xc!$Q",
        "4(B~&",
        "dmKYna",
        "O?[`6Bf)y",
        "spJvE",
        "<'z\\Y=",
        "pRYo`Y",
        "!4=_}",
        "C,8)A",
        "S8[/e",
        "Action : En cas d",
        "H O\\\"",
        "~d`(B",
        ";GC]he",
        "Parametri : lokalni putovi do datoteka i UNC mre",
        " mancano alcuni file di installazione. Se in precedenza hai avviato il programma di installazione da una directory locale, copia di nuovo tutti i file di installazione nella directory e riavvia il programma di installazione.",
        "pq#A`}",
        "<&o5H",
        "s Windows Update lapj",
        "M22KSLh",
        "37\"8*:q",
        "3=4J4Q4",
        "9_\"@^-]4",
        "MHiYV}",
        "|276%",
        ")j\"RB",
        "6`qC\"",
        "\"e-Nq",
        "iihuu",
        "skor keletkezett telemetriai adatokat. Ha a / Telemetry ",
        "Install",
        "SW=zz'",
        "uXH}8!?",
        "qHI>/",
        "787Wmp",
        "?qX D|j",
        ".\\bc;",
        "#:mWI",
        "kyX+x",
        "73$eR\")Jv",
        "@gFVWbL",
        ">RvPb",
        "o0V0[",
        ",Rb$V)J",
        "n 3+P",
        "&[FMN_",
        "mU6Mg",
        "Vj>AL",
        "%O7b(`yBu)",
        "oxS:[@",
        "WD/hL",
        "${Y{*",
        "uW0~0W0_0;",
        "HqcUj",
        "g>f:y",
        "trehoz",
        "e pokrenuti Install.exe",
        "DoGL,4^",
        "fremdrift",
        "ulx7p",
        "?CwMw",
        "bB[)L",
        "1d;ue?",
        "@Kj?P",
        "rX!V5Tbs",
        "&OdAl",
        "]{`SU",
        "7x9*x",
        "3Gd,R",
        "}T{Bs",
        "J_ig/",
        "[ X!XK",
        "]qXTU",
        "|UrUgpv",
        "=Bg{j$ol",
        "-3Br_F",
        "Parametri: 5x5 produkta atsl",
        "f}NY/e~",
        "ACQ9,",
        ",tq;n",
        "{kN^<Q",
        "!%jfL",
        "n>UV5",
        "-l<-/",
        "V21P+",
        "vdssC",
        "x}}]|",
        "installation. Ce param",
        "v.n4b",
        "Pb\"q4",
        "`5q6ts",
        "^o\"\"s",
        "SN1uqc",
        "Tikrinti suderinamum",
        "??1type_info@@UAE@XZ",
        "outil. R",
        "tett napl",
        "|OyrN",
        "0oM&v06",
        "d!<Vq",
        "Esempio: setup.exe / auto upgrade / showoobe full",
        "~'f^E'",
        "taVP`(",
        "#Q9De5",
        "`,M0ni?",
        "ad: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "vI4@z",
        "KE}Y.",
        "xC4 3",
        "!Tl3hFJ",
        "@#Zx{",
        "l+>w+P~",
        "dzis: / copylogs <atra",
        "~%{O&",
        "?IhufmL",
        "x02cS)1.",
        "6-W`i2",
        "6J9>y[3=94",
        "m[HBG`",
        "E`T0,p",
        "ZNf3N3",
        "oqTVY27",
        "f2AQh1",
        "m@2x>",
        "p/=)_",
        "h1<mL",
        "KFv-)",
        "uHB:r",
        "N^A{>",
        "u[u\"\"",
        "X 4%mC",
        "F,FSK",
        "D9&mLb",
        "pIJvX^-s",
        "JS$=x_>",
        "iwyZ-\"w",
        "Program za instalaciju sustava Windows 10 ne prihva",
        ". %1!s!",
        "GetFileInformationByHandleEx",
        "uQ\\GB",
        "Jq.s#?",
        " parametr Enable, instala",
        "ZK,-h",
        "R</h`",
        "{%S=D",
        "(<mtB",
        "tirme etkin, telemetri toplama ve kar",
        "y|jg:@G@",
        "$!o&G",
        "0 0Y0h0",
        "h3\\n`",
        "b9N$d",
        "]&D}+",
        "~blO7",
        "$&Xa}",
        "oOU-r",
        "HUEl7",
        "rd: Med flaggan quiet d",
        "ranka atnaujins arba sukurs PBR skaidin",
        "E.1@`",
        "xRjhzK* ",
        "TGypP?m",
        "lgende standardkonfigurationer: Accepteret slutbrugerlicensaftale, aktiveret dynamisk opdatering, tilmeldt telemetriindsamling og -overf",
        "mJ>dn",
        "$31zN",
        "%SZFw5Xq",
        ".a~ov",
        "4zH1N@+",
        "9PUG^",
        "H^s@9b",
        "{5Nt.",
        "RZ/'wm",
        "$o0&$o",
        " M7m%",
        "*kYe=",
        "Prenos",
        "racijas: sutikimas su GVLS, dinaminis naujinimas ",
        "?r)Wv^O>",
        "1UwL-\"",
        "N[ 3vS",
        "j\\2[Kw",
        "mi vybran",
        "P6SR&",
        "com escolha de migra",
        "7\\D4p}$",
        "Preveri zdru",
        "G,1$l",
        "r komponenter. ",
        "q:l0?",
        "E/u1{",
        "WC11\"R",
        "s vai aug",
        "^Fp[T",
        "pnh+z",
        "Lb\\V>",
        "`1DsVX6",
        "Continuar de onde eu parei",
        "|c@>9",
        "*/{k2g",
        "-tnqa",
        "1hgHZ_",
        ":NgO0",
        "#@M,q(\"L",
        "[&D5Op",
        "#>*>!",
        "1=cox",
        "Xlb5E(y",
        "'gMnu",
        "%Ij(IRCI",
        "5'.6lr",
        "Dqc>cY",
        "dv-MV",
        "p+)jb",
        "Exemple de sc",
        "We2xb#",
        "paration en cours (%d%%)",
        "N\"GI<w",
        "tAPPPh",
        "3'clV5",
        ":/9-M-",
        "n]W,n",
        "lgende kommandolinjeargumenter kan brukes til ",
        "Z8k;k+g",
        "Y/IX/",
        "#sUN^",
        "s au r",
        "s nor",
        "N!@|V",
        "J!bom",
        "yc*]_?Yg",
        " kaip diegimo dalies. ",
        "]Un8%",
        "Primjer : setup.exe / auto upgrade / copylogs \\MojaZajedni",
        "){Kgm ",
        "9^F7|rr",
        "RM*S#~",
        "i2qwr",
        "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%",
        "rv;rN",
        "M,&OU",
        "UKD<o",
        "e chcie",
        "MYlYOG",
        "_|mx|",
        "AOdw9",
        "i_+>O",
        "kiR0y",
        "aYd=L",
        ";r$wK",
        "ciu na Windows vNext (",
        "_bY4K",
        "X2IJ0",
        "4DNsU6",
        "y2|Y<n",
        "Scenariebaseret anvendelse ",
        " futtat",
        "\"*x;y+",
        "installation, notamment l",
        "tres: N / A",
        ",-k(}",
        "?| |0|(|8|",
        "dia source d",
        "50(Mt'z",
        "X0WZK/4",
        "&!RiR",
        "\"=-AA",
        "M@yF%",
        "DPoku",
        "b9XttX",
        "ewj;K2",
        "U6kcKL",
        "N/)|5",
        "2!2(21272?2Q2[2q2",
        "J=CA'<]",
        "#xR{,",
        "4$5B5g5y5",
        "m+kJ{B",
        "LrfK}d/",
        "ges legr",
        "t csak tesztel",
        "*Om>v",
        "?yqnn",
        "luv;')",
        "ho um",
        "THCzHU",
        "!72c?",
        "4DNt5",
        ")HQHA",
        "Action : Lorsque / Telemetry est d",
        "iQ(Q}",
        ":3K|N",
        "e, mais avant la premi",
        "Intfgp",
        "YLP=Y2@",
        "z/7zWpN",
        "componenten. ",
        "+Wrro",
        "@c8ul",
        "*o}uUU",
        "8'hOU",
        "Parameters : 5x5 product key ",
        "qnmoD^:",
        "sDve`D",
        "\"o!~I",
        ",~DH]",
        "installation de Windows",
        "J[$/[",
        "tW*N#w",
        "shuYZ",
        "gp^_s",
        "Zg%?o",
        " naujo paleiskite kompiuter",
        "|YcQj",
        "c=+,VD",
        "SetFilePointerEx",
        "7eY2A",
        "juma, bet ir automatiz",
        "H5^b?",
        "s a falha, a instala",
        "CCY+<=g",
        "40}4\"",
        " k verzii %1!s!. Chcete pokra",
        "CUiVkZ",
        "a]gY{s",
        "velet: Bet",
        ",CnS%W",
        "$A6t6",
        "jHq#j",
        "6*?&z",
        ";l~j;",
        "HP(b}QQ",
        "F$%As",
        ":MdSpt",
        "^!tA)",
        "2k-sf",
        "e=\"xcYO",
        " naujo nuo prad",
        "6ig#j",
        "x2wfw",
        "(^QQL",
        ".h9tUo",
        "ed\"<b}",
        "WJ9h?t",
        "mSJmcf",
        "?[M\\u>",
        "vw>\"x",
        "QD+|u",
        "k{d9XG",
        "C/]B4",
        "JtF#y",
        "^(-G|",
        "-JmCbr",
        ":|]8[Z",
        "<I'S'",
        ">VlxJQ",
        "LVt<h",
        "%UV72",
        " opera",
        "-Mjy6",
        "M=?zV",
        "@1^9Z",
        ">*>1>",
        "@nN^K& ; }",
        "rHInstallationsprogrammet kan ikke starte tidligere installationsoplevelse3Installationsprogrammet kan ikke starte Install.exe",
        "NL#x^\"",
        "Pn<-d]",
        "`iCzi",
        "qcf9;3",
        "logging. Det kj",
        "EKG$Uw-S)/",
        "n]#\\A",
        "<A!w-8i)",
        "Windows 10 Installation",
        "wMj9C",
        "j}jKq",
        "WyD_q",
        ")ao|6",
        "ide: setup.exe / auto upgrade / showoobe full",
        "Zg^6]",
        "uEp=uD",
        "inizden emin misiniz?%Windows 10",
        "g till en fil med namnet setupcomplete.cmd ",
        "0c2j2",
        "$.uD/_",
        " olarak t",
        "ne posodobitve (poi",
        "uO9xjC",
        ";`exH",
        "]M~#e3",
        "}zIt>",
        ":*:a:",
        "6SC%i",
        "Xs}na-",
        "'Zau]",
        "Pq[Uj|",
        "1Sq{}",
        ">lX x|n",
        "Yhteensopivuus",
        "CF! Id",
        "GetLanguageMediaNumber: LANG.INI not found. Path = '%s'. (hr = 0x%x)",
        "KuXs4",
        "N0C=x",
        "G?-E3o",
        ">l<TV",
        "#*`li",
        "Aktion: Automatisiert die Installation mit der Migrationseinstellung f",
        "j$qj(",
        "ljande kommandorad kan anv",
        "=h.g|",
        "Pavyzdys: setup.exe / auto upgrade",
        "nxhu3",
        "K{?ky|~",
        "n#Det g",
        "=V\"Q)",
        "2V$IrS",
        "m/Ko8",
        "ca*m?",
        "lsg1^",
        "bersprungen, PBR wird aktualisiert oder erstellt. ",
        "?!mt]",
        "-ryXz",
        "yZ[;g",
        "0F0h0f",
        "rinstalleras p",
        "r)HsC",
        "L!Twr",
        "ljande kommandorad instruerar installationsprogrammet att aktivera skriptet setuprollback.cmd efter en misslyckad installation: ",
        "ShsZu",
        "2W3j<",
        "vV&W&",
        "kdKC.",
        "Lpf;k",
        "@`!q6",
        "Fg%TW",
        ")Yjh\"~",
        " de forma exhaustiva en todas las subcarpetas de la ubicaci",
        "bP@E.",
        "tp\"27",
        "fowUV4",
        "MQ9:F",
        "cbVOX'",
        "lnie wy",
        "Y)uQy",
        "n&.\"&BT",
        "Commutateur: / installdrivers <emplacement>",
        "56'vh",
        "rer dynamiske opdateringshandlinger (s",
        " CNl'",
        "X]pP23",
        "s de progresso de configura",
        "ppp@@@ppp",
        "1 151F1c1",
        "r+~;I",
        "lgende kommandolinjeargumenter kan bruges til at ",
        "(Vl+!",
        "yp2ME",
        "hgX-6I",
        "8+8N8",
        "Przygotowywanie",
        "/*R!#j",
        "b$Wf!",
        "tson fel lemezter",
        "6t0\\z",
        "!KDA6",
        "0_0)R(uq}",
        "|foS8aFE",
        "&:4^uu",
        "elite li da nastavite?",
        "Btykd",
        "Z:lf7",
        "JWK/z|q",
        "<e{B'",
        "FjU_+",
        "ipkY5",
        "Cvq~p~",
        "?gySMP",
        "XAivr-",
        "w9ej8",
        "X,!xG5",
        "r-ojh",
        ":l6th",
        "8]'p:@h",
        "W=F'/uZ",
        "iti operacije dinami",
        "MMe&V",
        "~}! \"",
        "\\.V@@",
        " verze je Windows XP s aktualizac",
        "Dd[0z",
        "RwYp7",
        "jv-*c8",
        "(\\F?|",
        "9yblv",
        "d;jUP/",
        "~||xp",
        "t\\aPcY",
        "cy wdro",
        "tre d",
        "gen till installationens k",
        "'%s+lP",
        "-[S~j:,",
        "\\&3KA{",
        "\"Dxb%V",
        "g!\"_(",
        "Q{YHh",
        "5tgZ:",
        "jlg?b4",
        "#B17<~",
        "qZ Dm",
        "e przeszukane wszystkie podfoldery. ",
        "`/aEz",
        "Example: setup.exe / auto upgrade DynamicUpdate disable",
        "b,cwzK",
        "Conmutador: / showoobe <par",
        "ti. Ar ",
        "pertoire et relancez le programme d'installation.",
        "z$.c[8QB",
        "BCryptCreateHash",
        "na poprawnie uruchomi",
        "*T]0R",
        "[)@#]\\L",
        "fGd8j",
        "tilanne",
        "Jg2[WTSN[",
        "[`U`\\o",
        "nd / PBRUpdate este setat la valoarea Enable, instalarea va actualiza sau va crea parti",
        "Kapcsol",
        "_,YM~",
        "*O8Qc",
        "Pa]75",
        "7o|_3.",
        "sW,Ej",
        "#K~rD",
        "h|14k",
        "tzf)ul[",
        "StateMatch: Attempting to get Installation Scenario from registry...",
        "vat v",
        "@t]*n",
        "LCmO)",
        "cDcK`",
        "CreateMutexW",
        "V&F26",
        "*FuQ]U",
        "SQhp7A",
        "t!~\"c[",
        "YMq,p",
        "tTT*2",
        " Full",
        "3)}3X0",
        "oRx(bU",
        "u|sN1m",
        "OjV`w",
        "N|KW4",
        "standalone",
        "~'b7-",
        "AP^,AS",
        "0%191D1j1",
        "s8yjD",
        "~%M`*Nwz",
        "Ua?]-",
        "r=qO1",
        "x=?EHF",
        " d\"jsi",
        "dcO:No",
        "^tSz+",
        "ra (%1!s!). Folytatja?",
        "W0f0O0`0U0D0",
        "GEm:6t",
        ")<7x,",
        "VXc<.>",
        "pR|0I",
        "]my\\s",
        "File Not Found: [%s]",
        "=y&cV",
        " o crear",
        ")o)aA",
        " 3%7k",
        ",'2[}",
        "3=- 1",
        "I$L/>C",
        "2m#^7(",
        "=7NhE",
        "lEtJ)k",
        "jC;TP",
        "Pmb.q'",
        "C#qS4n",
        "9':A:N:y:",
        "JGS3U",
        "5S6Z6",
        "installation. Toutefois, lorsque / Telemetry est d",
        "e1H$ ",
        "dHkq%V",
        "/;De\\l",
        "3.1Sg5",
        "\"s6k-",
        "(;QVe",
        "I@0+S5c",
        "}^Th<J",
        "fl19c",
        "wBXG]",
        "ikZW[",
        "R'4b5",
        ">#>1>8>\\>w>",
        "eS4DSi",
        "mTOoW!",
        "o executar",
        "ndige Upgrade auf Windows vNext orchestriert werden, wobei nur bei der Einblendung der Windows-Willkommensseite auf dem Computer eine einmalige Benutzereingabe erforderlich ist: ",
        "LpEkI0",
        "8M#6F",
        "re Windows 10 Installation igen.",
        "6SL%G+x",
        "\"lan?",
        "}'Vy=",
        "cijas ",
        "+m%76",
        "&[B{PS",
        ">/`uB",
        "031o1",
        ",;Z+]",
        "\\~yyxX~",
        "lr& 0$",
        "fa],`",
        "LS-fZw",
        "RegDeleteValueW",
        "T=Qu5",
        "PB7/m",
        "|F]k>3Q",
        "Q0l9N",
        "at{m%",
        "5l+aA",
        "0d10du",
        "ii)Z1",
        "]Ipo]@g+",
        "ra nezodpoved",
        "|Bof0",
        "r{N}-",
        "\"@AGG",
        "Cc!wWpXHy",
        "MVVn}",
        ",LTK}~",
        "_cexit",
        "Kh+Q?",
        "VHbEW",
        "GcT/*",
        "r automatiserade. Den h",
        "DG\"E8rv",
        "t5% w",
        "aoYr^",
        "R<G8^",
        "y9E$i",
        "< ';E/WN",
        "4_VbA",
        "^jLV%",
        "2k23z",
        "jZEWY6",
        "rY6WEUv.",
        "bK[ap",
        "{d(NU",
        "d5\\ec",
        "rFK+?",
        "7W^:3Q",
        "/;%ti+",
        "StringCount",
        "@Nv=F",
        "%Mtr3",
        "e nemus",
        "Eb>'`i",
        "tjjTO",
        ", URI",
        "b*d+;",
        "n*lS|",
        "),KyC",
        "%9Vdf*",
        "e ne correspond pas ",
        "Sleep",
        "T-SWfl",
        "ckldM4",
        "AIVnb",
        "WW9CC",
        "RegEnumValueW",
        "&O)w&",
        "K(Nl2]",
        "hU^</dks",
        "GetTraceEnableLevel",
        "xP(*TK",
        "L$ ;L$$r",
        "#x^.s",
        "S~Y,B",
        "RegFlushKey",
        "B&Duq",
        "Er!WX'%b",
        "Parametrit: Enable; Disable ",
        "esddd",
        "Failed to remove ProcessId value, Error: [0x%X]",
        ",(i>a",
        "S?3rMH",
        "`Yp&SOV",
        "em PC-ju",
        " [r8D",
        "49->!",
        "%qktN",
        "ga-IE",
        "N:~\"pI",
        "paration",
        "$?5srP",
        ">YYYKKKp",
        "5qw?J",
        "8P3H<",
        "7/FbA",
        "Exemple : setup.exe / auto clean / installfrom d: \\myWim\\customwim.wim",
        "                 uiAccess=\"false\"",
        "Q&RVh",
        "VMRP{",
        "EvKWW`x",
        " le programme d'installation ",
        "7,f!u",
        "~qP}&",
        "y2dnA",
        "Im9#9s",
        "^q1jy",
        "}gk=-",
        "ndarbeh",
        ".>a\\|",
        "s val",
        "+!8R(",
        "&Mx@p",
        "SVM/\\U",
        "Z&j2[",
        "^*|`dkth",
        "Un;o2",
        "c*f1O",
        "Windows Setup se zaradi manjkajo",
        "6b2t)",
        "zh-CN",
        "Pc!xU",
        "Ftd;6",
        "&y[,\\Mg",
        "'mD2.",
        "5W@TY",
        ",#<A9",
        "%2lrn",
        "#LFv>!\\",
        "mOHHp=O",
        "Iy%W ",
        "W10BP",
        "YW0_04X",
        "rL0W)^",
        "H+7G#m",
        "ASc=I",
        "'R@QO",
        ">%I~i",
        "cy na wykonywanie zada",
        "5f*6f2y",
        "tor sa pok",
        "Sklopka : / noreboot ",
        "]%.w$W",
        "v derefter igen.dHvis du installerer denne version af Windows 10, kan du ikke g",
        ";qga:",
        "io_S4",
        "lt'kL\\",
        ";&8)C",
        "F}Y{_{P?",
        "pp!(|",
        "^ j.DJk",
        "+=I24",
        ";D$4uV",
        "?AnAm",
        ".text$di",
        "b'|olB",
        "emplacement des fichiers/du m",
        "elje medija za instalaciju zaslon s tijekom prikazuju se po zadaom, ali su automatizirani. Ovo prebacivanje tao",
        "!I6K[s=",
        "l[el6",
        "5(6R6o6",
        "4A}Rk",
        "N'/x4",
        "BE<n)Q",
        "[7)]Ljq",
        ":iwZ0",
        "souW?",
        "&CF~w",
        ".(>mK",
        "CDlpFile::GetName",
        "r%a^b",
        "3jUEV",
        "tw_X~",
        "Priprema %d%%",
        "es noc na odd",
        "ac2+6$",
        "FzpB]",
        "D#>653[",
        "\"XWDVD",
        "n{t#\\k",
        "%s /InstallFile \"%s\"",
        "su atlas",
        "qw:1r\";",
        "SetThreadPriority",
        "zIx]&oiJ",
        "LioaR",
        "hW!{&",
        "zvQE ",
        "5-5G5T5z5",
        "4+5X5",
        "; <:<G<",
        "jyof5-v",
        "l insera",
        "SetBrushOrgEx",
        "[v7jj}e",
        ";;}f5#",
        "KLuywn",
        "=rqWd",
        " eseguita in modo ricorsivo in tutte le sottocartelle nel percorso specificato. ",
        "rs: setup.exe / auto upgrade DynamicUpdate disable",
        "ts parametrs All, uzst",
        "`6Xd,RtT8b",
        "z var. Biraz yer a",
        ")~P+7",
        "!g1&P:",
        "9J}(P",
        "> ;3./V",
        "rIGrR",
        ".[1>#c",
        "%.p~ds",
        ";(;3;b;",
        "2=4C4I4O4U4g4",
        "hU1]>",
        "ih7q0",
        "6'gwH",
        "Turpin",
        " zgodno",
        "s az ",
        "buj uruchomi",
        "yl'>?",
        "526R6n6",
        "O@Pj Z",
        "E!k29",
        "s kopijuoti vietose, kurioms reikia vartotojo teisi",
        "PQ}0H",
        "h.nii",
        "(WrXO*",
        " @H!BXo",
        "T3\\*q8#",
        "1S,n_9",
        "zDe)lsn|",
        "cie. In",
        "xr8Y`",
        "n especificada. ",
        "\\CHUG",
        "*y!i)m'",
        "6~KcM",
        "Toiminto: automatisoi asennus k",
        "GCFc/",
        "knak manu",
        "0@ $A0",
        "n>$pp",
        "KAG'\"",
        "call,sn",
        "installation",
        "trie, ignorer OOBE, mettre ",
        "Ph|K@",
        "0nef9w",
        "8\\N6\\",
        "ru-MD",
        "$tJoq",
        "2La arquitectura seleccionada no coincide con tu PC",
        "+:I>09",
        "f*rT^",
        "paration de l",
        "i4aJj",
        "tl,J=",
        "XiEXR",
        "Yoi'9mF",
        "4M4ZL",
        "ioqL{sD{",
        "2d)$o",
        "P4Om(xq",
        " Linie de comand",
        ".eA!s",
        "P|4'7u",
        "494n4",
        "rl;sv",
        "#Jv@v(",
        "4$_HA",
        "mDnvB",
        "ZY*Gl",
        "h|=AB,",
        "RkFlZ-",
        "AgJ>]",
        "res med de samme rettighetene som brukeren eller prosessen som startet installasjonen. ",
        "z6a>?",
        "8ldm?",
        "&sohO",
        "kZ,dP",
        "*vNAyf*",
        ";{\"#w",
        "i instalaci neaktualizuje ani nevytvo",
        ", suorittaako asennusohjelma dynaamisen p",
        "wbO\"y",
        "T{$,_",
        "WPTX`t",
        "heq>`",
        "?+hIv",
        "CSetupPageResume",
        "FD_Ju",
        "EYyvd",
        "D`:8E",
        "jPd'|",
        "From RegKey: SetupDU files [%s] consumed - bSetupDUFromUA: [%s]",
        ")Z\\\\;",
        "qQVk~",
        "/|&8k<U",
        "rO/UK.",
        "Rz@)=",
        "(i9!Ot",
        "eYTC5",
        "|h*psk",
        "q*jDTQ_AQ",
        "o%3f6",
        ")nc3f",
        "brASn",
        "tFH92",
        "N3WO5C",
        ">lfymh",
        "Moz16",
        ".idata$2",
        ",IPo.m%",
        "{<'Qi",
        "cific",
        "Pt<h%P",
        "M_d2'",
        "!St-[S@",
        "oeUv7",
        "o apare",
        "OL%>d",
        "hilduvus",
        "D0~0Y0",
        "Y} dL",
        "sy verkossa. T",
        "iQ\"dJ_'",
        "O!ly ",
        "uu[mW",
        ": / migratealldrivers",
        "c]D]7",
        "d|iK%",
        ",1qkcx",
        "7M9?X",
        "mcL;08d@W",
        "o: / Telemetry <par",
        "5$5i5",
        "v_ bO",
        "f=-@g\\",
        "?W11[o",
        "% {>t~5",
        "Konfiguruj",
        "w\"[q}1O",
        "k,t:Y",
        "metros: caminhos do arquivo local e caminhos da rede UNC ",
        "WJ7f~",
        "MV5kS",
        "TrA?5",
        "8H=IM[gM",
        "\\CA{@/",
        "D$DPj",
        "I!gdk",
        ";#e-7e",
        "x>[A]",
        "Pavyzdys: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "T!UK5",
        "tJ\\iQ-",
        "He:`8",
        "0g0W0_0",
        "xS,/U",
        "0oNwQ",
        "z91}Gt",
        "11>Me?",
        "]r=UG",
        " eseguita la migrazione di alcun driver. ",
        "rA^t,",
        "y^W_}Q",
        "t:C}4M",
        "jb;N[",
        "*[/sYdz",
        "Waiting for Rollback to finish...",
        "Hv+/8b)",
        ">R3k9",
        "rs ingen insamling eller uppladdning av installationsrelaterade telemetridata. ",
        "Mda]c",
        "c[xjU",
        "dDw;O",
        "21\\I2",
        "8Bq/+_x",
        "CheckFileProtected",
        "rnek : setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        " su bendrojo licencijavimo laikmena arba laikmena, kurios ",
        "`]tgb",
        "/gEzt%",
        "*\\Oc6D",
        "stico de computadores de teste no caso de uma falha. A linha de comando a seguir instrui a instala",
        "U~}NC",
        "K)<pk",
        "{HS[I",
        "/I:A'",
        "I{Q\"U3H",
        "f8?bg>",
        "G72M(",
        "\\gNd4",
        "ho pou",
        "};4n&",
        "x\\JT%\\hb<",
        "vI1/Jw",
        "DlpTask: Suspending task after transfer...",
        "ZK/J}",
        "2BLFP",
        "fwxJZ`",
        "O>kj'",
        "!]`V[",
        "Sh@x@",
        "-?@u ^",
        "\"iHZ\"",
        "jl, amely a meghi",
        "O0M0K",
        "\\StringFileInfo\\%04X%04X\\%s",
        "Primer : setup.exe / auto upgrade",
        "lreiz.^Ja instal",
        "realloc",
        "vel iniciar a Instala",
        "hAXP\"",
        "io-w'_d",
        "|Ns<J4G.",
        " faila ce",
        "lCE>Bl#E",
        "Sr 2x;",
        "t4O/9",
        "installation correctement. Red",
        "3&!\"&4.",
        "S3]7I",
        "E~Qf,",
        "Sm$$W",
        "xSy.n",
        "jG=L[_",
        " aT%u",
        "H?/@S",
        "Bryter: / migratealldrivers <paramenter> ",
        "$$$0d~~>**",
        "0+<%i",
        "=.qv{(",
        "VK1WX",
        "F2G#K ",
        "[, x*",
        "MKh#+",
        "ActionWeight",
        "'d]Ug",
        "mft|G*;",
        "TransportId",
        "p~ KP",
        "Vk)h!",
        " sami manu",
        "?(?8???o?}?",
        "W{]gj",
        "^8U)z",
        "P\"IKd",
        "E|60=1",
        ")&ir*",
        "che kann nicht bestimmt werden.",
        "Akcija : navodi lokaciju za instalaciju izvornog medija / files ",
        "3(&Rw",
        "n de los t",
        "LX-Cp ",
        "Sn]P6",
        "Lg{x8",
        "        by the loader from the system directory.",
        "[BAJQ",
        "affichent par d",
        "rpe[5",
        "eV%WB",
        "Hzv5~",
        "lqvqL@",
        " \"Disable\", ",
        ">[EtQP",
        "7gX&d",
        "Primjer : setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "noga mjesta i da je nai",
        "1QU/E",
        " peste noapte un upgrade de la Windows 7 Enterprise pentru PC-urile din departamente. Nu vrea s",
        " v kontextu syst",
        "site gr",
        "        name=\"bcryptprimitives.dll\"",
        "  DiagTrack.dll",
        "bjmZe",
        "Parameters : N / A ",
        "W|{IM",
        "SiteLink",
        "pStopSetupPlatformETWSession",
        "(p5XL",
        "~i}K,",
        "metros: ruta de acceso local o ruta de acceso de red UNC a un archivo llamado setuprollback.cmd ",
        ".jItJ",
        "\"\\@,$",
        "zelle",
        "HJO>`",
        "D#}uM",
        "yAsennuksen k",
        "sokat is felt",
        "tU~hF",
        "&GsVz",
        "7\"7,71767@7E7J7Q7V7[7b7g7l7",
        ")4Q_h",
        "6f_`y",
        "~yT <",
        "dfS:[",
        " suorittaa Windows 10:n asennus uudelleen.",
        "='=.=4=D=d=m=y=",
        "=`>g>",
        "uEk|~",
        ",>T.5",
        "~9z[n",
        "ugiwana. Minimalna wymagana wersja to system Windows XP z dodatkiem Service Pack 3.",
        "o foi poss",
        "<y\\y29",
        "K$jhk",
        "progres",
        "6n|P^",
        "dzu, v",
        "/D2BRL",
        "(!5u7k5",
        "zZn5i",
        "o+_w>",
        ">E]r>GX",
        "pVR5pP",
        "^ ~:?",
        "Iyf)^",
        "pK$W'P",
        "metro n",
        "^IcM|",
        "/M|{*",
        "Q?*]Yr",
        "(m`ex",
        "y\\z5HQ",
        "inf\\setup.cfg",
        "e}T(&",
        "Z)i2/",
        "y!_8#",
        "8te-2-",
        "tP0PL",
        "!`>*\"",
        "@GvXh",
        "2aID+E",
        "ShT+A",
        "vS~mfrVF",
        "GT3]Z",
        "n%u2E",
        " komanda darbojas sist",
        "\\QLps",
        ":-:[:a:",
        "5a0M=",
        "Z?^j-z?",
        "Operacijski sustav Microsoft",
        " V47L",
        ",A~g/",
        "1ZP>z",
        "7(7<7A7M7o7",
        "CNc e",
        "j*18/",
        "24<zt",
        ":C'#-X",
        "s8B?#+",
        "JZ`PMxeT",
        "~i6]z",
        " ]M[}",
        "46GrL",
        "s locaux et chemins d",
        "4O)u(",
        "yadz}J9",
        "ti-ER",
        "zR;Om.",
        "Failed to clean alternate storage paths, Error: [0x%X]",
        "Vkbp\"",
        "&uH72",
        ",/Orm",
        "{f27u",
        "e T5#",
        "1ssZ^",
        "\\ b'-;",
        " e atualizar",
        "}[cl5",
        "bY|cBw",
        "6>6y6",
        "k]'Td",
        "&$b)U",
        "P'2>w",
        "EdI?CC",
        "rkAbK",
        "sG1<f",
        "ica sistema Windows ni podprta. Zahtevana razli",
        ">$>*>/>:>I>]>d>",
        "XO3>?",
        " Enable ",
        "6tJsI#",
        "^vqB`",
        "RegUnLoadKeyW",
        "&^9Cy",
        "NQ8IL",
        "Zp:t8",
        "ll a Windows 10 telep",
        "n seguir",
        "Wr9m$",
        "\\b^ky",
        "jet igen.yVi har brug for mindst 350 MB plads for at kunne k",
        "v|>AWF",
        "ruuv>",
        "2Voer Setup opnieuw uit in een opdrachtregelvenster",
        "vI^|v",
        "\"cwf9",
        "<-,pD",
        "212HN",
        "en-SG",
        "adi)p",
        "r versionen av Windows st",
        "lasztott architekt",
        "5#AV3$Y",
        "^k;K*Hg~",
        "}0}F}.",
        "f!+TQ",
        "\"Yebn`+J",
        "ajte ponovno pokrenuti program za instalaciju iz prozora naredbenog retka",
        "7hB{X",
        "TranslateCharsetInfo",
        "=3{\"L",
        "en, n",
        "9%9;9H9",
        "kazovom riadku spustite v kore",
        "?}Aptikome, kad ",
        "t>\"-5 #",
        "ZL2h2",
        "G;|Ws",
        "6Po$5",
        "7],{H",
        "~65\\-",
        ":i;x;",
        "CDlpTask::SetCallbackRoutine",
        "IRcSX",
        "AcquireSRWLockExclusive",
        "<O}p;",
        "l11nt",
        "-B$_#",
        "~ojQw",
        "PreDownloadMode",
        "5li,G=",
        "1JU>9.",
        "7Gs<G8",
        " Windows 10 ",
        "Wf|g].",
        "@Q#*Z",
        "@@@```@@@   ",
        "r inte att starta installationsprogrammet f",
        "6<6U6",
        "YC~#'H",
        "314s\\v",
        "R[u%!\"",
        "M8,p|",
        "JaaZ92-,+",
        "5(5p5",
        "Bp0Hr@R",
        "Y&>[PA",
        "7Q|JNf",
        "fa/5Wm",
        "rm?]o",
        "}\"xDYv",
        "o. Por outro lado, quando / migratealldrivers estiver",
        "<w0X*",
        "  pkeyconfig.xrm-ms",
        "[XXZJ$VV",
        "8.k%.g=|",
        "ZbliI[",
        "WbB2W",
        "r$XH9",
        ":yW0_0O0B0",
        " arabirimi ve ilerleme ekranlar",
        "5S-n/$`",
        "Action : en cas d",
        "^Essayez de r",
        "U,b1p",
        "*Z@3{",
        "MJLV8",
        "s eilut",
        "metros: N / A ",
        " jazyk pou",
        "n intermitente de red. Vuelve a intentar la instalaci",
        "pjQiCS",
        "lO+u3M",
        "p;KvC",
        "/5`SF",
        "Q:+y)",
        "        name=\"wow64.dll\"",
        "AKXzb#",
        "!y1:yb_",
        ")q|~U",
        "Vk:v)b",
        "bs-BA-Cyrl",
        "[JQtOg",
        "<sN8b",
        "yL->97",
        "D3RA+",
        "v^UZDT",
        ")eZLyAYT",
        "P^8v>",
        "~Vw.<ON",
        "+88GQp",
        "~v)RG",
        "u\\Wqr",
        "f\\|*?",
        "<cv=kh",
        "QMyi@r",
        "\"cxWon",
        "v @aT",
        "3}0JZ",
        "1/'-|",
        "2AF>'",
        ".:'Z0",
        "vkS#(",
        "1+2<2B2c2s2y2",
        "ovRn_7",
        "65EX}",
        "jmtnx",
        "StateMatch: InstallScenario found : 0x%X",
        "e+E3P",
        "?!?gT",
        "Download",
        "5 &Rh",
        "W]B2<",
        ":QQ8M",
        "[Owv*",
        "xTgq)n",
        "V'@@\\) 2",
        "m[l>1_",
        "es para obter mais informa",
        "{hl%|",
        "m nastaven",
        "o_V*b",
        "Setup.exe",
        "2[{^rX9",
        "DlpTask: Suspending task during action...",
        "eX}&G",
        "tJz,U",
        "-t}EE@",
        "Q!7s_)",
        "Soporte",
        "&}9ps",
        "=2FUq`q",
        "w06>Q",
        "<C9GzV",
        "n2UZJl",
        "Gjt|+",
        "_er/L",
        "!rKPR",
        "'&w1WoV:f",
        ", kai jis baigs ",
        "6F]-?p\"",
        "xToQ*Q",
        "jA=X4",
        "{{{}}=|",
        "Aktion: Wenn",
        "CTiZn",
        "devem ter permiss",
        ")t.4pcQ",
        "EeII)i%",
        "]<7mk6",
        "Vwxu_",
        "&tbB_",
        "3rq7H#",
        "+I1xNr<g",
        "5(v\\WS",
        "R4Oue*E~",
        "4_t%^",
        "Schalter: / Postrollback <Speicherort> ",
        "s$O@kJv",
        "metros : Upgrade; DataOnly; Clean ",
        "o!]Bm",
        "L{?+pV=\\X",
        "Td>X5",
        "<e$\\c'",
        "jra a g",
        "y%/=3I|8@",
        "nsker ikke, at brugergr",
        "3TC|5",
        "xel: / copylogs <s",
        ">YYIAR",
        "0(v/W",
        "I^bA!H",
        "=y3Ty",
        "M=('YI",
        "sKl#r",
        "ZVE6%",
        "fB:=\"",
        "Q//J6",
        "*zl_n",
        "&SRuWG",
        "labilir",
        "! !$4",
        "e|ciLCYLcilCYlci\\CY\\",
        "SetEvent",
        "d4%MR",
        "@@@@@@```",
        ">%>.>:>h>",
        "}iZgn6",
        "[%9\"8",
        "mVjPmr",
        "jNQ\\l",
        "WWWWPRWh",
        "ruHfHs",
        "ini alg",
        "!wT|<",
        "@ox=O",
        "H`v?V",
        "{;*F7",
        "naIAI",
        "cV}@9",
        "Bm\\[_",
        "emBuUv",
        "tJ\\e&i3",
        "Opzione: / migratealldrivers <parametro> ",
        "qa#J#i",
        "7s-m]FiJ",
        "zT 2toj",
        "r+O|j",
        "e prikupiti i prenijeti telemetriju povezanu s instalacijom. ",
        "&Odustani",
        "2|'X0",
        "mx|V;",
        "o%;7O",
        "7k2(7",
        "N|$v46",
        "}<y5u",
        "eb-3\"h<",
        " possibile avviare il programma di installazione di Windows perch",
        ".,VXY",
        "OHDzA",
        "(pPCB",
        "1.bm#",
        "z\"2=9",
        "y$V$LEv",
        "eiGwk",
        "IuT^C",
        "\";8tTLr",
        "pnek vagy a felhaszn",
        "1!141H1Z1a1g1l1",
        ",\"Ri^",
        "ss<q`",
        "R{$h_",
        "8a*LB",
        "G!k(r",
        "tab.nSeda Windowsi versiooni ei toetata. N",
        "Wb93i<G3",
        "A+;sJ",
        "YiV4?",
        "pMFhB",
        "s de un error de instalaci",
        "qfr\\h:",
        "0@J$A0",
        ", instalacija ne",
        "^9=.#s8F",
        "iO29J)",
        " ?G_=,",
        "ZTV]L",
        "5'6M6",
        " w5.[",
        "borom alebo sie",
        "=4=A=a=o=",
        "_@g/x",
        "D:.J&",
        "CqU3z`9",
        "OzA9dW+",
        ";~sEs",
        ">ES@):",
        "CDlpTask::GetParameters",
        "1?#Eh{",
        ",qFPc",
        "9]>j\"",
        "Ql`Rk",
        "u),c}",
        "Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11CF-8B85-00AA005B4383}",
        "92ZN,",
        "QnTmS",
        ". Prisiminkite, kad kompiuteris ir / arba vartotojas turi tur",
        "gfQ}~",
        "('v.b",
        "sg/{<{Bv",
        "o8cE-A3",
        "14p%;",
        "Esimerkki: setup.exe / auto upgrade / postoobe c : \\komentosarjat\\setupcomplete.cmd",
        "vs% ,",
        "zM7U/CK",
        "Fu;\\x",
        "Err_;",
        "x#?z#",
        "c0DC4",
        "{Ms68",
        "+wGMU",
        "/gg:JLGM",
        "\\=nR<",
        "*c`zk",
        "$*^:U)",
        "ppp@@@@@@@@@",
        "g~bn0o",
        "=ZFFX",
        "x(p7hU",
        "3_k<lO",
        "jK D<",
        "t-Mgf",
        "cQ!)HNF",
        "3L?To`pvx",
        "vas vietas. Atbr",
        "o-n+,n",
        ")P;TLmc*",
        "_81;S",
        " i rotkatalogen p",
        "latCt",
        "rcq:?go",
        "<UIM'",
        "8,z{5Wq",
        " nastavenia. ",
        "'50RZU",
        "Por ejemplo: setup.exe / auto upgrade / showoobe full",
        "l{?rBp",
        "10 versiju, nevar",
        "WdsCopyFileEx: Failed to strip file attributes for %s, will delete. GLE = 0x%x",
        "`L>ab",
        "((0Tl",
        "installation ne red",
        "rankai i",
        "7V'-l",
        "Vj -C#",
        "P4]wp",
        "+p[.<",
        "Akce: Ur",
        ", namestitveni program posodobi ali ustvari particijo za hitro ponastavitev. ",
        "D]A~@",
        "gT&p'",
        "q>d(oo",
        "]AGoF",
        "F<1g=",
        "e se pokrenuti dok je pokrenuta neka druga instanca programa za instalaciju. Mo",
        "Z~q7:f",
        "KmXKT",
        "bO@jc",
        "BCryptFinishHash",
        "exOovE",
        " /*N!",
        ")t6@o",
        "@C7BF",
        "R;s'^",
        "{P\\eK",
        "<DRXHOLE",
        "}+y.H",
        "t pro ",
        "m spustit instala",
        "(Hq+.n",
        "&eq[:",
        "3$3,343<3H3h3p3x3",
        "<|M5z3",
        "Py*HK,",
        "o4J*Pz",
        "`^Tax",
        "24ctxd",
        ".js}>",
        "424b4",
        "d*:bA",
        ",ote+",
        "CSetupLangIniLoader::Initialize: Failed to get the language media number: index = %d. (hr = 0x%x)",
        "le.Qa",
        "SSSSP",
        "}Jx'_v",
        "Yb,c6",
        "'0h:%)h",
        "Jk+LH",
        "145][",
        "5)_=8^P",
        "V? {NL'&",
        "$#%U~Z",
        "bn%X;",
        "Te<^O@",
        "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        \"> <rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"> <rdf:Description rdf:about=\"\" xmlns:xmpMM=\"http://ns.adobe.com/xap/1.0/mm/\" xmlns:stRef=\"http://ns.adobe.com/xap/1.0/sType/ResourceRef#\" xmlns:xmp=\"http://ns.adobe.com/xap/1.0/\" xmpMM:OriginalDocumentID=\"xmp.did:D90530087960E411BA60B7344D705471\" xmpMM:DocumentID=\"xmp.did:3BD55BE8700111E490F3D68815013C20\" xmpMM:InstanceID=\"xmp.iid:3BD55BE7700111E490F3D68815013C20\" xmp:CreatorTool=\"Adobe Photoshop CS6 (Windows)\"> <xmpMM:DerivedFrom stRef:instanceID=\"xmp.iid:977B7B345161E4118595B3E1319A734E\" stRef:documentID=\"xmp.did:D90530087960E411BA60B7344D705471\"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end=\"r\"?>",
        "^TBBi",
        "0%u;T",
        "rer i systemkontekst, s",
        "RNe_d",
        ":MdLcu",
        "6u0;\\",
        "cXf\"8X(t",
        "9o\"Z>",
        "-9tY}=",
        "$Euz+",
        "M|w0<",
        "a1`*6&^",
        "9f<O*/",
        "?{A-pL",
        ">I/dK",
        ",2MLb\\",
        "KVk1|",
        "s2m}F.e",
        "h'5N]",
        " harddiskencInstallation kan ikke starte korrekt. Genstart pc",
        "3hldBrU",
        "EktSh",
        "(%QJy",
        "2Z5Aq",
        "cGV$~",
        "Oj_e#",
        "bBkvo",
        "K>G6'",
        "`0VF;",
        "{(ol'd",
        "JO8SG",
        "2?3ctDy",
        "_/f&T",
        "`oO?w7",
        "!acJnu",
        "__p__fmode",
        "Q3Exk",
        "o@4S ",
        "P+m9J",
        " olarak ayarlan",
        "er. Den skal ikke bruges i produktion. ",
        ";TWtE",
        ". Cette commande s",
        "        loadFrom=\"%systemroot%\\system32\\dwmapi.dll\"",
        "SystemParametersInfoW",
        "memset",
        "/ showoobe is ingesteld op Full, moet de eindgebruiker het OOBE-proces handmatig voltooien. Als / showoobe is ingesteld op None, wordt het OOBE-proces overgeslagen en worden er standaardinstellingen toegepast op",
        "$.B}B",
        "bzeN|",
        "JVI>^",
        "SAY,;",
        ">$>+>@>G>",
        "CoInitializeEx",
        "*1>oM/m$",
        "<$<,<4<<<D<L<T<\\<d<l<t<|<",
        "3ek5B",
        "z!Mn(",
        "AlJE8",
        "o a ser preparadas algumas coisas",
        "l}8p}",
        "Y?PFb",
        "|vpr_",
        "`Y=.+",
        "[Vax.",
        "dz:J\\",
        "Voorbeeld: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "iune: injecteaz",
        "ncia da tela de apresenta",
        "Fa>/h>BG",
        "metros: las rutas de acceso al archivo local y rutas de red UNC. ",
        "rom pri prvom spusten",
        "Jyh@,6>",
        ";;5b9`k",
        "v&5a7",
        "|zjxi",
        "2{DbhT0$<",
        "o^?8x",
        " installere p",
        "Reading Box container header: [%d]...",
        "->0*&",
        "Fm,C#",
        "I4;Xb\"",
        "J<dmZ=",
        "k15!~k",
        "]A@YO",
        ":%:B:I:",
        "j`+[s",
        "VR`1J",
        "E<m#s",
        "H_'u;",
        "m:kPuh ",
        "rMvQM",
        "LgQI>",
        "ierul setupcomplete.cmd din loca",
        " informace z testovac",
        "ym!)}",
        "wGXDG",
        "^}R^u",
        "8nlb,X",
        "Xs?%$4",
        "Q8;bW",
        "-configurar o suporte de dados na unidade de disco r",
        ",MeoQ",
        "$bSr6'QF78S9",
        "@v I)",
        "or->Y",
        "nc[Htm",
        " naujo.",
        "unalo do",
        "+j*))!",
        "WuOf5",
        "rXBGW",
        "nse,*",
        ";%DV+",
        "1l_}F",
        "E^/I;",
        "mQ3D3",
        "ql\\,Z",
        "=b}gm",
        "C^}u%)k#",
        "Q?(;*",
        "invite de commande, ex",
        "Zcbqt",
        "sakorlHiba t",
        "l+#9B",
        "anas programma nor",
        "m5-pT<}",
        "6Y&'5g'",
        "]olTWv",
        "D$(PS",
        ";MRx@5",
        "i luuakse. ",
        "k|h9Q~|R",
        "Riprendi l'installazione",
        "zaUA=",
        "1p\"PL",
        " Microsoft Corporation. All rights reserved.",
        "0#161i1t1",
        " spusten",
        "CSetupLangIniLoader::Initialize:     IsDefault         : %d",
        "~\"G7#",
        ")ggQ,",
        "AbUU:nY",
        "Ln\\L5",
        "CleanInstallFolder",
        "kler.Ancak, / Telemetry Devre d",
        "?,^Lh",
        "AG@g24T*[",
        "{^6x?",
        "_jq1;P",
        "+FX d",
        "JQmOs",
        "n testdatorer om fel uppst",
        "q=NUW",
        "_:o!s",
        "jq%;k",
        "g99y.j",
        "wx2t;",
        "XHT0 ",
        "ita`?T",
        "8S.kJ",
        "me[h+",
        "Ol6[_",
        "o0'>\\S",
        "(l06~tKG6",
        "Tgxc<",
        "rkwaO",
        "BNr v",
        "![CVF",
        "+I|z)",
        "#[Hyq1v^",
        "mrM6]7G",
        "OB(ld",
        "N o}b",
        "Hlo>{",
        "==r;8",
        "I~Hrz",
        "w+q<3",
        "ena, program za instalaciju ne",
        "tmtg{?",
        "t]8s,*",
        "Nasuprot tome, in",
        "$uXi:Q",
        "X@O-PJ",
        "@M0C9",
        "dZ*MU",
        "Am:X/",
        "Zainstaluj",
        "$@WK5I",
        "u*F!L*p",
        "E;oF;",
        "        name=\"bcrypt.dll\"",
        "ker installationsprogrammet migrera alla drivrutiner som del av installationen. N",
        ";_E^M",
        "qiJzl",
        "T|3op",
        "7 7&7.767J7]7",
        "uYx]bN",
        "}|i{$",
        " chcete pokra",
        "P~^eq]xdy)",
        "&5ns^G",
        "Dbrn!f",
        "X?|m&s",
        " todos os ficheiros .inf de controladores existentes na localiza",
        "kkx\"1ke",
        "aRXvG",
        "O;&@[",
        "sto na disku a potom to zkuste znova.kKdy",
        "0zh6-",
        "hf)R(lF#",
        "bfNy'+",
        ".m#S6",
        "{n.^L",
        "_rfRX",
        "@ry{G+",
        "ynniss",
        "{9'Uz",
        "lemezt. Miut",
        "HYB1&",
        "Ye~*[{",
        "90CC&",
        "?O?jp~",
        "GhzoM",
        " wP4x7",
        "P0tO|",
        "J4KdR",
        "Pt%+YF",
        "i arhitectura corect",
        "`~q3Z",
        "nuy,BF",
        "s;wp'/",
        "</assembly>",
        "K;q)#",
        ":][(e",
        "CU\\kQ",
        "luz\"Y",
        "Qw?lA",
        "Iv`U3",
        "Dy@x9",
        "rJ)Md\\",
        "AQks9i",
        " EULA",
        "F%:\"i",
        "\"+6BUj",
        " All ",
        "Sj}n_",
        "De`Ru",
        "fini sur activ",
        "`cefx",
        "ad je",
        "w{$?3&",
        "7A^\";",
        "installation termin",
        "^;\\]p",
        "bnSw8",
        "~~k$_",
        "MyK}n",
        "Uvedbeni in",
        "<#=v=%>m>",
        "Cf4.g",
        "i-;W?",
        "^ EOA",
        "`8v^7t",
        ")pmkG",
        "ja saknes direktorij",
        "]I7~?",
        "Phtl@",
        "sAN5D",
        ";J!\\j",
        ":+:Y:i:o:",
        "Cd<q(",
        "igusi n",
        "?xk[1",
        "jA9mR",
        ">L|&W",
        "sq^Ns",
        "alyd2",
        ",MZZf;_W",
        "x;?E3",
        "r / showoobe er angivet til None, bliver OOBE sprunget over, og komponenterne angives til standardindstillingerne. ",
        "inynas",
        ". Minim",
        "Kan inte starta installationsprogrammet f",
        "nq[YT",
        "&9]i3",
        "L;(8'",
        "[|Vq!",
        "hK'S ",
        "] [D;",
        "+Rh;Z",
        "kY>ot",
        "p#<F{",
        ":(\"]N",
        "2.[0&XL",
        "jlokat tartalmaz",
        "nd date de intrare de la utilizator numai dup",
        "`RRZR",
        "1GK^'",
        "(CQ>;",
        "j>Ig\"]",
        "JIP4K/",
        "EzFGI",
        "kai paleista i",
        "&{}K~[",
        "ClientToScreen",
        ">7OQ}oT",
        "m spustili z m",
        "\\z.]@/",
        "Je+eFm",
        "ni feladatokat v",
        "c3_60",
        "h?7&I",
        "QUtx ",
        "_XTHTdE",
        "FoQTT",
        "w77;L",
        "s}IZ{U",
        "]itTU",
        "Sklopka : / PBRUpdate <parameter> ",
        "d*-AE",
        "Vv;;,",
        "9C?<%",
        "Transferring",
        "yZ8:/",
        "B2nL\"",
        "hd(KBWhVj",
        "goD*,",
        "rA.R+",
        "C]YmC",
        "yrI!Y",
        "iteks kui teie arvutis on Windowsi 64-bitine versioon, siis peate kasutama t",
        "vvvfg$",
        "p~=_5",
        "~SIi=",
        "Xg%7>",
        "}HotQE",
        "SF-Y3$",
        "O2UbV",
        "{t<vu",
        "Lg[p`V",
        "y~@#h",
        "WL^P=?{[G",
        "ba migracji wszystkich sterownik",
        "6A arquitetura que selecionou n",
        "Indstillinger: Full; None ",
        "installation et la restauration du syst",
        "b+F-;",
        "M^AWW",
        "?Instala",
        "8B{a-",
        "Spoofing detected: File [%s] is not a child of [%s]",
        "[\\f~S_7",
        "@n<*;",
        ";\\m(KK 4",
        "xXF5 ",
        "'Ygu ",
        "m4vDL",
        "W.YP&",
        "#!h;%",
        "i OOBE. S druge strane, ako je / showoobe postavljen na ",
        "pc?-Wl",
        "issue de l",
        "n quiere recopilar los registros y otra informaci",
        "\"'X9v",
        "rskenda ega loo installiprogramm PBR-sektsiooni ",
        "ENzy%7",
        "Z?b*:",
        "~@16$ ",
        "BGf5,p",
        "cO_E:",
        ">%f7I",
        "mipNf",
        "yI-`r",
        "Ip=iZ",
        "flH3Q",
        "`{!YF",
        "Pd:Ga\"Q",
        "[t~\\`",
        "+u98p",
        "?X*2_\\",
        "es-MX",
        "-H$\\!x!",
        "=`\\F~",
        "&WEr4w",
        "\"QW x",
        "5 9>o",
        "YV$e>",
        "2Mg?3",
        "tirmeyece",
        "TKt[_",
        "h$y(IZa",
        "Prebacivanje: / installfrom <lokacija> ",
        "4E^+o",
        "g(lyb11",
        "Podpora",
        "em ra",
        "k@[([",
        "t9}mr",
        "|r3f.",
        "pYFFv",
        "-S80o&",
        "q+!am",
        "`/d?d",
        "XC`Z8",
        "XA&|q",
        "]_Bgp4u",
        ">S!VbD",
        " 0{sSB",
        "Indstillinger: All; None ",
        "9{:qF",
        "9:G>\"",
        "0Ls{I~2",
        "x^2/5",
        "D}uXn)f",
        "?Gsnt",
        "3'3-3>3P3h3z3",
        "kA\"{m",
        ">%F~s",
        "]D9,S}",
        ",.-nvi",
        "\"yng6S",
        "8F8L8z8",
        "Exemplo : setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "Nv% {",
        "*pK=eu",
        "%F^yQ",
        "dzu, restart",
        "/T;DF",
        "+e?G[",
        "uriranja (tra",
        "F%E,3m",
        "n>(.*o:",
        " nouveau le programme d",
        "$D\"iID(B",
        "Bt.Dr",
        "vc |}",
        "2,2L2T2",
        "A].E~Zv",
        "R<I}/&",
        "M%ukd",
        "*pa+k:",
        "moTAbq",
        "en kao %s-bitni. Kada ga umetnete, program za instalaciju sustava Windows 10 automatski ",
        "=/i'O",
        "ad: setup.exe / auto upgrade / copylogs \\MojUdzial\\DziennikiUaktualniania",
        "7_Px.",
        "zu-ZA",
        "OZ4xr",
        "{J=*_",
        "WOTw(",
        "(a44Z",
        "7-mG$",
        "l[5I#",
        "miyor. ",
        "A DWU\\",
        "wL'=`<S",
        "u<6;p",
        "n-doY",
        "v>IKG':5[",
        "XEv4H\"",
        ".fi{i",
        "C8DK8",
        "z3rVF",
        "dia contenant un fichier pid.txt dans le dossier Sources. ",
        ".U8cZ@",
        "e imati dozvole za kopiranje na mjesta za koja su potrebne korisni",
        "[sRyc",
        ">tR G<8",
        "R#PF1B",
        "H!t!D1Q",
        "zC+cH;",
        "/Finalize %s",
        "teWaI",
        "e{ZTg",
        "`rb|! ",
        " neleis rodyti s",
        "s=VFaBh",
        "egixo",
        "rkssti til en fil med navnet setuprollback.cmd ",
        "u$Wls.",
        "dDkVp0",
        "91E}f",
        "x+kPm",
        "pgHyv",
        "rodowisku produkcyjnym. ",
        "Exemple : setup.exe / auto upgrade / PBRupdate disable",
        "uktBt",
        "sik p",
        "3k`fK",
        "8>^#N",
        " se instala",
        "k.(]n",
        "!QDDA",
        "h^YnW",
        "#l[gm",
        "A}fjf$j",
        "m: %1!s!",
        "E{.b/",
        "u-l41:",
        "SzIsV[",
        "eli da prikuplja evidencije i druge dijagnosti",
        "q$6YM",
        "5hWm<H",
        "O~A~F",
        "^>%55",
        "Quieres continuar?",
        "\\REGISTRY\\MACHINE\\",
        "$bQ!;",
        "xWP_3",
        "'4C&,dBLY",
        "z(5{&",
        "MJJ(+",
        "Sklopka : / installfrom <location> ",
        "Xj1Jk",
        "Dq.H(",
        "G5lwU",
        "S%T#l",
        "9Ow6Q",
        "1'#'L_",
        "Herunterladen",
        "            <supportedOS Id=\"{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}\"/>",
        "pM rC",
        "`wn_nD",
        ". _>R71",
        "5(5/5u5",
        "566=6Q6a6q6",
        "XQOQC",
        "CA xv6",
        ".t|>t",
        " pid.txt ",
        "`}5;w",
        "L$L_^[3",
        "i&LnK",
        "i4Uxn",
        "*v[\\V",
        "M'*]P",
        "t==jK",
        "T=o-/w",
        "z3X37",
        "nn-NO",
        " znova.aNa spustenie in",
        "t?htP",
        "m+R~{",
        "O>0^r",
        "91lMe",
        "gqLry",
        "J%B=]",
        "si be",
        "v?C^8;",
        "(\"hB^XT",
        "paration de certains ",
        " aus.",
        "n a su configuraci",
        "?3?=?",
        "Vj7u'",
        "6E\"|3",
        "6'!d6}",
        "<N~A~O",
        "DeleteCriticalSection",
        "Z06'G",
        "#Ekz ",
        "N$XbB7",
        "Parameter: Lokaler Dateipfad oder Netzwerkpfad zu einer Datei ",
        "2W&nk",
        "8M:}F",
        "j(I\\5",
        "VLi6iM",
        "v2mJ&i",
        "%l@.<g?",
        "[wbo^L",
        "pa-Arab",
        "y{]3-Q",
        "/50if",
        "s~kd.:7<",
        "3PiXe",
        "k'ZUa}S",
        "Hdtp:",
        "1A*9@",
        "=tOfz",
        "05lcv&T",
        " son syst",
        "+?/0WWV",
        " diegimo laikmenos ",
        "OsUninstallWarning: Os Uninstall Active [%s].",
        "Toiming: automaatne installimine migreerimissuvandiga. Vaikimisi kuvatakse kandja installiprogrammi kasutajaliides ja protsessikuva, kuid need automatiseeritakse. See l",
        "*| wo$",
        "rs: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "o`%sf",
        ")QgJtM",
        "~M&Wn",
        "che zum Einrichten der Medien und die Statusbildschirme werden standardm",
        "Parametri: cheia produsului ",
        "lFg?g",
        "#3uw/~O",
        "cNH2/",
        "j/Xf;",
        "OI`4w",
        "h*McK",
        "]z[ju",
        "q<t=h",
        "VirtualQuery",
        ";/@Kl+",
        "`-<X.",
        ".J0{C",
        ";Vfwl",
        " La1)",
        ":c]o&",
        "RAn)Jg",
        " 6>8y*K,b",
        "Ndg[G",
        "d8GVXg",
        "Voulez-vous vraiment quitter?",
        "A\"F7m",
        "exploitation pr",
        "gvTtKw",
        "=rDf(",
        "=`pF<",
        "A1_(o",
        "^[w!QRW",
        "CO_,tT",
        "&Seuraava",
        "NeeTE1F*",
        "|T%(.v",
        "Paz&3a",
        "Y0J%Y",
        "c]gEjQ_",
        "het script setuprollback.cmd uitvoert na een mislukte installatie: ",
        "Q:TW?q",
        "^$NQ>",
        "]a{i[aG",
        ">6C#8Z",
        "ZRc`Q-)",
        "3%>DP0",
        ">AT u",
        "lUZ$}",
        "ordinateurs de test en cas de panne. La ligne de commande suivante indique au programme d",
        "X9A>.",
        "~[;&&3Y!",
        "HeXnq{2",
        ":uiBK",
        "Qm7Fx4",
        "WLz^m",
        "p`5Fu6j",
        "v\"|RI`x",
        "tNj0a",
        "\\QlW-d",
        "kv/zp",
        " alcun dato di telemetria correlato all'installazione. ",
        "UWAGA: Tego prze",
        "\\'xui",
        "S7\\}zo",
        "c])1k",
        "eli v ra",
        "H!|:K",
        "P0ZO9y",
        "FBr7{l",
        "sd-Arab",
        "Pavyzdys: setup.exe / auto upgrade / Telemetry enable",
        "q;~wb",
        "<Please try running Set-up again from a Command Prompt window",
        "O'Q\\3",
        "rankai nepavyksta paleisti ",
        "'s)`Ai\\&w",
        "3$3N3o3y3",
        "R}zNh",
        "$pn2{",
        "|FepL",
        "pEJ,g",
        "q!Il;",
        "8u`cx",
        "```@@@@@@@@@@@@@@@",
        "(Q\\4[\\4",
        ";V[ri",
        "ol$DN2:",
        "j=^cjN",
        "CDlpManager::SetStringProperty",
        "$tc|W",
        "km-KH",
        "C^C}>",
        "Bryter: / DynamicUpdate <parameter> ",
        "C7UyH",
        "u\"MtG",
        ",9-HU",
        ".?AVCSimpleWizardPage@UX@Common@ConX@@",
        "e utvrditi jezik korisni",
        "o{v[{",
        "s,1\\ ",
        " %1!s!",
        "`op\\;",
        "pHsA3B",
        "000@@@",
        "rOfX5",
        "I!2 o,2",
        "bo0Q+a",
        "RA5u4",
        "-6dc$",
        "pVr3ib",
        "ZzaAqJ",
        "   ```   ",
        ":::@:U:j;",
        "Comutator: / DynamicUpdate <parametru> ",
        "Eksempel: setup.exe / auto upgrade",
        "yFqaun",
        "gwgR%",
        "VhP0A",
        ")Ggr'",
        "wD>F:",
        "]+hf`",
        "&Rj#;",
        " parametr None, ovlada",
        "_Q5}~",
        "*^F`WM",
        "~9e2M",
        ";cPIW",
        "!7La@+!",
        "we,Lx",
        "{X|,q",
        "Conmutador: / Telemetry <par",
        " komputera. Na przyk",
        "BdnyMpr",
        "U=$'N",
        "G2@A\\",
        "9Q Wd",
        "9kr1W",
        "8Uaj0\"",
        "R4I@#z~D\"9",
        "D$8PS",
        "<BKal",
        "VVkDs",
        "P[U+/}",
        "455_5x5",
        "NcMcTl",
        "&1H@e",
        "RzX(~-",
        " ja lataa palvelimeen asennuksen muodostamat telemetriatiedot. Kun valitsimen / Telemetry asetus on Disable, asennusohjelma ei kuitenkaan ker",
        ";u(% 2",
        "Bryter: / auto <overf",
        ";jnr$",
        "sA\\vb",
        "x%JA,",
        "7Q\"]f(",
        "46cy9",
        "|3;gf",
        "krevde XML-versjonen:Det oppstod en feil under lagring av mediene p",
        "o)?cn",
        "K4GtT",
        "l'~Dv=M",
        "k_}&f%",
        "jdo@;0;",
        "250701214655Z0|1",
        "?LobN3W",
        "/FF$R>",
        "VKv>t",
        "*<sbx~",
        "74l'M",
        "(\\QGA",
        "cy$>@",
        "lHmAMZ",
        "'\"]~7%",
        "r$/erT",
        "xbbnnB",
        "I1}ZVL~",
        "8AL54",
        "-lO<CK",
        "|w|o|e|]",
        "Otkriveno je da je sa mre",
        " oturumunun a",
        "pj2Yw",
        "mbge3",
        "t^HC%",
        "9QG&o",
        "F%O`<",
        "s un neveidos PBR nodal",
        ":w4~hf.M",
        "installation ne rassemblera pas et ne t",
        "~Wvnn",
        ".3]]T",
        "nge f",
        "w/e42j",
        "YL?=ts",
        ">zo4,",
        "mif[q}-P",
        "040404B0",
        "sy;qq",
        "!w4nK",
        "c7\"6z",
        "o especificada. O ficheiro Setupcomplete.cmd ",
        "|@~0fo",
        "wr\\>m",
        "#k1PQ",
        "cie syst",
        "Parametri: percorso di file locale o percorso di rete per un file specific.wim ",
        "RGjEg",
        "w'tQJ",
        "l arra az esetre, ha nem siker",
        "q/=/B",
        "#comment",
        ";Q',i",
        "zJ^geA",
        "G{Pd?",
        "(5%7]J",
        "Exemplo: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "838h8",
        "PripremaMInstalacijski program ne mo",
        "z|=%P0",
        "CDlpManager::GetTask",
        "2UxGj)b",
        "i instalare de actualiz",
        "_J15Hm",
        "Xg8]0[",
        "Z6\"@{",
        "vWF)S",
        ")lWNr",
        "\";noM4",
        "Dw>8j",
        "&Pabeigt",
        "TIFhz",
        "CU/-6",
        "anu, nepiecie",
        "{uSAH",
        "{@S<{",
        "o realizar",
        "I>rkC^g/\"",
        "XB}T*",
        " komentokehotteessa asennustietov",
        "dt=OZ",
        "tzm-Arab-MA",
        "<FbUw",
        "FwKi;",
        "tkomst till fils",
        "cM9#b>",
        "KE#1C",
        "efh;2",
        ")u]PiJ#i",
        ",mtu*5B",
        "Pht~@",
        "+_]Fv",
        "-v(y|",
        "*y=o<",
        "/tk-)Ry",
        "v_*P\\",
        "d$!S'",
        "j>@\\t",
        "kih programa prona",
        "fr-MC",
        "H;kkE)",
        "6=d|5",
        "ujeme, ",
        "[r2TO,",
        "\"Jv,C",
        "q`'WT",
        "3khmc0",
        "Jy,|}j:",
        "U(9D5",
        "LQ[O`R ",
        "xfK[U",
        "ZE,)e",
        "<F=)Zv",
        "<|exP",
        "H1V\"S",
        " A Windows 10 telep",
        ", executa",
        "ige arhitektuuri.(H",
        "nB>=oB>-3!",
        "/a*OI",
        "cCFX`",
        "VIur[",
        "Q6oL8",
        "8C[Uw",
        "[yTUg!sN",
        "^g7r\"n",
        ">U*a_",
        "cZ`KE",
        "/ files",
        "]}TTG",
        "jra.iHa a Windows 10 ezen verzi",
        "k@J1I.F",
        "ynnistet",
        "{IrK`^#",
        "0M0w0",
        "8k/RW",
        "lzm&[m6",
        "MZc\"kL",
        "f|O_5",
        "0=nG+Z",
        ";/<g<",
        "k?L3$U",
        "^n >K",
        "I/yN/{",
        "Verifying Box container: [%d]...",
        "KSg[G",
        "GD^>\\-",
        "ty(1!",
        "dia a obrazovky pr",
        "rd: Anger produktnyckeln f",
        "r vill samla in loggar och annan diagnostikinformation fr",
        "L)v)zs",
        "u~0C^Ygd",
        "%V<dY",
        "Eylem : Belirtilen ",
        "h5^MRS",
        "D$0PS",
        "Nm>G;5",
        "vat v produk",
        "jaOC/",
        "i put kada se ra",
        "Odwied",
        "_vkbA",
        "tt et forbig",
        "6:|(\"",
        "\"s<%fI",
        "OrwOr",
        "5m{s{",
        "< <,<8<D<P<\\<h<t<",
        " al suportului fizic de instalare.",
        "v^rtB",
        "{t{X:",
        ":E>pK",
        "r,cjo",
        "n>E5w",
        "1(h$T",
        "Idu4R",
        "Primer: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "N7]-rX",
        "naQK}",
        "6$606P6X6d6",
        "Qs:qtK",
        "I/f'V",
        "z49P7",
        "5*Z F",
        "9F/0z",
        ";?q~'N",
        "gdKA^",
        "seau UNC vers un dossier contenant les fichiers .inf ",
        ".1ZF-",
        "2Gjck",
        "]S|+s%",
        "GetFocus",
        "*(kQ+",
        "        name=\"kernelbase.dll\"",
        "1$~rx>[",
        "Valmistumine (%d%%)",
        "iSY`v,4",
        "Schalter: / PBRUpdate <Parameter> ",
        "EQ|uk",
        "nk+RuWI",
        "Dejanje: z zastavico ",
        "V+2[?",
        "j0Tc/mO",
        "\\IH2[",
        "up/Y^F",
        "]B&r]",
        "dz-BT",
        "qJ!t9",
        "di$@Y7P",
        "k0jhk",
        ":@;I;",
        "VZ|&o",
        "&[3/u",
        "g(U^q",
        "y|)*s-",
        "imine ve izne sahip olmas",
        ">w#>MX",
        "o+JD)",
        "l PBR se p",
        "Gg|c_",
        "3-4 7",
        "|E>K8",
        "|0kcg",
        ":Wdsc",
        "J'e~@0!]",
        ".tHrH",
        "4=o3=",
        " perkrautas, s",
        "S3.6=",
        "c.D\"\\-J)l(",
        "o pesquisar",
        " Zo>C ",
        "748D8I8O8p8",
        " dosiahne OOBE: ",
        "w_m6l",
        "XU@+Isg",
        ".v/t~",
        "TvI,<",
        "Nbkp6$",
        "ad: setup.exe / auto upgrade",
        "rVcjx",
        "ranka nukopijuos arba nusi",
        "S&&\\n0",
        "v;aB'",
        "_errno",
        "m9Te=",
        "0]0n0",
        "OlcJ?",
        "kEz#Z",
        "ts.#v#F",
        "KqcGB",
        "2I(jH",
        "ETTx'",
        "-#TEk",
        "},Uy:/U",
        "^K7-z",
        "_N51O",
        "Switch : / Postoobe <location>\\setupcomplete.cmd ",
        "6,737S7",
        "<}s{(",
        "|^OTq",
        "#f=<s",
        "Zcm4|",
        "ee/dR",
        "F9Vr|-",
        "FGYt^",
        "{!vg!%",
        "iF>U}",
        "boru. Tento pr",
        ")FwrN",
        "tiZ-Vw5Z",
        "j\\%O,",
        "klad: Technick",
        "@&(1zFk\"",
        "?&?-?3?8?C?M?a?l?z?",
        "TeoQ(",
        ">!3Ou",
        "vO+ul",
        ";(fr|",
        "Pomoc",
        "tVpZ{j",
        "Fg%<-",
        "gpqyJn",
        ".?AV?$CAutoDeleteArray@E@RAII@@",
        "IQ6Wg",
        "l9G.S",
        "Visite: %1!s!",
        "(~T\\F",
        "8?3YP",
        "Dx`B{e",
        "*l!J!+",
        "%>\"F'jb",
        "   @@@   ",
        "vh2mf",
        "&ox;y",
        "E-tmI",
        "v:Snc",
        "Y >b7",
        "{g'OB",
        "=cp}>8",
        "=y>0;f",
        "X]s=rw",
        "_-g)^",
        "y{^z_",
        "s. Ce commutateur implique ",
        "n$v -",
        " prost",
        "oCv+|_",
        "n^fku",
        "sJ,5!",
        ":u*.'-",
        "@q~}z",
        "Fgq]e",
        "te pou",
        "w|};bY",
        "doF:1",
        "NzOA$",
        "qJ&-g",
        "Windows Setup cannot be launched while another instance of Setup is already running. A feature update might be in progress. Go to Windows Update in the Settings app for more information.",
        "w\\'!,",
        "?.B&u&",
        "P9wDf2(",
        ":<:Q:V:y:",
        "l#_[N",
        "pfSh1",
        "Vh@2A",
        ";`dM/",
        "q~k*o",
        "q'1N.",
        "u))N[",
        "EO%Ppw",
        "Y=tqk",
        "?wev'",
        "D*e%Rb",
        "\\93qt",
        "iy-XbI",
        "eirs?",
        "hdI:l",
        "rnek : setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "+^oSi?",
        "<)=1=x=",
        "4F4NV}",
        ":SX'!",
        "@x#+$",
        "+zfkS",
        "q}r/m",
        "[<q)<",
        "caH2@m",
        "Parametrai: Full; None ",
        "Sl/j L7",
        "k~dI~",
        "jra automatikusan a sz",
        "<u`T0G",
        ">e1mk",
        "[)6Dq",
        ">->G>Z>d>u>",
        "kkulcs ",
        "Rgctf",
        "ct<=04",
        "anjem poskusi preseliti vse gonilnike. ",
        "Mef4s",
        "YiV6C",
        "elite li nastaviti?",
        "k)9_gr",
        "DEU(2",
        "lamad",
        "Z qzZ",
        "6&LmZ",
        ")eL)^",
        "bEYiV",
        "rez de l",
        "RtlAllocateHeap",
        "F9s t`",
        ">^ }_#",
        "`L*K@",
        "+;SoY",
        "\"cI;S",
        "yM'd\"",
        "t0U/5",
        "Hyd^il9la1",
        "yuzbd/c",
        ".$A\"^",
        ",jJff",
        ")'j+F+",
        "application Install.exe.",
        "9,:e:",
        "W2B^K^_",
        "fl8}K",
        "8u<3g}",
        "_INrvU^",
        ";G>#rS>",
        "AZqJ#",
        "T0|p&",
        "GU)45`",
        "EsXIn:%;$",
        "X+bN`",
        "jiet instal",
        "s4dWz",
        "}=B/ ",
        "Empezar desde el principio",
        "Parametri: c",
        "8vk9U",
        "VNWg0x",
        "Obtener",
        "RUiP9",
        "{CP\\6",
        "hG7r+",
        "rf\"WRn-",
        "Example: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "genes. ",
        "L$|_^[3",
        "B={8&k",
        "}h'9p",
        "Z0nY\\?%<",
        "Ex/|L",
        "X-Bsp",
        "&Ex_z",
        "_.-krY",
        "Dq0\"o",
        "stemi i",
        ", namestitveni program med name",
        "NC&5r",
        "=~Y{4",
        "{{[>Z",
        "|Q2M--",
        "VanhW",
        "i\\P('",
        "77ftC",
        "DZZ,xI",
        "~gC[c",
        "3@CK;",
        "GW/oO",
        "b@=~\"|",
        "Akcija : Kada je / migratealldrivers postavljen na Svi, program za instalaciju poku",
        "G>'jK",
        "&<=&0ez",
        "Q|\\N)K",
        "vW0f0O0`0U0D0",
        "mP]u0",
        ", / PBRUpdate",
        "_+}Mk",
        " permisiuni pentru a copia ",
        "*ZDiI",
        "i un UNC t",
        "!#L+#",
        "@mil%",
        "n del medio y las pantallas de progreso se muestran de manera predeterminada, pero est",
        "u7WVh",
        "Microsoft Corporation1(0&",
        "a:J|3",
        "QueryDosDevice failed for %s. GLE: %u",
        "hrung kompatibler Betriebssystemtasks von Setup nicht automatisch neu gestartet. Setup wird beim n",
        "8<8j8",
        "7DBT*",
        "/vJq6=",
        "5c=:y",
        "?kuWB",
        "%yDO(b",
        "D&2q$",
        ":AE-'2?",
        "6iK7`",
        "0*0<0h0o0",
        "N^5)*",
        "x%^Gn",
        "k~9kf=",
        "E~PP ",
        "}SnpM",
        "^~`GQ(",
        ".S'm#-",
        "Visita: %1!s!",
        "KZwZ>",
        "n_DQ/",
        "8%Gff\"",
        "res med de rettigheder, som den bruger eller proces, der startede installationsprogrammet, har. ",
        "ildir. ",
        "nda Windows Update'e gidin.",
        "5V(j%",
        "VOqC`",
        "|U.DS",
        "c[qV_",
        "wG?[<:",
        "UQ%7Dx",
        "pi27X",
        "j#Eu5",
        "Dj9]Vg",
        "t/'_Q",
        "WDSCORE.dll",
        "OTGd<e",
        "wJ,a/",
        "Conmutador: / Postoobe <location>\\setupcomplete.cmd ",
        "U!~3d",
        "Stikalo: / migratealldrivers <paramenter> ",
        "Parametri : N / A ",
        "(a18K",
        "I-Gs9ys",
        "j`RC=y",
        "1*8;\"",
        " olarka bir s",
        "M&3]#",
        "OVK>YN",
        "Action : si le PC est en train d",
        "5H6e6",
        " contains.inf-tiedostot ",
        "7FF+!",
        "9u#\"{",
        "[yh^T",
        "IL*'u",
        "_~@|vn",
        "versera la t",
        "v deretter p",
        "u]\\:!",
        "^YgjZ",
        "v-c>[<",
        "5S}<]",
        "?$?1?a?w?",
        "rSb:G",
        "\\I>[XI",
        " Service Pack 3.",
        "o: especifica",
        "tab. Funktsiooniv",
        "zMLZIuZ",
        "[cZjg",
        "sd-Arab-PK",
        "pj[h)",
        "{qyyy<",
        "W5(9\"",
        "IGpP,",
        "Xhl2NRW",
        "l@6aw*",
        "~nco`",
        "Z*5wy",
        "FY7,]",
        "-]K@]$0u",
        "k: %1!s!",
        "=Q!eP",
        "*lQTT",
        "fFS3+",
        "FokM+",
        "nlos}'",
        "f;C)Bc",
        "Rk)Km",
        "ar-LY",
        "f:i,p",
        "dmO80",
        "T0;O(",
        "a6?;4p",
        "{\\+bX/",
        ":s2'B",
        "/T.jK",
        "&^OdUp",
        "Instalator systemu Windows 103Instalator systemu Windows 10 jest ju",
        "9Ro0wF5}>",
        "M^mL8",
        "edyNf",
        ":DUK'",
        "|`~7c",
        ">g>t}",
        "JpK\"j",
        "imiyle y",
        "9>(ek",
        "H%g`n",
        "]Cq}YG2",
        "%o+R7",
        "_eK$W",
        "[1t}]",
        "IjYE[yqE",
        "V4MFH",
        "|zJdy",
        "?>4&I",
        "WUm~J",
        "a&?$S",
        "GP.hB)",
        "_wcsnicmp",
        "_t679$/",
        "\\tg8U",
        "G `n)",
        "setup.exe /?",
        "~V7^Q",
        ",24Ib",
        " jour ou cr",
        "aT{P$",
        "%[>M~'{V\\v",
        ")}NM$<",
        "A[y3t",
        "53)B?a",
        "E[hYp",
        "C*~m|P",
        "Lb&sY",
        "Dj{F^I",
        "ziZY?",
        "88[u0",
        ">0%|FG",
        "UHdll2",
        "7P;\\C",
        "a!z6|",
        "SetTimer",
        "ns#QD",
        "!RTHo",
        "Zy!, ",
        "r8$gfwgfWr",
        "Voulez-vous vraiment fermer",
        "sSdcd",
        "iq&,^",
        "{hFN0 ",
        "uBL>F",
        "6sey ?",
        "|db!,",
        "7,}L3",
        "qfmrmJ",
        "+x8axLbK",
        "mdar?{",
        "1EU6s",
        "UuZ@wM",
        "h|\"j(ih",
        "7KtIp",
        "%6==XZbA",
        "? Uyk",
        "Cleaning alternate storage paths...",
        " partir d",
        "q))%9",
        "Primjer : setup.exe / auto upgrade / quiet",
        "JuDa%",
        "si forr",
        "lbLJp",
        "#a~qd.",
        "@@@@@@@@@@@@ppp",
        "laiIsl",
        "PnTnS",
        ">zw`{",
        "Exemplo: setup.exe / auto upgrade / Telemetry enable",
        "RW'lhM",
        "Dejanje: namestitveni program med postopkom name",
        "6,>#Z",
        "SII[{",
        "8O8j2",
        "!_aJn",
        "br{FfK",
        "dnZe#~",
        " edellisen version asennustoimintoa/Asennus ei voi k",
        "Action : indique si le programme d",
        "j;|Js",
        "rMhgn",
        "i da se vratite na %1!s!. ",
        "Gt5( ",
        "b\\KV,",
        "Primjer : setup.exe / auto nadogradnja",
        "0z5`8",
        "EsU*O",
        ")f^E:|",
        ")N6\\Y",
        "CT}fJ",
        "o. A interface e os ecr",
        "`$Ovg",
        "7!?,5",
        "xQC!% ",
        "VYGVL",
        "I_6cP",
        "6$,1(r",
        "Windows Setup kan niet worden gestart vanwege ontbrekende installatiebestanden. Als u Setup eerder hebt gestart vanuit een lokale map, kopieert u alle installatiebestanden opnieuw naar de map en start u Setup nogmaals.",
        "C8-!C",
        "8J2%5*YN",
        "5Ec{[G",
        "$<w*eS",
        "Posjetite: %1!s!",
        "http://www.w3.org/2000/xmlns/",
        "^EK-W",
        "|CC91",
        "![Z@~Fc",
        "\\FAD6",
        "CreateFileW",
        "\"l+Ll",
        "0VG{/",
        "E:O/^",
        "ziz[$4",
        "kYo=G%T/~",
        "Opzione: / Postoobe <percorso>\\setupcomplete.cmd ",
        ".?AV?$CDlpAutoDelayLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@",
        "n`M8g",
        "qF$g;",
        "k0#(BZngo('0",
        "4h9_h)",
        "cute des op",
        "e.ILe programme d",
        "Vai|g",
        "ustutakse, d",
        "F4J1'",
        "N+.y2",
        "?E?_?l?",
        "4?OJcuM$E",
        ":]M'e",
        "l]=l%",
        " przekazane do odpowiedniej lokalizacji. Natomiast gdy prze",
        "hPWt1N",
        "mat5~0",
        "ZQ~Vct",
        "xLmq?",
        "_EZv/",
        "647P7b7o7",
        "jBHHC",
        "%BGoH",
        "%;kdg",
        "BMJm%1",
        "]V:}O",
        " necess",
        "8?n(_",
        "0j0D0_0",
        "k{{G[[",
        ">gPN?D",
        "{+~uEv8k~",
        "czNK/8",
        " Instalatorowi wywo",
        " whE$",
        " >Ta4A",
        "ae\\bm",
        "]_'iN",
        " ir .inf faili ",
        "$E2Yi",
        "Slet/",
        "d3K9#",
        "StateMatch: Attempting to get SetupHostResult from registry...",
        "z+n`#",
        "8yQs4",
        "juUF6:b",
        "Ia5bM",
        "rOATV",
        "iX#t%",
        "O>_t],",
        "        loadFrom=\"%systemroot%\\system32\\win32u.dll\"",
        "IXBo.",
        "\\Z8Ok",
        "g-{OK",
        ":&:-:3:8:C:J:^:q:",
        "F##<0C!v",
        "Hx%}m",
        "K8n|N",
        "MED}Y",
        " Kt9q",
        "Pavyzdys: setup.exe / auto upgrade / quiet",
        "metros: ruta de acceso local o ruta de acceso de red a una acci",
        "0OS/2L",
        "omxT>U",
        "u\"rCHd",
        "J@S!^",
        "(JyG-q",
        "faP$o",
        "#Oikf^",
        "CNrWrz",
        "^lLsT",
        "D7.a/Sw",
        ")sC^f",
        "nleA{",
        "9 y@Ww7",
        "%&7[k",
        "1l|+c",
        "QN|<+5|",
        "ana. Lai ieg",
        "G%aMMQ",
        "ETSvyJ",
        "l9-l-",
        "H'y V(",
        "/R`xb",
        "qS#sn",
        "SourceUrl",
        "ena skripta koja obavlja zadatke nakon dovr",
        "'SF<W",
        "xxxxxp",
        "/u m:",
        "x1'D{",
        "My'>L",
        "SJ#k<4",
        "Lb%I0",
        "NyGAZr:",
        "%WJ.?<",
        "e, PBR ",
        "Toiming: m",
        "Dth_YS",
        "Voorbeeld: setup.exe / auto upgrade / PBRupdate disable",
        "<Un*_",
        "vzC<A",
        "Disable",
        "rVc^/)",
        "@]o%sm",
        "Preparing to install Windows 10",
        "m adres",
        "k!)C\\",
        "IkK1\"Ts",
        "X#|jIk",
        "gv(i3,",
        "3lB':",
        "w|#!h",
        "z&<pKFZ",
        "SWRh(",
        "0@$$@0",
        "g+XH1",
        "z061+",
        "Y;6h^",
        "#$U7.",
        "`AQQQP",
        "u ~F/AJ^",
        "8~B?c",
        "XZ)Gs",
        ">;>]>",
        "Dc.`$",
        "U4p_Og",
        "\\BIfj",
        "wRnvQ",
        "wE|w|",
        "20D7r9J3",
        "Radnja: Ako je / showoobe postavljen na ",
        "7qOQ|?P",
        "*65ZNScx",
        "Cb/ir",
        "p31xx.",
        "p`If?]D]=-",
        "5<]n$",
        "W9SW$",
        "Dye1w",
        "ZkMmP",
        ",fSb?",
        "S\\f@df",
        "de,hu",
        "ti-ET",
        "Parametere: Upgrade; DataOnly; Clean  ",
        "10.0.19041.572 (vb_release_svc_prod1.201007-1724)",
        "&p-[&bx",
        "LIO;F{",
        ">X>_>i>",
        "i in ne po",
        "404F4Q4r4",
        "N6T};m",
        "$(K9k",
        "YZ2VK",
        "Tel\\7~d",
        "(+s7q",
        "qBm\\Oa",
        "N{);~|J",
        "qqud]",
        "!Hiy0p",
        "RQ^IZ",
        ".text$yd",
        "I,dT|K",
        ")c<_*|<",
        "OM_+$",
        ",EDZr",
        "on34-:",
        "5,N\\|",
        "XU|]f:9",
        " : Full; None ",
        "',t$/8",
        "M'z?0",
        "T@`cY",
        "% q\"Z",
        "_2G&p",
        "RVH_+",
        "U}*?h",
        "TT:ce",
        ": / Telemetry <parameter> ",
        "8bI`5",
        "zfT}^",
        "(w61:#7",
        "?O)yd0",
        "Conmutador: / DynamicUpdate <par",
        "anu, rad",
        "yMw7Wn\"",
        "gqz_</",
        "fO]6V~",
        "/VQ):",
        "$O6ES",
        "G8,rm",
        "7.?3yMvX|t",
        "MA$9%",
        "~G^<C",
        "fP9tY",
        "p.`7`",
        "HnGFP",
        "nCH_r",
        "tUwUwu",
        "#<3x9Q",
        "FExeo",
        "ZZ'Uc",
        "jteni a tesztg",
        "zG)'}",
        "[QW<D",
        "ty-R`~{M0h",
        "\\{8wz",
        "QrP8z",
        "M_^\\O",
        "QhTVA",
        "elje, ali ",
        "r dynamische Updates ausf",
        "#tP5=j",
        "slechts ",
        "o3wo3",
        "d'x.>",
        "v j\\Xf;",
        "\"ZZh^",
        "seau vers le chemin d",
        "M]{qBh",
        "WoIi{",
        "PWWRh",
        "&sd1L",
        "3U7tZ+#ko",
        "8z4dM",
        "-HpK(e",
        "ne6J`]=y",
        "&fuX;",
        "a:.lt",
        "9-RISP",
        "XE5Wc",
        ";UOyu",
        " o inserir, a Instala",
        "28BI)",
        "Cl'f>",
        ":{8hq8",
        ",uTW5",
        "mkA/C",
        "RXwt~",
        "lBc;Ro",
        "kxbK*",
        "/>#z!",
        "e umetnuti sve .infove upravlja",
        "Exemple : setup.exe / auto upgrade / migratealldrivers none",
        "a+Ol7",
        "oUek?+~;",
        "!!>Z&",
        "Sh`SA",
        "rtelmezett be",
        "v7:}sE",
        "g_C/T",
        "Reading Box header...",
        ";2;M;",
        "n de red y puede haber sufrido una interrupci",
        "Action : injecte le fichier setuprollback.cmd ",
        "Toiming: kui s",
        "o do Windows 10 ser",
        "Mi6R-",
        "!h&Fb",
        "%sy)\\",
        "vju^s",
        "^hcGaf",
        ")E()E",
        "_WY:l",
        "{2059w[",
        "zF%':W",
        "OOkOUx",
        "SgyBu",
        "-^b~\\",
        "jam nor",
        "t-f9>t(Vh",
        "P~0ya",
        "dSFx[",
        "4DctC4",
        "{uUm]",
        "R+s7U",
        "faut. ",
        "3$Es^",
        "u5:^'",
        "%s(%d): Result = 0x%X",
        "<Y]`c~n~0",
        "Exemplo : setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "b_\\, Xw\\2r",
        "Eq<Q8",
        "d|28ts",
        "i]jnq",
        "U9AgPI",
        "^>q8^",
        "@@@@@@",
        "@Po\"[",
        "S4O{(",
        "QU4C7",
        "Process termination due to Suspend! Returning: [0x%X]",
        "ciou. ",
        "~_vh#",
        "InstallScenario",
        "%JCb'",
        "'r?(-",
        "EV%(.`@ ",
        "_/% Q",
        "s+IYp]",
        "H$AJ*F",
        "%f8NV",
        "XOHSl",
        "6^1nXF",
        "(ICJK",
        "UNj84",
        "   9K0",
        "R?CAC",
        "!D_Kt0",
        "_X/:#S",
        "f_s(M",
        "h*R\"j",
        "]<#4D",
        "BHSuoS",
        "!,4t&",
        "DY+vy",
        "o~lTL",
        "}HoKi3",
        "-Q}x@",
        "ky zadan",
        "e automatski ponovno pokrenuti PC kada zavr",
        "Uvw6Y",
        "G~4Ak",
        "emu po",
        "HKiu0[3",
        "%:!i\"",
        ";P4'b_",
        " Enable uppdaterar eller skapar installationsprogrammet PBR-partitionen. N",
        "[<+9;+\\",
        "#h6QM8",
        ":$hqA",
        "s3M'6",
        "[K08G8",
        "PK!h-",
        "MV2uc",
        "I$ht4",
        "P%8^;_",
        "}a-0+",
        "Jm<CJ",
        "minen ei onnistunut. K",
        "?&?<?G?s?",
        "Aktion an der zuvor erreichten Stelle fortsetzen",
        ". Visos teis",
        "P0~}\\y",
        "3W4Tf",
        " .inf ",
        "s ginamos.",
        "_pz*=N",
        "L#hy ",
        "*.cab",
        "WvbHo",
        "0W0c0",
        "N&xqC+",
        "[BfPJ``",
        "Wz~M_",
        "-xV9dm%",
        "O'!@H",
        "effectue ",
        "ORRM~",
        "UrR^,'",
        "OpenCABFilesInFolder: [%s] is empty.",
        "Reprendre d",
        "e8)oJ",
        "VZ WU",
        "yeb5@",
        "?,n&c",
        "<iY&V",
        "ks3_N",
        "fgsUjk\"",
        "rksplacering, og der kan v",
        "PdM[8",
        "na putanja do specific.wim ",
        "B9N<)_",
        "ka do pliku setuprollback.cmd ",
        "'LL@ ",
        "qb9'#e",
        "<1C}~",
        "5xeEW",
        "@G)rN",
        "dzie, uruchom komputer ponownie, a nast",
        "6fJJJ",
        "\"K<dL",
        ")5\"~=",
        "jiet datoru un m",
        "\\X#];",
        "n de Windows 10 no acepta argumentos de l",
        "Opzione: / quiet ",
        "^UJ\"oF]",
        "%RR@yp(",
        " yolu ",
        "?nt8j",
        " eFix",
        "metro : / Telemetry <par",
        "q\\4:s",
        "w#oa`9",
        "s listo para instalar Windows 10?",
        "Esempio: setup.exe / auto upgrade / PBRupdate disable",
        "slovn",
        "nda setuprollback.cmd beti",
        "j54Ji",
        ".>C%D,L",
        "?js)-Rc",
        "K &??",
        "5xv^z",
        "igustega. ",
        "CG3BE3",
        "4ArJr",
        "Z<:G7",
        "]2}u.]",
        "CSetupLangIniLoader::Initialize: %d languages found.",
        "-Qo>ub",
        "FWa+\\",
        "N2h'lb",
        "8v]5b",
        "`^mjI",
        "F`+ys",
        "r+]Yq",
        "<7Opj",
        "hbru)",
        "d_}\\=HM",
        " telemetriu generovan",
        "~[6N'",
        "<iMb8",
        "en na odre",
        "0@$$?/",
        "&iqy7zf",
        "sLsZ1",
        "ssal. Az adathordoz",
        "/g2u;",
        "*Shp<3",
        "ec?{M",
        ":I,;I",
        "@~2?|",
        "cbD;1",
        "E^E*e",
        "c|>0|",
        " Instalatora ponownie z poziomu okna wiersza polecenia",
        "o herdada+A Instala",
        "lti a t",
        "Yw=cf%",
        "BD8R{",
        "4Zy9Eq",
        "kBe.k",
        "acl-[",
        "anja Windows instalacije>",
        "4e` 5:.",
        "OOBE de maneira interativa. Opcionalmente, quando",
        "S)sXJn*",
        "=^P^I",
        "6~>xI",
        " avdelingen fra Windows 7 Enterprise over natten. Hun vil ikke at brukergrensesnittet i installasjonsprogrammet skal vises, men hun vil at sluttbrukere manuelt skal g",
        ")4^\\A",
        "trograder vers %1!s!. Voulez-vous continuer ?",
        "+Pripravljanje namestitve sistema Windows 10\"Namestitveni program za Windows 100Namestitveni program za Windows 10 se ",
        ",_i?u",
        "Y{l`a",
        "t.$Xkwn\"",
        "M&+wo",
        "=0+:5",
        "unalnikih oddelka ",
        "Action: When / showoobe is set to Full, the end user must interactively complete OOBE.Alternatively, when / showoobe is set to None, OOBE is skipped and components are set to their default settings. ",
        "toarele argumente ",
        "x)&'S",
        "+Xc\\N",
        "RO,KXR",
        "~<}?,",
        "5J!sC",
        "waPJ%",
        "elaHzb",
        "SHplI",
        "8m[a>q",
        "~pZ)>",
        "ani, da ",
        "DI7iU",
        "Wait for SetupCln mutex returned: [0x%X]",
        "WhHy@",
        "Kc;t#",
        "CDlpManager::SetDwordProperty",
        "z;D:#Z",
        " }H(#",
        "Microsoft Corporation1%0#",
        "_^g2(Oc",
        "elite nadaljevati?",
        "NZjGw!LSP",
        "G\"V0)",
        "|hE/wZ",
        "^2Fyocvf",
        "j>Lqk",
        "dQVeC",
        "/tKo3",
        "~]Fr`CU",
        "&RUOG",
        "0dk}T",
        "DgJ5>I",
        "CDlpManager::SetPriority",
        "C8i=76",
        "wQK~/+",
        "Program za instalaciju sustava Windows ne mo",
        ";Oq?4z4e",
        "u komut sat",
        "g4I%_",
        "dRtqC",
        "Sader",
        "7\\\"Rsc",
        "km^f'",
        "u[AJm?B",
        "1.=.=",
        "Xklz!",
        "]15f3",
        " Windows\" ",
        "_Qh7n",
        ";a;dn",
        "hqcf_",
        "CreateSolidBrush",
        "Vorbereitung",
        "C8?#PG",
        "}k3MM^AT",
        "3?P7,",
        "tor aktualizuje alebo vytvor",
        "gle> ",
        "V6*9uk",
        "nbCHT",
        "s$u^s",
        "Aktion: Bei einem Fehler werden komprimierte Protokolle von Setup an den angegebenen Speicherort kopiert oder hochgeladen. Beachten Sie, dass der PC und/oder Benutzer eine Berechtigung und Netzwerkzugriff f",
        "JMyvR",
        "~r7o34",
        "bwx02",
        "G7@C6e",
        "Parametri: percorso di file locale o percorso di rete UNC per un file denominato setuprollback.cmd ",
        "N#=F@",
        "o da instala",
        "$_{Qa",
        "TW-Cu",
        "u$H~_",
        "IQ<5R<",
        "/c-ED",
        "*,Q=^",
        ".[`q7",
        "heV@\"",
        "0)R>v",
        "6un|=",
        "zLUGQL(",
        "Wj0|/n",
        "es de Atualiza",
        "n especificada. Recuerda que el PC o el usuario deben tener permiso y acceso de red para la ruta de archivo especificada. Este comando se ejecuta en el contexto del sistema, por lo que es posible que no tengas permiso para copiar ubicaciones que requieran permisos de usuario. ",
        "H4>G&",
        "jFID'",
        "i%^nT@$",
        "Sklopka : / Postrollback <location> ",
        "MultiByteToWideChar",
        "S)b#G",
        "?ajL~",
        "-DuZo",
        "{!*&6",
        "6nW?ip",
        "P JETTfQ",
        ".Rt:L",
        "lZF~]S",
        "RQRRR",
        "a6~s,1",
        "<I~C^$",
        "9cWYZ",
        "fR\"H)",
        "b`c4i",
        "JJieL",
        "xty/s",
        "nHMK6H",
        "KP$?z",
        "VRXQa",
        "ksy komentoriviargumentteja. Suorita ",
        "Diegti",
        "\"<'^P6z",
        "3X%`}",
        "vQHQMR",
        "Program za instalaciju sustava Windows 10",
        ".CRT$XCL",
        "B2$asoF0",
        "UwM\"v",
        " po dokon",
        "l' yOF",
        "\"9W+x",
        "L6]2j",
        "A*jve",
        "te %d%%",
        "'jk#h",
        "}Z{6E",
        "L*]we",
        "Source directory [%s] does not have newer files; will skip it",
        "5/NG7",
        "fg9Xs{",
        "Bg6P7",
        "a4=OC",
        "avkPuQ",
        "H<BTlR",
        "ErU.?",
        "j?Q,!",
        "Exempel: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "x5~{yBI",
        " program vlo",
        "7$};zq1",
        "5K5~5",
        "*Z``tE",
        "#yB#L",
        "EWP++",
        "installation. Lib",
        "rJUv~X",
        "*F\"-p",
        "Esempio: setup.exe / auto upgrade / installdrivers c : \\aggiornamento\\driver",
        "pieniu niepowodzenia instalacji: ",
        "e se koristiti sljede",
        "S!O5}",
        "-d'YJ",
        "9 9;9R9d9",
        "?:?S?s?x?}?",
        ")2LA\"&",
        "oNigY~0",
        "eV,4)",
        "85NL3K",
        "v[r4j",
        "X(~BB?&",
        "d,H(kD",
        "p:=4')_6",
        "Handling: Setter inn filen setupcomplete.cmd fra den angitte plasseringen. Setupcomplete.cmd er et tilpasset skript for ",
        "rs med systemprivilegier. ",
        "Parameetrid: kohalikud failiteed ja UNC-v",
        "w,0bQ",
        "M8^2r",
        "%wPtG",
        "I|![eGn",
        "n especificada. setupcomplete.cmd es un script personalizado que realiza tareas despu",
        "dzie mo",
        "?{V!9",
        "Wykryli",
        "ksta diegimo fail",
        "Q8\\><#G[",
        "Dl{Nt",
        "rz 1?",
        ";*;E;_;l;",
        "JbXw]",
        "        loadFrom=\"%systemroot%\\system32\\coremessaging.dll\"",
        "F^7iR",
        "J !CS",
        "=3c6|<",
        "VS_VERSION_INFO",
        "J)OR~I",
        "z.Tm)",
        "r&_y:[9w",
        "Sh+_|",
        "kL9=S",
        ">pibK",
        "h|E}r",
        "dku.HInstallationsprogrammet kan ikke bestemme sproget for brugergr",
        "Akcija : Kada je / PBRUpdate postavljen kao omogu",
        "ejJo,S",
        "]}h[U",
        "cRol=",
        "<2bbJ",
        "#?JPd",
        ". Se suoritetaan k",
        "waEE:",
        "kqn9+",
        "\"U$T1",
        "zFhmoj",
        "P(x[`",
        "Y(?aj+3#b",
        "O{-_N",
        "x}/C&",
        "uz-Cyrl-UZ",
        "0FO/fvu ",
        "4Ks4O",
        "9:=a(&",
        "%6|W^",
        "Parametry: Upgrade; DataOnly; Clean ",
        "X|UM`",
        "?;<~[",
        "5mt=*",
        "{ya//",
        "s sor",
        "H%VRJ",
        "o2|@C",
        ";W;h;n;",
        "rlfiF",
        "}m(R%{",
        "4%'qY",
        "y)Ji1%.",
        "dm.t#N",
        "\"Weet u zeker dat u wilt afsluiten?*Bent u klaar om Windows 10 te installeren?",
        "MHhH<",
        ".Zq#Z",
        "R0!Mq",
        "zT)c,{",
        "M/O<9\"\"!",
        "oC9fB ",
        "(VbW7",
        "Handling: Angiver, om installationsprogrammet udf",
        "{u{Ds",
        "393P3",
        "XYGbSIb",
        "P=P/a",
        "rX^/nd",
        "cfMRp",
        "9ERgX",
        "C-WB-",
        "X@Rtx",
        "lar. Kaynaklar klas",
        ";5?Dq",
        "o e tente novamente.tSe voc",
        "d!8mX",
        "9AI=Q",
        "o pode ser iniciada quando outra inst",
        "pMYw0",
        "Global\\MoSetup",
        "@Gy]U",
        "5EircB",
        "sticas en curso. Ve a Windows Update en la aplicaci",
        "Qm4VG",
        "#s$w+TVT5",
        "FUP\"y",
        " r1yG6",
        "rtR(dE|",
        "SYSTEM",
        "t Cp}",
        "O![-W{Q;",
        "siCirW",
        "sAu;9",
        ":%-dz",
        "n de Windows no es compatible. La versi",
        "g(Y2o",
        "L!UbU",
        "GWzkE",
        "ha-Latn",
        "131\\1v1",
        "0[tDY{y",
        "<mBKW5f",
        "0',O}",
        "  %s: %08x:%08x",
        "o consegue iniciar devido ",
        "gPP<A*",
        "GNgKZ",
        "%^OA{",
        ",!%7P",
        "&ii'W",
        "rhraF",
        "g@Nqq",
        "Pomoc techniczna",
        "Parametere: Lokal bane eller en UNC-nettverksbane til en fil med navnet setuprollback.cmd ",
        "bWq=;",
        "4<,Ah,",
        "Ic {b",
        "eUU89",
        "s tesztk",
        "7B9qR",
        "}3w.j",
        "_unlock",
        "\\YN''",
        "5@\"]Y,",
        "\"vYMS",
        "c>TbU",
        "YzXCn",
        "qw/i$",
        "hrt werden. Es wird mit Systemberechtigungen ausgef",
        "x>Y=~",
        "!9FksGK",
        "g&f+A",
        "9|$(u19|$,u+W",
        "1%2?2L2|2",
        "a$(Qtt",
        ":vs Mc",
        "n produc",
        "\"/mmM",
        "O[Z.>",
        "v1n#gdG_",
        "GetLastError",
        "n0)R(uq}",
        "W<ZGm",
        "-J\\_q\\",
        "^hPoG",
        "1&gLSqZ%-",
        "Gx[xO",
        "*p#!&",
        "zE4Lv",
        "ZO?zp",
        "gCR$pE",
        "'d-}Z",
        "8d$7M",
        "'9[gj",
        "'dhm)",
        "jungtas, telemetrijos rinkimas ir nusiuntimas pasirinktas, OOBE bus praleista, PBR bus atnaujintas arba sukurtas. ",
        "#lVVf",
        "k$3>f[",
        "=#Y5T",
        "s3kEX",
        "qqo>N/*",
        "uje odre",
        "m3&9%",
        "~E`0`vsC",
        "Xas_\\",
        "6$:+N0{",
        ";\"p'O",
        "5_fM?p",
        "2gQ}s",
        "}c5@T",
        "{'6`&",
        "hA/%=",
        "c\\WwYO",
        "U.A][",
        "9TR9H",
        "*aa),",
        "F/Vo4",
        "4f1sI",
        "#OXj1",
        "p]Tj^",
        "7Qa[-o",
        "Skrbnik ",
        "* w>By3",
        "0jHE&",
        "Wuiv ",
        "#E8NS",
        "JmKX7",
        "$fY( ",
        "dek instala",
        "?Fkq^EO",
        "igus genereeritud telemeetriaandmed. Kui s",
        "s<#n/9",
        "<`lw>",
        "Y2XK-[",
        "-iiV,$u",
        "zP}_C",
        "Y9}w9",
        "pq61f",
        "v5CpU",
        "[\"Yk5",
        ",>\\)09",
        "PX.|/l",
        "jmH-<",
        "o especificada durante o processo de instala",
        "{My>4f",
        "loYqlM",
        "unalnika, ko kon",
        "qaU.n",
        ":!1Rq",
        "XXOm@ ",
        "`~^SJ",
        "0d0k0",
        "Indstillinger: Lokale filstier og UNC-netv",
        "]-rC&",
        "zs'pW",
        " q>M-",
        "lbN O",
        "e\"[|W",
        "N=0t3",
        "Y+au-",
        "a_rYB",
        "wam?+Va",
        "?u4u@}",
        "c'kcQ",
        "x&Tx_H",
        "/RI<T",
        "<|ASQg",
        "iVDNE7PHKo",
        "z de tu medio de instalaci",
        "eoo+CgZ@EE",
        "s mennyis",
        "+i]Fq",
        "HT.#)",
        "mt?S#",
        "h8D:h%",
        "%=@SOS",
        "/]eKN",
        ";.'AV,",
        ">j6Df6",
        "G8uQt=",
        "PVVVVVVV",
        "u@?y@?y",
        ";FLMT",
        "&kD+C?",
        "=Eroare la montarea elementului media pe unitatea de hard diskiInstalarea nu a putut porni corect. Reporni",
        "tancia in",
        "SPQqX7e",
        "~_Z.W",
        "8wY{-",
        ". Notez que le PC et/ou l",
        "o(<tbH",
        "{3/zN",
        "[d/ODo",
        "=~ik:",
        "tAnuk",
        "}2r,-",
        "o atualizar",
        "in;5\\-Q",
        "R9mZe(",
        "fDcrfL",
        "(JJ%E",
        "ivityksen toiminnot (hae, lataa ja asenna p",
        "3T.i3",
        "H\"u?R",
        "]7cNyn",
        "iu-Latn-CA",
        "5]Z'eJ",
        "^D5('",
        "t}+jHj",
        "!Ki#C*",
        "q%K1B",
        "hrend bereits eine andere Instanz von Setup ausgef",
        "=(P0ofz",
        "f~o2YDf!",
        "}w$NM",
        "o : Especifica a localiza",
        "\\dAGk",
        "Arba diegimo in",
        " impostata su Disable, il programma di installazione non raccoglier",
        "L$,_^[3",
        "t/U@&^g",
        "DFBn:`'5",
        "=hjQp",
        "1q[L|",
        "sj`cXDw",
        "[p%<C",
        "zT;a2",
        "Uw,\\m\\",
        "Et1]B",
        "}yUO>5",
        "$}}8u",
        "|.bu:",
        "?^X\\^",
        ":0%77",
        "343O3j3",
        "9}KY*",
        "vel egy",
        "on interactive. Si / showoobe est d",
        "R EX[",
        "mhBvV",
        " suportada. Vers",
        "9!9w9",
        "J $TS",
        ": setuprollback.cmd ",
        "]..%Fo",
        " OR(*",
        "b_QQ\\w",
        "UtV.xZ",
        "|8SvY",
        "F#A<R",
        " Windows Update dans l",
        "< nvB",
        "Bryter: / noreboot ",
        ">CfZ-^(Q ",
        " a cabo operaciones de actualizaci",
        "(0)1$",
        "^-Fq:Z",
        "2fs`K",
        "Bzl(s",
        "4(C~`L+",
        "e;p/2",
        ":2H?JWq0",
        ":1:\\:",
        "%:zb;5",
        "MX`qIK9",
        "&UvxT]",
        "_wcsicmp",
        "5uj+Y",
        "SslTb5",
        "9'9=9D9N9e9",
        ";8*3Y",
        "V36^8}",
        "BtCj_",
        "/C-5o7\"PGm?",
        "Kh|O3",
        "Parametrar: Lokala fils",
        "`v7[X",
        "Qm0q(",
        "h!*E3",
        "{8BG1}y",
        "a1`/M",
        "9%-&A/",
        "rkssti til en mappe, der indeholder .inf-filer ",
        "bISlR",
        "CheckFolderProtected",
        "C&5~=",
        "x90WnB7W",
        "2`3<?",
        "/k5en-",
        "+i%L+",
        "e %s-bit. Ko ga boste vstavili, se bo namestitveni program za Windows 10 samodejno znova zagnal.,Ni bilo mogo",
        "Removing ProcessId registry value...",
        "Di$ 6",
        "F&x,1",
        "1J2^q",
        "\"oE3~",
        "$4-`^",
        "ooB>G~",
        " mGk&",
        "3H ''",
        "ordinateur est red",
        "Xn!9%V",
        " falta de ficheiros de instala",
        "Mmu )",
        "FQkWif",
        "\"Lu9GB",
        "fer<m",
        "e;JAw",
        "Dosv-",
        "jsm9o.",
        "steemiga Windows 7 Enterprise t",
        "EM<^d",
        "jb6o}",
        "7H_3_p!",
        "6q4]n",
        "'rVd8",
        "8Zk3E",
        "HINWEIS: Dieser Schalter sollte nur zu Testzwecken und in Testumgebungen verwendet werden. Von der Verwendung in der Produktion wird abgeraten. ",
        "ja uzst",
        "Comutator:/ pkey <cheia de produs> ",
        "me donc n",
        ";70rW",
        ".><+xn",
        "w z wiersza polecenia. W oknie Wiersz polecenia uruchom polecenie ",
        "r<VF9",
        "_<LQG",
        "6PYXA",
        "lan yap",
        "ivitamisel ilmnes t",
        "fh+)i",
        "PudBWG",
        "Voorbeeld: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "poX@VF",
        "6+CGr",
        "ki. To polecenie jest uruchamiane w kontek",
        "~IG?t",
        "6@O{>",
        "LoadStringW",
        "XIj]UJ",
        "w testowych. Za pomoc",
        "~4;+}",
        "I6k, }",
        "51:};s",
        "z;M$<",
        "Un administrador que quiera actualizar los equipos de sus departamentos de Windows 7 Enterprise en una noche. No quiere que la interfaz de usuario de la instalaci",
        "mp>Ra[",
        "^`tA<%",
        "3#4*4u4|4",
        "Had0r",
        "gots skripts uzdevumu veik",
        "xtW_7a$~",
        "l-Awp",
        " a telep",
        "Js?ww",
        "`?j,)g",
        " uprawnie",
        "1Sphcv",
        "juma konfigur",
        "Ph4y@",
        "'V(i4",
        "9,nWvD",
        "%59>*",
        "tGAp ",
        "P@3f3k",
        "v+gVG",
        "8{/ql",
        "rJ.WQ<",
        "Xk<~C",
        ", se uporabni",
        "6,W6R",
        "Je{c?k",
        "b@~$U",
        "UP!Q&",
        "Fy%{m~",
        "N`C/o",
        "#1dZr(",
        "N\"3ogR",
        "+= )|GK",
        "v.L>+W",
        "`Ncn-",
        "en samoja oikeuksia, jotka asennuksen k",
        "%A/ZV@",
        "@.T+nt",
        "T:a8a",
        "#Vh[r",
        "])#5=|",
        "ff-Latn",
        "B)) 7",
        "g`E<%",
        "2SyiQi",
        ";Bj.1",
        " iX r",
        "|hz:0",
        "|79A>",
        "@W|S}1",
        "Voorbereiden (%d%%)",
        " telemetrick",
        "e do fascikle koja sadr",
        "],y:'*",
        "5XMm&E",
        "DydoxfB",
        "h*6C*",
        "marrer de fa",
        "B+!;r@i",
        "9Z3?D",
        "Ea3IK",
        " xw(r",
        "in en az 350 MB alana ihtiyac",
        "uBriP",
        "mu`[k-",
        "qhgT=",
        "|)MP ",
        "ivitada.",
        "Esempio: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "Audqs",
        "\"?5D^\"{z^",
        "9KYWj",
        "trie g",
        "Dejanje: navede lokacijo medija z virom namestitve / files ",
        "=mtTU",
        " Windows. ",
        "vz9Jx",
        "0$s+:",
        "?83)l",
        "v,g0W",
        "=/g:+",
        "g]S;SP)",
        "|cSog",
        "PPP#~",
        "]DO1@dE",
        "2%2/2?2T2Z2",
        "h dxa",
        "G\\o.J/q",
        "a+)m#)`;vy",
        "QlS$a~",
        "worden geen opdrachtregelargumenten geaccepteerd. Typ setup.exe /? achter de opdrachtprompt in de hoofdmap van het installatiemedium.",
        " \"/ showoobe\" ",
        "XCv|}VO=",
        "EvQDd",
        "|DV)Z",
        "92/x<1L",
        "0R@` $",
        "r}f|s",
        "rs#vU",
        "{R!+<",
        "re opst",
        ")GA$h",
        "Pcf'r",
        "2'2.24292D2M2a2",
        " naujo",
        "~EEaP",
        "#3+w{",
        "cp7 e",
        "c)U+$ \"p",
        ",C2vG",
        "KdIl&3",
        "kGR<{",
        "9ZpCx",
        "klg8J7",
        "My_c$",
        "xv&BF",
        "*x<d\"",
        ">;+M,(",
        "}27PG",
        "EA1/5",
        "<blzb0",
        "i9n\"R",
        "v-ZDQk",
        "o4Q$1e",
        "Q]rp5",
        "\\Ni}:",
        "<za;{v2",
        "-sB'3T''",
        "une fois que la machine atteint OOBE : ",
        "7'7@7j7u7",
        "r2_%2",
        " $$\\I",
        ">8E_T_",
        "jI.lk",
        "O2u{Z8xv",
        "Ox6Z5",
        "E'3OY",
        "2e9X#",
        "n&)XCR",
        "kyTm:H8%",
        "lv9JO",
        "!=7$@",
        "=zY^E",
        ">http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0",
        "gy~Ff",
        "96'0gN",
        "Bw.q:q",
        "ZqU!J",
        "CDlpManager::Initialize",
        "__p__commode",
        "0'W^]h",
        " n*B;",
        "A|J|mSm=",
        " informacija",
        ")-rLY(W'",
        ";\"XhG",
        ">gMom",
        "HDZU_",
        "Z6S]P",
        "Switch: / Telemetry <parameter> ",
        "Conmutador: / migratealldrivers <paramenter> ",
        ";d-`A",
        "Y^03-",
        "3[vKpR",
        "}QN4V",
        "dx;Fu",
        "Gi!X]",
        "G,\\ \\",
        "1l].\\",
        "$2T}kO",
        "mhRT&=",
        "o>l0$U",
        "Pripremamo neke stvari",
        "/:mhfl",
        "9AvFgOv",
        "gralit",
        "xd)2M",
        "e~0_0o0\\O",
        "pao>!",
        ".?AVRegValueEnumAction@@",
        "262v2",
        " ZmZ=",
        "(UBxF",
        "x;Y}3)",
        "2oGM8Rer",
        "1<.@A",
        "5l6`}U",
        "$I{874$i",
        "nda kullan",
        "%cEWo",
        "Administrators v",
        "tHGtLCzX",
        "~jMp1",
        "R@]3o",
        "a4<Pw",
        "u}bM6",
        "izHnq",
        "~{j!]",
        "Performing cleanup level: [0x%X]",
        "6!6=6K6l6",
        "B|GA0",
        ".GE%8",
        "o. Libere algum espa",
        "kaz je spu",
        "#03s7[us",
        "@:CNid",
        "n<kA@R",
        "L_A41",
        "c;~\\U",
        "*;|jy",
        "Parametri : 5x5 klju",
        "Azo!S",
        "%9Qq$",
        "NtSetInformationThread",
        "lFpV:nv(",
        " OS. Jis turi tas pa",
        "ra verktyget igen och kontrollera att du v",
        "WZRDc",
        "U[MU7",
        "U g*K",
        "IR4jh",
        "SetupPlatform logging initialization failed: [0x%08X]",
        "~{1t&F+-",
        "ete se mo",
        "\\<#yc",
        "1u37yh7",
        "{;;yo",
        "<;<I<",
        "switch gaat bovendien uit van de volgende standaardconfiguraties: EULA geaccepteerd, dynamische update ingeschakeld, optie voor telemetrie verzamelen en uploaden is ingeschakeld, OOBE wordt overgeslagen, PBR wordt gemaakt of bijgewerkt. ",
        "iune: c",
        "vakettale ilmnes t",
        "c?uc$",
        "DnFrb8",
        "gll,m",
        "Q4b1g/_",
        "\\<f:6*",
        "fGTHA",
        "Operacin",
        "0?h$@0",
        "%;cwWWWWWWW",
        "v6tZ_",
        "ovat po p",
        "j\\Yf9",
        "mFRj:",
        "+K:Wm",
        ":#EP6",
        "i zadatke razine OS-a. Kada se PC sljede",
        "BdeX5",
        "<~[-E ",
        "io!.~",
        "g#B:T",
        "dia a obrazovky priebehu sa zobrazuj",
        "w/8Q:w",
        "-iU+Q",
        "*u&5}#",
        "N+M\"nQ",
        "n`cX=",
        "+L=yRAw",
        "YvPOLS@",
        "@W-vg",
        "/:]fk#",
        "WhTOm7",
        "v1,X)",
        "na odnale",
        " nytt fra kommandolinjen",
        "OM&yS&",
        "5+5K5l5",
        "#n<P?",
        "o do Windows 10 n",
        "Lttt`",
        "wzj\\B^",
        "0\"3ICkn",
        "NCn$+",
        ".dVSN",
        "NTzGq",
        "#HA[(",
        "Een beheerder wil in ",
        "42(G(",
        "VtI{X",
        "CSimpleDialog",
        "u/CGH",
        " ikke brukes i produksjonen. ",
        "vel inferior do sistema operacional. A instala",
        "8k$v>",
        "H,e$]",
        "~[coj",
        "\\?h|v",
        "ordinateur lorsqu",
        "%s\\%s",
        "ana neizdodas un ir notikusi datora atrite uz t",
        "i4:L~p",
        "TransportName",
        "metros: ruta al archivo local o ruta de red UNC a la carpeta que contiene los archivos .inf. ",
        "m-Y7Sk",
        "V%B`Q",
        "_O<t;q",
        "ProgressHandlerAction: Sending initial progress message for action [%d].",
        "?Of1P",
        "%O0[v[|:",
        "0rM`T",
        ">KOdL6",
        "Cancela&r",
        "'X|f{",
        "o: / copylogs <local> ",
        "gI{Wq",
        "\\?EVX",
        "2g1nY",
        "/4_}VN",
        "vne spusti",
        "{^nPw",
        "T8O*,",
        "tWIE&",
        "TR y)7LY",
        "R6$-A",
        "Vj'pw",
        "Nbvu`A<",
        "-h5/oX",
        "Process exit code: [0x%X]",
        "lni, ",
        "'RJ-O",
        "Obk+#",
        "p -6u",
        "zY+zy",
        " :SBa>",
        "U (oG!",
        "7UcY3",
        "7=y{=r",
        "L>-:l|?H",
        "hY'Z6",
        "n-V0]5",
        ")eRsbR",
        "FSHhw",
        "=zQp.<",
        "-A)d&.",
        "isOxM",
        "K?Y;_",
        "uje Windows. Navedeni argumeti komandne linije mogu da se koriste za izmenu pona",
        "JzmgD",
        "Beispiel: setup.exe / auto upgrade / PBRupdate disable",
        "Action : si / migratealldrivers est d",
        "ppp000",
        "}=lFW",
        "-f7mt",
        "d@8@Q",
        "zNB5w",
        "4wQPK",
        "#7yH'",
        "o do suporte de dados s",
        "[EMPO",
        "ib+r[A",
        "L[d9K}gW",
        "[y<zH",
        "\"4FCo",
        "tOWDG",
        "CDlpRegistrar::RegisterTransportFactory",
        "0*|kb",
        "aBz[[HZ",
        "]\"v,*",
        "nb@F ",
        "Task->Deserialize(): TransportId = [%s]",
        "9B:S:Y:",
        "!This program cannot be run in DOS mode.",
        "4%G#:I",
        " q&8d",
        "_gjC[",
        "8b<d-",
        "i nu va crea parti",
        "ku-Arab-IQ",
        "Uso basato su scenario ",
        "h?d?fo",
        "d.J-sQ",
        "'\"uo.J^",
        "Rr\\>hm",
        "|)8ad",
        "&[;m,",
        "C<+C(",
        "Io}*(X",
        "J2Srx",
        "#&)BJ#u",
        "lti a setupcomplete.cmd f",
        " um script personalizado para executar tarefas a seguir a uma falha na instala",
        "Exemplo: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "Windows 10 Setup$Windows 10 Setup is already running.eThis version of Windows is not supported. Minimum version required is Windows XP with Service Pack 3.rUse the other installation disc that says %s-bit. When you insert it, Windows 10 Setup will restart automatically.'Could not find the required XML version)Error staging the media on the hard drive\\Setup couldn",
        "wAAgJ",
        "?0Czy chcesz teraz zainstalowa",
        "'M6Hy",
        "}d|H-",
        "* ~,A",
        "1}4T{",
        "njLaM",
        "w'qhI",
        "J@9_=z",
        "g41A{",
        ">q[:u",
        "^6 Q<",
        "uxU_q,I",
        " Y}$N",
        "}g\\fQ",
        "sra csak akkor van sz",
        "_f2GI",
        "OpenProcessToken",
        " executado",
        "DeletePathEngine: Hit %d failure%s during recursive deletion of [%s]; 1st error = 0x%x, cd = [%s]",
        "~`DzTCa(",
        "-%_1s",
        " niskiego poziomu w systemie operacyjnym. Instalacja b",
        "File [%s] is older than [%s]",
        "L$OSbp",
        "liti: / auto <migreerimissuvand> ",
        "<WBn}",
        "Supporto",
        "zQ|Hv6",
        "kR@)t",
        "xr+uC",
        "Actie: hiermee wordt aangegeven of Setup Dynamic Update-bewerkingen gaat uitvoeren (updates zoeken, downloaden en installeren). ",
        "H. k;",
        "8`?nS",
        " installationsmediet i Kommandotolken.",
        "BrB]z",
        "outil, red",
        "#P_/n",
        "6ETGF",
        "n: cuando / showoobe est",
        "Y0D^z",
        "*tlQX",
        "=:3{Ny+d]",
        "&Abbrechen",
        "q4Nz#",
        "-TJf0",
        "d\\di<",
        "pu]$r",
        "tfen kurulumu yeniden deneyin",
        "/#?67",
        "/MediaPath \"%s\"",
        "py5+;8",
        "3o/b=",
        "KgaSjA",
        "@Y{X(T",
        "Source directory [%s] has newer files; will copy it",
        "oc-FR",
        "KE'om",
        "#?fN ",
        "W^Lxb",
        "(3uu!\\]",
        "randinstalliprogrammi k",
        "OW*\\16l",
        "+Adl|r",
        "Sources\\install.esd",
        "K=uko",
        "v#@Z%2",
        "`zuQ=4n",
        "ivitanud kasutajal v",
        "(BW6o",
        "wt$\"evu",
        "Vd ~D",
        "rtraukums. L",
        "WYYy-",
        "SxTF%'",
        "oPv_g",
        ")hzH5AKXDb",
        "u9f#U<",
        ">*@yy",
        "  wdsclientapi.dll",
        "';0`D\\$",
        "37!f1",
        " de produit>",
        "ite u odjeljku Windows Update u aplikaciji Postavke.",
        "0+(V8",
        "in, bilgisayar",
        ">D_FO",
        "giNf,",
        "Path cleanup failed! Error = 0x%X",
        "1'1;1E1L1R1W1c1s1",
        "uJFay",
        "rer installationsprogrammet komprimerede logfiler til den angivne placering. Bem",
        "=hoUj}'Z",
        "th0MM",
        "HK,zz",
        "+aM]>R",
        "  wdscsl.dll",
        ":];g;",
        " kabul eder: EULA kabul, Dinamik G",
        "Parametrai: vietinio failo kelias arba UNC tinklo kelias iki failo setuprollback.cmd ",
        "%d7a||",
        "9-989~9",
        "ckPB ",
        "C>wF2",
        "9nDN*",
        "rgmise k",
        "Z/;Dk",
        "I{h&muF",
        "1#101d1~1",
        "er. Den m",
        "3S`&}",
        "Exemple : setup.exe / auto upgrade / Telemetry enable",
        "yjgU<",
        "$s #3H",
        " problem podczas uruchamiania Instalatora. Zamknij to narz",
        ")i{i^",
        "nmlr\\|S\"",
        "Xh4@?(",
        "iK;|F~e",
        "MErk.",
        "Or1jV",
        "e petra",
        "m a odes",
        "[T<'F!",
        "9Tk2zD",
        "IC;Ku",
        "C<N%%",
        "n,RR !",
        "x<cRh",
        "xFH7LW",
        "m;d:=",
        "i6DFI",
        "555uuu588",
        "o: / noreboot ",
        "UsK+&",
        "{yTu1",
        "pbTDXs",
        "eCE}4",
        "T)t~]G",
        "WWWWh",
        "Mw-;9",
        "!q9wBrU",
        "\\H&0Wm0W%v",
        "oc%&['L_",
        "UnmapViewOfFile",
        "LhvWH\"",
        "Fm{r$i",
        "n>\\setupcomplete.cmd ",
        "Y_s?P",
        "Npvu`",
        "(w:g5'",
        "j?INIUR",
        "lda: setup.exe / auto upgrade / showoobe full",
        "\\h,r;",
        "PopulatePreservePaths",
        "de-CH",
        ":VqcL|c9",
        "Z90T+q1",
        "z<{3P",
        "sr-Latn",
        "8G<*^",
        "=-x3m",
        ".?AV?$CZeroInit@VCPackageScenarioCtrl@@$00@@",
        "<u?LL",
        "A\"s8T",
        "<UG50",
        "i argumenti naredbenog retka mogu se koristiti za preinaku pona",
        "m9n\"I",
        "K&@o_",
        "\\$YsJt",
        "LCo}Q",
        "Fujwh",
        "c2<!'d",
        "STS%}W",
        "E,lU7",
        "_v->,",
        "tnWVj",
        "y))2q",
        "X:0TKX",
        "0^O?n",
        " soubor setuprollback.cmd ze zadan",
        ",0n]B",
        "{a+X+",
        "t.0:v",
        "] {b[",
        " : setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "Action : The quiet flag will  suppress any setup UX, including rollback UX ",
        " su 3 pakeitim",
        "iune: instalarea va injecta toate fi",
        "o*psWS",
        "t znova a ujist",
        " ejecutando otra instancia de dicho programa. Es probable que haya una actualizaci",
        "O`j r1",
        "f2]0U",
        "+6`1V",
        "g1<49*",
        "8 Py@fx",
        "En@l%",
        "e]{{UO`",
        "Dejanje: ",
        "lt*fy",
        "A\"_}G\"_M{",
        "tn-BW",
        "'iwiA",
        "{WMBj",
        " {N&3+",
        "v;*l7",
        "f8vt/",
        "ratud asukohta. V",
        "]]h<9",
        ":g^qip@",
        "jCD%c",
        "%f*<E",
        " nori atnaujinti skyriaus kompiuteri",
        ">>8*r",
        ",~].5",
        "mZj8Ih8",
        "pc?06T",
        "kF#~`FY",
        "wDJAs",
        "GE[?u",
        "rovne. Pri ",
        "|v0ZcE",
        "VersionMatch: [%s]",
        ".rSvro",
        "+}^ss",
        "I;a8/",
        "+wa=3'gd:",
        "-4N9=",
        "DyVB}Xn-",
        "xhya1EF",
        "r7Tie/df*",
        "Primjer : setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "Jd d]X",
        "sias konfig",
        "sw-KE",
        "Z*{{l",
        "Instalare",
        "DW_G&",
        "organizar la actualizaci",
        "CreateDCW",
        "rs: setup.exe / auto upgrade / Telemetry enable",
        " A^ahO",
        ":r\"}I",
        "!D$DVf",
        "jQZs-F",
        "GjgAL-",
        "{7!uH<3",
        "/m(=]",
        "{` 9$",
        "k!bBj1;",
        "1JZSI",
        "xeFZ2",
        ":D;h>",
        "!5rp2T",
        "jiet: %1!s!",
        "6Bl1qmb",
        "ce polecenie w wierszu polecenia: ",
        "67V6{",
        "r/w0F",
        "'|E4o\")h`",
        "nFdKQ",
        "d><k ",
        "1t,x ",
        "1nq\\=",
        "metro : / installfrom <localiza",
        "kmak istedi",
        "G/Wc=",
        "v`Y`5",
        "tA3hn&",
        "FPB9U",
        "B0dap",
        ",+&#0",
        "olT:Q",
        "zO.F}",
        "]p5==",
        "/lTvm",
        "n. Por otro lado, cuando / Telemetry se establece en Disable, la configuraci",
        "In Windows 10 Setup",
        ")eZ'*",
        "WZ`\\U$]]z",
        "I P)@",
        "\\/HuW",
        "^wAKFo",
        "GlobalUnlock",
        "O7(`]",
        "Br&IO",
        "2AX .",
        "/Download %s",
        "> 8Xe",
        "Do?;,",
        "Verifica la compatibilit",
        " Microsoft Corporation. ",
        "Fm'}m\"v",
        "[W0f0",
        "E!Y'Y!",
        "``Z+[",
        "wl/98;",
        "L_sr+",
        "e*w\\R",
        "nl^w!",
        "ZuS<z",
        "_1lz9",
        "M2\"6`DBU7h!w",
        "BSj]]",
        ")d$L:",
        "'QZX(",
        "u#E<16E",
        "gY/?W",
        "f[/<b^`",
        "&+>Dx",
        "/|Y.Tz",
        "EVy%\"",
        "W[t5z\"%~{",
        "gWCfqM",
        "kleme) ger",
        "u<,/CH",
        "jq\"/o",
        "^kAz/p",
        "-4WW$",
        "lz=l'H",
        "?#u.n",
        "2(,P>",
        "WHg +",
        "'=(D%",
        "$'2_n/",
        "ide: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "wTv\"0",
        "r~akow",
        "rXJ$=--]cv",
        "vP R]",
        "0M0g0r0",
        "Hp)-m",
        "+bf9K",
        "lVGdd",
        "-50Hs",
        ":\\Z/X",
        "yCDB~C1`",
        "Tatz@K",
        "<G<+]",
        "K.mIl1+",
        "m diskuyInstala",
        " jaunin",
        "241A04B0",
        "Tt=n3",
        "LRrK6",
        ")!]__}JF",
        "y-1Mt",
        "ljF65",
        "amOHtGDIt/",
        "[,t>:",
        "WAc3h",
        "Prebacivanje: / Postrollback <lokacija> ",
        "7TCkB",
        "e da se pokrene dok je druga instanca instalacionog programa ve",
        "bQJ~1>r",
        ".+g_M",
        "oS~VA",
        "bban elind",
        "boru s n",
        "596O6",
        "x;x'x",
        "S2Nr7",
        ".PALiF~",
        "]'byT",
        " kompiuterio",
        "I>Qy1",
        "N6Q'{",
        " }OMF",
        "CSetupLangIniLoader::Initialize:     Language name     : %s",
        "k#>=?",
        "dFm~AD(",
        ":-:4:[:b:",
        "JT3Z2O=",
        "2viQ.",
        "c#Rrf",
        "M~[Ix",
        "lOHLH",
        "F0Jl9",
        "SVWu;",
        "^_ck!",
        "igus k",
        "ckh_YS",
        "bi4lCe",
        "9sL^=",
        "tigen mindestens 350 MB Speicherplatz zum Ausf",
        "\\:w\\\"",
        "q3i_e",
        "MPZDV@a",
        "Nas<~+",
        "0ezgF",
        "G1?dt%",
        "a`)@O",
        "Eu30K",
        "+\"h\"<",
        "A;=9A4",
        "e-EW0",
        "'4./;",
        "SetupHost result missing... remapping [0x%x] to MOSETUP_E_TERMINATE_PROCESS.",
        "nQ43pb",
        "\"qv6R",
        "dDg{s",
        "n%vqD",
        "rer allerede.kDenne version af Windows underst",
        "Q''S;",
        ",$YO[^(k",
        "@8T|1",
        "L9=\\9",
        ">T,Te",
        "}+3VH",
        "Arhitektura koju ste odabrali ne odgovara va",
        "e9Js(m-",
        "QT2i1$3J",
        "r / migratealldrivers er satt til None, da vil ingen drivere overf",
        "cqP8&",
        "#}%95F",
        "(ST58W",
        "4F-v'",
        "Kh<kF",
        "6!7<7W7r7",
        "a6}+;N",
        "2f]PV",
        "(OOBE)",
        "i^zCy",
        "JTG*{",
        "Kr[mkx",
        "urirati ili kreirati PBR particiju ",
        "sre val",
        "(KD\\}",
        "2<_rxw",
        "<dho2u+",
        "SPExecuteCleanup: Failure while removing folder %s. Error: 0x%08X",
        "(+T#O",
        "cc.+\\",
        "tj(pr+",
        "|H.H&",
        "S] MH/",
        "{',d2",
        "@m6vpk",
        " mappa helyi el",
        "@V-eR",
        "Parameters: n.v.t. ",
        "P}I,u",
        "%ct+E",
        "EQ\"[;",
        "8B4{]",
        "GyyyA",
        "*:Y@-",
        "(C[Ll",
        "%s: %s",
        " 1=!#S?",
        "$2rO$e",
        "mV8s^<",
        "hem vracen",
        "I.HB8",
        ")ttj}",
        "&>=34F",
        "D1.Z;A",
        "kK8y|",
        "bgmKe",
        "@SK_N",
        "OgIT;",
        "`*8y3t",
        "Eyq[B",
        "7H[Y?d?\\",
        "/rqwgR",
        "U:M_M",
        "ju vai datu nes",
        "Gt0mX",
        "97:@q",
        "<R6D4",
        "i/sau utilizatorul trebuie s",
        "Rb2y?",
        "(-/g(",
        "Sc<!T",
        "<KFjPsDQQW",
        "ana. Minimalna je podr",
        "en, og pr",
        "H.&IB",
        "0f0O0`0U0D0",
        "4WXD&",
        "Pgrvm",
        ")`]Td",
        "1qCL|",
        "fpvrmNgB $C",
        "Y6R0R",
        "9RN!C",
        " megpr",
        ">$>D>L>T>`>",
        "qyc=6",
        "|dm>#d",
        "V0Gn4:",
        "e(5oIx",
        "a instala",
        "u#`!m@1P",
        "}lyT=+",
        "&28Ev",
        " jour ni ",
        "cich in",
        "dH{=b",
        "(y)3N",
        "&$EEA",
        "U4vW7",
        "o\".nhE",
        "y&]z2G",
        "i in po",
        "HL_+*",
        "ranka negali b",
        "X6]&u",
        "p{xmz",
        "aDRPF",
        "DoY/[4",
        "I>{6A",
        "ALs?\\Iw",
        "wN\"9v",
        "qEUg3}cgG",
        "[*d**",
        "D3 n#",
        "|7'aI",
        "d[)De",
        "tN=0J",
        "0D6F]",
        "9v6~O",
        ":<R&u",
        "2TT^v[",
        "/ExpressPackage",
        "bED2+c",
        "metros: Enable; Disable ",
        ">$>R>~>",
        " Disable g",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z",
        ">px493yW",
        "*7?#pGq",
        "Q>\"lB9:?",
        "w47~s",
        "pc)[,JDY",
        "6|JX%",
        "i;pn$a$",
        "C{v#`(",
        "(i5!i",
        "GetFileSizeEx",
        "|dusK",
        "9 /z()^\"",
        "Ho$GO",
        "-8P,-",
        ":,&\" ",
        "MXEzw",
        "q/]@u",
        "vR.`kq",
        "v2V.c",
        ": / copylogs <location> ",
        "ZSmZ#iH",
        "er i tilf",
        "`T]f-tm+I",
        "SQc?G",
        "]MBF*f",
        "cznika nale",
        "E?WZ{^",
        "v;4(gQh",
        "9#492Fbp",
        ":U)-t)",
        "(H}h=34-",
        "4*>d!?",
        "Pm!T>",
        "m*|^o",
        "#;x9#",
        "gebbi verzi",
        "/hm Aoc$z",
        "Ajt2{",
        "pkEQ}I",
        "!gXV]_",
        "vW]%~g;",
        "W3@ mL",
        "8O6;bL",
        "BHTYd&q",
        ":7\\=7",
        "ZLgVT",
        "C$B/CQkhA",
        "3%424d4",
        "KvOKc}",
        ";Z*l)",
        "Vj?D9}a",
        "2E[Id[9G?S",
        "QPSVW",
        " informace",
        "78KPp",
        "Mc/:N",
        "I.jA^P*",
        "x\"M[[i",
        "x.y7i",
        "0jJ^B%",
        "Lwiec",
        "CoUninitialize",
        "\"bAd$",
        "!CTp8",
        "a;Y+G",
        ";zb5Lu",
        "tnGfJ",
        "k)U\\X ",
        "l*=\"$_",
        "vP1?D1Q",
        "LXlS%",
        "Przygotowywanie (%d%%)",
        "CDlpFile::UpdateProgress",
        "J-FER",
        "nd. Den k",
        "0(?aV",
        "ksytty, tervetuloa-ohjelma ohitetaan, pikapalautus p",
        "M}E*nE",
        "d}R19",
        "ConstructPartialMsgVW",
        "f?ex@",
        ";5Zow?",
        "c}eY_",
        "LBG!s",
        "92:9:",
        "d!EXD",
        "is>}(",
        "OD\"Zz",
        "QueryDosDeviceW",
        "wVD$h",
        "t8jB=Q-:_",
        "=aa\\O",
        "_%ENf",
        "`lnx8Mp",
        ";\";0;T;e;",
        "o : Injeta o ficheiro setupcomplete.cmd a partir da localiza",
        "KIMFR",
        "3)3y3",
        "!pQi6H",
        ":r&i[r",
        "m$Ee\\",
        "HKEY_USERS",
        "8NG#*",
        "tbdB6<Y",
        "[=='y",
        "Zc>/o",
        ",=T5l",
        "Vt%}w",
        "RHr`'p",
        "wuOEfV",
        "CDlpTask::Execute",
        "I Vht",
        "puj.YPy",
        ".CRT$XLZ",
        "|cr\"*Y",
        ":A5%Qe",
        "UjMSw",
        "f;?bf",
        "`J}gp",
        "liti: / Postoobe <asukoht>\\setupcomplete.cmd ",
        "rio de utiliza",
        "Clean ",
        "njem operacijskem sistemu. Name",
        "tKzOn",
        ":tpO ",
        "Forberedelse",
        "Ki|Qs",
        "\\g;J~",
        "89dQ@Z",
        "43HGf",
        "sqg<k",
        " \"None\", ",
        "#h-Fr",
        "linett",
        "k>!ul+}",
        "NHd%]H<",
        "#tvK>O",
        "#yu6+",
        "CDlpManager::GetQuadwordPropertyCount",
        "iXs8m",
        "4C&_A",
        "0T0Dx",
        "Ga3dPI",
        "e OS zadaci niskog nivoa. Slede",
        "J6}~|",
        "3jV2%>z)",
        "o]p|2.nu)1",
        "l9me#@",
        "windlp.state.xml",
        "Sxe_N",
        "*8JG/7;Nc ",
        "@'-Xd",
        "}< Ck",
        "E&dasivSetup.exe installib v",
        "n85>_|.",
        "\"8|B/",
        "+UO_9",
        "EqN;!",
        "g8vfB",
        "zi+w$g_",
        "0)Vu#",
        "(lc6R.G",
        "#UdGhm{",
        "jl\\setupcomplete.cmd",
        "&wLR3",
        "kleme dosyalar",
        "        loadFrom=\"%systemroot%\\system32\\textinputframework.dll\"",
        "Lh!I3",
        "g^uBk3",
        "htekaust sisaldab faili pid.txt. ",
        "~qdgl",
        ";ZI`I",
        " namestite ali nadgradite sistem Windows. ",
        "7\"IOvo",
        " su nurodytu produkto kodu. ",
        "rBUJI",
        "e datoteku setupcomplete.cmd s navedene lokacije. Setupcomplete.cmd je prilago",
        "5REL'|",
        "cM9+C]?m=y",
        "(M,B$",
        "9s+yE'lS<",
        "`|;7`",
        "v:xc>",
        "Jn=9`+)",
        "CK)}F",
        "qT>9G",
        "K-.G~",
        "f]wEd_",
        " en production. ",
        "DC*Uf",
        "*@j:cF>",
        "F+Kl1",
        ":-Re4`K7",
        "1eg8E",
        "l PBR. A kdy",
        "R}'1M",
        "4?X-|",
        "G},lH",
        " lLm;",
        "        name=\"ucrtbase.dll\"",
        "F,(rJ",
        "+@ZO*!",
        "-,MOJ",
        "&,V/sWOo",
        "U?4%8",
        "_o&,j',Z",
        "\\JCg#",
        "^H)[B",
        "Toiminto: kun valitsimen / migratealldrivers asetus on All, asennusohjelma yritt",
        "MizQ:",
        "v`,gI",
        "- Windows 7 Enterprise ",
        " 25 tecken ",
        "TW'45",
        "'4h @%",
        "D9_KY(",
        "6ekF|O",
        "`|iF0",
        "i,Q|CqM",
        "Yc+D}",
        "^;)t`",
        "[y}^H",
        "l)t?D=s",
        "Ihu+>{",
        "(h+|o",
        "SO5@q",
        "=,TsO",
        "al8Kb",
        "f$G}2L[[",
        "m;N~'",
        ": gs?",
        "&Vorige",
        "b.d2J",
        "Yasal",
        "N'-2i",
        "t?s8(",
        "010>0\\0v0",
        "d<i$8?",
        "Kr3Wf+g",
        "db/fS",
        "c5e^]",
        "Example : setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "U~`$gy",
        "'b}*,",
        "x7&`H",
        "\"xwVM",
        "Cg@g@",
        "Ri:ID",
        "u2Xd ",
        "VyFOyF",
        ">I[wt",
        "+a)Dk",
        "kleme diskini kullan",
        "Primer: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "Compatibiliteit controleren",
        "w7|Z]",
        ",Bk'[P",
        "xQzrw",
        "Alusta algusest",
        "<khh&",
        "7>*Mz",
        "Commutateur : / installfrom <emplacement> ",
        "Q`@!q",
        "/PostReboot",
        "9TI)_",
        "X9?nZ",
        "/CC,J",
        "AdjustWindowRectEx",
        "0!b<n",
        "W@KfbU ",
        "|Vm>%;9O",
        "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        \"> <rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"> <rdf:Description rdf:about=\"\" xmlns:xmpMM=\"http://ns.adobe.com/xap/1.0/mm/\" xmlns:stRef=\"http://ns.adobe.com/xap/1.0/sType/ResourceRef#\" xmlns:xmp=\"http://ns.adobe.com/xap/1.0/\" xmpMM:OriginalDocumentID=\"xmp.did:D90530087960E411BA60B7344D705471\" xmpMM:DocumentID=\"xmp.did:44B314C4700111E48C41F3D2216F3807\" xmpMM:InstanceID=\"xmp.iid:44B314C3700111E48C41F3D2216F3807\" xmp:CreatorTool=\"Adobe Photoshop CS6 (Windows)\"> <xmpMM:DerivedFrom stRef:instanceID=\"xmp.iid:977B7B345161E4118595B3E1319A734E\" stRef:documentID=\"xmp.did:D90530087960E411BA60B7344D705471\"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end=\"r\"?>",
        ".}/DF",
        "anu, jo tr",
        ",(L/{",
        "=%c4UU(",
        "$8&If",
        "6r\"n'",
        "AD}jl",
        "FD^4d",
        "\"2<g]",
        "Az!7\\",
        "QjJFj",
        "xOBV,",
        "5e-Y[",
        "<&~Bm",
        "vne preh",
        "Z9Pwj",
        "%hlK*",
        "X>T.&",
        "0Y[|g",
        "WU]]]U",
        "HQ-h?",
        "tres par d",
        "C%1<m[",
        "]VY]bB/t",
        "19D>!",
        "iPQeTA",
        "O+qO-Q",
        "5tqr~",
        ":E_H}",
        "_ftol2",
        "Ae/gPW2",
        "aUcAVzo",
        "16_*!_",
        "grb;v",
        "maD$}",
        "Z/%J.",
        "za`Leh#",
        "d(I.>2:",
        "CE~kD",
        "h\\Kx8",
        "_Q+r'",
        "<a7o f}&",
        "ivatel mus",
        "<[Y`;",
        "xh-ZA",
        "WdsSetupLogDestroy",
        "xel: / Postoobe <s",
        "4`d4`",
        "T<&Ou_(",
        ". Setupcomplete.cmd este un script particularizat care efectueaz",
        "mIZX]v",
        "```@@@@@@```",
        "s}Fw\\",
        "M/`@S",
        "p2hcU",
        "p]9=D",
        "uje da li ",
        "kClNS",
        "ine fi",
        "HM2Y.",
        " `B}7",
        "[}]8N",
        "1NlajA`%",
        "FindResourceW",
        "SR}2)|",
        "i@H(_",
        "U4y9?",
        "gaEAAAA",
        "84l?M",
        "dvendig n",
        "o_YSR",
        "iant laikmen",
        "nje namestitve9Namestitveni program ne more zagnati datoteke Install.exe",
        " jnGn8L",
        "msxde",
        "MYlfe",
        "vB7!A",
        "[`NRN",
        "7B?t%=7z",
        "%L$ptk`M",
        "~,4n~t",
        "U5~^)-",
        "=fPtw",
        "H\"-fU",
        "f},,c;]9t",
        "Ns#d-",
        "#zB(PL",
        "bg0jl",
        "Parametreler : Enable; Disable ",
        "ChRWT",
        "T=R}Tq",
        "BWWuc",
        "rmbillederne vises som standard, men er automatiserede. Denne parameter benytter ogs",
        "222>2",
        "XRoT &",
        "finis sur leurs param",
        "]r#q{",
        "cutez la commande setup.exe /? dans le r",
        "\"<=MIn",
        "Mq[~d",
        "Rw\\#H",
        "4k~<j_",
        "S6d#6f!'",
        "rskendab v",
        "JT#90",
        "'@Oo+",
        "w:mG-",
        "aNJbe",
        ";mj={S",
        "dwZLw:X",
        "$0'?V",
        "Cc04?5",
        "\"@~M:",
        "Comutator: / PBRUpdate <parametru> ",
        "M['gQ",
        "31tYKh`p",
        "R36Bjl",
        "r*kZ^v%",
        ")Po5[",
        "(ux|j;",
        "vRx`<qC",
        "O5WmQ",
        "L87I6",
        "pYm>L",
        "\"IMfv",
        "Vd?b;",
        "?1KUz]",
        "[vv~~/",
        "mE.*/^f",
        "Primer: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "50yW3",
        "EventUnregister",
        "tte / PBRUpdate v",
        "<Qa(&",
        "Sv5X2?",
        "hqi@Q",
        "r#Fqs",
        "rg9d-\"",
        "jen``",
        "KR0._",
        "1A2H2s2z2",
        "e do faze prvog postavljanja mo",
        "S5^\\?",
        "V<pC=G",
        "]Q Am",
        "Y*2;v3",
        "avanje zadataka nakon neuspe",
        "b~\\g=Q",
        " ejecutando una versi",
        "Gfd|8#qUFwq",
        "@\\H`D",
        "e>Y-N",
        "V6]GG",
        "(HjQcl",
        "acak.Z",
        "T^Gxd",
        "@wU?0",
        "=U(w`",
        "(XZ33g",
        "O8Lprr2",
        " de instalarea e",
        "L$$QP",
        "ico orodja. Poskusite znova zagnati orodje in izberite pravo arhitekturo.6Pri zagonu namestitvenega programa je pri",
        "ba: Ja / showoobe ir iestat",
        "8]Q]f",
        "@?%`l~",
        "$`2j)",
        "Perjungimas: / Postrollback <vieta> ",
        "_xbBh",
        "=MD62",
        "viD9_",
        "ke u instalaciji pokrene skriptu setuprollback.cmd : ",
        "\\/Xa6",
        "3%-`\"",
        "K^Kwi",
        "E/Z>mIh",
        "dY3Ky",
        "s lietot",
        "%XrF+U",
        "//uX\\",
        "N!ey4qa",
        "Goj,o",
        "R%0vV",
        "        name=\"wintypes.dll\"",
        "g[h'fd",
        "WdUms",
        "NMTOKENS",
        "=q(4g",
        "U<{Gv",
        "FePYT",
        "'Qn?K",
        "z:oF@",
        "b+y@~",
        "8*8X8f8x8",
        "s^{b^",
        "h,U72",
        "Akcja: Gdy prze",
        "g;sSE",
        "igus ",
        "I_Pj{'sM",
        "<`Yd7",
        "h@+%6U",
        "2`Sp4",
        "#<}sf",
        "FqTx&",
        "terek: A setuprollback.cmd f",
        "me1$F",
        "&W1ANx/@",
        "xprFh",
        "y^&0dAc",
        "4+4f4",
        "*\"bRRU Ej",
        "h>Ri#",
        " automaticky restartovat, kdy",
        "o: / PBRUpdate <par",
        "7:!?J",
        ":mQ7O}",
        "mclArL",
        "axmhV",
        "ena skripta koja provodi zadatke kada instalacija ne uspije pa se PC vrati na svoje prija",
        "njo prvega zagona. ",
        "no pro",
        "mmer inte med din dator",
        "*AP|*X",
        "(Setup is unable to determine UI language",
        "C]C_,",
        "faut suivantes : accepter le CLUF, activer la mise ",
        "}{@Tu",
        "I,clM",
        "1 1'1w2W4r4",
        "< 8Wl",
        "ipojen",
        "n'(Oe",
        "V}^\"E",
        "rke korral testarvutitest logisid ja muud diagnostikateavet. J",
        "Sj+fL9",
        "@@@```R",
        "hH}U>b",
        "zLLV&",
        "\"(m|e",
        "p8r4~",
        "?-8m>",
        "e ustali",
        "Parametri: Full; None ",
        "(A2M(X-",
        "EAgU\\",
        "n0`D\\",
        "&ptal",
        "urare, dar sunt automatizate. Acest comutator presupune, de asemenea, urm",
        "=g6q.",
        "KwzO|qco",
        "'3^m-",
        "ss{tL",
        "v:'n!!a",
        "4C1eY",
        "0$000T0\\0d0l0t0|0",
        "m3[ky",
        "]F/7\\",
        "~si.t",
        " +XB'",
        "*5Obt4",
        ")\\BFr",
        "inverse, si / PBRUpdate est d",
        "]Intenta volver a ejecutar el programa de instalaci",
        "xel: / installfrom <s",
        "KJ'Q#",
        "IO@ZK_",
        "j#i,<",
        ";jT{5",
        " ey-R[",
        ":G=Kz",
        "4{hi7JM'9",
        "?DE7~;",
        "bih7`",
        "Zi`I=",
        "Z'.w)",
        "B})\\J",
        "oBpnE",
        "%tTx;",
        "teni szeretn",
        "H;5m5",
        "kviesti scenarij",
        "hem instalace dokon",
        "}{Hd4",
        "EFcqW",
        "#RdXMS",
        "H[z`78",
        " Windows 10.",
        ", joka sis",
        "HKEY_LOCAL_MACHINE",
        "B>: N",
        "rOeq}",
        ".?AVCAtlException@ATL@@",
        "9g>lYvq",
        "NzH'>",
        "5N/yIN",
        "\"x|Ln",
        ":hdm#",
        "a v kontexte syst",
        "        name=\"coreuicomponents.dll\"",
        "1J2kW",
        "ubS_l",
        "ches de syst",
        "S^iV~B",
        "6N!M<&",
        "sMxG;\\&",
        "ben fut, ",
        ">:=[p",
        ",N{,/",
        "f\\gn*",
        "6)606C6L6V6g6{6",
        "e i postavljaju se podrazumevane postavke za komponente. ",
        " reiniciada automaticamente.2N",
        "*<VRU",
        "y`D>@",
        " #-7@[p",
        "dAzB_8",
        "y/8DK\"Z=",
        "v!PBV",
        "-9hR0I",
        "n intentar",
        "Y9=^',",
        "7&7-7^7~7",
        ":raP5",
        "1WSB>j",
        ">MTg@",
        "3 3N3^3d3v3|3",
        "oA{b,n",
        "'i]2V",
        "Nep{+g",
        "Lsf4*=",
        "7VaZn",
        "1)NH&l",
        "c_AKG",
        "iz?+P_",
        "%|I~\\7q",
        "&:\\rt5",
        "wbIfg",
        "mF~bVn.",
        "UId9{z?",
        "M|*ks",
        "SM60@",
        "%%\"wD",
        "uTbLl",
        "080A04B0",
        "BSDz3y",
        "*O'~dK",
        "/j25C",
        "=W4m7;",
        "PpYXX`cc",
        "Searching for ESD files...",
        "Wz8XJ",
        "LUhsI",
        "GetCurrentThread",
        "@&o2j8",
        "Pna-(",
        ".data$brc",
        "Toiming: esitab installiprogrammile m",
        ";1\\Fh",
        "9,~r2",
        "5FqRl",
        "mfv3G",
        " informacij, odprite storitev Windows Update v aplikaciji Nastavitve.",
        "Fq8&2 l|",
        "J.#%hqF4-",
        "O3bu?",
        "f)b@G",
        "rYvg_",
        "D$(PQ",
        ">J|=~",
        "CDlpTask::ExecutePrepare",
        ",D,i@,y",
        "Y$17<",
        "1_G^p",
        "5Bx o",
        "deeFDFFFFFFf",
        "e)lh@",
        "r.:E ",
        "UzjH8I",
        "Lv&rYj",
        "y]Qg~",
        "telek elfogad",
        ";;\\M_VV",
        "y)\"oW",
        "Action : Setup will inject all driver.infs found in the specified location during the installation process.Setup will recursively search through all the subfolders of the specified location. ",
        ")&@d\"",
        "aeO_&",
        "9CyfRQ",
        "+{-|t",
        "qR_T/",
        "d^d,w",
        "        loadFrom=\"%systemroot%\\system32\\wow64.dll\"",
        ">$?>?K?s?",
        "`C;?UN",
        "LvS-P",
        "Pripravuje sa",
        "Pq'%T\\",
        "t7=@O",
        "DcatR",
        "B)3y(",
        "Esempio: setup.exe / auto upgrade / Telemetry enable",
        ".fjDw",
        "[yM'pW2m",
        "o6.%F",
        "GetCommandLineW",
        "LU5E@",
        "tter n",
        "2x/!2'",
        "9dBg=",
        "moo/..~j",
        "o. Se / Telemetry for definido como Disable, o programa de configura",
        "PVbF'",
        "bO3'7",
        "!M N$",
        "Comutator: / Postrollback <loca",
        "J[?'h",
        "idc71",
        "l~\\%va",
        "#Ao2,R?",
        "gxq\\K",
        "]+Sa0",
        "lhvJ5",
        "\"BO4t!",
        ";@@Wuu",
        "Aww&8",
        "StateMatch: Current mode is Finalize - attempting to resume...",
        "Ef0oFp>~",
        "'L0;]",
        "righeter. ",
        "YA!_@[",
        "ceQBf",
        "t8j:r",
        "como Enable, a instala",
        "CDlpFile::GetState",
        "4PFQL",
        "{<nLL",
        "M<N[R",
        "T)|u-",
        "\"JsE]",
        "b?cs8",
        "KQT3Kbu",
        "P7vH7",
        "v@K>T",
        "*.FNY",
        "#PE87",
        "&XK('",
        "qt$n?",
        "\"oW'E",
        ",G\\&]M",
        ":DO&s",
        "33,-}",
        "5xa`+",
        ". O actualizare de caracteristici ar putea fi ",
        "s*I;m",
        "GBK/J",
        "1pg}Sf",
        "SYSTEM\\Setup",
        "Ad\"Hg>hv7",
        "-l,Etd",
        "6s;ur",
        "'{BOdl",
        "/OK$`",
        ")/fh5s",
        "bn:<g",
        "~G%u<",
        "%a<_a",
        "r19u7J",
        "Ru bg",
        "{Qb|7",
        "SOU=U]]",
        "/Package",
        "Windows 10 installiprogramm ei v",
        "HKw7H",
        "c{pY/$",
        "ho opera",
        "V\\cwK",
        "%s: Clearing Install mode...",
        "nr?s%",
        "j+u#]",
        "}O,H=;",
        "L'.}).",
        "]2YWm",
        "{W2%!",
        "8b\\ _\\",
        "Parameter: / DynamicUpdate <parameter> ",
        "b?v:<",
        "0Hvzlm@",
        "w=b^6",
        "K'A_\"",
        " qmK^",
        ">y%11",
        "?+xz?",
        "qpJ_0",
        "i3Dfd",
        "1J9L0",
        "lich Rollback-UX. ",
        "ky do zadan",
        "xz_n1",
        "~F/gT3",
        "rK~|f",
        "Toiming: vaikne t",
        "|aCr~*",
        "yla ayn",
        "        loadFrom=\"%systemroot%\\system32\\wow64win.dll\"",
        "*kx_^",
        "22~5F",
        "ix0fE",
        "w>%fS^Yq",
        "bp[=w",
        "9'919T9o9",
        "t :'*chW",
        "10.0.19041.572",
        "outil. Essayez d",
        "hU>:R}",
        "Ewb{>e)",
        ". A kdy",
        "Ag{RU",
        "W^2W{xT",
        ".VMuA",
        "<Iz*$",
        "DG:F7",
        " Y`<C",
        "Registering [%s] working directory for disk cleanup",
        "Avisos legales",
        "}Dpq_x",
        "Esimerkki: setup.exe / auto upgrade",
        "M1f,4:",
        "            <supportedOS Id=\"{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}\"/>",
        "Q50h`",
        "*T(6!F",
        "3f&$&%",
        "$/qzEU",
        "o que indica %s bits. Quando voc",
        "B-Xxwa",
        " z navedene lokacije. Datoteka ",
        "WBhBN",
        "1ml2^",
        " neprob",
        " finalizeze interactiv OOBE. Alternativ, c",
        "hrt wird, m",
        "Prebacivanje: / noreboot ",
        "Ixkpd1l",
        "PwzJL",
        "SEbb*",
        " pri inov",
        "8m8}8",
        "kGY\"-",
        "Y:|`F",
        "G2'bf",
        "V9Fn]",
        "}1`eB",
        "N1%NsH",
        "*^|3lj ",
        "nssnittet och f",
        "CharUpperW",
        "None, a",
        " rozhranie in",
        "3Eq5A0",
        "B;/eG}",
        "nJoe4<,5",
        "h8'Na",
        "90L0R0",
        "+^F5Z",
        "Tr=s\"",
        "|. zV'",
        "kgL)b",
        "2.JL!'eN",
        "xel: / quiet ",
        "vH;ZTP",
        "xhF/.c",
        "^S~(g",
        "YWm'+",
        "Dejanje: namestitveni program ne bo samodejno znova zagnal ra",
        "lgende kommandolinje kan bruges til at igangs",
        "vania in",
        "X`]H?",
        "&{3(Yk",
        "6n0R`",
        "iuni de actualizare dinamic",
        "l^`(B",
        "@M9s7",
        "o reiniciar",
        "/i*NR",
        "ype:_ut",
        " cesta UNC k souboru s n",
        "L^;%z",
        "DZHqC",
        "\"4:jA%",
        "k7v|~",
        "Switch: / DynamicUpdate <parameter> ",
        "uc<Ty",
        "+\"VSG",
        "c6G\"=",
        "u{&MB*R",
        "y@~&}",
        ";7Pw>?",
        "#Ux?}",
        "*]6LM",
        "b.Qx}",
        " na hodnotu Full, koncov",
        "< =R=",
        "2SA+6@",
        "Handling: Installationsprogrammet inds",
        "@>U5xX",
        "J78 O",
        ".?AVCWinThread@@",
        "anja instalacije sustava Windows",
        "kf0s-",
        "F@\\'@",
        "&->z/",
        "\"XvK8(mv",
        "_3v2J",
        "UL?\"E",
        "hren, die Benutzerberechtigungen erfordern. ",
        ">Vck!p$",
        "nek vissza",
        "z|xd{",
        "qgHf-",
        "d;y :>",
        "6AZZ~V",
        "rz_]y",
        "dfjSA",
        "{ Dp*",
        "/h0a,",
        "=_Zup",
        "Comprobar compatibilidad",
        "Z2y$'!S",
        "wCkzPm`",
        "0g0Y0",
        "t~J=/",
        "6~6|S#g",
        "Ni/[LX",
        "(9p?j",
        "                                                        ",
        "v&Y{{",
        "js6&Ob",
        "ba: klusais karodzi",
        "J%VV|",
        "BGB8UP",
        "])p^&",
        "XN=+HWJ",
        "hS^?i",
        "6Z8i8",
        "{wMQt",
        "sp@Zd",
        "su datoram",
        "&Baigti",
        "/ha75",
        "|2~kn",
        "sq?1jq07",
        "+),TX^a",
        "N*aiO",
        ": setup.exe / auto upgrade DynamicUpdate disable",
        "5JUjX",
        "/Mk{dt",
        "1+KZ:",
        "#b]B>",
        "YZcgC",
        ")~&*T",
        "(Out Of Box Experience). Met de volgende opdrachtregel kan de volledige upgrade naar",
        "0|xb}",
        "~|{Zm",
        ":~,C\"C",
        "[Tw.-",
        "000@@@ppp",
        "(8.Ek;",
        "Q\\L+z2",
        "Cance&l",
        "unarom. Na primer, ako ra",
        "Qg<Rg",
        "cT;9N",
        "+oUGf[9s",
        "a,}P}zY",
        "? 0(8$4,\\",
        "t#=I?",
        "0#1e1",
        "Lietojuma scen",
        "0Z,-W",
        "/PG?~",
        "5$5f5p5",
        "jU7H_M",
        "TargetFullPath",
        "it?(Jste p",
        "\\-1G'",
        "-cAp*",
        ":]@=P",
        "=Cb[o",
        "yULMi",
        "M|b)s",
        " colecteze jurnale sau alte informa",
        "-`%Ym",
        "_UbOm",
        " ubv,wT]=",
        " EULA, ",
        "pad zlyhania. Nasleduj",
        "to verziu Windowsu 10, nebudete sa m",
        "8i#XF",
        "eq/4?",
        "|Px^\"m",
        "<b9V#",
        "]:^>.",
        "VersionMatch: Source exe build version is: %s",
        "HpJ#L",
        "1?1O1V1I2e2l2",
        "\\Pk'5j",
        "sben megjelennek, de nem automatiz",
        "Zkontrolovat kompatibilitu",
        "0O1V1g1n1{1",
        "<(P~]",
        "^.uEe",
        "Kj7Jc",
        "'A Windows 10 telep",
        "nhk!uNRz",
        " znova a vybra",
        "zs3?eq6",
        "$Kd$'",
        "1-2C2",
        "ar>3L",
        ")c<ac%",
        "  DU.dll",
        "4ze^nU\\",
        "&\\Wye5",
        "tirecek veya olu",
        "ciu zdrojov",
        "W^o$^6",
        "ia PBR. Din contr",
        " .sLO/r",
        "SJ}\"]L",
        " ir j",
        "Pzq%f|",
        "JSi ,^",
        "=f|Xr",
        "n contextul de sistem, de aceea poate s",
        "5~9c#",
        "W\"*wa",
        "E'(0;G",
        "i]m2y",
        "jIw*\\",
        "m prost",
        "cP6W)",
        "G+}/9",
        "o deve ser usada em produ",
        "Lno-f",
        "_~\\l[",
        "_a0O0`0U0D0",
        "Aktion: Stellt den angegebenen Product Key f",
        ";\\AcP",
        "letek",
        "kjq-X",
        "Xh g6(\"",
        "E~.{=",
        "&MT[<",
        "r9W?s(v",
        "Z^rV)",
        ";u<\\xT",
        "N.u#!o",
        "DzRS~v@",
        "BXY$a",
        "p&x+kmG",
        "ejecutar",
        "Es3Z_",
        "9<LDz",
        "e+bKP",
        "S]0F]",
        "Example : setup.exe / auto upgrade / Telemetry enable",
        "PL!mV ",
        "7~q6Q",
        "S~Bk&",
        "n cazul unei defec",
        "s9U-QE",
        "mu programu zadan",
        "xfj3'",
        "85p~_",
        "~k&,I",
        "Primeri uporabe ",
        "_g09u",
        ". Setuprollback.cmd este un script particularizat care efectueaz",
        "o?k_e<e",
        "~?q|{",
        "MIK[X",
        "onecore\\base\\ntsetup\\lib\\setupduhelp\\src\\setupduhelp.cpp",
        "rs: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "HvKu,",
        "4:cYj",
        "a;;ncW",
        "EQikQv",
        "$wdQm",
        "d_5M6^",
        "&BL B<B",
        "VW$JY",
        ";CXY5e",
        "yvV-3",
        "8j-T<",
        "WM$rD",
        "[?cq}'",
        " uz failu setuprollback.cmd ",
        "C6Ws[",
        "Va^Y>x",
        "555;5M5Z5`5g5y5",
        "`_Yl=",
        "UL6dL",
        "}{\"%,",
        "XP+bhn",
        "YeMKr",
        "Kompatibilnost",
        "B \"oe",
        " OOBE)",
        "MB]O3@",
        "7@s)P",
        " Disable uppdateras eller skapas inte PBR-partitionen ",
        "c<er/D",
        "Svpv66",
        "Switch: / Postrollback <locatie> ",
        "sZNIv",
        "F1lA]",
        "Ai)H;x",
        "T'?n+",
        "mP>tz",
        "2?rxv",
        " in the root directory of your installation media.",
        "z*u.\"",
        "wDDgi",
        "bed\\|2",
        ";#)pT{",
        "Qvz+I|",
        "IN04y",
        "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7",
        "cz~Bd",
        "7B`%I",
        "W7hp]",
        "n no recopilar",
        "(MbMd",
        "8.8@8`8r8",
        "TpO;O",
        "Windows Kurulumu, eksik y",
        "ppkasutaja OOBE interaktiivselt l",
        "9@\"g9K",
        "|Da$o",
        "o#19fi7+;",
        "N`!6F",
        "N~/_W.",
        "B[W#$",
        "$c!sby,$-",
        "#8 \"m",
        "GT2_R",
        "{/~$Y",
        "htSXU",
        "uGRj/S",
        "5d)3 zu",
        "&Zavr",
        "0F +C%",
        "zn[+~",
        "]7`-Ip",
        "!robV7",
        "sr-Cyrl-CS",
        "GetCurrentProcessId",
        "utilisateur final doit compl",
        "YQD{Y",
        "oS!h'ug",
        "_TN%v",
        "vS-,_",
        "g:@zah",
        "Z3Zbo",
        "v`G~V",
        "W'`i]",
        "2t.rm",
        ";y:#tI6",
        "1<ck8",
        "Ocorreu um problema na inicializa",
        "KB[6c",
        "ijMl|",
        " at du vil avslutte?!Klar til ",
        "50Ei[",
        "WaR,(",
        "2H_VZM",
        "oQ|\\&tUy",
        " sette i gang fullstendig oppgradering til Windows vNext, og krever inndata fra brukeren bare n",
        ":InQ'",
        "mNsc5",
        "V9V##",
        "6%7/7w7",
        "t0\\[(",
        "uE%OTZs%",
        "[52\">",
        ": / migratealldrivers <parameter> ",
        "G]8'0J/",
        "T;a.uS",
        "UYHC.",
        "dUFrJ",
        "j|FQ0",
        "NZruF",
        "+dP!'+'",
        "d#]XK",
        "\\{`(T",
        "?yq;,",
        "b3qO/",
        "in ge",
        "57,MxM",
        "b4g&{l",
        "vu%xK",
        "[(S7i)v",
        "uQ=t'",
        "DpVz|",
        "uk&w4",
        "rbereds ",
        ";#<3<?<W<n<~<",
        "*Fo<|",
        "8'n_{",
        "C}p%V",
        "IDk57",
        "/>.Fn",
        "rj}m,",
        "'(9Hi",
        " valitset oikean arkkitehtuurin.,Asennusohjelman k",
        "%&&b8",
        " um script personalizado para realizar tarefas depois da falha de instala",
        "XGx2X8",
        "fQul(EY",
        "R8,8[I",
        "~|&t&",
        "vka<=",
        "$Sjb_",
        "0Vo_'",
        "u;y\"N\\7m",
        "A\\K!Ne",
        "l_5vN",
        "F58$z",
        "!p4&MN",
        "`-94n9",
        "%>tB!",
        "d-`6*",
        "MainHr",
        "CreatePath: Unable to create [%s]; GLE = 0x%x",
        "l6((v",
        "lc=x'",
        "4;b-F",
        "Esempio: setup.exe / auto upgrade / quiet",
        " migrar todos los controladores como parte de la instalaci",
        "}nQ=?",
        "y*w|'g",
        "c}tj1",
        "\"j;K3",
        ": setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "0X%_F",
        "Q;asMr7",
        "ua!)#K^",
        "4,+}cy",
        "z]x_9",
        "'XtUx",
        "Example : setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        ">Sh;y",
        "ZBp\\j",
        "/xk5~",
        "nce bir yerel dizinden ba",
        "<ElsQE0",
        "7RNx2F",
        "]xTc.(P",
        "`u<!/",
        "DZ`tl",
        "Zm!6k",
        "6)Cul",
        "tverkss",
        "kv%\\y",
        "51&v@i",
        "jc[[GScwkG",
        " xa90",
        "G{y6(",
        "mica (procura, transfer",
        "Arkitekturen du valgte, samsvarer ikke med PC-en din. Hvis PC-en din f.eks. kj",
        "}v&t*",
        "uPRu}<",
        "E}H}L}",
        "Q5Y#{i",
        "k4 h3",
        "X%,:h",
        "ar-LB",
        ";);b;~;",
        "c(9#iDV9u",
        "`P+- ",
        "#aNmAW",
        "m instala",
        "Klarg",
        "lp3!1H",
        "4;E`V",
        "*;S^`",
        "Thales TSS ESN:D6BD-E3E7-16851%0#",
        "?R?v?",
        "H:*+A",
        "N62{P",
        "c7ZGD",
        "OkW*<",
        "gRVo/",
        "Ml!t4bF",
        "O^S)<b`",
        ".V)*j",
        "bT-UG",
        "@AS`/",
        "m tla",
        "c tam m",
        "FPFc%",
        "BAfsE'p",
        "^v0,w",
        "lLmNI",
        "si-LK",
        "Na/+e",
        "yX9Y-6s",
        "EUV{m",
        "$mObQx",
        "Qb02e",
        "h]lG:~",
        "mica est",
        "Anahtar: / Postoobe <konum>\\setupcomplete.cmd ",
        "#0nz:",
        "fini sur Enable, le programme d",
        "9;9U9b9",
        "elite prekiniti?2Ste pripravljeni za namestitev sistema Windows 10?",
        "WW+oh",
        "wW#}_",
        "p-bYP^N",
        " Windows 7 Enterprise. ",
        "s olettaa seuraavat oletusm",
        "<}U8p",
        "es de diagn",
        "Aloita alusta",
        "8~yHC",
        "PO5uLwN:i4)",
        "$*6Ce{",
        "Ka[}&",
        "s(JzI",
        ">MdSpu",
        "E1vP5n",
        ",gM3l",
        "&Tilbage",
        "SQ^aXN",
        "B:h.+",
        "\"l}m=lQ",
        "*P/I,%",
        ": / pkey <",
        "}7qA]",
        "l*ZX`9",
        "/_512",
        "p%]-6",
        "o\\\")~%jiG`",
        "dia no disco r",
        "SendCallbackMessage: [0x%X] -> user callback returned 0x%X",
        "^KUm_6",
        "K+e&}aD",
        "qaZl-",
        "nt. Ha a / migratealldrivers ",
        "/&}S1",
        "0L01YWeW0",
        "toarea linie de comand",
        "Egj,K",
        "x@f/f",
        "]L3P3",
        "-zOoIIx",
        " Windows 107",
        "^$~ =",
        "l\"`,Q",
        "?NKlE",
        "?6*_q",
        "nRSa<:",
        "20201008094712.797Z0",
        "JU}\\m",
        "?b!\\`",
        ".!D@-J;",
        "ye_:6S",
        "A<-oB",
        "D7Y.n",
        "ja izst",
        "aX0 d@",
        "i UNC-v",
        "vhbs7",
        " v6/>",
        "VQJ:q",
        "*fd893",
        "pJ;\\+",
        "f|$O`g",
        "V{z&N",
        "g\"oR9K",
        ">ekx!bu",
        "I ett annat scenario kanske en administrat",
        " se vy",
        "hbK.b",
        "_]$2_=O",
        "^h^l]",
        "O[g1v",
        " diegimo funkcijas",
        ">[a.-1",
        "hrl`EF`E",
        "mT>3a'",
        "W0f0D0",
        "-6ucx",
        "N9n\\oF",
        "Ug5XMV",
        "<#<8<Q<X<^<c<n<x<",
        ",l:YC",
        "[#NMc",
        "K^YAz",
        "p(k@^",
        "Qgm:K",
        "H6 9)<",
        "^PsIm-+",
        "Rf|pc",
        "s suglaudintus ",
        "YOQ|_",
        ",Z^Mjm",
        "|~t='",
        "cuiRQ",
        "1iipJ",
        "0^L]Fcz",
        "en-ZA",
        "~!L9w",
        "v<(-Q^",
        "-_6X ",
        "Ko=}/K",
        " experien",
        "rgmisi vaikekonfiguratsioone: EULA-ga n",
        "u'% Y",
        "|KT>\\",
        "N(CCP=Qn",
        "pa43M",
        "N5{L3% ",
        "Uxw%Z",
        "v'Wp.V9o",
        "NMZV<ie)ICs",
        "&Terminare",
        "wyPJ3}",
        "#$Z;YD",
        "velet: A csendes ",
        "e, option d",
        ")17|%",
        "Exemplu: setup.exe / auto upgrade / postoobe c: \\script\\setupcomplete.cmd",
        "7!4tF",
        "OOBE-fase van de computer: ",
        "d9g,Y",
        "u~$y\\",
        "J.Jee",
        "/{u%m",
        "+%a\"6",
        "dzis: / DynamicUpdate <parametrs> ",
        "C+P8Rj",
        ".P&SG'",
        " du bruke 64-bitersversjonen av verkt",
        "CDlpManager::SerializeSynchronous",
        "dn7VU&",
        "hIhn7_",
        "L? A]",
        "F\\C~(?",
        "!xbeE",
        "Valitsin: / PBRUpdate <parametri> ",
        ",iDvF",
        "R3Hb6",
        "LbJ)#",
        "080404B0",
        "S2}j$8",
        "Conmutador: / PBRUpdate <par",
        "rVSj0wUj",
        "'yPpJ",
        "^Yg.m",
        "Toiminto: asennusohjelma ei k",
        "L,Ie_",
        "040E04B0",
        "3KCE|=d",
        "4+);s$7",
        "Xf;K1-",
        "Qi:-P:",
        "|2T:i",
        "},Eb8",
        "ppdKF",
        "VFO-T",
        "t^pta",
        ">ptkg",
        "yG2ln",
        "?WI<m",
        "5pT.i",
        "e, prenese in namesti posodobitve). ",
        "n de configuraci",
        "yhO9Z",
        "n<o=;A/",
        "Be,-1",
        "Exemplu: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "h?VD,)",
        "0.zxM",
        "w.ZdFW6",
        "Ge:|a",
        "h<28;",
        "7H4Fl",
        "1}0fe+",
        "6P(~{",
        ";Y{&JyX",
        " yeniden ba",
        "TcgLE",
        "Gi\"_>'M6oX",
        "/0c1Z",
        "*%..i",
        "_K,xW]*",
        "Veiksmas: kai / PBRUpdate nustatytas kaip ",
        "7N{g!",
        "q_(Mn'{L",
        "z}YApl",
        "i gata s",
        "gLGdX",
        "ScreenToClient",
        "~Rr^F(j",
        "6\\X`28",
        "Q'lFP",
        "B+~~ZhH",
        "*YQpE",
        "Mtth-",
        ";pgp@P",
        "ft6{Z3.",
        "Tp'x\"",
        "r)0d-",
        "vPDh~",
        "}c tV",
        "CDlpTask::UpdateProgressTransfer",
        "QzN|f)",
        "'ln1h",
        "5_AK6",
        "nrJ/Q",
        "rsa, kurulum, y",
        "6M,+2",
        "nimo de vers",
        "f&fOSE",
        "*8t;B",
        "'(p,=",
        "GetKeyState",
        "ixS2g",
        "mn-Mong",
        "?l#An",
        "`,FrgB",
        "s nevienu draiveri k",
        "trPWQ",
        "krOV\\",
        "=356F",
        "PCxR}c",
        "m0MiQ^QJE<",
        "anas programmu v",
        "#0jB){",
        "\"oE>\\P",
        "&O\\'Z",
        "u1-#~",
        "U'C{>",
        "H{6@t",
        "mu programu pokyn ke spu",
        "Z_\\rt",
        "U>gI/b'",
        "_#Z0y",
        "'=o}5",
        "(Jm!%'n",
        "V*XV},Xu",
        "&rP_a",
        "DEBUG",
        "N#}[4",
        "rnek: setup.exe / auto y",
        "r Windows p",
        "5\\nvV",
        "Ajf):",
        "$L_gW",
        "/PQ},L",
        "w7fEF",
        "zi!m6",
        "E U T",
        "lda: setup.exe / auto upgrade / migratealldrivers none",
        "hUM4V",
        "7z+~jxPf",
        "xP=t~",
        "65zoi",
        "(VLDuR",
        "w<R`W",
        "Birka",
        "3=3&\"",
        "%yc1G9M",
        "6;z?;",
        "fd|s^B\"",
        "f3m41'",
        "pr#81",
        "#BL-4J5",
        "A;t@'",
        " al successivo riavvio del PC. ",
        "nin atlanmas",
        "ZF}~f2",
        "sSueg",
        "`)KdM",
        "im ra",
        "4DCUF",
        "Wz-+R",
        "4{vXv",
        "\\A;*|",
        "N6nhLca",
        "s;uc*",
        "Otkrili smo da se instalacija pokre",
        "<g>7EVQn",
        "Z[ {K8",
        "M sS8",
        "Oalz*",
        ",#MuV[",
        "LEb5V",
        "~d?d_",
        "+A=gW",
        ")I9JHcHs",
        "7sKzH.#W",
        "c-7?n",
        "`}=%6",
        "mjU'x",
        "ybg6f",
        "MbcXN{",
        " disk",
        "Skipping cleanup.",
        "ka do pliku specific.wim ",
        "Parameetrid: N/A ",
        "DR_2H",
        "*cpnJ",
        "I=1+y",
        "Jogi tudnival",
        "ivoTk[",
        "F$Pqaj",
        "4yL\\`B",
        "_ \"4+",
        "]w$,;",
        "~|7-3",
        "Parameetrid: 5x5 tootev",
        "%Nm8n",
        "R)U:,",
        "_^CQU",
        "T+TKy",
        "Qp3A3",
        "646<6H6h6p6x6",
        "^Cr<d",
        "Y4vgv",
        ".@^Xo",
        "lwbS9",
        "XtOC(",
        "        name=\"mfc42u.dll\"",
        "E^gHm",
        "da-DK",
        "=Yb2R",
        "/:9rj",
        "_1Y6'",
        ";(0(@",
        "4q3J{",
        "/+yuU2",
        "XtE:J(",
        "Bs=c&",
        "Ha<Ob",
        "F2uPB",
        "Upn{l",
        "*b}x0_T",
        "4zKFf",
        "=S9t2K",
        "FGnV8'",
        "Action : When / PBRUpdate is set to Enable, setup will update or create the PBR partition.Conversely, when / PBRUpdate is set to Disable, setup will not update or create the PBR partition ",
        "Switch : / Telemetry <parameter> ",
        " instalarea, cu op",
        "driver.inf",
        "IOfof",
        ";dPwhz",
        "<CXHg",
        "]*L!u",
        "`v3'`m",
        "rt, men f",
        "+[lH3",
        "xaShd",
        "9LGB3(oq1n",
        "Opravdu chcete skon",
        "tes-vous pr",
        "sE+|ze.t",
        "K[n\"a",
        "letek ",
        "Voorbeeld: setup.exe / auto upgrade / Telemetry enable",
        "Stikalo: / installdrivers <lokacija> ",
        "O\\zlZ",
        "R1Bgg",
        "#`+jz",
        "&L5`*",
        "th1uZ",
        "7JIT&)S",
        ")yDp0",
        "0O1i1",
        " Windows XP com Service Pack 3.",
        "SG2K|GVl",
        "F6QsE",
        "h~tx_",
        "s;uZe",
        "Action : / PBRUpdate Etkinle",
        ",i(,N",
        "@.}'Kfg",
        "=`,{{",
        "Parameetrid: .inf-faile sisaldava kausta kohalik failitee v",
        "uN[>K",
        "nCvGi,$",
        "n42Ev",
        "3>DI\\+",
        "ra en fullst",
        "jg-s@W",
        "AMF,o",
        "I9a!~n`p3 ",
        "QuAp|",
        "~w,$x",
        "{)E|;J",
        "{,)PZ",
        "Preparando %d%%",
        "(DiKj1",
        "Metadata",
        "D$(PSS",
        "u6Qn$C:",
        "]1fuk",
        "tan ba",
        "Gcx2IJW",
        "l;.;!",
        ",Dyo/Dy'",
        "5$5O5",
        ":@YU(L",
        "ORF>;F2r",
        "Hkt1H,",
        "7#Z$a@",
        "vv:W<",
        "cw3H}",
        "Ij$IR#I",
        "vgP\"s",
        "GvASk",
        "@ ;F uZ",
        "GL+Y]",
        "Parameters : Local file path or UNC network path to a file named setuprollback.cmd ",
        " de produit (Product Key) sp",
        "1n],s~:d",
        "y{Q%:",
        "~k(fk",
        "gZvRR",
        "S}#x}",
        "K5A^D",
        "$ot)H5",
        "*8nMaa",
        "?lf%Q",
        "f>Nk/ ",
        "utilisateur ou le processus qui a lanc",
        "(-mhNb",
        ">OZ-q",
        "mx.bp",
        "Voorbeeld: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "x6jC{",
        "las nakt",
        "b\"G'#",
        "^z#+Y",
        "J/&o'",
        "Pr\"J\\d",
        "Z5Kk6",
        "NTFzG3",
        "A*#iv",
        "Vn7Xf1",
        " / migratealldrivers nastaven",
        "%PJrg4",
        ": / migratealldrivers ",
        "to telemetriju. Tom",
        "^-yB5z",
        "Vielleicht m",
        "0jD,t",
        "+.v,;",
        "(0x?Whu",
        "3IoWP",
        "m o Windows 7 Enterprise. Ela n",
        "{B\"Z#g(",
        "46{W=",
        "\\:6hj",
        "gVO5h",
        "mgkEi",
        "S8_xv.",
        "b8d|?d",
        "hPlEW",
        "_r%W3",
        "fo-FO",
        "{~}^?",
        "kleme i",
        "8>o,1/",
        "d3M{,9",
        "324F4_4",
        "*Rgwr",
        "~C<lz$o",
        "09EX/",
        "=vI0t",
        "l m11",
        "\\[[cNn",
        "DGphO",
        "Z<V?=3o",
        "`-pRq",
        "Getting ready1Setup is unable to launch legacy setup experience%Setup is unable to launch Install.exe",
        "b0-LTr",
        "Przyk",
        "/Ac6+",
        "FI>M6>9",
        "pO}q]",
        "ZQz9#",
        "ARu|C`@L6",
        "u medija za koli",
        "ti vagy l",
        "O^R?#",
        "rZy%R",
        ")2|e8",
        "Perjungimas: / migratealldrivers <paramenter> ",
        "KXgl3",
        "0j,N;",
        "enie. Sk",
        "        loadFrom=\"%systemroot%\\system32\\bcryptprimitives.dll\"",
        "cmd.exe",
        "k0;bY0S0h0o0g0M0j0O0j0",
        ".idata",
        ".(p;R",
        "R>)ZK",
        "-W|&&",
        "rwG$GM V_U",
        "YKwWo ",
        "lye a m",
        "eE8dO",
        ")4?A7P",
        "K#N k",
        "Primjer : setup.exe / auto upgrade / noreboot",
        "Meiryo",
        "(N{lC",
        "3The architecture you selected doesn",
        "hJd,d7",
        "#|<cT",
        "BIGih",
        "b3^ql",
        "@uLvw~",
        "4|_sTT",
        "4>d8E",
        "informations, acc",
        "b:xhS",
        "B_f9d",
        "%9Nc{",
        "QB1cD",
        ";g<{<",
        ":wwa[",
        "oP\\mf",
        "es-NI",
        "cV M;apR",
        "V`rIb",
        "Jy2PQ",
        "rd@`Y",
        "Pc}f1",
        "+Kcc7",
        "-u.$ag",
        "|+@tL",
        "s diegimo sugeneruot",
        "K['8Ln",
        "C`Vfx",
        "OJD}D",
        "_/N>}m",
        "-5p)s",
        "9RH!mx",
        ")4=]_&",
        "&-q6%",
        "3^brD",
        "'dxq|",
        "t start properly. Please reboot your PC and try running Windows 10 Setup again.",
        "C\\u.{",
        "8V:w?",
        "_B.6q",
        "DY^cC`",
        "D]#:u",
        "las, lai lietot",
        "606c6",
        "5=j$^",
        "u=MJ_",
        "(~^U-",
        " sau face upgrade sistemului Windows. Urm",
        "XR!'k",
        "S?_&n",
        "Y-)4F\\N>Y#",
        "aduje jenom v okam",
        "^h()I!@",
        "IC|k<",
        "<G^)oC",
        "7ZtoVQ",
        "R48v^",
        ";|#-z`r(p",
        "ar-AE",
        "*Wou-",
        "je eilut",
        "2|P8x",
        "e=#:X?I",
        ":\\*,Y!,Y),q/",
        "Conmutador: / Postrollback <location> ",
        "MOyOQAz",
        "9++tW",
        "MFC42u.dll",
        "$6S=5",
        "(jk5)",
        "r X(Y",
        "H1:61",
        "Eewg`",
        "Z{+[z",
        "Z$FTF",
        "I|0N'1,",
        "}|,>cO",
        "c)`oUa",
        "FillRect",
        "hDp -y",
        "?6v&z",
        "_cqT\\",
        "O{n1|",
        "NdUua%9",
        "mY`QKA3",
        "xDLC6",
        "tres : chemin d",
        "}3y^NU",
        "U*h_l",
        "qXPd[",
        "@f]Cu",
        "^7O2i",
        "B\"Ha%(",
        "g: %1!s!",
        "^V}a>",
        "6VZdl",
        "UaWzt\\G",
        "' k)H",
        "DpA4$",
        "oLxD>",
        "Parameter: Ein lokaler Dateipfad oder UNC-Netzwerkpfad zu einer Datei mit dem Namen ",
        "aI7vS[Z",
        "UJp4>",
        "2&2-2H2R2^2e2n2",
        "D^Ue8",
        "1y^X*",
        "6ln':",
        "ra installationsprogrammet igen fr",
        "GjL4j-",
        "n para obtener m",
        "i\\SQT",
        "Azione: consente di inserire il file setuprollback.cmd dal percorso specificato. Setuprolback.cmd ",
        "g>mpJ",
        "<H*vj",
        ":MHE8",
        "9<I*r",
        "B+n \\",
        "8zb`AS",
        ";wC#D",
        " zbierane ani przekazywane. ",
        "f90u'",
        "NS'Mtj",
        "a[U%#",
        "sBY4Q-",
        "NBa!%e!",
        "ds inte. Den l",
        "KS5&U",
        "Mh~dR",
        "CDlpTask::RestartAction",
        "usgiH",
        "o est",
        "2hr7f",
        "{,WLR",
        "X(F8>",
        "uje sve potfascikle sa odre",
        "Comutator: / copylogs <loca",
        ")T T:B^i",
        "RSDSpvf/",
        "DeleteFileEx: Unable to get information on [%s]; GLE = 0x%x",
        "Kontroll",
        "#text",
        "tMegoszt",
        "%z/ct5A",
        "4?ne2",
        "0=o%J",
        " naujo paleiskite s",
        "fil-PH",
        "a2g.`",
        "#\"qNG",
        " a Windows Update na aplica",
        "Ol;AG",
        "Z^t6R",
        "Wit`Fl",
        "p$RG8",
        "      <security>",
        "4`d5`",
        "\\j0O0h0",
        "n*0KehV]",
        "k7ySUJ/",
        "z@XGd",
        "K!. 4",
        "jams, ir iest",
        "#uq.X",
        "*r&!g",
        "$ [Ri",
        "YBo\"LNI&L",
        "qrvrbI|",
        "q7R2 %",
        "ivitatakse s",
        "5xnO\"c#c",
        "1-/aZK|",
        "F7<vq",
        "59b}:",
        "yCI'\"( ",
        "_f*4L",
        "%spRw",
        "Cleanup",
        "Se#.1",
        "1~m}S",
        "WYzv}",
        "6xR!J",
        "?+ GJ",
        ")n#PS",
        "IsWindowVisible",
        "gtj.N",
        "utilisateur doit avoir des autorisations et des acc",
        " Windows, ",
        "H|]ZX",
        "M|#]S2",
        "F>;Jx",
        "LlS%X",
        "2hkn#",
        "/RO?f",
        "ja at",
        "|rQ]QK",
        "&rGONG",
        "Lejupiel",
        "g~S&4",
        "3Y[4E",
        "Hr!.M",
        "GhLu}u,",
        "&;^vg",
        "Deleting box result...",
        "ranka ",
        "FYp\\6",
        "Dh.4$",
        "(M2C?",
        "'zzg9z",
        "hrend der Installation generierte Telemetriedaten von",
        "^Rw$C",
        "ZK7*R<U",
        "@1e-6",
        "u1Sxb",
        "-R\"'}",
        "V}9{w",
        "/;sQq8",
        "Qd2UT$",
        "1 2H2p2",
        "=4=C=P=",
        "c*fUT",
        "huCu.",
        ";}3=m^",
        "sah-RU",
        "        name=\"userenv.dll\"",
        "Checking SetupHost result value...",
        "!@'w*",
        "A/+s:Ib8",
        "Zr;9I",
        "@sDC:<v,",
        "G)m++",
        "tNu+F",
        " / Telemetry",
        "]LO B",
        "p0Eo7",
        "vV=cy^",
        "SGqwR",
        "s migr",
        "$+#t6R",
        "7[y)n;",
        "CDlpManager::GetTaskByName",
        "*uB]Tw",
        "j]cx5",
        "&Atcelt",
        " cesta UNC k prie",
        "s abpV",
        ")HbSc+=q",
        "7ob?X",
        "toarea repornire a PC-ului, instalarea va continua. ",
        "wcCw3",
        "PBfk0o0",
        ";;=G\\",
        "\"p:v8",
        "OsUninstallWarning: [%s]",
        "ri in",
        "T(`\\*",
        "X|1r;w",
        "?@WJ]",
        "anu cietaj",
        "I<pM&",
        "azo)V",
        "Ce%Po`",
        ": Upgrade, DataOnly, Clean ",
        "MKA: Tento p",
        "|EG|#9;",
        "X[Nlv",
        "ITvbJ",
        "B3eGX",
        "='085:",
        "Toiminto: Kun valitsimen / PBRUpdate asetus on Enable, asennusohjelma p",
        "|&ZMHb\\",
        "i5}dm",
        "i<$xFe",
        "N|O\\i",
        "*M*Y]5",
        "i~zF=H/",
        "yW#/+g#",
        "UnFNl",
        "=?u&g",
        "JR:sC",
        ";1%&l",
        "n5F =D",
        "DsfusW",
        "IV'd/",
        "en og/eller brugeren skal have tilladelse og netv",
        ":#;;;L;Z;",
        "UtXsz2,",
        "`]F?@",
        "q$@s@",
        "S2->[#",
        "E5%p*9",
        "Parameter: / Telemetry <parameter> ",
        "s=4PuX",
        "?fHei",
        "aukti",
        "_d.XN",
        "4X@b>",
        "A&.o`!D",
        "Xy2bX",
        "lectionner l",
        "ZrdTd",
        " 5Z:`a",
        ",#7suA3",
        "ami vismaz 350 MB br",
        "<PHyF",
        "1mt#&",
        ";$;0;<;H;T;`;l;x;",
        "8g\\1nF",
        "v,,ag|b",
        "%dB~\\",
        "!|hKFfk",
        "rk! Denne parameter skal kun bruges ved test og i testmilj",
        "0~0W0_0",
        "=hpx0I",
        "(H[[`",
        "[bpJ;",
        "dias licenciadas por volume ou de",
        "/^6u7",
        "noRK+",
        "CDlpTask::ResetTransferProgress",
        "n de caracter",
        "TnNz ",
        "d>eqG",
        "A Windows telep",
        ";xDRh",
        ".{u9}&O",
        ",\"52\"M",
        ">^=>6VMG",
        "^-N(W",
        "$m3rI\"ms",
        "InitiateSystemShutdownExW",
        "jt<-5",
        "Successfully hardlinked: [%s] -> [%s]",
        "EPeq;m",
        "el=#(",
        "Pm:]g",
        "U&@ba&%",
        "GetTickCount",
        "Tq9k`",
        "&Nw;U",
        "A a65U",
        "+u;kJc",
        "ExKKudy",
        "%:veh",
        "kalu uudelleen ja varmista, ett",
        " diagnostikos informacij",
        " J1Gdx",
        "REMARQUE : Ce commutateur doit uniquement ",
        "<+pw'aK",
        "[AL?l5",
        "2pS#y",
        "ETQTM",
        "'Fr@rJ[",
        ">:`JV",
        "&aw'<7",
        "Ts\":Q+9",
        "Esimerkki: setup.exe / auto upgrade / noreboot",
        ",=oRG",
        "8T&AL",
        "r=4+.",
        "ndas i produktionsmilj",
        "%r,h=mn",
        ",|zL}",
        "Ql\"`U",
        "Qh0L@",
        "#{17Y4",
        "sQ,XO",
        "Jm]'H",
        "interface utilisateur.",
        "=V,H>",
        "vv9T8x",
        "j95H;Kp;w",
        "gaO>6",
        "fy.~,",
        "}&%\"n",
        "v*M4X",
        ".?AV?$CAutoDeleteArray@PAU_EVENT_TRACE_PROPERTIES@@@RAII@@",
        "8a6;8",
        "q;j<y&",
        "j!\\Cn",
        "!/ 8b>",
        "t<XRn^7I)",
        "vVf<}h",
        "si|&<",
        "\\gtfp",
        "is parametras neb",
        "X`,G-\\4>C;f",
        "1(2F2",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
        "2.HIQ>:",
        "r/4+~/{gR",
        ", rad",
        "!EO[!",
        "m<jo3=j",
        "oeH%Ti",
        "\"&|ZoH",
        "Baixar",
        "J\\2pU",
        "^^`@y",
        "Action : Injects setuprollback.cmd file from the specified location.Setuprolback.cmd is a customized script to perform tasks after the installation fails and the PC has rolled back to its previous OS.It is run with the same privileges as the user or process that launched setup. ",
        "{B)DR",
        "bJFxK",
        "l5.'gq",
        "4z8/s",
        "7rW_B",
        "{Bh6I",
        "6E6R6Y6",
        "'o,o&o%",
        "naVdLa",
        "\"^u;u",
        "Eg.T+",
        "..B'Q",
        "Windows Setup kann nicht gestartet werden, w",
        "b1^c,",
        "Preparation",
        "#},~^",
        "UVLl\\",
        "gNF8)",
        "jra a sz",
        "m9Y{3",
        "Rwmpo",
        ";;3;;;",
        "\"9?]$",
        "4#'r(",
        " este Windows XP cu Service Pack 3.~Utiliza",
        "Parametre: Full; None ",
        "r-HlP$",
        "%rmy`A]",
        "*H*W'$",
        "vTiMy",
        "0-fs[",
        "r<P*m",
        "HOnUt",
        "#.rtE2",
        "H%(AC(A+8WO",
        "200304182921Z",
        "$%K)R",
        "GetPrivateProfileSectionW",
        "t@ozt",
        "   <description>Online Windows Installation Box Stub</description>",
        "D3Q4#|",
        "32JQ[",
        "DeletePath: Failed to obliterate [%s] after %d tries; GLE = 0x%x",
        "~]xGmU6B",
        "F<F}j?",
        "9$:J:T:l:",
        "0j0D0g0O0`0U0D0",
        "80_Z,",
        "2#2*2",
        "t:)pkR",
        "u`;)k",
        "RF_+f",
        "a,r#g\"/",
        "Bn4bg",
        "Trxdw",
        "eGU,!",
        "metros: Upgrade; DataOnly; Clean ",
        "KJeQzz",
        "m(Sl9G",
        ".x9:\\",
        "&A:Gv",
        "mrj{^",
        "oldv;",
        "000J0W0u0",
        "M0z%-",
        "{o#5v",
        "2:>71",
        "F/E=FS",
        " X)-PPQD",
        "0|&3I",
        "r?CI\"",
        "k/19Y",
        "o?T:&",
        "tdLQI|`",
        "ZqV<:b'2",
        "rX2_P9",
        ": %1!s!",
        "L8$xV",
        "OpenThreadToken",
        "MF& `",
        "i1sEu",
        "MyO'Qr",
        "WzI!\\F",
        "sjJg8",
        "]$b?_",
        "[Ly19",
        "~n.n^",
        "Opzione: / installfrom <percorso> ",
        "Parameters: Local file path or UNC network path to a file named setuprollback.cmd ",
        "Lc=?=",
        "=A>jo",
        "@6j@X",
        "installation n",
        "s darbu. ",
        "dG3F*f",
        "~eBb[",
        "$t8j<",
        "\\lJ?/",
        "n. Por el contrario, cuando / migratealldrivers se establezca en None, la instalaci",
        "EF}(3*",
        "A!M_M",
        "jligT",
        "\"m;b$",
        "}]8M]",
        "%>Bv'",
        "qQ=/3",
        "+B<1`A",
        "CNBoqq",
        "ATTLIST",
        "Eksempel: setup.exe / autoupgrade / migratealldrivers none",
        "o intermitente da rede. Repita a instala",
        "MXd'+4",
        "7$707{7",
        "I#h P",
        "f_|:6",
        "/I7LE",
        "P!@pC0\"",
        "Z );W",
        ";NQzM",
        "7o0;c9",
        "orp4\"tk!5W",
        "w:f>Nge08#",
        "O}/<)",
        "ki?RdE",
        "n har",
        "r{lXp",
        " narz",
        "Beispiel: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "xf4\"1{",
        "K_Qd]",
        "@HJui",
        "&>Q%3",
        "GDx?F",
        "UT}\" ",
        "3$-BL",
        "I5,H:aA?",
        "qY_QVt",
        "-l*Hz",
        "{-c68",
        "iljanje telemetrije je omogo",
        "fy/zk",
        "5HP'E",
        "-SBoh",
        "j;T{W4Uk",
        "X>\"6=)v",
        "hKm0R",
        "q3Femb",
        "5@_ss",
        "kHeau",
        "Leelawadee UI Bold",
        "anai ",
        "k gA.",
        "/@+/A+",
        "id*'F@R!",
        "4jA|%",
        "Bw/&#<[",
        "CQ)P5d",
        "p_8xZ",
        "Gfeh-q",
        "XIMR{",
        "r }\"R",
        "mu ni",
        "JZ]b?p",
        "l. A setuprollback.cmd egy",
        "n pero antes del primer inicio de sesi",
        "|D:4<",
        "~&=+0y",
        ")4YNU",
        "2E>xn9",
        "Commutateur: / Postoobe <emplacement>\\setupcomplete.cmd ",
        "U|)xo",
        "ZE\\uU",
        "(JU46",
        "=d|OJ",
        " Windows 10*",
        "455H5",
        "nQ{e>",
        "x`,!c4",
        "@((viG",
        "rCBC>#",
        "HT0Rnl",
        "7{!~}",
        ")d:j@o",
        "OQ8W@",
        "hX,zb",
        "z4'<J",
        "Xy^xUn= ",
        "8RZ4\"",
        "Installazione",
        "L/fwR",
        "DuplicateHandle",
        "FgH|a",
        "J1u2r",
        "        name=\"cfgmgr32.dll\"",
        "P`e*\\",
        ";~1pAD",
        "8ch%l",
        "9Ebbt",
        "w2\\s}",
        "b?7Do",
        "8!}`\\&",
        "leminekut operatsioonis",
        "yvqU[",
        "t;9 jc",
        "\"[Njr",
        ";q#|b",
        "Kdr<\"",
        "'[A%]:",
        "A^BckG",
        "?AcndN",
        "g>le7",
        "_ao?C",
        "'cQ\\;",
        ":Yx6c#",
        "ZOIc%",
        "f%d:R",
        "4tF%Px",
        "A&nnuler",
        "BqY,#",
        "&~e$b",
        "ts-ZA",
        "E}keZ",
        "L'installazione ",
        "&bb2FEdJ",
        "Tlwb+#",
        "`}X{C",
        "/((<E",
        "f)k,,0",
        "Vl 7y",
        "cznik: / Postrollback <lokalizacja> ",
        "tfv%)",
        "p~1$r1",
        "J79CI",
        " L4k/'!",
        "        name=\"dwmapi.dll\"",
        "sf-;b",
        ".idata$5",
        "10(1~",
        "=-f5Ms/",
        "xxl?i ",
        "A*0$*",
        "=,1_Z",
        "'<H60_`",
        "FyK>u'",
        "Le@<f",
        "Y|/cMR",
        " valitsin my",
        "ExpandEnvironmentStringsW",
        "oD9U#",
        "Wlf:5LE",
        "*-l/,Q",
        " d~4t3",
        "uje po dokon",
        "%x!Sln",
        "Kw!,D",
        "0U[K2s",
        " vilal",
        "hlen.",
        "040904B0",
        "hren erhalten). Mithilfe der folgenden Befehlszeile kann das vollst",
        "Microsoft Time-Stamp Service0",
        "u}y~:",
        " quaisquer controladores como parte da instala",
        "yB1O\\m",
        "CAzureScenarioCtrl::PopulateWorkingDir",
        "t%HA<86",
        "~36j-",
        "!_&Gnq",
        "1N}WH",
        "Z}@DN",
        "        loadFrom=\"%systemroot%\\system32\\ucrtbase.dll\"",
        "7c}O^",
        "uclwd",
        "Cx?(y>(",
        "Instalare Windows 10&Instalarea Windows 10 se execut",
        "vi, ja / showoobe ir iestat",
        "Redmond1",
        "</YH_RsF",
        ":=x{FS/(",
        "m|W'3",
        "[|_gN+;",
        "):+[n",
        "Pavyzdys: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "{@eDR+#5{p\\",
        " rede para o caminho de ficheiro especificado. Este comando ",
        "$o9\\KX",
        "SetTokenInformation",
        "sfJqE",
        "x~jkX~",
        ".8O/I",
        "zEfN<I",
        "6qi+H",
        "4l.{,",
        "ia PBR ",
        "VvGJT",
        "+i#P.F2P",
        "sb0gK",
        "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8",
        "H3s)b",
        "\\GYXv",
        ">sdBm2G&",
        "@]rS^",
        "+onBc",
        "jungti, s",
        "d@+;S",
        "zt.xA telep",
        "A+?cB",
        "J:J5gC",
        "(d$PH",
        "\\\\Jh(*E",
        "QZ&hg",
        "Tc;Nqg",
        "kl#hgg",
        "X*8n<",
        "<VB+D",
        " tarvitaan vasta, kun tietokone saavuttaa tervetuloa-ohjelman: ",
        "zpf3NK",
        "|,B\"Y",
        "~~ic*",
        "2R8-`",
        "J);nz",
        "aZBO`",
        "?)&o]",
        "Listo para instalar Windows 10?",
        "TK5'x",
        "JG(&Oh",
        ": Enable; Disable",
        "3e/[l4(u",
        "ZdjbWLUN",
        "_IU53",
        "sZAAl",
        "VHtDw9",
        "wE9O'",
        "\"m(MKt",
        "CurrentIP",
        "w:w6X",
        "Parametrai: 5x5 produkto kodas ",
        "cAjS~LL",
        "rg for at du velger korrekt arkitektur.*Kunne ikke starte konfigurasjonsprogrammetsKunne ikke starte konfigurasjonsprogrammet. Lukk verkt",
        ",r?56",
        "eli da se prikazuje korisni",
        "d}1oM",
        "n~?lG",
        "ne smetnje. Poku",
        "4:eBVZ\\",
        "ta vai izveidota PBR. ",
        "WUJ/3",
        "Hh0EBC@",
        "vKrp]",
        "mbolo del sistema",
        "I9x4b",
        "$o9(B",
        "6iznA",
        "e do nastavka instalacije. ",
        "8W8l4",
        "Tv2SB",
        ";J4Cp",
        " rula",
        "4j$\\Pd",
        "D<5]z-]",
        "!HQ{?6",
        "A`%\\J",
        "J&D=M",
        "+d+fX",
        "GnHPU",
        "5<6+Gzy0",
        "^=b\"|",
        ":;m\\\"{",
        "vs>%3G:",
        "x@<Ep",
        "bs-BA-Latn",
        "?2j&&q",
        "HgRQd;",
        "vz3;a",
        ",EsM}",
        "Y'I4N",
        "q*E?z",
        "6mE^,",
        "nS>8Kd",
        "|i2rT",
        " verziu XML(Chyba pri sp",
        "r?-:,",
        "T!mjW=",
        "o+GxBy",
        "o]YEyo",
        "~e#.1J",
        "-IMZf<i?LI",
        "62797d7k7",
        "cssdF",
        "GIFmNQ",
        "~zSp#Jk",
        "?~6|4",
        "U=9'?",
        "0$[5+",
        ";8E+C",
        " la pornirea instal",
        "s^1p-c",
        "DNpdOhc",
        "x<`NY",
        "~|yw8",
        "~@m{=",
        "g9$E\"yF",
        "`KJ>L",
        "u]na]",
        "Stsenaariumip",
        "ber hinaus die folgenden Standardkonfigurationen vorausgesetzt: EULA-Annahme, aktivierte dynamische Updates, Sammlung und Upload von Telemetriedaten sind zul",
        "C[|Wh",
        "K%WSI",
        " procesul de configurare ini",
        "n din",
        "O_c#=",
        "\"H'B&",
        "(^wUD",
        "?5&n(",
        "b%]A,H",
        "\"$gc?",
        "#7\"Nr",
        "igus migreerida k",
        "inizden emin olun.%Kurulum",
        ")-!>%E",
        "W1\"eD",
        "uXg`Y;",
        "#8h$eQ",
        "m};I7",
        " Ob]_dh0",
        " sist",
        "jya`X9o",
        "I(S1)",
        "cznik / showoobe ma ustawiony parametr Full, u",
        "%;A=O",
        "gU9(K",
        "3|>xW",
        " sau calea de re",
        ";yjPu",
        "nda, kurulum, y",
        "!ueXXq",
        "0<^8c",
        "5<H]4",
        "Ok[_M",
        "wgu1 u/",
        "B`6rTf",
        "cXJsG",
        "=9Y^A",
        "#Gt7\"",
        "1HC|X",
        "6_N&f",
        "x;&kD@",
        "*SVec'",
        "OQvpX",
        "Ol[kT",
        "od'sp",
        ":afPNT/",
        "TQD%J",
        "eTjJ0",
        "jb_1$",
        "Radnja: Ako instalacija ne uspe, ona kopira ili otprema komprimovane evidencije na odre",
        "./zPhZ",
        "_y|Mh",
        "*lra3",
        "iK.#wI",
        "`Q5O%",
        "PmmV4",
        "=9Bnt",
        "SyfW?:T",
        "C@I'u",
        "&)01Ix",
        "f!G7 h",
        "nj;}J",
        "T8HLL",
        "_wU(TRH",
        "9G`UP",
        "`mINU",
        "E*J!I&&1",
        "0*1D1",
        "aWKlj",
        "{iPo,",
        "b]Qoi;",
        "%o\\q$",
        "<-+8G",
        "G4Rn4t",
        "|W~Kpq",
        "encoding",
        "1rXV&A",
        "e8\\vG",
        "O:JC9",
        "o;[UN",
        "leyecektir ",
        "l\"y,Z",
        "^Qq[p",
        "installation ne peut pas lancer l",
        "m#t:j",
        "l`M\\;!{",
        "000PPP",
        "!Ao6K",
        "~wm3y",
        "XUw+U",
        "yvDOq",
        "r / migratealldrivers er angivet til All, vil installationsprogrammet fors",
        " do sekcji Windows Update w aplikacji Ustawienia, aby uzyska",
        "Segoe UI Semibold",
        " a instalace aktualizac",
        ". / files ",
        "G9aJT",
        "c|E:4",
        "6q;b\"",
        "cie: vyjadrenie s",
        "ytynyt>Virhe valmisteltaessa kiintolevyasemassa olevaa tietov",
        "u4#4K",
        "5)){*_",
        "elV8$",
        "el programa de instalaci",
        "}|o{ ",
        "ufFPv",
        ">bMBu",
        "=0Cje",
        "8T!Kj",
        "YY]R=",
        "BCryptCloseAlgorithmProvider",
        "=@~`yD*8",
        "Wx +4",
        "l&E4Z",
        "X %46=Q",
        ";NDZ ",
        "Preparando_El programa de instalaci",
        "(}m{\\",
        "IaSD)",
        "0/*o~CS",
        "L/Ys(",
        "4Rs\"8",
        "k3B>w&#",
        "cii. Ak je v",
        "Wa}6T=",
        ".GFF\"",
        "`)sgb",
        "0A$$@/",
        "}ESf'7",
        "j:Xf;",
        "E>Xxt",
        "13Lz33",
        "2x(uiR(",
        "lvl~s[",
        "quc-Latn",
        "FreeLibrary",
        "installation depuis un r",
        "8 \\ghO",
        "Installazione di Windows 10.Installazione di Windows 10 gi",
        "stico dos PCs de teste, para a eventualidade de uma falha. A linha de comando a seguir instrui o programa de configura",
        "vU_-N",
        "55c3Y",
        "rskendamise toiminguid (v",
        "0'>V3",
        "i{\\j%C",
        "1#1]1q1|1",
        "fp@5[",
        "Installation de Windows 10",
        "n de Windows 10 se reiniciar",
        "Wybrana architektura nie jest zgodna z architektur",
        "u\\1B2",
        "hA_`c",
        "Hjs*F",
        "808;8",
        "^;t!l",
        "'5V$5",
        "bcrypt.dll",
        "`H?Tu",
        "CmdLine",
        "ig angezeigt, sind jedoch automatisiert. Bei diesem Schalter werden dar",
        "Parameetrid: Enable; Disable ",
        "3q;,h",
        "yR?_e",
        "j@~-k",
        "galement souhaiter collecter les journaux et les autres informations de diagnostic provenant des PC de test ",
        "e nadgradnjo izvajate s koli",
        "6Ze\\kI",
        "m]~K==",
        "w(Hx~N",
        "]E=E ",
        "o@gN)",
        "]\\x{5H",
        "c< aAMU",
        "|T>)_",
        "MVIde$",
        "P]6V7>",
        "[`[;m",
        "zyId^",
        "KQ4HVR",
        "LsSVp",
        "ke izku",
        "FVc\\p(s",
        "Sm#gL",
        ". 3g+S5",
        "d%fHQc",
        "X2>>>",
        " SXh!{",
        "1 1-1Z1z1",
        "=/334",
        "@j~65\\",
        "o recolher",
        "dLzWv]",
        "N8J/.!z\\=",
        ":NOgt{",
        "6h:#~>",
        "uh]7)",
        "=K]gR",
        "4Eu]bc@",
        "RegisterTraceGuidsW",
        "* k{v",
        "UZL>W",
        "zOG}V)",
        "q0{A9",
        "I?;N)b",
        "uQC;_",
        "(g#U[!fll",
        "''y(JIjP",
        "JQ_yb",
        "Es+UT4",
        ")luF6",
        "UsE!6q",
        "wNpNtNrNvNqNuNsNw",
        "`v`X^",
        "b6RW0~0Y0",
        "uU9|D",
        "hrt, durch den Setup gestartet wurde. ",
        " spusti",
        "#Se preg",
        "EnumFontFamiliesExW",
        "s6e$/",
        "D_2HM",
        "{0l|%",
        "r ve bile",
        "WI@>M",
        "6~J.'",
        "V/n?!",
        "a$yvu'I",
        "CZ&t?",
        "4'4.4F4M4f4",
        "n3f%/!",
        "IctL:",
        "OpenCABFilesInFolder: Expanding [%s] to [%s]",
        "U0@'~us",
        "L`9]c",
        "97wenjnk",
        "c&['5",
        "?X/o7H7",
        "?~=`n",
        "KOgBF*Y",
        ".&Yc-+",
        "};Qn7",
        "lH/1N",
        "'>Wii",
        "FASN8",
        "Veiksmas: s",
        "BuloN",
        "-PJ_,",
        "CjD=~",
        "ob!KWb",
        " telep",
        "Ue+TYL",
        "(/Vn+",
        "%s: Install.wim/swm/esd was not found!",
        "CMediaScenarioCtrl::DetectOsUninstallWarning",
        "xjg.zmh",
        ":q7mw",
        ";EFT_n",
        "diom, ktor",
        ".qMwQ",
        "@$*~K",
        "}jo(zu_",
        "dET(n",
        "J[V<P",
        "))J:\\",
        "installation de l",
        "nl-BE",
        "4::zdd",
        ")>ln#< ",
        "g.K0'K",
        "tr-TR",
        "e izvaja.kTa razli",
        "klad: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "sdfKB",
        "\\D>D%!",
        "=%>?>L>g>",
        "memcpy",
        "a`Fw#",
        "i fel",
        "WHK}Bwo",
        "XFSq9",
        "h<E|r",
        "5*5PY",
        ",#m\\}*",
        "{ofavwfv",
        "r installasjonen av Windows 10#Installasjonsprogram for Windows 107Installasjonsprogrammet for Windows 10 kj",
        "ias numatyt",
        "kK?Kry",
        "Ts*,wR",
        "\\o*LC",
        "ncerca",
        "OTVN1",
        " %M;7",
        "|!X??",
        "V\\+glN",
        "F]~A7",
        "lpJXY",
        " kompiuteri",
        "='%!a",
        " ce computerul a ajuns la OOBE: ",
        ".v~6G",
        " http://www.microsoft.com/windows0",
        "|' F@",
        "TrackMouseEvent",
        ": / showoobe <",
        "glicherweise zeitweilig unterbrochen war. Wiederholen Sie den Setupvorgang.",
        "4 4$4(484@4D4H4X4`4d4h4l4p4t4x4|4",
        "UfE/q",
        "-Je^2",
        "Removing cleanup registry value...",
        "Pro instala",
        "LK%5>",
        "eDR$k",
        "I~c4&",
        "\"RKDa\\H",
        "<k%+3",
        "-j#b<",
        "zO$*H",
        ">-WZ/",
        "Bro~D",
        "e;[fV",
        "=ObGAQ",
        "V`?g6",
        "I|7lOF",
        "]d\"ic",
        "##wG&~",
        "```@@@   ",
        "h`7!4",
        "(?}jO",
        "pk_}N",
        ".u'h?}1",
        "gsb%'",
        "{?Z>j",
        "b|6eb~",
        "T_5m32",
        "eqe#2",
        "e nie mie",
        "ttes ikke. Den mindste p",
        "ivituda. Taask",
        "KlM>OJ",
        "x$5UV5R",
        " nebo v testovac",
        "((zp~j",
        "cutez ",
        "nea de comandos se puede usar para",
        "zAA]P",
        "Spustit instalaci znovu od za",
        "Ii.I9",
        "k6{\\!",
        "}wNKF",
        "y%tmZ",
        " parametr Disable, odd",
        "_M'P)",
        "0F0k0",
        "}Jgr9",
        "z}:{{",
        ":B:a-f~-h",
        " znova.",
        " installer Windows 10?",
        "+Cc;;=",
        "7%[U{(D",
        "L$\\_^[3",
        "d kapcsol",
        "+1FG+",
        "WIQC r",
        "YUcsG",
        "ra, OOBE praleid",
        "n2u8}",
        "ritetyst",
        "?QYx;T",
        "Action : Supplies setup with the specified product key.This parameter is not necessary when upgrading with volume licensed media or media that contains a pid.txt in the sources folder. ",
        "U^lV.",
        "RFx\\=",
        ";q4a'",
        "c poprawn",
        "JWKqB",
        "yDQ3VkM",
        "Parametere: 5x5-produktn",
        "8q7[1g",
        "i n< :",
        "A})GB",
        "ODg9l-[",
        "cifie l",
        "n de migraci",
        "&tF9`]",
        "G_KkM",
        "pc<N(",
        "'&+]0",
        "r den angegebenen Dateipfad aufweisen muss. Da dieser Befehl im Systemkontext ausgef",
        "%08 #",
        "wcschr",
        "F?Q2 ",
        "QR3|1B",
        "[f.t?",
        "SzGRB",
        "[[[))",
        "e do sistema operacional anterior do computador ser restaurado. Ele ",
        ">0\\4W0j",
        "NSe.v",
        "LZH+Y@",
        "ANCz[",
        "_9ziB",
        "i+7-S",
        "DgSp,",
        "k8j,v",
        "9wE+`",
        "&:h\"pj",
        "Z=\"jg$",
        "S-D;/",
        "Commutateur : / auto <option de migration> ",
        "RO~G9",
        "S,ujt^",
        "D`gg;",
        "mp8U(",
        "4Z,+n",
        "Sdlzv",
        "EVXuPL",
        "b{{{X&~",
        "}:(BX",
        "!134?}",
        "nO P$",
        "x\\%74",
        "Opening Box Result: [0x%X]",
        " =re#",
        "[TJ]n%^",
        "<QQ>1X",
        ")10z/",
        "0!,a%Z",
        "7!,X]",
        "Legale",
        "9h'1R",
        "yM`@Y",
        "tUz$}",
        "Parametre: All; None ",
        "mwN.l",
        "G*9/98",
        "FSC7B3",
        "7{ CfF",
        " Windows XP con Service Pack 3.",
        "Ue,Jce",
        "htekandja asukoha / files ",
        "r?0*e",
        ".?T::",
        "Kj~%/b",
        "P^*5,",
        "q!e<18\"'",
        "YE9d8",
        " \"\"-@6-\" ",
        ")'2:E",
        "{2H/ ",
        "lu3Mm",
        "yEn3I",
        "8A9i9p9",
        "QXIXi0",
        "+&,$^BC11aD\"",
        "metro : / copylogs <localiza",
        ">#ILvl",
        "6G9ZM",
        ".J+\"Ba",
        "d>6 r",
        "5d|wO",
        "ar<8-8",
        "D~#gF",
        "Ub_{P",
        " recursivamente todas as subpastas do local especificado. ",
        "M$R{*",
        "bas p",
        "rd: Aktiverar filen setupcomplete.cmd fr",
        "C1;&&",
        "={fLD",
        "ifra proizvoda> ",
        ",vsso",
        "7b;${",
        ")}8Ms",
        "s\\parancsf",
        "|1{iXb",
        "&0tlW",
        "Fk{;i",
        "rankos vartotojo s",
        "d]i/}",
        "4A4\\4",
        "{Td\\B|$n",
        "b*_}S",
        "g|[vg",
        "]cY?M",
        "MZdfG",
        "zSiElg",
        "1pjlQs",
        "*@mRw*",
        ">T{'>",
        "Dk8qN",
        "a que genera. Sin embargo, cuando / Telemetry se establezca en Disable, la instalaci",
        "5$GbZK",
        "8#q-b",
        ")yTUm",
        "7<8M8",
        "cG_f-",
        "{:;--;",
        "'_f V",
        "CDlpManager::GetDwordPropertyCount",
        "u,%-X",
        "fini sur Disable, le programme d",
        "p4^OD",
        "x{93)",
        "{{~G2~",
        "|~=nh<",
        "yFcqe<3",
        "0-0=0B0H0f0l0u0",
        "3u&m6S",
        "4j0:l)I",
        "hMj_l",
        "1k)4=",
        "e\\wnvLPTAN",
        "pomoc",
        " nem tudja meg",
        "p87OH7",
        "0,Y*H",
        "s, mak",
        "!l;K-e",
        "5eA=|",
        "r 4h=F",
        "lLr,4 n",
        "v(hTv@",
        "l01c 1",
        "\\6)d'i }",
        "O>w{GA",
        "Vh`$A",
        "S6p+g",
        "Eb2r&",
        "\"Microsoft Window",
        "RWY`&K_Y",
        "UW=qw",
        "Ia0u3",
        "(f.L7_",
        "bh.gD",
        "/~=sd",
        ".5O<6",
        "t3c@F",
        "_G =%",
        "g/&q?",
        "S]K5g",
        "CSxWR",
        "}RPB4=+",
        "HX[H\"",
        "_[\\Vm",
        "wt-Vg",
        "-Bc;oC",
        "xe8A:",
        "dDWU!",
        " s aMR",
        "trjSp",
        "I:x ?",
        "J-Q##",
        "[nSXAVM",
        "<O7w$",
        ". Aceast",
        "m^,db",
        "SOrp __",
        "WY`Bf",
        "ADVAPI32.dll",
        ";#;+;3;?;H;M;S;];g;w;",
        "SjdPj2j",
        "t, izmantojot lielapjoma licenc",
        "^h,c,",
        "K6:5(Lh",
        "-Nphq",
        ". Bandykite nustatyti i",
        "Removing CorrelationVector registry value...",
        "\\E+q*",
        "wQU4p4",
        "Ar tikrai norite baigti?",
        "Tg1Z98",
        "{y3a~",
        "ni uporabniki ro",
        "WARNING",
        "9E8M1",
        "*;:Q2w",
        "sr-Latn-CS",
        "@25A1",
        "R\"eR!UR#",
        "i,Pk}",
        "=c=}=",
        "{)i0X",
        "r du inds",
        ":L&&6M",
        "w#==*",
        "-W+'`",
        ",)Ax8",
        "5r#+c",
        "ql{GbZ",
        "\"bwk-",
        "/MS-Z",
        "\"s~hJ",
        "0~0_0o0 ",
        "#kwd:",
        "'f7X]",
        "architecture que vous avez s",
        ".\\i*d2",
        "tUwuB",
        "g)Ok:F.",
        "[1:7Z",
        "'lrn/`M",
        "TJhUp",
        "nea de comandos se pueden usar para modificar el comportamiento de la instalaci",
        "H(to1",
        "EDSr#",
        " prob",
        " potla",
        "7.1q<",
        "   ```",
        ",2ih*",
        "yKz4?",
        "spg;m",
        "urirati ili stvoriti. ",
        "H>Tmr",
        "Eksempel: setup.exe / auto upgrade / quiet",
        "sti se nastav",
        "a.OEk",
        ";?Y>ba",
        ",gDvL",
        "3=*7g",
        "\"M\"?{W",
        "#-;O`(",
        "xf(#n",
        "Tsnw(",
        "v!)?E",
        "^@G<B",
        "Yyh%xW&k",
        " ani nenahr",
        ";|g#0",
        "]{\\TE",
        "of23I&",
        "MHq})",
        " parametr All, prob",
        "\\E}UcU+",
        "Acquiring privileges...",
        "SetSecurityInfo",
        "dU3^NK",
        "fQK1B",
        "Pee_.",
        "vtjVc",
        "N}A[tDoLF!~",
        "u>.QcS",
        "e li program za instalaciju provesti operacije dinami",
        ">L2^m",
        "L{LGM",
        " program Windows 10 znova.",
        "sp3O(",
        "s<Q_j",
        ")()((((",
        "{prD\\",
        "Utilize o outro disco de instala",
        "`nQ?%",
        "$TR(y",
        "programot ",
        " Vai tie",
        "y}gg2i",
        "=h'H^",
        "VH)Jkjm",
        "P~Z-^",
        "cd9FV1",
        "HM@yQ",
        "$x)=Qb",
        "n de Windows 10.",
        "8AZ*-",
        ".idata$3",
        "nqE.zd_",
        "Yj-(#",
        "hQU}bSM",
        "BOc*>",
        "Forbereder installation ",
        "a)?H8",
        "j<0aM",
        "(<\"p8=",
        "n\"JjM+",
        "x[_6<",
        "BA<ztQR",
        "a)>!iP",
        "3J;?yZ",
        "Value",
        "nF@7+",
        "0w]W~",
        " 2Hdm",
        "f)jD:",
        "J+q?o",
        "\"Ai$w2:9",
        "0F0h0W0f0D0~0Y0",
        "z.4!X",
        "\"icCp2%",
        "gu,kf",
        "CEBd,2",
        "_j]nr",
        "wZ~p(",
        "4 4*42494H4T4f4",
        "X>{A>OL",
        "-6?U4",
        "BwVoQq",
        "j~/q{",
        "rbaud",
        "/+4i!8",
        "RiO5fi",
        ".1TZ=",
        "6:4yP",
        "1cB4\\",
        "7?Kp^",
        "m<oMv",
        "r hhw",
        "mogatott. A sz",
        "CDlpManager::DeleteTask",
        "oA,F}",
        "hhp{(",
        "PA)8V",
        "/<A:`[D@",
        "32Oak:",
        "ayT)Lj",
        "FW p=x",
        "d.+(t%",
        "wL)HO}Fr",
        "0B]4&",
        "(1P5J",
        "q.;<2",
        "/jH7f",
        "A3-l>K[",
        "0?44DV",
        "u varsay",
        "+Axt{s",
        "LC>DH",
        "gp{WP",
        "7EFx_@",
        ", ja rodas instal",
        "Jd8m]",
        "L;xWq",
        "J>:NO",
        "pTwbB",
        "es-EC",
        ".)e+Y",
        "t5ZzJ",
        "fuHy0Z",
        " ]FPW",
        "BL%q0",
        "installation va continuer. ",
        "sB2Gl",
        "g. Observera att datorn och/eller anv",
        "T6EI'[",
        "7$nu]",
        "^sGUWq",
        "5a[y)",
        "xeln b",
        "Conmutador: / copylogs <ubicaci",
        "w+5vMR",
        "n: cuando / migratealldrivers se establezca en All, la instalaci",
        "nou zmluvou koncov",
        "7}Idz$cG#",
        "34tdUw",
        "CUpdateScenarioCtrl::FindEsdFile",
        "!N8F,",
        "I4'zqJ",
        "Pjl^'g",
        "AhKi<",
        "sfjfj\"}",
        ",R/j/",
        "\\W0J0",
        "%|'>r",
        "6CA%=",
        "gaHe.9",
        "dh:u]",
        "b\\*0Q+u",
        "@4)i$",
        "\"%= 4z",
        "l/295",
        "ErNx\\Lj",
        "&ZJI-_",
        "0c<& ",
        "Im 9k|",
        "J. \\>0",
        "Exemplu: setup.exe / auto upgrade / migratealldrivers none",
        "}rCbx",
        ".Dve,",
        "^XMjE f",
        "NEy2m",
        "BQlwX3",
        "5Q'Cm.",
        "5(5R5",
        "0qc Z-",
        "kleri belirtilen konuma kopyalar veya y",
        "(>9!s",
        "rxt)/aG",
        "metro no es necesario cuando se actualiza con un medio de licencia por volumen o con un medio que contiene un pid.txt en la carpeta de origen. ",
        "sdQ8v",
        "RTD$F}",
        "&-nR]",
        "1[fB9b",
        "r den PC ein Rollback auf das vorherige Betriebssystem ausgef",
        "QVIOj V",
        "gios do usu",
        "#O~Vt",
        "lf^ww",
        "t_U~w",
        "@z_)X",
        "Ri\"~GGa",
        "s>jkB",
        "<A^ /",
        "MLyV1",
        "9{X%-",
        "?w?~?",
        "1T?+L",
        "=%>,>M>j>",
        "0@$$>/",
        "PWQC.:",
        ": / installfrom <",
        "h(;sr",
        "3/NMY",
        "K0s=;",
        "affiche, mais elle ne souhaite pas que les utilisateurs finaux puissent acc",
        "c-E%z",
        "h\\Hkf",
        "[8rxW",
        "~Z}~W",
        "chsten Neustart des PCs fortgesetzt. ",
        "1G!5cFo}g",
        "9`3\"QYt",
        "nZ9/+~@",
        "m!{|T",
        "iZg<B",
        "'[+jd",
        "T{kzKd",
        "^J3%$%%%4",
        "|v^j4s",
        "`\\iyW",
        "DFeG~!",
        "   @@@@@@",
        "j4UGS",
        "uZ\\LA9",
        "APS@U",
        "9\"?|g",
        "u9r@(",
        "Utilisez l",
        "6xf4t",
        "<R=Y=m=t=",
        "U#TB|",
        "PYkBB5",
        "W**Bd",
        "l,hAK",
        "k5`EL",
        "S93^V",
        "zL{9%8",
        "*.esd",
        "A1!1)",
        "*C]Q-",
        ";1|k|",
        "u\"'E,",
        "WQ?'j",
        "8D9SH",
        "[JXd<",
        "de-LU",
        "X7kx7/:c",
        "~@[)b",
        "<3=h=",
        "#T^b(",
        "faut, mais sont automatis",
        "_K+/K1",
        "3eHK|",
        "?%p!Gn",
        "}-W_p",
        "Asetus",
        "Vt@Lt",
        "U8 `rI",
        "n\"8c}\\",
        "Az=YA7",
        "aHvN\\)P",
        "a2!gw",
        "zZHlE",
        "Wc87s%H",
        "vbqbNbr",
        "CSTv-",
        "/Quiet",
        "Microsoft YaHei Bold",
        "8E$!.",
        "4>4f4",
        ":@]pG",
        "&Sx;*",
        "dUf4(",
        "=~S)i",
        "&z>2/",
        "ndonos",
        " qualquer intera",
        "une fen",
        "en-PH",
        "zVTS1",
        "2}mbb",
        "/7+:6",
        "n en lokal katalog kopierar du alla installationsfiler dit igen och startar installationsprogrammet p",
        "1VF@D=-",
        "@3IKS",
        "r#Yn\"",
        "lf?D6j",
        "\\WWYg",
        "$\"oHO>",
        "Mm&BIRR",
        "qa|A\\",
        "ge at migrere alle drivere som en del af installationen. N",
        "%_#\\XJBh",
        "_H|-$",
        "V3L--",
        "sI1MB ",
        "l. A setupcomplete.cmd egy",
        "i8AO)N",
        "9dz6~w",
        "jet igen, og s",
        "tinas naujinant versij",
        "xGUndN",
        "n>O=7",
        "rxVr:",
        " nouveau.jUn espace d",
        "VJYKG",
        "Radnja: Instalacija ubacuje svaki .inf upravlja",
        "Q>HRA",
        "metros : Caminho para pasta local ou de rede que cont",
        "sEexf",
        "Uw2!>&",
        "Op0vW",
        "8r-_/u",
        "o do Windows de 64 bits, voc",
        "Qncmh",
        "fj(RA",
        ":H_(N",
        "s_1)y",
        "cego polecenia mo",
        "uBT7%W",
        "E)8p1",
        "oH_)'",
        "bwC7o ",
        "SQz*.>m0",
        "UG,;^",
        "fM}'R",
        "<nt--",
        "+gGc'-",
        ",|<],~Ng",
        "KHEy;",
        " pri in",
        "NQ2TB",
        "]TFiK,6C~",
        "q=zqwd/V",
        "A preparar a configura",
        "<B4%FV",
        "000@@@PPP",
        ",x6<)",
        "![$k\"u",
        "{tVoN",
        "/EEE%I",
        "Ps'dhE?",
        "IvgR\\",
        "Br3LtDa",
        "UpLI:7jfo",
        "G7Ds'C",
        "R&.YL",
        "cio de sess",
        "oh?QE",
        "0'W.~",
        "b{?gqEd",
        "z<rU*",
        "Oxr{A",
        "3@~ca",
        "4J4+&9g",
        "apam?=",
        "@'t%c",
        "3XfO |aB",
        "Parameetrid: Full; None ",
        ")[s#y",
        "3jb5*]",
        "Q')]o&",
        "mYyk~-",
        "t;SDsS",
        "hne. ",
        "(e;?B",
        "c)4K[",
        "Q]{XnE{",
        "V5fH3s",
        "Pd0;4s4",
        "ar-JO",
        "!?5mp",
        "bJ8e/Ag",
        "q:Jr\"",
        "^j-MQ",
        "UFxbu",
        "B:D`y",
        ")6FJ6",
        "#r-`/r8",
        "r3l6+",
        "Windows 10 installiprogramm",
        "X=f'Pt",
        "rb@;l[",
        "Windows 7",
        "A14nP",
        "?\",4Z",
        "ybS~c",
        "r`}]E]bQ",
        "0n04X@b",
        "ze_z2",
        "alisation d",
        "dB)m8%m:|",
        "^y<0b",
        "[PdM_",
        "[?MJK",
        "mHF;P",
        "dia, kter",
        "bu5l6",
        "YnV*G",
        "mQ)G6",
        "&quot;",
        "tter filen setupcomplete.cmd fra den angivne placering. Setupcomplete.cmd er et tilpasset script til at udf",
        "at@4<K*",
        "m;0,G",
        "8!EPv",
        "|@04=",
        "ReserveManager.dll",
        "m_r86g",
        "r6/1tG",
        "CreateEventW",
        "de-DE",
        "e7p#Zv",
        "UJ)le",
        "O6AOa",
        "I`+p'p",
        "Parameters : All; None ",
        "ExMWi",
        "Vv'rp",
        "es-419",
        "sa-IN",
        "\">f\\S",
        "+b>DG",
        "IxT\"R",
        "Y>2Uc",
        "`.N@<*",
        "OB(o^",
        "tLjl[",
        "r0N[E",
        "7GwvA",
        "292M3T3",
        "(-VK~",
        "v(u7b",
        "2\"ng?",
        "KZ8{L",
        "9k3Iv+_",
        "WLk 3",
        "/A~\"jVO",
        "/P&IC",
        " comand",
        "d7KUZ",
        "h.APG",
        "HL$.w",
        "<!-- Copyright (c) Microsoft Corporation -->",
        "Populating Dynamic Update files: [%s] -> [%s]...",
        "tGr`rt",
        "f|^pTx",
        "4mda3",
        ">_r4@#",
        "o?~?^",
        " galima naudoti tik testuojant ir testavimo aplinkoje. Jo negalima naudoti gamybai. ",
        "b;6[=",
        "}PtH}",
        "aPM0h",
        "V?~Mk5",
        "S:n\\6",
        " program Windows 10 nejde zad",
        "Ay7UB;",
        "@sEga9",
        "7a={|t",
        "EdN;q%",
        "Rengiama s",
        "IvUN)W",
        "~ZKO\\",
        "CDlpTask::PushChronicleResponse",
        "Y818\\i",
        "eZOckX",
        "!z/+P]!",
        " la mise ",
        "si el",
        "Ef [[-",
        ")JKy?",
        "N0fHG",
        "/B7ed",
        "Scenariobaserad anv",
        "UlJ+03l",
        "&Weiter",
        "L2o~ ",
        "lVe&6",
        "OtLfR",
        "anjem ne preseli nobenega gonilnika. ",
        "Fw|0?",
        ",B|c6",
        "\"nNcE",
        "s-0<Ci",
        " festgelegt ist, werden w",
        "V=tN|6",
        "{6Q:B}",
        "8uK_2",
        "        name=\"wtsapi32.dll\"",
        "Microsoft America Operations1&0$",
        "'keak-",
        "Y0;k{",
        "`Ys`q!",
        "o XML necess",
        "`'c3g}#a3",
        "2OYY8",
        ",O^'8i",
        "*lzmh-R",
        "&Geri",
        "8.xp@?",
        "sIm?u",
        "n6[*N",
        "AOyt)",
        "6pD|QH",
        "i!7(e",
        "1VM^V",
        "Die ausgew",
        "!*'cF",
        "ajte ponovo da pokrenete instalaciju iz prozora komandne linije",
        "x\"Ue[",
        "Z x_>",
        "e.GUn probl",
        "Bf$lc&3D[",
        "t\"]M7",
        "c\\ixX,?",
        ";-jBu",
        "m'H4a",
        "?-}[kz",
        "?A'(=^-6",
        ":CD(i",
        "M!Tl/B",
        "XWy=\"`sz$",
        "=1%K~",
        "WinDLP System Shutdown",
        "SP_DOWNLEVEL_TELEMETRY_ETW_SESSION",
        "yH//-",
        "Bh%A;",
        "c^-~]n",
        "?_o@B",
        "\\CP9N",
        "747tO",
        "YlpsuM<",
        "Compatibility",
        "U(Y\\+",
        ")tHw\"",
        "u;8&$",
        "^EiCW&V",
        "um pid.txt na pasta",
        "I8zW`",
        "lJ6uZb",
        "3e8#J",
        "dw\"EB",
        "|L M3",
        ":W:e:\\;z; <C<",
        ",6E-3",
        "ox\\[l",
        "`CcSsKl",
        "#c\"Q~G",
        "dA`B8>u",
        "(w+9,",
        "\"]z,pi",
        "-*ES>",
        "G8e=J2",
        "4FR%:",
        "@cerK",
        "y[C%Gx",
        "\\*sYC",
        "Deseas continuar?",
        "IZ\"U-",
        ";=8_?Z",
        "$C*$U",
        "PAL2h",
        "X`k!!",
        "DhW=F",
        "'|khDp",
        "|^{.O",
        "Hn?Y.2",
        ":oOe'",
        "x4CgH",
        ":Ap.2O_",
        ",I[\";X",
        "*u9z?",
        "Bx,tc",
        ";@#;U",
        "KhRlkU",
        "949W9e9",
        "q=Fbm",
        "/)\\8Q7",
        "G;YQ5?",
        "Il<kt",
        "namada ve s",
        " J (!",
        "efTN.",
        "pe1@x",
        "r_(rE",
        "ILNoP",
        ">g5`X",
        "mAdy>*",
        "2:lq>U",
        "rtVDk",
        "1%101D1M1W1",
        "MpVu0hN\\",
        "k(WYd",
        "9J|z$",
        "n1jwr",
        "qc{y=",
        "A5lqQ",
        "MyD3t",
        "o!~_\"zs",
        ":#;T;",
        "G$MAOc",
        ")/YBy",
        "o: a instala",
        "tws7s",
        "BeVp>",
        "dTx@d",
        " todos los archivos driver.inf que encuentre en la ubicaci",
        "Compatibilidade",
        "*B!7v;",
        "d!d%d",
        "?*H.B",
        " \"None\", OOBE ",
        "+xFxv!(",
        "tirmeyecek veya olu",
        "555(433",
        "\"eF5}",
        "Xh\"<N",
        "?0sn!YT2",
        "@Krs`U0",
        "VCiz%u",
        ",h}!>",
        "Commutateur : / copylogs <emplacement> ",
        "/TluC",
        "DafOv un",
        "es-AR",
        "0_k} 2",
        "mnMZ\\I{",
        "<6od}G",
        "Esempio: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "kilo problematProblema paleid",
        "]6o}J",
        "6\"626B6R6b6h6n6t6z6",
        "Pb\"%&c",
        ".Y;<kL",
        "p0q\"R+g,:",
        "Logs\\MoSetup",
        "q]_y0",
        "dTC@Y",
        "@wqJ&FSL",
        "8zu)9",
        ">npD7",
        "L2:Sp",
        "2u)Lq",
        "nj\"Fz",
        "CUpdateScenarioCtrl::Initialize",
        "r;]~'Z$Iwk{",
        "e uporabni",
        "`N\"mg",
        "(5:kf",
        "ratleda",
        "F-Y*x\\",
        "PPPWS",
        "8jf_1",
        "PEKcH",
        "6~>+4!P",
        "~-6Ck|2k",
        "R6U;b<",
        "uvBQox~<~Q",
        "<{T3h",
        "Parametri: lok",
        "%s: Showing OS Uninstall Warning.",
        "-L_<`&",
        "kmxf@",
        "X\\:UBB!X",
        "X]m\\&",
        ",>h1J",
        "Wlngh",
        "VzvUw",
        "zh-Hans",
        "f*yRX",
        " .'H=",
        "EInsV",
        "a=}KDB",
        "klad: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "ff-Latn-NG",
        "Sef +",
        "-&j]M",
        "IsValidCodePage",
        "Ad`W,NL",
        "  OF8",
        "?%1-E",
        "+m>J3J",
        " UEO%",
        "kxn+(j",
        "hT0c3",
        "Lowering priority for Azure Host scenario...",
        "ad: setup.exe / auto clean / installfrom d : \\mojWim\\customwim.wim",
        "- PC ",
        "^~^sI",
        "'`d=l",
        "D(mlP",
        "}mt\\G",
        "WdsCopyFileEx: Failed to delete %s. GLE = 0x%x",
        "zsN>:~",
        "U<?BH",
        "Exemplo: setup.exe / auto upgrade / migratealldrivers none",
        "x ;WA",
        "ab@8*",
        "EC[ H",
        "V6XMeL",
        ", lrF?",
        "CDlpManager::CreateTask",
        "{uKm&Xj",
        "zs+qa",
        "Qhrwbg",
        ")=8+/",
        "}#'mTq2",
        "Yh0zV",
        "OJ@3)",
        "1OJl,=",
        ".(qi3q/~|",
        "yM,59U",
        ">6zw(",
        "Im.DU",
        "n ve ard",
        ".?AVAFX_MODULE_STATE@@",
        "9\"y_/",
        "Pc^A<7#",
        "BCryptDestroyHash",
        "+Pe+U",
        "System\\CurrentControlSet\\Control\\hivelist",
        "HTente executar a Instala",
        "g)G\"g",
        "md&lc",
        "}Rsoi",
        "Zta@f",
        "Doz&adu",
        "e2oY5",
        "\"T`Hc",
        "Primer: setup.exe / auto upgrade / showoobe full",
        "tter installationsprogrammet. ",
        " na instalaci Windows 10?",
        "NB?Qr",
        "UF#Ru",
        "hr-BA",
        ":X>`_",
        "E;ID;",
        "4+4;4S4l4{4",
        "ka prilikom kopiranja medija bez postavljanja na tvrdi disk",
        "Z;[VyJ",
        "6n~F\\n",
        "1uR4XUi",
        "\"d2{3E*",
        "f\\4dO",
        "7E5ux",
        "-Wn'aP",
        " Microsoft Corporation. Vse pravice pridr",
        "Commutateur: / noreboot",
        "Bf5W(44K'E^-m@",
        "X9?Zp",
        "ncepe din cauza fi",
        "PP<nN",
        "D9aMAN",
        "4]UH^",
        "d~\\vNn",
        "Switch: / installdrivers <locatie> ",
        ", mora kon",
        "\\[O\"q~rw",
        "(o>mig",
        "l+6'5|",
        "3XOJ ",
        "EN_4|",
        "\\M+i5",
        ", hogy a helyes architekt",
        ";%;d;",
        "TaK5i",
        "tQF`6",
        "eP6]\\",
        "f2_Zz",
        "]Q322@",
        "tka sealt, kus mul pooleli j",
        "y=zkR~",
        "n: el programa de instalaci",
        " k0Ls",
        "oK[m+",
        "o-QX?",
        "e migrirati upravlja",
        "zAlJ(",
        "d?~KJ",
        "mSXD<P",
        "C}eQs",
        "@~zvb",
        "rankai nepavyksta paleisti senstel",
        "{dd7dP^",
        "b134*-'",
        "RqX<@G",
        "t97[.",
        "szORz",
        "OEJ3 ",
        "Action : indique la cl",
        "=fw?F",
        " wykonywane operacje aktualizacji dynamicznych (wyszukiwanie, pobieranie i instalowanie aktualizacji). ",
        "nW]4t",
        "jnV^Z^o",
        "KSusz",
        "Uj(goNc",
        "leQ(W",
        "JH))!%P",
        "b4puRvk(",
        "n~Xy'",
        "Wh\"}9",
        "Q^;hu",
        "o2A%*e",
        "KnxZ'",
        "ivatele prov",
        "j9)s\"",
        "85t6h",
        "xr_PiG",
        "Y$8p8",
        "? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\\?`?d?h?l?p?t?x?|?",
        ">LfZ*",
        "m. Pokud jste instala",
        "xv~8D",
        "N9_i#",
        "O7Bw9",
        "c{AV3",
        "KMYjf",
        "JF'v%",
        "zS2/s",
        "T<)rFL",
        ": setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        ". Setupcomplete.cmd",
        "opD)6",
        "u1*sW",
        "37vq/",
        "\\+sA?:T",
        "fQ9jE",
        "^9Tz+",
        "<1)QI 8",
        "!C>al",
        "If&\"X",
        "W`CY3",
        "%,p+`",
        "M*8Z1x",
        "E2;Ce",
        "+/62'",
        "*`-BG!:",
        "XWaHe$",
        "rWP)w",
        "vrM7j;",
        "-U]gF_%y",
        "|zv)?",
        "ii care necesit",
        "zttLLL",
        "liti: / migratealldrivers <parameeter> ",
        "<=yDC+",
        "/r*\";;`?",
        "o de recursos pode estar em andamento. V",
        "U{.n8",
        "m ficheiros .inf ",
        "aK%bh",
        "l^JW/yU",
        ":6W;!",
        "FbMZb)",
        "ZlP<~",
        "RStYh",
        "Rzy<9:",
        "Nr+W\"",
        "chr-Cher-US",
        "z|ZV^",
        ". Komandin",
        ": setup.exe / auto upgrade / quiet",
        "n3c60pm",
        "zZTcR",
        " : setup.exe / auto upgrade / migratealldrivers none",
        "E@bU]",
        "=6VJ|",
        "CX5Yx",
        "J_4Nnz4bO",
        "^;oH-}",
        "w\"X[U",
        "{\\{aF",
        "2s?1>",
        "-Sj/#N",
        "metros : Caminho para pasta local ou de rede para um ficheiro com o nome setuprollback.cmd ",
        "iZqK(",
        "`+Vv\"",
        "F4Z1z",
        "b(u7b",
        "c:/Lf ",
        "ker rekursivt gjennom alle undermapper p",
        "~`XH@",
        "lBxD \\",
        "5P[sPM",
        "1 1$1,1D1T1X1\\1`1h1l1p1t1x1|1",
        "}rZ.9#",
        "Windows Installation kan ikke startes, mens en anden forekomst af installationsprogrammet k",
        " Iestat",
        "U]P}!",
        "+:4{5",
        "=(bN7",
        " de produit 5x5 ",
        "Pp1&%;,",
        "gb%L)",
        "k`;\\C",
        "'y/!g}G",
        "d'xz>",
        "FH;A8",
        "3yrKl",
        "o: / Postrollback <local> ",
        "}JEt#",
        "vel localizar a vers",
        "X9i69Q6yg",
        "Setup.exe permet d",
        "`l03X",
        "MFCzTj*",
        "q>=)<",
        "kSxMy",
        "TNe;9",
        "Windows vNext worden uitgevoerd. Hierbij wordt",
        "U-SC)",
        "!{A~?",
        "ana, lejupiel",
        "\\OY=8",
        " kullan",
        "e6gp/",
        "a'?TdF~Tgd",
        "tre n",
        "bb2ET",
        "jWa9 ",
        "m<:c:<R",
        "Parametri: Upgrade; DataOnly; Clean ",
        "@cE{P",
        "[y <3",
        "{:G,K",
        " a/nebo u",
        ";b7F,",
        "GmF~g",
        "i`z!'",
        "(*;i*",
        "iv.|P",
        "Vb>K)f",
        ".-:/C",
        "37DJ;",
        "DJ`g[",
        "M9nf?",
        "WdsRemoveDirectory: Unable to prepare path [%s]; GLE = 0x%x",
        "wkXMO",
        ":(:9:@:F:K:V:]:m:",
        "&i[C%^",
        "^9Hw`",
        "9$a#2",
        "4uI/j",
        "\\Fpm9",
        "<'ZB5",
        "5>Av9E",
        "n. La instalaci",
        "r`=EP",
        "hQa\"W",
        ">\"I\"Q",
        "9Qu(R",
        "\\[T'2",
        "n~Me?U",
        "r Windows 102Installationsprogrammet f",
        "n en el directorio de nuevo y vuelve a iniciar el programa de instalaci",
        "czFu/$HOG",
        "O#eW^",
        "l\\3iW>w",
        "LvF`w",
        "P\\-/UJ",
        "3O$}?",
        "8[:np",
        "CH7uX}",
        ">99yaa",
        "\\>`Ev",
        "oikeuksia. ",
        "hQ}n'",
        "vm|!\\v",
        "en-ID",
        "/Y<By",
        "KvuQ*",
        ">I$KW/G",
        "5=F94x",
        "\\h5E4",
        "}#,[*",
        "(C3)T=]",
        "jy*b[",
        ";YyH}",
        "H4t7j",
        "gez. Rendszerjogosults",
        "38Z.mU",
        ".i?8-",
        "#Rm{W",
        "*>-<mP",
        "~D.;{qx",
        "31._v",
        "c_2w?Y",
        "*m.cm",
        "<Ff6\"}",
        "(I+PiZ",
        "#?CP6Px",
        "Am detectat c",
        " kaikki ohjaimet osana asennusta. Vastaavasti, kun valitsimen / migratealldrivers asetus on None, asennusohjelma ei siirr",
        "Gereken XML s",
        "qAXw9",
        "UDlb7t",
        "Nn!Hn",
        "oqLBx",
        "8t747",
        "+((>;+",
        "HKEY_CURRENT_USER",
        "5*%b_A",
        "anrxj",
        "*R3U1(e",
        "Q-ZF^",
        "<5/2_",
        "25NvQ",
        "{H>O%",
        "rer dynamisk oppdatering-operasjoner (s",
        "R/i0t",
        "2I7Yq",
        "jVc,OD\"",
        "L0cM`w]#",
        "9p>:b",
        "PWPU%",
        "Oe#NA6",
        "s local ou chemin d",
        "w?8zl",
        " %1!s!. Voulez-vous continuer?",
        "CvFak",
        "DeviceIoControl",
        "vqz>Kz",
        ",:ko+",
        "NSgcS",
        "Switch: / auto <migratiekeuze> ",
        "1.G{cc",
        "Njg9y",
        "b'G8O",
        "elite ve",
        ",$9- ",
        "Ac\"GNj",
        " Microsoft Corporation. Todos os direitos reservados.",
        "\\eG?3",
        "G>6r,",
        "+@'(W",
        "Ni)>u@",
        "n. Bu komut, sistem ba",
        "qps-Latn-x-sh",
        "ggfgv7^",
        "q cYL",
        "2&3|^ru",
        "j?_;g",
        "vgp<$",
        "tir olarak ayarland",
        "PA>Fy",
        "SIqG\\ct(",
        "0S0n0",
        "\\b#qy",
        "R9JTJ\"",
        " paketu.",
        "'X`;c",
        "(d*QW",
        "rVj@t",
        "mkDRX",
        "oFe^K",
        "a4;a7",
        "& :3FZ",
        "uRKu@",
        "o ter permiss",
        "Y}`%\\",
        "e,N.^",
        "ja pieteik",
        "|)`;K",
        "sv-FI",
        " des interruptions intermittentes du r",
        "t visus draiverus k",
        "?kBxG",
        ",)6G<",
        "yDW@;bU",
        "Ph`\"A",
        "Fh\"tx",
        "yR&$iCY",
        "T6t%Li",
        "?Bandykite dar kart",
        "RW0f0O0`0U0D0",
        "`QTTT",
        "OmiHr",
        ")N5BK",
        ".[R5<",
        "Uma administradora quer atualizar durante a noite os computadores do departamento que t",
        "AK{!s",
        "]kH3U",
        "cK`h1*",
        "metro tamb",
        "oO%kcj9{(yE",
        "BJc6wn",
        "'}2R|iw",
        "}<<(]E",
        "Uscire?-Sei pronto per l'installazione di Windows 10?",
        " quiere que los usuarios finales puedan usar de forma manual la instalaci",
        "OF0h0",
        "[i5<G",
        "]MU1t",
        "pPwoC",
        "[+ST_",
        "memcpy_s",
        "~QQ-=PU]:",
        " qbwZ",
        "%1317",
        "DeleteFileEx: Unable to allocate hardlink path buffer",
        "k^b>m",
        "'/~27",
        "0;{$7F",
        "t no vietas, kur tika p",
        "ia specificat",
        "O63V\"",
        "D`aCL",
        "a.@&{$s@",
        "Parameter: All; None ",
        "'+GVn",
        "Prebacivanje: / auto <izbor migracije> ",
        "DiS&'",
        "&=WZ\"",
        "9V6/[)",
        "b9*!k",
        "KkZqD",
        "8'_ci6.",
        "/Selfhost",
        "Handling: Automatiser installationen med migreringsvalg. Mediebrugergr",
        "nsIkS",
        "RUT Fb",
        "QflSQ",
        "4hdWw;#",
        "{{Goj^",
        "#A2$H~",
        "{mC|j",
        "ivateli nebo procesu p",
        "d@j/U",
        "`p;pR",
        "N`YISf*",
        ")rA;#P;a",
        "Mhf1+",
        "6u706z",
        "$)zIM",
        "Opzione: / auto <opzione di migrazione> ",
        "s de que se complete la instalaci",
        "^E6@&",
        "ic3=_i",
        " je pokrenut.nOva verzija sustava Windows nije podr",
        "!s5rk",
        " cu acelea",
        "n: especifica la ubicaci",
        "(n-DZ",
        "3uy6X",
        "h<L~+{*",
        "`Gp%xL",
        "9 Rt4f",
        "|b(Q|P",
        ":<bPu",
        "3vDCS",
        "p:[Gv",
        "n879^",
        "T#Ll}",
        "kPLFg*",
        "boh,o",
        "dgX;>",
        "Dv[.uf",
        "4,5V5",
        "qxcT`",
        "s^\\&c5",
        "4+af>fe",
        "kz<WoE",
        "Wews{",
        "v`0jm|]",
        "lwU.k[",
        "?Tj6}",
        "liti: / DynamicUpdate <parameeter> ",
        "sJZg1",
        "($a Z",
        "e'm+dQ",
        "?,;3z]G",
        " /O_F",
        "#\\]uW|l`",
        "(V>Z`",
        "o novamente",
        "lDt'qR",
        " Microsoft Corporation. Sva prava zadr",
        "UP\"|+^",
        "5ZmAz",
        "4*GIp",
        "L>X%bmU",
        "CNamestitveni program poskusite znova zagnati v oknu ukaznega poziva",
        "(SI;F",
        "AsN+?+9-",
        "DlpTask: Leaving Execute Method",
        "rnek : setup.exe / auto upgrade / quiet",
        "}H,;>_,",
        "u|TC5",
        "@Windows 10 ",
        "rab selle, kas installiprogramm teostab d",
        "6<a3;",
        "|I-C5",
        "d_~z ",
        "\\qo}+",
        "base\\ntsetup\\conx\\common\\setuplib\\src\\language.cpp",
        "AQb(]",
        "RSd2.",
        "z~dDN",
        "UDhK7,",
        "%=$Ve",
        "A,;F8u",
        "\\;;%<",
        "Tm$US",
        "=\\j)6",
        "eF!Pbks",
        "8*yPC",
        "Oq@s$",
        "SxYH+",
        "Fm~_H",
        "0TGJa",
        "+TNo#,Q",
        "W?AtC8",
        "3'3D3U3",
        "yF2&^",
        "cm-sdHU",
        "tR>+)",
        "n que invoque al script setuprollback.cmd despu",
        "h5R$fo",
        "1v38/_N",
        "m/$R~",
        "{arwO",
        "/-BDb",
        "){_2AE",
        "eE5QO4",
        "a*YtS",
        "VhAM_k",
        "Parengti",
        "=Wyx|)",
        "#xRew",
        "x~WEq>_E",
        "54cC]",
        "T+=L'",
        "cz5nf;",
        "PF#hm",
        " Windows 7 Enterprise ",
        "u1; f",
        "HS$Y*",
        "('aWib",
        "~*So(",
        "                                                         ",
        "DL8i4",
        "%O\\3=oM",
        "   @@@ppp",
        "Nqu|C",
        "w,c\\W",
        ">fK^*",
        "Xn C=",
        "sYG~JE",
        "Cz~q4<",
        "i versiunea pe 64 de bi",
        "o do utilizador apenas depois de a m",
        "#W]z;",
        "L$bDr",
        "L#JA*",
        "i>=,{i2",
        "rs: setup.exe / auto upgrade",
        "x0.y~n",
        "4.FE;",
        "Z+ep<",
        ", OOBE se preska",
        "`pe^o|",
        "pVYl#_",
        "5K1_0",
        "U3jg:",
        "?Q?k?x?",
        "${zLPc",
        "\\UxR)l",
        "kamaj",
        "fy-NL",
        "RN,U(y",
        "V~N62V",
        "Ns<iPk",
        " envoriments",
        "PF@I!",
        ",Sh*\\",
        ">}K$%D",
        "zBeTI(",
        "PPWhP6C",
        "'(klm",
        "~rm\\+W*",
        "om-ET",
        "ygd}B\\",
        "brH&F",
        "'P!fW",
        ".sh}6",
        "rt, ja / migratealldrivers ir iestat",
        "Z]Yc|",
        "1p>CX",
        "3Et{ ",
        "Exempel: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "m@mRb",
        "rer 64-bitersversjonen av Windows, m",
        "AL'db(Q",
        "A^Q,]/%w)",
        "?}4k-",
        "uvT<]GEO",
        "eT^V+",
        "VK'%[Y",
        "V \\Xk",
        "3OjYt",
        "uj(+s",
        "62HVlM13/",
        "<af#&",
        "=GG4-",
        ".2/P]",
        "=inQZ",
        "Pf-8Jb\\",
        "z^6OK",
        "o10QM?",
        " izinleri gerektiren konumlara kopyalayamayabilir ",
        "*{Oq.",
        "Priprema %d%%)",
        "DAETD",
        "KDJ.Y",
        "Yg0M0~0[0",
        "+T0ZW",
        ">vIS??",
        "7T7X:",
        "as in",
        "I{QMax9<",
        "g%FP:j",
        "nzZAO",
        "l6),H,",
        "y9H%_",
        "R#?O#",
        "lb-LU",
        "Qi-pF",
        "K]s)W",
        "ZXj2^",
        "Z\\mUe",
        "marrage de l",
        "!j)3V",
        "//APZ",
        "^1\"Q?",
        "0$gTx",
        "|[W]?",
        " : All; None ",
        "unar, a zatim poku",
        "s3^*H",
        "+V|XQ",
        "-\\9Ji",
        "3-:~!",
        "S\"fUm",
        "gz`;r",
        "GG`vn",
        "te instalarea ",
        "#I3~^l",
        "Ucvgq",
        "gi/=HW",
        "#z-/7R ",
        "n]EDM",
        "p+\"uV5g7",
        " celle du PC",
        " jsou soubory .inf ",
        "D>.:y5<",
        "sSoPV",
        "[IHyG",
        "=@6fBtaF|l",
        "<2_y#D",
        "Prepare",
        "Actie: wanneer / Telemetry is ingesteld op Enable, verzamelt en uploadt Setup alle telemetriegegevens die worden gegenereerd door de",
        "T:Z%.E",
        "8?ZE-bl",
        "Zka*:",
        "+gK9t&@",
        "tor zasunie v",
        "t=Ul4)",
        "mwAqM",
        "ite, ali namestitveni program izvede operacije dinami",
        "X_OG44",
        "|\\S>2e",
        "/@-$A0",
        "jM+6^",
        "7@) C",
        "=S)p2",
        "'3:&_",
        "{4_Q75",
        "'~)2p\"",
        "%s: Error = 0x%X",
        "I|Y2?",
        "AXrC8;",
        "vwU3[",
        "ZF-BS",
        "9lNK[T",
        "C6uKgG",
        "\\zO<FL",
        "\\ Yki-E",
        "T`:W*",
        "  SetupMgr.dll",
        "ho2l&",
        "Bt4U0R$",
        "%m4CZC",
        "Fl#^S",
        "a sa s rovnak",
        "s4UtX",
        "y9I#'",
        "mPy$[y,",
        "zc(id",
        "=r=-^",
        "J;\\3io+W{",
        "e>Sg\\",
        "n. La interfaz de usuario de instalaci",
        "u)/vb",
        " do za",
        "metros: ruta de acceso al archivo local o ruta de red UNC a un archivo con el nombre setuprollback.cmd ",
        "re installationsprogrammet. Frig",
        "t\\vG:",
        "\\|]bZ]",
        ":^j}b",
        "h0a/4",
        "EPg+9f",
        "`xY5}",
        "xxv*u",
        "5G)v%",
        "9k:1;",
        "U$VS(B",
        "PPP   ",
        "d_hjo-p",
        "n[T=C",
        "snGBU",
        "q/@-3",
        "-_{oL",
        "^Q^B)",
        "!jW U_u",
        "? /qtw",
        "PY*2W",
        "GiEZf",
        "=.iu_",
        "iu verziu), pri",
        "?(?=?F?~?",
        "P>)G]",
        ">x#y}",
        "v1g:n7:",
        "o PBR ",
        "->n9[|u8",
        "CreateDirectoryW",
        "p3}.!",
        "_5zr-T:",
        "es-VE",
        "RegEnumKeyW",
        "!VTf\\U",
        "~!F?8",
        "1/^.'",
        "Xhw#uB",
        "ZGIH2",
        "}BjK|[",
        "LWh4M",
        "N2(e_",
        "bk=V&",
        "CAzureScenarioCtrl::Initialize",
        "xnWok",
        ",Q8G-*",
        "f8jq'C",
        "Yx`P9",
        "ir(`ZF",
        "hr-HR",
        ",V%#Z#",
        "DY|]L",
        "        loadFrom=\"%systemroot%\\system32\\msls31.dll\"",
        ")SD\\u",
        "m:Q:uI)",
        "-xXYu",
        " festgelegt ist,",
        "Parametri: Lokalna putanja do datoteke ili putanja UNC mre",
        "~{'LO",
        "p1lz|`>",
        "!@zE'=",
        "N+^3G",
        "8nNdP",
        "SpremanjeTInstalacioni program ne mo",
        "ekAI~d",
        "r6rBj",
        ":at.s",
        "[)2bQ",
        "7VQfeb",
        "7gtyB",
        "\\}c:'F",
        "M\\-O-",
        "gokkal fut. ",
        "a_ria`",
        "en-US",
        "s du fichier local et chemin d",
        "Primer : setup.exe / auto upgrade DynamicUpdate disable",
        "Action: Set-up will not automatically reboot the PC when it completes down-level OS tasks.The next time the PC is rebooted, set-up will continue. ",
        "G2\\E#=",
        "JTJD%OT",
        "fM?Y8",
        "_A#oPI",
        "e%I?O",
        "<kj<kA+d",
        "(klJYMn",
        "n. Libera espacio y despu",
        "u%Yad.",
        "option de migration choisie. L",
        "Perjungimas: / Telemetry <parametras> ",
        "rLHgg]",
        "H~#[aP&",
        "Handling: Ved feil vil installasjonsprogrammet kopiere eller laste opp komprimerte logger til den angitte plasseringen. V",
        "Cv+4c",
        "]7~M=w",
        "fR-0Y$2Y",
        "rankos. Perkraukite kompiuter",
        "ndan olu",
        "{3NI]B",
        "A68`'",
        "vg7\"E",
        "/@c$@0",
        "QOITil",
        "zOh$G",
        ",U6)G",
        "?B?X?c?",
        "`QVu/",
        "^op??(",
        "L6){Y",
        "Exemplo : setup.exe / auto upgrade / quiet",
        "e izvesti celotno nagradnjo na Windows vNext, posredovanje uporabnika pa se zahteva ",
        "dfdH2#",
        "jheaB",
        "aN<>g",
        "=F:R-$",
        "G>T^H",
        "~?~7lg]",
        "@|%u[",
        ";uIqs",
        "f-,S)",
        "Impossibile avviare Install.exe",
        "Pavyzdys: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "n del medio de origen de instalaci",
        "[81{v",
        "*v\\,J#",
        "o?lUy",
        "nir;q",
        ":5K_n#hh3I",
        "feHbqQ",
        "velet: Megadja, hogy a telep",
        "1:2L2b2s2",
        "g@;{e",
        "G<(k|",
        "+9vPF",
        "D0Y?:",
        "a+\\H+",
        "Installationsprogram f",
        "zzu;e>",
        "u=y=U",
        "7(mQ)4",
        "KxpA^b",
        "vs inte vid uppgradering med volymlicensierad media eller media som har en pid.txt i mappen sources. ",
        ".R:&=",
        "CreateTask: Name = [%s], WorkingPath = [%s%s], TransportId = [%s], Flags = [0x%X]",
        ",=@1<:",
        "l minden illeszt",
        "CBootScenarioCtrl::CreateCommandLine",
        "P`^@n",
        "&Mc.k",
        "LgQ_J",
        " rodoma s",
        "Ox0B}w",
        "gJgeO",
        "_2GsP",
        "wt$yJB",
        "hq}~P",
        "P{(G}",
        "ppp@@@```",
        "\"[XIq",
        "na. Minim",
        ".T3.q",
        "G-:Mp",
        "A(VzL",
        "*V^[,",
        "\\nN&W",
        "=y1]S",
        "rcV |",
        "zRi:7",
        "9&qwtq",
        "O<J<Il%",
        "8$828S8m8z8",
        "~~~v|gf",
        "?Fz|.B",
        ".!423",
        "$_|*-",
        "@#]/{<",
        "59uBn",
        "VU:0k",
        "$JGx.:",
        "<=h<-",
        "#sG{1a",
        "McGRm",
        "xdgTF",
        "ar-OM",
        "kon\\%/d",
        "Preuzmi",
        "je nem ind",
        "vfGS7?",
        ";4;<;r;",
        "~HH;m",
        "met de lagere versie zijn voltooid. De volgende keer dat de pc opnieuw wordt gestart, wordt het proces vervolgd door Setup. ",
        "67nN8",
        "+g!rm",
        "P<S# |",
        "ZwTyU",
        "^FAwS%?-",
        "hn,4.",
        "n que diga %s bits. Cuando lo insertes, el programa de instalaci",
        "Lkf6s",
        "*HMxs~",
        "9y%`x ",
        "0s7a2",
        "n Windows 10 -version, et voi palata edelliseen versioon %1!s!. Haluatko jatkaa?",
        "._P/n",
        "letim Sistemi",
        "da u toku. Posetite lokaciju Windows Update u okviru aplikacije Postavke za vi",
        "|z_3t",
        ";z2h'",
        "OjRvg",
        "p1?X&",
        "{xJ?^%O",
        "LA4-]M",
        "r~u_xM",
        "paX=/",
        "SetWindowLongW",
        "iKMiKy",
        "5+3(`",
        "I3]=D",
        "xAC{kP",
        "kst instal",
        "Gmi'K",
        "@t#%]",
        "97$Yd",
        "jw}!m.",
        "ou o programa de configura",
        "<\"_J\\",
        "=z]{p",
        "avF]C",
        "&XuY;@",
        "ytjpP",
        "4zloL",
        "0c7D1",
        "3&\"Mj",
        "*y#a!Y",
        "?+@dav.",
        "n keer een Windows 7 Enterprise-upgrade uitvoeren op alle",
        "4=J/}",
        "xH;y&",
        "Commutateur: / quiet ",
        "9\"2Kf",
        "AL5v:9C",
        "^9jSYj]",
        "O*u4\"L",
        "1MjJ[y",
        "!JG-Q{",
        "*z2udg",
        "Setup.exe installerer eller opgraderer Windows. F",
        "9)U}gky",
        "mesini istiyor.Yaln",
        "\\s]o1Q",
        "_Q#nW",
        "A-=Rk7",
        "9/)ie=w 5",
        "J=Xq,-",
        "{[U<SD",
        "4 565A5d5",
        "lVVb0Y|",
        "EnumerateDirCallback",
        ": / auto <sp",
        "Z[hRs",
        "a1}!#Ue",
        "VEdLlN",
        "uY]QW",
        "thz)6]",
        "kaMapa\\ZapisniciONadogradnji",
        ". Setuprolback.cmd",
        "h_Q9Q%w",
        "~JB8Fx",
        ";.j~q",
        "FW}Grt",
        ">*UHs",
        "kBf]0",
        "^/Bgt",
        "TfqeG",
        "9+?uO",
        ":\\eC(",
        "Olp-6",
        "ui1jI ",
        "rO?Y ",
        ".zDct",
        "Actie: Setup 'injecteert' alle",
        "ei<6`",
        "la-001",
        "qOr!g8",
        "6={SI",
        ";&;6;J;P;",
        "4|z=>=T",
        "Switch : / quiet ",
        "Example : setup.exe / auto upgrade DynamicUpdate disable",
        "6/[}Omr",
        "yg1`h",
        "ana nevar palaist, kam",
        "Z[$L~I",
        "mNA0-",
        "d[*4c",
        "E2SA^@8",
        "V\\F\"K",
        "K(kaWS",
        "47U'rw",
        "zOC{hYw`",
        "Compat Resume Found: [%s]",
        "iA^`<0!",
        " stejn",
        "Xw'X:?3",
        "Action: Injects setuprollback.cmd file from the specified location. Setuprolback.cmd is a customised script to perform tasks after the installation fails and the PC has rolled back to its previous OS. It is run with the same privileges as the user or process that launched set-up. ",
        "E(w.S",
        "dzis: / showoobe <parametrs> ",
        "0/f&T",
        "9&^w]",
        "#jm^>P9<o",
        "KdTHm",
        "Rm+%.",
        "=Mo$IV9",
        "p-U|b",
        "x`|2b",
        "XoXC'y",
        "l!'*%s",
        ", ant kurio u",
        "t1^f;",
        "CS)mL",
        "s,H'A&",
        "G8qq8",
        "2in/]",
        "utilisateur. Il est ex",
        "Compatibilit",
        "W)@xe",
        "Commutateur: / showoobe <param",
        "qc%zn,",
        "_|piJ",
        "kog interfejsa",
        "q$h3K`~I",
        "cznik: / installdrivers <lokalizacja> ",
        "5F5`5k5",
        "4jptu",
        ":KmTwT",
        "NF~dL",
        "Hv%w]",
        "1{mSV",
        "w_W8nbU(",
        "iDTP|",
        "'li,Z",
        "WSLpTo",
        "gqaf42",
        ">I!>HH",
        "Zi;hk",
        "CzfAC",
        "W[6X5",
        "-W b'",
        ": :$:<:@:X:\\:t:x:",
        "        loadFrom=\"%systemroot%\\system32\\kernelbase.dll\"",
        "Dejanje: namestitveni program v primeru neuspeha kopira ali nalo",
        "alt5q",
        "[usP6",
        "I=Mk`",
        "seau et qu",
        "r / Telemetry er satt til Disable, samler ikke installasjonsprogrammet inn eller laster opp installasjonsrelaterte telemetridata. ",
        "qeYYV",
        ",6~/79i",
        "_Xhjb",
        "7b^3z",
        "bO'~H",
        "7&+~_-",
        "Switch: / copylogs <location> ",
        "AyEST",
        "Xe>l>",
        "SetCurrentDirectoryW",
        "M_EHO",
        "I;mcj",
        "pYV'H",
        "RKzZj$",
        "{dvG&b",
        ",-4H+",
        "w-t'-L",
        "i spa",
        "C$xWgMM",
        "`_pKN",
        "bW0_0",
        ":`I@>",
        "H2;IV",
        "ea la calea de fi",
        "mu&[G",
        "yB_/Y",
        "D mgu",
        "`\":4O",
        ";O];5",
        "$`<:[",
        "eG3RBE",
        "yLt_5O",
        "WnGwpL",
        "B+j/6",
        "mDN-~",
        "Eylem : / showoobe Tam ",
        "b`G_,",
        "IZLgM",
        "h`o5a",
        "sta. Uvoln",
        "ver och standardinst",
        "vyBcGx/",
        "NXxN<7",
        "2]fsjE",
        "|n%0M",
        "K;-dSp",
        "A:9?G*",
        "H0YM O",
        "Nijedno",
        " naujinimas. Nor",
        "YU&,'",
        "Vn@+b",
        "R mS_B",
        "metro : / quiet ",
        "VZjEDC)LK",
        "hlte Architektur stimmt nicht mit Ihrem PC ",
        ": / Postoobe <hely>\\setupcomplete.cmd ",
        "ko)%j",
        "#:fzH",
        "I#wZR",
        "Voorbeeld: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "||;C9|",
        "cie dod",
        "*FYQ2",
        "i putea reveni la %1!s!. Continua",
        "7tAXAZ",
        "Vizita",
        "ro-MD",
        "UqXdW",
        "jrakezd",
        "BKY~}r",
        "en volyymik",
        ".?AV?$CZeroInit@VCMoReserveManager@@$00@@",
        "@ij-0",
        "@XMh*`=",
        "e?)=#",
        "n}YrK",
        "$QR(i",
        " Action : Procure au programme d",
        "-&Hy_",
        "1E>\"&",
        "ia suportului fizic surs",
        "q>u&^",
        "T=?v'",
        "$K?WN",
        "nhKD4",
        "#239QVa",
        "8jJZD",
        "eZ0fxkT",
        "[zd'^",
        "O*7={",
        "7x$`\"",
        "}I0\"V",
        "|Iiy1",
        "Zp4ky?W",
        "`~\"CI",
        "?feYla",
        "si adathordoz",
        "#&2k;",
        "c/LO:;e",
        "Le programme d",
        "nb-NO",
        "-){gH",
        "=$=m=",
        "$|?Ew",
        "e<gGu",
        "OxSb]tt",
        "npvD ",
        "nea de comandos.TLe programme d",
        "Programa Windows Setup ni mogo",
        ">?O%KQD",
        "(7Y(O/&3",
        "OsUninstallWarning: Os Uninstall Source Version [%d].",
        "6bfw`",
        "tq[qB}WV",
        "klaV\\",
        "WdKsn#",
        "e>,Y-m=Y",
        "a(cMyh",
        " :cBMh",
        "%zqx+",
        " denn",
        "installation injecte tous les fichiers .inf de pilote trouv",
        "Ai;vA",
        "zc|B&",
        "pjU8+",
        "\\W//rL",
        "q_:Q&",
        "jYUB%W",
        "8O!1>=17",
        "s2vx+",
        "M;$wb",
        "voortgang",
        "2h\"%?`hgAW",
        "lo je do problema pri pokretanju instalacije. Zatvorite alatku, ponovo pokrenite ra",
        "$]g4P",
        "o2ltt",
        "|4u(6",
        "}_t} ",
        "p+[g@",
        "AVMPY",
        "tire>Instalarea nu poate lansa experien",
        "e par l",
        "qzG2\"",
        " : setup.exe / auto upgrade / showoobe full",
        ";g=w{",
        "Anahtar : / installfrom <konum> ",
        "Uq49x",
        "qy_!r",
        "Vd;'_5iW",
        "OH pB5",
        "e ako ako s",
        "1rn1|",
        "&xYXl",
        "\\l~^,",
        "17i!}t",
        "hnout",
        "cznik dodatkowo przyjmuje nast",
        "gdE5N",
        "r~rkW",
        "X,Xv\\",
        "6>.U}'",
        "NJV&*3",
        ", sta",
        "Action: The quiet flag will suppress any set-up UX, including rollback UX ",
        "sti nuo ten, kur sustojau",
        "yciu no",
        "hCmAD",
        "n a migraci",
        "Ocorreu um problema ao iniciar a Configura",
        "Q\\G=n",
        "0?T$@0",
        " niveau pendant la nuit les PC d",
        "Operativsystemet Microsoft",
        "GUv* u",
        "ByXh{",
        "y\\$:+Js",
        "jrset",
        "\\y].;",
        "cT/x^",
        "#+O5[",
        "sV]Hu",
        "UNC-netwerkpad naar het bestand setupcomplete.cmd ",
        "? ?$?,?0?4?8?<?@?T?d?h?l?",
        "_hTvq?",
        "Ss`k(",
        "DW-cH",
        "|[#Il",
        "aK#G.{",
        "qE=shE",
        "5cbR0",
        ",D=n1|",
        "20`=:",
        "es-CL",
        "o : Quando / Telemetry ",
        "kZ\"+ ",
        "i stisnjene dnevnike na navedeno lokacijo. Upo",
        "e vyb",
        "TTZfbO30$",
        "yhG}3",
        "KoI ,k",
        "_hD$4w/",
        "v>yQUvq6",
        "wT52Ka",
        " atualizado ou criado. ",
        "r*Rp'",
        "g till en fil med namnet setuprollback.cmd ",
        "neell",
        "a utilizatorului pentru instalare, inclusiv cea pentru revenire ",
        "|=,[O",
        "'u?r(9",
        "(Ie':",
        " Setuprolback.cmd ",
        "lemleri(g",
        "k{Tz/",
        "{9c09N",
        "+(3~L",
        "@,ColAo",
        "s?]noC",
        "=mtTE",
        "]I?b>F",
        "H{Jdr",
        "VZUE3w@th",
        "btEy ",
        "4ehekU",
        "l-^xCIY",
        "wietlane, ale s",
        "CE, A^",
        "KO2k5UMH[M2",
        ":/ installdrivers <location> ",
        "\\D#R]'",
        "zx4=p}",
        "anie skryptu setuprollback.cmd po wyst",
        "gL4lvY",
        "ag9GVl",
        ":>aE5",
        "5am\\-",
        "IbD/Jje6",
        "ib*D>g",
        "g11Cl@",
        "rTS)A",
        "n2Rn6",
        "R@~)0",
        "b#FE#q",
        ".?AV?$CZeroInit@VCUpdateScenarioCtrl@@$00@@",
        "godqG",
        "X:]{0",
        "1RjyX,",
        "W2J_A",
        "k;TRUy.",
        "{GoKh%",
        "(b{eD+",
        "@NBc+",
        "0@P$A0",
        ".wpL`",
        ".mhU^",
        "3Dsn%",
        "|LtD{",
        "bWd{5",
        "L]^Ip",
        "9dsRq",
        "xSnpS",
        "-`[18",
        "U>3v11",
        "Exempel: setup.exe / auto upgrade / Telemetry enable",
        "diaire du support sur le disque dur",
        "*\"b8+",
        "5t'it|",
        "Comutator: / noreboot ",
        "EEE@SP",
        "rt, ja / PBRUpdate ir iestat",
        "CDlpManager::DeleteStringProperty",
        " nurodytos vietos. Setuprolback.cmd yra tinkintas u",
        "sPk~x'",
        "ar-EG",
        "A<+xs1^",
        "q+f&j",
        "tre a PBR part",
        "ftc$M",
        ";$px/>",
        "XO8*o",
        "#/yKry_",
        "fr-SN",
        "XPSh@",
        "i kasutajal peab olema m",
        "wU%Q6v",
        ">NE% t",
        "\\VarFileInfo\\Translation",
        "MOP|-",
        "EF+PG",
        "yNlq4",
        "Od,V?",
        "8)y\\-",
        "R(Uc>v~GR",
        "9pxgC",
        "=:imo",
        "2qG3F",
        " 5x5 ",
        "&Dm)1",
        "\"H<!s",
        "<H4D5r",
        "m -+k",
        ";lP{[wt",
        "@}\"p?",
        "t+2*d",
        "_2?V=",
        "/?$$@/",
        "2E2J2P2h2x2}2",
        "|ij+^",
        "rjestelm",
        ">?3_7",
        "$qqfPd`h",
        "EZB&W",
        "(?N>CN ",
        "]o,auB",
        "P&_dl",
        "U{8bW",
        "v[WY\\j",
        "r%gO_",
        "vOR/\"",
        "RNlu#}",
        ",RPKe",
        "47mfU",
        "QgQ;=",
        "l<_&{T",
        "SPCleanupInstallationDrive",
        "r inte anv",
        "a|[>(",
        "u$]C|n",
        "_KK21",
        ":r0=Q",
        "be, kezd",
        "zati helyr",
        "<5v&N",
        "vw.jk]k",
        "Attempting to clean installation drive at [%c]...",
        "{O`0g",
        "4>;/+",
        "BTmOOiy/",
        "chec, le programme d",
        "o>\\setupcomplete.cmd ",
        "rk+905",
        "[hQGS",
        ",?Z`:f$bv",
        "aEpY(",
        "`;W=^M",
        "IDREF",
        " prep",
        "8VGQ*",
        "229861+4583590",
        "WAu^|",
        "_K%4qW",
        "11BS9",
        "e`$QF",
        "@;mP?/S",
        "I|wAV",
        "]4ik`M",
        ":ew/P",
        "i!.P7",
        "w~vgw",
        "?goa_`",
        "m haklar",
        "+{qVW",
        "MOukx",
        "<!x>Wa",
        "<'VN-",
        "L,-U@",
        "%'n?Oe",
        "lrZ/6",
        "i2S4P",
        "1\"1A1]1d1",
        "a*qCvA",
        "8m@Sbn+",
        "8~0dj",
        ":C\\u9",
        " z'5B",
        "Z55O2L",
        "78=6g[",
        "f~*J;",
        "}@'~m",
        "Bqv/]",
        "tfen ",
        " : setup.exe / auto upgrade / PBRupdate disable",
        "c%U};",
        "G%hU~8",
        "GDu@m",
        "Sx0^_?b",
        "H>?:3",
        ": setup.exe / auto upgrade / installdrivers c:\\myUpgrade\\drivers",
        "terekkel m",
        "ML\"G^",
        "+<S>+IIf",
        "anas programmas (paz",
        "\\s-;T#",
        "7r\\/{",
        "tc<^O",
        "f[jbL",
        " hodnoty. ",
        "qQ8It",
        ": / installfrom <hely> ",
        ".?AVCCriticalSection@@",
        "rgDPC*",
        "AkT<kl",
        " obsahuje soubor pid.txt ve slo",
        "$655#>V)",
        "NRWZXh",
        "<0<a<",
        "\"qd8&",
        "6Z?Ey",
        "0K/??",
        "Lan^@",
        "re alle drivere som en del av installasjonen. I motsetning til n",
        "Dejanje: vstavi datoteko ",
        "1a|={",
        "anu, pabeidzot zem",
        "X~b9K ",
        "[(e^T",
        "1(141@1L1X1d1p1|1",
        "Y4+x3",
        "U,bos",
        "v/}`:",
        "g=5qk",
        " sequencialmente todas as subpastas da localiza",
        "JFgMZ",
        "&~LZ.'",
        "b]?4\\",
        ".\\%s.mui",
        "Forts",
        "i8t40/",
        "lv2%:",
        "$Hi`O",
        "9!_Gg",
        "?t>/bk",
        "~Lzk3",
        "y%N@x",
        "n &JB",
        "fJz!<",
        "rnek : setup.exe / auto upgrade DynamicUpdate devre d",
        "2LY0Lk:",
        "jT'SK",
        "2mfUvv",
        "QM0%?",
        "2ZPB+x",
        "nud7b",
        "HeapReAlloc",
        "W>F*r",
        "NT9|l",
        "+|'T*",
        "Switch: / pkey <product key> ",
        "*#h-D7:",
        "_ukK|5Z",
        "taken worden uitgevoerd na een mislukte installatie. Dit gebeurt nadat het vorige besturingssysteem is teruggedraaid op de pc. Het script beschikt over dezelfde",
        "`dC#/",
        "r die Installation von Windows 10?",
        "LC,GVU'",
        "\\|v1yv",
        "0Ujz\\",
        "^NB<Y",
        "=.(_=",
        " galima valdyti vis",
        "limo pasirinkimas> ",
        ":rBuC",
        "Eksempel: setup.exe / auto upgrade / PBRupdate disable",
        "/hHjx]",
        ">:J}*u",
        "A@;ALt",
        "}b|>>",
        "oEvh{I",
        "~=zk9K",
        "(%U>*9",
        "MoveFileExW",
        "|Q<C-)",
        "CDlpManager::GetTaskIndexByName",
        "L!c}*\\",
        "D$@WP3",
        "        </application>",
        "-&YqW",
        "K\\$W\\",
        "k\"9F\"",
        "~qWqOq",
        "Remapping DBG_TERMINATE_PROCESS to MOSETUP_E_COMPAT_TERMINATE...",
        "( 92E",
        "]34r2b",
        "Mvfg,",
        "39Jm3",
        "eU][E:5Q",
        "N0yFG2M",
        "gcr!w",
        "Sy@(K",
        "Ew\"L^",
        "+oTS-rZ",
        " bR:guc",
        ", +zo",
        "o e a seguir ao PC ter revertido para o SO anterior. ",
        "P=\\Pf",
        "vsre>",
        "2?!? ",
        "eq.se~\\",
        "P:PU87#",
        "bl*t6 ",
        "BQHJQ",
        "FYSKS",
        "vO\\)3%S",
        "seO-Du3N",
        "marrage du programme d",
        "rii, ci vrea ca utilizatorii finali s",
        "%bM-[",
        "e se uz sistemske ovlasti. ",
        "fiZy 8%M",
        "_E}_!",
        "Parametrar: produktnyckel p",
        "1Vp04Y",
        "AhrmJ&H",
        "mpCW|",
        "1MDP*P",
        "pertoire local, recopiez tous les fichiers d'installation dans le r",
        "Creating path: [%s]...",
        "KI{ c",
        " OEZ-",
        "~1pAk",
        "n;kgH",
        "1xGGI",
        "\\SiZf[<",
        "BCryptOpenAlgorithmProvider",
        ";^[d~",
        "Exemplu: setup.exe / auto upgrade / installdrivers c : \\pentruUpgrade\\drivere",
        "not already",
        "Dv$sI+",
        "iKe2;Fg",
        "4#t{<",
        "y5sQ@g",
        "CDlpManager::GetPriority",
        "hed@>%",
        "m]E?1O",
        "Zn>M'*",
        "S%\\+4",
        "@yI#qWK&+",
        "Impossibile avviare l'installazione di Windows durante l'esecuzione di un'altra istanza del programma di installazione. Un aggiornamento delle funzionalit",
        "zdm.mS",
        "}Nt$T",
        ":2vWj",
        ".UGU0",
        "'~$af{",
        "Windows 10",
        "N|lg]7",
        "|~+K~v",
        "RW0f0K0",
        " :q1v8E|f",
        "\"69dK$",
        "us=\\/",
        "Oficio",
        "mbg=&wh",
        "lgende kommandolinje ber installasjonsprogrammet starte skriptet setuprollback.cmd etter en mislykket installasjon: ",
        "0__;\"",
        "::we\\",
        "6f`OmD",
        "m'PUVU;N",
        "LSW@5",
        "sR=fV",
        "Z|{wG|",
        ":]k<^",
        "_V^T2",
        "hd\"0}7k",
        "kaz setup.exe /? v ko",
        "*IB(A",
        ")W{4t",
        "Fx\\V=G8s",
        "PK:Np",
        "su dator",
        "rloppssk",
        "0?.@z{~@1",
        "%:BVf",
        "y(~L}zM]",
        ")`9^=`",
        "fXAau",
        "Primer: setup.exe / auto upgrade / quiet",
        "W\"=4;",
        "6+#Qw(",
        "70MCz",
        "Ri_\\v",
        "Parameters: Local file path or network path to a specific.wim ",
        "uy%c|_",
        "zp:Zt:",
        ")20G:",
        "9O9Y9",
        "|>kcNhV",
        "p8a#TJ",
        "Ot(3A",
        "yKz@*",
        "[9~EI",
        "4]P7/<@",
        "s UNC h",
        "|O|J\"",
        "<yxxxd",
        "5L0zNtk",
        "T`\\__U",
        "RkYHN",
        "5 (\\9",
        "B8)F*",
        " Windows 10, ",
        " nytt, og s",
        "pHa8,WB\"a",
        "rbered",
        "ft9y PK3",
        " eilut",
        "OF04X",
        "XUyf.",
        "AX'^2",
        " [Windows Update] ",
        "cursive dans tous les sous-dossiers de l",
        "&nuGK",
        "$=Ck#",
        "!bLR|(",
        " ja lataa palvelimeen asennukseen liittyvi",
        "fIYU_",
        "o especificada. Note que o PC e/ou o utilizador tem de ter permiss",
        "^~sA\\",
        "te Windows vNext, n",
        "pYzVG",
        "HMSwi",
        "0`b#w",
        "@D \"X+d-D",
        "Exempel: setup.exe / auto upgrade DynamicUpdate disable",
        "3h\"iN",
        "4Arkitekturen du valgte, samsvarer ikke med PC-en din",
        "KU]l[",
        "mf.(8.",
        "HSNMA;",
        "izmanto ",
        "bhC8N",
        " driver.inf, ",
        "OPf,~",
        "E76Z_",
        "/1A(F",
        "EG8Fz",
        ";6Z`x",
        "8L Xf",
        "t0t0t?t?",
        "OM8;E",
        "Prejdite na: %1!s!",
        "TeSf`",
        "hT!>{U",
        "j9Sy83",
        "{BvFo",
        "sCS=G",
        "$D`\"\"",
        "!EYe|",
        "*?3gv",
        "6+ %mC",
        "Rx[5`",
        "6#7p7",
        "}rO7+",
        "gh&hH",
        "9qV990E",
        "\\Qa(=",
        "&#FHswm",
        "`4o`0",
        "`k!oK7Z",
        "9ZZBK",
        "es predefinidas: aceita",
        "]eUOK",
        "qjOfL",
        "eniu Instalator systemu Windows 10 zostanie automatycznie uruchomiony ponownie.-Nie mo",
        "El programa de instalaci",
        "hemalt 350 MB kettaruumi. Vabastage kettal ruumi ja proovige siis uuesti.wKui installite selle Windows 10 versiooni, ei saa te enam versiooni %1!s! uuesti kasutusele v",
        "xJ>s4#",
        "f=WugYX",
        "B>-#K",
        "CommandLine: [%s]",
        "ring (kjent som OOBE). Denne kommandolinjen kan brukes til ",
        "1Ca r",
        " fMP0",
        "aN+NZq",
        "NF'HA",
        "anas programma apkopos un aug",
        "#hELQkxW/BW",
        "gi licencelt adathordoz",
        "Hz_%J",
        "ts}Ow",
        "a;0Ra",
        "_oGp/O$tD",
        "   <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\">",
        "Ph0ZA",
        "adfmL",
        "Windows 10:n asennus ei hyv",
        "7(d@ ",
        "aMARDt",
        "f1C>YQn",
        "444<4D4L4X4x4",
        "Cot>&",
        "@E=z,o3",
        "Wzi *",
        "Um<[/",
        "etky s",
        "Z^'on06",
        "(IVOB",
        "P}e67",
        "m assume as seguintes configura",
        "?M]R.{+d",
        "@H^;_CO",
        "]9'44]",
        "\\!gee",
        "n|]g]",
        "LZoy@",
        "[&|_oz",
        "N{H:bs",
        "gBD(n",
        "F=y)`1r",
        "X!\\~/",
        "m%7QsJo*",
        "u86cPg,",
        "\\d\"7E",
        "CDlpManager::CheckInitialized",
        "v(k8*",
        ".=`$~",
        "*FWR^",
        "l3v6o",
        "Iu1gm",
        "gJ|;q",
        "}t0f4S?",
        "6]N(=",
        "9j>n:9v",
        "JnYVg",
        ")h/SP",
        "1|3W=",
        "ivitanud installiprogrammi kohaliku kausta kaudu, kopeerige k",
        "r6G'p",
        " la migration d",
        "4`$:4",
        "=&.NNk,",
        "I&SG%Kp",
        "S5PJ\"",
        "Aze31H",
        "D{!_r",
        "|PX3-",
        "#_kn\"d",
        "`4r:9n",
        "5#6W6q6~6",
        "1\\1r1",
        "\"+rlI",
        "l$;[q",
        ">&>N>b>y>",
        "-PlL^",
        "metros: rutas de acceso locales de archivo y rutas de acceso de la red UNC ",
        "wmlZd",
        "OV}}@r",
        "n presupone las configuraciones predeterminadas que se indican a continuaci",
        "fc?JmZ?",
        "zRrl7",
        "ADc1-_V",
        "#*~>q",
        "je vykdykite ",
        "lgjTM",
        "7A7R7W7]7w7",
        ":';=;H;k;",
        "iune: furnizeaz",
        "~YYmg",
        "/`DI(",
        "O\\z$-",
        "Ny@IC",
        "{&ZIl",
        ",~3zqGk",
        "hB:\"_[m",
        "y|3|s}",
        "M>8[c8P",
        "s2.;`%",
        "se vagy l",
        "<\":c_",
        "i>w\\)",
        "%s: Setting Install mode...",
        "7j*G{{",
        ")Hx{ ",
        "JO!;tWi",
        "&vYgt",
        "Co&ncluir",
        "|yw0]9",
        "&Finish",
        "Failed to Mark [%s] directory as Hard Reserve: [0x%X]...",
        "rk, at pc",
        " F33[",
        "cyx?~%",
        "k6puZ",
        ",.F^N",
        "<>_E4=",
        "(pff&!",
        "R|lMQ",
        "dzis: / pkey <produkta atsl",
        "kom Service Pack 3.qPou",
        "jUm<EE_",
        "TYHYI",
        "CDlpManager::GetStringPropertyCount",
        "`O-D$",
        "ejS-i1",
        "EZ3|&",
        "18l?KQ4",
        "X*a'zQ",
        "-B*t~",
        ")f\"g6",
        "f=7B1",
        "U+-gtOJ",
        "4,%p2",
        "s{&4t",
        "hPnRR",
        "tevajte, da mora imeti ra",
        "fVa*)7",
        "a{DPa",
        "T7X|8",
        "6CJm>",
        "wExq_",
        "E}nOZ",
        "rYSMe1",
        "5(5H5P5X5`5p5",
        "I0]]Zc",
        ",jbXt'",
        "E,E,G",
        ">wJa.ks",
        "o\"z9&",
        "<hVc?Mg",
        "boxtool_generated01.cab",
        "DGM7/",
        "DG`)0",
        "#l8st",
        "CK|]{\\",
        "co8&MC~mt",
        "es. Ce param",
        ". Veuillez noter que le PC et / ou l",
        "We treffen enkele voorbereidingen",
        "`vcRE",
        "~M(Uv",
        "z4pOK\\W",
        ":6NlJ",
        "9fViA",
        "A6N'i",
        "l6JBVGJ:>eONa",
        "7$e>!9",
        "M%RabmI",
        "z3?IB",
        "GetShortPathNameW",
        "7.]3o",
        "b9(F}",
        "];Yz4",
        "(JnL4",
        "eGXw^G",
        "yX]UB",
        "sALJ_AW",
        "W].{c",
        "6gE:Ab5",
        "zozOx",
        "aA%3EJf",
        "Ejemplo: setup.exe / auto upgrade DynamicUpdate disable",
        "Preparing setup ",
        "ON}?!d",
        "tWY4)1",
        "n{)CW",
        " : setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "D$8SVWj",
        "Ctu&Z",
        ")w IR",
        "Wh(m@",
        "        loadFrom=\"%systemroot%\\system32\\wimgapi.dll\"",
        "#9 \"D>9",
        "dvl:,H\"4T}",
        "<KD^[",
        "w+=1D",
        "{!ydE",
        ".?AVCDialogEx@UX@Common@ConX@@",
        "CW==s<",
        " &>|9",
        "QI\\5?I",
        "0?0r0",
        "bhq-^Y",
        "3byF,",
        "ti paleista, nes tr",
        "e uruchomi",
        "{|||{{qokg_[S",
        "\"=)='",
        "GL64L",
        "QzT.(0",
        "i4Fbn",
        ".wdkS7a\\",
        "d3w_(",
        "4`$5`",
        "P)oG[",
        "e;C/w",
        "OI}kQo",
        "DP$)(\"HT@",
        "h,^6.y27i",
        "-<,<\"",
        "f)]$Y;@",
        ".(Jh&",
        "y|?dZ'2}Dd:F",
        "p4jz*<",
        "k<W@W",
        "[-IF\"k",
        "etky ovl",
        "-7Uf(",
        " uzst",
        "L9^`E",
        "mgztQ",
        "enje za postavljanje3Instalacijski program ne mo",
        "af1im2",
        " executa",
        "VOG\\,@k",
        "Uv/{f",
        ";oxdP",
        "Q`\\F0!D-T",
        "Rq;;%",
        ";Bo_8zQ",
        "aInOUS|",
        "9.d96^>!m",
        "CV.Xu",
        ",\\0Ek",
        "7Fm=H",
        "@tax~",
        "gWSotc",
        "D^_UT",
        " registros comprimidos a la ubicaci",
        "PCZ,-",
        ",~]0K",
        "V/@;KHYI)K",
        "$,m1b",
        "WIMGAPI.DLL",
        ")PAD$",
        "C#wNi",
        "\\s}ll",
        "~(0k\\",
        "iniz sistem mimarisi bilgisayar",
        "[\"p'mu",
        "jOpOD/QZ",
        "j#eU@gU",
        "J}IV9`]",
        " Disable",
        " Microsoft Corporation. T",
        "dKzt7)O2Z",
        ">v8C4",
        "`)Z@[",
        "g4wdL",
        "Xol8b",
        "lonej lokalizacji. Plik Setupcomplete.cmd to dostosowany skrypt pozwalaj",
        "1LS2)H",
        " na hodnotu Disable, in",
        "9Tl0&N",
        "&Slutf",
        "<Os|E",
        "Va%,'",
        " / files ",
        "{|?EU",
        "w3Q;Q",
        ",#Q?F",
        "uVB\"%Kz",
        "Apsilankykite: %1!s!",
        "&Dalje",
        "hu, ale jsou automatizovan",
        "?Prova att k",
        "2-3K3}3",
        "vv)EX",
        ">,>^>x>",
        "EfO0g",
        "?^J26v",
        "000ppp   ",
        "o%fOL",
        "~yE?J",
        "A^U\"mC",
        "o7x`U",
        "b` hL",
        "Voorbeeld: setup.exe / auto upgrade DynamicUpdate disable",
        "lT8}}6",
        "UKfDk",
        "WM@f?",
        "#\":1!(",
        "Stikalo: / pkey <klju",
        "^Eq:s",
        " ixx ",
        "FUi7M",
        "\"MN1g7;",
        "WdsSetupLogMessageW",
        "jR-G\"",
        "('Tw,f5",
        "og\\:/IU|",
        " palaidiet \"setup.exe /?\".",
        "Fase preliminareGImpossibile avviare l'interfaccia del programma di installazione legacy",
        "Bo!urSG",
        "HyxIpI",
        "fr-RE",
        " nytt automatisk n",
        "R#-q%5Rl",
        ">(>>>",
        "GetOverlappedResult",
        "  setupplatform.cfg",
        "%s: Working directory was preserved so it is already populated.",
        "%q\"mn&`",
        "m.s87",
        "*oUGp",
        "Opening Box: [%s]",
        "O(uvQ",
        "\\_D|z",
        "!'dD.",
        "YFU]P",
        "cAB\"7dF",
        "X!. A",
        "Q J+i",
        "UtWd?k",
        "H>3Xg",
        "NOw(~",
        "x/z*}",
        ";,\\=J",
        "ZH}N$c",
        "O,el8/",
        "FWRx%",
        "P_U2'",
        "xm[k\"d",
        "kA^/<",
        "n error. La siguiente l",
        ">-~};",
        "*KB-?CxO",
        "!**mN)",
        "om po",
        ":>>ex",
        "d)HrA",
        "Yv(VnQj",
        "0/0E0R0s0",
        "ZD!^D-vT",
        "|< 9X",
        "Ka%YFK ",
        "F=R.Y",
        "$@8yp",
        "Qp({0",
        ".]dZq",
        ")x/!p",
        "PkR/*:8",
        "6I Mk",
        ":K,=J",
        ")hkvE",
        "~!9~!",
        "fw9}IO",
        "_onexit",
        "W.w?5",
        "FEbue",
        "qv82E",
        "/Rh*(5",
        "ncia de configura",
        "s felhaszn",
        "b2T7N",
        "~E.~5}h",
        "-PE-Q:6W\\",
        "SdMYXM",
        "2JF\"X",
        "rY?/#",
        "yO=P^",
        "yrT\"h",
        "=0Lh0",
        "81LjsX",
        "i put ponovno pokrene, program za instalaciju ",
        "-/cWCr",
        "sJ=+3{",
        "R`45c",
        "k?ol)",
        "r*ns[",
        ";zMwK[",
        "_Gh 4",
        " problem podczas uruchamiania Instalatora",
        ",dHuD",
        "d>yB>",
        " 5 x 5 ",
        "progression",
        "ii:H_$",
        "-q){Fc42",
        "kll~[",
        "k, / PBRUpdate Devre d",
        "RdSdcS",
        "djx}=P#",
        "Cm6=t",
        "s]j3=DoA",
        "StateMatch: Current mode is Install - resumption is not supported...",
        ".?AVCMediaScenarioCtrl@@",
        "jx/FP/",
        ">& 4`",
        "Eewq-",
        "ena, program za instalaviju ",
        "CDlpTask::UpdateState",
        "LT:h#",
        "&T29ng",
        "\\,{[jL",
        "t.K-f+&",
        "wV \\)A",
        "AR?S)",
        "C,Whh",
        "{5`%L%6",
        "\\REGISTRY\\USER\\",
        "|#0<1",
        "Whhq{p",
        "`4yA(",
        "Rm/0_",
        "ctjXy",
        "0YF~J",
        "1V6&`",
        "fbR.8",
        "-8u#0",
        "I?L^_t)",
        "st kapnak. ",
        ";0<J<U<s<",
        "P,T(>_",
        "DY:CY:K+",
        "STnfr9j",
        "/Hyfp",
        "ss597)",
        "rio da instala",
        "r !?q",
        "i$EZy#",
        "-3W,I|",
        "mEf}5",
        "cYKDD",
        "OcD;5",
        "ibV+<",
        "Cf:J2",
        "Re}b2n",
        "@\\z3F",
        "m3L/xM",
        "u[C#K",
        "UEm(]{",
        "9C!nR",
        "Uy>!@^",
        "^_qOd",
        "iKa0f",
        " OOBE). ",
        "ku, restart",
        "swb2I",
        "6(7/7J8",
        "jljainak hely",
        "&W\"we:",
        "PJ2Lu",
        "!\"Zov",
        "Y>HPp",
        "AMK%6",
        ",2j-0",
        "U|SY\\",
        " data vygenerovan",
        "wX` m",
        "%\\+<43",
        "sakor folytat",
        "[n8ZJs",
        "q?:Y:O",
        "rca jurnalele comprimate ",
        "P82{0",
        "vh%pBK",
        "LUD|\\",
        "H03I^",
        "bFeMg",
        ".00cfg",
        ".Sabit diskteki medya haz",
        "\\n9bJ",
        "LH[Xa",
        "7]NrA",
        "_ o`]",
        "he-IL",
        " a pak n",
        "Yl$q{",
        "cie m",
        "}=TK_B",
        "Anahtar: / auto <ge",
        "Valmistellaan: %d%%",
        "VNz0/,",
        "<Gro~6J",
        "{r~|bl",
        "ar-QA",
        "K!gKI9",
        "[<?qV",
        "'k1YN",
        "#(>%7",
        "c&-nz",
        "EVQhS",
        "&;`E`W",
        "KY$ErQQb/",
        "MEGJEGYZ",
        "oT1t.",
        "o: fornece a chave do produto (Product Key) especificada ao programa de instala",
        "Odg\"c",
        "O8.6B",
        "LbG%z",
        "<ffgp",
        "`k30h+",
        "8y-mx",
        "gPp@r",
        "]K;Wv",
        "H!0[k2",
        "j-8*#/>",
        "#2&K9",
        "}*.;Z*",
        "23 W+\"",
        "}a&oC\\\\q",
        "RegValueEnumAction::Enumerate: Failed to open key %s\\%s (error %d)",
        "kb\\t!",
        "hsb-DE",
        "=(z[Eo",
        "c|P.=",
        "_q_]J",
        "&Pn{6",
        "*9=8k",
        "*O>0x",
        "58c\\B",
        "zhSDb",
        "b@S(;",
        "DY?{R",
        "lL4k4;",
        "\"G{,W",
        "la na privremeni mre",
        "R\"(iJ",
        "pUux=",
        "GtG~~M",
        "%qp,)",
        "/6C^v",
        "VVdeG",
        "Primer: setup.exe / auto upgrade / Telemetry enable",
        "X~h%q",
        "kK~gd",
        "aukimo UX ",
        "tte / showoobe v",
        ",)@Qo",
        "`WN,Zhg",
        "'@L**",
        "G,$/E",
        ")7hg!_v",
        "Q'vva",
        "w&{oc",
        "I1H>j",
        "qbJ20",
        ")QsPm)",
        "O u@g}$4",
        "arn-CL",
        "Rg0M0~0[0",
        "'th8E",
        "*:W.(",
        "KRzFf",
        "WVb4G",
        "3LI=9#",
        "wH9\\$",
        "B?/2o",
        "-cU&C",
        "pQ\\y>",
        "+H\"bJ",
        "O_@.w",
        "I[Kk%\\",
        "r, bu nedenle kullan",
        "kfbH`0",
        "YzQW%",
        "aW{T[a",
        "Pt@I\\",
        "Xb3/7",
        "z,#)*H",
        "IC3Yi&",
        "e5kH+P",
        ".CRT$XIZ",
        " habilitada,",
        "4wUN91",
        "]uuue",
        "P^fx(",
        "Adbl_",
        "p21LR",
        "!3TMWO",
        "`)~8\\,",
        "Eyn*;n0",
        "@vV0q",
        ": / PBRUpdate <parametr> ",
        "teW0f0",
        "lN\"9|",
        "lk4O2",
        "@0Ym@Cw",
        "YF7V&",
        "f!9u/~",
        "p`wayLylaa",
        "4`g(}",
        "_UZV]",
        "2*8;y",
        "Eylem : Sessiz bayrak, UX geri alma da dahil olmak ",
        "Windows.old",
        "yor. Kurulum'u daha ",
        "?\"J|?S",
        "Kaufen",
        "ot\";'",
        "xeU%\\",
        "_%YJ$gU",
        "6f`uL",
        "mica (buscar, descargar e instalar actualizaciones). ",
        "EWLG&",
        "application Param",
        ": setup.exe / auto upgrade / noreboot",
        "63&np&",
        "H6JQV",
        "5 5P5Z5",
        "8n2ze",
        ". Kai j",
        "Qy%|[H",
        "\\ybU/)",
        "&Nazaj",
        "~xEHE",
        "LXgNX|`",
        "~=-Ur",
        "n>axU",
        "xg?h5",
        "Wy\\;K.G.",
        "%,;nJ{u",
        "        name=\"cryptbase.dll\"",
        "5\"Uro",
        "1L1q1",
        "2Nt\\_",
        "w9=!o!",
        "zk/*l",
        "sL{im",
        "6J{Li",
        "u^p3C",
        "A4Q~)",
        "Esimerkki: setup.exe / auto upgrade / PBRupdate disable",
        "Z]NiW\"",
        "Stikalo: / copylogs <lokacija> ",
        "5\"Mb,_",
        "ni prekid. Ponovno poku",
        "f6$m2",
        "y}z}p|=)6",
        "ct-]G",
        "c,kAf*",
        "=$Oyq",
        "w6n&Z",
        "HdGqDw",
        "uje lokaciju za medijum/datoteke instalacionog izvora ",
        "MI;mdY*nH",
        "P>e\"}+",
        "rUx==",
        "|d*PF",
        "H/\\<Q",
        "'8!@*",
        "Xw2gU",
        "Anahtar: / PBRUpdate <parametre>",
        "h_\\9Q&",
        "tfen, bilgisayar ve / veya kullan",
        "b%7qR",
        "6.wKdyd",
        "ubi]h/",
        "O(u'Y",
        "{0gfi",
        "~Z~mi",
        "uRj S",
        "mIC@w`",
        "CoBoB=",
        "Oo[UU",
        "rv}0G",
        "=Yw`7",
        "sta g",
        "AO/P3",
        "<@XrT",
        "ctOJyN",
        "Oo:xk",
        "y3)L6",
        "MoPjo>",
        "zw[;cy\\",
        "W@HIc",
        "~TNO>",
        "0?$$?/",
        "0#h(a",
        "<N<U<d<k<",
        "?@hy\"~",
        "wl3@[|",
        "m<,RC]",
        "Veiksmas: kai / Telemetry nustatytas kaip ",
        "n'E[)",
        " OOBE : ",
        "Commutateur: / Postrollback <emplacement>",
        "!`XL6",
        "PB5wG",
        "E0W[h",
        "3mC>4",
        "Maejt",
        "PrkT=",
        "PXn/7",
        "GR8D/",
        "Cz8i9gn",
        "        name=\"textinputframework.dll\"",
        ":_0$:",
        "T* *?^v@ ",
        "IljAu_Eu",
        " \"/ Telemetry\" ",
        "r du setter den inn, starter installasjonen av Windows 10 automatisk.&Finner ikke den p",
        "r(Gy@P",
        "FPO[2Q",
        "ti vykdomas funkcij",
        "kP3*t>x'~",
        "ke. Sljede",
        "0_td,",
        "JjIT#",
        ";{ay+~",
        "(GA$oi",
        "CU BNh",
        "*3.61z",
        "NAPOMENA : ova sklopka bi se trebala koristiti samo pri testiranju i u testnim okru",
        "D1{k?m9G",
        "O3ux k",
        "JuWjl",
        "0'0L0X0k0",
        "r[z54",
        "^~wu#",
        "0Z8.\\",
        "Veiksmas: perkelia setuprollback.cmd fail",
        "UT-C]",
        "h{6|*",
        "lE$hq(",
        "GetUserDefaultUILanguage",
        "'*YB/",
        "PVTZ^D",
        "Example: setup.exe / auto upgrade / quiet",
        "pias para localiza",
        "CMicrodom",
        "8_n;:",
        ". Sit",
        "Perjungimas: / noreboot ",
        "R^-Ey",
        "Hubo un problema al iniciar el programa de instalaci",
        "H>B+'4",
        " rede para o caminho do arquivo espec",
        "x\\.A{",
        "P8%j<dk",
        "-E'1.b?",
        "O4%>vF6e",
        "DY_^S",
        "KQ08q",
        "Bt*iZN",
        "TZggvc+'",
        "]{|SE",
        "6_*r@",
        "Anahtar: / migratealldrivers <paramentre> ",
        "2+WK$0",
        "-Slo^o",
        "y\"r:<",
        "HWEu%",
        "0XBaV",
        "6a8QX",
        "p0i+^",
        "#cvL\\",
        "\"3\"L?",
        "n0zzM0",
        "Aktion: Wenn ",
        "HA>@\"",
        "=xS{ ",
        " N(l+B",
        "uV1(k:",
        "s viet",
        "   </trustInfo>",
        "uc=m%~[",
        "<<<Tki",
        "<|lx@",
        "_Dtk}",
        "Switch: / installfrom <locatie> ",
        "ana, iesp",
        "o&fYM",
        "!G7|^",
        "@jW^LO@[",
        "*E#7:",
        "EZH:w",
        "lan de",
        "a6Y0;+*",
        "Cg&twst",
        "lvREfi",
        "Error checking pending Setup Platform rollback: [0x%X]",
        "*Fve>",
        "t3TRF",
        "i, trebuie s",
        "r`@E/T",
        "jf%px",
        "3ovFy",
        "^W\"o5y",
        "?*B<s",
        "j+7W5",
        "H6K -",
        ":{#qr",
        ".?AVCStaticEx@UX@Common@ConX@@",
        "zUTV;T",
        "O~KY0",
        "/aLC+",
        "?terminate@@YAXXZ",
        "xJ7T0O",
        "oQ>}U",
        "ari8L.;",
        "Y{+PN",
        "cqqJT",
        ",Zf3v&",
        "Prebacivanje: / showoobe <parametar> ",
        "y2yX%",
        "dleUt",
        "2l:ki",
        "A&D0N",
        "%i:CeU",
        "IZ|=YC",
        "QueryAllTracesW",
        "Ahi{L",
        "!^]w5",
        "$0M_]",
        "3 N}28",
        "*mD1w",
        "me#'%hG",
        "oo5j$5",
        "HOj7c",
        "metros: chave do produto (Product Key) 5x5 ",
        "F5J+l(",
        "0&2rb",
        "0*010U0o0",
        "f17ti",
        "CIoc8",
        "<z4;+R",
        "T=nU1",
        "7\\a0,",
        ":@\"-/",
        "0@v$A0",
        " 6-f_",
        ":$:@:N:",
        "|U_I@",
        "KD}J#",
        " instance instala",
        "r2gd[O",
        "D]E7EoD5",
        "?@5@-@=",
        "MrUT:",
        ".[^[<1",
        "rge|Installiprogramm ei saanud ",
        " Microsoft Corporation. Alle rettigheder forbeholdes.",
        "=$=3=:=",
        "\"p-\"0",
        "=H_TW8",
        "O|H|F|]",
        "zcV\\$",
        "KoM$(",
        "2~An#",
        "`R^iv(",
        "Ki\\ida",
        "<gWi*P",
        "!6,&X",
        "~>lA})",
        "va|uP",
        "4.Gq&",
        "j~UWMU",
        "Parametri: percorso di file locale o percorso di rete UNC per un file denominato setupcomplete.cmd ",
        "gu nocy uaktualni",
        ";z!c~",
        "9KdtL",
        "CD+E},#",
        "|7xQ_",
        "5@IjH",
        "/}[S^",
        "+mzOpS",
        "uv8WQo?9",
        "!x1%9TU",
        "Error cleaning path: [%s]",
        "laties turpin",
        "Wh8q@",
        "nqMM?",
        "UQA:4 ",
        "^aP2Q^",
        "rss}||",
        "_D1PA}",
        "8Re<)",
        "Parametri: percorso di file locale o percorso di rete UNC di una cartella che contiene file .inf ",
        "mR(#v",
        "@ZFqa$",
        "{BxbpO8",
        "|!iA7o@8",
        "+Hh%?",
        "f}Wy|_",
        "ene na navedenoj lokaciji tijekom instalacijskog postupka. Program za instalaciju ",
        "Zy^ql",
        "NKKHDo",
        "p.e9eA1",
        "alGNV",
        ",%)+$",
        "Htgi)",
        "$Lxso=",
        "U)F^5[",
        "~R~+KJ",
        "9u^{_",
        "y(rF<",
        "|JMNb",
        "gTc\\}",
        "r>|.~[",
        "WGgJ<",
        "BA arquitetura que voc",
        "E%&/o",
        "6+d[@?",
        "26e4c-)",
        "s vieta> ",
        "rc=L'",
        "&+y$.",
        "$%M u69",
        "OvwNt",
        " Windows",
        "gE!mJ",
        "d$ayX",
        "ATq/g;",
        "ticamente.(No se encuentra la versi",
        "q{N8_",
        "=BA4#IL",
        "i$:\\\"",
        "PWO7c",
        "ltLb ",
        "?IC3G+",
        "=Mm_u>al",
        "rs fr",
        "li zainstalujesz t",
        "<j@ZH~",
        "Jcw:T",
        "i)0&d",
        "UGdXe",
        "C!`S?#",
        "k-t'Z",
        "Ss-+]",
        "Tu1KU",
        "P*MchRl",
        " chyby d",
        "3ElIC",
        "sp_(W",
        "Jsva}x4",
        "yd`]F",
        "Sp$X.",
        "~UnUB^",
        "!A&@7",
        "){I0xofJ",
        "lg|/Ac",
        "v0rn'{ Td",
        "qY_NU",
        "_qpp.",
        "9{|u8",
        "2vP`i",
        "A?QH5",
        "jlt a megadott helyr",
        "5.5?5D5J5",
        "e&DVf%",
        ":\\Voqk",
        "F2nmq",
        " tilbage til %1!s!. Vil du forts",
        "dWE)F?r",
        ":cb\"A",
        "+/N~O",
        ",n;I^o'9}/}",
        "kMV&Z",
        "{5k[xX",
        "gciF,",
        ">+|;b",
        "'$[153",
        "]+NkyS",
        "\"n*th",
        "Mz6ju",
        "Parameter: / pkey <produktn",
        "0('A$",
        "Opzione: / DynamicUpdate <parametro> ",
        "ticos, OOBE ignorado, PBR atualizado ou criado. ",
        "V%L+y",
        "9gKuMOx",
        "Pri sp",
        "(WF&v",
        "yte7-",
        "^nIB7",
        "e}yP^",
        "o*VbQ",
        "cia syst",
        "        loadFrom=\"%systemroot%\\system32\\wtsapi32.dll\"",
        "_A*s7",
        "f>$5g",
        "CFJxv",
        "SumPSQR3",
        "M:(chk",
        ".N;{#",
        "IG68Nu",
        "*,6z..",
        " festgelegt ist, muss der Endbenutzer mit der Windows-Willkommensseite interagieren. Wenn ",
        "3A2&H",
        "!+dT;iP",
        "/TlvRT",
        "t sist",
        "iFxlD<y>",
        "mu Windows nejde spustit, kdy",
        "ConX::Setup::Common::CSetupLangIniLoader::GetLanguageMediaNumber",
        "bn-BD",
        "7B~&[b",
        "SF*jJ",
        "mD c\"y$",
        "P8LNc",
        "PPAPil",
        "]c9tO/",
        "berein. Wenn auf Ihrem PC beispielsweise die 64-Bit-Version von Windows ausgef",
        "]B;I {GW",
        "Installimise ettevalmistamine ",
        "BBLtp",
        "U4f>B",
        "^t?R1-",
        "'nD(>",
        "NtQueryInformationFile",
        "3JN(*",
        "qH66i!96",
        "NDATA",
        " auf ",
        "2~g,o",
        "T{jfj3",
        "Tn\"U]",
        "v]w[o",
        "5edC?y",
        "C+~'~",
        "IfKG~",
        "w&v(v",
        "NRglXj",
        "4.4;4N4\\4}4",
        "0*131c1",
        "Error while waiting for system-context rollback to start: [0x%X]",
        "xQ.1_",
        "NU;==",
        "G?`~-=",
        "be6vb\\",
        "n/{gF",
        "Z\\O>`",
        "QVHzW",
        "J&Ox%",
        "Exemplo : setup.exe / auto upgrade DynamicUpdate disable",
        "FindFirstFileW",
        "DeletePathDirectoryCallback: Spoofing detected deleting [%s] -> [%s]",
        "})oGv_D",
        "b*4%-|",
        "Q<'48",
        "u9lnwY",
        "}{>aF",
        "`/)!*",
        ")]!lK",
        "}-<)^",
        "yi^dv",
        "%rRSh",
        "%6-@+",
        "Ni\"mA>u",
        ";dQc%[",
        "d^4KZ",
        "i^0(:",
        "hAnpw",
        "&apos;",
        "W[%]14",
        "%qGtog",
        "<>sXQ[z",
        "#tw^:",
        "c7_x7~",
        "t*{*)U",
        "q7h66h",
        "+@[](|",
        "000```",
        "$\\3q'w",
        "KZT!_",
        "?0>)p",
        "0Przygotowywanie do instalacji systemu Windows 10",
        "f+Qq\"I",
        "stico de los equipos de prueba en el caso de que se produjera un error. La siguiente l",
        "        name=\"profapi.dll\"",
        "-i!F&",
        "/U3GB5",
        "tir olarak ayarlan",
        "}Y>Js",
        "{PfR\\",
        "=*=H=b=o=",
        "$5`[_",
        "ditsF<",
        "se-FI",
        ";_)qj",
        "e]=f)",
        "Parametri: Lokalna putanja do datoteke ili mre",
        "qnfV&",
        ",^Yb+",
        "ENxmG*",
        "terst",
        "5vgg.p$&",
        "xV|!zJ\"",
        "HVqL5",
        "OvkaQ",
        "2,f%-",
        "~TVy9",
        "o ^!0~C?e`",
        "KM!>\"",
        "={_QW",
        "U/7 g`q?(",
        "moh-CA",
        "b=ydf",
        " festgelegt ist, wird die Windows-Willkommensseite ",
        ")YL]Va",
        "'u}0Hs(",
        "UD_%A",
        "xF[/_",
        "HKp$2",
        "\"/Rsg",
        "sUR4UK",
        "Et#Xz",
        "3!3'3B3Y3_3",
        ".8T%XBni",
        "?5S^X",
        "N]}F^",
        "i apoi ",
        "xJrHE",
        "n angiven s",
        "s pour modifier le comportement de l",
        "1!#\\Fy",
        "klad: setup.exe / auto upgrade",
        "gIxv1",
        "metros : Caminho de pasta local ou de rede para um ficheiro com o nome setupcomplete.cmd ",
        "mXA-(Ul",
        "T.>,P*",
        "'89xu",
        "M3Q![U q",
        "?_~{B",
        "n%T%UW5R-T[",
        "RgUDuk3",
        " Kullan",
        "T>!$JS3",
        "DdoE%",
        "ZRh#P",
        "7h8@;",
        "^T\\tu",
        "\"6^1]S",
        "~zw|-",
        "'YwaO",
        "j_[-i",
        "BV3Uw",
        "S!z{K-n",
        "d/S,y",
        ":bioa",
        "|2fn5",
        "{_[84",
        "Parametrit: ",
        "eklinde ayarland",
        "PR$Wqa",
        "$:BMO",
        "R{ 6'8",
        "uX[8,",
        "lr8j>",
        " ze s",
        "``Cl&",
        "nl(FU",
        "lY.+^G$",
        " 7v}M",
        "ytyy suorittaa tervetuloa-ohjelma vuorovaikutteisesti. Vaihtoehtoisesti, kun valitsimen / showoobe asetus on None, tervetuloa-ohjelma ohitetaan, ja osat asetetaan k",
        "s futtassa ",
        "mSj\"b",
        "x\\O-R",
        "ZoWLW",
        "t\\{~L",
        ",Ir'Kn",
        "dS{T'd0e",
        "zIo'&",
        "HfJElY",
        "Ecr.%",
        "E*AR?]",
        "\".B%^",
        "es que requerem permiss",
        "\\Rh[m",
        "#]l-/",
        "rast installimise nurjumist skripti setuprollback.cmd k",
        "n de origen ",
        "8*]$A",
        "&Anulare",
        "60_{8Qh(",
        "edR1s0",
        "]~!m0",
        "gqV0's",
        "Ga naar: %1!s!",
        "r1@z:",
        "$F]xn",
        "oFDP;",
        ": Enable; Disable ",
        "m/\\V'",
        "*\\Q(<",
        "*\"[am",
        "*g4?8O",
        "EKTY'>",
        "c6Vdr",
        "|^a{\"",
        "-g3I$Q",
        "        name=\"combase.dll\"",
        "O~&l/>pR",
        ">i4hDQo)",
        "9ix6|",
        "I=^~b",
        ";_!|}",
        "8N9 I+",
        "uCR2i",
        "W/1MRN3H",
        "Akce: Zautomatizuje instalaci pomoc",
        "m,m5U",
        "0]0q0|0",
        "t/vSW",
        "D/rO\"",
        "`^}==",
        "l**l?",
        "ProductVersion",
        ":bxZ ",
        "Ph(6A",
        "re connexion utilisateur. Son ex",
        "iune: Instalarea nu va reporni automat PC-ul atunci c",
        "[f!g!",
        "OJ~6U",
        "~N{IU",
        "(OS==j",
        " iepriek",
        "tres>",
        "4#4Y4",
        "1oYN^",
        "talova",
        ";{ mMi",
        "Primjer : setup.exe / auto upgrade / showoobe full",
        "A*9VI",
        "installation de Windows 10HLe programme d",
        "^m~;0`",
        "OvS=%",
        "|;Nq.",
        "llmedia / filer ",
        "o:RgS",
        "xmBH aI",
        "SPCleanupInstallationDrive: Unable to stop Setup Platform ETW session. Error: 0x%08X",
        "{l\\}K",
        "gd2HN",
        "9K t~3",
        "fk[!s",
        "D)[|:",
        "SetupDirectories",
        "d^b\\}",
        "j/sy2",
        "G[/oO",
        "a3Mjv",
        "*;QV^Gq",
        "0000X````",
        "324G4",
        "\"8k!N",
        "Vjs=BO",
        "pd<_}",
        "1__s-o+",
        "fMY[W",
        "~qVpL",
        "ciu spusti",
        "MLZ,I",
        "rQ~K\\a",
        "[-?qM",
        "Je&x\\g",
        "!cIl]h",
        "iama s",
        "nd / Telemetry este setat la Disable, instalarea nu va colecta ",
        "8QBOR",
        " MwL g",
        "gkJprbFtn^",
        " setupcomplete.cmd ",
        "metro : / pkey <chave de produto> ",
        "ndan ",
        "go{{|||~H",
        "q0zmB",
        "u1H/`",
        ")Xk?&",
        "H4}l!",
        "2q%Ll",
        "do'x=",
        "Exemplo : setup.exe / auto upgrade / migratealldrivers none",
        "w\"i,r|",
        "anas programma netika pareizi start",
        "CWebScenarioCtrl::ShouldPreserveWorkingDir",
        "mn-MN",
        "-}r>G9s\"",
        "'5'/!",
        ":t[{%",
        "(|']F",
        "IMAGE",
        "AFzP=",
        "M(H-B",
        "hc+I2",
        "C5}Io",
        "HN>Gi",
        "#\"HK+",
        "R}o[u",
        "DF'>)-",
        "+~{2s",
        "cznik: / copylogs <lokalizacja> ",
        "@@@ppp",
        ",yg0T",
        "P.)SWF",
        "|= y[",
        "zX'O;",
        "Valitsin: / migratealldrivers <parametri> ",
        "ho rozhran",
        "0~E*S",
        "`O[!X",
        "mOIW7",
        ">P>j>u>",
        "a{AgB",
        "zX(G~",
        "ps@}o",
        "#A*$'",
        "c>b^e",
        "idla ",
        "oY[*,",
        "g~Hh~",
        "#47rB7+",
        "iJ='5A6",
        "Owd9=",
        "fz jU",
        "G&?UY",
        "C#(<\\",
        "ntrerupere de re",
        "hN=)a",
        "{ 1)~",
        "s0^5<",
        "1+1P1",
        "Y&9je",
        "4$U81",
        "829>9T9Z9",
        "`0o~9",
        "6mgQ(l<",
        "\">vsJ|",
        "K7*b*J%",
        "gS;7*",
        "w6878[",
        "0'0-0X0c0",
        ": / copylogs <umiestnenie> ",
        "!CIN1",
        "YP\"1oi",
        ";~Cjr",
        "GW2wg",
        " jooksul t",
        "I7&v+",
        "R$mGc}",
        "mh}Ut}S",
        "nb*\\-s",
        "Y?$_]",
        "x>a\\'",
        "|hmx<",
        "ed prvn",
        "cution n",
        "i sa pri in",
        "CDlpTask::GetActionCount",
        "lXBhn",
        "SVN!54",
        "`cQ1[",
        "`nr.s",
        "i2=/I",
        "P\\Xq,eS",
        "z9(^:",
        "zj~ZZ",
        "|].r03",
        "4wJtr",
        "tKj4VW",
        "U=$fG",
        ":[KQgc)bh",
        "is{ U",
        "e%@GZ",
        "Ul{)5",
        "se-SE",
        "GetExitCodeThread",
        ";G$8x",
        "k1lsG1l",
        "Veiksmas: perkelia setupcomplete.cmd fail",
        "4'5\\5",
        "O<pjMv",
        " \"Full\", ",
        "Ti,F3",
        "#xGdIZ",
        "P&U04",
        "TieUS",
        "$</7?",
        "bylE]",
        "SPExecuteCleanup: Failure while building path to clean up file %s. Error: 0x%08X",
        "]z;^'",
        "\\Device",
        "L%mp>",
        "t{pn$",
        "sB%n>",
        "0~m|s",
        "6@gjc",
        "=ZTzL&z,/r",
        "mWx^k~",
        ".!qK7",
        "oL*g?w`",
        "Ei+(Z-8",
        "7ez<a",
        "dz#iy?9",
        "RegNotifyChangeKeyValue",
        "(e~b))",
        "eNB{C",
        "WEjf.P",
        "C'x_g",
        "QV,?C",
        "HiveListEnumerator::ConvertWin32PathToNt",
        "X+rVD",
        "Example : setup.exe / auto upgrade / noreboot",
        "        name=\"kernel.appcore.dll\"",
        "$Y)&g",
        "d@:=}",
        ">3ACl",
        "NW0_0h0M0k0",
        "[!U%iX",
        "$JAR_i4",
        "anas programmu palaid",
        "o#[hT",
        "5wQ5k",
        "Pri zagonu namestitvenega programa je pri",
        "]OKXO7E",
        "EiMri",
        "&tC&`",
        "%uK=R",
        "Sg\\&u",
        "~\\;S.",
        "Ssixj",
        "RaY|5",
        "\\?;W0",
        "> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>x>",
        "04Onu",
        "K[-hv",
        "*AQ\"#",
        "`Hx)U",
        "sUTEo",
        "oM(Kpl",
        "ZY`b3",
        "/i17o",
        "Obter",
        "^E((wWSL*",
        "$}2jE5R]",
        "j3+mp",
        " (cunoscut ca OOBE - Out of box experience). Urm",
        "seau intermittente. Veuillez essayer ",
        "=:&sO",
        "Waited [%d] seconds for system-context rollback to create RollbackOnline key.",
        "Configuraci",
        ".9zfL",
        "z6^:[[",
        "xQ)e7",
        ";Rf-4",
        "\".*:fWg",
        "25i@s",
        "@0f :?1",
        "0#xa3",
        "o : Na eventualidade de uma falha, o programa de configura",
        "VKl;xi",
        "w 6.$",
        "cu\"Z=f{43[w",
        "ba: nodro",
        " toda UX de instalaci",
        "itS,. ",
        "Copying [%s] -> [%s]",
        "C/`5r",
        "EK_H>",
        "iama %d%%",
        "n. Cierra la herramienta, reinicia el PC e intenta ejecutar la herramienta de nuevo.|Se necesitan al menos 350 MB de espacio para ejecutar el programa de instalaci",
        "ene skript setuprollback.cmd: ",
        "Hy$Ur",
        "ini, kada je / showoobe postavljen na nijedan, OOBE se preska",
        " Windows 7 ",
        "cznik: / migratealldrivers <parametr> ",
        "EY\\AA@P",
        "`Ls]~",
        "Q^ON (",
        "7'ovv",
        "UK}>_\\=",
        "5ZbSo;",
        "q9|{x",
        "P!\\:S",
        "%s: Previous file hash not found.",
        "1~8{{",
        "s@9r^",
        "Sklopka : / Postoobe <location>\\setupcomplete.cmd ",
        "enu lokaciju. Imajte u vidu da ra",
        "Vv4/=",
        "]Jr;218B",
        "c`I$X",
        "@>C$M",
        "bOQ1$g",
        "zc*}:",
        "Du(Z];%",
        "},e]|3n",
        "CDlpTask::GetState",
        "CDlpTask::CheckInitialized",
        "es-PA",
        "Lls<!:G",
        "({(rWQ",
        "~`eiE",
        "K</z`",
        "{*x6%8",
        "6~lMe",
        "v)EqU",
        "}a->&B",
        "{W_N8J",
        ":F:[:k:y:",
        "DDxm9",
        "\\=O\\gT",
        "Hilfe",
        "5Yj9uS0e",
        "ei?ia;",
        "ndan yeniden deneyin.dWindows 10",
        "[Rw.$",
        "T$(94",
        "NqM&b",
        ")7}a5",
        "RaiseException",
        "NJWe0",
        ")y+-P",
        "81F1:",
        " setupcomplete.cmd.",
        ",4]RO+",
        "d^ lh",
        "E0HS>",
        "YW`[f",
        "1Zp7;s",
        "l*Q_5",
        "hR?QP|B|6",
        "emplacement pour le support d",
        "L$0Qh",
        "AMZSX-",
        "A*rKE",
        "<LI(k[gJ>",
        "(u3+Zn",
        "ja nem t",
        "m restartov",
        "$5C-F",
        ",Gm=p",
        "zW4*+{@\"",
        "0:F.Yn",
        "%fLJ@",
        "Instala",
        "GJ0;h3",
        " selecta",
        "@1C)_YuoT",
        "1(1,1D1L1P1T1X1\\1`1d1h1l1p1|1",
        "Dq.)k",
        "1O2k2",
        "R>R>S",
        "(4K>(",
        "]{p\\e",
        "ze\"@?NP",
        ":G=g!",
        "XOJ{M",
        "D^V&w",
        "/tqu{Y",
        "*<{W)$",
        "xima vez que o computador for reiniciado. ",
        "kZNrN",
        "ArqpBG",
        " yollar",
        "1\"_,c",
        "+m05j",
        "[SY%+",
        "ydu:w",
        "rG(BO",
        "Ea(D4",
        "HvIHix[",
        "6JutD",
        "u+M3)",
        "E'0Qk",
        "JR(1ZQ",
        "u7z]<",
        "YE^'o",
        "xa1cX",
        "L#Rf%}g",
        "e se uz iste ovlasti kao i kod korisnika ili procesa koji je pokrenuo instalaciju. ",
        "NmdYhj",
        "c63>J",
        "turmayacak: ",
        "QbF3@",
        "gtvniX",
        "W*-+5:g",
        "njega. Za",
        "X_TI]",
        "LpPB;@",
        "setuprollback.cmd",
        " OmT1",
        " setuprollback.cmd",
        ".W,{7",
        "i-c`_*",
        "f8e{ui",
        "=3=>=y=",
        "o9\\A*E4%+",
        "Reprendre depuis le d",
        "f;D$Pu",
        "E;uc!",
        "NGI#%%",
        "Pobierz",
        "]_D4Gt44*",
        "u:\\rF",
        "MG\"_?",
        ">vMrFdf",
        "*N75ELat-i",
        ": Full",
        "n del usuario. Se ejecuta con privilegios del sistema. ",
        "xel: / auto <migreringsalternativ> ",
        "9s t\\",
        ",OK,oB",
        "e%}k_V",
        "aX30!",
        "r / showoobe er satt til None, hoppes OOBE over og komponentene settes til standardinnstillingene. ",
        "^cSSY`",
        "1(` o",
        "1hlq:ht",
        "T_rkQ",
        "/}E^w",
        "C7n1P ",
        " |}>$?}{",
        "cfDw4P",
        "`._'h",
        "ene se z istimi pravicami, kot jih je imel uporabnik ali proces, ki je zagnal namestitev. ",
        "o6NVi}",
        "Ha)&5H",
        "jcBmX,",
        "dUsRU",
        "x-z50",
        "miyor",
        "w=H~0",
        "UyeJ.",
        "sBmQ{",
        "p8SFXnd",
        "6[1_i",
        " yeniden deneyin ve do",
        "[R6Uz",
        "Uz}U{",
        "ier locale ",
        " OC=f",
        "/|l5h",
        "Cw|/t",
        "%s /FlightData \"%s\"",
        "zym![",
        "CJ3T~",
        "n$$7|",
        "f-IH+d",
        "Y4Y+]",
        "(inherited) ",
        "ErrorCode",
        "=\">6>A>e>v>~>",
        "VCJF9",
        "=@a$~",
        " : setup.exe / auto upgrade / Telemetry enable",
        "ba: nor",
        "Ru!>DbS",
        "H]p0L",
        "wyO@U+",
        "Parameters: lokaal bestandspad of netwerkpad naar een specifiek .wim-bestand ",
        "rjer:",
        "4ka,u_f",
        "Cleaning folder: [%s]...",
        "|J;CNs",
        "Yejj*5",
        "4%3Ym",
        "-]_+E",
        "terek: Full; None ",
        "vede version er Windows XP med Service Pack 3.}Brug den anden installationsdisk, der er m",
        "der manuellement par le biais de Out-of-Box experience (appel",
        "tres : All ; None ",
        "A6w{q",
        "F<d?%L",
        "ja atrast nepiecie",
        "L{ecHH",
        "$.4f} 4",
        "({w5OE",
        "|piV=",
        "!Q_=$",
        "px+0d",
        "<aKRN",
        "969=9F9K9V9c9n9",
        "V7cZ~",
        "VQ,j|",
        "TLhao",
        "Extracting Box container: [%d]...",
        ".?AV?$CZeroInit@V?$CDlpAutoLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@$00@@",
        "_@#U\\",
        "}}|SU",
        "UiBns=",
        "Creating path (with ACL): [%s]...",
        "dA!BO/",
        "?1VzI",
        "qam2J",
        "SIELH",
        "zyka interfejsu u",
        "0t@?l",
        "nceki i",
        "2qWs*A",
        "S]yGj,",
        "{LoiNdU",
        "Sf}Vf",
        "eX3ka",
        "78^Pck",
        "ea la un folder care con",
        "lmN6+",
        "9.H/2L",
        "0pEGB",
        "yC/t^L",
        "'`$*f6",
        "LWDRx",
        " =zR3%5",
        ">+}/n",
        ",ng^z",
        " 64-bitowej wersji narz",
        "a%N9W",
        "zUP^m",
        "!dr4s",
        "!yt7ga8",
        "L[ZYT",
        "syr-SY",
        "= =,=8=D=P=\\=h=t=",
        "Ii3A7c",
        "?Ff)N",
        "rO(/N",
        "Y.M0l9d",
        ")Tfe?en",
        "<x\"5A",
        "]/m2P",
        "K.0B~",
        "aF9o*",
        "68c}J",
        "ifK1O",
        "@T#?T",
        "818>8j8",
        "&vAgbW",
        "V$<$p2;",
        "s*\\RaE",
        "RP2Kc",
        "yIY{=v",
        "\"mA+lq)",
        "-<0-5",
        "#rOV8",
        "3 3@3H3T3t3|3",
        ".]5l5c",
        "Lkf2s",
        "K%[CsP",
        "Y(:zD",
        "Priprava",
        "Action : Specifies whether setup will perform Dynamic Update operations(search, download, and install updates). ",
        "0z2oPN",
        "{Du9@",
        "%s: Writing ProcessId value...",
        "'o6JP",
        "[$Kww$Zo",
        "MOV`2Or",
        "HQ'^I",
        ":NtzxW",
        "_'#Da[",
        "nika instalacyjnego.",
        "fStUBGf",
        "eCq-i",
        "-nXvz",
        "-BU2&",
        "/ExpressPackage %s",
        ")Dt^b",
        "24Uk]",
        "Q=%O'",
        "dfciz\\",
        "CMediaScenarioCtrl::CreateCommandLine",
        "Ucj\"T",
        "?OmdOAN",
        " egy r",
        "s`CHT",
        "l,uFV",
        "f\\C]+",
        "rak olarak ayarlan",
        "ybBJ\\",
        "0zfT%]",
        ";GQNs,",
        "WpzV.\"",
        "rskendamine lubatakse, telemeetriateabe kogumine ja ",
        "$~,<,",
        "wFxzl",
        "OcY_(",
        "Atsisi",
        "}LiX=",
        "5g-XK",
        "a instalacji (/ files)",
        "ViL,O",
        "#YhN`",
        "ncerca s",
        " Windows 10&",
        "g0YJ6",
        "s@xrPx~",
        "Lth3#",
        ";v9Nw",
        "ost(C",
        "j.^I$",
        "g%'E#",
        "liti eeldab j",
        "ks eksemplar juba t",
        "G;PyM",
        "$dGsv",
        "4%5?5L5p5",
        "x@$mE",
        "Q_*<9",
        "Z@.ME",
        "3);Cm",
        "LFmh<",
        "G%6yA",
        "$%OsP}",
        "CreateICW",
        "=L*j\\;x",
        " program nebude po",
        "?B=5~i",
        "A&vanti",
        ":\\M^Hq",
        "r~UzqoM",
        "Y=ZwX",
        "62o0c",
        "Parameter: / quiet ",
        "\"l!M6?3",
        "0fH8M",
        "G[+@28./",
        "CDlpManager::Serialize",
        "041E04B0",
        "t702s",
        "Q{<uvR",
        "s4o2]D",
        "/BuL\\",
        "ugC`e\"",
        "oN<Xv",
        "xF~;q{jy",
        "Dd[CC",
        "!fWd=",
        "HlecP",
        "G(yM<I",
        "Vorbereiten",
        "9xtU=g",
        "P7_t^",
        " FwuQ",
        "#}5jy",
        "fj+ uG",
        "\"<NNV",
        "kKMUV",
        "9W,B!",
        "Nx;-T",
        "*V{#u",
        "Failed to preserve setup logs: [0x%X]",
        "Hive unload failed; cancelling enumeration. GLE: %u",
        "v:,B4",
        "%1!s! ",
        "100(LL+n",
        "DlpTask: Suspending task during transfer...",
        "2.&($o",
        "MXL*C",
        "GaU9oR",
        "eSBT9",
        "*M9>GE",
        "$!3%0",
        "tg9pq",
        "SPExecuteCleanupFailure while removing file %s. Error: 0x%08X",
        "pv,P*=",
        "NOT : bu anahtar yaln",
        ".?AV?$CUnknownImpl@UIUnknown@@@@",
        "Przygotowywanie instalacji ",
        "<+<1<N<U<b<i<",
        "in0/)G",
        "P?_x\\;",
        "<\"<;<_<m<",
        "n de Windows debido a que faltan archivos de instalaci",
        "lc^3A",
        "*M8+n!",
        "W:UU?",
        "!c(Nv>",
        "vodu ch",
        "=&x;B",
        "Det g",
        "5LCY~",
        "Pz{Z|",
        "lV?7+4y",
        " bir a",
        "u\"l0t",
        "y^Huy!",
        "~f#;x",
        "k a kezd",
        "?t7/<",
        "du|!3",
        "EventWrite",
        "Parameetrid: faili specific.wim kohalik failitee v",
        "Wa5Y]",
        "tZ.0\\U+By",
        "|%74ODZ9",
        "J0 \\b",
        "{8Tbq",
        "x{~c6",
        "393z3",
        "aj}T.",
        "\\+|Yy",
        "P`h)i",
        "|'v[h",
        "]A%07",
        "BuildPath failed for %s and %s. GLE: %u",
        "mI=\"se%",
        "/@w74^",
        "gf':!N",
        "D$(PW",
        "/}YEMrq",
        "Se produjo un problema al iniciar la configuraci",
        "ranka, bet nori, kad galutiniai vartotojai patys atlikt",
        " OOBE) ",
        "e40i4",
        "BlueBox.log",
        "oT6aw+",
        "]=LecF4",
        " bir betiktir.Sistem ayr",
        " U.{Ak",
        "Ah#`?Eq",
        "#-}QZT",
        "#tj@S",
        "_5^>/;",
        "gDapQ",
        "nd / showoobe este setat la Full, utilizatorul final trebuie s",
        "bor setuprollback.cmd zo zadan",
        "G\"}}a",
        "?H?R?",
        "JCm4E%",
        "0$&=\"",
        "3TDkX",
        "mJ3u3",
        "Schalter: / pkey <Product Key> ",
        "n: el indicador no interactivo suprimir",
        "akniniame kataloge.",
        "rtuseks on seatud None, j",
        "PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD",
        "qEB4r",
        "~ICH[",
        "@r$;\\",
        "A5f6d",
        "Esimerkki: setup.exe / auto upgrade / Telemetry enable",
        "+.YQ\\^^",
        "7W(#Pz",
        "}i..s",
        "L[4hqE",
        "\\m}Ms",
        "?r.Ya",
        "J;kOzQ",
        "s vieta>\\setupcomplete.cmd ",
        "@~Oz/:^`",
        "<`j\"bL",
        "Mw&`6",
        "+|~M(",
        " cesta k s",
        "0$RVP=%5",
        "u^C|,",
        "q1,]s",
        "2pu(]B",
        "Action: Upon failure, set-up will copy or upload compressed logs to the specified location. Please note that the PC and/or user must have permission and network access to the specified file path. This command  runs in the system context so may not have permissions to copy to locations that require user permissions ",
        "Rh3GK",
        "ey;k\"6",
        "G'?q-",
        "U{'n#a",
        "z#V^G%0",
        "t=re/",
        "ajki. Vi",
        "5JTk[",
        ": 28(",
        "n, mukaan lukien palautuksen k",
        "b4@J2l",
        "nVMVs",
        "]L'aUmj",
        "d-=a7jqcDK",
        "R}b>F]",
        ".?AVCWizardPage@UX@Common@ConX@@",
        "j}XYH",
        " la partizione PBR. ",
        "zere UX ayarlar",
        "jd>X+wh\"",
        "$CAbp",
        "n que se debe invocar el script setuprollback.cmd despu",
        " Operativsystem",
        "|$QsLw",
        "\\R;rA",
        "(7]E6",
        "7iD;R",
        ":K9hq",
        "+p*/p",
        " prijavil. Izvede se s sistemskimi pravicami. ",
        "EM5 +",
        "'!#G\"",
        "nVgr ",
        ">!u`Q",
        "]}I6J",
        "o quer que a interface do usu",
        "I?2ga",
        "lassza.#Hiba t",
        "~~j#O",
        "f[$EL",
        "ParV~NJ",
        "Bb6;r",
        "i da nadogradi ra",
        "u{~{]",
        "Commutateur: / PBRUpdate <param",
        "F=`#l",
        ". Instala",
        "~,`o'",
        "Parametri : lokalna stazado datoteke ili mre",
        "l:wGk",
        "/|e5Z",
        "WGG\\O",
        "6)@-3",
        "6VK6I=%",
        "w5&~]]",
        "#nVv2",
        "gZp|a",
        "*[9Ug]/",
        "rio novamente e reinicie a Instala",
        "e{^jE",
        "oQf&d",
        "e datoteku setuprollback.cmd s navedenog mjesta.Setuprolback.cmd je prilago",
        "KesXQ.",
        "e trwa aktualizacja funkcji. Przejd",
        "$~@6=",
        "7R?.i",
        "Y}j'=",
        "|2#Y]",
        "jraindul.$Nem tal",
        "-<|Wp",
        "Ua*BuW",
        "m5Fn[-",
        "&_z=R",
        "ches de bas niveau syst",
        "dzie gotowe",
        "<oA44F",
        ",bwLl",
        "K!utv",
        "~Gqum2",
        " Ub2V",
        "p sieciowy do wskazanej ",
        "ue>K2",
        "[GJvy`",
        "{tCV/",
        "minen ja palvelimeen lataaminen on hyv",
        "DeleteFileEx: Trying to set back attributes on: %s",
        "zFSA6",
        ";A\"8He",
        "n de Windows 10 ya est",
        "MoveFileW",
        "K9DH2#",
        "~./IS?-y0",
        "`5'b ",
        "mni-IN",
        "bl@n8",
        "l paleisti ",
        "=tMai",
        "WriteFile",
        "G|Sa=",
        "2j:|J(",
        "tT_Ic",
        "BYnX[",
        "PWwD.",
        "R&x&IO",
        "{h>Z5M",
        "Parametrit: paikallinen tiedostopolku tai verkkopolku tiedostoon specific.wim ",
        "(w&Gb",
        "<Ar#*Wd",
        " tai luo pikapalautusosion. Vastaavasti, kun valitsimen / PBRUpdate asetus on Disable, asennusohjelma ei p",
        "TDSE1",
        "ap^+]a",
        "e)|#h",
        "FileVersion",
        "_N&JBd3v",
        "n: en caso de error, el programa de instalaci",
        "{kmh_",
        "n. Podr",
        "/{&w7",
        "ugwjE}",
        "o>Jlg",
        "x4dt\\",
        "n^lsz",
        "&?Fn`",
        "Ejemplo: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "yps ;",
        "rqsppnmmTP84211h",
        "e s|cFn",
        "hk)H}aw",
        "e*3}|",
        "1Xl7E",
        "mHO6j",
        "HB:!I",
        " den angivne placering under installationsprocessen. Installationsprogrammet vil s",
        "vq@+ujP",
        "s/{..",
        "O`zqU9",
        "$[:'&v",
        "computador",
        "dzis: / migratealldrivers <parametrs> ",
        "Exemplo : setup.exe / auto upgrade / Telemetry enable",
        "k;{G}+",
        "d&,$`\"53j%",
        "65wqD",
        "?wuew",
        "o de termos de licen",
        "VIT\\G",
        ":L%Ls",
        "<==J=",
        "i_n6u",
        "R'Dl0g",
        "'n[bGpL",
        "faVgu",
        "<xq,W",
        "biSuk/",
        "WorkingPath",
        "PcbXhi",
        "@7x9>",
        "YGXS+",
        "og+1Z",
        "bd1U!9",
        ": / Postoobe <",
        "Installationen f",
        "Q\"[y9",
        "FVUJt",
        " None, OOBE ",
        "u|=+Q^/)F",
        "1z?G`",
        "}WAM0",
        "7T.9T",
        "ivad puududa ",
        "Z`Re{",
        "!E}D3(5",
        "4gKCs",
        "U;qB9N&",
        "Pravne informacije",
        "Gi.&TxM",
        "~EFn.",
        "j\\Yuj",
        "\"Gsw$",
        "{tSq*&",
        "1Dy?a",
        "+n+i8",
        "voX0E",
        "@AKYPc",
        "KNEO.7",
        "PP{x8",
        "g(cyV4",
        "UxTheme.dll",
        "Wty]Wt}:",
        ":O+2\"",
        "Cmxbb",
        "0ckW0O0",
        "rio ou processo que iniciou a instala",
        "*PW%<",
        "lY3|gOx",
        "~u3xy",
        "#document",
        "LVi9}",
        " la instalaci",
        "mEar|~_",
        "}r1mR1M",
        "nru,y",
        "n kirjautumista. Se suoritetaan k",
        "K#KNA",
        "-N!I ",
        "^SVc0I}",
        "Ra_#U",
        "#d_S$6",
        "T6f'}BA",
        "\"9&P$",
        "<o>0_",
        "=r$v$F?",
        "}Rd-9A",
        "!gTPI",
        "%Qi4lq",
        "=-=//",
        "ni put do datoteke naziva setuprollback.cmd ",
        "Action : Le programme d",
        "a]~M5",
        "5!6=6Z6i6",
        "}bT3YS7",
        "-J\\6LO",
        "RegCreateKeyExW",
        "_pLgA",
        "i pid.txt u fascikli izvora. ",
        "6 s.6",
        "O2hh'",
        "3>3w3~3",
        "IrqA6",
        "<CwfX",
        "0sfHlFfPzzZ:",
        ">T\\s\\",
        "x~#;[d",
        "7]c%M,UM,",
        " tbfr",
        "5gTx:)",
        "jdJy^",
        "PisR8g",
        "8rB9X",
        "}-9d7",
        "x>0}/",
        "{$(m 0",
        "6C6p6",
        "}B2y9_h",
        "?+%5k4",
        "2JJPS.",
        "[%ZDUs",
        "IudZj\"",
        "7aTfL",
        "(B`A}",
        "2P]<h@?d",
        "_)tGx",
        "    <!--",
        "c%?S0",
        "1%Cbf",
        " proizvoda ",
        "9Sb9O",
        "0hO9c[",
        "c0#J7;",
        "gA]n:E",
        "~mdv1",
        "rd: Installationsprogrammet aktiverar alla driver.inf som hittas i angiven s",
        ":j\\C.PoV",
        "JA<,r",
        "Naje'",
        "5(5H5P5X5h5",
        "A'{$8",
        "n no se inici",
        "r>K}>",
        "^PDP,HQyH",
        "DvjSlrn-i",
        "f<;ZtQ#o",
        "&r]=i0",
        "j-^[|C",
        "ban rekurz",
        "%n#z;",
        "Z,fbl",
        "PF-tK",
        "z+zQh\\6;",
        ". Versiunea minim",
        ".w)N.",
        "DrawFocusRect",
        "r jag slutade",
        "t*WPd",
        "s ind",
        "ntud#",
        ">[.e(",
        "+e>],3",
        ": :,:8:D:P:\\:h:t:",
        "xcH#A\"InX",
        "fr-029",
        "%I64X",
        "J?o(e]",
        "lja a telep",
        ": / PBRUpdate ",
        "Ikt\"O%",
        "2q;T5;",
        "etko pripraven",
        "A}D7r",
        "Rv;p7",
        "q/UT.",
        "+;s{s#",
        "1wq#yY",
        "i|lH{aN",
        "^@L]/!",
        "p8-|0",
        "tres: N / A ",
        ".?AVCObject@@",
        "ranka rekursi",
        "m0K}\"",
        " teniendo lugar desde una ubicaci",
        "hi-IN",
        ")+S8^)",
        "/C[~J",
        "W<4aS",
        "lav0G",
        "u5WWWWh",
        ".Bd#o",
        "d=5b~",
        "x0)J+E",
        "\\xwS.",
        "+j$FS",
        "Hh(P3",
        " mzx@",
        "6X<8Nd1",
        "%s: Setting Current Scenario: [0x%X]...",
        "prava instalace. ",
        " impostata su All, il programma di installazione eseguir",
        "nKI^u\"",
        "i instrumentul, reporni",
        "He9fkEF",
        "b5H8&",
        "T%cT5",
        "I>])Dv",
        "3&4-4",
        "<Y,5G?I",
        ":-:>:D:h:",
        "#.7fY;~",
        "ENTITIES",
        "anas reiz",
        "cy-GB",
        " kesintisi ya",
        "am-ET",
        "EP|z{2<b",
        "tv$r.",
        "QD=o)-zu",
        "eq|/%|",
        "./P,(",
        "2&3:3E3g3",
        "W0|?f",
        "ldre operativsystem. Installationsprogrammet forts",
        "9G)1\\wl",
        " voltar a %1!s!. Pretende continuar?",
        "F23*=",
        "kwf<U<",
        "]=R|.E",
        "WWW===333",
        "\\{}vQ",
        "+ZA#?o",
        "+nf<?",
        "stroj spusti",
        "m alt klas",
        "8EnF)7Cw",
        "b|Iqb",
        "&=0C}",
        "9|IyU",
        "l~cq2",
        "T\"Fy}q`",
        "kBn{*#n{*",
        "puE@K?J",
        "C[\\wLLDm",
        "#Tem a certeza de que pretende sair?\"Pronto para instalar o Windows 10?",
        "!QYO{",
        "f96gt",
        "ierelor de instalare lips",
        "|dz'N",
        "{yvU|",
        "lo. Ponovno pokrenite PC i poku",
        "bs6ny",
        "f~+W)<",
        "e\\jd_@",
        "zPZx{",
        "=!>W>^>",
        "lS 5y",
        " UNC.",
        "fuMzP",
        "utilisation ",
        "5y_']^",
        "o: / Postoobe <local>\\setupcomplete.cmd ",
        "&qZ}!",
        "E\"0G!p",
        "2#+?U",
        "H%s3H^",
        "N(to\\$",
        "g6#Va",
        "a sa vynech",
        "Parametrar: Upgrade; DataOnly; Clean ",
        "X<St}DX&?{1",
        "TRD;<$",
        "@<b{6",
        "?'kw*z",
        "Y#.2w",
        "-G%Pc",
        "lWK?'",
        "lda: setup.exe / auto upgrade / Telemetry enable",
        "Pavyzdys: setup.exe / auto upgrade DynamicUpdate disable",
        "sOq:KH",
        "j>USMd",
        "i configurarea.",
        "?\"?9?@?J?`?g?q?",
        "}|RAb",
        "t,-JG",
        "Exemple : setup.exe / auto upgrade / Telemetry enabled",
        "b43H,",
        "iT}6E",
        ":v^wx",
        "x.tCmk",
        "CDlpFile::Initialize",
        "NO|EA",
        "h8)|(",
        "T=>b_",
        ";8GyzR",
        "WgYP35",
        "~b#>4",
        ",VN0^A",
        "pid.txt",
        "2BQBt",
        " sitten suorittaa ty",
        "+WdpMI",
        "iC]yz:",
        ")+QdaH]",
        "'ciK/",
        "-X!ym",
        "\"<aok",
        "/Console",
        "/JG}A",
        "Creating folder [%s] for expansion...",
        "_S+v:",
        "B sNl",
        " on oltava m",
        "Skretnica : / copylogs <location> ",
        "a-GJA",
        "eOPD6-",
        "x&3GI",
        "SX!Upt",
        "+?Uq66",
        "Lj&2T",
        "nk$Yj",
        "7y[k^",
        "oqPvvJ",
        "%h'`_}",
        "BKyVc@B",
        "j5`D*a^~-]",
        "LJ-@&",
        ",6Q_4",
        "XJ_}M",
        "nem atualizar",
        "o do Windows 10AO Programa de Configura",
        "3<4m4",
        "viK&u",
        "\"=x_aA",
        "kzZh(On)[",
        "8$808<8H8T8`8l8x8",
        "tiski ats",
        " Zk/s",
        "4cG.=",
        "9qc!t",
        "3==7FH2HH",
        "&SyGb",
        "+kte8",
        "n PBR. ",
        "WghhP",
        "U-`&Z",
        "YQn)L",
        "nima necess",
        ": N / A  ",
        "o de 64 bits da ferramenta. Experimente executar a ferramenta novamente e certifique-se de que selecionou a arquitetura correta.-Ocorreu um problema ao iniciar a Configura",
        "qCtG$w_",
        "tzm-Tfng",
        "yR#F<",
        "F(tor(",
        "[(&`l",
        "Installationsprogrammet f",
        "oj'/\\",
        "*B,0_",
        "r2l.tK-_",
        "x,zj =~iV",
        "t<k@Oup",
        "Kge{k",
        ":K}`Z",
        "w~Ar j",
        "=o{>|",
        "A?xnMO",
        "6slns",
        "6c)opg",
        "JLI(I%",
        "95iGt",
        "Unexpected return code from WaitForMultipleObjects: [0x%X]!  Error = 0x%X",
        ")c;l=T",
        "95:?:n:y:",
        "@0Y3K[",
        "J|0'X",
        "i_dXk",
        "metro : / installdrivers <localiza",
        "ia Set",
        "^(WKm",
        "A36.V",
        " xr]V",
        " Windows Update ",
        "WL#;.LM^M",
        "n y el PC se ha revertido al SO anterior. Se ejecuta con los mismos privilegios que el usuario o proceso que inici",
        "AdjustTokenPrivileges",
        "CDlpTask::Initialize",
        "Conmutador: / noreboot ",
        "'jqA!",
        "tL2j#",
        " que puede que no tenga permisos para copiar ubicaciones que requieran de permisos de usuario ",
        "q(5Ho",
        "U%zr<",
        "v[]k(E",
        "g6/e4",
        "5 5$5(5,5054585<5@5\\5t5",
        ")O;~M",
        "Windows 10 installiprogramm(Windows 10 installiprogramm juba t",
        "&U{ (",
        "quz-PE",
        "F#~_A",
        ",K~G=",
        "Xf:0 ",
        "9{72j",
        "Na primer: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "gQjgn",
        ".BsW!",
        "=vZ\"T",
        "O{5_:",
        "P_iT,",
        " versiunea de Windows pe 64 de bi",
        "bet af natten. Hun ",
        "Action: Supplies set-up with the specified product key.This parameter is not necessary when upgrading with volume licensed media or media that contains a pid.txt in the sources folder. ",
        "Pripravuje saJIn",
        "^ H[/\"",
        "-~9eQ",
        "r7i4'",
        "Z?RCe",
        "8_NVB",
        "N&LsS",
        "i\"}U0",
        "?:&RQ2",
        "YEgLN",
        "WRgf0",
        "z:Lb+S/",
        "CDlpTask::SetWorkingPath",
        "yG}<f",
        "47bNh",
        "]#2^(:F",
        "MoC+VR",
        " ~@).",
        "i(2w`t",
        "5fMXS",
        " medyayla y",
        "\";d9#w",
        "gsw-FR",
        "W__j\"",
        "*y$)j",
        "5kXt/",
        "k;6rA",
        "\"ul49?Br",
        "@D}yS",
        "R~'2d",
        ".;Kc,]",
        "NsqH+",
        " automaticamente o PC quando concluir tarefas de baixo n",
        "Valitsin: / Telemetry <parametri> ",
        "ation de la partition PBR. ",
        "[b;{*",
        "I<.4~",
        "1_`l.",
        ")+b,y",
        "gUSz*",
        "j|j(]",
        "|NUUA",
        "-srCU",
        "h%^IRR",
        ";zmflm",
        "Sklopka : / quiet ",
        "{gj,U",
        "0?{$A0",
        "v5c)6!",
        "9vz`/",
        "Eksempel: setup.exe / auto upgrade / copylogs \\MitShare\\UpgradeLogs",
        "o*sa$",
        "lr>xZ",
        "J<qdw",
        "NK@l6}=K/",
        ">jV -",
        "4V1xaok",
        "ZbB#M",
        "S\"2nhR",
        "se establezca en",
        "OO&5c",
        "HZ?fgF",
        "aK._H",
        "&L J1",
        "Primer: setup.exe / auto upgrade / PBRupdate disable",
        " un tentativo di migrazione di tutti i driver nell'ambito dell'installazione. Al contrario, se / migratealldrivers ",
        "u]GG7",
        "#DW1{",
        "UuidFromStringW",
        "tter filen setuprollback.cmd fra den angivne placering. Setuprolback.cmd er et tilpasset script til at udf",
        "%f2f1#",
        "Parametrit: paikalliset tiedostopolut ja UNC-verkkopolut ",
        ".CRT$XCA",
        "oDT[)RXo/",
        "7{I|;",
        "dent. Il s",
        "n. Libera espacio y luego int",
        "cznik / Telemetry ma parametr Enable, dane telemetryczne zebrane podczas instalacji zostan",
        "hm;>@",
        "iH_&iSe{",
        "QNgN$",
        "O4zOT",
        "nd / migratealldrivers este setat pe All, instalarea va ",
        ".V,x%",
        "ana. Minimalna zahtevana verzija je Windows XP sa servisnim paketom 3.",
        "P}4*m6t",
        "SetFilePointer",
        ".M`.\\",
        "Atpa&ka",
        " permisiune ",
        ". Comme cette commande s",
        ";v;&<g<",
        "H*=Y.xs",
        "tgX1)uCx",
        "&@4?p",
        "{4\\Iq",
        "[4*3q",
        "q~pSS",
        "invite de commandes, ex",
        "ndan Windows Kurulumu ba",
        "L|u}-",
        "taK_C",
        "<?Wt\"#U",
        "5{b~_",
        "J&g$h-",
        "dsB?r[",
        ";IO!y",
        "XD<Fb",
        "=g9l~",
        "Pv\\i6",
        "Ef,BL",
        ";h>%N",
        "Yx6<K",
        "M/'3M&",
        "~;}zW",
        "b{\\n|",
        ">/3L\\",
        "=t1'A",
        "h$\"<9qA",
        "TS:])",
        "*={E0",
        "unar i/ili korisnik mora da ima dozvole i mre",
        "z*?O`n",
        "(&{kM",
        "RegDeleteKeyW",
        ">.R1*",
        "0S2]2",
        "4_{xNg",
        "u;_\"_",
        "Vy^/\\",
        "d Product Key. Tento parametr nen",
        "x\\AnXW",
        "Rj\\lj",
        "Action : When / Telemetry is set to Enable, setup will collect and upload telemetry generated by the installation.However, when / Telemetry is set to Disable, setup will not collect and upload installation - related telemetry. ",
        "q5>-Q",
        "{tma3",
        "}v6<{-x",
        "c^6fD",
        "?>=er@by/6",
        "Timeout reached. Will retry waiting for system-context rollback to start.",
        ">WSSNxE",
        "/Download",
        "SO%! ",
        "x3->%",
        "*rp88",
        "Prebacivanje: / PBRUpdate <parametar> ",
        "surea argumentide abil",
        "\"w0g<",
        "9s1y<",
        "adu/b",
        ":7y]*",
        "B#|<j",
        "O(u}T",
        "d:(zC",
        "0Gu#`L",
        "hE|wGzz",
        "MTYeC",
        "aCLNN",
        "q`dJQ",
        "?Ig@d",
        "\"]\"fU",
        "Xy~a]",
        "^rtOE",
        "[hrwi",
        "#6UDS",
        "Ue;aO",
        "mu Windows",
        "ments",
        "R+[\\l",
        ">r.jT",
        "ka do folderu plik",
        ";#8{ 9",
        "~TB3V",
        "$x^*!.go",
        "diegsite ",
        "xbXuO",
        "D|og6",
        "Xgv24o",
        "eoI\\q",
        "{M0cd",
        "/k5h)`",
        "GPub9",
        "/e%oV",
        "M/.^Mp",
        "F  #x",
        "n de Windows 10, no podr",
        "kd[xN",
        " definida como Enable, o programa de configura",
        "woogwvvg",
        "t\"=E^",
        "Wq`E-/H[",
        "e%0Wj",
        "ihM6~",
        "B,DvT",
        "Q&OtcHkx",
        "tsrlj",
        "eli da krajnji korisnici ru",
        "7EaiKii",
        "aLzr^",
        "O'nJmb",
        ">&%[E",
        "5ah0(",
        "k26VtS0",
        "!h'!H=",
        "}#J'rF",
        "8,{@/}",
        "9B;\"<8<C<-=Q>{>",
        "c+13,",
        "p0OA9",
        "Jt0Wi",
        "/ migratealldrivers is ingesteld op",
        "pm m5o",
        "'?4;F",
        "7H&I0",
        " Yd8U",
        "\\`e<<",
        "GyYM@?",
        "}=lORE_",
        "7pVg:",
        "7i 1g,qV",
        "installation / fichiers",
        "3F(U;MM",
        "tCQlj",
        "?a;is",
        "``bo.",
        "tZUs|UE",
        "Eksempel: setup.exe / auto upgrade DynamicUpdate disable",
        "O8RYq",
        "@@@@@@@@@@@@@@@@@@ppp",
        "SetupHost result value missing... forcing full cleanup.",
        "Na%-?",
        "t#t4s",
        "~Q|-(8",
        "l7yLt",
        "/{RLc",
        "wcstoul",
        "Kopen",
        "-u)e%",
        "\"bJ(]",
        "Fgdu$",
        "|;\"xcV",
        "no posodabljanje je omogo",
        "|2,D7",
        "Z>p4:S",
        "Se preg",
        "L9dh.O",
        "-o\\oV",
        "Z>y~3J",
        "1UV0Dm5R]D",
        ".RNes",
        "k&Vwn",
        ":&;Q;`;o;~;",
        "3R[ES",
        "+%tcB",
        "IHgCpH",
        "<nG(|j",
        "o{]/J",
        "%AwSQ|\"",
        " : setup.exe / auto upgrade / quiet",
        "~?$1R",
        "7&;@O",
        "$v#>5",
        "x7g[h",
        "]|pcA ]u",
        "a:Z\"~",
        "ticamente el equipo cuando se completen las tareas de nivel SO. Cuando se reinicie el equipo, la instalaci",
        "pExFMT",
        "to verzia syst",
        "I/_8b/",
        "9(9H9P9\\9|9",
        "Program Setup.exe instaluje lub uaktualnia system Windows. Do modyfikacji dzia",
        "rio de instala",
        "Rengiame kelis dalykus",
        "8KfmC",
        "i laadib need ",
        "er>R2",
        "[<g=Qn.^",
        "Y-@o%%",
        "Process termination succeeded for Suspend!",
        ">vEEG",
        "  %s: %u-%02u-%02u %02u:%02u:%02u.%03u",
        "8jb5%",
        "y~N>6",
        "Y@7{}0t",
        "Transfer execution thread timeout period: [%d ms]",
        "te.!g",
        "(lsv:Zx",
        "t egy parancssori ablakban futtatni ",
        "EEk4s",
        "ZWr pr",
        "x/EFqs",
        ".idata$6",
        "(lnzd",
        "VHSX<Na",
        "@|,~/",
        "Fefd%",
        "Przygotuj",
        "GetPrivateProfileIntW",
        "bGO(1",
        "gt2nG ",
        "a;}F ",
        "'5:G(",
        "1 141<1D1P1p1",
        ": setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "Parametri : N/A ",
        "=_J>#+1T",
        "v#4MM",
        "555My",
        "eno, uporabni",
        "R{t&T",
        "r-xXT",
        ".) ]%",
        "QH@!^",
        "rARc'",
        "0uueZ",
        "]c#TT'B/=",
        "Preparazione dell'installazione ",
        "38[7^",
        "elite prekinuti?3Jeste li spremni za instalaciju sustava Windows 10?",
        "re opgaver, efter at installationen er udf",
        "&{IlA<",
        ",)ux?",
        "OMF*7",
        "Opera",
        ":2E,cV",
        "czeniu zada",
        "v}`Su",
        "#zOBCL",
        "!Qn<C",
        "\"Sql0",
        "bTQ+0E=",
        "aW>~D",
        "y@{8+",
        "w?@v)@>",
        "J|?)D",
        " diagnostick",
        "0&161=1",
        "~*D\"<g",
        "9J/oe",
        "Tv%G.",
        "0z5h?",
        "i~U\\s",
        "\"9~G~",
        "UDr{P",
        "f(8=R",
        "|V{r>",
        "8CtGm+",
        "Cb_#b",
        "Ia&>|E",
        "3`B5v",
        "9b7mi",
        "4\"[2z",
        ".jsHF",
        "mw<GS",
        "Cwh^H",
        "Namestitveni program se ni mogel pravilno zagnati. Znova za",
        "NpE*2P",
        "_zCwuhAp",
        " Windows XP ",
        "Pripravuje sa in",
        ">&>M>^>e>",
        "dm8c<",
        "L5LPnS",
        "ir3ho",
        ">ARhr",
        "cznik / Telemetry ma parametr Disable, dane telemetryczne nie b",
        "gf,+'&",
        "GveKm",
        "r}J.6",
        "~d)_+",
        "Ru@8[0",
        "^3TK\\",
        "s[&kqd",
        "UhK]+",
        "=,=<=L=\\=l=|=",
        "Y-4'O",
        "H\\/-iW",
        "$)oX}",
        "^S?Hni",
        "4[ \\00",
        "J0z6'K%",
        "__setusermatherr",
        "WTSAPI32.dll",
        ",rrr\\\\\\",
        "XZb.3",
        "c:y&{",
        "BNjb/",
        "K~F%?",
        "interface utilisateur de configuration des m",
        "2 ]9J",
        "j\\Xf;",
        "jet, genstart pc'en, og pr",
        ". Setuprolback.cmd ",
        "n curs de desf",
        "y!8huf",
        ",c6<ym|",
        ";L>k`7UP",
        "^YN'4",
        "q!Y|Xr",
        "-J\\F\"",
        "6i ;g;",
        "1*NRR",
        "z^Ub0",
        "Handling: Sende den angitte produktn",
        "Uso com base em cen",
        "D:(Mm",
        "X`kc;gz",
        " du har muligvis ikke tilladelse til at kopiere til placeringer, der kr",
        " :?R9",
        "Fv2L|E",
        "<Q>)EUC",
        "g)46516",
        " .wim ",
        "uy4'`F",
        "`(57E",
        "Ra3%i_",
        "xbK6{",
        "i9>u[",
        "s%cvB^",
        "^q:XS",
        "We~xt",
        "y:0>w",
        "H~;\"9",
        "].{@ee",
        "ams, ja jaunin",
        ")I%dl",
        "tkub arvuti j",
        "s vietas. Setupcomplete.cmd ir piel",
        "<6ut\"",
        ".xf1V",
        "ldk\"lhHyU",
        "LaunchProcessInSession",
        "P,`)bnR",
        "2.N?y",
        "9?V <",
        "&Windows 10 installimiseks valmistumine",
        "k?/2\\'",
        "A arquitetura que selecionou n",
        "(n<0kz",
        ">k?n%W",
        "LTf)+",
        "W0'4eS",
        "h*!>u",
        "wOY\\2",
        ".ERW~",
        "v14z=",
        "meGX~",
        ">7Q\"X",
        "BhZ&{",
        "my-MM",
        "/dfJ$",
        "EWPTPv",
        "K!=wCG(",
        "Kgx,/",
        "CSc8+9+",
        "om. Ak je vo va",
        "_gZ^e",
        "0d7!\"",
        "}euT~",
        "D>\\a_",
        "TWE{=?",
        "se, beleegyez",
        "i cel",
        "RWu+!n~",
        "}cgAE",
        "Ct>D}",
        "$%|.QF",
        "I&8]&",
        "&%S1Pvk",
        "Iv9~3",
        "a\\y'm",
        "AmsAAyB",
        "Esempio: setup.exe / auto clean / installfrom d : \\Wim\\customwim.wim",
        "|L|S^",
        "]vP(r=ee",
        "installatie. Als",
        "E!aRG",
        " _Q?7O",
        "BS%e|U",
        "6Q!0Z",
        "un_.<",
        ": / copylogs <",
        ". PC ",
        "installation :",
        "Nc3kB",
        "<9TG7",
        "tres : chemins d",
        "gc*2@,",
        "n3s|V",
        "<s<'>",
        "6lF4Y3",
        "@rt(qk",
        "#[@_vIk",
        "n#uS)",
        "GXb>5",
        "CP8Jmh",
        "8__7 ",
        "W0~0!",
        "|R2R9+n",
        ">jFt8",
        "{gm'$Ly",
        "@-_an",
        "))&`8R",
        "hQjU3",
        "=~v3n",
        "io,PJ",
        "YE=AD7kr",
        "NSRl(W",
        "%hcZL",
        "k~<m4",
        "y!OnDK",
        "?'{(c",
        "?HFT>@Q",
        "meql[",
        "fini sur All, le programme d",
        "6vX3o",
        "zd_'Xz",
        "Azione: se l'opzione / Telemetry ",
        "UbuYk6",
        "n format 5x5",
        "<Yw^G~",
        "D$8 )@",
        "^~o+P",
        "x}`CKU",
        "-ZMoQ",
        "xX#[O",
        "CDlpTask::PopChronicleResponse",
        "f>C{7",
        "NOTA : este par",
        "jw0}4",
        "Z3=dSkJBV",
        "Perjungimas: / auto <perk",
        ".#Oua7",
        " 64-bitov",
        "Y05dE",
        "mes gad",
        "V'6&h",
        " asennusta uudelleen",
        ",(FusB",
        "a haber una actualizaci",
        "0n0-N",
        "XA!0N",
        "o exibidos por predefini",
        "I&|p6}",
        "rigen Berechtigungen m",
        "F@W0d3o",
        "><j:[SDp",
        "a (OOBE). Alternat",
        "qxZ%O",
        ">EB%Z",
        "Wfl\\^c",
        " sijainnista. Setupcomplete.cmd on mukautettu komentosarja, joka suorittaa teht",
        " : / copylogs <location> ",
        "Wh?t'",
        "Leelawadee UI Light",
        "=)=4=j=t=~=",
        "]rkgt",
        "ByG6r",
        "N}C2=l",
        "da*PQv2",
        ")Y6~,:",
        "=aHtO",
        "%rf[s(+1",
        "R*a}e",
        ";}g5j@~",
        "SIP)QU",
        "u==W8",
        "I#qqk",
        "'urF[",
        "V\\wh[E",
        "8zCht",
        "u1zlO*$",
        ".?AVHiveListEnumerator@@",
        "ts parametrs Disable, uzst",
        "GDI32.dll",
        "jK\\'=",
        "JR%.e+",
        "KwQz(",
        "Sprawd",
        "RtlInitUnicodeString",
        "*SHFB",
        "Y3B8'",
        "labilir: : ",
        "?%'**",
        "WCU?@B,",
        "rnek : setup.exe / auto upgrade / migratealldrivers none",
        "hsx6M#",
        "te instala",
        "NiT]%{",
        "jU\"&$",
        "B^~k`",
        " un restart",
        "^!3&rO",
        ":{`N]g",
        "]QYyUZu",
        "T/p3zz<",
        "Parameters: N / A ",
        "e?tyi",
        "yl}/a",
        "8o2xa",
        "s3}kV",
        "W}Acj",
        "[ed8MiY!",
        "3)6Z}7",
        "i~R-_",
        "-s7Qv",
        "er le fichier PBR. ",
        "kleme kaynak medyas",
        "i_os{c",
        "S]Moi",
        "N}LXI?+l",
        "0f0D0f0",
        "uU[xpx",
        "]^;76",
        "File [%s] has the same version as [%s]",
        "lWv ;",
        "wn\\:Hc",
        "Example : setup.exe / auto upgrade / quiet",
        "k66 \\+",
        "Z.p\\~",
        "Dg?P*_",
        "?}A+K",
        "<{-L{Q",
        "OHT*#E",
        "jYn42+",
        "3q!*&",
        "Mg%B9",
        "YCwoa",
        "r en feil. F",
        "ytkownik ko",
        "lreiz m",
        "3;z|u",
        "QS>-7",
        "uD<m)",
        "<guD9",
        "Jo(Q~",
        "*Sv|vYu",
        "|6hv\"z+",
        "|G|;%",
        "{@tXt",
        "_Zt=\\",
        "V#{U^",
        "eEwue",
        "Iv0pH",
        "c n\\#",
        "J,GoQ",
        "'%u=b!([0",
        "#k`xU",
        "92!RNGu",
        "ou$Xe",
        "*NEH+q7",
        "&#NZl",
        "r installationsprogrammet n",
        "GDI+D:",
        "#J8=m",
        "z8 jB8",
        ":[+|6f",
        "Jst.N",
        ";02uS",
        "H24y5",
        "{?=q6,n",
        "^O4Wc",
        "KW5k))",
        "X4JMT",
        "9egZ<",
        "ELjHl",
        "n7~~|",
        "ZG\\=k",
        "Alternativ, un inginer de implementare vrea s",
        "\"z\"%b",
        "Global\\Microsoft.Windows.Websetup",
        ",9C*LG",
        "5K,=jo2",
        "1fVr;",
        "xW2c_",
        "+Priprema za instaliranje izdanja Windows 10",
        "GzSDi",
        "Konfigurera",
        "0~q$az",
        "dwe[@y",
        "sit versiunea XML necesar",
        "\"vq%p",
        " komandin",
        "P6YM)",
        "{1<LS>",
        "Q>OBl",
        "boru alebo sie",
        "mommp",
        "/NC_zY",
        "ZRgh]-",
        "\\XSEa%S'J",
        "Ogz{Sp",
        "v], X",
        " C'G ",
        "8GPE0",
        "/P#)XVh",
        "U5BE%",
        "pF 8i",
        "rs: setup.exe / auto upgrade / noreboot",
        "yTw]U",
        "~D(K_",
        "F>Gv'",
        "klemesinin davran",
        "iniet palaist uzst",
        "`HQMR",
        ">Y;qL",
        "Exemplo : setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "3YGHn",
        "]{cVz",
        "]MB/e",
        "qsNL0",
        "[eHH4%",
        "3C3X3n3",
        "Kontynuuj od miejsca, w kt",
        "Y]9>W",
        "D4SbL",
        "a peut-",
        "itatakse s",
        "m]n>o",
        "Opzione: / installdrivers <percorso> ",
        "M<f(Y",
        "@NtM %",
        "r / showoobe hoppas v",
        "TA-vWr6",
        "w+12Ml",
        "8e8l8{8",
        "ocZ9J",
        "{[<do",
        "D22]5.",
        "NL?S=",
        "Li)ML",
        "sszes driver.inf f",
        "Installer",
        "E\\%H*",
        ",tV9[",
        "\\wwI5",
        "Xh*1xL",
        "A7x{\"",
        "ft[3im",
        "QAqI`",
        "]A4c`",
        "Parametri : Upgrade; DataOnly; Clean ",
        "$=P93jMD",
        "OiSN4",
        "lMtc;",
        "if2EB",
        "(-?Wi",
        ".advapi32.dll",
        "/sEJM",
        " provedli po",
        "[%~p^`",
        "6Jtm:",
        "x:8wS\\",
        "latam",
        "GCH7S",
        "c}'qsn~",
        "vz>It",
        "s saspiestus ",
        "xWWvro",
        "nXSU)",
        "<!<F<`<m<",
        ".qnWiz",
        "installation copie ou charge les journaux compress",
        "n specific.wim ",
        "ck(W2",
        "oXdXnXm",
        "L9Vt-",
        ".]=0a7",
        "ja ievadi tikai tad, kad dators sasniedz OOBE: ",
        "%w't%",
        "De geselecteerde architectuur komt niet overeen met uw pc. Als op uw pc bijvoorbeeld de 64-bits versie van Windows wordt uitgevoerd, moet u de 64-bits versie van het hulpprogramma gebruiken. Voer het hulpprogramma opnieuw uit en controleer of u de juiste architectuur hebt geselecteerd.7Er is een probleem opgetreden bij het starten van Setup",
        "<x=iZB",
        "14Got",
        "ranka nepriima komandin",
        "|2:2,5",
        "\\?4s?",
        "30`-L",
        "Ru3h]Q",
        "s#&sD",
        "Instaliraj",
        "Y*PE*",
        "91S#M",
        "{N{NV",
        "y|V(X",
        "PPP000",
        " : / migratealldrivers <paramenter> ",
        "ye ula",
        "Radnja: Instalacija ne",
        "-jB#/",
        "59=HQ",
        "ar do in",
        "T`}N3",
        "F%^$jy",
        "\\1+]N",
        "k21&G",
        "+*{#RIo5",
        " tutti i file driver.inf trovati nel percorso specificato durante il processo di installazione. La ricerca verr",
        "K_P>Hl",
        "\\{X*5",
        "v.vEK&",
        "fIbn\"Xv",
        ".?AV?$CZeroInit@VCSetupPageResume@@$00@@",
        ">D>r>",
        " yeniden deneyin.kKurulumu ",
        "CqpTa$",
        "rg Znx?4n",
        "b_Rlf:",
        "2$'l`H",
        "3%?06",
        "%<q{85",
        "Actie: voorziet Setup van de opgegeven productcode. Deze",
        "ny0bk",
        "zw]@c",
        "60*wk",
        "x`^&P",
        "2^D[n",
        "litit tuleks kasutada ainult testimiseks ja testimiskeskkondades. Seda ei tohiks kasutada tootmiskeskkonnas. ",
        "=$s9.",
        "9s$uC!s",
        "(M?'b/",
        "z<X&3",
        "CDlpManager::GetThreadPriority",
        "d2EECPV",
        "3@U`O",
        "-SBxL!<",
        " um script personalizado para executar tarefas posteriores ",
        "LkLYB[",
        "q:buNN",
        "X&&T{",
        "a_P#wO",
        "(k@4)&(",
        "?'3`=s",
        "f`u>{",
        "b@M#&A)",
        "=p4jH",
        "2Gk<N",
        "1me<{",
        ")o5H3",
        "[=:x7",
        "T:L;zw",
        "DoM@*",
        " definido como Enable, o programa de configura",
        "V.#>W",
        "x?tI*",
        "Parameter: / installdrivers <placering> ",
        "7'Udf",
        "+%9JE.h",
        "Parameter: Full; None ",
        "g5]JR",
        "n@3ud",
        "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\">",
        "V9^T?Yq",
        "#4FU.",
        "/Sy6-6",
        "}!|2;W\\",
        "FV=u#",
        "C)M#J",
        "z.3ID.",
        "eShKWdn",
        "$,$urh",
        "WHYLzm5",
        "@KGB,",
        "pet, ",
        "?(~W|h9:+",
        "revleri tamamlad",
        "?K?|?",
        "+%(Uv(x",
        "Windows 10 Kurulumu$Windows 10 Kurulumu zaten ",
        "Disable ",
        "['{zb",
        "[FO}S+",
        "M}GL^",
        "GC/W/",
        "xel: / Postrollback <s",
        "n2+(i$WP",
        "z6mnX",
        "%H9xU~",
        "soAme",
        "YBMH{",
        "'!Pi>",
        "pao<B?",
        "h.Q<G",
        "!.2~I",
        " 9!]`d",
        "igustega, mis on installiprogrammi k",
        "+UgQ30",
        " parametr Disable, shrom",
        "9\"9Z9z9",
        "2w'1B",
        "*$\"a#",
        "=+=6=c=",
        "1KQ fF",
        "O8cr?",
        "tg8cX",
        "rH*.|7Cm",
        "qg1/v",
        "{<96\"",
        "%aKU`\"",
        "adM4D",
        "oHwL!",
        "L#m`k",
        ",lT\\[<",
        "E$3*?",
        "Ql{1@J",
        "6X1;-G;",
        "_iEU&;",
        "4%MK3",
        "UAURUT",
        "uje pomo",
        "1h?M!zC3y",
        "%VQlSKH",
        "ice XML/Napaka pri pripravljanju medija na trdem pogonu",
        "}Wws-d",
        "R\\[?u",
        ":K`g)",
        "t&seUm:",
        "/ migratealldrivers se establece en None, la instalaci",
        "TL0B0",
        ":bi\\J",
        "f&5?_",
        ";d0\"Z",
        "skVx`",
        "ruje a ode",
        ")yY(T",
        "Ar`wpp",
        "  SetupCore.dll",
        "wyF-G",
        "jlokat a k",
        "z=1QX",
        "'jtUS8",
        "($!p\\'",
        "P0M>>",
        "`)3,r$",
        "Bs0!_",
        ">EWzA",
        "s;0[A",
        "njecteerd' vanuit de opgegeven",
        "w&Xxda",
        "[{\\Y6",
        ".\\Lang.ini",
        "3FLG'",
        "CDlpManager::Deserialize",
        "[4$X_l",
        "H^^Q-",
        "|sxNJ",
        "n\\%oL+",
        "<Z=u=",
        "=v?Fzc",
        "Bmdww",
        "&Tilbake",
        "v=*,/",
        "txM^*3%",
        "t.+5V&",
        "%upZhrU",
        "-&780",
        "]t&C+",
        "hcyF4",
        "MS7SA",
        "m3&j{",
        "+[;Zl",
        "p2\"TY",
        "TvoRTv",
        "v'nCQ",
        "GC.ai",
        "d$BH{",
        "%fq4`",
        "/c^f|",
        "uje instalaciju da pozove skriptu setuprollback.cmd nakon neuspe",
        "9(@XPf",
        "zp :l",
        "FA[ai",
        "X*&62",
        "vPHBT",
        "llapotk",
        "x2Sc!",
        ">DX(`V",
        "J{Gum",
        "`s67u\\",
        "-i6)i",
        "{X|taP",
        "B=4~v",
        "^j&;1",
        "mO)v|j",
        "xYz*,",
        "V\\wn47",
        ")7c`'",
        "\"#y[rS",
        "b!]<r",
        "A'Lo@E?",
        "DeletePath: Cannot delete <null>.",
        "{\":?P",
        "F]7`]",
        "lo je do problema pri pokretanju instalacije",
        "Dv4lx",
        " cesty UNC ",
        "rj=<)",
        "]2kF,O",
        "YA|g_",
        ";<a?H",
        "$A!q,",
        " nameV",
        "M3C~$7",
        "T[{)-4",
        " program znova.",
        "CId_|WG6v",
        "tTBh&t",
        "CMediaScenarioCtrl::DetectResumeMode",
        "unara na prethodni OS. Pokre",
        "dami gauti daugiau informacijos, program",
        "jlt bet",
        "`d-b;\\",
        "e&[x\\",
        "dj3MT",
        "\\Cn\"w(",
        "^ZeC?~PS",
        "q!y!SC",
        "ZS522",
        "sKL/[",
        ",#Puu",
        "#hq@J",
        "\"FE\"N",
        "MvLB;",
        "outil et veillez ",
        "jQ6[A",
        "OJ~!Y",
        "Tr*Fx",
        "@AT]A",
        "919B9H9Z9q9w9",
        "TO>}D",
        "@JR4%`",
        "[l<XTaQ",
        "Ybrq*#",
        "e^2GcA",
        "?k^mn",
        "bg}2q",
        "}_6oP",
        "z?ngV",
        ":ziz5",
        "23/(=+",
        "$hEj`",
        "LBJvH<",
        ". Soubor Setuprolback.cmd je upraviteln",
        " upgradovat po",
        "TN^=)r",
        "8.898a8y8",
        "<#<)<5<@<E<J<P<Z<d<t<}<",
        "Exemplo : setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "VPW(G",
        "r utrymme och f",
        "c#,AD",
        "ratud failitee kasutamise ",
        "?D4$v",
        ",<LBg",
        "O(udk",
        "L=tJ/",
        "nea de comandos. En el s",
        "V/%dN",
        "|%%bD",
        ",z.Abve",
        "7lt#t",
        "o_~bIOH5",
        "@jB'A",
        "|6%Rf",
        "rX9~6",
        "\\7~iic:",
        "TVZAc9[",
        "2(2@2",
        "Microsoft Corporation1&0$",
        "N>.1u?",
        "M*K>G",
        "ajte ponovo da pokrenete instalaciju izdanja Windows 10.",
        "l}bK'h'e",
        "&@n@=",
        "\"71;p",
        "0+*JT{",
        "CDlpTask::Deserialize",
        "ot}y?Z",
        "CU\\4gP",
        "/%c>H",
        "A~vbbS",
        "}Ac4t",
        "rxn~6",
        "mi opr",
        "Akcija : Kada je / showoobe postavljen na potpuni, krajnji korisnik mora interaktivno dovr",
        "already",
        ".\"\\$u",
        "}YNVh",
        "-S`sA",
        "pHe@j",
        "{e;o@",
        "O3 :nM",
        "cijas datu nes",
        "~w~zz",
        ">%{&)Lb",
        "stroja. Sk",
        "N!k{veQMR",
        "fp7:7",
        "dM m|",
        "xlj;+",
        "z/5\"{tn",
        "nFrT9",
        "T1[cFC",
        "${|oS",
        "}/[+8~(",
        "ta. Minim",
        ": setup.exe / auto clean / installfrom d:\\myWim\\customwim.wim",
        ";'[gEKl",
        " Service Pack 3.j",
        "r aktiviteter f",
        "x1Q3vpy",
        "ipravit",
        "n ve arac",
        "*;kQZ6",
        "n del usuario. Se ejecuta con privilegios de sistema. ",
        "K1kx+",
        "r(02?",
        "\\3s3s",
        "kG.'m",
        "\"k^G;k",
        "3|3zs",
        "r42/EK",
        "9hw2M",
        "3}o-$.Iz",
        ":B=Lk",
        "nCSL\\",
        ".wV`.",
        "*~%\"W",
        "%'J~$",
        "Z>l/S",
        ")GuKU",
        "jiet datoru un p",
        "s vietu / files ",
        "b_A[M",
        "\"uFV#",
        "$ZY)/",
        "ratud asukoha k",
        "=?_nO",
        "4<.Vq",
        "qLL!k",
        "f0U^Z",
        "]mZ5Z)",
        "286xm",
        "FywoC2",
        "]U!z}(I",
        "j%N)yS",
        "npRY2",
        "<3<}<",
        "G\\8W!",
        "V_9mJX=",
        "AZ0t/)",
        "i bel",
        "9BX5W",
        "mV^/((u",
        "QJ/.5",
        "'ZbOq",
        "tzG0F",
        "Preparando instala",
        "]>'0^",
        "sbP/v",
        "ndaren eller processen som startade installationsprogrammet. ",
        "rVo_04",
        "@Fj2RMdA",
        "371CS3",
        "$b5G\"",
        ">R7 4",
        "2$2,242<2D2L2T2\\2d2p2",
        "wn$XG",
        "Switch : / PBRUpdate <parameter> ",
        " tieto predvolen",
        ")J'R!",
        "(P*0f",
        "lIK([",
        "\"eH&-",
        "AbXNJ%.",
        "\"}@PWEP7",
        "k>M;j",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack",
        "QU\\?!",
        "S=?;D",
        "am4/B",
        "_V,[^[",
        "no z uporabni",
        "9l^Rk",
        "%<]Sp",
        "*Tm!#w9",
        "4B,GQ#N",
        "j~NJA;",
        ",!x6&{",
        "$$k!W",
        "Parametre: Cesta k lok",
        "Me7'l>{",
        "\"yCJf{x",
        "EnumeratePathEx: Callback requested enumeration interruption or hit internal enumeration failure on [%s]; GLE = 0x%x",
        "[W0_04X",
        "d<K88~",
        "npkrB",
        "#r&<\"",
        "!lrRlI",
        "b}7l+",
        "cov'b-",
        "</=L=",
        "Mj^Wn",
        "x HMI",
        "qu(SR",
        "Un probl",
        "%s /progressCLSID %s",
        "4DR4Dp",
        "4lcz](|%V",
        "(C_`h",
        "/>BHg",
        " pracovn",
        "]`lH5",
        "I%U$J",
        "BNTFa",
        "D$PSV",
        "gsAu6",
        "s2_f<",
        "4K[wa",
        "~BVD:",
        "sP3%-",
        "0l8\"z",
        "\\-N7FK",
        "Xt^0yJ",
        "rtR.,",
        "~GKWM",
        "&*!9\\",
        "buPInsLL_mZp",
        "Us@}TU",
        "2Jzz7$",
        "oSC<q",
        "rT<DR",
        "~fn`q",
        "ho syst",
        "9vEVc89",
        "Zv@E+",
        "1;9 t",
        "#$br9S",
        "/l?Awx;",
        "?o\"3j",
        "_ ceV",
        "C<(lI",
        "^/f&T",
        "nBDRy",
        "QW7tQ",
        "#u.2V",
        "DUDownload",
        "a relacionada con le instalaci",
        ".{_-kU",
        "Ju`o=",
        "NTYR(5",
        "NH\\'FU",
        "CPackageScenarioCtrl::PopulateWorkingDir",
        "cijas migr",
        "&;R{b",
        "Commutateur : / installdrivers <emplacement> ",
        "Af;:u",
        "w\\B&kI\"",
        "Wc@Ni",
        "2$202<2H2T2`2l2x2",
        "C;C>N",
        "NnHg_7",
        "H5[u*",
        "u Denetle",
        "=?OySQ",
        "GetParent",
        "sbaf6",
        "/>AV'x",
        "5jVQ8N`",
        ";d@i<",
        "e21K|",
        "xpqqJ",
        "e se ponovno pokrenuti.%Nije prona",
        ":8!++,& ",
        "Ni+Zo<",
        "Ms?`q",
        "6/pa:",
        "E[=61|V",
        "[_<7X",
        "o, mas s",
        "O-N*{JJNfd",
        "pxgm0",
        ")<,lkTVX",
        "_wcstoui64",
        "4(m=Vt",
        "@@@@@@   ",
        "dia na pevn",
        "Signalling actions thread to shut down.",
        "h?6[~lj ",
        "hIIbn",
        "Hf\\Sx",
        "*2c1q",
        ". Po jego w",
        "L rN[k",
        "=oDu~",
        "es para criar c",
        "wnym no",
        "4*;%:j&",
        "-r|vZ",
        "Tj7.w",
        "#{v^/",
        "494S4",
        "OTDZh|",
        "E=3}~",
        "c/[)!",
        "?oia=",
        "-0[0j0w0",
        "!B;!Q",
        "^JcvO)",
        "_x-B]",
        "m7?+5P",
        "i*+qqk",
        "3P-0G%",
        " nem indult el megfelel",
        "M~>V\"",
        "CDlpManager::ReportData",
        ":n=u=H>L>",
        "laOd2",
        "M~$ j",
        "^@}(3(",
        " _4\"eVH",
        "wR1>N",
        "+RF.'.$K",
        "N60t4I",
        "bT7a@",
        "uKiLC",
        "'s_Rk",
        "m^qs>",
        "bC-&'",
        "#CPx)X",
        "WK!.Z",
        "$U(%r",
        "Legal",
        "?'>;3$'",
        "8  NH",
        "$jqVtuv",
        "/ EF|",
        "ZPpf#*",
        "=9aM3h",
        "d}+sb",
        "\"\\Mc\"",
        "`H\"Gl",
        "5:&tL",
        "|-)~\\k %,-;",
        "VEg2y",
        "53NDA",
        "0-Nk0Y0y0f0n0",
        "rii. ",
        "wU&m.",
        "BJ?*7",
        "AEB3x",
        "dzie kontynuowana po nast",
        "v<-rh",
        "4HMk7",
        "|C?-:",
        "]-]GGG",
        "v~E^^",
        ";4WQO.",
        " de seu computador. Por exemplo, se seu computador tiver uma vers",
        "o. Feche a ferramenta, reinicie o seu PC e experimente executar a ferramenta novamente.oPrecisamos de pelo menos 350 MB de espa",
        "CK9o[?R+<",
        "#1\"&p",
        "*wEX%vL",
        "prs-AF",
        "WEUpl",
        "X4y*v:v*",
        "\\qQFT",
        "/_T^N",
        "iGd/8",
        "cie sa vy",
        "{^`X2",
        "anas UX, ieskaitot atrites UX ",
        "w:W!B",
        "k?&1g",
        "<;=d=k=p=",
        "in konum belirtir / files ",
        "+T)#:",
        ":1I#_hH0=c",
        "e as telas de progresso s",
        "w(\\PxD",
        "&M1dl",
        "? ?.?M?n?{?",
        "vkls1",
        "<E(.VJ",
        "5I*N,",
        "-HhH!HEoM|",
        "5XOXEXCX",
        "idArG",
        "\"88(#",
        "A2U*5",
        "o do Windows 10 j",
        "=F>M>",
        "_<!<L",
        "re getting a few things ready",
        "CTy2m",
        "lkomstprogrammet. F",
        " setuprolback.cmd ",
        ")U1hK",
        "jx2KbZcDL",
        "UlT5A",
        "Inh<B",
        "[QAE]",
        "t be able to go back to %1!s!. Do you want to continue?",
        "a6xDn",
        "a0i^n",
        "9`e_ ",
        "s$ZF7",
        "b dv\"N",
        "B#^CR}u",
        "rangos patirties*S",
        "!?TMX",
        ": All",
        "R^Eeo",
        "&L3#{",
        "u(7P^",
        "2h^VZ",
        "z;k}MF+",
        "cw&<G",
        ":\"~%_",
        "&On:$",
        "mndIGRq",
        "!T6\"C",
        "MrFVT",
        "9^<\"j",
        "0BHBdP",
        ";punQ",
        "p2$J)_",
        "G%RDy8",
        "@[s.#E",
        "s su diegimu susijusios telemetrijos. ",
        "WJ_jwT",
        "iOo(m",
        "{I$#t",
        "#KO\\:",
        "WqC/-:w0",
        "sVurX%^",
        "Pavyzdys: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "ZB9CW",
        "valV:",
        "ivityksi",
        "ncia e instala",
        "PhHK@",
        "mPed(",
        ".^s8$",
        "jhnKp%",
        "Actie: hierbij wordt het bestand setuprollback.cmd 'ge",
        "dO-ujD\"",
        "a=IIq\\/",
        "s,6B p ",
        "ho rozhrania vr",
        "^Xp.d",
        "H&SVRm",
        "[\"t8$",
        "i este posibil s",
        "I6R8;",
        "BK7kK",
        "h*9H.",
        "e\\\\\"F:",
        "$0fR2",
        "0/YAl",
        "K>k,/",
        "W_d6Ub.~",
        "        loadFrom=\"%systemroot%\\system32\\kernel.appcore.dll\"",
        ";=}Ac",
        "\")cHX8",
        "%\\W6j:",
        "CdHd_",
        "%Hjnb",
        "(9ZPr",
        "7jY])",
        "OtUc|8+Y",
        "Pasirinkta architekt",
        "`}C8\\",
        "|iU6+s",
        "Vad?d+|",
        "UDUQm",
        "}Q.pX",
        "!LY6%",
        ",Y,{I)",
        "Md'rK",
        "bf['\\",
        "b?KOo)",
        "rer installationen, indsamle logfiler og andre diagnosticeringsoplysninger fra test-pc",
        "]r&Yz",
        ".nHh]",
        "tXoB]",
        "I>jg.",
        "ki do plik",
        "TwfIe",
        "r46c(_",
        "0!0X0",
        "n2_Ji",
        "BXuQzG",
        "D*D/?d",
        "md79A.",
        "CiwVk",
        "+R6?dt",
        "G=eBJ",
        " WindowsAA telep",
        "_mys0",
        "V/D`w",
        "]u.nzC",
        "~M34SqO",
        "\"v9P}{",
        "Is5'=k",
        "(?.,)Epp",
        "hNjr0",
        " dizine yeniden kopyalay",
        "{U5Rio?",
        "OdFtqMI",
        "z#afGC",
        "(#jTjZ",
        "|FeHN",
        "D$lSP",
        "[+5\"rB",
        "Fq\"x+",
        "hB5=`",
        "BIFIEIG",
        "q`#@&&Y",
        "PD< GN$",
        ",m,G?",
        "M+}%3Z9",
        "6?c>f~",
        "HiEYE,",
        "cP{/G",
        "GKll7",
        "den for Windows-installationen>Die Sprache der Benutzeroberfl",
        "c0b<D",
        "P`91E",
        ".nYfRE",
        "^ x[l",
        "IDEZ\\",
        "nvalvoja haluaa p",
        "CDlpTask::UpdateProgressAction",
        "0?1j1~1",
        "hO$\"vn",
        "r+/`b?Ah",
        " autom",
        "'_Ig|",
        "3B3c3",
        "[=e#9X",
        "`$/Bd",
        " opcj",
        "k4%n>",
        "b:M?Ci",
        "e }sc",
        "z^E.n",
        "?KAD<",
        "(L0'|",
        "19YrHpHK",
        "pI^ML",
        " Instalatora. Uruchom komputer ponownie i spr",
        "n.gEsta versi",
        "$XD<\\'",
        "nI?=2\"U^",
        "A2YjDq",
        "lt telep",
        "ProgressHandlerAction: Sending final progress message for action [%d].",
        "werden im Rahmen der Installation keine Treiber von Setup migriert. ",
        "y6OiU",
        " establecido en None, se omitir",
        "itamiseks on vaja v",
        "}L%Z1",
        "Adobe ImageReadyq",
        "Npj7?",
        "5]M)~C",
        "h\"zM*",
        "seau et vous avez peut-",
        "U^y\"%",
        "P3Fh/",
        "&atV?LYV",
        "wW#|a",
        "@c<u ",
        "fPt_36-",
        "$qR:Yh^",
        "<Unz*C",
        "#d`CL",
        "@ZHJ'w",
        "qKz2S",
        "+e*#j",
        " von Setup eingef",
        "IMluW",
        "rwc!7-d",
        "EvV!TC",
        "V'c0{",
        ".`1\"\\",
        ")f)PH",
        "WC>F&",
        "txM&l",
        "$$cu2",
        "Parameters : Local file path or UNC network path to a file named setupcomplete.cmd ",
        "8Ti}>F",
        "zn^O=",
        "KE5l!T",
        "ptwUst",
        "zrnE`",
        "787@7L7l7x7",
        "yi],?",
        "#rEMI@5",
        "s du fichier sp",
        "#3.,CgoQ^Q",
        ".?AVCWebScenarioCtrl@@",
        "p &:~",
        "bddTB",
        " =:oh",
        "V2- / ",
        "V@Biy",
        "@AOl3",
        "eo0c~",
        "$Vlq6M4",
        "REMARQUE : ce commutateur ne doit ",
        "S^U=2",
        "xc|0J",
        "8w8}8",
        ";`LU8g",
        "yZ.xk",
        "} pf|",
        "RK6su",
        "O%z/,,l8",
        "GetNativeSystemInfo",
        ",5j);",
        "b)s@1",
        ")lM*mZe",
        "$)?.ME",
        "EH%EK",
        "tartujte po",
        "P7S_jf",
        "&_ Tb",
        "=W^!o",
        "NA<OA<OA<C",
        "   @@@```R",
        "mZhJ_",
        "0GUGsT",
        "*1_Y+",
        "2#3-3K3]3z3",
        "zSrx8V",
        "es-GT",
        "DlpTask: Skipping action progress reset due to action cancellation request.",
        "s, kas pieprasa lietot",
        "#4\\tQ",
        "4<iH~",
        "G[glxmI",
        "lonej lokalizacji. Komputer i/lub u",
        ">Y-Xv",
        "NtReadFile",
        "&nPrG!F",
        "i_pl]",
        "kC7_lu",
        "?c2v=",
        "bS/T(\\a",
        "#6,]/i",
        "sP*%b",
        "9u^]P",
        "NPNy1",
        "o'6u{#",
        "$_(!6d",
        "vkeYy",
        "ceho pr",
        "ih9;m",
        "j{u]A",
        ": / installdrivers <hely> ",
        "dkHr,g",
        "<YY7Z",
        "i, Instalarea Windows 10 va reporni automat.#Nu s-a g",
        "dnSA!/3&D",
        "K]%9Y",
        ".[Windows 10 ",
        ")/nb{",
        "W2 K~",
        "SetSecurityDescriptorGroup",
        "\\Z{h~\\",
        "\\$ ;E",
        "Zw/6B`",
        " %pn)",
        "P:l!}(",
        " zvolen",
        "da(ur(",
        "5+6Q6",
        "Action : When / showoobe is set to Full, the end user must interactively complete OOBE.Alternatively, when / showoobe is set to None, OOBE is skipped and components are set to their default settings. ",
        "#(CNT",
        "Valmistumine9Installiprogramm ei saa p",
        "[R~%oI",
        "GetFullPathNameW",
        "PntPa",
        "5,f ,",
        "Zaznali smo, da name",
        " den angivne placering. ",
        "?J;_kp.v6",
        "ifTH9",
        "Parameters : Local file path or UNC network path to a folder that contains.inf files ",
        "000000",
        "PN*cFx",
        "2g 7l6",
        "diegus, kol dar neprisijung",
        "@U)zh",
        "(\\V7<",
        "/ migratealldrivers",
        "CDlpManager::SetQuadwordProperty",
        "J|&Ub",
        " egy m",
        "]jOII",
        "U~x*-",
        "519^GT^",
        "nL\\oX)9",
        "F GBF",
        "6hhea",
        "}1u&L;i",
        "Vf/O=",
        "8mb>n'",
        "essayez.rSi vous installez cette version de Windows 10, vous ne pourrez pas r",
        "E>+WH",
        "8J81x",
        "^76?\\",
        "\"Do\"j#?j-",
        ")|;*d",
        "LRJ4R",
        "zp#ku",
        "&r`!-",
        "<CtEZ",
        "Instalare Windows 10",
        " executado com os privil",
        "S::>7",
        "8+)7s",
        "J0_oK",
        "WaitForSingleObject",
        "Akcia: Zasunie s",
        "=FlW]",
        "Action : / Telemetry Etkinle",
        "to,Z~x",
        "2F9lS",
        "h#/SJ",
        "Ps'y,U",
        "@?cj1",
        "&M\\_S",
        "Switch: / Postoobe <location>\\setupcomplete.cmd ",
        "P5%vi",
        "TS.`\\",
        "1a,dA5",
        "s!8mj",
        "`c+0|(^",
        "H'MU0",
        "Na primer: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "f\\`W'",
        "Verificar Compatibilidade",
        "uB.:+",
        "gz~?J",
        "rp>*r",
        "2uZfV|",
        "(F#L&",
        "&HMD,!",
        "+]``q+|J",
        "vI\"OK",
        "sr-BA-Cyrl",
        "8|s__U8",
        "=(1&Y",
        "ati da migrira sve upravlja",
        "i PC-ul revine la sistemul de operare anterior. Ruleaz",
        "nchide",
        "ik5;f",
        "n de OOBE, actualizaci",
        "      ",
        "__COMPAT_LAYER",
        "#-[><",
        "J7oCf",
        ")b'A[",
        "nitelep",
        "+uV)'",
        "L)u\")",
        "G(Qn%TW",
        "ovat z m",
        "E:Mx-_",
        "K!/MT",
        "-..wc",
        "jJ7eYK",
        ";?!pB",
        "lkomstprogrammet: ",
        "nnen Sie nicht zu %1!s! zur",
        "Bf:3/",
        "OE\\_E",
        "o^D Y",
        "^b4nO",
        "qJD~l|3",
        "f|P )",
        "r$f$Y",
        "=,PU{",
        "installation ex",
        "\\$rTz",
        "@\"[shH",
        "rCqtm",
        "g(%fR",
        "adovan",
        "ZI]Kp",
        "c:z&-g",
        "#-L5%",
        "-777(",
        "bNj||-",
        "lggL:",
        "Windowsi installiprogrammi ei saa k",
        "J\"%!'",
        "3q!>&",
        ">O-\\HR",
        "SG|Mw",
        ":2:H:S:",
        "b)b!^",
        "!iT&.",
        "O\"0xP",
        "\\@`oQ",
        "ee3 _",
        "9)VZG",
        " lQ.2",
        "Cd.@*9",
        "bGc8<",
        "(x.t{",
        "+MtW>",
        "Handling: Flaget quiet undertrykker alle brugeroplevelser i installationsprogrammet, herunder oplevelsen til annullering af opdateringer ",
        "i'>XO",
        "jra a Telep",
        "mId4sO",
        "JGUgk",
        "rience OOBE (Out Of Box Experience). La ligne de commande suivante permet d",
        "Fe2+n",
        " telemetriu s",
        "f9FHu",
        "S>Gk:v",
        "L|J;;",
        "Bt;kO",
        ".Io$g",
        "\\|0z+^",
        "FxN9w",
        "U@x4g]",
        "O#jVK",
        "o5'5LO",
        "0n0MRk0",
        "3VW W",
        "./IQ}p",
        "ivitage installiprogramm uuesti.",
        ".3^7<",
        "}.&,-A[2",
        "1N2U2[2`2l2}2",
        "ORWNX",
        "18nrw",
        ">iQ7Y",
        "#$a6Kc:/",
        "g!<ud",
        "[:r]z",
        "V&(s{",
        "7 3@~",
        "1dU]=",
        "Y>/~5",
        "x#ifr@,",
        "zq*M/",
        "~g'r<|",
        "CDlpTask::GetChronicleResponseCount",
        "LEX\\g",
        "UNC para",
        "ebuje, aby si koncov",
        "eli da se korisni",
        "j1. {",
        "sfB>d",
        "=H{/8",
        "GzzYT",
        "*N[v>",
        "/ Telemetry is ingesteld op Disable, worden er geen telemetriegegevens van de installatie verzameld of ge",
        "R<fDO",
        "g;Wa_st",
        "8l;BO",
        "_RS-&",
        "!0&Xd",
        "\"+LW^",
        " impostata su Disable, il programma di installazione non aggiorner",
        "1T4zX",
        "Parameters : Upgrade; DataOnly; Clean ",
        "fY:)K",
        "c~9Rq.|w",
        "/7x$~",
        "S/e(<T",
        "c=<Vj",
        ")1y>;e",
        "uf`=Dx",
        "~LW3]",
        "metro : / DynamicUpdate <par",
        "d(=ea",
        "7p}SB0",
        "ni uporabnik ro",
        "{]6o!",
        "^n>]'o",
        "DBQw+",
        ">:v5)",
        "vMgbOh",
        "p]FgDo!",
        "Vi^W.",
        "VCU[S",
        "181=Q",
        "i kandjalt, mille l",
        "eh82i",
        "QQSVW",
        "BJ?O>",
        "Commutateur : / noreboot ",
        ";K;a;h;y;",
        "[n+TM",
        "?]jU~%",
        "0VC_jYFE",
        " To3'",
        "g, amikor a g",
        "{W$=e]",
        "9+%g*",
        "*_'qa",
        ")C8Nu",
        "vne dokon",
        "GJG5z(u",
        "e na oddelen",
        "7<7C7e7l7",
        "auM8=",
        "!'yQ8\\L",
        "kla ce",
        "TcEq=",
        "|eXD?",
        "gl6\"V",
        "5Y6f6",
        " XXXX",
        "lv!++",
        "=hg{I3",
        "+@vIH\"^",
        "W4Bl%",
        "jipDU",
        "'R; q",
        "&Vissza",
        "zKJy}",
        "f2GvY",
        "h%`B/",
        "wmA!T%",
        "iMErMKhM",
        "Xby]4",
        "V[>]f",
        "0~\\>7*?",
        "?bL2(",
        "#\\#{~",
        "J][Ut",
        ")oG>h",
        "ho riadka mo",
        "|Y76@",
        "o;)?C",
        "\\LiX)4",
        "%v/fE<s(",
        "pIBYIbYF",
        "xLAK^",
        "*/ABL",
        "Myp0%",
        "EorUX",
        ",ewEHxIAp9bI3Ax6yHttou+BjXcPhU+bEkHdmB0T5J+Y=0Z",
        "T;@l~",
        "0t=C~r",
        ")8&k;",
        "anja ",
        "_0<Y(",
        "S7M<.",
        "'=OTu",
        "de eindgebruikers handmatig de OOBE-ervaring doorlopen",
        "dium nebo soubory instalace. ",
        "9B9\\9i9",
        "ke Enable, a telep",
        "gE&%g",
        "{O-[ ",
        "espace, puis r",
        "elE9O",
        "Y&&X5D",
        "B{j\"<4",
        "R^EZt",
        "unalnik. ",
        "Parametrar: Lokal fils",
        "A4kHV",
        "?+?1?",
        "7R15R17",
        "gsnw(",
        "@#1|s",
        "TUv}1",
        "c^l=Q",
        "oCu?Q",
        "Izabrana arhitektura nije podudarna sa va",
        "CSetupLangIniLoader::Initialize: Didn't find any language listed in LANG.INI.",
        "@_Pl%",
        "5GyDw*k",
        "r]&nS",
        ";T.uq*C,",
        "93;3;s",
        "-:t)2Bj",
        "?C:`DU<",
        "I<kM}V",
        " a odesl",
        "4T6L8",
        ">1>E>K>_>d>u>{>",
        "F>(*`",
        "=CYT{",
        "7XZem",
        "Smktf",
        "7\"Z]1",
        "0~0[0",
        ".y^.7w",
        "GMzqB9",
        "nOO M",
        "GetLanguageMediaNumber: Language not found under language pack section.",
        "/7rlko",
        "en, PBR ",
        "\\MEm-",
        "-5s\\X",
        " V\"}g",
        "|m*Q2",
        "r noget plads, og pr",
        "4QE[{",
        "^V/O`",
        "0T*cVF|",
        "0xqEu",
        "2 333;3t3",
        ",c~F,",
        "Conmutador: / showoobe <parameter> ",
        "[Fj?EK",
        "/y,i<3",
        "SetLastError",
        ",GjC[",
        "|P71'",
        "gza}hx",
        "}dHMP",
        "239K#",
        "5W6^6",
        "2ajq[",
        "steemi",
        "MZPJ+",
        "Opzione: / PBRUpdate <parametro> ",
        "ZLp\\:^",
        "#&|{`",
        "Brvkx",
        "it-IT",
        "z@_<}",
        "ena potrebna verzija XML-aAPogre",
        " contains.inf.",
        "i ecranele de desf",
        "2oke^",
        "d5EMUO",
        ") ClO",
        "C}C;C",
        "?P`Jf",
        "D$0;D$(",
        "#7sy^",
        ",7/Um",
        "'^J(Z",
        "|uH59",
        "C,Wh ",
        "%<zt%",
        "p:rRyO*",
        "w}&-#",
        "1Yy.w{2",
        "LB73RZy",
        "<-b#O",
        "I4+{B",
        "FQc%Pcu",
        "Xbd$nH",
        "5p4G#qwl",
        "\\.i9|C",
        "1lM'[lto",
        "041F04B0",
        "Deleting folder [%s] after successful expansion...",
        "e6+Al",
        "Windows 8.1",
        "n de Windows no puede iniciarse porque faltan los archivos de instalaci",
        "lI@3y",
        "`1^q'",
        "pvrPS9\\:",
        "(TNL=)",
        "dg*c2C",
        "8=DyJ",
        "i loob installiprogramm PBR-sektsiooni. Kui aga s",
        ".zDI=",
        "uKFvi",
        "jumu. Savuk",
        "&$]|0",
        "<,ykj",
        ",2gTU",
        "(Y`\"9Y",
        "H;K\\[-",
        "?#?C?X?^?",
        ":%s*|U",
        "=N=^=d=o=",
        "0C0A04B0",
        "@@@@@@@@@",
        "4kxif^bz",
        "stroja sa vyskytla chyba",
        "PEi=#",
        "Ltt)>s",
        "3nYivU",
        "fr-CM",
        "R!uxE",
        ": / Telemetry",
        "Example : setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "A6BF^",
        "_lB']",
        "/Rup8&X",
        "A!jPT",
        "Bx4_=",
        "Bryter: / pkey <produktn",
        "5=ehs;",
        "/oh'q=",
        "<a<b#",
        "mbZzvr",
        "*@q+7",
        ">D:g#",
        "t9##Dz",
        "r oppmerksom p",
        "metros: ruta de acceso al archivo local o ruta de red a un specific.wim ",
        ", kun asennusohjelman toinen esiintym",
        ": / PBRUpdate <parameter> ",
        "x3n'E",
        "ste ha beh",
        ">w?3#",
        "*t/f,,]",
        "F$3<b\"",
        "_=de}R",
        "kl-GL",
        "ide: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "ESp}y",
        "fKw{G",
        "ploiement peut ",
        "Sklopka : / Telemetry <parameter> ",
        "larQB<~",
        "mby3C",
        ",7-\\`",
        "-O\\;@q",
        "SoRu,",
        "\"9N%qJ44o",
        "},W'\\",
        "/Eula Accept %s",
        "KD$':c",
        ";?}kS",
        " riavviato automaticamente.-Impossibile trovare la versione XML richiestaBErrore di gestione temporanea del supporto sull'unit",
        "M\\.^T",
        "~$ft{",
        "n5A6Kr",
        ":uO5$`",
        "tWz-y",
        "z=TBk",
        "*R-D~_H",
        "t?!>e<_",
        "qd:3]",
        "Dejanje: namestitvenemu programu navedete klju",
        "5N@5%",
        "7#_:`{",
        "~/p4G",
        "Cette version de Windows n",
        "klarla ",
        " impostata su None, non verr",
        "Y@saR",
        "G+1F_",
        "f*$#Oe",
        "2kjajg",
        "6@N:@k",
        "1w~:u9",
        ":Vt@iZ",
        "$<D%VFH",
        "?:?F?V?`?{?",
        "!u4pn",
        "JH-^C",
        "xxxhdd",
        "p~fkv~fmv~",
        "mh4Oa",
        "A[9T,",
        "$9@bcvL+s1[_",
        "42/]ib",
        "o8P}G'",
        "V>`Fk",
        "X111V",
        "u42Ex",
        " Windows XP (",
        "wj{u[",
        "}:T/K",
        "n}`*J",
        "CreatePipe",
        "%(>Jb",
        "2,3F3Q3y3",
        "metros : N / A ",
        "AbqR,UZ",
        "Setupcomplete.cmd ",
        "wT4k5",
        "*#{[^b",
        "]85)P",
        "Z\"oCY",
        "\\a8+d",
        "FlP-oT",
        "g9}v,)",
        "=@]K>1|6N'",
        "3vrgj",
        "1,M9vQ",
        "naIWN",
        "sL^^t",
        "s$Mk]C",
        "ua]Y,",
        "/g;h*&",
        "Recome",
        "um arquivo",
        "rBfhnF",
        "n PBR. Por el contrario, cuando / PBRUpdate se establece en Disable, la instalaci",
        "a4b(}",
        "}MXSh",
        "2bv6J",
        "cijas disku, kur nor",
        "jdete v slu",
        "xz/q#",
        "MH;r)",
        "CButtonEx",
        " 64 bit ",
        "3fDyNl",
        "D<@@r",
        "&evpyy<f",
        "^23&c+",
        "Vz4tE8",
        "4`5wU",
        "b>-7t]",
        "= >\\O",
        "^G#z>P?",
        "7*&Ny!1",
        "&iH *",
        "diaire du m",
        "ii implicite: EULA este acceptat, Dynamic Update activat, s-a optat pentru colectarea ",
        ":Divf",
        "<dq3d",
        "jI1j=_",
        ": / Telemetry <",
        "t(s8[w",
        "9A0vq",
        "QyToe",
        " jedoch auf ",
        "I0G1-0+",
        "pAUtW",
        " suporte para esta vers",
        "Fwkg<",
        "5m$|&",
        ".OM^0?\"",
        "DaNN%}",
        "nk~sxxd",
        "9*A[`",
        "Obs! Den h",
        "dR?s~",
        "(V.du",
        "+#XoyF",
        "Jz7=m",
        "Ac'%J",
        "g0jh=",
        "Cgd0+",
        "\\/gKf",
        "RS'>n",
        "T7qO<",
        "B4]E3",
        "?<QU|",
        "`m/<F",
        "g7x3D",
        "Y/\\N<&",
        "eno je dinami",
        "4#r<q",
        "2uVe3",
        "4uI[0q",
        "U%F\";",
        "djs6A",
        "nBfb7m",
        "8_`iV",
        "[_3o}3",
        "Xt6X{",
        "dX<1;}",
        "(Ali ste prepri",
        "CSw2G",
        "!4fJU",
        "k$[<G",
        "Akcija : Automatiziranje instalacije s odabirom migracije za instalaciju. Korisni",
        "]poB*^",
        "lU<A=",
        ".?AVCSimpleDialog@UX@Common@ConX@@",
        "Czy na pewno chcesz wyj",
        "3@4Q4V4\\4",
        "skX.5",
        "metros : All; None ",
        "seau. R",
        "zg (p",
        "{7~iY_",
        " Param",
        ">CiI~[",
        "Mcv9w5",
        "|'Q42",
        "CloseHandle",
        "NH {0",
        "Bqp,<",
        "C;$`A",
        "#(jF@",
        "'[WI{",
        "o<ZYa",
        "!OJo>",
        "( ?Y4X",
        "\"'OY+",
        "lJ\\+z",
        "w9M?9",
        "&mU}!|FE",
        "i8tYH:",
        "/''8/",
        "d+T,?x",
        "A=}*U6",
        "nJubz",
        "_`Oo;",
        "<?{G$",
        "jO8$.",
        "B,R>4;Zm",
        "}ci;,",
        "0Y0y0f0n0",
        "w:QgM",
        " program Windows 10 automaticky restartuje.'Nelze naj",
        "hem instalace nebo b",
        ";%ULn#b",
        "<R]rD",
        "ZI[W%",
        ")AS_G",
        "gn\"= ",
        "i)7PIm",
        "Lkbr-",
        "\\tBn8)",
        "_=n9+S",
        "ZmQ33",
        "#@TRc",
        "${Xj=%",
        ".fvAE",
        "p;dtu1",
        "xMP(h",
        "N T63",
        "#zZg5E~",
        "P<E(N",
        "+/<LX",
        "`%&G{",
        "Actie: wanneer",
        "SHELL32.dll",
        "&STgq",
        "ra installationen igen.",
        "Y7@ga",
        "cijas da",
        "l8d,v",
        "cznik: / noreboot ",
        "D;\\LY",
        "OO...",
        "1oiHmW",
        "rios finais passem manualmente pela experi",
        "S2D>nr",
        "fGdki",
        "o?j~f=",
        "8x-_[",
        "%,v[i",
        ">:z689[s",
        "]FVma",
        "IqvXzFB",
        "J?s3^",
        "tadja a telep",
        "L`1r0",
        "@LvT2",
        "h_|B2",
        "+vQ7k",
        "I=UGu",
        "Ejemplo: setup.exe / auto upgrade",
        "5Uqka%",
        "qrgY\"",
        "rankos UX, ",
        "p%PjyF",
        "         </requestedPrivileges>",
        "sTl6D>",
        "uOW!&9",
        " alebo proces, ktor",
        "^IBHX1\\HHB",
        "AIH^7ptA%",
        "hzh J",
        "_aKt*",
        "rt nyissa meg a G",
        "TK7*z",
        ",69HZ",
        "~VR^]",
        "UCS-4",
        "L<7wx",
        "zf=xCHq",
        "Yw5J7!",
        "BkO*K)%_B",
        "JH=oR",
        "0&=7~T",
        "Y}tIM$",
        "L*3OF",
        "xZ*=S",
        ":uJ]Q",
        "-wGp+",
        "b&nv/",
        "4I{\\o",
        "[4d2t",
        "Llj=dbW",
        "4`'k<KjTr3",
        ";btF)f+6+",
        " 0KZU>",
        "n ve Windows 10 Kurulumu",
        "CDlpRegistrar::CreateTransport",
        "CDlpTask::ReportData",
        "NmsZIP",
        " tai tietov",
        "pn],bG",
        "50F0K0Q0",
        "auG1~",
        "StretchBlt",
        "Bryter: / copylogs <plassering> ",
        "=IH 8",
        "1R|I]",
        "9ak[p",
        ",SC'\"6",
        "I*hw^",
        " bir dosyaya yerel dosya yolu veya bir UNC a",
        "/FlightData",
        "sly@B",
        "Xqg^\\",
        "kAl*$",
        "_5:>t",
        "j\\Yf;LG",
        "8#A4&it",
        "{Mtl&O",
        "X[Pbma",
        "[P?(W",
        "232p2",
        "CDlpTask::GetFileCount",
        "dq/Y\"{",
        "  wdstptc.dll",
        "X!]1{",
        "r du s",
        "6BgU+]l",
        "F\"14=Ei[4JD)y",
        ")J?y,",
        "@_r$MO",
        "#<!cg",
        "JlDQO",
        "9*25C",
        ":0:6:s:",
        " nem tudja bet",
        "?.!$~",
        "CreatePath: Unable to create parent directory for [%s]; GLE = 0x%x",
        "mJf?]",
        "Pw\\L}",
        "MT6{x",
        "nK5t=X",
        "SafeOS.Mount",
        "EQ{nru",
        "EIYGA",
        "}WKI!",
        "1*]elO",
        "l4<Zm",
        "_^!/<",
        "_purecall",
        "[jp?k",
        "h0D0F0",
        "i, hitra ponastavitev se posodobi ali ustvari. ",
        "{@&@~",
        "mR2hb^[B",
        "aGsc9",
        "vX7]5",
        "N//PRw",
        "Primjer : setup.exe / auto upgrade / migratealldrivers none",
        "        loadFrom=\"%systemroot%\\system32\\wdscore.dll\"",
        "$u~;FW",
        "Parameters : Full; None ",
        "4(gx3",
        "Jy0h]T",
        "des piekri",
        "N@{44",
        ")2e7dJ#-s",
        "[R6v55",
        " verziu n",
        "+eO|:A}",
        "x{&/_",
        "ygh_$",
        "ho rozhrania ",
        "MhE{:",
        " in esecuzione.jQuesta versione di Windows non ",
        "!?b{Mz",
        "8t-oU:]>",
        "ChRJ_yiyo",
        "]{IhNE",
        "oauv{",
        "c}:Xe\"",
        "tl#cO-",
        " konfigurace: p",
        " setupcomplete.cmd-tiedoston m",
        "^;$gm",
        "?Wwpa",
        "M1}O_",
        ">RD3.;fX",
        "_GnI+U",
        "[E8)?",
        "%fJ66",
        "10AZ%h`",
        "F!4J2",
        "`DB*vp",
        "{(~ f",
        "u-ImA",
        "Parametre: Enable; Disable ",
        "anu ar instal",
        "anu, tiks izlaista OOBE, tiks atjaunin",
        "pertoire racine du m",
        ":UB.N",
        "G86K+",
        " konfigur",
        "fze8vB",
        "?a9&9n",
        "}'9|^D",
        "~4$?=",
        "zyM|!",
        "^>[$54",
        "\\?Jx@",
        "s$7N\"",
        "&Hacw",
        "CL%H[",
        ", instalacija prikuplja i otprema telemetriju koju je generisala instalacija. Me",
        "V?F>9?",
        "9=9w9",
        "Ann&ulla",
        " argumenty p",
        "UmwocXyr;",
        "Vm,J9",
        ";VqdN7k`",
        "x)8Yr",
        "inverse, lorsque / PBRUpdate est d",
        "/=EaA_",
        "SizeofResource",
        "1T8ZTG",
        "NGx%G",
        "h',32t",
        "+Xj8B",
        "~+4e34",
        "RZsqe",
        "Z[N3*",
        "0#070P0h0",
        "/1*Z_7",
        "+Vv7KYYj",
        "m62pA~h",
        "7F7K7_7s7",
        "<w~91",
        "JA]pW",
        "1#ibUT)",
        "xM9sdtF",
        "eS_;#A",
        "UrJ^YS",
        "UmP,K",
        " parancssori param",
        " setuprollback.cmd.",
        "fdfr|",
        "JTV^~l",
        "[^U\\d'g",
        "ZUY Y",
        "k/Z6c",
        "qtdbVl@?",
        "J'M~9",
        "Cm@AM",
        "859F9Q9X9_9f9",
        "=Jz|2",
        " uruchomiony.yTa wersja systemu Windows jest nieobs",
        "}kl`O<",
        "G*rHE",
        ":u]Njr",
        ";dM~Pm",
        "cc) 1]",
        "n*Q\\D~|",
        "rLE9T",
        "t0L^$",
        "Eksempel: setup.exe / auto upgrade / installdrivers c : \\minOpgradering\\drivers",
        "@{C5Ci\\857",
        "1dv*^]",
        "0NuTpCF",
        ">mM{(",
        "lDk6G",
        "YC1qS",
        "iZRMwNG",
        "id9,{",
        "Valitsin: / Postoobe <sijainti>\\setupcomplete.cmd ",
        "&Avbryt",
        " inform",
        "Q1J$Y",
        "m%IB/",
        "9~Pt.Q",
        "v4iF?0",
        "GO;\\Jk",
        "*MKCoE",
        "a?MzZN",
        "Ja4-|",
        "1Nw{cx,",
        "Ondersteuning",
        "030B0N0a0g0q0",
        "\":S!?HY%7",
        "-VfAN",
        "F^.i8",
        "3JF_F",
        "nd finalizeaz",
        "gxJLL",
        "xoA<8r",
        "eir#AW|t",
        "5hS%9Ia6v",
        "5v@oF",
        "`m+7[",
        "I4V{&t",
        "\"}+f'7",
        ".8;8'878/8?",
        "te nie je v",
        "(L|eh",
        "C-]gVk",
        "jWf'+",
        "^Pp8g:`",
        "x)Yea",
        "[(b9\"nG",
        "gQ^@)!'A",
        "*Le3Q&u",
        "WFc`-S",
        "O[=0_",
        "iE?A7",
        "{T!'N",
        "<=h?y",
        "2'Nbm.",
        "eitb*",
        " system Windows 10?",
        "p^Ol{",
        "est produit lors du d",
        ",p/N+",
        "|CrRB",
        "gXcTL",
        "u&:Sq",
        "o\";+^",
        "ne uaktualnienie do systemu Windows vNext z interakcj",
        "0.050;0@0K0W0",
        "Switch : / Postrollback <location> ",
        "a19z#",
        "3dg_)>/",
        "y\\{j}",
        ":3Q_MV",
        "`&MR\"k.",
        "{HzKr%VK+l",
        "qZE=TM",
        "~4g-39",
        "_tp2M",
        "*V%PIf",
        "pD~kK",
        "\\o`=K-",
        "Es wurde festgestellt, dass die Installation von einer Netzwerkadresse ausgef",
        "Ay<us",
        ".rNU0",
        "js ir interakt",
        "+Jp5=",
        "Q(\\CJ",
        "2)495",
        "dkle$)T+L",
        ": N / A ",
        "/+(Ly",
        "2OOWW",
        "se9Impossibile determinare la lingua dell'interfaccia utente",
        "CkBBm",
        "VHet^:mx",
        "8}^xt",
        "2wXofg8P",
        "OfQOx",
        "rsa, OOBE atlan",
        "Y0&\\Y",
        "ju, kura avota map",
        "7:>'!,",
        "|0RNU\"",
        "}8'I}mSxv5",
        "48~Vym",
        "yN/O:",
        "<mC,_!",
        "'i&u9",
        "nak vagy f",
        "R+}W$",
        "P:<4I",
        "2M:nQ",
        "rN`Z<",
        "2;314W4",
        "}J-[O",
        "dit protokoly a dal",
        "E0Sf(;",
        "$l&E~",
        "eY69'",
        "Pavyzdys: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        ",ldkp",
        "1{t|M",
        " kann nicht gestartet werden.",
        "S!aihs?q",
        "nhHS!",
        "D$,0)@",
        "YKK6~iD;",
        "lkRd66Bm.",
        "?pRwj",
        "e^c$7",
        "Tm~HG",
        "s,cV?",
        "i instalaci najdou v zadan",
        "Kas soovite kindlasti v",
        "nik, illetve ha az adathordoz",
        "Un\"cS",
        "EGbJx",
        "|G%Q?3PH",
        " instalarea va efectua opera",
        "350 MB ",
        "8qO_Js|",
        "aELGjC",
        ">0>,@",
        "<;mCP",
        "Y,&]!s",
        "Y-m>;i",
        "d?Tv}m",
        "era la partition PBR",
        "L<~_;:",
        "UqNOUNn",
        ":E;_;j;",
        "Haluatko varmasti lopettaa?(Oletko valmiina asentamaan Windows 10:n?",
        "4QVO?",
        "xBQfff",
        "[IBvlQ\\z",
        "Setupcomplete.cmd",
        "F5YYi",
        "Un administrator vrea s",
        "FALSE",
        "G~I~K",
        "I*(1n",
        "o haja permiss",
        "r\"Yv%",
        "A%WoT",
        "lF *(",
        "o-,j,]",
        "EJNtI.",
        "sma-NO",
        "6ExrX",
        "@is@Q",
        "ul a g",
        "8qJAk",
        "NE@hu",
        "Bwd)R",
        "M1]S[j",
        "@@@PPP@@@",
        "m_\\/V#t",
        "[y j_",
        "deve ser usada somente em testes e ambientes de",
        "U;\\,H3d",
        "OP79P-",
        "1qC<C",
        "]][O,]]_W4_",
        "v$^-m",
        ">'n9\"",
        ";^gA/",
        "CDlpTask::InternalSetError",
        "?v`\"^06",
        ",gg2X",
        "inverse, si / migratealldrivers est d",
        "Instalarea Windows nu poate ",
        ")~m|m",
        "Olyan eset is lehet, hogy egy telep",
        "|,n)j",
        "Esempio: setup.exe / auto upgrade",
        "jaaK1",
        " uprawnienia i dost",
        "^CV^f+",
        "rs. En funktionsuppdatering kanske p",
        "'c7*p",
        "?'|+\\w/",
        "Ad?-u9",
        "U&wOt{~",
        "Bay{_)z",
        "e spustit program Install.exe.",
        "eI;1(",
        "smwq.",
        "$lbRP",
        "T[j.=.=",
        "^go8X`:<",
        "y9XfR",
        "EyZ)[(",
        "{%\\.0",
        "fr-MA",
        ".nzV_",
        "-<ah$",
        "~B:?2HH?",
        "X)}Bo6",
        "&-pbn:N",
        "=.BOg",
        "49=Ar%",
        "or-IN",
        "6>6^6k6",
        "mes privil",
        "n buscar",
        "~UIqJ",
        "DTZJ`ZC",
        "P3r}<",
        "ke etter, laste ned og installere oppdateringer). ",
        "Re9~w",
        "fs=v%=-",
        ".2TMt&",
        "u?=uB",
        "K?}.~",
        "6HNHw",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "XG+hz",
        "/c)\"Z",
        "j:Xf;F",
        "t15ep2N",
        " giri",
        "FBe;se",
        "{`x2&'",
        "MO-0N",
        "pk%nT",
        "d>}V`l?",
        "~tG4r",
        "/L'6`",
        "0_04X@bK0",
        "g_`L9U",
        "UB;%m",
        "o(,w\"E",
        "r>4!99!",
        "r deneyimden (OOBE olarak bilinir) el ile ge",
        "skee asennusohjelman k",
        "XoC@K",
        "1TIn-",
        "&ILGr",
        "s rendszer",
        "6G731",
        "o. Caso tenha iniciado anteriormente a Configura",
        "g.4s6",
        "eOKPM",
        "c(dgA",
        "quiet",
        "A]Ic9",
        "$-2+?",
        "J+M@GpV",
        "C/Clk",
        "9[=a}BiM",
        "=_?(<_O",
        "]G24F3",
        "+GaO\\U",
        "qEoMJ_Z",
        "Y9hLr",
        "k] nh",
        "w#qsx",
        "hrt wird. M",
        "vSdjd",
        "Parametere: All; None ",
        "mu, tak",
        "c\":[c",
        "@On2[",
        "%o:P~TUd",
        "dH1BCI",
        "*e.:C,",
        "1-uyd",
        ".@#{:_",
        "TC@KP",
        "(#P2U2$9",
        "1d>!F",
        "f];s:u-<{D",
        "1;fPj",
        "L3$/ ",
        "X#J'>B",
        "}=!9>",
        "+Qr4m",
        "'~w0$q",
        "9dV0G",
        "=DOqnK",
        "0aI;F",
        "Param",
        "mEul!s",
        "lje telemetrijske podatke, ustvarjene z namestitvijo. ",
        "@\\Q0c",
        "xF1#2r",
        ",Pa}J",
        "SPCleanupInstallationDrive: Unable to unmount the directory %s. Error: 0x%08X",
        "k dizinindeki \"setup.exe /?\" dosyas",
        "yor. Bir ",
        "Windows ",
        "R^F1{",
        "c8y8m",
        "CSimpleWizardPage",
        "kleme kabul edilmesi, OOBE",
        "gl-ES",
        "A@#sB?&",
        "ste till exempel anv",
        "&Finalizar",
        "n>ic~",
        "6kqup",
        "do|rd}",
        "iJD/q",
        "]5Bne",
        "<wo\\S",
        " <*K0P",
        "PjAK!m",
        "[&WWbPgF",
        "wI9l:",
        "%s %s",
        " bir dosyaya yerel dosya yolu veya UNC a",
        ".VTom",
        "@=0O&",
        "\\YY`3",
        "[lCN&(",
        "/=?y8",
        " 5ehFi",
        "F; 3)#",
        "?4'mt",
        "SPHRF/e",
        "2A2P2]2",
        "Action : Setup will not automatically reboot the PC when it completes down - level OS tasks.The next time the PC is rebooted, setup will continue. ",
        "rs: setup.exe / auto upgrade / installdrivers c : \\mans_Jaunin",
        "n: la instalaci",
        "xw_IP",
        "lete, de szeretn",
        "\\.\\zr",
        "Q}hHWm",
        "H~y0BaRc",
        "EsI5Y7",
        "]'xti",
        "P{LxJ",
        "#4*\"h",
        "?,GZ;",
        "u_4=5g",
        "s_NpVKB",
        "ierele driver.inf g",
        "X_F]+",
        "Rg-S%'",
        "[X^'1",
        "}bx<h",
        "li chyb",
        "eB^FA4e",
        "=SM=n",
        "7hLhe>T",
        "/Uvx_7",
        "Exemple : setup.exe / auto upgrade / showoobe full",
        "S 'Sb",
        "HKW8}^",
        "2(3H3b3o3",
        "fHd5E",
        "HEBREW",
        "~Yre;\\",
        "%Pn{0",
        "yrQkvo",
        "1!11191t1z1",
        "TRE55h",
        "rym przerwano",
        "K7N@S=",
        "V$j]7@",
        "ene lokacije. Setupcomplete.cmd je prilago",
        "ho rozhrania",
        "/tW([y!",
        "OQ=]Q",
        "er tan",
        "2NTK|",
        "#jF`U",
        "ki interfejs instalacije programa i ekrani toka se podrazumevano prikazuju, s tim ",
        "Nadaljuj tam, kjer sem ostal",
        "z) {wv|@",
        "Sq]%f",
        "k alap",
        "0d~3t",
        "Gu)15 h",
        "{ }S#",
        "jz9Cyy",
        ".Setuprolback.cmd ",
        "m-&U?",
        "rLzu^M",
        ";q+I9T}",
        "fLIA?",
        "A|M68",
        "hCZ)x",
        "ym|28f7p",
        "06=Oh\"7,",
        "ymc.S",
        "|w=hP",
        ".?AVCSizableControl@UX@Common@ConX@@",
        "tjjxW",
        "s vis",
        "stroje. Zkuste n",
        "&(kk9",
        "Na-^!",
        "1E1_1j1",
        "?wDz_",
        ":M&Z}",
        "M#>Ay",
        "MXc'H",
        "X<DU6=",
        " nruG",
        "4j^8,0",
        "8wl,8z",
        "&qh/2",
        "1F4t,'",
        "e\\Omi ",
        "-ZNX^",
        "E9qI-h",
        "wI-5dV",
        ".'x\"WZ%{",
        "vb]n Q['",
        ")}44w%",
        ">1j\")j",
        "pi manuaalisesti. Seuraavan komentorivin avulla voidaan ohjata t",
        "%VF;+",
        " perjungim",
        "nXU3<",
        "6:lKfb&",
        "CreateFileA",
        "_iw4\"",
        "v9pA:T",
        "sul, a telep",
        "*NZIB%",
        "2<bUy",
        "9/MY(",
        "Skenaariopohjainen k",
        "m spustili In",
        "`(W,nf",
        "uVS17",
        "ygNBvY8",
        "zG9nO",
        "z[O8|",
        "/=$=)m",
        "[zqYjv",
        "~\\}.5\"//",
        "Example: setup.exe / auto upgrade / Telemetry enable",
        "a(yze",
        "]]eMQ$od:4$",
        "marre automatiquement.'La version XML requise est introuvable.JErreur de r",
        "g+'Uw",
        "lda: setup.exe / auto upgrade / PBRupdate disable",
        "UH.#S",
        "S)A}E9",
        "@o??L",
        ":^tHD",
        "[MJpO",
        "pwAAw#iG[",
        "I-BC;",
        "tani a felhaszn",
        "SBgkpp",
        "caw^Zn",
        "}KQBpO",
        "i'EZ+",
        " avec des privil",
        "87=\\Qh",
        "=d^RI!",
        ",Vwoo)>_",
        "IeCer",
        "W`-(E",
        "wkG]<",
        ": / installdrivers <",
        "Valitsin: / noreboot ",
        "iFdR ",
        "emesnio lygio OS u",
        "o. Se / migratealldrivers for definido como None, o programa de configura",
        ",&(),",
        ").bzOE",
        "@.?'&",
        "bLf#&~S",
        "Bc;&p",
        "a_Eg#",
        "}]r` +",
        ".:.&Qc",
        "ifN7O",
        "65|L?",
        "OI]b<x",
        "$AAA<",
        "bNb?Q",
        "bor setupcomplete.cmd zo zadan",
        "Veiksmas: jei nepavyks, s",
        "Nh6Y@v",
        "fwTIG",
        "/fERwn",
        "EwB)[",
        "}F?8noB",
        "KEY)Z",
        "<F0sZ",
        "vaHZI",
        "status",
        "fO*;{",
        "o : O programa de configura",
        "/ showoobe estiver configurado para",
        "pre&|",
        "metros: caminho do arquivo local ou caminho da rede",
        "3R]IF",
        ";W_-$~",
        "TE;`F",
        "jaYjz^j:Z",
        "3@4d4k4q4v4",
        "?`Zi'",
        "o\\#P\\",
        "H)&o#",
        ",@w1^[|",
        "n de 64 bits de la herramienta. Intenta ejecutar la herramienta de nuevo y aseg",
        "ZPx}-y",
        "R%_<c|",
        "$7wfau",
        "<sp:Cf",
        ".m4W9",
        "hsnc<?}",
        "[@2_\"W",
        "Valitsin: / auto <siirtovaihtoehto> ",
        "C~[}H",
        "~ijY5",
        "gY?vN",
        "mt-MT",
        "o.BO4~",
        "{KOdCo",
        "om!2Y",
        "(i/VY",
        "th(K-j]H",
        " el PC autom",
        "r darbojas cita uzst",
        "bX&k'",
        "GO 6R\\A",
        "1Zet>",
        "wGGHc",
        "aQMQT",
        "pload. ",
        "<unknown registry key>",
        "Pt|v#",
        "Exemple : setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "|KDYv|",
        "!$p0Um",
        "        loadFrom=\"%systemroot%\\system32\\cfgmgr32.dll\"",
        "(~\"GW",
        "U,?ag",
        "n 64-bit s",
        "]ytTU",
        "MJ/R+",
        "$:</e",
        "u)|{y{",
        "Tagxu",
        "`U@o\\m/",
        "hrt (Suchen, Herunterladen und Installieren von Updates). ",
        "Knc]7",
        "Parametri: lokalna pot datoteke ali omre",
        "\\za1u",
        "#8a.b",
        "6_3?3O",
        "aDM;{d",
        "(rCp[7J",
        "as procesu in",
        "MlwT+{",
        "oJdC:",
        "3;3~3",
        "QE*Pq",
        "r_ 7t",
        "7*@{wJ",
        "bvx8Q=D",
        "|lS`k",
        "*2,8>",
        "GP[+S[",
        "Kkw*}",
        "<{~c>",
        "7,wg8",
        "C{-;]&x",
        "KhhHA",
        "Programme d'installation de Windows 10",
        ">:I(m",
        "[L[`SvR",
        "N|*u=",
        "ZX#F.",
        "Gc,`v",
        "P]'k&",
        "ak prep",
        "K#x}&",
        "iL*?m#",
        "i2jm)",
        "FZ%6f",
        "OsUninstallWarning: We are running on Server. No need to warn for Uninstall Allowed.",
        "YO34_",
        "8Ea4ED",
        "n heredado7El programa de instalaci",
        "TW(7,3",
        "W')>n",
        "qs,[y6",
        "_'ez.",
        "6-uy>",
        "gp~BP",
        "324L4Y4~4",
        "('7{z",
        "U&>\\3",
        "\\uN%b",
        "K%>IC",
        "biLh[",
        "0]#oa",
        "pldSJ",
        "Akcja: Wprowadza plik setupcomplete.cmd z okre",
        "rgukatkestus. Proovige uuesti installida",
        "Vybrat",
        "Parametri : codice Product Key 5x5 ",
        "9#9*959",
        "Ij%aQ",
        "zg68\\!<",
        "tit zp",
        "525Q5p5",
        "l|A~}",
        "/g&n\"",
        "~'`DQ",
        "d*_Q|",
        "ijte druh",
        "}'{U~",
        "@>?*R",
        "M}oT*",
        ";%VBl",
        "$ou)c",
        "<*=7=>=",
        "vtiu]XK",
        "jjJ' 7,@",
        "d62g#",
        " ustawienia domy",
        "Qc=,a",
        "];SYm:",
        "p'>^\\",
        "R7i4N",
        "Er is een probleem opgetreden bij het starten van Setup. Sluit het hulpprogramma, start uw pc opnieuw op en voer het hulpprogramma opnieuw uit.",
        "~:*vE",
        "bKNpmD",
        "rfCpP",
        "Bxvn@",
        "{<6u2",
        "BtFUx~]",
        "yY7=jp8",
        "/@;$@0",
        "Z#bI@ ",
        "D_PuB",
        "&<Swa",
        "  unbcl.dll",
        "B(,B^V",
        "m$kXGV",
        "kc{.>",
        "ZO<?K",
        "JQjm\\",
        "tVl.F$4",
        "sso|O",
        "ket a vissza",
        "Akce: Pokud je pro p",
        ",optT",
        "N2[Kf",
        "6xCZG?C",
        "@vnmq",
        "m2lL!",
        "1\\j{I",
        " instalacj",
        "c/AQx9",
        "J$O.}s",
        "None ",
        "K.f8N",
        "kt no s",
        ".\"h'8",
        "a3A7r",
        "{o22=",
        "i de re",
        "h?vr(",
        "hren Sie an der Eingabeaufforderung im Stammverzeichnis des Installationsmediums ",
        "ANaWQ_",
        "-EyI(",
        "DlpTask: Preparing Files...",
        "8ge-o5",
        " uhxS/",
        "|Kub4",
        "&i#nh",
        "8P5\"S",
        ": / auto <migration choice> ",
        "qu;=_",
        ":`&Q2[",
        "SAF F",
        ",J)|{",
        "(0$<=8{O",
        "Iz_w=",
        "le zkomprimovan",
        "BJk<:P(",
        "(m@9@",
        "47:z?n",
        "&PK`B",
        "6UP5U",
        "zUeL9v",
        "rOH3/",
        "=?BAGf",
        "vN6,b",
        "SystemTimeToTzSpecificLocalTime",
        "r\\6^hz",
        ",5jLE",
        "qB`GE",
        "\"q<bL",
        ",}D|G",
        "7aIyx",
        " Windowsin. Seuraavien komentoriviargumenttien avulla voidaan muokata Windows-asennuksen toimintaa",
        "^{?* ",
        "c6,:j",
        "T$;Z+_>M=",
        "u-_sL",
        "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        ")1~~!",
        "%s: Box file hash is missing.",
        "%\"=Dr",
        ">0/6u",
        "-vQd[",
        "PtO!Q",
        "hKs/}",
        "#bmRV",
        ";R;!=",
        "ke informacije sa testnih ra",
        "dF\"#h",
        "O/TV]@",
        "XzKD[",
        ",PVBm",
        ";;wfY",
        "*RQ/J",
        "mu Windows 10 automaticky re",
        "pu-A8",
        "3;4N4a4t4",
        "yTII2E",
        ";E;s;",
        "q'/sP",
        "CDlpTask::CheckUserInterrupt",
        "Konfig",
        "van v",
        "3-u!T.",
        "&[Qv?P7",
        "~}q7g",
        "hrt.yDiese Version von Windows wird nicht unterst",
        "U|@/%",
        "0#;*B",
        "o do Windows 10.",
        "+/8\"3",
        " : setup.exe / auto upgrade DynamicUpdate disable",
        "-~N)<<",
        "uRpZU",
        "z}4@h?",
        "do primeiro logon do usu",
        "qps-plocm",
        "vc'Jv",
        "Architektura, kterou jste vybrali, neodpov",
        ": / PBRUpdate <",
        "{:g0R",
        "lI'9GP",
        "rtuseks on seatud Disable, ei kogu installiprogramm ega laadi ",
        "*#ksq",
        "%TLtB",
        "qqFO@G",
        "/T1P9\"",
        "'qi3\\A'",
        "3#343:3S3Y3f3",
        "7LzaoM?",
        "^q/M&~N",
        "l-xrz",
        "a#u&o",
        ">ZDR[4",
        "dTavL8",
        "%:+vwn",
        "Lu>d\\",
        ">*2LtP>",
        "8!8M2",
        "kos visuose nurodytos vietos poaplankiuose. ",
        "cdkHr,g",
        "SVIaR",
        "t egy helyi k",
        "j,>Tl",
        "d\"lx%~",
        "D`;r9",
        "\\iuZT",
        "3R*j%",
        "?\"2j@",
        "O)2w?",
        "]$E|a:",
        "siama. ",
        ";+IgSORr",
        "f>nhLH",
        "2ew!O,",
        "RegOpenKeyExW",
        "$g*SS",
        "w?y%{",
        "Re{B$",
        "o: / migratealldrivers <par",
        "1RmH[",
        "|x WA",
        "NrB#s",
        "m um pid.txt na pasta sources. ",
        " domy",
        "DKGm]",
        "[8x7+N",
        "TCfh#",
        "WX'|%+v",
        "%\"d2E~",
        "XSvq[",
        "xG|ks",
        "78zwFt",
        "8(9!9",
        "=~vJGr",
        "qA`[]j\"",
        "uKLjIG{F",
        "Xy o|",
        "[HCR_^",
        ")0NS.",
        "qx>sf-\"",
        "2&29y",
        "n no se pudo iniciar correctamente. Reinicia el equipo y prueba a ejecutar de nuevo el programa de instalaci",
        "#wj^'",
        "Vh$K@",
        "`A8v^",
        "b`(#ig",
        "000   ",
        "0M{;]",
        "axWfS",
        "lje telemetrijskih podatkov, povezanih z namestitvijo. ",
        "`T!0*C",
        ",4aMc",
        "ta. L",
        "7[#|?",
        "G\\8*b",
        "Y?9}5",
        "anai p",
        "n hyv",
        "=/NQly",
        "vPYO&",
        "XUL^k",
        "i-{Ik",
        "4`&.m_",
        "DcqYr",
        "Microsoft Time-Stamp PCA 2010",
        "UJQonI",
        " z Windowsu 7 Enterprise. Nechce, aby sa zobrazilo pou",
        "Z:*[G@f",
        "]oSF0",
        "]}>L8",
        "3||u`",
        "sfY-U",
        "ldv4{",
        "8r5JoaC,ljU",
        "iQ!lN",
        "sleduj",
        "NJCSO",
        "o de rede e pode ter atingido uma interrup",
        "ticamente cuando complete las tareas del SO de nivel inferior. La pr",
        ",4Fi`C",
        ">u|R{",
        "pa-IN",
        "3qPG0",
        "dT)Y8>",
        "=o}Sq",
        ">mOVj+",
        "I&i~*",
        "WqGHk0",
        "aNT?i",
        "8Mmf)",
        ") W!+",
        "1oX:k",
        "}yVl<",
        "nja prvega zagona se presko",
        "i nu va ",
        "2 2$2(2,2024282<2@2D2H2L2P2T2d2",
        "XSg=G",
        "wc9_z^",
        " B<dY",
        "u|Am]",
        "bCHI?l",
        "I^{=b<UE",
        "n-|@m",
        "RR+-+",
        "Jk6\\H@Rp",
        "aZBOd",
        "a#d@+",
        "CBitmapDialog",
        "{Fn#^",
        "hp?Z8O>",
        "uFsua8",
        "3/G &",
        "t take command line arguments. In Command Prompt, run \"setup.exe /?\" in the root directory of your installation media.",
        "0(040@0L0X0d0p0|0",
        "dent du PC. Son ex",
        "c2|&e",
        "WBfmL",
        "R:5)+",
        "R`hMff",
        "V^ZHu",
        "*{y:7*4",
        "<$4~O",
        "2A2I2w2~2",
        "LoadLibraryW",
        "SetUnhandledExceptionFilter",
        "SPExecuteCleanup: Cancelled",
        "sF^3G^",
        "$vJtw",
        "Commutateur : / DynamicUpdate <param",
        "ksmiJ",
        "f!O 2?",
        "stroj pou",
        "O5+y'Z",
        "!7Kr?",
        "TQ<C-",
        "klemeye haz",
        " UX  ",
        "e instalace prob",
        ";Am&4",
        "GW6yr",
        "*umqdM>",
        "m<1[<",
        "W\"g/tg",
        "tartovan",
        "#ywc^[",
        "%Pl~Y",
        "(B<){",
        "le telemetrick",
        "3S.+kG",
        "+St}D",
        "@:DY7",
        "r maskinen har n",
        "w ;{@i",
        "en er rullet tilbage til det tidligere operativsystem. Det udf",
        "S-OG*s1O",
        "5!.CgF",
        "/n_a^",
        "bP pqJ",
        "\\o4}V",
        "YER))",
        "ksyminen, dynaaminen p",
        ", tada v",
        "ZA)kZ",
        "xyxx0",
        "0W2[aB",
        "-Zal|,/+",
        "nVn6R",
        "Link de site",
        "{qGs5",
        "} ./N",
        "VtwfI|",
        "r;pkHn",
        "m p@Y",
        "^c-+o",
        "p[hCD",
        "`]!V)K",
        "G]M]_",
        "#u`5l",
        "LzPtR.",
        "JQyJ!",
        "k durumunda, kurulum, s",
        " specific.wim.",
        "y4cYV",
        "Bhy,?",
        "<nZYX",
        "j5mXD",
        "L-q(n",
        "CDlpTask::PerformAsyncOperation",
        "ze po",
        "PU,&Xc",
        ">=[je<M",
        "~8zKw",
        "EL\".1=",
        "(PNd0",
        "_+D=+9",
        "ajte ponovo da pokrenete alatku.rZa pokretanje instalacije je potrebno najmanje 350 MB prostora. Oslobodite deo prostora, a zatim poku",
        " ei v",
        "t)%Av",
        "n vaaditaan Windows XP Service Pack 3.uK",
        "y7_,U8<xp",
        "Y0bHl",
        "d^id>",
        "xf45'",
        "0\";q4F",
        "%<>Md",
        "VN**x}",
        "(5u-u",
        "j25;}",
        "sactiv",
        "kjpIw",
        "@f9f@",
        ".text",
        "]{qr0",
        ".hAD,",
        "bm'm_",
        "YUK=E",
        "0{q]QW",
        "enite Setup.",
        "n de Windows 10",
        "H.I|R'",
        "js,O1",
        "Dq3w^",
        "y&n~\\\\",
        "U^%/I",
        "1KbXR~",
        "0_U(u",
        "=jnMm",
        "Bs_YiW39",
        "F7jTX",
        "\" n-TA",
        "!lHzeb",
        " nutn",
        "g[]I!",
        "Lc`JK",
        "QDr|K",
        "3#3,3N3q3",
        "PHN9M",
        "surida juhendab installiprogrammi p",
        "*1Zg~",
        "2JeaaH",
        "ohnpO",
        "gW`rd",
        "mkVrt",
        "GJx}31",
        "{(H)u",
        "IsWow64Process",
        "Windows Installation kan ikke starte p",
        "#.74A",
        "<F9XUt",
        "}+&E<b",
        "UJzzu",
        "<5rlN",
        "d?6qj",
        "9ti;|",
        "e8q~#",
        " LlHz",
        "unalnik in poskusite znova zagnati namestitveni program za Windows 10.",
        "<:<p<",
        ">D?K?Y?",
        "4*A*Kk2",
        "UTvrV",
        "D$,BP",
        "8Q!8/",
        "X*%~c1",
        ">N?Y?",
        "installation ne peut lancer l",
        "p2eK)Y",
        "U3MJ/%",
        "|aR9NT:",
        "{>8RNt",
        "Vl!C9",
        "bh;S0",
        "Windows Setup kan niet worden gestart terwijl een ander exemplaar van Setup al wordt uitgevoerd. Mogelijk worden onderdelen bijgewerkt. Ga naar Windows Update in de app Instellingen voor meer informatie.",
        "a1g0X",
        ",z(C8",
        "Microsoft Corporation1200",
        "9qf#7m",
        "82KNga",
        "o~Z+t\"}Z",
        "e la partition PBR. ",
        "ysiJ;",
        "P-iuK",
        "F+X/,",
        "p\"SJ_",
        "m#Si<",
        "mI<t|;",
        "/Lw[P",
        "W},Ud",
        "Bryter: / installdrivers <plassering> ",
        "{zSyp6",
        "$:zzB",
        "Kall\\",
        "6La arquitectura seleccionada no coincide con el equipo",
        "u. Savuk",
        "3F1|c",
        "7V`U4",
        "GsGFq4",
        "rminos de licencia, la actualizaci",
        "sms-FI",
        "&Mqwwwwwwwwww",
        "U3K2t8",
        "`qa^M",
        "iku, kdy se instalace dostane do f",
        "=)=/=R=n=t=",
        " tWy(",
        "?DI'!",
        "6hE4}8",
        "@x.r-",
        "lalt disc de instalare, pe care scrie %s de bi",
        "R<<}.[",
        " executado no contexto do sistema, pelo que pode n",
        "$]j!u",
        ":>:{:",
        "Ip]fv",
        "q,JS{",
        "}67'Xz",
        "&>$r3F",
        "NQ8a{T",
        "[XApx`",
        "W>QoT",
        "u<<7n",
        "HY}\\Q$",
        "Conmutador: / auto <migration choice> ",
        "+$tzG",
        "lkj6-L",
        "uW0~0W0_04",
        "-w[g?",
        "ErrorState",
        "Hjelp",
        "+QuF]j",
        "DUDownload\\Setup",
        "t 6I+j",
        "**jYdEwU",
        "Spikker",
        ">[_^]",
        "&}H?EP",
        "Switch : / migratealldrivers <paramenter> ",
        "^Prova a eseguire di nuovo il programma di installazione da una finestra del prompt dei comandi",
        "<^Xk|",
        "TX-;Y",
        "o para copiar para locais que exijam permiss",
        "c\\{C@",
        "ParseCommandLine",
        "<;I wB>",
        "x7Y\\d",
        "ERROR",
        "0':(7",
        "pq\"\\|",
        "GetTimeZoneInformation",
        "ys7A-=",
        "+Vz#+%",
        "F+g'6L",
        "DlxWX)",
        "pienie Instalatora. By",
        "r)GzHy",
        "Xquzmz5",
        "Of'/K",
        "FL'0f",
        ": N/A ",
        ". Setupcomplete.cmd ",
        "ar-YE",
        "sqBo|",
        "0,000@0D0\\0l0p0t0x0",
        "TMj(-",
        "J,?\"v$",
        "c(Wzb",
        ". Predpokladom na pou",
        "?8?_?",
        "d|bpW",
        "Z:%\",",
        "vykus gedimui. ",
        "%~4IF",
        "Go:@?",
        "&*@$9",
        "Cxq>|=",
        "$z\"YK$",
        "SPWdslibLogCallback",
        "I,T0s",
        "LT&eW&)",
        "Stikalo: / Postrollback <lokacija> ",
        "~/2N/",
        "Jw\\v8",
        "*gY|V",
        "*nMrW",
        "OD4K<",
        "installatieproces. Setup zoekt ook recursief in alle onderliggende mappen van de opgegeven locatie. ",
        "ndas f",
        "j!{%sL",
        "~k2IBv[",
        ",A~g!",
        "M;i6U",
        "Teit.",
        "Pl$x8[",
        "qsGSB",
        "\"qRWf",
        "T*B[~",
        ", joka on %s-bittinen. Kun asetat levyn asemaan, Windows 10:n asennus alkaa automaattisesti.\"Vaadittua XML-versiota ei l",
        "RegCloseKey",
        "?sMGX",
        "#\\#x:",
        "O=s52",
        "/s|r)o",
        "ena skripta za izvr",
        "tqO~K",
        "t@[/0E",
        " tietokone uudelleen ja yrit",
        "f+\\27",
        "Exemplu: setup.exe / auto clean / installfrom d: \\fi",
        "GetThreadPriority",
        "F)n{`",
        "o durante a configura",
        "`0|H]w",
        "E7K:JV",
        "O Setup.exe instala ou atualiza o Windows. Os seguintes argumentos de linha de comandos podem ser utilizados para modificar o comportamento de instala",
        "Installation",
        "dd.<h",
        "s@X5I#KM",
        "(Ew9m",
        "Cancelling running action...",
        "`^>R#",
        "Q@Y:r(",
        "une copie interm",
        "v-iQ!",
        "}X@Y(i",
        "Windowsin asennusta ei voi k",
        "~kJ3-",
        "&HmvM",
        "mKj&#",
        "Nvi;G",
        "eo^EN",
        "6RNfZ",
        ":#+{R",
        "NN|3I",
        "isR{Z",
        " &b'7[",
        "gios de sistema. ",
        "7(Jj&_",
        "?-Mja",
        "eO0sV",
        "2=WAsCXhf",
        "~^/n!",
        "=^3[M5",
        "m7U'?",
        ")i!Zw",
        ":rNJw",
        "Z,B=\"",
        "X,4@MM",
        "X8`P9",
        "mF*&]",
        "NjD]s",
        "tP20U",
        "r fut.sA Windows ezen verzi",
        "tora, koncov",
        "qV%tX",
        "Qn?ADEG",
        "J[iI;",
        "fN0OA",
        "-J$2X",
        "?>3@Iv0",
        "Disable, a instala",
        "@2x;;",
        "'El:J",
        "zh-Hant",
        "%s: PreDownload mode value not found.",
        "H%;Fv",
        "VVVVV",
        "_1*h'9h",
        "nQ!`U",
        "bevoegdheden als de gebruiker die (of het proces dat) Setup heeft gestart. ",
        ";5<I<T<",
        "gd-GB",
        "wJmvk",
        "3B-)L",
        "d^W a0",
        "Gk0@ ",
        "N\\t{N4&9au--",
        "oi15z",
        "i]A-&",
        "Oa>ys",
        "xUz)y",
        "*NuP+",
        "*-pYe",
        "rZxCy7^C",
        "yy$'{",
        "Y7{88",
        "Action : Lorsque / PBRUpdate est d",
        "PG-\\5s",
        "s direktorijas, v",
        "[)mSdmd",
        "DT|||",
        ")au[O",
        "EWYRq",
        ": Upgrade",
        "po/t~",
        "llapot",
        "%s /ReportId %s",
        "GnE<f",
        "@@@@@@@@@@@@000",
        "~j1f(",
        "ches une fois l",
        " |+ll",
        "ojJt*",
        "uu=]_7",
        "H.cYk",
        "77*w(",
        "_M$Su",
        "_|SBM<",
        "OT\"Y4f",
        "ni put do datoteke naziva setupcomplete.cmd ",
        "p.!C6",
        "h/@oy",
        "E../5",
        "8%8Y8d8",
        "NPSt#",
        "$}W6}j",
        "}v[G|z",
        "9mQCt",
        "<(<5<P<j<w<",
        "TBCJh@",
        ":<y7:Z",
        "Directory [%s] is not in Hard Reserve. Not marking [%s] as Hard Reserve ",
        "i+G~(",
        "h(^RN",
        ": / copylogs <hely> ",
        "M\\(=1C",
        "yFKt>%",
        "cie trybu OOBE, aktualizacja lub utworzenie rekordu PBR. ",
        "sVVSKZ'",
        " niveau compl",
        "ivioB",
        "(?9H3",
        "}2ez\\",
        "+hd.5",
        "Z]oeh;.",
        "SS%m\"",
        "):,i]",
        "ZDaTk",
        "dKemS",
        "i$GR/;G",
        "3ANM`",
        "Parameetrid: faili setuprollback.cmd kohalik failitee v",
        "qH'F/",
        "ini unutmay",
        "BoXWZ",
        "@+$Ab",
        " prohled",
        "7;=Nf:",
        "NMNEEVb",
        " automaticamente il PC  al termine di attivit",
        "        loadFrom=\"%systemroot%\\system32\\mfc42loc.dll\"",
        "(`hF9",
        "G$}ZJ@",
        ". Dal",
        ";Abak_dk",
        "j=v2N",
        "8t:(6",
        "VYFmJ",
        "1d|Qx",
        "F!{p:=",
        "cie dynamickej aktualiz",
        "L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "q#)R_",
        " R>(T",
        "\\Uyjx",
        "7.<5<",
        "ypH<)^",
        "gGe\\5i=",
        "\"R7^:",
        "]y|TE",
        "mxwOB{G97",
        "EPFCR",
        "2H1kBdg#",
        "|D<v2",
        "5_w;b~",
        "wietlania interfejsu u",
        "sgQ4^(\"\\-",
        "F22S9",
        "cia funkci",
        "8=9K9y9",
        "/nSF}",
        "ks-Arab",
        "78hf&+",
        "8B8L8",
        "#F)b{",
        "dfe]>~",
        "y uruchomi",
        "QJ5K{,9",
        "_\"8 z\"",
        "[Qztb",
        "        loadFrom=\"%systemroot%\\system32\\windows.storage.dll\"",
        ")8MqN",
        ">TA5h",
        ".idata$4",
        "\\au><@R",
        "y}dZ3Nr",
        "t Go#E",
        "mE(wu",
        ">seqiu",
        "en-GB",
        "$Valmistellaan Windows 10:n asennusta",
        "/ showoobe",
        "?DNa*\\$3",
        "Ue~M4N",
        "fP_^'",
        "rab installimise l",
        "T&UHU",
        "$e;dU",
        "8K8x8",
        "}TFm0W",
        "~CF:pp",
        ":l6_Wm",
        "|t79R",
        "Example: setup.exe / auto upgrade / noreboot",
        "Cance&lar",
        "chiHZ",
        "el-GR",
        "tY91-zH",
        "i)Am ",
        "aoaG(/3D",
        "yvI[M8",
        "Svu|7",
        "#=6Lg",
        "\\?c+z",
        "CDlpTask::AddFile",
        "0qb-V",
        "D@,P)`",
        "ratud asukohast faili setupcomplete.cmd. Setupcomplete.cmd on kohandatud skript toimingute tegemiseks p",
        "I7:C%>u",
        "ko-KR",
        "ltak. Ez a kapcsol",
        "-E]?a",
        "2{*8m",
        "/.&gk",
        "cyuDl",
        "m>Za{",
        "d0K0c0_0 ",
        "^@go]",
        "&VmT5",
        "]PL]h",
        "EK$AX",
        "voLNK ",
        "es-PE",
        "iFyCM",
        "nUrI4",
        "mTRiD",
        "Actions thread has exited.",
        " parancssori argumentumokkal. A parancssorb",
        "[O\"ct",
        "mu~T>u8m>b",
        "ivitub Windows 10 installiprogramm automaatselt. N",
        " Microsoft Corporation. Kaikki oikeudet pid",
        "stico de los PC de prueba por si se produce alg",
        "{oI|_",
        "8bIqO",
        ": :O:c:",
        "1%,V<",
        "l842{[",
        "K,g6A",
        "!i-{$",
        "3S/ng.",
        "4th2\\v",
        "7,J4e",
        "^}<<b",
        "DKVGt",
        "ges. ",
        ":b'^^!",
        "Sklopka : / showoobe <parameter> ",
        "naPo;8",
        ")7Q Bu",
        "_OE.!`",
        ">_>f>m>t>{>",
        "installation de Windows 10.",
        "^8A=V",
        ";[],_",
        "Parameter: / migratealldrivers <parameter> ",
        "QF`,r",
        "7cBO`/",
        "NHcVO",
        "_CxxThrowException",
        "?%Av*",
        "G~(ab7!",
        "f!q>!\\",
        "RY`oU",
        " supportata. La versione minima richiesta ",
        " }xH[",
        "@9mBT_",
        "vP Ab",
        ".9/We",
        "P4[yz^>o",
        "`ogo_",
        "@.boxload@",
        "7.Ok(/d",
        ")|\"8G",
        ".c 'J",
        "> @*&m\"",
        "). Po jeho vlo",
        "HZkuste pros",
        "~t8e8",
        "lu PBR. ",
        "Vr\\>I",
        "kBF'/",
        "7iN-iP",
        "!w=Fu",
        "ste n",
        "5EuEMD",
        "FfyYy>",
        "Sklopka : / DynamicUpdate <parameter> ",
        "mu Windows 10?",
        ";+;~;",
        "e~(O:*&",
        "fr-ML",
        ">?>U>k>",
        "DB%TJ% !N*!",
        " interaktivn",
        "ringsvalg> ",
        "e da se pokrene jer nedostaju datoteke za instalaciju. Ako ste prethodno pokrenuli instalaciju iz lokalnog direktorijuma, ponovo kopirajte datoteke za instalaciju u direktorijum i pokrenite instalacioni program.",
        "V5(\\v",
        "dO?[#",
        "Q\\abQ",
        "YnP'&",
        ",t\"![",
        "0$K{y",
        "aFg\\_",
        "|+:l\\",
        "InitializeAcl",
        ":$;+;",
        "g$2Eq",
        "(t%;[",
        "ePoRP4&",
        "Rc\"gH",
        " PBR. Natomiast gdy prze",
        "C>Mz{",
        "Setuprollback.cmd",
        "vP4aq<s",
        "Xw`jf>",
        "`7:23",
        " nurodo s",
        "<4+?n",
        "hd83:",
        "EUc(3>#",
        "%9zo($",
        "Handling: Installasjonsprogrammet starter ikke PC-en p",
        "Parametri: calea local",
        "lemi s",
        "Job~b",
        "3hG]p",
        "0?B$@0",
        "4XBX#",
        "tHqf<",
        "t20/v",
        "aEYiV",
        "pNBt^",
        "lo do te",
        "!D<[;Ix",
        "c/[fp}",
        "K[5G[",
        "WlK++",
        "JsQr7",
        "o, mas anteriores ao primeiro in",
        "wC4oTDw",
        "WX,.-",
        "Instalacija nije uspela ispravno da se pokrene. Ponovo pokrenite ra",
        "#EwR@'",
        "&J'mA",
        "5 5/555I5s5y5",
        "lt \"Kh",
        "g'QR'",
        "[=*^uz",
        "XllE<",
        "cie3In",
        "5j[^~",
        "xoS/`",
        "SetupPhase",
        "R;9N}4",
        "=K:w^O",
        "e9!k+",
        "yor olabilir. Daha fazla bilgi i",
        "Z&xW.",
        "i%2lZ\\",
        ")zngAq",
        "H><Xu_F",
        "-,\\ 5",
        ":##.JY",
        "F+[0c",
        "Valitsin: / pkey <tuoteavain> ",
        ".?AVCFont@@",
        "uK3WR",
        "t sader",
        " U(rZ",
        "3,3E3J3f3",
        "3zJdz",
        "qDOeD",
        "@mDOJ",
        "ZgWZU",
        ".rdata$T$brc",
        "X yx;",
        "Z-ouF",
        "CPackageScenarioCtrl::GenerateBoxHash",
        "e2\\!&wK2",
        "Akcija : ume",
        "Handling: Setter inn filen setuprollback.cmd fra den angitte plasseringen. Setuprolback.cmd er et tilpasset skript for ",
        "OBUZRK",
        "9xkpv_>",
        "L|^E7d",
        "dzis: / Telemetry <parametrs> ",
        "58d4JW",
        "|S'_)",
        "\\zJ-CJ",
        "'sNhz",
        "Switch : / installdrivers <location> ",
        "~~vkkg",
        "U)&w^",
        "t`U!Th($",
        "4gO#z",
        "8V@.W",
        "ka prilikom pripreme medijuma na ",
        "m}l7-Lf",
        "Q*u){]",
        "W:|}`<>Jw",
        "0?Z:p",
        "eren medya veya birim lisansl",
        "\\p_/w",
        "P'Quy",
        "IXh\"6DX",
        "Parametri: N / A ",
        ">\\k=[5qw",
        "DFIIr",
        "uQ+OI",
        "W+:?L",
        "['Cv'Y",
        " 0qM1",
        "I$$kA",
        "rs: setup.exe / auto upgrade / PBRupdate disable",
        "D$8QQP",
        "!%ux7",
        "iendab Windowsi. Windowsi installimisk",
        "K1]:E",
        "metros: caminho do arquivo local ou caminho da rede para um specific.wim",
        "Unc%n",
        "[,Kn+",
        "F$;=U<OE",
        "upiel",
        "b8V{d",
        "Q\"32}",
        "OutputDebugStringW",
        "R feaB",
        "MOHr,g",
        "C\\>#3",
        "Z62Gx",
        "ntalo de nuevo.TSi instalas esta versi",
        "Akcija : Program ",
        "e do datoteke sa imenom setuprollback.cmd ",
        "11iOz",
        "zV9\\]",
        "Parametrai: vietini",
        "g>CaE%",
        ":P+gJ",
        "5zi&d",
        "\"dSotQb",
        "rience utilisateur de restauration. ",
        "o+x<pX",
        "lkozzon ",
        "D> XQm",
        "[(9r3TuW6:",
        "ranka nerinks ir nenusi",
        ": / PBRUpdate <param",
        "na staza do mape koja sadr",
        "7@R'#i,a",
        "eB%fF5R",
        "@;65V`;",
        "0ckW0D0",
        "no dokon",
        "5?X*3",
        ":hG%v",
        "B$#VC",
        "\"ZV>g",
        "Bf?Xp?",
        "enieris var v",
        "&Befejez",
        "galement les configurations par d",
        " v#tV`",
        "q?&E8",
        "*99916F\"",
        " Microsoft",
        "9D-[*",
        "KU^JK1",
        "R$xoT",
        "CInstalacioni program ne mo",
        "~(F~60",
        "yK3}<",
        "$nY3N;WyJ",
        "5\"656;6]6p6v6",
        "[M4g>g",
        "5x[v^",
        "pe:~=",
        "\\iR.(",
        "8Fv.Y",
        "#%*>=\"",
        "so-SO",
        "z_.Im",
        "=X9(>",
        "jaYjz_j:Z",
        "k KaY",
        "N&aslednji",
        "%^\\#v",
        "2 2&2P2a2f2l2",
        "A*@M.",
        "sj{Sc",
        "j/NjW",
        "dxLrH",
        "[!%LT",
        " prie nurodyto failo kelio. ",
        "%SmHq",
        "njo povrnitve prej",
        "8WrU+/",
        "X5WX\"T",
        "4[ Y6",
        "t/j\\Yf;",
        "ker rekursivt igenom alla undermappar. ",
        "1bodf$",
        "_vsnprintf",
        "|7)#i$@",
        "m-Q4xY",
        "t&-Vp",
        "' pvN",
        "a&#{^5",
        "1Ii/~D>7",
        "kZtitUt",
        "a cu utilizatorul a instal",
        "e da je %s-bitni. Kada ga ubacite, instalacija operativnog sistema Windows 10 ",
        "o tamb",
        "<J<d<o<",
        "Beispiel: setup.exe / auto upgrade / showoobe full",
        "?.VEU",
        "\"/(Q)",
        "udcRS",
        "Z_@Fq\"",
        " smo naleteli na za",
        "WUXfM",
        "WGwN0r",
        "i;`Oz|y",
        "?h}>,",
        "Vk3.wU",
        "Fzyi'",
        ",xiYmFs",
        "#tHt2",
        "1r'}L",
        "6INe?",
        ";`yg/",
        " driver.inf ",
        "6d\\\" ",
        "kY%}1d",
        "4H@ kT",
        "T\\tBh",
        "{;[*U",
        "Parameters: 5x5 product key ",
        "+lTw%",
        "d9c g",
        "BO69 ",
        "   PPP",
        "=XKX%",
        "0$OQ>",
        ";p%8R",
        "tja vagy UNC h",
        "M!x`a",
        "W=i6uS",
        "O:2d ",
        "'7X'7",
        "paiRj",
        "na pot UNC do mape z datotekami contains.inf ",
        "Handling: Leverer den angivne produktn",
        "JF=i$",
        "9,9\\9b9",
        "PPP@@@@@@@@@PPP",
        "8b98Go9",
        "        name=\"odbc32.dll\"",
        "\\3SnQr",
        "{/b*1~",
        "h_wOOo",
        "gAzc/",
        "'Kkf4",
        "B3dqo",
        "/|ip~",
        "jL>lx",
        "3Q\\M(V)`",
        "SQp&[$x",
        "wwzxw",
        "1AV~'@",
        "`O_a|))Pd",
        "%QRbK",
        "MD15(",
        "?_\\WDs1",
        "s`(>X",
        "n linia de comand",
        "J4=4T",
        "041004B0",
        "t_'xe",
        ":Vfx\"?",
        "z[mP+",
        "!:U3R",
        "'P67B*N",
        "9?ds)=",
        "\\yWrW",
        "G6'1~",
        ": 6KM",
        "NF>T]",
        " %7XQK",
        "1Vf&E",
        "N+ScV%",
        "$@-9z",
        "o+zSe",
        "pNO)F",
        "V&]O{",
        ";Sbia",
        ";|QXH",
        "}DqFX",
        "{xtsqy~qt9",
        "hTi0!+",
        "JT<wB",
        "c:Hew",
        "QSVVV",
        "&PC_o",
        " do test",
        "\"kV%E",
        "}/Q`s",
        "]o_D}",
        "UBiTS",
        "em$x9",
        "8jvk6",
        "daki komut sat",
        "(}%o@",
        "Exemplo: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "M^&{V",
        "w,Yda",
        "Paramereler : setupcomplete.cmd adl",
        "s seguro de que quieres salir? ",
        " vykdyti s",
        "kaw8|",
        "n> y!",
        "kr-Latn-NG",
        "(b${f",
        "VF}SM",
        "LKKMw",
        "rodowiska instalacji (w tym ",
        "no realizova",
        "\"StEJ",
        "p;q[.",
        "IWBFhr",
        "c~#=W",
        "j%!jCO",
        " adelante. ",
        "aozhe",
        "[{/ay",
        "%_VifRa",
        "=:B>r",
        "a\\rp$",
        "E\\T@\\X",
        "o PBR. Quando / PBRUpdate ",
        "k\\!:t",
        "ShGo/",
        "6.n/_",
        "i;d[:",
        "l?nr6",
        ";5yPnr\\",
        "b`0Hm",
        "CMediaScenarioCtrl::Initialize",
        ")Microsoft Root Certificate Authority 20100",
        ">P-WXt`",
        "$@F_#",
        "Nj7OWp",
        "p0~U}ui8",
        "`JQ&N3H",
        "sq-AL",
        "IC,1a",
        "o3Kx<",
        "ie>\\setupcomplete.cmd ",
        "m44,9a",
        "s2O<o",
        ")v :j(f",
        "architecture appropri",
        "IiVpYq",
        "r9QLH",
        "I]o%!i",
        "#qKhX",
        "~4|+l",
        "5lUC[/O",
        "CDlpManager::DeleteDwordPropertyByIndex",
        "`aVT,",
        "xk^|ae",
        "V{@{h:",
        ">aVsT",
        "ST\\W8\\z",
        "< <0<8<@<P<X<`<d<h<l<p<x<",
        "q0I8[k",
        ">XWYo",
        "```@@@@@@@@@@@@@@@@@@",
        "/DFH ,",
        "~21m5\\",
        "t0YP-",
        "FDIDestroy",
        "pnie spr",
        "g64[N~4",
        "Akcia: V pr",
        "\\01Nt",
        ")/F`(",
        "9nBu\\,",
        "VnW[z",
        "SetEnvironmentVariableW",
        "7_cS:",
        ".F]hmz",
        "QQ;t{h",
        "TqUB=",
        "EL])L]",
        "C9o,'",
        "IjjX%cz",
        ",b^35",
        "qX,`B",
        "]_Z>h",
        " OOBE. ",
        "re installationsprogrammet igen fra en kommandoprompt",
        "Action: Automate install with migration choice for the installation. The media setup UI and progress screens are shown by default, but are automated.This switch also assumes the following default configurations : EULA acceptance, Dynamic Update is enabled, telemetry collection and upload opt - in, OOBE will be skipped, PBR will be updated or created. ",
        "Akcja: Instalator wprowadzi wszystkie pliki driver.inf znalezione w okre",
        "cution. Une mise ",
        "8{@l%",
        "O;@(,",
        "8Il<N",
        "r plass, og pr",
        "\\i]{@<U",
        "ki vmesnik namestitvenega programa, ",
        "o. A instala",
        "AGH7xA*",
        "iwk9y",
        "@4kFk",
        "QDk/V\"",
        "9MdHdu",
        "Pg3'M",
        "BoxMovePath: Creating target parent path [%s]...",
        "l)Sbo",
        "yor.aWindows",
        "1{ucn",
        "yt>]@",
        "@vAE~O7",
        " dynamick",
        "3K4T4]4v4",
        "v7Y}(A",
        "dpT8v",
        "c>7{`-",
        "cie. Naopak, ak je prep",
        "CUd*m",
        "})Cq&%(",
        "5FQ<}",
        "Hj(` r",
        "        loadFrom=\"%systemroot%\\system32\\powrprof.dll\"",
        "5aPTwm",
        "]_t^J",
        "wmUn8l",
        "l+aN2",
        "1#1S1",
        "turacak.Buna kar",
        "edenemine",
        "wGO1pD",
        "5o*Sy&",
        "SU:g{",
        "W35G+",
        "Ar<9=",
        "j|WXKft8",
        "w<)YM",
        "CDlpManager::GetQuadwordPropertyByIndex",
        "5Kuu+u",
        "M/>ED",
        "o]5G\\ ",
        "'C544u",
        "Schalter: / noreboot ",
        "rations de mise ",
        "DlpTask: Suspending task after prepare...",
        "T[Mmm-",
        "K+sw/e",
        "K03<{n<z",
        "JGuUQs",
        "wng?IV",
        "SPCleanupInstallationDrive: Unable to unload mounted hives under %s. Error: 0x%08X",
        "=m`SU",
        "o8.m |7",
        "ReadFile",
        "S8]rR",
        "WQ+#?x",
        "]3_g>L",
        "Bryter: / quiet ",
        "i(CNC",
        ":5mO_",
        "sp/N68",
        "*wM'Fi",
        "Aktion: Gibt den Speicherort der",
        "gp0JL",
        "Hbd6r",
        "e0Tu^",
        " disk (%s-bitov",
        "KmuT/",
        "DK20F",
        "e$Nvx",
        "r, ja / Telemetry ir iestat",
        "KF)9$M`s",
        "0x~U=",
        "#a~UBSBD]",
        "do\"b)",
        "e je stikalo / showoobe nastavljeno na ",
        " {\";N",
        "sgs5n",
        "8%eE7{b",
        "lA&7f",
        "lvn8]",
        "LR(6$i",
        "u=`Kf",
        "V72+;@",
        "6Z'LF",
        "0?%T.=",
        "g@[/%",
        ":-r4120L",
        "1E7w{",
        "l#Y.~",
        "mu Windows 10",
        ".PAVCException@@",
        "FaLfY",
        "WMRvi",
        "E(u~V",
        "Comenzar desde el principio",
        "[dDjt",
        "~c@s+f",
        "LKP>9",
        "o<%'4",
        ";oz{~",
        "^VT2[`V,",
        "Y\"v,S",
        "$ ggV",
        "5L/S*J",
        "l pou",
        "Av5P@~",
        "927;O",
        " aSU*",
        "#[]WL#",
        "t1@-)",
        "fs8b8",
        "_Gj_c",
        "PHsb7",
        "H5VMTS",
        "System32",
        " na hodnotu Enable, in",
        "<.\"FAB/",
        "m|]M%",
        " na hodnotu None, in",
        "n controlador como parte de la instalaci",
        "P;XGP;*6",
        "Indstillinger: I/T ",
        "pid.txt in de bronnenmap. ",
        "67PB8",
        "m:UlZRb5VP&",
        "g2[$/",
        "Vjey?{Q",
        ":X:s:",
        "sG59d",
        "?& \"4",
        "1jsx\\",
        "X8w0$",
        "PkIK6'",
        "(/4Z&}(v",
        "@o:(H.",
        "@4+T4R+",
        " sa pou",
        "j!%A3",
        "8-8N8Y8`8",
        "712~'f",
        ": / migratealldrivers<paramenter> ",
        "i.T:?X",
        "[W|j#\\s",
        "doHgz",
        " jour des fonctionnalit",
        "g$G70",
        "7Z0@#",
        ";<;e;w;~;",
        "/`n7@",
        "lesben nem. ",
        "({*TXL",
        "%CqV:",
        "o de migra",
        "No se puede iniciar el programa de instalaci",
        "Wl@e4",
        "xtT]C",
        ":<:E:",
        "DVmuB-",
        "9gO;E",
        "]/G1W",
        "Af?'%+H",
        "cWGptC",
        "Ud}2-\\",
        "?((?}Y",
        "Nh1P(c",
        "S!P,.",
        "8{W)s",
        "b=_5YI'",
        "P$|-r",
        "=e:L^aB`",
        " ;XYi",
        "EB|B<",
        "ide: setup.exe / auto upgrade",
        ":1Vj>",
        "N#m&f&2",
        "s@fv;z<e",
        "RpcStringFreeW",
        "';z9*&",
        "b#*Fz",
        "ad: setup.exe / auto upgrade / showoobe full",
        "&V<[&V",
        "S`a,V ",
        "<`Xoa",
        "zKSq!Q",
        " bude in",
        "Yj6J0",
        "`Z` %",
        "vnou architekturu.5P",
        "?4?@?`?h?t?",
        "040D04B0",
        "o3_H*",
        "ReplaceFileW",
        "2j{sQ",
        "MessageBoxW",
        "ash0[t",
        "{CNt+f",
        "CIAmk",
        "@2^oY",
        "r kompatibilitet",
        "dfFS1",
        "$A?Z'",
        ":v`vl",
        "-Q^/+G",
        "RBfk0",
        "te spr",
        "9`n]n",
        "Ricomincia dall'inizio",
        " correctamente. Reinicia tu PC e intenta ejecutar nuevamente el programa de instalaci",
        " Windows 7 Enterprise",
        "\"s'w:",
        ".?AV?$CZeroInit@VCAzureScenarioCtrl@@$00@@",
        "TsO|j",
        "ra  s+",
        "Q,Tms",
        "aKx4N",
        "H.^X'",
        "1-121m1}1",
        "WtI=<i}",
        "m!Uqx",
        "WiHiTG{",
        "%+2Ulr",
        "~;x`<r",
        "ni pristup putanji odre",
        "GetCurrentProcess",
        "no:DDD ",
        ">>y)j",
        "/!8!1",
        "Launching: [%s] [%s] from [%s]!",
        "f[k &",
        "h_`f+{6",
        "zwB+j[k",
        "PO2.g",
        "v[Y/<",
        "CuOBD",
        "uF9w0t=Q",
        "^7bKI`",
        "lkomstprogrammet ",
        "zB}q}T",
        "-<lM>^",
        "Nn04X@bK0",
        "Configuration",
        "Q_E'Z",
        "LlnK<8",
        "D49@W",
        "4*qcS",
        ".CRT$XCAA",
        "7IRZ,",
        ")#F`>\\",
        "<];O:",
        "U&C}Z",
        "4D}H^",
        "8IMG%",
        "xkRT3",
        "=9n9WF",
        " nem carregar",
        "~]Nsk _",
        "[\"WdY",
        "Z_hn{}Q",
        ". Bandykite v",
        "uriranje, uklju",
        "C{6A,)",
        "q)}C-",
        "d1wM'",
        "BS?vFmoX",
        "&Fwc$",
        "?oDq ;@~",
        "\\rJ*?",
        "!J]*_D",
        ".f%xm",
        "5:A8KPp",
        "m telemetrick",
        "ZZ,Jf",
        "=u+ZS-",
        "igused v",
        "QO9+(",
        "636E6V6]6n6u6",
        "sx]zi",
        "C$w84",
        "H)Wf;",
        "u6mN8]_",
        "Beispiel: setup.exe / auto upgrade",
        "5C5]5j5",
        ";nok?",
        "_JYwh|",
        "~Bvj ",
        "o: / pkey <chave do produto> ",
        "n de Windows",
        "D m v",
        "<?xpacket begin=\"",
        "sM{pk",
        "|cSUb#",
        "z.9Wv",
        "r6&q+",
        "wE/eo",
        "*1^P,s",
        "4%n%5",
        "DKqXR",
        "&&F7+",
        "V1,Vj",
        "3/j;r",
        "j.st[z",
        ".?AVCBrush@@",
        "9N8P;",
        "ana, telemetrijas apkopo",
        "BBS#~",
        "&taqA8",
        "uNbg\\/d",
        "Nk6[ ",
        "e>u?-",
        "e]i\\4",
        "emqx[^",
        "O;8xh^",
        "ide: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "installation ne proc",
        "9@K;C",
        "K%$Ar",
        "hM4NB#",
        "\\8~Gh&q",
        "Bi>im*",
        "cSmvZ",
        "i instalaci migrovat nebudou. ",
        "fini sur None, le programme d",
        ",^s1H[",
        "v^hJT",
        "\\JOJ}Xn}",
        "n en el directorio y vuelve a iniciar el programa de instalaci",
        ".^V{/",
        " zautomatyzowane. Ten prze",
        "qD\"vr",
        "das noklus",
        "U2t!03Y%",
        ":InW'",
        "V)1U4nd;",
        "ekjHJ",
        "installation. Le support d",
        "LSAyV",
        "ra verktyget igen.gMinst 350 MB ledigt utrymme kr",
        "-f\"&JS:J2",
        "EQKH@",
        "o>hoT",
        "CP9C<t",
        "RXOT}",
        "$E!R|",
        "o: / installdrivers <local> ",
        "mfy]t`",
        "definido",
        "*&k\"1",
        "$4#Bo",
        "Ama[;X",
        "_g:ms",
        "7Ak:(",
        "rp=-_",
        "JqXrT\"h",
        "6+626F6V6[6a6p6v6",
        "i '98",
        "'P>w>.",
        "W8y(W",
        "Toiminto: lis",
        "GO+G]\\",
        "[~@!3",
        "LGwro",
        "! ).k",
        "i\\=WR",
        "ResumeMode: [%s]",
        "^sQ?L{",
        "tofe*#",
        "xOQy0",
        ";P(TZ",
        "Bl@HG",
        "Yibcm?",
        "P-Az1g",
        "b;Zcx",
        "^^^]Z",
        "ID|m3P",
        "XY!vjD",
        "Ty,ZjY",
        "h^L/oP",
        "=YuVT>",
        ".rdata$sxdata",
        "qm%KX",
        "!~jNcM",
        "A_?gA",
        "$`~C{_",
        "b~yT_k",
        "bs=&n",
        "auOl'2",
        "*}KoK",
        "w%|%{72",
        "Handling: N",
        "%=$V@",
        "+ISP#",
        ".?AV?$CZeroInit@VCBootScenarioCtrl@@$00@@",
        "<Lry%7",
        "Z\"lG%5y",
        ":*:2:C:L:U:",
        "*G2I2C",
        "unoIY>\\",
        "m<YrHW",
        "!_keG",
        "Vaihtoehtoisesti k",
        "1r{e7",
        "tu}Kurulum",
        "chten Sie die Aktion wirklich beenden?+Bereit f",
        "*ij)V",
        "{;=r!",
        "76:y+",
        "CwC_CGC/C",
        "&7U=)",
        "ID|>/",
        "*PdKz",
        "{~85n{NR",
        " 0+K0",
        "ra a znovu spustite In",
        "LZQ{7",
        ".?AVCLinkButton@UX@Common@ConX@@",
        "IpUIVh",
        ".{Qxk",
        "m Service Pack 3 i",
        "UE~n]",
        "Vh&4}",
        "{{!I0P`",
        "wj2ljU",
        "Nr^q;x",
        ">Y#2[",
        "\\'^[N",
        "82;;}'",
        "l%\"xG",
        "Actie: de quiet-vlag onderdrukt de Setup-gebruikerservaring, inclusief voor terugdraaien ",
        "$Vn7A",
        "es de utilizador ",
        "Q.CQD",
        "/LdB6",
        "Conmutador:",
        "'h<tQ",
        "o,CFl4",
        "y~;;{",
        "V2^vJ",
        "]v*z{Q",
        "O=Be,",
        "?khb7",
        "2v-{$",
        "S@/D\\c",
        "zc`u5",
        "QAkwc",
        "q24O%",
        "&&&%PT",
        "U\\O[Y",
        "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6",
        "U;bUer",
        " i log compressi nel percorso specificato. Tieni presente che il PC e/o l'utente devono disporre delle autorizzazioni e dell'accesso di rete per il percorso di file specificato. Questo comando viene eseguito nel contesto del sistema, quindi potrebbero non essere autorizzate operazioni di copia in percorsi per i quali sono richieste autorizzazioni utente. ",
        "imli olarak OOBE tamamlamas",
        "3<W{m",
        "rR&tD",
        "1c(d1",
        "CR;%HT>",
        " compatibilitatea",
        "tres : Un chemin d",
        "j<WEB",
        "Wz%h|",
        "F]s\"!.",
        "\\Rc>T",
        ":&:a:",
        ":*:=:",
        "T_Eq6Wg\\",
        "9a\"4b",
        "Kh8{)",
        "c\\L1FS",
        "fhI#dy",
        "Oc=1,",
        "rast installimise l",
        "&Sus$",
        "d=yIjY",
        "Bx8-\\",
        "z*FDo",
        "mwsZIL",
        ":.<5E|",
        "$3\\y0",
        "Q3E L",
        "Nhuq?\"",
        "[X`K5",
        "Hj)VQ",
        "is parametrs nav nepiecie",
        "#OK!/]X",
        "{_Stq",
        "k,U|iIA",
        "WoVzK",
        "7_!Zu",
        "VEeQL>",
        "5,jdX",
        "EtwEventUnregister",
        "KnU*e2",
        "Preparing %d%%",
        "Parameters: Upgrade; DataOnly; Clean ",
        "lUwA>",
        "8q'.7",
        "Por ejemplo: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "iI^}:\"",
        "solja vagy felt",
        "=fIQh",
        "@X~@H",
        "trie et de t",
        "[ql9>",
        "L{9;Y",
        "W3Dz%",
        "VOPnFu",
        "-li+[",
        "]$`iA",
        " jour dynamique activ",
        "S 2KM",
        "<-lsV",
        ";Qu2u",
        "dsEk|",
        "EH)j$56E%",
        "8 >[5",
        "c{n2+5u",
        "RiZ^g",
        "+W8.o<",
        "lda: setup.exe / auto upgrade / noreboot",
        "{W^rM._",
        "Az;G^T",
        "4TMPn",
        "        name=\"version.dll\"",
        "=?}^p",
        "yW8Q;N",
        "0S0h0",
        "La arquitectura que has seleccionado no coincide con la del equipo. Por ejemplo, si el equipo est",
        "v}Wf8",
        "g. Szabad",
        "GckCaKB",
        "e. Pokud je ale pro p",
        "(cf'\"",
        "nF`CU",
        "SaD#H",
        "Fx=b =",
        "Gh6WP",
        "GJu=~",
        " ejecutando otra instancia del programa de instalaci",
        "g:%k>",
        "=%E7RV<",
        "eHSFJE",
        "Sn3Pg",
        "n`cSn",
        "s te migreren als onderdeel van de installatie. Als",
        "Malgun Gothic",
        "OR#I6a",
        "'f)*8",
        "}p,lk",
        "RRJI3",
        "$d`a\"u",
        "4HwN4",
        "i din nou instrumentul ",
        "E|*j{",
        "46+r|",
        "&f\"U;wo",
        "pcW3@D",
        " Action : Lorsque / showoobe est d",
        "v!Sp+",
        "g;U56",
        ";C-t1",
        "osrU?",
        "4T$W\"",
        "SUs^S|",
        "I\\(5h",
        "Ug%V9yT",
        "        name=\"ntmarta.dll\"",
        "v`:e_",
        "V(7a]",
        "[&d`8",
        "P3h0\\",
        "F}MZ@",
        "Z]+y+ck/]",
        "7TfOR&t4",
        "uq\";k",
        "[6j]+[",
        "S<U-P",
        "R)ZJE",
        "dz\\AI)E",
        "e3)81L",
        "o corresponde ao seu PC",
        "lG\\Qe",
        "|;u;TTr",
        "729|&",
        "9yT<|",
        "g\\.|z",
        "BHjT5_",
        "?tRdW",
        "ggk/6",
        "b5>up.",
        "mfRe?",
        "?9?e?",
        "mu Windows nie je podporovan",
        "DwordCount",
        "vw*[5Jm",
        "hP&]M{Lf",
        ")=qCC",
        ";4vud",
        "[o(bU(",
        ",L;V\"{8,r",
        "bbi verzi",
        "&Nt+I|",
        "VoelM",
        "Action : L",
        "installation de Windows ne peut pas d",
        "E.w5Jz",
        "`\"l7N",
        ";X3mk",
        "9sTtr",
        "=v@dc",
        "\\NtxCF",
        "$mo<Y",
        "*mo1E",
        "feD,.",
        "%JD'jtA",
        "{pGilj",
        "LFnT,$0",
        "4\"Xb)",
        "BBJoK",
        "r^{\"%",
        "Fm$AV;H",
        "!#K'e",
        "|\\qV)",
        "t)cdB:",
        "^5jmw",
        "suviibaakna kaudu uuesti k",
        "4F5Sh)U:%",
        ">\"2>22+",
        ";nv[$",
        "b;=W[",
        ": / showoobe",
        "Exemple : setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "dg&{[",
        "ZMSdaM",
        "^w>}\"",
        "oAM3J",
        "~X]6dMN",
        "kX:f\"",
        "P`75+",
        "LCdzk",
        "s az elej",
        "bkkS7:m",
        "?Q*0;",
        "(z?4!",
        "&Fine",
        "^-cT6",
        ":Xg6E",
        "i Windows 10?",
        "<>,_<",
        "BLAvz.",
        "CDlpTask::GetFileByName",
        "nXSjVQ",
        "Failed to unload hive at %s\\%s. Error: 0x%08X",
        "=m[)v/",
        "3 3,383D3P3\\3h3t3",
        "QDV9U)",
        "6IXYYXXAFC=:",
        "]wZq[",
        "WiY^}",
        "sYlux3Z",
        ".Y*Y%",
        "I^ar{",
        "E0Vtk",
        "@Jn3^^",
        "GetSystemMenu",
        "'cx=9",
        "5=6O6}6",
        "!)rkz",
        ":v=UB",
        "b},\"\"",
        "x+=h=[Ak",
        ",B)MP",
        "BfXT8!",
        "Kk_1#S{",
        "8X\\;{j",
        "~?ZNp",
        ">Z4;X",
        "^MnGM4",
        "}1Jl+",
        "fjv;4{J",
        "X+0EG",
        "I5|WOO",
        " ir bandykite vykdyti ",
        "gqGd?",
        "vS^F1",
        "o do EULA, Atualiza",
        "#1b2G",
        "H1YUb",
        "041604B0",
        "Could not retrieve error description from transport for [0x%X].",
        "a?0+i",
        "j+=|AP",
        ">*,f>*",
        "qo.Q~v",
        "&>;A~",
        "`k[c\"",
        "Q-J_b",
        "koT?i",
        "Z/IImp",
        "0W0f0",
        "r Setup bereit. Bei Upgrades mit Volumenlizenzmedien oder Medien, in deren Quellordner eine Datei ",
        "x/CZF",
        "\\x^d#c",
        "B(0gFt>4",
        "eX[IU",
        "gf!l@",
        "a generada por la instalaci",
        "na.BM",
        "1Fj3\"u",
        "y[9E0",
        "{P1 W",
        "F<ya?",
        ".P3\\%",
        "M,?ag",
        ".data$r$brc",
        "7(747@7L7X7d7p7|7",
        "sj-,*",
        "nje prvega zagona: ",
        "O;+`~",
        "iune: specific",
        "/y/#^E",
        "X2+=r",
        ":fzGN",
        "Instalator systemu Windows 10 nie przyjmuje argument",
        "SetPriorityClass",
        "wf~<il",
        ">2Z]R",
        "X~F,f",
        "'8pBdp",
        "Handling: Angir plasseringen til kildemediet/-filene for installasjonen ",
        "/_?%;_ ",
        "IU(sQ;@=",
        "Pv<T~",
        "dzis: / Postoobe <atra",
        "g\\9]D",
        "7L\\5D5",
        "yi-001",
        "g~F)%",
        " / Telemetry ",
        "U_\\K4",
        "J+Kw{yyy",
        "2Uw{d",
        "~~yw]",
        "LzN=?",
        "g3z^_",
        "vJ/$o",
        "23rH:",
        "Yc;#c",
        "g a telep",
        "{Lnb%",
        "MapViewOfFile",
        "6p7w7",
        "\\s<k=",
        "rnek: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "anu uz Windows vNext, pieprasot lietot",
        "VyW{#",
        "lan olarak g",
        "YNb'abKl",
        "]CkrS",
        "Z5{B9",
        "VerSetConditionMask",
        "w/C[)",
        "pu9zmh6.",
        "y*E>jt",
        "e spustit star",
        "RQhpuE",
        "]2o/U",
        " onemogo",
        "BY+v+S",
        ",E93c",
        "[_IN~",
        "z!,Kq",
        "|)wyf",
        "CliX$",
        "I8YAZ",
        "FSN\"Q",
        "JD2u,HH",
        ";<<K<e<s<",
        "VX{ta",
        "r2U#'",
        "   @@@",
        "X_mYO.",
        "~Kgf3#La",
        "0cQv|7",
        "Hemos detectado que la instalaci",
        "D$@j(P3",
        "pnym ponownym rozruchu komputera. ",
        "en-AE",
        "/'%Ac",
        "qK:g(",
        "chargement",
        "']v#1G",
        "L$ Qh",
        "x3u/ui",
        "ObWv\"'",
        "`0L;I",
        "StringFileInfo",
        "y2(zS",
        "liti: / noreboot ",
        "N)wKyT",
        "kKalm/\\",
        "Anahtar: / installdrivers <konum> ",
        "T??Ru",
        "X.S6+",
        " AwI.",
        "##8p)v",
        "N2jXH",
        "ty6Lij{U",
        "+Z.s#JLp",
        "]hbrQ",
        "*c%vA",
        "N!`Dk",
        "wVPoU",
        "o de atualiza",
        "5 SUI",
        "_>Y2k",
        "a, zapnutie dynamickej aktualiz",
        "Zistili sme, ",
        "pp3Q%",
        "[`N)B(",
        "PGYi ",
        "YKC-w~",
        "&bZvEOK",
        "Waiting for process events...",
        "]n$H2",
        "%Ngu}2z",
        "d&,.; ",
        "}V1P|",
        "8b^j`,",
        "re OOBE interaktivt. N",
        "QmQ/N",
        "#tMU&",
        "t operace dynamick",
        "uH<uO",
        "xxxxh",
        "|aLX[",
        "Windows",
        "<=>T<^",
        "VwQD1i",
        "tv~p~t",
        ":6PhO1",
        "2{Tja",
        "MOkAaAY]=u<",
        "j`dn.{",
        "xrhf,",
        "ke programe u sklopu instalacije. Suprotno tome, kada je / migratealldrivers pstavljen na nijedan, program za instalaciju u sklopu instalacije ne",
        "s int",
        "0e]4%",
        "Yns`X",
        "<2`Mt",
        "^vte0",
        "_N_W7?",
        "-.2(B",
        " pro zdrojov",
        "{9y01",
        ":j19uE",
        ":vSxL.)",
        ";+ELz",
        "B_,j%",
        "Vy{=V",
        "0Ii<*",
        "nm?><",
        "H\\X_,.",
        "!i*\"a",
        "2#2_2y2",
        "A)$u/f",
        " arabirimi dilini belirleyemiyor",
        "*$})D",
        "..AZLTA",
        "GetLocaleInfoW",
        "GetNextDlgTabItem",
        "n%]/.",
        "Ra9V9",
        "k=}m:2",
        "ter nem sz",
        "?~%,>",
        "ren naar locaties waarvoor gebruikersbevoegdheden zijn vereist ",
        "'0}n2",
        "iune: C",
        "B^<EW",
        "!QDQx74vMm#!",
        "V/oZi",
        "]cL/,",
        "pTKt'(`",
        "bvFZ{",
        "U$Rb<",
        "CDlpRegistrar::CreateResponse",
        "JETmI&L!",
        "marrer en raison de fichiers d'installation manquants. Si vous avez d",
        "ci5Ex",
        "m-mM[",
        "|o:[\\",
        "Parametry: Enable; Disable ",
        " komandrinda uzst",
        "s7`~\\",
        "i$8/5",
        "XWPO}",
        "LPg@JZ%((",
        "9G9s9",
        "S;4Kd",
        "Posetite: %1!s!",
        "U8?f ",
        "`t?aN",
        "installation.",
        "9MmSS",
        " tartalmaz pid.txt f",
        "!ZMI$d'",
        "  WinDlp.dll",
        "4(CYl",
        "ws0_S",
        "y1sL;",
        "D\"N|e",
        "hWWT(",
        "JN5Jd/",
        "8jTas<,",
        "r<KfT",
        "Fn\\w&",
        "Q?qYb",
        "p\\.w>j",
        "}pAl=B",
        "8BMSdw",
        "<D.RC",
        "{p?*^",
        "        name=\"wimgapi.dll\"",
        "Namestitveni program za Windows 10 ne sprejema argumentov ukazne vrstice. V ukaznem pozivu v korenskem imeniku namestitvenega medija za",
        "dc*%t",
        "hsw?u<*k",
        "tB@.5",
        " pasirinkta architekt",
        "lGy=>",
        "sszetev",
        ",6Bf<q",
        ".S(zJ",
        " Action : Injecte le fichier setuprollback.cmd ",
        "NG` g",
        "L$(Qh",
        "'5z]g",
        "728C8H8N8r8",
        ">J&#!",
        "es-SV",
        "KbM=&",
        "|)%YR",
        "toru sa nepodarilo spusti",
        "x^Qp\\",
        ".+j5h",
        "S($zz",
        "e, znovu zkop",
        "O5lkx",
        "nWaQu",
        "=/>G>k>",
        "Parametreler : Full; None ",
        "??6}6",
        "9}!@g",
        "&K]Pq",
        "IkQb`",
        "?+6}9",
        "OA28\\",
        "wGt-/",
        "r+L9>",
        ">->6>K>",
        ")sG)sG",
        "xN+H7",
        "pId(O",
        "&Su[[",
        "`6raJ8",
        "ET|x,",
        "Gi{Z:",
        "9|$@t",
        "0(}-U",
        "mvnh`",
        "< <%<",
        "1o:(]",
        "q?zk8",
        "4.[`x?",
        ".#UdgY",
        "s wil verzamelen",
        " precisa usar a vers",
        "unalniku na primer izvaja 64-bitna razli",
        "(O:Dap",
        "'`/TE",
        "r9TY3I",
        "TcBYb",
        "    <compatibility xmlns=\"urn:schemas-microsoft-com:compatibility.v1\">",
        "(AEG1N",
        "ke podatke s testnih PC-jeva u slu",
        "$fH`\\",
        "0%0~0",
        "jI|lI~L",
        "=qH{T",
        "gw-[e",
        "6%~Z6",
        "VdF T o",
        "RB:H=a",
        "E=#nvc",
        "7k2R`",
        "y osoitteessa: %1!s!",
        " : setup.exe / auto upgrade",
        "iB&z\"",
        "muhxK",
        "5{9Up:V3",
        "bAz^^8",
        "zg;lh",
        "B@\\6Cd",
        "|ykHM7",
        " Windows vNext, ",
        "]QyoE7",
        "8+]qR",
        "/YG?|$",
        "hHq,5",
        "S8;&r",
        "nx%<p",
        "ru pri prvom spusten",
        "i{>tJ",
        "Conmutador: / Postoobe <ubicaci",
        "ZP;%X",
        "1UMUW5TMUK",
        "a-\"6k4",
        "=%5Lav",
        "u,$<!",
        "t?^rR",
        "lestuse k",
        "(yz?sS",
        "installation portant la mention %s",
        "~L&y9",
        "D-;jT",
        "^hA$&gn",
        "[.*,G",
        "|.:?Y",
        "U!:a:t",
        "; ;,;8;D;P;X;`;h;p;x;",
        "ZW/fT",
        "~3{^V",
        "39tAe",
        "5u-][",
        ":)8%6",
        "%4.4d.~BT",
        "d?o$;",
        " uz %1!s!. Vai v",
        "t\\]M:",
        "\\%xlMB",
        "Y/&DZo",
        " quiet ",
        "lm9oM",
        "4 Y)j)4",
        "<d&3:",
        "$s/97y",
        "Oaaz7i",
        "SOiG}(",
        "2FT/G",
        "progress",
        "6B/Y&Jrtw-",
        "e informacija potra",
        "x ::IP",
        "Action : Specifies location for installation source media / files ",
        ">HgyL",
        "yr5sU",
        "n`5cu",
        "G7Up*",
        "ScQ|om",
        "4\"424B4R4b4r4",
        "^dyV)",
        "Launching: [%s] [%s] from [%s] in session [%d]! (%s)",
        "$zD@t",
        "?&?D?S?`?",
        "}rg#7",
        "+Pripravuje sa in",
        "~OR-a",
        "Bw7>n",
        "V<Nn3p",
        "V4!0pU{",
        "Actie: hiermee wordt de locatie van de installatiebronmedia of -bestanden aangegeven",
        "*2b3V",
        "iRyhZ",
        "Zo%sW",
        "xqO@v<f",
        "5B,c^",
        "InternalName",
        " \"/ PBRUpdate\" ",
        "7C3<C",
        "@bEZ0",
        "bdgvZM",
        "}Z4]&",
        "p-fYT_",
        "3m4fXv",
        "56J#s",
        ";VyLt",
        "3~gLFz",
        "Zz}!s",
        "1Hzv1t",
        "-Q-k8",
        "p]'|U",
        "ybk>f:y",
        "pEx9=",
        "5&6B6I6",
        "Sn?3d",
        "+*kOy",
        "g;)!p",
        "2#i]7",
        "&QyBu?#",
        "IkPz#f",
        "e/Ar}",
        "dia s multilicenc",
        "\"+8#:L ",
        "\\x>LCA.L",
        "u'gTm^",
        "~7*7}",
        "ve-ZA",
        "t/]F*",
        ".8[x3",
        "<\\o/`",
        "Gx}q>",
        "-!^$z",
        "j^Q>56",
        "<9!2M",
        "474I4q4",
        "%*?qJ",
        "mr-IN",
        "*^Plw",
        "/Success %s",
        "<t.>B",
        "^##P#",
        "(<0ce",
        "DX$\"**5h#K",
        "retimde kullan",
        "|<km9",
        "8_dbC",
        "Tei[}",
        "\"pRb9)",
        "RTk[L",
        "Esempio: setup.exe / auto upgrade / migratealldrivers none",
        "`<VK?",
        "StateMatch: InstallMode found : %s",
        "jt}K,",
        "yzZ@rn",
        "metros : Caminho para pasta local ou de rede para um ficheiro  specific.wim ",
        "YqSds",
        "+3.@_",
        "toarele configura",
        "A'u&~]",
        "%`^PJ",
        "5 4e)[",
        "o+\\6[",
        "\\SX7j",
        "Setup.exe instala ou atualiza o Windows. Os argumentos de linha de comando a seguir podem ser usados para modificar o comportamento da instala",
        "L*/_?",
        "CopyDirectoryFileCallback: The copy was canceled by the user.",
        "%s: Setup mode is finalize - assume we are resuming.",
        "&Lxcl",
        "Meiryo UI",
        "mEz`8",
        "0Xwowv",
        "FSpP\\kT",
        "C?y^-",
        "bs-Cyrl",
        "bvt7)f",
        "0f0D0~0[0",
        "YOIuA",
        "*>$/6y}",
        "ni pristup njemu. Naredba se pokre",
        "stroj zatvorte, re",
        "v.x3j",
        "005Pj",
        ":`A~s",
        "{Q|?;",
        "d_A}E-",
        "hJ{:3",
        "Dr\"C@6",
        "?QSVg",
        "2!F7&",
        "5dMYK",
        ":MA=.k",
        "H'\"_x",
        ":C0L4",
        "1:e<,d",
        "%`IUa",
        "b82=7",
        "oJBov",
        "gZOZ>",
        "'fXb}p",
        "Oq,G[",
        "SEV\"R",
        "=J0W>:",
        "6X3;Ep",
        "J1lq^",
        ".4*WJ|",
        "bfT8+",
        ">gw:9.",
        "$^3w&",
        "S)5G#",
        "`1|,o&6",
        "l9qtf",
        "zh-CHT",
        "{-tS}",
        "p/JY<",
        "Aa+N;",
        "*Lb5c",
        "&<JXQw$",
        "Conmutador: / migratealldrivers <par",
        "erne fra Windows 7 Enterprise i l",
        "i asigura",
        "5d-X{",
        "azO,_k",
        "S4~L/",
        "wn\\a?S",
        "kMAUA",
        "g~3gw",
        "rR-DKC",
        "}cB(0",
        "d0i#9",
        "8m9<ys",
        "|\"Qo~",
        "/ClassId",
        "gpfeQ7",
        "2>QR0",
        "~}`B'",
        "Parametri : 5x5 ",
        "xuzsE",
        ")K>E4",
        "3yw(x&",
        "/Prompt",
        "Instalacija izdanja Windows 100Instalacija izdanja Windows 10 je ve",
        "z20fmf",
        "=Do.\"",
        "yY\"|Y",
        "UMP.-",
        "3O|x{",
        "4FfC7j",
        "MW% 7l",
        ":):6:@:",
        "cm{ZB",
        "        loadFrom=\"%systemroot%\\system32\\coreuicomponents.dll\"",
        "lemini ba",
        "Stikalo: / DynamicUpdate <parameter> ",
        "'7AaaCL",
        "&'34t",
        ",+lZm",
        "en0?B#Dg",
        "r 3};]Y",
        " y cargar",
        "m&]9A|",
        "`z=oT$-F",
        "9 :@:M:",
        "\\4^:p",
        "FreeSid",
        "YN0h%",
        "d |oxQ9",
        "5-646n6x6",
        "~1}T8p",
        ",4'v]D",
        "qAT3m",
        "Fortsett fra der jeg avsluttet",
        ":(9xJ",
        "WWobg",
        "rf6zgX",
        "M $=2",
        "d@k!]",
        "b_,+/",
        "\\S%08",
        "7)7:7?7E7",
        "Q{j rD",
        "kog su",
        "+?5#C",
        "r.T~_V",
        "a:gu2",
        "Sklopka : / migratealldrivers <paramenter> ",
        "http://www.w3.org/2000/09/xmldsig#",
        "Bn4;0",
        "f\\'Y~",
        "{iya_",
        "~jc1g",
        "1xD*(",
        ",>[ee",
        ">y{|!.",
        "78u*O",
        "cijas izv",
        "B?jGF",
        "U\"R'1M",
        "}H.=bR!",
        "hMB!=",
        "%!*xq",
        "$m0?UT",
        "$^&GSgg",
        "5p]{o",
        "M>r:Lc|",
        "O^F=M",
        "Parameters: lokale bestandspaden en UNC-netwerkpaden",
        "Meiryo Bold",
        "jums\\draiveri",
        "79)P_B",
        "nLS7@2",
        "n:8Z@",
        "xU1G`",
        "potek",
        "Bw9:s;H",
        "zY}'as",
        "<_=]>Q?",
        "W7Sop",
        "-]lnj",
        "59,9o/5",
        "JoEZ6",
        " migreze toate driverele ca parte a instal",
        "letim sistemi g",
        "q\\ef*",
        "W0D[^Gm",
        "=@3/j|V",
        "uBT|)",
        "4BucY",
        "=Qm4>",
        "r4&~T",
        "=*!F!r",
        "?/6zAj",
        "jS(p^#u",
        "Parameters: Enable; Disable ",
        "Jz%;Mn",
        ">PRpW24",
        "e*1M).",
        "LoadLibraryExW",
        "uriranje, telemetrijsko prikupljanje i davanje saglasnosti za otpremanje, OOBE ",
        "7F%)<F",
        "~&k?S",
        "'9<C^",
        "V:hYn",
        "Continue from where I left off",
        "v8aJ,b",
        "G1yx3",
        "PubY8",
        ">}$K|",
        "SetEndOfFile",
        "`b)xX",
        "~9=[M",
        "EZ(O`",
        "ba: automatiz",
        "]xpJ-u",
        "xNUCe",
        "@v|3t",
        "\\|-iW",
        "jq7p(",
        "e je stikalo / PBRUpdate nastavljeno na ",
        "-~\\-u_",
        "e u kontekstu sustava, pa mo",
        "dzis: / Postrollback <atra",
        "9D9a9",
        "x66Q}",
        "BI`,m",
        "@sSM4",
        "RegSetValueExW",
        "S}x![",
        "stato",
        "r!nR7",
        "$130*q",
        "_$g1Z<:",
        "ePR(cD",
        "r*XG$",
        "Voorbeeld: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "*S1v9l",
        "[Windows ",
        "V6E6'1",
        "_RG)*b",
        "l4)^9z\\",
        "JOIVu",
        "nzOwF;",
        "klad 64-bitov",
        "-W\"w*",
        "cUyRD\\",
        "+:#,`",
        "fihKR",
        "CP^Io",
        "o=2G2Do3",
        "6#v?=C",
        "IsChild",
        "Hr7/V",
        "Wq}vr",
        "Z(D0_]|",
        "b9XxtX",
        "k ZHu",
        "Y%r!d",
        "Z datoteko ",
        "{qysvzs",
        "'gh^(;",
        "Kurulum do",
        "KT%(/",
        "\\(GX&",
        "<!v+_",
        ">+>8>V>p>}>",
        "f.S5}",
        "k;k;k",
        "|;TO/",
        "oP{0#2",
        "q`6O{x",
        "%]?xM",
        "PerformCleanup",
        "KhdS%Rqqc",
        " Windows 10",
        "^MgqM",
        "R3HW#",
        "XhYB6L",
        "?/J;h!",
        "`NGkZt",
        "Qy,mi",
        ".xl?L:,DWj",
        "lnym s",
        "{lqon",
        "RMS,@",
        "Rzx/\\Q",
        "v8>}>",
        "Tv\\fk",
        "ri1tpS",
        "ckt Setup-UX, einschlie",
        "0p3h<c",
        "41=LM)",
        "o_;M'I",
        "6*6[6",
        "tI`Mju",
        "0+*'(",
        "uD4l$;",
        "SDa\\1r",
        "\\N~Gv",
        "Ep{p'",
        "?[@ }",
        "marrera automatiquement.'La version XML requise est introuvable.LErreur de r",
        "z jKI0",
        "]+q>\\",
        "iFxJ=:",
        "wqURA",
        "cZF?N-",
        "Ef=]@",
        "Md\\AGq",
        "_V@>v",
        "re oppgaver etter at installasjonen er fullf",
        "4jg4j",
        "%Zy]#%uU",
        "vsut*",
        "8;c@r",
        "J?,R1",
        "CRp'65",
        "y3[!)v",
        "c93\"ci",
        "_x15~wZ",
        "~h2+u",
        "<Smn7",
        "Check Compatibility",
        "Akce: P",
        "I]uU1X\\",
        "Z^``T",
        "SHA256",
        ";pZ,8",
        "t@U-1",
        "rrp9Bw",
        " tiver iniciado a Instala",
        "DeleteDC",
        "L1y^A",
        "zyinelemeli olarak arayacak. ",
        "2+Z?Ao?",
        "H!\"L{t",
        " by se m",
        " instalace zkop",
        "?Hey3^O8",
        "seau UNC  ",
        "l<5* ",
        "GA*@I",
        "wCOBv",
        "wO'{j",
        "&:/f_Q",
        ".5q?O|",
        "]{:U}",
        "OD0n0 ",
        ". Ar norite t",
        "FK-ZpZWH",
        "iA,%!",
        "seau UNC vers un fichier nomm",
        "%s: spScenarioCtrl->OnFailure returned Error = 0x%X",
        "=u8Q|s",
        "MUG'4",
        "1l&Ob}",
        "B9{0a@",
        "h;i9O",
        "es par d",
        "t&f;E",
        "F)3ERe30[",
        "ec33r)",
        "y&gjju",
        "8a)n[",
        "ta-LK",
        "nde bir pid.txt i",
        "n{@fLQp",
        ";Kg,t",
        " diegimo). ",
        "#IC,G",
        "UU-hm5hG]",
        "[QmCM/",
        "hendisi, bir hata durumunda s",
        "%|]az",
        "ranka bandys perkelti visas tvarkykles kaip diegimo dal",
        ";r2|no",
        "2\"#3YL6",
        "0W0~0Y0",
        "gokkal fut, mint a telep",
        "iuni. Urm",
        "vU_v^",
        "+!)#\\)",
        "EX4j3",
        "WIMSetFileIOCallbackTemporaryPath",
        "VND(J",
        "F*|!\\787",
        "8@Wb]",
        "%-Ok%iZ",
        "+>i}#",
        "pWDiG",
        "Gw*Nq",
        ",8?:6",
        ",0<B%m_",
        "@X,<$",
        "rtao<",
        "dK?F3",
        "^F,~}tj",
        "4[#TJ",
        "@a-&[",
        "d7rO^qx",
        " PC-ul ",
        "x3drH",
        "OEfO\\i",
        "Forbereder %d%%",
        "F{2]yc",
        "SbtzLq",
        "e<#/-",
        ";ZdeEz@",
        "Ud.~D",
        "B`FO^",
        "%Uq~G>I",
        "4<4h4",
        "=!:v0",
        "InitializeCriticalSectionAndSpinCount",
        "i<^te",
        "eu-ES",
        ".?AVCWnd@@",
        "E\\xf|z",
        "Exemplo: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "Prebacivanje: / Postoobe <lokacija>\\setupcomplete.cmd ",
        "uQXd2",
        "^_Xf2",
        "I+Lg&",
        "&Vp]I",
        "Av:S/\"%",
        "%%Sg#",
        "n'b^>",
        "zN<70",
        ";|46w",
        "W4zlK",
        "@r3HZq",
        "Bq|tl",
        "na6X*tw",
        ">lQW<-",
        "9\"ulF",
        "s=1~A$aQ",
        "j\\Xf;A",
        "NfL}/Z",
        "$3LPYa1TP",
        "|J:=]'.#n",
        "Q#9JE+",
        "V\"\"}rix",
        "RDR2j",
        "rken hata olu",
        "installation Windows 10.",
        "I|+H*o_",
        "dir.t%s bit yazan di",
        "k?}(>",
        "D<V4rN(+^r",
        "_5g1q",
        "x75=k",
        "(+O:g=*",
        "b8inO",
        "%j<M[",
        "ZD_\\_+",
        ".<Y-]|",
        "VxDl_",
        "Populating preservation paths...",
        "=p?CE",
        "a\\g+tX",
        "_+9&N",
        "mas uzdevumus. N",
        ":y=A7",
        " <~K99U",
        "$d:xG",
        "m7D##MPV",
        "th0TA",
        "5(-6^",
        ")hs7!S7G& ",
        "2W#EU47",
        "&&@VR<",
        "Sistema Operativo Microsoft",
        "{Jz'%e",
        "terek: - ",
        " til Windows Update i Innstillinger-appen for mer informasjon.",
        "C\"mbe",
        " {:0l",
        "oo{|||{{wjkk_YS",
        "JE?w1",
        "o, incluindo a revers",
        "cznik: / auto <opcja migracji> ",
        "P153\"",
        "```@@@ppp",
        "*q!pz",
        "7X0xL:",
        "#_^TH",
        "Conmutador: / installdrivers <location> ",
        "%^8Ee",
        "mu Windows. T",
        "<+=5=V=i=",
        ": Enable, Disable ",
        "O05>h",
        "X|}m|",
        "CDlpTask::ProgressHandlerAction",
        ".$W;O",
        ":~;c'",
        "l6{hx",
        "JA~_<",
        "7G<pF",
        "<oq3Y",
        "AbG5h:",
        "kNZ7=",
        "u'@b#i",
        "'Y/NF",
        ")G7*$",
        "'kWn&",
        "n H|3",
        "Sgt3Vtp",
        " EC~CkH-",
        "I<+kX",
        "[xhu;\"7",
        "GetLogicalDriveStringsW",
        "\"#+!S",
        "N1n,}",
        "CDlpManager::AsyncSerializeEnable",
        "_\"kR{",
        " tulemaan n",
        "?`Ah`_T",
        "4d+os",
        "?y<KX]",
        "Oi,287",
        "+b)&>",
        "i privilegii cu utilizatorul sau procesul care a lansat instalarea. ",
        "V]i_H",
        "installation est d",
        "NT%XB",
        "Orc3]G",
        "r,mr-",
        "r klar et par ting",
        ")WBBW",
        "aDux\\",
        "~@c=|",
        "\"$HHj",
        "]}vfa",
        "C>rcw",
        "5=D>?",
        "@,hql",
        ">4o1%",
        "7w611",
        "rikd:0",
        "Setup.exe asentaa tai p",
        " pokrenuta.xOva verzija operativnog sistema Windows nije podr",
        "VIETNAMESE",
        "fi:Qr",
        "q^f|N",
        "hCV^>",
        "xAwnOeU",
        "R0.H^",
        "I1]L7",
        "u0oe-l",
        "=Cac/p",
        "<:kd#",
        "~Nxe=U",
        "%v\"`7B",
        "GO*sO",
        "}]-\\[",
        "{4Qne",
        ":uSQ^",
        "nem criar",
        "'\"x@`-{",
        "'^THh1",
        "e(X|Z",
        "=H_H/",
        "98]BQ",
        "uRRtNJ",
        "p1nYN",
        "\\\"rYX\"r",
        "E(}&y",
        " xnn`",
        "=eUrF=",
        "])\\\\L",
        "j-s@-9*",
        "lda: setup.exe / auto upgrade",
        "Fby\"m(",
        "L\"\" B",
        "1Zc^`",
        "H~^(n",
        "nzLz-",
        "rP&{|",
        "3|Jr~",
        " 6\\s&",
        "s/X!;!X",
        "-'yw;]",
        "+Ov&.",
        "J|=/M",
        "ou verziou in",
        "GetFinalPathNameByHandleW",
        "REl programa de instalaci",
        "r>0gU",
        "^6DC2",
        "q}miEu^",
        "r du oppgraderer med et volumlisensiert medium eller medier som inneholder en pid.txt i sources-mappen. ",
        "ges XML-verzi",
        "D$@PW",
        "(8Bzl",
        "dK%<v*",
        "%-,*zk",
        "58*}_.e",
        "ahk?+",
        "Vhp8A",
        "1O1$2E2P2c2",
        "yWl v",
        "da instal",
        "e ste program Setup pred tem zagnali iz lokalnega imenika, znova kopirajte vse namestitvene datoteke v imenik in znova za",
        "Cw;O:n,>",
        "GPwLG",
        "5h3iL",
        "Ret}%Y",
        "XCi}S",
        "8[J 3wa",
        "S?$:{9",
        "rm] G",
        "LWL!=",
        "HCWej",
        "cego plik pid.txt w folderze ",
        "U\\3FxV",
        "m\\oLl3&",
        "O\\\"}|p",
        "{_Bb_",
        "*w:zo",
        "4DZ\"6",
        "CkvuaY",
        "piM?0",
        "C&oncluir",
        "bbi inform",
        "mu Windows 10 je u",
        "X747F\"y3",
        "aDT}#",
        "im_sb%",
        "i din nou s",
        "9x&jmA}\"^p",
        "1K\"P,",
        "1gJcazA",
        "fg#T)",
        "\\m%Mp",
        "Uma situa",
        ">Nd/f/`",
        "e[j*v",
        "cznik: / pkey <klucz produktu> ",
        "iTkxv",
        "Zd|!]~",
        "        loadFrom=\"%systemroot%\\system32\\ntmarta.dll\"",
        "y={ 0",
        "n<ib%^b",
        "sa, PBR part",
        "s[x,{=",
        "Qi/p[N",
        "w i ekrany post",
        "CompanyName",
        "O:~i<",
        "Dq\"NE",
        " Bh7E",
        "TqiM]",
        ")gwklH",
        "hne p",
        "hy}=}",
        "Radnja: Odre",
        "7:62R|",
        "PA<XM",
        "En administrator ",
        "BI@q3",
        "$Z+BkFh",
        "FR0]=-",
        "0?ceQY0",
        "]^5fY",
        "}OZQqA",
        "(wcQ<",
        "f9sBC",
        "k~`u'",
        "friss",
        "Ava&n",
        "<T+{3IU",
        "0[neUJ",
        ". Dac",
        "Iy9Uq#ml",
        "FD!ax%",
        "01YWeW0_04X",
        "=+zNW",
        "ZRghL-",
        "DISPLAY",
        "t>$E#",
        "inky v zadanom umiestnen",
        "gioB~",
        "{mq|##",
        "e.k0b",
        "eM-?w",
        "U3&2{Bb",
        "steemikontekstis, nii et kasutaja",
        "<`>25Z",
        "z gerekir. Arac",
        "H% kR",
        "^[ihc",
        "IsIcN",
        "k8)6=",
        "xOIQv",
        "@n1576Z",
        "K^r:9H",
        "I:YB,",
        "x),T<",
        "CDlpManager::GetTransport",
        "c#zl\"",
        "laties apkopot ",
        "Jpoh=%",
        "Mnh^C=*",
        "f:MjF",
        "^6RB-",
        ")Mg#2F",
        "36pF7g",
        "c%n>6#!",
        "anje se bo nadaljevalo, ko naslednji",
        "3j1g'",
        "[mQ6|",
        ">7?G?W?`?i?s?w?",
        "c<?]X;",
        "i naredbeni redak : ",
        "C/9^Ksq;",
        "IsdSw",
        "K@UG2",
        "-}`Zq`|P",
        "Waiting for SetupCln to finish...",
        "62q_>",
        "i&&09\"",
        "nin g",
        "wZ)x;",
        "D0X V",
        ">?.#k",
        "setupcomplete.cmd do local especificado. Setupcomplete.cmd ",
        "~w>J@/",
        "yBJ0#",
        "+8a7h",
        "L2$#[",
        "c noklus",
        "o com a op",
        "p/o0rJ",
        ".?AV?$CZeroInit@VCWebScenarioCtrl@@$00@@",
        ",%WJ?4P",
        "9iI=Fv",
        "`eb}5",
        "/[CSX\\",
        "}]*^E",
        "V^a4{",
        "Niof3",
        "sap-Id",
        "W9AMUc",
        "uTH.E+L",
        "?\"8!qsOh",
        "rer allerede. En funksjonsoppdatering kan p",
        "aU\"]8",
        "DestroyEnvironmentBlock",
        "K1$xP",
        " UNC ",
        "9c+$mZ~",
        "?{8l6c",
        "888T8X8\\8`8d8h8l8p8t8x8|8",
        "1d6Jc",
        "D$XPj",
        "liti: / Telemetry <parameeter> ",
        "VT,b:",
        "A)?CB}[v",
        "qvR66",
        "k{Ivm",
        "2:S)4",
        "VQ8AM",
        "qP>E;$t",
        "3@9h;I",
        " de produit de 5 x 5",
        "dB-6c",
        "QueryPerformanceCounter",
        "3*y<#",
        "n: proporciona a la instalaci",
        "g~ONw",
        "'VANz",
        "B7|*tFLu",
        ">CS50",
        "ug-CN",
        "SiteLink'Rufen Sie die folgende Seite auf: %1!s!",
        "8eM*{",
        "oQs9~e",
        "P`nz0@N",
        "X'!@T",
        "T)IQ_x",
        "StringProperty",
        "ksi niin, ett",
        "ipraven",
        "Wiizk",
        "xz`vD3+c",
        "!A$7>",
        "CDlpTask::GetAction",
        "]A0HS",
        "ranka bus t",
        "R#.1`I",
        "s^h,7^",
        "S+XOS",
        "bTt.$",
        "210211214040Z0",
        "t=%_3~r&",
        "]O[e;9",
        "fFb>C",
        "0j{#<q#Y",
        "@j2,1t",
        "5[$yh",
        "h<W<m",
        " versija ir Windows XP ar 3. servisa pakotni.~Izmantojiet citu instal",
        "nP5T7",
        "buma'",
        "U*s*_",
        "{K]~ZT",
        " N;:$",
        "c1os=D:",
        "zjgNrl/",
        "Vc9V-",
        " impostata su Enable, il programma di installazione aggiorner",
        "1}}N_",
        "e/~iz(",
        "Parameters: All; None ",
        ")j<^i",
        "s\\illeszt",
        "I%CoX<]",
        "2]Bbe",
        "o de diagn",
        "hj(-j",
        ".c\\]0",
        "?B6[bB",
        "&K~`=",
        "e.}S[",
        "I#^syBE(Vy",
        "z[CMh",
        "6qWHDg",
        "O_+ep[",
        "echna pr",
        "P]3EO",
        "H\\E$,a",
        "&d=9w_DQ8",
        "$X\"Nx",
        "2 ]nP",
        "<banG",
        "ZnRPz",
        "\\Znb6",
        "ee/9J",
        "4sdde",
        "yj innego dysku instalacyjnego, zawieraj",
        "u%~Y) ",
        "ide: setup.exe / auto upgrade / Telemetry enable",
        "0-Nk0",
        "/\"|6z",
        "verser les journaux compress",
        "Valitsin: / installfrom <sijainti> ",
        "FuGL]",
        "%ZH6ZH6Z",
        "U!S#*d",
        "PMS\"V[5_",
        "ssen Sie die 64-Bit-Version des Tools verwenden. F",
        "Eu(1S",
        "(m<6t",
        "[06xm*.",
        "/Yt]!",
        " ]]|W",
        ";v]xv",
        "31|}=6",
        "e@)|9",
        "?&=FE",
        "CIb(I",
        "hP{@qS",
        "/ installfrom <ubicaci",
        "k/<G<",
        "F^O|M",
        " di raccogliere log e altre informazioni diagnostiche da PC di prova in caso di errore. La riga di comando seguente indica al programma di installazione di richiamare lo script setuprollback.cmd dopo un errore di installazione: ",
        "ke prijave. Pokre",
        "frDxl|\\8",
        "vt7hs",
        "+6h!m*",
        "iere ",
        "UT`Y:",
        "=0 2]",
        "kaf<e",
        "~hKc?4",
        ".]r\\J",
        "(7ZN0BY",
        "2-Tl2-Z",
        ";K=>d",
        "]{@UU",
        ".?AVCSimpleWizard@UX@Common@ConX@@",
        "nik, ",
        "=&9_{",
        "~1;kb",
        "80>zPl\\DtB",
        "D&:TR",
        "n: cuando / showoobe se establece en Full, el usuario final debe completar OOBE de manera interactiva. Como alternativa, cuando / showoobe se establece en None, OOBE se omite y los componentes se establecen en su configuraci",
        "7}C^}",
        "ev0Ck",
        ">Sf\\u",
        ".hy?|",
        "-b3=F",
        "+(y8Vh",
        "eC.47:Y",
        "[d~yJr",
        "rh9=I",
        "5!555<5T5b5q5",
        "TX0yr)jg0",
        "#`q]g4",
        "jl helyi el",
        "5)555i5",
        "1N{cd",
        "_.HKG",
        "PV-5U",
        "_V]EZ",
        "4L'architettura selezionata non corrisponde al tuo PC",
        "(B-jA",
        "z1D6Z",
        "5Arhitektura koju ste odabrali ne odgovara va",
        "Fmp1g",
        "Qgl#i",
        "Pp22L%",
        "#j%^(VH",
        "InitializeCriticalSection",
        "W0~0Y0",
        "}|/h}",
        "Fpwei",
        ", mihin j",
        "Fbbv,r7~",
        "4sTI6",
        "\"1$n[$R",
        "yAxCT",
        "IxB_I",
        "oGUPWh",
        "(\\{stmq",
        "j:%gL ",
        "f-@V9",
        "DBH9B",
        ",+sXAV",
        "q-O?!",
        "id?md",
        "]7y.t",
        "4rOiT",
        "Njkxu",
        "e i komponente se postavljaju na svoje zadane postavke. ",
        "Tk.8xi",
        "Q|mQ*f",
        "DLPLOG: [0x%X] [%s] [%s]",
        "bD-CB",
        "aceita",
        "d:~Tj",
        "V[>tT",
        "ajte ponovno pokrenuti alat i pripazite da odaberete odgovaraju",
        "rguteed ",
        "9rbl\"",
        "o do Windows enquanto outra inst",
        "!dMzQ",
        "Eller en distribusjonstekniker vil kanskje samle inn logger og annen diagnostikkinformasjon fra test-PC-er hvis det oppst",
        "7'7g7u7~7",
        "zNj\"q",
        "`9&6g\\",
        "KVhLa",
        "Akcja : Automatyzacja instalacji z wybran",
        "hW{>1",
        "`7Goc(8w",
        "feAP6yu",
        "vG[u(rBK;6G",
        "x@e'V",
        "A;?lDz",
        "G_F!&",
        "MV\"mi_",
        "85v $f,",
        "ND3G~",
        "/Priority",
        "iau, kai / PBRUpdate nustatytas kaip I",
        ";+;w;",
        "q3C^I?",
        "Exempel: setup.exe / auto upgrade / noreboot",
        "UTF-16",
        "@`v){",
        "$_-8,]RN4",
        "RZ>&,",
        "I>S)2",
        "nu arhitekturu./Do",
        "I!K,iQ",
        "OpenEventW",
        "I(M_!`e",
        "49__j",
        "M[4|?",
        "nY_;vj",
        "Au3Cn",
        "Setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers / postrollback c : \\setuprollback.cmd",
        "W37b}",
        "N@mC ",
        "9?3s!",
        "np*tF",
        "xvxA=on",
        "FVdb:P",
        "iyI|S",
        "Finalize Resume Found: [%s]",
        "e_iO(",
        "B~~,?7",
        "Primjer : setup.exe / auto upgrade DynamicUpdate onemogu",
        "rio raiz da sua m",
        " za nasadenie zhroma",
        "@'CU:",
        "hp'%$^M",
        "%jd;n",
        "PQQQQQQh ",
        "sh[YS",
        "'*a:%[",
        ">SYkf",
        "f-IUW",
        "lk.[v",
        "'*2O?",
        "C5)LM",
        "< $@@l ",
        "#>(rl",
        "As3\"R",
        "|4}'^",
        "2t,-z#",
        "vz!4$g",
        "Eb5`3",
        ">,><>@>D>H>L>P>T>h>l>p>",
        "est pas n",
        "SPLA)",
        "FWys=`",
        "ljuda?+Kas olete Windows 10 installimiseks valmis?sAvastasime, et installimine toimub v",
        "ysTN|",
        "vykus diegimo gedimui: ",
        "1IzU>",
        ": Upgrade; DataOnly; Clean ",
        "2N|;6rr",
        "ZA5E])",
        "Por ejemplo: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "(;oO;",
        "wcsncmp",
        "0xG&E",
        "9k?Y8",
        " Instalatora systemu Windows 10.",
        "*ZN5t",
        "In alternativa, un tecnico della distribuzione potrebbe avere la necessit",
        "CDlpTask::GetChronologyIndexById",
        "n, mutta h",
        "j{-ek",
        "to produkta atsl",
        "r=7r3",
        "b-QY|pM",
        "`C88L",
        "4pQqAh",
        "^A2r>",
        ")\"1&c",
        "Br~%4",
        "d[KQw",
        "|n8#*@/",
        "Pse~p",
        "CorrelationVector",
        "r endast anv",
        "PE~bIP",
        "AK}C=JD",
        "&guti",
        "s=SyN",
        "vFw I",
        "ktan sonra g",
        "r inte att starta den tidigare installationsmilj",
        "2Kn'-",
        "c'M7K",
        "26Y~.",
        ";vx;.",
        "Instalacija izdanja Windows 10",
        "u/Q=5",
        "7uu8V[",
        "inskim licenciranjem ili medijuma koji sadr",
        "E6TN_",
        "$0#U^",
        "C+eLrU",
        "Sb-~Q",
        "tti feladatokat v",
        "A'L@I\\",
        "EnumeratePathEx: FindFirstFile failed for [%s]; GLE = 0x%x",
        "q3Lk!z",
        ".:j?WU",
        ": / copylogs <um",
        "}:]$7",
        "Sb+~Q]",
        "V.#Kr",
        "OfRB5Q",
        "ih namestitvenih datotek ne more zagnati. ",
        "i .inf datoteke ",
        "i protsessil. ",
        "Qm`hC",
        "=/y5Y",
        "Esimerkki: setup.exe / auto clean / installfrom d : \\omaWim\\mukautettuwim.wim",
        "NdxYl",
        "ru-RU",
        "cEUtz",
        "VPAtl",
        "zNas[",
        "%Z+G&",
        "-:@{Mo",
        "vcuC|u6",
        "y}'y-",
        "[L:rKJ",
        "59[{J",
        "q5}0h]*",
        "zfE5.7",
        "JJZYd",
        "jHhKN",
        "$Xi)MH3",
        "_P1>'-",
        "5Q^GyY",
        "^]+b8",
        "x=vL3?",
        "MtATu",
        "Z-_,X",
        ">sTcj",
        "=,1+3>mZ*",
        "qPHnL-",
        "BE<$`W",
        "vQ$mt",
        "2#!w ",
        "Perjungimas: / copylogs <vieta> ",
        "&E40{",
        " syst",
        "Parametri:  Lokalna putanja do datoteke ili putanja UNC mre",
        "aO[<:",
        "g/~E1E",
        "n setuprollback.cmd-komentosarjan asennusvirheen j",
        "2X,{9",
        "@qyW!<",
        "Z^\"tFau",
        "J2+.c",
        "KzI;iC",
        "c3-A|",
        "8fjA!",
        "L!qI$",
        "NtYieldExecution",
        "4k^|J",
        "WCJ!<ZZ6",
        "xr[{D",
        "ZQ**N",
        "BE'1O%",
        "F!vuz",
        "8E3}C",
        "_%o(p",
        "g<??1",
        "1ISLk",
        "k3jJ8&=EU",
        "ZfRJ;",
        "'+vQr",
        "Invalid parameter passed to C runtime function.",
        "D_;Zg",
        "lq,f.",
        "Tn6Wq",
        "ssel foglalkoz",
        "lTZrRu",
        "/M:k}z",
        " : / Postoobe <location>\\setupcomplete.cmd ",
        "Fpv*j",
        " friss",
        "Example: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "&obU'",
        "4mQ|r",
        "@U>.g(;",
        "\\&kL~",
        "ringsvalg for installasjonen. Grensesnitt for mediekonfigurasjon og fremdriftsskjermbilder vises som standard, men den er automatisert. Denne bryteren forutsetter ogs",
        "7/9eG",
        "5 6*6",
        "VA\"`p",
        "jx]|w",
        "]#D1B",
        "iY~G|",
        "{O6R-",
        "6rNeO`XNe",
        "ckU?`u",
        "ciju, programm",
        "T+-T*e",
        ".-LD/",
        "gE0k[",
        "eB)[o",
        "|%,4P4",
        "lG#Of",
        "BoxHash",
        "1Gll_+",
        "ly sz",
        "niejszego systemu operacyjnego. Jest on uruchamiany z tymi samymi uprawnieniami, kt",
        "'{Fnu",
        "h:_eLT",
        "jga]\"o",
        "i( q$",
        "essayez d",
        "e)ln/",
        "anas programma neveiks ar instal",
        "<0<J<_<",
        "tW|kij",
        "uRp;|I",
        "lete ",
        "EYW,R",
        "f0x]Qm",
        "qJg\"|9",
        "accepte pas les arguments de ligne de commande. ",
        "A5P94!O]n",
        " nebo aktualizace odd",
        "quz-EC",
        "tWVPj",
        "?iC?DjY",
        "UyZ0v",
        ">KnE[a",
        "6t9VA",
        "n timpul procesului de instalare. Instalarea va c",
        "z@[6h",
        ")z|X:",
        "%s bites",
        "<\\i0/",
        "{tyV\\",
        "Opzione: / noreboot ",
        "=[c`k",
        "definido como",
        "~j]])XW",
        "Omogu",
        "|uczi",
        "&Wstecz",
        "1)1O1",
        "CDlpTask::EnqueueAction",
        "c<A3)V",
        "6RXJ ?f>",
        "+uK/G",
        "A8X9X",
        "s a conclus",
        "PmWCV",
        "O-:mT,",
        "v'j!j'",
        "6<s5e",
        "ho umiestnenia a v sieti sa mohlo vyskytn",
        "xo08o",
        "Bg>#E",
        "RfJO=",
        "Yz{F%",
        "Ru Jo",
        "Ib{>&",
        "+heD:",
        "5GztE",
        ")t2Nz[L",
        "Parametry: K",
        "f\\I%h",
        "b7A}T?",
        "CDlpTask::SendCallbackMessage",
        "O:#E#Nz1",
        " vynulovania stla",
        "]\"1xS",
        "L*JDY",
        "oNp&:",
        "S`bi_",
        "in 350 MB de spa",
        "m98QV",
        "OmF(u-",
        "g:O>>f",
        "t`Oe1",
        "r5m&'",
        "1JJgP",
        "6}c\\?L",
        ";@x9^j",
        "i!<-fI",
        "<S |/i",
        "heU=M",
        "|=z3:",
        "\"O';?",
        "Mk&V#",
        "5\\\"B]",
        "AddAccessAllowedAce",
        "Un administrador quiere actualizar los PC del departamento desde Windows 7 Enterprise durante una noche. No quiere que aparezca la interfaz de usuario de instalaci",
        "\\bW/Q",
        " sonras",
        "sl-SI",
        "f{]J2[K",
        "l@&l7Mr",
        "CSetupLangIniLoader::Initialize: LANG.INI Directory = %s",
        "Y&@B\"",
        "%?]KG",
        "K&ER&m",
        "HSd3T",
        "MjnS?E",
        "s9]|'y",
        "Instalacija Windowsa ne mo",
        "0)Hqw",
        "media met een volumelicentie of media met een",
        "&2}3>",
        "K?D2A",
        "cJ&4_",
        "FNB@6",
        ",$vjx",
        "s}|u6",
        "telezi: licencfelt",
        "Ip44y",
        "Q:!EW}",
        "cie (h",
        "a=\"4;",
        "[4D|/k",
        "ze-xow",
        "*3Pws/",
        "0*4a$I*B_}r",
        "z0 H+.[",
        "P,eXL k.",
        "ech ovlada",
        "io>&7=Y",
        "jD50]B\\Y",
        "J^T@{0",
        ".C@;e",
        "P\\B%E",
        "Verificar a Compatibilidade",
        "HtH UY",
        "z2'sm",
        "s08Zk",
        "talujete t",
        "To:Y7@",
        "}u1 -",
        "KKJ<V",
        "P/]DA",
        "TCI5zR",
        "WX+wA;M",
        "Primjer : setup.exe / auto upgrade / Telemetry enable",
        "6d.SG",
        "_}\\T~",
        " %d%%",
        "6'ouO!o?!",
        "?2[{/0",
        "B/'XN",
        "Cleanup was successful.",
        "kKe|{z",
        "m Q@24",
        "itie na z",
        "}Lc/b",
        "GaayE;",
        "Y=7{y",
        "%F@B$$",
        "T.mE#$^'",
        "Anahtar: / DynamicUpdate <parametre> ",
        "m1nbY",
        "q;vgt",
        "q>-#J ^",
        ":JDG JU:'",
        ".FY{q#<I",
        "q2Sp.2Q",
        "9,:S:",
        "rb4\\~",
        "GC->+",
        "%1!s!",
        "B)&ss",
        "=MblV",
        "F~J')n",
        "CDlpTask::GetTransferProgress",
        ";UrLT",
        "{y4i ",
        "8Z'x|",
        "3?YB3",
        "G=**!",
        "/MF?i}",
        "cZD>&(",
        "seau vers un fichier .wim sp",
        "rj;-U",
        "#^OwNt",
        "3$Jt2",
        "ke Full, a felhaszn",
        "LGS6kq",
        "Qm[?;",
        "?:\\$Windows.~LS\\Sources\\",
        "c-V(#/D",
        "TYobU",
        ">v&6!g}",
        "ru bir ",
        "+evWFu",
        "9\\2^9",
        "k!E'U9",
        "NRW}=",
        "Start p",
        "#a(Yr\\",
        "864p6v",
        "$rH\\0",
        "a^5]^",
        "8!8\\8",
        "s palai",
        "ilerleme durumu",
        "b@:&,(l",
        "u{\\fKy",
        "sma-SE",
        "Biztosan kil",
        "&eMQr|",
        ":Q8Y-",
        "pgrN~",
        "vvJ,E",
        "TKfUG",
        "q$mkT",
        "ter> ",
        "LR4-Z",
        "Windows Setup kann aufgrund fehlender Installationsdateien nicht gestartet werden. Wenn Sie Setup bereits von einem lokalen Verzeichnis aus gestartet haben, kopieren Sie alle Installationsdateien erneut in das Verzeichnis, und starten Sie Setup erneut.",
        "Failed to clean installation drive [%c]: [0x%X]",
        ")4{wD",
        "rVGYE",
        "R{t5w",
        "VYR>C",
        "9@zOi5",
        "\"$4b %",
        ",!`+I0A",
        "Z`1jh",
        "Akcja: Okre",
        "#xbGH",
        "ucj(S",
        "1INWm",
        "Failed to remove MoSetup cleanup value, Error: [0x%X]",
        "QR-g?|",
        "eU?'h",
        "&6|Hf",
        "|PaS\\G",
        "fBOUXK",
        ")?K_`[",
        "k`H]]jS",
        "iv)|!",
        "{T(pE",
        " # I6An {",
        "[?+1\"u",
        "536QG(z(",
        "DeleteTaskByName: Error serializing state!  [0x%x]",
        ",&bG@G8",
        "0&FS,>v",
        "_*.3D",
        "Launching process: [%s] with command-line [%s] in Session: [%d]",
        ",,xm\"",
        "C\"IKgY",
        "Parametry: brak ",
        "*[w9c",
        "HeG7Zj",
        "<Tca1tg",
        "5&gq\\",
        "hhi>}x",
        "6@EcU",
        "sek keres",
        "aR59f|",
        "o foi iniciada corretamente. Reinicie o PC e tente executar novamente a Configura",
        "?F3k%",
        "installation de Windows ne peut pas ",
        "hA1PF",
        "suprimir",
        "aduje len vtedy, ke",
        "84+*e",
        "Z1i7e",
        "3t_rc",
        "-lQ]NQ]",
        "Failed to get [%s] directory Hard Reserve status: [0x%X]...",
        " wird Windows installiert oder aktualisiert. Mithilfe der folgenden Befehlszeilenargumente kann das Verhalten der Windows-Installation ge",
        "g<t;y=",
        "6ZZ+**",
        "ad: setup.exe / auto upgrade / installdrivers c : \\mojeUaktualnienie\\sterowniki",
        "yg%Q=",
        ">*yS3",
        "w73d~7",
        "=`{R&",
        " ;8'5",
        "K'}*U",
        "\\]U~EY",
        "K(`Zd",
        "cm4t5",
        "Switch: / copylogs <locatie> ",
        "{vo,e",
        "s3R<R",
        "<w/k^S",
        "IDREFS",
        "8C8]8j8",
        "PMFQQ",
        "}<.J-",
        "e}1Y]l!$",
        "]%w4$m3",
        "OQ]_>/s",
        "G.Z{_",
        "iu-Cans",
        ".gfids",
        "j-2zn",
        "w`.Z?",
        " _j.<Y",
        "~y+> o",
        "sr-Cyrl-ME",
        "By4P!+",
        ">3?b?|?",
        "t~d$?",
        "bW%n#",
        "Y)`-H",
        "]jM3*/q",
        "J;2{t",
        "udvatesse asukohtadesse kopeerimise ",
        "m{qoI",
        "tor z lok",
        "6\"uvs",
        "0Y0y0f0?ceQW0~0Y0",
        "x JAW",
        "o]Kue(",
        "5`\"UN1",
        ":rI-4",
        "!>!9>",
        "ky a ",
        "en-BZ",
        "dv[W)|",
        "ti paleista, kol veikia kitas s",
        "Hhd\\jd+5",
        "x(tf`",
        "47DgctDRc",
        "c<~a)R",
        "(G0.G",
        " poate fi utilizat",
        "NMTOKEN",
        "tor zhroma",
        "&3bR[N",
        "wWrfIOR",
        "Kl b0",
        "_1YWeBf",
        " Windows XP Service Pack 3",
        "fvI5y",
        "inku obsahuje s",
        "`2p.}",
        "8~7Oi",
        "RNlAk",
        "A`<CD",
        "Na primer: setup.exe / auto upgrade / installdrivers c : \\mojaNadogradnja\\upravlja",
        "/&5rF<",
        "vi mekl",
        "qbfwg",
        "> x6H",
        "[_]+L",
        "#pcM/z`",
        "cqY\"h",
        "Tqo5N",
        "iPQj+",
        ":$:4:Q:",
        "o&ka|",
        "RKOV=",
        "-,>Z[",
        "|@}D3b",
        "<-wY3",
        " %1!s! ",
        "28`EFl'4",
        " apspied",
        "I0hF]",
        "\\DVE#9H^B",
        "V]?1c",
        "*|sje",
        "D~m6x~",
        "echny instala",
        ";2) ]1<",
        "Ol:4J",
        "ra, znova skop",
        "9t$ t",
        "Bgv>`",
        "'X:fm",
        ".t~9|M",
        "N<9wv",
        "ur:XpO",
        "unara kada se dovr",
        "g<!qI",
        " Full, ",
        ".SMBQ",
        "__dllonexit",
        "v=;wBwb",
        "1c.4dL",
        "bas patur",
        "tl~R\"",
        "XkyW<",
        "e, vytvo",
        "Nuwu59",
        "sB3XI;;",
        "XC-i0",
        "mu um",
        "fzX[o",
        "$$~ecH",
        "klemenin par",
        "&p`](",
        "\"aA_5",
        "@}N*D",
        ".y!ucvxm",
        "nr%S[",
        "5_YN1c",
        "?|9?Dny@=",
        "_,@J*",
        "}[]g6w",
        " Setup.exe ",
        "z?/a^",
        "#aNn/",
        "uHq^kk9",
        "iq}|l",
        "o96=D]",
        "#y(oc",
        "`gkT)",
        "iune de migrare. Se afi",
        "spV$/",
        "tHcTdH",
        "4bX2T",
        "KJ*dg",
        "`lRv;v",
        "#]?dq0",
        "vNU4]",
        "cessitant une saisie utilisateur uniquement une fois que l",
        "!b0tL",
        "1jjl@",
        "y?Ur*V+",
        ".giats",
        "Li]6F",
        "E&dasi",
        "j1s~eW",
        "J9;b.",
        "ZMU`p",
        "<tWL_",
        " PBR. ",
        "e4?-BK",
        "!G!^i",
        "23({FI",
        "F5CM2",
        "|CH*X",
        "YLZYR",
        ")qlJ/",
        "/D3wK",
        "J;e Nq",
        "}\\2uE",
        "i in komponente se nastavijo na privzete nastavitve. ",
        ">*Ju%",
        "tu papildinform",
        "installation. ",
        "oiNM~",
        "G,|+f",
        "ke None, nem telep",
        "N?:JU",
        "IbZnF\"",
        "[o?\\y!",
        "z{}6>z",
        "i u257",
        "Phd(A",
        "f3-o13",
        "Dzz='",
        "1*/=]",
        "n7{k^lS",
        "Ng<8Bp",
        "I*7)6",
        "rOXcXM:",
        ": 'oB5w",
        "l,K`S",
        "zrLS3",
        "1(2S2",
        "nSetupDUUpdateFiles",
        "$@[~:",
        " bez wy",
        "e!Q,b)+",
        "R iXMp)",
        ")')^N",
        "Z%F:Z",
        "CWebScenarioCtrl::Initialize",
        "Parametere: Lokal bane eller en UNC-nettverksbane til en fil med navnet setupcomplete.cmd",
        "U\\11/",
        "Asennus vaikuttaa tapahtuvan verkkosijainnista, ja on saattanut tapahtua satunnainen verkkoyhteyden katkeaminen. Yrit",
        ": / migratealldrivers <parametr> ",
        "cwI&g",
        ")uOuR",
        "chte ein Bereitstellungstechniker im Falle eines Fehlers aber auch Protokoll- und andere Diagnosedaten von Test-PCs sammeln. Mithilfe der folgenden Befehlszeile wird Setup angewiesen, nach einem Installationsfehler das Skript ",
        "ptT6i",
        "JWK7H",
        "6U_.22k",
        "*%RB.",
        "Nwu-{`%=A",
        ",#6dJ",
        "oUb=],",
        "E)MFe",
        "^]o(8",
        "\\5e&T",
        "G72s4",
        "_oE<1",
        "n. Cierra la herramienta, reinicia el equipo y, luego, intenta ejecutar la herramienta de nuevo.}Necesitamos al menos 350 MB de espacio para ejecutar el programa de instalaci",
        "'!#Vh",
        "unara u slu",
        "k:Hr|",
        "=b 0jSq-",
        "/Update",
        "#EhkY4",
        "Zj%`j^",
        "k`VVl",
        "Attempting to move working path...",
        "}R*DY:D",
        "}@kLi",
        "cJ}c?",
        "q?*+m_'",
        "=mc[S*",
        "*yImh",
        ": / DynamicUpdate <param",
        "e se sa sistemskim privilegijama. ",
        " szakember szeretne napl",
        "mpB0}(",
        "20C0H0N0",
        "l?hGt0s",
        "gw'd kfbf1B",
        "DfxpO",
        "A=BNT",
        "^>pn^",
        "s}(y{)",
        "etky podprie",
        "oMT;<)",
        "n~03Z",
        "[Tz;.",
        "|%[K)%",
        "U:=`t",
        "50gd1M",
        "U!shTb",
        "Y2{#z",
        "Copying file: [%s] -> [%s]...",
        "Primjer : setup.exe / auto upgrade / PBRupdate disable",
        "al5Xm",
        "exploitation. La prochaine fois que l",
        "<])$>",
        "k+M\"'w",
        "B! \\!T",
        "ti teis",
        "w.7U7",
        "Wd{+c",
        "tzmF;Z",
        "1?3\\W",
        "rF;qN",
        "_Hk_Z",
        "}Ej,h",
        "H6)~~",
        "\"3iC<N",
        "yorsa, arac",
        "qj+'>D",
        "U4([G",
        "{79?i;\\",
        "~?3y K",
        "Y|!2`",
        "m!|'W",
        "Y*FYt",
        "Y.];<",
        "e au programme d",
        "%qbjvm",
        "QAmWm",
        "ranka atliks dinaminio naujinimo operacijas (ie",
        "D9'B]x'6",
        "`P=_hg",
        "W+vz4",
        "Q(m\\:",
        " nouveau et assurez-vous d",
        "PhX*A",
        "USER32.dll",
        ")9KE%",
        ">\\WjYU\\",
        "QSVWj",
        "ba: Ja / PBRUpdate ir iestat",
        "15*&D",
        "unalniku povrne na prej",
        "-I\\V\"6",
        "v|HnT",
        "[WK%F",
        "4GN[N",
        "%9lWoS",
        ": / Telemetry <parametr> ",
        "{h-kk",
        "[|*l$m",
        "J@I1j",
        "`%8!f",
        "b*}DB",
        ")`iG@7m",
        "Z[J|\\s",
        "B_l+s",
        "pade zlyhania in",
        "ax+>$",
        ",)k\" ",
        "L9+4|",
        "RZ!MM",
        "Teisin",
        "/[_61",
        "Opzione: / copylogs <percorso> ",
        "vJ83:",
        "7$7,747<7D7L7T7\\7d7p7",
        "P;]1&",
        "XGHgfHW",
        ";{N?7A",
        "8yWI^,",
        "xkN:)[uT",
        ",z:M$",
        "!`0-H",
        "FileTimeToSystemTime",
        "^$Hhc",
        "l~cS/3",
        ",\\=_V",
        "WE^Il",
        "=Z11G/d",
        "33g,3'",
        "D. Cm",
        "#x!&8z",
        "=Lut#",
        "F|]+c",
        "The architecture that you",
        "znak quiet potla",
        ".,D=1",
        "<QKhG",
        "cXeOi",
        "GetDriveTypeW",
        "7l82lk6",
        "Destek",
        "vBi!Y",
        "t'+Yg",
        "%oIZ$",
        "gw_?r3&/",
        "z}}M;",
        "smj-NO",
        "2BN+\\wL",
        "o do Windows 10, n",
        "`UEKQ",
        "iJL5KO",
        "%4_BKh",
        "GetDeviceCaps",
        "installer ou de mettre ",
        "^;T=|",
        "qifjR",
        "h7f@M",
        "1ppJg",
        "rYu7^;Z",
        "SPExecuteCleanup: Failure while enumerating folder %s. Error: 0x%08X",
        "l!PVWY ",
        "9&C=B",
        "2bGHcU~",
        "Execute file [%s] exists: [%s]",
        "eAi-'",
        "AY||X",
        ">Z7)Y",
        "cie, kedy sa PC vr",
        ";Ew0j'oL!,",
        "-/rg.",
        "7+#NT.",
        "YS?NJ_^",
        "sJz=KoHH",
        "fuX]V",
        "8 ^(F",
        "ELh@a",
        "HeZf-",
        "Konfigurovat",
        "Microsoft JhengHei UI",
        "CzBKt",
        "b&ZhX\\",
        "UD\"='",
        "Alternatif olarak, bir da",
        "s'b9[V",
        "icM~y",
        "G-$G^9",
        "ACv8r",
        "SiteLink$L",
        "4GJ+:",
        "{&MMZ#=",
        "hZ|7N",
        "JO);{",
        "xNA+S",
        "JHsgA?",
        "O94A ",
        ",(#-\"u\\",
        "%s: Showing Resume mode msg.",
        "tw5}H",
        "#!Nmf",
        "+B*)Z",
        "g*|Y1",
        "'2q<^",
        "Pj2jl",
        "        name=\"wow64win.dll\"",
        " %XGY",
        "[}5RP",
        " =|UC",
        ";[8lR",
        "ky Windows Update v aplikaci Nastaven",
        "8.{\\w?!c'",
        "Wenn Sie diese Version von Windows 10 installieren, k",
        "ben&u",
        "es-CR",
        "ja[H_",
        "6w-VJ",
        "(u7bCgP",
        "r0fGt",
        "\\~S^N6",
        "g)cl&",
        "A/Q%OO",
        "n con opci",
        " program nem",
        "pP8&T",
        "Unloading hive at %s\\%s",
        "WM6v9",
        "o dos suportes de dados da instala",
        "Windows Setup cannot start due to missing installation files. If you previously launched Setup from a local directory, copy all the installation files to the directory again and relaunch Setup.",
        "sr-Latn-RS",
        " atra",
        "-P,{x",
        "versement, OOBE sera ignor",
        ";m8~a?",
        "h(hch",
        "|fpMa?",
        "ob5c(k",
        "ivitage k",
        "T$@j[P",
        "n automatizadas. Este conmutador tambi",
        " / migratealldrivers ",
        "tV:'1",
        "|#+=O",
        "y6h)4/G",
        "3n=2vn$",
        "NpE\"nC",
        "\\x]c&",
        "TU$P5j",
        "L+|[VNn",
        "CSimpleWizard",
        "F\"Z}\\V",
        "Conmutador: / pkey <clave de producto> ",
        "@//3h",
        "P^d\"V",
        "fuz*X",
        "l,/SY",
        " definido como All, o programa de configura",
        " x<Od",
        "6p{x'",
        ")$\"u+*",
        "Preparando el programa de instalaci",
        "lp>LD",
        "R#<=8",
        "?-5Q6",
        "Xfm\"o",
        "H(9?2",
        " tietokoneella ja/tai k",
        "g>&7{",
        "' G+A",
        "}KX>h",
        "\\j8W4",
        "7tP0?",
        "bin4~-X,",
        " M3)O",
        "sFD'm",
        "4r7YV",
        "[U\"x/>s",
        ">+?2?",
        "\\{@qi",
        "Vr\\s*",
        "wdTW=",
        "s|W/W",
        "W&2GR&2^k",
        "Ro#x_5",
        " versiota. Yrit",
        "TI&ok",
        " program shrom",
        "4MN!8^X",
        "installation ait ",
        "RQ^6,",
        "-Vf&6",
        "|_'vmM",
        "4 /t;vkI",
        ". Instalace bude pokra",
        ", namestitveni program ne bele",
        "Se-5t",
        "5S`Gk",
        "l(%KS+A7",
        "_Sozn",
        "Handling: Angiver placeringen af installationskildemedierne / files ",
        "z0/R|",
        "\\cUZc",
        "Fwu%f",
        "*5Ln~l",
        "X%mu](",
        "l#rr3",
        "#yylI",
        "/p8m%",
        "9#939H9`9",
        "  Diager.dll",
        "P~r(<",
        "da ne",
        "|zvY\\Z",
        "vwwk>",
        "%Fj@SJ",
        "ite: %1!s!",
        "Jtr{.",
        "(II1*",
        "^gJ}l",
        "/PSpE",
        ")1_2I",
        ":Y4l#",
        "6<6W6r6",
        "8as~i",
        "26^dCK",
        "@c~d$",
        "#S5DO-xY",
        ")Ck'd",
        "26a%7<",
        "5\"5/-m",
        " aktualizace funkc",
        "[BIk-z",
        "Sagatavo",
        "*^I:J",
        "4G:\\C",
        "Parameter: / installfrom <placering> ",
        "u/vC}",
        "T')4e:I,",
        "NcptxU",
        "e+peIL",
        "'2T${",
        "{I`+[=",
        "be5SV3E",
        "rja om fr",
        ",{/QE",
        "P=}VO",
        "[5**=",
        ".b[[$",
        "e2.k\"",
        "n!y\";",
        "Lg%XU",
        "odsMj",
        "la lokalizacj",
        "XFu*r]",
        "\\6P6bO*",
        "!Y^L8o",
        "{ir'z",
        "}5/By",
        "02n~gyXt",
        "7n%[C'",
        " um script personalizado que realiza tarefas ap",
        "\"$&4D@[",
        " _Gva",
        "n;.i-C",
        ">h>Oq",
        "enir morda ",
        "dGnt$*B",
        "X`.13",
        "a8Fq3",
        "eK4j&",
        "6GVXc",
        "Azione: il contrassegno quiet consente di escludere qualsiasi interazione con l'utente durante l'installazione, inclusa l'esperienza utente per il ripristino dello stato precedente ",
        "9;MIG",
        "State",
        "?i[[\\",
        " komento suoritetaan j",
        "Idev]",
        "S(_^[",
        "\"466w",
        "c6/F/",
        "h>^Z,m",
        "a4d5G",
        ".sTato verze syst",
        " [-l@",
        "!a`Cd",
        ",:Yl0f",
        " festgelegt ist, wird die PBR-Partition durch Setup aktualisiert oder erstellt. Wenn ",
        "MGjDM^Q",
        "y-4VH)",
        "n, bilgisayar",
        "eC&=w",
        ":@;n;",
        "JKcK+h",
        "z^@|:",
        ")0.!-",
        "1;2w2",
        "sureaargumente. K",
        "6z}`8",
        "Hv)OLZ",
        ":h\"v{",
        "ver brugertilladelser ",
        " setuprollback.cmd-tiedoston m",
        "H.3Tf",
        "|MK/0",
        "YWy-Xju",
        "Ojc<\"F6",
        "o : Quando / PBRUpdate ",
        "}*a@3",
        "m, ka instal",
        "2J3Q3l3",
        "ZPDx`",
        ".?AVCGdiObject@@",
        "J2B6h",
        "K;l@o",
        "r\\8Dt",
        "Setup.exe nain",
        "Windows s",
        "czv%y",
        "Deleting folder [%s] before expansion...",
        "WSNGu",
        "nceput",
        "rd: Aktiverar filen setuprollback.cmd fr",
        "nR~~#",
        "<Rg_d'",
        "+qTY0+",
        "`5;$h\\",
        "`\"eSqW",
        "B+a\\D",
        "+4K-t",
        "'vu?&",
        ">Bfa~3^j",
        "2GH=u",
        "`NVal",
        "Waiting for transfer thread to exit.",
        "nek a megadott term",
        "Uk(5q",
        ": / installdrivers <umiestnenie> ",
        "kalu uudelleen.]Asennuksen suorittamiseen tarvitaan v",
        "RPQ`tTQ~",
        "ger f",
        "$tWT@_d",
        "^\\.mB",
        "U<Z5v",
        "WigA=",
        "miA1Ji",
        " ni cargar",
        "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4",
        "CPuA9j",
        "ch s instalac",
        "mhrK*",
        "1$1,181X1`1h1p1x1",
        "=hyn/",
        "I~RRji",
        "a@?2}5",
        "-{Xa4+",
        "o4\")Md2",
        "[(]+4",
        "}\\aLIW",
        "%HY4S\"",
        "L:+P&",
        "O>qMd6",
        "GC,}4",
        "n kielt",
        "z_]]9",
        "u^ohz",
        "eJ_R^o<I}P",
        "XpT0|@",
        "*Zw-N",
        "~_w7X",
        "^GKI\"",
        "*m#2}N",
        "0FdI3",
        "4m?ua",
        ":N >r",
        "lretbP",
        "xT$W)",
        "             />",
        " pirmas vartotojas. Jis turi sistemos teises. ",
        " la collecte ni au chargement de la t",
        "_J/36",
        "SVWPj",
        "28n|)9#",
        " grund af manglende installationsfiler. Hvis du tidligere har startet installationsprogrammet fra en lokal mappe, skal du kopiere alle installationsfilerne til mappen igen og genstarte installationen.",
        "xmlns",
        "Parametri: f",
        "uV\\V#",
        ">h?o?",
        "_`,_,",
        "tJ}ui",
        "`3Ih_",
        "@jh>jm",
        "o corresponde ",
        "UC';aB`y",
        "YmW=kI",
        "V'{C2",
        "7QqI$",
        "4.nX.",
        "~E;`W",
        "V\"LKd",
        "-NJ!u",
        "t&SF)",
        "I(%eo",
        "Y2])6",
        "A\"ick>z",
        "qTK-[",
        "4/4V4g4w4",
        "-mEb@",
        "S$Ad9",
        "~e8MX,",
        "()/MsU",
        "fj'J2",
        "y1VH&",
        "k](%M*",
        ">$>*>J>",
        "m|ozmd",
        "zA$RNt",
        "k%Exc",
        "Prebacivanje: / DynamicUpdate <parametar> ",
        "CVpwg",
        "g.qw'",
        "Ch^sc4C&Z",
        "cution de la Configuration. Fermez l",
        "Toiminto: antaa asennusohjelmalle m",
        "*]Ya5",
        "Anahtar: / noreboot ",
        "DIXWbl",
        "QZ'{4",
        "-byX,zN",
        "pI\"g\\",
        "ie diagnostick",
        "t1VPQ",
        "9[V'(",
        "rIlB`zb",
        "g(w1la",
        "s6~ 4",
        "'.%_]\"",
        ":ort_",
        "lonej lokalizacji. Plik Setuprolback.cmd to dostosowany skrypt pozwalaj",
        "        Specifically load these DLLs from the specified path. This",
        "/?ur'1m}",
        "a4.MH",
        "ckpTU",
        "!KIkx",
        "t1Dt4",
        "{2-rI&",
        "mn-Mong-CN",
        "[zVJ_;",
        ";9r;4zG",
        "@n;?b@",
        "sGr<T?",
        "g!uR0",
        "PT sl",
        "cc!%T",
        "5,4|f",
        "Parametri : nisu dostupni ",
        "t)}A't",
        "__o36",
        "Perjungimas: / showoobe <parametras> ",
        "lM(S|d",
        "?j>vb|",
        "9T6N'SD",
        "!(paEL4",
        "i(&a(#",
        "x PqB",
        "82 rX",
        "KVLVW",
        ";+><>A>G>z?",
        "SRd+@",
        "NKhH1",
        "o[l>{H",
        "nW:pwA",
        "\\[K[q",
        "#Ue$&",
        "_!M]?",
        "#)l=[",
        "6RhK{nO",
        "K6h7NN",
        "Opening Box container: [%d]...",
        "|FMkX",
        ",4a`U",
        "zca s",
        " asennusohjelma uudestaan.",
        "3Mol;",
        "+_lY%",
        "45gQXs",
        "NP.$dP",
        "vQVsa=",
        "Ii+X@R3",
        "EXcET",
        "k}(CO",
        "Cm$+I",
        "aujai un t",
        "EwBTe|",
        "0\\r@7",
        "\\P$HO",
        ".uO)I",
        "ClO\"n1",
        "AkN]z",
        "#ejy|",
        "u:%6G",
        "qhF7%",
        "d^WO2L",
        "OMQlK",
        "1$>G|l",
        "anas programma atjaunin",
        "mk-MK",
        "JZQV,",
        "D3m(u",
        "cwW$&",
        "8CKQs",
        "Zre\"`v",
        "EE\"r>,+",
        "8|bl, ",
        "8,838",
        "9R9~9",
        "4\"bC1",
        ".CRT$XLA",
        "|r1f[N",
        "e instalacija izvr",
        "E#r9 4",
        " upgrade na Windows vNext. Vstup u",
        "59Coh",
        "$J8Mq",
        "GP(6K",
        "19bBG",
        "|_UAg",
        "mi-NZ",
        "jTMd8g",
        ":13-U*",
        "`:e9*",
        "1Kurulum kullan",
        "$tI6b",
        "ller datorn till f",
        ">A_DF",
        "3P4j4",
        ";mOC+??",
        ">T|#=",
        ":P:a:{:",
        "7z^/_",
        "]\"&:/",
        "2Bn '",
        "Vf1j\\",
        "c1F5$K",
        "-5GxV",
        "lo-LA",
        "x.jWR8",
        "3a|! ",
        "k]yZ_~6",
        "29K>LE`",
        "q!AtJ",
        "w\".$8",
        "rience utilisateur d",
        "v1Gr~r",
        "E.Dp-",
        "+{?>=",
        "qElnt",
        "%,(xdT",
        "RS7ODM]-",
        "?Vr5kS",
        "f^mN,;c",
        ",in9w7",
        "Windows9Instalarea nu poate determina limba interfe",
        "ana notiek no t",
        ">Z>9c",
        ":Ri~P",
        "JId&1",
        "ZTy~H;",
        "XN:Iri",
        "Comutator: / Postoobe <loca",
        "z<^?o~",
        "&}=Se",
        "4O;WD",
        "i'jkk",
        "c_nY_",
        "z&~/v",
        " }HV7q",
        "&j{#s`b>",
        "Commutateur : / PBRUpdate <param",
        "d25F~",
        "x2`yw",
        "bBzN-",
        "W Mk8#<>",
        "7FD'8",
        "Akcija : instalacijski ",
        "zs{|2 ",
        "9_5H}",
        "^vDtX",
        "trie relative ",
        "metros : Caminhos para pastas locais ou de rede ",
        "L$D_^[3",
        "~gBV,i",
        "]M[v~",
        "h^N``",
        "SetThreadPreferredUILanguages",
        "Fertig &stellen",
        "2(323w3~3",
        "97e0F",
        "bY:bp",
        "]EW4G",
        "+hqU:",
        "p=Mt.b",
        "I*;xm",
        ")|?.{",
        "Exemplu: setup.exe / auto upgrade / PBRupdate disable",
        " ?2@f",
        "b:4/x",
        "iei specificate. ",
        "llni a kor",
        "b|J1>",
        "u+,Ku",
        "pWl0w",
        "Zln3@.",
        "7).&8",
        "i selectat-o nu corespunde PC-ului dvs.",
        "vjJ}*M",
        "$7h7B",
        "1\"VL^i7",
        "NOmAt",
        "L`OPWA",
        "vg:Ls",
        "\\cz_=",
        "i}t#]:",
        "lckjPp",
        "O00{M",
        "Y`..,",
        "_JpBt",
        "*011!",
        "(+5xq",
        "klad pou",
        "}~<J=,=QJ",
        "0H+W(",
        "Waiting for prepare thread to exit.",
        "''+-z",
        "}q5Q#",
        "G@gS~",
        "V4f\\.",
        "\"9_%T",
        "!xS\"NA\\",
        "0&xEF",
        "&eHYR",
        "nda belirtilen konumda bulunan t",
        ".6fA$",
        ">-9v~",
        "tQ>SF",
        ")$&M!",
        "Comutator: / auto <op",
        "        name=\"uxtheme.dll\"",
        "\\_k(%",
        "Y*1lX",
        "lohy opera",
        "s diagnosztikai adatokat gy",
        " Service Pack 3)",
        "Lz'F\\ygq",
        "~F0b|k1@",
        "Eg#Zp",
        "An1as",
        "xB)[d*g",
        "ly=Y^",
        "fW -?",
        "7E]3h",
        ": / Postrollback <",
        "Ax8l[",
        ">v0}L",
        "wcC;f",
        "$Y[A6",
        "Opzione: / Telemetry <parametro> ",
        "reTT`_5",
        "r3y$t",
        "local especificado. Setuprolback.cmd ",
        "dpEQV]6",
        "|oIi4",
        "=w!y8",
        "fr-CA",
        "Lu-=t",
        "Example : setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "20201009142756Z0t0:",
        "a==<L",
        "H3*\"#",
        "2F}pT[",
        "R|iQ>",
        "Z9I.>",
        "ctiRs",
        " <M#g",
        "W0~0Y0K0",
        "g]qD2u#|X.A",
        "installation s",
        "f&%zpWm",
        "q)_^s",
        "csqnf",
        "`wQjr",
        "Wcq]}",
        "i;=bs",
        "]-O#FX[L",
        "=nMPr",
        "[oqRi",
        "o injeta todos os driver.inf encontrados no local especificado durante o processo de instala",
        "cijas failu. Ja iepriek",
        " rozhran",
        "etakse vahele, PBR v",
        "jusios ",
        "qe '*",
        "ivitamisel. ",
        "qUiK4",
        "6J7^7i7",
        "=TA?>",
        ",45zF",
        "n^`~`<",
        "~Gr.C",
        "\\nCY8",
        "$2'p@",
        "q'J/Z<",
        " OOBE).",
        "<>IZh",
        "lwu3S",
        "`IO(K",
        "s9zEz",
        "75wRW",
        "7Y'MCT",
        " scenarijus, vykdomas, jei nepavyksta ",
        "Wh@RA",
        "Pavyzdys: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "ivitage arvuti ja proovige t",
        "(&N)4Setup.exe ",
        "696@6F6K6X6d6",
        "'7=>t",
        "`6-&)",
        "cijas: EULA l",
        "(Cz!K~%&z",
        "u medijuma sa koli",
        "DosDateTimeToFileTime",
        ">S5dE",
        "_+7=4",
        "CDlpManager::CreateDlpFile",
        "[xjc2",
        "Global\\Microsoft.Windows.Setup.Cleanup",
        "jraind",
        "ndan g",
        " i(oK",
        "\\(gq-",
        "7Q cM",
        "\"QO-N",
        "j]D>5w|S",
        " qui permet d",
        "Rqyp8",
        "T$MIo2",
        "gC9C(Hi",
        "Akce: Vlo",
        "GARTT",
        "\"#|Df",
        "t\"GzJ",
        "5G%)}",
        "terminer la langue de l",
        "`Mt3H",
        "x.#'O",
        "imi> ",
        "sMnqu",
        "Y7'f}",
        "File [%s] is newer than [%s]",
        "MS UI Gothic",
        "tx'x<",
        "Z1[+M",
        "-P<{k",
        "6Q'%AIT&+",
        "171_1w1",
        "X=FzN\".",
        "<lD}$",
        "7|pWu7",
        "G4h5e",
        "%Jzde",
        "|b^rEb#",
        "zf>7r",
        "sw1{_",
        " w katalogu g",
        "}KoA@A",
        "x<P`C",
        "zAp[n",
        ";GbTr",
        "=jwZ~Zh?Sz",
        "yla kurulum sa",
        "&G=Rw9",
        "3mu:tu",
        "AgjrN",
        "~j-wu",
        "XWew9",
        "!F't]",
        "od^sb_",
        "mk+N7",
        "OpmCmB",
        "YaYgR\"",
        "wop{8",
        "a9t\\.GC",
        "?;8JLd*",
        "U|K1\\t",
        "*/'1E",
        "102A2F2L2",
        "nea de comandos se puede usar para coordinar la actualizaci",
        "n completa a Windows vNext y solo requiere que el usuario intervenga una sola vez cuando el equipo alcance el OOBE : ",
        "BU2vl",
        "'3e}$",
        "2(_DJ",
        "kC39\\",
        "k#9gK",
        "{w9&'",
        "installation avec l",
        "KmG};",
        "zzB[O'",
        "L.8}Rt",
        "[ubcRH",
        "<a m.",
        "Hva${",
        "oNp9aM",
        "QuW(J=",
        "fix4j",
        ";hM'HU",
        "syL~!",
        "@Tbj]'",
        "cz,T/A",
        "hren Sie das Tool erneut aus, und achten Sie darauf, die richtige Architektur auszuw",
        "S;~a&",
        "0PZO>",
        "k<S1O",
        "sE@A*",
        "T)c$'0X:",
        "UY{|X",
        "Y8%P<",
        ".@8@e",
        "Yy8Aq",
        "Uporabite drug namestitveni disk, na katerem pi",
        "6gc*V",
        "^~mS>",
        "qycq%",
        "*2#m=",
        " fkdw",
        "7#7=7M7b7s7",
        " e-7e",
        "UlA\\Tb",
        "Oc0f0",
        " MS h",
        "dias et les ",
        "<E(ql",
        "rio final dever",
        "LoadImageW",
        "]ap4Q",
        "1F2Sh",
        "3{B/CHz",
        "@~0`T?n",
        "jZW+{&",
        " obsahuje s",
        "/k_=O",
        "89[oe,",
        "S(n+Q",
        "yYy~o",
        "Rechtshinweise",
        "#i6i&",
        "XEb1n",
        " nem ind",
        "ALeMI",
        " a ode",
        "%s: Error storing Box result value, Error = 0x%X",
        "g_uJG",
        "Pripremi",
        "rs: setup.exe / auto upgrade / quiet",
        "TTdc}",
        "s{G|H",
        "g}&Ll",
        "pet a kor",
        "Commutateur : / Postrollback <emplacement> ",
        "s4@==w",
        "xima vez que o PC for reiniciado, o programa de configura",
        "cR)aR",
        "L0+T~0",
        "Few~L",
        "T{7)b7<q",
        "r / PBRUpdate er satt til Enable, oppdaterer eller oppretter  installasjonsprogrammet PBR-partisjonen. Og motsatt, n",
        "q,f84)^",
        "4fOm5",
        "lti a telep",
        "UL63xh",
        "yizpi",
        "%6b<3",
        "U$)1u",
        " osaston tietokoneet Windows 7 Enterprise -k",
        "[P$tay",
        "k;HAH_E",
        "%s: Error flushing volatile registry key, Error = 0x%X",
        "0TX,n",
        "OxXJNF",
        "xel: / pkey <produktnyckel> ",
        ":yj<u",
        "wJMl-N3",
        "?8K>3",
        "Ob[K]",
        ";<'tSh",
        "ci trybu OOBE. Gdy prze",
        "^vDq'",
        "vL 2z",
        "m driver.inf dosyalar",
        "\\VWsiA",
        "* WWc",
        "ok:.+!",
        "GaT9K@",
        "EnumeratePathEx: Unable to get reparse tag for persistent reparse point; GLE = 0x%x",
        "je automatikusan ",
        "j\"+2DMdGr",
        "HcUc\"",
        "Za chwil",
        "nfWY{W",
        "hrt wurde. Es wird mit denselben Berechtigungen wie denen des Benutzers oder Prozesses ausgef",
        "installation va mettre ",
        "@@@   ",
        "lQ=3$",
        "y2'E'`hs",
        "9'9.939=9A9G9`9g9s9y9",
        ":auWB",
        "CDlpTask::CreateDlpFile",
        "zz|v*",
        ";De/]S",
        " g1|]f|",
        "G@9_ t\\",
        "s.U*-}",
        "-;GW;",
        "\\f_E&!",
        "}xTCOr",
        "%f17A",
        "\\'1\"Z=",
        "Gm$DGUY",
        ":u&d6",
        "iswspace",
        "Akce: Instala",
        "O+Ru|",
        "gmd+_",
        "KQ7G&",
        "Wp[z+",
        "u0{qq",
        ":`^5o",
        ".\\1M(",
        "#@IIod",
        "[SJ/{",
        "Hoq7eC",
        " Enable",
        "*$7[i3",
        "s}eKD",
        "@8M<N4Gj[",
        "Z6-'j",
        "n especificada. Setupcomplete.cmd es un script personalizado para realizar tareas despu",
        "pzo+5_u",
        "_I%aH",
        "040804B0",
        "vsP+K%yc",
        "cie, vyjadrenie explicitn",
        "gs0Uh",
        "O(8<=",
        "U$<R6",
        "[`l5-0B1N",
        " versij",
        ")PXp+",
        ">P%ivp;P",
        "1#161=1a1q1",
        "va zo sie",
        "$Y2>Xq",
        "tdn&~",
        "Xu2MC",
        "7n   ",
        " ser ",
        ",@ HwuWUwU",
        "7}1~y",
        "hKxmq",
        "i?Y3g",
        " darbojas Windows 64 bitu izdevums, jums ir j",
        "c_|OJL{",
        "E+/e/",
        "(cNWc",
        ")32nd",
        "ndert werden.",
        "o komandrindu var izmantot, lai vad",
        "\\EN5d",
        "5V9&{",
        "anas programma m",
        "_6Fil]",
        "U>L2J>",
        "#a~Zi",
        "jypWM",
        "4H4O4x4",
        "Azione: se l'opzione / migratealldrivers ",
        "_Mu7.jG",
        "tor nezhroma",
        "Jq`d{",
        "bor pid.txt. ",
        "CA\\h{",
        " verificato un problema durante l'avvio dell'installazione. Chiudi lo strumento, riavvia il PC e quindi riprova a eseguire lo strumento.]Sono necessari almeno 350 MB di spazio per eseguire l'installazione. Libera spazio e riprova.WSe installi questa versione di Windows 10, non potrai tornare a %1!s!. Vuoi continuare?",
        "`(p!y",
        "i prov",
        "C6D,uk",
        "z{'`X",
        ":qk75",
        ". V p",
        " \"System\". ",
        "_yC$Y3",
        "GetDC",
        "?!t|7",
        "S-.PgN",
        "k3LxA",
        "iAnCiZ",
        "}DjV`",
        "        loadFrom=\"%systemroot%\\system32\\bcrypt.dll\"",
        "K;Vk^",
        "SJmR&",
        "Example: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "S2w|;",
        "[(*C[",
        "GZ.Qw",
        "D$<Pj",
        "r ett anpassat skript som k",
        "B\\plF",
        "EwCcJ",
        "yDTR/>",
        "-B[gA",
        "'b^r2",
        "HP$)R",
        "qO\\s!v)",
        "H8^C{D",
        "Vf5Y3",
        "Valitsin: / showoobe <parametri> ",
        "i\\&Mj",
        ".iDH5",
        "hsF4d",
        "=pWG6",
        "uy=~'",
        "^\"fJiy",
        "e?m?c",
        "C\"^%\"M",
        "<%=>=X=b={=",
        " uz failu setupcomplete.cmd ",
        "M)v\"g",
        "/be7m",
        "`ypJ*Z",
        "d%Eih",
        "2.Tfd",
        "zP$k #",
        "/h`4q",
        "F@3R2",
        "!b>B[",
        "P})<.",
        "XPQSh",
        "gOw7,",
        "AB,!t?",
        "-y6K~",
        "        loadFrom=\"%systemroot%\\system32\\wintypes.dll\"",
        "t, hogy ind",
        "+m5XPUn",
        "/&(k5",
        "tzm-Latn",
        "8},=1]W",
        "installation ne peut d",
        "j=6O5",
        "4tMQc",
        "L(Jl*",
        "BoxMovePath: No target path found!",
        "1W/[x",
        "hrmXw",
        "oDG*b",
        "M65s~6",
        "y+cb1",
        "l^!ww",
        "lgende standardkonfigurasjoner: godkjenning av lisensavtalen, dynamisk oppdatering er aktivert, godkjenning av innsamling og opplasting av telemetri, OOBE vil bli hoppet over, PBR oppdateres eller opprettes. ",
        "R;JWx",
        "`B0?)X",
        "\"{.ZQ",
        "-b <i",
        "NUELX",
        "d1g[EF",
        "/Eula Defer %s",
        "nda, kurulum devam edecek. ",
        "PuXjg",
        "Valmistele",
        "71&^`",
        "ba: injic",
        "!Y'Mb",
        "$I0y>f",
        " nurodytos vietos. Setupcomplete.cmd yra tinkintas u",
        "4|xcw",
        "g5 `Fo",
        ":@-y&",
        ")LV?8 mc",
        "q{e>;",
        "TGh 4",
        "Ijkjx",
        "o>$:8*\"",
        "8G}iU",
        "#)p%6Q",
        "RegSetKeySecurity",
        "dI)k>",
        "0IMJR",
        "}\"C\\!`3%",
        "X#6&~y",
        "}>(+Z",
        " knGZ\\j",
        "<gq<16",
        "d<>!I-",
        "1G[Q|",
        "8/8@8",
        "X~H (",
        "5'_|EqT2",
        "(ZlZT",
        "installation qui indique %s-bit. Lorsque vous l",
        ".?AVCMoReserveManager@@",
        "WakeAllConditionVariable",
        "WRX]GKQg",
        "9;I}]",
        "s$wOF",
        "<QZZj",
        "kr-i1",
        "jf8bE",
        "6p,rm",
        "M'vzd",
        "0?Q%z,.",
        "Ae$Jp",
        "=aM:6",
        "qx/ny",
        "~uW{?S",
        "\"Fu1*:",
        "Q|lA)[",
        "7%do/}",
        "n,FpP",
        "x]Hu9A*",
        ">T$;J",
        "b1u!r",
        "}HTis.",
        "\\A=H:?",
        "lq1V{",
        "}5!@S",
        "nd se face upgrade cu suportul fizic de licen",
        "v<lYm_Df",
        "r*=nfN",
        "&Terminer",
        "m#aK4",
        "N}1g,",
        "lNF.|",
        "`Cnw?",
        "90k//",
        ":c]-e",
        "Dynamic update detected!  Returning: [0x%X]",
        "x*UOE",
        "rNFA^jR",
        "+NHKn",
        "n!X_v ",
        ")/;2k",
        "Are you sure you want to quit?",
        "IdA$x:",
        "]]n.w",
        ")tX?S",
        "m*}Y7",
        "%xKvp5W",
        "e~k2^",
        "Brf% ",
        "EzFDG]",
        "8`&Gq",
        "#Tem certeza de que deseja encerrar?\"Pronto para instalar o Windows 10?",
        "_XcptFilter",
        "re installationen igen",
        " Microsoft Corporation. Toate drepturile rezervate.",
        "rmarna visas som standard, men ",
        "9'Iv6",
        " failu ce",
        "'Preparando la instalaci",
        "do8U^9y",
        "x ?dh2",
        "GL0e59",
        " : / installfrom <location> ",
        "{\"B\"6y",
        "c instal",
        "FyQo~",
        "HR7a|A",
        "Q[\\+.)=",
        "un acc",
        "l>k.Lw\\R",
        "td5d>",
        "3ZO%oG[S",
        "zjnL vJ",
        "}F:y9{",
        "ew2;,",
        "DlpTask: Skipping action progress reset due to task cancellation request.",
        "$55t@45jn",
        ".TKSXbI",
        "OkXTN",
        "GYa+T",
        "6VEpp",
        "><T7<+",
        "nDYY.",
        "<RXAw~q",
        "+M|77",
        "Z+\\(,",
        "NDU5)",
        " instalar esta vers",
        "yY.`W<",
        "2sNR7",
        "~%c/eJ",
        "n: cuando / migratealldrivers se establece en All, el programa de instalaci",
        "t&$vCA",
        "J`,nE",
        "Segoe UI Symbol",
        "lGcurz",
        "ZE\"(j",
        "x$+F y2",
        "8P8l8",
        "000ppp",
        "ende operativsystemstillst",
        "GWvl>",
        "DwordProperty",
        "ms-MY",
        "4%4F4]4c4",
        "/+v</",
        "[;=Wvv>",
        "ZgNv`Qr",
        "ckkehren. M",
        "#B}aZ",
        "$mXB7",
        "xg-Jv",
        "nsefladen og -statussk",
        "?Uj}w",
        ": Z\"B",
        "WnK[[iK{Q\"",
        "metros: Enable ; Disable ",
        "ene lokacije. ",
        "y\\%#:",
        "klad: setup.exe / auto upgrade / noreboot",
        " do pewnych lokalizacji (takich, kt",
        "tter den, starter Windows 10 Installation automatisk.*Den p",
        "w8im~",
        "_j|WZ",
        "`!fwg",
        "i28w1",
        "*!06'",
        "M4H>5",
        "R1OT*",
        "@>dTA",
        "\\<\\t%<vB",
        "&<lUo",
        "6/>::",
        "Spoofing detected: deleting [%s] -> [%s]",
        "/u |w",
        "7\\Zo_K",
        "^[a`x",
        "zm6MN",
        "^m0Hw",
        "NS7vPc",
        "h}*vH",
        "o(=)9",
        "i din nou instalarea",
        "~.m$k",
        "(W?x=",
        "uW0~0W0_0",
        "U[?vykF",
        "qN;JL",
        "-T~Jo",
        "ga2rm",
        "        name=\"sspicli.dll\"",
        "P=7}V",
        "XdgFpV:",
        "K3pY+",
        "Parametri: Lokalne putanje do datoteka ili putanje UNC mre",
        "]l$qR",
        "AC24b",
        "|Cg\\B",
        "}.t>/",
        "1{*W!",
        "RO\\g0",
        "!PUg@W",
        "&BhSJ",
        "R?!Po",
        "vV<6)",
        "!Qq'-",
        "V3<;_.",
        " @4GQ",
        "-OSs3X",
        "\"?_q(",
        "DlpTask: Adding file: Name = [%s], Source = [%s], Target = [%s]",
        " ou criar",
        "~Tb;'#",
        "}c7y&",
        "ef8j(",
        "-O///",
        "}Uw]I",
        "on<?dP>w",
        "6*D#4",
        "li izpild",
        "45S+q",
        "g8&J<",
        "loh po zlyhan",
        "!S$R_",
        " parcurg",
        "v[eE{",
        " Microsoft Corporation. Alle rechten voorbehouden.",
        "<\"m#y",
        "ceqvb",
        "ritetyn tuoteavaimen. T",
        "Oy@|)",
        "?EX%O",
        " kart",
        "_(}G1",
        "%s: Finalize mode requested, but not in resume mode",
        "pVrD1",
        "^u4ct4",
        "1P1m1",
        "tirir.Setupcomplete.cmd, y",
        " %1!s!. ",
        "e program nakon pogre",
        "@ypX'",
        "Tp5]E",
        "8N.+l",
        "bmlUi#",
        "TbUr\\",
        ";8:of",
        "o : Especifica se o programa de configura",
        "unalnikom",
        "(&N)NSetup.exe",
        "br(7G",
        "|cOxE",
        "F45-9",
        "Opzione: / showoobe <parametro> ",
        "F5$|KA",
        "{UY[od",
        "UpHq*=[",
        "echny podslo",
        "ZEy<)",
        "tB3rJ",
        "_J8dQ",
        "ukrP!",
        "DeletePath: Failed to obliterate [%s] (GLE = 0x%x); retrying...",
        "n tal",
        "tirip ger",
        "bZ4~X",
        "di&N^i",
        "F_jU*W",
        "KI]1jI",
        "F7{ ^",
        " t3L)",
        "auY]<P",
        "3LPMQ%",
        "Wy`)s?",
        "$pm8dI",
        "i lansat anterior configurarea dintr-un director local, copia",
        "rgmine k",
        "wYBzG",
        "z4v^A",
        "tN@.#",
        "Za&ko",
        "n: inserta el archivo setupcomplete.cmd desde la ubicaci",
        "H?gB6U",
        "Exempel: setup.exe / auto upgrade",
        "^?42B`^GE@)q",
        "@V$22",
        "T3716X",
        "i]{[H",
        "&@C9_77D",
        "=D&xl",
        "C ,5D",
        "Cy4;3",
        ")Klhk",
        "-s6Mx",
        "GT%}\\.!/",
        "#IhR\"h",
        ".IiJF",
        "Nl1k?",
        ",6Der",
        "sfZ([-9",
        "0cgm?",
        "~Y@fJF",
        "-&o;+6g",
        "`~r&B",
        "KnqKz",
        "-)tw6/",
        "H:/eK",
        "CDlpRegistrar::GetState",
        "WNl`I9f",
        ",k[`8",
        ".}h?_",
        "+32nx}K",
        "FN+IW",
        "w|,ZY",
        "ay}%W",
        "Transfer: %d%%, Totals: %0.2lfs, Bytes: %0.3lfMB, Rvg: %0.3lf Mbps, Tvg: %0.3lf Mbps",
        "_M?j8",
        "r{m9@",
        "?)}iR",
        "HsiuDBXDDp",
        "O:1ik\"",
        "#PBG*a",
        "iDlLL",
        "gxw<%",
        "d`Ta/:-p",
        "Y$PWZQa",
        ":lFfY!DF",
        "MS!lf",
        "<[(y*",
        "tre pas les autorisations pour copier dans les emplacements qui n",
        "Cj:~E",
        "Pasirengimas",
        "t asennuksen valmistumisen j",
        "G_CV^",
        "B%=Q?",
        "\" )S6636i",
        "Uw1FE^",
        "qYuPVGP0x~x",
        "jKju:",
        "71~x`",
        "1sx'%",
        "9tZ$S",
        "#9M|$",
        "InvalidateRect",
        "\"h3#LT/",
        "NLIvV",
        ":0;B;O;p;",
        "Primjer : setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "?V')i~",
        "Qo4ZaGHZ",
        "h;.$J",
        "(xw*m",
        "K\\@r6",
        "leslaadimine lubatakse, OOBE j",
        "&Loobu",
        "gX=zy",
        "f%Fm_F",
        "TwjKJ",
        "o injetar",
        " pentru a orchestra un upgrade complet la Windows vNext, solicit",
        "\\KWGK{",
        "X;[)s",
        "IjeJa",
        "Action: Set-up will inject all driver.infs found in the specified location during the installation process. Set-up will recursively search through all the subfolders of the specified location. ",
        "S=~qVM",
        ",h*q0C",
        "=C=J=l=s=",
        "pYJGF",
        "1e,Ra",
        "$L~E$",
        "')mC+",
        "rEInstallasjonsprogrammet kan ikke starte en tidligere installasjons",
        "hTyS2",
        "+eRq<FV",
        " .inf, kter",
        "4XPXe",
        ">=K?lt",
        "eM9lT8",
        "{:J\\d<<A)",
        "seau UNC ",
        "Ok7f9",
        "f[Sl%",
        "031:1F1^1f1",
        "~;sb\\",
        "v#W/J",
        "whmm~[",
        "E222Kx",
        "1i1e1",
        "#>RER",
        "Egy rendszergazda egy ",
        "arqrI",
        "x !@c",
        "`uL'gAiE",
        "~OBVb",
        "5BvKB{",
        "g6!.w",
        "z2[I/m?",
        "][<LEX",
        "QcBDeRjjH",
        "9<wsy",
        "cf#m[O",
        "CSetupLangIniLoader::Initialize: Failed to get the language name: index = %d.",
        ")f:H T",
        "Dx4Ai",
        "[mO\\?;_/\\",
        "M{q):{",
        "W_#5_",
        "W[/%T",
        "totta el a Telep",
        "sQ8OY",
        "NL%Ph",
        " nytt.kVi trenger minst 350 MB plass for ",
        ">p3sG",
        "!|$<9}",
        "*\"}TK",
        "2DyG;",
        "huVux4=",
        "$o33a",
        "{.xz*",
        "|7 S/",
        "}]p1]",
        "=vy0t",
        "/o8}c",
        "LuxW>",
        "/AzureHost",
        "j4h?b",
        "\"pOE6x",
        "041804B0",
        "tor syst",
        "`VIy7!",
        "<m+2a",
        "r / Telemetry er angivet til Enable, indsamler og overf",
        "GcJ)h-",
        "-J=$1",
        "v[[u(",
        "uHkL7",
        "\\,#TA",
        "limo pasirinkimu. Laikmenos s",
        "$Dd/1",
        "sM y4pr",
        "][lUWz",
        "=vXeI",
        "glUa\\",
        "O:hUUM:",
        "b6ZC1/",
        "=u:~o*",
        "yFLW}.",
        "pZf8_",
        "4<4[4z4",
        "TP%*\"",
        "Setup.exe installerer eller oppgraderer Windows. F",
        "shcBb",
        "7vRKXY*",
        "`PNq[",
        "\")j27",
        "fY_>[",
        "$ReW3",
        "9'HH+",
        "s>a73;",
        "AH=QS8",
        "qxhOE",
        "W8m m",
        "v6J.[[Q6v ",
        "dia d",
        "Iw%JY",
        "8PXaF)",
        "|G~/7S",
        "CZw3z",
        "             <requestedExecutionLevel",
        ">!+x!",
        "{uj,\"",
        "NOTA: ",
        "$`2X`F",
        "sL9x$",
        "hpXyL",
        "~DUnV",
        "mGgi+",
        "-X?)k",
        "S*Wlz",
        "b 5\\5",
        "KmJ69",
        "7`2CYy",
        "pFu])",
        "GetFileVersionInfoSizeExW",
        "iXoB8",
        "=Den arkitektur, du har valgt, stemmer ikke overens med din pc",
        "D,p'}",
        ";k9]m",
        "zc$Lv{",
        "        loadFrom=\"%systemroot%\\system32\\shcore.dll\"",
        "I^=cA",
        "Taw|i9$",
        "J7$6#",
        "<i:#H",
        "CUpdateScenarioCtrl::PopulateWorkingDir",
        "Jj212",
        "cifie si le programme d",
        "o. O programa de configura",
        "s>pmV",
        "{n]$pa4",
        "nv6;S1",
        "G5x$BD",
        "Hx.GZ",
        "ubqaQQiY",
        "tu pirm",
        "+>k?S!",
        "Ao?`mib",
        ";|ort",
        "q/FYN#",
        "(KD3,",
        "HG0Vz",
        "vY7/`+",
        "kc3;h",
        "+M`Hs",
        ";e%~O}",
        "6vw!f",
        "E5qK-",
        "t)hM?",
        "|:fe\"@",
        "z#ky`",
        "be9O~",
        "eli v primeru neuspele namestitve iz preskusnih ra",
        "%|{|.",
        "Konfigurova",
        "3^66fUzA",
        "m*,q5",
        "c`T'8g",
        "'^\"+|]Z",
        "Hs[5w",
        "fp\"u?L",
        "~Ukja",
        "EiIHUG",
        "hb[?n",
        "dNy5{y",
        "!Xl1X",
        "e s mre",
        "#yLtE",
        "m%9z.",
        "_3}`o3",
        "Parametere: N / A ",
        "i komand",
        "h8PS1N",
        "z?1]'",
        "bz}$[",
        ":xy\\%>",
        ":x.\\G",
        "A2~P,",
        "|O5;xG^W",
        "n: indica si la instalaci",
        "Action : Automatiser l",
        "Resetting rolling average list.",
        ")uU0].",
        "99veU",
        "\"n.g|",
        ";yv]VK",
        "WB-w`",
        "|h@@41",
        "PSSSSSSh ",
        "#(=Yp",
        "\\UvNt",
        "% r/%",
        ";&<B<P<_<j<",
        "vJ8G:V",
        "C1%~y",
        "D)P-n",
        "l|5jg",
        "}EI+5",
        "7O7`7e7k7",
        "|# qz",
        "\\:uD-Gspdw\"",
        "D/1T$f",
        "CQ)Su",
        "(c\\.Ms",
        "zAeX5yh",
        "_>!TE",
        "{CC,b+",
        "dj/}m",
        "-/Ra8H.",
        "ne instalacije. Slede",
        "hren Sie das Tool erneut aus.",
        " ]+u9",
        "\\`Sj)",
        " ignorada e os componentes ser",
        "YN)\\B@",
        "{{w7i",
        "+ymPwJ)S",
        "c%?:5Q",
        "x\"^CT'",
        "_L$A]a",
        "T.P}$",
        "5)<+i",
        ",gPhepO+",
        "i(9Q4",
        "Z_0g.",
        "?\"?*?A?Z?`?",
        ":'<+(",
        "automatisch opnieuw op nadat de taken van het besturingssysteem",
        " 350 ",
        "u90G<",
        "Exemple : setup.exe / auto upgrade / postoobe c: \\script\\setupcomplete.cmd",
        "-s<nD",
        ">\"K[R",
        "Operacijski sistem Microsoft",
        ". Atlaisvinkite ",
        "br%'*VWl",
        "Z}Y^>f",
        "=&=@=T=t=",
        "*>xiHo}_",
        "metro : / Postrollback <localiza",
        "*******SetupHost Logging End*******",
        "ver kun brugerinput, n",
        "NtDuplicateToken",
        ";Oq0a",
        "xtC<u",
        "]ZU'eW",
        "s~g%q",
        "DJLWt",
        "475s5~5",
        "ka do pliku setupcomplete.cmd ",
        "installation va copier ou t",
        "5[Es1",
        "'cM_F",
        "YI?tc",
        "l.FsZ6",
        "RhS,J",
        "@xO+E",
        "/E>.*",
        "U|?>D",
        "cznik / PBRUpdate ma parametr Enable, Instalator zaktualizuje lub utworzy partycj",
        "f$v/q",
        "*s&0O",
        "ad: setup.exe / auto upgrade / Telemetry enable",
        "zAeqc",
        "LWuQK",
        ")y_?tR",
        " datora atk",
        "P;3|~",
        "%N,}5",
        "/<hYH",
        "1Og{,",
        " 09p#",
        "oupO\"",
        "qSz5:*",
        ".d x;",
        "CDlpTask::ExecuteAction",
        "qU?z-*r",
        "&rb#N",
        "$PS1H",
        "Setup.exe installs or upgrades Windows. The following command line arguments can be used to modify the behaviour of Windows installation",
        "CDlpTask::Serialize",
        "wSy{1b",
        "\\<F[>uk",
        "cJO(}",
        "D$0SVW",
        " 8M\",",
        "rifier la compatibilit",
        "VlcHT",
        "^{@*5",
        "K\\hk8",
        "c<QNR",
        "VB7!IH",
        "09gJt",
        "rt/#yK",
        "urnalus ir kit",
        "HiveListEnumerator::UnloadHiveByNtPath",
        "6qAir",
        "4jg}Y*",
        "'`d:N",
        "e{kX<UdV",
        "4~I?Q",
        "pkxx(o",
        " definido como Disable, o programa de configura",
        "*jDn#",
        "Eksempel: setup.exe / auto upgrade / Telemetry enable",
        "r$y(,",
        "*IBsUR",
        "#i]vNK",
        "i spusten",
        "Kompatibilit",
        "3Wy?\\=",
        "'d^QQ86",
        "4/&$.b",
        "HFMq!",
        "Jc71W8O#",
        "@F\"&p",
        "I9U@$",
        "?1$I'",
        "J8]Mt",
        "<T`WC",
        "0~0g0",
        "/6i5P",
        "8w9|9",
        ")hcXa",
        "Uj}\"j",
        "-8PX<",
        "6U4lFR",
        "BD6WH",
        "969T9m9",
        "laaY6>~",
        "uc9W*)g",
        "  SetupHost.exe",
        "-_|o4",
        "vGo{J7",
        "bExct",
        "tcU&Y",
        "Redo att installera Windows 10?sInstallationen g",
        "ekK_v;swA",
        "N6X';",
        "Operativni sistem Microsoft",
        "RhFx-",
        "xO|\"4",
        "*9;x;",
        "'F!GS",
        "!*i.q",
        "3)Flljd",
        " / showoobe nastaven",
        "es e acesso ",
        "OF.b=",
        "7#ngO",
        "CreateProcessW",
        "PW0f0D0~0Y0",
        "2<2R2_2",
        "<VX-Xs",
        "V'k(xA",
        ",0ZBIG",
        ":RA,t",
        "Schalter: / installfrom <Speicherort> ",
        "0avs&a",
        "ayei`",
        "DrawTextW",
        "FKrlr",
        "Bq9/F",
        "z^R\"&8",
        "p}\\?T",
        "9D9WW",
        "4ewNo",
        "n&tL^(",
        "tUzS9",
        "(t`6p",
        "f90CJ",
        "j{:Lj",
        "-S~|B",
        "4!;ed",
        "^9-)[@K",
        "O_/uY\\",
        "~en]t!i<He",
        "7<9j9q9",
        "~JHK.",
        "x:91Y",
        "cC/|E",
        "|p]zH3",
        "LdgqA",
        "oM`q[",
        "9<l<]",
        "R]Nd?",
        "lony klucz produktu do Instalatora. Ten parametr nie jest potrzebny w przypadku uaktualniania przy u",
        "8ngQge",
        "E5EuE",
        "\\g/NR",
        "@@@000@@@",
        "w;=f_",
        "o: quando / migratealldrivers estiver definido como All,",
        "zk[nkz",
        "%VC_.",
        "%61#=9",
        "oYA?Z",
        "dcjxv^P",
        "Ph<K@",
        "Kt9@3s",
        "3sGfh",
        "c&AXK",
        ")9x8:",
        "s+6xbZ",
        " de unde am r",
        ">P|g\\1",
        "cessaire pour ex",
        "\\=|N3",
        "V5Ecxfr",
        "lneho adres",
        ">7{MJn>\\",
        "B&08>",
        "Em.e>",
        "installation tente de migrer tous les pilotes lors de l",
        "<FdHTC",
        "T;z'2",
        "etakse OOBE vahele ja komponentide vaikes",
        "L&=\"HQ",
        "mu Windows 10.",
        "sR/HLJ]",
        "kol8=]",
        "[u6fm,0K",
        "=Gjt{",
        "TgG$I",
        "PBP[v",
        "8@^;,",
        "o`OVDS",
        "Tu`OyT",
        "Conmutador: / PBRUpdate <parameter> ",
        "klade scen",
        "\\j[DNd",
        "~-z+8",
        "SetupDUConsumed",
        "&56wH",
        "OFqZx",
        "SleepConditionVariableSRW",
        "]Q}M+U",
        "ocI(iS",
        " arba naujina jos versij",
        "PUJ;S)[",
        "o8c&w",
        "anas pieredzi:Uzst",
        "mS*uD",
        "yO`B(i",
        "s rendszerrel kapcsolatos feladatok befejez",
        "O7n<?r3",
        "{9bt<",
        " un fichier nomm",
        "<w=:>",
        "Yq;H0dr#i",
        "r}[}]",
        "wY`f'N",
        "hZ<h|6t",
        "lde af fejl. F",
        "ele v fazi uporabni",
        "owAo9_k",
        "?4s[Q",
        "WT'fy",
        "$Ft\"b",
        "m8I}%",
        "CeY$l^",
        "]W]!&d",
        "g? ;b",
        "3:S8[",
        "bL$g\\l",
        "g!bkR",
        "7}:(_G",
        "_+~k=r",
        "f9q%U",
        "PQ\"tT",
        "34H9b3",
        "ru.%Start",
        "res med systemrettigheder. ",
        "996ry",
        "\"=QH.",
        "alo'v",
        "I1x2V",
        "|XW$5",
        ".?AVCBootScenarioCtrl@@",
        "IybqVf",
        "C!u!}",
        "zFpxy",
        "D00RI ",
        "VzF%X",
        "enite orodje.tZa zagon namestitvenega programa potrebujemo vsaj 350 MB prostora. Sprostite nekaj prostora in nato poskusite znova.n",
        "H6}~i",
        "rkssti til en fil med navnet setupcomplete.cmd ",
        ": / Telemetry ",
        "F+PMW",
        "n aikana. H",
        "ynk04",
        "'nJ]r",
        "xx}62",
        "ynnist",
        " de produit sp",
        "hmp=P",
        "9 MY/",
        "].=K@",
        "ar-SY",
        "??Mk.]",
        "5<a3'",
        "zellik g",
        "N!*MCO ",
        "fjbF5",
        "Y::y3",
        "D$`p)@",
        "d~0UQY",
        " nainstalujete tuto verzi Windows 10, nebudete se moct vr",
        "8o`hE",
        ".,?OO",
        " uudelleen.`Jos asennat t",
        "GO'K ",
        "PPP@@@",
        "a|^^8",
        "unKo)",
        "u|J )",
        "\\KqVb$",
        "1*-'/HY",
        "?|o 8",
        "OB:pzpf",
        "O]{}ry",
        "<%<R<",
        "{cPJ@",
        "o pode iniciar a instala",
        "E<f[m4",
        "m+\\I8",
        "(vJCk",
        "24!+o",
        "@jE,N",
        "$8af9Y",
        "R\\PJ`",
        "g under installationen. Installationsprogrammet s",
        "?G^#o",
        "KSKsa",
        "#_Hb5'*Zi",
        "|H(,H",
        "282D2d2",
        "dan y",
        "frBiB",
        "'IRlQ",
        "[%h;+",
        "f~@E2",
        "bnAOG",
        "3zh{ ",
        ")\"^<#",
        "Z>20w",
        "%WcR*J",
        ":blPs",
        "4s\"bWaN",
        "k*}]j",
        "d+9S.",
        "]1]F1UItdE",
        "#Tn! {[",
        "mM!}j",
        "Namesti",
        "j2X9!",
        "|11p\"u7",
        "z alkalmaz",
        ", instalacija ",
        "?ZC%0Q",
        "&F^-H",
        "gu6%o>W}F",
        "285r!",
        "W@9eo",
        "(Ve9,",
        "en-AU",
        "RlG\\U",
        " alap",
        "DnufQr",
        "H<O@k",
        "&Dalej",
        "FindClose",
        "5L/?FL/5",
        "==R^}/<",
        "?Nd3*4",
        "rf{9m3",
        "Commutateur : / Postoobe <emplacement>\\setupcomplete.cmd ",
        "OZ`tx[",
        "zC[m_",
        "$Windows.~WS",
        "La arquitectura seleccionada no coincide con tu PC. Por ejemplo, si tu PC ejecuta la versi",
        "2*#J^",
        " Windows 10\"",
        "i;)vL",
        "D]fEN",
        "JivQs(C~\"",
        " palaida uzst",
        "B<<W!",
        "7n1X\\",
        "ajte ponovo da instalirate",
        "eg}b|",
        "e et que le PC est restaur",
        "x.A*1",
        "43jyb",
        ",\\]N}s",
        "|q.(-",
        "ni od za",
        "4q<nR",
        "hrt werden, nachdem die Installation einen Fehler verursacht hat und f",
        "J!*\"Xb",
        "K{qA)`ZH",
        "g?MY&i",
        "uVK\\5k|j",
        "oPeR1",
        "QvH^W",
        "OC&pib",
        "$6$i5",
        "@@@@@@@@@@@@@@@@@@@@@",
        "s(Q-<+",
        "R^yku",
        "&cO<x>x/l",
        "gG^03",
        "c+`zN",
        "60I>Z",
        "RegValueEnumAction::Enumerate",
        ")Q))Qy",
        "m prihl",
        "*41 9",
        "z_:z5",
        "*XQ+_E",
        "|tGDF",
        "netici gece boyunca, departman bilgisayarlar",
        "Panther\\NewOs",
        "S7}OJ",
        "tres : Upgrade ; DataOnly ; Clean ",
        " : / Telemetry <parameter> ",
        "6h2+s",
        "I2%63A",
        "E~dB}6",
        "ppp@@@@@@@@@@@@@@@",
        ";5F|I8",
        ": / showoobe <parametr> ",
        "XF~q65)",
        "DU={k",
        "o, mas automatizados. Este par",
        ".0PHip",
        "^lm`4",
        "qts@g",
        "S`zWZ",
        "Nastavi tamo gdje sam stao",
        "au moins 350 Mo est n",
        "FaB`~\\",
        ".?AVCDialog@@",
        "Cleaning MoSetup Volatile key...",
        "A#I4,",
        " permettant d",
        "x$kOz",
        "Action : l",
        ")p+sVC",
        "fK[?_",
        "-xe/)",
        "@s=2_",
        "^X+~j",
        "RuFpI8l",
        "uvei. ",
        "9n6c'Rp",
        " |( Q",
        "Luf9k",
        "NnP3I",
        "/Ycq|/",
        ")5qRB",
        "Z3#~L",
        "iune de migrare> ",
        "insko licenciranim medijem ali medijem, ki v mapi z viri vsebuje datoteko pid.txt. ",
        "VeB  ",
        "pg4F|",
        "![1dk$",
        "\":uEP",
        "zca makine OOBE",
        "3W>8yZ6",
        "qb2Y:",
        "Action: Specifies whether set-up will perform Dynamic Update operations(search, download and install updates). ",
        "        <application>",
        "-Vdee",
        "W4nG`",
        "sktoO%",
        "+3F<}&}",
        "it jazyk u",
        "yl,!&fD",
        ":[vug",
        "Indstillinger: Lokal filsti eller UNC-netv",
        "`$m]V0",
        "Bhd\">",
        "^(u-Nl",
        ":nm>1Eh3",
        "D.gzrl9",
        "%#!H4p",
        "PF}~Z",
        "`WwjW",
        "-/#Ej",
        "7,bX$",
        "MNZ\\DZtq",
        "<zAff",
        "Q2Vu@",
        "GQQAh^",
        "B8V)4",
        "lni. Futtassa ",
        "\\&vB9k",
        "_B<+t",
        ")_!/3",
        "J\"'3`\\",
        "Arhitectura pe care a",
        "XO~#4",
        "(ytPhW",
        "\\+H~e",
        "/Q@\\Uve",
        "solja be a telep",
        "/2I%Sr",
        "ratud tootev",
        "nDh}Hh",
        "3hh((",
        "-*Kcj",
        "XBz9[s",
        "B%lW|",
        "Lwo:S7",
        "Juridisk information",
        "PHTke",
        "`ERp+",
        "qhkjA",
        "0tma_r",
        ") MYV6",
        "'EQ>q",
        "~c+@4x*P",
        " Install.exe-tiedostoa",
        "Ey^{+",
        "iere .inf ",
        "xT2)X}",
        ";*+4j",
        "}wkhQ",
        "^JQvHYsp",
        "+~r%l",
        "d%k)j",
        ":*:^:",
        "100706204017Z",
        "cznik / migratealldrivers ma parametr None, ",
        "```@@@",
        "'VK\"$",
        "udNi3",
        "?ekNE",
        "Parametrar: Enable; Disable ",
        "klad: setup.exe / auto upgrade / migratealldrivers none",
        "Ag #m",
        ".s2h\"1",
        "K#CJ\"e",
        "c41Jlfj",
        "/=0&!",
        ",':a8",
        "d9X_V",
        "A*D]J",
        "Gltg$J",
        "nssnittsspr",
        "br-FR",
        "TUScECt/}",
        "FpfEN",
        "0uO|Cmr",
        "V|~0Egk",
        "<9:HW",
        ".#)k'FA",
        "w@mp-",
        "0VA{O",
        "zS{q|",
        ".e5V_",
        ": Full, None ",
        "@1m9:",
        "un bu s",
        ":Q8!'",
        "u&f&.",
        "L!(<(",
        "@9#M+",
        "KnILk",
        "rge. Sulgege t",
        "*p;j4",
        "Td=XG",
        "mo\\he`",
        "4\\7G%",
        "9{?^Y",
        "~l0%1",
        ",';H*",
        "`3PPcF",
        "Z-` D",
        "crans de progression sont affich",
        "tJhHu",
        "me est survenu au d",
        "`nGQ#",
        "installation de Windows 10 n",
        "@=Jwc`",
        "s,y$y:",
        "Prebacivanje: / copylogs <lokacija> ",
        "[t59Ti",
        "Soutien",
        "I(dTr",
        "T~OUov",
        "N`Q-U",
        " Windows ",
        "5OAEf",
        "e se v va",
        "<U<b<",
        "-9Q)y",
        "e]AC=$=-",
        "|rY!!",
        "anje EULA-e, omogu",
        "B('We",
        "]]R%t",
        " scenarijus, kuris vykdomas ",
        " completar de forma interactiva el OOBE. Por el contrario, cuando / showoobe est",
        "Br(I~",
        "nemezsiniz. Devam etmek istiyor musunuz?",
        "xN*)Bm",
        "i UX vra",
        "UWt4+Y",
        "R[QYJ",
        "Le5X=",
        "1'2Z2",
        "u,[/M",
        "6j{IhU",
        "L9JiRl",
        "Nevar start",
        "G6C<G",
        ";!;';;;_;o;u;",
        "BZcmp",
        "*F6=<",
        "CyOwp}o",
        "ivitada kui installiprogrammi ",
        "dWeNr7",
        "!XtCi",
        "@<<M$",
        "PK&@#u",
        "Eksempel: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "0~1xt",
        " c@7k",
        "r et par ting klar",
        "5>6H6S6d6j6s6}6",
        "I]t^`",
        "@LOf]",
        "+@Z/?",
        ",_sL1",
        "^Ro\"'|",
        "m2|7X",
        " durante el proceso de instalaci",
        "Ix3p8",
        "Csx2z",
        "rzt=S",
        "Akcja: Flaga quiet powoduje pomini",
        "ne informacije. S spodnjo ukazno vrstico namestitvenemu programu naro",
        "w+F$jy[a2",
        "VvcTT|4",
        "BBVS&h",
        "`%|qK",
        "DNz'?",
        "t/$_'",
        "Wir ben",
        "03C&`",
        ",2)wg",
        "om1nO",
        "LH+rL",
        "vAZGBc",
        " versija nepalaikoma. Seniausia tinkama versija yra ",
        "syuM[i",
        "m,'ug0",
        "k5@N-",
        "uU.hp9",
        "Commutateur: / installfrom <emplacement>",
        "=Arhitectura pe care a",
        ". Nelietojiet to ra",
        "y?-==o_",
        "Z/or:",
        "#]Ys3V",
        "JsLVxJ",
        "brP`Q",
        "pl-PL",
        ";&OO_K4K",
        "hrj[9sM",
        "J3kHU",
        "fVJDi",
        "A[.6~",
        "<hQPr",
        "^N6yZ[V$",
        "fx@.j",
        "/Ja.u",
        "8W_dV74",
        "DlpTask: Resetting transport progress start time.",
        " <Su\"",
        "ac9*r(",
        "x:){8",
        "1O5>d",
        "Ywu`<",
        "ba: Ja / migratealldrivers ir iestat",
        "B)?/R",
        "]^CFy",
        "5}((7",
        "R~dOf",
        "TH2P5",
        "MulDiv",
        "NON:BNZ",
        "n*V!$",
        "Bir y",
        "I4xW-",
        "1PXrL",
        "e|%:X",
        "yXmAe",
        "Y\\5k1",
        "G\\BF-k[",
        "tsa el ",
        "]wOD?c",
        "`PeP m",
        "zOEp.",
        "88882200..",
        "^xrRU1h",
        ":J0m^",
        "Eksempel: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "Operatsioonis",
        "t|3A+;",
        "CX>a\"",
        "8t7:I",
        ":R,YZ",
        "Qy-l<",
        "#S_3|",
        "tn-ZA",
        ":50g ",
        "WKY.]",
        "Veiksmas: nurodo diegimo ",
        "CDlpFile::SetSourceUrl",
        "=}oN>",
        "m`)b`",
        "K*FP#",
        ":)efT",
        "B?xF8",
        "5XEp_",
        "gT/b0|",
        "PkYy>^",
        "M~wt~",
        "6}6Gb",
        "elite li zaista da odustanete?,Da li ste spremni da instalirate Windows 10?",
        "Da*zT",
        "az-Latn-AZ",
        "ttes ikke. Minimumsversjonen som kreves, er Windows XP med Service Pack 3.",
        "Z(Wfa",
        "tX:*5K",
        "fBZg ~",
        "/7G<b",
        "}#g{U",
        "_z[B|",
        "\\D~bx",
        "  wdsimage.dll",
        "*n\\rj",
        "tXj`W",
        "s:]V.Kn",
        "B9yw G=F",
        "zxVF||",
        "8UUo~",
        "`[zh#",
        "L<,ZIM%w",
        "DeleteFileEx: Spoofing detected deleting [%s] -> [%s]",
        "\\#N?2",
        "NOoQk",
        "bJlt}",
        "CStaticEx",
        "iti OOBE. Ako to ne u",
        "lp_k\"",
        ". Zkuste pros",
        "RX$n5",
        "diegti ir gr",
        "uy&Pz-",
        "L# (l",
        "/Nyp2<",
        "iKie>",
        "9j(E<",
        "+f'0)",
        "W{nH&Mx",
        "^moDB",
        "XNP~5",
        "{}#r_",
        "!+\"f_",
        "^8.wQ",
        " ?W{Dm|",
        "j8X]V",
        "D$LPS",
        ".MCoiS",
        "${mlQ^",
        "Hb9'U,",
        "-aDZ8,x1",
        "*tn*U",
        ">#WY^",
        "MoK^V",
        "E^`)6",
        "vTTTJJ",
        "b4KK%8",
        "e.r::",
        "F]1:OW&jD",
        "l[S-;",
        "CgEi;zNK",
        "wxdo`S",
        "ej#?.",
        "UY%7B",
        "e se spu",
        "kleme hatas",
        "1'1dL",
        "xp:55",
        "F$mAJ",
        "e,wHcM",
        "e je stikalo / Telemetry nastavljeno na ",
        "Pj$^V",
        "'5r[>",
        "9oqj\"",
        "ef8_k",
        "lT&Mw",
        "<Icvr",
        "*JfR!1",
        "r+4;Q",
        "GEnE~",
        "\"w?GN%",
        "K(+Y>w",
        "Bj_h3",
        "!^h*'",
        "Perjungimas: / installdrivers <vieta> ",
        "};S\"GA",
        "a oper",
        "7uSo.Q",
        ";xA~y",
        "\"!e;x",
        "Schalter: / showoobe <Parameter> ",
        "PGFGE",
        "y{Q_\\j",
        "9\"Jl=]",
        "TV9C!",
        "ya6kcE",
        "{g98-K",
        "kpR%N",
        "A&tgal",
        "A*D&K",
        "/Override",
        ")4Uj_",
        "i vratiti na %1!s!. ",
        "YO\"*Q",
        " migrar todos los controladores para que formen parte de la instalaci",
        "m};OX",
        "ppp@@@@@@@@@@@@@@@@@@",
        "Fx_{B",
        "W_IuUD",
        "b'/Hf}",
        "A\"{KO",
        "cg?nF",
        "FHPDy",
        "?ka}p",
        "[=N%X",
        "|J>yI",
        "g\\D>!(",
        "eX,s`o",
        "Rvo3X",
        "0k3:p4",
        "7L}s~",
        "FsgylK-",
        "ro*i&=",
        "*5ENt",
        "Z]=uIGo}m]",
        "NPoku",
        "U)$O8",
        "wC>4K",
        "Wor[II",
        " tai prosessilla on. ",
        "3Aa[.",
        "9<~eX",
        "KYP,:",
        "<JPs7",
        "Langpacks",
        "n haluaa k",
        ":9MeC",
        "vD]d{{",
        "m<C,J",
        "ten for Windows-installasjonen9Instalator nie mo",
        "ki unos samo kada ra",
        "Zy7.5@",
        "Kg%+X",
        "/ReportId",
        "]MP([",
        "#t_W3",
        "[@)3h",
        " potrebbe essere in corso. Passa a Windows Update nell'app Impostazioni per ulteriori informazioni.",
        ">&99Qh",
        "Xy\\A#",
        "rio de raiz do suporte de dados de instala",
        "\\gg.?",
        "9*&sTL^0B",
        "i*8cS",
        "vu^Pz",
        "TY/0lp",
        "TGj#u",
        ":\"Ua>",
        "Oxd8x",
        "Example: setup.exe / auto upgrade / showoobe full",
        "wc?2t",
        "OjbLH",
        "VB/?{",
        " / PBRUpdate nastaven",
        "GetSystemDirectoryW",
        "J'3&Q",
        "VOQZk`=I",
        "YZ3 }",
        "YR6qY",
        "0Xsyu",
        ":Rpn8",
        "E&wC7",
        "/Fe\"=5Sj",
        "L$L9=",
        "/hM>F",
        "\\J<h=",
        "rJUr6i",
        "T`6@&",
        "w1p9b",
        "l/y,h+Rx,U",
        "p4Ho<",
        "([sp3",
        "yzqY.",
        ">)?0?:?j?q?",
        "mm4sU",
        "|-$[Y",
        "1p2z2",
        "\"g%Viu",
        "YKp_gAL",
        "Xg:*t#m",
        "Conmutador: / installdrivers <ubicaci",
        "8CuRI",
        "-y;b;S",
        "jds(=",
        "yb$yJ=",
        "-L?1\\L",
        "P|3ac",
        "(j41z",
        "DeleteTask: Error serializing state!  [0x%x]",
        "+]bFEM",
        "SetSecurityDescriptorControl",
        ",qmW:VT",
        "y~&D!P:Q",
        "t:SSSj",
        "(N6B+",
        "sv+|N",
        "s lango",
        "yn9P%",
        "e, PBR sera mis ",
        ")}tXy7",
        "CreateHardLinkW",
        "3'*0#",
        "N8d|{`3",
        ":Z|ucS",
        ";6;G;N;f;",
        "C,Z#t",
        " se zobraz",
        "in>|6`",
        "V-,2C",
        "`(C)8N",
        "O]e9M'",
        "}50~_",
        "yO7q:",
        "o : Quando / migratealldrivers ",
        "\".&Mdp[",
        "c62[P{_O",
        "zW>6Zq",
        "|<eh/0",
        "-Z`Rv",
        "bvhEDx",
        "9xF)>",
        "b^G{~e;",
        "05+[S",
        ".i^t+",
        "\\QN#To",
        "^O\\U^",
        "?A:Lb+]",
        "MrQ))",
        " Sn0^",
        "Am(zG",
        "a]aX-",
        "\\vI.K",
        "Jz {S^*",
        "Parametreler : Upgrade; DataOnly; Clean ",
        "\"DB wW",
        "Onemogu",
        "A>oz7",
        "Bx.OL",
        "LMUwuUuWwu",
        "_z`\\/*",
        "Installasjonsprogrammet for Windows kan ikke starte p",
        "uk-UA",
        "aBP/Q",
        "gt_XC",
        "F{tTM",
        "%s\\%s\\%s.mui",
        "z~./0wF",
        "\"EC1E",
        "`#c},",
        "g5Vk8",
        "Veiksmas: diegiant s",
        "7<FRv4a",
        "Valmistellaan<Asennus ei voi k",
        "Conversion to NT path failed for %s. Error: 0x%08X",
        "=<T)R",
        "n ei halua m",
        "metros : chave de produto 5x5 ",
        "I~K$=",
        "~(hE-",
        "2M_d5",
        "8!8~8",
        "{LAbPkk",
        "pen a Windows 64 bites verzi",
        "Z)|Ek",
        "EY5%I5",
        "lastage: %1!s!",
        "(#u\"d",
        "-t\"(A",
        "%TtdS",
        "BAj&I",
        "wq7{~",
        "yl.eF",
        "p>K)xY",
        "{,Re?",
        "pI\"5G",
        "j:Yf9H",
        "=Z}5\\",
        "mu Windows nen",
        "g0R&D",
        "ranka automati",
        ": / DynamicUpdate <parameter> ",
        " ignorado e os componentes assumem os seus valores predefinidos. ",
        "K\\>f9",
        "060<0o0v0",
        "~#KB)?",
        "(7ab{",
        "YiU9i",
        "specific.wim",
        "ico sistema Windows 10, se ne boste mogli vrniti nazaj na %1!s!. Ali ",
        "^V*/o",
        "rtuseks on seatud Enabled, v",
        "*=@-\" \"",
        "&<><h",
        "042204B0",
        "nc=>*",
        "RV*6.",
        "ny!T!",
        "Perjungimas: / installfrom <vieta> ",
        "'N2Ve",
        "xs,=c",
        "~| < ",
        "Awy`1",
        "Mv'>{",
        ".?AV?$CUnknownImpl@V?$CUnknownImpl@UIUnknown@@@@@@",
        "^]0n0",
        "!L&d ",
        "o completa para o Windows vNext, necessitando da entrada do usu",
        "ro{SR|C[",
        "BuYGK",
        "ra neatbilst j",
        "GC)Zi4",
        "sLB H",
        " verze Windows, mus",
        "dMyY>",
        "MYL)F",
        "eZS&:z",
        "h &Z;",
        "<e@\"8",
        "o{6ip",
        "{?{md",
        ".xm#h ",
        "Consulta: %1!s!",
        "gots_wim.wim",
        "Cmd+mdx",
        "D;1PL",
        "F}J!%",
        "iu-CA-Latn",
        "D+;#'",
        "Parametri : Full; None ",
        "9\\v%=B",
        "(|vn38",
        "eiW[z",
        "1H5B{",
        "app\\U",
        "Actie: Geautomatiseerde installatie met migratiekeuze voor de installatie. De Setup-UI voor de media en de voortgangsschermen worden standaard weergegeven, maar zijn geautomatiseerd. Deze",
        "Fu>[\"",
        "bw<5]",
        "^{wcv",
        "JdZezI",
        "ppp@@@@@@ppp",
        "Error lowering priority for WU scenario, Error = 0x%X",
        "v$J*Ee",
        "~d^bulc",
        "+++qP",
        "uf-{%",
        "V`.0+",
        "Q]d|>",
        "q5PWk{",
        "&geDU",
        "o:mdG",
        "1+)lL",
        "+XM{x",
        "60666^6u6{6",
        "hVYi$",
        "-*Yz]Gn|",
        "o de funcionalidades. V",
        "+C?Gj=}",
        "+ahm(",
        "jqSq5",
        "(_ri ",
        "]gdyv]V",
        "#dZ R",
        "oZXJF",
        "718\\8",
        "0>J#7",
        "*_wc[>",
        "V~N}x&!F",
        "id7U0",
        "#}mDUb",
        "`X{/)",
        "a (Out of box experience, OOBE). Pomocou nasleduj",
        "`SIQn0",
        "nYGW#",
        "MtJVr",
        "gwHV0",
        " smlouvy EULA, povolen",
        "fDuw(",
        "Flushing MoSetup registry key...",
        "WQRw'",
        "xW:&nK s",
        "fH`/|",
        "{k#0:",
        "i zaten ",
        "D{QpR",
        "X?TIT",
        "O?f<6t",
        "t t#\\",
        "y*5Du",
        "cznik: / showoobe <parametr> ",
        "dpm0n",
        "fT|5S",
        "~o6W#",
        "-u#m)",
        "smn-FI",
        "%94d7",
        "vdmId",
        "1b4b@_",
        "@Qm6t",
        "~n\\H.",
        "Action execution thread timeout period: [%d ms]",
        "3,333G3O3U3[3a3j3",
        "1,121U1e1k1",
        "I\"h&r",
        "nj X1",
        "gp1H\"",
        "je.E1",
        "z`6z6",
        " on jo k",
        "Q!{YBX",
        "{FqTZ",
        ":h3qo",
        "ie inform",
        ">gltKr}",
        "O;67x",
        "kkelen til installasjonsprogrammet. Denne parameteren er ikke n",
        ")f{$g5{",
        "{Y5f{A",
        "fFBo ",
        "a>/Nn",
        "+Ut[c&",
        "8),\"y",
        "'Wxm_(",
        "j#,g^",
        "\"vQ4P",
        "ekpCf",
        "6/uqwn",
        "CDlpFile::Deserialize",
        "@OWCOOq",
        "N=5\\9of",
        "ratud asukohast leitud driver.inf-failid. Installiprogramm otsib rekursiivselt m",
        "gyf4& m$",
        "dyt%Y",
        ":(:X:",
        "BYhZ(",
        ">N4uw",
        "ana un aug",
        "\"uUvY",
        "=+j~Hy",
        "IohE!l",
        "{t>zT",
        "3}ST;",
        "rskenduste otsimine, allalaadimine ja installimine). ",
        "ii}S3",
        "Creating directory [%s]",
        "tv+^<",
        "R@O>|",
        " para o Windows Update no aplicativo Configura",
        "D9#Pn",
        "Bqw;\"*",
        "n<uAC",
        "a@/E<",
        "$|!S)y",
        ")[3}I",
        ")_ZP`",
        "0jmrv",
        "$[*Uh",
        "&sjw+",
        "n$.Vi_",
        "$Vc(V.",
        "J8U0 ",
        "7}Yjr*r",
        "EiW0]",
        "OMpb,",
        "Na primer: setup.exe / auto upgrade / migratealldrivers none",
        "1)QZhOJrQ",
        "o_Pnj",
        "qWB8M",
        "9326xE",
        "N#0V7d",
        "oppgaver for operativsystemet er fullf",
        "H}5x!",
        "n2dwH?",
        "PT+f2",
        "<,<4<<<D<L<T<\\<d<l<t<|<",
        "vShN^v%",
        "!2X1d",
        "9HYt',",
        "st automatiz",
        "1>^ Nxd",
        "Q7?8G",
        "b5r}^",
        "nGK_EK",
        "S+~?U",
        "B-n>.",
        "s$52]",
        "S67K\\%`",
        "n7Lr& F",
        "?jg7,",
        "H<{Vk",
        "marrer le programme d",
        "NYm:;@rN9?B",
        ",4Y`?",
        "4\\YN4p",
        "[osxh7",
        "+PSA][",
        "dku spus",
        "n#sF1",
        ":G;R;",
        "lQ^[eV",
        "WH@?P",
        ">GG!RD",
        "D9Ckt",
        "M@tQ`",
        "NT Mq",
        "VN#G<S",
        "jra a Windows 10 telep",
        "5sxQh ",
        "E`.Mz",
        ")HP#u",
        "Working file [%s] %s exist.",
        "bJ!L\"T",
        "r / Telemetry er angivet til Disable, indsamler og overf",
        "4GQy<",
        "ESRJf",
        "rios ",
        "ky`yi",
        "N,g0W",
        "v ]4s0^",
        "uriranja (pretraga, preuzimanje i instaliranje ispravki). ",
        "\"dx\\]x",
        "fhs0~",
        "jAUAW",
        "dGu<d",
        "o3XV6!",
        "z}}MM",
        "tViHM",
        "ui1q*r",
        "-b*zY@",
        "0@O$A0",
        "Parametreler : All; None ",
        "Programa de instalaci",
        "%_S ]N{",
        "xG3V*=",
        "Setup360",
        "pbcW081",
        "7G+gZ",
        "tYsXZa",
        "i\\B1U",
        ":vuKPa_",
        "ban. ",
        "r vill uppgradera kontorets datorer fr",
        "&q)!q)",
        "h5[-S7",
        "s|s0Lg0",
        "W'g:6_",
        "ZQKOjmG",
        "gc*| ",
        "Dw1!.>",
        "%&rJL",
        "Start over from the beginning",
        "cPQ~h",
        "NT Kernel Logger",
        "+*.]O)",
        "_initterm",
        "be*N?&",
        "r pri prvom spusten",
        "ena mogu",
        "[6I~1,k",
        "driver.inf-bestanden in de opgegeven locatie tijdens het",
        "<2<A<J<\\<b<s<}<",
        "Blp4)",
        "|@:&]",
        "?yV2o8",
        "wFjl/_!+m=",
        "sgWdO",
        "))ObJ",
        "gwX;Ke?",
        "Ddrv+",
        ">MdDtu",
        "4yUzd",
        "iNX1u",
        "?>n[sH",
        "L#^*b_",
        "^6H0Sj2",
        ".VGr]",
        "_<cqL",
        "DcHot",
        "iz(A:o",
        "enjima. Ne sme se koristiti u proizvodnji. ",
        "/!;P{",
        "\"N%zM&",
        "zt, ind",
        ".rdata$brc",
        "8Tp%C",
        "lT'*.",
        "_Hxv|",
        "y@VV.*[",
        ";MiTU",
        ":28JH",
        "en =k",
        "ma Microsoft",
        "?frpf",
        "0 Bxe",
        "?1`=5",
        "KeYaM",
        "*'3jE$*",
        "o a partir de um diret",
        "!.Q{[?",
        "|iZ X",
        "2Y`EG?",
        "a^02>",
        "w[RaZN",
        " 350MB",
        "GPz.s",
        "[`Di6Tat",
        "]9uD'",
        "!s=&n@",
        "iune: la eroare, instalarea va copia sau ",
        ">@JJ;;5",
        "jwf?j",
        "J(mQu",
        " driver.inf",
        "~DAsz3h",
        "hw\\86a",
        "x\"YKv",
        "Exemplo : setup.exe / auto upgrade / PBRupdate disable",
        "=81sO",
        ";&yxz",
        ".YR'l",
        "0g0o0",
        "be Windows Update v aplik",
        "=&;X[",
        "RJ~Ie",
        "@~e4~",
        "6x|gQ",
        "LUiFo5(S",
        "(~J_sZ%4",
        "$Lig^",
        "=Z8+qG}]",
        "CVE}5",
        " los archivos driver.inf incluidos en la ubicaci",
        "]zE#g",
        "q<\\(n",
        "5;,}e",
        "B7%Z2",
        "_Qx7_",
        "iune de instalare: ",
        "3NABC",
        "]J5@@gOH",
        "Wb`wj",
        "n no migrar",
        "D$PPQ",
        "}yf%GH|S",
        "9VC3F",
        "\"ZT)o#",
        "f[X?x,",
        "Y5ctc",
        "T_AjR",
        "!^TN}k",
        "J+iT9",
        "f`|I^",
        "}pz$*",
        "g]&LG",
        "TN=(d)",
        "FmfY&",
        ".?AVCStatic@@",
        " impostata su Enable, il programma di installazione raccoglier",
        "cessitent des autorisations d",
        "%u=1>",
        "`Bnj ",
        "l2h'(4",
        "8\"pA5",
        ";|1j2",
        "QiCPgk",
        "&>~&L",
        "h953Vk",
        "NtSetInformationFile",
        "uxJW`",
        "cYA?E",
        "je Parametrai eikite ",
        "2\\R!w",
        "Kc#{M",
        "\\\\?\\GLOBALROOT",
        "Y14ZCd",
        "s onnan, ahol abbahagytam",
        "wsrsR",
        "mas kontekst",
        "3(7!}",
        "jFAs1",
        "oB03k",
        "Scenario - Based Usage ",
        "Parametry: lokalna lub sieciowa (UNC) ",
        ":_}0gQ&}",
        "i;k_gJ",
        "Bruk den andre installasjonsdisken (%s-bitersversjonen). N",
        "Fi<L{",
        "2m|W[Z&P",
        "X\\be2",
        "7\\w~\"?",
        "Z 7f`",
        "\"PmQP{",
        "9h@k,",
        "#$G\"Rr6Y",
        "\\3lVh",
        "Radnja: Obezbe",
        "f:&4 X)",
        "}7.`T%",
        ".z;u%",
        "G${J_'2",
        "c9Ge9",
        "etZoB",
        ";$;[;",
        "i relansa",
        "@_+w+n",
        "f^H1s",
        " qualquer UX de instala",
        "8Z}Zk",
        "k<tm-",
        "y1d\"_",
        "((*5PP",
        "nwdi2'",
        "T;n$8-E",
        "bS'C3",
        "  pid.txt ",
        " aplanke yra pid.txt. ",
        "M&,dV",
        "iune: fanionul quiet suprim",
        " },y|",
        "|iPL\"",
        "re installasjonen p",
        "G@}y]",
        "ncia da Configura",
        "PPP@@@ppp",
        "rste brugerlogon. Det udf",
        "'3|z=",
        "B1G u",
        "^,RMKwq",
        "NOTE: This switch should only be used in testing and test environments. It should not be used in production. ",
        "xel: / noreboot ",
        "L9%F5",
        "o especificada. O ficheiro Setuprolback.cmd ",
        "*aZ1u",
        ")3P{,",
        "*Y@KF",
        "^fkO/",
        "VL%^du",
        "DJN%?PP8",
        "#dE-8",
        " instan",
        "7=7S7\\7f7u7",
        "I-eAYQM@",
        "q9'36",
        "/FgDt",
        "GQ#}H",
        "+lJaa",
        "#|nXhu",
        "'FUjS",
        "rksafbrydelse. Pr",
        "\\xpF+",
        "z)*t+",
        "lreiz iekop",
        "0m58u,",
        "s-I^O",
        "%s: File hash stored!",
        "Action: Specifies location for installation source media / files ",
        "!:Y[^",
        ";weGc,8",
        ":]a!FUn",
        "(jFdj|",
        "b)cMI",
        "c2\"N1;",
        "G@0p}&A",
        "n!\"+F",
        "l%O`_",
        "=0{ZT",
        "ySUYq",
        "gX+s(",
        " arhitekt",
        "< <e<",
        "F5v=bk",
        "zgB9z",
        "6I_@C6",
        "=Z`=^",
        "0~0Y0L0",
        "Preserve working path: [%s]",
        "/ files ",
        "*Co}o",
        "@FUVf1",
        "wpVEBt",
        "8kV0eK",
        "CR)]n",
        "<,`j3",
        "mJh!n:",
        "`,\"cC",
        " a ser executada. Poder",
        " bt.RG",
        "~(.YWr",
        "e skompresowane dzienniki do okre",
        "u-1x7",
        "nDb$,",
        "%.OGP",
        "&|c<'",
        "8taFl{&<b",
        "2@<p)",
        "Ki[tm",
        "pw~~$",
        "hD<eY",
        "|C*_8",
        "W[8Sin",
        "/LRWZ",
        "ZD9+#",
        "%s: Box file hash does not match.",
        "nt a telep",
        ",7AMmu",
        "_6tX6",
        "Ht'k?",
        "!<1MH",
        "A`P&R",
        "J5fMb",
        "v1+$k",
        "3Ggxu",
        ";B%1\\\\&",
        "jh;r w",
        "TkLlj=V9",
        "ste in",
        "2Hj&6",
        "ytkownik musz",
        "las, lai tiktu r",
        "q>^Qa-",
        "CDlpFile::CheckInitialized",
        "&Peruuta",
        "KhCYv",
        ">,J<a",
        "Ner|h",
        "x$`9V`%",
        "_X8 q<r",
        "V8_^j",
        "TS<:d",
        "Ys%Sl",
        "eE71\\L",
        "YN??p",
        "o7([@",
        "&Fullf",
        "Sklopka : / pkey <product key> ",
        "}k{]l|8",
        "TpL*_",
        ">`\"z=",
        "0O:5(",
        "6fI6f",
        "nak interakt",
        "Parametri: klju",
        "n9T|%\"v",
        "jmm}yy",
        "<UPn3",
        "1G;R|",
        "'G.Xa+",
        "UBJRO",
        "N9z%!",
        "Switch: / pkey <codice Product Key> ",
        "$2`Tpb",
        "!81;6",
        "qkjVj^Lw",
        "h/9O\\",
        "\"*9tq",
        "tl]J9",
        "o3pO=",
        "?*z\\A",
        "UB|UA",
        "(HN{4",
        "dzis: / noreboot ",
        "(\"OQJ.",
        "k1z-F",
        "Lxj)N",
        " dit installationsmedie.",
        "gar och UNC-n",
        "lEwP{",
        "G-T-O",
        "/=Jw,\\@",
        "Parametre : k",
        "CDlpManager::GetQuadwordProperty",
        "\\x:pr",
        "e\\ls.",
        "9$9C9s9",
        "MO3Bu",
        ";zX3q",
        "EjjU(+2p(",
        "2L-S2T",
        "VH,.V",
        "IT>Bv(",
        " *!\"P",
        "DJG@$",
        "fh5qYiE",
        "OGxu}",
        "{a|7V",
        "*W8Sa",
        "upUnloadMountedHives",
        "@i;HfG8",
        "z;}$Vp",
        "][}:h",
        "$}8)s",
        "3rNL\"",
        "KkL+!",
        "3B%eUP",
        "        name=\"wdscore.dll\"",
        "363E3R3w3",
        "Toiminto: quiet-merkint",
        "&m4&%M",
        "Q|S8,",
        "V1U&>",
        "Z|5[I",
        "ide: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "_T:=.",
        "ok\"`]",
        "jvj;a",
        "aujas ",
        "w)sK0",
        "tres : Full; None ",
        "%wNtE",
        "JxL%<",
        "terek: A setupcomplete.cmd helyi el",
        "1XHc=;",
        " /rrX",
        "=tkB+z`",
        "3(4/4=4",
        "TVLKJ",
        "L(_lY[Izq,LoJ",
        "ibdYG",
        "IU1?|",
        "(XLGNl~",
        "U:]?bq",
        " necesar",
        "8<:N'",
        "e/9HN",
        ";='\"\\j",
        "-a}6n",
        "|#Q/R",
        "H:tIRA",
        "k)*1F",
        "jV13p",
        "Aktion: Gibt an, ob Setup Vorg",
        "uF3mk",
        "Bvhb-",
        "^C[vi,",
        "q_&1IFx8AXZ+_:G",
        ".0oO5",
        "/Override %s",
        "T<D-1",
        "RW@}c",
        "K~v.R,<",
        "G%QiD\"",
        "htX=I[",
        "sNzr5",
        "N]~(m",
        "unZ#f5",
        "R}(gw",
        ". Acest parametru nu este necesar c",
        "K|[RW",
        "rpfdY",
        "U)>F.!YY",
        ";pkV4",
        "1\\lY+",
        "BwvrtXb",
        "?!viF",
        "n tai luodaan. ",
        "Por ejemplo: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "#zkz;}",
        "J'Msw;",
        "Parameter: / noreboot ",
        "Ag-+z",
        "]u.;^",
        "%![1Q",
        "hv:%C",
        "B4&^n",
        "\\Ya@f#'",
        "yzjNi$",
        "=kxTE",
        "{]~7F",
        "$m$Qz",
        "NtOpenFile",
        "Mr\"m]",
        "gM,nh",
        "eca j",
        "1at!\"",
        "n no puede iniciar la experiencia del programa de instalaci",
        "l. Nem szeretn",
        "rwwokk",
        "Vht~@",
        "ZlA^u",
        "PIRW{",
        "#}+}r",
        "rtelmez",
        "e dovesti do automatskog ponovnog pokretanja ra",
        "161e1|1",
        "rU{Ebb##",
        " architektur",
        "Toiming: nurjumise korral kopeerib installiprogramm tihendatud logid v",
        "zi-LR#",
        "Q6F$;",
        "`I9.I",
        "`U;'T",
        "}!b{:8D",
        "\\-o5)m",
        "OPMERKING: deze",
        "{Fey3Bf",
        "H0=p<0o",
        "2ST\\g",
        "_%/ok+",
        "-dd?,*CP",
        "=54Qz",
        "2KD)X",
        "o alternativa pode ser a de um engenheiro de desenvolvimento que pretende recolher registos e outra informa",
        "nottoteknikko saattaa haluta ker",
        "!'w/w<",
        "q/A6{",
        " OOBE, ",
        "EnableWindow",
        "&ilg4",
        "-SJRz",
        "A]?91",
        "rD&1)",
        "t8c{ ",
        "/^z$f5",
        " nastalo kr",
        "):zN8",
        "j\\Yf;",
        "IN7A2",
        "e=D1^",
        "AZB-T",
        " tyto v",
        "__RTDynamicCast",
        "NCry)",
        ";b'DW",
        "4J4y4",
        ")lDt8",
        "architecture s",
        "%MB=:4",
        "3wA+}",
        "z0 R/VJ3",
        "n/54[,",
        "!kx0(",
        "7OF=l",
        "  wdsutil.dll",
        "uiU|a",
        "s;`GZ",
        " XML-",
        "$u?Im",
        "}s|s}",
        "pF6yC)",
        "W+0'<",
        "&+}d0O",
        "po[Yd",
        ".7&gw",
        "(x>?Q",
        "IRReM-=",
        ": setup.exe / auto upgrade / migratealldrivers none",
        "Nz}tm1",
        "9`<m>\\",
        "7F8O8V8`8",
        "G=v@p",
        "RV0;^",
        "TGggo",
        "zDFAA",
        "]T\\YT}a",
        ">A%x6c",
        "7$818J8p8}8",
        "4brjt5",
        "R+kh%",
        "}}Vlg",
        "omf$S",
        "Px AT",
        ", PBR ",
        "eW0_0h0S0",
        "o&_9zo",
        "<l=s=",
        "4aSD/",
        "nosti migrace pro instalaci. Ve v",
        "A70 Lb{",
        "[%#Fht=ZgW-",
        "$<>]_",
        "h1Ncm",
        "5Y{s3",
        "n\\crg",
        "2y?*`!vp",
        "ja-JP",
        "TH*!U",
        "<C}9_",
        "iajame diske ",
        "0N)eA",
        "m2G!5",
        "%K&;Up",
        "cie n",
        "wm-!OEu",
        "Y7Mmo",
        "2/N-,J1/]C",
        "Dg~!3Q",
        "YE~I~O",
        "\"LqKl",
        "5;\"_9Y",
        "udmist, kuid enne kasutaja esimest sisselogimist. See k",
        "_F'?,",
        "lW]e`",
        "]:Wmt)mtHC",
        "s/oh]",
        "k%VPQTF",
        "(Y&X-M",
        "_}g>q",
        "9=9`N",
        "unar i poku",
        "Iq{+g",
        ";-47]",
        "&9tqH>|",
        "ff~\\i",
        "}3!;p",
        "g9Y\\EI",
        "Xd,7N",
        "~2#\"M",
        "F4O(U",
        "installation. Le programme d",
        "BGtEV5&",
        "#}e_s",
        "e[Io.",
        "u/c,i",
        "KPMc` ",
        "c#x5<",
        "BB AK",
        "r / showoobe er angivet til Full, skal slutbrugeren interaktivt udfylde OOBE-oplysninger. N",
        "[WV.v",
        "jnZ[L",
        "y',bwx",
        "s enged",
        "PA\"BS0",
        "^zYK'be[",
        "8o>8W",
        "~`iqt\"=",
        "CBootScenarioCtrl::ShouldPreserveWorkingDir",
        "7G2Lz",
        "i zahtevanu verziju XML-a2Gre",
        "<@6_P",
        "O^[Pf",
        ":OK5=",
        "^Q[>T",
        "]f$MBS",
        "WvL{x",
        "er podrazumijeva sljede",
        "eX<K#>",
        "sterilir, ancak otomatik hale getirilmez. Bu anahtar ayr",
        "7?-9g",
        "$,f/[",
        "qnK~g3",
        "7F?SP",
        "eli, da se prika",
        "%C3R\\",
        "m\"ulE",
        "KUS)d",
        "EBXU7K",
        "setupcomplete.cmd",
        "<=IkK]",
        "&Suivant",
        "+4E^!",
        "tk-TM",
        ">\\setupcomplete.cmd ",
        "?\\Z})",
        " interfa",
        "*.kDR;",
        "~9~y~",
        "YQuDr",
        "O\\\\>I",
        "}Tuh[cl",
        "CSetupLangIniLoader::Initialize: Adding language: index: %d",
        "!W`&ep",
        "35&hE",
        "C.|4F",
        "l+',+",
        "%s: User decided to Abort Setup to keep Uninstall option active.",
        "*^B!e",
        "8X;=e",
        "*Z32[",
        "qL \\V",
        "_:!SU",
        "oURd].",
        "Executing pending rollback command: [%s]...",
        "i</m^",
        "g_b7&",
        "n directorul r",
        "164T)",
        "llningar anv",
        "h+)qP",
        "E6p(]-",
        "%Uv(=L",
        "t match your PC. For example, if your PC is running the 64-bit version of Windows, you need to use the 64-bit version of the tool. Try running the tool again, and make sure that you select the correct architecture.\"There was a problem starting SetupiThere was a problem starting Setup. Close the tool, restart your PC, and then try running the tool again.QWe need at least 350 MB of space to run setup. Create some space, then try again.jIf you install this version of Windows 10, you won",
        "_f1ys",
        "1dbbB",
        "Xv!q[p9",
        "F:dh[",
        "=3}1.",
        "ndaren interagera och slutf",
        "<*<h<o<",
        ")4`wv",
        "C]@/Ak",
        "-kKeY",
        ";e\\ 5",
        "K5c(eTip",
        "n ve Kurulum'u yeniden ba",
        "r / Telemetry ",
        ";nxxlg?",
        "3b4>s]",
        ".WvFaA",
        "Sc}$KT",
        "jies intermit",
        "Beispiel: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "fM\"(7",
        "UZBx(",
        "w`#ku",
        ">[7`^",
        "]b[tGK",
        "ZHiba t",
        "s\\>sh",
        ",-`Wv",
        "'f(O(-",
        "c<'^0",
        "t kell haszn",
        "Q<QbQ",
        "l2L$d",
        "8M9x9",
        "*lsq4",
        "U$>hO",
        " -,CaA",
        "r att testa installationer i testmilj",
        "4tu#`",
        "E}V;VJ",
        ")rb~+",
        "+'rwU",
        "-ifTH[",
        "UNKNOWN",
        "575j5~5",
        "F/c e",
        "bp~bA",
        "){ddXa]",
        "Suspend! Terminating process...",
        "@J9G^`",
        "JjDf-",
        "0G1U1[1",
        "kog programa prona",
        "CreateCommandLine",
        "MKtOs",
        "{c55U",
        "G34_+",
        "CQV M",
        "c71kw",
        "L$(!t$",
        "cw@_tg`M",
        "ter OOBE de fa",
        "Parametrai: vietinio failo kelias arba UNC tinklo kelias iki aplanko, kuriame yra .inf failai ",
        "1?\\+`5I",
        "lETq~",
        "<7PD;",
        "zX^R,e%1X",
        "5BWWuE",
        ".YOpF)l",
        "Ylbcw",
        "{~eIr",
        "-3\"]?(",
        "GaJ6M4",
        "KC=fm",
        "Eylem : Kurulumun Dinamik G",
        ";N+w4",
        "sq~3r",
        "->iA=",
        "bWtlg",
        "F+JPN",
        ".WI)V2",
        "&<1&E",
        "0V)v|",
        "4p|U|",
        "Y=\\co",
        "`H?UO/",
        "$Wd/{/B",
        "|sHO}",
        " a zkuste spustit instala",
        ";'b_X|~b",
        "F@l'@",
        "j\"v@05v",
        "<;KV9=",
        "P5tey*",
        "6LEAkJ",
        "JK,<'",
        "PM\\j7",
        "ev[.Y",
        "\\#f`|",
        "n: cuando / Telemetry se establece en Enable, la configuraci",
        "mPMFL",
        "jams, tiek veikta l",
        "CeLB=w+T",
        "zati kapcsolat. Pr",
        "IdqKJdq",
        " nytt, fortsetter installasjonen. ",
        "/r|v >",
        "Cmzi!\\",
        "V\\,c8\"*]i",
        "Comutator: / installfrom <loca",
        "C*,}N",
        "RXYky",
        "Parametry: Full; None ",
        "LMeb5_",
        "Gw>qu",
        "Veiksmas: tyliojo re",
        "tXz_&S",
        "{/hJ{$E",
        "$J()){",
        "~qa\\iO",
        "'vW7d",
        "DuplicateTokenEx",
        "D0^0i0",
        "p.)K5",
        "A preparar %d%%",
        " till Windows Update i appen Inst",
        "'eO*{",
        "sR+A-9}s",
        "CreateCompatibleDC",
        "}l'*]",
        "Informacje prawne",
        "s)cgo",
        ">74AZ?",
        "de ni ",
        "gJ61U",
        "(OD8+$P",
        "uXA1+",
        "cursive tous les sous-dossiers de l",
        "M/q[/f",
        "?};sb",
        "?#?)?F?K?\\?b?",
        "enjima. Ne bi je se smjelo koristiti u produkcijskom okru",
        "Por ejemplo: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "CDlpFile::UpdateState",
        "G{0Dp",
        "R)Kz,y",
        "c=mN%",
        "hN6`w",
        "8K<#2",
        "rsel, OOBE springes over, PBR bliver opdateret eller oprettet. ",
        "dGCcuGX",
        "\\[b\"j",
        "Deleting path: [%s] -> Result: [0x%X]",
        "jV+k;z",
        "KfR| ",
        "|KRl9\\b",
        ":p(!|",
        "dia install",
        "S]`b*t ",
        "*c]^.^$",
        "#-Q`=[\"W",
        "Setup.exe installeert Windows of voert een Windows-upgrade uit. Met de volgende opdrachtregelargumenten kunt u het gedrag van de Windows-installatie aanpassen",
        "575\\5",
        "RegQueryInfoKeyW",
        ")WU. ",
        ",[ida",
        "U{jiw-",
        "; ;(;@;D;\\;l;|;",
        "a5_.BA|#,",
        "6A:\\[ ",
        "Ij>Cp3",
        "}p0b,",
        "Z#>8]",
        "dc3c8]3",
        "fini ",
        "lkeen, kun asennus on ep",
        ":|i+do",
        "n la clave de producto especificada. Este par",
        ">`xZYMU",
        "klad: setup.exe / auto upgrade / quiet",
        "e}ip[",
        "KdciF^j",
        " Microsoft Corporation. Todos los derechos reservados.",
        "\".2${h",
        "E-x@'Rz",
        "(eL*-q",
        " softv",
        "e}$~}",
        "rGj(W/n5",
        "DVf+7",
        "o Ft'",
        "o0VCM",
        ";>1az ",
        "Parametrit: 5 x 5 -merkkinen tuoteavain ",
        "lK(F)",
        "LL'Am",
        "i spu",
        "mFv8u",
        "Rozpocznij od pocz",
        "e\\yM?",
        "KP/{X",
        "Yvo8xN",
        ".~*N,",
        "czv\\g",
        "*+%aee",
        "n: especifica si la instalaci",
        "5GR='",
        "Df.hm",
        "001B1",
        "y =qB,=t{",
        "kOf]X",
        "dZg,P",
        "bs-Latn",
        "va vyhraden",
        "/P//Q*",
        "l\"OR:",
        "Parameters: Full; None ",
        "7]Am$",
        "Xg0n0",
        "['&`4",
        "8@8\\8z8",
        "Ss-E.",
        "k(05fpD",
        "u kroz iskustvo kori",
        "Nr|46h",
        "`fdJF",
        "kog a",
        "Bryter: / installfrom <location> ",
        "17x.1p:",
        "pM#mF",
        "Y}sS@i",
        "r `>;",
        "=zE)zf",
        "n automatizadas. Para este conmutador tambi",
        "3ro]8",
        "n desde un directorio local, copia de nuevo todos los archivos de instalaci",
        "iatku",
        " <*l\"9",
        "|Sybgz",
        "BKE0^\";.9(",
        "t(sO\"",
        "b-avR",
        "\"zMj_",
        "#G}W|",
        "+EYN/",
        "6G;Do",
        "CBy68,",
        "eNB}W",
        "!r[/T",
        "`-1;I",
        "mk{o]",
        "~67K`{2",
        "eKP\"N",
        ":x3P9A",
        ";lf=Qn",
        "4N^Z./",
        "v[IpS",
        "&&JB2!m20!",
        "$EdMjM",
        "vflfw.",
        "A-<6B",
        "'bY?U",
        "ges syst",
        "ciu syst",
        "Zw<Eo",
        "}@vbXF",
        ": / pkey <k",
        "version",
        "NPW@}",
        "*^]Ts",
        ",FUY~",
        "8U%ph",
        " po niepowodzeniu instalacji i wycofaniu procesu do wcze",
        "=99E)VId",
        "peit Windows 7 Enterprise rendszerr",
        " SVW3",
        "I`$52",
        "3y\\5is",
        "PfJzW",
        "i PC-ul ",
        "GS1GU",
        "Soubor setup.exe nainstaluje nebo upgraduje Windows. K ",
        "!z;Eo",
        "Jq~u)",
        "IsUninstallAllowed: Error Os Uninstall Source Version. Error = 0x%X",
        "G)'}G",
        "}7rG>",
        "\"41 !",
        "g`4TPbL",
        "$V`xS+",
        " : setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "S-.VZB",
        "cHYT~",
        "ti a Windowst. A k",
        "s:++y&",
        "u2+0M",
        "CDlpTask::GetNextActionIndex",
        ":$;<;N;s;",
        "x}YeYAc",
        "vN7w{",
        "@W-V[",
        "i ^1%x",
        "6KD)R",
        "j#:.w",
        "FyQaT",
        "n.  Aceptaci",
        "dwM<0",
        "*z\"k$",
        "qA2 &r~",
        "~XQxl",
        "?1L3H",
        "_z3pO:)|",
        "~SEX_6M",
        "!MGll",
        "cwz+z",
        "0L01YWeW0_04X",
        "z]<|+(=",
        "i pid.txt. ",
        "$5N]P",
        "(yHNU",
        "L9jX(",
        " reTYQ",
        "|6i\"~",
        "H71,'",
        "~@I:H",
        ": setup.exe / auto upgrade / showoobe full",
        "+SV6|A",
        "5vNn@",
        "8'rr,",
        "*f%+{",
        "zvom setuprollback.cmd ",
        ",r+aP",
        "x_=FI",
        "ranka rinks ir nusi",
        "xwG7l",
        "$b#[.",
        "rPvV5",
        "]@_~Y",
        "|{4V2",
        "g!X{-",
        "(y,&nz;",
        "PVq~x",
        "rberedelser g",
        " que lors des tests et dans les environnements de test. Il ne doit pas ",
        " niveau avec des supports de volume sous licence ou sur un support qui contient un pid.txt dans le dossier sources. ",
        "@^UpU",
        ")CWaa",
        "< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\\<`<d<h<l<p<t<x<|<",
        "FK{j'",
        "*<^gZ",
        "{b=-P",
        "NtWriteFile",
        "bs=[#",
        "i0n+[",
        "v{E6F",
        "l#oF-",
        "YG8+U^",
        "q:sgh",
        "H`mzw",
        "SetSecurityDescriptorOwner",
        "qA?W=",
        "7tl9V~",
        "{P]6S",
        "mFh'^{",
        ")}BI.",
        " Install.exe ",
        "t Windows 10",
        "+.T.7",
        "UYOt!",
        ".{;C,",
        "zOI?]P",
        "        loadFrom=\"%systemroot%\\system32\\sspicli.dll\"",
        "DC{8r",
        "+jkgP",
        "N?_QH3",
        "S**LR",
        "&S9+W",
        "??&cX}/",
        "6hY4B",
        "iHtgBq",
        "n#aX,<",
        "Qj9X1",
        "?nJ]Y",
        "#F0hf",
        "13d46nE",
        "RymnL",
        ", / migratealldrivers",
        "zwt[}",
        "_lMC;",
        "d.a>dK",
        "Qh$/A",
        " inov",
        "xbNz|",
        "s. See k",
        "?<Hk]",
        ".*A ap",
        "G`^V`;",
        "Microsoft Corporation",
        ",bj=DeRa$",
        "pe%.(",
        "Conmutador: / Telemetry <parameter> ",
        "9x )TT",
        "viJ!ju]",
        "5xeIK",
        "la, czy w ramach instalacji b",
        "myI(c",
        "UFUPU",
        "V\"aX!",
        "};dod",
        "(KPK~~",
        "MeNB?'E=h",
        "ynnistym",
        "qhr4tF",
        "skb8W]q8w",
        "]{tTE",
        "?w$tQ",
        "Y\"sdT",
        "9.5h>",
        "69&`C",
        "~VC);E3",
        "K\"ks#k",
        "SgU*aC",
        "n)@Vn",
        "&dF0.",
        "9$9,949<9D9P9t9|9",
        " versiune de Windows nu se accept",
        "0wHM=",
        "3 install",
        "CPackageScenarioCtrl::CreateCommandLine",
        "il}wqF",
        "s~Oiu",
        "Ah3&`R",
        "aSi\"%s",
        "{{|||{xqokg_YS",
        "!#(zEdBa1",
        "{(FoN",
        "\"Iiq=K",
        "(BpAN",
        "ktan sonra ancak ilk kullan",
        "ceQIQ",
        "B~qjg",
        "$45y|n&",
        "]*|a&",
        "Palaikymas",
        "]{|TE",
        "|(0Z/",
        "a/_VGl}",
        "!>QJ:0b",
        "#~R9&7G",
        "v[/I~",
        "rtuseks on seatud Enable, siis installiprogramm kogub ja laadib ",
        "TlToi",
        ";o@~u",
        "=Pe.`",
        ": / Postrollback<location> ",
        "%P?4\"",
        "> ?@?G?Q?c?",
        " finalizarea instal",
        "0CnKp/\\_",
        "U(q]4",
        "Uf;f$)(",
        "n no puede determinar el idioma de la interfaz de usuario",
        "bC6#~",
        "Il programma di installazione di Windows 10 non accetta gli argomenti della riga di comando. Al prompt dei comandi, esegui \"setup.exe /?\" nella directory radice del supporto di installazione.",
        "6{!eeS",
        "cBwf<",
        "tGVWj",
        ")>iLiG3B",
        "qwtOQ",
        "EtwEventEnabled",
        "G^LYI^L6",
        "jS{P6",
        "GBp_P",
        "DlpTask: Deserialize(): ActionId = [%s]",
        "3I3c3n3",
        "1FNKF",
        "$kxVD",
        "=8=B=l=",
        "'b$v9S",
        "9QRb))",
        "4OL`E",
        "7X8+9B9",
        "Sb0^n",
        "&z[:q",
        "JH}|9",
        "-oJ,_",
        "Sources\\Panther",
        "W[us5",
        "_N~8CT9",
        "lY$7<",
        "O~(4w*",
        " sa m",
        "ywQJ.k",
        "%?N*goV",
        "ncia de Primeira Execu",
        "Un amministratore desidera aggiornare i PC di vari reparti da Windows 7 Enterprise durante la notte. Non vuole visualizzare l'interfaccia utente del programma di installazione, ma desidera che gli utenti eseguano manualmente l'esperienza della Configurazione guidata. ",
        "5)LDH",
        "ny kimarad, ",
        "WideCharToMultiByte",
        "='^{<-\\",
        "*%mTm",
        "k nor",
        "1\"PYa",
        "$D$aH",
        "o, mas quer que os utilizadores finais percorram manualmente a Experi",
        "6w!!aY",
        "?}>1.",
        "M|1Mm",
        "k#{vL",
        "-c[at6",
        "ta vastu k",
        "`@XU{b&",
        "4^-%t",
        "SMhD@",
        "V0V\"F",
        "Por ejemplo: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp",
        "Jez+G",
        "2*0Dt",
        "kmesini istemiyor ancak son kullan",
        "`vX@3",
        "sI?<Uz[H",
        "@tG3_",
        "m>QkKd",
        "O.b]GX!",
        "ONcLz",
        "j,loL",
        "5o0#\"",
        "/%[R(",
        "YZFZjM",
        "_~&h|",
        "sNt.39",
        " komand",
        "anja vstavi vse datoteke driver.inf, ki jih najde na navedeni lokaciji. Namestitveni program rekurzivno prei",
        "u|yRpD",
        ",H7\\D",
        "zh-CHS",
        "81--=}",
        "tzt. Die mindestens erforderliche Version ist Windows XP mit Service Pack 3.",
        "r \"setup.exe /?\" i kommandoprompten i rodmappen p",
        "zi*iV",
        ">tovM ",
        "(ZEo]6",
        "n`-wE",
        "YolmAl-P",
        "uvrA0",
        "ana verzija Windows XP sa servisnim paketom SP 3.",
        "ReportData failed: Error = [0x%X]",
        "Sources\\Rollback",
        "Switch: / quiet ",
        "*~;_W",
        "Ql/;IoM",
        "0n'+?5",
        "sik, ",
        "elite prilagoditi vedenje namestitve sistema Windows, lahko uporabite spodnje argumente ukazne vrstice.",
        "f^vMA",
        "3,3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "SSSSj",
        "UP+z/",
        " ZW@l",
        "n: la marca silenciosa suprimir",
        "041904B0",
        "jota dinamisk",
        "j1^WV",
        "AfVZt",
        "N*N(u7b{vU_MRgbL",
        "X\"}FL",
        "#;$;!+",
        "@4?RJum",
        "tky k %1!s!. Ur",
        "}{20d",
        "d[7r)",
        "e preuzima slede",
        "OI1uF9",
        "yV[d(d",
        "<!>1>D>M>Y>`>w>",
        "Priprava %d%%",
        "iOipi",
        "t% 0d`,,@M",
        "[`yy?",
        "o do Windows 10 novamente.",
        "z_91y",
        "llningsgr",
        "oHbn8ZtX8",
        ",g)VJ",
        "{~E6r",
        "RnzqNq",
        "&?R\"^",
        "*EU16:",
        "cr'SV",
        "virkelig grensesnitt under installasjonen, inkludert tilbakerulling ",
        "9>#Od",
        " ]*}%",
        "@Arhitektura, ki ste jo izbrali, se ne ujema z va",
        "ZHCIE",
        "1gB8}",
        "`On!IF{",
        "oI?\\3",
        " Disable, ",
        ":0i5%",
        ".EkB#",
        "gKlbI",
        "F|60t",
        "HH<wA",
        "2[an6",
        "^E\"l:",
        "YEPW5",
        "TTNK(",
        "5e]Y_6",
        "SZM1*T3",
        "pw5fq",
        " E9>s",
        "tres : Upgrade; DataOnly; Clean ",
        "o. Uma atualiza",
        "['Eb)",
        "Obs!  Denne bryteren skal bare brukes i testing og testmilj",
        "slFb}",
        "Exempel: setup.exe / auto upgrade / migratealldrivers none",
        "Microsoft YaHei",
        "D:tOU",
        "anas darb",
        " verzia Windowsu, mus",
        "{)e698",
        "$1SWw",
        "__wgetmainargs",
        "4YJvX",
        "6GGrD",
        "wg=U++w",
        "tgci~B",
        "Z+**^",
        "e da pokrene iskustvo pri radu sa zastarelom instalacijom<Instalacioni program ne mo",
        "Akcja: Instalator nie wykona ponownego rozruchu komputera po zako",
        "u9ukZ",
        "T]tG*",
        "?H+?a",
        "4r=v=-",
        "s\\Friss",
        "+y)3*",
        ";4]tj'",
        "Akcja: Wprowadza plik setuprollback.cmd z okre",
        "oP6$%",
        "<`L<x",
        "%\\G08_",
        "Exemplo : setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "o do Windows",
        "CDlpTask::TraceData",
        "xel: / installdrivers <s",
        "Gq\"AGM",
        "ln T1$",
        "fini sur None, OOBE est ignor",
        "ZtfSp",
        "jJ-+Pg(",
        "6,6;6^6}6",
        "^i:`\"",
        "o=K%$",
        "]l['}5\\b",
        ": / migratealldrivers <param",
        "$ljl'",
        "mfAFu4P",
        "dvendig, n",
        "S8fIi",
        "J{ QX",
        "B[gu}",
        ";Q`oa",
        "xcpSOq",
        "*@a#7",
        "Z7fh6u",
        "4)T{pE",
        "rKYJ.^",
        "x&Mzj",
        "x6]Y+",
        "3:hy=/6",
        "4zwC^n7",
        "?u'G.C",
        " specific.wim",
        "8__Hr",
        "locatie. Setupcomplete.cmd is een op maat gemaakt script waarmee taken worden uitgevoerd nadat de installatie is voltooid, maar voordat de gebruiker zich voor het eerst aanmeldt. Het script beschikt over systeembevoegdheden. ",
        "5''Q9#",
        " contains.inf ",
        "5|p,mkU",
        "XtOeo{",
        ".DSi\\",
        "*?8*6",
        "Z_CTB_7P",
        "Protecting file: [%s]...",
        "X+~|/k",
        "rcarea telemetriei, OOBE va fi omis, PBR va fi actualizat sau creat. ",
        "Action: Injects setupcomplete.cmd file from the specified location.Setupcomplete.cmd is a customised script to perform tasks after the installation completes but before first user log-in. It is run with System privileges. ",
        "h'HDdY",
        "ycJ`\\",
        "}B~}3",
        ".zR)ekMpb",
        "_8e\\s",
        "Konfigur",
        "lisan kelljen v",
        "<,P!~:",
        "g:5H/",
        "|Z-O2*",
        "6u_4`_",
        "`-f:lj",
        " jz'|",
        "v!|fo",
        "lkeen: ",
        "\\&!?.(",
        "Y K$E",
        "d(yJKu",
        "J!W_j",
        "ivitys\\ohjaimet",
        "Rv,TNE",
        "ppkasutajad teeksid k",
        "~-)boH",
        "[%7rs",
        "1JYf,3lmu",
        ".8492h",
        "\\g(_zwC",
        "QT~uW",
        " GBWzr",
        "c6QJ|",
        "tv:(+",
        ";/KI_",
        "{K:J)",
        "!?^E[",
        ": .inf ",
        "ct'*A",
        "xX_\\|",
        "gz[3Q!W",
        "%]oh1W>\"",
        "uje um",
        "%lPb/",
        "FMOWgoFQP",
        "yor %d%%",
        "h|f|h(",
        "?,&-OKj",
        "ivitamisel: ",
        "xel: / showoobe <parameter> ",
        "s<_ee",
        "f0f0 RU",
        "lb_L,",
        "ranka bus automati",
        "&,%,8",
        "g*XCV",
        "hc1zrEp",
        ")r<hA",
        "}4+GU",
        "KZOSi",
        "YhuA^=o",
        "rer allerede.hDenne versjonen av Windows st",
        "\\u>:q",
        "iF}M#",
        "bZ(E}",
        "n PBR ",
        "cnico",
        " Windowsin 64-bittinen versio, sinun on k",
        "o novamente de uma janela de Prompt de Comando",
        "8:.a<",
        "d06Vi",
        "S4/&%*E",
        "C!vTe",
        "TM4dX",
        "q:)?{",
        "Y]]U]]U",
        "Provera kompatibilnosti",
        "{$m}8)",
        "5_J-Uh}wn",
        "[jE7E-",
        "n_>OW",
        "TIDvQD",
        "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>",
        "Action : le programme d",
        "v6E50^",
        "9^s4e",
        "+ ]3&",
        "15*&Dy",
        "%7e\"Qh",
        "S[N8\\1",
        ";VU^(",
        "5A:/6W\"",
        "{@|Bq2r",
        "n: cuando se produzca un error, la instalaci",
        "oS^J>",
        "mH[MGv[M",
        "[o]l? X",
        "C^_nx",
        "._[>[",
        "V\\W=&",
        "iRi#$",
        "ivo u toku testiranja i u probnim okru",
        "mPNQ!{",
        "EnumeratePathEx: Unable to enumerate [%s]; GLE = 0x%x",
        "?sfzuV",
        "`hnCv Gre",
        "uz-Latn-UZ",
        "f6:pjZ",
        "<$4.`q",
        "%$!(`m",
        "/n=\\l",
        "anas k",
        "n(X6x",
        ".]B[R",
        "WAceE}",
        ":t zm",
        "FmS(/",
        "393_3",
        "kU>Q_",
        "`sl<5",
        "KRw=2",
        "i43bh",
        "ao)8S",
        "]opcWu",
        "7?*n).",
        "8?8I8^8g8q8",
        "O=>TC",
        "aR*=^%Jr",
        "HoZhc",
        "<4mOz=",
        "Tg7:;8",
        "V{+yb",
        "o procurar",
        "+fqzy",
        "+bn1m_/i{",
        "?$?d?~?",
        "Parametry: N / A ",
        "NRinS",
        "installation de Windows 10 est d",
        "marrez votre PC et essayez d",
        "m*11p",
        "&s}G(I",
        "/#NWo",
        "?4T t",
        "mQ w3",
        "Exemple : setup.exe / auto upgrade / installdrivers c: \\myUpgrade\\drivers",
        ";QQeu<r=",
        "%+{efN",
        "4i#r#",
        "ts lietot",
        "YE>dHI",
        "pJ(+6",
        "Parameter: Upgrade; DataOnly; Clean ",
        "4g<k7",
        "0\\b?>h",
        " lokeja ja muita diagnostiikkatietoja testitietokoneista virheen tapahtuessa. Seuraava komento k",
        "YCvth2Q",
        "^Z]YU",
        "[(wT%",
        "#/rWp",
        "U.<4>N",
        "i3w<y-|",
        "uNxyTN '",
        " izdelka> ",
        "ea UNC ",
        "l=5@_",
        "040104B0",
        "CrF<u)",
        "a (OOBE), aktualiz",
        "X= Uw",
        "{kU4K",
        "hoRL2",
        "J!s:2a",
        ">OA7<]b",
        "!A+{'",
        "Y5<+@Y",
        "iMNet",
        "cj*tB",
        "(6Wu,'",
        "%YJa:",
        "'[1wg<",
        "@jt>3[",
        "vne inform",
        "]~IH(",
        "\\}}*^",
        "CDlpRegistrar::CheckInitialized",
        "9vaw:",
        "w*,)w",
        " Microsoft Corporation. K",
        "18j_-j",
        "VQjB8",
        "'k11)",
        "lQ_6o",
        "L^='M^Y",
        "V81Q;",
        " o%e!",
        "%.{ncu",
        "eP@P|P",
        "74w&4",
        "FTL0b",
        "*':vL",
        ":D}XbeO",
        "\\;e\\;",
        "*C\\e]-",
        "yxgh|-9=",
        "pabeigt",
        "w(<bZ",
        "<A/mcv",
        "w^?I)",
        "T#3!hT",
        "m i^,K\"M",
        "x_B<*7'6",
        "*:T4'",
        "u\"dc{",
        "uY>I'",
        "| ?)(",
        " na starost nasazen",
        "X7T@)",
        "Uyumluluk",
        "$L^S3",
        "8ikXM",
        "{f^Q~a",
        "\\0=qu{",
        "5{-RF8.y",
        "[G=lF",
        " migracji. Interfejs u",
        "\\U$31",
        "ve selected doesn",
        "sd|NG1",
        "&>Nlj",
        "0LQ*5",
        "V;Iy$_",
        "=(8F%",
        "d[cFj.$.",
        "Z|uwh",
        "suBZw",
        "Voorbereiden2Setup kan de bestaande Setup-ervaring niet starten\"Setup kan Install.exe niet starten",
        "IF0e>kK",
        " dans le r",
        "ko izku",
        "mtZBn",
        "a><*K",
        "D]d|.",
        "SPExecuteCleanup",
        ";&bvh",
        "7Kszh",
        "r fel uppst",
        "\\WJdJ",
        "Q39S^",
        "0~0Y0 ",
        "Kqo&s",
        "!:LOR/",
        ">*?K?Q?",
        "x/zGZ",
        "HN{K[h",
        "Azione: il programma di installazione inserir",
        "v8XZe",
        "!lY?ztVX0",
        "F AqT",
        "adovanou verzi k",
        "(=*Z(",
        "i beavatkoz",
        "ZqV<G",
        ":QhHL",
        "R/|Jb",
        "x!FG6",
        "mp&|F",
        "s!o`~J",
        "Mkr7i",
        "O~+H2c",
        "}p6}wK}",
        "hV3.D",
        "Kw|%5rG",
        "'Ii+CL",
        "z8sNy",
        "V\\:'v",
        "s<h#U",
        "w EVY^",
        "R%TjT/z",
        "7A8Ug",
        "Rz<u_",
        "ea,&b",
        " T/Y<",
        "5E}1]",
        "*gA'Q",
        "8}G\\O",
        "-GtL$",
        "7PfQT",
        ";xv|\"g+",
        "h\"_>2_n",
        "9%$JBY",
        "yACQP",
        "w]\"VA",
        "/_GaGv",
        "r\\>=1",
        "Zkp:(",
        "71N{cD",
        "th-TH",
        "E?RI6",
        "s+%NO",
        "CreateFontIndirectW",
        "F%%g,K",
        "iJI(T",
        "Ur)kJ",
        "8,;}WN",
        "`CfN#;%",
        "`7Rj#m",
        ".CRT$XCZ",
        "7}aA-;",
        "d41#=",
        "9K'/y",
        ">%?=?S?e?z?",
        "qVhQ{",
        "_~.f8",
        "s-kBI",
        "be-BY",
        "6SZD,",
        "t-fD*",
        "~3Ei'",
        " galima paleisti s",
        ":zqWH",
        ">ITM0T~",
        "ZCL\\k?",
        "t\"jdY",
        "Qh$0o",
        "cPq}R",
        "eno, bele",
        "YrH/9n)y",
        "Kx+%w~",
        "gt@H>",
        " je prilagojen skript, ki izvede opravila, ko namestitev ne uspe in se operacijski sistem v ra",
        "cutant Windows 7 Entreprise. Il ne veut pas que l",
        "mm)6V",
        "nd / PBRUpdate este setat la valoarea Disable, instalarea nu va actualiza ",
        "}7X!i",
        "llningar f",
        "GGlHY>",
        "I%>*t",
        "QOf\"H",
        " a ocorrer a partir de uma localiza",
        "Nr:*Y)",
        "1hKl]}cdyJ",
        "~gbi~",
        "est pas prise en charge. La version minimale requise est Windows XP avec le Service Pack",
        "Failed to convert NT path %s to DOS path. Error: 0x%08X",
        ",t1a'",
        "jK4a2",
        "A[En+",
        "2-2R2w2",
        "vca potrebuje cez noc inovova",
        "0h49pt",
        "kc=\\J",
        "5%535T5n5{5",
        "d>9 6",
        "%bI&U",
        "X-!I`!",
        ".CRT$XIAA",
        "o. Liberte algum espa",
        "0w4Nu",
        "3.D${",
        "Teine v",
        "dM/WtI",
        "!,[)'",
        "v~oIB",
        "((Bx,R ",
        "=rgRV,",
        "c6rr;",
        "j\\Zf;Ty",
        "taluje alebo inovuje Windows. Tieto argumenty pr",
        "T+Owa",
        "n\"+Q:",
        "nCzz:",
        "0@y$@0",
        "~4LZl",
        "6:}>w",
        " u#bd",
        "'OE\\D>",
        "h%|gO+q",
        " #{w6,",
        "2x\"_2+",
        "rTkYS=",
        "AWDz\\",
        "`r}b^",
        "a atjaunin",
        "EULA ",
        "\"oyZy@U",
        "zati kapcsolattal a megadott f",
        "5K65\\",
        "j!1!LT",
        "~ :X-P",
        "mbO*Z~=",
        "1N=){",
        "#'_j6",
        "a sa vy",
        ")c/|V",
        "2<|ij_3X",
        "l+p]~",
        "g<\\[GA7",
        "/J[*J<",
        " ~SkfB",
        "Exemplo : setup.exe / auto upgrade / noreboot",
        "yfO>+",
        "sxTe{",
        "=A=G=z=",
        "bd#.@",
        "Setup.exe instalira ili nadogra",
        "|^Y:<",
        "3bInz",
        "]}tSU",
        "|W\"Nl",
        "VdNr6",
        "C9m;^;",
        "18)@2",
        "<gz C",
        "mu Windows 10-In",
        "h3@]`",
        ">%{?z",
        "+dQ[9",
        "Segoe UI Light",
        "hqN}NN",
        "=DgXW",
        "tos komandrindas argumentus var izmantot, lai modific",
        "EAz^+",
        "7PIT ]",
        "Wcq+KqD",
        "_3y%|",
        "Wyy=x",
        "Compatibilidad",
        "dzis: / PBRUpdate <parametrs> ",
        "Z$~S}i",
        "N$1,a9",
        "uvbF=",
        "0V1f1l1",
        "RF|Hi",
        "kuGn`",
        "`wUx/",
        "c_bNUM",
        "P4nRC",
        "iK+eK ",
        "+o`R++",
        "cia sa vykon",
        "O(W,W",
        "L:RTb",
        "hGVh5",
        "wq5gwZ",
        "4EPH/",
        "5bHSsB7",
        ",d9Gh",
        "7#{^6",
        "qw`a4?;",
        "816;~FVn",
        "iR6cqK",
        "V,(B\"(B",
        "Parameetrid: faili setupcomplete.cmd kohalik failitee v",
        "6w(.T;",
        "ntF`A",
        "5GE15",
        "CDlpFile::Serialize",
        "si folyamatot3A telep",
        "aX$zH$",
        "je}t3",
        "!q/Um",
        ".1Wyst",
        "Ready to install Windows 10?",
        "iendamine toimub hulgilitsentsiga kandjalt v",
        "PnkZn",
        "R8Nf5",
        "t skriptu setuprollback.cmd gad",
        "Stikalo: / Postoobe <lokacija>\\setupcomplete.cmd ",
        "},^K+",
        "odp$18N",
        "ib(6Gc",
        "9@ms)",
        "S5umm",
        ";*uvx",
        "rer installationsprogrammet den telemetri, der er genereret af installationen.  Men n",
        "E?Qm{^",
        "Por ejemplo: setup.exe / auto upgrade",
        "pf#8:",
        "+B;,R+",
        "9<(#p",
        "K]o/x{",
        "B%::D",
        "~-&CK0nJ",
        "tBk!J",
        "ivcVL3@",
        "DlMG/",
        " OOBE) darb",
        "y5'/~",
        "FIXED",
        "\\w1]X",
        "[bgMuY",
        "(S?e{m",
        "a komandna linija upu",
        "R.H.L",
        "1BIpp",
        "!zrS/",
        "+c-4/",
        "?&:n$",
        "Beispiel: setup.exe / auto upgrade / quiet",
        "2Valitsemasi arkkitehtuuri ei vastaa tietokonettasi",
        "G0PE=",
        "g;\"}+",
        "O/T_o]",
        "*d I S",
        "yC#Bbd",
        "c~=&+",
        "es-US",
        "8DRt{",
        "/$C:8",
        "{u;<G>yu7~|",
        "JWL}g2",
        "T_VMOu",
        "]n2Aw",
        "YCZ~_",
        "g till specific.wim ",
        "R{%Ohfc(",
        "ghCU\"",
        "t%^9`",
        "apKpp",
        "ajVbH61",
        "ECo/h",
        "sdZCQ,",
        "e{<3;",
        "rw-RW",
        "2CNC/Y",
        "Xf'U^c",
        "2}vqm",
        "oDG05J",
        "=3|>]x",
        "9x&ZV;V`x",
        "ojXh4",
        ";1X.k",
        ",C[Y%K",
        "ba: Ja / Telemetry ir iestat",
        " desteklenmiyor. Gereken en d",
        "ncia da Instala",
        "sqnRb",
        "x8!D$",
        "Ud\\sorn",
        "L'installation de Windows ne peut pas d",
        "cxV]x",
        "&Prekli",
        "xB]m2",
        ";4kxr",
        "y=[Ic",
        "hk~g(M",
        ", by mohl cht",
        "fqYbs",
        "k}hGkO",
        "@J<>[",
        "#>;'/",
        "848J8U8",
        ".?AVCBitmapDialog@UX@Common@ConX@@",
        "C(qu(Y",
        "rodowiska wycofywania) ",
        "WdDVg",
        "Qzye/",
        "_G`SK",
        "M|'MK^",
        "uje, ",
        "hoz legal",
        "250706205017Z0~1",
        " : setup.exe / auto upgrade / noreboot",
        ":[_Nu",
        "'b_!17~j",
        ">x6DJ",
        ">9,E-",
        "SbdIIp1",
        "Z UeKUYR",
        "YU\"Ys",
        "L.#N@/",
        " gerekir.Alternatif olarak, / showoobe Hi",
        "Tq{E\\",
        "VersionMatch: Verifying that the target binary at [%s] exists...",
        "=2=1QFA",
        "Akcia: Automatick",
        "se-NO",
        ".G=#/mS",
        "z0X=]0",
        "2r(b1",
        "j2fC|",
        "Z~.jZ",
        "S\"&8.+O",
        "D+)+^",
        "huw%iHC7",
        "d5?HQMz",
        "vs2Fel n",
        ":t)`A",
        "\\<EYtG",
        "dEEkU+mS",
        "i Windows Update din aplica",
        "2}L?3",
        "]4e+_",
        "Parametreler : 5x5 ",
        "DyxD&",
        "m+|rXe",
        "}OSG7",
        "ks-Deva-IN",
        "Br\\#lI",
        "#Er du sikker p",
        "V*f| O",
        "z\\%p`p",
        "M;6\"\\",
        "P+Jk+",
        "Microsoft Corporation0",
        "<r9!TA",
        "t.Np\\",
        "Sy(c_}/",
        ".lReikia bent 350 MB, kad b",
        "8]e>94!",
        "ranka perkels visus tvarkykl",
        "kseltmek istiyor.Kurulum kullan",
        "Cancel&ar",
        "uriranja). ",
        "O}S}K",
        "Xf\\4j",
        "Installation de Windows 10;L",
        "0#*;f",
        "Xhr,AHS",
        "5|<sv#{",
        ": / showoobe <param",
        "AP<x+",
        "pap-029",
        ">/>A>R>Y>_>d>p>",
        "tfO%_",
        ">Ico3",
        "a3GyI",
        " felirat",
        "lineen p",
        "Den arkitektur, du har valgt, stemmer ikke overens med din pc. Hvis f.eks. din pc k",
        "CDlpManager::GetDwordProperty",
        "VhH9A",
        "-?p6*",
        "vetkez",
        "rSo`Ssqf",
        "cpsC7fB",
        "\"Windows 10 y",
        "Er is ten minste 350 MB opslagruimte nodig om de installatie uit te voeren. Maak ruimte vrij en probeer het vervolgens opnieuw.bAls u deze versie van Windows 10 installeert, kunt u %1!s! niet meer terugzetten. Wilt u doorgaan?",
        "]Xh0#",
        "%#Ue`u^h>zy",
        "ier specificat",
        "l(c3R",
        "Y{t}~t=",
        "7=8U8k8v8",
        "j^HYm",
        "[0xD7",
        "n kontekstissa, joten sill",
        "$4V\"Zh;",
        "zMhep",
        "iw\"4cD",
        "ejs<2",
        "rnyezet",
        "B\"|B&QWc",
        "RegValueEnumAction::Enumerate: Error enumerating contents of key: %s\\%s (error %d)",
        "yP CI",
        "SRS --",
        "CreateProcessAsUserW",
        "Un5WmO",
        "S?AEHli",
        "LsQz'ez)",
        "a>_?A-",
        "2f@g>",
        "^06*7",
        "CDlpFile::GetTargetFullPath",
        "r / migratealldrivers er satt til All, pr",
        "A iniciar os preparativosHA Configura",
        "eu&v2\\",
        "OriginalFilename",
        "\"g98z",
        "~>=U[",
        "KJ]WI;",
        "B!G!OS",
        "ndarna manuellt ska g",
        "j8&/p",
        "ygrcW",
        "2Sj{Y,}i\"t",
        "NjUU,`",
        "CDlpManager::DeleteDwordProperty",
        "iT;,#",
        "ndaren endast beh",
        "r installationsprogrammet slutf",
        "+\\stx~\\",
        "rd: N",
        "KDc4!",
        "G<Z@Q2'",
        "~#(S78",
        "Af`SWcs8",
        "WG)LV",
        "@.reloc",
        "Kf?{U",
        "V2JVq",
        ",$Wjr^*7o",
        "L>6Po",
        "vne, ak je prep",
        "$<T{%+q",
        "\\\\?\\Volume{",
        "ZQPAA",
        "FSEzN",
        ".ZD{33YZ",
        "tisku datora atk",
        "nsker ",
        "|JSVE$",
        "9wx{F",
        "*..'q",
        "c{;6A",
        "R7cqo",
        ")4#`g",
        "6A}3{3",
        "aIn1{w",
        "?laIL",
        "^}bz15",
        "-OaK`R",
        "'Jo#|",
        "_~LzTV",
        "')9VI",
        "B&V?l",
        "Pgw*kM",
        "4.4W4",
        "IS4XS",
        "u5N!V",
        "nnzq<",
        "oH5eL",
        "\\{f,Y<z",
        "=KR0x|",
        "bn-IN",
        "gMj;R",
        "18^/o",
        "Yz]\">t",
        "CE!A= **zN",
        "0lf:k8",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "rgmisel taask",
        "c,6V`",
        "Q(:;Q",
        "8N*rZ :z",
        "8kbZ#",
        "6%brL",
        "_Q$R}",
        "u/t,(9^",
        "bSEPo",
        "4C'GS",
        "3`kz'",
        "4E{h/",
        "9yD#OYE",
        "lCnH>",
        "h{]2%",
        "Microsoft Time-Stamp PCA 20100",
        "HaI;}",
        "emiet v",
        "uRx~ ",
        "8&9-9",
        "e0SZd",
        "&eE}$",
        "ad: setup.exe / auto upgrade / migratealldrivers none",
        "rvQ.DF",
        "jy7b/",
        "@@@   @@@",
        "ii de diagnostic de la PC-uri de test, ",
        "|6^W!=",
        "mtoqn",
        "ho programu.6Instala",
        "a}h!{b'$",
        "Action : injecte le fichier setupcomplete.cmd ",
        "CBdx~",
        "irn|J",
        "        name=\"cabinet.dll\"",
        "8['{<",
        "tl6Uk",
        "Parametrai : Upgrade; DataOnly; Clean ",
        "p520n",
        "n\"t$4",
        "',/*o\"N8",
        "3XBs3i",
        "Z{m Pd",
        "'lT'%",
        "None, worden er geen stuurprogramma",
        "~G'Lf",
        "$WT*$I",
        "(q1/L",
        "=$=0=t=x=",
        "ho41a",
        "V:}]g",
        "!nugv",
        "YH)TmUT",
        "a de instalare a suportului media ",
        "By!Ae\"",
        "An3cw",
        "nTBV6",
        "s!jtwM",
        "|uF\"1",
        " a sk",
        "sKE@$ ",
        "d'X1-",
        "t opr",
        ";b b/",
        "ivitada3Installiprogramm ei saa faili Install.exe k",
        "Dm`ijo",
        "l-^}]K",
        "h2b<,",
        "0yr)jg0",
        "MJKHM",
        "\"&Ec@",
        "]~D##",
        "ba Full, lietot",
        "Na primer: setup.exe / auto upgrade / noreboot",
        "fq%g:",
        ")MxN(",
        "$*1LT[",
        "XJy22k",
        ",a\\!f",
        "Xb;\\T",
        "nssnitt, inklusive ",
        ",?2av",
        "1/2e2}2",
        "&{0F)",
        "DJd2L",
        "?30*l",
        " Windows>Namestitveni program ne prepozna jezika uporabni",
        ";-+W.y",
        "|Qf}L!",
        "PO@g1",
        "*H2CA?",
        "C}!TSy",
        "g)>qCb",
        ")<QGqV",
        ".<,$*E",
        "6[5km",
        ">V>%G",
        "^hx[^b",
        "jr)%-",
        "Jt\"q/",
        "l%?2:",
        "Pj?/u",
        "Voorbeeld: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "rsta anv",
        ":[#z\"{{iSN",
        ">ky:R",
        "I.<v@G",
        "c%XKzA",
        "|_wY{",
        "|U?L9",
        "7g:3dU",
        "PPP```",
        "8WjP9Y",
        "@FVVY|",
        "e},!k",
        "lwz51",
        "CY?i|",
        "e$'rm",
        "%\\Kx}",
        "N|PB`9",
        "(^4fG",
        "%$)hAn",
        "U\"=p9b",
        "}1$_=C",
        "tirecek.Kurulum, belirtilen konumun t",
        " aucun, OOBE est ignor",
        "n, pero antes del primer inicio de sesi",
        "-NBjv",
        "`<O<*XF=V",
        "=C-KA_^\"/",
        "em$DlkT",
        "gN57Z",
        "bQLKU",
        "S&GR(",
        "5[4O7",
        "->a[f",
        "_~1o7",
        "z!;S'r",
        "Zq_D8-",
        "|GCG+",
        "r#i07",
        "M.`]M",
        "UR:$^~",
        "o corresponde a seu computador",
        "Administrator ",
        "K}-R<",
        "CopyRect",
        "fXh<Cc+",
        "irmeye ",
        "Enable",
        "=D=j=",
        " a programului de instalare este deja executat",
        "Kga4'",
        "d}p:A",
        "x)-z)",
        "9P9w9",
        "Handling: Installationsprogrammet genstarter ikke automatisk pc",
        ")W|nhg",
        "/|=|w@",
        "DrDW?L(",
        "Mn^v7-j",
        "UNC-netwerkpad naar een map met .inf-bestanden ",
        "x^G;}",
        "{i5p8",
        "%P|(=<",
        "sE@{RNQ",
        "1tx&:=8XQ",
        "c'f9$",
        "+l[,s",
        "jt a forr",
        "x`)NN",
        "j|@'vJ#",
        "_$l*>",
        "ste znova spusti",
        "s65SZ",
        "e zleci",
        ",(X72",
        "%'`I?",
        ",qHkS",
        "qU?Ed",
        "wu4!0",
        "*o[W1EWA",
        "\\lX1~",
        "rankai nepavyksta nustatyti UI kalbos",
        "a, aceptaci",
        "SetupDUUpdateFiles: Source directory [%s] does not exist.",
        "pravu spr",
        "; ;&;1;M;S;n;t;",
        "@?A|X",
        "O'JnT",
        "K5=l&",
        "g_t76",
        "3a5Zf.",
        "P5Kdp",
        "S@zs'|",
        "VKJ7KJ+1",
        "8' I{",
        "I>be3",
        "U;X\\@",
        "/p\"fBw:",
        "rsEUy",
        "Roy+J",
        ">Die ausgew",
        ">8L8^",
        "2OZ(g",
        "9;9A9",
        "'YjoO",
        "j'Ft{",
        "|<=ySK",
        "\"yC8B",
        "\\v$^A ",
        "Xf$P6l",
        "ajte ponovo da pokrenete alatku i vodite ra",
        ";g=4-",
        "1k1fE",
        "interface utilisateur du programme d",
        "> ><>^>z>",
        "aO!KDk",
        "Comutator: / showoobe <parametru> ",
        "gHrQu",
        "U9OT5",
        "<Y)OQ",
        "_QKs9",
        "2xj\"+O",
        "Setup.exe instal",
        "\\2Rn{\\",
        ".<>I(",
        "a8D;F",
        "CY%=Q&'",
        ">X8bm",
        ">Q?Hm",
        "zK7i=uj",
        "yv)?\"",
        "'9c f",
        "8\"\"~X",
        "fubWZ",
        "<pqlq",
        "rMbF+J",
        "Instalace Windows 10",
        "ntdll.dll",
        "eWindows 10 ",
        "Qm8F\"!",
        "n a megadott helyen tal",
        "e31^}",
        "ySuwc",
        ";gn~a;ncKk/P >",
        "Exemplu: setup.exe / auto upgrade / showoobe full",
        "prs5n",
        "T2\"\"J",
        "e|.u]Y",
        "L7#3koS",
        "q]`_Y",
        "*D:)h-",
        "0FQ-0P",
        "iereWim\\wim_particularizat.wim",
        "7 (\\#",
        "7oH@{V",
        "unar ponovo pokrene, do",
        "PPWSW",
        ",CC~,",
        "8=;hp",
        "*k\\5>",
        "site ",
        "e4SKX1nj%4C+",
        " konumundan ger",
        "ld`$Xdl<",
        " povolenie a sie",
        "UIB;M%",
        "uhy=,#",
        "7SfU_",
        "(R5rF",
        "r#}(?)(W",
        "~~v~v",
        "G(!O&",
        "\"va0:",
        "gHKLm?",
        "Ta=yf",
        "Yns&6",
        "3qSez",
        "Windows 7 Enterprise",
        "Configurar",
        "D~r?3",
        "<1Rt ~",
        "5(5<5S5f5v5",
        "admin",
        "ku-Arab",
        ">d$:`",
        "Toiminto: virheen yhteydess",
        "1pL6v",
        "t. Ha a / PBRUpdate ",
        "*O]baq",
        "+PupW",
        "rKpKF",
        "n: cuando / PBRUpdate se establece en Enable, la instalaci",
        "a>9\"r",
        "|d&_C",
        "kSt2c",
        "byFBy`#NK(",
        " 4bda(",
        "PKeK$E",
        "9urn#",
        "Parameter: / PBRUpdate <parameter> ",
        "vne m",
        "Ejemplo: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "h7}FY(",
        "-dcyEx",
        "ho umiestnenia. Setupcomplete.cmd je prisp",
        "LK;3O",
        ">zn[o",
        "%`DLy'",
        " ist ein benutzerdefiniertes Skript, mit dem Tasks nach Abschluss der Installation aber vor der ersten Benutzeranmeldung ausgef",
        "3>eQXDPk",
        "GN^M/",
        "AJM{AN",
        "eXIEX0IF",
        "_De}n",
        "!5Wy\\=w",
        "V[q=C.",
        "^YgYT",
        "/]-nY\\oc",
        "'2pvLK",
        "U@nkcE\\t",
        "fqe,3",
        "WJRbD",
        "?G\"]q",
        "'_$sf",
        "tCr--",
        " Z&&d",
        "\\fZ63",
        "-D&]C7(Opg",
        "0!kn0",
        "WShpw@",
        "6?v}n",
        "6&y~s'(",
        "\\`|-.0=V3`~6",
        "aN?{ Q",
        "fO7Anh",
        "x=bwsP,~Xu/",
        "}Xe/4",
        "r@j)`",
        "\\8k*$",
        "B %BT",
        "!gl40",
        "#j]m)%",
        "base\\ntsetup\\setupplatform\\lib\\static\\utilities.cpp",
        "$C5Lx",
        "5fRiH",
        "lkomstprogrammet. Om None anv",
        "F*t8H",
        "f',{,e",
        "?sX^^",
        "lU#,~",
        "rg]dE",
        " disco rigido",
        ".::;?0_",
        "MVeuillez relancer l",
        "&)7ue!",
        "^~~<RY",
        "*[[iZs",
        "8U+R@",
        ">::255",
        "tted Windows Update.",
        "V>&[|k",
        "o da Instala",
        "Language Pack Location",
        "V)3(%dt:k]d",
        ":W;3<R<",
        "i=o Y",
        "\\Zy/}0",
        "l?bm>_",
        "            <!--This Id value indicates the application supports Windows 7/Server 2008 R2 functionality-->",
        "[\"[Mln",
        "+<`+T",
        "2/sG~F",
        "G-J{6",
        " / Telemetry nastaven",
        "|$ab@1",
        "l=]BO",
        "XD@QZn",
        "anas programma neveiks autom",
        "#i8[f",
        ".,r'B",
        "t!14=",
        "zati el",
        "d Product Key. Tento parameter nie je potrebn",
        "G#1E-",
        "S#_inr",
        "A Configura",
        "0q^vi",
        "@/;_$z",
        "mPrUy",
        "Sm@x ",
        "QAd??M+",
        "&8M=q",
        "zB}$W` ",
        "9c:j:",
        "unalnik, nato pa znova za",
        "\\}g`]",
        "+!]Ap1_",
        "UVHixv",
        "|/$G&",
        "#VK0$",
        "=*bnI",
        "!Hw2w*",
        "Gkj`Q",
        "0$0H0",
        "Ouy~,",
        "/G]O)",
        "anas programma nemigr",
        "iT!V8'",
        "YXvhU",
        "ytyneet driver.inf-tiedostot asennusprosessin aikana. Asennusohjelma hakee rekursiivisesti m",
        "z7[+-",
        "Hb&#q",
        "cqA0|8",
        "xY^V}",
        "zfxY!",
        "5#85T",
        "Error [0x%X] deleting file: [%s]",
        "ciowe problemy z po",
        "a)RA$",
        "[_?^o",
        "HKxvl",
        "N(};/?",
        "}~ zP",
        "/Media %s",
        "I1ai!NQ",
        "4<8r;",
        "#r>;|",
        "cY*_u",
        "Op<?Kx",
        "@[@/ ",
        "{~N9F",
        "SL{jM",
        "1hbVU",
        "!]YRc",
        "XS^<}",
        "&1arC",
        "PBww\"",
        "berein.",
        "GUT30",
        "%q'qQ",
        "        name=\"powrprof.dll\"",
        "w0lcc",
        ")\\Q|_",
        "f$>`0",
        "2yXI5",
        "O\"ifSET$5",
        "GetTickCount64",
        "B7VV6",
        "`A6LT",
        "'*C=sh",
        "C#>.k",
        "wj<DX",
        "?mB)$",
        "t|/3u",
        "-gc7=",
        "4rV>O</}OgJ",
        "/?$$?0",
        "Copying [%s] -> [%s]...",
        "p*EX}",
        "w>Y{~P3:",
        "bb-B)",
        ":/;q;x;",
        "E{#Co",
        "j~%KHh",
        "e/YKt",
        "+h4q]",
        "4P3Sd",
        "8Go)+#",
        "$\"V4&",
        "#mvl5",
        "'}<Gx",
        "ljer r",
        "m:\"Zfjb",
        "4UIbV",
        "|*vq@P",
        "H}lR7E",
        "<OpZ=^",
        "r;J4<",
        "hW>Mh(",
        "r en instans av installationsprogrammet redan k",
        "V(eV5[",
        " copier aux emplacements, qui n",
        "2lr=4ix",
        "w_#jh,",
        "=D!TzV",
        "2[~TM",
        "f1C<&^",
        "Setup.exe installerar eller uppgraderar Windows. F",
        "Ng,]EU-",
        "4F>~2-",
        "FT#}V",
        "Si|yv|",
        "g1|d1",
        "r 64-bitarsversionen av Windows. F",
        "p&p-Y;*",
        "KoT=1\"",
        "gFM9a",
        "y7 x\\",
        "gh< h",
        "^6)WRSb",
        " znova za",
        "Jc=Zl",
        "WRJ^-S",
        "t-f]DIe{",
        "0op_'",
        "E|r%o",
        "+nedd<",
        "nD'5q",
        "t3F;u",
        "p.R;R",
        "y# i36gad'c",
        "kk|$U",
        "@<F1g",
        "yd OK",
        "e3X:+",
        "4&kRt=",
        ":oqHm",
        ".3&aV",
        " lieu ",
        ".text$mn",
        "+RS;$",
        "HOJB>",
        "TF\"80",
        "'vI.p",
        "7<9{6",
        "0;,Z%",
        "gp'uV",
        ",_|s$",
        ">D/3t",
        " aufzurufen: ",
        "i\\GLi",
        "%&AVK",
        "Wm9S*B",
        "Snart klar8Det g",
        "}+m^u",
        "wMyzv",
        "3w|uU",
        "C0F?m",
        "%g,P>",
        "afKI0",
        "rKZY*",
        "\\'GuU",
        "VON]+",
        "G+Zn9",
        "z*'Gv",
        "rg for, at du har valgt den rigtige arkitektur.!Der opstod et problem under startaDer opstod et problem under start. Luk v",
        "W=!7*vI",
        "tre de ligne de commande. Dans l",
        "o recolhe e carrega todos os dados de telemetria gerados pela instala",
        "Error registering working directory for disk cleanup, Error = 0x%X",
        "BoxDeletePath: Error deleting path [%s]!  Error = 0x%X",
        "OjpGt",
        "6?XYD",
        "VOR8Y",
        "?[kyL",
        "rbereder %d %%",
        "AllGg",
        "g%(aW",
        "e1q8+&A'N",
        "_X8q;%,",
        "rO1++",
        "*#Aa]",
        ")\\-=z",
        ":6:O:",
        "XV3Ai",
        "h`8ogq",
        "TR6GrOg",
        ":c%wT",
        "EOf=*?1",
        "^YWRa_",
        "zdrg5;",
        "Es@ja",
        "=}|SU",
        "ri a kezd",
        "_^[Y]",
        "+k&)=",
        "2p[1g",
        "(''%`",
        "U1d~+v",
        "20u:;=",
        "CMediaScenarioCtrl::ShouldPreserveWorkingDir",
        "H ;N t",
        "M}gI~7",
        "#9s7Na",
        " T+[M",
        " Windows 10;",
        "GwyZ9",
        "0$0I0r0",
        "dCaP9",
        "9HUmi",
        "\\Dr:VA",
        "<4<K<T<]<~<",
        "ni}\\?N",
        "@j9AzQ",
        "!958~a",
        ";^W,m",
        "|(X.Q",
        "f/Y^PBQ",
        "QP}>ol",
        "uh,kUAV",
        "bw5FM",
        "Pomocn",
        "3_.8_v",
        "}L7|Skwg",
        "pSA8a",
        "F ;C t2",
        "Zao$U",
        "h1i)L",
        "l`d?W",
        "qe,Q:D",
        "installation. En revanche, lorsque / migratealldrivers est d",
        "^KVe0",
        "ZFzgk",
        "      </security>",
        "fA.#>C,]`_",
        "sihU~",
        "{u0qs",
        "j~F3e7",
        "Tdj%%",
        "_DLT\\",
        "}Yoeu",
        "o^p${",
        "re i gang. G",
        "ste anv",
        "F\\W@!h",
        "!ds)l",
        ":2dD>v",
        "Elp],",
        "OuWv$dr*",
        "JS`n}",
        "m Windows XP s bal",
        "d;5,-",
        "_lock",
        "&I'%F",
        "54R?}",
        "[EgBt",
        " o cargar",
        "wVj5y",
        "^*aK;",
        "LPs*i",
        "Storage Reserve Manager Unavailable: [0x%X]",
        " soubor setupcomplete.cmd ze zadan",
        " se b",
        "Microsoft Code Signing PCA 2010",
        "&O4QP",
        "'W`<p4`$$",
        "3NpLG",
        "4zy N{}",
        ".&$pXs",
        "0}k0d0D0f0o0",
        "lfO:E",
        "Parameter: / copylogs <placering> ",
        "n$\\Y3",
        "se). ",
        "o\"7D8",
        "<^=/]c",
        "'9\"4J",
        "A'i>@",
        "K?Vz>",
        "tre> ",
        "=O*@I{",
        "#rNLL0",
        "`Drt:",
        "zSuRL",
        "+fRWl",
        "qena\\~",
        "B&e3R6!e",
        "T8w9x",
        "$}'s};%}_",
        "q?#S4",
        ".%w2y",
        "B>Fk7",
        "N~~$M",
        "?TT<g",
        "(^~xZ",
        "does not",
        "ende netv",
        ">a&:C",
        "d Product Key 5x5 ",
        " Windowsin versio ei ole tuettu. V",
        "PGJkP",
        "|b_y!C;",
        "07A)f",
        "B_qe02!u",
        "r(Jqm",
        "WQ-zMht",
        "W8bJ8b",
        "A<d{9$",
        "_~' QQ",
        "CDlpFile::GetSourceUrl",
        "Failed to move working path: [0x%X]",
        ".?AVCAzureScenarioCtrl@@",
        "ld@1Q",
        "GQwkJ(",
        "k;}h~",
        "As]:1vy,",
        "_Y]d9",
        "CDlpManager::ShutdownSystem",
        ":<AKh",
        "nfJ^i",
        "\\M+jO",
        "@V@I^X",
        "Waiting for actions thread to exit.",
        "%Qv-XM",
        "RoPoT",
        "sYX+F",
        "ranka!",
        "k&]bA",
        " czynno",
        "x1f(p6G",
        "}+F#pn",
        " q2q&q.",
        "Suporte",
        "UOQp\"Z",
        "a^AbC:",
        "do zadan",
        ">{UF$v",
        "o9m*e",
        "yn_eO",
        "i]:p>",
        " nytt fra begynnelsen",
        "e da se koristi za uskla",
        "7HO/1",
        ":a/\\lKn",
        " em execu",
        "L<AqGU",
        "C/IK!",
        "re connexion de l",
        "5 K_F",
        "z_]6L",
        "u[E-Y",
        "i-/6:",
        "Q~e*|+",
        "T}sU_",
        "(k3qlD",
        ";g@v`",
        "*ROAR",
        "/t)~x",
        "Failed to read SetupDUConsumed RegKey. Assuming not consumed  - bSetupDUFromUA: [%s]",
        "^#&\"R",
        "Folytat",
        "cznik: / installfrom <lokalizacja> ",
        "ranka nebandys perkelti joki",
        "j@x/Ge",
        "@)K#!",
        "\\p{+`",
        ",[n7/",
        " Y\"j-",
        ",EH/Ww",
        "Ua/$]H ",
        "nXlUCOQ7",
        "irmeyecek. ",
        "tres : All; None",
        ";[Od5",
        "ivitatakse samasuguste ",
        "=@=hp",
        ".aPKo.",
        "DY\"eI",
        "Z`DP]",
        "W6aY^",
        "<M %m",
        " }VN{",
        "unare odeljenja koji rade pod operativnim sistemom Windows 7 Enterprise. Ne ",
        "Compatibiliteit",
        "/Web %s",
        "C_.]T",
        "C9{(a",
        "|g~6#YI",
        ".6YMuy",
        "JFHq$\\",
        "Prebacivanje: / Telemetry <parametar> ",
        "uRJbR",
        " a Windows XP Service Pack 3 szervizcsomaggal.zHaszn",
        "S_y,J",
        " Windows 10?o",
        "4:::e}",
        "Xf9ABt",
        "+Q^D?",
        "etky nastavenia pou",
        "rVd:V",
        "XuR]Rw",
        "AJLf}",
        "(=8~D~",
        "dzi lietojiet tikai test",
        "kseltir. Windows y",
        "ivitys Windows vNext -k",
        "qP/I%b4O)1`8",
        "Ikw6S5",
        "h=*;~@_",
        "jWqjW",
        "hw4eQ;Y",
        "|p]J<\\",
        "=rw`U:",
        "2;UahKE",
        "cbM{hW",
        "DW;q2",
        "6TQl'",
        "Z=zvN~\\",
        "jsiPR",
        "nbEK_|",
        "An admin wants to upgrade the departments PCs from Windows 7 Enterprise overnight.She does not want the setup user interface to appear, but she does want the end users to manually go through the Out of box experience(known as OOBE) experience.The following command line can be used to orchestrate the full upgrade to Windows vNext, requiring user input only once the machine reaches OOBE : ",
        "mp%D%",
        "m$P&rc",
        "_wtoi",
        "P%RdWM4",
        "6[C@o",
        "D(Xv/",
        "Gxb3dI",
        "]!0\"^x",
        "Rw>I|",
        "d6DJ2",
        ".+3j1",
        "q=*SL",
        "C^OO-v:",
        "FPI2V^",
        "L#ud:",
        "b-f<c",
        "tk`z_K",
        "aL\":J$",
        "IY~oE",
        ">xia>|",
        " : / noreboot ",
        "!;9ZMw",
        "o~3cZ",
        "EIWbT",
        "XjJUV",
        "YPPPh",
        "5S]*:<",
        ": / installfrom <umiestnenie> ",
        "CDlpManager::GetStringPropertyByIndex",
        "4W{il6I",
        "iAA(<hg",
        "6zxW^",
        "0RAVr",
        "Td9PO",
        "EA(Qy",
        "J#F%g",
        " program znova z okna p",
        "2hUCW0",
        "(7IUFE",
        "tEXtSoftware",
        "MAvko",
        ".swwE",
        "adniki przyjmuj",
        "QuadwordCount",
        "=*.o#99;",
        "5ke}+",
        ",_K,o",
        " OOBE-oplevelsen (f",
        "ts parametrs None, uzst",
        "li na komputerze jest zainstalowana 64-bitowa wersja systemu Windows, nale",
        "o-kZ >]o\\",
        "}iX_j`",
        "ni dostop do navedene poti. Ta ukaz se izvede v kontekstu sistema, zato morda nima dovoljenj za kopiranje na lokacije, ki zahtevajo dovoljenja uporabnika. ",
        "O_(Az;{O",
        ">rmpBb",
        "tirilmi",
        "s van folyamatban. Tov",
        "~P,C2",
        " Windows 10,",
        " PBR ",
        "swho|LmU",
        "?+>aM\"",
        "Global\\Microsoft.Windows.Setup.Box",
        "ActionableCompat",
        "Or7&Af",
        "<!rTq",
        "<' H/",
        "rd: Datorn startas inte om automatiskt n",
        "lg/}Em",
        " nebo m",
        "&@hr%j",
        "gExperimente executar a o programa de configura",
        "Ajd5g",
        "Zq@};",
        "5D[M,",
        "Stikalo: / auto <izbrana selitev> ",
        "LuZpy",
        "X h004MH",
        "Sh`t@",
        "'/#WB/^",
        "{$R(#Q",
        "\\XN,I",
        "Teeme m",
        "ProcessId",
        ":~7[M",
        "'L >y^",
        "9R*BOY",
        "iFDkZp",
        "(4[]P",
        ">hx\\M",
        "cia s v",
        "T\\{e2)",
        ")UaUW",
        "IP:-Q",
        "0 0,080D0P0\\0h0t0",
        "4- ';",
        "MtvvYw",
        "-Leba",
        "ySi(3",
        "5%|F)",
        "o de utilizador. ",
        "B%:;Y",
        "L`T|g",
        "><d@p<",
        "3=3D3a3h3}3",
        "%U2R~",
        "B$u=,",
        "P\\ HM",
        "042404B0",
        ". Restartujte pros",
        "b3,\"+",
        "P5_A5",
        "0#[eK",
        "J^Cmza`",
        "Y.x^%f",
        "u8+ZK",
        "K\\b=]",
        "Switch: / migratealldrivers <paramenter> ",
        "8?}j(}",
        ";8dDp\\7",
        "c9B}(J",
        "CompareStringW",
        "V_yA4p7W",
        "s que l",
        "kleme ba",
        "n!^0E",
        "na pot do datoteke specific.wim ",
        "B%8eV",
        "^eK%0",
        "){2Kg",
        "J.]qvG",
        "Sh`}@",
        "mq7Rd",
        "]2eIdL",
        "OD9F2*5",
        "tq&?{",
        "CSetupLangIniLoader::Initialize: Cannot save current directory",
        "M]`\\q1",
        "m=SK#;9",
        "Zha@oa",
        "7Oz6i",
        "A;[mQ",
        "tt. F",
        "nya fut. Lehet, hogy funkci",
        "qd<I!",
        "tre utilis",
        "Microsoft Time-Stamp Service",
        "pyTX*",
        "Akcia: In",
        "Frfq0l",
        " nu aib",
        "0*xL.rE",
        "S192f",
        "O#PEK)",
        "ava svaki UX instalacije, uklju",
        "LF(m8",
        "Q3Qj|",
        "\\X\"7y+L",
        "oP1Nm",
        "Z44B^",
        "H2F@;oW6L",
        "$DocZ",
        "?6Z\"-",
        "+:Y-2",
        ")xz7+xy",
        "gj\\=\\J",
        "><A'd",
        "2kVi:",
        "B?$:~",
        "n'b[6",
        " Service Pack 3.g",
        "anas UI un norises ekr",
        "rtraukta darb",
        " til: %1!s!",
        "~jytO/F",
        "ULTsNp",
        "c0W<^",
        ":-fjv",
        "CC}CC)",
        "CMicrodom_Blob",
        "xac37]",
        "''YTu",
        " System ",
        "I$MJs",
        "Pavyzdys: setup.exe / auto upgrade / showoobe full",
        "Fbmi>Z",
        "&E;Kt",
        ":]wm!z1",
        "$m'GR",
        "OOBE). La siguiente l",
        "NvocO",
        ",87m+",
        "ivityslokit",
        "IGpZ N&",
        "E0_o!n+",
        "Cf9Y*",
        "GxeP~4",
        "N{<4u",
        "}K!2}",
        "Primjer : setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "rs: setup.exe / auto upgrade / postrollback \\Mans_koplietojums\\skripts\\setuprollback.cmd",
        " invoce scriptul setuprollback.cmd dup",
        "<ETdD",
        " : / installdrivers <location> ",
        "zk>TI",
        "Kld&O",
        "YCnMMD",
        " procesului de instalare cheia de produs specific",
        "}SX=v",
        "u>{Xf",
        "/]f9`9C",
        "UYPBS",
        "IsDebuggerPresent",
        "Sklopka : / installdrivers <location> ",
        "ukg5C",
        "ta0#f",
        "6id-$e",
        "HO@\"f",
        "t]iUY",
        "72zp6+",
        "'Wi}A",
        "g3(Z>K",
        "Setup.exe ",
        "^WhIR/",
        "JGb0.",
        ">1>Y>",
        "cuter ",
        "YVz1-",
        "Ao`jv",
        " spune procesului de instalare s",
        "`#]@JO",
        "CC\" +",
        "Ru1lR",
        "<wTx1-L",
        "jl22z:",
        "y%m\"gBT",
        "NX{Kx",
        "lP4xr",
        "A-!la",
        "/\"f)0",
        "&^ZR`",
        "x;6xS",
        "LG@&>",
        " parametr None, po",
        "]){N=<)fI",
        "&(%QV",
        "Yt{(5F",
        "b<7^*Y",
        "[YxD.<",
        "v4m'd)",
        "o!U;R3",
        "/ showoobe ",
        "`rG)L",
        "B~\\f!",
        "CLP}5",
        "v~GkU",
        ". Uzst",
        "iiG?:",
        "!\"n\\C",
        "@qGIi",
        ":P=Y=W",
        "K Jdk",
        "/B/zs",
        ".UJei ",
        "sGang",
        "Error registering ESD image download directory for disk cleanup, Error = 0x%X",
        "^%!&LP-r",
        "bh0W0f0",
        "bd:uv",
        "fico. Este comando ",
        "GetVersionExA",
        "j[Y}To/",
        "!ue0=",
        "'&AGp#",
        "8 N$^",
        "+8`^r",
        "lg/e1",
        "6L`o5",
        "040C04B0",
        "j\\UIWZ",
        "utilisateur final doit ex",
        "u;2Y>",
        "y.^Jv",
        "S_J@R",
        "^rLCh",
        "#m(.c",
        "X\\I0Oq",
        "eZ=S*",
        "8-Q=b",
        ")cy\\(",
        "[\\Oic+)",
        "Installera",
        "W`%>K<8",
        "V4DBc",
        "ch>W?",
        "eG*ds",
        "jszaka alatt friss",
        ".?AV?$CZeroInit@VCSetupDialogSplash@@$00@@",
        "tietoja on Asetukset-sovelluksen Windows Update -osiossa.",
        "\\;Vc|bU",
        "czN4t",
        "Fr{sc",
        "$AHBS",
        "v'7v3",
        "ztWwuU[",
        "ZOBxI",
        "/5Ye6",
        "Vz #;",
        "RL\"^f",
        "lN;1^?m",
        "n+MV2t",
        "D^C_CB",
        "r Full anv",
        "s telep",
        "ZcU>M",
        " injic",
        "L{L7?",
        ": / installfrom <location> ",
        "+4p6{",
        "Z<]0O",
        "/ PBRUpdate",
        ";TaxA",
        "CompareFileVersions: Couldn't get fixed file info of [%s] and/or [%s]. GLE = %u",
        "2VQp-h1",
        "B-'sz1",
        "7^0SQ",
        "^lB?>v",
        "@@@@@@@@@@@@@@@@@@",
        "jv?IVN",
        "(>'VS\"m",
        "d%YOn",
        "tartuje.)Nepodarilo sa n",
        "1dQdw",
        "3r4hO^",
        ").qXI6",
        "`ysss",
        "wz>jP>j",
        "P7l-@f8",
        "~K`;/",
        "E>56\"~?",
        "a%$9_",
        "~\\x{Z8",
        "* X4_)",
        "4Y=rovnT",
        "tt;ok}}M",
        "YC@Av8H",
        "F_}^6X':t",
        ">Hh3a>",
        "<G<o<",
        ";yVh7+",
        "SYSTEM\\Setup\\MoSetup",
        "7I7h7r7",
        "_vscwprintf",
        "_OE*YJ",
        ".yoh2",
        "vN%rF",
        "o#B\"{",
        "Last ned",
        "S{O>g",
        "ksszW",
        "D\"M0(",
        "gyN='Z",
        "N:k!Z",
        "GwuuUw",
        "Wfqc6",
        "9H-5t&",
        "Sistema operativo Microsoft",
        "lRiJCV",
        "Exemplo: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "Vsb2_",
        "mica (pesquisar, baixar e instalar atualiza",
        ")}E9ud",
        "\">$h}",
        "~;-dq",
        " habilitada, recopilaci",
        "'r3PZd",
        " Microsoft Corporation ",
        "tOjPW",
        "]Ko+Gv",
        "50I0g0m0",
        "Mdlx_",
        "Action : si / PBRUpdate est d",
        "'trT(",
        ", le programme d",
        "0_0h0H0p0",
        "n95A)",
        ":w:?W4",
        "; =lE",
        "q7Khp",
        "TuHk0u",
        "_f+m(.",
        "xK\\}F",
        ":g7;\"",
        "eu4{,",
        "ZZZjZ(",
        "tW&OU",
        "vat argumenty p",
        "LX.9XLjV",
        "81]#N",
        "tTelep",
        "J~~r-x",
        " impostata su None, la Configurazione guidata non viene eseguita e per i componenti vengono usate le impostazioni predefinite. ",
        "sa ut",
        "rijs ",
        "EjK%R",
        "nzYk](",
        "e0T#@",
        "4~*bob",
        "L~~TDS",
        "N|<U<",
        "XO|$l",
        "[mF}h",
        "P?~VWSw",
        "loadt",
        " OOBE",
        " niveau les services PC Windows 7 Entreprise pendant la nuit. Elle ne veut pas que l",
        "mu po",
        "ex&zZ",
        "?Lhk!l,",
        "R!=\"7Y",
        "uje, jestli bude instala",
        "Z,>l-",
        "(J+(\\5",
        "altini",
        ",p&b^3",
        "OID+~",
        "Windowsi installiprogramm ei saa k",
        "~Hjk2",
        "\"O?v-",
        "o8A+G",
        "`K lQy",
        "dG6N;s",
        "3v'\"JC",
        ">J?`?k?",
        ",(PG.}=",
        "jZ'b4",
        " nastaven",
        "EnumeratePathEx: Failed search path is >= MAX_PATH!",
        ">3>P>V>",
        "=DnP:a",
        "|F>'_",
        "RL.dl",
        "iO3M2",
        "ndra Windows-installationens beteende",
        "$/Pla%",
        "pv?a_",
        "Telep",
        "|xT,i",
        "jG{t} ;y",
        "s@59r",
        "PPxf8",
        "Yja?MP",
        "*;!~~6",
        "~(9~0t",
        "l`sV0",
        "/-%d++[x",
        "kleme medyan",
        "%*pFT",
        "er la partition PBR. ",
        "D9Ln)",
        "41w`=bngZo",
        "~2%Mu",
        "n predeterminada. ",
        "si}R,",
        "/<haX",
        " Windows XP(",
        " en cours d",
        "    <file",
        "g-Bu$",
        "@vn3v",
        "=;^u\\#",
        "righet och n",
        ";:;[;|;",
        "6%>u,",
        "BoxDeletePath: No last path available.",
        ":1K<O",
        "hilduvust",
        "vF^oUo",
        "<p5@|",
        "*(Bz ",
        "<aUPt",
        "du&D/-",
        "ja fut, az eszk",
        "p5k@2",
        "R@)O)",
        "15XuI",
        "1m tT_",
        "Atbalsts",
        "in Ayarlar uygulamas",
        "]PcSa",
        "#*4fA",
        "es-HN",
        "o: / quiet",
        "vU_/T",
        "1AR2S",
        "Protecting folder: [%s]...",
        "ga-Nc",
        "l?k0L)7",
        "blw_.",
        "{mNlr",
        "]j\\}6",
        "lc&iC",
        "8T!!G",
        "gYg,?",
        "000@@@@@@@@@@@@",
        "dNE#B1",
        "8D_s;",
        "808C8S8h8y8",
        "i componentele sunt setate la set",
        "$vgu%",
        "86UHLE",
        "pDFwka",
        "bj(o?",
        "JXzZ2",
        "V^XUK",
        "F%QuO",
        "+a6\"e",
        "LD{{a",
        "18[A:",
        "^bwGs",
        "I-D3-",
        "Parametrit: paikallinen tiedostopolku tai UNC-verkkopolku tiedostoon nimelt",
        "/InstallFrom",
        "Observa",
        "em{k7",
        "o'H`C",
        "sW2w%",
        "q$uhR",
        "KOTUa",
        "r`  M(",
        "O\\BuJ2",
        ".\\%s\\%s.mui",
        "Eylem : Bilgisayar alt d",
        "iqCZGu",
        "juma iestat",
        "A6rH=Ps",
        "\\H5}7",
        "qXv^h.fgP_$",
        "1U>}<",
        "|AaSm",
        "f^d*!k ",
        "P1heT",
        "3(:XW",
        "=8gT3gT",
        "bp&/3",
        "uv%??",
        "YLqF*",
        "P9Hc;",
        ":):B:`:m:",
        "Y^[tL9",
        "V4?^8",
        "s volver a %1!s!. ",
        "\\qKrw",
        "coleta de telemetria e aceita",
        "+ugP~",
        "i)F'\"",
        "O{UT%{Lr",
        "anai un testa vid",
        "!~6ZV/",
        "^\\=='",
        "OUOw4",
        "UlJb.r",
        "q+SzTG",
        "5r9Kj",
        "U,Yr=",
        "nD;IY-.n",
        " przej",
        "esGjf",
        "%wLtC",
        "96?vql",
        "msvcrt.dll",
        "[Pgtl",
        "+e&S2",
        ";xC7.&LU",
        ")g`|9.",
        " a komponenty sa nastavia na predvolen",
        ">t\"A{",
        "6E7_7j7",
        "\"j|WT",
        "\\&>qhX",
        "0F0k0Y0",
        "}YqG ",
        "fif>qF",
        "%{icB",
        "Eksempel: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "jdeFS",
        "I|&gZzd",
        "e'bK3D",
        "zj_<*",
        "]B\\;h",
        "Handling: quiet-flagget skjuler alt brukerp",
        "cemu opera",
        "aOEU~",
        "g9LEin",
        "Os+PN",
        "DO_$u+'u:m6",
        ">\"Y?43",
        "gh1~o",
        "l@B:4(",
        "TDF=5_]^",
        "R!=(J$q`",
        "til fazer uma atualiza",
        "4P4h4",
        "0Lfe.",
        "]~: 0",
        "$31\\-xn",
        "X+Ux/",
        "(Z2 \"",
        ":iDHnW",
        "glicherweise wird gerade ein Funktionsupdate ausgef",
        "_wQ;e",
        "-t#J6",
        "ny kihagy",
        "]`,>A#",
        "s\"]wAi",
        "888b8",
        "]J)y8",
        "Ew`L#",
        "u<VhL",
        "%]z%`",
        "XF|2*",
        "z2)Ce",
        "zzH\"F",
        "W/<&&",
        "3HE.N?",
        "\"6d(o9C",
        "eba 64bitov",
        "J.ujTR",
        "9r)=|m",
        "1H^MR",
        "cy instalacj",
        "0`#&&",
        "D^HYC",
        "p.:9]",
        "~$`~6",
        "i instalaci. Pokud je ale pro p",
        "Ein Administrator m",
        "b 5u)",
        "Z-man",
        "$4A$'AZ$",
        "ifra proizvoda ",
        "Handling: Angir om installasjonsprogrammet utf",
        "~os\\-",
        "\"v\\NC",
        "r olunuyor*Kurulum eski kurulum i",
        "]ka1?",
        "ytkownik lub proces wykonuj",
        "9SVCl",
        "rk'5Vt",
        "yZe?0",
        "progreso",
        "v!!fI",
        "4gPjH%q",
        "Eksempel: setup.exe / auto upgrade / postrollback \\MinRessurs\\script\\setuprollback.cmd",
        "y+$B;",
        "QL5Dq",
        "k>^r5",
        ",s&hK",
        "^$gu8",
        "6Z;u\"",
        "!9d^2/",
        "|Kgj[:",
        "latuq`[Hj",
        ";~^RTT",
        "<uS&^BJ",
        "V7uH,",
        "@NnSJ",
        "{d;6.",
        " quiere que los usuarios finales tengan la experiencia de introducci",
        "=XFwh2?:!-s",
        "0n0%Rn0",
        "Xn\"w=7",
        "EIBIFIEIG",
        "Z<=0b|",
        "F<g_z",
        "=.=;=",
        "8tM8*",
        "nl:Hs",
        "Qz;ki",
        "3GMLS",
        "s0oyI",
        "R8VmXgV",
        "9I:[:n:w:",
        "K gT ",
        " pendant l",
        ";Ne-5",
        "?JufJ",
        "h4t0z9",
        "A$o!I5",
        "8hWR3m",
        "zUOaJ?rn",
        "tt-RU",
        "Problem beim Starten von SetupsProblem beim Starten von Setup. Schlie",
        "n^6Cd:",
        "Atw+[",
        "OSbi^:H",
        "P\\'1-d.",
        "n especificada. Tenga en cuenta que tanto el equipo como el usuario deben tener permiso y acceso de red a la ruta especifica. Este comando se ejecuta en el contexto del sistema, as",
        "iusuV",
        "xG+3^x",
        ":=gCh",
        "iniet v",
        "i UX-ove vra",
        "unalnikom. ",
        ".M]gS",
        "OvEF1",
        "=aI_t\"",
        "miNd.",
        "lxCY#)",
        "Ci:E'",
        "lL)g2",
        "%7V*eZ",
        "g#v$m",
        "Rjg&y",
        "*|&Q%",
        "F|.%irLX",
        "O%9|^",
        "qrD},!Z",
        "%!$cz",
        "r=XiEnk",
        "Lc|vW dxx<",
        "|Ja3B",
        "2*8j{",
        "+($f-Su",
        "+H/jh'.^",
        "J:/a;/ ",
        "?;oQp",
        " instalace shrom",
        "xoyH'E",
        "\\7gl+",
        "3W_=L",
        "3PDLG^",
        "C[DV@I",
        " dopo il completamento dell'installazione ma prima che il primo utente esegua l'accesso. Viene eseguito con privilegi di sistema. ",
        "Hy.}(",
        "(#\"E/q",
        "D*V$C^Q\"Fg",
        "*Vusp",
        "'&\"%fN",
        "Z|s+p",
        "Le_O(",
        "JO9KI",
        "Action: When / migratealldrivers is set to All, set-up will attempt to migrate all drivers as part of the installation. In contrast, when / migratealldrivers is set to None, set-up will not migrate any drivers as part of the installation. ",
        "PyXbu=",
        "cessite de disposer des m",
        "98N/V",
        "@nXj%",
        "PM(doJ8",
        "ppp@@@   ",
        "):,T'h",
        "-.vI<",
        "7:w]z",
        "':>Vh",
        "(q5\\}",
        "2&2-2j2q2",
        "kV.xE^",
        "Up+gA",
        "b3r&J&",
        "rtuseks on seatud Full, peab l",
        ": / quiet ",
        "J< YS",
        "vB2FR",
        "F%@gm",
        "q\\qtA",
        "sQp(/Bp8",
        "~46__",
        "<\\}24",
        "tte / migratealldrivers v",
        "]q`m#",
        "b>./e",
        "/R{=?=_kzkr",
        "DsAS6)",
        "i8.vy\\",
        "Bryter: / Telemetry <parameter> ",
        ">f<wu",
        "99S}I^",
        "qb(\"D",
        "|qXWn",
        "aju pogre",
        "pf[0AS",
        "Gr^`5",
        "|q[hn",
        " setupcomplete.cmd",
        "{XOy^?",
        "|x;Hk",
        "6sW|xE",
        "=h$9x+",
        "!Fk@S",
        "{[s,m",
        "@5#TW^",
        "jUtyJo]",
        "l\"B$tV",
        ")&&N,,",
        "r8%%P",
        "cN2**>T",
        "iQ?|b",
        "]zzC3",
        "yASK%",
        "2ttQdk",
        "cia alebo vytvorenie vynulovania stla",
        "eAq/q",
        "@WSq{6",
        "/U7`#",
        "%jR8[m",
        "'1Wt=H",
        "`rw^'NyP",
        "qV~qQ",
        "X^|Oz3",
        "O9cPL",
        ")J_Pgh",
        "ZH(yks",
        "VQ~i`",
        "b7{_\\rD",
        "szlelt",
        "ivituda, kuna osa installifaile on puudu. Kui olete varem k",
        "ybv5Z",
        "xm (O(M",
        "!FKUi",
        "R_,^^",
        "Task error [0x%X] is being set while task is not in Error state.",
        ",}>w}",
        "fm;U;",
        ".AFDB",
        "4T6`$",
        "nDp7K",
        "bOhciK",
        "Lataa",
        "k0_%1#7B",
        "cifique ",
        "_peo0",
        "`QU?CN",
        "marre pas automatiquement. L",
        "9l*/^",
        "=ycQ%",
        "~n?(c)",
        "&Siguiente",
        ";p+!n",
        "qV3)x",
        "LgqZu",
        ">*k3W",
        "oe#.1",
        "{zYip",
        "&Back",
        "F'}9fi,",
        "MNev7{",
        "QcjBM",
        "GetFileInformationByHandle",
        " Disable ",
        "Bryter: / showoobe <parameter> ",
        "y3lA7+",
        "hx*<7",
        "Og7c#",
        "z-eR{",
        "}LWw}",
        "SIvvd{",
        "d4X2K",
        "HMks$",
        "7-osJ",
        "dzi tiek pie",
        " implicit interfa",
        "ytkownika",
        "Q.9e>",
        " se p",
        "Aktion: Das quiet-Kennzeichen unterdr",
        "$9p.]8 8",
        "0A$$@0",
        "1R2d2",
        "I8HE;",
        "111WWWddd",
        "+T}\"(",
        ">NeAnV@",
        "TQ^_+",
        "pu?8w",
        " lxm6",
        "Detected existing box mutex... exiting.",
        "Kc{,0",
        "~Lf6X1)",
        "vd.9N",
        "vV2H9z",
        "Commutateur : / Telemetry <param",
        "ke dozvole ",
        "#Pu2}",
        " ,f_+",
        "B{nWS",
        "\"2#uy",
        "t'uD\"",
        "U,x+M",
        "T9qxz",
        "so~|z",
        "rio quando se atualiza a partir de um suporte de dados de licenciamento em volume ou de um suporte de dados que cont",
        "iendada operatsioonis",
        "zijJD",
        "G^ES,",
        "cYi9g",
        "#<FNbQ",
        "_Jj7:?",
        ".?AVCInstallPrepUI@@",
        "etky pr",
        "IW{6o^",
        "1;YI~",
        "9C.=u",
        "C51kx",
        ".Ua9%",
        " (%d%%)",
        "=J8/w",
        "Av3 l",
        "K:W$3",
        "dsb-DE",
        "Mc|t ",
        "~Qam[",
        "wA0w67E",
        "9XDexo<",
        "o`q<Q",
        "@\\E\\C",
        "IDS3>",
        "aqrj L",
        "l futtassa a setup.exe /? parancsot a telep",
        "n con la opci",
        "f/F=m",
        "FU_i?",
        "l<G;j",
        "XpWV^",
        "XKp%Y",
        "si fel",
        "\\tbaU",
        "MY1[ha",
        "hez. Ha p",
        "Rengiamasi=S",
        "eD>l\\",
        "nario : niveau d",
        ";{G\\V+8",
        "c}Oi;",
        "}0tmM",
        ">?zi_+",
        "@i&6O",
        "9DD2\"",
        "QCk(*3",
        "EV|1p",
        "}<PgS",
        "<k+%>",
        "98u,C",
        "L_k_r9k",
        "J-{62c",
        "utilisateur. ",
        "WVShx%A",
        ":NtT~",
        "HiZJk+",
        "*:.vy&",
        "4[^)?",
        "EtwEventRegister",
        "Sh0u@",
        "s!jBK",
        "QNHQtB",
        "w.MoE",
        ">4mX>",
        "o+A[b",
        "e migirati sve upravlja",
        "ktqid",
        "AC#<A",
        "%SDr:2",
        "ia%R%",
        "|MVQT",
        "$ryk3",
        ":}jFy",
        "e(_Im",
        "tFsWb",
        "d]G_S",
        "Xe5F|",
        "L;V:L",
        "g. Setuprolback.cmd ",
        "=h8K6",
        "Esimerkki: setup.exe / auto upgrade DynamicUpdate disable",
        "HeEf*G)",
        "y_f^~",
        "2B%#*m2",
        "lPCHX#}",
        "u!rz8",
        "o%\"O/",
        "w94->'ZS`",
        "C#\\YR",
        "Zm\".or-",
        "INDIAN",
        "=x2=#",
        ";u>zD",
        "%K#+-",
        "&rU*6[",
        "Action : si / showoobe est d",
        "jMjc<",
        "'l #-",
        "ZagAc",
        "Mk<i\\\\",
        "autre disque d",
        "ne lokacije do",
        "Parametri: nav ",
        "V&olgende",
        ",IoRL",
        "DlpTask: Executing Actions...",
        "ke programe u sklopu instalacije. ",
        "Q>O*e.",
        "ana). ",
        "i|ECq<oS",
        "#mEv{",
        ")F+i[",
        "Px_X#",
        "Ww!~#",
        ")x\\:9",
        "BY(v-",
        "q/@=F",
        "!2MOk",
        "Sh@sz",
        "6+73d",
        "q!AZ#",
        "rayaf",
        "<.??>",
        "y*!xog",
        ".?AVCSyncObject@@",
        " na in",
        "tz]J/",
        "Se^[1",
        "es-ES_tradnl",
        "_G\"eY}",
        "ine potisnut ",
        "XI9-m)",
        "?]zBO",
        "k+j?x",
        "o para a instala",
        ",9p\";",
        "$?A~=1",
        "stup k zadanej ceste k s",
        "\"@&=/",
        "t{NUO7i0",
        "?Z]s/",
        "yI8Nn5",
        "j\"i0\\",
        "wC_kJM",
        "Ghf+L4S",
        "B|Jk\\s",
        ":M3k.O",
        "f@nc\\",
        "$&6cJ",
        "<b^7_",
        "Windowsin asennus ei pysty k",
        "Wdc+W",
        "lR 0M",
        "A+~nN",
        "&}K'0",
        "K=`b=",
        "RZicc",
        "kKJJtMv",
        "n. Por el contrario, cuando",
        "(0msR",
        "?.%aR",
        "E>[([ZoK",
        "[1B<.FP",
        "unar radi pod 64-bitnom verzijom operativnog sistema Windows, potrebno je da koristite 64-bitnu verziju alatke. Poku",
        "k(`}5m",
        "*wvE:",
        "indicateur quiet supprime l",
        " Q^ J",
        "U4ll9",
        ":k v-",
        "u,,`hfff3KW",
        "9S0vmR",
        "1\\[L5Z(.",
        "Fhd=W",
        "ni iz po",
        " : / PBRUpdate <parameter> ",
        "upU@5",
        "Enable, la instalaci",
        "BukFS",
        "\"*|[XE",
        "on appropri",
        "ciu spustil. ",
        "zwVDen",
        "%1rb@",
        "{gjZT|",
        "h{KMvA",
        "DEEA||<d",
        "Z\\[N~/",
        "k\\/>Tr",
        "1i*YdPl0",
        "404<4\\4h4",
        " completar",
        "2#0\"9",
        "<#<*<D>X>c>",
        "EDCz!",
        "CH0h^",
        "\\/41-",
        "v[WF}",
        "q->4>&",
        "A}Dv|72",
        "6K5+ uEL",
        ";uQ9{",
        "*******SetupHost Logging Begin*******",
        "ZeS){6",
        " v produk",
        "Instalarea Windows nu poate fi lansat",
        "Gt{BB",
        "!W^ctLe",
        "/{Ktnt",
        "!Bp'B",
        "1>5Hj",
        ":z7c?x",
        ":fC? i",
        "C@$Wd",
        ")Pm0e,e^*",
        "w;bH:",
        "#=d6}/Z|",
        "o[FoHPo",
        "--aKK",
        "cMh'Ey",
        "Exempel: setup.exe / auto upgrade / showoobe full",
        "U#hHl",
        "Wq?sRF",
        "R}:s^",
        " quando l'installazione non viene eseguita correttamente e nel PC viene ripristinato il sistema operativo precedente. Viene eseguito con gli stessi privilegi dell'utente o del processo che ha avviato l'installazione. ",
        "hD5RT={",
        "a4w.f",
        "@@7J3>0)",
        "l'`y:",
        "Op: / showoobe <par",
        "VGoufj",
        "l6v^Yd",
        "installation de Windows 10 red",
        "RtlGetVersion",
        "na staza do datoteke  specific.wim ",
        "6._.*y",
        "cbB*~",
        "qB3NZ",
        " (EULA), ",
        "*T/Zp",
        "Ann&uleren",
        ")vuwuuUuu=:",
        "X--Dm",
        "3+3S3f3",
        "A7bd=",
        "        name=\"shcore.dll\"",
        "REQUIRED",
        "7z3>S",
        "YeWx,",
        "@!/6wP7",
        "C;L:g",
        "}Oyc~k",
        "r lavniv",
        "%'XLH>",
        "Esimerkki: setup.exe / auto upgrade / showoobe full",
        "EF`~m[$=6",
        "'<)~Y",
        "(qG1)J",
        "Im#Vm",
        "Beispiel: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "Xnh.4",
        "Xc)H0",
        "&'0X[",
        "An[MO[n",
        "`_iUb$V<",
        "PdCl@",
        "bKX4c",
        "f;rsYS",
        "oLx!G;",
        ";A#AW",
        "p?0}O",
        "Y__^[",
        "asw`s",
        ".:<@^",
        "uab OOBE-ni): ",
        "o|:Ui",
        "bVZ+E6W",
        "_)@oG",
        "041A04B0",
        "49:W)",
        "!Wp?z",
        "x!Exd",
        "towlower",
        "i7@jr",
        "ne instalacije i povratka ra",
        "a~(Wn",
        "I`KGm",
        "jo~by",
        "1zy!6",
        "XKb~6",
        " conclus",
        "{R-onr",
        "SetFileInformationByHandle",
        "Is)^b^",
        "Z:[~3rf",
        "tres : Enable; Disable ",
        "espace pour ex",
        "|hK,_",
        "IMlH24",
        "-;e4}",
        "ps;Qn",
        "enje in po",
        "=[]sI",
        "uz-Latn",
        "x5O=R",
        "#~I,W:",
        "H4qn+",
        "9S@bk",
        "s?A telep",
        "PG]Qfa",
        ".?AV?$CAutoCleanupBase@PAPAU_EVENT_TRACE_PROPERTIES@@@RAII@@",
        "FLlG4#Tx",
        "'49oav",
        "'.eI?B",
        "TSOq/",
        "^}3n-",
        "SetupDUUpdateFiles: Could not determine whether target directory [%s] is empty.",
        "gar som kr",
        "tjaPzG",
        "qHgAZ",
        ")GwJg",
        "wS6}Kd",
        "(jTG.O",
        "#\\P]rJ",
        "LpSb<",
        "a\\$Vn",
        "}Cm`w",
        "BE7aF",
        "6AifFj",
        "\\9.c]",
        "N?pr{u",
        "PUxH]",
        "6Izabrana arhitektura nije podudarna sa va",
        "l is a 64 bites verzi",
        "BuD+j",
        "!==m=",
        "#8`?Fk",
        "HC=94N-",
        "nmEB\"",
        ",X5xb",
        "Zf\\`U",
        "GZ)LB",
        "AU\"T%",
        " program prov",
        "&daXq",
        "k1a\\PA",
        "p/\\ *V",
        "CK|]y@U",
        "Rc:/m",
        "rY!Tu",
        "$fOiI",
        "8=gw`",
        "%Nl:)",
        "\"V3y9",
        "Ejemplo: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "iniet palaist r",
        "9Hr3$",
        "fz/z+Z",
        "V^O_c7O",
        "$ m>b",
        "inama kompiuterio ankstesn",
        ";G8Ao",
        "}ipe?{",
        "tHvn_",
        "Ak!'e",
        "R?\"_'44zm",
        "T,;`Y",
        "&wYl-",
        "siNapl",
        "}\\dnn",
        "t-ci)c",
        "=BZNd",
        "w;9n6",
        "Por ejemplo: setup.exe / auto upgrade / PBRupdate disable",
        "7$717g7",
        "RV\\fSfC",
        "Parameters: lokaal bestandspad of UNC-netwerkpad naar het bestand setuprollback.cmd ",
        "G%4h54(/",
        "opJNn",
        "Zt2I.",
        "Parametreler : setuprollback.cmd adl",
        "Q<_}M",
        ">w>rk",
        "9F9V9c9",
        "sr-Cyrl",
        "ALtJUD",
        ",9V/D",
        "njIjp",
        "}10loa(",
        "%s{%s}",
        "r Windows 10 om automatiskt.1Det gick inte att hitta den XML-version som kr",
        " e06>9\"",
        "Pripravljamo nekaj stvari",
        "y~%J`W<j",
        "9^nSL",
        "sFsnf",
        "S@2T|",
        "`+8|}",
        "{+H/|-",
        "\\NJYE",
        "t telep",
        "q`gv>*)",
        ":(:4:@:L:X:d:p:|:",
        "c|vSc8",
        "F1-Qz",
        "BqNbw@",
        "r|]!.7",
        "71f9{",
        "!1,:Tm9X",
        "ad: setup.exe / auto upgrade / postrollback \\MojUdzial\\script\\setuprollback.cmd",
        "        loadFrom=\"%systemroot%\\system32\\riched20.dll\"",
        " instala",
        "R+*lS|",
        ":_B{y",
        "j`Vvdb",
        "[>2~3",
        "xk\\h>&",
        "}+I? ",
        "Start forfra",
        "A+es)",
        "tm9O.",
        "Uyu<m",
        "t!]D;",
        "V1DN@$R",
        "Pexf/",
        "8+yta",
        "8-8K8v8",
        ", instalacija ne prikuplja niti otprema telemetriju vezanu za instalaciju. ",
        ".{9m:<",
        "YHYx\\Wd",
        "tirme i",
        "HU[2O[R",
        "/SOi}i+",
        "Sud~y<",
        "E^YdQ",
        "?Tb']p",
        "E<](7{X",
        "})m0l",
        "a20k@",
        "66Gpc",
        "1t:*}'T>",
        "}3=[,%",
        "i. Pokud na po",
        "7Yt^9e",
        "CWizardPage",
        "\"0fe(",
        "%X>@P",
        "{?/uAO",
        "&}lc0}l",
        "5k|Cy;&a",
        "0XW\\D",
        "JFU)P",
        "_?eLg!",
        ",3ldE0[",
        "Comutator:  / quiet ",
        "D$hPW",
        "4e(Ab",
        "]zZY7",
        "UanUD",
        "a komandna linija mo",
        "ENeGGGlllAA",
        "8=#&+",
        "2KbW-P0WEO",
        "=z%eO3<",
        ", hogy a felhaszn",
        "dH;\"~",
        "AU8[b$",
        "Ed]hZ",
        "eyJfH",
        "!qKv{",
        "RhaM$",
        "<\"$-L",
        "0t2b*",
        "8J>'G",
        "n de Windows 10 no acepta argumentos de la l",
        " Wg^L_",
        "xXo2'",
        "(\"-mN",
        "<WIvp2",
        ":a&bt",
        "Elf:51",
        "cM O`",
        "}!888",
        "I ett scenario kanske en administrat",
        "ze \\x",
        "Z<)rR",
        "/x[YE",
        "1_H)'",
        ":aiio",
        "HV[rV",
        "8G6Q>",
        "u[Si6d",
        "96z7m",
        "anu. ",
        "fT!GJ",
        "A}]!d",
        "''yhH3",
        "L({fB",
        "effectuer des t",
        "Failed to flush MoSetup registry key, Error: [0x%X]",
        "o consegue determinar o idioma da UI",
        "metro: / auto <op",
        "PQ>3/",
        "WX{=+",
        "@.dY>",
        "~Kg1;",
        "\\}W7b",
        "mY-{+",
        "0D0f0",
        "qb]s%",
        "H37-~#",
        "Parameetrid: All; None ",
        "DBKa$(}",
        "}otZc",
        "sHW\"DO",
        "W!N$(",
        "5&5D5]5",
        "blHX>HvA",
        "3~DVR",
        "Ck:oL",
        "7K8p9",
        "Eylem : Kurulum, y",
        "buj ponownie.rJe",
        "ria(Erro ao preparar a m",
        "ho nastaven",
        "+A5Qe",
        "%E>mX",
        "zA|Wl",
        "#|2|o",
        "=e?xQ",
        "tYyK7",
        "Gatavo",
        "CAzureScenarioCtrl::CreateCommandLine",
        "D_^u~",
        "&R'BM",
        "nS6v[",
        "Y2V5s",
        "e,\\Pq",
        "A4Mqw",
        "yPS*S",
        "|A_{q",
        "NMRn0 ",
        "[2;[5",
        "27.dM",
        "bf4Xv0",
        "y2shY9U",
        "0!n,h@M",
        "N\\'!p4",
        "Ct;KV",
        ".4P?}'",
        "59XU9",
        "HeapAlloc",
        "OtfM> ",
        "vN|Z~r",
        "fini sur Aucun, le programme d",
        "6jr@x",
        ")1Qr)",
        "pOLDD",
        "S1~.v",
        "PR\\-n",
        "cpbdL",
        "IPe<}",
        "ZtxYb",
        "I)T<zg",
        "!.!o/C",
        "NIq}ek}",
        "]c&iLsh",
        "Could not get exclusive lock on hive file %s. Error: 0x%08X",
        " sava instal",
        "Z(a8y",
        "W1i(<",
        "3SVVV",
        "in(tj",
        ")#20X\"r",
        ";3<R<\"=`=",
        "anu un aug",
        "Cj/qH",
        "{i?<U",
        "L@ee8",
        "`Q%ve",
        ".twV\"",
        "CK5}c",
        "1Installasjonsprogrammet kan ikke fastsl",
        "!VqReWnz",
        " Install.exe",
        "0{8!o",
        "ua-oO",
        "lti a setuprollback.cmd f",
        "uJT'q",
        "\"50P.",
        "Parametrai: N / A ",
        "GB9(G",
        "        loadFrom=\"%systemroot%\\system32\\mfc42u.dll\"",
        "55Wr?",
        "rUe,he",
        "+o!f'3<",
        "W0wHk",
        "Ggn;(xf",
        "    -->",
        "=(0 0p",
        "fjgt=",
        "Attempting to preserve existing logs...",
        "bYnZswN",
        "?~Y$_",
        "gezzen-e dinamikus friss",
        "=(>B>O>",
        "VfCS9Rs",
        "dgs@G",
        "H~)\";",
        "lry8L",
        "=e2EE",
        "Mnt?_",
        "MZ{*N",
        "V`EZc",
        "D2HH7e/50h/ir",
        "5$5(585H5L5`5d5|5",
        "pN~-o",
        "#rn\"vm",
        "ZreY+",
        "<wg4*",
        "SXYYXXIFB=:",
        "4q4x4",
        " OOBE). La ligne de commande suivante peut ",
        "s(I/#jA",
        "x5P#g",
        "SVPQ3",
        "c.6WB",
        "w+No)",
        "#{~nAQ",
        "G`;{A",
        "KnYME",
        "y2v'm",
        "sVg?d",
        "eZT]noy",
        "^A!}6",
        "Fn1|%",
        "nf ;N",
        "zbDCT",
        "Exemplu: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "<3\\\\I",
        "^~awnB",
        "ivanje potpune nadogradnje na Windows vNext, uz obavezan korisni",
        "%s\\%s.mui",
        "ranka jau vykdoma.c",
        "wB.#w",
        "T<C>uux",
        "DW_kr39:U",
        ":$O;+3",
        "uUmU_",
        "P6*=,=*",
        "!#* Z",
        ":t{\"T",
        "7ku[.",
        " architekt",
        "Q!P[.Fh",
        " nukopijuokite diegimo failus ",
        "%]*\"U",
        "XRKi-]",
        "@_^[]",
        "8My`P",
        "re wymagaj",
        "Action : Injecte le fichier setupcomplete.cmd ",
        "9lcfx",
        "14FNd",
        "Xd2bJ3b",
        " pirmojo sistemos paleidimo programos veiksmus (OOBE). Naudojant ",
        "N'EdNX",
        "B.>W?",
        "041204B0",
        "4=WF2bX ",
        "W{7|?",
        "CompareFileTime",
        "]224__8",
        "<[9_(m",
        " endre virkem",
        "J<))1^m",
        "f~XgTU;",
        "Eylem : Belirtilen konumdan setuprollback.cmd dosyas",
        ")I@<w",
        "eSnIc",
        "}ts#O",
        "X^&O.",
        "2r>zf",
        " vom angegebenen Speicherort ein. ",
        "oHo:$o$",
        "AWfQW",
        "OC|yRXq",
        "G x<(x<[",
        "BHYE.",
        "N\\1z<",
        "?Mn[L",
        "/oI4x",
        "X$Rj*",
        "klad: setup.exe / auto upgrade / PBRupdate disable",
        ".?AVCSetupPageResume@@",
        "ZRfr7",
        "<b44L",
        ":R)y9",
        "-Gm46I",
        "z/P)y8",
        "D:5[_e",
        "!XL%m",
        "n\\j?=",
        "i\\[o4",
        "\"MuFG",
        "FZL\"I}",
        "^QrlNh",
        "\\0K>)/w",
        "o:u1@y",
        "e zadane konfiguracije : priha",
        "S|t9:",
        "rcare ",
        "l*p8r'",
        "W`(fu-",
        "1#xP/u",
        "99~^Z",
        "ZZZvww",
        "D!Q*eC",
        "EH0Q|",
        " ve UNC a",
        "'-OqI%",
        "*rXt+95",
        "*@`RG",
        "=is+z",
        "Ky\"lS",
        "f!C8&\\",
        "5ltbl<",
        "]A1=W]",
        ">?(u>X",
        "@TRN~",
        "@&usW>v",
        "HIIYTB",
        "k6Tv4m",
        "aU?[x#",
        "[}'}^",
        "U2C|d",
        " Windows vNext ",
        "x=|~uV",
        ".data",
        "gG&qE",
        "0Ne'PJ",
        "ches ",
        "*Priprema za instalaciju sustava Windows 10)Program za instalaciju sustava Windows 10:Program za instalaciju sustava Windows 10 ve",
        "'Qu7G",
        "End;U|",
        ":y.(pgx",
        "e biti a",
        "lreiz.rLai palaistu uzst",
        "Ag2,BTh'",
        "^cQ3?h",
        "%pUxVv",
        ">S0pobQ8r",
        "8;:q]0",
        "P?b>4",
        "sYhly",
        "q_eje",
        "A-mK8{",
        "qMXoo",
        "exploitation Microsoft",
        "bO:>{B",
        "N>G6{",
        "s<CQO",
        "eli preko no",
        " None",
        "o3e>LY-",
        "RR(TV",
        ":l\"=a]",
        "rY\"#k",
        "IfI0Hy&",
        "l(f45n",
        "rB5?v",
        "Anahtar: / Telemetry <parametre> ",
        "Bryter: / PBRUpdate <parameter> ",
        "8_=\"fh",
        "hu-HU",
        "zune_",
        "0[\\1UJ",
        "\"_J('",
        "ica sistema Windows, morate uporabiti 64-bitno razli",
        "COMCTL32.dll",
        "az-Cyrl",
        "/+>8c/",
        "idK>t",
        "]QN=_",
        "03YNW",
        "A4;F<t;",
        "33By0",
        "x8>\"m'&",
        "W}N/b",
        "NOTA: Este conmutador solo se debe usar en entornos de prueba. No debe usarse en entornos de producci",
        "emplacement indiqu",
        "qClWb",
        "dbJzz",
        ">QLyQ",
        "&7@$BCI",
        "CreateFileMappingW",
        "h3nTI",
        "RmmPm",
        "C8tUw<o",
        "w!KEM",
        "S,f@@3",
        "c'cO2.",
        "zbqG(Z/",
        "Imjc{",
        "y!D&A.{",
        ";{gEG8k",
        "Rc[P9f$",
        "nHH/t>",
        "a^Ib-",
        "U&#s&",
        "ra neatitinka kompiuterio. Pvz., jei kompiuteryje naudojama 64 bit",
        "eD_V&~",
        "sO5~#",
        "LI5m3",
        "_GgM-",
        " olabilece",
        "ivitata arvutit automaatselt. Installimine j",
        "Exempel: setup.exe / auto upgrade / PBRupdate disable",
        "H\"fP'",
        "q0#,S",
        "ss^gq",
        "o,d}S",
        "< !T^`wv",
        "dBV>\\",
        "j%tW`fU",
        "-j1}?",
        "!je'6/",
        "_F]5Z}",
        "]#\\nWT",
        " complet, l",
        "G_Q>`",
        "\\1A{g",
        "cL.]C",
        "PBOdg",
        "2Ka|wq",
        "2[?-I",
        "} :>w",
        "Hj%mB7",
        "V8293",
        "=En8E*",
        "L$;tJ",
        "}IuF|",
        "u`6Gy",
        "5hAV<h",
        " n`qf",
        "u{hf\"C",
        "cznik / migratealldrivers ma parametr All, w ramach instalacji zostanie podj",
        "W6MOR",
        "b\",xQ",
        "y=xTH",
        "jW&PYY",
        "jjF^b",
        "ojoEs",
        "1:gPP_",
        "l?[,`",
        " 3Z53M",
        "?X(n.|u|",
        ":4:8:X:t:x:",
        ":::bcc",
        "Ut)g>",
        "t^9_`tY",
        "j-3EP",
        "t~/)V",
        "{UP:Z",
        "kseltme",
        "mas Windows 7 Enterprise. Tas nev",
        "tb+rC$p",
        "|:BVL",
        "S>311",
        "@zibf",
        "micas, recopilaci",
        "!0(0=0D0x0",
        "?wxu8",
        "}Tr]x",
        "?2xQTV",
        "(DoTd",
        ">$>0><>H>T>`>l>x>",
        "m94\\u)",
        "z2phC",
        ">Dv=|t0Sd",
        "GetCurrentDirectoryW",
        " E-uM",
        "JOb}7",
        "uxtLg(7",
        " ni crear",
        "!!gE0",
        "de-AT",
        "Q{F0@",
        "JD vAv",
        "rMUwM",
        "O]tG~nd",
        "l>^Op",
        "Ix<4m",
        ">.6J4<?Bg",
        "r Windows 10 k",
        "C7NQ5,k",
        "WX_JB{",
        "7ABx}",
        "n{'8h",
        "nea de comandos indica a la instalaci",
        " apar",
        "G/G`{",
        ")\\!#[",
        "V\\c+Y",
        "Alternat",
        "`%Jwu",
        "bB3.:",
        "yhnlQ",
        "yuzD?x",
        ":[l4]W",
        "/!$.f",
        "T\";.-",
        "l a telep",
        "6/Mhs",
        ".51`IlzdN\\",
        "9<o6\\",
        "I,C]b",
        "LjhTO",
        "v at k",
        "5A Configura",
        "_<WTVe",
        "n]CW]d",
        " teda povolenia na kop",
        "Dejanje: s stikalom dolo",
        "~BeQe",
        "tre atteint une interruption r",
        "%Hk2u:",
        "kfwgO",
        " 3+&!'",
        "bSnx0",
        "YULpr",
        "fKF5T",
        "6f6Ypl",
        "smj-SE",
        "C3^\"8a",
        "lW!;_",
        "?w,gy",
        "installation : ",
        "=;z_e",
        "DA=O3",
        "pb\\2_",
        "&\"LDhO",
        ". Ji nenori, kad b",
        ";>iB,",
        "f0^im",
        "Do&kon",
        "n*g)O",
        "4(5B5m5",
        "s~yL{p",
        "ur-IN",
        "nika licencjonowania zbiorowego lub no",
        "a querer recopilar algunos registros u otra informaci",
        "S,_^[",
        "Juridic",
        "5\"6,6M6g6t6",
        "2%`Te",
        "fV\"&\"",
        "rguasukohast ja ilmnenud on ajutine v",
        "@czEkG",
        "LdAV^s",
        "nqA$#",
        "(33#j",
        "GywZ\"'&",
        "#ry`%t",
        "hO>)g3",
        "bCUlv",
        "KS3C|",
        "@@@@@@@@@@@@@@@@@@   ",
        "DeleteFileEx: Unable to clear out attributes on [%s]; GLE = 0x%x",
        "metro no se necesita cuando la actualizaci",
        "Jnd{<",
        "iant s",
        "kllbbj",
        ".Setupcomplete.cmd ",
        "RtlDosPathNameToNtPathName_U_WithStatus",
        "aH5i.",
        "Vg'8Q",
        "Parametri : lokalna staza datoteke ili UNC mre",
        "Z@N)2+3",
        "Gi'E>\\[",
        "pir\"A\\",
        "D'V%6",
        "ConX::Setup::Common::CSetupLangIniLoader::LoadLangIni",
        "\"T=j1WHa",
        "/Teie valitud arhitektuur ei vasta teie arvutile",
        "HWi:]:-3",
        "~}=zYb",
        "sx~MN",
        "0@>$@0",
        "ra, s",
        "+ut.5",
        "\\Gx$}#",
        "SgY,%MP",
        " ]e .",
        "2e`<CF",
        "\"uIw)",
        "ij= _0n*",
        "```   ",
        "w.p.t.r.v.q.u.s.w",
        "xMi|e",
        "6Ej3X{",
        "``````",
        ";VS\"Un&",
        "iWU=I",
        "q5^#O",
        "&{7&MU",
        "rraYQ",
        "W=s|h",
        "W^j\\V",
        "^X@rI",
        "'z/O7z~",
        "9X`Df",
        "lI*&z",
        "i din nou toate fi",
        "[UK !",
        "O7>)~?!",
        "ESEMT",
        "}]{cJ",
        "BE1-!",
        "Yc3zz",
        "H[{G )",
        "GetStartupInfoW",
        "7+1wK",
        "ratud eelmise OS-i peale. See k",
        "6%777_7q7",
        "ZEa\"az",
        " program nedok",
        "tavate arvutite versiooni. Ta ei soovi installiprogrammi kasutajaliidese kuvamist, kuid ta soovib, et l",
        "7ZZ;@",
        "3=#8C",
        "xPah}",
        "IV6H2",
        "TfoSr",
        "o\"Ov04M",
        "&X8:RiYUG",
        "h0(`6BF",
        "c9\\N;h",
        "r\"PMXV",
        "KdEsy,+",
        "NIZO)",
        "AEMq-",
        "b?4G[",
        "m=<{zZm",
        "! sV2>=-",
        "pabeidz OOBE. Alternat",
        "a&gho",
        "R~\"Xe",
        "-'ZSb",
        "Beispiel: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "L:.zlW",
        ")^i&F!]",
        "hxkI@",
        "/Vybrat",
        "K+WYT",
        "Tj_R*zCR",
        "Tjuu!X",
        "@#'t<",
        "$RW UQ*x<",
        "de origem. ",
        "hT3B|e",
        "U?Li7}ob",
        "}azR]",
        "v5j:Xf;A",
        "V^\\>6\"\"",
        "2i7vm",
        "4[| wB",
        "9 tDpv<",
        "_UO|X",
        "Y!mQj",
        "C!q+!",
        "C'B'B",
        "@D!{N",
        "4^!G{",
        "qXMS@",
        "?A;9[",
        "F3Vz[",
        ", ktor",
        "Windows 10:n asennus%Windows 10:n asennus on jo k",
        "n/kxa.",
        "-\\)Df",
        "klad: setup.exe / auto upgrade DynamicUpdate disable",
        "###  q",
        "ljande kommandoradsargument kan anv",
        "A9S=C",
        "8MKcD:",
        "Dfs.C6",
        "&XJgXL",
        ">2jO-x",
        "*!jXxQRy",
        "4Zv-/",
        "*',,ljf",
        "5tRgr",
        "}4ro ",
        "iSBN-",
        "O^EOk",
        "HA`gM",
        "Nc+>}",
        "]6hq7",
        "5g]L)Z",
        "`uusG",
        "Of#Y7",
        "+z|X0",
        "CX;'d",
        " a sz",
        ": setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "-$#E;",
        "{bSsH",
        "}I{OG5",
        "/SmM~",
        "'qd2;:2s",
        "e*6e]",
        ";Mh}.",
        "lHJ._<",
        "7bk4~b0",
        "DeleteFileEx: Unable to open [%s]; GLE = 0x%x",
        "\\g]ma33",
        "A-cVr",
        "ll[rI",
        "{+Sv)N_",
        "0H*!}//e",
        "r / PBRUpdate er satt til Disable, verken oppdaterer eller oppretter installasjonsprogrammet PBR-partisjonen ",
        "Y;?\\B'",
        "X&J}t",
        "nw}]O",
        "CmdPAZ",
        "O?el?",
        "#yog]r",
        ":Nw69W",
        "7uQXZ",
        "zV4Yp5",
        "zLMX9",
        "RU]UU",
        "MRr},",
        "``<VL",
        "&_qo'w",
        "D[AH,",
        "iti sve podmape navedene lokacije. ",
        "gvY)9a",
        "xc?Gy",
        ".rdata$r$brc",
        "o]AW*",
        ">{KN^7",
        ";3;A;Z;~;",
        "o+wn4",
        "{Q;hv=",
        ":6i:O",
        "5&u[N",
        "{-6r\\",
        "(((B8",
        "Ih6Z5",
        "H2 !U",
        "FindNextFileNameW",
        ",7z:7E",
        "eno dinami",
        "IAwr}",
        "aO7!#f",
        ">_|?b",
        "(r-Hn",
        "nda kurulum otomatik olarak yeniden ba",
        "]oq'q",
        "..DJ@",
        "041304B0",
        "GO$J}",
        "xVh4z",
        "&sX&uf",
        ">71{A,",
        "8S|[,",
        "0@w$A0",
        "z67sB",
        "i=F(Y",
        "terek: Egy .inf f",
        "qiQ$m",
        "k]?\\p",
        "tbbdp6",
        "tJj\\P",
        "/WUCachedFileName \"%s\"",
        "ESD source file: [%s]",
        ";SA>vVoS",
        "Te[CU",
        "M&;48$",
        "\"2C/j",
        "m,?TC",
        "xBTPQ#",
        "=1XjJ",
        "[@JvI",
        "c-J(I",
        "X37:\\",
        "Z<h-w",
        "itNR4",
        "#x^*o[!o^!",
        "fs|tmK",
        "y7 d+=",
        "`Fy.Q",
        "Bsbca",
        "}xU;E?",
        "oEG@+",
        "Jc=@d",
        "0KYj)",
        "E!02h",
        "?F*nP",
        "N$4W:",
        "&YrV%",
        "Parameters: 5x5 productcode ",
        "ZL+`/",
        "2EL1S",
        "d.Yi_",
        "]yl;)",
        "OdJh'",
        "9dBY`",
        "u{omNz",
        "QRV*h/",
        "Z{9X$B",
        "ez no",
        ",x}RK",
        "|R=SB",
        "Fg.1Ux;",
        "m<ZqI",
        " : / pkey <product key> ",
        "W\"\\IpY",
        "LI1D|",
        "8Im:8",
        "1_?dyg",
        "YeN;?V",
        "bKd_u",
        "$%%qu",
        "Li#zb <",
        "/Recovery %s",
        ">a^\\n<",
        "RX0N4t",
        "TZ9|V",
        "[qzr/B",
        "B\\H_h",
        "\"eJq^-2",
        "RKD[TInA",
        "anas, bet pirms pirm",
        "4ZDAJ",
        "~PQu}",
        "H0/Y_.",
        ":A:Q:a:q:",
        " \"All\", ",
        "%'omgw",
        "=M\\cC",
        "gu)Tj&",
        "d5.@3",
        "Z8'G\\",
        " z&43",
        "StateMatch: [%s]",
        "Parameter: Ein lokaler Dateipfad oder UNC-Netzwerkpfad zu einem",
        "u6V: ",
        "Op?Q-",
        "$AbT'v",
        "`&wvSYA(",
        "DdO(w",
        "EnGMv",
        "r inst",
        "r1nA-",
        "UuM]Wo",
        "Gj96a",
        "nJiSOQ",
        "!|oIt&",
        "%fsXd",
        "*{-8r",
        "v-/E]",
        "(M (Z",
        "Gzn@[",
        "s(^Z_U[",
        "*j1W|K-8u",
        "=C:NW",
        "Uik>^,<",
        "\"e3_s",
        "l`RCf",
        "]6r/E",
        "RF<)Z",
        "739rVt",
        "Oa,\":",
        "k eO\\",
        "`wpVV",
        "\"RQ43",
        "\"q\"\\>",
        "7&7@7M7d7q7",
        "Prepar",
        "metros: caminho",
        "2/pf{",
        "kqK]G",
        "Y:JK1",
        "VH#sq",
        "#zr0TF",
        "Kontrollera kompatibilitet",
        "dzia. Spr",
        "n'5qK",
        "-Wm/fq#",
        "[V\\$V",
        "chTG[",
        "en-TT",
        "Panther",
        "hPe;:",
        "s adathordoz",
        "czeniem sieciowym. Spr",
        "dia pr",
        " telemetriatietoja. ",
        "%SCz,",
        "mDCM;",
        "@)WQ8",
        "xfO<}l",
        "F1MkGz6",
        "Detected existing setup mutex... exiting.",
        "ide: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "anas datu nes",
        "{M?Z.",
        "^@yx#b",
        "IZCIv",
        "cL}F?[",
        "@r?Op",
        "6Ex'dm",
        "ini belirtir. ",
        " pendant qu'une autre instance du programme d",
        "DJw6+",
        "klad: setup.exe / auto upgrade / showoobe full",
        ".s~71",
        "9AXGb",
        "TWks-",
        "nd den andra installationsskivan som det st",
        "b!B/e",
        "anas programma veiks dinamisk",
        "*7<k(",
        "$DHb[",
        "ct\"FI",
        "-uDee",
        "ZnK\\(",
        "Rengiamasi ",
        "z3Fm.5",
        "DX|[F>k",
        "-El2[h",
        "t fra det punkt, hvor jeg stoppede",
        "metros: clave de producto 5x5 ",
        "`0]/_G",
        "rF^6\"",
        "we(c1lzw`",
        "UhI($ ",
        "gTk8 =",
        "bbtef",
        "WVa5oW:",
        "000@@@@@@",
        "]~N;<=",
        "WY-/N",
        "%Z!TWE",
        "s veicam sagatavo",
        "!s_k#",
        "L$4_^[3",
        "MJbM,[",
        "G-P|g",
        "c>BD+",
        "Could not retrieve error description from action for [0x%X].",
        "bo,{1",
        "Process timed out!  Returning: [0x%X]",
        "en-IE",
        "_v8o5",
        "Ga4b\"",
        "T},6,@",
        "4QZ*]",
        "q|M]T",
        "6T[B9",
        "@JMA+",
        "'>&F+",
        "Voorbeeld: setup.exe / auto upgrade",
        "%5UJM",
        ";JAqth&",
        "fnL`h",
        "Bryter: / Postoobe <plassering>\\setupcomplete.cmd ",
        "OutputDebugStringA",
        "~eCM.",
        "_Z4=1MU",
        "vSB>@",
        ">{7jd",
        "675>o",
        "is diegimas atliekamas i",
        "Qp3rAB",
        "anas oper",
        "e, le programme d",
        "d$wV%",
        "'mks}",
        "2*2J2U2^2h2m2r2~2",
        "5m(m*",
        "R`cWZ",
        "Switch : / installfrom <location> ",
        "nje stanje i OS. Pokre",
        "b3\\ej",
        "zo(z7",
        "%4{gC",
        "}.6P]",
        "Actie: bij een mislukte installatie kopieert of uploadt Setup de gecomprimeerde logboeken naar de opgegeven locatie. Hierbij is het belangrijk dat de pc en/of gebruiker beschikt over de juiste bevoegdheden en netwerktoegangsrechten voor het opgegeven bestandspad. Deze opdracht wordt uitgevoerd als systeemopdracht",
        "zeUz/",
        "ma)u'",
        "K)m*'",
        "-F{Ir",
        "CEe`|",
        "Q&8`|",
        "oP$5U\"",
        "Y1/DFm2",
        "xel: / PBRUpdate <parameter> ",
        "Ar9s|k",
        "FD\"zD",
        "r inte att fastst",
        "lja a m",
        "N>CU-|_U)1",
        "fykFV",
        "O|||y-",
        "n~'e,Vw",
        "SO'4H",
        "n]lleO",
        "o`kP.",
        "[92<x",
        "?E\\iL73",
        "g0{w&",
        "0&b3e,D",
        "jrwww",
        ".9Setup kan de taal van de gebruikersinterface niet bepalen",
        "<`bcs",
        "o#5yb 4'",
        "+U^Zk",
        "9{c?7{a",
        " OOBE ",
        "hrt wird und die Netzwerkverbindung m",
        "Ng`l5",
        "GetFileAttributesW",
        "3#2'p",
        "3#3(3<3g3l3",
        "5.38Q",
        "zla e",
        "Ys_Ye5V6",
        "0G0V0d0u0",
        "tor rekurz",
        "}MsU*",
        "Windows 10 Setup akzeptiert keine Befehlszeilenargumente. F",
        "ih3xKj",
        " ke kop",
        "4zNi<",
        "jam vai procesam, kur",
        "I\\gH)",
        "~?rbp",
        "d~Z0Pc",
        "NNR+|ELU",
        "RVTlQ",
        "]H.ZO",
        ".iqU6",
        "UZ!kU",
        "UQ=\\u",
        "3X-8@",
        "x%rwIh",
        "oJ$IoM",
        "-M4Dv",
        "zSE4n",
        "\"&96=",
        "*.x7Q",
        "'2k[\\",
        "metro : / Postoobe <localiza",
        "6[m;;",
        "XC/pN",
        "OY>#F>",
        "0;1B1L1S1$212h2o2y2",
        "NMyYV",
        "gb]U4et",
        "'n\"PV",
        "r{` Bk",
        "df~;(",
        "83,X!",
        "ZjLks",
        ")VoC'",
        "RpPeC",
        " -kYVWB",
        "SdjnYS*u",
        "oihZtW",
        "sekor. A sz",
        "klad: setup.exe / auto upgrade / Telemetry enable",
        "!esgp",
        "wS,to",
        "&M\\Ph6",
        "u<#S4",
        "X0j$AT",
        "|c\\HX",
        "u{1Mc",
        "Of.'c",
        "^w}nj",
        "Tarkista yhteensopivuus",
        "e}@v[",
        "N/~\"6WYM",
        "cznik: / DynamicUpdate <parametr> ",
        "[/oR^",
        "roLoeu",
        " OOBE: ",
        "u yeniden ",
        "-)[V+N",
        "t=Du2 +",
        "16}H.",
        "!J G@K",
        "7]O{?",
        "RSSq1",
        "m'mmE",
        " niveau vers Windows vNext, en ne n",
        "7K,_i",
        ">PLRI",
        "m$6CL",
        "g7LN],(",
        "dC!*/",
        "b\\|z7",
        "S:Wi`",
        "wO4>N",
        "{8n^l",
        "a'vRC",
        "#Y3)/",
        "db\"6z",
        "Vz :6",
        "o: esta op",
        "f\"\"UZ",
        "2Cm7t",
        "\\`~cJ",
        "gu-IN",
        "qs-S,{",
        "Action : indique l",
        "Q'(/<\"",
        "A~!?m",
        ".boxload",
        "Opnieuw beginnen vanaf het begin",
        "GR@(]",
        "^J=J\\",
        "!eA<f",
        "~N'4T",
        "8~caD",
        "' \"kh",
        "fS1hm",
        "[F?Y^",
        "G<#-p",
        "BitBlt",
        "GQ,V>",
        "iV$K>",
        "!ElP#",
        "dzis: / installdrivers <location> ",
        "!FZ*F\"",
        "CopyFileW",
        "parationQLe programme d",
        "s7%%+",
        "Cleaning working dir...",
        "[g0M0~0[0",
        "191113214040Z",
        "`o`/m",
        "h/lA8",
        " vc4A",
        "avanje zadataka nakon instalacije, ali pre prvog prijavljivanja korisnika. Pokre",
        "0#1h1",
        "Tg:WO}]",
        "E@NNNzbL",
        ">}\\'5",
        "&i.Y^",
        "I>f_j",
        "OL9>K",
        "6>6n6y6",
        "&VA+9",
        "wt=sFT",
        "Jf(Yr",
        "lNek8",
        "%!p0p",
        "wLu:C",
        "r %s bitar p",
        "|7RFA~",
        ":F9a[",
        "iOi0:",
        "V0xp=",
        " predvolene, s",
        "v;mEJ",
        "Ow9Owy",
        "erw3~",
        "?r,p=.",
        "O|w\\qK*VK",
        "D$HSV",
        "(CD9I",
        "}h6C9",
        "D$DPWj",
        "-9I_pz",
        "f [so",
        " ir i",
        "DQU_vu",
        ">rn1;",
        "@0I&W",
        "A!z6C",
        "wPG@7",
        "3WR\"q_",
        "*%]Ex0",
        "VTgk}",
        "ozVGu",
        ",$Xw-",
        "kUo~6",
        "Process timed out!  Terminating process...",
        "u'1Qw",
        ";92y'",
        " e non caricher",
        "]A0-p",
        "2ER5t",
        "^>{yC{",
        "'Jtv|s",
        "5r!7P",
        ";}^yi'",
        "gQO3-R",
        "Px4.>",
        "OGQ\\4",
        "l=gB'R{Y",
        " interakt",
        "/fM\\)",
        "\\Odzv",
        "Oaf^Saf",
        "0\\> A",
        "RPCRT4.dll",
        "qU59B",
        "1U#a2*-",
        "DsaV*",
        "k+[Yf",
        "E(d6LS",
        "nom prostred",
        "0X^aQ",
        "G\\f\\p",
        "R(W/\\",
        "8|Vof",
        "Parametrai : N / A ",
        "nda 64-bitarsversionen av verktyget om din dator k",
        "n de Windows 10%Programa de instalaci",
        "6j$M*",
        "cii s multilicen",
        "5Kux9",
        "mn0;3Lu ",
        "'0D |",
        "zN<s\\",
        "wXUeE",
        "eJ;V:E",
        "k'5@b",
        "/X 8?+",
        "^&r|Y",
        "'to}BYr",
        "^j5Z0",
        "Qu3L%",
        "<kq~j",
        "installation. Fermez l",
        "nz8I>",
        "Prebacivanje: / migratealldrivers <parametar> ",
        "(GiC9",
        "o%80T",
        "i0.gv",
        "Working path still exists. Cleaning working path: [%s]...",
        "'./$\\~'%2",
        "9]Qa,r",
        "hOoL&",
        "jK3(ev",
        "{a?<4",
        "!|e[$",
        "3=i\\3",
        "y{kz;",
        "{P_3(",
        "gtViS6",
        "2C[`h",
        "FindFirstFileNameW",
        "~gMOt",
        "$|wX'",
        "`A<O<8MK%",
        "ECg*G",
        "E9vzYX",
        "tko.h{",
        "nMY2-",
        "pR6gQ",
        "*s#~u",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "qps-ploca",
        "D\"(XX%",
        "ZZ1:{3",
        "?4?D?X?h?{?",
        "[Eswu",
        "q9G#4",
        "MOX]|rD",
        "fHT\\ ",
        "N.+}@",
        "9Rp9$",
        "[!n^Ejn",
        "njega stanja. ",
        "Fdm7a",
        "i|~80",
        "QIl[?",
        "_wcmdln",
        "zy`tR",
        "&r;=\"]",
        " uruchomione inne wyst",
        "1^bG<K|",
        "Zd,nX",
        "O`t4f",
        "ZIw~~qH8",
        "i}!X&8",
        "~3pBZ",
        "$7)pMh",
        "r <_EI",
        "`<.BAD",
        "7}e6is",
        "R2T4U",
        "pDI^%SV",
        "N~GXE<",
        "I/To~",
        "101=1y1",
        "=B/kl",
        ">x6>n",
        "q]~;je",
        "qpmy|",
        "ZC-yV",
        "P1Ll$",
        " jour dynamique (recherche, t",
        "/Yjk[<",
        "NOTA: Este conmutador solo se debe usar en entornos de y para pruebas. No debe usarse durante la producci",
        "ie komand",
        "'=o!4-",
        " \"bcR)",
        "}j-Yw",
        ".!M7\"",
        "5c^X;",
        "2G2Q2e2l2z2",
        "UC:~M",
        "nika zawieraj",
        ",>vRq",
        "+3d9{`",
        "Konfiguratsioon",
        "vTkeO",
        "(W2)2<,",
        "8mN;fp",
        "+::h=rCG",
        "@rY+O4",
        "da nemate dozvole za kopiranje na lokacije koje zahtevaju korisni",
        "bj+Er=",
        "VAi5;",
        "D$\\$)@",
        "z\\ T#",
        " partir de l",
        "~yJ>4",
        "'X%2x",
        "OOBE ",
        "C-&Kl",
        "0@d$A0",
        "Q\\'dG",
        "Valitud arhitektuur ei sobi teie arvutiga. N",
        "6jcpmq",
        "~28o9",
        "e;:0}t",
        "j-Yf;",
        "9Mks)",
        ",f6l;",
        "8@8Nk",
        "233p3",
        "uQ5*1",
        "!AbmC7",
        "]3Wh5L",
        "+9|O(",
        "*8yl-",
        "`^Wqpx",
        "N}Q}K}_M",
        "c`G/n",
        "t?o.|",
        "n01q1",
        "sistema; portanto, talvez n",
        ">,><>@>P>T>X>\\>d>|>",
        "boru specific.wim ",
        "u~90$",
        "d~3sQ",
        "hB %6 ",
        "anas programmu.",
        "R2WZ5",
        "o deve ser usado em produ",
        "%Ty|5j",
        ")uR;,",
        "VVWk(",
        "040B04B0",
        "YBC<m",
        "~WI?V",
        "\\zF.:[",
        "ho programu se objevil probl",
        "G*tB+T",
        "ce argumenty wiersza polecenia.AA Instala",
        "GmO-0",
        "        exploit related to Sysprep.exe being auto-elevated. The list",
        "HS*\\J",
        "$Ls3a",
        "J*NG=Y",
        "DEE%UU",
        "2Yu{j",
        "hrU4g",
        "zJWcZAg&3Y",
        "3v||^",
        "5(>0/B8%",
        ":MwnD",
        "UjNrM=",
        "vi-VN",
        ":+o\\$",
        "da pak ",
        ">BtJD",
        "~Vi^y",
        "Phh!A",
        "=|mzT",
        "x;\\we",
        "n. Si anteriormente iniciaste el programa de instalaci",
        "Parametere: Lokale filbaner og UNC-nettverksbaner ",
        "%SRJn`",
        "E`af@",
        "2rmo-",
        "OegG~",
        "c_\"gd",
        "o7e<1`",
        "XQp2j",
        "d]s&7Y",
        "vyrCg",
        "e@#w ",
        "ao concluir tarefas de n",
        "Lowering priority for WU scenario...",
        "_=>S?",
        "U&`mU",
        "L.llt",
        ",>qm~{",
        "rbf.;",
        "%9Be>~C",
        "b8+;c",
        "rak olarak ayarlanm",
        "w3AV!",
        "$EtW$",
        "?p p0p(p$p4p,p<p\"p2p*p:p&p6p.",
        "YI[WYH",
        ")`kks$",
        "ajte ponovo.wAko instalirate ovu verziju operativnog sistema Windows 10, ne",
        "tartuje po",
        " U@y@",
        "OLh95\":",
        "1E:0Q",
        "`0+.=",
        "yN\\F%",
        "jb<im",
        "e;3\"a",
        "vi izvieto",
        "m tDF",
        "kalu, k",
        "d]yxb}$u",
        ",O]sX",
        "2s'IA",
        "-~O@v",
        "/;\\;H",
        "fCgk0",
        "Pl9ow0",
        "uR{!7F",
        "n deneyin",
        ")ybXLDo9J",
        "&(vU!",
        "qd|$m+\\(",
        "=)hHH",
        "~VHb 6e",
        "`1Xn0",
        "@ ;A u",
        "66BVN",
        "Administrator",
        "rujte v",
        "Foi detectado que a instala",
        "N#o'#",
        "Wuwuw",
        "ng verktyget, starta om datorn och f",
        "hren Sie Windows 10 Setup erneut aus.",
        "70ygmS",
        "O0;:[",
        "vd$gI",
        "ng datorn startas om. ",
        "dia de instala",
        "9YoZnM1q",
        "Esempio: setup.exe / auto upgrade / copylogs \\Condivisione\\UpgradeLogs",
        "D>OHk",
        "X!(_)",
        "Veiksmas: automatinis diegimas su diegimo perk",
        "s van een afdeling. Daarbij wil ze de gebruikersinterface van Setup niet weergeven, maar wel dat",
        "n 350 Mt tilaa. Vapauta tilaa ja yrit",
        "UJNfTJ",
        "ver anv",
        "5jCB)",
        "rp>O|",
        "TYm\"k",
        "ho po",
        "chec d",
        "rgmiste k",
        "chec de l",
        "U*M^%",
        "kqV:j",
        ":*[dC",
        "DlpTask: Resetting action [%d] progress start time.",
        "2sQV_",
        "l*;*\\",
        "Pb/9j&?",
        "Prebacivanje: / quiet ",
        "MnV0{",
        "0(RhM",
        "L])EZ",
        "/Ouup",
        ">(Ko%",
        "9:J8Z",
        "3h_YU",
        ".?AVDirectoryHiveUnloader@@",
        "fPnic",
        "bNr.|{",
        "olvDU",
        "K`CqJ",
        "gsrVA",
        "rv} E[",
        " /ZsCa",
        "T4N>Z",
        "R]?;X",
        "+gc\\Z",
        "SendMessageW",
        ">=>h>o>",
        "GAYsh",
        "Mlj[6",
        "s\"!Ku",
        "b$\"yJ3",
        "VC\"$A2",
        "~[SUk=d",
        "0qDu&",
        "o!q(ImV",
        "ZkdN+",
        "dzie jeszcze raz.wDo uruchomienia Instalatora potrzeba co najmniej 350 MB wolnego miejsca. Zwolnij miejsce, a nast",
        "a9Tqz8;",
        "< ='=>=G=",
        "S`o07H",
        "]<h1it",
        "o (conhecida como OOBE). A linha de comando a seguir pode ser usada para orquestrar a atualiza",
        "CPackageScenarioCtrl::ShouldPreserveWorkingDir",
        "%G~(6u",
        "|||v|xp",
        "y:V`{",
        "t>C;XuI",
        "kseltme yaparken bu parametre gerekli de",
        "jumi. ",
        "cego wersj",
        "r installationen misslyckas och ",
        "tuzO]7",
        "&_HxS;",
        "^8{a1",
        "|@SOj}{",
        ";%=k=",
        "n3)0'",
        " fail",
        "Instal",
        "j?G8<P",
        "9kXq5sY",
        " verzia je syst",
        "~Un3E",
        "|x3K:",
        "92x8d",
        "1@'=KH&A",
        "FUr9B",
        "k&PfLLm",
        "'\"UsE",
        ">;B[SJ[",
        "09Rx2",
        "8C9T9Z9",
        "^V;[h",
        "+n6@3",
        ":yO@-",
        "^VfFY",
        "0hC{n",
        "3#4?4",
        "a&UOA+R1",
        "*|e~J",
        "D$0SVW3",
        "$TE=DX",
        "V/]$s",
        "2-\\*zg",
        "andamento",
        "Gt+G]",
        "ho programu. Asi je",
        "L{OFc",
        "G=|2h",
        " Microsoft Corporation. Minden jog fenntartva.",
        " setuprollback.cmd ",
        "Toomine",
        " jour dynamique, accepter le chargement et la collecte de la t",
        "7U<z>r",
        "nssnitt ",
        "ch soubor",
        "bb 350 MB szabad helyre van sz",
        "^?ewb",
        "Un ing",
        "Px7rf",
        "pTq~1",
        "!%[`v",
        "u}@'c.",
        "rMOcT4",
        "GA AI",
        "/bBc1",
        "fxeKi",
        "fXFM2.",
        "o %s bits. Quando este for inserido, a Configura",
        "otfk;e",
        " asennuksen l",
        "7k-T)g",
        "1.4(O/N]I",
        "(z54!l",
        "s$kfL",
        "ti, nem fog tudni vissza",
        "re mia",
        "gZqS ",
        "CreateThread",
        "~OBaAw",
        "Cy(\"M",
        "Z2ZR8",
        "##8Dj",
        "If.S2",
        "Windows 10 Setup",
        "? ?,?8?D?P?\\?h?t?",
        "?:TC9",
        "rskendatakse v",
        "ndig uppgradering till Windows vNext d",
        "DZ=;L",
        "tSd2r",
        "`cM!tJ`",
        ")hWrS",
        "F\"`C.(U",
        "m[4`rO",
        "Hadx=h",
        ":K#gj",
        "rio somente quando o computador atingir a OOBE : ",
        "tAF;u",
        "YPvg[",
        "'MUN=",
        " 2wX$",
        "yp/_m",
        "B^q%=",
        "1.ZT,",
        "7x1_mP",
        "i!1T;)",
        "\"oH=}o",
        "n[TkJ",
        "]1}K.",
        "/_Z}}",
        "]m?dsl",
        "Y5M@M",
        ")k8A)",
        "s1C3peQ",
        " bulunamad",
        "dia / files ",
        "RtlNtStatusToDosError",
        "_\\z/B@\\",
        " adathordoz",
        "hyZ-+p",
        "~$PY<",
        "gk_,<s",
        "<yw9k",
        "m4q+L",
        "$)$is",
        "Registering [%s] ESD image download directory for disk cleanup",
        "qwzib)",
        "&bi)I",
        ":+-R*l=",
        "vat jenom p",
        "M~EW,",
        "$1L`u",
        "{+ro\">",
        "C|\"{i\"{h\"",
        "[4}n_",
        " setup.exe ",
        "%1gaE",
        "n que indica %s bits. Cuando lo insertes, el programa de instalaci",
        "&Neste",
        "urnalus ",
        " e caricher",
        "R<f(>",
        "lYdR\"",
        "(d(e`",
        "Parametry: lokalna lub sieciowa ",
        "cJj|i",
        "i PC-jeve u svojem odjelu nadograditi sa sustava Windows 7 Enterprise. Ne ",
        "?DK7 ",
        "f[s)(bb",
        "utY}6",
        "6[>'&",
        "\"4.X`",
        "HF_dM",
        "L>mxJ",
        " kaikki m",
        "Fk>Jk",
        "jiet uzst",
        "A=4tn",
        "IQrB|",
        "lTn*O",
        "DzLNV",
        "l bandykite paleisti ",
        "9r0st",
        "A`Hl:",
        "nYoxa",
        ">Z*.c",
        "<M\"'K7",
        "RQH<T",
        "Sources\\Diagnostics",
        "NrRY&?",
        "rt. Neste gang PC-en er startes p",
        "I_%jc:",
        "*\"r5iA",
        "c'V\"[",
        "+W}h/",
        "A6z-e",
        "up)//",
        ",n_E.(",
        "gfeyAM",
        "=0>i'v",
        "/P/.B*",
        "etky in",
        "0k0o0",
        "tsa el a setuprollback.cmd parancsf",
        "/M6`?",
        "che soll nicht angezeigt werden, allerdings sollen die Endbenutzer mit der Windows-Willkommensseite manuell interagieren (einen Eindruck beim ersten Ausf",
        "GetSystemTime",
        "8+9^9",
        "s;#D\"W",
        "j8z0nPN9irn",
        "37Jkz",
        "[LKHL",
        "GB_c$",
        "Azione: specifica il percorso per il supporto o i file di origine dell'installazione ",
        "vcvpr",
        "'tPL~",
        "ggs'r",
        "lda: setup.exe / auto upgrade / installdrivers c : \\saj",
        "s local ou un chemin r",
        "O.7*8H",
        "2knThn",
        "ryejzs",
        "A;%>F",
        "+4{e~",
        "Y/GX1",
        "9ToK0",
        "(\\gH$w",
        "9/FxB",
        "y^w+7",
        "3h3n3x3",
        "[qjs'",
        "v&^52",
        "ramise UX-i ",
        "HR\"8k6",
        "6].?8",
        "@@@000",
        "LBh18",
        "dGX}\"$",
        "]EYF3",
        "A arquitetura que voc",
        "blCc@P",
        "mH/^|",
        "Perjungimas: / Postoobe <vieta>\\setupcomplete.cmd ",
        ";w+!Ad",
        "i.'NL<",
        "#0}#~",
        "Phx A",
        "1G,V7Un",
        "*}HPST",
        ">BA~}#,Z",
        ".a! /,",
        "&/0#b",
        "~AKJ?",
        "JS)&L",
        "0k0!nW0~0Y0",
        "FzWHn",
        "n especificada durante el proceso de instalaci",
        ">h];/",
        "la na povremene mre",
        "J{YF\\",
        "t<Yuc",
        "^<u`V",
        "`ed ;`",
        "E^fU+H",
        "[|cbF|",
        "zFQx&",
        "C2<*g",
        "-Es$C|",
        "cMyg?",
        "E[d^Rm",
        "8wz\\r",
        "'9'qP",
        "DdOIa",
        "biri olarak ayarland",
        "2Y9Y9_Y",
        "qd>YGN",
        "o: / installfrom <local> ",
        "NoeR1",
        "V\\!e\"",
        "g!SX=",
        "v-mP-",
        "mas at",
        "CDlpTask::ReportDiagTime",
        "itie tohto prep",
        "utfH=",
        "%r`9iJ;",
        "Kj*Go[",
        "vWnSJ",
        "K\\-`s",
        "$?phJ",
        "{$C|X/",
        "/\"VYa",
        "Q2B*69",
        "SetupHost.exe",
        "Parametrar: Full; None ",
        "~MW)|p",
        "op+6?vx",
        "V7wW7X",
        "U:sG0;",
        "w#@fi",
        ";2;=;k;",
        "|}r}:I:Y/",
        "H&KQD",
        "IUR*yM}@",
        "U{GqL",
        "\\&OI(-G+",
        "K)B4F",
        "V]?du",
        "wY$v5",
        "Q\"+W|",
        "B}=g1",
        "TAl},",
        "Azione: consente di inserire il file setupcomplete.cmd dal percorso specificato. Setupcomplete.cmd ",
        "X3bw@",
        "q)G@mY",
        "High Contrast White",
        "u]OO_Hw",
        "xz9`l",
        "Ru7VS",
        "!(Fl0",
        "ed-BDf4W+",
        "O$FN&zCd\"",
        "sr@#SL.",
        "xh=]~",
        "<F~E^$",
        "Q6:y3U",
        "verser la t",
        "wox;>>",
        "UhcER",
        "-0KY6E=",
        "'d%JN",
        "<^f^A",
        "|-i(m!",
        "-ulC[1s",
        "N0L0J",
        "riist, taask",
        "F5%e,",
        "yb}pYBo",
        "F1a6p[",
        "H]diK",
        ".Ew=W",
        "4EVNFT",
        "p=A.Q",
        "Fq5@!",
        "tke arvesse, et arvutil ja/v",
        "n (conocido como",
        "SetupDUUpdateFiles: Target directory [%s] does not exist.",
        "@rRu2$",
        "rkssti til en specific.wim ",
        "_n0'Y'",
        "c47>~",
        ")c&{V!",
        "2!3[3",
        "4II?!",
        "rZ`92",
        "&pvR<CB",
        "EtwEventWrite",
        "UqP<B#:",
        "VT.'\\'",
        "_n+{v",
        "`n4G!",
        "DKG(n",
        " g?'g",
        "wn7\\5",
        "h6u}u",
        "#9d\\$.dGu",
        "} NUC|",
        "o\\g7w",
        "c7gr>",
        "n1) ](",
        "dD{qvq",
        "toru sa nepodarilo ur",
        "]sI>c",
        "v\"Ly2x",
        "m soubor",
        "?huyp",
        "<j3h+{",
        "Parametri : lokalna staza datoteke ili mre",
        "J4+u0",
        "SetupDUUpdateFiles: Target directory [%s] should be empty in the presence of reference directory [%s].",
        "(&N)6Setup.exe ",
        "Exemplo: setup.exe / auto upgrade / PBRupdate disable",
        "znak tich",
        ".4r&\"",
        "J{XVIo",
        "hw6nc",
        "vs0U_",
        "\":nK\\r_",
        "R*@7%W",
        "c\"<ZOU",
        "L$t_^[3",
        "5,GM,L",
        "_.\\+I",
        "yxpmW~",
        "[zH0Of",
        "j*:QQ",
        "gs c3",
        "L{?[0U",
        "klemeyle ilgili telemetrileri toplamaz ve kar",
        "avN6}",
        "s est peut-",
        "vk0zv",
        "-Nn0h0M0o0",
        "`RqRoX",
        "pNAKc/F",
        "d.Dlf",
        "h{7D-",
        "Installasjonsprogrammet for Windows kan ikke startes mens en annen forekomst av installasjonsprogrammet kj",
        "/AzureHost %s",
        "uo2<2",
        "bory contains.inf ",
        "en, program za instalaciju ne",
        "UrkbwO=",
        "y[EPG",
        "$Hj0AR",
        "^k/{d|",
        "{GHImlm",
        "kleme tamamland",
        "GJ>/Wcc",
        "LS(A/",
        "A},06",
        "-pu.^",
        ";0bF/",
        "bGupAAO",
        "W~))h2Jt",
        ")0Wt1",
        "-u7O&",
        "|+|+}",
        "Y/10z",
        "/<WlU",
        "WiL@X6~q",
        "x}9OX",
        "ch dat souvisej",
        "~m)P>",
        " dokon",
        "ritetyn sijainnin kaikista alikansioista. ",
        " 23?Q",
        "TNNi=x&",
        "I97%N",
        ">&?-?",
        "bkpPx",
        "D&vrn5",
        "Gk\\auH",
        "Gs_6m",
        "-vh-396",
        "vhtBD",
        "Jhkf&",
        "~1N;@Z",
        "h`@^#&",
        "ges que l",
        "=^~='",
        ":C,5.",
        "bg-BG",
        "}d;?s>",
        "o8+I@",
        "$uQ} ",
        "CVw\\g",
        "n de diagn",
        "memmove",
        "T;\"]u",
        "n niiden oletusasetuksia. ",
        "#zLe#",
        "sI|KwE",
        "-oPr4",
        "K2#Z.",
        "8&9C9r9",
        "outil ",
        "xsBlVr",
        "$i5In",
        "TNE|evzAepS,",
        "]]9F[v",
        " installer Windows 10 ?",
        "Mu6r}",
        "yRbA:",
        "Ig_+5",
        "ZYu}z",
        "lj8#a/3",
        "Parameters: lokaal bestandspad of",
        "TGM=*d",
        "5{rp%,sT",
        "rM!*Zk",
        "PhE=._5",
        "c QB;",
        "_nXyp",
        "W-O#38",
        "ne geri d",
        "m, kas ir lietot",
        "Ee2!~",
        "b_\\, Xw\\",
        "eW>3V",
        "s ellen",
        ":> (py",
        "<mF@!",
        "G3;=/<",
        "Ma3{{",
        "n`'B5",
        "aeOV2",
        "pulej",
        "SPCleanupInstallationDrive: Cleaning up %s",
        "\\bcIu",
        "wXN5M'e",
        "fr-CD",
        "l^D<d",
        ".}_I ",
        "}/r8u",
        "hgt6z",
        "Je7)Sp",
        "mpNastaly pot",
        "3.$r9Ah",
        "j!ldW",
        "vf~QUx",
        "%s: Calculating file hash...",
        "Z65K2^",
        "~4Rb[yc%",
        "bb~A Setup.exe telep",
        "une autorisation et d",
        "Eksempel: setup.exe / auto upgrade / installdrivers c: \\minOppgradering\\drivers",
        "){\"iK",
        "k=yFk",
        "{x0T>",
        " failu setuprollback.cmd no nor",
        "&>7S\\",
        "p_x_w",
        "Jg|*zh",
        "?'i{1",
        "bW$Etj",
        "@#mFX",
        "Parametry: All; None ",
        "/q05:",
        "F'[nc:&[",
        "f*[*1",
        "G+jyzzlf",
        ")JU~[",
        "bg!~m",
        "H\\\\+a",
        "s,%p4&",
        "rV[r7",
        "KNw%j",
        "v?(7Fn",
        "cie> ",
        "k2W j",
        "Sedkdc",
        "_JZzd",
        "Zgodno",
        "dZUr%",
        "CDlpManager::GetDwordPropertyByIndex",
        "O| lo",
        "P%&Bt=0@`",
        "Sm_SHGl",
        "rL1L1",
        "Y[[[!%",
        ":pDtS",
        "V5sY5",
        "!\\Y#<<",
        ":b4c8",
        "QEQbl\"i",
        " program.",
        "hKw7~",
        "l1}Nq",
        "tja a telep",
        "installation de Windows 10 ne prend pas de param",
        "o Defini",
        "a[]eY",
        "N_`1:",
        "bWIbP",
        "E@_\"@ ",
        "zda Windows",
        "&ROs5",
        "bbtS T",
        "q!252E",
        "CDlpManager::DeleteQuadwordProperty",
        "mpligt ",
        " |kwf",
        ":ha2=",
        "UM&,g$qc",
        "}p-?v",
        "Het kan ook voorkomen dat een implementatie-engineer de logboekgegevens en andere diagnostische gegevens van de test-pc",
        "jf-r$",
        "afnzH",
        "O*]1Kf",
        ";K]Nh",
        "ja atra",
        ";F23!",
        "y|$p3",
        "ILV']AV'}/Y",
        ";LcO6!",
        " ruleaz",
        "^mn\\w[",
        "*ly>zaJ",
        "ppp@@@@@@@@@ppp",
        "@CA}z",
        "b?0Bt",
        ": / DynamicUpdate<parameter> ",
        "IbG~s",
        "qw-Yx",
        "3.3]3",
        "ha-Latn-NG",
        " v zdrojovom prie",
        "\\w'pNr",
        "A]G;F:",
        "hKopJ",
        "v&n0U",
        "Xk'iK",
        ">t<{U",
        "93%C?",
        "U0bZCM5",
        "k{gWO?Iq",
        "]zWBZ",
        "4bRE.kEw",
        "2C[?[",
        "o/C_g",
        "^'|S8|",
        "a~y%o",
        "?G&Ho",
        "iU'nw",
        "Hrjhy$9=T",
        "IVRr<",
        ";=>c>m>$?W?c?",
        "!eeDY",
        ":U:KG",
        "W=3h^",
        "VVok8",
        "ivatelsk",
        "]9Z~>",
        "!}7XM",
        "<0<5<3>?>",
        "\\W$4Nj",
        "<!<<<V<c<",
        "#nw7p",
        "ntalo de nuevo.USi instalas esta versi",
        "fl`@F",
        "v<\\b]",
        "Xb1@S",
        "};6H;",
        "j+9vB",
        ":MG-o.X",
        "{;i6oa",
        "G?t'F",
        "A Instala",
        "<.%x\\J",
        "gle i 5 grupper af 5 tegn",
        "|dP__",
        "3Oye,",
        "a90tm",
        "~>zA(,",
        "mV)/4",
        "qTr M!",
        "P#]OR&1",
        ",oaxy7",
        "S_,OHP-",
        "a$Vw6",
        "van keres. ",
        "y91,8",
        "installation h",
        "vNS:\\F",
        "6T SZ7c",
        "zN,ld",
        "Q{5_DpV:D",
        "v02\\xvJA",
        "Ej$ew",
        "0;0B0Z0",
        "f>6\\|",
        "vD*LM*",
        "UTM@?W",
        "S5K7y",
        "Akcia: Ak je prep",
        "pule viima. Kui aga s",
        "9n1kU",
        "9oEe{w",
        "2~qG<c",
        "&Ki`}",
        ">EYpg",
        "ivitage arvuti ja proovige Windows 10 installiprogramm uuesti k",
        "|${[do",
        "??1)-",
        ">P[dr",
        ".<`sJ",
        "GJ-Z,x",
        "*o~H30L",
        "U4u[Q",
        "s vietas apak",
        "Z U&Ex",
        "Translation",
        ";Z~fS",
        "lJ2y<",
        "ChA=T",
        "=EWgt",
        "`gmGK",
        "D4[>`",
        "+~0F|0",
        "&!>ln1",
        ">r84H",
        " None ",
        "yGw]`{+7",
        "$qR8)",
        "&RFD^Z",
        "m!|H=",
        "vDYYY",
        "c(P0_",
        "e;3\"El",
        "#.r;$?",
        "|WC=H",
        "%OHV3",
        "[(dIV1Z",
        ":\\.<Kx",
        "f^L*?s!",
        "Uv'qP",
        "r Windows 10",
        "9Vr_nN",
        "ghQt7hCDv",
        "Xeg\\E",
        "igist alamkaustadest. ",
        "\\;HjDB",
        "<hAJH",
        "dVQW|x}S",
        ", namestitveni program ne posodobi ali ustvari particije za hitro ponastavitev. ",
        "v@W_S",
        "aiZhd",
        ")f(^k",
        ";>Rw`",
        "D|2D:",
        "'ybPL",
        "e'Esx+",
        " tvarkykli",
        "G=qk;",
        "kpRrJq/)",
        "        name=\"windows.storage.dll\"",
        "lus un citu diagnostikas inform",
        "ivitada.qInstalliprogrammi k",
        "wfB@H",
        "c'_Q[",
        "Switch : / DynamicUpdate <parameter> ",
        "Szu,3",
        "0{nv1",
        "WB^x{h",
        ">c4&k",
        "pA^+'",
        "&Nqxvk",
        "T*Zn\"",
        "nrX!3!",
        "FM0M8",
        " wersj",
        "!!.>n",
        " >z(kt",
        "|G$=F",
        "=(h,i",
        "M$yq\\",
        "5aa_c",
        "BkVmF",
        "UohOMz3",
        "G8cj6g",
        "Pavyzdys: setup.exe / auto upgrade / migratealldrivers none",
        "UT]Oy",
        "E:XMA",
        ">(?0?S?d?~?",
        "G~;_?",
        "ipHTR",
        "R o\"E",
        "ZYB/7[",
        "a=|02",
        "%`kR|",
        "?Do1=",
        "GetModuleHandleExW",
        "Stikalo: / Telemetry <parameter> ",
        "o?U3M",
        "0A$$?0",
        "orO&Y",
        "}qY`8",
        "5x'muqF|",
        ",V'y+",
        "=Q,+9",
        "jbOWE",
        " parancs arra utas",
        "RrB4*",
        "%S0Ee}O",
        "0xG79",
        "Y&y#*L",
        "l$:x<q+{",
        "OLd=u~r-",
        "|danfh",
        "lZk?hw'",
        "ee[-|",
        "C\\~4zq",
        "ezHhW",
        "8D8ir\\*",
        "6;><j_",
        "K)+6f",
        "x%zbh",
        "ch\"%g",
        "]|Nj]",
        "awM28%",
        "e0*)g,",
        "OqG(|",
        "8$?D7)",
        "n en n",
        "M8q5+",
        "/ Telemetry ",
        "no contexto do",
        "anas programmai nor",
        "yOmv]",
        "+t\"\\b)",
        "Indstillinger: Enable; Disable ",
        "A-G7Y",
        "V}_OL",
        "~Q<[c",
        "        loadFrom=\"%systemroot%\\system32\\version.dll\"",
        "_El|j",
        "gsZC:",
        "S|Bgx",
        "T{Uq_b<",
        "oI2=s",
        "PR-S=2",
        "lg=5;",
        "jot iestat",
        "essayez.uSi vous installez cette version de Windows 10, vous ne serez pas en mesure de revenir ",
        "&Df@!",
        "%U0[y@bD.",
        "DlpTask: Deserialize(): ActionIndex = [0x%X]",
        ":Gyw]T",
        "fZ[8#",
        ";X?U`",
        "Qwj4h",
        "ind|/w2-",
        "Exemplo : setup.exe / auto upgrade / showoobe full",
        "mD(nd",
        "R\\{UW",
        "\"3BRGrq",
        "Pripravljanje namestitve ",
        "4Ii'Nv",
        "3,AXJ",
        "[gt4#",
        "q-F2CJR",
        "rCfAqVy",
        "1?Y9S",
        "Qyees",
        "s darbamBUzst",
        "t noda",
        "oO{rK",
        ":!:':7:K:[:a:",
        "na pot UNC do datoteke z imenom ",
        "9W2{u",
        "ouS M",
        "utilisateur doivent disposer d",
        "bplrU",
        "[TSJ7",
        "u9]m7",
        "yXbS}",
        "X+Kta",
        "%eV=x",
        "tverks",
        "939E9{9",
        "jB1?8:{R",
        "%Kbhe",
        ":u'zQQ",
        "intervention de l",
        "Ms*A;",
        "ioT!KK",
        "4,Fxw",
        "D/Jju6",
        "= 3-A:",
        "Qf8@_",
        "C`lCBal",
        "WEU|5i>L",
        "~wZ`D1",
        "rDc7{f",
        "<{rTbm",
        "j?|QS",
        "J%(WZev_",
        "^l^'7>",
        "2^[Q<",
        "\\\\Kup",
        "j=5Rm",
        "d4b0zH",
        "9bp% ",
        "v1us/,",
        "tt arkitektur.0Det gick inte att starta installationsprogrammetsDet gick inte att starta installationsprogrammet. St",
        "4>[jq",
        "AY1IU\"",
        "xF)n`",
        "m yerden devam et",
        ":A:\\:",
        "E`BYE",
        "K+PW ",
        "Allalaadimine",
        "B+4j9",
        "psmF\\",
        "M.gK9",
        "Akcia: Ur",
        "J:lc?",
        "6'2lz",
        "5J9o[",
        "PLePn",
        "9hI7b ",
        "l|6a2",
        "DCj]5+",
        "{AYaH",
        "D+DPj",
        "XN6_Vi",
        "(2()E",
        "*,Rl}",
        "Kc'i5",
        "0+TmY",
        "ee[4m",
        "|V$+*",
        "!&#@!",
        "{/ab/",
        "n^{o5",
        "0f0D0~0Y0",
        "!3DIB[",
        "p_CXoTh",
        "<IZVY",
        "G0y3%[1y+%",
        "p4n&n'Mt",
        "ar-SA",
        "a&$!?0",
        "K?*Sp",
        "n se hace con medios de licencia por volumen o con medios que contienen un archivo pid.txt en la carpeta de or",
        "~^?RmE",
        "w*vH7",
        "`jM<Sk",
        "Y[F`d",
        "Exemplu: setup.exe / auto upgrade / noreboot",
        "T;`2g",
        "AkE7\"",
        "fy(y[",
        "]DC%>",
        "n54!Q",
        "XB#QJ",
        "T%{bR",
        "Zbov1;D",
        "tU+cR",
        "xHCr>",
        "Huz7n",
        "o. Feche a ferramenta, reinicie o computador e tente executar a ferramenta novamente.cPrecisamos de pelo menos 350 MB de espa",
        "i0pwhc,uq",
        "T3\\N{vZ",
        "u$p:0",
        "(#1jA",
        "QN6<+",
        "~';%zG\\",
        "gVHm@",
        "6#O0s3",
        "n eri",
        "P>*c*",
        "r[(neV",
        "*.7_u",
        "(>>&@",
        "C8;#-9X",
        ",,SKQ",
        "site, ",
        "lW1QT",
        ",RXIaE",
        "bB27\"",
        ")ob^I",
        "tirmek i",
        "B]eTD",
        "C4K4U4[4f4m4r4x4~4",
        "F&O55",
        "x:Okq",
        "Ae&qEd",
        "G.e7OV",
        "tg-Cyrl",
        "b}E|N",
        "]xz=M",
        "Switch : / showoobe <parameter> ",
        "<tkIG8",
        "t3!'z",
        "GzL~XCP_",
        "475F5",
        "{KUa-=",
        "P}Nu\\M",
        "%QCU4",
        ".5w+*",
        "Y(@.!",
        "sxBro",
        "*g3^q",
        "HX@7`",
        "%{ILV\"",
        "1`&F4",
        "G?ew(",
        "pa-Arab-PK",
        "+@Maw4",
        "040504B0",
        "\\$4YY",
        "0}uBs",
        "BIDx|",
        "j1RK)",
        "Mdngw",
        "H Q>Ds",
        ",\"g?;",
        "V/@OtF",
        "`op<8",
        "2 XPY",
        "[wW~[tw#R",
        "nja prvega zagona presko",
        "QZbXwx",
        "ra installationsprogrammet. Frig",
        "'YZ}]B ",
        "k?aOi]",
        "sjlw8",
        "mica ativada, recolha de telemetria e carregamento autom",
        "igus ja sellele v",
        "f5  X",
        "RT=n@bR",
        "V)R(V",
        "Exemplu: setup.exe / auto upgrade / Telemetry enable",
        "O!-X|",
        "QQSVW3",
        ":E mv",
        "-CWzm",
        "@.&R5nX`",
        "$,5&^",
        "zOEsl",
        "o quer que apare",
        "bQg)/",
        "Q~>?Y",
        "SetupHost result value: [0x%X]",
        "iV4k#",
        "(U^UUqj",
        "installation la cl",
        "                                                                         ",
        "fz9'o'",
        "LP.CAB",
        "D{8{z",
        "n:8/1",
        "e se a",
        "tter alle fundne driver.inf-filer p",
        "LqS:5",
        "%wOtF",
        "        name=\"mfc42loc.dll\"",
        "&`f,or",
        "#g1qL9",
        "m49&/",
        "jlt sikertelen telep",
        "r / migratealldrivers er angivet til None, vil installationsprogrammet derimod ikke migrere nogen drivere som en del af installationen. ",
        "Z 1R1",
        "!a/Ukr",
        "qwA*Y_",
        "*6h<x",
        "Nq$G`;",
        "teni a telep",
        "s gemigreerd als onderdeel van de installatie. ",
        "=s<JF9",
        "c?M`#K",
        "\"d+D&)",
        "C,Qml",
        "CommandLineToArgvW",
        "Windows 10 ",
        "<>\"Tm",
        "^&38P",
        "s\"!EU",
        "\"6dS>",
        ": specific.wim ",
        "64s^p",
        "Nous avons d",
        "7.7G7",
        "h^$Oc",
        "Phx/A",
        "n2CD\\",
        "8?9U9b9",
        "\"miUx",
        "nCxsO+",
        ";j7\\n",
        "q$1\"a",
        "K)T3j2",
        "ZXXEU",
        "D}SO0",
        "bb6KI",
        "e|/[x",
        "[iN2#",
        "pv{/+",
        "&Jmp.n",
        "n ohjaimia osana asennusta. ",
        "orchestrer l",
        "{TN_bi_",
        "c_X<T",
        "d podczas przemieszczania zawarto",
        "QXI8{",
        "SPCleanupInstallationDrive: Unmounting directory %s",
        "lda: setup.exe / auto upgrade / postrollback \\Saj",
        "KRnhu",
        "g;7z`s",
        "$E_G7",
        "7_++;\\",
        "[qcd+N",
        "]&nq9",
        "yml$T",
        "@iNyzc`",
        "]B}Gx+J",
        "/nJVRzS",
        "^3-4_",
        "e.5?\"",
        "I|E=%",
        "~xGZjy",
        "nsefladen i installationsprogrammet skal blive vist, men hun ",
        "f8OB9",
        "z~M;`",
        "+1d@q",
        "/?$$@0",
        "F9R:\"",
        ":m\"gq",
        "=\\=b=p=",
        "KB>uo",
        "t&/>@{'y1",
        "l:Kq|)",
        "$6vr3tY",
        "ij 0N`",
        "abL-S",
        "0PQco*",
        "jumi dodieties uz Windows Update.",
        "D$Tfff",
        "]<je!",
        "&}^M:fi",
        "1@|Pczh}.",
        "-p:23",
        "[Y#:6J",
        "hZKcg",
        "M<Oc<g",
        "Deleting ESD download directory failed! Error = 0x%X",
        "N`1p.p",
        "RF\"Y Fw",
        "Eylem : Ba",
        "uqneG",
        "*pb;B",
        "1>1y1",
        "U+la!P",
        "o0R+cBZ",
        "lda: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "rq;yc",
        "G#x1{ ",
        "/)f@u",
        "hren von Setup. Geben Sie Speicherplatz frei, und wiederholen Sie den Vorgang.",
        "QjhR@",
        "pKoT}%",
        "[3)RgbS",
        "-%F-)",
        "(XXY:z",
        "RedrawWindow",
        "a5+i/",
        "6<a;#",
        "/8>sp",
        "es padr",
        "n='<*r",
        "@k5sye",
        ": / pkey <product key> ",
        "nost migrace> ",
        "l4/mL;",
        "s.JY{L",
        "i'}S}",
        "]J9+o",
        "Vorbereitung l",
        "c9yV-`",
        "8-9G9O9U9b9|9",
        "#}Ldn",
        "4:;*K",
        "LZ> ~'",
        "+8kY`",
        "`}|3g",
        "[A:4:",
        "<NI=:",
        "x#2*Y",
        "Y>HIJ",
        "oG6\\m",
        "nso-ZA",
        "fR\"0)",
        "U1lU}",
        "($$B>",
        ";i;|Ggw",
        "U/I5k",
        "DG^I'",
        "Djl4)",
        "acdXm7K4Bue",
        "8>MDl",
        "J|#&F",
        "zf=?N|",
        "x34,#B+^D",
        "/~[8o",
        "(CAl({",
        "xlT4;",
        ".?AVCButtonEx@UX@Common@ConX@@",
        "K S+t",
        "THG-R",
        "0V1[1",
        ")$KhA",
        "eIVe^&",
        "D$L9A",
        "0C0C04B0",
        "TraceData failed: Error = [0x%X]",
        "#x+[8w|",
        " je spusten",
        "3h%PzRc(",
        "!CdD;w",
        "rc755",
        "i4s'`",
        "gidotA Configura",
        "#e7yL",
        "dXtwb",
        "}WQgS",
        "k{%]F",
        "i5%(u",
        "$9 ]O",
        "yoBJc",
        "h'&2Al",
        "6].OzM",
        "^lm>(\\",
        "Pripravuje sa %d%%",
        "1wuPps3",
        "e2Gi:",
        "7yw0:",
        "wi8eu",
        "9LUa}>",
        ":gI'k",
        "j82|cfa,r",
        ":<=.T<",
        "E70-l",
        "X4V<!",
        "O4!E~",
        "q>PadZ",
        "qEwMXR",
        "S9$H?7",
        "^_#2~",
        ".<'&H",
        "U>@@vn",
        "r installationen. Den h",
        "#=#D=",
        "Noteic",
        "ZMUP>5.",
        " komprimovan",
        "enb86qLi",
        "$W5&o",
        "QbmMk",
        ")b%Kw",
        "u2dt`",
        "|L^8T",
        "+Dk<1",
        "Vz\\2xJ",
        "        name=\"msls31.dll\"",
        "czeniu instalacji, ale przed pierwszym zalogowaniem u",
        "bF=c\"bs",
        "JmffI",
        "%EKl?T",
        "l_Om$",
        "(7uLF_",
        "-%FAl",
        "Vl;;&u&#",
        "7\\ju_",
        "-?u#tKs",
        "L9xIs",
        "%_za7 ",
        "YN+gce",
        "F\\[uZ",
        "hVQyE",
        "a\\Y,9",
        "+\"fop4>",
        "=g_Y2=",
        "J-<][",
        "rQ1'K",
        "SUKbP",
        "i(X$H3",
        ";0'1('",
        ":=}ct%",
        "^_%Nj",
        "o'1:Dz7",
        "mC[4;",
        "DHZ*-P",
        "DV#Ksww_",
        "n de UX (experiencia de usuario), incluida la restauraci",
        "C_L&3",
        "(F\"A>",
        "Nu~^Y",
        "%(VJ=",
        "UHwF\\",
        "Nf6Y.",
        "ges, ha a friss",
        "qu?Dh",
        "Ojj\\GQ",
        "X:\\6D",
        "!qO5oi/%\"",
        "PJD9h",
        "'q*j?2 7",
        "G,uY:!^",
        "7-es]F",
        "&$@f/",
        "Akcija : daje navedeni klju",
        "'JgL{",
        "D=vW'+&\"",
        " instalace. ",
        "```@@@@@@",
        "2;s=;;",
        "5u*VE,G",
        "installation Windows 10 red",
        "X'Bk-",
        ";5i>l",
        ")nT7\"",
        "estiver",
        "yoj@j",
        "\"mIUi[",
        "Instalar",
        "^G!od",
        "YaVNK",
        "jmSV)",
        "&#D0A",
        "x\\?Cu",
        "Srs`p",
        "S:]'t",
        "j]G=Yb",
        "jAk,\"0G",
        "x5].X",
        "E</1$/",
        "S$?k7",
        "FveQk",
        "CDlpManager::DeleteQuadwordPropertyByIndex",
        "o%CuI",
        "~pD~]O_$",
        "Oe#})",
        "$4Gy4s94",
        "*.O;J,AS",
        " sistema ",
        "p}{9I",
        "wGdYf",
        "ce ustawienia konfiguracji : akceptacja umowy EULA, w",
        "seau UNC vers un dossier qui contient les fichiers .inf.",
        "5V*1I#E#",
        "*O)U/",
        ";#0JG",
        "$;_Z@",
        "j[ iw2lJ",
        "]q%8@K",
        "(@A$&eIS",
        "tn=%Zo",
        "Installieren",
        "\\=5(-",
        "1GDy1",
        "lx!v+",
        "8R8\\8w8",
        "U`uY+",
        "Windows 10 Setup)Windows 10 Setup wird bereits ausgef",
        "fRY4L",
        "5C)\"\\=4",
        "^a0Nn",
        "2=2]2",
        "uriran ili kreiran. ",
        "<H,s2L9",
        ".!YmM:FuryVG[",
        "BDemd|",
        "ttQ,;",
        "|AQOO",
        "pU4V}",
        "lRtqQ",
        ".(7H+DW",
        "<(<,<D<H<`<d<|<",
        "R>#ue/",
        "fr-CI",
        "ciju saist",
        "k[~$$",
        "CSetupLangIniLoader::Initialize: Language %s is not supported on this OS",
        "u|Plf",
        "QNN[)9mmga.0",
        "!'Nu{4",
        "tverksproblem kan ha uppst",
        "Kj/-m",
        "G$mzD",
        "o migrar",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "X>!?{",
        "zNlII",
        "iA{MP",
        "\"CaDB",
        "}1;i3",
        "kXng+",
        "@i~_|2",
        "M70sY",
        "4\"4C4L4q4.656u6|6",
        "Iqy%^",
        "Setup.exe instala o actualiza Windows. Los siguientes argumentos de la l",
        ".;+U`O*pY_d",
        "S\"OiU",
        "8gV?\\",
        ":kk~}Z",
        "=o{f#[",
        "|?BTt",
        "S#q<[",
        "s>!%b",
        "DBoG;",
        " Hu}n",
        "M`Ba1",
        "\"X  I",
        "#Rys:k",
        "O=hS't9",
        "gez. Ugyanazokkal a jogosults",
        "QSVWQQ",
        "+3'j4",
        "|pcU<",
        "%6<I7P",
        "1i|q55",
        "\\N-YfW",
        "$pL6K",
        ")?KUO",
        "rnek : setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "Q\\MWZ",
        "2IOIO",
        "s?\\a|",
        "ZS 0.",
        "]gB&-",
        "6:CTp",
        "i din nou.YDac",
        "\"}7:S",
        "cHvY)",
        " vagy folyamat. ",
        " na hodnotu None, softv",
        "w'8kY6",
        "`cj0~",
        "n no actualizar",
        "a,A+_R",
        "tverksplats och ett n",
        "GKcFr",
        "<pR#Z;[",
        "Action: When / PBRUpdate is set to Enable, set-up will update or create the PBR partition. Conversely, when / PBRUpdate is set to Disable, set-up will not update or create the PBR partition ",
        "ydce\\",
        "$1ZG)$q",
        "6s\\}5(",
        "?V~]!7",
        "#fH{D",
        "UK?xI",
        "g.R?=",
        "pt-BR",
        "U9x(R`",
        "4@>@#",
        "]h^`J",
        "mSMxD",
        "\"3c[G",
        "b$O7[5",
        "<\"BDR",
        "6L/YMo\"",
        "P]%I0",
        "kS<GD",
        ",Q2l ",
        "ne-IN",
        "}'V/a`",
        "hwCZG",
        "s un ",
        "n=FrI",
        "x,krU",
        "?s'^i",
        "k:_g8[",
        "CDlpManager::DeleteTaskByName",
        "~'#.M",
        "\"0x#q",
        "fini sur Full, l",
        ",fABQ?",
        "p+nDI",
        "@@@@@@@@@@@@@@@@@@PPP",
        "Cleaning path: [%s]...",
        "1MYXZ",
        "`9<GL",
        "7.7;7O7\\7|7",
        "de un instal",
        "b~Lq=s",
        "        loadFrom=\"%systemroot%\\system32\\fltlib.dll\"",
        "i,HDJM",
        "s felt",
        "=FB~G",
        "Gy2)@11",
        "NtWaitForSingleObject",
        "AN[D7",
        "vel no SO. Da pr",
        "5^/SL5DE",
        "nxCrOf1\"",
        "gGUgg",
        "trie reli",
        "&nr!YB",
        "][iJ'",
        "818`8s8",
        "*j9[Kg",
        "whrAuzIg",
        "Qu46i",
        "HoOMl",
        "4 Mck",
        "tj=d>%",
        "4vUA8Wu",
        "3f[|8))Bo",
        "Bd'QwV",
        "]*m8d+hK",
        "V.%,q",
        "=O=p=}=",
        "tA?:)",
        "k`PTQC",
        "V5~)4",
        "zv;!V",
        "C,=]$",
        "4,40444L4\\4`4d4|4",
        "]UL,c@",
        "sH<&_",
        "outil.|Nous avons besoin d",
        "CSetupLangIniLoader::Initialize: Language Pack Root = %s",
        "^1hy ",
        ">qe~~",
        "pStopSetupPlatformETWSession: Failure while querying all traces. Error: 0x%08X",
        "{^GVi",
        "?L)1z",
        "hf;<w",
        "GetTraceEnableFlags",
        "X@`Qv;r",
        "!luZI",
        "2=[!\"Pj",
        "-S6*'",
        "?@NiE",
        "Ep}1}0",
        "a_AxYa",
        "oQtaV",
        "#f81`",
        "0_04X@bg0",
        "V:\"MN",
        "thoz. Ez a parancs a rendszer k",
        "Instalarea Windows 10 nu preia argumente ",
        "{<{*X",
        "@3WCM",
        ">bH0D_",
        "!`T9Xx",
        "U=H=^=L",
        "lkeen mutta ennen ensimm",
        "|B>/_",
        "5WdI)",
        "m-)\\j/",
        "-BTf/u",
        ">j|~S",
        "X)L0K",
        "ll=5/D",
        "Arhitektura, ki ste jo izbrali, se ne ujema z va",
        "6/'2h,",
        "b6.]}",
        "RpTgb[D",
        "9F*}4b;",
        "hdetietov",
        "Parametri: All; None ",
        "6eNg}",
        "Conmutador: / installfrom <location> ",
        "ib olla pooleli. Lisateabe saamiseks avage rakenduses S",
        "!RNvp",
        "69viStK+`",
        " katalog",
        "2MY1$",
        "~~slI_",
        "O1A1'",
        "_.3;r",
        "F%$btO",
        "\\nuXB.",
        "ru.4Pri sp",
        "hO,CY",
        "O3%h'@",
        "yw~>F",
        "xNat%",
        "m$k&r",
        "oA>m!",
        "AD2vD",
        "Zs6Y[L",
        "klemez. ",
        "Juriidika",
        " instalarea se produce dintr-o loca",
        "EZlPF0",
        ":clu$",
        "LS)G,|c",
        "$RZsXZ{",
        "xG| >",
        "w? 9d",
        " sakl",
        "CDlpTask::GetCurrentAction",
        "9E tD",
        "GetSystemDefaultUILanguage",
        "Zfm@&8m",
        "Soporte t",
        "Zu{)*M",
        "TbJpyO",
        "prava.IInstala",
        "4Hdbe",
        "qRu[|&&",
        "w|<fu",
        ".CRT$XCU",
        "r anv",
        "^a\\oo",
        "3X&vz",
        ">$E{<",
        "<$.5I",
        "'tuBk",
        "]7vtL",
        ">'>24\"~6",
        "Q2%l\"",
        "D$$PQ",
        "10E0`0",
        "WWEy!n:",
        "!\"JRA",
        "D_!m ",
        "P*d*?",
        "hmGZ= ",
        "Gy?7~",
        "Conmutador: / copylogs <location> ",
        "}PO|n",
        ": / auto <",
        "x[VVv",
        "<o{}Z[",
        "Nb={.",
        "HT+\"7O",
        "DwQj)ndX",
        "skaitant at",
        "rKak0j0c0_0h0M0k0`0Q0",
        " keliai ir UNC tinklo keliai ",
        "nama bilgisayarlar",
        "zm+}a",
        "`T.;S",
        "adovala po u",
        "CurentBytes",
        "-VUJS",
        "KXo$w",
        "nyen. Ha a / showoobe ",
        "6t3z =",
        "'eO76TGs",
        ")j#d)[",
        "TXdnV",
        "anai, ja instal",
        "0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "gi\"@J",
        "}9q25",
        "szen ",
        "n director ",
        ". System ",
        "JZv4X",
        "LwQ~$",
        "V0y,a",
        "<H\\?{~",
        "S^P%J",
        "u kroz prvo postavljanje. Za organiziranje potpune nadogradnje na Windows vNext pri kojoj je korisni",
        "SsyhX}",
        "Ime+k",
        "/WcH!3{Ou",
        "rd: Anger om installationsprogrammet utf",
        "6dTA=",
        "LY<Ns",
        "md4E;",
        "777D7e7",
        "L3eQa`f9",
        "j@Xf;A",
        " program bude rekurzivn",
        " a parti",
        "&)+6{",
        "; ;%;.;5;:;D;H;N;U;\\;b;k;q;v;~;",
        "}\"=.g",
        "sVy:e",
        "V!go'&;",
        "Xml*Qqq",
        "8W5Iob",
        "r dynamisk uppdatering (s",
        "g$'Pe",
        "iau, kai / Telemetry nustatytas kaip I",
        "i#i%G",
        "A:#zt",
        "_\",GT",
        "yjmv6_1",
        "steem Microsoft",
        "rm|WT",
        "0,0N0_0e0",
        "PPP@@@```",
        "L7\"p7",
        "@g.*.",
        "6&CT4J",
        "W}V:a",
        "kcLgF",
        "j(g4Z{",
        " All f",
        "CK:zX)",
        "ch po",
        "Ub9t$",
        "CjcM?",
        "[4nlx",
        "|`<6h",
        "]16&Me?",
        ".4gl'",
        "a&yv2",
        "rr#U&",
        "G,'|F",
        "Action : Injects setupcomplete.cmd file from the specified location.Setupcomplete.cmd is a customized script to perform tasks after the installation completes but before first user login.It is run with System privileges. ",
        "7(}V/",
        "GcrNY",
        "'Mt{f",
        "cm;wK",
        "{-Vbv",
        ",:id)",
        "3M3Ay|",
        "D'L5i3",
        "&LFbI",
        "8VVq;",
        "i9IA<",
        "3!?cu",
        "9w\\n!",
        "t+Q_W",
        "a%8*~G&",
        "d|,iUW[",
        "htegi draiverit. ",
        "}{mVB",
        "vH\\}j",
        "~yqFz",
        "n}Z]}X,",
        "tg-Cyrl-TJ",
        "0$[x7",
        "OuuCz}",
        ".x|Fi",
        "KJIBN",
        "tr{*{",
        "6C6~a",
        "F[?O?;6",
        "6S$Sn5",
        "Ppz4a",
        "r die Installation. Die Benutzeroberfl",
        "A+BA2",
        "^N=c~",
        "h2-Nt;*F7",
        "lld p",
        "+T'(x]",
        " 5MB~b",
        "L5W-TK",
        "J=oC1>",
        "I)v0#",
        "lv-LV",
        "uCbGU",
        "gs8{}A",
        "Q$?~/",
        "Status",
        "T@2w@",
        "l<EC<",
        "Ke)NV77",
        "w'r+2",
        "P:Hyx",
        "U&]>yc7,V",
        "b'Pu -`",
        "cii Nastavenie.",
        "Q~O\\r",
        "&_t\"_",
        "Operazioni preliminari in corso",
        "|FRy1V>f",
        "ndre funktionsm",
        "y!br~",
        "IhmwN",
        "a_om],",
        "(&H2$",
        "]w@w&",
        "r-~q%",
        "v6&BX",
        "marrer votre ordinateur et essayer d",
        "enie chce, aby w przypadku niepowodzenia by",
        "y-0:#P",
        "dL[{:",
        "\\=+?B",
        "$2;:&",
        "X[/\"f",
        "K){Y)",
        "=gt43",
        "GR Ro)y",
        "installation met ",
        "_gov{~~Q",
        " RLy;",
        "45p;6",
        " ist ein benutzerdefiniertes Skript, mit dem Tasks ausgef",
        "Q_5Q3",
        "F[_M7",
        " de produit> ",
        "C44&NarV",
        "I`s,u]:",
        "cii vykonaj",
        "nega mesta, in najbr",
        "d3~)@5:2",
        "O<d(y",
        "<hj'5o",
        "B+m)ZZP",
        " niveau Windows. Les arguments de ligne de commande suivant peuvent ",
        "o=+5e",
        "5,d/Vh",
        "*N/aK",
        "Setup.exe / auto upgrade / quiet / showoobe full ",
        "p71pi",
        "perny",
        "V'7Ap@",
        "6c7nF8y",
        "R %8w",
        "chr-Cher",
        "9^v?>",
        "pBxIxZxTxP",
        "3-4G4",
        "hzd/L~",
        "y[amf",
        "IW-L'ok",
        "7p+zK",
        "LgGtu",
        "PP?~r",
        "~V:<^|W",
        "Lou%K",
        ".rdata",
        "3J4Z4k4p4v4",
        "505I5O5|5",
        ">7jwt*",
        " aktualizace, vyj",
        "lBLJ=(ni",
        "w\\Xrt",
        " Soc<",
        "H\\gue<\\Z",
        "i*lSL",
        "D_j}2",
        "bQl<{a",
        "dy^c>T",
        "Yu Gothic UI",
        "PrzygotowywanieDInstalator nie mo",
        "'m5j|",
        "Installationsquellmedien",
        "DeleteFileEx: hardlink given to us is: %s",
        "9?=YII",
        "M_&Jt",
        ">We;W%",
        "Stikalo: / installfrom <lokacija> ",
        "BaL4*",
        "h{LB\"f",
        "/ifx#H$",
        "}jx{F",
        " !(%04",
        "YQ/eQ-",
        "StateMatch: SetupHostResult found : 0x%X",
        "_6gg`",
        "(Heq1T:,",
        "l'+{x",
        "pD#@4",
        "ppp@@@000",
        "Parametry : klucz produktu 5x5 ",
        "J8PWu*",
        "Continu",
        "t valmiiksi. Kun tietokone k",
        "x{dU?",
        "d9zXM",
        "h;ZM#",
        "vw>{%",
        "ljande standardkonfigurationer: Godk",
        "x:6PU",
        "#J1Y]K",
        "3:XRP6",
        "CDlpTask::GetIndex",
        "M*{\"d",
        "[C^hN",
        "Kreni ispo",
        "@^z(n+'",
        "{3vd@",
        "Yu+Ft',",
        "Full, o usu",
        "        name=\"gdi32full.dll\"",
        "B)vtr%",
        "9@i+S.Z",
        "Ofcp#<",
        "cuter l",
        "0j}|NNqVv",
        "RtlFreeHeap",
        "utavat XML-versiooni ei leitud-Meediumi koondamisel k",
        "sRz/%",
        "s de completar la instalaci",
        "RfT{'",
        "\"WNj@|",
        "            <!-- This Id value indicates the application supports Windows Threshold functionality-->            ",
        ":'Fpj",
        "_4*rCr",
        "*WVb&-",
        "a}J\\F",
        ".Mp5jg",
        "&3-eHu",
        "t[VW3",
        "J1~WS",
        "V>g#J",
        "@z`O*",
        "dp3Pi",
        "jFS>v",
        "\"Ge#^",
        "Parametrai : All; None ",
        "/,tpm",
        "Rn Dq",
        "N-'):se",
        "cijas failus direktorij",
        "FUj?m",
        "oyYT*",
        "k,5&UKx",
        ")HuQi",
        "A=|g!",
        "bLxHX",
        "o pode iniciar o Install.exe",
        "r}KkI",
        "0L0B0",
        "i1h3oL",
        "l0B=2",
        "vVnUKs",
        "CompareFileVersions: Couldn't get last modification time of [%s] and/or [%s]. GLE = %u",
        "itumist saab muuta j",
        "'2vl;",
        "Technik wykonuj",
        "*ouYu",
        "48Ox0[",
        "^z@zD",
        "dZfeQV",
        "~IuV(",
        "x`X:K",
        "\"TCl@",
        "R<A).b[",
        "fr-BE",
        "E{<to9",
        "yQ=+01q",
        "!YnxOv",
        "vj?5Y",
        "mPr:|",
        "i}hxZO",
        "MLe}L",
        "CopyDirectoryFileCallback: Unable to %s file from [%s] to [%s]; GLE = 0x%x",
        "\"bh9Q8pC)",
        "ciB;=",
        "9>F;y ",
        "}dn?!",
        "2,2I2`2",
        "4$`'Xa",
        "jg=_>",
        "900/W",
        "^,i=E",
        "Windows 10 Setup doesn",
        "U%Se9",
        "/{TNq*K",
        ":pB~|@",
        "aNC#E",
        "7z\"^dh",
        "7A7H7X7v7",
        "wm)0a",
        "YIpnu",
        "B@x'F",
        ":UQ@'U",
        "8QLX9",
        "l 3di$",
        "Schalter: / copylogs <Speicherort> ",
        "veleteket (friss",
        "B%#Jg,",
        "%7xXj",
        "rnek: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "n recopilar",
        "}yK*|e",
        "ZSI[m",
        "'zCz1",
        "Radnja: Quiet zastavica spre",
        "Exemple : setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "E2iE}",
        "adanie, s",
        "U|h&Y",
        "[im+Uo",
        "y>eM-Z",
        "jl, amely a telep",
        "29vp-",
        "Ir]H*)",
        "*<!.T]h",
        "}hP3o",
        "ROwE.",
        "5vl$K",
        "Q)2?0Q",
        "0)0S0",
        "lmr|.",
        "2nh=t",
        "E=YDR",
        "8hA:4",
        "7'7K7_7j7",
        "{ew#$",
        "Pjm:`",
        "(94CH",
        "aca~/",
        "c$s*O",
        "{?Xmv",
        "=3*ZV",
        "Z/7:L",
        "Vi har oppdaget at installasjonen skjer fra en nettverksplassering, og det har kanskje oppst",
        "sf:3Kp",
        "3[VSe",
        "gigmenni",
        "ta03Y",
        "-,cBK",
        "Parameetrid: Upgrade; DataOnly; Clean ",
        "Nlf>_<",
        ";**F# EP",
        ";kOA)",
        "9RQ\"#S",
        "pDz,ag",
        "?amKm",
        "Kv.z5b",
        "?aW9vZB",
        "YcCef",
        "cDMEv%",
        "tenje prema scenariju ",
        "<unavailable>",
        "XKzpi",
        "!GTvj;",
        "Z&~HX",
        " OOBE) etapi. J",
        "{3L,*",
        ":6:<O",
        "Z\"K[Hwh",
        "Qs+cG",
        "1g,>!",
        "lohy. K jeho spu",
        "s usar la versi",
        "Ph\\K@",
        "d%e_e",
        "mhdt?m",
        "ste gang pc",
        "OeH79\"",
        "HPOX >",
        "0Wwf~",
        "d!o@C",
        " protokoly",
        "9*jqT",
        "P9:1^",
        "uc{J\\k",
        "ajo uporabni",
        "?W!S#*d",
        "$TKxa",
        "787E7q7",
        "H/l:?6",
        "ds5de",
        "&.Q1N",
        "n;wIW",
        "Installazione di Windows 10",
        "/ PBRUpdate is ingesteld op Enable, wordt de PBR-partitie gemaakt of bijgewerkt. Als / PBRUpdate is ingesteld op Disable, wordt de PBR-partitie niet gemaakt of bijgewerkt",
        "-R`6%",
        "*e_%d",
        "CS|=_=",
        "Lrj!>",
        "(v]NW",
        ";dOrW",
        "Eyb2<",
        "`<(K@",
        "\\JbjB",
        "P't4-",
        ": acest comutator ar trebui utilizat doar la testare ",
        "#HC.4",
        "m3mzd-=b",
        "a-e{+",
        "7eL~0",
        "SYq:)",
        "Ib<j.",
        "vel iniciar a instala",
        "eren bir klas",
        "$k'*A",
        "CfmUO",
        "'H8tI",
        "AOBOB{B{B",
        "F[0&7",
        "l``sT",
        "}uGs$",
        "Handling: Installasjonsprogrammet setter inn alle .inf-filer for drivere som finnes p",
        "v,g_j",
        "@r<[S",
        "nZv]l",
        "8<9h9",
        "<.=M=Y=a=u=~=",
        "79f7.",
        "s%N&mAV3",
        "ebW+V-b[&",
        ")69fp",
        "8Oivv",
        "Wird vorbereitet (%d%%)",
        "aQUi|",
        "A7Mmus",
        "VRO:<",
        "]#\\kn",
        "i\\$5.",
        "{+Hnm|",
        "ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp(",
        "#`B~Py+",
        "e se p",
        "/&$@x{",
        "Downloaden",
        "@%8pt",
        "f^;dw?o(",
        "liK_S+",
        "i PC-ul, apoi ",
        "YDo=[",
        "#uqWP",
        "=7*}XaY",
        "rpJ)r",
        " el, am",
        "N4-.*/",
        "enler, varsay",
        "U)t5I{o$",
        "aR/I_7",
        "#X'e8",
        " m%:8. ",
        "mqFQ^",
        "J9m81",
        "q1&m0[G[",
        "Zxa,s",
        "^U~&u",
        "dzis: / auto <migr",
        "QUn*a=|",
        "JSR}:",
        "e je stikalo / migratealldrivers nastavljeno na ",
        "!-@x[",
        "_FY)pbI",
        "y(G}z0",
        "e vse podmape na navedeni lokaciji. ",
        "Po}\"H",
        "}&i(qx",
        "T^l1F8",
        "6}I6KTS",
        "'vlCR",
        ",#g,s",
        "313H3U3~3",
        "e@:gs",
        "nCPJ%",
        "lVT3S",
        "lfT0G7",
        "en-JM",
        "U3=f#S#",
        " Enable samlar installationsprogrammet in och laddar upp telemetridata som genererats av installationen. N",
        "s a Windows vNext rendszerre. Felhaszn",
        "CUpdateScenarioCtrl::GenerateBoxHash",
        "h}y(3",
        "P\\ziou",
        "10K)ifKl",
        "files",
        "K`iz(",
        "*?9Ny=",
        "6LG?P",
        "6/6S6",
        "dF}b0n}",
        "misess",
        "tk i!",
        "-Zyr3",
        "MM%cZ]",
        ";4'RT",
        "jCu\"kL",
        "*2o-?",
        " sau calea UNC de re",
        "~J;[W",
        "?MdDlu",
        "_amsg_exit",
        " je prilagojen skript, ki izvede opravila, ko je namestitev dokon",
        ".?AV?$CAutoCleanupBase@PAE@RAII@@",
        "IX6#,Q",
        "(/%Cs",
        "PQfV'i",
        "mK_KE",
        "PL0g0M0",
        "9rv4;l",
        "+|:7-me",
        ": 1>~",
        "*9'F]",
        "oB-:#",
        "`qz^T",
        "}o]>\"",
        "amo XML versiju9Veicot datu nes",
        "ho riadka",
        "y}Vk<C",
        "N`Hx1",
        "^3f{;Q",
        "||Gkn",
        "C7:zs",
        "2Un7 ",
        "c:yW[CQ]",
        "t;+DA",
        "&bTrd=",
        "a 9y[H",
        "Microsoft",
        "SPExecuteCleanup: Failure while building path to clean up folder %s. Error: 0x%08X",
        "eu+N@",
        "CSetupLangIniLoader::Initialize:     IsInstallInImage  : %d",
        " 3=.f",
        "3?3z3",
        "AOU,,3",
        "v91JX",
        "]@zlZq",
        "UnhandledExceptionFilter",
        "+n\"f1",
        "/=Og4|",
        "@d;.L",
        "tMb`5)",
        "*o7Zo{",
        "ZatUx",
        "2%RLs",
        "Um administrador pretende atualizar os PCs do departamento durante a noite, a partir do Windows 7 Enterprise. N",
        "j2&md",
        "U>A&9G",
        " : setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "W]mVf",
        "Ye.L\"",
        "iT3O]",
        "(d8FQ",
        "N!AP=",
        "S=/7\\",
        "q}UI ",
        "kR8bKT)",
        "i@H9\\>",
        " vai t",
        "C@ftN",
        "9MBn.",
        "z olduktan ve bilgisayar ",
        "u?pc3",
        "&Nazad",
        "\"z|./\\",
        "1ZAo3",
        "#$Qx)",
        "xBz_O",
        "=I1 B",
        "{lC<h",
        "U/%.>",
        "eP'?G",
        "wX#-6a&",
        "C-,@c",
        "qx>MW",
        "9A`nv",
        "vXJ|W",
        "tres : Full ; None ",
        "A{5KH",
        "(<xj}",
        "Setup.exe consente di installare o aggiornare Windows. ",
        ",^&s!",
        "rast seda, kui installimine nurjub ja arvuti on tagasi p",
        "y?8<(",
        "GXq-N",
        "ir<K_",
        "F}4@C",
        "!{EW,AV",
        "&H6N!A>7",
        "metro : / migratealldrivers <par",
        "Yp(opK",
        "041104B0",
        "3Z?udUT(^5",
        "8<ZB8",
        ":dMyv",
        "hC'4(A",
        "=%>G>P>",
        ".+t.vA",
        "j]Xc,u",
        "x7G iu",
        "rMU`r",
        "V*9fV",
        "&NZ39<",
        "Ku+o _",
        "TZml6",
        "0~0_0o0",
        "#f;%iCi",
        "Jp03u",
        "d5W~ ",
        "o : Fornece a chave de produto especificada ",
        "d<a&#%",
        "les installimise k",
        "n tervetuloa-ohjelman l",
        "6A9]j",
        "|=q[Ec2",
        "_o!C*",
        ">2D9ol",
        "0DEhW",
        "GH'?1",
        "NCncP\"",
        "_vIGI",
        ":H=$Rz",
        "windlp.state-old.xml",
        "H\"_Dy{;%",
        "@!L??",
        "p]GukY",
        "E!vyR*",
        "(yTmR",
        "jZXM&",
        "b<g`)",
        "FindNextFileW",
        "Zzg9[",
        "z`<_2",
        "l12Du",
        "%s: Error opening/creating key for Box result value, Error = 0x%X",
        "~f.g,",
        "jwj\\n",
        ")Ge?$",
        ",dUuV:p",
        "1hFWF",
        "3n([.1",
        "Rc+Hn",
        "en-IN",
        "\"U6nL",
        "w?onX)?y",
        "6+@br_",
        "OQ>YV",
        "&s]c_",
        "<x*vE",
        "edpokl",
        "i komanda vykdoma sistemos kontekste, tod",
        "xE| ~",
        "}:X*Mrf",
        "0T}(]",
        "GR8FL",
        "G[+\",m",
        "z#u1=",
        "U4Kvw",
        "4A]MR",
        "no*'g",
        "ytkownika/Instalator nie mo",
        "BDZ)D",
        "e poku",
        "`;K>s",
        "CoO)_",
        "dE8%w",
        "=BM_u",
        "D$,_^[3",
        "^d|N.",
        "6k^U\\k",
        "|b91P",
        "xo<5B",
        "R/3y9",
        "K;$wN",
        "979r9",
        "\"*N#:",
        "Anahtar: / showoobe <parametre> ",
        "[Vqf!",
        "`kGct",
        "DI'p+",
        "en Sie das Tool, starten Sie den PC neu, und f",
        "\"=23p",
        "tg$+O",
        "209%e",
        "G]N?\"",
        "gl&%[",
        "|A.Q+zk",
        "D(&LH",
        "ts'vsW",
        "eO/l|/",
        "-J84WrP'L:[",
        "xzk|5",
        "xi,Sn",
        "k~4+Ss",
        "x@#P}",
        "h3kA~",
        "5L?_U7",
        "%Gp6u",
        "c2bREY",
        "r2rkvq",
        "Ha%\"C",
        "QQONkB",
        "-!hx%",
        ".Cqes",
        "8+8@8F8a8g8x8",
        "^o[T^4",
        "8lHBbR",
        "inierius gali rinkti ",
        "XPh\"i",
        "_b}XY",
        "ehI<l",
        "8^/ti",
        "1Khyn\"",
        "v3=4q",
        "/_AY<$",
        "de-LI",
        "3A-d6",
        "`2i##",
        "rs redan.gDen h",
        "Qh@p@",
        ">\"L0APB",
        "&[Z.\"1",
        "ZCB=T",
        "A telep",
        "?hL|U",
        "kaz setup.exe /?.",
        "57]>zV",
        "h|\"^a",
        "V};jJ)",
        "\\R./W",
        "TI7r@",
        "CWgPLx",
        "1Mc$j",
        "Y0z{)",
        "~K9N ",
        "N@Txv",
        "nfU= ",
        "<B:QJ&Z",
        "78r[<",
        "rm-CH",
        "amo}I",
        "Tr.2_",
        "rio. Ele ",
        "Zjistili jsme, ",
        "Esimerkki: setup.exe / auto upgrade / installdrivers c : \\omaP",
        "Z1xru",
        "C+ml*",
        "5#cdQ",
        "RxmhH=",
        " desfazer a atualiza",
        "+K0~<2",
        ";uW>3",
        "ZgQqP",
        "6'\\vh",
        "bhjUn",
        "%\\fRo",
        "h<U7,",
        ")D}z0",
        "metros: caminho do arquivo local ou caminho da rede UNC para um arquivo nomeado setupcomplete.cmd ",
        "u adresi ziyaret edin: %1!s!",
        "WBzOj|",
        "o aceita argumentos da linha de comando. No Prompt de Comando, execute \"setup.exe /?\" no diret",
        "SiLSg#",
        "[$p?3",
        "{o|333G",
        "i de fi",
        "CDlpTask::Pause",
        "V`(U>N3",
        "ysbJ&",
        "`I'fP",
        "MSj:d",
        "ht!/ ",
        "StRlv\"",
        "KERNEL32.dll",
        ", telemetrian ker",
        "PBb#p",
        ";wwgw",
        "o: especifica se a instala",
        "Uhn[o",
        "xg=Nn",
        ".!0*Y",
        "klad: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "gs*p5K]e5",
        "DlpTask: Transferring Files...",
        "Y lWIj",
        "/F~'z",
        "lTX$k",
        "jS8sa",
        "n de las actualizaciones din",
        "b)Si-Y,`",
        "=7>W>|>",
        "X7hDp",
        "z@|TlE",
        "Preparaci",
        "pZ.Hi",
        "7U.Aa",
        "lRA{'",
        "!^1GX-",
        "ahG0N",
        "Provjera kompatibilnosti",
        "IKtR3",
        "CopyFileExW",
        "lyk\\E",
        "4f|]R",
        "#C4 G%X",
        "\\(l=ye",
        "!R(JI!`x",
        "nika na dysk twardy",
        "mPg$V,_r",
        "u94St",
        ";7z_V",
        "PS%vc",
        "|c_L~;",
        "as datorus no sist",
        "2Z]AjB8",
        "<%s></%s>",
        "VWXE7",
        " umiestnenie na in",
        "//va|",
        "wx7ed{",
        "-{r:2r",
        "k=IYC",
        "    </compatibility>",
        "\">AO|",
        "tor nebude migrova",
        "  specific.wim ",
        "8vN~lN.",
        "]LAH\"",
        "Exempel: setup.exe / auto upgrade / quiet",
        "e tam y",
        "XU/] D",
        "s argument",
        "b</L>",
        ":gwU&",
        "g8%:K",
        "[z.b(-",
        "D)j;h9#",
        "$7xKo",
        "=jF}FB}~",
        "p>EI?",
        "\\V4F-",
        "b' Bn",
        "t#.Oz|H",
        "J-\"E]~",
        "eli pa, da kon",
        "Exemplu: setup.exe / auto upgrade / copylogs \\PartajarePersonal",
        "Y}7bWr",
        "uje po ne",
        "`*DhnJ",
        "CoM-66R",
        "Valmistellaan asennusta ",
        ",5rG_",
        "vw_#.r",
        "te instalarea Windows 10",
        "M>B~1",
        "JyS4%PM",
        "_uT^'T",
        "]`Z-5@",
        "o. Se voc",
        "q}x2F:",
        "exploitation de bas niveau, le programme d",
        "!rl/=",
        "3azO%",
        "anas programma rekurs",
        "(t;)UT",
        "0!7(m",
        "UTF-8",
        "qU'\\l",
        "vGW~x0",
        "!N:4A",
        " deja.gAceast",
        "|l yV",
        "Azione: in caso di errore, il programma di installazione copier",
        "gVl!(;",
        " Microsoft Corporation. Med enerett.",
        "uVgYw",
        "qx2xW",
        "#}>.}",
        "w.Qv+g",
        "cution.",
        "pqS,*",
        "u2U}C",
        "5&6.666>6F6",
        "vG{8P`",
        "IDHG*",
        "T~~VW",
        "gUs(\"-[7",
        "/nnJ9]x",
        "7!F3-",
        "k*P?m",
        "f5%Z7",
        "8H9z9",
        "1kf0c,",
        "Accept",
        "sv-SE",
        "Bz:O?",
        "=,=D=\\=x=",
        "[Z_tYY",
        "ln.j}(",
        "YI^\"/",
        "G)k7l",
        "q6xny",
        "4_$CH",
        "z_&#ja",
        "e system jest instalowany z lokalizacji sieciowej, dlatego mog",
        "|ixb/B,",
        "=!Hy(\"",
        "Z(^-h",
        "jlB2tS",
        "mha>u{",
        "E]\\@oN",
        "M\\l.G",
        "Jv=<}",
        "CtT+Q",
        "ad: setup.exe / auto upgrade DynamicUpdate disable",
        "jHx-U",
        "kb#y9",
        "uktyx",
        "gQeDp/",
        "8$808P8\\8|8",
        ">3RZW",
        "p6V~R",
        "<f^2o`",
        "fk|0?",
        ".5p:p",
        " j\\w}",
        "\"o(m?",
        "P>4MVFs",
        "E]SJ_",
        "l1ex)ve",
        "kV;K5",
        "Z|Y'=y",
        "Vol&tooien",
        ")3?w1",
        "E[Ymv",
        "uh*5S",
        "88m.|",
        "sBk=n",
        "sHZX?",
        "B<?[c",
        "'`L0B0",
        "jF(e~*",
        "cg`sHd%^x",
        "jCviV",
        "VR`dt",
        "TB<$C",
        "znY\"e",
        "Y+b(W=UN",
        "4D;^\"",
        "w%>Pw",
        "*-'QVQ9",
        "%}e26",
        " dYQw",
        "J~kna*G",
        "}5?\">H",
        "T$(+T$ +D$",
        ";aeJg",
        "-besturingssysteem",
        "%E\"2Q",
        "@apmY",
        "        name=\"wow64cpu.dll\"",
        ")N 4m{u",
        "/am2U_",
        "cijas (atjaunin",
        "<K,)t",
        "~~G8;",
        "lK~<j4?7",
        "Perjungimas: / PBRUpdate <parametras> ",
        " consigliabile usare questa opzione solo per scopi di testing e in ambienti di testing. Non usarla in produzione. ",
        "'%I;D",
        "IsValidLocale",
        "bY-u[",
        "XM]nG",
        "4TzB~",
        "8r[|x",
        "&25#p",
        "essayez l",
        "'3y7]",
        "]_wZ7",
        "Ejemplo: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "dg.mr",
        "]{xTE",
        "lo do instalacije koja je nai",
        "jet. Pr",
        "Z(t`U",
        "mu Windows 10 neakceptuje argumenty pr",
        "8GcNMv)",
        " pentru instalare / files ",
        "<&}~J",
        "r+\"u2",
        "*rbw/",
        "t`#``",
        "%#{~c",
        "in yerel doya yolu veya a",
        "6n- ?",
        "Z>T?zK",
        "sfh<}",
        "o$|)?",
        "kenlerini almaz. Komut ",
        "wY!!&f^",
        "aCStc",
        "*7$r&9",
        "^Z;hu",
        "JQibr",
        "j\\Xf+DO",
        "]W6]D\"",
        "{?e-h",
        "q*MyU{e%",
        "r kommandot k",
        "\"d-i3*",
        "4GbqKI",
        " executado com os mesmos privil",
        "4o|L?",
        "#mIR|",
        "Mh!dA",
        "xj[\"$",
        "RYD;4",
        "|>>qp\"6W",
        "F~nS}l",
        "z tAU",
        "P}_g?",
        "r1N%.",
        "!3Dm0",
        "YNV[I",
        "{0pzl",
        "\\*].>bV",
        "QuadwordProperty",
        "I`;wf",
        "Gdp~d",
        ": / auto <zvolen",
        "Lw3'3",
        ":/7$7",
        "&\\Lok",
        "ytett",
        "DUiUH>A4",
        ",S4+YF",
        "?}czj",
        "%zJ:]",
        "N/_HL(",
        "6`Gz.",
        "pw\\-F",
        "leri ge",
        "2|m\"4m",
        "LockResource",
        "hMsZx^r",
        "mCCoh",
        "d/\\hD",
        "0?Y$A0",
        "VNCo`^",
        "x9L'..i",
        "$D<wEB<[\"!",
        "^v.{c",
        "h68eW",
        "r~X`8",
        ";2x[H",
        "o PBR. Por outro lado, quando",
        " migrar todos os controladores como parte da instala",
        "F[676",
        " a potom sk",
        " lors de l",
        "g. Setupcomplete.cmd ",
        "z'hTl",
        "~H)gX",
        "}I_a'!",
        "1l=hY&",
        "<R%tvv",
        "3Z:FY}Z~P",
        "sr-Latn-BA",
        "NHrGS",
        "]_3hB",
        "y]+;-^",
        "P{+lD",
        "k\"EUW",
        "Rt(T6A>",
        "I48mx1O",
        "'&%6$&",
        "_except_handler4_common",
        "ze:.d",
        "eq+~Y",
        "-s#-s",
        "u<G<2",
        "o aceita argumentos da linha de comandos. Na Linha de Comandos, execute \"setup.exe /?\" no diret",
        "<xcdn",
        "w6TN+{",
        "r versionen av Windows 10 kan du inte ",
        "et en forbig",
        "OCHQy",
        "cessaire en cas de mise ",
        "\\++;*",
        " ole oikeuksia kopioida sijainteihin, jotka edellytt",
        " instalace z m",
        "/i7c$0w#",
        "OQ{QD,",
        "+n<;pw",
        "5RV}i",
        "uje sustav Windows. Sljede",
        "GetSysColor",
        ",I7~H",
        "a(gl?",
        "W@/n&",
        "?yCWC",
        "OwYre",
        "F6wnQ",
        "puLx&O",
        "VjFt9",
        ">(UIw%",
        "lPAJW;",
        ":1[]3",
        "2_~oU",
        "E(]rw",
        "/Eula",
        "ke All, a telep",
        "`Ff2p:",
        "R-\\^g",
        "edpexG",
        "^5]qA",
        "`}qMO",
        "~otw|",
        "TM.Us5T",
        "_)Q+y",
        "':aKJi",
        "a:VJiJ",
        "HpY|Nk{}",
        "vFI{\\",
        "m<g`z~",
        "E,u)D",
        "-KB7D",
        "FlushFileBuffers",
        "wc}mr",
        "Em9]x",
        "s vietas. Setuprolback.cmd ir piel",
        "wuummm",
        "?k,3cU",
        "p)BLL",
        "FDo=}",
        "NpH7?M",
        "VersionMatch: Target exe build version is: %s",
        "GetExitCodeProcess",
        ",/3TK",
        "`pFct",
        "TXiZ w",
        "&3w8H",
        "-5dT3",
        "h#0,;",
        "!L^_U",
        "8ZtDum",
        "e migrirati nijedan upravlja",
        "Y25Cp",
        "oVc@a",
        "qe!oc",
        ";e=/\"",
        "lt-LT",
        "gQt88",
        "aPqnp",
        "F0D8a/=",
        "XMwh4L1",
        " aktualizace (vyhled",
        "uP,n0R",
        "S!U+|",
        "Xmq5-",
        "lVM A|",
        "7aUF}5",
        " Zp7v",
        "# ;~1",
        " u osnovnom direktorijumu instalacionog medijuma.",
        "parameter is niet nodig bij een upgrade met",
        "E}@B*",
        " / PBRUpdate ",
        "X s[\\",
        "Y2>g-",
        "sV;t!",
        "nEr)\\",
        "d#xL*",
        "tH?mK4",
        "_}*05",
        "Commutateur : / pkey <cl",
        "t=!kb",
        "8Qes.",
        "_1gE!l0",
        "JgAQ(",
        "@~[A]",
        "$9dE:r",
        "LS.=Cy",
        "SendCallbackMessage: [0x%X] -> Cancel request returned 0x%X",
        "kIz3g",
        "gof&x",
        "C/piIj",
        "velet: Ha a / migratealldrivers ",
        "_`W,%Zb",
        "?y<,8$0",
        "p?0Ys",
        "B6'@(",
        "d5KmW",
        "BYa_Ey)",
        "@JEVW}",
        "Compatibilitate",
        "=|~dR",
        "\\a@mU#",
        ":Am9*",
        "j---.7",
        "GE!DC9 (",
        "';ug=,",
        "sr-SP-Latn",
        "Reporne",
        "7-8M8Z8",
        "_OgXX=",
        "]b{9[",
        "|/>6_}",
        "rba, ",
        "kalun 64-bittist",
        "3,H#J",
        "aY`::",
        "5EI:J*I",
        "6@I$R",
        "ud`(?",
        "Zh%zv",
        "cznik / showoobe ma ustawiony parametr None, tryb OOBE jest pomijany, a sk",
        "GW?Kp",
        "<)>0>>>E>o>u>",
        "sekormA telep",
        "G*{^x",
        " basert bruk",
        "?K?b?",
        "C-n!2",
        "+0Q(jGs7=>",
        "Dgg%g",
        "Ta)p(",
        "UZB[6",
        "|[|=w",
        "h!)D_",
        "PNy2D",
        "xcFb3",
        ">TU)M",
        "\"a1fS",
        "9H:S:o:~:",
        "D8$/?+",
        "14^;R",
        "mJEH]S{",
        "VI|Ev",
        ",yQVy",
        "T]4Jq",
        "Rd)[_T*",
        "skcgCbh",
        "/Prompt Defer %s",
        "PXniG",
        "6/Qh&",
        ">-?\\?",
        "gers wird Windows 10 Setup automatisch neu gestartet.;Die erforderliche XML-Version konnte nicht gefunden werden.8Fehler beim Bereitstellen der Medien auf der Festplatte.pSetup konnte nicht korrekt gestartet werden. Starten Sie den PC neu, und f",
        "(:U=j",
        ">_5@f",
        "l)G2K",
        "cessitant l",
        "Q?u3{",
        "r7Gis",
        "^+CoI",
        "{S)VP",
        "ekLB&",
        "nBHQ=",
        "|,lk^",
        ".`xDS",
        "Hive file %s is in use; will attempt retries to ensure it is unloaded.",
        ",`Q\"9",
        "0^\\m3",
        "xN(k2",
        "G:*cL",
        " registros compactados para o local especificado. Observe que o",
        "3}Xh?",
        "s vai izveidos PBR nodal",
        "[\\6^]",
        "N;/yOW",
        "TEMri",
        "FgD<GE",
        "/Recovery",
        "kkulcs> ",
        "|mE9:zf",
        "metro : / noreboot ",
        "pe$byi",
        "wpz7t",
        "Sw9=O",
        "M2E)C",
        "bUn],",
        "M*2}'",
        "-THnW",
        "O9*jD",
        "T0}Mv",
        " ^8&s",
        "\"(6O]na",
        "C\\=U3",
        ")`}Le5)",
        "kC+-7_",
        "e#9S&",
        "%Ke.0",
        ">QI21",
        "K^]Vj",
        "Kompatibilitet",
        " ?uD6KC",
        "0AImfP",
        "3 383d3",
        "a9GX(",
        "Parameters : Local file path or network path to a  specific.wim ",
        "Pavyzdys: setup.exe / auto upgrade / PBRupdate disable",
        " versijos naujinim",
        "MZ[L0xW",
        "27~@oEW",
        "wT2mV",
        "36d.B",
        "+-b'S",
        "w..89",
        " definido como Full, o utilizador final tem de preencher interativamente o OOBE. Quando / showoobe ",
        "9lOHTyF",
        "c=j-O",
        "U&*8Z",
        "T?P\\Y)v",
        "s{4zK",
        "o`kFB",
        "-aGY\\",
        "Durch ",
        " starszej wersji interfejsu u",
        "yll(|",
        "Q^>$_",
        "&Annuller",
        "<Vw+i",
        "CDlpManager::SetThreadPriority",
        "tres : Enable ; Disable ",
        "el7|R",
        ")jK=e",
        "        loadFrom=\"%systemroot%\\system32\\uxtheme.dll\"",
        "D87\"8",
        "gGP{H",
        ":(n|\"",
        "7,8w8",
        " GPfJ\\",
        "|)5p/o",
        "7hY%q",
        " versija, reikia naudoti 64 bit",
        "lJ`^J",
        "Q%{P>",
        "b\"8Lg3",
        "6)f\"K",
        "bQ?'R",
        "ppp@@@",
        " None migreras inte drivrutiner som del av installationen. ",
        "gi[ON3",
        ";5/4/k",
        "Dg5cOOt",
        "=0fsr`",
        "n XML requeridaAError de almacenamiento intermedio de los medios en el disco duro",
        "sH7]z",
        "7r4k<G",
        "Indstillinger: Upgrade; DataOnly; Clean ",
        "E=^%GU",
        "VDe_f%",
        "D'A'A",
        "pW~$o%",
        "C \"jj*)",
        "B(#\"<S/",
        ">&#yp",
        "28h\"O",
        "DOWF\\u",
        "9iwDY",
        "U3vWE",
        "j6jg%3",
        "kok-IN",
        ":!;(;E;L;",
        "^C}==?",
        "DOCTYPE",
        "GN<Ll",
        ", OOBE ",
        "zvem setuprollback.cmd ",
        "3-333C3P3g3m3",
        "3Iq F5`FK",
        "CDlpTask::GetError",
        "r Windows XP med Service Pack 3.",
        "Db>z^&",
        "5{ Gu",
        "x??65",
        "RlxoJ",
        "'3VI^",
        "%\\z(]Gqb",
        "'.?.w",
        ".Pr19V",
        "-vg3t",
        "'Installatie van Windows 10 voorbereiden",
        "\"s[]YS",
        "Switch: / auto <migration choice> ",
        "|dpEVp",
        "s#xE??",
        "0LkhNc",
        "WZco_7",
        "? ?$?(?,?0?4?H?L?P?T?X?l?p?t?x?|?",
        "fj_z0",
        "oen.>",
        " activit",
        "=R_TF",
        "AKUtM",
        "metros : Full; None ",
        "p%P>]",
        ">v*^p",
        "?B$/u",
        "U>(\"(xV",
        ":E<'0vYq",
        "FDICopy",
        ":,C+?",
        "QTeUK",
        "16[Wz",
        "E$>s)\\",
        "yF~#Q",
        "'];n% ",
        "0$010U0h0",
        "Beispiel: setup.exe / auto upgrade / migratealldrivers none",
        "ZOko2",
        "y~<OxU0",
        "[,*7h",
        "`k};qT>R",
        "}Xr7I",
        " *R#.",
        "ik installifailid j",
        "L.b6T",
        "!_Aj!\"",
        "SetupHost result missing... remapping [0x%x] to MOSETUP_E_COMPAT_TERMINATE.",
        "sakor. Z",
        "M9V~o*R",
        "%cJMgQ",
        "zvvs(",
        "VbVh<",
        "n$iDDz",
        "c\"y(-",
        "en-ZW",
        "OAXD0",
        "+3\\-Z",
        ":)zE}",
        "C^d32J",
        "9.boxu",
        "}DKj9\"",
        "^lw{K|",
        ".%UQp",
        "SetupPrep.exe",
        "{3}2Z",
        "Tnv2@'",
        "k@'D!2",
        "s telemetrijas apkopo",
        "%+5[U",
        "it1C*",
        "9LDNe%0",
        "(IIIZ2",
        "v486iy",
        "MQ.W-Pi",
        "A'Wjg'",
        "w^{XX",
        "c64zyVa",
        "htng2",
        "fs?z+",
        "pzu$X",
        "Te^nW",
        "jien k",
        "K~;QT~",
        "LxpD]",
        ">K=@c",
        "r til OOBE: ",
        "+divl",
        "Box Magic...",
        ">QY8O:",
        ")wBKO}",
        ",`\"' \"03vB",
        "t match your PC. For example, if your PC is running the 64-bit version of Windows, you need to use the 64-bit version of the tool. Try running the tool again and make sure you select the correct architecture.\"There was a problem starting SetupiThere was a problem starting Setup. Close the tool, restart your PC, and then try running the tool again.UWe need at least 350 MB of space to run setup. Free up some space and then try again.jIf you install this version of Windows 10, you won't be able to go back to %1!s!. Do you want to continue?",
        "O_<M_",
        "c/_Oq/k",
        "x?~v;",
        "QTO*M",
        "}Ye|H",
        "(%9]C",
        "wt(+O",
        "V4(<A",
        "#gYm|",
        "tzm-Tfng-MA",
        "h%\"l[",
        "84>?{N4",
        "Z1Ei3V'(",
        "{9'PI",
        "2QC<^",
        "Tidf3",
        "T$S4e",
        " informace najdete u polo",
        "Q5W=S",
        "Microsoft JhengHei",
        "&#eC4",
        "Transfer thread has exited.",
        "yt/#Os",
        "2k(>$",
        "mu na po",
        "None, a instala",
        "Ir`Db",
        "4=$!t.Z8u",
        "AJ4#RO",
        "cOW<&~",
        ",k2_-",
        "pr,t`",
        "Service Pack 3 ",
        ">%>3>:>G>N>V>]>",
        "mx/2'\"",
        "mw_|c",
        "L3_ON",
        "feYYH",
        "cs-CZ",
        "(|T,&",
        "[$IZI(",
        "6k5c[",
        "J>>VK",
        "/Z,=!V",
        "U#[j(",
        "&Otka",
        "ljivost",
        "SY8 G",
        ">&/sI",
        "D+1/]",
        "~8{rW",
        "&_*k4n",
        "velet: A telep",
        "[]3ol&;",
        "[<;4\\s",
        "(KkhS",
        "h_~VW",
        "qLHBK",
        ";i%<^2(",
        "ania instalacji systemu Windows s",
        "4ck,1",
        "(`o:;;",
        "7jrmr",
        "Anahtar: / copylogs <konum> ",
        "bbwh\\",
        "d{r~\\",
        "x%2p;e!",
        "N9Y-N",
        "\\wW$C",
        "utilisation",
        "EAt*(*o",
        "\\yH,d",
        "jHj,`",
        "S736@",
        "e. Veuillez red",
        "q2^<H",
        "G u7x",
        "D!}^6",
        "3s-}bT",
        "Zd=`Y",
        "~:YWVJ",
        "Schalter: / installdrivers <Speicherort> ",
        "ci pr",
        "_%1yT",
        "PIg]P",
        "BuN+f",
        "~GRrn",
        "CreateProcessWithTokenInSession failed!  Error = 0x%X",
        "X>Mec",
        "XAJ(w",
        "lonej lokalizacji. Zostan",
        " vai UNC t",
        "+FEG!ZP",
        "L2z<x",
        " telemetrij",
        "Tiy-I",
        "<la@ ",
        "Skontrolova",
        "PJ-$EUS",
        "+K3`\\R",
        "e37fj",
        "/J\"_|",
        "1T%E,jYlBS",
        "8klE2",
        "r'2}Pw",
        " : Enable; Disable ",
        "o`:(Q",
        "!wfp$r",
        "gNS>{",
        "#9@VR",
        "rG8?m",
        "({;k3",
        "2(2H2x2",
        ".?AVCNoTrackObject@@",
        "ncC&(",
        "[BqVN",
        "<6y4xk",
        "charger",
        "OUCyx",
        "Eksempel: setup.exe / auto upgrade / showoobe full",
        "ZyipS",
        "FLm)Lm",
        "#1.IW",
        "!U>9B",
        "=+x{q",
        "CreateTask: Error serializing state!  [0x%x]",
        ".M@$W3",
        "Exempel: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "n haz",
        "OHV^'V",
        "`t<SC",
        "wF20p",
        "&6<g~",
        ">m['O`",
        ", ak u",
        "pppPPP",
        "9[577",
        "]n\\7b",
        "6TgE<QA6",
        "GVrDL8?o",
        "1%cHc",
        "Z2--u",
        "v.ycd",
        "@BiKA",
        "+#}KH",
        "5S?z7",
        "2ZeTO=",
        "||oi!",
        "&jOxA",
        "~n?4 fhe",
        "N>[0zjn",
        "i9]]{",
        "lmVs-",
        "OZV}7Q",
        "(JHj9",
        "GetCurrentThreadId",
        "5$G/]",
        "h8\\Lgn4",
        ";!<\\<",
        "jJW{c",
        "Lt.N_/",
        " possibile usare gli argomenti della riga di comando seguenti per modificare il comportamento dell'installazione di Windows.",
        "wlAY?",
        "}9v6v",
        "g>\\setupcomplete.cmd ",
        "Cz|@;",
        "HR|cOba",
        "aF;`&)",
        "Z#{EQ",
        "XIl@F",
        "4W~NCv",
        "_Bf|v",
        "xZRvA",
        "ELEMENT",
        "lmayacak. Bilgisayar daha sonra yeniden ba",
        "*px\\LX",
        "Wnf;}s",
        "OHqy;Y",
        "f5_+DD8S",
        "-&&;`",
        "-m=oF",
        "XxN+M",
        ".?AVCCmdTarget@@",
        "BUCzI",
        "q]G~E",
        "y%Sx]",
        "v}6kw",
        " %E)M",
        "dd OOBE: ",
        "QRW$j#",
        "4KQF/",
        " _1YF",
        "+*ELE",
        "&Next",
        "h[)O^D",
        "Koit(",
        "t:ol[O",
        "|NiF0",
        "jumu. ",
        "RS%pz{",
        "#!:G1",
        ".[V6zk",
        "5U7w;h",
        "8Q`=AmO\"",
        "Fhon9",
        "0;~u0",
        "avons pas pu d",
        "j=^9*",
        "@m5Cif",
        "xc/}~",
        "dw9;X",
        "Cr<[2",
        "(kT5j",
        "CktkU",
        "7PV^6~By",
        "aF@T0y",
        "Yw7m}",
        " nenhum driver como parte da instala",
        "'`U@)n",
        "S-|dj",
        "V+--)1>{",
        "&napoi",
        ".inf ",
        "-jd+bj",
        "ov pre pr",
        "vk_k{",
        "2[2s2",
        "fil5+",
        "YtXIU}",
        "Fs(_U",
        "1bK=0a",
        "\"sJMF:",
        "\\X_R>",
        "6#626b6",
        "rminos de licencia, habilitaci",
        "<0}O+",
        "Exemplo: setup.exe / auto upgrade DynamicUpdate disable",
        "=Qm0^#) ",
        "%`']&",
        "@|;|P",
        "ranka",
        "vcJ0A",
        "n,4~0eJ",
        "OF ?7",
        "r~amP",
        "E|Pp{p",
        "]NR{b",
        " 2gHz",
        "Eg\\tB#LfT",
        "$vreY",
        ".?AUIUnknown@@",
        ":g*[G",
        "%s: Clearing PreDownload mode...",
        "N*USz",
        "!<ZTj{",
        "6Sidnu",
        "r(\\Q&",
        "sta, kde byla instalace p",
        "DeleteObject",
        "j4<MEE",
        "T$ 9Q ",
        "e|n.7",
        "[a:zXKt",
        "''n|.",
        "Example : setup.exe / auto upgrade / migratealldrivers none",
        "RJk5!",
        "s. A k",
        "u@{uX",
        "Parameter: / Postrollback <placering> ",
        "343c3",
        "<`|lZs4",
        "zYd^y",
        "sr-Cyrl-BA",
        "r)YSkK",
        "C33mT",
        "Tuj'8",
        "rUfvb",
        "zC3H^",
        "A]a@z",
        "*yMnGE",
        ",w|0 ",
        "9:,|O",
        "h)%z<-",
        "R2nt\\*",
        "ddaB0?|",
        " program",
        "D$$Pj",
        "gZvL#^",
        "yD>4G",
        "N*S<^",
        "),BGO",
        "68W_{h",
        "`!66v",
        "Voorbeeld: setup.exe / auto upgrade / showoobe full",
        "&-S5;eJZ",
        "kazov",
        "4c|cu",
        "Yn^Jx",
        "[pam}\\bT!",
        ": / Postrollback <hely> ",
        "e se ",
        "Jw~1e",
        "T#;;9",
        "r] Qt",
        " stand",
        "QF=JL",
        ": quiet ",
        "!8b8#",
        "$%3w ",
        "oa{3|",
        "}kG8U",
        "F*WJW",
        "gB7]:",
        "BB_Kg",
        "rankio versij",
        "=-qQ6:",
        "`3Q.g",
        "6rD 8",
        "#Are you sure that you want to quit?",
        "A9dd'",
        " technik zodpovedn",
        "4G^#o",
        " do wersji %1!s!. Czy chcesz kontynuowa",
        "v^j7I",
        "Yi4(k",
        "0MX,<",
        "FormatMessageW",
        "-MExqG",
        "`E={J",
        "jExjmN",
        "ox:]?",
        "8)E6(,",
        "GetModuleHandleW",
        "}8i*Z",
        "5;\"Yg+",
        "S8@&,",
        "\"):0DL",
        "%)\"m/",
        "Lt[H1",
        "gy>|+?",
        "JJJ{7",
        ")EVmE",
        "[\"?MW",
        "IawVl)",
        "bK5dO",
        "!yGP2",
        "|@xLH|d\\",
        "_E!1B!1",
        "2HYJde",
        "ntxyy",
        ";9e=(",
        "XV^<C",
        "\\!N@vrS",
        "}(KJ}",
        "CQAH-A",
        "dzu, m",
        "steemile Windows vNext, mille korral n",
        "M6*_o",
        "s9.29.",
        " PBR; ",
        "feH8aq4",
        "[4NRn8",
        "mq2u*",
        "l+KS5",
        "\\>}?_",
        "jc}g%",
        "`Vh^$",
        " oper",
        "vF?w?",
        ".IbK?",
        "``~.f?",
        "hVhOK",
        "zJ[=0XZ",
        "Exemple : setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "Handling: Automatisere installasjon med overf",
        "SiteLink%Keresse fel a k",
        "~.le3",
        "V<Y*r",
        "ZhLw$",
        "eGhg*",
        " a telemetria referente ",
        " uz specific.wim ",
        "a#<<Kr",
        "yzV<r",
        "#YfL<",
        "e+!vp",
        "7,7H7",
        "G?\\$?",
        " ir pasirinkite tinkam",
        "67W9a",
        "[oF\\p",
        "#%CX^",
        "lo failu ce",
        "q*boy",
        "\\.\\VQ)",
        "ce, ve kter",
        " Action : Sp",
        "kRK'm",
        "nC:z<",
        "JC\\ye",
        "P8kxK",
        "k, kter",
        "J(<L!",
        "!l{0-",
        "X8_zU",
        "+T&Oe3",
        "ENlmkk",
        "d8{$f",
        "DlpTask: Transport not set. Skipping download phase.",
        "o de 64 bits da ferramenta. Experimente executar a ferramenta novamente e assegure-se de selecionar a arquitetura correta.)Houve um problema ao iniciar a Instala",
        "]}xSU",
        "wHA{\"",
        "4mi$M;;",
        "Stikalo: / noreboot ",
        "RhJ]/j",
        ".uOV>y",
        ";|VY:",
        "*s;4+>",
        "FileDescription",
        "CK0w8",
        "%qwOP",
        "f9XBt",
        "Djn;@}2",
        "3`C,2",
        "&Dokon",
        "Nz((l",
        "0,000H0L0T0X0l0p0t0",
        "+dZ:>.",
        "eb`*ieuloZ",
        "QhD/A",
        " sen j",
        "*SgnFu",
        " niveau avec un m",
        "9/G>1",
        ".Og7R",
        "installation ne mettra pas ",
        "EyVEy",
        "Df,'>",
        "Setup.exe installe ou met ",
        "        is done as a defence-in-depth approach to closing a known UAC",
        "A\"rI:\"l",
        "cD,9N",
        "0S0h0L0",
        "=gbg8",
        "eo6Jq",
        "=Y,5:@",
        "*{<^tS",
        "l-E}o",
        "switch mag alleen worden gebruikt bij testen en in een testomgeving. Gebruik de switch nooit in een werkomgeving. ",
        "Km.)b",
        "!w>R*",
        "            <supportedOS Id=\"{1f676c76-80e1-4239-95bb-83d0f6d0da78}\"/>",
        "c$[+-",
        "lama bilgilerini toplamak isteyebilir.",
        "unar dospe do OOBE : ",
        "v[:m)",
        "Wp1%-f",
        " u[VM",
        "Y'(E)",
        "/Console %s",
        "D^,>|",
        "MOCQHr,g",
        "+> ^r",
        "Zb-5x~>",
        "C _A_",
        "\\Za7Dr",
        "yylhL",
        "\"OlU[",
        "{R|}w{k(",
        "Akcija : Zastavica ti",
        "\\;;)a",
        "*#Kp ",
        "j04X@b",
        "f4y,U",
        "N#>g!D0",
        "]21_^",
        " eJ(}",
        "*d=yM2",
        "CDlpTask::ExecuteTransfer",
        "n: cuando / Telemetry se establezca en Enable, la instalaci",
        "m3_/>",
        "EPrX6=/",
        "Buh_[S",
        "SOGXK",
        "8*ECq@",
        ":=:h:",
        "]R{Uw",
        "Akcija : navodi ho",
        "xX<*6",
        "Z23*?",
        "GlobalLock",
        "sq}$e",
        "*-1%V~",
        "F'cq;",
        "^qp@yPZu",
        "Parameter: / showoobe <parameter> ",
        "`)4Z9l",
        "_P&!<3W",
        "gF/gF",
        "25L76",
        "&Indietro",
        "GetAce",
        "Iwz}2",
        "7`2:s",
        ";Ljd&P",
        "gZ>4D",
        "09cShW",
        "('t#/a",
        "{  ,*r",
        "NdjYN",
        "I}?3i",
        "tA)e83",
        " overf",
        "jv&{+",
        ":Dm?4",
        "aJwUfq",
        "riet atpaka",
        "D$@ )@",
        "y\"NjZ",
        "=cGJfF",
        "t;:'[{",
        "FXSZ ",
        "``<_f|",
        "N{l#WP$",
        "UninstallActive",
        "R+ *j",
        "k~O\\w",
        ")ODV>B",
        "Q#f:*",
        "595S5`5",
        "TaskCount",
        "?V++f",
        "jwBzye",
        "4~X\"+q^B:?",
        "#^?.y",
        "ssig, Windows-Willkommensseite wird ",
        "NtW,M",
        "uJVlG[",
        "0$PDg",
        "yor+Kurulum Install.exe program",
        "$;yMt?0",
        "33#A#",
        "fTwTK",
        "ba{KN",
        "j<?2^",
        "Action : Upon failure, setup will copy or upload compressed logs to the specified location.Please note that the PC and / or user must have permission and network access to the specified file path.This command  runs in the system context so may not have permissions to copy to locations that require user permissions ",
        "Valmistelu",
        " den angitte plasseringen. ",
        "FYtJ9-",
        "bq)9N",
        "`(![L4/",
        "b!@@4",
        "Pr_6?",
        " una partici",
        "o: quando / Telemetry estiver",
        "i1Hf<>&",
        "X`bavl",
        "PFQE^U",
        "O~-cO",
        ",QR7M",
        "XC<m'",
        "59&GY",
        "n|/z,",
        "9X`v^j",
        "en, program za instalaciju ",
        "D6E['",
        "ge# g",
        "lda: setup.exe / auto upgrade / copylogs \\Saj",
        "jl\\setuprollback.cmd",
        "SetCursor",
        "E{~IX",
        "vel encontrar a vers",
        "ognIv",
        "sx2Z]",
        "f;GwD",
        "F3WRu",
        "2: U_",
        "CLinkButton",
        "et-EE",
        "|_h'1D/",
        "IqJ|%",
        "aRq%|",
        "iJt%H",
        "#DT<>7",
        "h,V&]",
        "]ibw'",
        "/+vo[<a",
        "C;X`s",
        "t%)=$)",
        "b_z)0BR",
        "bo-CN",
        "J_Rc{NR",
        "Pj!nQP",
        "qiPMm",
        "1@<-+b_?x",
        "FBb,hx",
        "D$hSVW",
        " cualquier instalaci",
        "742@9",
        "i$T>Q^gy",
        "B#[<G",
        "@kY9z",
        "6O~CImC",
        "ta pr",
        "metros: ruta de acceso local o ruta de acceso de red UNC a un archivo llamado setupcomplete.cmd ",
        "V%OPSK",
        "GetWindowLongW",
        " XML ",
        "DeleteFileEx: Unable to restore attributes on [%s]; GLE = 0x%x",
        "Rs*jF4",
        "IM*kn",
        "SrUn/",
        ",c9,Z",
        ":t:p8",
        ";XcNU",
        "9\\$$v",
        "6M~_f",
        "O!B+K",
        "CDlpManager::CreateTransport",
        "~J#yV",
        "9~x?+2",
        "l~b0R@b",
        "'9\\.-",
        ".|F*S",
        "[W6n]yo",
        "6:Jgp",
        "f3?`V",
        "W0$]V|{",
        "n^99q&U",
        "w'X14",
        "klcc>F",
        "^:US+gn",
        "&_.8r?",
        "c=fY*Y",
        "d_`bs9X",
        "Parametrit: Upgrade; DataOnly; Clean ",
        "cie vyvolal skript setuprollback.cmd: ",
        "2R$zgg",
        "bory do adres",
        "un 64-bit s",
        "ux0,|E",
        "jCR1a",
        "PPPPV",
        "wzki+1",
        "G~o l",
        "|#Fy!",
        "Veiksmas: pateikia s",
        "7AK?d",
        "Kk?1u",
        "K!-d9=",
        "J?*<|",
        "-q(3.M`3",
        "..CZu",
        "mcugg",
        "@o8ag0",
        "1k&seI",
        "@23\\]m",
        "p65G#N",
        "<3<v<",
        "e?Xn:",
        "S@]LSA",
        " el OOBE y los componentes volver",
        "9~Rnp$",
        "-|Y!\\",
        " les t",
        "yoY~i",
        "_+yWB",
        "=K)=\"",
        "du%X{}",
        "Ng0n0",
        "g till en mapp med .inf-filer ",
        ".n~)+",
        "latan i",
        " definido como None, o OOBE ",
        ">7t+)",
        "s[%,\\",
        "|>3h\\",
        "nWJ |",
        "|~r1`",
        "'C+Scg",
        "OBK;8",
        "M(zX'",
        "~M)_g]S",
        "7T~F\\-",
        "Zb}mmD",
        "c%gHE~v)j",
        "%7#P^3=",
        "ajte ponovno.eAko instalirate ovu verziju sustava Windows 10, ne",
        "SgqW0f0O0`0U0D0:",
        "f,r:?",
        "5gKBQR",
        "~@&~t]",
        ">J>d>q>",
        " : setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "Commutateur: / migratealldrivers <param",
        "{Z<ON",
        "CDlpTask::NotifyActionStateChanged",
        "UuidToStringW",
        " la suite d",
        "5t;iN",
        "k(]>O",
        "9D}Bi",
        "aly?%",
        "412M]I",
        "o|VMM",
        "tgWHy",
        "u& <C",
        "u}?2iDf",
        "?'ZK\\",
        "> t>S",
        "nyt asennusohjelman paikallisesta hakemistosta, kopioi kaikki asennustiedostot hakemistoon uudelleen ja k",
        "@uhOF",
        ">uw?R",
        "wwwwwwwwwwwwwwwwp",
        "/PreDownload %s",
        "liti: / copylogs <asukoht> ",
        "0d1v1",
        "6H7O7",
        "SJ{h_",
        "64]ui",
        "(DWet",
        "0-Nk0i0n0",
        "ghB<F",
        " oppgradere PC-ene p",
        "h2;Q/",
        "jT?fV",
        "{Btjb",
        "trehozza a PBR part",
        "3bNKR",
        "q]z$T",
        "X|+F'",
        "'B*hR",
        ">$Z*7<",
        "|q}gQ",
        "V;4^w",
        "tllN$",
        "v1\"UY",
        "'OOA?",
        "torul",
        "0'040R0s0",
        "~P/82",
        "Lys,E",
        "7mK-6",
        "cznie wykonali czynno",
        "jot,*_",
        ",]5,2",
        "~x*ZW",
        "dwxtm\\k",
        "Y+0Y[",
        "bs-Cyrl-BA",
        "z7M&h",
        "lda: setup.exe / auto clean / installfrom d : \\saj",
        "2k#zj",
        "-P\"@G%-",
        "ad: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "ene datoteke. Ova komanda se pokre",
        "A`7$@",
        "/v_O7k",
        "velet: Ha a telep",
        "j[]0p",
        "@ U:|",
        "tC7vn",
        "%s, DLPLOG: [0x%X] [%s] [%s]",
        " da pr",
        "8q:/T",
        "tzm-Latn-DZ",
        "S3SW4",
        "tenia zmien pou",
        "y4/.j#",
        "OTAhr",
        "|6(O0",
        "8!M.0",
        "^_}}>",
        "Akcja: Przekazuje okre",
        ",<DP&Xx",
        "08hs1",
        "U#7(a&",
        "'FcNl",
        "5J~|#",
        "ciOQ ",
        "6z!m|",
        "!U-|[",
        ")Gdrz",
        ";*;:;C;L;V;Z;k;q;",
        " <y3[7",
        "@/39u",
        "eO}\"UV=Remj",
        "{nr_t{",
        "St|ZZ*",
        "*kmwIB",
        "6}3@k",
        ">E-1e",
        "tf8]x",
        "8m\\2n",
        "OHC^p[",
        "^g}ej",
        "4ZjBC",
        "~A15p",
        "BQhb%",
        "t.2>e,",
        "suviibal oma installikandja juurkaustas \"setup.exe /?\".",
        "k\\y-N",
        "=xJxj&",
        "P$bL)/",
        "-Dy7#",
        "@oruv",
        "pXa@(",
        "Xii$a",
        "j.U+{",
        "M}!\"L",
        "\\'iY6",
        "a>p\\^b",
        ")bNdi",
        "v*4wEq",
        "?7}E+X}",
        " la partizione PBR. Al contrario, se / PBRUpdate ",
        " kopiere til plasseringer som krever brukertillatelser ",
        "GQq1I",
        "/XTtN",
        "0%3>=",
        "05lKX",
        "w~~xp",
        "rVY`*",
        "o<(Vxx",
        "E.#8i",
        " %1!s!(",
        "blV|D",
        "0~0Y0",
        "m\"^QXdo",
        "@~y<A",
        "i din nou instalarea Windows 10.",
        "h:o*F",
        "`1XL0",
        "X2rr;o",
        "sa)fA",
        "e#~x-:",
        "lhatja ",
        "*xRW%*[",
        "kCZ[!",
        "HM>TV;",
        "m&}_K",
        "m8Z$k",
        "U-jU+]",
        "#rJ:!H(",
        "utim, kada je / Telemetry postavljena na ",
        "g+Qb7",
        "e}jS;",
        "e5Lme",
        "ptG!Dl",
        "'QJ`'~,4",
        " Microsoft Corporation. Tous droits r",
        "[^s.x",
        "]H)B6WE",
        "P4)ufP",
        "Nous n",
        "appeller le script setuprollback.cmd apr",
        "Qux^yZg",
        "TJ)GhG6z",
        "<\"T5S",
        ">\"1Fj4",
        "2[|#G^",
        "NMRk0",
        "Pvh4Q",
        "matStart",
        "Ow2-~1",
        "bZ]@nF",
        "p.\"={",
        "Eljjb",
        "0=0l0",
        "-AbiOwn",
        "chte die PCs einer Abteilung ",
        "2.7e;",
        "\\6/)A?",
        "rer installationsprogrammet ikke installationsrelateret telemetri. ",
        "c@J;1*",
        " los registros comprimidos en la ubicaci",
        ":&*ui",
        "1y6;p",
        "EGLhv",
        "Z[5;(%W",
        "?M!hQ",
        "ar-TN",
        "XLe programme d",
        " cu privilegii de sistem. ",
        "nl-NL",
        "X>T=B",
        "YtE-h",
        "aW=<^",
        "q?c7+",
        "ti vagy friss",
        "{PWlUu",
        "h3!^!F",
        "cznik: / quiet ",
        "=Z2~~",
        "YI3FS0G",
        "soben",
        "Js80[E",
        "L`f65",
        "1koYj",
        "s$)7%",
        "SYSTEM\\CurrentControlSet\\Control\\MiniNt",
        "Qh4/A",
        "Actie: wanneer / migratealldrivers is ingesteld op",
        "nd / Telemetry este setat la Enable, instalarea va colecta ",
        "o2)8#",
        "K.wd=",
        "Fu<d ",
        "nb#[sq",
        "GetSysColorBrush",
        "I\"V4YD",
        "CDlpRegistrar::GetActionFactory",
        "hM]\"?-",
        "%7++/",
        "Sigur renun",
        "CDlpManager::TraceData",
        "DpR0X",
        "[/>c-w",
        "Xa`'k",
        "d~o^4",
        "rnek : setup.exe / auto upgrade / Telemetry enable",
        "X96^*",
        "&NB%%A_",
        "InitializeSecurityDescriptor",
        "t\\GAx",
        "&lZheg",
        ";.{HUw<",
        "n5/2j",
        "5Z+a]x",
        "{4YRp|<",
        "6;k0hz9",
        "121=1]1r1",
        "Xe-r@J",
        "W\\43v",
        "?7YyV",
        "a y carga voluntaria, se saltar",
        "Ir6RP",
        "]8Nm~",
        "Rkokk",
        "FiHY;Q^X",
        "p^!Pr",
        ",gS_k0B}",
        "3Ayb/",
        "V\\i5.",
        "=@~Kl:<]",
        "{?~]>7D",
        "%65S]",
        "pL/\"%",
        "O-MK|",
        "Ejemplo: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "Valitsin: / copylogs <sijainti> ",
        "5$505<5H5T5`5l5x5",
        "inde, y",
        "^OZ@e",
        "ba None, OOBE tiek izlaista, un komponentiem ir iestat",
        "L$T_^[3",
        "$?!Qz",
        "5cxqv",
        "D?kn>",
        "cU/IWr^",
        "0}{e/}",
        "]:9mj",
        "lqFg(Z",
        "Rollback command returned: [0x%X]",
        "8r<Po",
        "?HD5H",
        "rate de seleccionar la arquitectura correcta.2Se produjo un problema al iniciar la configuraci",
        "dV:3y",
        "E64eE",
        "fw?z7v",
        "3!3%3)3-3135393=3A3E3",
        "FKC!l",
        "wR*xu2",
        "iu-Cans-CA",
        "[\\ZBSVQ",
        "zP*LQ",
        "|2gs}",
        "Of\\${O",
        "~{X+<I.l@",
        ",FHxW",
        "np,o@",
        "7h,.-",
        "'mh72",
        "/\\7-Rwpt",
        "<{e\"=9",
        "iDs09L",
        "gzr<*",
        "by=.E{",
        ",>G/~",
        "<Vd:RSt/G*",
        "_1YWe",
        "dHs%p^",
        "nn7h5",
        "(>I8Cc*|",
        "T`~<Zk",
        "rrQ%y&L",
        "j:IFF",
        "seau vers un .wim sp",
        "lectionn",
        "6r#<Wc",
        "JWs{u",
        "na uruchomi",
        "z[SKa",
        "J~&mE",
        "rez, le programme d",
        "8;A5;",
        "Gh;I#",
        "erG9z",
        "c`{4p",
        "MV{F^l",
        "QK^#_+",
        " durant les tests et l",
        "<,<3<o<~<",
        "O q'i",
        "sk-SK",
        "&0Bd4d",
        "+U%^D",
        "Y&Ubd",
        "s&jJ<",
        "D=*sR",
        "rsU'zt",
        "~W,w:",
        "p^-@N",
        "CInstallPrepUI",
        "es-CO",
        "K'?L\\",
        "BO(uk",
        "/GRz\"=",
        "CopyDirectoryEx2: Specified directory [%s] doesn't exist",
        "9 WE@=^h",
        "4lmAO",
        "L`%%/",
        "QlX&k",
        "anas programma nevar palaist programmu Install.exe",
        "stroja sa vyskytla chyba. N",
        ";Tc&\\X",
        "U7)SK",
        "td@]HRQ",
        "e podrazumevane konfiguracije: prihvatanje Ugovora o licenciranju sa krajnjim korisnikom, omogu",
        " Windows 10?#",
        "9Kdt_",
        "G:%=.",
        "E2,m>",
        "~!sE|",
        "n. Asimismo, la instalaci",
        "rer 64-bit versionen af Windows, skal du bruge 64-bit versionen af v",
        "fg0M0~0Y0",
        ">4Hbz",
        ".a~lH",
        "L~S)l",
        "r':{TEH",
        "l.Xm+",
        "rgutee ",
        " grund av saknade installationsfiler. Om du tidigare startade installationsprogrammet fr",
        "+4J'Qv",
        "bMF%0",
        "ke None, a kezd",
        "E!~!l",
        ",hQB4r",
        "wURHhw~;\\",
        ";8'WQQAK",
        "@p3>^l|\\B",
        "R\"%SYT6",
        "BmiP*Ql+",
        "u993u5",
        "[|TI7",
        "Kontroller kompatibilitet",
        "dpGYK",
        " leurs param",
        "c tai var neb",
        "e[z{/{",
        "@:As.",
        "\"+(6I",
        " festgelegt ist, versucht Setup, alle Treiber im Rahmen der Installation zu migrieren. Wenn",
        "Exemple : setup.exe / auto upgrade DynamicUpdate disable",
        "FSkL0",
        "y.'[wT",
        "1lWG8",
        "ddfUyt<=&+",
        "x-Zu^",
        "6;7.NZ",
        "_vsnwprintf",
        "p0m(K",
        " den har kanskje ikke tillatelse til ",
        "Pko_@}",
        "InstallMode",
        " Fdu*",
        "{/,++",
        "m'53A",
        "Exemplu: setup.exe / auto upgrade",
        "7bgm[t",
        "vede XML-version blev ikke fundet6Fejl under midlertidig lagring af mediet p",
        "cja d",
        ")'WN5",
        "nZyp'|]w?",
        "bxjq~",
        "I]G8I\"",
        "2XIUv",
        "%s;%s",
        "zvem setupcomplete.cmd ",
        "4.5k5",
        "Found ESD target file: [%s]",
        "N8qja",
        "Azione: specifica se il programma di installazione eseguir",
        "HutZ|*",
        "AFEKB",
        " gjennom opplevelsen ved f",
        "PostMessageW",
        "RtlExpandEnvironmentStrings",
        "hGZ1;",
        "8Bw1I",
        "Ix'o\"mbQ\\",
        "lOr9N",
        "j{^a\"",
        "&lkgz",
        "tFriss",
        "\"}J#-fW",
        "<^72t-",
        "avooy<",
        "i&Yu!k",
        "g!m2G)",
        "F&5rP",
        "VYm|g",
        "=@.%a",
        "V\\}~@",
        "k/P<z",
        "U{&oM",
        "l56n7",
        "MH6qp",
        "0n01YWe",
        "riaDErro ao pr",
        "AU:fU",
        "bOf$o",
        "#xI]wh",
        "1)r]c",
        "151h1o1",
        "7C=w?",
        "x|f\"7\"",
        "oHEOd",
        ";x{|*",
        "C$^df]",
        "en-029",
        "gig kell haladnia a kezd",
        "-I@o|@&",
        "k-IgW",
        "N5UMS",
        "Ly5Xtv8",
        "/8qc[",
        "hmbl7",
        ".XJa5",
        "o corresponde ao seu PC. Por exemplo, se o seu PC estiver a executar a vers",
        "?/P\\:`7",
        "qow6|",
        "Qj|2>",
        "T`=p+P",
        "edchoz",
        "v5.F-",
        "Setup gesammelt und hochgeladen. Wenn ",
        "Hhd_L",
        ".9/QX#i/",
        "r{a9\"",
        "B%?Ep$t",
        "yg$dj",
        "1L.C6",
        "jumu mekl",
        "1brp>aE",
        "0y:.m",
        "IG6PPP",
        "yT.\\R",
        ",>+vm",
        "ovom adres",
        "}D`Tv",
        "n de t",
        "A1W+;",
        "c\\#s/\\",
        "Ofsi?",
        "installation, mais avant la premi",
        "zt>dv",
        ": / PBRUpdate<parameter> ",
        ";1~E&",
        "o9;L}",
        "{G07%",
        "@WT}n",
        "\\>Lgh",
        "$Oqvi",
        " zadan",
        "6l]!y",
        "+R(:K",
        "CDlpManager::DeleteStringPropertyByIndex",
        "M>x1; ",
        "i64o[",
        "k_uN'ecjT",
        "m?1v_",
        "#D{,\\",
        "Y fLW|",
        "ba: uzst",
        "fZZv5j",
        "quc-Latn-GT",
        "IXy!7",
        "}x#(Z",
        "Exemplo: setup.exe / auto upgrade",
        "VDR9G",
        "fS|Oq",
        "h}>y\\",
        "Toiminto: kun valitsimen / Telemetry asetus on Enable, asennusohjelma ker",
        "`Ev@>",
        "CmdLine contains setupplatform.exe Waiting for system-context rollback to start...",
        ",h//[",
        "T4W:}J",
        ";p5nP",
        "210303182921Z0t1",
        "Kompatibilita",
        "`!26~>=",
        ":>lnaXm",
        "dk$3R",
        "\\u@Mf",
        "DJ)HN8",
        "kudXX0",
        "oM@Wq",
        "5;OB^",
        "hZO<5=",
        "sPc;d",
        "JA*Tgr",
        "+AU=L",
        "Mvy^B",
        "nI><3",
        "M8jyr4",
        "?V`^U",
        "{o?hi",
        "+:EOr",
        "5#!%G&",
        ": / showoobe <parameter> ",
        "wUp7u",
        "AIl8\"",
        "n!rry",
        "`UWK&yR",
        "[F_>|",
        "N}9?q",
        "rlerini ",
        "+/ ONU",
        "7Y'Q)*UC",
        "*H+,i=U",
        "&6&o{",
        "KCu|.",
        "&/y,k+k1R",
        "7+5#Z",
        "Pcw{N",
        "o copiar",
        "GetProcAddress",
        "l]4&_",
        "Switch : / copylogs <location> ",
        "Exemple : setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "iM?_N",
        "@4PgXZ",
        ".ngr4)",
        ",{KM@",
        "p1L+cX",
        "n PBR. Por el contrario, cuando / PBRUpdate se establezca en Disable, la instalaci",
        "n de la instalaci",
        "u9rJ>",
        "Xlwo\\",
        "N/<>`.",
        "t match your PC",
        "rca telemetria legat",
        "r/\\$2T",
        "CDialogEx",
        "%We6F",
        "o8* /",
        "X~L?N'=",
        "V;Dp;",
        "=cLf !#",
        "}gySxu",
        "|IFYl",
        "sV~jCc",
        "tijek",
        "mc!79n",
        "Prepare thread has exited.",
        "5?#~8",
        "Switch: / PBRUpdate <parameter> ",
        "\\x'J9",
        ")?{:^",
        "FtiK8v",
        "W93uH3",
        ",gyC2T",
        "tirmesi s",
        "B!&=Y",
        "]FZqe",
        "/Update %s",
        "smUp|",
        "Nie mo",
        "h%G<>!F",
        "_*k/6B",
        "+Srcm",
        "@wRx2B",
        "DV1-RM",
        "bf,cU$V",
        "r parametern kr",
        "n puuttuvien asennustiedostojen vuoksi. Jos olet aiemmin k",
        "S;8Zn",
        "su datoram. Piem",
        "-E`TE",
        "ZDl'3}F",
        "q7%X}",
        "!N6#BJQ]r",
        "?DWc3c",
        "CDlpTask::ExecuteActions",
        "h+jiP",
        "me8oM",
        "JVVVS",
        "(QLsz",
        "!gPdpg",
        "Wz*?>",
        "I<?|$HqnX(HT",
        "}OqQ?",
        "qiNR-gV",
        "/n,O<?",
        ")BNE[7+yJy",
        "o consegue iniciar o Install.exe",
        "jx#k^",
        "wx=,[-",
        " 6|Ow",
        "]8ewhK",
        "U&\"Gk",
        "'hM,c",
        "AR:E.q&&",
        "<%>uGz",
        "D7GN8",
        "5:/q4",
        "Mh?}8",
        "installation collecte et charge la t",
        "oeFe-",
        "@3= Wsh",
        "ZAt#R+",
        " 0O|D",
        "8*d/d?",
        "NOTATION",
        ": / DynamicUpdate <",
        "|L>-_",
        "|B_>6",
        "NT,0D",
        "^MM7ZMI",
        "xShr?M",
        "@i/l0",
        "dw$n<",
        "C:x3|",
        ";rIb.",
        "yHJK{V",
        " harddisken",
        "M!B?;",
        "\"}YC*",
        "Tl(hKI[",
        "=6l.J",
        "1\"J+ ",
        "swm'U",
        "ea intermitent",
        "Schalter: / migratealldrivers <Paramenter> ",
        "<{IbA. ",
        " preru",
        "ZZy=T~'",
        "(_)#U",
        "l4&Z3",
        "c>;#_",
        "\\J1`w`",
        "28WN z",
        "7MWy u",
        " felhaszn",
        "Expanding Setup Dynamic Update files: [%s] -> [%s]...",
        "q'(AMS",
        "rs i systemets kontext s",
        "Yd%KL",
        "n3xx4r",
        "W89V;",
        "fTg7-5-]",
        "y::a9",
        "'P/[8h",
        "XZj2Z",
        " per nakt",
        "Eksempel: setup.exe / auto clean / installfrom d : \\minWim\\tilpassetwim.wim",
        "naamiline v",
        "p7w[>.",
        "*ynsdn",
        "2fbbF",
        "{YS\"OEe7",
        "avanja instalacije, ali prije prve korisni",
        "%s[*]",
        "o#M_T}",
        "PPPppp",
        "{>@]W",
        "ki interfejs instalacije pojavi, ali ",
        "OC6 @",
        "0@5$@0",
        "qGg6@",
        "w<}mj9A",
        "@-v+$eW\\",
        "Finished waiting for Rollback!",
        "~#;*%",
        "}|rl~4",
        "csu fp",
        "-0{@k",
        "M}CmJs",
        "v~f?GZ#.",
        "Switch: / Postrollback <location> ",
        "aqV\\A",
        "S9u/6",
        "e+kW'",
        "J* !6",
        "L?u:N1",
        "_^[+P",
        "Normal",
        "o do Windows n",
        "cowi r",
        "anas programma nevar palaist mantoto uzst",
        "JBI*s",
        "eno okru",
        " ignorada, PBR ser",
        "(Phe^",
        "-?YW~0?",
        "|YWDR",
        "h'Thw",
        "H+ ?#|",
        "SMUei",
        "VfU,I",
        "HF5#`",
        "5J2%U9",
        ":);9;H;Y;^;d;l;};",
        "VSx[4",
        "7!757Z7a7g7l7w7",
        "A(sDZ=",
        "[^B?=z",
        "WWWWWWWPWWWV",
        "Sources",
        "e se nastaviti. ",
        "zi<47[",
        "4JJJ&''",
        "O?T>L)",
        "*K)#\\",
        "L`,70",
        "J>8~+r",
        "m(ah*",
        "#`4r`",
        "ZFYhw",
        "%s: Remapping [0x%X] to [0x%X] in a non-UUP scenario",
        "RLmv ",
        "#PZjp",
        "G0G*o5&",
        "RG)&B",
        "KONzr?j",
        "u arhitekturu.2Pojavio se problem prilikom pokretanja instalacije|Pojavio se problem prilikom pokretanja instalacije. Zatvorite alat, ponovno pokrenite PC i poku",
        "r{{{zzzww",
        "H$YA$]",
        "Byh:HAA",
        "+?VwN",
        ">=Y:V",
        "R1BxuA",
        ".e p(",
        "ep5gY<!}b%",
        "zDt6_D",
        "]KPYI",
        ":A;_d",
        "[@1=x",
        "[ _+^",
        "4T5n5",
        "4,a0X",
        "o : Quando / showoobe ",
        ",cs5 ",
        "7%`?!",
        "r att ",
        "9~ukz",
        "iune: automatizeaz",
        "f;DZR",
        "Como alternativa, um engenheiro de implanta",
        ">>q>M",
        "u4x/DP",
        "s%TW93",
        ".CRT$XIA",
        "Zt](T",
        "ktd(a#",
        "tIVS3",
        " parametr Enable, tak se p",
        "+~Tkc1E",
        " atjaunin",
        "\\5 e\\W",
        "L}:x#[",
        "CopyDirectoryEx2: Failed to copy [%s] to [%s], GLE = 0x%x; will retry in %u ms; am on try %u.",
        "1pwL,I",
        " jsaoB",
        "~@on?",
        "S/KKP",
        "|gd%T",
        "wsKC_!",
        "iUl%91(",
        "es-PY",
        "A3F8O",
        "=Ru+7",
        "/jlkc",
        "0:M;f",
        "020J0e0{0",
        "LO@vS",
        "7V6\\0'",
        "<z^>C",
        "QO%~5",
        "Gnf)=",
        "G-$Rd",
        "GetFileTime",
        "]$w@[m",
        "lda: setup.exe / auto upgrade / quiet",
        "is per",
        "0}\"du",
        "5vFh/n:\"H",
        "Q<Q|Q",
        "F<-;z3",
        "%[_L>Z",
        ": / Postoobe <um",
        "L$LPj",
        "Y0fq8",
        "Z5l>1",
        "az-Latn",
        "fTitI?i",
        "LC_0W",
        "H4)&_O",
        "Cw.xm}",
        "DK;wq<",
        "30?ue",
        "#s,-b",
        " -u^C5",
        "Continue without SetupHost logging.",
        "94bk'",
        "WTSQueryUserToken",
        "***xLII",
        "9%C2\"c",
        "O\"#R@",
        "CreateDlpFile: Source = [%s], Target = [%s]",
        " vietinio katalogo, dar kart",
        "n no reiniciar",
        "!|OR~",
        "zrAez",
        "1#121[1g1q1",
        "Ejemplo: setup.exe / auto upgrade / migratealldrivers none",
        "wpDK10A",
        "&Ut;+",
        "}{}jL",
        "]Y(67s",
        "ja. Poskusite znova zagnati namestitveni program.",
        "1<o)6",
        "5d|jv",
        "EKX7!",
        "lMQqM",
        "Radnja: Automatsko instaliranje sa izborom migracije za instalaciju. Korisni",
        "i8)r ",
        "ji manu",
        "(%d%%)",
        "dY#0K",
        "}*ZIwpy",
        "V9Lb%)5y",
        " a nahr",
        "5S5m5z5",
        "!A<~0",
        "8`y?a:",
        ":kgi7E",
        "}iyEZ+9U\\",
        "   @@@```",
        "UsE}hy",
        "<DjE-",
        "=s4cz",
        "na wr",
        "U5*RT/",
        "\"kd8F",
        "BuI<K",
        ";Xo\"R",
        " riadok informuje in",
        "N7Hr9",
        "3\"H:l",
        "N6GqJ;",
        "^yI&R",
        ": All, None ",
        " od miesta preru",
        "~Hgn,?$",
        "E)\\6v",
        "q:?h_;",
        "I|+q\"",
        "s atra",
        "\"tz(Wk",
        "r sedan installationsprogrammet f",
        "n anahtar",
        "FBJfEr",
        "Fe$,B",
        "g?f|Y",
        "`)vZ(",
        "{Y)[L]",
        " w@Nt",
        "msF~J",
        ")K3{nN:",
        "Windows vNext ",
        "!vIYV",
        "\"-%%%",
        "/PreDownload",
        "leminin bir a",
        "z;[r<]",
        "res med systemprivilegier. ",
        "progresso",
        "GQ=q7",
        "Usf(,7p",
        "w;uLv",
        "|'\\~yv",
        "0U|S]{",
        "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        \"> <rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"> <rdf:Description rdf:about=\"\" xmlns:xmpMM=\"http://ns.adobe.com/xap/1.0/mm/\" xmlns:stRef=\"http://ns.adobe.com/xap/1.0/sType/ResourceRef#\" xmlns:xmp=\"http://ns.adobe.com/xap/1.0/\" xmpMM:OriginalDocumentID=\"xmp.did:D90530087960E411BA60B7344D705471\" xmpMM:DocumentID=\"xmp.did:4AD21886700111E49021E51E50F2AB93\" xmpMM:InstanceID=\"xmp.iid:4AD21885700111E49021E51E50F2AB93\" xmp:CreatorTool=\"Adobe Photoshop CS6 (Windows)\"> <xmpMM:DerivedFrom stRef:instanceID=\"xmp.iid:977B7B345161E4118595B3E1319A734E\" stRef:documentID=\"xmp.did:D90530087960E411BA60B7344D705471\"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end=\"r\"?>ku",
        "-YjX$",
        "ch prostrediach. Nem",
        "i. Dup",
        "r / Telemetry er satt til Enable, samler installasjonsprogrammet inn og laster opp telemetridata som genereres av installasjonen. N",
        "Fnapy",
        "&=\"%Q",
        "da je u tijeku a",
        "7_7n7",
        "Ejemplo: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "E&'xj",
        "Oo)Zh",
        "16$Zt",
        "0Ti-5",
        "AT}1:Qz",
        "kR?Kd",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\VolumeCaches\\Temporary Setup Files",
        "UpVid$",
        "c.4c[?y\"",
        "999Y9u9",
        "Ms\\f[",
        "PhTK@",
        ",?&?#o",
        "!q?yO",
        "&>q,?d",
        "V}`6u",
        "T4{V.",
        "RBYJ{",
        ">V'i.bW",
        "EN#6b",
        "o de rede intermitente. Tente efetuar a configura",
        "NiK;LG",
        "mi instalace. Zav",
        "DirectoryHiveUnloader::ProcessValue",
        "31_+p",
        "z6\"gz",
        "ana/Windows 10 uzst",
        "d/<pK",
        "mu syst",
        "I&~$4",
        "il6[F",
        "PV@TTp$zW",
        "H3^LE",
        "~EvY3",
        "(8%; [",
        "tme. Seda parameetrit pole vaja, kui t",
        "Naudokite kit",
        " WH^G",
        "84o6A",
        "en kan bestanden mogelijk niet kopi",
        "4!#P|",
        "CDlpTask::GetActionByName",
        "installation se poursuit alors au prochain red",
        "<\"%iLE",
        "2>Jn`",
        "{D,vk",
        "Akcia: Pr",
        "GX[Gc",
        "Qd3\"=",
        "X`xyh",
        "#Wph?",
        "/Pm(I",
        "mZd`C",
        "Ejemplo: setup.exe / auto upgrade / showoobe full",
        "VR D:<",
        "I'QymSO!",
        "48:PS",
        "I&%ib",
        "Nw[=ZA",
        "`*&:jN)",
        "(6B!J",
        "Pan [",
        "t SSSj",
        "[KC5j/T",
        ")'ZQq",
        "s meghi",
        ">=nhX3`",
        ":U8E8_",
        "dU:b>",
        "b]KGr",
        "BTuEy",
        "BVhspT",
        "j5fz@",
        "oSP_k^",
        "a)t*K",
        "mKf_u",
        "af-ZA",
        "%IY u",
        "[`%% n",
        "DRwwm",
        "ieDU0",
        "cute la version 64 bits de Windows, vous devez utiliser la version 64 bits de l",
        "g>b<s",
        "vD\\Jg1j",
        "}>,Xa:C{",
        "Paera",
        "/bg9H",
        "8V7*Qu",
        "SPCleanupInstallationDrive: Failure while building path to safe OS mount directory. Error: 0x%08X",
        "oP6Y-",
        "J/A=f",
        "'K*+F=",
        ":p)%+",
        "#O&2$",
        "WDFR]@",
        "c%K86",
        "ZrU`e",
        "]{xSU",
        "s de un error en la instalaci",
        ";>;;;",
        "~3:>L",
        "Wc@z\"dXr?",
        "c)@1j",
        "tS8-[f-",
        "7'(_OB",
        "{.jH u",
        "ve`.z",
        "Pf+'zjY",
        "191q>",
        ")HY+=E+",
        "aju neuspe",
        "!w-q%+9",
        "EN46a",
        "P:@Yo",
        "W{z7_",
        "1y8]N",
        "VtVil",
        "*8wST",
        "r}.:o",
        "zz`w)",
        "!{3N#o",
        "vr~fm",
        "installation ne peut pas lancer le syst",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        "kUQY{",
        "qKNx)ns",
        " G*HNT",
        "?nvg>",
        "041404B0",
        "Comparing file modification times:",
        "ho umiestnenia po",
        "$$`sx,",
        "/@8$A0",
        "iwKiCG",
        "OrZ G",
        "0E)M6",
        ">(>4>@>L>X>d>p>|>",
        " asennuksen siirtovaihtoehtoa. Tietov",
        " \"OOBE\"). ",
        "rskendus v",
        "9[:b:n:",
        "A*URmt",
        "espace et r",
        "_k%=frI",
        "enju. ",
        "<.=d=z=",
        ".BKn{",
        "z@x~<",
        "-hBL ",
        "^g=ak",
        "m:{-W",
        "#ceb3&1",
        "uDFo[",
        "lF}u(",
        "tu pilnu jaunin",
        ".rsrc$01",
        ",&xbp;",
        "ix=uT",
        "r fra en netv",
        "#! NT",
        "aj#|Nd",
        "^<:g|",
        "Check for FU Reserve tag on directory: [%s]",
        "Error waiting for terminated process to exit!",
        "Rfb?$",
        "qT?D{",
        "?YVS$",
        "6'7:7U7",
        "^\"\"_)",
        "fr-CH",
        "nE-:YW",
        "q>^F7",
        "Windows vNext",
        "HsV =LH",
        "X~9Yf",
        "'4V Z",
        "`c9sv!",
        "lXt3xN",
        "ip-3e",
        "{csEN",
        "86zsD",
        "0=1M1R1X1f1v1{1",
        "^3G4eG",
        "#< M'",
        "bm{`{",
        "Xzi79",
        "q~xXv",
        "#Cd5T-dO",
        "_gR];",
        "ap{LJ",
        "'n_4bo",
        "}Y&j_6i_p",
        "WXV^-",
        "g{fdLeu",
        "F`'x.",
        "A[OmQ",
        "797D7e7",
        "Y!S;u",
        "I=-M?",
        "wc$BD",
        "t.;_W~Y",
        "9_,-^,",
        ".Zi)]",
        "3z^$vx",
        "fxr]`",
        "_Gv(8",
        "3ND9,#",
        ">\"G 1",
        "f43J&",
        ";$f9}",
        "YFynR",
        "Z<&N\",,w",
        "soVm{",
        "\",;:S",
        " celle du PC. Par exemple, si votre PC ex",
        "Example : setup.exe / auto upgrade / PBRupdate disable",
        "jKB_|`",
        "es-CU",
        "$rfqWq",
        "iEAKm",
        "sQ4+5",
        "pV_<M",
        ".?AV_AFX_DLL_MODULE_STATE@@",
        "oDCmY",
        "%k!`O",
        "ta-IN",
        "8?(xY",
        "Del mismo modo, un ingeniero de implementaci",
        "lQ6!3/E",
        "L_Wm8",
        "Switch: / installfrom <location> ",
        "$ZJl9r",
        "UA\\W(=",
        "eCFB>",
        "!bN}*_",
        "nvv)-",
        "I{%[z(",
        "][HTA",
        "P-\"YP^",
        "TSWJ#",
        "GC_.5",
        "X}~8ZY",
        "ocJ%v",
        "i a instrumentului. ",
        "V_fg.",
        "ap?4`xE",
        "~h}LpN",
        "rs, men innan den f",
        "uW0f0D0",
        "n8}-)v",
        "FDICreate",
        ">tl\\z",
        "#?uYQ",
        "?Q#tx",
        " Windows 10?",
        "  setupplatform.dll",
        "HJQj`",
        "K\"cI\\\"",
        "].8>l",
        "t#dbY",
        "/yx?}",
        "OE,JX",
        "4%Z Z",
        " cesta nebo s",
        "!r!JZ",
        "CUpdateScenarioCtrl::ShouldPreserveWorkingDir",
        "htTM /",
        "(j;-Z",
        "VmL:`c",
        "^0=)M",
        "a>[DJ",
        "kta.(Nevar",
        "J,^Cn!",
        "5jhY~<",
        "HObQd\"",
        "eNMY\"",
        "SG\"^k",
        "Fy;EY(e",
        "ZpF6E",
        "emplacement sp",
        "04_QV@",
        "w`_Q8C}",
        "L`iL,",
        "zgS/!s",
        "b.lTL",
        "9xP Z",
        "^OLL1aZ",
        "C\\z}/",
        "File [%s] does not exist for comparison",
        "W)WBJ",
        "$eP%4-",
        "TS03N",
        "ZpQY~,d(",
        "90Pkd",
        "yx^ln",
        "Prepara",
        "uz-Cyrl",
        " 2012 Microsoft Corporation. All Rights Reserved.SetupRegularVersion 1.06http://www.microsoft.com/typography/fonts/You may use this font as permitted by the EULA for the product in which this font is included to display and print content. You may only (i) embed this font in content as permitted by the embedding restrictions included in this font; and (ii) temporarily download this font to a printer or other output device to help print content.",
        "cG9d%",
        "qYY~,M",
        "Iq{P<",
        "1@{~7",
        "fYu2,",
        "LCG:~",
        "0ub{9",
        "Windows 8",
        "ide: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "ZQE>w",
        "jlokat ",
        "Microsoft JhengHei Bold",
        "-fgj3\\",
        "bS63t",
        "'{$)v",
        "SIGYD",
        "O$Tx/",
        "i''`V",
        "bQ%2L%",
        "(a.m\\",
        "8\"pr(",
        ">])4q5-",
        "A7\"q$",
        "3}hW=",
        "vatelia v",
        "Zxj|2~",
        "%*,,a",
        "ymr}:I:",
        "x1iYk",
        "3j4p4S5",
        "X$%c<f",
        "9x%'2Q<",
        " de instalare. ",
        "=%`W0",
        "NO\\Vk'",
        "AL:~&",
        ";U0- ",
        ".jS+hQK{",
        "y,7w+",
        "mzq*)",
        "Dr7'h",
        "z'{e2",
        "ENTITY",
        "2K/Y{$k/",
        "B`y0m",
        "XgFOeD>",
        "$sQf4V`",
        "Preparazione",
        "<w<vv4=",
        "fE9Z!",
        "lUN+.0",
        "cznik: / Postoobe <lokalizacja>\\setupcomplete.cmd ",
        "P!@-Mv",
        "L$ ;C8",
        "+;ya?",
        "5,Pzpxi",
        "i?hY3z",
        "OI,Hu",
        "g;w'L",
        "ciu. Pou",
        "7H\"bd",
        "velet: Ha a / PBRUpdate ",
        "}A[SH",
        "X}>'b",
        "^E7;n",
        "oeI41",
        "6FUQQ6G]G",
        "I[1R#",
        "4{bnG",
        "/Install",
        " los controladores y estos no formar",
        "9>I^N",
        "Juridisk",
        "{S;*T",
        "K{&J<(",
        "G?Xc)",
        "hJ8Q3",
        "}+1zo",
        " #'xO",
        "]A*V\"",
        "p@S{A",
        ", o vartotojai dalyvaus tik OOBE etape: ",
        "Kurulum haz",
        "ed5w[",
        "o. No entanto, quando / Telemetry estiver definido como Disable, a instala",
        "W;v3=\"",
        "%OTRy",
        "*whga",
        "2Y*3@",
        "LDLwrE",
        "zV]gr",
        "G6(t%",
        "040604B0",
        "KDA'dS<",
        "o do Windows 10",
        "SEZ~MQ",
        "StateMatch: Attempting to get InstallMode from registry...",
        "3^N`te",
        "Dy <K",
        " program Windows 10 u",
        "|vH.S",
        "wlE$kZP",
        "C[3l`",
        "et-iC",
        "vM)-7",
        "!hYW(",
        "yfBZQ",
        "r8G3f",
        "F&mt|\";w=$",
        "\\y%t{",
        "B4LcC",
        "{c53V(",
        "QZ_&RO",
        "lp)'R;",
        "<nbcS",
        "g?5]X=",
        "63787X7N8{8",
        "M!d}S",
        "4:4D4e4",
        "tk>m}",
        "<%<9<C<J<P<U<`<g<w<",
        "BKD@K",
        "/ migratealldrivers ",
        "MV8[0",
        "!1Xz<1",
        "W Az?",
        "fu:Oq",
        "kos, atsisiuntimo ir naujinim",
        "KaG`0",
        "MKn9l",
        "6,$sVu",
        ",%%b;<|",
        "PG}(DO",
        "S`<5l",
        "?ZEE[",
        "\\uwEmj",
        "H|(X?B",
        " XMLI",
        "kai perkraus kompiuter",
        "/Package %s",
        "ptr/F|",
        "0'>gf'",
        "}yL[0",
        "[Rg |",
        "s?t>8",
        "[}U7f",
        ":{+gG",
        "`C\"LjS",
        "BJrtg8",
        "8@o\"|",
        "|LbK+&",
        "mtJ/m",
        "d4O[L",
        "5-545:5?5J5T5g5",
        "n9j&;A",
        "#9^|t",
        "'%D.?",
        "cie. ",
        "GmaS^",
        "4?O3d",
        "D]%-Hu",
        "\\#/Hl5R",
        "*>XlU",
        "lCom~",
        "/irP2",
        "W'g{Q",
        "c:9F\"",
        "s'|/m4",
        "\\gyrQ",
        "Z?*w'p<y",
        "rP|LR",
        "l7H[i",
        "6N#b=I,",
        "BlueBox2.log",
        "BoxDeletePathCallback: Error during callback!  Error = 0x%X",
        "0Bj1q",
        "Cw8xM+",
        "ProgressHandlerAction FinalUpdate: 0x%X, 0x%I64X / 0x%I64X, 0x%I64X",
        "<K\"/,W",
        "'de&Z",
        "KV7uuk",
        "X5zMF",
        "DwFBVF",
        ".x#d0M",
        "kiMw_L",
        "rio local, copie novamente todos os ficheiros de instala",
        "P~Z[#Q",
        "4|#9E",
        "OsD;l!",
        "){cq3",
        "RW0~0Y0",
        "qC\"66S{a",
        "O|4_3&",
        "~JyhM",
        "s}{8!tV",
        "s k)V",
        "|*qK2",
        "M3QkJ",
        "1(2s2",
        "I%42<g",
        "sX`@`<Ae",
        "Por ejemplo: setup.exe / auto upgrade / migratealldrivers none",
        "6G[G>",
        "^<Wp+",
        "9ubGwBGg",
        "$R\\Y]zA\\U",
        "szlkW",
        "senosti so star",
        "Schalter: / auto <Migrationseinstellung> ",
        "liti: / pkey <tootev",
        "metros: ruta de acceso local o ruta de acceso de la red UNC a una carpeta que contenga archivos .inf ",
        "?x?~?",
        "czenie aktualizacji dynamicznych, zgoda na zbieranie i przekazywanie danych telemetrycznych, pomini",
        "Ke0C<5",
        "(d j(",
        "%<=P8",
        " igenom v",
        "]?iO1",
        "Cb-Gyj",
        "lMd/Y",
        "gfwCU",
        "Y's,~",
        "1]Cj=",
        "Gs;gw",
        "^@-}u",
        "s probl",
        "xGrV*",
        "M-^\\Q,$",
        "installation. Il effectue une recherche r",
        "es de usu",
        "_[4-\\[$",
        "cute dans le contexte syst",
        "k!z-D",
        "MO3X3o",
        "I/V{w",
        "]F'D]F",
        "+beY4",
        "&A=SI",
        "Example: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "BCryptHashData",
        "velet: Ha a / showoobe ",
        "tTSXX)",
        "turulmas",
        "hCi+*",
        "Q\"|eZ",
        "utav miinimumversioon on Windows XP koos hoolduspaketiga Service Pack 3.yKasutage teist, %s-bitise versiooni installiketast. Selle sisestamisel k",
        "hrt. Wechseln Sie in der Einstellungs-App zu Windows Update, um weitere Informationen zu erhalten.",
        "-:O!)%",
        "em komandrindas argumentus. Komandu uzvedn",
        ";l?j#L",
        "Handling: Inds",
        "VuT]UO",
        "L[(TG",
        "6B3qQ",
        "F#SlF",
        "ZV#mn",
        "QVM'K",
        "YWOB\\",
        "+jDBH",
        "t]?,M",
        "}4`c0",
        "8!8 M",
        "AJiD6",
        "nksG%4",
        "tKcMtoz",
        "C}y1br",
        "}0{Sp",
        "LgESh:",
        "JjRux",
        "9GiX{n",
        "^Q_q(Z",
        "n mod recursiv prin toate subfolderele loca",
        "Parametri : All; None ",
        "$gTxQ",
        "<nn8s",
        ")S.kOy",
        ". EULA ",
        "~l>7S",
        "YGCd\\",
        "}fT{H",
        "j}N%+",
        "l~{an",
        "|h~1#[E",
        "n copiar",
        "cGII!x",
        "K~F{(p.",
        "Commutateur : / migratealldrivers <param",
        "}Z}fWUYqy",
        "yQ^?%?",
        "<+1YK",
        "*H$j'",
        "EME7c",
        "h$uz@ry[c[",
        "l%wM7|@",
        "\\_V]3",
        "nda, kurulum PBR b",
        "{Ie3?",
        "I=&IL",
        "z~xB2",
        "KR#SO`",
        "vzueZ",
        "Ck~`$",
        "6_7x7H8_8g8",
        "oK0D$\"<",
        "m%x?U",
        "        loadFrom=\"%systemroot%\\system32\\wow64cpu.dll\"",
        "[XXZZYY[",
        "=KtOQ",
        ":)Y`0j",
        "Q6v~q",
        "+j1Ef",
        "UrU\\w",
        ".#Paleid",
        "rd: Automatisera installationen med migreringsalternativet f",
        "B4A@j4A@j4A",
        "*zS/!S",
        ")+OY9",
        "vn+RC",
        "?,y{r",
        "hNyi^",
        "2h6Qj",
        "Dq+Q~",
        "`_p8HF",
        "a)ID\"",
        "Bw^gQ",
        "r inte att starta Install.exe",
        "=RrTvW",
        "24H-&",
        "=NstL",
        "*0m8M",
        "TTEEYQ",
        "Alternatively, a deployment engineer may want to collect logs and other diagnostic information from test PCs in the event of a failure.The following command line instructs setup invoke the setuprollback.cmd script after an installation failure : ",
        "gyeljen r",
        "7m>eT",
        "Oh^a=",
        "0x0n0",
        "f#4uf",
        "}XJqf",
        ".wDA(",
        "|D%5M",
        "-`n>x5",
        "tor, aby po zlyhan",
        "Exiting early!",
        "M(E5s",
        "(ijb\"> E",
        "676J6^6q6",
        "oZ4.:",
        "oRMEq",
        "F<^iA",
        "Y1Q,Q",
        "Oj\\_b",
        "=\"=X=x=",
        "?J5Rh",
        "t'=H(",
        "cie z testovac",
        "<pgbgnCX",
        "QPAIy",
        "ps-AF",
        "a1a'@",
        "o.8Su",
        " systemu Windows 10, nie b",
        "e se pokrenuti zbog nedostatka instalacijskih datoteka. Ako ste prethodno pokrenuli instalaciju iz lokalnog direktorija, ponovno kopirajte sve instalacijske datoteke u direktorij i ponovno pokrenite instalaciju.",
        "e/ou o usu",
        "ranka neatnaujins ir nesukurs PBR skaidinio ",
        "se, let",
        "L0eM'1M_JC",
        "P=MiN`",
        "p{X<E;xJ",
        "ek(el",
        "(.5=-",
        "2*Y1]",
        "hXg|X7lXW",
        "doVXr",
        "UuON%Slm",
        "Wl0tn",
        "a_z#J",
        "` J5r",
        "{}eq6yN",
        "N@h?M",
        "marre pas automatiquement l",
        "%Frnf",
        "vzhr7^",
        "e z Windows 7 Enterprise. Nechce, aby se p",
        "636W6m6x6",
        "&amp;",
        "tZ:'uH]",
        "s$rKY",
        "\\0q=\\",
        "\\G8=?Eq",
        "Zb^0{iTB",
        "^^>b_(}",
        "k(dqOlC ",
        "\\\\i;3]",
        "Schalter: / quiet ",
        "n de los medios o archivos de instalaci",
        "V:U#Y",
        "j1pnm",
        "da, vai uzst",
        "%s: Setup mode is install - assume we are not resuming.",
        "Po@f&",
        "14t>mch;",
        "#jEUVc",
        "*b|WM",
        "W{_~zw",
        ".X$^P",
        "GetSystemTimeAsFileTime",
        "'= z$",
        "f!r=\\67",
        "Y-Z x",
        "NxZDEs",
        "avoir s",
        ";L?u5",
        "!9Tb2",
        ",l?q0",
        "/Quiet %s",
        ".eF\"HB",
        "%5os&",
        "]0]kK<",
        "O$d&3",
        "8#lRk",
        "n de PBR . ",
        "S!g<|N",
        "4IKXY\\+",
        "h80AC",
        "%UHI'",
        "=Wybrana architektura nie jest zgodna z architektur",
        "GL>m(",
        "U~)}v~K\"T",
        "},gw7",
        "vIj 5",
        "ytkownicy ko",
        "idla. Naopak, ak je prep",
        " registos comprimidos para a localiza",
        "]#R>&",
        "CopySid",
        "-(k$/x",
        "RZOE=",
        ">jt~\\",
        "F~+'V$",
        "Cp#kF",
        "Y5DH3",
        " la bonne architecture.6Un probl",
        "s<q:G",
        " configura",
        "[\\UdI",
        "B I%1",
        "gXEKg",
        "rer i systemkonteksten, s",
        "H,^-H)",
        "rut o problem",
        "8Y)o6;",
        "~>p_8sG",
        "|/vo0",
        "_XC/6",
        ".x*a\"S",
        "ZKYw{",
        "kwMS6",
        "SetFileTime",
        "VUWUW",
        "Ij%5;",
        "9A;H;",
        "Configura",
        "g#M7O",
        "i+rIz}m",
        "c!(r4",
        "HUOMAUTUS: t",
        "u^[Nf",
        "YwJ[{",
        "hQG'iK",
        "f\"W!+",
        "&R[)T",
        " Instalatora systemu Windows z powodu braku plik",
        "+xNF_/1",
        "B<g]M!",
        " instalace a p",
        "*9ExYy",
        "a7{7{",
        "b~'#\\",
        "N,Qva",
        "IL -vbK",
        "X;Xp3.*/",
        "g1iC0M",
        "metros: Full; None ",
        "%Preparando para instalar o Windows 10",
        ".twpA",
        ".'*S=U;}",
        "N)oIE",
        "ruje alebo nahr",
        "b%'hI",
        "X:h(E",
        "uy9w<ut9w@uo9wDujQ",
        "Doorgaan vanaf waar ik ben opgehouden",
        ": / )",
        "Na primer: setup.exe / auto upgrade / quiet",
        "LN+MN",
        "rcare",
        "Gz\\Cz",
        "<Zp@\"",
        "*Q 5MD",
        "x8?Hb",
        "apljuS\\",
        "frF*#",
        "E;+ .Qo",
        "\"V\\aao",
        "0W0f0D0~0Y0",
        "r-n#'",
        "hc{M*",
        "voor het geval dat er iets fout gaat. Met de volgende opdrachtregel kunt u ervoor zorgen dat Setup",
        "{sfwq",
        "Pripremamo nekoliko stvari",
        "kFGMk",
        "zh-MO",
        "[<n:Q",
        "nost prikupljanja telemetrije i preuzimanja, OOBE se preska",
        "tirir.Setuprolback.cmd, y",
        "\\Woz#",
        "gOCqz",
        "T91r,",
        "=lE,/fi",
        "|U|<n",
        "x>!]W",
        "p_|A~2@",
        "#LH<C\\",
        "Spusti",
        " Microsoft Corporation. Sva prava pridr",
        " nytt.fHvis du installerer denne versjonen av Windows 10, kan du ikke g",
        "{2<}HP",
        "{8M7,",
        "DhW1d:",
        "xG}q_",
        "1(<!1*.",
        "DeleteFileEx: Unable to delete [%s]; GLE = 0x%x",
        "b:~TS",
        "mEYSfr",
        "'^*EF",
        "O!|b\\",
        "CSetupLangIniLoader::Initialize: Set default install language = %s.",
        "CopyDirectoryDirCallback: The copy was canceled by the user.",
        " impostata su Full, l'utente finale deve eseguire la Configurazione guidata in modo interattivo. Al contrario, quando / showoobe ",
        "IvH*U",
        "(O<2C",
        "9E?Ve",
        "r3:x$@_",
        "E9Cqo",
        "w$fkFxv",
        " diegimo disk",
        " oli ongelma",
        ";,$'n",
        "C>8G*x",
        "A\\|qr",
        "GKK%=",
        "ytkownika no",
        "Vs5e\\",
        ")3!w!",
        "[\"q1#?n",
        "2?2U2b2",
        "'oecy",
        "-+q&|m`",
        "kGg[l",
        "n de la UX ",
        "OOBE (Out Of Box Experience) ",
        "!?zF|",
        "N\\6!E",
        "teva lucruri",
        "Scenarijumi pagr",
        ";53st)F",
        " Windows vNext",
        "q,JRn9",
        "G^T]s",
        "setuprolback.cmd",
        "+<,mx#",
        "HIPy<",
        "TRANSPORT",
        "mu Windows sa ned",
        "iau paleidote s",
        "0aFs`",
        "8c\\6n",
        "+veP@[",
        "3F:[U",
        ".p4q?",
        "KU8.iBLW",
        "9-R'ou*$",
        "{+u}:",
        "L\\kAAy",
        "B~BY\"",
        "StopTraceW",
        "QctG{~4",
        "SX]_aQ",
        "Lg ;M@c",
        "*?Fw~ih",
        "[W]qt[l",
        "(kn0|",
        ")JtVS",
        "Q18'|z",
        "Exemple : setup.exe / auto upgrade",
        "P9&p5",
        "gt die Datei ",
        "W,VKJ",
        "All, probeert Setup om alle stuurprogramma",
        "R.1,=",
        "-a0nW.",
        "mZPL^",
        "[/XN{",
        "9\"lyg",
        "6T7;8U8",
        "]XEZ:",
        "T&;'??",
        " falta de arquivos de instala",
        "5zGu6a",
        "{)pu>('o\"",
        "yXfsj",
        "FRs2?",
        "asno prekinitev delovanja omre",
        " nem friss",
        "R>)Dj--",
        "8OTHml",
        "5)N~.",
        "S,R5?",
        "FGQeY",
        "Usa el otro disco de instalaci",
        "d~>-K",
        "}}\\TU",
        "nO)*(f",
        "Ae{[>",
        "B\\\"<J",
        "Eylem : Y",
        "U>;Jc7",
        "S%pQ ",
        "+]x/>",
        "Sistem de operare Microsoft",
        "_ZlFTZl",
        ",_Vy=e",
        "HJ`g[",
        "Q6Tq0",
        "=K :n1",
        "_RA\"r",
        "~jD|f",
        "UnPK5",
        "Lu\"`.",
        "`6\\5R|",
        "z4[entJ+",
        "Setup.exe, Windows y",
        ".?AV?$CMoReserveManagerT@V?$CUnknownImpl@UIUnknown@@@@@@",
        "!cd-YG",
        "l*yLh",
        "2'>>~Q",
        "~HC}:",
        "676N6",
        "`O\\/3",
        "ana, uporabnik pa se ",
        "Bl2Zj",
        "GB6z5",
        "/aAgp",
        "Global\\Microsoft.Windows.Setup",
        "H5(#z",
        " jako %sbitov",
        "        loadFrom=\"%systemroot%\\system32\\msvcp_win.dll\"",
        "'Za}Q$",
        "n de red y que puede sufrir interrupciones de red intermitentes. Vuelve a ejecutar el programa de instalaci",
        "F8*f4",
        "RitJkj",
        ":kINe,",
        "B4`:s",
        "Ya<mU",
        "I&!`HF",
        "x%n_m#",
        "8:+YlvAv",
        "VlCZ}",
        "9?8p\\>7Nh",
        "U\\Xdpt",
        "1 J&D;",
        ",@wS4o",
        "-ei}-",
        "=q%Z93<",
        "2={\\&",
        "LsdWm93",
        "SetupHost result missing... remapping [0x%x] to MOSETUP_E_PROCESS_CRASHED.",
        "4wjrW}",
        "ar desde o in",
        "?=$O\\J",
        "7R+3?0",
        ";9;?;T;Z;_;k;",
        "Q@,3R",
        "=5=f=",
        "-B}f!",
        "ini ve aral",
        "Wy+Hs",
        "Q_UW]R",
        "'4o0!",
        "m>)] ",
        "nyen. Az al",
        "!<7Cd#",
        "o@NhW",
        "qFH^IUK",
        "n de nuevo desde",
        "yj|GZ",
        "Valitsin: / quiet ",
        "o~Fdo3",
        ".$_Xl",
        "~w*Mue",
        "o|X,o.",
        "&NrNn",
        "e$vQ,",
        "Dejanje: z izbrano selitvijo avtomatizirate namestitev. Zasloni z uporabni",
        "v@9g?",
        "e zagnati, ",
        "kVe1U",
        "5W_ou",
        ".br^ cy",
        "g(lh6",
        " |kl-",
        "R]4TU",
        "_jBf|~",
        "25]NH}",
        "_Q#'@e",
        "L)nGT",
        "f<],P",
        "V\\$(n",
        "z\"{WYG8%",
        "u](tu",
        "\"\").I*",
        "*bZB=",
        "MgcGk",
        "b d'<0",
        ",@88LIh",
        "gXuDZ_",
        "Rd(Pb",
        "~)layR",
        "[!W|I5",
        "rqTymH",
        ".Uv><",
        "H'XGn6",
        "sv/$a",
        "ajte ponovno pokrenuti program za instalaciju sustava Windows 10.",
        "Commutateur: / copylogs <location> ",
        "\\efbu",
        ":$:<:_:m:",
        " parametrai. ",
        "t no lok",
        "6>z|+",
        "9_9o9t9z9",
        "Parametri: percorsi di file locali e percorsi di rete UNC ",
        "ipravuje se instalace Windows 10.",
        "BvvTiu",
        "i^5O~",
        "00Hq-",
        "https://go.microsoft.com/fwlink/?LinkId=530046",
        "jI/W$",
        "}9&wk",
        "h>wVfc",
        "^49&Vj}",
        "_,)+}",
        "HKh*\"",
        "o: o sinalizador de silencioso",
        ")F*%:o",
        "Parametreler : Bir specific.wim i",
        "v%QGY",
        "5_9WD",
        ", krajnji korisnik mora interaktivno da dovr",
        "Nastavi od mesta gde sam stao",
        "@${S#",
        "hN*wNS",
        "s uma falha na instala",
        "HQ(`!",
        "\"gj;1",
        ":%t6z",
        "}2z+L",
        "6\\[R1",
        "Lb8\\r",
        "yuO/E)",
        "Av&bryt",
        "WRjUZ",
        " yerle",
        "m,8[R",
        "<w>Rgd",
        "3FfcU",
        "L:O1#R_",
        "6\"68V%",
        " sluttbrukeren fullf",
        "@>A@M",
        "L9afd8u;d",
        ")@2-F",
        "r'y@p(",
        "j0W0 ",
        "hy-AM",
        "|pf|p*_",
        "?*^y4",
        "zZBMV",
        "%^Kmt",
        "x_| >",
        "@C-.X!a",
        "\\!:[_",
        "!;?Y_s",
        "F.gv9F",
        "/2LflK",
        "7\\{ju",
        "o legada1A Configura",
        "X'}Hs",
        "s atjaunin",
        "eD=;6",
        "]\\5)S*",
        "\\/Z<c",
        "{VhKt",
        "|i5W)",
        "@z4i_\\h",
        "$Kk~3",
        "$<Nh+|",
        "~*J:%E7",
        "Af`V(",
        "EF##D/",
        "Z3OxyE",
        ",SVW3",
        ".xdata$x",
        "e da pokrene datoteku Install.exe",
        "D[u;4",
        "lzQO5",
        "e. Ce param",
        "mq',-",
        "3T;%c5jG",
        "@*MEcv*",
        "[3rZ~",
        "Switch: / installdrivers <location> ",
        "DrZh$Yv",
        "U3zB(;",
        "v;^?Y",
        "N+'x&",
        "m9\\AE",
        "#f!f#",
        "lOSp#]x",
        "ncC87]",
        "i din nou instalarea dintr-o fereastr",
        "?i[pz^q",
        "Error lowering priority for Azure Host scenario, Error = 0x%X",
        "IYObY",
        "7poQ]",
        "!4z8i",
        "@j3Q8",
        "rio e volte a iniciar a Configura",
        "*ha>\"P",
        "V:S]]m",
        "Radnja: Ako je / PBRUpdate postavljen na ",
        "c=qcy4",
        "2tjZX",
        "Instalator systemu Windows 10",
        "q]MJp",
        "'0fB=",
        "53-M3",
        "~2n\"!&;",
        "U'VYV",
        "?eY>9",
        "G&M<>",
        "GWindows ",
        "Primer: setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "/C~ZT{",
        "U_GEW",
        "'tRb4@",
        "liti: / showoobe <parameeter> ",
        ": :(:4:T:\\:d:p:",
        "B7\"y8,R",
        "oXV>Gx",
        "I:,O+",
        "ProgressHandlerAction: Skipping progress for uninitialized action [%d].",
        "dkD$X#",
        ">zD{3m",
        "environnement de test. Il ne doit pas ",
        "0W0D0g0Y0K0?",
        "Va+&o.",
        "o novamente a partir de uma janela da Linha de Comandos",
        "M&:ND@y",
        "N;>?r",
        " lanc",
        "kUI7!",
        "F-H#P",
        "o especificada. ",
        "chargement et installation des mises ",
        "2mF}Sc",
        "}Cm|W",
        " sijainnista l",
        "\"Zyc,",
        "^bC[$",
        "VqZq7",
        "8 8$8(8,8084888<8@8P8X8\\8t8",
        "rUninstallSourceVersion",
        "8`'2 ",
        "{*'={2",
        "S \"]J",
        "5*g~/",
        "F(;vE",
        "ql+ZJ",
        ".text$x",
        ",|hN.N;",
        "4+4a4k4",
        "$lV(H",
        "K^rEy",
        "L7IK?",
        "HMRVT",
        "hc4a1rw",
        "Ym&!ju|",
        "l5O%|",
        "yw!oYG",
        "JvT@-",
        "hNC L",
        "DeletePath: [%s] doesn't exist as a directory; nothing to delete.",
        "7!+m|",
        "w!wa A",
        "9XDY:",
        "r-k3:Fx#Iu",
        "eka|9",
        "1ruWUOQ",
        "*Pm~'",
        "4$%9]\"G",
        "< J^d",
        "hXO[]",
        "!c?_6_",
        "*NsBW",
        "7JCs#",
        "ji1qy",
        "Example : setup.exe / auto upgrade / showoobe full",
        "/zxT~.",
        "rberedelser",
        "83{]E",
        "CSKR_",
        "[v|S^",
        "w-5^m",
        "shez ",
        "khhAx'.pj",
        "W\\W)?",
        "Switch: / migratealldrivers <parameter> ",
        "3IZm0",
        "rio local, copie todos os arquivos de instala",
        "!>;{z",
        "VarFileInfo",
        "(lXEh",
        "u\\\\BP",
        " t6Zi",
        "SkhoS",
        "r1vq-",
        "Dd=s^",
        "A[C4`j",
        "*j,Ze4",
        "#O1a1tyq",
        "zt'z?}",
        "ver installasjonsprogrammet ",
        "IDATx",
        " vhodn",
        "L<yyT",
        "h/ne:",
        "metro> ",
        "ca-ES-valencia",
        "s seguro de que quieres salir?&",
        ")dA{1",
        "re installasjonsprogrammet. Frigj",
        ":h5z[K",
        "Tm7]U:$",
        "_\"9y\"",
        "pK +-",
        "sobu migr",
        "hAm>DO",
        "+2[GU.H",
        "DP*hp",
        "`*IBu",
        "cJZ:x",
        "8D7'U",
        "TgSwv@",
        "eF kq",
        "v2.>f3",
        "GBk@7",
        "B~s>w",
        "%mN@V",
        "j1[-C",
        "`()*|$",
        "x\"E:+",
        "3#3B3H3",
        "]@\\e#",
        "{R+U_",
        "{t9]Z",
        "        loadFrom=\"%systemroot%\\system32\\cabinet.dll\"",
        "&\"Tn+Bkx",
        "Na primer: setup.exe / auto upgrade / PBRupdate disable",
        ")&*2:",
        "_exit",
        ")`a?4g",
        "pIaI:",
        "=K^N_",
        "sFL{Q",
        "y5u}0",
        "Use o outro disco de instala",
        "kHej0",
        " 350 MB voln",
        "riista 64-bitist versiooni. Proovige t",
        "O>%v{",
        "jR^]'",
        "Beispiel: setup.exe / auto upgrade / Telemetry enable",
        "5k[!^",
        "lne. ",
        "f}vpN9",
        ": setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "lckyO^",
        "}.AjaS",
        " necessario per l'aggiornamento con un supporto per contratti multilicenza o un supporto che contiene un file pid.txt nella cartella Sources. ",
        "042604B0",
        "PjK;Hv_",
        "'R\"@Jg.%",
        "s.yOzK",
        "r Windows 10 igen.",
        "%s: Found previously stored file hash.",
        "@b-'a",
        "h'01|;&!",
        "!$bo+",
        "v~a@o",
        "hFIL2",
        "$i6R[\\",
        "IT++Gd",
        "GsK[r",
        "lQ^F`",
        ">P7vz",
        "programok",
        "ias teises kaip vartotojas arba procesas, kuris paleido s",
        "8Qu=]",
        "b>3#Y",
        ": / installdrivers <um",
        "*X~B@Ek",
        "^wpVp",
        "#|GpbZ^",
        "GW?OcHnd",
        "H~+vH",
        "Akcija : kada je / Telemetry postavljena kao mogu",
        "2^{b6",
        "hqw 0=",
        "3hp3R",
        "{l$M_",
        ">Xv5K",
        "en-HK",
        "7.p\\}",
        ")4)xE",
        "V;g*z~!",
        "=\"=7=?=I=Y=b=}=",
        "pppppp",
        "_L-kK-oE",
        "a 8Hf",
        "S}w@k~",
        "];G[;",
        "6WQTu",
        "&esNnU",
        "S$FLY",
        "fh<V9",
        "tNPuN",
        " instalaci a po obnoven",
        "n etkile",
        "?NMjxb_",
        "klemeyi otomatik hale getir. Ortam kurulumu kullan",
        "_,qXK",
        "?v<^c!",
        "L*}_\"3",
        ": setupcomplete.cmd ",
        "Reset: Error serializing state!  [0x%x]",
        ":/*Y ",
        "iaki)2",
        "{4!Wf",
        "E6BJ6",
        "Azione: consente di automatizzare l'installazione scegliendo un'opzione di migrazione per l'installazione. L'interfaccia utente del programma di installazione da supporto e le schermate dello stato vengono visualizzate per impostazione predefinita, ma sono automatizzate. Questa opzione implica inoltre le configurazioni predefinite seguenti: accettazione del contratto di licenza con l'utente finale, abilitazione di Aggiornamento dinamico, consenso esplicito per la raccolta e il caricamento dei dati di telemetria, esclusione di Configurazione guidata, aggiornamento o creazione di PBR. ",
        "\"ksa.)g4",
        "5[Z>#|",
        "S&nr-7e",
        "::Bf8",
        "?=,[%9",
        "F5\"UM8",
        "s informaci",
        "?;2Z'MY?2:t",
        "~:U>+",
        "8Qs!Q.",
        "q+q(J",
        "kVlvp",
        " celle de votre PC. Par exemple, si votre PC ex",
        "ca?-c$gn",
        "_a8#2",
        " versiune de Windows 10, nu ve",
        ", e5i",
        ":v op",
        "q,fiHjDr",
        "WZ|QV^",
        "l45^A#",
        "E-[8.",
        "yg;#m",
        "daQ]1",
        "(Y+<=x",
        "klK_:",
        "jDm$A",
        "<ZMu|#",
        "Instalacija izdanja Windows 10 ne dobija argumente komandne linije. Na komandnoj liniji pokrenite ",
        "3FdK#!I",
        "o0]Ri\"",
        "revler ger",
        "pFr3e$e",
        "q-R@\\u",
        "8CJe,",
        "D-kmt",
        "2XjOGwa",
        "g,b{o !/",
        "1n 8HF",
        "s .inf, rastus nurodytoje vietoje. S",
        "?BeB K__nC-t",
        "O)|<'",
        "+Vd0{",
        "Rs8NQ",
        "mLpxp",
        "/w&aX",
        "!r\\l['",
        "]$cB*&L",
        "A=w%$",
        "riist uuesti k",
        "V_0y:*",
        "rder n",
        "r<@9[",
        "io@!27",
        "I=L7-",
        "H{B;N",
        ";Qr1VH4ut",
        "^A;t ",
        ">Gp)u",
        " ;QhB",
        "o computador automaticamente",
        "Xw'.r",
        "_M</N",
        "chec. La ligne de commande suivante demande au programme d",
        "_Bsfw4",
        "Por ejemplo: setup.exe / auto upgrade DynamicUpdate disable",
        "D,5X!",
        "#`u5u",
        "9~ltFSWW",
        "%C~nv",
        "R\"bt=",
        "Aktion: W",
        "6E+ka",
        "};r/\"",
        "%dM\"O^",
        "g~qo3",
        "YD!x7",
        " jour ni ne cr",
        "1!J\"$",
        ":gOt%",
        "5%5:5N5U5c5",
        "%04d-%02d-%02d %02d:%02d:%02d",
        "gios do utilizador ou do processo que lan",
        "\"u\\*m",
        "!V>#?",
        "=Windows 10 ",
        "G)(NRH",
        "TqD4_",
        "pC\\w@,o",
        "+.}b()",
        "dia/arquivos de origem ",
        "D<'|a",
        " 9^=M",
        "YekZ]",
        " la cr",
        "D65TB",
        ">0c9g",
        " povolenia pou",
        "diLPO",
        "wD.xzn>",
        "iuW\"B",
        "K(}(c({<",
        " do um",
        "\\$y2Px",
        "x~TFQ",
        "Vs]XIz",
        "fr-HT",
        "n!|/n,~",
        "dia na pevnom disku",
        "tN~:2",
        "iqLcmz",
        "s5sYx>",
        "ejpX8",
        ",jc?N\"w",
        "INkgsd",
        "cpAl{j",
        "WT|T-y",
        "au moins 350 Mo d",
        "]Zt%u",
        "sIR}\"p",
        "e)7;I",
        "Parametrit: paikallinen tiedostopolku tai UNC-verkkopolku kansioon, joka sis",
        "Pasirengti diegti ",
        "nhxq/",
        "_/@*6",
        "ave. Zaprite orodje, znova za",
        "\\n>Oq",
        "E[R4D",
        "6'zO0",
        "&_>2_~",
        "ic;ka",
        "vvO{ 4F",
        "kt3Installasjonsprogrammet kan ikke starte Install.exe",
        "i>}ZI",
        "AI[etv",
        "042504B0",
        "\\Vw|n",
        "EfSd9N",
        "GetTraceLoggerHandle",
        ",FnG=",
        "`#@hp",
        "v|?3j]",
        "yZxT\"|",
        "eF3B~",
        "2*P7p",
        "Priprema",
        "@+l[A~",
        "sa, dinamikus friss",
        "jlhL<",
        "(bd0+eUPo",
        " : / quiet ",
        ")cGd}",
        "JuQek",
        "ebujeme aspo",
        "jr6,R",
        "szF7=/5",
        "9i<dM",
        "&E\\>!/[",
        "Washington1",
        ".,Jc2",
        "3Bh>H6/q",
        "qKE<8",
        "1pF-)",
        "o Din",
        "<65p 9",
        "' d[H",
        "|_:qK2",
        "8fYheq",
        "<M<`<",
        "2q_,g",
        "6J*pZ",
        "^a}EWJ",
        "W]l~^6",
        "2oYq1",
        "b<PV(",
        "A2\"H>",
        "ZB}!B",
        "G[Tq/i!",
        "h3Te3",
        "E}8 D",
        "6+6Z6t6",
        "iC'z1",
        "O.y+1)Ie",
        "?NL$L",
        "|C1vGq",
        "4vW2v",
        "~p)]y",
        ":NA58",
        "\\uW@\"n",
        "\"{}'}?",
        "N x~L",
        "ci w trybie OOBE. Aby wykona",
        "67&y^",
        "i-1L#",
        "0#/k@",
        "?0Ste pripraven",
        "d\\Og0M0",
        "Azione: se l'opzione / PBRUpdate ",
        "#8Qfc",
        "cF7 r",
        "GH=/[",
        "]{?af",
        "](?\"m",
        "uM;tM",
        "e informacija.",
        "GZ_-6",
        "O1[0fZ",
        "vNF\\O",
        "786Y`",
        "26Pjs",
        "MDinK",
        "<]JxJ",
        "k,IA,R'",
        "*P_,@",
        "4(5^5",
        "HujqD",
        "$sC`J",
        "installation avec un choix de migration pour l",
        "lteni az Install.exe f",
        "!lux.",
        "o tentar",
        "gDWM0O|!",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "m?OH7",
        "Stikalo: / showoobe <parameter> ",
        "$UcHHZ",
        "%wfEo",
        "0,`o?",
        "1K\\bD",
        "#_&_#",
        "Priprema instalacije ",
        "FE4dc58M'",
        "RW0_0",
        "Cleaning install folder...",
        "hZD~m",
        "u\\Ba6",
        ":7,CnM",
        "enje zasnovano na scenariju ",
        "J0?PuK",
        "<7<Q<^<y<",
        "TkrIh",
        "=NpaW",
        "'GmG#",
        "5(6/6D6O7`7e7k7",
        "bits. Une fois le disque ins",
        "(\\YJ~/",
        "yfT /",
        "%13Z#",
        "qr}R4m",
        ".q@[]",
        ">/|ou7x",
        "OTrK|4",
        "fnCsl",
        "2?nVm",
        "System operacyjny Microsoft",
        "\\JWwAm",
        "w1O:L",
        "nomeado setuprollback.cmd ",
        "Ejemplo: setup.exe / auto upgrade / noreboot",
        "Q%lXC",
        "Gh={:",
        "4{Kce",
        "Eao]syF",
        "y#I+N",
        "ev}D:7",
        "Ex(lA",
        "cia aktualiz",
        "urirati ili kreirati PBR particiju. Nasuprot tome, ako je / PBRUpdate postavljen na ",
        "RtlRaiseStatus",
        "0?k$A0",
        "hL4.!",
        ";?s%^g8e",
        "n Configuraci",
        "zy))=",
        "h03fT",
        "Por ejemplo: setup.exe / auto upgrade / postrollback \\MyShare\\script\\setuprollback.cmd",
        "6cba*",
        "9 9^9j9",
        "H.&_G",
        "qd=#VC",
        "Notiek %d%% sagatavo",
        "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;",
        ".{-/yWT-",
        "0[dbT",
        "ne poti UNC ",
        "Kp@~g}",
        " 6OLN&",
        "ba: k",
        "+;N#y",
        "FDlQG",
        ">Qf^b5",
        "?E7$$",
        "`ow>'iW",
        "Zu_y~",
        "OHb}l",
        "!KMq0'",
        "Z([ks",
        "m pou",
        "Mz:`sw",
        "PostThreadMessageW",
        "n6gO#",
        "SearchPathW",
        " vai jaunina sist",
        "vS5W}",
        "3x!|3}",
        "K>DKfi%E",
        "CAzureScenarioCtrl::ShouldPreserveWorkingDir",
        "ol9h|-",
        "P?icGx",
        "-_[zd",
        "&R.Am",
        "!-jnx-Ky",
        "%h49B",
        "cT%is",
        "^Wu5V",
        "+`ZP&",
        "(K+inN1c",
        "xmG&F",
        " kompatibilitu",
        "bZoWL",
        "++6<^+'",
        "@fZT ",
        ":lR;t",
        " dh-{",
        "iO'4a6",
        "{4dO%",
        "q~ak~",
        "\\Mr%%",
        "=#=P=[=",
        "d1k U",
        "tre lanc",
        "nama ortamlar",
        "888I(",
        "kla vietas notiek un, iesp",
        "velet: ",
        "2(3@3",
        "xX%*z",
        "muWU?",
        "3;;?//*ZZ",
        "EJ\"rh",
        "J.*v6",
        "K9fZy",
        "mQ|N6",
        "p=,:I",
        "d =6Dnl",
        "xn]OI",
        "l5F48",
        " izdelka. Tega parametra ni treba uporabiti, ",
        "NcQxE",
        "Me-Y8",
        "G37F,4",
        " in esecuzione da un percorso di rete e potrebbe essersi verificata un'interruzione di rete intermittente. Riprova a eseguire l'installazione.",
        ">hixF",
        "PghF[",
        "5b#|$",
        "1&r|p",
        "m Microsoft",
        "<V>#y",
        "rddisken{Installationsprogrammet startades inte korrekt. Starta om datorn och k",
        ">T#xD",
        "<|cCmd",
        "E\\-oq",
        "TRmpfw1",
        "mu, nemus",
        "`\"4)!B",
        "QuWE<ui",
        "?$=U4Ow\"",
        "FM8H#",
        "Lgket@",
        "s _?C",
        "AuR&/",
        "liti: / installdrivers <asukoht> ",
        " instal",
        "PPPPh",
        "FoFyo",
        "Commutateur: / pkey <cl",
        "N.-sw",
        "Enumeration of hive list failed. Error: 0x%08X",
        "$>\"?P ",
        "%c}[+",
        "H+w@.",
        "a@xt5",
        "|G~ ?",
        "}W\"7,",
        "';r5j",
        ")-Ti-",
        "<8<d<",
        ">1>Q>^>",
        "{h4U\\",
        "g/|[C1",
        " possibile usare la riga di comando seguente per orchestrare l'aggiornamento completo a Windows vNext, richiedendo l'input dell'utente solo quando si raggiunge la fase della Configurazione guidata: ",
        "{/8/Q",
        "B]^2tZwVDsS",
        "%m cn",
        "[Hs'%",
        "g<t~f ",
        "\\F.'W",
        "6nDUW",
        "LtAX^",
        "KrM=D",
        "}Fy:(",
        "K<i3Z",
        "\"rnm(2",
        "swo+L",
        "uZM2z:3",
        ", hogy megjelenjen a telep",
        "Comutator: / installdrivers <loca",
        "ri pentru mai multe informa",
        "?FML3",
        "F%%!2",
        "U)A6Jw",
        "MhZ=g",
        "_\",DC",
        " =Gg)",
        "{R~s9",
        ")kXg[",
        "r@}2|y",
        "jHyQy",
        "eio8&V",
        "Z&VQB",
        "FFJa&",
        "&Anuluj",
        "5/P.L",
        "O7571g5b",
        "5\"545N5[5g5",
        "Yb%^0\\",
        "#M{B#",
        "mos que a instala",
        "^((\\f",
        "\\8\"|c",
        "Dc=Yk",
        "1<fZh",
        "2tm/T",
        "qh7rL!",
        "n0zPbF",
        "IhVV&",
        "2VYbV",
        "m:;/e",
        "If~^\"",
        "rodowiskach testowych. Nie nale",
        "eh}0+",
        "pav|*r",
        "OJr=#=",
        ",Z`<4",
        "I-V@JQ",
        "Conmutador: / DynamicUpdate <parameter> ",
        "]QHE]",
        "hM-=G",
        "n conocida como OOBE). La siguiente l",
        "Locale",
        "a`bp^",
        "c#GGz",
        "\"YFG5(|",
        "K)Q;*",
        "zcx@i",
        "urirati ili instalirati PBR particiju. Isto tako, kada je / PBRUpdate postaljen kao onemogu",
        "-h|\\g",
        "$Cm@U",
        "H{7w3",
        " 5s$4Sb",
        "(C^9,",
        "^WAj!",
        "YtQ]#]",
        "4p0/}P",
        "Setup.exe instaleaz",
        "i|+i6",
        "Ca>>V",
        "GjG`|",
        "=)rnR",
        "3*%,V(",
        "CWebScenarioCtrl::PopulateWorkingDir",
        "CDlpTask::Suspend",
        "/G1\\n",
        "stemi penceresinden Kurulum",
        "37& n",
        "n de 64 bits de Windows, deber",
        "Ladda ned",
        "1.Scy",
        "YqL`V",
        ",7G^8",
        "p[0iF",
        "5Q+ok@",
        "gVVMvE",
        ")!WCGiL.\\}",
        "vzJ$2",
        "P/Ew?",
        "CSetupLangIniLoader::Initialize: Set default UI language = %s.",
        "@UR2.",
        "2 2%202A2U2g2n2t2y2",
        "^7FoJ+",
        "z|)#i",
        "k?k/o",
        "2_I^S",
        "@v[mp",
        "UfN#v",
        "|Ra#tR",
        "v[kP@Lo",
        " grunn av manglende installasjonsfiler. Hvis du tidligere har startet installasjonsprogrammet fra en lokal mappe, kopierer du alle installasjonsfilene til mappen igjen og starter installasjonsprogrammet p",
        "2Gk5&Z",
        "e&3q3xh",
        "KM(gO",
        " je me suis arr",
        "6B7rM",
        "q?I&+q",
        "F0C;X",
        "enje, preuzimanje i instaliranje a",
        "Z}Z3V&,8/",
        "WYB84",
        "couvert que l",
        "/PyaF^",
        "'_;@o\\",
        "s\"/hr",
        "P+j*g",
        "Wq{o\"",
        "nOonx",
        "#ZD\"EZ",
        "-|GPM8O",
        "uHNMe",
        "PvR+G",
        "?5va\\",
        "1(*4>N",
        "P##%[",
        "1hy=e",
        "[du#k",
        "ce zdrojov",
        "terek: All; None ",
        "*G)Bk",
        "A<R d4",
        "rer. En funktionsopdatering kan v",
        "Esimerkki: setup.exe / auto upgrade / migratealldrivers none",
        "l9Sj9",
        "BSwH$",
        " el OOBE, se actualizar",
        "=N-RE",
        "YGc8p",
        ";g9T%",
        "}?ByT",
        "installation effectue les op",
        "r`>5l",
        "ntTK`",
        " proizvoda pogramu za instalaciji. Ovaj parametar nije potreban kada se nadogra",
        "?3+6q",
        "Klargj",
        "p}GQ}_",
        "\"S^\\9xZ",
        "*8+*q",
        "rstegangsoplevelsen) manuelt. F",
        "Qg!SYyF",
        "Gni'4Q",
        "ux*b}",
        "d7N)+7$",
        "iPH|Hx",
        "r-u(n",
        "xi\"q].",
        "g!|D3",
        "?/ab[",
        "/h^&a",
        "/o#8oLr_",
        "I3{9QN",
        "anas instance. Iesp",
        ".?AVCPackageScenarioCtrl@@",
        "[_0W|9y",
        "?fF+Lt/",
        "$` SE",
        "wf$,ED",
        "Please visit: %1!s!",
        "rile implicite. ",
        "%s3|]",
        "8 Ld4",
        "quz-BO",
        "do arquivo local ou caminho da rede UNC para uma pasta que contenha arquivos .inf ",
        "zRGqTX",
        "-\\c?)",
        "mQ$u$",
        "Wj[kY",
        "2 2$2(2,202D2H2`2d2|2",
        "bS04Nv",
        "[c_`fW",
        "ryVk9",
        "zGtDb",
        "Z`q]F",
        "imalus. Juurutusinsener soovib koguda t",
        "?^9XR",
        "K$J5t",
        "5T[4.",
        "ibxRL",
        ",?6T#O%",
        "rT]kJ",
        "Q1(0 ",
        "@Oj5p",
        "Jjpe+K",
        "p69Gq",
        "klerseniz %1!s! s",
        "Bg9n:",
        "]gr5E",
        "m#TP[",
        "/\"n;c",
        "J,x]j",
        "-E<u&(",
        "\"l9vg|",
        "?u%`M",
        "The architecture you selected doesn",
        "&Aem7",
        "%cf+'g",
        ":)}31",
        "(PE*3",
        "PG'w}&",
        " migrar todos os drivers como parte da instala",
        "%\\cW3",
        "RKT2\\",
        "b7ZvQ",
        "fwYNZn",
        "rbV,,K`v",
        "Btg=)",
        "d#\"oyG",
        "[;KcJ;",
        "]$4#{",
        "!Vf9|",
        "6GRr7",
        "3f2>a",
        ".Py<4",
        "BCTD'",
        "83p9up@",
        "LI.wU",
        "\\aWa\"",
        "R-h>(",
        "enjer za implementaciju mo",
        "Fkd8;",
        "t;4O$",
        "j+Xf;",
        "uYDF'",
        "dm#*V:",
        "%%}CW",
        "!*i/-s",
        "]mAUww",
        "r det udf",
        "rs: setup.exe / auto upgrade / migratealldrivers none",
        "V eFv",
        ">=&ZZ",
        "%u`1{t",
        "l'Z^OI",
        ">+z/=",
        "ICRx:",
        "&oV+|",
        "N?.4Bk9=",
        "nd-)\\",
        "uY[RSR",
        "}#:[_",
        "5aC1@7",
        "SG?g?",
        "OqawyD",
        "`>w&.",
        "5'6b6",
        "res som en del av installasjonen. ",
        "lC(o;",
        "^H|<2",
        "enoj lokaciji u toku procesa instalacije. Instalacija povratno pretra",
        "MhF+<",
        "\".uYw",
        "sfu_\\&",
        "l\"u<S",
        "MxF#q.",
        "<:S(#",
        "ZuZ^k",
        "cQ6ceC",
        "gH}t;",
        "h$zx}",
        "BSACug",
        "?)xE}",
        ",/AW_",
        "+50e7",
        "=nXLiO",
        "NmN;t",
        ">O2o'",
        "VK~b6",
        ") HM'",
        "}zg{6j",
        "C@(zB",
        "q/2XR!",
        ",n/}1",
        "6c'4V",
        "C,CU;",
        "mu souboru .wim ",
        "Xw\"h6W",
        "n especificada. Setuprolback.cmd es un script personalizado que realiza tareas si se produce un error de instalaci",
        "0g0q0",
        "\"@qCY",
        "gE=~}@",
        "CrX'9_",
        "Ath_[S",
        "si migrova",
        "o40sU",
        "<nl4LKp",
        "BK#Lt=~",
        "<a[=Z",
        "Uso basado en escenarios ",
        "9IQe<",
        "V\"jPq",
        "b_\\, X",
        "S\\$1pyt",
        "E~*SX\\-q",
        ")8j]Uz",
        "6@93c",
        "8t(&l",
        "LaunchProcessInSession returned: [0x%X]",
        " pot fi folosite pentru a modifica comportamentul de instalare Windows",
        "{<#ur",
        "3i\"|q>",
        "f\\:x,h",
        "__CxxFrameHandler3",
        "z+feE",
        "$;Ao7;",
        "8M^T_-",
        "eOCX_",
        "&Tagasi",
        "Akcija : Program za instalaciju ne",
        "d#gut",
        "$^[{)",
        "diegti ",
        "Akcia: Po",
        "n volum sau cu suportul fizic care con",
        "7sB5I",
        "1`w>L",
        " festgelegt ist, werden von Setup keine installationsbezogenen Telemetriedaten gesammelt und hochgeladen. ",
        "A[t5Q",
        ":8;E;L;",
        "e do datoteke sa imenom setupcomplete.cmd ",
        " parametri ei ole tarpeellinen, kun p",
        "#06rA",
        "1(0&0",
        "8Pq;`Xj",
        "5bE`k",
        "(d/^B",
        "??v7t",
        "WcXoU",
        "NtSetInformationProcess",
        "a)%4\",",
        "~h9NI",
        "vaM!c",
        "P:pqq",
        "3U[oP",
        "4WBI5",
        "{Zfs01",
        "tre en cours. Pour plus d",
        " pid.txt",
        "X6R6Z6V6",
        "qUl7Nl",
        "\\2QW>",
        "?$?0?<?H?T?`?l?x?",
        "|QH,_N",
        "CDlpTask::GetTransport",
        "7 8*818;8M8[8b8v8}8",
        "xxwwx",
        "E*tQQK",
        "{RcCV!|",
        "}<xSp",
        "ER%>+",
        " jour). ",
        "Esimerkki: setup.exe / auto upgrade / postrollback \\OmaJaettuResurssi\\komentosarjat\\setuprollback.cmd",
        "Commutateur: / Telemetry <param",
        "PV*qeDI)Y",
        "aYH&W",
        ";e>bi",
        "YnI0d",
        "F3-o:",
        "Ex/Cn",
        "NW0~0Y0K0?",
        ",Ezf,",
        "k$,Q&I",
        "j|&JK-",
        "z5:NU",
        "G:~`J",
        "m'^NmR",
        "*IYJp",
        "Administrator zamierza w ci",
        "6HEtH",
        "iZx=+=",
        "4FUmT.)_",
        "Instalaci",
        "}K)-p",
        "iaM}v",
        "bCIq8",
        ":']un",
        "?wM^2u",
        ">(*,IG",
        "Nsldl",
        "yrO/2",
        "&O<~$q",
        "Marking directory as Hard Reserve: [%s]...",
        "ea la un fi",
        "UajLy",
        "MU]0,",
        "9eP09",
        "u!;< ",
        "bcknx",
        "lineen sijainnin",
        "hlasu so zhroma",
        "a+$1x",
        "rF-tXZ",
        "~EIv(fK",
        "MTO\\%",
        ").2/Zh`)",
        "Ns@5lu",
        "u@_Ft",
        "crans de progression s",
        "377i`",
        "EIzsRK",
        "$+Q*m<",
        "Ty n.Ktd",
        "1?/a|",
        "2s_iB",
        "y go u",
        "swHMG",
        "RG.2S/",
        "GX{r|",
        "+Z/6Z",
        "!qus0",
        "INHMQ",
        "uL=Ie",
        "zJbK:",
        "K@UT]tHS",
        "alGuh,",
        "3HNdZ",
        "i%pX5`",
        "f[;H(",
        "h78uvC",
        "+ MXN8",
        ",(5YRV",
        "9b]M>",
        "tricos associados ",
        "Support",
        "gVQq4",
        "UWU|7",
        "{Nh,k",
        "GL\\|T",
        "$Pd@{5",
        ",8pf~",
        "Parametri : Enable; Disable ",
        "21383_3",
        "!J6wNU",
        "]4^^Z",
        "   000",
        "=C4h A",
        "Hj-ijP",
        "|i/taJ",
        "~4~vl",
        "CdP:k",
        "r installationen. Medieinstallationsgr",
        "F2vCcPL",
        "FARV)T*/",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "(mBbhR",
        ":(J+y",
        "IMPLIED",
        "tn8^\\t",
        "b<0&~",
        "n: automatizar la instalaci",
        "RtlReAllocateHeap",
        "uc#z,",
        "J?L {",
        "`Z`q=<",
        "OovK<",
        "ritettyyn tiedostopolkuun k",
        "9S8&v",
        "fG:]@",
        "utare, desc",
        "~?f<ni",
        "]}tSe",
        "IsAppThemed",
        "32dy`",
        "ver, PBR uppdateras eller skapas. ",
        "J6q<51DbH",
        "pqD+]O",
        "D($Bp",
        "C~;;U",
        "8-GuN",
        ")bhY_",
        "5}y'QX",
        ":tyA~,.",
        "sb}p!",
        "4P:PZ",
        " g>hd",
        "4 Gy]CAfiP",
        "cm`!WNb=|",
        "+EzE.5!",
        "B!S39`",
        "^q~Oc",
        "CDlpTask::ResetActionProgress",
        "tD{%h",
        "gbs+^",
        "#xrkw",
        "(d@^Kn7",
        "r mer information.",
        "E^xQ-",
        "xEE_!",
        "q@X5,",
        "ik draiverid. Kui aga s",
        "n desde un directorio local, copia todos los archivos de instalaci",
        "@Y*;M",
        "4>f$i",
        ":qX.D",
        "Zk-Zh",
        "e$XadP",
        "r / migratealldrivers ",
        ":'vVpB",
        "N\"2;@",
        "_x{kQ",
        "PLoe,'",
        "]a>}cC",
        "sr-Latn-ME",
        "h?2g,YC",
        "CBootScenarioCtrl::Initialize",
        "ldasc",
        "F'saR",
        "nce g",
        "CLAe=",
        "-Tn[s",
        "```ppp",
        "lH7yiBR",
        "?kZfO",
        "X=Y|+0",
        "\\XDN\"",
        "(#q8%",
        "ZnB}97",
        "|0rBO",
        "o de upload, OOBE ser",
        "Transferir",
        "S;~Y0X",
        "ruoti",
        "3#4T4",
        "J'hbk",
        "U`/eN}'",
        "K9^rk*M",
        "*>U<Z|R",
        "ni tiek r",
        "fR4T5",
        "(lk$,^",
        "i acces ",
        "31Ga+=G",
        "Q(Y~)",
        "OlG5w",
        "[2?DC",
        "Windows 10 uzst",
        "qi*~)D",
        " uno script personalizzato per l'esecuzione di attivit",
        "mI+M[",
        "ud]YO",
        "w1Z+K",
        "\"LCu6",
        "installation va rechercher de mani",
        "C*dRh",
        "ju'/5,p]",
        "ge rekursivt gennem alle undermapper p",
        "X}1[ ",
        "$O7rt",
        "DoD[v",
        "ij(!\"2",
        "=:]W`",
        "hL;,#+",
        "#'0Mc",
        "CP0r+5",
        "FjLvsx",
        "-z68b",
        "EcF%R",
        "x+Kn2",
        "=l70:",
        "9@Kl0f",
        "([?n<",
        "768Z8",
        "PU}^U",
        "PY9jjQ",
        ">U=J7",
        "7 VZX3",
        "vneniami ako pou",
        "o_)F3",
        "reeI%",
        "b;ymu",
        "yq:*~&",
        "Exemplu: setup.exe / auto upgrade DynamicUpdate disable",
        "SetBkMode",
        "A~=NiH",
        "6.|xd",
        "SUcOm",
        "r8d8k'",
        "ogHZ'",
        "['hb?",
        "8GKje",
        "F;?I*m",
        "Parameter: 5x5-Product Key ",
        "Vi gj",
        "klad: setup.exe / auto upgrade / installdrivers c : \\myUpgrade\\drivers",
        "ifru proizvoda za instalaciju. Ovaj parametar nije neophodan prilikom nadogradnje pomo",
        "rii. Din contr",
        "VxzS>|",
        "=]>g>",
        "WdsRemoveDirectory: Unable to remove directory [%s]; GLE = 0x%x",
        "VJciA?",
        "oikeudet ja p",
        "|Lbkr",
        "]Zkf`p",
        "+oa-F_O",
        "B'9}7",
        "vr0zE",
        "u-#.m",
        " |vHQ",
        "?;C:0",
        "n que se especific",
        "zda, Windows 10 Kurulumu otomatik olarak yeniden ba",
        "dVo~5",
        " ja edistymisn",
        "Alternativt kan en tekniker, der udf",
        "wIhG6",
        "M6(<1",
        "DlpMgrInit: WorkingPath = [%s], Disposition = [%s], Flags = [0x%X], Diagnostics = [%s], StockRegistrar = [%s], UserRegistrar = [%s]",
        "Eksempel: setup.exe / auto upgrade DynamicUpdate deaktiver",
        "I^&o607@j",
        "z^t |",
        "HfnD^Y",
        "ATVnc",
        "m\\[P-",
        "xBOEZ",
        "3W(5'A",
        "GcnU]Vg",
        "EA_LFh",
        "38fc'Rc6",
        "K5sW}",
        "4[6=3s ",
        "s^,~o",
        "ko su",
        "~q;)n",
        "2zQOg2>8",
        "ii-CN",
        "~8XrX",
        "PCLx$r[GM",
        "e sva postavljanja UX-a, uklju",
        "728K8",
        "^0&006--H0",
        "CDlpTask::GetName",
        "ro-RO",
        ",RZ#~",
        "CDlpTask::ProgressHandlerTransfer",
        "cie pre in",
        "RT(LE",
        "S6\\-a'",
        "u&f98t",
        "&vsCG",
        "k=T\"/",
        "s'rq;",
        "!9_}q#",
        "-D_Z!x1",
        "Kez*I",
        ">El$z",
        "D8v<pM 4`l",
        "\"$}^!",
        "\".iE|FR",
        "K;C{H;",
        "Parametri: Enable; Disable ",
        "]+?x^",
        "R/[@+",
        "7LwEKV",
        "|chy]",
        "^\"PJOw",
        "ue=Y_6",
        "]*wG\\",
        ".W{mq",
        "VrB6o4",
        "v2+;jI",
        ",;[A5r",
        "ResetEvent",
        "9y^~'/",
        "Detected existing cleanup task mutex... exiting.",
        "y{\"_y",
        "qps-ploc",
        "KM$yM",
        "<Xk%-",
        "<.f2Q",
        "oOG*?",
        "ReleaseSRWLockExclusive",
        "wYLw9",
        "Zs)Qwp",
        "r aktiverad, val av telemetriinsamling och uppladdning, v",
        "649I8",
        "EV\"`4",
        "MKqfu",
        "V2dK_",
        "[Y#.j",
        "s^=4h",
        "bs-Latn-BA",
        "t@X^+",
        "]0W..",
        "GH=/^",
        "@7ch)",
        "~ZU/3",
        "guma akcept",
        " asennusohjelma kopioi tai lataa pakatut lokit m",
        "ma. Aizveriet r",
        "O(uW0f0O0`0U0D0",
        "`Rl,[ar",
        "Q\\ >B",
        "4\"TYF",
        "<(Ek4",
        "r;*|Y^",
        "U)]$v",
        "sX#G!",
        "81IL&S",
        "<0=E;",
        "7 7-7U7s7",
        "yS\\iw",
        "2ZO{\"",
        " 350 MB miesta. Uvo",
        "VH\\Z87",
        "a\\liN",
        "R)3yBE",
        "fhR.G",
        "|i5K;C",
        "vAc6[",
        "ie din re",
        "'&[6J8",
        "R,g95",
        "ghYom",
        "o$$L_L^",
        "_{od|u",
        "njo namestitvenega programa, vklju",
        "/N[E<",
        "000@@@@@@@@@   ",
        "%EFGc",
        "0A0|0",
        "q[nch",
        "8psb&",
        "{}Wm\\;",
        "w%6``",
        "&Xmu)",
        "j*lM1",
        "Parameters: Local file paths and UNC network paths ",
        "oLd)U",
        "{?pr}",
        "s4}^C",
        "78'EqN\"qN",
        "Euh_YS",
        "=NZ=t",
        "QZbo|",
        "PKu&j",
        "n`U_9",
        "(Qc~*g",
        "WUb=y;Nk",
        "[9(Si\\",
        "ACTION",
        "WdsGenericSetupLogInit",
        "r mediet skulle f",
        "]BH-XQ",
        "$}#mB/",
        "5ZQf&$",
        "Lu}<O=",
        "#h.soUw",
        "3;1vG",
        "H37+l",
        ">OyZ|",
        ">\"?,?Q?q?",
        "v%;G{g)%",
        "~lP!BH",
        "Ty3M'",
        "TE|(n`",
        "6Ct\"m",
        "n behelyezte, a Windows 10 telep",
        "Qh9+C",
        "X8N[X",
        "{]seD7D",
        "Y|c33f",
        ". Nen",
        ",=6,Z",
        "o automatizadas. Esta",
        "Installeren",
        "}_pEw=",
        ".Uzst",
        "sny{D",
        "n\"DC&",
        ";dZq[r,",
        "mI`E{:b",
        "c\\&S@",
        "Yl;L*",
        "3\\,1~3",
        "^>z__F",
        "rtoto palai",
        "ivitet",
        "2R2w2",
        "|Ra#A]J",
        "ThOoM",
        "o: / DynamicUpdate <par",
        "z&=;r",
        "ide: setup.exe / auto upgrade / quiet",
        "Vr'DH",
        "?Ih/:",
        "*Z{P{xG",
        "n, incluida la UX de reversi",
        "h;rE'-",
        "fCdfx",
        "zh-HK",
        "yeAYT",
        "_4g3a",
        "GUPsW",
        "Pc=p'",
        "{M}/L",
        "|+Li3",
        "LoadCursorW",
        "}J>b//",
        "\\-(JF&uJzr",
        "A(]SS",
        "Hive %s is loaded under %s",
        "k)<S|",
        "J9:;N",
        " tinklo vietos ir gal",
        "F1qS/",
        " Microsoft Corporation. Wszelkie prawa zastrze",
        "un service ex",
        "kd0|m",
        "Hu~O*",
        "o?L}~",
        "65^X?{UM",
        "MyF+=",
        "0vv,*",
        "n.\"vx",
        ">o^5o",
        ";p(,]b",
        " 8=Q?}",
        "9sXh<K]",
        "brX*1X",
        "?1BHUO",
        " installere Windows 10?",
        "%Pq.%Z",
        "I7gGF",
        "[F**|",
        "t take command line arguments. In Command Prompt, run ",
        "z(>OF(U",
        "vDSMU;",
        "A}9{d[e",
        "cznik: / PBRUpdate <parametr> ",
        "\\4A{^",
        ">#>4>:>H>X>^>l>q>{>",
        "w. Natomiast gdy prze",
        "N<_?H",
        "nek el",
        "ep_hl~",
        "reR6O",
        "EyT&Z",
        "^_x)f[",
        "k;)Y'",
        " asennuksen k",
        "]z~Y$a0",
        " ir tinklo prieig",
        "]Do1P",
        "\"?Tgi",
        "gqM\"1",
        "*$iGPA",
        "[=kT$G",
        "|aoZRq&D",
        "pMR[m",
        "BBD@;",
        "st9:][",
        "rate de seleccionar la arquitectura correcta.(Error al iniciar Programa de instalaci",
        "sA>R^",
        "\\>f:y",
        "4@?Iv",
        "pV.j0",
        "s]L{c",
        "{wrz:[",
        "un emplacement r",
        ">vB.+",
        "uvuu2H!",
        "&(%90",
        "+hXM*A",
        "{tBVh:5",
        "80P0w0",
        "9H4>a",
        "Ie$^|",
        ">A|Fh",
        "#+-jY",
        "hHr:*",
        "I9/.]",
        "x=0Zo",
        "qQi5o",
        "IjPys",
        "4Q/M4(",
        "OUZyI",
        ".a^z@>",
        "du XML.?Chyba p",
        "u(d?%",
        "CK(s`",
        "!k=qM_",
        "%C$$j}",
        "-# <&",
        "gQOgp",
        "em}cs",
        "Stikalo: / PBRUpdate <parameter> ",
        "b!zDpd",
        "KtI~^",
        "wxYe.",
        "_G?5}",
        "~Z/io",
        "inku, ktor",
        "fZU?w*W",
        "yTdR!o",
        "<Z9C<",
        "JwEh0q",
        "n`XLh",
        "yCJX;",
        "MzJNF",
        "to\\B7",
        "9iBjR",
        "{X=)}",
        "{QSaK<",
        "y=H<$HL",
        "GetWindowRect",
        "cNa&$",
        "y6un_",
        "$Z2)|",
        "<C^'D3",
        "1n2u2",
        "GbNW#g",
        "bin-NG",
        " kullanman",
        "oikeuksia ",
        "\\j:5O",
        "\"NmJ=",
        "}CVe8",
        "onsC\\j",
        "D>WwM",
        "Wj9SK",
        "o(>27X",
        "((gBfm",
        "+'pwl",
        "TXn&g",
        "$c+Um",
        "%<6J9&u!{",
        "*JKYr",
        "|b1:o",
        "blHa(",
        "Dr^l3",
        "&+EyJ",
        "|VH9j",
        "%^\"-4H",
        "Ep\\YR",
        ">@ko(u",
        "z?y@}\"",
        "e10e2",
        ";n5@@X",
        "1'V`/",
        "%s: Remapping [0x%X] to [0x%X] to facilitate retries",
        "d\\\\Yo",
        "Kana$:",
        "*IpxM",
        "T qU(",
        "D>uQb",
        "~|;mV$5",
        ".`F*%BM+",
        "74-AN",
        "h ^fN",
        "8+F!ZE",
        "Switch : / noreboot ",
        "gB.OM",
        "7RXN%",
        "bAM2/`",
        " repetidamente en todas las subcarpetas de la ubicaci",
        "ei+;\\",
        "=}!\\Ex",
        "rd: Anger s",
        "sASw\"8",
        "o, mas antes",
        "FO/[O",
        "$#IF2",
        "CxgkH",
        "@.rsrc",
        "dj+;&",
        "xW`'\"",
        "oNNrp",
        "Nu+Sn@",
        ":iZV^",
        "XJ3i%",
        "thW]$",
        "|H>'_",
        "dR(Oa%HZ*",
        "]~nNC",
        "iTQzl",
        "gnx0ex",
        "NtShutdownSystem",
        "y.cNk",
        "fZX=M",
        "nZr1C",
        "Preparando-se2A Instala",
        "i<i_P",
        "hnKzp",
        "oGTjF",
        "!TTQj",
        "Konfiguracija",
        "$O'8$.",
        "{*GFN",
        "YT4L@",
        "ztOFy",
        "DTQ5F",
        "li. Datu nes",
        "e[xkgy",
        "Wu|2)",
        "MiQ2t",
        "LjFJ8",
        "@Q1G{",
        "zi%Gr",
        "Fh ;?",
        "{kW=:o",
        "r4aYDX2Ylcb",
        "N3\"LDN",
        "Error cleaning folder: [%s]",
        "!/e3B",
        ".xG?S",
        "sOY*B",
        "!t<]Bw\"O",
        "ISf)J1",
        "+{0v{]",
        "ajte pokrenuti instalaciju.",
        "IBk&u]8$",
        "P-.R_Y",
        "V(1-'S",
        "Nf3T`",
        "&,Z\"#",
        "gNOHr,g/f ",
        "\"RY@*",
        "ivitamisel ilmnes probleem.sH",
        "&Natrag",
        "u:q']",
        "(n*\\0",
        "9'=B0",
        "n: inserta el archivo setupcomplete.cmd de la ubicaci",
        "9':Ra",
        "Segoe UI",
        "!7Oq1",
        "pfhR_",
        "R74,O",
        "tu Windows instal",
        "Y#-#^a",
        "ine un pid.txt ",
        "Q;]_R",
        "+Lu7V",
        "kn-IN",
        "xJRpifx",
        "tivte pros",
        "_M8/*}",
        "QU&0.",
        "@'4-?",
        "urare. Accesa",
        "hYqS]h",
        "Esimerkki: setup.exe / auto upgrade / copylogs \\OmaJaettuResurssi\\P",
        "i alap",
        "Eksempel: setup.exe / auto clean / installfrom d: \\minWim\\customwim.wim",
        "AV=*>",
        "hu60?",
        "<t/p.y8!",
        "Primer: setup.exe / auto upgrade / migratealldrivers none",
        "u2Ut<",
        "\"<jY:",
        "T~mfG",
        "_:oPb",
        "lRXy-",
        "^nbUd",
        "<82N)C",
        "t!'YQ",
        "PiBE_",
        "v[v6ASNFA",
        "70QWj",
        "1My$s",
        "v3|;o",
        "/45*K3m",
        "QQTumE",
        "2Q'X-",
        "[OE>7XB",
        ",o3k`4]",
        "cuter le programme d",
        "o do Windows 10/A Instala",
        "SH\"L*",
        "jI|qo",
        "TjJ$;9",
        "/yptD",
        "}f6Ev",
        "_RWC?",
        "(\\]nH",
        "Ut?(8",
        "EYs!7",
        "Vill du avsluta?",
        "Gebruik de andere installatieschijf waarop %s-bits staat vermeld. Wanneer u deze plaatst, wordt Windows 10 Setup automatisch opnieuw gestart.'De vereiste XML-versie is niet gevonden6Fout bij het faseren van het medium op de harde schijfhSetup is niet correct gestart. Start uw pc opnieuw op en probeer Windows 10 Setup opnieuw uit te voeren.",
        "Fyz57D",
        "Perjungimas: / quiet ",
        "liittym",
        "&A2Hi{FN",
        "klp5<",
        "3,3D3\\3t3",
        "lv~u.&",
        "D^6A(l}4s",
        "tY9w$tT",
        "sult telep",
        "}nKj1o2j",
        "d?RBG\\",
        "u5{xq",
        "{fcIr",
        "%\"~:6>80w8",
        "n de telemetr",
        "tres : N / A ",
        " establecido en Full, el usuario final deber",
        "$T^wxZ",
        "![2OQ",
        "$m)SN",
        "t@)>V",
        "ZDPFL*",
        "-x@Y9",
        "5YV|7",
        "g>S[=",
        " bir betiktir.Kurulumu ba",
        "pvWxRo",
        "ekilde, / migratealldrivers Hi",
        "G:][7",
        "LyG={2",
        "0fv24Gmh",
        "vojiet vietu un p",
        "lvm{Tys'",
        "2EWDh'",
        "I@\\9;",
        "M-R=K",
        ";.8+'\\PEb",
        "U2/%K",
        "[:Q\"-",
        "{g~Zj",
        "P\"Mxh:P",
        "]nMu!",
        "S:j|6",
        "/Taq]",
        "]9\\%\\",
        "ad: setup.exe / auto upgrade / quiet",
        "'Wr/K",
        "!1,C+",
        "Zqzww",
        "n llevar",
        "zSdu:n)",
        "U37Rx1-",
        "\\7aI^jo",
        "(4og7",
        "NJ?e$",
        "Scenariu de utilizare ",
        "Z/#Sn",
        "Juridisch",
        "@M!W0",
        "5GCVo",
        "<&E;5",
        "fF6qBQ",
        "Action : Automate install with migration choice for the installation. The media setup UI and progress screens are shown by default, but are automated.This switch also assumes the following default configurations : EULA acceptance, Dynamic Update is enabled, telemetry collection and upload opt - in, OOBE will be skipped, PBR will be updated or created. ",
        "6um(f",
        "z';#7",
        "}8@%[",
        "\"V&aP",
        ": / showoobe ",
        ". SetupComplete.cmd est un script personnalis",
        "(_Oh'x",
        "7!r+}w",
        "Eksempel: setup.exe / auto upgrade / copylogs \\MinRessurs\\UpgradeLogs",
        "ob?t:D",
        ".~YsU",
        "t{!H@h7",
        " del sistema operativo di livello inferiore. Il programma di installazione continuer",
        "4^N@f",
        "<;~zh$",
        "3AkQ.",
        "rMq?z",
        "b5,jL,[",
        "An admin wants to upgrade the departments PCs from Windows 7 Enterprise overnight. She does not want the set-up user interface to appear but she does want the end users to manually go through the Out of box experience (known as OOBE) experience. The following command line can be used to orchestrate the full upgrade to Windows vNext, requiring user input only once the machine reaches OOBE : ",
        " ECD\\",
        "c'`n0",
        "Nck(W",
        "u&mG,",
        "X6w~I>",
        "qnN*+3r",
        "\\j7HU",
        "g7H%t",
        "            <!-- This Id value indicates the application supports Windows Blue/Server 2012 R2 functionality-->            ",
        "01{6N=",
        "]'.aY",
        "zh-TW",
        "ti to noklus",
        "V|lA2",
        "}c$*i",
        "g'$<Ww",
        "GipM`&",
        "`DPp`",
        "5_~fxb",
        "?{4|_K/S",
        "$h6\\j",
        "3*w46O",
        "_xl>\"",
        "|?xj?F",
        "V<dJ5",
        "<9=@=",
        "Parametreler : .inf dosyalar",
        "O?MD-",
        "~U5abrX",
        "\\.W!\\",
        " naujo.'Nepavyko rasti reikalingos XML versijos1Ruo",
        "2OYGP",
        "D2m+_c",
        "R5xUb",
        "7R8Y8v:",
        "9$1:A:",
        "W.^Jv,qI",
        ".nL@f",
        "TEA)_J",
        "=`++MX~{",
        "#wTKj",
        "G2Vt0",
        "w-,bO}",
        "        name=\"win32u.dll\"",
        "CMp-J",
        "7BFph",
        "@L%0[`",
        "JeV9T^E",
        "Z,+W:H",
        "m%K^-",
        "[Q>>f",
        ":Aq`$",
        "o10AO",
        "KFmbV",
        "W4x-}",
        "4<*?u$",
        "M?g,-",
        "=QPCrO",
        "-P|`}p",
        "T#.Zw",
        ")e[/Xpt",
        "s\\ R>",
        "_5w:8",
        "L.c5-I",
        "6IQyv",
        "#s*\"~",
        "rnyezetekben szabad haszn",
        "^K<ct",
        "LvU|Fuj",
        " an. ",
        "WdsCopyFileEx: Failed to copy [%s] to [%s], GLE = 0x%x; will retry in %u ms",
        "\\0jg{'",
        "ZCi;fd.",
        "ivitt",
        "f&*Y:",
        "CPackageScenarioCtrl::Initialize",
        "|L>+_",
        "j*'}s",
        "Xcd-d",
        "uQ=|}d",
        "7O9+>",
        "9[rBNn",
        "rI1qE",
        "|7]i/",
        "cQ:yD",
        "L,wtpT",
        "2kyvQ",
        "zp'/x",
        "YD~LX",
        "Commutateur: / DynamicUpdate <param",
        "n:sZffe",
        "ne instalacije: ",
        "Zfr,O",
        "?L-Yc",
        "HGVP:",
        ",qeb%",
        "@yGHU",
        "/@[-z",
        "TH=+[-'o-YD",
        "d4,6P",
        "0Wiij",
        "Cvi27.",
        "Bk1el",
        "#Cmzh",
        "i#Z(k",
        "93{49=\\",
        "mTi)X",
        "%A preparar para instalar o Windows 10",
        ": Full; None ",
        "G6ANQ",
        "Ie`d]",
        "Po8[4",
        "ana tiks autom",
        "KM?Gc7n",
        "33,,,Ps",
        "0,JXI",
        ";!<z<L=j=",
        "user32.dll",
        "9 9$989<9T9d9h9l9",
        "-)7q>z",
        "j|D4\\k",
        "QCJ6q4",
        "AllocateAndInitializeSid",
        "lVndVi",
        "rQ Lm",
        "]!fH)",
        "ar-BH",
        "sZB7C",
        "_ZF6?",
        "8)8g8",
        "\\reZ_",
        "ber Nacht von Windows 7 Enterprise upgraden. Die Setup-Benutzeroberfl",
        "lmamal",
        "bFd6=",
        "rste brukerp",
        "EnumeratePathEx: Unable to construct path under [%s]; GLE = 0x%x",
        "]Cun6",
        "AKokeile suorittaa asennusohjelma uudelleen komentokehoteikkunasta",
        "Fvs$D",
        "Txq>4",
        "<a!+g",
        "m3Tja",
        "pertoire et relancez le programme d",
        "        loadFrom=\"%systemroot%\\system32\\odbc32.dll\"",
        "e2`Rv",
        " program p",
        "V/O9m=",
        "bIdVnY",
        "Ak@cl",
        "'7go6",
        "j/Yf;",
        "O(uyb",
        "HDh>_3",
        "R'X| ",
        "h]g!s",
        " oldalt: %1!s!",
        "?|awu",
        "fw'VK",
        "Beispiel: setup.exe / auto upgrade / noreboot",
        "KoVfh",
        "WPdXD",
        "Xs?SM~",
        "cej informacji.",
        "InitCommonControlsEx",
        "J`EO5",
        "<xnHa",
        "]j1VN",
        "UcTvC`H",
        "{#S]]}yyYYY)+",
        "ze8vA>",
        "tter in den startas installationsprogrammet f",
        "0L0Kb",
        "RxW%Xq",
        "c{B-V",
        "H0Mp3",
        "ti vagy nem hozza l",
        ">sR;_",
        "'<my=:",
        "=0T .(",
        "~9iWD0",
        ">$>+>F>V>n>u>",
        "`^|\" ",
        "m3e}0",
        " oli ongelma. Sulje ty",
        ".*Z$W",
        "ina uzst",
        "6a-Y76",
        "3!>7k\\",
        "l&0F`",
        "l*}0_",
        "GKv@.",
        "uCFRPs",
        "N`o~ri8",
        ">!,?o",
        "kx\\q?",
        "j\"P)}!",
        "8=@u+",
        "+,<b.",
        "s[69p",
        "M\\$`k",
        "K(#Qm` ",
        "quina chegar ao OOBE : ",
        " instalace Windows se daj",
        "Y*V#k",
        "%=c|BhOq",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "H6s0=Sk",
        "5$6W6|6",
        "xr]z,",
        "tJ>HB",
        "@?e\"@",
        "E/d\\z",
        "%s: Setting PreDownload mode...",
        "klad: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "nnande av licensvillkor, dynamisk uppdatering ",
        "s<:MbG",
        "Voorbereiden",
        "it-CH",
        "HZm_h9",
        "=x31fN\\",
        "LmONm&b0",
        "pCm}M",
        "fr-LU",
        "(aV`.",
        "$i@i0",
        "^ds*;u",
        "H2F'J",
        ")OkO[",
        "FcZ(E",
        "@*Fb&",
        "*==}zz",
        "gZ#n_",
        "+9h~Bkl",
        "c/}n1t",
        "Forbereder installasjon ",
        "!}\\r%2",
        "aGb$em",
        "x,@TpL",
        "FA}xd",
        "o, inclusive UX de revers",
        "es-ES",
        "3!GU!V",
        "~p.,v",
        "Programmu Windows uzst",
        "jxNK[",
        "yF83z",
        "Vc=_N",
        "FindResourceExW",
        "+|O\\8",
        "m\\inb",
        "^i`]i",
        "nea de comandos. En un s",
        "~D{}=",
        "al,2*",
        "Iug2w",
        "PhX5A",
        " chce p",
        "3\"323B3R3b3r3",
        "?#?2?C?I?W?g?m?",
        "3\\>Cl",
        "xima vez que se reinicie el PC, la instalaci",
        "Xfq3zJJ]",
        "hrt. ",
        "sC?_Q",
        "CDlpManager::AsyncSerializeDisable",
        "nd / showoobe este setat la None, OOBE este ignorat ",
        "Dy*f2",
        "ide: setup.exe / auto upgrade / noreboot",
        "sWx!Z",
        "r att k",
        "$#;,&C",
        "qmn1<",
        "n est",
        "lKY9V",
        "o definidos",
        "A\\xGN",
        "j5wYq",
        "6=1M!Y",
        "SdxX&",
        "P=W5P",
        "ErGy?",
        "oU3>t7",
        "Sigurno ",
        "?w>zl",
        "'iM7=ek",
        "7dC~.",
        "YMuAL;jK}",
        "rovanie do umiestnen",
        "sitsi l",
        "6$7K7p7",
        ";I{4e&",
        ": / Telemetry <param",
        ".P]~XH%",
        "insko licenciranje ili pomo",
        "tFj0SV",
        "7oBm>",
        ">D`,=",
        "qIt;l",
        "+\\)5:I",
        "K: K/",
        "elle peut avoir donn",
        "Nothing to preserve.",
        "7+z@W",
        "XhoaMO(",
        "9D{^Aj",
        "045p?",
        "FFa9 ",
        "squeda, descarga y actualizaciones de instalaci",
        "stroj, restartujte po",
        "Action: When / Telemetry is set to Enable, set-up will collect and upload telemetry generated by the installation. However, when / Telemetry is set to Disable, set-up will not collect and upload installation - related telemetry. ",
        "Pm,00",
        "GkG!=",
        "W=7m|",
        "u%O*4",
        "priebeh",
        "PmhAl^l",
        "uriranje zna",
        "9Ow7@",
        ", kter",
        "pfd\\81",
        "5,K/f",
        "Stiahnu",
        "N?dqU",
        "=^n5K",
        "r|T)|o",
        "Qm}DL",
        "J-3%1",
        "CreateEnvironmentBlock",
        "**o~3",
        "wqJ)EUw",
        "<KkPkv",
        "/Priority Normal %s",
        "GlQ!}a",
        "OmLfI",
        "abt##",
        "?5Dxr",
        "EEEGO",
        "Zn(Fc",
        "s1^l5d",
        "dSd{d",
        "_SU$u",
        "%8, 8lR",
        "TMRn0",
        "yU={7",
        "cN;1<",
        "-`<7e=X",
        "tim c",
        "Gauti",
        "^Ih||",
        "LGB^!",
        "*2lm7",
        "Gpo$l",
        "@kIAl'",
        "OVSop",
        "`.aZQ",
        "KTM:H",
        "e*k\"*LW",
        "'iv^c",
        "MmQD]",
        "letim sistemine geri al",
        "~@Bg0j",
        "% moa",
        "Md}u#",
        "V]xGd",
        "bYaJ*3",
        "installation va injecter tous les pilotes .infs trouv",
        "        />",
        "@68%F9>",
        " ei tule k",
        ".7z\"=",
        "s,W3z",
        "~BQ; ",
        "hE|By:}",
        "YOR`#~",
        "E66|{",
        "lda: setup.exe / auto upgrade DynamicUpdate disable",
        "V*+1JOe",
        "b`f_X",
        "KFJ|$^",
        "&5Ebx",
        "/eSq%",
        ".$m$~uYW",
        "}$0Cj",
        "\\^*]S",
        "Ixj$l",
        ":#o3_",
        "+#%7~4W",
        "-2S4T4",
        "737Q7_7f7",
        "a pu d",
        "I_\"]H",
        "R'5H#",
        "0FO/f",
        "vAEi]",
        "x{0/H",
        "35JR;",
        "'e1gc",
        "Rh'R\"",
        ";Uo/;U",
        ":R?}$y",
        "IOWEY",
        "H<Y$-",
        " Service Pack 3z",
        "J\\jI,J-",
        "Q9Y&J",
        "G+2EG",
        "[W0~0Y0 ",
        "'YAnP",
        "vL7v<",
        "`\"X4q",
        "|K,Lg6<",
        ",  instalacija ne",
        "\"fnlX",
        ",IV&?",
        "ho souhlasu se shroma",
        "jPQP1&",
        "%:#=PMs#",
        "YRd&e",
        "Qb-4X",
        "}~:W-67",
        "6$NiA]E#[",
        "S.Q{7G",
        "j1rD2NO",
        "U|=lV",
        "]g}o/t",
        "Vsfsu",
        "-[jYsL",
        "T18e?",
        "c6h4'",
        "8h\\6n",
        "tane vr",
        "$.b:N",
        "terek: Egy adott specific.wim f",
        "(L8.m",
        "]Nxn1",
        "El:Sq",
        "i?%Sunte",
        "3p3l+",
        "tta. Kas soovite j",
        "Ah,U72",
        "anas programma nepie",
        "T<t<$uU",
        "r~C1i",
        "i instalaci pokus o migraci v",
        "9&:;#",
        "@GQeyC",
        "=9+'j",
        "KoH)pH",
        "18{'*",
        "*QS:fs",
        "0c0f0",
        "r:i0+.",
        "}K<l2",
        "j\\(npa",
        "A!G.x",
        "8CfGE",
        "fyJ{og",
        "N+iPV,",
        "2.!g1n",
        ")Qh.A",
        ")f],8K48K",
        " loca",
        "jD9R]",
        "Ca!Ps",
        "}{`SU",
        ":Xiw&",
        "NOTE : this switch should only be used in testing and test envoriments.It should not be used in production. ",
        "Parametrit: All; None ",
        "_controlfp",
        "rlLLd3",
        "<9-Jb?",
        ">n zR",
        ";NQw-",
        "\\v}_l",
        "9 KQf",
        ":R_&W",
        " |++'",
        "0T<r\"",
        "o : A etiqueta quiet eliminar",
        "oc`,Fh",
        "D6{$w",
        "kkel ",
        "Yzby$",
        "H'#Hvr",
        "Bl;9owoA",
        "A0|I{'",
        "DlpTask: Entering Execute Method",
        "KT%\\d",
        "u1h]?\"E]",
        ".'#i+I",
        "IMm<;",
        "Action: %d%%, Delta: %0.2lfs, %0.0lf ticks, Avg: %0.3lf ticks/s",
        "b`$l0",
        "XbY;l",
        "ZER&k",
        "Ad!YOv!E",
        "lnm64",
        "X#Rv*",
        "\\|Q_f",
        "x3q@!",
        "[(n-W",
        "prava: %d %%.",
        "tres : cl",
        "oDI+6",
        "Eylem : / migratealldrivers T",
        "ppp```PPP",
        "-}<Un",
        " {O s",
        ";\">p)",
        "U[`\\Eq",
        "Veiksmas: kai / showoobe nustatytas kaip Visi",
        "t=Wj,j",
        " : Upgrade; DataOnly; Clean ",
        "374t4=5s5",
        "OR}(i}",
        "hoc[w&",
        "X7PG@",
        "eOFv:",
        "8%8G8U8n8",
        "Radnja: Ako je / migratealldrivers postavljen na ",
        " ]3 O",
        "^4W]CQD",
        "o&OO5",
        "vo\"?Z",
        "B_1>6E;",
        " L+q 1",
        ";\\sCU",
        "loh opera",
        "rlopp",
        "r / showoobe m",
        "~rc$f",
        "`@}C=",
        "D~3pS[",
        "WinDLP System Reboot",
        "HczqbgK",
        "hG# M",
        "(Inb3fd",
        "#EJAL",
        "<uHJ+f",
        "A{\\:C6",
        "<M>Eg1",
        "P!g\\>",
        ": ;L<Y<g<",
        "Asisten",
        "kzz9.",
        ":[Y9,",
        "2OeP|~",
        "=(:~@{)",
        "E-g1l:",
        "373>3E3P3W3_3o3",
        "ne-NP",
        "Pavyzdys: setup.exe / auto upgrade / noreboot",
        "U--xh",
        "]jf6My",
        "n. Diski takt",
        "XcR.=",
        "FN<zI2B",
        "3&4g4",
        "G>2*Sp",
        "uA\\eu.",
        "inclusion de la collection de t",
        "T_K/wW",
        "@r=^7v$",
        ".grK7",
        "]>c-N",
        "biri olarak ayarlan",
        " iba pri testovan",
        "i=HhO",
        "dA7cV",
        "_s0Tx7",
        "<L>YX",
        "Process termination failed!  Error = 0x%X",
        "*N2_&",
        "FGK3t",
        "ESD target file: [%s]",
        ".}T8z",
        "C]a-4",
        ", ale pot",
        "ProductName",
        "[OX;t",
        "18^B\"",
        ". Soubor setupcomplete.cmd je upraviteln",
        "snve3",
        "54e>a",
        "j3-&Jx",
        "(^\\Qc\\",
        "1k2:4y4",
        ";$':]",
        "a<T]A3\\",
        ">)JEr/",
        "|WEF ",
        "~g x0Y",
        "Microsoft YaHei UI",
        "BR)g,4",
        "zc}I}",
        "22n(g",
        "!MaRL",
        "nfHn!K",
        "mku(=",
        ": 5x5 ",
        "vV?7o",
        "`b2(s",
        "GKoooX",
        ";_&KJ33",
        "Setup.exe instala o actualiza Windows. Para modificar el comportamiento de la instalaci",
        "Oi?$%",
        "\\W;\"d",
        "OJ^?U",
        "_r0+X$\\",
        "`[*]vt",
        "s}g/0",
        "C* krK",
        "DFY<Z",
        "fa-IR",
        "|G=s_",
        "nM*{W `L(",
        "Estamos fazendo alguns preparativos",
        "%[_S(",
        "IVM4J@nM",
        "W=3Lf",
        "^&g=@",
        "v0W*?v",
        ",V?fV",
        "xd<5^",
        "-E~s%",
        "Perjungimas: / pkey <produkto kodas> ",
        "$`yw+",
        "dW>v2",
        "Urn<N",
        "SEp0_",
        "<X<K|",
        "gle til installationsprogrammet. Denne parameter er ikke n",
        "av1vw(",
        "5[;>T=)!",
        "q((^vA",
        "z8dX^:",
        "T:{zE",
        "/CorrelationVector",
        "bIu~r",
        "kOB5Ik",
        " a megadott helyen l",
        "e pokrenuti naslije",
        "lnemu s",
        "v$kb\"",
        "?w<t6",
        "333:3@3E3P3X3l3",
        "Ex*yQ",
        "Y-Nk0OUL",
        "*~:*b",
        "{{j%&",
        "[w.[p=",
        "T:?t =",
        "|P~%w",
        "?n*/#uG",
        "ls$]]R",
        "{YtKh",
        "AJijUs",
        "E9m4\"g",
        ">B[#W",
        "5X6D7K7[7b7q7x7'8.8N8",
        "ivitys saattaa olla k",
        "PYlC^s",
        "^^t{_]",
        "|$|`>fy",
        "^rZ r",
        " / showoobe ",
        "!*`HBT",
        "r=C}U",
        "Parametre: Upgrade; DataOnly; Clean ",
        "^L3UV",
        ";wX>#",
        "ndT.S",
        "c^1(840",
        ";3sfff",
        "|2F7NG}",
        "d Product Key, 5 x 5 ",
        "k igen.cOm du installerar den h",
        "p.n6F",
        "}~.n|",
        "RK0M[n",
        "1!1R1",
        ",M.mX$",
        "f5*&@",
        "[`Un$",
        " skript, kter",
        "+O2OP",
        "4z0{52j>",
        "Dniql",
        "#&0I~",
        "<[]n<",
        "y_N*F ",
        "%()S{xw",
        "PZA[H",
        "ndning ",
        "Wyptm",
        "R5?u#",
        "@sN/!",
        "e-Y_r",
        "U]d@,\"",
        "?,6F5Z5r",
        "pQF]5",
        "K[^w2N",
        "zz+Y]",
        "}hfY`",
        "X/4 6I2",
        "VP=P>",
        "TMQ<{",
        ")+Lv$",
        "ite uporabni",
        "i=bkG",
        "'`+;/",
        "r / PBRUpdate er angivet til Enable, vil installationsprogrammet opdatere eller oprette PBR-partitionen. Omvendt n",
        "Te+|d",
        "Esimerkki: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "d6xweT",
        "}UrR:SS",
        "metro deve ser usado apenas durante testes e em ambientes de teste. N",
        "SvU8]5",
        "%s: PreDownload mode value found.",
        "6,mXGF",
        "UoP_V",
        "+(Xof",
        "@6\\D\\",
        "{XLIt",
        "0*g#4",
        "S7@tVI",
        "G$Tnm@",
        "r{c[C",
        "^,q6l",
        "QfQ?Od",
        "/ auto <escolha de migra",
        ":=;G;'<",
        "7C}ee",
        "wG!E6",
        "Action : si / Telemetry est d",
        "i instrumentul.oAvem nevoie de cel pu",
        "Lh3l<B",
        "G$+6P",
        ".S$&.",
        "=8wrG",
        "F+g cS",
        "oh9^c",
        "X+vIs[",
        "80wc-f",
        "AYDVJ",
        "e&y`b",
        "<y<)e",
        "*? NF'",
        ".!$,Z",
        "O&K'i.",
        "VV|~]",
        " : / showoobe <parameter> ",
        "n, belirtilen dosya yoluna a",
        "qLK[b",
        "o para executar a configura",
        "HvAd>",
        "}7!Z`",
        "XSdi[",
        "Windows 10 telep",
        "<}@y5",
        "*wP]G",
        " verificato un problema durante l'avvio dell'installazione",
        "i(\\HR",
        "~:\"0]",
        "7M<.qjc",
        "Z<X:d1",
        "ug4LyAn!<",
        "/~_R;w",
        "vO{-P",
        "`ppcTU",
        "gsGat",
        "WhTv@",
        "9x9N(t",
        "<w%r<=Tt",
        "1^1e1k1u1",
        "wiI_>",
        "XLjE?|",
        "es-DO",
        " Microsoft Corporation. Alle Rechte vorbehalten.",
        "prfdA",
        "$;<n/q",
        "DuPHy",
        "n timp ce alt",
        "Kgq->DY@g",
        " nem gy",
        ":kU \"",
        "VVDv'",
        "finis ",
        " alebo pou",
        "enite ukaz ",
        "D?9IwN",
        "H)d-$",
        "_(M*%",
        "VVT\\Ex7",
        "YA@kM:",
        "p!Ej\"",
        ")Nzu~]A",
        "dfEe.e",
        "VR3njQ",
        "n]?Ze",
        "`~awr",
        "$G(yKW",
        "77&PE$",
        "mt^XU",
        "}eGN^N",
        "Ajuda",
        "Como alternativa, un ingeniero de implementaci",
        "E6|?#K!",
        "~aXrP",
        "Ve'Rk&",
        "%&y.\"y&",
        "=FxT^",
        "yZyde",
        "97u$VV",
        "l ;-;",
        "~`ID%U",
        "7xk]=|",
        "Rd)bO",
        "!9x+`",
        "PuB'$",
        "0? $A0",
        "4+5h5",
        "4i:xWw",
        "tte hele opgraderingen til Windows vNext og kr",
        ")*WG$",
        "PUBLIC",
        "pE]VK",
        "eDF:/Os",
        "*]X,NB=",
        "_kX$Y",
        "$[1(B",
        "HeapSize",
        "bY5RV",
        "=65N:",
        "2>2V2e2l2",
        " Microsoft Corporation. V",
        "2zBga",
        "&r+Z|Kv",
        "k 7M_",
        "Setup360Files",
        "4$4:4D4X4f4v4",
        "Notiek gatavo",
        "&E3 an{BS[",
        "Qq)bl",
        "2+*de",
        " uz mapi, kur",
        "5P6W6^7e7",
        "Installi",
        "uV\\Lb{,",
        "en-CA",
        "0IwlsJ&",
        "x^0G}",
        "Oig9y",
        "'NBOz",
        "j>d,8]",
        "]}tTE",
        ", namestitveni program bele",
        "h5Jh1",
        "1 sU s",
        "1wa+7vU",
        "b=i=h",
        "=qQ'XB",
        "DIB-Ca",
        "B+4>J",
        "MVXMWd:",
        "{/UU;XI",
        "jxw(Kg.$b",
        "lI&7l",
        "5NX=V",
        "6(wz@",
        "TerminateProcess",
        "G^#h :",
        "^ctcoz",
        "'\\_a~",
        "yEV[=",
        "visiacu s in",
        "CDlpManager::GetStringProperty",
        "_\\, X<.",
        "qMT'A",
        "H!d2#",
        "\\JuZqI",
        "-Qu_4",
        "{4(m(",
        "iiiPTX",
        "x=..>",
        "TFYgu",
        "5alUg W",
        "a?0EY",
        "hwQf.",
        "8vJ]6<",
        "P5c~ ",
        "anas programmai uzdot iesaist",
        "Comutator: / Telemetry <parametru> ",
        "Example : setup.exe / auto clean / installfrom d : \\myWim\\customwim.wim",
        "OjVqD",
        "Wait for Rollback mutex returned: [0x%X]",
        "R`*nD",
        "BRj/<#",
        "@xxV:",
        "7,7<7L7\\7`7h7|7",
        "^:h(B",
        ")F+&)R",
        "3qFnB",
        "7%4{H-",
        "g;ZSnVjb",
        "+(:f-K",
        "p6}i!",
        "Setup.exe installs or upgrades Windows. The following command line arguments can be used to modify the behavior of Windows installation*Asennus ei tunnista k",
        "n loca",
        "rs med samma privilegier som anv",
        "LSVWh",
        "eli prikupiti zapisnike i druge dijagnosti",
        "KI~G2",
        "RqaKF",
        "9vBOs&,",
        " ::pN",
        ">NqKt",
        "-TXz%HY",
        "4a1hz",
        "af$;,",
        "Ur7Fh\\",
        "EoM8]_",
        "bbY~|",
        "5Eu{)K^",
        "L]O{GT",
        "Z\\E'~",
        "cznik: / Telemetry <parametr> ",
        "lgPwJ",
        "].gU+o",
        "3K5\\Y[k/`",
        "Action : Lorsque / migratealldrivers est d",
        "O|IMW",
        "RichEdit20W",
        "vI_K5rD",
        "?<qO#",
        "P8~*~",
        "C49[{",
        "n folderul surse. ",
        "@0b}zfu",
        "JKKmB^",
        "v%OH]",
        "kn)BWg",
        "oz#:k",
        "lda: setup.exe / auto upgrade / postoobe c : \\parancsf",
        "N9wI={",
        "dias que contenham",
        "8TX1>",
        "G:g7[",
        "Finished waiting for SetupCln!",
        "c?YB-",
        "Cxf_{",
        "Parametrai : Enable; Disable ",
        "LSVW3",
        "NM'Bx",
        "}e'K)",
        "gn-PY",
        "On(w!",
        "Switch: / showoobe <parameter> ",
        "Un(qXJ",
        "he korra (kui seade j",
        "8@v5%",
        "z=;9%",
        ",NfpR?~",
        "3EG3d/_g",
        "9Ay v",
        "576=7",
        "Suderinamumas",
        "V4#}2Mf",
        "A\"k{,",
        "o continuar",
        "Msju_xs",
        "6X6_6}6",
        "?]C,~Y",
        "9 9,989D9P9\\9h9t9",
        "vXHjK>_",
        "iL&\\j",
        "ZC/Am",
        "Se\\Ls",
        "6l>|^",
        "#{Dl1",
        " siirt",
        ";H7wv",
        "kleme taraf",
        "BEZ{S5|ak",
        "um]:*",
        "PPP@@@@@@@@@@@@@@@PPP",
        "K)|_cqL",
        " enthalten ist, ist dieser Parameter nicht erforderlich. ",
        ",`?) ",
        "rgujuurdep",
        "ytkownika Instalatora, ale tak, aby u",
        "lati forgat",
        ";)HeN",
        "a|0BI",
        "21#y#>5I",
        "xz+yz",
        "M4N%4",
        "w~naCQ",
        "AG2lO",
        "_Nysy",
        "`vispL",
        "E6}Vb-",
        "rtuseks on seatud None, ei migreeri installiprogramm installimise k",
        "K[t<m",
        "dwjXv",
        "V-k5q7",
        "P &6kT",
        "6[/3`",
        "6@E\\q",
        ".Lang.ini",
        "ysi p",
        "0}0!1{b",
        "2rMGPF",
        "/7N\"j",
        "+p|Wt",
        "AOK\\R",
        "{>eKG",
        "Pvr&g",
        "e\"0CF",
        " executado com privil",
        "1:yRd",
        ";aj8!gd",
        "Z(T*f0lzjG",
        "        loadFrom=\"%systemroot%\\system32\\userenv.dll\"",
        "*>>|f",
        ";ueuee",
        "#?tcc",
        "vAx=~B",
        ".LkYb",
        "9kT*l",
        "U2}T*",
        "interface utilisateur et les ",
        "e/%Q)",
        "M\"quk",
        "cuVHIs",
        ";,ifO<",
        "$#H]#",
        "9!:c:",
        "anas programma nevar noteikt UI valodu",
        ": / Postrollback <um",
        "2p~h;",
        "P$y78N",
        "b`uEn",
        " failu setupcomplete.cmd no nor",
        "tZdF$\"",
        "les m",
        "#F}<]",
        "%&Q@:",
        "ntGh-",
        "Q[GNHxVG",
        ";tDjp",
        "3JWkvF",
        "BwsM'",
        "-}O-T:",
        "JuZa=",
        "`~;&!",
        "_HIq 4",
        "        loadFrom=\"%systemroot%\\system32\\profapi.dll\"",
        "?|ToTN",
        "~\"H6d",
        "EON\\}",
        "?lbN`/n",
        "}\\}oQ",
        "}3@ux",
        "j08iou3/m,fE",
        "B6KI;",
        "vfGpXO",
        "@'*'%#",
        "cb}J5",
        "{NG*)",
        "s instal",
        "Q!{!\\",
        "Azione: fornisce il codice Product Key specificato al programma di installazione. Questo parametro non ",
        "\\hC->",
        "vXHuo",
        "\"-)$,",
        "F_itw",
        "[J]2S",
        "2YcdEGE",
        "X}Y:d",
        "F8(y\\",
        ",$rsh",
        ".Y@Bi",
        "e-xUG",
        "EG8mO",
        " 53+q",
        "Y#**da",
        "D{+F8",
        "BOnrJ",
        " taky p",
        "4hEK+:",
        "rcKwK",
        "\\yGLF}q",
        "_64bS",
        ")OC7S",
        "-]8Mx",
        "=?[bMt",
        "Fk?~^",
        "o:|)S",
        "t?uW>F",
        "8!9:9",
        "Action : automatise l",
        "2-Yo8",
        "XfB3#",
        "3iNv8`2",
        ";xs=rC",
        "! P[f",
        "q$224.",
        "let nyelv",
        "|yd@:",
        "_uUEw",
        "+!w0y",
        "<7R77",
        "t`3+v",
        " la partici",
        "SLj&%JS",
        "a;b|7",
        "9t$ u39t$",
        "1}Lol",
        "O8G,9",
        ")o iU",
        "IXG^Z-c",
        "o local para a instala",
        "#0|$F",
        "^P)k?",
        "u1kms",
        " operaciones de actualizaci",
        " skript na vykonanie ",
        "#>$~[",
        "n se suponen las siguientes configuraciones predeterminadas: aceptaci",
        "JLEh{",
        "59E#.N",
        " i dati di telemetria generati dall'installazione. Se / Telemetry ",
        "Exempel: setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "micas (b",
        "ru mimariyi se",
        "l0J`A",
        "li|hv",
        "CDlpFile::GetProgress",
        " ,#ur",
        "woY,^",
        " soubory do adres",
        "{YBJG",
        "ym1;[",
        "{QagZ",
        "emts, ka sp",
        "e,/%+",
        "EKm-hon",
        "wfv<S",
        "PhpYA",
        "liti: / quiet ",
        "%~`'>",
        "$[\\T!",
        "![<;n",
        "%j-K7D",
        "20201008142756Z",
        "H^Cz|",
        "Ejemplo: setup.exe / auto upgrade / Telemetry enable",
        ".<\\tB",
        " nepiecie",
        " tai luo pikapalautusosiota ",
        "loh po dokon",
        "{6Kyf",
        "8&8,8H8c8s8y8",
        "Bh_-S",
        "%K4sv4q1I",
        "rder efter att installationen slutf",
        "Q9BV3",
        "\"E@VNm",
        "In\"n&",
        " g5pW",
        "y<Q|z",
        "S5Fp*",
        "9/G%LB",
        "{O9w<x",
        "a\"9OJv^",
        "aR.W}",
        "]Qp[W",
        "93Dgv",
        "<3tWq",
        "x0?1]",
        "Q:T:J",
        "9 ?A_",
        " ning",
        "Den arkitektur du valde matchar inte din dator. Du m",
        "s a telemetriai adatok gy",
        "Cq^}sc",
        "H7SaUL",
        "_K6`l",
        "RX)Fo",
        "t*s42F",
        "_::t2",
        "RDz/t",
        "o24?R",
        "nsker at opgradere afdelings-pc",
        "'kj^xP.",
        "@>,[a",
        "sYqa80",
        "Z&c-%",
        "q#D/L",
        "ADfur_ ",
        "'k8S&g",
        "ZbnH{",
        "9E*V-",
        "XOSQ#T(",
        "iN:I^",
        ";>k\\?",
        "]kEA|",
        "CKd]ixT",
        "?N]M~K^&",
        "T%22/Qc",
        ">WeY##",
        "iKPJX",
        "N%gf/1",
        "3[K[?",
        "uHJjz",
        ")oW1h",
        "~rxWN",
        ":A:O:X:n:|:",
        "YqS'p",
        "L/!?m",
        "I_RpcMapWin32Status",
        "Parameters: Local file path or UNC network path to a folder that contains .inf files ",
        "Parametry: M",
        "nt a merevlemez-meghajt",
        "cie, ale e",
        "& nID>cCl[",
        ")JLgt",
        "M,<g>",
        "terek: 5x5 term",
        "lle samasse kausta ja k",
        "6.Kde",
        "rG_jW",
        "dkZ]]",
        "&&sSk",
        "\"G_#)",
        "mg_WP",
        "?4)bP",
        "@-(@E",
        ":ex'U",
        "!wbdj",
        "s visus draiveru .inf failus, kas atrodami nor",
        "My\\)c",
        "b-&w_I",
        "9Qn\"#6e",
        "%&,Y7",
        "\\&&Wi?",
        "2DeZJ",
        "mOko7",
        "v^'a:;",
        "jJiyjy",
        "0%TIC",
        "Ec?)^",
        "888D8d8l8x8",
        "t4}qo",
        "C|&:Ig",
        "ActionId",
        "ESq@&",
        "enete ra",
        "j0}!N",
        "QcGjZ",
        "m<F+(Z",
        "1Q/NM",
        ";\\'}?",
        "w6\"UO",
        "o. A interface do usu",
        "uA)d}k",
        "?<UIS",
        "BMLm ",
        "sf$ri",
        "N1kd:",
        "r`0Mk",
        "/!?DY",
        "R9H'9",
        " }VFzT",
        " activ",
        "9Z1H?",
        ";';;;A;",
        ")Z,yn",
        "4nf77",
        ":.gVz",
        "82!NX",
        "7+nFu",
        "~_^:|VF",
        "vD/|\"l",
        "dTl~3&)",
        "nBUxu",
        "Beispiel: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "9y vg",
        "Xf1'O~",
        "#~PRR",
        "*DKkR",
        "8z#=J",
        "|2pM8;",
        "MI!C+",
        "3@3h3",
        "2/7OUw",
        "k|q=P",
        "\\w$=r$C",
        ";C^hyK",
        ",Okb>",
        "rs`5E",
        "V$^dN",
        "ho programu pot",
        ">?&:Q",
        "U}y3Ph",
        "w---e",
        "jo laikinai nutraukti tinklo ry",
        "\"8|S#",
        "mvY>\\",
        "b7qQq",
        " na v",
        "iadne ovl",
        "]jC+]$",
        "Ji&xj",
        "Usmaa",
        "kXRs$",
        ")5l&]",
        "Xw/K}",
        " o creer",
        ")a]A?",
        "(E7>$",
        "O-;*!",
        "0\\`DY",
        "5e--94\"",
        ",ieR5",
        "ADO[T",
        "dV![?",
        "Ix;Xe",
        "(=zv8",
        "6v*Ar{yO",
        "Pa_UG",
        "mA45.",
        "F\"E|7",
        "|$(Y3",
        "H^,\\XU",
        "4MZ(m",
        "'^CU@",
        "z del medio de instalaci",
        "w{[MV",
        "UNPqAx\"@",
        "5T#sy",
        "081604B0",
        "fr-FR",
        "N\"x68.",
        "0;wGn",
        "N&hq-2",
        "wU.CY",
        "Malgun Gothic Bold",
        "o (conhecida pela sigla OOBE). A linha de comando seguinte pode ser usada para organizar toda a atualiza",
        "UjY-D",
        "x8O[J",
        ".tls$",
        "fDyuq",
        "P>F8ip",
        "#ZGC/",
        "!$ v3",
        "}l? J",
        "Primer: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "#G8\"I",
        "Mj;B(kj(v",
        "L<5dEF",
        "~(2,R3|A",
        "ZC?6'",
        "{hRO2",
        "LoadResource",
        "z^RoX#",
        "-)]Gh",
        "QEiLg",
        "`.6|E}",
        "{v.jJ",
        "dkFuu",
        "Installasjonsprogrammet starter ikke slik det skal. Start PCen p",
        "d Product Key> ",
        "/JYpm",
        "k2u|+",
        "'Forbereder installationen af Windows 10",
        "/|BGZ",
        "v\\7n3",
        "[CxTCx",
        "K3_6ln",
        "{97x*",
        "<CE~\\",
        "ncelle",
        "z*W}&G=",
        "8!9j9",
        "$Z{(Y",
        "?ME?%",
        "0 ZP|0",
        "\\)88_",
        "3h'_1",
        ".?AVCButton@@",
        "lPoP_P",
        "%dT?%",
        "`.Q3n",
        ")^@@o]",
        "0S0h0L0g0M0~0Y0",
        "+=re/",
        "r att g",
        "interface utilisateur d",
        "JE{^`",
        "Ejemplo: setup.exe / auto upgrade / quiet",
        "faut suivantes : acceptation du CLUF, mise ",
        "U`Z}%",
        "Moving file [%s] to [%s]",
        ", PBR",
        "Cg'2n>",
        "rH~]]uk*V",
        "\"%s\" %s",
        "installation ne peut pas d",
        "borov. Ak ste predt",
        "Continuar a partir do ponto em fiquei",
        "Q*z@O",
        "Php+A",
        "ki unos potreban tek kad ra",
        "B<\\xr",
        "r{H.~",
        "4PFOW",
        "3)_>u",
        "SVjrfV",
        "HJgADx",
        "KsijQ",
        "0.~pE",
        "Q00Cy",
        ".?AV?$CAutoWdsLibFree@PAG@RAII@@",
        "L30'Z|",
        "7on^a",
        "si utak ",
        "Bryter: / Postrollback <plassering> ",
        "v-Stj",
        "        loadFrom=\"%systemroot%\\system32\\combase.dll\"",
        "S&NXp",
        ">zjgW",
        "u2R{1O",
        "=kl\\W",
        "VWPj)Z",
        "~YW>E6",
        ";0;l;",
        "Y?l7+",
        "Na primer: setup.exe / auto upgrade / showoobe potpuno",
        "^-0TI",
        "[yBiz",
        ".qYv6",
        "a&lej",
        "q|D8Y",
        "kIyGF",
        "Wpufo",
        "@QVrq",
        "um85Nk",
        "]oN<bl",
        "6ha0k",
        "x(:H\\K]",
        "v|obn",
        "tGkIs",
        "GetSystemWindowsDirectoryW",
        " a sou",
        "trx:w",
        "?&rj%^",
        "gNOHr,g:N ",
        "IdZPy",
        "86\"&PH<",
        ">JdFF",
        "M*\\ K",
        "'K7Yf",
        "l2a!X",
        "~/Y00",
        "#@0UB",
        "),]sM",
        "K)-#n",
        "$:YB`7v",
        "4c#vS",
        "]%`4>",
        "#BAw\\ ",
        "K.?G+",
        "~W_H9",
        "DP(zy",
        "j6!f5'",
        "DyL\"gd",
        "K1u5F{",
        "buj ponownie przeprowadzi",
        "_vZkz",
        "T'|Y+",
        "070Q0o0",
        "+#JfF",
        " skriptu setuprollback.cmd: ",
        ",^$[3",
        "wo^:P",
        "7-Sgp|.o",
        "         <requestedPrivileges>",
        "]vWTI",
        "yZ,`p;",
        "stama k",
        "vob:0o",
        "JtT[wBOi;",
        "6b<N{",
        "OGpt-",
        "vyko klaidamNepavyko tinamai prad",
        "N#~vG",
        "N_!&\\~",
        "_%D >",
        "'T4*`",
        "01{R1O",
        "*6ZTlRTl0",
        "ZZ~[]",
        ">!ZZm",
        "is-IS",
        "zom<9",
        " installasjonsmediet.",
        "/h44B",
        ">B>u>",
        "Ph0|@",
        "!BL$B",
        "3D(Cr4Hz",
        "   ppp",
        "gen. Det h",
        "wwUv!",
        "c6ELO/",
        "Toiming: installiprogramm sisestab installiprotsessi k",
        "}%~Qu<}n",
        "&b4p\"6f",
        "L2Bz8",
        "wI>Ww",
        "dha!b<glw",
        " %s-bitow",
        "dajov telemetrie a s nahr",
        "lW(TJx",
        "}F)p,",
        "jOk:2",
        "4_HWG",
        "<\\YFAY",
        "Q+FB+4",
        "xi#p1",
        "tfen bilgisayar",
        ".$+&;s",
        "mUa8]NM",
        ": / noreboot ",
        "2!2,2N2s2",
        "Xd@_O.",
        "GWVVP",
        "J8Aeo",
        "]D9QE",
        "G^[D;",
        ": Enable",
        "            <!--This Id value indicates the application supports Windows 8/Server 2012 functionality-->",
        "$Qh,S",
        "fh2=X",
        "anas programma neatjaunin",
        "p_0PLfc",
        "#D;&xK",
        "qp%vR~",
        "onF-A",
        "I(\"S#",
        ".5~76",
        "Q~*iT",
        "-)Vgg",
        "3?E<nd+",
        "^\" TQ",
        "n@V_fa",
        "(2H7I%",
        "s a sz",
        "3a$K`",
        "(e?+e~",
        "6|jl'",
        "Z4I`%\\-",
        "Start again from the beginning",
        "i\\Vv|",
        ".text$mn$00",
        "Vg;p+",
        "H\\KYo",
        ";,uDK",
        "*Q1\\:,",
        "8W|U\\$",
        "xA-Yc",
        "j&42]n",
        "Vr=/y}D",
        "56t6D`",
        "}a/2=",
        "ciV'B",
        "NXG<m",
        "E0G;k",
        "9FusfYu",
        "pt-PT",
        "bbi paranccsal v",
        "~{(Hv",
        "Lc}Fl",
        "rUWog",
        "BTS##",
        "b+B1)0",
        "p;{WK",
        "Qjlv6",
        "i upgradu",
        "V,[lg",
        "WIMUnmountImage",
        "lTK;s",
        ")2F>'",
        "LU{b0",
        ",K~)A2",
        "R--0eWK",
        "tbTy|",
        "9AP,u",
        "x,L3 ",
        "SdBt%",
        "ewF#F",
        "9!r]lJ",
        "d'i<Ko|Ov\"]8",
        "ke kopirati ili prenijeti komprimirane zapisnike na navedenu lokaciju. Imajte na umu da PC i/ili korisnik moraju imati dozvolu za navedeni put do datoteke i mre",
        "        name=\"riched32.dll\"",
        ";+y$:",
        "BI1Q<+N",
        ":Iq+o",
        "t<eP}",
        ",F9fY",
        "RWel,3-sif",
        "+#5i*",
        "Xc(t\"",
        "BVH..",
        "V[%r]#",
        "kseltmeyi d",
        "VD*,R",
        "FpThL",
        "`-My:",
        "/| cG",
        "!ZzPf",
        "jra a telep",
        "ordinateur atteint OOBE : ",
        "::DhmC",
        "'8F;[*",
        "<w+EPE",
        "6S$G_q",
        "a, mas quer que os usu",
        "wII<E",
        "J')^i",
        "-&G0m",
        "1O\\|&w\"",
        "Oljl.",
        "ji*({",
        "o Windows",
        "'HU[p",
        "|A.2!",
        "_$'Qr'",
        ":+56P",
        "'nL0(",
        ".yF>k%}",
        "LZLFxKO",
        "ri). ",
        "4/-L6M",
        ">\\{?!",
        "w=s=Z",
        "ned ettevalmistused",
        "qQ-MUv",
        "Failed to clean MoSetup Volatile key, Error: [0x%X]",
        "UL%0.;",
        "LX1/N$h",
        "Parametreler : Yerel a",
        "ytkownika dopiero po pierwszym uruchomieniu (w trybie OOBE), nale",
        "<X>'?",
        "&Anterior",
        "\\JurnaleUpgrade",
        "\")2WO",
        "wz~69}",
        "^E09x|j",
        "rii, dar ",
        "g|eLF",
        "F]zLKD",
        "cHIIIYY",
        "3r*`r",
        "EtM=s",
        "CDlpTask::GetWorkingPath",
        "mqL]~",
        "bbbc#",
        ",[oIiu",
        "1Tc@!",
        "EnterCriticalSection",
        "o3SECU/0",
        "r>~+3]",
        "+R]7Lj}5",
        "EEtnN",
        "2dfBU'",
        "Du5f!4",
        "Valitsin: / installdrivers <sijainti> ",
        "UeK|JM",
        "Nbiik",
        "'LlRs",
        "zlJhVY",
        "3M'jz",
        "rs: setup.exe / auto clean / installfrom d : \\mans_Wim\\piel",
        "Tat20",
        "rQ`l_",
        "7<@%n",
        "nd@%A",
        "(+}Uc",
        "hxN?5=",
        "lT_.Z7",
        "Koristite drugi instalacioni disk na kojem pi",
        "oWw: ",
        "L'K~\\",
        "tNi8KX",
        "nEe{9",
        "QO;.A1{m",
        "|f 1m)bQT",
        "r das %s-Bit-Betriebssystem. Beim Einlegen des Datentr",
        "fGm@#",
        "x_r1|",
        ")yIas",
        "FdNYn\"9",
        "\\##$'",
        ">r#!U",
        "Detectamos que la instalaci",
        "q$gN<",
        "030l0",
        "llyel ",
        "i46EV:",
        "HV(km",
        "5X|ZpW",
        "WIMInitFileIOCallbacks",
        "BoxMovePath: Target path exists [%s].",
        "B&)y}9",
        "ZlsOlAd",
        "fw)*n",
        "^dz(>+x.{7",
        ").44w",
        "lna po",
        "szleg g",
        ")^;j{",
        "d$B7h",
        "I!cak!y",
        "lq>81",
        "$L\\%E",
        "HAB% ",
        "]UOjI",
        "Installasjonsprogram for Windows 10",
        ";>=W^",
        "jao-4I7",
        "Hq@_GZ",
        "Wf0\\vr",
        "|v&QP",
        " ho pou",
        "X3Z%p",
        "{5yv_o",
        "gKV2m",
        "_hG d",
        "tUrR4qb",
        "Igv!$0",
        "@Cenh",
        "E.%TI.",
        "ende brudd i nettverkstilkoblingen. Pr",
        ",=Ig 9",
        "j}CE}",
        "v)jWoV",
        "Windows 10 Installation'Windows 10 Installation k",
        "/!$7{,",
        "o\\#,n",
        "`\"hg{l",
        "righet kan saknas att kopiera till s",
        "<3<LO",
        " ir fails pid.txt. ",
        "0Arkitekturen du valde st",
        "5/.DHXB4",
        "'zE$:CcSX",
        "{lFi%}.`M(",
        "cM1,a3",
        "`l=n${",
        "$@fq ",
        "5{vd,\"",
        "jjjjjj",
        "lt oQ",
        "6_K_u",
        "\\hRZv",
        "~=$`.:w|",
        "$0Xd3c",
        "Fkg_[",
        "SP_DOWNLEVEL_UM_ETW_SESSION",
        "QbCB%",
        "rmalar",
        "|,;P[j",
        "hT?CI!",
        "MdZ\"F",
        "}5sUL",
        "GT/#,",
        "r / showoobe er satt til Full, m",
        "yet. Pr",
        "tor automaticky re",
        "DPJn+",
        "xh<3^",
        "&Voltar",
        "sK-81",
        "2Tr+|",
        "ivitys on k",
        "_qqf9tUo",
        "Iw.TJ",
        "w}i;F",
        "Valitsin: / Postrollback <sijainti> ",
        "*g_F.",
        "}\"shO",
        "8=j*qZ",
        "LegalCopyright",
        "5(5C5z5",
        "? e-*",
        "04to!z",
        "pqxQF5",
        "x(<),9g",
        "Parametreler : N / A ",
        ":q%**=",
        " BD@B",
        "IiB&e",
        "#aOm[",
        ",3'K`",
        "j([nv",
        "=T9:0EO%",
        "X;3Q,J6",
        "hpY*0",
        "E=(i=",
        "Switch: / pkey <productcode> ",
        "S34(l",
        "Y^6M-",
        "\",'L'",
        ";Q}},F",
        "Parameters: Local file path or UNC network path to a file named setupcomplete.cmd ",
        "{G0B$",
        "/SuspendId",
        "a)FKP",
        "ib'/)",
        "|pHYhL+F2",
        "vS.QS_",
        "_%i8Z",
        "5_!NuP",
        "d#v1b",
        "' Dyee",
        "m~\"~l<\\",
        "-B&kdw",
        "^#eUJ",
        "L!knt",
        "j2#}}",
        "n: cuando / PBRUpdate",
        "oC.G$",
        "eJ+e'",
        "I0;&&bd2",
        "1A_M@_M^EB\"",
        "sH0SF",
        "\"xI9|",
        "r\\4H]",
        "6~e!UTN/W8",
        "Jm+&%M",
        "Found ESD file: [%s] [%s]",
        "LU}Bi",
        "Voorbeeld: setup.exe / auto upgrade / quiet",
        "=pJ5C^",
        "0i6;:",
        "a,rD~",
        "H2G >",
        "q \\Se",
        "U6AqCe",
        "lRt`Y@",
        "*y9;v:",
        "CUO^#",
        "t&,H+",
        ",b?uv",
        "g`YL=",
        "BI-$K",
        "            <supportedOS Id=\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\"/> ",
        "J-lCjU",
        "o}}0!",
        "~0\\bW",
        ">sE\\,",
        "PvN)k",
        "HW:\"u",
        "C,-/5",
        "@(;Umy4",
        "ivatele se vy",
        "dn_nJ",
        "X[0\\H",
        "&010n0",
        "gND6G",
        "(h;;=|4",
        "w44p!",
        "G1^!C",
        "*]%I\\",
        "ur(rr&",
        " None, ",
        "Z+~W,",
        "2)nS0",
        ": / Postoobe <umiestnenie>\\setupcomplete.cmd ",
        ".:W~0[",
        "Q)(,~8C",
        ":1ZHv",
        "4f)<jR7",
        "xd7%ZI",
        "=\\;]4B",
        "k@>;z)",
        "(yuA'f",
        "\\`QttX",
        "bi valmistarkvara kohandamise (Out of box experience ",
        ". Tento p",
        "installation ne le red",
        "e a je",
        "B\"R7p*q",
        "pLTIJRjoZ",
        "5ex~I",
        "1~V5J",
        "uIAn{g",
        "`=Q7D",
        "v=>SY",
        "marrez le PC, puis r",
        "Try\\Q",
        "0+0V0h0z0",
        "(lq$v",
        " ics2,",
        "6L_3-",
        "CoCreateInstance",
        "~U1B@",
        ". Jei anks",
        "8QxH0\\",
        "7pGT/9",
        "LAg`Q",
        "A$'AJ%S",
        "+_,\\5",
        "%s: Box file hash matches.",
        "Legal_Policy_Statement",
        "nkt*?!",
        "!BHZ[",
        "(KR2<",
        "loy^>.p-",
        "PhP%A",
        "p>H}L",
        "{f%{f&",
        "WGNwe",
        "M6[e:",
        ": setup.exe / auto upgrade / PBRupdate disable",
        "(8^\"4",
        "7i\"N\\oo",
        "fl K*5",
        "T/BMc8",
        "v88F}V",
        "rnek : setup.exe / auto upgrade / showoobe tam",
        "Example: setup.exe / auto upgrade / postoobe c : \\script\\setupcomplete.cmd",
        "IW`Fu:@",
        "_9aw[",
        "metros : 5 x 5 clave de producto",
        "8d2Vc'L",
        ".MKFr",
        "RjEdB",
        "xQeDn",
        "fxm\"S",
        "!;jbA",
        "=1u+O",
        "N*'?0z",
        "T#/f@",
        "Oa\\;z",
        "S}mh7",
        "*l6%%",
        "%>cNz",
        "tVh8X",
        "+YYn*",
        ">H>O>k?",
        "m:KoZ",
        "O{gx_B",
        "CheckTokenMembership",
        "nhR\\zZFZB",
        "A\":2ap",
        "C^6*8",
        "4m:sg",
        "NVersuchen Sie, Setup erneut von einem Eingabeaufforderungsfenster auszuf",
        "7Z>@B1",
        ");!e\"",
        "rs: setup.exe / auto upgrade / postoobe c : \\skripts\\setupcomplete.cmd",
        "OD^t=2F",
        "Parameters : Local file paths and UNC network paths ",
        "/|]K\"",
        "1#uWw",
        "N#k-$",
        "#W_g%",
        "Qy4?L",
        "q-ZXM",
        "pxD%i",
        "T_T*d",
        "7#)i7",
        "jOm&g5",
        "ki program. ",
        "qnV{pS",
        ": / DynamicUpdate <parametr> ",
        "n7v6T",
        "hh>z&",
        "kuo4q",
        " *XY(",
        "@$.0a;tN",
        "BuildInfo: [%s]",
        ">{tRZ",
        "B27%a",
        "z2H54",
        "8sd^_",
        "v}DU<",
        ",hZH6s",
        "zhVdk",
        "mB0`T",
        "(??UI",
        "[Xg27",
        "prava",
        "_F|ZzR",
        "<M8'y:",
        "|gRg!",
        "r #?E",
        ")Y%x\\",
        "^cIyY",
        "en. Ind",
        "opK8j{J",
        "T\\}pN",
        "CDlpTask::SetParameters",
        "kD;|[",
        "$D #&",
        " bandom",
        "=81og+",
        "1I1=l",
        "%31'mr",
        "Lu1XSo",
        "c(wy\\",
        "D$A+[",
        "ActionCount",
        "cessite de disposer de privil",
        "gk\"JE",
        " _w<#",
        "RRQj-B",
        "PASTABA: ",
        ")xmkm",
        "wcsrchr",
        "tirme arama, indirme ve y",
        "+V-w%",
        "}[$l7u",
        "{;(`0GO",
        "+:J(*",
        "Y~L.D",
        "\\UvTZA",
        "j*|NyK",
        "Q+xXx",
        "#!!r!m@",
        "cowy musi interaktywnie wykona",
        "Actie: Setup start de pc niet",
        "o coletar",
        "xel: / migratealldrivers <parameter> ",
        "_tp8~",
        ">Wa8pM",
        "~:Pwc",
        "kla piek",
        "V-Fnr",
        "'I,Y-0/",
        "q%^nj",
        "I7(' ",
        "|$HSQ",
        "evdyY:",
        "khT}d",
        "t\":.#ul",
        "Ns;$=",
        "JLk96P",
        "[W0~0Y0",
        "\"x*O;",
        "E4.G>t~$",
        "yoJCE",
        "F}V~oe",
        "L$$_^[3",
        "000M0T0Z0_0j0t0",
        "MU2I$",
        "ide: setup.exe / auto upgrade / PBRupdate disable",
        "ve detected that the install is occurring from a network location and may have hit an intermittent network interruption. Please try setup again",
        "xJK/N",
        "U_8M@",
        "{B6>u",
        "uT$jQ",
        "=Hqw=",
        "@8go4",
        "SetFileAttributesW",
        "co-FR",
        "n de 64 bits de Windows, debes usar la versi",
        "uB=^8",
        "EOJmr",
        "1nfar",
        "[8^Z9",
        "n / files.",
        "bL7_4",
        "O'y|Z",
        "uvvf:",
        "xl`Bvprs",
        "U:$U=J",
        ")ns{_L",
        "7^]=O4U",
        "Pravne napomene",
        "o : Automatiza a instala",
        "k&nsi",
        "lus. ",
        " oblas",
        "E#~Av",
        "4QF!:S",
        "#lwfzx",
        "`~+yO",
        "FU.q)p",
        "X}I3U",
        " a Windows-telep",
        "[jKB}",
        "il a termin",
        "^2B:a",
        "Anahtar: / Postrollback <konum> ",
        " til Windows Update i appen Indstillinger for at f",
        "Eun\"?",
        "installation va tenter de faire migrer tous les pilotes dans le cadre de l",
        "VW-F<L",
        "NtqUsWx",
        "JDL@W",
        "D(SSS",
        "ja interfeiss, bet v",
        "Q9u0j",
        "LeW!n",
        "(?e[Z",
        "Por ejemplo : setup.exe / auto upgrade / noreboot",
        "jo oper",
        "MMW|j",
        ";Ov+X",
        "Q<Xpl",
        "k*1)7",
        "^UfAl",
        "O}_YAOAO",
        "a^Z<}@",
        "50HkP",
        "=M>Z>|>",
        "y|pW~'",
        "V#etwd",
        "a2iw!",
        "zy/VeQ",
        "7<stsnz",
        "ky%\\`J*d1",
        "0rO#J$|",
        "&3n=T",
        "67-qNG",
        "c{*R_8",
        "9V\"p|",
        "Conmutador: / Postrollback <ubicaci",
        "}N?n?",
        "y.;B@",
        "Toiming: sisestab m",
        "*tyA_",
        "3uz9n;2",
        "0MIP'\"GL",
        "A{+RU",
        "24t#Hx",
        "Pg`[:*1Z",
        "W\\Z].",
        "MA1.:",
        "v{GR{",
        "D$|PQ",
        ">.8 K",
        "Windows 10:n asennus",
        "_* /w",
        ",6<eKLf",
        "}&\\<N",
        "K(+xB",
        "sy`&@",
        "GetLengthSid",
        "6&ANK",
        ":D)qn",
        "3mzr2",
        "L07i6=",
        "ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp",
        "o de 64 bits do Windows, tem de utilizar a vers",
        "kpub)",
        "C&Ul>4",
        "\"LNmF",
        "CyJg`",
        "V!lX@",
        "dbmw.",
        "o0'f}",
        "Task->Deserialize(): SourceUrl = [%s], DestPath = [%s]",
        " Windows 10?%",
        "anas proces",
        "eeei.",
        "rankos UI ir eigos ekranai rodomi pagal numatytuosius nustatymus, bet yra automatizuoti. ",
        "pBlB}",
        "|Z%=b",
        "V',y?",
        "jt}1z",
        "Zf8l&",
        "A+VTH",
        "_79gn",
        "wa!\\#P",
        "8)~FG",
        "/L]m{",
        "d7mYC",
        "CW m;",
        "Install.exe",
        "wp4Op",
        "A8M]*",
        "\"vu8R;",
        "uNEh)?O",
        "s6+t=",
        "n!r9V",
        ":*nh*D",
        "%(_R8",
        ";i`eQ",
        "'vqW;]",
        "9TWI|",
        "E];o?Am",
        "n de Windows 10>El programa de instalaci",
        "nN0v3",
        "FY`OC",
        "J)YcCb",
        "0NA$H",
        ",AL^ x",
        "Setup voorbereiden ",
        "Bbk/,",
        "ratud asukohast faili setuprollback.cmd. Setuprolback.cmd on kohandatud skript toimingute tegemiseks p",
        "-p?YE",
        "7=!\\_Qz",
        "CBnume",
        "echny soubory ovlada",
        "zvom setupcomplete.cmd ",
        "@3P*!\"",
        "JRw1M",
        "9Hm6)*",
        "CBootScenarioCtrl::PopulateWorkingDir",
        "j;XVo",
        "0jri9K",
        "sjMe=W",
        "!Ymvb",
        "l^.h_{",
        "o: quando / showoobe estiver configurado para",
        "hG,x<",
        "kb1|qd",
        "mL&g ",
        "[s$AjA",
        "&> %`",
        "__set_app_type",
        "jlokat a megadott helyre. Ehhez a sz",
        "m+KX}",
        "pea0o",
        "Bei$w",
        "@@@```",
        "$zIKS",
        "0?c$@0",
        "~=9bK",
        "P}5j6Gh",
        "^']?[",
        "jV`Y7",
        "gYX9V",
        "lImB0",
        "N]c}-4y",
        "Z}43b",
        "Na primer: setup.exe / auto upgrade / copylogs \\Mojedeljenje\\Evidencijenadogradnje",
        "n especificada. Setuprolback.cmd es un script personalizado para realizar las tareas despu",
        "[j1]}7",
        "Ou%8j7",
        "QP{6P7",
        "Y_&}5T",
        "F*<q{",
        "Jra+w",
        "T`wb_",
        ">nEFX",
        "+!#CtE+y",
        "GetModuleFileNameW",
        "zB%}R",
        "DYmQF",
        "$<t|R",
        " DP6#",
        "j{G&yN",
        "\\-A@[",
        "1S3Z3",
        "cR5[8",
        "/K1hZ![fa",
        "r]<2C]\\",
        "ZE>In",
        "/>oj.",
        "M&za27",
        "finie ",
        "_J=S1a",
        "exr?!",
        "*^Yhj",
        "Q`fJ)",
        "|'H\"T-",
        "4.7h1 'G-)",
        " nast",
        "SetupHostResult",
        "re verkt",
        "NvN5-6Q",
        "$|cGS",
        "`v:Y=g",
        "1|IaZxL",
        "d,CAo",
        "[teGS",
        "3*Nq6M",
        "0?&$@0",
        "bUP'I1b",
        "VerifyVersionInfoW",
        "~v ?e",
        "(>D!d",
        "cUv(9",
        "iTdkJ",
        " (OOBE) ",
        "A\"(_' ",
        "kk[xmeeC",
        "9 ~8|",
        "d^<k:G",
        ", KIqZ",
        "x?AYP",
        "XH)Nw",
        "~@oA ",
        "nGMsV",
        "ad: setup.exe / auto upgrade / noreboot",
        "ASA}(",
        "/XJ,%",
        " dados telem",
        "#d_8.",
        "6t[3?",
        "<]5D]",
        "5]d$Epm",
        "8oFOw",
        "1{l3Cs",
        ":^gyD",
        "SPF/CxUJ",
        "\"x^`zN",
        " at PC-en og/eller brukeren m",
        " Setupcomplete.cmd ",
        "Toiming: kui installiprogramm teostab OS-i alltaseme toiminguid, ei taask",
        "6,#ed",
        "? Hy/",
        "Q&%<;d",
        "~Hwe}z",
        "&Naprej",
        "C?Cmw",
        "P,J;9",
        "ne\"rUrC",
        "C7s(.",
        "^4,<y",
        "Psp[o",
        "(U~{?O",
        "mxz]b",
        "4YyC:",
        "Y%GEf",
        "Process termination succeeded!",
        "B:5CpA3",
        "@vh*)",
        "anje. Ne uporabljajte ga v proizvodnji. ",
        "marrage du PC. ",
        "dmRLd",
        "it po",
        "UP#Gi",
        "?\\V?3",
        "96qx:",
        "jUeYWq",
        "+[1rj",
        "Konfigurer",
        "BfAlH",
        "Rl'(P",
        "m9nm,+",
        "m.4u`",
        "`38w8",
        "[qnOCo",
        "Hfd6L",
        "liti: / PBRUpdate <parameeter> ",
        "surea abil saab juhtida kogu ",
        "pHKXI7",
        "] 5~?",
        "ICu~MY",
        "Azione: se l'opzione / showoobe ",
        "r kopierar eller laddar installationsprogrammet upp komprimerade loggar till angiven s",
        "8H|2$",
        "ica je najmanj Windows XP s servisnim paketom SP3.",
        "Y[|`a2",
        "=2=K=R=X=]=h=r=",
        "2oEyC",
        "^5(*g]",
        "OfvQB",
        "ite, da v primeru neuspele namestitve za",
        " en ejecuci",
        "z. _l",
        "k+o%?a",
        "WeN\\OW",
        "GzzzhhhWW",
        "V<e14",
        ", namestitevni program med name",
        "Ex-b/+",
        "%1wH6O",
        "t:(1x@}",
        "haw-US",
        "RZ`&@",
        "y`s6t;6",
        "%~/DK",
        "m}q1e",
        "`C|Hj",
        "0FW@i",
        "f{7\\'w",
        "OY06X",
        "}QPA{7",
        "yBkK^",
        "mL'j,",
        "H[x<ED",
        "T9}*-",
        "Rhorbx",
        "ri{n1",
        "]{=s[",
        "lvB[[",
        "%nqU\\c",
        "fv_`v|<",
        "dzis: / installfrom <atra",
        "ier .wim anume",
        "<P3.f",
        "nssnittet ska visas, men hon vill att anv",
        "?YGhy",
        "mZM/[",
        "^L{gS",
        "#u\",!%;",
        "2hmhk",
        "nE:0l2",
        "[?I/u",
        "- XML ",
        "sKO-/",
        "?OH,%",
        "ivitada",
        "ho adres",
        "W0~0[0",
        "Lx\\'O",
        "<@>G>d>n>",
        "v}$=m",
        "I9zWk@",
        "0)R(uq}",
        "G2bga",
        "7:<&:",
        " (47K<X",
        "\\}#bri",
        ",Ac?;",
        "Tf\"U=",
        "(3SY#p",
        "%qK_]",
        "!g0Aj",
        "Ea}O'5",
        "~(u7b",
        "XcD~bh",
        "ahovanie a in",
        "I3\"MIc",
        "9t'Td",
        "_XivZu",
        " #=N7",
        "042704B0",
        "rs : setup.exe / auto upgrade / showoobe full",
        ").>1r",
        "1usv1",
        "\\c;ru",
        "ile de nivel inferior ale sistemului de operare. La urm",
        "v3zq!",
        "buj jeszcze raz uruchomi",
        "Voorbeeld: setup.exe / auto upgrade / noreboot",
        "s<jz_",
        "wH\\fgi;iw",
        " 232 ",
        "&Valmis",
        "H-accek",
        "5lwjAP",
        "Parametere: Enable; Disable ",
        "*\"uN2",
        "hine kasutus ",
        "Parametere: Full; None ",
        "~)4?d",
        "Guh`*R",
        " izdelka v obliki zapisa 5 x 5 ",
        "V'|Nvk0",
        "SXvJr",
        ";ijl ",
        "`pLylN",
        "_O2,P<",
        "^q,?Qk^l",
        "h&\\nFs",
        "RNHwNAy",
        "a]~+4",
        ":%:=:y:",
        "HMu.<",
        "sr-BA-Latn",
        "^l,2@",
        "a, Atualiza",
        "!-@L7+",
        "letet, ",
        "Ds:y=",
        "\\&<ze",
        "invite de commandes",
        "darykite ",
        "&[?^_",
        "DC=\\:@",
        "~<k*7?",
        "^pc2M",
        "anas programma turpin",
        " je spu",
        "Nbh`^",
        "bErv^",
        "HAj \"",
        "dZmJI",
        "t2\"&h",
        "eVWOId",
        "yR aHg",
        "WjUBe",
        "T+4/[",
        "@ O_(",
        "KZLs7",
        "ppp   ",
        "?nK(v",
        "5|m6o",
        "r.YO\\R",
        "^P,yO",
        "J:`1z",
        "3d_.1",
        "c8Z!a",
        ".w.t,",
        "/(Ym?-",
        "6dXOZZ",
        "J,pc$O",
        "zNcbb",
        "OFS=r",
        "-W1vdm",
        "$d}&jL05",
        "!^Rib",
        "C?@N~",
        "Nj:.o",
        ".2!\"AH",
        "Mg\"y+0",
        "Btps'",
        "\\kIcW",
        "W}}=ATT",
        "Jx\\+.y",
        "'iFS|E+f",
        "#M]_W",
        "CWebScenarioCtrl::CreateCommandLine",
        "He/CWP.",
        "li poprzednio uruchomiono Instalatora z katalogu lokalnego, ponownie skopiuj wszystkie pliki instalacyjne do tego katalogu i uruchom ponownie Instalatora.",
        "B@Q)N",
        "{8;K;SY",
        "hb{j7Y",
        "CbKwl",
        "o pode querer coletar registros e outras informa",
        "le&ri",
        "\\RaN.",
        "R(A|q",
        "K#xv}",
        "KMvnU",
        ": / migratealldrivers <",
        "-$Q,Y",
        "j:Yf;",
        "j%'^H",
        ")EY9$W",
        "}Ert9",
        "0XmlG",
        ">yX&m",
        "FE.n6brq",
        "v1_;D",
        "se,~~",
        "FFD1@",
        "hERRq",
        "0F~s$",
        "np@IIn",
        "me, elle peut ne pas ",
        "b|q! j",
        "|Pyoj",
        "B!NkB",
        " All, ",
        "finie sur d",
        "altinio laikmenos viet",
        "[|!0,",
        "G@i!(9B",
        "DU4P5",
        "]h}W.",
        "sZVyD_>-w",
        "o com a designa",
        "W]^Koc",
        "k(mS(m",
        "wAOq%",
        "jimas taip pat apima ",
        " J'?8?",
        "WYUF<?",
        " musia ma",
        "*be)Z",
        "Qz#i7",
        "liti: / Postrollback <asukoht> ",
        "o / files ",
        ";-;8;Z;",
        "#@IDp",
        "c4n~}H#",
        "MwJ;g'",
        "->mCa",
        "*u2GJ",
        "d21O+",
        "T=Cy&",
        "0@e$@0",
        "9O:x:",
        "uzkd)M",
        "MD;=i%",
        "7'_(4",
        "Bb4pw)",
        "l98D)",
        "AzHC\")J",
        "\"~Ir#",
        "AoaQ[E",
        ".U_%F ",
        "K\"T 0",
        "PPQhp",
        "9+P5o",
        "q|2,v#",
        "k*7oj",
        "\"3^FF(",
        ")|jeuo",
        "'0i3Q",
        "ARABIC",
        "kaz sa sp",
        "-j,*x",
        "Commutateur: / auto <choix de migration>",
        "\\Y??R",
        "rj}2p",
        "{\\#L]",
        "jI~WuUr",
        "bi/`Ls",
        "  wdscore.dll",
        "`G4zH",
        "Zqu_$b",
        "(nRF&",
        "Kz<*<<K",
        "c1Zh~",
        "iK`o!",
        "Parametrar: All; None ",
        "@zhER",
        ":F:W:\\:b:",
        "A$?dW",
        "Vo-AK",
        "#naX(",
        "n parte de la misma. ",
        "#w%\"?",
        "#hW%gOJ",
        "#YhV}",
        "1h7O@",
        "ni parancsf",
        "\">%4f",
        "::3u~",
        "DfOmr",
        "jw2+,5",
        "kipvb",
        "-67KX:cA",
        "}OqQ*q",
        "E%oQG",
        "LeaveCriticalSection",
        "Indstillinger: produktn",
        "D|]g&'T",
        "Tr/!Rs>",
        "i1LD;",
        "tXrJrM",
        "V<bs$H",
        "D7:rR",
        "Global\\Microsoft.Windows.Setup.SetupCln",
        "+:f\"^r",
        "Aa+ApB",
        "7NaHJJ",
        "n'HSA2",
        "J&D+A~Xg:",
        "lB|$s",
        "XVy4]k<Kos|",
        "o[LPp+3.U",
        "iE3WTW46o",
        "yW6)*",
        "2]5=4y*:`",
        "q\"+@F",
        "&~}/#I",
        "iama ir nustatomi numatytieji komponent",
        "u#CAQ;",
        "jI\"L1",
        "FMU'I",
        "):,x0",
        "Dq3sR",
        "Esimerkki: setup.exe / auto upgrade / quiet",
        "[V,lO",
        "7.<(;j \\",
        "BJ9+9",
        "HZi$q",
        "?vrGF",
        "$.8{D~",
        "@`b`&",
        "/8cbA",
        "o e tente novamente.USe instalar esta vers",
        " jednou spus",
        "R/Pm7",
        "WY}lb",
        "i:KQ<4J",
        "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9",
        "lh67;",
        "Detected existing websetup mutex... exiting.",
        "*a9|_",
        "Windows XP",
        "Ytb>d",
        "kX*_A",
        "1!1v1",
        "?#kO k",
        "        need not contain KnownDlls since those are always loaded",
        "fn]Fp",
        "W[9j ",
        "b<0pQy",
        "G-']#",
        "kO]Gxw",
        "sqkf?y'",
        "i{g;%",
        "7\"_t(",
        "!D20cb",
        ")W;dB",
        "hl}G5)",
        "d($-5",
        ".E'`Q",
        "a[;./]",
        "ms-BN",
        "laties beigt darbu?,Vai esat gatavs instal",
        "velet: Ha a / Telemetry ",
        "ar-IQ",
        "zp#j_\"wR~",
        "fy$.f",
        "PRRRRRRh ",
        "]om%j",
        "ppp@@@@@@@@@@@@@@@@@@@@@```",
        "_9B9c?",
        "q(a=W",
        "Actie: hiermee wordt het bestand setupcomplete.cmd 'ge",
        "Yz+T)",
        "p+]{5",
        ":M%I.",
        ":],/+h.0",
        "`)}25",
        "F@bc ",
        " et les composants sont d",
        "R]+JE",
        "!]>$mnG",
        "xnsEP",
        "?E=7)>PQ",
        "$C_^A_",
        "{\\G{w",
        "^rqc~%",
        "sU\\]E",
        ":AgxT]",
        "VERSION.dll",
        "7 >nl",
        "ho umiestnenia. Po",
        "'H4Q3",
        "non-admin",
        "e pour orchestrer la mise ",
        "DUDownload\\Cab",
        "p:M\\p",
        "Veiksmas: kai / migratealldrivers nustatytas kaip Visi, s",
        "$,@Vf",
        ",|Pc,",
        "lb;p6W",
        "BEm5^",
        "B+[9b\\.",
        "berpr",
        "ka izku",
        "rnek : setup.exe / auto upgrade / PBRupdate disable",
        "mK0qW",
        "_-(t]X",
        "7~u_@'",
        "oID.^",
        "?we7/_6",
        " flere oplysninger.",
        "?goPs",
        "urt#Z",
        "*&i_ ",
        "mas Windows versija netiek atbalst",
        "oO474",
        "n7k9:",
        "2>rO:",
        "R08Ic0",
        "]&z7<",
        "VN~d,?",
        "h!mJe",
        "O&|jb",
        "Setuprolback.cmd ",
        "fO=G7)V",
        ".>#Mf",
        "marrez votre PC, puis r",
        ":pdK1",
        "q}3-Oh",
        "T\"mD`",
        "{i3I'",
        "q%y<E",
        "afy(k",
        "oQ09@$",
        " *=vw\"C>^",
        ". Setupcomplete.cmd est un script personnalis",
        "@.q`H",
        "S.A/L",
        "c]{kn",
        "chten Sie den Vorgang fortsetzen?",
        "=/.=%",
        "SG2w'",
        "\"/U#|h*",
        "1<1\\1",
        "Uwzh{",
        "JjU@=",
        "Wez{_",
        ";1;8;",
        "e se automatski ponovo pokrenuti.+Nije mogu",
        "525?5F5q5x5",
        "9soMr",
        "Lhn5f",
        "Voorbeeld: setup.exe / auto upgrade / migratealldrivers none",
        "\\1LN2",
        ">[g^sE$",
        "em3Ml",
        "&Pirmyn",
        "K0Y)uA",
        "'g=f6",
        "s{6js",
        " den angitte plasseringen under installasjonen. Installasjonsprogrammet s",
        "tAV_xI",
        "U~7XJ",
        "rj!OTuK",
        "Pripravi",
        "GetLongPathNameW",
        "/>$$@0",
        "z[DC_0",
        "C'(|c",
        "*`>+Z",
        "#A.0T&",
        "o para o diret",
        "l{jdM",
        "?&?6?i?",
        " WindowsL",
        "]H>:'N",
        " (tu`",
        "%s: Failed to Detect Resume Mode. Assuming not in Resume mode. Error = 0x%X",
        "m]#uq",
        "|Q\"Ij",
        "'WR{1",
        "B[ C{y",
        "yzrox",
        ")?#$f",
        "-%Y*m",
        "hwV\"_",
        "uje da nakon pogre",
        "RxiMV5",
        "<f&pQ5",
        "KillTimer",
        "0sz1+",
        "]y/$3q",
        "h|fdH4>\\",
        "+ma=m",
        "T_(=q",
        "Parameter: NV ",
        "V%pA=",
        "Oi.2r",
        "/$I[GUr",
        "E!\"bB(",
        "?&<{_C<7~",
        "\\UjP`u=",
        "[lgZZ",
        "e prona",
        "x`]wZ",
        "bas. ",
        "-Q+NDjm",
        "MN)wI",
        ":F'T?",
        "qa[W2Bcu",
        "4<GOb",
        "SEgzy",
        "&v;Zlb",
        "CDATA",
        "tGH\\S",
        "Bg>Rv_",
        "7sg_{V$",
        "4o]`.",
        "j&=_3",
        "Dvh3N",
        "{W8i}}S>",
        "/Q2Sh",
        "n medii de testare. Nu ar trebui utilizat ",
        "U:tCl",
        "L;#KTP",
        "CSetupLangIniLoader::Initialize: Failed to get the language information: index = %d.",
        "In3KR",
        "B1g)un",
        "] B5!",
        "G8u%j",
        "kler veya y",
        "kdhd~d",
        "e{#>:",
        "8dZ0+Y",
        "1j\"]G",
        "R#F|<",
        ";!C@{",
        "3$333D3W3g3w3",
        "}3/eR",
        "ed:!]H",
        "7t3/7",
        "_ y+P",
        "I4?(EiVo",
        "rexcl",
        "vZ'US",
        "nda, son kullan",
        "t Windows uzst",
        "J/&JP.",
        "!#ql]j",
        "D/19k",
        "{ g]Gfn",
        ",t5e;kj",
        "*]7Wd",
        "%Up/L",
        "$X[).[",
        "_bVM3",
        " : / DynamicUpdate <parameter> ",
        "!{#9y",
        "?;%a'",
        "Global\\Microsoft.Windows.Setup.Rollback",
        "ux-F|v",
        "Y;<+&o",
        "[B}ZlP^",
        "W((f<",
        "I(#``",
        "P_N6a^",
        "MY-8-",
        "X*YWm|",
        "{3[UR1",
        "dvj;=",
        "lFY]R",
        ",X#nl",
        "Z+lhe",
        "gy lehet, hogy nincs enged",
        "m77eN",
        "Conmutador: / auto <opci",
        "u6VVhT",
        "4tYS6",
        "Cyxkb",
        "C(;zf",
        "100701213655Z",
        "8?`Jz",
        "RollbackOnline",
        "2 2L2",
        "PW+nB",
        "st ind",
        "\">[lO7",
        "8Z9e9",
        "za%$-",
        "vr:Xu",
        "aygE8",
        "es). ",
        "oag++",
        "LP{)D",
        "5XW,'",
        ";:(Hh$",
        "terek: Enable; Disable ",
        "JuqSM",
        "WQ:e\"",
        "7&GE%",
        "_!/0B",
        "}:?nC",
        "e&1N1",
        "er. Den b",
        "JKPyw",
        ")KRrl",
        ". Ominaisuusp",
        "^B*UL",
        "b*%]L",
        "system32\\cabinet.dll",
        "=^^eI3",
        "KLX__IY(",
        "rv%{d|",
        "G/Utb",
        "CDlpManager::CreateResponse",
        "u6:s4",
        "u0;<$B",
        "/OR/@#",
        "@m<e~g%.Y",
        "k, hogy a telep",
        "U%/9(",
        "=rsBc",
        "tOi;L7",
        "ZAe^]",
        ",t6SG",
        "0|(YH",
        ":tyOc&",
        "}ZR~;",
        "v1vA~",
        "D>'94",
        "$&e -",
        "api-ms-win-eventing-provider-l1-1-0.dll",
        "%p+eM",
        "iqU; ;",
        "=CJZ%",
        "7an<6I",
        "x\\(s'",
        "_|s?|O",
        "KU_|#Q{}=",
        "&:-0Y",
        " program se nespustil spr",
        "ch5&GP",
        "BGi\"a",
        "p)lU{",
        "zVwc5q",
        "MySMM",
        "@o,rY[",
        "oTMx@",
        "5&_M5",
        "r>ma+",
        "j% [/",
        "mWOuR",
        "js8PJ",
        "EzDF.",
        "2rCoD",
        "*X]a5coT",
        "1.`='",
        "Radnja: Ako je / Telemetry postavljen na ",
        "{sw{/",
        "Al!yM\"",
        "D:~Uc",
        "^9>mKz",
        "}+|+}q",
        "D<N`:",
        "_<o{}",
        "t1C<\"",
        "NyU=g",
        "CheckFolderHierarchy",
        "*~T ua#",
        "hc>`N",
        "-YVy6",
        "b&&|3**",
        "v*}$s",
        "/ PBRUpdate ",
        "M-u|'",
        "s du fichier local ou chemin d",
        "vqC\"SB",
        "ni, de az els",
        "|C05i",
        "Y<,L-",
        "S:.\\b",
        "({}~1",
        "iv zb",
        " till %1!s!. Vill du forts",
        ".U)4&|",
        "&9h@Ec",
        "RW0f0",
        "t&rG@",
        "ier denumit setupcomplete.cmd ",
        "1Ch_s*",
        "oE,vc",
        "\\AF9)",
        "NAPOMENA: ovo prebacivanje treba da se koristi isklju",
        "Y0f`]",
        "|4nfj",
        "V]z~n<",
        "WXFannU",
        "(5z>b",
        "5j~'(~",
        "kZI?oH",
        "ActionName",
        "}:hTyl}",
        "qvr;$",
        "y)]`O",
        "+4@WbI",
        "H>}yS",
        "njecteerd' vanuit de opgegeven locatie. Setuprolback.cmd is een op maat gemaakt script waarmee",
        "2bVg^",
        ":#:=:t:",
        "D^zo82u",
        "Conmutador: / pkey <product key> ",
        "J.EUlx",
        "+suac",
        "9j@#-K",
        "a?_8Z0",
        "CUUeYfO",
        "~Zds{J",
        "rca telemetria generat",
        "tjV57%K",
        "./ELN$^O",
        "TJF_9",
        "9[IE%",
        "sA8CK",
        "t&H&&",
        "lgende kommandolinje instruerer installationsprogrammet i at aktivere setuprollback.cmd-scriptet efter en installationsfejl: ",
        "uUF?R]",
        "Oc0.M",
        "Q2,T?F~",
        "n, pero s",
        "<XdD?",
        "X `}Nr7",
        "-z]qcW",
        "o. Este par",
        "PPPPP",
        "0U0u0",
        "CDlpTask::GetFile",
        "yet p",
        "quando / PBRUpdate estiver definido como Enable, a instala",
        "_yCq,",
        "/b;r?",
        "L}k(ka<",
        "$XNU(",
        "HSK#M",
        "v_Q>qaJ",
        "VL(A^",
        "tres.",
        "rm:-I4",
        "$nOH^L",
        "Koristite drugi instalacijski disk ozna",
        "_mIMq",
        "0OfZ~l",
        ".lo+@A",
        "Eksempel: setup.exe / auto upgrade / migratealldrivers none",
        "nd / migratealldrivers este setat la valoarea None, instalarea nu va migra niciun driver ca parte a instal",
        "i testov",
        "D+|U3",
        "q-;vq<",
        "Wg7O(FK",
        "lx\":<",
        " o^s=",
        "n insertar",
        "~5B3L",
        "z|t1I",
        "Br8uh",
        "|~8zcdb",
        "L}R-i1",
        "Twvd,H",
        "`/+=E",
        "Konfig.",
        "RtlAdjustPrivilege",
        "v+<mJp",
        "K(~@\"^",
        "?!/H;wG",
        "Bv>YM",
        "4WZ-m",
        "4]\"RY\"",
        ": setup.exe / auto upgrade / copylogs \\MyShare\\UpgradeLogs",
        "Eyyq4uc",
        "{%Y+Kv",
        "installation de Windows 10&Programme d",
        "b\"\\\\{",
        "gsta version som kr",
        "x$`3r",
        "lU6F<",
        "V\\I}i",
        "`BPy^Y~AAn>(7",
        "'>hHH/H",
        "uUYA)",
        "em PC-ju. Primjerice, ako PC koristi 64-bitnu verziju sustava Windows, morate koristiti 64-bitnu verziju alata. Poku",
        "=I-Kz",
        "es-UY",
        "cgpgU",
        "U1%44",
        "fnrJ(jV",
        "p4%uf",
        "yhms4",
        "zoB8[DQ1B",
        "brXo!",
        "y\\P[i",
        "Senaryo - Tabanl",
        "\\'9nn",
        "N*U`s",
        "o: automatizar a instala",
        "fq0X$",
        "_.uG+",
        "\"&k=&c",
        "%qs{b1",
        "G9o+Z-",
        "gR5#S",
        "Z}:H;",
        "WcQ/&5ll",
        "im naredbenim retkom instalacijskom se programu nare",
        "w .inf",
        "QP4=k",
        ",0Tz4",
        "O+`(U?s",
        "[KwJL",
        "L$$Qh",
        "Zc[PS",
        "}u0,U +",
        "(#&9CK",
        "5+At\"c-*",
        "CSetupLangIniLoader::Initialize:     Media number      : %d",
        "M]9lC",
        "]r0~h2",
        "; <@<M<e<",
        "ene lokacije. Setuprolback.cmd je prilago",
        "@[$^~",
        "t&\\\\ ",
        "9bn8b",
        "nJ.2!q",
        "7u^d@p!",
        "..WN{",
        "t6d!%",
        ";kCMx<",
        "]k=&\\%:4",
        "1,0*0",
        "ivitada ja veenduge, et olete valinud ",
        "rnek : setup.exe / auto upgrade / noreboot",
        "9t$$t",
        "rNo]E",
        "!4#6s",
        "|*|1=4",
        "sob migr",
        "i$v;b",
        "t0<9}s",
        ":bvQU",
        "Yke !",
        "Yr6A3U",
        "Parametry : Upgrade; DataOnly; Clean ",
        "TuKge*R",
        "XF20B",
        "{U,}m",
        " cesta UNC k s",
        "mfF7b",
        "aKX g",
        "=]j.:",
        "Gkfc~3",
        "leXQu",
        "~X\\)#",
        "G+}:a",
        "*/lp8",
        "0_04X@bn0Y0y0f0n0",
        "yAGfvi^k",
        "D,7i9",
        " PBR-",
        "T/^6&",
        "%.!T`L",
        "f`UXs",
        "$.lkb",
        "2j. s",
        "c8~K;",
        "nYa,jmY.",
        "ovat?",
        "&Notiek gatavo",
        "me est survenu lors de l",
        "'s+uj",
        ", ka datoram un/vai lietot",
        "Exemplu: setup.exe / auto upgrade / quiet",
        "e ni prvi",
        " Operating System",
        " Action : Le programme d",
        "\"9KT#",
        ":':O:d:}:",
        ">nSz4",
        "hYjl1",
        "f>cD6",
        "kega vmesnika",
        " tilbake til %1!s!. Vil du fortsette?",
        "9 s|4",
        " a ser executado.`Esta vers",
        "lla gr",
        "```PPP",
        "S*9fy!",
        "YbzFEzaK\\ ",
        "Z`#?-",
        "C?@:Dz",
        "5(e8`",
        "K)+tHY0]",
        "DcYw,",
        "O:dF-",
        "s}8>'p9",
        "nima requerida es Windows XP con Service Pack 3.",
        "-Obi>",
        "ni putovi ",
        "h8*>e",
        " el PBR. ",
        "rksstier ",
        "Q]6LK",
        "h,`g0",
        "erlerine ayarlan",
        "ndaren loggar in. Den k",
        "22272<2A2F2K2P2V2",
        "=1]e_",
        "M;}C?A",
        "[@2G~",
        "tt>)B",
        "q.il8(",
        "(OrR$",
        "MF}I^",
        "pe%Cr!\"y",
        "U\\Ubacl",
        "xKN!}:*",
        "CDlpManager::SetWorkingPath",
        "h4rq3",
        "xazU!",
        "AI2*d",
        "6JtN-&",
        "cie systemu, wi",
        "<r/b/@",
        "ppp@@@@@@@@@@@@@@@```",
        "}qL 8 ",
        "z$89,",
        "Parameter: Enable; Disable ",
        "lreiz no komandu uzvednes loga",
        "~[b#I16",
        "`b*Pw",
        "<2K\\*",
        "q^:I]",
        "H\"\\%7",
        "5hPNJie",
        "6KTM,l}9tL",
        "VpWR \"0",
        "kzf*$b",
        ",UFaV",
        "a relacionada con la instalaci",
        "com suas configura",
        "Szenariobasierte Verwendung ",
        "[:[fr",
        ">$FMy",
        "gV:(1",
        "[>WO,",
        "'zqJk+v1",
        "Jw5MX",
        "E}vSQ",
        "0mQ$*",
        "u|zFt",
        "it^km",
        "A|cpbP",
        "9rs3r",
        "7S'(K",
        "oikeuden tietov",
        "rNI+7W",
        "xN>f_m",
        "')?W-F",
        "m-z5g",
        "AqI|H",
        "$Cnlzh",
        "ts %s bitu. Kad to ievietosit, Windows 10 uzst",
        "JL1hR",
        "R8/jzl",
        "K08*i",
        "Q=EoW4",
        "j33D3",
        "iQk d",
        "!oVYB",
        "Paf+X1",
        "Parameter: Lokale Dateipfade und UNC-Netzwerkpfade. ",
        "?5kU_",
        "jz9]c6",
        "| 7pPn",
        "t9[*x",
        " suorittaa ty",
        "hbxrP1",
        ">5Ewj",
        "]kr0r:w",
        "q|ve@",
        "JKiXI",
        "mA_L.",
        "8DC9@@",
        "tZ\"YW6",
        "l<]`4>r",
        "Primer: setup.exe / auto upgrade / noreboot",
        "$hNy+",
        "uSVQ[s",
        "5JCst",
        "4.mfe",
        "`-,}?",
        "zftgfe",
        "6,oXkx`",
        ".ljMlx",
        "D)0Ij,",
        "?b},T",
        "++oKX",
        "bsLK4",
        "+riZ]",
        ">E>S>\\>a>m>y>",
        "i aceast",
        "17Y!(",
        "zASz'4C!",
        "PWPPh",
        "0OI>{@Y",
        "TpzZ;",
        "*=]U]U",
        "PEV$m",
        "mn-Cyrl",
        "Na primer: setup.exe / auto upgrade / pkey ABC12 - DEF34 - GHI56 - JKL78 - MNP90",
        "H9<{`oD",
        "m`Z?I",
        "~$/Cp",
        "r]g76s",
        " !\"\"\"#$ &&&%%%%%%%",
        "o5Aou",
        "ScsHkCf.-c",
        "BnD-ev",
        "#ir^T",
        "LocalFree",
        "t,jkX",
        "B>p6x",
        "tfCIF",
        "Y<^*spA",
        "Upa%J",
        "\\k>7?",
        "ver interagera n",
        "/r:Iu",
        "J~4gaff",
        "?i3EI",
        "U-cZt",
        "HyAqUxk",
        "OR&S]",
        "\\\"}*q",
        "#`HZb_u",
        "Bo'=7h",
        "GORV/qP",
        ",Fujg&u",
        "].UB[XB",
        "<Q8Mf;DW/",
        "6FXP/",
        "::&cA",
        "6yUIYgL",
        ".?AV?$CDlpAutoLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@",
        "A8I_2JB\";K",
        "$$%9cJ",
        "Nabavite",
        "44t,v",
        "EZ-2**",
        "+~qWm",
        "2YsoD",
        "RY.ED;b",
        "installation de Windows 10",
        "e0UnP",
        "v, Lv;",
        "/vc-`",
        "(xI,t",
        "Mgm|$8",
        "}D)w&",
        "r%y>B",
        "\\._aEn",
        "#qbfsG",
        "OnZT^",
        "X[x[@",
        "UM1-'b",
        "U}y\"?",
        "setupplatform.exe",
        "GH9_ t]",
        "/0XTsh",
        "'U3HU",
        "y<6)u4A",
        "r computeren n",
        "8$8C8w8",
        "v&zig",
        "xs{sk",
        "9w-=0",
        " XML6",
        "u '^XU",
        "(A5'&",
        "CVNY=",
        "ZXv.EG",
        "mLH3V",
        "+}O3Dhu",
        "9>&ipu",
        " \"setup.exe /?\" ",
        "-eZe ",
        "Y-?2X+",
        "jW!L-",
        "0L0J0",
        "0$0B0N0W0`0n0w0",
        ">_BF`",
        "vME>2",
        "kk-KZ",
        "bor Install.exe",
        "\\Hx+x:",
        "3e:N-",
        ";+;>;E;Q;s;",
        "^lR'rj",
        " VV4Z",
        "Ijj&&n",
        "s44x$+h",
        "<\\=c=",
        "nR\\-n",
        "xP\"D_/",
        "metro : / PBRUpdate <par",
        "=wtSZ",
        ":u~6E",
        "py*/QT@^j",
        "SvWp ",
        "pUYsQ",
        "SRM5t4",
        "X2Jvg",
        "dv:BCC",
        "B:Dzd%",
        "a`\\e;Za",
        "}K>UVk",
        "VivWwsmVOjon",
        "$P}Kn}",
        " / showoobe",
        "DrF>E",
        "gAIZ${",
        "jzJdF",
        "uN\"+Z",
        "j32j\"Tj",
        ":+yhd%",
        "tu. Arac",
        "2$N5\\",
        ";.|7q",
        "8Gi*2D",
        "/2<,|@",
        "C&~5$",
        "nUZj8",
        "3i#53",
        "{iA)YQi7",
        "H%+`M",
        "vt&p2",
        "R#sDb",
        "Ybs+3",
        "andz@",
        "adowe zastosowania ",
        "2A+`9T",
        "kEJL@",
        "\\SG}5",
        "9`b$I",
        "$,54G0+",
        "5RVCO",
        "vi9&2",
        "Windows 10 Kurulumu komut sat",
        "ke Disable, a telep",
        "Ic;f>g",
        "0?ceQW0~0Y0",
        "yj*f[}",
        ":,B%>@?",
        "bg.R*S&-",
        "Parametere: Lokal bane eller nettverksbane til en specific.wim ",
        "as-IN",
        "blhuuY",
        ", kuruluma, bir y",
        "v#8kX",
        ")avx~7",
        "3'X;f/\"",
        "=vR%w",
        "4Wza}",
        "Gg!]~",
        "prh{9",
        "$rZ.'",
        ">$aW/A",
        "nH=r{s",
        "GrJg7",
        "#ua5[",
        "Example: setup.exe / auto upgrade / migratealldrivers none",
        "23383",
        "x&v-J",
        ".rdata$zzzdbg",
        "#s38m/",
        "nGsV+E",
        "r@ySt",
        ":q:{:",
        "\\ymJ/",
        ",=u?.=4",
        "J;?`>",
        "2t(=SX",
        "Thz>&",
        "& *QX",
        "*E,F;$",
        "2dHUYh",
        "#v:|/j'",
        "~YE&!",
        "kuZaF",
        "Bd/Nj1",
        "|;G\\+",
        "fAS1-"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "a240c1bc485d3c05bd206ab08cf1d6cd331e1bc13bcbcef79bab614039a28243",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/a240c1bc485d3c05bd206ab08cf1d6cd331e1bc13bcbcef79bab614039a28243",
              "guest_paths": [
                "overlay"
              ],
              "size": 7914776,
              "crc32": "FA9F1F14",
              "md5": "69dbc57653fcb01314df4ae6925c5436",
              "sha1": "d7e78e5f03e6037ee196c2aedcf1521214689b6b",
              "sha256": "a240c1bc485d3c05bd206ab08cf1d6cd331e1bc13bcbcef79bab614039a28243",
              "sha512": "d9b562224f139fa1ffb186d662c5f0fbe87923dc9d6492c85c176c64c132e6d86e1dc309102d12f7e4dcb92517b6edd26525b60a14913f7c3e9c6fdc77f96a90",
              "rh_hash": null,
              "ssdeep": "196608:AH1km/Sf7byFXKEBmih9S5rQ5FNFl001p4Ki:UB/SDbyFBH9eQD/l00/4",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T123863357DF46AF0AC045BB37DB105C20B808BB5968190583E33AB7864DB1DC9F5B6E2E",
              "sha3_384": "cb06a58031cf175e6fb6fd21003a59beb29b0c4d039a115fa83f6894ba32710a5a4aa0bd19c094fffd1fa771b6ad1d60",
              "data": null
            }
          ],
          "extracted_files_time": 0.006123881001258269,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": ""
    }
  },
  "dropped": [
    {
      "name": [
        "DiagTrackRunner.exe"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/488cbc8330952dd13b797bb40e4e30610ed03483c25919c39555f7b334a3c159",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe"
      ],
      "size": 79040,
      "crc32": "3FEC6A69",
      "md5": "76f30a1e149792d2542a253b920cbef6",
      "sha1": "9040e0873df5cc2a64b850d1b8159b77528ba62c",
      "sha256": "488cbc8330952dd13b797bb40e4e30610ed03483c25919c39555f7b334a3c159",
      "sha512": "ec39861a3f39f88aad52975974c988ae76376a09136d95f5d4fedd60ee7ec252736d882cef77298d82d786e0dad13c61148b29d7c5fb7ba7d7c74b05de9d7e84",
      "rh_hash": null,
      "ssdeep": "1536:ctlKhKIqVXrOLgef8j1D8KxLQgSSQlsJkGAsC:SlYKrOMso1D8KxLQgSdKJMsC",
      "type": "PE32 executable (console) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T153737F42AFEC9429F4F35B706A799166643ABDA58B12D4EF7001638D9871BC0CEB1733",
      "sha3_384": "d59fffda095e37c1ca62e53916873f46d1c987204ce37f37e790286d0df1f06b4b10a685f3de1d04c77ddd062d67c6be",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x00400000",
        "entrypoint": "0x000055a0",
        "ep_bytes": "e833060000e92efeffffcccccccccccc",
        "peid_signatures": null,
        "reported_checksum": "0x0002154d",
        "actual_checksum": "0x0002154d",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "diagtrackrunner.pdb",
        "imports": {
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x408000",
                "name": "EventWriteTransfer"
              },
              {
                "address": "0x408004",
                "name": "RegCreateKeyExW"
              },
              {
                "address": "0x408008",
                "name": "RegDeleteValueW"
              },
              {
                "address": "0x40800c",
                "name": "RegGetValueW"
              },
              {
                "address": "0x408010",
                "name": "RegCloseKey"
              },
              {
                "address": "0x408014",
                "name": "OpenThreadToken"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x40801c",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x408020",
                "name": "SetEnvironmentVariableW"
              },
              {
                "address": "0x408024",
                "name": "GetModuleHandleExW"
              },
              {
                "address": "0x408028",
                "name": "OutputDebugStringW"
              },
              {
                "address": "0x40802c",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x408030",
                "name": "GetCurrentThread"
              },
              {
                "address": "0x408034",
                "name": "FormatMessageW"
              },
              {
                "address": "0x408038",
                "name": "RaiseException"
              },
              {
                "address": "0x40803c",
                "name": "GetLastError"
              },
              {
                "address": "0x408040",
                "name": "SetLastError"
              },
              {
                "address": "0x408044",
                "name": "GetProcAddress"
              },
              {
                "address": "0x408048",
                "name": "GetModuleFileNameA"
              },
              {
                "address": "0x40804c",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x408050",
                "name": "CloseHandle"
              },
              {
                "address": "0x408054",
                "name": "ExpandEnvironmentStringsW"
              },
              {
                "address": "0x408058",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x40805c",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x408060",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x408064",
                "name": "GetModuleHandleA"
              },
              {
                "address": "0x408068",
                "name": "TerminateProcess"
              },
              {
                "address": "0x40806c",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x408070",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x408074",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x408078",
                "name": "Sleep"
              },
              {
                "address": "0x40807c",
                "name": "GetTickCount"
              }
            ]
          },
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x408094",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x408098",
                "name": "??1exception@@UAE@XZ"
              },
              {
                "address": "0x40809c",
                "name": "?what@exception@@UBEPBDXZ"
              },
              {
                "address": "0x4080a0",
                "name": "_callnewh"
              },
              {
                "address": "0x4080a4",
                "name": "_XcptFilter"
              },
              {
                "address": "0x4080a8",
                "name": "__p__commode"
              },
              {
                "address": "0x4080ac",
                "name": "_amsg_exit"
              },
              {
                "address": "0x4080b0",
                "name": "__wgetmainargs"
              },
              {
                "address": "0x4080b4",
                "name": "__set_app_type"
              },
              {
                "address": "0x4080b8",
                "name": "exit"
              },
              {
                "address": "0x4080bc",
                "name": "_exit"
              },
              {
                "address": "0x4080c0",
                "name": "??0exception@@QAE@ABQBDH@Z"
              },
              {
                "address": "0x4080c4",
                "name": "__p__fmode"
              },
              {
                "address": "0x4080c8",
                "name": "__setusermatherr"
              },
              {
                "address": "0x4080cc",
                "name": "_initterm"
              },
              {
                "address": "0x4080d0",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x4080d4",
                "name": "_lock"
              },
              {
                "address": "0x4080d8",
                "name": "_unlock"
              },
              {
                "address": "0x4080dc",
                "name": "__dllonexit"
              },
              {
                "address": "0x4080e0",
                "name": "_onexit"
              },
              {
                "address": "0x4080e4",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x4080e8",
                "name": "_controlfp"
              },
              {
                "address": "0x4080ec",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x4080f0",
                "name": "??0exception@@QAE@ABQBD@Z"
              },
              {
                "address": "0x4080f4",
                "name": "_cexit"
              },
              {
                "address": "0x4080f8",
                "name": "memcpy"
              },
              {
                "address": "0x4080fc",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x408100",
                "name": "_purecall"
              },
              {
                "address": "0x408104",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x408108",
                "name": "malloc"
              },
              {
                "address": "0x40810c",
                "name": "free"
              },
              {
                "address": "0x408110",
                "name": "memmove"
              },
              {
                "address": "0x408114",
                "name": "_wcsicmp"
              },
              {
                "address": "0x408118",
                "name": "??3@YAXPAX@Z"
              },
              {
                "address": "0x40811c",
                "name": "??0exception@@QAE@ABV0@@Z"
              },
              {
                "address": "0x408120",
                "name": "memset"
              }
            ]
          },
          "USERENV": {
            "dll": "USERENV.dll",
            "imports": [
              {
                "address": "0x408084",
                "name": "ExpandEnvironmentStringsForUserW"
              }
            ]
          },
          "diagtrack": {
            "dll": "diagtrack.dll",
            "imports": [
              {
                "address": "0x40808c",
                "name": "RunDll32Main"
              }
            ]
          }
        },
        "exported_dll_name": null,
        "exports": [],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x0000812c",
            "size": "0x00000078"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x00009000",
            "size": "0x00008d98"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x0000f800",
            "size": "0x00003cc0"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x00012000",
            "size": "0x000005ac"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x000023c0",
            "size": "0x00000038"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x00002418",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x00008000",
            "size": "0x00000128"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x00005530",
            "size_of_data": "0x00005600",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.12"
          },
          {
            "name": ".data",
            "raw_address": "0x00005a00",
            "virtual_address": "0x00007000",
            "virtual_size": "0x0000060c",
            "size_of_data": "0x00000200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "2.55"
          },
          {
            "name": ".idata",
            "raw_address": "0x00005c00",
            "virtual_address": "0x00008000",
            "virtual_size": "0x000007ee",
            "size_of_data": "0x00000800",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.24"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x00006400",
            "virtual_address": "0x00009000",
            "virtual_size": "0x00008d98",
            "size_of_data": "0x00008e00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "3.75"
          },
          {
            "name": ".reloc",
            "raw_address": "0x0000f200",
            "virtual_address": "0x00012000",
            "virtual_size": "0x000005ac",
            "size_of_data": "0x00000600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.31"
          }
        ],
        "overlay": {
          "offset": "0x0000f800",
          "size": "0x00003cc0"
        },
        "resources": [
          {
            "name": "MUI",
            "offset": "0x00011ca8",
            "size": "0x000000f0",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.75"
          },
          {
            "name": "WEVT_TEMPLATE",
            "offset": "0x00009500",
            "size": "0x000087a2",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.76"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00009110",
            "size": "0x000003f0",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.44"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Microsoft Windows Diagnostics Tracking Runner"
          },
          {
            "name": "FileVersion",
            "value": "10.0.10586.0 (th2_release.151029-1700)"
          },
          {
            "name": "InternalName",
            "value": "diagtrackrunner.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "diagtrackrunner.exe"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.10586.0"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "9e98f50f78965e161ef2db3a0c43016e",
        "timestamp": "2015-10-30 02:09:29",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 5
      },
      "data": null,
      "strings": [
        "address not available",
        "Microsoft",
        "address_family_not_supported",
        ">X>j>",
        "protocol not supported",
        "FailFast",
        "$Microsoft Root Certificate Authority",
        "UnicodeStringArrayField",
        "unknown error",
        "UnhandledExceptionFilter",
        ".text$yd",
        "AsimovUploader_NormalUploadSucceeded",
        "__dllonexit",
        "Metadata_IsEscalationInProgress",
        "=,=8=D=Q=n=",
        "Metadata_TimeSinceOsInstall",
        "Microsoft Time-Stamp Service",
        ".CRT$XIAA",
        "not_a_socket",
        "EventKey",
        ".?AVlogic_error@std@@",
        "MaxCancelReports",
        "Trigger",
        ".rdata$zETW0",
        "5$5,5",
        "Microsoft Corporation",
        "EventPersistence",
        "system",
        "invalid string position",
        "Metadata_LastUnlockTime",
        "DTSQMLogger_UploadScenario",
        "malloc",
        ";&<u=",
        "DiagTrackScenario",
        "MOPR1",
        "141001180638Z",
        "[%hs]",
        "L&*H$_Z",
        ".CRT$XIY",
        "?terminate@@YAXXZ",
        "SetupWorkItem_ExecutedAction",
        "t$HPQ",
        "??0exception@@QAE@ABV0@@Z",
        "RegCloseKey",
        "FilterLength",
        "AsimovUploader_RealtimeUploadSucceeded",
        "RegCreateKeyExW",
        "EventData",
        "__set_app_type",
        "operation in progress",
        "Producer",
        "9\"9.9y9",
        "WEVT|",
        "ActionType",
        "3 3)333?3E3L3U3[3c3i3v3~3",
        "%DiagtrackRegistryRoot%",
        "CurrentFailureReports",
        "SystemTimeField",
        "uKPPV",
        "zaLj]W",
        ")Microsoft Root Certificate Authority 20100",
        "function not supported",
        "LoadLibraryExW",
        "__setusermatherr",
        "GetProcAddress",
        "TraceManager_SnappingTrace",
        "HexInt64Field",
        "0OmtD",
        "100701213655Z",
        "Utils_GetRegistryKey",
        "BooleanField",
        "no such device",
        "cross device link",
        "Metadata_LastLogonTime",
        "170107181402Z0",
        "diagtrack.dll",
        "E(SV3",
        "Microsoft Corporation1&0$",
        "network reset",
        "timed out",
        "diagtrackrunner.exe",
        "nCipher NTS ESN:4DE9-0C5E-3E091+0)",
        "TEMP8",
        "TraceManager_StartingTrace",
        "9':\\:",
        "generic",
        "?http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T",
        "result out of range",
        "bad allocation",
        "20151029165712Z",
        "TerminateProcess",
        "RaiseException",
        ".idata$5",
        "TraceEndTime",
        ".CRT$XCU",
        "PointerField",
        "SetEnvironmentVariableW",
        "151007181402Z",
        "Metadata_LastAbnormalShutdownTime",
        "resource deadlock would occur",
        "no_protocol_option",
        "3)3G3V3k3|3",
        "/UploadEtlFilesOnly",
        "??1exception@@UAE@XZ",
        "ExpandEnvironmentStringsW",
        "TraceManager_StoppingTrace",
        "117[-",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z",
        "SinkStateOrdinal",
        "DiagTrackPerf",
        "_purecall",
        "EventPayload",
        "040904B0",
        "UploadEtlFilesOnly",
        "Microsoft Time-Stamp Service0",
        "operation_would_block",
        "TriggersCount",
        "9^9g9",
        "too many files open in system",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        ".PxW[E",
        "not a socket",
        "_wcsicmp",
        ".?AVexception@@",
        "HRESULT",
        "PerfTrackDurationField",
        "\"Microsoft Window",
        "MatchEngine_ManifestUpdatePruneScenarioList",
        "D$ SVW",
        ".idata",
        "TestEvent_TestEvent",
        ".data",
        "no space on device",
        "[%hs(%hs)]",
        "RedirectedStorageRoot",
        "20151030165712Z0v0<",
        "MaxEscalations",
        "Redmond1",
        "network_reset",
        "PerfTrackScenarioName",
        "Microsoft-Windows-DiagTrack/Diagnostic",
        "Msg:[%ws] ",
        "MaxFailureReports",
        " Windows",
        "t$HQP",
        "address in use",
        "Int64Field",
        "win:Informational",
        "not a stream",
        "GUIDField",
        "ScenarioManager_LoadingScenariosStop",
        "stream timeout",
        "9$9,949<9D9L9T9\\9d9l9t9|9",
        "IsSatisfied",
        "argument out of domain",
        "RichS",
        "TracePriority",
        "Metadata_IsAcOn",
        "MOPR1'0%",
        "no lock available",
        "executable format error",
        "ADVAPI32.dll",
        "RegDeleteValueW",
        "9A:h:",
        "bad file descriptor",
        "%hs!%p: ",
        "not enough memory",
        "TestEvent_RADARAction",
        "UnicodeStringField",
        "inappropriate io control operation",
        "AnsiStringField",
        "invalid seek",
        "160904174245Z0",
        "broken pipe",
        "Metadata_IsKernelDebuggerPresent",
        "connection refused",
        "_cexit",
        "SysprepGeneralize",
        "string too long",
        "win:Info",
        "ActionName",
        "Microsoft Time-Stamp PCA0",
        "value too large",
        "directory not empty",
        "02060B0F0R0V0h0p0",
        "rr.5n+",
        "Filter_FilterEvaluated",
        ".xdata$x",
        "ReturnHr[PreRelease]",
        "/newdatabase",
        "Microsoft Corporation1",
        "FiletimeField",
        "Int16Field",
        "invalid argument",
        "DiagTrackSpew",
        "Int32Field",
        "ToggleTraceWithCustomFilterAction_CreatedFilter",
        "owner dead",
        "operation_in_progress",
        "StringFileInfo",
        "KERNEL32.dll",
        "Severity",
        "Sleep",
        "ExpandedKeyName",
        "L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "N0L0J",
        "r~akow",
        "250706205017Z0~1",
        "10.0.10586.0",
        "GetCurrentProcessId",
        "MOPR1301",
        "not connected",
        "100706204017Z",
        "D$89^",
        "no buffer space",
        "N=|)H",
        "DiagTrackStatus",
        "UInt8Field",
        "L$ 9^",
        ".?AVbad_alloc@std@@",
        "160101180638Z0",
        "filename_too_long",
        ";'<?<W<r<",
        "iostream stream error",
        "UInt64Field",
        "MaxFailureEscalations",
        "1Jv1=+r",
        "CurrentCompletionEscalations",
        "1.0,0",
        "_onexit",
        "TimeStamp",
        "Microsoft Time-Stamp PCA",
        "address_in_use",
        "address_not_available",
        ".rdata$zETW2",
        "\"Metadata_LastPowerSourceChangeTime",
        "file too large",
        "UInt32Field",
        ".idata$4",
        "MsQ[v",
        "*38076+68d2f8bb-0a3b-40b4-9f24-eb7e9419d1600",
        "AsimovUploader_AddEvent",
        "3`3t3",
        "no_buffer_space",
        "DoubleField",
        "Microsoft Corporation0",
        "%ProgramData%\\Microsoft\\Diagnosis",
        "__wgetmainargs",
        "LdrFastFailInLoaderCallout",
        "KnILk",
        "permission denied",
        ".text$mn",
        "win:Error",
        "UInt16Field",
        "no message",
        "!Metadata_LastAbnormalShutdownTime",
        "no stream resources",
        "network_down",
        "wrong_protocol_type",
        "% moa",
        "invalid_argument",
        ".CRT$XIA",
        "TEMP,",
        "bad_address",
        "TriggerInfo",
        "<(<1<F<[<h<p<",
        "EscalationEngine_ExecuteDenied",
        "base\\diagnosis\\diagtrack\\include\\utils.h",
        "illegal byte sequence",
        "D$@SVW",
        ".text$x",
        "SIDField",
        "TEMPD",
        "Microsoft Corporation1(0&",
        "LegalCopyright",
        "Error",
        "OPCO0",
        "?what@exception@@UBEPBDXZ",
        "already_connected",
        "Y__^[",
        "*31595+04079350-16fa-4c60-b6bf-9d2b1cd059840",
        ".idata$3",
        ";L;U;n;};",
        "CurrentCompletionReports",
        "=$=-=<=E=Y=|=",
        ".rdata",
        "TEMP4",
        "Int8Field",
        "7%7y7",
        "$`2X`F",
        "0 0$00040",
        "M0K0I",
        "no such process",
        "Value",
        "bad message",
        "operation not supported",
        ".text$di",
        "CurrentEscalations",
        "VarFileInfo",
        "network_unreachable",
        "\"Metadata_LastSuccessfulRefreshTime",
        "%hs(%d)\\%hs!%p: ",
        "GetCurrentProcess",
        "connection already in progress",
        "??1type_info@@UAE@XZ",
        "UnicodeStringArrayCountField",
        "ProcessInfo",
        "not supported",
        "CommitMB",
        "/~>ln>",
        "|hK,_",
        "DiagTrackTrace",
        "en-US",
        ".tq[m",
        "OriginalFilename",
        "`Ge`@N",
        "memmove",
        "_CxxThrowException",
        "DiagTrackWP",
        "L0J0H",
        "RegGetValueW",
        "SnapTrace_SnappingScenarioInformation",
        "WasPreempted",
        "filename too long",
        ":.:>:]:g:",
        "Metadata_LastResumeFromHibernateTime",
        "read only file system",
        "@.reloc",
        ".rdata$zETW1",
        "t$<WP",
        "170107181736Z0",
        "Microsoft.Windows.DiagTrack",
        "1$1D1`1p1|1",
        "Phd\"@",
        ".CRT$XCAA",
        "4\"444<4A4F4h4n4u4z4",
        "RtlNtStatusToDosErrorNoTeb",
        "LogHr",
        " Operating System",
        "no protocol option",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "_initterm",
        "CurrentReports",
        "CurrentCancelReports",
        "ScenarioManager_AcceptScenario",
        "FixedUnicodeStringArrayField",
        "_exit",
        "not_connected",
        "t$0QP",
        "=7>g>q>w>",
        "too_many_files_open",
        "L$89\\$Ls",
        "SetLastError",
        "??0exception@@QAE@ABQBD@Z",
        ">http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0",
        "GetModuleHandleA",
        "connection_reset",
        ".00cfg",
        "_callnewh",
        "100831221932Z",
        "FilterType",
        "__p__commode",
        "oK0D$\"<",
        "_lock",
        "CallContext:[%hs] ",
        "operation_not_supported",
        "MatchEngine_ManifestUpdateMaintainScenarioList",
        "DataType",
        "Microsoft Code Signing PCA 2010",
        "9l>p>",
        "L$ 9\\$4s",
        "?M?m?",
        "msvcrt.dll",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "z.9Wv",
        "9)919P9",
        "GetCurrentThread",
        "_controlfp",
        "7%7-757=7I7R7W7]7g7q7",
        "#Vx\"&6",
        "GetCurrentThreadId",
        "no such file or directory",
        "4 4$4,4@4H4P4X4\\4`4h4|4",
        "<http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0",
        "SiteCode",
        "Microsoft Code Signing PCA0",
        "EventWriteTransfer",
        "MatchEngine_CompletedManifestUpdate",
        "Microsoft Time-Stamp PCA 2010",
        "ScenarioManager_RejectScenario",
        ".?AVResultException@wil@@",
        "1B1P1r1x1",
        "`.data",
        "@.rsrc",
        "iostream",
        "150604174245Z",
        "operation not permitted",
        "timed_out",
        "ReturnHr",
        "Legal_Policy_Statement",
        "FloatField",
        "Vj@^Vj",
        "Microsoft Time-Stamp PCA 20100",
        "__CxxFrameHandler3",
        "H0F0D",
        "file exists",
        ".gfids$x",
        "address family not supported",
        "DiagtrackRegistryRoot",
        "Exception",
        "u[gGZ",
        "FilterData",
        "1(0&0",
        ".rdata$zETW9",
        "3T4X4`4h4r8}8",
        "TraceProfileHash",
        "4H *O",
        ".idata$2",
        "ScenarioName",
        "destination address required",
        "message size",
        "Metadata_LastResumeFromStandbyTime",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z",
        "too many links",
        "D$89\\$Ls",
        "UIntArrayField",
        "destination_address_required",
        ".CRT$XCA",
        "EscalationEngine_Execute",
        "Microsoft Code Signing PCA 20100",
        "6A6J6",
        "state not recoverable",
        "2$2,242<2D2L2T2\\2d2l2t2|2",
        "SetUnhandledExceptionFilter",
        "is a directory",
        "argument list too long",
        ">http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0",
        "a740Q",
        "ErrorValue",
        "i\\ta?",
        "PhP-@",
        "7Z>@B1",
        "ComplexData",
        "network unreachable",
        "connection_already_in_progress",
        "identifyingInfo",
        "FilterRepresentation",
        "host unreachable",
        "3$3,343<3D3L3T3\\3<7D7L7T7\\7d7l7t7|7",
        "no message available",
        "no child process",
        "Metadata_LastDeviceArrivalTime",
        "io error",
        "??0exception@@QAE@ABQBDH@Z",
        "D$xSVWj",
        "!Metadata_IsContinuumSessionActive",
        "282H2T2t2|2",
        "__p__fmode",
        "\"Microsoft Time Source Master Clock0",
        ";!;';",
        "ProductVersion",
        "ScenarioManager_InvalidScenario",
        ".rdata$sxdata",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "#Metadata_LastApplicationInstallTime",
        "t$0PQ",
        "Duration",
        "message_size",
        "already connected",
        "5\"5(51565S5v5",
        "connection_refused",
        "nCipher DSE ESN:728D-C45F-F9EB1%0#",
        "I0G0E",
        "1'151f1",
        "BinaryField",
        "GetSystemTimeAsFileTime",
        "memset",
        "connection aborted",
        "RunDll32Main",
        "protocol_not_supported",
        "GetTickCount",
        ".CRT$XIZ",
        "operation canceled",
        "DTSQMLogger_SQMSingleInfoStreamRow",
        "CompanyName",
        "4]F*3",
        "20151030030913.551Z0",
        "\"Metadata_LastResumeFromStandbyTime",
        "0@0H0L0l0",
        "permission_denied",
        " Metadata_IsKernelDebuggerPresent",
        "InternalName",
        "VS_VERSION_INFO",
        "ProductName",
        "too many files open",
        "InputKeyName",
        "250701214655Z0|1",
        "DiagTrackDbVersion",
        "KeyName",
        "j%XQf",
        "network down",
        "no link",
        ";D$Hr>P",
        "OutputDebugStringW",
        "ScenarioId",
        "DiagtrackStorageRoot",
        "CHANp",
        "D$ 9\\$4s",
        "interrupted",
        "bad address",
        "O0M0K",
        "_except_handler4_common",
        "Microsoft Windows Diagnostics Tracking Runner",
        "?&?_?",
        "070403125309Z",
        "Message",
        ".text",
        "too many symbolic link levels",
        "WEVT_TEMPLATE",
        "EscalationWorkItem_ExecutedAction",
        "Translation",
        "MatchEngine_ScenarioCompleted",
        "8$8,848<8D8L8T8\\8d8l8t8|8",
        "L$89^",
        "connection_aborted",
        "identifier removed",
        "ValueName",
        "c]?;ET",
        "Utils_CreateRegistryKeyFailed",
        "FixedUIntArrayField",
        "operation would block",
        "FormatMessageW",
        "memcpy",
        "GetModuleHandleW",
        "not a directory",
        "MaxReports",
        "internal\\sdk\\inc\\wil\\result.h",
        "10.0.10586.0 (th2_release.151029-1700)",
        "151030030912Z0#",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "??3@YAXPAX@Z",
        "ScenarioManager_LoadingScenariosStart",
        "Microsoft Corporation1!0",
        "win:Verbose",
        "$Metadata_LastResumeFromHibernateTime",
        "Metadata_IsContinuumSessionActive",
        ".?AVlength_error@std@@",
        "151007181736Z",
        "UIntArrayCountField",
        "USERENV.dll",
        ";?;F;M;T;[;",
        "no such device or address",
        "DRfDmR",
        " http://www.microsoft.com/windows0",
        "200831222932Z0y1",
        "2'3.3F3]3g3s3",
        "QK<H+\"6",
        "Metadata_LastBootTime",
        "device or resource busy",
        " Microsoft Corporation. All rights reserved.",
        "AsimovUploader_PersistEvent",
        "Microsoft Code Signing PCA",
        "GetModuleFileNameA",
        "t#QWj",
        "_vsnwprintf",
        "!This program cannot be run in DOS mode.",
        "bad_file_descriptor",
        "protocol error",
        "210403130309Z0w1",
        "?:?S?",
        "diagtrackrunner.pdb",
        "Washington1",
        ".rsrc$01",
        "Microsoft Corporation1#0!",
        "$Microsoft Root Certificate Authority0",
        "c.^SF",
        "1$1,141<1D1L1T1\\1d1l1t1|1",
        "Metadata_LastSuccessfulRefreshTime",
        "microsoft1-0+",
        "EscalationWorkItem_EscalationCompleted",
        "_unlock",
        "SSSVh",
        "CurrentFailureEscalations",
        "Microsoft Corporation1200",
        "MaxCompletionReports",
        "/SysprepGeneralize",
        ".?AVout_of_range@std@@",
        "host_unreachable",
        "Chttp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X",
        "RedirectedRegistryRoot",
        "8http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0",
        "OpenThreadToken",
        ".rsrc$02",
        "D$ 9^",
        "Reason",
        "GetLastError",
        "CloseHandle",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Diagnostics\\DiagTrack",
        "QueryPerformanceCounter",
        "GetModuleHandleExW",
        "MaxCompletionEscalations",
        "(caller: %p) ",
        "wrong protocol type",
        "InFlightScenario_AddMatchedTrigger",
        "5*50585S5`5y5",
        "ProcessId",
        "AsimovUploader_UploadEventBuffer",
        "ContainsEscalationSection",
        "resource unavailable try again",
        "KEYW8",
        "Metadata_LastApplicationInstallTime",
        ".CRT$XCZ",
        ".data$r",
        "9pTs=",
        "FileDescription",
        "FileVersion",
        "ntdll.dll",
        "_XcptFilter",
        "HexInt32Field",
        "connection reset",
        ".rdata$zzzdbg",
        "EventLatency",
        "text file busy",
        "Metadata_LastPowerSourceChangeTime",
        "ExpandEnvironmentStringsForUserW",
        "_amsg_exit",
        "%hs(%d) tid(%x) %08X %ws",
        ".idata$6",
        "v$Sh8",
        "\\)D<ku`",
        "ScenarioInstanceId",
        "TEMP@",
        "172^2"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "153a2776a54fe6f76f58280c7b711ac0b04ac24f72fb01af042de2c79d3d7752",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/153a2776a54fe6f76f58280c7b711ac0b04ac24f72fb01af042de2c79d3d7752",
              "guest_paths": [
                "overlay"
              ],
              "size": 15552,
              "crc32": "830AA173",
              "md5": "5105230c6f0723080c643a8d869e816e",
              "sha1": "7d988a1ed6b7ded7be9c766cfb60f5455be1e735",
              "sha256": "153a2776a54fe6f76f58280c7b711ac0b04ac24f72fb01af042de2c79d3d7752",
              "sha512": "e0b6f9216234a853d6d7f39d7df13db3819f00445abaed9b36b960c8abe7ec39c4cc162ab716f0cccf9ee7b7d0666192412cf20bbcfb7e6eec39664628aa834e",
              "rh_hash": null,
              "ssdeep": "192:uHzvXS9YOCAs/nGfe4pBjSbEsGcWNArXVWQ42WXqnajbYXwsMgPvx251:Szv9A0GftpBj3i4lHYAszPW",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T18B6208D28A7C9483EC87AC5063E8EA837C3D97C71D10645614AEF9E92DC33D6EB1482D",
              "sha3_384": "270986a19c3ad2bc6377278d42e1836884dc60f87533f414794713c02166389897083fa75fcca3d3fe79043b21886bd4",
              "data": null
            }
          ],
          "extracted_files_time": 0.0005092370010970626,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "wdsutil.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/eab16299b69323fca094f2d214a5bc5fbf973040b7ccd187415edf985f46b21d",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\wdsutil.dll"
      ],
      "size": 237384,
      "crc32": "9119D5DB",
      "md5": "818e76521dad2369e8f713aecda42145",
      "sha1": "df047d531b34433f5139beaa886af72136fd1537",
      "sha256": "eab16299b69323fca094f2d214a5bc5fbf973040b7ccd187415edf985f46b21d",
      "sha512": "2414e9db470251251796de54000dc4067697068f7fd38c6bf443b367c9ec8e05cb1d75455d6dbd8bd08419fe13cc99deccb44086cd32bd72ea76f743ef239d4b",
      "rh_hash": null,
      "ssdeep": "6144:al6Ls7+dMPL25tZ1qeLkLY85pwkfLWdm7bS:Y2s7+dMPL8tZ/4s8PwkC/",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T158344C2137D48D76EADA2630981D737951BDE2604BE092CB535C4FFEAE203C29E7425B",
      "sha3_384": "52a3caea47c0f662703115af4cfeb5fbf741f7d0a6459eb3290c4f2a882c378f5ce7bc02e3145169511db33884c773de",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x00029e80",
        "ep_bytes": "8bff558bec837d0c017505e815070000",
        "peid_signatures": null,
        "reported_checksum": "0x00049572",
        "actual_checksum": "0x00049572",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "wdsutil.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x1003623c",
                "name": "wcschr"
              },
              {
                "address": "0x10036240",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x10036244",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x10036248",
                "name": "_wcsicmp"
              },
              {
                "address": "0x1003624c",
                "name": "_vscwprintf"
              },
              {
                "address": "0x10036250",
                "name": "wcsrchr"
              },
              {
                "address": "0x10036254",
                "name": "_gmtime64"
              },
              {
                "address": "0x10036258",
                "name": "memchr"
              },
              {
                "address": "0x1003625c",
                "name": "memcpy"
              },
              {
                "address": "0x10036260",
                "name": "memcpy_s"
              },
              {
                "address": "0x10036264",
                "name": "??0exception@@QAE@ABQBD@Z"
              },
              {
                "address": "0x10036268",
                "name": "memmove_s"
              },
              {
                "address": "0x1003626c",
                "name": "wcsnlen"
              },
              {
                "address": "0x10036270",
                "name": "wcsncpy_s"
              },
              {
                "address": "0x10036274",
                "name": "_ultow_s"
              },
              {
                "address": "0x10036278",
                "name": "vswprintf_s"
              },
              {
                "address": "0x1003627c",
                "name": "wcsncmp"
              },
              {
                "address": "0x10036280",
                "name": "_stricmp"
              },
              {
                "address": "0x10036284",
                "name": "_wcslwr_s"
              },
              {
                "address": "0x10036288",
                "name": "wcsspn"
              },
              {
                "address": "0x1003628c",
                "name": "wcscspn"
              },
              {
                "address": "0x10036290",
                "name": "iswdigit"
              },
              {
                "address": "0x10036294",
                "name": "wcstol"
              },
              {
                "address": "0x10036298",
                "name": "ldiv"
              },
              {
                "address": "0x1003629c",
                "name": "towlower"
              },
              {
                "address": "0x100362a0",
                "name": "strrchr"
              },
              {
                "address": "0x100362a4",
                "name": "wcsstr"
              },
              {
                "address": "0x100362a8",
                "name": "_vsnprintf_s"
              },
              {
                "address": "0x100362ac",
                "name": "memmove"
              },
              {
                "address": "0x100362b0",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x100362b4",
                "name": "realloc"
              },
              {
                "address": "0x100362b8",
                "name": "_errno"
              },
              {
                "address": "0x100362bc",
                "name": "_onexit"
              },
              {
                "address": "0x100362c0",
                "name": "__dllonexit"
              },
              {
                "address": "0x100362c4",
                "name": "_unlock"
              },
              {
                "address": "0x100362c8",
                "name": "_lock"
              },
              {
                "address": "0x100362cc",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x100362d0",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x100362d4",
                "name": "_initterm"
              },
              {
                "address": "0x100362d8",
                "name": "_amsg_exit"
              },
              {
                "address": "0x100362dc",
                "name": "_XcptFilter"
              },
              {
                "address": "0x100362e0",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x100362e4",
                "name": "_callnewh"
              },
              {
                "address": "0x100362e8",
                "name": "?what@exception@@UBEPBDXZ"
              },
              {
                "address": "0x100362ec",
                "name": "??1exception@@UAE@XZ"
              },
              {
                "address": "0x100362f0",
                "name": "??0exception@@QAE@ABV0@@Z"
              },
              {
                "address": "0x100362f4",
                "name": "??0exception@@QAE@XZ"
              },
              {
                "address": "0x100362f8",
                "name": "malloc"
              },
              {
                "address": "0x100362fc",
                "name": "free"
              },
              {
                "address": "0x10036300",
                "name": "wcscpy_s"
              },
              {
                "address": "0x10036304",
                "name": "calloc"
              },
              {
                "address": "0x10036308",
                "name": "_purecall"
              },
              {
                "address": "0x1003630c",
                "name": "_memicmp"
              },
              {
                "address": "0x10036310",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x10036314",
                "name": "memset"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x10036038",
                "name": "CreateMutexW"
              },
              {
                "address": "0x1003603c",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x10036040",
                "name": "ReleaseMutex"
              },
              {
                "address": "0x10036044",
                "name": "HeapAlloc"
              },
              {
                "address": "0x10036048",
                "name": "GlobalAlloc"
              },
              {
                "address": "0x1003604c",
                "name": "CloseHandle"
              },
              {
                "address": "0x10036050",
                "name": "GetWindowsDirectoryW"
              },
              {
                "address": "0x10036054",
                "name": "SetLastError"
              },
              {
                "address": "0x10036058",
                "name": "LocalFree"
              },
              {
                "address": "0x1003605c",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x10036060",
                "name": "RaiseException"
              },
              {
                "address": "0x10036064",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x10036068",
                "name": "CompareStringW"
              },
              {
                "address": "0x1003606c",
                "name": "GetEnvironmentVariableW"
              },
              {
                "address": "0x10036070",
                "name": "MultiByteToWideChar"
              },
              {
                "address": "0x10036074",
                "name": "WideCharToMultiByte"
              },
              {
                "address": "0x10036078",
                "name": "Sleep"
              },
              {
                "address": "0x1003607c",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x10036080",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x10036084",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x10036088",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x1003608c",
                "name": "GetTickCount"
              },
              {
                "address": "0x10036090",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x10036094",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x10036098",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x1003609c",
                "name": "TerminateProcess"
              },
              {
                "address": "0x100360a0",
                "name": "OutputDebugStringA"
              },
              {
                "address": "0x100360a4",
                "name": "HeapFree"
              },
              {
                "address": "0x100360a8",
                "name": "GetLastError"
              },
              {
                "address": "0x100360ac",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x100360b0",
                "name": "FormatMessageW"
              },
              {
                "address": "0x100360b4",
                "name": "VirtualProtect"
              },
              {
                "address": "0x100360b8",
                "name": "LoadLibraryExA"
              },
              {
                "address": "0x100360bc",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x100360c0",
                "name": "VirtualQuery"
              },
              {
                "address": "0x100360c4",
                "name": "GetSystemInfo"
              },
              {
                "address": "0x100360c8",
                "name": "AcquireSRWLockExclusive"
              },
              {
                "address": "0x100360cc",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x100360d0",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x100360d4",
                "name": "HeapDestroy"
              },
              {
                "address": "0x100360d8",
                "name": "HeapReAlloc"
              },
              {
                "address": "0x100360dc",
                "name": "HeapSize"
              },
              {
                "address": "0x100360e0",
                "name": "CreateSemaphoreExW"
              },
              {
                "address": "0x100360e4",
                "name": "CreateMutexExW"
              },
              {
                "address": "0x100360e8",
                "name": "ReadFile"
              },
              {
                "address": "0x100360ec",
                "name": "OpenSemaphoreW"
              },
              {
                "address": "0x100360f0",
                "name": "WaitForSingleObjectEx"
              },
              {
                "address": "0x100360f4",
                "name": "ReleaseSemaphore"
              },
              {
                "address": "0x100360f8",
                "name": "OutputDebugStringW"
              },
              {
                "address": "0x100360fc",
                "name": "IsDebuggerPresent"
              },
              {
                "address": "0x10036100",
                "name": "DebugBreak"
              },
              {
                "address": "0x10036104",
                "name": "GetModuleFileNameA"
              },
              {
                "address": "0x10036108",
                "name": "GetModuleHandleExW"
              },
              {
                "address": "0x1003610c",
                "name": "GetFileSize"
              },
              {
                "address": "0x10036110",
                "name": "GetTempFileNameW"
              },
              {
                "address": "0x10036114",
                "name": "GetExitCodeProcess"
              },
              {
                "address": "0x10036118",
                "name": "CreateProcessW"
              },
              {
                "address": "0x1003611c",
                "name": "CopyFileW"
              },
              {
                "address": "0x10036120",
                "name": "FindResourceExW"
              },
              {
                "address": "0x10036124",
                "name": "WriteFile"
              },
              {
                "address": "0x10036128",
                "name": "SetFilePointer"
              },
              {
                "address": "0x1003612c",
                "name": "SetFilePointerEx"
              },
              {
                "address": "0x10036130",
                "name": "FindResourceW"
              },
              {
                "address": "0x10036134",
                "name": "LoadResource"
              },
              {
                "address": "0x10036138",
                "name": "LockResource"
              },
              {
                "address": "0x1003613c",
                "name": "SizeofResource"
              },
              {
                "address": "0x10036140",
                "name": "IsWow64Process"
              },
              {
                "address": "0x10036144",
                "name": "Wow64DisableWow64FsRedirection"
              },
              {
                "address": "0x10036148",
                "name": "Wow64RevertWow64FsRedirection"
              },
              {
                "address": "0x1003614c",
                "name": "CreateFileMappingW"
              },
              {
                "address": "0x10036150",
                "name": "MapViewOfFileEx"
              },
              {
                "address": "0x10036154",
                "name": "UnmapViewOfFile"
              },
              {
                "address": "0x10036158",
                "name": "GetSystemDirectoryW"
              },
              {
                "address": "0x1003615c",
                "name": "GetSystemWindowsDirectoryW"
              },
              {
                "address": "0x10036160",
                "name": "GetVolumePathNamesForVolumeNameW"
              },
              {
                "address": "0x10036164",
                "name": "QueryDosDeviceW"
              },
              {
                "address": "0x10036168",
                "name": "LoadLibraryW"
              },
              {
                "address": "0x1003616c",
                "name": "SystemTimeToFileTime"
              },
              {
                "address": "0x10036170",
                "name": "GetCurrentThread"
              },
              {
                "address": "0x10036174",
                "name": "GetVersionExW"
              },
              {
                "address": "0x10036178",
                "name": "GetFullPathNameW"
              },
              {
                "address": "0x1003617c",
                "name": "FindFirstVolumeW"
              },
              {
                "address": "0x10036180",
                "name": "DeviceIoControl"
              },
              {
                "address": "0x10036184",
                "name": "CreateFileW"
              },
              {
                "address": "0x10036188",
                "name": "GetProcAddress"
              },
              {
                "address": "0x1003618c",
                "name": "FindVolumeClose"
              },
              {
                "address": "0x10036190",
                "name": "FreeLibrary"
              },
              {
                "address": "0x10036194",
                "name": "FindNextVolumeW"
              },
              {
                "address": "0x10036198",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x1003619c",
                "name": "CreateDirectoryW"
              },
              {
                "address": "0x100361a0",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x100361a4",
                "name": "FindFirstFileW"
              },
              {
                "address": "0x100361a8",
                "name": "FindNextFileW"
              },
              {
                "address": "0x100361ac",
                "name": "GetTempPathW"
              },
              {
                "address": "0x100361b0",
                "name": "FindClose"
              },
              {
                "address": "0x100361b4",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x100361b8",
                "name": "DeleteFileW"
              }
            ]
          },
          "USER32": {
            "dll": "USER32.dll",
            "imports": [
              {
                "address": "0x100361cc",
                "name": "UnregisterClassA"
              }
            ]
          },
          "ole32": {
            "dll": "ole32.dll",
            "imports": [
              {
                "address": "0x10036344",
                "name": "CoInitializeEx"
              },
              {
                "address": "0x10036348",
                "name": "CoCreateInstance"
              },
              {
                "address": "0x1003634c",
                "name": "CoUninitialize"
              },
              {
                "address": "0x10036350",
                "name": "CoCreateGuid"
              },
              {
                "address": "0x10036354",
                "name": "StringFromGUID2"
              }
            ]
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x100361c0",
                "name": "SysAllocString"
              },
              {
                "address": "0x100361c4",
                "name": "SysFreeString"
              }
            ]
          },
          "WDSCORE": {
            "dll": "WDSCORE.dll",
            "imports": [
              {
                "address": "0x100361e4",
                "name": "WdsEnumNextBlackboardItem"
              },
              {
                "address": "0x100361e8",
                "name": "WdsAbortBlackboardItemEnum"
              },
              {
                "address": "0x100361ec",
                "name": "WdsEnumFirstBlackboardItem"
              },
              {
                "address": "0x100361f0",
                "name": "WdsSetupLogMessageW"
              },
              {
                "address": "0x100361f4",
                "name": "ConstructPartialMsgVW"
              },
              {
                "address": "0x100361f8",
                "name": "CurrentIP"
              },
              {
                "address": "0x100361fc",
                "name": "WdsInitializeDataUInt32"
              },
              {
                "address": "0x10036200",
                "name": "WdsInitializeDataUInt64"
              },
              {
                "address": "0x10036204",
                "name": "WdsDestroyBlackboard"
              },
              {
                "address": "0x10036208",
                "name": "WdsCreateBlackboard"
              },
              {
                "address": "0x1003620c",
                "name": "WdsInitializeDataStringW"
              },
              {
                "address": "0x10036210",
                "name": "WdsPublishImmediateEx"
              },
              {
                "address": "0x10036214",
                "name": "WdsGetBlackboardValue"
              },
              {
                "address": "0x10036218",
                "name": "WdsFreeCollection"
              },
              {
                "address": "0x1003621c",
                "name": "WdsPackCollection"
              },
              {
                "address": "0x10036220",
                "name": "WdsCollectionGetValue"
              },
              {
                "address": "0x10036224",
                "name": "WdsUnpackCollection"
              },
              {
                "address": "0x10036228",
                "name": "WdsAllocCollection"
              },
              {
                "address": "0x1003622c",
                "name": "WdsCollectionAddValue"
              },
              {
                "address": "0x10036230",
                "name": "WdsSetBlackboardValue"
              },
              {
                "address": "0x10036234",
                "name": "WdsFreeData"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x1003631c",
                "name": "RtlAllocateHeap"
              },
              {
                "address": "0x10036320",
                "name": "RtlImageRvaToVa"
              },
              {
                "address": "0x10036324",
                "name": "RtlImageDirectoryEntryToData"
              },
              {
                "address": "0x10036328",
                "name": "RtlGetVersion"
              },
              {
                "address": "0x1003632c",
                "name": "RtlReleaseSRWLockExclusive"
              },
              {
                "address": "0x10036330",
                "name": "RtlAcquireSRWLockExclusive"
              },
              {
                "address": "0x10036334",
                "name": "RtlSetThreadErrorMode"
              },
              {
                "address": "0x10036338",
                "name": "RtlGetThreadErrorMode"
              },
              {
                "address": "0x1003633c",
                "name": "RtlFreeHeap"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x10036000",
                "name": "EventWriteTransfer"
              },
              {
                "address": "0x10036004",
                "name": "TraceEvent"
              },
              {
                "address": "0x10036008",
                "name": "ProcessTrace"
              },
              {
                "address": "0x1003600c",
                "name": "RegisterTraceGuidsW"
              },
              {
                "address": "0x10036010",
                "name": "StartTraceW"
              },
              {
                "address": "0x10036014",
                "name": "ControlTraceW"
              },
              {
                "address": "0x10036018",
                "name": "UnregisterTraceGuids"
              },
              {
                "address": "0x1003601c",
                "name": "OpenTraceW"
              },
              {
                "address": "0x10036020",
                "name": "CloseTrace"
              },
              {
                "address": "0x10036024",
                "name": "RegCloseKey"
              },
              {
                "address": "0x10036028",
                "name": "RegEnumKeyExW"
              },
              {
                "address": "0x1003602c",
                "name": "RegOpenKeyExW"
              },
              {
                "address": "0x10036030",
                "name": "RegQueryValueExW"
              }
            ]
          },
          "VERSION": {
            "dll": "VERSION.dll",
            "imports": [
              {
                "address": "0x100361d4",
                "name": "VerQueryValueW"
              },
              {
                "address": "0x100361d8",
                "name": "GetFileVersionInfoExW"
              },
              {
                "address": "0x100361dc",
                "name": "GetFileVersionInfoSizeExW"
              }
            ]
          }
        },
        "exported_dll_name": "WDSUTIL.dll",
        "exports": [
          {
            "address": "0x100068f0",
            "name": "??0?$CShimUserSetting@VCStringUserSetting@@@@QAE@ABV0@@Z",
            "ordinal": 1
          },
          {
            "address": "0x10006920",
            "name": "??0?$CShimUserSetting@VCStringUserSetting@@@@QAE@XZ",
            "ordinal": 2
          },
          {
            "address": "0x100068f0",
            "name": "??0?$CShimUserSetting@VCUInt32UserSetting@@@@QAE@ABV0@@Z",
            "ordinal": 3
          },
          {
            "address": "0x10006920",
            "name": "??0?$CShimUserSetting@VCUInt32UserSetting@@@@QAE@XZ",
            "ordinal": 4
          },
          {
            "address": "0x100068f0",
            "name": "??0?$CShimUserSetting@VCUInt64UserSetting@@@@QAE@ABV0@@Z",
            "ordinal": 5
          },
          {
            "address": "0x10006920",
            "name": "??0?$CShimUserSetting@VCUInt64UserSetting@@@@QAE@XZ",
            "ordinal": 6
          },
          {
            "address": "0x10006ae0",
            "name": "??0CComputerNameSetting@@QAE@$$QAV0@@Z",
            "ordinal": 7
          },
          {
            "address": "0x10006ae0",
            "name": "??0CComputerNameSetting@@QAE@ABV0@@Z",
            "ordinal": 8
          },
          {
            "address": "0x10006ac0",
            "name": "??0CComputerNameSetting@@QAE@XZ",
            "ordinal": 9
          },
          {
            "address": "0x10006f70",
            "name": "??0CDUUIProgressSetting@@QAE@$$QAV0@@Z",
            "ordinal": 10
          },
          {
            "address": "0x10006f70",
            "name": "??0CDUUIProgressSetting@@QAE@ABV0@@Z",
            "ordinal": 11
          },
          {
            "address": "0x10006f50",
            "name": "??0CDUUIProgressSetting@@QAE@XZ",
            "ordinal": 12
          },
          {
            "address": "0x10006f10",
            "name": "??0CDUUIWelcomeSetting@@QAE@$$QAV0@@Z",
            "ordinal": 13
          },
          {
            "address": "0x10006f10",
            "name": "??0CDUUIWelcomeSetting@@QAE@ABV0@@Z",
            "ordinal": 14
          },
          {
            "address": "0x10006ef0",
            "name": "??0CDUUIWelcomeSetting@@QAE@XZ",
            "ordinal": 15
          },
          {
            "address": "0x10006c10",
            "name": "??0CDiskPartFileSystemUserSetting@@QAE@$$QAV0@@Z",
            "ordinal": 16
          },
          {
            "address": "0x10006c10",
            "name": "??0CDiskPartFileSystemUserSetting@@QAE@ABV0@@Z",
            "ordinal": 17
          },
          {
            "address": "0x10006bf0",
            "name": "??0CDiskPartFileSystemUserSetting@@QAE@XZ",
            "ordinal": 18
          },
          {
            "address": "0x10006c70",
            "name": "??0CDiskPartFormatUserSetting@@QAE@$$QAV0@@Z",
            "ordinal": 19
          },
          {
            "address": "0x10006c70",
            "name": "??0CDiskPartFormatUserSetting@@QAE@ABV0@@Z",
            "ordinal": 20
          },
          {
            "address": "0x10006c50",
            "name": "??0CDiskPartFormatUserSetting@@QAE@XZ",
            "ordinal": 21
          },
          {
            "address": "0x10006bb0",
            "name": "??0CDiskPartUserSetting@@QAE@$$QAV0@@Z",
            "ordinal": 22
          },
          {
            "address": "0x10006bb0",
            "name": "??0CDiskPartUserSetting@@QAE@ABV0@@Z",
            "ordinal": 23
          },
          {
            "address": "0x10006b90",
            "name": "??0CDiskPartUserSetting@@QAE@XZ",
            "ordinal": 24
          },
          {
            "address": "0x10006eb0",
            "name": "??0CEulaSetting@@QAE@$$QAV0@@Z",
            "ordinal": 25
          },
          {
            "address": "0x10006eb0",
            "name": "??0CEulaSetting@@QAE@ABV0@@Z",
            "ordinal": 26
          },
          {
            "address": "0x10006e90",
            "name": "??0CEulaSetting@@QAE@XZ",
            "ordinal": 27
          },
          {
            "address": "0x100070f0",
            "name": "??0CIBSUIImageSelectionSetting@@QAE@$$QAV0@@Z",
            "ordinal": 28
          },
          {
            "address": "0x100070f0",
            "name": "??0CIBSUIImageSelectionSetting@@QAE@ABV0@@Z",
            "ordinal": 29
          },
          {
            "address": "0x100070d0",
            "name": "??0CIBSUIImageSelectionSetting@@QAE@XZ",
            "ordinal": 30
          },
          {
            "address": "0x10007150",
            "name": "??0CKeyboardSetting@@QAE@$$QAV0@@Z",
            "ordinal": 31
          },
          {
            "address": "0x10007150",
            "name": "??0CKeyboardSetting@@QAE@ABV0@@Z",
            "ordinal": 32
          },
          {
            "address": "0x10007130",
            "name": "??0CKeyboardSetting@@QAE@XZ",
            "ordinal": 33
          },
          {
            "address": "0x10006e50",
            "name": "??0COOBEUIFinishSetting@@QAE@$$QAV0@@Z",
            "ordinal": 34
          },
          {
            "address": "0x10006e50",
            "name": "??0COOBEUIFinishSetting@@QAE@ABV0@@Z",
            "ordinal": 35
          },
          {
            "address": "0x10006e30",
            "name": "??0COOBEUIFinishSetting@@QAE@XZ",
            "ordinal": 36
          },
          {
            "address": "0x10006df0",
            "name": "??0COOBEUIWelcomeSetting@@QAE@$$QAV0@@Z",
            "ordinal": 37
          },
          {
            "address": "0x10006df0",
            "name": "??0COOBEUIWelcomeSetting@@QAE@ABV0@@Z",
            "ordinal": 38
          },
          {
            "address": "0x10006dd0",
            "name": "??0COOBEUIWelcomeSetting@@QAE@XZ",
            "ordinal": 39
          },
          {
            "address": "0x10006a70",
            "name": "??0CProductKeyUserSetting@@QAE@$$QAV0@@Z",
            "ordinal": 40
          },
          {
            "address": "0x10006a70",
            "name": "??0CProductKeyUserSetting@@QAE@ABV0@@Z",
            "ordinal": 41
          },
          {
            "address": "0x10006a50",
            "name": "??0CProductKeyUserSetting@@QAE@XZ",
            "ordinal": 42
          },
          {
            "address": "0x10006d90",
            "name": "??0CSetupUISummarySetting@@QAE@$$QAV0@@Z",
            "ordinal": 43
          },
          {
            "address": "0x10006d90",
            "name": "??0CSetupUISummarySetting@@QAE@ABV0@@Z",
            "ordinal": 44
          },
          {
            "address": "0x10006d70",
            "name": "??0CSetupUISummarySetting@@QAE@XZ",
            "ordinal": 45
          },
          {
            "address": "0x10006d30",
            "name": "??0CSetupUIWelcomeSetting@@QAE@$$QAV0@@Z",
            "ordinal": 46
          },
          {
            "address": "0x10006d30",
            "name": "??0CSetupUIWelcomeSetting@@QAE@ABV0@@Z",
            "ordinal": 47
          },
          {
            "address": "0x10006d10",
            "name": "??0CSetupUIWelcomeSetting@@QAE@XZ",
            "ordinal": 48
          },
          {
            "address": "0x10006a00",
            "name": "??0CShimStringUserSetting@@QAE@$$QAV0@@Z",
            "ordinal": 49
          },
          {
            "address": "0x10006a00",
            "name": "??0CShimStringUserSetting@@QAE@ABV0@@Z",
            "ordinal": 50
          },
          {
            "address": "0x100069e0",
            "name": "??0CShimStringUserSetting@@QAE@XZ",
            "ordinal": 51
          },
          {
            "address": "0x10006960",
            "name": "??0CShimUInt32UserSetting@@QAE@$$QAV0@@Z",
            "ordinal": 52
          },
          {
            "address": "0x10006960",
            "name": "??0CShimUInt32UserSetting@@QAE@ABV0@@Z",
            "ordinal": 53
          },
          {
            "address": "0x10006940",
            "name": "??0CShimUInt32UserSetting@@QAE@XZ",
            "ordinal": 54
          },
          {
            "address": "0x100069b0",
            "name": "??0CShimUInt64UserSetting@@QAE@$$QAV0@@Z",
            "ordinal": 55
          },
          {
            "address": "0x100069b0",
            "name": "??0CShimUInt64UserSetting@@QAE@ABV0@@Z",
            "ordinal": 56
          },
          {
            "address": "0x10006990",
            "name": "??0CShimUInt64UserSetting@@QAE@XZ",
            "ordinal": 57
          },
          {
            "address": "0x10006650",
            "name": "??0CShowFlagUserSetting@@IAE@XZ",
            "ordinal": 58
          },
          {
            "address": "0x10006680",
            "name": "??0CShowFlagUserSetting@@QAE@ABV0@@Z",
            "ordinal": 59
          },
          {
            "address": "0x100068c0",
            "name": "??0CSimpleStringUserSetting@@QAE@$$QAV0@@Z",
            "ordinal": 60
          },
          {
            "address": "0x100068c0",
            "name": "??0CSimpleStringUserSetting@@QAE@ABV0@@Z",
            "ordinal": 61
          },
          {
            "address": "0x100068a0",
            "name": "??0CSimpleStringUserSetting@@QAE@XZ",
            "ordinal": 62
          },
          {
            "address": "0x100067c0",
            "name": "??0CSimpleUInt32UserSetting@@QAE@$$QAV0@@Z",
            "ordinal": 63
          },
          {
            "address": "0x100067c0",
            "name": "??0CSimpleUInt32UserSetting@@QAE@ABV0@@Z",
            "ordinal": 64
          },
          {
            "address": "0x100067a0",
            "name": "??0CSimpleUInt32UserSetting@@QAE@XZ",
            "ordinal": 65
          },
          {
            "address": "0x10006840",
            "name": "??0CSimpleUInt64UserSetting@@QAE@$$QAV0@@Z",
            "ordinal": 66
          },
          {
            "address": "0x10006840",
            "name": "??0CSimpleUInt64UserSetting@@QAE@ABV0@@Z",
            "ordinal": 67
          },
          {
            "address": "0x10006820",
            "name": "??0CSimpleUInt64UserSetting@@QAE@XZ",
            "ordinal": 68
          },
          {
            "address": "0x100066c0",
            "name": "??0CStringUserSetting@@IAE@XZ",
            "ordinal": 69
          },
          {
            "address": "0x100066f0",
            "name": "??0CStringUserSetting@@QAE@ABV0@@Z",
            "ordinal": 70
          },
          {
            "address": "0x10006fd0",
            "name": "??0CTimezoneSetting@@QAE@$$QAV0@@Z",
            "ordinal": 71
          },
          {
            "address": "0x10006fd0",
            "name": "??0CTimezoneSetting@@QAE@ABV0@@Z",
            "ordinal": 72
          },
          {
            "address": "0x10006fb0",
            "name": "??0CTimezoneSetting@@QAE@XZ",
            "ordinal": 73
          },
          {
            "address": "0x100066c0",
            "name": "??0CUInt32UserSetting@@IAE@XZ",
            "ordinal": 74
          },
          {
            "address": "0x100066f0",
            "name": "??0CUInt32UserSetting@@QAE@ABV0@@Z",
            "ordinal": 75
          },
          {
            "address": "0x100066c0",
            "name": "??0CUInt64UserSetting@@IAE@XZ",
            "ordinal": 76
          },
          {
            "address": "0x100066f0",
            "name": "??0CUInt64UserSetting@@QAE@ABV0@@Z",
            "ordinal": 77
          },
          {
            "address": "0x10006cd0",
            "name": "??0CUpgStoreUserSetting@@QAE@$$QAV0@@Z",
            "ordinal": 78
          },
          {
            "address": "0x10006cd0",
            "name": "??0CUpgStoreUserSetting@@QAE@ABV0@@Z",
            "ordinal": 79
          },
          {
            "address": "0x10006cb0",
            "name": "??0CUpgStoreUserSetting@@QAE@XZ",
            "ordinal": 80
          },
          {
            "address": "0x10006b40",
            "name": "??0CUpgradeUserSetting@@QAE@$$QAV0@@Z",
            "ordinal": 81
          },
          {
            "address": "0x10006b40",
            "name": "??0CUpgradeUserSetting@@QAE@ABV0@@Z",
            "ordinal": 82
          },
          {
            "address": "0x10006b20",
            "name": "??0CUpgradeUserSetting@@QAE@XZ",
            "ordinal": 83
          },
          {
            "address": "0x100065f0",
            "name": "??0CUserSetting@@QAE@ABV0@@Z",
            "ordinal": 84
          },
          {
            "address": "0x10007200",
            "name": "??0CUserSetting@@QAE@XZ",
            "ordinal": 85
          },
          {
            "address": "0x10007090",
            "name": "??0CWDSUIImageSelectionSetting@@QAE@$$QAV0@@Z",
            "ordinal": 86
          },
          {
            "address": "0x10007090",
            "name": "??0CWDSUIImageSelectionSetting@@QAE@ABV0@@Z",
            "ordinal": 87
          },
          {
            "address": "0x10007070",
            "name": "??0CWDSUIImageSelectionSetting@@QAE@XZ",
            "ordinal": 88
          },
          {
            "address": "0x10007030",
            "name": "??0CWDSUIWelcomeSetting@@QAE@$$QAV0@@Z",
            "ordinal": 89
          },
          {
            "address": "0x10007030",
            "name": "??0CWDSUIWelcomeSetting@@QAE@ABV0@@Z",
            "ordinal": 90
          },
          {
            "address": "0x10007010",
            "name": "??0CWDSUIWelcomeSetting@@QAE@XZ",
            "ordinal": 91
          },
          {
            "address": "0x100066e0",
            "name": "??1?$CShimUserSetting@VCStringUserSetting@@@@QAE@XZ",
            "ordinal": 92
          },
          {
            "address": "0x100066e0",
            "name": "??1?$CShimUserSetting@VCUInt32UserSetting@@@@QAE@XZ",
            "ordinal": 93
          },
          {
            "address": "0x100066e0",
            "name": "??1?$CShimUserSetting@VCUInt64UserSetting@@@@QAE@XZ",
            "ordinal": 94
          },
          {
            "address": "0x100066e0",
            "name": "??1CComputerNameSetting@@QAE@XZ",
            "ordinal": 95
          },
          {
            "address": "0x10006670",
            "name": "??1CDUUIProgressSetting@@QAE@XZ",
            "ordinal": 96
          },
          {
            "address": "0x10006670",
            "name": "??1CDUUIWelcomeSetting@@QAE@XZ",
            "ordinal": 97
          },
          {
            "address": "0x100066e0",
            "name": "??1CDiskPartFileSystemUserSetting@@QAE@XZ",
            "ordinal": 98
          },
          {
            "address": "0x100066e0",
            "name": "??1CDiskPartFormatUserSetting@@QAE@XZ",
            "ordinal": 99
          },
          {
            "address": "0x100066e0",
            "name": "??1CDiskPartUserSetting@@QAE@XZ",
            "ordinal": 100
          },
          {
            "address": "0x100066e0",
            "name": "??1CEulaSetting@@QAE@XZ",
            "ordinal": 101
          },
          {
            "address": "0x10006670",
            "name": "??1CIBSUIImageSelectionSetting@@QAE@XZ",
            "ordinal": 102
          },
          {
            "address": "0x100066e0",
            "name": "??1CKeyboardSetting@@QAE@XZ",
            "ordinal": 103
          },
          {
            "address": "0x10006670",
            "name": "??1COOBEUIFinishSetting@@QAE@XZ",
            "ordinal": 104
          },
          {
            "address": "0x10006670",
            "name": "??1COOBEUIWelcomeSetting@@QAE@XZ",
            "ordinal": 105
          },
          {
            "address": "0x100066e0",
            "name": "??1CProductKeyUserSetting@@QAE@XZ",
            "ordinal": 106
          },
          {
            "address": "0x10006670",
            "name": "??1CSetupUISummarySetting@@QAE@XZ",
            "ordinal": 107
          },
          {
            "address": "0x10006670",
            "name": "??1CSetupUIWelcomeSetting@@QAE@XZ",
            "ordinal": 108
          },
          {
            "address": "0x100066e0",
            "name": "??1CShimStringUserSetting@@QAE@XZ",
            "ordinal": 109
          },
          {
            "address": "0x100066e0",
            "name": "??1CShimUInt32UserSetting@@QAE@XZ",
            "ordinal": 110
          },
          {
            "address": "0x100066e0",
            "name": "??1CShimUInt64UserSetting@@QAE@XZ",
            "ordinal": 111
          },
          {
            "address": "0x10006670",
            "name": "??1CShowFlagUserSetting@@IAE@XZ",
            "ordinal": 112
          },
          {
            "address": "0x100066e0",
            "name": "??1CSimpleStringUserSetting@@QAE@XZ",
            "ordinal": 113
          },
          {
            "address": "0x100066e0",
            "name": "??1CSimpleUInt32UserSetting@@QAE@XZ",
            "ordinal": 114
          },
          {
            "address": "0x100066e0",
            "name": "??1CSimpleUInt64UserSetting@@QAE@XZ",
            "ordinal": 115
          },
          {
            "address": "0x100066e0",
            "name": "??1CStringUserSetting@@IAE@XZ",
            "ordinal": 116
          },
          {
            "address": "0x100066e0",
            "name": "??1CTimezoneSetting@@QAE@XZ",
            "ordinal": 117
          },
          {
            "address": "0x100066e0",
            "name": "??1CUInt32UserSetting@@IAE@XZ",
            "ordinal": 118
          },
          {
            "address": "0x100066e0",
            "name": "??1CUInt64UserSetting@@IAE@XZ",
            "ordinal": 119
          },
          {
            "address": "0x100066e0",
            "name": "??1CUpgStoreUserSetting@@QAE@XZ",
            "ordinal": 120
          },
          {
            "address": "0x100066e0",
            "name": "??1CUpgradeUserSetting@@QAE@XZ",
            "ordinal": 121
          },
          {
            "address": "0x10007220",
            "name": "??1CUserSetting@@QAE@XZ",
            "ordinal": 122
          },
          {
            "address": "0x10006670",
            "name": "??1CWDSUIImageSelectionSetting@@QAE@XZ",
            "ordinal": 123
          },
          {
            "address": "0x10006670",
            "name": "??1CWDSUIWelcomeSetting@@QAE@XZ",
            "ordinal": 124
          },
          {
            "address": "0x10006620",
            "name": "??4?$CShimUserSetting@VCStringUserSetting@@@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 125
          },
          {
            "address": "0x10006620",
            "name": "??4?$CShimUserSetting@VCStringUserSetting@@@@QAEAAV0@ABV0@@Z",
            "ordinal": 126
          },
          {
            "address": "0x10006620",
            "name": "??4?$CShimUserSetting@VCUInt32UserSetting@@@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 127
          },
          {
            "address": "0x10006620",
            "name": "??4?$CShimUserSetting@VCUInt32UserSetting@@@@QAEAAV0@ABV0@@Z",
            "ordinal": 128
          },
          {
            "address": "0x10006620",
            "name": "??4?$CShimUserSetting@VCUInt64UserSetting@@@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 129
          },
          {
            "address": "0x10006620",
            "name": "??4?$CShimUserSetting@VCUInt64UserSetting@@@@QAEAAV0@ABV0@@Z",
            "ordinal": 130
          },
          {
            "address": "0x10006620",
            "name": "??4CComputerNameSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 131
          },
          {
            "address": "0x10006620",
            "name": "??4CComputerNameSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 132
          },
          {
            "address": "0x10006620",
            "name": "??4CDUUIProgressSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 133
          },
          {
            "address": "0x10006620",
            "name": "??4CDUUIProgressSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 134
          },
          {
            "address": "0x10006620",
            "name": "??4CDUUIWelcomeSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 135
          },
          {
            "address": "0x10006620",
            "name": "??4CDUUIWelcomeSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 136
          },
          {
            "address": "0x10006620",
            "name": "??4CDiskPartFileSystemUserSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 137
          },
          {
            "address": "0x10006620",
            "name": "??4CDiskPartFileSystemUserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 138
          },
          {
            "address": "0x10006620",
            "name": "??4CDiskPartFormatUserSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 139
          },
          {
            "address": "0x10006620",
            "name": "??4CDiskPartFormatUserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 140
          },
          {
            "address": "0x10006620",
            "name": "??4CDiskPartUserSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 141
          },
          {
            "address": "0x10006620",
            "name": "??4CDiskPartUserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 142
          },
          {
            "address": "0x10006620",
            "name": "??4CEulaSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 143
          },
          {
            "address": "0x10006620",
            "name": "??4CEulaSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 144
          },
          {
            "address": "0x10006620",
            "name": "??4CIBSUIImageSelectionSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 145
          },
          {
            "address": "0x10006620",
            "name": "??4CIBSUIImageSelectionSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 146
          },
          {
            "address": "0x10006620",
            "name": "??4CKeyboardSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 147
          },
          {
            "address": "0x10006620",
            "name": "??4CKeyboardSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 148
          },
          {
            "address": "0x10006620",
            "name": "??4COOBEUIFinishSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 149
          },
          {
            "address": "0x10006620",
            "name": "??4COOBEUIFinishSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 150
          },
          {
            "address": "0x10006620",
            "name": "??4COOBEUIWelcomeSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 151
          },
          {
            "address": "0x10006620",
            "name": "??4COOBEUIWelcomeSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 152
          },
          {
            "address": "0x10006620",
            "name": "??4CProductKeyUserSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 153
          },
          {
            "address": "0x10006620",
            "name": "??4CProductKeyUserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 154
          },
          {
            "address": "0x10006620",
            "name": "??4CSetupUISummarySetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 155
          },
          {
            "address": "0x10006620",
            "name": "??4CSetupUISummarySetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 156
          },
          {
            "address": "0x10006620",
            "name": "??4CSetupUIWelcomeSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 157
          },
          {
            "address": "0x10006620",
            "name": "??4CSetupUIWelcomeSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 158
          },
          {
            "address": "0x10006620",
            "name": "??4CShimStringUserSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 159
          },
          {
            "address": "0x10006620",
            "name": "??4CShimStringUserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 160
          },
          {
            "address": "0x10006620",
            "name": "??4CShimUInt32UserSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 161
          },
          {
            "address": "0x10006620",
            "name": "??4CShimUInt32UserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 162
          },
          {
            "address": "0x10006620",
            "name": "??4CShimUInt64UserSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 163
          },
          {
            "address": "0x10006620",
            "name": "??4CShimUInt64UserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 164
          },
          {
            "address": "0x10006620",
            "name": "??4CShowFlagUserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 165
          },
          {
            "address": "0x10006620",
            "name": "??4CSimpleStringUserSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 166
          },
          {
            "address": "0x10006620",
            "name": "??4CSimpleStringUserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 167
          },
          {
            "address": "0x10006620",
            "name": "??4CSimpleUInt32UserSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 168
          },
          {
            "address": "0x10006620",
            "name": "??4CSimpleUInt32UserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 169
          },
          {
            "address": "0x10006620",
            "name": "??4CSimpleUInt64UserSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 170
          },
          {
            "address": "0x10006620",
            "name": "??4CSimpleUInt64UserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 171
          },
          {
            "address": "0x10006620",
            "name": "??4CStringUserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 172
          },
          {
            "address": "0x10006620",
            "name": "??4CTimezoneSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 173
          },
          {
            "address": "0x10006620",
            "name": "??4CTimezoneSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 174
          },
          {
            "address": "0x10006620",
            "name": "??4CUInt32UserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 175
          },
          {
            "address": "0x10006620",
            "name": "??4CUInt64UserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 176
          },
          {
            "address": "0x10006620",
            "name": "??4CUpgStoreUserSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 177
          },
          {
            "address": "0x10006620",
            "name": "??4CUpgStoreUserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 178
          },
          {
            "address": "0x10006620",
            "name": "??4CUpgradeUserSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 179
          },
          {
            "address": "0x10006620",
            "name": "??4CUpgradeUserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 180
          },
          {
            "address": "0x10006620",
            "name": "??4CUserSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 181
          },
          {
            "address": "0x10006620",
            "name": "??4CWDSUIImageSelectionSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 182
          },
          {
            "address": "0x10006620",
            "name": "??4CWDSUIImageSelectionSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 183
          },
          {
            "address": "0x10006620",
            "name": "??4CWDSUIWelcomeSetting@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 184
          },
          {
            "address": "0x10006620",
            "name": "??4CWDSUIWelcomeSetting@@QAEAAV0@ABV0@@Z",
            "ordinal": 185
          },
          {
            "address": "0x100010f0",
            "name": "??_7?$CShimUserSetting@VCStringUserSetting@@@@6B@",
            "ordinal": 186
          },
          {
            "address": "0x100010f0",
            "name": "??_7?$CShimUserSetting@VCUInt32UserSetting@@@@6B@",
            "ordinal": 187
          },
          {
            "address": "0x100010f0",
            "name": "??_7?$CShimUserSetting@VCUInt64UserSetting@@@@6B@",
            "ordinal": 188
          },
          {
            "address": "0x10001120",
            "name": "??_7CComputerNameSetting@@6B@",
            "ordinal": 189
          },
          {
            "address": "0x100010d0",
            "name": "??_7CDUUIProgressSetting@@6B@",
            "ordinal": 190
          },
          {
            "address": "0x10001170",
            "name": "??_7CDUUIWelcomeSetting@@6B@",
            "ordinal": 191
          },
          {
            "address": "0x100012c4",
            "name": "??_7CDiskPartFileSystemUserSetting@@6B@",
            "ordinal": 192
          },
          {
            "address": "0x100011fc",
            "name": "??_7CDiskPartFormatUserSetting@@6B@",
            "ordinal": 193
          },
          {
            "address": "0x10001210",
            "name": "??_7CDiskPartUserSetting@@6B@",
            "ordinal": 194
          },
          {
            "address": "0x10001228",
            "name": "??_7CEulaSetting@@6B@",
            "ordinal": 195
          },
          {
            "address": "0x1000119c",
            "name": "??_7CIBSUIImageSelectionSetting@@6B@",
            "ordinal": 196
          },
          {
            "address": "0x100011e8",
            "name": "??_7CKeyboardSetting@@6B@",
            "ordinal": 197
          },
          {
            "address": "0x10001158",
            "name": "??_7COOBEUIFinishSetting@@6B@",
            "ordinal": 198
          },
          {
            "address": "0x10001138",
            "name": "??_7COOBEUIWelcomeSetting@@6B@",
            "ordinal": 199
          },
          {
            "address": "0x10001108",
            "name": "??_7CProductKeyUserSetting@@6B@",
            "ordinal": 200
          },
          {
            "address": "0x100012b8",
            "name": "??_7CSetupUISummarySetting@@6B@",
            "ordinal": 201
          },
          {
            "address": "0x100011a8",
            "name": "??_7CSetupUIWelcomeSetting@@6B@",
            "ordinal": 202
          },
          {
            "address": "0x1000123c",
            "name": "??_7CShimStringUserSetting@@6B@",
            "ordinal": 203
          },
          {
            "address": "0x10001280",
            "name": "??_7CShimUInt32UserSetting@@6B@",
            "ordinal": 204
          },
          {
            "address": "0x10001268",
            "name": "??_7CShimUInt64UserSetting@@6B@",
            "ordinal": 205
          },
          {
            "address": "0x100011c8",
            "name": "??_7CShowFlagUserSetting@@6B@",
            "ordinal": 206
          },
          {
            "address": "0x100011d4",
            "name": "??_7CSimpleStringUserSetting@@6B@",
            "ordinal": 207
          },
          {
            "address": "0x100011b4",
            "name": "??_7CSimpleUInt32UserSetting@@6B@",
            "ordinal": 208
          },
          {
            "address": "0x10001298",
            "name": "??_7CSimpleUInt64UserSetting@@6B@",
            "ordinal": 209
          },
          {
            "address": "0x10001144",
            "name": "??_7CStringUserSetting@@6B@",
            "ordinal": 210
          },
          {
            "address": "0x100010dc",
            "name": "??_7CTimezoneSetting@@6B@",
            "ordinal": 211
          },
          {
            "address": "0x10001144",
            "name": "??_7CUInt32UserSetting@@6B@",
            "ordinal": 212
          },
          {
            "address": "0x10001144",
            "name": "??_7CUInt64UserSetting@@6B@",
            "ordinal": 213
          },
          {
            "address": "0x100010bc",
            "name": "??_7CUpgStoreUserSetting@@6B@",
            "ordinal": 214
          },
          {
            "address": "0x10001254",
            "name": "??_7CUpgradeUserSetting@@6B@",
            "ordinal": 215
          },
          {
            "address": "0x100012ac",
            "name": "??_7CUserSetting@@6B@",
            "ordinal": 216
          },
          {
            "address": "0x1000117c",
            "name": "??_7CWDSUIImageSelectionSetting@@6B@",
            "ordinal": 217
          },
          {
            "address": "0x10001164",
            "name": "??_7CWDSUIWelcomeSetting@@6B@",
            "ordinal": 218
          },
          {
            "address": "0x10007260",
            "name": "?AcquireMutex@CUserSetting@@IAEXXZ",
            "ordinal": 219
          },
          {
            "address": "0x10007540",
            "name": "?DeserializeField@CUserSetting@@IAEJPBGIPAUWDS_DATA@@H@Z",
            "ordinal": 220
          },
          {
            "address": "0x100079e0",
            "name": "?DeserializeString@CStringUserSetting@@IAEJPAPAGH@Z",
            "ordinal": 221
          },
          {
            "address": "0x100077d0",
            "name": "?DeserializeUInt32@CUInt32UserSetting@@IAEJPAIH@Z",
            "ordinal": 222
          },
          {
            "address": "0x100078c0",
            "name": "?DeserializeUInt64@CUInt64UserSetting@@IAEJPA_KH@Z",
            "ordinal": 223
          },
          {
            "address": "0x10007330",
            "name": "?GetBlackboard@CUserSetting@@IAEPAU_BLACKBOARD@@XZ",
            "ordinal": 229
          },
          {
            "address": "0x100073d0",
            "name": "?GetKeyName@CUserSetting@@IAEJPAGHH@Z",
            "ordinal": 231
          },
          {
            "address": "0x10007380",
            "name": "?GetModuleId@CUserSetting@@QAEPAXXZ",
            "ordinal": 232
          },
          {
            "address": "0x10007dd0",
            "name": "?IsUpgrade@CUpgradeUserSetting@@SGHXZ",
            "ordinal": 234
          },
          {
            "address": "0x10007660",
            "name": "?ReadError@CUserSetting@@IAEJPAJH@Z",
            "ordinal": 237
          },
          {
            "address": "0x10007620",
            "name": "?ReadShow@CUserSetting@@IAEJPAHH@Z",
            "ordinal": 238
          },
          {
            "address": "0x100072d0",
            "name": "?ReleaseMutex@CUserSetting@@IAEXXZ",
            "ordinal": 239
          },
          {
            "address": "0x10007450",
            "name": "?SerializeField@CUserSetting@@IAEXPBGPAUWDS_DATA@@@Z",
            "ordinal": 240
          },
          {
            "address": "0x10007980",
            "name": "?SerializeString@CStringUserSetting@@IAEXPBG@Z",
            "ordinal": 241
          },
          {
            "address": "0x10007790",
            "name": "?SerializeUInt32@CUInt32UserSetting@@IAEXI@Z",
            "ordinal": 242
          },
          {
            "address": "0x10007880",
            "name": "?SerializeUInt64@CUInt64UserSetting@@IAEX_K@Z",
            "ordinal": 243
          },
          {
            "address": "0x10007390",
            "name": "?SetModuleId@CUserSetting@@QAEXPAX@Z",
            "ordinal": 244
          },
          {
            "address": "0x10007ad0",
            "name": "?Simple_get_String@CStringUserSetting@@IAEJPAPAG@Z",
            "ordinal": 245
          },
          {
            "address": "0x10007810",
            "name": "?Simple_get_UInt32@CUInt32UserSetting@@IAEJPAI@Z",
            "ordinal": 246
          },
          {
            "address": "0x10007910",
            "name": "?Simple_get_UInt64@CUInt64UserSetting@@IAEJPA_K@Z",
            "ordinal": 247
          },
          {
            "address": "0x10006870",
            "name": "?Simple_set_String@CStringUserSetting@@IAEJPBG@Z",
            "ordinal": 248
          },
          {
            "address": "0x10006770",
            "name": "?Simple_set_UInt32@CUInt32UserSetting@@IAEJI@Z",
            "ordinal": 249
          },
          {
            "address": "0x100067f0",
            "name": "?Simple_set_UInt64@CUInt64UserSetting@@IAEJ_K@Z",
            "ordinal": 250
          },
          {
            "address": "0x10007e50",
            "name": "?UnattendChecked@CUpgradeUserSetting@@SGHXZ",
            "ordinal": 251
          },
          {
            "address": "0x100019b8",
            "name": "?c_stErrorName@CUserSetting@@1QBGB",
            "ordinal": 252
          },
          {
            "address": "0x100019b4",
            "name": "?c_stMutex@CUserSetting@@1QBGB",
            "ordinal": 253
          },
          {
            "address": "0x100019b0",
            "name": "?c_stShowName@CUserSetting@@1QBGB",
            "ordinal": 254
          },
          {
            "address": "0x100019ac",
            "name": "?c_stValueName@CUserSetting@@1QBGB",
            "ordinal": 255
          },
          {
            "address": "0x10006750",
            "name": "?get_Error@?$CShimUserSetting@VCStringUserSetting@@@@UAEJPAJ@Z",
            "ordinal": 256
          },
          {
            "address": "0x10006750",
            "name": "?get_Error@?$CShimUserSetting@VCUInt32UserSetting@@@@UAEJPAJ@Z",
            "ordinal": 257
          },
          {
            "address": "0x10006750",
            "name": "?get_Error@?$CShimUserSetting@VCUInt64UserSetting@@@@UAEJPAJ@Z",
            "ordinal": 258
          },
          {
            "address": "0x10007770",
            "name": "?get_Error@CShowFlagUserSetting@@UAEJPAJ@Z",
            "ordinal": 259
          },
          {
            "address": "0x10006750",
            "name": "?get_Error@CSimpleStringUserSetting@@UAEJPAJ@Z",
            "ordinal": 260
          },
          {
            "address": "0x10006750",
            "name": "?get_Error@CSimpleUInt32UserSetting@@UAEJPAJ@Z",
            "ordinal": 261
          },
          {
            "address": "0x10006750",
            "name": "?get_Error@CSimpleUInt64UserSetting@@UAEJPAJ@Z",
            "ordinal": 262
          },
          {
            "address": "0x10006aa0",
            "name": "?get_Name@CComputerNameSetting@@EAEPAGXZ",
            "ordinal": 263
          },
          {
            "address": "0x10006f40",
            "name": "?get_Name@CDUUIProgressSetting@@EAEPAGXZ",
            "ordinal": 264
          },
          {
            "address": "0x10006ee0",
            "name": "?get_Name@CDUUIWelcomeSetting@@EAEPAGXZ",
            "ordinal": 265
          },
          {
            "address": "0x10006be0",
            "name": "?get_Name@CDiskPartFileSystemUserSetting@@EAEPAGXZ",
            "ordinal": 266
          },
          {
            "address": "0x10006c40",
            "name": "?get_Name@CDiskPartFormatUserSetting@@EAEPAGXZ",
            "ordinal": 267
          },
          {
            "address": "0x10006b70",
            "name": "?get_Name@CDiskPartUserSetting@@EAEPAGXZ",
            "ordinal": 268
          },
          {
            "address": "0x10006e80",
            "name": "?get_Name@CEulaSetting@@EAEPAGXZ",
            "ordinal": 269
          },
          {
            "address": "0x100070c0",
            "name": "?get_Name@CIBSUIImageSelectionSetting@@EAEPAGXZ",
            "ordinal": 270
          },
          {
            "address": "0x10007120",
            "name": "?get_Name@CKeyboardSetting@@EAEPAGXZ",
            "ordinal": 271
          },
          {
            "address": "0x10006e20",
            "name": "?get_Name@COOBEUIFinishSetting@@EAEPAGXZ",
            "ordinal": 272
          },
          {
            "address": "0x10006dc0",
            "name": "?get_Name@COOBEUIWelcomeSetting@@EAEPAGXZ",
            "ordinal": 273
          },
          {
            "address": "0x10006a30",
            "name": "?get_Name@CProductKeyUserSetting@@EAEPAGXZ",
            "ordinal": 274
          },
          {
            "address": "0x10006d60",
            "name": "?get_Name@CSetupUISummarySetting@@EAEPAGXZ",
            "ordinal": 275
          },
          {
            "address": "0x10006d00",
            "name": "?get_Name@CSetupUIWelcomeSetting@@EAEPAGXZ",
            "ordinal": 276
          },
          {
            "address": "0x10006fa0",
            "name": "?get_Name@CTimezoneSetting@@EAEPAGXZ",
            "ordinal": 277
          },
          {
            "address": "0x10006ca0",
            "name": "?get_Name@CUpgStoreUserSetting@@EAEPAGXZ",
            "ordinal": 278
          },
          {
            "address": "0x10006b10",
            "name": "?get_Name@CUpgradeUserSetting@@EAEPAGXZ",
            "ordinal": 279
          },
          {
            "address": "0x10007060",
            "name": "?get_Name@CWDSUIImageSelectionSetting@@EAEPAGXZ",
            "ordinal": 280
          },
          {
            "address": "0x10007000",
            "name": "?get_Name@CWDSUIWelcomeSetting@@EAEPAGXZ",
            "ordinal": 281
          },
          {
            "address": "0x10006730",
            "name": "?get_Show@?$CShimUserSetting@VCStringUserSetting@@@@UAEJPAH@Z",
            "ordinal": 282
          },
          {
            "address": "0x10006730",
            "name": "?get_Show@?$CShimUserSetting@VCUInt32UserSetting@@@@UAEJPAH@Z",
            "ordinal": 283
          },
          {
            "address": "0x10006730",
            "name": "?get_Show@?$CShimUserSetting@VCUInt64UserSetting@@@@UAEJPAH@Z",
            "ordinal": 284
          },
          {
            "address": "0x100089f0",
            "name": "?get_Show@CComputerNameSetting@@UAEJPAH@Z",
            "ordinal": 285
          },
          {
            "address": "0x10008030",
            "name": "?get_Show@CDiskPartUserSetting@@UAEJPAH@Z",
            "ordinal": 286
          },
          {
            "address": "0x10007700",
            "name": "?get_Show@CShowFlagUserSetting@@UAEJPAH@Z",
            "ordinal": 287
          },
          {
            "address": "0x10006730",
            "name": "?get_Show@CSimpleStringUserSetting@@UAEJPAH@Z",
            "ordinal": 288
          },
          {
            "address": "0x10006730",
            "name": "?get_Show@CSimpleUInt32UserSetting@@UAEJPAH@Z",
            "ordinal": 289
          },
          {
            "address": "0x10006730",
            "name": "?get_Show@CSimpleUInt64UserSetting@@UAEJPAH@Z",
            "ordinal": 290
          },
          {
            "address": "0x10006890",
            "name": "?get_String@CShimStringUserSetting@@UAEJPAPAG@Z",
            "ordinal": 291
          },
          {
            "address": "0x10006890",
            "name": "?get_String@CSimpleStringUserSetting@@UAEJPAPAG@Z",
            "ordinal": 292
          },
          {
            "address": "0x10008080",
            "name": "?get_UInt32@CDiskPartUserSetting@@UAEJPAI@Z",
            "ordinal": 293
          },
          {
            "address": "0x10006790",
            "name": "?get_UInt32@CShimUInt32UserSetting@@UAEJPAI@Z",
            "ordinal": 294
          },
          {
            "address": "0x10006790",
            "name": "?get_UInt32@CSimpleUInt32UserSetting@@UAEJPAI@Z",
            "ordinal": 295
          },
          {
            "address": "0x10006810",
            "name": "?get_UInt64@CShimUInt64UserSetting@@UAEJPA_K@Z",
            "ordinal": 296
          },
          {
            "address": "0x10006810",
            "name": "?get_UInt64@CSimpleUInt64UserSetting@@UAEJPA_K@Z",
            "ordinal": 297
          },
          {
            "address": "0x10006ab0",
            "name": "?get_ValidateID@CComputerNameSetting@@EAEHXZ",
            "ordinal": 298
          },
          {
            "address": "0x10006b80",
            "name": "?get_ValidateID@CDiskPartUserSetting@@EAEHXZ",
            "ordinal": 299
          },
          {
            "address": "0x10006a40",
            "name": "?get_ValidateID@CProductKeyUserSetting@@EAEHXZ",
            "ordinal": 300
          },
          {
            "address": "0x10007500",
            "name": "?set_Error@CUserSetting@@QAEJJ@Z",
            "ordinal": 301
          },
          {
            "address": "0x100074c0",
            "name": "?set_Show@CUserSetting@@QAEJH@Z",
            "ordinal": 302
          },
          {
            "address": "0x10008a30",
            "name": "?set_String@CComputerNameSetting@@UAEJPBG@Z",
            "ordinal": 303
          },
          {
            "address": "0x10007ca0",
            "name": "?set_String@CShimStringUserSetting@@UAEJPBG@Z",
            "ordinal": 304
          },
          {
            "address": "0x10006870",
            "name": "?set_String@CSimpleStringUserSetting@@UAEJPBG@Z",
            "ordinal": 305
          },
          {
            "address": "0x10008420",
            "name": "?set_UInt32@CDiskPartUserSetting@@UAEJI@Z",
            "ordinal": 306
          },
          {
            "address": "0x10007b40",
            "name": "?set_UInt32@CShimUInt32UserSetting@@UAEJI@Z",
            "ordinal": 307
          },
          {
            "address": "0x10006770",
            "name": "?set_UInt32@CSimpleUInt32UserSetting@@UAEJI@Z",
            "ordinal": 308
          },
          {
            "address": "0x10007d50",
            "name": "?set_UInt32@CUpgradeUserSetting@@UAEJI@Z",
            "ordinal": 309
          },
          {
            "address": "0x10007bf0",
            "name": "?set_UInt64@CShimUInt64UserSetting@@UAEJ_K@Z",
            "ordinal": 310
          },
          {
            "address": "0x100067f0",
            "name": "?set_UInt64@CSimpleUInt64UserSetting@@UAEJ_K@Z",
            "ordinal": 311
          },
          {
            "address": "0x10008bd0",
            "name": "CallbackGetArgumentInt32",
            "ordinal": 312
          },
          {
            "address": "0x10008c00",
            "name": "CallbackGetArgumentString",
            "ordinal": 313
          },
          {
            "address": "0x10008ba0",
            "name": "CallbackGetArgumentUInt64",
            "ordinal": 314
          },
          {
            "address": "0x10005b10",
            "name": "DiskRegionSupportsCapabilityForType",
            "ordinal": 224
          },
          {
            "address": "0x10005c30",
            "name": "DiskSupportsCapabilityForType",
            "ordinal": 225
          },
          {
            "address": "0x10006580",
            "name": "FreeReason",
            "ordinal": 226
          },
          {
            "address": "0x10006050",
            "name": "GetApplicableDiskReason",
            "ordinal": 227
          },
          {
            "address": "0x10005f00",
            "name": "GetApplicableDiskRegionReason",
            "ordinal": 228
          },
          {
            "address": "0x100058e0",
            "name": "GetDiskKey",
            "ordinal": 230
          },
          {
            "address": "0x10005920",
            "name": "GetRegionKey",
            "ordinal": 233
          },
          {
            "address": "0x100056e0",
            "name": "IsCrossArchitectureInstall",
            "ordinal": 315
          },
          {
            "address": "0x10006160",
            "name": "LogDiskReasons",
            "ordinal": 235
          },
          {
            "address": "0x100061a0",
            "name": "LogDiskRegionReasons",
            "ordinal": 236
          },
          {
            "address": "0x10009620",
            "name": "MergeEtlFiles",
            "ordinal": 316
          },
          {
            "address": "0x10009170",
            "name": "PublishMessage",
            "ordinal": 317
          },
          {
            "address": "0x100057a0",
            "name": "SignalSetupComplianceBlock",
            "ordinal": 318
          },
          {
            "address": "0x10008e20",
            "name": "WdsCollectionAddString",
            "ordinal": 319
          },
          {
            "address": "0x10008d40",
            "name": "WdsCollectionAddUInt32",
            "ordinal": 320
          },
          {
            "address": "0x10008db0",
            "name": "WdsCollectionAddUInt64",
            "ordinal": 321
          },
          {
            "address": "0x10009000",
            "name": "WdsPickTempDriveBasedOnInstallDrive",
            "ordinal": 322
          },
          {
            "address": "0x10008e90",
            "name": "WdsValidateInstallDrive",
            "ordinal": 323
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x0002f450",
            "size": "0x00003e43"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x00036360",
            "size": "0x000000c8"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x00039000",
            "size": "0x000003f8"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x00037e00",
            "size": "0x00002148"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x0003a000",
            "size": "0x00002608"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x00004f70",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x00001010",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x00036000",
            "size": "0x0000035c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x0002f328",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x00032293",
            "size_of_data": "0x00032400",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.47"
          },
          {
            "name": ".data",
            "raw_address": "0x00032800",
            "virtual_address": "0x00034000",
            "virtual_size": "0x0000155c",
            "size_of_data": "0x00001000",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "3.54"
          },
          {
            "name": ".idata",
            "raw_address": "0x00033800",
            "virtual_address": "0x00036000",
            "virtual_size": "0x0000167a",
            "size_of_data": "0x00001800",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.29"
          },
          {
            "name": ".didat",
            "raw_address": "0x00035000",
            "virtual_address": "0x00038000",
            "virtual_size": "0x00000020",
            "size_of_data": "0x00000200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "0.45"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x00035200",
            "virtual_address": "0x00039000",
            "virtual_size": "0x000003f8",
            "size_of_data": "0x00000400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "3.38"
          },
          {
            "name": ".reloc",
            "raw_address": "0x00035600",
            "virtual_address": "0x0003a000",
            "virtual_size": "0x00002608",
            "size_of_data": "0x00002800",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.54"
          }
        ],
        "overlay": {
          "offset": "0x00037e00",
          "size": "0x00002148"
        },
        "resources": [
          {
            "name": "RT_VERSION",
            "offset": "0x00039060",
            "size": "0x00000394",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.53"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "OS Deployment Utilities"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WDSUTIL"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "WDSUTIL.DLL"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "d3477f2991202dabe5c7abb4d3666c85",
        "timestamp": "2101-07-12 06:14:19",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 9
      },
      "data": null,
      "strings": [
        "<X<^<m<",
        "Invalid image header checksum.",
        "9C0s2",
        "??0CUserSetting@@QAE@ABV0@@Z",
        ";-;H;",
        "Microsoft Time-Stamp Service",
        "V`^_]",
        "CShimStringUserSetting::set_String",
        "SystemTimeToFileTime",
        "CStringUserSetting::Simple_get_String",
        "\\\\.\\?:",
        "?get_Name@CDiskPartUserSetting@@EAEPAGXZ",
        "??4CSetupUIWelcomeSetting@@QAEAAV0@ABV0@@Z",
        "d([0-9])",
        "??1COOBEUIWelcomeSetting@@QAE@XZ",
        "6\"6&6,60666:6A6R6W6]6a6f6l6",
        "?GetModuleId@CUserSetting@@QAEPAXXZ",
        "7#7@7`7",
        "malloc",
        ".rsrc",
        "RtlGetDeviceFamilyInfoEnum",
        "Upgrade Store Path",
        "[%hs]",
        "=3>o>",
        "??4CShimUInt32UserSetting@@QAEAAV0@$$QAV0@@Z",
        "229879+4583620",
        "UnmapViewOfFile",
        "5$5D5L5T5\\5h5",
        "HeapSize",
        "hr != ((HRESULT)0x80020005L)",
        "7#7*727:7B7N7W7\\7b7l7v7",
        "9U$u$",
        "WdsInitializeDataUInt32",
        "Local\\SM0:%d:%d:%hs",
        "??4CDiskPartFileSystemUserSetting@@QAEAAV0@$$QAV0@@Z",
        ">G?Z?s?",
        ":3;F;",
        ";,;R;q;",
        "0U2E3",
        "IsDebuggerPresent",
        "ModuleId != 0",
        "8RSDSu",
        "1.151S1",
        "VirtualProtect",
        "u]j\\R",
        "wcsstr",
        "3$444@4H4|4",
        "; ;<;L;X;`;",
        "CUserSetting::ReadError",
        "?get_Error@CShowFlagUserSetting@@UAEJPAJ@Z",
        "??4?$CShimUserSetting@VCStringUserSetting@@@@QAEAAV0@ABV0@@Z",
        "Paging exception occurred while processing image file.",
        "6)6h6",
        "TerminateProcess",
        "646<6D6L6T6`6",
        ".idata$5",
        "??4CDiskPartFormatUserSetting@@QAEAAV0@$$QAV0@@Z",
        "4@5V5",
        "??0COOBEUIWelcomeSetting@@QAE@ABV0@@Z",
        "??0CDiskPartFileSystemUserSetting@@QAE@$$QAV0@@Z",
        "?set_String@CSimpleStringUserSetting@@UAEJPBG@Z",
        "8,878H8N8v9}9",
        "WinSAT/Metrics",
        "8a9|9",
        "_purecall",
        "040904B0",
        "Microsoft Time-Stamp Service0",
        "HeapFree",
        "??1CDUUIWelcomeSetting@@QAE@XZ",
        "200304183039Z",
        "??4COOBEUIFinishSetting@@QAEAAV0@$$QAV0@@Z",
        "676n607",
        ".data$r$brc",
        ">$>,>L>T>\\>x>",
        "Redmond1",
        "<:RSDSu",
        "Msg:[%ws] ",
        "ole32.dll",
        "Images",
        "j\\Yf;",
        "[multiple files]",
        "??0COOBEUIWelcomeSetting@@QAE@$$QAV0@@Z",
        "*.xml",
        "??0CSimpleStringUserSetting@@QAE@XZ",
        "??1CUpgradeUserSetting@@QAE@XZ",
        "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8",
        "UnregisterClassA",
        "3E3K3X3c3|3",
        "??4CShimStringUserSetting@@QAEAAV0@ABV0@@Z",
        "??4CUpgStoreUserSetting@@QAEAAV0@$$QAV0@@Z",
        "?4?Z?u?",
        "An internal error occurred",
        "=0=<=\\=d=p=",
        "(((HRESULT)(hrTemp)) >= 0)",
        "\\StringFileInfo\\%04X%04X\\%ws",
        ";:<w<",
        "?-?A?J?g?",
        "??0CSetupUISummarySetting@@QAE@ABV0@@Z",
        "?set_String@CShimStringUserSetting@@UAEJPBG@Z",
        "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a",
        "?$?X?h?t?",
        "??4CUInt64UserSetting@@QAEAAV0@ABV0@@Z",
        "7:8F8N8f8n8{8",
        "CreateSemaphoreExW",
        "??0CShimStringUserSetting@@QAE@$$QAV0@@Z",
        "23292L2S2Y2^2i2v2",
        "SizeofResource",
        "6.666E6M6j6",
        "5\\6r6",
        "041X1l1",
        "CurrentIP",
        "?get_Name@CComputerNameSetting@@EAEPAGXZ",
        ".xdata$x",
        "tCUserSetting::GetBlackboard",
        "SignalSetupComplianceBlock",
        "??1CShimUInt64UserSetting@@QAE@XZ",
        "GetIfTable2Ex",
        "1!1<1b1",
        "_vscwprintf",
        ".didat$3",
        "Microsoft Corporation1",
        ">@?h?~?",
        "\\VarFileInfo\\Translation",
        "??4?$CShimUserSetting@VCStringUserSetting@@@@QAEAAV0@$$QAV0@@Z",
        "Multiple CvDbg entries in IL-only image.",
        "WdsPublishImmediateEx",
        "WdsPackCollection",
        "wcscspn",
        "?get_ValidateID@CDiskPartUserSetting@@EAEHXZ",
        "7,8R8",
        "LogDiskReasonsForType",
        "1T1|1",
        "StringFileInfo",
        "N0L0J",
        "r~akow",
        "8/8Z8c8",
        "?get_UInt32@CDiskPartUserSetting@@UAEJPAI@Z",
        "??4CSetupUISummarySetting@@QAEAAV0@ABV0@@Z",
        "Invalid executable format.",
        "\\\\.\\PHYSICALDRIVE%d",
        "3L4R445K6",
        "\\Framework64\\",
        "onecore\\internal\\sdk\\inc\\wil\\opensource\\wil\\resource.h",
        "??4CUpgStoreUserSetting@@QAEAAV0@ABV0@@Z",
        "??1CComputerNameSetting@@QAE@XZ",
        "%s failure: ",
        "L$,!D$",
        "%u.%u.%u.%u",
        "7N7Z7",
        "<-<W<v<",
        ">O>_>k>x>",
        "??0CTimezoneSetting@@QAE@$$QAV0@@Z",
        "4+464N4Y4^4",
        "VWjXP",
        "WaitForSingleObjectEx",
        "2F5e5",
        "ra([a-zA-Z0-9])",
        "vector<T> too long",
        "??4CTimezoneSetting@@QAEAAV0@ABV0@@Z",
        "%Microsoft Windows Production PCA 2011",
        "?UnattendChecked@CUpgradeUserSetting@@SGHXZ",
        "G;~8r",
        "0'0-0B0Z0",
        "=L9o<",
        "CUInt64UserSetting::Simple_get_UInt64",
        ".text$x",
        "SelectedImageArch",
        "??_7CSimpleUInt32UserSetting@@6B@",
        "?get_Name@CEulaSetting@@EAEPAGXZ",
        "\\Device\\Mup\\",
        "??4CSetupUISummarySetting@@QAEAAV0@$$QAV0@@Z",
        "QRPh(",
        "222;2C2Q2",
        "8C9`9|9",
        "9c:y:",
        "VarFileInfo",
        "?'?6?Z?r?",
        "oXPERF_EmbeddedPdbPath",
        "PPPPVWP",
        ";D;f;s;",
        "r#w%;",
        "uw9ALrr",
        "DeleteCriticalSection",
        "?get_ValidateID@CComputerNameSetting@@EAEHXZ",
        "HZo6m|",
        "memmove",
        "=$=?=Z=u=",
        "?ReadShow@CUserSetting@@IAEJPAHH@Z",
        "??0CDiskPartUserSetting@@QAE@ABV0@@Z",
        "t&;9u",
        "c([a-zA-Z])",
        "DiskSupportsCapabilityForType",
        "??4CIBSUIImageSelectionSetting@@QAEAAV0@ABV0@@Z",
        ">!><>b>",
        ",Xot5aiz3Otd+M0dsZ+2tlVIxYFNz6hcF6YKeD1Vhf9c=0Z",
        "??_7?$CShimUserSetting@VCStringUserSetting@@@@6B@",
        "4+4E4v445S5k5y5",
        "t*f98t%",
        "HeapReAlloc",
        "14181X1x1",
        "??4CDUUIWelcomeSetting@@QAEAAV0@$$QAV0@@Z",
        "313d3",
        "9,9L9r9",
        "98r#w",
        "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5",
        "_NT_SYMBOL_PATH",
        "7W7x7",
        "9/949\\9r9}9",
        "VirtualQuery",
        "=$=,=4=<=D=L=T=l=t=",
        "9;9A9J9V9u9",
        "=&===U=h=n=",
        "BCryptCloseAlgorithmProvider",
        "??0CUInt64UserSetting@@IAE@XZ",
        ">N?w?",
        "msvcrt.dll",
        "PublishMessage",
        "8,8S8",
        "7-7O7T7",
        "GetCurrentThreadId",
        "0L0\\0t0x0",
        "3!3>3Y3",
        "WdsEnumFirstBlackboardItem",
        "D$`;C",
        "?set_UInt64@CSimpleUInt64UserSetting@@UAEJ_K@Z",
        "memmove_s",
        "FreeLibrary",
        "`.data",
        ";.;O;p;",
        "ReturnHr",
        "=\"=h=x=",
        "8H8P8X8`8h8t8",
        "Unable to parse image path: %s",
        "Failed to parse image event.",
        "?get_Name@CWDSUIImageSelectionSetting@@EAEPAGXZ",
        "FormatPartition",
        "GetDiskKey",
        "bcrypt.dll",
        "b([ \\t])",
        "??1COOBEUIFinishSetting@@QAE@XZ",
        "??0CShimUInt64UserSetting@@QAE@ABV0@@Z",
        ">(>H>P>\\>|>",
        "??1CDiskPartUserSetting@@QAE@XZ",
        "ProcessTrace",
        "CShimUInt64UserSetting::set_UInt64",
        "728S8",
        ".CRT$XCA",
        "BCryptOpenAlgorithmProvider",
        "Eula\\EulaText",
        "?SerializeUInt32@CUInt32UserSetting@@IAEXI@Z",
        "210303183039Z0p1",
        "ATL$__a",
        "DiskInfo\\BlockExplanationsDisk",
        "SetFilePointer",
        "WdsGetBlackboardValue",
        "??4CSetupUIWelcomeSetting@@QAEAAV0@$$QAV0@@Z",
        "RegisterTraceGuidsW",
        "_91$[bS",
        ",*~_i",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "fResult",
        "??0CSetupUISummarySetting@@QAE@$$QAV0@@Z",
        "??0CUpgStoreUserSetting@@QAE@$$QAV0@@Z",
        ".cpdb",
        "??4CSimpleStringUserSetting@@QAEAAV0@$$QAV0@@Z",
        "8!8(808n8w8",
        ";0uF9E",
        "tE, <",
        "??0CShimUInt32UserSetting@@QAE@ABV0@@Z",
        ":c:x:",
        "InstallDate",
        "WinSAT/SystemConfig",
        "CoUninitialize",
        "uNPPV",
        "??4CComputerNameSetting@@QAEAAV0@ABV0@@Z",
        "InternalName",
        "2-3O3",
        "Microsoft Corporation1.0,",
        ".didat$4",
        "??0?$CShimUserSetting@VCStringUserSetting@@@@QAE@XZ",
        "l.dbg",
        "250701214655Z0|1",
        "??4CShimUInt32UserSetting@@QAEAAV0@ABV0@@Z",
        "6B6M6S6[6b6p6w6|6",
        "WarningReasonsText",
        "HashDigestLength",
        "ConstructPartialMsgVW",
        ">#?4?[?b?",
        "OOBEUI\\WelcomePage",
        "??1CShimUInt32UserSetting@@QAE@XZ",
        "RaiseFailFastException",
        "1b2i2u2",
        "L$ VP",
        ":,:>:S:_:e:z:",
        ";Fpu&",
        "QueryDosDeviceW",
        "-KB10t",
        "Translation",
        "4\"4-4l4",
        "3*4>4y4",
        "??0CStringUserSetting@@QAE@ABV0@@Z",
        "D$ PS",
        "FormatMessageW",
        "memcpy",
        "kernel32.dll",
        "GetModuleHandleW",
        "BUnattendDone",
        ">N>e>",
        "LoadResource",
        "GetSystemInfo",
        "u1SVW",
        " http://www.microsoft.com/windows0",
        "WdsSetBlackboardValue",
        "SetupUI\\DU\\WelcomePage",
        "D$Tx3",
        "??0CProductKeyUserSetting@@QAE@$$QAV0@@Z",
        "?get_Name@CDUUIWelcomeSetting@@EAEPAGXZ",
        "Washington1",
        "DiskRegionSupportsCapability:Disk [%d] is %s against capability [%s] for the following reasons...",
        "??0CSetupUIWelcomeSetting@@QAE@XZ",
        "5(5/555:5F5\\5p5",
        "ReleaseMutex",
        "??0CSimpleUInt32UserSetting@@QAE@$$QAV0@@Z",
        "??4CSimpleUInt64UserSetting@@QAEAAV0@$$QAV0@@Z",
        "??_7CShimStringUserSetting@@6B@",
        "MergeEtlFiles",
        "=,=7=d=j=",
        "??0CUpgStoreUserSetting@@QAE@XZ",
        "VSh@D",
        "j Xf;D$^",
        "\\Framework\\",
        ";\"<A<\\<",
        "(((HRESULT)(hr)) >= 0)",
        "GetModuleHandleExW",
        "??4CEulaSetting@@QAEAAV0@$$QAV0@@Z",
        "FileDescription",
        "q(\"[^\"]*\")|('[^']*')",
        "_XcptFilter",
        "WdsCollectionAddUInt32",
        "??_7CShimUInt64UserSetting@@6B@",
        "GetSystemWindowsDirectoryW",
        "QPWSQQhP",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "=B=a=|=",
        "SVWjz",
        "??_7CSetupUISummarySetting@@6B@",
        ".idata$6",
        "9@9a9",
        "??0CUpgradeUserSetting@@QAE@$$QAV0@@Z",
        "WdsInitializeDataUInt64",
        "4+565",
        "LogDiskReasons",
        "BuildLabEx",
        "wcschr",
        "OpenSemaphoreW",
        "??1CWDSUIImageSelectionSetting@@QAE@XZ",
        "??0CSetupUIWelcomeSetting@@QAE@ABV0@@Z",
        "??1CProductKeyUserSetting@@QAE@XZ",
        "8A8F8[8",
        "??0CUpgradeUserSetting@@QAE@ABV0@@Z",
        "??4?$CShimUserSetting@VCUInt64UserSetting@@@@QAEAAV0@$$QAV0@@Z",
        "Failed to obtain the original file name.",
        "Diagnostics\\Dword\\SetupCompliance",
        "?set_UInt32@CSimpleUInt32UserSetting@@UAEJI@Z",
        "CallbackGetArgumentString",
        "1$1+181?1+252?2F2L2Q2]2m2",
        "sgWQR",
        "RtlReleaseSRWLockExclusive",
        "??_7CShowFlagUserSetting@@6B@",
        "base\\ntsetup\\panther\\wdsutil\\usersetting.cpp",
        "??1CEulaSetting@@QAE@XZ",
        "??_7CWDSUIWelcomeSetting@@6B@",
        "WdsInitializeDataStringW",
        "Microsoft Corporation",
        "??4CDiskPartFormatUserSetting@@QAEAAV0@ABV0@@Z",
        "PWQjP",
        ".didat$6",
        "RegQueryValueExW",
        "[1b1g1y1",
        "%s [%s] failure: ",
        "9RSDS",
        "PWh M",
        "?get_String@CSimpleStringUserSetting@@UAEJPAPAG@Z",
        "83888?8",
        "SetupUI\\WelcomePage",
        "??0CDiskPartFormatUserSetting@@QAE@ABV0@@Z",
        ")CUserSetting::ReleaseMutex",
        "aepic.dll",
        "st QW",
        "GetProcessHeap",
        "??4CProductKeyUserSetting@@QAEAAV0@$$QAV0@@Z",
        "LoadLibraryExW",
        "343<3`3i3",
        "%s\\%s\\%s",
        ";f;r;x;",
        "calloc",
        "_errno",
        "??1CDUUIProgressSetting@@QAE@XZ",
        "??1CWDSUIWelcomeSetting@@QAE@XZ",
        "api-ms-win-core-processthreads-l1-1-3.dll",
        "??4CEulaSetting@@QAEAAV0@ABV0@@Z",
        "D$d;C",
        ";\"<e<",
        "UserData\\ComputerName",
        "FindResourceW",
        "??0CKeyboardSetting@@QAE@ABV0@@Z",
        "(((HRESULT)(hrT)) >= 0)",
        "??_7CSimpleStringUserSetting@@6B@",
        "2#2/2R2f2",
        "wcsncpy_s",
        "WdsValidateInstallDrive",
        "CUpgradeUserSetting::set_UInt32",
        "2 2(202D2L2T2\\2p2x2",
        "VSh(*",
        "??1exception@@UAE@XZ",
        "R!s4Z",
        "??1CSimpleStringUserSetting@@QAE@XZ",
        "??4CIBSUIImageSelectionSetting@@QAEAAV0@$$QAV0@@Z",
        "%ws\\drivers\\%ws",
        "8 8(8,84888@8D8L8P8X8\\8d8h8p8t8|8",
        "=(=@=`=",
        "CallbackGetArgumentUInt64",
        "??1CTimezoneSetting@@QAE@XZ",
        "GetTempPathW",
        "VQPWV",
        "WideCharToMultiByte",
        "Thales TSS ESN:0A56-E329-4D4D1%0#",
        "\\SystemRoot\\",
        "\"Microsoft Window",
        "4!424J4O4h4o4",
        "WWWWj",
        "RegEnumKeyExW",
        "?get_Show@?$CShimUserSetting@VCStringUserSetting@@@@UAEJPAH@Z",
        "8_^[]",
        "5%5R5",
        "PicFreeFileInfo",
        "??0CShowFlagUserSetting@@IAE@XZ",
        "xProductKey\\ProductKey",
        "8-8N8S8n8",
        "??4CDiskPartUserSetting@@QAEAAV0@ABV0@@Z",
        "u+9\\0(u%",
        "?SerializeField@CUserSetting@@IAEXPBGPAUWDS_DATA@@@Z",
        "F SWj",
        "??4CWDSUIImageSelectionSetting@@QAEAAV0@$$QAV0@@Z",
        "UserSettings",
        "u8j\\V",
        "??0CComputerNameSetting@@QAE@$$QAV0@@Z",
        "ADVAPI32.dll",
        "%hs!%p: ",
        "EnterCriticalSection",
        ":!:Z:f:l:w:",
        ": :$:(:,:0:4:8:<:@:D:H:L:X:",
        "2(2z2",
        "??4CProductKeyUserSetting@@QAEAAV0@ABV0@@Z",
        "??4CShowFlagUserSetting@@QAEAAV0@ABV0@@Z",
        "??_7CUInt32UserSetting@@6B@",
        "WdsSetupLogMessageW",
        "WARNING",
        "? ?4?H?Q?Y?e?l?r?w?",
        "base\\ntsetup\\panther\\wdsutil\\diskcaps.cpp",
        "SHA256",
        "Setup.UserSetting.Mutex",
        "8RSDS",
        "ti9~8vZ",
        "3J3w3",
        "WdsCollectionAddUInt64",
        "9~8ve3",
        "CStringUserSetting::SerializeString",
        "PWQjM",
        "?get_Name@COOBEUIWelcomeSetting@@EAEPAGXZ",
        "RtlAllocateHeap",
        "20201008050501Z",
        "WdsClient\\UI\\WelcomePage",
        "1/0-0",
        "??4CKeyboardSetting@@QAEAAV0@ABV0@@Z",
        "TSWj@3",
        "2S3^3c3x3",
        "7 7$7,70787<7D7H7P7T7\\7`7h7l7t7x7",
        "DiskRegionSupportsCapability:Couldn't determine whether [%s] is %s for {disk %d, offset 0x%I64x}; hr = 0x%x",
        "WDSUTIL",
        "9\"9+9:9U9",
        "?IsUpgrade@CUpgradeUserSetting@@SGHXZ",
        ".?AVbad_alloc@std@@",
        ";8;a;",
        "tCh0>",
        "676d6",
        "_onexit",
        "PSWh8H",
        "7 7$7@7D7H7L7P7T7X7",
        "RtlGetVersion",
        "*pstDest != 0",
        "20201008071935.135Z0",
        "=%=+=6=d=k=q=v=",
        ".didat$7",
        "aow\\root\\rootfs",
        ">NB10tY",
        "6W6h6s6",
        "2H4h5x5'7w=",
        "??0CShimUInt64UserSetting@@QAE@XZ",
        "?get_Name@CKeyboardSetting@@EAEPAGXZ",
        "vswprintf_s",
        "< <0<<<D<\\<",
        "< <:<E<\\<o<x<",
        "CUserSetting::SetModuleId",
        "\"j?[f;",
        "??1CDiskPartFileSystemUserSetting@@QAE@XZ",
        "2)4F4W4",
        "LegalCopyright",
        ">&>S>r>z>",
        "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "1&1>1",
        "8\"898H8q8",
        "?get_UInt64@CShimUInt64UserSetting@@UAEJPA_K@Z",
        "%hs(%u)\\%hs!%p: ",
        "Y__^[",
        ".idata$3",
        "j\\^VW",
        "wX8^Xu",
        "towlower",
        "GetWindowsDirectoryW",
        "?Simple_get_UInt64@CUInt64UserSetting@@IAEJPA_K@Z",
        "wdsutil.pdb",
        "Upgrade Unattend Processed: Set %s\\UnattendDone value to 1.",
        "$`2X`F",
        "M0K0I",
        "Value",
        "??4CDUUIProgressSetting@@QAEAAV0@$$QAV0@@Z",
        "21Q1@2",
        "GetFileVersionInfoSizeExW",
        ">\"?A?\\?",
        "60686D6L6",
        "??1type_info@@UAE@XZ",
        "WDSCORE.dll",
        ",0E0b0}0",
        "=$=C=`=",
        "|hK,_",
        "BlockingReasonsText",
        "UR3$?",
        ".?AVCAtlException@ATL@@",
        "0070U0\\0:1w1",
        ": :,:4:T:\\:x:",
        "\\system32\\wdi\\PerfTrack\\",
        "4>5X5i5",
        "??0CProductKeyUserSetting@@QAE@XZ",
        "base\\ntsetup\\panther\\wdsutil\\wdsutil.cpp",
        ".edata",
        "t$<WP",
        "Wow64RevertWow64FsRedirection",
        "3;3h3n3t3",
        "3$3,343<3H3P3",
        "tJ97t'",
        "9&:O:e:",
        "$u$f9B",
        "LogDiskRegionReasonsForType",
        ";N<y<",
        "RegOpenKeyExW",
        "Microsoft Corporation1)0'",
        "LoadLibraryExA",
        "LogReasons: [%s reason for disk %u: %s] %s",
        "\\FI_UNKNOWN",
        "??0exception@@QAE@ABQBD@Z",
        ".00cfg",
        "uV8]$t",
        "6(787D7d7l7t7",
        "??_7CSetupUIWelcomeSetting@@6B@",
        "??0CIBSUIImageSelectionSetting@@QAE@ABV0@@Z",
        "CUpgradeUserSetting::UnattendChecked",
        "3L3t3",
        "?get_Name@CSetupUISummarySetting@@EAEPAGXZ",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
        "GetCurrentThread",
        "DiskNumber",
        ":2=W>",
        ".data$brc",
        "CoCreateInstance",
        "EventWriteTransfer",
        "Microsoft Time-Stamp PCA 2010",
        "6;7Z7",
        "??0CDUUIWelcomeSetting@@QAE@ABV0@@Z",
        "Legal_Policy_Statement",
        "__CxxFrameHandler3",
        "_wcsnicmp",
        "4:5c5",
        "??0CDUUIWelcomeSetting@@QAE@XZ",
        "FindVolumeClose",
        "9FPsS",
        "Exception",
        "~h_^]",
        ">'>2>B>q>",
        "1(0&0",
        "CloseTrace",
        "??4?$CShimUserSetting@VCUInt32UserSetting@@@@QAEAAV0@$$QAV0@@Z",
        "??4CWDSUIWelcomeSetting@@QAEAAV0@$$QAV0@@Z",
        "'bs%`",
        "LoadLibraryW",
        "SetUnhandledExceptionFilter",
        "_ultow_s",
        "??_7CDUUIProgressSetting@@6B@",
        "??_7CDUUIWelcomeSetting@@6B@",
        "4<4H4v4",
        "?get_UInt64@CSimpleUInt64UserSetting@@UAEJPA_K@Z",
        "WilError_03",
        "9:9R9]9d9",
        "??4CDUUIWelcomeSetting@@QAEAAV0@ABV0@@Z",
        "??_7CUpgStoreUserSetting@@6B@",
        "??4CUpgradeUserSetting@@QAEAAV0@$$QAV0@@Z",
        "FindFirstVolumeW",
        "?@?~?",
        "??4CKeyboardSetting@@QAEAAV0@$$QAV0@@Z",
        "j._Qj",
        "?set_UInt32@CDiskPartUserSetting@@UAEJI@Z",
        "PWQjY",
        "tQhpI",
        "unexpected caching error: %x",
        "3$4,4L4h4x4",
        "?c_stValueName@CUserSetting@@1QBGB",
        ".CRT$XIZ",
        "CoCreateGuid",
        "Fh9~8",
        "0\"0z0",
        "CompanyName",
        "??0CDiskPartUserSetting@@QAE@XZ",
        "PVRQh",
        "??0CStringUserSetting@@IAE@XZ",
        "??0COOBEUIFinishSetting@@QAE@ABV0@@Z",
        "5 5(5,54585@5D5L5P5X5\\5d5h5p5t5|5",
        "9%:5:}:",
        "j:Yf97u?3",
        "?get_ValidateID@CProductKeyUserSetting@@EAEHXZ",
        "20201009050501Z0w0=",
        "??0CEulaSetting@@QAE@XZ",
        ";*;I;h;",
        "<9<M<]<w<|<",
        "GlobalAlloc",
        "CreateFileW",
        "SetFilePointerEx",
        "0(0H0P0X0`0h0p0x0",
        ":/;=;m;",
        "wcsrchr",
        "0B0a0|0",
        ".text",
        "CreateProcessW",
        "??_7CComputerNameSetting@@6B@",
        "<M=h=",
        "t&hLU",
        "?DeserializeUInt32@CUInt32UserSetting@@IAEJPAIH@Z",
        "u-j.V",
        "t*j\\Xf9",
        "RtlImageRvaToVa",
        "FindNextVolumeW",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "RtlSetThreadErrorMode",
        "10.0.19041.572",
        ".?AVlength_error@std@@",
        "IsWow64Process",
        ">\">.>?>G>Z>f>n>",
        "CDiskPartUserSetting::set_UInt32",
        "??0CWDSUIImageSelectionSetting@@QAE@XZ",
        ";@<F<U<o<z<",
        "??1CShowFlagUserSetting@@IAE@XZ",
        "TdhQueryProviderFieldInformation",
        "?DeserializeUInt64@CUInt64UserSetting@@IAEJPA_KH@Z",
        "?set_UInt64@CShimUInt64UserSetting@@UAEJ_K@Z",
        "1*2C2R2k2",
        "iswdigit",
        "??1CShimStringUserSetting@@QAE@XZ",
        "9$9(90949<9@9H9L9T9X9`9d9l9p9x9|9",
        "_vsnwprintf",
        "?GetBlackboard@CUserSetting@@IAEPAU_BLACKBOARD@@XZ",
        "GetVersionExW",
        "Microsoft Corporation1200",
        ";:<{<",
        "?DeserializeField@CUserSetting@@IAEJPBGIPAUWDS_DATA@@H@Z",
        "LogReasons: [%s reason for {disk %u offset 0x%I64x}: %s] %s",
        "t7f9O",
        "?set_UInt32@CShimUInt32UserSetting@@UAEJI@Z",
        "8%;P<m<",
        "HeapAlloc",
        "PublishMessage: Publishing message [%s]",
        "?get_Name@COOBEUIFinishSetting@@EAEPAGXZ",
        "_gmtime64",
        "QueryPerformanceCounter",
        "(caller: %p) ",
        "$Microsoft Ireland Operations Limited1",
        "dwResult == ((((DWORD )0x00000000L) ) + 0 )",
        "\\Device\\vmsmb\\",
        "??4CSimpleUInt32UserSetting@@QAEAAV0@$$QAV0@@Z",
        "D$8Ph",
        "j\\Xf9",
        "??4CStringUserSetting@@QAEAAV0@ABV0@@Z",
        "<>:\"/\\|,?%&*",
        ".CRT$XCZ",
        "OOBEUI\\FinishPage",
        "fResult != 0",
        "5#7@7;8g9",
        "?get_Show@CSimpleStringUserSetting@@UAEJPAH@Z",
        "_vsnprintf_s",
        "t);>u",
        "?c_stErrorName@CUserSetting@@1QBGB",
        "MaxDuration_ms",
        "3Y4n4",
        "??0exception@@QAE@XZ",
        "%1\\%2",
        "tVV9_",
        "50565@5",
        "??4CShimUInt64UserSetting@@QAEAAV0@ABV0@@Z",
        "??0CDiskPartFileSystemUserSetting@@QAE@XZ",
        "QSVWh",
        ".text$yd",
        "IsCrossArchitectureInstall",
        ".CRT$XIAA",
        "!\\$0!\\$4!\\$",
        "Upgrade Unattend Processed: %s\\UnattendDone already set to 1.",
        "RRRRR",
        ".?AVlogic_error@std@@",
        "?set_String@CComputerNameSetting@@UAEJPBG@Z",
        "j\\Zf;Ty",
        "??1?$CShimUserSetting@VCUInt64UserSetting@@@@QAE@XZ",
        "??0CSimpleStringUserSetting@@QAE@ABV0@@Z",
        "DeleteFileW",
        "=I=N=e=~=",
        "PartOffset",
        "??0CShowFlagUserSetting@@QAE@ABV0@@Z",
        "?SetModuleId@CUserSetting@@QAEXPAX@Z",
        "434e4n4",
        "1B1M1",
        "ReleaseSemaphore",
        "?terminate@@YAXXZ",
        "??0exception@@QAE@ABV0@@Z",
        "RegCloseKey",
        "QPSWQQV",
        "=4=<=H=P=",
        "??0CIBSUIImageSelectionSetting@@QAE@XZ",
        "??0CDUUIProgressSetting@@QAE@XZ",
        " Microsoft Operations Puerto Rico1&0$",
        "%ws%ws",
        "152J2h22393I3g3",
        "GetProcAddress",
        "?get_Name@CWDSUIWelcomeSetting@@EAEPAGXZ",
        "FindClose",
        "?get_Error@CSimpleStringUserSetting@@UAEJPAJ@Z",
        ";P;t;~;",
        "InitializeCriticalSection",
        "8MPDB",
        "5(535:5B5K5Y5",
        "BCryptCreateHash",
        "Microsoft Corporation1&0$",
        "??0CEulaSetting@@QAE@$$QAV0@@Z",
        "??_7CDiskPartFormatUserSetting@@6B@",
        "1@3k4",
        "?set_Show@CUserSetting@@QAEJH@Z",
        "??0CSimpleUInt64UserSetting@@QAE@ABV0@@Z",
        "??0CTimezoneSetting@@QAE@ABV0@@Z",
        "??0CWDSUIImageSelectionSetting@@QAE@$$QAV0@@Z",
        "??0CDiskPartFileSystemUserSetting@@QAE@ABV0@@Z",
        "GetFileSize",
        "ReleaseSRWLockExclusive",
        "InstallDestination\\DestinationFileSystem",
        ".CRT$XCU",
        "CreateMutexW",
        "_stricmp",
        "9,949<9D9L9T9`9",
        ":%;2;F;v;",
        "wcsspn",
        "??0CShimUInt32UserSetting@@QAE@XZ",
        "5!6X6g6",
        "??0COOBEUIFinishSetting@@QAE@$$QAV0@@Z",
        "DriveInformation",
        "8D9P9b9i9s9",
        ".?AVexception@@",
        "TdhLoadManifestFromBinary",
        "??0CUpgradeUserSetting@@QAE@XZ",
        "\\\\?\\VMSMB\\",
        "90:@:L:l:x:",
        ".data",
        "?Simple_get_String@CStringUserSetting@@IAEJPAPAG@Z",
        "?get_Show@CSimpleUInt64UserSetting@@UAEJPAH@Z",
        "StringFromGUID2",
        "_wcslwr_s",
        ";3;~;b<u<",
        "SetupState\\SetupArchitecture",
        " Windows",
        "RtlGetThreadErrorMode",
        "??0CDUUIProgressSetting@@QAE@$$QAV0@@Z",
        "??4CWDSUIWelcomeSetting@@QAEAAV0@ABV0@@Z",
        "Bh9Fhs",
        "191219011459Z",
        "??_7COOBEUIFinishSetting@@6B@",
        "??_7CUInt64UserSetting@@6B@",
        ";t04u",
        "wcsncmp",
        "??0CSetupUISummarySetting@@QAE@XZ",
        "??0CDiskPartFormatUserSetting@@QAE@$$QAV0@@Z",
        "??4CWDSUIImageSelectionSetting@@QAEAAV0@ABV0@@Z",
        "string too long",
        "??1?$CShimUserSetting@VCStringUserSetting@@@@QAE@XZ",
        "??0CKeyboardSetting@@QAE@XZ",
        "WdsEnumNextBlackboardItem",
        "??4CUInt32UserSetting@@QAEAAV0@ABV0@@Z",
        "8A8o8",
        "\\Device\\",
        "??_7CSimpleUInt64UserSetting@@6B@",
        "PPPWS",
        "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7",
        "??4CSimpleUInt32UserSetting@@QAEAAV0@ABV0@@Z",
        "??4CUpgradeUserSetting@@QAEAAV0@ABV0@@Z",
        "414E4",
        "??0CUInt64UserSetting@@QAE@ABV0@@Z",
        "CreateFileMappingW",
        "?Simple_set_UInt32@CUInt32UserSetting@@IAEJI@Z",
        "AhN~%",
        "SSSSVSSSS",
        "Sleep",
        "strrchr",
        "t$pVQ",
        "?get_Show@CDiskPartUserSetting@@UAEJPAH@Z",
        ":I:b:",
        "CUserSetting::SerializeField",
        "7)787F7c7",
        "GetCurrentProcessId",
        "VerQueryValueW",
        "??0CTimezoneSetting@@QAE@XZ",
        "??_7CKeyboardSetting@@6B@",
        "9,989X9`9l9t9",
        "_CorDllMain",
        "BCryptGetProperty",
        "O4;1s3j",
        "Upgrade Unattend Processed: Error setting %s\\UnattendDone value.",
        "??_7CShimUInt32UserSetting@@6B@",
        "BCryptDestroyHash",
        "GetModuleId() != 0",
        "7!7(7.747:7O7Z7`7h7o7",
        ".idata$4",
        "\\\\?\\UNC",
        "9J9P9_9y9",
        "??_7CProductKeyUserSetting@@6B@",
        "t;<$u7",
        "?get_Name@CUpgradeUserSetting@@EAEPAGXZ",
        "??0CComputerNameSetting@@QAE@ABV0@@Z",
        "?AcquireMutex@CUserSetting@@IAEXXZ",
        "5<5t5",
        "GetVolumePathNamesForVolumeNameW",
        "@.didat",
        ".CRT$XIA",
        "CLRCreateInstance",
        "4J4r4",
        "Invalid parameter passed to C runtime function.",
        "D$$WWQ",
        "??4CDiskPartFileSystemUserSetting@@QAEAAV0@ABV0@@Z",
        "Unattend",
        "DtCSV",
        "??0?$CShimUserSetting@VCUInt32UserSetting@@@@QAE@ABV0@@Z",
        "Error",
        "??1CUpgStoreUserSetting@@QAE@XZ",
        "111019184142Z",
        "1=1[1|1",
        "?what@exception@@UBEPBDXZ",
        "??1CUInt64UserSetting@@IAE@XZ",
        "?get_Name@CSetupUIWelcomeSetting@@EAEPAGXZ",
        "FindFirstFileW",
        ".rdata",
        "??0CWDSUIImageSelectionSetting@@QAE@ABV0@@Z",
        "OS Deployment Utilities",
        "?SerializeString@CStringUserSetting@@IAEXPBG@Z",
        "??1CSimpleUInt64UserSetting@@QAE@XZ",
        ".text$di",
        "TdhLoadManifest",
        "OriginalFilename",
        "CUserSetting::AcquireMutex",
        "??0CShimUInt32UserSetting@@QAE@$$QAV0@@Z",
        "_CxxThrowException",
        "939:9D9P9",
        "??0CUserSetting@@QAE@XZ",
        "= >/><>U>r>~>",
        "?ReleaseMutex@CUserSetting@@IAEXXZ",
        "DiskInfo\\BlockExplanationsRegion",
        "lL7Ki\"0",
        "??0?$CShimUserSetting@VCUInt64UserSetting@@@@QAE@ABV0@@Z",
        "@.reloc",
        "LogHr",
        "??0CSimpleStringUserSetting@@QAE@$$QAV0@@Z",
        "??0CDUUIWelcomeSetting@@QAE@$$QAV0@@Z",
        "??0CSimpleUInt64UserSetting@@QAE@$$QAV0@@Z",
        "?get_UInt32@CShimUInt32UserSetting@@UAEJPAI@Z",
        "??0CDiskPartUserSetting@@QAE@$$QAV0@@Z",
        "RtlFreeHeap",
        "U0S0Q",
        "mscoree.dll",
        "8$8+82888D8O8T8Y8_8i8s8",
        "1 1$1,10181<1D1H1P1T1\\1`1h1l1t1x1",
        ";J>i>",
        "_callnewh",
        "|$XjD",
        "WDSUTIL.dll",
        "??4CDiskPartUserSetting@@QAEAAV0@$$QAV0@@Z",
        "MapViewOfFileEx",
        "ATL$__z",
        "%s\\DiskCapabilities",
        "2+262I2g2s2{2",
        "3 3@3H3T3\\3|3",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "?set_UInt32@CUpgradeUserSetting@@UAEJI@Z",
        "DiskRegionSupportsCapability:Region on disk [%d] (offset = [0x%I64x]) is %s against capability [%s] for the following reasons...",
        "??0CComputerNameSetting@@QAE@XZ",
        "LogDiskRegionReasons",
        "MultiByteToWideChar",
        "TraceEvent",
        "_P+_L",
        "Microsoft Time-Stamp PCA 20100",
        "PublishMessage:Failed to format the message. MessageID is [%d]",
        "1$1,141<1H1h1p1x1",
        "3D4W4",
        "??4CShimUInt64UserSetting@@QAEAAV0@$$QAV0@@Z",
        "WdsCreateBlackboard",
        "_hMutex != 0",
        "RtlCompressBuffer",
        "InstallDestination\\Selection",
        ".idata$2",
        "??_7CWDSUIImageSelectionSetting@@6B@",
        "ImageInfo\\OSImage",
        ".CRT$XCL",
        "; ;(;,;4;8;@;D;L;P;X;\\;d;h;p;t;|;",
        "ObjectLength",
        "api-ms-win-eventing-tdh-l1-1-0.dll",
        "4C5o5",
        "< <$<(<,<0<4<8<<<@<t<x<|<",
        "??1CIBSUIImageSelectionSetting@@QAE@XZ",
        "LeaveCriticalSection",
        "GetEnvironmentVariableW",
        "??1CSetupUISummarySetting@@QAE@XZ",
        "%s%s%s",
        "2 2(2,24282@2D2L2P2X2\\2d2h2p2t2|2",
        "8'9U9\\9z9",
        "8'9H9d9",
        "0$1O1t1",
        "??1CKeyboardSetting@@QAE@XZ",
        "PublishMessage:Formed a generic error message.",
        "ProductVersion",
        "4<4v4",
        "1\"1+1I1\\1n1",
        "<&<H<U<p<",
        "31383>3C3N3[3o3|3",
        "=\"?)?",
        "wcsnlen",
        "CreateFileMapping failed: %d",
        "2,242<2D2L2T2`2",
        "%wc:%ws",
        "C,)sHjX",
        "9~(s+j",
        "vLh\\K",
        "??0CUInt32UserSetting@@IAE@XZ",
        "Ad;Bdr",
        "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9",
        "2:2n2",
        "HeapDestroy",
        "list<T> too long",
        "8,8L8\\8l8r8",
        "VS_VERSION_INFO",
        "4:4T4Z4",
        "=7=?=Q=q=",
        "%wc:\\Symbols",
        "OutputDebugStringW",
        "OLEAUT32.dll",
        "??1?$CShimUserSetting@VCUInt32UserSetting@@@@QAE@XZ",
        "O0M0K",
        "??0?$CShimUserSetting@VCStringUserSetting@@@@QAE@ABV0@@Z",
        "realloc",
        "VERSION.dll",
        "??0?$CShimUserSetting@VCUInt32UserSetting@@@@QAE@XZ",
        "??1CSimpleUInt32UserSetting@@QAE@XZ",
        "DeviceIoControl",
        "656F6\\6g6",
        "9 :l:r:",
        " !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~",
        ">m?s?",
        "DiskRegionSupportsCapability:Couldn't determine whether [%s] is %s for disk %d; hr = 0x%x",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        ";HXw;;H8r",
        "<E<O<V<g<x<~<",
        "XPERF_NGenPdbsCachePath",
        "=+=j=",
        "?set_Error@CUserSetting@@QAEJJ@Z",
        "?get_String@CShimStringUserSetting@@UAEJPAPAG@Z",
        "t&j.W",
        "2>2e2",
        "GetModuleFileNameA",
        "+a,Y?",
        "WdsAbortBlackboardItemEnum",
        "?get_Show@CShowFlagUserSetting@@UAEJPAH@Z",
        "Odu;`Q",
        "?get_Name@CTimezoneSetting@@EAEPAGXZ",
        "GetSystemDirectoryW",
        "GetThreadInformation",
        ".rsrc$01",
        "?ReadError@CUserSetting@@IAEJPAJH@Z",
        "u1j\\XP",
        "DebugBreak",
        "_unlock",
        "6$6(60646<6@6H6L6T6X6`6d6l6p6x6|6",
        ".?AVout_of_range@std@@",
        "BucketSizes_ms",
        ":9:_:",
        ".gfids",
        "??4COOBEUIWelcomeSetting@@QAEAAV0@$$QAV0@@Z",
        "s{WVj",
        "5*6j6",
        ".rsrc$02",
        "u*9EDt",
        "GetLastError",
        "memcpy_s",
        "GetTempFileNameW",
        "xPhh?",
        ":$:+:;:J:R:{:",
        "??0CShimUInt64UserSetting@@QAE@$$QAV0@@Z",
        "8'9E9K9V9",
        "CShimUInt32UserSetting::set_UInt32",
        ">Q>W>",
        "XPERF_NGenPdbsPath",
        "??4CTimezoneSetting@@QAEAAV0@$$QAV0@@Z",
        "ntdll.dll",
        "??0CKeyboardSetting@@QAE@$$QAV0@@Z",
        "=t>}>b?",
        "999\\9",
        "_amsg_exit",
        "memchr",
        "InstallDestination\\DiskNumber",
        "8.9v9",
        "%hs(%d) tid(%x) %08X %ws",
        "0'0P0R1",
        "??0CIBSUIImageSelectionSetting@@QAE@$$QAV0@@Z",
        "WdsPickTempDriveBasedOnInstallDrive",
        "??_7COOBEUIWelcomeSetting@@6B@",
        "CStringUserSetting::DeserializeString",
        "Relogger",
        "Microsoft",
        "3&3C3J3T3[3a3f3r3",
        "FailFast",
        ":$:X:h:t:|:",
        "UnhandledExceptionFilter",
        "__dllonexit",
        "??_7CStringUserSetting@@6B@",
        "=$=A=J=P=q=y=",
        "WdsAllocCollection",
        "L$@QP",
        "??_7?$CShimUserSetting@VCUInt32UserSetting@@@@6B@",
        "TdhGetEventInformation",
        "NULL path in image path.",
        ">RSDS",
        "??4COOBEUIFinishSetting@@QAEAAV0@ABV0@@Z",
        "GetApplicableDiskRegionReason",
        "z([0-9]+)",
        "??0CSetupUIWelcomeSetting@@QAE@$$QAV0@@Z",
        "invalid string position",
        "?get_Error@CSimpleUInt32UserSetting@@UAEJPAJ@Z",
        ".didat$2",
        "SetupInfo",
        "GetFullPathNameW",
        ".giats",
        "??0CUpgStoreUserSetting@@QAE@ABV0@@Z",
        "7$7,747<7D7L7X7x7",
        "GetRegionKey",
        "4 4$4,40484<4D4H4P4T4\\4`4h4l4t4x4",
        "?get_UInt32@CSimpleUInt32UserSetting@@UAEJPAI@Z",
        "?get_Show@CComputerNameSetting@@UAEJPAH@Z",
        "3#444J4",
        "0A2K2h2b3",
        ")Microsoft Root Certificate Authority 20100",
        "Keyboard",
        "AcquireSRWLockExclusive",
        "100701213655Z",
        "??_7CDiskPartFileSystemUserSetting@@6B@",
        "WARNED against",
        "0$0(00040<0@0H0L0T0X0`0d0l0p0x0|0",
        "WaitForSingleObject",
        ">$>G>Q>g>v>0?T?f?",
        "??0CProductKeyUserSetting@@QAE@ABV0@@Z",
        "?Simple_set_String@CStringUserSetting@@IAEJPBG@Z",
        "FindNextFileW",
        "?get_Error@CSimpleUInt64UserSetting@@UAEJPAJ@Z",
        "Wow64DisableWow64FsRedirection",
        "kernelbase.dll",
        "OutputDebugStringA",
        "??1CSetupUIWelcomeSetting@@QAE@XZ",
        "RtlAcquireSRWLockExclusive",
        "RaiseException",
        "??_7CTimezoneSetting@@6B@",
        "7#7(7u9",
        ": :$:,:0:8:<:D:H:P:T:\\:`:h:l:t:x:",
        "607@7L7T7",
        ";s$vX",
        "1 242D2L2T2`2",
        "?get_Error@?$CShimUserSetting@VCStringUserSetting@@@@UAEJPAJ@Z",
        "t'Ph,&",
        "\\GLOBAL??\\",
        ";xds/k",
        "??_7?$CShimUserSetting@VCUInt64UserSetting@@@@6B@",
        "??4CShimStringUserSetting@@QAEAAV0@$$QAV0@@Z",
        "??4CSimpleStringUserSetting@@QAEAAV0@ABV0@@Z",
        "??0CWDSUIWelcomeSetting@@QAE@ABV0@@Z",
        ":1:\\:",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "526r6",
        "_wcsicmp",
        "WARNED",
        "ControlTraceW",
        "QQSV3",
        "<$<,<4<<<D<P<X<",
        "??4CDUUIProgressSetting@@QAEAAV0@ABV0@@Z",
        ".idata",
        "GetFileAttributesW",
        "[%hs(%hs)]",
        "1t2<3L3",
        "10.0.19041.572 (WinBuild.160101.0800)",
        "map/set<T> too long",
        "0\"0)0",
        "5j5o5",
        "WdsCollectionGetValue",
        "4,5<5H5P5",
        "OpenTraceW",
        ".didat$5",
        "_memicmp",
        ";'<E<[<",
        "5)5V5",
        "\\Device\\LanmanRedirector\\",
        "WDSUTIL.DLL",
        "261019185142Z0",
        "??1CUInt32UserSetting@@IAE@XZ",
        "0(000P0l0|0",
        "??4CComputerNameSetting@@QAEAAV0@$$QAV0@@Z",
        "FindResourceExW",
        "?get_Name@CIBSUIImageSelectionSetting@@EAEPAGXZ",
        "WdsFreeData",
        "GetApplicableDiskReason",
        "ReadFile",
        "USER32.dll",
        "tLVVVW",
        "QSVWj",
        "?DeserializeString@CStringUserSetting@@IAEJPAPAGH@Z",
        "9C(s6",
        "%wsngen.exe createpdb %ws %ws",
        "RtlImageDirectoryEntryToData",
        "?get_Name@CUpgStoreUserSetting@@EAEPAGXZ",
        "3%4P4k4",
        ".ni.pdb",
        "WdsUnpackCollection",
        "??4?$CShimUserSetting@VCUInt64UserSetting@@@@QAEAAV0@ABV0@@Z",
        "3$3(30343<3@3H3L3T3X3`3d3l3p3x3|3",
        "??0CEulaSetting@@QAE@ABV0@@Z",
        ">I>d>",
        "0L0P0X0`0x0",
        "?Simple_get_UInt32@CUInt32UserSetting@@IAEJPAI@Z",
        "UnregisterTraceGuids",
        "D$ SP",
        "??4COOBEUIWelcomeSetting@@QAEAAV0@ABV0@@Z",
        "<O=e=",
        "KERNEL32.dll",
        "7'8E8K8V8",
        "PPPPP",
        "InstallDestination\\Partition OffSet",
        "K0h091",
        "D$0+D$8",
        "8(808d8t8",
        "5-6H6Q6]6d6u6",
        "CopyFileW",
        "717I7Q7W7~7",
        "??0?$CShimUserSetting@VCUInt64UserSetting@@@@QAE@XZ",
        "QQSVW",
        "FreeMibTable",
        "?GetKeyName@CUserSetting@@IAEJPAGHH@Z",
        "%ws\\%hs\\%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x%x",
        "?get_Show@?$CShimUserSetting@VCUInt32UserSetting@@@@UAEJPAH@Z",
        "D$nSP",
        "<$<,<4<<<D<L<T<\\<l<t<",
        "??0CShimStringUserSetting@@QAE@XZ",
        "4$404g4",
        ".text$mn",
        "?c_stShowName@CUserSetting@@1QBGB",
        "PWWWWh(",
        "??_7CDiskPartUserSetting@@6B@",
        "SetupUI\\SummaryPage",
        "9YHtJ",
        "?get_Show@?$CShimUserSetting@VCUInt64UserSetting@@@@UAEJPAH@Z",
        "CreateDirectoryW",
        "??_7CEulaSetting@@6B@",
        "??0CSimpleUInt64UserSetting@@QAE@XZ",
        "BCryptHashData",
        "7A7i7",
        "WdsCollectionAddValue",
        "GPQQh",
        "GetCurrentProcess",
        "=N>y>",
        "(((HRESULT)(hRes)) >= 0)",
        "?SerializeUInt64@CUInt64UserSetting@@IAEX_K@Z",
        "081U1",
        "User selected upgrade option",
        "??_7CUpgradeUserSetting@@6B@",
        "CUserSetting::DeserializeField",
        "777!9X9",
        "Microsoft Windows0",
        "User selected clean install option",
        "w([a-zA-Z]+)",
        ":':B:]:",
        "APPID",
        "bCreateFile failed: %d",
        " Operating System",
        "hbad allocation",
        "BuildLab",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "_initterm",
        "?get_Name@CDiskPartFormatUserSetting@@EAEPAGXZ",
        "SVWj@",
        "210317011459Z0",
        "?c_stMutex@CUserSetting@@1QBGB",
        "*.ptxml",
        "SetLastError",
        ">7>R>m>",
        "oK0D$\"<",
        "_lock",
        ".rdata$brc",
        "CallContext:[%hs] ",
        "Timezone",
        "SetThreadInformation",
        "PWQj[",
        "BCryptFinishHash",
        "2%3H3c3",
        "z.9Wv",
        "9&9*9.92969:9>9B9F9J9N9R9V9Z9^9b9f9j9n9r9v9z9~9",
        "?get_Name@CDUUIProgressSetting@@EAEPAGXZ",
        "%s\\RegionAtOffset%I64u",
        "uF9SLrA",
        "9CdvD9A",
        "vector<bool> too long",
        ".?AVResultException@wil@@",
        "??1CUserSetting@@QAE@XZ",
        "??0COOBEUIWelcomeSetting@@QAE@XZ",
        "8,888X8d8l8",
        ";8;H;T;t;|;",
        "??0CDiskPartFormatUserSetting@@QAE@XZ",
        "??4?$CShimUserSetting@VCUInt32UserSetting@@@@QAEAAV0@ABV0@@Z",
        "tdh.dll",
        "?get_Error@?$CShimUserSetting@VCUInt64UserSetting@@@@UAEJPAJ@Z",
        "?get_Show@CSimpleUInt32UserSetting@@UAEJPAH@Z",
        "GetFileVersionInfoExW",
        "Hbg&~",
        "7+7A7i7z7",
        "6i7i;",
        "??0CSimpleUInt32UserSetting@@QAE@ABV0@@Z",
        "?,?4?<?D?L?T?\\?d?l?t?|?",
        "<I<\\<b<t<",
        "CUInt32UserSetting::Simple_get_UInt32",
        "QQhDL",
        "pstDest != 0",
        "PickTempDrive",
        "Iphlpapi.dll",
        "invalid map/set<T> iterator",
        "0I0n0",
        ";T;Z;e;",
        "2,272N2l2",
        "WdsDestroyBlackboard",
        "PicRetrieveFileInfo",
        "1575;5J5Z5`5d5q5",
        "TlP0X",
        "?get_Name@CProductKeyUserSetting@@EAEPAGXZ",
        "StartTraceW",
        "2\"282T2",
        "3C3K3X3^3f3",
        "&PWSV",
        ";u=f9w",
        "??0CSimpleUInt32UserSetting@@QAE@XZ",
        "7'8=8",
        "j\\Yf9",
        ".rdata$sxdata",
        "??0CWDSUIWelcomeSetting@@QAE@XZ",
        "D$$Ph",
        "2#2;2X2|2",
        "wcscpy_s",
        "??4CSimpleUInt64UserSetting@@QAEAAV0@ABV0@@Z",
        "9] tJ",
        "DiskInfo\\Disk%u",
        "CUpgradeUserSetting::UnattendChecked couldn't create BB",
        "LockResource",
        "GetSystemTimeAsFileTime",
        "memset",
        "DiskRegionSupportsCapabilityForType",
        "GetTickCount",
        "CoInitializeEx",
        "ext-ms-win-eventing-tdh-ext-l1-1-0.dll",
        "\\StringFileInfo\\%04X%04X\\OriginalFilename",
        ":(<n<~=",
        "??_7CIBSUIImageSelectionSetting@@6B@",
        "LocalFree",
        ">$>0>8>P>t>",
        "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4",
        "??1CDiskPartFormatUserSetting@@QAE@XZ",
        "ProductName",
        "a/Richx",
        "??0COOBEUIFinishSetting@@QAE@XZ",
        "Aow\\RootFS",
        "TdhGetEventMapInformation",
        "5D5T5`5",
        "_except_handler4_common",
        "QQh@L",
        "111I1a1y1",
        ":2;{;",
        "686X6h6",
        "?get_Name@CDiskPartFileSystemUserSetting@@EAEPAGXZ",
        "9$9,9D9L9",
        "9;9N9_9o9v9",
        "7L8W8u8",
        "QPVSW",
        "q(9>u",
        "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6",
        "_pBlackboard != 0",
        "4xCh F",
        "??0CUInt32UserSetting@@QAE@ABV0@@Z",
        "SetupUI\\DU\\ProgressPage",
        "?9?F?f?",
        "CallbackGetArgumentInt32",
        "6QPQS",
        "%Microsoft Windows Production PCA 20110",
        "FreeReason",
        "8.8S8q8",
        "I0G1-0+",
        "2k3k5",
        "wcstol",
        "??1CStringUserSetting@@IAE@XZ",
        "MapViewOfFileEx failed: %d",
        " Microsoft Corporation. All rights reserved.",
        "WdsFreeCollection",
        "8NB10",
        "1*1g3",
        "Upgrade",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Diagnostics\\PerfTrack\\InteractionClasses",
        "!This program cannot be run in DOS mode.",
        "GetExitCodeProcess",
        "WinSAT/WinSPR",
        "??_7CUserSetting@@6B@",
        "4G4`4y4",
        "CreateMutexExW",
        "9P:W:",
        "?Simple_set_UInt64@CUInt64UserSetting@@IAEJ_K@Z",
        "<,<7<o<",
        "3G3Q3\\3c3",
        "h([0-9a-fA-F])",
        "??0CShimStringUserSetting@@QAE@ABV0@@Z",
        "BLOCKING",
        "6C6X6",
        "<}=/?",
        "?get_Error@?$CShimUserSetting@VCUInt32UserSetting@@@@UAEJPAJ@Z",
        "Fd;BdwT",
        "WdsCollectionAddString",
        "F8PRR",
        ":@:]:",
        "CloseHandle",
        "182q2",
        "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0",
        "WriteFile",
        "<<<H<}<",
        "f9:t1",
        "RtlGetCompressionWorkSpaceSize",
        "BLOCKED",
        ">\">)>N>d>",
        "??0CWDSUIWelcomeSetting@@QAE@$$QAV0@@Z",
        "1X1^1m1",
        "FileVersion",
        "{28ad2447-105b-4fe2-9599-e59b2aa9a634}",
        "?.?Q?",
        ".rdata$zzzdbg",
        "??4CUserSetting@@QAEAAV0@ABV0@@Z",
        "WdsClient\\UI\\ImageSelectionPage",
        "4'484y4",
        "??0CDUUIProgressSetting@@QAE@ABV0@@Z",
        "t VWS",
        "; <y<",
        "^(((srv)|(cache)|(symsrv\\*symsrv\\.dll))\\*{\\c:[^*]*})",
        "CompareStringW",
        ";$;0;T;\\;d;l;t;|;"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "f272422192dc750ca95c9deb1d7141cc729e2c3b6bbd5fb9fe1e3c31743522ce",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/f272422192dc750ca95c9deb1d7141cc729e2c3b6bbd5fb9fe1e3c31743522ce",
              "guest_paths": [
                "overlay"
              ],
              "size": 8520,
              "crc32": "DDFB14E1",
              "md5": "315a289305717bdbfb8a8346fc8b9564",
              "sha1": "bc0de08b6dc3663b5f5bc10fd56fb07c92e2327f",
              "sha256": "f272422192dc750ca95c9deb1d7141cc729e2c3b6bbd5fb9fe1e3c31743522ce",
              "sha512": "0a0a3d7b43ef022e5230303ed92267753f18a76fd33fde91cfd45b7f74de12540a3bf9e40ab113b6de0f857b0e26900711d986ebda8e4fc5736647aa94b077a9",
              "rh_hash": null,
              "ssdeep": "96:btSMDXvDbzC0cr8OAlpVHKzDmowDD0pBDXiebs/Am2grWXGueDXf9RfBDqh0hDfM:ZQr8VHwDDBQABJMQ2SkqnajKs93O6+X",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T147023CD1CB785443DEA37880135CE5837D3D63CB5850816A25AEF9A51CDB3C6DF085AE",
              "sha3_384": "871594b289cb192573ab6e6312e85ad7aca0aea2c0b4031eac9327618e2c292f0210ba6cb2f6ff6554aee4c04faa6ce9",
              "data": null
            }
          ],
          "extracted_files_time": 0.0004894999983662274,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "diagwrn.xml"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/5caec7fc4e8cd26d37f83034123f319a5935167cd1f9045d93dbd16ddafec2b1",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
      ],
      "size": 3215,
      "crc32": "54A4739F",
      "md5": "6a19051c3f64d62ce20b58749ae0af9e",
      "sha1": "3a9f1b6e5fa63823797a93533070a3048aba4bb9",
      "sha256": "5caec7fc4e8cd26d37f83034123f319a5935167cd1f9045d93dbd16ddafec2b1",
      "sha512": "3372b9d4f63f7f539eb4074a15c3534d141cb461eeb8562991b1a67c1864ef7e148fe822306f8228c22802aae7c314f78ef54fa74d154180553d69c31a8b593c",
      "rh_hash": null,
      "ssdeep": "24:5I5aVbJDP+tUI0X3AN0/1Cvf/g3vvQ/1Cv8Gh/1Cvze/g3vO/1CvVL/1CvR/g3vx:5MwiGI0P4GsfT/7EPtCP83RPSdP836L",
      "type": "Unicode text, UTF-8 (with BOM) text, with very long lines (333)",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T14F61A12CB1A91F779D5402A8CFE038827B809F7D42156037A0C9FDDF6275086E9B63C9",
      "sha3_384": "6a7dfb5fd2d68ea42badfb73701ff4745122916c93ad9ff92f89c1b7524a0eb242eab26df8ec8f61d820a6a5ceaf314d",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": "\\xfeff<xml xmlns:s=\"uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882\"\n xmlns:dt=\"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882\"\n xmlns:rs=\"urn:schemas-microsoft-com:rowset\"\n xmlns:z=\"#RowsetSchema\">\n<s:Schema id=\"RowsetSchema\">\n<s:ElementType name=\"row\" content=\"eltOnly\" rs:updatable=\"true\">\n<s:AttributeType name=\"Cls\" rs:number=\"0\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Sev\" rs:number=\"1\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Maj\" rs:number=\"2\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Min\" rs:number=\"3\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"LN\" rs:number=\"4\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Fil\" rs:number=\"5\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Fun\" rs:number=\"6\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Uid\" rs:number=\"7\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Msg\" rs:number=\"8\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"PID\" rs:number=\"9\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"TID\" rs:number=\"10\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Con\" rs:number=\"11\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Exe\" rs:number=\"12\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Mod\" rs:number=\"13\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Err\" rs:number=\"14\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"MD\" rs:number=\"15\">\n<s:datatype dt:type=\"hexBinary\"/>\n</s:AttributeType>\n<s:AttributeType name=\"DT\" rs:number=\"16\">\n<s:datatype dt:type=\"dateTime\"/>\n</s:AttributeType>\n</s:ElementType>\n</s:Schema>\n<rs:data>\n<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"663\" Fil=\"\" Fun=\"CSetupDiagnostics::LogString\" Uid=\"51019776\" Msg=\"SetupHost: Unexpected scenario - defaulting postoobe/rollback commands!\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod=\"SetupHost.Exe\" Err=\"0\" MD=\"\" DT=\"2026-05-28T15:59:41\"/>\n<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"663\" Fil=\"\" Fun=\"CSetupDiagnostics::LogString\" Uid=\"51019776\" Msg=\"ConnectToSourceUrl: Unable to retrieve proxy info for URL -&gt; [0x2f94].\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod=\"SetupHost.Exe\" Err=\"12180\" MD=\"\" DT=\"2026-05-28T15:59:41\"/>\n<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"663\" Fil=\"\" Fun=\"CSetupDiagnostics::LogString\" Uid=\"51019776\" Msg=\"CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x2002]\" PID=\"5932\" TID=\"7504\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod=\"SetupHost.Exe\" Err=\"0\" MD=\"\" DT=\"2026-05-28T15:59:42\"/>\n<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"663\" Fil=\"\" Fun=\"CSetupDiagnostics::LogString\" Uid=\"51019776\" Msg=\"ConnectToSourceUrl: Unable to retrieve proxy info for URL -&gt; [0x2f94].\" PID=\"5932\" TID=\"7504\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod=\"SetupHost.Exe\" Err=\"12180\" MD=\"\" DT=\"2026-05-28T15:59:56\"/>\n",
      "strings": [],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5932
    },
    {
      "name": [
        "BlueBox.log"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/dc841755420a445321e88a5e6b6f6f012d5724c7d829ae7662bc081621b0f8d1",
      "guest_paths": [
        "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
      ],
      "size": 2005,
      "crc32": "BBC26784",
      "md5": "ffdf2354fdf3462e06c054fe1e2db58e",
      "sha1": "b9a9728808b49a681ffc87e46bd18c53db9ab4ec",
      "sha256": "dc841755420a445321e88a5e6b6f6f012d5724c7d829ae7662bc081621b0f8d1",
      "sha512": "3aba4f3c8d839e0e1e2d67672afad18318d9e6161ef0e9dc8ae8f966c02e89d4b671f792a737fdff03eb1c835118fe0057db06aaf7b8b5c4ca764dc145b980b1",
      "rh_hash": null,
      "ssdeep": "48:ry2cMa2ciDeyxkk+s4a2cm6GgEcceY00F:mDMaDii7k+TaDdQeYZF",
      "type": "Unicode text, UTF-8 (with BOM) text, with CRLF line terminators",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T14341E612AFF7415B26D142059AE10B1EAF02F467BB9DB85F7FAC808861471AC8DFC2D1",
      "sha3_384": "a87bbc017dc37d56d32ca90918c2ad249be7d91bc00af09528167145c8cc05211d64060e625731061fe32eee54719b2d",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": "\\xfeff2026-05-28 15:59:32: BuildInfo: [10.0.19041.572 (vb_release_svc_prod1.201007-1724)]\n2026-05-28 15:59:32: CommandLine: [\"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\" ]\n2026-05-28 15:59:32: Opening Box: [C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe]\n2026-05-28 15:59:32: Opening Box Result: [0x0]\n2026-05-28 15:59:32: Deleting box result...\n2026-05-28 15:59:32: Creating path: [C:\\$Windows.~WS\\Sources]...\n2026-05-28 15:59:32: Checking cleanup registry value...\n2026-05-28 15:59:32: Cleanup value missing... assuming no cleanup.\n2026-05-28 15:59:32: Skipping cleanup.\n2026-05-28 15:59:32: Preserve working path: [No]\n2026-05-28 15:59:32: Cleaning alternate storage paths...\n2026-05-28 15:59:32: Cleaning MoSetup Volatile key...\n2026-05-28 15:59:32: Removing CorrelationVector registry value...\n2026-05-28 15:59:32: Removing cleanup registry value...\n2026-05-28 15:59:32: Flushing MoSetup registry key...\n2026-05-28 15:59:32: Cleaning working dir...\n2026-05-28 15:59:32: Attempting to preserve existing logs...\n2026-05-28 15:59:32: Nothing to preserve.\n2026-05-28 15:59:32: Working path still exists. Cleaning working path: [C:\\$Windows.~WS]...\n2026-05-28 15:59:32: Creating path (with ACL): [C:\\$Windows.~WS]...\n2026-05-28 15:59:32: Creating path: [C:\\$Windows.~WS\\Sources]...\n2026-05-28 15:59:32: Opening Box: [C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe]\n2026-05-28 15:59:32: Reading Box header...\n2026-05-28 15:59:32: Opening Box container: [0]...\n2026-05-28 15:59:32: Verifying Box container: [0]...\n2026-05-28 15:59:32: Reading Box container header: [0]...\n2026-05-28 15:59:32: Extracting Box container: [0]...\n2026-05-28 15:59:33: Launching process: [C:\\$Windows.~WS\\Sources\\SetupHost.Exe] with command-line [/Download /Web  ] in Session: [-1]\n2026-05-28 15:59:33: Launching: [C:\\$Windows.~WS\\Sources\\SetupHost.Exe] [/Download /Web  ] from [C:\\$Windows.~WS\\Sources]!\n2026-05-28 15:59:34: Waiting for process events...\n",
      "strings": [],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "products.cab"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/7677dd6247c5768737b643911894374939aac5ae2dea158c272511fdd2ac52bf",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\products.cab"
      ],
      "size": 44045,
      "crc32": "299C1371",
      "md5": "52b7d0637974ed697dd8aa819ed3c8b0",
      "sha1": "e81a7094362964e9ae69580b91a1e72207be667d",
      "sha256": "7677dd6247c5768737b643911894374939aac5ae2dea158c272511fdd2ac52bf",
      "sha512": "173a5893612a789f51ee9d914ae26e1faec557dcfab4ddb8aa8c8baa7690ca456af117e14e2b6d004c963573cb67a02f0e2760cc8c609287587dc335f9c4c1a8",
      "rh_hash": null,
      "ssdeep": "768:a7WxoIAiafX3+okXkCCn22+ZvEcKdH+u0eZfQEj7Mq6TFSguODDOLANYo:a6yIAVfX3EYn22+9vKow7MtFLu1LAN1",
      "type": "Microsoft Cabinet archive data, Windows 2000/XP setup, 44045 bytes, 1 file, at 0x2c last modified Sun, Dec 07 2023 22:07:36 +A \"products.xml\", ID 33800, number 1, 86 datablocks, 0x1503 compression",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T11713F1471D991A6EA3C0F5585F63CBA08107DAC39304870A9C870D772A9E7F9B2DC3A0",
      "sha3_384": "fd15a804eff6ece4726dd7dcb6df08bdc2c1e118bad65a05f4d8f07ce16fa797f59c4cf6eddd6c25d82183efb788ab62",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": null,
      "strings": [
        "c\\c\"}",
        "x{JJ]",
        "9/lBJ7",
        "~vv2k",
        "Aw 342",
        "7yv;:*",
        "eWOV+",
        "7]B\\<",
        "vHj$e",
        "A;lCZ ",
        "u@/v1",
        "XB47@%",
        ".we(\\",
        "9!C1(O>",
        "07Yv*",
        ")H}jV",
        "4!sS&",
        "ZP\"}LW",
        "6@&;9h",
        "cZY}V",
        "|n>{KW2",
        "-Hz%g",
        "2Zh35",
        "lI!;x(",
        "rhQ[H",
        "Ke%>O",
        "'}gun",
        " {0}4T",
        "C](1;11",
        "j\\gp/",
        "v 041@K",
        "_3s>\\",
        "*cO}n",
        "}sI]f",
        "hB47@&69o",
        "N!\\!=",
        "\\L1t\"",
        "1q*xm,|a",
        "$_yK#",
        "5Hf6L~,",
        "TFoirI=*",
        "Up|/}a",
        "\\rO+j",
        "-7NXP",
        ">F~aK",
        "Sco=FS",
        "21hBt7@&69",
        "lYjB9",
        "g@kfl",
        "q@^=r",
        "6hh%d'",
        "gGa,C",
        "5):42",
        "']k:7",
        "+lCT It P",
        "P\"vL04'",
        "PjGWfP",
        "^8wy\\",
        "442@f",
        "SVT[2",
        "B&(v:m",
        "Z<=n}w",
        ")esF!T",
        "w[AC1(V>'",
        "UoC82",
        "g@:G1",
        "w[AC8(",
        "CI&\"J",
        "{A6]B",
        "[~h9m",
        "(j|w0",
        "d?~0R",
        "?)cQ)",
        "G'g@l\"C!",
        "e@lDG!",
        "B  kg",
        "6njF\\",
        "@~u1l",
        "S:8u2Y",
        "KdoU-",
        "g@k4d",
        "PB{L,;",
        "/<wc_",
        "rodQv",
        "U3]pl",
        "$LEuL",
        "products.xml",
        "GaWVL",
        "bP:w&",
        "lCQ=(",
        "/q^(/|",
        "sn'82",
        "&:]~GE",
        "/T*2\"",
        ",)]qk",
        "xB47A'y",
        "tvD!s",
        "7h~7k",
        "7J,*S",
        "qkqJY",
        ">F~aKZ[",
        "b7z\"8",
        "W,%ux",
        "n=cW)",
        "9<}gt",
        "@whee",
        "6Hl#[",
        "/;lC_",
        " qu _9",
        "YDxB)a",
        "KMk1Y~",
        "f@l\\G!",
        " ;lBJ ",
        ":]}as",
        "-Hk$`",
        "LPkgl",
        "pR<V|,",
        "{~|cVc",
        "B&(V:j",
        "<v{V4",
        "}y\\OY",
        "Nwvoe",
        "s1\\'w",
        "I0Zhe",
        "p}s75p'",
        "4@2_9L",
        "u}z-\"",
        "cqp W",
        "#go[M",
        "=SOouF",
        "eZ7^/",
        "!d1E]~",
        "1Uo7u",
        "~%7T-",
        "&|b9y",
        "BX7x'",
        "U)+wq",
        ">8AWms",
        "BZ6`%",
        "w-`O{",
        "+au\\*6",
        "#|QI{M",
        "$Nu7M;",
        "<1C  ",
        "i'Zcu*",
        "KIC  5ux",
        "{~}{l)I",
        "XcM/g",
        "oe:C(",
        "<v2V9fll0m",
        "I^h35",
        "iri=T",
        "6*Vyd",
        "94,@L",
        "syzdm",
        "Cl(!;&",
        "\\LQWnQ2",
        "dK^\\4|",
        "-(i%_",
        "^LOM%",
        "@e+6\"",
        "}0(kJ",
        "@P\"~L"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5932
    },
    {
      "name": [
        "SetupCore.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/a9ac64ec515d04589dfc38b25d68d01f281bbb794d0df9ec4205fe473703aef5",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\SetupCore.dll"
      ],
      "size": 2172728,
      "crc32": "6F6CC2C4",
      "md5": "55a4344e76136460be2c8547c38567b4",
      "sha1": "83400b9a3bc4f1d935258a80b3e7636baaa618cb",
      "sha256": "a9ac64ec515d04589dfc38b25d68d01f281bbb794d0df9ec4205fe473703aef5",
      "sha512": "a8ad61caf69891ee31c48401ec87d3bb92db5e64c9fe878ee33e072fd6e5406db9a747485d1cf93f615072e6c565c36715700571dcd974c6eb7a76a7630d0f43",
      "rh_hash": null,
      "ssdeep": "24576:OeEbcHPcrJLItSNvtuu/YhSef7K/cjkXgaoo0NGG2Adj9DDIE/RYw:OVb2cRwyY4VXXEL2GjBIQYw",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T153A5B4256BED0128F1F3AF3599B526A55D7BBD616934ED8E0280824D0D32E92DC70F3B",
      "sha3_384": "8cbb36c28edc42f7c1ba496eadc110de958c4cb26beebfac0be42a6a5f48ad06523035e34c17f2ec2dee80d9fe0841ce",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x001a14b0",
        "ep_bytes": "8bff558bec837d0c017505e8110a0000",
        "peid_signatures": null,
        "reported_checksum": "0x00216fe1",
        "actual_checksum": "0x00216fe1",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "SetupCore.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x101b342c",
                "name": "_vsnprintf"
              },
              {
                "address": "0x101b3430",
                "name": "wcsrchr"
              },
              {
                "address": "0x101b3434",
                "name": "bsearch"
              },
              {
                "address": "0x101b3438",
                "name": "_vscwprintf"
              },
              {
                "address": "0x101b343c",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x101b3440",
                "name": "towupper"
              },
              {
                "address": "0x101b3444",
                "name": "strrchr"
              },
              {
                "address": "0x101b3448",
                "name": "wcscpy_s"
              },
              {
                "address": "0x101b344c",
                "name": "_ultow_s"
              },
              {
                "address": "0x101b3450",
                "name": "wcscat_s"
              },
              {
                "address": "0x101b3454",
                "name": "swprintf_s"
              },
              {
                "address": "0x101b3458",
                "name": "_vsnwprintf_s"
              },
              {
                "address": "0x101b345c",
                "name": "strcpy_s"
              },
              {
                "address": "0x101b3460",
                "name": "wcsnlen"
              },
              {
                "address": "0x101b3464",
                "name": "toupper"
              },
              {
                "address": "0x101b3468",
                "name": "_vsnprintf_s"
              },
              {
                "address": "0x101b346c",
                "name": "_errno"
              },
              {
                "address": "0x101b3470",
                "name": "_snprintf_s"
              },
              {
                "address": "0x101b3474",
                "name": "_wcsupr"
              },
              {
                "address": "0x101b3478",
                "name": "strncmp"
              },
              {
                "address": "0x101b347c",
                "name": "_snwscanf_s"
              },
              {
                "address": "0x101b3480",
                "name": "memset"
              },
              {
                "address": "0x101b3484",
                "name": "memcmp"
              },
              {
                "address": "0x101b3488",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x101b348c",
                "name": "_wcslwr"
              },
              {
                "address": "0x101b3490",
                "name": "iswspace"
              },
              {
                "address": "0x101b3494",
                "name": "swscanf_s"
              },
              {
                "address": "0x101b3498",
                "name": "_wtoi"
              },
              {
                "address": "0x101b349c",
                "name": "wcsncmp"
              },
              {
                "address": "0x101b34a0",
                "name": "_wcstoi64"
              },
              {
                "address": "0x101b34a4",
                "name": "qsort"
              },
              {
                "address": "0x101b34a8",
                "name": "towlower"
              },
              {
                "address": "0x101b34ac",
                "name": "memmove_s"
              },
              {
                "address": "0x101b34b0",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x101b34b4",
                "name": "_onexit"
              },
              {
                "address": "0x101b34b8",
                "name": "__dllonexit"
              },
              {
                "address": "0x101b34bc",
                "name": "_unlock"
              },
              {
                "address": "0x101b34c0",
                "name": "_lock"
              },
              {
                "address": "0x101b34c4",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x101b34c8",
                "name": "_initterm"
              },
              {
                "address": "0x101b34cc",
                "name": "malloc"
              },
              {
                "address": "0x101b34d0",
                "name": "free"
              },
              {
                "address": "0x101b34d4",
                "name": "_amsg_exit"
              },
              {
                "address": "0x101b34d8",
                "name": "_XcptFilter"
              },
              {
                "address": "0x101b34dc",
                "name": "memmove"
              },
              {
                "address": "0x101b34e0",
                "name": "memcpy"
              },
              {
                "address": "0x101b34e4",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x101b34e8",
                "name": "?what@exception@@UBEPBDXZ"
              },
              {
                "address": "0x101b34ec",
                "name": "??1exception@@UAE@XZ"
              },
              {
                "address": "0x101b34f0",
                "name": "??0exception@@QAE@ABV0@@Z"
              },
              {
                "address": "0x101b34f4",
                "name": "??0exception@@QAE@ABQBDH@Z"
              },
              {
                "address": "0x101b34f8",
                "name": "??0exception@@QAE@ABQBD@Z"
              },
              {
                "address": "0x101b34fc",
                "name": "??0exception@@QAE@XZ"
              },
              {
                "address": "0x101b3500",
                "name": "fwprintf"
              },
              {
                "address": "0x101b3504",
                "name": "wcsstr"
              },
              {
                "address": "0x101b3508",
                "name": "_wfopen"
              },
              {
                "address": "0x101b350c",
                "name": "wcschr"
              },
              {
                "address": "0x101b3510",
                "name": "ldiv"
              },
              {
                "address": "0x101b3514",
                "name": "_purecall"
              },
              {
                "address": "0x101b3518",
                "name": "wcstoul"
              },
              {
                "address": "0x101b351c",
                "name": "fclose"
              },
              {
                "address": "0x101b3520",
                "name": "memcpy_s"
              },
              {
                "address": "0x101b3524",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x101b3528",
                "name": "_wcsicmp"
              },
              {
                "address": "0x101b352c",
                "name": "__CxxFrameHandler3"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x101b3534",
                "name": "RtlNtStatusToDosErrorNoTeb"
              },
              {
                "address": "0x101b3538",
                "name": "RtlInitUnicodeStringEx"
              },
              {
                "address": "0x101b353c",
                "name": "RtlInitializeCriticalSection"
              },
              {
                "address": "0x101b3540",
                "name": "RtlDeleteCriticalSection"
              },
              {
                "address": "0x101b3544",
                "name": "RtlCreateHeap"
              },
              {
                "address": "0x101b3548",
                "name": "RtlDestroyHeap"
              },
              {
                "address": "0x101b354c",
                "name": "NtSetEaFile"
              },
              {
                "address": "0x101b3550",
                "name": "RtlFindAceByType"
              },
              {
                "address": "0x101b3554",
                "name": "RtlSetControlSecurityDescriptor"
              },
              {
                "address": "0x101b3558",
                "name": "RtlDeleteResource"
              },
              {
                "address": "0x101b355c",
                "name": "RtlReleaseResource"
              },
              {
                "address": "0x101b3560",
                "name": "RtlAcquireResourceShared"
              },
              {
                "address": "0x101b3564",
                "name": "RtlAcquireResourceExclusive"
              },
              {
                "address": "0x101b3568",
                "name": "RtlInitializeResource"
              },
              {
                "address": "0x101b356c",
                "name": "NtQueryInformationProcess"
              },
              {
                "address": "0x101b3570",
                "name": "RtlDowncaseUnicodeChar"
              },
              {
                "address": "0x101b3574",
                "name": "DbgPrintEx"
              },
              {
                "address": "0x101b3578",
                "name": "NtYieldExecution"
              },
              {
                "address": "0x101b357c",
                "name": "RtlRaiseStatus"
              },
              {
                "address": "0x101b3580",
                "name": "NtWaitForSingleObject"
              },
              {
                "address": "0x101b3584",
                "name": "NtCreateFile"
              },
              {
                "address": "0x101b3588",
                "name": "NtQueryInformationFile"
              },
              {
                "address": "0x101b358c",
                "name": "RtlExpandEnvironmentStrings"
              },
              {
                "address": "0x101b3590",
                "name": "RtlReAllocateHeap"
              },
              {
                "address": "0x101b3594",
                "name": "NtReadFile"
              },
              {
                "address": "0x101b3598",
                "name": "NtWriteFile"
              },
              {
                "address": "0x101b359c",
                "name": "NtEnumerateBootEntries"
              },
              {
                "address": "0x101b35a0",
                "name": "NtQueryDirectoryObject"
              },
              {
                "address": "0x101b35a4",
                "name": "NtOpenDirectoryObject"
              },
              {
                "address": "0x101b35a8",
                "name": "NtTranslateFilePath"
              },
              {
                "address": "0x101b35ac",
                "name": "NtSetSecurityObject"
              },
              {
                "address": "0x101b35b0",
                "name": "NtQueryBootOptions"
              },
              {
                "address": "0x101b35b4",
                "name": "NtQueryBootEntryOrder"
              },
              {
                "address": "0x101b35b8",
                "name": "NtOpenFile"
              },
              {
                "address": "0x101b35bc",
                "name": "NtDeviceIoControlFile"
              },
              {
                "address": "0x101b35c0",
                "name": "NtQuerySymbolicLinkObject"
              },
              {
                "address": "0x101b35c4",
                "name": "NtOpenSymbolicLinkObject"
              },
              {
                "address": "0x101b35c8",
                "name": "RtlImpersonateSelf"
              },
              {
                "address": "0x101b35cc",
                "name": "NtOpenThreadTokenEx"
              },
              {
                "address": "0x101b35d0",
                "name": "NtSetInformationThread"
              },
              {
                "address": "0x101b35d4",
                "name": "NtOpenProcessTokenEx"
              },
              {
                "address": "0x101b35d8",
                "name": "NtAdjustPrivilegesToken"
              },
              {
                "address": "0x101b35dc",
                "name": "NtQuerySystemInformation"
              },
              {
                "address": "0x101b35e0",
                "name": "ZwOpenProcess"
              },
              {
                "address": "0x101b35e4",
                "name": "ZwQueryInformationFile"
              },
              {
                "address": "0x101b35e8",
                "name": "RtlInitAnsiString"
              },
              {
                "address": "0x101b35ec",
                "name": "ZwQueryInformationProcess"
              },
              {
                "address": "0x101b35f0",
                "name": "LdrGetDllHandle"
              },
              {
                "address": "0x101b35f4",
                "name": "LdrGetProcedureAddress"
              },
              {
                "address": "0x101b35f8",
                "name": "ZwOpenDirectoryObject"
              },
              {
                "address": "0x101b35fc",
                "name": "ZwOpenSymbolicLinkObject"
              },
              {
                "address": "0x101b3600",
                "name": "ZwQueryDirectoryObject"
              },
              {
                "address": "0x101b3604",
                "name": "ZwDeviceIoControlFile"
              },
              {
                "address": "0x101b3608",
                "name": "ZwQuerySymbolicLinkObject"
              },
              {
                "address": "0x101b360c",
                "name": "ZwAllocateUuids"
              },
              {
                "address": "0x101b3610",
                "name": "ZwOpenKey"
              },
              {
                "address": "0x101b3614",
                "name": "ZwSetValueKey"
              },
              {
                "address": "0x101b3618",
                "name": "RtlCreateSecurityDescriptor"
              },
              {
                "address": "0x101b361c",
                "name": "ZwUnloadKey"
              },
              {
                "address": "0x101b3620",
                "name": "ZwSetSecurityObject"
              },
              {
                "address": "0x101b3624",
                "name": "RtlCreateAcl"
              },
              {
                "address": "0x101b3628",
                "name": "ZwQueryValueKey"
              },
              {
                "address": "0x101b362c",
                "name": "ZwEnumerateKey"
              },
              {
                "address": "0x101b3630",
                "name": "ZwDeleteKey"
              },
              {
                "address": "0x101b3634",
                "name": "RtlFreeSid"
              },
              {
                "address": "0x101b3638",
                "name": "RtlLengthSid"
              },
              {
                "address": "0x101b363c",
                "name": "RtlAllocateAndInitializeSid"
              },
              {
                "address": "0x101b3640",
                "name": "RtlAddAccessAllowedAceEx"
              },
              {
                "address": "0x101b3644",
                "name": "ZwLoadKey"
              },
              {
                "address": "0x101b3648",
                "name": "ZwCreateKey"
              },
              {
                "address": "0x101b364c",
                "name": "RtlSetDaclSecurityDescriptor"
              },
              {
                "address": "0x101b3650",
                "name": "RtlSetOwnerSecurityDescriptor"
              },
              {
                "address": "0x101b3654",
                "name": "RtlLengthSecurityDescriptor"
              },
              {
                "address": "0x101b3658",
                "name": "ZwClose"
              },
              {
                "address": "0x101b365c",
                "name": "ZwOpenMutant"
              },
              {
                "address": "0x101b3660",
                "name": "ZwOpenFile"
              },
              {
                "address": "0x101b3664",
                "name": "ZwReleaseMutant"
              },
              {
                "address": "0x101b3668",
                "name": "ZwQueryKey"
              },
              {
                "address": "0x101b366c",
                "name": "RtlCompareUnicodeString"
              },
              {
                "address": "0x101b3670",
                "name": "RtlAllocateHeap"
              },
              {
                "address": "0x101b3674",
                "name": "RtlInitUnicodeString"
              },
              {
                "address": "0x101b3678",
                "name": "RtlDosPathNameToNtPathName_U"
              },
              {
                "address": "0x101b367c",
                "name": "RtlAdjustPrivilege"
              },
              {
                "address": "0x101b3680",
                "name": "RtlGetVersion"
              },
              {
                "address": "0x101b3684",
                "name": "RtlNtStatusToDosError"
              },
              {
                "address": "0x101b3688",
                "name": "RtlFreeHeap"
              },
              {
                "address": "0x101b368c",
                "name": "NtSetInformationFile"
              },
              {
                "address": "0x101b3690",
                "name": "RtlDosPathNameToNtPathName_U_WithStatus"
              },
              {
                "address": "0x101b3694",
                "name": "ZwWaitForSingleObject"
              },
              {
                "address": "0x101b3698",
                "name": "ZwQueryAttributesFile"
              },
              {
                "address": "0x101b369c",
                "name": "RtlAppendUnicodeToString"
              },
              {
                "address": "0x101b36a0",
                "name": "RtlStringFromGUID"
              },
              {
                "address": "0x101b36a4",
                "name": "RtlFreeUnicodeString"
              },
              {
                "address": "0x101b36a8",
                "name": "RtlGUIDFromString"
              },
              {
                "address": "0x101b36ac",
                "name": "ZwQuerySystemInformation"
              },
              {
                "address": "0x101b36b0",
                "name": "NtClose"
              },
              {
                "address": "0x101b36b4",
                "name": "NtQueryValueKey"
              },
              {
                "address": "0x101b36b8",
                "name": "NtOpenKey"
              },
              {
                "address": "0x101b36bc",
                "name": "RtlCompareMemory"
              },
              {
                "address": "0x101b36c0",
                "name": "ZwDeleteValueKey"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x101b30e0",
                "name": "LoadLibraryW"
              },
              {
                "address": "0x101b30e4",
                "name": "CreateThread"
              },
              {
                "address": "0x101b30e8",
                "name": "ResetEvent"
              },
              {
                "address": "0x101b30ec",
                "name": "HeapAlloc"
              },
              {
                "address": "0x101b30f0",
                "name": "GetProcAddress"
              },
              {
                "address": "0x101b30f4",
                "name": "SetFilePointerEx"
              },
              {
                "address": "0x101b30f8",
                "name": "LocalFree"
              },
              {
                "address": "0x101b30fc",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x101b3100",
                "name": "LCMapStringW"
              },
              {
                "address": "0x101b3104",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x101b3108",
                "name": "CreateProcessW"
              },
              {
                "address": "0x101b310c",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x101b3110",
                "name": "FreeLibrary"
              },
              {
                "address": "0x101b3114",
                "name": "CopyFileW"
              },
              {
                "address": "0x101b3118",
                "name": "WideCharToMultiByte"
              },
              {
                "address": "0x101b311c",
                "name": "SystemTimeToTzSpecificLocalTime"
              },
              {
                "address": "0x101b3120",
                "name": "GetSystemTime"
              },
              {
                "address": "0x101b3124",
                "name": "GetSystemWindowsDirectoryW"
              },
              {
                "address": "0x101b3128",
                "name": "VirtualQuery"
              },
              {
                "address": "0x101b312c",
                "name": "IsWow64Process"
              },
              {
                "address": "0x101b3130",
                "name": "GetDriveTypeW"
              },
              {
                "address": "0x101b3134",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x101b3138",
                "name": "IsDebuggerPresent"
              },
              {
                "address": "0x101b313c",
                "name": "FlushFileBuffers"
              },
              {
                "address": "0x101b3140",
                "name": "GetExitCodeProcess"
              },
              {
                "address": "0x101b3144",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x101b3148",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x101b314c",
                "name": "TerminateProcess"
              },
              {
                "address": "0x101b3150",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x101b3154",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x101b3158",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x101b315c",
                "name": "GetTickCount"
              },
              {
                "address": "0x101b3160",
                "name": "DeviceIoControl"
              },
              {
                "address": "0x101b3164",
                "name": "GetFileSizeEx"
              },
              {
                "address": "0x101b3168",
                "name": "SetFileAttributesW"
              },
              {
                "address": "0x101b316c",
                "name": "GetCurrentDirectoryW"
              },
              {
                "address": "0x101b3170",
                "name": "GetPrivateProfileSectionW"
              },
              {
                "address": "0x101b3174",
                "name": "GetPrivateProfileStringW"
              },
              {
                "address": "0x101b3178",
                "name": "GetFileInformationByHandleEx"
              },
              {
                "address": "0x101b317c",
                "name": "GetTempPathW"
              },
              {
                "address": "0x101b3180",
                "name": "GetFileInformationByHandle"
              },
              {
                "address": "0x101b3184",
                "name": "SetFileInformationByHandle"
              },
              {
                "address": "0x101b3188",
                "name": "CopyFileExW"
              },
              {
                "address": "0x101b318c",
                "name": "GetFinalPathNameByHandleW"
              },
              {
                "address": "0x101b3190",
                "name": "GetLongPathNameW"
              },
              {
                "address": "0x101b3194",
                "name": "GetVolumePathNameW"
              },
              {
                "address": "0x101b3198",
                "name": "GetVolumeNameForVolumeMountPointW"
              },
              {
                "address": "0x101b319c",
                "name": "GetCurrentThread"
              },
              {
                "address": "0x101b31a0",
                "name": "VirtualAlloc"
              },
              {
                "address": "0x101b31a4",
                "name": "GetDiskFreeSpaceExW"
              },
              {
                "address": "0x101b31a8",
                "name": "CloseHandle"
              },
              {
                "address": "0x101b31ac",
                "name": "OutputDebugStringW"
              },
              {
                "address": "0x101b31b0",
                "name": "GetLastError"
              },
              {
                "address": "0x101b31b4",
                "name": "GetTickCount64"
              },
              {
                "address": "0x101b31b8",
                "name": "GetTimeZoneInformation"
              },
              {
                "address": "0x101b31bc",
                "name": "FormatMessageW"
              },
              {
                "address": "0x101b31c0",
                "name": "Sleep"
              },
              {
                "address": "0x101b31c4",
                "name": "CreateEventW"
              },
              {
                "address": "0x101b31c8",
                "name": "GetLogicalDriveStringsW"
              },
              {
                "address": "0x101b31cc",
                "name": "GetSystemDefaultLocaleName"
              },
              {
                "address": "0x101b31d0",
                "name": "GetSystemDirectoryW"
              },
              {
                "address": "0x101b31d4",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x101b31d8",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x101b31dc",
                "name": "CreateFileW"
              },
              {
                "address": "0x101b31e0",
                "name": "LocalAlloc"
              },
              {
                "address": "0x101b31e4",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x101b31e8",
                "name": "FindClose"
              },
              {
                "address": "0x101b31ec",
                "name": "GetSystemPowerStatus"
              },
              {
                "address": "0x101b31f0",
                "name": "GetEnvironmentVariableW"
              },
              {
                "address": "0x101b31f4",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x101b31f8",
                "name": "InitializeCriticalSectionAndSpinCount"
              },
              {
                "address": "0x101b31fc",
                "name": "GetProductInfo"
              },
              {
                "address": "0x101b3200",
                "name": "GetUserDefaultUILanguage"
              },
              {
                "address": "0x101b3204",
                "name": "GetLocaleInfoEx"
              },
              {
                "address": "0x101b3208",
                "name": "SetEnvironmentVariableW"
              },
              {
                "address": "0x101b320c",
                "name": "WaitForMultipleObjects"
              },
              {
                "address": "0x101b3210",
                "name": "GetModuleFileNameW"
              },
              {
                "address": "0x101b3214",
                "name": "GetSystemDefaultUILanguage"
              },
              {
                "address": "0x101b3218",
                "name": "ExpandEnvironmentStringsW"
              },
              {
                "address": "0x101b321c",
                "name": "GetModuleHandleExW"
              },
              {
                "address": "0x101b3220",
                "name": "WriteFile"
              },
              {
                "address": "0x101b3224",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x101b3228",
                "name": "FindNextFileW"
              },
              {
                "address": "0x101b322c",
                "name": "GetFullPathNameW"
              },
              {
                "address": "0x101b3230",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x101b3234",
                "name": "SetLastError"
              },
              {
                "address": "0x101b3238",
                "name": "HeapFree"
              },
              {
                "address": "0x101b323c",
                "name": "CompareStringW"
              },
              {
                "address": "0x101b3240",
                "name": "SetEvent"
              },
              {
                "address": "0x101b3244",
                "name": "GetFileSize"
              },
              {
                "address": "0x101b3248",
                "name": "GetVersionExA"
              },
              {
                "address": "0x101b324c",
                "name": "GetTempFileNameW"
              },
              {
                "address": "0x101b3250",
                "name": "GetNativeSystemInfo"
              },
              {
                "address": "0x101b3254",
                "name": "GetLocaleInfoW"
              },
              {
                "address": "0x101b3258",
                "name": "GetSystemDefaultLCID"
              },
              {
                "address": "0x101b325c",
                "name": "RaiseException"
              },
              {
                "address": "0x101b3260",
                "name": "GetLocalTime"
              },
              {
                "address": "0x101b3264",
                "name": "ExitProcess"
              },
              {
                "address": "0x101b3268",
                "name": "GetModuleFileNameA"
              },
              {
                "address": "0x101b326c",
                "name": "GlobalFree"
              },
              {
                "address": "0x101b3270",
                "name": "DeleteFileW"
              },
              {
                "address": "0x101b3274",
                "name": "GetVersionExW"
              },
              {
                "address": "0x101b3278",
                "name": "DisableThreadLibraryCalls"
              },
              {
                "address": "0x101b327c",
                "name": "VirtualFree"
              },
              {
                "address": "0x101b3280",
                "name": "GetThreadUILanguage"
              },
              {
                "address": "0x101b3284",
                "name": "DebugBreak"
              },
              {
                "address": "0x101b3288",
                "name": "SizeofResource"
              },
              {
                "address": "0x101b328c",
                "name": "LockResource"
              },
              {
                "address": "0x101b3290",
                "name": "FindResourceExW"
              },
              {
                "address": "0x101b3294",
                "name": "LoadResource"
              },
              {
                "address": "0x101b3298",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x101b329c",
                "name": "AcquireSRWLockExclusive"
              },
              {
                "address": "0x101b32a0",
                "name": "OutputDebugStringA"
              },
              {
                "address": "0x101b32a4",
                "name": "TlsFree"
              },
              {
                "address": "0x101b32a8",
                "name": "SetErrorMode"
              },
              {
                "address": "0x101b32ac",
                "name": "CloseThreadpoolTimer"
              },
              {
                "address": "0x101b32b0",
                "name": "WaitForThreadpoolTimerCallbacks"
              },
              {
                "address": "0x101b32b4",
                "name": "SetThreadpoolTimer"
              },
              {
                "address": "0x101b32b8",
                "name": "InitializeCriticalSectionEx"
              },
              {
                "address": "0x101b32bc",
                "name": "WaitForSingleObjectEx"
              },
              {
                "address": "0x101b32c0",
                "name": "OpenSemaphoreW"
              },
              {
                "address": "0x101b32c4",
                "name": "ReleaseSRWLockShared"
              },
              {
                "address": "0x101b32c8",
                "name": "CreateThreadpoolTimer"
              },
              {
                "address": "0x101b32cc",
                "name": "CreateMutexExW"
              },
              {
                "address": "0x101b32d0",
                "name": "AcquireSRWLockShared"
              },
              {
                "address": "0x101b32d4",
                "name": "CompareStringOrdinal"
              },
              {
                "address": "0x101b32d8",
                "name": "HeapSize"
              },
              {
                "address": "0x101b32dc",
                "name": "HeapDestroy"
              },
              {
                "address": "0x101b32e0",
                "name": "SearchPathW"
              },
              {
                "address": "0x101b32e4",
                "name": "FindFirstFileW"
              },
              {
                "address": "0x101b32e8",
                "name": "ReadFile"
              },
              {
                "address": "0x101b32ec",
                "name": "CreateDirectoryW"
              },
              {
                "address": "0x101b32f0",
                "name": "GetVolumePathNamesForVolumeNameW"
              },
              {
                "address": "0x101b32f4",
                "name": "TlsSetValue"
              },
              {
                "address": "0x101b32f8",
                "name": "CreateMutexW"
              },
              {
                "address": "0x101b32fc",
                "name": "ReleaseMutex"
              },
              {
                "address": "0x101b3300",
                "name": "SetFilePointer"
              },
              {
                "address": "0x101b3304",
                "name": "OpenProcess"
              },
              {
                "address": "0x101b3308",
                "name": "GetHandleInformation"
              },
              {
                "address": "0x101b330c",
                "name": "SetEndOfFile"
              },
              {
                "address": "0x101b3310",
                "name": "GetOverlappedResult"
              },
              {
                "address": "0x101b3314",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x101b3318",
                "name": "CreateSemaphoreExW"
              },
              {
                "address": "0x101b331c",
                "name": "ReleaseSemaphore"
              },
              {
                "address": "0x101b3320",
                "name": "GetVolumeInformationW"
              },
              {
                "address": "0x101b3324",
                "name": "HeapReAlloc"
              },
              {
                "address": "0x101b3328",
                "name": "LockFileEx"
              },
              {
                "address": "0x101b332c",
                "name": "UnlockFileEx"
              },
              {
                "address": "0x101b3330",
                "name": "DuplicateHandle"
              },
              {
                "address": "0x101b3334",
                "name": "GetSystemInfo"
              },
              {
                "address": "0x101b3338",
                "name": "CreateFileMappingW"
              },
              {
                "address": "0x101b333c",
                "name": "MapViewOfFile"
              },
              {
                "address": "0x101b3340",
                "name": "UnmapViewOfFile"
              },
              {
                "address": "0x101b3344",
                "name": "GetVolumeInformationByHandleW"
              },
              {
                "address": "0x101b3348",
                "name": "GlobalMemoryStatusEx"
              },
              {
                "address": "0x101b334c",
                "name": "RemoveDirectoryW"
              },
              {
                "address": "0x101b3350",
                "name": "MultiByteToWideChar"
              },
              {
                "address": "0x101b3354",
                "name": "DosDateTimeToFileTime"
              },
              {
                "address": "0x101b3358",
                "name": "LocalFileTimeToFileTime"
              },
              {
                "address": "0x101b335c",
                "name": "SetFileTime"
              },
              {
                "address": "0x101b3360",
                "name": "TlsAlloc"
              },
              {
                "address": "0x101b3364",
                "name": "TlsGetValue"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x101b3000",
                "name": "RegQueryValueExW"
              },
              {
                "address": "0x101b3004",
                "name": "EventProviderEnabled"
              },
              {
                "address": "0x101b3008",
                "name": "RegDeleteKeyW"
              },
              {
                "address": "0x101b300c",
                "name": "RevertToSelf"
              },
              {
                "address": "0x101b3010",
                "name": "CloseEncryptedFileRaw"
              },
              {
                "address": "0x101b3014",
                "name": "WriteEncryptedFileRaw"
              },
              {
                "address": "0x101b3018",
                "name": "OpenEncryptedFileRawW"
              },
              {
                "address": "0x101b301c",
                "name": "GetAclInformation"
              },
              {
                "address": "0x101b3020",
                "name": "GetSecurityDescriptorLength"
              },
              {
                "address": "0x101b3024",
                "name": "GetSecurityDescriptorControl"
              },
              {
                "address": "0x101b3028",
                "name": "GetSecurityDescriptorSacl"
              },
              {
                "address": "0x101b302c",
                "name": "GetSecurityDescriptorDacl"
              },
              {
                "address": "0x101b3030",
                "name": "GetSecurityDescriptorGroup"
              },
              {
                "address": "0x101b3034",
                "name": "GetSecurityDescriptorOwner"
              },
              {
                "address": "0x101b3038",
                "name": "SetSecurityDescriptorDacl"
              },
              {
                "address": "0x101b303c",
                "name": "EqualSid"
              },
              {
                "address": "0x101b3040",
                "name": "AddAccessAllowedAce"
              },
              {
                "address": "0x101b3044",
                "name": "InitializeAcl"
              },
              {
                "address": "0x101b3048",
                "name": "GetTraceLoggerHandle"
              },
              {
                "address": "0x101b304c",
                "name": "GetTraceEnableFlags"
              },
              {
                "address": "0x101b3050",
                "name": "GetTraceEnableLevel"
              },
              {
                "address": "0x101b3054",
                "name": "RegisterTraceGuidsW"
              },
              {
                "address": "0x101b3058",
                "name": "UnregisterTraceGuids"
              },
              {
                "address": "0x101b305c",
                "name": "GetLengthSid"
              },
              {
                "address": "0x101b3060",
                "name": "GetTokenInformation"
              },
              {
                "address": "0x101b3064",
                "name": "InitializeSecurityDescriptor"
              },
              {
                "address": "0x101b3068",
                "name": "EventRegister"
              },
              {
                "address": "0x101b306c",
                "name": "EventUnregister"
              },
              {
                "address": "0x101b3070",
                "name": "SetThreadToken"
              },
              {
                "address": "0x101b3074",
                "name": "DuplicateTokenEx"
              },
              {
                "address": "0x101b3078",
                "name": "OpenThreadToken"
              },
              {
                "address": "0x101b307c",
                "name": "EventWriteTransfer"
              },
              {
                "address": "0x101b3080",
                "name": "AdjustTokenPrivileges"
              },
              {
                "address": "0x101b3084",
                "name": "AllocateAndInitializeSid"
              },
              {
                "address": "0x101b3088",
                "name": "OpenProcessToken"
              },
              {
                "address": "0x101b308c",
                "name": "FreeSid"
              },
              {
                "address": "0x101b3090",
                "name": "CheckTokenMembership"
              },
              {
                "address": "0x101b3094",
                "name": "RegCloseKey"
              },
              {
                "address": "0x101b3098",
                "name": "RegQueryInfoKeyW"
              },
              {
                "address": "0x101b309c",
                "name": "RegCreateKeyExW"
              },
              {
                "address": "0x101b30a0",
                "name": "RegSetKeySecurity"
              },
              {
                "address": "0x101b30a4",
                "name": "RegSetValueExW"
              },
              {
                "address": "0x101b30a8",
                "name": "RegUnLoadKeyW"
              },
              {
                "address": "0x101b30ac",
                "name": "RegLoadKeyW"
              },
              {
                "address": "0x101b30b0",
                "name": "RegOpenKeyExW"
              },
              {
                "address": "0x101b30b4",
                "name": "RegGetValueW"
              },
              {
                "address": "0x101b30b8",
                "name": "RegCreateKeyW"
              },
              {
                "address": "0x101b30bc",
                "name": "RegDeleteValueW"
              },
              {
                "address": "0x101b30c0",
                "name": "RegEnumValueW"
              }
            ]
          },
          "USER32": {
            "dll": "USER32.dll",
            "imports": [
              {
                "address": "0x101b33c0",
                "name": "CharUpperW"
              },
              {
                "address": "0x101b33c4",
                "name": "FindWindowExW"
              },
              {
                "address": "0x101b33c8",
                "name": "GetSystemMetrics"
              },
              {
                "address": "0x101b33cc",
                "name": "UnregisterClassA"
              },
              {
                "address": "0x101b33d0",
                "name": "CharNextW"
              }
            ]
          },
          "ole32": {
            "dll": "ole32.dll",
            "imports": [
              {
                "address": "0x101b36c8",
                "name": "CoTaskMemFree"
              },
              {
                "address": "0x101b36cc",
                "name": "CoCreateInstance"
              }
            ]
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x101b3378",
                "name": "SysAllocString"
              },
              {
                "address": "0x101b337c",
                "name": "SysFreeString"
              },
              {
                "address": "0x101b3380",
                "name": "VariantInit"
              },
              {
                "address": "0x101b3384",
                "name": "SystemTimeToVariantTime"
              }
            ]
          },
          "RPCRT4": {
            "dll": "RPCRT4.dll",
            "imports": [
              {
                "address": "0x101b338c",
                "name": "RpcStringFreeW"
              },
              {
                "address": "0x101b3390",
                "name": "I_RpcMapWin32Status"
              },
              {
                "address": "0x101b3394",
                "name": "UuidToStringW"
              },
              {
                "address": "0x101b3398",
                "name": "UuidCreate"
              }
            ]
          },
          "VERSION": {
            "dll": "VERSION.dll",
            "imports": [
              {
                "address": "0x101b33e4",
                "name": "GetFileVersionInfoSizeW"
              },
              {
                "address": "0x101b33e8",
                "name": "VerQueryValueW"
              },
              {
                "address": "0x101b33ec",
                "name": "GetFileVersionInfoW"
              },
              {
                "address": "0x101b33f0",
                "name": "GetFileVersionInfoExW"
              },
              {
                "address": "0x101b33f4",
                "name": "GetFileVersionInfoSizeExW"
              }
            ]
          },
          "Cabinet": {
            "dll": "Cabinet.dll",
            "imports": []
          },
          "CRYPT32": {
            "dll": "CRYPT32.dll",
            "imports": [
              {
                "address": "0x101b30c8",
                "name": "CertVerifyCertificateChainPolicy"
              }
            ]
          },
          "WINTRUST": {
            "dll": "WINTRUST.dll",
            "imports": [
              {
                "address": "0x101b33fc",
                "name": "WinVerifyTrust"
              },
              {
                "address": "0x101b3400",
                "name": "WTHelperGetProvSignerFromChain"
              },
              {
                "address": "0x101b3404",
                "name": "WTHelperProvDataFromStateData"
              }
            ]
          },
          "NETAPI32": {
            "dll": "NETAPI32.dll",
            "imports": [
              {
                "address": "0x101b336c",
                "name": "NetGetJoinInformation"
              },
              {
                "address": "0x101b3370",
                "name": "NetApiBufferFree"
              }
            ]
          },
          "UxTheme": {
            "dll": "UxTheme.dll",
            "imports": []
          },
          "bcrypt": {
            "dll": "bcrypt.dll",
            "imports": [
              {
                "address": "0x101b340c",
                "name": "BCryptDestroyHash"
              },
              {
                "address": "0x101b3410",
                "name": "BCryptGetProperty"
              },
              {
                "address": "0x101b3414",
                "name": "BCryptOpenAlgorithmProvider"
              },
              {
                "address": "0x101b3418",
                "name": "BCryptCloseAlgorithmProvider"
              },
              {
                "address": "0x101b341c",
                "name": "BCryptCreateHash"
              },
              {
                "address": "0x101b3420",
                "name": "BCryptHashData"
              },
              {
                "address": "0x101b3424",
                "name": "BCryptFinishHash"
              }
            ]
          },
          "SETUPAPI": {
            "dll": "SETUPAPI.dll",
            "imports": [
              {
                "address": "0x101b33a0",
                "name": "SetupDiGetDeviceInterfacePropertyW"
              },
              {
                "address": "0x101b33a4",
                "name": "SetupDiEnumDeviceInterfaces"
              },
              {
                "address": "0x101b33a8",
                "name": "SetupDiGetClassDevsW"
              },
              {
                "address": "0x101b33ac",
                "name": "SetupDiGetDeviceRegistryPropertyW"
              },
              {
                "address": "0x101b33b0",
                "name": "SetupDiGetDeviceInterfaceDetailW"
              }
            ]
          },
          "SLC": {
            "dll": "SLC.dll",
            "imports": [
              {
                "address": "0x101b33b8",
                "name": "SLGetWindowsInformationDWORD"
              }
            ]
          }
        },
        "exported_dll_name": "SETUPCORE.DLL",
        "exports": [
          {
            "address": "0x10106130",
            "name": "CreateSetupObject",
            "ordinal": 1
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x001abdf0",
            "size": "0x00000052"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x001b36d8",
            "size": "0x00000168"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x001b7000",
            "size": "0x0004cc58"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x00210600",
            "size": "0x00002138"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x00204000",
            "size": "0x0000fb64"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x000beef0",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x0000b67c",
            "size": "0x00000018"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x0000b5d0",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x001b3000",
            "size": "0x000006d4"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x001aae42",
            "size_of_data": "0x001ab000",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.02"
          },
          {
            "name": ".data",
            "raw_address": "0x001ab400",
            "virtual_address": "0x001ac000",
            "virtual_size": "0x000065b8",
            "size_of_data": "0x00005600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "4.11"
          },
          {
            "name": ".idata",
            "raw_address": "0x001b0a00",
            "virtual_address": "0x001b3000",
            "virtual_size": "0x0000300a",
            "size_of_data": "0x00003200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.55"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x001b3c00",
            "virtual_address": "0x001b7000",
            "virtual_size": "0x0004d000",
            "size_of_data": "0x0004ce00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "4.24"
          },
          {
            "name": ".reloc",
            "raw_address": "0x00200a00",
            "virtual_address": "0x00204000",
            "virtual_size": "0x0000fb64",
            "size_of_data": "0x0000fc00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.68"
          }
        ],
        "overlay": {
          "offset": "0x00210600",
          "size": "0x00002138"
        },
        "resources": [
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001b7490",
            "size": "0x0000147c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.90"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001b890c",
            "size": "0x000034b4",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.59"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001bbdc0",
            "size": "0x0000392c",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.33"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001bf6ec",
            "size": "0x00003f78",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.39"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001c3664",
            "size": "0x00003f6c",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.96"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001c75d0",
            "size": "0x00003490",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.29"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001caa60",
            "size": "0x000034a4",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.31"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001cdf04",
            "size": "0x0000405c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.34"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001d1f60",
            "size": "0x00003a14",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.45"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001d5974",
            "size": "0x00004030",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.26"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001d99a4",
            "size": "0x00001fe0",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "5.10"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001db984",
            "size": "0x00001f0c",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.33"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001dd890",
            "size": "0x00003f14",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.26"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001e17a4",
            "size": "0x000034e0",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.33"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001e4c84",
            "size": "0x000039b0",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001e8634",
            "size": "0x00003aac",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.31"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001ec0e0",
            "size": "0x000035d4",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.95"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001ef6b4",
            "size": "0x000036f0",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.33"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001f2da4",
            "size": "0x0000327c",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001f6020",
            "size": "0x00001480",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.86"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001f74a0",
            "size": "0x00003b28",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.31"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001fafc8",
            "size": "0x00003c10",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.26"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x001febd8",
            "size": "0x00000380",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.62"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x001fef58",
            "size": "0x00000398",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x001ff2f0",
            "size": "0x000003b4",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.51"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x001ff6a4",
            "size": "0x00000398",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.52"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x001ffa3c",
            "size": "0x000003d0",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.07"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x001ffe0c",
            "size": "0x0000039c",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.49"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x002001a8",
            "size": "0x000003a8",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.53"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00200550",
            "size": "0x000003dc",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.53"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x0020092c",
            "size": "0x000003a4",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.54"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00200cd0",
            "size": "0x000003ac",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.50"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x0020107c",
            "size": "0x0000038c",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.65"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00201408",
            "size": "0x00000380",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.60"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00201788",
            "size": "0x0000039c",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.53"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00201b24",
            "size": "0x00000394",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.50"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00201eb8",
            "size": "0x000003b8",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.53"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00202270",
            "size": "0x000003bc",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.51"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x0020262c",
            "size": "0x000003e4",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.95"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00202a10",
            "size": "0x000003b4",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.52"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00202dc4",
            "size": "0x000003a4",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00203168",
            "size": "0x0000037c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.59"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x002034e4",
            "size": "0x000003b8",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.51"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x0020389c",
            "size": "0x000003bc",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.50"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "安裝程式核心動作"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0404 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Setup Core Actions"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Všechna práva vyhrazena."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Operační systém Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0405 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Konfigurer kernehandlinger"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Alle rettigheder forbeholdes."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operativsystem"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0406 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Setup-Kernaktionen"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Alle Rechte vorbehalten."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Betriebssystem Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0407 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Ενέργειες πυρήνα εγκατάστασης"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Με επιφύλαξη κάθε νόμιμου δικαιώματος."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Λειτουργικό σύστημα Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0408 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Setup Core Actions"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Määritä ydintoimet"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Kaikki oikeudet pidätetään."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® -käyttöjärjestelmä"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x040b 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Actions principales du programme d'installation"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Tous droits réservés."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Système d’exploitation Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x040c 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "A telepítő alapfunkciói"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Minden jog fenntartva."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® operációs rendszer"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x040e 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Azioni base installazione"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Tutti i diritti riservati."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Sistema operativo Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0410 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "コア アクションのセットアップ"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0411 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "설치 코어 작업"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0412 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Setup Core-acties"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Alle rechten voorbehouden."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows®-besturingssysteem"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0413 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Installer kjernehandlinger"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Med enerett."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Operativsystemet Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0414 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Podstawowe akcje Instalatora"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Wszelkie prawa zastrzeżone."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "System operacyjny Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0415 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Configurar Ações de Núcleo"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Todos os direitos reservados."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Sistema Operacional Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0416 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Основные действия при установке"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Корпорация Майкрософт (Microsoft Corporation). Все права защищены."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Операционная система Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0419 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Kärnåtgärder för installationsprogrammet"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Med ensamrätt."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Operativsystemet Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x041d 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Kurulum Çekirdek Eylemleri"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Tüm hakları saklıdır."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® İşletim Sistemi"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x041f 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "设置核心操作"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0804 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Configurar Ações Principais"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Todos os direitos reservados."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Sistema Operativo Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0816 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Configurar acciones de núcleo"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupCore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Todos los derechos reservados."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupCore.dll"
          },
          {
            "name": "ProductName",
            "value": "Sistema operativo Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0c0a 0x04b0"
          }
        ],
        "imphash": "604513afcf63eb2e4123cfc6eb206dde",
        "timestamp": "2019-02-25 18:42:11",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 17
      },
      "data": null,
      "strings": [
        "9;:B:Y:w:",
        "LogAdapter::Logger::LogNumObjects",
        "GN7FR-4QK4T-8XPDY-P2RYF-QGP4G",
        "Microsoft.Windows.162.X21-83178_8wekyb3d8bbwe",
        "><?G?U?",
        "<,=4=w=",
        "445;5R5Y5m5t5",
        "Microsoft.Windows.101.X20-29687_8wekyb3d8bbwe",
        "BiBindEfiBootManager failed %x",
        "CompatInstallReq: Initializing Image Index:               [%d]",
        "cea4a4b9-8c5c-9316-2108-cceb95d737f3",
        "Automation: Registered DISK_PARTITION Response",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::SetParameters",
        "Microsoft.Windows.162.X21-43642_8wekyb3d8bbwe",
        " Microsoft Corporation. Med ensamr",
        "8#9(9-92979<9A9G9",
        "a pas pu s",
        "jabb verzi",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionUpdateMediaFactory,class CDlpActionUpdateMedia>::SetActionId",
        "jele. %0",
        "ebc0a77f-31c7-424b-8c62-638278ebdc23",
        "tsbericht kann aufgrund einer fehlenden Systemkomponente nicht angezeigt werden.%0",
        "Windowsin palautusymp",
        "Microsoft.Windows.98.X19-99662_8wekyb3d8bbwe",
        "3bea74c5-3b8d-38fb-49fb-823cb9287cc1",
        "9cc24120-fa06-08df-1253-73f588f3ef2f",
        "Microsoft.Windows.7.X21-83184_8wekyb3d8bbwe",
        "Egy sikerparancsf",
        "HN8HJ-PCTFX-K4X3W-YM8D9-TF4BG",
        "ShouldSuspendBitlocker",
        "STATUS_SXS_ASSEMBLY_NOT_FOUND",
        ";+;M;S;n;|;",
        "De angivne automatiseringsoplysninger var ugyldige.%0",
        "ZwOpenKey",
        "DriverSkippedCount",
        "Microsoft.Windows.122.X20-29617_8wekyb3d8bbwe",
        "2d1d42b6-85a2-6257-ba56-ab8f7b38198f",
        "ris f",
        "5$5q5",
        "Vaadittuja ehtoja vastaavaa tarjousta ei l",
        "7WNQY-TJPFM-RXDB8-K4HTR-2KDFX",
        "8I8^8e8}8",
        "9M3QN-7CPRK-XVVM4-GFXGH-8HV2C",
        " bulunamad",
        "ar-MA",
        "6HNX2-8WPCG-4YD6C-99G7X-TF4CC",
        "QPWSQQh",
        "http://www.w3.org/XML/1998/namespace",
        "RtlNtStatusToDosError",
        "Microsoft.Windows.98.X19-99580_8wekyb3d8bbwe",
        "DiskSpaceInstallReq: Initializing Critical Count         [%ld]",
        "ml-IN",
        "Microsoft.Windows.122.X19-98693_8wekyb3d8bbwe",
        "N79J7-VMKVD-9XKD8-378K3-9778G",
        "0e65f202-a15e-96cb-596d-afc74b3209c2",
        "An unexpected version of Update Agent client was encountered.%0",
        "Een precommit-script kan niet worden uitgevoerd of heeft een fout geretourneerd.%0",
        "Recovery: Image Language:        [%s]",
        "%CLOUD_E%",
        "060L0Z0f0n0",
        "7*878",
        "n no est",
        "9sTtr",
        "0B1N1g1",
        "Brukeren har avsl",
        "4SVWQ",
        "Microsoft.Windows.48.X20-23598_8wekyb3d8bbwe",
        "12aebd59-f351-b4c2-ed8d-f56ba94c6861",
        "?MdDlt",
        "serverenterprisev",
        " setup.exe ",
        "030E0r0",
        "es de compatibilidade para transfer",
        "[RS2]",
        "Microsoft.Windows.100.X19-99458_8wekyb3d8bbwe",
        ".?AV?$CZeroInit@VCSetupFCDiagnostics@@$00@@",
        "5f2b068c-4ea3-e6a4-edc2-db19ef581689",
        "Microsoft.Windows.50.X17-54014_8wekyb3d8bbwe",
        "d9794ff0-7416-1879-63aa-8eca7ab86cb7",
        "9$9*90969<9C9J9Q9X9_9f9m9s9",
        "[%hs]",
        "DUImage: Hardware compatibility file [%s] not generated.",
        "NMX7M-7233W-6962R-K6GX6-V6DD6",
        "MoSetupPlatform: ReleaseSetupAutomation called with invalid suspend path: [%s]",
        "=9=K=",
        "5c03df24-1fdf-1556-f71d-b000b631db32",
        "Sh_^[",
        "UseStorageReservesForInstall",
        "InstallChoice",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionDataMigrateFactory@@VCDlpActionDataMigrate@@@@",
        "Microsoft.Windows.7.X18-81291_8wekyb3d8bbwe",
        "8&8d8k8",
        "DuplicateHandle",
        "CDlpActionCompat::InitializeFinalizeReqScan",
        "MoSetupPlatform: Creating SetupAutomation object from [%s]...",
        "dia. %0",
        "DUSetup: Downloaded %d updates.",
        "DataMigration: Migrating ReportId [%s] into Target OS...",
        "<{u%;",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::SerializeRoutine",
        "lemi bir s",
        "az-Cyrl-AZ",
        "Finalize: Remapping install success [0x%X] -> [0x%X] for telemetry.",
        "9C:_:",
        "<unknown>",
        "> >$>4>8><>@>D>H>L>T>X>\\>`>d>h>p>",
        "k~[\\*A",
        "st nem lehet megjelen",
        "O utilizador optou por cancelar a Configura",
        " megszak",
        "st inden for den kr",
        "Proces instalace byl neo",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::GetSerializeOnProgress",
        "BUCL::Rtl::BlockLookupTable<unsigned __int64,unsigned __int64,&long __stdcall Windows::Rtl::CompareIntegers<unsigned __int64>(unsigned __int64 const &,unsigned __int64 const &,int *),struct BUCL::Rtl::BlockLookupTablePODSetPolicy<unsigned __int64,unsigned __int64> >::Insert",
        "Asennuksen etenemiseen liittyv",
        "tej zgodno",
        "Microsoft.Windows.4.X19-99683_8wekyb3d8bbwe",
        ", mert a v",
        "Microsoft.Windows.47.X17-48253_8wekyb3d8bbwe",
        "Um script de pr",
        "3 3,383D3P3\\3h3t3",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::Execute",
        " platforma zjistila nespecifikovanou chybu.%0",
        "lanan otomasyon bilgi ge",
        "Microsoft.Windows.125.X21-83178_8wekyb3d8bbwe",
        "3M3F8-YN4T9-DJMK9-VTP6G-MKMQP",
        "0k0o0",
        "$:0:C:",
        "?&?1?L?",
        "CompatFinalizeReq: Initializing Language:              [%s]",
        "ts-ZA",
        "adavky na m",
        "Microsoft.Windows.48.res-v3306_8wekyb3d8bbwe",
        "Microsoft.Windows.99.X20-29698_8wekyb3d8bbwe",
        "151\\1",
        "GetSystemTime",
        "=T=j=w=",
        "6N6}6",
        "ConX::Setup::Common::COSInfoHelper::GetHostOSVersion",
        "pLj Q",
        "KW9QN-PQXBX-C24PY-23YXX-KQBMG",
        "1b25ca27-b6f6-e3bc-e039-84c90c734d9b",
        "SSSjdj",
        "Kernel-ProductInfo",
        "MobileUpdate",
        "04e14d47-d0ff-a6d5-4bcc-8c1f6f33c077",
        "GPD27-N7P3R-KB999-JWB7W-WB48F",
        "n levytila on lopussa.%0",
        "y6Vhj",
        "totta a telep",
        "Zadan",
        ".idata$5",
        "=;>M>g>",
        "6L7|7",
        "Microsoft.Windows.101.X19-98874_8wekyb3d8bbwe",
        "Microsoft.Windows.17.X17-36803_8wekyb3d8bbwe",
        "ServerStandard",
        "serverenterprise",
        "WH2CN-CV37J-RBD3H-7V4HM-X4R72",
        ".?AV?$CZeroInit@VCDlpActionSummary@@$00@@",
        "SkipUpdate from Response [%s]",
        "RtlTranscodeLBlobs",
        "f4d98789-b51c-5819-6bfc-15bc92543ff2",
        "n se est",
        "210121231914Z0",
        "041604B0",
        "4\"6,6@6i6",
        "010_0x0",
        "nytelenek.%0",
        "ExpandEnvironmentStringsW",
        "ghV!q",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::CheckInitialized",
        "Microsoft.Windows.48.X20-29562_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X20-29637_8wekyb3d8bbwe",
        ": :1:A:R:b:s:",
        "STATUS_RESOURCE_NAME_NOT_FOUND",
        "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\LOWPART",
        "=*?L?^?",
        "NtQueryWnfStateData",
        "nskede migreringsvalg.%0",
        "8f4c5a4f-f1b7-3d12-2f5d-98b012b0463d",
        " ilmoitusta.%0",
        ";C;l;v;",
        "SetupCore: Registered COMPAT_INSTALLREQ action",
        "WimEnterCriticalSectionWithLazyInitialization",
        "si folyamat ",
        "0W0f0",
        "040904B0",
        "t$$9t$ vb",
        ";5<@<",
        "Microsoft Time-Stamp Service0",
        "t;j#j",
        "58016268-1238-7d9c-e53f-121f5c492f91",
        "Not-null check failed: MatchIndex",
        "1891eef8-6577-94d7-e6f4-eb3b2d464468",
        "DataMigration: Request for file migration of ActionList.xml has been queued",
        "FPN6M-RCWPF-BJHXY-8P3PY-VQXCY",
        "Microsoft.Windows.98.X20-29570_8wekyb3d8bbwe",
        "CDlpActionGetWebSetupUserInput::InitializeRoutine",
        "Microsoft.Windows.50.res-v4328_8wekyb3d8bbwe",
        "DiskSpaceInstallReq: Initializing Media Path:                   [%s]",
        "D$`SVW",
        "36890805-a2f3-a8fc-0a79-84735e5af4c4",
        "3$303P3\\3|3",
        "delegge meldingen for blokkering av avslutning.%0",
        "SetSecurityDescriptorDacl",
        "ProductKey: Validating Default Product Key for edition [%s].",
        ">[>f>m>",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::Prepare",
        "J7D66-7NJXV-KK87W-CMB3J-TQ8GQ",
        "objet Diagnostics n",
        "GNKHT-YC997-R8DK2-Q9X27-KHJVG",
        "9,:J:p:",
        ".data$r$brc",
        "7(747@7L7X7d7p7|7",
        "OpenEncryptedFileRawW",
        "Microsoft.Windows.161.res-v3917_8wekyb3d8bbwe",
        "FNJXY-3HTTH-28G88-GVX68-TQ8J8",
        "2FNQG-3WH7P-QJXMT-7YPJX-MHCF6",
        "%c:\\$Windows.~BT\\Sources",
        "Redmond1",
        ">a>|>",
        "Kompatibilitetsproblemene ble ikke l",
        "LockFileEx",
        "Microsoft.Windows.49.X20-29565_8wekyb3d8bbwe",
        "87dbda3e-0555-9550-6f80-dfaca1d8a2e3",
        "e692bcb2-3367-f19e-3978-f450869b48ce",
        "SSh @",
        "tt lisensvilk",
        "StringCchCopyN failed",
        "00240df7-8a9e-73ec-240f-c262cbcedb45",
        "0j0K0c0_0_0",
        "Microsoft.Windows.101.X20-29678_8wekyb3d8bbwe",
        "DataMigration: Queue preservation of recovery image into Target OS...",
        "Failed to mark system store. File: %ws Status: %x",
        "n, lisans s",
        "D6YXN-73KK9-RRTG9-B3J7V-8HWWD",
        "525b5u5",
        "Microsoft.Windows.101.X19-99538_8wekyb3d8bbwe",
        "Microsoft.Windows.50.X18-81306_8wekyb3d8bbwe",
        "Et forudinstallationsscript blev ikke udf",
        " Uudelleenyritys mahdollista.%0",
        "yi-001",
        "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8",
        "673JN-2Y3HJ-HW9TK-488TJ-Q69QT",
        "CloudN",
        "No hay paquetes para descargar.%0",
        ">%?,?f?",
        "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\WebSetup",
        "b5836f57-dc49-564a-4ba0-b44c8c85c93a",
        "Os problemas de compatibilidade de requisitos m",
        "Nyttolastfiler var skadade.%0",
        "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform\\Activation",
        "INVALID_DISPOSITION",
        "DecryptionKeyX64",
        "ExecuteDownloadReq: DiskSpaceReq polling starts...",
        "no lock available",
        "RtlDosPathNameToNtPathName_U",
        "57db946d-31e6-56b3-1e1a-c387ae15d1c1",
        "RBPVT-NJ672-TCHWV-Y798M-MY47P",
        "8$8<8H8`8l8",
        "MoSetupPlatform: NewSystem object suspended!",
        "embeddedindustrye",
        "MapViewOfFile",
        "HMN4B-X8XB6-HG4PD-MKMYY-K763Y",
        "FveDisableAuthenticationW",
        "9/9R9^9",
        "UncompressFile failed",
        "33CY4-NPKCC-V98JP-42G8W-VH636",
        "DUSetup: SqmOptin from Response [%ld]",
        "DUImage: Skipping Dynamic Update due to timeout getting FOD updates.",
        "DUImage: Initializing Drivers Path:              [%s]",
        "o de dispositivo para instalar a atualiza",
        "PidGenX",
        "Microsoft.Windows.122.X19-98697_8wekyb3d8bbwe",
        ">&>8>w>",
        "Microsoft.Windows.7.X17-66959_8wekyb3d8bbwe",
        "8f8e669d-6e3d-23b4-c736-330f3eb413dd",
        "ProductKey: Pid.txt file not found.",
        "Microsoft.Windows.184.res-v4256_8wekyb3d8bbwe",
        "MicrodomImplementation::CMicrodom::GetElementNodeSet",
        "f0daae41-acbe-ad6f-a81c-773375d8a240",
        "T9D8N-TWPHV-VB9TJ-DB2QW-F3KTP",
        "a6f215f4-faed-09f4-fb38-57d3b4b2379a",
        "A<Au%",
        " instalacji, poniewa",
        "a8b746ad-b405-6e69-f259-3a9aa03d0623",
        "G4K2H-KTNGB-6KBBF-2R8WX-MG92J",
        "Microsoft.Windows.99.X20-35489_8wekyb3d8bbwe",
        "professionalsinglelanguage",
        "o tem mais espa",
        "ProductKey: Looking for product key in Digital Marker.",
        "MoSetupPlatform: Identifier -> [%s]",
        "0A1_1",
        "2)272",
        "Microsoft.Windows.101.X20-39250_8wekyb3d8bbwe",
        "DataMigration: Initializing RecoveryOption:                     [%d]",
        "8E9j9q9|9",
        "Cihazda indirme i",
        "3T4FN-F8BBV-YHYY3-MY7DP-FYBJ2",
        "Microsoft.Windows.161.X21-43625_8wekyb3d8bbwe",
        "3558b48b-23c3-f7b5-cf56-b17f75f75152",
        "gn0$P",
        "4\\4z4",
        "Microsoft.Windows.101.X19-99553_8wekyb3d8bbwe",
        "T$DQQ",
        "dbc57aeb-38d5-19bf-c66f-08cc4e8b2176",
        "D$@j(P3",
        "HomePremiumN",
        "en-AE",
        "546Q6X6`6x6",
        "?0n0u0",
        "c5730a55-a0ff-9df6-0aca-f8d4f9512b2c",
        "4(4S4",
        "9000726a-46e5-f18d-9df1-3e59b53159a4",
        "779f9110-74e4-52dc-0d9b-c679b91e5567",
        "aefad424-3d54-4fb6-c458-27159a52cf01",
        "Den eksekverbare fil GatherOsState kunne ikke udf",
        "8\\9l9s9",
        "a74d8875-a73a-ad6d-d05e-4822cdd1c5df",
        "GetWebSetupUserInput: Error reporting telemetry for WebSetupInputDefaultArch: [0x%X]",
        "0$0,040<0H0h0p0x0",
        "CDlpActionSummary::IsPowerPluggedIn: Unknown power state. Assuming that system is not running on AC power.",
        "Det gick inte att hitta m",
        "FveGetStatus",
        "5I5f5~5",
        "CDlpActionDU::ExecuteDUSetup",
        "serverstandardeval",
        "Microsoft.Windows.100.X19-99452_8wekyb3d8bbwe",
        "StringFileInfo",
        "CP4KF-NG6TC-9K6QF-P6GTT-H8RBM",
        "c19e7ebe-5469-4882-47a1-69533375aeb4",
        "81fb75af-cebf-2dff-0824-d51242c7ea2b",
        "N0L0J",
        "0e31e335-4fca-fae1-9951-be6512ca6f63",
        "6fba12a6-3077-5301-cfde-f22f59f1e2a6",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::GetError",
        "6(616;6?6P6V6f6",
        "CDlpActionFinalize::ExecuteRoutine",
        "fcb2930b-2f09-d213-b633-5bb8971dc47e",
        "Microsoft.Windows.49.X19-98859_8wekyb3d8bbwe",
        "ncia de payload.%0",
        "aduje se restartov",
        "7&7}7",
        "bs-BA-Latn",
        "Microsoft.Windows.8.X21-83700_8wekyb3d8bbwe",
        "d9d76e9c-8df7-f303-0387-87c814d0d14c",
        "Microsoft.Windows.100.res-v3274_8wekyb3d8bbwe",
        "EtwEventWrite",
        " kompatibilit",
        "de915f5f-2a91-98e5-92c3-3f5e8d1147cd",
        ".?AV?$CUnknownSingletonImpl@VCMoOnlineStore@@VIMoOnlineStore@@@@",
        "Microsoft.Windows.119.X19-99606_8wekyb3d8bbwe",
        "::RtlIsLBlobValid(Blob)",
        "iostream stream error",
        "b8739611-196c-e9ac-80ed-b0e68a7483c4",
        "tirmeyi s",
        "f8a65f03-cfaf-3769-c20e-73a3d0691c68",
        "4%5T5",
        "Microsoft.Windows.161.X21-03400_8wekyb3d8bbwe",
        "6503bbff-b6b7-8fee-c881-502dcc08d577",
        "Microsoft.Windows.8.X21-83705_8wekyb3d8bbwe",
        "my s kompatibilitou pro stahov",
        "Microsoft.Windows.98.X20-24584_8wekyb3d8bbwe",
        "CDlpActionDataMigrate::MigrateKeyboardLayout",
        "Het systeem voldoet niet aan de schijfruimtevereisten voor het downloaden en uitpakken van media met meerdere architecturen.%0",
        "Microsoft.Windows.100.X19-99444_8wekyb3d8bbwe",
        "RDGBN-RMM3C-R66WW-J82GM-43KT3",
        " ei ole p",
        "MigChoice: Initializing Image Name:            [%s]",
        "es de automa",
        "Microsoft.Windows.98.X20-29574_8wekyb3d8bbwe",
        "t)j\\V",
        "bcd037f0-2143-0a95-7876-8929ab1eef00",
        "ImageDeploy: Initializing Use Storage Reserves:  [%d]",
        "b8246f08-d711-611e-7e4c-4bdc24d27743",
        "d3a6f691-5e05-7aac-f18e-5d13b9297422",
        "DataMigration: Initializing FlightData:          [%s]",
        "454p4",
        "BXCFX-GQGQ7-8XHPK-CCWHQ-6WPHR",
        "D42FN-YGMP6-92CFJ-6XDCJ-J8HY7",
        "::RtlXmlExtentToUtf8String( 0, &m_State.ParseState.RawTokenState, &Src, TempString.GetMutablePointer(), &cRequired)",
        "XQJXN-H6Y7K-6CJ2W-TJQ63-B99Y2",
        "o em disco suficiente para transfer",
        "AllocateReadChunk",
        "Microsoft.Windows.4.X21-03400_8wekyb3d8bbwe",
        "(Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::Stream) || (Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::BlobProvider) || (Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::Blob)",
        "5 50545L5P5h5x5",
        "cdb27332-3f94-28f0-5052-b2e45c19552c",
        "CDriverCallback::ValidateDriverPackage: Package is not a candidate for migration. {938EFDDC-D0F5-46E2-82B5-65F3F9683E31}",
        "MigChoice: After Migration Filter -> [%s]",
        "cej ilo",
        "DbgPrintEx",
        "Microsoft.Windows.125.X21-83255_8wekyb3d8bbwe",
        "L$t_^[3",
        "Meddelelsen om blokering af lukning kunne ikke oprettes eller destrueres.%0",
        "network_down",
        "File is not system store. File: %ws Status: %x",
        "ndaren har valt att avbryta f",
        "DebuggerOptions: Initializing Debugger Key:      [%s]",
        "0\\0~0",
        "vector<T> too long",
        "000L0v0",
        "Microsoft.Windows.122.X19-98838_8wekyb3d8bbwe",
        "dd2c7337-4554-3659-0cca-ed42f78b3202",
        "BiCreateBootEntry: Could not retrieve BCD Object application description. Status: %x",
        "5c2de669-7fe4-2a04-d6bb-92f55b04b996",
        "8(888<8L8P8`8d8|8",
        "939R9",
        "Microsoft.Windows.100.X19-99666_8wekyb3d8bbwe",
        "Microsoft.Windows.136.X21-98320_8wekyb3d8bbwe",
        "X6B8W-TN3XG-6F22Q-RQG6Q-BHCJK",
        "=L9o<",
        "c1b9a94b-6763-dfaf-9fe8-b11c3a6d59a9",
        "=0=4=L=\\=`=t=x=",
        "ff-Latn-SN",
        "45e0ccf8-18c7-061c-aa8a-7420cba82f8b",
        "count",
        "GetLocaleInfoW",
        "DataMigration: Not migrating file: [%s]",
        "f;F$u",
        "%hs: Failed to read 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber'. Error = %d",
        "Kan geen installatiekopie vinden voor dit systeem.%0",
        "=$=(=@=D=H=L=P=T=X=\\=p=t=x=|=",
        "Problemerne med diskplads i forbindelse med download blev ikke l",
        "InstallChannelFromSkulib",
        "4/5Y5",
        "fi-FI",
        "Microsoft.Windows.121.X19-98668_8wekyb3d8bbwe",
        "?H?d?",
        "t/h|s",
        "YN4MQ-MQR6P-QWT6F-9BGVP-V8RBQ",
        ":Q:[:",
        ".?AV?$CZeroInit@VCDlpActionPackageMigrate@@$00@@",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::Deserialize",
        "6\"6+6a6p6w6",
        "9JCN8-D6K64-2H7TY-XB3TW-DGP22",
        "No se encuentra el ejecutable de instalaci",
        "J9P3N-4PQF4-9XW8M-2HGTQ-FM47D",
        "Kunde inte hitta en installationsavbildning f",
        "4d8be97f-72d2-afc5-60f5-0d3cfae6097b",
        "CXmlCursor::CompareExtents",
        "Impossibile creare o eliminare il messaggio di blocco dell'arresto.%0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::CheckUserInterruptEx",
        "w h8$",
        "DUImage: Initializing payload ImageDU",
        "%PRO%",
        "DKDNW-TVC88-9TMY7-YT9PF-8B49Y",
        "8bcd2f4f-8b45-3e55-522d-c3875c18832e",
        "RtlAppendLUtf8StringToLUtf8String",
        "6 7B7",
        "cych miejsca na dysku potrzebnego do pobrania i rozpakowania no",
        "SetupDU",
        ";(;4;T;`;",
        "ProductKey: SelectImageIndex: Clearing saved SKULIB info because selected edition has changed.",
        "4BTVN-8469B-GG8H6-D7YWY-FGDGT",
        "ar-DZ",
        "En ov",
        "CDlpActionPackageMigrate::ResumeRoutine",
        "MoSetupPlatform: Preserve the existing recovery image if available.",
        "BCN6M-7KMX4-FDP6K-6BF4F-GX2F2",
        "WaitForThreadpoolTimerCallbacks",
        "bg-BG",
        "RtlLengthSecurityDescriptor",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::Initialize",
        "ibb-NG",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::CheckUserInterruptEx",
        "F83XK-9QND6-T3GC9-DX6PD-C372F",
        "NTSTATUS_FROM_WIN32(",
        "HZo6m|",
        "a82fbc79-7a7d-1342-dd2e-aa961cf2d291",
        "DataMigration: Failed to read WebSetup media location Hr=[0x%X].",
        "bb2e5d22-191c-294c-c00f-79aac3efd61a",
        "?I?^?",
        "Microsoft.Windows.7.X21-83724_8wekyb3d8bbwe",
        "Windows-Wiederherstellungsumgebung kann derzeit nicht gewartet werden.%0",
        "outil n",
        "memmove",
        "teni a le",
        "=0>F>\\>",
        "PNX2M-CCXYM-7XD4Q-Y64GX-BKMK7",
        "ProductsXmlFilePath",
        "1 1$1(1,101D1H1X1\\1l1p1",
        "DiskSpaceReq: skipping GDR packages...",
        "CDlpActionCompat::ExecuteRoutine",
        "P4N8K-HMWMH-TD94J-DCJFP-XTPHF",
        "<'<><K<V<d<k<r<y<",
        "Microsoft.Windows.98.X20-20965_8wekyb3d8bbwe",
        "un composant syst",
        "encoding",
        "0U1o1",
        "NtOpenKey",
        "2B3b3",
        "Failed to set boot options. Status: %x",
        "9,90949L9\\9`9x9",
        "e13d0c04-c9aa-1fff-730f-050bd71162a1",
        "Microsoft.Windows.172.res-v3862_8wekyb3d8bbwe",
        "rias arquiteturas.%0",
        "SVWj@3",
        "Finalize: Error setting diagnostic results: [0x%X]",
        "Microsoft.Windows.7.X21-83735_8wekyb3d8bbwe",
        "NVGV7-7T64T-XHYK8-G44V8-292MX",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::GetResultsRoutine",
        "c1c508de-cb97-15de-0c12-80a1dd2b1fce",
        "rtill",
        "0&0<0i0",
        "WKPKN-YBMB2-KVQ9F-H2XCW-9TPHJ",
        "ad363a15-61aa-cb4a-c7f3-30edaf1ac0c2",
        "inde kabul etmedi.%0",
        "Microsoft.Windows.48.X19-98858_8wekyb3d8bbwe",
        "DebuggerOptions: Initializing Debugger Type:     [Net]",
        "sszetev",
        "UnlockFileEx",
        "9@:O:X:]:g:",
        "NewContext.Allocate()",
        "Finalize: Error creating compat instance: [0x%X]",
        "SkipOCMigration",
        "8/8D8y8",
        "2%212C2K2u2}2",
        "CDlpActionDiskSpaceReq::CallTriggerStorageCleanup",
        "Microsoft.Windows.171.X21-24740_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X19-98821_8wekyb3d8bbwe",
        "L$(Qh",
        "Failed getting versionless keyform for: {0}",
        "4\"4.494W4n4",
        "CDlpActionCompat::GetResultsSysReq",
        "ExecuteInstallReq: Error reporting telemetry for bExtDriveUsed: [0x%X]",
        "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5",
        "ActionListPath",
        " /MediaArch %s",
        "Microsoft.Windows.7.X21-83745_8wekyb3d8bbwe",
        "Aucune offre correspondant aux crit",
        "rizze a csomag tartalm",
        "es-SV",
        "CDlpActionCompat::DeserializeFinalizeReqScan",
        "fr-CD",
        ">A>U>o>|>",
        "CDlpActionDataMigrate::MigrateLicenseState",
        ":X:q:",
        "YCT8J-N9JVK-V2KYK-CH7DX-RM48H",
        "0004080@0X0\\0d0|0",
        "3e1f71dc-b9ae-fd63-c3a2-e99682911015",
        "t$(VW",
        "Microsoft.Windows.98.X20-29590_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::InitializeRoutine",
        "deab2afa-33d0-db7a-ac5b-111af1ce1a2d",
        "4*505\\5{5",
        "BCryptCloseAlgorithmProvider",
        "CDlpActionProductKeyValidate::ExecuteRoutine",
        "CDlpActionDiskSpaceReq::ExecuteDownloadReq",
        "Bugcheck param 2",
        "j\\hps",
        "XMGYY-R8NRP-DV4CM-7QYP4-9W6BQ",
        "9f9m9",
        ".?AVCBcdUtils@@",
        "?\"?/?6?M?T?",
        "Microsoft.Windows.7.res-v4291_8wekyb3d8bbwe",
        "a3964773-6055-f435-0da5-fbfe4b816cfe",
        "4*515",
        "DataMigration: Initializing OfflineGather:                      [%s]",
        ".?AVIDlpRestartable@@",
        "6`7l8~8",
        "Microsoft.Windows.98.X20-44905_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X19-99514_8wekyb3d8bbwe",
        "Translated a DontSync entry with ID 0x%x",
        "9:9D9q9{9",
        "HN6JV-2PVDT-VHX2K-BVRMY-WHV3D",
        "BiExportStoreAlterationsToEfi failed %x",
        "46169a66-5cad-f39b-3ce4-83b2745b99d8",
        "Microsoft.Windows.49.X19-99522_8wekyb3d8bbwe",
        "quc-Latn",
        "feac0d25-1bde-48b4-0807-099197cbe1bd",
        "::RtlIsLBlobValid(Source)",
        "FreeLibrary",
        "memmove_s",
        "`.data",
        "DUImage: Downloaded %d LangPack updates.",
        "Die Speicherplatzanforderungen zum Herunterladen und Entpacken von Medien f",
        "Target OS: UpgradeFlags = [0x%X]",
        "Microsoft.Windows.7.X21-83737_8wekyb3d8bbwe",
        "882caa2e-f7a8-c9e1-afff-25306ec3e591",
        "8I8d8|8",
        "DM2KN-J8JPJ-6VD2F-QPB9D-PYT4R",
        "8PNQX-RF873-CXRPY-8J42B-XBWWC",
        "Het systeem voldoet niet aan de compatibiliteitsscan voor het installeren van de update.%0",
        "7N977-4C3F2-KRQYD-J3T8J-PKCH3",
        "N09{4u",
        "6I6`6",
        "1V1l1",
        "XN9J7-JRDBW-H38BQ-8CFVW-WB6KQ",
        "nimos de compatibilidade n",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::ExecuteResponse",
        "DBGJD-HN3WP-V9VQC-4WXC7-B7W4K",
        "Microsoft.Windows.99.X19-99562_8wekyb3d8bbwe",
        "InstallPackage",
        " per l'installazione dell'aggiornamento.%0",
        "b1399e8c-1de4-2f44-8b18-5fd31ec76009",
        "?'?/?l?",
        "Microsoft.Windows.27.X20-00860_8wekyb3d8bbwe",
        "FHN6M-B7FTV-DGC97-K7F98-82QD6",
        "24c2d982-7385-9e41-a30d-09c297d0a6bf",
        ">=>G>t>~>",
        "!E\\H4",
        "NPW4D-8DK99-VT9WM-9K2CM-8FG36",
        "?D?N?x?",
        "N9QCR-YMVJ3-VY847-8XPWQ-977Y8",
        "76ca07c4-730c-df4d-7dc9-548271d90c76",
        "vel localizar uma imagem de instala",
        "O relat",
        "GHH37-F4N9K-3MHBJ-MQRRW-D9MQG",
        "Installationsprocessen pausades.%0",
        "CDlpActionPackageMigrate::MigratePackages",
        ".?AV?$CZeroInit@VCDlpActionImageDeploy@@$00@@",
        "bcrypt.dll",
        "7J8Z8",
        "si lemezk",
        "PreFinalize: Automation error: [0x%X]",
        " architetture. %0",
        "Denne versjonen av verkt",
        "050?0F0P0b0p0w0",
        ">->B>I>_>f>z>",
        "RtlIsLBlobValid(BinaryData)",
        "757p7",
        "uw!\\$",
        "Activation: Suspend was requested",
        "eafabc82-86a9-014d-71df-657935ee3e02",
        "PD9BN-KTQRG-2GH6T-3BT96-KTRBM",
        ">+>6>c>m>",
        "Betriebssystem Microsoft",
        "ImageExit: Initializing Scenario:    [%d]",
        "x/fzz",
        "itli uyumluluk taramas",
        "sr-latn-cs",
        "The install diskspace issues were not resolved within the required time limit.%0",
        "vg0\\PbkU0",
        "5O6y6",
        "ulIndex < m_Header->ulTotalNodeCount",
        ":2:@:H:",
        "Nyttelastfiler er skadet.%0",
        "Microsoft.Windows.4.X19-99672_8wekyb3d8bbwe",
        "Het installatieproces is onverwacht be",
        "6E7i7n7",
        "ra redan beg",
        "Log: Failed To Get Msg From ID",
        "kompatibilit",
        "210303183039Z0p1",
        "GNY6G-JQPBM-HJDY7-B4KDP-YKMK4",
        "1>1E1V1]1u1",
        "d453110b-f9fc-726a-59d8-8d419922d03b",
        ";#<;<a<p<",
        "eb8a1537-cb9a-6d2b-9d64-c2f968cd694b",
        ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskSpaceAction@@@@@@@@",
        "324i4",
        "Ett fel uppstod och resultatv",
        "pnych etapach instalacji napotkano b",
        "24e4f85b-1450-3f60-fe19-0a91bdd1cada",
        "Microsoft.Windows.27.X19-98762_8wekyb3d8bbwe",
        "network unreachable",
        "GDRDownloadPath",
        "CheckDiskSpace: Found enough free disk space on [%c] drive",
        "29NVR-6CTYD-4CJ9D-XYTG6-8T3H9",
        "The gated compatibility issues were not resolved within the required time limit.%0",
        "ImageDeploy: Initializing BitLocker Mode:        [Keep Active (Mandatory)]",
        "RegisterTraceGuidsW",
        "tre ex",
        "747^7s7",
        "ha-Latn-NG",
        "BiSpacesUpdatePhysicalDevicePath failed %x",
        "ProductKey: Getting all image info objects.",
        ":2:z:",
        "ImageExit: Initializing Mode:        [%d]",
        "585e5x5",
        "2G7KY-NC34D-KV27M-T4GWM-R6YMB",
        "D$0PW",
        "ddee540f-bb6e-2693-767a-570737119beb",
        "PRO_KN",
        "ReadDirEntry",
        " elfogadja a licencszerz",
        "lemi bulundu.%0",
        "Microsoft.Windows.172.X21-24716_8wekyb3d8bbwe",
        "XkZu=",
        "Exception (code 0x%08X: %s) occurred at 0x%p in %s (+%p).  Minidump attached (%d bytes) to diagerr.xml and %s.",
        "3e8f8257-6dba-ff2a-baf4-13ddd94ffd8d",
        "ilo spustit nebo vr",
        "4;5N5",
        "Microsoft.Windows.27.X19-98752_8wekyb3d8bbwe",
        "Platforma instalacyjna napotka",
        "849;9_9i9q9~9",
        "CERT_E_REVOKED",
        "rityksen alkuvaiheissa ilmeni ACCESSDENIED-virhe. ",
        " je mo",
        "Kompatibilitetsrapporten kan ikke vises p",
        "Serversvar er ugyldigt.%0",
        "CDlpActionFinalize::GetCorrelationVector",
        "r die Wiederherstellung von Windows nicht erf",
        "u8Wh ",
        "DiskPartition: Failed to get drive letter from automation",
        "65377e6a-4516-bbca-4e93-014ae23bd8fa",
        "576p6",
        ":%:G:_:n:",
        ">9?W?z?",
        " s neplatn",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::GetProgress",
        "CDlpActionPackageMigrateFactory::CreateInstanceRoutine",
        "Microsoft.Windows.161.X21-43633_8wekyb3d8bbwe",
        " obrazu instalacyjnego tego systemu.%0",
        "$Microsoft Ireland Operations Limited1&0$",
        "1%2,2?2F2\\2",
        "Microsoft.Windows.188.X21-99376_8wekyb3d8bbwe",
        "677t7",
        "1a1aa123-c15c-5111-d443-bc9613e219dd",
        "a35474e6-1706-a2dc-6ae5-ad803f3f7f7f",
        "FHDPX-JNVDW-FF3RD-HPDKC-MP2TB",
        "< <(<0<8<@<L<l<x<",
        "o em disco.%0",
        "9b04dd81-8acb-265c-0164-bdc01d05e35b",
        "InternalName",
        "Microsoft.Windows.122.X19-98836_8wekyb3d8bbwe",
        "r kompatibilitet l",
        "2b2i2",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::DeserializeRoutine",
        "WATSON_STACK_TEXT",
        "Microsoft.Windows.4.X19-99674_8wekyb3d8bbwe",
        " cancelar porque el dispositivo no tiene suficiente espacio en disco para instalar.%0",
        "Kompatiblitetsproblemen f",
        "PackageMigration: Migrating GDR packages from [%s] into Target OS...",
        "2:3R3",
        "<K=o=",
        "758I8P8p8",
        "Microsoft.Windows.100.X19-99665_8wekyb3d8bbwe",
        "KeyName",
        "Et fejlscript blev ikke udf",
        "2$3W3p3",
        "enterpriseseval",
        "ProductKey: Key from SkuLib is valid and the Machine is Active.",
        " poss",
        "041^1",
        "GetVolumePathNameW",
        "73KBB-9NP4R-YC23T-6DFRV-6XXR4",
        "<#=d=|=",
        "d7ae2f89-4cb4-2e37-7a09-1d5075aa1448",
        "PSWVVh",
        "yor veya yok edilemiyor.%0",
        "9L:V:",
        "No se pudo ejecutar un script de confirmaci",
        " Microsoft Corporation. Tutti i diritti riservati.",
        "me est introuvable.%0",
        "N9YYM-82XGT-FQG6K-2V76V-VT99C",
        " la configuration minimale requise pour l'installation de la mise ",
        "FveGetSecureBootBindingState",
        "1%1M1Z1g1",
        "LangPacksDownloadPath",
        "JGVJ6-F2NQQ-KT6VT-684KV-CYWV3",
        "df413a22-aa13-f241-135f-85db56eb3b95",
        "Software\\Microsoft\\SQMClient\\Windows\\CommonDatapoints",
        " en el l",
        "The system store is not already loaded",
        "6fdbef24-4461-dbd9-6595-9a8546d74be6",
        "NewChild.Allocate()",
        "WindowsPE",
        "090F0V0u0",
        "Microsoft.Windows.8.X21-98315_8wekyb3d8bbwe",
        "RPJNW-QC3PB-4PP3H-2PGTF-4X8WP",
        "8H8N8",
        "%s: Progress exceeds total -> [0x%I64X / 0x%I64X]",
        "Translation",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionFinalizeFactory,class CDlpActionFinalize>::GetActionId",
        " Nytt fors",
        "nl-BE",
        "ve-ZA",
        "OYu-Nn0 ",
        "tr-TR",
        "WimBufferToHexString",
        "ivitysagenttiasiakkaan odottamaton versio.%0",
        "dcdc3493-a32e-2514-865a-9916dc32ffc8",
        "CDlpActionProductKeyValidate::PopulateImageInfoSet",
        "CloserElement = this->AllocateStreamObject()",
        "mr-IN",
        "05ce649a-eed1-d14e-aa01-4045f35ca54d",
        "IMAGE\\WINDOWS\\INSTALLATIONTYPE",
        "258c688f-d982-4403-1688-eeda394ecebc",
        "memcpy",
        "her spezifizierter Fehler erkannt.%0",
        "7#7d7|7",
        "YQTNY-6Y3D3-HYCF9-BB99B-43K2J",
        "2K98T-2NYMC-FT4VT-XH8GX-FRJYQ",
        "CDlpResponseAutomation::InitializeRoutineMigChoice",
        "Compatibility: Resolve successfully completed.",
        "Microsoft.Windows.122.X19-99473_8wekyb3d8bbwe",
        "uje po",
        "CDriverCallback::ValidateDriverPackage: Package found under reflection path - Returning DRV_ANSWER_REFLECT. {89E750E4-77A4-44F2-A450-368978DA08CB}",
        "MoSetupPlatform: Suspending SetupAutomation object to [%s]...",
        "ERROR_SXS_ASSEMBLY_MISSING",
        "ndsinstallasjonsskript kan ikke kj",
        "Microsoft.Windows.8.X21-83185_8wekyb3d8bbwe",
        "MediaPath",
        "Windows::uDom::Rtl::RtlMicrodomUpdateSetNodeName",
        "78ad7fd4-aaaf-e2ff-a457-ca636a7c842f",
        "nika.%0",
        ".?AV?$CZeroInit@VCDlpActionCompatFactory@@$00@@",
        " http://www.microsoft.com/windows0",
        "Recovery: Image Edition ID:      [%s]",
        "Microsoft.Windows.125.X21-83250_8wekyb3d8bbwe",
        "serverstorageworkgroup",
        "ulValue < MultFactor",
        "6H6i6x6",
        "BootFinalize: Initializing Target:                     [%c]",
        "Microsoft.Windows.98.X20-15876_8wekyb3d8bbwe",
        "zane w ramach wymaganego limitu czasu.%0",
        "ZwSetValueKey",
        "1#212?2",
        "3f4b5d66-2e78-a473-c74c-7675e98b940d",
        "EDU_N",
        "(unknown enumerant ",
        "9N9T9",
        "swprintf_s",
        "teruppta den tidigare p",
        "Installationsprocessen startades med ett ok",
        "9)9h9",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::UpdateState",
        "onecore\\base\\ntsetup\\lib\\narratorutil\\src\\narratorutil.cpp",
        "SetupLog",
        "4752babe-6396-cd46-bf0b-c2af7bf4aa24",
        "DB4MM-NPT6H-W6Q63-M73Y7-CYVCJ",
        "o em disco suficiente para instala",
        "Un script engag",
        "7916045c-88ba-0f57-e9b2-d9fdc07ea88b",
        "r die Installation aufweist.%0",
        "SetupCore: Registered IMAGE_EXIT action",
        ":I:v:",
        "bs-Cyrl",
        "MicrodomImplementation::CMicrodom::Initialize",
        "FLT_UNDERFLOW",
        "K62NP-KT2WK-6HX2X-B8JJR-PPQPM",
        "Microsoft.Windows.17.X17-66964_8wekyb3d8bbwe",
        "0f0D0~0[0",
        "f692d8a4-a7a5-fd7a-b326-3cb59aef80b0",
        "NPYGM-T4JGM-RBDJC-KVRBM-F9CHV",
        "No se cre",
        ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskPartitionGetBKeyAction@@@@@@",
        "dNarratorUIClass",
        "51c9b746-232c-af4f-314e-8894846a1247",
        "TempNodes.Allocate(UpperIndex - TheElement.Reserved)",
        "CheckDiskSpace: Drive [%c] is BitLocker enabled",
        "707N7`7n7",
        "@*97u",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNSNode",
        "ProductKey",
        "CDlpActionFinalize::ArmReserveManagerForReboot",
        "57fd41a9-e9fd-815d-6687-17b5f8ff18f9",
        "CHCDD-NBFKY-M8DJM-MHYBQ-T6RFF",
        " wersj",
        "CElementModification::ChangeTextValue",
        "Y8D8N-6XHGY-D3V7X-8648J-78RB7",
        "Microsoft.Windows.4.X19-99696_8wekyb3d8bbwe",
        "ProfessionalEducationN",
        "Microsoft.Windows.164.X21-06154_8wekyb3d8bbwe",
        "9!:>:",
        "Der er ingen pakker, som skal downloades.%0",
        "6bb17b1a-4cf8-0e82-84d9-f3bb8cc30502",
        "8 8(80888@8H8P8X8`8h8p8x8",
        "MG29Q-WWWH3-QCXCD-KT7RQ-HQQFC",
        "cf8c5921-2a2a-29a5-6f28-c3e5c4d1f565",
        ">#>)>:>@>",
        "68NBD-KD2XT-PGR79-BM8QY-TXXRC",
        "Microsoft.Windows.98.X20-29583_8wekyb3d8bbwe",
        "o em disco para transfer",
        "CDriverCallback::ValidateDriverPackage: Not migrating blocked package. {5E08BE46-2307-4752-9A54-7C2761642DFD}",
        "718N8`8j8",
        "B7JR7-N48R8-6JB9G-942YX-T83XW",
        "ProfessionalN",
        "78e6608c-8f7e-f704-fb28-1c205d165358",
        "DUCategoriesCmdlineFlag",
        "tti eszk",
        "ny kivonata nem tal",
        "6dd35df5-561e-9b83-c3d5-58c752a9a5be",
        " trouv",
        "b3267dc8-96db-fbbb-752a-737ef02856d1",
        "GetModuleHandleExW",
        "4HGWB-MNV2D-YV8WV-RX83M-R62JM",
        "si parancsprogram v",
        "zh-CHT",
        ":*;0;R;[;w;};",
        "41d042f0-0e3e-409a-ab6e-d22de88f5cfd",
        "Installasjonen kan ikke fortsette fordi fullf",
        "1.2A2p2w2",
        "D$LSP",
        "CDlpActionPackageMigrate::InitializeRoutine",
        "0C0r0",
        "AllowPartitionChanges",
        "Converting to NT filename failed",
        "a0411bca-cf7a-4d90-a21f-2bd31ee69506",
        "WTHelperProvDataFromStateData",
        "7c442192-0bfe-577b-5bcd-2b33d3d31187",
        "Microsoft.Windows.145.X21-83699_8wekyb3d8bbwe",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionRecoveryFactory,class CDlpActionRecovery>::GetActionId",
        "te-IN",
        "39ed6ee1-790c-c15b-6893-58734331c64f",
        "Microsoft.Windows.121.X20-29640_8wekyb3d8bbwe",
        "ConX::Setup::Common::COSInfoHelper::GetHostSkuInfo: GetProductInfo failed, Err=%d",
        "98caebba-369f-5044-a921-1f692884de70",
        "serverdatacenteracor",
        "L$\\_^[3",
        "TWTQC-WN4RR-FRFP9-QJ9R9-MG9RM",
        "=+=;=C=J=Q=i=",
        "5efbf535-2402-b1cb-e2f2-3687350e548d",
        ">6>`>",
        "baff6551-7fa0-4071-c7ec-f00ac7cd1bd2",
        "SWj43",
        "The diagnostics object was not created. Events cannot be reported.%0",
        "yo-NG",
        "CDlpActionDiskPartition::DeserializeRoutine",
        "Not-null check failed: Params",
        "ar-KW",
        "4XKB3-CN8G6-M9HBH-R3GYB-39MMG",
        "nyt asentamista varten.%0",
        "Microsoft.Windows.98.X19-99597_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::CheckUserInterruptEx",
        "PackagePath",
        "YVWGF-BXNMC-HTQYQ-CPQ99-66QFC",
        "O utilizador optou por cancelar o an",
        "Der blev fundet en uventet version af Update Agent-klienten.%0",
        "F8PSj",
        "=*>c>",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionDebuggerOptionsFactory@@VCDlpActionDebuggerOptions@@@@",
        "Microsoft.Windows.100.X20-29720_8wekyb3d8bbwe",
        "8JKQN-CYCPT-PW8R8-CTWHY-VQYMF",
        "n de migraci",
        "1baed060-4b63-d54c-7d2c-83c3614dda03",
        "9a<>?",
        "a3a5edb3-03f0-c2d5-4a36-1aeb9e644908",
        "GetSupportedDriveLetters: Drive [%c] bIsReadOnlyDrive = [%s]",
        "DiskSpace: Desired Post upgrade free space: [%llu] MB",
        "5<5I5a5",
        "Microsoft.Windows.4.X19-99676_8wekyb3d8bbwe",
        "Synchronizing store with firmware",
        "wcschr",
        "t taramas",
        "DUImage: Skipping Dynamic Update due to timeout getting LangPack updates.",
        "OpenSemaphoreW",
        "Microsoft.Windows.49.X20-29564_8wekyb3d8bbwe",
        "Installationsprocessen blev ikke fuldf",
        " laste ned og pakke ut multiarkitekturmedier.%0",
        "Microsoft.Windows.99.X20-23530_8wekyb3d8bbwe",
        "6c8d3dcb-ce05-587e-62bf-1010c8a86714",
        "6M6{6",
        " z serwera jest niepoprawnie sformu",
        "DUOptIn",
        "Basebrd",
        "Finalize: Remapping internal cancellation request [0x%X] -> [0x%X]",
        "9s v5",
        "EULA[*]",
        " il dispositivo non dispone di spazio su disco sufficiente per l'installazione.%0",
        "ProductKey: Error reporting telemetry for GatherOSState exit code: [0x%X]",
        "8PYNV-8RJ8R-7K93C-RGPJX-RM7WT",
        "32275875-e43d-d18a-a7ed-172934c1934a",
        "N0R&{",
        "ProductKey: No SkuLib Upgrade edition available.",
        "Microsoft.Windows.22.X17-53885_8wekyb3d8bbwe",
        "Wj(Q3",
        "FreeSid",
        "3*313",
        "vel encontrar uma letra de unidade de destino. %0",
        "Proces instalacji nie zosta",
        "SaveOffset failed",
        "SetupCore: Registered PRE_FINALIZE action",
        "Microsoft.Windows.121.X20-29612_8wekyb3d8bbwe",
        "CDlpActionCompat::RescanAsync",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetNamedItemNs",
        "T<hW0~0[0",
        "f352046f-fccc-39ca-b09e-d4c9ff797618",
        "TRCKN-QV3YJ-HT7RW-JVQHD-627BG",
        "329b2bec-691c-298f-6f3e-1fc250d2d089",
        "Microsoft.Windows.98.X20-15867_8wekyb3d8bbwe",
        "rzt.%0",
        "3Y7R6-NFMM6-WW38M-DQJ2Y-KD3KX",
        "De gebruiker is niet akkoord gegaan met de licentievoorwaarden. %0",
        "t nicht gen",
        "AllocChunkInfo",
        "o pode ser exibido porque est",
        "ste acceptera licensavtalet i installationsprocessen.%0",
        "32132d40-37ff-40e9-5fae-c3757dc306e1",
        "Brukeren har ikke godtatt lisensavtalen for sluttbrukere innen tidsfristen.%0",
        " skript se nepoda",
        "ActionListSafeOSPaths",
        "GetWebSetupUserInput: Execute: PreSelected Arch is = [%s].",
        "tEj<VW",
        "DownloadFileHashX64",
        "T8RCT-KJNR2-WGPR4-HC3JX-66H7K",
        "Microsoft.Windows.48.X19-99502_8wekyb3d8bbwe",
        "http://www.w3.org/2000/09/xmldsig#",
        "\\System Volume Information\\FVE.{e40ad34d-dae9-4bc7-95bd-b16218c10f72}.X",
        "De problemen met de schijfruimte voor de download zijn niet opgelost binnen de vereiste tijdslimiet.%0",
        "MoSetupPlatform: Asking ReAgent if we should use the new image...",
        "onecore\\private\\base\\inc\\BlockLookupTable.h",
        "64ee7b27-c07a-af7a-3930-82ec9eccd324",
        "Microsoft.Windows.98.X19-98881_8wekyb3d8bbwe",
        "UCS-2",
        "cch <= (((((SIZE_T)~((SIZE_T)0)) - (((SIZE_T)~((SIZE_T)0)) % sizeof(WCHAR))) / sizeof(WCHAR)) - 1)",
        "Microsoft.Windows.99.X19-99558_8wekyb3d8bbwe",
        ">9>F>V>u>",
        "[SetupConfig]",
        "na obs",
        "=9>g>",
        "RNVXQ-7KVPJ-HG3HW-FXB68-D9G73",
        "Microsoft.Windows.99.res-v3264_8wekyb3d8bbwe",
        "Microsoft.Windows.4.X19-98707_8wekyb3d8bbwe",
        "Microsoft.Windows.164.res-v3793_8wekyb3d8bbwe",
        "BQQ76-BD8XB-JTPK4-YC93K-JMJYX",
        "21282?2F2M2",
        "16d7c127-3e28-ff41-f786-d0068acfc9e5",
        "Microsoft.Windows.48.X20-32146_8wekyb3d8bbwe",
        "8e4d0d87-b781-6b32-c5d5-c6a9c7eb893b",
        "Compatibility: Calling Resolve(SETUP_DISMISS_ALL_RESOLVE_STRING)",
        "Microsoft.Windows.98.X20-24580_8wekyb3d8bbwe",
        "Microsoft.Windows.161.X21-43631_8wekyb3d8bbwe",
        "Microsoft.Windows.145.X21-83753_8wekyb3d8bbwe",
        "9\";?;J;t;",
        "8L8y8",
        "665f6f21-1692-5d08-17e4-934e0c638268",
        "5&5-5O5V5x5",
        "PRWQJ-K4NGT-8H2TM-PJXJ4-BY7B6",
        "RegQueryValueExW",
        "Microsoft.Windows.162.X21-04954_8wekyb3d8bbwe",
        " holde avinstalleringsalternativet aktivt.%0",
        "2L3b3",
        "ky-KG",
        " il sistema non ha superato l'analisi della compatibilit",
        "g akt",
        "Finalize: Delaying telemetry upload until exit action.",
        "Microsoft.Windows.171.X21-24742_8wekyb3d8bbwe",
        "o encerrado inesperadamente.%0",
        "7$7,787@7H7P7X7`7h7p7x7",
        "=.=A=b=|=",
        "Microsoft.Windows.4.X19-99705_8wekyb3d8bbwe",
        "6)7b7 8C8_8w8",
        "g0M0~0[0",
        "SystemPartition",
        "Installasjonsplattformen har funnet en uspesifisert feil.%0",
        "CompatFinalizeReq: Initializing Image Index:           [%d]",
        "File[*]\\Architecture_Loc",
        "dc43bdc4-5263-64ab-f814-51be4c28ed51",
        "%hu.%hu.%hu.%hu",
        "Microsoft.Windows.48.X20-35544_8wekyb3d8bbwe",
        "a9bddef1-4a6b-b1e6-a022-f52b70e9d75e",
        "Microsoft.Windows.50.res-v4335_8wekyb3d8bbwe",
        "GetProcessHeap",
        "HBY4H-RNXB8-Y2YTR-443VB-MY6F8",
        "EventProviderEnabled",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::Initialize",
        "46BNG-GP74X-PT69H-MVWD3-7T9TG",
        "LoadLibraryExW",
        "4A4\\4",
        "Microsoft.Windows.7.X21-83683_8wekyb3d8bbwe",
        "090T0o0",
        "ProcessorNameString",
        "RtlInitializeGrowingList( this, sizeof(TStoredObject), m_ulElementsPerChunk, (PVOID)m_InternalBuffer, sizeof(m_InternalBuffer), Allocator )",
        "K8ND4-KBPFY-3QCDH-2MQQB-2PQX7",
        "WWhl*",
        "3X4f4|4",
        "me.%0",
        "d4081056-a1b9-6ed6-1288-b7f86067ea4c",
        "grehajthat",
        "Brugeren har valgt at annullere, fordi systemet ikke opfylder minimumskravene til genoprettelse af Windows.%0",
        "CDlpActionDiskSpaceReq::DeserializeRoutine",
        "07cba33f-13bd-2d4d-e600-190199c378da",
        " puuttuu.%0",
        "InitializeRoutine: UNKNOWN",
        "CDlpActionRecoveryFactory::CreateInstanceRoutine",
        "ZwQueryInformationProcess",
        "SetEndOfFile",
        "CompatFinalizeReq: Initializing SPMajor Version:       [%d]",
        "DataMigration: Not requesting file migration.",
        "00e232a4-9952-b228-e45b-8af3b908e183",
        "Microsoft.Windows.8.X17-66951_8wekyb3d8bbwe",
        ">%>d>k>",
        "Brugeren har valgt at annullere, da enheden ikke har tilstr",
        ";&;-;6;I;P;Y;~;",
        "[19H1]",
        "DataMigration: Initializing Target:                             [%c]",
        "ProgressCurrent",
        "GXN9C-9G2DB-C2H6F-CG4QY-39MMP",
        "9^<t\"",
        "Q2GQD-G3N76-KWQMV-KFQRQ-QRR7T",
        "7f7b0d7e-a87b-9a3b-8a2e-8d6558ba30b9",
        "FeatureId",
        "Microsoft.Windows.100.X20-35503_8wekyb3d8bbwe",
        "RequiredExtDriveFreeDiskSpace",
        "7057fd3d-b494-422e-e271-6778398e2e83",
        "9FNXQ-YVWD9-GPQB4-XJ3TC-GQ7X6",
        "tottuk.%0",
        "ASSERT: %hs",
        "RegSetValueExW",
        "PPSWS",
        "FveIsRecoveryPasswordValidW",
        "MoSetupPlatform: Setup Platform object suspended!",
        "Q8R8C-T2W6H-7MGPB-4CQ9R-KR36H",
        "7502e687-d19a-a022-1253-af2e7c754580",
        "KBTN3-KHBDD-K2XBW-4FYQD-KKXRJ",
        " gerekir.%0",
        "Se detect",
        "MicrodomImplementation::CStringpoolCache::AttachToStringPool",
        ":-;;;M;T;f;p;y;",
        "CDlpActionImageDeploy::DeserializeRoutine",
        "1ba2853d-3c34-2c6a-86f3-4afee6a8fdb5",
        "The install cannot continue because a required task is missing.%0",
        ";+;S;n;",
        "CDlpResponseAutomation::GetResultsRoutineSelectImage",
        "Microsoft.Windows.161.X21-43626_8wekyb3d8bbwe",
        "e1ca4fb0-b921-017b-7722-65091c1acc86",
        "Failed to delete boot entry 0x%x. Status: %x",
        "Egy el",
        "Microsoft.Windows.162.X21-43655_8wekyb3d8bbwe",
        "Microsoft.Windows.171.res-v3858_8wekyb3d8bbwe",
        "\\ProgramData\\Microsoft\\Windows\\ClipSVC\\GenuineTicket\\GenuineTicket.xml",
        "Microsoft.Windows.8.X18-81285_8wekyb3d8bbwe",
        "DownloadUrlX86",
        "w(hX%",
        "868B8M8",
        "CMicrodomXmlWalker::XmlError",
        "MediaBasedUpgrade",
        "0f0D0~0Y0",
        "Et script til gennemf",
        "66206456-5b9c-4e01-6b9d-803dee7c6406",
        "u|9\\$",
        "0b4564c6-4c0d-7c23-c200-0d858ef31216",
        "Proces instalace byl spu",
        "f57cb12f-37b6-1228-b218-8ceccd850f28",
        "Os problemas de espa",
        "CheckDiskSpace: Error reporting telemetry for DISKSPACE_DATAID_FU_RESERVE_TOTAL_SPACE: [0x%X]",
        "lise e n",
        "6,646<6D6L6T6\\6d6l6x6",
        "ar-SA",
        "CDlpActionImageDeploy::InitializeRoutine",
        ".?AV?$CUnknownImpl@VIDiskPartitionGetBKeyAction@@@@",
        "4:5g5",
        "5 5$5(5,5054585L5P5T5l5|5",
        "Microsoft.Windows.121.X19-99468_8wekyb3d8bbwe",
        "WVhp&",
        "97t?j",
        "8+9C9",
        "DUSetup: Error on downloading SetupDU Payload: [0x%X]",
        "n no puede continuar porque el hash de la instancia no coincide.%0",
        "\"Microsoft Window",
        "N2M44-T82CF-D2BBR-R2TYB-39PCK",
        "Microsoft.Windows.7.X18-81319_8wekyb3d8bbwe",
        "?)?G?",
        "Suoritettavaa asennustiedostoa ei l",
        "7#7,737B7X7h7o7",
        "22f53ddb-c700-4a3d-ed28-d5cddb3c50ea",
        " instalacji aktualizacji.%0",
        " dzia",
        "%s.%d.%d.%d",
        "OnDemandRetry",
        "4(4T4u4",
        "9MNGH-VMTTV-X7XMB-26JPR-BY7B8",
        "WBNFF-YWRVT-HCKD3-GXV3G-VCG4H",
        "RestoreFileData",
        "L'utilisateur a choisi d'abandonner l'installation pour conserver l'option de d",
        "135c1148-1a43-e402-aa03-25cf7b260e6b",
        "69b90f27-654b-cca0-7ebc-df6e19b792b5",
        "7\\8v9",
        "9;9F9y9",
        "05d1209e-8e1b-533c-e89c-d6d8eca364e9",
        "ConX::Setup::Common::COSInfoHelper::GetCurrentSystemBranchName Could not open ImageHlep DLL:  Err=%d",
        "\\??\\PhysicalDrive%lu",
        "6f64e6bc-86de-21d1-8d24-9e20f7421643",
        "na utworzy",
        "GetUserPreferredUILanguages",
        "NRTKY-9489Y-48WB6-QT6X6-Y98XR",
        "Kohdeaseman kirjainta ei l",
        "SINGLE_LANGUAGE",
        "MHNVF-QFCDJ-HBR7Y-RJ6TB-BBHYH",
        "Kan het blokbericht voor afsluiten niet maken of vernietigen.%0",
        "SetupDiGetDeviceInterfaceDetailW",
        "la se ",
        ">$>g>t>",
        "bsearch",
        "?*?2?B?X?a?m?u?",
        "FACILITY_HYPERVISOR",
        "cfb258a3-4d58-7a9e-2473-cff56225c762",
        "01XJTg0M0~0[0",
        "f29c3237-cd09-88eb-afa3-bc4d7c14c804",
        "argument out of domain",
        "98;l;",
        " a Friss",
        "V3VRY-WYNMD-PW8GJ-2XV4M-CWF9G",
        "QW889-26N3M-P2X9V-2RH7Y-YWT2B",
        "RtlDeleteResource",
        "6cfba5a0-7f9d-7bb9-03bd-99191cef43a3",
        "Microsoft.Windows.49.X19-99507_8wekyb3d8bbwe",
        "RtlSetDaclSecurityDescriptor",
        "Microsoft.Windows.162.X20-00861_8wekyb3d8bbwe",
        "ImageExit: Initializing SQM:         [%s]",
        "n. Comprueba el contenido del paquete.%0",
        "Microsoft.Windows.98.X19-99582_8wekyb3d8bbwe",
        "ADVAPI32.dll",
        "tg-Cyrl",
        "md3rQ@",
        "FTPKP-6DNGQ-47VWJ-R4X2W-Q699F",
        "bad file descriptor",
        "not enough memory",
        "dia multiarquitetura.%0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::UpdateState",
        "eni nedeniyle g",
        "Configurar A",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::SerializeRoutine",
        "llnings",
        "6&6R6_6f6",
        "9fbacd96-d8a6-e440-4bc9-87c8b2860337",
        "lemedi.%0",
        "NetPort",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::GetResults",
        "Microsoft.Windows.48.X19-98851_8wekyb3d8bbwe",
        "lo k chyb",
        ".?AV?$CZeroInit@VCDlpActionActivation@@$00@@",
        "?!?P?c?",
        "pa-Arab-PK",
        "Microsoft.Windows.48.X19-99715_8wekyb3d8bbwe",
        "lle ei l",
        "WARNING",
        "040504B0",
        "112R2e2",
        "Esiasennuksen komentosarjan suorittaminen ep",
        "\\$4YY",
        "Volume",
        "STATUS_SXS_IDENTITIES_DIFFERENT",
        "DebuggerOptions: Initializing Debugger Host IP:  [0x%X]",
        "sr-Latn-CS",
        "ERROR_SUCCESS_REBOOT_INITIATED",
        "De gebruiker heeft ervoor gekozen om te annuleren omdat het systeem niet voldoet aan de minimum vereisten voor het herstellen van Windows.%0",
        "ProductKeyHostOS",
        "TriggerStoragePolicies is not supported",
        "NHKY8-V4VGV-BT322-H2DBB-TXYWG",
        "(*m_State.ParseState.pfnCompareSpecialString)(&m_State.ParseState, Extent, &ss, pResult, 0)",
        ".?AVCDlpWimInfo@@",
        "0$0D0L0X0x0",
        "BootFinalize: Initializing Update and Shutdown:        [%s]",
        "?!?(?R?l?",
        "Activation: Something went wrong during Polling.",
        "0 0'0=0D0",
        "3L3W3",
        "RtlDuplicateLBlob",
        "CDlpActionFinalize::ResumeRoutine",
        "Microsoft.Windows.48.X19-98848_8wekyb3d8bbwe",
        "73DYK-MYXR4-DF43W-82VQ6-KR7CB",
        "m_StoredTable.Initialize()",
        "4c81231f-149d-3c69-dfef-db65727481d0",
        "Microsoft.Windows.27.X20-00859_8wekyb3d8bbwe",
        "PreSelectedLanguage",
        "25e89c3c-a750-7b58-97e7-e80682d8ce72",
        "Installasjonsprosessen krever at brukeren godtar lisensavtalen.%0",
        "TQN2F-TQWM4-DTPVH-D3FB7-CYVJ6",
        "TVDW8-7NPHX-GXY7F-X6T3H-G6PJR",
        "Microsoft.Windows.48.X19-99481_8wekyb3d8bbwe",
        ", proto",
        "10f6e94c-d449-60eb-800e-b3f314df1a71",
        "hu instalace nen",
        "Microsoft.Windows.162.X21-43648_8wekyb3d8bbwe",
        "Egy hibakezel",
        "PRh,%",
        "Microsoft.Windows.98.X19-99578_8wekyb3d8bbwe",
        "|d-Vk",
        "QQSVW3",
        "969@9X9",
        "f39d8e46-a1c4-ce10-36be-1021a4c0754e",
        "|$0u&",
        "69NHX-WQQ7G-QVBPG-4HPQP-8XDB7",
        "fc4ffa48-a219-f88f-ec15-ef961cbf5578",
        "MoSetupPlatform: SetupPlatform::INewSystem::Finalize returned: [0x%X]",
        "9(919H9O9]9",
        "Microsoft.Windows.98.X20-35494_8wekyb3d8bbwe",
        "8?8N8u8",
        ".?AVIDlpResponseFactory@@",
        "f618c4c4-b1ea-468a-516c-7e0e9915200c",
        "operation_in_progress",
        "Microsoft.Windows.139.X99-99999_8wekyb3d8bbwe",
        "33QT6-RCNYF-DXB4F-DGP7B-7MHX9",
        "DUImage: Searching for GDR updates...",
        "FNYQ6-7MJJH-MHBWT-HWTQG-8TYMH",
        ";D$$u",
        "t&f;E",
        "The system does not pass the diskspace requirements to download the payload.%0",
        "serverdatacenter",
        "YB}bk",
        "The minimum requirements compatibility issues were not resolved within the required time limit.%0",
        "cc59514a-ad7f-dc01-503d-8cf34e4e9f76",
        "bfe31205-f327-6433-949f-1df8c6ec6a8c",
        "G4J8V-NC892-P2HCW-GQF9M-WHVX6",
        "ta-LK",
        "DBN7V-4R3HT-7P6Y3-TBJDT-GMPM3",
        "316b3942-5097-7dc5-85c4-520c1bac5466",
        "=(=0=<=\\=h=",
        "RC4VN-4GQBW-WYPTV-3BD66-FVXR6",
        "Microsoft.Windows.122.X19-98688_8wekyb3d8bbwe",
        "ImageDU",
        "%wOtF",
        "Microsoft.Windows.146.X21-83741_8wekyb3d8bbwe",
        "0L0zv",
        "Activation",
        "c62e1eeb-ada4-ac0d-1c59-fc6d5a4b1980",
        "GetWebSetupUserInput: Execute: PreSelected Edition is = [%s].",
        "Microsoft.Windows.50.X18-81309_8wekyb3d8bbwe",
        "Microsoft\\Windows NT\\CurrentVersion",
        "pToRemove != 0",
        "Setup Core-acties",
        "in en d",
        " podpis.%0",
        "7NFK4-8GG72-XH3G6-XC7TF-KBV4W",
        "SourceBuild",
        "ActionListParser::ParseMediaPackage",
        "2a8c537b-e754-fa64-bbe3-4e8581fc414c",
        "2WPGN-4JH6M-BB4YK-TVF3F-7H7CK",
        "CDlpActionProductKeyValidate::ValidateEICfgFile",
        "041D04B0",
        "TargetUsbDrive",
        "s, mert hi",
        "RP2X2-C2NFW-RGFM7-VGWQW-VH8XH",
        "<H<x<",
        "L$(QP",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionProductKeyValidateFactory@@VCDlpActionProductKeyValidate@@@@",
        "WPVh(",
        ".?AUIDriverMigCallback@SetupPlatform@@",
        "DataMigration: Not requesting setupcomplete.cmd file migration.",
        "The installation process was terminated.%0",
        "6'787",
        "VYQRY-NBMXC-X4XMJ-W8QXF-GXYMQ",
        "Per continuare l'installazione, verr",
        "Microsoft.Windows.126.X21-83263_8wekyb3d8bbwe",
        "2N3^3",
        "ARCH_32",
        "999F9z9",
        "HG3NG-MWJ6W-XVT8D-Y9HD8-GVJV4",
        "Een preinstall-script kan niet worden uitgevoerd of heeft een fout geretourneerd.%0",
        "Q83WX-NV3J2-GVVHJ-HT9C4-Q9GTB",
        "CDlpActionDiskPartition::CancelRoutine",
        "TestId",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::Initialize",
        "CheckDiskSpace: Error reporting telemetry for DISKSPACE_DATAID_OSPARTITION_REQUIREDSPACE_NO_STORAGERESERVES: [0x%X]",
        "?%?Q?\\?",
        "KH86N-T2W2H-YTKVC-7QDHC-YKPJC",
        "MoSetupPlatform: ExecuteCurrentOperations was successful!",
        "DJBMD-4F9CD-YJ9Q4-NDHD2-6JF9H",
        "a2dfc2a6-9d22-1e71-70de-f7f28278d232",
        "Microsoft.Windows.95.X99-99999_8wekyb3d8bbwe",
        "Microsoft.Windows.164.X21-11809_8wekyb3d8bbwe",
        "ACCESSDENIED-feil oppstod i de f",
        "EDU_KN",
        "TheNode != TheNode.InvalidValue()",
        "QSWh$V",
        "Created boot entry 0x%x using cached variable",
        "b541c0b5-d28f-4ade-cb28-e560a4dc334b",
        "060?0M0T0f0~0",
        "?!?2?A?S?s?x?}?",
        "CompatFinalizeReq: Initializing Processor Architecture:[%d]",
        "ados.%0",
        "939f273b-a050-0ff3-2509-a2f0c210ae17",
        "XRC2X-2RN9M-F6BT9-V9BX7-R9FBX",
        "<$<N<Y<",
        "InitializeCriticalSectionAndSpinCount",
        "fdfda683-894d-afe6-c2ba-03db7a033f34",
        "eu-ES",
        "ee06dd01-6f57-fd00-736d-f22a434b2095",
        ">(>,>D>H>`>d>|>",
        "1'1O1",
        " el proceso de instalaci",
        "CWHF2-FNTDD-6FMTF-7K6HC-FX8XQ",
        "installation va ",
        "QGN8F-VCF82-DXQ6D-XCBBW-29XRV",
        ". Les ",
        "8HQ9M-QNCX9-FV4G2-88VDT-6FXGD",
        "illegal byte sequence",
        "161N1",
        "b571de05-2149-a31e-3a7e-411e8417a643",
        "r minimumskravene for ",
        "9K4Q3-XNV7V-QQFFR-DCXGT-H8RCC",
        "Microsoft.Windows.146.X21-83746_8wekyb3d8bbwe",
        "Target OS: Detected Source SPVersion = [%s]",
        "DiskSpaceDownloadReq: Initializing UseExtDrive:            [%s]",
        "6c0ac4b2-43ea-fc5a-adee-c9b8d495aef4",
        "CLIENT_KN",
        "?,?5?V?m?y?",
        "*ppObject = State->m_pAllocator->Allocate<InstallPackage>()",
        "Microsoft.Windows.121.X19-98671_8wekyb3d8bbwe",
        "67818069-a73c-d397-8934-f934e28ced7d",
        "gend Speicherplatz f",
        "5h5o5",
        "srendszer-vissza",
        "PackageMigration: Initializing FOD Path:            [%s]",
        "NW0~0W0_0",
        "j\\Xf;A",
        ".idata$3",
        "YMBMN-JM3KY-VVT26-9X2DJ-D9QD6",
        "0454df5d-b971-b6aa-0e24-6a96ec650ccd",
        "670152bd-b5d1-a0d9-d608-341b3b31f83d",
        "9-:4:G:N:a:h:",
        "CDlpActionProductKeyValidate::ValidateAndGetUpdatedDefaultProductKey",
        "N3M67-82C2B-64DVW-C7BP2-7CFDM",
        "9772215d-d6aa-6945-7a70-a01c0b75d563",
        "4 5@5l5",
        ".?AVCDlpActionSummary@@",
        ";E<x<",
        "DiskSpaceInstallReq: Initializing FOD Path:              [%s]",
        "n anterior. Se debe reiniciar el sistema.%0",
        "Asennusprosessi edellytt",
        "d572c7e4-3707-6778-935b-d862e38b47e8",
        "Et vellykket skript kan ikke kj",
        "SetupCore: Registered UPDATEMEDIA action",
        "no such process",
        "Failed to load action list:{0}",
        "Value",
        "1695f52b-9c84-4b7e-6acc-f5c0319a4d28",
        "it instala",
        "7@8z8",
        "DUSetup: Initializing IsEnterpriseGSKU:  [%s]",
        "ProductKey: SelectImageIndex: Found multiple matching images. Querying for image index.",
        "KD93X-TNKDG-6KY3C-7GRVC-8XC2Y",
        "CMicrodomUpdateContext::CreateVirtualElement",
        ":7:A:n:x:",
        "<$>+>",
        "Microsoft.Windows.7.X17-36796_8wekyb3d8bbwe",
        "Systemet opfylder ikke minimumskravene til genoprettelse af Windows.%0",
        "The user has chosen to abort Setup to keep Uninstall option active.%0",
        "enterprisesn",
        "FindFirstChunk",
        "3I4P4",
        "Sistema Operativo Microsoft",
        "GetSystemMetrics",
        "0%080b0i0u0",
        "el hash instance.%0",
        "No packages to be downloaded.%0",
        "SOFTWARE\\Microsoft\\Sysprep",
        "DataMigration: Queue Request for data migration - full upgrade scope",
        "De gebruiker heeft ervoor gekozen om Setup af te breken en de optie voor het ongedaan maken van de installatie actief te houden.%0",
        "Microsoft.Windows.162.X21-83177_8wekyb3d8bbwe",
        "Microsoft.Windows.7.X21-83742_8wekyb3d8bbwe",
        "PVVj@Wh",
        "DiskPartition: Target drive not found in automation.",
        "EventRegister",
        "s kezdeti szakaszaiban ACCESSDENIED hiba l",
        "Wykonywanie skryptu powodzenia nie powiod",
        "MoSetupPlatform: Resume requested without Pause.",
        "PPPjd",
        "File[*]\\FileName",
        "Microsoft.Windows.4.X21-05132_8wekyb3d8bbwe",
        "c7d0ad9f-b664-baaf-0194-4aba01522e7f",
        "Microsoft.Windows.122.X19-98837_8wekyb3d8bbwe",
        "MMNXW-37YYP-RV6PQ-WVD4Y-R63H8",
        "<M=T=e=",
        "CDlpActionProductKeyValidate::PopulateCompleteImageInfoSet",
        "u 9C0t",
        "Impossibile continuare l'installazione perch",
        "STATUS_INVALID_SID",
        "DownloadUrlX64",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::GetError",
        "Microsoft.Windows.164.X21-11811_8wekyb3d8bbwe",
        "83172dcb-5e3b-50be-1324-d41e6766eccf",
        "~,9~(t",
        "Microsoft.Windows.98.res-v3269_8wekyb3d8bbwe",
        "Az adattartalomf",
        "96GT9-N299H-9HBTB-9H6WW-82QFF",
        "20b91409-d1a0-f476-4b33-e5243b6d2fc0",
        "Antwoord van server is ongeldig.%0",
        "627A7",
        "5#606Y6d6",
        "HRNHB-MDMKJ-7B74M-FB6M8-JFG7B",
        "Microsoft.Windows.126.X21-83276_8wekyb3d8bbwe",
        "__rv.UcsCharacter != (0xffffffff)",
        "tre consolid",
        "Problemene med portet kompatibilitet ble ikke l",
        "ActionListParser::ParseInstallFeature",
        " vazio.%0",
        "de5d27de-33e6-6fa9-bd07-26a948eba840",
        ".?AV?$CMoSetupActionImpl@V?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIActivationAction@@@@@@@@@@@@",
        "53a8ebd2-fd2a-2177-36be-cfb6e1d36c4d",
        "es-EC",
        "nso-ZA",
        "8*8Q8e8q8",
        "62d7b6a5-6cd9-6baa-3908-5dea053ad93e",
        "YF922-NMRJ6-JY939-HFGQ6-RRHKD",
        "No se ha encontrado ninguna oferta que coincida con los criterios necesarios.%0",
        "WGGHN-J84D6-QYCPR-T7PJ7-X766F",
        "setting hardlink failed",
        ";#;;;V;q;",
        "RestoreMountStub: Could not move hardlink stub to prepopulate location",
        "nyt lataamista varten.%0",
        " /MCTUILanguage %s",
        "Failed install count for build [%s] is [%d]",
        "??0exception@@QAE@ABQBD@Z",
        "Microsoft.Windows.125.X21-83231_8wekyb3d8bbwe",
        "GetLogicalDriveStringsW",
        "290d5979-55d5-9572-8dc3-c6398eda81b4",
        "F4QQS",
        "DiskSpaceReq: We have an external drive to calculate minimum required space on system drive",
        "n_0W0f0D0~0[0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::Resume",
        "YRD24-NDX6K-Q92J9-42HP6-H8RBQ",
        "Um script excedeu o limite de tempo.%0",
        "_u.9S(t",
        "3#3=3W3o3",
        "DataMigration: Migrating WebSetup media location [%s].",
        "84810201-9214-329b-be2c-f16cc0ad91eb",
        "D$L9A",
        "ProductKey: Matching Install Wim: No edition provided, matching all images.",
        "7e126f00-204f-08cf-c092-7d0d84d5d000",
        "CMicrodomBuilder::ProduceStringTable",
        "ImageFinalize: Initializing Mode:                             [%d]",
        "CDlpActionDU::GetResultsRoutine",
        "39HPt",
        "Microsoft.Windows.98.X20-29576_8wekyb3d8bbwe",
        "es Principais",
        "9$959;9D9N9`9g9o9x9",
        "Microsoft.Windows.8.X21-83720_8wekyb3d8bbwe",
        "ProductKey: Eula = %s",
        "BuildBranch",
        "NMQWG-TM4R6-2QKJK-MPRCC-BTDGY",
        "Nutzlastdateien waren besch",
        " au pr",
        "50a838e9-66e2-7101-c383-6eec46e8d0aa",
        "ImageDeploy: Initializing Target:                [%c]",
        "Microsoft.Windows.125.X21-83244_8wekyb3d8bbwe",
        "r Item ",
        "cb836420-c8e8-a73b-b693-776028ce365e",
        "laton.%0",
        "e581d7fc-ac88-a358-976c-b5236f62cd66",
        "Microsoft.Windows.48.X19-99716_8wekyb3d8bbwe",
        "Microsoft.Windows.48.X19-99500_8wekyb3d8bbwe",
        "DUImage: Skipping Dynamic Update due to timeout getting GDR updates.",
        "CDlpActionCompatFactory::CreateInstanceRoutine",
        "YJQ8K-M7FV8-93RC3-VH7WQ-TYKB7",
        "DUImage: Generating hardware compatibility file [%s]...",
        "WIM\\IMAGE[*]\\CREATIONTIME\\LOWPART",
        "HostOSBuildNumber",
        "\\ArcName\\multi(0)disk(0)rdisk(0)",
        "EventWriteTransfer",
        "(NewPrefix == 0) || RtlIsLUtf8StringValid(NewPrefix)",
        "474V4",
        "MigChoice: Before Migration Filter -> [%s]",
        "FveUnlockVolume",
        "HDNGX-P72PX-PVYMX-K932H-R9CTC",
        "Brugeren har valgt at annullere, fordi systemet ikke opfylder kravene i kompatibilitetsscanningen til installation af opdateringen.%0",
        "Het diagnoseobject is niet gemaakt. Gebeurtenissen kunnen niet worden gemeld.%0",
        "ndaren accepterade inte licensvillkoren.%0",
        "</=h=",
        "f4a9c760-f75f-9ed2-4be1-7c5e3d2d544d",
        "Microsoft.Windows.49.X20-29598_8wekyb3d8bbwe",
        ":4:D:H:X:\\:l:p:t:x:|:",
        "jl futtat",
        "ZwDeleteKey",
        "ImageDeploy: Error retrieving feature info! [0x%X]",
        "Finalize: Remapping install error [0x%X] -> [0x%X] for telemetry.",
        "3 3$3(3,3034383<3P3T3X3l3p3",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionEulaFactory,class CDlpActionEula>::GetActionId",
        "si folyamat nem fejez",
        "Speeg/T",
        "718^8k8x8",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Accessibility",
        "9JQNQ-V8HQ6-PKB8H-GGHRY-R62H6",
        "1%2_2u2",
        "30e20fad-4d8b-1615-eb3a-8f660d28348f",
        "ttelep",
        ">MdDtt",
        ":=;I;d;Y<y<",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::Execute",
        "lise compacta protegida para instalar a atualiza",
        "293C3Y3",
        " stato trovato.%0",
        "remedi",
        "STATUS_NO_MORE_MATCHES",
        "JF9NT-7JJCQ-HPKQF-X4PPJ-VH642",
        "No se pudo continuar con la instalaci",
        "3$3,343<3D3L3T3\\3d3l3t3|3",
        "CDlpResponseAutomation::GetResultsRoutineUpdateMedia",
        "285c76ab-c5b7-68eb-944b-3f5293a26ce3",
        "Microsoft.Windows.161.X21-83177_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X19-98883_8wekyb3d8bbwe",
        "rdateien f",
        "Microsoft.Windows.48.X19-99491_8wekyb3d8bbwe",
        "7F7o7",
        "W7RNC-HPTRX-DCQ9T-GBGW9-H6DDQ",
        "Die Installation kann nicht fortgesetzt werden, weil bereits ein Abschlussvorgang angefordert wurde.%0",
        "3%4C4a4~4",
        "Systemet opfylder ikke kravene i kompatibilitetsscanningen til installation af opdateringen.%0",
        "RtlIsLUtf8StringValid(Name)",
        "B9H4N-38JYF-3XY33-QPVD4-YTDD6",
        "L0zzg0Y0",
        "PackageMigration: Initializing GDR Count            [%ld]",
        "GetFinalPathNameByHandleW",
        "2@2n2",
        "PreFinalize: Queue Request for driver installation",
        "MoSetupPlatform: Persisting telemetry data",
        "PackageMigration: Initializing Critical paths       [%ld] [%s]",
        "destination_address_required",
        "72443ffb-2478-4a66-babc-5af8e236546a",
        "nia minimalnych wymaga",
        " ei t",
        "nce ba",
        "ImageDeploy: Initializing BitLocker Mode:        [Suspend]",
        "Microsoft.Windows.48.X20-29566_8wekyb3d8bbwe",
        "tKWVj",
        "NPPR9-FWDCX-D2C8J-H872K-2YT43",
        "de375d4a-3c5d-7344-db44-cf8fc849f31c",
        "2$2,242<2D2L2T2\\2d2l2t2|2",
        "D$@PW",
        "DATATYPE_MISALIGNMENT",
        "660c85c9-5f1a-01b0-2811-67b09f9a61c4",
        "Payload",
        "Enumerate_OnDemand",
        "MicrodomImplementation::CDomPositionCache::GetLocation",
        "DYNQ8-H7BQB-YCF8K-PM77M-PR66D",
        "C6HQY-NDPTB-B8V8D-BKY6X-FRG4F",
        "Failed to get img buf",
        "lido.%0",
        "1v1}1",
        "1<2g2t2",
        "InitializeCriticalSectionEx",
        "(Bytes % sizeof(WCHAR)) == 0",
        "u.FAB;",
        "host unreachable",
        "Installasjonen kan ikke fortsette fordi forekomst-hash ikke ble funnet.%0",
        "Microsoft.Windows.100.X20-29644_8wekyb3d8bbwe",
        "Error setting compression",
        "r att slutf",
        ":&;W;q;",
        "288c10d3-db69-97fd-22d6-d1f83eb7f47f",
        "FNPG6-GVG6G-8HWJQ-8FR3C-3YJG9",
        "Eine unerwartete Version von Bin",
        "DataMigration: Initializing Eula:                               [%s]",
        "Finalize",
        "=W>o>",
        "Serveren for installasjonsfremdrift er ikke tilgjengelig.%0",
        "XGYGN-8DQ7H-HGWFQ-XB7CY-KD726",
        "DUImageInfoSet",
        "dvendig oppgave mangler.%0",
        "Y4?L8M",
        "Den k",
        "yoj@j",
        "my s kompatibilitou s omezen",
        "embeddedindustryeeval",
        "already connected",
        "8j8q8",
        "connection_refused",
        "%hs: Error finding window %s; HR = 0x%x",
        "T9NFD-3RDH8-GF4RT-Q2K6F-KBVYR",
        ".?AVIMoSetupCompat@@",
        "WKFQV-KNKRQ-8XR3J-F2MFG-PDFW2",
        "d5792fee-169a-c3a7-3942-72548e7d278e",
        ";4;8;<;@;D;H;L;P;T;\\;`;d;h;l;p;t;",
        "8?8c8",
        "%CLIENT_KN%",
        "No se ha podido encontrar una imagen de instalaci",
        "5H6]6",
        "en tuntematonta komentoriviargumenttia.%0",
        "N3FBK-8V7WF-FT4XF-MR3FV-CYT4Y",
        "st-ZA",
        "hrbaren",
        ".?AVCCompatibilityDataProvider@@",
        "this->m_PositionList.Allocate(LocationHeader->ulItemCount)",
        "84YR8-NY984-KPXFV-PWDB7-CYT4G",
        "a3cb8e47-0039-7125-246d-b36842370f7e",
        "MicrodomImplementation::CDomLayoutCache::GetNodeChildren",
        "serverdatacentereval",
        "4NDDF-WMDXJ-C32YC-FJ7JC-76FH6",
        "Exporting alterations to firmware.",
        "2DGWC-6VNGF-YM3YR-Q2HQB-RC2KD",
        "2WH4N-8QGBV-H22JP-CT43Q-MDWWJ",
        "CompanyName",
        "#D$ P",
        "Il processo di installazione non ",
        "eb48d790-e947-9b8e-c397-0f2e00e2442e",
        "Microsoft.Windows.126.X21-83280_8wekyb3d8bbwe",
        "Microsoft.Windows.136.X21-98321_8wekyb3d8bbwe",
        "DQ9NR-PK7CQ-42CYF-RQ7HM-39QH2",
        "D$TX5",
        "N6233-Y6GCR-6RCM3-QFF3Y-8FG64",
        "lis k",
        ".?AV?$CZeroInit@VCCompatProgressHandler@@$00@@",
        "CGNP9-KFP3C-FPBX6-2R4WD-B98WD",
        "RtlIsLUtf8StringValid(ElementId)",
        "Nebylo mo",
        "de-LU",
        "Microsoft.Windows.100.X20-00915_8wekyb3d8bbwe",
        "SelectedMigChoice",
        "Microsoft.Windows.121.X20-00859_8wekyb3d8bbwe",
        "Y74D9-QN2XB-TPRT8-KK6JR-PPJJF",
        "3(3K3c384",
        "Microsoft.Windows.48.X20-39266_8wekyb3d8bbwe",
        "chargement de la charge utile.%0",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementNodeSet",
        "rts.%0",
        "<!=j=",
        "Microsoft.Windows.126.X20-00859_8wekyb3d8bbwe",
        "93e34508-939e-4566-8e38-aea2a9eb082b",
        " gjenopprette Windows.%0",
        "MoSetupPlatform: Creating NewSystem object...",
        "Finalize: Error reporting downlevel time: [0x%X]",
        "El sistema no cumple los requisitos de espacio en disco para descargar y desempaquetar los medios de varias arquitecturas.%0",
        "5$606y6",
        ";4;a;",
        "Microsoft.Windows.101.res-v3259_8wekyb3d8bbwe",
        "Microsoft.Windows.99.X19-99568_8wekyb3d8bbwe",
        "d i konieczne jest skonsolidowanie warto",
        "Registrerte en uventet versjon av Update Agent-klienten.%0",
        "N6M3Y-HWT69-B886F-TMPFR-R3KQY",
        "20201008085054Z",
        "vodu chyb",
        " possibile intervenire.%0",
        "Microsoft.Windows.162.X21-43647_8wekyb3d8bbwe",
        ":?:[:n:",
        "2BJKM-PKNR6-QJKDB-773F7-HXMMG",
        "MoSetupPlatform: Requesting installation of required LangPackPackages:        [%ld] [%s]",
        " uruchomiony z nieprawid",
        "Kurulum ",
        ".?AV?$CZeroInit@VCAutomationManager@@$00@@",
        "Microsoft.Windows.122.X19-99474_8wekyb3d8bbwe",
        "D$(PV",
        "9R69H-NM9K8-72CKY-R7P8B-G3DGX",
        "De gebruiker heeft ervoor gekozen om te annuleren omdat het apparaat onvoldoende schijfruimte heeft om te downloaden.%0",
        ".?AV?$CZeroInit@VCDlpActionCompat@@$00@@",
        "g[0Z0B}",
        "DataMigration: Migrating WebSetup image index [%d].",
        "mu.%0",
        "CDlpActionCompat::SerializeSysReqScan",
        "139059eb-716b-363d-7b4f-7817597a4ba2",
        "Microsoft.Windows.4.X19-99685_8wekyb3d8bbwe",
        " non sono stati risolti entro il limite di tempo richiesto.%0",
        "J3B2N-BGKG8-F4Y28-36HWC-TMT42",
        "Microsoft.Windows.101.X19-99529_8wekyb3d8bbwe",
        "6HPQN-F6WKY-2JM6P-7DV28-W4XFR",
        "CDlpActionDiskSpaceReq::PerformTriggerStoragePolicies",
        "Microsoft.Windows.50.X21-83785_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X20-25151_8wekyb3d8bbwe",
        "en-PH",
        "LogSharingViolationErrorInfo",
        "fr-CI",
        "connection_aborted",
        "Microsoft.Windows.100.X20-30044_8wekyb3d8bbwe",
        ".?AVCDlpActionUpdateMediaFactory@@",
        ">!>%>)>->1>5>9>=>A>E>I>M>Q>U>Y>]>a>e>i>m>q>u>y>}>",
        "=\">R>j>",
        "Failed to allocate string",
        ";+;@;",
        ":@;k;",
        "RtlAppendUcsCharacterToLUtf8String",
        "DUImage: Error on Latent Acquisition Payload: [0x%X]",
        "YHG84-GCN2Y-38QPD-87PWJ-XW3DQ",
        "PT98N-K47YD-4MHH4-23BWV-3J3GP",
        "si jelent",
        "Microsoft Corporation1-0+",
        "FinalizeActionTimeEnd",
        "No more than one flag set check failed: __e",
        "NRG8B-VKK3Q-CXVCJ-9G2XF-6Q84J",
        "ba-RU",
        "o em disco para instala",
        "DiskSpaceInstallReq: Initializing Wim Ref Count          [%ld]",
        "4X4_4",
        "CDlpActionCompat::SerializeGatedScan",
        "82a5fc3e-2249-28fe-7ed1-c18f50811993",
        "o mais atualizada ser",
        "El sistema no supera el an",
        "A failure script failed to execute or returned an error.%0",
        "$Progs",
        "Microsoft.Windows.126.X21-83272_8wekyb3d8bbwe",
        "CDlpActionSummaryFactory::CreateInstanceRoutine",
        "Uyumluluk raporu eksik bir sistem bile",
        "Proces instalace byl pozastaven.%0",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "enterprisesubscriptionn",
        "Microsoft.Windows.98.X20-24581_8wekyb3d8bbwe",
        "sente pas l'espace disque requis pour le t",
        "796a6096-0c1c-0168-a02c-7dd2a70f6ed1",
        "VH6KN-F9GXT-4B4DF-WG67G-6F62B",
        "ynnistettiin k",
        "Microsoft.Windows.101.X19-99547_8wekyb3d8bbwe",
        "Microsoft.Windows.101.X20-20961_8wekyb3d8bbwe",
        "Asennusprosessi k",
        "DUImage: Skipping Dynamic Update due to timeout getting driver updates.",
        "313<3h3s3",
        " nespr",
        "CheckHotPluggableDrive: Drive %c SetupDiEnumDeviceInterfaces Error: 0x%X",
        "Microsoft.Windows.99.res-v3266_8wekyb3d8bbwe",
        "o para instalar o sistema operacional.%0",
        "Esecuzione dell'eseguibile GatherOsState non riuscita.%0",
        "5@5G5Y5`5",
        ";`<W=",
        "DataMigration: Not requesting private file migration.",
        ">7>K>c>",
        "4*4a4",
        "9e9x9",
        "CDlpActionDU::SerializeDUSetup",
        "SLC.dll",
        "Microsoft.Windows.101.X20-36703_8wekyb3d8bbwe",
        "Microsoft.Windows.48.X19-99479_8wekyb3d8bbwe",
        "3XWDQ-83NTJ-PB2RK-QVQ7B-MY49G",
        "Failed to get aliased identifier. Status: %x",
        "KVKHN-XQMH9-6JR6T-JJ36Q-4F8JY",
        "RestoreMountStub: setting reparse point data failed",
        "Microsoft.Windows.4.X19-99689_8wekyb3d8bbwe",
        "708W8i8K9B:",
        "Le syst",
        "mogatott.%0",
        "Microsoft.Windows.8.X21-83691_8wekyb3d8bbwe",
        " ACCESSDENIED v po",
        "WIM\\IMAGE[*]\\FILECOUNT",
        "vel criar ou eliminar a mensagem de bloqueio de desativa",
        "ZwOpenProcess",
        "4abe0f39-ce49-8c95-aa54-9af530556a77",
        "Microsoft.Windows.27.X19-98757_8wekyb3d8bbwe",
        "X4NPR-H8B8C-WVP34-CFY48-J8HB6",
        "t';CTt\"3",
        "enterprisee",
        "Os problemas de compatibilidade restrita n",
        "ce46cf2e-730c-6acc-1da3-37dd442bae9e",
        "Microsoft.Windows.188.X21-99387_8wekyb3d8bbwe",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionImageDeployFactory,class CDlpActionImageDeploy>::SetActionId",
        "*0M0S0z0N1g1{1",
        "NtQueryBootEntryOrder",
        "GetVersionExW",
        "8W9o9",
        "ca57f183-c1d0-2142-8006-c8928824e439",
        "rz9|$ |t",
        "OnDemandLateAcquisition",
        "E_INVALIDARG",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttributes",
        "Recovery: Initializing Wim Path:       [%s]",
        "ec209de6-c5a3-3622-eba9-e898d9bd868c",
        "ggesztve.%0",
        "698eca6a-ad28-4643-c263-26db61780eb9",
        "CDlpActionDataMigrate::SetSModeRegKey",
        "o foi executado com um argumento de linha de comandos desconhecido.%0",
        "TaskName",
        "o em disco para transferir e descompactar suportes de dados.%0",
        "Microsoft.Windows.8.X21-83689_8wekyb3d8bbwe",
        "5I5T5",
        "['`kb",
        " nieprawid",
        "FACILITY_CLUSTER_ERROR_CODE",
        "8G8Q8",
        "Compatibility: GenerateInstallReqCompatReports enter",
        "Not-null check failed: Document",
        "0#1J1",
        "ar-JO",
        "%PRO_K%",
        " aktualizace nepro",
        "Microsoft.Windows.4.X19-99673_8wekyb3d8bbwe",
        "Microsoft.Windows.125.X21-83247_8wekyb3d8bbwe",
        "nda kar",
        " avbryte fordi enheten ikke har nok diskplass for installasjon.%0",
        "SQMOptIn",
        "4 5*5U5_5",
        "De time-outlimiet voor een script is overschreden.%0",
        "WdsLogStructuredException",
        "QueryPerformanceCounter",
        "rbare installasjonsfilen.%0",
        "Proces instalacji wymaga, aby u",
        "~j\\XPW",
        "$Microsoft Ireland Operations Limited1",
        "veletet ",
        "nk.%0",
        "Microsoft.Windows.27.X19-98750_8wekyb3d8bbwe",
        "ug-CN",
        "Ingen pakker som skal lastes ned.%0",
        "ndirme disk alan",
        "Microsoft.Windows.172.X21-24744_8wekyb3d8bbwe",
        "FlightData",
        "DataMigration: ActionList.xml does not exist under given path, skipping migration.",
        "Features",
        " tietojen asentamisen levytilavaatimuksia.%0",
        "serversbspremiumcore",
        "Microsoft.Windows.7.X21-83728_8wekyb3d8bbwe",
        "n para mantener activa la opci",
        "Microsoft.Windows.49.X20-00862_8wekyb3d8bbwe",
        "SetupCore: Registered PKEY_VALIDATE action",
        "GetLocalTime",
        "CDlpActionDiskPartition::GetDriveLetterFromAutomation",
        "Microsoft.Windows.98.X20-29582_8wekyb3d8bbwe",
        "130d221e-7fe1-651f-5f90-7732d98e8caf",
        "PsfTargetName",
        "SP_UPLOAD_ASIMOV",
        "20201008074304.973Z0",
        "sd-Deva-IN",
        "MMKYK-QNQFH-KJF3V-J4HTF-BY49Y",
        "6cd908b3-98dd-6eee-1b66-d8ca18e27567",
        "Microsoft.Windows.121.X19-98672_8wekyb3d8bbwe",
        "cdade081-9ca8-0047-b2bd-af947e336cbc",
        "Microsoft.Windows.99.X19-99575_8wekyb3d8bbwe",
        "pt-BR",
        "BASE_K",
        "Microsoft.Windows.98.X19-99431_8wekyb3d8bbwe",
        "3:3i3|3",
        "ModuleCollection",
        "&quot;",
        "ds inte.%0",
        "?:\\WINDOWS",
        "71155f88-b268-868a-12aa-c8812f905a5d",
        "toupper",
        "a2bc938f-732d-3e46-a7c0-b4b6e9a2f694",
        "INT_OVERFLOW",
        "0a211e3c-4f27-fd2f-7867-9dd56d1e5ff0",
        "0bd4c858-4ff6-75ea-2bd0-f90186499f27",
        "Not-null check failed: Value",
        "ReserveManager.dll",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionImageDeployFactory@@VCDlpActionImageDeploy@@@@",
        "ne-IN",
        "r Windows ",
        "Microsoft.Windows.172.res-v3859_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X20-29575_8wekyb3d8bbwe",
        "CreateEventW",
        "8e0997f2-d7cb-d109-d02b-df5dbd8affe7",
        "de-DE",
        "ID testovac",
        "DriverInstallPath",
        "QQVWhLH",
        "233T3c3p3",
        "WIM %s, offset %.8x%.8x, length %x",
        "Microsoft.Windows.4.X19-99679_8wekyb3d8bbwe",
        "3cd959bf-4b07-9b5b-f3d9-43da28f1a94a",
        "Installationsprocessen bruges i et testmilj",
        "Failed to populate Plan from {0}",
        "embeddedeval",
        "Der Installationsprozess wurde mit einem unbekannten Befehlszeilenargument gestartet.%0",
        "es-419",
        "4$4D4L4T4\\4h4",
        ".?AV?$CZeroInit@VCDlpActionMediaCreationSuccess@@$00@@",
        "sa-IN",
        "3PJXD-QNDX8-C2X37-TWX3C-JB6PW",
        ", Microsoft Yaz",
        "027589f5-8532-6d05-5fea-09975eea486a",
        "FNPJB-C6Y6X-GXQWM-79GJJ-XW3HB",
        "Clean_FailForward",
        "8$9,9T9\\9",
        "ProductKey: Initializing Media Path:         [%s]",
        "CXmlCursor::Next",
        "DiskSpaceInstallReq: Initializing Image Index:                  [%d]",
        "4F973-NKYKY-X6MBQ-3X93P-FX9FX",
        "cfb52acc-0316-006c-5759-4c7ce50c6d4b",
        "NYM7J-CRRVT-D232T-748BW-HMHY7",
        "DUImage: Enumerating build offer",
        "protocol not supported",
        "NtWaitForSingleObject",
        "::;A;T;",
        "65ff92ea-03a2-b2b6-b2f3-03b426dc324c",
        "RestoreFileInfo",
        "61d61405-688d-516f-1136-3ce845b485a7",
        "echna pr",
        "_snwscanf_s",
        "???E?g?m?",
        "3PBTQ-9N4MQ-K6KVC-G28GJ-9TQM6",
        "531bdf5a-e3d6-4229-1833-55f29bd2b1f9",
        "5f14f159-95f7-5b9a-b565-b880ae7aa201",
        "CriticalCount",
        "Compatibility: Device-Actionable Block found.",
        "iotos",
        "serverforsbsolutions",
        "AuthUsesFlags",
        "NJJX7-2FV3V-7W6D3-J3764-W8F9D",
        ":(:M:T:Y:",
        "be2c7002-5af5-fea2-524d-5e99667f6391",
        "2f071021-0adc-659c-3490-5ee065717dc0",
        "QQQjd",
        "MoSetupPlatform: Release Identifier -> [%s]",
        "CDlpActionCompat::GetResultsInstallReq",
        "ACCESSDENIED error encountered in initial stages of Setup - Retry possible.%0",
        "ccd20ad9-38bf-2209-417f-79f171a0bade",
        "CDlpActionDU::SuspendRoutine",
        "bca76167-cf70-f7e3-55dc-b172992debe0",
        "Microsoft.Windows.161.X21-43622_8wekyb3d8bbwe",
        "ERROR_ACCESS_DENIED",
        "7KWY4-2NQW6-CQ6M2-2RQ9X-9HJVT",
        "0-Nk0",
        "Activation: OS is Threshold Plus. Assuming no issues.",
        "winbrand.dll",
        "NR4R9-WF6TQ-4TVB6-3YMX7-XD73C",
        "starter",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionRecoveryFactory,class CDlpActionRecovery>::CreateAction",
        "RtlUnregisterFeatureConfigurationChangeNotification",
        "rd fr",
        "rio reiniciar o sistema.%0",
        "CompatInstallReq: Initializing Media Path:                [%s]",
        "97u\"3",
        "The user has not accepted Advertisement within the required time limit.%0",
        "= =<=B=",
        "=?>_>",
        "o existem pacotes para ser transferidos.%0",
        "OnDemand",
        "Microsoft.Windows.48.X20-29664_8wekyb3d8bbwe",
        "Not-null check failed: pWriter",
        "CBasicNodeType::ForceNameSetting",
        "755d8f5a-8c4f-c827-d0bf-688887ac06e5",
        "DeleteFileW",
        "3@3p3",
        "on inattendue.%0",
        "7;7B7d7k7",
        "PostUpgradeDiskSpacePercentage",
        "CheckDiskSpace: External drive is not available",
        "<5=v=",
        "527079ee-10ca-8f4a-608d-224c476b04ac",
        "GetSupportedDriveLetters: Fixed drive found [%s]",
        "Microsoft.Windows.162.res-v3921_8wekyb3d8bbwe",
        "Microsoft.Windows.50.X18-81305_8wekyb3d8bbwe",
        "AppScanResult",
        "DebugBusParams",
        "20d045e6-00a9-23be-78ae-03b87ae9c143",
        "Duplicate install feature. Group: {0}, FMID: {1} , Feature: {2} or out of memory.",
        "GetTraceEnableFlags",
        "8a2f8653-bd04-f1f8-21c1-ba9cb3cd25f6",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionAdvertiseFactory,class CDlpActionAdvertise>::GetActionId",
        "JNMYF-GG4M9-X9BFY-87FT8-TQ7YD",
        "sti syst",
        "Serwer post",
        "rd hittades.%0",
        "6!6F6Q6l6",
        "Microsoft.Windows.145.X21-83756_8wekyb3d8bbwe",
        "GJTYN-HDMQY-FRR76-HVGC7-QPF8P",
        ";!<7<",
        "RtlXmlInitializeTokenization(&TokenizerState, &TokenizerInit)",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionDiskPartitionFactory,class CDlpActionDiskPartition>::SetActionId",
        "18dd1c9c-dfb2-d64f-84b1-38ac8c224ceb",
        "pStringPool->Signature == ('pSdM')",
        ".?AVCDlpActionDU@@",
        "Microsoft.Windows.101.X20-35488_8wekyb3d8bbwe",
        "lasza helytelen form",
        " serveru m",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionUpdateMediaFactory,class CDlpActionUpdateMedia>::GetActionId",
        "95c1e1de-c21b-cb6e-6167-ef626e48821c",
        "Microsoft.Windows.164.X21-06156_8wekyb3d8bbwe",
        "onecore\\base\\Cbs\\Util\\inc\\CbsArray.h",
        "Microsoft.Windows.99.X18-52141_8wekyb3d8bbwe",
        "adavky pro obnoven",
        "889e1e01-dc4c-a152-629f-bbb47ffea84a",
        "4?5^5i5q6",
        "Microsoft.Windows.125.X21-83236_8wekyb3d8bbwe",
        "f2631487-ecfd-dea5-3a8c-7250cf82f792",
        "Microsoft.Windows.4.X19-99694_8wekyb3d8bbwe",
        "7 7(70787@7H7P7T7X7\\7`7d7h7l7p7t7x7|7",
        "ilo se naj",
        "_wcslwr",
        "DataMigration: Queue Eula Accepted into Target OS...",
        "LdrGetDllHandle",
        "%hs: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber' does not exist. Assume 0",
        "ndan, kullan",
        "MN6BV-H3XRF-89T3G-3Q7QB-2PQGT",
        "HRP6Q-NVBG7-PFYKR-R6JHJ-BWT37",
        "Microsoft.Windows.188.X21-99377_8wekyb3d8bbwe",
        "PreFinalize: Initializing Drive letter:        [%c]",
        "Not-null check failed: PseudoKeyOut",
        "Microsoft.Windows.17.X17-66962_8wekyb3d8bbwe",
        "5P6V6p6",
        "Systemet opfylder ikke gated-kompatibilitetsscanningen for at installere opdateringen, og brugeren skal ikke have besked.%0",
        "Microsoft.Windows.48.X19-98795_8wekyb3d8bbwe",
        "a05d7b05-aa3a-aef8-231d-ca190ff77335",
        "JM8PN-694RH-VT977-37X34-84474",
        "afea7842-d4ab-2fb0-acc8-ed9c40f354df",
        "la se neo",
        "Microsoft.Windows.101.X19-98873_8wekyb3d8bbwe",
        "no such device",
        "FveEnableAuthenticationW",
        "InitializeCriticalSection",
        "3.4u4",
        "B2C7P-MN9Y4-4F9W4-PFR6X-8QKRG",
        "Object alias resolves to %s",
        "Error restoring directory metadata",
        " nem ",
        "businessn",
        "7 7(747T7\\7d7l7t7|7",
        "QVPCV-NCD6K-KQV3Q-X6RWP-VFR9Q",
        "Not-null check failed: pDocument",
        "4756039f-e56b-d2f5-0f5a-3a4a127650a7",
        "d893c338-f318-eaa3-ebbf-d287f57c5522",
        "Compatibility: Calling Resolve(WICA_DISMISS_ALL_RESOLVE_STRING)",
        "TmiMatrix\\VersionRanges",
        "o aceitou o An",
        "o foi criado. N",
        "9p:x:",
        "Microsoft.Windows.4.X19-98702_8wekyb3d8bbwe",
        "o para manter a op",
        ".?AV?$CZeroInit@VCDlpActionRecovery@@$00@@",
        "8[8~8",
        "1(141T1`1",
        ".?AV?$CUnknownImpl@VIFCPayloadCallback@@@@",
        " sakl",
        "64b3ac32-0881-b1d9-f2a6-1ac988945082",
        "873bd014-8929-2e9e-8a8c-fc28003253cb",
        "1I3^3}3",
        "Could not find a target drive letter. %0",
        "8b9w9",
        "GetSystemDefaultUILanguage",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::Execute",
        "Array size too big",
        "4Y4c4",
        "ProfessionalSingleLanguage",
        "Microsoft.Windows.101.X19-99532_8wekyb3d8bbwe",
        ";.<5<i<",
        "CDlpActionDiskSpaceReq::QueryInterface",
        "G3KNM-CHG6T-R36X3-9QDG6-8M8K9",
        "serverstorageenterprise",
        "31754c9e-531a-a701-0cbe-b037d57700e7",
        "2]2p2",
        "HRTMN-TD7V8-8R99C-P648K-GJGPY",
        "RtlAllocateLBlob",
        ".?AV?$CZeroInit@VCDlpActionDiskPartition@@$00@@",
        ".CRT$XCU",
        "=@>Y>r>",
        "DLPLOG: [0x%X] [%s] [%s]",
        "b2dffd2a-f887-2434-3447-51d78a81b95d",
        "]._g*",
        "D$0SV",
        "959D9{9",
        "Microsoft.Windows.125.X20-00862_8wekyb3d8bbwe",
        "XXJN6-VCHX7-99BCX-T2GJ4-VMKV9",
        "ZwOpenFile",
        "YY_^]",
        "BUCL::Rtl::AddInPlaceWithOverflowCheck(&MaximumLength, Sources[i].Length)",
        ">#>.>?>F>_>x>",
        "D$@PjZ",
        "9c7668c4-2f21-2b81-55ff-2e88921b7785",
        "Asennus keskeytettiin.%0",
        "2GXNB-H7M3M-M3W32-H77XJ-7FVBY",
        "D$$PQ",
        "Microsoft.Windows.164.X21-06161_8wekyb3d8bbwe",
        "0a8023cc-3d45-1447-54d8-12de7f16c449",
        "QNG88-GPCPC-V9FF2-MTCC2-MP2JP",
        "enterprisesneval",
        "T$0QQV",
        "DUSetupMUv6",
        "<&=1=f=q=",
        "MoSetupPlatform: Resurrecting SetupAutomation object from [%s]...",
        "Uno script ha superato il limite di timeout.%0",
        "Microsoft.Windows.172.X21-24721_8wekyb3d8bbwe",
        "Microsoft.Windows.7.X17-66961_8wekyb3d8bbwe",
        "Microsoft.Windows.122.X19-98892_8wekyb3d8bbwe",
        "bbd87642-32a8-e374-33ad-fad51be8f47f",
        "WN7RF-QBR8G-4PMJR-2DJJF-HQXC3",
        "NCHYW-W9P2G-RW847-Q4VHV-BDWWD",
        "Der Installationsvorgang erfordert, dass der Benutzer dem Lizenzvertrag zustimmt.%0",
        "Microsoft.Windows.50.X21-83778_8wekyb3d8bbwe",
        ">'?;?P?y?",
        "27531ae3-4d2e-abc0-4439-831ce2bd9a31",
        "mesini kabul etmesini gerektirir.%0",
        "605db963-940a-27f7-a167-c9f1c87a288e",
        "Microsoft.Windows.27.X19-98754_8wekyb3d8bbwe",
        "UTF-16",
        " przerwany w trakcie fazy sprawdzania zgodno",
        "ERROR_MOD_NOT_FOUND",
        "D43PH-NJP6R-C4GGV-HCX23-PYVKQ",
        "::RtlIsLBlobValid(Destination)",
        "D$$;D$",
        "0c81628b-ef22-db62-fa8e-ebcf109c912b",
        "Het installatieproces is uitgesteld.%0",
        "Offer",
        "*ppObject = State->m_pAllocator->Allocate<Media>()",
        "cf2ba416-72bb-19ca-c460-201533650bd3",
        ";;;_;i;x;",
        "my s kompatibilitou se nevy",
        "coreconnectedsinglelanguage",
        "8a9a32f5-fdc2-728e-7d68-58737a286c64",
        "Server response is malformed.%0",
        ";0;8;@;P;t;|;",
        "MinOSVersion",
        "7d3773ed-642e-2ff8-f8da-7da76805eda4",
        ";S s!k",
        "UncompressFile",
        "Microsoft.Windows.162.X21-03401_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::GetActionId",
        "Microsoft.Windows.188.X21-99384_8wekyb3d8bbwe",
        "94c763b0-3f26-55d1-3867-d35e6b38ace5",
        "layan bir teklif bulunamad",
        ":,:J:h:",
        ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:",
        "r inte att visa kompatibilitetsrapporten p",
        "0u1|1",
        "2.3Z3",
        "KN368-RBYCH-GW4CW-K8WRV-WK8XT",
        "LangPackChecked",
        "GKHN2-DYYPG-J94DP-Y4WK7-M4G6M",
        "Microsoft.Windows.49.X19-99720_8wekyb3d8bbwe",
        "TX9XD-98N7V-6WMQ6-BX7FG-H8Q99",
        "JPHNP-VJ3RW-HX2HT-6X9GB-X4R9J",
        "9D$$t",
        "rdien skal konsolideres til telemetriform",
        "GTHNT-JQHQM-YQVKH-CB6JB-K766G",
        "Finalize: Clearing update and shutdown key after successful finalize",
        "0,1c1",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::Restart",
        "f5722f77-2605-aef7-4e1a-6de522aa7a51",
        "3f01e834-6a0b-6cb5-a83e-e4c5748b8f69",
        "w binarnych platformy instalacyjnej. Sprawd",
        "Pairs.Allocate(m_StringTable.GetEntryCount())",
        "1'1U1`1",
        ": :8:<:T:X:\\:`:d:h:p:",
        ":a;Z<",
        "Zu-C;",
        "Microsoft.Windows.4.X19-98720_8wekyb3d8bbwe",
        " in un formato non valido.%0",
        "Microsoft.Windows.7.X18-81302_8wekyb3d8bbwe",
        "Het installatieproces is gestart met een onbekend opdrachtregelargument.%0",
        "VJNG4-JVRBV-QQ2TM-TX3DX-66RC3",
        "62ec1525-423c-8a1d-a1fa-1fadb528b50a",
        "1532aab5-9681-fe23-2697-dd808bbedd78",
        "B3NJP-H76KG-WGPG2-8WJQY-TXXRJ",
        "serverazurecor",
        "_wfopen",
        "<g<m<",
        " stata individuata un'operazione di rollback del sistema operativo in sospeso.%0",
        "De gebruiker heeft ervoor gekozen om te annuleren, omdat het systeem niet voldoet aan de minimum vereisten voor het downloaden van de update.%0",
        "309b6e8a-26bf-687c-e95a-bfdd8a42d9b6",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetPropertiesSetup",
        ">MdSpt",
        "RtlIsLUtf8StringValid(Source)",
        "es-AR",
        "ERROR_SUCCESS_REBOOT_REQUIRED",
        "R7NPP-B8F2Y-9289P-922Y4-3DB9B",
        "xJj&Y",
        "GPFMN-2W48F-YP3FV-WHBTG-683FY",
        "Microsoft.Windows.101.X19-98868_8wekyb3d8bbwe",
        "wcsncmp",
        "Cabinet.dll",
        "3fc7e515-53f1-af36-81cc-2efb4f90ba1c",
        "MoSetupPlatform: Calling SetupPlatform::INewSystem::RequestResumeOperations...",
        "WATSON_DRIVER_PROVIDER",
        "1cec6511-14e2-6261-7868-07e5297a6f37",
        "The installation process terminated unexpectedly.%0",
        "connection refused",
        "string too long",
        "404i4s4",
        "DUImage: OsVersion: [%s]",
        "66b24907-7304-7adb-9c16-a0cd80d01aa1",
        "0>1T1y1",
        "labilir.%0",
        "NQWWD-8T2J9-K8HCG-9W6YB-TX2GB",
        "[ybVh",
        ">D>f>m>",
        "Compatibility: Hardblock resolved. InstallReq polling ends",
        "GetWebSetupUserInput: Error reporting telemetry for WebSetupInputDefaultEdition: [0x%X]",
        " avbryte for lisensavtalen.%0",
        "MigChoice: No Response found. Continuing with default values.",
        "Global\\SetupLog",
        "3b3d09ee-3dc4-0ae0-7651-90ec0d9540dc",
        "SessionData",
        "Microsoft.Windows.101.X20-35485_8wekyb3d8bbwe",
        "CorrelationVector",
        "ch po",
        "Diagnostikobjektet skapades inte. Det g",
        "?A?G?M?S?Y?_?}?",
        "PackageHash",
        "SSSjdQ",
        "Brugeren har valgt at afbryde installationsprogrammet, s",
        "Not-null check failed: Decoder",
        "Not-null check failed: fHasChildNodes",
        "QX6XR-WNWTF-PB4MQ-87R6B-FGFJD",
        "f5d70ff6-db33-bab3-42e3-4a28ea339595",
        "me ne satisfait pas ",
        "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;p;t;x;",
        "Uno script di errore non ",
        "zh-Hans",
        "CDlpResponseAutomation::GetResultsRoutineDiskPartition",
        "originatingBinary",
        "Det gick inte att hitta installationsavbildningen.%0",
        "N3P28-TW9C9-69PWP-YQVC3-YBKR4",
        "DiskSpaceInstallReq: Initializing RollbackOption:               [%d]",
        "ff-Latn-NG",
        "JGKTN-69CHM-2RG3R-VHHG8-PKFBQ",
        "a pas pu ",
        "EnumeratePathEx: FindFirstFile failed for [%s]; GLE = 0x%x",
        "7X<`<j<p<{<",
        ">O?]?m?",
        "ce2818fa-9073-bf6b-8da7-42e4d5833e98",
        "Microsoft.Windows.101.X19-99528_8wekyb3d8bbwe",
        "strrchr",
        "8067f28f-a6db-02ee-3c4d-380e11bc66e4",
        "NWWGK-3QTDG-D322H-PRD7G-V6DG3",
        "t$pVQ",
        "tg-Cyrl-TJ",
        "2b2970e5-99f2-babb-af2b-06bf80b8b507",
        "BQ4FN-3794Q-8R8QC-KFYT7-94R8H",
        "9(9t9",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::GetError",
        "MoSetupPlatform: Finalize was successful!",
        " nem fogadta el a licencszerz",
        "ya al",
        "Microsoft.Windows.121.X19-98669_8wekyb3d8bbwe",
        ";V;w;",
        "QY2N8-QJB87-234JV-KRBRY-HT92P",
        "n no se resolvieron en el plazo requerido.%0",
        "Q6736-9NJ23-YKM8K-WHX2P-9QCRP",
        "NJ3GV-MCQHC-DJMDK-TK8F3-C373M",
        "VerQueryValueW",
        "3F3U3",
        "Sources\\pid.txt",
        "2(2,2D2T2X2`2d2h2l2p2t2x2|2",
        "Sag>k",
        "ru-RU",
        "LocalFileTimeToFileTime",
        " reklamy w wymaganym czasie.%0",
        "ZsZ(p",
        " podporovan",
        "304h4",
        " || SourceName: ",
        "filename_too_long",
        "Microsoft.Windows.48.X19-99488_8wekyb3d8bbwe",
        "26a09250-c5c7-6508-05e2-4fdf32214d2c",
        "NGMHF-GW28B-76HMB-6JTRX-GJF9Q",
        "Microsoft.Windows.49.X19-98820_8wekyb3d8bbwe",
        "1D1O1m1",
        "lv-LV",
        "Substitute name string copy failed",
        "8r ,Y",
        "Y6NXQ-GY9CW-J96YV-QV98H-94VYX",
        "Target OS: Error retrieving feature info! [0x%X]",
        "serverwebcore",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::GetError",
        "RemovePackage",
        "NDHK4-38D89-FJHP7-G338J-D9G9C",
        "DUImage: Initializing Media UpdateAgent Path:    [%s]",
        "RestoreFileCompression",
        ";(;4;@;L;X;d;p;|;",
        "46PN6-R9BK9-CVHKB-HWQ9V-MBJY8",
        "durangohostos",
        "rodowisku testowym.%0",
        "BCryptDestroyHash",
        "?=?H?i?s?",
        " k instalaci dostatek m",
        "CDlpActionDU::CancelRoutine",
        "Het systeem voldoet niet aan de gated compatibiliteitsscan voor het installeren van de update.%0",
        "Microsoft.Windows.99.X18-28456_8wekyb3d8bbwe",
        "1c5489de-1481-d3f6-f0cd-bc868b0b01b1",
        "041504B0",
        "MoSetupPlatform: Detecting recovery image option through ReAgent...",
        "\\\\?\\UNC",
        "DebuggerOptions: Initializing Debugger Type:     [USB]",
        "Microsoft.Windows.98.X20-24582_8wekyb3d8bbwe",
        "=$=S=b=o=",
        "Finalize: Leaving install error [0x%X] as-is for telemetry.",
        ":>:|:",
        "PackageMigration: Initializing Critical Count       [%ld]",
        " syst",
        "SLClose",
        "DownloadFileSizeX64",
        "70ed257e-3423-7fe4-3a39-255d640ae114",
        "serveressentialadditional",
        "hr-BA",
        "CompatMigXmlPath",
        "CMicrodomBuilder::CElementNameToAttributeListTable::Find",
        "?-?d?",
        "=<=d=~=",
        "GetFailedInstallCount:RegGetDword failed. GLE is [%d]",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::Prepare",
        "iotedgeos",
        "KM6DK-VN9Q4-FHBK2-PP2VV-8HV2C",
        "GetSupportedDriveLetters: Drive [%s] has free space [%llu] MB",
        "es-PR",
        "NtYieldExecution",
        "Complete",
        "SVWjLj",
        "cc6c141d-29b1-9ced-88c0-e71a78570d97",
        "GetVolumePathNamesForVolumeNameW",
        "t{Vh ",
        "Finalize: Compat instance not found.",
        "79e630d5-63cd-5414-1043-333df2426fb4",
        "Uno script di precommit non ",
        "bf0ead1f-aa88-60bb-59f1-c7d5827a9e51",
        "Microsoft.Windows.145.X21-83697_8wekyb3d8bbwe",
        "NPTRB-CFYFD-DGFPG-DY9GJ-CPR8F",
        "<&=_=",
        "RollbackOptionFound",
        "CDlpActionRecovery::SerializeRoutine",
        "bdf0e134-5ac1-339a-c3e8-ea0bd165a2a0",
        "D$@t3",
        "0dce95b2-e77d-c1ed-6328-55a07902a37d",
        "Invalid parameter passed to C runtime function.",
        "t_VVVP",
        "2<2R2k2r2",
        "< <(<<<D<L<T<X<\\<d<x<",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::GetResults",
        "Microsoft.Windows.49.X19-98815_8wekyb3d8bbwe",
        "NPPFM-238TT-HJHKC-R2CCJ-4VV2C",
        "Ein Fehler ist aufgetreten. Der Ergebniswert muss zu Telemetriezwecken konsolidiert werden.%0",
        "chr-Cher",
        "111019184142Z",
        "The install cannot continue because finalize cannot resume the previously started update.%0",
        "zverzi",
        "JNPM6-RQB23-8TGWF-Y6TCT-683PJ",
        "CDlpActionCompat::SerializeFinalizeReqScan",
        "f92ffb5f-e273-09a2-c3fa-4d2d0c07ee4a",
        "CDlpActionPreFinalize::InitializeRoutine",
        "?(?@?X?p?",
        "rdet m",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionActivationFactory,class CDlpActionActivation>::SetActionId",
        "Microsoft.Windows.125.X21-83242_8wekyb3d8bbwe",
        "Af;H(s",
        "ERROR_INVALID_HANDLE",
        "NHBGK-XPJP2-4TKJ6-RRR2V-PWF7T",
        "4YGRN-GMPC8-GG84C-4BTFR-MWT47",
        ".rdata",
        "x'Sh ",
        "D$pSVW",
        "<O=Z=h=",
        "5c19bd64-1e27-78f9-2a72-4e399ab7f5a1",
        "BiCreateBootEntry: Could not retrieve BCD Object application device. Status: %x",
        "3NJK8-F2Q9H-TXQC2-JC8CR-VMJG6",
        "Nyttedatafiler er beskadigede.%0",
        "Microsoft.Windows.7.X21-83738_8wekyb3d8bbwe",
        "A tesztcsomag azonos",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::GetResultsRoutine",
        "NCM4C-9DM2J-GG7YC-XJCRK-BKMWX",
        "Params->fRequireUtf8",
        ">9?Q?g?",
        "=7>^>j>",
        "CDlpResponseAutomation::GetResultsRoutine",
        "Failed to set registry data for element %s. Status: %x",
        "%s.%s.%s.%s",
        "4F8Q4-47Q6Y-7HKM9-BPYH2-9FJJR",
        "2L3|3",
        "onecore\\base\\servicing\\actionlist\\lib\\mergeaction.cpp",
        "680d697d-c060-2ea2-36b9-2768a4375d51",
        "Bugcheck driver version",
        "eca51c98-9f32-a55e-e289-e78118f96d74",
        "34265225-7db3-d75d-0cfd-f990f68eadbb",
        "MoSetupPlatform: Finalize reported disk full!",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::SetProgress",
        "Failed to convert data for element %s. Status: %x",
        "6NFV3-F2M2P-38MXH-X89X6-CGYP3",
        "Microsoft.Windows.98.X20-30046_8wekyb3d8bbwe",
        "eHomeEdition",
        "SetupCore: Registered INSTALL_GET_WEBSETUP_USER_INPUT action",
        "Closing store. Flags: 0x%x",
        "DeleteFileEx: hardlink given to us is: %s",
        "Module path is [%s]",
        "555L5a5",
        "WXW9N-48W7R-VX939-B3XYX-BKMPF",
        "5bb7bdc4-4673-a846-6829-c7bd4ee187c6",
        "22CW3-WXNPV-F7DYJ-BGXDF-MWRBJ",
        ">C>O>n>",
        "Feature",
        "F89~<t",
        "0o07_6RB}",
        " nie zosta",
        "Installationsprocessen blev startet med et ukendt kommandolinjeargument.%0",
        "quz-EC",
        "tWVPj",
        "DiskSpaceInstallReq: Initializing Timeout in Mins:              [%ld]",
        "DataMigration: Initializing SkipZeroDay:                        [%s]",
        "83428285-3c49-e944-5971-b802c1a84b05",
        "CERT_E_INVALID_NAME",
        "Microsoft.Windows.162.X21-43644_8wekyb3d8bbwe",
        ".?AVCFCPayloadDUCallback@CDlpActionDU@@",
        "MoSetupPlatform: Recovery image option is PRESERVE.",
        "A success script failed to execute or returned an error.%0",
        "808@8D8H8`8p8t8",
        "95bfd3ad-de8d-2697-dbc1-c75290dc4fb8",
        "@SVW3",
        "ca-ES",
        "ZwQueryDirectoryObject",
        "CDlpActionAdvertiseFactory::CreateInstanceRoutine",
        "DUSetup: ActionList file [%s] does not exist.",
        ".?AVCDlpActionDiskSpaceReq@@",
        "CDlpActionFinalize::InitializeImageFinalize",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteEscapedString",
        " neplatn",
        "Failed to read file {0}",
        "ProductKey: Offer = [%s].",
        ";#;>;w;F<]<",
        "[RS1]",
        "5b078ef5-6680-4b0c-df15-cdf1aacccd19",
        "M3WYN-36MC4-FP8M4-PC73X-MG9Q7",
        "Microsoft.Windows.120.X21-83763_8wekyb3d8bbwe",
        "8\"8(8.848;8B8I8P8W8^8e8m8u8}8",
        "MoSetupPlatform: Disk space released after install: [%I64u]",
        "i yap",
        "4718fb99-0752-0994-5357-5d45f3e287e7",
        "FD944-NBF4J-4DWHK-QQY3D-CBBJP",
        "e se nena",
        "2-242u2",
        "? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\\?`?d?h?l?p?t?x?|?",
        "Microsoft.Windows.48.X20-39264_8wekyb3d8bbwe",
        "FCGFG-FVNT9-98CGY-F4JM6-VCFTR",
        "4 4F4",
        "QXMHD-T8NFY-J2P3W-CPVHP-KW3FD",
        " nieoczekiwanie przerwany.%0",
        "=5=I=j=q=",
        "Microsoft.Windows.27.X19-98767_8wekyb3d8bbwe",
        "WimSetSecurityDescriptor",
        "RtlFreeHeap",
        "48260cfc-4fa4-1af6-6cff-6a8ad069f797",
        "NF2WR-678CT-24CPY-DVP9C-MP26G",
        "DUImage: Failed to execute GDR search and download [0x%x]",
        "CDlpActionCompat::SuspendRoutine",
        "0383ab3e-1cf8-f054-5b81-9224959e8a5f",
        "si ellen",
        "ee785bdc-c67a-1b9d-f62f-7c9b957f179e",
        "Microsoft.Windows.125.X20-35463_8wekyb3d8bbwe",
        " la finalizzazione non pu",
        "=&>1>f>q>",
        ">=>G>n>x>",
        "515@5M5w5",
        "?4?X?",
        "Invalid delimiter: %wc.",
        "%s\\ControlSet%3.3d\\Control\\Nls\\Language",
        "ytkownik zaakceptowa",
        "do foram corrompidos.%0",
        "0>0D0\\0c0s0",
        "94b3098d-5e58-8e80-16f8-dcbfbfbcba29",
        "CDlpActionDiskPartitionFactory::CreateInstanceRoutine",
        "18d074ab-590f-8161-95cd-c9e886af0407",
        "Microsoft.Windows.121.X20-35504_8wekyb3d8bbwe",
        "qsort",
        "The user has chosen to cancel because the system does not pass the minimum requirements to install the update.%0",
        "CDlpActionCreateMediaSuccessFactory::CreateInstanceRoutine",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::Prepare",
        "Microsoft.Windows.7.X17-66960_8wekyb3d8bbwe",
        "Ett skript ",
        "lemi ge",
        "DestinationMaximumLength >= SourceLength",
        "8#8m8",
        ">C?I?t?}?",
        "CHVC6-6NJD7-DF3R7-GV8HM-BBJ4K",
        "CNG9D-KCYWM-P6B4H-PG3GT-D3XRR",
        "969A9f9q9",
        "Too many unexplained failures. File: %s Last status: %x",
        "Recovery: No matching images found!",
        "t4f97t",
        "Microsoft.Windows.172.X21-24713_8wekyb3d8bbwe",
        "Catalog[*]",
        "Microsoft.Windows.122.X20-35511_8wekyb3d8bbwe",
        "Microsoft.Windows.27.X19-98751_8wekyb3d8bbwe",
        "RtlWriteDataIntoSmartLBlobWritingContext",
        "3)3P3k3w3",
        "Microsoft.Windows.100.X20-29649_8wekyb3d8bbwe",
        "9NFRD-HQQ7R-X3C7M-68B6G-WXCHP",
        "Suoritettavan GatherOsState-tiedoston suorittaminen ep",
        "totta a folyamatot, mert a rendszer nem felel meg a friss",
        "TCNK7-X7QH9-HQ38C-8DDJW-YP4B3",
        "Compatibility: No UI to notify HardBlock status change",
        "2QN79-MFHKY-VW4HX-TFD9J-7FR9Q",
        "7b634362-1456-a552-b9e1-edfe69ee7bb1",
        "0L0B0",
        "Microsoft.Windows.49.X20-29600_8wekyb3d8bbwe",
        "Microsoft.Windows.121.X19-98679_8wekyb3d8bbwe",
        "CDlpActionPreFinalize::SerializeRoutine",
        "63FTG-KN7RX-RMYHH-4TGHW-CPQGW",
        "serverstoragestandardeval",
        "3H3S3",
        "Microsoft.Windows.100.X19-99664_8wekyb3d8bbwe",
        "RtlUnsubscribeWnfNotificationWaitForCompletion",
        "m ke sta",
        "nimos para transferir a atualiza",
        "MicrodomImplementation::CMicrodom::GetNamedNodeMapLength",
        "Microsoft.Windows.48.X20-32149_8wekyb3d8bbwe",
        "8K2N2-G2R3X-BBKPT-J8VRJ-DGQFM",
        "Microsoft.Windows.84.X20-35526_8wekyb3d8bbwe",
        "Failed load key %ws. Flags: 0x%x File: %s Status: %x",
        "Microsoft.Windows.125.X21-83241_8wekyb3d8bbwe",
        "A imagem de instala",
        "en-NZ",
        " beti",
        "Microsoft.Windows.98.X19-99600_8wekyb3d8bbwe",
        "9D9YT-QNQPJ-RYXJF-XPG9P-3YH26",
        "memcmp",
        "AddAccessAllowedAce",
        "chr-Cher-US",
        "6Q3NP-P9X4K-C392Y-WY4QM-MY48M",
        "Translated a DontSync object to ID 0x%x",
        "6T9CB-NXX3G-8QPH8-M2334-VMJVQ",
        "Uma opera",
        "XML parse error: {0} at line {1}, column {2} : {3}",
        "Yhteensopivuusongelmia ei saatu ratkaistua vaaditussa ajassa.%0",
        "Sistem, y",
        "sl-SI",
        "nkami a u",
        "Microsoft.Windows.172.res-v3860_8wekyb3d8bbwe",
        "CompatCtrl.dll",
        "fr-BE",
        "XN9GY-C7KVX-P28MW-JF6XH-VT9RM",
        "bcded0ed-ba50-703a-5cf9-676ccf263522",
        "y}9O<t",
        "Error,",
        "rio de compatibilidade n",
        "Error ACCESSDENIED en las etapas iniciales de la instalaci",
        "200cd958-6266-e6eb-55de-75fadb28a7aa",
        "Microsoft.Windows.160.X21-83764_8wekyb3d8bbwe",
        "V:N*g~b0R",
        "041R1q1",
        "32X2X-4CN6X-3JVJT-FR6VD-973QP",
        "cuter ou a renvoy",
        "ncio dentro do limite de tempo necess",
        " dostatek m",
        "ebdb69bc-8a99-41b0-69a3-37035be7e1c1",
        "La piattaforma di installazione ha rilevato un errore non specificato.%0",
        "LangPackCount",
        "DebuggerOptions: Initializing Debugger Target:   [%s]",
        "b79e4e02-0c72-fe5a-b00e-6e09f128574b",
        " proces byl ukon",
        "DefaultAttribute.Allocate()",
        "ivatel se rozhodl p",
        "VWj 3",
        "message size",
        "X8HC2-NBHJ7-VHH9M-YMD43-WQKRM",
        "VGN89-VKGKP-BGTXV-BRQJW-VH666",
        "File[*]\\Sha1",
        "DUChannelsFlag",
        "<#<P<g<s<",
        "FH;A8",
        "6>6I6n6y6",
        "0-1@1o1v1",
        "9H9x9",
        "O(u!qHe",
        "</<K<a<",
        "RHGJR-N7FVY-Q3B8F-KBQ6V-46YP4",
        "2370f4fa-11e4-885c-1706-557974060074",
        "nea de comandos desconocido.%0",
        "WinREUseNewPBRImage",
        "Microsoft.Windows.161.X21-03403_8wekyb3d8bbwe",
        "35b2fa1c-9d53-d536-fe75-c94726293a79",
        "d509887c-3f21-a346-357e-30ac5dfc6996",
        "NM7HJ-FYJ4F-7G82H-CG2DT-KTPTC",
        "PublishedMedia\\Languages",
        "Panther\\LatentAcquisitionActionList.xml",
        "4 4(40484@4H4P4X4`4h4p4x4",
        "5+555K5p5",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::DeserializeRoutine",
        "5=6}6",
        "263ec206-3d7e-dc6e-17f8-1386185e85ed",
        "CompatFinalizeReq: Initializing Major Version:         [%d]",
        "9s8um",
        "e17d64d7-77ce-1fce-9a07-8de96aff5f86",
        "Q2YFK-8FNJ3-WTPRD-7Q4BV-9BT33",
        "GetEnvironmentVariableW",
        "Microsoft.Windows.4.X20-29624_8wekyb3d8bbwe",
        "CPVVD-PNB4C-DFFX2-DJHHD-RJRDD",
        "inde ",
        " on peruuttanut asennuksen pit",
        "n no era v",
        "93fb20c2-9429-cea7-0c54-a231a31dbf2a",
        " la publicit",
        "<J=d=",
        "Microsoft.Windows.98.X20-29573_8wekyb3d8bbwe",
        " se nepoda",
        "8e51c058-e3b8-7254-5a32-f0c409dce258",
        "CLOUD_E",
        "wsc:wica:RemoveAllDismissibleHB",
        "TmpNodes.Resize(cNecessary)",
        "NGQ8F-HFW9F-4B3DT-TKR7H-3J4B4",
        "WdsRemoveDirectory: Unable to prepare path [%s]; GLE = 0x%x",
        "Microsoft.Windows.4.X21-05123_8wekyb3d8bbwe",
        "GetVolumeInformationW",
        "No se pudo encontrar una letra de unidad de destino. %0",
        "nost migrace.%0",
        "IMAGE\\WINDOWS\\LANGUAGES\\DEFAULT",
        "STATUS_NO_MEMORY",
        "JDGN9-KW3GC-JVJ68-6K28J-33TBB",
        "OnlineRollbackPath",
        "DataMigration: Queue Request for data migration - clean install scope",
        "1#1*1A1_1",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::GetSerializeOnProgress",
        "Odpowied",
        "0/040>0R0Z0a0h0n0",
        "ivatel odm",
        "MigChoice: Initializing Drive Letter:          [%c]",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::InitializeRoutine",
        "%s: Registering Setup Platform error: [0x%X]",
        "8f9c7269-d69c-dfb4-32ea-21b19603f5c5",
        "; ;$;(;,;0;4;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;",
        "llet.%0",
        "o em disco de download n",
        "r att installera uppdateringen och anv",
        "Det gick inte att hitta den k",
        "EsdFlightData",
        "Microsoft.Windows.49.X19-99516_8wekyb3d8bbwe",
        "4\"4O4e4",
        "en-ID",
        "a2c5d2ec-c50c-4e25-d080-f77f61330f74",
        ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIFCDiagnostics@@@@@@",
        "::BUCL::Rtl::Add<SIZE_T>( cElements, 10, NewCapacity)",
        "serverenterpriseia64",
        "CloseThreadpoolTimer",
        "<unavailable>",
        "STATUS_EFS_NOT_ALLOWED_IN_TRANSACTION",
        "na wykona",
        "too many files open",
        "3_^[]",
        "EnterpriseSN",
        "tij:V",
        "PreFinalize: Automation information not found.",
        "855225a0-c332-718d-9af7-ff462aaeab19",
        "LocalAlloc",
        "5f76868c-e00b-e577-2f6b-dac1f95c8fbc",
        "s nem folytathat",
        "mle kar",
        "Microsoft.Windows.4.X19-99671_8wekyb3d8bbwe",
        "sma-SE",
        "1\"2S2}2",
        "le fasen van de installatie. Opnieuw proberen is mogelijk.%0",
        "Problemy z zamkni",
        "5o5-6165696=6A6E6I6M6Q6U6Y6]6a6",
        "202Q2a2h2",
        "OLEAUT32.dll",
        "Microsoft.Windows.172.X21-24714_8wekyb3d8bbwe",
        "Microsoft.Windows.99.X19-99658_8wekyb3d8bbwe",
        " malformada.%0",
        "DataMigration: Initializing SkipOobe:                           [%s]",
        "interrupted",
        "8<9j9n:",
        "9\\$0t]",
        "DataMigration: Initializing Privacy Option:                     [%d]",
        "Microsoft.Windows.165.X21-11810_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X20-29572_8wekyb3d8bbwe",
        "39JC3-TN66J-TQ3GM-94PG4-DJ3PK",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::Cancel",
        "DataMigration: Request for file has been queued",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::CheckUserInterrupt",
        "Microsoft.Windows.188.X21-99371_8wekyb3d8bbwe",
        "DUImage: SetupPlatform instance created.",
        "Microsoft.Windows.7.X21-83401_8wekyb3d8bbwe",
        "DVBWF-NFKRB-H98XB-JD8YT-XQBMK",
        "4*5/545>5C5H5R5W5\\5c5h5m5t5y5~5",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::SerializeRoutine",
        "6l6S7Z7",
        "DataMigration: Queue telemetry product name into Target OS...",
        "93456da6-f76d-063b-5b08-bc3ba724baa6",
        "dc7e7c4e-9e2f-3d56-298f-37ab6c581d6e",
        "CDlpResponseAutomation::GetResultsRoutineInstallNowOrLater",
        "?<?m?",
        "GGNMY-7PCGW-CRFM9-Y36CW-9TPHX",
        "STATUS_INVALID_HANDLE",
        "484T4`4w4",
        ";6<:<><B<F<J<N<R<V<Z<^<b<f<j<n<",
        "\\ArcName\\multi(0)disk(0)rdisk(1)",
        "Microsoft.Windows.161.X21-43636_8wekyb3d8bbwe",
        "imageSize",
        "L$$9D$",
        "GNM93-YKYXR-WTVC4-RY9BC-CKFBK",
        "cdf9fb0c-81a3-0696-e25f-8393ae2fc565",
        "L'utilisateur a choisi d'annuler la publicit",
        "0[0Z0k0",
        "2$3X3",
        "tte, fordi der ikke er mere diskplads i systemet.%0",
        "lverzi",
        " albo skrypt zwr",
        "DeviceIoControl",
        "c36a195f-8e52-7000-7c92-0a872c3a4db2",
        "GlobalCollection",
        "32080821-f74f-7403-e069-fac976f46c8f",
        "GVBQH-GN6BK-W9C7F-CV86D-DV74T",
        "112;2N2X2",
        "Failed to get decoder context",
        "7CCNQ-M4PQ8-JKKQX-BH6VK-MHBMY",
        "NMB98-MKJBC-FTVQ9-J3XK6-QYKTQ",
        "6 6,686D6P6\\6h6t6",
        " Microsoft Corporation. Todos os direitos reservados.",
        "3deadc7b-088e-5a6d-187f-a8348826ef6d",
        "GetMetadataPadding",
        "System\\CurrentControlSet\\Services\\i8042prt\\Parameters",
        "HGV9R-FNVTF-MQQPJ-VQPWG-VCFBP",
        "Microsoft.Windows.101.X20-29679_8wekyb3d8bbwe",
        "H7TF7-Y8JMJ-FYWR6-DCHKX-TXRCT",
        "Die Speicherplatzanforderungen zum Installieren der Nutzlast werden vom System nicht erf",
        "The system does not pass the gated compat scan to install the update, and the user should not be notified.%0",
        "qps-Latn-x-sh",
        "341fdf89-7ed9-242e-f172-4d0ea9b5795e",
        "NMDXC-PVJBP-QPKKJ-T7R8G-4M47W",
        "02ba7d1b-9b1f-8bcc-8afb-ef7e6c7e5d2f",
        "MoSetupPlatform: Releasing Setup Platform object...",
        "ProductKey: SkuLib upgrade edition is [%s].",
        "56243c8d-d28a-42f7-f1b9-fa333d629367",
        "F6GJC-NXCM6-JW4C2-DCRQJ-JFG66",
        "Den automatiseringsinformation som tillhandah",
        "SetupVersionMajor",
        "RtlInitializeResource",
        "Diskutrymmesproblemen f",
        "[%s:(%d) -> %s] %s",
        "=)=`=",
        "51aaa2dc-08b2-9930-a686-b85d38745b80",
        "898C8X8a8k8",
        "DUSetup: No Response found. Continuing with default values.",
        "Duplicate media item: {0}, or out of memory.",
        "373k3}3",
        "CSetupCore::Register",
        "12ebcc0d-a2a5-5669-4c41-cdb90a65c49f",
        "96b51e4c-3966-e2db-c299-1ed58a0dc2e9",
        "Failed to set directory extended attribute",
        "Microsoft.Windows.27.X20-35463_8wekyb3d8bbwe",
        "6bb0b6ec-e409-a187-679d-e50e4f073450",
        "GatherOsState",
        "BNG2Q-VKJ4R-8PX28-C772P-Q3XDB",
        "Recovery: Found match!",
        "NCQMH-7JRF3-32PVY-R92K6-9K2J2",
        "iotuap",
        " cancelar el proceso porque el sistema no supera el an",
        "; ;L;W;",
        ">.?9?e?p?",
        "P8MVM-NFQMH-HM7QM-KQXY9-QV64J",
        "professionalstudentn",
        "A instala",
        "Microsoft.Windows.98.X20-39255_8wekyb3d8bbwe",
        "WIM\\TOTALBYTES",
        "6a47453b-afaa-78c4-6035-9c869a45eb13",
        "RestoreDirMetadata: RestoreFileStorageTierClass failed",
        "QQH2N-2KTDV-44K2Y-XBXQ6-WXFBH",
        "sv-FI",
        " /LaunchSetupWithConfig %s",
        "Microsoft.Windows.146.X21-83754_8wekyb3d8bbwe",
        "CDlpActionDiskSpaceReq::CalculatePostUpgradeFreeSpace",
        "7<8C8a8j8u8|8",
        "%s: Leaving Execute Method",
        "RecordFileDataLocation",
        "protocol error",
        "WimParseHexString",
        "KBJNW-C3PCT-9D7MX-R949M-RC38T",
        "CDlpActionImageDeploy::SerializeRoutine",
        "?#???S?",
        "jlja ",
        "The system does not pass the gated compat scan to install the update.%0",
        "9BWN3-937V7-KXK8H-FB78C-JB7YF",
        "1$1,141<1D1L1T1\\1d1l1t1|1",
        "2!2O2e2",
        "=@=`=f=l=r=",
        "CheckDiskSpace: Not even minimum free disk space on system drive",
        "ProductKey: Product EditionID = %s",
        "d7135ec5-9f45-835e-d387-20c2834e011e",
        "Il file di configurazione del programma di installazione ",
        "IDREFS",
        "ku.%0",
        ">%>l>s>",
        "connectedcar",
        "GetSystemDefaultLocaleName",
        "DUImage: Invoking download on Payload ImageDU",
        "Microsoft.Windows.145.X21-83690_8wekyb3d8bbwe",
        "837d4fec-16ed-8c0c-8058-9ff9e3b3b698",
        "UpdateMedia: Error reporting telemetry for PerformMediaUpdate: [0x%X]",
        ".?AVout_of_range@std@@",
        "lida.%0",
        "iu-Cans",
        "ERROR_DISK_FULL",
        "Microsoft.Windows.7.X21-83405_8wekyb3d8bbwe",
        ".gfids",
        "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0",
        "5*5M5W5j5",
        "Microsoft.Windows.161.X21-43638_8wekyb3d8bbwe",
        "sr-Cyrl-ME",
        "sr-SP-Cyrl",
        "taient endommag",
        "?)?O?Z?",
        ">>>S>c>",
        ".rsrc$02",
        " la configuration minimale requise pour installer la mise ",
        "RtlDllShutdownInProgress",
        "memcpy_s",
        ">!>=>I>",
        "DeleteFileEx: Unable to allocate hardlink path buffer",
        "%I64u",
        "79180463-a512-bd3d-39fc-67c22e86fd96",
        "Failed to query process info. Status: %x",
        "GetTempFileNameW",
        "en-JM",
        ">(?3?N?o?",
        "FinalizeReqScan: MigXml path: [%s]",
        "professionaleducationn",
        "A felhaszn",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionPackageMigrateFactory,class CDlpActionPackageMigrate>::SetActionId",
        "Een opruimbewerking van een vorige installatiepoging is nog in behandeling. Het systeem moet opnieuw worden opgestart.%0",
        "6XTN2-V4VBD-F6TCV-G6KKH-462M6",
        "3&3;3",
        "n inesperada del cliente del agente de actualizaci",
        "MoSetupPlatform: Getting current disk space requirements...",
        "en-BZ",
        "Microsoft.Windows.7.X21-83747_8wekyb3d8bbwe",
        "Compatibility: Deleting RegKey for Driver Reflect",
        "ERROR_FILE_NOT_FOUND",
        "Microsoft.Windows.100.X20-00909_8wekyb3d8bbwe",
        "Os problemas de compatibilidade para download n",
        "MoSetupPlatform: Checking for system accent color...",
        "Microsoft.Windows.98.res-v3271_8wekyb3d8bbwe",
        "NMTOKEN",
        "Microsoft.Windows.7.X21-83407_8wekyb3d8bbwe",
        "2 2+292D2Q2_2j2",
        "serverenterprisecore",
        " naprawczych.%0",
        "6f9c97d0-153b-ff3d-6672-6010286b5e4e",
        "Saved app scan result at : %s",
        "connection reset",
        "Microsoft.Windows.126.X21-83266_8wekyb3d8bbwe",
        "ZwFilterBootOption",
        "relseshandling.%0",
        "PreFinalize: Initializing PostOobe Arguments:               [%s]",
        "pChild->pBasicNode != 0",
        "Microsoft.Windows.100.X19-99440_8wekyb3d8bbwe",
        "ea4459ba-f950-720b-0c0b-baade12157b3",
        "_amsg_exit",
        "afficher le rapport de compatibilit",
        "ivityksen lataamisen v",
        "n no puede continuar porque no se encontr",
        "CDlpActionDU::DeserializeRoutine",
        "6d959b02-22bd-589d-b25b-2e374876d0fb",
        "Compatibility: Error Deleting RegKey for Driver Reflect: [0x%X]",
        "MX7CG-3NV7R-979CY-RBWM6-J2QPK",
        "ndaren m",
        "JVNYV-6YRVM-GQ2FX-JFPF8-BWRB9",
        "Przekroczono limit czasu skryptu.%0",
        "nda beklenmeyen bir s",
        "Microsoft.Windows.125.X21-83240_8wekyb3d8bbwe",
        "7HNRX-D7KGG-3K4RQ-4WPJ4-YTDFH",
        "=\"=)=",
        "NCTH2-M3KRD-QRQMK-6XMXX-CDKTY",
        "3QJ27-8N2GD-P9HGM-7TYKV-G6PJK",
        "g muligt.%0",
        "54e33830-28bc-5f20-ab10-9880a4e62163",
        "professionalstudent",
        "$SVh4",
        "]_cOW",
        "Microsoft.Windows.49.X20-35548_8wekyb3d8bbwe",
        "st, hogy az Elt",
        "ad05061b-3f24-61df-4813-f7131900b28e",
        "jHXPj",
        "DebuggerOptions: Enabling USB debugging -> [%s]...",
        "zca tarama i",
        "Microsoft",
        "Microsoft.Windows.98.X19-98884_8wekyb3d8bbwe",
        "N6978-P8C8P-7J8R6-JT96R-2KCKT",
        "56f6e12a-971b-2300-a8b9-9fe46b6b8b71",
        "FailFast",
        ">1>8>h>o>",
        "Boot entry exists for DontSync with ID 0x%x",
        "BFM6D-TKNBY-X6RGR-PHJ4G-723B6",
        "Microsoft.Windows.101.X20-29632_8wekyb3d8bbwe",
        "9t$ t",
        "4j$j@",
        "UnhandledExceptionFilter",
        "JWFPN-GFH6H-6D3HH-DGDTP-W2R46",
        "__dllonexit",
        "f2ad4d9b-b0b2-8a40-5817-a9862ecd083e",
        "Encontrada opera",
        "The install cannot continue because a finalize operation was already requested.%0",
        "3f836b7c-cbcc-97ab-1e6e-31a05c479214",
        "Microsoft.Windows.184.X21-83662_8wekyb3d8bbwe",
        "FinalizeReqScan: No MigXml present",
        "professionalwmc",
        "totta a m",
        "2fe638c2-b88f-914c-012e-7b6840808164",
        "Microsoft.Windows.122.X20-35463_8wekyb3d8bbwe",
        "TVQN9-H4VQW-YPYVH-PTTBX-4JRDM",
        "2%383I3r3",
        "DiskSpaceInstallReq: Initializing GDR paths              [%ld] [%s]",
        "WIM_Verbose_Logging",
        "<zf;D9",
        "A kiszolg",
        "2 3{3",
        "DownloadPath",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::Suspend",
        "BT79Q-G7N6G-PGBYW-4YWX6-6F4BT",
        "7N7Y7`7",
        "6?nIF0",
        "2 3&3a3",
        "r det h",
        "27704654-1e0e-ea9c-2ab0-b4354f3741f6",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::GetWorkingPath",
        "Microsoft.Windows.7.X21-83406_8wekyb3d8bbwe",
        "rio optou por cancelar o contrato de licen",
        ">M>i>p>w>",
        "DataMigration: Queue Request for setupcomplete.cmd file migration",
        "invalid string position",
        "CDlpActionSummary::ExecuteRoutine",
        "KRNTD-QJ66K-W9GTD-TMY9G-TJF7T",
        "c1678a13-6aaa-fd2d-2c16-2011dd29ec0b",
        "k dosyalar",
        " Erneuter Versuch m",
        "s kicsomagol",
        "CDlpActionProductKeyValidate::SearchForKeyInHostOS",
        "nimos para instalar la actualizaci",
        "Microsoft.Windows.49.X18-15572_8wekyb3d8bbwe",
        "2b290825-39de-ac50-b636-a20201dbd25a",
        "embeddedindustryeval",
        " ACCESSDENIED. ",
        "115be1b1-8ff2-c2f5-62ee-e625f6a99418",
        "QJFNK-JWT88-68VJ7-HFXFB-VQYMV",
        ".giats",
        "A,;F8u",
        "C2FCN-9YQPG-QJP3R-MF4XT-8TYMG",
        "8e751b31-28e8-e0f2-c57c-745b9409eaa5",
        "De gebruiker heeft ervoor gekozen om te annuleren, omdat het systeem niet voldoet aan de minimum vereisten voor de gewenste migratieoptie.%0",
        "SYSTEM\\Setup\\MoSetup\\Volatile",
        "Microsoft.Windows.171.X21-24722_8wekyb3d8bbwe",
        "9HGRW-NH2CQ-XQHJD-YCRWB-6VJV7",
        "w|PPP",
        "BUCL::Rtl::AddInPlaceWithOverflowCheck(&cbRequired, (*EncodingSizer)(ucsch))",
        "inden, Kullan",
        "393V3",
        "041104B0",
        "GetAclInfo failed",
        "+T$\\+",
        "Microsoft.Windows.49.X20-29597_8wekyb3d8bbwe",
        "2!3,3X3c3",
        "ProductKey: SelectImageIndex: Selecting image index from response.",
        "KCT8Y-N444Q-XTCGD-X99CG-GMWR2",
        "NWGHQ-MWB7V-RWBVX-GRWK7-DRR8D",
        "nimos para baixar a atualiza",
        "505e48aa-dc22-1f91-7a95-1175d361c354",
        "Microsoft.Windows.7.X21-83733_8wekyb3d8bbwe",
        " hizmeti verilemiyor.%0",
        "0n0AS",
        "e7a6f16c-3735-133a-4a12-c2687e6df401",
        "1\"1&11171B1S1b1n1",
        "CDlpActionUpdateMedia::EvaluateApplicability",
        "Der opstod en fejl, og resultatv",
        "0~0_0o0",
        "ijal licen",
        " terminato in modo imprevisto.%0",
        "2495552f-9757-2150-2df2-2e4900e5f25c",
        "dzeniu nie ma wystarczaj",
        "Kan ikke opprette eller ",
        "040704B0",
        "inde tamamlanmad",
        "RollbackOption",
        "UpdateMedia: Initializing DUOptIn:                  [%s]",
        "Microsoft.Windows.125.X21-83254_8wekyb3d8bbwe",
        "9PWPK-NWF68-K33W2-MVD4B-F877B",
        "NQXXQ-DXW8K-B2GTB-KJ4QM-R63GV",
        "6d8b2ce5-0f14-8668-97a1-228b599fa680",
        ".?AV?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VICompatAction@@@@@@@@@@",
        "cross device link",
        "8 9z:",
        "Microsoft.Windows.101.X19-98662_8wekyb3d8bbwe",
        "5;5d5",
        "Q6VNQ-TCM4W-CCVWY-B4QKX-6CQGY",
        "#rSPo",
        "ProductKey: Initializing Min OS Version:     [%ld]",
        "f87b227f-c33f-4a8c-5ed6-d01b8a234463",
        "ServerImage",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::InitializeRoutine",
        "FindNextFileW",
        "9'909?9L9",
        "ffbd79ab-8bc0-26b4-2984-47c501d053af",
        "MoSetupPlatform: The recovery image option is invalid.",
        "d3d7c9ad-2c5d-4fd7-f628-718e4048b705",
        "Microsoft.Windows.99.X20-23527_8wekyb3d8bbwe",
        "Tapahtui virhe, mink",
        "5b3ca306-9e7c-5274-bcff-80a94289fcbc",
        "FQGNV-X2XKP-T94YQ-GBFCT-237Y9",
        "o pode retomar a atualiza",
        "4 4$4(4,4044484<4@4D4H4L4P4T4h4l4p4t4x4|4",
        "3NQ62-T2KDP-GBGWJ-VC3B7-WK8V2",
        "4 5'5;5B5",
        "zh-SG",
        "Eula: Getting EULA for language: [%s]",
        "WdsRemoveDirectory: Unable to clear attributes on [%s]; GLE = 0x%x",
        "en-IN",
        "82DMY-NGKV6-YYJ98-8HPY2-XTPHM",
        "Microsoft.Windows.49.X20-29589_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::Cancel",
        "=+=L=b=i=s=",
        "eef23cc5-d8a7-9bbf-4bfc-81bfa5ea93ad",
        "3&3R3]3",
        "HKLM\\SYSTEM\\Setup\\MoSetup",
        "ReAgent.dll",
        "8826fbb6-d0de-7305-dac6-4687bc8261db",
        "kleme ilerleme sunucusu kullan",
        "ProductKey: Matching Install Wim: Target Image Index: %d TargetImage EditionID: %s",
        "78e6bbeb-f984-9527-3c53-bd04dc406961",
        "bd3f490e-3a8d-c4f9-dbfd-47f689d0ee45",
        "ScanResult",
        "DataOnly",
        "Activation: Machine is NOT active.",
        "Microsoft.Windows.7.X18-81289_8wekyb3d8bbwe",
        "; ;0;@;l;t;",
        "Eula: Using Online Store version = [%s].",
        "fy-NL",
        "9eec1eec-cbf5-b60d-9b00-bb9a329df633",
        "ProductKey: Looking for EICfg file.",
        "CBasicNodeType::ChangeNamespace",
        "D$,_^[3",
        "202<2\\2d2p2",
        "Failed to shred keyform: {0}",
        "ERROR_PATH_NOT_FOUND",
        "L$hQS",
        "33efd4ae-70da-81c1-2e5a-e478d653f264",
        "YNRRQ-2TPDJ-W7HCP-3PMTX-YDWWM",
        " vazia.%0",
        " los t",
        "om-ET",
        "CDlpActionProductKeyValidate::GetResultsRoutinePkeyGetEdition",
        "::RtlIsLUnicodeStringValid(String)",
        "Microsoft.Windows.50.X21-83771_8wekyb3d8bbwe",
        "randeprocessen inte kan ",
        "40>0H0R0f0",
        "CompatFinalizeReq: Initializing Edition ID:            [%s]",
        ".?AVCSetupFCDiagnostics@@",
        "CompactOs",
        "Failed to open file attributes. Status: %x",
        "3I3^3",
        "Microsoft.Windows.99.X20-35491_8wekyb3d8bbwe",
        "9-:8:i:t:",
        "Windows::uDom::Rtl::RtlCreateUpdatedMicrodomAsUtf8",
        "81888K8",
        "Rg0W0_0",
        "Microsoft.Windows.48.X19-99496_8wekyb3d8bbwe",
        "pkeyconfig.xrm-ms",
        "=(=4=@=L=X=d=p=|=",
        "QQSV3",
        "4.4\\4",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::Cancel",
        "97c90407-8ddf-203c-f97c-f789c691cb46",
        "taj=R",
        "c1903514-3149-ceff-5856-ad6f5c6ed253",
        "Microsoft.Windows.7.X18-87815_8wekyb3d8bbwe",
        "rulay",
        "FACILITY_NDIS_ERROR_CODE",
        "5<5C5",
        "9-:p:w:",
        "Microsoft.Windows.4.X19-99675_8wekyb3d8bbwe",
        ";!<2<d<",
        "o pode sofrer manuten",
        "ngelig.%0",
        "CDlpActionGetWebSetupUserInput::GetDefaultOfferIndex",
        "827c24ad-3820-3719-6a27-d5df3e70dbab",
        "8e0cacce-6903-03c4-14fc-7d4d182a299b",
        "DUImage: Facilitator Latent Acquisition result: [0x%x]",
        "5V5l5y5",
        "PW2NH-XVVCX-JRHJF-YP429-8QMPC",
        "Error al ejecutar el ejecutable GatherOsState.%0",
        "QSVW3",
        "NewComment = this->AllocateStreamObject()",
        "0&040M0j0",
        "0b583451-441f-0325-c1e1-6e6ae2dfcf8c",
        "WATSON_DRIVER_VERSION",
        "KQP6C-NH3KF-D3XCW-H9JMP-27JXQ",
        "E(SVW",
        "JKDN6-VP37T-G7W39-PG788-Q69TQ",
        "4,4J4_4",
        "ProcessSecurityData",
        "de-LI",
        "Microsoft.Windows.101.X20-35484_8wekyb3d8bbwe",
        "1#1=1B1I1P1W1^1e1l1s1z1",
        "lb-LU",
        "%PRO_N%",
        "Microsoft.Windows.98.X20-29578_8wekyb3d8bbwe",
        "6 6'666=6L6S6",
        "RtlIsLBlobValid(Source)",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::Cancel",
        "XN829-2DTD4-RRV3C-GVGJ4-VMJGQ",
        "The installation process is being used in a test environment.%0",
        ".?AVCDlpActionDiskPartitionFactory@@",
        "0o0\\O",
        "VX38R-JFNW9-PJY8H-X9H9M-2PQDQ",
        "A telep",
        "Microsoft.Windows.99.X20-25153_8wekyb3d8bbwe",
        "0=0G0t0~0",
        "A resposta do servidor est",
        "9T9[9p9",
        "PerformMediaUpdate",
        "Nepoda",
        "XVMNF-PH2KF-HXQ3B-RGMDV-DRR9Y",
        "5!656>6E6",
        "tX9~<t",
        "USER32.dll",
        "CDlpActionCompat::ResolveCommandAsync",
        "d79e0e39-3b23-a099-2087-1048430e31d4",
        ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpResponse@@@@@@@@",
        "7w7~7",
        "eW[L0",
        ">.>L>",
        "inappropriate io control operation",
        "Setup360Extended",
        ">(>/>]>s>z>",
        "a863dec6-3d20-1a9a-8081-3f7046f8813c",
        "PreFinalize: Queue Request for driver migration",
        "D9YBH-FYJ7G-4GB6T-B7DK4-FWWJ7",
        "RestoreDirMetadata: RestoreFileInfo failed",
        "WIM_Enumerate_Directory_Reparse_Point",
        "VXW7P-QKN37-XTGGH-4DRTM-43KQ6",
        "<&<Y<1=",
        "TD97P-9TNMT-J8QRH-348HQ-H24BV",
        "?Y?c?",
        "K2NTV-4XTJY-7FC94-7C9HH-DRR7W",
        "rm-CH",
        "7.7F7c7",
        "DiskSpaceReq: Polling scan timeout occurred.  Exiting.",
        "DataMigration: Queue Request for oobe.cmd file migration",
        "JWBTN-M49F6-6RFC3-BFR3Y-X4VYV",
        "1/363@3l3",
        "JQTWJ-NCQQD-XDD7P-F278F-HQWVV",
        "4952426b-d534-f1a3-3a66-40bb2f9a9c6c",
        "Microsoft.Windows.98.X20-29567_8wekyb3d8bbwe",
        "NRMBT-TGK4V-4RFD7-HFMH4-CR4C2",
        "3-373E3k3v3",
        "CDlpActionActivation::ExecutePollingScan",
        "Microsoft.Windows.4.X21-83176_8wekyb3d8bbwe",
        "3 383T4[4",
        ">.>O>",
        "Microsoft.Windows.175.X21-41297_8wekyb3d8bbwe",
        "818;8h8r8",
        "DUImage: Initializing DU Sandbox Path:           [%s]",
        "tta eftersom en ",
        "Odpov",
        "99:S:b;};",
        ":1:6:>:",
        "151Y1w1(2B2Q2e2",
        "DUImage: Initializing DU Channels:               [0x%X]",
        "Target OS: Detected Source DomainJoined = [%s]",
        "RestoreMountStub",
        "Microsoft.Windows.99.res-v3265_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::GetSerializeOnProgress",
        "towupper",
        "dda860a3-3a9d-6c28-f5c9-cc7c982ee22b",
        "W269N-WFGWX-YVC9B-4J6C9-T83GX",
        "Microsoft.Windows.98.X19-99579_8wekyb3d8bbwe",
        "UnregisterTraceGuids",
        "0ec42cc5-2b09-a734-1bb9-ff00e4a52d46",
        "1.2]2",
        "11181G1e1",
        "NWFGV-2B6FY-RWD28-FM6XR-7H7CK",
        "707L7",
        "KERNEL32.dll",
        "dala po",
        "GetDriveTypeW",
        ":8:D:d:p:",
        "mn-Mong-MN",
        "Activation: Error reporting telemetry for bActivationBlockFound: [0x%X]",
        "CDlpActionDebuggerOptionsFactory::CreateInstanceRoutine",
        "Microsoft.Windows.119.X20-35536_8wekyb3d8bbwe",
        "%EDU_N%",
        "t(9\\$",
        "CDlpActionFinalize::DeserializeRoutine",
        "MoSetupPlatform: Setup Platform object resurrected!",
        "t}WhpC",
        "CDlpActionDiskSpaceReq::InitializeRoutine",
        "7c838941-1d04-809a-f8d4-1b5cba8b80c3",
        "El sistema no supera el examen de compatibilidad controlada para instalar la actualizaci",
        "smj-NO",
        "\\Windows\\System32\\Config\\FP",
        "DiskSpaceReq: Drive [%c] has enough free disk space",
        "L$8;U",
        "Microsoft.Windows.165.X21-11812_8wekyb3d8bbwe",
        "=\"=>=M=#>",
        "MoveCaptureNode",
        "Der Installationsvorgang wurde unerwartet beendet.%0",
        "o foram resolvidos dentro do limite de tempo necess",
        "NX2BK-Y2GR2-XP7XQ-WFJPG-Y99YT",
        "7187cd9c-190f-99cd-23de-ad2be6c96851",
        "808M8t8",
        "SetupUpdate",
        ">#>d>|>",
        "2d047180-9be9-1907-6abd-779ef08955c1",
        "f55425ba-2dab-7616-98a2-9a37c26bf45a",
        "ba517a10-4f95-fb56-6f38-88130f8127f0",
        "Microsoft.Windows.98.X19-99594_8wekyb3d8bbwe",
        "3R7NT-MTX6X-WJ3X8-KJY2B-7MKTQ",
        "CDlpActionDU::ExecuteFacilitatorDUSetup",
        ", Kald",
        "A precommit script failed to execute or returned an error.%0",
        "MediaUpdateAgentPath",
        "QNH8Y-PG6KP-C7MDM-CX9XP-TMT64",
        "59e9a3b2-1229-5b81-7fa1-759e94640887",
        "9$9,949@9d9l9t9|9",
        "laton, ",
        "relsen ikke kan genoptage den tidligere startede opdatering.%0",
        "ProductKey: Error reporting telemetry for dwIsDefaultKeyUsed: [0x%X]",
        "cutable GatherOsState a une signature non valide.%0",
        "4O4\\4q435",
        "lasztott ",
        "1f17335c-cf9a-6bcf-702b-f4f7f2805f6c",
        "WGPNC-FBRQ4-QQDFV-T7W6Y-92FCB",
        ":':,:a:n:",
        "UseStorageReservesForDownload",
        "CopyFileExW",
        "ZwSetSecurityObject",
        "DebuggerOptions: Enabling 1394 debugging -> [%d]...",
        "PT3N7-CYHX6-8FPDY-X4QGF-4X8WB",
        "3NR8Y-GF6BG-MFBP8-88K8G-BP2JH",
        "m_PropertyCache.Allocate(m_LayoutCache.TotalObjectCount())",
        "Ein Skript hat das Zeitlimit ",
        "ForcePrepareTIForReserveInitialization",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionFinalizeFactory@@VCDlpActionFinalize@@@@",
        "<,<7<c<n<",
        "Microsoft.Windows.101.X20-00913_8wekyb3d8bbwe",
        "Microsoft.Windows.101.X20-35487_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X19-99583_8wekyb3d8bbwe",
        "si adatok ",
        "ivityksen asentamisen laitetarkistusta.%0",
        "2'2S2^2",
        "SetupCore: Registered PACKAGE_MIGRATE action",
        "CDlpActionDU::DeserializeDUSetup",
        "f0a3dca6-a844-098e-3089-5941860dd619",
        "WG9KW-BN636-QYD9H-GMM3B-G3CRH",
        "f086dc52-d4f9-a295-1603-72eda3df9f66",
        " stato completato entro il limite di tempo richiesto.%0",
        "WIM\\IMAGE[*]\\WINDOWS\\PRODUCTNAME",
        " licencyjn",
        "Microsoft.Windows.50.X21-83784_8wekyb3d8bbwe",
        "5868cc83-42b8-8bb5-c811-de9fe5644c22",
        "Microsoft.Windows.48.X19-99714_8wekyb3d8bbwe",
        "ad92ed9b-6671-9bc1-851a-beb8c6143183",
        "Es wurde kein Installationsimage f",
        "5*6A6s6",
        "19150a00-7b00-d84a-598a-23d65dc76f4a",
        "1\"1-1<1M1",
        "HYKKP-B7NJF-GD7KB-3X98Y-PR4CF",
        "es.%0",
        "DriveLetter",
        "1b52dbdf-381e-6939-a314-cb46f0d80465",
        "708=8x8",
        "DataMigration: Migrating FlightData [%s] into Target OS...",
        "Microsoft.Windows.4.X19-98711_8wekyb3d8bbwe",
        "nytelen parancssori argumentummal indult el.%0",
        "CheckHotPluggableDrive: Drive %c SetupDiGetDeviceInterfaceDetail-1 Error: 0x%X",
        "Microsoft.Windows.21.X18-81298_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X20-29584_8wekyb3d8bbwe",
        "Pj2jl",
        "QWHVM-3NKBV-TWJ8J-FHRMW-7FTF8",
        "UncompressFileBase",
        "STATUS_SXS_FILE_HASH_MISMATCH",
        "ae3df061-e97e-4cb6-bc65-036adf63aa31",
        "V4YDN-QP7WF-2499K-KDHD2-2DMM2",
        "kernel32",
        "CreateDirectoryW",
        "es-CR",
        "2_2m2",
        ";';-;R;Z;u;",
        "es-VE",
        "Microsoft.Windows.49.X19-99725_8wekyb3d8bbwe",
        "o mais atualizada da configura",
        "CDlpActionPreFinalize::ResumeRoutine",
        "%systemdrive%\\Windows\\Setup\\Scripts\\update",
        "tZhx*",
        "DiskSpaceInstallReq: Initializing Critical paths         [%ld] [%s]",
        "578a9953-4dc8-9834-6a6c-f11c5909bd67",
        "st innen tidsfristen.%0",
        " k dispozici.%0",
        "Microsoft.Windows.8.X21-83722_8wekyb3d8bbwe",
        "Microsoft.Windows.48.X20-35539_8wekyb3d8bbwe",
        "MicrodomWriterImplementation::CMicrodomWriter::CreateInterface",
        "*ppObject = State->m_pAllocator->Allocate<ActionListDocument>()",
        "sr-Latn-RS",
        "Microsoft.Windows.7.X21-83684_8wekyb3d8bbwe",
        "hr-HR",
        "The requested attribute is not supported.%0",
        "SystemPhysicalMemory",
        "s let",
        "UTF-8",
        "BBHB3-GNRMD-48PJ9-QKYKJ-7FR72",
        "T$@j[P",
        "a1fb5b8f-d7ab-f2db-3f1b-ba2449cabd5a",
        " operace vr",
        "NtQueryDirectoryObject",
        "15c99cc4-84f9-621d-6881-19b5211d80ec",
        "3N46B-F8R7T-BM6CV-TRTMX-T83GY",
        "Microsoft.Windows.8.res-v4310_8wekyb3d8bbwe",
        "5d277d9e-6ef6-b89c-a8ab-5a9c723378ca",
        "MajorVersion",
        "afc58d1b-7524-6777-6564-da0eadf469db",
        "ultimatee",
        "3\"4Y4`4m4{4F5`6",
        " Microsoft Corporation. Med enerett.",
        "ioctl: setting reparse point tag failed",
        "o em disco para baixar a carga.%0",
        "PreFinalize: Initializing Target:                           [%c]",
        "FTXYN-HFX89-BD3GK-VBYY6-VCFBG",
        "PVR6H-NTGD7-BQ7X4-93Q9R-MWRDD",
        "Microsoft.Windows.8.X21-83718_8wekyb3d8bbwe",
        "r installationen l",
        "0L0lQ",
        "Microsoft.Windows.125.X20-35519_8wekyb3d8bbwe",
        "8670dbb1-c29b-3fbc-c0cb-dd9c437ce962",
        "o foi iniciado com um argumento de linha de comando inv",
        ":N;Y;",
        "not supported",
        "J3DVD-NVHDM-PH9B8-HCTYB-TXXQR",
        ";y-{e",
        "en-US",
        "Microsoft.Windows.7.X21-83729_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::GetState",
        "7:8G8N8Y8",
        "<)=9=@=o=",
        "j\\Zf9",
        "sv-SE",
        "Microsoft.Windows.171.X21-24741_8wekyb3d8bbwe",
        "dzia nie jest obs",
        "InstallFlowConstraint",
        "2WYPR-GMN23-BYCHW-6P6WD-QRR7H",
        ".?AVCDlpActionPreFinalize@@",
        "4/4D4y4",
        ";q;M<U<}<",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionRecoveryFactory,class CDlpActionRecovery>::SetActionId",
        "Unknown",
        "=.=4=M=T=c=j=v=",
        "sto na disku pro instalaci datov",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionImageDeployFactory,class CDlpActionImageDeploy>::GetActionId",
        "Operacja oczyszczania po poprzedniej pr",
        "PerformSilentCleanup: Failed to call PerformTriggerStorageCleanup",
        "DownlevelActivation",
        "InstallNow",
        "Automation: Registered INSTALL_NOW_OR_LATER Response",
        "se el",
        "corearm",
        "CreateReportFromFile",
        "tBj\\P",
        "Microsoft.Windows.161.X21-03402_8wekyb3d8bbwe",
        "Extended",
        "9U:b:i:",
        "=#>/>",
        "CDlpActionDataMigrate::ExecuteRoutine",
        "Microsoft.Windows.49.X21-03401_8wekyb3d8bbwe",
        "vel criar nem destruir a mensagem de bloqueio de desligamento.%0",
        "PVVh<",
        "Der Benutzer hat die Lizenzbedingungen nicht innerhalb des erforderlichen Zeitlimits akzeptiert.%0",
        "; OS.%0 y",
        "Die ausf",
        "9*989",
        "Failed to copy source string to destination",
        "%s: Entering Response Execute Method",
        "ci miejsca na instalacj",
        "FveDetectTelemetry",
        "5a2925ca-d90d-9e10-8164-96659371f9ff",
        "707m8",
        "too_many_files_open",
        "Microsoft.Windows.171.res-v3854_8wekyb3d8bbwe",
        "compresser le m",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::Deserialize",
        ":&;1;i;",
        "RtlDuplicateLUnicodeStringToLUtf8String",
        "sPublishedMedia\\Files",
        " wiersza polecenia programu setup.exe tylko do przeprowadzenia skanowania, a nie do zainstalowania systemu operacyjnego.%0",
        "7,878j8u8",
        "Environnement de r",
        "lla avinstallationsalternativet.%0",
        " Lisans Ko",
        "%d.%d.%d",
        "6NDBM-3HP48-KJMTX-BY298-YP2JB",
        " csomagokat.%0",
        " wstrzymany.%0",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteRawString",
        "VWj(j",
        "<<=M=",
        "ndaren har k",
        "fullUpgrade",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::SetProgress",
        "nia wymaga",
        "The system does not pass the requirements for desired migration choice.%0",
        "Microsoft.Windows.171.res-v3855_8wekyb3d8bbwe",
        "ch instalace ",
        "ProductKey: Product key found in Host OS.",
        "XNQ6Q-JMCQ9-JG299-3T7VJ-QDCRJ",
        ";4<A<m<x<",
        "Microsoft.Windows.48.X19-98808_8wekyb3d8bbwe",
        "ytkownik odrzuci",
        "vel reportar eventos.%0",
        "8ab45de3-7fc0-8837-0c8b-9ee8af73f100",
        "Microsoft.Windows.49.X19-99512_8wekyb3d8bbwe",
        "Microsoft.Windows.8.X21-83696_8wekyb3d8bbwe",
        "F8KCB-XNVH7-XJXH8-R782J-VH776",
        "u;9_0t6",
        "79a56b8c-592c-8bd3-766d-d9fa01dd6341",
        "-besturingssysteem",
        "rv.UcsCharacter < 0x110000",
        "807d73a3-33f2-c21b-c47a-85c313d97af9",
        "Microsoft.Windows.48.X19-98796_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::ExecuteResponse",
        "d45dd9ed-f352-aefc-bc17-e3ad4d8c9525",
        "Microsoft.Windows.98.X20-29571_8wekyb3d8bbwe",
        "o da ferramenta n",
        "SetupDiEnumDeviceInterfaces",
        "SystemLanguageFromSkulib",
        "DUImage: Facilitator DUImageResult: [0x%x]",
        "stat. failed",
        "timed_out",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::Initialize",
        "eeaa6187-c287-b7a0-75c3-718266d6d937",
        "0O0c0",
        "J8FBX-NT2GD-MXXWX-4W4MQ-FM63J",
        "a9e2b33f-4534-2d78-8ed0-fef66981824c",
        "Compatibility: Device-Actionable Block NOT found.",
        "A Plataforma de Configura",
        "en-MY",
        "?\\?l?",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::CheckUserInterrupt",
        "JBWQB-VNWQG-93G4V-R23W8-9TP2Y",
        "charger et d",
        "8a8fb214-a939-70a7-ecc3-594f7133c295",
        "Microsoft.Windows.17.X17-36806_8wekyb3d8bbwe",
        "=+=H=M=",
        "CMicrodomBuilder::WriteXmlDom",
        "900de5cb-acf2-fbc8-f711-75728dadfb14",
        "DataMigration: Initializing ActionListPath:     [%s]",
        "ra meddelandet om blockerad avst",
        "D$ ;D$",
        "9GNJJ-DMCCH-J66PX-WCGMF-KBT32",
        "H9TTN-VGX68-6WX86-KJT7B-7MHYG",
        "GetFileVersionInfoExW",
        ">;?\\?|?",
        "Microsoft.Windows.120.X20-19835_8wekyb3d8bbwe",
        "Microsoft.Windows.7.X21-83726_8wekyb3d8bbwe",
        "0k0W0f0J0O0S0h0",
        "ar-OM",
        "WINTRUST.dll",
        "The provided automation information was invalid.%0",
        ">=?}?",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::Serialize",
        "RtlIsLUtf8StringValid(NamespaceURI) || (NamespaceURI == 0)",
        "B228C-4HNV4-KXB9T-Q62MF-KBV4R",
        "98NKH-VW7G3-6K3BF-22TVH-DRV4K",
        "State",
        "Failed to get system store path. Status: %x",
        "Microsoft.Windows.188.X21-99378_8wekyb3d8bbwe",
        " laste ned oppdateringen.%0",
        "d19a41e5-21f7-0658-3a74-42fd23486516",
        "S(_^[",
        "CumulativeUpdate",
        "CMicrodomUpdateContext::CreateVirtualComment",
        "Microsoft.Windows.49.res-v3314_8wekyb3d8bbwe",
        "Microsoft.Windows.99.X19-99657_8wekyb3d8bbwe",
        "W9NV9-HCFTP-DB7WX-RMJ2V-BDXRX",
        "c2332c5e-f14c-f2f1-67f1-452cfdf5dd26",
        "Microsoft.Windows.49.X19-98819_8wekyb3d8bbwe",
        "letim Sistemi",
        "UpdateMedia: Initializing OneSettingsSetupVersion   [%s]",
        "er ou de d",
        "Et script overskred timoutgr",
        "6/7Z7",
        "1cf35b66-bb4b-7009-ffb1-a8dc39ffa934",
        "6>7p7",
        "embeddeda",
        "7#7Z7x7",
        "nements ne peuvent pas ",
        "CleanInstall",
        "MoSetupPlatform: Upload telemetry data",
        "RtlCreateDefaultMicrodomXmlWriter",
        "8(878B8",
        "Microsoft.Windows.4.X19-98700_8wekyb3d8bbwe",
        "DiskSpaceReq: Cancel was requested",
        "Create_Media",
        "DesktopInplaceUpgrade",
        "MJ6W9-4NRC9-P74PQ-C4448-F3MMY",
        "DNJ2Y-6X8M2-427WB-BYV3T-6F397",
        "0c709f41-c237-aa57-2fe3-81cc880a665b",
        "connection_already_in_progress",
        "STATUS_KEY_DELETED",
        "Found loaded store at key %s",
        "k venter fortsatt. En systemomstart kreves.%0",
        "*ppObject = State->m_pAllocator->Allocate<MediaPackage>()",
        ".?AV?$CZeroInit@VCDlpActionActivationFactory@@$00@@",
        "iminden temizleme i",
        "instance est introuvable.%0",
        "_^u.h",
        "1fe8fbdc-ea29-35b5-4dfa-6874d40e2c8e",
        "5ce027f4-e6ea-421c-331b-343c147ec69e",
        "k-NB}bk",
        "CompatInstallReq: Initializing Telemetry OptIn:           [%s]",
        "j?Yf97tQ",
        "WimCloseImageFile",
        "1.1;1I1",
        "ef5d8ea2-b692-0004-edff-3f7ea784b397",
        "serverhomepremium",
        "3O3X3_3",
        "Microsoft.Windows.164.X21-06164_8wekyb3d8bbwe",
        "DCTRN-JH8PH-HGY4C-X42X6-GMT6R",
        "Microsoft.Windows.4.X19-99700_8wekyb3d8bbwe",
        "ytett",
        "0873c306-63ae-6e1a-f446-bfac35cab4cb",
        "Q9QFR-8GN4F-7BFFB-VH9TH-X763T",
        "a502e74d-73be-ced4-ad56-7f53fa7a4de6",
        "rnyezetben fut.%0",
        "Une version plus ",
        "N9M2Y-DFCFT-FHP3C-486W4-F63CC",
        "4285ea10-fbde-ebca-1120-0fdc50e3209c",
        " procesu, proto",
        "8<9C9i9p9",
        "CDlpActionDebuggerOptions::SerializeRoutine",
        "es de N",
        "Compatibility: Calling Resolve(WICA_UNINSTALL_ALL_RESOLVE_STRING)",
        "LockResource",
        "tte, fordi forekomstens hash-v",
        "N73CM-2VTCR-XFD8X-XCMBB-FGFFP",
        "fen Sie den Paketinhalt.%0",
        "RemoveDirectoryW",
        "PSSSSSSSj",
        "Vdk!q",
        "PerformSilentCleanup: TriggerStorageCleanup not supported.",
        "o do sistema ",
        "4962912c-27e5-a5b4-16e8-e1f58d7fd481",
        "1&1,191_1f1",
        "PackageMigration: Initializing SafeOS Count         [%ld]",
        "CDlpActionProductKeyValidate::SerializeRoutineGetEdition",
        "uje minim",
        "by.%0",
        "3v3}3",
        "QNJWQ-KH7GC-GC7RG-RXJD7-JQMV9",
        "Problemen med minimikraven f",
        "E_NOTIMPL",
        "id-ID",
        "education",
        "The requested attribute does not have write access.%0",
        "Die Installation kann nicht fortgesetzt werden, da der Instanzhash nicht gefunden wurde.%0",
        "3_5i5(7",
        "bereinstimmt.%0",
        "D$ x[",
        "mes d'espace disque de t",
        "9(9K9",
        "<E=l=",
        "ImageDeploy: Prepare system for the installation process",
        "be766819-42ef-642c-f613-d28de62c4500",
        "YTMG3-N6DKC-DKB77-7M9GH-8HVX7",
        "!fExisted",
        "permission_denied",
        "WldpQueryWindowsLockdownMode",
        "4E4k4",
        "Microsoft.Windows.48.X19-98811_8wekyb3d8bbwe",
        "Microsoft.Windows.7.res-v4290_8wekyb3d8bbwe",
        "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4",
        "Installationsservern ",
        "9E9|9",
        ";P;l;",
        "W2VFP-NKXJB-3WVJP-4PKQK-QV74W",
        "CERT_E_UNTRUSTEDROOT",
        "P!\\$0",
        "n no puede continuar porque falta una tarea necesaria.%0",
        "rio de compatibilidade devido a um componente do sistema em falta.%0",
        "Finalize: Error reporting finalize end time(ASMV): [0x%X]",
        "D$,t V",
        "sr-Latn-BA",
        "QTNH3-VBKCC-7GTGY-PRPWD-QRTRT",
        " il sistema non soddisfa i requisiti minimi per il ripristino di Windows.%0",
        "UpdateMedia: Entering execute.",
        "DiskSpace: Uninstall Disabled via rollback option.",
        "9&9<9B9U9k9q9",
        "Inga paket att ladda ned.%0",
        "7f44652b-c883-189d-71d6-df9be586a224",
        "Microsoft.Windows.50.X21-83783_8wekyb3d8bbwe",
        "041;1",
        "90ba8b4e-b981-42ff-c4f9-3d22bb374db1",
        "_except_handler4_common",
        "Duplicate download item: {0}, or out of memory.",
        "e657e638-095c-b338-dc94-29671a549a7f",
        "d2ed86b9-e4bd-7049-ace7-dc438dd3f3c4",
        "NtTranslateFilePath",
        "ProductKey: EI.cfg file did not contain an edition Id.",
        "Finalize: Error reporting extended result(ASMV): [0x%X]",
        "Microsoft.Windows.48.X19-99647_8wekyb3d8bbwe",
        "FACILITY_SXS_ERROR_CODE",
        "28976eae-a54c-1f09-7ad8-dc4de97e7db5",
        "5e19634a-a1e1-6190-f4b6-1966bc03bf9e",
        "pett fel. Az ",
        "MoSetupPlatform: Calling SetupPlatform::INewSystem::RequestPauseOperations...",
        "BUCL::Rtl::Multiply(WorkingBufferSize, MultiplicativeGrowthFactor, WorkingBufferSize)",
        "wo-SN",
        "MNGHX-GBT73-MQC8B-KKD68-JFHKF",
        "la-001",
        "4YNX2-TT84J-HKRVH-YM9BB-39MWX",
        " la ligne de commande de setup.exe pour effectuer une analyse uniquement et non pour installer le syst",
        "NtOpenThreadTokenEx",
        "363H3f3",
        "SkipProductKey",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionProductKeyValidateFactory,class CDlpActionProductKeyValidate>::GetActionId",
        "318468ee-5642-b7ae-09a7-a8bc8a1daaf7",
        "Microsoft.Windows.98.X20-15874_8wekyb3d8bbwe",
        " ei hyv",
        " kulland",
        "ef1c605d-d105-8954-c8c5-89382f029f1f",
        "nimos para descargar la actualizaci",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionActivationFactory@@VCDlpActionActivation@@@@",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::SetProgress",
        "SVWPj",
        "MoSetupPlatform: ExecuteCurrentOperations reported disk full!",
        "7b1deff1-0029-c9d5-4b72-1e9dd7384b35",
        "=k=~=",
        "92ecb840-f632-122a-e9fd-c2b575156386",
        "n se inici",
        "Microsoft.Windows.21.X18-81301_8wekyb3d8bbwe",
        "5b9f7c6e-dc26-bab5-3ee9-575a4f720872",
        "xmlns",
        "Microsoft.Windows.27.X19-98756_8wekyb3d8bbwe",
        "ExecuteInstallReq: Auto selected drive [%c] has enough free disk space",
        " datov",
        "0n0_0",
        "GetSecurityDescriptorDacl",
        "Erro ACCESSDENIED encontrado nos est",
        "2d93cf82-c2cb-ae91-6a76-0efffb8036f6",
        "in ayg",
        "GetProductKeyFromResponse: Response product key is valid.",
        "ersiz imza var.%0",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::Length",
        "CDlpActionProductKeyValidate::ValidateProductKey",
        "4\"5N5",
        "04d06df1-ab57-0dd6-1ba4-8c5df08c85ee",
        "NBHQV-BQC4F-BP4KD-6TBC3-PYVJ9",
        "Microsoft.Windows.48.X20-23648_8wekyb3d8bbwe",
        "PQQhd",
        "Microsoft.Windows.48.X19-98794_8wekyb3d8bbwe",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocument",
        "FNR2C-V6GDR-PDVKM-VG6MD-7T9RF",
        "%ARCH_32%",
        "I problemi di spazio su disco per l'installazione non sono stati risolti entro il limite di tempo richiesto.%0",
        "WMX8Q-7GN9V-RJ2KH-YRG49-WTY6M",
        "UserMigXmlPath",
        "CDlpActionDataMigrate::MigrateFiles",
        "WYPNQ-8C467-V2W6J-TX4WX-WT2RQ",
        "Microsoft.Windows.4.X19-99670_8wekyb3d8bbwe",
        "No se pudo ejecutar un script de error o se devolvi",
        "7VN96-G3R8F-PPHBV-DVGMV-QPFB9",
        "GetSupportedDriveLetters: Failed to CheckReadOnlyDrive on drive [%s]. Error: [0x%X]",
        "4NKRR-W36Y4-48PGV-RHQYQ-4GF9D",
        "Compatibility: Ignoring Dismissible HBs from now on.",
        "2'323^3i3",
        "CDlpActionPreFinalizeFactory::CreateInstanceRoutine",
        "device or resource busy",
        "Microsoft.Windows.162.res-v3920_8wekyb3d8bbwe",
        "Microsoft.Windows.50.X17-54016_8wekyb3d8bbwe",
        "Installationsfilen blev ikke fundet. %0",
        "11a310d0-978a-b65b-2f98-f553a4bf0fe7",
        "MicrodomImplementation::CStringpoolCache::FindString",
        "74ea4260-9a6f-90d1-6006-5da12542d453",
        "Microsoft.Windows.98.X18-15541_8wekyb3d8bbwe",
        " zdarze",
        "Microsoft.Windows.100.X19-99460_8wekyb3d8bbwe",
        "4 4$4(444P4x4",
        "CDlpActionActivation::RescanAsync",
        "PackageMigration: Initializing LangPack Count       [%ld]",
        "DebuggerOptions: Initializing Debugger Channel:  [%d]",
        "[0x%.8x] ",
        "ad06549e-369d-3f73-5106-dc018a4e1b00",
        "o de payload.%0",
        "FlushFileBuffers",
        "ead94952-1f62-1f7a-a533-ed81ca55b4b2",
        "amento est",
        "CDriverCallback::ValidateDriverPackage: Returning the proposed answer. {62960759-F2E8-41F3-8605-52442B9B2E7B}",
        "5ea6fe95-1886-387f-b74a-0d9fb0f22b41",
        "NFCQ2-TJDXD-X6YFX-2JRDM-XBT4X",
        "968ccd2e-128d-61c6-81dc-5faf1b38d9cd",
        "CDlpActionCompat::ExecuteMigChoiceScan: Exit",
        "NJMFF-TXKRR-VG2JY-KMV92-FX8WP",
        "Microsoft.Windows.7.X17-36797_8wekyb3d8bbwe",
        "g hely a telep",
        "GetExitCodeProcess",
        "t1VPQ",
        "nost Odinstalovat aktivn",
        "Activation: Machine is active.",
        "V2NHV-GQ43K-88YJP-JXF3Y-TXX2J",
        "Microsoft.Windows.100.X19-99453_8wekyb3d8bbwe",
        "CDD8N-7MBXW-7XFH9-R388M-7MKPG",
        "PayloadFilePath",
        "? ?,?@?f?t?",
        "UseExtDrive",
        "eSystemManifest",
        "d846c97d-d25f-127b-c30e-b466409297eb",
        "9K:i:",
        "7N7e7",
        "DoNotConnectToWindowsUpdateInternetLocations",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::Resume",
        "lt-LT",
        "mn-Mong-CN",
        "de577544-8db0-d3e8-0ea4-d73bc99ce70c",
        "Installasjonsprosessen krasjet.%0",
        "Impossibile creare l'oggetto diagnostica. Gli eventi non possono essere segnalati.%0",
        "ely telemetrie.%0",
        "Serversvaret er feil utformet.%0",
        "Asennusta ei voida jatkaa, koska j",
        "GetUpdateReserveManager",
        " desteklenmiyor.%0",
        "%d.%d",
        "keniyle ba",
        "263e8f1e-784e-4e23-028f-8e4e23f8f2ef",
        ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VICompatAction@@@@@@@@",
        "<I<]<",
        "3dc4d427-0e39-c53a-6b2c-a801a01f902b",
        "whichElement != Windows::Microdom::Rtl::Element::InvalidValue()",
        "w-t'-L",
        "%hs: Narrator auto launch reg setting is %d",
        "BaseBrd.dll.mui",
        "Microsoft.Windows.4.X20-29628_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X20-39257_8wekyb3d8bbwe",
        "M9P2N-Y3YX6-4VXTK-MCT93-C38YY",
        "__tempE",
        "6!666K6",
        "528effeb-1607-cdd8-9985-eda7b3cc0608",
        "si vizsg",
        "Microsoft.Windows.161.X21-43634_8wekyb3d8bbwe",
        "JFT78-J8N8P-GJ8KQ-R9TVP-KW3PM",
        ".?AV?$CZeroInit@VCDlpActionDU@@$00@@",
        "c3c2a67a-f326-03aa-aec8-e9ce6c5d37ed",
        "CDlpActionProductKeyValidate::ExecuteRoutinePkeyValidate",
        "ges feladat.%0",
        "CLIENT_N",
        "UpdateMedia: Initializing OneSettingsToolUrl        [%s]",
        "5>5`5v5",
        "Microsoft.Windows.99.X19-99564_8wekyb3d8bbwe",
        "MicrodomImplementation::CDomPositionCache::AttachToPositionList",
        "9):]:",
        "ges.%0",
        " palvelin ei ole k",
        "6-6d6",
        "SVWhP",
        "8 888<8D8H8L8P8T8h8l8p8t8x8|8",
        "dfa32a07-4ecf-4922-0d10-4f427e0cae87",
        "Microsoft.Windows.126.X21-83269_8wekyb3d8bbwe",
        "Microsoft.Windows.100.X18-52140_8wekyb3d8bbwe",
        ".?AVCMoSetupDUDownload@@",
        "ImageFinalize: Initializing SetupResult:                      [0x%x]",
        "Het installatiebestand is leeg.%0",
        "DataMigration: Not requesting data file migration.",
        "HFMVH-KCBNC-7TJWY-KXRQY-X4TWV",
        "Microsoft.Windows.145.X21-83700_8wekyb3d8bbwe",
        "Microsoft.Windows.8.X21-83704_8wekyb3d8bbwe",
        "3<4S4",
        "WaitForMultipleObjects",
        "f6ce2f8a-fac2-0556-3330-3fa55691e5d1",
        "CDriverCallback::ValidateDriverPackage: Driver Package Enter {2A35BE4C-47B4-4F01-88C5-11AFF3A4F834}",
        "ace5abbe-50a5-f9e1-dea2-70fdf622a7e6",
        "8cbac387-23fa-83a2-7c36-b2204a918655",
        ".?AV?$CMoSetupActionImpl@V?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskPartitionGetBKeyAction@@@@@@@@@@@@",
        "WN9JT-82JJM-F72Y8-FTKGY-WHVYJ",
        ">A>c>",
        "OemAcpiMsdmTable",
        "ZwQueryValueKey",
        "sr-SP-Latn",
        "totta a folyamatot, mert a rendszer nem felelt meg a friss",
        " un error no especificado.%0",
        "File[*]\\LanguageCode",
        "CWHKR-GNB9F-6JJTC-CQH9D-PYVM2",
        "Microsoft.Windows.101.X19-99533_8wekyb3d8bbwe",
        "PG6ND-KQJY7-HQT2R-XP3DY-JK4HJ",
        "eMoSetupPlatform: Getting current boot entry...",
        "WIMExtractImagePathByWimHandle",
        "RtlCreateHeap",
        "VWRQSU",
        "Setup-Kernaktionen",
        ">$>.>@>X>",
        "Printed name string copy failed",
        "b1552e19-6286-7427-6b54-a3e8f298ca7f",
        "HW4NG-K68YX-W6CXY-9YGRR-DJ49H",
        "=)=V=`=",
        "6)7D7r7",
        " skanowania zgodno",
        "Finalize: Error reporting WindowsUpdateExit(ASMV): [0x%X]",
        "f;D$4u",
        "PQQQV",
        " konsolidovat pro ",
        "ro-MD",
        "mk-MK",
        "7$7,747<7D7L7T7\\7h7",
        "Wn0OUL",
        "WimImageEnqueueOperation",
        "fc26c7c4-6617-97bc-4e12-c099edce44bb",
        "GetTokenInformation",
        "Activation: No response registered.",
        "UpdateMedia: Starting box download",
        "Summary: IsPowerPluggedIn returned [0x%X].",
        "Ein Bereinigungsvorgang eines vorherigen Installationsversuchs steht noch aus. Ein Systemneustart ist erforderlich.%0",
        ".?AV?$CZeroInit@VCMoReserveManager@@$00@@",
        " il sistema non ha superato l'analisi del dispositivo per l'installazione dell'aggiornamento.%0",
        "NCTJJ-RVFR8-DK2M6-4MDR6-9KXQ6",
        "sr-Cyrl-RS",
        "o foi aprovado pela verifica",
        "1'2;2n2",
        "Microsoft.Windows.98.X19-99595_8wekyb3d8bbwe",
        ">7>r>",
        "Microsoft.Windows.126.X21-03400_8wekyb3d8bbwe",
        ".CRT$XLA",
        "UpdateMedia: Initializing OneSettingsEnabled        [%s]",
        "(Flags & ((0x00000002) | (0x00000004))) != ((0x00000002) | (0x00000004))",
        "7O7w7",
        "RestoreFileMetadata: RestoreFileInfo failed",
        "4N4Y4",
        "Microsoft.Windows.161.X21-83176_8wekyb3d8bbwe",
        "El sistema no cumple los requisitos de espacio en disco para instalar la carga.%0",
        "BASE_CHINA",
        "CDlpResponseAutomation::GetResultsRoutinePkey",
        "e3c8aa33-c828-5deb-88fc-9d2b421fca3b",
        "0,090T0",
        "2c0eae5e-466d-0181-39e1-43472796d8e3",
        ">a?h?",
        "mi-NZ",
        "Microsoft.Windows.126.X21-83178_8wekyb3d8bbwe",
        "DiskSpaceInstallReq: Initializing Perform Silent Cleanup        [%s]",
        " verze je pr",
        ", mert a p",
        "9GG6K-VNMDP-DXDHT-MJCY8-JFJR6",
        "2e01adc7-42a5-fcec-d927-8fa4f11d3a91",
        "HF29H-DFNHX-JKM6X-3XVK2-YKMP8",
        "Microsoft.Windows.7.res-v4295_8wekyb3d8bbwe",
        "Q8NQG-W3WKV-BP27T-KXKHV-X77Y4",
        "Microsoft.Windows.4.X19-99706_8wekyb3d8bbwe",
        "rique ne dispose pas de l'espace disque requis pour le t",
        "Compact",
        "nb-NO",
        "Latauksen levytilaongelmia ei ratkaistu aikarajaan menness",
        "Microsoft.Windows.72.X20-35517_8wekyb3d8bbwe",
        "6913e02f-1813-f7f4-2827-9141879b557a",
        "servermultipointstandard",
        "Compatibility: Uncategorized Block NOT found.",
        ">+?C?",
        " pliku wykonywalnego GatherOsState.%0",
        "lo-LA",
        "2+2Z2",
        "Microsoft.Windows.188.X21-99372_8wekyb3d8bbwe",
        "t adott vissza.%0",
        "es-BO",
        "Not-null check failed: Source",
        "malloc",
        "7 8R8",
        "%PRO_KN%",
        "Microsoft.Windows.165.X21-06168_8wekyb3d8bbwe",
        "Target OS: Version = [%d.%d.%d.0]",
        "Microsoft.Windows.99.X20-29705_8wekyb3d8bbwe",
        "The requested attribute does not have read access.%0",
        "DUSetup: Enumerating build offer",
        "charger la mise ",
        "7GNT4-DJHXD-VFPJY-384GG-683YC",
        "cf2e0157-a74b-71c7-132a-0cd99abc51a4",
        "Microsoft.Windows.48.res-v3425_8wekyb3d8bbwe",
        "The install cannot continue because the instance hash was not found.%0",
        "Microsoft.Windows.27.X21-83176_8wekyb3d8bbwe",
        "NVFT8-DCMQY-CT6RF-3BDHP-GQ8Y2",
        "[RS5]",
        "Zu$A;",
        "%CLIENT_N%",
        "The system does not pass the minimum requirements to recover Windows.%0",
        "f24f3ce6-bc79-f037-38c5-bd8334b00f61",
        "f8a2b3f9-53ec-1e3e-1c7a-464714784d59",
        " na urz",
        "serverembeddedsolution",
        "WKKYN-2TTTP-2B4V7-MGFHY-YWRCC",
        "1ed2dcf6-08a1-f5a8-b60f-81950a55671d",
        "Microsoft.Windows.50.X17-54018_8wekyb3d8bbwe",
        "5L6p6",
        "Microsoft.Windows.146.X21-83744_8wekyb3d8bbwe",
        "229879+4583620",
        "GetDeviceNumberFromPath: Drive %s CreateFile returned Error: 0x%X",
        "Substitue name string copy failed",
        "b06f3b0a-4496-5399-9e6a-fb51a037767d",
        "T9DFN-TBX82-V7K77-3RY48-VH8XK",
        "4C4m4",
        "Microsoft.Windows.135.X20-43106_8wekyb3d8bbwe",
        "b64f0e2a-d3d8-b2bd-7980-6310d7929278",
        " v testovac",
        "<$<2<b<",
        "kning, inte f",
        "EDU_K",
        "1A1\\1",
        " sorunlar",
        "serverhypercore",
        "4:5U5g5",
        "2u3-4o4",
        "TPRN8-XBWGX-TK6QT-GKKMD-7T9QV",
        "A GatherOsState v",
        "rios.%0",
        "RtlReallocateLBlob",
        "Failed to enumerate boot entries. Status: %x",
        "BootFinalize: Initializing Extended:                   [0x%x]",
        "C72WR-KQNKK-K2JHF-B92YK-M99C4",
        "L$D_^[3",
        "IgnoreDismissibleHB",
        "si folyamat megk",
        "2,2i2",
        "9:9A9",
        "MigChoice: Auto Response has an invalid answer: [%ld]",
        "grehajt",
        "BcdCloseStore: Failed to acquire BCD sync mutant. Status: %x",
        "PackageMigration: Initializing SSU Count            [%ld]",
        "Problemy z miejscem na dysku przeznaczonym na instalacj",
        "CMicrodomBuilder::ConsumeAttdef",
        "Failed to delete \"%ws\" variable. Status: %x",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionPackageMigrateFactory,class CDlpActionPackageMigrate>::GetActionId",
        "t Sh ",
        "wcsstr",
        "?\"?)?K?l?",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionPackageMigrateFactory,class CDlpActionPackageMigrate>::CreateAction",
        "ra GatherOsState-filen.%0",
        "9!9%9)9-9=9",
        "GetFileVersionInfoW",
        "ZwReleaseMutant",
        "CMicrodomBuilder::CFourStringIdTable<unsigned short>::Initialize",
        "timed out",
        "Windows::uDom::Rtl::RtlMicrodomUpdateCreateElementNs",
        ".?AVCDlpActionDUFactory@@",
        "L$$QPh",
        "DUSetup: Setting progress callback for payload SetupDU",
        "Asennusta ei voi jatkaa, koska viimeistelytoimintoa on jo pyydetty.%0",
        "O utilizador optou por cancelar, uma vez que o dispositivo n",
        "Die Speicherplatzanforderungen zum Herunterladen und Entpacken von Medien werden vom System nicht erf",
        "2B7BM-NFQFX-XKGFX-2W7QF-3DBP2",
        "44VVN-KQQGY-2FR3C-XFFC4-9W4H4",
        "GTF7R-4NQ6M-CVCDM-TH442-4RJTB",
        "SessionId",
        "MoSetupPlatform: Releasing NewSystem object...",
        "serverwinsb",
        "LowCostDeviceMode",
        "3b512a7a-a766-26c2-d853-8c7de76e95d6",
        "KHFM3-NW7PC-GYV6D-6YBQB-RC4BJ",
        "Nejde vytvo",
        ":d;j;",
        "ProductKey: Product key is invalid. (Invalid Format)",
        "DUCategoriesOneSettingsFlag",
        " olmad",
        "CDlpResponseAutomation::GetResultsRoutineMigChoice",
        "3E3R3{3",
        "44f65b03-ab1a-483e-6fc2-d520edf90291",
        "d11bc417-12c7-60a8-a597-831853795fdb",
        "g hely a let",
        "CERT_E_UNTRUSTEDCA",
        "<;<E<S<p<{<",
        "scarletthostos",
        "CDlpActionDUFactory::CreateInstanceRoutine",
        "Operativsystemet Microsoft",
        "lmedi.%0",
        "Sistema Operacional Microsoft",
        "Il sistema non soddisfa i requisiti di spazio su disco per il download e la decompressione del supporto. %0",
        "WMDGN-G9PQG-XVVXX-R3X43-63DFG",
        "nyeknek.%0",
        "Microsoft.Windows.21.X18-81300_8wekyb3d8bbwe",
        "Il sistema non soddisfa i requisiti di spazio su disco per il download del payload.%0",
        "6c9c8c4f-bb49-2330-3322-1d66c6ef55a5",
        "RN72X-8QMJ9-M9KTQ-RRQK2-8XFFF",
        "7YWP7-YN82T-3BPHM-VY2JB-6VJ48",
        "resource deadlock would occur",
        "SecureStartupPremium",
        "D$8SVW",
        "6;6F6T6m6x6",
        "4NMT4-HB48K-RFR8K-TVTRQ-9D7YB",
        "Microsoft.Windows.99.X19-99653_8wekyb3d8bbwe",
        "Compatibility: Something went wrong during Polling.",
        "0:1N1U1",
        "t$ PhTB",
        "narrator",
        "ExecuteInstallReq: Getting disk space requirement using drive letter [%c].",
        "De gebruiker heeft ervoor gekozen om te annuleren voor de licentieovereenkomst.%0",
        "es-CL",
        "Microsoft.Windows.168.X21-83758_8wekyb3d8bbwe",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FveDetect\\Cache",
        "DiskSpaceInstallReq: Initializing LXP paths              [%ld] [%s]",
        "Microsoft.Windows.101.X20-15864_8wekyb3d8bbwe",
        "384F4b4",
        "3aa55fc0-63cd-bbf6-6341-53bc4b75cb47",
        "sinstallation active.%0",
        "13a4c02e-1160-b56b-d637-b03a36305a6f",
        "bfd6de38-33ea-0d8a-303f-7d27429894b0",
        "Immagine di installazione non trovata.%0",
        ";D<O<k<",
        "wietli",
        "Questa versione dello strumento non ",
        "Microsoft.Windows.101.res-v3262_8wekyb3d8bbwe",
        "CDlpActionDiskSpaceReq::InitializeDownloadReq",
        "Microsoft.Windows.99.X19-99576_8wekyb3d8bbwe",
        "HeapFree",
        "145a47b4-e8db-e31c-07d0-485b93214bc1",
        "swscanf_s",
        "=Z=a=",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::GetSerializeOnProgress",
        "DUImage: Initializing GDR Path:                  [%s]",
        "e2949e60-8fca-9383-c923-5b773ab3cf8f",
        "D$ SVW",
        "?A?~?",
        "Failed to add system store from file. File: %ws Status: %x",
        "Microsoft.Windows.165.X21-06173_8wekyb3d8bbwe",
        "6MNDJ-WFKGG-C8VP8-44MCH-3J3XF",
        "1B2[2b2",
        "CDlpActionDiskSpaceReq::ExecutePollingScan",
        "ti.%0",
        "n de la herramienta no es compatible.%0",
        "kok-IN",
        "0x%08X",
        "onecoreupdateos",
        "Impossible de continuer l'installation, car l'espace disque du syst",
        "Underh",
        "fr-CA",
        "9NJHV-KTFQX-WH62R-8JGCG-Y98VW",
        "DOCTYPE",
        "ChunkWriterFlush",
        "Microsoft.Windows.98.X19-99430_8wekyb3d8bbwe",
        "e n'ont pas ",
        "Microsoft.Windows.101.X20-17624_8wekyb3d8bbwe",
        "ole32.dll",
        "B8HXJ-GKN7Q-B9FTG-T7HWP-4RG4C",
        "n palauttaminen.%0",
        "Microsoft.Windows.121.X19-98885_8wekyb3d8bbwe",
        "lni.%0",
        "83XNG-JQFK8-KB3XG-PR3BP-HH74Q",
        "Failed to get system partition. Status: %x",
        "f284e5ea-2420-cbca-966f-804211a626e3",
        "4V7NJ-MQKCW-VYTFX-DX6JD-QRT4B",
        "TR8V6-X3N8K-X6263-KWD88-Q69Q6",
        "Le processus d'installation ne s'est pas termin",
        "DataMigration: Failed to read WebSetup image index Hr=[0x%X].",
        "G3NDH-4B69M-9DQWK-BMBWC-PGYM4",
        "YNG9G-C88QB-B88K9-BWWQ8-6MVCK",
        "CDlpActionCompat::ExecuteSysReqScan",
        "Microsoft.Windows.49.X19-98861_8wekyb3d8bbwe",
        "Microsoft.Windows.4.X20-00862_8wekyb3d8bbwe",
        "MoSetupPlatform: ExecuteCurrentOperations was cancelled!",
        "Microsoft.Windows.48.X20-29719_8wekyb3d8bbwe",
        "Microsoft.Windows.99.X20-29707_8wekyb3d8bbwe",
        "H46W6-R87G2-6J6Y3-YF2WY-7MG4F",
        "L'utente ha scelto di annullare l'operazione perch",
        ".?AVIFCPayloadCallback@@",
        "Ocorreu um erro e o valor do resultado tem de ser consolidado para efeitos de telemetria.%0",
        "RtlCreateSecurityDescriptor",
        "ImageDeploy: Initializing BitLocker Mode:        [Keep Active (Best-Effort)]",
        "CDlpActionGetWebSetupUserInput::GetMediaFormatFromResponse",
        "3(3=3N3c3",
        "s a felhaszn",
        "executable format error",
        "Failed to modify boot entry 0x%x. Status: %x",
        "Microsoft.Windows.180.X21-83665_8wekyb3d8bbwe",
        "*ppObject = State->m_pAllocator->Allocate<Downloads>()",
        "f8ba57f0-1ce1-a38b-0fc3-dde2dc37d12b",
        "C784F-9KNXX-YWYKK-2FCMP-RVV2F",
        "MainOS",
        "Microsoft.Windows.8.X21-83697_8wekyb3d8bbwe",
        "5<LuP",
        "e1c3e041-b0cb-177c-6729-8a35d4b9fb94",
        "The Setup Platform has encountered an unspecified error.%0",
        "The system does not pass the minimum requirements to install the update.%0",
        " la configuration minimale requise pour t",
        "rios necess",
        "Microsoft.Windows.48.X20-29661_8wekyb3d8bbwe",
        "w<9w@t",
        "GetWebSetupUserInput: Execute: Download file size X86 = [%llu].",
        "4def0f41-4626-e08e-8c7c-cbdc702d851e",
        "WVDHN-86M7X-466P6-VHXV7-YY726",
        "lan ACCESSDENIED hatas",
        "pDoctype->ulSignature == ('tDdM')",
        "CDlpActionActivation::QueryInterface",
        "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Flighting\\Build",
        "RtlXmlDefaultCompareStrings(&m_State.ParseState, Left, Right, pResult)",
        "74R7N-QX2QT-69CQ2-K2BPC-BTDYP",
        "4D4w4",
        "9N9WF-7QKQ2-2W69C-92GWG-J2QY3",
        "6781637f-9fdf-398e-3dd0-016bc23c255f",
        "Er wordt een beter bijgewerkte setup-versie gestart om de installatie voort te zetten",
        "6DWFN-9DBPB-99W4C-XYWKQ-VXPFM",
        "Microsoft.Windows.4.X19-99699_8wekyb3d8bbwe",
        "CDlpActionFinalize::ExecuteCompatFinalize",
        "Microsoft.Windows.146.X21-83738_8wekyb3d8bbwe",
        "9K:\\:~:",
        "Herstelbewerking van OS gevonden die nog in behandeling is.%0",
        "DosDateTimeToFileTime",
        "%s\\Partition%lu",
        "22bef844-58c2-85ad-a9ed-618dfad2fad4",
        "CDlpActionDataMigrate::MigrateEulaAccepted",
        "Microsoft.Windows.8.res-v4307_8wekyb3d8bbwe",
        "A more up-to-date version of setup will be launched to continue installation",
        "Bugcheck driver INF name",
        "ur-PK",
        "1fea6576-6b7a-0139-b7a0-115eec2ef933",
        "L$<_^[3",
        "CDlpActionCompat::SerializeRoutine",
        "ar-EG",
        "m_StoredTable.FindOrInsertIfNotPresent(Pair, pAttDef)",
        "Microsoft.Windows.125.X21-83681_8wekyb3d8bbwe",
        "owy podpis. %0",
        "Microsoft.Windows.121.X20-00862_8wekyb3d8bbwe",
        "fr-SN",
        "Microsoft.Windows.100.X19-99438_8wekyb3d8bbwe",
        "en-ZW",
        "tL0-N",
        "5)5L5f5",
        "rt eller returnerede en fejl.%0",
        "Microsoft Corporation1",
        "\\VarFileInfo\\Translation",
        "DebuggerOptions: Initializing Debugger NoDHCP:   [%s]",
        "7NY2F-2RPB3-TJ734-YW6TM-B4HCK",
        "ndaren har valt att avbryta eftersom systemet inte klarar kompatibilitetskontrollen f",
        "RK3P8-FNTGF-B8338-63JD9-DYHY9",
        "ivatel p",
        "MoSetupPlatform: Failed to set Correlation vector. [0x%x]",
        "Not-null check failed: Context",
        "zenetet.%0",
        "2QW8H-7RNHB-MPWPJ-8RJDT-V6D27",
        "lla Windows.%0",
        "CDlpActionPackageMigrate::PauseRoutine",
        "Channel",
        "rjestelm",
        "Microsoft.Windows.50.X17-54019_8wekyb3d8bbwe",
        "27FB3-G8NKF-X8RGK-GDBV6-7226C",
        "Microsoft.Windows.50.X21-83790_8wekyb3d8bbwe",
        "41ee95c5-4cc6-5369-1ea3-8a0a3b35c166",
        "Microsoft.Windows.80.X18-81293_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::ExecuteResponse",
        "DataMigration: Skipping Request for OC replication",
        "><?c?",
        "DUImage: Latent Acquisition Action List Path [%s]",
        "SetupDiGetDeviceRegistryPropertyW",
        "082849c1-922a-8684-dea5-71363faa51f7",
        " avec un argument de ligne de commande inconnu.%0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::Prepare",
        "Microsoft.Windows.98.X20-35495_8wekyb3d8bbwe",
        "8ffa2de3-a844-431a-09bf-f02da3853561",
        "lony b",
        "8G9{9",
        "22331f5f-cef7-8bde-2c3b-204280861647",
        "ily v po",
        "ae575973-4b94-46de-f946-5c0661f0646b",
        "BNY6R-2PG44-HX6Q2-P4V4F-WFG6G",
        "GN6FF-PBWTQ-PQ73B-7B98T-GMWR2",
        "Compatibility: Device Block NOT found.",
        "TKMKK-8NH9Y-VKD4Y-B2RDD-KKX2M",
        "LicenseStateFound",
        " anulowania dla umowy licencyjnej.%0",
        "B2V2J-RPNXQ-2HB33-4X397-XD8HT",
        "Microsoft.Windows.8.X21-83713_8wekyb3d8bbwe",
        "FWDNG-YRM8C-26J68-348V8-29X9B",
        "ImageDeploy: Initializing SafeOS Image Index:    [%d]",
        "=Q=t=",
        "iu-Latn",
        "b584a45e-438b-0f51-b7df-848a731b845c",
        "8RNJ7-PPRTG-2MJQW-YHK6T-D3WVG",
        "tzm-Tfng-MA",
        "Microsoft.Windows.98.X20-30043_8wekyb3d8bbwe",
        "El sistema no cumple los requisitos de espacio en disco para descargar y desempaquetar los medios.%0",
        "<,=P=",
        "7 8'8R8Y8",
        "DataMigration: Initializing System Language:     [%s]",
        " durante la fase de compatibilidad que requiere acci",
        "WaitForSingleObjectEx",
        "=[>b>r>",
        "JTYNQ-D7RXR-23JKV-M3QTX-8QKRQ",
        "c6b15ef0-61d5-ab48-52fe-a66bf5b9c144",
        "0(0d0",
        "IDREF",
        "N2WHR-HQJ72-WX9PY-62G3P-P92F6",
        "742b3744-ac1d-1e22-076b-6f981e9084d9",
        "ka-GE",
        "kozen",
        "2+363[3f3",
        "na raportowa",
        "9,:[:u:",
        " skanowania urz",
        "?l?}?",
        "Not-null check failed: BytesRequired",
        ";J<W<\\<",
        "2i2t2",
        "N7D4B-D4MJM-7PY9M-JBFGV-VT9RR",
        "6$7V7",
        "wrong_protocol_type",
        "414;4E4O4Y4",
        ".?AVIAutomationManager@@",
        "serverstandardcore",
        "02c2fb2b-9f16-09eb-01f1-355d4b3378a7",
        "The installation process has been halted for testing purposes.%0",
        "Windows::Rtl::CRtlObjectTypeDescription<class MicrodomWriterImplementation::CMicrodomWriter>::CreateInstance",
        "m haklar",
        "c16cf877-fe17-8dfa-b82f-565d05143322",
        "7d3086d5-e46c-410e-9710-5f4ea3c8997e",
        "242W2j2",
        "0eca6d44-b789-3b6a-9b3b-cb6fb76fcd02",
        "bad_address",
        "Windows::Rtl::IPoolAllocator::AddAlignedBlob",
        "MB2VG-4NKDH-BQRX8-K6R8P-BTDGQ",
        "MNPJW-XM6KJ-TKJ7M-3RWW7-8HWGR",
        "o pode continuar porque o sistema n",
        ".?AV?$CZeroInit@VCDlpActionPreFinalizeFactory@@$00@@",
        "cs-CZ",
        "Microsoft.Windows.164.X21-06153_8wekyb3d8bbwe",
        "GUARD_PAGE",
        "Q4B4P-NMXVT-MRTHW-Q98WJ-78RCB",
        "Microsoft.Windows.125.X21-83235_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::DeserializeRoutine",
        "F28RV-NYFK4-FFHV7-QQYRH-462JC",
        "DeleteCompatibilityController",
        "00V0y0",
        "NX6TT-WH4BH-CJC2P-M98B8-33YPV",
        "Microsoft.Windows.49.X20-29603_8wekyb3d8bbwe",
        "1!1H1Q1m1s1",
        "Microsoft.Windows.7.X21-83723_8wekyb3d8bbwe",
        "Failed to set file extended attribute",
        "<*<G<b<",
        "tte installationen",
        ":-:T:h:v:",
        "Microsoft.Windows.100.X19-99456_8wekyb3d8bbwe",
        "m neprojde kontrolou kompatibility s omezen",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::GetActionId",
        "=F>P>",
        "n termin",
        "WimAtExitInitialize",
        "O(9_ptO",
        "fcb31748-5921-4712-fe8a-45ce2529cdf8",
        "Microsoft.Windows.48.X19-98809_8wekyb3d8bbwe",
        "<@<G<",
        "VXDNG-W2YFG-H224H-CGTKM-CWHWW",
        "SystemProcessorCount",
        "TNCQH-C7P33-VG3FM-882K3-97636",
        "F4NHY-FK2RK-BX726-9MWJ2-9QB6P",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::GetProgress",
        "Microsoft.Windows.48.X20-23646_8wekyb3d8bbwe",
        "Microsoft.Windows.119.X20-35535_8wekyb3d8bbwe",
        ":8:@:H:P:`:",
        "Serveren til installationsstatus er ikke tilg",
        "8*8<8d8l8",
        "PublishedMedia\\EULAs",
        "5<5G5x5",
        "serverstandardv",
        "NewChild->Attribute.Allocate()",
        "ActiveScenario",
        "Microsoft.Windows.98.X19-99663_8wekyb3d8bbwe",
        "Microsoft.Windows.101.X19-98878_8wekyb3d8bbwe",
        "NV4W3-THJ3C-62W4W-B3HTH-FJRBY",
        "CMicrodomBuilder::ConsumePCData",
        "Microsoft.Windows.48.X19-98843_8wekyb3d8bbwe",
        "o anterior pendente. ",
        "Microsoft.Windows.8.X17-66952_8wekyb3d8bbwe",
        ".?AV?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskPartitionGetBKeyAction@@@@@@@@@@",
        "CheckHotPluggableDrive: Drive %c SetupDiGetClassDevs Error: 0x%X",
        "@(97u",
        "D$(f9",
        "1(141@1L1X1d1p1|1",
        " ei ole Windowsin palauttamisen v",
        ": :Q:\\:",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::InitializeRoutine",
        "QSVWj2^",
        "674d496b-3d5b-5393-286b-2fba09f649f5",
        "Microsoft.Windows.7.X21-83399_8wekyb3d8bbwe",
        "PackageType",
        "D$(Pj",
        "59a36947-6953-3558-a634-c27ecd560ef7",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0t0|0",
        "<WIM><TOTALBYTES>0</TOTALBYTES></WIM>",
        "9d801308-39fc-5652-8647-a1ef3ae51722",
        "Ainda existe uma opera",
        "2[2h2",
        "7'8p8",
        "RtlXmlInitializeNextLogicalThing(this, &Init)",
        "MoSetupPlatform: Setup Automation object suspended!",
        "Microsoft.Windows.180.res-v4259_8wekyb3d8bbwe",
        ".?AVIFCDiagnostics@@",
        "Finalize: Error reporting mapped result(ASMV): [0x%X]",
        "WimAtExitReserve",
        ".\\%s.mui",
        "6TDNG-YWPDR-W3FDM-WPKTP-7CFC8",
        "b5e97bfd-c03f-88ce-b405-3c4edf9d0007",
        "ntande OS-",
        "Failed to get img event",
        "Sources\\ei.cfg",
        "servermediumbusinessmanagement",
        "Microsoft.Windows.122.res-v3284_8wekyb3d8bbwe",
        ":2:=:o:z:",
        "D$0PQ",
        "NHK7B-F3BDF-42JVF-QXQP3-PYT4Q",
        "M9H87-JN9JF-FHDJ9-67MF6-Y986C",
        "Target OS: Install Drive does not match. Removing install choices...",
        "jl nem tal",
        "%I64x",
        "Microsoft.Windows.100.X20-39259_8wekyb3d8bbwe",
        "A cleanup operation from a previous installation attempt is still pending. A system reboot is required.%0",
        "*WjdWjd",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetXml",
        "ig-NG",
        "R8XF6-NJRHB-3Q4W8-WY92W-K2GB2",
        "95bd2561-e54d-b969-789e-f7d12b386c67",
        "XGXGD-NQRGY-2JBBQ-266HK-RM49M",
        "CloudE",
        "pte az id",
        "ncia n",
        "HeapReAlloc",
        "RtlDeleteCriticalSection",
        "servermediumbusinesssecurity",
        "QQPQQQQW",
        ".?AVCMoSetupCompat@@",
        "RtlFreeSid",
        ":.:[:w:",
        "n uudelleenk",
        "39CRN-27R8Y-8H3BW-834W2-9QB6P",
        "N27GV-J68WH-Q8899-K8QM4-R3K9F",
        ".?AV?$CDlpOSInfoT@V?$CUnknownImpl@UIUnknown@@@@@@",
        "EnumeratePathEx: Unable to get reparse tag for persistent reparse point; GLE = 0x%x",
        "ProductKey: Looking for product key in Pid.txt file.",
        "649cf126-a7d6-5f75-8135-bd52f04bc4d9",
        "Microsoft.Windows.122.X20-29615_8wekyb3d8bbwe",
        " hatal",
        "UpdateNotificationShownCount",
        "Microsoft.Windows.121.X19-98677_8wekyb3d8bbwe",
        "File[*]\\Edition",
        "\\Users",
        "W8VRN-D6776-749GR-V66H2-DC68B",
        "Failed to populate download actions from {0}",
        "2!20272",
        "Fail to read WIM header",
        "CDlpActionProductKeyValidate::GetResultsRoutinePkeyValidate",
        "Microsoft.Windows.101.X20-15875_8wekyb3d8bbwe",
        "tu ve sonu",
        "000H0`0x0",
        "DeleteFileEx: Unable to remove [%s]; GLE = 0x%x",
        "L'utilisateur a choisi d'annuler l'installation, car l'analyse de compatibilit",
        "Microsoft.Windows.144.X20-91395_8wekyb3d8bbwe",
        "File[*]\\Edition_Loc",
        "Finalize: Retrieving downlevel ticks from registry...",
        "06ab7504-d420-3d96-b872-759bf540718c",
        "BASE_KN",
        "PerformSilentCleanup: Failed to create CMoSetupSchTask instance: [0x%X]",
        "SyspartIsSpace failed for partition path: %s",
        "1$2E2T2a2",
        "6C7I7",
        "DH2NC-P6PBY-XB7MT-WBF9Q-Y4G4F",
        "Failed to open process. Status: %x",
        "0#0*0Z0a0w0~0",
        "RWTV4-N4BKJ-CT2Y2-HF7VM-TXXRY",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetItem",
        "6da1a0d7-ddb7-e514-f1d9-a66dd9fe7f3b",
        "GetCurrentThreadId",
        "Microsoft.Windows.125.X21-83233_8wekyb3d8bbwe",
        "Microsoft.Windows.125.X21-83259_8wekyb3d8bbwe",
        "stem na disku pot",
        "iswspace",
        "RtlpGenericMicrodomUpdateGetCookieForExistingThing",
        "Systemet godk",
        "4&4+4",
        "ELEMENT",
        "Microsoft.Windows.121.X19-99607_8wekyb3d8bbwe",
        "N8HYM-T3P4J-C3B93-G9FQJ-JFJTD",
        "FODChecked",
        "CompatFinalizeRequirement",
        "serverstorageworkgroupcore",
        "va vyhrazena.",
        "RtlInitializeSmartLBlobWritingContext",
        "98d54efa-8cc6-f4ee-3f42-f5625e352488",
        "PYBGV-N94P6-PB79J-87RQ7-BDWWB",
        "El usuario no acept",
        "jeblikket. %0",
        "b562e32a-776c-9dde-e5e4-865746bd574e",
        "51566df4-f650-9729-20aa-62c74dece7b7",
        "=8=?=X=",
        "cbaa4126-1412-28e4-1cec-283433c45c30",
        "5QhLu",
        "QNTWT-3MMT6-Y3QVC-FYPHF-369T3",
        "D$0PVj",
        "<==Q=X=s=",
        "ZwQueryInformationFile",
        "ProductKey: Is Machine Active                : [%s]",
        "minVersion",
        "74b7288a-9af9-707e-fc71-50bf6eb3abde",
        "7'8`8j8",
        "Microsoft.Windows.8.X21-83721_8wekyb3d8bbwe",
        "9*919B9I9",
        "A8PSV",
        "ObjectCookie.Opaque != 0",
        "WWWjd",
        "Microsoft.Windows.8.X21-83702_8wekyb3d8bbwe",
        "DigitalProductId4",
        "Sammutuslohkon sanoman luominen tai poistaminen ei onnistu%0.",
        " iptal etmeyi se",
        "040804B0",
        "UseStorageReserves",
        "<(<O<V<",
        ";t$ r",
        "jWX_^[",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::Execute",
        "ExecuteDownloadReq: DiskSpace issuses resolved. DiskSpaceReq polling ends",
        "0c05f7db-8475-a950-0982-f5380e3d24e9",
        "m argumentem p",
        "string size too big",
        "BootFinalize: Initializing Scenario:                   [%d]",
        "SetupCore::Initialize",
        "destination address required",
        "Systemet videresender ikke kravene til diskpladsen for at downloade og udpakke medier med flere arkitekturer.%0",
        "SWjH_Wj",
        "Bugcheck stack",
        "sszeomlott.%0",
        "too many links",
        "5'616^6h6",
        "PackageMigration: Initializing LXP Count            [%ld]",
        "tu wyst",
        "85a21e01-ffe6-be98-6550-0df43124c94b",
        ".?AVIMoOnlineStore@@",
        "Microsoft.Windows.169.X21-14947_8wekyb3d8bbwe",
        "DataMigration: Migrating keyboard layout values under reg key: [HKLM\\%s].",
        "2N694-4XJDK-MGDCF-3V623-YBKPG",
        "BCryptOpenAlgorithmProvider",
        "b15a5952-28ec-b215-3164-10fc800204ba",
        " /ClientId %s",
        "191{1",
        "CDlpActionProductKeyValidate::GetResultsRoutine",
        "9YDXY-4N3FG-8RBT3-JC8B3-VXQFR",
        "FveGetAuthMethodInformation",
        "DUImage: Failed to execute critical search and download [0x%x]",
        "RegCreateKeyW",
        "3c67f521-81a4-8cb6-f140-9e8ed85ce05c",
        "is a directory",
        "GetSystemDefaultLCID",
        " compat",
        "Le processus d'installation s'est termin",
        "o inesperada do cliente Agente de Aplica",
        "Microsoft.Windows.130.X21-83284_8wekyb3d8bbwe",
        "0 0$04080<0@0D0H0\\0`0d0|0",
        "1:2z2",
        "4$4/4J4^4q4",
        "System store path: %s",
        "analogonecore",
        "STATUS_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT",
        "The install cannot continue because the system is out of disk space.%0",
        "Microsoft.Windows.27.X20-35527_8wekyb3d8bbwe",
        "HDCHQ-FNTQ6-XRP3B-RM84V-MBHYJ",
        "Microsoft.Windows.101.X20-15872_8wekyb3d8bbwe",
        "0(un0",
        "p\\O(u-N",
        "8b69a7dc-687c-9b3c-ecf1-d9bc6412ae7d",
        "CDlpActionCompat::ExecuteInstallReqScan",
        "GJW76-WNM7Q-P6RK9-RQJXD-FM47T",
        "De problemen met de schijfruimte voor de installatie zijn niet opgelost binnen de vereiste tijdslimiet.%0",
        "2?3J3",
        "1V1`1t1",
        "901a9565-35e8-40a8-c4f3-b726713688e8",
        "DiskSpaceReq: Migrating LangPacks from [%s] into Target OS...",
        "ncio.%0",
        "P3NFB-3DD4J-8BV29-6FGVP-KW3F2",
        "a07ca41c-282f-abb2-ef37-3e629118dce7",
        "GetWebSetupUserInput: Error reporting telemetry for WebSetupInputSelectedEdition: [0x%X]",
        "Asennusprosessi lopetettiin.%0",
        ".?AUIUnknown@@",
        "HYNWR-MVXJX-6PJHM-BQRHT-RRG3Y",
        "t'hh7",
        "Microsoft.Windows.101.X20-29674_8wekyb3d8bbwe",
        "8WVNW-47G3Q-QFHXC-F678C-D692P",
        "La informaci",
        "ProductKey: Product key target version does not match.",
        " procesu instalace.%0",
        "HMNWJ-V69R6-B2CDC-8P7VT-2373K",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::GetResultsRoutine",
        "serverdatacenterv",
        "Het systeem",
        "Not-null check failed: DocumentNode",
        "nns i enhetsgenoms",
        "Microsoft.Windows.8.X17-36776_8wekyb3d8bbwe",
        "Fail to flush file buffers",
        ";J;T;",
        ".?AV?$CZeroInit@V?$CDlpAutoDelayLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@$00@@",
        "7c28c8d2-8e87-8963-5fb2-810499917d47",
        "kleme g",
        "2(2S2f2",
        "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\utility.c",
        "D$<Pj",
        "f;D$0u",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetMicrodomBinaryRepresentation",
        "e0c7c94d-f5b8-9cb3-4e52-5c4b33d58bb3",
        "2(3P3",
        "PerformSilentCleanup: Running SilentCleanup task.",
        "Microsoft.Windows.146.X21-83752_8wekyb3d8bbwe",
        "sr-Cyrl-BA",
        "5<5z5",
        "lemi hala devam ediyor. Sistemin yeniden ba",
        "CDlpActionProductKeyValidate::CallPidGenX",
        ";2<&=}=",
        "ky ke sta",
        " el l",
        "2994d9fd-eb54-4a48-f763-095171c5525a",
        "r iste",
        "Microsoft.Windows.7.X21-83725_8wekyb3d8bbwe",
        "MediaBasedUpgradeUsingDynamicUpdate",
        "CheckHotPluggableDrive: Drive %c Unable to query device number for %s Error: 0x%X",
        "uNPPV",
        "9T:a:",
        "cych wymagane kryteria.%0",
        "516f6",
        "54c3d112-d73b-a75f-47b0-e4d0742d8245",
        "CheckHotPluggableDriveEx: Drive %c SetupDiGetClassDevs Error: 0x%X",
        "MigChoice: Initializing Wim Path:              [%s]",
        "Microsoft.Windows.121.X20-29553_8wekyb3d8bbwe",
        "e4bc2701-13dd-3e2a-10c4-c29b375cc8eb",
        " byly po",
        "8(8L8R8g8",
        "SetupUpdateMedia",
        "Microsoft.Windows.27.X19-98760_8wekyb3d8bbwe",
        "ResurrectSetupPlatform",
        "F987P-6N62H-V938R-XKCBR-6Q78X",
        "ImageDeploy: Initializing InstallFlowConstraint: [%d]",
        "Microsoft Corporation1.0,",
        "F9NJ2-VQ9GB-YFWMD-QHGB6-P7JVD",
        "STATUS_TRANSACTIONAL_CONFLICT",
        "Microsoft.Windows.171.res-v3857_8wekyb3d8bbwe",
        ".?AV?$CUnknownImpl@VIDlpResponse@@@@",
        "Das Installationsdatei wurde nicht gefunden.%0",
        "Microsoft.Windows.98.res-v3268_8wekyb3d8bbwe",
        "urn:schemas-microsoft-com:os-update-actionlist",
        "MoSetupPlatform: SetupPlatform::SetWatsonBucketingParameter returned: [0x%X]",
        "SetupCore: Registered COMPAT_GATED action",
        "kazov",
        "3*5S5|5",
        "T973N-7DY9V-DG9MF-G3BFM-K764J",
        "N33V3-9KKBK-FBGYW-KDQ6P-7CFTG",
        "4'4/4o4",
        "Microsoft.Windows.125.X20-35520_8wekyb3d8bbwe",
        "=2=P=h=y=",
        "tMhl<",
        "47TNM-XW3Y6-FVFVX-BTXMJ-GVFFH",
        "Onnistumisen komentosarjan suorittaminen ep",
        "Microsoft.Windows.48.X19-98842_8wekyb3d8bbwe",
        "DUSetup: OsVersion: [%s]",
        "RtlNotifyFeatureUsage",
        "e545df7e-1b56-c098-22d7-c52a7c929300",
        "yeblikket.%0",
        "r tom.%0",
        "883b8a1d-d4e4-8c25-efd5-3537cb1f0941",
        "?)?3?:?d?k?r?",
        ">4>>>T>",
        "WT33N-7KFCT-6PJ3M-4VGM7-6XXQY",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionGetWebSetupUserInputFactory@@VCDlpActionGetWebSetupUserInput@@@@",
        "FP7QN-KR4PT-X6K6X-3RGMP-HH7MF",
        "YHr,g",
        "Microsoft.Windows.165.X21-06177_8wekyb3d8bbwe",
        "ImageDeploy",
        "6&656@6K6Z6e6p6",
        "5 555R5y5",
        "cloude",
        "CDlpActionRecovery::InitializeRoutine",
        "DataMigration: Initializing Compat MigXmlPath:   [%s]",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionSummaryFactory,class CDlpActionSummary>::CreateAction",
        "ver, at brugeren accepterer licensaftalen.%0",
        "9YQP3-N367H-CB4YR-4R2KT-P7JWD",
        "Microsoft.Windows.165.X21-06172_8wekyb3d8bbwe",
        "tzm-Latn",
        "DecompressChunkedFile",
        "MoSetupPlatform: Error retrieving installed size for package [%s] -> [0x%X]",
        "CDlpActionDiskSpaceReq::SerializeRoutine",
        "relse af kompatibilitetsproblemer.%0",
        "FC_CreateFCManager",
        "We can only update the same product once per operation. CompDBs specified updating product at least twice: {0} with versions {1} and {2} and types {3} and {4}",
        "3(4P4g4",
        "DataMigration: Not requesting migration of ActionList.xml",
        "Das System hat die Compat-Pr",
        "=M=q=",
        "CDlpActionUpdateMedia::ValidateOneSettingsSetupVersion",
        " manca un'attivit",
        "Microsoft.Windows.49.X20-29569_8wekyb3d8bbwe",
        "<3=>=L=w=",
        "2(2K2",
        "Er is een fout opgetreden en de resultaatwaarde moet vanuit een telemetrisch standpunt worden samengevoegd.%0",
        "FormatMessageW",
        "CSetupCore::RegisterSetupActions",
        "QHMY3-NMFJF-HYY3D-VRM3Q-2WHB3",
        "P4G7N-HV6D6-PBTBG-C7666-YG9TT",
        "EXFAT   ",
        "4!4H4",
        "kernel32.dll",
        "476d261d-fd38-4da6-0637-48d8b94d814f",
        "0!0i0",
        "GetModuleHandleW",
        "ImageFinalize: Initializing Update and Shutdown:              [%s]",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::GetError",
        "0ea595b7-b92e-34ab-7079-f78ee335ddc8",
        "2395f173-7cd5-25e2-50f9-c7ae0afd1755",
        "2;2E2b2h2",
        "CompatFinalizeReq: Initializing Minor Version:         [%d]",
        "L$djo_",
        "95e8b596-1f6f-dba8-0ea6-7aff09bc2f18",
        ".?AV?$CMoSetupUnknownImpl@VCAutomationManager@@@@",
        "GetSystemInfo",
        "Microsoft.Windows.99.X19-99574_8wekyb3d8bbwe",
        "enterprises",
        "cannot read WIM header",
        "Finalize: Error during compat Finalize: [0x%x]",
        "Failed to open description key for store. Store: %s StoreKey: %ws Status: %x",
        "4NHPP-3KJPH-28KGH-8MDW3-XHJWP",
        "ProductKey: Error reporting telemetry for Digital key cmd used, exit code: [0x%X]",
        "Microsoft.Windows.48.X20-21795_8wekyb3d8bbwe",
        "4f422859-7345-0a42-2916-c4e3401bcbdd",
        "2PVXM-GN9GV-4QJ7K-CRF7T-HFTP4",
        "hIPCA",
        "920e502b-bbb5-f7ab-207e-c0c931cec6cc",
        "n bel",
        "MicrodomImplementation::CDomLayoutCache::FindObject",
        "Microsoft.Windows.189.res-v4367_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X19-98877_8wekyb3d8bbwe",
        " anulowania, poniewa",
        "Microsoft.Windows.48.X19-99493_8wekyb3d8bbwe",
        "istiedostoa ei l",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionDataMigrateFactory,class CDlpActionDataMigrate>::CreateAction",
        "NewDocument = this->AllocateStreamObject()",
        "DebuggerOptions: Debugging not enabled.",
        "3+464b4m4",
        "SpaceIssuesFound",
        "ok mimarili medyay",
        "<:<C<_<e<",
        "onecore\\base\\cbs\\util\\cbsstr.cpp",
        "9dadbc9d-12e4-abfc-3797-4034069ab8c8",
        "RegSetKeySecurity",
        "jfh(d",
        "5(6X6",
        " oper",
        "WIM\\IMAGE",
        "Y328N-PHM76-GWPXF-47KG3-49CHH",
        ";0<8<",
        "CAutomationManager::RemoveAutomationValues",
        "1e3f1d85-76d6-48c5-9846-f97e44eea293",
        "CompressCaptureNode",
        "Automatisierungsinformationen waren ung",
        "NtOpenDirectoryObject",
        "Le processus d'installation s'est arr",
        "File too large {0}",
        "k gereksinimleri ge",
        ".?AVCMoReserveManager@@",
        "29WPG-VNTBP-293DQ-DVR2V-FJRBB",
        "Die Installation kann nicht fortgesetzt werden, da der Instanzhash nicht ",
        ".?AV?$CSetupObject@VCAutomationManager@@VIAutomationManager@@@@",
        "Group",
        "RtlIsLUtf8StringValid(TagName) || (TagName == 0)",
        "CompressChunk",
        "c2fa10dc-ed48-552f-6f0a-f8024ba2c3a9",
        "6?6I6s6}6",
        "424N4x4",
        ">C?V?",
        ";.;8;D;a;l;z;",
        "Target OS: Architecture = [%s]",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::Serialize",
        "ReleaseMutex",
        "MoSetupPlatform: Finalize was cancelled!",
        "ci wyniku na potrzeby telemetrii.%0",
        "qihoo",
        ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIProductKeyAction@@@@@@",
        "WindowsSysPartDevice",
        "Microsoft.Windows.101.X20-30283_8wekyb3d8bbwe",
        "%ws\\%ws",
        "924ebe8d-6c4a-d702-1653-b371f72a9606",
        "0cbcf224-2c22-37cd-3869-61bcb6f1ae25",
        "01253fcf-21e3-cd34-4c1f-857cd2bb8848",
        "29f83457-72f8-e84d-dc97-ee739919bb96",
        "CreateSetupPlatform",
        "The existing WIM file became corrupted",
        "NQKWP-F47YJ-V43H4-QPCX7-DRR76",
        "WPN2V-T7CXK-XKK33-G7MW4-F6T89",
        "GM2HV-PNMX9-7KF44-HWB79-BKQH2",
        "(NamespaceURI == 0) || RtlIsLUtf8StringValid(NamespaceURI)",
        "Microsoft.Windows.49.X19-99515_8wekyb3d8bbwe",
        "Microsoft.Windows.50.X18-87819_8wekyb3d8bbwe",
        "1a1beab4-2e0c-0ec8-0042-783e1ab7fb9f",
        "r ikke portet kompatibilitetsskanning for ",
        "ProductKey: Validating Product Key for Image.",
        "44RPN-FTY23-9VTTB-MP9BX-T84FV",
        "76N4H-7M4D3-QKDMR-4KKH3-BG9Q6",
        "Der Benutzer hat sich entschieden, den Lizenzvertrag zu k",
        "tykuormatiedostot olivat vioittuneita.%0",
        "9C9H9j9o9",
        ".tls$ZZZ",
        "3KNVR-PXJFJ-MXRQY-KKQH7-YY6QH",
        "Scan result at : %s",
        "Microsoft.Windows.126.X21-83281_8wekyb3d8bbwe",
        "SetupCore::UpdatePaths",
        "Microsoft.Windows.50.res-v4333_8wekyb3d8bbwe",
        "DriversReflect",
        "Microsoft.Windows.161.X21-03401_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X19-98830_8wekyb3d8bbwe",
        ".?AVCDlpActionGetWebSetupUserInput@@",
        "Microsoft.Windows.121.X19-98666_8wekyb3d8bbwe",
        "7VW9N-8C48X-J6442-J3KM6-FVTM9",
        " umowy EULA w wymaganym czasie.%0",
        "0W0~0W0_0",
        "1.2f2",
        "Microsoft.Windows.171.X21-24736_8wekyb3d8bbwe",
        "ywany w ",
        "header version mismatch",
        " essere attualmente riparato.%0",
        "CDlpActionSummary::IsPowerPluggedIn: System's AC power is online.",
        " fjernelsesfunktionen forbliver aktiv.%0",
        "kleme devam edemiyor.%0",
        "FileDescription",
        "a4df3354-8f64-1b6f-3e6a-0e757572089b",
        "378ef8f9-bf4d-560e-b701-df76f547288b",
        ">.>4>H>U>",
        "f9XBt",
        "_XcptFilter",
        "NJP6C-K7R7D-BP23D-KQWVW-K2FC4",
        "ProductKey: Product key block found. [%d]",
        "B99Q2-NV9CP-GYQF2-2F3QV-M4G4Y",
        "59c89b11-85e2-68e2-6ce5-be2c981b5b07",
        "Microsoft.Windows.161.X20-00860_8wekyb3d8bbwe",
        "ID de version d",
        "4P5|5",
        "Log: Cannot convert ansi->unicode.",
        " funkcja finalizacji nie mo",
        "ivatel nep",
        " klienta agenta aktualizacji.%0",
        "afabc496-f907-e437-7146-1bf35f5926cd",
        "3MWP6-DKNRJ-GG2RC-Y8VR8-4VWH4",
        "<!<N<X<",
        "Microsoft.Windows.48.X19-98812_8wekyb3d8bbwe",
        "K3HBC-NKD87-HQV6K-X8Y62-JB6RJ",
        "58a3bf46-65dc-9a0f-7422-540a75e4d5a4",
        "Microsoft.Windows.99.X20-39254_8wekyb3d8bbwe",
        "6E7[7",
        "r%*U$",
        "BootFinalize: Initializing SetupResult:                [0x%x]",
        "1,1014181<1@1D1H1L1P1T1X1l1p1",
        "Sistem, istenen ge",
        ":0;f;",
        "HX3NQ-H4XT7-RHBXY-KYH7G-CGYM6",
        "nyeinek.%0",
        "n pendiente del sistema operativo.%0",
        "ZwSetBootOptions",
        "ves en genstart af systemet.%0",
        " on havainnut m",
        "Setup360Result",
        "InstallTicks",
        ">2?u?",
        "PRIV_INSTRUCTION",
        "The user has chosen to cancel for advertisement.%0",
        ";$;D;L;T;`;",
        "PN3KR-JXM7T-46HM4-MCQGK-7XPJQ",
        "Microsoft.Windows.121.X21-03403_8wekyb3d8bbwe",
        "Microsoft.Windows.4.X19-99690_8wekyb3d8bbwe",
        "CXmlCursor::XmlAlloc",
        "MediaLocation",
        "1-242",
        "Microsoft.Windows.80.X21-83750_8wekyb3d8bbwe",
        " poistotoiminto odottaa yh",
        "Compatibility: Entering PerformResolveCommand",
        "CDlpActionCompat::ExecuteDownloadReqScan",
        "Microsoft.Windows.50.X21-83789_8wekyb3d8bbwe",
        "RtlInitUnicodeStringEx",
        "CheckDiskSpace: Error reporting telemetry for OSPARTITION_REQUIREDSPACE: [0x%X]",
        "H3DNW-WTYJT-MVQFM-M4YTV-KHJXC",
        "xboxnativeos",
        "Catalog",
        "959]9s9",
        "4795094d-0434-c3db-f4f3-c9e338904b10",
        "el kontrolou kompatibility p",
        "811eabb3-e364-8868-2bdc-ba3e67ed6a9f",
        "Um script de falha n",
        "MoSetupPlatform: Getting default SetupAutomation object...",
        "shez.%0",
        "ms-MY",
        "0(0i0",
        "Target Image: Language = [%s]",
        "Microsoft.Windows.125.X21-83176_8wekyb3d8bbwe",
        "$0R0e0",
        "onecore\\base\\cbs\\util\\cbsutil.cpp",
        "872ff530-066a-0f8b-da38-88964f035b1c",
        "\\Microsoft\\Windows\\DiskCleanup",
        "G<9sTu",
        "TNWT4-J9899-FX9VF-RDQXR-HQWWR",
        "MNHR4-M463D-M8943-J783K-6CQDY",
        "en.%0",
        "8fa1f2ae-7758-12e5-585c-4d8478735d8f",
        "onecore\\base\\servicing\\util\\servicinghelper.cpp",
        "GetFileVersionInfoSizeW",
        "Microsoft.Windows.101.X20-29684_8wekyb3d8bbwe",
        "PSWh$V",
        "WimInitXmlInfo",
        ";Y;t;~;",
        "cb7c0db3-c3f0-98b8-80d1-b76d9b1901be",
        "Von der Setupplattform wurde ein nicht n",
        ">H?R?z?",
        "rio n",
        "1#8,8",
        "9_0t%",
        "Microsoft.Windows.48.X20-32150_8wekyb3d8bbwe",
        "4j j@",
        "23f15cd4-24f4-6b83-3d94-df3f1c44fff7",
        "3t4'5a5g5v5",
        "8f7587f2-abf8-b8a3-d4ce-059bb986778d",
        "40474Y4`4",
        "BUCL::Rtl::Add<SIZE_T>( cbNecessary, Iter.Key.Length, sizeof(UCHAR), cbNecessary)",
        "CDlpActionFinalizeFactory::CreateInstanceRoutine",
        "DUSandboxPath",
        "477da59b-62d1-6543-4935-51753a7ca3d7",
        "K{m<KI",
        "4#5E5",
        "be8fe154-b523-5954-e235-37d4733cd3b4",
        "6,6<6L6P6T6X6\\6`6d6l6",
        "0+080",
        ".?AV?$CZeroInit@VCCompatibilityDataProvider@@$00@@",
        "Diagnostiikkaobjektia ei luotu. Tapahtumista ei voi tehd",
        "1+1E1k1",
        "MigrateLicenseState",
        "GlobalMemoryStatusEx",
        "r die Wiederherstellung von Windows nicht.%0",
        "34b20b82-324d-16d9-b460-c4675e951001",
        "Activation: Activation polling starts...",
        "st nem lehet folytatni, mert nincs szabad hely a lemezen.%0",
        "4(444@4L4X4d4p4|4",
        "smeno c",
        "Media",
        "d prob",
        "W6JFN-WCTJ9-9G96V-Q2QH2-RVVYY",
        "4b58cfa9-ce6e-3669-5924-298d8edf236b",
        "24d4b85b-9ff4-27b3-05c9-88c90d53d45e",
        "Microsoft.Windows.100.X19-99441_8wekyb3d8bbwe",
        " l'hash di istanza non corrisponde.%0",
        "Cihazda y",
        "STATUS_SXS_ASSEMBLY_MISSING",
        ">.>4>U>`>w>}>",
        "uW0~0W0_0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::GetState",
        "7YFMF-NHXBD-4HD26-GW2TQ-T6Q8T",
        "f8c6cd98-085d-51a9-9736-f827871a514f",
        "CDlpActionDU::ExecuteDUImage",
        "ac3421b6-09c1-2bba-1436-0acc73c95c28",
        ";l<v<",
        "reparse point tag too short in filestream",
        "Microsoft.Windows.100.X20-29648_8wekyb3d8bbwe",
        "ProductKey: Image selection response created.",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::PreInit",
        "07da16e4-0035-3157-7990-72ee89bd4088",
        "VN7GG-XJ738-R6HXV-2CX3F-HQWW6",
        "9KM4D-NG3DK-9TBK8-6JQ4W-TQ72C",
        "= >5>n>",
        "d0b17a07-e409-6abf-34fd-7f141bd5ab87",
        "7(787<7@7X7h7l7",
        " on k",
        "700cbb81-5845-9150-5687-45ea43fd25c6",
        "4#5N5_5t5",
        "Microsoft.Windows.7.X18-87817_8wekyb3d8bbwe",
        "CMicrodomBuilder::EndAttlist",
        "DUSetup: Initializing payload SetupDU",
        "SystemProductName",
        "El proceso de instalaci",
        "6H2YJ-NY243-VRYBY-DW966-J2QF2",
        "*Q`L]",
        ".?AVCDlpActionEulaFactory@@",
        "*ppObject = State->m_pAllocator->Allocate<UpdateProduct>()",
        "14f98898-aa40-2486-af47-59076bd22780",
        "W3NJG-HJ66R-XBQ6V-YRYBJ-K2FDM",
        "2FPB9-CRNYB-QQK3C-82PMX-4JPY8",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::Restart",
        ".?AVCDlpActionFinalize@@",
        "Microsoft.Windows.191.X99-99999_8wekyb3d8bbwe",
        "Q3XM6-KKG22-7TBBY-76XXK-T77WT",
        "ovat, proto",
        " alapfunkci",
        "ci i wykonywania dzia",
        "2\"2)252d2x2",
        "902fa614-d88f-cae1-dc5a-b79cf2ccc1fa",
        "Microsoft.Windows.49.X19-99727_8wekyb3d8bbwe",
        "<0<;<i<t<",
        "L'utente ha scelto di annullare per il contratto di licenza.%0",
        "~89~(t",
        "Microsoft.Windows.101.X19-99551_8wekyb3d8bbwe",
        "CDlpActionGetWebSetupUserInput::SelectOffer",
        "DebuggerOptions: Enabling Net debugging -> [0x%X, %d, %s, %d]...",
        "No se resolvieron los problemas de compatibilidad en el l",
        "onecore\\internal\\sdk\\inc\\wil/Staging.h",
        "Microsoft.Windows.164.X21-06157_8wekyb3d8bbwe",
        "Microsoft.Windows.50.X18-81310_8wekyb3d8bbwe",
        "NF3Q3-4KTWH-489DP-3YDRW-XW3G3",
        "Het systeem voldoet niet aan de schijfruimtevereisten voor het installeren van de nettolading.%0",
        "6632b411-be24-c4f8-57f6-a966606a0c4c",
        "onnistui tai palautti virheen.%0",
        "DUSetup: Facilitator DUSetupResult: [0x%x]",
        "HKFJR-N3H3P-7FCQ7-WDBQM-XBVCK",
        "?9?Q?g?",
        "UpdateAndShutdown",
        "cych miejsca na dysku potrzebnego na pobranie ",
        "586L6`6t6",
        "j YQh",
        "Microsoft.Windows.129.X20-35523_8wekyb3d8bbwe",
        "6D6w6",
        "GYYPN-QTM8C-HCKBG-YY394-X2G6M",
        "GetProductKeyFromResponse: Using automation response.",
        "CDriverCallback::ValidateDriverPackage: Driver Package Exit {B416FA3D-8490-4221-9A9B-A8ED9DD4C914}",
        "?,?:?",
        "GetModuleVersion",
        "*ppObject = State->m_pAllocator->Allocate<InstallFeature>()",
        "68a1978e-99f8-426b-8d65-996f10c0c84d",
        "Microsoft.Windows.48.X20-25155_8wekyb3d8bbwe",
        "WriteEncryptedFileRaw",
        "r die Installation des Updates nicht erf",
        "0G0w0",
        "STATUS_BUFFER_OVERFLOW",
        "8:9E9S9}9",
        "StringId < m_Entries.Length",
        "CDlpActionRecovery::ExecuteRoutine",
        "MoSetupPlatform: GetUserPreferenceAccentColor: Using default color...",
        "Microsoft.Windows.4.X19-99680_8wekyb3d8bbwe",
        "amd64",
        "ZwTranslateFilePath",
        "$Docs",
        "Actions",
        "Microsoft.Windows.122.X20-29557_8wekyb3d8bbwe",
        "BcdGetElementDataWithFlags: Failed to open elements key.Object: %ws Status: %x",
        "K4GTR-NTMW9-DG63T-G9R7W-CPQFR",
        "Microsoft.Windows.162.X21-43639_8wekyb3d8bbwe",
        "Microsoft.Windows.27.X21-03403_8wekyb3d8bbwe",
        "hrend der ausf",
        "rjade uppdateringen.%0",
        "n iniciada anteriormente.%0",
        "zh-tw",
        "HD3VD-G4NG6-QV8KD-8M783-DV7Y2",
        "7ace4a20-28e2-95b0-ab8f-a59b7dd261e6",
        "GetSecurityDescriptorSacl",
        "XT9TP-N6M8P-R4PYD-MHB6X-FRG4C",
        "9916d417-bbd0-687c-f7a3-427618c04fe7",
        "Identity missing language.",
        "EducationN",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::UpdateState",
        "Microsoft.Windows.27.X20-00862_8wekyb3d8bbwe",
        "ttes ikke.%0",
        "Microsoft.Windows.98.X20-20963_8wekyb3d8bbwe",
        "R!s4Z",
        "QQhX%",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::CheckUninitialized",
        ",4Gmw+eeeEnQbwZEJX2lc0W+MbNuI+2wC/SpC23ubbb0=0Z",
        "9X`v^j",
        "CDlpActionDataMigrate::MigrateWebSetupESDImageLocation",
        "AllowUninstall",
        "ProductKey: Getting index from response.",
        "Microsoft.Windows.145.res-v4316_8wekyb3d8bbwe",
        "3HDCN-87G3V-FPCDF-C6HTB-79Q3X",
        "2`2{2",
        "Not-null check failed: Root",
        "CFQFT-XNTXF-VJ4MC-3DDXV-94R9P",
        "DeletePath: Failed to obliterate [%s] (GLE = 0x%x); retrying...",
        "bitlocker                       ",
        "::RtlIsUnicodeStringValid(String)",
        "PsfSourceName",
        "DNCTQ-PJ8RY-99WYF-TDTY4-W8HWP",
        "VWj j",
        "7B6NC-V3438-TRQG7-8TCCX-H6DDY",
        "WinSatDiskScore",
        ":\":9:C:I:^:h:n:7<g<",
        "DebuggerOptions: Setting Debug Bus Parameters -> [%s]...",
        "et-EE",
        "^6e0R",
        "Setting element %08x",
        "NFCDV-7XHPJ-9J2V2-4J8W7-X7636",
        "8w8~8",
        "The download diskspace issues were not resolved within the required time limit.%0",
        "3&4-4g4",
        "dtak meg a hat",
        "ProductKey: Offer Default.",
        "C;X`s",
        "WIM\\IMAGE[*]\\WINDOWS\\VERSION\\MAJOR",
        "Generating compat report.",
        "charger.%0",
        "bo-CN",
        "a6e27a02-4d32-9316-49c8-b0d90fb2d1ae",
        "CDlpActionProductKeyValidateFactory::CreateInstanceRoutine",
        "> >,>A>",
        ".?AVCDlpActionPackageMigrate@@",
        "f61de926-d23b-9de6-5e58-ae85517cd9d0",
        "<)=k=",
        "RestoreSecurityDescriptor",
        "50a009bb-9fe7-897e-1737-ab173bf5961f",
        "STATUS_REVISION_MISMATCH",
        "43TBQ-NH92J-XKTM7-KT3KK-P39PB",
        "CDlpActionCompat::PopulateTargetInfo",
        "212D2d2",
        "::;f;",
        "SilentCleanup",
        "Los problemas de espacio en el disco de descarga no se resolvieron en el plazo requerido.%0",
        "6 6(606@6H6P6`6h6p6",
        "ra vonatkoz",
        "Microsoft.Windows.189.X22-09605_8wekyb3d8bbwe",
        "Annetut automaatiotiedot olivat virheelliset.%0",
        "6\\6b6h6q6",
        "DeleteFileEx: Unable to restore attributes on [%s]; GLE = 0x%x",
        "6&7R7`7v7",
        "?#?P?Z?",
        "ARCH_64",
        "aa28561e-34b7-103c-8d09-6b125fb53c94",
        " Microsoft Corporation. T",
        "aae6e3f5-777f-7754-b5fb-9d0e71fe580f",
        "FODPath",
        "VX84N-JDYBF-V79VF-P6YPK-MG9RX",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::UpdateState",
        "X6J7D-TN6P6-BRPVD-DFDQM-XBT33",
        "Le processus d'installation a ",
        "ts ov",
        "9\\$$v",
        "PN3YY-92KRG-DDVBJ-2GW7K-WT3GQ",
        "0e4ed02f-0e2c-ad61-f1c4-c426cc54dd9b",
        "ProductKey: Matching Install Wim For Exact Editions",
        "2'3k4",
        "4a782de7-a01e-a3fe-1844-27cb3955c6ec",
        "768M8h8",
        "ERROR_REQUEST_OUT_OF_SEQUENCE",
        " avbryte for annonsen.%0",
        "1(1Q1m1",
        "fc017d80-f651-1abd-1b80-9ba51136bb2d",
        "Kompatibilitetsproblemene for minimumskravene ble ikke l",
        "Uno script di preinstallazione non ",
        "%hs!%p: ",
        "Het installatieproces is be",
        "6079bde1-b609-1fa6-8b46-364609d716eb",
        "CMicrodomBuilder::Initialize",
        "CDlpActionDiskPartition::GetDriveLetterFromResponse",
        "Microsoft.Windows.122.X20-29558_8wekyb3d8bbwe",
        "jligt.%0",
        "Language[*]",
        " cancelar el proceso porque el sistema no cumple los requisitos m",
        "9(90989D9d9l9x9",
        "lemi gerekli s",
        "Failed to determine source edition type!  Error: [0x%X]",
        "t$ RP",
        "2E2P2",
        "FBf;E",
        "Microsoft.Windows.4.X19-99678_8wekyb3d8bbwe",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::BeginOpenElement",
        "DiskPartition: Executing Disk Provisioning from Automation.",
        "KDGFF-N69CJ-DH4F3-JKQ26-H8T2C",
        "a591cfcd-f875-c80a-615d-a41ee8ce039e",
        "Microsoft.Windows.99.X20-00916_8wekyb3d8bbwe",
        "cktes. Verifiera paketinneh",
        "En nyare version av installationsprogrammet startas f",
        "k nem old",
        ";H;R;};",
        "9ecdb325-14c2-0597-db93-f8578ef88690",
        "XYVDB-NTPFD-4CG33-WHDP6-3V66R",
        "09b433be-521a-748e-ae9a-198a56925ad4",
        "Microsoft.Windows.171.X21-24724_8wekyb3d8bbwe",
        "062a6de0-45d2-8550-8cc7-7c35cfcf78e6",
        "mes de compatibilit",
        "fr-RE",
        "GetOverlappedResult",
        "d41f55d0-564d-0328-4e86-42dcfeafbdcf",
        "5(5H5P5X5`5l5",
        "2c0404c7-741e-931d-77d9-99087f6ea7c6",
        "ConX::Setup::Common::COSInfoHelper::GetHostOSSKUInfo",
        "e3032f8c-22c1-7bf5-925d-3acc1b115376",
        "DataMigration: Queue preservation of downlevel os build number into Target OS...",
        "8BNTP-P8BGH-Y9KQ6-T7K2T-WXDFY",
        "2=2U2~2",
        "Microsoft.Windows.165.X21-06174_8wekyb3d8bbwe",
        "rozatlan hib",
        " zako",
        "CDlpResponseAutomation::InitializeRoutineSummary",
        "4TNKC-664XB-XDYF8-CR74Y-HT9RF",
        "(DynamicBuffer == 0) || (DynamicBuffer->Length == 0)",
        ".?AVCDriverCallback@@",
        "CBasicNodeType::EncodeLUtf8String",
        "7K8[8g8",
        "9J9x9",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::EmitAttribute",
        "CoreConnectedN",
        "6A6_6",
        "QKN2D-TFQD7-9Q469-RBMGX-4JT2G",
        "1/0-0",
        "DUOptInDefault",
        "%s /f \"%s\"",
        "8#8I8N8X8b8l8v8",
        "Microsoft.Windows.48.X20-24587_8wekyb3d8bbwe",
        "Microsoft.Windows.48.X19-99489_8wekyb3d8bbwe",
        "MicrodomImplementation::CDomLayoutCache::DecodeElementCounts",
        "MCT\\Catalogs",
        "=K=`=q=",
        "NXCTR-YXXWC-TK368-HGGTF-8YB99",
        "0,0Q0c0",
        " nem fogadta el a hirdet",
        "NtClose",
        "52575Q5W5z5",
        "DiskSpaceInstallReq: Initializing ActionList Path:       [%s]",
        "Napotkano nieoczekiwan",
        "Microsoft.Windows.161.X21-43627_8wekyb3d8bbwe",
        "o para instalar o SO.%0",
        "WKVBF-F226X-NR2XW-3WW93-2WF9V",
        "t$ WV",
        "%SINGLE_LANGUAGE%",
        "21c77e35-4a7e-7a61-e865-1915f3e2976a",
        "2;2p2",
        "t,h`s",
        "Microsoft.Windows.7.X17-66958_8wekyb3d8bbwe",
        "TlsSetValue",
        "YQH9J-XYNRK-C2FQK-VQDRY-3GPKR",
        "64411aee-d445-2daa-81b1-4ba7ee3cc8f9",
        "CompatInstallReq: Initializing Timeout in Mins:           [%d]",
        "7%828^8i8",
        "4*4D4a4m4",
        ".?AVbad_alloc@std@@",
        "UuidToStringW",
        "|q}CQ",
        "9E9P9}9",
        "334:4H4",
        "false",
        "Microsoft.Windows.172.X21-24723_8wekyb3d8bbwe",
        "Microsoft.Windows.27.X20-46577_8wekyb3d8bbwe",
        "PNDGK-PM26G-BDG9X-J69CQ-TCQGY",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionDUFactory,class CDlpActionDU>::GetActionId",
        "CDlpActionSummary::SerializeRoutine",
        "PreFinalize: Initializing Driver reflect path: [%s]",
        "Y84VV-NBK6Q-TYTM7-F9PTC-Q3Q2J",
        "SVWj2",
        "_onexit",
        "G^{P&a",
        "serverarm64",
        "\\\\?\\GlobalRoot",
        "Server Workstation",
        "Microsoft.Windows.48.X20-29665_8wekyb3d8bbwe",
        "PerformSilentCleanup: SilentCleanup task not available.",
        "DiskSpace: Rollback Disabled via detection.",
        "Objects",
        "4B4M4",
        "505G5s5",
        "JH8W6-VMNWP-6QBDM-PBP4B-J9FX9",
        "jHXPd",
        "Client Workstation",
        "kseen asennuksen poistovaihtoehdon aktiivisena.%0",
        ":*;e;",
        "e v syst",
        "A rendszer nem felel meg a v",
        "CDlpActionDiskSpaceReq::PerformTriggerStorageCleanup",
        ">~>#?",
        "Install",
        "CDlpResponseAutomation::InitializeRoutineSelectImage",
        "057d9554-de71-3860-9365-c6f27c09c3e0",
        "Microsoft.Windows.48.X20-29662_8wekyb3d8bbwe",
        "!|$<9}",
        "Microsoft.Windows.99.X20-29710_8wekyb3d8bbwe",
        "CDlpActionEula::DeserializeRoutine",
        "ritystiedosto on tyhj",
        "el kontrolou za",
        "liversion tunnus on tyhj",
        "<(<?<K<d<",
        "9FGDN-62789-F9V2R-VK68M-HT9R2",
        "6f5df78f-5da0-2184-d699-5ea1a8471ce4",
        "DataMigration: Migrating PrivacyConsentStatus [%d].",
        "rio aceite o contrato de licen",
        "CDlpActionAdvertise::InitializeRoutine",
        "Microsoft.Windows.189.X22-09608_8wekyb3d8bbwe",
        "5bca5fe0-2865-8605-f225-03352ebcd3b4",
        "El sistema no cumple los requisitos para la opci",
        "DiskSpaceInstallReq: Initializing PostUpgrade space Percentage: [%ld]",
        "t$ Sj",
        "163ff349-019c-8b17-9ba3-688bd397e74c",
        "Microsoft.Windows.172.X21-24740_8wekyb3d8bbwe",
        "t+Phx`",
        "Yhteensopivuuden v",
        "GetProductKeyFromResponse: Attempting to get a product key from the response layer.",
        "f81c17fd-48a2-7275-3ed3-35526be032fa",
        "Microsoft.Windows.99.X19-99566_8wekyb3d8bbwe",
        "292A2f2n2",
        "Microsoft.Windows.101.X19-99543_8wekyb3d8bbwe",
        "?1?B?K?O?a?r?w?}?",
        "TXNW4-97MDB-HDGX7-CD6WD-KK2H3",
        "bs-Cyrl-BA",
        "Microsoft.Windows.49.X21-83178_8wekyb3d8bbwe",
        "FACILITY_DEBUGGER",
        "e dans les ",
        " rendszer",
        "0<0T0",
        "Microsoft.Windows.101.X20-29683_8wekyb3d8bbwe",
        "VHTMN-GFRPG-78FGF-88H7Q-M7V3G",
        "\\Windows\\Setup\\Scripts\\setupcomplete.cmd",
        "Microsoft.Windows.146.X21-83684_8wekyb3d8bbwe",
        "Microsoft.Windows.146.X21-83747_8wekyb3d8bbwe",
        ">7?V?o?",
        "8adaa30d-f0ea-a200-3994-64ebf2df4ce0",
        "Microsoft.Windows.100.X19-98663_8wekyb3d8bbwe",
        "owym argumentem wiersza polecenia.%0",
        "Microsoft.Windows.98.X19-99659_8wekyb3d8bbwe",
        "Microsoft.Windows.164.X21-22361_8wekyb3d8bbwe",
        "4*5U5v5",
        "%s, DLPLOG: [0x%X] [%s] [%s]",
        "rt innen tidsfristen.%0",
        "Microsoft.Windows.164.res-v3800_8wekyb3d8bbwe",
        "NYJVK-8TTVJ-C68BC-RMW29-P373M",
        "STATUS_SUCCESS",
        "+0>0Q0",
        "ProductKey: Product InstallChannel = %s",
        "DiskPartition: Selected Drive letter from response [%c]",
        "tzm-Latn-DZ",
        "Nie znaleziono pliku wykonywalnego instalacji.%0",
        "ProductKey: Valid product key found = [%s].",
        "RtlDisownModuleHeapAllocation",
        "nds i en testmilj",
        "67e525d0-3ecb-626f-ea30-b0f3d441e59c",
        "0;3I3P3>4E4",
        "7K7h7",
        "Zu1A;",
        "DiskSpace: Required disk space is [%ld] MB without using external drive",
        "DataMigration: skipping EULAAccepted...",
        "STATUS_SXS_COMPONENT_STORE_CORRUPT",
        "$`2X`F",
        "rnek karma e",
        "F09{ u",
        "Microsoft.Windows.48.X19-98854_8wekyb3d8bbwe",
        "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\HIGHPART",
        "uZSW3",
        "M0K0I",
        "Microsoft.Windows.98.X19-99590_8wekyb3d8bbwe",
        "GJTR7-XN3D4-QJF73-KP8K9-WTYP4",
        "SETUP360_LOW_COST_DEVICE",
        "tte, da f",
        "Microsoft.Windows.126.X20-35463_8wekyb3d8bbwe",
        "Y7FPN-7XMB9-MHP4H-X64GB-X4R7T",
        "GetFileVersionInfoSizeExW",
        "rifiez le contenu du package.%0",
        "949D9H9L9P9T9X9\\9h9l9p9t9x9|9",
        "6 797c7o7z7",
        "BootNext",
        "H2WVQ-N82CJ-VHGPK-J77MJ-K2FBQ",
        "??1type_info@@UAE@XZ",
        "Asennuksen m",
        "o passou a an",
        "!D$P9t$Xt",
        "ZwUnloadKey",
        "ZwQueryKey",
        "*g(W@b",
        "75542ec6-6af5-087a-ec85-794b3fbf9f65",
        "Il sistema non ha superato l'analisi del dispositivo per l'installazione dell'aggiornamento.%0",
        "b143aa49-afab-09aa-201d-a58102ff19da",
        "ProductKey: Looking for product key in Host OS.",
        "f5fec609-c2e0-5360-02bc-7576effbe7b5",
        "0D0g0o0w0}0",
        " image se nena",
        "31ac2903-ed34-7dba-e98e-b61a525e3245",
        ";9<L<R<h<{<",
        "Microsoft.Windows.48.X19-98805_8wekyb3d8bbwe",
        "AcceptEulaSelected",
        "CLOUD",
        "CLOUD_N",
        "PackageMigration: Initializing GDR paths            [%ld] [%s]",
        "RJTXN-VFQQG-G3X77-DK7TX-YDWVD",
        "Microsoft.Windows.100.res-v3273_8wekyb3d8bbwe",
        "Microsoft.Windows.184.X21-83660_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X19-99436_8wekyb3d8bbwe",
        "Compatibility: App Uninstall Block NOT found.",
        "Systemet opfylder ikke kravene i gated kompatibilitetsscanningen og kan derfor ikke installere opdateringen.%0",
        "enterprisen",
        "9fdda306-ebda-b496-ddf7-4920dd6f2c59",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::InitializeRoutine",
        "ERROR_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT",
        "2D3PN-8MMQ3-TGYJR-4KPDF-7H64X",
        "Microsoft.Windows.8.X21-83717_8wekyb3d8bbwe",
        "MigChoice: Auto Response has a valid answer: [%ld]",
        "ProcArch",
        "1b63b03a-7986-a87c-71ea-d7a2b2137cc5",
        "ltend",
        ".edata",
        "Wow64RevertWow64FsRedirection",
        "t1f9;t,",
        "MoSetupPlatform: Calling SetupPlatform::INewSystem::Finalize...",
        "DRDNB-GPC7W-M8T7C-GQTFB-YWRCT",
        "CheckDiskSpace: Error reporting telemetry for OSPARTITION_MINIMUM_REQUIREDSPACE: [0x%X]",
        "CoreN",
        "GetWebSetupUserInput: Edition=[%s]",
        "multi(%d)disk(%d)rdisk(%d)",
        "ff053126-dd5c-aa71-4189-bf1f86e342a4",
        "13d98b40-ece1-1c81-e8d6-465611594ff7",
        "RtlNtStatusToDosErrorNoTeb",
        "serveressentialmanagement",
        "s reciente del programa de configuraci",
        "3G4i4",
        "779a3fa2-2554-152a-ab78-b15745e548fc",
        "TempElements.Allocate(NewCapacity)",
        "GetFileInformationByHandleEx",
        "Assert failed to build string.",
        "628042f6-8f4a-939e-6905-8cecef69fec0",
        "e obnovit d",
        "323G3T3q3z3",
        "Cette version de l",
        "Systemet uppfyller inte minimikraven f",
        "Microsoft.Windows.101.X20-36694_8wekyb3d8bbwe",
        "CDlpActionDiskSpaceReq::SuspendRoutine",
        "a463d63f-604c-e343-a8ac-b8454598b045",
        "CDlpActionPreFinalize::CancelRoutine",
        "e560a056-e17c-a903-251e-8ca043c8f3fa",
        "Microsoft.Windows.171.X21-24739_8wekyb3d8bbwe",
        " nebyly v po",
        ": :@:H:P:\\:|:",
        "f0b2cc90-343b-979f-10b2-b3d8dfef8fe7",
        "SerialBaudRate",
        "523382ee-e463-a07e-f452-d462689b38c1",
        "Saved InstallReq scan result at : %s",
        "3 4h4q4",
        "R2CNT-9XPV2-M4PRH-G7D97-XD72C",
        "0~0Y0",
        "1%141D1K1W1j1q1}1",
        "DiskSpaceInstallReq: Initializing AllowPartitionChanges:        [%s]",
        "FACILITY_HID_ERROR_CODE",
        ".?AV?$CZeroInit@VCDlpActionProductKeyValidate@@$00@@",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::ExecuteRoutine",
        "ResExtractToFile failed",
        "s az eredm",
        ", zostanie uruchomiona nowsza wersja instalatora",
        ": {0}",
        ".00cfg",
        ":B:U:_:k:",
        "CDlpActionDiskPartition::SerializeRoutine",
        "JRWYN-6M9J7-CP2FC-KQ47P-6JF8K",
        "CDlpActionUpdateMedia::DeserializeRoutine",
        ", mert m",
        "INT_DIVIDE_BY_ZERO",
        "2f9116b4-6b25-933a-1b1d-fae1c2bf6f11",
        "4N8VT-7Y686-43DGV-THTW9-M98W7",
        "CDlpActionProductKeyValidate::GetIsFreeUpgradeOfferActive",
        " iniciada para continuar a instala",
        "Target OS: Feature -> [LowCostDevice]",
        "he-IL",
        "MK6DN-DMTMR-J7TF7-XHHF6-9KXQR",
        "ImageDeploy: Installation drive cleaned.",
        "dka, kter",
        "Microsoft.Windows.22.X18-81296_8wekyb3d8bbwe",
        " Microsoft Corporation. Tous droits r",
        "KT4VW-NR4D6-87QD6-8VTHC-P92H7",
        "PSSSSSSh ",
        "F;w$r",
        ":=:U:s:",
        "JTN9B-QXPJK-DFDY7-WV82J-VH7KQ",
        "ncel bir s",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
        "c0b6ed6b-62b5-62a6-1dc7-429d4aefd27c",
        ";&<B<P<_<j<",
        "152a2",
        "NMRk0",
        "Activation: Genuine ticket generated         : [%s]",
        "6N6U6j6",
        "in bir y",
        "ar-QA",
        "si folyamat v",
        "t>j<j",
        "5D6v6",
        "Microsoft.Windows.48.X20-32158_8wekyb3d8bbwe",
        "Microsoft.Windows.146.X21-83735_8wekyb3d8bbwe",
        "Microsoft.Windows.8.X21-83186_8wekyb3d8bbwe",
        "PortableOperatingSystem",
        "f9db5732-b001-8d5c-e3e8-fb88e99d61c6",
        "The setup config file is empty.%0",
        "Het systeem voldoet niet aan de schijfruimtevereisten voor het downloaden van de nettolading.%0",
        "=>=e=",
        "72348616-e7e1-304a-bc31-d81b41f7256d",
        "1 2'2",
        "9CRJN-CHQPC-G36KV-QG9MD-3PG33",
        "Fail to update the WIM header",
        "9t$(tS",
        "242c7c20-ff91-57ff-23ab-8a71b37203bd",
        "b1f69e28-4546-6336-c29c-036e676d75de",
        "operation not permitted",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionCreateMediaSuccessFactory,class CDlpActionMediaCreationSuccess>::GetActionId",
        "FVHHX-GFNGX-PJJHM-H6KTM-B4G36",
        "QRDJF-N7QCC-CCJH4-GBJXD-T6H4M",
        "ar-TN",
        "lemedi veya hata d",
        "7b26c0d4-f56e-394c-4767-8927687d0b57",
        "::RtlIsLBlobValid(Data)",
        "nl-NL",
        "KJ3FR-NJFPH-RMYB4-KVBH7-QPG2M",
        "it reklamu.%0",
        "dv-MV",
        "ProductKey: Product key found in Pid.txt file.",
        "FFDJH-N7B4Y-V94KY-B7CF8-F3PH7",
        "102F2\\2",
        "Bir ba",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::Serialize",
        "L'installation ne peut pas continuer, car une op",
        "Das System erf",
        "YGMXY-HRNYX-HBBVY-MC4YV-9BT42",
        "vel assistir o Ambiente de Recupera",
        "FPBG8-NQ6F2-PBG2X-73GBC-KW3XC",
        "H6G89-NQVMR-V9QDD-BHJPM-8FHCM",
        "ring ikke kan gjenoppta tidligere startet oppdatering.%0",
        "Exception",
        "Microsoft.Windows.49.X19-98867_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::PrepareRoutine",
        "MoSetupPlatform: Setting Correlation vector",
        "Microsoft.Windows.162.X21-43656_8wekyb3d8bbwe",
        "9 94989<9T9X9\\9`9d9h9l9p9t9x9|9",
        "hsb-DE",
        ".?AVCDlpActionAdvertise@@",
        ";#;8;A;P;l;",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::SetProgress",
        "Microsoft.Windows.145.X21-83696_8wekyb3d8bbwe",
        "fbf52a0e-96ad-c3a7-ec57-b2d415f3cdc4",
        "5%5?5G5S5a5",
        "0$0(0D0H0d0h0",
        "4N6B6-2XBB7-38FK2-YVR3C-76F9H",
        "A rendszer nem felel meg a Windows helyre",
        "BNG7W-CCTQ9-HP93Q-TJWT7-G6PKM",
        "Windows::uDom::Rtl::RtlMicrodomUpdateCreateTextual",
        "B8W89-NFC8F-C782R-6G7HM-39MWW",
        "4ed7f321-c3d3-a8f1-36e5-eb9fa9d752d2",
        "InitializeSecurityDescriptor",
        "b194b4ed-9f26-4fe9-0459-5bf127ea69de",
        "1e48cc88-9544-aa77-5fdf-1d4b2ff96d57",
        ":3:Q:b:i:",
        "Microsoft.Windows.100.X20-29645_8wekyb3d8bbwe",
        "7f821b6e-fb99-83e6-7c39-8533f6e64b36",
        "got ledigt diskutrymme kvar.%0",
        "PackageMigration: Initializing ActionListPath:      [%s]",
        "Microsoft.Windows.101.X19-99540_8wekyb3d8bbwe",
        ";B<P=",
        "_ultow_s",
        "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%",
        "3ba1ceae-2833-c5ce-5a0c-98f42bd38aea",
        "=0=H=`=x=",
        "Microsoft.Windows.98.X19-99586_8wekyb3d8bbwe",
        "0b70f720-eb51-11f0-9b3c-684a86ae28c0",
        ";E<O<i<",
        "O ficheiro de configura",
        "ltunk a sz",
        "WilError_03",
        "Microsoft.Windows.21.X17-53889_8wekyb3d8bbwe",
        "9bab4bd5-95f4-b7c4-b423-095f9e3a7322",
        "kernelBase.dll",
        "lt megoldani a hat",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionCreateMediaSuccessFactory@@VCDlpActionMediaCreationSuccess@@@@",
        "f4404635-b9d6-4edd-c6df-aa3034c64510",
        "CAutomationManager::FindAutomationFile",
        "f0efbee9-e03b-0ab2-41d1-d1931dd347bb",
        "Ez az eszk",
        "arn-CL",
        "5$505<5H5T5`5l5x5",
        "Microsoft.Windows.175.X21-41298_8wekyb3d8bbwe",
        "o do Windows.%0",
        "L$T_^[3",
        ".?AUIScanProgressHandler@Compatibility@ConX@@",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::CloseElement",
        "DynamicUpdate=%s",
        "f89ccbf5-91c7-2fdf-64d3-82b923ea07e8",
        "N3JCC-3JTWF-KKHX2-3FBCR-4X8XD",
        "wH9\\$",
        "acdc9f9a-b9ab-a4e2-5e00-4c94636064a3",
        "62695118-642b-240e-1b7d-f1c33c2962ea",
        "CDlpActionUpdateMedia::GetHostOSArchitecture",
        "NtSetEaFile",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::GetActionId",
        "Failed to add product.",
        "MediaCompDBPath",
        "5baed8a6-6b76-cbfc-9b94-fa955a8b5075",
        "<==S=s=",
        "Microsoft.Windows.165.X21-06178_8wekyb3d8bbwe",
        "GetSupportedDriveLetters: Removable drive found [%s]",
        "QMNY4-DG2PG-X94QM-TXYHM-39QFP",
        "CDlpActionActivation::CancelRoutine",
        " la configuration minimale requise pour r",
        "Description",
        "F8PXD-G9NM6-YR8FR-6TMYQ-BG9Q6",
        "Microsoft.Windows.98.X20-29634_8wekyb3d8bbwe",
        "message_size",
        "CDlpActionCompat::ExecuteMigChoiceScan",
        "fe70cf25-dc7f-a412-21e3-0d5ba0627ae3",
        ">\">B>^>p>",
        "iu-Cans-CA",
        "\\EFI\\Microsoft\\Boot\\bootmgfw.efi",
        "6bf81fb3-1746-02aa-4301-bc2449003d63",
        "tt.%0",
        "OneSettingsEnabled",
        "indigd tijdens het uitvoeren van een actie in de compatibiliteitsfase.%0",
        "Element",
        "Microsoft.Windows.126.X21-83274_8wekyb3d8bbwe",
        ".CRT$XIZ",
        "STATUS_DISK_FULL",
        "BootFinalize: Initializing Enterprise Attribution:     [%s]",
        "elem testov",
        ".?AV?$CZeroInit@VCDlpActionCreateMediaSuccessFactory@@$00@@",
        "833b999c-4958-6bd4-b220-a59a2d84ff70",
        "PANTHER_ENABLE_TELASSERT",
        "pToRemoveFrom->Element != 0",
        "Kompatibilit",
        "Microsoft.Windows.48.X20-32147_8wekyb3d8bbwe",
        "Microsoft.Windows.48.X19-98800_8wekyb3d8bbwe",
        "73c5cf99-5995-de44-ba16-828f052b1605",
        "si platform meghat",
        "9t$Pt",
        "6O7e7",
        "O processo de instala",
        "Microsoft.Windows.4.X19-98703_8wekyb3d8bbwe",
        "H9VNF-3MFR9-MHFKK-FKHHD-WQPKK",
        ";5;I;z;",
        "<-<u<}<",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteProcessingInstruction",
        "NtOpenSymbolicLinkObject",
        "545c6eca-7b28-eba7-c566-15c078d20d1a",
        "RES_OPTIONAL_RESOURCEID_MAP",
        "4T6DD-KNB6K-9QV69-MB8GK-DYHYC",
        "3217c011-4537-5f99-4619-a6a40813527e",
        "N2GRM-XWYJ7-QB94J-FYJDD-KKX9F",
        "0123456789abcdef",
        "151x1",
        "ProductKey: Calling GatherOSState to generate GenuineTicket.xml",
        "fe2f8fb0-f58c-fbcb-7586-d65e72e0e6b1",
        "1 181P1h1",
        "Microsoft.Windows.4.X20-35516_8wekyb3d8bbwe",
        "61703d92-fa40-8b65-3fd5-dfdae08f289a",
        "5bd84c06-4e87-b415-367c-0bce52b51c2b",
        "1-1<1I1l1",
        "RtlQueryFeatureConfiguration",
        "> >,>4>h>x>",
        "o de configura",
        "SetFilePointerEx",
        "Microsoft.Windows.101.X19-99534_8wekyb3d8bbwe",
        "totta a folyamatot, mert a rendszer nem felel meg a Windows helyre",
        "VWh($",
        "sk-SK",
        "sen.%0",
        "PayloadFileName",
        "5 6U6",
        "a676736b-5e20-c7fc-6736-191d34bc8621",
        ">*?I?o?",
        "N78Q7-C2CCM-2RPCK-9WHYY-2PR77",
        "rio recusou os termos de licen",
        " ke sta",
        "si folyamat kiszolg",
        "Not-null check failed: pContents",
        "CDlpActionProductKeyValidate::DeserializeRoutinePkeyValidate",
        "StartedFromDownlevel",
        "CreateProcessW",
        ":MdSpt",
        "too many symbolic link levels",
        " 9w<t",
        "Microsoft.Windows.48.X20-32143_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X19-98866_8wekyb3d8bbwe",
        "b8258d7e-14e2-21aa-462e-349c2e9369f8",
        "92FN7-DMCHB-GQXFP-PR3H4-9W3D2",
        "es-CO",
        "Microsoft.Windows.100.X19-99463_8wekyb3d8bbwe",
        "RestoreFileMetadata",
        "4b1412af-12ad-0bbd-177e-6f7579c8600f",
        ";6;V;",
        "Microsoft.Windows.165.res-v3787_8wekyb3d8bbwe",
        "99NWR-W7HT9-HYD3X-3DX7V-FJT6M",
        "TRUST_E_NOSIGNATURE",
        "=&=B=[=",
        "4863c2b7-d2b3-2f3f-7ba8-b25e5b7a3315",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionCreateMediaSuccessFactory,class CDlpActionMediaCreationSuccess>::SetActionId",
        "b35c7b1c-1dd7-c586-caa6-c8e0773daeac",
        "4!5k5",
        "ProductKey: Rejecting Key from SkuLib since the Machine is not Active.",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionPreFinalizeFactory,class CDlpActionPreFinalize>::GetActionId",
        "Microsoft.Windows.101.res-v3260_8wekyb3d8bbwe",
        "Microsoft.Windows.121.X20-29551_8wekyb3d8bbwe",
        "ProductKey: Initializing Search locations:   [%ld]",
        "278dabe0-f0c8-bce7-aabd-148006868f9a",
        "ndigen.%0",
        "Microsoft.Windows.165.X21-06169_8wekyb3d8bbwe",
        "o aprova os requisitos de espa",
        "ringsalternativet.%0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::ExecuteRoutine",
        "Compatibility: Resolve Action complete. Notify Task",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::PreInit",
        "FLT_DENORMAL_OPERAND",
        "00a30030-f5de-0c9a-9452-440112835780",
        "ci miejsca na dane do pobrania.%0",
        "9Kdt_",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNS",
        "f72e9233-86eb-e460-18e7-8ecdccbd6ac6",
        "Unstaged Image",
        "CDlpActionDiskPartition::GetBitLockerFromUI",
        "CDriverCallback::ValidateDriverPackage: Override answer - migrate this package",
        "767s7",
        "imi i",
        "Microsoft.Windows.126.X21-03403_8wekyb3d8bbwe",
        "DiskSpaceInstallReq: Initializing SafeOS Image Index:           [%d]",
        "e6286801-6574-9420-2a69-2148558c9f6d",
        "CDlpActionProductKeyValidate::ExtractDataFromEICfg",
        "3-3~3",
        "Microsoft.Windows.99.X20-23528_8wekyb3d8bbwe",
        "ndaren har valt att avbryta eftersom systemet inte godk",
        "ljuk a rendszer telep",
        "4628b519-8008-91e7-ed8c-ee9222261a4e",
        "d342f4b1-c80a-64d3-fa33-106736148236",
        "Not-null check failed: fHasAttributes",
        "647L7c7",
        "DataMigration: Queue preservation of custom scripts into Target OS...",
        "Microsoft.Windows.4.res-v3289_8wekyb3d8bbwe",
        "ProductKey: Product key using host OS edition = [%s].",
        "t$T+t$",
        "2KJ8Y-NJ78C-CKMJH-HQ93F-DJ3XC",
        "MicrodomImplementation::CMicrodom::GetNodeMapNamedItem",
        " opera",
        "8 8(80888@8H8T8t8|8",
        "me n'est pas conforme aux exigences d'espace disque pour t",
        "MVBNC-DB8WB-96B63-QK44V-WK9F7",
        "onecore\\base\\xml\\udom_xmlwalker.h",
        "t$DWh",
        "LocationHeader->Signature == ('cLdM')",
        "76WN9-FYMPD-D4D2F-8V3JG-FVXRD",
        "si folyamatot tesztel",
        "EventSetInformation",
        "7Q8i8",
        "YNF2T-4KM28-YBHHT-FY8FY-DPG4P",
        "4afcab54-4170-d0c7-7de6-a0f725f16eaf",
        "tAh 8",
        "QNVKK-4TW4H-VGPHW-7MPTQ-PYT36",
        "r annonsering.%0",
        "Asennusprosessi lopetettiin odottamattomasti.%0",
        "Loaded hive at BCD%08d",
        "isvaatimuksia.%0",
        "ERROR_ALREADY_EXISTS",
        "Microsoft.Windows.98.X20-29579_8wekyb3d8bbwe",
        "e93fa8ad-2126-91d0-3ec0-35732ea5f425",
        "MYQYY-DNY4T-C2FYR-JCHCC-YKQD3",
        "3T6XG-9ND39-RBXH6-8J9W3-7VCKD",
        "4>5Q5",
        "ImpersonationCountInit",
        "_vsnwprintf",
        "GetSysVolRefNodePath",
        "PostUpgradeFreeSpace",
        "sre haszn",
        "CDlpActionDU::GetProcArchStr",
        "isvaatimusten mukainen.%0",
        "es de compatibilidade protegida n",
        ";';:;\\;",
        "2=2N2k2",
        "9/959X9",
        "051B1",
        "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MiniNT",
        "ConstructPartialMsgVW: MALLOC failed",
        "XR4ND-QXFBP-3GHF8-YFPYH-FJTB8",
        "64Q9N-WR2KJ-8XXP6-HQGWP-YKHBB",
        "Nessun pacchetto da scaricare.%0",
        "XMM3V-NYK4X-V8V44-TGQBV-GCQFM",
        "Microsoft.Windows.49.X19-99510_8wekyb3d8bbwe",
        "basebrd.dll",
        "CDlpActionDiskSpaceReq::PerformSilentCleanup",
        "ddddb9e2-a8ee-6cab-5414-4480c77e8a69",
        "D$$4m",
        "DUImage: Initializing LangPacks Path:            [%s]",
        "BR2Q9-FN6VT-D6JFM-BRCP7-KHJXT",
        "Systemet best",
        "QVNHR-WWCDT-72RDW-XDFV6-XQCRT",
        "re den kj",
        "3075c661-de02-1c8f-1d48-1369ed2a5bef",
        "MoSetupPlatform: Calling SetupPlatform::INewSystem::RequestCancelOperations...",
        "cb23e1f7-bcd4-f79c-4119-73feade9d270",
        "54a5c4ce-6d11-684b-ce23-b2e93250dc7f",
        "060w0",
        "RtlExpandEnvironmentStrings",
        ":><n<",
        "Failed to export unload alterations to firmware. Status: %x",
        "Microsoft.Windows.22.X17-53883_8wekyb3d8bbwe",
        "Suojattuja yhteensopivuusongelmia ei saatu ratkaistua vaaditun ajan kuluessa.%0",
        "37a32952-a4f1-fdf6-2730-5e103ffb2132",
        ",Code=",
        ";H;y;",
        "71c1e6c9-08a0-c911-6ed6-5ce7d52522cc",
        " systemet.%0",
        "VBX36-N7DDY-M9H62-83BMJ-CPR42",
        "nkami.%0",
        "Pliki ",
        "CNRK2-QQ89Q-7P4X3-HGTDQ-C39RW",
        "121Q1r1}1",
        "6f14fe6b-a482-ad65-cb4b-edd53e2a29bd",
        "RtlCompareUnicodeString",
        "DebuggerOptions: Initializing Debugger Type:     [None]",
        "u+jKh",
        "WATSON_DRIVER_CLASS",
        "CompatInstallReq: Initializing Target Edition Id:         [%s]",
        "4f647dfd-61e4-1de6-7685-94b946744879",
        "182ef32b-0cf5-b9ed-d924-2bb1421b0d3f",
        "(caller: %p) ",
        " dezinstalacji.%0",
        "Sistem, ",
        "demment.%0",
        "m kimli",
        "7CYBN-WP2MW-43367-GTG79-4JQ93",
        "Microsoft.Windows.4.X21-05130_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::Cancel",
        "n encontr",
        "0E1s1",
        ".?AUIDUDownloadProgress@SetupPlatform@@",
        "eHe}T",
        "Microsoft.Windows.121.X19-98891_8wekyb3d8bbwe",
        "DUSetup: Loading Facilitator.dll",
        "65a4f206-c212-4609-09af-4db1a8ae6057",
        "ConX::Setup::Common::COSInfoHelper::GetCurrentSystemBranchName GetSystemDirectory() failed :  Err=%d",
        "Not-null check failed: NodeList",
        "5)5l5",
        "STATUS_NO_MORE_FILES",
        "Microsoft.Windows.125.X21-83258_8wekyb3d8bbwe",
        "VNMM9-9DMCX-4FT94-KYDTP-W2Q2V",
        "fc668f10-9dab-b578-f330-8371daaea691",
        "Microsoft.Windows.49.X20-29602_8wekyb3d8bbwe",
        " nejde prov",
        "VGXTQ-WNTR4-KXCPV-8CM4M-6VJVH",
        "en-029",
        "Microsoft.Windows.49.X20-00861_8wekyb3d8bbwe",
        "sente pas l'espace disque requis pour l'installation de la charge utile.%0",
        "GetUserDefaultUILanguage",
        "429dd58f-e149-f248-b552-e43cae3bb514",
        "CMicrodom",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::PrepareRoutine",
        ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpResponse@@@@@@",
        "DownloadFileSizeX86",
        "Aiempaan asennusyritykseen liittyv",
        "rbare filen GatherOsState.%0",
        "3&4-4B4I4z4",
        "text file busy",
        "8)8X8k8",
        "\\Device\\%s\\Partition%lu",
        "BRANDING_REQUIRED_RESOURCEID_MAP",
        "fe592e76-0d20-7ca1-9f29-b6c101672099",
        "6%6G6P6V6m6",
        "serverstandardacor",
        "edchoz",
        "La plataforma de instalaci",
        "80e7d6e1-fe77-a576-3468-ccceb7481653",
        "MinorVersion",
        "86B93-BNKGR-8MYM7-V83BD-XHJWD",
        "ERROR_INTERNAL_ERROR",
        "MoSetupPlatform: Retrieving default boot entry...",
        "D$d9C",
        "Harddisk",
        "c95f37f7-ef55-757f-b603-81883665b83f",
        "EncodingSizer != 0",
        "1bed36be-9029-aad2-1bb3-82e562836936",
        "2\"2)282?2z2",
        "ynnist",
        "Not-null check failed: pUpdateCookie",
        "Microsoft.Windows.101.X20-24585_8wekyb3d8bbwe",
        "CheckHotPluggableDrive: Drive %c SetupDiGetDeviceInterfaceDetail-2 Error: 0x%X",
        "08d8c097-34d2-39a8-abfc-63b09d8045e4",
        "YR229-NB77P-JFKKK-JV8VC-P9XQR",
        "Uma vers",
        "Installasjonsprosessen brukes i et testmilj",
        "xHj1^",
        "ar-SY",
        "Microsoft.Windows.98.X19-99584_8wekyb3d8bbwe",
        "Impossible de cr",
        "GRFBW-QNDC4-6QBHG-CCK3B-2PR88",
        " informace o automatizaci byly neplatn",
        "8GTN9-WP4GG-33HFG-7J66H-4C4CT",
        "RQWPj",
        "+ZLY{",
        "A let",
        "['`OUL",
        "f8f888c4-bad1-3079-9e14-6fc0129829d1",
        "na kontynuowa",
        "DataMigration: Request skipping OOBE.",
        "=d>k>",
        "3QP4N-RC9JQ-XD9MD-7Q647-HXQB9",
        "Microsoft.Windows.49.X19-98826_8wekyb3d8bbwe",
        "Compatibility: Hardblock found. InstallReq polling starts...",
        "shez sz",
        "668224d2-b0c3-b634-b2c1-b04a7689f3c8",
        "6DC8J-PBCRB-C3VPW-94H3W-8R8B8",
        "Havaittiin odottamaton versio asennusymp",
        "t)h@2",
        "Microsoft.Windows.99.X20-29695_8wekyb3d8bbwe",
        "FACILITY_TERMINAL_SERVER",
        " soubor GatherOsState se nepovedlo prov",
        "quc-Latn-GT",
        "Microsoft.Windows.101.X20-25154_8wekyb3d8bbwe",
        "PackageMigration: skipping GDR packages...",
        "UpdateMedia: Box download path is [%s]",
        "Microsoft.Windows.175.X21-41295_8wekyb3d8bbwe",
        "2!202",
        "PGGM7-N77TC-KVR98-D82KJ-DGPHV",
        ":=:i:",
        "Microsoft.Windows.27.X21-03401_8wekyb3d8bbwe",
        "5399250b-c74d-1092-c313-35249ccfaeeb",
        "tuPh0p",
        "8I8`8",
        "f2254766-4f44-4cee-1ba9-144752240d5e",
        "CDlpActionProductKeyValidate::SearchForValidProductKey",
        "CertVerifyCertificateChainPolicy",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::PrepareRoutine",
        "4%4=4y4",
        "ba50230f-c816-781b-89aa-8d1101ec4546",
        "nika dla wielu architektur.%0",
        "L'installazione non pu",
        "base\\ntsetup\\conx\\common\\setuplib\\src\\osinfo.cpp",
        "OfferPackage",
        "ActionListParser::ParseRemovePackage",
        "NtCreateFile",
        ".?AV?$CUnknownImpl@VIProductKeyAction@@@@",
        "4e2169ce-1366-f46d-e29e-25af7dd82cd1",
        "tta eftersom slutf",
        "r kompatibilitetsskanningen for ",
        "ekilde sonland",
        "8&8-8d8",
        "230ced95-6f70-0cb1-1c07-d621fc5e9415",
        "t>9w<t",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::CheckUninitialized",
        "Microsoft.Windows.49.X19-98862_8wekyb3d8bbwe",
        " byla po",
        "k a beavatkoz",
        "DebuggerOptions: Initializing Target:            [%c]",
        "CDlpActionProductKeyValidate::DeserializeRoutineGetEdition",
        "Kurulumun ilk a",
        "j+hx~",
        "d55d4c2b-9488-7f95-b68d-d6373e767a98",
        "06b08a7b-9e54-ed2a-3ad4-03d3b280c0a4",
        "RtlAcquireResourceShared",
        "Microsoft.Windows.101.X20-00898_8wekyb3d8bbwe",
        "33RR8-NYH78-T8DJ4-PCQK6-CGYK4",
        "XRW2Y-N9949-GXYBH-KFDJH-94MRK",
        "Systemet uppfyller inte kraven f",
        "dceeb57c-911c-7bc6-3d14-eb395d17b01b",
        "<*<8<T<[<g<",
        "e6c9da83-70a8-fba8-3a46-e0db5f32eed2",
        " concernant le t",
        "?terminate@@YAXXZ",
        "478eec77-0ac5-164b-267f-65d0d6d46e65",
        "ActionListParser::ParseActionListDocument",
        "bb469e69-f9a4-ec9b-90ef-1845048ee658",
        "Er is een niet-gespecificeerde fout opgetreden in het Setup-platform.%0",
        "Microsoft.Windows.164.X21-04955_8wekyb3d8bbwe",
        "FACILITY_USB_ERROR_CODE",
        "N6HM8-VYWXY-PK8V2-R8DV8-HMH26",
        "717w7",
        "2$2T2t2",
        "QP2WN-49X2P-W66XQ-KWB9G-TJF9G",
        "]B}bk",
        "Failed to get size of existing string",
        "rdi ikke stemmer overens.%0",
        "Not-null check failed: NewMicrodom",
        "Microsoft.Windows.48.X20-46576_8wekyb3d8bbwe",
        "Die Kompatibilit",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::GetActionName",
        "CompatInstallReq: Initializing Driver Install Path:       [%s]",
        "anie, poniewa",
        "r nedladdningen av nyttolasten.%0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::Restart",
        "FveOpenVolumeW",
        "Microsoft.Windows.122.X19-98687_8wekyb3d8bbwe",
        " skanowania zamkni",
        "function not supported",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::GetResults",
        "en-AU",
        "tzt.%0",
        "FFGDT-8TNGF-QW4D7-367BJ-6MVKD",
        "L'analyse de compatibilit",
        "GetProcAddress",
        "Microsoft.Windows.48.X20-32151_8wekyb3d8bbwe",
        "5>5I5v5",
        "5 5@5H5T5t5",
        "FindClose",
        "e67a77f9-d990-630b-d7f4-fc8f8e2a3220",
        "FltCommStubRename",
        "CMicrodomBuilder::CFourStringIdTable<struct _MICRODOM_XML_ATTDEF const *>::Initialize",
        ";G<x<",
        "\\Windows\\Setup\\Scripts\\oobe.cmd",
        " suportada.%0",
        "596ed611-def9-7d63-dd84-8eb33a2597e0",
        "loha.%0",
        " nie znaleziono warto",
        "ngning.%0",
        "TreatAsSystem",
        "8e20e60b-0826-3084-51fe-cda9e1b184cd",
        "2\"3,3V3`3",
        "AltStoragePath",
        ">W>s>",
        "BCryptCreateHash",
        "Microsoft.Windows.101.X20-24578_8wekyb3d8bbwe",
        "tirme Arac",
        "t9h@q",
        "uGjHW",
        "851e5deb-4d30-0fa2-f08a-d3b7eccb91e2",
        "9$939?9\\9c9o9v9",
        "5c5b12ee-102e-18c1-27b5-ce47f51ec109",
        "27b17d1d-497a-1933-db83-ce7508961a74",
        "Microsoft.Windows.99.X19-99573_8wekyb3d8bbwe",
        "Q3FT7-64NXV-924XG-RBRT2-JB48R",
        "STATUS_ACCESS_DENIED",
        "onecore\\base\\xml\\isolib_parser.h",
        ".?AVIActivationAction@@",
        "Microsoft.Windows.7.X21-83185_8wekyb3d8bbwe",
        "_peg0",
        "*ppvAlloc = RtlAllocateHeap((((PPEB)__readfsdword(((LONG)(LONG_PTR)&(((TEB *)0)->ProcessEnvironmentBlock))))->ProcessHeap), 0, cb)",
        "MoSetupPlatform: Releasing SetupAutomation object...",
        "result out of range",
        "n bu s",
        " Microsoft Corporation. Alle rettigheder forbeholdes.",
        "Microsoft.Windows.136.X20-43107_8wekyb3d8bbwe",
        "9d929f52-59e3-3939-e85c-a6584b248c13",
        "f0d76ba3-fa6e-2bee-75cb-465e931697c8",
        " il sistema non soddisfa i requisiti minimi per il download dell'aggiornamento.%0",
        "W93uH3",
        "Microsoft.Windows.99.X19-98664_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X20-00859_8wekyb3d8bbwe",
        " demand",
        "CDlpActionProductKeyValidate::SelectImageFromSkuLib",
        "CreateMutexW",
        "MediaBasedUpgradeUsingLocalCompDB",
        "086b6b71-d38d-26a0-6d76-0081219ba443",
        "4N96H-6GK4Q-Y6CFF-7XMTD-7VCF6",
        "Q9N3Y-9RMD7-7BF4J-TY7RG-XP7BB",
        "1c2df123-57f9-d28e-8fd8-969b5f77f441",
        "Nie mo",
        "\\O#]`",
        ";,;4;<;D;L;T;\\;d;l;t;|;",
        "Microsoft.Windows.122.X19-98682_8wekyb3d8bbwe",
        "Microsoft.Windows.125.X21-83256_8wekyb3d8bbwe",
        "1H2O2s2\"3",
        "9KdtL",
        "Microsoft.Windows.48.X21-83178_8wekyb3d8bbwe",
        "610a4ae6-7b5c-a525-c926-4e7657673d28",
        "3XFYC-YN792-HV76R-P93XR-MWRBY",
        " !\"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@O",
        "Se ha encontrado una operaci",
        "%hs: couldn't get host edition id",
        "6 686|6",
        "7&7X7z7",
        "TX72N-9YCF8-V9382-CT8KG-H8RB4",
        "2*2K2c2B3^3l3",
        "Der Benutzer hat den Vorgang abgebrochen, da das System den Compat-Scan f",
        "Index out of bound.",
        "85b838e4-661c-ed3e-bcff-31feac8e442b",
        "standalone",
        "jH^VR",
        "ivatel pou",
        "Il sistema non soddisfa i requisiti minimi per il download dell'aggiornamento.%0",
        "`1XL0!q",
        "1b6c72e6-1ef5-057b-660e-3dc31461b355",
        "ndaren har valt att avbryta eftersom systemet inte uppfyller minimikraven f",
        "NTFS    ",
        "Azioni base installazione",
        "01148e89-8414-0a41-73eb-5069a2e2d347",
        "JVVVS",
        "T8RV8-G9NDF-P3KYY-6QQB7-94R7V",
        "ERROR_FAIL_REBOOT_REQUIRED",
        "GetWebSetupUserInput",
        "1[1t1",
        "aad433ae-1674-6860-0467-b23b3bca7876",
        "Microsoft.Windows.101.X20-35490_8wekyb3d8bbwe",
        "JGDN9-WKM9H-7RKXC-73PKD-FM49Q",
        "7C2NP-7MHC9-DD62H-JJQDH-2R4BJ",
        "EulaFilePath",
        "too many files open in system",
        "d4ec72f2-a95d-a6d6-7742-5442843f9efb",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::CTempOutputStream::CreateInterface",
        "X20-29592;X20-32145",
        "WriteDataCallback",
        "Microsoft.Windows.49.X19-98834_8wekyb3d8bbwe",
        ".?AV?$CZeroInit@VCDlpActionSummaryFactory@@$00@@",
        "BitLockerMode",
        "? ?p?",
        "PostOobeArgs",
        "45381008-b4ce-e66e-77a8-ed7b52e980f5",
        "CoTaskMemFree",
        "tsphase beendet.%0",
        "isvaatimusten ongelmia ei ratkaistu aikarajaan menness",
        ".?AV?$CZeroInit@VCDlpWimInfo@@$00@@",
        "9e22eb3d-cc9e-8968-106c-c1295221f9ea",
        "fFound",
        "NotificationUIShown",
        "SqmOptInDefault",
        "HQG3W-RVNYW-7MV7T-T6C2M-TXXR2",
        "Microsoft.Windows.4.X20-46571_8wekyb3d8bbwe",
        "Failed to generate the compat report [0x%X]",
        "95:t:~:",
        "O utilizador optou por cancelar o contrato de licen",
        "NOTATION",
        "0(010:0C0L0U0^0g0",
        "1b73b638-ecf7-bb1d-8741-20fe7647db44",
        "ServerComputeCluster",
        ">??w?",
        "SOFTWARE\\Microsoft\\WindowsUpdate\\CommitStatus",
        "Microsoft.Windows.27.X21-03400_8wekyb3d8bbwe",
        "P9NHK-M44VD-96RBX-DGX2F-X2G2C",
        " Windows",
        "t-j._f;9u",
        "MoSetupPlatform: Loading ReAgent module...",
        ";0;4;L;\\;`;d;l;t;",
        "e6c69f2e-f45f-c3a9-b6e5-2d3ce248cec1",
        "6a47536b-b0c7-f78c-b9cf-66cbffbf25c3",
        "CDlpActionFinalize::SerializeRoutine",
        "Microsoft.Windows.48.X20-32156_8wekyb3d8bbwe",
        "6BY82-GNQ24-DMTP3-X9VQD-VXQB9",
        "7N7s7",
        "There was no offer found that matches the required criteria.%0",
        "ae7161e3-580a-e3c9-ca18-2089d55bccec",
        "Installasjonen kan ikke fortsette fordi en n",
        "DataMigration: Request skipping ZDP.",
        "Deleting element %08x blocked by secure boot policy.",
        ">4>@>`>h>x>",
        "Microsoft.Windows.180.X21-83668_8wekyb3d8bbwe",
        "MoSetupPlatform: New installed image should be used for recovery. Setting option to not install a separate PBR image.",
        "Microsoft.Windows.49.X20-29563_8wekyb3d8bbwe",
        "setup.exe ",
        "j YWPS",
        "Byla zji",
        "*41;D$<s",
        "CharNextW",
        "RegDeleteValueW",
        "LangPackInstallPath",
        ".?AV?$CZeroInit@VCDlpActionDiskSpaceReq@@$00@@",
        "Microsoft.Windows.49.X20-35599_8wekyb3d8bbwe",
        "3!3o3",
        "-instala",
        "SetSecurityInfo() failed",
        ".?AV?$CZeroInit@VCDlpActionDataMigrateFactory@@$00@@",
        "=,=;=Z=u=",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionUpdateMediaFactory@@VCDlpActionUpdateMedia@@@@",
        "ProductKey: Clearing existing image selection response (product key changed).",
        "Microsoft.Windows.49.X20-39268_8wekyb3d8bbwe",
        "HKLM\\System\\ControlSet001\\Control\\CI\\Policy",
        "Het installatieproces is gestart met een ongeldig opdrachtregelargument.%0",
        "Microsoft.Windows.146.X21-83683_8wekyb3d8bbwe",
        "edpotvrzovac",
        "embeddede",
        "Failed to set wof data",
        "y)Vhy",
        "Microsoft.Windows.100.X20-25152_8wekyb3d8bbwe",
        "PTKM3-DN93H-8WPY6-G7V7T-HFMT7",
        "de ser executado ou retornou um erro.%0",
        "Compatibility: Dismissible Block NOT found.",
        "09e9b2f7-a68a-f3bd-71e7-8212742f5423",
        "STATUS_CANNOT_DELETE",
        "Microsoft.Windows.164.res-v3786_8wekyb3d8bbwe",
        "C9XH3-B2NV7-HKKDC-DYYPK-MG9RX",
        "N2TJ6-23GWD-H9FW8-WD3P3-T6RBQ",
        "SetupCore::RegisterSetupActions",
        "595^5",
        "my s m",
        "8$9D9Y9",
        "DebuggerOptions: Initializing Debugger Type:     [1394]",
        "m_Entries.Allocate(PoolHeader->TotalCount)",
        "Microsoft.Windows.126.X21-83268_8wekyb3d8bbwe",
        "c69c6746-94f4-1b79-2ea0-2c4fd5505e08",
        "No se pudo ejecutar un script de aciertos o se devolvi",
        "RestoreFileMetadata: RestoreHardlinks failed",
        "9FNHH-K3HBT-3W4TD-6383H-6XYWF",
        "Der Installationsprozess wird in einer Testumgebung verwendet.%0",
        "4b6a0d5e-4f4c-1a25-7102-f50c0b688f97",
        "3NFXW-2T27M-2BDW6-4GHRV-68XRX",
        "JR9RG-GKNM3-GBW8C-X9893-2WF8F",
        "m limitu smlouvu EULA.%0",
        "in kullanmad",
        "ndaren valde att avbryta eftersom enheten inte har tillr",
        "_^[+P",
        "2@3G3",
        ":\":G:]:{:",
        "o do Windows n",
        "RtlQueryWnfStateData",
        "lineen tietojen lataamisen ja purkamisen levytilavaatimuksia.%0",
        "1(131X1c1~1",
        "a6881fdf-8268-6915-7206-0b9a38f31430",
        "8cbc17af-95c5-ce44-21f2-00ef4c6c6330",
        "Compatibility: GenerateHardwareCompatFile: IDUPackageCollection is empty. Not generating DuHwCompat file.",
        "\\??\\PhysicalDrive%d",
        "Sleep",
        "WTTFN-W2MVP-H2DB9-R7XRD-PYWV3",
        "52595H5`5w5",
        "Microsoft.Windows.48.X20-29668_8wekyb3d8bbwe",
        "Microsoft.Windows.121.X19-98676_8wekyb3d8bbwe",
        "stes inte innan tidsgr",
        "*ppObject = State->m_pAllocator->Allocate<OfferPackage>()",
        "S$[_^",
        "RegEnumValueW",
        "1.4.1",
        "CDlpActionPackageMigrate::DeserializeRoutine",
        "SetupCore: Registered DISKSPACE_DOWNLOADREQ action",
        "R6VGT-8N4QF-CH23Y-D2F22-RVXPG",
        "Microsoft.Windows.48.X20-23596_8wekyb3d8bbwe",
        "Microsoft.Windows.122.X19-99471_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X19-99513_8wekyb3d8bbwe",
        "D$(P3",
        "Microsoft.Windows.122.X19-98691_8wekyb3d8bbwe",
        "TTYX6-G2NDY-H3HRB-MQP77-9BWYQ",
        "GetTraceEnableLevel",
        "> >0>4>8>@>D>X>\\>`>d>h>l>p>t>x>|>",
        "(NewName == 0) || RtlIsLUtf8StringValid(NewName)",
        "F48BJ-8NX82-MRVY9-PF8BW-HMHY2",
        "03ab2d81-d02e-e041-f49a-7576176c5d61",
        ";D$<s",
        "Microsoft.Windows.49.X20-35549_8wekyb3d8bbwe",
        "Microsoft.Windows.126.X21-03401_8wekyb3d8bbwe",
        "SYSTEM\\Setup\\Panther",
        "FACILITY_ITF",
        "Microsoft.Windows.121.X20-29609_8wekyb3d8bbwe",
        "6CRRT-MFK42-PVN9R-BTYV6-722KV",
        "Microsoft.Windows.48.res-v3313_8wekyb3d8bbwe",
        "415D5s5z5",
        "ksynyt k",
        "MigChoiceDefault",
        ".?AV?$CZeroInit@VCDlpActionProductKeyValidateFactory@@$00@@",
        "DataMigration: Queue skipping product key into Target OS...",
        "FACILITY_MONITOR",
        "br-FR",
        "334834ed-a7bf-670e-dc85-4b973fbba7a9",
        "Microsoft.Windows.8.res-v4303_8wekyb3d8bbwe",
        "Asennus on keskeytetty testaamista varten.%0",
        " pobrania aktualizacji.%0",
        "file too large",
        "ga-IE",
        " smlouvu.%0",
        "j?Xf;",
        "RTKX8-9DNPD-3K8C9-FRDWW-QDCM4",
        "CompatGatedCheck",
        " uprzednio rozpocz",
        "787?7K7i7p7",
        "Microsoft.Windows.100.X19-99669_8wekyb3d8bbwe",
        "a est",
        "bn-BD",
        "Exporting store alterations to efi",
        "1:1A1H1P1a1x1",
        "c7689b79-4c1f-7b8a-506c-671b5a728ed2",
        "SetupCore: Registered MEDIA_CREATE_SUCCESS action",
        "(SourceCount == 0) || (Sources != 0)",
        "<!=+=R=\\=",
        "919;9b9",
        ";-;_;~;",
        "Microsoft.Windows.101.res-v3505_8wekyb3d8bbwe",
        "r att ",
        "Microsoft.Windows.8.X21-83688_8wekyb3d8bbwe",
        "49BWB-KND26-48W74-4626D-H2V4J",
        "o deve ser notificado.%0",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionProductKeyValidateFactory,class CDlpActionProductKeyValidate>::CreateAction",
        "4HNYR-F9BXF-TC2CH-H7MR8-VH7MQ",
        "NtQueryInformationFile",
        "13668f4d-065a-6636-0a9f-9b559c92c8c9",
        "Failed to allocate process ID buffer.",
        "SelectedMigChoiceLocation",
        "#,|6d",
        "onecore\\base\\servicing\\actionlist\\lib\\cactionlist.cpp",
        ".CRT$XIA",
        "NDATA",
        "1#1)1@1J1P1l1r1R2",
        "Microsoft.Windows.126.X21-83278_8wekyb3d8bbwe",
        " Windows ",
        "o no momento.%0",
        "tIVS3",
        "CDlpActionCompat::ExecuteInstallReqScan: Enter",
        "7586800e-55d1-6c15-5a6a-9aab7d786933",
        "::RtlIsLUtf8StringValid(String)",
        "66f15731-250a-1407-0f3d-37dcea5e3a3b",
        "zh-CN",
        "Microsoft.Windows.48.X19-99644_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X20-29638_8wekyb3d8bbwe",
        "TlsAlloc",
        "Een foutscript kan niet worden uitgevoerd of heeft een fout geretourneerd.%0",
        "Failed to coerce string.",
        " avbryte installasjonsprogrammet for ",
        "Le processus d",
        "T7TMJ-6RNKP-Q8VX2-82JT9-KQBPF",
        "tWSW3",
        "ActionListGDRPaths",
        "PackageMigration: No. of FODs to be removed: %d",
        "G QQVP",
        "6QGCQ-NDBF6-QVG9Q-4B799-RM47V",
        "NT9F9-FXQ3D-6VJRX-YBRC3-BG9R2",
        "VirtualFree",
        "already_connected",
        "rfiler uppt",
        ".?AVIDiskPartitionGetBKeyAction@@",
        "es-PY",
        " l'hash di istanza non ",
        "r dieses System gefunden.%0",
        "FindFirstFileW",
        "DeletePathDirectoryCallback: Spoofing detected deleting [%s] -> [%s]",
        "e80ad046-7bb0-3318-5c2c-87083cac529a",
        "Instalace nem",
        ":1:K:\\:",
        "1M2`2",
        ".?AV?$CZeroInit@VCDlpActionFinalizeFactory@@$00@@",
        "Microsoft.Windows.7.X21-83403_8wekyb3d8bbwe",
        "08d05996-24c0-88e4-45f8-0fa748f6b4f9",
        ";D$4uV",
        "State.m_WalkCursor.IsUtf8()",
        "AppScanResultPath",
        ".text$di",
        "Microsoft.Windows.101.X19-98872_8wekyb3d8bbwe",
        "strcpy_s",
        "FindWindowExW",
        "7Z8|8",
        "68cde49c-3add-500f-5f8c-2cbe1eb0b109",
        "82TGN-T7VPQ-RBFRF-WGCP2-RVVX6",
        "Microsoft.Windows.121.X20-29610_8wekyb3d8bbwe",
        "Microsoft.Windows.99.X20-29690_8wekyb3d8bbwe",
        " kalmad",
        "&apos;",
        "j3VWh",
        "<I=?>F>T>",
        "16a750f3-e141-f8b4-a55e-846c599fa843",
        "Microsoft.Windows.122.X20-00861_8wekyb3d8bbwe",
        "MoSetupPlatform: NewSystem object resurrected!",
        "FMRXN-7HQ8Q-QGPRR-4QVMG-HFV4F",
        "c5fe3113-59e7-7853-15d1-bce21b878744",
        "Failed to query processes. Status: %x",
        "Microsoft.Windows.121.X19-98889_8wekyb3d8bbwe",
        "525d2a53-8a70-e416-8541-2cf9bac779e3",
        ".?AV?$CUnknownImpl@VIFCDiagnostics@@@@",
        "MediaCreationSuccess: Entering execute.",
        "az-Latn",
        "4WX3D-NPGJF-F4X7B-X9PRX-V24CB",
        " /MediaEdition %s",
        "5F5K5",
        "95f000a1-bfce-1d41-a6bc-d6706ab61b91",
        "W6X2Q-NDHPF-F9PTD-496HM-8FCQK",
        "9RNQV-3KMXY-9FFM9-WVXYM-88F8R",
        "se-FI",
        "Not-null check failed: Out",
        "t+Qh0N",
        "H3RNG-8C32Q-Q8FRX-6TDXV-WMBMW",
        "Microsoft.Windows.8.X21-83706_8wekyb3d8bbwe",
        "UseDigitalKey",
        "c42a2c3e-80e6-09fa-0148-71f2ac4157a5",
        "terst",
        "Microsoft.Windows.49.X20-46575_8wekyb3d8bbwe",
        "StorageTiering not supported",
        "Microsoft.Windows.48.X19-99495_8wekyb3d8bbwe",
        "pl-PL",
        "4fe354e4-a03b-d56e-fbc6-ba56b30c084a",
        "Microsoft.Windows.48.X21-03401_8wekyb3d8bbwe",
        "CDlpActionDiskPartition::GetResultsRoutine",
        "X3VPN-YDJDD-VQ3YY-Y23QB-2PQGP",
        "moh-CA",
        "kningen f",
        "PRC3N-RPM29-FF7JV-9V3HK-HCFBG",
        "@t[9\\$",
        "Microsoft.Windows.48.X19-99478_8wekyb3d8bbwe",
        "2df6f31c-18d2-fd0b-267e-a27bd6aab9b6",
        "VRVD4-J8NQT-D73PB-B8HQD-VXMK4",
        ":-:G:e:",
        "nschte Migrationsoption nicht.%0",
        "3%3=3E3",
        "r portet kompatiblitetsskanningen til ",
        "NTHVR-CXRP6-RPHCC-JXW7W-KY9XD",
        "ProductKey: Matching Install Wim For Compatible Editions",
        "0n06RP",
        " zgodno",
        "Microsoft.Windows.99.X20-00905_8wekyb3d8bbwe",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::InitializeRoutine",
        "792C8-N4TPB-JTPKW-BFT8W-J8BTM",
        "IsEnterpriseGSKU",
        "%BASE_KN%",
        "Microsoft.Windows.99.X19-99572_8wekyb3d8bbwe",
        "HomePremium",
        "N69G4-B89J2-4G8F4-WWYCC-J464C",
        "450d145f-1eab-7644-84e1-3b40d2b9a932",
        "L$d_^[3",
        "3NJKG-28PB8-XMC64-QHMX2-FYBJT",
        "ZwEnumerateBootEntries",
        "J43QF-MNFC2-8YX8Q-H8VKV-94R7Q",
        "TV9QN-3DF2G-6QBCH-M6DWG-BP222",
        "Installationsprocessen kr",
        "MicrodomImplementation::CMicrodom::GetElementsByTagName",
        "8CNY3-CWY7D-F8MFX-8QKHK-HCD94",
        "ndelser.%0",
        "< <,<<<G<S<c<n<z<",
        "49WPM-GNK3J-2CDRH-3D4VY-YWRTP",
        "rmek i",
        "installation pour ce syst",
        "Microsoft.Windows.162.X21-43649_8wekyb3d8bbwe",
        "i selh",
        "9325f17d-f65b-cd50-e813-0c539b879145",
        "serverhomestandard",
        "Microsoft.Windows.172.X21-24743_8wekyb3d8bbwe",
        "Microsoft.Windows.121.X20-35501_8wekyb3d8bbwe",
        "installation",
        "De gebruiker heeft ervoor gekozen om te annuleren omdat het systeem niet voldoet aan de apparaatscan voor het installeren van de update.%0",
        "WHYNJ-7B694-MWQJY-DF96F-KBT6Q",
        "Microsoft.Windows.49.X19-98860_8wekyb3d8bbwe",
        "DUSetup: Initializing Working Path:      [%s]",
        "o coincide.%0",
        "Driver",
        "Microsoft.Windows.49.X20-29601_8wekyb3d8bbwe",
        "CDlpActionCompat::ExecuteMigChoiceScan: Enter",
        "Microsoft.Windows.101.X20-30284_8wekyb3d8bbwe",
        "Microsoft.Windows.8.X21-83707_8wekyb3d8bbwe",
        "<-=6=?=X=a=",
        "ru-MD",
        "tn-ZA",
        "CRYPT_E_NOT_FOUND",
        "CDlpActionDU::ExecuteFacilitatorDUImage",
        "Microsoft.Windows.27.X19-98769_8wekyb3d8bbwe",
        "0R0n0",
        "69f3acb6-7695-8b3c-ae1c-642962a68109",
        "Microsoft.Windows.48.res-v3557_8wekyb3d8bbwe",
        "<&<-<J<Q=",
        "6@7E7",
        "WinVerifyTrust",
        "2:2d2",
        "relse blev ikke udf",
        "ActionListParser::ParseMedia",
        "24ed4a73-25ec-cba0-75b8-2135e8878fe6",
        "Le fichier ex",
        "ProductKey: Product key using pkey edition = [%s].",
        "professionals",
        "ConX::Setup::Common::COSInfoHelper::GetCurrentSystemBranchName StringCchCat() failed :  hr=0x%d",
        "d\\OL0",
        "MXNVQ-Q8TR8-RP9YQ-CVF94-FC2JK",
        "997841f0-69a6-dc79-b29c-6b378e34d41f",
        "Microsoft.Windows.122.X19-99476_8wekyb3d8bbwe",
        "t^Wh ",
        "RevertToSelf",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::GetState",
        "serverstorageexpresscore",
        "Microsoft.Windows.48.X19-99484_8wekyb3d8bbwe",
        "az-Latn-AZ",
        "o. %0",
        "97f94f8f-1743-7135-dd92-5a4e05b8afda",
        "HKLM\\System\\Setup\\Upgrade",
        "b3d1f512-384b-1246-5ee8-1a2274e5cbe6",
        "Microsoft.Windows.101.X20-29682_8wekyb3d8bbwe",
        "r die Installation des Updates nicht bestanden hat.%0",
        "ZwOpenSymbolicLinkObject",
        "N6WXW-FBTF4-T87CB-KXMRC-W2R9H",
        " gestita per l'installazione dell'aggiornamento.%0",
        "Microsoft.Windows.99.X20-15862_8wekyb3d8bbwe",
        "NJ4MX-VQQ7Q-FP3DB-VDGHX-7XM87",
        "GetWIMBootWIMPathInternal",
        "D$tHP",
        "Microsoft.Windows.146.X21-43660_8wekyb3d8bbwe",
        "N9BYX-9TGXH-XCGG2-GKCR8-BWRBW",
        "instance ne correspond pas.%0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::GetActionName",
        "Microsoft.Windows.99.X20-29721_8wekyb3d8bbwe",
        "Sonland",
        "SetupBranchName",
        "10d2b9a4-ae42-00c8-c3c7-72c65823cd0a",
        "PreFinalize: Initializing Driver install path: [%s]",
        "DeleteFileEx: Spoofing detected deleting [%s] -> [%s]",
        "Microsoft.Windows.48.X20-29663_8wekyb3d8bbwe",
        "CMicrodomBuilder::ConsumeEntityDecl",
        "29N8G-XMMD7-8PTV2-6FF7F-TVJ48",
        "6984817d-beb4-b545-a3e2-8562a0b9956f",
        "InstallFeature",
        "re nem.%0",
        "rios da Plataforma de Configura",
        "ProgressTotal",
        "Microsoft.Windows.48.X19-98840_8wekyb3d8bbwe",
        "Microsoft.Windows.48.X20-35543_8wekyb3d8bbwe",
        "DMRN9-MH9B4-XYKKF-4C7PK-66RBD",
        ".idata$2",
        "5\"6}6",
        "CDlpActionCompat::ExecuteFinalizeReqScan",
        "Activation: Error reporting telemetry for bActivationBlockSkipped: [0x%X]",
        "1I2_2|2",
        "@\\jdPQ",
        "7 7$7<7@7X7\\7t7",
        "de6311aa-794d-62bf-3328-f5476cb92bfc",
        "2f3m3",
        "5<5B5\\5v5",
        "De momento, n",
        "68dadf84-96cc-028c-fb12-a6fc4fb11a2f",
        "Opening object %s",
        "Bugcheck driver downloaded",
        "Microsoft.Windows.98.X20-29588_8wekyb3d8bbwe",
        "vel tentar novamente.%0",
        "ek0B}",
        "73654780-d0f0-d91e-3a3f-8c9546ef8750",
        "EditionID",
        "L'utilisateur a accept",
        "Microsoft.Windows.100.X19-99455_8wekyb3d8bbwe",
        "tdjah",
        "6P7`7\"8)8",
        "Optional",
        "Installationsprocessen blev afbrudt.%0",
        "DiskSpaceReq: Checking disk space req without storage reserves",
        "6PWN4-9D86H-G47W8-J9VFJ-HMHYG",
        "PackageMigration: Initializing LXP paths            [%ld] [%s]",
        "3df6c8c1-847a-2fd6-17dd-de1454272f4d",
        "Die Installation kann nicht fortgesetzt werden, weil eine erforderliche Aufgabe fehlt.%0",
        "6557c980-c132-299b-1d1a-9572816e4b7b",
        "res requis n'a ",
        "business",
        "El sistema no cumple los requisitos de espacio en disco para descargar la carga.%0",
        "r enhetsskanningen for ",
        "919N9k9",
        "DUSetup: Initializing DU Channels Flag:  [0x%X]",
        "let probl",
        "9NJCK-3BFY8-TCXGJ-VYPHH-7QWWB",
        "3PFM8-GN437-GW6KP-FVXXK-YDYM8",
        "Opening system store. Flags: 0x%x",
        "PackageMigration: Initializing LXP License Count    [%ld]",
        "FMGHT-G2NBT-7QXYM-GX8BJ-CPQXB",
        "<R=g=",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::CheckUserInterrupt",
        "gung steht.%0",
        "ImageFinalize: Initializing Target:                           [%c]",
        "cc308cc1-0306-41ce-4f7e-32ac61f571ee",
        "C(;C$",
        "Microsoft.Windows.100.X19-99446_8wekyb3d8bbwe",
        "jlok s",
        "Microsoft.Windows.4.X19-98714_8wekyb3d8bbwe",
        "Could not move source file",
        "a2ce01f8-d348-0edb-b156-0e4547c97a37",
        "da7bc061-4e48-141c-9f92-8cfff153e2e5",
        "1E1]1",
        "Microsoft.Windows.101.X19-99527_8wekyb3d8bbwe",
        "PayloadType",
        "D$DPj",
        "1F1O1T1_1d1",
        "ProductVersion",
        "Microsoft.Windows.162.X21-43640_8wekyb3d8bbwe",
        "CDlpActionDataMigrate::MigrateCustomScripts",
        "HJWRN-H7DPH-CJDQ9-R487F-JHVYG",
        "Konfigura",
        ".?AV?$CSetupObject@VCSetupCore@@VISetupCore@@@@",
        "0g0W0_0",
        "o aceitou o EULA dentro do limite de tempo necess",
        "osan puuttumisen vuoksi.%0",
        "Microsoft.Windows.165.X21-06176_8wekyb3d8bbwe",
        "585F5b5",
        "Microsoft.Windows.188.res-v4363_8wekyb3d8bbwe",
        "7b551831-c4a3-c878-59c3-09cd4760a6d0",
        "Tato verze n",
        "n hajautusarvoa ei l",
        "Microsoft.Windows.101.X20-29680_8wekyb3d8bbwe",
        "o pode continuar porque o sistema est",
        "VirtualAlloc",
        ";S<r<",
        "CDlpActionCompat::DeserializeInstallReqScan",
        " /MediaLangCode %s",
        "37PGN-R92CV-T37D6-G7733-TCQFV",
        "Microsoft.Windows.49.X19-99722_8wekyb3d8bbwe",
        "UpdateId",
        "\\Partition0",
        " /Eula Accept /Action CreateMedia",
        "imageName",
        "slednou hodnotu je nutn",
        "DUImage: Initializing Media CompDB Path:         [%s]",
        "andromeda",
        "ImageExit: Initializing PostReboot:  [%s]",
        "verskred tidsgr",
        "Failed to allocate memory",
        "Microsoft.Windows.122.X19-98683_8wekyb3d8bbwe",
        "IsDriveLetterSupported: Checking if drive [%c] is supported",
        "DUSetup: Failed to execute DUSetup seach and download  [0x%x]",
        "Microsoft.Windows.164.X21-06160_8wekyb3d8bbwe",
        "DownloadExternalDriveLetter",
        "NT78P-JKW68-XMYBT-VM3CF-8B49F",
        "Suoritettavalla GatherOsState-tiedostolla on virheellinen allekirjoitus.%0",
        "SetupCore: Registered EULA action",
        "D7MXN-HGMTK-3DY7V-T9PTM-KD8DC",
        "nsen.%0",
        "in setup.exe komut sat",
        "t SSSj",
        "VTRMB-NMG7J-4QKPT-VJ9TH-X763W",
        "list<T> too long",
        "BitlockerDeviceAvailable",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::Suspend",
        " dotycz",
        "Microsoft.Windows.100.X20-29711_8wekyb3d8bbwe",
        "Zu)A;",
        "CDlpActionImageDeploy::GetResultsRoutine",
        "Success,",
        "3JMPN-B7BMV-6WHBF-WQT32-6JHWY",
        "202@2P2`2d2x2",
        "oikeussopimusta aikarajaan menness",
        "Actions principales du programme d'installation",
        "0?0F0",
        "7MND6-J7F4G-F887Y-99XMG-2373G",
        "professionalembedded",
        "0E0f1",
        "6%7H7",
        "ccf8b249-28ac-6078-a2bc-170646877213",
        "zane w wymaganym czasie.%0",
        "6C3Q3-3NFYH-YYYXW-3TQMJ-WB6GC",
        "PreFinalize: Initializing FullUpgrade:         [%s]",
        "af-ZA",
        "6D6{6",
        "8PCMT-WNMRK-7MF6V-PFHXJ-7FTF8",
        "ny kivonata nem egyezik.%0",
        "Microsoft.Windows.125.X21-83243_8wekyb3d8bbwe",
        "setup.exe",
        "6N7k7",
        ".?AUIDriverInstCallback@SetupPlatform@@",
        "CDlpActionDiskSpaceReqFactory::CreateInstanceRoutine",
        "67fdad5f-4038-ae22-977d-ee0b74d73881",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::CheckUninitialized",
        "Nenhum pacote a ser baixado.%0",
        "N3TDW-CW7TP-69FJC-RT2WD-QRR9M",
        "1+2<2i2",
        "GetSetupPlatformVersion",
        "O0M0K",
        "\\StringFileInfo\\%04X%04X\\%s",
        "WIMCloseWIM",
        "Microsoft.Windows.48.X20-21798_8wekyb3d8bbwe",
        "ini do",
        "ho programu je pr",
        "De installatie kan niet worden voortgezet omdat er al een voltooibewerking is aangevraagd.%0",
        "90u69",
        "0,131:1A1H1O1",
        "Failed to query boot options. Status: %x",
        "Microsoft.Windows.49.X20-29591_8wekyb3d8bbwe",
        "ZwUnloadKey2",
        "STATUS_DIRECTORY_NOT_EMPTY",
        "Microsoft.Windows.101.X19-99650_8wekyb3d8bbwe",
        "The user has chosen to cancel because the system does not pass the minimum requirements to recover Windows.%0",
        "mn-MN",
        "HB6YC-3NYTP-3RRW4-HXPPT-683DY",
        "Automation: Registered Update Media Response",
        "4f8fe235-b28a-6de9-ff82-600a8e2e46d0",
        "9DN2B-8B4HC-YFKWM-TCPW9-TF672",
        "Microsoft.Windows.49.X19-98817_8wekyb3d8bbwe",
        "2VQHK-NR3BF-H9R4D-RFKRT-8T3D3",
        "rios de Plataforma de Instala",
        "Recovery: Offline Language:     [%s]",
        "CDlpActionDiskSpaceReq::DeserializeDownloadReq",
        " rencontr",
        "IMAGE",
        "HKN62-QMXYP-F982Y-KB9Q8-GVKWJ",
        "Microsoft.Windows.171.X21-24738_8wekyb3d8bbwe",
        "76WDM-TN9D3-JTBH4-FCR4R-3DDFR",
        "Deleting boot entry 0x%x",
        ";G;p;w;~;",
        "7f1428be-3639-614f-3708-d385dbdf407a",
        "Microsoft.Windows.49.X21-03402_8wekyb3d8bbwe",
        "Installationen kan ikke forts",
        "C6R9P-FVN2Y-MT2GY-M99DK-Y7XRH",
        "ddffd099-d250-c0f1-a899-5828fe665d99",
        ">K>n>",
        "3838C-9YXM9-8X6MC-D7HF2-27QWV",
        "Den angitte automatiseringsinformasjonen var ugyldig.%0",
        "GY7H2-PND3J-RDVPM-3WG74-2KDH8",
        "Microsoft.Windows.48.X20-32153_8wekyb3d8bbwe",
        "NetGetJoinInformation",
        "Microsoft.Windows.161.X20-00861_8wekyb3d8bbwe",
        "777\\7",
        "QQVWh",
        " faltando um componente do sistema.%0",
        "Microsoft.Windows.121.X20-00860_8wekyb3d8bbwe",
        "CompatFinalizeReq: Initializing Server Image:          [%s]",
        "33878a30-7ac2-fe4d-5103-6ab38d97e553",
        "ACCESSDENIED-fel p",
        "='=5=<=C=P=a=e=i=m=q=u=y=}=",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        " el hash de la instancia.%0",
        "fb2813e2-1f9f-21fd-9692-72fd2736a975",
        "A Plataforma de Instala",
        "041404B0",
        "Recovery",
        "DiskSpaceInstallReq: Initializing SSU Count              [%ld]",
        "Microsoft.Windows.4.X19-99684_8wekyb3d8bbwe",
        "Finalize: updated the EnableNarratorOnProgress flag to %d",
        ";C;I;\\;b;m;t;y;",
        ":V:x:",
        "FACILITY_DRIVER_FRAMEWORK",
        "KKYWJ-2NK8Q-BXBKM-Q886G-HFVWP",
        "Microsoft.Windows.4.X21-05124_8wekyb3d8bbwe",
        ">*>1>>>E>M>T>",
        "3H3|3",
        ">(>4>@>L>X>d>p>|>",
        "XYFDK-VNWHK-YWQDB-MTKHY-F9C6K",
        "99fcefc4-6fdc-3e74-40ca-769c06cc64ad",
        "Not-null check failed: Blob",
        "CDlpActionImageDeploy::ResumeRoutine",
        "Microsoft.Windows.48.X19-99490_8wekyb3d8bbwe",
        "38b6fb05-2259-ea22-a0d3-2062c8641c16",
        "Finalize: Error updating the setupplatform on narrator status: [0x%X]",
        "Microsoft.Windows.161.X21-43630_8wekyb3d8bbwe",
        "e finaliza",
        "1cdcc723-b458-5346-a7f4-ee04616c5529",
        "1*2E2]2",
        "AssertWithArgs",
        "sit.%0",
        "256eca39-c6be-a521-40d7-059073b547cd",
        "Installasjonaprosessen ble avbrutt.%0",
        "GetSystemDirectoryW",
        "STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME",
        "STATUS_INTERNAL_ERROR",
        "ae26e3d1-adf3-27ae-2551-56de7ffbfd88",
        ".rsrc$01",
        "UpdateMedia: Initializing IsServer:                 [%s]",
        "9e5e1c13-0e88-d5cd-7b6e-a463a9e1ee22",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::SetParameters",
        "nyekkel kapcsolatos kompatibilit",
        "428036db-2760-5fe3-6518-6fc610ab2067",
        "KCNVV-DVG9M-R93RQ-KVMD4-QGP48",
        "21728b26-b270-8961-3981-960fa4319074",
        "7)7>7]7",
        "j/fzz",
        "168b880d-693f-de5e-d378-cd7f9072c51b",
        "a04a7c51-85a7-4750-7de0-b15fee3b1b04",
        "Microsoft.Windows.100.X19-99435_8wekyb3d8bbwe",
        "Bekleyen OU geri alma i",
        "Microsoft.Windows.8.X21-83711_8wekyb3d8bbwe",
        "fr-CH",
        " podm",
        "GeoAvailability",
        "Operation",
        " Microsoft Corporation. Alle rechten voorbehouden.",
        "8PTT6-RNW4C-6V7J2-C2D3X-MHBPB",
        "8%9P9",
        "Store %s is the system store",
        "04f70e48-a7b1-0802-5294-91b45b144f46",
        "o foi poss",
        "CDlpActionCompat::GetResultsMigChoice",
        "sakad",
        "D$(QQPh",
        "t. %0",
        "BiCreateEfiEntry failed %x",
        "CDlpActionDebuggerOptions::InitializeRoutine",
        "=V?~?",
        "Microsoft.Windows.48.res-v3507_8wekyb3d8bbwe",
        "Microsoft.Windows.162.X21-03403_8wekyb3d8bbwe",
        "onecore\\base\\xml\\udom_writer.cpp",
        "5ac8689a-b199-fc56-beed-59768748cc8f",
        "40474Z4g4",
        " plik",
        "5!646N6s6",
        "Failed to set wof data for file backed by wim file",
        "Problemet ned nedlastingsplass p",
        ">)?b?",
        " warto",
        "Microsoft.Windows.98.X20-29580_8wekyb3d8bbwe",
        " faltando uma tarefa obrigat",
        "Satellite",
        ".?AVCDlpActionEula@@",
        "061<1w1}1",
        ".?AV?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIProductKeyAction@@@@@@@@@@",
        "%ARCH_64%",
        "se-SE",
        "lama nesnesi olu",
        "ab500eab-a8e2-ab24-3e95-849ff6109770",
        "Kapatma blok iletisi olu",
        "Microsoft.Windows.48.X19-98797_8wekyb3d8bbwe",
        "PerformSilentCleanup: TriggerStoragePolicies not supported.",
        "DUSetup: OsBranch: [%s]",
        "%hs [HRESULT = 0x%08x - %hs]",
        "Compatibility: Resolve(WICA_DISMISS_ALL_RESOLVE_STRING) returned: [0x%X]",
        "Microsoft.Windows.172.X21-24719_8wekyb3d8bbwe",
        "2d1f632b-8b03-0757-00f0-4bc348331c53",
        "6C6{6",
        "8982db08-55fb-af98-d239-b573cea09554",
        "Un script a d",
        "ratlanul le",
        "wimgapi.dll",
        "t:SSSj",
        "Microsoft.Windows.4.X19-99707_8wekyb3d8bbwe",
        "Microsoft.Windows.99.X20-00902_8wekyb3d8bbwe",
        "Il processo di installazione ",
        "RR77N-QRRM8-KJTGV-HFT8G-BP2KD",
        "4$4)4",
        "\\Device",
        "Plik konfiguracji instalacji jest pusty.%0",
        "0f7c9d3e-bb2f-f3a4-9398-fd91073192f2",
        "e7d2e2a7-24ee-40fc-6d4c-6efc6bbb54da",
        "6BN8P-W446Y-G7BK6-Q34X9-HCFBG",
        "ration, car le syst",
        "\\>w,nf",
        "es-CU",
        "%hs(%d) tid(%x) %08X %ws",
        ":M:X:",
        "ta-IN",
        "Microsoft.Windows.172.X21-24712_8wekyb3d8bbwe",
        "6dd2eb3f-8342-02a6-f6a8-23566dbeb748",
        "2-282e2p2",
        "5A5H5",
        "Microsoft.Windows.4.X21-05133_8wekyb3d8bbwe",
        "Microsoft.Windows.100.X20-35497_8wekyb3d8bbwe",
        "5!5K5Q5W5]5b5l5",
        "f228369b-da91-0f01-69f8-5d085b7889de",
        "Microsoft.Windows.48.X19-98804_8wekyb3d8bbwe",
        "lls var ogiltig.%0",
        ".?AVISetupObject@@",
        "GetFileSystemFlags",
        "Microsoft.Windows.100.X19-99442_8wekyb3d8bbwe",
        "cution de l",
        "Finalize: Error reading narrator reg key: [0x%X]",
        "TRUST_E_FAIL",
        "1<2V2`2",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::Serialize",
        ", az oper",
        "zis sor",
        "uYf9s",
        "Eula: Eula File Url From Online Store: [%s]",
        "Finalize: Error reporting real result(ASMV): [0x%X]",
        "EnterpriseN",
        "Microsoft.Windows.172.X21-24718_8wekyb3d8bbwe",
        "KJ6VV-CNFYK-FDHQV-PTJDQ-97Y8G",
        "68WP7-N2JMW-B676K-WR24Q-9D7YC",
        "RtlCreateMicrodom",
        "ti-ER",
        "Das Installationsimage wurde nicht gefunden.%0",
        "Source OS: Host SKU Info: Edition = '%s', Edition Type = '%s', Installation Type = '%s', Product Name = '%s', Arch = %s, StationType = %s, Stage type = %s",
        "rio.%0",
        "amalar",
        "Microsoft.Windows.145.X21-43659_8wekyb3d8bbwe",
        ".?AVCDlpActionProductKeyValidateFactory@@",
        "CDlpActionDiskSpaceReq::IsDriveLetterSupported",
        "<H<n<",
        "b6e16d99-55a5-1cea-1fd1-c37645d7a80d",
        "CLIENT",
        "Microsoft.Windows.184.X21-64463_8wekyb3d8bbwe",
        "Q8CGD-NJVMC-XVFR6-696J4-KBVMD",
        "Microsoft.Windows.7.X21-83400_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X19-99589_8wekyb3d8bbwe",
        "0m0x0",
        "=%>;>[>w>",
        "1(1K1_1",
        "817fa0b9-709b-f42b-7ce6-f54f31fd73fa",
        "PackageMigration: Removed FODs          [%ld] [%s]",
        "HYVNT-498GD-3FHKT-76HDV-M4G4R",
        "CDlpActionCompat::GenerateInstallReqCompatReports",
        "uk-UA",
        "60646L6\\6l6|6",
        "8,888X8`8h8t8",
        "999X9c9",
        "4\\5k5",
        "8VN4T-VT6KF-JTTPV-BJMH7-QPFCB",
        "03b3c0b9-0e93-31b5-e0be-132bd51a1e29",
        "RegUnLoadKeyW",
        "d-Nbk",
        "%s: Leaving Response Execute Method",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionDataMigrateFactory,class CDlpActionDataMigrate>::GetActionId",
        "26e0dfc6-90c8-82f0-f7d1-483b4de2aa52",
        "ProductKey: Product key is a default key.",
        "ZwCreateKey",
        "=hK2/;",
        "Microsoft.Windows.121.X21-83178_8wekyb3d8bbwe",
        "Microsoft.Windows.122.X20-29555_8wekyb3d8bbwe",
        ">8?N?p?w?",
        "DiskSpaceInstallReq: Initializing LangPacks Path:        [%s]",
        "0aee978b-6f2d-28fd-a479-01c3435fcaea",
        "%s\\%s\\%s.mui",
        "GetFileNodeFromPath",
        ":A;V;k;",
        "CRYPT32.dll",
        "Microsoft.Windows.8.X18-87816_8wekyb3d8bbwe",
        "o atende aos requisitos para a op",
        "2!212A2M2S2y2",
        "Microsoft.Windows.165.res-v3801_8wekyb3d8bbwe",
        "afafd1dc-7365-5f4b-d5a4-b79a15a12e5b",
        "fd4c4c82-f219-2a0b-75aa-aa384644d452",
        "<,<0<H<L<d<t<x<|<",
        "CFCPayloadDUCallback: CurrentPayloadOperation [%d]",
        "UpdateWIMHeader failed",
        "134b833d-27a8-2d1c-1191-e5a0ea4703b5",
        "ProfessionalWMC",
        "f10a61a0-136b-ad58-380f-e8ac364a0d8b",
        "b1e1ca85-0d13-43c1-ebe2-20a2b1db8ffb",
        "=)=L=x=",
        "Microsoft.Windows.172.X21-24717_8wekyb3d8bbwe",
        "CDlpActionCompat::DeserializeGatedScan",
        "Microsoft.Windows.22.X17-53884_8wekyb3d8bbwe",
        "ivatel se rozhodl zru",
        "en-SG",
        "7.7H7O7k7r7",
        "uz-Cyrl",
        "j:Yf9H",
        "CDlpActionCompat::ExecuteSysReqScan: Exit",
        "=,=J=",
        "2cc3fadc-eaaa-6b37-1999-db1cdb188664",
        "4DBW3-XN8YC-F74XR-QKFRH-QPFDD",
        " att slutf",
        "STATUS_TOO_LATE",
        "rma dosyas",
        "WBWKN-YKMW2-4HX8B-CQGMK-XKYCW",
        "102fc001-4941-4afb-9c35-44e612227423",
        "BN2C4-QQJD9-TG443-V3M7Y-QJ442",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::GetProgress",
        "Microsoft.Windows.48.X21-03402_8wekyb3d8bbwe",
        "n hajautusarvo ei t",
        "8X8o8|8",
        ".?AV?$CZeroInit@VCDlpActionDataMigrate@@$00@@",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::GetResultsRoutine",
        "Source.Length >= 2",
        "FFMT6-KWNBD-K3B3C-JYG4H-B7V2Y",
        "STATUS_RM_NOT_ACTIVE",
        "9KKNJ-YRMWP-R7K4K-Y2B94-JHVY6",
        "DTN2J-TRR4K-QJXC9-84QTV-462RV",
        "FacilitatorURL",
        "R27HM-9NV6R-6D9CY-9M3BJ-6MT6P",
        "professionalsn",
        "\\\\.\\Z:",
        "3b7a4b42-6198-a4f4-bda0-88b7edc08395",
        "GetWebSetupUserInput: Language=[%s]",
        "5adef52d-8a0d-e0cb-ed3e-5accf1b3234b",
        "iotenterprises",
        "adunku by",
        ".?AV?$CUnknownImpl@V?$CUnknownImpl@UIUnknown@@@@@@",
        "AcquireSRWLockExclusive",
        "9MdHdt",
        "es-PA",
        "startere",
        "6a25f386-4fd8-97c8-586d-045f353c9413",
        "Les informations d'automatisation fournies ne sont pas valides.%0",
        ";#;.;6;@;Q;d;",
        "BootFinalize: Initializing Mode:                       [%d]",
        "CSetupCore::UpdateLoggingPath",
        "?*?R?h?q?{?",
        "Microsoft.Windows.8.X21-83685_8wekyb3d8bbwe",
        "ZwModifyBootEntry",
        "o iniciada anteriormente.%0",
        "[%d] %s%s%s%s",
        "NMB2K-JTQB7-B7GFY-8TXGT-H8T2C",
        "DiskPartitionDriveLetter",
        "ec757a4a-42fb-cf80-934f-c62a9911eae9",
        "Recovery: Offline CompactOS:    [%s]",
        "Microsoft.Windows.162.X21-83176_8wekyb3d8bbwe",
        "9-9U9p9",
        "DiskSpaceInstallReq: Initializing PostUpgrade space Max:        [%ld]",
        "Microsoft.Windows.121.res-v3278_8wekyb3d8bbwe",
        "257cc5b1-238a-a6d0-b86d-a84a8eb253d6",
        "e hash instance se neshoduje.%0",
        "HBTND-PFQQ2-6G8VD-CV9XC-MP3JF",
        "CDlpActionCompat::DeserializeRoutine",
        "En oprydningshandling fra et tidligere installationsfors",
        "HK386-DNXKY-J8WX8-DY78C-XTH4F",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionDiskSpaceReqFactory,class CDlpActionDiskSpaceReq>::GetActionId",
        "Microsoft.Windows.99.X19-99560_8wekyb3d8bbwe",
        ";F;M;X;",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::Execute",
        "DecodeChunk",
        "generic",
        "u:9N0t",
        "oikeussopimuksen ehdot.%0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::CheckUserInterrupt",
        "ProductKey: Image selection response not found.",
        "30e66ccf-b124-5ad7-42a6-c29035b43f84",
        "RtlIsLUtf8StringValid(NamespaceURI)",
        "vu bloku vypnut",
        "SLGetProductSkuInformation",
        "ENTITY",
        "WIMExtractImagePathAndGetFileHandle",
        "T$(94",
        "29b30187-e818-130a-41e0-b469a42632b9",
        "iu-CA-Latn",
        ":(:8:<:@:T:X:\\:`:d:h:l:p:t:|:",
        "SetupBranchHash",
        "4F5d5",
        "RaiseException",
        " on valinnut peruutuksen, koska j",
        "Automation: Registered PKEY_VALIDATE_AUTOMATION Response",
        "embeddedautomotive",
        "6,6H6{6",
        "RtlStringFromGUID",
        "Der Installationsprozess wurde angehalten.%0",
        "totalHits",
        "NR422-P2BWP-BF987-JHPP2-DDB8Y",
        "VjdVjd",
        "0d432f1c-f868-4a56-2edd-eb3ac3492ef2",
        "G88NP-2HYMW-B4QGH-87K7H-M4HCP",
        "labilir uyumluluk a",
        "16a8ce58-328f-4be4-849d-8c9f581f1aa8",
        "=?=J=v=",
        "DesktopUpgrade",
        "PreFinalize: Initiate pre-finalize of downlevel phase",
        "CheckDiskSpace: Drive [%c] is not BitLocker enabled",
        "2882fdb4-92a3-8fd3-be25-23e633f7b59c",
        "6bd79aae-7ffe-7466-9a54-1a5b91843583",
        "llt die Mindestanforderungen f",
        "FACILITY_STATE_MANAGEMENT",
        "Microsoft.Windows.4.X20-29625_8wekyb3d8bbwe",
        ">.>Q>",
        "72c0e5a8-ba4a-dfe4-0adc-85a745db260b",
        "JJ3BH-DN3XW-T2YF7-VMPX3-WQMMY",
        "ulIndex < UpdateChildNodes.Size()",
        "o foi terminado durante a fase de compatibilidade acion",
        "CiXPath",
        "4\\5i5",
        "DataMigration: Initializing TrySMode:                           [%s]",
        " umow",
        "0$0+0n0",
        "r inte att utf",
        "4TRN3-CJ6MQ-GCYX2-JHVWT-CG3D4",
        "ReadMetaDataBuffer",
        "NGD9M-9RKHB-68KVG-2QB8M-HT92K",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocumentNodeSet",
        "***   Source File: %s, line %ld",
        ">)???",
        "MoSetupPlatform: Pause already requested.",
        "CompatFinalizeReq: Initializing BitLockerPremiumAvail: [%s]",
        "Microsoft.Windows.99.X19-99567_8wekyb3d8bbwe",
        ";M<u<",
        "bs-BA-Cyrl",
        "Instala",
        "DUImage: Downloaded %d GDR updates.",
        "Microsoft.Windows.122.X20-29618_8wekyb3d8bbwe",
        "1(1H1h1p1t1",
        "Microsoft.Windows.180.X21-83664_8wekyb3d8bbwe",
        "serverenterprisevcore",
        "=:=m=",
        "Der Installationsstatus-Server ist nicht verf",
        ", reklam i",
        "De installatiekopie is niet gevonden.%0",
        "CDlpActionProductKeyValidate::ReportDownlevelInstallChannel",
        "8$9G9Y9p9y9",
        "Le processus d'installation requiert l'acceptation du contrat de licence par l'utilisateur.%0",
        "cych instalacji aktualizacji.%0",
        "VSh(/",
        "8z9~9",
        "<6<E<",
        "FailFwdFlags",
        "HRN83-JPXFJ-84J9B-4XJP4-Q9QCG",
        "ytyi odottava k",
        ":G:N:^:",
        "DND7D-RXVTB-DYP44-XYQYG-HFTF8",
        "505Z5g5",
        "Microsoft.Windows.48.X19-99501_8wekyb3d8bbwe",
        "[%hs(%hs)]",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::Cancel",
        "o terminou inesperadamente.%0",
        "5)5~5",
        "Finalize: Initiate finalize of downlevel phase",
        "Microsoft.Windows.122.X20-35506_8wekyb3d8bbwe",
        "809L9S9]9",
        "3bc06bc5-786b-e3ab-5d16-add8644a867d",
        "CDlpActionDiskSpaceReq::DeserializeInstallReq",
        "2D7NQ-3MDXF-9WTDT-X9CCP-CKD8V",
        "Het installatieproces is niet binnen de gestelde tijdslimiet voltooid.%0",
        "PreSelectedEdition",
        "10.0.19041.572 (WinBuild.160101.0800)",
        "RecoveryImageOption",
        "::RtlIsLUtf8StringValid(&Sources[i])",
        "02c57f98-03fa-c96f-e1e1-5888760b2c6d",
        "d0a44fd8-c2c0-802f-c03c-0d9005c16a3f",
        "8p8{8",
        "93899b83-5ade-be4d-8200-9d656bee5c25",
        "Tel#Sqm",
        "040604B0",
        "WFDJK-W9NH6-YYRMD-T3JX8-82QDR",
        "06a885cd-d7e8-683d-5e14-e2f3f0128b1f",
        "\\Device\\HarddiskVolume",
        "DataMigration: Queue telemetry build number into Target OS...",
        "Microsoft.Windows.50.X18-81308_8wekyb3d8bbwe",
        "-Tz4q",
        "address in use",
        "Es wurde kein Angebot gefunden, das die erforderlichen Kriterien erf",
        "Microsoft.Windows.100.res-v3276_8wekyb3d8bbwe",
        "smn-FI",
        "Microsoft.Windows.4.X19-99701_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X19-99605_8wekyb3d8bbwe",
        "a42e3c78-5674-058e-875d-31602909836c",
        "b971bc34-3057-27b6-a352-6b30a801abf2",
        "chargement n'ont pas ",
        ">\">L>r>",
        "433KJ-8N6G7-6D8FV-XT6KF-2KFFF",
        "f;D$Pu",
        "GetWebSetupUserInput: Selected MultiArch = [%s].",
        "Microsoft.Windows.126.X20-35532_8wekyb3d8bbwe",
        "Microsoft.Windows.145.X21-83751_8wekyb3d8bbwe",
        "M7XTQ-FN8P6-TTKYV-9D4CC-J462D",
        "6:6U6i6",
        "261019185142Z0",
        "Microsoft.Windows.4.X20-29627_8wekyb3d8bbwe",
        "2b2ba0e9-60a6-9886-e374-5b654bc6d77f",
        "DUImage: Loading Facilitator.dll for latent acquisition",
        "849MD-N9J4D-282Q4-CVC3Q-RJT37",
        "ben l",
        "MicrodomImplementation::DecodeXmlCharacterToUcsChar",
        "9Y2N2-RF983-M8DXX-QGV6V-KHJX2",
        "303H3`3x3",
        "Microsoft.Windows.101.X20-24586_8wekyb3d8bbwe",
        "ProductKey: Error reporting telemetry for dwFoundLocation: [0x%X]",
        "J3QFK-NTXB9-VM699-JT2FB-KD72F",
        ".?AUIGenericProgress@SetupPlatform@@",
        "onecore\\base\\lstring\\lblob.cpp",
        "070B0n0y0",
        "^*g(W",
        "Failed to add boot entry. Status: %x",
        "XPNYG-6MVR2-RYPPM-J6CKC-DC69F",
        "in Kurulum",
        "Compatibility: No error in scan",
        "Finalize: Reading Shutdown Value: [%s]",
        "MoSetupPlatform: Releasing resurrected Setup Platform object!",
        "Microsoft.Windows.48.X19-98855_8wekyb3d8bbwe",
        "STATUS_NOT_SAME_DEVICE",
        "?/?s?",
        "Microsoft.Windows.98.X20-29585_8wekyb3d8bbwe",
        "565P5b5",
        "Not-null check failed: Writer",
        "Failed to load actionlist from {0}",
        "QQRNR-MM8WD-X3C43-VWVMD-DV67B",
        "Microsoft.Windows.126.X21-83265_8wekyb3d8bbwe",
        "Microsoft.Windows.50.X21-83786_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X19-99593_8wekyb3d8bbwe",
        "1 1L1W1|1",
        "_wcstoi64",
        " ACCESSDENIED ",
        "CoreConnectedSingleLanguage",
        "RWMRW-NQ787-92WMM-HWFJF-MWT33",
        "ce4e4149-d2c9-a488-7ecd-a235565b889e",
        "AdVPj",
        "CAutomationManager::Register",
        "Microsoft.Windows.122.X19-98692_8wekyb3d8bbwe",
        "CDlpActionProductKeyValidate::FindMatchingImagesInternal",
        "vel executar um script de ",
        "ntar fortfarande p",
        "File[*]\\Size",
        "N7XX3-MK2WP-J74DP-4MJK2-BTFFK",
        "d6d48d40-a33c-45ac-c0fb-9af2e219607f",
        "Palvelimen vastauksen muoto on virheellinen.%0",
        "KWG2N-RKXPK-FHHF9-QPFXM-RC3MX",
        "The user has not accepted Eula within the required time limit.%0",
        "Microsoft.Windows.8.X21-83712_8wekyb3d8bbwe",
        "4#42494",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::Deserialize",
        "lise compacta para instalar a atualiza",
        "StorageUsage.dll",
        "5af5cb23-53a1-20e8-802e-f674838c28eb",
        "pToInsertInto != 0",
        "TDGXG-2NPXR-4QYG9-PDMVW-6MWYY",
        "FX6NY-MGFWM-VK6TH-XPMPF-FC3M6",
        "G62PN-6BKV7-YY39J-YVPG4-W8GPX",
        "CDlpActionUpdateMedia::DownloadMediaCreationTool",
        "serverwinfoundation",
        "849f45d9-36d8-1084-d9ed-1bb7c22e065e",
        "6%6/696g6q6{6",
        "o inesperada do cliente do Agente de Atualiza",
        "757L7S7y7",
        "Soubory datov",
        "1 2f2",
        "$0/0`0k0",
        "DiskSpaceInstallReq: Initializing SafeOS paths           [%ld] [%s]",
        ";|$Xt",
        "o foram resolvidas dentro do limite de tempo necess",
        "Microsoft.Windows.101.X19-99557_8wekyb3d8bbwe",
        ";A<L<",
        "Microsoft.Windows.125.X21-83234_8wekyb3d8bbwe",
        "Pkey=%s",
        "ErrorCode",
        "CTXFJ-PN78H-XHJ43-DTVPK-WTYPF",
        "Microsoft.Windows.121.X19-99469_8wekyb3d8bbwe",
        "Microsoft.Windows.101.X20-29692_8wekyb3d8bbwe",
        "StagedSize",
        "DiskPartition: Requesting target drive from automation.",
        "J2CN7-4MGKJ-KQ6G2-CR9F9-WTY7D",
        "\\Device\\Harddisk%lu\\Partition%lu",
        "<O=x=",
        "MININT",
        "Microsoft.Windows.101.X19-98879_8wekyb3d8bbwe",
        "Les probl",
        "ini etkin tutmak i",
        "<`=g=",
        "GetWebSetupUserInput: Selected Language From Response = [%s].",
        "6ef202c0-0080-74c1-d3f9-41d6174db114",
        "Microsoft.Windows.143.X20-91396_8wekyb3d8bbwe",
        "7c320c14-88a0-3073-3661-392eea785826",
        "Uno script non ",
        "SetEvent",
        "LocationHeader != 0",
        "ket konszolid",
        "MNH8T-CMDTX-7GK96-TM2TY-2PQGQ",
        ">'?B?Z?",
        "WATSON_MODULE_NAME",
        "e2d5e4a5-4907-ea6b-d1cf-79bb2913220b",
        "si felt",
        ":MdLct",
        "DUImage: Initializing Wim Ref paths   [%ld] [%s]",
        "53281836-fe1a-c499-3436-267def680542",
        "DiskPartition: Getting drive letter from Automation.",
        "Microsoft.Windows.121.X19-98667_8wekyb3d8bbwe",
        "c81e3f3e-6fb7-17c1-b997-0c109e1692fe",
        "nea de comandos setup.exe para hacer el examen ",
        "professionaln",
        "me et l",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionDebuggerOptionsFactory,class CDlpActionDebuggerOptions>::GetActionId",
        "o para este sistema.%0",
        "Directory",
        ".rdata$zETW2",
        ".?AVIDlpError@@",
        ".?AV?$CZeroInit@V?$CDlpAutoLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@$00@@",
        "6NMRW-2C8FM-D24W7-TQWMY-CWH2D",
        "F6QCD-BNYYR-K7HCJ-X9B34-F6YQG",
        "Microsoft.Windows.4.X20-35514_8wekyb3d8bbwe",
        "r van egy kor",
        "<+=n=",
        "Konfigurationsfilen ",
        "Microsoft.Windows.99.X20-29701_8wekyb3d8bbwe",
        "a8891535-b8dc-d034-3f10-483fb69d3096",
        "Brukeren har brukt Setup.exe-kommandolinjen for ",
        "RtlAllocateAndInitializeSid",
        "Exception (code 0x%08X: %s) occurred at 0x%p in %s (+%p).",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionCompatFactory,class CDlpActionCompat>::SetActionId",
        "D$$Pm",
        "93PP7-NJXDM-TPQWM-YJV39-TF6B7",
        ".?AVIDlpResponse@@",
        "Kompatibilitetsproblemerne i forbindelse med minimumkravene blev ikke l",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionDiskPartitionFactory,class CDlpActionDiskPartition>::GetActionId",
        "NodeMap != Windows::Microdom::Rtl::NamedNodeMap::InvalidValue()",
        "g0M0j0K0c0_0K0",
        "Microsoft.Windows.8.res-v4304_8wekyb3d8bbwe",
        "DataMigration: Queue telemetry test id into Target OS...",
        " gereksinimlerini kar",
        "9f1d0b61-78e3-3329-5d6f-9b08df4d228c",
        ";+;A;^;m>s>",
        "Microsoft.Windows.121.X19-98670_8wekyb3d8bbwe",
        "f90c0208-dab7-70ce-e865-483bd0983c44",
        ".?AV?$CZeroInit@VCDlpActionEula@@$00@@",
        ";&;k;",
        "Microsoft.Windows.101.X19-99548_8wekyb3d8bbwe",
        "Finaliz",
        "STATUS_OBJECT_TYPE_MISMATCH",
        "Podstawowe akcje Instalatora",
        "3.373L3S3",
        "00a335b7-bbf9-3339-d8c0-4dcc163aea2a",
        "K98BW-7NY2F-XRKVV-VKW8J-33XWJ",
        "Creating object. Version: %d. Type: 0x%08x",
        "ad81dc8b-5d43-e5c2-57dc-7dbc36080883",
        "8FF7X-7NV38-8YXYT-23WH4-CR4BD",
        "QPWQQQV",
        "Microsoft.Windows.99.X19-99654_8wekyb3d8bbwe",
        "d23d1b73-3519-ec43-e066-9eee4ecd6459",
        "Ett skript kunde inte k",
        "FACILITY_VIDEO",
        "VVVVh(",
        "3J3x3",
        " on peruuttanut k",
        "syr-SY",
        "InitializeRoutine: MOSETUP_ACTION_IMAGE_FINALIZE",
        "= =,=8=D=P=\\=h=t=",
        "f2236229-7899-22ca-e2ab-b915400b941e",
        "o de finaliza",
        "Die Probleme mit den Mindestanforderungen an die Kompatibilit",
        "mes d'espace disque d'installation n'ont pas ",
        "serverstorageworkgroupeval",
        "242[2",
        "CDlpActionCompat::Resolve",
        "Microsoft.Windows.27.X20-35528_8wekyb3d8bbwe",
        ".?AV?$CMoSetupActionImpl@V?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIMoSetupDlpAction@@@@@@@@@@@@",
        "7>7N7^7}7",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::GetActionId",
        "0b3e5ef6-8050-abb2-f42b-2920903281af",
        "Microsoft.Windows.98.X19-99603_8wekyb3d8bbwe",
        "En rensnings",
        "c6a32e7e-6811-fdee-d434-24efe0cf68dc",
        "7aec8726-6a62-2898-2e8b-86a74bbbfc44",
        "CoreCountrySpecific",
        "9\\$`t",
        "Microsoft.Windows.48.res-v3622_8wekyb3d8bbwe",
        "DMWTN-T4MT3-T4FV6-9RGC2-HH8VT",
        "Entity.Length != 0",
        "MoSetupPlatform: LXP packages count doesn't match the licenses count!",
        "STATUS_DELETE_PENDING",
        "CDlpResponseAutomation::ExecuteRoutine",
        " GatherOsState.%0",
        "8'939>9",
        "YN9TR-MCTJK-82M3Y-DV7TV-VT9R2",
        " riprendere l'aggiornamento avviato in precedenza.%0",
        "W9{HuI",
        "Target OS: Detected Source Arch = [%s]",
        "BCryptHashData",
        "CERT_E_CHAINING",
        "ProposedExternalDriveLetter",
        "FX2TT-HGNTQ-2XFKR-FBY67-RGDFQ",
        "df24871c-03a6-e6b9-f275-e4681e8f772e",
        "3NBT8-F7YTB-DJQDK-PF3V9-YDWWP",
        "installation a ",
        "Aktualnie nie mo",
        ".?AV?$CZeroInit@VCDlpActionUpdateMediaFactory@@$00@@",
        "QYNMC-WQFWF-73V68-CG2FH-GCRJC",
        "Failed to open key for all object's elements. Status: %x",
        "7fa78efe-5e50-acfa-0241-2a100e5680a5",
        "res requis n",
        "4L5V5",
        "DiskSpace: Space released after install from SP: [%llu] MB",
        "DataMigration: Queue Request for data file migration",
        "94a7cd5a-59fd-b56f-d249-d088d81e25a3",
        "a0409e96-7222-6de6-fba6-494ca0f9fc44",
        "Microsoft.Windows.98.X19-99581_8wekyb3d8bbwe",
        "coresystemserver",
        "yle kar",
        ", lisans s",
        "0k0P}",
        "a82e9877-3637-f060-b2f0-565119f609b8",
        "wsc:wica:UninstallAllHBApp",
        "ac6d4e55-b379-d575-7ce1-ba738630c926",
        "YNMGQ-8RYV3-4PGQ3-C8XTP-7CFBY",
        "Microsoft.Windows.84.X19-98772_8wekyb3d8bbwe",
        "Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11CF-8B85-00AA005B4383}",
        "ben van. ",
        "8X6NF-4Y9YF-VRGD4-46PJJ-78RW8",
        "Duplicate install action item or out of memory. KeyForm: {0}, Id {1}",
        "NW6C2-QMPVW-D7KKK-3GKT6-VCFB2",
        "Setup360",
        "CDlpActionCompat::ExecuteDownloadReqScan: Enter",
        "ActivationIssuesFound",
        ":d:n:",
        "a394b096-4dab-c92c-f145-1f122f171d00",
        "Se encontr",
        ".?AV?$CUnknownImpl@VICompatAction@@@@",
        "FMVRD-WNQVD-D6QPB-RT88T-QYH3J",
        "ba1aeca5-8cd3-78eb-4bed-33b39aa65d7f",
        "unknown",
        "DP3NW-RXVQ6-79BFR-VBX83-TCQT8",
        " una versi",
        "6-6D6T6Y6",
        "Geen pakketten om te downloaden.%0",
        "ExecuteDownloadReq: Error reporting telemetry for szAutoSupportedDriveLetters[dwIndex]: [0x%X]",
        "CMicrodomBuilder::ConstructAndWriteMicrodom",
        "2 2R2]2",
        "1<2C2Q2",
        "KM4GN-DQFRK-DXYDC-MVWPX-PBBM4",
        "5Z5d5n5x5",
        "Microsoft.Windows.121.X20-35463_8wekyb3d8bbwe",
        " stato terminato.%0",
        "Microsoft.Windows.125.X21-83177_8wekyb3d8bbwe",
        ";X;_;t;",
        "tta installationen",
        "6V2XT-NYHDP-FX4G6-B663R-X2G4D",
        "R7MNG-P4B9K-YGFXV-9G7WY-PR48J",
        "ltunk let",
        "ndirme i",
        "ProductKeyInfoSet",
        "8 9p9",
        "1U1e2",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionProductKeyValidateFactory,class CDlpActionProductKeyValidate>::SetActionId",
        "leg elkezdett friss",
        "RtlAddAccessAllowedAceEx",
        "3-333b3k3",
        "SetupDiGetClassDevsW",
        "_initterm",
        "5b6ea02c-eb57-53da-37b2-185361e04b70",
        "R24N9-QH8VH-WQ3Y7-QY7K2-8XCKT",
        "4N7JM-H4DHH-RHQ9M-TT9VP-KW3XD",
        "5.6F6g6",
        "SystemManufacturer",
        "8e33394a-8663-7aa9-db98-c627f730a56e",
        "3c3k3{3~4",
        "Microsoft.Windows.126.X21-83264_8wekyb3d8bbwe",
        "IoTEnterprise",
        "9L$(s",
        "1$1T1",
        "Installationsprocessen blev stoppet midlertidigt.%0",
        ">2>a>",
        "ovat v instalaci.",
        "BMNYP-GKTD4-PPFJB-CYK6V-462RK",
        "PreFinalize: Initializing OnlineRollback Arguments Sys:     [%s]",
        ".?AV?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskSpaceAction@@@@@@@@@@",
        "9,90949L9P9h9l9",
        "serverrdsh",
        "gameos",
        "4'41474Q4}4",
        "oK0D$\"<",
        "7J8t8",
        "N7HMH-MK36Q-M4X93-76KQ2-6JHWR",
        ".rdata$brc",
        "Microsoft.Windows.146.X21-83755_8wekyb3d8bbwe",
        "d ACCESSDENIED. Mo",
        "CMicrodomBuilder::GetXmlDomSize",
        "MX7FN-8KYH2-834Q4-V3YBY-92F8D",
        " istenen s",
        "Er is een onverwachte versie van de Update Agent-client aangetroffen.%0",
        "DCYNY-GFW6C-28PR9-HXVQR-JHV3P",
        "SYSTEM\\Setup\\SetupWatson",
        "Microsoft.Windows.130.X20-35521_8wekyb3d8bbwe",
        "%s: Entering Prepare Method",
        "ERROR_INSUFFICIENT_BUFFER",
        "fwprintf",
        "BCryptFinishHash",
        "Microsoft.Windows.49.res-v3318_8wekyb3d8bbwe",
        "\\Boot\\BCD",
        "313G3",
        "T9NFT-HQJ3J-YXFJ8-977DX-WT2M2",
        "Microsoft.Windows.126.X21-83177_8wekyb3d8bbwe",
        "22ea551d-3b87-c22e-aefb-64144b647012",
        "<,=\\=",
        "t wurden nicht innerhalb des erforderlichen Zeitlimits behoben.%0",
        "Fant ventende OS-tilbakerullingsoperasjon.%0",
        "nyeket.%0",
        "TNRHX-C7XKY-TXB6F-WWK42-BTDXC",
        "RtlAppendLBlobToLBlob",
        "<O<Y<",
        "Microsoft.Windows.121.X20-35508_8wekyb3d8bbwe",
        "Microsoft.Windows.146.X21-83740_8wekyb3d8bbwe",
        "uVf9S",
        "2FKXD-NHTPX-DC8CF-4HGCG-QYGBV",
        "HM7N4-MX7BW-7X74R-KD8CB-3GPKD",
        "62DJN-XDMVP-JG82T-6B7M7-RGDGR",
        "serversolutionspremiumcore",
        "DiskSpace: Required disk space is [%ld] MB using Drive [%c]",
        "kat nem siker",
        "080?0V0]0t0{0",
        "A minim",
        ".?AV?$CZeroInit@VCDlpActionGetWebSetupUserInputFactory@@$00@@",
        "WATSON_BUGCHECK_P1",
        "Y69N9-6TM37-HRPM4-JPCD9-DYH24",
        " pendant la phase de compatibilit",
        "MediaCreationSuccess",
        "ValidateAndClearWriteInProgressFlag",
        "r att installera uppdateringen.%0",
        "Bugcheck driver provider",
        "u$WSQ",
        ";\"<d<",
        "Microsoft.Windows.161.X21-83178_8wekyb3d8bbwe",
        "0e3bc86a-eeb6-589c-2a7e-fa0ace112667",
        "Microsoft.Windows.22.X18-81297_8wekyb3d8bbwe",
        "serverhi",
        "<!=?=X=",
        "9JC6F-NQV39-VGD8Y-2YQRD-BHBWG",
        "4fc5db8b-0846-8eae-2044-60c5d2695047",
        "Encoder != 0",
        "address family not supported",
        "timestamp",
        "JM4W4-RWN73-F367K-2YB8R-X2GY9",
        "RGTRV-HPNJ2-2CXMW-7FM8C-D7CFY",
        "o tem espa",
        "Microsoft.Windows.99.X19-99571_8wekyb3d8bbwe",
        "39BN2-FR8MB-CTFK3-V7B7F-369Q6",
        "2(2@2X2p2",
        "MoSetupPlatform: No current boot entry was found. Assume {current} == {default}.",
        "42fa3338-8244-4b43-f8c1-4903f8607189",
        ".rdata$zETW9",
        "05015c20-fe90-d0a3-5c3c-188ecfc1a51f",
        "PackageMigration: Initializing FOD Count            [%ld]",
        "BcdGetElementDataWithFlags: Failed to get registry value.Object: %ws Reg type: %lu Status: %x",
        "lai imparti. %0",
        "n de reversi",
        "Microsoft.Windows.4.X19-98709_8wekyb3d8bbwe",
        "Finalize: Failed to persist registry telemetry. hr=0x%x",
        "N2G4K-Y8TB2-QFD9J-4V9JW-4VV8W",
        "D$PPQ",
        "o pode continuar porque o hash da inst",
        "ps-AF",
        "7D8$999D9",
        "HWHWG-NTQXK-6PPB7-VKXMM-88F7T",
        "8D8P8w8",
        " cancelar el examen porque el sistema no ha aprobado el an",
        "ExecuteInstallReq: Checking disk space",
        "%BASE%",
        ":);3;`;j;",
        "j < ValidProperties.Length",
        "5'525R5f5",
        ":C:O:x:",
        "6h6y6",
        "Microsoft.Windows.121.X21-03401_8wekyb3d8bbwe",
        "e04d4d80-9617-57c7-a754-186389026f82",
        "XKCNC-J26Q9-KFHD2-FKTHY-KD72Y",
        "c6894d3b-1e20-5ff2-c63e-270bd03d18d7",
        "Erreur ACCESSDENIED rencontr",
        ".?AV?$CUnknownImpl@UIUnknown@@@@",
        "0fca2732-6c8d-a112-5d66-2edd83d95da0",
        "wJ9D$",
        "dW0f0D0~0Y0",
        "PoolHeader != 0",
        "NtSetInformationFile",
        "93ed7251-cb63-9cb4-037a-6d76a5d84ecb",
        "A megadott automatiz",
        "es de requisitos m",
        "Windows::Rtl::CRtlObjectTypeDescription<class MicrodomWriterImplementation::CMicrodomWriter>::CreateTearoff",
        "ProductKey: Matched %s with %s",
        "Microsoft.Windows.4.X20-29623_8wekyb3d8bbwe",
        "Microsoft.Windows.146.res-v4317_8wekyb3d8bbwe",
        "Installationsprocessen avbr",
        "03080Z0s0",
        "Nie odnaleziono obrazu instalacji.%0",
        "9/959H9`9",
        "GetWebSetupUserInput: Entering execute.",
        "Microsoft.Windows.27.X20-00861_8wekyb3d8bbwe",
        "&amp;",
        "\\\\?\\GLOBALROOT",
        "Det g",
        "ProductKey: Initializing Wim Ref Count       [%ld]",
        "professionalcountryspecific",
        "1X1_1z1",
        "Systemet inte klarar kompatibilitetskontrollen f",
        "80979K9R9n9",
        "DiskSpaceInstallReq: Initializing Critical Path:         [%s]",
        "Asennusta ei voi jatkaa, koska viimeistelytoiminto ei pysty jatkamaan aiemmin aloitettua p",
        "io error",
        "StorageReserveFlagForDownload",
        "313H3d3",
        "embedded",
        "DataOnly_FailForward",
        " grund av att en systemkomponent saknas.%0",
        "GH37Y-TNG7X-PP2TK-CMRMT-D3WV4",
        "CDlpActionCompat::SerializeInstallReqScan",
        "ResAddFromFileAndHandle",
        "CDlpActionProductKeyValidate::InitializePkeyValidateRoutine",
        "EventWrite",
        "ActionListParser::ParseDownloads",
        "Microsoft.Windows.8.X21-83716_8wekyb3d8bbwe",
        "Microsoft.Windows.188.X21-99374_8wekyb3d8bbwe",
        "3#4.4<4V4t4",
        "4CBNB-73RKJ-VD7YH-H4J6C-9P677",
        "The user has chosen to cancel because the system does not pass the gated compat scan to install the update.%0",
        "rio optou por cancelar porque o dispositivo n",
        "sources\\unattend.xml",
        "ERROR_SXS_IDENTITIES_DIFFERENT",
        "121u1",
        "J8KYN-XVH8C-MC8HD-RWRKJ-7FTPY",
        "wcscpy_s",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::DeserializeRoutine",
        "FirmwareVariable",
        "Locals.Allocate()",
        "2I2|2",
        "Q@Phh",
        "D$(PW",
        ".?AVCDlpActionImageDeploy@@",
        "GetSystemTimeAsFileTime",
        "memset",
        "4,5?5F5T5",
        "Ta wersja narz",
        "b72a0ac2-8708-194b-eef9-90dd1c565954",
        "protocol_not_supported",
        "829366b3-0f0b-eea4-738f-826ff1d5aa60",
        "DG2GN-G3Y26-6VH26-F7JVP-9QDGQ",
        "RN6T7-3GV49-43DQJ-89RQM-MY49M",
        "RN8J9-272YP-DX3XR-Y798C-XTP3R",
        "Microsoft.Windows.162.X21-43650_8wekyb3d8bbwe",
        "O ID do Piloto est",
        "operation canceled",
        "DependsOn",
        "d3ef5910-53ee-e11d-070e-23a7b12691eb",
        "<6=b=",
        "WXHTN-3Y3RJ-BWP6P-TGBDQ-9778G",
        "o atende aos requisitos de espa",
        " per i requisiti minimi non sono stati risolti entro il limite di tempo richiesto.%0",
        "Bugcheck module",
        "PKeyLocation",
        "Microsoft.Windows.100.X20-39263_8wekyb3d8bbwe",
        "5,5a5",
        "4FNRT-B4VXV-JCWDT-TTRVQ-DV66Q",
        "CDlpActionGetWebSetupUserInput::DeserializeRoutine",
        "Problemy z miejscem na dysku przeznaczonym na pobierane dane nie zosta",
        "Microsoft.Windows.49.X20-00860_8wekyb3d8bbwe",
        "Q27W6-FJBV9-4DFRT-N9WV8-RX8XH",
        "DUSetup: Initializing DU Sandbox Path:   [%s]",
        "Found pending OS rollback operation.%0",
        ";b;m;",
        "6,6L6r6",
        "NodeIndex < m_pTargetObject->m_LayoutCache.TotalObjectCount()",
        "#0<0Q0X0k0",
        "Compatibility: No MigXml present",
        "Microsoft.Windows.122.X19-98839_8wekyb3d8bbwe",
        "ExternalDriveLetter",
        "Ett f",
        "Microsoft.Windows.98.X19-99660_8wekyb3d8bbwe",
        "VerifyFileByHandle",
        "Microsoft.Windows.99.X20-39252_8wekyb3d8bbwe",
        "no link",
        "2PNKX-78KYP-B24X8-BQYF6-9KXRV",
        "85361d4f-a9b5-bbb7-3274-a10ae7eb35f5",
        "CompatFinalizeReq: Initializing BitLockerDevEncrAvail: [%s]",
        "CFN49-BR4B6-9KCJK-KVY6X-FRG6G",
        "6RDKC-FNJ4G-FV3F9-WXVYF-844BK",
        "digt.%0",
        "lisis de compatibilidad para la instalaci",
        "Microsoft.Windows.147.X21-83759_8wekyb3d8bbwe",
        "BiBindEfiNamespaceObjects failed %x",
        "ND8Y2-Y3FKK-6Q7FJ-9WXGM-KD9TM",
        "CDlpActionCompat::ExecuteDownloadReqScan: Exit",
        "FNW8H-JCWQD-CJM8H-BR4F3-RJTB2",
        "1(1/161",
        "Target Image: Version = [%d.%d.%d.0]",
        "fa72d556-3042-7edd-f7a5-dbe7034a2ab0",
        "Yhteensopivuusraporttia ei voi n",
        "CDlpActionProductKeyValidate::SearchForKeyInDigitalMarker",
        "ProductKey: Failed to report Host OS channel to telemetry.",
        "De gebruiker heeft ervoor gekozen om te annuleren omdat het systeem niet voldoet aan de compatibiliteitsscan voor het installeren van de update.%0",
        "<j=p=",
        "ProductKey: GatherOsState Process returned   : [0x%X]",
        "Microsoft.Windows.159.X21-83761_8wekyb3d8bbwe",
        ".?AV?$CUnknownImpl@VIActivationAction@@@@",
        "54d38694-9ab1-1a13-ab12-73ff2fdc53b7",
        "w do pobrania.%0",
        "5(5,5D5H5`5p5t5x5|5",
        "CDlpActionDU::InitializeDUImage",
        "STATUS_SXS_TRANSACTION_CLOSURE_INCOMPLETE",
        "ProductKey: Getting index from SkuLib.",
        "Microsoft.Windows.98.X20-29586_8wekyb3d8bbwe",
        "DUImage: Skipping Dynamic Update due to timeout getting critical updates.",
        "UpdateMedia: Initializing ConfigFilePath:           [%s]",
        "operation would block",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionPreFinalizeFactory,class CDlpActionPreFinalize>::CreateAction",
        "te9w<t",
        "SetFileTime",
        "Die Probleme mit dem Installationsspeicherplatz wurden nicht innerhalb des erforderlichen Zeitlimits behoben.%0",
        "r att forts",
        "9>:E:",
        "06acf7a6-2c14-c6bc-072c-151b081ec62e",
        "ReportId",
        "GetSecurityDescriptorGroup",
        "4221964b-ff44-21a6-7547-18f585697257",
        " soubor instala",
        "Microsoft.Windows.48.X20-32154_8wekyb3d8bbwe",
        "6\"6N6Y6j6q6|6",
        "bec6c6fc-48fd-1ea8-c79a-bdeed95e0359",
        " Operativsystem",
        "> >=>d>",
        ";](s?",
        "CheckDiskSpace: Error reporting telemetry for OSPARTITION_TOTALSPACE: [0x%X]",
        "1fa5dd31-9b26-a520-ccef-15e1774f773d",
        "D$8G;}",
        "08ce069e-0ef4-bdaa-8abd-99d5ea08eebb",
        "dffd9550-f456-9101-a8e6-7603f72504b4",
        "Microsoft.Windows.50.X21-83781_8wekyb3d8bbwe",
        "BcdOpenSystemStore: Failed to acquire BCD sync mutant.Status: %x",
        "Volume:MAK",
        "s folytat",
        "GetPrivateProfileStringW",
        "Target OS: Product Name = [%s]",
        "MNXKQ-WY2CT-JWBJ2-T68TQ-YBH2V",
        "DiskSpaceInstallReq: Initializing GDR Path:              [%s]",
        "SkipOobe",
        "ImageBasedPBR",
        "Microsoft.Windows.49.X19-99511_8wekyb3d8bbwe",
        "XmlParserGenerator::ReportError",
        "526K6",
        "191023231914Z",
        "65725c92-d1d4-31e6-cc5a-146e7db75754",
        " Microsoft Corporation. All rights reserved.",
        "CompatInstallReq: Initializing Wim Ref Count:             [%ld]",
        "o requer que o usu",
        "DUSetup: DCAT offer not found",
        "4 4$4(404H4L4d4t4x4",
        "6$7X788q8",
        "Microsoft.Windows.98.X19-99588_8wekyb3d8bbwe",
        "$ProgData",
        "CDlpActionImageDeploy::PopulateImageInfo",
        "The compatibility report cannot be displayed due to a missing system component.%0",
        "Microsoft.Windows.49.X19-98816_8wekyb3d8bbwe",
        "Compatibility: Cancel was requested",
        "eb1efc76-f01c-3070-3896-1dab30d8eba9",
        "ndigungen zu stornieren.%0",
        "ration de restauration de syst",
        "666@6F6Y6",
        "NH9MT-6368J-TT4XY-4BGCW-9TPHF",
        "03868fdd-7c34-2e36-4aad-eb30efb04cee",
        "Microsoft.Windows.48.res-v3310_8wekyb3d8bbwe",
        "2\"2*2=2m2",
        "6K3GQ-N2KF9-84J97-K4FVC-YKMPF",
        "3ef3be69-5ace-63f7-85c8-325a50883566",
        "KQNHM-C2RTJ-Q6JJY-M483Y-39PJP",
        "enterprisesubscription",
        ";G<M<`<n<",
        "C9PDN-TR2KB-MR4DF-3RQ7Y-88HFF",
        "T$<QP",
        "HMFN6-8M96P-XKR6W-8FH4T-J2QFJ",
        "1d359dc6-3a5b-8606-81ab-27b54acb3025",
        "453cbc81-144a-99e4-2640-425792e7f735",
        "6RKNgQ",
        "CKCFC-NMDR2-QG2XC-QWFCV-4C38T",
        "llningsmilj",
        "zh-MO",
        "Microsoft.Windows.165.X21-06179_8wekyb3d8bbwe",
        "ImageDeploy: Initializing Wim Ref Count          [%ld]",
        "DUSetup: Initializing Force Default:     [%s]",
        "EditionIdFromSkulib",
        "ConX::Setup::Common::COSInfoHelper::GetHostSkuInfo: GetProductInfo not found in kernel32.dll, Err=%d",
        "64227d72-696a-3a54-1743-70ca88f21889",
        "nelik disk alan",
        "3&353H3Q3]3e3t3",
        " avbryte fordi systemet ikke oppfyller kravene for det valgte overf",
        "Microsoft.Windows.49.X20-35547_8wekyb3d8bbwe",
        "Microsoft.Windows.50.X21-83768_8wekyb3d8bbwe",
        ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIMoSetupDlpAction@@@@@@",
        "9s0toh",
        "o encontrou um erro n",
        "Summary: IsBitlockerEnabled returned [0x%X].",
        "DM3GN-V7TRY-XD7Q8-JGR32-CJ7M7",
        "n yhteensopivuusvaiheen aikana.%0",
        "NJQK8-TPGT8-W98WH-KXJMQ-JTYP8",
        "Microsoft.Windows.101.X20-39244_8wekyb3d8bbwe",
        "9m:f;",
        "DeleteFileEx: Unable to delete [%s]; GLE = 0x%x",
        "7NQVF-QB396-FM8FM-P3BPT-RRHKQ",
        ";@;U;",
        "2013a376-f783-f2cd-5f71-26a23f44d609",
        "host_unreachable",
        "Microsoft.Windows.48.X21-03400_8wekyb3d8bbwe",
        "Brukeren har valgt ",
        "095afc8d-977c-ccbb-a65d-28bd8d5c9042",
        "5-778_8",
        "DeleteFileEx: Trying to set back attributes on: %s",
        "FlushSink.Hr()",
        "DPH2V-TTNVB-4X9Q3-TJR4H-KHJW4",
        "CDlpActionDiskSpaceReq::MigratePackages",
        "La plateforme d",
        "GetDiskFreeSpaceExW",
        "9FMFN-42B2R-8Q8M3-W2P36-RRHKC",
        "WGKWM-HXNRK-YFMP8-BFHBX-YDWVP",
        "PackageMigration: Migrating critical update packages from [%s] into Target OS...",
        "f7fe92e6-68e4-1820-db04-81baa3d77dce",
        " possibile riprovare.%0",
        "DataMigration: Queue Request for [%s] file migration",
        " a ser utilizado num ambiente de teste.%0",
        "n para realizar pruebas.%0",
        "n no se complet",
        "Microsoft.Windows.4.X19-98715_8wekyb3d8bbwe",
        "5&555@5H5W5b5m5|5",
        "MoSetupPlatform: SetupAutomation object released!",
        "80577ce4-4608-fd67-b350-542b7250300d",
        "29e4c833-092c-f9af-2a47-e7ebe219f351",
        "versionRange",
        "mni-IN",
        "Une version inattendue des fichiers binaires SetupPlatform a ",
        ";&<1<f<q<",
        "\"GatherOsState.exe\" konnte nicht ausgef",
        "Microsoft.Windows.101.X20-24575_8wekyb3d8bbwe",
        "5C5J5",
        "3/3M3R3f3s3~3",
        "WriteFile",
        " esaurito.%0",
        "DUImage: Downloaded %d FOD updates.",
        "SourcePath",
        "Microsoft.Windows.48.X19-99504_8wekyb3d8bbwe",
        "Brugeren har kun brugt setup.exe-kommandolinjen til at scanne, ikke til at installere OS.%0",
        "Microsoft.Windows.101.X19-99526_8wekyb3d8bbwe",
        "L$$PSV",
        "DUImage: Initializing IsServer:                  [%s]",
        " gestita non sono stati risolti entro il limite di tempo richiesto.%0",
        "TRUST_E_SUBJECT_NOT_TRUSTED",
        "6e6b5db1-d955-7235-d1e0-761f330c1e8d",
        "o, e o usu",
        "Microsoft.Windows.122.res-v3287_8wekyb3d8bbwe",
        "FileVersion",
        "CDlpActionFinalize::UploadSqmToSetupPlatform",
        "WATSON_BUGCHECK_P3",
        "RtlDuplicateLUtf8String",
        "Microsoft.Windows.48.X20-35592_8wekyb3d8bbwe",
        "303P3p3",
        "o em disco para transferir e descompactar suportes de dados com v",
        "3+4:4J4Y4g4q4",
        "reportgen.dll",
        "Could not set compression. Invalid cluster size.",
        "Recovery: Initializing Target:         [%c]",
        "Microsoft.Windows.99.X20-29697_8wekyb3d8bbwe",
        "(Params->InputType == Windows::Microdom::Rtl::CreateMicrodomSource::Binary) || (Params->InputType == Windows::Microdom::Rtl::CreateMicrodomSource::Xml)",
        "Microsoft.Windows.7.X21-83402_8wekyb3d8bbwe",
        "D6RD9-D4N8T-RT9QX-YW6YT-FCWWJ",
        "Microsoft.Windows.48.X20-29658_8wekyb3d8bbwe",
        "5Qh\\`",
        "DUImage: Initializing Wim Ref Count    [%ld]",
        "ProductKey: Using existing image selection response (product key unchanged).",
        "8f590583-3540-a68a-810f-fd08f54da7d3",
        "Action",
        "TYNHW-PQ6GK-6T847-DCJQW-YP2KG",
        "def2e685-e537-f9b4-bdce-0acfde233b17",
        "Microsoft.Windows.96.X99-99999_8wekyb3d8bbwe",
        "adavky pro po",
        "n ett tidigare installationsf",
        "7-7i7",
        "Y7YJC-NKRQ6-D3VPG-GTX96-KTP2V",
        ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskSpaceAction@@@@@@",
        "Microsoft.Windows.7.X17-36798_8wekyb3d8bbwe",
        "coresinglelanguage",
        "Finalize: Error reading Update and Shutdown Value: [0x%X]. Using default value of [%s]",
        "Microsoft.Windows.100.X19-99448_8wekyb3d8bbwe",
        "RtlFreeUnicodeString",
        "SPMinorVersion",
        " EULA",
        "LangPack",
        "El entorno de recuperaci",
        "CDlpActionPreFinalize::PauseRoutine",
        "Eine neuere Version von Setup wird gestartet, um die Installation fortzusetzen.",
        "091e1p1",
        "SourceEdition",
        "Stato dell'installazione del server non disponibile.%0",
        " raportu zgodno",
        "b975d5e5-09ad-77f9-b55f-b7343fe3a60f",
        "n por parte del usuario.%0",
        "Microsoft.Windows.7.X21-83411_8wekyb3d8bbwe",
        "YNDMB-2QCFC-HTFBP-JF9HC-FX849",
        "=!>W?k?x?",
        "7(757@7K7k7",
        "Microsoft.Windows.4.X19-98706_8wekyb3d8bbwe",
        "db45ec72-7adf-a2fe-9e45-d8e06e801ce1",
        ";E;[;a;y;",
        "<4=>=T=Z=",
        "GenerateGenuineTicket",
        ">+>T>p>",
        "4O5V5\\5u5",
        "klemek i",
        "MigChoice: Initializing Target Edition Id:     [%s]",
        "Target OS: Detected Source Edition = [%s]",
        "Microsoft.Windows.101.X20-35486_8wekyb3d8bbwe",
        "(ulElementType == (0x2)) || (ulElementType == (0x3)) || (ulElementType == (0x5)) || (ulElementType == (0x1)) || (ulElementType == (0x6)) || (ulElementType == (0x7)) || (ulElementType == (0x4))",
        "24RGN-K2YXT-Y4QB2-4Y29V-94PMD",
        "Microsoft.Windows.27.X19-98761_8wekyb3d8bbwe",
        "a4b5462c-7dff-e15d-8e9a-e5a0ab9f18f9",
        "Microsoft.Windows.99.X20-39249_8wekyb3d8bbwe",
        "BuildInfo",
        "CDlpActionDiskSpaceReq::CallTriggerStoragePolicies",
        "6=6\\6",
        "545m5",
        "cd05a480-e384-ca4b-9986-96e8ea0094e6",
        "4!4+424C4J4n4",
        "JQ6CR-JNV8R-J6VFC-YR39V-G6PHF",
        "NtEnumerateBootEntries",
        "The GatherOsState executable has invalid signature.%0",
        "<0<G<Q<x<",
        "An unexpected version of Setup Platform binaries was encountered. Please verify the package contents.%0",
        "t:Vh0Z",
        "\\\\.\\?:",
        "TelemetryAssert",
        "j\\Yuj",
        ">!?C?R?_?",
        "DataMigration: This is a data-only migration. Attempt to acquire locale info",
        " opakov",
        "X19-99485;X19-99482;X19-99498;X19-99499;X19-99508;X19-99520;X20-30039;X20-30040;X20-30049;X20-30047;X20-30050;X20-30053;X20-30051;X20-30052;X20-36699;X20-36700;X20-36702;X20-36701;X20-36693;X20-36696;X18-15587;X18-15584;X18-95491;X18-95458;X18-15577;X18-15575;X18-95498;X18-95466",
        "il v po",
        "e65a144b-b2ea-bedb-08df-b3c92450205c",
        "3c88328a-7c1e-aa8a-72e7-edca5665b405",
        "<+<;<A<O<y<",
        "Microsoft.Windows.100.X19-99447_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X20-29587_8wekyb3d8bbwe",
        " nie powiod",
        "RestoreHardlink",
        "EnableShortnamesOnApplyTarget",
        "%wNtE",
        "coren",
        "Compatibility: Creating resolve thread.",
        "Activation: Is Machine Active                : [%s]",
        "Microsoft.Windows.48.X19-98845_8wekyb3d8bbwe",
        "O sistema n",
        "UxTheme.dll",
        "7ccb37ec-c0db-a750-5716-fbf9162f5dc2",
        "Microsoft.Windows.49.X19-98832_8wekyb3d8bbwe",
        "pHeader->ulTotalSize == m_MicrodomDataBlob.Length",
        "8+8V8]8",
        "2d88564b-e4b1-86b2-7ae6-b0b81cd5bdba",
        "Il sistema non soddisfa i requisiti di spazio su disco per l'installazione del payload.%0",
        ".?AV?$CMoReserveManagerT@V?$CUnknownImpl@UIUnknown@@@@@@",
        "#document",
        "MoSetupPlatform: Failed to enable ETL tracing. [0x%x]",
        "Voor het installatieproces is vereist dat de gebruiker akkoord gaat met de gebruiksrechtovereenkomst.%0",
        "o encontrada. Verifique o conte",
        "Kullan",
        "Target Image: Edition = [%s]",
        "vel localizar uma letra de unidade de destino. %0",
        "o pretendida.%0",
        "9#9|9",
        "jnhP|",
        "H74JJ-7FNDK-FKBT6-RF7XD-YBH3B",
        "Microsoft.Windows.8.X18-81312_8wekyb3d8bbwe",
        "CDlpActionDiskSpaceReq::GetResultsInstallReq",
        "r valt migreringsalternativ.%0",
        " nur zum Scannen und nicht zur Installation des Betriebssystems verwendet.%0",
        "cfa33a25-3505-dd6f-4a09-c92b7c09edee",
        "CMicrodomBuilder::InsertDefaultAttributes",
        " prov",
        "QQQQj",
        "tFWj;P",
        "=&=5=;=",
        "Microsoft.Windows.98.X19-99598_8wekyb3d8bbwe",
        "VHJVF-HYNDP-F99W3-V7M4F-K4R7T",
        "2,2024282@2X2h2x2|2",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::GetState",
        "4354ba24-4d71-5345-f92c-1d58e54349f1",
        "NtQueryInformationProcess",
        "9!:(:{:",
        "7c3d1878-6d96-4688-59e4-87f64c5cb5d3",
        "DHWP9-NWWKH-G72RJ-CQ49T-P7JXM",
        "WjdWjd",
        "Microsoft.Windows.99.X20-35493_8wekyb3d8bbwe",
        "Det oppstod en feil, og resultatverdien m",
        "RegCreateKeyExW",
        "STATUS_DUPLICATE_NAME",
        "vede kriterier.%0",
        "cych instalacji aktualizacji, a u",
        "Microsoft.Windows.175.X21-41300_8wekyb3d8bbwe",
        "ff8eda5f-d166-a8c8-05ad-8b37de17574f",
        "Ein fehlerhaftes Skript konnte nicht ausgef",
        "Microsoft.Windows.22.X18-81294_8wekyb3d8bbwe",
        "UpdateMedia: Scenario not supported for media update",
        "9t$8tJ",
        "n previa o se devolvi",
        "B4CRN-GXQVV-79THX-9QYVB-DPFTR",
        "DUImage: Searching for LangPack updates...",
        "CDlpResponseAutomation::InitializeRoutineDiskPartition",
        "De gebruiker heeft ervoor gekozen om te annuleren voor de advertentie.%0",
        "o. Verifique o conte",
        "425f5",
        "101Q1",
        "Microsoft.Windows.101.X19-99546_8wekyb3d8bbwe",
        "The installation process was launched with an unknown command line argument.%0",
        "Y9YPN-6X7VH-HD3JW-T8V6P-DDBPC",
        "7N6PP-MYR7R-YMPX3-K3B7W-WB6P4",
        "<@<K<w<",
        "r ikke kompatibilitetsskanningen for ",
        "Microsoft.Windows.17.X17-66965_8wekyb3d8bbwe",
        "uW0~0W0_0 ",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::PreInit",
        "Microsoft.Windows.50.res-v4330_8wekyb3d8bbwe",
        "CFCPayloadDUCallback: OnProgressChanged [%d]",
        "222M2g2x2",
        ".?AV?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIMoSetupDlpAction@@@@@@@@@@",
        "RtlRegisterFeatureConfigurationChangeNotification",
        ".?AVCDlpActionRecoveryFactory@@",
        "f5712222-d93a-8d77-6019-b6ffaf0cc828",
        ":9>G>",
        "Microsoft.Windows.122.X19-98690_8wekyb3d8bbwe",
        "network reset",
        "CDlpActionSummary::DeserializeRoutine",
        "60b1e949-cd25-347a-dc12-87c24cc0991e",
        "El sistema no ha aprobado el an",
        "3 383<3T3d3h3l3",
        "CDlpActionUpdateMedia::InitializeRoutine",
        "Brugeren har valgt at annullere, fordi systemet ikke opfylder kravene i enhedsscanningen til installation af opdateringen.%0",
        "<%<,<n<y<",
        "De gated compatibiliteitsproblemen zijn niet binnen de gestelde tijdslimiet opgelost.%0",
        "MigChoice: Error reporting install choice: [0x%X]",
        "Il sistema non soddisfa i requisiti per l'opzione di migrazione desiderata.%0",
        "6 6(60686@6P6t6|6",
        "Microsoft.Windows.98.X19-99599_8wekyb3d8bbwe",
        ";&;o;y;",
        "Der Benutzer hat den Vorgang abgebrochen, da das System die Anforderungen f",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionDiskPartitionFactory,class CDlpActionDiskPartition>::CreateAction",
        "847K2-NHK4Y-J48Y9-MK8GD-TCQPP",
        "NWQBX-QDCCJ-GWWXV-H8J9T-FVVYG",
        "Ein Vorinstallationsskript konnte nicht ausgef",
        "compresser le support multi-architecture. %0",
        "t(j\\W",
        "72734d2e-d8e0-741e-9d49-ea4857ad0b62",
        "DMXJN-DCCMP-MKYJT-44W9W-TQ73D",
        "SetupCore: Registered DU_SETUP action",
        "si lemezter",
        "Target OS: Feature -> [%s]",
        "CDlpActionProductKeyValidate::SelectImageFromResponse",
        "homepremiume",
        "NtOpenFile",
        "fr-029",
        ": :,:8:D:P:\\:h:t:",
        "Microsoft.Windows.99.X20-00907_8wekyb3d8bbwe",
        "homebasic",
        "Proces instalacji zosta",
        "4Z5p5",
        ":w:~:6;=;",
        "\\imagehlp.dll",
        "1$101;1X1",
        "owe.%0",
        "D$ 9D$",
        "file corrupted in block at offset %p",
        "CP7V3-KFC9F-DBV2R-TVHBW-4P9GM",
        "El usuario rechaz",
        "24282P2`2d2l2p2t2x2",
        "Failed to find a key to load store %s. Last attempted key: %ws",
        "ResNodesSort",
        "400f4a5e-0e8d-1c2a-b565-46668a21627c",
        "serverstandardcor",
        "b-Nbk",
        "Aby kontynuowa",
        "PerformSilentCleanup: Performing silent disk cleanup.",
        "T)R(uq}",
        "Microsoft.Windows.100.X20-00904_8wekyb3d8bbwe",
        ":a:q:}:",
        "hi-IN",
        "nkami se nevy",
        "ProductKey: EI.cfg file contained an edition Id.",
        "ivityksen asentamisen v",
        "nimos no se resolvieron en el plazo requerido.%0",
        "SystemLanguage",
        "SetupCore: Registered SUMMARY action",
        "Microsoft.Windows.121.X20-35502_8wekyb3d8bbwe",
        "ste startas om.%0",
        "r att beh",
        "GGR2P-Y9NDD-K8WGP-FCTBP-W2R42",
        "HMNXT-HFMD2-KGXHP-JVCJR-FC2R8",
        "es-MX",
        "Microsoft.Windows.48.X20-23597_8wekyb3d8bbwe",
        "7D7N7X7b7l7",
        "l dostat upozorn",
        "ReadWimHeader",
        "PerformSilentCleanup: Failed to call PerformCleanupTask",
        "Tel#Asmv",
        ";0<Q<X<",
        "Et precommitscript blev ikke udf",
        ":=:P:i:|:",
        "901b8d0a-7e61-cc47-9541-b8ad00267e09",
        "czony.%0",
        "2N2Y2",
        "ENTITIES",
        "FD6N9-BRHQC-47BVQ-YCFCF-PPQGT",
        "CN9G3-XTMBM-MRB7W-7B7RT-J2QDV",
        "cy-GB",
        "Q7R6P-FNW74-H4FP9-V8GG4-HQWVV",
        "WRjUZ",
        "$kJE)",
        "j\\Yf;",
        "DUImage: Skipping Dynamic Update due to opt-in selection.",
        "am-ET",
        "ae778c21-f495-2b68-19a6-109baa220553",
        "4dd3afd1-bc10-4114-2b50-84523e26a63a",
        "SyspartGetPhysicalPartitions failed with error code: %x",
        "PRQhh",
        "ProductKey: Matching Install Wim.",
        "ras. Datorn m",
        "31383e3",
        "stream timeout",
        ".?AV?$CDlpWimInfoT@V?$CUnknownImpl@UIUnknown@@@@@@",
        "D$4_^[",
        "UnregisterClassA",
        "ProductKey: EI.cfg file contained an install channel.",
        "13d2d06a-02f4-991b-d90d-8da9222b33be",
        "D$,PQ",
        "A rendszer nem felel meg az adatok let",
        "Microsoft.Windows.7.res-v4296_8wekyb3d8bbwe",
        "hy-AM",
        "STATUS_UNMAPPABLE_CHARACTER",
        "BUCL::Rtl::Add(cbReturnSize, cbThisSize, cbReturnSize)",
        "Microsoft.Windows.48.X21-03403_8wekyb3d8bbwe",
        "Microsoft.Windows.172.X21-24720_8wekyb3d8bbwe",
        "A kezdem",
        "tt kezdem",
        "5$666",
        "Microsoft.Windows.100.X20-39260_8wekyb3d8bbwe",
        "aeeac240-bd6d-74ff-6ffe-4a9486f8db95",
        "SetupBuildString",
        "8r SW",
        "526de8c3-8357-2bc3-0d2d-831185d17841",
        "nglig.%0",
        "4-4M4h4x4",
        "rt kommandoraden med setup.exe endast f",
        "J3DY3-HWNTC-YTJ8H-637K6-CGY6Q",
        "MoSetupPlatform: Attempting resurrect of Setup Platform object...",
        "Um script excedeu o limite de tempo limite.%0",
        "SetupCore: Registered DISK_PARTITION action",
        "vel encontrar uma imagem de instala",
        "ConX::Setup::Common::COSInfoHelper::GetCurrentSystemBranchName",
        "Microsoft.Windows.100.X20-29643_8wekyb3d8bbwe",
        "a995b3a0-592f-7650-be63-0f8dfdb39ca2",
        "holographic",
        "7 7$7(7@7D7X7\\7l7p7t7x7|7",
        "969f04e5-71ac-e52c-5702-fdee0ec65e54",
        "772e6ffb-f51a-b025-2a0c-e8f2e1c2ff9d",
        "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a",
        "171>1D1i1p1v1",
        "NewEntityDecl = this->AllocateStreamObject()",
        "PWWWWWWS",
        "8o8|8",
        "5&6A6i6",
        "Microsoft.Windows.48.X20-23649_8wekyb3d8bbwe",
        "647v7",
        "zu-ZA",
        "d\\OL0~0`0",
        "o pode continuar porque a finaliza",
        ".?AUICompatibilityDataProvider@Compatibility@ConX@@",
        "6MFNB-H2K7D-8QCBM-DGB8V-R9CKT",
        "CheckDiskSpace: Error reporting telemetry for EXT_DRIVE_REQUIREDSPACE: [0x%X]",
        "4%464?4K4k4r4",
        "GetSupportedDriveLetters: Drive [%c] bIsHotPluggable = [%s]",
        "Microsoft.Windows.161.X20-00859_8wekyb3d8bbwe",
        "tapes initiales de Configuration - Nouvelle tentative possible.%0",
        "DiskSpaceInstallReq: Initializing GDR Count              [%ld]",
        ",SVW3",
        ".xdata$x",
        "5X5_5",
        "Det gick inte att k",
        "tirilmesi gerekiyor.%0",
        "ca3cca74-75e9-d541-0a0e-424ffff27dc4",
        "Microsoft.Windows.122.X19-98685_8wekyb3d8bbwe",
        "Microsoft.Windows.125.X20-00859_8wekyb3d8bbwe",
        "OnlineRollbackArgsSys",
        "pu instalacji jest niedost",
        "Microsoft.Windows.8.X21-83698_8wekyb3d8bbwe",
        "dtak meg a sz",
        ">1>E>",
        "%CLIENT_K%",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::GetActionName",
        "enterpriseneval",
        "MR7Y6-N3FX9-M269R-BK6WH-6XRW6",
        "The installation process was terminated during the actionable compatibility phase.%0",
        "Sistem, Windows kurtarmak i",
        "invalid argument",
        "N6PP2-2BMR3-8CBJ4-7JFWD-9D73M",
        "PreSelectedArch",
        "3KHY7-WNT83-DGQKR-F7HPR-844BM",
        "Microsoft.Windows.8.X17-36778_8wekyb3d8bbwe",
        "NJ699-4WWMC-39RH9-TXD7J-QDBW2",
        "24c37526-ebf5-e6af-4cbb-ad62c47d8133",
        "ddf6b4eb-bb04-f6fd-c062-05d5b399c722",
        "rio optou por cancelar porque o sistema n",
        "0(0,0004080<0D0\\0`0x0",
        "Microsoft.Windows.101.X20-36691_8wekyb3d8bbwe",
        "9A:H:x:",
        "ja-JP",
        "Microsoft.Windows.100.res-v3275_8wekyb3d8bbwe",
        "2d2d0114-d610-577b-4069-16f661c4ccee",
        "inden iptal etmeyi se",
        "DUImage: OsArchitecture: [%s]",
        "184460aa-9ca8-057e-fde0-30ddc3131ec5",
        "o especificado.%0",
        "CDlpActionCompat::GetResultsGated",
        "Microsoft.Windows.8.X21-83687_8wekyb3d8bbwe",
        "ExecuteInstallReq: Error reporting telemetry for szAutoSupportedDriveLetters[dwIndex]: [0x%X]",
        "QDTCN-F22MP-3FPD9-XY3VD-97639",
        "a544d16e-8932-9395-89a6-69c5a6fea205",
        "f806a9f8-7645-ed31-212a-bb7527f467b3",
        "RtlLengthSid",
        "7RNMY-8K82B-FCX9M-PBM6M-88F8P",
        "9s8uh",
        "Microsoft.Windows.99.X19-99652_8wekyb3d8bbwe",
        "Microsoft.Windows.101.X20-29691_8wekyb3d8bbwe",
        "Server Core",
        "ufhLE",
        "7G7b7}7",
        "CDlpActionGetWebSetupUserInput::SerializeRoutine",
        "=(=,=<=@=P=T=l=|=",
        "El usuario ha usado la l",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::Suspend",
        "RtlWriteMicrodomXml",
        "PrivacyConsentStatus",
        "Microsoft.Windows.121.X19-98890_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X20-39273_8wekyb3d8bbwe",
        "DataMigration: Failed to read Reserve Manager Active Scenario Key Hr=[0x%X].",
        ".?AV?$CMoSetupPlatformT@V?$CUnknownImpl@UIUnknown@@@@@@",
        "a2c43d41-2c69-5bbd-6201-7e6966c03320",
        "Microsoft.Windows.99.X20-29694_8wekyb3d8bbwe",
        "<,<4<@<`<l<",
        "GetWebSetupUserInput: Including retail only editions = [%s].",
        "|%s|%d|%I64d",
        " lanc",
        "N2T7D-3RJ8Q-QJ6V6-26F6M-VQWWK",
        "Recovery: Examining Image Index: [%d]",
        "AppBlockFound",
        "DriverCount",
        "ration, car l'analyse du p",
        "t9f91t4",
        " verze instala",
        ";3rU;",
        "Microsoft.Windows.48.X20-29560_8wekyb3d8bbwe",
        "MoSetupPlatform: Checking for target drive letter in automation...",
        "NK8HP-6D7GB-9RTK6-4KDRH-GCQG4",
        "2bb9f2b8-80e6-4550-d6f1-99abaf906b34",
        "VY84N-QKMHQ-67WWW-FV392-YKMM7",
        "MYHRY-CN8HD-MXF2X-W8Q97-3J473",
        "7e483e68-ff30-92e8-4587-8f2086a4e3e0",
        "Microsoft.Windows.4.X21-05135_8wekyb3d8bbwe",
        "PNJ93-PJK47-B7TKH-HJPB7-2RXGH",
        "GKBNJ-MHH82-8436W-MJ4P4-6Q8WB",
        ":(;/;:;_;",
        " jour n'a pas abouti pour le syst",
        "WIM\\IMAGE[*]\\TOTALBYTES",
        "5$54585<5T5d5h5l5p5t5x5|5",
        ".?AUIDownloadCallback@SetupPlatform@@",
        ">'?I?",
        "Target OS: Detected Source Version = [%s]",
        "Et feilskript kan ikke kj",
        "befb80d8-d96f-5cd6-b7a0-09c1bc9e8002",
        "no message",
        "2(3S3",
        "NetApiBufferFree",
        "Microsoft.Windows.27.X21-83178_8wekyb3d8bbwe",
        "=A=N=",
        "RtlCopyLUtf8StringToLUnicodeString",
        "Hiba t",
        "0-0F0[0Y1",
        "Microsoft.Windows.4.X21-03401_8wekyb3d8bbwe",
        "%Microsoft Windows Production PCA 2011",
        ":$:+:8:?:F:",
        "DiskSpaceInstallReq: Initializing SafeOS Count           [%ld]",
        "1 1(1A1F1N1V1^1f1~1",
        "8FD96-KNCQ6-M26FY-T38CP-Q3XC3",
        "o de revers",
        "4C5h5",
        "SerialPort",
        "1127ca49-468c-b5ec-08ab-8efb30b6c9f9",
        "11181{1",
        "QSVWj\\",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::PrepareRoutine",
        "TargetEdition",
        "Microsoft.Windows.165.X21-04956_8wekyb3d8bbwe",
        "8$808<8H8T8`8l8x8",
        "SetupVersionBuildNumber",
        "4/4k4",
        "SPMajorVersion",
        ".text$x",
        "\\EFI\\Microsoft\\Boot\\BCD",
        "0a39b7c1-0dd4-b12e-414d-6d4f6b4223a0",
        "10151404-158e-9a2b-2e26-7629d05547eb",
        "Microsoft.Windows.48.X20-29670_8wekyb3d8bbwe",
        "4'404=4F4c4m4",
        "Installasjonen kan ikke fortsette fordi det ikke er nok diskplass p",
        "CDlpActionCompat::ExecuteInstallReqScan: Exit",
        "CDlpActionDiskPartition::InitializeRoutine",
        "setupcomplete.cmd",
        ":;;Y;h;",
        "H4MND-KF7J8-PWBTV-2P3JG-BP4FC",
        "Microsoft.Windows.7.X17-36795_8wekyb3d8bbwe",
        "L$L_^[3",
        "tk-TM",
        "NY48Y-K9DDM-VT896-8VW3H-6X2JT",
        "DeletePath: [%s] doesn't exist as a directory; nothing to delete.",
        "XMW6N-FC76F-HMK9T-MW3W6-WXCJP",
        "Failed to shred identity.",
        "enterprisegn",
        "adnika systemu.%0",
        "m minim",
        "installation, car une t",
        "Microsoft.Windows.189.res-v4368_8wekyb3d8bbwe",
        "7C7Y7",
        "VFN72-MT369-966D8-XVGDF-W8F86",
        "tzm-Tfng",
        ":$:>:e:~:",
        "522c8dde-ce27-056b-e4bb-567d419dda14",
        "turulmad",
        "D$,@n",
        "5%5:5D5J5",
        "9$:/:a:l:",
        "f9696172-fcfa-c40d-2c87-b81feffff0e8",
        "MoSetupPlatform: Opening BCD store...",
        "Summary",
        "la.%0",
        "150ba3b7-4f8d-cb60-41f9-32cb4e27aa94",
        "nn-NO",
        "imlendirilmi",
        "Microsoft.Windows.98.X19-99592_8wekyb3d8bbwe",
        "Enumerate_Editions",
        "RestoreStreams",
        "CDlpActionCompat::SerializeMigChoiceScan",
        "6MQMH-2M9TJ-69JQN-JKKCM-PR42H",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::CheckUserInterrupt",
        "N7JY7-R7WX2-8FX4J-YVP4G-XQDCC",
        "failed to extract file from reference extension",
        "VarFileInfo",
        "r inte att skapa eller f",
        "7Q2BN-4JVQ4-76M8H-D3QF7-XD7YB",
        "Microsoft.Windows.125.res-v4249_8wekyb3d8bbwe",
        "Setup360DownlevelTime",
        "CXmlNamespaceManager::Initialize",
        "OutputLString.Buffer = static_cast<PWCHAR>(Allocator.ReserveBytes(BytesRequired, alignof(WCHAR)))",
        "Client.OS.RS2",
        "pProcessResFileBackedByWim",
        "829<9",
        "EnterpriseS",
        "YRNM6-H6F6D-9B36P-4QGPG-GMVM7",
        "28b7ffab-71ae-ec74-c4f7-236e5543b02f",
        "JDCKB-7VNPD-QD376-MMRQJ-JFG6Y",
        ">$>F>T>m>|>",
        "DeleteCriticalSection",
        "d928019e-ee40-3037-ecde-d6571d4d7d2c",
        "Microsoft.Windows.184.X21-83659_8wekyb3d8bbwe",
        "6NCT3-8HGPG-VY8H7-843W6-683GT",
        "415A6^6d6",
        "u*9~(t h",
        "Der er ingen pakker, der skal downloades.%0",
        "ca-ES-valencia",
        "Microsoft.Windows.136.res-v4361_8wekyb3d8bbwe",
        ">!>;>B>x>",
        "3XFBN-WY2B8-DQ4FJ-TQHJV-7QWXQ",
        "Microsoft.Windows.126.X20-35531_8wekyb3d8bbwe",
        "8547f92c-2bd5-7bc7-9e63-c83e61395372",
        "5>6E6P6",
        "AdjustTokenPrivileges",
        "Ultimate",
        "66fb1378-9746-19da-24ad-7b112418c92b",
        "1!2B2S3",
        "CMicrodomUpdateContext::CreateVirtualAttribute",
        "7PMGW-KN2K8-JXP2D-XJ98Y-X4TP3",
        "d2948d8f-5739-6cfb-d430-79e6466b31d8",
        "o, porque j",
        "SetupDiGetDeviceInterfacePropertyW",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::Restart",
        "pa-Arab",
        "BASE_N",
        "b3a2f25b-7590-24d8-4b23-bf0d2f2841a5",
        "En mer oppdatert versjon av installasjonsprogrammet startes for ",
        "itli uyumluluk sorunlar",
        "CQ89X-NPB2V-FYDKC-6VDKC-DDBPB",
        "@PPhP",
        ";'<3<Z<d<",
        "4NK4C-44FKK-TDQKK-3QDP8-W44CT",
        "sultante doit ",
        "tfen paketin i",
        "t2h`t",
        " de fa",
        "quz-PE",
        "miyor.%0",
        "DUOptInSelected",
        "Assertion failed in %hs(%i)",
        "DiskSpaceInstallReq: Initializing Wim Path:                     [%s]",
        "Microsoft.Windows.48.X19-98847_8wekyb3d8bbwe",
        "Installationsprocessen slutf",
        "UNKNOWN",
        "NFDPX-3MV8X-THC2X-QQ9QP-P9YY6",
        "dataOnly",
        "Finalize: Reporting result value: [0x%X]",
        "VWTXN-MJ2HW-8R3KB-9WYD2-V8RDD",
        "pny.%0",
        "STATUS_UNDEFINED_CHARACTER",
        "o foi encerrado.%0",
        "professionale",
        "Microsoft.Windows.101.X20-36698_8wekyb3d8bbwe",
        "ObjectHeader->uElementType == ucObjectType",
        "professionalworkstationn",
        "7:7B7j7r7",
        "NVGV6-J6FGM-7TFK7-VC9DP-8XCJM",
        " gereksinimlerini ge",
        "ZwQueryBootEntryOrder",
        "ExecuteInstallReq: Error reporting telemetry for DesiredPostUpgradeFreeSpace: [0x%X]",
        "vs.%0",
        "Microsoft.Windows.165.X21-06171_8wekyb3d8bbwe",
        "T3QCY-BND4M-CXJFF-6QBG7-94R7T",
        "STATUS_ACCESS_VIOLATION",
        "Microsoft.Windows.48.X20-32159_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X19-98833_8wekyb3d8bbwe",
        "5,535:5A5H5O5",
        "CompatInstallReq: Initializing Driver Reflect path:       [%s]",
        "RtlXmlDetermineStreamEncoding(&TokenizerState, &EncodingLength)",
        "VirtualQuery",
        "ProductKey: SelectImageIndex: Only one image found. Selecting default.",
        "Microsoft.Windows.165.X21-39884_8wekyb3d8bbwe",
        "Eula.rtf",
        "N4W9V-KBQWC-XQM46-MJYDJ-33WVT",
        "Microsoft.Windows.98.X20-00910_8wekyb3d8bbwe",
        "1333fbf1-b52b-55ab-743d-0a14c4515095",
        "NMK6H-DQGYD-R6WQ6-XGCYP-HH66Q",
        "Microsoft.Windows.162.res-v3924_8wekyb3d8bbwe",
        "Failed inserting element to cbs array at index %lu",
        "-consolida",
        "sa nem siker",
        "9&9F9",
        " odzyskiwania systemu Windows.%0",
        "do dentro do limite de tempo necess",
        "Microsoft.Windows.100.X20-29712_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::Resume",
        "adavk",
        "CheckDiskSpace: Not enough free disk space on [%c] drive",
        "P4Q9B-KN4TJ-W464W-67F2D-2WHWT",
        "GetUILanguageInfo",
        "e2849aa8-6c5b-08aa-33a9-270857bcac0f",
        "Microsoft.Windows.48.X20-29672_8wekyb3d8bbwe",
        "liwe jest ponowienie pr",
        " les termes du contrat de licence. %0",
        "1)272s2",
        "842e2bf0-e58a-e202-569a-4cf9df9760d1",
        "849s9",
        "gsw-FR",
        "28f6467f-33e2-2529-126b-9b2561a0ee11",
        "Could not open file {0}",
        "=2=@=\\=",
        "in yeterli disk alan",
        "*g~b0R",
        "CERT_E_INVALID_POLICY",
        "8#828b8",
        "Microsoft.Windows.101.X19-99552_8wekyb3d8bbwe",
        "?M?S?h?o?~?",
        "A resposta do servidor tem um formato incorreto.%0",
        "4B98P-WP9HN-XKDDP-HWCTM-KD73H",
        "Microsoft.Windows.131.X20-57726_8wekyb3d8bbwe",
        "en-HK",
        "Der Benutzer hat die Lizenzbedingungen abgelehnt.%0",
        "WIM\\IMAGE[*]\\WINDOWS\\VERSION\\SPBUILD",
        "iostream",
        "9\\9i9",
        "ee7e5ab1-1389-ac0a-7e8c-418b9732e4f3",
        " verze bin",
        "CDlpActionDU::ExecuteRoutine",
        "a74dc9b9-e3d6-91c0-cd52-d94d7136e4c7",
        "STATUS_INTEGER_OVERFLOW",
        "CheckDiskSpace: Not enough free disk space on system drive. Available: [%llu] MB",
        "f8c3940c-33b2-3a24-d617-180cf22a4ea0",
        "ReadChunk",
        "Microsoft.Windows.8.X18-87818_8wekyb3d8bbwe",
        "onecore\\base\\xml\\udom_modify.cpp",
        "Failed to query \"%ws\" variable. Status: %x",
        "0Y0`0",
        "Target OS: Detected Source DomainName = [%s]",
        "MoSetupPlatform: Queuing FOD %s for removal Failed   Error: [0x%X]",
        "ChunkWriterEnqueue",
        "=#=.=7=G=R=`=g=n=u=|=",
        "sd-Arab",
        "CheckHotPluggableDriveEx: Drive %c SetupDiGetDeviceInterfaceDetail-2 Error: 0x%X",
        "Il sistema non ha superato l'analisi della compatibilit",
        ";I;d;",
        "263e9fd2-d65e-3631-a0b8-dedb51d3faa5",
        "44PQX-NFXFH-XD9QY-38JVR-844DM",
        "VMHQW-YDN62-2RW7J-VDGY7-2R66P",
        "Og0M0~0[0",
        "DuplicateTokenEx",
        "3ce6b60a-05f7-c463-3d81-e127e1cf0668",
        "Microsoft.Windows.101.res-v3571_8wekyb3d8bbwe",
        "Spustiteln",
        " verze klienta agenta aktualizace.%0",
        "DataMigration: Queue Request for data migration - data only upgrade scope",
        "Microsoft.Windows.122.X21-83177_8wekyb3d8bbwe",
        ".?AVCDlpResponseAutomation@@",
        "PYHNX-QGQFG-GTCV8-CGDY9-GJGQF",
        "adavky na voln",
        "304C4r4y4",
        "Microsoft.Windows.164.res-v3792_8wekyb3d8bbwe",
        "km-KH",
        "Microsoft.Windows.101.X19-99536_8wekyb3d8bbwe",
        "Parallel chunk decode queue empty; switching to synchronous decode",
        "ulWhich < TheMap->Length",
        "CompareStringOrdinal",
        "9QKPB-NV4XR-H3JD7-F336F-BY48D",
        "The user has chosen to cancel for license agreement.%0",
        "Os problemas de compatibilidade n",
        "Microsoft.Windows.110.X18-94212_8wekyb3d8bbwe",
        "Microsoft.Windows.172.res-v3858_8wekyb3d8bbwe",
        ".CRT$XCA",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::Suspend",
        "b64bfd3a-f9ef-e457-3344-cbaa2683ab1c",
        "81927c7a-5d01-d2ce-0a31-456734837ffd",
        "10ea416b-3e31-778a-fe93-a4e15a50b1ff",
        "H0f0D0~0Y0",
        "=$>X>",
        "CXmlLogicalState::Initialize",
        "Microsoft.Windows.98.X20-39258_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::GetResultsRoutine",
        "ActionListLXPPaths",
        "SetFilePointer",
        "Impossibile trovare una lettera di unit",
        "RQ7PN-WDGCC-VTD2Y-FRC6B-FF8YT",
        "cf0d2263-8a80-5e26-7bfa-d37645429cb1",
        "ExecuteDownloadReq: Drive [%c] has enough free disk space",
        "vel apresentar o relat",
        "DiskPartition: Supported Drive letters [%s]",
        "SystemCpuDescription",
        "GetSupportedDriveLetters: Failed to CheckHotPluggableDriveEx on drive [%s]. Error: [0x%X]",
        "pienia.%0",
        "bucketArgument1",
        "<+<A<",
        "ProductKey: No digital marker key found. hr=[0x%x]",
        "MNCHX-GXHFC-22943-MRRRC-MP3JJ",
        "Microsoft.Windows.48.X19-98841_8wekyb3d8bbwe",
        "Microsoft.Windows.121.X19-99470_8wekyb3d8bbwe",
        "f765217d-4e3b-83d2-c8b1-f0529b6f385a",
        "2Q3_3",
        "r nedladdningen.%0",
        "Microsoft.Windows.161.X21-43624_8wekyb3d8bbwe",
        " se daj",
        "HK68K-T673F-CF768-KMHJT-MJ3WP",
        "Microsoft.Windows.7.res-v4298_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X19-99726_8wekyb3d8bbwe",
        "NewTearoff.Allocate()",
        "nlatot.%0",
        "Microsoft.Windows.8.X21-83694_8wekyb3d8bbwe",
        "RegQueryInfoKeyW",
        "Microsoft.Windows.184.X21-83657_8wekyb3d8bbwe",
        " stato interrotto a scopo di test.%0",
        "CBSWdsLog",
        "Microsoft.Windows.49.X19-98835_8wekyb3d8bbwe",
        "serversolutionem",
        "STATUS_TRANSACTION_NOT_ACTIVE",
        "NJ8QT-677VQ-9DBXG-8MHPH-3J46C",
        "Global\\WIMGAPI-LOGFILE-%c%08x'%08x",
        "HostOSBranchName",
        "ProductKey: Pid.txt file did not contain a product key.",
        "NDB7V-27VC9-XGHJP-3J668-TQ8JF",
        "Microsoft.Windows.100.X20-29647_8wekyb3d8bbwe",
        "99t$ t",
        "Microsoft.Windows.11.X17-37458_8wekyb3d8bbwe",
        "0a5bbf4e-09db-0f24-da1d-662fca381499",
        "904c18f6-22f0-21d1-c196-4119fdd173a4",
        "FW7NV-4T673-HF4VX-9X4MM-B4H4T",
        "Microsoft.Windows.4.X20-35509_8wekyb3d8bbwe",
        "7KXMW-8N7GT-TVJQX-F9KD6-HFR7Q",
        "NewChild->Comment.Allocate()",
        " Microsoft Corporation. Todos los derechos reservados.",
        "D$8PS",
        "tFhH+",
        "CDlpActionDU::SerializeRoutine",
        "SLGetLicensingStatusInformation",
        "5#5*5U5",
        "MoSetupPlatform: Resurrecting NewSystem object from [%s]",
        "8:8X8a8\"9H9O9^9q9",
        ".?AVCDlpActionImageDeployFactory@@",
        "CDlpActionDataMigrate::MigrateProductKey",
        "DiskSpaceReq: Migrating GDR packages from [%s] into Target OS...",
        "1m1y1",
        "NK2FB-XR23F-JJTTJ-62QWW-J8F7H",
        "RtlMatchLUtf8StringAgainstPointerList",
        "RtlCompareMemory",
        "CDlpActionCompat::ExecuteGatedScan: Exit",
        "Target OS: Remapping [%s] -> [%sCore]",
        "RegDeleteKeyW",
        "MicrodomImplementation::CMicrodom::FindObject",
        "DiskSpaceInstallReq: Initializing SSU paths              [%ld] [%s]",
        "3<4p4",
        "CDlpActionMediaCreationSuccess::InitializeRoutine",
        " jour d",
        " en raison d",
        "SetImpersonationCount",
        "PPPPRj",
        "=(>/>N?i?~?",
        "570bb52b-4907-f269-8819-7ae17484f3cb",
        "Systemet oppfyller ikke diskplasskravene for ",
        "u6VVhD",
        "250701214655Z0|1",
        "Nem folytathat",
        "Failed to open key for element %s. Status: %x",
        "%04d-%02d-%02d %02d:%02d:%02d",
        "CDlpActionActivationFactory::CreateInstanceRoutine",
        "YFF6N-MPKKJ-WXQ8H-2WWG7-RGDDV",
        "Microsoft.Windows.98.X20-00900_8wekyb3d8bbwe",
        "\\ArcName\\",
        "DiskSpaceInstallReq: Initializing LXP Count              [%ld]",
        "j\\h(U",
        "bs-Latn",
        "ussite n'a pas pu ",
        "067dba2a-26e2-679a-2b74-78ae52d7c1a0",
        "RaiseFailFastException",
        "2KMWQ-NRH27-DV92J-J9GGT-TJF9R",
        ".?AV?$CZeroInit@VCDlpOSInfo@@$00@@",
        "ydy. %0",
        "Komut dosyas",
        "Microsoft.Windows.48.X20-35533_8wekyb3d8bbwe",
        "7X7m7",
        "CheckDiskSpace: Drive [%c] is good for scratch space",
        "PKN2F-3MXJX-PB3WJ-X7Q9X-V22JB",
        "0aeaff95-f11d-56bf-7251-2f1f95c54301",
        "dku.%0",
        "w h8+",
        "Not-null check failed: Params->Source.pIStream",
        "GetWebSetupUserInput: HostOs Architecture=[%s].",
        "Microsoft.Windows.101.X19-99531_8wekyb3d8bbwe",
        "7+898l8z8",
        "Scripts",
        ".?AVCDlpActionRecovery@@",
        ":B:q:",
        "5&5V5",
        "STATUS_FILE_CORRUPT_ERROR",
        "4N4~4",
        "=[=b=w=",
        "YN47Q-6C9WV-2JH87-X7HCQ-H22JR",
        "::BUCL::Rtl::Add<SIZE_T>( *pcElements, 10, NewCapacity)",
        "Microsoft.Windows.49.X20-29599_8wekyb3d8bbwe",
        "5X537|7",
        "DUImage",
        "CDlpActionCompat::GetResultsDownloadReq",
        "ExecuteDownloadReq: Error reporting telemetry for bExtDriveUsed: [0x%X]",
        "fr-HT",
        "566_6~6",
        "DebuggerOptions: Enabling serial debugging -> [%d, %d]...",
        "Microsoft.Windows.49.X20-35545_8wekyb3d8bbwe",
        "040404B0",
        "c2f85eda-c79f-ccae-5420-2246ec2bc3d1",
        "35c6e5dd-867e-7a37-daf1-a8b5fd76a0fd",
        "e71da907-ec59-239f-ebbd-0372b00180d1",
        "Microsoft.Windows.48.X20-32152_8wekyb3d8bbwe",
        "Le serveur de progression d'installation n'est pas disponible.%0",
        "STATUS_RESOURCE_TYPE_NOT_FOUND",
        "6@6L6Z6y6",
        "Microsoft.Windows.162.X21-03402_8wekyb3d8bbwe",
        "=$>+>1>A>G>O>V>[>",
        "WATSON_DRIVER_INF",
        "JMCNR-7YBB8-4C7H3-8YGF9-66PKQ",
        "56e72537-f757-e94f-0e10-b188bd1495e2",
        "5[6b6u6",
        "FveDeleteAuthMethod",
        "SSWh@",
        "Microsoft.Windows.99.X19-99569_8wekyb3d8bbwe",
        "aYd(z_C",
        "DiskSpaceDownloadReq: Initializing ExtDrive space req:     [%ld]",
        "dc43701b-4fd6-77cc-5aba-35a5ae4f23e2",
        "#comment",
        "6MPNQ-BMVQQ-KK99H-J947Y-F9DM6",
        "<9<U<",
        "tt, hogy nem fogadja el a hirdet",
        "<K<Z<",
        "ise p",
        "9I9^9y9",
        "Microsoft.Windows.99.X19-99559_8wekyb3d8bbwe",
        "XYX6H-8NGPP-9DMC2-R3BM9-KQBMD",
        "CDlpActionCompat::ExecuteFinalizeReqScan: Exit",
        "Microsoft.Windows.4.X20-35515_8wekyb3d8bbwe",
        "NHCJT-BG7GG-J44P8-F3HX6-V6DGW",
        "Microsoft.Windows.145.X21-83693_8wekyb3d8bbwe",
        "FveRemoveTrustedWimData",
        "ReadData failed",
        "Richx",
        "GetTraceLoggerHandle",
        "Microsoft.Windows.4.X20-35513_8wekyb3d8bbwe",
        "951b4640-97a4-36db-7322-d3d29716aad2",
        "HQC!!",
        "version",
        "DGTNQ-XKH93-VVG23-QCM3W-YP382",
        ";7;>;",
        "CheckDiskSpace: Error reporting telemetry for OSPARTITION_FREESPACE: [0x%X]",
        "4i5u5",
        " SVW3",
        "Microsoft.Windows.175.X21-83765_8wekyb3d8bbwe",
        "Microsoft.Windows.48.X19-99505_8wekyb3d8bbwe",
        "o foi criado. Eventos n",
        ";E;_;",
        "228d8cea-af15-d1e6-065d-30e1537a6aaa",
        "MicrodomImplementation::CMicrodom::GetNamedNodeMapItem",
        "ServerDatacenter",
        "tzm-Arab-MA",
        "Sunucu yan",
        "7g7{7",
        "Microsoft.Windows.100.X20-30048_8wekyb3d8bbwe",
        "Washington1",
        "RtlDestroyHeap",
        "4QN62-H8C7F-JDW9V-YQ6V7-9BT4X",
        " z minimalnymi wymaganiami nie zosta",
        "bW0~0W0_0",
        "Microsoft.Windows.4.X19-98698_8wekyb3d8bbwe",
        "1&2c2",
        ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIProductKeyAction@@@@@@@@",
        ", lemezter",
        "RtlReallocateLUnicodeString",
        "Failed to load hive into key %ws from %s. Status: %x",
        "4#4c5n6",
        "RegLoadKeyW",
        "5f159708-28c6-c5f6-eec8-662fac29a969",
        "homepremium",
        "8(8C8h8",
        "BUCL::Rtl::Add<SIZE_T>(DataLength, OldLength, TempSize)",
        "9 9@9H9T9t9",
        "ProductKey: Initializing WIM Path:           [%s]",
        "3NGVC-W8MG2-THR8Q-YTDDH-G6PJD",
        "8(8,808H8X8\\8t8x8",
        "DP982-GN4MH-D8PCP-6RJBH-4C2HT",
        "Not-null check failed: String",
        "wcstoul",
        "fr-MC",
        "RtlpSmartLBlobWritingContextResizePolicy",
        "corecountryspecific",
        "CDlpActionDataMigrateFactory::CreateInstanceRoutine",
        "db2eaf60-a8db-9f1d-2cf1-b286ca551b80",
        "Microsoft.Windows.48.X19-98806_8wekyb3d8bbwe",
        "lt, vagy hib",
        "<=<Q<X<f<",
        "Microsoft.Windows.125.X21-83245_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X19-99596_8wekyb3d8bbwe",
        "Microsoft.Windows.138.X99-99999_8wekyb3d8bbwe",
        "GetHandleInformation",
        "t6h0\\",
        "c9f9c21f-fa99-7ca7-f4a7-3d33381efc66",
        "8I8T8",
        "DomainJoin",
        ";#<><Q<",
        "r den Download des Updates nicht erf",
        "PartnerID",
        "Microsoft.Windows.101.X20-35483_8wekyb3d8bbwe",
        "n de automatizaci",
        "cd2ff36a-bf5a-a2ff-5b29-56d38d6b75c1",
        "9\\$,t",
        "PoolHeader->Signature == ('pSdM')",
        "CDriverCallback::ValidateDriverPackage: Returning the proposed answer. {99C48B3D-E7C1-4EF1-9AC4-14E62176B70F}",
        "95834d35-b228-0ca0-6319-30edb0ab0e79",
        "Microsoft.Windows.99.X20-36695_8wekyb3d8bbwe",
        "f24032a6-e9e1-a10e-c183-ccdf7206a057",
        "GetProductKeyFromResponse: Defer product key prompt.",
        "The user has chosen to cancel because the system does not pass the requirements for desired migration choice.%0",
        "Microsoft.Windows.7.X18-78292_8wekyb3d8bbwe",
        "56554ae2-cdcb-08c2-d4d3-b9cc8bb64790",
        "Die Speicherplatzanforderungen zum Herunterladen der Nutzlast werden vom System nicht erf",
        "6c7'8",
        " by odpov",
        "ProductKey: Initializing Region:             [%s]",
        "570b0111-1c30-5440-4272-a93e3dfec0e0",
        "o em disco para instalar a carga.%0",
        ">-><>U>w?",
        "(system)",
        "89a2b749-5f4b-87a6-ba36-f459fdc199bc",
        "%hs: Failed opening Narrator registry key ; Error = 0x%x",
        "Microsoft.Windows.122.X21-04949_8wekyb3d8bbwe",
        "Compatibility: Leaving PerformResolveCommand",
        "nse.%0",
        "Finalize: Error retrieving compat instance: [0x%X]",
        "STATUS_ENTRYPOINT_NOT_FOUND",
        "t&QPj",
        "Microsoft.Windows.101.X20-29633_8wekyb3d8bbwe",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::SetResponseName",
        "DUImage: Downloaded %d critical updates.",
        "o foi interrompido para efeitos de teste.%0",
        "9ef3fe04-1835-8170-e40c-3931c86cded5",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "9J364-N6P64-CRFC4-D4C9T-FVWGJ",
        "GlobalFree",
        "424G4s4",
        ".idata$6",
        "404@4D4H4L4P4T4X4\\4`4d4h4p4",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::GetResponseId",
        "VXN7G-4G9P9-F6GKT-CF422-MP2KQ",
        "< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\\<`<d<h<l<p<t<x<|<",
        "A rendszer nem felel meg a friss",
        "2907b935-0ea5-dca1-85a7-75597491a18b",
        "PrepopulateList",
        "DiskSpaceDownloadReq: Initializing Perform Silent Cleanup: [%s]",
        "es de espa",
        "NtWriteFile",
        "9-:8:F:l:{:",
        "9%959h9o9",
        "Het systeem voldoet niet aan de minimum vereisten voor het herstellen van Windows.%0",
        "J9JGX-3VNQ7-QR86Y-GDPP9-YDWV8",
        "address not available",
        "?P?{?",
        "KFTH7-Q7N7H-PBG89-DVKPM-FGDD8",
        "D$0PS",
        "Microsoft.Windows.188.X21-99381_8wekyb3d8bbwe",
        "Microsoft.Windows.126.X21-83267_8wekyb3d8bbwe",
        "Microsoft.Windows.110.X18-94213_8wekyb3d8bbwe",
        "Microsoft.Windows.99.X20-39248_8wekyb3d8bbwe",
        "1#1<1G1",
        "Microsoft.Windows.101.X19-99554_8wekyb3d8bbwe",
        "unknown error",
        "< <,<8<D<P<\\<h<t<",
        "5235f3b2-99e8-f9df-0ca0-3bf5cd4c491c",
        "1570fcfb-fa04-fbb9-a8c2-e941536ea75a",
        "System operacyjny Microsoft",
        "64a54a82-4d0b-5c7f-360c-8c994c29ce05",
        "DataMigration: Initializing Post Upgrade Free Space:            [%X]",
        "teni.%0",
        "a. %0",
        "Business",
        "V2YWH-DFNBW-B8VGX-Y8M7M-BBFDY",
        "Microsoft.Windows.48.X20-32157_8wekyb3d8bbwe",
        "84NDK-M3JW4-PHYFH-CM7GR-6Q9TF",
        "ZwOpenDirectoryObject",
        "744TC-NFG8T-3YDJ7-884TX-P372F",
        "a nieokre",
        "RtlRaiseStatus",
        "4<4`4",
        "7&7-7X7",
        "Opera",
        "UuidCreate",
        "33WWX-XHN6G-CC88J-CFWJD-9D73F",
        "CDlpResponseAutomation::GetResultsRoutineDuOptin",
        "KNW3G-22YD2-7QKQJ-2RF2X-H6F8M",
        "2:3]3d3",
        "CDlpActionActivation::DeserializeRoutine",
        "M4Y2N-3G47M-HQ7GH-BHGPF-X2D98",
        "d0abebc5-9627-5a36-1dc6-f57c0c215650",
        "4 565",
        "151O1g1",
        "L$ jdXj",
        "Activation: Cancel was requested",
        "Kan ikke kj",
        "KHNKF-J6BBY-YK8BC-HMQ86-WXCHT",
        "HBRTJ-XDN4Q-FFV29-JH8GM-88BVJ",
        "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;",
        "Fant ikke den kj",
        "CoreConnectedCountrySpecific",
        "Microsoft Corporation",
        "PjdPjd",
        "SetupVersionCSDBuildNumber",
        "CDlpActionGetWebSetupUserInput::CheckForDiskSpaceRequirements",
        "7 7(70787@7H7P7X7`7h7p7x7",
        "9c3afcee-44eb-bcc1-bcab-e0ce3b345ff0",
        "Windows Herstelomgeving kan momenteel niet worden aangeboden.%0",
        ";!;/;T;r;",
        "DataMigration: Initializing EditionId:           [%s]",
        "QXVXT-N8VM3-VB8WD-3M9KP-76FB3",
        "XCKHW-NTX8X-JM9DB-FP6HC-FX8VT",
        "ActionListParser::ParseDocument",
        "7:8e8",
        "The system does not pass the disk space requirements to download and unpack multi-architecture media.%0",
        "MigXmlPath",
        "D7WMX-NMQXC-6VFVK-DFYFC-27JWR",
        "#0N0Z0e0",
        "Customer,",
        "dz-BT",
        "Revision",
        "STACK_OVERFLOW",
        "Failed to insert product: {0} with version {1} and type {2}",
        "Microsoft.Windows.79.X18-81292_8wekyb3d8bbwe",
        "::RtlIsUnicodeStringValid(Source)",
        "a7f5ddbb-2e60-5dd7-a695-68af98ca3eec",
        "Microsoft.Windows.7.X21-98315_8wekyb3d8bbwe",
        "Installationsprocessen er blevet stoppet af hensyn til test.%0",
        "Index of element to insert exceeds the number of elements.",
        "VVVh ",
        "?w$tQ",
        "9 9(989\\9d9l9t9|9",
        "tte, fordi der allerede er anmodet om en f",
        "ca9ecc88-860d-cd3d-fc49-c74ff0ca266a",
        "%d.%d.%d.%d",
        "HD3M6-MN2PH-WDHDQ-F4CJG-J2QGW",
        "Microsoft.Windows.101.X20-20964_8wekyb3d8bbwe",
        "ActionListParser::ParseActions",
        "9p\\t:",
        "SearchPathW",
        "?<?D?L?T?\\?d?l?t?|?",
        "Microsoft.Windows.4.X19-98717_8wekyb3d8bbwe",
        "TimeoutValueInMins",
        "L'image d'installation est introuvable.%0",
        "Installasjonsprosessen ble startet med et ugyldig kommandolinjeargument.%0",
        "o foi suspenso.%0",
        ".?AVIProductKeyAction@@",
        ";_<|<",
        "L$DPj",
        "222A2m2",
        "Microsoft.Windows.4.X19-98704_8wekyb3d8bbwe",
        "71b4a1d7-5887-0508-fdde-fae2a3994391",
        "7MTX9-PNH6X-7RMWG-MYXF4-TVKQD",
        " limit.%0",
        "Microsoft.Windows.49.X20-24588_8wekyb3d8bbwe",
        "ERROR_FAIL_REBOOT_INITIATED",
        "7NTYY-D9WFT-CFQ7M-TQ7BG-RRG3V",
        ":-;9;D;",
        "F4X8N-CQ8GX-MYG9C-J79M2-PGYK3",
        "Microsoft.Windows.101.X19-99530_8wekyb3d8bbwe",
        "WKF9N-MTH43-WD4FF-H9D64-7H66G",
        "MicrodomImplementation::CMicrodom::CreateInterface",
        "1:2N2",
        "Microsoft.Windows.162.X21-43645_8wekyb3d8bbwe",
        "d1824773-e3ab-9045-1d09-db670ccb395b",
        "Microsoft.Windows.165.res-v3795_8wekyb3d8bbwe",
        "aa4f114f-0c15-f283-9d9e-b46369506159",
        "System",
        "DNFFR-VMJRX-GQRV8-D76WX-HCFBR",
        "4\"4M4",
        "6'757h7v7",
        "A ID da vers",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::PrepareRoutine",
        "ppipro",
        "Microsoft.Windows.126.X21-83270_8wekyb3d8bbwe",
        "Microsoft.Windows.48.X20-29654_8wekyb3d8bbwe",
        "tre lanc",
        "m_pTargetObject->IsNamedNodeMapValid(NodeMap)",
        "TrySMode",
        "j\\Xf;",
        "$OEM$",
        "CDlpActionDiskPartition::ExecuteRoutine",
        "_errno",
        "ExportRepository",
        "J3DNW-3RDWM-8WHBX-YCX3X-RM49D",
        "?.?@?V?h?~?",
        "=)>J>`>m>z>",
        "4XGR7-PNCKM-XYHV8-CH4W2-GQ3JC",
        "WIMCommitImageChanges",
        "lemi sonland",
        "Microsoft.Windows.146.X21-83748_8wekyb3d8bbwe",
        "m Microsoft",
        "9L$0s!",
        "8&848[859<9H9^9",
        "DUImage: Initializing FOD Path:                  [%s]",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::Restart",
        "CERT_E_EXPIRED",
        "NDDBP-M3KRG-6HHBX-GFHRD-BHCHT",
        "k let",
        "8 9C9|:",
        ":L;-<|<4=",
        "7RQHC-MNTBD-2CK49-B4JCF-PPJYQ",
        "699ba6b3-5892-d515-1869-3523d85733bb",
        "CabFileName",
        "Microsoft.Windows.100.X20-29642_8wekyb3d8bbwe",
        "\\Program Files",
        "0b5a9a9f-4f98-96df-f3e0-59ad1e2fbfb8",
        "Microsoft.Windows.121.X19-99465_8wekyb3d8bbwe",
        "GatherOsState y",
        "HNM8K-CK43C-JR9D9-PTGV3-JTYK8",
        " harddisken ble ikke l",
        "97519e88-5133-455d-6855-61dd9aa17fc7",
        "EtwEventEnabled",
        " installere nyttelasten.%0",
        "TempNode != Windows::Microdom::Rtl::Node::InvalidValue()",
        "MoSetupPlatform: Current disk space required: [%I64u]",
        ">&?3?",
        "< <g<{<",
        "UpdateMedia: Initializing BoxDownloadPath:          [%s]",
        "L$,QP",
        "r genoms",
        "YG37V-VYNTJ-4CY9P-JVQQ9-7XQH3",
        " ydintoimet",
        " o tym powiadamiany.%0",
        "\\lL\\q",
        "Microsoft.Windows.100.X20-29641_8wekyb3d8bbwe",
        "Microsoft.Windows.100.X19-99459_8wekyb3d8bbwe",
        "RtlInitLUnicodeStringFromNullTerminatedString",
        "25a2a93a-19a7-1d71-7f70-3bfc7689887e",
        "Microsoft.Windows.48.X20-29561_8wekyb3d8bbwe",
        ">@?G?",
        "Microsoft.Windows.49.X19-98827_8wekyb3d8bbwe",
        "UD;UD",
        "Professional",
        "lemi test amac",
        "it zpr",
        "??1exception@@UAE@XZ",
        ";%<t<",
        "24bedba1-dd10-fd3b-601e-87cf025c1535",
        "9R63F-NGF82-938JB-J7DCQ-H22TC",
        " asennusohjelman ajantasaisempi versio",
        "=I=\\=c=s=",
        "Source.Length >= 3",
        "5#6-6W6a6",
        " in uso in un ambiente di test.%0",
        ">)?4?X?d?",
        "ba7864c4-bb4d-2e71-6f39-5c1861ad3473",
        "4$4,444<4D4P4p4x4",
        "sta.%0",
        "NFKHD-4MFXJ-V8DMX-V8XC2-DDDD4",
        "`V@Pj",
        "GC9GD-N2YRX-2FRPT-M7XWT-QYH3M",
        "Recovery: Image Product Name:    [%s]",
        "1b8f41f5-248e-5eb6-01e0-629899ecf5fe",
        " stata richiesta un'operazione di finalizzazione.%0",
        "my-MM",
        "GetTempPathW",
        "Configurar acciones de n",
        ";9<r<",
        "Le informazioni di automazione specificate non sono valide.%0",
        "N9DYC-JVYJC-6R76G-Q6RP7-9BV4P",
        "WideCharToMultiByte",
        ":(;/;X;_;",
        "ServicingStackUpdate",
        "7#717",
        ":N:a:",
        "41c7ca90-00b2-f904-7cda-86db3e08bdc6",
        "6.7J7|7",
        "3 3@3H3P3X3`3h3p3|3",
        "IsSecureBootBound",
        "adunku.%0",
        "Microsoft.Windows.8.X21-83690_8wekyb3d8bbwe",
        "ration, car l'analyse de compatibilit",
        "9r4uC",
        "GTN9W-7JQ3W-VPKVR-G3XMJ-6MT6T",
        "GC2HC-XWNXB-9QVTY-XV8C4-2KCHM",
        "93:?:J:",
        "Microsoft.Windows.125.X21-83248_8wekyb3d8bbwe",
        "Compatibility: Uncategorized Block found.",
        "60R0n0",
        "MoSetupPlatform: Requesting install of language packs from [%s]...",
        "HKYFJ-MN6FF-FPTBG-WWTCT-68YP3",
        "VY8RQ-KN26P-CQYVC-248YC-CKDBP",
        "el kontrolou kompatibility s omezen",
        "CMicrodomBuilder::DetermineStringTableSize",
        "jZYf;",
        ".?AVCAutomationManager@@",
        "D$$PR",
        "00000",
        "Microsoft.Windows.125.X20-35524_8wekyb3d8bbwe",
        " anular la instalaci",
        "PackageMigration: skipping LangPacks...",
        "KN8B8-8BG9P-XCXDJ-HWGFB-YWRBG",
        "Rilevata versione imprevista dei file binari della piattaforma di installazione. Verificare il contenuto del pacchetto.%0",
        "Microsoft.Windows.171.X21-24731_8wekyb3d8bbwe",
        "0A0X0h0o0",
        "o foi encontrada qualquer oferta que corresponda aos crit",
        "pToRemoveFrom != 0",
        "Microsoft.Windows.121.X21-04945_8wekyb3d8bbwe",
        "%s:(%d)",
        "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@",
        "Microsoft.Windows.8.X21-83710_8wekyb3d8bbwe",
        "Nie znaleziono ofert pasuj",
        "Microsoft.Windows.49.X19-99724_8wekyb3d8bbwe",
        "7b9b9348-c142-09be-2d7c-fba4dd44b833",
        "DUImage: Initializing Critical Path:             [%s]",
        "zh-CHS",
        "Installasjonsprosessen er stanset for testform",
        "Locale",
        ", sistem g",
        "A vers",
        "WKVNQ-M8TFY-72JB7-DGDP3-PYT4F",
        "f0266271-84be-bde7-ced7-003d485315ce",
        "tencent",
        "Denne installation kan ikke forts",
        "Microsoft.Windows.49.res-v3559_8wekyb3d8bbwe",
        "7,7J7",
        "666=6B6O6w6~6",
        "a88ab526-6550-210a-9b4f-9c94d63ace52",
        " jednotky. %0",
        "Hedef s",
        "2(2[2",
        "CompatDownloadRequirement",
        "A diagnosztikai objektum nem lett l",
        "f082a061-3834-0de6-d28f-f386995c01a5",
        "ration de nettoyage d'une pr",
        "The compatibility issues for download were not resolved within the required time limit.%0",
        "GetWebSetupUserInput: Execute: Download file hash X64 = [%s].",
        "mite de tiempo de espera.%0",
        "MigrateHostSettings",
        "NHF4B-PC2H9-B8F3T-JCGTC-9QB3B",
        "rnyezetet jelenleg nem lehet kiszolg",
        "danej opcji migracji.%0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::InitializeRoutine",
        "Microsoft.Windows.145.X21-83686_8wekyb3d8bbwe",
        "SetupCore: Registered ADVERTISE action",
        "YHMNQ-PPQW2-P8PGP-32643-C372T",
        "Microsoft.Windows.4.X19-99687_8wekyb3d8bbwe",
        "3,fTidTq ,>gEB;",
        " miatt a kompatibilit",
        "041904B0",
        "adb32380-40ec-40d8-b8da-bf6ca61a7cb2",
        "0b56ef24-79da-8c3a-a4c1-3062b08d7521",
        "L'analyse du p",
        " aktualizace.%0",
        "N6CD6-3QB8V-G3JM6-JDHRF-6Q72T",
        "directory not empty",
        "UpdateMedia: Error reporting telemetry for UpdateMediaNotSupported: [0x%X]",
        "373J3s3",
        "Microsoft.Windows.48.X19-99719_8wekyb3d8bbwe",
        "Range",
        "2K3i3",
        "o pode continuar porque a hash da inst",
        "rdi ikke blev fundet.%0",
        "lamad",
        "O utilizador optou por cancelar porque o sistema n",
        "PPPPPj",
        "Asennuksen levytilaongelmia ei ratkaistu aikarajaan menness",
        "4B4I4",
        "0.0g0n0|0",
        "sXhH/",
        "RtlAllocateHeap",
        "7097a850-51ba-985b-db6e-109bbcd6afae",
        "na neo",
        "NGKG3-4JWK4-JRHMT-BDB2P-KW4FJ",
        "Microsoft.Windows.48.X20-00860_8wekyb3d8bbwe",
        "9.;;;",
        "9GPBN-9CRWD-X4893-6WPC7-VT9RY",
        ">'>.>4>U>r>",
        "Microsoft.Windows.50.X17-54015_8wekyb3d8bbwe",
        "D$ Z;D$ r",
        "8#9w9",
        "45d955cf-6757-52d4-177f-d1500a3746b8",
        "tre desservi pour le moment.%0",
        "ivityst",
        "5*5F5b5",
        "DiskSpaceReq: skipping critical update packages...",
        "O utilizador recusou os termos de licenciamento.%0",
        "=5=<=B=d=k=q=",
        "Microsoft.Windows.98.X20-24583_8wekyb3d8bbwe",
        "Microsoft.Windows.180.X21-83666_8wekyb3d8bbwe",
        "do dentro do prazo necess",
        "MTPN6-JVPFW-H778D-PB8FY-DPG4K",
        "CDlpActionCompat::DeserializeSysReqScan",
        "F0C;X",
        "52b5ed11-8d5f-a972-cd30-5ef3693f1f04",
        " soubor nebyl nalezen.%0",
        "ProductKey: Product key did not successfully pass validation.",
        "F2Y9N-DW82B-BK2W3-49WJ4-4X9FH",
        "nt kommandoradsargument.%0",
        "Microsoft.Windows.49.X19-98822_8wekyb3d8bbwe",
        "f44158e5-5a68-ba93-b86c-c173bf0d1207",
        "Der blev ikke fundet et tilbud, der matcher de kr",
        "Failed to get object identifier. Status: %x",
        "Microsoft.Windows.7.X21-83744_8wekyb3d8bbwe",
        "Microsoft.Windows.162.X20-00859_8wekyb3d8bbwe",
        "En uventet versjon av bin",
        "o foi iniciado com um argumento de linha de comando desconhecido.%0",
        "755fc079-55b6-b32b-20a4-1bd92209cf0d",
        "1829436f-38dc-f9f8-a40d-68d02b960197",
        "526<6",
        "serverforsbsolutionsem",
        "9%9P9[9",
        "Microsoft.Windows.125.X21-83238_8wekyb3d8bbwe",
        "21292g2",
        "Microsoft.Windows.48.X20-17626_8wekyb3d8bbwe",
        "Systemet opfylder ikke kravene i enhedsscanningen til installation af opdateringen.%0",
        "545<5D5L5T5\\5d5l5x5",
        "CDlpActionCompat::ExecuteGatedScan: Enter",
        "InstallLanguage",
        "BUCL::Rtl::Add<SIZE_T>( sizeof(MICRODOM_HEADER), cbStringPoolSize, cbDomLayoutSize, cbPositionDataSize, cbDoctypeDataSize, cbRequiredSize)",
        "<8=d=",
        "RestoreMountStub: error creating destination file",
        "FveAuthElementFromRecoveryPasswordW",
        "MoSetupPlatform: Requesting install of dynamic updates from [%s]...",
        " vuoksi tulosarvo on liitett",
        "nimos para recuperar o Windows.%0",
        "ImageDeploy: Initializing Alt Storage Path:      [%s]",
        "515L5",
        "address_not_available",
        "c198a2c7-6e87-a03a-7fa9-9e85597ef074",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::CheckUninitialized",
        "Microsoft.Windows.48.X21-83176_8wekyb3d8bbwe",
        "hoz elind",
        "Temp = (PUCHAR)((*RtlAllocateStringRoutine)(Bytes))",
        "RN4QM-C93P4-7G7W9-2V8BK-7XMPT",
        "s4hpq",
        "fc05c171-fb47-6afb-dcb2-2090710a436e",
        "Windows::uDom::Rtl::RtlDestroyMicrodomUpdateContext",
        "GetWebSetupUserInput: Selected Offer:",
        "Microsoft.Windows.162.X20-00862_8wekyb3d8bbwe",
        "RtlInitUnicodeString",
        "Microsoft.Windows.99.X20-37914_8wekyb3d8bbwe",
        "061w1~1",
        "7:7D7q7{7",
        "1^1f1",
        ">->7>A>K>",
        "MoSetupPlatform: Disk provisioning info not found.",
        "q@boA",
        "ee6b595e-beb0-c788-2dd2-ab0c71007019",
        "[u0A;",
        "P8MNP-VBFY9-2PGQT-3FBV6-722JP",
        "Microsoft.Windows.80.X17-53881_8wekyb3d8bbwe",
        "MH7XR-N4T8K-2F6CQ-D4GMV-QPFBG",
        "Microsoft.Windows.121.X20-29613_8wekyb3d8bbwe",
        "rdas.%0",
        "5$5?5_5",
        "HKLM\\SYSTEM\\Setup\\MoSetup\\Volatile",
        "3%3:3L3R3o3y3",
        "4(4F4",
        "D$$PSSh",
        ".?AVIDlpActionFactory@@",
        "Microsoft.Windows.100.X20-39261_8wekyb3d8bbwe",
        "PX437-ND23X-QY7GV-G8FCV-8HV2B",
        "ria.%0",
        "ac6e7ff8-dc99-1e5f-3f23-5fb404fc5099",
        "El servidor de progreso de instalaci",
        "quz-BO",
        "Eula: Failed to report online store version to telemetry.",
        "MoSetupPlatform: ExecuteCurrentOperations reported failure!",
        "ProductKey: Entering execute.",
        "serversolution",
        "2a7b0629-c5bb-5ca6-4f6c-bab25485ae7b",
        "O servidor de progresso de instala",
        "3N66Q-GFMWG-98BD3-M36CW-9TQMX",
        "m limitu vy",
        "Panther\\GenuineTicket.xml",
        "STATUS_OBJECT_NAME_COLLISION",
        "u7WVh",
        "ProductKey: Returning Skulib values for results",
        "4b75bf19-808d-4e1f-33aa-239e63213a07",
        "CDriverCallback::ValidateDriverPackage: Failed. HRESULT = [0x%X]",
        "n no puede continuar debido a que ya se ha solicitado una operaci",
        "UpdateNotificationButton",
        "LCMapStringW",
        "Microsoft.Windows.48.X20-23595_8wekyb3d8bbwe",
        "serverweb",
        " s nezn",
        "Duplicate remove action item or out of memory. Keyform: {0}",
        "NewCData = this->AllocateStreamObject()",
        "F;t$ ",
        ">Q>X>_>t>~>",
        "DataMigration: Initializing ReportId:            [%s]",
        "Removal",
        ".?AVCSetupCore@@",
        ";H;l;",
        "Microsoft.Windows.101.X20-29675_8wekyb3d8bbwe",
        ";;<B<X<",
        "Target Image: SPVersion = [%d.%d]",
        "bf07cc2b-e0fd-b8ab-1558-9ffeecf80e99",
        "GetProductKeyFromResponse: Response product key not validated. Validating key...",
        "8#8]8d8k8",
        "CheckHotPluggableDriveEx: Drive %c SetupDiGetDeviceInterfaceProperty Error: 0x%X",
        "Microsoft.Windows.165.X21-06175_8wekyb3d8bbwe",
        "Er is geen aanbieding gevonden die overeenkomt met de vereiste criteria.%0",
        "VCJNR-MY9XK-BCQ63-VGWF6-QYH3D",
        "Den h",
        " nem t",
        "CDlpActionFinalize::CancelRoutine",
        "{;!*]]",
        "ProductKey: Product key was successfully validated.",
        "Not-null check failed: pfn1",
        "Asennusprosessi kaatui.%0",
        "ZwDeleteValueKey",
        "7JCG6-NF9GY-BQD93-GRJQH-94R9D",
        "CDlpActionCompat::NotifyInstallReqResultsChanged",
        "bad message",
        "t8QQj",
        "BUCL::Rtl::ConvertInteger(Bytes, NewLength)",
        "CDlpActionDiskSpaceReq::ExecuteInstallReq",
        ";!<j<",
        "InstallChannel",
        "DUImage: Invoking download on Payload Latent Acquisition",
        " sendo usado em um ambiente de teste.%0",
        "Microsoft.Windows.49.res-v3558_8wekyb3d8bbwe",
        "JN3PQ-GHR33-HKW3D-9XBV3-8MBMK",
        "`1Xn0_0",
        "5)656@6Y6",
        "Failed to duplicate string",
        "6H7i7x7",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::SerializeRoutine",
        "Microsoft.Windows.49.X20-35601_8wekyb3d8bbwe",
        "WindowsUpdateExit",
        "o podem ser relatados.%0",
        "K6NQ4-2RDX4-PPH2B-CWRK9-RM6QG",
        "Microsoft.Windows.7.X18-81316_8wekyb3d8bbwe",
        "8cc436d1-3f70-ded7-7dad-6e20317d7ffd",
        "Microsoft.Windows.189.X22-09603_8wekyb3d8bbwe",
        "NewTempBytesRequired > TempBytesRequired",
        "\\KernelObjects\\BcdSyncMutant",
        "Microsoft.Windows.4.X19-99710_8wekyb3d8bbwe",
        "DataMigration: Not requesting oobe.cmd file migration.",
        "RegGetValueW",
        "Proces instalace se pou",
        "6 6(60686H6l6t6|6",
        "DataMigration: Queue Request for InstallType: [%d]",
        "<$<0<<<H<T<`<l<x<",
        "SystemProcessorArchitecture",
        "Kurulum yap",
        "QJNXR-YD97Q-K7WH4-RYWQ8-6MT6Y",
        "Microsoft.Windows.7.res-v4294_8wekyb3d8bbwe",
        "090X0v0",
        "filename too long",
        "39da4430-af15-ec18-689b-ccdd537cf1b4",
        "j+Xf;",
        "Windows\\Branding\\BaseBrd",
        "5E5S5k5u5",
        "2=3h3~3",
        "789d2c7a-c0e7-e273-bb2e-e1f2af39ff60",
        "1\"2D2",
        "Microsoft.Windows.172.X21-24708_8wekyb3d8bbwe",
        "serversbsstandard",
        "Les fichiers de charge utile ",
        "ytkownik u",
        "3%3`3",
        "Se suspendi",
        "26c5f611-0e01-2448-cbe5-6e9a6d72c032",
        "b~0_0o04x",
        "k gereksinimler uyumluluk sorunlar",
        "sd-Arab-PK",
        "JY2G2-FN9RJ-D96C8-K8CBC-V8RTP",
        "De gebruiker heeft de opdrachtregel setup.exe gebruikt om alleen een scan uit te voeren, niet om het besturingssysteem te installeren.%0",
        "Falha ao executar o execut",
        "YNQYX-MFJ4H-D2KWX-96Q9V-WK8XF",
        "t(hxs",
        "MHN9Q-RD9PW-BFHDQ-9FTWQ-WQPF8",
        "4e27f381-9cf3-751b-98ec-a3fcf675cc36",
        "FirmwareModified",
        "b4672477-f13f-a733-df16-82449a8f8fb1",
        "35f89ca8-1c7e-8cdb-70c2-eab3d8d77fb5",
        "Current",
        "GetWebSetupUserInput: Error reporting telemetry for WebSetupInputUpgradeNow: [0x%X]",
        "Microsoft.Windows.48.X20-29657_8wekyb3d8bbwe",
        "Not-null check failed: Length",
        "Microsoft.Windows.48.X19-99497_8wekyb3d8bbwe",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionDataMigrateFactory,class CDlpActionDataMigrate>::SetActionId",
        "6928cef0-eb51-1ed0-cade-5298425c97e7",
        "ar-LY",
        "tIh(\"",
        "IsDriveLetterSupported: Drive [%c] is not supported",
        "eb75c530-5cc0-1a7c-397a-96db92282305",
        "CriticalDownloadPath",
        "Het installatieproces is vastgelopen.%0",
        "UpdateMedia: Initializing SystemLanguage:           [%s]",
        "9GNTV-CRPWR-6BDMW-WTHGH-T3BPC",
        "BCD%08d",
        "5#6f6m6",
        ".?AVCDlpActionDiskSpaceReqFactory@@",
        "WimStrDupe",
        "Microsoft.Windows.49.X20-21796_8wekyb3d8bbwe",
        "homebasice",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::GetResults",
        "Der Installationsprozess wurde w",
        "De gebruiker heeft ervoor gekozen om te annuleren omdat het apparaat onvoldoende schijfruimte heeft om te installeren.%0",
        "BrandingFormatString",
        "embeddedindustry",
        "3NKG2-H79C3-8W7KK-FFBQJ-33XC4",
        "H2FN2-F294C-GWT3W-JPDF7-HXMWW",
        ":w;~;",
        "WGF3G-P9N2H-WM8XV-FP3HV-JQPMR",
        "Het systeem voldoet niet aan de minimum vereisten voor de gewenste migratieoptie.%0",
        "AddCaptureNodeToImage",
        "Microsoft.Windows.126.res-v4252_8wekyb3d8bbwe",
        "o parou.%0",
        "Microsoft.Windows.101.res-v3258_8wekyb3d8bbwe",
        "ad49b8e0-f771-3654-a436-718d29a6c87d",
        "NtQueryValueKey",
        "Microsoft.Windows.122.res-v3285_8wekyb3d8bbwe",
        "DiskSpace: Creating new system (with ext drive [%s])",
        "5c3aedf5-484e-4f88-5e4a-8aa65e192e8e",
        "Fail to update WIM header",
        "8!838@8P8]8o8|8",
        ">(?V?i?s?",
        ":Y:o:';.;9;W;`;t;",
        "CompatSysRequirement",
        "Eula: Initializing AcceptEulaDefault:     [%s]",
        "STATUS_NO_MORE_ENTRIES",
        "Duplicate remove feature. Group: {0}, FMID: {1} , Feature: {2} or out of memory.",
        "161A1m1x1",
        "e2b77317-dd0b-5337-79bc-5fd159d133b7",
        "serversbspremium",
        "DiskSpaceReq: Starting Wait",
        "Microsoft.Windows.162.X20-00860_8wekyb3d8bbwe",
        "%s /p \"%s\"",
        "4f9af827-9fb4-1d01-b59f-9b3236b9e5b4",
        ";b;m;{;",
        "chargement.%0",
        "CRYPT_E_ASN1_CORRUPT",
        "FDNH6-VW9RW-BXPJ7-4XTYG-239TB",
        "DataMigration: Initializing Migrate Custom Scripts: [%s]",
        "__CxxFrameHandler3",
        "_wcsnicmp",
        "EnumeratePathEx: Unable to enumerate [%s]; GLE = 0x%x",
        ".?AVCDlpActionDataMigrateFactory@@",
        "uz-Latn-UZ",
        "Brugeren har valgt at annullere, fordi systemet ikke opfylder minimumskravene til download af opdateringen.%0",
        "SecureStartupDeviceEncryption",
        "Microsoft.Windows.48.X19-98810_8wekyb3d8bbwe",
        "onecore\\base\\lstring\\lunicode_string.cpp",
        "Q2NKV-98YCF-C6KMW-TKKTJ-2GYQJ",
        "Un script de d",
        "ERROR_SERVICE_DEPENDENCY_FAIL",
        "Microsoft.Windows.48.X20-29656_8wekyb3d8bbwe",
        "FveCloseVolume",
        "CompatInstallReq: Initializing Ignore Dismissible Blocks: [%s]",
        "WIM\\IMAGE[*]\\WINDOWS\\ARCH",
        "j\\XPS",
        "Microsoft.Windows.100.X19-99461_8wekyb3d8bbwe",
        "Microsoft.Windows.161.X21-43632_8wekyb3d8bbwe",
        "1(0&0",
        "Microsoft.Windows.161.X21-43623_8wekyb3d8bbwe",
        "1e8d121c-d254-c780-93a9-aceeab82318a",
        "FV469-WGNG4-YQP66-2B2HY-KD8YX",
        "7&838I8g8",
        "fb318d57-6f7f-d89a-c326-79a2953cdefd",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::CheckInitialized",
        "__tempErr",
        "N2434-X9D7W-8PF6X-8DV9T-8TYMD",
        "DiskSpaceReq: skipping LangPacks...",
        "DiskSpaceDownloadReq: Initializing Storage Reserve Used:   [%d]",
        "WINDOWS",
        "7 7R7]7",
        "kkelig diskplads til at downloade.%0",
        "G7KPD-PNC9B-C9C72-D7QXH-GCRFQ",
        "?$?+?W?^?t?{?",
        "CheckDiskSpace: Error reporting telemetry for DISKSPACE_DATAID_FU_RESERVE_CLAIMED_SPACE: [0x%X]",
        "Er is een onverwachte versie van de binaire bestanden van het Setup-platform aangetroffen. Controleer de inhoud van het pakket.%0",
        "?$?0?<?H?T?`?l?x?",
        ";T;[;",
        "Microsoft.Windows.98.X20-36689_8wekyb3d8bbwe",
        "<,<0<4<8<<<@<D<H<P<h<l<t<",
        "PHN2T-WHKP4-X8RTQ-TD9TT-D3YPC",
        "ltek.%0",
        "DiskSpaceInstallReq: Initializing Storage Reserve Used:         [%d]",
        "NW0~0[0",
        "31293910-59d5-f0db-8ebc-5809d3385b13",
        "r inte tillg",
        "BcdGetElementDataWithFlags: Failed to acquire BCD sync mutant. Status: %x",
        " halutun siirt",
        "SetupCore: Registered PKEY_GET_EDITION action",
        "CDlpActionMediaCreationSuccess::SerializeRoutine",
        "WIM\\IMAGE[*]\\WIMBOOT",
        "CDlpActionCompat::ExecutePollingScan",
        "La instalaci",
        "2NCBG-M2XX3-B4YMG-HVV6R-Q9MMY",
        "<(<:<c<j<",
        "11688e4b-5dab-2316-450b-daab3c44810b",
        "serverdatacenternano",
        "Het uitvoerbaar bestand voor de installatie is niet gevonden.%0",
        "0c7524aa-929b-7d3e-f796-0d607f70ce8d",
        ">9>K>r>",
        "<^<|<",
        "MigChoice: Initializing Wim Ref Count:         [%ld]",
        "Microsoft.Windows.7.X21-83746_8wekyb3d8bbwe",
        " lo spazio su disco del sistema ",
        "%w't%",
        "NONCONTINUABLE_EXCEPTION",
        "Microsoft.Windows.119.res-v3304_8wekyb3d8bbwe",
        "Microsoft.Windows.100.X19-99449_8wekyb3d8bbwe",
        "CoreSingleLanguage",
        "D$Pj@j",
        "aW0~0[0",
        "7&7-7B7I7X7_7",
        "CDlpActionCompat::InitializeGatedScan",
        "3PNGX-M88FX-8K4B3-2G86G-C9YHY",
        "31e2d15a-4d10-3d06-a583-3f9aaf5f0878",
        "DiskSpaceDownloadRequirement",
        "DequeueNextChunk",
        "=E=O=y=",
        "BNKG6-96G3C-4HWG8-468M3-GF4BG",
        "TempNodes.Allocate(this->m_LayoutCache.TotalObjectCount())",
        " on peruuttanut mainoksen.%0",
        "0a68df12-fdcc-8ca9-f719-5511928d494e",
        "UpdateMedia: Skipping UpdateMedia process due to user selection",
        "GetProductKeyFromResponse: Using default response.",
        "deb40d09-fd65-a268-b5d8-cde68e4da3f8",
        "CDlpActionDiskSpaceReq::GetResultsRoutine",
        "DYYRT-NY9VP-4CB2F-8VC7H-DRTKR",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::GetState",
        "2\"3A3",
        "0%1h1",
        "B8CMN-PRD7H-JKCWT-6VYBQ-4GDXF",
        "Q96PD-4NF2H-VJK87-43BWW-BWR8M",
        "7e7c7b37-26ab-0e2f-8959-9fc1b95a3115",
        "W3GNW-YXYVB-WCKXH-364FM-G3B87",
        "DUSetup",
        "A4;F<t?",
        "STATUS_BUFFER_TOO_SMALL",
        "ration, car le p",
        "connection aborted",
        "2A3L3Z3",
        "6R6u6",
        "RQDTH-PN3PK-96YF2-9H98C-XTPR8",
        "8V9NR-4XFTH-BFTY4-XKH7D-C39TQ",
        "Microsoft.Windows.49.X21-03400_8wekyb3d8bbwe",
        "UpdateMedia: Initializing TelemetryOptIn:           [%s]",
        "((HRESULT)0x8007000EL)",
        "_snprintf_s",
        "=6=?=f=o=",
        "EditionId",
        "e72d3416-09de-e635-750c-8342d97ab1cc",
        "CDlpActionProductKeyValidate::InitializePkeyGetEditionRoutine",
        "Starter",
        "K9H88-6NFR6-TFK6F-VY6PT-WXCJP",
        "diagerr.mdmp",
        "Microsoft.Windows.49.X20-29607_8wekyb3d8bbwe",
        " zobrazit z",
        "Microsoft.Windows.4.X20-00859_8wekyb3d8bbwe",
        "HNVPH-MXM9Y-JDG4P-WHC23-8K8XT",
        ":\":0:P:g:u:~:",
        "http://www.w3.org/2000/xmlns/",
        "204a6c62-f937-3ab4-1cac-4aeca1d45b9e",
        "GNJPJ-Q6Y46-6PDVF-FYKT8-PJ7M7",
        "4 5Q5",
        "UpdateProduct",
        "Microsoft.Windows.98.X19-98880_8wekyb3d8bbwe",
        "network down",
        "k01YWeW0~0W0_0",
        "0e1|1",
        "CDlpResponseAutomation::GetResultsRoutineSummary",
        "ivityksen asentamisen suojattua yhteensopivuustarkistusta.%0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::Pause",
        "CreateFileW",
        "t~j?Yf;",
        "Microsoft.Windows.125.X20-00860_8wekyb3d8bbwe",
        "Windows::StringUtil::Rtl::Impl::CalculateEncodingLengthForString",
        "Microsoft.Windows.100.X20-00903_8wekyb3d8bbwe",
        "The installation process crashed.%0",
        "4CDNC-P7DQY-8CM42-3K3Y7-G6RBD",
        ";s s%k",
        "Microsoft.Windows.21.X18-81299_8wekyb3d8bbwe",
        "Setup Core Actions",
        ".?AV?$CDlpAutoDelayLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@",
        "CDlpActionProductKeyValidate::SerializeRoutineValidate",
        "7b8e7603-9983-b0c2-e758-7512d0f0d321",
        "=8=i=",
        "Microsoft.Windows.22.X17-53886_8wekyb3d8bbwe",
        "399483cc-440e-4245-f944-8fa5d98357a9",
        "VCB9N-R7JFT-3FG3C-8WJQY-39QFM",
        "< =7=Y=",
        "ProductKey: Validating Product Key.",
        "6NJ93-4YVHJ-C884K-38X3F-DJ3D8",
        " avec un argument de ligne de commande non valide.%0",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionDiskPartitionFactory@@VCDlpActionDiskPartition@@@@",
        "8F8k8<9",
        "WIM\\IMAGE[*]\\WINDOWS\\EDITIONID",
        "ACCESSDENIED-fejl registreret i indledende faser af Installation ",
        "Installationsprocessen anv",
        "ImageExit: Unable to resurrect NewSystem object. hr=0x%x",
        "STATUS_SHARING_VIOLATION",
        ":/;d;",
        "NewAttribute = this->AllocateStreamObject()",
        "r die Installation des Updates nicht bestanden, und der Benutzer sollte nicht benachrichtigt werden.%0",
        " necess",
        "5(626|6",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::Resume",
        "d60592c8-01df-1550-f39d-3b49df079a1a",
        "Microsoft.Windows.50.X21-83772_8wekyb3d8bbwe",
        "lemi beklenmedik ",
        "MNWM3-Y2HKW-H22TJ-D8VG8-JFG6Y",
        "Windows Genoprettelsesmilj",
        "f9BPu",
        ":);3;G;N;\\;",
        "0j0D0_0",
        "924202f1-0049-0354-4b0a-3ea2ee0d5145",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::CheckUserInterrupt",
        "TNJ4M-XQVBB-6DKCF-74FDG-P7JW6",
        "HDKJD-QGNVJ-YGWJ4-TT3WJ-D9MQD",
        "The user has chosen to cancel as the device does not have enough disk space to install.%0",
        "I file di payload erano danneggiati.%0",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "CriticalPath",
        "IMPLIED",
        "pHeader->ulOffsetToPositionData < pHeader->ulTotalSize",
        "tn8^\\t",
        ".?AVlength_error@std@@",
        "RtlReAllocateHeap",
        "Microsoft.Windows.4.X19-99688_8wekyb3d8bbwe",
        "tIWPd",
        "PRO_K",
        "Microsoft.Windows.8.res-v4309_8wekyb3d8bbwe",
        "=<=S=m=",
        "cleanInstall",
        "XFH34-N8YPQ-MQKMB-KTJX8-F3KTT",
        " minim",
        "Es stehen keine Pakete zum Herunterladen bereit.%0",
        "n de limpieza de un intento de instalaci",
        "fbbc8f26-c337-e366-cd9a-7ece39db5eaf",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionSummaryFactory@@VCDlpActionSummary@@@@",
        "lt bejelenteni az esem",
        "<$<,<4<<<D<L<X<x<",
        "Microsoft.Windows.49.res-v3321_8wekyb3d8bbwe",
        "Microsoft.Windows.122.X21-03400_8wekyb3d8bbwe",
        "ytynyt asennuksen n",
        "8088b7cf-f3b6-f16f-fa59-5b6359e46556",
        "3,30343L3\\3`3p3",
        "Reset restore hardlinks error because of file redirection.",
        ", aby zachowa",
        "o foi terminado.%0",
        "PG;y0r",
        "Microsoft.Windows.4.X19-98721_8wekyb3d8bbwe",
        "D8F4Y-FNBKB-973FK-WC93Q-WQMKV",
        "2884fc55-9cf3-5fb7-f8e3-ba3e22484e64",
        "Microsoft.Windows.100.X20-36692_8wekyb3d8bbwe",
        "Microsoft.Windows.48.X19-99487_8wekyb3d8bbwe",
        "Microsoft.Windows.125.X20-00861_8wekyb3d8bbwe",
        "9K9p9",
        "62RVV-QH82X-9YDXN-YRV7M-JK9JT",
        "=\">F>",
        "J4WNC-H9BG3-6XRX4-3XD8K-Y7XRX",
        "rlet lehets",
        "Microsoft.Windows.125.X21-83252_8wekyb3d8bbwe",
        ":\":::a:m:",
        "83058434-a2a9-3575-dfcf-9ae8810b7a11",
        "CheckExcludeMetadata",
        "Microsoft.Windows.8.X21-83701_8wekyb3d8bbwe",
        "Konfigurationsfilen til installationen er tom. %0",
        "faillance n",
        "TheDocument.Reserved == m_pTargetObject->m_LayoutCache.DocumentId()",
        "%EDU%",
        " el anuncio en el plazo requerido.%0",
        "bec53ec8-d138-88d9-120b-cf47309b016c",
        "<$<,<4<<<H<l<t<|<",
        "MoSetupPlatform: Disk provisioning is needed!  Executing...",
        "TL0B0",
        "f0ead30a-2456-89d3-8334-958933569bb7",
        "7N9G2-J9WYB-V4D9W-V4H6P-HH8V3",
        "Microsoft.Windows.8.X21-83703_8wekyb3d8bbwe",
        "656B6L6",
        "35e3a1e8-2a2e-6668-c24c-538aeb7e8f49",
        "58a23899-6261-7c42-fa60-bae12185f76c",
        "Microsoft.Windows.99.X19-99561_8wekyb3d8bbwe",
        "MoSetupPlatform: Enable diagnosis mode",
        "Proces instalace se nedokon",
        "O utilizador n",
        "Microsoft.Windows.145.X21-83694_8wekyb3d8bbwe",
        "< <$<<<L<P<T<X<\\<`<t<x<",
        "Wykonywanie skryptu przed instalacj",
        "7.9D9,:3:",
        "sr-Latn-ME",
        "Disable",
        "Compatibility: Resolve(WICA_UNINSTALL_ALL_RESOLVE_STRING) returned: [0x%X]",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::Restart",
        "c69046c0-2936-08c3-d064-a529f539a077",
        "CheckDiskSpace: Failed to get free disk space on [%c] drive. Error: [0x%x]",
        "N7VJK-VHCXC-9CDCH-7YKHR-YTDD9",
        "4'474D4V4c4u4",
        "RHDN4-9MKR3-G7WQM-9WKTY-RC28W",
        "ActionListParser::ParsePayload",
        "th-TH",
        "DataMigration: Initializing Mig License State:                  [%d]",
        "dek programu setup.exe jenom ke kontrole, ne k instalaci opera",
        "telep",
        "Informational,",
        "DiskSpaceInstallReq: Initializing LangPack paths         [%ld] [%s]",
        "czony w ramach wymaganego limitu czasu.%0",
        " harfi bulunamad",
        "GetDeviceNumberFromPath: Drive %s CDeviceIoControl returned Error: 0x%X",
        "Q0$1p1",
        "HRESULT_FROM_WIN32(",
        "ForceDefault",
        ".CRT$XCZ",
        "CDlpActionRecovery::GetResultsRoutine",
        "TQWQJ-9NWJ4-46XRG-MQJX9-C7KRP",
        "_FC;]",
        "Failed to open element %ws key for delete. Status: %x",
        "CRNFH-JP4RJ-6MTJ4-C4XR9-WTY6M",
        "GetWebSetupUserInput: Checking available disk space for drive=[%c].",
        "Microsoft.Windows.101.X20-29669_8wekyb3d8bbwe",
        "embeddedindustryae",
        "3\"3T3Y3",
        "WPT3X-RDN87-MBFRP-7DGPG-QYJGM",
        "SetupCore: Registered COMPAT_DOWNLOADREQ action",
        "rd kr",
        "Microsoft.Windows.172.X21-24707_8wekyb3d8bbwe",
        "be-BY",
        "Het systeem voldoet niet aan de schijfruimtevereisten voor het downloaden en uitpakken van media.%0",
        "Bir hata olu",
        "Spust",
        "X297P-NVC2F-6P7K9-Y2G2Y-VQXFW",
        "2,3W3X6r6",
        "M7FP8-NKP48-B29K3-4YYWJ-XWW22",
        "Fant ingen tilbud som samsvarer med de obligatoriske kriteriene.%0",
        "036f4f22-b719-c52a-db4d-cd88dc643c2b",
        "InitializeRoutine: MOSETUP_ACTION_IMAGE_EXIT",
        "CFFNG-VMMJQ-VMKKQ-24RPX-TF62B",
        "Microsoft.Windows.48.res-v3307_8wekyb3d8bbwe",
        "3DCBV-3N6KK-7YWF4-V9YQ4-QGQ83",
        "Microsoft.Windows.189.X22-09701_8wekyb3d8bbwe",
        "Microsoft.Windows.146.X21-83739_8wekyb3d8bbwe",
        "ti-ET",
        "?A?z?",
        "Microsoft.Windows.50.X17-54013_8wekyb3d8bbwe",
        "33d0387f-389e-2ef1-9c9f-c32e24746151",
        "ExecuteInstallReq: Using auto selected drive letter [%c].",
        "9D:_:v:N;f;><^<e<",
        "mmer.%0",
        "??0exception@@QAE@XZ",
        "Microsoft.Windows.4.X19-98716_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X21-83177_8wekyb3d8bbwe",
        "0bd0cfa9-f5cd-111a-2174-fb99a3d55d01",
        ">0>8>D>d>p>",
        "Microsoft.Windows.27.X19-98755_8wekyb3d8bbwe",
        "bbe4816c-24bb-3f3f-3e14-fab305f41ac7",
        "Microsoft.Windows.27.X19-98763_8wekyb3d8bbwe",
        "c7993efe-9203-d80d-b5af-f505daf6513e",
        "Installationsprocessen gik ned.%0",
        "7+7T7^7",
        ">0>M>t>",
        "CDriverCallback::ValidateDriverPackage: Package is not signed but has signed binaries. Returning DRV_ANSWER_INSTALLDEFAULT. {7EFC331C-A8DD-4DDA-8601-005B2520F06A}",
        "3ab69ab2-5ba7-dd27-2bf9-079fa4a659a9",
        "No se pudo ejecutar un script de instalaci",
        "4$4N4X4",
        "CacheDisable",
        "6%7;7H7W7",
        "GetSupportedDriveLetters: Excluding Drive [%s] because we cannot get free space. Error: [0x%x]",
        "HNGVG-HGJFG-6BKFM-MDW7K-RM6F8",
        ".text$yd",
        "CKWNM-DJK49-QYCWT-VP2R2-4RG36",
        "WriteData failed",
        "uU9G0t",
        "TelemetryAssertList",
        "PPj PPPSP",
        "ae3f1be1-82fa-8b02-d345-d13dd84e5a24",
        "Installationen kan inte forts",
        ".CRT$XIAA",
        "Enumerate",
        "E$j$Z",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::CheckUserInterrupt",
        "not_a_socket",
        ".?AV?$CZeroInit@VCDlpActionImageDeployFactory@@$00@@",
        "PPWGW-8NW9C-J77Q9-8WHB9-QV64W",
        "JCJ4B-NYGDQ-Y9MHG-XRYT7-2R6FK",
        "lmeghajt",
        "MoSetupPlatform: SuspendAndReleasing Setup Platform object...",
        ".?AVCDlpActionFinalizeFactory@@",
        "DeletePath: Cannot delete <null>.",
        "servermediumbusinessmessaging",
        "CDlpActionDiskSpaceReq::ReportAdditionalTelemetryData",
        "DataMigration: Migrating WebSetup image location [%s].",
        "YNCKW-C4B3Y-Q4BWG-37MTX-P38J3",
        "Advertise",
        "lidas.%0",
        "0M1V1d1",
        ";\";@;G;d;k;};",
        "830040fa-8411-853d-0319-fd01511a7fd2",
        "WdsRemoveDirectory: Unable to remove directory [%s]; GLE = 0x%x",
        ".?AV?$CZeroInit@VCDlpActionAdvertiseFactory@@$00@@",
        "Microsoft.Windows.48.X19-98802_8wekyb3d8bbwe",
        "09a5f165-b6d6-4159-5e7f-fdf5a3ad488e",
        "NG4WR-HY8H2-MYPYY-RF36P-MP2JH",
        "Der Benutzer hat sich entschieden, Ank",
        "j\\Zf;Ty",
        "Finalize: Reporting total downlevel time: [%d seconds]",
        "4cb0ac6f-e72a-ff1f-4f49-0d72ab774e9d",
        "d0785d09-011f-43af-dc53-ded5642a3385",
        "o falhou.%0",
        "ActionListLangPackPaths",
        "CMicrodomBuilder::AddString",
        "CheckDiskSpace: Error getting FU reserve claimed space: [0x%X]",
        "The Flight ID is empty.%0",
        "Channel1394",
        ":&;S;",
        "Microsoft.Windows.122.X20-35507_8wekyb3d8bbwe",
        "ProductKey: Looking for product key in SKULIB.",
        "CDlpActionUpdateMediaFactory::CreateInstanceRoutine",
        "r att installera operativsystemet.%0",
        ".?AV?$CZeroInit@VCDlpActionDebuggerOptions@@$00@@",
        "Microsoft.Windows.146.res-v4298_8wekyb3d8bbwe",
        "8@9a9p9}9",
        "GKDTR-NDC27-Y64GV-J42D6-2373M",
        "Microsoft.Windows.4.X19-99692_8wekyb3d8bbwe",
        "VPMWD-PVNRR-79WJ9-VVJQC-3YH2G",
        "ExecuteInstallReq: DiskSpaceReq polling starts...",
        "Il sistema non soddisfa i requisiti minimi per il ripristino di Windows.%0",
        "n de finalizaci",
        "08cfc710-a63a-a82b-2911-f2571b039d0a",
        "PerformSilentCleanup",
        "<*=4=a=k=",
        "ApplyReparseFixup",
        ":&:Q:X:",
        "9H9S9",
        "0484031c-2983-c6dc-093f-f76ec24424b1",
        "ReleaseSemaphore",
        "ProductKey: Populating Image info set.",
        "GYFHM-NDGDD-YFTWR-XPPT6-8TXB7",
        "b9f89f1c-4790-7489-7196-bf9428224a50",
        "Finalize: updated the Enterprise attribution flag to %d",
        "ActionListParser::ParseOfferPackage",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::UpdateState",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::GetState",
        "e74e28f4-c1b9-12cb-7b1c-61e5dedff37e",
        "Microsoft.Windows.129.X21-83262_8wekyb3d8bbwe",
        "6ND8M-JX7KK-K29VW-H6D88-Q69Q2",
        "DUSetup: Could not get DoNotConnectToWindowsUpdateInternetLocations value. [0x%X]",
        "EnterpriseNEval",
        "it licen",
        "4g5m5s5",
        "LanguageCode",
        "n para este sistema.%0",
        ".?AV?$CZeroInit@VCMoSetupDUDownload@@$00@@",
        "8Z8 :y::;x;",
        "ii-CN",
        "43HVN-Y6V6C-WC73G-RHMPF-PPQXD",
        "An error has occured and the result value must be consolidated for telemetry purposes.%0",
        "<f=q=x=",
        "System nie spe",
        "5'5Z5",
        "2NCTC-KX62G-72P7B-G7QYW-29YT9",
        "0121eb7a-611a-59b4-0d5c-96e32def8f35",
        "NFD8K-TDM7C-7CVTC-8JKP6-3V64Q",
        "29400235-f0e7-f989-c0d7-cb9c0ed8f443",
        ">(>O>v>",
        "NPWBB-M6DWX-JGQWH-RRX2W-GVKFM",
        "QQSVWj",
        "ro-RO",
        "0<0Y0",
        "CDlpActionDataMigrate::PauseRoutine",
        "K3RTH-NHMX6-T4KK4-WQWXY-XBVCP",
        "bie instalacji nadal oczekuje na wykonanie. Wymagane jest ponowne uruchomienie systemu.%0",
        "JMN29-GCVF9-D7C92-M3YD7-T3BPC",
        ";a<t<",
        "ed instalac",
        "FLT_DIVIDE_BY_ZERO",
        "RtlCreateAcl",
        "CDlpActionDiskSpaceReq::RescanAsync",
        "ecde50c8-230c-f210-901a-bf9254f2445c",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::PrepareRoutine",
        "NM762-99XWX-K47DD-H3668-XW442",
        "NW7J8-Y88HJ-GCP33-8X623-YBH3G",
        "si platform bin",
        "42abc688-9620-cd31-dbc5-61416b157562",
        "Specifying User MigXml file: [%s]",
        "39JVP-BN72R-V7YQK-3PD2C-VFR7T",
        "st inden for den p",
        "FV4NT-QMCWC-DFXT2-83GKB-QJWKP",
        "Microsoft.Windows.7.X21-83398_8wekyb3d8bbwe",
        "5dda4bd0-2934-eb2c-9a07-07e74ebf26ae",
        "97bf0314-744c-318e-950d-6f667b31cd4f",
        "t Phx",
        ":,:4:9:E:S:t:",
        "K8QVR-GMN3V-HJ3CR-22CW2-GQ7X6",
        "XP6DX-NRFYJ-HK736-Q2FQD-KKX9B",
        "YNV7D-VDW9Q-FJDFR-WF94G-H8T4H",
        "SkuKeyWithoutLicense",
        "Microsoft Corporation1&0$",
        "9 9$9(9,9094989<9@9D9H9T9",
        "cb32c469-a712-b0ad-d7b2-8d199b288554",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::ExecuteResponse",
        "Microsoft.Windows.8.X18-81313_8wekyb3d8bbwe",
        "BiExportBcdObjects failed %x",
        "Systemet opfylder ikke minimumskravene til installation af opdateringen.%0",
        "ResetEvent",
        "f6644f98-23f9-ec6c-3490-e161617241ee",
        " J9\\$$u",
        "serverdatacentervcore",
        "qps-ploc",
        "7 72797K7R7",
        "MN2TG-DRF79-MY969-498RR-W8HYF",
        "1(1G1i1",
        "5%6\\6",
        "bad allocation",
        "Failed comparing: {0} and {1}",
        "nceki bir y",
        "Le processus d'installation est utilis",
        "ReleaseSRWLockExclusive",
        "NX92Y-XF98H-83XKV-4X22Y-88HYK",
        "Software\\Microsoft\\Windows NT\\CurrentVersion",
        "WildCard",
        "5de08b65-8793-71b2-430d-9348511ccade",
        "The user has chosen to cancel because the system does not pass the minimum requirements to download the update.%0",
        "7N9T3-P3MKD-BY23G-V7DRJ-RX9C4",
        "WWWWVP",
        "Microsoft.Windows.101.X20-20962_8wekyb3d8bbwe",
        "GBBXB-8DNVD-2X4G6-T863T-9KRWD",
        "x`h(%",
        "bs-Latn-BA",
        "MoSetupPlatform: SetupAutomation object created!",
        "SetupCore: Registered DU_IMAGE action",
        "Microsoft.Windows.101.X19-99649_8wekyb3d8bbwe",
        " avviata una versione pi",
        "6(727L7|7",
        " litery dysku docelowego. %0",
        "9)9o9",
        "Microsoft.Windows.171.X21-24734_8wekyb3d8bbwe",
        "97WTN-WY7D4-G8V3T-CHKPW-2GYP4",
        ">'?8?E?w?",
        "ProductKey: Matching Install Wim: Found [%d] matching images.",
        "CDlpActionActivation::SerializeRoutine",
        "060y0",
        "R33WN-HYW7C-96YWC-G8YQG-P7KXW",
        "34383P3`3d3h3l3",
        "STATUS_SXS_MANIFEST_PARSE_ERROR",
        "Zu.A;",
        "GetWebSetupUserInput: Execute: Download Url X64 = [%s].",
        "N8DYR-QG3CT-KKJYV-4R7VT-68442",
        "CDlpResponseAutomation::InitializeRoutine",
        "04eb1a52-f0ec-4e11-579c-0f99b30e8d8c",
        "::RtlIsLUtf8StringValid(Candidates[i])",
        "RtlImpersonateSelf",
        "88be78c2-9430-07c8-1a20-7b0332826f2b",
        "Microsoft.Windows.7.X18-81318_8wekyb3d8bbwe",
        "nimos para a op",
        "CMicrodomBuilder::CNamespaceNamePrefixToAttDef::Insert",
        "Microsoft.Windows.165.X21-22363_8wekyb3d8bbwe",
        "EqualSid",
        "SetupCore: Registered DISKSPACE_INSTALLREQ action",
        "CDlpActionCompat::MigLogMessage",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::Execute",
        "hrbare Datei ",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::Serialize",
        "ACCESSDENIED-fout opgetreden in de initi",
        "Asennusprosessi lopetettiin toimia edellytt",
        "268a0537-266f-da71-d667-71496551865e",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::GetProgress",
        "CDlpActionDiskPartition::ValidateBitLockerKey",
        "3TQMN-7HFW3-F3DHR-Y9DFM-WHWHY",
        "a47dcccc-c2f4-6552-3e50-b48aa217ea26",
        "FACILITY_FVE_ERROR_CODE",
        "Het uitvoerbare bestand van GatherOsState is niet uitgevoerd.%0",
        "tirmeyi indirmek i",
        " pendente. Uma reinicializa",
        "%s(%d): Result = 0x%X",
        "SQWhp",
        "DCATDownloadSuccess",
        "SetupCore: Registered ACTIVATION action",
        "KQ6BB-N4K6V-QWDT3-FRGGM-43MPC",
        "BiBindEfiEntries failed %x",
        "Kurulumu s",
        "ImageDeploy: Cleaning installation drive...",
        "CDlpActionEula::SerializeRoutine",
        "RestoreFileMetadata: RestoreFileStorageTierClass failed",
        "@@@@@@",
        "2&2F2L2k2t2",
        " contr",
        "3$4z4",
        "STATUS_DUPLICATE_OBJECTID",
        "FIXED",
        "Microsoft.Windows.4.X19-99681_8wekyb3d8bbwe",
        "NewBuffer = (*RtlAllocateStringRoutine)(Bytes)",
        "CreateThreadpoolTimer",
        "+RjjQ3",
        "92d1930d-7e28-dd92-c8d0-c0b5cfff55db",
        "KTRKN-8RCFX-3T47M-VGDT8-JFHCK",
        "rene.%0",
        "p!c5Mf",
        "787X7x7",
        "R6BTJ-8GNTW-D2M9P-9FD7H-3J3DV",
        "FACILITY_RPC_RUNTIME",
        "RTKX8-KN2HT-MKRKG-3BK3X-RM47T",
        "Microsoft.Windows.121.X19-98680_8wekyb3d8bbwe",
        "ZwSetBootEntryOrder",
        "ProductKey: Default Product Key is not allowed.",
        "IsNarratorAutoLaunchSettingsOn",
        "727L7^7",
        "es-US",
        "VN3YP-Y4PXW-WXM8K-YT9CD-C384H",
        "977WD-QNC9M-4T6R7-B8D2R-4X9F3",
        "fe411b51-cecb-8a45-7e29-3b1144572e70",
        "Installationsprocessen kraschade.%0",
        "PerformSilentCleanup: Calling TriggerStorageCleanup.",
        "bbe5dee2-be04-c51f-5ebd-d9e234f6ee21",
        "Finner ikke m",
        "Microsoft.Windows.101.X20-39246_8wekyb3d8bbwe",
        "5ae475ce-4c43-9aa5-332f-7b02b284bbf9",
        "CERT_E_ISSUERCHAINING",
        "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\ReserveManager",
        "6Q7s7",
        ">D>\\>v>",
        "Microsoft.Windows.98.X19-99601_8wekyb3d8bbwe",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionDebuggerOptionsFactory,class CDlpActionDebuggerOptions>::SetActionId",
        "3TNB2-FBW3G-2M6TH-8RCRV-MBKV4",
        "Der Benutzer hat den Vorgang abgebrochen, da das Ger",
        "A 3F ",
        "Microsoft.Windows.8.X18-81314_8wekyb3d8bbwe",
        "Microsoft.Windows.101.X19-99555_8wekyb3d8bbwe",
        "DUSetup: OsArchitecture: [%s]",
        "XFJNR-BJP8F-CXTDY-CKXVB-XBT3T",
        "RtlAcquireResourceExclusive",
        "veletet, mert az eszk",
        "rw-RW",
        "t/hx3",
        "o ser",
        "BusinessN",
        "324b4fb7-7224-1094-c79d-c3606dec13fe",
        "Microsoft.Windows.101.res-v3422_8wekyb3d8bbwe",
        "STATUS_SMI_PRIMITIVE_INSTALLER_FAILED",
        "ProductKey: Restored default product key [%s], based on Edition: [%s] and Channel: [%s].",
        ";><j<",
        "TD97K-V6NPB-W8432-XRYKX-V222Y",
        "x0h(%",
        "ivatel by m",
        "137ce7b3-0566-614c-97fc-e07dc4e2baa0",
        "WIM\\IMAGE[*]\\WINDOWS\\INSTALLATIONTYPE",
        "22c596f6-f250-2e29-8249-ae12439c3f88",
        "Eula: Initializing Eula File Path:        [%s]",
        "c'`n0OUL",
        "Microsoft.Windows.126.X21-83277_8wekyb3d8bbwe",
        "60c5af46-fbff-6c0e-e622-769503f837d1",
        "XK7N6-RKB6X-MM7WD-XMXCB-DPG2G",
        "x8!D$",
        "*.cab",
        "Microsoft.Windows.101.X20-35481_8wekyb3d8bbwe",
        "9f8ee8e8-20ed-55d6-dc4b-a2ab92d73750",
        "N7CXQ-RW8G8-QT9RC-9BBRH-YY49M",
        "Nenhuma oferta encontrada correspondente aos crit",
        "Der Installationsprozess ist abgest",
        "ImageExit: Initializing Extended:    [0x%x]",
        "=I=i=",
        ">'>s>",
        "rt verzi",
        ".?AVIFCDiagnosticsLite@@",
        "7F7P7",
        "SetupBuildDate",
        "T3M8N-WBQ3R-G8WP7-MMCHR-844BG",
        "uN9{ uI9{(uD9",
        "GetSystemPowerStatus",
        "GetWebSetupUserInput: Execute: Target Usb Drive=[%c].",
        "Microsoft.Windows.171.X21-24732_8wekyb3d8bbwe",
        "ec5b95fd-0baf-333b-258a-06cc635e2624",
        " ani zniszczy",
        "E_POINTER",
        "Microsoft.Windows.99.X20-39251_8wekyb3d8bbwe",
        "BRNJ2-P6JVD-QK6RK-CV77Q-XHJVF",
        "owner dead",
        "67b26d8a-6840-32f7-01cd-71d4f8fe6219",
        "DBVQ7-8N2X7-47FG9-GQ9PY-43KRJ",
        "sto na disku pro sta",
        "CDlpActionDiskPartition::ExecuteDiskProvisioningFromAutomation",
        "CDlpActionUpdateMedia::SerializeRoutine",
        "r ikke portet kompatiblitetsskanningen for ",
        " foi solicitada.%0",
        "EnumeratePathEx: Callback requested enumeration interruption or hit internal enumeration failure on [%s]; GLE = 0x%x",
        "STATUS_NAME_TOO_LONG",
        " SFVP",
        "%BASE_CHINA%",
        "zh-HK",
        "Microsoft.Windows.101.X19-99539_8wekyb3d8bbwe",
        "TBNX2-VFP7M-JT6GH-FV2FF-GX2KG",
        "UpdateMedia: Initializing Edition:                  [%s]",
        "vel.%0",
        "T$`@3",
        "DiskSpaceInstallReq: Initializing Migration Choice:             [0x%X]",
        "3D4T4w4",
        ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@",
        "PreFinalize: Initializing OnlineRollback Registration Path: [%s]",
        "d099ffc7-bf2c-9f76-b7de-48bd8b7eb5be",
        "kleme disk alan",
        "lai d'expiration.%0",
        "J24RN-WB323-PCYPT-8J8X4-FC2JD",
        " zatrzymany na potrzeby testowania.%0",
        "CompatInstallReq: Initializing LangPack Install Path:     [%s]",
        "H9CNQ-XT3PG-GDFGD-Q983T-KTP2Y",
        "tta eftersom det inte gick att hitta instans-hash.%0",
        "GKY2V-BN9DX-436PD-FK3PF-X2FBB",
        "Microsoft.Windows.50.X21-83788_8wekyb3d8bbwe",
        "Facilitator.dll",
        "?9?v?",
        "<%<W<",
        "Microsoft.Windows.121.X19-98886_8wekyb3d8bbwe",
        "se-NO",
        "DataMigration: Initializing Region:              [%s]",
        "4b8d4940-46e7-a344-a6f7-6f88867ba123",
        "< <$<(<,<@<D<\\<l<p<t<",
        " Microsoft Corporation. Wszelkie prawa zastrze",
        "6-6H6",
        "address_in_use",
        "Could not find an install image for this system.%0",
        "D$PSV",
        "FinalizeActionTimeStart",
        "3-4;4N4a4",
        ", Reklam",
        "lisis de dispositivos para instalar la actualizaci",
        "Microsoft.Windows.8.X17-53913_8wekyb3d8bbwe",
        "L$ h?",
        "lida. %0",
        "Asennusta ei voi jatkaa, koska esiintym",
        "8/9=9H9h9s9",
        "NG6FW-VRCRR-WX78V-6FRHQ-XHKC4",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionImageDeployFactory,class CDlpActionImageDeploy>::CreateAction",
        "MoSetupPlatform: Finalize reported failure!",
        "Not-null check failed: Target",
        "2D2l2",
        "ks-Deva-IN",
        "Microsoft.Windows.188.X21-99380_8wekyb3d8bbwe",
        "Brugeren har valgt at annullere, fordi systemet ikke opfylder kravene til det ",
        "MicrodomImplementation::CMicrodom::GetElementById",
        ".?AVCDlpActionGetWebSetupUserInputFactory@@",
        "N2R73-C6TFF-VC8KP-8C2TY-2PR4Y",
        "Der Installationsprozess wurde nicht innerhalb des erforderlichen Zeitlimits abgeschlossen.%0",
        "ho syst",
        "xito ou este devolveu um erro.%0",
        "Ett failure-skript kunde inte k",
        "TRUST_E_EXPLICIT_DISTRUST",
        "GKBNK-C4HDW-VQ3WF-32MCQ-M7V23",
        "permission denied",
        "ProductKey: Product key found in Digital Marker.",
        "r nedladdningen l",
        "CDlpActionSummary::IsPowerPluggedIn",
        "Microsoft.Windows.126.X21-83283_8wekyb3d8bbwe",
        "RG43T-DKYQP-P6TMG-FJY2H-8GC43",
        "F,j\\P",
        "5#6C6",
        "sHhh.",
        "4NKJY-VJKYH-8MV33-262F8-BWRWR",
        "20201009085054Z0w0=",
        "4922beee-d827-1a54-0ed0-77d95f1a95d3",
        "d87d30a8-d15b-b298-44f2-b50b85c61707",
        "Systemet tilfredsstiller ikke diskplasskravene ",
        "Microsoft.Windows.48.X20-35537_8wekyb3d8bbwe",
        "0fd4124d-dc93-91dd-783f-c0d1e0e0c839",
        "Could not open {0}",
        "DataSetting",
        "NtQueryBootOptions",
        "_wcsupr",
        "=$=D=L=X=x=",
        "Znaleziono oczekuj",
        "pap-029",
        "6%7h7",
        "Microsoft.Windows.48.X20-00862_8wekyb3d8bbwe",
        "2$202<2H2T2`2l2x2",
        ".?AVIDiskSpaceAction@@",
        "DecryptionKeyX86",
        "Um script de ",
        " possibile trovare un'immagine di installazione per questo sistema.%0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::ExecuteRoutine",
        "e pour l'installation de la mise ",
        "nns inte i kompatibilitetsgenoms",
        "SetupCore.dll",
        "ImageDeploy: Initializing Wim Path:              [%s]",
        "1N1f1",
        "solus dans le d",
        "BX;AX",
        "Microsoft.Windows.49.X19-99525_8wekyb3d8bbwe",
        "ko-kr",
        "<-<d<",
        " installere oppdateringen.%0",
        "; ;8;P;h;",
        "ytkownik anulowa",
        "o de compatibilidade restrita para instalar a atualiza",
        "cc057e09-87ed-6015-2edc-1adc2484bc59",
        "[F$d*",
        "Microsoft.Windows.99.X20-29699_8wekyb3d8bbwe",
        "8b8fe36d-7a6a-4864-bc85-393d3885a223",
        ": :M:W:",
        "Microsoft.Windows.7.X21-83736_8wekyb3d8bbwe",
        "XF3MQ-NQQ6R-9RBJ3-VFFBJ-CPQD6",
        "ksQ:gWW",
        "6)747B7@8",
        "DUImage: Downloaded %d driver updates.",
        "ImageDeploy: Initializing Image Index:           [%d]",
        ">\"?)?",
        "Microsoft.Windows.171.X21-24728_8wekyb3d8bbwe",
        "t akce.%0",
        "0d93e431-afba-e5df-8e11-0558b54aadd3",
        " grund af en manglende systemkomponent.%0",
        "Microsoft.Windows.27.X19-98758_8wekyb3d8bbwe",
        "ActionListParser::ParseInstallPackage",
        "RGHTN-4RFYY-WRP4D-8RPJH-94R7G",
        " scanonly",
        "a75d44d9-2084-73b2-8f28-cdda033bc590",
        "7b9cb5ad-bb37-6c7c-b757-5ecf8e7fb7e0",
        "ndaren accepterade inte licensvillkoren innan tidsgr",
        "Microsoft.Windows.49.X19-98863_8wekyb3d8bbwe",
        "DiskSpaceInstallReq: Initializing InstallConstraint:            [%d]",
        "<$=9=",
        "G0N0X1",
        "connection already in progress",
        "d20e551d-ee57-3820-b43d-b34abed98a04",
        "D$XSVW",
        "4)5\\5",
        "rbare filen GatherOsState har en ugyldig signatur.%0",
        "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\OOBE",
        "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\sync.c",
        "tXVWj",
        "z!qHe",
        "82ca92e7-90dc-0af8-c188-659be1c91754",
        "8f423f01-69fe-2472-99f4-410da5227bdd",
        "servercloudstorage",
        " jour.%0",
        "OriginalFilename",
        "Module version is [%s]",
        ".?AVCDlpActionPreFinalizeFactory@@",
        "default",
        "3%3,3P3W3g3n3",
        "sen. %0",
        "%hs: couldn't get host product name",
        "Microsoft.Windows.100.X18-28457_8wekyb3d8bbwe",
        "o - Poss",
        "MoSetupPlatform: SuspendAndReleasing NewSystem object...",
        "Kompatibilitetsproblemen l",
        "e0f302ae-0b6b-f727-f6a4-a48be5b0c626",
        "Microsoft.Windows.99.X20-29693_8wekyb3d8bbwe",
        "CDlpActionCompat::UpdateCompatProgress",
        "t)Ph@",
        "YNV4T-WVC3V-B36RW-2BHT3-B99DF",
        " une erreur non sp",
        "9a888fdf-6c73-1edc-20be-47316bde85aa",
        "=/>O>^>}>",
        "L'utilisateur a refus",
        "< <$<(<,<0<4<8<<<@<H<`<d<h<l<p<t<x<|<",
        "d282adc6-1ec0-b9db-9b79-9f0dc3dfc7c3",
        "lL7Ki\"0",
        "ZwQuerySystemInformation",
        "Microsoft.Windows.125.X21-83260_8wekyb3d8bbwe",
        "2e017fe7-af20-82f4-8192-60b485b8a4f1",
        "@.reloc",
        "9W9u9",
        " aggiornata del programma di installazione",
        "Un script de r",
        "7C7M7g7z7",
        "757j7",
        "ExecuteDownloadReq: No response registered.",
        "Microsoft.Windows.121.X19-99467_8wekyb3d8bbwe",
        "GPT63-N66BP-FDGH6-CKFTV-B7VX6",
        "Microsoft.Windows.48.X19-99718_8wekyb3d8bbwe",
        "\\\\?\\Volume{",
        "LogHr",
        "Microsoft.Windows.125.X21-03401_8wekyb3d8bbwe",
        "6$6Y6",
        "6?6F6",
        "n taahh",
        "Microsoft.Windows.101.X20-23650_8wekyb3d8bbwe",
        "d5b19d9d-d415-79ae-ccb0-009ff5de2100",
        "8+8<8C8H8U8Z8y8",
        ";C<J<",
        "27905a3b-4f1a-4205-66e3-1f8e266a78f1",
        "m pokusu o instalaci. Vy",
        "FODsRemoved",
        "8KQ9N-H2TQK-39DHB-9RCD8-9TRB4",
        "RtlInitializeCriticalSection",
        "b3174572-8823-3c3b-ae55-960b6bf101e4",
        "ZwOpenMutant",
        "DebuggerOptions: Initializing Debugger Port:     [%d]",
        "Microsoft.Windows.175.X21-41296_8wekyb3d8bbwe",
        "5?6O6",
        "2FNJP-6VTR4-P493H-WK8DM-MY48M",
        "Inget erbjudande hittades som matchar kriterierna.%0",
        "Ph(Y-",
        "YXCN8-XDB97-8KDCC-DPQHB-XBV8F",
        "wldp.dll",
        "3d771ffd-3641-58c3-5e07-388084a1d579",
        "bin-NG",
        "Microsoft.Windows.48.X19-98853_8wekyb3d8bbwe",
        ": ;+;G;s;",
        "serverstandardevalcor",
        "2L3^3",
        "NewChild->Element.Allocate()",
        "8+8X8r8z8",
        "%WINDOWS_LONG%",
        "ba6ba0a7-4881-96fe-4c49-154e8b7765ed",
        "Microsoft.Windows.180.X21-83661_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X19-98831_8wekyb3d8bbwe",
        "ivatel se rozhodl proces zru",
        "Isolationp::Parse::CTemplatizedStringIterator<struct _LUTF8_STRING>::Attach",
        "connection_reset",
        "e08e09b2-470a-0d1c-be26-2816da1d854b",
        "PR3DM-NGHRJ-RXJQT-FFJPV-JQPH6",
        "DebuggerOptions",
        "8bffcfa8-b200-ea8c-8d1d-d5dd443e0f8a",
        "PFBN4-TKGGF-XDWQY-P436P-W2QXC",
        "GetWebSetupUserInput: No matching offer found for Edition=[%s], Architecture=[%s], Language=[%s]",
        "Finalize: Get the narrator autolaunch status and update setupplatform",
        "D$$Ph0",
        "Probl",
        "ve spu",
        "DUSetup: Instance created!",
        "ImageDeploy: Initializing SkipInstallingWinRE:   [%s]",
        "DXG7C-N36C4-C4HTG-X4T3X-2YV77",
        "operation_not_supported",
        "27fbfcae-232b-e222-e6bb-50ccaa4757a6",
        " Windows.%0",
        "\\packages",
        ">0>4>L>P>h>l>",
        "GetFailedInstallCount",
        "bn-IN",
        "fce4d864-43cc-2b26-13b3-ec8f2dbfa1d9",
        "SetupDisplayedProductKey",
        "Q3DTQ-T6N3Y-YKRF7-8CB94-FC4CY",
        "CDlpActionDiskSpaceReq::GetSupportedDriveLetters",
        "RtlReallocateLUtf8String",
        "e475db17-cf4b-0ca2-64b7-e642181f5900",
        "Der Installationsprozess wurde beendet.%0",
        "Viallisen komentosarjan suorittaminen ep",
        "PerformSilentCleanup: TriggerStorageCleanup is done!",
        "o da instala",
        "%s: Leaving Prepare Method",
        "vel GatherOsState tem uma assinatura inv",
        "SOFTWARE",
        "dano ju",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "CDlpActionDiskSpaceReq::InitializeInstallReq",
        "prs-AF",
        "10770f90-8dac-e680-6e42-92625826f427",
        "CDlpActionDU::CFCPayloadDUCallback::OnProgressChanged",
        "Microsoft.Windows.48.X19-98893_8wekyb3d8bbwe",
        "jQhps",
        "Target Image: BitLocker Premium Available = [%s]",
        "tmj\\W",
        "MigChoice: Error reporting supported install choices: [0x%X]",
        "PackageMigration",
        "NJ84D-FDTW2-4GWYC-J4G2Y-VQWVT",
        "servermultipointpremium",
        "adavky pro sta",
        "Select",
        "16a09be3-d6e1-ce40-ef4c-1c83d4c85948",
        "1)1v1}1",
        "Microsoft.Windows.162.X21-43641_8wekyb3d8bbwe",
        "MultiByteToWideChar",
        "g venter stadig. Der kr",
        "7P7W7l7",
        "lisis de compatibilidad controlada para instalar la actualizaci",
        "UpgradeMatrix.xml",
        "=0>C>V>i>|>",
        "ae83bc0f-9f67-5424-be7c-f04853483bef",
        "9~0t\"",
        "@.rsrc",
        "880c277e-67fa-8657-f65f-1b41c4f2385f",
        "1&2q2",
        "N0Rdk",
        "<'<q<",
        "Los problemas de compatibilidad de los requisitos m",
        " pour l'installation de la mise ",
        "Microsoft Time-Stamp PCA 20100",
        ".?AV?$CZeroInit@VCDlpActionEulaFactory@@$00@@",
        "RQRRR",
        "u'QQQ",
        "Windows\\Branding\\BaseBrd\\basebrd.dll",
        " suspendu.%0",
        "rhandsversion ",
        "SetupCore: Registered BOOT_FINALIZE action",
        "mstest",
        "976aaa2c-a9bc-32bb-0b33-4d9690587908",
        "GM227-FNBQ9-9CWGV-7GYY8-33YJT",
        "Microsoft.Windows.161.X21-43629_8wekyb3d8bbwe",
        "e98f19d0-2d08-3c5e-0942-8f1ec979b4da",
        "Microsoft.Windows.125.X21-83246_8wekyb3d8bbwe",
        "BGB7N-PBQJ3-7T889-4699K-JXFBV",
        "ja nem ",
        "CDlpActionCompat::InitializeMigChoiceScan",
        "w$h )",
        ":\";,;",
        "ration Finaliser a d",
        "GN8GQ-B494K-BXW6Q-G9RGB-X4R8R",
        "Brak pakiet",
        "o requer que o utilizador aceite o contrato de licen",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::SetParameters",
        "GHPJR-6NJ96-432GB-DXBC8-MTDF4",
        "cbf7542d-fa01-dadd-52b1-47837351d4c7",
        "M2N96-46V9F-8P3PP-V9MT7-2R4BC",
        "=8=X=x=",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::Pause",
        "RtlInitAnsiString",
        "BRGWG-M7TGB-2K34W-3HB8B-73KR4",
        "0x%08x",
        "Microsoft.Windows.50.X18-81307_8wekyb3d8bbwe",
        "DiskSpace: Total space on System Drive: [%llu] MB",
        ".CRT$XCL",
        "<><~<",
        "Microsoft.Windows.171.X21-24735_8wekyb3d8bbwe",
        "626084d9-046e-8b18-2805-b3fbaadab39b",
        "A rendszer nem felel meg az adatok telep",
        "ProductKeyValidate",
        "Finalize: Failed to set general setup telemetry. hr=0x%x",
        "Microsoft.Windows.122.X20-46570_8wekyb3d8bbwe",
        "me ne satisfait pas les exigences d'espace disque pour t",
        ";M<x<",
        "NETAPI32.dll",
        "WIMLoadImageInternal",
        "utilisateur ne doit pas ",
        "InitLZMSCompression",
        "CDlpActionUpdateMedia::IsEditionNotSupported",
        "nimos n",
        "ba4e0af6-6127-f38b-2418-80868b62c1c7",
        "Microsoft.Windows.99.X20-35492_8wekyb3d8bbwe",
        "Microsoft.Windows.188.res-v4362_8wekyb3d8bbwe",
        "DesktopReservicing",
        "Microsoft.Windows.99.X20-29702_8wekyb3d8bbwe",
        " cancelar porque el dispositivo no tiene suficiente espacio en disco para descargar.%0",
        "Recovery: Image Architecture:    [0x%X]",
        "SETUPAPI.dll",
        "bb314b77-2f67-f12b-f7cd-84d8ab8d7361",
        "FPKH3-NM8B6-GRBKP-4T42B-XBVY3",
        "9B9c9{9",
        "Microsoft.Windows.121.X19-98673_8wekyb3d8bbwe",
        "H7RN9-XDBFP-824HQ-J98D3-DVY84",
        "Microsoft.Windows.162.res-v3922_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::SerializeRoutine",
        "Microsoft.Windows.49.X21-83176_8wekyb3d8bbwe",
        "DriverChecked",
        "N878H-93RJD-4T9MG-K9BFW-TQ9RB",
        "CXFNW-4HWPJ-B72QX-W36BK-M98WP",
        "DriversPath",
        "Microsoft.Windows.4.X21-05131_8wekyb3d8bbwe",
        "STATUS_RM_METADATA_CORRUPT",
        ";6;L;",
        "8)999J9Z9k9{9",
        "8caaef37-82b7-a7d6-13e4-87dbe26784dc",
        "ProductKey: Product key has an incorrect size.",
        "STATUS_INVALID_IMAGE_FORMAT",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::CheckUninitialized",
        "ndsutf",
        "D$DPh",
        "Activation: GatherOsState Process returned   : [0x%X]",
        "STATUS_INFO_LENGTH_MISMATCH",
        "94a54c97-a7b7-896a-154d-5f9a6a708cb4",
        "NewInstance.Allocate()",
        "DownlevelBuildNumber",
        "281c8431-9023-378c-7922-722821d8cd75",
        "FACILITY_FIREWIRE_ERROR_CODE",
        "wcsnlen",
        "o foram resolvidas dentro do prazo necess",
        "CDlpActionDebuggerOptions::ExecuteRoutine",
        "kn-IN",
        "DUSetup: DoNotConnectToWindowsUpdateInternetLocations Value [%lu]",
        "697H7\\7",
        " il sistema non soddisfa i requisiti per l'opzione di migrazione desiderata.%0",
        "tirmeyi y",
        ".?AV?$CZeroInit@VCDlpResponseAutomationFactory@@$00@@",
        "RtlDowncaseUnicodeChar",
        ">&?6?=?",
        "CAutomationManager::CheckResponseArgs",
        "FQ36C-4ND2C-4B977-DVQ32-KW3FD",
        "LdrGetProcedureAddress",
        "9~(s+j",
        "Microsoft.Windows.101.X19-99556_8wekyb3d8bbwe",
        "f152312e-c8c3-38a1-7d30-bfd2cbde1a2c",
        "83KNH-KMG24-PBTQG-VWJVT-HFTP2",
        "d33dbe75-8d1c-9d83-6fea-aea14f66387a",
        "4412c8fd-e25c-33f1-83f3-a41a5e37d116",
        "4 4=4D4a4h4",
        "%wPtG",
        "XY6BR-KNDCB-DQHHC-WJQYH-X7666",
        ":3:\\:",
        "PreFinalize: Initializing Device scan results: [%s]",
        "CDlpActionDataMigrate::DeserializeRoutine",
        "UpdateMediaOptInDefault",
        "Root != Root.InvalidValue()",
        "Lettre de lecteur cible introuvable. %0",
        "Microsoft.Windows.122.X21-03403_8wekyb3d8bbwe",
        ":M;s;",
        "D$PPh",
        ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIFCPayloadCallback@@@@@@",
        "n del programa de instalaci",
        "f0a7ec64-cc5b-feef-d473-6fc00a2d045d",
        "ndelser kan ikke rapporteres.%0",
        "Microsoft.Windows.21.X17-53887_8wekyb3d8bbwe",
        "medi ve kullan",
        "DiskPartition: Automation found!  Checking for disk provisioning...",
        "7,8H8",
        "VS_VERSION_INFO",
        "CDlpActionCompat::AppendInstallChoice",
        "dCSDBuildNumber",
        "d08308a3-675e-2b32-5800-ef100142041d",
        "ActionListParser::ParseDownloadPackage",
        "ExitResult",
        "8JJ9W-CNMJ3-MHX9B-MKWHQ-M7WGQ",
        "0+0V0",
        "969Q9i9",
        "pidgenx.dll",
        "Microsoft.Windows.121.X20-29639_8wekyb3d8bbwe",
        "2f0e97f1-d893-1fe9-2035-f98618af144e",
        "Microsoft.Windows.98.X20-29577_8wekyb3d8bbwe",
        "t(h(r",
        "PGCJN-V6CCD-KDFPM-HGTC7-VT9Q6",
        "CMicrodomBuilder::StartDocument",
        "1Y2s2x2",
        "A0!q8",
        "DriverReflectPath",
        "272e2{2",
        "F692N-K7JD2-KTW3F-CV46P-RVQKD",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::Serialize",
        "uz-Cyrl-UZ",
        "HomeBasicN",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::ExecuteRoutine",
        "?A?x?",
        ".?AVCDlpActionActivation@@",
        "<6>]>z>",
        "RestoreEncryptedFile",
        "PhRSDT",
        "CDlpActionDiskSpaceReq::CheckDiskSpace",
        "WIM\\IMAGE[INDEX=%d]\\WINDOWS\\EDITIONID",
        "V2Y4T-NKJDQ-9FVF4-FWD2F-PPR6B",
        "CompatFinalizeReq: Initializing Selected Mig Choice:   [0x%X]",
        "DataMigration: Initializing User MigXmlPath:     [%s]",
        "t?Vh ",
        "2NM93-FP46J-PRBPG-XRR67-MBKR9",
        "'`OUL",
        "=\"=?=Y=y=",
        "1-2u2",
        "Microsoft.Windows.48.X19-98801_8wekyb3d8bbwe",
        "CDlpActionDataMigrate::MigrateBuildInformation",
        ".?AV?$CUnknownImpl@VIMoSetupDlpAction@@@@",
        "?0?]?x?",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::CheckInitialized",
        "D$lSP",
        "7 787<7@7D7X7\\7l7p7t7x7|7",
        "mesi i",
        "CreateDestinationFileEx",
        "Microsoft.Windows.125.X21-83232_8wekyb3d8bbwe",
        "9ba97e6b-a175-9213-45af-206eee5b31bc",
        "tV9_0t",
        "BQFBB-6N34Y-TJWPY-WC9RG-PDKRY",
        "SafeOSDU",
        "<1<7<W<^<",
        "r den Download des Updates nicht.%0",
        "? ?>?[?",
        "ProductKey: Extracting data from EI.cfg file.",
        "0=0D0v0",
        "GetWebSetupUserInput: Execute: Download file size X64 = [%llu].",
        "5\"5=5c5",
        "MT992-NV4TV-3VPBY-T4FQJ-JFH8B",
        "CDlpActionFinalize::InitializeImageExit",
        "Enable",
        "CMicrodomBuilder::CNamespaceNameExistenceCheck::AddAndCheckExistence",
        ": :$:(:,:0:4:H:X:\\:l:p:x:|:",
        "6e7o7",
        "PerformSilentCleanup: Failed to call TriggerStorageCleanup: [0x%X]",
        "74034938-1cdb-5391-cdd8-efeddd503cb4",
        "0e3ca0e1-251b-e37c-0a34-b5626e729763",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::CheckInitialized",
        "FLT_INEXACT_RESULT",
        ">O>f>",
        "e pour poursuivre l",
        "758M8",
        "ndaren har valt att avbryta eftersom systemet inte uppfyller kraven f",
        "ProductKey: Host OS edition is [%s].",
        "3bd82cbe-a190-2833-5425-085943156976",
        "DiskPartition",
        "755a6964-972f-a5b5-a445-0c18a9aaf6a9",
        " opcj",
        "ProductKey: Key from SkuLib is invalid",
        "FRWCN-FV7YV-M84HG-M34Q7-BDWWP",
        ">T>b>",
        "SYSTEM",
        "Systemet opfylder ikke minimumskravene til download af opdateringen.%0",
        ".?AV?$CUnknownSingletonImpl@VCMoSetupCompat@@VIMoSetupCompat@@@@",
        "ProcessDirectory",
        "Temp = (*RtlReallocateStringRoutine)(Bytes, Blob->Buffer)",
        "FilePath",
        "L'utilisateur a utilis",
        "u durdurmay",
        "42fcd868-6ab1-67ab-3fbb-d9c748c3c784",
        "652456fc-d8ad-2ee4-f9ef-188f47f33f96",
        "9):D:",
        "2c982167-b2b6-647b-fc17-dce546631e92",
        "t,h`Y",
        "0 0$0<0@0X0h0l0|0",
        "Microsoft.Windows.4.X21-05134_8wekyb3d8bbwe",
        "ZwDeleteBootEntry",
        "8B9M9d9o9",
        "8R8Y8n8",
        "[0b0y0",
        "Compatibility: Suspend was requested",
        "m_StoredTable.FindOrInsertIfNotPresent(Pair, Value, 0, pfExisted)",
        "InitializeRoutine: MOSETUP_ACTION_BOOT_FINALIZE",
        "GetModuleFileNameA",
        "YY_[^",
        "hg0M0~0[0",
        "=X=|=",
        "4(4,444L4\\4`4d4h4l4p4t4x4|4",
        "ha-Latn",
        ">D>_>",
        "8aea09e6-b8e8-745c-3e57-654cc58732ea",
        "o de SO pendente encontrada.%0",
        "6;6n6",
        "<g=r=",
        ":/:6:$;*;Y;",
        "PackageMigration: Initializing SafeOS paths         [%ld] [%s]",
        "0 00040<0P0T0d0h0x0|0",
        "CDlpActionFinalize::InitializeRoutine",
        "bad_file_descriptor",
        "NetHostIp",
        "0707c969-6c6b-712e-af78-2320e70a6545",
        "Reset setting hardlink failure because of folder redirection",
        "Microsoft.Windows.7.X18-81290_8wekyb3d8bbwe",
        "Microsoft.Windows.101.X20-23599_8wekyb3d8bbwe",
        "Het installatieproces wordt gebruikt in een testomgeving.%0",
        "TelemetryOptIn",
        "8N8Y8",
        "\\Windows\\WinSxS\\",
        "Microsoft.Windows.8.X17-36775_8wekyb3d8bbwe",
        "ytynyt.%0",
        "MT3Q7-XTN4Y-7F7J4-4GHTQ-BG92P",
        "r ikke enhetsskanningen for ",
        "Microsoft.Windows.48.X20-32144_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::GetActionId",
        "Het compatibiliteitsrapport kan niet worden weergegeven vanwege een ontbrekend systeemonderdeel.%0",
        "CDlpActionSummary::IsPowerPluggedIn: System's AC power is offline.",
        "GetWebSetupUserInput: Error reporting telemetry for WebSetupInputSelectedArch: [0x%X]",
        "DebugBreak",
        "GetWebSetupUserInput: HostOs Language[%s].",
        "nnen nicht gemeldet werden.%0",
        "RtlCopyLBlob",
        "c'`n0",
        "_unlock",
        "GetWebSetupUserInput: Architecture=[%s]",
        "4ea80521-b3cd-f9d3-f981-fd8b77854da5",
        "a0986bd9-7770-2f17-8f77-d83eb46923ae",
        "teleknek megfelel",
        "Version",
        "o foi interrompido para fins de teste.%0",
        "Invalid pointer ppvObject",
        "\"%s\" \"%s\"",
        "Microsoft.Windows.126.X21-83682_8wekyb3d8bbwe",
        " operacj",
        "1b19d44f-921e-347a-353b-48e034c9f3ef",
        "e3a1bc17-b52f-478c-a156-1ed53c920055",
        "Microsoft.Windows.98.X20-20966_8wekyb3d8bbwe",
        "zh-TW",
        "SystemManifest",
        "1T1t1",
        ">;?\\?y?",
        "Het systeem voldoet niet aan de minimum vereisten voor het installeren van de update.%0",
        "ExecuteDownloadReq: Error reporting telemetry for bSpaceReqBlock: [0x%X]",
        "GetLastError",
        "st lehet",
        "Foi encontrada uma vers",
        "j0_f;",
        "5$5,545<5D5L5T5\\5d5l5x5",
        "PackageMigration: Initializing Target:              [%c]",
        "62f590a3-1b6b-db2d-fc81-9e09d598acb3",
        "Target OS: SPVersion = [%d.%d]",
        "rma daha ",
        "IoTEnterpriseS",
        "D8W23-NBJX6-GD3V7-VW4YT-D3WXF",
        "en-us",
        "Current: [%llu] Total:[%llu]",
        "x}G;}",
        ";1<;<",
        "5c9e3007-b260-6f3d-b4aa-3b6029ca97c6",
        "MoSetupPlatform: Calling SetupPlatform::INewSystem::ExecuteCurrentOperations...",
        "Microsoft.Windows.101.X19-99541_8wekyb3d8bbwe",
        "7V7c7p7",
        "]SYSTEM\\Setup\\FailedInstallations",
        "Der blev fundet en ventende handling for annullering af opdatering af operativsystem.%0",
        "4$4,444<4D4L4T4\\4d4l4t4|4",
        "9;9U9Z9",
        "deserialize app scan result at : %s",
        " ukon",
        "Il sistema non soddisfa i requisiti di spazio su disco per il download e la decompressione del supporto per pi",
        "Not-null check failed: String1",
        "ntdll.dll",
        ".?AVICompatAction@@",
        "GetNativeSystemInfo",
        "78e38bf3-09fa-c671-195d-e780b5d2594d",
        "9 :*:U:_:",
        "%s:%s",
        "Microsoft.Windows.172.X21-24706_8wekyb3d8bbwe",
        "fclose",
        "UsbTarget",
        "serverstorageenterprisecore",
        "Recovery: Offline Architecture: [0x%X]",
        "e7bf3184-0bff-5008-70bc-cfff6199ea6e",
        "m_CurrentStreamObject != 0",
        "<0<i<",
        "9-9M9",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionPreFinalizeFactory,class CDlpActionPreFinalize>::SetActionId",
        "MoSetupPlatform: Creating DATAONLY Fail Forward system...",
        "m krit",
        "es-GT",
        "Microsoft.Windows.27.X21-83177_8wekyb3d8bbwe",
        "b81232f2-ad85-0678-0644-73e50a274f5f",
        "jdYWPWQ",
        "6f645e1c-a9cf-5fae-47f0-8e6d5733c1be",
        "lai imparti.%0",
        "FJPN2-GBC2B-CKXGD-2KR6W-7FR8P",
        "lemedi veya bir hata d",
        "NtReadFile",
        "909W9}9",
        "ServerHPC",
        "Microsoft.Windows.99.X19-99565_8wekyb3d8bbwe",
        "STATUS_SXS_INVALID_ACTCTXDATA_FORMAT",
        "Microsoft.Windows.49.X21-03403_8wekyb3d8bbwe",
        "lemi ask",
        "Egy v",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::ExecuteRoutine",
        "Finalize: Successfully completed the downlevel phase",
        "CDriverCallback::ValidateDriverPackage: Driver Package: Classname: [%s], ClassGuid: [%s], Proposed Answer: [%d]",
        "DeviceScanResultPath",
        ";&;`;j;",
        "pienia jest niezgodna.%0",
        "NH29J-RHHRK-G4TK6-4B2CR-BY6QT",
        "93f77932-84b4-87a7-a6cf-243d1bea4693",
        "73f15e83-c74e-ddf2-135d-3eebf519b14c",
        "Microsoft.Windows.99.X20-29706_8wekyb3d8bbwe",
        "ku-Arab",
        " komunikatu blokady zamkni",
        "69267043-1b22-84a7-5456-e6a1961d9823",
        " anulowania dla reklam.%0",
        "Microsoft.Windows.49.X20-35546_8wekyb3d8bbwe",
        "D32CM-X4NMM-648WF-MGVDK-CDPJ7",
        "v maradjon.%0",
        "ERROR_INVALID_FLAGS",
        "9b200cf1-197e-c4e4-adb7-3e949be107e5",
        "CDlpActionActivation::InitializeRoutine",
        "EnterpriseAttribution",
        "97vhS",
        "ProductKey: EI.cfg file found.",
        "Il messaggio di risposta del server ",
        "?\"?H?",
        "7$7,747@7d7l7t7|7",
        "P84V3-NVW96-R27W2-CBMTR-K4R79",
        "Microsoft.Windows.50.X21-83767_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X19-99517_8wekyb3d8bbwe",
        "Bir hata komut dosyas",
        "The compatibility issues were not resolved within the required time limit.%0",
        "3+333X3`3",
        "Volume:GVLK",
        "Microsoft.Windows.125.X21-03402_8wekyb3d8bbwe",
        "CDlpActionGetWebSetupUserInput::ExecuteRoutine",
        "CDlpActionGetWebSetupUserInput::GetInstallChoiceFromResponse",
        "NtQuerySystemInformation",
        "XW8K7-NC8B8-FPJ26-FYKFM-6VJXY",
        "Activation: Skipping the Activation block since requested.",
        "\\$ ;E",
        "Erro ACCESSDENIED encontrado em fases iniciais da Configura",
        "WWRND-H328G-J8CC2-RTPTW-W44WT",
        "BHWRH-XY7GH-F2Y6C-DRXH6-T4XBY",
        "937abd9c-d4c9-4e30-4f13-8e7915181d37",
        "A Windows helyre",
        "Process %s is accessing file wim %s",
        "Der Benutzer hat den Vorgang abgebrochen, da das System die Kompatibilit",
        "nns i kompatibilitetsgenoms",
        "RtlFindAceByType",
        "SetupVersionMinor",
        "!040`0",
        "4)5D5P5[5x5",
        "061b2482-4b56-b386-a096-6045802ac4a7",
        "BiBuildIdentifierList failed %x",
        "575e3a7c-18f9-0529-5164-0cc460478f5a",
        "GetFullPathNameW",
        "37GNV-YCQVD-38XP9-T848R-FC2HD",
        "6PDKD-N2PRH-K72QG-PHQKR-7H7PX",
        "Microsoft.Windows.8.X17-66953_8wekyb3d8bbwe",
        "8$9.9[9e9",
        "4a4q4",
        "BNWWD-82X4R-WTMQC-72YF8-J8F9J",
        "H22VK-NM8QD-CG3VR-VWBW8-Q699B",
        "<<<C<S<",
        "NQ6FT-3TV44-FX86M-4D8BT-D3WWH",
        "cloudn",
        "CDlpActionProductKeyValidate::SelectImageIndex",
        ":@:G:W:",
        "Microsoft.Windows.122.res-v3283_8wekyb3d8bbwe",
        ">=?D?p?",
        "3db297d4-7fc6-ca73-bad0-fce698ac5ccc",
        "a pas ",
        " uruchomiony z nieznanym argumentem wiersza polecenia.%0",
        "No processes are using this file.",
        "n testiymp",
        "PackageMigration: Getting Removed FODs Failed         Error: [0x%X]",
        "Microsoft.Windows.161.X21-43635_8wekyb3d8bbwe",
        "ckligt med ledigt diskutrymme f",
        "ar-BH",
        "AllocateAndInitializeSid",
        "0f9d5f44-b649-05bd-8077-b1b4a407532f",
        "92c988ce-94b7-d31f-4cde-666d9c5f756c",
        "Installationsprocessen har stoppats i testsyfte.%0",
        "El usuario eligi",
        "ProductKey: Initializing Wim Ref paths       [%ld] [%s]",
        "Microsoft.Windows.100.X20-15869_8wekyb3d8bbwe",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionPackageMigrateFactory@@VCDlpActionPackageMigrate@@@@",
        "<N<n<",
        "Microsoft.Windows.48.res-v3305_8wekyb3d8bbwe",
        "4.4R4b4{4",
        "924ddaa2-e3aa-331d-4905-23e1e2b9ea46",
        "BGT2Y-9NFW4-FRTJ6-7YQ7V-8HQJ8",
        "9 989H9L9P9T9X9`9d9h9l9p9",
        "EnumeratePathEx: Unable to construct path under [%s]; GLE = 0x%x",
        "Compatibility: Resolve(SETUP_DISMISS_ALL_RESOLVE_STRING) returned: [0x%X]",
        "j?Zf9TH",
        "3`3}3",
        "9NVFH-WH7MD-27WPF-KQQMQ-4GDDR",
        "0120b62a-4a69-226c-d3be-40af7d74921e",
        "NB9QB-R69WQ-KPRQF-G87C8-W462B",
        " reddetti.%0",
        "Retail",
        "iu-Latn-CA",
        " voi huoltaa. %0",
        "Failed to populate Media from {0}",
        "ndaren accepterade inte annonsering innan tidsgr",
        "HXFNP-8HYQ3-4FMC3-2DHJ9-M97JF",
        "WaitForSingleObject",
        "j/Yf;",
        "Microsoft.Windows.171.X21-24730_8wekyb3d8bbwe",
        "9r<y<",
        "M:h]14Y&j",
        "Microsoft.Windows.4.X19-99691_8wekyb3d8bbwe",
        "Microsoft.Windows.7.X21-83404_8wekyb3d8bbwe",
        "`1Xk0",
        "FODCount",
        ";N;|;",
        " disponible.%0",
        "embeddedeeval",
        "GetSupportedDriveLetters: Supported Drive letters [%s]",
        "Microsoft.Windows.8.X21-83692_8wekyb3d8bbwe",
        "A kompatibilit",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::ExecuteRoutine",
        "Proces instalace byl ukon",
        "Die Meldung zum Blockieren des Herunterfahrens konnte nicht erstellt oder zerst",
        "L$,_^[3",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::GetProgress",
        ".?AV?$CDlpActionImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIActivationAction@@@@@@@@@@",
        "95ab9554-900c-2089-a82d-f60abdbfdec1",
        "7$7,747<7D7L7T7\\7d7l7t7|7",
        "N28W9-K6H3D-3VT87-TJVDK-GJHY4",
        "NFJ77-RMF62-V89VY-G4B7Y-VQYM4",
        " oldu",
        ">q>z>",
        "\\System Volume Information\\FVE2.{e40ad34d-dae9-4bc7-95bd-b16218c10f72}.X",
        "5.5M5l5",
        "IN_PAGE_ERROR",
        "0)0Q0",
        "69f84523-1850-2a6f-f59f-d986445f14d5",
        "CritDU",
        "Windows::StringUtil::Rtl::Impl::AppendTranscodedStringToPreallocatedBuffer",
        "191u1",
        "Activation: Error reporting telemetry for GatherOSState exit code: [0x%X]",
        "i nem old",
        "DNWTT-PXGKJ-2K96V-B789W-33WV9",
        "Microsoft.Windows.17.X17-36804_8wekyb3d8bbwe",
        "2DBW3-N2PJG-MVHW3-G7TDK-9HKR4",
        "43TWJ-BN9D2-7D7MW-DPBTB-39QD8",
        "ugiwana.%0",
        "sr-BA-Cyrl",
        "CDlpActionDataMigrate::MigrateLocaleInformation",
        "ges id",
        "DUImage: Failed to execute driver search and download [0x%x]",
        "n porque el sistema no tiene espacio en disco.%0",
        "087c9f5c-9fc3-c1c5-f1b4-23ce84cb2047",
        "Compatibility: Resolve returned an error [0x%x].",
        ":$:D:L:T:`:",
        "Timeout",
        "__COMPAT_LAYER",
        "Windows::uDom::Rtl::RtlMicrodomUpdateRemoveElement",
        "rique ne dispose pas de l'espace disque requis pour l'installation.%0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::PreInit",
        "5a6d265c-9675-6628-9981-54e2d23c82df",
        "ReadMetaDataFile",
        "PathToProductsXml",
        "7db9b258-a7bd-cdc6-721c-b0b618b38c4f",
        "Microsoft.Windows.101.X19-99523_8wekyb3d8bbwe",
        "yet st",
        "m_StoredTable.Find(Pair, ppusAttrListNumber)",
        "DUSetup: Initializing Facilitator Url:   [%s]",
        "CAutomationManager::GetAutomationValues",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::Suspend",
        "CDlpActionDU::GenerateHardwareCompatFile",
        "31ddee98-14b2-07fc-5d9f-a0be69841902",
        "DataMigration: Queue private files into Target OS...",
        "4428afaf-6187-0528-0a37-87a843f90f4e",
        "<e=l=",
        "Repair",
        "rnek karma bulunamad",
        "Testversjons-ID-en er tom.%0",
        " aktywn",
        " Windowsin palauttamisen v",
        "ActionListSSUPaths",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "r installationen av nyttolasten.%0",
        "DR333-NJ97M-CVYT6-TGKVP-KW3GT",
        "_wcsicmp",
        "ProductKey: SelectImageIndex: Selected image index [%ld].",
        "FTNVJ-JBBWC-26CGT-28XVT-HFR9P",
        "M6NDM-3HYKM-93838-Y463P-YKM6M",
        "it-CH",
        "o de pr",
        "Microsoft.Windows.48.X20-35463_8wekyb3d8bbwe",
        "fr-LU",
        "Microsoft.Windows.101.X19-99651_8wekyb3d8bbwe",
        "152;2M2S2&3-3C5",
        "no space on device",
        "\\??\\GLOBALROOT",
        "Errore ACCESSDENIED rilevato nelle fasi iniziali dell'installazione - ",
        "Microsoft.Windows.101.X20-29631_8wekyb3d8bbwe",
        "9$9n9z9",
        "7CDNR-2XWJ3-FFK9H-YC8D7-FJTBW",
        "Microsoft.Windows.49.X20-23647_8wekyb3d8bbwe",
        "adovan",
        "ef20a23c-fd32-4f11-63b3-a6a0af6798a2",
        "serverstoragestandardcore",
        "2k6u6<7C7",
        ".?AV?$CZeroInit@VCDlpActionDebuggerOptionsFactory@@$00@@",
        "Edition",
        "Microsoft.Windows.171.X21-24725_8wekyb3d8bbwe",
        "WL0j0D0_0",
        "The system does not pass the minimum requirements to download the update.%0",
        "CompatFinalizeReq: Initializing SKU Name:              [%s]",
        "es-ES",
        "8CB8D-N2C2H-YGPC9-R984X-Y7V3G",
        "Microsoft.Windows.100.X20-35500_8wekyb3d8bbwe",
        "Microsoft.Windows.7.X21-83740_8wekyb3d8bbwe",
        "ZwQuerySystemEnvironmentValueEx",
        "5(545@5L5P5T5X5\\5`5l5x5",
        "App.Support.QuickAssist~~~~0.0.1.0",
        "736V8-NM7JQ-HJRFC-B9C8B-K7663",
        "VD7N4-MR9PG-BGQM9-B269F-GXXRR",
        "KVN6T-MM2W2-JJWJV-6JP6H-8HV2F",
        "CERT_E_UNTRUSTEDTESTROOT",
        "Microsoft.Windows.161.X21-04951_8wekyb3d8bbwe",
        "6fa7107f-c2e9-9383-f0be-6c42cee66672",
        "5b350ca3-3ee7-bc4a-59e8-a1857bf37497",
        "GetVolumeInformationByHandleW",
        "|q}*g",
        "4,4C4",
        "Microsoft.Windows.100.X19-99668_8wekyb3d8bbwe",
        "FindResourceExW",
        "F<9S,u",
        "8NQTV-7FQR9-27KKV-2M4HG-KTPKT",
        "UUUUf",
        ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskPartitionGetBKeyAction@@@@@@@@",
        "De installatie kan niet worden voortgezet omdat de exemplaar-hash niet is gevonden.%0",
        "7 7$7,7D7T7X7h7l7p7",
        "CXmlLogicalState::{dtor}::<lambda_0fd40d3b956627884e315ff69db4f18c>::operator ()",
        "Nem tal",
        " per il download non sono stati risolti entro il limite di tempo richiesto.%0",
        "The installation process did not complete within the required time limit.%0",
        "DriversDownloadPath",
        "FveSetFipsAllowDisabled",
        "212D2",
        "MoSetupPlatform: NewSystem object released!",
        "invalid seek",
        "f9FHu",
        "RtlGUIDFromString",
        "8RQCG-NRXBX-PJX2K-XGTH7-QM9XV",
        "STATUS_CANCELLED",
        "STATUS_LOG_GROWTH_FAILED",
        "7c899I9`9",
        "jth`u",
        "061f8a0c-5839-4d9c-73e7-983ca01880f1",
        "<r=y=",
        "485N5s5",
        "CDlpActionCompat::ExecuteGatedScan",
        "ts under fasen med kompatibilitetsproblem som beh",
        ".?AVIMoSetupDlpAction@@",
        "Microsoft.Windows.121.X20-35505_8wekyb3d8bbwe",
        "n est",
        "me ne remplit pas les conditions requises pour le choix de migration souhait",
        "GetTickCount64",
        "?$?D?P?t?|?",
        "CDlpActionDebuggerOptions::EnableDebugger",
        "?3?9?B?q?",
        "JT7NC-QMYWP-KDDYR-QRVRT-J2QDR",
        "CompatFinalizeReq: Initializing SPMinor Version:       [%d]",
        "Microsoft.Windows.48.X20-32148_8wekyb3d8bbwe",
        "7A8L8",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionFinalizeFactory,class CDlpActionFinalize>::CreateAction",
        ".?AVCDlpOSInfo@@",
        "st.%0",
        ":,;E;b;",
        "Microsoft.Windows.98.X19-99432_8wekyb3d8bbwe",
        "FACILITY_GRAPHICS_KERNEL",
        "Ein ausstehender Rollbackvorgang f",
        "CDlpActionUpdateMedia::GetResultsRoutine",
        "383N3[3h3",
        "Microsoft.Windows.50.X21-83770_8wekyb3d8bbwe",
        "ho programu, aby bylo mo",
        "2PFGF-QKNVW-7C936-6PRD4-KBVY4",
        "6f17da6f-4d97-949e-cf2e-8574e2f4a908",
        "Microsoft.Windows.7.X21-83397_8wekyb3d8bbwe",
        "glich.%0",
        "Esta versi",
        "CAutomationManager::Initialize",
        "Microsoft.Windows.7.X17-53913_8wekyb3d8bbwe",
        "6%6O6Z6",
        "serverembeddedsolutioncore",
        "Index of element to remove exceeds number of the element.",
        "182?2R2a2H3_3v3Q4",
        ".;,=~#@^&'$%",
        "FDTTH-PGBYW-XW2RD-NCYMM-88F9H",
        "5?6M6m6",
        "Microsoft.Windows.48.X19-98846_8wekyb3d8bbwe",
        ">4>Y>k>x>",
        "MTP4X-N26Y3-69V49-HT8YX-4JRBQ",
        "Microsoft.Windows.48.X20-29666_8wekyb3d8bbwe",
        " dispon",
        "N768D-V2R7C-VRBQM-YCJQQ-MDYP4",
        "572ab8c6-b122-e3fc-2c16-709a59a2e57a",
        " a telep",
        " il sistema non soddisfa i requisiti minimi per l'installazione dell'aggiornamento.%0",
        "4a23a648-b320-5cf9-67cc-c07bfbfcf339",
        "CERT_E_MALFORMED",
        "no buffer space",
        "b29bd774-3fd0-7f5a-4428-ee3f376f072f",
        "owana.%0",
        "8(848@8L8X8d8p8|8",
        "Windows Recovery Environment can't be serviced currently.%0",
        "274e3597-8644-2f0b-0fe3-d8f3f6167c41",
        "Asennusta jatketaan k",
        "Y4WG2-WNJ29-GQFJV-PK3JM-MY64R",
        "CDlpActionActivation::SuspendRoutine",
        ">>>I>u>",
        "en objekt diagnostiky. Ud",
        "MVY7X-7NMFG-3BPQ3-63TVF-FC3FP",
        "CDlpResponseAutomation::InitializeRoutinePkey",
        "gW0j0D0",
        "f1a62ba0-7f1e-250d-9790-09fd18c23a21",
        "878V8",
        "373W3",
        "Microsoft.Windows.50.res-v4329_8wekyb3d8bbwe",
        "El id. de vuelo est",
        "0R0s0",
        "o foi conclu",
        "Automation",
        "6!6%6)6-6",
        "Downloads",
        "Der Installationsprozess wurde zu Testzwecken angehalten.%0",
        "CMicrodomBuilder::StartElement",
        "ebcad5a6-f265-722d-829b-ce736f8c7c9f",
        "Der blev registreret en uventet version af bin",
        "1j2t2",
        "QQSVW",
        ".?AVCMoSetupPlatform@@",
        "System32\\Config",
        "TNYB9-P84KB-VM2T6-YQC3Y-BBHYP",
        "9,9X9",
        "Microsoft.Windows.125.X21-83251_8wekyb3d8bbwe",
        "rste trinnene av installasjonen ",
        "nicamente, no para instalar el sistema operativo.%0",
        "Microsoft.Windows.121.X19-98674_8wekyb3d8bbwe",
        "ff-Latn",
        "Microsoft.Windows.145.X21-83687_8wekyb3d8bbwe",
        "Se ha producido un error y el valor del resultado debe consolidarse con fines de telemetr",
        "no_buffer_space",
        "Der Kompatibilit",
        "me ne pr",
        "< <1<B<_<",
        "Not-null check failed: NodeSet",
        "FDj<P",
        "dddc9139-a243-78b8-92f1-a41b9de1abee",
        "<9<d<",
        "4*4:4[4",
        "751939cb-667f-ba4d-9c94-d60a6c1f1b85",
        "na wy",
        "76ebee90-ead7-b934-ae2a-959fa9a21a80",
        "CMicrodomBuilder::ConsumeCData",
        "NPDT2-BJ44P-WJ2BP-DB467-G6RFD",
        " bilgilendirilmemelidir.%0",
        ".text$mn",
        "e pokra",
        "uD9pXu",
        "L$4^3",
        ";/;|;",
        " une erreur.%0",
        "STATUS_INVALID_TRANSACTION",
        "Microsoft.Windows.79.X21-83749_8wekyb3d8bbwe",
        "MoSetupPlatform: Enabled update UX on NewSystem!",
        "a9457c31-7155-128b-e29a-66aaa2ea8ae1",
        "=\">C>c>x>",
        "lenemiyor.%0",
        ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpResponseFactory@@@@@@",
        "j\\Xf9DN",
        "Microsoft.Windows.164.X21-06162_8wekyb3d8bbwe",
        "The user has chosen to cancel because the system does not pass the device scan to install the update.%0",
        "Failed to initialize DriverKeyformProperties: {0}",
        "CDlpActionFinalize::SerializeExit",
        "ExecuteInstallReq: Drive [%c] has enough free disk space",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::GetResultsRoutine",
        "OYuU0",
        "Microsoft.Windows.145.res-v4318_8wekyb3d8bbwe",
        "a64c30ea-c091-3561-9850-c6b2b5be876f",
        "voldoet niet aan de minimum vereisten voor het downloaden van de update.%0",
        "9P9q9",
        "4e4653e1-9bbd-2594-33cf-f6f9fd5cc270",
        "Microsoft.Windows.121.X19-99466_8wekyb3d8bbwe",
        "e74d2639-11fe-11a3-e1a3-00ba19291994",
        "Microsoft.Windows.4.X19-98701_8wekyb3d8bbwe",
        "Q73N4-C93QV-YQ826-HGQ79-JXCJR",
        "\\Device\\Harddisk%u\\Partition%u",
        "Microsoft.Windows.101.X20-24576_8wekyb3d8bbwe",
        "t$PPQQQQ",
        "DownloadFileHashX86",
        "Created new boot entry 0x%x",
        "7G8b8h8",
        "WimRefPaths",
        "15d73864-d3e8-eee8-e753-08715a182028",
        "=%=P=[=",
        "CX9MK-PFNX4-4GHQR-FMGQH-RGDGQ",
        "Installer kjernehandlinger",
        "1edce1f3-7792-a6e5-8330-88607dfa1dac",
        "0I0W0",
        "WATSON_DRIVER_DOWNLOADED",
        "Die Flight-ID ist leer.%0",
        "PQQhH",
        "MSCFu",
        "SWPhP",
        "4a55b715-31f5-df8d-0585-96e08838017d",
        "4=4s4",
        "PrivacyConsentOption",
        "zHr,g",
        "NMRk0f",
        "FveCommitChanges",
        "b2cf312a-e02c-9d7a-4804-a36e970e156d",
        "Microsoft.Windows.171.X21-24727_8wekyb3d8bbwe",
        "t$$QV",
        "KN7J6-3BQFW-29TFD-2TG98-F3KQ6",
        "0_06RP",
        "622d7456-1822-68f9-c39f-5869c8cdf250",
        "Microsoft.Windows.49.X19-99519_8wekyb3d8bbwe",
        "4:4V4",
        "78568d00-2f73-c56b-6be7-17bdbb396b7c",
        "ffades under den inledande konfigurationen - nytt f",
        "Microsoft.Windows.122.X19-98689_8wekyb3d8bbwe",
        "operation not supported",
        "CDlpActionProductKeyValidate::ValidateProductKeyFromWim",
        "Microsoft.Windows.101.X20-17627_8wekyb3d8bbwe",
        "fe8a6ffd-5cea-3b45-c290-237b7b5d0b8d",
        "Uyumluluk sorunlar",
        "98bac3d0-5c94-3ccb-0d08-9dc9f4ebd241",
        " istemcisinin beklenmeyen bir s",
        "ExitProcess",
        "969m9",
        "d014ba89-2113-549f-e903-917899af9aab",
        ";'<J<",
        "_^[Y]",
        "Microsoft.Windows.48.X19-99486_8wekyb3d8bbwe",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::EndOpenElement",
        "JHKT4-XDNYB-3G7J2-WKQJJ-D9MP2",
        "ullar",
        ".?AVCCompatProgressHandler@@",
        "UpdateMedia: Media Edition [%s] is not supported",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::PreInit",
        " installere oppdateringen, og brukeren skal ikke varsles.%0",
        "Failed to allocate new string",
        "DiskSpace",
        "b555f3ad-0c82-7545-070d-c305cbdc2d4f",
        "ffa41827-6786-a83d-931e-fa36567329b9",
        "<6<J<T<^<r<|<",
        "5W5^5h5",
        "verensst",
        "MoSetupPlatform: Determine if the expected version of Setup Platform has been loaded...",
        "n no puede continuar porque el comando \"finalize\" no puede reanudar la actualizaci",
        " platformy. Ov",
        ":D:g:",
        "Microsoft.Windows.100.X19-99450_8wekyb3d8bbwe",
        "Le fichier de configuration du programme d'installation est vide.%0",
        "MicrodomImplementation::CMicrodom::DecodeXmlString",
        "PWWhP",
        "3$4/4[4f4",
        "System\\Setup\\MoSetup",
        "hren eines Erfolgs-Skripts.%0",
        "0~0[0",
        "55199680-fe72-8ebd-1458-e6cd2a33ac17",
        "dd7ab89a-67fb-7dc9-69db-0245cc014681",
        "D$XAF",
        "Microsoft.Windows.99.X20-29689_8wekyb3d8bbwe",
        "whichDoc.Reserved == m_pTargetObject->m_LayoutCache.DocumentId()",
        "WF32N-224KM-4CK7R-PRPCJ-82R42",
        "565]5",
        "6+7x7",
        "CDlpActionDataMigrate::MigrateFlightData",
        "ImageDeploy: Initializing Wim Ref paths          [%ld] [%s]",
        ";!;=;\\;~;d?",
        "CDriverCallback::ValidateDriverPackage: GetDriverBlockType Failed. HRESULT = [0x%X]",
        ", lisans ko",
        "9H9a9",
        "DUImage: Initializing Wim Path:                  [%s]",
        "CoreConnected",
        "tott telep",
        "OutMut->Buffer = static_cast<BYTE*>(this->ReserveBytes(InBlob.Length, Alignment))",
        "no protocol option",
        "5R5s5",
        "Falha do execut",
        "1)1k1v1",
        "%CLOUD_N%",
        "2O3~3",
        "Microsoft.Windows.164.X21-06163_8wekyb3d8bbwe",
        "29fd1b73-4bc9-7058-e09b-b531de590179",
        "DiskSpaceInstallRequirement",
        "CDlpActionActivation::ExecuteRoutine",
        "Microsoft.Windows.8.X21-83709_8wekyb3d8bbwe",
        "m_StoredTable.Find(Pair, ppAttDef)",
        "not_connected",
        "y uszkodzone.%0",
        "Nem lehet l",
        "Setup",
        "686D6d6l6",
        " tietov",
        ".?AV?$CUnknownImpl@VIDlpActionFactory@@@@",
        "D$4PQ",
        "DUImage: Initializing Image Index:               [%d]",
        "Microsoft.Windows.101.X19-98875_8wekyb3d8bbwe",
        "Microsoft.Windows.21.X17-53890_8wekyb3d8bbwe",
        "uGj\\[",
        "Staged Image",
        "DiskSpaceDownloadReq: Initializing Storage Reserve Flag:   [0x%X]",
        "SetLastError",
        "50U0}0",
        "%BASE_K%",
        "MKWHN-783W8-GCGD4-9RTGW-W4YQW",
        "P3NRG-H2HT7-DD6YP-KHY4P-76F8D",
        "0c0f0",
        "PGXBY-RHNHX-P2BBF-8QHKT-4M47V",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::SetParameters",
        "_lock",
        "coreconnectedcountryspecific",
        "%wZ~%ws~%ws~%wZ",
        "tre signal",
        "Microsoft.Windows.180.res-v4257_8wekyb3d8bbwe",
        "n de desinstalaci",
        "serversolutionspremium",
        "KDPBN-MKMTM-VPQK2-PHVBV-9BT7B",
        "SETUPCORE.DLL",
        "ltigen Befehlszeilenargument gestartet.%0",
        "M33WV-NHY3C-R7FPM-BQGPT-239PG",
        "RtlReallocateUnicodeString",
        ":::@:L:i:p:",
        "it-IT",
        "1F2M2W2^2",
        "r versionen av verktyget st",
        "CQGKN-F7X3F-CPH37-BPHY6-8T3FD",
        "N7KWP-RFCTM-8TM42-HVPTC-9QBQD",
        "%hs: Window %s does NOT exist",
        "592e0b62-e6f8-0c3d-a440-dcf181e9b1c9",
        "GetWebSetupUserInput: Execute: Download Url X86 = [%s].",
        "Microsoft.Windows.101.X20-39245_8wekyb3d8bbwe",
        "949e350a-fe20-efa6-ed84-8db5fbfe883c",
        "ActionListFODPaths",
        "multi(%d)disk(%d)rdisk(%d)partition(%d)",
        "JGN9H-28H2K-DX3T6-XPQ7G-KTPJF",
        "1Q1p1",
        "PackageMigration: Initializing LXP License Paths    [%ld] [%s]",
        "D$0;D$(",
        "coreconnectedn",
        ".?AVCDlpActionCompat@@",
        "Target Image: Product Name = [%s]",
        "NYPVG-GFKXY-H6FKC-4JFGB-X4R9M",
        "tsprobleme wurden nicht innerhalb des erforderlichen Zeitlimits behoben.%0",
        "::RtlIsLUtf8StringValid(StringIn)",
        "NV8QP-FB7GV-PJP6F-WRCYD-7T9TP",
        " su cui ",
        "in uyumluluk taramas",
        ".?AVResultException@wil@@",
        "C9GCN-GP33R-D34V9-M79TW-DGQMX",
        "Proces instalace byl zastaven za ",
        "pHeader->ulOffsetToDomLayout < pHeader->ulTotalSize",
        "UltimateN",
        "8c9g9k9o9s9w9{9",
        "nda kullan",
        ".?AVICompatProgress@@",
        ": :=:Y:k:",
        "bc475ae6-b31b-abfa-f6d0-e11abbdcb82b",
        "EulaAccepted",
        "9/9`9",
        "Finalize: Error updating the setupplatform on enterprise attribution status: [0x%X]",
        "7(8/8|8",
        "Microsoft.Windows.122.X19-98684_8wekyb3d8bbwe",
        "nyzik egy sz",
        " parancsprogram v",
        "nytelen.%0",
        ":D:T:|:",
        "Microsoft.Windows.121.X21-03400_8wekyb3d8bbwe",
        "041F04B0",
        "DataMigration: skipping ReportId...",
        "Microsoft.Windows.48.X19-99646_8wekyb3d8bbwe",
        "CDlpActionProductKeyValidate::ValidateProductKeyFromPidGenX",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::GetError",
        "78NGV-VTM63-8V4QQ-PJ94G-D3W49",
        "=0=C=V=i=|=",
        "CheckHotPluggableDrive: Drive %c SetupDiGetDeviceRegistryProperty Error: 0x%X",
        "tl licen",
        "DataMigration: Queue preservation of locale [%s] into Target OS...",
        "TJ4JT-NPRW3-RKQXD-MY3F4-FC2HV",
        "DataMigration: Queue Request for OC replicaiton",
        "Microsoft.Windows.168.X21-83760_8wekyb3d8bbwe",
        "Microsoft.Windows.50.X21-83769_8wekyb3d8bbwe",
        "ServerEnterprise",
        "5^6t6",
        "0)0C0e0",
        "122561f8-f7a7-18b6-dab7-4743210fa142",
        "_vsnwprintf_s",
        "3v4}4",
        "91e47d5c-3682-de02-1231-2301ff9c9787",
        "8]9u9",
        "0:0D0",
        "Une erreur s'est produite et la valeur r",
        "4150c44c-9d12-9c18-d546-0f34cc826225",
        "Microsoft.Windows.121.X19-99462_8wekyb3d8bbwe",
        "XRTMN-66H4W-GD3K8-V93BK-XKXQ2",
        "JV34N-8GBMD-43J9Q-262CR-KBVKB",
        "SetFileSize failed",
        "Los problemas de compatibilidad controlada no se resolvieron en el plazo requerido.%0",
        "Microsoft.Windows.48.X20-44906_8wekyb3d8bbwe",
        "NtSetInformationThread",
        "FYGFT-4RNJV-8TWCQ-946FX-V24C9",
        "t=Wj,j",
        "5%5R5\\5",
        "CreateCompatibilityController",
        "=(=/=",
        "ProductKey: SelectImageIndex: Image index not found in response. Selecting image index from SkuLib.",
        " le d",
        "0C0A04B0",
        "Todav",
        "o aprova os requisitos m",
        "df92aad8-083d-b6d3-9a28-58243c359ef2",
        "tmhXU",
        "777e7{7",
        "PPNQJ-T6RG8-9MF42-TMMGX-8QK9D",
        "Microsoft.Windows.48.X19-99721_8wekyb3d8bbwe",
        "exploitation en attente d",
        "QM8CX-N29PT-FFFCD-BPJYC-CKCKY",
        "professionaleducation",
        "fr-CM",
        "CompatInstallReq: Initializing Selected Mig Choice:       [0x%X]",
        ":(:=:W:l:w:",
        "444J4n4u4",
        "ServerWeb",
        "PYDXP-3N9MD-7V6FJ-6VHDR-JHWG2",
        "0*151a1l1",
        "6NTQ8-YGP9M-B7GVF-P3G4B-F9FFK",
        "TlP0X",
        "Microsoft.Windows.182.X21-64698_8wekyb3d8bbwe",
        "The installation process was suspended.%0",
        "Der Benutzer hat die Ank",
        "coreconnected",
        "serverstorageexpress",
        "FACILITY_FWP_ERROR_CODE",
        "DebuggerOptions: Initializing Debugger Type:     [Serial]",
        "Ncknx",
        "Generating object GUID.",
        "b1318b8c-6398-2f0b-6011-dfcedfe81dd8",
        "&PWSV",
        "Microsoft.Windows.161.res-v3915_8wekyb3d8bbwe",
        "ProductKey: Extracting Eula",
        "CDlpActionFinalize::InitializeBootFinalize",
        ">>>I>g>",
        "kl-GL",
        "Microsoft.Windows.49.X19-98870_8wekyb3d8bbwe",
        "Microsoft.Windows.27.X19-98765_8wekyb3d8bbwe",
        "j\\Yf9",
        "%hs: Window %s exists",
        "CNRGM-9V26B-KVV9T-2KWCH-DRVYM",
        "onecore\\internal\\base\\inc\\blockpool.h",
        "\\0k0q0",
        "Not-null check failed: pStream",
        "nyt komentorivikomennon setup.exe kanssa scanonly-vaihtoehtoa k",
        "NRMFG-W72MC-YF83V-4KFM3-QRR86",
        "O ficheiro execut",
        "K8TDD-MNPB4-BCFYR-MGRD7-T3B6P",
        "D$$Ph",
        "RestoreReparsePoint",
        "Microsoft.Windows.101.X20-29688_8wekyb3d8bbwe",
        "s-ellen",
        "ringsoperasjon.%0",
        "cd07df8b-5588-d16d-da9f-e00ee19db594",
        "8 8(848T8\\8h8",
        "kleme giri",
        "TRUST_E_PROVIDER_UNKNOWN",
        " em falta uma tarefa necess",
        "797h7",
        "CN38Q-DDMD9-YD84K-2TMM6-4M47F",
        "De gebruiker heeft ervoor gekozen om te annuleren omdat het systeem niet voldoet aan de minimum vereisten voor het installeren van de update.%0",
        "Finalize: Requesting ASIMOV upload.",
        "3'3K3y3",
        "na odnale",
        "ne-NP",
        "El usuario ha elegido cancelar la publicidad.%0",
        "c639bfcd-f3b7-3969-788a-2014d1a430b4",
        "CDlpActionGetWebSetupUserInputFactory::CreateInstanceRoutine",
        "d3355629-a2a5-44dc-9a40-b5f105ced5c8",
        "Activation: Rescan was requested. ",
        "3ceea0c9-26bf-a96b-5f84-1b8a8c28bc01",
        "E_FAIL",
        ">.>?>q>",
        "MoSetupPlatform: Loading Setup Platform...",
        "=)=k=",
        "it ani zni",
        "3ac946b9-dc8a-8b18-a58e-0afdf520a14f",
        "Microsoft.Windows.101.X20-00912_8wekyb3d8bbwe",
        "Microsoft.Windows.4.X19-99698_8wekyb3d8bbwe",
        "Microsoft.Windows.48.res-v3623_8wekyb3d8bbwe",
        "mpningsskript kunde inte k",
        " peruutti toiminnon, koska laitteen levytila ei riitt",
        "Z9S4u",
        "5Fz<|",
        "QQPWQ",
        "A valid store must have a description key.",
        "=1=N=T=c=i=t={=",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionAdvertiseFactory@@VCDlpActionAdvertise@@@@",
        "TheElement != TheElement.InvalidValue()",
        ":;;[;",
        "26K99-N2H9H-VMBQB-6FMXX-GJHY6",
        "Could not parse {0}",
        "4 4$4(4,4044484<4@4T4X4h4l4p4",
        "PreFinalize",
        " GatherOsState ",
        "4`4g4n4",
        "0%0X0{1",
        "77380dff-e8d9-bb1e-3f5b-aa60fb7113ba",
        "ERROR_ADVANCED_INSTALLER_FAILED",
        "='=1=8=b=i=p=(>/>i>",
        "=&=@=G=a=h=",
        "Serversvaret har fel format.%0",
        " le Contrat de Licence Utilisateur Final dans le d",
        "PWDHN-MX39J-9HW2X-XHHFD-BHCF6",
        "Decoder != 0",
        "737>7Y7",
        "ImageFinalize: Initializing SQM:                              [%s]",
        "ParseChunkRegionInternal",
        "TGMNB-2M6M7-39WWG-MT7JH-6XYV4",
        "Microsoft.Windows.27.X19-98759_8wekyb3d8bbwe",
        "The system does not pass the compat scan to install the update.%0",
        "ProductName",
        "(Destination->Buffer != 0) || (Destination->MaximumLength == 0)",
        "DUImage: Error on downloading ImageDU Payload: [0x%X]",
        "5>6Y6",
        "Diagnoseobjektet ble ikke opprettet. Hendelser kan ikke rapporteres.%0",
        "Failed open key %ws. Status: %x",
        "Microsoft.Windows.164.X21-06155_8wekyb3d8bbwe",
        ";-;J;Q;_;",
        "dbaa08ca-3313-fcec-0eeb-9dbbe96f9636",
        "Xf9ABt",
        "5)5N5",
        "9JFKN-MWC8F-X8PVJ-RG34X-9HD27",
        "QW876-NFKK2-9CHBQ-4VK88-2GYP2",
        ".?AV?$CZeroInit@VCDlpActionFinalize@@$00@@",
        "Installationsprocessen blev afbrudt i fasen til afg",
        "SetupCore.pdb",
        "?4???p?{?",
        "fveapi.dll",
        "%s\\%s",
        "278b2aba-ff8f-1f88-1100-521fc69224d4",
        "Microsoft.Windows.7.X21-83410_8wekyb3d8bbwe",
        "mu nen",
        "InstallType",
        "9(9@9X9p9",
        "ExecuteInstallReq: Getting disk space requirement using fake drive letter [%c].",
        "o em disco para baixar e descompactar m",
        "WIM\\IMAGE[*]\\WIMBOOTENTRIES",
        "GetWebSetupUserInput: Selected Image Name From response = [%s].",
        "24W89-MNYP4-9GFRG-WPQK6-CG2RM",
        "1c24f3fd-13fd-69f6-af7d-8c7094ae83cc",
        "2B3I3`3>4E4",
        "8c35cf71-6e90-d725-f564-cc5476f4f121",
        "DUImage: Searching for FOD updates...",
        "Microsoft.Windows.48.X20-35540_8wekyb3d8bbwe",
        "1Q2t2",
        "DUImage: Initializing DU Categories OneSettings: [0x%X]",
        "::RtlIsLUtf8StringValid(Source)",
        "2.3F3y3",
        "%EDU_K%",
        "368WN-4TYJW-BKYFP-4WY9T-YG92J",
        "Microsoft.Windows.48.res-v3621_8wekyb3d8bbwe",
        "GetAclInformation",
        "totta a folyamatot, mert a rendszer nem felel meg a v",
        "fa-IR",
        "jFSVh",
        "BcdForciblyUnloadStore: Failed to acquire BCD sync mutant. Status: %x",
        "CDlpActionGetWebSetupUserInput::GetTargetUsbDriveFromResponse",
        "Brugeren har valgt at annullere, fordi systemet ikke opfylder gated-kompatibilitetsscanningen og kan derfor ikke installere opdateringen.%0",
        "r att ladda ned och packa upp media med flera arkitekturer.%0",
        "JN63M-337XK-M337F-9JMXV-CYWV7",
        "RFPF3-NWRDC-83K94-HQTKQ-KKXT3",
        "Windows::uDom::Rtl::RtlMicrodomUpdateGetCookieForExistingNode",
        "Microsoft.Windows.48.X19-99494_8wekyb3d8bbwe",
        "_wtoi",
        "1 181H1L1d1t1x1|1",
        "2Y2x2",
        "\\Windows",
        "IncrementFailedInstallCount",
        "9:9C9P9",
        "Die Serverantwort ist falsch formatiert.%0",
        "= >d>k>l?z?",
        "-eQkU",
        "RtlSetControlSecurityDescriptor",
        "DiskSpace: Creating new system (without ext drive)",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::Suspend",
        "99931c1e-6a0c-40b8-444d-43845d46fe7e",
        "MigChoice: Initializing Image Index:           [%ld]",
        "Microsoft.Windows.48.X19-99483_8wekyb3d8bbwe",
        "VMKVQ-3MN6B-BVM9F-YWV97-R9FCX",
        "c414312f-9f39-ba5f-88e0-ad2be072897a",
        "Compatibility: Polling scan timeout occurred.  Exiting.",
        "RtlIsMicrodomUpdateContextValid(HostUpdate)",
        "?w<t6",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::SerializeRoutine",
        "m nepro",
        "9A0vq",
        "KNWBR-KQ8FV-CKBJD-MT6B3-GF4TM",
        "JGP36-HCNXR-RG9F9-BYHGK-TF62C",
        "Microsoft.Windows.101.X19-99524_8wekyb3d8bbwe",
        "ServerHyperCore",
        "Process PID %d is accessing file wim %s",
        "I0G1-0+",
        " systemet til installationen.%0",
        "ca613cee-63d2-d117-d2d9-749ca40d624e",
        "<F=M=",
        "<.=m=",
        "DGN4F-YHHRJ-M8G6D-BDBHQ-XHJXP",
        "DUImage: Initializing payload LatentAcquisition",
        "Microsoft.Windows.101.X20-29630_8wekyb3d8bbwe",
        "Microsoft.Windows.21.X17-53891_8wekyb3d8bbwe",
        "<-=9=_=x=",
        "ea440f06-bbdc-759c-dd04-62b48509fbdd",
        "3(4}4",
        "DataMigration: Initializing SkipProductKey:                     [%s]",
        "Microsoft.Windows.101.X19-98871_8wekyb3d8bbwe",
        "76a2ce42-85ab-ec8a-90e7-cd49b1154e72",
        " ancora in attesa. ",
        "VYNPY-876CT-3WG64-6WQ6P-RVWWB",
        "33746b37-f700-e8e7-7ab4-2ceee74b20dc",
        "SLOpen",
        "The user has chosen to cancel because the system does not pass the compat scan to install the update.%0",
        "cfc37f1d-1833-57ff-7a27-1b58249cabd5",
        " jour. %0",
        "DUImage: Searching for critical updates...",
        "CDlpResponseAutomation::InitializeRoutineUpdateMedia",
        "WimMoveFile",
        "1!1R1",
        "vel de instala",
        "rFailed to set boot entry order. Status: %x",
        "Denne version af v",
        "!This program cannot be run in DOS mode.",
        "8*8T8_8",
        "MoSetupPlatform: SetupPlatform::INewSystem::ExecuteCurrentOperations returned: [0x%X]",
        "SBCDOBJECT=",
        "FRPMP-6DNPH-82MVV-BHKCD-G83F2",
        "62fdd55c-5b66-3d14-efac-fbb2188a43e5",
        "TMNBK-3YQQV-PQQFQ-JVKT3-KKXRQ",
        "re scanonly, ikke installere operativsystemet.%0",
        "ku-Arab-IQ",
        "9-9Y9@:y:",
        "83df3a6a-e0f7-a569-059e-0e03d1e2b2a2",
        "Automation: Registered SELECT_IMAGE Response",
        "r die Installation des Updates nicht bestanden.%0",
        "Microsoft.Windows.101.X20-29673_8wekyb3d8bbwe",
        "NewChild->Text.Allocate()",
        "4(404<4\\4h4",
        "Sikertelen volt a GatherOsState v",
        "C<+C(",
        "<<<J<",
        "L'utente ha scelto di interrompere il programma di installazione per mantenere attiva l'opzione di disinstallazione.%0",
        "v1j:Xf;A",
        "NewPcData = this->AllocateStreamObject()",
        "373=3I3]3d3",
        "serverwinsbv",
        "xRES_REQUIRED_RESOURCEID_MAP",
        "DiskSpaceReq: skipping FOD packages...",
        "0N1U1c1",
        "49765a7c-95da-e40f-561e-7cb508bac1f1",
        "697o7",
        "NewAttlistClose = this->AllocateStreamObject()",
        "FACILITY_RPC_STUBS",
        "f@f#E",
        "Microsoft.Windows.101.X19-99545_8wekyb3d8bbwe",
        "Microsoft.Windows.122.X20-29556_8wekyb3d8bbwe",
        "DataMigration: Initializing ProductKey:          [%s]",
        "?8???M?",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::Deserialize",
        "ActionableCompat",
        "GetWebSetupUserInput: Execute: Decryption key X86 = [%s].",
        "Microsoft.Windows.121.X19-98681_8wekyb3d8bbwe",
        "Windows::Rtl::IsValid(ptr)",
        "9r$tL;",
        "Systemet oppfyller ikke minimumskravene for ",
        "9e1dc9a5-0439-bee1-54b3-4a2308c67bb1",
        "Compatibility: Resolve requested. command: [%lu]",
        "DataMigration: Resurrect system for the installation process",
        "6-6J6",
        "SafeOSImageIndex",
        "GetProductInfo",
        "CMicrodomBuilder::ConsumeProcessingInstruction",
        "4?4J4",
        "6)6/6?6D6\\6j6",
        "OpenProcessToken",
        "RQ2HY-JWN2P-MDT3J-JHRCC-FYBPJ",
        "Reason",
        "QQQQQQQW",
        "me est n",
        "CloseHandle",
        "DeletePathEngine: Hit %d failure%s during recursive deletion of [%s]; 1st error = 0x%x, cd = [%s]",
        "9<:V:",
        "^[w\"QRW",
        "BTP36-XN8H8-DHX8Q-M3TYJ-9TQJJ",
        "ProductKey: Matching upgrade edition not found in SkuLib.",
        "0c076999-00bb-bb14-0b79-c5e89d0954bc",
        "e na disku za",
        "7R436-NJWQX-TJRKQ-THVC6-TJHW2",
        "Wykonywanie skryptu zwi",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionDiskSpaceReqFactory@@VCDlpActionDiskSpaceReq@@@@",
        ">>>q>",
        "757R7r7",
        "CDlpActionEula::DownloadEulaFromOnlineStoreUrl",
        "<!=,=G=M=n=y=",
        "%EDU_KN%",
        "Microsoft.Windows.49.X19-99518_8wekyb3d8bbwe",
        "1(1,101H1L1`1d1t1x1|1",
        "91a0152c-ad9e-064d-2615-4efb08100818",
        "T$(9GL|X",
        "][YZ_^_^[",
        "PerformSilentCleanup: TriggerStoragePolicies API call is not supported on below RS4 host machines",
        "GJHFP-N4CCY-9MV9W-D4H6J-GVFHR",
        "sta na disku.%0",
        "File[*]\\FilePath",
        "WilStaging_02",
        "0 0,080D0P0\\0h0t0",
        "CDlpActionImageDeploy::ExecuteRoutine",
        "ConX::Setup::Common::COSInfoHelper::GetHostSkuInfo",
        "n de Windows.%0",
        "m_AttdefListTable.FindOrInsertIfNotPresent( ulElementName, NewAttdefList, &pAttdefList)",
        "re filer til installationsplatformen. Kontroll",
        "O objeto de diagn",
        "NVM98-MRGJ2-6F4D8-XRK4D-BG92J",
        "LoadIntegrityInfo",
        "NtQuerySymbolicLinkObject",
        "1D2O2]2",
        "SetupCore: Registered COMPAT_SYSREQ action",
        "9X3DN-VGTCM-B4VV6-29VBJ-WB472",
        "Microsoft.Windows.100.X19-99454_8wekyb3d8bbwe",
        "Microsoft.Windows.27.X20-35525_8wekyb3d8bbwe",
        "171W1^1",
        "MC8P7-QXNC3-Y7MVX-9DYY6-VCFXC",
        "7d8q8",
        "849>9E9",
        "Kompatibilitetsproblemerne i forbindelse med download blev ikke l",
        "Q3NGT-DKTD4-TYMGV-WH8WG-4M47H",
        " el objeto de diagn",
        "Microsoft.Windows.125.X21-03403_8wekyb3d8bbwe",
        "b04eead7-dad3-0961-c56d-fd7fe680f17c",
        "ncia.%0",
        "ksynyt mainosta aikarajaan menness",
        "ProductKey: Genuine ticket generated         : [%s]",
        "oc-FR",
        ":<:G:y:",
        "G83W4-NH2PT-6GJR3-Y2P47-3J3XD",
        "Windows::uDom::Rtl::RtlMicrodomUpdateInsertChild",
        "333k3r3",
        "DataMigration: Initializing Host Settings:                      [%s]",
        "770dc8cb-e595-2700-dcfc-b5187c36c4f3",
        "f9a5716d-57b2-ceb3-93dc-b2edb5a0c489",
        "4o5y5",
        "HN3B3-X9PC6-GDTBF-T6M43-C37YQ",
        "uNj03",
        "tsprobleme mit dem Download wurden nicht innerhalb des erforderlichen Zeitlimits behoben.%0",
        "MFN9T-42MKQ-XF4VM-MC92T-C9XRX",
        "CompareStringW",
        "PackageMigration: Migrating LangPacks from [%s] into Target OS...",
        "1d670a88-9832-5763-9d70-cc806a1fbbd9",
        "ssel kapcsolatos kompatibilit",
        " dans un environnement de test. %0",
        "121=1n1y1",
        ">6?k?",
        "ProductKey: Product key edition does not match an install wim.",
        "9TMNP-6GTTJ-DQF6X-RR68K-GJF7J",
        "f0bebb66-5949-07d0-106e-e8c3b57663eb",
        "485v5s6",
        "Microsoft.Windows.101.X19-99544_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::GetState",
        "processorArchitecture",
        "Microsoft.Windows.126.X21-83271_8wekyb3d8bbwe",
        "WCBQD-VN8PB-FH2RR-WPFCX-3RTKM",
        "nda sona erdirildi.%0",
        ">$>*>L>R>t>z>",
        "ekirdek Eylemleri",
        "5R6n6",
        "STATUS_SXS_IDENTITY_DUPLICATE_ATTRIBUTE",
        "Target OS: Language = [%s]",
        "Microsoft.Windows.4.X19-99695_8wekyb3d8bbwe",
        "ExecuteDownloadReq: Using auto selected drive letter [%c].",
        "Microsoft.Windows.48.X20-35538_8wekyb3d8bbwe",
        "UpdateMedia: Error reporting telemetry for SkipUpdateSelected: [0x%X]",
        "[RS4]",
        "Microsoft.Windows.8.X21-83715_8wekyb3d8bbwe",
        "ringsskript kan ikke kj",
        ">(>.>",
        "es-DO",
        " Microsoft Corporation. Alle Rechte vorbehalten.",
        "Microsoft.Windows.122.X20-29554_8wekyb3d8bbwe",
        "WATSON_BUGCHECK_CODE",
        "PYT28-42NKJ-X68MD-2RBRC-27JVW",
        "Failed to acquire permissions to load hive. Status: %x",
        "Das System hat die Kompatibilit",
        "e chyb",
        "Microsoft Time-Stamp Service",
        "a8dee1a7-5ec1-0340-2be8-2993596fb45b",
        "XQQYW-NFFMW-XJPBH-K8732-CKFFD",
        "Failed to open object's key. Status: %x",
        "Microsoft.Windows.125.X21-83239_8wekyb3d8bbwe",
        "strncmp",
        "4PN9J-CYGQ9-GG23D-YQH87-JQKRF",
        "Microsoft.Windows.48.X19-98895_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X20-35463_8wekyb3d8bbwe",
        "HXQDV-NR47Q-98XPH-TGBKD-8K8VH",
        "212=2H2",
        "F3D28-2NW8J-KXMG3-4XK3H-G6QJC",
        "8H9r9",
        "Microsoft.Windows.27.X19-98753_8wekyb3d8bbwe",
        ";E;P;z;",
        "Microsoft.Windows.49.X20-29606_8wekyb3d8bbwe",
        "WIMSetFileShortName",
        "DiskSpaceReq: Rescan was requested",
        "Microsoft.Windows.161.X21-43637_8wekyb3d8bbwe",
        "7=8|8",
        "f92u9A",
        "VFFNY-J46DH-MDD2F-RCFMY-RC4CF",
        "<T<I=s=",
        "Microsoft.Windows.100.X20-29715_8wekyb3d8bbwe",
        "Systemet opfylder ikke kravene til det ",
        "CMicrodom_Blob",
        "Komentosarja ylitti aikakatkaisun rajan.%0",
        "%s /c",
        "MQNTW-4GRYT-YTQJ4-VKPBP-7CG36",
        "Failed open newly loaded key %ws. Flags: 0x%x Status: %x",
        "HNPWH-7Q7P8-GFH79-GKKD3-DV637",
        "ImageDeploy: Unknown BitLocker Mode: [%u]",
        " dost m",
        "RGPNR-HXPW8-JJ376-8T3YT-XQBPC",
        "UCS-4",
        "49c16db2-1499-6874-ebf0-2a9218cb4b37",
        "lle j",
        " sem espa",
        "*ppObject = State->m_pAllocator->Allocate<Actions>()",
        "ProductKey: Product key is invalid.",
        "PUBLIC",
        ";2<{<",
        ".?AVCDlpActionUpdateMedia@@",
        "UnmapViewOfFile",
        "XR8RN-MGCR7-R4QXC-9HK9T-8TYMK",
        "55c2861e-56fb-b50f-ae9b-b28ef094ad41",
        "Microsoft.Windows.100.X19-99443_8wekyb3d8bbwe",
        "Cf9Y*",
        "Microsoft.Windows.50.X21-83777_8wekyb3d8bbwe",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::GetActionName",
        "n inesperada de binarios de la plataforma de instalaci",
        "HeapSize",
        "NTGMV-YWGFF-8R6R6-QB63X-2YV74",
        "a229eea4-e845-d409-60b8-70e6d6f0e851",
        "Microsoft.Windows.7.X21-83408_8wekyb3d8bbwe",
        "ltig.%0",
        "FFPNR-W93H9-6VMTM-KR7PR-4X8WH",
        "tRPWhH",
        "ImageDeploy: Unknown BitLockerMode: [0x%X]",
        "de-CH",
        "Local\\SM0:%d:%d:%hs",
        " Microsoft Corporation. V",
        "Microsoft.Windows.165.X21-06170_8wekyb3d8bbwe",
        "FN9MV-2D8M3-F742C-W9RG2-TMT6G",
        "sr-Latn",
        "sti.%0",
        "Microsoft.Windows.100.X19-99661_8wekyb3d8bbwe",
        "Egy parancsprogram t",
        "|$ 9t$L",
        "131:1F1T1p1",
        "PerformSilentCleanup: Error reporting telemetry for OSPARTITION_FREESPACE_BEFORE_SILENT_CLEANUP: [0x%X]",
        "IsDebuggerPresent",
        "GetWebSetupUserInput: Drive [%c] has [%llu] MB of free space.",
        "<4=F=l=",
        "FveAddAuthMethodInformation",
        "The user has declined the license terms.%0",
        "Microsoft.Windows.48.res-v3309_8wekyb3d8bbwe",
        "f704d9e7-09b6-0d20-ecbd-f0c297d34f64",
        "CDlpActionGetWebSetupUserInput::GetOfferSelectionFromResponse",
        "Microsoft.Windows.164.X21-06152_8wekyb3d8bbwe",
        "</<;<C<W<`<|<",
        "ts.%0",
        "dataSetting",
        "eb12aaf7-39a6-b575-b6a3-324a0dfe04e2",
        "GetImageErrorCode",
        "Microsoft.Windows.48.X20-35541_8wekyb3d8bbwe",
        "The system does not pass the device scan to install the update.%0",
        "7614b798-afd7-e298-bef4-117b3f43a06d",
        "131:1",
        "Der Benutzer hat die Befehlszeile von ",
        "Failed to update object GUID string. Status: %x",
        "MoSetupPlatform: Setup Platform object released!",
        "en-CA",
        "6#6E6L6n6u6",
        "6?6R6",
        "222W2~2",
        "CDlpActionCompat::ExecuteFinalizeReqScan: Enter",
        "5(6h6",
        "WWV8W-G3NHT-DBH8Y-W89DW-BWQ96",
        "RequiredFreeDiskSpace",
        "ImageFinalize: Initializing Scenario:                         [%d]",
        "STATUS_NOT_SUPPORTED",
        "OpenProcess",
        "DUImage: Initializing DUOptIn:                   [%s]",
        "=!===M=S=i=",
        "MeteredNetwork",
        "8J8RJ-NCJGX-YDVVC-QPXYD-M7VYJ",
        "CDlpActionDataMigrate::InitializeRoutine",
        "Microsoft.Windows.121.X20-00861_8wekyb3d8bbwe",
        ";6<W<]<z<",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::Initialize",
        "Microsoft.Windows.122.X20-00862_8wekyb3d8bbwe",
        "RNB93-FKP46-P23DM-M7CFR-R3KVB",
        "eny.%0",
        "[ybVhl",
        "DUImage: Initializing Mig choice:                [%d]",
        "61c4886e-2df5-c1ea-7057-e50caa6036da",
        "a57991b8-7a5d-0374-d74a-549c44fb5360",
        "L'utente ha scelto di annullare per la pubblicit",
        "FF69K-FWN4P-P3HHJ-MJY6B-PR4W9",
        "TerminateProcess",
        "SetThreadToken",
        "8$84888<8T8X8p8",
        "zh-hk",
        "s$97t",
        "RestoreSecurityDescriptor failed",
        "c7abc2eb-16ee-c3a7-24f4-069c4f1c7db8",
        "6-7W7^7k7{7",
        "b2ddb48a-79ca-f211-b367-06ab0f603ea9",
        "2db43247-133a-f40d-c76f-b3e0c867b3ad",
        ">!>2>6><>@>R>V>\\>`>f>j>p>t>z>~>",
        "GetBitLockerKeyFromUI: Attempting to get a bit locker key from the user.",
        "2B87N-8KFHP-DKV6R-Y2C8J-PKCKT",
        "SVhh\"",
        "CDlpActionDiskSpaceReq::GetFakeDriveLetter",
        "acfc3d58-f71f-80e6-3f86-3fc4febb7226",
        "tt, hogy nem fogadja el a licencszerz",
        "0A0L0x0",
        "tn-BW",
        "%08lx",
        "vel da instala",
        "0'1X1_1",
        "no_protocol_option",
        ";6;A;k;v;",
        "2<2D2L2T2\\2h2",
        "CreatePath: Unable to create parent directory for [%s]; GLE = 0x%x",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::Resume",
        "DataMigration: Initializing bSkipOCMigration:                   [%s]",
        "RMMRN-9B43V-4DYBD-P2RFT-BP2J6",
        "TelemetryAssertDiagTrack",
        "t5QQj",
        "9_:l:",
        "DUSetup: Action List Path [%s]",
        "2/3B3q3x3",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionActivationFactory,class CDlpActionActivation>::GetActionId",
        "4268aeb2-8195-756d-3e7a-4fffc033198a",
        "Die Probleme mit dem Downloadspeicherplatz wurden nicht innerhalb des erforderlichen Zeitlimits behoben.%0",
        "r tomt.%0",
        "Microsoft.Windows.7.X21-83731_8wekyb3d8bbwe",
        "24WMH-RNHKB-7M29G-BH8RX-9HKC2",
        "6.6O6_6",
        "_purecall",
        "44NYX-TKR9D-CCM2D-V6B8F-HQWWR",
        "CDlpActionDiskSpaceReq::PerformCleanupTask",
        "3K4f4",
        "Arresto anomalo del processo di installazione.%0",
        "WIMCreateFile",
        "CompatInstallReq: Initializing Server Image:              [%s]",
        "n_0W0f0D0j0D0_0",
        "10f0a177-c463-6079-3a18-4c5011b68ddd",
        "WimPath",
        "GetVersionExA",
        "sw-KE",
        "Attempting to determine owner of file %ws.",
        "38bbfe2d-9efb-c214-3a60-1944bbba47f9",
        "2h3y3",
        "MicrodomImplementation::CMicrodom::IRtlMicrodom_Cast",
        "0L0zzg0Y0",
        "200304183039Z",
        "Exporting forcible unload to firmware",
        "Microsoft.Windows.184.res-v4258_8wekyb3d8bbwe",
        "3&3A3F3V3",
        "Microsoft.Windows.50.X15-55273_8wekyb3d8bbwe",
        "<L<s<",
        "MigrateReservesActiveScenario",
        "TlsGetValue",
        "040C04B0",
        "mite de tiempo necesario.%0",
        "DUSetup: Initializing Du OptIn Default:  [%s]",
        "Microsoft.Windows.4.res-v3288_8wekyb3d8bbwe",
        "B8WN4-J77KP-X4JC3-KYM43-MDWWH",
        "DequeueWimData",
        "Failed to open key for all objects. Status: %x",
        "? ?$?<?L?\\?l?p?t?",
        "Microsoft.Windows.7.X21-83409_8wekyb3d8bbwe",
        "Gereken kriterleri kar",
        "Msg:[%ws] ",
        " pakietu.%0",
        "ProductKey: Host OS install channel is [%s].",
        "Microsoft.Windows.50.X21-83782_8wekyb3d8bbwe",
        "Target OS version: %u.%u.%u.%u",
        "o em disco de instala",
        "ad9169ca-526d-6e3f-44df-c5ce7fa59a5c",
        "TN83Y-KKVQK-YJKVD-FVWY6-BP2TB",
        "cloud",
        "Failed to populate install actions from {0}",
        "RollbackType",
        "rdes inte inom den aktuella tidsgr",
        ":yg0M0~0[0",
        "t$X9u t",
        "STATUS_REQUEST_OUT_OF_SEQUENCE",
        "Microsoft.Windows.101.X20-29718_8wekyb3d8bbwe",
        "Konfigurer kernehandlinger",
        "DiskSpaceInstallReq: Initializing Host Settings:                [%s]",
        "=d>v>",
        "LSVW3",
        " inesperadamente.%0",
        "gn-PY",
        "Microsoft.Windows.4.X19-98708_8wekyb3d8bbwe",
        "MigChoice",
        "o anterior ainda est",
        "VK7JG-NPHTM-C97JM-9MPGT-3V66T",
        "SetFileStorageTierClass",
        ";A<H<Y<`<",
        "(Properties.Elements != 0) && (Results.Elements != 0)",
        "f7410cd5-3eeb-a9ad-4d06-5999a92dbb46",
        "47e7c4d5-a35d-77c4-569b-c36be722d94f",
        "kalun versiota ei tueta.%0",
        "serverdatacentercore",
        "Not-null check failed: szWin32FilePath",
        ".?AVCDlpActionDataMigrate@@",
        "08a801e7-4b3e-2a0b-3cf9-29ce49d0499b",
        "4fce82c6-67c2-783a-4544-6921fc261ffa",
        "s telep",
        "5983fd49-281c-c2ae-78cc-e056b181ccd7",
        "s nem tudja folytatni az el",
        " konfigur",
        "Microsoft.Windows.8.res-v4308_8wekyb3d8bbwe",
        "95d6ed1d-d321-2f47-08f2-7c828399cd04",
        "JFJ6N-XWR98-8F389-WBV6G-6846B",
        " il dispositivo non dispone di spazio su disco sufficiente per il download.%0",
        "Kurulum Platformu ikili dosyalar",
        "MicrodomImplementation::CreateBinaryMicrodomFromXml",
        "9 9,989D9P9\\9h9t9",
        "=-=o=5>?>Y>",
        "Microsoft.Windows.136.X21-98319_8wekyb3d8bbwe",
        "4(4L4T4\\4d4l4t4|4",
        "res.%0",
        "o foi executado com um argumento de linha de comandos inv",
        "Microsoft.Windows.98.X20-39256_8wekyb3d8bbwe",
        "MoSetupPlatform: Creating Setup Platform object...",
        " Microsoft Corporation. ",
        "CreateSemaphoreExW",
        "DUImage: Loading Facilitator.dll",
        "El usuario decidi",
        "492eee7d-f896-233f-ab18-2cb6d18f586a",
        "ProductKey: Getting Host OS install channel for telemetry.",
        "Microsoft.Windows.49.X19-98897_8wekyb3d8bbwe",
        "RtlCompareEncodedLBlobs",
        "ImageDeploy: Initializing RollbackType:          [%d]",
        "$SVWh",
        "SizeofResource",
        "VVVjd",
        "333T3",
        "m_AttdefListTable.Initialize()",
        "9`:|:",
        "WIMCopyFileEx failed",
        "4118aaa1-c76a-697b-6184-3632c5a29927",
        "vel continuar com a instala",
        "ImageDeploy: Initiate installation(image deploy) of the operating system",
        "464A4m4x4",
        "363I3U3h3o3t3}3",
        "RNWQJ-2JWM6-C7V2C-9HQWQ-RJRBR",
        "RestoreHardlinks",
        "SYSTEM\\Setup\\MoSetup",
        ">'>:>M>`>s>",
        "ndig ",
        "xM9sdtF",
        "Not extracted",
        "_vscwprintf",
        "Incorrect filesize. Could be corrupted",
        "c83d313f-6691-09a3-6f72-37ad3d366770",
        "o cumpre os requisitos de espa",
        "XPDNH-BD66B-HG77G-F79HF-FC4BV",
        "Sistema operativo Microsoft",
        "Une version inattendue du client Agent de mise ",
        "CheckHotPluggableDriveEx: Drive %c SetupDiEnumDeviceInterfaces Error: 0x%X",
        "NtAdjustPrivilegesToken",
        "f97eff2a-19bf-788f-1fa6-45cb7bd06bc3",
        "%c:\\Windows",
        "QXV7H-NV2J3-2V68C-FB2WD-Y4HKD",
        "07fde8dc-7c6a-1d7b-843e-c4a298e07df5",
        " necessario riavviare il sistema.%0",
        "Microsoft.Windows.121.X20-29614_8wekyb3d8bbwe",
        "Not-null check failed: Matches",
        "De installatie kan niet worden voortgezet omdat het systeem onvoldoende schijfruimte heeft.%0",
        "CDlpActionDU::SerializeDUImage",
        "535Q5h5u5{5",
        "Microsoft.Windows.99.X19-99655_8wekyb3d8bbwe",
        "r~akow",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::GetProgress",
        "88GNY-7733F-RM7MM-KY2XT-J2R7Y",
        "22d29407-aae7-2ccc-5818-7cd0b941ad8e",
        "Telemetry=%s",
        ".?AV?$CUnknownImpl@VIDiskSpaceAction@@@@",
        "Havaittiin p",
        "BUCL::Rtl::Increment(m_NextStringId)",
        "fc2d7bfe-07bc-4ea7-1abb-21f0b5ce4cfc",
        "d40739c4-a65b-6201-d504-c97739f0ff53",
        "not connected",
        ";E<U<w<",
        "CMicrodomUpdateContext::GetNodeUpdatePtr",
        "PWWWV",
        "Compatibility: Compat state changed or Rescan requested.",
        "onecore\\internal\\sdk\\inc\\wil\\opensource\\wil\\resource.h",
        "Bugcheck param 3",
        "ProfessionalWorkstationN",
        "4eb5da3f-6f38-0df1-a18f-00ef84f3bdd1",
        "RtlSetOwnerSecurityDescriptor",
        ":>:S:Y:v:",
        "1c8d7df0-fe5a-f4e6-5f7d-70feb6b93fbc",
        "turulam",
        "N6738-PV7HR-YRW62-6QQ6P-W2RFK",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::GetResultsRoutine",
        "Finalize: Error reporting downlevel time(ASMV): [0x%X]",
        "D84KV-7NXJR-FTWTG-GYYXG-D3WXM",
        "System32\\hal.dll",
        "CallTriggerStoragePolicies: Uninstall period is inactive",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::Deserialize",
        "2E2P2|2",
        "ProductKey: Initializing Partner ID:         [%s]",
        ";';/;<;D;Q;q;y;",
        "9PCFV-XNFWP-HFM8J-4DGG4-MWRT6",
        "n nincs el",
        "bban elind",
        "MoSetupPlatform: ReleaseSetupAutomation called with invalid suspend path: [%s] err = [0x%X]",
        "El ejecutable GatherOsState tiene una firma no v",
        "%u.%u.%u.%u",
        "No se puede mostrar el informe de compatibilidad debido a que falta un componente del sistema.%0",
        ";L;/<e<",
        "Finalize: Error getting diagnostics for extracting correlation vector",
        ".?AVCDlpActionProductKeyValidate@@",
        "0*0f0",
        "ZwQueryBootOptions",
        "Microsoft.Windows.4.X20-00861_8wekyb3d8bbwe",
        "PN4GV-KP7DG-629XG-VDXJB-CWF9Q",
        "tOf97tJh",
        "DiskSpaceReq: Checking disk space req with storage reserves",
        "10a604d9-3ceb-166f-3f1a-9b1ea3cf4f33",
        "FNK3C-V7RCJ-CMMJW-QMG7J-J8F9G",
        "MBCYQ-QPNYT-WGFM7-2VD39-XKYC4",
        "App.Support.ContactSupport~~~~0.0.1.0",
        "<#<,<1<;<@<j<",
        "Microsoft.Windows.49.X19-99723_8wekyb3d8bbwe",
        "WdsSetupLogInit",
        "Microsoft.Windows.161.X21-43628_8wekyb3d8bbwe",
        ">;?Z?}?",
        "2CTP7-NHT64-BP62M-FV6GG-HFV28",
        "TV4D3-R2NC9-QQHB7-GDDY4-MWRDF",
        "EnumeratePathEx: Failed search path is >= MAX_PATH!",
        "Microsoft.Windows.49.X20-29568_8wekyb3d8bbwe",
        "De gebruiker is niet binnen de vereiste tijdslimiet akkoord gegaan met de gebruiksrechtovereenkomst.%0",
        "si folyamat tesztk",
        "Microsoft.Windows.146.X21-83743_8wekyb3d8bbwe",
        "BTQTW-N6VJB-63M8G-PHQ77-GCQGG",
        "0D0l0t0|0",
        "Brukeren har ikke godtatt annonsen innen tidsfristen.%0",
        "9230d783-86a3-ca6a-c43f-0b2f11aaafd3",
        "69790082-fefa-9083-07b7-b64bc49b3ab1",
        "SkipInstallingWinRE",
        "losti nen",
        "GetWebSetupUserInput: Execute: Decryption key X64 =[%s].",
        "V instalaci nelze pokra",
        "~(9~0t",
        "L$$RP",
        "Microsoft.Windows.50.X17-54017_8wekyb3d8bbwe",
        "velete m",
        "68430125-aa01-6889-4463-d37f936993e0",
        "CMicrodomBuilder::CNamespaceNamePrefixToAttDef::Find",
        "CDlpActionMediaCreationSuccess::ExecuteRoutine",
        "XmlParserGenerator::ParseLString",
        "ERROR_INVALID_DATATYPE",
        "349dd569-36a4-3bbf-955f-b93781abcc64",
        "Los archivos de carga estaban da",
        "jnh`u",
        ";';L;",
        "Microsoft.Windows.48.X19-98849_8wekyb3d8bbwe",
        "CDlpActionPackageMigrate::CancelRoutine",
        "V36XB-NDXCJ-PMGXD-XRYQQ-9764D",
        "TMYNM-76HXQ-6BJBF-78X8H-6XXQY",
        "e70e22bd-6461-8e74-dc56-2bb33da5d533",
        "0(u6b",
        "ProfessionalCountrySpecific",
        "rique pour l'installation de la mise ",
        "DataMigration: Migrating Reserve Manager Active Scenario Key [%d].",
        "ZwAllocateUuids",
        "3a24c78c-0ab2-b88d-d8b2-b7207b9cacad",
        "onecore\\base\\lstring\\lutf8_string.cpp",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::GetResults",
        "T9GNW-2WKYM-KC92M-DCM9T-YG9RR",
        "CDlpActionAdvertise::DeserializeRoutine",
        "526m6",
        "CDlpActionDU::GetResultsDUImage",
        "SYSTEM\\Setup\\MoSetup\\Volatile\\Telemetry",
        "WATSON_BUGCHECK_P4",
        "Microsoft.Windows.121.X21-03402_8wekyb3d8bbwe",
        ";$;+;7;H;\\;~;",
        "CDlpActionDataMigrate::ResumeRoutine",
        "dddb0dcc-2689-87db-8735-56d6fcb40696",
        "CBasicNodeType::ChangeName",
        "N79KC-MKD68-96QY3-CPRFC-RVV3G",
        "NQTH4-KK96T-T4W27-KYP3C-JB47T",
        "ActionListParser::ParseRemoveFeature",
        "c1c30bf9-e872-8af2-d965-b2da3569a7fa",
        "cutable d'installation n'a pas ",
        "=;>V>",
        "KNRWR-JTCF6-8636P-9YRD7-JQKTG",
        ".?AV?$CZeroInit@VCDlpActionRecoveryFactory@@$00@@",
        ">B>M>",
        "tta eftersom systemet inte har n",
        "BUCL::Rtl::Add(pCachedInfo->m_ulChildCount, pCachedInfo->m_ulAttributeCount, cNecessary)",
        "3f16486b-2c5a-992d-adaa-be22078fcef1",
        "BMRN3-KDT93-FTPHK-HY9JM-3GP22",
        "Diese Version des Tools wird nicht unterst",
        "26fe1901-4a72-733a-8c9e-b51fa7914459",
        "9F sN",
        "7dee2a4c-8763-cec6-729b-0b97405c8c55",
        "De installatie kan niet doorgaan omdat er een vereiste taak ontbreekt.%0",
        "ab2a6bb9-0cb3-6ada-906b-203f943992f3",
        "343u3",
        "P6DH4-PHNT4-V32D6-TBP2T-WXCKD",
        "379756f2-d69b-3534-5985-1ca572e6c0c4",
        "JMGNM-VTCK8-VTP9W-CYHBD-TCRBY",
        "CDlpActionUpdateMedia::ExecuteRoutine",
        "NotificationBttnClicked",
        "9)9a9",
        "es-HN",
        "e4f31708-93c5-4e9a-d87d-766826162afa",
        "ImageExit: Initializing SetupResult: [0x%x]",
        "Microsoft.Windows.48.X19-98813_8wekyb3d8bbwe",
        "The user has chosen to cancel as the device does not have enough disk space to download.%0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::GetSerializeOnProgress",
        "fmalloc failed",
        "e syst",
        "The GatherOsState executable has failed to execute.%0",
        "da54096b-9ded-b28f-34ae-1b948d890ccf",
        "cutable GatherOsState.%0",
        "0bbfca56-176a-6e92-d966-4689118aff8f",
        "L$,!t$0!t$4",
        "tte, fordi der mangler en n",
        "Microsoft.Windows.122.X20-29611_8wekyb3d8bbwe",
        "2.3d3n3",
        "96178c45-7dc6-2b8c-33ea-2ec619101cc3",
        "3$3,343<3D3L3T3\\3d3l3x3",
        "DiskSpaceInstallReq: Initializing RecoveryOption:               [%d]",
        "5 696N6m6",
        "4\"5[5",
        "DownloadSize",
        "0<0H0h0p0",
        "=1=;=",
        "r installationen.%0",
        "pToInsertInto->Element != 0",
        ".?AVCDlpActionCreateMediaSuccessFactory@@",
        ".?AV?$CZeroInit@VCSetupCore@@$00@@",
        "e1e897c9-4b68-101f-9172-2021a1f23455",
        "o em disco suficiente para a instala",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::CheckUserInterruptEx",
        "tRSV3",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::Pause",
        "4-4J4`4m4z4",
        "DiskPartitionAutomation",
        "viin telemetriatietoihin.%0",
        "62db884e-f008-a5ed-e498-89f646cb91c7",
        "Microsoft.Windows.49.X19-98825_8wekyb3d8bbwe",
        "#wXsA",
        "CDriverCallback::ValidateDriverPackage: We want to migrate this package. Returning proposed answer. {7EFC331C-A8DD-4DDA-8601-005B2520F06A}",
        "t beti",
        "DTYHP-NF3K3-FCBTF-HF4K6-CGT97",
        ".\\%s\\%s.mui",
        " supportata.%0",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteText",
        "IsDriveLetterSupported: Drive [%c] is supported",
        "9288c808-ca41-0745-1773-7825ff6be5f8",
        "*ppObject = State->m_pAllocator->Allocate<RemovePackage>()",
        "Un'operazione di pulizia di un tentativo di installazione precedente ",
        "FveCheckSuspendBitLockerOnUpgrade",
        "CDlpActionFinalize::PauseRoutine",
        "6fa07987-6297-adbb-4774-2a8bcc37b313",
        "FACILITY_ACPI_ERROR_CODE",
        "t;Sh<",
        "0S0h0L0g0M0~0[0",
        "DebuggerOptions: Retrieving BCD settings interface...",
        "DiskSpaceReq: Migrating FOD packages from [%s] into Target OS...",
        "271fba0f-bf4c-71a5-d49d-26382a6e9fbd",
        "j Yf;",
        "3$5U5z6",
        "The user has use the setup.exe command line to do scanonly, not to install the OS.%0",
        "9L:S:r:y:",
        "NTRHT-XTHTG-GBWCG-4MTMP-HH64C",
        "Microsoft.Windows.21.X17-53888_8wekyb3d8bbwe",
        "9097772d-87a2-1e80-ad0d-705e334c8cfc",
        "9#989B9I9s9z9",
        "Microsoft.Windows.8.X21-83708_8wekyb3d8bbwe",
        "%hs: Registry value 'CSDBuildNumber' is not the correct type (REG_SZ).",
        "D0K0U0",
        "ersiz.%0",
        "Microsoft.Windows.121.X20-21794_8wekyb3d8bbwe",
        "Target OS: Error retrieving upgrade flags! [0x%X]",
        "trehozni vagy megsemmis",
        "435>5E5v5}5",
        "3c538bb8-b3a9-e4f0-4cff-ec74e901da81",
        ".?AV?$CZeroInit@VCMoSetupPlatform@@$00@@",
        "PackageMigration: Initializing FullUpgrade:         [%s]",
        "598e6490-d22d-94d1-9564-552305cbe0fc",
        "2NJR4-TQ688-4X24Y-KRPQ7-8HQKF",
        "1cdbd138-173b-e306-bb7f-783f452e16a8",
        "0%0-0W0r0",
        "(SVW3",
        "0-NbkW0f0",
        "2+3M3k3",
        "41045f1a-546c-1f08-d720-fa23e6472a06",
        "Systemet uppfyller inte diskutrymmeskraven f",
        "CDlpActionDataMigrate::MigratePrivacyConsentOption",
        "N:Nzz",
        "021=1i1t1",
        "Microsoft.Windows.8.X17-66950_8wekyb3d8bbwe",
        "%wLtC",
        "0f0O0`0U0D0",
        "ExecuteInstallReq: No response registered.",
        "1/2u2|2",
        "HNFWK-JGCHR-B4RWK-VVV2K-MG9RY",
        "msvcrt.dll",
        "HK38N-M79BP-C7GMX-8MDT8-PKFBQ",
        "The requested attribute value can not be determined at the current stage of the update.%0",
        "n asennuksen sijaan.%0",
        "CDlpActionAdvertise::ExecuteRoutine",
        "truire le message de blocage d'arr",
        "FALSE",
        "CDlpActionProductKeyValidate::SearchForEICfgFile",
        "?$?4?8?<?@?D?H?L?`?p?t?",
        "N2VCT-KTCCY-CFC8F-DGR7J-J8BRC",
        "MigChoice: Selected install choice is not available.",
        "tdj;^",
        "<1<k<",
        "gamecorexbox",
        "<I=r=",
        "?0?@?D?H?`?p?t?",
        "WVCX3-RN4GC-FMXF7-DX9W6-683GQ",
        "3N7M4-4RGV9-B4T2Q-HFFJ3-DV8XD",
        "L'eseguibile GatherOsState ha una firma non valida. %0",
        "sma-NO",
        "L'utente non ha accettato le condizioni di licenza. %0",
        "y rozwi",
        "CompatInstallReq: Initializing Wim Path:                  [%s]",
        "CDlpActionCompat::InitializeSysReqScan",
        "2+333S3",
        "24a98d5c-1d36-cf62-1f12-511b41312ea0",
        "Skript p",
        "PWSWWWhp)",
        ",0P0W0",
        "ReturnHr",
        "I_RpcMapWin32Status",
        "\\Registry\\Machine",
        "Identity contains invalid public key token: %*.*ws.",
        "080{0",
        "3k3|3",
        "Failed to bind with firmware. Flags: 0x%x Status: %x",
        "QWKN2-3YTY9-PBQ7D-GKH9B-KD84K",
        "Microsoft.Windows.49.X19-98823_8wekyb3d8bbwe",
        "D$\\x3",
        "63778J8d8k8",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::Pause",
        "file exists",
        "SYSTEM\\CurrentControlSet\\Control\\SystemInformation",
        "Microsoft.Windows.171.X21-24737_8wekyb3d8bbwe",
        "leme i",
        "YN79T-WVGKW-B83DY-7V74T-BP2HM",
        "Installationen afsluttede uventet.%0",
        "si probl",
        "CreateSetupObject",
        "54945600-72ed-bcbe-680f-7f6effef20a0",
        "tg0o0",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionDiskSpaceReqFactory,class CDlpActionDiskSpaceReq>::SetActionId",
        "L'utilisateur a choisi d'annuler l'op",
        "e0b050c8-102d-04b7-ebd1-93f33eb61adf",
        "Microsoft.Windows.8.X21-83695_8wekyb3d8bbwe",
        "nOa-Q",
        "DUImage: Initializing DU Categories Cmdline:     [0x%X]",
        "iotenterprise",
        "Brugeren har ikke accepteret annoncen inden for den p",
        "FltCommStubCreateChild",
        "DJTP2-NR4TF-4J2G8-9CWD8-KY9XY",
        "u6f9s",
        " jour a ",
        "NewElement = this->AllocateStreamObject()",
        "Facility=",
        "L$(@;E",
        "in gereksinimleri kar",
        "Microsoft.Windows.126.X20-35530_8wekyb3d8bbwe",
        "Microsoft.Windows.48.X20-29660_8wekyb3d8bbwe",
        "inden y",
        "CDlpActionCompat::QueryInterface",
        "n de Windows no se puede atender actualmente.%0",
        "Microsoft.Windows.162.X21-43643_8wekyb3d8bbwe",
        "776e3901-f67f-94a0-ea40-868122ec43c1",
        "FDBNB-3GM37-BXTD6-3TKP3-JTTTC",
        ";8<E<o<",
        "Microsoft.Windows.48.X19-99480_8wekyb3d8bbwe",
        "o Desinstalar ativa.%0",
        "DKNFQ-2YGFM-83D78-CJWXM-G3CQH",
        "7YNQP-BP4FG-J2QQB-WHMJK-6CR9H",
        "c94a9a81-515a-7e6e-1dcd-3253dcf89172",
        "j\\^f;",
        "7\"7*70757=7C7H7N7V7^7j7p7v7|7",
        "3%353D3P3_3k3z3",
        "Microsoft.Windows.121.res-v3280_8wekyb3d8bbwe",
        "Microsoft.Windows.122.X19-98694_8wekyb3d8bbwe",
        ".?AVIDlpAction@@",
        "rinstallationsskript kunde inte k",
        "708c6549-a29c-7045-eb72-d1a0b6123156",
        " hetkell",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::SetProgress",
        "GetFileSizeEx",
        "?(?8?<?L?P?`?d?|?",
        ";.;C;J;^;d;k;",
        "ksyy k",
        "c915e695-b9e4-451f-c1d5-3f1933f6933a",
        "8/9M9",
        "SYSTEM\\Setup\\Rollback",
        "NWVJP-VTWVQ-PBFHB-YPW9C-7CFDD",
        "gbar.%0",
        "6U7_7",
        "fb3eb62f-01d8-c265-a156-848c4fa1e035",
        "*ppObject = State->m_pAllocator->Allocate<DownloadPackage>()",
        "CDlpActionDataMigrate::MigrateRecoveryImage",
        "fr-MA",
        "Microsoft.Windows.101.X20-29686_8wekyb3d8bbwe",
        ":0:H:`:x:",
        "TVDC8-KNMC7-C3T67-B6XFQ-9D9WB",
        "Microsoft.Windows.122.X20-35512_8wekyb3d8bbwe",
        "CDlpActionDiskPartition::SearchForValidBitLockerKey",
        "WTHelperGetProvSignerFromChain",
        "Microsoft.Windows.48.X20-35602_8wekyb3d8bbwe",
        "or-IN",
        "no message available",
        "ytkownik nie powinien by",
        "NetNoDHCP",
        "my se spln",
        "k gereksinimleri kar",
        "Eine unerwartete Version des Update-Agent-Clients wurde erkannt.%0",
        ".?AV?$CZeroInit@VCMoSetupCompat@@$00@@",
        "??0exception@@QAE@ABQBDH@Z",
        "b5f617a8-0907-c367-5287-06108080b597",
        "Microsoft.Windows.98.X19-98665_8wekyb3d8bbwe",
        "serverstandardvcore",
        "bu prost",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionDUFactory,class CDlpActionDU>::CreateAction",
        "ydy.%0",
        "9\\$Lt",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "pDomLayout->ulSignature == ('lDdM')",
        "Microsoft.Windows.4.X19-99704_8wekyb3d8bbwe",
        "Microsoft.Windows.49.res-v3320_8wekyb3d8bbwe",
        "Failed to set description key value. Store: %s StoreKey: %ws Status: %x",
        "GetWebSetupUserInput: HostOs Edition=[%s].",
        "MoSetupPlatform: GetSetupPlatform failed: [0x%X]",
        "j:Xf;F",
        ">&>.>N>S>r>~>",
        "2df27219-ed55-9e0b-ed96-8e25f148168b",
        "installation a rencontr",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing\\Features on Demand\\Removed FOD Markers",
        "9764e6ef-c702-e9f4-09f1-a30c6a6bbf09",
        "gatherosstate.exe",
        " (Microsoft Corporation). ",
        "Microsoft.Windows.98.X20-00908_8wekyb3d8bbwe",
        "RtlHashEncodedLBlob",
        " Update Agent.%0",
        "Microsoft.Windows.49.X19-98856_8wekyb3d8bbwe",
        "rt inden for den kr",
        "9%8YWDQ",
        "Cache",
        "QPSVW",
        "Microsoft.Windows.99.X20-29708_8wekyb3d8bbwe",
        "s rendszer",
        "9O:$;1;[;f;",
        "?(?G?i?",
        "lni kell a telemetriai elemz",
        "tt-RU",
        "STATUS_OBJECT_PATH_NOT_FOUND",
        "DUImage: Searching for driver updates...",
        "OfflineGather",
        "ReleaseSRWLockShared",
        "9fd478e8-ce29-9241-261a-55051408ed3e",
        "llt.%0",
        ";L;t;",
        "Microsoft.Windows.50.X21-83780_8wekyb3d8bbwe",
        "CDlpActionDataMigrate::MigrateData",
        "Microsoft.Windows.7.res-v4292_8wekyb3d8bbwe",
        "5@5K5y5",
        "4a060d57-d15d-5814-887c-2face8b11b99",
        "516~6",
        "thinpc",
        "DUImage: Failed to execute LangPack search and download [0x%x]",
        "ERROR_SXS_FILE_HASH_MISMATCH",
        "SetupPlatform.dll",
        "Microsoft.Windows.49.res-v3315_8wekyb3d8bbwe",
        "nsen gick ut.%0",
        "221c5f76-d2a2-7a29-e8b4-40dd658cd7ea",
        "VerifyIntegrityChunk",
        "DiskSpaceReq: Migrating critical update packages from [%s] into Target OS...",
        "ras eller returnerade ett fel.%0",
        "PreFinalize: Requesting Automation",
        "3X3o3v3",
        " pokra",
        "524ec275-8967-8ae2-18db-e297f123d786",
        "f89a9e9a-d944-990d-92d4-e5c464bc9d40",
        "70f4ccac-9a50-0c5b-9b8c-4fe0d6276cf1",
        "T9HYM-TFNC2-HHBP3-FB9P7-B7VY4",
        "8b3fdd7b-e8af-7b9b-7443-39a7c034b841",
        "ProductKey: Error with PidgenX config file format while validating product key.",
        ":<:f:z:",
        "serverstoragestandard",
        "Microsoft.Windows.162.X21-43651_8wekyb3d8bbwe",
        "Microsoft.Windows.122.X19-99475_8wekyb3d8bbwe",
        "M4FNP-HBDXD-WWP3B-DM2B3-KKYRK",
        "081604B0",
        "SkipZeroDay",
        "fr-FR",
        "FACILITY_NTSSPI",
        "4.6Y6t6",
        " fortsette installasjonen",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionAdvertiseFactory,class CDlpActionAdvertise>::CreateAction",
        ".?AVCDlpActionMediaCreationSuccess@@",
        "ZwSetSystemEnvironmentValueEx",
        ">,?7?E?",
        ".tls$",
        "CDlpActionImageDeploy::PauseRoutine",
        "lem yeniden ba",
        "sa.%0",
        ";7<c<",
        "19fdd02e-afce-55c1-7787-9f0df6c94d29",
        "educationn",
        "QTYGN-TW9VB-XRG78-97DHJ-82QGG",
        "dedab3ce-480a-14fb-d91b-b06bd8aa4519",
        "Microsoft.Windows.4.X21-83178_8wekyb3d8bbwe",
        "Microsoft.Windows.99.X19-99577_8wekyb3d8bbwe",
        "ntad version av Update Agent-klienten p",
        ".?AVISetupCore@@",
        "ZwQueryAttributesFile",
        "tani a rendszert.%0",
        "File[*]\\IsRetailOnly",
        "onecore\\base\\wcp\\rtllib\\nativelib\\parsers.cpp",
        "Microsoft.Windows.8.X18-81284_8wekyb3d8bbwe",
        "3d5adc77-ab0f-2a53-f22c-a4e13e8d1610",
        ".CRT$XLZ",
        "=$>Z>n>",
        "W374N-CR9R2-G36CB-MBY8K-QV8WG",
        "CDlpActionUpdateMedia::GenerateCommandLine",
        "Windows ",
        "LoadResource",
        "PostUpgradeDiskSpaceMAX",
        "NYR6B-CPMMK-RTJQQ-XH2GG-MKQH3",
        "te obsah bal",
        "rodowiska odzyskiwania systemu Windows.%0",
        "Ocorreu um erro, e o valor do resultado deve ser consolidado para fins de telemetria.%0",
        "9-9d9",
        "TN4KB-9GTMD-PDKHH-FDH4W-D9M7X",
        "gl-ES",
        "Microsoft.Windows.8.X21-83719_8wekyb3d8bbwe",
        "DiskSpaceInstallReq: Initializing Wim Ref paths          [%ld] [%s]",
        "Compatibility: Rescan returned non-successful scan error code: [0x%X]",
        "SetupCore: Registered IMAGE_FINALIZE action",
        "L'utente non ha accettato il Contratto di licenza entro il limite di tempo richiesto.%0",
        "D$,8Y",
        "PsfHash",
        "CheckDiskSpace: Usage of drive [%c] is not supported",
        "Microsoft.Windows.49.X19-98865_8wekyb3d8bbwe",
        "969i9",
        "78CNT-C9JMM-K2WCJ-PJKXF-GX2F2",
        "~HQMR",
        "e0c8a3eb-681f-e01c-5b01-5ca84c9fde70",
        "Cloud",
        "><>C>\\>l>s>",
        "ncelle",
        "CDlpActionUpdateMedia::GenerateConfigFile",
        "67898332-c24e-690c-00d5-83b875e0f5ef",
        "e250993e-6651-b4c0-f22d-f588ffc06d42",
        "dfed173e-1299-e05b-f1c0-f040ed0ca145",
        " con un argumento de l",
        "Deleting element %08x",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionPreFinalizeFactory@@VCDlpActionPreFinalize@@@@",
        "050[0h0v0",
        "GDTNP-H4DWW-K8X3B-RFQQD-49CKM",
        "ccddecd1-a5b1-e44d-2f50-ffecb9d004a2",
        " stato avviato con un argomento della riga di comando non valido.%0",
        "D$ QP",
        "4>4}4",
        "Der Installationsvorgang wurde mit einem ung",
        "Microsoft.Windows.49.res-v3317_8wekyb3d8bbwe",
        "NWKXD-8HBCJ-TKC7X-DW3B4-R3MMP",
        "6X4N2-PXTF7-BWTFB-4Q9BV-46YQD",
        "PreFinalize: Initializing OnlineRollback Arguments User:    [%s]",
        "6QKBJ-8N99P-BCFXF-BR9BR-K4R73",
        "I problemi di compatibilit",
        " indirmek ve paketini a",
        "Microsoft.Windows.125.X21-83253_8wekyb3d8bbwe",
        "=F>k>r>~>",
        "T$@Ph@",
        "0$1Z1{1",
        "7ca7ed4a-4ec0-7589-3069-d1d60741930f",
        "2?2J2v2",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteCData",
        "<*<K<R<",
        "(Value == 0) || RtlIsLUtf8StringValid(Value)",
        "ASSERT: Assert failed to build string.",
        ">*?1?H?N?X?_?u?",
        "False",
        "33b20972-e135-5163-b3cf-142956cfafe1",
        "3,323",
        "=3>T?",
        "a01692dd-7387-ddca-858a-ac43c81bf04a",
        "Microsoft.Windows.49.X19-99503_8wekyb3d8bbwe",
        "Education",
        "STATUS_SXS_IDENTITY_PARSE_ERROR",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::CheckUserInterruptEx",
        "!0'0X0g0|0",
        "_xe_U",
        "011f488f-0879-0f54-1e62-cb112b57b05c",
        "2e6b8e14-c206-b8b1-cd08-5d9d546b6df6",
        "TYXWC-VNTQ7-6YMHK-PR6XH-VT9RC",
        "Microsoft.Windows.4.X19-98705_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X20-25156_8wekyb3d8bbwe",
        "OneSettingsToolUrl",
        "rfiler for installasjonsplattform ble funnet. Kontroller pakkeinnholdet.%0",
        " awarii.%0",
        "YKMY3-NTHJ6-3GVPJ-R7F93-2WF9W",
        " pendiente una operaci",
        "szlelt",
        "dwBytesRead == dwSizeToRead",
        "Microsoft.Windows.122.X19-99477_8wekyb3d8bbwe",
        "Microsoft.Windows.188.X21-99385_8wekyb3d8bbwe",
        "Pt(Qh",
        "27934eb0-31c1-8b9d-548b-1ffee3d12740",
        "y+VhQ",
        "3N4z4",
        "2b3331d2-139a-553a-5517-5cf0a53bbe28",
        "MoSetupPlatform: GetUserPreferenceAccentColor: No accent color found. Using default color...",
        "WIM\\IMAGE[*]\\HARDLINKBYTES",
        "Microsoft.Windows.79.X17-53880_8wekyb3d8bbwe",
        "2#383?3H3M3R3",
        "tre averti.%0",
        "Asennusta ei voi jatkaa, koska tarvittava teht",
        "veteli, hogy a felhaszn",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\WebSetup",
        "1abbb487-fca6-e737-88e4-dde5b8324fe2",
        "6c6941f7-3dab-5141-25fb-157e14edbb20",
        "ZwLoadKey2",
        "Compatibility: Notify UI that HardBlock status has been updated.",
        "STATUS_MEDIA_WRITE_PROTECTED",
        "t$j\\Q",
        "Microsoft.Windows.7.X21-83730_8wekyb3d8bbwe",
        "SetThreadpoolTimer",
        "Enterprise",
        "The installation progress server is unavailable.%0",
        "Microsoft.Windows.49.X19-98824_8wekyb3d8bbwe",
        "PackageMigration: Initializing Removed FODs",
        "Microsoft.Windows.146.res-v4315_8wekyb3d8bbwe",
        "resource unavailable try again",
        "1O1w1",
        "=9>B>q>",
        "Brugeren har valgt at annullere reklamer.%0",
        "8QNHV-HJWXP-XP79V-G8Q87-T269B",
        "8 8-8H8",
        "De compatibiliteitsproblemen zijn niet binnen de gestelde tijdslimiet opgelost.%0",
        "92NFX-8DJQP-P6BBQ-THF9C-7CG2H",
        "CDlpActionDU::GetResultsDUSetup",
        "9>9I9{9",
        "d4345f13-f740-f0d3-feda-1de7eb2f69c5",
        "dente tentative d'installation est toujours en attente. Un red",
        "; hash = ",
        "RtlIsLUtf8StringValid(LocalName) || (LocalName == 0)",
        "1$2>2C2",
        " systemet til at kunne downloade dataene.%0",
        "On allocating cbs array",
        "zupkfb^ZVSOLIEB@=:7520-+)&$\" ",
        "0(191R1Y1w1",
        "GKNKW-8BFVQ-7C3WD-J72T9-KQB3F",
        "9NKWQ-28467-CRMKC-9YB2V-PWF9Y",
        "DUSetup: Initializing Sqm OptIn Default: [%s]",
        "TriggerStoragePolicies",
        "fdacb3d0-6c55-6f94-af46-98d1a39ce4c5",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::Restart",
        "GetSystemWindowsDirectoryW",
        "_L0ckW0O0B0",
        "Microsoft.Windows.48.X20-17625_8wekyb3d8bbwe",
        "Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe",
        "GetFileInformationByHandle",
        "CommandLine",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::UpdateState",
        "utilityvm",
        "9M,tN",
        "G68RM-Q6NMD-X9JPK-7VXC9-JXFB8",
        "CDlpActionProductKeyValidate::SearchForKeyInPidTxt",
        "Bugcheck driver class",
        "@&0_DM",
        "H79JQ-87NDB-D3Y3T-GDJGV-B7VYG",
        "Microsoft.Windows.98.X20-00911_8wekyb3d8bbwe",
        "ivityksen asentamisen suojattua yhteensopivuustarkistusta, ja k",
        "Bugcheck param 4",
        "GetLocaleInfoEx",
        "Microsoft.Windows.49.X20-29594_8wekyb3d8bbwe",
        "N8HD3-9HMFQ-TVJGC-V6HBQ-4GGBQ",
        "530d8f12-5f3b-3cc6-ee42-8fb63f29286d",
        "89DNY-M3VP8-CB7JK-3QGBC-Q3WV6",
        "lenhetsbeteckningen. %0",
        "BitlockerPremiumAvailable",
        "PackageMigration: Initializing LangPack paths       [%ld] [%s]",
        "6-777=7P7",
        "3HPMV-69NWF-3DRFG-BGBHD-RJRBG",
        ":8:V:p:",
        "De compatibiliteitsproblemen voor downloaden zijn niet opgelost binnen de vereiste tijdslimiet.%0",
        "assertVersion",
        ";M;c;",
        "3#3E3h3q3{3",
        "Microsoft.Windows.49.X20-29593_8wekyb3d8bbwe",
        "Microsoft.Windows.109.X20-87484_8wekyb3d8bbwe",
        ":7;:<i<",
        "d83662bf-be4a-8af2-aecc-fedb2010b9fc",
        "112M2s2",
        "62696S6Z6j6q6",
        "CBasicNodeType::ChangeNamespacePrefix",
        "d7e7ef2d-5e79-8ab1-fadb-2c946bf908b7",
        "Microsoft.Windows.49.X19-98818_8wekyb3d8bbwe",
        "Microsoft.Windows.162.X21-43654_8wekyb3d8bbwe",
        ":4;;;M;v;};",
        "Microsoft.Windows.98.X20-39253_8wekyb3d8bbwe",
        "Microsoft.Windows.126.X21-83275_8wekyb3d8bbwe",
        "Microsoft.Windows.101.X20-24577_8wekyb3d8bbwe",
        "37c051b8-42d9-a932-7fd0-68f01491bbb7",
        "m limitu.%0",
        "Not-null check failed: NewXmlStream",
        "seket.%0",
        "Microsoft.Windows.162.X21-43652_8wekyb3d8bbwe",
        "f01d7acf-9cac-9fd1-b055-59398b7303e2",
        " avbryte fordi systemet ikke oppfyller minimumskravene for ",
        ":*;Z;k;{;",
        "Zu'A;",
        "Microsoft.Windows.4.X19-98712_8wekyb3d8bbwe",
        "Microsoft.Windows.4.X21-05128_8wekyb3d8bbwe",
        "GNCFB-XDTMQ-47342-62VKK-YDWXW",
        "6*616",
        "Installationsprocessen blev startet med et ugyldigt kommandolinjeargument.%0",
        "BUCL::Rtl::QuickSort(Pairs, CompareStringSlot)",
        "9DBC7-NPYQG-VGKMJ-G3YW6-C9XR2",
        "D$<QPj",
        "SystemCpuModel",
        ", ett",
        "Microsoft.Windows.7.X21-83727_8wekyb3d8bbwe",
        "?'?>?_?",
        "Microsoft.Windows.99.X20-29703_8wekyb3d8bbwe",
        "e54b4853-3984-528f-c123-e05de7124af6",
        "GetSupportedDriveLetters: Excluding System drive: [%s]",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::DeserializeRoutine",
        "WIM\\IMAGE[*]\\WINDOWS\\VERSION\\MINOR",
        "#0=0E0M0U0]0",
        ".rdata$zETW0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::GetSerializeOnProgress",
        "B7T86-NDGHJ-M7J2H-767KR-W8HYQ",
        "is-IS",
        "Microsoft.Windows.98.X20-15866_8wekyb3d8bbwe",
        "9-:m:",
        "1&121>1h1",
        "DataMigration: Queue product key into Target OS...",
        "Stage",
        "28c8a252-76af-c895-1bfd-d291787f4bc8",
        " zaman a",
        "SetupCore: Registered DEBUGGER_OPTIONS action",
        "7+8w8",
        "b0ed9a0e-1899-78dd-0745-a2f5137daf73",
        "ERROR_FAIL_NOACTION_REBOOT",
        "\\ProgramData",
        "18596609-ffcf-6ab6-792a-9afabde63ed1",
        "K93XN-VTF4B-DJWPG-G8Y92-FX8XG",
        "EA^Wp",
        "FirmwareBootDevice",
        "VWj43",
        "CDlpActionPackageMigrate::GetFODPackagesToRemove",
        "9`:g:u:",
        "1?2g2",
        ";%<:<U<q<y<",
        ".?AV?$CZeroInit@VCDlpActionAdvertise@@$00@@",
        "DebuggerOptions: Initializing Debugger BaudRate: [%d]",
        "dsb-DE",
        "6$6(6,6064686L6P6T6l6p6",
        "ze kompatibility, ve kter",
        "pPQQj",
        "Nie utworzono obiektu diagnostyki. Nie mo",
        "STATUS_XML_PARSE_ERROR",
        "RestoreFileMetadata: RecordFileDataLocation failed",
        "O Ambiente de Recupera",
        "0(0A0",
        "GWVVP",
        "Problemy ze zgodno",
        "YDCV7-PXNB9-XJCPP-TGY9B-F9FBK",
        " instalacji z powodu braku miejsca na dysku.%0",
        "MicrodomImplementation::CDomLayoutCache::AdvanceCachedPointer",
        "031G1]1}1",
        "medi.%0",
        "lemi kilitlendi.%0",
        "Compatibility: Dismissible Block found.",
        "5-646U6\\6v6}6",
        "ERROR_SXS_MANIFEST_PARSE_ERROR",
        "Installationsplatformen har fundet en ikke-specificeret fejl.%0",
        "BuildNumber",
        "Microsoft.Windows.48.X19-98850_8wekyb3d8bbwe",
        "Microsoft.Windows.101.X20-30042_8wekyb3d8bbwe",
        "TNBBG-X29DX-PF28B-MTH32-CKCH2",
        "7/868D8",
        ";t$ u1h",
        "DebuggerType",
        ":,:8:X:d:",
        "Microsoft.Windows.48.X21-83177_8wekyb3d8bbwe",
        ".?AV?$CDlpResponseImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpResponse@@@@@@@@@@",
        "Microsoft.Windows.101.X20-00906_8wekyb3d8bbwe",
        "%sCore",
        " vuoto.%0",
        "Microsoft.Windows.48.X19-98852_8wekyb3d8bbwe",
        "Kan de letter van een doelstation niet vinden. %0",
        "4CPRK-NM3K3-X6XXQ-RXX86-WXCHW",
        "72fbd945-1eb2-b0c5-7616-a593d20f8f12",
        "r inte att rapportera h",
        ";K8t ",
        "p nem tal",
        "xh-ZA",
        ".?AV?$CUnknownImpl@VIDlpResponseFactory@@@@",
        "GetSecurityDescriptorControl",
        "RFTH7-4NMFT-HXXVP-FMPMF-KBWV7",
        "EtwEventRegister",
        "=1=Y=",
        "nyezett kompatibilit",
        "pt-PT",
        "FY327-QNYQC-3WDFC-MKQDC-PGYQF",
        "aduje, aby u",
        "ConfigFilePath",
        "Microsoft.Windows.4.X19-99686_8wekyb3d8bbwe",
        "H3M94-NRWYM-H7WCK-T74XG-H8RB9",
        "CheckDiskSpace: Found enough free disk space on system drive. Available: [%llu] MB",
        "1d57edf6-7a6e-1ffa-b300-98c596b07be2",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionDUFactory,class CDlpActionDU>::SetActionId",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::CheckInitialized",
        "CDlpActionPackageMigrate::ExecuteRoutine",
        "L$TQj",
        "Microsoft.Windows.49.X20-39272_8wekyb3d8bbwe",
        "ndaren valde att avbryta installationen f",
        "f4389fdf-6585-07bb-c6bd-60b43186f76c",
        "5(6F6s6Z7",
        "dure d'installation est bloqu",
        "jaYjz^j:Z",
        "DataMigration: skipping FlightData...",
        "> >(>@>D>H>L>P>d>h>x>",
        "Problemerne med programkompatibilitet blev ikke l",
        "PN44P-9W8RR-T3FVH-2J6PY-43PFY",
        " avec la configuration minimale requise n'ont pas ",
        "dc15a0cb-351d-03d3-a0a6-c482c6529a57",
        "Microsoft.Windows.161.X21-43621_8wekyb3d8bbwe",
        "5-6S6h6",
        "5:5L5U5s5",
        "QRP8G-JNKV9-98H69-GWDRG-PDKRJ",
        "Microsoft.Windows.100.X20-39262_8wekyb3d8bbwe",
        "gend Speicherplatz zur Verf",
        "m_MicrodomDataBlob.Length >= sizeof(MICRODOM_HEADER)",
        "ActionListParser::ParsePlan",
        "63ce0644-8d6a-9bd4-703b-2defad566f8e",
        "o fornecidas eram inv",
        "b9f31d56-6f7a-3493-f6c5-d5d1b717f4dc",
        "hSVW3",
        "DUImage: Action List Path [%s]",
        "4C4U4\\4f4",
        "BDFPV-YNCQW-H9WRJ-9T7GF-QGRBQ",
        "CDlpActionDiskSpaceReq::ReportStorageReservesTelemetry",
        "mt-MT",
        "Target OS: Edition = [%s]",
        "PMWTN-WT8XM-YCYHT-2MYJR-8B6QX",
        ":':/:9:G:S:a:i:o:",
        "vetelm",
        "ERROR_SERVICE_DOES_NOT_EXIST",
        " grunn av en manglende systemkomponent.%0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::Serialize",
        "5 5@5H5P5X5`5l5",
        "3N4[4h4",
        "482e3ada-05f0-d73c-4fef-cc9d8f8d989f",
        "TriggerStorageCleanup",
        "CompatInstallRequirement",
        ":*:1:",
        "6]7m7",
        "DiskSpaceDownloadReq: Initializing Timeout in Mins:        [%ld]",
        "Microsoft.Windows.126.X21-83279_8wekyb3d8bbwe",
        "L'utilisateur a choisi d'annuler le contrat de licence.%0",
        "9WHvQ",
        "Los problemas de compatibilidad para la descarga no se resolvieron en el plazo requerido.%0",
        " jour de l",
        "GetThreadUILanguage",
        "4?4t4",
        "Microsoft.Windows.161.res-v3919_8wekyb3d8bbwe",
        "operation_would_block",
        ">!>B>X>",
        "9,9]9{9",
        "1A1U1",
        "Microsoft.Windows.101.X20-15865_8wekyb3d8bbwe",
        "CDlpActionProductKeyValidate::ExtractEula",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNode",
        " stato sospeso.%0",
        "gios iniciais da Configura",
        " cancelar el proceso porque el sistema no cumple los requisitos de la opci",
        "ProductKey: Failed to extract key from Host OS. hr=[0x%x]",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::DeserializeRoutine",
        "VQPWV",
        "7a7a8af5-2248-ea42-c9a3-edeccf6d375d",
        "6N3KD-DD7PR-FKKBH-JG3YX-BKMMG",
        "CDlpActionDU::InitializeRoutine",
        "DiskSpaceInstallReq: Initializing FOD paths              [%ld] [%s]",
        "GX7WN-2W37Y-W3R6F-RJYRM-6VJVQ",
        "ndaren ska inte meddelas.%0",
        "8@8t8",
        "XHH47-38NK7-4G3VV-Q3YRP-76DD6",
        "PQQQW",
        "lemi bilinmeyen komut sat",
        "9CNGY-6GWHC-XGMT6-77GXH-VT9RD",
        "31e9a4d1-e7a6-759a-1aeb-332b97591ddc",
        "n requiere el usuario acepte el acuerdo de licencia.%0",
        "7E7b7",
        "IsServer",
        "SetupCompilationType",
        "MYJVR-HHN9Q-9BJXB-68F7Q-7T9R2",
        "MXR8F-33NPH-K4Q6G-K728D-GF4W4",
        "GetSecurityDescriptorLength",
        "HYNC4-8VY3W-8MTV6-DBJD3-7T9QQ",
        "Microsoft.Windows.48.X19-98807_8wekyb3d8bbwe",
        "lemi, eylem yap",
        "5a195ed4-4fca-fdb3-3d70-cc5c4080b674",
        "es-ES_tradnl",
        "=2>w>",
        "HNQFF-CPM78-BQJXP-9JRDM-7MJGQ",
        "bf4901c2-7cc7-910c-a487-484a623c197f",
        "O(u*g",
        "DUImage: Populating Image info set.",
        "='=S=^=",
        "Compatibility: App Uninstall Block found.",
        "Microsoft.Windows.145.X21-83689_8wekyb3d8bbwe",
        "4I5~5",
        "En eksekverbare GatherOsState-fil har en ugyldig signatur.%0",
        "o foi encerrado durante a fase de compatibilidade acion",
        "not a stream",
        "1!1N1h1{1",
        "Microsoft.Windows.99.X19-99563_8wekyb3d8bbwe",
        "8G762-CNJ38-3BWB9-8PXC4-CR64D",
        "F0Vh`",
        "7=8D8a8w8",
        "r installationsprogrammet",
        "Failed inserting element io cbs array",
        "2.353}3",
        "Installasjonen kan ikke fortsette fordi forekomst-hash ikke samsvarer.%0",
        "PostOobePath",
        "serverdatacenterevalcor",
        ":-;4;S;Z;r;y;",
        "0e9c0996-3d32-3048-df7d-73e4c77d2823",
        "Microsoft.Windows.49.X20-29596_8wekyb3d8bbwe",
        "DUImage: Failed to execute FOD search and download [0x%x]",
        "let-k",
        "dia.%0",
        "EnterCriticalSection",
        "[Blue]",
        "73d087c9-d25f-3a73-7631-a08c5cc1d902",
        "036a60cc-a532-0ca7-f912-d81bef42b822",
        "MoSetupPlatform: Retrieving current boot entry...",
        "EventUnregister",
        ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIActivationAction@@@@@@@@",
        ";%;I;W;k;y;",
        "1-1F1Z1j1~1",
        "serveressentialmanagementsvc",
        "X4JNT-7CWP3-PW82B-XDRVJ-F3PGF",
        " komentoriviargumenttia.%0",
        "RtlReleaseResource",
        " un error.%0",
        "6)656Z6x6",
        "0\"0:0?0X0_0",
        "jljai nem a v",
        "rminos de licencia. %0",
        "STATUS_ADVANCED_INSTALLER_FAILED",
        "CMicrodomBuilder::StartAttlist",
        "N7FD6-8GC8C-R7MG3-3Q44K-P38WF",
        "ntat.%0",
        "CDlpActionProductKeyValidate::InitializeRoutine",
        "BiUpdateEfiEntry failed %x",
        "W0j0D0_0",
        "9S0vmR",
        "Microsoft.Windows.27.X19-98766_8wekyb3d8bbwe",
        "Express",
        "me est insuffisant.%0",
        "VNJG3-QDK8Q-C3DPY-6HKRM-2PR8Y",
        "ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT",
        "69ea8289-c6f3-6b41-e066-c8e6a54953e0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::GetError",
        "hrt werden.%0",
        "S*41C\\",
        "UpdateMedia:     Block reasons = [0x%x]",
        "Installasjonaprosessen ble avsluttet.%0",
        "o e o utilizador n",
        "Microsoft.Windows.4.X19-99697_8wekyb3d8bbwe",
        "As informa",
        "96YNV-9X4RP-2YYKB-RMQH4-6Q72D",
        "PerformSilentCleanup: Failed to run SilentCleanup task: [0x%X]",
        "Microsoft.Windows.8.X21-83699_8wekyb3d8bbwe",
        "n y no se debe notificar al usuario.%0",
        "Microsoft.Windows.121.X20-29552_8wekyb3d8bbwe",
        "Integer overflow after WriteData",
        "Egy kor",
        ":&:6:_:e:|:",
        "a352ad34-5377-4c8e-fe00-e85e710491bf",
        "H9NDH-3KJ74-TVB33-R67MG-MKQD4",
        "stes inte inom den aktuella tidsgr",
        "n para continuar con la instalaci",
        "0G1h1o1",
        "Microsoft.Windows.122.X21-83178_8wekyb3d8bbwe",
        "3V6Q6-NQXCX-V8YXR-9QCYV-QPFCT",
        "Microsoft.Windows.8.res-v4306_8wekyb3d8bbwe",
        "['`1XJT",
        " des fins de t",
        "CDlpActionEulaFactory::CreateInstanceRoutine",
        "NtUpdateWnfStateData",
        "1!1.1",
        "Microsoft.Windows.122.X20-21793_8wekyb3d8bbwe",
        "Unable to delete install failure count REG key. GLE is [%d]",
        "Microsoft.Windows.100.X19-99464_8wekyb3d8bbwe",
        "CDlpActionDataMigrate::SerializeRoutine",
        "MoSetupPlatform: Getting WinREUseNewPBRImage proc address...",
        "rbara filen GatherOsState har en ogiltig signatur.%0",
        "D74T9-BHNY9-WB94V-QJKTY-K77YC",
        "tb9t$",
        "D$lj PQ",
        "DUImage: Initializing Facilitator Url:           [%s]",
        "Target OS: Enabling migration of host settings.",
        "70f8cbed-9b4b-6e5c-cb66-a83eb054a11c",
        "M66NY-3BVW3-DVBPQ-CQ3C7-B7VYQ",
        "NMTOKENS",
        "7T9NV-W7MXB-WJB83-RBQCJ-BWTFK",
        "252?2",
        " instalacj",
        "6$626O6",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::Deserialize",
        "GetVolumeRootFromPath",
        "37f71d0b-6a69-4801-d164-3e13b8e5c29b",
        "586T6",
        "NFPXB-HRPHT-998P2-WHK3P-FX9XY",
        "3ee16add-b675-e087-d185-e617cc1a2ebf",
        "Microsoft.Windows.126.X21-83273_8wekyb3d8bbwe",
        "Microsoft.Windows.4.X21-05127_8wekyb3d8bbwe",
        "043acdb7-1984-91af-c6b1-257068578dcd",
        "MoSetupPlatform: Not requesting install of FOD packages from [%s].",
        "nimos para instalar a atualiza",
        ":QVEE",
        "9w<t*",
        ";1;G;",
        "IsNarratorRunning",
        "ytkownik postanowi",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttribute",
        "MoSetupPlatform: Recovery image option is NONE.",
        "2*3W3y3",
        "SqmOptInSelected",
        "RtlGetVersion",
        "09934471-a7b1-41c5-aa09-28c0ec0c59f9",
        "De Flight-id is leeg.%0",
        "bucketArgument2",
        "0Y1d1",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::SerializeRoutine",
        ".?AV?$CZeroInit@VCDlpResponseAutomation@@$00@@",
        "RtlCalculateUtf16StringLengthFromLUtf8String",
        "Microsoft.Windows.4.X19-99709_8wekyb3d8bbwe",
        "4f981d62-b25d-796d-3b25-23cb94c19b97",
        "6cd0c78b-055d-8d54-e2ba-76b5f536513a",
        "1f94ea59-05de-658f-293b-24c363a1e34d",
        "WWWWV",
        "CBasicNodeType::ForceValue",
        "t;f97t6",
        "r licensvillkoren.%0",
        " indirmek i",
        "DecompressChunkedFile failed",
        "689a423d-2210-5cc4-5cdc-6d06321664ff",
        "ck(WKm",
        "?(?h?",
        "CDlpActionDebuggerOptions::DeserializeRoutine",
        "REQUIRED",
        "d196793c-1767-1489-8237-f3991d829267",
        "8NDWP-X6X8C-GFWXX-4BM6Q-8K848",
        "$filehashes$.dat",
        "1\"1)10171u1",
        "n de la actualizaci",
        "CheckHotPluggableDriveEx: Drive %c SetupDiGetDeviceInterfaceDetail-1 Error: 0x%X",
        "De server voor de voortgang van de installatie is niet beschikbaar.%0",
        "0d2a44b4-605d-3189-959c-3bf8f02b5397",
        "e wznowi",
        "SystemTimeToTzSpecificLocalTime",
        "Microsoft.Windows.125.X21-83237_8wekyb3d8bbwe",
        "CDlpResponseAutomation::InitializeRoutineEula",
        "rios obrigat",
        "b496a9a1-fe98-7a3f-4c7c-b3e40208d89b",
        "a8a48c62-8886-b0a9-20e1-8c446008b70b",
        "ZwLoadKey",
        "Microsoft.Windows.8.X21-83693_8wekyb3d8bbwe",
        "GetWebSetupUserInput: Error reporting telemetry for WebSetupInputSelectedLang: [0x%X]",
        ";(;9;I;Z;j;{;",
        "ExecuteDownloadReq: Trying to use proposed external drive [%c]",
        "gleges",
        "1(1,1<1@1X1`1d1h1l1p1t1x1|1",
        "HN49G-V24KT-T6C2T-WH62T-MKMP3",
        "LegalCopyright",
        "PsfSourcePath",
        ">S>j>q>",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::GetActionId",
        "Nebyl vytvo",
        "edinstala",
        "DYHRN-MM9MT-TMRRW-497WH-6XXTT",
        "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "Microsoft.Windows.101.X19-99648_8wekyb3d8bbwe",
        " kan ikke behandles i ",
        "%hs(%u)\\%hs!%p: ",
        "Y__^[",
        ":*:N:Y:",
        "tzVW3",
        "404971d2-6817-a5a2-1403-a85bff039221",
        "Expanded",
        "Finalize: Failed to process persisted telemetry events. hr=0x%x",
        "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate",
        "Microsoft.Windows.98.X20-35496_8wekyb3d8bbwe",
        "towlower",
        "cb0646aa-cc2a-1355-0317-73277a19c4d8",
        "4#4z4",
        "Microsoft.Windows.48.X20-29659_8wekyb3d8bbwe",
        "File[*]\\Architecture",
        "BNMVG-QJR9K-B87YR-XYRPR-VMH3D",
        " konsolideres for telemetriform",
        "&030j0",
        "Microsoft.Windows.49.X19-99509_8wekyb3d8bbwe",
        "Microsoft.Windows.189.X22-09602_8wekyb3d8bbwe",
        "CompatInstallReq: Initializing FODs Removed:              [%s]",
        "Die Mindestanforderungen zum Installieren des Updates werden vom System nicht erf",
        "5Qh<|",
        "1:2E2",
        "d7fc32dd-52f3-ad23-90e9-260945dc2550",
        "5!646?6^6",
        "Servicing\\Editions\\UpgradeMatrix.xml",
        "KJ8MH-MNJMF-XPRD4-BTT49-MG92M",
        "SetFileInformationByHandle",
        "CDlpActionDiskSpaceReq::ExecuteRoutine",
        "AcceptEula from Response [%s]",
        "ReadWriteDataInternal",
        "Microsoft.Windows.100.X20-15868_8wekyb3d8bbwe",
        "The installation image was not found.%0",
        "DataMigration: Failed to read WebSetup image location Hr=[0x%X].",
        "J0m0t0",
        "8o9v9}9",
        "qps-plocm",
        " stato terminato durante la fase di compatibilit",
        "DriverUpdate",
        "809:9r9",
        "|hK,_",
        "DiskSpaceDownloadReq: Initializing ProposedExtDriveLetter: [%c]",
        "YT83R-NYG6V-QMHXV-Q6GDY-39G99",
        "Microsoft.Windows.101.X19-99549_8wekyb3d8bbwe",
        "ci skr",
        "Microsoft.Windows.122.X21-03402_8wekyb3d8bbwe",
        "=F=a=h=n=",
        "3RKN7-8PWXC-VRKJW-6RRGP-DDBW2",
        "N7HY3-YHFHM-P6F86-M98CR-KBQHW",
        "W69BB-N79M9-M223P-JVQDC-JB49G",
        "Shellbrd",
        "Host OS version: %u.%u.%u.%u %s (%hu.%hu) Platform 0x%X, SuiteMask 0x%hX, ProdType 0x%hX",
        "uz-Latn",
        "CMicrodomBuilder::EndElement",
        "DisableShiftF10",
        "clouden",
        ";w(tE",
        "9'9X9o9v9",
        "CDlpActionProductKeyValidate::DeserializeRoutine",
        "Microsoft.Windows.101.X20-29685_8wekyb3d8bbwe",
        ": :;:B:c:j:",
        "CDlpActionCompat::GetResultsRoutine",
        "FLT_INVALID_OPERATION",
        "cdkHr,g",
        "E_UNEXPECTED",
        "A rendszer nem felel meg az t",
        "CDlpActionCompat::SerializeDownloadReqScan",
        "Microsoft.Windows.162.X21-43646_8wekyb3d8bbwe",
        " dans le d",
        "DUSetup: Initializing IsServer:          [%s]",
        "stico. No se pueden notificar los eventos.%0",
        "RtlConcatenateLUtf8Strings",
        "d7dafb96-1180-6946-76e9-d709e770b867",
        ".rdata$zETW1",
        "t$<WP",
        "Microsoft.Windows.4.X20-35463_8wekyb3d8bbwe",
        "dbdd407a-f1bb-cf23-1461-bfb16d7134e1",
        "CDlpResponseAutomation::InitializeRoutineInstallNowOrLater",
        "9MT66-DNGWQ-48FPD-TQHJC-XTPHT",
        "S_FALSE",
        "Microsoft.Windows.148.X21-83762_8wekyb3d8bbwe",
        "3)434]4g4",
        ":&:P:[:",
        "NewBuffer = (*RtlReallocateStringRoutine)(Bytes, String->Buffer)",
        "Failed to filter delete element %08x. Status: %x",
        "FveGetStatusBasicW",
        "<!=<=o=",
        "2M3WR-NQW7W-7MX3H-TYCRD-8MBPW",
        "o desejada.%0",
        "inden, kullan",
        "Microsoft.Windows.49.X20-39269_8wekyb3d8bbwe",
        "RegOpenKeyExW",
        "Aucun package ",
        "dc02bf8a-fbae-d5f8-c9f6-692de92ff2b5",
        " wycofywania systemu operacyjnego.%0",
        "10b840a0-833e-29c1-d2ad-1b06c5546feb",
        "arm64",
        "DUImage: Setting progress callback for payload ImageDU",
        " nyt fors",
        "Microsoft.Windows.145.X21-83698_8wekyb3d8bbwe",
        "e26630f7-418e-743c-27a1-7cb722b45336",
        ":E:^:",
        "CDlpActionRecovery::DeserializeRoutine",
        "CDlpActionCompat::CancelRoutine",
        "Impossible d",
        "Microsoft.Windows.100.X19-99451_8wekyb3d8bbwe",
        "7Y4KV-TNR3P-XRTY7-HVRRK-YDRHQ",
        "787K7",
        "9'9G9e9",
        "84eb5e02-8c61-342b-7492-41233bfe1cb5",
        " yaln",
        "96e69206-e5b4-b20f-7ec9-14c3bf950ef7",
        " ei l",
        "embeddedindustrya",
        "CDlpActionCompat::PerformResolveCommand",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::Initialize",
        ":9:x:",
        "rdigg",
        "213l3",
        "C743N-RYHH2-YV4JV-GP4HJ-J8HYV",
        "8N8Y8`8",
        "3&4W4",
        "6Q3N8-3R9CG-M8V87-WRVQQ-9766P",
        "GetCurrentThread",
        "BJBKV-PQNJV-K4Y3H-4TJB7-CYVKR",
        "ci z powodu braku sk",
        "no such file or directory",
        "a8fb83ec-f4fa-3147-b2cc-655981741035",
        ".data$brc",
        ":3:::@:b:i:o:",
        "232B2s2",
        "CoCreateInstance",
        "s rendszer telep",
        "Microsoft.Windows.101.X19-99537_8wekyb3d8bbwe",
        "JN9WX-28CF8-YV7CK-WDHHM-8FJV3",
        "Microsoft Time-Stamp PCA 2010",
        "j\\Zj:",
        "8305992b-a37a-66ee-ef9d-d3f542c606b7",
        "4e6edf56-9c26-5a85-3d34-51fb0777d862",
        ";3;A;W;e;{;",
        "5 5(50585@5H5P5X5`5h5p5x5",
        "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Syspart",
        "D$(PQ",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionCreateMediaSuccessFactory,class CDlpActionMediaCreationSuccess>::CreateAction",
        "Het uitvoerbare bestand GatherOsState heeft een ongeldige handtekening.%0",
        "sr-Cyrl",
        "Microsoft.Windows.4.X21-05129_8wekyb3d8bbwe",
        "203q3",
        "Legal_Policy_Statement",
        "FindChunkForOffset",
        "ExpressPackagePath",
        "999F9",
        "CDlpActionDataMigrate::MigrateReserveManagerKeys",
        "Finalize: Error getting narrator running status: [0x%X]",
        "WIM\\IMAGE[*]\\WINDOWS\\LANGUAGES\\DEFAULT",
        "r den Download aufweist.%0",
        "ActionList",
        "pa-IN",
        "Microsoft.Windows.49.X19-99506_8wekyb3d8bbwe",
        "8HFNR-6MYQ7-8B2DM-MB4M8-XW3GP",
        "lebilir dosyas",
        " gerekli zaman s",
        "MH37W-N47XK-V7XM9-C7227-GCQG9",
        "78bcb07f-e1ff-ea66-9d0f-484d19ebd426",
        "0475ed62-f64a-f0b5-95cc-0cbedb856c27",
        "CDlpActionCompat::InitializeRoutine",
        "PCPB6-8N2D2-YCKBQ-RBHTV-VT9Q6",
        "DNBM8-2JPG2-MHCJK-4FXTY-G3B7V",
        "cessaire. %0",
        "sr-latn-rs",
        " sistemde disk alan",
        "c7fcb013-68f2-5a24-db20-68c70b4c92cc",
        "~h_^]",
        "1!252;2_2e2",
        ">&>K>q>",
        "Microsoft.Windows.189.X22-09604_8wekyb3d8bbwe",
        "Microsoft.Windows.171.X21-24733_8wekyb3d8bbwe",
        "ExecutableName: ",
        "DiskSpaceInstallReq: Initializing LXP License Count          [%ld]",
        "DiskSpaceInstallReq: Initializing UseExtDrive:                  [%s]",
        "More payload found than expected",
        "9t$@t",
        "686`6",
        ":(:4:@:L:X:d:p:|:",
        " pouvant donner lieu ",
        "Sistem, g",
        "f6fa7417-496c-dfbe-5979-0b7f0d33945b",
        "wcscat_s",
        "Installasjonsprosessen ble startet med et ukjent kommandolinjeargument.%0",
        "GD7KH-DV2JH-NX4JF-42MTJ-9TP8T",
        "0O0o0",
        "WriteData failed during NULL block copy",
        "81579925-db7e-1da6-db6e-a0be8c2d6907",
        "t$<PQQ",
        "Microsoft.Windows.49.X19-98857_8wekyb3d8bbwe",
        "F2NFY-D4KMV-TQR7Y-V3K3R-JHVYG",
        "QJGRK-CNMBD-GYF9K-RW8M3-GF4B3",
        "o de compatibilidade para instalar a atualiza",
        " instala",
        "Die Setup-Konfigurationsdatei ist leer. %0",
        "3C7PC-PRNW9-BBHJ9-D3GQW-BWT38",
        "Brugeren har valgt at annullere licensaftalen.%0",
        "Microsoft.Windows.121.X19-98898_8wekyb3d8bbwe",
        "CPWHC-NT2C7-VYW78-DHDB2-PG3GK",
        "Microsoft.Windows.48.X20-00861_8wekyb3d8bbwe",
        "CheckTokenMembership",
        "CDlpActionCompat::DeserializeMigChoiceScan",
        "LoadLibraryW",
        "SetUnhandledExceptionFilter",
        "Microsoft.Windows.27.X19-98768_8wekyb3d8bbwe",
        "Proces instalacji uleg",
        "5d6acdf3-369c-3acc-ee69-ca2fb0e664a7",
        "af78eda8-f9ef-7740-0494-bb6c5baa2db2",
        "ZwQuerySymbolicLinkObject",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::Cancel",
        "1+121S1Z1_1e1t1{1",
        "Microsoft.Windows.145.X21-83695_8wekyb3d8bbwe",
        "PQ6NX-BHK88-86J9G-7FWM9-6CJYT",
        "advapi32.dll",
        "Specifying Compat MigXml file: [%s]",
        " form",
        "onecore\\base\\xml\\udom_microdom.cpp",
        "8:8Y8v8",
        "Microsoft.Windows.50.X21-83776_8wekyb3d8bbwe",
        "FACILITY_FILTER_MANAGER",
        "BGQ3W-4N7FY-VDT2P-J43GQ-FM49G",
        "Das System hat die Ger",
        "=,>9>@>",
        "2@2d2",
        "908da6f0-5510-92f9-bc23-555a9ddbb455",
        "~49~8t",
        "65952d75-2e77-a8d9-94f4-b10ecc2d3151",
        "6 60646D6H6X6\\6l6p6",
        "530f41fb-17ef-84f0-c7ef-a88e015d4dc9",
        "Microsoft.Windows.125.X20-35518_8wekyb3d8bbwe",
        "Gerekli bir g",
        "f56cc560-fd36-1d29-727d-dc1a7cb05817",
        "tot.%0",
        "Microsoft.Windows.101.X20-39247_8wekyb3d8bbwe",
        "PerformSilentCleanup: Calling TriggerStoragePolicies.",
        "72c095ba-cfc8-5c45-f7a1-d272ee042deb",
        "XVNRV-9HTX4-TH2JD-HVJQD-QRQWG",
        "maya y",
        "RtlXmlNextLogicalThing( &m_State, &m_Namespaces, &m_CurrentThing, &m_AttributeList )",
        "JF4ND-8K7CW-96P84-DT2RX-9HFFK",
        "RtlInitLUnicodeStringFromUnicodeString",
        "8b0b5353-7e24-2d16-2e06-0db548937938",
        "1b7b551a-f4d4-8604-c60d-f6b2ee9328d8",
        "DUWorkingPath",
        "Server.OS",
        "=,=8=X=`=l=",
        "DiskSpaceDownloadReq: Initializing Required Free Space:    [%ld]",
        "\\$4Sj",
        "2#232:2I2P2`2g2",
        " gestita per l'installazione dell'aggiornamento e l'utente non deve essere notificato.%0",
        "Windows::WCP::Implementation::Rtl::ParseDottedVersion",
        "6VVFQ-NHJC6-K7D39-83VG8-JFG44",
        "ERROR_BAD_ENVIRONMENT",
        "NGH86-TGPJY-J836V-RXQ8R-JHQJ8",
        ";=<_<",
        "DiskSpaceInstallReq: Initializing AllowUninstall:               [%s]",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetNamedItem",
        "N2KJX-J94YW-TQVFB-DG9YT-724CC",
        "Global\\WdsSetupLogInit",
        "c1c2d1da-5747-c668-a25e-4cde5c0e1d39",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionEulaFactory,class CDlpActionEula>::CreateAction",
        "ckgegeben.%0",
        "CompatInstallReq: Initializing SKU Key No License:        [%s]",
        "1a4738f6-9034-09d0-5fb7-64b93b780673",
        "CXmlCursor::CompareStrings",
        "SYSTEM\\Setup",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::PreInit",
        "FLT_OVERFLOW",
        "DUSetup: DUOptin from Response [%ld]",
        "ltige Signatur auf.%0",
        "PXYNJ-FYCDY-P3KKV-V6B9T-8TY6Q",
        "Microsoft.Windows.100.X20-29709_8wekyb3d8bbwe",
        "Binding EFI namespace objects",
        "NFF4H-MMXBC-P46DX-4GYT4-3DDFW",
        "71437f58-9fa6-c10a-c65e-31ac0430d49d",
        "Microsoft.Windows.27.X21-03402_8wekyb3d8bbwe",
        "Found %d processes using this file.",
        "D$hPW",
        "CDlpActionDiskSpaceReq::GetResultsDownloadReq",
        "MediaType",
        "7(7,7D7T7d7h7x7|7",
        "o atende aos requisitos m",
        "5:5s5",
        "1+1N1o1",
        "trehozva. Nem siker",
        "PRO_N",
        ">3>^>",
        "6m6{6",
        "58b4dfc5-0018-202e-f99e-24dfb7c55c21",
        "110cbaf0-acb2-3c6b-90fc-868cf23e338d",
        "=,=8=X=`=h=p=x=",
        " continuare perch",
        " stata trovata alcuna offerta che corrisponde ai criteri richiesti.%0",
        "berschritten.%0",
        "Microsoft.Windows.126.X21-83176_8wekyb3d8bbwe",
        "4J87H-N2833-6PCWF-7HWFF-2KCKR",
        "CDriverCallback::ValidateDriverPackage: Override answer - DO NOT migrate this package",
        "O(ug0M0~0[0",
        "6abbe9f9-4919-88b6-b60a-1cc394a4d4ad",
        "?!?+?2?9?@?G?",
        ":#:D:O:l:q:",
        "f1741714-d6c8-326f-c8c9-4c64c5064529",
        "HM3NG-HXCBR-B3BCG-X9MVG-GMWVQ",
        "Microsoft.Windows.98.X20-00899_8wekyb3d8bbwe",
        "onecore\\internal\\base\\inc\\rtl_object_library.h",
        "_u&A;",
        "hrt werden oder hat einen Fehler zur",
        "Microsoft.Windows.101.X20-29629_8wekyb3d8bbwe",
        "STATUS_NOINTERFACE",
        "wcsrchr",
        "7J8p8",
        "SLC.DLL",
        "Der Benutzer hat den Vorgang abgebrochen, da das System die Ger",
        "GDRCount",
        "Konfigurasjonsfilen for installasjonen er tom.%0",
        ".?AVCDlpActionSummaryFactory@@",
        ".text",
        "<B<G<O<W<_<g<",
        "961bd80e-5ddb-867e-e807-3096246aa446",
        "DataMigration: Initializing Channel:             [%s]",
        "DiskSpaceInstallReq: Initializing SkipInstallingWinRE:          [%s]",
        "FACILITY_WIN32",
        ">!>'>",
        "Microsoft.Windows.101.X20-00901_8wekyb3d8bbwe",
        "es de compatibilidade n",
        "Finalize: Error setting environment variable SP_UPLOAD_ASIMOV. GLE = [%d]",
        "Microsoft.Windows.4.X21-03403_8wekyb3d8bbwe",
        "55a63838-7b8a-b658-6dd5-adc84a088a46",
        "e0df8301-f297-e6fe-b881-0b6442005946",
        "ProductKey: Using existing image selection response (product key deferred).",
        "r mehrere Architekturen werden vom System nicht erf",
        "mi podm",
        "PreFinalize: Initializing PostOobe Registration Path:       [%s]",
        "PerformSilentCleanup: Error reporting telemetry for OSPARTITION_SPACE_FREED_UP_STORAGE_CLEANUP: [0x%X]",
        "Software\\Microsoft\\Windows\\CurrentVersion\\ReserveManager",
        "Microsoft.Windows.4.X20-00860_8wekyb3d8bbwe",
        "098c46c3-2bad-7c87-09de-34d7a5383606",
        "nda ge",
        "trie. %0",
        "d608699e-bc5f-7b7a-0150-63e40240b3c9",
        "N+@:81J",
        "0PQQj",
        "DUSetup: Opted-out of DU and telemetry due to DoNotConnectToWindowsUpdateInternetLocations policy regkey",
        "Windows::uDom::Rtl::RtlMicrodomUpdateRemoveChild",
        "Es wurde kein Ziellaufwerkbuchstabe gefunden. %0",
        "Kurulum Platformu belirtilmeyen bir hatayla kar",
        "=(=y=",
        "9':B:Z:",
        "|$HSQ",
        "ersiz bir komut sat",
        "Not-null check failed: pOutputStream",
        "10.0.19041.572",
        "NF3C7-QJCH4-XMB9G-HT9HK-HCFJX",
        "e6f7833e-9de3-1f80-7aae-3429a4ea396d",
        "jet underst",
        "2\"2(2W2b2}2",
        "Trimming remove action for package: {0}, because there is a related add package: {1}",
        "2.3o3",
        "IsWow64Process",
        "MigChoice: Initializing Wim Ref paths:         [%ld] [%s]",
        "SetErrorMode",
        "L$$_^[3",
        "Microsoft.Windows.48.X20-39271_8wekyb3d8bbwe",
        "ration Windows (WinRE) ne peut pas ",
        "8;8P8_8j8r8{8",
        "Microsoft.Windows.122.X19-98696_8wekyb3d8bbwe",
        "4be79be7-7373-edc2-f333-d00557434d0f",
        "46J3N-RY6B3-BJFDY-VBFT9-V22HG",
        "PackageMigration: Initializing FOD paths            [%ld] [%s]",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementsByTagNameNS",
        "ded3b75a-e0c9-a3b8-b853-2a5351b79ad6",
        "b6f9e826-ff41-69d7-0394-938a6de64a00",
        "8d784be4-a24a-771d-c20f-7777e4cd2200",
        "Microsoft.Windows.146.X21-83742_8wekyb3d8bbwe",
        "b7ceaa0e-5652-00a9-90c8-c592212c0857",
        " przerwa",
        "Microsoft.Windows.8.X18-81311_8wekyb3d8bbwe",
        " avbryte fordi systemet ikke best",
        "Microsoft.Windows.121.X20-46572_8wekyb3d8bbwe",
        "MoSetupPlatform: Setup Platform object created!",
        "? ?$?",
        "installation ne peut pas continuer, car le code de hachage de l",
        "TGWNR-T88HF-DKKP7-Y8Y88-GVJVW",
        "3)3/3L3R3l3x3",
        "D$(SVW3",
        "SetFileAttributesW",
        "co-FR",
        "f2f3425d-452a-ccbe-ac80-aa86fb98ff27",
        "5$5,545@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5",
        "CompatFinalizeReq: Initializing Build                  [%d]",
        "3DB6N-YXFXK-PFHGQ-C8QB2-TMWXD",
        " zawarto",
        "vel GatherOsState.%0",
        "6b8028f4-0edc-3ecc-8e7d-592d697bab36",
        "si folyamatot megszak",
        "CDlpActionDiskSpaceReq::CalculateRequiredDiskSpaceInstallReq",
        "VJ9TN-XPWV7-HPC8T-92YQ4-F6YMG",
        "File[*]\\Key",
        "%016I64x",
        "jQh(U",
        "(LocationHeader->ulFlags & ~((0x00000001) | (0x00000002) | (0x00000003))) == 0",
        "0%0Q0\\0",
        "ServerHyper",
        "BUCL::Rtl::ConvertInteger(pObject->m_cChildren, pDocument->usChildNodes)",
        "ProductKey: Product key has a block.",
        "?-?A?S?Y?b?m?t?y?",
        "Y24GV-NQ97Y-VP3KD-7CMYT-D3WVD",
        "5c7j7}718",
        "Microsoft.Windows.48.res-v3556_8wekyb3d8bbwe",
        "BXX9H-RKNX6-DQFRR-3737W-9TRB6",
        "<5=x=",
        "Microsoft.Windows.101.res-v3261_8wekyb3d8bbwe",
        " di destinazione. %0",
        ";)<Q<",
        "DataMigration: Migrating Windows License State [%d].",
        "92486975-d437-1193-c623-ab787a730114",
        "Microsoft.Windows.8.res-v4301_8wekyb3d8bbwe",
        "2f9ee6d2-2328-8331-c809-77ff0330cec0",
        "5 5@5s5",
        "CharUpperW",
        "ActionListParser::ParseUpdateProduct",
        "ProductKey: Product Key OS edition [%s] mismatched with Host OS edition [%s].",
        "Microsoft Corporation1200",
        "ce pobierania nie zosta",
        "Microsoft.Windows.49.X20-21797_8wekyb3d8bbwe",
        "656D6Q6t6",
        "9.9?9P9a9o9{9",
        "47c45b39-dcc4-3405-1087-9496230fcfe6",
        "F2NVG-HKM28-VY6RW-FJWRF-CR4DM",
        "CompactOS",
        "4 434N4s4",
        "Das Diagnoseobjekt wurde nicht erstellt. Ereignisse k",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocumentElement",
        "HeapAlloc",
        "CDlpActionFinalize::DeserializeExit",
        "<K<X<l<s<",
        "94080ca4-28c0-f609-9084-61bb978b58e7",
        "Microsoft.Windows.164.X21-39883_8wekyb3d8bbwe",
        "Error restoring directory metadata - ignoring failure",
        "onnistui.%0",
        "748O8",
        "0413a45d-53ab-f194-80c0-52996436bd0f",
        "De opgegeven automatiseringsgegevens zijn ongeldig.%0",
        "6DWPW-GNMQ4-WYJH9-VD7K4-37BBB",
        "B3DHV-RNWWQ-RH2QP-TQDGT-D3YMY",
        "13a6f62e-ceff-add9-fabc-fb340e90b5cf",
        "stico n",
        "Microsoft.Windows.49.X20-44907_8wekyb3d8bbwe",
        "systemos",
        "QWWWP",
        "t{93tw",
        "Microsoft.Windows.180.X21-83663_8wekyb3d8bbwe",
        "Not-null check failed: Data",
        "3SVVV",
        "DiskSpaceInstallReq: Initializing FOD Count              [%ld]",
        "0L04x",
        "4>4H4]4d4l4",
        "CDlpActionDataMigrate::MigratePrivates",
        "sms-FI",
        "DCC6N-X83T4-DTH4H-4KH4W-TQ78X",
        "Der er ikke diskplads nok p",
        "TFKN7-3BRDR-9H7CY-XXQQ4-YTDX2",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionGetWebSetupUserInputFactory,class CDlpActionGetWebSetupUserInput>::CreateAction",
        "a11549d4-7247-fc23-085c-cfe6aa738bf4",
        "ImageDeploy: Initializing CompactOS:             [%s]",
        "?>?I?u?",
        "WIM\\IMAGE[*]\\DIRCOUNT",
        "ddc422e2-1615-e74d-228f-268b3376a5b5",
        "3X99J-PND6M-WWTJQ-TQGXY-HVCHV",
        "CDlpActionDU::DeserializeDUImage",
        "CDlpActionMediaCreationSuccess::DeserializeRoutine",
        "9b21e00a-9feb-ad05-df0f-e9154c11edcf",
        "Brugeren har valgt at annullere, fordi systemet ikke opfylder minimumskravene til installation af opdateringen.%0",
        "Microsoft.Windows.48.X20-17628_8wekyb3d8bbwe",
        "Microsoft.Windows.164.X21-06159_8wekyb3d8bbwe",
        "Microsoft.Windows.99.X20-15873_8wekyb3d8bbwe",
        "Restart",
        "eab3cef4-6771-c2f3-5211-f878a38592f4",
        "NtOpenProcessTokenEx",
        "SyspartIsSpace failed for %s",
        "n deseada.%0",
        "C,!s4",
        "nimos para la descarga de la actualizaci",
        "kkelig diskplads til installationen.%0",
        "TH4GN-T267P-HW64M-R934Y-7MHX6",
        "nky. %0",
        "si folyamat fel van f",
        "\\Program Files\\WindowsApps\\",
        "in kurulumun daha g",
        "FLT_STACK_CHECK",
        "> ?A?H?R?e?",
        "_vsnprintf_s",
        "0\"000",
        "Microsoft.Windows.101.res-v3572_8wekyb3d8bbwe",
        "739dcd23-97df-af63-1af6-f94bd133e199",
        "243:3G3S3]3",
        "D$|PQ",
        "Microsoft.Windows.98.X19-99591_8wekyb3d8bbwe",
        "Warning,",
        "9#:A:_:",
        "ErrorState",
        "561b9f00-654a-9cef-9575-35dac181caf3",
        "C9G9V-2NPKQ-TC2FF-KKPVC-P92JW",
        "393b1e43-e854-9ccc-ac7d-9b0d820f2628",
        "7TVXR-N8YTY-WWY2G-CX96R-9W4FJ",
        "Microsoft.Windows.48.X19-98803_8wekyb3d8bbwe",
        "8ae1a1e3-1e69-7ba1-3f1e-3073415cdcf2",
        "VN9WJ-3VGYC-PPFYD-82RBB-BBJGP",
        "= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=",
        "6888e63b-32a6-266a-995b-e4f33cb6537e",
        "GetLengthSid",
        ">[_^]",
        "BN6W9-JDGFQ-FW483-V4MB7-MBJGP",
        "onecore\\base\\xml\\parsergenerator\\lib\\xpgutil.cpp",
        "*** Assertion failed: %s",
        "Microsoft.Windows.4.X21-05136_8wekyb3d8bbwe",
        "= >A>P>]>x>",
        "9d297f82-7f98-a676-4bfc-f2da1ebc0229",
        "Il sistema non soddisfa i requisiti minimi per l'installazione dell'aggiornamento.%0",
        "5K5U5",
        "%I64d",
        "9O9~9",
        "Microsoft.Windows.48.X20-32155_8wekyb3d8bbwe",
        "Microsoft.Windows.4.X19-99702_8wekyb3d8bbwe",
        "2>7E7$9%<",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::UpdateState",
        "address_family_not_supported",
        ";0;;;",
        "ExternalDriveUsed",
        "DiskSpace: Post upgrade free space percentage: [%llu] MB",
        "ERROR",
        "6fd0fba3-ac21-cd9b-95d3-7dd1d236f4d6",
        "GetSecurityDescriptorOwner",
        "DebuggerOptions: Initializing Debug Bus Params:  [%s]",
        "918299db-faa5-825f-ee07-9a4468e8352c",
        "Microsoft.Windows.101.res-v3570_8wekyb3d8bbwe",
        "6S6v6",
        "GetTimeZoneInformation",
        "Microsoft.Windows.4.X19-99682_8wekyb3d8bbwe",
        "4U4d4t4",
        "64af8ca5-a5a0-690d-d0af-57c03f6cb89b",
        "Microsoft.Windows.4.X19-99677_8wekyb3d8bbwe",
        "n finaliz",
        "4F6M6b6r6",
        "Microsoft.Windows.98.res-v3270_8wekyb3d8bbwe",
        "6TP4R-GNPTD-KYYHQ-7B7DP-J447Y",
        "K3QRN-RMXRR-DDY22-PDB6G-683XF",
        "6HCN4-DHPFG-XMVQJ-KJ3FW-78Q93",
        "b19456d1-f62c-30d0-06e5-92a7f6d344ff",
        "WDBN4-M33XM-48H6F-Y74TB-X4TP2",
        "9*:f:",
        "Microsoft.Windows.188.X21-99383_8wekyb3d8bbwe",
        "ar-YE",
        "936477ce-9401-be8c-ed58-b386fd57a4a4",
        "A preinstall script failed to execute or returned an error.%0",
        "DiskSpace: Required disk space from SP: [%llu] MB",
        "Microsoft.Windows.27.X19-98749_8wekyb3d8bbwe",
        ".?AVlogic_error@std@@",
        "2\"2-2;2E2\\2b2l2",
        "4DJYP-2NVY6-R2GJ9-PBMDV-DRR73",
        "T3NJV-7X6JX-V7HRD-7TMKD-YBH23",
        "2%222b2",
        "fAlreadyExisted",
        "TJ6TN-FHXJG-YGKX9-3TQ7D-G83D6",
        "=^=v=",
        "bee47dbf-17fc-f0eb-679f-677d127ffd3b",
        "CheckDiskSpace: Error reporting telemetry for EXT_DRIVE_FREESPACE: [0x%X]",
        "CDlpActionFinalize::DeserializeBootFinalize",
        "L'eseguibile di installazione non ",
        "Microsoft.Windows.22.X18-81295_8wekyb3d8bbwe",
        "PVVVVh",
        "07627a21-3c49-b6ae-3dd0-7ba104418691",
        "Automation: Registered MIGCHOICE Response",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionDebuggerOptionsFactory,class CDlpActionDebuggerOptions>::CreateAction",
        "0F1Q1_1",
        "A rendszer nem felel meg az adathordoz",
        "Microsoft.Windows.99.X19-99656_8wekyb3d8bbwe",
        "system",
        "0U0~0",
        "ImageFinalize: Initializing Extended:                         [0x%x]",
        "0c599bd9-67dd-f575-eade-643711673982",
        "NT4CF-K26Y7-BBKBT-7CMJ3-M7VY6",
        "Der blev ikke fundet et destinationsdrevbogstav. %0",
        "o pode continuar porque uma opera",
        "c1b5512e-912c-d7d1-4991-7c7ef5583f9a",
        "892a8101-0d5b-d0de-9bc2-db4118ed5f21",
        "1(1/1@1Q1",
        "> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>",
        "RtlXmlDestroyNextLogicalThing(this)",
        "T<hW0j0D0_0",
        "<F=s=}=",
        "oikeussopimuksen.%0",
        "%s\\%s.mui",
        "99:m:",
        "GenuineTicket.xml",
        ":';.;y;",
        "Microsoft.Windows.100.X20-29651_8wekyb3d8bbwe",
        "l meg",
        "1q1]2d2t2{2",
        "Microsoft.Windows.8.X21-83184_8wekyb3d8bbwe",
        " possibile continuare l'installazione perch",
        " po p",
        "f;D$ u",
        "RtlSubscribeWnfStateChangeNotification",
        "TempTempElements.Allocate(NewCapacity)",
        "Microsoft.Windows.50.X21-83779_8wekyb3d8bbwe",
        "??0exception@@QAE@ABV0@@Z",
        "RegCloseKey",
        "0_0_0",
        "DUSetup: No files were unpacked. No DUSetup Updates.",
        "DataMigration",
        "Microsoft.Windows.145.res-v4301_8wekyb3d8bbwe",
        "Microsoft.Windows.168.X21-83757_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X20-39270_8wekyb3d8bbwe",
        "fd0aad15-cdd9-c15e-7533-dc94ca912956",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::Pause",
        "The installation executable was not found.%0",
        "84d03470-29bc-75b1-add9-0cae3bc17ba6",
        "NHr,g",
        "BootFinalize: Initializing SQM:                        [%s]",
        "@_^[]",
        "Finalize: Finalizing the deployment of the new OS",
        "1i152l2",
        "8 8$8(8,8084888<8@8D8H8L8T8l8|8",
        "fbf5ca2d-b8b7-cae4-5660-043932da6310",
        "m limitu reklamu.%0",
        "y/VhHQ",
        "7%8Q8}8",
        "CompressFileBackedByWim",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::CheckUserInterruptEx",
        "34WMX-7NV29-GCXJX-TPHXB-VQWVT",
        "041204B0",
        "466c5e18-450d-99e3-9d2a-d72cec734277",
        "Microsoft.Windows.125.X21-83230_8wekyb3d8bbwe",
        "Microsoft.Windows.125.res-v4248_8wekyb3d8bbwe",
        "7HBDQ-QNKVG-K4RBF-HMBY6-YG9R6",
        "<'=A=",
        ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VICompatAction@@@@@@",
        "7I7Q7Z7b7r7",
        "Microsoft.Windows.50.X21-83774_8wekyb3d8bbwe",
        "ffades.%0",
        "NHJ23-Q3MBT-9TW8K-R39KV-94T4D",
        "R7NF4-FB42P-TMDF8-TKYHG-KTPJK",
        "Microsoft.Windows.8.X18-78293_8wekyb3d8bbwe",
        "ce14a187-835c-7270-6fcb-602268e16063",
        "|$ +D$4;D$L",
        "Saved device scan result at : %s",
        "4(4U4",
        "25ea8193-f7f3-e032-fe1f-753719340d8d",
        "GetFileContents",
        "PNJTQ-7MFX9-CVF69-2BJCP-KW4FT",
        "DeferEula from Response [%s]",
        ">#><>C>[>",
        "aa7f433b-3137-5f8e-bb36-a8d576843324",
        "%s: Entering Execute Method",
        "Microsoft.Windows.48.X19-98799_8wekyb3d8bbwe",
        "bbeb2b03-f9d6-cb96-9d24-37a880f01aa0",
        "GetModuleFileNameW",
        "92b74606-d291-8d47-ab15-15bd95d081c7",
        "CDlpActionDiskSpaceReq::SerializeDownloadReq",
        "NQ2H6-X7Y93-H6RWK-PCTQC-3YJWD",
        "Een success-script kan niet worden uitgevoerd of heeft een fout geretourneerd.%0",
        "Target Image: Architecture = [%d]",
        "De compatibiliteitsproblemen voor minimumvereisten zijn niet opgelost binnen de vereiste tijdslimiet.%0",
        "8.8K8r8",
        "lle ei tule antaa ilmoitusta.%0",
        "Compatibility: Starting Wait",
        "t a nainstalovat image pro tento syst",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionUpdateMediaFactory,class CDlpActionUpdateMedia>::CreateAction",
        "me. %0",
        "dd3e4a20-2e8e-2200-1d80-7a9f51df37a4",
        "6V268-4N9HR-2YD74-XTGTT-H8T73",
        "0&0L0W0w0",
        "Not-null check failed: DataBlock",
        "GetFileSize",
        "Microsoft.Windows.98.X19-99587_8wekyb3d8bbwe",
        "FWW6F-BMN4Y-VJ2C2-D3XKH-VT9RG",
        "bdb94eca-2cfc-0c73-ed76-7c79ca34d429",
        "n binaaritiedostoista. Tarkista paketin sis",
        "L'utilisateur n'a pas accept",
        "6(737X7c7",
        "2!2.2H2",
        "homebasicn",
        "CDlpActionFinalize::DeserializeImageFinalize",
        "Microsoft.Windows.8.X18-81283_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X19-98882_8wekyb3d8bbwe",
        "Proces instalacji jest u",
        "SetupCore: Registered DATA_MIGRATE action",
        "lemi i",
        "image d",
        "professional",
        "DUSetup: Unpacking DUSetup updates to %s ",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::GetResults",
        "3320b35f-7ff0-becf-6aa1-0175877f6f70",
        "4D4O4{4",
        "6YDB8-N9JVF-PWCX4-G9RQY-8FHY3",
        "Integer overflow after ReadData",
        "Microsoft.Windows.126.X20-00860_8wekyb3d8bbwe",
        "CMicrodomBuilder::ConsumeComment",
        "m prost",
        ">:?}?",
        "MigChoice: Location where selected install choice found: [%ld]",
        "9^(teh",
        "UpdateMedia: Initializing UpdateMediaOptInDefault:  [%s]",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementsByTagName",
        "zh-Hant",
        "ad13527a-3945-c9a6-f889-2564adff724a",
        "242\\2",
        "RtlIsMicrodomUpdateContextValid(TheContext)",
        "4$4^4",
        "CDlpActionImageDeploy::ReportImageInfo",
        "RtlGetCharacterSetDecoder",
        "PhMSDM",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::SetParameters",
        "Microsoft.Windows.100.X20-29652_8wekyb3d8bbwe",
        "2711a61e-4fdb-c5c7-6d0a-a23a5078af86",
        "STATUS_OBJECT_NAME_NOT_FOUND",
        "1o1u1{1",
        "Flight-id'et er tomt.%0",
        "FinalizeExit",
        "De gebruiker is niet binnen de vereiste tijdslimiet akkoord gegaan met de aankondiging.%0",
        "O arquivo de configura",
        "No se encontr",
        "Microsoft.Windows.49.X19-98864_8wekyb3d8bbwe",
        "ijal v po",
        " stato eseguito o ha restituito un errore.%0",
        "Microsoft.Windows.125.X21-83261_8wekyb3d8bbwe",
        ":::U:}:",
        "gd-GB",
        "x*h@D",
        ".?AVCDlpActionAdvertiseFactory@@",
        "741a45a5-a7d2-c55d-2897-50a9633615ad",
        "m_StoredTable.FindOrInsertIfNotPresent(p, (USHORT)0, 0, &fExisted)",
        "3cd9f349-08ec-7091-b735-90078bb772bc",
        "265b78c7-3bda-8847-5514-6c5b14afca60",
        "not a socket",
        ".?AV?$CZeroInit@VCDlpActionGetWebSetupUserInput@@$00@@",
        "FACILTIY_MUI_ERROR_CODE",
        ".?AVexception@@",
        "misvaihtoehdon vaatimuksia.%0",
        "ak. Ellen",
        "e979be29-9c63-a516-83fb-40747e27afc4",
        "CDlpActionPackageMigrate::SerializeRoutine",
        ".data",
        "3N3Y3",
        "nea de comandos no v",
        "d093d17b-dd5a-f540-defc-74cbe63ba66d",
        "6PDNC-RCFJJ-H6K7C-MWRWY-FF8JX",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionFinalizeFactory,class CDlpActionFinalize>::SetActionId",
        " bozuktu.%0",
        "Microsoft.Windows.101.X19-98869_8wekyb3d8bbwe",
        "021E1",
        "CDlpActionProductKeyValidate::SearchForKeyInSkuLib",
        "Microsoft.Windows.42.X14-19709_8wekyb3d8bbwe",
        " ett ospecificerat fel.%0",
        "Eula: Eula File Path: [%s]",
        "o pode continuar porque est",
        "alable n",
        "Microsoft.Windows.100.X20-29716_8wekyb3d8bbwe",
        " Eula",
        "7903d126-2405-8df0-586e-6d8877d86549",
        "MigChoice: Selected install choice: [%ld]",
        "ExecuteInstallReq: Error reporting telemetry for bSpaceReqBlock: [0x%X]",
        "CDlpActionImageDeployFactory::CreateInstanceRoutine",
        "Microsoft.Windows.17.X17-66963_8wekyb3d8bbwe",
        " instalacji z powodu braku wymaganego zadania.%0",
        "8ed16054-b812-aa7d-85ad-24f4e0f29b08",
        "yla birle",
        "rio usou a linha de comando setup.exe para fazer somente verifica",
        "81b602a0-509e-816d-37a8-05c0c03acd17",
        ",f~|z[WP",
        "9C0t ",
        "XGVPP-NMH47-7TTHJ-W3FW7-8HV2C",
        "nama ortam",
        "NBTQ7-XRQ9R-GXK6H-Y62RX-QV7PK",
        "exploitation Microsoft",
        "Microsoft.Windows.100.X19-99457_8wekyb3d8bbwe",
        "8N3M3-KQXF4-HHQ4Y-WRGXH-463GV",
        "1R1]1d1",
        "La proc",
        "4-4n4",
        "Nn0OUL",
        "Not-null check failed: ComparisonResult",
        "CDlpActionFinalize::UploadAdditionalSqmToSetupPlatform",
        "RGN8P-66G78-QBGVD-VY73P-FX8V6",
        "F8NYP-GYGDR-8C6BC-9FHMJ-K2FBX",
        "Microsoft.Windows.100.X19-99434_8wekyb3d8bbwe",
        ";I;h;",
        "Microsoft.Windows.48.X19-98814_8wekyb3d8bbwe",
        "MoSetupPlatform: Setting Watson bucketing parameter -> [%d]=[%s]",
        "CDlpActionImageDeploy::CancelRoutine",
        "ZwDeviceIoControlFile",
        "4.43494M4R4^4o4w4",
        "InstallationType",
        "C92DR-NKFCM-QQV84-P9HBG-RRJYR",
        "RN7HF-W962Q-329TQ-GH4B3-Y4G6Q",
        "N4XM6-FYMQM-8K2CG-D6DDH-RGF9C",
        "ponse du serveur est incorrecte.%0",
        "y/VhV",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionCompatFactory,class CDlpActionCompat>::GetActionId",
        "Microsoft.Windows.4.X21-83177_8wekyb3d8bbwe",
        "VBJPB-NVV3Y-3XGWX-79GDQ-MDWVG",
        "4,434e4",
        "Microsoft.Windows.172.X21-24709_8wekyb3d8bbwe",
        "hu-HU",
        "Microsoft.Windows.101.X19-99542_8wekyb3d8bbwe",
        "beb015c9-08a9-2940-41af-4fcbb24710b5",
        "27738001-6dbe-7009-bb4b-21b600ce7141",
        "*ppObject = State->m_pAllocator->Allocate<RemoveFeature>()",
        " une action.%0",
        "MVTXD-8N8H9-X2RY8-C28V8-W4633",
        "G43BN-4MD4H-MDCFH-PCCGY-92FVW",
        "Could not query file size for {0}",
        "=4=8=P=T=X=\\=`=d=h=l=p=t=",
        "App block found: [%s]",
        "BcdGetElementDataWithFlags: Failed to open key.Object: %ws Type: %ws Status: %x",
        "XFRQW-P8NBD-VFRFX-V2GDD-B98XJ",
        "ERROR_SHARING_VIOLATION",
        "Microsoft.Windows.188.X21-99370_8wekyb3d8bbwe",
        "re vonatkoz",
        "3!3A3[3",
        "haw-US",
        "A setup.exe parancssori futtat",
        "az-Cyrl",
        "DownlevelProductName",
        "header type/size mismatch",
        "9bc9e33d-de99-85e3-5fc1-36f8a150b5d9",
        "El sistema no cumple los requisitos m",
        "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::PreInit",
        "MWYTD-X8Q89-HTPBF-V3GYX-4V6XW",
        "?(?4?T?\\?d?p?",
        "N9VXB-H6WXT-HBMGX-K3WKJ-MTBP2",
        "sa csak ellen",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::GetActionName",
        "o foi encontrado.%0",
        ":,;3;<;I;",
        "DUSetup: Unpacked DUSetup Updates. Setup will be restarted.",
        "285c6b05-d723-801e-63e8-ecf28715fb12",
        "tjuk a telep",
        "1)1f1",
        ";7;<;H;`;",
        "SearchLocation",
        "68211120-e96f-cc7d-f73c-902f42a2ea5d",
        "1e258837-a89c-5d3d-74a1-f783947ac97b",
        "TheEndElement = this->AllocateStreamObject()",
        "7A7O7@8",
        "Keyform",
        "ProductKey: EI.cfg file did not contain an install channel.",
        "a5dacf6a-c950-dc54-1c2d-94ce092bbb09",
        "Microsoft.Windows.48.X20-29653_8wekyb3d8bbwe",
        "CreateFileMappingW",
        "O execut",
        " operacji finalizacji.%0",
        "Microsoft.Windows.100.X20-29713_8wekyb3d8bbwe",
        "880b245d-9556-9beb-eabc-f1aae20ea9fa",
        "CloseEncryptedFileRaw",
        "XDWQ9-DDNCH-CY4WT-KXWBG-2373P",
        "3HT3D-MN7HX-8K27D-QMM37-JQKQ6",
        "Microsoft.Windows.99.res-v3423_8wekyb3d8bbwe",
        "2e25a585-4505-bb00-6373-caafe0d0bc83",
        "SLGetSLIDList",
        "Finalize: Converting [%d] downlevel ticks to seconds...",
        "L'utente non ha accettato l'annuncio entro il limite di tempo richiesto.%0",
        "ImageExit: Initializing Target:      [%c]",
        " des fins de test.%0",
        "Systemet oppfyller ikke kravene for det valgte overf",
        "CDlpActionPreFinalize::InitializeDriverMigration",
        "Die Installation kann nicht fortgesetzt werden, da beim Finalisieren das zuvor gestartete Update nicht fortgesetzt werden kann.%0",
        "KNVVP-6PX6M-W9FDR-TQ496-9KYRP",
        "=;>D>I>`>",
        "sr-Cyrl-CS",
        "Windows::Rtl::CRtlObjectTypeDescription<class MicrodomImplementation::CMicrodom>::CreateTearoff",
        "GetCurrentProcessId",
        "b2130469-0378-d87b-2a1c-e9f9c2b8e4da",
        "ProfessionalWorkstation",
        "Microsoft.Windows.125.X21-03400_8wekyb3d8bbwe",
        "CWHNV-R8QM6-8JQM8-4874Q-GF4TP",
        "Microsoft.Windows.126.X21-83282_8wekyb3d8bbwe",
        "Microsoft.Windows.4.X19-98699_8wekyb3d8bbwe",
        "ResNodesLoad",
        "KN6V4-GPDQY-HYMV2-M38RK-T83D8",
        "Los problemas de espacio en el disco de instalaci",
        "Identyfikator pakietu testowego jest pusty.%0",
        "Microsoft.Windows.99.X20-29700_8wekyb3d8bbwe",
        "ProductKey: Error reporting telemetry for m_shEditionId: [0x%X]",
        "BCryptGetProperty",
        "Impossibile visualizzare il report di compatibilit",
        "Microsoft.Windows.50.X21-83766_8wekyb3d8bbwe",
        "405M5d5",
        "4a12d14e-b753-e6ec-7063-3affc3de6814",
        "u#j~hP",
        "W0~0[0",
        "ks-Arab",
        "<#=/=g=q=",
        "INVALID_HANDLE",
        "Microsoft.Windows.98.X20-35498_8wekyb3d8bbwe",
        "ImageFinalize: Initializing Enterprise Attribution:           [%s]",
        "ca39f679-5717-4c8f-c82e-9a5d352ecb9f",
        "Microsoft.Windows.4.X19-98710_8wekyb3d8bbwe",
        "Target OS: Disabling migration of host settings.",
        "CDlpActionFinalize::SerializeImageFinalize",
        "Nem a v",
        "El archivo de configuraci",
        " || LogMessage: ",
        "*ppObject = State->m_pAllocator->Allocate<Payload>()",
        "T2B3W-RJN32-32HFV-82TKM-K7Y9G",
        "Microsoft.Windows.165.res-v3794_8wekyb3d8bbwe",
        "o inesperada de bin",
        ".idata$4",
        "e055fe7a-6220-2293-1814-0d8e8088255b",
        "3V5M6m6t6+7",
        "Microsoft.Windows.146.X21-83745_8wekyb3d8bbwe",
        "J7728-RHNBP-X8XYD-H9P7R-VMKRV",
        "serverazurenano",
        "TargetName",
        "NVRRD-FG4TH-V8V63-CHDB4-R3KR2",
        "ImageDeploy: Initialized the NewSystem object",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::DeserializeRoutine",
        "3)3?3s3",
        "en-GB",
        "324v4",
        "~(u7b",
        "Recovery: Examining Offline OS: [%s]...",
        ".?AVCMoOnlineStore@@",
        "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX",
        "CompatMigrationChoice",
        "4c747df9-ab56-cd62-ba2e-cf41957fecd2",
        "DiskSpaceInstallReq: Initializing LangPack Count         [%ld]",
        "8 8?8a8q8",
        ";0;:;D;N;X;b;",
        "o corresponde.%0",
        "5[6.7",
        "c6d71333-0efa-4192-1388-07b002457eb6",
        "6N6o6",
        "<)<2<D<",
        "CDlpActionPreFinalize::ExecuteRoutine",
        "D2J5A",
        "*ppObject = State->m_pAllocator->Allocate<Plan>()",
        "el-GR",
        "in ge",
        "8db8c511-02ff-d1bb-4179-41c1ec35d3b6",
        "VSh0%",
        "Microsoft.Windows.145.X21-83688_8wekyb3d8bbwe",
        "CDlpActionGetWebSetupUserInput::GetResultsRoutine",
        " stato avviato con un argomento della riga di comando sconosciuto.%0",
        "1'2O2",
        "9:9^9h9",
        ";-;8;d;o;",
        "Microsoft.Windows.8.res-v4305_8wekyb3d8bbwe",
        "MigrateDriversDefault",
        "PackageMigration: skipping critical update packages...",
        "CDlpActionProductKeyValidate::FindMatchingImages",
        "8-8n8",
        "Compatibility: Creating RegKey for Driver Reflect",
        "15cced35-e3d9-187a-581d-2661ca5db923",
        "MVRWT-69NTQ-GVC6B-H6Q23-JT2M8",
        "ImageDeploy: Created Setup Platform",
        "CompatIssuesFound",
        "sr-BA-Latn",
        "%BASE_N%",
        "ko-KR",
        ".?AV?$CZeroInit@VCDlpActionUpdateMedia@@$00@@",
        "PackageMigration: Initializing LangPacks Path:      [%s]",
        "BNYY9-422WC-Y3K9J-B6DB4-R3KQQ",
        "jra kell ind",
        "58625109-8bde-ecbc-0198-92d05a7a233e",
        "InitLZMSDecompression",
        "Zu,A;",
        "DUSetup: Invoking download on Payload SetupDU",
        "8ce91d7f-531b-98b7-c922-32c54bc5eea7",
        "CDlpActionEula::InitializeRoutine",
        "GetCurrentDirectoryW",
        "LXPLicensePaths",
        "97:>:",
        "CNH8T-Q7JMM-4M8BY-3FVDX-2YT63",
        "Microsoft.Windows.101.X20-44908_8wekyb3d8bbwe",
        "WINDP",
        "?what@exception@@UBEPBDXZ",
        "de-AT",
        ";$;7;>;o;",
        ".?AV?$CZeroInit@VCFCPayloadDUCallback@CDlpActionDU@@$00@@",
        "es-PE",
        "7f09bbc0-3bf5-ea0c-1f31-13deab161c06",
        "VW3XX-NY4T6-Q79C2-GC6M2-3YJWC",
        "FACILITY_TRANSACTION",
        "CDlpActionDiskSpaceReq::SerializeInstallReq",
        "CreatePath: Unable to create [%s]; GLE = 0x%x",
        "G4N9R-HX2VG-633R6-6P84P-PGY6Q",
        "Microsoft.Windows.48.X20-29559_8wekyb3d8bbwe",
        "ytkownik wybra",
        "La respuesta del servidor tiene un formato incorrecto.%0",
        "&0F0v0",
        "869|9",
        ":U;\\;",
        "YC7N8-G7WR6-9WR4H-6Y2W4-KBT6X",
        " Microsoft Corporation. Kaikki oikeudet pid",
        "DUImage: OsBranch: [%s]",
        "7f7q7",
        "lise do dispositivo para instalar a atualiza",
        "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control",
        "DXH3Y-8N27T-MJVDQ-WP3J6-683XY",
        "Microsoft.Windows.121.X19-98675_8wekyb3d8bbwe",
        "%s | %s",
        "si folyamat ismeretlen parancssori argumentummal indult el.%0",
        "=/=9=",
        "UpdateMedia",
        "OnlineRollbackArgsUser",
        "pToInsert != 0",
        "ZwWaitForSingleObject",
        ">3?b?u?",
        "D$TPQQ",
        "5298a995-209f-7023-95f5-99695691f69b",
        "installation ne peut pas continuer, car la finalisation ne peut pas reprendre la mise ",
        ". Olaylar raporlanam",
        "59b92eff-6bda-d70f-762e-bec940eda9f3",
        "STATUS_UNSUCCESSFUL",
        "JN9HR-MH7K4-DBPDD-TFTXF-Q9MMF",
        "Client",
        "r die gew",
        "6>7j7q7",
        "Os arquivos de conte",
        "El usuario ha elegido cancelar de contrato de licencia.%0",
        "Installasjonsprosessen ble uventet avsluttet.%0",
        "SYSTEM\\Setup\\MoSetup\\NotificationSQM",
        "The installation process requires that the user accept the license agreement.%0",
        ".w.t,",
        "MoSetupPlatform: Using action error code: [0x%X]",
        "DUImage: Instance created!",
        "3dabea62-0ebe-b7b6-f5da-31fe4510ce91",
        "tta eftersom en n",
        "2R2n2",
        "Um script pr",
        "CMicrodomBuilder::CElementNameToAttributeListTable::MaybeInsert",
        "smj-SE",
        "97e3e06d-b3a4-2f58-d350-12798e96d213",
        "H0O0m0",
        "MoSetupPlatform: Creating CLEANINSTALL Fail Forward system...",
        "Microsoft.Windows.122.X20-35510_8wekyb3d8bbwe",
        "m nespl",
        "PreFinalize: Initializing Migrate drivers:     [%d]",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionAdvertiseFactory,class CDlpActionAdvertise>::SetActionId",
        "_CxxThrowException",
        "0ce774e8-d71f-d5fb-9540-597ddab0cb5d",
        "Microsoft.Windows.72.X19-98718_8wekyb3d8bbwe",
        "8NT82-JYHPQ-9TDH4-V3C4M-6VMRF",
        "GX7VW-JRNT2-7MXMP-DMTHP-V8RJW",
        "RKW9C-8NW8G-R4K3M-R664B-F9D8M",
        "CDlpActionCompat::InitializeInstallReqScan",
        "jHhHr,g",
        "43c11182-1dfa-8d0b-907f-461f1fb1ff4e",
        "1#2M2c2",
        "5>5I5s5~5",
        "DUImage: DCAT offer not found",
        "STATUS_OBJECT_PATH_SYNTAX_BAD",
        "ar-LB",
        "DiskSpace: Required disk space is only [%ld] MB, raising it to 200 MB",
        "En opprydding fra et tidligere installasjonsfors",
        "read only file system",
        "ur-IN",
        "T49Q4-NV8XR-WRXD9-4Y78C-D7CJ4",
        "cd080564-f99d-f780-3688-0e05829ba48e",
        "102a2",
        ":V:]:r:",
        "__rv.NewCursorValue != 0",
        "1#1P1Z1",
        "S,_^[",
        "%CLIENT%",
        "CJT62-7TNTH-6JCHF-CHM2V-PWF7M",
        "Microsoft.Windows.27.res-v3300_8wekyb3d8bbwe",
        "enterpriseg",
        "istiedostoa.%0",
        "5646aab3-53d6-37f1-41d4-bc75eda9f052",
        "69730167-1b91-c662-365d-df42ff362327",
        "%hs: Failed to open 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion'. Error = %d",
        "Microsoft.Windows.100.X20-29646_8wekyb3d8bbwe",
        "9bc8403e-5462-4701-4ce3-0ff3f931f3c7",
        "si-LK",
        "PPPhLE",
        "Esta vers",
        "U0S0Q",
        "Windows::uDom::Rtl::RtlMicrodomUpdateSetNodeTextContent",
        "WATSON_BUGCHECK_P2",
        " verificato un errore e il valore risultante deve essere consolidato a fini di telemetria.%0",
        "4b1fc7cb-08a1-6382-537e-6d13fd9e2e9f",
        "DeleteFileEx: Unable to clear out attributes on [%s]; GLE = 0x%x",
        "ndirilecek paket yok.%0",
        "4/5@5",
        "m proveden",
        "RemoveFeature",
        "FveAddTrustedWimData",
        "Microsoft.Windows.49.X19-98828_8wekyb3d8bbwe",
        ">(>5>U>a>h>",
        ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIMoSetupDlpAction@@@@@@@@",
        "Latauksen yhteensopivuusongelmia ei ratkaistu aikarajaan menness",
        "serverdatacentercor",
        "HVYNB-XGJ47-FJYM2-7XM7H-7QYRK",
        "YWRXB-FNXQ6-TH9QB-6PKW6-683GG",
        "SVhh#",
        "Microsoft.Windows.98.X20-29636_8wekyb3d8bbwe",
        "The install cannot continue because the instance hash does not match.%0",
        "yEVjp",
        "RtlDosPathNameToNtPathName_U_WithStatus",
        "fr-ML",
        "ImageDeploy: Initializing Disable Shift F10:     [%s]",
        "Microsoft.Windows.165.X21-06165_8wekyb3d8bbwe",
        "N63P7-TWY9H-PM7RK-3TPMC-CKCJK",
        "6\"7/7",
        "Microsoft.Windows.99.X20-23532_8wekyb3d8bbwe",
        "BREAKPOINT",
        "9$9+9^9e9",
        "9T$(r\"",
        "Microsoft.Windows.48.X20-29655_8wekyb3d8bbwe",
        "PreFinalize: Finalizing the deployment of the new OS",
        "Microsoft.Windows.100.X19-99445_8wekyb3d8bbwe",
        "6YBN7-DRWHP-9DGM8-9QGYX-JXCHH",
        "tt be a sz",
        "u 9C<",
        "InitializeAcl",
        "it, proto",
        "0482159b-1c73-e7a0-616b-b1889c7ab005",
        "bd9d8629-5126-20e9-4053-b7d30ca60d22",
        "5o6v6",
        "NKDHV-XJXBT-GMPRK-CC7BV-B7WY2",
        "81dd2f1c-4e27-8251-71ab-4b250de2b3cc",
        ".?AV?$CMoSetupUnknownImpl@VCSetupCore@@@@",
        "PVN2P-FR3KC-9FYPM-BXKDC-PG2JD",
        ">@.6Y",
        "r systemet.%0",
        "Thales TSS ESN:0842-4BE6-C29A1%0#",
        "8/8P8",
        " se aktu",
        "L$ Qht",
        "r att ladda ned uppdateringen.%0",
        "SLGetWindowsInformationDWORD",
        "Plik wykonywalny GatherOsState ma nieprawid",
        "MoSetupPlatform: The recovery image is not available.",
        "HRESULT_FROM_NT(",
        "N8FHW-G2P4G-DYVDY-BYHVQ-XHKXT",
        ";);J;k;",
        "MCWRC-6QNM6-GJYWP-JMR8V-HXMMG",
        "353k3",
        "CDlpActionPackageMigrate::RemovePackages",
        "CRtlGrowingList<struct _XMLDOC_ATTRIBUTE,50,6>::Initialize",
        "me d'exploitation.%0",
        "47e5a8af-a234-a300-36f3-dc48e11cfdb8",
        "zanego z niepowodzeniem nie powiod",
        "Y8XFV-4YNCP-F4KQQ-YHH9T-8TYPT",
        "cbeef714-6746-66f1-d953-ae0adf977d91",
        "Microsoft.Windows.48.X19-99717_8wekyb3d8bbwe",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionGetWebSetupUserInputFactory,class CDlpActionGetWebSetupUserInput>::GetActionId",
        "Microsoft.Windows.122.X20-29616_8wekyb3d8bbwe",
        "e777c773-b97e-bd46-f198-773da304a3ce",
        "Not-null check failed: pfn2",
        "?1?@?g?",
        "ARRAY_BOUNDS_EXCEEDED",
        "Not-null check failed: String2",
        "TmiMatrix",
        "182b2j2z2",
        "kleme beti",
        "BRANDING_OPTIONAL_RESOURCEID_MAP",
        ">;?]?",
        "4\"4=4G425",
        "7836984b-2301-56bf-6f7a-8113975e37cd",
        "RtlAppendUnicodeToString",
        "Bl(u7b",
        "Microsoft.Windows.121.X21-83177_8wekyb3d8bbwe",
        "ba0fee7d-77f8-202f-27e1-72e35791088a",
        ".?AV?$CZeroInit@VCMoOnlineStore@@$00@@",
        "6d6x6",
        "ACCESS_VIOLATION",
        "CDlpActionFinalize::ExecuteSetupPlatformFinalize",
        "::RtlIsLUtf8StringValid(Destination)",
        "42HRM-9NF7J-8QV86-KR3XH-B7XPG",
        "r%s__Count",
        "MoSetupPlatform: Requesting install of FOD packages from [%s]...",
        "DataMigration: Searching for private files...",
        "R2TJ7-9DNRJ-JY6XW-PXVKH-KHJXQ",
        "stroje nen",
        "8QC6Y-6NQ7G-R24PQ-WJYW3-DV8V9",
        "W0f0D0",
        "CDlpActionGetWebSetupUserInput::GetHostOsInfo",
        "K8XQY-KN4WM-KDT29-VXVJW-J8F78",
        "2Y3c3w3~3",
        "511f5299-b4a2-ade0-c018-73d11882d153",
        "ObjectLength",
        "Microsoft.Windows.100.X20-35499_8wekyb3d8bbwe",
        "279aa730-0ee8-3f90-6ca6-b8235308c63d",
        "281a62aa-60ef-a491-aa39-44df62171ced",
        "RtlIsLUtf8StringValid(LocalName)",
        "(NewNamespace == 0) || RtlIsLUtf8StringValid(NewNamespace)",
        "Microsoft.Windows.4.X19-98719_8wekyb3d8bbwe",
        ";4;8;<;@;T;X;\\;t;x;",
        "DataMigration: Copying ActionList.xml to working directory",
        "NG8GB-PRKDX-K6FMJ-4PT47-HXMM3",
        "cia systemu.%0",
        "r pakkens indhold.%0",
        "Microsoft.Windows.48.res-v3308_8wekyb3d8bbwe",
        "67d8123c-fecb-f631-f652-2a5c5ae96520",
        "argument list too long",
        "773b7db7-46ef-8650-86d3-d84b5c74276a",
        "20eddc5e-b78c-6ee7-d3c0-7e9a7da92cf5",
        "WindowsLockdownTrialMode",
        "WWNBF-8QPVM-WGWV2-939VV-JQKRY",
        "LeaveCriticalSection",
        "en-ZA",
        "Microsoft.Windows.101.X20-00914_8wekyb3d8bbwe",
        "979>9D9",
        "848970dd-94aa-653a-678c-d1fa6fb2f5f8",
        "Microsoft.Windows.7.X21-83748_8wekyb3d8bbwe",
        "3WFXN-BKYG9-WGVPV-66V4F-WFG4J",
        "XGNJ6-WRVRD-M4R3Q-8BTC4-6Q73B",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementById",
        "Windows::uDom::Rtl::RtlMicrodomUpdateCreateAttributeNs",
        "adavky pro instalaci aktualizace.%0",
        "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE",
        "ImageName",
        "Microsoft.Windows.122.X19-98894_8wekyb3d8bbwe",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttribute",
        ")`yJb",
        "8bce8ef0-abe4-0e56-62ad-d1ac5881a394",
        "3MHNP-33X7K-Q9MYM-9QP7H-DRTTW",
        ".rdata$T$brc",
        "CDlpActionDU::InitializeDUSetup",
        "De installatie kan niet worden voortgezet omdat de exemplaar-hash niet overeenkomt.%0",
        "808=8S8]8u8",
        "a97cdb8f-b1d6-29c4-15d1-aeb99755e9ef",
        "Microsoft.Windows.98.X20-29581_8wekyb3d8bbwe",
        "Canonical",
        "teG;}",
        "6%6]6d6y6",
        "DataMigration: Initializing FailFwd Flags:                      [0x%X]",
        "8t8{8",
        "504b26ab-1d30-c937-3850-3e123cb0e3ca",
        "Het installatieproces is gestopt voor testdoeleinden.%0",
        ".?AV?$CZeroInit@VCDlpActionDiskSpaceReqFactory@@$00@@",
        "Failure from: %hs, line: %d, you can set break point on 'DebugOnError' function",
        "valuation est vide.%0",
        "WinSatIsScoreValid",
        "STATUS_INSUFFICIENT_RESOURCES",
        "NewProcessingInstruction = this->AllocateStreamObject()",
        "Microsoft.Windows.50.X21-83787_8wekyb3d8bbwe",
        "CDlpActionGetWebSetupUserInput::IsOfferLanguageMatch",
        "WinSatCpuScore",
        ".?AVCDlpActionPackageMigrateFactory@@",
        "RequestDriveFromAutomation",
        "e12553c6-fcd2-841a-c3a4-b1fa488a7570",
        "CDlpActionCompat::DeserializeDownloadReqScan",
        "ProductKey: Offer RegValue = [%s].",
        "l1XJT",
        "75c02135-2102-93b8-6fd4-11f0d11291de",
        "90d44f43-4581-295d-87d4-9b7d1d1f2fb0",
        "63be66eb-301a-b651-a0b2-8f453e71b14e",
        "STATUS_INVALID_PARAMETER",
        "Microsoft.Windows.99.X20-15871_8wekyb3d8bbwe",
        "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9",
        "nMoSetupPlatform: Platform and Setup binaries match!",
        "38NQ9-CYXDQ-24VFP-DR7G8-JFG3R",
        "(FixedSizeBuffer != 0) || (DynamicBuffer != 0)",
        "3#41484Q4",
        "M6Y8X-H8N8Y-PKKFJ-39FWV-R9CJP",
        "FBVNY-B4B3R-WG8YB-RHV8Y-PR4DG",
        "fd7b7f16-b90b-428e-957a-1c0d6ba0cb38",
        "Microsoft.Windows.7.X21-83743_8wekyb3d8bbwe",
        ">,>4><>D>L>T>\\>d>l>t>|>",
        "209a0f53-a608-3dc8-a81e-69b545064fa2",
        "HeapDestroy",
        "ERROR_SXS_FILE_NOT_PART_OF_ASSEMBLY",
        "RtlNsInitialize(this, Comparison, pvCompareContext, Alloc)",
        "Wykonywanie skryptu przed zatwierdzeniem nie powiod",
        "PackageMigration: skipping FOD packages...",
        "0C0d0",
        "080404B0",
        "db1ad587-2c56-f36a-f684-52df42a2b75f",
        "D$,Pm",
        "dvendig opgave.%0",
        "c9c54775-1002-dbee-8d2f-360cd6482404",
        "VWhlC",
        ".?AVCDlpActionDebuggerOptions@@",
        "SKUName",
        "ms-BN",
        "040E04B0",
        "FACILITY_COMMONLOG",
        "ar-IQ",
        "VBNFV-K94KJ-WQX6X-2WMH7-QPFTR",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IMoSetupDlpAction> > > >::CheckInitialized",
        "e6877017-2616-f5e3-1036-edafdef7aee8",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasChildNodes",
        "OutputDebugStringW",
        "DeleteFileEx: Unable to open [%s]; GLE = 0x%x",
        ";C<c<",
        "SkipDiskProvisioning",
        "fb3c6bbb-3004-83c0-f150-cd345e317e5c",
        "2444e02c-fc98-96f2-9218-b755b59d4b8e",
        "c923808a-38de-5705-9150-4d3ed30893b2",
        "DUImage: ImageInfo set populated properly.",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionCompatFactory@@VCDlpActionCompat@@@@",
        "D$0QQ",
        "bad address",
        "20L0e0~0",
        "d15d8aa7-4d6c-a222-f2ad-b5edc9194bcb",
        "8G4DR-2N4RK-R6RJH-Y9XJB-CWF8M",
        "BTDBB-8NHY8-24BJ7-32KJQ-WQKRM",
        "9P9NR-C9T8T-PFQF9-JRDXP-JB49M",
        "%systemdrive%\\Windows\\system32\\update",
        " a causa della mancanza di un componente di sistema.%0",
        "Microsoft.Windows.126.X21-03402_8wekyb3d8bbwe",
        "DiskSpace: Free space on System Drive: [%llu] MB",
        "serverhpcv",
        "=+>C>",
        "QPC3X-T9NPC-RW8BB-RRGQP-8XCKQ",
        "4%505a5l5",
        "K9MR3-WN7R2-866WW-8MDJ4-BY6PY",
        "7XXPF-NF6M3-VYGHV-F337T-239V3",
        "Ambiente ripristino Windows non pu",
        "SystemStartOptions",
        "=)=<=O=",
        "teleket a hat",
        " stata rilevata una versione imprevista del client dell'agente di aggiornamento.%0",
        "CDlpResponseAutomation::InitializeRoutineDuOptin",
        "VERSION.dll",
        "identifier removed",
        "Partition",
        "Microsoft.Windows.122.X20-00860_8wekyb3d8bbwe",
        "3<3]3l3y3",
        "A rendszer nem felelt meg a friss",
        "Target OS: DomainJoin not available. Removing install choices...",
        "Failed to open key for object's elements. Status: %x",
        ".rdata$r$brc",
        "MM286-PNW8H-36MC4-CVC4D-T6PHF",
        "PNV78-286W9-RQDD9-HTC7K-HCFJW",
        "xsG;}",
        "Microsoft.Windows.48.X20-35542_8wekyb3d8bbwe",
        "Der Benutzer hat sich entschieden, Setup abzubrechen, damit die Deinstallationsoption aktiv bleibt.%0",
        "J6QRN-JRMRY-398JP-R393D-GFXWC",
        ":+;5;_;i;",
        "Microsoft.Windows.4.X19-99693_8wekyb3d8bbwe",
        "O utilizador recorreu a uma linha de comandos setup.exe apenas para realizar apenas uma an",
        "MoSetupPlatform: Package [%s] -> install size [%I64u]",
        "ConX::Setup::Common::COSInfoHelper::GetTargetOSVersion",
        "9;9W9{9",
        "BiCreateBootEntry: Could not retrieve BCD Object application path. Status: %x",
        "<%<f<}<",
        "Sistem, Windows kurtarma i",
        "IsOsPreRS1",
        "JRNV4-WCFVJ-4DTR6-GFT9H-KHJVD",
        " la imagen de la instalaci",
        "FindNextFileNameW",
        "t:9A t59A$t09A(t+9A,t&9A0t!9A4t",
        "CLIENT_K",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::Execute",
        "VP8TQ-B4NC6-D2D27-VV9TF-844BR",
        "6bb92e50-4c42-f6e9-282f-169cf6146a80",
        "@9F$u",
        "> ?L?",
        "041304B0",
        "HomeBasic",
        "Microsoft.Windows.100.X19-99439_8wekyb3d8bbwe",
        "?P?i?",
        "9ae8a256-5851-8f85-11dd-f599b3bd06e5",
        "NH6RH-D3DK6-KXRCV-GH8YV-9BWWV",
        "berpr",
        "4NKF9-DKB62-C37M6-RH4XT-YG9TQ",
        "NVXKD-FXT9G-7VB23-BG97Q-7T9TQ",
        " Microsoft",
        "HNGCC-Y38KG-QVK8D-WMWRK-X86VK",
        "GetProductKeyFromResponse: Automation response not found.",
        "c2ea678c-f40c-4d67-ba6c-012c6c004a07",
        "c938005a-7f79-1022-52e1-74e8bcab0cda",
        "6w6~6",
        "hubos",
        "ExecuteInstallReq: DiskSpace issuses resolved. DiskSpaceReq polling ends",
        "F2YM7-NC42F-GF8H3-3GYK7-7QYMX",
        "no such device or address",
        "Not-null check failed: Result",
        "RPRRj",
        "base\\ntsetup\\diagnostics\\lib\\diagutil\\src\\setupfailurecount.cpp",
        "a58e9c1e-4547-6a3e-a885-895ce76b561e",
        "Microsoft.Windows.98.X19-99602_8wekyb3d8bbwe",
        "ultimate",
        "ulLocation < m_PositionList.Length",
        "6%6b6",
        "RestoreDirMetadata",
        "Microsoft.Windows.122.X19-98695_8wekyb3d8bbwe",
        "0&1B1",
        "CDlpActionCompat::GetResultsFinalizeReq",
        "so-SO",
        "hem f",
        "mn-Mong",
        "Microsoft.Windows.188.X21-99379_8wekyb3d8bbwe",
        "XV48N-GJ8VM-3QFDV-Q6WDQ-RJRBG",
        "jaYjz_j:Z",
        "141c6349-4f91-7fc2-7d69-5dfd298af7ba",
        "GetProductKeyFromResponse: Product key is valid!",
        "trPWQ",
        "9&:M:l:",
        "MoSetupPlatform: NewSystem object created!",
        "CheckHotPluggableDriveEx: Drive %c Unable to query device number for %s Error: 0x%X",
        "c70a7575-282b-f1a0-00ff-feb3f285d602",
        "2863Y-N3JTD-R2644-R44YP-27JVF",
        "Microsoft.Windows.8.X21-83714_8wekyb3d8bbwe",
        "@u)j@j",
        "0!0'0,0A0Q0a0",
        "ImageIndex",
        " || SourceFunction: ",
        "N8DVK-WHQR7-WFRBG-82XQ8-K2FBG",
        "STATUS_FILE_IS_A_DIRECTORY",
        "H6NQT-9MFM7-9XH8W-W69CD-MDYRF",
        "4193bb42-f87a-8117-0b2e-34debe8569dc",
        "343Z3",
        "9(979}9",
        "M2P7N-69983-C3RCQ-Y9FC4-9W3PJ",
        "ProductKey: Digital Marker contained an empty value.",
        "97fb5da4-354e-5841-2921-9db7fad18d37",
        "DEBUG",
        "homepremiumn",
        "%s__%ld",
        "M6GNG-6RRJD-M4VDQ-8K8VW-CPQFQ",
        "_vsnprintf",
        "Valid flags check failed: Flags",
        "PackageMigration: Entered because SafeOS is present..",
        "0/0O0X0e0l0",
        "Microsoft.Windows.17.X17-36805_8wekyb3d8bbwe",
        "0!181c1i1",
        "Microsoft.Windows.48.X20-29671_8wekyb3d8bbwe",
        "5F6\\6",
        ">D>t>",
        "6V43W-6N6XV-HT892-Y6GF7-3J3G3",
        "RtlDuplicateLUtf8StringToLUnicodeString",
        "u+SSS",
        ".?AUIOperationsProgress@SetupPlatform@@",
        "kleme devam edemiyor ",
        "LangPacksPath",
        "hSVWjD_3",
        "FullUpgrade",
        "(Value != 0) || RtlIsLUtf8StringValid(Value)",
        "Target Image: BitLocker Device Encryption Available = [%s]",
        "!t$$Pj",
        "nse. %0",
        "5C6^6o6v6}6",
        "ntad version av installationsplattformens bin",
        "vMR!q",
        "NtSetSecurityObject",
        "ProductKey: Saving information from SKULIB key.",
        "Bugcheck code",
        "6L6_6",
        "6 6(60686@6H6P6X6`6h6p6x6",
        "</=H=b=",
        "OneSettingsSetupVersion",
        "CDlpActionProductKeyValidate::FindEditionInStoreCatalog",
        "NetKey",
        "Se iniciar",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionRecoveryFactory@@VCDlpActionRecovery@@@@",
        "wrong protocol type",
        "P39K2-6NQFV-3DRY4-34TPY-43KR2",
        "121beac9-a772-f3e7-2b61-b608fdf6d235",
        "6f630b35-b0ec-92e0-9567-1cd5c4a91b71",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::SetProgress",
        "Failed to query boot entry order. Status: %x",
        "GetWebSetupUserInput: Error reporting telemetry for WebSetupInputMediaType: [0x%X]",
        "W3RKC-NC38G-WWMTD-PW6FB-YWTFT",
        "GatherOsState ",
        "DataMigration: Initializing Migration Choice:                   [0x%X]",
        "BN3CX-XK2J6-F6MW7-7JHXB-VQXFY",
        "o de limpeza de uma tentativa de instala",
        "o passou os requisitos para a op",
        "5L5S5h5",
        "ges felt",
        "ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE",
        "GetLongPathNameW",
        "c architektur. %0",
        "3WN48-GVPXF-VHWK4-29Y8D-KKTD2",
        "GuidCache",
        ";#<B<[<t<",
        " usando en un entorno de prueba.%0",
        "CriticalChecked",
        "1d58a06d-33c6-4331-2e25-b0ef5da03304",
        "NewAttlist = this->AllocateStreamObject()",
        "7l8v8",
        "Microsoft.Windows.125.X21-83249_8wekyb3d8bbwe",
        "TX3M3-HN6CW-2D8RM-QKCVK-WT3F3",
        "2I3o3{3",
        "1C2Y2",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::Prepare",
        "Setup360MappedResult",
        "?/?J?Q?]?",
        "nou aktualizaci.%0",
        "PerformSilentCleanup: Error reporting telemetry for STORAGE_CLEANUP_TIME: [0x%X]",
        "017a0d88-3d90-48a1-7a08-dafb6c6c7e0e",
        "YYVX9-NTFWV-6MDM3-9PT4T-4M68B",
        "041004B0",
        "professionalworkstation",
        "Microsoft.Windows.99.X20-23533_8wekyb3d8bbwe",
        "da-DK",
        "DBXXP-6YNM8-MCTYH-WXVDG-FVWWB",
        "?3?X?v?|?",
        "erinin telemetri amac",
        "6[7f7t7",
        "2566c30a-5a06-c01d-8a73-1f00e5e1ea61",
        "serveressentialadditionalsvc",
        "798977d6-4d0b-0570-5a98-b9333ea4a40c",
        "0c02444f-30f6-46a9-a0a4-ec405e362a97",
        "Process Name [%d]: %ws",
        "Microsoft.Windows.27.X19-98764_8wekyb3d8bbwe",
        "ebaa90b7-cd60-05c1-2f4a-e86e88a430d4",
        "c7156f3c-7c61-9242-5946-8d37662429dc",
        "5b744439-886b-3ff3-a517-106dc57fdf10",
        "StarterN",
        "DataMigration: Initializing bMigrateReservesActiveScenario:     [%s]",
        "j.Xf;",
        "WIM\\IMAGE[*]\\WINDOWS\\VERSION\\SPLEVEL",
        ".?AV?$CZeroInit@VCDlpActionPackageMigrateFactory@@$00@@",
        "m k instalaci nebyly v po",
        "STATUS_INVALID_DEVICE_REQUEST",
        "Microsoft.Windows.122.X19-99472_8wekyb3d8bbwe",
        "WJCTN-YMDWK-BDVBM-G8T77-YY47J",
        ":&:C:J:Y:`:i:p:",
        "NBD82-BBRYC-P7XDD-G6844-37CF6",
        "Fehler beim Ausf",
        "CDATA",
        "(u7b*g(W@b",
        "b28507e6-35d6-4132-3496-2603960839e9",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::Deserialize",
        "HN338-K69PP-P3JWH-PPCG2-D7BM3",
        "Microsoft.Windows.101.X20-29681_8wekyb3d8bbwe",
        "ges lemezter",
        "5dacd79b-a8fe-c0c0-e6c5-b1f06ba5f7f2",
        " el.%0",
        "QSVVV",
        "en-TT",
        "Panther",
        "2Q9YQ-N4XJJ-6PH9T-2KJHG-GMT6R",
        "Microsoft.Windows.100.X20-30045_8wekyb3d8bbwe",
        "YJNWD-DQKWB-HBPMK-B6RDY-FF83J",
        "9 9'9R9e9m9",
        "7\"707^7",
        "TJJTV-HNW4M-4KY28-BRQD2-6JGF8",
        "Microsoft.Windows.184.X21-83658_8wekyb3d8bbwe",
        "Microsoft.Windows.188.X21-99375_8wekyb3d8bbwe",
        "X9NV3-MCH4F-M3G24-2PKR2-BTDT3",
        "onecore\\base\\servicing\\actionlist\\lib\\actionlist\\objfre\\i386\\actionlistparser.cpp",
        "4fcd7083-c14e-cc20-89de-cf6655e146f8",
        "s adathordoz",
        "DiskPartition: Automation not found.",
        "=(=/=5=@=G=z=",
        "De gebruiker heeft ervoor gekozen om te annuleren omdat het systeem niet voldoet aan de gated compatibiliteitsscan voor het installeren van de update.%0",
        "Microsoft.Windows.27.X19-98746_8wekyb3d8bbwe",
        "Microsoft.Windows.49.res-v3316_8wekyb3d8bbwe",
        "dfc22b9d-b1dc-0ead-7a04-a090cdde087a",
        "0#1x1",
        "99;><",
        "]_^[]",
        "DuHwCompat.TXT",
        "Microsoft.Windows.99.X20-37357_8wekyb3d8bbwe",
        "o do SO pendente.%0",
        "\\Windows\\Setup\\LatentAcquisition\\ActionList.xml",
        "ultimaten",
        "m_ulSize == 0",
        "t[Vh ",
        "bc0045e0-d78a-2d7f-3c28-c6622fb0654e",
        "9 9$9(9,9094989<9@9D9H9L9P9T9X9`9l9x9",
        "re eller returnerte en feil.%0",
        "7c2f5ca6-e604-50ae-bdf5-d7bfb961495c",
        " nem fogadta el a licencfelt",
        "Compatibility: Resolve requested. String: [%s]",
        "kr-Latn-NG",
        "pHeader->ulSignature == ('dHdM')",
        "N4PR4-9WYHD-J3GJ2-28RYQ-JTT8D",
        "DiskSpaceInstallReq: Initializing Download Drive Letter:        [%s]",
        "The installation process was launched with an invalid command line argument.%0",
        "me manquant.%0",
        "6&7-7S7",
        " Windows Recovery Environment.%0",
        "SINGLE_STEP",
        "8'808",
        "GDRPath",
        "WimImageSetInformationFile",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionSummaryFactory,class CDlpActionSummary>::GetActionId",
        "g%s (Error = %d)",
        "RDN98-QF2FV-VBFXF-QWJGP-DDB6M",
        "Microsoft.Windows.145.X21-83691_8wekyb3d8bbwe",
        "CDlpActionProductKeyValidate::GetProductKeyFromResponse",
        "CreateDirectory failed",
        "D$ j8",
        "ImageLocation",
        "7eccbf80-e904-e6f7-5a5a-606a8f501d10",
        "NTBVJ-QQ2TW-MHD26-2M77M-JMBJ2",
        "O usu",
        "848^8",
        "1 1&1-1",
        "m.Reserved < m_NamedNodeMaps.Size()",
        "DisableThreadLibraryCalls",
        "GetWebSetupUserInput: Selected Architecture From Resposne = [%s].",
        "CDlpActionDiskSpaceReq::CancelRoutine",
        "operation in progress",
        "PhXSDT",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionDUFactory@@VCDlpActionDU@@@@",
        "failed",
        "3c5ded6b-6fd0-5e2c-a8b1-5633e56d5f73",
        "CMicrodomUpdateContext::Construct",
        "GDRChecked",
        "N37VK-3DQBV-KGKPC-WYDHP-GQ9PF",
        "CDlpActionGetWebSetupUserInput::IsOfferEditionMatch",
        "Microsoft.Windows.121.X19-98678_8wekyb3d8bbwe",
        "8N8c8",
        "Diagnosticeringsobjektet blev ikke oprettet. H",
        "Asennusta k",
        "DataMigration: Initializing InstallType:                        [0x%X]",
        "474B4o4y4",
        "CMicrodomUpdateContext::CreateVirtualTextual",
        "KN773-HKQCT-MVBPM-JRFMG-237YT",
        "L$4_^[3",
        ")Microsoft Root Certificate Authority 20100",
        "Microsoft.Windows.98.X20-24579_8wekyb3d8bbwe",
        "ProfessionalStudent",
        "onnistui, tai viallinen komentosarja palautti virheen.%0",
        "Microsoft.Windows.48.X20-00859_8wekyb3d8bbwe",
        "Microsoft.Windows.7.X21-83734_8wekyb3d8bbwe",
        "_T{b_",
        "Os ficheiros de payload estavam danificados.%0",
        "en-IE",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::GetActionName",
        "sq-AL",
        "til chybu.%0",
        "100701213655Z",
        "Microsoft.Windows.7.X21-83739_8wekyb3d8bbwe",
        "CDlpActionDU::ExecuteFacilitatorLatentAcquisition",
        "d5b2660a-95d0-2843-fb1c-4bc7408d8b24",
        "Automation: Registered SUMMARY Response",
        " tietojen lataamisen levytilavaatimuksia.%0",
        "1E2]3",
        "Failed to query process information for size. Status: %x",
        "dc9f71e3-aeac-c7e8-4a0f-d36f83ca146e",
        "SelectedDriveLetter",
        "Microsoft.Windows.188.X21-99382_8wekyb3d8bbwe",
        "en virheellist",
        "8]9x9",
        "The requested attribute value is the wrong type. Either int was requested instead of string or vice versa.%0",
        "Failed to increment failed install count. GLE is [%d]",
        "HKLM\\%s",
        "Microsoft.Windows.122.X19-98686_8wekyb3d8bbwe",
        "o em disco suficiente para download.%0",
        "F3NGF-8BK3B-CRXW9-CWDG6-P7MJ4",
        ":,;3;s;",
        "in uyumluluk sorunlar",
        "Microsoft.Windows.101.X19-99535_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X20-29595_8wekyb3d8bbwe",
        "Y9YDN-7XCQV-WQVR6-FBHX7-3J4FW",
        "Object GUID: %s",
        "Microsoft.Windows.7.X21-83732_8wekyb3d8bbwe",
        "kernelbase.dll",
        "Der blev ikke fundet en installationsafbildning til dette system.%0",
        ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIActivationAction@@@@@@",
        "OutputDebugStringA",
        "2 20242L2\\2`2x2",
        "DiskSpaceInstallReq: Initializing LXP License Path     [%ld] [%s]",
        "Microsoft.Windows.121.X21-83176_8wekyb3d8bbwe",
        "Finner ingen installasjonsavbildning for dette systemet.%0",
        "Failed to get saved failed install count. GLE is [%d]",
        "WNXY8-KV4JY-6QYBW-TMWCD-63DCC",
        "Unable to create or destroy the shutdown block message.%0",
        "CDlpActionAdvertise::SerializeRoutine",
        "Microsoft.Windows.48.X19-98798_8wekyb3d8bbwe",
        "MALLOC failed",
        "Microsoft.Windows.184.X21-83667_8wekyb3d8bbwe",
        "SetEnvironmentVariableW",
        "tta eftersom instans-hash inte ",
        "o passou os requisitos m",
        "NF6HC-QH89W-F8WYV-WWXV4-WFG6P",
        "L$8PW",
        "::RtlIsLUnicodeStringValid(Source)",
        "9$9D9X9x9",
        "HC9QN-HRPCH-JPHFW-B86FF-CR397",
        "NJ6Y6-HQ4JJ-GXJY6-JCPM6-BP2KR",
        "NP93H-BJDMF-PQRVW-D7G8J-XWW3J",
        "79a766c6-b883-53b2-12cf-4e77ef782667",
        "N76RK-Y8DB4-TCGMV-TB6JB-RC4BP",
        "xito n",
        "1I1T1~1",
        "ra just nu.%0",
        "cec0ae21-d0bc-0105-c9ee-0cf08c10e0e5",
        "CDlpActionDiskSpaceReq::GetSystemDriveRequirements",
        "fo-FO",
        "kleme i",
        ";D$ t\"Q",
        "9;:B:X:p:",
        "ce34f504-46e0-6e37-b23b-eb54d8bbd6c3",
        "=A=f=",
        "3df795cc-d20f-203f-155d-b9d6cfb377ef",
        "Systemet videresender ikke kravene til diskpladsen for at downloade og udpakke medier.%0",
        "5f301dd5-019c-f58a-e7ec-b0ab326cda46",
        ".?AVCDlpActionCompatFactory@@",
        "89211cad-5aea-44da-f694-23eb7ebf4090",
        "0*0c0",
        "TNK62-RXVTB-4P47B-2D623-4GF74",
        "Package",
        "ERROR_INVALID_DATA",
        "Microsoft.Windows.162.res-v3799_8wekyb3d8bbwe",
        "minSPVersion",
        "api-ms-win-eventing-provider-l1-1-0.dll",
        ".?AVCDlpActionDebuggerOptionsFactory@@",
        "6D8CG-BNHCR-2QKC6-GTKW8-9TPHF",
        "A script exceeded the timeout limit.%0",
        "?(?7?>?L?S?_?n?{?",
        "STATUS_ILLEGAL_CHARACTER",
        "090`0",
        "Proces instalace vy",
        "est pas prise en charge.%0",
        ";;;J;W;z;",
        "Automation: Registered EULA Response",
        "SetupCore: Registered IMAGE_DEPLOY action",
        "vede tidsgr",
        "indigd.%0",
        "ZwEnumerateKey",
        "8543aaa2-de1b-8b1a-f37d-251aae310b6e",
        "WimApplyPrivileges",
        "7)7/787B7I7O7U7]7w7",
        "cych miejsca na dysku potrzebnego na zainstalowanie ",
        ".idata",
        "GetFileAttributesW",
        "6 6$6(6,60686P6`6d6|6",
        "PackageMigration: Nothing to do.",
        "d0ca42ec-cccd-8670-1fa1-b973474e9516",
        "Microsoft.Windows.27.X19-98747_8wekyb3d8bbwe",
        "37a65355-2eaf-f4ef-98f3-b3dd63f92cf2",
        "M2382-NCG6C-PGBJV-2D6VV-T3BMQ",
        "MoSetupPlatform: Not persisting telemetry data",
        "Microsoft.Windows.164.X21-06167_8wekyb3d8bbwe",
        "5d0a4a09-5ef5-108c-32d8-0347639c00bb",
        "onecore\\private\\base\\inc\\LogAdapter.h",
        "network_reset",
        "Server pr",
        "BinaryPartition",
        "(DestinationMaximumLength == 0) || (DestinationBuffer != 0)",
        "PerformSilentCleanup: Error reporting telemetry for SILENT_CLEANUP_TASK_TIME: [0x%X]",
        "XM9N2-JYHQP-MTP8H-X89BH-BDWV3",
        "2aa03c0a-d0f2-74c2-a020-d6a2edf8c3cd",
        "Installationsbilledet blev ikke fundet.%0",
        "Y9D2N-8G4P4-7BCRG-MK77Q-M7VYB",
        "ActivationIssuesSkipped",
        "CDlpActionSummary::InitializeRoutine",
        "87f7769c-2d98-be15-45ba-9fc61a26a93a",
        "ba9c128f-e99c-e193-3298-02947849d507",
        "6#7N7u788c8",
        "Et forh",
        "> >8>P>h>",
        "CDlpActionProductKeyValidate::SerializeRoutine",
        "WTMK2-FNFHY-78XKW-GVYBG-233H8",
        "SourceName",
        "7ca454a9-6572-7b5b-81da-e2684d034ee9",
        "Windows::uDom::Rtl::RtlCreateUpdatedMicrodomAsMicrodom",
        "pHeader->ulOffsetToStringPool < pHeader->ulTotalSize",
        "2G2Q2",
        "Not-null check failed: Params->Source.pBlob",
        "PPIPro",
        "ACCESSDENIED-Fehler in Anfangsphasen des Setups gefunden ",
        "De installatie kan niet worden voortgezet omdat de eerder gestarte update niet kan worden hervat.%0",
        " system nie spe",
        "5&6S6",
        "o pode ser executado ou devolveu um erro.%0",
        "rder f",
        "es-NI",
        "4f214c2c-3e60-5366-f3ef-b279cbd6a209",
        "D$8t3",
        "97867e01-314b-d486-5380-298c339eaad6",
        "Microsoft.Windows.8.X18-81302_8wekyb3d8bbwe",
        "L'utente ha usato la riga di comando setup.exe solo per una scansione e non per installare il sistema operativo.%0",
        "ILLEGAL_INSTRUCTION",
        "F93BG-2NQGW-3FKT3-7P8MK-3RVY4",
        "Microsoft.Windows.99.X20-29704_8wekyb3d8bbwe",
        "ivityksen asentamisen yhteensopivuustarkistusta.%0",
        "onecore\\base\\lstring\\ucsdecoders.cpp",
        "ReadFile",
        "a7128ada-b478-99f1-2ba3-675b88eac1f7",
        "FODDownloadPath",
        "Y%m-\"",
        "L'ID versione di anteprima ",
        "f0104cb7-3db3-974a-9d88-0205adf5d225",
        "Microsoft.Windows.7.X21-83741_8wekyb3d8bbwe",
        "Sistem, medyay",
        "CDlpActionCompat::InitializeDownloadReqScan",
        "Microsoft.Windows.126.X20-00862_8wekyb3d8bbwe",
        "Asennusta ei suoritettu vaaditussa ajassa.%0",
        "Deze versie van het hulpprogramma wordt niet ondersteund.%0",
        "broken pipe",
        "W86ND-FTRMC-7F9HM-486GP-7CFBT",
        "2VN9R-T2TFP-2HPVG-D43WQ-C36BT",
        "Microsoft.Windows.101.X20-35482_8wekyb3d8bbwe",
        "PVMJN-6DFY6-9CCP6-7BKTT-D3WVR",
        "WimFindClose",
        "llt die Anforderungen f",
        ">6>j>",
        "0^1j1",
        "lisis de compatibilidad para instalar la actualizaci",
        "KCNPH-BQTCW-CG2QQ-9FHM9-KQDD4",
        ";&;>;X;",
        "oeY<9",
        "3,303@3D3H3`3d3l3p3t3x3",
        "r die Einrichtung der Plattform wurde erkannt. ",
        "23MXW-YN2QD-FB2M6-4KP6C-2DKTG",
        "RJD2N-BHQBB-4MTQK-788W2-V8T4T",
        "ar-AE",
        "NF3W7-8C4B7-BFRT9-VKR44-8B6R2",
        "value too large",
        "Microsoft.Windows.188.X21-99373_8wekyb3d8bbwe",
        "10b252bb-1b24-d4e1-c7a6-7e774e7355a8",
        "Nie znaleziono ofert spe",
        "DataMigration: Migrating file: [%s] -> [%s]",
        ":,:3:O:U;[;",
        "B38N7-QYJB6-HQRBK-KTVKH-VT4WX",
        "Compatibility: Device Block found.",
        "HB2G7-NJB3W-C3CT2-HVQXH-B7V3B",
        "Microsoft.Windows.50.X21-83773_8wekyb3d8bbwe",
        "212<2h2s2",
        "Microsoft.Windows.48.X19-99645_8wekyb3d8bbwe",
        "tej aktualizacji.%0",
        "Microsoft.Windows.100.X20-29650_8wekyb3d8bbwe",
        "GetWebSetupUserInput: Execute: Action[%u] InstallNow=[%s].",
        "6 6Q6\\6",
        "696E6S6",
        "u anda Windows Kurtarma Ortam",
        "rbara installationsfilen.%0",
        "Fant ikke installasjonsbildet.%0",
        "6NYJH-YBYFY-96TVD-B9FHM-TXX9F",
        "-confirma",
        "404656af-d8b7-1db5-afc7-c4852fd64e07",
        "tti kompatibilit",
        "Microsoft.Windows.164.X21-06158_8wekyb3d8bbwe",
        "19c65668-f2b5-2a0b-e5fa-ab83b302652b",
        "cd24d0d1-5499-6933-b55f-da416ea68eb1",
        "G,PSWh",
        "nschte Migrationsoption nicht erf",
        "Automation: Registered DUOPTIN Response",
        "gu-IN",
        "WIM\\IMAGE[*]\\WINDOWS\\VERSION\\BUILD",
        "n virheen.%0",
        " usean arkkitehtuurin tietov",
        "=K>p>",
        "[RS3]",
        "4 5?5",
        "7c136ced-57a1-2dca-efd4-f72cc5000d6d",
        "pContext != 0",
        "PPPPP",
        "STATUS_RESOURCE_DATA_NOT_FOUND",
        "27596e46-fce0-a0e7-f3eb-bbc8b65a8d84",
        "Microsoft.Windows.48.X19-98844_8wekyb3d8bbwe",
        "Microsoft.Windows.121.X19-98887_8wekyb3d8bbwe",
        "CopyFileW",
        "Microsoft.Windows.122.X20-00859_8wekyb3d8bbwe",
        "13cffd52-8d0f-b739-1804-c555192abc1f",
        "Microsoft.Windows.8.X17-36777_8wekyb3d8bbwe",
        "WimLazyInitialize",
        "Microsoft.Windows.4.X19-98713_8wekyb3d8bbwe",
        "8PXG6-NT6GR-VTFFC-GQG42-J44TQ",
        "2,2L2r2",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionGetWebSetupUserInputFactory,class CDlpActionGetWebSetupUserInput>::SetActionId",
        " n'ont pas ",
        "7g9J:Q:m:",
        "<(<@<X<p<",
        "664f00ea-5d31-8d75-225b-db98623475a7",
        "f94a9e4b-dfd5-b304-eecc-06df1247f95d",
        " laste ned og pakke ut medier.%0",
        "ea362d4e-fcc1-b3f3-88cd-8d017424d0b5",
        "System partition: %s",
        "STATUS_DLL_NOT_FOUND",
        "3$4A4]4A5]5",
        "GetVolumeNameForVolumeMountPointW",
        "na operace finalize.%0",
        "do do pacote.%0",
        "STATUS_IMPLEMENTATION_LIMIT",
        "536>6L6r6",
        "3L3f3",
        ";#<`<w<",
        "DUSetup: Failed to unpack DUSetup Updates: [0x%x]",
        "d0a94b6b-6e9e-a3f2-75d4-a22ce91c2bb1",
        "Invalid array index",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::Pause",
        "marrage du syst",
        "8\"8`8",
        "o est",
        "o de migra",
        "tti parancsprogram v",
        "Microsoft.Windows.126.X20-35529_8wekyb3d8bbwe",
        "in disk alan",
        "94ee330d-32ea-0031-aabe-af8e9e48575e",
        "3!373E3[3i3",
        "VDPNF-J4X9B-FJC2P-7JQFD-JTYQD",
        "kleme y",
        "<->X>",
        "9$939",
        "PG7H6-7RNT3-R4MGR-HMJK2-J462D",
        "2H6HF-GNKW2-JB93P-BK6XC-W2R42",
        "Microsoft.Windows.123.X20-57725_8wekyb3d8bbwe",
        "ReadData reparse tag from filestream failed",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FveDetect",
        "Microsoft.Windows.48.X20-39265_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X20-36697_8wekyb3d8bbwe",
        ">'>T>_>",
        "SymbolicLink",
        "ProductKey: Initializing Digital Key:        [%s]",
        "STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE",
        "DeleteFileEx: Unable to get information on [%s]; GLE = 0x%x",
        "#text",
        "GetSystemFirmwareTable",
        "RtlAdjustPrivilege",
        "=4=8=@=X=\\=d=h=l=p=t=|=",
        "G7FJC-PN8KK-Y8DRB-YR28B-K766T",
        "061o1",
        "nimos para la recuperaci",
        ".?AVIDlpObject@@",
        "DiskPartition: Selected Drive letter from automation [%c]",
        "fil-PH",
        "84NJF-R7748-RB4W8-WB72F-FC26Q",
        "CDlpActionProductKeyValidate::GenerateGenuineTicket",
        "Microsoft.Windows.122.X21-03401_8wekyb3d8bbwe",
        " operace nem",
        "rt werden.%0",
        "e21bad02-cca4-7606-41ad-e9693f099b26",
        "onecore\\base\\xml\\udom_xmlcursor.cpp",
        "07901ac7-e54e-63c7-469c-d07a08922e02",
        "Microsoft.Windows.4.res-v3291_8wekyb3d8bbwe",
        "lacakt",
        "no stream resources",
        "RpcStringFreeW",
        "B6GMV-NJ4P4-PXJ9C-3JQ86-MKMMW",
        "Microsoft.Windows.22.X17-53882_8wekyb3d8bbwe",
        "CDlpActionProductKeyValidate::ExecuteRoutinePkeyGetEdition",
        "Den kj",
        "791ee811-71b2-247e-8946-c32795dfa494",
        "Microsoft.Windows.48.res-v3312_8wekyb3d8bbwe",
        "Microsoft.Windows.49.X19-98896_8wekyb3d8bbwe",
        "RNR8D-B4QK8-BDP4D-GTPCR-BY49W",
        "invalid_argument",
        "PVNPJ-T4WWX-6WK66-DKP3R-369Q6",
        "DUImage: Hardware compatibility file [%s] generated with [%d] entries.",
        "7c396c9f-59ea-0d3e-dd8f-0aceae7c765a",
        "4WQN9-2BWFT-PHQVP-YPT2Q-TCQW7",
        "Problemet ned installasjonsplass p",
        "AcquireSRWLockShared",
        "No se puede crear ni destruir el mensaje de bloqueo de apagado.%0",
        "GetWebSetupUserInput: Execute: PreSelected Language is = [%s].",
        ";+<F<O<Y<q<",
        "DataMigration: Attempting migration of ActionList.xml",
        "c6287397-ff67-0478-60dd-cbcd5d468ea3",
        "Elements",
        "ac61249b-a9a2-413a-524c-138cca7bf54a",
        "Het systeem voldoet niet aan de gated compatibiliteitsscan voor het installeren van de update en de gebruiker hoeft niet op de hoogte te worden gesteld.%0",
        "GetWebSetupUserInput: Error reporting telemetry for WebSetupInputDefaultLang: [0x%X]",
        "es-UY",
        "adovanou mo",
        "3ca80945-b75f-4306-14f7-bf8ec0447732",
        "GetWebSetupUserInput: Execute: Target Iso=[%s].",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::SetParameters",
        "6%666G6v6",
        "wsc:setup:Setup_DismissAllDismissibleBlock",
        "647ce6ad-4629-ce52-0f70-02c8d823d50c",
        "2e33ca33-6cbb-89c5-d996-390db4b118be",
        "7D7N7",
        "Installasjonsprosessen ble ikke fullf",
        "o foi encontrada.%0",
        "01e9c00e-44fb-23a1-b539-6583ac61fa5c",
        "95affec8-a2df-63e9-5089-5bd34051e038",
        "84NGF-MHBT6-FXBX8-QWJK7-DRR8H",
        "maxVersion",
        "Il processo di installazione richiede che l'utente accetti il Contratto di Licenza.%0",
        "WIM\\IMAGE[*]\\CREATIONTIME\\HIGHPART",
        "Too many delimiters in string id.",
        " laste ned nyttelasten.%0",
        "M6N3G-M747G-GHV4F-XTKFB-VQXRM",
        "SourceMicrodom != 0",
        "PerformSilentCleanup: Error reporting telemetry for OSPARTITION_SPACE_FREED_UP_CLEANUP_TASK: [0x%X]",
        "serverstandardnano",
        "Microsoft.Windows.49.X19-99521_8wekyb3d8bbwe",
        "9W9m9",
        "ProductKey: Not calling GatherOSState",
        "RPCRT4.dll",
        "(null)",
        ".?AVCDlpActionActivationFactory@@",
        ":?:v:",
        "Microsoft.Windows.101.X20-29676_8wekyb3d8bbwe",
        "NJBCW-WXK3P-BH2HC-HV2DQ-2WBRC",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::Resume",
        "5$5(5,5D5T5X5h5x5|5",
        "10181D1d1p1",
        "W\\\\.\\%c:",
        "Microsoft.Windows.48.X20-23601_8wekyb3d8bbwe",
        "T$4Qj",
        "274d7952-e8f8-077a-bb77-60b3f23de33d",
        "Microsoft.Windows.172.X21-24715_8wekyb3d8bbwe",
        "8NVGM-CKCPY-VFHVY-KTMH2-HH668",
        "Un script super",
        "CompatFinalizeReq: Initializing Telemetry OptIn:       [%s]",
        "network_unreachable",
        "GetCurrentProcess",
        "Microsoft.Windows.161.X20-00862_8wekyb3d8bbwe",
        "PPPPSW",
        "k mulig.%0",
        "8/9=9n9{9",
        "VCTJH-KNG8D-3Y36V-W9Y48-J8F9M",
        "The system does not pass the diskspace requirements to install the payload.%0",
        "This version of the tool is not supported.%0",
        "NPTDJ-TDWGG-QQK2H-X83P9-FRCPX",
        "Brugeren har ikke accepteret slutbrugerlicensaftalen inden for den p",
        ".?AVCDlpResponseAutomationFactory@@",
        "GetWebSetupUserInput: Execute: Download file hash X86 = [%s].",
        "Microsoft.Windows.99.X20-23529_8wekyb3d8bbwe",
        "Et skript har overskredet grensen for tidsavbrudd.%0",
        ".?AV?$CDlpActionFactoryImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpActionFactory@@@@@@VCDlpActionEulaFactory@@VCDlpActionEula@@@@",
        "NewAttdef = this->AllocateStreamObject()",
        "Activation: Starting Wait",
        "BGHKJ-QC9GW-QBDX9-CVT3C-QX33Q",
        "Microsoft.Windows.121.res-v3282_8wekyb3d8bbwe",
        "Microsoft.Windows.126.X20-00861_8wekyb3d8bbwe",
        "Microsoft Windows0",
        "lettel kapcsolatos k",
        "V293R-HN3JK-D69PJ-4D2J7-8HW4F",
        "4309cd6d-2166-9415-cf27-09cc8bca0f6b",
        ">%>+>1>7>=>J>`>f>",
        "UploadTelemetryFreeSpaceOnSystemDrive: Error reporting telemetry for Free Space On OS Partition for %s: [0x%X]",
        "ImageDeploy: Initializing AllowPartitionChanges: [%s]",
        "Configuration",
        "NJ23M-WDVR7-72XT7-T8FCG-9KRWG",
        "FindFirstFileNameW",
        "tvVW3",
        "%h.vvZu",
        "PerformSilentCleanup: TriggerStoragePolicies is done!",
        "ProductKey: Signing issue with GatherOsState. This is a non-critical error. Assuming machine is not active.",
        "WJF7T-NW437-T74PD-FR6JJ-33YMV",
        "Blob->Buffer = (PUCHAR)((*RtlAllocateStringRoutine)(Bytes))",
        "TlsFree",
        "Windows::uDom::Rtl::RtlCreateMicrodomUpdateContext",
        "CompatInstallReq: Initializing Wim Ref paths:         [%ld] [%s]",
        "Installationsprocessen startades med ett ogiltigt kommandoradsargument.%0",
        "HNB99-KKKXK-Y69TM-8782Q-3PFBG",
        "MGY4W-DXN7K-838GJ-44M6D-7T9Q2",
        "KGBJC-N8DR2-4TW94-R3QWC-76DXD",
        " Operating System",
        "Activation: Activation issuses resolved. Activation polling ends",
        "cych do wymaganych kryteri",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "S _^[",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteComment",
        "1d1k1r1",
        "qps-ploca",
        "BiExportEfiBootManager failed: %x",
        "ba6a2fe2-0daf-592d-1bcd-88e38a2d0ae1",
        "3GR3N-MTFRB-9GJ7M-MJ2BV-9BV79",
        "%CLOUD%",
        "CDlpActionActivation::GetResultsRoutine",
        "Impossible de poursuivre l",
        "che requise est manquante.%0",
        " foi solicitada uma opera",
        "tHjahx",
        "\\FVEAPI.DLL",
        "WKYKR-2NHJK-496TK-BMCKJ-DGPJM",
        "891c5371-5513-50ee-5edb-98ee36622b0b",
        "Microsoft.Windows.7.X18-81317_8wekyb3d8bbwe",
        "X[_^]",
        "Activation: Initializing Timeout in Mins:     [%ld]",
        "<0<Q<f<",
        "rminos de licencia en el plazo requerido.%0",
        ";+;6;i;",
        ".?AVCDlpActionDiskPartition@@",
        "Activation: Polling scan timeout occurred.  Exiting.",
        "Microsoft.Windows.145.X21-83692_8wekyb3d8bbwe",
        "sah-RU",
        "Het systeem voldoet niet aan de apparaatscan voor het installeren van de update.%0",
        "efcf1490-0c70-a555-ac0b-09b20b854fcc",
        "DiskSpaceReq: Suspend was requested",
        "WimCreateDirectory",
        "T3RTN-VJHYH-CMVH6-84TDF-7H7KB",
        "a1a2747d-babc-31ec-6204-4f175d0ec392",
        "Microsoft.Windows.98.X19-98876_8wekyb3d8bbwe",
        "Se bloque",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationAction> > > >::Suspend",
        "WNT9D-KBW3Q-7RVW8-3FVB9-Y7XV3",
        "Recovery: Offline Edition ID:   [%s]",
        ">l>s>",
        "CallContext:[%hs] ",
        "rer Windows.%0",
        "4NF4Y-PY6TP-8GC66-66Q6H-FJT2P",
        "in iptal etmeyi se",
        "Microsoft.Windows.101.X19-99550_8wekyb3d8bbwe",
        "J6NW8-62PJK-7QR4Y-DJC74-6Q8KG",
        "Microsoft.Windows.48.X20-23600_8wekyb3d8bbwe",
        "77def6ea-5521-8d80-3376-21482f4b1503",
        "G4NCM-F9JB6-2MRX7-WP9FQ-9D72F",
        " a rozbalen",
        "57fd01ec-b41b-2441-6ecd-957eaa7ed5fc",
        "Installasjonen kan ikke fortsette fordi det allerede er bedt om en fullf",
        "s lehet",
        "rev eksik oldu",
        "Paketteja ei ole ladattavana.%0",
        "z.9Wv",
        "ProductKey: Checking SKULIB location failed.  [0x%X]",
        "STATUS_TM_INITIALIZATION_FAILED",
        "NDCD9-K4JJB-VKCT2-Q9BJC-XTP23",
        "ProfessionalStudentN",
        "495e4f48-43b3-c29e-daeb-ced65db1e511",
        "fung f",
        "Not-null check failed: UpdateContext",
        "tJj<SV",
        "Microsoft.Windows.48.X20-39267_8wekyb3d8bbwe",
        "Ein Precommit-Skript konnte nicht ausgef",
        "?6?i?",
        "lan g",
        ";7<u<",
        "CDlpActionEula::ExecuteRoutine",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::Prepare",
        ".?AV?$CZeroInit@VCDlpActionDiskPartitionFactory@@$00@@",
        " ou a renvoy",
        "Bu sistem i",
        "bbarchitekt",
        "?3?[?",
        "CDlpActionDataMigrate::CancelRoutine",
        "2NKDB-KJM3F-Y6KYT-CRC9F-WFH4P",
        "CreateFile failed",
        "Microsoft.Windows.48.X20-29667_8wekyb3d8bbwe",
        "Payload files were corrupt.%0",
        "Properties.Length == Results.Length",
        "SourceDom != 0",
        "ProductKey: Validating EI.cfg file.",
        "25b28367-0114-11e7-5564-94406e299908",
        "9VGNT-HMQQT-3PTB9-VDGRK-BKPRM",
        "Microsoft.Windows.48.X19-99492_8wekyb3d8bbwe",
        "ci dotycz",
        "63fdad36-1fac-b16c-55ed-d93192f0262d",
        "4:4^4v4",
        "DiskSpaceInstallReq: Initializing Skip OC Migration:            [%s]",
        "serverstandard",
        "Failed to allocate memory for space for process name.",
        "Microsoft.Windows.125.X21-83257_8wekyb3d8bbwe",
        "4U4e4q4",
        "8$8,848<8H8h8p8|8",
        "3P3W3r3",
        "GetSupportedDriveLetters: Unsupported drive type found. Drive: [%s], Type: [%d]",
        "Kompatibilitetsproblemene for nedlasting ble ikke l",
        "ugiwa",
        "Microsoft.Windows.48.X20-35534_8wekyb3d8bbwe",
        "cf5b5e68-55a6-56d4-80b9-f0451334fd9b",
        "VPiw&",
        "d9284b17-177f-0f65-2704-3416c5014a8a",
        " program a zachovat mo",
        "j-Yf;",
        " necessaria.%0",
        "90097968-5897-0f68-1190-882befeb2a9e",
        "Hbg&~",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IProductKeyAction> > > >::CheckUninitialized",
        "Microsoft.Windows.188.X21-99386_8wekyb3d8bbwe",
        ";D$ u",
        "02cf2873-ec88-6ef3-5c0e-4e08d17cc159",
        "4099d089-176b-ddfa-aadd-2e23cab98561",
        "industryhandheld",
        "AcceptEulaDefault",
        "9NBF6-WDTP2-7HH99-R9X3M-3GH7H",
        "2D3QM-TND8P-FCF2F-9239W-JFHY4",
        "V2MF4-NG9CF-7GMQX-TB433-XHKDW",
        "77effb74-e3b8-464d-8fba-71edbeffe57b",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionSummaryFactory,class CDlpActionSummary>::SetActionId",
        "CP9C<t",
        "IncludeRetailOnlyOffers",
        "Microsoft.Windows.49.X20-29605_8wekyb3d8bbwe",
        "FACILITY_IO_ERROR_CODE",
        "972c2692-2251-0e48-d77e-0612921542aa",
        "bbi v",
        "INDEX",
        "49NT7-6HWP2-KX7GX-FRWDJ-TQ8DC",
        "Microsoft.Windows.99.X19-99570_8wekyb3d8bbwe",
        "pGetHostCSDBuildNumber",
        "EnterpriseEval",
        "040B04B0",
        "ProfessionalEducation",
        "292a2",
        "QHBBC-XNCHQ-D4WX6-TMWRF-Q9MP4",
        "r att ladda ned och packa upp media.%0",
        "state not recoverable",
        "D$(f97",
        "Compatibility: MigXml path: [%s]",
        "PackageMigration: Initializing Critical Path:       [%s]",
        "8W8r8r<",
        ";$;0;<;H;T;`;l;x;",
        "Microsoft.Windows.100.X19-99667_8wekyb3d8bbwe",
        "Microsoft.Windows.121.res-v3279_8wekyb3d8bbwe",
        "4BTDQ-NF6WC-9GVV8-DFMJK-9HJXG",
        "Precommit komentosarjan suorittaminen ep",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceAction> > > >::CheckInitialized",
        "Not-null check failed: StringIn",
        "0~0W0_0",
        "vi-VN",
        ".?AV?$CZeroInit@VCDlpActionPreFinalize@@$00@@",
        "f1468af8-cffc-8f9d-6faf-49f73988d9b0",
        "no child process",
        "<P<Z<",
        "Microsoft.Windows.101.X20-29677_8wekyb3d8bbwe",
        "W8JKB-NMX2R-RTYVM-9XMC8-RX9RQ",
        "Gated-kompatibilitetsproblemerne blev ikke l",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionDiskSpaceReqFactory,class CDlpActionDiskSpaceReq>::CreateAction",
        "Microsoft.Windows.48.res-v3506_8wekyb3d8bbwe",
        "Microsoft.Windows.101.X20-30041_8wekyb3d8bbwe",
        ":!;5;I;`;w;",
        "d4e1f142-7484-d75c-f966-79d6be0d26e2",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::CheckUninitialized",
        "NFBM4-MHXHX-BQDR4-H7QP8-W44CF",
        "Microsoft.Windows.49.X20-29608_8wekyb3d8bbwe",
        "En nyere version af installationsprogrammet startes for at forts",
        "CXmlCursor::DecodeExtent",
        "Bugcheck param 1",
        "7/7E7",
        "Installasjonsprosessen ble avsluttet under kompatibilitetfasen.%0",
        ".rdata$sxdata",
        "<8=>=q=",
        "Microsoft.Windows.162.X21-43653_8wekyb3d8bbwe",
        "4&5A5\\5w5",
        "47222f8c-02c6-c54a-7d3a-32b87b0ca2d9",
        "this->ChildList[u]->Text != 0",
        "DesktopServicing",
        "jl al",
        "CDlpActionSummary::IsPowerPluggedIn: System is running on backup AC power.",
        "Microsoft.Windows.49.X19-98829_8wekyb3d8bbwe",
        "serverhpc",
        "?!?6?K?Z?b?k?q?",
        "CDlpActionEula::GetResultsRoutine",
        "ndigung nicht innerhalb des erforderlichen Zeitlimits akzeptiert.%0",
        "B\\;A\\",
        "es de automatiza",
        "bfbce14d-5527-d647-239e-42fbfec99798",
        "Microsoft.Windows.99.X20-29696_8wekyb3d8bbwe",
        "STATUS_NOT_IMPLEMENTED",
        "GetTickCount",
        "InstalledSize",
        "r das Betriebssystem wurde gefunden.%0",
        "Microsoft.Windows.162.X21-03400_8wekyb3d8bbwe",
        " postanowienia licencyjne.%0",
        "mn-Cyrl",
        "Microsoft.Windows.161.res-v3916_8wekyb3d8bbwe",
        "Microsoft.Windows.189.X22-09606_8wekyb3d8bbwe",
        "-FVE-FS-",
        ";0;M;t;",
        " weist eine ung",
        "7-888d8n8",
        " !\"\"\"#$ &&&%%%%%%%",
        "STATUS_NOT_CAPABLE",
        "GQBV4-JYN8F-TR99K-V9JPG-Y98WD",
        "Microsoft.Windows.49.X20-29604_8wekyb3d8bbwe",
        "HNRBK-QTGCQ-TXR6R-7R9YJ-2G2M8",
        "CDlpActionUpdateMedia::GenerateClientId",
        "Microsoft.Windows.50.X21-83775_8wekyb3d8bbwe",
        "NX79V-FMVY4-RR4YR-9GCPB-R6Y6R",
        "The system does not pass the disk space requirements to download and unpack media.%0",
        "283?3F3M3T3[3o3",
        "totta a folyamatot, mert rendszer nem felelt meg a friss",
        "LocalFree",
        "45c0f7ca-41d6-bce7-b03c-416422c29f34",
        "230c238c-963e-1677-8ac5-04e31687a401",
        "3$373",
        "Die Installation kann nicht fortgesetzt werden, weil auf Ihrem System nicht gen",
        "Un script de pr",
        "PackageMigration: Migrating FOD packages from [%s] into Target OS...",
        "I problemi di spazio su disco per il download non sono stati risolti entro il limite di tempo richiesto.%0",
        ".?AV?$CZeroInit@VCDlpActionDUFactory@@$00@@",
        "ytkownik nie zaakceptowa",
        "DiskSpaceInstallReq: Initializing ExtDrive space req:           [%ld]",
        ";B;K;",
        "Microsoft.Windows.4.X21-03402_8wekyb3d8bbwe",
        "Installationsplattformen har st",
        "be084ded-98b3-9d72-32d4-cb50c81bc5a9",
        "9NRVV-F7GMC-DPR6X-GRDBH-BDXC4",
        "VRBNY-WGYMJ-V32HB-96J7W-GVJVV",
        "<`<u<",
        "272>2[2b2",
        "NtDeviceIoControlFile",
        "THN6R-6GYFG-J2MWM-6R2CG-Y99FK",
        "<5<Z<}<",
        "Microsoft.Windows.98.X19-99604_8wekyb3d8bbwe",
        "f4928149-b788-8e34-ddf5-cdfb5f5b34b7",
        "Microsoft.Windows.99.X20-15870_8wekyb3d8bbwe",
        "=Q>S?",
        "Asennusn",
        "yla durduruldu.%0",
        ">>>Y>j>x>",
        ",01070y0",
        "As quest",
        "Region",
        "CDlpActionDiskSpaceReq::UploadTelemetryFreeSpaceOnSystemDrive",
        "PackageMigration: Initializing SSU paths            [%ld] [%s]",
        "203N3n3",
        "Microsoft.Windows.4.X19-99703_8wekyb3d8bbwe",
        "Der Benutzer hat den Vorgang abgebrochen, da das System die Mindestanforderungen f",
        "93cb2d0f-6ba5-bae5-445e-43e2e501fadc",
        ";l<s<",
        "Microsoft.Windows.101.res-v3504_8wekyb3d8bbwe",
        "WT7Q7-HNQXJ-8F3V2-T2P6M-B4G3V",
        "38fae8ab-7780-1fcb-972d-99bf49a649f3",
        "ivatel se rozhodl pro zru",
        "ynnistys vaaditaan.%0",
        "Microsoft.Windows.7.X21-83186_8wekyb3d8bbwe",
        ".?AV?$CDlpAutoLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@",
        "2B29T-NRCQT-TGH7G-KDTDK-6CQG6",
        "MoSetupPlatform: Checking whether disk provisioning is needed...",
        "892c4567-c1eb-c9bf-2070-4b86e3f6204d",
        "RDN2C-39Y4C-RRFJB-YYPHH-XD9M9",
        "8GPT9-GNYFG-CJVY8-9BBGV-VT9RJ",
        "39247f58-30e3-a1d7-660a-3bd6f80c1548",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionActivationFactory,class CDlpActionActivation>::CreateAction",
        "tPSVP",
        "MNM8Y-C332H-8QKD7-HCQXF-K4R7P",
        "MicrodomImplementation::CMicrodom::GetDocumentNodeSet",
        "Systemet klarar inte kompatibilitetskontrollen f",
        "SetupCore: Registered COMPAT_MIGCHOICE action",
        "Microsoft.Windows.161.res-v3798_8wekyb3d8bbwe",
        "PreFinalize: Migrating Correlation Vector [%s] into Target OS...",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskPartitionGetBKeyAction> > > >::Initialize",
        "25b1a4d0-b537-7537-05c4-594ea75fd438",
        " soubor GatherOsState m",
        "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6",
        "1M3`3v3",
        "RNQRB-3BXF7-X782H-4H4HM-JMBJP",
        "Podane informacje o automatyzacji s",
        ": :$:(:<:@:D:H:L:P:X:p:t:",
        "1$1R1",
        "zvizsg",
        "onecore\\base\\xml\\udom_builder.cpp",
        "Not-null check failed: Destination",
        "313X3",
        "DiskSpaceReq: Something went wrong during Polling.",
        "Failed to export alterations to firmware. Status: %x",
        "TriggerStorageCleanup is not supported",
        "enterprise",
        " hylk",
        "not a directory",
        "<B=s=",
        "Language",
        "3$3,343<3D3L3T3\\3h3",
        "CheckDiskSpace: Checking if we can use [%c] drive",
        "Microsoft.Windows.100.X20-29714_8wekyb3d8bbwe",
        "PostReboot",
        "GHMG6-NT2FH-BJ7VY-QW4F8-QC674",
        "%Microsoft Windows Production PCA 20110",
        "chec de l",
        "Die angegebenen",
        ">+>h>",
        "TargetISO",
        "rio optou por anular a Instala",
        ":*:=:",
        "<#=h>",
        "XXRW6-8QNPQ-M8MKC-DFBXG-XQCM4",
        "W7JC8-G7N7P-C2WTV-44W6Q-YBH3D",
        "22324-FN7V3-8V6VT-XF87K-RM47T",
        "Problemerne med diskplads i forbindelse med installationen blev ikke l",
        "(New == 0) || RtlIsLUtf8StringValid(New)",
        "5b12d121-2337-1875-1f04-2166e4ab5c2d",
        "lstasjonsbokstav. %0",
        "o consegue retomar a atualiza",
        "FACILITY_NTWIN32,Code=",
        "5608c207-e8fd-c9d6-e2bd-bcbea630df0b",
        "Microsoft.Windows.100.res-v3424_8wekyb3d8bbwe",
        "Microsoft.Windows.98.X20-29635_8wekyb3d8bbwe",
        "47fb20a3-b025-7acc-5149-767c31ece4fe",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttributeNs",
        "0021b46d-8398-0673-90f6-6f100d8b5dee",
        "ServerRdsh",
        "nns inte i enhetsgenoms",
        "Se interrumpi",
        "NH7W7-BMC3R-4W9XT-94B6D-TCQG3",
        "kk-KZ",
        "=8=P=",
        "b35aee31-e9c1-c22d-4ec4-86959f145e07",
        "f2ada5f6-c0c2-19ad-64cf-6e777fba230e",
        "n. Se puede reintentar.%0",
        "DiskSpaceInstallReq: Initializing Drivers Path:          [%s]",
        "GetPrivateProfileSectionW",
        "ProductKey: Failed to Validate Default product key.",
        "DeletePath: Failed to obliterate [%s] after %d tries; GLE = 0x%x",
        "DiskSpaceInstallReq: Initializing CompactOS:                    [%s]",
        "rio optou por cancelar o an",
        "RHr,g",
        "fad76bee-c952-d956-3a36-3f8c3f4e8d91",
        "70d26009-9672-cef2-d382-4f942f7fc73b",
        "3ef3c5a0-3c55-7606-2218-d4fc8c9ec8fc",
        "70L0j0",
        "Not-null check failed: fHasAttribute",
        "Microsoft.Windows.125.X20-35522_8wekyb3d8bbwe",
        "lemi, kullan",
        "1g1t1",
        "1[1`1w1",
        "EtwEventUnregister",
        "6419b893-60c7-3988-c248-5b2968f134b9",
        "^j?[;",
        "Server",
        "FellBackToCanonical",
        "SetupCore: Registered COMPAT_FINALIZEREQ action",
        "c15412ec-0fa1-cea3-df38-77c9f734c51d",
        "3B2KJ-Q6NFR-H8PHY-PCYFM-K766T",
        "8C3ND-JRGWR-3RF9P-92KD8-K2FCT",
        "dia pro v",
        "ImageDeploy: Initializing AllowUninstall:        [%s]",
        ">#>C>_>",
        "D$ SV3",
        "l>f:y|Q",
        "5-595P5z5",
        "QPWSRh",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::ExecuteRoutine",
        "CDlpActionActivation::CheckActivationBlock",
        "CreateMutexExW",
        "057e1749-68ef-56ec-fe9a-6bff4c4d46a5",
        "b8aa0744-3e40-ab7f-fcf3-70ce3156e64c",
        "FNTQK-DP7FM-GPQB2-M9BKR-DJ3HB",
        "1\"1:1",
        "538f5699-0a8e-3d66-24e2-363bd89d3dbd",
        "3834ce33-a5f5-db7f-f91d-b902fec9dc36",
        "CDlpActionCompat::ExecuteSysReqScan: Enter",
        " avbryte fordi enheten ikke har nok diskplass for nedlasting.%0",
        "Brugeren har afvist licensvilk",
        "ZwClose",
        "a5ff19ba-b00f-86dc-bebb-472c8a8e07fe",
        "421f35b8-7a38-2e6a-14b6-7c44b7b2b62a",
        "5\"5Q5}5",
        "ste konsolideras i telemetrisyfte.%0",
        "ZwAddBootEntry",
        "e9x0v[",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionCompatFactory,class CDlpActionCompat>::CreateAction",
        "SetupCore: Registered COMPAT_RECOVERYREQ action",
        "ResExtract",
        "OpenThreadToken",
        "Microsoft.Windows.125.res-v4247_8wekyb3d8bbwe",
        "preoobescript.cmd",
        "8A;H;X;_;n;u;",
        "Microsoft.Windows.121.X19-98888_8wekyb3d8bbwe",
        "C4NTJ-CX6Q2-VXDMR-XVKGM-F9DJC",
        "Payload-bestanden waren beschadigd.%0",
        "enterpriseeval",
        "Microsoft.Windows.146.X21-83737_8wekyb3d8bbwe",
        "2ba6701a-4632-f994-3b3c-6ac4db3f16f8",
        "as-IN",
        "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0",
        "ActionListCriticalPaths",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionEulaFactory,class CDlpActionEula>::SetActionId",
        "729b7416-38a0-ce81-2303-0438cddd1f3b",
        "b6747fa0-b8aa-7512-18bf-f27026b4202c",
        "PerformSilentCleanup: SilentCleanup task is done!",
        "installation n",
        "J0V;A",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatAction> > > >::GetResults",
        "c6f8cd32-23f0-ca24-c34a-d01d7065cf89",
        ">6>=>Y>",
        "69915946-b8e4-58b1-81dd-7c3a346de02b",
        "Na wst",
        "7169fce6-6d49-ed73-1715-55a916fc71e1",
        "Microsoft.Windows.98.X19-99437_8wekyb3d8bbwe",
        "6c9Q;",
        "Asennusymp",
        "? ?$?(?,?0?4?8?<?@?D?H?L?`?d?h?",
        "MoSetupPlatform: Restartable: [%s]",
        "WIM\\IMAGE[*]",
        " Microsoft Corporation. Minden jog fenntartva.",
        "1$101P1X1`1h1p1x1",
        "Windows::Rtl::CRtlObjectTypeDescription<class MicrodomImplementation::CMicrodom>::CreateInstance",
        "ERROR_SXS_ASSEMBLY_NOT_FOUND",
        "?/?6?M?T?i?",
        "d3c3c081-c1e4-d21c-3c9c-f7cd394d0144",
        "Microsoft.Windows.122.X21-83176_8wekyb3d8bbwe",
        "c120c01f-63a5-f497-ff8c-760ee295a143",
        "startern",
        "ch soubor",
        "7f160fbc-cb61-7965-d748-d1222c816624",
        "2Y2f2",
        "Zu-A;",
        "8$8,848<8D8P8p8x8",
        "ATTLIST",
        "Recovery: Initializing Install Choice: [0x%X]",
        "Microsoft.Windows.7.res-v4293_8wekyb3d8bbwe",
        ":8;I;~;",
        ".rdata$zzzdbg",
        "PackageMigration: Initializing GDR Path:            [%s]",
        ">5><>[?b?",
        "CDlpResponseAutomation::GetResultsRoutineEula",
        "S\\Omi",
        "ca2cffd3-6cca-b4a5-1165-4dc235a7b611",
        "Windows Recovery Environment kan ikke vedlikeholdes for ",
        "Microsoft.Windows.98.X19-99585_8wekyb3d8bbwe",
        "tO|Fonecore\\internal\\base\\inc\\rtlstringutil.h",
        "b4bcefe9-9d6e-67d7-611a-a1f1ad06c984",
        "Microsoft.Windows.165.X21-06166_8wekyb3d8bbwe",
        "8CW4N-MCWMY-FGXK7-M34XJ-W44C6",
        "t0jLSV",
        "ImageDeploy: Creating NewSystem object...",
        "MicrodomImplementation::CMicrodom::GetElementsByTagNameCommon",
        "Microsoft.Windows.8.X21-83686_8wekyb3d8bbwe",
        "50@0P0",
        "MoSetupPlatform: Cancel already requested.",
        "CreateThread",
        "yor.%0"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "3ed873893232f4172c55860d3aa8a7c9285514213907e000e3c9b68425dc830f",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/3ed873893232f4172c55860d3aa8a7c9285514213907e000e3c9b68425dc830f",
              "guest_paths": [
                "overlay"
              ],
              "size": 8504,
              "crc32": "B3C8E964",
              "md5": "2ed5b018b374f2a2b84a4b295572a10c",
              "sha1": "33bdb5a5b03f81aa4959db3bceb5f1006a8ec8f6",
              "sha256": "3ed873893232f4172c55860d3aa8a7c9285514213907e000e3c9b68425dc830f",
              "sha512": "e3facb7f03d82df3128c492fd961786cce80c634a51fbeabaae5c5a74a9819e8dfbb639faf83b10be9bf9c38196678dbfee3dfaadb5a9f058144fa1be6b2b393",
              "rh_hash": null,
              "ssdeep": "96:fOJMDXvDbzC0cr8OAlpVHKzDmowDD0pBDXiebs/Am2grWXGuGDXtxmhdKDm46DfK:WBr8VHwDDBQABJ60vMNIXqnajgKoHX",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T1C00219D28B686443DB63BC406358E5877C3D93CB0824946B649EF6A92CD73C9FF0496E",
              "sha3_384": "5554eef2eebf826534a409ab69130e3aaadbacf2487563438447cde4e9819774eee272e1e46de4e15c6131463f3c0434",
              "data": null
            }
          ],
          "extracted_files_time": 0.0005197880018386059,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "DU.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/4912abc0a250dfaf63a48e4165e94ab701505f14bcc7a1464d5588fa2d434564",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\DU.dll"
      ],
      "size": 123712,
      "crc32": "B8854089",
      "md5": "7727a405c9878c2fe052922c1f965384",
      "sha1": "12ef6479a97c7a6574ca8dd7be6b64f47b79f710",
      "sha256": "4912abc0a250dfaf63a48e4165e94ab701505f14bcc7a1464d5588fa2d434564",
      "sha512": "55c1a07bc932c619b585e3b883eaf581f5a0c5c8ed0ab1d1d0386dd344501746420d2541f0cd3caff984472ab65b8a7d49f5fd8821f45e5c4fa7194ddb89e09e",
      "rh_hash": null,
      "ssdeep": "3072:7UTZhzH2+F3yOme7PNWCsWlMzeNDz7biF4jL4hgXE:GbF13PACNlDzS4Cn",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T19FC31BB2719C45B2D3EB127DB25D53B25B2BA860C7D192DF313C804919949E6AF3A333",
      "sha3_384": "4cd252dd2ad2c04a023c8d5e62c88f99e0b5e6511107519b216d6ea6da3a0d9db66719f803739ba685c346707374d8e1",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x00016af0",
        "ep_bytes": "8bff558bec837d0c017505e845060000",
        "peid_signatures": null,
        "reported_checksum": "0x00023bed",
        "actual_checksum": "0x00023bed",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "du.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x1001b160",
                "name": "wcschr"
              },
              {
                "address": "0x1001b164",
                "name": "_wcsicmp"
              },
              {
                "address": "0x1001b168",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x1001b16c",
                "name": "_errno"
              },
              {
                "address": "0x1001b170",
                "name": "realloc"
              },
              {
                "address": "0x1001b174",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x1001b178",
                "name": "_unlock"
              },
              {
                "address": "0x1001b17c",
                "name": "__dllonexit"
              },
              {
                "address": "0x1001b180",
                "name": "_onexit"
              },
              {
                "address": "0x1001b184",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x1001b188",
                "name": "_initterm"
              },
              {
                "address": "0x1001b18c",
                "name": "_amsg_exit"
              },
              {
                "address": "0x1001b190",
                "name": "_XcptFilter"
              },
              {
                "address": "0x1001b194",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x1001b198",
                "name": "_callnewh"
              },
              {
                "address": "0x1001b19c",
                "name": "wcsstr"
              },
              {
                "address": "0x1001b1a0",
                "name": "iswspace"
              },
              {
                "address": "0x1001b1a4",
                "name": "_purecall"
              },
              {
                "address": "0x1001b1a8",
                "name": "memcpy_s"
              },
              {
                "address": "0x1001b1ac",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x1001b1b0",
                "name": "towupper"
              },
              {
                "address": "0x1001b1b4",
                "name": "?what@exception@@UBEPBDXZ"
              },
              {
                "address": "0x1001b1b8",
                "name": "??1exception@@UAE@XZ"
              },
              {
                "address": "0x1001b1bc",
                "name": "_lock"
              },
              {
                "address": "0x1001b1c0",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x1001b1c4",
                "name": "??0exception@@QAE@ABV0@@Z"
              },
              {
                "address": "0x1001b1c8",
                "name": "??0exception@@QAE@XZ"
              },
              {
                "address": "0x1001b1cc",
                "name": "malloc"
              },
              {
                "address": "0x1001b1d0",
                "name": "memmove_s"
              },
              {
                "address": "0x1001b1d4",
                "name": "free"
              },
              {
                "address": "0x1001b1d8",
                "name": "__RTDynamicCast"
              },
              {
                "address": "0x1001b1dc",
                "name": "memset"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x1001b028",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x1001b02c",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x1001b030",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x1001b034",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x1001b038",
                "name": "GetLastError"
              },
              {
                "address": "0x1001b03c",
                "name": "RaiseException"
              },
              {
                "address": "0x1001b040",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x1001b044",
                "name": "Sleep"
              },
              {
                "address": "0x1001b048",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x1001b04c",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x1001b050",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x1001b054",
                "name": "GetTickCount"
              },
              {
                "address": "0x1001b058",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x1001b05c",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x1001b060",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x1001b064",
                "name": "TerminateProcess"
              },
              {
                "address": "0x1001b068",
                "name": "OutputDebugStringA"
              },
              {
                "address": "0x1001b06c",
                "name": "DelayLoadFailureHook"
              },
              {
                "address": "0x1001b070",
                "name": "LoadLibraryExA"
              },
              {
                "address": "0x1001b074",
                "name": "IsDebuggerPresent"
              },
              {
                "address": "0x1001b078",
                "name": "DebugBreak"
              },
              {
                "address": "0x1001b07c",
                "name": "SetThreadErrorMode"
              },
              {
                "address": "0x1001b080",
                "name": "CreateMutexExW"
              },
              {
                "address": "0x1001b084",
                "name": "OpenSemaphoreW"
              },
              {
                "address": "0x1001b088",
                "name": "WaitForSingleObjectEx"
              },
              {
                "address": "0x1001b08c",
                "name": "OutputDebugStringW"
              },
              {
                "address": "0x1001b090",
                "name": "ResolveLocaleName"
              },
              {
                "address": "0x1001b094",
                "name": "ReleaseMutex"
              },
              {
                "address": "0x1001b098",
                "name": "GetModuleHandleExW"
              },
              {
                "address": "0x1001b09c",
                "name": "ReleaseSemaphore"
              },
              {
                "address": "0x1001b0a0",
                "name": "CreateSemaphoreExW"
              },
              {
                "address": "0x1001b0a4",
                "name": "GetModuleFileNameA"
              },
              {
                "address": "0x1001b0a8",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x1001b0ac",
                "name": "FreeLibrary"
              },
              {
                "address": "0x1001b0b0",
                "name": "HeapFree"
              },
              {
                "address": "0x1001b0b4",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x1001b0b8",
                "name": "CloseHandle"
              },
              {
                "address": "0x1001b0bc",
                "name": "CreateEventW"
              },
              {
                "address": "0x1001b0c0",
                "name": "CompareStringW"
              },
              {
                "address": "0x1001b0c4",
                "name": "HeapAlloc"
              },
              {
                "address": "0x1001b0c8",
                "name": "SetEvent"
              },
              {
                "address": "0x1001b0cc",
                "name": "MultiByteToWideChar"
              },
              {
                "address": "0x1001b0d0",
                "name": "WaitForMultipleObjects"
              },
              {
                "address": "0x1001b0d4",
                "name": "CreateDirectoryW"
              },
              {
                "address": "0x1001b0d8",
                "name": "GetVolumeNameForVolumeMountPointW"
              },
              {
                "address": "0x1001b0dc",
                "name": "HeapSize"
              },
              {
                "address": "0x1001b0e0",
                "name": "HeapReAlloc"
              },
              {
                "address": "0x1001b0e4",
                "name": "HeapDestroy"
              },
              {
                "address": "0x1001b0e8",
                "name": "FormatMessageW"
              },
              {
                "address": "0x1001b0ec",
                "name": "LocalFree"
              },
              {
                "address": "0x1001b0f0",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x1001b0f4",
                "name": "SetLastError"
              },
              {
                "address": "0x1001b0f8",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x1001b0fc",
                "name": "GetProcAddress"
              }
            ]
          },
          "ole32": {
            "dll": "ole32.dll",
            "imports": [
              {
                "address": "0x1001b1f0",
                "name": "CLSIDFromString"
              },
              {
                "address": "0x1001b1f4",
                "name": "CoCreateInstance"
              },
              {
                "address": "0x1001b1f8",
                "name": "CoInitializeEx"
              },
              {
                "address": "0x1001b1fc",
                "name": "CoUninitialize"
              },
              {
                "address": "0x1001b200",
                "name": "CoTaskMemFree"
              },
              {
                "address": "0x1001b204",
                "name": "StringFromCLSID"
              }
            ]
          },
          "WDSCORE": {
            "dll": "WDSCORE.dll",
            "imports": [
              {
                "address": "0x1001b150",
                "name": "WdsSetupLogMessageW"
              },
              {
                "address": "0x1001b154",
                "name": "ConstructPartialMsgVW"
              },
              {
                "address": "0x1001b158",
                "name": "CurrentIP"
              }
            ]
          },
          "USER32": {
            "dll": "USER32.dll",
            "imports": [
              {
                "address": "0x1001b148",
                "name": "CharLowerW"
              }
            ]
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x1001b104",
                "name": "VariantClear"
              },
              {
                "address": "0x1001b108",
                "name": "SysFreeString"
              },
              {
                "address": "0x1001b10c",
                "name": "SysStringLen"
              },
              {
                "address": "0x1001b110",
                "name": "SysAllocStringLen"
              },
              {
                "address": "0x1001b114",
                "name": "SysAllocStringByteLen"
              },
              {
                "address": "0x1001b118",
                "name": "SysStringByteLen"
              },
              {
                "address": "0x1001b11c",
                "name": "VarBstrCat"
              },
              {
                "address": "0x1001b120",
                "name": "VariantInit"
              },
              {
                "address": "0x1001b124",
                "name": "SysAllocString"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x1001b000",
                "name": "RegSetValueExW"
              },
              {
                "address": "0x1001b004",
                "name": "RegOpenKeyExW"
              },
              {
                "address": "0x1001b008",
                "name": "RegEnumKeyExW"
              },
              {
                "address": "0x1001b00c",
                "name": "RegDeleteKeyExW"
              },
              {
                "address": "0x1001b010",
                "name": "RegCreateKeyExW"
              },
              {
                "address": "0x1001b014",
                "name": "RegCloseKey"
              },
              {
                "address": "0x1001b018",
                "name": "RegDeleteTreeW"
              },
              {
                "address": "0x1001b01c",
                "name": "ConvertStringSidToSidW"
              },
              {
                "address": "0x1001b020",
                "name": "RegQueryInfoKeyW"
              }
            ]
          },
          "SETUPAPI": {
            "dll": "SETUPAPI.dll",
            "imports": [
              {
                "address": "0x1001b134",
                "name": "SetupDiGetClassDevsW"
              },
              {
                "address": "0x1001b138",
                "name": "SetupDiEnumDeviceInfo"
              },
              {
                "address": "0x1001b13c",
                "name": "SetupDiDestroyDeviceInfoList"
              },
              {
                "address": "0x1001b140",
                "name": "SetupDiGetDeviceRegistryPropertyW"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x1001b1e4",
                "name": "RtlFreeHeap"
              },
              {
                "address": "0x1001b1e8",
                "name": "RtlAllocateHeap"
              }
            ]
          },
          "RPCRT4": {
            "dll": "RPCRT4.dll",
            "imports": [
              {
                "address": "0x1001b12c",
                "name": "UuidFromStringW"
              }
            ]
          }
        },
        "exported_dll_name": "du.dll",
        "exports": [
          {
            "address": "0x100091f0",
            "name": "??4ClientApplicationInfo@DU@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 1
          },
          {
            "address": "0x100091d0",
            "name": "??4ClientApplicationInfo@DU@@QAEAAU01@ABU01@@Z",
            "ordinal": 2
          },
          {
            "address": "0x10009150",
            "name": "??4DownloadOptions@DU@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 3
          },
          {
            "address": "0x10009150",
            "name": "??4DownloadOptions@DU@@QAEAAU01@ABU01@@Z",
            "ordinal": 4
          },
          {
            "address": "0x10009190",
            "name": "??4ImageInfo@DU@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 5
          },
          {
            "address": "0x10009170",
            "name": "??4ImageInfo@DU@@QAEAAU01@ABU01@@Z",
            "ordinal": 6
          },
          {
            "address": "0x10009140",
            "name": "??4SearchOptions@DU@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 7
          },
          {
            "address": "0x10009140",
            "name": "??4SearchOptions@DU@@QAEAAU01@ABU01@@Z",
            "ordinal": 8
          },
          {
            "address": "0x10009190",
            "name": "??4Version@DU@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 9
          },
          {
            "address": "0x10009170",
            "name": "??4Version@DU@@QAEAAU01@ABU01@@Z",
            "ordinal": 10
          },
          {
            "address": "0x100094c0",
            "name": "DUCancel",
            "ordinal": 11
          },
          {
            "address": "0x10009410",
            "name": "DUDownload",
            "ordinal": 12
          },
          {
            "address": "0x10009320",
            "name": "DUSearch",
            "ordinal": 13
          },
          {
            "address": "0x10009780",
            "name": "DUShutdown",
            "ordinal": 14
          },
          {
            "address": "0x10009540",
            "name": "DUStartup",
            "ordinal": 15
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x00018c20",
            "size": "0x00000287"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x0001b210",
            "size": "0x000000dc"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x0001d000",
            "size": "0x000003e0"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x0001c200",
            "size": "0x00002140"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x0001e000",
            "size": "0x00001d04"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x00008830",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x000011d0",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x0001b000",
            "size": "0x0000020c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x00018b88",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x00017ea7",
            "size_of_data": "0x00018000",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.24"
          },
          {
            "name": ".data",
            "raw_address": "0x00018400",
            "virtual_address": "0x00019000",
            "virtual_size": "0x000010c4",
            "size_of_data": "0x00000c00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "4.04"
          },
          {
            "name": ".idata",
            "raw_address": "0x00019000",
            "virtual_address": "0x0001b000",
            "virtual_size": "0x00000d7a",
            "size_of_data": "0x00000e00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.43"
          },
          {
            "name": ".didat",
            "raw_address": "0x00019e00",
            "virtual_address": "0x0001c000",
            "virtual_size": "0x0000000c",
            "size_of_data": "0x00000200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "0.15"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x0001a000",
            "virtual_address": "0x0001d000",
            "virtual_size": "0x000003e0",
            "size_of_data": "0x00000400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "3.26"
          },
          {
            "name": ".reloc",
            "raw_address": "0x0001a400",
            "virtual_address": "0x0001e000",
            "virtual_size": "0x00001d04",
            "size_of_data": "0x00001e00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.71"
          }
        ],
        "overlay": {
          "offset": "0x0001c200",
          "size": "0x00002140"
        },
        "resources": [
          {
            "name": "RT_VERSION",
            "offset": "0x0001d060",
            "size": "0x0000037c",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.47"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Dynamic Update"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "DU.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "DU.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "96048393aa446d6a9ea450137c963885",
        "timestamp": "2074-09-11 13:02:40",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 10
      },
      "data": null,
      "strings": [
        "VPh(>",
        "%s: Failed to get the IUpdateSearcherInternal object for getting driver sets. hr = 0x%x",
        "Microsoft",
        "VShXm",
        "%s: Failed to set the value for the Version Info SP build number. hr = 0x%x",
        "%s: Failed to initialize the CDUUpdateCollection. hr = 0x%x",
        "%s: Failed to create destination directory %s for update number %d from the bundled updates collection. hr = 0x%x",
        "FailFast",
        "GUID_DEVCLASS_SMARTCARDREADER",
        "%s: Failed to set the value for the Image Info language. hr = 0x%x",
        "%s: Failed to create a new IUpdateDownloader. hr = 0x%x",
        "GUID_DEVCLASS_EXTENSION",
        "?.?8?l?s?y?",
        "?9?K?R?Y?e?q?",
        "91989>9D9P9\\9u9",
        "UnhandledExceptionFilter",
        ".text$yd",
        "__dllonexit",
        "%s: Failed to create the root Image Info registry key. hr = 0x%x",
        "%s: WU_UpgradeI::CreateInternalUpgradeSession failed. hr = 0x%x",
        "%s: Failed to make a writable shallow copy of the IUpdateCollection. hr = 0x%x",
        "PQSVW",
        "959N9]9n9u9{9",
        "QQSVWhT",
        "Microsoft Time-Stamp Service",
        "VPhh;",
        "%hs: ProcessDeviceClass() failed for NULL device class; hr = 0x%X",
        ".CRT$XIAA",
        "%s: Failed to copy update from the WU cache. hr = 0x%x",
        "<[<r<y<",
        "WSh(I",
        "0M1Z1a1h1t1~1",
        "4T4k4r4x4",
        "WVPhX~",
        "GUID_DEVCLASS_DOT4PRINT",
        "WSh(L",
        "5\"5'545B5M5",
        "0 040H0\\0p0",
        "GUID_DEVCLASS_HDC",
        "X0]0o0",
        "%s: Could not find any default AU service. hr = 0x%x",
        "6&626=6D6X6]6",
        "GUID_DEVCLASS_MEMORY",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SystemProtectedUserData",
        "SetupDiEnumDeviceInfo() failed; hr = 0x%8X",
        "333I3Q3W3g3n3t3z3",
        "20201008052650Z",
        "GUID_DEVCLASS_ADAPTER",
        "ResolveLocaleName",
        ".?AVCDUSession@DU@@",
        "jfWh8 ",
        "%s: Failed to get the IUpdateInternalConfiguration object for skipping existing drivers. hr = 0x%x",
        "j\\Zf;Ty",
        "GDRDURevision",
        "%s: Failed to get IsDriverSet property of internal driver update. hr = 0x%x",
        ";%;+;7;C;W;",
        "Microsoft Corporation",
        "6 60646D6H6X6\\6l6p6t6x6|6",
        "5 6'60666B6f6v6",
        "yqfd}pwd|p",
        "tjj:V",
        "3\"353H3O3U3[3g3s3",
        "malloc",
        ";>;J;\\;",
        ".didat$2",
        ".rsrc",
        "%s: Failed to set the value for the Version Info major version. hr = 0x%x",
        "?$?*?5?A?t?",
        "7#757Q7g7",
        ".giats",
        ".didat$6",
        "base\\ntsetup\\cdp\\du\\dll\\du.cpp",
        "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate\\ImageInfo",
        "9~(s,j",
        "%s: Failed to create the Type registry key for device IDs. hr = 0x%x",
        "GUID_DEVCLASS_FDC",
        "ReleaseSemaphore",
        "%s: No valid driver update type; invalid update",
        "VWhHv",
        "Network cost manager is not available; will proceed with download",
        ">*>1>7>=>H>U>s>",
        "=2>9>E>P>b>w>}>",
        "xDU::CDUSession::Search::CServerSelectionReset::DoReset",
        "[%hs]",
        "|qbd}pc",
        "9sd~}j",
        "4_4l4G5",
        "%s: Failed to set WU driver applicability property to ignore installed drivers. hr = 0x%x",
        "?terminate@@YAXXZ",
        ".?AVCDUSearchCompletedCallback@DU@@",
        "??0exception@@QAE@ABV0@@Z",
        "RegCloseKey",
        "xDU::CDUSession::Download",
        "xDU::CRegistryManager::CreateImageInfoKeys",
        "DU::CDUSession::CreateUpdateSession",
        "RegCreateKeyExW",
        "4%4,42484C4O4c4y4",
        "%s: Invalid update removed successfuly",
        "8$8+81868A8L8R8f8",
        ".?AUIDUUpdate@DU@@",
        "8$8B8H8P8j8r8",
        "%s: Failed to get update number %d from the IUpdateCollection. hr = 0x%x",
        "=0=\\=c=j=v=",
        " Microsoft Operations Puerto Rico1&0$",
        "ComponentUpdate:",
        "HeapSize",
        "3&424D4",
        "GetProcessHeap",
        "3$303<3P3z3",
        "2+2v2",
        "<%<,<2<8<F<U<",
        "r~akow",
        "4#454<4B4H4T4`4",
        "DU::CDUSession::Search",
        "PWh(s",
        ")Microsoft Root Certificate Authority 20100",
        "Local\\SM0:%d:%d:%hs",
        "<$<+<6<B<Q<X<_<j<v<",
        "DU::CRegistryManager::CreateTypeKeys",
        "LoadLibraryExW",
        "%s: Failed to allocate the hardware ID BSTR",
        "SQhPT",
        "5/5H5O5U5`5l5x5",
        "IsDebuggerPresent",
        "GetProcAddress",
        "=2>Q>[>q>",
        "base\\ntsetup\\cdp\\du\\lib\\src\\duupdatecollection.cpp",
        "%s: Failed to get the IUpdateSearcherIgnoreInstalledDrivers object for using WU driver applicability. hr = 0x%x",
        "xDU::CDUSession::GetOnlineServiceId",
        "5,5<5L5\\5l5|5",
        "DU::CDUUpdateCollection::GetItem",
        "%s: Failed to create the Type registry key for input language features on demand. hr = 0x%x",
        "100701213655Z",
        "%s: Failed to create the Update Types registry keys. hr = 0x%x",
        "%s: Failed to create the Type registry key for Setup updates. hr = 0x%x",
        "WShXJ",
        "?%?,?2?8?C?O?c?{?",
        "SVh@U",
        "%s: Failed to set the value for the device ID %s. hr = 0x%x",
        "=%=9=P=W=]=c=q=}=",
        "%s: Failed to restore server selection %d for IUpdateSearcher. hr = 0x%x",
        "_errno",
        "InitializeCriticalSection",
        "WaitForSingleObject",
        "<(<4<H<c<",
        "GUID_DEVCLASS_MODEM",
        "9(9-9X9r9",
        "0V1t1",
        ">\">/>>>r>",
        "wcsstr",
        "%s: Failed to get update type property; hr = 0x%x",
        "4!4,4@4l4s4z4",
        "GUID_DEVCLASS_61883",
        "%s: Failed to set the volume %s for download (to achieve WU cache redirection). hr = 0x%x",
        "VPh87",
        "DU::CDeviceIDIterator::ProcessDeviceClass",
        "%s: WU internal upgrade API mismatch; expected [%s], actual [%s]",
        "5 5$5(5,5@5H5`5|5",
        "Microsoft Corporation1&0$",
        "<%<q<",
        "PShP ",
        "GUID_DEVCLASS_NETSERVICE",
        "%s: Failed to put network cost policy awareness in the downloader. hr = 0x%x",
        "kernelbase.dll",
        "%s: Failed to restore WU internal searcher property to include driver sets. hr = 0x%x",
        "base\\ntsetup\\cdp\\du\\lib\\src\\dusession.cpp",
        "%s: Failed to get the number of bundled updates. hr = 0x%x",
        "E0C1)0'",
        "OutputDebugStringA",
        "GUID_DEVCLASS_MULTIPORTSERIAL",
        "1<1j1~1",
        "%s: Failed to Invoke the internal IDUDownloadProgressCallback. hr = 0x%x",
        "bad allocation",
        "WPht\\",
        "WShD@",
        "2*212?2F2M2Y2e2",
        "2[2p2",
        "%s: Ending asynchronous download",
        "RegSetValueExW",
        "%s: Failed to create the device ID registry sub-keys. hr = 0x%x",
        "%s: Failed to get update CLSID from string %s. hr = 0x%x",
        "GUID_DEVCLASS_1394DEBUG",
        "TerminateProcess",
        "210317011500Z0",
        "RaiseException",
        "DriverUpdate:",
        ";0;L;P;X;|;",
        ".idata$5",
        ".CRT$XCU",
        "%s: Failed to end the asynchronus download. hr = 0x%x",
        "6,6<6H6h6p6|6",
        "Unable to allocate device property 0x%X; hr = 0x%X",
        ":m;w;",
        ":\":':8:Q:w:",
        "M QRSP",
        "; ;';2;>;M;T;[;f;r;",
        "%s: Failed to set the value for the Client Application Info architecture. hr = 0x%x",
        "DU::CDUSession::Initialize",
        "??1exception@@UAE@XZ",
        "WSh H",
        "R!s4Z",
        "1#2>2r2",
        "7$7*7j7y7",
        "%s: Invalid search flag 0x%x passed with update types 0x%x. hr = 0x%x",
        ":::s:",
        "GUID_DEVCLASS_MEDIA",
        "%s: Unexpected flight ID property type %d. hr = 0x%x",
        ":E:Y:s:",
        "'XD}*",
        "%s: Failed to get the IDownloadProgress property from the IDownloadProgressChangedCallbackArgs. hr = 0x%x",
        "_purecall",
        ">+?k?",
        "2 2&2,272C2W2",
        "%s: Failed to create the root Client Application Info registry key. hr = 0x%x",
        "%s: Failed to clear registry state before starting DU search. hr = 0x%x",
        "040904B0",
        "%s: Failed to build the search criteria. hr = 0x%x",
        "Microsoft Time-Stamp Service0",
        "GUID_DEVCLASS_DISPLAY",
        "DU::CDUSession::CancelOperation",
        "%s: Failed to get network cost from network cost manager. hr = 0x%x",
        "WShPM",
        "HeapFree",
        "%s: Failed to restore service ID %s for IUpdateSearcher. hr = 0x%x",
        "VPh`8",
        "9*:A:[:n:s:y:",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "%s: Failed to get IUpdateService2 interface from IUpdateService index %d. hr = 0x%x",
        "Got IUpdateSearcher properties: server selection = %d, service ID = %s; will restore later",
        "%s: Failed when iterating over the set of device IDs. hr = 0x%x",
        "_wcsicmp",
        "SetupPlatformUpdate:",
        ".?AVexception@@",
        "api-ms-win-core-delayload-l1-1-1.dll",
        "\"Microsoft Window",
        "191219011500Z",
        ".idata",
        "%s: Failed to get generate well-formed GUID string from service ID string %s. hr = 0x%x",
        ".data$r$brc",
        "CoTaskMemFree",
        "%s: Failed to get update ID for update number %d from the bundled updates collection. hr = 0x%x",
        ".data",
        ".?AUIDUUpdateCollection@DU@@",
        "1$2:2O2j2z2",
        "[%hs(%hs)]",
        "RegEnumKeyExW",
        "%s: Failed to get the IUpdateCollection object wrapped up by the CDUUpdateCollection. hr = 0x%x",
        "696K6W6q6w6",
        "Redmond1",
        "bcp47langs.dll",
        "10.0.19041.572 (WinBuild.160101.0800)",
        "%s: Failed to clean up the download operation. hr = 0x%x",
        "%s: Could not get volume path for [%s]. hr = 0x%x",
        ">-?:?",
        ">*>7>",
        "xDU::CRegistryManager::CreateDeviceIdKeys",
        "%s: Failed to dynamic cast IDUUpdateCollection* to CDUUpdateCollection*",
        "3%3,383D3X3b3h3",
        "Msg:[%ws] ",
        "ole32.dll",
        "VWPh :",
        "8+82888>8I8U8i8",
        "%s: Failed to set WU internal configuration property for targeted scans. hr = 0x%x",
        "9(9.939F9Z9",
        " Windows",
        "j\\Yf;",
        "1%242I2~2",
        ";%<><E<K<Q<\\<h<|<",
        "&%VmwP",
        "GUID_DEVCLASS_SIDESHOW",
        "%s: Failed to set the value for the Version Info build number. hr = 0x%x",
        "__RTDynamicCast",
        "StringFromCLSID",
        ".didat$5",
        "2%2/2B2^2",
        ".?AVCServerSelectionReset@?1??Search@CDUSession@DU@@QAEJHQAPBGHPBUImageInfo@3@KPBUSearchOptions@3@PAPAVCDUUpdateCollection@3@PAW4tagOperationResultCode@@@Z@",
        "261019185142Z0",
        "3.3L3",
        "3)4V5",
        "/ServiceEnvironment/WUClientData/DriverSync",
        "%s: Failed to move/copy parent update from the WU cache. hr = 0x%x",
        "Volatile service ID %s is in use in IUpdateSearcher!",
        "WShpO",
        "1F1o1",
        "%s: Failed to get IUpdate9 interface from update. hr = 0x%x",
        "VWh(e",
        "6,6C6c6}6",
        "GUID_DEVCLASS_HIDCLASS",
        "??4ImageInfo@DU@@QAEAAU01@ABU01@@Z",
        "GUID_DEVCLASS_DECODER",
        "%s: Failed to create the features on demand registry sub-keys. hr = 0x%x",
        ">/>;>I>W>c>j>p>v>",
        "ADVAPI32.dll",
        "DU::CDUSession::Search::CIncludeDriverSetsReset::DoReset",
        "404D4X4l4",
        "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate\\SetupUpdate",
        ".?AVCTargetedScanReset@?1??Search@CDUSession@DU@@QAEJHQAPBGHPBUImageInfo@3@KPBUSearchOptions@3@PAPAVCDUUpdateCollection@3@PAW4tagOperationResultCode@@@Z@",
        "5\"565M5]5m5",
        "CategoryIDs contains '",
        "%s: Failed to restore WU driver applicability property to ignore installed drivers. hr = 0x%x",
        "USER32.dll",
        "GUID_DEVCLASS_PROCESSOR",
        "%s: Failed to append version override criterion value: %s. hr = 0x%x",
        "EnterCriticalSection",
        "3S3Z3",
        "%hs!%p: ",
        "InstallationType",
        "SWhHz",
        "CLSIDFromString",
        "%s: Failed to allocate the flight ID string",
        "%s: Failed to append OR string. hr = 0x%x",
        "GUID_DEVCLASS_INFRARED",
        "qvd}pRichwd}p",
        "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a",
        "VPh`]",
        "3PhhZ",
        "%s: Failed to set the values for the Image Info Version. hr = 0x%x",
        ":):W:n:",
        "WdsSetupLogMessageW",
        "CreateSemaphoreExW",
        "%s: Failed to set the value for the Image Info GDR DU Revision level. hr = 0x%x",
        "pvd}pc",
        "%s: Failed to get the update result for update %d. hr = 0x%x",
        "DU::CDUSearchCompletedCallback::Invoke",
        "=,=>=Z=",
        "3 3*3:3J3P3[3a3m3}3",
        "GUID_DEVCLASS_IMAGE",
        "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate\\ComponentUpdate",
        "CurrentIP",
        "<%<7<",
        "WPh(}",
        "GUID_DEVCLASS_PRINTERUPGRADE",
        "%s: Failed to get the hardware id from the update description. hr = 0x%x",
        ".xdata$x",
        "GUID_DEVCLASS_PORTS",
        "VPh8=",
        "020S0Z0`0f0r0",
        "?#?7?@?Y?p?z?",
        "2 2,2;2O2h2v2}2",
        "4$4*434H4T4[4b4h4",
        ".didat$3",
        "DU::CDUUpdateCollection::Invalidate",
        "5,535?5F5h5",
        "=%=1===Q=b=",
        "Microsoft Corporation1",
        "VPh`<",
        "RtlAllocateHeap",
        ".?AVCRegistryManager@DU@@",
        "GUID_DEVCLASS_PCMCIA",
        "?\"?.?B?L?S?Y?_?j?x?",
        "SetThreadErrorMode",
        "4!4X4u4",
        ".?AVCDUInterface@DU@@",
        "<\"=g=s=",
        "%s: Failed to append category ID contains clause. hr = 0x%x",
        "towupper",
        ":$:>:E:o:v:|:",
        "m<!*R",
        "%s: Failed to get bundled updates. hr = 0x%x",
        "SQh0V",
        "DU::CDUDownloadCompletedCallback::Invoke",
        ";&;B;R;i;p;z;",
        "Thales TSS ESN:7880-E390-80141%0#",
        "1/0-0",
        "base\\ntsetup\\cdp\\du\\lib\\src\\duupdate.cpp",
        " Microsoft Operations Puerto Rico1",
        "646?6",
        "StringFileInfo",
        "KERNEL32.dll",
        "Sleep",
        "SPh(Z",
        "%s: Failed to restore the default download volume for IUpdateDownloader. hr = 0x%x",
        "t$pVQ",
        "= =)=.=7=<=E=J=S=X=a=f=o=t=}=",
        "7#7P7",
        "Failed to get device hardware ID; hr = 0x%8X",
        "9':B:h:",
        "5\"5K5Q5W5_5~5",
        "N0L0J",
        "080U0v0",
        "%s: Failed to allocate CDUUpdate",
        "%s: Failed to create a new IDownloadCompletedCallback. hr = 0x%x",
        "4 484<4T4X4p4t4",
        "PPPPP",
        "9b9q9",
        "%s: Failed to initialize CDUSession on thread ID 0x%x. hr = 0x%x",
        "1&151I1R1^1e1l1x1",
        "GetCurrentProcessId",
        "%s: Failed to get UpdateID property from update identity. hr = 0x%x",
        "7#7)757A7U7q7",
        ";&;2;>;h;",
        "<)<U<[<h<s<",
        "SetupDiGetDeviceRegistryPropertyW",
        "505n5u5|5",
        "PWWWV",
        ":D;\\;",
        "onecore\\internal\\sdk\\inc\\wil\\opensource\\wil\\resource.h",
        "%s: Failed when waiting for WU update event. hr = 0x%x",
        ": :(:<:X:`:d:l:p:x:|:",
        "%s: Failed to set the value for the Version Info branch. hr = 0x%x",
        "SetEvent",
        ".?AVbad_alloc@std@@",
        "6!6)656I6",
        "DU::CDUSession::Search::CTargetedScanReset::DoReset",
        "%s: Failed to get IsDefaultAUService property from IUpdateService2 index %d. hr = 0x%x",
        "<!<1<<<B<J<Q<a<l<r<y<",
        "%s: Failed to get the Operation Result Code of the download. hr = 0x%x",
        "2 282|2",
        "%s: Failed to allocate CDUUpdateCollection",
        "GetVolumeNameForVolumeMountPointW",
        "DUShutdown",
        "20201008073851.732Z0",
        "SPhT\\",
        "%s: Unpacking update number %d from the bundled updates collection into its own sandbox %s",
        "_onexit",
        "151]1",
        "229879+4583610",
        "GUID_DEVCLASS_FLOPPYDISK",
        ".idata$4",
        ".?AUISearchCompletedCallback@@",
        "A@SPj",
        "QQSVW",
        "%s: Failed to get the IUpdateCollection object wrapped up by the CDUUpdateCollection to get download result. hr = 0x%x",
        "DUCancel",
        "%s: Failed to restore WU internal configuration property for targeted scans. hr = 0x%x",
        "GUID_DEVCLASS_SENSOR",
        "GUID_DEVCLASS_UNKNOWN",
        "%hs: SetupDiGetClassDevs() failed; hr = 0x%X",
        "WaitForSingleObjectEx",
        "%s: Skipping unpack of main update",
        "1!1;1O1V1]1i1u1",
        "818U8q8",
        "#wd}pwd}pwd}pc",
        "DU::CRegistryManager::CreateClientApplicationInfoKeys",
        ".didat$7",
        "KERNEL32.DLL",
        ".text$mn",
        " AND Type='Driver'",
        "7$7*7C7W7",
        "GUID_DEVCLASS_SCSIADAPTER",
        "DUSearch",
        "DUDownload",
        "GUID_DEVCLASS_VOLUMESNAPSHOT",
        "3?3p3",
        "949Q9J:",
        "GUID_DEVCLASS_COMPUTER",
        "}$)~r",
        "=2=I=`=",
        "?$?,?4?<?D?L?T?\\?d?l?t?|?",
        "%Microsoft Windows Production PCA 2011",
        "DU::CDUUpdate::Initialize",
        "@.didat",
        "%s: Failed to get the network cost. hr = 0x%x",
        ".CRT$XIA",
        "=)=3=L=S=Z=e=q=",
        "DU::CDUSession::Search::CServiceIdReset::DoReset",
        "fH%w[",
        "%s: Failed to get hardware ID from Windows driver update interface; hr = 0x%x",
        "/ServiceEnvironment/WUClientData/FederatedServices/ServiceID",
        "WQhPt",
        "2(2<2P2d2x2",
        "%s: Unexpected exception thrown by CDUSession::DUUpdateCollectionReleased",
        "Invalid parameter passed to C runtime function.",
        "%s: Failed to get current server selection for IUpdateSearcher. hr = 0x%x",
        "GUID_DEVCLASS_TAPEDRIVE",
        "8!8.8B8g8{8",
        ".text$x",
        "GUID_DEVCLASS_CDROM",
        "DU::CDeviceIDIterator::AddDeviceMultiSzProperty",
        "210303183038Z0p1",
        "VDEST",
        "%s: Failed to create the applicability registry key for language features on demand. hr = 0x%x",
        "%s: CallerProfile search criterion is supported while scanning for drivers; will only use driver classification for category",
        "shell\\cpls\\internationalsettings\\duplugin\\ForEachKey.h",
        "040X0j0q0w0}0",
        "=.=G=c=",
        "LegalCopyright",
        ">;>j>",
        "%s: Not a component update; request to not extract cab file is invalid. hr = 0x%x",
        "111019184142Z",
        "CreateDirectoryW",
        "umVVW",
        "%s: CoCreateInstance on IUpdateServiceManager failed. hr = 0x%x",
        "%hs(%u)\\%hs!%p: ",
        "?what@exception@@UBEPBDXZ",
        "Y__^[",
        "%s: Failed to set the value for the Client Application Info id. hr = 0x%x",
        "%s: Failed to get the Operation HRESULT of the partially successful download. hr = 0x%x",
        ".idata$3",
        "0 0&0,070C0Q0]0d0j0p0{0",
        "GUID_DEVCLASS_USB",
        "WSh`N",
        "1'1.141:1F1R1l1|1",
        "RtlDisownModuleHeapAllocation",
        ".rdata",
        ";*;>;e;p;",
        "%s: Failed to append closing single quote. hr = 0x%x",
        "%s: Operation result code (%d) after download indicates failure.",
        "RPCRT4.dll",
        "VPhX3",
        "0\"0+00090>0G0L0U0Z0r0w0}0",
        "$`2X`F",
        ": ;@;t;",
        "3Ph`[",
        "0$0,040<0D0L0T0\\0d0l0t0|0",
        "M0K0I",
        "%s: Failed to allocate the hardware ID string",
        ".text$di",
        "WWWWWWP",
        "du.pdb",
        "VarFileInfo",
        "GetCurrentProcess",
        ":);G;S;u;",
        "5$585=5R5d5",
        "%s: Failed to set the value for the Version Info minor version. hr = 0x%x",
        "??1type_info@@UAE@XZ",
        "%s: Failed to set WU internal searcher property to include driver sets. hr = 0x%x",
        "Client",
        "WDSCORE.dll",
        "%s: Failed to initialize the device iterator for class %s. hr = 0x%x",
        "SetupDiEnumDeviceInfo",
        "|hK,_",
        "VPh`|",
        "%s: Upgrade internal session is not available; invalid request. hr = 0x%x",
        "%s: Failed to get service ID property from IUpdateService2 index %d. hr = 0x%x",
        "WShXA",
        "DU::CDUSession::GetNetworkCost",
        "%s: Failed to append version override's closing single quote. hr = 0x%x",
        "tNf9E",
        "DeleteCriticalSection",
        "%s: Failed to create a new IUpdateSession. hr = 0x%x",
        "%s: Failed to move update from the WU cache using IUpdate9. hr = 0x%x",
        "OriginalFilename",
        ".?AVCAtlException@ATL@@",
        "%s: Unknown DUSessionStatus: %d",
        "8)858I8X8r8y8",
        "_CxxThrowException",
        "DU::CDUUpdate::GetFlightID",
        "WSh8B",
        "Microsoft Windows0",
        "%s: CoCreateInstance failed. hr = 0x%x",
        "%s: Failed to set the value for the Image Info edition id. hr = 0x%x",
        "SetupDiDestroyDeviceInfoList",
        "7,7<7C7I7O7Z7f7z7",
        "Major",
        "%s: Failed to get the collection of updates that was found in the search. hr = 0x%x",
        "gDU::CDUUpdate::GetHardwareID",
        "<2<M<g<x<",
        "GUID_DEVCLASS_MOUSE",
        "%s: Failed to get the update HRESULT for update %d. hr = 0x%x",
        "8.8B8M8]8d8j8p8{8",
        "??4ClientApplicationInfo@DU@@QAEAAU01@$$QAU01@@Z",
        "SPLevel",
        "7(7H7P7X7d7",
        "7!70787G7^7d7",
        "@.reloc",
        ".edata",
        "t$<WP",
        "9/:X:",
        "GUID_DEVCLASS_MULTIFUNCTION",
        "7R8u8",
        "RSDS6,=P\"",
        "1&1:1h1",
        "%s: Failed to copy client application info ID string %s. hr = 0x%x",
        "%s: Failed to get update number %d from the bundled updates collection. hr = 0x%x",
        "262=2C2I2T2`2",
        "%s: Failed to dynamic cast IDUUpdateCollection* to CDUUpdateCollection* to get download result",
        "LogHr",
        "1)191@1F1L1W1c1w1",
        " Operating System",
        "%s: Operation result code (%d) after download indicates success with errors. Operation HResult = 0x%x",
        "0 1_1~1",
        "%s: Failed to allocate the hardware ID CString",
        "SetupDiGetClassDevsW",
        "6+6A6H6O6[6j6v6}6",
        "7\"747;7A7G7R7^7r7",
        "7e7~7",
        ".?AVCIncludeDriverSetsReset@?1??Search@CDUSession@DU@@QAEJHQAPBGHPBUImageInfo@3@KPBUSearchOptions@3@PAPAVCDUUpdateCollection@3@PAW4tagOperationResultCode@@@Z@",
        "_initterm",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "GUID_DEVCLASS_MEDIUM_CHANGER",
        "%s: Failed to set the collection of updates to download. hr = 0x%x",
        "%s: Failed to get the count of updates in IUpdateCollection object. hr = 0x%x",
        "SVWj@",
        "RtlFreeHeap",
        "8$8,848<8D8L8X8`8x8",
        "HeapReAlloc",
        "j[Sh8 ",
        "%s: Failed to create a new ISearchCompletedCallback. hr = 0x%x",
        "U0S0Q",
        "GUID_DEVCLASS_DOT4",
        "RegOpenKeyExW",
        "Microsoft Corporation1)0'",
        "2%292N2y2",
        "GUID_DEVCLASS_WPD",
        "LoadLibraryExA",
        "3#3)3/3:3F3Z3c3o3z3",
        "WVPh8E",
        "8 888<8T8d8t8",
        "SetUpdateDownloadVolume",
        "8I8x8",
        "SetLastError",
        "%s: Failed to copy client application info version's branch value %s. hr = 0x%x",
        ">*>c>",
        "%s: Failed to set the value for the Version Info SP level. hr = 0x%x",
        ".00cfg",
        "_callnewh",
        "RegDeleteKeyExW",
        "9#9*90969B9N9b9w9",
        "9(949J9Q9W9b9m9y9",
        "oK0D$\"<",
        "_lock",
        "Unreleased DUUpdateCollection interface during DUSession release",
        "768V8",
        "%s: Failed to get the number of updates in the collection. hr = 0x%x",
        "%s: Failed to get update service collection. hr = 0x%x",
        "%s: Failed to get update identity interface from update. hr = 0x%x",
        "VWh y",
        ".rdata$brc",
        "DU::CDUSession::~CDUSession",
        "%s: Failed to get current service ID for IUpdateSearcher. hr = 0x%x",
        "%s: Failed to build OS version information structure. hr = 0x%x",
        "%s: Invalid update. Removing update from the collection...",
        ".?AUIRegistryManager@DU@@",
        "CallContext:[%hs] ",
        "%s: Failed to append category ID. hr = 0x%x",
        "%s: Failed to get current WU internal searcher property to include driver sets. hr = 0x%x",
        "GUID_DEVCLASS_PNPPRINTERS",
        "%s: Failed to get online service ID. hr = 0x%x",
        "msvcrt.dll",
        "%s: Failed to get count from update service collection. hr = 0x%x",
        "<L=V=q=",
        ">$>0>T>\\>d>l>t>|>",
        "3$3<3@3X3\\3t3x3",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "z.9Wv",
        "GUID_DEVCLASS_EHSTORAGESILO",
        "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate\\SetupPlatformUpdate",
        "GetCurrentThreadId",
        "GetUserLanguagesForUser",
        "%s: Failed to set the Aborted event. GLE = 0x%x",
        ".data$brc",
        "SWhp^",
        "CoCreateInstance",
        "9)9=9G9",
        "7(787H7L7\\7`7p7t7x7|7",
        "VWh d",
        "%s: Failed to abort the search operation. hr = 0x%x",
        "6)646H6v6",
        "7#7Q7_7",
        "Microsoft Time-Stamp PCA 2010",
        "%s: Waiting for WU update event neither timed out nor failed; wait status = 0x%x",
        "4N4a4y4",
        "Failed to get device compatible IDs; hr = 0x%8X",
        "iswspace",
        "3,3@3T3h3|3",
        "7 7&7,787G7[7x7",
        "MultiByteToWideChar",
        "%s: Incompatible search flags 0x%x passed. hr = 0x%x",
        "memmove_s",
        "FreeLibrary",
        "Branch",
        "`.data",
        "%s: Failed to create the Type registry key for Driver updates. hr = 0x%x",
        ".?AVCPropertyReset@?1??Search@CDUSession@DU@@QAEJHQAPBGHPBUImageInfo@3@KPBUSearchOptions@3@PAPAVCDUUpdateCollection@3@PAW4tagOperationResultCode@@@Z@",
        "WPhXR",
        "%s: Failed to abort the download operation. hr = 0x%x",
        "ReturnHr",
        "%s: Failed to get update identity for update number %d from the bundled updates collection. hr = 0x%x",
        "??4SearchOptions@DU@@QAEAAU01@$$QAU01@@Z",
        "000E0Z0l0",
        "Legal_Policy_Statement",
        "GUID_DEVCLASS_KEYBOARD",
        "Microsoft Time-Stamp PCA 20100",
        "4C4J4P4V4a4n4}4",
        "%s: Caller profile search criterion is not supported. hr = 0x%x",
        ".?AVCIgnoreInstalledDriversReset@?1??Search@CDUSession@DU@@QAEJHQAPBGHPBUImageInfo@3@KPBUSearchOptions@3@PAPAVCDUUpdateCollection@3@PAW4tagOperationResultCode@@@Z@",
        "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate\\ClientApplicationInfo",
        "__CxxFrameHandler3",
        "1$181L1`1t1",
        "VPhL{",
        "xDU::CRegistryManager::CreateFeaturesOnDemandKeys",
        "333a3s3z3",
        "GUID_DEVCLASS_LEGACYDRIVER",
        "5 5@5H5P5X5d5",
        "DU::CDUSession::Search::CIgnoreInstalledDriversReset::DoReset",
        "GUID_DEVCLASS_NETCLIENT",
        "5G6N6]6i6x6",
        "%s: Failed to get IUPDATE_INTERNALUPDATEPROPERTY_FLIGHTID from IUpdateInternalProperty. hr = 0x%x",
        "1<;<Q<[<q<{<",
        "Exception",
        ">'>3>E>",
        "<&<,<2<=<I<]<~<",
        "3$3,343<3D3L3T3\\3d3l3t3|3",
        "base\\ntsetup\\cdp\\du\\lib\\src\\dudownloadcallback.cpp",
        "1(0&0",
        "5P5Z5",
        "%s: Failed to put ssOthers server selection for IUpdateSearcher. hr = 0x%x",
        "xCallerProfile='DU' AND ",
        "%s: Failed to get update service index %d from update service collection. hr = 0x%x",
        "%s: Waiting for WU update event timed out after %d ms.",
        "2U2b2k2v2}2",
        ".idata$2",
        "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate",
        "13191B1N1m1|1",
        "4 4@4P4t4|4",
        "GUID_DEVCLASS_INFINIBAND",
        ">(>P>x>",
        ".CRT$XCL",
        "UuidFromStringW",
        "GUID_DEVCLASS_WCEUSBS",
        "%s: Failed to create the Type registry key for Setup Platform updates. hr = 0x%x",
        "%s: CoCreateInstance failed for network cost manager. hr = 0x%x",
        "%s: Failed to create the Client Application Info registry keys. hr = 0x%x",
        "Wp/wM",
        "GUID_DEVCLASS_SBP2",
        ".CRT$XCA",
        "6Sh(C",
        "PQQSVW",
        "3;3E3K3T3g3m3|3",
        "0?0F0L0R0]0i0",
        "%s: Tried to get the hardware ID of a non driver update",
        "5a6u6",
        "EditionID",
        "VPhH4",
        "WSh|B",
        "SetUnhandledExceptionFilter",
        "%s: Failed to check whether caller profile search criterion is supported. hr = 0x%x",
        "?&?P?",
        "2$2,242<2D2L2T2\\2d2l2t2|2",
        "Dynamic Update",
        "VWhPc",
        "GUID_DEVCLASS_ENUM1394",
        "141L1S1Y1_1j1v1",
        "LeaveCriticalSection",
        "GUID_DEVCLASS_SOUND",
        "TlP0X",
        "%s: Failed to create a new IUpdateSearcher. hr = 0x%x",
        "<,=0=<=\\=h=",
        "%s: Failed to move/copy bundled update number %d from the WU cache. hr = 0x%x",
        "%s: Failed to start the asynchronus download. hr = 0x%x",
        "WilError_03",
        "SETUPAPI.dll",
        "0K0d0",
        "%s: Failed to start the asynchronus search. hr = 0x%x",
        "%s: Failed to create a new IDownloadProgressChangedCallback. hr = 0x%x",
        "4!5/595S5w5",
        "jQSh8 ",
        "%s: Failed to set the session's client application ID. hr = 0x%x",
        "du.dll",
        "WVPhp}",
        "%s: COM is already initialized in apartment-threaded mode on thread ID 0x%x.",
        "<$<2<N<b<i<o<u<",
        "ResolveDelayLoadsFromDll",
        "&PWSV",
        "?1?:?",
        "GUID_DEVCLASS_SECURITYACCELERATOR",
        "RegisterTargetedSyncServiceFunctor",
        "080a0",
        "/ServiceEnvironment/WUClientData/CallerProfileDisabled",
        "%s: Beginning asynchronous search",
        "base\\ntsetup\\cdp\\du\\lib\\src\\dudevice.cpp",
        "DU::CDUUpdate::GetUpdateType",
        "ProductVersion",
        "=:=A=[=b=y=",
        "GUID_DEVCLASS_MONITOR",
        "GUID_DEVCLASS_FIRMWARE",
        ".rdata$sxdata",
        ".?AUIUnknown@@",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "RegQueryInfoKeyW",
        "GUID_DEVCLASS_SYSTEM",
        "0&020>0R0]0u0",
        "VPh86",
        "98:U:g:",
        "GUID_DEVCLASS_BLUETOOTH",
        "%s: Failed to get RevisionNumber property from update identity. hr = 0x%x",
        "ConvertStringSidToSidW",
        "6<6T6^6|6",
        "GetSystemTimeAsFileTime",
        "memset",
        "%s: Failed to get online service ID GUID from string %s. hr = 0x%x",
        "DU::CDUUpdateCollection::RemoveItem",
        "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate\\ComponentUpdate\\FeaturesOnDemand",
        "5c5z5",
        "GetTickCount",
        ":::?:W:^:d:j:u:",
        "ExtractUpdateFromCache3",
        ".CRT$XIZ",
        "??4ClientApplicationInfo@DU@@QAEAAU01@ABU01@@Z",
        "CoInitializeEx",
        "Datacenter",
        "152v2",
        "GUID_DEVCLASS_BIOMETRIC",
        "CompanyName",
        ",86RWMce4/9OiZIOWPWcP2jaIRxIc5d0DN25pxwB0tWc=0Z",
        ".L7Gq",
        ">,>7>W>",
        "IUpdateDownloader2 is not available; will proceed with download",
        "%s: Failed to append open parenthesis. hr = 0x%x",
        "HeapDestroy",
        "Minor",
        "CoUninitialize",
        "Custom volume is in use in IUpdateDownloader!",
        "uNPPV",
        "LocalFree",
        "SPBuild",
        "InputLanguages",
        "2!353C3W3e3q3",
        "1 1&1*1",
        "585L5S5Y5_5k5w5",
        "%s: Failed to get current WU driver applicability property to ignore installed drivers. hr = 0x%x",
        "%s: Failed to get generate well-formed GUID string from update ID string %s. hr = 0x%x",
        "InternalName",
        "%s: Update %d was not downloaded because of error hr = 0x%x.",
        "Microsoft Corporation1.0,",
        "WindowsGetStringRawBuffer",
        "VS_VERSION_INFO",
        "ProductName",
        ".didat$4",
        "%s: Failed to get string from volatile service ID GUID. hr = 0x%x",
        "%s: Failed to create a new Registry manager. hr = 0x%x",
        "1.1<1",
        "PShXl",
        "%s: Failed to set the values for the Client Application Info Version. hr = 0x%x",
        ">D>z>",
        "404U4q4z4",
        "250701214655Z0|1",
        "=*=;=B=I=U=f=z=",
        "%s: Failed to get update number %d from the collection. hr = 0x%x",
        "~qud}pc",
        "%s: Failed to end IUpgradeInternalSession. hr = 0x%x",
        "WindowsDeleteString",
        "OutputDebugStringW",
        "7*797S7Z7`7f7q7}7",
        "ConstructPartialMsgVW",
        "OLEAUT32.dll",
        "%s: Failed to copy update from the WU cache using IUpdate8. hr = 0x%x",
        "%s: Network has cost-related restrictions with best cost 0x%x; will not download.",
        "%s: Failed to initialize COM on thread ID 0x%x. hr = 0x%x",
        "RaiseFailFastException",
        "SPhTW",
        "_except_handler4_common",
        "<;<F<O<U<x<",
        "tqld}pc",
        "200304183038Z",
        "realloc",
        "O0M0K",
        "DU::CDUSession::CreateUpgradeInternalSession",
        "%s: Failed to get IUpdateInternalProperty interface from update. hr = 0x%x",
        ">%>,>2>8>C>O>c>",
        "607J7",
        ".text",
        "?!?&?/?4?=?B?K?P?Y?^?g?l?u?z?",
        "VWhXw",
        "shell\\cpls\\internationalsettings\\duplugin\\lib\\inputlanguagesduplugin.cpp",
        "Translation",
        "api-ms-win-core-winrt-string-l1-1-0.dll",
        "%s: Failed to remove update number %d from the IUpdateCollection. hr = 0x%x",
        "%s: Failed to set the Completed event",
        "Build",
        "%s: Failed to append volatile service ID string %s. hr = 0x%x",
        "%s: Failed to get move update %s from WU cache using IUpgradeInternalSession. hr = 0x%x",
        ".rdata$r$brc",
        "GUID_DEVCLASS_BATTERY",
        "%s: Ending asynchronous search",
        "FormatMessageW",
        "%s: Invalid Operation Result code (%d) after download.",
        "VPh`:",
        "DU::CRegistryManager::CreateVersionValues",
        "GetModuleHandleW",
        "}qvd}pc",
        "Language",
        "Using IUpgradeInternalSession",
        ".?AUIDownloadCompletedCallback@@",
        "SetupUpdate:",
        "??4Version@DU@@QAEAAU01@ABU01@@Z",
        "DU::CDUUpdateCollection::Initialize",
        "%Microsoft Windows Production PCA 20110",
        "joVh8 ",
        "xDU::CDUSession::WaitForUpdateEvent",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "GUID_DEVCLASS_NODRIVER",
        "Enable",
        "%s: Failed to clean up the search operation. hr = 0x%x",
        "GUID_DEVCLASS_AVC",
        "10.0.19041.572",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "%s: Failed to end the asynchronus search. hr = 0x%x",
        "%s: Failed to get the IUpdateDownloader2 object for network cost awareness. hr = 0x%x",
        "DU.dll",
        "%s: Failed to append driver type clause. hr = 0x%x",
        "Failed to destroy device info list; Error = %u.",
        "%s: Failed to get copy update %s from WU cache using IUpgradeInternalSession. hr = 0x%x",
        "%s: Failed to get the Operation Result Code of the search. hr = 0x%x",
        "??4ImageInfo@DU@@QAEAAU01@$$QAU01@@Z",
        ".?AVCServiceIdReset@?1??Search@CDUSession@DU@@QAEJHQAPBGHPBUImageInfo@3@KPBUSearchOptions@3@PAPAVCDUUpdateCollection@3@PAW4tagOperationResultCode@@@Z@",
        " http://www.microsoft.com/windows0",
        "%s: Failed to append closed parenthesis. hr = 0x%x",
        "DU::CDeviceIDIterator::Initialize",
        "?H?O?U?[?f?r?",
        "%s: Failed to create the Type registry key for Component updates. hr = 0x%x",
        "%s: Failed to build version override criterion value. hr = 0x%x",
        "%s: Failed to create the Type registry key for features on demand. hr = 0x%x",
        "jTWh8 ",
        "??4SearchOptions@DU@@QAEAAU01@ABU01@@Z",
        ".?AVCDownloadProgressChangedCallback@DU@@",
        "GUID_DEVCLASS_PRINTER",
        "%s: Failed to get current WU internal configuration property for targeted scans. hr = 0x%x",
        " Microsoft Corporation. All rights reserved.",
        ".?AVCDUUpdate@DU@@",
        "WShpC",
        "/ServiceEnvironment/WUClientData/ServiceName",
        "eDU::CDownloadProgressChangedCallback::Invoke",
        "%s: Failed to create the root device ID registry key. hr = 0x%x",
        "GetModuleFileNameA",
        "; ;4;N;^;",
        "VWhHb",
        ".?AUIDownloadProgressChangedCallback@@",
        "8*8;8_8",
        "ResolveDelayLoadedAPI",
        ".?AUIDUObject@DU@@",
        "SVWjl",
        "_vsnwprintf",
        "Server",
        "DU::CDUUpdateCollection::~CDUUpdateCollection",
        "!This program cannot be run in DOS mode.",
        "%s: Update %d was not downloaded because of network cost policy restriction.",
        "RegDeleteTreeW",
        ">%>*>3>8>A>F>O>T>]>b>k>p>y>~>",
        "Washington1",
        ".rsrc$01",
        "DU::CDUUpdate::UnpackContents",
        "%s: Failed to create a new IUpgradeInternalSession. hr = 0x%x",
        "5 5e6",
        ":$:+:2:>:I:]:s:",
        "?)?V?",
        "9!9D9u9",
        "1$1,141<1D1L1T1\\1d1l1t1|1",
        "CreateMutexExW",
        "DebugBreak",
        "%s: No valid update type found; invalid update",
        "GUID_DEVCLASS_APMSUPPORT",
        "GUID_DEVCLASS_VOLUME",
        "%s: Failed to remove the invalid update from the collection. hr = 0x%x",
        "%s: Beginning asynchronous download",
        "_unlock",
        ":4;H;Z;a;g;m;u;",
        "??4Version@DU@@QAEAAU01@$$QAU01@@Z",
        "%s: Failed to create the Image Info registry keys. hr = 0x%x",
        "x AND VersionOverride='",
        "ReleaseMutex",
        "Microsoft Corporation1200",
        "%s: Failed to allocate client application info version structure. hr = 0x%x",
        "??4DownloadOptions@DU@@QAEAAU01@ABU01@@Z",
        "?)?0?D?e?y?",
        "DU::CDUSession::BuildSearchCriteria",
        ".gfids",
        "8+8@8T8[8a8g8s8~8",
        "%s: Failed to put service ID %s for IUpdateSearcher. hr = 0x%x",
        "4 4'434?4d4}4",
        "DUStartup",
        "zv |y",
        "HeapAlloc",
        "WSh0O",
        ".rsrc$02",
        "=(=I=W=^=d=m=x=",
        "UnregisterTargetedSyncService",
        "RtlDllShutdownInProgress",
        "GetLastError",
        ".?AVCDUDownloadCompletedCallback@DU@@",
        "memcpy_s",
        "CloseHandle",
        "jsSh8 ",
        "QueryPerformanceCounter",
        "GetModuleHandleExW",
        "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0",
        "GUID_DEVCLASS_GPS",
        "(caller: %p) ",
        "GUID_DEVCLASS_1394",
        "ebfc1fc5-71a4-4f7b-9aca-3b9a503104a0",
        "GUID_DEVCLASS_NET",
        "%s: Failed to append version override criterion prefix. hr = 0x%x",
        "Enterprise",
        "%s: Failed to get Windows driver update interface from update; hr = 0x%x",
        "8@9G9e9l9J:",
        "030O0X0h0o0u0{0",
        "HardwareID:",
        "GUID_DEVCLASS_DISKDRIVE",
        "GUID_DEVCLASS_NETTRANS",
        ">\">'>B>",
        "6,=P\"",
        "6(6A6H6N6S6[6f6k6",
        "DelayLoadFailureHook",
        ".CRT$XCZ",
        "%s: Failed to get the update type from its description. hr = 0x%x",
        "WaitForMultipleObjects",
        "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate\\DriverUpdate\\DeviceIDs",
        "FileDescription",
        "FileVersion",
        ":7:Q:",
        "9 :<:`:|:",
        "ntdll.dll",
        "949;9A9G9h9o9u9{9",
        "696T6",
        "SOFTWARE\\Microsoft\\Windows\\Setup\\DynamicUpdate\\DriverUpdate",
        "_XcptFilter",
        "CharLowerW",
        "%s: Failed to build destination path for update number %d from the bundled updates collection. hr = 0x%x",
        "??4DownloadOptions@DU@@QAEAAU01@$$QAU01@@Z",
        "GUID_DEVCLASS_MTD",
        ".?AVCDUUpdateCollection@DU@@",
        ".rdata$zzzdbg",
        "8(9/959;9F9Q9e9u9",
        "6!606",
        "%s: Failed to get update description. hr = 0x%x",
        "Found default AU service at index %d",
        "%s: Failed to allocate the description CString",
        "CreateEventW",
        "_amsg_exit",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "20>0F0^0f0s0{0",
        "%s: Failed to begin IUpgradeInternalSession. hr = 0x%x",
        "%s: Failed to create event. GLE = 0x%x",
        "%s: Failed to set the value for the Image Info installation type. hr = 0x%x",
        "%hs(%d) tid(%x) %08X %ws",
        ".idata$6",
        "%s: Failed to get IUpdate8 interface from update. hr = 0x%x",
        "20201009052650Z0w0=",
        "%s: WaitForUpdateEvent failed",
        "=(=/=5=;=G=S=g=w=",
        "%s: Failed to set the value for the Image Info architecture. hr = 0x%x",
        "Unreleased DUUpdate interface during DUUpdateCollection release",
        "CompareStringW",
        "??0exception@@QAE@XZ",
        "%s: NULL category ID provided at index %d. hr = 0x%x",
        "9$9<9L9\\9d9",
        "wcschr",
        "OpenSemaphoreW",
        "%lu.%lu.%lu.%lu.%hu.%hu.%hu.%u"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "625ddb9f09b7a10609d14e7c08cd8bfc015d3d4992ccfb7021385ff89a2c21d5",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/625ddb9f09b7a10609d14e7c08cd8bfc015d3d4992ccfb7021385ff89a2c21d5",
              "guest_paths": [
                "overlay"
              ],
              "size": 8512,
              "crc32": "7C6D1F3A",
              "md5": "1735fdc5fb7ab6628ccdba63bc229561",
              "sha1": "5857b0a7f912ad6a9e99c7554af5e91e9d106f2a",
              "sha256": "625ddb9f09b7a10609d14e7c08cd8bfc015d3d4992ccfb7021385ff89a2c21d5",
              "sha512": "6d5ee195d42fdb82290fe4dc6972094a65d793c5a32ba6f606fc3025ea3c2b2d1dd7a6788a82694f4544590d34994448ef260c71df03fdc22e45a1e3f8ec502f",
              "rh_hash": null,
              "ssdeep": "96:/4DXBDbz9MekJ3AhNpVtEiJhwDD0pBDXiebs/Am2grWXGueDXcjwfV8bBDqh+oDF:TF2q8hDBQABJdc8bVT/gqnajKsLZhr",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T1ED0218D18F6C5407DA96798013E8F587BD3E53CF28208062159BF6A01D837C6DB49AAD",
              "sha3_384": "3fb8ebc30f6b89daf3753deb2fdccfd3bfa13c2354735eb0af7d1cfe5f49a08fdeb7c91bdf43251e449344ed2b177fff",
              "data": null
            }
          ],
          "extracted_files_time": 0.0004893439981970005,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "MAPPING1.MAP"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/f7aa1f9a250c5fad8d89cbc3960e779bf77a60661496181ea4c19be2e6964a4b",
      "guest_paths": [
        "C:\\Windows\\System32\\wbem\\repository\\MAPPING1.MAP"
      ],
      "size": 76744,
      "crc32": "604566A3",
      "md5": "caabeebed6b0088ad74f90df43bc5443",
      "sha1": "e4a72baaed7333157d9d9d7cb152d43d1af7eced",
      "sha256": "f7aa1f9a250c5fad8d89cbc3960e779bf77a60661496181ea4c19be2e6964a4b",
      "sha512": "d76d2ecd2e03dd00584710a82f6178dfc424eed12d5c5689737280a21f79a42d2c9bed8299643a8d7dcae0932b7803b14b070f140fde5462e9f8b53c76ec2611",
      "rh_hash": null,
      "ssdeep": "768:NNiZMmjPpSD15sErN+teBjGKXm56sp9Aj1hxsjXAGC/Own1iPtJVDC:8MoCxrnRGAm5HpuJzsEGUdCtJRC",
      "type": "data",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1A8736F39FDCC9A8ED1C94F33A4222764C8B8D40736088797372B57616A16B465FFF60A",
      "sha3_384": "56d33e91bfa7643ddc3c1f0a20c2005ac0240c6b2d8c2edb0c4d1419532fcec7c86b4001afd526d89520ac11f32789ea",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": null,
      "strings": [
        "zxg!F",
        "WG9LD",
        "09jvJ",
        "s;Vm>",
        "s`40.",
        "`WM-Q",
        "KOk9C"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 4344
    },
    {
      "name": [
        "diagerr.xml"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/6c06bf950d0fe3476e020cd363ec0c8c9d4ee0fc89a24c50780c44e6453995c6",
      "guest_paths": [
        "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
      ],
      "size": 1908,
      "crc32": "7CDC5D6D",
      "md5": "d1e75542ec8d1b4851765a57ac63618e",
      "sha1": "a231451f545d3133e5d6a0487a59c5dbd01ee50e",
      "sha256": "6c06bf950d0fe3476e020cd363ec0c8c9d4ee0fc89a24c50780c44e6453995c6",
      "sha512": "89d3c182833b97b0899ecd45de1439f8341bf2ea11578e2085375a4db3cc18fad221998dc4b6f4407381d2134cb43d78025349ded1e50b6a4eea5919b18b168c",
      "rh_hash": null,
      "ssdeep": "24:5I5aVbJDP+tUI0X3AN0/1Cvf/g3vvQ/1Cv8Gh/1Cvze/g3vO/1CvVL/1CvR/g3v9:5MwiGI0P4GsfT/7eLy",
      "type": "Unicode text, UTF-8 (with BOM) text",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1A0416229B1992EBB5C9446F8DFD038C26F8097794106A03391C4FDAFA239082F5B17CA",
      "sha3_384": "5cedf9502288ae47d70a36befbafa8692653e4067a2c5f662320a0bbfbef5698b6baab12b9b5c8e0b937cde482d4180c",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": "\\xfeff<xml xmlns:s=\"uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882\"\n xmlns:dt=\"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882\"\n xmlns:rs=\"urn:schemas-microsoft-com:rowset\"\n xmlns:z=\"#RowsetSchema\">\n<s:Schema id=\"RowsetSchema\">\n<s:ElementType name=\"row\" content=\"eltOnly\" rs:updatable=\"true\">\n<s:AttributeType name=\"Cls\" rs:number=\"0\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Sev\" rs:number=\"1\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Maj\" rs:number=\"2\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Min\" rs:number=\"3\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"LN\" rs:number=\"4\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Fil\" rs:number=\"5\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Fun\" rs:number=\"6\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Uid\" rs:number=\"7\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Msg\" rs:number=\"8\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"PID\" rs:number=\"9\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"TID\" rs:number=\"10\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Con\" rs:number=\"11\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Exe\" rs:number=\"12\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Mod\" rs:number=\"13\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Err\" rs:number=\"14\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"MD\" rs:number=\"15\">\n<s:datatype dt:type=\"hexBinary\"/>\n</s:AttributeType>\n<s:AttributeType name=\"DT\" rs:number=\"16\">\n<s:datatype dt:type=\"dateTime\"/>\n</s:AttributeType>\n</s:ElementType>\n</s:Schema>\n<rs:data>\n</rs:data>\n</xml>\n",
      "strings": [],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5932
    },
    {
      "name": [
        "wpx.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/08c8a6b2f76f9d9152e01ff3118990fdcdbb0d2e8c57dbfe43568367493187d4",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\wpx.dll"
      ],
      "size": 1082696,
      "crc32": "FFA501D6",
      "md5": "15e92d3769e6eefa80daac3085741bf6",
      "sha1": "e149b74683e37d6ff574788d233020e5dd097795",
      "sha256": "08c8a6b2f76f9d9152e01ff3118990fdcdbb0d2e8c57dbfe43568367493187d4",
      "sha512": "ce8eb54356739eb9e40c3f62026ca7371cb8e24a0cfb83897535d85b401829dccad56a027b76e824cf482c4d128fe1014c6b9416c44d16fa179a2fc2b6f5bbb9",
      "rh_hash": null,
      "ssdeep": "12288:bO3QPsPj6z55ORVLWvluEJm+po+UyFwhDfRRBp4YZgeXc:b7PsPj6z55ORVLWvwao+UWwBRRBQeXc",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1CF35B71327F80828F2732A30B77A3510D9EA75520A72C58EB56CE18E1F736C74A77766",
      "sha3_384": "059cdab150c72201d107d2d15eee25937d9e63d73accb37adc7866576fe050f3a516d6a6eaa2de51b8cd0adfd0332918",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x000ae000",
        "ep_bytes": "8bff558bec837d0c017505e8d5040000",
        "peid_signatures": null,
        "reported_checksum": "0x0011046a",
        "actual_checksum": "0x0011046a",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "wpx.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x100c5164",
                "name": "_vsnprintf_s"
              },
              {
                "address": "0x100c5168",
                "name": "tolower"
              },
              {
                "address": "0x100c516c",
                "name": "wcsspn"
              },
              {
                "address": "0x100c5170",
                "name": "wcscspn"
              },
              {
                "address": "0x100c5174",
                "name": "iswdigit"
              },
              {
                "address": "0x100c5178",
                "name": "free"
              },
              {
                "address": "0x100c517c",
                "name": "_wtoi"
              },
              {
                "address": "0x100c5180",
                "name": "??0exception@@QAE@ABQBD@Z"
              },
              {
                "address": "0x100c5184",
                "name": "_aligned_free"
              },
              {
                "address": "0x100c5188",
                "name": "_aligned_malloc"
              },
              {
                "address": "0x100c518c",
                "name": "wcsnlen"
              },
              {
                "address": "0x100c5190",
                "name": "wcscat_s"
              },
              {
                "address": "0x100c5194",
                "name": "wcsncpy_s"
              },
              {
                "address": "0x100c5198",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x100c519c",
                "name": "towupper"
              },
              {
                "address": "0x100c51a0",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x100c51a4",
                "name": "wcspbrk"
              },
              {
                "address": "0x100c51a8",
                "name": "wprintf"
              },
              {
                "address": "0x100c51ac",
                "name": "_wtoi64"
              },
              {
                "address": "0x100c51b0",
                "name": "_wcsicmp"
              },
              {
                "address": "0x100c51b4",
                "name": "vswprintf_s"
              },
              {
                "address": "0x100c51b8",
                "name": "wcsstr"
              },
              {
                "address": "0x100c51bc",
                "name": "wcschr"
              },
              {
                "address": "0x100c51c0",
                "name": "wcsrchr"
              },
              {
                "address": "0x100c51c4",
                "name": "memcpy_s"
              },
              {
                "address": "0x100c51c8",
                "name": "iswspace"
              },
              {
                "address": "0x100c51cc",
                "name": "_vsnwprintf_s"
              },
              {
                "address": "0x100c51d0",
                "name": "_vscwprintf"
              },
              {
                "address": "0x100c51d4",
                "name": "wcscpy_s"
              },
              {
                "address": "0x100c51d8",
                "name": "_purecall"
              },
              {
                "address": "0x100c51dc",
                "name": "calloc"
              },
              {
                "address": "0x100c51e0",
                "name": "memmove_s"
              },
              {
                "address": "0x100c51e4",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x100c51e8",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x100c51ec",
                "name": "memmove"
              },
              {
                "address": "0x100c51f0",
                "name": "_onexit"
              },
              {
                "address": "0x100c51f4",
                "name": "__dllonexit"
              },
              {
                "address": "0x100c51f8",
                "name": "_unlock"
              },
              {
                "address": "0x100c51fc",
                "name": "_lock"
              },
              {
                "address": "0x100c5200",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x100c5204",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x100c5208",
                "name": "_initterm"
              },
              {
                "address": "0x100c520c",
                "name": "_amsg_exit"
              },
              {
                "address": "0x100c5210",
                "name": "_XcptFilter"
              },
              {
                "address": "0x100c5214",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x100c5218",
                "name": "_callnewh"
              },
              {
                "address": "0x100c521c",
                "name": "?what@exception@@UBEPBDXZ"
              },
              {
                "address": "0x100c5220",
                "name": "??1exception@@UAE@XZ"
              },
              {
                "address": "0x100c5224",
                "name": "??0exception@@QAE@ABV0@@Z"
              },
              {
                "address": "0x100c5228",
                "name": "??0exception@@QAE@XZ"
              },
              {
                "address": "0x100c522c",
                "name": "malloc"
              },
              {
                "address": "0x100c5230",
                "name": "memcpy"
              },
              {
                "address": "0x100c5234",
                "name": "memcmp"
              },
              {
                "address": "0x100c5238",
                "name": "_ftol2"
              },
              {
                "address": "0x100c523c",
                "name": "__RTDynamicCast"
              },
              {
                "address": "0x100c5240",
                "name": "memset"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x100c5008",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x100c500c",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x100c5010",
                "name": "TerminateProcess"
              },
              {
                "address": "0x100c5014",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x100c5018",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x100c501c",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x100c5020",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x100c5024",
                "name": "Sleep"
              },
              {
                "address": "0x100c5028",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x100c502c",
                "name": "InitializeCriticalSectionAndSpinCount"
              },
              {
                "address": "0x100c5030",
                "name": "TlsAlloc"
              },
              {
                "address": "0x100c5034",
                "name": "TlsGetValue"
              },
              {
                "address": "0x100c5038",
                "name": "TlsFree"
              },
              {
                "address": "0x100c503c",
                "name": "TlsSetValue"
              },
              {
                "address": "0x100c5040",
                "name": "GetFinalPathNameByHandleW"
              },
              {
                "address": "0x100c5044",
                "name": "ReadFile"
              },
              {
                "address": "0x100c5048",
                "name": "GetFileSizeEx"
              },
              {
                "address": "0x100c504c",
                "name": "GetTickCount"
              },
              {
                "address": "0x100c5050",
                "name": "SleepConditionVariableSRW"
              },
              {
                "address": "0x100c5054",
                "name": "WakeAllConditionVariable"
              },
              {
                "address": "0x100c5058",
                "name": "AcquireSRWLockExclusive"
              },
              {
                "address": "0x100c505c",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x100c5060",
                "name": "HeapFree"
              },
              {
                "address": "0x100c5064",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x100c5068",
                "name": "HeapAlloc"
              },
              {
                "address": "0x100c506c",
                "name": "SizeofResource"
              },
              {
                "address": "0x100c5070",
                "name": "LockResource"
              },
              {
                "address": "0x100c5074",
                "name": "LoadResource"
              },
              {
                "address": "0x100c5078",
                "name": "FindResourceExW"
              },
              {
                "address": "0x100c507c",
                "name": "GetTempPathW"
              },
              {
                "address": "0x100c5080",
                "name": "GetLastError"
              },
              {
                "address": "0x100c5084",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x100c5088",
                "name": "GetTempFileNameW"
              },
              {
                "address": "0x100c508c",
                "name": "CreateFileW"
              },
              {
                "address": "0x100c5090",
                "name": "FindResourceW"
              },
              {
                "address": "0x100c5094",
                "name": "MultiByteToWideChar"
              },
              {
                "address": "0x100c5098",
                "name": "FreeResource"
              },
              {
                "address": "0x100c509c",
                "name": "GetWindowsDirectoryW"
              },
              {
                "address": "0x100c50a0",
                "name": "LocalFree"
              },
              {
                "address": "0x100c50a4",
                "name": "OutputDebugStringW"
              },
              {
                "address": "0x100c50a8",
                "name": "FormatMessageW"
              },
              {
                "address": "0x100c50ac",
                "name": "IsDebuggerPresent"
              },
              {
                "address": "0x100c50b0",
                "name": "DeleteFileW"
              },
              {
                "address": "0x100c50b4",
                "name": "MoveFileExW"
              },
              {
                "address": "0x100c50b8",
                "name": "GetModuleFileNameA"
              },
              {
                "address": "0x100c50bc",
                "name": "CreateSemaphoreExW"
              },
              {
                "address": "0x100c50c0",
                "name": "SetLastError"
              },
              {
                "address": "0x100c50c4",
                "name": "ReleaseSemaphore"
              },
              {
                "address": "0x100c50c8",
                "name": "GetModuleHandleExW"
              },
              {
                "address": "0x100c50cc",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x100c50d0",
                "name": "ReleaseMutex"
              },
              {
                "address": "0x100c50d4",
                "name": "WaitForSingleObjectEx"
              },
              {
                "address": "0x100c50d8",
                "name": "OpenSemaphoreW"
              },
              {
                "address": "0x100c50dc",
                "name": "CloseHandle"
              },
              {
                "address": "0x100c50e0",
                "name": "GetProcAddress"
              },
              {
                "address": "0x100c50e4",
                "name": "CreateMutexExW"
              },
              {
                "address": "0x100c50e8",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x100c50ec",
                "name": "DebugBreak"
              },
              {
                "address": "0x100c50f0",
                "name": "IsWow64Process"
              },
              {
                "address": "0x100c50f4",
                "name": "HeapSize"
              },
              {
                "address": "0x100c50f8",
                "name": "HeapReAlloc"
              },
              {
                "address": "0x100c50fc",
                "name": "HeapDestroy"
              },
              {
                "address": "0x100c5100",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x100c5104",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x100c5108",
                "name": "RaiseException"
              },
              {
                "address": "0x100c510c",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x100c5110",
                "name": "LeaveCriticalSection"
              }
            ]
          },
          "OLE32": {
            "dll": "OLE32.dll",
            "imports": [
              {
                "address": "0x100c5118",
                "name": "CoCreateInstance"
              }
            ]
          },
          "SHLWAPI": {
            "dll": "SHLWAPI.dll",
            "imports": [
              {
                "address": "0x100c5134",
                "name": "PathFileExistsW"
              },
              {
                "address": "0x100c5138",
                "name": "StrToIntW"
              },
              {
                "address": "0x100c513c",
                "name": "StrCmpW"
              }
            ]
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x100c5120",
                "name": "SysFreeString"
              },
              {
                "address": "0x100c5124",
                "name": "SysAllocString"
              }
            ]
          },
          "RPCRT4": {
            "dll": "RPCRT4.dll",
            "imports": [
              {
                "address": "0x100c512c",
                "name": "UuidFromStringW"
              }
            ]
          },
          "WIMGAPI": {
            "dll": "WIMGAPI.DLL",
            "imports": [
              {
                "address": "0x100c5144",
                "name": "WIMCreateFile"
              },
              {
                "address": "0x100c5148",
                "name": "WIMGetImageInformation"
              },
              {
                "address": "0x100c514c",
                "name": "WIMGetImageCount"
              },
              {
                "address": "0x100c5150",
                "name": "WIMSetTemporaryPath"
              },
              {
                "address": "0x100c5154",
                "name": "WIMExtractImagePath"
              },
              {
                "address": "0x100c5158",
                "name": "WIMCloseHandle"
              },
              {
                "address": "0x100c515c",
                "name": "WIMLoadImage"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x100c5000",
                "name": "IsValidSecurityDescriptor"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x100c5248",
                "name": "RtlInitializeSRWLock"
              },
              {
                "address": "0x100c524c",
                "name": "RtlReleaseSRWLockExclusive"
              },
              {
                "address": "0x100c5250",
                "name": "RtlAcquireSRWLockExclusive"
              },
              {
                "address": "0x100c5254",
                "name": "RtlNumberOfSetBits"
              },
              {
                "address": "0x100c5258",
                "name": "RtlRunOnceBeginInitialize"
              },
              {
                "address": "0x100c525c",
                "name": "RtlRunOnceComplete"
              },
              {
                "address": "0x100c5260",
                "name": "RtlUpcaseUnicodeChar"
              },
              {
                "address": "0x100c5264",
                "name": "RtlNtStatusToDosError"
              },
              {
                "address": "0x100c5268",
                "name": "RtlFindNextForwardRunClear"
              }
            ]
          }
        },
        "exported_dll_name": "wpx.dll",
        "exports": [
          {
            "address": "0x1003beb0",
            "name": "WpxCreateConfig",
            "ordinal": 1
          },
          {
            "address": "0x100759f0",
            "name": "WpxCreateWriteOpt",
            "ordinal": 2
          },
          {
            "address": "0x10075d50",
            "name": "WpxGetAnswerFileType",
            "ordinal": 3
          },
          {
            "address": "0x1005a010",
            "name": "WpxGetDeplSettings",
            "ordinal": 4
          },
          {
            "address": "0x1005a200",
            "name": "WpxResetDeplSettings",
            "ordinal": 5
          },
          {
            "address": "0x1005a110",
            "name": "WpxSetDeplSettings",
            "ordinal": 6
          },
          {
            "address": "0x1003fa20",
            "name": "WpxSetLogger",
            "ordinal": 7
          },
          {
            "address": "0x10040120",
            "name": "WpxSetScratchDirectory",
            "ordinal": 8
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x000bd9b0",
            "size": "0x00000116"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x000c5274",
            "size": "0x000000c8"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x000c7000",
            "size": "0x00034018"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x00106400",
            "size": "0x00002148"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x000fc000",
            "size": "0x0000dab4"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x0003b3d0",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x00003c24",
            "size": "0x00000018"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x00003b78",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x000c5000",
            "size": "0x00000270"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x000bcac6",
            "size_of_data": "0x000bcc00",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.04"
          },
          {
            "name": "PAGE",
            "raw_address": "0x000bd000",
            "virtual_address": "0x000be000",
            "virtual_size": "0x00001d9a",
            "size_of_data": "0x00001e00",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.51"
          },
          {
            "name": ".data",
            "raw_address": "0x000bee00",
            "virtual_address": "0x000c0000",
            "virtual_size": "0x00004acc",
            "size_of_data": "0x00004600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "4.88"
          },
          {
            "name": ".idata",
            "raw_address": "0x000c3400",
            "virtual_address": "0x000c5000",
            "virtual_size": "0x00001014",
            "size_of_data": "0x00001200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.22"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x000c4600",
            "virtual_address": "0x000c7000",
            "virtual_size": "0x00034018",
            "size_of_data": "0x00034200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "4.97"
          },
          {
            "name": ".reloc",
            "raw_address": "0x000f8800",
            "virtual_address": "0x000fc000",
            "virtual_size": "0x0000dab4",
            "size_of_data": "0x0000dc00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.76"
          }
        ],
        "overlay": {
          "offset": "0x00106400",
          "size": "0x00002148"
        },
        "resources": [
          {
            "name": "WPX_FOOTPRINT_RESOURCE_TYPE",
            "offset": "0x000f8f78",
            "size": "0x000020a0",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.74"
          },
          {
            "name": "WPX_FOOTPRINT_RESOURCE_TYPE",
            "offset": "0x000c7500",
            "size": "0x00031a77",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.94"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x000c7170",
            "size": "0x00000390",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.52"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows Provisioning XML"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "wpx.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "WPX.DLL"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "6253fe7ff964d5fc9de199ff35ef3911",
        "timestamp": "2018-01-17 20:41:55",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 9
      },
      "data": null,
      "strings": [
        ".?AVDeplUnattendExporter@@",
        "*[local-name()='%s' and @%s='%llu']",
        "    Failed to export synchrous command %u",
        "    <Setting>FontSize</Setting>",
        "e    Failed to get top-level setting info for %s",
        "WpxXmlNode::HasAttribute",
        "}hCM28j",
        "SmiStore::GetSparseNodeChildren::ChildNameEnum::CheckExistsInStore",
        "p:Constraints",
        "  <Setting Path=\"/InternetExplorer/FavoriteBarItems\">",
        "    Failed to add list index node to document",
        "    Couldn't export post-audit generalize option",
        "Extend",
        "eUILanguage",
        "WpxConfig::GetPhaseCondition",
        "yHSh=",
        "    Couldn't iterate over child paths of %s",
        "    <Setting>MuteTimeout</Setting>",
        "RtlNtStatusToDosError",
        "@pattern",
        "    <Setting>FolderLocations</Setting>",
        "4 4,4L4T4\\4h4",
        "  <Setting Path=\"/Sensors/AdaptiveBrightness\">",
        "2.2<2Z2h2",
        "y#Vhk",
        "@language",
        "9s`v5",
        ".?AV?$CAutoRelease@PAUIWpxConditionEnum@@@RAII@@",
        "    <ManifestFile>mobilecore_internal_Audio-AudioCore.man</ManifestFile>",
        "4%4*4/4=4",
        "7D7L7p7",
        "[%hs]",
        "060?0Q0s0",
        "4,474J4O4T4k4u4",
        "WpxSetting::IsVisible",
        "4^4x4",
        "wcm:keyValue",
        "    <ManifestFile>systemos_internal_LegacyClientCore-Audio-AudioCore.man</ManifestFile>",
        "    <Setting>MaintainServerList</Setting>",
        "    Couldn't export drivers",
        "WpxUnattendWriter::WritePassSettings",
        "    Failed to write action attribute to item node",
        "  <Setting Path=\"/Embedded/KeyboardFilter/BrowswerForward\">",
        ">$>0>",
        ".?AUIWpxImage@@",
        "    <Setting>ShowCompatibilityViewButton</Setting>",
        "    <ManifestFile>Networking-MPSSVC-Svc-MobileCore.man</ManifestFile>",
        "    Couldn't write find criterion",
        ">8?k?",
        "    Invalid option for WillReboot: %s",
        "  <Setting Path=\"/MediaCenter/UsePeakModeVideoEncoderSettings\">",
        "    <Setting>ExternalAdapter</Setting>",
        "    Failed to get text answer for %s",
        "    Failed to read variant-specific settings",
        "        >Microsoft-Windows-Security-Licensing-SLC-UX</Component>",
        ".?AVWpxPackage@@",
        "    Couldn't write display color depth",
        "wpaf:InstallWindows",
        "515?5D5`5n5s5",
        "?'?R?u?",
        ".idata$5",
        "        <Setting Path=\"/InternetExplorer/Item/Favorite/URL\" />",
        "080l0",
        "wpaf:WimImage/wpaf:ImageIndex",
        "    Failed to allocate szRegValue.get()",
        ".?AV?$CAutoRelease@PAUIWpxTargetStateEnum@@@RAII@@",
        "3\"3.3E3T3r3",
        "    Failed to iterate over search directories",
        "    Couldn't iterate over features",
        "= =9=B=T=z=",
        "    <Setting>OverlayWarningThreshold</Setting>",
        "u:package",
        ".?AVEnum@?1??EnumTargets@WpxConfig@@UAEJPAPAUIWpxTargetEnum@@@Z@",
        "?&?8?W?j?t?",
        "FinishOfflinePhase",
        ";3;J;O;T;`;",
        "    Couldn't filter settings for pass %u",
        "        <Setting Path=\"/Connections/Item/Policy/ClientType\" />",
        "040904B0",
        "Microsoft Time-Stamp Service0",
        ":t:y:~:",
        "    Failed to iterate over allowed map keys",
        "<7=]=s=",
        "    </Store>",
        "2G3W3",
        "yOWh(",
        ".data$r$brc",
        "VSj{Z",
        "Redmond1",
        "1;1R1e1",
        "    Couldn't iterate over <package> elements",
        "  <Setting Path=\"/Firewall/PrivateProfile_LogSuccessfulConnections\">",
        "Letter",
        "9(9B9a9",
        ":':/:]:r:|:",
        "5 5)5.5A5R5W5\\5w5",
        "    Couldn't get child setting %s of %s",
        "WpxSetting::RemoveListItem",
        "=F=s=",
        "9#989J9e9",
        "    Failed to iterate over allowed integer values",
        "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8",
        "9-92979E9^9~9",
        "?)?.?3?A?N?S?X?f?",
        "restriction\\enumeration",
        "4/4@4X4\\4`4d4h4l4p4t4~4",
        "    Couldn't export prevent-pending-actions flag",
        "1$1H1[1",
        "7 7p7",
        "= =%=:=d=",
        "    %s: Can't coerce %s as a bool string",
        "=*=D=I=N=^=v=",
        ".?AUIWpxWriteOpt@@",
        "<0<L<h<",
        "    Failed to get visibility info",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsB\">",
        "    Couldn't get answer file root node name",
        "    Failed to write variant-specific settings",
        "    Failed to check if left schema enumerates allowed values",
        "    Failed to allocate data",
        "4M4=5",
        "=$=B=P=n=|=",
        "    Couldn't create value of %s with key %s",
        "    Incomplete package path given",
        "1?1D1I1X1s1x1}1",
        "<'<<<_<d<i<",
        "1)1.131?1Q1s1x1}1",
        "  <Setting Path=\"/InternetExplorer/FilterLevel\">",
        "3&3B3x3}3",
        "t    Root node type must be an element",
        "y0Vhf",
        "TargetRef",
        "StringFileInfo",
        "<K<[<m<",
        ";&;0;H;f;",
        "N0L0J",
        "Mobile",
        "y3Why",
        "    Couldn't get integer answer",
        "<#<@<S<c<",
        "GetVisbilityInfoForAllowedValues",
        "y0Wh,",
        "v100.5_master_2019-09-30T14:28:46-07:00_bc35cd8_2019-09-30T15:00:52",
        "<(<D<X<c<{<",
        "    <Setting>IcmpRedirectsEnabled</Setting>",
        "AhSVW",
        "5!5&5{5",
        "  <Setting Path=\"/OutOfBoxExperience/WaitForAppRegistrationBeforeFirstLogon\">",
        ".?AUIWpxTarget@@",
        "    Failed to get child nodes",
        ":/:;:M:k:w:",
        "<><Z<c<u<",
        "ExFAT",
        "WpxTargetState::EnumConditions",
        "servicing",
        "    <Setting>ControlTab</Setting>",
        "Microsoft-Windows-Deployment",
        "    Couldn't parse '%s' as an integer",
        "  <Setting Path=\"/Computer/Name\">",
        "2%2=2c2",
        "768Q8",
        "    Failed to allocate *Extensions",
        "    Unable to load SMI schema hive",
        "WpxSetting::GetVisibility",
        "tQjaXjzYf;",
        "WpxWpafWriter::StripTempListIndices",
        "    Created, but could not retrieve map value %s",
        "?(?L?T?\\?d?l?t?|?",
        "DeplUnattendImporter::Clean",
        "    <Setting>BrowserRefresh</Setting>",
        "  <Setting Path=\"/Embedded/KeyboardFilter/VolumeUp\">",
        "5 5(5@5D5\\5`5x5",
        ".?AVEnum@?1??EnumTargetStates@WpxTarget@@UAEJPAPAUIWpxTargetStateEnum@@@Z@",
        ".?AV?$CAutoCleanupBase@PAD@RAII@@",
        "<Y<^<c<o<",
        "KnobsStore::GetSchemaNode",
        "=&=S=s=x=}=",
        "=L9o<",
        "070j0",
        "333\\3a3f3r3",
        "    Failed to create new implicit target '%s'",
        "u:InputLocale",
        "=2=J=O=T=`=z=",
        "333J3V3[3`3",
        "    Can't get SMI node for this map's key",
        "CreatePartition",
        "2(2,202D2T2X2\\2t2x2",
        "    Couldn't find %s under component %s",
        "    Couldn't write package action",
        "        <Setting Path=\"/Messaging/PerSimSettings/__ICCID/ErrorCodeEnabled\" />",
        "091u1z1",
        "    <Setting>EnableLUA</Setting>",
        "onecore\\base\\ntsetup\\wpx\\core\\path.cpp",
        "    Couldn't export ignore-check flag",
        "=&=;=U=p=",
        "specialize",
        "WpxUnattendWriter::GetComponentNode",
        "WpxSetScratchDirectory",
        "4(4,4<4@4P4T4d4h4x4|4",
        "    Failed to allocate value",
        "    Failed to allocate prop",
        "%s .%s",
        "    <Setting>Link2Text</Setting>",
        "0(030K0`0x0",
        ">,>8>X>d>",
        "Thales TSS ESN:F87A-E374-D7B91%0#",
        "HZo6m|",
        "    <Setting>InternalIsBridge</Setting>",
        "InstallWindows",
        "?C?X?^?l?r?",
        "memmove",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsShiftRight\">",
        "@source",
        "WpxSetting::ClearAssetTargetPath",
        "    Error getting hive key at %s",
        "WpxSmiSetting::FindTypeDecl",
        "%s '%lld'",
        "  <Setting Path=\"/InternetExplorer/SearchScopes\">",
        "    Failed to get common settings tree",
        "    <Setting>Windows</Setting>",
        "74797>7J7",
        "    Failed to get pass from pass condition",
        "    Failed to allocate disk",
        "    Couldn't get child node names from unattend map",
        "%s %s %s",
        "8'8,8;8]8o8",
        ";V<z<",
        "        <Setting Path=\"/Connections/Item/Connection/AlwaysOn\" />",
        "wpaf:Preserve",
        "?0?8?D?d?p?",
        "?0?c?h?m?y?",
        "    <Setting>Scan</Setting>",
        "  <Setting Path=\"/NetworkProxy/HKLMProxyServer\">",
        "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5",
        "<@<|<",
        "    Couldn't enumerate map value paths",
        "InstallToAvailablePartition",
        "    Couldn't get text value from IWpxSchemaAllowedValue",
        "    Failed to check if left schema has a default value",
        "%s: %lld",
        "3-3X3e3}3",
        "m    Couldn't count number of items below %s",
        "9-9A9O9e9{9",
        "=9=>=C=O=i=",
        "=\"='=F=T=Y=x=",
        "/WpxUnattend/Setting",
        "    Couldn't write bool setting %s",
        "  <Setting Path=\"/Embedded/UnifiedWriteFilter/DisableAutoDefrag\">",
        "=<=A=F=R=i=t=",
        "wpaf:Payload",
        "y3Vh'",
        "memmove_s",
        ";$;(;@;D;\\;`;x;|;",
        "`.data",
        "    Conditions: Argument cannot be NULL",
        "    <Setting>AppUserModelId</Setting>",
        "4'4c4h4m4y4",
        "    Couldn't count list items under %s",
        "969;9@9N9c9w9",
        "    Couldn't export assembly name",
        "wpaf:Common",
        "/u:unattend/u:settings[@pass='oobeSystem']/u:component[@name='Microsoft-Windows-Deployment']/u:Reseal",
        "    <Setting>CopyProfile</Setting>",
        "    <ManifestFile>moderncore_internal_Audio-AudioCore.man</ManifestFile>",
        "wpaf:Display/wpaf:Resolution/wpaf:Width",
        "DeplUnattendImporter::ImportInstallImage",
        "    <Setting>TapiUnattendLocation</Setting>",
        "%s: %s and %s cannot both appear under the same %s node",
        "    <ManifestFile>Microsoft-Windows-RecoveryAgent.man</ManifestFile>",
        "e    Couldn't find declaration source node",
        "DeplUnattendImporter::ImportOnlineDepl",
        "  <Setting Path=\"/Firewall/DomainProfile/DisableNotifications\">",
        ".?AV?$CAutoHeapFree@PBG@RAII@@",
        ">!>3>O>\\>",
        "858:8?8N8c8",
        ":<:g:",
        "DeplUnattendExporter::ExportInstall",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-International-Core-WinPE']/u:UILanguage",
        "ActivateWhenSupported",
        "Check",
        "    Failed to allocate node",
        "WpxWpafWriter::Write",
        "6.7O7n7",
        ":*:5:M:b:w:|:",
        "y@WjEh",
        "  <Setting Path=\"/Embedded/KeyboardFilter/AltTab\">",
        "    Failed to serialize package state %u",
        "        >Microsoft-Windows-WwanUI</Component>",
        "848<8D8L8T8`8",
        "2!353_3",
        "    Couldn't export package permanence",
        "210303183039Z0p1",
        "5*585V5u5",
        "    <ManifestFile>shwebsvc.man</ManifestFile>",
        "    Couldn't iterate over allowed values",
        "/wpaf:Settings/wpaf:Customizations/wpaf:Variant",
        "C ;G u",
        "0'0M0R0W0i0",
        "787@7H7P7X7`7l7",
        "u:UpgradeData",
        "    Couldn't write initial customization blob path",
        "Width",
        "SmiStore::Release",
        "7&7B7R7]7|7",
        "8$8)878I8N8S8a8n8s8x8",
        "6*7M7p7",
        "        <Setting Path=\"/Shell/Start/PrepinnedTiles\" />",
        "    Failed to query subkey %u of SMI hive root key",
        "y-Sh/",
        "    Failed to extract file extension from %s",
        "wpaf:ModifiedPartitions/wpaf:Partition",
        "8+8F8]8",
        "    Couldn't get answer for %s",
        "DeplWpafExporter::ExportEvents",
        "<E=}=]>",
        "494l4",
        ".?AV?$CAutoRelease@PAVFilter@?1??FilterExcludedChildren@SmiStore@@AAEJABVWpxPath@@PAUIWpxStringEnum@@PAPAU5@@Z@@RAII@@",
        ".?AV?$CAutoCleanupBase@PAUIWpxDeplImporter@@@RAII@@",
        "6\"6,6Q6e6{6",
        "4)5T5",
        "        <Setting Path=\"/Connections/Item/Connection/SimIccId\" />",
        "    <Setting>Color</Setting>",
        "9 969J9h9~9",
        "        <Setting Path=\"/HelpAndSupport/HelpAndSupport/Logo\" />",
        "9regfu`",
        "        <Setting Path=\"/Messaging/PerSimSettings/__ICCID/UAProfToken\" />",
        "InternalName",
        "    Couldn't validate whether %s is in the allowed values enum",
        "%s is not a valid file path",
        "8#9(9-9<9T9i9n9s9",
        ".?AVWpxConfig@@",
        "DeplUnattendExporter::ExportDriver",
        "    Feature selection missing required @name attribute",
        ":(:,:D:H:`:d:|:",
        "6 6,6L6T6`6",
        "RtlNumberOfSetBits",
        "  <Setting Path=\"/Embedded/Logon/AnimationDisabled\">",
        "SharedLocalDataFile",
        "    arch: Argument cannot be NULL",
        "SettingNode::GetDefaultInt",
        ">;>@>E>Q>j>",
        ";8;`;",
        "  <Setting Path=\"/Embedded/Logon/BrandingNeutral\">",
        "<+<G<L<Q<l<w<",
        "    Failed to load excluded URIs from footprint file",
        "    <Setting>LicensingMode</Setting>",
        ">!?>?V?n?",
        "WindowsPE",
        "    Answer enumerator failed",
        "5;5Z5c5w5",
        "? ?3?E?]?z?",
        "Translation",
        ".?AUIWpxVisibilityStateDesc@@",
        "    Couldn't write firewall enabled setting",
        "0-02070F0V0x0}0",
        "  <Setting Path=\"/MediaCenter/BindNavHintsToToolbars\">",
        "    Filter callback returned a failing error code",
        "    Can't get parent schema node for %s",
        "U(9M ",
        "memcpy",
        "</<K<j<o<t<",
        "    <Setting>WindowsDown</Setting>",
        "    Couldn't parse boolean value %s for UpgradeData Upgrade",
        "  <Setting Path=\"/SNMP/EnableAuthenticationTraps\">",
        "3'4,414=4",
        "y4Wh<",
        "y3VhK",
        "        >Microsoft-Windows-AllUserInstallAgent</Component>",
        "    Couldn't check whether %s has a list item friendly name",
        "Parse error (0x%08x)",
        "g    Couldn't get answer for bool setting %s",
        "versionScope",
        ".?AV?$CAutoCleanupBase@PAVWpxUnattendMap@@@RAII@@",
        "    <Setting>EnabledScenarioExecutionLevel</Setting>",
        ".?AVTextEnum@?1??GetAnsEnumValues@SmiSchemaNode@@UAEJPAPAUIWpxSchemaAllowedValueEnum@@@Z@",
        "e    Unknown processor architecture %u",
        " http://www.microsoft.com/windows0",
        "    <Setting>WindowsComma</Setting>",
        "  <Setting Path=\"/MediaCenter/FontSize\">",
        "  <Setting Path=\"/Fax/Fax\">",
        "    <Setting>ShowMenuBar</Setting>",
        "<3<I<c<u<",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-International-Core-WinPE']/u:LayeredDriver",
        "    Failed to allocate packaging",
        "    Failed to allocate session",
        "    Couldn't iterate over nodes",
        ":8:X:t:",
        "    Couldn't write partition volume label",
        "222B2f2k2p2|2",
        "DisableEncryptedDiskProvisioning",
        "    <ManifestFile>TerminalServices-LocalSessionManager.man</ManifestFile>",
        "    Couldn't add Targets node to document",
        "2,2J2v2{2",
        "        publicKeyToken=\"31bf3856ad364e35\"",
        "wpaf:SkipLicenseCheck",
        "203<3",
        "y0PhV",
        "1/2S2y2",
        "    Couldn't set namespace prefix on document",
        "8'8,818b8|8",
        "?8?c?}?",
        "y&Wh2",
        "    <ManifestFile>Terminalservices-LicenseServer.man</ManifestFile>",
        "    <Setting>WindowsPageDown</Setting>",
        "    <Setting>DisplayName</Setting>",
        "    Couldn't get the system scratch directory",
        "  <Setting Path=\"/Firewall/DomainProfile_LogSuccessfulConnections\">",
        "ProductKey",
        "8#999R9",
        "    Failed to allocate meta",
        "151D1U1Z1_1j1",
        "wpaf:SearchDirectories/wpaf:Directory",
        "4+4C4Y4f4q4",
        "WPh<]",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsI\">",
        "353X3]3b3m3",
        "    Couldn't find setting schema for %s",
        "6+666O6[6`6e6",
        "j XPhL",
        "        >Microsoft-Windows-MobileCore-Audio-AudioCore</Component>",
        "    Couldn't open schema store from %s image %u",
        "        >Microsoft-Windows-NetBT</Component>",
        "/wpaf:Settings/wpaf:WindowsPE",
        "GetModuleHandleExW",
        "    Failed to initialize WpxXmlNode",
        "PPh4j",
        "2;2O2|2",
        "ImageTimeOnly",
        "    Failed to iterate over <TargetRef> elements",
        "    Package source missing required location attribute",
        "82878<8H8U8`8x8",
        "    Must specify both a metadata XPath and a text value",
        "    Failed to write dependency %u",
        "y Wj@h",
        "DeplUnattendExporter::WriteValue",
        "    Failed to parse policy for package %s",
        ".?AV?$CAutoCleanupBase@PAVKnobsAllowedValue@@@RAII@@",
        "2$3)3.3E3O3g3y3~3",
        "    <ManifestFile>production\\coresystem_prod_Audio-AudioCore.man</ManifestFile>",
        "    Source for setting %s missing required @Path attribute",
        "    Failed to parse boolean value for ProvisionDisk node",
        "?$?>?V?`?e?x?",
        "    Couldn't set answer for %s",
        "WpxWpafWriter::WriteMetadata",
        "    <ManifestFile>Networking-MPSSVC-Svc.man</ManifestFile>",
        "Installed",
        "FinishOfflinePhase/Action",
        "wcschr",
        "OpenSemaphoreW",
        "797>7C7O7f7q7",
        "onecore\\base\\ntsetup\\wpx\\file\\wpafreader.cpp",
        "3<5e7",
        "y-VjCh",
        "    Failed to get integer value from IWpxAllowedValue",
        "    Couldn't export feature name",
        "u:ImageName",
        "    Failed to open schema hive key %s",
        "    Couldn't delete answers for item %llu of %s",
        "  <Setting Path=\"/SecureStartup/WriteSubrequestLength\">",
        "?O?]?{?",
        "restriction\\maxLength",
        "    <Setting>OEMName2</Setting>",
        "    <Setting>CEIPEnabled</Setting>",
        "y*VjOh<]",
        "    Failed to parse value %s for FinishAuditMode <Generalize> node",
        "  <Setting Path=\"/InternetExplorer/SmallCommandBarIcons\">",
        "RtlReleaseSRWLockExclusive",
        "  <Setting Path=\"/Shell/TimeZone\">",
        "6;6f6",
        ";9;O;_;m;",
        "DeplUnattendExporter::ExportDiskID",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:Restart",
        "    Couldn't write primary UI language",
        ":):=:U:v:",
        "    Couldn't record default answer",
        "    Failed to set answer for %s",
        "SmiStore::GetSparseNodeChildren",
        "    Failed to allocate itemNode",
        "0(080H0X0h0x0",
        "Minimum",
        "Windows Provisioning XML",
        "<D<x<",
        "WpxSetting::MakeAns",
        "yDWh:",
        "0#1p1",
        "wpaf:Eula",
        "yHShh",
        "7>7C7H7W7u7",
        "=\"=)=4=;=F=M=u=z=",
        "0 0(0,040<0@0H0P0X0p0t0",
        "6'6?6Z6",
        "091I1",
        "5:5R5w5",
        "/u:unattend/u:settings[@pass='auditUser']/u:component[@name='Microsoft-Windows-Deployment']",
        "1,1I1j1o1t1",
        "  <Setting Path=\"/NetworkProxy/HKLMContentPerUserItem\">",
        "WpxWpafWriter::WritePassSettings",
        ".?AUIWpxDeplInsSettings@@",
        ";~0sM",
        "  <Setting Path=\"/DNS/UseDomainNameDevolution\">",
        "WpxAnsTree::EnumChildPaths",
        "    Failed to scan policy XML for setting declarations",
        "    Couldn't write EULA action",
        "    Couldn't export package prevent-pending-actions flag",
        "1*1F1h1w1",
        "    Failed to prune non-existent path %s from the unattend map",
        "GetProcessHeap",
        "@name",
        "WpxStore::GetChildrenUnder::ChildEnum::GetNext",
        "    Failed to import <Feature> element",
        "    Failed to read multivariant targets",
        ".?AV?$CAutoRelease@PAVMcsfStore@@@RAII@@",
        ".?AVKnobsStore@@",
        "    Failed to allocate feature",
        "calloc",
        "    Couldn't write OOBE-phase reseal mode",
        "%s '%s'",
        "0!1K1P1U1a1u1",
        "7_8o8z8",
        "5$565A5T5l5x5}5",
        "    Couldn't import packaging operation",
        ":):4:?:R:d:w:}:",
        "Vj\\h0",
        "    Unknown find condition operator %s",
        "u:component[@name='%s']",
        "<string list>",
        "MaxItemCount",
        "<#<(<E<g<",
        "u:ComputerName",
        "1 1(181@1\\1d1l1t1|1",
        "    <Setting>SetRegionSpecificPrivacyAccessPolicy</Setting>",
        "    Couldn't read common settings",
        "    Failed to write computer name",
        "    Couldn't export error %u to validation report",
        "e    <Feature> element missing required @Name attribute",
        "    Failed to record default answer",
        "5/54595S5]5p5w5~5",
        "    Failed to retrieve converged store contents from WIM",
        "WpxConfig::GetVariantSetting",
        "WPX_FOOTPRINT_RESOURCE_TYPE",
        "<O<k<{<",
        "    <Setting>SlicedEncryptionMinSize</Setting>",
        "444P4U4Z4e4y4",
        "6/6G6S6X6]6}6",
        "ModifyPartitions",
        "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:ProductKey",
        "%s xmlns='%s'",
        "WpxSetting::GetAnsMaxLength",
        "<#<(<-<<<M<^<j<v<{<",
        "    Couldn't write WillReboot flag",
        "    <Setting>LmAnnounce</Setting>",
        "    TargetIDs: Argument cannot be NULL",
        "y_WhN",
        "  <Setting Path=\"/MediaCenter/UseLivingRoomComputerFormFactor\">",
        "WpxUnattendReader::ReadBoolValue",
        "    Failed to allocate enc",
        "\"Microsoft Window",
        "        <Setting Path=\"/Power/CustomPowerApplication2/IconID\" />",
        "9M;\\;o;u;",
        "    Failed to allocate path",
        "G;~(r",
        "GreaterThan",
        ";,;7;V;[;`;k;",
        "    Couldn't read image information",
        "MinMajorVersion",
        "WPX.DLL",
        ";$;,;8;X;`;h;p;|;",
        "b=f=l=p=v=z=",
        "    Couldn't write common settings tree",
        "    <Setting>ForceOffAccessibility</Setting>",
        "    <ManifestFile>Microsoft-Windows-IE-ESC.man</ManifestFile>",
        "    Couldn't set <component> @name attribute",
        "DeplWpafExporter::ExportEnvUser",
        "u:Password",
        "    Value %lld is below the inclusive minimum %lld",
        ":_:l:",
        "    Don't know how to present SMI type 0x%08x as a map key",
        "    Failed to enumerate children below %s",
        "    Failed to allocate image",
        "ADVAPI32.dll",
        ":%;=;V;|;",
        "KnobsStore::Initialize",
        "settings",
        "t(WjGh|7",
        "WpxUnattendReader::ReadComponent",
        "9&9A9n9s9x9",
        "    Couldn't get deployment settings WPAF importer",
        "    <ManifestFile>DiagCpl.man</ManifestFile>",
        "    Couldn't get common settings tree",
        "7*7K7W7b7w7",
        "    Missing .appx path (Path) / .appxbundle path (Bundle)",
        "WpxUnattendWriter::WriteCommonTree",
        "remove",
        "676c6",
        "    Couldn't get or create configuration's deployment settings",
        "  <Setting Path=\"/Embedded/KeyboardFilter/ControlTab\">",
        ".?AVKnobsVisibilityRule@@",
        "        <Setting Path=\"/Connections/Item/Policy/Item/Connection/ConnectionId\" />",
        "=3=D=]=b=g=s=",
        "525<5N5e5~5",
        "  <Setting Path=\"/Embedded/KeyboardFilter/DisableForAdministrators\">",
        ".?AV?$CAutoRelease@PAVWpxValidation@@@RAII@@",
        "?#?(?-?9?M?Y?e?j?o?",
        "WpxSetting::GetListItem",
        "    Failed to write condition parameter name",
        "    <Setting>IntranetCompatibilityMode</Setting>",
        ".?AV?$CAutoRelease@PAUIWpxDeplImporter@@@RAII@@",
        "    Invalid boolean value %s for DynamicUpdate Enable",
        "    <Setting>Gadget1</Setting>",
        "u:OptIn",
        "    Couldn't get root schema node",
        ".?AV?$CAutoCleanupBase@PAVWimStoreEnum@@@RAII@@",
        "  <Setting Path=\"/MediaCenter/RestartHour\">",
        "u:InstallFrom",
        "wpaf:DataMigration",
        "    <Setting>AutoLogon</Setting>",
        "    Couldn't check if map key has a maximum length",
        "?)?B?G?L?d?o?",
        ">8>=>B>N>d>",
        "y,Vj0h",
        "8,808H8L8d8h8",
        "    Couldn't find footprint resource %s",
        ">4>9>>>J>f>",
        "  <Setting Path=\"/Sidebar/Gadget5\">",
        "      <Pass>specialize</Pass>",
        "    <Setting>TBP</Setting>",
        ":I:Z:",
        "    Can't initialize disk using partition table type %u: unattend only supports 'auto'",
        "  <Setting Path=\"/Licensing/SkipRearm\">",
        ";v<|<",
        "7'7,717<7U7`7z7",
        "WpxSetting::GetDefaultBool",
        "%s xmlns:%s='%s'",
        "WIMCloseHandle",
        "PSQQj",
        "  <Setting Path=\"/Wireless/HideUIInOOBE\">",
        "    <Setting>HideAllBootUI</Setting>",
        "wpaf:Language/wpaf:InputLocale",
        "    <ManifestFile>Security-Licensing-SLC-UX.man</ManifestFile>",
        "      <Pass>auditUser</Pass>",
        ";6;;;@;O;l;",
        ".?AVEnum@?1??EnumTargets@WpxVariant@@UAEJPAPAUIWpxStringEnum@@@Z@",
        ";5;A;F;K;",
        "    Failed to parse %s as a setup pass",
        "  <Setting Path=\"/NetworkProxy/HKLMSendTimeOut\">",
        ":#;8;C;[;o;",
        "    Couldn't change item index below %s",
        "5/5O5n5s5x5",
        "QSVj0f",
        "<\"<'<2<?<J<b<|<",
        "InitializeCriticalSectionAndSpinCount",
        "    <Setting>OfflineUserAccounts</Setting>",
        "2.2E2Z2j2u2",
        "=6=J=O=T=`=z=",
        "1\"2]2",
        "  <Setting Path=\"/MediaCenter/PreventAutoConnect\">",
        "wpaf:WdsImage/wpaf:FileName",
        ".?AV?$CAutoCleanupBase@PAVWpxSimpleAllowedValue@@@RAII@@",
        "    <ManifestFile>embeddedeshell.man</ManifestFile>",
        ".idata$3",
        ":.:H:_:l:w:",
        "  <Setting Path=\"/Embedded/UnifiedWriteFilter/BootStatusPolicy\">",
        ".?AV?$CAutoLocalFree@PAG@RAII@@",
        "    WindowsDeploymentServices node missing required ImageSelection node",
        "DeplUnattendExporter::ExportFeature",
        "WpxSetting::GetMapKeyMinLength",
        "WpxWpafWriter::WriteTextSetting",
        "Value",
        "WpxSmiSetting::GetMaxOccurs",
        "  <Setting Path=\"/Sidebar/SidebarVisible\">",
        "  <Setting Path=\"/Embedded/Logon/NoLockScreen\">",
        "    Map settings %s has multiple value nodes",
        "9;9@9E9T9",
        "@passes",
        "    Failed to get item count for list setting %s",
        "        <Setting Path=\"/WeakCharger/HideWeakChargerNotifyOptionUI\" />",
        "    Couldn't write input layered driver",
        "    Not setting scratch dri to '%s' because the directory was not found",
        ">1>6>;>V>a>",
        "D$(Ph",
        ".?AV?$CAutoRelease@PAVMcsfLeafNode@@@RAII@@",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsSlash\">",
        "McsfLeafNode::ParseRegistryType",
        "    Failed to check whether schema has a fixed set of allowed file extensions",
        "<!=&=+=7=V=",
        "WpxWpafReader::ReadSettingValue",
        "McsfLeafNode::GetSource",
        "    Failed to remove WpxSetting %s from the answer tree",
        "  <Setting Path=\"/Wireless/RadioLocation\">",
        "DeplWpafExporter::ExportEnvLanguage",
        "\\Windows\\Provisioning\\Microsoft-Common-Provisioning.dat",
        "  <Setting Path=\"/MediaCenter/AllowToolbarPopups\">",
        "WpxWpafReader::ReadPhaseSettings",
        ";,<m<r<w<",
        "    Failed to add <Target> to the document tree",
        "  <Setting Path=\"/InternetExplorer/CompanyName\">",
        ":#;^;",
        "WpxPathTree::RemovePath",
        "    Couldn't iterate over nodes matching %s",
        "ShutDown",
        "Loaded unattend mapping",
        "??0exception@@QAE@ABQBD@Z",
        "=#=-=O=c=",
        "DeplUnattendExporter::Export",
        "444R4q4v4{4",
        "    Failed to check if left schema has a pattern",
        "7+7G7_7q7",
        "  <Setting Path=\"/Firewall/PublicProfile_LogDroppedPackets\">",
        "    Failed to record asset target path %s",
        ">,>4><>D>L>T>\\>h>",
        ";);H;];h;~;",
        "@xsd:maxOccurs",
        "    Couldn't extract SMI hive %s from WIM image to %s",
        "  <Setting Path=\"/SecureStartup/InPlaceCrypto\">",
        "        <Setting Path=\"/Shell/SystemTray/Location/LocationIcon\" />",
        "    Failed to query maxOccurs for %s",
        "1 101T1\\1d1l1t1|1",
        "6 6(606H6L6d6h6",
        "u:Username",
        "?,?0?D?H?`?d?h?|?",
        ".?AV?$CAutoRelease@PAVSmiSparseNode@@@RAII@@",
        "WpxSetting::MoveListItem",
        "WpxCondition::GetVariant",
        "    <Setting>UserAuthentication</Setting>",
        "    Failed to iterate over <Target> elements",
        "    <Setting>ComputerName</Setting>",
        "    Couldn't write WIM metadata text",
        "  <Setting Path=\"/Tablet/AssociationData\">",
        "DeplWpafExporter::ExportEnvLogFilePath",
        "    Couldn't read key for item in map setting %s",
        "        <Setting Path=\"/Connections/Item/Connection/ConnectionType\" />",
        "    Failed to add map key node to document",
        "  <Setting Path=\"/InternetExplorer/SuggestedSitesEnabled\">",
        "/u:unattend/u:settings[@pass='auditSystem']/u:component[@name='Microsoft-Windows-Deployment']",
        ".?AV?$CAutoCleanupBase@PAVWpxValidation@@@RAII@@",
        "    Couldn't export feature %u",
        "    Couldn't create phase condition for phase %u",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-International-Core-WinPE']/u:UILanguageFallback",
        "    WillReboot is not allowed in this setting pass",
        "; <%<*<7<{<",
        "?'?C?M?R?",
        "    Couldn't enumerate child nodes",
        "  <Setting Path=\"/Embedded/Shell/UserSettings\">",
        "j(XQPh",
        "WpxValidation::ValidateInt",
        "WpxSmiGetHiveValue",
        "3$3,343<3D3L3T3\\3d3l3t3|3",
        "FriendlyName",
        "y*Vj\"h",
        "        >Product-coresystem__Microsoft-Windows-Audio-AudioCore</Component>",
        "RtlValidRelativeSecurityDescriptor",
        "7#7F7a7|7",
        "    Couldn't get int value from IWpxSchemaAllowedValue",
        "    Couldn't read error reason from IXMLDOMParseError",
        "8-9l9",
        "8!8K8P8U8d8{8",
        "    Failed to get integer answer for %s",
        "    <Setting>DomainProfile_EnableFirewall</Setting>",
        "    Couldn't export encrypted disk setting",
        "GetFinalPathNameByHandleW",
        "        <Setting Path=\"/Connections/Item/Policy/Connections\" />",
        "    <Setting>MaxDecryptRequests</Setting>",
        "metadata\\elements\\%s",
        "Payload",
        "        >Microsoft-Windows-WorkstationService</Component>",
        "    <Setting>RestartEnabled</Setting>",
        "DeplWpafExporter::ExportSvcFeatures",
        "    Couldn't write accept EULA setting",
        "112n2s2x2",
        "WpxWpafWriter::PostProcessDocument",
        "    <Setting>PublicProfile_LogDroppedPackets</Setting>",
        "y Vj>h",
        "        >Microsoft-Windows-PnpSysprep</Component>",
        "y3Wh3",
        "    <Setting>CustomPowerApplication6</Setting>",
        "DeplWpafExporter::ExportInsOptions",
        ">9>S>k>v>}>",
        "    Failed to delete %s[%s] in order to overwrite it with answer file value",
        "    %s does not allow any passes suitable for phase %u",
        "2'2A2\\2v2",
        "y#VhH",
        "    <ManifestFile>shsetup.man</ManifestFile>",
        "WINDOWS/VERSION/SPLEVEL",
        "    Couldn't export assembly language",
        "292L2V2h2w2",
        "    <Setting>Themes</Setting>",
        "  <Setting Path=\"/Embedded/HideBootStatusIndicator\">",
        "6'6/6E6M6q6z6",
        "cAMDuE",
        "    Couldn't export user organization",
        "50545L5P5h5x5",
        "CompanyName",
        "    <Setting>PreventAutoConnect</Setting>",
        "wpaf:ComputerName",
        "FullName",
        "    Skipping unrecognized child %s specified for tree setting %s",
        "0,1l1",
        "9-989H9S9d9t9",
        "    This store does not publish %s",
        "    Specifying both <CreatedPartitions> or <ModifiedPartitions> with <Partitions> in the same disk is not allowed",
        ":C:`:e:j:v:",
        "=,=9=L=U=",
        "SmiSchemaNode::GetMapKeyPattern",
        "  <Setting Path=\"/HelpAndSupport/OnlineSupportIconLink\">",
        "1D1|1",
        ".?AVEnum@?1??GetVisibility@WpxAllowedValue@@UAEJPAPAUIWpxVisStateEnum@@@Z@",
        "y2Ph;",
        "WpxConfig::GetLoadedStores",
        "e    Warning: %s could not be unregistered from answer tree",
        "676O6o6",
        "WpxWpafWriter::WriteVariants",
        "ImageMetadata",
        "SkipLicenseCheck",
        ".?AV?$CAutoRelease@PAUIWpxAllowedValueEnum@@@RAII@@",
        ".?AV?$CAutoCleanupBase@PAUIWpxSchemaAllowedValue@@@RAII@@",
        "<&<X<]<b<n<",
        "WpxWpafWriter::WritePassSetting",
        "<(<,<D<H<`<d<|<",
        "Context",
        "1'171A1N1X1b1t1",
        "RunAsynchronousCommand",
        "4<4D4L4T4\\4d4l4|4",
        "0:0^0",
        "ModifyPartition",
        " yr5@",
        "    Couldn't parse hex string %s",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsZ\">",
        ">3?\\?",
        ".?AV?$CAutoCleanupBase@PAVWpxReadOpt@@@RAII@@",
        ";/<4<9<E<n<",
        "DeplWpafImporter::ImportEnv",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "  <Setting Path=\"/Shell/TaskbarLinks\">",
        "    Error while trying to validate the Common settings tree's answers",
        "<:<F<K<P<",
        "1J1s1x1}1",
        "AuditMode",
        "1!1,1O1T1Y1g1",
        "  <Setting Path=\"/Firewall/DomainProfile/LogSuccessfulConnections\">",
        "4 515N5d5i5n5z5",
        ".?AUIWpxStringEnum@@",
        "7N7S7X7d7~7",
        "=)=.=3=?=N=c=",
        "    Couldn't set friendly name for %s",
        "8'9?9K9]9{9",
        "2H2U2m2",
        "8B8m8",
        "1$1,141@1d1l1t1|1",
        "    <Setting>Gadget3</Setting>",
        "    Phase: Argument cannot be NULL",
        "e    Failed to allocate children",
        "jiXVPh",
        "wpaf:Language/wpaf:SystemUI/wpaf:FallbackLanguage",
        "4\"4.4L4",
        "    Failed to export disk criterion",
        "j!XWPh",
        "8#878W8r8",
        "    <Setting>PanningDisabled</Setting>",
        "9^0v0",
        "    <Setting>FallbackOrder</Setting>",
        "    <Setting>WindowsU</Setting>",
        ";4;B;W;\\;a;m;",
        "WpxConfig::GetPhaseSetting",
        "    Failed to write item index to <Order> element",
        "    Failed to check if right schema has a pattern",
        "DeplUnattendImporter::ParseBool",
        "    Couldn't write CompactOS flag",
        "33383=3U3`3v3",
        "DeplUnattendExporter::ExportCreatePart",
        ".?AV?$CAutoRelease@PAUIWpxSchemaAllowedValue@@@RAII@@",
        "    Failed to read list index of list item %s",
        "QueryPerformanceCounter",
        "$Microsoft Ireland Operations Limited1",
        "6D6W6k6}6",
        "2 2(20282@2H2P2X2`2h2p2x2",
        "y1Vh(",
        ".?AVConditionEnum@?1??EnumConditions@WpxConfig@@UAEJPAPAUIWpxConditionEnum@@@Z@",
        "        <Setting Path=\"/OnlinePrinting/Icon\" />",
        "    Failed to convert base type %s of setting type %s for setting %s to an SMI type",
        "SmiSchemaNode::GetAnsEnumValues",
        ".?AV?$CAutoRelease@PAUIWpxTargetEnum@@@RAII@@",
        "    Couldn't write integer setting %s",
        "    Failed to allocate reseal",
        "7(7=7J7U7n7",
        "DeplUnattendImporter::ParseReseal",
        "Atomic",
        "    Failed to check if left schema has an upper bound",
        "        >Microsoft-Windows-BrowserService</Component>",
        "    Couldn't retrieve answer at path %s",
        "WpafTempListIndex",
        ">6>;>@>W>a>",
        "848@8`8l8",
        "WpxWpafWriter::GetPhaseTree",
        "    Couldn't write audit mode computer name",
        "        <Setting Path=\"/Connections/Item/Connection/IpHeaderCompression\" />",
        "PWVSV",
        "  <Setting Path=\"/Power/FlyoutAutoPowerScheme\">",
        "  <Setting Path=\"/RemoteAssistance/CreateEncryptedOnlyTickets\">",
        "y&Vh[",
        "=!=2=I=[=z=",
        "    Feature selection missing required @state attribute",
        "WpxSetting::GetParent",
        "        >Microsoft-Windows-SystemMaintenanceService</Component>",
        "    Cannot specify extra files along with a .appxbundle",
        "    Failed to allocate paths",
        "0#0.0F0`0z0",
        "    <Setting>IEHardenAdmin</Setting>",
        ".?AVSettingNode@@",
        "    <Setting>TrustedSites</Setting>",
        "7`7e7j7v7",
        "s    Couldn't create answer for %s",
        "1#1@1Z1j1u1",
        "boolean",
        "y,Vhq",
        "    Couldn't validate answer for setting %s",
        "    Failed to export use-boot-disk flag",
        "wpaf:UserInfo/wpaf:Name",
        "WpxStore::EnumSources::SourceEnum::GetNext",
        "455:5?5K5m5",
        "        >Microsoft-Windows-MobilePC-Sensors-API</Component>",
        "    Couldn't allocate ns",
        "DeleteFileW",
        "<D<I<N<f<q<",
        "@pass",
        ".?AVEnum@?1??GetVisibility@WpxSetting@@UAEJPAPAUIWpxVisStateEnum@@@Z@",
        "g%hs (%hs:%d) - 0x%08x:",
        "u:assemblyIdentity",
        "  <Setting Path=\"/Drivers/PersistAllDeviceInstalls\">",
        "        >Microsoft-Windows-MigrationWizardApplication</Component>",
        "        <Setting Path=\"/DeviceManagement/Policies/OMACP/NetwpinRoles\" />",
        "    Load contents of resource, but can't get Unicode length",
        ".?AUIWpxVisibilityRuleDesc@@",
        "DeplUnattendExporter::ExportPackage",
        ">!?&?+?7?Q?i?y?",
        "    Failed to iterate over the configuration's variants",
        ".?AV?$CAutoCleanupBase@PAUIWpxVisibilityRule@@@RAII@@",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsL\">",
        "<(<:<E<W<l<w<",
        ";';F;P;h;m;r;~;",
        "?1?C?b?r?w?|?",
        "5(5<5e5",
        "1&1=1Q1j1o1t1",
        ":&:<:]:t:",
        "WpxSetting::ValidateAnswer",
        "sProvisioningCommands",
        "s    Failed to query allowed integer values",
        ";.;:;N;g;r;",
        ".?AV?$CAutoCleanupBase@PAUIXMLDOMParseError2@@@RAII@@",
        ".?AUIWpxVisibilityState@@",
        "WpxXmlDocument::SaveXml",
        "242J2f2r2",
        "InitializeCriticalSection",
        "WpxAnsTree::AddListItem",
        "WpxUnattendWriter::GetPassForPhase",
        "    Result: Argument cannot be NULL",
        ".?AV?$CAutoCleanupBase@PAVWpxAnswer@@@RAII@@",
        "    Target: Argument cannot be NULL",
        "  <Setting Path=\"/ErrorReporting/DefaultConsent\">",
        "SVWjL",
        "919<9T9h9",
        "    Failed to iterate over dependency files",
        "WpxConfig::GetCommonSettings",
        "y#VhT",
        "5(656M6",
        "WpxSetting::Clone",
        "=4=@=V=[=`=l=",
        "    Must specify a destination drive, partition index, or allow any partition index",
        "2 2,2T2p2",
        ".CRT$XCU",
        ".?AVChildNameEnum@?1??GetChildrenUnder@WpxUnattendMap@@QAEJABVWpxPath@@PAPAUIWpxStringEnum@@@Z@",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsD\">",
        "WpxSmiSetting::GetChildNames::SubKeyEnum::GetNext",
        "2 2%212G2L2k2p2u2",
        "1(181U1f1r1~1",
        "3 3'303;3X3]3b3n3",
        "KnobsStore::GetRoot",
        ">3>m>",
        "    <Setting>RestartMinute</Setting>",
        "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:DataImages",
        "2,202H2L2d2h2",
        "is invalid (no details available)",
        ">$?G?b?",
        "9!9&989X9",
        "yBSjth",
        "    Couldn't export assembly processor architecture",
        "4#4/4E4Y4^4c4r4",
        "    <Setting>WindowsEscape</Setting>",
        "y-Vjmh",
        ": :%:6:G:R:o:t:y:",
        "SmiSparseNode::Initialize",
        "  <Setting Path=\"/Shell/AutoLogon\">",
        "  <Setting Path=\"/Power/CustomPowerApplication4\">",
        "    <Setting>fAllowToGetHelp</Setting>",
        "    Failed to iterate over visibility rules",
        "7\"7'767J7\\7a7f7u7",
        "5,545<5D5L5T5\\5l5t5|5",
        "4*4C4H4M4X4e4p4",
        "3<3o3",
        "u:Diagnostics",
        "    Error initializing bool data.",
        ".?AV?$CAutoRelease@PAUIWpxStateDescEnum@@@RAII@@",
        "    Failed to find type declaration %s for setting %s",
        "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:EnableDynamicUpdate",
        ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:",
        "2%2*2/2:2N2S2X2c2u2",
        "    NumItems: Argument cannot be NULL",
        "WpxAllowedValue::GetVisibility",
        "    Couldn't enumerate child paths of %s",
        "u:ModifyPartitions/u:ModifyPartition",
        "4$4,444@4d4l4t4|4",
        ".?AV?$CAutoCleanupBase@PAVKnobsVisibilityState@@@RAII@@",
        "    <Setting>LocalIntranetSites</Setting>",
        "1&1@1X1e1p1",
        "RunAsynchronous",
        "WpxSmiSetting::ParseBuiltInType",
        "McsfLeafNode::Initialize",
        "QQSVWj0",
        "    <Setting>EnableSPADLaunchErrors</Setting>",
        "    Failed to write universal app path",
        "jIXWPh",
        ": :$:(:@:D:X:\\:t:x:|:",
        "\\jaXf;",
        "    <Setting>CacheLimit</Setting>",
        "    Couldn't initialize WpxSettingIssue",
        ":2:Q:",
        "string too long",
        "yEWh9",
        "MobileOperator",
        "    Couldn't compute length of base64-encoded buffer for %s",
        ".?AV?$CAutoCleanupBase@PAUIWpxAllowedValue@@@RAII@@",
        "  <Setting Path=\"/Power/CustomPowerApplication3\">",
        "/wpaf:Settings/wpaf:Provisioning/wpaf:ProvisioningPackages",
        ".?AV?$CAutoCleanupBase@PAUIXMLDOMDocument3@@@RAII@@",
        "7#8(8-898S8g8q8",
        "<'<F<K<P<\\<s<~<",
        ";+;0;5;D;v;{;",
        "onecore\\base\\ntsetup\\wpx\\core\\condition.cpp",
        "l    No longer able to load %s",
        "    Failed to allocate variant object",
        "    Couldn't write auditUser reseal shutdown flag",
        "    <Setting>PrintBackground</Setting>",
        "y+Wh/",
        ".?AV?$CAutoRelease@PAVWpxSource@@@RAII@@",
        "1K1X1j1",
        "y=Wh\"",
        "        <Setting Path=\"/Messaging/PerSimSettings/__ICCID/RequestDeliveryReport\" />",
        ">$>,>4><>D>L>X>x>",
        "StrToIntW",
        "        >Microsoft-Windows-LUA-Settings</Component>",
        "WpxSetting::GetAnswer",
        "    <Setting>RemoveMXDW</Setting>",
        "    Couldn't write subtree under %s",
        "    %s: Can't marshal (WPX_SMI_TYPE)%u as an integer",
        "    Couldn't set <component> @VERSION_SCOPE attribute",
        "/0E0c0",
        "    No entry in unattend map for setting %s",
        "t$pVQ",
        "    Couldn't write page file size",
        "    Couldn't iterate over synchronous commands",
        "?4?8?P?T?l?p?",
        "4W5{5",
        "MinMinorVersion",
        "  <Setting Path=\"/Firewall/PrivateProfile/LogFile\">",
        ".?AV?$CAutoCleanupBase@PAUIWpxStateDescEnum@@@RAII@@",
        ":,:5:::N:j:u:",
        "        >Microsoft-Windows-EnhancedStorage-Adm</Component>",
        "8'8]8e8p8",
        "    Couldn't iterate over disks in DiskConfiguration",
        "    Couldn't write disk index",
        "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:InstallWindows",
        "SettingNode::GetDefaultBinary",
        "    Couldn't export provisioning packages",
        "= =%=3=K=j=o=t=",
        ".?AV?$CAutoCleanupBase@PAUIWpxConditionEnum@@@RAII@@",
        "    Failed to write destination partition",
        "    Incomplete access credentials (username and password are required)",
        "    Couldn't serialize partition table type %u",
        "9{|v5",
        ".?AUIWpxAllowedValueEnum@@",
        ".?AV?$CAutoRelease@PAVWpxReadOpt@@@RAII@@",
        "    Failed to get variant from condition",
        "wpaf:Network/wpaf:Enabled",
        "    Couldn't load image %u from WIM file %s",
        "    Failed to allocate profiles",
        "  <Setting Path=\"/Firewall/PrivateProfile/EnableFirewall\">",
        "  <Setting Path=\"/InternetExplorer/ShowCompatibilityViewButton\">",
        "    Must specify an existing partition index on entries of <ModifiedPartitions>",
        "374O4[4m4",
        "F;spr",
        "        >Microsoft-Windows-NetworkLoadBalancing-Core</Component>",
        "SmiStore::FilterExcludedChildren::Filter::GetNext",
        "WpxSetting::SetListItemName",
        ">$>>>V>c>n>",
        "  <Setting Path=\"/Embedded/KeyboardFilter/LaunchApp1\">",
        "    <Setting>RemoveMPDW</Setting>",
        ";\"<c<",
        "    <Setting>WindowsTab</Setting>",
        "WpxXmlNode::AddChild",
        "Ordered",
        ".?AUIWpxPackage@@",
        "    Failed to append child node",
        "    Failed to serialize the common settings tree",
        "    Package path %u is incomplete",
        "u:UserLocale",
        "    <Setting>PersistAllDeviceInstalls</Setting>",
        "SVWj|",
        "111019184142Z",
        ":9:M:i:",
        "Display/Resolution/Width",
        "        versionScope=\"nonSxS\"",
        "    Couldn't iterate over node children",
        "0M0R0W0c0",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsLeft\">",
        ".rdata",
        "0*040C0S0]0l0",
        ">1>8>>>H>]>",
        "WpxSmiSetting::ParsePasses",
        "1 1,141h1x1",
        "2\"2Y2",
        "DeplUnattendImporter::ImportPackaging",
        "        <Setting Path=\"/Connections/Item/Proxy/Type\" />",
        ".?AV?$CAutoCleanupBase@PAVWpxVariant@@@RAII@@",
        "        language=\"neutral\"",
        "    Couldn't find schema for answer path %s",
        "/u:unattend/u:settings[@pass='auditSystem']/u:component[@name='Microsoft-Windows-Deployment']/u:Generalize",
        "DeplWpafImporter::ImportPackage",
        "    Unrecognized option for <Restart>: %s",
        "DeplUnattendExporter::ExportEnvironment",
        "DeplUnattendImporter::ImportAuditSysDepl",
        "585=5B5S5",
        "2O2T2Y2m2x2",
        "!Vjzh",
        "    <Setting>FindProvidersURL</Setting>",
        "    <ManifestFile>International-Core.man</ManifestFile>",
        "WpxWpafReader::ReadVariants",
        "> >1>A>R>W>\\>",
        "    Failed to strip %s attribute under %s",
        "    Failed to allocate targets",
        "Feature",
        "    Can't enumeration children of a complex setting",
        "DeplUnattendImporter::OrderNodes",
        "y/Vh{",
        ":%:@:E:J:V:q:v:{:",
        "  <Setting Path=\"/Firewall/PrivateProfile/LogDroppedPackets\">",
        ">6?B?T?x?",
        "    Incomplete WIMBootFrom node (DiskID and PartitionID are required)",
        "5#5,555J5_5n5v5",
        "    Must specify either a package file path or a package keyform",
        ":\":-:D:d:i:n:y:",
        "    <Setting>LinearityData</Setting>",
        "    <Setting>Shell</Setting>",
        "DeplWpafExporter::ExportSvcSessions",
        "ProvisioningPackage",
        "y#Vhn",
        "    <Setting>FlyoutAutoPowerScheme</Setting>",
        "? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\\?`?d?h?l?p?t?x?|?",
        "        >Microsoft-Windows-TerminalServices-RemoteConnectionManager</Component>",
        ">&><>O>d>i>n>z>",
        "    Couldn't load schema for %s",
        "5.53585G5q5",
        "0+00050D0`0",
        ">*>]>",
        "%s: Variant references undefined target state '%s'",
        ";#;C;_;q;",
        "        >Microsoft-Windows-OutOfBoxExperience</Component>",
        "    Invalid migration option %u",
        "8#8(848O8j8|8",
        "    Couldn't write value for setting %s",
        "        <Setting Path=\"/Connections/Item/Connection/IdleDisconnectTimeout\" />",
        "&WjQh",
        "        >Microsoft-Windows-UnattendedJoin</Component>",
        "y-Vho",
        "RtlRunOnceBeginInitialize",
        "  <Setting Path=\"/InternetExplorer/LockToolbars\">",
        "y/WhZ",
        "?-???V?d?",
        "3 3$3(3<3L3P3T3l3p3",
        "u:InstallImage",
        "    Couldn't write refresh rate",
        "package/state",
        "wprintf",
        "    <ManifestFile>OutOfBoxExperience.man</ManifestFile>",
        "memcmp",
        "    <Setting>HKCUuseDefaultOverscanMargins</Setting>",
        "u:UserData",
        ".?AV?$CAutoRelease@PAUIWpxVisibilityState@@@RAII@@",
        "/wpaf:Settings/wpaf:WindowsPE/wpaf:ComputerName",
        "    Failed to initialize WpxXmlNode (item %u of %u",
        "    Item node for map setting %s doesn't declare a key (%s)",
        "    Couldn't export implicit-session packages",
        "    Failed to parse document",
        "    Couldn't add <settings> comp to document",
        ".?AV?$CAutoRelease@PAUIWpxAnswerFileReader@@@RAII@@",
        "    <Setting>NotificationArea</Setting>",
        "WpxSettingIssue::BuildDescription",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsE\">",
        "4'4k4",
        "?-?K?g?t?",
        "    Couldn't export OS install image",
        "    Can't specify <Format> for entries of <CreatedPartitions>",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsPageUp\">",
        "0(151M1",
        "@xsd:type",
        "UniversalApps",
        "< =6=I=N=S=_=",
        "    <settings> element does not have a @pass attribute",
        "    Image InstallTo disk must have a single Index=(...) criterion",
        "    <Setting>BTSearchIntervalOnDC</Setting>",
        "  <Setting Path=\"/MediaCenter/RestartMinute\">",
        "h    This tree doesn't have an entry for %s",
        "v    Couldn't iterate over WindowsPE drivers",
        "1!111<1M1`1{1",
        "2'272C2J2P2U2Z2{2",
        "  <Setting Path=\"/OEM/Information\">",
        ".?AVEnumerator@?1??GetVisibility@KnobsAllowedValue@@UAEJPAPAUIWpxStateDescEnum@@@Z@",
        ":0:=:H:`:w:",
        "    Couldn't iterate over provisioning packages",
        "4A5h5u5",
        "282H2Y2^2",
        "WpxTarget::RemoveTargetState",
        "        <Setting Path=\"/Power/CustomPowerApplication6/IconID\" />",
        "<\"<0<B<`<l<~<",
        "        <Setting Path=\"/Power/CustomPowerApplication4/Application\" />",
        "    <Setting>PartnerId</Setting>",
        ",kGyqWihIdz3igX5CMycIIyZVdDhWRuUV9/PZf6wjxkQ=0Z",
        "SSSQW",
        "    <Setting>Fax</Setting>",
        "?8?=?B?N?m?",
        "3;3l3x3",
        "        <Setting Path=\"/Connections/Policies\" />",
        " 0?0I0N0",
        "l    Contents: Argument cannot be NULL",
        "    <ManifestFile>TerminalServices-CentralPublishing.man</ManifestFile>",
        "package/@permanence",
        "2B3v3",
        "    Couldn't check whether the decl for %s has an @key",
        "%s: Key must have at least %lld character(s)",
        "y-PhC",
        "    <Setting>WorkOffline</Setting>",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsH\">",
        "    Failed to clear source path from answer object",
        "WpxSetting::IsMapValue",
        "    Couldn't run query: %s",
        "    Not recording default answer for list/map/tree setting",
        "    Failed to allocate driver",
        "OLEAUT32.dll",
        "%s: Inside node %s, can't parse '%s' as a binary",
        "    Values: Argument cannot be NULL",
        "    Failed to allocate visibilityRule",
        "3-3E3K3e3v3",
        "u:InstallToAvailablePartition",
        "    WPAF doesn't support temporary package paths (use unattend instead)",
        "4!5&5+575G5]5p5u5z5",
        "y-Sj~h",
        "    IWpxDriver missing required Path parameter",
        "f9A4sMht",
        "0(1S1~1",
        "    Issue: Argument cannot be NULL",
        "    <Setting>FavoriteBarItems</Setting>",
        ".?AVWpxDeplSettings@@",
        "202H2U2`2y2",
        "y%Vh$",
        "u:HorizontalResolution",
        "9 9(909H9L9d9h9",
        "WIMGetImageCount",
        "  <Setting Path=\"/Audio/CameraSoundLevel\">",
        ".?AUIWpxDeplImporter@@",
        "?*?=?",
        "    Couldn't write main UI language",
        "    Failed to serialize answer file to string",
        "8-82878C8",
        "SmiStore::Initialize",
        "8\"8'8,8L8[8q8~8",
        "    Couldn't clear answer at %s",
        "5+5L5k5p5u5",
        "u:Value",
        "WpxSmiHive::Mount",
        "WindowsDeploymentServices",
        "    <Setting>RegistryExceptionsUserDefined</Setting>",
        ">#>H>]>o>|>",
        "/wpaf:Settings/wpaf:AuditMode",
        "y#Whn",
        "/u:unattend/u:servicing",
        "    <Setting>WindowsRight</Setting>",
        "0=0I0N0S0v0",
        "2%2C2P2r2w2|2",
        "DiskID",
        "    <Setting>Icon</Setting>",
        "WpxSmiSetting::GetDefault",
        "    Couldn't generate unique file name in %s",
        "Package/Install",
        "    Couldn't iterate over CreatePartitions",
        ";,;0;H;L;d;h;",
        "    Couldn't enumerate names of children under %s for Windows %s %s",
        "    <Setting>WindowsB</Setting>",
        ".?AV?$CAutoRelease@PAVWpxSmiHive@@@RAII@@",
        "1$1,141<1D1L1T1\\1d1l1t1|1",
        "8>8C8H8`8k8",
        "    <Setting>Receipts</Setting>",
        ";(;8;H;X;h;x;",
        "    <Setting>EnableICS</Setting>",
        "/wpaf:Settings/wpaf:Servicing/wpaf:Packages",
        "    %s node missing required Order parameter",
        ".?AVout_of_range@std@@",
        ".gfids",
        ".?AV?$CAutoRelease@PAVWpxConfig@@@RAII@@",
        ".?AV?$CAutoCleanupBase@PAVWpxCondition@@@RAII@@",
        "    Couldn't import disk",
        ".rsrc$02",
        "WINDOWS/VERSION/BUILD",
        "RtlDllShutdownInProgress",
        "        <Setting Path=\"/Theme/DefaultAccentColor\" />",
        "memcpy_s",
        "%I64u",
        "GetTempFileNameW",
        ";#;z;",
        "%s is not one of the allowed values",
        "y-ShA",
        "    <ManifestFile>fvefilterdriver.man</ManifestFile>",
        "  <Setting Path=\"/NetworkProxy/HKLMConnectRetries\">",
        "yBWh9",
        "7 7(70747<7D7H7P7X7\\7d7l7p7x7|7",
        "    Can't query whether setting %s has a maximum",
        "    ModifyPartition requires a PartitionID",
        "WpxSmiOpenWimStore",
        "component",
        "%s/p:Setting[@Name='%s']",
        "_amsg_exit",
        ".?AV?$CAutoCleanupBase@PAE@RAII@@",
        "4/4]4j4",
        ".?AV?$CAutoRelease@PAVWpxSetting@@@RAII@@",
        "  <Setting Path=\"/Shell/DisableAutoDaylightTimeSet\">",
        "3*4/444@4Z4",
        "    Couldn't query for attribute %s",
        "wpaf:Condition",
        "8-979`9e9j9",
        "  <Setting Path=\"/MediaCenter/DisableVolumeDisplay\">",
        ".?AV?$CAutoRelease@PAVKnobsStore@@@RAII@@",
        "    <Setting>LsaCfgFlags</Setting>",
        "y-Vhj",
        "    <ManifestFile>wlansvc.man</ManifestFile>",
        "Microsoft",
        "    Failed to allocate res",
        "FailFast",
        "wpaf:WdsImage/wpaf:ImageName",
        "Equals",
        "    Couldn't import package",
        "    <Setting>DisableAutoDaylightTimeSet</Setting>",
        "141<1H1l1t1|1",
        "UnhandledExceptionFilter",
        "  <Setting Path=\"/Firewall/DomainProfile/LogFile\">",
        "__dllonexit",
        "3$3=3B3M3k3p3u3",
        "OptIn",
        "  <Setting Path=\"/Internationalization/SystemLocale\">",
        "11161;1G1V1o1x1",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsPlus\">",
        ">-?X?",
        "  <Setting Path=\"/SecureStartup/MaxEncryptRequests\">",
        "878T8t8",
        "2%2E2K2z2",
        "        >Microsoft-Windows-DeviceAccess</Component>",
        ";-;b;",
        ".?AV?$CAutoRelease@PAVKnobsAllowedValue@@@RAII@@",
        "2\"3E3J3O3^3z3",
        "    Couldn't write variant-specific settings tree(s)",
        "UserData",
        "WpxSetting::GetListItemName",
        "Apply",
        "    Cannot instantiate %s: left schema (Windows %s %s) and and right schema (Windows %s %s) have different schemas",
        "7@7U7u7",
        "    MaxLength: Argument cannot be NULL",
        "Drivers",
        "u:OSImage",
        "5D6y6",
        "VSjRZ",
        "y4Wh?",
        "UILanguageFallback",
        "invalid string position",
        "SmiSchemaNode::GetAnsEnumValues::IntEnum::GetNext",
        "    InstallTo is required for WDS images",
        "74797>7I7`7o7~7",
        "0 0%010C0P0[0z0",
        "    Error initializing int data.",
        ".giats",
        "y-WhV",
        "    Failed to load excluded URIs from footprint files",
        "<D<^<c<h<",
        "    Declaration for setting %s missing required RegistrySource/CspSource child element",
        "8!9/949X9f9k9",
        "nwindowsPE",
        "    Value %s does not use an SMI type to store its value!",
        "wpaf:Packages/wpaf:Package",
        "y+Vhp",
        "<!<,<C<X<c<z<",
        "  <Setting Path=\"/MediaCenter/OCURProductKey\">",
        "    Couldn't write user locale",
        "    Failed to allocate logs",
        "McsfApplyInfo::GetResolvedTargetPath",
        "    Failed to allocate finishOffline",
        "y-Pjlh|7",
        "0+050e0",
        "    Couldn't case NODE_ELEMENT IXMLDOMNode to IXMLDOMElement",
        "    Couldn't export language settings",
        "    <Setting>DuplicatorDescription</Setting>",
        ">(>8>H>X>\\>l>p>",
        "  <Setting Path=\"/StorageAreaNetwork/AutoMountPolicy\">",
        "?1?t?",
        "    <ManifestFile>Microsoft-Windows-Fax-Service.man</ManifestFile>",
        "    <ManifestFile>coresystem_internal_Audio-AudioCore.man</ManifestFile>",
        "2c3z3",
        "    Failed to traverse to %s in %s",
        "wpaf:IgnoreCheck",
        ">9>D>Y>w>",
        "    Must specify a VHD file path",
        "4*4/444B4]4t4",
        ":':B:p:",
        "DataOnly",
        "    Failed to allocate modified",
        "    Couldn't parse <CspSource> Type attribute",
        "FallbackLanguage",
        "    Too many sections in package ID: %s",
        "989L9a9",
        ".?AV?$CAutoCleanupBase@PBE@RAII@@",
        "    IWpxVisibilityState enumerator failed",
        "    '%s' is too short (keys must have %u characters minimum)",
        "8)8t8",
        "    Failed to export session %u",
        "0G0[0v0",
        "    Failed to write force-install flag",
        "CFG_DATATYPE_INTEGER",
        "    Failed to decode base64 binary value for %s",
        ".?AVValueEnum@?1??GetIntEnumValues@WpxSmiSetting@@QAEJPAPAUIWpxIntEnum@@@Z@",
        ":1:>:I:b:y:",
        "  <Setting Path=\"/OnlineBackup/Link1Text\">",
        "        >Microsoft-Windows-RemoteAssistance-Exe</Component>",
        "2&2;2S2]2b2g2",
        "    Couldn't read line position from IXMLDOMParseError",
        "0@0c0",
        "DeplUnattendImporter::ImportModifyPart",
        "    Failed to get newly-inserted item %llu of %s",
        "    Couldn't set <component> @publicKeyToken attribute",
        "EvalValueContains : Not yet implemented",
        "<)<.<3<K<V<p<",
        "<.<;<S<X<]<v<",
        "    Must specify an image type",
        "    Couldn't write per-pass settings tree(s)",
        "4M5R5W5c5~5",
        "    Couldn't parse default answer",
        ".?AV?$CAutoCleanupBase@PAG@RAII@@",
        "=U>w>",
        "  <Setting Path=\"/Embedded/KeyboardFilter/ControlWindowsF\">",
        "    <SettingsGroup> element missing required @Path attribute",
        "8W8c8w8",
        "4 4@4H4X4|4",
        "    Unknown package state %u",
        "    Incomplete feature (name and enabled are both required)",
        "    Can't query whether setting %s has a pattern",
        "ImageCustomizations",
        "QSVWj",
        "0\"0'0,080J0_0}0",
        "    Failed to allocate startOOBE",
        "  <Setting Path=\"/Display/Settings\">",
        "9'999>9C9U9y9",
        ":w:}:",
        "DeplUnattendImporter::ImportOobeDepl",
        "7-787P7g7",
        "DeplUnattendImporter::ImportDisk",
        "    Couldn't set text for element <%s>",
        "778|8",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-International-Core-WinPE']/u:UserLocale",
        ";';,;H;~;",
        "    <Setting>SecurityLayer</Setting>",
        ";-;2;7;F;",
        "WpxPathTree::AddPath",
        "9regfuD",
        "    Failed to create new target state",
        "    Setting: Argument cannot be NULL",
        "4!4D4I4N4Z4v4",
        "WpxSetting::GetMapKeys",
        "9*9[9b9g9",
        "8/8D8O8`8s8",
        "    <Setting>OEMInformation</Setting>",
        "towupper",
        "=(=H=P=X=h=",
        "KERNEL32.dll",
        "hCMScSP",
        ".?AV?$CAutoRelease@PAVWpxUnattendMap@@@RAII@@",
        "    Couldn't add <component> element to document",
        "s    Failed to allocate svc",
        ".?AV?$CAutoCleanupBase@PAUIWpxVariantEnum@@@RAII@@",
        "    Couldn't write partition filesystem type",
        "y%Whs",
        "090f0",
        "Microsoft-Windows-Foundation-Package",
        "u:Domain",
        ".?AV?$CAutoDelete@PAVWpxDriver@@@RAII@@",
        "WpxWpafReader::ReadIntValue",
        "2:3?3D3O3d3i3n3|3",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:LogPath",
        "y6Sh)",
        "        <Setting Path=\"/Messaging/PerSimSettings/__ICCID/AllowSelectAllContacts\" />",
        "    Couldn't create element %s",
        "    Missing image destination information",
        "WpxWpafReader::Read",
        "    Couldn't export package assembly ID",
        "?3?T?Y?e?",
        "    Couldn't get base type for simpleType %s of setting %s",
        "0\"0'0,070Q0k0z0",
        "    Couldn't export deployment settings",
        "3$3)3.3a3{3",
        "WpxUnattendWriter::WriteBinarySetting",
        "3X3e3}3",
        "    package missing required assemblyIdentity parameter",
        ";);.;3;>;Q;b;n;z;",
        "MaxMajorVersion",
        "    <ManifestFile>VolumeControl.man</ManifestFile>",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:UseConfigurationSet",
        "494\\4{4",
        "=7=<=A=O=T=",
        ";(<@<L<r<w<|<",
        "DriveLetter",
        "auditUser",
        ".?AV?$CAutoDeleteArray@$$CBG@RAII@@",
        "3!3=3C3O3e3y3~3",
        "    <Setting>CustomPowerApplication1</Setting>",
        "    Couldn't sort modified partitions",
        "<$<,<8<X<`<h<p<x<",
        "    Failed to validate map key %s for %s",
        "y-Vjuh",
        "='=:=\\=k=~=",
        "    Failed to iterate over features",
        "    <Setting>FaxUnattend</Setting>",
        "Vj(h0",
        "    Missing required @Path attribute",
        ".?AUIWpxFeature@@",
        ".?AVWpxTargetCondition@@",
        "    Answer tree doesn't have answer with path %s",
        "<0<4<H<L<d<h<l<",
        "Asset",
        "?*?:?E?]?i?n?s?",
        "generalize",
        "    Failed to allocate m_Default",
        "    Couldn't write WIM boot flag",
        "9+9P9i9t9",
        "    Schema: Argument cannot be NULL",
        "permanent",
        "%s %lld",
        "    Failed to prune missing paths below %s",
        "    Couldn't validate settings below %s",
        "    Couldn't write command order",
        "    Loaded resource %s, but could not lock its contents for read",
        "wpaf:ComputerName/wpaf:RequiresReboot",
        "    Couldn't get WPX_SETUP_PASS at index %u",
        "    Couldn't write partition label",
        "selection",
        "    Failed to enumerate over right schema values for property %s",
        "Accept",
        "Unknown",
        "    Couldn't iterate over package sources",
        "?%?>?`?e?j?v?",
        "    Failed to allocate deps",
        "SmiStore::GetSparseNodeChildren::ChildNameEnum::Initialize",
        "    <Setting>RequirePlatformSecurityFeatures</Setting>",
        "    Couldn't write WDS image group",
        ".?AUIWpxPartition@@",
        "4,4;4O4f4{4",
        "Extended",
        ".?AUIWpxSchemaAllowedValue@@",
        "SVWj@",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:DiskConfiguration",
        "    <Setting>CtrlWin</Setting>",
        "  <Setting Path=\"/Shell/ShowWindowsLive\">",
        "        <Setting Path=\"/Power/CustomPowerApplication1/Application\" />",
        "    Couldn't parse macros in policy path %s",
        ":':5:::Y:t:",
        "<$<1<F<k<p<u<",
        "wpaf:UserInfo/wpaf:Organization",
        "    <Setting>LaunchMediaSelect</Setting>",
        "QQh4j",
        "0C0V0`0o0",
        "C$;G$u",
        "@processorArchitecture",
        "        <Setting Path=\"/Connections/Item/Proxy/ExtraInfo\" />",
        "WpxSetting::InsertListItem",
        "4/5_5u5",
        ">3?S?h?z?",
        "y-VjGh",
        "/wpaf:Settings/wpaf:Provisioning/wpaf:ProvisioningCommands",
        "  <Setting Path=\"/MigrationWizardApp/HideDiscontinuedComponents\">",
        "    Failed to load Knobs schema hive",
        "        <Setting Path=\"/Connections/Item/Connection/AuthType\" />",
        "/wpaf:Settings/wpaf:Deployment/wpaf:Install/wpaf:Online",
        ">3>E>^>c>h>v>",
        "#0>0X0]0b0n0",
        "VSjYZ",
        "<*<5<O<i<",
        ".?AUIWpxAnswerFileWriter@@",
        "RtlInitializeSRWLock",
        "2-2D2N2S2X2",
        "<?xml version='1.0' encoding='utf-8' standalone='yes'?>",
        "    Couldn't set binary answer for %s",
        "  <Setting Path=\"/OnlinePrinting/DisplayName\">",
        "    Invalid boolean value for EnableFirewall",
        "    Failed to allocate creds",
        "CspSource",
        ":1:B:V:a:y:",
        "    <Setting>WindowsQ</Setting>",
        "    <Setting>SensorPermissions</Setting>",
        "EnableNetwork",
        "?K?c?h?m?x?",
        "  <Setting Path=\"/SMBClient/OtherDomains\">",
        "/u:unattend/u:settings",
        "y-Vhn",
        "    <Setting>TapiConfigured</Setting>",
        "AnsUpperBound",
        "WpxValidation::ValidateAnswer",
        "    Couldn't check if answer has a minimum length",
        "        >Microsoft-Windows-GPIOButtons</Component>",
        "    <Setting>Size</Setting>",
        "    <Setting>PlaySound</Setting>",
        "1-1F1c1",
        "  <Setting Path=\"/Embedded/KeyboardFilter/LaunchApp2\">",
        "0/04090E0W0z0",
        "4-42474E4U4f4k4p4",
        "9F9W9_9s9",
        "ImageSelection",
        "    Couldn't write post-generalize reseal mode",
        "    Failed to allocate asmid",
        "    Couldn't write auditSystem reseal shutdown flag",
        "    <Setting>RFC1156Agent</Setting>",
        "    Returning false because this isn't an integer setting",
        "LockResource",
        "474S4k4",
        ".?AVKnobsAllowedValue@@",
        "    <ManifestFile>production\\moderncore_prod_Audio-AudioCore.man</ManifestFile>",
        "    <ManifestFile>stobject.man</ManifestFile>",
        "        <Setting Path=\"/Messaging/PerSimSettings/__ICCID/ImsiAuthenticationToken\" />",
        "    Failed to move target item from temp index to %llu",
        "http://schemas.microsoft.com/WMIConfig/2002/State",
        "    Failed to allocate sync",
        "WpxSetting::GetAnsUpperBound",
        "  <Setting Path=\"/InternetExplorer/FindProvidersURL\">",
        "???D?I?",
        "    <ManifestFile>PerfCenterCPL.man</ManifestFile>",
        "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4",
        "    Couldn't get parent setting of setting %s",
        ":*:5:A:U:`:l:",
        "(Sjuh",
        "y-Vh%",
        "    Couldn't export disk wipe setting",
        "    Can't specify <Active> for entries of <CreatedPartitions>",
        "WpxWpafWriter::WriteAssetSetting",
        "9)9.939?9k9",
        "y.Vhj",
        ":1:K:`:p:",
        "?6?;?@?L?^?}?",
        "    Couldn't adding %s to path tree",
        "    <Setting>SidebarOnByDefault</Setting>",
        "_except_handler4_common",
        "  <Setting Path=\"/Internationalization/UILanguageFallback\">",
        "e    Couldn't get setting at answer path %s",
        "    <ManifestFile>SqmApi.man</ManifestFile>",
        "4 5:5X5w5|5",
        "        >Microsoft-Windows-DiagCpl</Component>",
        "s    Couldn't query if %s has a maximun number of occurrences",
        "onecore\\base\\ntsetup\\wpx\\core\\visibility.cpp",
        "    Couldn't write command description",
        ":$:,:4:<:H:h:p:x:",
        "9U9_9y9~9",
        "<T=\\>",
        "6%6=6",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsW\">",
        "?6?R?W?\\?t?",
        "?0?<?G?\\?n?|?",
        "7+80858A8\\8v8",
        "        <Setting Path=\"/Connections/Item/Proxy/Password\" />",
        ";+;8;C;\\;",
        "    Failed to allocate strIndex",
        "    <Setting>HKLMProxyEnable</Setting>",
        "Removable",
        "    Failed to get map value setting %s",
        "EnableFirewall",
        "242<2D2L2T2\\2d2l2t2",
        "        >Microsoft-Windows-Embedded-ShellLauncher</Component>",
        "  <Setting Path=\"/MediaCenter/EnableSPADLaunchErrors\">",
        "    <Setting>WindowsW</Setting>",
        "  <Setting Path=\"/Embedded/KeyboardFilter/Application\">",
        "  <Setting Path=\"/OnlineBackup/Link1\">",
        "?3?8?=?K?[?",
        "Vjih4j",
        "yIShV",
        "7-7=7B7G7S7`7e7j7v7",
        "WpxWpafReader::ReadSettingsTree",
        "WpxExclusionList::Load",
        "989e9j9o9~9",
        "    Couldn't enable XML parse error reporting",
        "        <Setting Path=\"/Messaging/PerSimSettings/__ICCID/UAProf\" />",
        ";3;?;K;P;U;x;",
        "        <Setting Path=\"/Maps/ChinaVariantWin10\" />",
        "        >Microsoft-Windows-Fax-Service</Component>",
        "DeplWpafExporter::ExportEnvDisplay",
        "? ?.?<?",
        "    <Setting>Gadget2</Setting>",
        "WpxValidation::ValidateString",
        "    <Setting>DisableComplexStretchesOnConsole</Setting>",
        "0-0f0k0p0",
        "  <Setting Path=\"/RemoteAssistance/AllowToGetHelp\">",
        "  <Setting Path=\"/InternetExplorer/ShowStatusBar\">",
        "    Failed to get boolean answer for %s",
        "9O:n:",
        "e    Failed to allocate state",
        "    <Setting>HKUSERSuseDefaultOverscanMargins</Setting>",
        "    Source for setting %s missing required @Type attribute",
        "8'8F8g8",
        "=,>@>O>[>`>e>",
        "    Couldn't validate whether %u is in the allowed values enum",
        "    <Setting>SearchScopes</Setting>",
        "  <Setting Path=\"/Firewall/PublicProfile_LogFileSize\">",
        "  <Setting Path=\"/OEM/WelcomeCenter\">",
        "10151:1E1W1\\1a1l1",
        "    <Setting>PrivateProfile_EnableFirewall</Setting>",
        "    Couldn't serialize criterion operator %u",
        "1(232D2X2l2",
        "    Unable to parse content of StartAuditMode <Action> node: %s",
        "    Failed to allocate disp",
        "0(0H0P0\\0|0",
        "9O:v:",
        "303a3",
        "%hs: User requested %u bytes, but RegGetValue only read %u",
        "5\"5g5z5",
        "    Condition missing required @Name attribute",
        "    Couldn't find schema path for %s under %s",
        "WpxWpafWriter::WriteTarget",
        "9hbinu",
        "    Failed to write Id attribute",
        "wpaf:VhdImage/wpaf:Path",
        ".?AV?$CAutoDeleteArray@D@RAII@@",
        "WpxXmlDocument::LoadFootprint",
        "8\"878B8Z8n8",
        "        <Setting Path=\"/Shell/Themes/DesktopBackground\" />",
        "EvalValueLessEqual : Not yet implemented",
        "  <Setting Path=\"/RemoteAssistance/AllowFullControl\">",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-PnpCustomizationsWinPE']/u:DriverPaths",
        "yBWhT",
        "<*<@<N<",
        ";)<<<Y<l<",
        "MapKeyName",
        "yGWh2",
        "wpaf:Domain",
        "    Couldn't write data migration option",
        "WpxWpafReader::AddVariants",
        ".?AV?$CAutoDeleteArray@G@RAII@@",
        ".CRT$XLA",
        "AllowedFileExtensions",
        "    Couldn't import asynchronous command",
        "WpxWpafReader::ReadBinaryValue",
        "    <Setting>EnableLinksBar</Setting>",
        "484K4P4U4a4",
        "    <ManifestFile>systemos_internal_Audio-AudioCore.man</ManifestFile>",
        "    Couldn't find declaration for type %s",
        "    Failed to allocate driverNode",
        "    Couldn't import CreatePartition",
        ".?AV?$CAutoCleanupBase@PAUIXMLDOMNode@@@RAII@@",
        "MetaData",
        "1%1*1/1:1S1`1e1|1",
        "=$=(=0=8=P=T=l=p=",
        "<1<T<",
        "Compact",
        "040G0[0m0",
        "    Couldn't enumerate answer paths under %s",
        "    Can't specify both imperative (CreatePartitions/ModifiyPartitions) and declarative (Partitions) partitioning in the same disk",
        "    Missing required .appx path or .appxbundle path",
        ".?AVWpxSettingIssue@@",
        "    <Setting>WindowsPageUp</Setting>",
        "        <Setting Path=\"/InternetExplorer/DataSaving/ShowPicturesAutomatically\" />",
        "Loaded image %u from WIM file %s",
        "malloc",
        "1 1%1*161d1",
        ".?AV?$CAutoRelease@PAUIWpxVisRuleEnum@@@RAII@@",
        "    <Setting>SkipAutoActivation</Setting>",
        "7<8X8~8",
        "8 848D8h8t8|8",
        "229879+4583620",
        "93989=9I9]9b9w9|9",
        "    Couldn't export provisioning package %u",
        "    Couldn't write value '%s' for metadata field %s",
        "    Couldn't export network enabled flag",
        "yEPhe",
        "    Failed to check if element %u of path %s is a map key",
        "WpxStore::SupportsRuntimeProvisioning",
        "    <ManifestFile>TerminalServices-RemoteConnectionManager.man</ManifestFile>",
        "WpxUnattendReader::ReadTextValue",
        ">;?S?",
        "  <Setting Path=\"/Embedded/KeyboardFilter/ShiftControlEscape\">",
        "u:VerticalResolution",
        "    Can't specify extra files for a .appxbundle",
        ">*>:>E>^>",
        "wcsstr",
        "    Map schema node has multiple child nodes",
        "    Couldn't parse <Type> element",
        "  <Setting Path=\"/Shell/VisualEffects\">",
        ";(;-;2;A;N;h;q;",
        "  <Setting Path=\"/Embedded/Tablet/TouchUI\">",
        "t    Failed to allocate text",
        "DeplUnattendImporter::ImportAuditDepl",
        "    <ManifestFile>partmgr.man</ManifestFile>",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsM\">",
        "    Failed to allocate source",
        "Category",
        "        <Setting Path=\"/Connections/Item/Connection/AccessPointName\" />",
        "not present",
        "    Couldn't get element %u of %s",
        "646<6D6L6T6`6",
        "u:WillReboot",
        "9&919_9j9",
        "u:ImageInstall",
        ";J<O<T<c<",
        "y%Vhk",
        "0.090N0l0",
        "giQXo",
        "ProvisionDisk",
        "wpaf:Password",
        ">$>(>0>8><>D>L>d>h>",
        "2'2b2m2",
        "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:EnableConfigurationSet",
        "5)545M5a5v5",
        "Dependencies",
        "Logical",
        "<(<3<f<k<p<|<",
        "5$5,545<5D5L5T5\\5d5l5t5|5",
        "    Ignoring Validate/Option node for setting of type %u",
        "HeapFree",
        "    Couldn't import UnattendedSetup settings",
        "Required",
        "PPhH{",
        "    Failed to write target state condition",
        "y WjBh",
        "    Failed to enumerate child key %u",
        "u:Label",
        "    <Setting>MaxEncryptRequests</Setting>",
        "= =D=L=T=\\=d=l=t=|=",
        "    Found but could not determine size of resoure %s",
        ".?AVValueEnum@?1??GetTextEnumValues@WpxSmiSetting@@QAEJPAPAUIWpxStringEnum@@@Z@",
        "WpxCondition::CheckSetting",
        "    Schemas differ for property %s (left: %s, right: %s)",
        "Display/RefreshRate",
        "    Failed to export store app %u",
        "        <Setting Path=\"/Connections/Item/Proxy/Server\" />",
        "WpxTargetState::AddTargetCondition",
        ";7;<;A;O;^;j;o;t;",
        "    Failed to query setting visibility",
        "  <Setting Path=\"/TerminalServicesWMIProvider/DisabledAllowList\">",
        "UnattendedSetup",
        "onecore\\base\\ntsetup\\wpx\\depl\\model.cpp",
        "WpxVariant::AddTarget",
        "        >Product-clientcore__Microsoft-Windows-Audio-AudioCore</Component>",
        "ApplyAfterSetting",
        "    Targets: Argument cannot be NULL",
        "y#Vh2",
        "u:Upgrade",
        "=.=T=Y=^=u=",
        ";$;);.;:;I;",
        "  <Setting Path=\"/Drivers/KMDFStartType\">",
        "    Failed to load SMI schema hive",
        "1@2p2",
        "Continue",
        "    The OS doesn't have a WPX-compatible settings store",
        "DeplWpafExporter::NewChild",
        "    <Setting>CtrlF4</Setting>",
        "McsfLeafNode::ParseValidation",
        "    Couldn't get unattend deployment setting importer",
        "9\\$D|",
        "Filename",
        "    <ManifestFile>clientcore_internal_Audio-AudioCore.man</ManifestFile>",
        "    <Setting>StartTiles</Setting>",
        "Microsoft Corporation1",
        "MinLength",
        "OSImage",
        "    <Setting>OEMWelcomeCenterLinks</Setting>",
        "    Skipping unknown child %s below %s",
        "wcscspn",
        "SmiStore::GetSchemaNode",
        ".?AV?$CAutoCleanupBase@PBG@RAII@@",
        "    Attributes for conflicting condition types both specified",
        "    Couldn't set node text for %s",
        "WpxSetting::GetAllowedFileExtensions",
        "  <Setting Path=\"/MediaCenter/MuteTimeout\">",
        "WpxXmlDocument::Initialize",
        "  <Setting Path=\"/Domain/UnattendedJoin/Offline\">",
        "9:9?9D9S9",
        "6/6n6",
        "  <Setting Path=\"/Embedded/Tablet/MultiTouchEnabled\">",
        "2!3(3=3G3",
        "909D9`9s9",
        "    Couldn't write command reboot flag",
        "This node isn't an element, returning NULL",
        "%s for the asset's source path",
        "  <Setting Path=\"/SecureStartup/MaxCryptoRequestsPerIo\">",
        "    Couldn't query allowed passes for %s",
        "1#131>1W1c1h1m1",
        "DeplWpafExporter::ExportSvcUniversalApps",
        "    Failed to initialize SMI setting store",
        "wow64",
        "    Couldn't enumerate child paths below %s",
        "0]0b0g0v0",
        "    Can't read type of value %s",
        "      <Pass>oobeSystem</Pass>",
        "    <Setting>WindowsPlus</Setting>",
        ";/;P;g;u;",
        "    Couldn't get string for reboot option %u",
        "95:F:\\:a:f:q:",
        "WaitForSingleObjectEx",
        "WpxUnattendReader::Read",
        "wpaf:WimImage/wpaf:Path",
        "    Internal IWpxVisibilityStateDesc enumerator failed",
        ">%>B>O>q>v>{>",
        "    Failed to allocate conditions",
        "5r6w6|6",
        "      <Pass>windowsPE</Pass>",
        "3 3:3T3k3x3",
        "7(70787@7L7l7x7",
        "    <Setting>WindowsSlash</Setting>",
        "    Failed to write package description",
        ";*;F;K;P;g;r;",
        "8#8D8I8N8Z8o8",
        ">!>5>N>z>",
        "    <Setting>Clusters</Setting>",
        "4,41464M4W4e4",
        "SelectionNamespaces",
        ".?AUIWpxTargetCondition@@",
        "    Couldn't write dynamic update setting",
        "LayeredDriver",
        "<(<0<<<D<x<",
        "    Unable to parse content of FinishOfflinePhase <Action> node: %s",
        "FinishAuditMode",
        "y-Wjah",
        "2'2?2T2n2",
        "='=,=1=H=R=q=",
        "3n4w5",
        "DeplWpafImporter::ImportAudit",
        "=-=2=7=P=[=p=x=",
        "    <Setting>ShowGallery</Setting>",
        "  <Setting Path=\"/SecureStartup/SlicedEncryptionInPlace\">",
        "    Couldn't write custom partition type",
        ":8:@:H:P:`:",
        "    Couldn't enumerate children of %s",
        "  <Setting Path=\"/Embedded/Tablet/PanningDisabled\">",
        "    Failed to set document namespace prefix for unattend namespace",
        "    <Setting>InstalledBrowserExtensions</Setting>",
        "    Failed to get schema for item of %s",
        "McsfStore::GetSchemaNode",
        "    <Setting>ProductKey</Setting>",
        "        <Setting Path=\"/Connections/Item/Connection/LanguageSpecificIdentifier\" />",
        "WpxXmlDocument::EnableErrorReporting",
        "    Failed to copy string, insufficient buffer.",
        ".?AVWpxWpafReader@@",
        "    <Setting>DisableAntiSpyware</Setting>",
        "%s is missing",
        "8*8/848A8",
        "hCMcsSh",
        "    Failed to iterate over synchronous commands",
        "    Couldn't write package permanence value",
        "<\"<?<D<I<U<o<",
        "6\"6N6s6",
        ".?AV?$CAutoCleanupBase@PAUIWpxVisRuleEnum@@@RAII@@",
        "    WDS installation images must have a destination disk and partition",
        "7!7(7/767=7D7L7T7\\7h7q7v7|7",
        "=%=0=E=`=",
        "  <Setting Path=\"/TerminalServices/DenyTSConnections\">",
        "    Couldn't read value of asset setting %s",
        "    <Setting>MSCompatibilityMode</Setting>",
        "    <Setting>WindowsSpace</Setting>",
        "u:Login",
        "    Failed to get text value from IWpxSchemaAllowedValue",
        "6)7b7}7",
        ".?AVDeplWpafImporter@@",
        "    Failed to write access username",
        "y&VhE",
        "  <Setting Path=\"/InternetExplorer/WelcomeMessage\">",
        "3(4]4",
        "    Unable to query if the setting %s has a display name",
        "Cx;s|r",
        "    Unable to query if the setting %s has a description",
        "    Missing required child element Component",
        "HeapReAlloc",
        "    <Setting>PrivateProfile_LogFile</Setting>",
        "%0`0j0x0",
        "<8<X<",
        "y(VhV",
        "y&Wh8",
        "    Couldn't count list items",
        "    Failed to add %s to path tree",
        "    <Setting>HKLMHistoryPerUserItem</Setting>",
        "    <Setting>EnableAuthenticationTraps</Setting>",
        "    Driver PathAndCredentials missing required Path parameter",
        "    Failed to remove answer object from answer tree",
        "7*7D7i7",
        ";!;.;3;>;[;`;e;q;~;",
        "    <Setting>IEHardenUser</Setting>",
        "<9<R<m<",
        "GetCurrentThreadId",
        "    Failed to get item setting name",
        "MoveFileExW",
        "4$4,484\\4d4l4t4|4",
        "3)4?4L4`4z4",
        "/wpaf:Settings/wpaf:WindowsPE/wpaf:Network/wpaf:Enabled",
        "wpaf:Reboot",
        "    Couldn't load unattend map",
        "?:?Q?k?~?",
        "iswspace",
        "    Failed to check if left schema has a minimum length",
        "    Invalid value %u for WPX_EULA_ACTION",
        "    Couldn't import DataImage",
        "?$?0?T?\\?d?l?t?|?",
        "    Failed to write variant",
        "    <Setting>Gadget4</Setting>",
        "7$7D7]7",
        "    Couldn't import settings from %s",
        "WpxPopulateFromConvergedStore",
        "5B5S5k5p5u5",
        "Deleting temporary Knobs hive at %s ...",
        "  <Setting Path=\"/Setup/DuplicatorDescription\">",
        ".?AV?$CAutoRelease@PAUIWpxVisibilityRule@@@RAII@@",
        "    <ManifestFile>Microsoft-Windows-IE-InternetExplorer.man</ManifestFile>",
        "DataImage",
        "        >Microsoft-Windows-Wlansvc</Component>",
        "?,?<?P?k?",
        "        >Security-Malware-Windows-Defender</Component>",
        ";.<N<S<X<f<",
        "    Invalid drive letter",
        "5#5(5-595[5~5",
        "    Couldn't parse contents of <DataMigration> element",
        "7 7$7(7@7D7X7\\7t7x7|7",
        "    Failed to write destination partition is automatic",
        "5 6D6f6z6",
        ".?AVIntEnum@?1??GetAnsEnumValues@SmiSchemaNode@@UAEJPAPAUIWpxSchemaAllowedValueEnum@@@Z@",
        "DeplWpafExporter::ExportSvcCommands",
        "  <Setting Path=\"/Embedded/Shell/DefaultReturnCodeAction\">",
        "    Couldn't write UpgradeData flag",
        "    <Setting>StartPanelLinks</Setting>",
        ">.>F>S>^>",
        "  <Setting Path=\"/InternetExplorer/AllowedSites\">",
        ",PjRh",
        "    <ManifestFile>shell-sidebar.man</ManifestFile>",
        ": :(:0:4:<:D:H:P:X:\\:d:l:p:x:",
        "RestrictSearch",
        "wpaf:Size",
        "3+3?3K3W3\\3a3",
        "  <Setting Path=\"/Shell/WindowsFeatures\">",
        "y&Vhs",
        "QSVWjL",
        "    <Setting>SyncDomainWithMembership</Setting>",
        ".?AVChildEnum@?1??GetChildrenUnder@WpxStore@@QAEJABVWpxPath@@PAPAUIWpxStringEnum@@@Z@",
        "    Failed to allocate crit",
        "506<6Q6^6",
        "50585D5d5l5x5",
        "Values",
        "343c3",
        "WpxAnsTree::ClearAnswer",
        "DeplWpafExporter::ExportEnvCommands",
        "0,1:1?1R1l1",
        "8-8[8",
        "    Can't specify <DriveLetter> for entries of <CreatedPartitions>",
        "        >Microsoft-Windows-Store-Client-UI</Component>",
        "  <Setting Path=\"/Embedded/KeyboardFilter/AltF4\">",
        "uNPPV",
        "    Invalid setup pass %u",
        "        <Setting Path=\"/Maps/UseSmallerCache\" />",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0`0h0p0x0",
        "WpxConfig::GetPhaseSettings",
        ";#;=;V;t;",
        "    IWpxSetting instance is not an instance of WpxSetting",
        "InstallTo",
        "  <Setting Path=\"/Networking/BridgedInterfaces\">",
        "Microsoft Corporation1.0,",
        "><>_>",
        ":':=:N:k:",
        "y-Phn",
        "    Couldn't get existing child at index %u",
        "1;1`1t1",
        "    Failed to get the host Windows directory",
        "y-VjNh",
        "161D1f1}1",
        "  <Setting Path=\"/SoftwareLicensing/SkipAutoActivation\">",
        "    Failed to write access password",
        "PathFileExistsW",
        "<+<<<S<e<",
        "    Can't query whether setting %s has a maximum length",
        "  <Setting Path=\"/Embedded/KeyboardFilter/F21\">",
        "3#3.3D3P3[3q3}3",
        "SettingNode::SetDefaultText",
        "8 888<8T8X8p8t8",
        "    Couldn't write answer file",
        "wpaf:Description",
        "wpaf:Permanent",
        "WpxValidation::ValidateSettingTree",
        "0+0m0r0w0",
        "WpxConfig::EnumConditions",
        "FormatMessageW",
        "8$8:8E8y8~8",
        "GetModuleHandleW",
        "  <Setting Path=\"/SMBServer/LmAnnounce\">",
        "82878<8K8\\8m8r8w8",
        ":-:H:a:s:",
        "    Couldn't get schema node at path %s",
        "s    Failed to iterate over <component> elements",
        "y3Vh*",
        "yEWhN",
        "  <Setting Path=\"/Embedded/UnifiedWriteFilter/ProtectedVolumeList\">",
        "    Schema hive contained unknown primitive type %s",
        "    Couldn't get error %u",
        "7\"7D7c7h7m7y7",
        "    Couldn't get parent node for %s",
        "    Failed to open knobs store while populating converged store",
        "1!1T1Y1^1m1",
        "        <Setting Path=\"/Power/CustomPowerApplication3/IconID\" />",
        "SettingNode::GetAllowedFileExtensions",
        "DeplWpafExporter::ExportDiskCrit",
        "ModifiedPartitions",
        "        >Microsoft-Windows-TerminalServices-LocalSessionManager</Component>",
        "@wcm:keyValue",
        "        <Setting Path=\"/Power/CustomPowerApplication1/IconID\" />",
        "=,=F=]=j=u=",
        ";C;Y;^;~;",
        "        <Setting Path=\"/Shell/Start/Layout/StartLayout\" />",
        ".?AV?$CAutoCleanupBase@PAVOrderedNodeEnum@DeplUnattendImporter@@@RAII@@",
        "WakeAllConditionVariable",
        ">T>v>",
        "    <Setting>WindowsI</Setting>",
        "6@6W6r6~6",
        "  <Setting Path=\"/Embedded/KeyboardFilter/LaunchMail\">",
        "wpaf:Execute",
        ">)>.>3>?>]>r>",
        "  <Setting Path=\"/Firewall/PublicProfile/DisableNotifications\">",
        "    Couldn't iterate over drivers",
        ">5>:>?>O>",
        "    Failed to allocate store",
        "6-6;6Q6V6[6s6~6",
        "    Failed to add target to variant",
        "ReleaseMutex",
        "u6F;w",
        "y-Shw",
        "    Expected IWpxCondition to be of type WpxCondition",
        "0%020<0A0F0b0h0q0",
        ";:;e;",
        ".?AV?$CAutoCleanupBase@PAUIWpxSetting@@@RAII@@",
        "WpxUnattendWriter::WriteIntSetting",
        "=$=,=4=<=D=L=T=`=",
        "  <Setting Path=\"/BitLocker/DoNotAutomaticallyEncryptDevices\">",
        "6t7{7",
        ".tls$ZZZ",
        ".?AVWpxCafWriter@@",
        "MBSDriverSet",
        "    <ManifestFile>production\\prod_Microsoft-Windows-IE-InternetExplorer.man</ManifestFile>",
        "WpxVisibilityRule::IsSatisfied",
        ";$;,;4;<;D;L;T;\\;d;l;t;|;",
        "FileDescription",
        ";(;3;S;b;",
        "_XcptFilter",
        "  <Setting Path=\"/InternetExplorer/CompatibilityViewDomains\">",
        "1'1,111?1U1`1",
        "WpxOpenStoreFile",
        "90:l:",
        "  <Setting Path=\"/WindowsStore/ContentModifier\">",
        "  <Setting Path=\"/WindowsDefender/DisableAntiSpyware\">",
        "    <Setting>WindowsShiftUp</Setting>",
        "    Failed to allocate m_FoundationPackage",
        ".?AV?$CAutoRelease@PAUIWpxVisibilityRuleDesc@@@RAII@@",
        "    Failed to clear target path from answer object",
        "WINDOWS/VERSION/MINOR",
        "DeplWpafExporter::ExportDriver",
        "*[local-name()='%s' and @%s='%s']",
        "LessThan",
        "    <ManifestFile>TerminalServices-Publishing-WMIProvider.man</ManifestFile>",
        "DeplUnattendImporter::InferImageType",
        "3)3B3Y3f3q3",
        "WpxPathTree::HasChildren",
        "  <Setting Path=\"/Wireless/WiFiToWlan\">",
        "ClusterSize",
        ".?AUIWpxDeplSettings@@",
        "  <Setting Path=\"/InternetExplorer/UserAgent\">",
        "/wpaf:Settings/wpaf:SetupEvents/wpaf:StartAuditMode",
        "5:5D5\\5a5f5r5",
        "868a8|8",
        "  <Setting Path=\"/RemoteAssistance/MaxTicketExpiry\">",
        "727M7p7",
        "    <Setting>DisableStatefulPPTP</Setting>",
        "4@4k4",
        ";O;y;~;",
        "    Couldn't read value of textual setting %s",
        "DeplUnattendImporter::ImportWdsImage",
        "    Can't create IXMLDOMDocument3 instance",
        "    <Setting>ShiftControlEscape</Setting>",
        "e    <pacakage> missing required @action attribute",
        "4*484S4s4x4}4",
        "    Couldn't export data image %u",
        "0&020D0{0",
        ".?AV?$CAutoCleanupBase@PAVSmiSchemaNode@@@RAII@@",
        "5:5P5m5",
        "    Failed to allocate multipleErrorMessages",
        "20201008032758.968Z0",
        " _^[]",
        "y/Phd",
        ".?AVWimStoreEnum@@",
        "    <Setting>InstalledBHOList</Setting>",
        "    <Setting>TCGSecurityActivationDisabled</Setting>",
        "    Couldn't remove attribute %s",
        "    Failed to parse state for target %s",
        "wpaf:Username",
        "    IWpxDriver %s has incomplete access credentials",
        "%s is too long",
        "DeplUnattendExporter::ExportServicing",
        "/wpaf:Settings/wpaf:SysprepGeneralize",
        "    <Setting>StoreContentModifier</Setting>",
        "    <Setting>LeftShiftLeftAltNumLock</Setting>",
        "    Couldn't import <package>",
        "3$3:3",
        "5 6%6E6e6",
        "  <Setting Path=\"/Embedded/KeyboardFilter/BrowswerBack\">",
        "  <Setting Path=\"/UserAccountControl/Enabled\">",
        "4/4;4@4E4s4",
        "    Value for Validate/Option must 0 or 1 for boolean settings",
        "2.2L2h2q2|2",
        "        <Setting Path=\"/DeviceManagement/Policies/OMACP/UsernetwpinRoles\" />",
        "WINDOWS/EDITIONID",
        ".?AUIWpxDeplSvcSettings@@",
        "    <Setting>PublicProfile_LogFile</Setting>",
        "5,5<5L5\\5l5|5",
        "WpxSetting::NumListItems",
        "    Failed to initialize schema hive node for %s",
        "    <Setting>RegisteredOwner</Setting>",
        "jaZjz",
        ".?AV?$CAutoRelease@PAUIWpxTargetCondEnum@@@RAII@@",
        "00040L0P0h0l0",
        "    Couldn't iterate over created <Partition> elements",
        ".?AUIWpxTargetState@@",
        "f91uIf",
        "0<0A0F0R0v0{0",
        "@deprecated",
        "0?0_0}0",
        "    Failed to export driver %u",
        "  <Setting Path=\"/SecureStartup/WriteIoAggregateMinSize\">",
        "    Failed to enumerate visibility rules, will return FALSE",
        "TargetRefs",
        "627<7[7l7",
        "    Couldn't get system temp path",
        "?(?,?D?H?`?d?|?",
        "    Failed to allocate visibilityState",
        "  <Setting Path=\"/ErrorReporting/DisableWER\">",
        "7$7,747<7D7L7T7\\7d7l7x7",
        "6D6w6",
        "        <Setting Path=\"/DeviceManagement/Policies/OMACP/UserpinRoles\" />",
        "    <Setting>UserLocale</Setting>",
        "AnsMinLength",
        "amd64",
        "    .sku.xml missing required field /WpxStore/Version",
        "7&8O8T8Y8e8",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsSpace\">",
        "DataImages",
        "wcsncpy_s",
        "        <Setting Path=\"/Connections/Item/Connection/Enabled\" />",
        "7.73787D7Q7V7[7g7",
        "747M7]7r7",
        "    Couldn't parse validation information",
        ">&>W>b>n>",
        "/u:unattend",
        "7<7A7F7R7",
        "R!s4Z",
        "0-090>0C0o0t0y0",
        ":@:J:",
        "  <Setting Path=\"/OutOfBoxExperience/Options\">",
        "    Failed to rerieve SMI setting %s for %s",
        "    Failed to read variant settings",
        "%s.%s",
        "L$ QQ",
        "WpxSetting::Release",
        "    <Setting>EnableCaptureMonitor</Setting>",
        "  <Setting Path=\"/NetBIOS/Interfaces\">",
        "    <ManifestFile>ErrorReportingCore.man</ManifestFile>",
        "    <Setting>WindowsHome</Setting>",
        "    <Setting>PreventDeviceEncryption</Setting>",
        "    Failed to move item %llu to %llu",
        "t    Failed to allocate schema",
        "WIMGAPI.DLL",
        "    Failed to allocate doc",
        "< <6<;<@<L<",
        "    Failed to iterate over packages",
        "AnsMaxLength",
        "    Failed to allocate ref",
        "  <Setting Path=\"/Embedded/UnifiedWriteFilter/OverlayWarningThreshold\">",
        "g    Failed to allocate setting",
        "2$3:3Y3^3c3n3{3",
        "    Couldn't remove old path %s from path tree",
        "    Couldn't export log directory",
        "wpaf:TargetState",
        "  <Setting Path=\"/Embedded/KeyboardFilter/Ctrl\">",
        "182E2]2",
        ">%>>>P>i>v>",
        "    Failed to allocate net",
        "8(868L8Q8V8b8q8",
        "    Couldn't write partition processing order",
        "9,999L9U9",
        "    <ManifestFile>TCPIP.man</ManifestFile>",
        "6(6R6W6\\6j6",
        ".?AV?$CAutoCleanupBase@PAX@RAII@@",
        "%hs!%p: ",
        "    Couldn't parse %s as a boolean",
        "wpaf:AccessCredentials",
        "    <Setting>RadioLocation</Setting>",
        "    Can't specify <Label> for an item in <CreatedPartitions>",
        "DynamicUpdate",
        "OnRequest",
        "WVhH2",
        "  <Setting Path=\"/Tablet/MultiTouchEnabled\">",
        ".?AV?$CAutoRelease@PAUIWpxDeplExporter@@@RAII@@",
        "  <Setting Path=\"/InternetExplorer/TrustedSites\">",
        "9$:):.:E:O:d:i:n:",
        "1 101@1P1`1p1",
        "    <Setting>DisplayNetworkSelection</Setting>",
        "DEBUG: Failed to parse XML:",
        ".?AUIWpxSchemaStore@@",
        "0 0(00080@0L0T0l0|0",
        "0$0)0M0b0|0",
        "Provisioning",
        "    Failed to load document at %s",
        "    <Setting>CustomPowerApplication4</Setting>",
        "=,=:=P=U=Z=e=s=",
        "0,0<0D0L0T0\\0d0l0t0|0",
        "=*=/=4=?=L=W=o=",
        "  <Setting Path=\"/HelpAndSupport/OnlineSupportIconDescription\">",
        "    Couldn't write audit mode script payload path",
        "    <Setting>FlyoutPowerSaverPowerScheme</Setting>",
        "  <Setting Path=\"/Shell/ClientApplications\">",
        "source",
        ": ;3;P;c;",
        "u:Mode",
        "606:6T6_6~6",
        "1/0-0",
        ".?AVWpxSetting@@",
        ">$>G>L>Q>]>g>s>",
        "4,41464B4X4q4z4",
        "='>S>X>]>o>",
        ">->j>",
        "?'?2?Q?V?[?g?",
        ".?AV?$CAutoCleanupBase@PAUIWpxVisibilityStateDesc@@@RAII@@",
        "DeplUnattendImporter::ImportPackage",
        "    <ManifestFile>Microsoft-Windows-ServerManager-SvrMgrNc.man</ManifestFile>",
        "  <Setting Path=\"/Firewall/Groups\">",
        "TlsSetValue",
        "y)VhE",
        ".?AVbad_alloc@std@@",
        "7\"8'8,888M8e8j8o8{8",
        "Display/Resolution/Height",
        "false",
        "WpxVisibilityRule::EvalValueAreEqual",
        "    Failed to create new target '%s'",
        "4C4H4M4Y4",
        "QVWjH",
        "_onexit",
        "6?6D6I6a6u6",
        "6(6H6h6",
        "94:`:",
        ".?AUIWpxSettingEnum@@",
        "    Couldn't get variant condition object",
        "6(646H6g6t6",
        "7#7;7\\7o7",
        "<%<J<X<n<",
        "        <Setting Path=\"/Connections/Item/Connection/IPType\" />",
        "wpaf:FilePath",
        "Common",
        "6O6T6Y6k6",
        "Install",
        "wpaf:CreatedPartitions/wpaf:Partition",
        "    Error initializing map data.",
        "6\"6a6",
        "494C4O4[4`4e4",
        ";&;,;F;b;",
        "KnobsStore::Release",
        "  <Setting Path=\"/Embedded/KeyboardFilter/VolumeMute\">",
        "707F7V7g7",
        "    Failed to allocate wds",
        ";?;U;o;~;",
        "    Incomplete feature specified (must have both name and state)",
        "DeplWpafExporter::ExportInsDisks",
        "FileName",
        "    Couldn't write vertical resolution",
        "9G:g:",
        "  <Setting Path=\"/InternetExplorer/FavoritesList\">",
        "    Extend is mutually exclusive with Size",
        "    Couldn't validate key %s for map %s",
        ">\">z>",
        "Paths",
        "RtlDisownModuleHeapAllocation",
        "SystemLocale",
        "7 707B7M7p7",
        "$`2X`F",
        "/wpaf:Settings/wpaf:AuditMode/wpaf:CustomCommands",
        "0$0,040<0D0L0T0\\0d0l0t0|0",
        "M0K0I",
        "WpxXmlNode::RemoveAttribute",
        "949<9D9L9T9\\9d9l9t9|9",
        "    Failed to parse target state condition",
        "    Couldn't serialize setting",
        "        >Microsoft-Windows-TerminalServices-Publishing-WMIProvider</Component>",
        "9$919Z9_9d9o9",
        "??1type_info@@UAE@XZ",
        "G;~ r",
        "0+10151A1f1k1p1|1",
        "        <Setting Path=\"/Messaging/PerSimSettings/__ICCID/UserAgentString\" />",
        "Disk/Initialize",
        "    <Setting>DisableExpressSetup</Setting>",
        "=\">B>\\>",
        "  <Setting Path=\"/MediaCenter/Timeout\">",
        "    Couldn't import feature",
        "SearchDirectories",
        "4 4$484<4T4X4\\4p4",
        "516=6O6e7",
        "9C9W9v9",
        "    <Setting>WindowsK</Setting>",
        "j9XWPh",
        "    Couldn't sort data images",
        "        <Setting Path=\"/Shell/Themes/ScreenSaver\" />",
        "    <Setting>CreateEncryptedOnlyTickets</Setting>",
        "wpaf:Type",
        ".edata",
        "WpxSetting::GetAnsEnumValues",
        "7*7U7k7",
        "WpxUnattendReader::ReadPass",
        "GetHiveKey",
        "5:5?5D5P5",
        "    <Setting>HKLMConnectTimeOut</Setting>",
        "u:SystemLocale",
        ":0:8:H:l:t:|:",
        "  <Setting Path=\"/MediaCenter/Color\">",
        "DeplWpafExporter::ExportUniversalApp",
        "    <ManifestFile>EmbeddedAppLauncherSMI.man</ManifestFile>",
        "    <ManifestFile>production\\mobilecore_prod_Audio-AudioCore.man</ManifestFile>",
        ".00cfg",
        "Validation",
        "    Couldn't export synchronous command %u",
        "    Failed to write Compact flag",
        "4*4R4n4w4",
        "%s: Malformed drive letter '%s' specified for %s",
        "    <ManifestFile>internal_Microsoft-Windows-IE-InternetExplorer.man</ManifestFile>",
        "  <Setting Path=\"/Embedded/KeyboardFilter/MediaNext\">",
        "        <Setting Path=\"/InternetExplorer/FirstRunUrl\" />",
        "323M3s3",
        "Ch;slr",
        "    <Setting>BrowserHome</Setting>",
        "    Unknown answer file type %u",
        "    <ManifestFile>HelpAndSupport.man</ManifestFile>",
        "wpaf:CustomCommands/wpaf:Synchronous/wpaf:Command",
        "stage",
        ".?AVWpxRunCommand@@",
        "3&3+3@3I3W3j3z3",
        "x=F;w",
        "  <Setting Path=\"/Power/CustomPowerApplication1\">",
        "5/5I5e5t5",
        "    Couldn't add <%s> element to document",
        "    Failed to write target value",
        "    <Setting>BrowserForward</Setting>",
        "t    Failed to allocate comp",
        "        <Setting Path=\"/Connections/Item/Connection/Roaming\" />",
        "<>\"|?*",
        "  <Setting Path=\"/InternetExplorer/PrivacyAdvisorMode\">",
        "0'1~1",
        "Exception",
        "/u:unattend/u:settings[@pass='offlineServicing']/u:component[@name='Microsoft-Windows-PnpCustomizationsNonWinPE']/u:DriverPaths",
        "%s~%s~%s~%s~%s",
        "permanence",
        "SetupEvents",
        "    Couldn't parse boolean value %s for WillWipeDisk",
        ".?AVWpxFeature@@",
        "5.585H5`5t5",
        "REG_SZ",
        "    Couldn't determine edition for store file %s",
        "WilError_03",
        "  <Setting Path=\"/MediaCenter/ShowGallery\">",
        "        <Setting Path=\"/Email/DefaultBackgroundThemeSetting\" />",
        ".?AV?$CAutoRelease@PAVWimStoreEnum@@@RAII@@",
        "  <Setting Path=\"/Firewall/DomainProfile/LogDroppedPackets\">",
        "=#=;=Q=z=",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsDown\">",
        "    <Setting>OEMWelcomeCenter</Setting>",
        "QVWjP",
        "8%8>8R8W8d8",
        "    <Setting>DescriptionText2</Setting>",
        "Description",
        "McsfLeafNode::GetDefaultText",
        "  <Setting Path=\"/MediaCenter/DisableExpressSetup\">",
        "  <Setting Path=\"/NetworkProxy/HKLMProxyEnable\">",
        "    <ManifestFile>wdf01000.man</ManifestFile>",
        "Pj{h|7",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsQ\">",
        "WpxTargetState::AddRangeCondition",
        "5%6/6<6`6|6",
        "    Failed to parse top-level setting %s",
        "1<1D1L1X1|1",
        "    Scheduled %s to be deleted on next boot.",
        "    Couldn't set <component> @language attribute",
        "    <Setting>WAUSetupLocation</Setting>",
        ".CRT$XIZ",
        "    <Setting>AltF4</Setting>",
        "WpxWpafWriter::WritePhaseSettings",
        "        <Setting Path=\"/Shell/Start/Item/PrepinnedTile/MSAppID\" />",
        "y&Vh|",
        "7(7<7M7o7",
        ":6:J:{:",
        "2#3?3D3I3U3j3",
        "    Failed to write destination disk",
        "u@hCM26Sh",
        "DeplWpafImporter::ParseInt",
        "    <Setting>MaxTicketExpiry</Setting>",
        ".?AUIWpxVariantEnum@@",
        "        <Setting Path=\"/Power/CustomPowerApplication2/Application\" />",
        "6*6>6I6n6",
        "    <Setting>WindowsEnter</Setting>",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:DynamicUpdate/u:Enable",
        "3-3C3N3q3v3{3",
        ":+:[:g:l:q:",
        "    <ManifestFile>WwanUI.man</ManifestFile>",
        ":S:c:",
        "    <Setting>VolumeDown</Setting>",
        "    <Setting>DisableKeyboardFilterForAdministrators</Setting>",
        "    Failed to add <TargetRefs> to document tree",
        ".?AV?$CAutoCleanupBase@PAVWpxXmlNodeEnum@@@RAII@@",
        "        <Setting Path=\"/WeakCharger/NotifyOnWeakCharger\" />",
        "wpaf:Display/wpaf:Resolution/wpaf:Height",
        "  <Setting Path=\"/OnlineBackup/ProviderName\">",
        "    Failed to get source for declaration %s",
        "Layout",
        "8$8,848<8D8L8T8\\8d8l8t8|8",
        ";E;j;o;t;",
        "WpxConfig::GetPassCondition",
        "    Couldn't add path for map value %s to the path tree",
        "%llu Bytes",
        "onecore\\base\\ntsetup\\wpx\\core\\aggregation.cpp",
        "1 131`1~1",
        ".?AV?$CAutoRelease@PAVSmiStore@@@RAII@@",
        "    Couldn't serialize filesystem %u",
        "e    Failed to mount SMI schema hive",
        "    <Setting>DomainSecretKeyPersisted</Setting>",
        "5$505P5X5`5h5t5",
        "s    Failed to allocate groups",
        "6\"6.696O6g6r6~6",
        "/wpaf:Settings/wpaf:Provisioning/wpaf:Packages",
        "879O9[9m9",
        "GreaterEqual",
        "@publicKeyToken",
        ".?AV?$CAutoCleanupBase@PAUIWpxIntEnum@@@RAII@@",
        "90959:9Q9\\9u9z9",
        "  <Setting Path=\"/Power/FlyoutPowerSaverPowerScheme\">",
        "8 8(80888@8H8T8t8|8",
        "42474<4H4Z4o4",
        "DeplWpafExporter::GetEventNode",
        "    Couldn't read answer file",
        "DeplWpafImporter::ImportFeature",
        "3E4l4",
        "  <Setting Path=\"/Embedded/Shell/Executable\">",
        "  <Setting Path=\"/Embedded/KeyboardFilter/BrowswerSearch\">",
        "    WIMBoot InstallTo disk must have a single Index=(...) criterion",
        "y VjVh",
        "    Can't specify both a WIM index and general WIM metadata",
        "    Couldn't write InstallToAvailablePartition",
        "_vsnwprintf",
        "=)=6=P=g=",
        "onecore\\base\\ntsetup\\wpx\\smi\\smihive.cpp",
        "    %s is not allowed in deploy phase %u",
        "969;9@9M9`9}9",
        "    Failed to check if right schema enumerates allowed values",
        "</WpxUnattend>",
        "    Couldn't export display settings",
        "wpaf:CustomDataFile",
        ";'<@<E<J<X<g<s<x<}<",
        "RegistrySource",
        "restriction\\maxInclusive",
        "4%4*4/4;4j4",
        "    Failed to enumerate child setting names",
        "9 989X9]9b9p9",
        "    Can't set IXMLDOMDocument3::async",
        "    Failed to check if right schema has a default value",
        "    Couldn't parse content of <EnableDiagnostics> node",
        ";3;8;=;T;^;{;",
        "    Failed to allocate variants",
        "    Couldn't add <settings> node to document",
        "WpxSmiHive::FindSettingDecl",
        ".?AVWpxPackagePath@@",
        "    Failed to enumerate entries in unattend map",
        "9]:g:",
        "(caller: %p) ",
        "yDShI",
        "SleepConditionVariableSRW",
        "    Incomplete <Credentials> (username and password are required",
        "Component",
        ":B;I;U;",
        "3\"4=4",
        "8!9L9",
        ">:>?>D>P>o>t>y>",
        "UserExperienceHint",
        "SysNative",
        "Gp_[]",
        "        <Setting Path=\"/Shell/Themes/BrandIcon\" />",
        "    <Setting>DisableWER</Setting>",
        "HorizontalResolution",
        "ClosestTo",
        "%s: Inside node %s, '%s' is not a recognized value",
        "?#?8?M?^?t?",
        "WpxConfig::GetCommonSettingSchema",
        "Credentials",
        "1*1=1Z1_1d1p1",
        "onecore\\base\\ntsetup\\wpx\\file\\unattendwriter.cpp",
        "    Couldn't parse size string as a byte count",
        "        >Microsoft-Windows-shwebsvc</Component>",
        "    <ManifestFile>production\\prod_WMPPlayer.man</ManifestFile>",
        "/wpaf:Settings/wpaf:Servicing/wpaf:Features",
        "    Failed to write answered setting %s",
        "QQhH{",
        "    Couldn't convert WPX_EULA_ACTION %u to a string",
        "action",
        "WpxSetting::GetMapKeyPattern",
        "  <Setting Path=\"/SharedAccess/EnableICS\">",
        "    ProvisionDisk can only be specified with an 'Automatic' partition",
        "install",
        "3\"3,383D3I3N3",
        "?#?S?`?t?",
        "2O2T2Y2e2",
        "3ntdll.dll",
        "WpxStore::CheckAreCompatible",
        "  <Setting Path=\"/Embedded/KeyboardFilter/ShiftWin\">",
        "  <Setting Path=\"/WindowsAnytimeUpgrade/SetupLocation\">",
        "    <Setting>BrowserBack</Setting>",
        "    Failed to allocate config",
        ".?AV?$CAutoCleanupBase@PAVWpxConfig@@@RAII@@",
        "  <Setting Path=\"/MediaCenter/UseDefaultOverscanMargins/ForCurrentUser\">",
        "9%9D9I9N9e9o9",
        "    Couldn't write product key",
        "wcspbrk",
        ".?AVEmpty@?1??GetVisibility@McsfTreeNode@@UAEJPAPAUIWpxStateDescEnum@@@Z@",
        "wpaf:FillSpace",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsT\">",
        "    Couldn't iterate over paths below %s",
        "    Couldn't export provisioning commands",
        "s    Failed to allocate audit",
        "3(3C3a3t3",
        "WpxXmlNode::InsertChild",
        "    Failed to recursively remove paths below %s",
        "    Couldn't export package path",
        "    Failed to get setting, won't log error details",
        "    <Setting>MediaPrev</Setting>",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsUp\">",
        "    Couldn't iterate over modified <Partition> elements",
        "        >Networking-MPSSVC-Svc-MobileCore</Component>",
        ">2><>A>F>p>",
        "/wpaf:Settings/wpaf:Servicing/wpaf:Packaging",
        ".?AV?$CAutoRelease@PAVWpxSmiSetting@@@RAII@@",
        "1'1N1]1x1",
        "?3?J?X?o?",
        "    <ManifestFile>RasServer.man</ManifestFile>",
        "    Couldn't iterate over path nodes",
        "?terminate@@YAXXZ",
        "9,9n9",
        "3$4?4k4",
        "; ;D;L;T;\\;d;l;t;|;",
        "    Failed to allocate settings",
        "WpxXmlNode::SetText",
        "717F7[7q7v7",
        "    Couldn't get WPX_DEPLOY_PHASE at index %u",
        "    <Setting>InternalAdapter</Setting>",
        "onecore\\base\\ntsetup\\wpx\\mcsf\\mcsfleafnode.cpp",
        "6#6.6J6l6",
        "y%ShD",
        "EnableAuditMode",
        "wpaf:Find",
        ".?AV?$CAutoCleanupBase@PAUIWpxStringEnum@@@RAII@@",
        "GetProcAddress",
        "WpxConfig::FindSchema",
        "  <Setting Path=\"/InternetExplorer/ESC/EnableOnAllAccounts\">",
        "    <ManifestFile>snmp.man</ManifestFile>",
        "y%Sh!",
        "%s: (no details available)",
        "    <Setting>EnableOnlineBackup</Setting>",
        "WpxGetFileEdition",
        "1(2-222=2a2f2k2v2",
        "    Failed to allocate pnp",
        "<*<o<",
        "    Failed to allocate async",
        "    Failed to enumerate variant's target references",
        "j6XSPh",
        "?&?Y?^?c?q?",
        "4J5w5",
        ".?AUIWpxSettingIssue@@",
        "    %s: Can't marshal (WPX_SMI_TYPE)%u as a bool",
        "    Failed to allocate ev",
        "        >Microsoft-Windows-Sidebar</Component>",
        "1Y2|2",
        "DeplWpafExporter::ExportCommand",
        ".?AV?$CAutoCleanupBase@PAVWpxEdition@@@RAII@@",
        "y#Wh'",
        "  <Setting Path=\"/ServerManager/DontLaunchAtLogon\">",
        "    Couldn't set WIM scratch directory",
        "onecore\\base\\ntsetup\\wpx\\core\\validation.cpp",
        "464_4",
        "4-4A4G4",
        "    <Setting>ControlWindowsF</Setting>",
        "wcsspn",
        "y?PjEh",
        "54585P5`5p5",
        "1%1*1/1:1K1",
        "8\"8)80878>8E8L8R8^8i8n8s8y8",
        ".?AV?$CAutoRelease@PAUIWpxSetting@@@RAII@@",
        "5;5[5",
        "Customizations",
        ".?AUIWpxDiskCriterion@@",
        "        >Microsoft-Windows-PerfCenterCPL</Component>",
        "0$0,040<0D0L0T0\\0d0l0x0",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:PageFile",
        "  <Setting Path=\"/InternetExplorer/ShowMenuBar\">",
        "  <Setting Path=\"/Embedded/Logon/HideAutoLogonUI\">",
        ":$:,:4:<:D:L:T:\\:d:l:t:|:",
        ".?AV?$CAutoRelease@PAVWpxEdition@@@RAII@@",
        "  <Setting Path=\"/InternetExplorer/Accelerators\">",
        "    Can't specify an existing partition index on a <CreatedPartitions> entry",
        "    Couldn't parse value %s as a partition type",
        "5&5+505=5H5`5z5",
        "    Couldn't export created partition %u",
        ".?AVEnumerator@?1??GetMapKeyEnumValues@SettingNode@@UAEJPAPAUIWpxSchemaAllowedValueEnum@@@Z@",
        "WpxXmlDocument::SelectNodes",
        "    Found but could not load resource %s",
        "    Setting %s has no child named %s",
        "Reseal",
        "    %s: Can't marshal (WPX_SMI_TYPE)%u as a string",
        "u:Format",
        " Windows",
        "    Couldn't get node tree for phase %u",
        ".?AVChildEnum@?1??GetChildren@WpxSetting@@UAEJPAPAUIWpxSettingEnum@@@Z@",
        "    <Setting>PublicProfile_LogSuccessfulConnections</Setting>",
        ".?AV?$CAutoCleanupBase@PAUIWpxTargetStateEnum@@@RAII@@",
        "        <Setting Path=\"/Shell/Start/Layout/FeaturedTile\" />",
        "1'1B1a1v1",
        "xmlns:%s",
        "Microsoft-Windows-Setup",
        "    Couldn't convert partition type %u to a string",
        "    Failed to parse XML for item of %s",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:EnableFirewall",
        "5&5@5[5q5",
        "L$HVP",
        "    Couldn't check if map key has a minimum length",
        "    Failed to iterate over child names",
        "    <Setting>SignatureUpdateInterval</Setting>",
        "    Unrecognized file extension in image path: %s",
        "u:WillWipeDisk",
        "@displayName",
        "SysprepGeneralize",
        "757[7`7e7q7",
        "8%8*8/8:8O8b8w8|8",
        "License",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-International-Core-WinPE']",
        ": :@:H:T:t:|:",
        "<=<\\<",
        "    Got non-integer IWpxSchemaAllowedValue from schema IWpxSchemaAllowedValueEnum",
        "wpaf:SharedLocalDataFile",
        "wpaf:ProductKey",
        "  <Setting Path=\"/SoftwareLicensing/ReferralId\">",
        "ValidateSettingAgainstInfo",
        "y+Wh]",
        "    Failed to record asset source path %s",
        ".?AVEnum@?1??EnumRules@WpxVisibilityState@@UAEJPAPAUIWpxVisRuleEnum@@@Z@",
        "s    MapKey enumerator failed",
        "SymbolicLinkValue",
        "?+?I?y?~?",
        "WpxSetLogger",
        "e    Failed to allocate lang",
        "    Couldn't check whether %s has a map value friendly name",
        "Sleep",
        "IgnoreCheck",
        "2:2?2D2U2",
        "    <Setting>AssociationData</Setting>",
        "    Can't get setting at input path %s",
        "  <Setting Path=\"/Licensing/ReferralID\">",
        "    <Setting>SidebarVisible</Setting>",
        "> ?%?*?6?O?j?",
        "DeplUnattendImporter::ImportWinPESetup",
        "    Failed to allocate keyName",
        ".?AV?$CAutoFreeResource@PAX@RAII@@",
        "7*7/747?7R7c7o7{7",
        "4*4/444@4",
        "    Couldn't validate answer for %s",
        "    Couldn't add setting path %s to the path tree",
        "    TargetStates: Argument cannot be NULL",
        "wpaf:Settings",
        "<#=B=w=",
        "DeplWpafExporter::ExportSession",
        "    Couldn't parse boolean value %s for Active",
        "%s: Map key attribute %s for node %s is invalid or missing",
        "WpxCreateReadOpt",
        "    Couldn't get textual value for allowed value %s of %s",
        "    Can't read %s",
        "3$3)373J3V3`3~3",
        "7(8A8",
        "696L6`6|6",
        ">#?<?\\?a?f?u?",
        "    <Setting>ReadDoubleBuffering</Setting>",
        "    <Setting>PrivateProfile_LogDroppedPackets</Setting>",
        "u:Order",
        "    Key: Argument cannot be NULL",
        "WpxConfig::EnumVariants",
        "0#0M0X0d0",
        "F^9_dv.",
        ".?AUIWpxVisStateEnum@@",
        "    Couldn't add new path %s to path tree",
        "    <Setting>UninstallWindowsRE</Setting>",
        "ubyte",
        ".CRT$XIA",
        "9+9S9b9y9",
        "    Couldn't parse %s as a SKU XML file",
        "u:InstallTo",
        "0I0p0",
        "?!?-?2?7?Q?p?u?z?",
        "    Failed to initialize WpxSmiSetting for child %s",
        "    Incomplete find disk criterion specified",
        ";L;Q;V;d;",
        "  <Setting Path=\"/RemoteAccess/ConfigurationFlags\">",
        "    Failed to allocate settingSchema",
        "    Skipping unknown setting %s under component %s",
        "  <Setting Path=\"/Firewall/PrivateProfile_LogDroppedPackets\">",
        "TlsAlloc",
        ";0;J;j;y;",
        "3 414H4|4",
        "    <ManifestFile>production\\prod_Security-SPP.man</ManifestFile>",
        "    Failed to check if the current process is WOW64",
        "=,=Y=t=",
        ".?AVWpxWriteOpt@@",
        "=O=T=Y=d=r=",
        "383=3B3N3t3",
        "@default",
        "    Internal error: ReadSettingValue should not be called for settings of type %u",
        "    <Setting>WriteSubrequestLength</Setting>",
        ".text$di",
        "?\"?'?3?",
        "    Failed to iterate over child paths below %s",
        "MapKeyMinLength",
        ";-;h;u;",
        ";';4;?;X;l;y;",
        ";@<k<",
        "    Couldn't write app description",
        "  <Setting Path=\"/Firewall/DomainProfile_LogFile\">",
        "wpaf:Network/wpaf:FirewallEnabled",
        "121K1W1b1y1",
        "PartitionID",
        "Disabled",
        "    Couldn't write audit mode temporary computer name",
        ".?AVFilter@?1??FilterKeyNameFromChildNames@SmiStore@@AAEJPAUIWpxStringEnum@@PBGPAPAU3@@Z@",
        "  <Setting Path=\"/NetworkProxy/HKLMHistoryPerUserItem\">",
        "<+<R<n<s<x<",
        "DeplUnattendExporter::GetComponentNode",
        "    Failed to get textual value for allowed map key",
        "<+<L<Q<V<a<w<",
        "        <Setting Path=\"/Connections/Item/Connection/Password\" />",
        "11161;1G1j1s1",
        "    Failed to enumerate child paths under %s from unattend map",
        "4$424P4^4",
        "4)4L4a4z4",
        "    Couldn't create deployment setting exporter for unattend",
        "    <Setting>ControlEscape</Setting>",
        "    Couldn't get item %s of %s",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-International-Core-WinPE']/u:SystemLocale",
        "    Index %llu is out of range (%s has %llu items)",
        "    Malformed excluded setting: missing path attribute",
        "    <Setting>CommandLabelDisplay</Setting>",
        "    <Setting>Link1</Setting>",
        "Visibility",
        "5-5\\5y5",
        "y;Wh/",
        "6.6I6n6",
        "WpxConfig::EnumConditions::ConditionEnum::GetNext",
        "y+Vh|",
        "8 8$8(8@8D8X8\\8t8x8|8",
        "        >Microsoft-Windows-CoreSystem-SharedAccess</Component>",
        "_callnewh",
        "6O6]6o6",
        "WpxConfig::RemoveTarget",
        "< =<=X=p=",
        "Microsoft-Windows-International-Core-WinPE",
        "  <Setting Path=\"/Firewall/PublicProfile_LogFile\">",
        "Driver",
        "DeplUnattendExporter::ExportEnvDisplay",
        "  <Setting Path=\"/Embedded/Tablet/TouchUISize\">",
        "d    Can't export a run command without a Command set",
        "4$484S4z4",
        "495U5u5",
        "2*2/242A2\\2n2",
        "    <ManifestFile>Microsoft-Windows-SensorsAPI.man</ManifestFile>",
        "=4=d=}=",
        "/u:unattend/u:settings[@pass='specialize']/u:component[@name='Microsoft-Windows-Deployment']",
        "WpxConfig::LoadWimStores",
        "    Couldn't read element %u of path %s",
        ".?AVEmpty@?1??GetVisibility@McsfLeafNode@@UAEJPAPAUIWpxStateDescEnum@@@Z@",
        "        >Product-mobilecore__Microsoft-Windows-Audio-AudioCore</Component>",
        ";.;<;O;Y;",
        "    Failed to load unattend path map",
        "/u:unattend/u:settings[@pass='auditSystem']/u:component[@name='Microsoft-Windows-Deployment']/u:Reseal",
        "1-1J1_1d1i1w1",
        ".idata$2",
        "  <Setting Path=\"/Storage/DisableAutomaticDiscEncryption\">",
        "9<9X9",
        "    Failed to remove item %llu of %s",
        "        >Product-moderncore__Microsoft-Windows-Audio-AudioCore</Component>",
        "    Failed to write image destination drive",
        "WpxSetting::GetMapKeyEnumValues",
        "= =0=4=D=H=X=\\=l=p=",
        "    Expected IWpxCondition object to be an instance of WpxCondition",
        "u:Path",
        "4\"4'4>4I4s4",
        "    Failed to get allowed value reference for setting %s",
        "  <Setting Path=\"/OnlinePrinting/Description\">",
        "?*?@?V?f?z?",
        "    Failed to get Answer values.",
        "        >Microsoft-Windows-HelpAndSupport</Component>",
        "y%Whx",
        "WpxUnattendReader::ReadPasses",
        "  <Setting Path=\"/TerminalServices/LicensingMode\">",
        "WpxConfig::Clone",
        "    Couldn't write text setting %s",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:ImageInstall",
        "    Failed to write max value",
        "WpxConfig::CreateVariant",
        "5+6S6f6",
        "    Asset %s has a target path, but it could not be retrieved",
        "WpxSmiOpenSystemStore",
        "ProductVersion",
        "~(_^]",
        "0(050M0",
        "53585=5I5`5k5",
        "    <Setting>UserSettings</Setting>",
        "WpxWpafWriter::WriteSetting",
        "y.Vhk",
        "6!6G6w6",
        "d    Missing required ",
        "Private",
        "    Couldn't read the current scratch directory",
        "WpxConfig::FilterAnswerTree",
        "        <Setting Path=\"/AutomaticTime/NTPRetryInterval\" />",
        "    <Setting>OverlayType</Setting>",
        "    <Setting>OEMName</Setting>",
        ">4?^?q?",
        "    Couldn't import SetupEvents section",
        "    Unhandled SMI class %u",
        "?$?D?b?{?",
        "McsfStore::GetChildrenUnder",
        "Permanent",
        "7.797",
        "t    Couldn't get document element",
        "KnobsAllowedValue::GetIntValue",
        ";I;|;",
        "<7<K<V<n<",
        "    <Setting>DisableBootMenu</Setting>",
        "    Target '%s' redefines an existing target",
        "ParseHex",
        "    Couldn't retrieve validation issue",
        "Label",
        "    Failed to export synchronous command %u",
        "WpxWpafReader::ReadTargetCondition",
        "O0M0K",
        ";!;&;D;I;N;\\;p;",
        "    Couldn't read value of binary setting %s",
        "SjOh4j",
        "FreeResource",
        "151R1p1",
        "        >Product-onecore__Microsoft-Windows-Audio-AudioCore</Component>",
        "    <ManifestFile>microsoft-windows-deviceguard-wmi.man</ManifestFile>",
        ": :O:k:",
        ".?AV?$CAutoHeapFree@PAG@RAII@@",
        "    Failed to load answer file",
        "Default",
        "/wpaf:Settings/wpaf:Provisioning/wpaf:UniversalApps",
        "    Couldn't get WpxCondition object for the given variant",
        "WpxWpafWriter::WriteIntSetting",
        ".?AVWpxDisk@@",
        "    Couldn't set node text",
        ".?AV?$CAutoCleanupBase@PAUIWpxRuleDescEnum@@@RAII@@",
        "  <Setting Path=\"/Power/CustomPowerApplication5\">",
        "1/191k1",
        "Initialize",
        ".?AV?$CAutoRelease@PAVWpxXmlDocument@@@RAII@@",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        "=5=:=?=J=Z=k=w=",
        "    Failed to check if right schema has a maximum length",
        "y/Vhf",
        "/u:unattend/u:settings[@pass='auditUser']/u:component[@name='Microsoft-Windows-Deployment']/u:Reseal",
        "97:L:Q:V:b:",
        "    Failed to write shared local data file",
        "Recovery",
        "    <Setting>ThreatSeverityDefaultAction</Setting>",
        "        <Setting Path=\"/Messaging/PerSimSettings/__ICCID/TargetVideoFormat\" />",
        ">(?T?Y?^?j?",
        "    <Setting>AllowedSites</Setting>",
        "WpxUnattendWriter::WritePhaseTree",
        ".?AUIWpxTargetEnum@@",
        "  <Setting Path=\"/Embedded/UnifiedWriteFilter/TSCALPersisted\">",
        "WpxGetSystemScratchDirectory",
        "<#<8<Y<y<",
        "/wpaf:Settings/wpaf:Customizations/wpaf:Targets/wpaf:Target",
        "    Couldn't iterate over provisioning commands",
        "    MetaData not allowed because the image is not a WIM file",
        "    Can't create a unique scratch file name",
        "WIB\\t,",
        "    Couldn't get map value schema node name",
        "    Couldn't set WCM namespace",
        "    Failed to allocate ui",
        "y@WhE",
        ".rsrc$01",
        "/wpaf:Settings/wpaf:Customizations/wpaf:Profile",
        "    <Setting>DescriptionText1</Setting>",
        "WillReboot",
        "    Couldn't import OSImage",
        "    <ManifestFile>BrowserService.man</ManifestFile>",
        "707{7",
        "  <Setting Path=\"/Embedded/HideAllBootUI\">",
        ":?;R;W;x;};",
        "5#5/5M5R5W5c5",
        ">/>?>Q>s>",
        "        >Microsoft-Windows-TerminalServices-RDP-WinStationExtensions</Component>",
        "=3=f=",
        "    Couldn't enumerate unattend map paths under %s after pruning",
        "Operation",
        "        <Setting Path=\"/Maps/UseExternalStorage\" />",
        "  <Setting Path=\"/Firewall/PrivateProfile_DisableNotifications\">",
        "2)2C2X2r2",
        "    Error initializing list data.",
        "50585@5L5l5t5",
        "4<5h5",
        "    Couldn't case Variant to WpxVariant",
        "  <Setting Path=\"/Tablet/ConvertibleSlateHint\">",
        "wpaf:ProvisioningCommands/wpaf:Command",
        "DeplUnattendExporter::ExportEnvLanguage",
        "DeplUnattendExporter::NewChild",
        "sCustomCommands",
        ".?AV?$CAutoDeleteArray@K@RAII@@",
        "onecore\\base\\ntsetup\\wpx\\depl\\wpafexporter.cpp",
        "        >Microsoft-Windows-Embedded-KeyboardFilterService</Component>",
        "r    Couldn't read error code from IXMLDOMParseError",
        "20201009062507Z0w0=",
        "(Sjqh",
        ";+;5;L;o;",
        "ImageInstall",
        "4C4X4z4",
        "CFG_DATATYPE_BOOLEAN",
        "1 1$14181H1L1\\1`1p1t1x1|1",
        "  <Setting Path=\"/NetworkProxy/HKLMConnectTimeOut\">",
        "WpxSetting::IsListItem",
        "%hs(%d) tid(%x) %08X %ws",
        "WpxXmlNodeEnum::GetNext",
        "/wpaf:Settings/wpaf:UnattendedSetup",
        "  <Setting Path=\"/Embedded/KeyboardFilter/CustomFilters\">",
        "    Component missing required @name attribute",
        ".?AVWpxWpafWriter@@",
        "243[3",
        "Command",
        "    Could not produce %s in Store for Windows %s %s [%s]",
        "=(>5>M>}>",
        "EnableWhenSupported",
        ":F:K:P:\\:",
        "      <Pass>generalize</Pass>",
        "    Expected %s to have an inner-text value",
        "    Couldn't get settings tree for pass %u",
        "1(3I3i3n3s3",
        "    The contents of %s cannot be parsed",
        ":*:/:4:@:R:`:v:",
        "WpxConfig::GetTarget",
        "    Unattend only supports disk indices; cannot export disk criterion %s",
        "0&0;0_0d0i0x0",
        "    Couldn't add path %s to the path tree",
        "u:Extend",
        "60646L6\\6l6|6",
        "    Couldn't write WIM image index",
        "  <Setting Path=\"/OnlineBackup/Enable\">",
        "6B6P6f6k6p6",
        "Synchronous",
        "@visible",
        "    Can't read maxLength value",
        "    <Setting>ResourceDll</Setting>",
        "  <Setting Path=\"/Embedded/Logon/HideFirstLogonAnimation\">",
        "    <Setting>LaunchMail</Setting>",
        "    Couldn't write answers for pass %u",
        "GetTextInfo",
        "sPackages",
        "    <Setting>Title</Setting>",
        "SVWu4",
        "    Couldn't filter common settings",
        "    Index '%llu' is out of range (%s has %llu items)",
        "y/Wh{",
        "WpxSmiHive::FindComponentDecl",
        "    <Setting>HideDiscontinuedComponents</Setting>",
        "8#8(838K8b8g8l8",
        "171S1\\1a1",
        "CreatePartitions",
        "    <ManifestFile>Security-Licensing-SLC.man</ManifestFile>",
        "u:Credentials",
        "  <Setting Path=\"/Firewall/PrivateProfile_LogFile\">",
        "WpxUnattendReader::ReadTopLevelSetting",
        "        >Microsoft-Windows-SMBServer</Component>",
        "  <Setting Path=\"/OEM/Name\">",
        "CreatePartition/Type",
        "    <Setting>AltSpace</Setting>",
        "2)232M2R2W2c2",
        "wpaf:Destination",
        "Settings",
        "WpxSetting::ClearAssetSourcePath",
        "wpaf:StartupLogs",
        "AcquireSRWLockExclusive",
        "    Couldn't enumerate schema sources of %s",
        "414N4k4{4",
        "        <Setting Path=\"/Connections/Proxies\" />",
        "Condition",
        "    Can't specify a specific partition size in a <ModifiedPartitions> entry",
        "    Failed to allocate images",
        ".?AV?$CAutoCleanupBase@PAUIWpxStoreEnum@@@RAII@@",
        "    Couldn't import provisioning command",
        "tolower",
        "    Couldn't write fallback UI language",
        "    Child of map setting %s must declare a map key (@%s)",
        "    Failed to check whether the %s is a valid key for %s",
        "    Failed to get map key for %s",
        "    Can't query whether setting %s has a minimum",
        "44484P4T4l4p4",
        ": :8:M:c:v:",
        ";2;E;R;c;q;",
        "RaiseException",
        "G j Vj",
        ": :;:g:z:",
        "SystemUI",
        "    Missing required child element Passes",
        "wpaf:Features/wpaf:Feature",
        "    Failed to set driver wcm:keyValue",
        "    Couldn't get phase from phase condition",
        "wpaf:Generalize",
        "WpxAnsTree::RemoveListItem",
        "  <Setting Path=\"/Firewall/DomainProfile/EnableFirewall\">",
        "=$=)=.=<=`=e=j=x=",
        "Domain",
        "    <Component",
        "0!0[0f0",
        "    Couldn't initialize tree node %s",
        "606@6d6l6t6|6",
        "    <Setting>ReferralId</Setting>",
        "2$202P2X2h2",
        "u:Description",
        "wpaf:InitialCustomizationBlob",
        "?\"?2?=?L?W?s?",
        "y*WjHh",
        "2X2f2",
        "BootDisk",
        "AuditComputerName",
        "y-Phe",
        "y*SjTh|7",
        "InitialCustomizationBlob",
        ";P<r<",
        "[%hs(%hs)]",
        "  <Setting Path=\"/TCPIP/IcmpRedirectsEnabled\">",
        "    Couldn't export end-of-offline-phase action",
        "10.0.19041.572 (WinBuild.160101.0800)",
        "    Don't know how to iterate over int enumeration of type 0x%08x",
        "    Error adding entry %s to unattend map",
        "WpxSetting::GetVisibility::Enum::GetNext",
        ".?AV?$CAutoRelease@PAVChildNameEnum@?1??GetSparseNodeChildren@SmiStore@@AAEJABVWpxPath@@PAPAUIWpxStringEnum@@@Z@@RAII@@",
        "?*?H?T?f?",
        "131G1s1",
        "8)8E8`8u8",
        ":':3:N:",
        "9$9,949<9D9L9T9\\9d9l9t9|9",
        "261019185142Z0",
        "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:EnableCompactOS",
        "t    Failed to get WpxVariant for WPX_COND_VARIANT WpxCondition",
        "    <Setting>HKLM10FtOOBE</Setting>",
        "    Couldn't iterate over children of path %s",
        "        >Microsoft-Windows-ErrorReportingCore</Component>",
        ".?AVWpxUniversalApp@@",
        "    <Setting>UILanguageFallback</Setting>",
        "y0Shy",
        ">E>J>O>^>",
        "  <Setting Path=\"/Sidebar/Gadget1\">",
        ".?AUIWpxAnswerFileReader@@",
        "        >Microsoft-Windows-Shell-Setup</Component>",
        "4#4I4d4",
        "y;Whw",
        "%s: Value may have at most %lld character(s)",
        "%s: Map key '%s' is",
        "<$<,<4<<<D<P<p<x<",
        ">!>9>N>i>",
        "  <Setting Path=\"/Tablet/TouchUISize\">",
        "WpxValidation::ValidateMapKey",
        "  <Setting Path=\"/PCSettings/WiFiToWlan\">",
        "WpxSetting::GetAssetTargetPath",
        "3\"4'4,4C4Y4t4",
        "    <Setting>Gadget5</Setting>",
        "Bundle",
        "    <Setting>CustomReturnCodeAction</Setting>",
        "        >Microsoft-Windows-Security-Licensing-SLC</Component>",
        "2 3%3*363Q3",
        "    Load image information, but image info was empty",
        "    Couldn't reinitialize child to use updated XMLDOMNode",
        "50555:5V5}5",
        "%s: Inside node %s, can't parse '%s' as a boolean",
        "    Failed to allocate ppkgs",
        "    Failed to write AppX bundle path",
        "    <Setting>PublicProfile_EnableFirewall</Setting>",
        "  <Setting Path=\"/Embedded/KeyboardFilter/Escape\">",
        ":$:A:W:",
        "    Value: Argument cannot be NULL",
        "7!7&787W7c7",
        "j,XVPh4j",
        "  <Setting Path=\"/Embedded/KeyboardFilter/ForceOffAccessibility\">",
        "    Couldn't get answer file writer of type %u",
        "wpaf:Disk",
        "    Couldn't parse boolean value %s for Extend",
        "y-Vjth",
        "9 9,9c9",
        "y6Wh+",
        "    <Setting>UseDomainNameDevolution</Setting>",
        ";2;R;W;u;z;",
        "    Failed to allocate refs",
        "    <ManifestFile>KeyboardFilterSMI.man</ManifestFile>",
        "    Conflicting destination nodes specified",
        "    Couldn't add node for setting %s to the document tree",
        "    Couldn't parse <RegistrySource> Type attribute",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsV\">",
        "        <Setting Path=\"/Messaging/PerSimSettings/__ICCID/RcsOptions\" />",
        "    Must specify a destination",
        ".?AV?$CAutoCleanupBase@PAUIWpxTargetCondEnum@@@RAII@@",
        "Directory",
        "/wpaf:Settings/wpaf:Provisioning/wpaf:Packaging",
        "  <Setting Path=\"/Embedded/AppLauncher/AppUserModelID\">",
        "  <Setting Path=\"/DNS/SuffixSearchOrder\">",
        "    <Setting>EnableVolumeControlWhileLocked</Setting>",
        "        <Setting Path=\"/NFC/SEMgr/UI/DefaultFastCardSetting\" />",
        "u:Size",
        "    Couldn't import driver",
        "    Couldn't import WDS OS image",
        "  <Setting Path=\"/Embedded/KeyboardFilter/MediaStop\">",
        "    Failed to allocate e",
        "    Couldn't export package ignore-check flag",
        "    Couldn't write access password",
        "535Q5V5[5g5",
        "7H7M7R7c7",
        "WpxAllowedValue::IsVisible",
        "    Failed to remove child path %s",
        "        <Setting Path=\"/Connections/Item/Proxy/Port\" />",
        "    Failed to allocate szRuleRegValue.get()",
        "    Couldn't write partition type",
        "3-3Z3d3z3",
        ";2<m<",
        "    Couldn't import store app",
        "    Couldn't export feature target state",
        "6>6i6",
        ".LOG2",
        "    Unattend doesn't support destination drives for applying images",
        "    Path is required if InstallFrom is specified",
        "3'363R3W3\\3x3",
        "    Failed to allocate settingsNode",
        "<(<9<D<U<s<~<",
        "WpxWpafReader::ReadCommonSettings",
        "    Couldn't get answer file root node",
        "    Returning false because the node %s was itself not found",
        "    Couldn't export dynamic update option",
        "WpxAnsTree::ChangeItemIndexRecursive",
        "p:Validate",
        "DeplUnattendImporter::Import",
        "        <Setting Path=\"/Connections/Item/Connection/SwCompression\" />",
        "    Failed to allocate ppkg",
        "3+3F3q3v3{3",
        "343;3Y3^3c3o3",
        "  <Setting Path=\"/Firewall/DomainProfile_LogFileSize\">",
        "=*=/=4=^=",
        "WpxConfig::GetPassSetting",
        "?6?H?Z?y?",
        "2'3E3y3",
        "        <Setting Path=\"/NFC/SEMgr/UI/CardEmulationState\" />",
        "3 3@3H3T3t3|3",
        "        >Microsoft-Windows-WinRE-RecoveryAgent</Component>",
        "    <Setting>MultiTouchEnabled</Setting>",
        "    CandidateKey: Argument cannot be NULL",
        "  <Setting Path=\"/Tablet/TouchUI\">",
        "y&Vh<",
        "6 6%6*666o6",
        "? ?+?M?c?|?",
        "    Failed to enumerate target state conditions",
        "WpxGetAnswerFileType",
        "WpxUnattendMap::RemovePathRecursive",
        "?4?9?>?J?_?q?",
        "  <Setting Path=\"/Embedded/KeyboardFilter/ControlEscape\">",
        "0\"0<0",
        ".?AUIWpxPackagePath@@",
        "    <Setting>HideBootLogo</Setting>",
        "uvSQV",
        "WpxGetAnswerFileReader",
        ".?AV?$CAutoRelease@PAUIWpxIntEnum@@@RAII@@",
        "        <Setting Path=\"/Messaging/PerSimSettings/__ICCID/DefaultContentLocationUrl\" />",
        "  <Setting Path=\"/Embedded/Logon/UIVerbosityLevel\">",
        "        >Microsoft-Windows-Security-SPP-UX-SPPCC</Component>",
        "        >Microsoft-Windows-BLB-WSB-Online-Main</Component>",
        "=,=<=L=P=T=X=`=d=l=p=x=",
        ";2;G;];j;o;",
        "_initterm",
        "  <Setting Path=\"/Bluetooth/MTPSearchIntervalOnDC\">",
        "    Failed to get settings tree for variant",
        "  <Setting Path=\"/InternetExplorer/TabProcessGrowth\">",
        "  <Setting Path=\"/Sidebar/LayoutPosition\">",
        "    <Setting>ShowLeftAddressToolbar</Setting>",
        "    <Setting>Link1Text</Setting>",
        ";%;I;Y;y;",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsP\">",
        "2+20252i2~2",
        "p:RegistrySource",
        "    Package must have a requested target state",
        "oK0D$\"<",
        "=!=&=+=7=j=",
        "  <Setting Path=\"/InternetExplorer/ShowCommandBar\">",
        ".rdata$brc",
        "  <Setting Path=\"/NetworkProxy/HKLMCookiesPerUserItem\">",
        "    <Setting>Description</Setting>",
        "y/Wh;",
        "    <Setting>WindowsR</Setting>",
        "%s: Value must have at least %lld character(s)",
        "    Failed to iterate over states for target %s",
        "    Internal consistency error: setting in pass %u not allowed in corresponding phase %u",
        "        <Setting Path=\"/InternetExplorer/CustomHTTPHeaders\" />",
        "WpxXmlDocument::ReportError",
        "2(2=2J2U2m2",
        "0,0<0L0\\0l0|0",
        "?<?A?F?R?y?~?",
        "9 9(90989L9T9\\9d9",
        "    '%s' is too long (allows %u characters maximum)",
        "    Unrecognized child %s specified for tree setting %s",
        "  <Setting Path=\"/MediaCenter/OEM/PrimaryName\">",
        "u:TypeID",
        "    Invalid XML (line %u, position %u): %s",
        "y1Vhb",
        "    Couldn't write user organization",
        "    <Setting>Link2</Setting>",
        "    <Setting>Escape</Setting>",
        "wpaf:Modify",
        "WpxSetting::SetMapValueName",
        "    Couldn't iterate over child paths",
        "SmiStore::GetSparseNodeChildren::ChildNameEnum::GetNext",
        "        <Setting Path=\"/HelpAndSupport/OnlineSupportIconImage\" />",
        "1$1,141<1D1L1T1\\1d1l1x1",
        "    Couldn't iterate over apps",
        "0!060C0N0m0r0w0",
        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",
        "wpaf:VhdImage",
        "WpxAnsTree::MoveListItem",
        ".?AV?$CAutoDelete@PAVKnobsVisibilityState@@@RAII@@",
        ".?AVWpxDriver@@",
        "EnableWimBoot",
        "1&1@1[1o1",
        "UpgradeData",
        "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:EULA",
        "removable",
        "4 4D4L4T4\\4d4l4t4|4",
        "666;6@6K6[6`6e6p6",
        "u:UILanguageFallback",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsK\">",
        "        <Setting Path=\"/Connections/Item/Connection/UseRequiresMappingsPolicy\" />",
        "    Couldn't export modified partition %u",
        "    Couldn't import OS install image",
        "101;1G1^1y1",
        "DeplWpafImporter::ImportEvents",
        "    Must specify a WIM file path",
        "QRRSRP",
        "    <Setting>DomainProfile_LogSuccessfulConnections</Setting>",
        "    Can't parse <FillSpace>",
        "7'8,818B8",
        "9\"9'9,9>9Q9]9b9g9",
        "w6L$|",
        "oAllowedValueReference",
        "c=%s,s=%s",
        "u:ImageSelection",
        "wcscpy_s",
        "WpxSmiGetHiveInt",
        ":d:n:w:",
        "    Couldn't query unattend map for %s",
        "GetSystemTimeAsFileTime",
        "memset",
        "    Unknown WPX_OWNER_TYPE %u",
        "positive",
        ":L:o:",
        "    Unattend doesn't support WDS data images",
        "Partitions",
        "<.<J<W<b<~<",
        "    Couldn't iterate over packaging operations",
        "    Can't specify <Label> for entries of <CreatedPartitions>",
        "@Pattern",
        "PromptAtOOBE",
        "WpxWpafWriter::WriteTargets",
        "    Error initializing asset data.",
        "    <Setting>WindowsP</Setting>",
        ":9:T:z:",
        "    Failed to get map value name (after skipping parent key name)",
        "WpxWpafWriter::WriteSkeleton",
        "onecore\\base\\ntsetup\\wpx\\core\\setting.cpp",
        "    <Setting>fDenyTSConnections</Setting>",
        "j=XVPh",
        "WpxGetAnswerFileWriter",
        "    Failed to write subtree under %s",
        "2'3S3]3o3",
        "424L4Q4V4b4|4",
        ";~(sW",
        ":>:Y:",
        "4 4(444T4\\4d4l4t4|4",
        "979F9Q9}9",
        "    Failed to allocate package",
        "    Failed to write key value %s to document",
        "t*Vho",
        "  <Setting Path=\"/Embedded/KeyboardFilter/AltSpace\">",
        "    <ManifestFile>ehome-reg-inf.man</ManifestFile>",
        "AnsLowerBound",
        "8>8]8f8",
        "0\"0D0d0i0n0z0",
        "DeplWpafExporter::ExportSvcDrivers",
        ":$:5:K:a:q:",
        "    Couldn't open online schema store from %s",
        "u:FullName",
        "    Failed to postprocess document",
        "=.=6=;=@=^=o=",
        "    Incomplete WIM metadata specified",
        "  <Setting Path=\"/RemoteDesktop/ManagementPort\">",
        "WpxCondition::GetPass",
        "QSVWj0",
        "1'2Z2}2",
        "0$0,040<0H0l0t0|0",
        "    Couldn't set component public-key token attribute",
        "5 53585=5I5N5q5",
        "3=3m3",
        "=&>Q>",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:RunSynchronous",
        "    <Setting>PrivacyAdvisorMode</Setting>",
        "WpxWpafWriter::WriteBinarySetting",
        "    Regex: Argument cannot be NULL",
        "  <Setting Path=\"/Tablet/PanningDisabled\">",
        "WpxUnattendMap::LoadFromFootprint",
        "y&Vhw",
        ".?AV?$CAutoCleanupBase@PAUIXMLDOMElement@@@RAII@@",
        "    Couldn't parse content of the Destination/Disk element",
        "9$979B9T9r9w9",
        " Microsoft Corporation. All rights reserved.",
        "    Failed to allocate disks",
        "  <Setting Path=\"/RemoteDesktop/SecurityLayer\">",
        ":<;u;",
        "    Failed to get element %u of path %s",
        "Upgrade",
        ":1;6;;;G;d;",
        "    Couldn't import deployment settings",
        "        versionScope=\"nonSxs\"",
        "AcceptEula",
        "    Failed to cast Variant to WpxVariant",
        "    Failed to add child node %s to component node for %s",
        "MinBuildNumber",
        "ParseHexDigit",
        "707:7Q7z7",
        "5@5P5\\5|5",
        "    <ManifestFile>SystemMaintenanceService.man</ManifestFile>",
        "y7Vjjh",
        "    Destination: Argument cannot be NULL",
        "    Couldn't check whether map key has a set of allowed values",
        "=&=O=l=",
        "yTWh5",
        "    Couldn't read line number from IXMLDOMParseError",
        "=#=.=E=a=l=",
        "    Can't set IXMLDOMDocument3::validateOnParse",
        "KnobsStore::GetChildrenUnder",
        "  <Setting Path=\"/Sidebar/Gadget2\">",
        "McsfLeafNode::ParseType",
        "858K8[8m8r8w8",
        "?<?D?L?X?x?",
        "u&;E u!",
        "    <ManifestFile>WPD-BusEnumService.man</ManifestFile>",
        "tQjzXf;",
        "MapKeyMaxLength",
        "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:AuditMode",
        "    Couldn't report file issue",
        "  <Setting Path=\"/Firewall/FirewallGroups\">",
        "wpaf:ProvisionDisk",
        "FileVersion",
        "9s0v/;C0",
        "    Failed to insert <servicing> element as the first element",
        "=4=9=>=J=\\=i=t=",
        "%s: Malformed disk find criteria '%s' given for %s",
        "    Couldn't write color depth",
        "wpaf:WdsImage",
        "Action",
        "    Failed to write target state",
        "WPX_FOOT_UNATTEND_MAP",
        "CFG_DATATYPE_BINARY",
        "    Couldn't write partition table type",
        "p:Option",
        "/wpaf:Settings/wpaf:WindowsPE/wpaf:Drivers",
        "wpaf:License",
        ">+?0?5?L?V?~?",
        "    Couldn't iterate over child paths below %s",
        "    <ManifestFile>onecore_internal_Audio-AudioCore.man</ManifestFile>",
        "RSDSG1Jx",
        "0$000C0O0Y0w0|0",
        "WpxSmiGetHiveValueSize",
        ".?AUIWpxDriver@@",
        "9,9<9L9\\9`9p9t9",
        "y4VhC",
        "WpxXmlDocument::SetRoot",
        ";0;h;",
        "9$9,989X9h9",
        "    Invalid setting type %u for underlying setting %s",
        "    <ManifestFile>Disk-Failure-Diagnostic-Module.man</ManifestFile>",
        "%s does not match the regular expression",
        "    Settings: Argument cannot be NULL",
        "    Couldn't parse macro variable from %s",
        "  <Setting Path=\"/InternetExplorer/InstalledBHOList\">",
        "M3W3a3",
        "  <Setting Path=\"/SNMP/PermittedManagers\">",
        "3/393U3q3",
        "    Couldn't import ModifyPartition",
        "        <Setting Path=\"/Connections/Item/Policy/OrderedConnections\" />",
        ".?AV?$CAutoRelease@PAVWpxXmlNodeEnum@@@RAII@@",
        "sPackaging",
        "    ver: Argument cannot be NULL",
        ".?AV?$CAutoCleanupBase@PAVSmiSparseNode@@@RAII@@",
        "    Couldn't clean deployment setting nodes out of document",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']",
        "        >Microsoft-Windows-ehome-reg-inf</Component>",
        "    Couldn't set the document root to %s",
        "        >Microsoft-Windows-SystemSettingsThreshold</Component>",
        ".?AVDeplWpafExporter@@",
        "  <Setting Path=\"/DeviceGuard/RequirePlatformSecurityFeatures\">",
        "    <Setting>HideAutoLogonUI</Setting>",
        "    IsValid: Argument cannot be NULL",
        "525F5S5^5w5",
        "    Couldn't export packaging sessions",
        "3'3M3b3m3",
        "<(<8<H<X<h<x<",
        "<==Q=",
        "4'444?4W4c4h4m4",
        "        <Setting Path=\"/Connections/Item/Connection/ExemptFromDisablePolicy\" />",
        "    <Setting>DisableFirstRunWizard</Setting>",
        "    <Setting>Link</Setting>",
        "    <Setting>BootStatusPolicy</Setting>",
        ">P>u>",
        ".?AV?$CAutoCleanupBase@PAUIWpxAnswerFileReader@@@RAII@@",
        "t{9:rw",
        "offlineServicing",
        "<,<1<6<A<O<k<u<z<",
        ":0:^:m:|:",
        ">\">J>O>T>c>",
        "DeplWpafExporter::ExportEnvNetwork",
        "    Driver element missing required Path element",
        "4,4I4l4",
        "  <Setting Path=\"/MediaCenter/RestartEnabled\">",
        "5t#fj",
        "  <Setting Path=\"/Shell/FolderLocations\">",
        "    Failed to get this rule's target key",
        "2(272",
        "y#Wh!",
        "    <ManifestFile>RemoteAssistance-Exe.man</ManifestFile>",
        "0/0:0L0a0l0}0",
        "        <Setting Path=\"/Messaging/PerSimSettings/__ICCID/AutomaticallyDownload\" />",
        "WpxConfig::LoadWimStore",
        "    Couldn't get child node names from SMI hive",
        "    %s is not a macro declaration",
        "    Failed to write SkipLicenseCheck value",
        "    <ManifestFile>TabletPC-Platform-Input-Core-Embedded.man</ManifestFile>",
        "=,=4=<=D=L=T=\\=h=",
        "    <ManifestFile>TerminalServices-RDP-WinStationExtensions.man</ManifestFile>",
        "  <Setting Path=\"/InternetExplorer/DisableFirstRunWizard\">",
        "  <Setting Path=\"/Firewall/DomainProfile_EnableFirewall\">",
        "    Failed to initialize MCSF store",
        "ForceInstallUnsigned",
        ".?AVEnumerator@?1??GetChildrenUnder@McsfStore@@UAEJABVWpxPath@@PAPAUIWpxStringEnum@@@Z@",
        "    Couldn't parse boolean value %s for ForceShutdownNow",
        "9HvLEVum",
        "    Additionally failed to schedule %s to be deleted at next boot",
        "536f6",
        "DeplWpafImporter::ImportDriver",
        "Sensitive",
        "    Failed to read phase-specific settings node(s)",
        "u:Display",
        "wpaf:Packaging/wpaf:Operation",
        "    Couldn't set component name attribute",
        "unsigned",
        ".?AV?$CAutoCleanupBase@PAVWpxSmiSetting@@@RAII@@",
        "y0Vhs",
        "/u:unattend/u:settings[@pass='specialize']/u:component[@name='Microsoft-Windows-Deployment']/u:RunAsynchronous",
        "GetMapInfo",
        "    Cannot specify both WIMBootFrom and InstallTo or InstallToAvailablePartition",
        "  <Setting Path=\"/InternetExplorer/ESC/EnableOnAdminAccounts\">",
        "DisplayName",
        "Deleting temporary SMI hive at %s ...",
        "  <Setting Path=\"/DNS/Interfaces\">",
        "  <Setting Path=\"/Internationalization/UILanguage\">",
        "1\"242U2g2",
        "    No settings loaded; skipping common settings tree",
        "        <Setting Path=\"/Shell/Start/Layout/PinDiagnosticTiles\" />",
        "3!4A4[4",
        "y+Whg",
        "%s: New definition for multivariant target state '%s' conflicts with an existing definition",
        "WpxSmiSetting::GetMaxInclusive",
        "?$?,?4?<?D?L?T?\\?d?l?t?",
        "    <Setting>PreferredPlan</Setting>",
        ":J:]:",
        "    Structure of component keyform was unexpected: %s",
        "MaxBuildNumber",
        "  <Setting Path=\"/OnlineBackup/Icon\">",
        "    Couldn't read settings for phase %u under %s",
        "    Failed to load offline hive at %s",
        "    Couldn't add source to WpxStore",
        "    Couldn't parse <Format> node",
        "    Failed to parse value %s for FinishAuditMode <StartOOBE> node",
        ":&:4:?:V:b:g:l:",
        "1,1<1L1P1`1d1t1x1",
        "9 9$9(9@9D9X9\\9t9x9|9",
        "RtlUpcaseUnicodeChar",
        ">(>8>=>h>",
        "    Failed to export install commands",
        "    The given state is not an instance of WpxTargetState",
        ">3>P>",
        "    Couldn't initialize map node %s",
        "    Couldn't write basic answer file skeleton",
        ":(:?:K:P:U:",
        "  <Setting Path=\"/MediaCenter/DisableHighResolutionCheck\">",
        ".?AVSourceEnum@?1??EnumSources@WpxStore@@QAEJPAPAUIWpxStoreEnum@@@Z@",
        "__RTDynamicCast",
        "4:5]5b5g5s5",
        "    Couldn't get or create answer object",
        "u:WIMBootFrom",
        "9<:P:b:t:",
        "    Couldn't parse <Install> element",
        "0'1E1U1~1",
        "080J0m0",
        "1=2w2",
        "?hbinu",
        "    Couldn't sort RunSynchronous commands",
        "6$6,646<6D6L6T6\\6h6",
        "y1PhQ",
        ".?AVSourceEnum@?1??EnumSources@WpxStore@@QAEJABVWpxPath@@PAPAUIWpxStoreEnum@@@Z@",
        "        <Setting Path=\"/Email/WarnIfNoSubject\" />",
        "WpxXmlNode::GetParent",
        "DeplWpafImporter::ImportDisk",
        ".?AV?$CAutoDeleteArray@$$CBE@RAII@@",
        "=8=D=d=l=x=",
        "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a",
        "    <Setting>ID</Setting>",
        "8.8=8M8r8",
        "  <Setting Path=\"/Embedded/KeyboardFilter/BrowswerRefresh\">",
        "WpxSetting::ValidateMapKey",
        "=/>B>G>L>[>r>w>|>",
        "  <Setting Path=\"/NetworkProxy/HKLMProxyOverride\">",
        ".xdata$x",
        "    Disk missing required DiskID parameter",
        "  <Setting Path=\"/InternetExplorer/FeedList\">",
        "  <Setting Path=\"/Embedded/KeyboardFilter/Shift\">",
        "    Couldn't initialize sparse node for %s",
        "2$2/2G2\\2v2",
        "    No SKU information file %s available for store file %s",
        "9^ v0",
        "    LoadedStores: Argument cannot be NULL",
        "> >D>L>T>\\>d>l>t>|>",
        "WpxXmlNode::SelectNodes",
        "AuthuN",
        "    <Setting>TouchGate</Setting>",
        "?,?L?l?q?v?",
        "y-VjVh",
        "    Failed to add <Settings> to the document tree",
        "=C=c=h=m=y=",
        "    Unable to query if setting %s has a default",
        "VSj&Z",
        "212J2[2o2",
        "    <ManifestFile>production\\prod_Audio-AudioCore.man</ManifestFile>",
        ">3>M>g>l>q>}>",
        ";%;0;7;b;g;l;y;",
        "y2Vh\"",
        "WpxSetting::IsValid",
        "    Failed to export feature %u",
        "    Failed to validate answer %s",
        "DeplWpafExporter::ExportServicing",
        "    Couldn't get schema node for %s",
        "0-0A0R0\\0k0u0",
        "DeplWpafExporter::ExportImage",
        ".?AV?$CAutoRelease@PAUIWpxDeplSettings@@@RAII@@",
        ".?AV?$CAutoCleanupBase@PAVKnobsVisibilityRule@@@RAII@@",
        ";5<T<",
        "        <Setting Path=\"/USBErrorsOEMOverride/HideUsbErrorNotifyOptionUI\" />",
        "    Couldn't parse partition table type %s",
        "    Unable to query if setting %s has pass information",
        "    <Setting>PublicProfile_DisableNotifications</Setting>",
        "y/Vh6",
        "WpxXmlDocument::LoadXml",
        "7,71767D7Q7V7[7i7\\8",
        "DeplUnattendImporter::ImportOfflineDrivers",
        "DeplWpafExporter::GetSvcNode",
        "DeplUnattendExporter::GetDiskIndex",
        "n    Failed to create child name enumerator",
        "    Cannot allocate name",
        "    Couldn't initialize schema for %s",
        "/wpaf:Settings/wpaf:WindowsPE/wpaf:Language",
        "ColorDepth",
        "%Microsoft Windows Production PCA 2011",
        "y VjAh",
        "    Couldn't export user name",
        ".text$x",
        "8-8i8n8s8",
        "3:3]3b3g3s3",
        "    Failed to get phase from phase condition",
        "    Failed to allocate result",
        "    <Setting>Port</Setting>",
        "8.83888O8Z8|8",
        ".?AV?$CAutoCleanupBase@PAUIWpxIssueList@@@RAII@@",
        "  <Setting Path=\"/InternetExplorer/AllSitesCompatibilityMode\">",
        "    Couldn't serialize migration option %u",
        "    Couldn't clear sparse answer at %s",
        "7-7E7Z7_7d7~7",
        "  <Setting Path=\"/SharedAccess/InternalAdapter\">",
        "62696",
        "    Couldn't import WindowsPE driver",
        ";(;F;",
        "    Couldn't IWpxConfig deployment settings",
        "        <Setting Path=\"/Connections/Item/Proxy/ConnectionName\" />",
        "? ?@?L?l?x?",
        "1(1-121A1R1c1h1m1",
        "WpxSetting::AddListItem",
        "6$606T6\\6d6l6t6|6",
        "VarFileInfo",
        "? ?%?<?G?U?",
        "    Couldn't write horizontal resolution",
        "> ?<?A?F?T?d?u?z?",
        "    Couldn't iterate over asynchronous commands",
        "DeleteCriticalSection",
        "    Couldn't export diagnostics option",
        "WpxWpafWriter::GetSettingNode",
        ".?AVWpxDeplSvcSettings@@",
        "MainLanguage",
        "    Couldn't iterate over Order nodes",
        "    <Setting>WindowsZ</Setting>",
        "3\"3(3.3B3H3R3X3^3z3",
        ":l;q;v;",
        "99:@:a:",
        "    MaxItemCount: Argument cannot be NULL",
        "    Not allowed to specify reboot for commands in this context",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsPageDown\">",
        "ED9MXs",
        "?8?U?x?",
        "2'2X2f2|2",
        "    Failed to add list item node to document",
        "WpxUnattendMap::GetChildrenUnder",
        "?D?|?",
        "    <Setting>WindowsExperienceIndexOemInfo</Setting>",
        ".?AV?$CAutoCleanupBase@PAUIWpxDeplExporter@@@RAII@@",
        "9~ v0",
        "2+2=2[2g2y2",
        "3#3+3?3Z3",
        "WpxSetting::SetAssetSourcePath",
        "    <Setting>DoNotCleanTaskBar</Setting>",
        "=+=0=5=A=",
        "9P9c9",
        "y2Ph(",
        "9b9u9",
        "<J<O<T<k<u<",
        "7T8]8v8",
        "    Failed to iterate over top-level settings of component %s",
        "5\"525D5[5j5",
        "3\"3.3?3_3z3",
        "QVWj<",
        "5'6W6",
        "  <Setting Path=\"/Firewall/DomainProfile_DisableNotifications\">",
        "WpxSetting::EnumSources",
        "    Failed to get this rule's target value",
        "RRPWRQ",
        "?.?3?8?D?r?",
        "    Failed to iterate over variant nodes",
        "  <Setting Path=\"/MediaCenter/OEM/LogoURI\">",
        "    Can't read length of enumeration values",
        "y-VjSh",
        "  <Setting Path=\"/Embedded/UnifiedWriteFilter/OverlayType\">",
        "WINDOWS/VERSION/MAJOR",
        "EnableDiagnostics",
        "0\"0:0D0Y0l0",
        "C<;{@r",
        "4'424>4L4[4o4",
        ".?AV?$CAutoCleanupBase@PAVSmiStore@@@RAII@@",
        "u:LayeredDriver",
        "  <Setting Path=\"/Shell/StartTiles\">",
        "y-Vh|",
        "MaxMinorVersion",
        "3$484N4X4}4",
        "    <Setting>PublicProfile_LogFileSize</Setting>",
        "/u:unattend/u:settings[@pass='specialize']/u:component[@name='Microsoft-Windows-Deployment']/u:RunSynchronous",
        ">,>R>W>\\>h>",
        "    Couldn't write access username",
        "lstd::exception: %hs",
        "SiliconVendor",
        "    <Setting>ShiftWin</Setting>",
        "  <Setting Path=\"/SecureStartup/SlicedEncryptionRequestsMax\">",
        "        >Microsoft-Windows-Security-SPP</Component>",
        "0'0Z0_0d0p0",
        "    Couldn't validate key %s for setting %s",
        "    Failed to allocate upg",
        "9)9B9W9n9",
        "9#:(:-:9:",
        "        >Microsoft-Windows-Printing-Spooler-Core</Component>",
        "        <Setting Path=\"/InternetExplorer/Favorites\" />",
        "    Can't read value %s",
        "    Failed to load unattend map",
        "DeplWpafExporter::GetEnvNode",
        "        <Setting Path=\"/DeviceManagement/Policies/SISL/ServiceIndicationRoles\" />",
        "    Not setting scratch dir to '%s' because the path does not refer to a directory",
        "7$7,747<7H7l7t7|7",
        "444<4D4L4T4\\4d4l4t4|4",
        "  <Setting Path=\"/SMBServer/CacheSize\">",
        "UuidFromStringW",
        "    Destination drive must be a single letter",
        "<+<5<@<G<a<f<k<",
        "auditSystem",
        "    Couldn't get child %s of %s",
        ".CRT$XCA",
        "0(0Z0d0|0",
        "  <Setting Path=\"/Wireless/SimultaneousMultiChannelSupported\">",
        ".?AUIWpxApplyInfo@@",
        "3(3H3h3",
        "=*=C=H=M=d=n=",
        "  <Setting Path=\"/UserAccounts/Accounts\">",
        "    Couldn't enumerate child paths",
        "<:<R<h<",
        "    Can't enumerate child names",
        "        >Microsoft-Windows-IE-InternetExplorer</Component>",
        ".?AV?$CAutoCleanupBase@PAVMcsfTreeNode@@@RAII@@",
        "    <ManifestFile>Security-SPP-UX.man</ManifestFile>",
        "    Couldn't export operating system image",
        "    <Setting>LaunchApp2</Setting>",
        "4.4R4e4",
        "DeplWpafExporter::ExportInsImages",
        "  <Setting Path=\"/OnlinePrinting/Icon\">",
        "TypeID",
        "6 6(60686@6H6T6t6|6",
        "?*?C?]?r?",
        "    Invalid file system type %s",
        "onecore\\base\\ntsetup\\wpx\\ks\\setting.cpp",
        "0<0D0L0T0\\0d0p0",
        "    <Setting>href</Setting>",
        "31bf3856ad364e35",
        "    Couldn't parse <Permanent> element",
        "=,=:=?=[=i=n=",
        "    Failed to iterate over settings groups",
        "    Setting under %s missing required @Name attribute",
        ".?AVWpxPackagingSession@@",
        "8$8=8F8K8",
        "WpxUnattendWriter::WriteSettingSubtree",
        "    Couldn't get variant from WpxCondition of type VARIANT",
        "ApplyPasses",
        "    Must specify a WIM image within the file",
        "    <Setting>WindowsLeft</Setting>",
        "    <Setting>SuggestedSitesEnabled</Setting>",
        "    <Setting>OOBE</Setting>",
        "3C3P3U3Z3e3",
        "0>0C0H0S0s0",
        "919B9Q9e9z9",
        "WpxConfig::GetPassSettings",
        "    Couldn't export disk ID",
        "    <Setting>PrivateProfile_LogFileSize</Setting>",
        "DeplWpafExporter::ExportEnvBootDrivers",
        "DefaultBool",
        "90959:9J9y9",
        "  <Setting Path=\"/Firewall/PublicProfile/LogSuccessfulConnections\">",
        "250701214655Z0|1",
        "485=5B5T5",
        "5-5G5f5k5p5",
        "3 383<3T3X3p3t3",
        "RaiseFailFastException",
        "7s8B9",
        "j<XVPh",
        "?E?q?",
        "9spv%;sps'",
        "888H8l8t8|8",
        "    Error while trying to validate answers for phase %u",
        "2S2X2o2",
        "    Pass: Argument cannot be NULL",
        "        <Setting Path=\"/Connections/Cellular\" />",
        "WpxSetting::SetAnswer",
        "y5Wh|",
        "    <ManifestFile>production\\prod_TabletPCPlatformInput-core.man</ManifestFile>",
        "    Couldn't write friendly name for %s",
        "    Couldn't set WPAF namespace prefix",
        "VSj[Z",
        "    List schema node has multiple child nodes",
        "    <Setting>Binding</Setting>",
        "G;~0r",
        "    Failed to read common settings node",
        "u:Letter",
        "DeplWpafExporter::ExportDisk",
        "        <Setting Path=\"/Shell/SystemTray/DataActivity/DataActivityIcon\" />",
        "    Incomplete display resolution specified (must have both width and height)",
        "    Couldn't write filesystem type",
        "wpaf:Partitions/wpaf:Partition",
        "/wpaf:Settings/wpaf:Servicing",
        "    <Setting>WindowsF</Setting>",
        "    <Setting>MaxTicketExpiryUnits</Setting>",
        "    <ManifestFile>CoreMmRes.man</ManifestFile>",
        "WpxTarget::EnumTargetStates",
        "wpaf:Drive",
        "    Failed to query allowed textual values",
        "WpxConfig::LoadPackageStore",
        "configure",
        "4*454L4f4}4",
        "n    Condition: Argument cannot be NULL",
        "    Couldn't export EnableAuditMode option",
        "version",
        "y-Whf",
        "GetVisbilityInfo",
        "><>X>t>",
        "        <Setting Path=\"/Connections/Item/Policy/SID\" />",
        "0 1x1",
        "Washington1",
        "5<5U5a5",
        "; <;<k<u<",
        "u:PartitionID",
        "8 8(8,848L8P8h8l8",
        "Removed",
        "    Couldn't get node for child %s of %s",
        ">!>&>+>7>Q>c>x>",
        "/WpxStore/Version",
        "    <ManifestFile>powercpl.man</ManifestFile>",
        "    <Setting>WindowsPeriod</Setting>",
        "    <Setting>ProviderName</Setting>",
        "8+848L8i8",
        "SettingNode::GetDefaultText",
        "=1=V=d=z=",
        "9%9*9/9J9i9",
        ">4>H>`>z>",
        "    Couldn't parse Generalize settings",
        "    .sku.xml missing required field /WpxStore/Edition",
        "    Invalid Reboot value %s",
        "u:EnableNetwork",
        "    Failed to filter answer tree below %s",
        "    <Setting>RestartHour</Setting>",
        "        >Microsoft-Windows-Embedded-EmbeddedAppLauncher</Component>",
        "  <Setting Path=\"/OnlineBackup/DescriptionText2\">",
        "    <Setting>AllSitesCompatibilityMode</Setting>",
        "    Couldn't write system locale",
        ".?AUIWpxCondition@@",
        "    Found default for %s, but unable to read it",
        "5$5H5l5",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "    Commands cannot cause reboots in this context",
        ".idata$6",
        "< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\\<`<d<h<l<p<t<x<|<",
        "  <Setting Path=\"/Shell/StartPanelLinks\">",
        "Network",
        "        >Microsoft-Windows-SystemSettings</Component>",
        "QQSVWjH",
        "    Can't specify <Format> for an item in <CreatedPartitions>",
        ".?AV?$CAutoRelease@PAUIWpxVisibilityStateDesc@@@RAII@@",
        "<5<:<?<W<b<",
        "s    Variants: Argument cannot be NULL",
        ".?AUIWpxSchemaAllowedValueEnum@@",
        "    <Setting>OfflineIdentification</Setting>",
        "  <Setting Path=\"/Embedded/UnifiedWriteFilter/Binding\">",
        "283P3Z3x3",
        "050:0?0]0h0",
        "    Failed to query if %s has a child key",
        "    Couldn't get <settings> node for pass %u",
        "@Name",
        "    Couldn't export user settings",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsEnter\">",
        "PQSVW",
        "SmiSchemaNode::GetAnsEnumValues::TextEnum::GetNext",
        "McsfStore::IsValidPath",
        "    Validate/Option element missing required Value attribute",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsHome\">",
        "  <Setting Path=\"/Drivers/DoNotCleanUpNonPresentDevices\">",
        "    <Setting>Start</Setting>",
        "    Couldn't iterate over windowsPE-phase drivers",
        "4<4`4",
        "y+Pjwh",
        "5?6n6",
        "u:Organization",
        "888P8",
        "_aligned_malloc",
        "%lld byte(s)",
        "151O1T1Y1q1",
        "CustomDataFile",
        "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;",
        "Microsoft Corporation",
        "wpaf:Partition",
        "WpxUnattendMap::GetChildrenUnder::ChildNameEnum::GetNext",
        "    Don't know how to iterate over text enumeration of type 0x%08x",
        "DeplWpafImporter::ImportPartition",
        "0 0(00080D0d0p0x0",
        "y-VjUh",
        "1&2>2R2]2u2",
        "/u:unattend/u:settings[@pass='%s']",
        "    <ManifestFile>Microsoft-Windows-IE-ClientNetworkProtocolImplementation.man</ManifestFile>",
        "?#?U?Z?_?k?|?",
        "    <Setting>PrivateProfile_DisableNotifications</Setting>",
        "SmiSchemaNode::GetMapValue",
        "858J8\\8p8}8",
        "    Couldn't export finish-audit-mode action",
        "y/WhJ",
        "<'<Z<_<d<s<",
        ".?AV?$CAutoRelease@PAVOrderedNodeEnum@DeplUnattendImporter@@@RAII@@",
        "        >Microsoft-Windows-ServerManager-SvrMgrNc</Component>",
        ".?AV?$CAutoRelease@PAUIXMLDOMDocument3@@@RAII@@",
        "u:Type",
        "WpxSmiSetting::GetKeyName",
        "    Couldn't export package keyform",
        "    <Setting>Application</Setting>",
        "onecore\\base\\ntsetup\\wpx\\file\\factory.cpp",
        "333S3s3x3}3",
        ":*:L:f:{:",
        "DisplayDescription",
        "2#383",
        "    Failed to parse answer file contents",
        "    Couldn't get name of pass %u",
        "        <Setting Path=\"/OEM/Information/Logo\" />",
        "    Couldn't clear answer %s because it wasn't already present in the configuration",
        "    Unattend only supports the EQUAL_TO operator; cannot export disk criterion Index",
        "/wpaf:Settings/wpaf:WindowsPE/wpaf:UserInfo",
        ">+>M>p>u>z>",
        "8<8S8p8",
        "  <Setting Path=\"/SecureStartup/BytesDecryptedInDiskRequestOverhead\">",
        "    Internal error: WriteSetting should not be called for settings of type %u",
        "WpxLoadFootprintFile",
        "    Failed to write custom data file",
        "DiskConfiguration",
        "    <Setting>TouchUI</Setting>",
        "    Failed to remove %s attribute from %s",
        "0*1/141@1n1s1x1",
        "<allowed value list>",
        ".?AV?$CAutoCleanupBase@PAUIXMLDOMParseError@@@RAII@@",
        "WpxWpafWriter::WriteTargetCondition",
        "    Couldn't filter settings for phase %u",
        ".?AVEnum@?1??EnumVariants@WpxConfig@@UAEJPAPAUIWpxVariantEnum@@@Z@",
        "< <$<(<@<D<X<\\<t<x<|<",
        "5&6+606?6O6T6Y6q6",
        "DeplWpafImporter::ImportUniversalApp",
        ".?AV?$CAutoDeleteArray@E@RAII@@",
        "McsfStore::Initialize",
        "??1exception@@UAE@XZ",
        "        >Microsoft-Windows-SharedAccess</Component>",
        "    Failed to move item %llu of %s to index %llu",
        "    SettingsTree: Argument cannot be NULL",
        "Reboot",
        "1\"1y1",
        "Nothing",
        "Path (file extension)",
        "4$4,444<4D4L4T4\\4d4p4",
        "WpxTargetState::RemoveCondition",
        "    Config: Argument cannot be NULL",
        "6 656:6?6K6t6~6",
        "GetTempPathW",
        "4,41464E4X4",
        "WpxXmlDocument::Create",
        "y/Vj-h",
        "    Couldn't create <settings> element",
        "DeplWpafImporter::Clean",
        "20201008062507Z",
        ";$<(<,<0<<<@<H<P<T<\\<d<h<p<x<|<",
        "yJWhk",
        "onecore\\base\\ntsetup\\wpx\\file\\getfiletype.cpp",
        "    Must specify WDS image information",
        "5+5T5_5k5",
        "    Couldn't export page file size",
        "5&6L6b6p6",
        "wpaf:Active",
        "u:source",
        "8%9+989C9\\9g9p9y9",
        "3&3:3Y3s3",
        "2\"242[2x2",
        "    Unknown CspSource type %s",
        "    Failed to allocate states",
        "    Couldn't write search directory %u",
        "g    Failed to check if all stores under %s support runtime provisioning. Will return best effort.",
        "y+Vh#",
        "    Couldn't init setting object for %s/%s",
        "j>XWPh",
        "l    Can't parse bool %s",
        "7,7<7L7\\7l7|7",
        "    <Setting>FavoritesOnTop</Setting>",
        "080=0B0Y0c0",
        "InstallFrom",
        "Modify",
        "        <Setting Path=\"/Shell/Start/Item/PrepinnedTile/XCoordinate\" />",
        "    Can't query whether setting %s has an enumeration",
        ".?AV?$CAutoHeapFree@PAE@RAII@@",
        "    <Setting>SmallCommandBarIcons</Setting>",
        "wpaf:Customizations",
        "    <Setting>DomainProfile_LogDroppedPackets</Setting>",
        "    <Setting>DriverStartType</Setting>",
        "2.2<2T2h2|2",
        "    <Setting>NumAntennaConnected</Setting>",
        "    Failed to iterate over disks in <Layout>",
        "    Failed to retrieve allowed values from schema",
        "    Couldn't set namespace URI for prefix",
        "    Failed to allocate contents",
        "151B1P1y1",
        "yHSh$",
        "    Couldn't get child setting %s for %s",
        "        >Microsoft-Windows-SNMP-Agent-Service</Component>",
        "222^2r2",
        "    Couldn't set document selection namespaces",
        "5(545T5\\5d5l5x5",
        "    Failed to iterate over excluded settings",
        "    Couldn't get asset target path",
        "    Couldn't read WPAF file metadata",
        "KnobsAllowedValue::GetTextValue",
        "7,767S7i7r7",
        "4,464B4N4S4X4",
        "RtlRunOnceComplete",
        "6)686I6b6u6z6",
        "  <Setting Path=\"/InternetExplorer/FavoritesOnTop\">",
        "  <Setting Path=\"/InternetExplorer/MSCompatibilityMode\">",
        "    Couldn't export page file settings",
        "Shutdown",
        "WpxConfig::EnumVariants::Enum::GetNext",
        "    <ManifestFile>Wlansvc.man</ManifestFile>",
        "yEWhQ",
        "6.676d6",
        "797X7x7}7",
        "040E0P0o0t0y0",
        "WINDOWS/VERSION/SPBUILD",
        "    Failed to allocate root",
        "    WDS InstallTo disk must have a single Index=(...) criterion",
        "    Node: Argument cannot be NULL",
        "    Couldn't set path",
        "    Expected Config to be an instance of WpxConfig",
        "Setting constraint violation (0x%08x) for %s",
        "wpaf:Paths/wpaf:Path",
        "MapKeyPattern",
        "1T2s2",
        "7?7b7g7l7x7",
        "    Unhandled target condition type %u",
        "    <Target> element missing required @Id attribute",
        "    <Setting>WiFiToWlan</Setting>",
        "  <Setting Path=\"/OnlinePrinting/ID\">",
        "2$2@2T2p2",
        "    Couldn't query parent schema",
        "    Failed to allocate replaces",
        "ImageGroup",
        "061Y1",
        "    Failed to iterate over target state conditions",
        "5%5*5/5;5z5",
        "8,8H8`8p8{8",
        ":;:@:O:c:q:",
        "    Error initializing tree data.",
        "='=@=Q=]=i=n=s=",
        "    Couldn't sort RunAsynchronous commands",
        "    <ManifestFile>PnpSysprep.man</ManifestFile>",
        "tEjhj",
        ".?AUIWpxIntEnum@@",
        "    Failed to allocate item",
        "y Vj*h",
        "        <Setting Path=\"/Theme/DefaultBackgroundColor\" />",
        "y@Whu",
        "/u:unattend/u:settings[@pass='auditUser']/u:component[@name='Microsoft-Windows-Deployment']/u:RunSynchronous",
        "    Couldn't get common settings from configuration",
        "    Failed to allocate to",
        ";,;0;@;D;T;X;h;l;|;",
        "    Failed to iterate over asynchronous commands",
        "Setting",
        "oobeSystem",
        ".?AVEnumerator@?1??GetMapKeyEnumValues@WpxSetting@@UAEJPAPAUIWpxAllowedValueEnum@@@Z@",
        "  <Setting Path=\"/Wireless/DisplayNetworkSelection\">",
        "    Couldn't create key %s in map setting %s",
        "WpxWpafWriter::WriteCommonSettings",
        "WdsImage",
        "    Couldn't set component version scope attribute",
        "DeplWpafImporter::ImportDiskCriterion",
        "2(2,20242<2@2H2P2T2\\2d2h2p2x2|2",
        "2'2.2C2\\2",
        ";);C;W;t;y;~;",
        "    Sources: Argument cannot be NULL",
        "    Index: Argument cannot be NULL",
        "    Failed to enumerate child schema names",
        "    Failed to allocate keyNode",
        ".?AV?$CAutoCleanupBase@PAVSettingNode@@@RAII@@",
        ".?AUIWpxStoreEnum@@",
        "\\Windows\\System32\\SMI\\Store\\Machine\\SCHEMA.DAT",
        "7 7$7,74787@7H7L7T7\\7`7h7l7t7|7",
        "    For CreatePartition, must specify a partition size or fill-remaining-space",
        "InputLocale",
        "MaxLength",
        "    Failed to allocate *ChildNames",
        "ET/{a",
        "WPX_FOOT_EXCLUDED_SETTINGS",
        "    <Setting>DoNotOpenServerManagerAtLogon</Setting>",
        "    Failed to add <Condition> to the document tree",
        "  <Setting Path=\"/Registered/Owner\">",
        "/IMAGE/INDEX",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsMinus\">",
        ".?AV?$CAutoRelease@PAVWpxCondition@@@RAII@@",
        "  <Setting Path=\"/Embedded/Tablet/TouchGate\">",
        "9#9[9w9",
        "SettingNode::SetDefaultBool",
        "d    Can't open schema hive key for child %s",
        "StartupLogs",
        "    Couldn't export firewall enabled flag",
        "WpxConfig::RemoveVariant",
        "y%Vh@",
        "WpxSmiSetting::GetMaxLength",
        "WpxAnsTree::GetAnswer",
        "<J=u=",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsC\">",
        "__CxxFrameHandler3",
        "_wcsnicmp",
        "    Couldn't enumerate paths below %s",
        "TargetState",
        "2/2W2e2{2",
        "272<2A2M2f2z2",
        ">$>,>4><>D>L>T>\\>d>l>t>|>",
        "%s does not have one of the allowed file extensions",
        "yGShr",
        "    Failed to allocate startAudit",
        "VhdImage",
        "=-><>O>U>",
        "1(0&0",
        "    Can't specify <DriveLetter> for an item in <CreatedPartitions>",
        "    Couldn't strip processed nodes from input document",
        ">.>G>L>Q>_>o>",
        "yEWh/",
        "    Can't specify <Active> for an item in <CreatedPartitions>",
        "WpxConfig::Validate",
        "3c465",
        "WpxSetting::GetAssetSourcePath",
        ".?AV?$CAutoRelease@PAVMcsfTreeNode@@@RAII@@",
        "    The given data cannot be parsed",
        "WpxXmlDocument::LoadFile",
        "=/=N=x=",
        "D$0P3",
        "    <Setting>LaunchApp1</Setting>",
        ".?AUIWpxConfFilter@@",
        "7$7:7L7a7z7",
        "    <Setting>OtherDomains</Setting>",
        "wpaf:Disks/wpaf:HardwareEncryption",
        "0!090G0c0",
        ":U:{:",
        "8p8w8",
        "    <Setting>BrowserFavorites</Setting>",
        "2D2x2",
        "7\"7'7>7I7_7x7",
        "u:DriverPaths/u:PathAndCredentials",
        "DefaultText",
        "    Failed to add profile variants",
        ";0;];q;",
        "0#0=0]0r0",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsR\">",
        "7!7<7A7F7Q7a7l7",
        "    Failed to allocate parts",
        "    Couldn't read answers under %s",
        "    Map value %s does not exist",
        "6&6:6n6s6x6",
        "    Couldn't export StartOOBE option",
        "9$9g9",
        "    Failed to iterate over allowed values of %s",
        "131F1[1z1",
        "    Failed to check if the settings tree is empty",
        "u:Generalize",
        "5#5/54595P5",
        ".?AV?$CAutoCleanupBase@PAVKnobsStore@@@RAII@@",
        "<binary data>",
        "  <Setting Path=\"/Firewall/IntfQuarantineEnabled\">",
        "WpxXmlDocument::CreateElement",
        "yESh~",
        "/wpaf:Settings/wpaf:AuditMode/wpaf:Payload",
        "    <Setting>DisableDevTools</Setting>",
        "    Failed to parse policy XML",
        ".?AVWpxCafReader@@",
        "t]j Pj",
        "  <Setting Path=\"/DeviceAccess/RegionSpecificPrivacyAccessPolicy\">",
        "    <Setting>CompatibilityViewDomains</Setting>",
        "%s: '%s' is not a valid child node for %s",
        ">:>`>e>j>y>",
        "9~@v.",
        "CreateFileW",
        "n    Unrecognized WPX_SETUP_PASS %u",
        "6 6$6,60686<6D6H6P6T6\\6`6|6",
        "  <Setting Path=\"/MediaCenter/WorkOffline\">",
        "  <Setting Path=\"/OutOfBoxExperience/OemExtensionXmlFilePath\">",
        "1=1B1G1W1r1",
        "93:`:",
        ":!:&:+:C:N:^:o:",
        "Unable to instantiate %s: Couldn't find %s / %s in this SKU",
        "EvalValueMatches : Not yet implemented",
        "    Couldn't export asynchronous command %u",
        "8\"888=8B8M8o8|8",
        "1-191J1V1[1`1",
        "wpaf:Dependencies",
        "1'1@1L1Q1V1p1",
        "jQXVPh",
        ".?AUIWpxTargetCondEnum@@",
        "    Failed to load excluded URIs from footprint",
        "  <Setting Path=\"/HelpAndSupport/OnlineSupportIconImage\">",
        "9*959F9d9~9",
        "    Must specify both Min and Max for a range condition",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "  <Setting Path=\"/Audio/EnableVolumeControlWhileLocked\">",
        ".?AVlength_error@std@@",
        "9 :0:;:",
        "tCF;w",
        ":7:O:",
        "0e0q0|0",
        "<?xml version=\"1.0\"?>%s",
        "yrWh'",
        "  <Setting Path=\"/WindowsDefender/FallbackOrder\">",
        "3#3O3Y3t3",
        "    <Setting>ValidCommunities</Setting>",
        "5 5$5(5@5D5X5\\5t5x5|5",
        "    GetVisibility() failed, will return TRUE",
        "u:DiskConfiguration",
        "WpxCreateConfig",
        "y@WjCh",
        "555[5w5",
        "  <Setting Path=\"/TerminalServices/LicenseServer/DatabasePath\">",
        "    Must specify a <Modify> node for items in <ModifiedPartitions>",
        "    ImageSelection node missing required InstallImage node",
        ">->O>T>Y>e>~>",
        "    Error initializing setting.",
        "    Couldn't export package type",
        ">@>t>",
        "7'7E7J7O7[7j7}7",
        "    Couldn't check whether type decl for %s has an @key",
        "u:ForceShutdownNow",
        "    <Setting>HKLMSendTimeOut</Setting>",
        "        >Microsoft-Windows-Audio-VolumeControl</Component>",
        "u:UILanguage",
        ";);5;A;F;K;",
        "    Couldn't write asset setting %s",
        "    <ManifestFile>printing-spooler-core.man</ManifestFile>",
        ".?AVWpxDeplEnvSettings@@",
        "WpxSetDeplSettings",
        "SettingNode::GetAnsEnumValues",
        "    ModifyPartition missing required PartitionID parameter",
        "yGWhf",
        "m    Failed to add list item to %s",
        "ywPhN",
        "    Couldn't import provisioning settings",
        "WpxSmiHive::GetSetting",
        "      <Pass>auditSystem</Pass>",
        "    Failed to add <TargetState> to the document tree",
        "        <Setting Path=\"/Power/CustomPowerApplication6/Application\" />",
        ".?AUIWpxPackagingSession@@",
        ":';5;K;P;U;`;n;",
        "Contains",
        "WpxXmlNode::GetChildren",
        "    <Setting>WindowsT</Setting>",
        ".?AVEnum@?1??GetAnsEnumValues@McsfLeafNode@@UAEJPAPAUIWpxSchemaAllowedValueEnum@@@Z@",
        "9-9c9s9",
        ".?AVWpxImage@@",
        "        >Microsoft-Windows-IE-ClientNetworkProtocolImplementation</Component>",
        ";4;9;>;J;k;",
        "2%2O2u2",
        "wpaf:Format",
        ".CRT$XCZ",
        "44595>5J5",
        ".?AV?$CAutoRelease@PAUIWpxRuleDescEnum@@@RAII@@",
        "    Common setting %s not allowed in any suitable passes",
        "WpxConfig::GetVariantSettings",
        "080=0B0N0e0p0",
        "  <Setting Path=\"/TCPIP/Interfaces\">",
        "</<H<M<R<`<m<r<w<",
        "7#767Z7",
        "2$2,242<2D2L2T2\\2d2l2t2",
        "    InstallFrom is required for data images",
        "727N7S7X7d7~7",
        "    Failed to allocate img",
        "6-6:6E6d6i6n6z6",
        "    Failed to write destination partition index",
        ".?AV?$CAutoCleanupBase@PAK@RAII@@",
        "< <;<Q<V<i<t<",
        "??0exception@@QAE@XZ",
        "    <Setting>TouchUISize</Setting>",
        "        <Setting Path=\"/Connections/Item/Proxy/Exception\" />",
        "    Failed to add variants",
        "    Failed to allocate *Keys",
        "</Exclusions>",
        "WpxWpafWriter::WriteBoolSetting",
        "838B8_8s8",
        "2>2Y2x2",
        "SettingNode::GetMapKeyEnumValues",
        ";$;,;4;<;D;P;t;|;",
        "    Failed to allocate ins",
        "292f2}2",
        ".text$yd",
        "WIMBootFrom",
        "8&8T8a8l8",
        "  <Setting Path=\"/Embedded/KeyboardFilter/AltWin\">",
        ".CRT$XIAA",
        "u:LogPath",
        "DeplWpafExporter::Export",
        "yHShi",
        "    Couldn't set map value friendly name for %s",
        "  <Setting Path=\"/SecureStartup/SlicedEncryptionMinSize\">",
        "    <Setting>InPlaceCrypto</Setting>",
        "797D7U7x7",
        "PageFile/SizeMB",
        "    Failed to allocate dir",
        ":):?:b:l:",
        "u:Restart",
        "    Unknown answer file schema",
        "AllowedPasses",
        "    Failed to read value %s",
        "    <Setting>InstalledToolbarsList</Setting>",
        "  <Setting Path=\"/Embedded/KeyboardFilter/LeftShiftLeftAltNumLock\">",
        "  <Setting Path=\"/Tablet/TouchEnabled\">",
        ":.:L:W:h:x:",
        "  <Setting Path=\"/Power/CustomPowerApplication2\">",
        ".?AUIWpxAllowedValue@@",
        ">0>B>M>d>p>u>z>",
        "ReleaseSemaphore",
        "*[local-name()='%s']",
        "wpaf:Drivers/wpaf:Driver",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsO\">",
        ".?AVWpxUnattendReader@@",
        "    <Setting>TrapConfiguration</Setting>",
        ".?AVWpxUnattendWriter@@",
        "    Failed to check if left schema enumerates allowed file extensions",
        "  <Setting Path=\"/InternetExplorer/FavoritesDelete\">",
        "Generalize",
        "QQSVWj",
        ">3>8>=>I>w>",
        ">1>A>K>a>p>v>",
        "    <Setting>CustomPowerApplication2</Setting>",
        "    Got non-textual IWpxSchemaAllowedValue from schema IWpxSchemaAllowedValueEnum",
        "<$<,<4<<<D<L<X<|<",
        "    <Setting>HelpAndSupport</Setting>",
        "        >Microsoft-Windows-SecureStartup-FilterDriver</Component>",
        "%s: Value",
        "    <Setting>LogonCommands</Setting>",
        "    Failed to load store from installation at %s",
        "    State: Argument cannot be NULL",
        "Microsoft Corporation1&0$",
        "<(<L<T<\\<d<l<t<|<",
        "4-4M4h4u4",
        "  <Setting Path=\"/Embedded/DisplayDisabled\">",
        "e    Couldn't read value of boolean setting %s",
        "y&Vh3",
        "bad allocation",
        "WpxWpafReader::ReadMetadata",
        "u:MetaData",
        "ReleaseSRWLockExclusive",
        ";-;V;q;",
        "y-VhK",
        ".?AV?$CAutoCleanupBase@PAVWpxImage@@@RAII@@",
        "  <Setting Path=\"/WindowsDefender/TrustedImageIdentifier\">",
        "    Attributes can only be set on elements",
        "<1<J<S<X<l<",
        ":$:,:4:@:d:l:t:|:",
        "4@4`4",
        "VerticalResolution",
        "Loaded settings from Windows %s %s",
        "585W5z5",
        "7$7?7^7l7|7",
        "3,3G3f3q3",
        "wpaf:StartOOBE",
        "    Failed to set namespace prefix for policy XML namespace URI",
        "    Couldn't get configuration settings for phase %u",
        "=F=Q=h=}=",
        "    Couldn't get item %llu of %llu from %s",
        ".?AV?$CAutoCleanupBase@PAVWpxDriver@@@RAII@@",
        "  <Setting Path=\"/InternetExplorer/NoDial\">",
        "DeplWpafExporter::ExportInstall",
        "5F5T5",
        "    <ManifestFile>Security-Malware-Windows-Defender.man</ManifestFile>",
        "    Couldn't base64-encode buffer for %s",
        "    Couldn't write WDS file name",
        "        <Setting Path=\"/Messaging/PerSimSettings/__ICCID/AllowSendingDeliveryReport\" />",
        ";(;8;=;B;P;k;p;u;",
        "5/5W5l5w5",
        "    Removed %s from answer table, but couldn't remove from answer tree",
        "  <Setting Path=\"/Shell/LogonCommands\">",
        "/wpaf:Settings/wpaf:WindowsPE/wpaf:CustomCommands",
        ".?AV?$CAutoCleanupBase@PAVWpxSource@@@RAII@@",
        "    <Setting>DisableOOBAccelerators</Setting>",
        "  <Setting Path=\"/Shell/NotificationArea\">",
        "9+9S9X9]9k9",
        "2:2X2e2}2",
        "        <Setting Path=\"/Connections/Item/Connection/TetheringNAI\" />",
        "        <Setting Path=\"/Shell/Start/Item/PrepinnedTile/OEMAppID\" />",
        "  <Setting Path=\"/Sidebar/Gadget3\">",
        "; ;3;J;O;T;_;{;",
        "  <Setting Path=\"/InternetExplorer/QuickLinkList\">",
        "    <ManifestFile>Microsoft-Windows-CoreSystem-SharedAccess.man</ManifestFile>",
        "  <Setting Path=\"/OnlineBackup/DescriptionText1\">",
        "  <Setting Path=\"/InternetExplorer/Help_Page\">",
        "=Wjzh",
        "> >1>[>y>~>",
        "        >Microsoft-Windows-TCPIP</Component>",
        "5'575<5A5P5l5q5v5",
        "WpxWpafReader::ReadTargetState",
        "8E8J8O8[8t8",
        ".?AV?$CAutoCleanupBase@PAUNode@WpxPathTree@@@RAII@@",
        "    Couldn't parse <IgnoreCheck> element",
        "=0>5>:>G>",
        "63686=6I6\\6",
        "entiu<3",
        "WpxCondition::GetPhase",
        "8/8R8S9v9",
        "u:selection",
        "WpxSetting::GetMaxItemCount",
        "wpaf:WimImage/wpaf:ImageMetadata/wpaf:Path",
        ">$>)>5>B>G>L>X>i>",
        "    Must specify a package path and/or identifier",
        "<(<6<F<b<p<",
        "7$737S7e7",
        "        >Microsoft-Windows-Security-SPP-UX</Component>",
        "RunSynchronousCommand",
        "wpaf:CustomCommands/wpaf:Asynchronous/wpaf:Command",
        "  <Setting Path=\"/PCSettings/DisplayNetworkSelection\">",
        "y3ShX",
        ".?AV?$CAutoRelease@PAVWpxPathEnum@@@RAII@@",
        "    Error while trying to validate settings tree below %s",
        "  <Setting Path=\"/Domain/MaintainServerList\">",
        "8@8`8{8",
        "    Unhandled variant type %u",
        ".?AV?$CAutoDelete@PAVWpxVariant@@@RAII@@",
        "4,5C5Z5h5",
        ".?AUIWpxSchema@@",
        "onecore\\base\\ntsetup\\wpx\\ks\\store.cpp",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-International-Core-WinPE']/u:InputLocale",
        "WpxXmlNode::SetAttribute",
        "    Couldn't write target path %s for %s",
        "    Couldn't export page file path",
        "    <Setting>CustomFilters</Setting>",
        "language",
        ";@<E<h<y<",
        "2(2?2V2",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsF1\">",
        "onecore\\base\\ntsetup\\wpx\\core\\footprint.cpp",
        "9^@v\"",
        "metadata\\complexTypes",
        "  <Setting Path=\"/SharedAccess/InternalIsBridge\">",
        "8%8D8V8v8",
        "    Couldn't iterate over data images",
        "    Couldn't parse contents of <EnableWhenSupported> element",
        "    <Setting>TimeZone</Setting>",
        "    Failed to enumerate Pass nodes",
        "9~(v.",
        "    Couln't parse boolean value %s for InstallToAvailablePartition",
        "=,=J=Q=[=u=z=",
        "9A9L9d9",
        "    Failed to iterate over children of %s",
        "u:Compact",
        "%s: Map key is",
        "    <Setting>DisableHighResolutionCheck</Setting>",
        "    <Setting>InputLocale</Setting>",
        "    <Setting>WindowsC</Setting>",
        "WpxUnattendWriter::GetPassForCommonSetting",
        "    Inner enumerator failed to iterate",
        "        <Setting Path=\"/Messaging/PerSimSettings/__ICCID/MaxRetryCount\" />",
        "tUhdC",
        "</<<<[<`<e<}<",
        "6*6O6g6l6q6",
        "y5VhX",
        "    <Setting>IntfQuarantineEnabled</Setting>",
        "    <Setting>OEMLogoUri</Setting>",
        "    <Setting>WindowsV</Setting>",
        "    <Setting>OemExtensionXmlFilePath</Setting>",
        "        >Product-systemos__Microsoft-Windows-Audio-AudioCore</Component>",
        "    '%s' is too short (requires %u characters minimum)",
        "5*555L5X5]5b5",
        "        <Setting Path=\"/Connections/Item/Connection/OemConnectionId\" />",
        "    <Setting>Bridge</Setting>",
        "000N0w0|0",
        "XSVWj8",
        "    <Setting>SkipRearm</Setting>",
        "    <Setting>fAllowFullControl</Setting>",
        "    Failed to write subtree of top-level setting %s/%s (%s)",
        "    Missing required disk index",
        "    Couldn't write optional metadata field(s)",
        "3(3H3P3`3",
        "    <Setting>Window_Title_CN</Setting>",
        "QLj Yf#",
        "OriginalFilename",
        "    Error initializing text data.",
        "    Couldn't add %s %u to enumerator",
        "TextType",
        "3L3h3",
        "    Failed to add condition to target",
        "    Keys: Argument cannot be NULL",
        "7!7&727J7Z7t7y7~7",
        "SSSSSSS",
        "    Couldn't convert input pass %u to a pass string",
        "WpxUnattendWriter::WriteCommonSettings",
        "lL7Ki\"0",
        "        <Setting Path=\"/Connections/Item/Policy/Host\" />",
        "    <Setting>WindowsH</Setting>",
        "@.reloc",
        "    <Setting>DNSSuffixSearchOrder</Setting>",
        "WpxSetting::Initialize",
        "=#=(=-=9=U=",
        "    Failed to parse XML for item %s of %s",
        "4!4&4+4=4h4",
        "LogHr",
        ".?AV?$CAutoCleanupBase@PAVWpxSmiHive@@@RAII@@",
        "  <Setting Path=\"/Camera/NoPhysicalLED\">",
        "  <Setting Path=\"/Licensing/PartnerID\">",
        "Owner",
        "WpxSettingIssue::GetSetting",
        "DeplWpafImporter::ImportCommand",
        "RtlFindNextForwardRunClear",
        ".?AUIWpxStateDescEnum@@",
        "0,01060B0s0",
        ";<;D;L;T;\\;h;",
        "/wpaf:Settings/wpaf:SetupEvents/wpaf:FinishOfflinePhase",
        "1%1=1B1G1S1i1}1",
        "WpxOpenSystemStore",
        "DefaultBin",
        "y0VhZ",
        "    Couldn't get asset source path",
        "=0=5=:=H=r=",
        "212Y2^2c2}2",
        "    Couldn't iterate over DataImages",
        "n    Failed to allocate cond",
        "    <ManifestFile>Microsoft-Windows-SharedAccess.man</ManifestFile>",
        "OnLastRemove",
        "    Unknown WPX_VISIBILITY_RULE_TYPE %u",
        ">0>4>L>P>h>l>",
        "vLh$z",
        "9&919A9m9{9",
        ".?AVEnumerator@?1??GetVisibility@SettingNode@@UAEJPAPAUIWpxStateDescEnum@@@Z@",
        "    <Setting>StartPanelOff</Setting>",
        "    Couldn't enumerate setting schema children",
        "y-Vh]",
        "    Couldn't get answer as string",
        ":\":<:V:x:",
        "    TargetValue: Argument cannot be NULL",
        "RefreshRate",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "9$9,949@9`9h9p9x9",
        "WpxUnattendWriter::GetNodeTreeForPass",
        ".?AVSmiStore@@",
        "4#4-4K4`4|4",
        "/u:unattend/u:settings[@pass='auditUser']/u:component[@name='Microsoft-Windows-Deployment']/u:RunAsynchronous",
        "1&2+202G2Q2d2",
        "MultiByteToWideChar",
        "    Can't specify <%s> in items of <CreatedPartitions>",
        "    Couldn't parse <Condition>",
        "  <Setting Path=\"/Sidebar/Gadget4\">",
        "y1Wh4",
        "@.rsrc",
        "    Failed to export package %u",
        "Registry",
        ".?AUIWpxVariant@@",
        "Microsoft Time-Stamp PCA 20100",
        "    Failed to retrieve answer lower bound from schema",
        "u:AuditComputerName/u:WillReboot",
        "    Failed to allocate commands",
        "DeplUnattendExporter::GetTargetArch",
        "1P2x2",
        ".?AUIWpxDeplEnvSettings@@",
        "989W9\\9a9m9",
        "y-Vh@",
        "/wpaf:Settings/wpaf:Provisioning/wpaf:Features",
        ";,;8;=;B;r;};",
        "~0j.V",
        ">T>|>",
        ".?AV?$CAutoRelease@PAUIWpxSchemaStore@@@RAII@@",
        "  <Setting Path=\"/Firewall/DomainProfile/LogFileSize\">",
        "9_$v\"",
        "  <Setting Path=\"/WindowsDefender/SignatureUpdateInterval\">",
        "  <Setting Path=\"/Shell/Themes\">",
        "727D7O7g7{7",
        "    Failed to read item %u of %s",
        "2#212G2R2j2",
        "?%?H?M?R?^?s?",
        "  <Setting Path=\"/OnlineBackup/Link2Text\">",
        "    Couldn't get setting path for setting %s under component %s",
        "?%?/?A?c?",
        ".CRT$XCL",
        "REG_EXPAND_SZ",
        ".?AVMcsfLeafNode@@",
        "REG_MULTI_SZ",
        "u:RunSynchronous/u:RunSynchronousCommand",
        "2 2$2(2<2L2P2T2l2p2",
        "  <Setting Path=\"/Printing/RemoveMXDW\">",
        "WpxUnattendWriter::WriteSkeleton",
        "    <ManifestFile>prod_MobileCore-Audio-AudioCore.man</ManifestFile>",
        "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:EnableWIMBoot",
        "WpxConfig::LoadOnlineStore",
        "878K8j8z8",
        "    Unrecognized WPX_DEPLOY_PHASE %u",
        "9$9,949@9`9h9p9|9",
        "WpxSetting::GetAnsMinLength",
        "WpxXmlDocument::GetRoot",
        "y#Vhv",
        "wcsnlen",
        "    Failed to allocate validation",
        "        langauge=\"neutral\"",
        "    Failed to allocate finishAudit",
        "9~(s+j",
        "C\\;{`r",
        "    Failed to add <Variant> element to document",
        "y-Vh{",
        "<WpxUnattend>",
        "    <Setting>NotInOOBE</Setting>",
        ">\"?'?,?C?M?~?",
        ".?AUIWpxUniversalApp@@",
        "    Couldn't set @pass attribute of <settings> element",
        "3*3/343_3~3",
        "VS_VERSION_INFO",
        "j~Xf9",
        ".?AVEnumerator@?1??GetAnsEnumValues@SettingNode@@UAEJPAPAUIWpxSchemaAllowedValueEnum@@@Z@",
        "wpaf:EnableCompactOS",
        "=3=[=",
        "3R:i:",
        "WpxWpafReader::ReadBoolValue",
        ";*<Z<",
        "787J7U7y7",
        "wpaf:WdsImage/wpaf:ImageGroup",
        "Staged",
        "unattend",
        "  <Setting Path=\"/Firewall/PrivateProfile_EnableFirewall\">",
        "5%6M6",
        "    Couldn't write multivariant targets",
        "DeplUnattendImporter::ImportFeature",
        "    FilePath: Argument cannot be NULL",
        "    Couldn't write VHD file path",
        "WpxSetting::GetApplyInfo",
        "    Couldn't import windowsPE-phase driver",
        "  <Setting Path=\"/Firewall/DisableStatefulPPTP\">",
        "DeplUnattendExporter::GetPackaging",
        "6$6:6N6l6",
        "Enable",
        "    <Setting>OCURProductKey</Setting>",
        "    Failed to allocate drivers",
        ";1;I;a;y;",
        "9(949T9l9p9|9",
        ".?AVWpxParseIssue@@",
        "y2WhE",
        "FilePath",
        "yMShG",
        "    Couldn't load the WIM file at %s",
        "    Failed to write inverted attribute",
        "PreventPending",
        "696>6M6a6o6",
        "  <Setting Path=\"/InternetExplorer/BlockPopups\">",
        "4%424G4S4X4]4t4",
        "y-PhJ",
        "GetModuleFileNameA",
        "WpxConfig::LoadPackagePolicyXML",
        "y2Ph]",
        "    Couldn't parse partition index",
        "535G5^5}5",
        "EnableDynamicUpdate",
        "    Couldn't parse %s as an integer",
        "SmiStore::PruneUnattendMapRecursive",
        "    Couldn't write WIM metadata XPath",
        "    Partition type is required for CreatePartition",
        "state",
        "  <Setting Path=\"/StartMenu/UseClassicAppearance\">",
        "Serialization",
        "y)WhW",
        "yEWh\"",
        "DebugBreak",
        "    <Setting>WLANPlatformLevelDeviceResetSupported</Setting>",
        "    Path %s is excluded by exclusion filter",
        "_unlock",
        "  <Setting Path=\"/InternetExplorer/CommandLabelDisplay\">",
        "    Can't export combined create/modify partition list to unattend (use WPAF instead)",
        "wpaf:PreventPending",
        ">\">.>J>U>n>",
        "  <Setting Path=\"/OEM/WelcomeCenterLinks\">",
        "Display/ColorDepth",
        "    Couldn't export boot drivers",
        "    <Setting>ConfigurationFlags</Setting>",
        "GetLastError",
        "7\"8'8,8;8W8v8",
        "    Failed to clone configuration",
        "4,474O4p4}4",
        ".?AVFilter@?1??FilterExcludedChildren@SmiStore@@AAEJABVWpxPath@@PAUIWpxStringEnum@@PAPAU4@@Z@",
        "    <Setting>WindowsO</Setting>",
        "Password",
        "Height",
        "y-Vh~",
        "WpxXmlNode::GetChildCount",
        ">,>C>",
        "    Couldn't write diagnostics setting",
        "    Failed to check whether %s exists in SMI store",
        "ForceShutdownNow",
        "y1Wh7",
        "wpaf:ClusterSize",
        "5S5n5",
        "        >Microsoft-Windows-WDF-Kernel Library</Component>",
        "=$=)=\\=o=",
        ".?AV?$CAutoCleanupBase@PAUIWpxVisibilityState@@@RAII@@",
        "    Couldn't check if Windows %s %s has %s",
        "    Failed to parse data for pass %s",
        "    Couldn't iterate over ModifyPartitions",
        "DeplWpafExporter::ExportSvcPackages",
        "404L4c4",
        "ntdll.dll",
        ";0;@;`;r;",
        "3%3*3/3;3L3s3",
        "    <Setting>ShowWindowsLive</Setting>",
        "7!777C7O7[7`7e7",
        "%s:%s",
        "5&6@6E6J6V6m6r6w6",
        "WpxGetDeplSettings",
        "0=0Q0t0",
        ".?AUIWpxRuleDescEnum@@",
        "    Couldn't get child node names from Knobs store hive",
        "2 20242D2H2X2\\2l2p2",
        "    Value %lld is above the inclusive maximum %lld",
        "CFG_DATATYPE_MULTIPLE_STRING",
        "    ParamName: Argument cannot be NULL",
        "    Couldn't get edition from %s image %u",
        ".?AVFilter@?1??Clone@WpxConfig@@UAEJPAPAUIWpxConfig@@@Z@",
        "    Couldn't write OOBE reseal shutdown flag",
        "  <Setting Path=\"/Domain/UnattendedJoin/Online\">",
        "    Failed to import <Package> element",
        "2A3|7",
        "    <Setting>AnimationDisabled</Setting>",
        "6 626K6X6",
        "?4?D?T?d?h?p?t?x?|?",
        "    <ManifestFile>MicrosoftWindowsSystemRestore-Main.man</ManifestFile>",
        "    Can't determine value size for %s",
        "    Failed to register WpxSetting %s",
        "    Incomplete AccessCredentials (must specify username and password)",
        "    Internal IWpxVisibilityRuleDesc enumerator failed",
        "e    Invalid phase %u",
        "WpxTargetState::AddPatternCondition",
        "  <Setting Path=\"/Printing/StartAutoLogger\">",
        ".?AV?$CAutoCleanupBase@PAUIWpxAnswerFileWriter@@@RAII@@",
        "    Failed to create filter for excluded child paths",
        "VjBh0",
        "    Couldn't find component named %s",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:Display",
        "< <2<X<]<b<y<",
        "    Invalid value %s given for package permanence",
        ":(:W:w:",
        "    Couldn't iterate over <Partition> elements",
        "    <Setting>DoNotCleanUpNonPresentDevices</Setting>",
        "wpaf:Install",
        "        >Microsoft-Windows-TabletPC-Platform-Input-Core</Component>",
        "3)3.333K3V3",
        "    Failed to export miscellaneous install options",
        "  <Setting Path=\"/Firewall/PublicProfile_EnableFirewall\">",
        "WpxValidation::ValidateAsset",
        "SmiSchemaNode::GetMapKey",
        "<,<<<L<\\<l<|<",
        "454G4^4l4",
        "    <Setting>DefinitionUpdateFileSharesSources</Setting>",
        ".?AVDeplUnattendImporter@@",
        "<(<7<L<Q<V<d<t<",
        "2/2>2M2b2x2",
        "/u:unattend/u:settings[@pass='auditUser']/u:component[@name='Microsoft-Windows-Deployment']/u:Generalize",
        "    Unable to instantiate %s from %s / %s",
        ";V;`;{;",
        "    Failed to allocate *Values",
        "    MinLength: Argument cannot be NULL",
        "    <Setting>Display</Setting>",
        "onecore\\base\\ntsetup\\wpx\\depl\\wpafimporter.cpp",
        "    <ManifestFile>TapiSetup.man</ManifestFile>",
        "7$7,747<7D7L7X7x7",
        "4&464a4|4#5(5-5<5^5",
        "    Couldn't choose target pass for %s",
        "    <Setting>NoLockScreen</Setting>",
        "        >Microsoft-Windows-PartitionManager</Component>",
        ">$>)>@>M>",
        "t>Qh@",
        "8)8.838",
        "3 3(343T3\\3d3l3x3",
        ".?AV?$CAutoCleanupBase@PAUIWpxDeplSettings@@@RAII@@",
        "    Invalid permanence value %s specified for package source location",
        "7+7I7N7S7_7",
        ".?AUIWpxParseIssue@@",
        "    Failed to get or create parent node for %s",
        "DeplWpafImporter::ImportIns",
        "WaitForSingleObject",
        "    Failed to get IXMLDOMNodeList length",
        "    Failed to export install images",
        "    <Setting>MaxCryptoRequestsPerIo</Setting>",
        ".?AVEnumerator@?1??GetGroupNodeChildren@KnobsStore@@AAEJABVWpxPath@@PAPAUIWpxStringEnum@@@Z@",
        "/wpaf:Settings/wpaf:SetupEvents/wpaf:StartOOBE",
        "WpxSmiSetting::GetIntEnumValues",
        "    Failed to iterate over settings for group %s",
        "7$7,747<7D7L7T7\\7d7l7t7|7",
        "1!1O1T1Y1g1z1",
        "    Extensions: Argument cannot be NULL",
        "McsfLeafNode::ParseOptions",
        "  <Setting Path=\"/NetworkLoadBalancing/Clusters\">",
        "RtlAcquireSRWLockExclusive",
        "4,404H4L4P4d4h4l4p4x4|4",
        "onecore\\base\\ntsetup\\wpx\\mcsf\\mcsfstore.cpp",
        "    Failed to retrieve answer upper bound from schema",
        "  <Setting Path=\"/InternetExplorer/IntranetCompatibilityMode\">",
        "        >Microsoft-Windows-ClientCore-Audio-AudioCore</Component>",
        ">#>.>K>`>k>",
        "    Can't read minInclusive value",
        "    Couldn't parse contents of Network/Enabled element",
        "    Couldn't import data image",
        "    IWpxCommand %s has incomplete access credentials",
        "    Can't specify an explicit partition size for entries of <ModifiedPartitions>",
        "j9XSPh",
        "y.Vh{",
        "    Failed to prune empty path %s from unattend map",
        "    Failed to enumerate over left schema values for property %s",
        "    Unattend doesn't support the IgnoreCheck or PreventPending flags",
        "    Failed to load footprint file %s",
        "3\"343Q3V3[3g3v3",
        "0=0L0]0i0u0z0",
        "9-9D9Q9\\9t9",
        "9'9F9h9",
        "7!7&727K7`7w7",
        "  <Setting Path=\"/Sidebar/SidebarOnByDefault\">",
        "2+3L3h3",
        "545<5D5P5p5|5",
        "737S7e7",
        "    <Setting>WindowsF1</Setting>",
        "838=8U8m8",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "_wcsicmp",
        "y2Vhm",
        "    Couldn't write processing order",
        "1A1^3",
        "    Incomplete InstallTo node (DiskID and PartitionID are required)",
        "=X=]=b=q=",
        "?(?J?^?",
        "onecore\\base\\ntsetup\\wpx\\depl\\unattendimporter.cpp",
        "    No settings loaded; skipping settings tree for phase %u",
        "    Couldn't export disk partition %u",
        "    <Setting>SlicedEncryptionInPlace</Setting>",
        "    Can't get length of hive value %s",
        ".?AV?$CAutoRelease@PAVWpxAllowedValue@@@RAII@@",
        "    Failed to get IXMLDOMNodelist length",
        "    <Setting>WriteIoAggregateMinSize</Setting>",
        "2$282L2\\2l2x2",
        "131h1m1r1~1",
        "    Failed to iterate over children for %s",
        "/wpaf:Settings/wpaf:Provisioning/wpaf:MBSDriverSet",
        ">(>F>_>d>i>",
        "WpxValidation::ValidateIsAllowed",
        "FindResourceExW",
        "1:1D1M1R1h1y1~1",
        "8/84898J8",
        "    Failed to allocate setup",
        "272B2N2s2",
        "yGWhz",
        "?9?>?C?R?",
        "    Failed to export asynchrous command %u",
        ".?AUIWpxVisRuleEnum@@",
        "Preserve",
        "    Couldn't write permanence for package path %u",
        "McsfLeafNode::GetDefaultBinary",
        "DeplWpafExporter::ExportEnvPageFile",
        "y4Wh@",
        "    <Setting>RegisteredOrganization</Setting>",
        "=;>@>E>Q>{>",
        "    Couldn't get schema for item node %s",
        "    Couldn't get answer from source tree at path %s",
        "9A8s+hz",
        "    Couldn't read value of integer setting %s",
        "676F6U6d6s6",
        "onecore\\base\\ntsetup\\wpx\\file\\unattendreader.cpp",
        ":4;9;>;J;l;",
        ">!>2>>>J>O>T>~>",
        ":4:E:e:j:o:",
        "4%4@4[4v4",
        "    Failed to open setting key %s",
        "WpxVariant::RemoveTarget",
        "wpaf:UniversalApps/wpaf:App",
        "WpxXmlDocument::SelectNode",
        "    Couldn't write display refresh rate",
        "    <ManifestFile>AppInfoCfg.man</ManifestFile>",
        "0 000@0P0`0p0",
        "y3Wh@",
        "4$404B4W4u4",
        "    Invalid command reboot flag %u",
        "    Can't parse boolean value %s for Extend",
        "    <Setting>AdaptiveBrightness</Setting>",
        ": :(:,:4:<:@:H:P:T:\\:d:h:p:x:|:",
        "=5=H=W=f=u=",
        "  <Setting Path=\"/Fax/FaxUnattend\">",
        "    Couldn't write source path %s for %s",
        "Attempting to load schema hive at %s",
        "rUserInfo",
        "8$8@8\\8t8",
        "Package/Type",
        "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:EnableDiagnostics",
        "4R4e4n4u4",
        "    <Setting>PreApprovedAddons</Setting>",
        "8,898J8c8o8",
        "60646L6P6h6x6",
        "WpxXmlNode::GetText",
        ":4:o:",
        "  <Setting Path=\"/UserAccounts/OfflineAccounts\">",
        "WpxOpenWimStore",
        "WpxSetting::GetListIndex",
        "WpxResetDeplSettings",
        "QQSVW",
        "  <Setting Path=\"/OnlinePrinting/href\">",
        "0>0C0H0V0f0",
        "    Couldn't clear subtree of %s",
        "/*[local-name()='CustomizationPolicy']/p:SettingsGroup[@Path='%s']",
        "t    Failed to allocate env",
        "    <Setting>Alt</Setting>",
        "WpxConfig::LoadInstallationStore",
        "        <Setting Path=\"/Messaging/PerSimSettings/__ICCID/WapPushTechnology\" />",
        "*[u:Order='%lld']",
        "  <Setting Path=\"/SecureStartup/MaxDecryptRequests\">",
        "Update",
        "    Failed to allocate command",
        ">$>,>4><>D>P>p>x>",
        "    Failed to check whether %s has a maximum item count",
        ".text$mn",
        "6;6E6Q6]6b6g6",
        "8$9=9]9b9g9v9",
        "        <Setting Path=\"/Connections/Item/Proxy/EnableProxy\" />",
        "WpxSmiSetting::Initialize",
        "    Failed to write common settings tree",
        ".?AUIWpxStore@@",
        "y-Vh`",
        "    Failed to allocate sessions",
        "    <Setting>CustomScancodes</Setting>",
        "DeplUnattendImporter::ImportCreatePart",
        "    <Setting>BlockPopups</Setting>",
        "6,676L6h6s6",
        "?,?7?C?R?f?",
        "        >Microsoft-Windows-Deployment</Component>",
        "2*2/242@2Z2u2",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsJ\">",
        "    <Setting>WindowsShiftLeft</Setting>",
        "WpxSmiOpenStore",
        "g    Failed to initialzie %s",
        ".?AVMcsfApplyInfo@@",
        "    <Setting>ShowStatusBar</Setting>",
        "6)6.636>6\\6a6f6w6",
        ">>>C>H>V>f>",
        ":):5:I:i:n:s:",
        "    Couldn't set attribute %s to %s",
        "y\"VhB",
        ">#>?>M>",
        "Asynchronous",
        "    Failed to load XML data",
        ".?AV?$CAutoWimClose@PAX@RAII@@",
        "9$999N9b9w9",
        "McsfLeafNode::ParseCspType",
        "WpxSettingIssue::Create",
        ".?AV?$CAutoRelease@PAUIWpxVisStateEnum@@@RAII@@",
        "    Couldn't get answer for integer setting %s",
        "?'?B?h?",
        "        <Setting Path=\"/Shell/Start/Item/PrepinnedTile/Size\" />",
        "  <Setting Path=\"/Embedded/KeyboardFilter/CtrlF4\">",
        "=0=`=t=",
        "        >Microsoft-Windows-Embedded-UnifiedWriteFilter</Component>",
        "0 0[0}0",
        "    Failed to import MBS driver set",
        ":6:@:",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:Diagnostics/u:OptIn",
        "    Method was called on a non-tree setting (type %u)",
        "    Failed to convert XSD type %s to SMI type",
        "_^[Y]",
        "    <Setting>WindowsShiftDown</Setting>",
        ":@;a;",
        "8#808;8R8i8y8~8",
        "DeplWpafImporter::Import",
        "    Failed to check if there are any loaded settings",
        "n    Failed to iterate over nodes matching %s",
        "/wpaf:Settings/wpaf:Servicing/wpaf:Drivers",
        "    Failed to write target node",
        "`PAGE",
        "        <Setting Path=\"/DeviceManagement/Policies/MMS/MMSMessageRoles\" />",
        "    Couldn't write user name",
        "    Failed to iterate over child paths",
        ".?AV?$CAutoCleanupBase@PAUIXMLDOMParseErrorCollection@@@RAII@@",
        "        <Setting Path=\"/USBErrorsOEMOverride/NotifyOnUsbErrors\" />",
        "UserLocale",
        "4$5/5;5I5T5`5v5",
        ".?AV?$CAutoRelease@PAUIWpxSchemaAllowedValueEnum@@@RAII@@",
        ">(?8?D?d?p?",
        "ComputerName",
        "    <Setting>FavoritesList</Setting>",
        "<(<-<2<J<W<",
        "AllowedPhases",
        ";\";9;C;];b;g;",
        "u:AcceptEula",
        "    Couldn't set <settings> @pass attribute",
        "  <Setting Path=\"/InternetExplorer/EnableLinksBar\">",
        "  <Setting Path=\"/Shell/DesktopOptimizations\">",
        "y0Vhn",
        ";L;V;",
        ".?AV?$CAutoRelease@PAVWpxSimpleAllowedValue@@@RAII@@",
        "=8>=>[>`>e>q>",
        "  <Setting Path=\"/TerminalServices/LicenseServer/Role\">",
        "SetLastError",
        "    Couldn't initialize setting at path %s",
        "wpaf:Language/wpaf:SystemUI/wpaf:MainLanguage",
        "    Couldn't export feature state",
        "~.j~P",
        "_lock",
        "6*7/747O7y7~7",
        "    <Setting>OverlayMaximumSize</Setting>",
        "8#888V8v8{8",
        "    Failed to create <servicing> element",
        "DeplUnattendImporter::ImportWinPELanguages",
        "5S5_5",
        "7S8p8u8z8",
        "        >Microsoft-Windows-SystemRestore-Main</Component>",
        "    <ManifestFile>NetworkLoadBalancing-Core.man</ManifestFile>",
        "    <Setting>VolumeUp</Setting>",
        "y0VhP",
        "Always",
        "y.Wh=",
        ".?AV?$CAutoCleanupBase@PAVMcsfStore@@@RAII@@",
        "    <Setting>FirewallGroups</Setting>",
        "    Reference to undefined target state '%s'",
        "  <Setting Path=\"/InternetExplorer/ShowInformationBar\">",
        "        >Microsoft-Windows-TapiSetup</Component>",
        "    Failed to allocate xml",
        "7?8a8",
        "onecore\\base\\ntsetup\\wpx\\core\\answer.cpp",
        "    Failed to allocate childNode",
        "    Couldn't initialize %s node %s",
        "= >5>B>M>l>q>v>",
        ".?AVResultException@wil@@",
        "        versionSCope=\"nonSxS\"",
        "        >Microsoft-Windows-DeviceGuard-WMI</Component>",
        ">#>;>@>J>b>g>s>",
        "    <Setting>BrowserSearch</Setting>",
        "9/94999J9",
        "= =:=T=_=f=o=z=",
        "    <Setting>Interfaces</Setting>",
        "    Answer %s is present in the answer table, but couldn't be removed",
        "DeplUnattendImporter::ImportAuditUserDepl",
        "WpxSetting::GetAnsLowerBound",
        "4+4E4X4q4",
        "  <Setting Path=\"/Embedded/DisableBootMenu\">",
        "7 7H7S7k7",
        "_vsnwprintf_s",
        "    Couldn't initialize WpxXmlNode",
        "9+9C9k9",
        "999G9L9h9v9{9",
        "    Couldn't set answer in destination tree at path %s",
        "<'<@<`<e<j<",
        "    Couldn't import feature selection",
        "1/1=1Z1|1",
        "    Couldn't initialize node for DOM element %s",
        "y*Vjah",
        "    Couln't parse boolean value %s for Compact",
        "DeplWpafExporter::ExportEnvironment",
        "TlP0X",
        "    <ManifestFile>GPIOButtons.man</ManifestFile>",
        "  <Setting Path=\"/Embedded/KeyboardFilter/ControlAltDelete\">",
        "0*0a0f0k0z0",
        "&PWSV",
        "j'XQPh",
        "WpxConfig::FilterAnswers",
        "6k7u7",
        ">8>O>p>",
        "    Couldn't read element %u of %s",
        "WpxXmlDocument::ReportErrors",
        "=#=(=3=O=c=",
        "    Couldn't set index attribute for list item %s",
        "yHShS",
        "    Couldn't parse content of <EnableDynamicUpdate> node",
        "    Couldn't set list item friendly name for %s",
        "    <Setting>HideFirstLogonAnimation</Setting>",
        "    <Setting>Timeout</Setting>",
        "9(9W9",
        "    Can't query type information for %s",
        "=>=Y=}=",
        ";&;4;9;X;s;",
        ".LOG1",
        "Profile",
        "    Failed to check if right schema enumerates allowed file extensions",
        "        <Setting Path=\"/Shell/StartTiles\" />",
        "    Couldn't parse %s",
        "WpxUnattendWriter::WritePhaseSettings",
        ">\"?V?[?`?l?{?",
        "ProductName",
        "?#?d?j?",
        "0\"0@0S0c0x0",
        "    Failed to get textual value for map key %s of %s",
        "DeplWpafExporter::ExportInsCommands",
        "WpxWpafReader::ReadAssetValue",
        "<\"='=,=:=X=]=b=p=}=",
        "    Couldn't import synchronous command",
        "0 0*0D0I0N0Z0s0",
        "%s\\%s",
        "/wpaf:Settings/wpaf:Customizations/wpaf:Common",
        "        <Setting Path=\"/Connections/Item/Connection/Version\" />",
        "    <ManifestFile>uwf.man</ManifestFile>",
        "WpxConfig::EnumTargets",
        "y-Sjuh",
        ":<:D:L:T:\\:h:",
        "    Failed to allocate dest",
        "    <Setting>TabProcessGrowth</Setting>",
        "ycVhD",
        "        <Setting Path=\"/DeviceManagement/Policies/SISL/ServiceLoadingRoles\" />",
        "    Failed to initialize %s",
        "5\"5M5k5",
        "7$7,70787@7X7\\7t7x7",
        "808;8R8r8w8|8",
        "    Couldn't write binary setting %s",
        "_wtoi",
        "/*[local-name()='CustomizationPolicy']/p:SettingsGroup",
        "> >8><>T>X>p>t>",
        "8/9c9",
        "yEWh+",
        "    Unhandled visibility type: %u",
        "Partition/Format",
        "  <Setting Path=\"/Embedded/UnifiedWriteFilter/OverlayCriticalThreshold\">",
        "    Failed to initialize setting %s",
        "  <Setting Path=\"/Embedded/AppLauncher/DefaultReturnCodeAction\">",
        "  <Setting Path=\"/Embedded/KeyboardFilter/BrowswerHome\">",
        "97:<:A:R:_:d:i:z:",
        ".?AVWpxSource@@",
        "  <Setting Path=\"/Embedded/KeyboardFilter/VolumeDown\">",
        "<#<(<3<G<h<m<r<}<",
        "u:UseConfigurationSet",
        "DeplWpafExporter::ExportSvcProvPkgs",
        "GetIntInfo",
        "I0G1-0+",
        "  <Setting Path=\"/Licensing/SkipAutoActivation\">",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsShiftUp\">",
        "    Name: Argument cannot be NULL",
        "wpaf:StartOOBE/wpaf:Action",
        "5;5P5[5b5k5v5",
        "    Missing required child element Setting",
        "  <Setting Path=\"/Diagnostics/DiskFailureAlertTextOverride\">",
        "    Stores: Argument cannot be NULL",
        "6$6)6F6h6",
        "=*=5=N=h=",
        "%s: Inside node %s, can't parse '%s' as an integer",
        "7/7:7K7[7_7c7g7k7o7s7w7{7",
        "WpxSetting::GetMapValue",
        "!This program cannot be run in DOS mode.",
        "WpxWpafWriter::WriteSettingsTree",
        "    Couldn't get settings tree for phase %u",
        "858a8r8",
        "    <Setting>DomainProfile_LogFile</Setting>",
        "    WIMBoot installation images must have a destination disk and partition",
        "  <Setting Path=\"/ReadyBoost/CacheList\">",
        "=0=5=:=E=d=",
        "5&6M6o6t6y6",
        "    Failed to get %s from schema store for Windows %s %s",
        "    Couldn't get map value node name from child name enumerator for %s",
        "VSjFZ",
        "e    Couldn't enumerate unattend map paths under %s",
        "    Failed to check if right schema has a lower bound",
        "060Q0",
        "; ;J;O;T;a;",
        "2+3I3S3k3p3u3",
        "CloseHandle",
        "    Failed to validate list %s",
        "wpaf:DriveLetter",
        "<,<]<t<",
        ";);?;c;w;",
        "  <Setting Path=\"/InternetExplorer/DisableDevTools\">",
        "McsfLeafNode::GetDefaultBool",
        "    Children: Argument cannot be NULL",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsTab\">",
        "        <Setting Path=\"/Shell/Start/Item/PrepinnedTile/YCoordinate\" />",
        "  <Setting Path=\"/SNMP/RFC1156Agent\">",
        "0!1<1R1j1",
        "onecore\\base\\ntsetup\\wpx\\core\\tempfiles.cpp",
        "5 525F5i5n5s5",
        "1/14191Q1\\1",
        "wpaf:Display/wpaf:ColorDepth",
        "3(3,3D3T3d3t3",
        "5'5F5P5\\5h5m5r5",
        "    <Setting>WindowsShiftRight</Setting>",
        "+1i1s2",
        "package",
        ":L:X:",
        "=1>P>e>",
        "u:DataImage",
        "    <Setting>TaskbarLinks</Setting>",
        "=m=r=w=",
        "    <ManifestFile>production\\prod_Microsoft-Windows-NetworkBridge.man</ManifestFile>",
        "    <Setting>HKLMProxyServer</Setting>",
        "/wpaf:Settings/wpaf:AuditMode/wpaf:ComputerName",
        "    <Setting>TSCALPersisted</Setting>",
        "    <Setting>UIVerbosityLevel</Setting>",
        "    Length: Argument cannot be NULL",
        "processorArchitecture",
        ";!;+;N;S;X;o;y;",
        "4'5B5p5~5",
        "y&Sh/",
        "= =D=\\=~=",
        "Login",
        "    Failed to allocate sel",
        "<Exclusions>",
        "    Failed to check if right schema has a minimum length",
        "y#Vh_",
        "Microsoft Time-Stamp Service",
        "  <Setting Path=\"/SNMP/ValidCommunities\">",
        "u:DisableEncryptedDiskProvisioning",
        "1/1A1F1K1Z1y1~1",
        "    Couldn't write WIM file path",
        "838x8}8",
        "    Can't initialize parent node %s",
        "        >Microsoft-Windows-NetworkBridge</Component>",
        ":0:8:@:H:P:X:h:",
        "    Can't specify both <Size> and <FillSpace> for the same partition",
        "23282=2I2",
        "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:EnableAuditMode",
        ".?AVWpxValidation@@",
        "    <Setting>WindowsD</Setting>",
        "    Couldn't validate whether %s is an allowed extension",
        "6O6W6l6",
        "    <Setting>WindowsM</Setting>",
        "Setting %s has multiple child nodes; is this really a map?",
        "    Couldn't write partition size in bytes",
        "d    Command missing required Path parameter",
        "9%979Q9e9p9",
        "_wtoi64",
        "    Missing destination Disk and/or Partition",
        ".?AV?$CAutoCleanupBase@PAUIWpxAllowedValueEnum@@@RAII@@",
        "9%:;:v:",
        "DeplUnattendExporter::ExportAssemblyID",
        "    UniqueID: Argument cannot be NULL",
        "    Couldn't export SetupEvents section",
        "    <Setting>WindowsJ</Setting>",
        "        <Setting Path=\"/Multivariant/DefaultProfile\" />",
        "C;_$r",
        ".?AV?$CAutoCleanupBase@PAVWpxXmlDocument@@@RAII@@",
        "    Couldn't write metadata value",
        "WpxWpafWriter::WriteVariant",
        "HeapSize",
        "    Invalid storage unit %s",
        "wpaf:EnableConfigurationSet",
        "WpxXmlNode::SelectNode",
        "ComponentVersion",
        "Local\\SM0:%d:%d:%hs",
        "2%222=2U2u2z2",
        "IsDebuggerPresent",
        "wpaf:EnableWIMBoot",
        "%s: Node %s does not contain the required child node %s",
        "WpxSmiSetting::GetMinInclusive",
        "  <Setting Path=\"/NetworkProxy/CacheLimit\">",
        "  <Setting Path=\"/InternetExplorer/PlaySound\">",
        "1!1*1K1f1",
        ":<:K:n:",
        "d    Run command missing required Execute parameter",
        "3/3?3J3i3n3s3",
        "    Failed to export provisioning command %u",
        "    Can't specify 'fill space' and an explicit size on the same partition",
        "8&989T9f9",
        "3$4)4.4A4[4p4{4",
        "    Couldn't extract knobs hive %s from WIM image to %s",
        "    Couldn't get <settings> element for pass %u",
        "  <Setting Path=\"/Embedded/KeyboardFilter/CustomScancodes\">",
        "GetBoolInfo",
        "TerminateProcess",
        "    Couldn't write input locale",
        "        >Microsoft-Windows-SQMApi</Component>",
        "        >Microsoft-Windows-powercpl</Component>",
        ":(:8:H:X:h:x:",
        ";a;w;",
        "WpxVisibilityState::EnumRules::Enum::GetNext",
        "    <Setting>ControlAltDelete</Setting>",
        "urn:schemas-microsoft-com:windows-provisioning",
        "    Couldn't parse Reseal settings",
        "    Failed to write log directory",
        "y%Vh?",
        "    Failed to allocate *StateDescs",
        "n    Couldn't write restrict-search-dirs flag",
        "_aligned_free",
        "    IWpxImage has incomplete access credentials",
        "C;^0r",
        "_purecall",
        "    Couldn't export start-OOBE action",
        "WIMCreateFile",
        "u:Active",
        "    Couldn't get component/setting for %s",
        "U(9M<s",
        "?.?I?",
        ".?AV?$CAutoCleanupBase@PAVMcsfLeafNode@@@RAII@@",
        "    TargetRef missing required @Id attribute",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsComma\">",
        "200304183039Z",
        "    <Disk> missing required <Find> parameter",
        "    Incomplete display resolution specified",
        "  <Setting Path=\"/InternetExplorer/ShowLeftAddressToolbar\">",
        "TlsGetValue",
        "Organization",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:EnableNetwork",
        "    Cannot specify both InstallTo and InstallToAvailablePartition",
        "    <Setting>WLANFunctionLevelDeviceResetSupported</Setting>",
        "    Unhandled source type %s",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-PnpCustomizationsWinPE']",
        ".?AUIWpxConditionEnum@@",
        "    <ManifestFile>setupugc.man</ManifestFile>",
        ":.:E:Y:p:",
        "Msg:[%ws] ",
        "=H=U=m=",
        "sTargets",
        ":R;W;\\;h;",
        "    Invalid boolean value %s specified for feature selection state",
        "    <Setting>BrandingNeutral</Setting>",
        "Never",
        "SmiSchemaNode::GetMapKeyMaxLength",
        "    Couldn't get variant-specific settings",
        "Language/LayeredDriver",
        "8(8D8d8",
        "    Failed to set @cm:keyValue",
        "5!5&555f5k5p5",
        "4(5I5f5k5p5|5",
        "<$=A=J=k=p=u=",
        "    Couldn't export network settings",
        "    Couldn't parse text content of <Feature> element",
        "0#0=0J0U0m0",
        "/wpaf:Settings/wpaf:WindowsPE/wpaf:PageFile",
        "Drive",
        "WpxUnattendReader::ReadMapKey",
        "Loaded Knobs schema hive at %s",
        "    Couldn't create map value %s",
        "3,3M3R3W3h3{3",
        "5!5C5H5M5^5r5",
        "u:AuditComputerName/u:Name",
        "8T8s8",
        "jaXVPh",
        "        <Setting Path=\"/AutomaticTime/NTPServers\" />",
        "434H4",
        "    <Setting>ProtectedVolumeList</Setting>",
        "WpxConfig::AddTarget",
        ".?AUIWpxVisibilityRule@@",
        "9(939L9c9|9",
        "?:?T?e?",
        "    Unknown phase %u",
        "    Unable to parse content of FinishAuditMode <Action> node: %s",
        "CreateSemaphoreExW",
        "u:ProductKey/u:Key",
        "SizeofResource",
        "    <Setting>UsePeakModeVideoEncoderSettings</Setting>",
        "    Failed to initialize Knobs setting store.",
        "071i1n1s1",
        "/wpaf:Settings/wpaf:WindowsPE/wpaf:Network/wpaf:FirewallEnabled",
        ">\">9>N>y>",
        "%s\\%s\\SMI\\Store\\Machine\\SCHEMA.DAT",
        "onecore\\base\\ntsetup\\wpx\\mcsf\\mcsfapplyinfo.cpp",
        "_vscwprintf",
        "2)2G2",
        "WpxSetting::GetItemSettingType",
        "<!<,<1<6<X<]<b<}<(=8=H=i=",
        "    Failed to allocate szStateRegValue.get()",
        "/wpaf:Settings/wpaf:Provisioning",
        "    Failed to allocate target",
        "    Failed to get item %u of %u",
        "e    Failed to check if Windows %s %s publishes %s",
        ">!>@>E>J>V>h>",
        "    <Setting>NoDevDiscBalloon</Setting>",
        "    Couldn't parse hex digit %u",
        "r~akow",
        "    <ManifestFile>fveFilterDriver.man</ManifestFile>",
        "    Failed to get map value name",
        "4-474G4Q4a4k4{4",
        "u:EnableFirewall",
        "    Can't remove %s because it has children",
        "onecore\\internal\\sdk\\inc\\wil\\opensource\\wil\\resource.h",
        "u:WindowsDeploymentServices",
        "    Found SMI declaration %s %s for %s, but SMI tree didn't contain path element %u (%s)",
        "    Failed to set document root node",
        "WpxWpafReader::ReadTextValue",
        "WIMLoadImage",
        ".?AV?$CAutoCleanupBase@PAUIWpxVisStateEnum@@@RAII@@",
        "yESh/",
        "7%7C7N7_7o7",
        "767?7S7u7",
        "WpxConfig::LoadConvergedWimStore",
        ">,>1>6>M>W>s>",
        "  <Setting Path=\"/OnlineBackup/Link2\">",
        "    <ManifestFile>production\\prod_WinStoreUI.man</ManifestFile>",
        "  <Setting Path=\"/NetworkProxy/HKLMReceiveTimeOut\">",
        "C;^ r",
        "McsfStore::FindDeclarations",
        "WpxValidation::ReportParseIssue",
        "787B7G7L7",
        "y0Sh2",
        "232h2m2r2~2",
        "=(=8=H=X=h=x=",
        "    Couldn't enumerate children of map setting %s",
        "    Couldn't parse contents of ForceInstallUnsigned element",
        "    <Setting>DoNotOpenInitialConfigurationTasksAtLogon</Setting>",
        "WpxSimpleAllowedValue::GetTextValue",
        "    Failed to read variant information",
        "080?0n0",
        "  <Setting Path=\"/InternetExplorer/DisableWelcomePage\">",
        "    Couldn't sort created partitions",
        "    Failed to parse knobs store %s from %s",
        "676S6n6",
        "UpgradeData/Upgrade",
        "  <Setting Path=\"/CEIP/Enabled\">",
        "    <ManifestFile>Printing-Spooler-Core.man</ManifestFile>",
        "    Failed to insert item into %s at index %llu",
        "assemblyIdentity",
        "wpaf:Bundle",
        "WpxUnattendWriter::WritePassTree",
        "wpaf:Language/wpaf:UserLocale",
        "    <Setting>DisableAutoDefrag</Setting>",
        "    Unable to get path of online Windows directory",
        "    Couldn't get WpxCondition object for the given pass",
        "  <Setting Path=\"/Wireless/WLANFunctionLevelDeviceResetSupported\">",
        "    <Setting>CustomPowerApplication3</Setting>",
        "  <Setting Path=\"/Power/CustomPowerApplication6\">",
        "737W7u7",
        "    Failed to allocate pk",
        "/wpaf:Settings/wpaf:WindowsPE/wpaf:StartupLogs",
        "3\"3@3K3\\3l3",
        ".?AVChildNameEnum@?1??GetSparseNodeChildren@SmiStore@@AAEJABVWpxPath@@PAPAUIWpxStringEnum@@@Z@",
        "  <Setting Path=\"/SecureStartup/WriteIoAggregateMaxSize\">",
        "    Failed to get visibility info for this allowed value.",
        "'0,010@0",
        "y&Wh_",
        "6&6B6G6L6X6i6",
        "=/=9=S=g=",
        "WpxSetting::GetAllowedValueReferenceSetting",
        "http://schemas.microsoft.com/embedded/2004/10/ImageUpdate",
        "onecore\\base\\ntsetup\\wpx\\core\\config.cpp",
        "  <Setting Path=\"/Shell/FirstLogonCommands\">",
        "7<7s7",
        "  <Setting Path=\"/Embedded/AppLauncher/CustomReturnCodeAction\">",
        "SVWhT",
        "        <Setting Path=\"/AutomaticTime/NTPRegularSyncInterval\" />",
        ".?AV?$CAutoRelease@PAUIXMLDOMParseErrorCollection@@@RAII@@",
        ".?AV?$CAutoCleanupBase@PAUIWpxSchema@@@RAII@@",
        "    <Setting>WindowsE</Setting>",
        "404Q4z4",
        "3$3,343<3D3L3T3\\3d3l3x3",
        "wpaf:File",
        "</<G<^<o<",
        ".?AVWpxSimpleAllowedValue@@",
        "3.33383C3P3[3s3",
        "SettingNode::GetVisibility",
        "y1WhE",
        "    Failed to iterate over allowed map keys for %s",
        "    Failed to iterate over allowed values for %s",
        "    Failed to iterate over configuration conditions",
        "    Couldn't export disk find criterion %u",
        ".?AVSettingApplyInfo@@",
        "SizeMB",
        "    Failed to read scalar answer for setting %s",
        "    <Setting>SanPolicy</Setting>",
        "    Can't determine type information for %s",
        "%s: %s",
        ":':<:G:_:t:",
        "        <Setting Path=\"/Messaging/PerSimSettings/__ICCID/w4\" />",
        "    <ManifestFile>UnattendedJoin.man</ManifestFile>",
        "  <Setting Path=\"/InternetExplorer/LocalIntranetSites\">",
        "1-1I1\\1a1f1u1",
        "  <Setting Path=\"/Registered/Organization\">",
        "  <Setting Path=\"/MediaCenter/DisableComplexStretchesOnConsole\">",
        "    Failed to add replace variants",
        "7\"7Y7^7c7n7",
        "    Unknown setting %s under component %s",
        "    Couldn't export offlineServicing driver %u",
        "0;1n1",
        "y.Vh ",
        "  <Setting Path=\"/WindowsDefender/ThreatSeverityDefaultAction\">",
        "6,676Q6o6",
        "6\"7'7,787L7]7i7u7z7",
        "t    Couldn't iterate over map value paths",
        "  <Setting Path=\"/Shell/BluetoothTaskbarIconEnabled\">",
        "101P1U1Z1k1x1",
        "?4?P?t?",
        "<(<-<2<=<H<U<w<|<",
        "    ID: Argument cannot be NULL",
        "    <Setting>LogonWaitForPackageRegistration</Setting>",
        "6H6S6j6|6",
        "    <Setting>AddAllVolumes</Setting>",
        "    Couldn't get the number of items in list %s",
        "    Couldn't parse <Active> value %s",
        "msvcrt.dll",
        "publicKeyToken",
        "    Failed to allocate du",
        "?456789:;<=",
        "  <Setting Path=\"/MediaCenter/OEM/SecondaryName\">",
        "3$3,343<3D3P3p3x3",
        "%s is below the minimum allowed value",
        "<0=k=",
        "DeplWpafExporter::WriteValue",
        "        >Microsoft-Windows-TerminalServices-LicenseServer</Component>",
        "WpxSetting::GetMapKeys::MapKeyEnum::GetNext",
        "627s7",
        "=,=C=N=Z=r=",
        "    Failed to write universal app license path",
        "ReturnHr",
        "    <Setting>TrustedImageIdentifier</Setting>",
        "KnobsStore::GetGroupNodeChildren",
        "  <Setting Path=\"/StartMenu/ShowPowerButton\">",
        "Execute",
        "t(jpS3",
        "y*Vj[h<]",
        "    Failed to report parse error(s)",
        "9#9;9Y9o9",
        "    Reboots are not allowed for this command",
        "    Asset %s has a source path, but it could not be retrieved",
        "90W0c0",
        "WpxSmiSetting::GetPattern",
        "ProvisioningPackages",
        "    <ManifestFile>Security-SPP-UX-SPPCC.man</ManifestFile>",
        "/WpxStore/Edition",
        "DeplUnattendExporter::ExportCommand",
        "6(6-626>6e6j6o6~6",
        "u:component",
        "6W7y7J8o8R9d9",
        "2)2S2i2",
        "  <Setting Path=\"/WindowsDefender/Scan\">",
        "6?7X7x7}7",
        "WpxUnattendWriter::WriteTextSetting",
        "; ;(;4;T;\\;h;",
        "    Parent: Argument cannot be NULL",
        "u:RefreshRate",
        ">C>S>",
        "        <Setting Path=\"/Connections/Item/Policy/Item/Connection/Type\" />",
        "5*5/545@5O5d5q5|5",
        "GetFileSizeEx",
        ":0:C:c:y:",
        "  <Setting Path=\"/Embedded/UnifiedWriteFilter/AddAllVolumes\">",
        "9+9=9W9l9",
        "    <Setting>InitialOEMServiceProvider</Setting>",
        "j;XWPh",
        "SVWjP",
        "    Failed to iterate over target states",
        "4+5^5",
        "    %s: Can't read value as a string",
        "    Failed to allocate indexNodes",
        "    Couldn't determine length of base64 binary value for %s",
        ":6:W:r:",
        ".?AVEnumerator@?1??GetAllowedFileExtensions@SettingNode@@UAEJPAPAUIWpxStringEnum@@@Z@",
        "  <Setting Path=\"/RemoteAccess/RouterType\">",
        "    Couldn't get answer for binary setting %s",
        "wpaf:Path",
        "    <Setting>DisableDataExecutionPrevention</Setting>",
        "    Couldn't iterate over <Option> elements",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "6)62676<6^6c6h6",
        "wpaf:Language/wpaf:SystemLocale",
        "0;0M0i0{0",
        "    <Setting>Accelerators</Setting>",
        "8hbinu~9x",
        "Microsoft-Windows-PnpCustomizationsNonWinPE",
        ":$:3:z:",
        "9,909H9L9d9h9",
        "  <Setting Path=\"/OutOfBoxExperience/DoNotOpenInitialConfigurationTasksAtLogon\">",
        "    Content of <Drive> must be a single drive letter",
        "9\"9'999Y9",
        "    Internal error while attempting to load an answer file",
        "=$=,=4=<=D=L=T=\\=h=",
        "5,5>5H5",
        "yEShf",
        "9B9X9",
        "Reserved",
        "        <Setting Path=\"/InternetExplorer/CustomUserAgentString\" />",
        "WpxStore::GetSchemaNode",
        "wpaf:Label",
        "PShdo",
        "<8<=<B<\\<f<z<",
        "WpxUnattendMap::AddEntry",
        "383L3o3",
        "    <Setting>AltWin</Setting>",
        "hCM33j",
        "292]2v2",
        "Format",
        "8$8,848<8H8l8t8|8",
        "yGShu",
        "    <Setting>DisableSR</Setting>",
        ":/:b:q:",
        "    Can't get child %s",
        "    Invalid hexadecimal digit '%c'",
        ":0:L:Y:",
        "?X?k?",
        ">,>0>D>H>`>d>h>|>",
        ".tls$",
        "  <Setting Path=\"/SystemRestore/Disabled\">",
        "2+272W2",
        "    Couldn't add Customizations/Common node to document",
        "768;8@8M8e8",
        "    <Setting>FlyoutHighPerformancePowerScheme</Setting>",
        "    Couldn't add node for %s to the document",
        "    Couldn't check if answer has a maximum length",
        ".CRT$XLZ",
        "    Couldn't add child node %s to %s",
        "5+575<5A5c5x5",
        "LoadResource",
        "3=3I3[3",
        "DeplWpafImporter::ImportSession",
        "  <Setting Path=\"/Firewall/PrivateProfile_LogFileSize\">",
        "    Must specify both a WIM metadata XPath and text value",
        ">4?X?",
        "u:RunAsynchronous/u:RunAsynchronousCommand",
        ">*?Z?",
        "a    Couldn't create read options object",
        "  <Setting Path=\"/Embedded/HideBootStatusMessage\">",
        ".?AUIWpxDisk@@",
        "5 5'5D5]5~5",
        "        >Microsoft-Windows-Embedded-EmbeddedLogon</Component>",
        "u:PageFile",
        "    <Setting>Ctrl</Setting>",
        "LogMismatch",
        "        >Microsoft-Windows-DNS-Client</Component>",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:RunAsynchronous",
        "QQSVWj<",
        "  <Setting Path=\"/InternetExplorer/PrintBackground\">",
        ".?AV?$CAutoCleanupBase@PAUIWpxSchemaStore@@@RAII@@",
        "%s %s",
        "AccessCredentials",
        "RequiresReboot",
        "  <Setting Path=\"/Shell/DoNotCleanTaskBar\">",
        "WpxAllowedValue::GetVisibility::Enum::GetNext",
        "y0Wh<",
        "        <Setting Path=\"/Power/CustomPowerApplication3/Application\" />",
        "    Failed to parse disk criterion",
        "VSj%Z",
        "    Couldn't parse <PreventPending> element",
        "3'3,313<3N3",
        "    Failed to write settings tree for phase %u",
        "    <Setting>MediaPlayPause</Setting>",
        "    Couldn't export package install state",
        "    Couldn't export installation settings",
        "4@4E4J4V4j4",
        "=    Unhandled type",
        "False",
        "    Couldn't get map key for map value setting %s",
        "DeplWpafImporter::ImportSvc",
        "WpxGetWimEdition",
        ";0;L;e;j;",
        "    Couldn't enumerate configuration conditions",
        "ePageFile",
        "    Failed to register %s in answer tree",
        "    <ManifestFile>netbt.man</ManifestFile>",
        "    Failed to import disk criterion",
        "%s: Inside node %s, can't parse '%s' as a text",
        "4%4=4x4",
        "656:6?6N6k6",
        "yEShU",
        "WpxSmiGetHiveText",
        "    <Setting>LockToolbars</Setting>",
        "    Failed to clone schema for %s",
        "3\"3'353H3i3n3s3",
        "        >Microsoft-Windows-MediaPlayer-Core</Component>",
        "    Failed to enumerate target states",
        "    <Setting>DomainProfile_DisableNotifications</Setting>",
        "    Failed to allocate indexNode",
        "    <Setting>HideBootStatusMessage</Setting>",
        "e    Failed to allocate pkg",
        "CFG_DATATYPE_STRING",
        "    <ManifestFile>SystemSettings.man</ManifestFile>",
        "3<3x3",
        "    Failed to allocate dep",
        "  <Setting Path=\"/Firewall/PublicProfile_DisableNotifications\">",
        "      <Pass>offlineServicing</Pass>",
        "< <+<F<K<P<[<y<~<",
        "0<0C0I0S0b0j0v0{0",
        ".?AV?$CAutoRelease@PAUIWpxVariantEnum@@@RAII@@",
        "8+80858@8Q8",
        "9(90989@9L9l9x9",
        ";(<u<",
        "WpxSetting::GetMapKeyMaxLength",
        "StrCmpW",
        "    Couldn't get answer file reader of type %u",
        "7W8g8",
        "    Couldn't export start-audit-mode option",
        "797P7]7h7",
        "    <Setting>DisplayDisabled</Setting>",
        "/wpaf:Settings/wpaf:Provisioning/wpaf:Drivers",
        ".?AVWpxTargetState@@",
        "WpxConfig::GetCommonSetting",
        "<.=3=8=G=|=",
        "    Couldn't check if type declaration %s exists",
        "    Failed to iterate over <settings> elements",
        "<T=l=->r>",
        "Loaded SMI schema hive at %s",
        "    Couldn't write settings tree for phase %u",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsBreak\">",
        "020S0s0",
        ".?AUIWpxSetting@@",
        "DriverPaths",
        ":';R;",
        "9sPv5",
        "  <Setting Path=\"/SecureStartup/ReadDoubleBuffering\">",
        "SWhH6",
        "    <Setting>StartPages</Setting>",
        "    Couldn't set root node",
        "onecore\\base\\ntsetup\\wpx\\core\\store.cpp",
        "ebytes",
        "  <Setting Path=\"/Setup/UninstallWindowsRE\">",
        "    Couldn't create <%s> element",
        "    Couldn't read value for %s",
        "    <Setting>SimultaneousMultiChannelSupported</Setting>",
        "  <Setting Path=\"/Embedded/KeyboardFilter/BrowswerFavorites\">",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsRight\">",
        "WpxXmlNode::Initialize",
        "WpxVariant::EnumTargets",
        "metadata\\simpleTypes",
        ".?AVMcsfTreeNode@@",
        "    <Setting>UserAgent</Setting>",
        ".?AV?$CAutoCleanupBase@PAVFilter@?1??FilterExcludedChildren@SmiStore@@AAEJABVWpxPath@@PAUIWpxStringEnum@@PAPAU5@@Z@@RAII@@",
        "  <Setting Path=\"/InternetExplorer/Home_Page\">",
        "868V8",
        ".?AV?$CAutoRelease@PAVWpxXmlNode@@@RAII@@",
        "8+8D8]8v8",
        "PPPPPh",
        "WpxOpenKnobsStore",
        "WpxWpafWriter::WriteTargetState",
        "WpxSmiOpenSubKey",
        ".?AV?$CAutoHeapFree@PAX@RAII@@",
        "    <Setting>FirstLogonCommands</Setting>",
        "!B !B$_^",
        "_ftol2",
        "3 3$383<3T3X3\\3p3",
        "onecore\\base\\ntsetup\\wpx\\file\\wpafwriter.cpp",
        "    Couldn't parse answer file contents as XML",
        "y.Vhg",
        "6+7E7g7q7}7",
        "wcm:action",
        "WpxStore::EnumSources",
        "9/9<9G9^9j9o9t9",
        "integer",
        ".?AVSmiSparseNode@@",
        "0+0B0b0}0",
        "    No open stores publish %s",
        "    Couldn't add list item to %s",
        "    Couldn't write settings tree under %s",
        "8Q9h9m9r9",
        "0$0,040<0D0P0t0|0",
        "    NewState: Argument cannot be NULL",
        "WpxSetting::HasMapKey",
        "Display/Resolution",
        "FirewallEnabled",
        "    <Setting>ShowCommandBar</Setting>",
        "    Failed to allocate settingNode",
        "1'171<1A1M1i1u1",
        "FindResourceW",
        "=+=5=:=f=",
        "    <Setting>BluetoothTaskbarIconEnabled</Setting>",
        "  <Setting Path=\"/InternetExplorer/StartPages\">",
        "54595>5J5",
        "%s is too short",
        "?(?-?2?C?g?",
        "=5=Y=^=c=r=",
        "  <Setting Path=\"/Wireless/NumAntennaConnected\">",
        "WpxSmiSetting::GetTextEnumValues",
        "PathAndCredentials",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsPeriod\">",
        "717`7",
        "%s for the asset's target path",
        "        <Setting Path=\"/InternetExplorer/DataSaving/BrowserDataSaver\" />",
        "    Couldn't parse contents of <EnableAuditMode> element",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:ComputerName",
        ":);B;",
        "t$$ShX",
        "%s/Mode",
        "    Couldn't get number of list items in %s",
        "Loaded SMI schema hive for installation at %s",
        "Diagnostics",
        "    Couldn't write partition drive letter",
        "2#252G2[2t2",
        "DeplWpafExporter::GetAuditNode",
        "    Can't read enumeration values",
        "    <Setting>SlicedEncryptionRequestsMax</Setting>",
        "        <Setting Path=\"/Power/CustomPowerApplication5/Application\" />",
        "WpxStore::HasSchemaNode",
        "9@9N9e9j9o9z9",
        "DeplUnattendExporter::ExportModifyPart",
        "wpaf:EnableDynamicUpdate",
        "Prompt",
        "    Couldn't parse content of <EnableCompactOS> node",
        "    %s does not support runtime provisioning and cannot appear in a multivariant setting tree",
        "    <Setting>EnableStartMenu</Setting>",
        "6%696X6r6",
        ";,;A;N;Y;q;",
        "        >Microsoft-Windows-TerminalServices-CentralPublishing</Component>",
        "y0WhT",
        "?!?,?D?X?f?w?|?",
        "    <ManifestFile>embeddedlogon.man</ManifestFile>",
        "AtFirstSIMDetectOnly",
        "    Couldn't write audit mode computer name reboot flag",
        "EnterCriticalSection",
        ":=:T:z:",
        "  <Setting Path=\"/WindowsExperienceIndex/OEM\">",
        "    Couldn't get error count",
        "WpxAnsTree::AddMapValue",
        ".?AUIWpxRunCommand@@",
        "    Couldn't export existing index",
        "  </Setting>",
        "wpaf:Initialize",
        "7$7)7.7<7N7",
        "WpxSmiGetHiveValueType",
        "  <Setting Path=\"/InternetExplorer/DisableAccelerators\">",
        "@description",
        "WimImage",
        ">7><>A>P>w>",
        "/u:unattend/u:settings[@pass='offlineServicing']/u:component[@name='Microsoft-Windows-PnpCustomizationsNonWinPE']",
        "    Failed to export disk settings",
        ".?AV?$CAutoCleanupBase@PAVWpxAllowedValue@@@RAII@@",
        "hCMScj",
        "  <Setting Path=\"/InternetExplorer/DisableOOBAccelerators\">",
        "y0Vh4",
        "  <Setting Path=\"/Tablet/LinearityData\">",
        "828Z8",
        ">*>5>H>l>",
        "6%606S6X6]6h6|6",
        "    Couldn't add <settings> element to document tree",
        "9'9B9c9~9",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:UserData",
        "%s: Key may have at most %lld character(s)",
        "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:Disks",
        "6 6%616",
        "    Too few sections in package ID: %s",
        "WpxWpafWriter::WritePassTree",
        "DeplUnattendImporter::ImportWinPEDrivers",
        "    <Setting>DefaultReturnCodeAction</Setting>",
        "%s: Malformed XML at line %llu, position %llu",
        "?(?-?2?I?X?m?r?w?",
        "    Partition Type was CUSTOM, but Partition CustomType was not set",
        "7;7]7p7",
        "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:InitialCustomizationBlob",
        "    Couldn't get schema for %s",
        "@state",
        "2-32373C3]3",
        "5!5=5K5i5|5",
        "5$595K5d5i5n5|5",
        "    Couldn't export top-level error to validation report",
        "    Couldn't write hardware disk encryption option",
        "    Load contents of resource, but can't convert to Unicode",
        "WpxSetting::GetChildren::ChildEnum::GetNext",
        "    Couldn't parse image information",
        "    Couldn't export implicit-session features",
        "WpxSmiSetting::GetChildNames",
        "/wpaf:Settings/wpaf:Customizations/wpaf:Replace",
        "wpaf:Action",
        "    Unknown Reseal Mode %s",
        "    <Setting>DomainProfile_LogFileSize</Setting>",
        "    Couldn't write fill-remaining-space flag",
        "  <Setting Path=\"/Firewall/PublicProfile/EnableFirewall\">",
        "    Couldn't export run commands",
        "    Unrecognized store file format",
        "vswprintf_s",
        "    Got unexpected image type %u from InferImageType",
        "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:DataMigration",
        "        >Microsoft-Windows-Disk-Failure-Diagnostic-Module</Component>",
        "    Error while trying to validate answers for pass %u",
        "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:CustomCommands",
        "hCMSc",
        ";(<5<M<",
        "2U3x3",
        "    Couldn't set component language attribute",
        "0SVW3",
        "LegalCopyright",
        "<&<2<D<b<n<",
        "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "        >Microsoft-Windows-IE-ESC</Component>",
        "%hs(%u)\\%hs!%p: ",
        "WpxConfig::GetVariantCondition",
        "Y__^[",
        "u:Key",
        "j=Xf9Ds",
        ">8>@>H>P>X>`>h>t>",
        "    Couldn't export assembly version number",
        "    Couldn't set <component> @processorArchitecture attribute",
        "    Couldn't export boot driver %u",
        "GetWindowsDirectoryW",
        "j_XVPh",
        "y@ShN",
        "EvalValueGreaterEqual : Not yet implemented",
        "=:>R>_>",
        "9&9?9Q9f9q9",
        "        >Microsoft-Windows-Audio-AudioCore</Component>",
        "    <Passes>",
        "Disks",
        "0$0)050h0|0",
        "    Couldn't initialize SMI schema hive at %s",
        "    Couldn't get components for %s from unattend map",
        ">2>P>p>",
        "|hK,_",
        "101;1R1f1s1~1",
        "939Y9y9",
        "7*7S7k7",
        ".?AVCAtlException@ATL@@",
        "hCM29j",
        "    <Store Type=\"MCSF\">",
        "    Original index out of range (index: %llu, list count: %llu)",
        ".?AV?$CAutoRelease@PAUIWpxIssueList@@@RAII@@",
        "    Failed to enumerate allowed values for %s",
        "1 </<E<J<",
        ";$;);6;\\;f;z;",
        "  <Setting Path=\"/Embedded/UnifiedWriteFilter/DomainSecretKeyPersisted\">",
        "/wpaf:Settings/wpaf:SetupEvents/wpaf:FinishAuditMode",
        "t$<WP",
        "        >Microsoft-Windows-Embedded-BootExp</Component>",
        "    <Setting>ConvertibleSlateMode</Setting>",
        "646_6z6",
        "    Couldn't get answer",
        ".?AV?$CAutoCleanupBase@PAVWpxXmlNode@@@RAII@@",
        "Replace",
        "GetAssetInfo",
        "3:3e3",
        "    Failed to get source setting, will return FALSE",
        "    Couldn't get answer for textual setting %s",
        "/wpaf:Settings/wpaf:Servicing/wpaf:ProvisioningCommands",
        "Microsoft Corporation1)0'",
        "434R4u4z4",
        "g    Couldn't get or create node for %s",
        "/Exclusions/Store[@Type='%s']/Setting",
        "  <Setting Path=\"/Embedded/KeyboardFilter/BrowswerStop\">",
        "yGWh0",
        "arm64",
        "yDShF",
        "7,7H7h7",
        "l    Failed to serialize document",
        "5 5(505<5\\5d5p5",
        ":\":):@:X:",
        "t    Failed to check if any SMI components under %s exist in this store",
        "9~0v0",
        "EnableWIMBoot",
        "/wpaf:Settings/wpaf:Servicing/wpaf:ProvisioningPackages",
        "?,?0?H?L?d?h?",
        ";=<p<",
        "8P8p8",
        "    InstallTo is required for data images",
        ".data$brc",
        "    <Setting>ClientApplications</Setting>",
        "    Unknown owner type %s",
        "CoCreateInstance",
        "InstallImage",
        "Microsoft Time-Stamp PCA 2010",
        "<:<S<d<w<",
        "WpxPathTree::EnumDirectChildren",
        "C;_dr",
        "    Unrecognized setup pass %s",
        "g    Couldn't write list setting %s because the unattend schema doesn't support lists",
        "  <Setting Path=\"/Power/FlyoutHighPerformancePowerScheme\">",
        "Legal_Policy_Statement",
        "    <Setting>Help_Page</Setting>",
        "/u:unattend/u:settings[@pass='auditSystem']/u:component[@name='Microsoft-Windows-Deployment']/u:AuditComputerName",
        "  <Setting Path=\"/Telephony/TapiConfigured\">",
        "present",
        "    Couldn't allocate name",
        "        <Setting Path=\"/Connections/Item/Connection/ApnId\" />",
        "WpxSetting::SupportsRuntimeProvisioning",
        "1@3J3S3X3y3~3",
        ">HvLEu$",
        "4$4C4O4`4l4}4",
        "4a4z4",
        "G;~@r",
        ".?AVEnum@?1??EnumRules@KnobsVisibilityState@@UAEJPAPAUIWpxRuleDescEnum@@@Z@",
        "nonnegative",
        "~h_^]",
        ".?AVWpxVisibilityRule@@",
        "wcscat_s",
        "hexbinary",
        "9,969;9O9k9v9",
        "AnsPattern",
        "2.2:2N2W2i2",
        "SetUnhandledExceptionFilter",
        "WpxGetScratchDirectory",
        "    Couldn't serialize partition type %u",
        "3(3,303D3T3X3\\3t3x3",
        "    Unable to query if %s is a map setting",
        "    ItemType: Argument cannot be NULL",
        "2(3:3X3b3",
        "4(4,4D4H4`4d4|4",
        "<(=d=",
        "    <Setting>HKLMReceiveTimeOut</Setting>",
        "90:<:",
        "7#7(7F7K7P7\\7",
        "  <Setting Path=\"/InternetExplorer/DisableDataExecutionPrevention\">",
        "    Failed to allocate dirs",
        "y4Vh+",
        "1 1(10181@1H1P1X1`1h1p1x1",
        "WpxXmlDocument::SetPrefix",
        ".?AVWpxDiskCriterion@@",
        "  <Setting Path=\"/InternetExplorer/InstalledBrowserExtensions\">",
        "WpxSetting::Validate",
        "    Couldn't get edition from image",
        "  <Setting Path=\"/Firewall/PublicProfile/LogDroppedPackets\">",
        "1(181H1X1h1x1",
        "+0N0S0X0c0x0",
        "    <Setting>LeftShiftLeftAltPrintScreen</Setting>",
        "WillWipeDisk",
        "WpxSetting::DeleteMapValue",
        "='=C=N=X=j=",
        "WpxSmiHive::Initialize",
        "QSVWjH",
        "    Answer: Argument cannot be NULL",
        "2 282X2]2b2p2",
        "3=3K3d3q3",
        "Found settings in image %u of WIM file %s",
        "    Failed to export MBS driver set",
        "    Failed to write target reference ID",
        ".?AV?$CAutoCleanupBase@PAUIWpxTargetEnum@@@RAII@@",
        "  <Setting Path=\"/Firewall/PrivateProfile/LogSuccessfulConnections\">",
        ";.;?;I;z;",
        "Everything",
        "2\"363",
        "wcsrchr",
        "9s@v5",
        ".text",
        "DeplUnattendImporter::ImportDataImage",
        "    Couldn't parse size string %s",
        "= =$=(=@=D=X=\\=t=x=|=",
        ".?AVWpxAllowedValue@@",
        "8$8C8d8i8n8z8",
        "    <Setting>FavoritesDelete</Setting>",
        "= =(=0=8=@=H=P=`=",
        "5D5^5|5",
        "y6Vh&",
        "10.0.19041.572",
        ";&;9;H;N;",
        "DeplUnattendExporter::GetPassNode",
        "    Failed to allocate layout",
        "hCMLbQ",
        "    <Setting>BrowserStop</Setting>",
        "        <Setting Path=\"/Connections/Item/Proxy/UserName\" />",
        "IsWow64Process",
        "    Opt: Argument cannot be NULL",
        "McsfStore::ParseMacros",
        "#0(0-0:0Q0\\0h0{0",
        "  <Setting Path=\"/Embedded/KeyboardFilter/MediaPrev\">",
        "    <Setting>HKLMCookiesPerUserItem</Setting>",
        "    Couldn't find schema for %s",
        ".?AVMcsfStore@@",
        ".?AV?$CAutoRelease@PAUIXMLDOMParseError@@@RAII@@",
        "  <Setting Path=\"/Embedded/KeyboardFilter/Alt\">",
        "1(191P1~1",
        "333c3",
        ".?AV?$CAutoRelease@PAVWpxVariant@@@RAII@@",
        "iswdigit",
        "\"0F0V0f0~0",
        "McsfStore::ParseMacro",
        "959?9Y9w9",
        "    Couldn't initalize parent node",
        "    Failed to allocate pf",
        "=G>z>",
        ">->D>a>f>k>",
        "        <Setting Path=\"/Shell/Themes/CustomDefaultThemeFile\" />",
        "    Failed to iterate over <Find> conditions",
        "        >Microsoft-Windows-Embedded-TabletPC-Platform-Input-Core</Component>",
        "    The unattend schema does not support WPX_EULA_DEFER",
        "1%2*2/2;2e2",
        "wpaf:ForceInstallUnsigned",
        "  <Setting Path=\"/Firewall/PublicProfile/LogFile\">",
        "?\"?O?Z?k?",
        ":(:A:F:K:W:h:}:",
        "Audit",
        "Microsoft Corporation1200",
        "6$7C7x7",
        "    <ManifestFile>Security-Licensing-SLCC.man</ManifestFile>",
        "    Failed to create document - is COM initialized?",
        "HeapAlloc",
        "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;",
        "    <Setting>QuickLinkList</Setting>",
        "onecore\\base\\ntsetup\\wpx\\ks\\allowedvalue.cpp",
        "WpxSetting::CreateMapValue",
        "    No destination specified for install image",
        "WpxSmiSetting::GetChild",
        ".?AV?$CAutoDelete@PAUNode@WpxPathTree@@@RAII@@",
        "<M<X<l<",
        "    Couldn't parse content of <EnableConfigurationSet> node",
        "        <Setting Path=\"/Connections/Item/Connection/UserName\" />",
        "=C>j>o>t>",
        "    Failed to allocate app",
        "    Couldn't set IXMLDOMDocument3 MultipleErrorMessages property",
        "262M2W2p2",
        "WpxSetting::GetChild",
        "WpxVisibilityRule::GetSourceSetting",
        "Restart",
        "161R1W1\\1h1",
        "  <Setting Path=\"/Sensors/SensorPermissions\">",
        " _^Y]",
        "    Can't read hive value %s",
        "    Couldn't write access domain",
        "_vsnprintf_s",
        "    Failed to enumerate configuration conditions",
        "8,8H8^8r8",
        "2+252?2V2[2`2p2",
        ">regfu;",
        "WIMGetImageInformation",
        "= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=",
        "    Failed to move target item from %llu to temp index",
        "5:5G5",
        ":-:A:S:o:",
        "    Couldn't get integer value for allowed value %s of %s",
        ">$>)>4>I>b>r>}>",
        "    Can't specify <ClusterSize> for entries of <CreatedPartitions>",
        "    <Setting>WindowsL</Setting>",
        "WpxConfig::LoadStoreFile",
        "    Variant: Argument cannot be NULL",
        "    Unattend does not support list settings",
        "9;9U9",
        "    <ManifestFile>TerminalServices-AUInstallAgent.man</ManifestFile>",
        "    Failed to get parent IXMLDOMNode",
        "  <Setting Path=\"/RemoteDesktop/UserAuthentication\">",
        "2b2g2",
        "l    Failed to allocate diag",
        "0)0.030w0",
        "    <Setting>F21</Setting>",
        "3_3i3",
        "    Couldn't open schema store at %s",
        "    Failed to write settings tree for pass %u",
        ".?AVlogic_error@std@@",
        "8)8=8R8q8",
        ".?AVEmpty@?1??GetVisibility@SmiSparseNode@@UAEJPAPAUIWpxStateDescEnum@@@Z@",
        "6&6;6W6s6",
        "    Failed to write min value",
        "wpaf:Keyform",
        "0.03080H0X0u0",
        "    Failed to initialize clone of %s",
        "0-0S0s0",
        "t    Failed to get node text",
        "WpxCreateWriteOpt",
        "    Path: Argument cannot be NULL",
        "DeplUnattendExporter::ExportDataImage",
        "1'2,212@2Z2{2",
        "> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>",
        "7:7?7D7P7j7",
        "Primary",
        "y.Ph6",
        "Target",
        "9D9Q9s9x9}9",
        "    Unattend does not support binary settings",
        "    Couldn't export store apps",
        "    Failed to add map item node to document",
        "    Failed to iterate over the configuration's target states",
        "??0exception@@QAE@ABV0@@Z",
        "DataMigration",
        "    Failed to allocate os",
        "Loaded settings from Windows Mobile package %s",
        "    Couldn't set package action",
        " Microsoft Operations Puerto Rico1&0$",
        "    Failed to get textual value from IWpxAllowedValue",
        "  <Setting Path=\"/HelpAndSupport/OnlineSupportIconTitle\">",
        "McsfLeafNode::GetDefaultInt",
        "    Couldn't import servicing settings",
        "    Login node missing required Credentials parameter",
        "y8Whr",
        "    <Setting>HKLMProxyOverride</Setting>",
        "wcm://",
        "UseConfigurationSet",
        "    '%s' is too long (key may have %u characters maximum)",
        "3!3.393R3^3c3h3",
        "  <Setting Path=\"/MediaPlayer/InitialOEMServiceProvider\">",
        "WpxWpafReader::ReadTargets",
        "        <Setting Path=\"/Connections/Item/Proxy/BypassLocal\" />",
        "1-1K1W1i1",
        ">+>U>u>",
        "y,Vh&",
        "onecore\\base\\ntsetup\\wpx\\core\\xml.cpp",
        "SettingNode::GetDefaultBool",
        " !\"#$%&'()*+,-./0123",
        "    Failed to import partition",
        "8 9=9U9v9",
        "    Failed to check if left schema has a lower bound",
        "    <ManifestFile>bootexp.man</ManifestFile>",
        "y*VjDh",
        "    Couldn't iterate over packages",
        "        >Microsoft-Windows-Security-Licensing-SLCC</Component>",
        "  <Setting Path=\"/Embedded/AppLauncher/UserSettings\">",
        "    Couldn't write page file path",
        ".?AV?$CAutoCleanup@PAG@RAII@@",
        "6]7b7g7s7",
        "    Couldn't get schema node %s",
        "FAT32",
        "8$8,848<8H8h8p8x8",
        "5+6k6{6",
        "= =(=8=D=L=T=\\=d=l=|=",
        ">/>K>P>U>a>",
        "/wpaf:Settings/wpaf:Servicing/wpaf:UniversalApps",
        "3m3r3w3",
        "<7<T<q<|<",
        "2$2,242<2D2P2p2x2",
        "    Couldn't parse boolean value %s for UseConfigurationSet",
        ".?AVexception@@",
        "    <ManifestFile>production\\prod_WorkstationService.man</ManifestFile>",
        "Resolution",
        "WpxSetting::GetDefaultText",
        "=>=W=f=~=",
        ".data",
        "WpxUnattendReader::ReadIntValue",
        "1%1h1",
        "  <Setting Path=\"/WindowsDefender/EnableRemoteManagedDefaults\">",
        "    <Setting>DesktopOptimization</Setting>",
        ".?AV?$CAutoRelease@PAUIWpxStringEnum@@@RAII@@",
        "<$<2<E<[<",
        "/wpaf:Settings/wpaf:WindowsPE/wpaf:Display",
        "    Can't find value node for map setting %s",
        "8<9F9O9u9",
        "969A9H9Q9\\9",
        "9/9<9G9`9l9q9v9",
        "  <Setting Path=\"/Wireless/WLANPlatformLevelDeviceResetSupported\">",
        "9a9|9",
        "    <Setting>ShowPowerButtonOnStartScreen</Setting>",
        "0*1B1N1`1",
        "    Failed to enumerate allowed map keys for %s",
        "    <Setting>WindowsMinus</Setting>",
        "onecore\\base\\ntsetup\\wpx\\core\\allowedvalue.cpp",
        "    Couldn't write metadata key",
        "    Couldn't export assembly public key token",
        "yGSjth",
        "/u:unattend/u:settings[@pass='windowsPE']/u:component[@name='Microsoft-Windows-Setup']/u:UpgradeData/u:Upgrade",
        "\\Windows\\Provisioning\\Microsoft-Desktop-Provisioning.dat",
        "u:CreatePartitions/u:CreatePartition",
        "  <Setting Path=\"/Firewall/PrivateProfile/LogFileSize\">",
        "u:DynamicUpdate",
        "    Couldn't parse allowed values",
        ".?AVWpxTarget@@",
        "0<0d0{0",
        ".?AV?$CAutoRelease@PAUIWpxSchema@@@RAII@@",
        "787l7",
        "    Failed to strip temporary list indices",
        "    Failed to load contents of footprint file %s",
        "SettingNode::SetDefaultInt",
        ".?AV?$CAutoORCloseHive@PAX@RAII@@",
        "    Failed to allocate orderStr",
        "onecore\\base\\ntsetup\\wpx\\smi\\smistore.cpp",
        "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7",
        "5/5H5l5q5v5",
        "?(?4?T?\\?d?p?",
        ".?AV?$CAutoDelete@PAVKnobsVisibilityRule@@@RAII@@",
        "3k4p4u4",
        "=)=6=_=i=r=",
        "5=6B6G6^6i6}6",
        "4(5h5",
        ".?AV?$CAutoDelete@PAVWpxImage@@@RAII@@",
        ".?AVEnum@?1??EnumConditions@WpxTargetState@@UAEJPAPAUIWpxTargetCondEnum@@@Z@",
        "Keyform",
        "    <Setting>IEWelcomeMsg</Setting>",
        "    <Setting>BTSearchIntervalOnAC</Setting>",
        "y/Wh)",
        ".?AVSmiSchemaNode@@",
        "6!6-6H6a6",
        "9+979p9",
        "dThis node isn't an element, returning false",
        "WpxSetting::GetItemSchema",
        "WpxXmlNode::RemoveChild",
        "y/WhV",
        "OwnerType",
        "EnableConfigurationSet",
        "    Couldn't create <component> element",
        "?&?+?0?R?m?",
        "GetCurrentProcessId",
        "    <Setting>LayoutPosition</Setting>",
        "  <Setting Path=\"/DeviceGuard/LsaCfgFlags\">",
        "7T7t7",
        "    <Setting>MediaNext</Setting>",
        "/wpaf:Settings/wpaf:SetupEvents",
        "  <Setting Path=\"/Embedded/KeyboardFilter/Windows\">",
        "C;^@r",
        "2I3S3",
        ">(>f>",
        "    Failed to iterate over children of %s after pruning",
        "    <Setting>Identification</Setting>",
        ".idata$4",
        "3$3,383\\3d3l3t3|3",
        "    <ManifestFile>MicrosoftWindowsBLBWSBOnlineMain.man</ManifestFile>",
        "Display",
        "    Couldn't iterate over feature selections",
        "WVhx0",
        "        >Networking-MPSSVC-Svc</Component>",
        "    Couldn't write ID of partition to modify",
        "WpxUnattendMap::Forget",
        "    Driver missing required path parameter",
        ":):w:",
        "    Couldn't allocate xpath string",
        "=L=i=n=s=",
        "SmiStore::GetSchemaNodeChildren",
        "PWhdo",
        "    Failed to allocate bootDrivers",
        "<H=]=",
        "WpxUnattendMap::Load",
        ":!:::N:c:s:~:",
        "wpaf:RestrictSearch",
        "Mounted schema hive at %s",
        "wpaf:EnableAuditMode",
        "DefaultInt",
        "u:Enable",
        "    Couldn't get item schema for %s",
        "FillSpace",
        "0:0Z0n0z0",
        "    Failed to get schema at path %s",
        ":,;O;j;",
        "WpxUnattendReader::ReadSettingValue",
        "    <Setting>CacheList</Setting>",
        "4,4H4b4",
        "> >8>H>X>h>x>",
        "313H3j3",
        ".?AV?$CAutoRelease@PAVWpxAnswer@@@RAII@@",
        ":#:/:L:h:~:",
        "g    Internal consistency error: WindowsPE-pass setting not allowed in either corresponding deployment phase",
        "    Couldn't write command line",
        "WpxCreateScratchFile",
        "DeplUnattendImporter::ImportDriver",
        "urn:Microsoft.WindowsPhone/PackageSchema.v8.00",
        "4)4<4G4R4e4r4}4",
        "    <Setting>Home_Page</Setting>",
        "?what@exception@@UBEPBDXZ",
        "1.1c1h1m1y1",
        "JZN76-",
        "        >Microsoft-Windows-International-Core</Component>",
        "    Can't export packaging sessions to unattend (use WPAF instead)",
        "  <Setting Path=\"/MediaCenter/UseDefaultOverscanMargins/ForAllUsers\">",
        "    Failed to enumerate the configuration's target states",
        "    <ManifestFile>MigrationWizardApp.man</ManifestFile>",
        "    Invalid drive letter %c (%04x)",
        "425R5r5x5",
        "2$3\\3",
        "?0?5?:?F?U?",
        "    <Setting>DisableWelcomePage</Setting>",
        "    Failed to prune non-present entries from unattend map",
        "3)373M3R3W3c3r3",
        "    <Setting>NoDial</Setting>",
        "_CxxThrowException",
        "WpxMcsfOpenPolicyXml",
        "    Failed to allocate name",
        "y4ShN",
        "restriction\\minInclusive",
        "    <Setting>CameraSoundLevel</Setting>",
        "    <Setting>MediaStop</Setting>",
        "WpxSetting::GetMapKey",
        "ulong",
        "U0S0Q",
        "WpxAnsTree::InsertListItem",
        "DeplWpafExporter::ExportPackage",
        ">!?3?",
        "    Couldn't cast Condition to WpxTargetCondition",
        "8k8p8u8",
        "141<1D1P1p1x1",
        "    Couldn't write partition extend flag",
        "=6=_=o=",
        "818<8S8g8|8",
        "y3Vh%",
        "yESh3",
        "    Unable to parse content of StartOOBE <Action> node: %s",
        "1,101@1D1T1X1h1l1|1",
        "    Couldn't get or create setting node for %s",
        "y_Wh~",
        "u:ColorDepth",
        "Deprecated",
        "    Can't delete map value %s because it does not exist",
        ".?AUIWpxIssueList@@",
        "    <Setting>OverlayCriticalThreshold</Setting>",
        "6\"6;6R6j6z6",
        "5&676t6y6~6",
        "    Invalid boolean value %s for Diagnostics OptIn",
        "2 2D2L2T2\\2d2l2t2|2",
        "p:Setting",
        ".?AUIWpxDeplExporter@@",
        "3!3:3F3K3P3j3~3",
        "9):A:F:K:c:z:",
        "< <(<0<8<H<l<t<|<",
        ">8>=>B>N>X>c>v>",
        "n    Couldn't get names of child nodes under %s",
        "5/5C5W5m5w5",
        "7(747T7`7",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsEscape\">",
        "3$3,343<3L3\\3d3x3",
        ">$>,>4><>D>L>T>\\>d>p>",
        "2K2a2",
        "    Failed to import disk",
        "CL;{Pr",
        "    Unable to query if the setting %s is deprecated",
        "5;6N6S6X6n6x6",
        "8 8$888<8T8X8\\8p8",
        ".?AUIWpxReadOpt@@",
        "8.898P8r8",
        "    Failed to allocate features",
        ":$:I:V:x:}:",
        "1J1t1",
        "<$<)<5<`<m<",
        "PageFile/Size",
        "McsfLeafNode::ParseDefault",
        "f94C^",
        "d    Couldn't validate %s",
        "3!393N3S3X3p3",
        "Destination",
        ".?AVEnumerator@?1??GetAnsEnumValues@WpxSetting@@UAEJPAPAUIWpxAllowedValueEnum@@@Z@",
        "LeaveCriticalSection",
        "    <Setting>CustomPowerApplication5</Setting>",
        ".?AV?$CAutoRelease@PAUIXMLDOMNode@@@RAII@@",
        "RunSynchronous",
        "<-<4<@<K<]<t<",
        "<5<I<l<q<v<",
        ";$;);7;O;o;t;y;",
        "ImageName",
        "    Couldn't iterate over configuration conditions",
        "McsfStore::GetChildrenUnder::Enumerator::GetNext",
        ".rdata$T$brc",
        "    Failed to write access domain",
        "  <Setting Path=\"/Firewall/PublicProfile_LogSuccessfulConnections\">",
        "1 1>1U1",
        "    Couldn't find type decl for complex type %s",
        "<#=7=c=",
        "2&2C2R2Y2w2",
        "> >4>I>V>a>z>",
        "    OptionalParams: Argument cannot be NULL",
        "5,6P6",
        "    Failed to check if %s is allowed in this setting tree",
        "    <Setting>UILanguage</Setting>",
        "WpxTargetCondition::operator ==",
        "    <Setting>BindNavHintsToToolbars</Setting>",
        "    Failed to iterate over variant's target references",
        "080K0V0{0",
        "    Failed to allocate part",
        "    Couldn't write search path %u",
        "9{(v/;C(",
        "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9",
        ".?AV?$CAutoCleanupBase@PAUIXMLDOMNodeList@@@RAII@@",
        "  <Setting Path=\"/InternetExplorer/GroupTabs\">",
        "HeapDestroy",
        "7!8&8+868H8M8R8]8",
        "    Failed to allocate packages",
        "    Failed to allocate apps",
        "QSVWj|",
        "2F2c2h2m2x2",
        "SmiStore::FilterExcludedChildren",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsShiftDown\">",
        "hCM7 j",
        "        >Microsoft-Windows-RasServer</Component>",
        "    <Setting>fDisabledAllowList</Setting>",
        "    <Setting>DefaultConsent</Setting>",
        "        <Setting Path=\"/Messaging/GlobalSettings/ShowSendingStatus\" />",
        "OutputDebugStringW",
        "    <Setting>Shift</Setting>",
        "  <Setting Path=\"/Embedded/HideBootLogo\">",
        "=)=>=S=X=]=k={=",
        "    Couldn't initialize setting %s",
        "REG_DWORD",
        "6,646<6H6h6t6",
        "8q:x:",
        "    Unhandled condition type %u",
        "e    Unknown RegistrySource type %s",
        "DeplUnattendImporter::ParseInt",
        "5%656>6S6h6|6",
        "Partition",
        "  <Setting Path=\"/DNS/Domain\">",
        "4)4A4T405",
        "    Couldn't import WindowsPE settings",
        ".rdata$r$brc",
        "313@3T3l3z3",
        "    Couldn't export disk %u",
        "    <Setting>AltTab</Setting>",
        "        <Setting Path=\"/Power/CustomPowerApplication4/IconID\" />",
        "y-WhD",
        "WpxSetting::GetMapValueName",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsShiftLeft\">",
        "neutral",
        "SmiSchemaNode::Initialize",
        "9(9,9D9H9`9d9|9",
        "?%?*?/?A?}?",
        "7 7-787P7j7w7",
        "Passes",
        "        <Setting Path=\"/Email/EscapeSpecialCharsInAttachmentNames\" />",
        "y*WjJh",
        ":DIRTt",
        "191219011506Z",
        "wpaf:Display/wpaf:RefreshRate",
        "y-Vj+h",
        "161=1^1c1h1t1",
        "  <Setting Path=\"/SharedAccess/ExternalAdapter\">",
        "        <Setting Path=\"/CallAndMessagingEnhancement\" />",
        ".?AV?$CAutoRelease@PAUIWpxAnswerFileWriter@@@RAII@@",
        ".?AV?$CAutoCleanupBase@PAVWpxPathEnum@@@RAII@@",
        "  <Setting Path=\"/Firewall/DisableStatefulFTP\">",
        "030E0",
        "6;6S6k6p6u6",
        "SHLWAPI.dll",
        "    Couldn't write partition active flag",
        "<E<X<l<~<",
        "ImageIndex",
        ";);4;A;F;K;b;u;",
        "StartOOBE/Action",
        "  <Setting Path=\"/Embedded/KeyboardFilter/LeftShiftLeftAltPrintScreen\">",
        "+00050A0f0k0p0|0",
        ".?AV?$CAutoRelease@PAVSettingNode@@@RAII@@",
        "WpxSetting::GetDefaultBinary",
        "    Couldn't write UseConfigurationSet flag",
        "onecore\\base\\ntsetup\\wpx\\core\\unattendmap.cpp",
        "y-Vh8",
        "  <Setting Path=\"/RemoteAssistance/MaxTicketExpiryUnits\">",
        "    Couldn't export package %u",
        ">3>8>>>D>J>P>p>",
        "    Couldn't write partition active bit",
        "aVj}h",
        "WpxUnattendWriter::Write",
        "    Couldn't add Customizations node to document",
        "    <ManifestFile>production\\prod_SMBServer.man</ManifestFile>",
        "    Couldn't serialize filesystem type %u",
        "3Q3{3",
        "urn:schemas-microsoft-com:unattend",
        "  <Setting Path=\"/Embedded/KeyboardFilter/LaunchMediaSelect\">",
        "    Failed to allocate user",
        ".?AV?$CAutoRelease@PAUIXMLDOMParseError2@@@RAII@@",
        "    Couldn't write package path %u",
        "wpaf:WinImage/wpaf:ImageMetadata/wpaf:Value",
        "6 6$6(6@6D6X6\\6t6x6|6",
        "    Failed to allocate gen",
        "6 6$64686H6L6\\6`6p6t6",
        "344t4",
        "    Failed to write ProvisionDisk template",
        "    Failed to allocate created",
        "5'5H5U5w5|5",
        "    UpperBound: Argument cannot be NULL",
        ":L;[;j;",
        "y0Sha",
        "yjVhR",
        "9*9?9D9I9`9j9",
        "; ;8;D;I;N;",
        "=(>|>",
        "wpaf:MBSDriverSet",
        "    <Setting>DisableStatefulFTP</Setting>",
        ">3>H>_>k>p>u>",
        "  <Setting Path=\"/Wireless/CoexistenceSupport\">",
        "= =(=,=4=<=@=H=P=T=\\=d=h=p=x=",
        "OLE32.dll",
        "    Unattend requires every exported package to publish an ID keyform",
        "CreatedPartitions",
        "wpx.dll",
        "  <Setting Path=\"/Fax/Receipts\">",
        ";#;1;M;W;\\;",
        "210317011506Z0",
        "WIMExtractImagePath",
        "@Value",
        "    Couldn't write per-phase settings tree(s)",
        "wpaf:ProvisioningPackages/wpaf:ProvisioningPackage",
        "j\\XVPh",
        "DeplWpafImporter::ImportImage",
        "5K6P6U6a6|6",
        "    Failed to insert child node at index %u",
        "2Q2w2",
        "        >Microsoft-Windows-WPD-BusEnumService</Component>",
        "    Couldn't write partition size",
        "DeplWpafExporter::GetInsNode",
        "location",
        ";?;D;I;V;v;",
        "y0Vhw",
        ":(:3:L:X:]:b:",
        "    Failed to check if right schema has an upper bound",
        "; ;$;(;@;D;X;\\;t;x;|;",
        "=0=T=",
        "868N8\\8z8",
        "y[Whn",
        "n-?\\d+",
        "1 1B1M1`1",
        "  <Setting Path=\"/Embedded/KeyboardFilter/CtrlWin\">",
        "303F3P3r3",
        "%s '<binary>'",
        "    Can't find map key node %s in map value node for map %s",
        "  <Setting Path=\"/Internationalization/UserLocale\">",
        "Active",
        "637F7Z7p7",
        "    <Setting>RouterType</Setting>",
        "2\"3@3",
        "    Couldn't export configuration set option",
        "    <Setting>DisableAccelerators</Setting>",
        "    Invalid boolean value %s for AcceptEula",
        "    </Passes>",
        ">/>@>S>X>]>k>",
        "WpxWpafReader::ReadVariant",
        ".?AV?$CAutoRelease@PAUIWpxAllowedValue@@@RAII@@",
        "  <Setting Path=\"/Power/PreferredPlan\">",
        "Variant",
        ")Microsoft Root Certificate Authority 20100",
        "3(333?3S3",
        "wpaf:FinishAuditMode",
        "    <Setting>HideBootStatusIndicator</Setting>",
        "wpaf:Disks/wpaf:Layout/wpaf:Disk",
        "EvalValueLessThan : Not yet implemented",
        "100701213655Z",
        "y0Vhm",
        "wpaf:DataImages/wpaf:DataImage",
        "272<2U2Z2_2k2",
        "  <Setting Path=\"/InternetExplorer/InstalledToolbarsList\">",
        "kernelbase.dll",
        ".?AVWpxDeplInsSettings@@",
        "%s/%s",
        "5*5/545B5f5",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsF\">",
        "y-Vj5h",
        "WpxAnsTree::SetAnswer",
        "WpxVisibilityState::EnumRules",
        "short",
        "WpxWpafReader::ReadTarget",
        "    Couldn't export deployment settings to WPAF document",
        ".?AV?$CAutoCleanupBase@PAVChildNameEnum@?1??GetSparseNodeChildren@SmiStore@@AAEJABVWpxPath@@PAPAUIWpxStringEnum@@@Z@@RAII@@",
        "5'545?5\\5h5m5r5",
        "e    Failed to delete %s",
        "6(636L6Q6V6m6",
        "<a<r<",
        "DeplWpafImporter::ParseBool",
        "    Couldn't write post-offline phase restart option",
        "9\"9@9Y9|9",
        "    Failed to write pattern",
        "2$202T2\\2d2l2t2|2",
        "    Couldn't get configuration common settings",
        "    <ManifestFile>DNS-Client-Unattend.man</ManifestFile>",
        "Username",
        "    Unable to parse pass list %s for setting %s",
        "5+5E5J5O5^5",
        "Package",
        "    <Setting>DfdAlertTextOverride</Setting>",
        "  <Setting Path=\"/Firewall/PublicProfile/LogFileSize\">",
        ".?AUIWpxConfig@@",
        ".?AV?$CAutoCleanupBase@PAUIWpxVisibilityRuleDesc@@@RAII@@",
        ".idata",
        "GetFileAttributesW",
        "  <Setting Path=\"/Embedded/UnifiedWriteFilter/RegistryExceptionsUserDefined\">",
        "4+484=4B4Z4f4u4",
        "y#Wh>",
        "3\"313A3F3K3W3g3l3q3",
        ":*:/:4:K:V:f:",
        "WpxUnattendWriter::WriteBoolSetting",
        "WpxConfig::ReadAnswerFile",
        "WpxVisibilityState::IsSatisfied",
        "PQQQQQj",
        "545L5l5",
        "111:1E1R1[1f1t1",
        "    <Setting>NoPhysicalCameraLED</Setting>",
        "    Incomplete MetaData (both Key and Value are required)",
        "    <Setting>ShowInformationBar</Setting>",
        "  <Setting Path=\"/Telephony/TapiUnattendLocation\">",
        "    <Setting>WindowsBreak</Setting>",
        "y/Whe",
        "%s%s.sku.xml",
        "/wpaf:Settings/wpaf:Servicing/wpaf:MBSDriverSet",
        "=P>W>",
        "<(<0<P<l<|<",
        "ReadFile",
        "4 4@4",
        "yJWh(",
        "onecore\\base\\ntsetup\\wpx\\core\\exclusions.cpp",
        "8'9<9G9_9t9",
        "    <Setting>DBPath</Setting>",
        "wpaf:ComputerName/wpaf:Name",
        "6?6D6I6`6j6~6",
        "  <Setting Path=\"/Diagnostics/DiskFailureEnabledScenarioExecutionLevel\">",
        "727\\7s7",
        ">3>M>V>|>",
        "    Failed to enumerate over child setting names",
        "    Failed to enumerate child schema nodes",
        ";4;@;`;l;",
        ";0;<;",
        "8#8=8H8]8w8",
        "WpxAnsTree::RemoveAnswerSubtree",
        "718B8J8_8",
        ".?AV?$CAutoRelease@PAUIXMLDOMNodeList@@@RAII@@",
        "KnobsAllowedValue::GetVisibility",
        "    <Setting>FilterLevel</Setting>",
        "    Failed to move item %llu of %s to %llu",
        "    Couldn't write driver path",
        "162k2",
        "    Couldn't export environment settings",
        "u:servicing",
        "<R<\\<",
        "    Failed to allocate filter",
        "        <Setting Path=\"/Power/CustomPowerApplication5/IconID\" />",
        "  <Setting Path=\"/Setup/ProductKey\">",
        "5'606Q6V6[6w6",
        "    Buffer: Argument cannot be NULL",
        "    Couldn't export foundation package keyform %s",
        "6$6,646<6D6L6T6\\6d6l6t6|6",
        "?.?:?F?[?",
        "m    Item: Argument cannot be NULL",
        "1<1Y1^1c1o1",
        "u:DiskID",
        "9w,u5",
        "  <Setting Path=\"/Internationalization/InputLocale\">",
        "wpaf:WimImage",
        "5.53585J5a5",
        ";F<K<P<g<q<",
        "  <Setting Path=\"/Firewall/PrivateProfile/DisableNotifications\">",
        "System32",
        "Index",
        "<:<U<",
        "9-9L9`9",
        "WpxSetting::GetChildren",
        "l    Couldn't retrieve default value",
        "6!6Q6d6q6}6",
        "    <Store Type=\"SMI\">",
        "  <Setting Path=\"/WindowsDefender/DefinitionUpdateFileSharesSources\">",
        "WpxXmlNode::GetAttribute",
        "WpxExclusionList::PathIsExcluded",
        "0C0[0`0e0",
        "<'<1<6<P<r<}<",
        "    Unattend doesn't support specifying the target disk should be provisioned",
        "y_WhP",
        "    Failed to write driver description",
        "    <Setting>UserAccounts</Setting>",
        "2\"2=2W2y2",
        "wpaf:Language/wpaf:LayeredDriver",
        "wpaf:PageFile/wpaf:SizeMB",
        "    Couldn't parse boolean value %s for DisableEncryptedDiskProvisioning",
        "y>VhO",
        "7D7I7N7Z7y7",
        "d    Failed to load unattend map from footprint",
        "StartOOBE",
        "6&797X7j7",
        "Pattern",
        "    Failed to allocate passNodes",
        "    Failed to serialize package type %u",
        "StartAuditMode",
        "    Invalid boolean value for EnableNetwork",
        "2L2w2",
        "8,9h9",
        "    Failed to export asynchronous command %u",
        ";4;G;Q;d;o;",
        "y#Vhy",
        "1(1E1J1O1[1u1",
        "    Couldn't parse content of <EnableWIMBoot> node",
        "ModifyPartition/Format",
        "?$?,?4?<?D?L?T?\\?d?l?t?|?",
        ".?AUIWpxTargetStateEnum@@",
        "  <Setting Path=\"/HelpAndSupport/HelpAndSupport\">",
        "sFeatures",
        "    Couldn't parse content of <RestrictSearch> element",
        ".?AVWpxPartition@@",
        "1Z2s2",
        "555:5?5K5_5s5",
        "DeplWpafExporter::ExportFeature",
        "    <Setting>EnableRemoteManagedDefaults</Setting>",
        "SmiStore::GetChildrenUnder",
        "    Couldn't write network enabled setting",
        "414D4m4r4w4",
        "Order",
        "    <ManifestFile>microsoft-windows-deviceaccess.man</ManifestFile>",
        "    Couldn't import AuditMode settings",
        ">*>=>E>t>z>",
        "WpxValidation::ValidateList",
        "7'8a8|8",
        ".?AV?$CAutoRelease@PAVSmiSchemaNode@@@RAII@@",
        "RPCRT4.dll",
        "    <Setting>VolumeMute</Setting>",
        "    <Setting>GroupTabs</Setting>",
        "0)0I0S0j0o0t0",
        ":#:(:4:N:_:x:",
        "    Couldn't parse minimum / maximum allowed values",
        "t8fHf",
        "Enabled",
        "GetCurrentProcess",
        ":0:=:_:d:i:y:",
        "WpxUnattendWriter::WriteSetting",
        "    LowerBound: Argument cannot be NULL",
        "    Couldn't get WpxCondition object for the given phase",
        "@OwnerType",
        "    <Setting>CoexistenceSupport</Setting>",
        "1\"1'131U1",
        "    <Setting>SystemLocale</Setting>",
        "Microsoft Windows0",
        "HardwareEncryption",
        "    Couldn't write partition volume drive letter",
        "    <Setting>BytesDecryptedInDiskRequestOverhead</Setting>",
        "    Unattend only allows a single Index=(...) disk criterion, but this object has %u criteria",
        "    <Setting>WriteIoAggregateMaxSize</Setting>",
        "DevicePath",
        "DeplUnattendExporter::ExportInstallImage",
        "DeplUnattendExporter::ExportDisk",
        "        <Setting Path=\"/NFC/SEMgr/UI/HideFastCardsOptions\" />",
        "TlsFree",
        "3!3/3O3b3",
        "REG_BINARY",
        "  <Setting Path=\"/MediaCenter/NoDevDiscBalloon\">",
        "=S=g=",
        "    Failed to read settings under component %s",
        " Operating System",
        "    Invalid drive letter: %c",
        ">#>?>^>c>h>w>",
        "    Couldn't append item to list %s",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "u:Reseal",
        "IsValidSecurityDescriptor",
        "718S8d8z8",
        "    Failed to allocate document",
        "    %s is not allowed in setup pass %u",
        "CFG_DATATYPE_UNKNOWN",
        "jAXf;",
        "        <Setting Path=\"/Phone/VoicemailRegistrationTable\" />",
        "WpxSetting::SetAssetTargetPath",
        "CallContext:[%hs] ",
        ".?AVSubKeyEnum@?1??GetChildNames@WpxSmiSetting@@QAEJPAPAUIWpxStringEnum@@@Z@",
        "3/3A3U3n3",
        "    Unhandled setting type %u",
        "    Couldn't enumerate child paths under %s",
        ":5:J:W:b:{:",
        "?*?B?R?]?v?",
        "WpxSmiGetHiveBool",
        "9{lv5",
        "6,6B6G6",
        "    Unattend map doesn't have an entry for %s",
        "  <Setting Path=\"/Printing/RemoveMPDW\">",
        "z.9Wv",
        "  <Setting Path=\"/Embedded/UnifiedWriteFilter/OverlayMaximumSize\">",
        "string",
        "wpaf:StartAuditMode/wpaf:Action",
        "LessEqual",
        "    Incomplete assemblyIdentity specified",
        "WpxSmiSetting::IsSigned",
        ".?AVKnobsVisibilityState@@",
        "Loaded SMI schema hive from WIM image",
        "    Failed to enumerate the configuration's variants",
        "=0=D=_=s=",
        ";);=;y;~;",
        "wpaf:EULA",
        "  <Setting Path=\"/Bluetooth/MTPSearchIntervalOnAC\">",
        "Microsoft-Windows-PnpCustomizationsWinPE",
        "PWhp/",
        "    Couldn't get the current scratch directory",
        "    Couldn't get answer object",
        "WpxConfig::WriteAnswerFile",
        "Hbg&~",
        "LogPath",
        "onecore\\base\\ntsetup\\wpx\\ks\\settingapplyinfo.cpp",
        "?J?Q?",
        "2/2U2u2",
        "wpaf:PageFile/wpaf:Path",
        "    Couldn't set generalize ForceShutdownNow flag",
        "515N5[5g5s5x5}5",
        "WpxUnattendReader::ReadSettingTree",
        "    Failed to add map key allowed value.",
        "    Failed to get newly-created item %llu of %s",
        "<2<G<V<p<",
        "6-6b6",
        "    <Setting>VisualEffects</Setting>",
        "e    Couldn't enumerate children under %s",
        "  <Setting Path=\"/InternetExplorer/PreApprovedAddons\">",
        "y+Wh%",
        "    Couldn't create WpxXmlDocument",
        "    <Setting>DisableVolumeDisplay</Setting>",
        "u:Filename",
        "021I1l1q1v1",
        "    Can't get enumeration type",
        "    Failed to iterate over destination disk conditions",
        "        >Microsoft-Windows-CoreMmRes</Component>",
        "wpaf:%s",
        "    <Setting>HKLMConnectRetries</Setting>",
        "DeplWpafExporter::ExportPartition",
        ">(>->>>T>e>",
        "    Couldn't write WDS image name",
        ".rdata$sxdata",
        "MultipleErrorMessages",
        "9&:0:5:O:q:|:",
        "y+WhD",
        ".?AVWpxVariant@@",
        "    Can't parse %s as a boolean",
        "AnsEnumValues",
        "WpxTarget::AddTargetState",
        "WpxSetting::GetDefaultInt",
        "    Couldn't get pass from pass condition",
        "GetTickCount",
        "EvalValueGreaterThan : Not yet implemented",
        ".?AV?$CAutoRelease@PAUIXMLDOMElement@@@RAII@@",
        "    Failed to get <settings> element for pass %u",
        "p:CspSource",
        "    Couldn't write partition size (fill remaining space)",
        "  <Setting Path=\"/InternetExplorer/Window_Title_CN\">",
        ".?AVMapKeyEnum@?1??GetMapKeys@WpxSetting@@UAEJPAPAUIWpxStringEnum@@@Z@",
        "0!0,0D0P0U0Z0",
        "  <Setting Path=\"/Embedded/KeyboardFilter/WindowsU\">",
        "7K8V8b8t8",
        "4!494[4o4",
        "LocalFree",
        "RRWRQ",
        "  <Setting Path=\"/Embedded/KeyboardFilter/MediaPlayPause\">",
        "    <Setting>PermittedManagers</Setting>",
        "DeplUnattendImporter::ImportCommand",
        "@version",
        "282H2X2`2",
        "<#<=<R<W<u<z<",
        "    Failed to check if left schema has a maximum length",
        "    <Setting>DNSDomain</Setting>",
        "EnableCompactOS",
        "    Couldn't get WPAF exporter for deployment settings",
        "Automatic",
        ".?AV?$CAutoORCloseKey@PAX@RAII@@",
        "    Couldn't get allowed values for %s",
        "?3?X?r?",
        "    <Setting>FeedList</Setting>",
        ".?AV?$CAutoRelease@PAUIWpxStoreEnum@@@RAII@@",
        "9>9C9R9f9z9",
        "y0Vh)",
        "  <Setting Path=\"/OnlineBackup/ResourceDLL\">",
        "979R9m9",
        "wpaf:TargetRefs/wpaf:TargetRef",
        "2@3S3p3",
        ":0:e:",
        "4\"4>4",
        "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6",
        "e    %s is not a built-in type",
        "  <Setting Path=\"/SNMP/TrapConfiguration\">",
        "/wpaf:Settings/wpaf:UnattendedSetup/wpaf:Eula",
        "    Couldn't infer image type from file extension in Path %s",
        ";(;@;X;p;",
        "u:Disk",
        "Language",
        "    Couldn't get parent node for setting %s",
        ".?AVWpxCondition@@",
        "    Couldn't create pass condition for pass %u",
        "%Microsoft Windows Production PCA 20110",
        "    <Setting>WindowsUp</Setting>",
        "  <Setting Path=\"/SoftwareLicensing/SkipRearm\">",
        "y#Wha",
        "    Couldn't set map key attribute for map value %s",
        "*/u:Order",
        "=r=w=|=",
        "9w$u?",
        "wpaf:EnableDiagnostics",
        "DeplWpafImporter::ParseSize",
        "<'<A<c<z<",
        "060V0z0",
        "%s is above the maximum allowed value",
        ".?AV?$CAutoCleanupBase@PAVWpxSetting@@@RAII@@",
        "wpx.pdb",
        "    Couldn't set component architecture attribute",
        "/u:unattend/u:settings[@pass='oobeSystem']/u:component[@name='Microsoft-Windows-Deployment']",
        "    '%s' appears to be a macro, but doesn't start with $ or ~",
        "?*?>?N?",
        "    Couldn't get setting %s",
        "  <Setting Path=\"/StartMenu/Enable\">",
        "WpxSetting::GetAnsPattern",
        "    Failed to parse XML for %s",
        "  <Setting Path=\"/SMBClient/SyncDomainWithMembership\">",
        "y3Vh0",
        "485E5]5",
        ";0;I;[;t;",
        ":';R;];t;",
        "wpaf:FinishOfflinePhase/wpaf:Action",
        "  <Setting Path=\"/Audio/EnableCaptureMonitor\">",
        "CreateMutexExW",
        "j#XVPh",
        "    <Setting>Role</Setting>",
        "6&616I6o6",
        ".?AVWpxReadOpt@@",
        "    <Setting>PrivateProfile_LogSuccessfulConnections</Setting>",
        "    Failed to parse '%s' as a EULA action",
        "Maximum",
        "QQSVWjP",
        "    Couldn't get or create <component> element for %s",
        "1\\2f2",
        ".?AVEmpty@?1??GetVisibility@SmiSchemaNode@@UAEJPAPAUIWpxStateDescEnum@@@Z@",
        "        >Microsoft-Windows-stobject</Component>",
        "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0",
        "    Couldn't parse setting type",
        "5,5f5",
        "  <Setting Path=\"/Firewall/DomainProfile_LogDroppedPackets\">",
        "  <Setting Path=\"/Shell/CopyProfile\">",
        "Loaded WIM file %s",
        "    <Setting>CompanyName</Setting>",
        "WIMSetTemporaryPath",
        "    Unhandled SMI setting type %u",
        "    Failed to add <TargetRef> to document tree",
        "Network/Enabled",
        "    <Setting>HKLMContentPerUserItem</Setting>",
        "onecore\\base\\ntsetup\\wpx\\depl\\unattendexporter.cpp",
        ".?AV?$CAutoCleanupBase@PAUIWpxSchemaAllowedValueEnum@@@RAII@@",
        "    ApplyInfo: Argument cannot be NULL",
        "    Can't specify <ClusterSize> for an item in <CreatedPartitions>",
        ".rdata$zzzdbg",
        "    Failed to filter map key %s from child names",
        "WpxSimpleAllowedValue::GetIntValue",
        "    Couldn't export servicing settings",
        "728b8l8",
        "    Failed to allocate from",
        "?\"?b?g?l?{?",
        "u:ImageGroup",
        "    Failed to allocate find",
        "nonSxS",
        ".?AVWpxVisibilityState@@",
        "    <Setting>WindowsFeatures</Setting>"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "a96439aac9d7e417396073a468269da1dde52b47920c3a42e71b6df8119da257",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/a96439aac9d7e417396073a468269da1dde52b47920c3a42e71b6df8119da257",
              "guest_paths": [
                "overlay"
              ],
              "size": 8520,
              "crc32": "FAA8B66D",
              "md5": "6c0fd685c052aadc75341874b25c3a96",
              "sha1": "2159a093889adc5ebc4356b4efa9ca51fcacf6dc",
              "sha256": "a96439aac9d7e417396073a468269da1dde52b47920c3a42e71b6df8119da257",
              "sha512": "8298d53e5644260df3eef36e3f02fe6339f889d2a6c30b895ec92bf347d05fcd8498f046825561291c81980cac90f0dd424b880b85f33c82b1e88c14fa0dede8",
              "rh_hash": null,
              "ssdeep": "192:hr8VHwDDBQABJokibQwuD8PEqXAfqnajKswRO1jBBW:hr6wDDBRJok4QwuAzXulGswRO1j/W",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T1F50208D1CB781443CA567C9013ACE5837D3DA3CB582055A615ABF9942CDB3C6EF0497E",
              "sha3_384": "0f543a56e08a06ef0f940c1f8c844c4842773600c7d0737b36efa497baf41190dacb94332fdd254207cddbccf59e920a",
              "data": null
            }
          ],
          "extracted_files_time": 0.0005521249986486509,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "setupplatform.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/cbeec25c578f4e8eae81bb8829c3b7bc81648da6f63eeb4a606b9a66660d6d91",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
      ],
      "size": 7203144,
      "crc32": "C6B82380",
      "md5": "0db2eb7b159d7289dfbdf3ca29d44704",
      "sha1": "57a9aa7409a9040a701855bf610f68e5a9cfea24",
      "sha256": "cbeec25c578f4e8eae81bb8829c3b7bc81648da6f63eeb4a606b9a66660d6d91",
      "sha512": "8eada149f0c90df794d26efe8af2c90df1b8172b33ccc6639f3f1a18671aa34493a6d466b4bf2357075094bc13129e5001623b2388c39ed6fa4239b4e9ef6328",
      "rh_hash": null,
      "ssdeep": "98304:FsA91crphY6bcvsNZSI/mbuhfuCK4Q4Rus1T+nfIqBpxlpcLy/Wuac7KA2:iA98pSg3ZHLusB+nF1/dS",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T123764B2262454137F0BF213A5466732A82AFBC204BF58CD79131DBAF253A4D35D3AB5B",
      "sha3_384": "a3af9b8e6b88ea00a151f4a7b8a3ce62ece37b137958617ee95d0db0f19e95591642098f26d15d0d4fa1e561c265550e",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x0056b710",
        "ep_bytes": "8bff558bec837d0c017505e8b5050000",
        "peid_signatures": null,
        "reported_checksum": "0x006e0808",
        "actual_checksum": "0x006e0808",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "SetupPlatform.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x10643680",
                "name": "_wcstoi64"
              },
              {
                "address": "0x10643684",
                "name": "_wcsrev"
              },
              {
                "address": "0x10643688",
                "name": "qsort"
              },
              {
                "address": "0x1064368c",
                "name": "wcstok_s"
              },
              {
                "address": "0x10643690",
                "name": "isspace"
              },
              {
                "address": "0x10643694",
                "name": "_resetstkoflw"
              },
              {
                "address": "0x10643698",
                "name": "toupper"
              },
              {
                "address": "0x1064369c",
                "name": "vswprintf_s"
              },
              {
                "address": "0x106436a0",
                "name": "??0exception@@QAE@ABQBD@Z"
              },
              {
                "address": "0x106436a4",
                "name": "__doserrno"
              },
              {
                "address": "0x106436a8",
                "name": "fwscanf_s"
              },
              {
                "address": "0x106436ac",
                "name": "ferror"
              },
              {
                "address": "0x106436b0",
                "name": "fwprintf_s"
              },
              {
                "address": "0x106436b4",
                "name": "feof"
              },
              {
                "address": "0x106436b8",
                "name": "realloc"
              },
              {
                "address": "0x106436bc",
                "name": "wcstol"
              },
              {
                "address": "0x106436c0",
                "name": "iswctype"
              },
              {
                "address": "0x106436c4",
                "name": "strncmp"
              },
              {
                "address": "0x106436c8",
                "name": "memcpy_s"
              },
              {
                "address": "0x106436cc",
                "name": "fclose"
              },
              {
                "address": "0x106436d0",
                "name": "_wfopen_s"
              },
              {
                "address": "0x106436d4",
                "name": "_wcsupr"
              },
              {
                "address": "0x106436d8",
                "name": "__iob_func"
              },
              {
                "address": "0x106436dc",
                "name": "_wtof"
              },
              {
                "address": "0x106436e0",
                "name": "fflush"
              },
              {
                "address": "0x106436e4",
                "name": "wcsnlen"
              },
              {
                "address": "0x106436e8",
                "name": "_wcslwr"
              },
              {
                "address": "0x106436ec",
                "name": "_snwscanf_s"
              },
              {
                "address": "0x106436f0",
                "name": "strcpy_s"
              },
              {
                "address": "0x106436f4",
                "name": "_vsnwprintf_s"
              },
              {
                "address": "0x106436f8",
                "name": "wcscat_s"
              },
              {
                "address": "0x106436fc",
                "name": "_ultow_s"
              },
              {
                "address": "0x10643700",
                "name": "bsearch"
              },
              {
                "address": "0x10643704",
                "name": "wcsncmp"
              },
              {
                "address": "0x10643708",
                "name": "iswdigit"
              },
              {
                "address": "0x1064370c",
                "name": "wcsstr"
              },
              {
                "address": "0x10643710",
                "name": "swprintf_s"
              },
              {
                "address": "0x10643714",
                "name": "wprintf"
              },
              {
                "address": "0x10643718",
                "name": "_wtol"
              },
              {
                "address": "0x1064371c",
                "name": "wcscpy_s"
              },
              {
                "address": "0x10643720",
                "name": "strncpy_s"
              },
              {
                "address": "0x10643724",
                "name": "_errno"
              },
              {
                "address": "0x10643728",
                "name": "strtol"
              },
              {
                "address": "0x1064372c",
                "name": "_set_errno"
              },
              {
                "address": "0x10643730",
                "name": "strrchr"
              },
              {
                "address": "0x10643734",
                "name": "isalpha"
              },
              {
                "address": "0x10643738",
                "name": "sprintf_s"
              },
              {
                "address": "0x1064373c",
                "name": "isdigit"
              },
              {
                "address": "0x10643740",
                "name": "_vscwprintf"
              },
              {
                "address": "0x10643744",
                "name": "swscanf"
              },
              {
                "address": "0x10643748",
                "name": "wcschr"
              },
              {
                "address": "0x1064374c",
                "name": "strchr"
              },
              {
                "address": "0x10643750",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x10643754",
                "name": "__RTDynamicCast"
              },
              {
                "address": "0x10643758",
                "name": "_ftol2"
              },
              {
                "address": "0x1064375c",
                "name": "_ftol2_sse"
              },
              {
                "address": "0x10643760",
                "name": "memcmp"
              },
              {
                "address": "0x10643764",
                "name": "memcpy"
              },
              {
                "address": "0x10643768",
                "name": "memmove"
              },
              {
                "address": "0x1064376c",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x10643770",
                "name": "wcstoul"
              },
              {
                "address": "0x10643774",
                "name": "towlower"
              },
              {
                "address": "0x10643778",
                "name": "towupper"
              },
              {
                "address": "0x1064377c",
                "name": "_onexit"
              },
              {
                "address": "0x10643780",
                "name": "__dllonexit"
              },
              {
                "address": "0x10643784",
                "name": "_unlock"
              },
              {
                "address": "0x10643788",
                "name": "_lock"
              },
              {
                "address": "0x1064378c",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x10643790",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x10643794",
                "name": "_initterm"
              },
              {
                "address": "0x10643798",
                "name": "_amsg_exit"
              },
              {
                "address": "0x1064379c",
                "name": "_wcsicmp"
              },
              {
                "address": "0x106437a0",
                "name": "_wtoi64"
              },
              {
                "address": "0x106437a4",
                "name": "_wcstoui64"
              },
              {
                "address": "0x106437a8",
                "name": "_wtoi"
              },
              {
                "address": "0x106437ac",
                "name": "swscanf_s"
              },
              {
                "address": "0x106437b0",
                "name": "iswalpha"
              },
              {
                "address": "0x106437b4",
                "name": "_vsnprintf_s"
              },
              {
                "address": "0x106437b8",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x106437bc",
                "name": "_XcptFilter"
              },
              {
                "address": "0x106437c0",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x106437c4",
                "name": "_callnewh"
              },
              {
                "address": "0x106437c8",
                "name": "?what@exception@@UBEPBDXZ"
              },
              {
                "address": "0x106437cc",
                "name": "??1exception@@UAE@XZ"
              },
              {
                "address": "0x106437d0",
                "name": "??0exception@@QAE@ABV0@@Z"
              },
              {
                "address": "0x106437d4",
                "name": "??0exception@@QAE@XZ"
              },
              {
                "address": "0x106437d8",
                "name": "_vsnprintf"
              },
              {
                "address": "0x106437dc",
                "name": "wcsncpy_s"
              },
              {
                "address": "0x106437e0",
                "name": "wcsrchr"
              },
              {
                "address": "0x106437e4",
                "name": "_strnicmp"
              },
              {
                "address": "0x106437e8",
                "name": "_stricmp"
              },
              {
                "address": "0x106437ec",
                "name": "fwprintf"
              },
              {
                "address": "0x106437f0",
                "name": "_scwprintf"
              },
              {
                "address": "0x106437f4",
                "name": "iswspace"
              },
              {
                "address": "0x106437f8",
                "name": "_purecall"
              },
              {
                "address": "0x106437fc",
                "name": "malloc"
              },
              {
                "address": "0x10643800",
                "name": "calloc"
              },
              {
                "address": "0x10643804",
                "name": "memmove_s"
              },
              {
                "address": "0x10643808",
                "name": "free"
              },
              {
                "address": "0x1064380c",
                "name": "?name@type_info@@QBEPBDXZ"
              },
              {
                "address": "0x10643810",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x10643814",
                "name": "memset"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x1064381c",
                "name": "RtlInitializeBitMap"
              },
              {
                "address": "0x10643820",
                "name": "RtlClearAllBits"
              },
              {
                "address": "0x10643824",
                "name": "RtlSetBits"
              },
              {
                "address": "0x10643828",
                "name": "RtlAreBitsClear"
              },
              {
                "address": "0x1064382c",
                "name": "RtlFindSetBits"
              },
              {
                "address": "0x10643830",
                "name": "RtlNumberOfSetBits"
              },
              {
                "address": "0x10643834",
                "name": "RtlRandom"
              },
              {
                "address": "0x10643838",
                "name": "NtPowerInformation"
              },
              {
                "address": "0x1064383c",
                "name": "NtOpenFile"
              },
              {
                "address": "0x10643840",
                "name": "NtSetSystemInformation"
              },
              {
                "address": "0x10643844",
                "name": "NtQueryInformationFile"
              },
              {
                "address": "0x10643848",
                "name": "NtQueryInformationProcess"
              },
              {
                "address": "0x1064384c",
                "name": "NtQueryVolumeInformationFile"
              },
              {
                "address": "0x10643850",
                "name": "RtlDosPathNameToNtPathName_U"
              },
              {
                "address": "0x10643854",
                "name": "NtCreateFile"
              },
              {
                "address": "0x10643858",
                "name": "NtSetInformationFile"
              },
              {
                "address": "0x1064385c",
                "name": "NtClose"
              },
              {
                "address": "0x10643860",
                "name": "RtlFreeUnicodeString"
              },
              {
                "address": "0x10643864",
                "name": "RtlAdjustPrivilege"
              },
              {
                "address": "0x10643868",
                "name": "NtQueryLicenseValue"
              },
              {
                "address": "0x1064386c",
                "name": "RtlNtStatusToDosError"
              },
              {
                "address": "0x10643870",
                "name": "NtQuerySystemInformation"
              },
              {
                "address": "0x10643874",
                "name": "NtOpenThreadToken"
              },
              {
                "address": "0x10643878",
                "name": "NtDuplicateToken"
              },
              {
                "address": "0x1064387c",
                "name": "NtOpenProcessToken"
              },
              {
                "address": "0x10643880",
                "name": "NtLoadKey2"
              },
              {
                "address": "0x10643884",
                "name": "RtlFormatCurrentUserKeyPath"
              },
              {
                "address": "0x10643888",
                "name": "RtlNtStatusToDosErrorNoTeb"
              },
              {
                "address": "0x1064388c",
                "name": "RtlDosPathNameToRelativeNtPathName_U_WithStatus"
              },
              {
                "address": "0x10643890",
                "name": "RtlpEnsureBufferSize"
              },
              {
                "address": "0x10643894",
                "name": "RtlNtPathNameToDosPathName"
              },
              {
                "address": "0x10643898",
                "name": "RtlInitializeCriticalSection"
              },
              {
                "address": "0x1064389c",
                "name": "NtUnloadKey2"
              },
              {
                "address": "0x106438a0",
                "name": "NtSetEaFile"
              },
              {
                "address": "0x106438a4",
                "name": "RtlDeleteResource"
              },
              {
                "address": "0x106438a8",
                "name": "RtlReleaseResource"
              },
              {
                "address": "0x106438ac",
                "name": "RtlInitUnicodeString"
              },
              {
                "address": "0x106438b0",
                "name": "RtlAcquireResourceShared"
              },
              {
                "address": "0x106438b4",
                "name": "RtlAcquireResourceExclusive"
              },
              {
                "address": "0x106438b8",
                "name": "RtlInitializeResource"
              },
              {
                "address": "0x106438bc",
                "name": "NtQueryEaFile"
              },
              {
                "address": "0x106438c0",
                "name": "RtlFindAceByType"
              },
              {
                "address": "0x106438c4",
                "name": "RtlGetLastNtStatus"
              },
              {
                "address": "0x106438c8",
                "name": "LdrAccessResource"
              },
              {
                "address": "0x106438cc",
                "name": "LdrFindResource_U"
              },
              {
                "address": "0x106438d0",
                "name": "RtlGetNtProductType"
              },
              {
                "address": "0x106438d4",
                "name": "NtQueryInformationThread"
              },
              {
                "address": "0x106438d8",
                "name": "NtCreateEvent"
              },
              {
                "address": "0x106438dc",
                "name": "RtlImageNtHeader"
              },
              {
                "address": "0x106438e0",
                "name": "NtOpenProcess"
              },
              {
                "address": "0x106438e4",
                "name": "NtYieldExecution"
              },
              {
                "address": "0x106438e8",
                "name": "RtlRaiseStatus"
              },
              {
                "address": "0x106438ec",
                "name": "RtlExpandEnvironmentStrings"
              },
              {
                "address": "0x106438f0",
                "name": "NtReadFile"
              },
              {
                "address": "0x106438f4",
                "name": "NtWaitForSingleObject"
              },
              {
                "address": "0x106438f8",
                "name": "NtQueryDirectoryFile"
              },
              {
                "address": "0x106438fc",
                "name": "NtFsControlFile"
              },
              {
                "address": "0x10643900",
                "name": "RtlEqualUnicodeString"
              },
              {
                "address": "0x10643904",
                "name": "NtQuerySystemEnvironmentValueEx"
              },
              {
                "address": "0x10643908",
                "name": "NtQueryAttributesFile"
              },
              {
                "address": "0x1064390c",
                "name": "NtWriteFile"
              },
              {
                "address": "0x10643910",
                "name": "NtUnloadKey"
              },
              {
                "address": "0x10643914",
                "name": "NtDelayExecution"
              },
              {
                "address": "0x10643918",
                "name": "NtLoadKey"
              },
              {
                "address": "0x1064391c",
                "name": "NtEnumerateValueKey"
              },
              {
                "address": "0x10643920",
                "name": "NtEnumerateKey"
              },
              {
                "address": "0x10643924",
                "name": "NtQuerySecurityObject"
              },
              {
                "address": "0x10643928",
                "name": "RtlSetControlSecurityDescriptor"
              },
              {
                "address": "0x1064392c",
                "name": "RtlConvertSidToUnicodeString"
              },
              {
                "address": "0x10643930",
                "name": "RtlGetControlSecurityDescriptor"
              },
              {
                "address": "0x10643934",
                "name": "NtRestoreKey"
              },
              {
                "address": "0x10643938",
                "name": "RtlAddAccessAllowedAce"
              },
              {
                "address": "0x1064393c",
                "name": "RtlReAllocateHeap"
              },
              {
                "address": "0x10643940",
                "name": "RtlGetAce"
              },
              {
                "address": "0x10643944",
                "name": "RtlExpandEnvironmentStrings_U"
              },
              {
                "address": "0x10643948",
                "name": "RtlDestroyEnvironment"
              },
              {
                "address": "0x1064394c",
                "name": "RtlCreateEnvironment"
              },
              {
                "address": "0x10643950",
                "name": "RtlSetEnvironmentVariable"
              },
              {
                "address": "0x10643954",
                "name": "NtQuerySystemTime"
              },
              {
                "address": "0x10643958",
                "name": "RtlValidSid"
              },
              {
                "address": "0x1064395c",
                "name": "EtwEventWrite"
              },
              {
                "address": "0x10643960",
                "name": "NtSaveKeyEx"
              },
              {
                "address": "0x10643964",
                "name": "NtDeleteValueKey"
              },
              {
                "address": "0x10643968",
                "name": "NtFlushKey"
              },
              {
                "address": "0x1064396c",
                "name": "NtQueryKey"
              },
              {
                "address": "0x10643970",
                "name": "NtQueryObject"
              },
              {
                "address": "0x10643974",
                "name": "RtlSetThreadErrorMode"
              },
              {
                "address": "0x10643978",
                "name": "RtlGetThreadErrorMode"
              },
              {
                "address": "0x1064397c",
                "name": "NtDeleteFile"
              },
              {
                "address": "0x10643980",
                "name": "RtlDosPathNameToNtPathName_U_WithStatus"
              },
              {
                "address": "0x10643984",
                "name": "RtlCompareMemory"
              },
              {
                "address": "0x10643988",
                "name": "NtCreateKey"
              },
              {
                "address": "0x1064398c",
                "name": "NtEnumerateBootEntries"
              },
              {
                "address": "0x10643990",
                "name": "NtQueryDirectoryObject"
              },
              {
                "address": "0x10643994",
                "name": "NtOpenDirectoryObject"
              },
              {
                "address": "0x10643998",
                "name": "NtTranslateFilePath"
              },
              {
                "address": "0x1064399c",
                "name": "NtSetSecurityObject"
              },
              {
                "address": "0x106439a0",
                "name": "NtQueryBootOptions"
              },
              {
                "address": "0x106439a4",
                "name": "NtQueryBootEntryOrder"
              },
              {
                "address": "0x106439a8",
                "name": "NtDeleteKey"
              },
              {
                "address": "0x106439ac",
                "name": "NtQueryValueKey"
              },
              {
                "address": "0x106439b0",
                "name": "NtSetValueKey"
              },
              {
                "address": "0x106439b4",
                "name": "NtDeviceIoControlFile"
              },
              {
                "address": "0x106439b8",
                "name": "NtQuerySymbolicLinkObject"
              },
              {
                "address": "0x106439bc",
                "name": "NtOpenKey"
              },
              {
                "address": "0x106439c0",
                "name": "NtOpenSymbolicLinkObject"
              },
              {
                "address": "0x106439c4",
                "name": "RtlImpersonateSelf"
              },
              {
                "address": "0x106439c8",
                "name": "NtPrivilegeCheck"
              },
              {
                "address": "0x106439cc",
                "name": "NtOpenThreadTokenEx"
              },
              {
                "address": "0x106439d0",
                "name": "NtSetInformationThread"
              },
              {
                "address": "0x106439d4",
                "name": "NtOpenProcessTokenEx"
              },
              {
                "address": "0x106439d8",
                "name": "NtAdjustPrivilegesToken"
              },
              {
                "address": "0x106439dc",
                "name": "ZwOpenProcess"
              },
              {
                "address": "0x106439e0",
                "name": "ZwQueryInformationFile"
              },
              {
                "address": "0x106439e4",
                "name": "ZwDeleteFile"
              },
              {
                "address": "0x106439e8",
                "name": "RtlInitAnsiString"
              },
              {
                "address": "0x106439ec",
                "name": "ZwQueryInformationProcess"
              },
              {
                "address": "0x106439f0",
                "name": "LdrGetDllHandle"
              },
              {
                "address": "0x106439f4",
                "name": "ZwQueryVolumeInformationFile"
              },
              {
                "address": "0x106439f8",
                "name": "LdrGetProcedureAddress"
              },
              {
                "address": "0x106439fc",
                "name": "ZwOpenDirectoryObject"
              },
              {
                "address": "0x10643a00",
                "name": "RtlGetVersion"
              },
              {
                "address": "0x10643a04",
                "name": "ZwOpenSymbolicLinkObject"
              },
              {
                "address": "0x10643a08",
                "name": "ZwQueryDirectoryObject"
              },
              {
                "address": "0x10643a0c",
                "name": "ZwDeviceIoControlFile"
              },
              {
                "address": "0x10643a10",
                "name": "ZwQuerySymbolicLinkObject"
              },
              {
                "address": "0x10643a14",
                "name": "ZwAllocateUuids"
              },
              {
                "address": "0x10643a18",
                "name": "ZwOpenKey"
              },
              {
                "address": "0x10643a1c",
                "name": "ZwSetValueKey"
              },
              {
                "address": "0x10643a20",
                "name": "RtlCreateSecurityDescriptor"
              },
              {
                "address": "0x10643a24",
                "name": "ZwUnloadKey"
              },
              {
                "address": "0x10643a28",
                "name": "ZwSetSecurityObject"
              },
              {
                "address": "0x10643a2c",
                "name": "RtlCreateAcl"
              },
              {
                "address": "0x10643a30",
                "name": "ZwQueryValueKey"
              },
              {
                "address": "0x10643a34",
                "name": "ZwEnumerateKey"
              },
              {
                "address": "0x10643a38",
                "name": "ZwDeleteKey"
              },
              {
                "address": "0x10643a3c",
                "name": "RtlFreeSid"
              },
              {
                "address": "0x10643a40",
                "name": "ZwSaveKey"
              },
              {
                "address": "0x10643a44",
                "name": "ZwDeleteValueKey"
              },
              {
                "address": "0x10643a48",
                "name": "ZwFlushKey"
              },
              {
                "address": "0x10643a4c",
                "name": "RtlLengthSid"
              },
              {
                "address": "0x10643a50",
                "name": "RtlAllocateAndInitializeSid"
              },
              {
                "address": "0x10643a54",
                "name": "RtlAddAccessAllowedAceEx"
              },
              {
                "address": "0x10643a58",
                "name": "ZwLoadKey"
              },
              {
                "address": "0x10643a5c",
                "name": "ZwCreateKey"
              },
              {
                "address": "0x10643a60",
                "name": "ZwCreateFile"
              },
              {
                "address": "0x10643a64",
                "name": "RtlSetDaclSecurityDescriptor"
              },
              {
                "address": "0x10643a68",
                "name": "RtlSetOwnerSecurityDescriptor"
              },
              {
                "address": "0x10643a6c",
                "name": "RtlLengthSecurityDescriptor"
              },
              {
                "address": "0x10643a70",
                "name": "ZwClose"
              },
              {
                "address": "0x10643a74",
                "name": "ZwOpenMutant"
              },
              {
                "address": "0x10643a78",
                "name": "ZwOpenFile"
              },
              {
                "address": "0x10643a7c",
                "name": "ZwReleaseMutant"
              },
              {
                "address": "0x10643a80",
                "name": "ZwQueryKey"
              },
              {
                "address": "0x10643a84",
                "name": "ZwWaitForSingleObject"
              },
              {
                "address": "0x10643a88",
                "name": "ZwQueryAttributesFile"
              },
              {
                "address": "0x10643a8c",
                "name": "RtlAppendUnicodeToString"
              },
              {
                "address": "0x10643a90",
                "name": "RtlAllocateHeap"
              },
              {
                "address": "0x10643a94",
                "name": "RtlFreeHeap"
              },
              {
                "address": "0x10643a98",
                "name": "RtlStringFromGUID"
              },
              {
                "address": "0x10643a9c",
                "name": "RtlGUIDFromString"
              },
              {
                "address": "0x10643aa0",
                "name": "ZwQuerySystemInformation"
              },
              {
                "address": "0x10643aa4",
                "name": "NtCreatePagingFile"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x10643000",
                "name": "RegOpenKeyW"
              },
              {
                "address": "0x10643004",
                "name": "RegCreateKeyW"
              },
              {
                "address": "0x10643008",
                "name": "ImpersonateLoggedOnUser"
              },
              {
                "address": "0x1064300c",
                "name": "CredReadW"
              },
              {
                "address": "0x10643010",
                "name": "RegDeleteTreeW"
              },
              {
                "address": "0x10643014",
                "name": "RegDeleteKeyExW"
              },
              {
                "address": "0x10643018",
                "name": "EnumDependentServicesW"
              },
              {
                "address": "0x1064301c",
                "name": "NotifyServiceStatusChangeW"
              },
              {
                "address": "0x10643020",
                "name": "FreeSid"
              },
              {
                "address": "0x10643024",
                "name": "AllocateAndInitializeSid"
              },
              {
                "address": "0x10643028",
                "name": "DuplicateTokenEx"
              },
              {
                "address": "0x1064302c",
                "name": "SetThreadToken"
              },
              {
                "address": "0x10643030",
                "name": "GetTokenInformation"
              },
              {
                "address": "0x10643034",
                "name": "ConvertSidToStringSidW"
              },
              {
                "address": "0x10643038",
                "name": "GetSecurityDescriptorOwner"
              },
              {
                "address": "0x1064303c",
                "name": "GetSecurityDescriptorControl"
              },
              {
                "address": "0x10643040",
                "name": "SetNamedSecurityInfoW"
              },
              {
                "address": "0x10643044",
                "name": "GetSecurityDescriptorGroup"
              },
              {
                "address": "0x10643048",
                "name": "GetSecurityDescriptorDacl"
              },
              {
                "address": "0x1064304c",
                "name": "GetSecurityDescriptorSacl"
              },
              {
                "address": "0x10643050",
                "name": "GetSecurityDescriptorLength"
              },
              {
                "address": "0x10643054",
                "name": "GetAclInformation"
              },
              {
                "address": "0x10643058",
                "name": "InitializeSecurityDescriptor"
              },
              {
                "address": "0x1064305c",
                "name": "GetLengthSid"
              },
              {
                "address": "0x10643060",
                "name": "InitializeAcl"
              },
              {
                "address": "0x10643064",
                "name": "AddAccessAllowedAce"
              },
              {
                "address": "0x10643068",
                "name": "EqualSid"
              },
              {
                "address": "0x1064306c",
                "name": "SetSecurityDescriptorDacl"
              },
              {
                "address": "0x10643070",
                "name": "RevertToSelf"
              },
              {
                "address": "0x10643074",
                "name": "OpenEncryptedFileRawW"
              },
              {
                "address": "0x10643078",
                "name": "WriteEncryptedFileRaw"
              },
              {
                "address": "0x1064307c",
                "name": "CloseEncryptedFileRaw"
              },
              {
                "address": "0x10643080",
                "name": "ReadEncryptedFileRaw"
              },
              {
                "address": "0x10643084",
                "name": "TraceMessage"
              },
              {
                "address": "0x10643088",
                "name": "GetTraceLoggerHandle"
              },
              {
                "address": "0x1064308c",
                "name": "GetTraceEnableLevel"
              },
              {
                "address": "0x10643090",
                "name": "GetTraceEnableFlags"
              },
              {
                "address": "0x10643094",
                "name": "RegisterTraceGuidsW"
              },
              {
                "address": "0x10643098",
                "name": "RegGetValueW"
              },
              {
                "address": "0x1064309c",
                "name": "RegCloseKey"
              },
              {
                "address": "0x106430a0",
                "name": "RegSetValueExW"
              },
              {
                "address": "0x106430a4",
                "name": "RegDeleteKeyW"
              },
              {
                "address": "0x106430a8",
                "name": "RegCreateKeyExW"
              },
              {
                "address": "0x106430ac",
                "name": "RegOpenKeyExW"
              },
              {
                "address": "0x106430b0",
                "name": "RegFlushKey"
              },
              {
                "address": "0x106430b4",
                "name": "RegRestoreKeyW"
              },
              {
                "address": "0x106430b8",
                "name": "OpenSCManagerW"
              },
              {
                "address": "0x106430bc",
                "name": "OpenServiceW"
              },
              {
                "address": "0x106430c0",
                "name": "DeleteService"
              },
              {
                "address": "0x106430c4",
                "name": "CloseServiceHandle"
              },
              {
                "address": "0x106430c8",
                "name": "ChangeServiceConfigW"
              },
              {
                "address": "0x106430cc",
                "name": "RegQueryValueExW"
              },
              {
                "address": "0x106430d0",
                "name": "RegDeleteValueW"
              },
              {
                "address": "0x106430d4",
                "name": "GetSecurityInfo"
              },
              {
                "address": "0x106430d8",
                "name": "ConvertSecurityDescriptorToStringSecurityDescriptorW"
              },
              {
                "address": "0x106430dc",
                "name": "TraceEvent"
              },
              {
                "address": "0x106430e0",
                "name": "UnregisterTraceGuids"
              },
              {
                "address": "0x106430e4",
                "name": "RegEnumKeyExW"
              },
              {
                "address": "0x106430e8",
                "name": "RegUnLoadKeyW"
              },
              {
                "address": "0x106430ec",
                "name": "RegLoadKeyW"
              },
              {
                "address": "0x106430f0",
                "name": "OpenThreadToken"
              },
              {
                "address": "0x106430f4",
                "name": "OpenProcessToken"
              },
              {
                "address": "0x106430f8",
                "name": "LookupPrivilegeValueW"
              },
              {
                "address": "0x106430fc",
                "name": "AdjustTokenPrivileges"
              },
              {
                "address": "0x10643100",
                "name": "RegQueryInfoKeyW"
              },
              {
                "address": "0x10643104",
                "name": "ConvertStringSecurityDescriptorToSecurityDescriptorW"
              },
              {
                "address": "0x10643108",
                "name": "RegEnumKeyW"
              },
              {
                "address": "0x1064310c",
                "name": "EnumServicesStatusExW"
              },
              {
                "address": "0x10643110",
                "name": "QueryServiceStatusEx"
              },
              {
                "address": "0x10643114",
                "name": "StartServiceW"
              },
              {
                "address": "0x10643118",
                "name": "CreateServiceW"
              },
              {
                "address": "0x1064311c",
                "name": "StartTraceW"
              },
              {
                "address": "0x10643120",
                "name": "EnableTraceEx2"
              },
              {
                "address": "0x10643124",
                "name": "ControlTraceW"
              },
              {
                "address": "0x10643128",
                "name": "RemoveTraceCallback"
              },
              {
                "address": "0x1064312c",
                "name": "QueryAllTracesW"
              },
              {
                "address": "0x10643130",
                "name": "TraceSetInformation"
              },
              {
                "address": "0x10643134",
                "name": "EventUnregister"
              },
              {
                "address": "0x10643138",
                "name": "EventRegister"
              },
              {
                "address": "0x1064313c",
                "name": "EventWriteTransfer"
              },
              {
                "address": "0x10643140",
                "name": "EventActivityIdControl"
              },
              {
                "address": "0x10643144",
                "name": "QueryServiceStatus"
              },
              {
                "address": "0x10643148",
                "name": "ControlService"
              },
              {
                "address": "0x1064314c",
                "name": "QueryServiceConfigW"
              },
              {
                "address": "0x10643150",
                "name": "RegEnumValueW"
              },
              {
                "address": "0x10643154",
                "name": "StopTraceW"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x1064318c",
                "name": "HeapFree"
              },
              {
                "address": "0x10643190",
                "name": "GetModuleFileNameA"
              },
              {
                "address": "0x10643194",
                "name": "DebugBreak"
              },
              {
                "address": "0x10643198",
                "name": "IsDebuggerPresent"
              },
              {
                "address": "0x1064319c",
                "name": "OutputDebugStringW"
              },
              {
                "address": "0x106431a0",
                "name": "AcquireSRWLockExclusive"
              },
              {
                "address": "0x106431a4",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x106431a8",
                "name": "AcquireSRWLockShared"
              },
              {
                "address": "0x106431ac",
                "name": "ReleaseSRWLockShared"
              },
              {
                "address": "0x106431b0",
                "name": "SetEvent"
              },
              {
                "address": "0x106431b4",
                "name": "ResetEvent"
              },
              {
                "address": "0x106431b8",
                "name": "ReleaseSemaphore"
              },
              {
                "address": "0x106431bc",
                "name": "ReleaseMutex"
              },
              {
                "address": "0x106431c0",
                "name": "SetThreadpoolTimer"
              },
              {
                "address": "0x106431c4",
                "name": "WaitForThreadpoolTimerCallbacks"
              },
              {
                "address": "0x106431c8",
                "name": "CloseThreadpoolTimer"
              },
              {
                "address": "0x106431cc",
                "name": "WaitForSingleObjectEx"
              },
              {
                "address": "0x106431d0",
                "name": "InitializeCriticalSectionEx"
              },
              {
                "address": "0x106431d4",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x106431d8",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x106431dc",
                "name": "OpenSemaphoreW"
              },
              {
                "address": "0x106431e0",
                "name": "CreateThreadpoolTimer"
              },
              {
                "address": "0x106431e4",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x106431e8",
                "name": "CreateEventW"
              },
              {
                "address": "0x106431ec",
                "name": "GetSystemPowerStatus"
              },
              {
                "address": "0x106431f0",
                "name": "CompareStringW"
              },
              {
                "address": "0x106431f4",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x106431f8",
                "name": "FindFirstFileW"
              },
              {
                "address": "0x106431fc",
                "name": "FindClose"
              },
              {
                "address": "0x10643200",
                "name": "GetTickCount64"
              },
              {
                "address": "0x10643204",
                "name": "SetEnvironmentVariableW"
              },
              {
                "address": "0x10643208",
                "name": "CopyFileW"
              },
              {
                "address": "0x1064320c",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x10643210",
                "name": "GetWindowsDirectoryW"
              },
              {
                "address": "0x10643214",
                "name": "DeleteFileW"
              },
              {
                "address": "0x10643218",
                "name": "CreateFileW"
              },
              {
                "address": "0x1064321c",
                "name": "ReadFile"
              },
              {
                "address": "0x10643220",
                "name": "WaitForMultipleObjectsEx"
              },
              {
                "address": "0x10643224",
                "name": "CreateThread"
              },
              {
                "address": "0x10643228",
                "name": "CreateMutexExW"
              },
              {
                "address": "0x1064322c",
                "name": "CreateSemaphoreExW"
              },
              {
                "address": "0x10643230",
                "name": "SetFileAttributesW"
              },
              {
                "address": "0x10643234",
                "name": "RemoveDirectoryW"
              },
              {
                "address": "0x10643238",
                "name": "CreateDirectoryW"
              },
              {
                "address": "0x1064323c",
                "name": "CreateHardLinkW"
              },
              {
                "address": "0x10643240",
                "name": "GetSystemTime"
              },
              {
                "address": "0x10643244",
                "name": "SystemTimeToFileTime"
              },
              {
                "address": "0x10643248",
                "name": "CompareFileTime"
              },
              {
                "address": "0x1064324c",
                "name": "GetTempFileNameW"
              },
              {
                "address": "0x10643250",
                "name": "GlobalMemoryStatusEx"
              },
              {
                "address": "0x10643254",
                "name": "LocalFree"
              },
              {
                "address": "0x10643258",
                "name": "SetCurrentDirectoryW"
              },
              {
                "address": "0x1064325c",
                "name": "FileTimeToSystemTime"
              },
              {
                "address": "0x10643260",
                "name": "SystemTimeToTzSpecificLocalTime"
              },
              {
                "address": "0x10643264",
                "name": "DeviceIoControl"
              },
              {
                "address": "0x10643268",
                "name": "MoveFileExW"
              },
              {
                "address": "0x1064326c",
                "name": "ConnectNamedPipe"
              },
              {
                "address": "0x10643270",
                "name": "WaitForMultipleObjects"
              },
              {
                "address": "0x10643274",
                "name": "WriteFile"
              },
              {
                "address": "0x10643278",
                "name": "FlushFileBuffers"
              },
              {
                "address": "0x1064327c",
                "name": "FindNextFileW"
              },
              {
                "address": "0x10643280",
                "name": "CreateNamedPipeW"
              },
              {
                "address": "0x10643284",
                "name": "DisconnectNamedPipe"
              },
              {
                "address": "0x10643288",
                "name": "CopyFileExW"
              },
              {
                "address": "0x1064328c",
                "name": "GetFileSizeEx"
              },
              {
                "address": "0x10643290",
                "name": "CreateIoCompletionPort"
              },
              {
                "address": "0x10643294",
                "name": "GetOverlappedResult"
              },
              {
                "address": "0x10643298",
                "name": "FindFirstVolumeW"
              },
              {
                "address": "0x1064329c",
                "name": "FindNextVolumeW"
              },
              {
                "address": "0x106432a0",
                "name": "FindVolumeClose"
              },
              {
                "address": "0x106432a4",
                "name": "GetVolumeInformationByHandleW"
              },
              {
                "address": "0x106432a8",
                "name": "SetFilePointer"
              },
              {
                "address": "0x106432ac",
                "name": "InitializeCriticalSectionAndSpinCount"
              },
              {
                "address": "0x106432b0",
                "name": "GetFileTime"
              },
              {
                "address": "0x106432b4",
                "name": "GetVolumePathNameW"
              },
              {
                "address": "0x106432b8",
                "name": "GetDiskFreeSpaceW"
              },
              {
                "address": "0x106432bc",
                "name": "MultiByteToWideChar"
              },
              {
                "address": "0x106432c0",
                "name": "PostQueuedCompletionStatus"
              },
              {
                "address": "0x106432c4",
                "name": "GetQueuedCompletionStatus"
              },
              {
                "address": "0x106432c8",
                "name": "GetSystemInfo"
              },
              {
                "address": "0x106432cc",
                "name": "TrySubmitThreadpoolCallback"
              },
              {
                "address": "0x106432d0",
                "name": "QueryPerformanceFrequency"
              },
              {
                "address": "0x106432d4",
                "name": "HeapAlloc"
              },
              {
                "address": "0x106432d8",
                "name": "GetDriveTypeW"
              },
              {
                "address": "0x106432dc",
                "name": "GetTempPathW"
              },
              {
                "address": "0x106432e0",
                "name": "CreateMutexW"
              },
              {
                "address": "0x106432e4",
                "name": "GetCurrentThread"
              },
              {
                "address": "0x106432e8",
                "name": "WideCharToMultiByte"
              },
              {
                "address": "0x106432ec",
                "name": "SetFilePointerEx"
              },
              {
                "address": "0x106432f0",
                "name": "QueryDosDeviceW"
              },
              {
                "address": "0x106432f4",
                "name": "GetVolumeNameForVolumeMountPointW"
              },
              {
                "address": "0x106432f8",
                "name": "GetFileInformationByHandle"
              },
              {
                "address": "0x106432fc",
                "name": "GetFullPathNameW"
              },
              {
                "address": "0x10643300",
                "name": "LocalAlloc"
              },
              {
                "address": "0x10643304",
                "name": "GetFileSize"
              },
              {
                "address": "0x10643308",
                "name": "IsWow64Process"
              },
              {
                "address": "0x1064330c",
                "name": "WritePrivateProfileStringW"
              },
              {
                "address": "0x10643310",
                "name": "GetPrivateProfileStringW"
              },
              {
                "address": "0x10643314",
                "name": "GetPrivateProfileSectionW"
              },
              {
                "address": "0x10643318",
                "name": "CreateProcessW"
              },
              {
                "address": "0x1064331c",
                "name": "GetExitCodeProcess"
              },
              {
                "address": "0x10643320",
                "name": "SetEndOfFile"
              },
              {
                "address": "0x10643324",
                "name": "SetFileInformationByHandle"
              },
              {
                "address": "0x10643328",
                "name": "GetDiskFreeSpaceExW"
              },
              {
                "address": "0x1064332c",
                "name": "OpenProcess"
              },
              {
                "address": "0x10643330",
                "name": "GetVolumeInformationW"
              },
              {
                "address": "0x10643334",
                "name": "GetLocalTime"
              },
              {
                "address": "0x10643338",
                "name": "OpenEventW"
              },
              {
                "address": "0x1064333c",
                "name": "K32EnumProcesses"
              },
              {
                "address": "0x10643340",
                "name": "K32EnumProcessModules"
              },
              {
                "address": "0x10643344",
                "name": "K32GetModuleFileNameExW"
              },
              {
                "address": "0x10643348",
                "name": "lstrcmpiW"
              },
              {
                "address": "0x1064334c",
                "name": "GetVolumePathNamesForVolumeNameW"
              },
              {
                "address": "0x10643350",
                "name": "GetLogicalDrives"
              },
              {
                "address": "0x10643354",
                "name": "SetVolumeLabelW"
              },
              {
                "address": "0x10643358",
                "name": "ExpandEnvironmentStringsW"
              },
              {
                "address": "0x1064335c",
                "name": "GetSystemWindowsDirectoryW"
              },
              {
                "address": "0x10643360",
                "name": "GetSystemDirectoryW"
              },
              {
                "address": "0x10643364",
                "name": "RaiseException"
              },
              {
                "address": "0x10643368",
                "name": "SetThreadIdealProcessor"
              },
              {
                "address": "0x1064336c",
                "name": "HeapReAlloc"
              },
              {
                "address": "0x10643370",
                "name": "GetHandleInformation"
              },
              {
                "address": "0x10643374",
                "name": "MapViewOfFile"
              },
              {
                "address": "0x10643378",
                "name": "CreateFileMappingW"
              },
              {
                "address": "0x1064337c",
                "name": "UnmapViewOfFile"
              },
              {
                "address": "0x10643380",
                "name": "VerifyVersionInfoW"
              },
              {
                "address": "0x10643384",
                "name": "VirtualFree"
              },
              {
                "address": "0x10643388",
                "name": "VirtualAlloc"
              },
              {
                "address": "0x1064338c",
                "name": "SetErrorMode"
              },
              {
                "address": "0x10643390",
                "name": "GetErrorMode"
              },
              {
                "address": "0x10643394",
                "name": "OpenThread"
              },
              {
                "address": "0x10643398",
                "name": "LoadLibraryW"
              },
              {
                "address": "0x1064339c",
                "name": "SleepEx"
              },
              {
                "address": "0x106433a0",
                "name": "MoveFileW"
              },
              {
                "address": "0x106433a4",
                "name": "VerSetConditionMask"
              },
              {
                "address": "0x106433a8",
                "name": "GetCurrentDirectoryW"
              },
              {
                "address": "0x106433ac",
                "name": "GetFinalPathNameByHandleW"
              },
              {
                "address": "0x106433b0",
                "name": "GetLongPathNameW"
              },
              {
                "address": "0x106433b4",
                "name": "GetFileInformationByHandleEx"
              },
              {
                "address": "0x106433b8",
                "name": "CloseHandle"
              },
              {
                "address": "0x106433bc",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x106433c0",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x106433c4",
                "name": "TerminateProcess"
              },
              {
                "address": "0x106433c8",
                "name": "FormatMessageW"
              },
              {
                "address": "0x106433cc",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x106433d0",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x106433d4",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x106433d8",
                "name": "GetTickCount"
              },
              {
                "address": "0x106433dc",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x106433e0",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x106433e4",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x106433e8",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x106433ec",
                "name": "Sleep"
              },
              {
                "address": "0x106433f0",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x106433f4",
                "name": "GetModuleFileNameW"
              },
              {
                "address": "0x106433f8",
                "name": "SetLastError"
              },
              {
                "address": "0x106433fc",
                "name": "FreeLibrary"
              },
              {
                "address": "0x10643400",
                "name": "GetModuleHandleExW"
              },
              {
                "address": "0x10643404",
                "name": "GetLastError"
              },
              {
                "address": "0x10643408",
                "name": "GetProcAddress"
              },
              {
                "address": "0x1064340c",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x10643410",
                "name": "LockFileEx"
              },
              {
                "address": "0x10643414",
                "name": "UnlockFileEx"
              },
              {
                "address": "0x10643418",
                "name": "Wow64DisableWow64FsRedirection"
              },
              {
                "address": "0x1064341c",
                "name": "Wow64RevertWow64FsRedirection"
              },
              {
                "address": "0x10643420",
                "name": "TlsAlloc"
              },
              {
                "address": "0x10643424",
                "name": "TlsFree"
              },
              {
                "address": "0x10643428",
                "name": "GlobalFree"
              },
              {
                "address": "0x1064342c",
                "name": "TlsGetValue"
              },
              {
                "address": "0x10643430",
                "name": "TlsSetValue"
              },
              {
                "address": "0x10643434",
                "name": "DuplicateHandle"
              },
              {
                "address": "0x10643438",
                "name": "CreateSemaphoreW"
              },
              {
                "address": "0x1064343c",
                "name": "DosDateTimeToFileTime"
              },
              {
                "address": "0x10643440",
                "name": "OutputDebugStringA"
              },
              {
                "address": "0x10643444",
                "name": "LCMapStringW"
              },
              {
                "address": "0x10643448",
                "name": "GetVersionExW"
              },
              {
                "address": "0x1064344c",
                "name": "GetEnvironmentVariableW"
              },
              {
                "address": "0x10643450",
                "name": "ExitProcess"
              },
              {
                "address": "0x10643454",
                "name": "WTSGetActiveConsoleSessionId"
              },
              {
                "address": "0x10643458",
                "name": "FindResourceExW"
              },
              {
                "address": "0x1064345c",
                "name": "SearchPathW"
              },
              {
                "address": "0x10643460",
                "name": "LocalFileTimeToFileTime"
              },
              {
                "address": "0x10643464",
                "name": "SetFileTime"
              },
              {
                "address": "0x10643468",
                "name": "FindFirstFileExW"
              },
              {
                "address": "0x1064346c",
                "name": "GetCompressedFileSizeW"
              },
              {
                "address": "0x10643470",
                "name": "GetThreadLocale"
              },
              {
                "address": "0x10643474",
                "name": "CompareStringOrdinal"
              },
              {
                "address": "0x10643478",
                "name": "FileTimeToLocalFileTime"
              },
              {
                "address": "0x1064347c",
                "name": "MapViewOfFileEx"
              },
              {
                "address": "0x10643480",
                "name": "DefineDosDeviceW"
              },
              {
                "address": "0x10643484",
                "name": "TerminateThread"
              },
              {
                "address": "0x10643488",
                "name": "FindResourceW"
              },
              {
                "address": "0x1064348c",
                "name": "LoadResource"
              },
              {
                "address": "0x10643490",
                "name": "LockResource"
              },
              {
                "address": "0x10643494",
                "name": "SizeofResource"
              },
              {
                "address": "0x10643498",
                "name": "GetUserDefaultUILanguage"
              },
              {
                "address": "0x1064349c",
                "name": "GetLocaleInfoW"
              },
              {
                "address": "0x106434a0",
                "name": "GetVersionExA"
              },
              {
                "address": "0x106434a4",
                "name": "GetSystemDefaultUILanguage"
              },
              {
                "address": "0x106434a8",
                "name": "MulDiv"
              },
              {
                "address": "0x106434ac",
                "name": "GetExitCodeThread"
              },
              {
                "address": "0x106434b0",
                "name": "GetLocaleInfoEx"
              },
              {
                "address": "0x106434b4",
                "name": "SleepConditionVariableSRW"
              },
              {
                "address": "0x106434b8",
                "name": "WakeAllConditionVariable"
              },
              {
                "address": "0x106434bc",
                "name": "VirtualQuery"
              },
              {
                "address": "0x106434c0",
                "name": "LoadLibraryExA"
              },
              {
                "address": "0x106434c4",
                "name": "VirtualProtect"
              }
            ]
          },
          "OLE32": {
            "dll": "OLE32.dll",
            "imports": [
              {
                "address": "0x106434d8",
                "name": "CoGetMalloc"
              },
              {
                "address": "0x106434dc",
                "name": "CLSIDFromString"
              },
              {
                "address": "0x106434e0",
                "name": "CoSetProxyBlanket"
              },
              {
                "address": "0x106434e4",
                "name": "CoCreateInstance"
              },
              {
                "address": "0x106434e8",
                "name": "CoInitializeEx"
              },
              {
                "address": "0x106434ec",
                "name": "CoUninitialize"
              },
              {
                "address": "0x106434f0",
                "name": "CreateStreamOnHGlobal"
              },
              {
                "address": "0x106434f4",
                "name": "StringFromGUID2"
              },
              {
                "address": "0x106434f8",
                "name": "CoCreateGuid"
              },
              {
                "address": "0x106434fc",
                "name": "CoTaskMemAlloc"
              },
              {
                "address": "0x10643500",
                "name": "CoTaskMemFree"
              },
              {
                "address": "0x10643504",
                "name": "CoInitializeSecurity"
              }
            ]
          },
          "VERSION": {
            "dll": "VERSION.dll",
            "imports": [
              {
                "address": "0x10643580",
                "name": "GetFileVersionInfoW"
              },
              {
                "address": "0x10643584",
                "name": "VerQueryValueW"
              },
              {
                "address": "0x10643588",
                "name": "GetFileVersionInfoExW"
              },
              {
                "address": "0x1064358c",
                "name": "GetFileVersionInfoSizeExW"
              },
              {
                "address": "0x10643590",
                "name": "GetFileVersionInfoSizeW"
              }
            ]
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x1064350c",
                "name": "SafeArrayGetUBound"
              },
              {
                "address": "0x10643510",
                "name": "SafeArrayGetElement"
              },
              {
                "address": "0x10643514",
                "name": "SafeArrayDestroy"
              },
              {
                "address": "0x10643518",
                "name": "SafeArrayGetElemsize"
              },
              {
                "address": "0x1064351c",
                "name": "SysFreeString"
              },
              {
                "address": "0x10643520",
                "name": "VarI8FromDec"
              },
              {
                "address": "0x10643524",
                "name": "VariantTimeToSystemTime"
              },
              {
                "address": "0x10643528",
                "name": "VarBstrFromDate"
              },
              {
                "address": "0x1064352c",
                "name": "SysStringLen"
              },
              {
                "address": "0x10643530",
                "name": "VariantInit"
              },
              {
                "address": "0x10643534",
                "name": "VariantClear"
              },
              {
                "address": "0x10643538",
                "name": "SysAllocString"
              }
            ]
          },
          "RPCRT4": {
            "dll": "RPCRT4.dll",
            "imports": [
              {
                "address": "0x10643540",
                "name": "NdrClientCall2"
              },
              {
                "address": "0x10643544",
                "name": "RpcExceptionFilter"
              },
              {
                "address": "0x10643548",
                "name": "RpcBindingFree"
              },
              {
                "address": "0x1064354c",
                "name": "RpcStringBindingComposeW"
              },
              {
                "address": "0x10643550",
                "name": "RpcBindingFromStringBindingW"
              },
              {
                "address": "0x10643554",
                "name": "RpcStringFreeW"
              },
              {
                "address": "0x10643558",
                "name": "UuidToStringW"
              },
              {
                "address": "0x1064355c",
                "name": "UuidFromStringW"
              },
              {
                "address": "0x10643560",
                "name": "I_RpcMapWin32Status"
              },
              {
                "address": "0x10643564",
                "name": "UuidCreate"
              },
              {
                "address": "0x10643568",
                "name": "RpcBindingSetAuthInfoW"
              }
            ]
          },
          "CRYPT32": {
            "dll": "CRYPT32.dll",
            "imports": [
              {
                "address": "0x1064315c",
                "name": "CertVerifyCertificateChainPolicy"
              }
            ]
          },
          "WINTRUST": {
            "dll": "WINTRUST.dll",
            "imports": [
              {
                "address": "0x10643624",
                "name": "WTHelperProvDataFromStateData"
              },
              {
                "address": "0x10643628",
                "name": "WinVerifyTrust"
              },
              {
                "address": "0x1064362c",
                "name": "CryptCATCDFClose"
              },
              {
                "address": "0x10643630",
                "name": "CryptCATCDFOpen"
              },
              {
                "address": "0x10643634",
                "name": "WTHelperGetProvSignerFromChain"
              }
            ]
          },
          "MPR": {
            "dll": "MPR.dll",
            "imports": [
              {
                "address": "0x106434cc",
                "name": "WNetAddConnection2W"
              },
              {
                "address": "0x106434d0",
                "name": "WNetCancelConnection2W"
              }
            ]
          },
          "SspiCli": {
            "dll": "SspiCli.dll",
            "imports": [
              {
                "address": "0x10643578",
                "name": "GetUserNameExW"
              }
            ]
          },
          "bcrypt": {
            "dll": "bcrypt.dll",
            "imports": [
              {
                "address": "0x10643658",
                "name": "BCryptGetProperty"
              },
              {
                "address": "0x1064365c",
                "name": "BCryptFinishHash"
              },
              {
                "address": "0x10643660",
                "name": "BCryptCloseAlgorithmProvider"
              },
              {
                "address": "0x10643664",
                "name": "BCryptOpenAlgorithmProvider"
              },
              {
                "address": "0x10643668",
                "name": "BCryptHashData"
              },
              {
                "address": "0x1064366c",
                "name": "BCryptDestroyHash"
              },
              {
                "address": "0x10643670",
                "name": "BCryptCreateHash"
              }
            ]
          },
          "unbcl": {
            "dll": "unbcl.dll",
            "imports": [
              {
                "address": "0x10643ab4",
                "name": "?Append@StringBuilder@UnBCL@@QAEPAV12@PBG@Z"
              },
              {
                "address": "0x10643ab8",
                "name": "??1StringBuilder@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643abc",
                "name": "??0StringBuilder@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643ac0",
                "name": "?GetSystemInfo@Environment@UnBCL@@SGPBVSystemInfo@2@H@Z"
              },
              {
                "address": "0x10643ac4",
                "name": "??0MemoryStream@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643ac8",
                "name": "?EndsWith@String@UnBCL@@QBEHPBGH@Z"
              },
              {
                "address": "0x10643acc",
                "name": "??C?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$Array@PAVString@UnBCL@@@1@XZ"
              },
              {
                "address": "0x10643ad0",
                "name": "??1?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643ad4",
                "name": "?GetFiles@Directory@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBVString@2@0H@Z"
              },
              {
                "address": "0x10643ad8",
                "name": "??0?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@PAV?$Array@PAVString@UnBCL@@@1@@Z"
              },
              {
                "address": "0x10643adc",
                "name": "?GetFileNameWithoutExtension@Path@UnBCL@@SGPAVString@2@PBV32@@Z"
              },
              {
                "address": "0x10643ae0",
                "name": "?Compare@String@UnBCL@@SGHPBV12@PBGH@Z"
              },
              {
                "address": "0x10643ae4",
                "name": "?GetFileNameExtension@Path@UnBCL@@SGPAVString@2@PBV32@@Z"
              },
              {
                "address": "0x10643ae8",
                "name": "?Split@String@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@2@PBG@Z"
              },
              {
                "address": "0x10643aec",
                "name": "?get_Length@String@UnBCL@@QBEHXZ"
              },
              {
                "address": "0x10643af0",
                "name": "?Insert@String@UnBCL@@QBEPAV12@HPBG@Z"
              },
              {
                "address": "0x10643af4",
                "name": "?Steal@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEPAV?$ArrayList@PAVString@UnBCL@@@2@XZ"
              },
              {
                "address": "0x10643af8",
                "name": "?get_Build@Version@UnBCL@@QBEHXZ"
              },
              {
                "address": "0x10643afc",
                "name": "??C?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@1@XZ"
              },
              {
                "address": "0x10643b00",
                "name": "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643b04",
                "name": "??0?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@PAV?$ArrayList@PAVString@UnBCL@@@1@@Z"
              },
              {
                "address": "0x10643b08",
                "name": "??4?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z"
              },
              {
                "address": "0x10643b0c",
                "name": "??1?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643b10",
                "name": "??0?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643b14",
                "name": "?ToLower@String@UnBCL@@QBEPAV12@XZ"
              },
              {
                "address": "0x10643b18",
                "name": "?GetFileName@Path@UnBCL@@SGPAVString@2@PBV32@@Z"
              },
              {
                "address": "0x10643b1c",
                "name": "?Compare@String@UnBCL@@SGHPBG0H@Z"
              },
              {
                "address": "0x10643b20",
                "name": "?get_Minor@Version@UnBCL@@QBEHXZ"
              },
              {
                "address": "0x10643b24",
                "name": "?get_OSVersion@OperatingSystem@UnBCL@@QBEPBVVersion@2@XZ"
              },
              {
                "address": "0x10643b28",
                "name": "?get_Major@Version@UnBCL@@QBEHXZ"
              },
              {
                "address": "0x10643b2c",
                "name": "?GetOSVersion@Environment@UnBCL@@SGPBVOperatingSystem@2@H@Z"
              },
              {
                "address": "0x10643b30",
                "name": "?ExpandEnvironmentVariables@Environment@UnBCL@@SGPAVString@2@PBV32@@Z"
              },
              {
                "address": "0x10643b34",
                "name": "?get_Context@SerializationStream@UnBCL@@QBEPAVObject@2@XZ"
              },
              {
                "address": "0x10643b38",
                "name": "??6SerializationStream@UnBCL@@QAEAAV01@V?$SmartPtr@UISerializable@UnBCL@@@1@@Z"
              },
              {
                "address": "0x10643b3c",
                "name": "?Delete@File@UnBCL@@SGXPBVString@2@@Z"
              },
              {
                "address": "0x10643b40",
                "name": "?Exists@File@UnBCL@@SGHPBVString@2@@Z"
              },
              {
                "address": "0x10643b44",
                "name": "?Delete@Directory@UnBCL@@SGXPBVString@2@H@Z"
              },
              {
                "address": "0x10643b48",
                "name": "??0FileStream@UnBCL@@QAE@PBVString@1@W4FileMode@1@W4FileAccess@1@W4FileShare@1@K@Z"
              },
              {
                "address": "0x10643b4c",
                "name": "?GetParentPath@Path@UnBCL@@SGPAVString@2@PBV32@@Z"
              },
              {
                "address": "0x10643b50",
                "name": "?ToString@DateTime@UnBCL@@UBEPAVString@2@XZ"
              },
              {
                "address": "0x10643b54",
                "name": "?GetNow@DateTime@UnBCL@@SG?AV12@H@Z"
              },
              {
                "address": "0x10643b58",
                "name": "?Remove@String@UnBCL@@QBEPAV12@HH@Z"
              },
              {
                "address": "0x10643b5c",
                "name": "??1Win32Exception@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643b60",
                "name": "?Format@String@UnBCL@@SAPAV12@PBGZZ"
              },
              {
                "address": "0x10643b64",
                "name": "?DeleteNE@Directory@UnBCL@@SGHPBVString@2@H@Z"
              },
              {
                "address": "0x10643b68",
                "name": "?FormatV@String@UnBCL@@SGPAV12@PBGPAD@Z"
              },
              {
                "address": "0x10643b6c",
                "name": "?Concat@String@UnBCL@@SGPAV12@PBG00@Z"
              },
              {
                "address": "0x10643b70",
                "name": "??0Win32Exception@UnBCL@@QAE@KPBG@Z"
              },
              {
                "address": "0x10643b74",
                "name": "?WithoutLongPrefix@Path@UnBCL@@SGPAVString@2@PBV32@@Z"
              },
              {
                "address": "0x10643b78",
                "name": "?GetFullPath@Path@UnBCL@@SGPAVString@2@PBV32@@Z"
              },
              {
                "address": "0x10643b7c",
                "name": "?GetEnvironmentVar@Environment@UnBCL@@SGPAVString@2@PBV32@@Z"
              },
              {
                "address": "0x10643b80",
                "name": "?StartsWith@String@UnBCL@@QBEHPBGH@Z"
              },
              {
                "address": "0x10643b84",
                "name": "??B?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ"
              },
              {
                "address": "0x10643b88",
                "name": "?Steal@?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEPAVString@2@XZ"
              },
              {
                "address": "0x10643b8c",
                "name": "?IsEnvironmentVarSetTrue@Environment@UnBCL@@SGHPBVString@2@H@Z"
              },
              {
                "address": "0x10643b90",
                "name": "??0Exception@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643b94",
                "name": "?get_P@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@2@XZ"
              },
              {
                "address": "0x10643b98",
                "name": "??0String@UnBCL@@QAE@PBV01@@Z"
              },
              {
                "address": "0x10643b9c",
                "name": "??0ISerializable@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643ba0",
                "name": "??_DMemoryStream@UnBCL@@QAEXXZ"
              },
              {
                "address": "0x10643ba4",
                "name": "??0?$IEnumerable@PAVString@UnBCL@@@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643ba8",
                "name": "??0?$ICollection@PAVString@UnBCL@@@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643bac",
                "name": "??1InvalidCastException@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643bb0",
                "name": "??4Object@UnBCL@@QAEAAV01@ABV01@@Z"
              },
              {
                "address": "0x10643bb4",
                "name": "??0?$IEnumerator@PAVString@UnBCL@@@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643bb8",
                "name": "??1?$IEnumerator@PAVString@UnBCL@@@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643bbc",
                "name": "??0IInstanceFactory@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643bc0",
                "name": "??0?$IEnumerable@H@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643bc4",
                "name": "??0?$ICollection@H@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643bc8",
                "name": "?UnregisterType@SerializationStream@UnBCL@@SGXPBVString@2@HPAUHINSTANCE__@@@Z"
              },
              {
                "address": "0x10643bcc",
                "name": "??1?$ICollection@H@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643bd0",
                "name": "?ReadBytes@SerializationStream@UnBCL@@QAEXPAEH@Z"
              },
              {
                "address": "0x10643bd4",
                "name": "?WriteBytes@SerializationStream@UnBCL@@QAEXPBEH@Z"
              },
              {
                "address": "0x10643bd8",
                "name": "??0Exception@UnBCL@@QAE@PBG@Z"
              },
              {
                "address": "0x10643bdc",
                "name": "??0Object@UnBCL@@QAE@ABV01@@Z"
              },
              {
                "address": "0x10643be0",
                "name": "??0InvalidCastException@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643be4",
                "name": "??1?$ICollection@PAVString@UnBCL@@@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643be8",
                "name": "?AddRef@Object@UnBCL@@QAEXXZ"
              },
              {
                "address": "0x10643bec",
                "name": "?EnqueueSbRegistration@SbRegistrationList@UnBCL@@SGXPBDHPAUHINSTANCE__@@PAUIInstanceFactory@2@@Z"
              },
              {
                "address": "0x10643bf0",
                "name": "?RegisterType@SerializationStream@UnBCL@@SGXPBVString@2@HPAUHINSTANCE__@@PAUIInstanceFactory@2@@Z"
              },
              {
                "address": "0x10643bf4",
                "name": "?CanRegister@SerializationStream@UnBCL@@SGHXZ"
              },
              {
                "address": "0x10643bf8",
                "name": "?GetCallingModule@SerializationStream@UnBCL@@SGPAUHINSTANCE__@@XZ"
              },
              {
                "address": "0x10643bfc",
                "name": "?SetLiteralStorage@_@UnBCL@@YGXPAPBVString@2@PBG@Z"
              },
              {
                "address": "0x10643c00",
                "name": "??0InvalidOperationException@UnBCL@@QAE@PBVString@1@@Z"
              },
              {
                "address": "0x10643c04",
                "name": "??1NotSupportedException@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643c08",
                "name": "??0NotSupportedException@UnBCL@@QAE@PBG@Z"
              },
              {
                "address": "0x10643c0c",
                "name": "?DecRef@Object@UnBCL@@QAEHXZ"
              },
              {
                "address": "0x10643c10",
                "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAPAVString@1@@Z"
              },
              {
                "address": "0x10643c14",
                "name": "??0InvalidOperationException@UnBCL@@QAE@PBG@Z"
              },
              {
                "address": "0x10643c18",
                "name": "??1InvalidOperationException@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643c1c",
                "name": "??0InvalidOperationException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z"
              },
              {
                "address": "0x10643c20",
                "name": "??0String@UnBCL@@QAE@ABV01@@Z"
              },
              {
                "address": "0x10643c24",
                "name": "??2Object@UnBCL@@SGPAXII@Z"
              },
              {
                "address": "0x10643c28",
                "name": "?get_CString@StringBuilder@UnBCL@@QBEPBGXZ"
              },
              {
                "address": "0x10643c2c",
                "name": "?SanitizeTypeName@SerializationStream@UnBCL@@SGPAVString@2@ABV32@@Z"
              },
              {
                "address": "0x10643c30",
                "name": "?FromASCII@String@UnBCL@@SGPAV12@PBD@Z"
              },
              {
                "address": "0x10643c34",
                "name": "??1ArgumentException@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643c38",
                "name": "??0ArgumentException@UnBCL@@QAE@PBG@Z"
              },
              {
                "address": "0x10643c3c",
                "name": "??1ArgumentNullException@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643c40",
                "name": "??0ArgumentNullException@UnBCL@@QAE@PBG@Z"
              },
              {
                "address": "0x10643c44",
                "name": "??1ArgumentOutOfRangeException@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643c48",
                "name": "?Equals@Object@UnBCL@@UBEHPBV12@@Z"
              },
              {
                "address": "0x10643c4c",
                "name": "?Clone@Object@UnBCL@@UBEPAV12@XZ"
              },
              {
                "address": "0x10643c50",
                "name": "?get_InnerException@Exception@UnBCL@@UBEPBV12@XZ"
              },
              {
                "address": "0x10643c54",
                "name": "?get_Message@Exception@UnBCL@@UBEPBVString@2@XZ"
              },
              {
                "address": "0x10643c58",
                "name": "?get_Source@Exception@UnBCL@@UBEPBVString@2@XZ"
              },
              {
                "address": "0x10643c5c",
                "name": "?set_Source@Exception@UnBCL@@UAEXPBVString@2@@Z"
              },
              {
                "address": "0x10643c60",
                "name": "?GetBaseException@Exception@UnBCL@@UBEPBV12@XZ"
              },
              {
                "address": "0x10643c64",
                "name": "?set_HResult@Exception@UnBCL@@MAEXJ@Z"
              },
              {
                "address": "0x10643c68",
                "name": "?SetMessage@Exception@UnBCL@@MAEXPAVString@2@@Z"
              },
              {
                "address": "0x10643c6c",
                "name": "??0ArgumentOutOfRangeException@UnBCL@@QAE@PBG@Z"
              },
              {
                "address": "0x10643c70",
                "name": "?AddStackTrace@Exception@UnBCL@@QAEXPBD@Z"
              },
              {
                "address": "0x10643c74",
                "name": "?MemAllocFailed@Allocator@UnBCL@@SGHXZ"
              },
              {
                "address": "0x10643c78",
                "name": "?CreateDir@Directory@UnBCL@@SGPAVDirectoryInfo@2@PBVString@2@@Z"
              },
              {
                "address": "0x10643c7c",
                "name": "?Exists@Directory@UnBCL@@SGHPBVString@2@@Z"
              },
              {
                "address": "0x10643c80",
                "name": "?GetPathRoot@Path@UnBCL@@SGPAVString@2@PBV32@@Z"
              },
              {
                "address": "0x10643c84",
                "name": "?get_Ticks@DateTime@UnBCL@@QBE_JXZ"
              },
              {
                "address": "0x10643c88",
                "name": "?get_Win32ErrorCode@Win32Exception@UnBCL@@QBEKXZ"
              },
              {
                "address": "0x10643c8c",
                "name": "?get_P@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$Array@PAVString@UnBCL@@@2@XZ"
              },
              {
                "address": "0x10643c90",
                "name": "?Equals@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHPBVObject@2@@Z"
              },
              {
                "address": "0x10643c94",
                "name": "?Clone@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEPAVObject@2@XZ"
              },
              {
                "address": "0x10643c98",
                "name": "??_D?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAEXXZ"
              },
              {
                "address": "0x10643c9c",
                "name": "??_DFileStream@UnBCL@@QAEXXZ"
              },
              {
                "address": "0x10643ca0",
                "name": "??1DateTime@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643ca4",
                "name": "?CompareTo@String@UnBCL@@QBEHPBGH@Z"
              },
              {
                "address": "0x10643ca8",
                "name": "?IndexOf@String@UnBCL@@QBEHG@Z"
              },
              {
                "address": "0x10643cac",
                "name": "?Substring@String@UnBCL@@QBEPAV12@HH@Z"
              },
              {
                "address": "0x10643cb0",
                "name": "?TrimEnd@String@UnBCL@@QBEPAV12@PBG@Z"
              },
              {
                "address": "0x10643cb4",
                "name": "??0StringPtr@UnBCL@@QAE@PAVString@1@@Z"
              },
              {
                "address": "0x10643cb8",
                "name": "?Replace@String@UnBCL@@QBEPAV12@PAV12@0H@Z"
              },
              {
                "address": "0x10643cbc",
                "name": "?GetDirectories@Directory@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBVString@2@0H@Z"
              },
              {
                "address": "0x10643cc0",
                "name": "??_DStringPtr@UnBCL@@QAEXXZ"
              },
              {
                "address": "0x10643cc4",
                "name": "??0OutOfMemoryException@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643cc8",
                "name": "?Free@Allocator@UnBCL@@SGXPAXI@Z"
              },
              {
                "address": "0x10643ccc",
                "name": "?set_AutoDelete@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXH@Z"
              },
              {
                "address": "0x10643cd0",
                "name": "?get_Count@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHXZ"
              },
              {
                "address": "0x10643cd4",
                "name": "?Add@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEHPAVString@2@@Z"
              },
              {
                "address": "0x10643cd8",
                "name": "?get_Item@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEAAPAVString@2@H@Z"
              },
              {
                "address": "0x10643cdc",
                "name": "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAE@HH@Z"
              },
              {
                "address": "0x10643ce0",
                "name": "??0StreamWriter@UnBCL@@QAE@PAVStream@1@PAVEncoding@1@HHH@Z"
              },
              {
                "address": "0x10643ce4",
                "name": "?GetUnicode@Encoding@UnBCL@@SGPAV12@XZ"
              },
              {
                "address": "0x10643ce8",
                "name": "??0FileStream@UnBCL@@QAE@PAXW4FileAccess@1@@Z"
              },
              {
                "address": "0x10643cec",
                "name": "?SetEnvironmentVar@Environment@UnBCL@@SGXPBVString@2@0@Z"
              },
              {
                "address": "0x10643cf0",
                "name": "?Concat@String@UnBCL@@SGPAV12@PBG0@Z"
              },
              {
                "address": "0x10643cf4",
                "name": "??0?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAE@PAVEncoding@1@@Z"
              },
              {
                "address": "0x10643cf8",
                "name": "??1?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643cfc",
                "name": "??0StreamReader@UnBCL@@QAE@PBVString@1@PAVEncoding@1@@Z"
              },
              {
                "address": "0x10643d00",
                "name": "?get_P@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBEPAVEncoding@2@XZ"
              },
              {
                "address": "0x10643d04",
                "name": "?get_Chars@String@UnBCL@@QBEABGH@Z"
              },
              {
                "address": "0x10643d08",
                "name": "??6SerializationStream@UnBCL@@QAEAAV01@G@Z"
              },
              {
                "address": "0x10643d0c",
                "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAG@Z"
              },
              {
                "address": "0x10643d10",
                "name": "??1?$ICollection@G@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643d14",
                "name": "??0?$ICollection@G@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643d18",
                "name": "??0?$IEnumerable@G@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643d1c",
                "name": "??_DStreamReader@UnBCL@@QAEXXZ"
              },
              {
                "address": "0x10643d20",
                "name": "??_DStreamWriter@UnBCL@@QAEXXZ"
              },
              {
                "address": "0x10643d24",
                "name": "??1OutOfMemoryException@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643d28",
                "name": "?CreateTemporaryDirectory@Directory@UnBCL@@SGPAVString@2@XZ"
              },
              {
                "address": "0x10643d2c",
                "name": "??0?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643d30",
                "name": "??4?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z"
              },
              {
                "address": "0x10643d34",
                "name": "?GetDirectoriesAndFiles@Directory@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBVString@2@0W4EnumerationType@12@H@Z"
              },
              {
                "address": "0x10643d38",
                "name": "?GetLoadedModuleDir@Directory@UnBCL@@SGPAVString@2@PBV32@@Z"
              },
              {
                "address": "0x10643d3c",
                "name": "?IsDirectoryEmpty@Directory@UnBCL@@SGHPBVString@2@@Z"
              },
              {
                "address": "0x10643d40",
                "name": "?Copy@Directory@UnBCL@@SGXPBVString@2@0HPAUICopyDelegate@12@@Z"
              },
              {
                "address": "0x10643d44",
                "name": "?FromMultiSz@MultiSz@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBG@Z"
              },
              {
                "address": "0x10643d48",
                "name": "?LastIndexOf@String@UnBCL@@QBEHG@Z"
              },
              {
                "address": "0x10643d4c",
                "name": "??0MutableString@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643d50",
                "name": "?Append@MutableString@UnBCL@@QAEXPBG@Z"
              },
              {
                "address": "0x10643d54",
                "name": "?Append@MutableString@UnBCL@@QAEXG@Z"
              },
              {
                "address": "0x10643d58",
                "name": "?Substring@String@UnBCL@@QBEPAV12@H@Z"
              },
              {
                "address": "0x10643d5c",
                "name": "??0MultiSz@UnBCL@@QAE@PBG@Z"
              },
              {
                "address": "0x10643d60",
                "name": "?ToString@MultiSz@UnBCL@@UBEPAVString@2@XZ"
              },
              {
                "address": "0x10643d64",
                "name": "?FromString@MultiSz@UnBCL@@SGPAV12@PBGG@Z"
              },
              {
                "address": "0x10643d68",
                "name": "?ToByteArray@MultiSz@UnBCL@@QBEPAV?$Array@E@2@XZ"
              },
              {
                "address": "0x10643d6c",
                "name": "?get_Buffer@MultiSz@UnBCL@@QBEPBGXZ"
              },
              {
                "address": "0x10643d70",
                "name": "??0MultiSz@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643d74",
                "name": "?Add@MultiSz@UnBCL@@QAEXPBG@Z"
              },
              {
                "address": "0x10643d78",
                "name": "?Clone@MultiSz@UnBCL@@UBEPAVObject@2@XZ"
              },
              {
                "address": "0x10643d7c",
                "name": "??_DMultiSz@UnBCL@@QAEXXZ"
              },
              {
                "address": "0x10643d80",
                "name": "?GetASCII@Encoding@UnBCL@@SGPAV12@XZ"
              },
              {
                "address": "0x10643d84",
                "name": "??0Version@UnBCL@@QAE@HH@Z"
              },
              {
                "address": "0x10643d88",
                "name": "??0String@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643d8c",
                "name": "?Copy@File@UnBCL@@SGPAVString@2@PBV32@0H@Z"
              },
              {
                "address": "0x10643d90",
                "name": "?IndexOf@String@UnBCL@@QBEHPBG@Z"
              },
              {
                "address": "0x10643d94",
                "name": "?Subtract@DateTime@UnBCL@@QBE?AVTimeSpan@2@ABV12@@Z"
              },
              {
                "address": "0x10643d98",
                "name": "?get_TotalMilliseconds@TimeSpan@UnBCL@@QBENXZ"
              },
              {
                "address": "0x10643d9c",
                "name": "??1TimeSpan@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643da0",
                "name": "??_DVersion@UnBCL@@QAEXXZ"
              },
              {
                "address": "0x10643da4",
                "name": "?GetCurrentDir@Directory@UnBCL@@SGPAVString@2@XZ"
              },
              {
                "address": "0x10643da8",
                "name": "?LastIndexOf@String@UnBCL@@QBEHPBG@Z"
              },
              {
                "address": "0x10643dac",
                "name": "?Compare@String@UnBCL@@SGHPBGPBV12@H@Z"
              },
              {
                "address": "0x10643db0",
                "name": "?WithLongPrefix@Path@UnBCL@@SGPAVString@2@PBV32@H@Z"
              },
              {
                "address": "0x10643db4",
                "name": "??0?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAE@PAVVersion@1@@Z"
              },
              {
                "address": "0x10643db8",
                "name": "??0Version@UnBCL@@QAE@PBG@Z"
              },
              {
                "address": "0x10643dbc",
                "name": "??1?$SmartPtr@VVersion@UnBCL@@@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643dc0",
                "name": "??C?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBEPAVVersion@1@XZ"
              },
              {
                "address": "0x10643dc4",
                "name": "?CompareTo@Version@UnBCL@@UBEHPBVObject@2@@Z"
              },
              {
                "address": "0x10643dc8",
                "name": "?Clone@Version@UnBCL@@UBEPAVObject@2@XZ"
              },
              {
                "address": "0x10643dcc",
                "name": "?GetHashCode@Version@UnBCL@@UBEHXZ"
              },
              {
                "address": "0x10643dd0",
                "name": "?ToString@Version@UnBCL@@UBEPAVString@2@XZ"
              },
              {
                "address": "0x10643dd4",
                "name": "?Equals@Version@UnBCL@@UBEHPBVObject@2@@Z"
              },
              {
                "address": "0x10643dd8",
                "name": "?IsDriveLetterPrefix@Path@UnBCL@@SGHPBVString@2@@Z"
              },
              {
                "address": "0x10643ddc",
                "name": "?IsDriveLetterOrUncPrefix@Path@UnBCL@@SGHPBVString@2@@Z"
              },
              {
                "address": "0x10643de0",
                "name": "?Read@FileStream@UnBCL@@UAEHPAEHH@Z"
              },
              {
                "address": "0x10643de4",
                "name": "?IsPathRooted@Path@UnBCL@@SGHPBVString@2@@Z"
              },
              {
                "address": "0x10643de8",
                "name": "??0Win32Exception@UnBCL@@QAE@K@Z"
              },
              {
                "address": "0x10643dec",
                "name": "?Replace@String@UnBCL@@QBEPAV12@PBG0W4StringCasing@12@@Z"
              },
              {
                "address": "0x10643df0",
                "name": "?Concat@String@UnBCL@@SGPAV12@PBG000@Z"
              },
              {
                "address": "0x10643df4",
                "name": "?Sanitize@Path@UnBCL@@SGPAVString@2@PBV32@@Z"
              },
              {
                "address": "0x10643df8",
                "name": "??0XmlDocument@XmlLite@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643dfc",
                "name": "?LoadXml@XmlDocument@XmlLite@UnBCL@@QAEXPAVString@3@@Z"
              },
              {
                "address": "0x10643e00",
                "name": "?SelectNodes@XmlNode@XmlLite@UnBCL@@QAEPAVXmlNodeList@23@PAVString@3@@Z"
              },
              {
                "address": "0x10643e04",
                "name": "?get_Count@XmlNodeList@XmlLite@UnBCL@@QBEHXZ"
              },
              {
                "address": "0x10643e08",
                "name": "?get_Item@XmlNodeList@XmlLite@UnBCL@@QAEPAVXmlNode@23@H@Z"
              },
              {
                "address": "0x10643e0c",
                "name": "??1XmlDocument@XmlLite@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643e10",
                "name": "?ToUpper@String@UnBCL@@QBEPAV12@XZ"
              },
              {
                "address": "0x10643e14",
                "name": "?CompareTo@String@UnBCL@@QBEHPBG@Z"
              },
              {
                "address": "0x10643e18",
                "name": "?get_InnerText@XmlNode@XmlLite@UnBCL@@QBEPAVString@3@XZ"
              },
              {
                "address": "0x10643e1c",
                "name": "??1ApplicationException@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643e20",
                "name": "??0ApplicationException@UnBCL@@QAE@PBG@Z"
              },
              {
                "address": "0x10643e24",
                "name": "??0ApplicationException@UnBCL@@QAE@PAVException@1@PBG@Z"
              },
              {
                "address": "0x10643e28",
                "name": "??0?$ArrayList@G@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643e2c",
                "name": "??0Win32Exception@UnBCL@@QAE@KPBGPAVException@1@@Z"
              },
              {
                "address": "0x10643e30",
                "name": "?Clone@?$ArrayList@G@UnBCL@@UBEPAVObject@2@XZ"
              },
              {
                "address": "0x10643e34",
                "name": "?Equals@?$ArrayList@G@UnBCL@@UBEHPBVObject@2@@Z"
              },
              {
                "address": "0x10643e38",
                "name": "??_D?$ArrayList@G@UnBCL@@QAEXXZ"
              },
              {
                "address": "0x10643e3c",
                "name": "?GetBuffer@?$Array@E@UnBCL@@UAEPAEH@Z"
              },
              {
                "address": "0x10643e40",
                "name": "?set_Item@?$Array@E@UnBCL@@UAEXHE@Z"
              },
              {
                "address": "0x10643e44",
                "name": "?GetLogicalDriveNames@Environment@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@XZ"
              },
              {
                "address": "0x10643e48",
                "name": "?ToMultisz@MultiSz@UnBCL@@SGPAGABU?$ICollection@PAVString@UnBCL@@@2@@Z"
              },
              {
                "address": "0x10643e4c",
                "name": "??D?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEAAV?$ArrayList@PAVString@UnBCL@@@1@XZ"
              },
              {
                "address": "0x10643e50",
                "name": "?SelectNodes@XmlNode@UnBCL@@QAEPAVXmlNodeList@2@PAVString@2@@Z"
              },
              {
                "address": "0x10643e54",
                "name": "?get_Count@XmlNodeList@UnBCL@@QAEHXZ"
              },
              {
                "address": "0x10643e58",
                "name": "?get_Item@XmlNodeList@UnBCL@@QAEPAVXmlNode@2@H@Z"
              },
              {
                "address": "0x10643e5c",
                "name": "?get_FirstChild@XmlNode@UnBCL@@QAEPAV12@XZ"
              },
              {
                "address": "0x10643e60",
                "name": "?get_NodeType@XmlNode@UnBCL@@QAE?AW4XmlNodeType@2@XZ"
              },
              {
                "address": "0x10643e64",
                "name": "?get_Value@XmlNode@UnBCL@@QAEPAVString@2@XZ"
              },
              {
                "address": "0x10643e68",
                "name": "??0RegistryKey@UnBCL@@QAE@PAUHKEY__@@H@Z"
              },
              {
                "address": "0x10643e6c",
                "name": "?OpenSubKey@RegistryKey@UnBCL@@QAEPAV12@PBVString@2@H@Z"
              },
              {
                "address": "0x10643e70",
                "name": "?GetValueNames@RegistryKey@UnBCL@@QAEPAV?$Array@PAVString@UnBCL@@@2@XZ"
              },
              {
                "address": "0x10643e74",
                "name": "?GetValueKind@RegistryKey@UnBCL@@QAE?AW4RegistryValueKind@2@PBVString@2@@Z"
              },
              {
                "address": "0x10643e78",
                "name": "?GetBinaryValue@RegistryKey@UnBCL@@QAEPAV?$Array@E@2@PBVString@2@@Z"
              },
              {
                "address": "0x10643e7c",
                "name": "?GetLocalMachine@Registry@UnBCL@@SGPAVRegistryKey@2@XZ"
              },
              {
                "address": "0x10643e80",
                "name": "?get_IsEmpty@String@UnBCL@@QBEHXZ"
              },
              {
                "address": "0x10643e84",
                "name": "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAE@PBU?$ICollection@PAVString@UnBCL@@@1@@Z"
              },
              {
                "address": "0x10643e88",
                "name": "??0String@UnBCL@@QAE@PBGHH@Z"
              },
              {
                "address": "0x10643e8c",
                "name": "??1FormatException@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643e90",
                "name": "??0FormatException@UnBCL@@QAE@PBG@Z"
              },
              {
                "address": "0x10643e94",
                "name": "??0Win32Exception@UnBCL@@QAE@PBG@Z"
              },
              {
                "address": "0x10643e98",
                "name": "?ToString@StringBuilder@UnBCL@@UBEPAVString@2@XZ"
              },
              {
                "address": "0x10643e9c",
                "name": "?Append@StringBuilder@UnBCL@@QAEPAV12@G@Z"
              },
              {
                "address": "0x10643ea0",
                "name": "?Append@StringBuilder@UnBCL@@QAEPAV12@PBVString@2@@Z"
              },
              {
                "address": "0x10643ea4",
                "name": "??0StringBuilder@UnBCL@@QAE@H@Z"
              },
              {
                "address": "0x10643ea8",
                "name": "?Copy@String@UnBCL@@SGPAV12@PBV12@@Z"
              },
              {
                "address": "0x10643eac",
                "name": "?RegisterNamespaces@XmlDocument@UnBCL@@QAEXPAVString@2@@Z"
              },
              {
                "address": "0x10643eb0",
                "name": "??1XmlSchemaSet@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643eb4",
                "name": "?LoadXml@XmlDocument@UnBCL@@QAEXPAVString@2@@Z"
              },
              {
                "address": "0x10643eb8",
                "name": "?set_Schemas@XmlDocument@UnBCL@@QAEXPAVXmlSchemaSet@2@@Z"
              },
              {
                "address": "0x10643ebc",
                "name": "?set_ValidateOnParse@XmlDocument@UnBCL@@QAEXH@Z"
              },
              {
                "address": "0x10643ec0",
                "name": "?Add@XmlSchemaSet@UnBCL@@QAEXPAVString@2@PAVXmlDocument@2@@Z"
              },
              {
                "address": "0x10643ec4",
                "name": "??0XmlSchemaSet@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643ec8",
                "name": "?Right@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@H@Z"
              },
              {
                "address": "0x10643ecc",
                "name": "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@ABV01@@Z"
              },
              {
                "address": "0x10643ed0",
                "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBG@Z"
              },
              {
                "address": "0x10643ed4",
                "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@ABV01@@Z"
              },
              {
                "address": "0x10643ed8",
                "name": "??A?$CSimpleStringT@G$0A@@ATL@@QBEGH@Z"
              },
              {
                "address": "0x10643edc",
                "name": "?Trim@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ"
              },
              {
                "address": "0x10643ee0",
                "name": "?Trim@String@UnBCL@@QBEPAV12@XZ"
              },
              {
                "address": "0x10643ee4",
                "name": "??0Version@UnBCL@@QAE@HHH@Z"
              },
              {
                "address": "0x10643ee8",
                "name": "?TrimStart@String@UnBCL@@QBEPAV12@PBG@Z"
              },
              {
                "address": "0x10643eec",
                "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAE@Z"
              },
              {
                "address": "0x10643ef0",
                "name": "??6SerializationStream@UnBCL@@QAEAAV01@E@Z"
              },
              {
                "address": "0x10643ef4",
                "name": "??B?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ"
              },
              {
                "address": "0x10643ef8",
                "name": "??0TimeSpan@UnBCL@@QAE@_J@Z"
              },
              {
                "address": "0x10643efc",
                "name": "?Close@FileStream@UnBCL@@UAEXXZ"
              },
              {
                "address": "0x10643f00",
                "name": "??_D?$Array@PAVString@UnBCL@@@UnBCL@@QAEXXZ"
              },
              {
                "address": "0x10643f04",
                "name": "?Equals@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHPBVObject@2@@Z"
              },
              {
                "address": "0x10643f08",
                "name": "?Clone@?$Array@PAVString@UnBCL@@@UnBCL@@UBEPAVObject@2@XZ"
              },
              {
                "address": "0x10643f0c",
                "name": "??0?$Array@PAVString@UnBCL@@@UnBCL@@QAE@HH@Z"
              },
              {
                "address": "0x10643f10",
                "name": "??C?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBEPAVEncoding@1@XZ"
              },
              {
                "address": "0x10643f14",
                "name": "?GetBuffer@?$Array@G@UnBCL@@UAEPAGH@Z"
              },
              {
                "address": "0x10643f18",
                "name": "??_D?$Array@G@UnBCL@@QAEXXZ"
              },
              {
                "address": "0x10643f1c",
                "name": "??0?$Array@G@UnBCL@@QAE@HH@Z"
              },
              {
                "address": "0x10643f20",
                "name": "?Nullify@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV12@XZ"
              },
              {
                "address": "0x10643f24",
                "name": "?Nullify@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV12@XZ"
              },
              {
                "address": "0x10643f28",
                "name": "??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@ABV01@@Z"
              },
              {
                "address": "0x10643f2c",
                "name": "?Combine@Path@UnBCL@@SGPAVString@2@PBV32@0@Z"
              },
              {
                "address": "0x10643f30",
                "name": "?get_HResult@Exception@UnBCL@@UBEJXZ"
              },
              {
                "address": "0x10643f34",
                "name": "??1SerializationStream@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643f38",
                "name": "??0SerializationStream@UnBCL@@QAE@PAVStream@1@W4Mode@01@PAVObject@1@@Z"
              },
              {
                "address": "0x10643f3c",
                "name": "??0MemoryStream@UnBCL@@QAE@PAV?$Array@E@1@HH@Z"
              },
              {
                "address": "0x10643f40",
                "name": "??C?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBEPAV?$Array@E@1@XZ"
              },
              {
                "address": "0x10643f44",
                "name": "??_D?$Array@E@UnBCL@@QAEXXZ"
              },
              {
                "address": "0x10643f48",
                "name": "?Equals@?$Array@E@UnBCL@@UBEHPBVObject@2@@Z"
              },
              {
                "address": "0x10643f4c",
                "name": "?GetHashCode@Object@UnBCL@@UBEHXZ"
              },
              {
                "address": "0x10643f50",
                "name": "?ToString@Object@UnBCL@@UBEPAVString@2@XZ"
              },
              {
                "address": "0x10643f54",
                "name": "?CompareTo@Object@UnBCL@@UBEHPBV12@@Z"
              },
              {
                "address": "0x10643f58",
                "name": "?Clone@?$Array@E@UnBCL@@UBEPAVObject@2@XZ"
              },
              {
                "address": "0x10643f5c",
                "name": "??0?$Array@E@UnBCL@@QAE@HH@Z"
              },
              {
                "address": "0x10643f60",
                "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAPAUISerializable@1@@Z"
              },
              {
                "address": "0x10643f64",
                "name": "?ToString@Exception@UnBCL@@UBEPAVString@2@XZ"
              },
              {
                "address": "0x10643f68",
                "name": "??1Exception@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643f6c",
                "name": "??5SerializationStream@UnBCL@@QAEAAV01@AA_K@Z"
              },
              {
                "address": "0x10643f70",
                "name": "??5SerializationStream@UnBCL@@QAEAAV01@AA_J@Z"
              },
              {
                "address": "0x10643f74",
                "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAJ@Z"
              },
              {
                "address": "0x10643f78",
                "name": "??6SerializationStream@UnBCL@@QAEAAV01@_K@Z"
              },
              {
                "address": "0x10643f7c",
                "name": "??6SerializationStream@UnBCL@@QAEAAV01@_J@Z"
              },
              {
                "address": "0x10643f80",
                "name": "??6SerializationStream@UnBCL@@QAEAAV01@J@Z"
              },
              {
                "address": "0x10643f84",
                "name": "?Compare@String@UnBCL@@SGHPBV12@0H@Z"
              },
              {
                "address": "0x10643f88",
                "name": "?GetArchitectureString@OperatingSystem@UnBCL@@SGPBGK@Z"
              },
              {
                "address": "0x10643f8c",
                "name": "??1MutableString@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643f90",
                "name": "?Steal@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEPAV?$Array@PAVString@UnBCL@@@2@XZ"
              },
              {
                "address": "0x10643f94",
                "name": "??0?$IEnumerable@E@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10643f98",
                "name": "?get_P@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBEPAV?$Array@E@2@XZ"
              },
              {
                "address": "0x10643f9c",
                "name": "??6SerializationStream@UnBCL@@QAEAAV01@PBUISerializable@1@@Z"
              },
              {
                "address": "0x10643fa0",
                "name": "??0?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAE@PAV?$Array@E@1@@Z"
              },
              {
                "address": "0x10643fa4",
                "name": "??4?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z"
              },
              {
                "address": "0x10643fa8",
                "name": "??1?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10643fac",
                "name": "?SetValue@RegistryKey@UnBCL@@QAEXPBVString@2@H@Z"
              },
              {
                "address": "0x10643fb0",
                "name": "?Sort@?$Array@PAVString@UnBCL@@@UnBCL@@SGXPAV12@@Z"
              },
              {
                "address": "0x10643fb4",
                "name": "?GetStringValue@RegistryKey@UnBCL@@QAEPAVString@2@PBV32@H@Z"
              },
              {
                "address": "0x10643fb8",
                "name": "?IndexOf@String@UnBCL@@QBEHPBGH@Z"
              },
              {
                "address": "0x10643fbc",
                "name": "?get_TotalSeconds@TimeSpan@UnBCL@@QBENXZ"
              },
              {
                "address": "0x10643fc0",
                "name": "?get_InnerText@XmlNode@UnBCL@@QAEPAVString@2@XZ"
              },
              {
                "address": "0x10643fc4",
                "name": "?get_OuterXml@XmlNode@UnBCL@@QAEPAVString@2@XZ"
              },
              {
                "address": "0x10643fc8",
                "name": "??7?$SmartPtr@VString@UnBCL@@@UnBCL@@QBE_NXZ"
              },
              {
                "address": "0x10643fcc",
                "name": "?Assign@?$SmartPtr@VString@UnBCL@@@UnBCL@@AAEXPAVString@2@@Z"
              },
              {
                "address": "0x10643fd0",
                "name": "?get_Item@XmlAttributeCollection@UnBCL@@QAEPAVXmlAttribute@2@PAVString@2@@Z"
              },
              {
                "address": "0x10643fd4",
                "name": "?GetStackTrace@Exception@UnBCL@@QBEPAVString@2@XZ"
              },
              {
                "address": "0x10643fd8",
                "name": "?SelectSingleNode@XmlNode@UnBCL@@QAEPAV12@PAVString@2@@Z"
              },
              {
                "address": "0x10643fdc",
                "name": "?get_Attributes@XmlNode@UnBCL@@QAEPAVXmlAttributeCollection@2@XZ"
              },
              {
                "address": "0x10643fe0",
                "name": "?Clone@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAVObject@2@XZ"
              },
              {
                "address": "0x10643fe4",
                "name": "??0?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@HH@Z"
              },
              {
                "address": "0x10643fe8",
                "name": "??_D?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAEXXZ"
              },
              {
                "address": "0x10643fec",
                "name": "?MakeTrim@MutableString@UnBCL@@QAEXPBG@Z"
              },
              {
                "address": "0x10643ff0",
                "name": "??0MutableString@UnBCL@@QAE@PBG@Z"
              },
              {
                "address": "0x10643ff4",
                "name": "?get_ChildNodes@XmlNode@UnBCL@@QAEPAVXmlNodeList@2@XZ"
              },
              {
                "address": "0x10643ff8",
                "name": "?get_Name@XmlNode@UnBCL@@QAEPAVString@2@XZ"
              },
              {
                "address": "0x10643ffc",
                "name": "?get_Count@XmlAttributeCollection@UnBCL@@QAEHXZ"
              },
              {
                "address": "0x10644000",
                "name": "??4MutableString@UnBCL@@QAEAAV01@PBG@Z"
              },
              {
                "address": "0x10644004",
                "name": "?Nullify@?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEAAV12@XZ"
              },
              {
                "address": "0x10644008",
                "name": "?SetCompressionState@File@UnBCL@@SGHPBVString@2@G@Z"
              },
              {
                "address": "0x1064400c",
                "name": "??0?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10644010",
                "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAI@Z"
              },
              {
                "address": "0x10644014",
                "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAK@Z"
              },
              {
                "address": "0x10644018",
                "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAH@Z"
              },
              {
                "address": "0x1064401c",
                "name": "??6SerializationStream@UnBCL@@QAEAAV01@I@Z"
              },
              {
                "address": "0x10644020",
                "name": "??6SerializationStream@UnBCL@@QAEAAV01@K@Z"
              },
              {
                "address": "0x10644024",
                "name": "??6SerializationStream@UnBCL@@QAEAAV01@PBVString@1@@Z"
              },
              {
                "address": "0x10644028",
                "name": "??6SerializationStream@UnBCL@@QAEAAV01@H@Z"
              },
              {
                "address": "0x1064402c",
                "name": "?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEPAVString@2@XZ"
              },
              {
                "address": "0x10644030",
                "name": "?Equals@String@UnBCL@@UBEHPBVObject@2@@Z"
              },
              {
                "address": "0x10644034",
                "name": "?GetHashCode@String@UnBCL@@UBEHXZ"
              },
              {
                "address": "0x10644038",
                "name": "?GetType@Object@UnBCL@@UBEPAVType@2@XZ"
              },
              {
                "address": "0x1064403c",
                "name": "?ToString@String@UnBCL@@UBEPAV12@XZ"
              },
              {
                "address": "0x10644040",
                "name": "?GetObjectID@Object@UnBCL@@UBEIXZ"
              },
              {
                "address": "0x10644044",
                "name": "?CompareTo@String@UnBCL@@UBEHPBVObject@2@@Z"
              },
              {
                "address": "0x10644048",
                "name": "?Clone@String@UnBCL@@UBEPAVObject@2@XZ"
              },
              {
                "address": "0x1064404c",
                "name": "??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10644050",
                "name": "??1String@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10644054",
                "name": "??0String@UnBCL@@QAE@PBG@Z"
              },
              {
                "address": "0x10644058",
                "name": "??2Object@UnBCL@@SGPAXI@Z"
              },
              {
                "address": "0x1064405c",
                "name": "??1ISerializable@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10644060",
                "name": "??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z"
              },
              {
                "address": "0x10644064",
                "name": "??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEPAVString@1@XZ"
              },
              {
                "address": "0x10644068",
                "name": "?get_CString@String@UnBCL@@QBEPBGXZ"
              },
              {
                "address": "0x1064406c",
                "name": "??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10644070",
                "name": "??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@PAVString@1@@Z"
              },
              {
                "address": "0x10644074",
                "name": "??3Object@UnBCL@@SGXPAX@Z"
              },
              {
                "address": "0x10644078",
                "name": "??0?$ICollection@E@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x1064407c",
                "name": "??1Object@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10644080",
                "name": "??0Object@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10644084",
                "name": "??0?$IList@E@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x10644088",
                "name": "??0?$Array@E@UnBCL@@QAE@PBU?$ICollection@E@1@@Z"
              },
              {
                "address": "0x1064408c",
                "name": "??1?$IList@E@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10644090",
                "name": "??1?$ICollection@E@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x10644094",
                "name": "?GetWindowsDir@Directory@UnBCL@@SGPAVString@2@XZ"
              },
              {
                "address": "0x10644098",
                "name": "?IndexOf@String@UnBCL@@QBEHGH@Z"
              },
              {
                "address": "0x1064409c",
                "name": "??1XmlDocument@UnBCL@@UAE@XZ"
              },
              {
                "address": "0x106440a0",
                "name": "?Load@XmlDocument@UnBCL@@QAEXPAVString@2@@Z"
              },
              {
                "address": "0x106440a4",
                "name": "??0XmlDocument@UnBCL@@QAE@XZ"
              },
              {
                "address": "0x106440a8",
                "name": "??0StreamReader@UnBCL@@QAE@PAVStream@1@PAVEncoding@1@@Z"
              },
              {
                "address": "0x106440ac",
                "name": "?Trim@String@UnBCL@@QBEPAV12@PBG@Z"
              },
              {
                "address": "0x106440b0",
                "name": "?GetDirectoryRoot@Directory@UnBCL@@SGPAVString@2@PBV32@@Z"
              },
              {
                "address": "0x106440b4",
                "name": "?Flush@FileStream@UnBCL@@UAEXXZ"
              },
              {
                "address": "0x106440b8",
                "name": "?CompareTo@DateTime@UnBCL@@UBEHPBVObject@2@@Z"
              },
              {
                "address": "0x106440bc",
                "name": "?GetHashCode@DateTime@UnBCL@@UBEHXZ"
              },
              {
                "address": "0x106440c0",
                "name": "?Equals@DateTime@UnBCL@@UBEHPBVObject@2@@Z"
              },
              {
                "address": "0x106440c4",
                "name": "?Format@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXPBGZZ"
              },
              {
                "address": "0x106440c8",
                "name": "??0DateTime@UnBCL@@QAE@HHHHHHH@Z"
              },
              {
                "address": "0x106440cc",
                "name": "?EndsWith@String@UnBCL@@QBEHG@Z"
              },
              {
                "address": "0x106440d0",
                "name": "??_DRegistryKey@UnBCL@@QAEXXZ"
              },
              {
                "address": "0x106440d4",
                "name": "??1?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@XZ"
              },
              {
                "address": "0x106440d8",
                "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@XZ"
              },
              {
                "address": "0x106440dc",
                "name": "??D?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEAAVString@1@XZ"
              },
              {
                "address": "0x106440e0",
                "name": "?get_Days@TimeSpan@UnBCL@@QBEHXZ"
              }
            ]
          },
          "WDSCORE": {
            "dll": "WDSCORE.dll",
            "imports": [
              {
                "address": "0x106435b4",
                "name": "WdsDestroyBlackboard"
              },
              {
                "address": "0x106435b8",
                "name": "WdsGetBlackboardValue"
              },
              {
                "address": "0x106435bc",
                "name": "WdsFreeData"
              },
              {
                "address": "0x106435c0",
                "name": "WdsCreateBlackboard"
              },
              {
                "address": "0x106435c4",
                "name": "WdsSetupLogMessageW"
              },
              {
                "address": "0x106435c8",
                "name": "ConstructPartialMsgVA"
              },
              {
                "address": "0x106435cc",
                "name": "WdsSetupLogMessageA"
              },
              {
                "address": "0x106435d0",
                "name": "WdsTerminate"
              },
              {
                "address": "0x106435d4",
                "name": "WdsInitialize"
              },
              {
                "address": "0x106435d8",
                "name": "ConstructPartialMsgVW"
              },
              {
                "address": "0x106435dc",
                "name": "CurrentIP"
              }
            ]
          },
          "imagehlp": {
            "dll": "imagehlp.dll",
            "imports": [
              {
                "address": "0x10643678",
                "name": "CheckSumMappedFile"
              }
            ]
          },
          "FLTLIB": {
            "dll": "FLTLIB.DLL",
            "imports": [
              {
                "address": "0x10643174",
                "name": "FilterFindClose"
              },
              {
                "address": "0x10643178",
                "name": "FilterLoad"
              },
              {
                "address": "0x1064317c",
                "name": "FilterVolumeInstanceFindNext"
              },
              {
                "address": "0x10643180",
                "name": "FilterVolumeInstanceFindFirst"
              },
              {
                "address": "0x10643184",
                "name": "FilterAttach"
              }
            ]
          },
          "Cabinet": {
            "dll": "Cabinet.dll",
            "imports": []
          },
          "VirtDisk": {
            "dll": "VirtDisk.dll",
            "imports": [
              {
                "address": "0x10643598",
                "name": "GetVirtualDiskPhysicalPath"
              },
              {
                "address": "0x1064359c",
                "name": "DetachVirtualDisk"
              },
              {
                "address": "0x106435a0",
                "name": "GetStorageDependencyInformation"
              },
              {
                "address": "0x106435a4",
                "name": "AttachVirtualDisk"
              },
              {
                "address": "0x106435a8",
                "name": "OpenVirtualDisk"
              },
              {
                "address": "0x106435ac",
                "name": "CreateVirtualDisk"
              }
            ]
          },
          "profapi": {
            "dll": "profapi.dll",
            "imports": []
          },
          "XmlLite": {
            "dll": "XmlLite.dll",
            "imports": [
              {
                "address": "0x1064364c",
                "name": "CreateXmlWriter"
              },
              {
                "address": "0x10643650",
                "name": "CreateXmlReader"
              }
            ]
          },
          "SHLWAPI": {
            "dll": "SHLWAPI.dll",
            "imports": [
              {
                "address": "0x10643570",
                "name": "PathRemoveBackslashW"
              }
            ]
          },
          "WTSAPI32": {
            "dll": "WTSAPI32.dll",
            "imports": [
              {
                "address": "0x1064363c",
                "name": "WTSQueryUserToken"
              },
              {
                "address": "0x10643640",
                "name": "WTSFreeMemory"
              },
              {
                "address": "0x10643644",
                "name": "WTSEnumerateSessionsW"
              }
            ]
          },
          "WINHTTP": {
            "dll": "WINHTTP.dll",
            "imports": [
              {
                "address": "0x106435e4",
                "name": "WinHttpQueryDataAvailable"
              },
              {
                "address": "0x106435e8",
                "name": "WinHttpConnect"
              },
              {
                "address": "0x106435ec",
                "name": "WinHttpSetCredentials"
              },
              {
                "address": "0x106435f0",
                "name": "WinHttpSendRequest"
              },
              {
                "address": "0x106435f4",
                "name": "WinHttpGetProxyForUrl"
              },
              {
                "address": "0x106435f8",
                "name": "WinHttpQueryAuthSchemes"
              },
              {
                "address": "0x106435fc",
                "name": "WinHttpGetIEProxyConfigForCurrentUser"
              },
              {
                "address": "0x10643600",
                "name": "WinHttpCloseHandle"
              },
              {
                "address": "0x10643604",
                "name": "WinHttpSetOption"
              },
              {
                "address": "0x10643608",
                "name": "WinHttpOpenRequest"
              },
              {
                "address": "0x1064360c",
                "name": "WinHttpReadData"
              },
              {
                "address": "0x10643610",
                "name": "WinHttpQueryHeaders"
              },
              {
                "address": "0x10643614",
                "name": "WinHttpGetDefaultProxyConfiguration"
              },
              {
                "address": "0x10643618",
                "name": "WinHttpReceiveResponse"
              },
              {
                "address": "0x1064361c",
                "name": "WinHttpOpen"
              }
            ]
          }
        },
        "exported_dll_name": "SetupPlatform.dll",
        "exports": [
          {
            "address": "0x101aee50",
            "name": "CreateSetupPlatform",
            "ordinal": 1
          },
          {
            "address": "0x101af350",
            "name": "CreateSetupPlatformOnline",
            "ordinal": 2
          },
          {
            "address": "0x101af310",
            "name": "GetSetupPlatformVersion",
            "ordinal": 3
          },
          {
            "address": "0x101aeee0",
            "name": "ResurrectSetupPlatform",
            "ordinal": 4
          },
          {
            "address": "0x101fe700",
            "name": "_CreateDeploymentProject",
            "ordinal": 5
          },
          {
            "address": "0x101afa50",
            "name": "_CreateSetupPlatformPrivate",
            "ordinal": 6
          },
          {
            "address": "0x101af3b0",
            "name": "_ExecuteRollback",
            "ordinal": 7
          },
          {
            "address": "0x101afe70",
            "name": "_FinalizeUninstall",
            "ordinal": 8
          },
          {
            "address": "0x101fe780",
            "name": "_GetMetaDeploymentVersion",
            "ordinal": 9
          },
          {
            "address": "0x101afac0",
            "name": "_GetUninstallInterface",
            "ordinal": 10
          },
          {
            "address": "0x101afe80",
            "name": "_RemoveSnapshot",
            "ordinal": 11
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x005ee120",
            "size": "0x0000019f"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x006440ec",
            "size": "0x000001f4"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x0064f000",
            "size": "0x00000410"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x006dc800",
            "size": "0x00002148"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x00650000",
            "size": "0x000945c0"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x0019e030",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x0001f408",
            "size": "0x00000018"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x00001010",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x00643000",
            "size": "0x000010e8"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x005ec560",
            "size": "0x00000260"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x005ed2bf",
            "size_of_data": "0x005ed400",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.52"
          },
          {
            "name": ".data",
            "raw_address": "0x005ed800",
            "virtual_address": "0x005ef000",
            "virtual_size": "0x000534b8",
            "size_of_data": "0x0004fa00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "5.28"
          },
          {
            "name": ".idata",
            "raw_address": "0x0063d200",
            "virtual_address": "0x00643000",
            "virtual_size": "0x0000a434",
            "size_of_data": "0x0000a600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.86"
          },
          {
            "name": ".didat",
            "raw_address": "0x00647800",
            "virtual_address": "0x0064e000",
            "virtual_size": "0x000003c0",
            "size_of_data": "0x00000400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "4.56"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x00647c00",
            "virtual_address": "0x0064f000",
            "virtual_size": "0x00000410",
            "size_of_data": "0x00000600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "2.51"
          },
          {
            "name": ".reloc",
            "raw_address": "0x00648200",
            "virtual_address": "0x00650000",
            "virtual_size": "0x000945c0",
            "size_of_data": "0x00094600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.76"
          }
        ],
        "overlay": {
          "offset": "0x006dc800",
          "size": "0x00002148"
        },
        "resources": [
          {
            "name": "RT_VERSION",
            "offset": "0x0064f060",
            "size": "0x000003ac",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.53"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Setup Platform Core"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "setupplatform.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "SETUPPLATFORM.DLL"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "9415a6d64aa0edf582b1a748e07c9d40",
        "timestamp": "2045-10-10 03:37:57",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 24
      },
      "data": null,
      "strings": [
        "3 343D3O3g3u3",
        "ERROR_WAKE_SYSTEM",
        "0=0C0K0X0`0",
        "class UnBCL::ArrayList<struct SetupPlatform::IDisk *> *__stdcall pGetAllDisks(struct IDiskPlatform *)",
        "=2>b>",
        "VdsPartition::CreateLogicalPartition: Failed to query IID_IVdsCreatePartitionEx interface [%s] (0x%08x)",
        ".?AV?$Array@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$ArrayList@PAVCDriverDetails@@@2@@UnBCL@@@UnBCL@@",
        "5C5g5",
        "Opening private provisioning package: %s",
        "Failed to create create general objects. Status = [%x]",
        "%s\\*.inf",
        "SPAPI_E_INVALID_HWPROFILE",
        "CReconstructOS::TearDownCbsLogging: Failed to delete HKLM\\System\\Setup WorkingDirectory: 0x%08x",
        "NEO installation path is turned off by environment variable.",
        "winSxS",
        "SystemTimeToFileTime",
        "2\"2Q2g2}2",
        "FOLDERID_Links",
        "ar-MA",
        "http://www.w3.org/XML/1998/namespace",
        "0#0*00050@0N0f0~0",
        "QRPh`",
        "ml-IN",
        "768b8m8",
        "%hs: Promoted the existing store file to the system BCD Store",
        "; ;&;,;",
        "pCreateSystemRootDriveMapping: Expected to find a \\ in SystemRoot value [%s]",
        ".?AVWmiCollection@WMI@@",
        "1!1)1`1h1u1}1",
        "ERROR_SETCOUNT_ON_BAD_LB",
        "7&7R7\\7k7",
        "{D8581231-83AF-4DEB-BF95-E2A9C2444100}",
        "__thiscall UnBCL::ArrayList<class ISPPluginData *>::ArrayList(const struct UnBCL::ICollection<class ISPPluginData *> *)",
        "    Failed to allocate _spCurrentDirectory.get()",
        "ActionPlatform::CallEntryPoint",
        "D$$Pje",
        "SL_E_VGA_NON_GENUINE_STATUS_FIRST",
        "X*/DataUpgrade/Data Upgrade/*",
        "enum MIGSTATUS __stdcall SPGetOSInformation(class UnBCL::String *,class UnBCL::String *,class UnBCL::String **,class UnBCL::ArrayList<class COSPieceInfo *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *> *,class UnBCL::ArrayList<class CProfileInfo *> *)",
        "VdsVolumePathEnumerator::Initialize: Failed to query IID_IVdsVolumeMF interface [%s] (0x%08x)",
        "9/969<9A9L9W9k9",
        "SendAbortMessage",
        "787@7H7P7`7",
        "ProgramData",
        "797a7~7",
        "<+<C<e<w<",
        "SclpCanonicalizePaths",
        "SP_ENV_SIMULATE_LOW_DISK_SPACE",
        "Policy: Suspend protection on any volume we require access to",
        "D$4QPQQ",
        "az-Cyrl-AZ",
        "ERROR_INCORRECT_SIZE",
        "VPh0D",
        "2,3X3",
        ".?AVCTestHookDUUpdate@@",
        "SPCreateSnapshotWithScoping: Failed to query created snapshot ID. Error: 0x%08X",
        "?$?)?4???L?",
        "2&2,212<2F2Y2|2",
        ".?AV?$CAutoCleanupBase@PAUIDiskPlatform@@@RAII@@",
        "ERROR_REMOTE_PRINT_CONNECTIONS_BLOCKED",
        "Previous partition extended successfully",
        "ERROR_TRANSACTED_MAPPING_UNSUPPORTED_REMOTE",
        "636O6i6w6",
        "0 0(00080@0H0L0P0X0`0d0h0p0t0x0|0",
        "ReclaimRecoveryImagePartition failed. Error: 0x%08X",
        "0)0T0",
        "Failed to write the %s marker. Error: 0x%08X",
        "1!1D1a1v1{1",
        "= =4=<=D=L=T=`=",
        "VirtualProtect",
        "??0ArgumentException@UnBCL@@QAE@PBG@Z",
        ">(>0>8>D>d>l>t>",
        "WmiAssociation::MoveNext: Can't get second property name (0x%08x)",
        "Failed to read the migration scope from %s. hr = 0x%08X",
        "class ISPPluginData *__thiscall UnBCL::_::ArrayListEnumerator<class ISPPluginData *>::get_Current(void) const",
        "int __thiscall UnBCL::ArrayList<enum OP_OPERATION_ID>::IndexOf(enum OP_OPERATION_ID,int,int) const",
        "%hs: Running in Windows PE, request is not supported",
        "ActionPlatform::LaunchModule: Loaded DLL %s but could not find entry point '%s' in it; dwRet = 0x%x",
        "ERROR_FLOPPY_WRONG_CYLINDER",
        "f98u;f9x",
        "3%303>3S3c3p3}3",
        "8B8N8Y8g8",
        "7.7C7R7\\7a7i7p7|7",
        ">1>?>",
        ";,;6;I;Q;W;d;v;",
        "6\"6.6B6V6l6r6w6",
        "VdsPartition::CreateLogicalPartition: Can't create logical partition (0x%08x)",
        ">+>8>H>M>Y>p>w>",
        "    Failed to find first directory",
        "dd1aa213-54e7-4173-8456-b278964a26b6",
        "CommitTransaction",
        "uP9\\$",
        "EventActivityIdControl",
        ".PAVCXXXXXHandledException@?2??DoExecute@CFinalizeCriticalBoundary@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "class UnBCL::String *__thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,class ATL::CElementTraits<struct HKEY__ *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "<!<6<c<|<",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,class ATL::CElementTraits<struct UnBCL::ISerializable *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "1#1(1E1Q1X1f1p1u1",
        "{C0F1816A-E2E9-4A73-9FFF-66B0F4C7A43A}",
        "9#929_9g9n9~9",
        "?,?8?\\?d?l?t?|?",
        "CInstallDUUpdatesOffline::DoExecute: Failed to get info set for image %s. hr = 0x%x",
        "FileCount",
        "Failure while restoring the known folder path for %s",
        "CDeploymentBase::OptInToSqm",
        "6$61686=6J6Y6`6n6y6",
        "?CompareTo@String@UnBCL@@QBEHPBG@Z",
        "7%7.7:7]7e7z7",
        "void __thiscall UnBCL::ArrayList<class CDeploymentBase *>::QuickSort(class UnBCL::ArrayList<class CDeploymentBase *> *,class UnBCL::ArrayList<class CDeploymentBase *> *,int,int)",
        "< <(<P<d<l<t<",
        "MIG_PLUGIN_CALL_TIMEOUT_INTERVALS",
        ": :$:@:D:H:L:P:T:X:\\:`:d:h:",
        "Failed to get create a GUID.",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,class CSPInternalPluginData *>,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,class CSPInternalPluginData *> __stdcall UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,class ATL::CElementTraits<class CSPInternalPluginData *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "CleanupWindowsOldRegistryValue",
        "3&373A3W3}3",
        "9>:P:X:^:k:}:",
        ">$>.>6><>A>U>^>f>v>~>",
        "Operation failed: %s. Error: 0x%08X",
        "AUTHOR",
        "2%2-232@2R2c2~2",
        "8*979X9e9}9",
        "Unable to write the back up value for start type. Error: %u",
        "6'646F6N6T6a6s6",
        ".PAVCXXXXXHandledException@?CFC@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "3$303P3\\3|3",
        "    Failed to find element start node",
        "SetSecurityDescriptorDacl",
        "ProvPackageAPI <unknown severity>: %s",
        ";E(u)",
        "> >7>=>H>V>",
        "CORRUPTION",
        "OpenEncryptedFileRawW",
        "RPC_S_SERVER_TOO_BUSY",
        "ERROR_INVALID_SERVICE_LOCK",
        "DismGetPackageInfo",
        "5=5`5",
        "LockFileEx",
        "No more elements to enumerate",
        "void __thiscall UnBCL::ArrayList<struct SetupPlatform::IDisk *>::Insert(int,struct SetupPlatform::IDisk *)",
        ":!:1:6:B:W:d:q:",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *> *)",
        "NotifyWinEvent",
        ">\"?9?O?t?",
        "Creating/Setting Crashdumpenabled reg value  with %s.",
        "4B4U4\\4b4g4r4y4",
        "0p3x3}3",
        "ERROR_EVT_FILTER_TOO_COMPLEX",
        "?!?:?L?c?r?",
        "<,<2<K<R<a<h<t<",
        "struct UnBCL::ISerializable *&__thiscall UnBCL::ArrayList<struct UnBCL::ISerializable *>::get_Item(int)",
        "1?1S1Z1e1l1y1",
        "9*9@9j9",
        "1(151<1F1Y1i1",
        "494O4\\4g4m4w4",
        "ERROR_SYSTEM_HIVE_TOO_LARGE",
        "class UnBCL::ArrayList<class COperationResult *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class COperationResult *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "SL_E_SFS_INVALID_TOKEN_DATA_HASH",
        "\\Windows\\System32\\drivers\\wof.sys",
        "SPValidateMigratedServices: cannot find Win32 path for %s, cannot validate service",
        "7+7c7p7",
        "VERBOSEOPS: Setting operation order for %d to be after %d",
        "GetSizeOfWinRE: Failed to open %s to get WinRE size (0x%08x)",
        "j?^j\\",
        "Checking NEW OS path: %s",
        "3?3a3r3y3",
        "5#5D5Q5h5u5",
        ":G:Y:a:g:t:",
        "7*70767;7E7O7Y7c7q7w7}7",
        "SclpExecuteRequestInternal",
        "BcdCopyObjectEx: Failed to copy object. Target: %ws Flags: 0x%x Status: %x",
        "? ?+?9?a?m?",
        "PVVh?",
        ".?AV?$ValueCollection@GH@_@UnBCL@@",
        "Catalogs",
        "Matched OCs:",
        "=#=*=0=:=\\=n=|=",
        "8H9Z9l9",
        "7#757D7N7z7",
        ".?AV?$CAutoCleanup@PAUHKEY__@@@RAII@@",
        "4&414=4G4Y4a4g4q4{4",
        "Could not convert the following Win32 path to an NT one - %ls",
        "?\"?)?7?A?T?b?l?|?",
        ";4<n<",
        "?get_NodeType@XmlNode@UnBCL@@QAE?AW4XmlNodeType@2@XZ",
        "CSetupPlatformOnline::WriteLog",
        "888>8H8M8W8^8l8~8",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,enum ActionType>,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,enum ActionType> __stdcall UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,class ATL::CElementTraits<enum ActionType> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,enum ActionType> *,class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,enum ActionType> > *,int)",
        "suspend protection on OS volume",
        ":,:@:T:h:|:",
        "747H7\\7d7",
        "COperationQueue::RevertExecution",
        "ERROR_BAD_MCFG_TABLE",
        "Failed to get creation time for snapshot [%s]. Error: 0x%08X",
        "CMigrateBootSettings::DoExecute",
        "$WINDOWS.~TMP",
        ".?AV?$SerializableBase@V?$Array@PAVCRegCreationData@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCRegCreationData@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "?$?,?4?@?d?l?t?|?",
        "Old and new paths are identical ([%ws]); skipping path replacement...",
        "VERSION",
        ">*>8>B>L>c>",
        "ERROR_TRANSACTION_REQUEST_NOT_VALID",
        "SetupPlatform: End SafeOS: Global progress: %u, Phase progress: %u",
        "? ?)?2?;?G?[?d?m?v?",
        "081E1",
        "Invalid",
        "SVh0}",
        "515:5D5_5",
        "FIOEnumerateReparsePoints",
        "0#040=0i0r0",
        "%hs: Progress message received: Phase: %s, Operation: %s, Percentage: %u%%",
        "1'1n1",
        "    User hive: %s",
        "ERROR_IPSEC_IKE_INVALID_POLICY",
        "%hs: fail-forward system does not have a parent, no requests are allowed to be queued",
        "L$dPj",
        "8,848:8D8N8b8x8",
        "6#6@6O6X6b6k6u6",
        ".?AVCXXXXXHandledException@?2??SPHexEncode@@YGPAVString@UnBCL@@QAEK@Z@",
        "ERROR_INVALID_SIGNAL_NUMBER",
        "?Nullify@?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEAAV12@XZ",
        "7)71777D7V7d7",
        "2,2<2L2\\2l2|2",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::RemoveAt(int)",
        "ERROR_TXF_DIR_NOT_EMPTY",
        "ERROR_LUIDS_EXHAUSTED",
        "SRRemoveRestorePoint",
        "Protection is active on non-OS path %s",
        "?^?j?",
        "L$4PV",
        ".?AVCExtractFilesFromWIM@@",
        ".?AU?$IList@UDISK_SPACE_IMPACT@@@UnBCL@@",
        ">5>C>L>(?:?K?Y?z?",
        ";&<:<L<T<Z<c<y<",
        ">\">*>1>7><>G>S>g>p>x>",
        "=D=h=",
        "ERROR_IPSEC_IKE_INVALID_RESPONDER_LIFETIME_NOTIFY",
        "0 0-0?0M0",
        "Failed to authorize WDS client session to server %s. Error: 0x%08X",
        "  Branch = %s",
        "01080>0C0N0U0i0",
        "      to [%02d/%02d/%d %02d:%02d:%02d]",
        "JET_wrnSeekNotEqual",
        "=&=0=6=C=",
        "969=9C9H9S9_9p9",
        "INBOX",
        "CDownloadDUUpdates::MoveOrCopyUpdates: Failed to clean up extracted update directory [%s]. hr = 0x%x",
        "1$1(1,10181@1X1\\1t1",
        "MEMORYTRACK: Consumed        : %I64d",
        "2,22282=2G2Q2[2e2s2y2",
        "ERROR_CTX_MODEM_RESPONSE_NO_DIALTONE",
        ">$>,>4>@>H>|>",
        "6 787E7]7h7v7",
        "CWin32PrivilegeT<class CEmptyType>::Init",
        "=,=@=O=V=\\=a=o=",
        "BiCreateBootEntry: Could not retrieve BCD Object application description. Status: %x",
        "Marking event [&SclEvent_ExecuteRequest_Stop]",
        ".?AV?$ArrayListEnumerator@PAUIDisk@SetupPlatform@@@_@UnBCL@@",
        "VVVVPPPj",
        "void __thiscall UnBCL::Array<class CWIMBootData *>::Insert(int,class CWIMBootData *)",
        "sCDownloadDUUpdates::DownloadUpdates",
        "  No associated volume",
        "ff-Latn-SN",
        "8:uEh",
        "void __thiscall UnBCL::Array<class CDeploymentBase::CMountedPathInfo *>::RemoveAt(int)",
        "3 3.343@3L3S3Y3^3i3w3",
        "unmount",
        "8.8g8",
        "SPCleanupInstallationDrive: Failure while building path to Setup Platform working directory. Error: 0x%08X",
        "?%?2?>?G?P?W?d?p?y?",
        "..\\rollback\\setupapi\\setupapi.offline.log",
        "Value:%s",
        "fi-FI",
        "ERROR_REG_NAT_CONSUMPTION",
        "344l4",
        "x\\f9}",
        "SL_E_VGA_NON_GENUINE_STATUS_LAST",
        "4.464u4",
        ".?AVVdsVolume@@",
        "9,989@9X9`9x9",
        "SPModifyOfflineHives failed; hr = 0x%08X",
        "1.1>1S1n1",
        "4#4,464C4L4V4`4r4{4",
        "WINDOWS/INSTALLATIONTYPE",
        ".PAVCXXXXXTemp@?IG@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "3)353B3R3b3n3v3|3",
        "void __thiscall UnBCL::Array<class CBasicEnvEntry *>::InitLarva(class UnBCL::ArrayList<class CBasicEnvEntry *> *)",
        "0!0'0,070F0N0T0h0",
        ".PAVCXXXXXHandledException@?2??pAddSafeOSDrivers@@YGJPBGPAVCSetupAutomation@@000PAXPAUIGenericProgress@SetupPlatform@@@Z@",
        "specialize",
        "<&<4<L<]<u<",
        "SL_E_CHPA_BUSINESS_RULE_INPUT_NOT_FOUND",
        "ERROR_JOURNAL_DELETE_IN_PROGRESS",
        "0,040:0l0s0y0~0",
        "ar-DZ",
        "pbr: Estimated reconstruction disk space needed: %I64u",
        "?7?C?a?m?",
        "%hs: Can't mount offline hive: %s. Error: 0x%08X",
        "RtlLengthSecurityDescriptor",
        "CNewSystem::QueueDriverMigrationCommon",
        "e\\%s-%x-%x-%x.tmp",
        "ibb-NG",
        "Failed to flush BCD to disk. Status = [%x]",
        ".?AV?$CAutoRelease@PAVSmVirtDiskPooledDiskEnumerator@@@RAII@@",
        "{AA6B0D5E-BB64-4023-8F93-A1B5AFDC43EE}",
        "jQj h",
        "0\"0K0Q0]0e0w0~0",
        "3)3=3R3_3y3",
        ";9;S;h;p;v;",
        "7\"717@7I7S7\\7f7o7y7",
        "__thiscall CSPPluginData::CSPPluginData(class UnBCL::String *,class CSPInternalPluginData *)",
        ".PAVCXXXXXHandledException@?EF@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "1d2r2",
        "CTestHookDUUpdate::UnpackContents: Failure to finsih TestHook of DownloadDUUpdate. Error: 0x%08X",
        "SPSh?",
        "8+8E8L8R8W8b8m8",
        "0\"060>0E0K0P0[0e0x0",
        "SysprepSession::ExecuteAction: Error bypassed for deleteValue operation",
        "92:E:S:o:",
        "NtOpenKey",
        "6A7F7Q7c7q7x7",
        "Saw SHARING_VIOLATION while loading hive [%ws]; is it already loaded?",
        "File creation failed with error 0x%08X. Ignoring error as per request.",
        "Unable to get procedure ParseManifest",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet",
        "CCreateScopedSnapshot::DoExecute",
        "1#1(131>1R1p1",
        "long __thiscall CApplyDataOffline::DoExecute(struct IExecutionContext *,void *,struct IInternalOperationsProgress *)",
        ".?AVCXXXXXHandledException@?P@??DownloadDynamicUpdates@CSetupPlatform@@IAEJPBUImageInfo@DU@@KPBGHPAUIDownloadCallback@SetupPlatform@@PAUIExecutionContext@@PAXPAUIGenericProgress@6@PAPAUIDUPackageCollection@6@@Z@",
        "5*5;5B5X5s5y5",
        "5!5.545;5E5R5Y5c5t5",
        ">+>6>Q>b>",
        "6$727;7D7M7k7",
        "ERROR_CTX_BAD_VIDEO_MODE",
        ";&<,<G<a<y<",
        "4T4o4",
        "ERROR_INVALID_MODULETYPE",
        ".?AV?$DefaultInstanceFactory@VCMigrateBootSettings@@@UnBCL@@",
        "?Trim@String@UnBCL@@QBEPAV12@XZ",
        "Do not install.",
        ">'>K>\\>i>{>",
        "=->E>R>j>u>",
        "JET_errIndexTuplesCannotRetrieveFromIndex",
        ">%>/>F>i>",
        "UnlockFileEx",
        "CDeploymentProject::Initialize: Failed to create image info from %s. Error: 0x%08X",
        "Custom GPT type GUID: %s",
        "7#797@7L7S7",
        "EnterpriseAttribution set to %d",
        "SmVolume::Initialize(): Unknown filesystem type: %s",
        ".?AVStringProperty@?1???$pDefineStringProperty@V<lambda_3aba7b39af2ad8a50905ee2bec8178a2>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_3aba7b39af2ad8a50905ee2bec8178a2>@@@Z@",
        "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5",
        "ERROR_CLASS_HAS_WINDOWS",
        "5\"5,535A5S5d5k5",
        ";&<I<S<f<o<x<",
        "Unsupported offline system architecture found: %hu",
        "BootEntries",
        ".?AV?$CAutoDeleteArray@U_DismDriverStoreProperty@@@RAII@@",
        "class OSRollbackService::CCheckpoint **__thiscall UnBCL::ArrayList<class OSRollbackService::CCheckpoint *>::GetBuffer(int)",
        "%hs: No default boot entry was found. We will assume {default} == {current}",
        "    Reset clear has unknown value",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::Remove(class UnBCL::String *)",
        "4&454Q4v4",
        "t$(VW",
        ":=;];",
        ">%>/>6><>A>L>X>]>q>",
        "CBS_E_SESSION_READONLY",
        "FindNode",
        "< <*<9<B<H<U<[<`<q<|<",
        "Bugcheck param 2",
        "SPEnumUnallocated",
        "Failed opening target DerivedData",
        "5&5/5;5H5S5l5y5",
        "L$,^3",
        ">#>/>;>G>S>_>",
        "1#1@1a1",
        "CRtlCompressionT<class CEmptyType>::Init",
        "Find completed operation %u with unknown complete phase",
        "CRYPT_E_HASH_VALUE",
        ".PAVCXXXXXTemp@?MH@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "class CDeploymentBase::CMountedPathInfo *__thiscall UnBCL::_::ArrayListEnumerator<class CDeploymentBase::CMountedPathInfo *>::get_Current(void) const",
        "ERROR_LOG_NO_RESTART",
        "OC Exception: %s",
        ".PAVCXXXXXTemp@?9??AddToImageInfoSet@CImageInfoSet@@SGJPAV2@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@KPAV?$ArrayList@PAVCImageInfo@@@4@PBG4PAUtagWDS_CLI_CRED@@W4IMAGE_TYPE@SetupPlatform@@@Z@",
        "`.data",
        "9$9,949<9H9P9l9t9|9",
        "ERROR_INDEX_ABSENT",
        "555<5B5G5R5]5b5v5",
        "void __thiscall UnBCL::Array<class CDeploymentBase *>::RemoveAt(int)",
        "Failed to remove %s. Error: 0x%08X",
        "5%545H5",
        ".?AU?$IList@PAVCFilterDriverInfo@@@UnBCL@@",
        "0;0E0T0l0r0",
        "4Z4_4",
        "=&=A=s=",
        "010B0N0Z0r0~0",
        "3$323;3D3N3W3m3",
        "8#8@8E8r8",
        "7(7<7I7]7h7y7",
        "0-0S0j0",
        ".?AUISPTelemetryData@@",
        "Successfully disabled feature %s in the OS: %s.",
        "SetupPlatform::_ExecuteRollback: Failed to create CSetupPlatformPrivate. Error: 0x%08X",
        "Error Initializing Setup Infrastructure",
        "GlobalPath,%s,%u,%I64u,%u%s%s",
        ".OfflineApplyIncomplete",
        "<0=x=",
        "=#=?=F=L=Q=\\=f=y=",
        "\\\\.\\pipe\\spprogress",
        "OC::COCDismAdapter::Release: DISM session closed succeessfully",
        "Sources\\NewSystem.dat",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,struct UnBCL::ISerializable *> __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,struct UnBCL::ISerializable *>,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,struct UnBCL::ISerializable *> __stdcall UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,class ATL::CElementTraits<struct UnBCL::ISerializable *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "8\"868>8S8k8",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CCFGSectionValue *>::Reset(void)",
        "CManifest::Serialize",
        "8+9`9",
        "=&>3>R>d>n>x>",
        "0+1Z1v1",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::LastIndexOf(class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *,int,int) const",
        "0!1+1A1m1",
        "9$:?:I:Z:",
        "202;2A2K2R2X2]2l2w2",
        "7)7K7W7f7u7",
        "FLTLIB.DLL",
        "CCreateScopedSnapshot::DoExecute: Snapshot [%s] created",
        "Failed to read the source `Current` value",
        "210303183039Z0p1",
        "ERROR_PRINT_JOB_RESTART_REQUIRED",
        "?(?e?z?",
        "Failed to get bootmgr custom actions. Status = [%x]",
        "Number of reparse points processed",
        "Failed to open a handle to the bootmgr object. Status = [%x]",
        "ParseDiskCriterion",
        "SPEstimatePageFileSizeAndRequiredMemory: Failed to get system information. NTSTATUS: 0x%08X",
        "ERROR_INSTALL_PACKAGE_OPEN_FAILED",
        "9'91969J9U9^9t9",
        "%hs: PackageType is unknown",
        "ERROR_PAGEFILE_CREATE_FAILED",
        "??0Win32Exception@UnBCL@@QAE@KPBG@Z",
        "JET_errBadPatchPage",
        "<vKWW",
        "8i8s8",
        "  BEGIN",
        "WdsInitialize",
        "Failed to create Recovery directory. Last error = %#x",
        "Enumerating files for WIMBoot entry %I64d (%s, backup path: %s, index: %d) for drive %s",
        "=#=,=B=X=j=r=x=",
        "Failed to open a handle to the bootmgr. Status = [%x]",
        "OCs which will be disabled:",
        "XkZu=",
        "\\REGISTRY\\MACHINE\\SAM\\SAM",
        "=%>>>N>",
        "{%08lx-%04hx-%04hx-%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx--%x}{%x}",
        "=)=9=U=n=",
        "Migration.Services.NoVersionCheck",
        ".?AVCXXXXXHandledException@?FH@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "RootPath",
        "?CompareTo@Object@UnBCL@@UBEHPBV12@@Z",
        "{4DC7D63D-D6E2-47C0-AB8F-C4988D777C50}",
        ">?>Z>b>k>s>z>",
        "Attempting to reset setup.",
        "CAddProvisioningPackage::DoExecute: Failed to write package path %s to registry at %s [%s]: 0x%08x",
        "SVh4=",
        ".?AVCRegCreationData@@",
        ".?AU?$ICollection@PAUIPartition@SetupPlatform@@@UnBCL@@",
        "ERROR_DS_DUP_MAPI_ID",
        "7)7R7",
        "BCD settings applied successfully",
        ">'>5>C>",
        "CSetupPlatformApplyRollbackCheckpoint: Failed to find setup platform path.",
        "SP_ENV_DISABLE_READING_ONESETTING",
        "Processing non-OS volumes",
        "int __thiscall UnBCL::Array<class COperationResult *>::Add(class COperationResult *)",
        "2\"2*202=2O2Y2l2t2z2",
        "CSetupAutomation::CacheInstallImage: Couldn't read WIM file %s: 0x%08x",
        "JET_wrnTargetInstanceRunning",
        "Service %s is already running",
        "?6???R?^?h?u?~?",
        "3!363j3t3",
        "sSP_SNAPSHOT_INFO",
        "MaxFileSize is set as %dMB",
        "pDeterminePageFileRequirements",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::MoveNext(void)",
        "Offline portion of first and oobe boot apply operations",
        "soobeldr.exe",
        "<g<~<",
        "041T1x1",
        ":*:4:B:K:T:w:",
        "Snapshot policy doesn't allow creating snapshot",
        "File [%s] is created.",
        "JET_errRequiredLogFilesMissing",
        "Payload block count = %d",
        "5*52595>5J5X5h5m5v5",
        "3'4K4U4u4~4",
        "1#1*1<1B1Y1`1",
        "OOBEBoot,End",
        "<(<B<O<U<f<}<",
        ";D<[<z<",
        "%hs: Failure when deserializing the fail-forward data.",
        "Failed to convert GUID to string.",
        "int __stdcall SPWriteDriversList(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *> *,const unsigned short *,int)",
        "0!0*060B0K0U0h0r0",
        "DiskLayout::VerifyLayoutModifyIndices: Failed to read disk properties: 0x%08x",
        "GetAnswerFileContentsAsUnattend: No WPX processor architecture for %u",
        "FOD Validator: Ignoring validator failure due to environment variable.",
        "s8h8(",
        "5\"5(5-585B5U5",
        ".?AV?$DefaultInstanceFactory@VCSysprepRespecialize@@@UnBCL@@",
        ":#:3:@:F:S:`:}:",
        "Failed to open OS DISM session",
        "8 8W8c8y8",
        "ERROR_QUORUM_DISK_NOT_FOUND",
        ":,:g:",
        ";-;4;J;e;k;u;z;",
        "373J3k3",
        "---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------",
        "CFG Validator: Unkonwn type [%s]",
        "IsDynamic",
        ".?AV?$SmartPtr@U?$IEnumerator@I@UnBCL@@@UnBCL@@",
        "Searching for unused drivers that may be removed from the system.",
        ".PAVCXXXXXHandledException@?P@??DownloadDynamicUpdates@CSetupPlatform@@IAEJPBUImageInfo@DU@@KPBGHPAUIDownloadCallback@SetupPlatform@@PAUIExecutionContext@@PAXPAUIGenericProgress@6@PAPAUIDUPackageCollection@6@@Z@",
        "1!1.1G1R1`1}1",
        "4,5l5",
        "ERROR_VOLUME_NOT_SIS_ENABLED",
        "3(3G3j3p3{3",
        "Failure while getting the destination known folder path for %s",
        "long __thiscall CAppXValidator::ValidatePostExecution(struct IExecutionContext *,enum OP_EXECUTION_PHASE,class COperation *,class COperationQueue *,int &)",
        "ERROR_NO_DATA",
        ".?AV?$CAutoCleanupBase@PAVSmPlatformDiskEnumerator@@@RAII@@",
        "4(5L5n5",
        "SPHexDecode: Hex/binary buffer lengths don't match",
        ".?AV?$SerializableBase@VCSysprepSpecializeOffline@@$0A@V?$DefaultInstanceFactory@VCSysprepSpecializeOffline@@@UnBCL@@@UnBCL@@",
        "pGetProvisioningPackagePayload: Failed to get asset size. Error: 0x%08X",
        "{L_^[",
        "4(4b4",
        "4 4$4<4@4X4\\4t4x4",
        "CDeploymentProject::CreateVHDDeployment: Failed to delete temporary VHD. Error: 0x%08X",
        "PVWh0",
        "4/4D4h4",
        ";$;.;A;a;h;n;s;~;",
        "> >/>6><>A>N>Y>_>s>z>",
        "1/2A2J2S2\\2e2n2",
        "na:Compressed",
        "NtRestoreKey",
        "3!3&31383M3_3f3l3q3|3",
        "2M2R2W2c2",
        "5&5F5d5",
        "<6<H<V<d<r<",
        ".?AU?$IList@PAVCBasicEnvEntry@@@UnBCL@@",
        "8&868B8I8W8^8e8p8",
        "SetupLog",
        "CNewSystem::QueueCustomizations",
        "; ;$;(;,;4;X;`;d;h;l;t;",
        "; ;0;@;L;d;j;|;",
        ".?AVCXXXXXHandledException@?GF@??ExecuteFailForward@CSetupPlatformPrivate@@IAEJHPAU_PROGRESS_DATA@SetupPlatform@@@Z@",
        "?)???J?c?h?u?}?",
        "SetupPlatform: Phase \"Pre-OOBE\" completed successfully.",
        ".?AU?$IList@UPartitionInfo@?1??SPGetPartitionOrdinal@@YGJPAUIPartition@SetupPlatform@@PAK@Z@@UnBCL@@",
        "9 9*9=9M9l9y9",
        "5#5/5@5W5c5t5",
        ">'>Z>a>g>l>w>",
        "%programdata%",
        "ERROR_LOG_READ_CONTEXT_INVALID",
        ";$;2;<;F;P;Z;q;",
        "ProductKey",
        "t!Shh8",
        "PWVhh",
        "{654AF0B5-24F0-4BEE-A325-F27BAB266F2F}",
        "0&030L0V0k0u0",
        "4+474Y4e4q4}4",
        "x%SystemRoot%\\system32\\Atbroker.exe",
        "6/666<6A6L6V6_6w6",
        "SKIPBOOTTRACK(SAFEOS): Cannot attempt SafeOS boot removal, NEO path is disabled",
        "void __thiscall UnBCL::Array<class CFileCreationData *>::Remove(class CFileCreationData *)",
        "5%5<5C5I5N5Y5`5v5",
        "JET_errInvalidIndexId",
        "ERROR_RMODE_APP",
        "{C80C4FCF-FD54-40A8-B6EF-C175BAAFA53A}",
        "%hs: Removing uninstall data",
        "9-9>9K9^9r9",
        "RtlExpandEnvironmentStrings_U",
        "3(373F3R3`3|3",
        "7$7(7@7D7\\7`7x7|7",
        "SeTakeOwnershipPrivilege",
        "WTHelperProvDataFromStateData",
        "2%242H2X2_2f2q2|2",
        "=.=i={=",
        "102B2J2P2]2o2}2",
        "te-IN",
        ":T:y:",
        ">;>N>i>w>",
        ">)>>>_>r>",
        "= ='=8=I=Q=W=k=}=",
        "DiskLayout::ParseCustomMbrType: Custom MBR type must be a two-digit hex byte",
        "pEnumAndDeleteWimExternalFilesProc",
        ".?AV?$CAutoRelease@PAVSmVolumePathEnumerator@@@RAII@@",
        "1*111;1H1S1]1y1",
        "ERROR_NO_SYSTEM_MENU",
        "7C8V8b8x8",
        "yo-NG",
        "9'91989?9F9h9",
        ";\";(;.;4;:;@;F;L;R;X;^;d;j;p;v;|;",
        "ar-KW",
        "PolicyManager_GetPolicy",
        "SmImageDisk::GetProperties: Can't initialize MSFT_Disk properties (0x%08x)",
        "CFfuWriterAsyncT<class CSecurityHeaderWriterT<class CEmptyType>,class CImageHeaderWriterT<class CEmptyType>,class CStoreHeaderWriterT<class CEmptyType>,class CPayloadWriterT<class CEmptyType> >::Initialize",
        "=%=E=e=o=",
        "pStopSetupPlatformETWSession: Failure while stopping trace at [%s]. Error: 0x%08X",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCFileCreationData@@@UnBCL@@@UnBCL@@",
        "7 7$7(7,7074787<7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7",
        "3!343T3s3",
        "9 9+919E9M9f9w9",
        ".?AVCValidateSafeOS@@",
        "6f6k6",
        "PWVhA",
        "30343L3P3h3l3",
        "131E1O1\\1b1i1s1",
        "Synchronizing store with firmware",
        "%hs: Failed to create offline CBS session. hr = 0x%08X",
        "7#7-747L7S7Z7`7k7",
        "7+797",
        "8!8)80868V8\\8e8m8|8",
        "ERROR_INVALID_WINDOW_STYLE",
        "void __thiscall UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *>::Insert(int,class OC::CCmdLineExecutionTelemetryData *)",
        "7#747Q7X7`7e7u7",
        "=0=<=D=Z=p=}=",
        "CCaptureIODispatcher::Initialize",
        "191F1i1v1",
        "7A7W7q7",
        "RegisterRecoveryImage",
        "9s v5",
        "SPAPI_E_NO_ASSOCIATED_SERVICE",
        "t!VhXU",
        "8,81868A8f8m8s8x8",
        "VERBOSE: OS part root (DOS): %s",
        "JET_errDatabaseLocked",
        "OSRollbackService::CCheckpoint::MoveOrCopyFiles: failed to move (error %u) or copy (error %u) from %s to %s",
        "Failed to Migrate SxS configuration",
        "ERROR_PRINTER_HAS_JOBS_QUEUED",
        "struct IVdsVDisk *__thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,&protected: static struct IVdsVDisk * __stdcall UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsVDisk *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "?N?V?|?",
        "ERROR_EFS_ALG_BLOB_TOO_BIG",
        "8-8\\8n8v8|8",
        "int __thiscall UnBCL::ArrayList<class COperation *>::BinarySearch(int,int,class COperation *,struct UnBCL::IComparer<class COperation *> *)",
        ".?AVCXXXXXHandledException@?2??RegisterRollbackOnlineSys@CSetupPlatformRollback@@UAEJPBG0@Z@",
        "6!656M6T6Z6_6j6r6",
        "SL_E_PKEY_NOT_INSTALLED",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,class ATL::CElementTraits<class CSPInternalPluginData *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "j hp$^",
        "\\System Volume Information\\FVE.{e40ad34d-dae9-4bc7-95bd-b16218c10f72}.X",
        "617G7V7",
        "<(<8<H<X<h<x<|<",
        "4H5d5n5x5~5",
        "UCS-2",
        "<\"<,<1<;<B<P<b<s<z<",
        "4+454I4R4u4",
        "Failed to create disk enumerator",
        "4%424<4K4T4Z4g4m4r4",
        "SL_E_LICENSE_AUTHORIZATION_FAILED",
        "Fail-forward rollback detected, source WIM file(s) be removed only at the end of the installation.",
        "Failed to initialize UTC Api Wrapper: 0x%x",
        "CRYPT_E_MSG_ERROR",
        ":#;5;F;X;j;|;",
        ":::E:R:_:n:}:",
        "8(818=8F8O8[8g8s8",
        ">\">(>5>B>O>V>`>q>~>",
        "u~j-[f9\\0&",
        "ERROR_UNEXPECTED_MM_EXTEND_ERR",
        "sParseSizeString",
        "6$676E6L6R6W6b6m6",
        "void __thiscall UnBCL::ArrayList<class CImageInfo *>::Resize(int,int)",
        "int __thiscall UnBCL::_::ArrayListEnumerator<struct DiskLayout::Partition>::MoveNext(void)",
        "Skip Boot Validator: No source OS pieces found",
        "<%</<<<B<I<S<`<g<q<",
        "RegQueryValueExW",
        "<'<1<A<R<W<g<w<",
        "2(222S2d2p2|2",
        "ky-KG",
        "8,93999>9I9Y9m9",
        "Failed to concat second string.",
        "ERROR_IO_INCOMPLETE",
        "Failed to Enumerate elements from %ws. Status: %x",
        "Relocating WIMBoot-backed driver package: %s",
        "    Failed to create destination folder",
        "CARPValidator::GetRegInfo",
        "GetSystemPartitionNTPath: Found system partition at [%s].",
        "ERROR_INSTALL_REMOTE_PROHIBITED",
        "8,8>8^8k8",
        "Failed to retried available free space info from file: %s.",
        ": :G:W:_:p:x:",
        "GetProcessHeap",
        "6?6h6z6",
        "BootStat\\OS\\bootstat.dat",
        "pOpenDiskImage",
        "appver",
        "ERROR_STACK_OVERFLOW",
        "{A30FCA57-6B5A-481E-A9F2-205A35BB614C}",
        "5 585@5H5\\5d5l5|5",
        ".?AV?$SerializableHashtableBase@PAVString@UnBCL@@K@_@UnBCL@@",
        "ERROR_UNHANDLED_EXCEPTION",
        "CCFGSectionFile::Initialize",
        ".0]0l0v0",
        ">*>8>F>T>b>",
        ".PAVCXXXXXTemp@?9??Execute@COperation@@QAEJW4OP_EXECUTION_PHASE@@PAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ";-;;;`;r;z;",
        "Public",
        "Successfully copied %s to %s",
        "\\ssshim.dll",
        "SPCopyFolder: Failed to find next file/folder for %s. Error: 0x%08X",
        "SPDeleteAllSnapshots: Failed to enumerate snapshots. Error: 0x%08X",
        "7!7-767B7N7Z7f7r7~7",
        "0%030=0G0Q0[0e0o0y0",
        "Failed to set NET debugging key. Status = 0x%X",
        "3\"303f3",
        "Failed to read item %u of array (0x%08x)",
        "T0f0n0t0",
        "6\"6*606=6O6]6v6}6",
        "WimCopyStream failed",
        ";!;(;.;3;>;H;[;z;",
        "Auto-unlock is not supported for non-OS volumes, will suspend as necessary",
        "ExportChunkedPortion",
        "2#282?2D2[2b2h2m2x2",
        "728<8",
        ";%<O<",
        "0%0-030@0X0",
        "676~6",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@GH@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "RtlGetNtProductType",
        "BuildUpdate",
        "8J8t8",
        "XQuerySnapshotFailedHR",
        "?<?_?",
        "2!2*2I2^2x2",
        "CBS_E_STACK_UPDATE_FAILED_REBOOT_REQUIRED",
        "CPrepareSafeOSForRollback::DoExecute",
        "j\\Zf;",
        ".?AV?$CAutoCleanupBase@PAUIMigRegistryNavigator@@@Mig@@",
        "2i3u3",
        "MIG_ALLOW_REPARSE_POINTS",
        ".?AV?$ArrayListEnumerator@PAVSysprepAction@@@_@UnBCL@@",
        "%windir%\\System32\\OOBE\\SetupPlatform",
        ".?AV?$SerializableArrayListBase@PAVCOperationResult@@@_@UnBCL@@",
        "3.393T3[3a3f3q3|3",
        "?!?1?C?K?Q?^?p?",
        "(%lx): Failed to create boot entry recovery file",
        "MIG_AGENT_DLL_FILTER",
        "CNewSystem::QueueOperations: Estimate free [%I64d] space from Soft Reserve",
        "?=?L?",
        "8'838C8V8k8~8",
        ".?AV?$CAutoCleanupBase@PAVString@UnBCL@@@Mig@@",
        "9*9=9K9[9b9k9p9}9",
        "ERROR_DS_CLIENT_LOOP",
        "Failed to format string.",
        "CreateFailForwardSystem called with name %s",
        "CreateCompatibleBitmap",
        "0!0*030<0E0N0W0`0i0r0{0",
        "3!434",
        ".?AV?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@",
        "int __thiscall UnBCL::ArrayList<class CDriverInfo *>::LastIndexOf(class CDriverInfo *,int,int) const",
        "int __thiscall UnBCL::Array<struct DiskLayout::Partition>::Add(struct DiskLayout::Partition)",
        "VERBOSE: MOVETRACK: Failed to get source attributes, GLE=0x%08X",
        "JET_errTaskDropped",
        "2\\2p2",
        "LastCrashDumpInfo: BugcheckParameter1 %llu",
        "SPDeleteAllSnapshots: Target snapshot doesn't exist, assume it's already removed",
        "class CGlobalPath *__stdcall UnBCL::Try_Cast<classCGlobalPath*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        ".?AV?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@",
        "?get_Count@XmlNodeList@UnBCL@@QAEHXZ",
        "t$(Ph",
        "ReleaseDataRange",
        ".?AV?$SerializableBase@VCAddUnattend@@$0A@V?$DefaultInstanceFactory@VCAddUnattend@@@UnBCL@@@UnBCL@@",
        "Cannot link this payload; will copy instead",
        "Pre First Boot",
        "SL_E_NONGENUINE_GRACE_TIME_EXPIRED_2",
        "\\\\?\\Volume",
        "Read invalid NT header from file: %S",
        "WWWWj",
        "RegValueEnumAction::Enumerate: Failed to query key info: %s\\%s (error %d)",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *> *)",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::MoveNext(void)",
        "Execute offline apply from ICB",
        "5<5K5T5s5",
        ".?AVCUserProfile@@",
        "MIGPERFTRACK: Migration overhead: %.1f",
        ".?AV?$DefaultInstanceFactory@VCReconstructOS@@@UnBCL@@",
        "SPTaskRemoveSnapshot: Try to delete all expired Upgrade snapshots",
        "9+9Q9f9x9",
        "pSetTaskPrincipal",
        "RestoreFileData",
        "4!4,464;4O4c4",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCDriverInfo@@@UnBCL@@@UnBCL@@",
        ":W:p:u:",
        "5$5(50545<5@5H5L5T5X5`5d5h5p5x5",
        "SetupPlatform: Phase \"OOBEBoot\" completed successfully.",
        "VERBOSE: MOVETRACK: Moving %s to %s",
        "CInfFile::DetectDefaultInstallSection: Failed to open driver package %s; hr = 0x%08X",
        "CImageInfoSet::ValidateProductKey",
        "NGEN cleanup: Not touching folder %s",
        "bsearch",
        "pAddNewOSDynamicUpdateOperations",
        ".?AV?$CAutoRelease@PAVDiskLayout@@@RAII@@",
        ".?AVCXXXXXHandledException@?GD@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "50545L5P5h5l5",
        "6X6m6~6",
        "9$909P9X9`9l9",
        "ERROR_MUI_FILE_NOT_FOUND",
        "Failed to enumerate wim external files for data source ID: %I64d. Error: 0x%08X",
        "3\"3B3Y3'4>4",
        "2 2(262>2W2^2d2i2q2|2",
        "8!8*898O8\\8s8",
        "ERROR_ILLEGAL_CHARACTER",
        "3!4/484N4\\4e4n4w4",
        "Error creating boot status data log(%s)! Last Error = %#x",
        "RPC_S_INVALID_NAME_SYNTAX",
        "tAhPo",
        "7p8H9 :",
        "CLSIDFromString",
        "1&2=2U2[2m2~2",
        "ImageStubMountDirectory",
        "{4d36e970-e325-11ce-bfc1-08002be10318}",
        "CDiagnosticsHelper::set_WatsonEventName",
        "?R?s?",
        "142g2",
        "CInfFile::Parse: Failed to detect native default install section in driver package %s; hr = 0x%08X",
        "ERROR_SUCCESS_REBOOT_INITIATED",
        "WpeRegisterLogCallback",
        ".?AU?$ICollection@PAVCDriverInfo@@@UnBCL@@",
        "??0?$Array@E@UnBCL@@QAE@HH@Z",
        "=!=(=",
        "=)=J=X=o=}=",
        "%M.%m.%ls",
        "= =(=0=<=\\=d=l=t=|=",
        ":%:>:S:",
        "</<_<q<y<",
        "Opening store over provisioning package %s",
        "7/7@7G7Y7d7r7",
        "0#0-0;0A0G0L0V0`0j0t0",
        "SclRegDeleteKeyRecursive",
        "Execute.PostApply",
        "5;5I5R5[5d5m5v5",
        "Disk.Resiliency value was unrecognized!",
        "ucj.Zf9",
        "Opening store. Flags: 0x%x",
        "=6=>=E=[=n=t=",
        "CDiagnosticsHelper::Merge",
        "DiskLayoutMakeSystem",
        "1)131H1Z1b1h1|1",
        "8+9=9E9K9X9j9x9",
        "ERROR_IPSEC_IKE_INVALID_GROUP",
        "JET_errTooManyIndexes",
        "FolderMoveLog.TXT",
        "ValidatorFailed",
        ".?AV?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@",
        "3U4Z4",
        "96:N:Z:l:",
        "class OSRollbackService::CCheckpoint *const &__thiscall UnBCL::ArrayList<class OSRollbackService::CCheckpoint *>::get_Item(int) const",
        "0 0-0?0M0Z0",
        "BcdCopyObjectEx: Failed to set target elements. Target: %ws Flags: 0x%x Element type: %lu Status: %x",
        "0%0a0h0",
        "    Failed to open provisioning package for read",
        ":#:<:[:u:",
        "ERROR_LOG_MULTIPLEXED",
        "ERROR_WMI_DP_NOT_FOUND",
        "PVWhm",
        "ySafeBootCommandTrusted",
        "int __thiscall UnBCL::_::HTEnumerator<unsigned short,int,struct UnBCL::Hashtable<unsigned short,int>::TableKey,class UnBCL::DictionaryEntry<unsigned short,int>,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<unsigned short,int> __stdcall UnBCL::Hashtable<unsigned short,int>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned short,int>::TableKey,int,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "CWIMBootHelper::CreateFileW",
        "QWjcj",
        "<F<d<v<",
        "2!202=2J2S2h2o2x2",
        "fwscanf_s",
        "QSjbj~jd",
        ":\";B;I;P;m;t;",
        ">)>K>i>y>",
        "t!QQj",
        "<\"<0<=<O<W<]<j<|<",
        "CSetupPlatformPrivate::RollbackOnlineUsr: Failed to register RollbackOnline for user. Error: 0x%08X",
        "ERROR_CLUSTER_INVALID_IPV6_TUNNEL_NETWORK",
        "9#919Q9l9",
        "3 3-3<3[3b3h3t3",
        "6[7n7",
        "FLOWTRACK(FIRST): Failing installation due to scenario constraint (%d). Skip First boot is turned off.",
        "?(?T?p?",
        "ERROR_IPSEC_MM_AUTH_IN_USE",
        "??D?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEAAVString@1@XZ",
        "5%5-535G5N5`5g5u5",
        "8<8Z8i8x8",
        "1?1H1m1s1",
        "WRQPh \"",
        "Migrating SECURITY registry content",
        "8.8;8D8P8f8q8",
        "4)464>4D4X4]4i4u4",
        "9<9D9L9T9\\9d9l9t9|9",
        "3\"3)3/3;3M3[3i3w3",
        "Failed to retrieve image path for namespace %s, server %s. Error: 0x%08X",
        "Failed to change start type for service %s. Error: 0x%08X",
        "CERT_E_PURPOSE",
        ":.:I:Z:f:",
        "%hs: Failed to write new OS boot entry GUID to %s. Error: 0x%08X",
        "3$3.3>3N3V3_3e3z3",
        "6,6P6",
        "3 3(3<3D3L3\\3h3p3",
        "CDeviceIdDatabase::Initialize: SetupDiEnumDeviceInfo failed at device index %s; hr = 0x%08X",
        ".?AV?$CAutoCleanupBase@PAVWmiArray@WMI@@@RAII@@",
        "6'6Z6d6m6",
        "ERROR_REQUEST_ABORTED",
        "JET_errDatabaseSignInUse",
        "CDiskReader::GetBlockAllocationBitmapVolumeRawCopy",
        "8 8)828<8E8N8`8r8{8",
        "ERROR_EVT_FILTER_OUT_OF_RANGE",
        ".PAVCXXXXXHandledException@?8??SPGetWIMBootEntries@@YGPAV?$ArrayList@PAVCWIMBootData@@@UnBCL@@GH@Z@",
        "7$7H7g7",
        ".PAVCXXXXXTemp@?3??CreateFromWDSServer@CImageInfoSet@@SGJPBGPAUtagWDS_CLI_CRED@@PAPAV2@@Z@",
        "SPIsTargetTaggedForUpdate: Get NULL for target path",
        "struct DiskMatchFilter *__thiscall UnBCL::ArrayList<struct DiskMatchFilter>::GetBuffer(int)",
        "727n7",
        "Element::EnumeratePayload",
        ".?AV?$DefaultInstanceFactory@VCAppInfo@@@UnBCL@@",
        ";)<=<O<W<]<f<|<",
        "VdsPlatformDiskEnumerator::GetNext: Failed to get provider properties (0x%08x)",
        "ERROR_IPSEC_IKE_PROCESS_ERR_NONCE",
        "; ;,;c;o;",
        "2&2/282C2M2T2Z2_2j2u2",
        "323L3b3*4<4",
        "=*=8=Q=X=_=e=q=",
        "QueueAddProvisioningPackage called with package %s",
        "fPfPgf",
        "VdsPartition::GetProperties: Failed to get extended partition extent (0x%08x)",
        "base\\ntsetup\\setupplatform\\lib\\automation\\standarddisk.cpp",
        "5*5>5V5m5v5",
        "FOD Validator: Capability Count %d",
        "DiskLayout::ApplyCreatePartition",
        "u1ShH",
        "9!9*9@9M9_9g9m9v9",
        ";?;P;];o;",
        "Php?M",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: failed to delete %s.",
        "class CDrvStoreProperty *const &__thiscall UnBCL::ArrayList<class CDrvStoreProperty *>::get_Item(int) const",
        "SetupStartedBy",
        "SWh8_",
        "LastMigrationScope",
        "=4=W=a=",
        "2#202j2t2z2",
        "2a2h2n2s2~2",
        "??1?$IList@E@UnBCL@@UAE@XZ",
        "DiskLayout::CreatePartition: Failed to get parent partition properties (0x%08x)",
        "OC::COCCbsAdapter::InitOnline: CoInitializeEx hr = 0x%x",
        "BcdExportStore: Failed to open system store. Status: %x",
        "5'5?5E5W5h5u5~5",
        "1+1:1C1L1U1k1",
        "class DiskLayout *const &__thiscall UnBCL::ArrayList<class DiskLayout *>::get_Item(int) const",
        "negative capacity to ArrayList constructor",
        "=4=A=b=o=",
        "ImageWorkerThread",
        "PREVALIDATION: Validator asked for retry: %s (%s)",
        "14191@1H1X1v1",
        "7,737G7_7u7",
        "Failed to write input %s of call to method %s on %s, although the input exists; unexpected type? (0x%08x)",
        "ERROR_UNSUPPORTED_COMPRESSION",
        "GetSystemMetrics",
        "4\"4.4Z4",
        ">%?3?D?d?}?",
        ".?AV?$HTDictEnumBase@G@_@UnBCL@@",
        "CNewSystem::QueueSetupAutomation: Failed to get audit payload (0x%08x)",
        "ERROR_UNMAPPED_SUBSTITUTION_STRING",
        "7&7.747A7S7a7",
        "<,<?<X<m<",
        "EventRegister",
        "080W0z0",
        ":\":6:>:L:U:f:|:",
        "4\"4/4;4K4^4f4s4{4",
        "4 4%404>4R4\\4h4~4",
        "3!363c3|3",
        "PWVhv",
        "---|--------------------------------------------------------------------------------|--------|-------------------|-------------------|--------|------------------|------------------|-----------------|--------------------------------------",
        "Bug parameters set successfully",
        "ERROR_WAS_LOCKED",
        "SL_E_CHPA_INVALID_PRODUCT_KEY_LENGTH",
        "Failed popping next directory from stack",
        "CBS_E_CANNOT_UNINSTALL",
        ".PAVCXXXXXTemp@?CFN@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "CDeploymentProject::CreateVHDDeployment: Failed to create new system; Error: 0x%08X",
        "%s-%d",
        ">1>=>M>",
        "CDownloadDUUpdates::DoExecuteInternal: Failed to create reserved file's parent path %s. hr = 0x%x",
        "VdsPartition::SetUsage: Couldn't set attribute for %s partition (0x%08x)",
        ":1;Q;",
        ":(:1:::C:L:U:^:g:p:y:",
        "SetupDiGetDevicePropertyW",
        "AddDeviceIDsToInjectedDriverNodeHelper:Model section name is [%s]",
        "VVVPW",
        "GetAnswerFileContentsAsUnattend: Failed to open %s: 0x%08x",
        "5'545>5R5_5o5",
        "Requests to replace the OS drive path that don't provide an explicit 'old' path require access to the SOFTWARE hive.",
        "9.9Z9s9~9",
        "VdsVolume::AssignLabel: Failed to get volume properties (0x%08x)",
        "8,8=8K8S8Z8`8e8p8z8",
        "F4QQS",
        "CDUPackage::UnpackTo: IDUUpdate::GetWUAInterface failed. hr = 0x%x",
        "NtSetSystemInformation",
        " !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`a",
        "ERROR_NO_BROWSER_SERVERS_FOUND",
        "CRYPT_E_INVALID_INDEX",
        "8,8P8b8j8p8}8",
        "<><E<d<v<",
        "39HPt",
        "int __stdcall UnBCL::MP::ThrowCompare<unsigned short *>::Compare(unsigned short *,unsigned short *)",
        "> >1>>>N>V>",
        ".?AU?$ICollection@PAVCRegCreationData@@@UnBCL@@",
        ".?AV?$SmartPtr@VCCryptoUtil@OC@@@UnBCL@@",
        "6(6G6`6g6n6t6",
        "CSetupAutomation::GetDiskInfo: Failed to enumerate partitions: 0x%08x",
        "Creating new system (4). Existent system drive: %s",
        ".?AVCXXXXXHandledException@?5??SPScheduleTask@@YGJPBG000@Z@",
        "=*=<=R=y=",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "=+=G=N=T=Y=d=r=x=",
        "=&=2=:=Q=]=e=y=",
        "Client requested to keep BitLocker active, but the device does not support it. Will suspend BitLocker instead.",
        "CBackupRecoveryPartition::DoExecute: Failed to hash WIM file %s: 0x%0x",
        "DiskInitialize: Failed to wipe target disk (0x%08x)",
        "; ;0;4;8;P;`;d;|;",
        "__thiscall UnBCL::ArrayList<class COperationInfo *>::ArrayList(const struct UnBCL::ICollection<class COperationInfo *> *)",
        ":-:;:B:Q:g:",
        "void __thiscall UnBCL::Array<class CInfFile *>::RemoveAt(int)",
        "VERBOSE: Folder %s already exists, no need to create it",
        "ERROR_HOTKEY_NOT_REGISTERED",
        "WIM\\IMAGE[*]\\CREATIONTIME\\LOWPART",
        "Error uncompressing boot status data log(%s)! Last Error = %#x",
        "\\ArcName\\multi(0)disk(0)rdisk(0)",
        "=Q=e=",
        "Executing .NET reinstallation",
        "ERROR_ALREADY_REGISTERED",
        "000D0Z0u0",
        "090?0I0N0X0_0m0",
        "CNewSystem::QueueOperations:     Claimed Space : %I64u",
        "1>1R1`1n1|1",
        "6$61696?6E6U6i6u6",
        "SPCreateSnapshotWithScoping: Failed during creating snapshot with exclusion. Delete snapshot if created",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Directory CreateDir failed",
        ":*:T:[:c:h:x:",
        "6(6/656:6E6O6b6q6{6",
        "CEnable1394Debugging::SetDebuggerTypeSpecificSettings",
        "Footprint",
        "ERROR_INVALID_TRANSFORM",
        "PWVh_",
        "9\"9/9>9W9m9~9",
        ".PAVCXXXXXHandledException@?CJ@??CreateFFUDeployment@CDeploymentProject@@UAEJPBGPAXPAUIGenericProgress@SetupPlatform@@@Z@",
        "Failed getting package install stamp",
        "2)292x2",
        ".?AV?$SerializableBase@VCTurnOffReserve@@$0A@V?$DefaultInstanceFactory@VCTurnOffReserve@@@UnBCL@@@UnBCL@@",
        "eDeviceLayout",
        "=)>A>O>k>",
        "<;<_<q<y<",
        "4 4(40444<4D4H4P4X4\\4d4l4p4x4",
        ".PAVCXXXXXHandledException@?NJ@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "?&?3?O?\\?f?",
        "    Failed to assemble source path (path key)",
        "PVWhl",
        "?0?`?",
        ";!;);5;B;J;T;`;m;v;",
        "SL_E_SRV_INVALID_PAYLOAD",
        ";&<1<p<}<",
        "CoInitializeSecurity hr = 0x%x",
        "Set %s boot entry as the default boot entry",
        "%hs: Cannot make BCD device object of type BCDE_DEVICE_TYPE_RAMDISK. Status = %d",
        "CNewSystem::GetCriticalDUPackageInformation: Failed to append updates to the CDUPackageCollection. hr = 0x%x",
        "void __thiscall UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::QuickSort(class UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo> *,class UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo> *,int,int)",
        "LastCrashDumpInfo: CrashCount %u",
        "dcc3e261-03ff-448b-994f-7216a61203a5",
        "DRVMIG",
        "SL_E_CHPA_BINDING_MAPPING_NOT_FOUND",
        ".?AV?$ArrayListEnumerator@PAVCShellFolderInfo@@@_@UnBCL@@",
        ".?AVCAddBootEntry@@",
        "WPhxD",
        "<8<A<W<{<",
        "<\"<(<5<G<U<v<",
        "Final decision for external driver package: %s",
        "9$9*9/94999>9H9U9[9b9q9w9|9",
        ".?AV?$DefaultInstanceFactory@VCFailForwardSystem@@@UnBCL@@",
        ".?AV?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "344;4Q4e415e5X6",
        "InitializeCriticalSectionEx",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::get_Item(int)",
        "939W9",
        "8#858N8U8g8s8",
        ">8>\\>l>|>",
        "pFinalizeUninstall: Failed getting status of uninstall, hr = 0x%x",
        "4'4/44494Y4k4s4y4",
        "Successfully %s WIM entry for %s.",
        "6&6<6\\6e6",
        "707N7h7",
        ":,;>;F;L;Y;k;",
        "    Failed to write start document",
        "CMediaLayout::QueueWIMSplit: Failed to get full path for %s: 0x%08x",
        "void __thiscall UnBCL::ArrayList<struct DiskRange>::Insert(int,struct DiskRange)",
        "7)7:7E7M7W7h7q7z7",
        ".?AV?$SmartPtr@VMultiSz@UnBCL@@@UnBCL@@",
        "%hs: Cannot get volume path for OS partition. Error: 0x%08X",
        "void __thiscall UnBCL::ArrayList<class CBcdSetting *>::Resize(int,int)",
        "int __thiscall UnBCL::ArrayList<class CGlobalPath *>::IndexOf(class CGlobalPath *,int,int) const",
        "Successfully read Snapshot Cleanup Period from Onesetting: %d",
        "int __thiscall UnBCL::_::HTEnumerator<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<void *,void *> * __stdcall UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::DictionaryEntry<void *,void *> *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "1 141<1R1X1p1",
        "  Installation Type = %s",
        "st-ZA",
        "FOD Validator: Failed to revert execution of data gather operation. Error: %08X",
        "<'<=<_<p<",
        "WimStringToLower",
        "ERROR_IS_SUBST_PATH",
        "Failed to set task principal. hr = 0x%x",
        "505Q5q5",
        "#D$ P",
        "VdsDisk::InitializeProperties: Failed to refresh VDS service (0x%08x)",
        "?get_Chars@String@UnBCL@@QBEABGH@Z",
        ";(;9;B;L;l;r;{;",
        "Failed to parse registry file: %s, 0x%x",
        "Failed to set element data type BCDE_DEVICE_TYPE_RAMDISK_SDI_PATH. Status = %d",
        ".?AV?$Array@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@",
        "Writing PageFiles value: %s. to config file",
        "SecondBootPhaseStartTime",
        "class CDriverDetails **__thiscall UnBCL::ArrayList<class CDriverDetails *>::GetBuffer(int)",
        "?0?8?H?y?",
        "WinREHash",
        ":':B:H:Y:`:f:k:v:",
        "6+737:7@7E7P7^7c7",
        "5'535K5]5h5t5",
        "          INF name : %s",
        "class OC::COptionalComponent *const *__thiscall UnBCL::ArrayList<class OC::COptionalComponent *>::GetBuffer(int) const",
        "ERROR_DS_DRA_BAD_DN",
        "PVhh ",
        "F(;G(",
        "3 3(343T3`3",
        "class COperationsValidator **__thiscall UnBCL::ArrayList<class COperationsValidator *>::GetBuffer(int)",
        "ERROR_DS_INVALID_LDAP_DISPLAY_NAME",
        ">\">*>7>G>_>f>m>s>~>",
        "WinHttpSendRequest",
        "5M6\\6b6",
        "NtPrivilegeCheck",
        "ERROR_IO_PENDING",
        "1+1>1o1",
        ".?AVCDismApiLayer@OC@@",
        "6$6*676I6W6|6",
        "<\"<-<A<`<",
        ":$:,:4:<:D:L:T:`:",
        ".?AVCXXXXXHandledException@?CA@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "INF %ws has no drivers, skipping package.",
        "InitDownlevelOCMode",
        ".?AU?$IEnumerator@W4ActionType@@@UnBCL@@",
        "D$(PV",
        "6)626B6\\6d6r6z6",
        "RestoreMounts failed",
        "CBS_E_SOURCE_MISSING_FROM_WU_EXPRESS",
        "8+8Q8f8r8",
        "6=6O6^6n6{6",
        "=/=<=F=Z=g=q=",
        "1$1@1G1M1Y1e1",
        "int __thiscall UnBCL::Array<class CDeploymentBase::CMountedPathInfo *>::Add(class CDeploymentBase::CMountedPathInfo *)",
        "pSPExecuteApply",
        "=*=<=G=[=m=",
        "LogSharingViolationErrorInfo",
        ":+:7:C:Q:X:^:c:n:x:",
        "SPCopyFilesAndFolders",
        "8%8.868<8P8d8v8",
        "eGeneralizationState",
        "989E9l9",
        ".?AVCXXXXXHandledException@?2??DoExecuteInternal@CDownloadDUUpdates@@IAEJHHPAUIDownloadCallback@SetupPlatform@@PAUIExecutionContext@@PAUITelemetry@@PAXPAUIDUDownloadProgress@4@PAPAVCDUPackageCollection@@@Z@",
        "Failed to allocate string",
        "<9<i<t<",
        "??0?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAE@PAVVersion@1@@Z",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::LastIndexOf(class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *,int,int) const",
        "?$?+?1?6?A?G?Z?}?",
        "ba-RU",
        "2L3^3e3o3v3|3",
        "Boot%04x",
        "%hs: Cannot export WIM image %d into %s. Error 0x%08X",
        "One or more unattend GCs requested a delayed reboot; we will reboot the computer",
        "3&323>3J3V3_3w3",
        "6#6N6Z6j6t6~6",
        "3 3<3X3|3",
        "ERROR_DS_ADD_REPLICA_INHIBITED",
        "ERROR_LOGON_SESSION_EXISTS",
        "%hs: Cannot change the Recovery partition",
        "9G9Z9",
        "4\"424H4Y4a4j4r4x4",
        ">#>F>`>}>",
        "?V?]?",
        "6\"6*6>6F6]6e6v6",
        "class CImageInfo *&__thiscall UnBCL::ArrayList<class CImageInfo *>::get_Item(int)",
        "ERROR_HIBERNATED",
        "XCCFGValidator::ValidatePreExecution",
        "8E8c8",
        "?U?f?",
        "1$262>2D2Q2c2q2",
        "%hs: Engine initialization failed with error: 0x%08X",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::RemoveAt(int)",
        "{3E97FDBA-2B4A-4437-9E3F-1CD0A4960F94}",
        "BuildDiskInfoFromPath: GetVolumeInformation failed for for %s. Error: 0x%08X",
        "Failed opening source COMPONENTS hive %ls",
        "DisableSnapshotOnLowDisk",
        "Failed to disable rollback",
        "%hs: Cannot set queue value %s. Error: 0x%08X",
        "\\windows",
        "CCreateScopedSnapshot::DoExecute: Failed to create snapshots. Error: 0x%08X",
        "5 5$5(5054585<5D5H5L5P5T5X5\\5`5d5l5p5t5x5",
        "?set_HResult@Exception@UnBCL@@MAEXJ@Z",
        "class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *__thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,&protected: static class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> * __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "ERROR_ALREADY_FIBER",
        "=(=5=B=O=[=g=s=",
        ">!>5>L>n>{>",
        "GetVersionExW",
        "030E0M0S0`0r0",
        "XpExtractWinREFromImage",
        "class CGlobalPathFindData **__thiscall UnBCL::ArrayList<class CGlobalPathFindData *>::GetBuffer(int)",
        "Found tracing session: name=[%s], logfilename=[%s]",
        ".?AU?$IEnumerator@PAVCWIMBootData@@@UnBCL@@",
        "%hs: Failed to set BCDE_OSLOADER_TYPE_BOOT_MENU_POLICY field. Status = %d",
        ".?AV?$CAutoCleanupBase@PAVSmVolume@@@RAII@@",
        "y#Wjlh",
        "313X3p3|3",
        "ERROR_NO_WRITABLE_DC_FOUND",
        "    Failed to write index attribute",
        "5&5=5D5N5^5g5n5",
        "=\"=4=<=B=K=a=k=",
        "22292?2D2c2l2t2{2",
        "3'343=3C3W3`3k3",
        "Failed to get proc address for CurrentIP.",
        "Comparing file versions:",
        "\\Windows\\System32\\ci.dll",
        "9$:`:",
        "1G1]1",
        "3#4*404<4H4T4",
        "pAddSafeOSDrivers: Failed to open %s file (0x%08x)",
        "void __thiscall UnBCL::ArrayList<enum OP_EXECUTION_PHASE>::QuickSort(class UnBCL::ArrayList<enum OP_EXECUTION_PHASE> *,class UnBCL::ArrayList<enum OP_EXECUTION_PHASE> *,int,int)",
        "$Microsoft Ireland Operations Limited1",
        "npProcessingDone",
        "Failed to get device path for %ws.",
        "JET_errIndexTuplesTextColumnsOnly",
        "void __thiscall UnBCL::ArrayList<unsigned int>::Insert(int,unsigned int)",
        "??1?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@UAE@XZ",
        "%hs: Could not find %s, skipping",
        ":(:1:S:e:",
        ".?AU?$ICollection@PAVCWIMBootData@@@UnBCL@@",
        "DISKSPACETRACK: Size of SafeOS WIM %s is %I64u",
        "sd-Deva-IN",
        "1'151C1Q1_1",
        "=$=2=@=",
        "ERROR_DS_DRA_REF_ALREADY_EXISTS",
        "y0Sh|",
        "Failed loading policymanager.dll, hr = 0x%08X",
        "JET_errMustDisableLoggingForDbUpgrade",
        "class CFailForwardSystem *const &__thiscall UnBCL::ArrayList<class CFailForwardSystem *>::get_Item(int) const",
        ".PAVCXXXXXHandledException@?FF@??pSPDoOfflineApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0H0PAUISPMigProgress@@@Z@",
        "8(8,8D8H8`8d8|8",
        ".?AVCAppInfo@@",
        "DismPreSysprep",
        "toupper",
        ".?AVCReconstructionImageInfo@@",
        "3 3/3U3_3n3",
        "Error while executing the move/copy/merge. Error: 0x%08X",
        "CSetupAutomation::ResolveTarget: Failed to persist resolved target drive: 0x%08x",
        "SPGetTotalMemory",
        "Processing profile hive: [%ws]",
        "tPPhx",
        "Mscorlib.ni.dll",
        "Failed to set NET debugging port. Status = 0x%X",
        "5\"5,5@5U5\\5b5g5r5{5",
        "ERROR_INVALID_EXE_SIGNATURE",
        "SPModifyOfflineHives",
        "9\"9*909=9O9Y9l9t9z9",
        "ERROR_MR_MID_NOT_FOUND",
        ".?AVCXXXXXHandledException@?NJ@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "system32\\",
        "Calling transformer Uninstall for %s, manifest %s",
        "<\"<,<;<O<c<x<",
        "6$6,646<6D6L6X6`6",
        "2(262>2P2Z2a2g2l2w2",
        "0 0$0(0004080<0@0D0H0L0P0X0\\0`0d0l0p0t0x0|0",
        "1)121>1R1^1h1x1",
        "class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::GetBuffer(int)",
        "SignedImage ",
        ";\";-;U;\\;b;g;r;};",
        "Storage Reserve is ignored by external request",
        "<:<A<G<L<X<f<z<",
        "Will attempt to redirect WU cache volume to %s to save download space",
        "INF %ws (%ws) %ws be removed.",
        "1$1X1`1",
        "=0=8=@=T=\\=d=t=",
        "?!?&?1?;?@?T?v?",
        "j\\Yf9M",
        "> >3>d>k>",
        "struct _GUID &__thiscall UnBCL::ArrayList<struct _GUID>::get_Item(int)",
        ".?AV?$HTDictEnumBase@V?$DictionaryEntry@PAVString@UnBCL@@H@UnBCL@@@_@UnBCL@@",
        "3+3;3B3K3P3]3m3",
        "j0Yf+",
        ";#;7;F;K;V;c;x;",
        "7!8&838A8H8R8_8l8|8",
        "%hs: Cannot get the store platform. Error: 0x%08X",
        ".?AUIDUPackageCollection@SetupPlatform@@",
        "RtlUnregisterFeatureConfigurationChangeNotification",
        "7)747<7T7\\7i7}7",
        "FirstBootPhaseEndTime",
        "97u\"3",
        "8,8<8L8\\8l8|8",
        ">4>S>w>",
        "2$2,2<2D2L2T2\\2d2l2t2|2",
        "CProcessDrivers::GetDeviceDetails",
        ";$;,;4;<;D;L;T;\\;d;l;t;",
        ":+:I:",
        "5?6F6T6j6",
        "DeleteFileW",
        "InstallStartTime",
        ";@;y;",
        ">!?D?W?_?e?r?",
        "383[3d3",
        ".PAVCXXXXXTemp@?6??pSPRemoveSourceHardlinks@@YGXPAVString@UnBCL@@@Z@",
        "QueueDataMigration called with scope %d",
        "0@1X1e1}1",
        "7,7B7p7",
        "9$979A9F9V9a9k9{9",
        "=+=x=",
        ".PAVCXXXXXTemp@?MP@??Rollback@CSetupPlatformOSSwitchCheckpoint@@UAEXPBG@Z@",
        "PWVh[",
        "3#4N4p4",
        "FreeAndZeroCSI_REPAIRED_COMPONENT",
        ".?AVCAddUnattend@@",
        "2-2T2_2",
        "XPhase",
        "VdsPartition::Format: Failed to query IID_IVdsDiskPartitionMF2 interface [%s] (0x%08x)",
        "=m=y=",
        "PolicyManager_IsPolicySetByMobileDeviceManager",
        "<'<,<@<a<h<n<s<~<",
        "{8DB138CC-2E2E-4D0B-B08E-BBE00A110A6E}",
        ";\";~;",
        "t\"f90t",
        "%hs: Failed to write volume path to file: %s. Error: 0x%08X",
        "<!<.<;<K<_<w<",
        "?Z?g?y?",
        "%windir%\\System32\\BOOT.SDI",
        "void __thiscall UnBCL::Array<class CDriverDetails *>::Remove(class CDriverDetails *)",
        ".?AVCAddAppxPackage@@",
        "262T2_2d2}2",
        "SmVolume::EnumerateMountPaths: Failed to create mount path enumerator (0x%08x)",
        "Turn off %sreserves",
        "Deserialized source OCs:",
        "JET_errNTSystemCallFailed",
        "9w$uq9w tv",
        "0%0,02070B0O0W0]0b0v0",
        "OsLoader identifier: %wZ",
        "ForcePrepareForUninstall",
        "<1<K<^<w<",
        "%hs: %s environment variable detected, simulating low disk space.",
        "Current bugcheck string  : %s",
        "FveEnableAuthenticationW",
        "?Replace@String@UnBCL@@QBEPAV12@PAV12@0H@Z",
        ">6?;?i?n?}?",
        "void __thiscall UnBCL::Array<class CAppInfo *>::InitLarva(class UnBCL::ArrayList<class CAppInfo *> *)",
        "Np|_^[",
        "Error restoring directory metadata",
        "ERROR_EVALUATION_EXPIRATION",
        "2$2,242<2H2P2l2t2",
        ">$>,>?>K>~?",
        "CApplyWIM: Failure while applying image %d for %s. Error 0x%08X",
        "828B8N8b8p8",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *> *,int) const",
        "Progress: Will not ignore registry errors",
        "??_DMemoryStream@UnBCL@@QAEXXZ",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCFileCreationData@@@UnBCL@@@UnBCL@@",
        "?)?C?d?",
        "ERROR_INVALID_PRINT_MONITOR",
        "5J6t6",
        "Array size too big",
        "PPh!@",
        "SVhpY",
        "%s\\Control\\MUI\\UILanguages",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CInfFile *>::Reset(void)",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::Resize(int,int)",
        "CSetupPlatform::CreateNewSystem: Invalid parameter(s)",
        "<*<6<y<",
        "JET_errUnicodeNormalizationNotSupported",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::Insert(int,class UnBCL::DictionaryEntry<class UnBCL::String *,int> *)",
        "]._g*",
        "JET_errRollbackRequired",
        "Backup the recovery partition to %s",
        "1:1W1o1",
        "CWIMBootHelper::CreateFileW: Cannot get WIM attributes. Error: 0x%x",
        ".PAVCXXXXXHandledException@?2??SPGetFileOpenedByPIDs@@YGPAV?$ArrayList@K@UnBCL@@PBG@Z@",
        "CSetupAutomation::GetDriveLetter: Failed to get disk properties: 0x%08x",
        "VdsPartition::EnumerateLogicalPartitions: Failed to create logical partition enumerator (0x%08x)",
        ".?AU?$IEnumerator@PAVCImageInfo@@@UnBCL@@",
        "CSetupAutomation::Initialize: Unrecognized answer file (0x%08x)",
        "ERROR_DS_DNS_LOOKUP_FAILURE",
        "4+444@4L4U4^4s4",
        "> >(>1>D>Z>e>t>",
        "Apply (first boot apply from ICB, online phase): Migration phase failed. Result: %d, no specific error",
        "%hs: ProvMigration failed. Error: 0x%08X",
        "SPGetSnapshotCreationTimeFromVSS: Failed to query snapshot property. Error: 0x%08X",
        "2,202H2L2d2h2",
        "JET_errOneDatabasePerSession",
        "4&41484>4C4N4Y4m4|4",
        "{9F89C83F-3AA2-4C5C-8634-B1374F46C4AC}",
        "Final list of OS pieces:",
        "6-6<6M6d6w6",
        "SafeOS",
        "ERROR_NOT_CONNECTED",
        "?!?+???F?L?Q?\\?f?y?",
        "2,23292>2I2S2f2n2y2",
        "ProcessJournalEntries: Malformed entry ignored: %s",
        "4$464D4h4",
        "|SYSPART|\\|DEST|",
        "\\program files",
        "ERROR_MOD_NOT_FOUND",
        "void __thiscall UnBCL::Array<class CDUPackage *>::Remove(class CDUPackage *)",
        "30363H3\\3i3z3",
        "=4>A>^>r>",
        "9C9X9g9p9",
        "7'7=7F7X7l7y7",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::RemoveAt(int)",
        "434`4k4",
        "7&7/787I7h7v7",
        ";%;2;:;?;^;p;",
        "1:1@1J1O1Y1`1n1",
        ":8:M:`:h:n:{:",
        "9#999P9f9",
        "Working directory %s",
        "5;5L5Y5f5",
        "JET_errBadPageLink",
        "!1!09u",
        ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:",
        "BuildFileNodeHashTable",
        "9S9c9",
        "ERROR_GLOBAL_ONLY_HOOK",
        ".PAVCXXXXXTemp@?FM@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "646;6A6F6Q6X6l6{6",
        "404>4W4^4e4k4w4",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::Reset(void)",
        ";?;F;L;Q;];e;y;",
        "80888>8K8]8k8",
        "VdsPartition::SetUsage: Couldn't get disk object (0x%08x)",
        "?C?R?",
        ".?AV?$SerializableBase@VCFinalizeCriticalBoundary@@$0A@V?$DefaultInstanceFactory@VCFinalizeCriticalBoundary@@@UnBCL@@@UnBCL@@",
        "pFindAndAddFiles: Invalid file name string %s passed",
        ")VdsDisk::CreatePartition",
        ".?AV?$DefaultInstanceFactory@VCDUClientAppInfo@@@UnBCL@@",
        ".?AV?$ValueCollection@W4OP_OPERATION_ID@@H@_@UnBCL@@",
        "=*=2=8=A=W=`=x=",
        ".?AV?$ArrayListEnumerator@PAVCCFGSectionValue@@@_@UnBCL@@",
        ";2;C;P;Y;a;u;",
        "ActionPlatform::DeleteDirectory",
        "SETUPPLATFORMCOMM: Progress message received: Phase: %s, Operation: %s, Percentage: %d%%",
        ";!;);5;=;y;",
        "CBS_E_MANIFEST_VALIDATION_DUPLICATE_ATTRIBUTES",
        "<U<b<t<|<",
        "?GetDirectoryRoot@Directory@UnBCL@@SGPAVString@2@PBV32@@Z",
        ":<:B:K:S:b:i:o:t:",
        "LaunchWimserv",
        "9C9J9P9U9`9l9",
        "ActionPlatform::LaunchModule: DLL %s cannot be loaded offline; will defer to online",
        "ERROR_DS_ALIASED_OBJ_MISSING",
        "reagent.dll",
        "Cabinet.dll",
        "2$2(2@2D2\\2`2x2|2",
        "CDUPackage::UnpackTo: Failed to copy update contents to destination %s. hr = 0x%x",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCShellFolderInfo@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "void __thiscall UnBCL::Array<class CFileCreationData *>::RemoveAt(int)",
        "1/1E1]1l1r1",
        "D$,Pj",
        ":(:8:E:M:_:g:l:w:",
        ".?AV?$DefaultInstanceFactory@VCSetupPlatform@@@UnBCL@@",
        ".0:0J0V0`0i0y0",
        "123456789:;<=>?@ABCDEFGHIJKLMNO",
        "SL_E_INTERNAL_ERROR",
        "VjRjq",
        ">->=>L>R>a>x>",
        ".?AUICbsUIHandler@@",
        "202<2\\2d2l2t2",
        "%hs: Unknown rollback option requested: %d",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CCopyInfo *>::Reset(void)",
        "Sources\\mountpaths.dat",
        "7\"7/787H7T7^7j7r7z7",
        "OSRollbackService::CCheckpoint::MoveOrCopyFiles: Source directory %s does not exist; nothing to do",
        "Copy appx license from %s to %s",
        ".?AV?$DefaultInstanceFactory@VCUpdateBootSector@@@UnBCL@@",
        "<2<I<g<r<w<",
        "7&7.787?7E7J7U7`7f7z7",
        "ERROR_UNABLE_TO_UNLOAD_MEDIA",
        "CERT_E_CN_NO_MATCH",
        "L$(@3",
        "2)2A2I2a2y2",
        ".?AVStringProperty@?1???$pDefineStringProperty@V<lambda_4b611fffb2e0d99bcc8f30ab507875dd>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_4b611fffb2e0d99bcc8f30ab507875dd>@@@Z@",
        "0!060>0D0Q0c0|0",
        "3%4,4;4Q4\\4m4",
        "?4?8?P?T?l?p?",
        "INETPUB",
        "Source is WimBoot OS",
        "Failed to query if this devices is connected standby. Error: 0x%08X",
        ":<:D:[:b:h:m:",
        "VerQueryValueW",
        "LocalFileTimeToFileTime",
        "SPLogProcessNames",
        "5V5f5n5",
        "=J=o=",
        ".?AV?$CAutoComFree@PAPAG@RAII@@",
        "ERROR_IPSEC_CLEAR_TEXT_DROP",
        "=*=7=D=L=R=X=e=y=",
        "1*131@1I1Q1d1s1",
        "Could not find information about the new WinRE partition. Error: 0x%08X",
        "ERROR_INVALID_EVENT_COUNT",
        "ERROR_INSTRUCTION_MISALIGNMENT",
        "JET_errKeyIsMade",
        "ERROR_AUTODATASEG_EXCEEDS_64k",
        "ERROR_INVALID_SEGDPL",
        "@Ph8&",
        "3.393@3N3X3z3",
        "1$1N1U1a1f1v1~1",
        "MSFT_Partition",
        "CI EA is not supported due to mismatched versions of host OS and applied image.",
        "EFI\\Microsoft\\Recovery",
        "5\"585O5j5x5",
        "ERROR_LOG_SECTOR_INVALID",
        "P~4jPj",
        "\\\\?\\UNC",
        "Pass status for %s after running: %d",
        "ERROR_FT_WRITE_RECOVERY",
        "=,=6=S=b=q=",
        ":$ETLUNIQUECVDATA",
        "3D3x3",
        "    Failed to enumerate payloads",
        "ERROR_CHECKOUT_REQUIRED",
        ":!:):7:G:a:",
        "SF Validator: Users/shell folders dissapeared/changed, will invalidate data gather operation",
        "5#545A5J5T5[5e5t5~5",
        "xSPGetFreeMemory",
        "void __thiscall UnBCL::ArrayList<class CAntiVirusInfo *>::Resize(int,int)",
        ".?AU?$IList@PAUISerializable@UnBCL@@@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::set_Item(int,class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *)",
        "9)929;9N9U9[9`9k9u9z9",
        "Cannot read the recovery phase.",
        "DiskLayout::ApplyProperties: Failed to format volume: 0x%08x",
        "SPCleanupAfterRollback",
        "failed transaction commit",
        "8B9[9`9",
        "fXf[f",
        "<e=z=",
        "1&1/181A1J1S1^1i1t1",
        "ProvisioningPackage::GetAuthor",
        "int __thiscall UnBCL::ArrayList<struct DISK_SPACE_IMPACT>::IndexOf(struct DISK_SPACE_IMPACT,int,int) const",
        "QueryPerformanceFrequency",
        "5$5)515<5",
        ":%:+:?:S:e:~:",
        ".PAVCXXXXXHandledException@?EF@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "GetVolumePathNamesForVolumeNameW",
        "es-PR",
        "Failed to clear device element after failure. Status = %x",
        "ERROR_KEY_DELETED",
        "4*434=4",
        "Cannot calculate weight for finalize operations. Likely the sort operation failed.",
        "454B4T4\\4b4o4",
        ".PAVCXXXXXHandledException@?EB@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        ".?AV?$SmartPtr@VCDismApiLayer@OC@@@UnBCL@@",
        "%hs: Re-adding safe OS BitLocker hash %s",
        "Failed to write installation type to %s. Error: 0x%08X",
        "20272=2I2U2",
        "3efabf46-3037-4c85-a752-3189e574b621",
        ";#;G;",
        "7$7,74787@7H7P7T7X7`7d7h7l7p7t7|7",
        "%hs: Failed to open BCD bootmgr handle. Status = 0x%08X",
        "1 1W1",
        ".?AVExternalException@UnBCL@@",
        "1(1,1D1H1`1d1|1",
        "Failed opening source Setup",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$Array@E@2@@UnBCL@@@_@UnBCL@@",
        "2S2c2",
        "6'696A6G6[6a6j6",
        "9!9E9e9",
        "?DecRef@Object@UnBCL@@QAEHXZ",
        "ERROR_IPSEC_IKE_FAILSSPINIT",
        "ERROR_ALREADY_WIN32",
        "Starting the wait in wait routine",
        "ERROR_CLUSTER_POISONED",
        "Failed to get diagnostics directory, merging data file fialed. hr = 0X%x",
        "D$pSVW",
        "<\\<u<|<",
        "(%lx): Failed to rename value [%ws] to [%ws]",
        ".?AV?$DefaultInstanceFactory@VCDownloadDUUpdates@@@UnBCL@@",
        ">+?2?n?u?",
        "7\"7+7A7R7[7g7{7",
        ";6;T;c;h;",
        "6X6_6e6j6u6",
        "class CSimpleCleanup::CCleanupEntry *&__thiscall UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *>::get_Item(int)",
        "7&7U7\\7b7g7r7}7",
        "0$060Z0l0",
        "void __stdcall ForEachPartition<class ForEachVolume::<lambda_93e097f692a0ecd7060ae525f7768550>>(struct SetupPlatform::IDisk *,class ForEachVolume::<lambda_93e097f692a0ecd7060ae525f7768550>)",
        " SetupPlatformTelActivityEvent",
        "RPC_S_BINDING_HAS_NO_AUTH",
        "8'8N8r8",
        "80888B8T8\\8p8x8",
        "0+0c0r0",
        "class UnBCL::ArrayList<class OC::COptionalComponent *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class OC::COptionalComponent *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        ".?AV?$DefaultInstanceFactory@VCOOBEBootApplyFromICB@@@UnBCL@@",
        "long __thiscall OC::COfflineOCManager::RestoreOCStatus(class OC::COCCollection *)",
        "Partition [%ws] found in disk [%d].",
        "ERROR_DS_NOT_SUPPORTED",
        "9J9Q9p9",
        "L$$9t$ t",
        "CSetupAutomation::ResolveTarget: Unsupported state: install image is not a WIM file!",
        "%hs: Failed to write the new OS pieces to the %s config file. Error: 0x%08X",
        "ca-ES",
        "CSetupPlatformApplyRollbackCheckpoint::UndoTransformers",
        "FindGlobalPath: GetVolumeInformation failed for for %s. Error: 0x%08X",
        "__thiscall UnBCL::ArrayList<class OC::COptionalComponent *>::ArrayList(const struct UnBCL::ICollection<class OC::COptionalComponent *> *)",
        "SPLevel",
        "BootDriverFlags.Bak",
        "JET_errRunningInMultiInstanceMode",
        "ReconstructionEstimationElapsedTime",
        "%hs: Current user environment could not be retrieved.",
        "4,4Y4l4s4y4~4",
        ":&:/:8:A:J:S:\\:e:n:w:",
        "5&5,515<5C5W5}5",
        "JET_errTooManyInstances",
        "6$686M6c6|6",
        "< <.<<<J<",
        "%hs: DU was not initialized; proceeding.",
        ".?AVCXXXXXHandledException@?M@??DoExecute@CFinalizeSafeOSBootRemoval@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ")SPGetDevicePathFromVolumeName",
        "SPApplyAnswerFileSettings: Failed to create %s directory (0x%08x)",
        "4$484>4G4]4j4|4",
        ">D?p?",
        "XComplete servicing operations",
        "tiPQP",
        ";!;,;J;z;",
        "8#8>8D8N8S8]8d8r8",
        "6$6*6=6N6U6[6`6k6q6",
        "IVdsDisk",
        "Failed to save diag track support state to file: %s. Error = %d",
        "void __thiscall UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::Insert(int,class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *)",
        ".PAVCXXXXXTemp@?NO@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ".?AU?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@@UnBCL@@",
        "Uninstall",
        "WDSUTIL.dll",
        ";\";);6;B;K;W;\\;e;l;y;",
        "pSPStartAutoStartingServices: Failed to signal SC_OOBE_MACHINE_NAME_DONE event.",
        "Sources\\SetupPlatform.Drivers.External.ini",
        "2S2h2q2}2",
        "qsort",
        "1(252G2O2U2b2t2",
        ".{Test_%s}",
        "ERROR_DS_NAME_ERROR_DOMAIN_ONLY",
        "131U1",
        "Too many unexplained failures. File: %s Last status: %x",
        ".amd64",
        "CMediaLayout::QueueInstallImage: Only installation WIMs are currently supported",
        "{CF937864-809B-4697-832C-7A7C6D49D626}",
        ".?AV?$SerializableBase@V?$Hashtable@GH@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@GH@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        ".?AV?$CAutoCleanupBase@PAUIMigRegistryInfo@@@Mig@@",
        "3\"4L4]4d4v4}4",
        "Opening DISM session for %s",
        "    Failed to get metadata value",
        "2#2)2.292H2P2Y2a2g2l2",
        "VdsPartition::GetVolume",
        "void __stdcall ForEachPartition<class <lambda_45f26f953671ba29c8678a5b25f77b79>::()::<lambda_d25f31d283c83d3cd25b921d77fa85dc>>(struct SetupPlatform::IDisk *,class <lambda_45f26f953671ba29c8678a5b25f77b79>::()::<lambda_d25f31d283c83d3cd25b921d77fa85dc>)",
        "MigGetRealPlatform",
        "HARDRESERVETRACK: Needed for op: %I64d",
        "> >.><>J>",
        "<(<0<8<D<L<l<",
        "EVERYTHING",
        "ERROR_DS_SCHEMA_NOT_LOADED",
        ".?AU?$IList@PAVCOperationResult@@@UnBCL@@",
        "en-NZ",
        "<,<0<H<L<d<h<|<",
        "CReconstructOS::ReconstructWindows: Failed to set up log output from cbs_pbr.lib: 0x%08x. Proceeding without logs...",
        ".?AV?$CAutoCleanupBase@PAVWmiCall@WMI@@@RAII@@",
        "pDUDownload: Failed to retrieve count of updates. hr = 0x%x",
        "memcmp",
        "1+1H1n1~1",
        "<+<<<P<\\<h<t<",
        "<,<4<<<D<L<X<x<",
        "ERROR_IPSEC_IKE_INVALID_MAJOR_VERSION",
        "CSIDL_MYDOCUMENTS",
        ":l:s:y:",
        "ERROR_DS_NTDSCRIPT_SYNTAX_ERROR",
        "ERROR_DS_AFFECTS_MULTIPLE_DSAS",
        "6D7]7d7k7r7y7",
        "8(8>8T8f8n8t8",
        "Re-initialize Reserves",
        "080M0`0h0n0{0",
        "  Component name: %s",
        "ERROR_RDP_PROTOCOL_ERROR",
        "Simple",
        "int __thiscall UnBCL::ArrayList<class CProfileInfo *>::LastIndexOf(class CProfileInfo *,int,int) const",
        "Failed to create OneSettings infrastructure. Error: 0x08%X",
        "SclProcessObjectSecurity",
        "pSPDeleteExpiredUpgradeSnapshots: Failed to delete snapshot [%s]. Error: 0x%08X",
        "long __thiscall CDUPackage::UnpackTo(const unsigned short *)",
        "DiskLayout::VerifyLayoutModifyIndices",
        "  PathID: %s",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *> *,int) const",
        "1G1L1",
        "ERROR_DOMAIN_CONTROLLER_NOT_FOUND",
        "CSetupAutomation::ResolveTarget: Failed to partition disks: 0x%08x",
        ">&>/>8>C>K>R>n>w>",
        "FullFlash",
        "GetFileStorageTierClass",
        ".?AV?$CAutoWdsLibFree@PBG@RAII@@",
        ".?AV?$DefaultInstanceFactory@VCDisableFeature@@@UnBCL@@",
        "Reading onesettings disabled.",
        "IMAGE\\WIMBOOT",
        "0Z0o0",
        "VdsPlatformDiskEnumerator::GetNext: Failed to query IID_IVdsVdProvider interface [%s] (0x%08x)",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *> *,int,int)",
        ".?AV?$SmartPtr@V?$Hashtable@PAVString@UnBCL@@H@UnBCL@@@UnBCL@@",
        "ERROR_RM_NOT_ACTIVE",
        "Sources\\RecoveryPartitionBackup",
        "class CDriverDetails *const &__thiscall UnBCL::ArrayList<class CDriverDetails *>::get_Item(int) const",
        "VdsPartition::CreateLogicalPartition",
        "=0=@=L=\\=x=",
        "w!j:Xf;",
        "7Q7g7v7",
        "1*171?1\\1i1s1z1",
        "b0g0l0",
        "VdsVolumePathEnumerator::GetNext",
        "ReadEncryptedFileRaw",
        "PBR: Mum servicing LCU in pending: %ws",
        "%hs: Failed to set rollback description for the SafeOS, ignoring error. Status = 0x%08X",
        "BfsRepair: Failed to get system volume %08x",
        "jPhx+",
        "8-8>8G8X8q8x8",
        "5-555?5F5L5Q5\\5h5m5",
        "989N9d9",
        "> >$>,>4>8><>D>H>L>P>T>X>`>x>|>",
        "void __thiscall UnBCL::ArrayList<class CDriverDetails *>::QuickSort(class UnBCL::ArrayList<class CDriverDetails *> *,class UnBCL::ArrayList<class CDriverDetails *> *,int,int)",
        ".?AV?$CAutoCleanupBase@PAUHINSTANCE__@@@RAII@@",
        "=#=@=",
        "1\"1.1f1k1",
        ";1;G;N;T;Y;d;n;",
        "PVWhQ",
        "7.7:7B7]7m7",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::LastIndexOf(class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *,int,int) const",
        "5D5V5]5m5t5",
        "%hs: Image state is not supported for full upgrade: %s",
        "1)1G1d1k1q1v1",
        "1T1}1",
        "  Package file: %s",
        ":*:2:8:L:R:[:q:~:",
        "5&575Q5e5",
        "< =x=",
        "141;1r1y1",
        ">)?B?p?",
        "SmDisk::Initialize: Failed to create partition enumerator (0x%08x)",
        "0>0L0y0",
        "=&=:=F=R=^=j=v=",
        "<!<0<L<^<f<",
        "CNewSystem::QueueSetupAutomation: Failed to get product key (0x%08X)",
        "CDownloadDUUpdates::DoExecuteInternal: Insufficient space to download and install updates; will skip download.",
        "ERROR_DS_HIERARCHY_TABLE_TOO_DEEP",
        "CloseThreadpoolTimer",
        ";$;D;p;",
        "void __thiscall UnBCL::ArrayList<class CGlobalPath *>::RemoveAt(int)",
        ".PAVCXXXXXHandledException@?GE@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "1\\1j1{1",
        "3.4:4L4x4",
        "3_^[]",
        "ERROR_BUSY_DRIVE",
        "575<5H5k5p5|5",
        "9 9'9-929=9H9\\9d9}9",
        "ElementEnumerator::GetNextElementType",
        "void __thiscall UnBCL::Array<class COperationsValidator *>::InitLarva(class UnBCL::ArrayList<class COperationsValidator *> *)",
        "OLEAUT32.dll",
        ".?AV?$SerializableArrayBase@PAVCFileCreationData@@@_@UnBCL@@",
        ":':4:A:M:U:w:",
        "yb9\\$",
        "4'4Q4s4",
        "0R1^1",
        "ERROR_INVALID_CATEGORY",
        "(%lx): Failed to calculate load key for the old hive [%ws]",
        "targetOCStatus",
        "6!6*666?6H6Q6j6t6}6",
        "Product",
        ";&;/;7;D;S;k;r;x;",
        "7 7(727:7@7E7T7`7g7m7r7}7",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment",
        "CMediaLayout::Initialize: Failed to get full path to work dir: 0x%08x",
        "4;5R5i5s5",
        "?3?D?L?V?h?p?",
        "WIM entry file %s no longer exists, was likely removed before getting here.",
        "PWWWQ",
        "base\\ntsetup\\setupplatform\\lib\\util\\operations.cpp",
        "9(9F9R9d9",
        "6 6,686D6P6\\6h6t6",
        "< <2<@<G<M<R<]<d<",
        "60686C6T6[6a6f6q6|6",
        "<5<Q<",
        "\\$windows.~bt\\",
        "CMergeWIM::DoExecute: Cannot delete source file %s. Error: 0x%x",
        "FirstBootOfflineApplyIncomplete",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::Remove(class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *)",
        "__thiscall UnBCL::ArrayList<class CDeploymentBase *>::ArrayList(const struct UnBCL::ICollection<class CDeploymentBase *> *)",
        "02090?0D0P0[0h0p0}0",
        "WIMRemountImage",
        ".?AV?$HTDictEnumBase@V?$DictionaryEntry@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@@_@UnBCL@@",
        "CDUDownloadProgressWrapper::Invoke",
        "Autounattend.xml",
        "=7=C=U=]=c=u=",
        "5^5d5}5",
        ";,;0;H;L;d;h;",
        "<$<,<4<<<D<L<X<`<",
        "SetupPlatform: Executing StopAsync commands: Failure while executing command %s. Error: 0x%08X",
        "RecordFileDataLocation",
        "CSIDL_COMMON_MUSIC",
        ".?AU?$IEnumerator@PAVCDriverInfo@@@UnBCL@@",
        ":&:;:M:[:z:",
        ".?AV?$CAutoCleanupBase@PAVString@UnBCL@@@RAII@@",
        "7$7/767J7X7",
        "00070=0B0M0W0j0",
        "3$3,343<3D3L3T3`3",
        "REG_LINK",
        "?LoadXml@XmlDocument@XmlLite@UnBCL@@QAEXPAVString@3@@Z",
        "1$1,141<1D1L1T1\\1d1l1t1|1",
        "=(=k=z=",
        "%s\\Control\\ProductOptions",
        "struct SetupPlatform::IDisk *&__thiscall UnBCL::ArrayList<struct SetupPlatform::IDisk *>::get_Item(int)",
        "DISKSPACEQUERY(external request): Calculating disk space needed:",
        "IsActive",
        ";(;8;H;X;h;x;",
        "=!=_=j=t=",
        "SclpResolveRequest",
        "182?2",
        "Pre-Finalize",
        "0*020d0t0",
        ":\":+:7:@:I:Z:d:m:v:",
        "2$2,242<2D2L2T2`2h2",
        "int __thiscall UnBCL::ArrayList<class CProfileInfo *>::BinarySearch(int,int,class CProfileInfo *,struct UnBCL::IComparer<class CProfileInfo *> *)",
        ".?AV?$ArrayList@PAVCProfileInfo@@@UnBCL@@",
        "RetryBugCheckCode",
        "sr-SP-Cyrl",
        "333A3K3i3",
        "Past recovery phase %d does not match current phase %d. Resetting recovery attempts",
        ".rsrc$02",
        ">8>M>T>Z>_>k>s>",
        "y,Sh ",
        "1/171>1L1b1v1",
        "Failed to query process info. Status: %x",
        "class OC::COptionalComponent *&__thiscall UnBCL::ArrayList<class OC::COptionalComponent *>::get_Item(int)",
        "Detecting OCs using manifests in folder (%s)...",
        "(%lx): Failed to retarget links",
        "fYfYfYfY",
        ";(;H;",
        "SPGetFootprintCapabilities: Failed to construct full path to file %s. Error: 0x%08X",
        "1%1+1=1Q1^1x1",
        "5#535;5A5G5W5g5o5u5{5",
        "?Delete@File@UnBCL@@SGXPBVString@2@@Z",
        "GetThreadLocale",
        "4<5L5b5i5{5",
        "7%757E7g7",
        "CDeploymentProject::CreateFolderDeployment: Failed to set boot app in SafeOS image file (0x%08x)",
        "CBS_S_STACK_RESTART_REQUIRED",
        "1?1F1",
        "SPDeleteAllSnapshots: Failed to delete snapshot. Error: 0x%08X",
        "%s|%s|%s|GlobalPath,%s,%u,%I64u,%u%s%s",
        "4$5`5",
        "JET_errKeyTooBig",
        "ZwFilterBootOption",
        "ReleaseVolumeAccessPath: Access path '%c:\\' is not ref-counted, skipping release.",
        ";=;E;k;s;x;};",
        "343E3R3c3w3",
        "Failed setting installed state for package %S",
        ".?AVCDeviceInfoData@CDeviceIdDatabase@@",
        "System.ni.dll",
        "There are %d existing snapshots",
        "Failed to get size of destination string.",
        "Canoot delete all snapshots. Error: 0x%08X",
        "Creating OsLoader object.",
        "WIM_FileData_Queue_Length",
        "%hs: Failed to create backup of BootDriverFlags. Error: 0x%08X",
        ".?AV?$ArrayList@UDISK_SPACE_IMPACT@@@UnBCL@@",
        "%hs: Cannot load the hive %s for the offline OS. Error: 0x%08X",
        "1#1.181=1Q1Y1",
        "Failed to open a handle to the object element. Status = [%x]",
        ".?AV?$SerializableBase@V?$Array@PAVCImageInfo@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCImageInfo@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "= =&=+=6=@=S=",
        "ERROR_IPSEC_IKE_UNSUPPORTED_ID",
        "7%7,737:7A7H7N7X7z7",
        "license.rtf",
        "jHXPj",
        "1 1/1>1G1Q1Z1d1m1w1",
        "6.676@6U6^6g6",
        ">&>4>",
        "CDeploymentBase::CMountedPathInfo::StreamRead",
        "Register async process",
        "PQhX,",
        "SETUPPLATFORMCOMM: Got a connection to a broadcast pipe.",
        "6 6J6O6U6[6a6g6m6s6y6",
        "SP_BATTERY_INFO",
        "SERVICINGDATA",
        "pSPRestoreUserShellFolder",
        "8\"848S8",
        "?GetFileName@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        ".PAVCXXXXXHandledException@?LF@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "SL_E_LICENSE_SIGNATURE_VERIFICATION_FAILED",
        "void __thiscall UnBCL::ArrayList<class CDriverDetails *>::CopyTo(class UnBCL::Array<class CDriverDetails *> *,int) const",
        "ERROR_SXS_XML_E_UNBALANCEDPAREN",
        "Creating a transformer executor",
        "Transformers INI file %s is missing.",
        "AQRRh",
        "User profile suffix mismatch, upgrade cannot continue.",
        "2H3l3",
        "(%lx): Unable to get system device information.",
        "=$=(=,=0=8=\\=d=h=l=p=x=",
        "8\"838;8B8U8k8",
        "FastCleanupCompleteState",
        "void __thiscall UnBCL::ArrayList<class CProfileInfo *>::CopyTo(class UnBCL::Array<class CProfileInfo *> *,int) const",
        "Qj<jlQ",
        "6,6E6L6S6Z6a6h6n6x6",
        "imagehlp.dll",
        "ERROR_DS_COULDNT_CONTACT_FSMO",
        "2$2-252<2K2T2]2e2l2z2",
        "Failed to get the set of devices ids for all devices, Err = 0x%lx",
        ".?AVCEnableSerialDebugging@@",
        "2 282<2T2X2p2t2",
        "CReconstructOS::DoExecute: Finished re-staging Windows installation",
        "EnableKernelFlags",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCMountedPathInfo@CDeploymentBase@@@UnBCL@@@UnBCL@@",
        "0#0(030>0R0o0{0",
        "SKIPBOOTTRACK(SAFEOS): Failed to get SafeOS boot removal OneSetting, 0x%x",
        "7+7=7K7z7",
        "MetaDeployment.Env.Debug",
        "?,?2?F?~?",
        "CTestHookDUUpdate::GetUpdateSize: Failed to calculate size of Update in [%s]. hr = 0x%x",
        "+T$\\+",
        "0/0N0Z0r0",
        "pDUSearch: DUSearch result code indicates partial success. Operation result code = %d",
        "|$@9D$P",
        "5)50565;5F5Q5e5z5",
        "%hs: Cannot queue OC replication. Error: 0x%08X",
        "7,747<7D7P7t7|7",
        "6A6e6",
        "%s\\%s(%d)",
        "SYSTEM\\Setup\\DeploymentInProgress",
        "HSVW3",
        "void __thiscall UnBCL::Array<__int64>::Insert(int,__int64)",
        "6@7k7p7",
        "SclCreateKey failed to open key under [%ws], returning STATUS_INSUFFICIENT_RESOURCES; skipping...",
        "\\I386",
        "disablecmdrequest.tag",
        "fY[ZfYfY",
        "CUnmountWIM::DoExecute",
        "%hs: Failed to get footprint capabilities; hr = 0x%08X",
        "/040G0",
        "3`3s3~3",
        "5 5]5j5",
        "ERROR_PATH_BUSY",
        "=V>j?y?",
        ":$:4:8:H:L:\\:`:p:t:",
        "=)=;=S=Y=o=",
        ":-:4:A:M:U:\\:b:g:r:}:",
        "CRYPT_E_NOT_IN_CTL",
        "int __thiscall UnBCL::ArrayList<class CUserProfile *>::LastIndexOf(class CUserProfile *,int,int) const",
        ".?AV?$ArrayListEnumerator@PAVCDeviceInfoData@CDeviceIdDatabase@@@_@UnBCL@@",
        "0L0[0b0",
        "Copying to [%ws]",
        "<2<f<z<",
        "7!7)737D7Q7m7z7",
        ":);2;<;L;",
        "?:?I?",
        "const enum OP_OPERATION_ID *__thiscall UnBCL::ArrayList<enum OP_OPERATION_ID>::GetBuffer(int) const",
        "XML parse error while loading script %s. Message: %s",
        "zh-SG",
        "WdsRemoveDirectory: Unable to clear attributes on [%s]; GLE = 0x%x",
        "SPFindImageDisk: Can't read disk properties (0x%08x)",
        "1:2`2",
        "?!?+?5?>?H?^?",
        "f`fPfQf3",
        "SclStateRecordResults",
        "WVh8v",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@@UnBCL@@",
        "ERROR_NULL_LM_PASSWORD",
        "ERROR_LAST_ADMIN",
        "SL_E_APPLICATION_POLICIES_NOT_LOADED",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CDUPackage *>::Reset(void)",
        "4*474?4H4M4Z4l4",
        ".PAVCXXXXXTemp@?7??SPValidateMigratedServices@@YGJPAVString@UnBCL@@@Z@",
        "0,0?0X0m0",
        "SetupOverride",
        "{EFAB52C0-05CB-4B83-BF9A-A50FC94F4D41}",
        "void __thiscall UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::CopyTo(class UnBCL::Array<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo> *,int) const",
        "?.?L?[?j?y?",
        "3+31383B3O3V3`3q3~3",
        "ERROR_EVT_CANNOT_OPEN_CHANNEL_OF_QUERY",
        "int __thiscall UnBCL::ArrayList<class CAppInfo *>::LastIndexOf(class CAppInfo *,int,int) const",
        ".?AVMutableString@UnBCL@@",
        "L$hQS",
        "\\Windows\\System32\\",
        "RPC_S_CALL_CANCELLED",
        "?-?r?|?",
        "SL_E_FREE_CAL_NOT_FOUND",
        "RollbackExecuteSequence: Checkpoint sequence was disabled, setting checkpoint failed. If setup terminated at that point we should be able to rollback.",
        "-0O0t0",
        ")TargetOSBuildNumber",
        "0K0a0",
        "ERROR_CLUSTER_NODE_ALREADY_HAS_DFS_ROOT",
        ";+;=;E;K;X;j;",
        "0\"050<0B0G0R0a0i0o0",
        "6\"6)676H6N6b6n6",
        ".?AV?$SerializableBase@V?$Array@PAVCOperationInfo@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCOperationInfo@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "1,151B1K1[1`1k1w1",
        "QQSV3",
        "2;2B2H2M2X2d2i2t2{2",
        "class OC::COptionalComponent *__stdcall UnBCL::Try_Cast<classOC::COptionalComponent*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "??6SerializationStream@UnBCL@@QAEAAV01@PBVString@1@@Z",
        "CoCreateInstance failed for CLSID_TaskScheduler. hr = 0x%x",
        "Error creating the progress pipe",
        "ImageBeginImpersonation",
        "3E4S4s4",
        "7.7@7H7N7[7m7{7",
        "CUpdateBootCode::DoExecute: An error occurred while repair system partition. Root path [%s]. Error: 0x%08X",
        "ERROR_DS_CONTROL_NOT_FOUND",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAK@Z",
        "7 7,7L7T7\\7d7l7t7",
        "9^8tM",
        "050B0T0\\0b0k0",
        "8.8G8Z8c8~8",
        "9$9:9A9G9L9[9e9x9",
        "u6WPj(",
        ".?AU?$IList@PAV?$DictionaryEntry@_JPAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "RollbackDumpType",
        ">1>=>G>X>a>m>}>",
        "<#<*<4<A<R<c<t<|<",
        "<'<9<P<{<",
        ".?AV?$CAutoCleanupBase@PAG@RAII@@",
        "ProcessSecurityData",
        ".?AVCBCDManipulator@OSRollbackUtils@@",
        "0'0/050:0I0N0[0k0r0}0",
        "1$1,141<1D1\\1`1l1",
        "class Mig::CBasicEnv *__stdcall UnBCL::Try_Cast<classMig::CBasicEnv*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "6)61676D6V6d6",
        "??6SerializationStream@UnBCL@@QAEAAV01@PBUISerializable@1@@Z",
        "=(=-=A=f=s=}=",
        ":):4:B:",
        "D:(A;;GA;;;BA)(A;;GA;;;SY)",
        "Path %s already contained in %s",
        "APPX Validator: Ignoring validator failure due to environment variable.",
        "9%9+989J9X9",
        "868O8X8j8",
        "PVWhE",
        "migcore.dll",
        "CRYPT_E_VERIFY_USAGE_OFFLINE",
        "t*QVjd",
        "CEnableSafeOSPageFile::DoExecute: There is no existing pagefile, and there was no hard requirement for pagefile.",
        "8 8&838H8V8d8r8",
        ":%:6:H:O:U:Z:e:l:",
        ":!:&:1:8:=:Q:`:",
        "[QVj3jOh",
        "181v1",
        "WIM_Enumerate_Directory_Reparse_Point",
        "%hs: WDSServer parameter cannot be NULL.",
        "< <$<(<,<0<4<8<@<D<H<L<T<X<\\<d<h<l<t<x<|<",
        ">!>'>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>",
        "imagePath",
        "Client requested to suspend BitLocker unconditionally",
        "D$0hPx",
        "Migrated keys/values below the threshold limit, will return [0x%08X]",
        ":0;_;",
        "dShutdownRequested",
        ".?AV?$CAutoRelease@PAUIWpxWriteOpt@@@RAII@@",
        "uch([",
        ".?AV?$DefaultInstanceFactory@VCProcessDrivers@@@UnBCL@@",
        ";/;;;G;S;};",
        "ERROR_VERSION_PARSE_ERROR",
        "Failed to read the boot entry GUID for the new OS. Error: 0x%08X",
        "Failed to set NET debugging DHCP usage. Status = 0x%X",
        "?GetLocalMachine@Registry@UnBCL@@SGPAVRegistryKey@2@XZ",
        "D$(j\\P",
        "SPGetWIMBootOSStatus",
        "7)7/7;7F7\\7d7x7",
        "j3jRjWj",
        "RestoreMountStub",
        ".?AV?$CAutoDelete@PAVTraceLoggingCorrelationVector@@@RAII@@",
        "COfflineHiveT<class CEmptyType>::GetDwordValue",
        "towupper",
        "UnregisterTraceGuids",
        "%hs: Platform does not have basic footprint capabilities",
        "void __thiscall UnBCL::Array<class CProfileInfo *>::InitLarva(class UnBCL::ArrayList<class CProfileInfo *> *)",
        ".?AVCXXXXXHandledException@?P@??DoExecute@CTrustSafeOS@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "8)80868;8F8T8h8}8",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *> *)",
        "hwexcludePE.txt",
        "6C6J6P6U6`6g6l6",
        "mn-Mong-MN",
        "9&989N9b9i9o9t9",
        "??0DateTime@UnBCL@@QAE@HHHHHHH@Z",
        "7&8.8;8J8|8",
        "Validator",
        "CCleanupSnapshot::DeleteSnapshot: Policy is set to not retain snapshot from previous Upgrade",
        "2/2I2T2d2k2q2v2",
        "9%929F9O9\\9i9",
        "?%?5???Q?Y?_?i?s?",
        ".?AV?$ArrayList@W4OP_EXECUTION_PHASE@@@UnBCL@@",
        "DriverNewOSInjectSucceededList",
        "LocalPayload\\Feature\\OC",
        "E_OUTOFMEMORY",
        "ERROR_DS_INVALID_SEARCH_FLAG_SUBTREE",
        "ERROR_SEEK_ON_DEVICE",
        "=*=<=R=`=i=r={=",
        "3-3^3|3",
        "GetStockObject",
        "? ?8?@?X?`?h?|?",
        "4\"4*484@4J4Z4d4",
        "6-7T7y7",
        ";3;N;b;i;o;t;",
        "%s\\%s\\",
        ".?AU?$IEnumerable@PAVCOptionalComponent@OC@@@UnBCL@@",
        ";#;c;s;",
        "3`485",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCAppInfo@@@UnBCL@@@UnBCL@@",
        ":$:,:|:",
        "CMediaLayout::ExecuteOptimization: Only installation WIMs are currently supported",
        "1,121=1D1I1R1Y1^1g1n1s1}1",
        "1#1)1=1K1Y1g1",
        "ERROR_CANT_RECOVER_WITH_HANDLE_OPEN",
        "2'2n2",
        "CProcessDrivers::IsDriverPackageApplicable",
        "ERROR_HOST_NODE_NOT_AVAILABLE",
        "0 1(101<1\\1d1l1t1",
        ".?AVCSetupPlatformOSSwitchCheckpoint@@",
        "  Published Name: %s",
        "666S6w6",
        ":#:*:0:5:@:J:]:~:",
        "class CGlobalPathFindData *&__thiscall UnBCL::ArrayList<class CGlobalPathFindData *>::get_Item(int)",
        "Will restore the content of the WIMBoot partition from %s to %s",
        "0'0=0h0",
        "!0:0A0H0N0Z0n0|0",
        "MigrateUsersOffline",
        "auditUser",
        ".?AU?$IList@PAVSysprepComponent@@@UnBCL@@",
        "Attempting to remove file operations journal: %s",
        "999@9F9K9V9`9e9y9",
        "5,5i5q5{5",
        "Failed creating target component hive path name %ls\\COMPONENTS",
        "APPX Validator: Execution of data gather operation completed.",
        "UncompressFileBase",
        "void __thiscall UnBCL::Array<__int64>::Remove(__int64)",
        ":&:=:O:d:k:q:v:",
        "PWVS3",
        "(%lx): Failed to process user hive [%ws]",
        "7$7,747<7D7L7T7\\7d7l7t7",
        "1%1-13191I1`1p1{1",
        "6 6$6(6,6064686<6D6H6L6P6X6\\6`6d6h6l6t6x6|6",
        "1$1,141<1H1l1t1|1",
        "='=:=L=Y=b=z=",
        "Deleting safe OS BitLocker hash %s",
        "616D6q6w6",
        "ERROR_CANT_CROSS_RM_BOUNDARY",
        "CRelocateOS::DoExecute",
        "int __thiscall UnBCL::ArrayList<class CInfFile *>::BinarySearch(int,int,class CInfFile *,struct UnBCL::IComparer<class CInfFile *> *)",
        "ERROR_HOOK_NEEDS_HMOD",
        "FOD Validator: Adding installed Fod package or feature to list",
        "1(2T2f2n2t2",
        ".?AV?$SmartPtr@VCCheckpointSequence@OSRollbackService@@@UnBCL@@",
        "1#1.1<1h1r1",
        "?&?.?4?A?S?c?~?",
        "8 919=9g9t9",
        "=+=D=K=R=X=d=x=",
        "Failed to write delayed WIMBoot entry removal for %s. Error: 0x%08X",
        "ERROR_INVALID_INDEX",
        "int __thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,unsigned long,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,&protected: static unsigned long __stdcall UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsVDisk *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "Failed to get Reserve Manager",
        "1)111Z1b1o1t1",
        "8D8K8Q8V8a8m8r8",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *> *,int,int)",
        ".?AV?$CAutoRelease@PAUIMigRegistryAccess@@@Mig@@",
        "4&434;4D4N4U4[4`4k4}4",
        "3!3,333@3]3f3x3",
        "class CBasicEnvEntry *&__thiscall UnBCL::ArrayList<class CBasicEnvEntry *>::get_Item(int)",
        ".PAVCXXXXXHandledException@?5??SPProcessServiceDisable@@YGXPBG0@Z@",
        "4<4]4d4v4",
        "DUFailedUpdatesList",
        "7)7/747H7S7g7o7",
        "index out of range to ArrayList#get_Item",
        "CReconstructOS::RestoreInstallationLanguageSettings: Failed to set all settings to install language: 0x%08x",
        ";y-{e",
        "SPDeleteOldUpgradeSnapshots: Try to delete all expired Upgrade snapshots",
        "%hs: WinRE file: %s",
        "=.=5=N=e={=",
        "1#1+1>1F1Y1a1q1y1",
        "Failed to close new store. Store: %ws Status: %x",
        "j\\Zf9",
        "ERROR_OUT_OF_PAPER",
        ".?AV?$SmartPtr@U?$IEnumerator@PAUPageFileDesc@@@UnBCL@@@UnBCL@@",
        "SPCopyFilesAndFolders: Failed to move folder %s -> %s. hr = 0x%08X",
        "6#6,656<6I6U6^6k6",
        "Unknown",
        ".?AVCReserveDiskSpaceFirstBoot@@",
        "333=3D3J3O3Z3e3y3",
        "ERROR_IPSEC_QM_POLICY_EXISTS",
        "6%6+606;6K6_6h6r6y6",
        "  Name: %s",
        "5D6N6s6",
        ".?AV?$DefaultInstanceFactory@VCCallRegisterRecoveryImage@@@UnBCL@@",
        "8/868<8A8L8W8k8|8",
        "void __thiscall UnBCL::ArrayList<class CBcdSetting *>::QuickSort(class UnBCL::ArrayList<class CBcdSetting *> *,class UnBCL::ArrayList<class CBcdSetting *> *,int,int)",
        "  SP Build = %d",
        "%hs: Failed to move Downlevel Telemetry. Error: 0x%08X",
        "class CDUPackage *__thiscall UnBCL::_::ArrayListEnumerator<class CDUPackage *>::get_Current(void) const",
        "SL_E_NOT_EVALUATED",
        "ERROR_DS_INCORRECT_ROLE_OWNER",
        "SL_E_CHPA_RESPONSE_NOT_AVAILABLE",
        "ERROR_CLUSTER_NETWORK_ALREADY_OFFLINE",
        "VVRh8",
        "void __thiscall UnBCL::Array<class CRegCreationData *>::RemoveAt(int)",
        ";,;3;F;M;c;l;y;",
        "PVVh<",
        "int __stdcall pDeleteTempCleanupFiles(class UnBCL::String *)",
        "CSetupAutomation::Save",
        "40?0X0z0",
        "0%00090?0D0X0}0",
        "CAddSetupClRequest::DoExecute: Failed to merge pended request with operation request. Error: 0x%08X",
        "BootStat\\OS",
        "WIMBoot.Partition",
        "Opening template from %ws.",
        "struct PartitionLayoutArgs *__thiscall UnBCL::_::ArrayListEnumerator<struct PartitionLayoutArgs *>::get_Current(void) const",
        ":):<:D:J:W:i:w:",
        "GetIdentityAuthority",
        "GetDriverInfoFromModule: Cannot calculate full path for module to examine.",
        ".?AVCCopyCallback@?1??DoExecute@CCopyFilesAndFolders@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "CExecuteUnattend::DoExecute",
        "??1?$ICollection@H@UnBCL@@UAE@XZ",
        "FindAllPaths: Cannot get NT path for disk %d, partition %d. Error: 0x%08X",
        "979f9",
        "?%?+?=?K?Y?",
        "5E5O5e5",
        ";(</<5<:<E<P<U<i<",
        "Determined optimum VHD size (in bytes) to be %I64u",
        "%d.%d.%d",
        "2,2C2h2",
        "9!9/999C9M9d9r9{9",
        "4-454;4H4Z4s4",
        "Failed to allocate `ControlSet000\\Control\\ProductOptions` key name",
        "9V:o:v:}:",
        "OC::COCDismAdapter::Release: DismOpenSession failed. hr = 0x%x",
        "0$0,040X0l0t0|0",
        "3(383H3X3h3x3",
        "0$0,0<0D0L0T0\\0d0l0t0|0",
        "DU disk space checkpoint before download:",
        "Failed to set element application path. Status = [%x]",
        ".PAVCXXXXXHandledException@?GI@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "ReleaseVolumeAccessPath: Undefined access path '%c:\\'",
        "4,4@4T4\\4d4l4t4",
        "void __thiscall UnBCL::ArrayList<class CDrvStoreProperty *>::Resize(int,int)",
        "Service has no start type to back up.",
        "int __thiscall UnBCL::Array<class CCFGSectionValue *>::Add(class CCFGSectionValue *)",
        "304<4_4",
        "CSuspendBitlocker::SuspendByPath",
        "__thiscall UnBCL::Hashtable<unsigned short,int>::Hashtable(const struct UnBCL::IDictionary<unsigned short,int> *)",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCImageInfo@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "3'3-323F3R3`3p3y3",
        "=\"=3=D=",
        ";\";0;I;P;W;^;e;l;r;|;",
        "5#575D5Z5",
        ">+>7>C>L>U>^>t>",
        "en-MY",
        ".?AV?$SerializableBase@VCOOBEBootApplyFromICB@@$0A@V?$DefaultInstanceFactory@VCOOBEBootApplyFromICB@@@UnBCL@@@UnBCL@@",
        "Shl$a",
        "setupplatform.dll",
        "8D8w8",
        "ERROR_LOG_STATE_INVALID",
        "GetFileVersionInfoExW",
        ";+;;;F;",
        "ResumeRequested",
        "4%474U4a4s4",
        "4 4(444C4X4e4q4}4",
        "ERROR_DS_LOW_DSA_VERSION",
        ".PAVCXXXXXHandledException@?FN@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "zjdZ9U",
        "    Failed to get wim handle",
        "?#?0?B?P?]?o?w?}?",
        ".?AUIWIMBootHelper@@",
        "0%070?0E0R0d0r0",
        ".?AV?$SerializableBase@VCCopyFilesAndFolders@@$0A@V?$DefaultInstanceFactory@VCCopyFilesAndFolders@@@UnBCL@@@UnBCL@@",
        "SL_E_SFS_INVALID_FD_TABLE",
        "JET_errSPAvailExtCacheOutOfMemory",
        "2,2U2l2y2",
        "deleteDirectory",
        "=\">)>0>;>E>X>i>",
        "Copying extra migration XML: %s -> %s",
        "ERROR_EVT_MESSAGE_NOT_FOUND",
        "Cannot get the GUID for the OS we are replacing, recovery partition will not be backed up. Error: 0x%08X",
        "ERROR_DS_COUNTING_AB_INDICES_FAILED",
        "CSetupPlatform::SuspendAndRelease: Failure",
        ":$:):5:E:`:l:",
        ".?AVStringProperty@?1???$pDefineStringProperty@V<lambda_ecf2a307e3fc3e3bc22e3d71bd8c4a9f>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_ecf2a307e3fc3e3bc22e3d71bd8c4a9f>@@@Z@",
        "4:5D5S5e5j5",
        "  Resolved default install decision for package: %s",
        "MSFT_DiskToPartition",
        "2 3k3",
        "CNewSystem::PreInitialize: Unexpected enum value",
        ".ICBFirstApplyIncomplete",
        "VirtDisk.dll",
        "WimCloseImageFile",
        "Source directory [%s] has older files; will not copy it",
        ">!>'>,>:>A>U>\\>k>~>",
        "WmiObject::GetAssociated: Can't iterate over association class %s (0x%08x)",
        ":H;~;",
        "Failed to create directory %s, error code=%d",
        "Failed to read item %u of array: index out of bounds for array with length %u",
        "ERROR_CHECKING_FILE_SYSTEM",
        ">2>w>",
        "ERROR_DS_CANT_MOVE_APP_BASIC_GROUP",
        "Failure while requesting appx license payload copy. Error: 0x%08X",
        "2\"3h3",
        "methodName",
        "ERROR_DBG_COMMAND_EXCEPTION",
        "CSetupAutomation::Resurrect: Can't find the volume that hosts the answer file",
        "WPVhH",
        "%hs: Error while setting the OOBE skip value. Error: 0x%08X",
        "ImageInfo",
        "ERROR_SUCCESS_RESTART_REQUIRED",
        "?Concat@String@UnBCL@@SGPAV12@PBG0@Z",
        "3(3:3H3`3e3|3",
        "PSSSSSSSj",
        ":$:,:4:<:D:L:T:\\:d:p:",
        "D$@PQQ",
        ".?AVCAddProvisioningPackage@@",
        "JET_errBadRestoreTargetInstance",
        "%hs: Failed to remove recovery sequence for %s. Status = 0x%08X",
        "6-646:6?6J6T6Y6m6",
        "; ;&;,;2;8;>;D;J;P;V;\\;b;h;n;t;z;",
        "4&5;5C5H5N5]5z5",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::LastIndexOf(class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *,int,int) const",
        "=X=j=r=x=",
        "ERROR_SXS_INVALID_ASSEMBLY_IDENTITY_ATTRIBUTE_NAME",
        "id-ID",
        "= =$=(=,=0=4=8=<=@=D=L=P=T=\\=d=h=l=p=t=x=",
        ">\">(>.>4>:>@>F>L>R>X>^>d>j>p>v>|>",
        "BuildEndpointHandle",
        "void __thiscall OC::COCCbsAdapter::Release(void)",
        "PREVALIDATION: Operations can no longer be sorted following a validator's request to retry.",
        "ERROR_CANNOT_IMPERSONATE",
        "SequenceDisabled",
        "f`&gf",
        "Failed opening target configuration",
        "CERT_E_UNTRUSTEDROOT",
        "7-7>7F7L7p7|7",
        "3:3R3d3k3q3v3",
        "0I1[1e1w1",
        "<H<l<",
        "%SystemDrive%\\swapfile.sys",
        "0f1r1|1",
        "ERROR_DEVICE_NOT_AVAILABLE",
        "=,=9=^=k=}=",
        "ERROR_IPSEC_DEFAULT_QM_POLICY_NOT_FOUND",
        "Setting product key failed. Error: 0x%08X",
        "pSPRemoveTask: Remove snapshot cleanup task",
        "0\"0-0=0Q0^0k0~0",
        "%hs: Failed to convert current entry GUID to string.",
        "90949L9P9h9l9",
        "class OC::COptionalComponent **__thiscall UnBCL::ArrayList<class OC::COptionalComponent *>::GetBuffer(int)",
        "\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\HIVELIST",
        "5$505T5\\5d5l5t5|5",
        "SPTaskRemoveSnapshot: Disk total space : %I64d",
        "9$9.9;9W9^9d9i9t9",
        "0 1*11171<1G1R1f1",
        ">'>1>6>J>c>t>",
        "wo-SN",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "t#j\\Q",
        "4?5U5m5",
        "QSjUjtjd",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::get_Current(void) const",
        "=+=D=]=s=~=",
        "\\WINNT",
        "0\"1(171=1G1V1m1u1",
        ":$:,:4:<:H:h:p:x:",
        "RestoreRefNodeCallback",
        "void __thiscall UnBCL::ArrayList<class CDriverInfo *>::set_Item(int,class CDriverInfo *)",
        "<+<8<E<]<i<u<",
        "Enable Page File for New OS %s",
        "707k7s7",
        ":#:-:\\:m:z:",
        "?/?A?^?{?",
        "7H7|7",
        "  %s: %s",
        "XCSetupPlatform::EnumerateDisks",
        "Failed to flush the BCD to disk. Status = [%x]",
        "ERROR_DEPENDENCY_ALREADY_EXISTS",
        "Action,CMXEPlugin,",
        ":&:-:3:8:C:M:R:f:y:",
        "0,040<0D0L0T0\\0d0l0",
        "?3?A?\\?f?p?v?",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        ".?AVCTrustSafeOSBootCommand@@",
        "7-767I7[7c7i7r7",
        ":$:,:4:<:D:L:T:\\:t:|:",
        "GetThisModuleDirectory",
        "void __thiscall UnBCL::Array<class CDriverDetails *>::InitLarva(class UnBCL::ArrayList<class CDriverDetails *> *)",
        "\\\\?\\GLOBALROOT%s%s",
        "base\\ntsetup\\setupplatform\\lib\\util\\diskspaceestimates.cpp",
        "0$0,0D0L0T0h0p0x0",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVCGlobalPath@@@UnBCL@@@UnBCL@@",
        "1$1(181<1@1X1\\1`1d1h1l1",
        "4=4l4~4",
        "wcstol",
        "WriteSectors: Expected to write [%u] bytes; only wrote [%u] bytes. GLE is [0x%X]",
        "SL_E_TOKSTO_CANT_READ_FILE",
        "707;7g7o7",
        "PRRhd",
        "JET_errInternalError",
        ".?AV?$Array@PAVCFailForwardSystem@@@UnBCL@@",
        "QSVj j",
        "CSIDL_MYMUSIC",
        "[0x%.8x] ",
        "7#828c8",
        "3#3,343;3K3s3z3",
        "3&424K4X4r4y4",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::Add(class UnBCL::String *,struct HKEY__ *)",
        "3'3/3@3F3S3`3h3p3u3",
        "5G5|5",
        ">!>(>>>Y>_>i>n>x>",
        "void __thiscall UnBCL::ArrayList<struct DiskRange>::Resize(int,int)",
        "ERROR_ENLISTMENT_NOT_FOUND",
        "CMediaLayout::ExecuteOptimization: Failed to queue copy for %s => %s: 0x%08x",
        ">'>7>>>Z>c>k>q>w>",
        ":*:::I:U:e:v:",
        "VdsDisk::Wipe: Failed to clean disk (0x%08x)",
        ":1:Q:h:}:",
        "ERROR_CANT_ACCESS_DOMAIN_INFO",
        ".?AV?$HTDictEnumBase@V?$DictionaryEntry@PAVString@UnBCL@@PAUHKEY__@@@UnBCL@@@_@UnBCL@@",
        "WMI::WmiCollection::MoveNext",
        "\\System32\\bootstr.dll",
        "  Needed by install of updates: %I64d",
        "?LastIndexOf@String@UnBCL@@QBEHPBG@Z",
        "<*<2<8<E<W<e<t<",
        "=\\>z>",
        "CManifest::CreateInstance",
        "VERBOSE: OS volume: %s",
        "GetUpdateReserveManager",
        "7)707I7Q7c7j7z7",
        "dLocalPayload\\Unattend",
        "4 4.4R4v4",
        ":&:-:3:8:C:O:T:h:}:",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::Resize(int,int)",
        "VdsPartition::TakeOffline: Couldn't take volume offline (0x%08x)",
        "8%8-888@8J8Q8W8\\8g8s8x8",
        "040@0W0c0p0",
        "%hs: Failed to read the rollback GUID from file: %s. Error: 0x%08X",
        "=,=4=<=D=L=T=\\=d=l=x=",
        "Mb=Lk",
        "8.8>8J8Z8h8",
        "FOLDERID_PhotoAlbums",
        "[HKLM\\",
        ":&:+:?:X:d:s:}:",
        "9,969G9]9",
        "wQtG-L",
        "?)?/?B?k?",
        "757P7f7",
        "DownloadProgress value exceeds %u%% percent",
        "1>2V2c2{2",
        "0.0C0R0o0",
        ".?AVNumericProperty@?1???$pDefineNumericProperty@V<lambda_7fc3b75bd9d98b181c575b2dc70e036e>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_7fc3b75bd9d98b181c575b2dc70e036e>@@@Z@",
        "8@8j8",
        "APPX Validator: New AppX folders appeared, will invalidate data gather operation",
        "void __thiscall UnBCL::ArrayList<class SysprepComponent *>::Resize(int,int)",
        "=6>A>d>q>",
        "6$6+626>6I6O6c6l6|6",
        "IsDiskOnXHCI: FindMatchingDeviceInfoData failed. Error = 0x%X.",
        "3*383=3",
        "CSetupPlatform::Initialize: Setup log starts:",
        "40494H4R4_4e4l4v4",
        "WaitForMultipleObjects",
        "ActionPlatform::DeleteFilePattern",
        "base\\diagnosis\\srt\\util\\bugcheck.cpp",
        "tESWV",
        "jAj@j:j",
        "=&=5=G=T=r=",
        "Reading onesetting for respecialize",
        "void __thiscall UnBCL::ArrayList<class CAntiVirusInfo *>::AddRange(const struct UnBCL::ICollection<class CAntiVirusInfo *> *)",
        "Performing sysprep specialization offline",
        "CSetDefaultBootEntry: Failed to set the default boot entry. Error: 0x%08X",
        "DismOpenSession",
        "CAddUnattend::DoExecute",
        ".?AV?$CAutoDeleteArray@D@RAII@@",
        "Cannot create an installation ID",
        "2$2,282\\2d2l2t2|2",
        ":!:':,:7:B:c:o:",
        "OC::COCCbsAdapter::GetPackageByName: Failed to enumerate Cbs packages. hr = 0x%x",
        "        Class GUID : %s",
        "Setting bus parameters...",
        "%hs: Set the reference to the recovery image WIM %s",
        "3#393F3_3x3",
        "VdsPartition::GetOrdinal: Returning -1 because SPGetPartitionOrdinal failed with 0x%08x",
        ">->B>W>l>|>",
        "class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::GetBuffer(int) const",
        "PQQQV",
        "2&2I2Q2n2u2{2",
        "Initial catalog length = %d, Final catalog length = %d",
        "Deserialize/Execute post-FirstBoot operations failed",
        "t$DRP",
        "8/888I8l8",
        "Minidump",
        "GetTokenInformation",
        "PVWhc",
        "sr-Cyrl-RS",
        "5>6K6V6n6",
        ".PAVCXXXXXTemp@?EA@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        ".?AV?$CAutoRelease@PAUIUnknown@@@RAII@@",
        "ReadBootCode: Error reading FAT boot sectors!",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::Insert(int,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *)",
        "SPCanRemoveRecoveryPartition",
        "ERROR_MEDIA_CHANGED",
        "<#</<;<I<X<_<e<j<u<",
        "Param1",
        "s\\Registry\\Machine\\",
        "OSRollbackService::CCheckpoint::ExtractCrashDump: Found page file at %s; attempting to extract crash dump",
        "1+12181=1H1N1a1",
        "ARP Validator: New installed applications apeared, will invalidate data gather operation",
        "8,9\\9v9",
        "%windir%\\LiveKernelReports",
        "4#4:4P4",
        "ERROR_NO_SAVEPOINT_WITH_OPEN_FILES",
        "CFfuWriterAsyncT<class CSecurityHeaderWriterT<class CEmptyType>,class CImageHeaderWriterT<class CEmptyType>,class CStoreHeaderWriterT<class CEmptyType>,class CPayloadWriterT<class CEmptyType> >::CreateInstance",
        ".PAVCXXXXXTemp@?6??GetCurrentDiskSpaceRequirements@CDeploymentBase@@QAEJPA_K0@Z@",
        "Failed to merge tracing file: %s, %s. hr = 0X%x",
        ".?AVCKeywordTree@Mig@@",
        ": :*:4:>:H:R:\\:f:p:z:",
        "?6?B?N?e?",
        "ChangedKeys",
        "PSSSSSSh",
        "Failed to store snapshot ID into registry key. Error: 0x%08x",
        "SPCreateDiskImage: CreateVirtualDisk() failed: %u",
        "?GetHashCode@DateTime@UnBCL@@UBEHXZ",
        "8$808T8\\8d8l8t8|8",
        "747Q7Z7b7o7~7",
        "enum MIGSTATUS __stdcall SPExecuteFirstBootApply(class UnBCL::String *,class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *> *,enum SetupPlatform::SP_MIG_SCOPE,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::ArrayList<class CWIMBootData *> *,class UnBCL::String *,int,int *,struct ISPTelemetryData **,struct ISPMigProgress *,long *)",
        "ERROR_WRITE_PROTECT",
        "CApplyWIM: Failure while opening image file %s. Error 0x%08X",
        "pIsCollecTraceSet",
        "int __thiscall UnBCL::ArrayList<class CFileCreationData *>::BinarySearch(int,int,class CFileCreationData *,struct UnBCL::IComparer<class CFileCreationData *> *)",
        "<(<D<_<f<l<q<|<",
        "es-BO",
        "malloc",
        "484Q4X4_4e4q4",
        "2%2/262<2A2R2b2l2s2y2~2",
        "<#<,<=<T<f<n<t<",
        "2 2$2(2,2024282L2X2`2d2h2l2p2t2",
        ".PAVCXXXXXHandledException@?GK@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "0%0-0@0G0Q0^0h0o0y0",
        "DWORD64",
        ">$>4>A>I>T>c>j>t>}>",
        "QSjFj",
        "Failed to stop user mode tracing. hr = 0X%x",
        ".?AU?$IEnumerable@PAVCDriverDetails@@@UnBCL@@",
        "ERROR_IS_JOINED",
        "\\System32\\SsShim.dll",
        "ERROR_INVALID_FORM_SIZE",
        "CFailForwardSystem::QueueCreateFile",
        "7'717D7L7y7",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::RemoveAt(int)",
        "Mount path low",
        "=%=,=3=9=E=Y=g=u=",
        "1'1.171<1I1[1e1y1",
        "Vh@#a",
        ".?AV?$DefaultInstanceFactory@VCSetupRecoveryPartition@@@UnBCL@@",
        "838K8e8}8",
        "4.4?4V4g4n4t4y4",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CDriverDetails *>::Reset(void)",
        "9$9z9",
        "Image Index",
        "LastCrashDumpInfo: BugcheckProgress %u",
        "void __thiscall UnBCL::Array<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::InitLarva(class UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *> *)",
        "9*91989>9J9\\9j9x9",
        "6(686H6X6\\6`6x6",
        "__thiscall UnBCL::ArrayList<struct DiskRange>::ArrayList(const struct UnBCL::ICollection<struct DiskRange> *)",
        ".?AU?$IEnumerator@PAUPageFileDesc@@@UnBCL@@",
        "Skipping this volume, protection is not active",
        "%hs: BCD failed to get timeout. Error: 0x%08X",
        "4\"4)474E4M4S4g4p4x4",
        "Newly created WinRE partition removed successfully",
        "9+9E9`9",
        "wcsstr",
        ";2<e<",
        "9+:?:",
        "Marking event [&SclEvent_ProcessSystemRegistry_Stop]",
        "JET_errSoftRecoveryOnSnapshot",
        ":3:H:Q:b:",
        "<.<6<<<I<[<i<",
        "ApplySecondBootICBPluginErrorList",
        "IVdsVolumeMF3",
        "bootx64.efi",
        "CDumpSourcesData: Failed to write reference %s to file: %s. Error: 0x%08X",
        "DiagTrack.dll",
        "=&=3=D=Y=n=",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::Reset(void)",
        "0g0}0",
        ".?AVArgumentException@UnBCL@@",
        ".PAVCXXXXXHandledException@?MG@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "Error copying boot debugging files from %ws to %ws (%ws). Last Error = %#x",
        "ERROR_NO_SUCH_SITE",
        "PVVVG",
        "3!3*333<3E3N3W3`3i3r3{3",
        ":#:c:s:",
        ".?AV?$ArrayListEnumerator@PAG@_@UnBCL@@",
        "Name: %s",
        "Failed to delete service %s. Error: 0x%08X",
        "RollbackReinitialize: threw exception.",
        ":':2:?:G:M:a:}:",
        "%hs: Cannot create filter key %s. Error: 0x%08X",
        "PQQQR",
        "9<9`9t9",
        "    Failed to allocate spParentPath.get()",
        "5#5G5f5",
        "class CImageInfo *__stdcall UnBCL::Try_Cast<classCImageInfo*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "7 787<7T7X7p7t7",
        "JET_errKeyNotMade",
        "class CWIMBootData *__stdcall UnBCL::Try_Cast<classCWIMBootData*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "4 4?4K4R4j4v4",
        "8$8,888X8`8h8p8|8",
        "ApplySecondBootOfflinePluginErrorList",
        ">W>v>",
        ".?AV?$CAutoRelease@PAVSmImageDisk@@@RAII@@",
        "\\kernel32.dll",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FveDetect\\Cache",
        "<+<P<b<j<p<}<",
        "SPGetVolumeStableGuidStringFromVolumeName: unexpected number of chars returned by StringFromGUID2. Will return NULL.",
        "    Failed to get AppData temp folder.",
        "CSh<E",
        "ERROR_CURRENT_TRANSACTION_NOT_VALID",
        ";\";+;3;:;H;R;e;n;|;",
        "void __thiscall UnBCL::ArrayList<struct DiskRange>::set_Item(int,struct DiskRange)",
        ":&:8:@:F:S:e:s:",
        "= >Y>r>",
        ".PAVCXXXXXHandledException@?CN@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "pIterateAssociation: Can't iterate over instances of %s associated with %s (0x%08x)",
        "HeapFree",
        ">&?1???M?[?i?w?",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,struct HKEY__ *>,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,struct HKEY__ *> __stdcall UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,class ATL::CElementTraits<struct HKEY__ *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "Extending back the OS partition as an undo operation",
        "Failed to add system store from file. File: %ws Status: %x",
        "=I=W=r=",
        "0x%08X",
        ">%>/>C>e>l>r>w>",
        "0$0:0F0M0Y0^0o0z0",
        "x83t)",
        "CMediaLayout::QueueCbsPackages: Failed to get full path for %s: 0x%08x",
        "2-2;2D2M2[2j2",
        "?%?V?",
        ".PAVCXXXXXHandledException@?FP@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "wcstok_s",
        "JET_errRecordTooBigForBackwardCompatibility",
        "<6===l=s=",
        "9,949>9O9X9e9o9v9|9",
        "%hs: Failed to get array length (0x%08x)",
        "%s\\%s.%s",
        "CMediaLayout::QueueFileCopy: Failed to add operation [%s]: 0x%08x",
        "?$?+?1?6?A?O?W?]?b?v?",
        ".PAVCXXXXXTemp@?EM@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "616?6",
        "PROGRAMDATA",
        "5!6-6B6Y6i6q6x6",
        "4&4.494O4e4",
        "Failed to query the size of registry value [%d]. Error: 0x%08X",
        "FOD Validator: Failed to build the new FoD list, skip verification. Error: %08X",
        "7*717E7b7n7|7",
        "CCompressOldOS::CCompressOldOS",
        "CDeploymentProject::CreateVHDDeployment: Failed to determine disk space needed by new system; Error: 0x%08X",
        "OC::COCNameMatcher::Match",
        "{816E23C5-8C8F-43BC-B9CB-3B58F7C1845C}",
        ";L<Z<k<",
        "080<0@0D0T0\\0x0|0",
        "CSetupAutomation::Resurrect: Failed to read from serialization stream: 0x%08x",
        "void __thiscall UnBCL::_::ArrayListEnumerator<struct SetupPlatform::IDisk *>::Reset(void)",
        "DiskInitialize: Failed to initialize target disk with GPT style (0x%08x)",
        "CSetupAutomation::SuspendAndRelease: Failed to get disk properties: 0x%08x",
        "Recovery sequence for %s boot entry deleted successfully.",
        "spGetAntiVirusInfo",
        "ProvisioningPackage::OpenProvisioningPackageForRead",
        "\\System32",
        "j.[SV",
        "4*4j4|4",
        "DU directory %s does not exist; skipping installation",
        "1#1?1M1W1^1d1i1u1",
        ".?AU?$IEnumerable@PAVCSPInternalPluginData@@@UnBCL@@",
        "ERROR_INSTALL_FAILURE",
        "<)<5<K<",
        "6 6(656=6C6R6i6y6",
        "2,3P3x3",
        "VERBOSEOPS: %sOperation with ID %u might be able to run as part of phase %u, checking dependencies",
        "CSetupPlatform::Initialize: Failed to start telemetry; hr = 0x%08X",
        "ur-PK",
        "L$<_^[3",
        "Disk has no layout",
        "VDisk",
        "VdsPartition::RefreshVdsProperties: Failed to query IID_IVdsDisk interface [%s] (0x%08x)",
        "6 6$6<6@6X6\\6t6x6",
        "GetClientRect",
        "ERROR_TAG_NOT_FOUND",
        "Microsoft Corporation1",
        "7!7.777?7J7P7]7n7{7",
        "2%252=2O2d2",
        "2 2%2/262D2V2g2n2",
        "RegRestoreKeyW",
        "?&?6?>?E?T?h?o?u?z?",
        "ProvPackageAPI: %s",
        "ERROR_RESUME_HIBERNATION",
        "SysprepSession::CreateXPathForSelection: Processor architecture in registry is %s",
        "sprintf_s",
        "7'797D7N7[7c7",
        ".?AV?$CAutoCleanupBase@PBG@RAII@@",
        "Failed to initialize wcp.dll at %ws",
        "=/=<=D=L=R=X=d=x=",
        "VdsPlatformDiskEnumerator::GetNext: Failed to get next pack (0x%08x)",
        "Complete file operations for offline portion of first and oobe boot apply",
        "? ?%?0?7?a?l?",
        "system32\\inetsrv\\config",
        "Wmi::OpenNamespace: Failed to set proxy blanket (0x%08x)",
        "GetBlackboardString(BB_NAME_BTSOURCES_FOLDER, BB_PROP_VALUE) is NULL.",
        "CSetupRecoveryPartition::CSetupRecoveryPartition",
        "Rollback",
        "VERBOSE: MOVETRACK: File symbolic link could not be removed. Error: 0x%08X",
        "4#5*5B5c5j5",
        "8.9@9H9N9[9m9{9",
        "f90tU",
        "CSetupPlatformPrivate::WriteLog",
        "3,383H3T3\\3f3m3t3",
        ">'>>>N>_>o>~>",
        "Failed to open new system store. Store: %ws Status: %x",
        "Found hive [%ws] already loaded at: [%ws]",
        "> >$>(>0>H>L>d>h>",
        "ERROR_DS_CONSTRUCTED_ATT_MOD",
        "%hs: Setting boot app %s for winre %s",
        ".PAVCXXXXXTemp@?JP@??DoExecute@CRelocateOS@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "4&4o4",
        "1!1/1A1R1Y1o1",
        "$WINDOWS.~BT",
        ";#;P;`;l;r;",
        ".?AVCXXXXXHandledException@?EG@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "void __thiscall UnBCL::Array<enum OP_OPERATION_ID>::Insert(int,enum OP_OPERATION_ID)",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@W4ActionType@@UTableKey@?$Hashtable@PAVString@UnBCL@@W4ActionType@@@2@PAV12@UKeyTraits@52@$1?RetrieveKey@52@KGPAV12@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@W4ActionType@@@UnBCL@@W4ActionType@@UKeyTraits@23@V?$CElementTraits@W4ActionType@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "8(808<8\\8d8l8x8",
        "6 6$6(6,646<6@6D6L6T6X6\\6`6d6h6l6p6t6|6",
        "9<9G9",
        "iu-Latn",
        "9!9-989B9R9]9s9~9",
        "0$0,040<0D0L0T0\\0h0",
        ".?AVStringProperty@?1???$pDefineStringProperty@V<lambda_f0752e957992c5641482eb8c40076cde>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_f0752e957992c5641482eb8c40076cde>@@@Z@",
        "class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::get_Item(int) const",
        "settings/v2.0/%ls/%ls",
        "9(9;9h9",
        "%ls\\%ls\\%ls\\%ls",
        "??0Version@UnBCL@@QAE@PBG@Z",
        "9%949P9m9v9",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *> *)",
        "SL_E_INVALID_PACKAGE",
        ">5>R>a>",
        "ka-GE",
        "Parts of the uninstall infrastructure are missing, uninstall cannot continue.",
        "646\\6t6",
        "SShlm",
        ";!;3;C;^;c;",
        "? ?4?D?V?a?",
        "3:3A3G3L3W3i3}3",
        "    Failed to canonicalize intermediate path string",
        "void __thiscall UnBCL::Array<class CFilterDriverInfo *>::Insert(int,class CFilterDriverInfo *)",
        "void __thiscall UnBCL::ArrayList<class SysprepAction *>::RemoveAt(int)",
        "class UnBCL::Array<class UnBCL::String *> *__stdcall UnBCL::Try_Cast<classUnBCL::Array<class UnBCL::String *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "CSuspendBitlocker::DoExecute: Failed to suspend by path %s: 0x%08x",
        ".?AVCXXXXXHandledException@?BLL@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "ERROR_IPSEC_IKE_POLICY_CHANGE",
        "4$4T4`4z4",
        "0$0.050@0M0",
        "< <0<4<D<H<X<\\<l<p<",
        "CMediaLayout::Initialize: Failed to clone the automation instance: 0x%08x",
        ".?AVCGatherEndInstall@@",
        ";(;/;5;:;E;O;T;h;p;",
        "5<6W6",
        "Failed to set file extended attribute",
        "DiskLayout::FindTarget: Failed to parse numeric value '%s' for property %s (0x%08x)",
        "sanity shortfall in comparison operators",
        "?Steal@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEPAV?$Array@PAVString@UnBCL@@@2@XZ",
        "??0String@UnBCL@@QAE@PBG@Z",
        "454J4_4n4",
        "CRYPT_E_NO_KEY_PROPERTY",
        ";0;B;J;P;];o;};",
        "9_`t[jT",
        "[%s] is already executed",
        "na:Type",
        "ERROR_CLUSTER_CANT_CREATE_DUP_CLUSTER_NAME",
        ".PAVCXXXXXTemp@?CK@??pSPDoOfflineApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0H0PAUISPMigProgress@@@Z@",
        "3P3\\3j3",
        "DUDownloadSkippedHR",
        "ERROR_INVALID_MEDIA",
        "3&303:3Q3_3i3s3",
        "0$0+0<0C0P0]0d0q0v0",
        "061_1",
        "1 141A1N1]1y1",
        "626I6_6v6",
        "CSetupPlatformRollback::SaveBootManagerTimeout",
        "Bulk Upgrade",
        "%hs: Setting the entropy for the new OS.",
        "%hs: uninstall GUID %s cannot be converted to a GUID structure, uninstall validation will fail.",
        "1)131A1G1M1R1\\1f1p1z1",
        "MaxPartitionCount",
        ":#:5:=:C:P:b:l:",
        ".PAVCXXXXXTemp@?3??SPCreateFile@@YGJPAVString@UnBCL@@K0H@Z@",
        "Failed to write FilterPages to %s. Error: 0x%08X",
        "MIG_FAIL_ON_PROFILE_ERROR",
        "struct HKEY__ *__thiscall UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::get_Item(class UnBCL::String *) const",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,struct HKEY__ *>,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,struct HKEY__ *> __stdcall UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,class ATL::CElementTraits<struct HKEY__ *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *> *,class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,struct HKEY__ *> > *,int)",
        "FIOIsDirectoryEmpty",
        "|$09L$",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *> *)",
        "CSetupPlatformPrivate::DoCommunication",
        "%hs: System state does not allow for finalize operations to be executed. Current state is %d",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,long> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::get_Item(int) const",
        "long __thiscall CSetupPlatformPrivate::RollbackOnlineCommon(void)",
        "JET_errIndexTuplesTooManyColumns",
        "5,555>5K5_5o5x5",
        "?E?n?",
        "FindGlobalPath: Cannot get partition count for disk %d. Error: 0x%08X",
        "ERROR_IPSEC_IKE_INVALID_SIG",
        "%hs: Not able to set the header text for Diagnostics Error Reporting. Error = %d",
        ".?AV?$DefaultInstanceFactory@VCCleanupSnapshot@@@UnBCL@@",
        "181h1",
        "Partition starting offset (%llu) is not a multiple of cluster size (%llu)",
        "Failed to get img event",
        "D$0PQ",
        "Cannot find the New OS boot entry",
        ":(:M:h:}:",
        "IsCaptureWIMBootCompliant",
        "CNewSystem::QueueSetupAutomation: Failed to queue provisioning package %u: 0x%08x",
        "ig-NG",
        "4!4*434=4F4O4X4a4j4s4",
        "ActionPlatform::DeleteKey: Invalid registry key path %s passed",
        "6(606H6P6X6l6t6|6",
        "CNewSystem::QueueSetupAutomation: Failed to get SQM opt-in (0x%08X)",
        "void __thiscall OSRollbackService::CBootFilesRestoreCheckpoint::Rollback(const unsigned short *)",
        "CDownloadDUUpdates::FilterUpdates: Skipping update at index %d; it cannot be filtered",
        "__thiscall SysprepComponent::SysprepComponent(class UnBCL::XmlNode *)",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$ArrayList@PAVCDriverDetails@@@2@@UnBCL@@@_@UnBCL@@",
        "7#7G7X7d7n7u7~7",
        "VWh U",
        "RtlFreeSid",
        "REG_QWORD",
        "7(787A7R7[7h7|7",
        "1F1K1",
        "5:5N5f5r5",
        "ERROR_TM_IDENTITY_MISMATCH",
        "DeleteFileEx: Unable to remove [%s]; GLE = 0x%x",
        "  [%s] => <value type %u>",
        "WofMob",
        ":&:D:K:Q:V:a:o:u:",
        ".?AU?$IEnumerator@K@UnBCL@@",
        "839C9",
        "BcdOpenStore: Failed to acquire BCD sync Mutant. Store: %wsFlags: 0x%x Status: %x",
        "6F6\\6u6",
        ".PAVCXXXXXHandledException@?2??DoExecute@CEnableTracingForImage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "ERROR_NOT_CAPABLE",
        ";0;G;N;`;m;~;",
        "This system's wimmount.sys does not support spare mounting.",
        "2$282O2x2",
        "4%4.4C4L4",
        "<(<6<o<",
        ".?AVCXXXXXHandledException@?BF@??QueueAddDriver@CNewSystem@@QAEJPBG000W4SP_ERROR_HANDLING@SetupPlatform@@@Z@",
        ";2;8;B;G;Q;X;f;x;",
        "<\"<(<1<<<H<T<`<",
        "{F1A1917F-3A40-4909-8B5F-6451E763C1AB}",
        "???x?",
        "ERROR_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER",
        "= =0=D=K=W=g=",
        "QHPWV",
        ".?AVCXXXXXHandledException@?EN@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "9 9;9W9",
        "848<8D8P8p8x8",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> *,class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> > *,int)",
        "<L<V<e<",
        "?+?8?X?v?",
        "SVhxs",
        "<%<6<F<W<]<d<n<",
        "<%<7<P<g<y<",
        "7\"777M7T7]7b7r7z7",
        ")DUSuccessUpdatesList",
        "=!=L=S=_=g=u=|=",
        "ERROR_CTX_SHADOW_DENIED",
        ":]<d<",
        "8\"8E8L8R8W8b8l8q8",
        "151I1S1Y1|1",
        "jWX_^[",
        "666>6D6J6V6g6t6}6",
        "string size too big",
        "  Volume Name = %s",
        "pDUSearchAndDownload",
        "4*4M4u4",
        "2&2\\2",
        "ERROR_DEPENDENT_RESOURCE_PROPERTY_CONFLICT",
        "jsj:j",
        ".PAVCXXXXXHandledException@?8??SPUninitializeNetwork@@YGXH@Z@",
        "04080P0T0l0p0",
        "T$49U",
        "2 242B2I2W2^2s2z2",
        "6$6C6Q6Z6p6",
        "4\"4+434A4I4P4g4n4t4y4",
        "CreateVolumeAccessPath: No free drive letters to use!",
        "4#454=4C4W4]4f4|4",
        ":&:-:3:8:C:O:T:Y:^:r:",
        "CSIDL_DESKTOPDIRECTORY",
        "ERROR_VOLUME_NOT_SUPPORT_EFS",
        "333J3y3",
        ".PAVCXXXXXTemp@?6??SPFindSnapshotProp@@YGJPAVString@UnBCL@@PAU_VSS_SNAPSHOT_PROP@@@Z@",
        "=/=5=K=[=d=",
        "ERROR_NOT_SNAPSHOT_VOLUME",
        "1$2g2",
        "Creating/Setting Crashdump Enabled key  with %d",
        ":*:<:J:",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::Remove(class UnBCL::String *)",
        "_91$[bS",
        "<x=P>(?",
        "Failure while executing uninstall apply, uninstall will continue. Status: 0x%08X",
        ".?AV?$DefaultInstanceFactory@VCFODValidator@@@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<class OSRollbackService::CCheckpoint *>::Insert(int,class OSRollbackService::CCheckpoint *)",
        "D$@;t$\\r",
        "ControlSet00%1u\\Control\\Session Manager\\Memory Management",
        "Failed to write downlevel progress in file: %s. Error: 0x%08X",
        "><vMSS",
        ".?AVCXXXXXHandledException@?GI@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "CredReadW",
        "ERROR_DS_HAVE_PRIMARY_MEMBERS",
        "CDeploymentProject::CreateVHDDeployment: Failed to start logging after platform release. Error: 0x%08X",
        "ERROR_COUNTER_TIMEOUT",
        "9-949B9L9_9x9",
        "=*>5>H>",
        "2%212;2H2N2T2`2m2u2",
        "Fail to flush file buffers",
        "  Using WU caller profile search criterion",
        "=<>D>Q>`>|>",
        "Failure while requesting appx package payload copy. Error: 0x%08X",
        "8<8b8k8t8}8",
        "6 6-6?6",
        "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\utility.c",
        "081?1F1R1\\1o1",
        "ERROR_CLUSTER_NO_NET_ADAPTERS",
        "CBS_E_PENDING",
        "8 828U8",
        "nALTITUDE",
        "FOLDERID_Contacts",
        "volume{",
        "4/4F4V4b4p4",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,int> __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,int>,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,int> __stdcall UnBCL::Hashtable<class UnBCL::String *,int>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "2V2m2",
        "ImageExtractToHandle",
        "CCreateScopedSnapshot::DoExecute: Cannot open snapshot key, unable to update snapshot Info. Error: 0x%08x",
        "void __thiscall UnBCL::ArrayList<class CShellFolderInfo *>::set_Item(int,class CShellFolderInfo *)",
        "y\"WVh",
        ".PAVCXXXXXTemp@?BH@??GetAnswerFileContentsAsUnattend@@YGPAVString@UnBCL@@PBG0K@Z@",
        "The entry to add already exists with GUID %s. We will recreate it keeping the same GUID.",
        "1\"1<1Z1o1u1",
        "5'5-5@5U5",
        "XPanther",
        "9!9;9B9K9P9`9h9s9",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCDeviceInfoData@CDeviceIdDatabase@@@UnBCL@@@UnBCL@@",
        "SmVolume::GetProperties",
        ".PAVCXXXXXHandledException@?8??ExecuteCurrentOperations@CDeploymentBase@@QAE?AW4SYSTEM_STATE@SetupPlatform@@HPAUIOperationsProgress@4@@Z@",
        "=;=Z=}=",
        "sWIM ",
        "090z0",
        "Failed to delete orphaned ramdisk. Status = [%x]",
        "6 6+666;6O6g6{6",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "0&0W0^0{0",
        "969H9T9i9",
        "PageFileConfigurationSection",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::MoveNext(void)",
        "> >(>8>D>d>p>",
        "? ?-???c?",
        "0%0,03090C0e0w0",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Successfully removed the system BCD store which is created for rollback only.",
        "DecompressChunkedFile",
        "OS pieces found, calculating drives to enumerate",
        "ERROR_FUNCTION_FAILED",
        "CSetupPlatformPrivate::RollbackOnlineCommon: Failed to decode safe OS hash, cannot remove it: 0x%08x",
        "int __stdcall SPCanRemoveRecoveryPartition(class UnBCL::String *,unsigned short,unsigned __int64 *,unsigned __int64 *)",
        ":7;M;T;Z;_;j;q;",
        "kSPDoOfflineGather",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::IndexOf(class UnBCL::DictionaryEntry<unsigned short,unsigned short> *,int,int) const",
        "5*5D5K5T5Y5d5q5|5",
        "kernel32.dll",
        "SystemDrive",
        "void __thiscall UnBCL::Array<class OC::CCmdLineExecutionTelemetryData *>::InitLarva(class UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *> *)",
        "DISKSPACETRACK: %I64u",
        "Set reg key value BufferSize failed: 0x%x",
        "L$djo_",
        "SetupUpdate:",
        "Failed to get file name",
        "void __thiscall UnBCL::ArrayList<class OC::COptionalComponent *>::Insert(int,class OC::COptionalComponent *)",
        "ActionPlatform::LaunchModule",
        "D$<QPW",
        "NtSetValueKey",
        "3*383\\3",
        "%ls %d %u",
        "Download OS Updates (DU) to keep installation up-to-date",
        "6$646D6T6d6t6",
        "Failed to open description key for store. Store: %s StoreKey: %ws Status: %x",
        "VdsVolume::Mount: Failed to query IID_IVdsVolumeMF interface [%s] (0x%08x)",
        "SVh8e",
        "\\Locations\\TrackedVolumes",
        "Failed to copy file %s to %s. Error: 0x%08X",
        "SetTextColor",
        "ActionPlatform::SetValue: Error from RegSetValueExW on value %s under key %s; dwRet = 0x%x",
        "fZf_fY",
        "8 959C9J9l9",
        "SVh0b",
        "0_0f0",
        "Rollback: (1) Showing splash window with restoring text: %s",
        "%hs: Cannot find room to relocated %s folder. Error: 0x%08X",
        "CDeploymentProject::CreateFFUDeployment: Failed to get image info set. Error: 0x%08X",
        ";%;8;J;R;X;e;w;",
        "ERROR_DS_PROTOCOL_ERROR",
        "%hs: Failed to get system partition. Error: 0x%08X",
        ".?AU?$IDictionary@PAVString@UnBCL@@PAVCSPInternalPluginData@@@UnBCL@@",
        "CSetupAutomation::CacheInstallTarget: Failed to iterate over partitions: 0x%08x",
        "{6AADBA7D-FCCD-4B0C-834A-D174A4A89D61}",
        "CDeploymentProject::AddProvisioningPackage",
        "838:8Y8z8",
        "BfspPrintFileOwnerProcess: Failed to acquire debugprivilege",
        "WIM\\IMAGE",
        "%hs: WinRE image is not available on this system",
        "SPGenerateCopyListFromConfigFile: Didn't find file list in %s, section %s",
        ".?AVIOCMatcher@OC@@",
        "ServiceDebuggerFiles: ConfigBuffer is too small",
        "%hs: Executing offline gather operation",
        ";;;Q;X;^;c;n;y;",
        "? ?4?I?y?",
        "5,5054585<5@5D5X5\\5`5x5",
        "343Y3|3",
        "ERROR_INVALID_MEDIA_POOL",
        "u3h|'",
        "SmDiskPartitionEnumerator::GetNext",
        "ci.dll",
        "Image is no longer serviceable",
        "Failed opening target SOFTWARE hive %ls",
        "7!7&767>7E7g7n7t7y7",
        "ReleaseMutex",
        ";t<}<",
        "CSetupPlatformCheckpoint::CopyLogFiles: An error occurred while processing the memory.dmp file",
        "MergeEtlFiles",
        "SSSSV",
        "%ws\\%ws",
        "void __stdcall ForEachPartition<class ForEachVolume::<lambda_803a65feb47116ea67afdf78ddf6f929>>(struct SetupPlatform::IDisk *,class ForEachVolume::<lambda_803a65feb47116ea67afdf78ddf6f929>)",
        "9'9>9N9Z9b9o9{9",
        "?N?`?h?n?{?",
        "DUStartup",
        "SPTaskRemoveSnapshot: Cannot open snapshot key, unable to get snapshot Info. Remove the task. Error: 0x%08x",
        "4\\4p4~4",
        "Adding/Starting pending services is complete",
        "1/1=1Y1l1s1",
        "%hs: \"%s\" does not exist.",
        "ERROR_LOGON_SERVER_CONFLICT",
        "=0=D=X=l=",
        "QVj>jVjd",
        "  Parameter 4  : 0x%I64X",
        "6:6n6y6",
        "5&5/585A5R5[5d5n5w5",
        "6 6-696?6L6]6j6t6{6",
        "ERROR_RESOURCE_CALL_TIMED_OUT",
        "5J5_5z5",
        "Failed to remove folder %s. Error: 0x%08X",
        ".tls$ZZZ",
        "7)757?7H7U7a7r7",
        "WNetAddConnection2W",
        ".?AVCXXXXXHandledException@?NN@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "%hs: Finished at %.2d:%.2d:%.2d",
        ".?AV?$SmartPtr@VCCFGSectionRegistry@@@UnBCL@@",
        "xEj:Xf",
        "2*323>3E3K3P3[3f3z3",
        "SL_E_LICENSE_SERVER_URL_NOT_FOUND",
        ";$;,;4;<;D;L;T;\\;d;l;t;|;",
        "9'959?9I9S9]9t9",
        "Failed to set serial debugging baudrate. Status = 0x%X",
        "5,5P5t5",
        ".?AV?$ArrayList@PAVCDriverInfo@@@UnBCL@@",
        "3,3<3L3\\3l3|3",
        "?%?-?4?;?G?N?T?Y?d?n?s?",
        ";+;4;:;G;M;R;c;n;|;",
        "CreatedSnapshot",
        "DismDelete",
        "<0<N<[<i<p<v<|<",
        "Failed to open BCD object. Status = %d",
        ".?AV?$DefaultInstanceFactory@VCEnableNetDebugging@@@UnBCL@@",
        "Failed to create GUID folder.",
        "%hs: WinRE installation disk space impact: %I64u",
        "9\\$Xu",
        ".PAVCXXXXXHandledException@?6??SPExecuteFirstBootCompletion@@YGJPAVString@UnBCL@@@Z@",
        "0%030:0H0O0]0d0r0y0",
        "Failed to save time to file: %s. Error = %d",
        "SPDeleteAllSnapshots: Function called for query",
        ";\";(;5;G;Q;f;n;t;",
        "%hs: Failed to create target directory %s, error: 0x%08X",
        "%hs: Internal rollback requested but WinPE is not available in this scenario",
        "IDR_SETUP_FONT",
        ".?AV?$SmartPtr@UISerializable@UnBCL@@@UnBCL@@",
        "=-=7=I=Q=W=a=k=",
        "4#4)4.494C4R4b4i4o4t4",
        "SPAPI_E_GENERAL_SYNTAX",
        "9$9-9^9|9",
        "ERROR_HOST_DOWN",
        ".?AV?$SerializableBase@VCDownloadDUUpdates@@$0A@V?$DefaultInstanceFactory@VCDownloadDUUpdates@@@UnBCL@@@UnBCL@@",
        "ERROR_BAD_DRIVER",
        "Failure while getting the known folder path for %s (%s)",
        "struct PartitionLayoutArgs **__thiscall UnBCL::ArrayList<struct PartitionLayoutArgs *>::GetBuffer(int)",
        "7$7<7@7X7\\7t7x7",
        "2#2.2<2h2r2",
        "QVPWj",
        "CI EA is only supported on hosts Windows 8 and higher.",
        ";X;^;d;o;};",
        "Local\\wimmount_ready_event_%s",
        "CNewSystem::QueueRecoveryImageInstallation",
        "fYfXf",
        "1)161Y1h1s1}1",
        ".?AVCCleanupEntry@CSimpleCleanup@@",
        "9(939>9Z9w9",
        "Failed to get driver info from external driver package %s. Error: 0x%08X",
        "CSetupPlatformPrivate::Execute: Failed to deserialize/execute post-OOBE operations. Error: 0x%08X",
        "onecore\\base\\cbs\\util\\cbsutil.cpp",
        "tXVVj",
        "TCPAf",
        "ERROR_COMPRESSION_DISABLED",
        "<\"<-<A<Y<p<w<}<",
        "long __thiscall CAppXValidator::ValidatePreExecution(struct IExecutionContext *,enum OP_EXECUTION_PHASE,class COperation *,class COperationQueue *,int &)",
        "0/0_0q0y0",
        "5D6j6",
        "QueueLanguagePackages called with packages directory %s",
        ">%>0>L>f>",
        "pRunFastCleanup",
        "5,6L6h6",
        "void __thiscall UnBCL::ArrayList<class CAppInfo *>::CopyTo(class UnBCL::Array<class CAppInfo *> *,int) const",
        "VWhH ",
        "8(868J8[8h8p8",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@J@UnBCL@@@_@UnBCL@@",
        "?Load@XmlDocument@UnBCL@@QAEXPAVString@2@@Z",
        "RPC_S_INVALID_ASYNC_HANDLE",
        "3 3x3",
        "|SYSPART|",
        "Get incorrect snapshot info [%s] from config file",
        "0#1d1",
        "GlobalMemoryStatusEx",
        "1%292F2b2v2",
        "4(444@4L4X4d4p4|4",
        "??0InvalidOperationException@UnBCL@@QAE@PBVString@1@@Z",
        "0Qh\\>",
        "=$=H=X=`=d=h=l=t=",
        "OperationEndTime",
        "SPReserveMoveInternal: Failed to move [%s] to [%d]. hr = 0x%08X",
        ">3>9>K>[>h>p>",
        "base\\ntsetup\\setupplatform\\lib\\util\\provisioningpackage.cpp",
        "<'<.<=<K<S<Z<s<y<",
        "5L5e5l5s5z5",
        "DebugCreate",
        "3-3h3u3",
        "WIMBoot partition information is incorrect. Assuming partition is intact. Info read: %s",
        "=\"=R={=",
        "ERROR_INVALID_FILE_VERSION_TAG",
        "=!=-=X=i=",
        ">)>7>P>",
        "Failed to open a handle to the template store. Status = [%x]",
        "void __thiscall UnBCL::ArrayList<__int64>::CopyTo(class UnBCL::Array<__int64> *,int) const",
        ":B:`:",
        "pGetProvisioningPackagePayload: Failed to enumerate elements for provisioning package. Error: 0x%08X",
        "CDeploymentProject::CreateVHDDeployment: Failed to create setup automation; Error: 0x%08X",
        "5,5<5L5\\5l5|5",
        "=)=@=G=U=e=y=",
        "4*4A4H4N4S4^4j4r4",
        "6I7g7s7",
        ".?AV?$Hashtable@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@",
        "%hs: Failed to restore WinRE from the backup directory. hr = 0x%08X",
        "0 0(00080@0H0L0T0\\0`0h0l0t0|0",
        "CDeploymentBase::SetDownlevelOSSQMAndWatsonParams",
        "L$ SP",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class DiskLayout *>::MoveNext(void)",
        "1(151E1J1V1k1v1",
        "4 444<4D4L4T4`4",
        "{00438428-F1B0-4507-8567-7A90F587130C}",
        "sSrcOSPieces",
        "9'9A9_9u9",
        "Deleting existing file",
        "5&686@6F6S6b6",
        "void __thiscall UnBCL::ArrayList<struct PartitionLayoutArgs *>::QuickSort(class UnBCL::ArrayList<struct PartitionLayoutArgs *> *,class UnBCL::ArrayList<struct PartitionLayoutArgs *> *,int,int)",
        "<'<.<",
        "0N0c0o0z0",
        "<1=8=>=C=N=d=x=",
        "6*6Q6^6c6n6",
        "=2>M>W>a>g>u>",
        "?%?-?=?L?h?s?",
        "142T2\\2s2",
        "1A1f1m1z1",
        "Failed to copy NTLDR object data. Status = [%x]",
        "ERROR_DRIVER_DATABASE_ERROR",
        "WIMCloseWIM",
        "=$=6=?=H=Q=Z=f=o=",
        "ZwTranslateFilePath",
        "Actions",
        "8(818I8w8",
        "MachineIndependent_XMLs",
        "RPC_S_INVALID_BOUND",
        "BcdGetElementDataWithFlags: Failed to open elements key.Object: %ws Status: %x",
        "ClPQV",
        "%hs: Cannot retrieve volume name for the installation path.",
        ".PAVCXXXXXHandledException@?5??SPProcessServiceEnable@@YGXPBG@Z@",
        "8%8,84898H8S8_8m8",
        "7%7,797E7N7[7t7}7",
        "addKey",
        "SetupPlatform: Phase \"Pre-SysPrep\" completed successfully.",
        "WShtR",
        "%hs: Failed to set BCDE_OSLOADER_TYPE_SYSTEM_ROOT field. Status = %d",
        "2-262K2T2b2i2o2t2",
        "JET_errVersionStoreOutOfMemoryAndCleanupTimedOut",
        "Identity missing language.",
        "5%595I5R5Z5d5l5s5",
        "BootCommandNormal",
        ";<;L;\\;l;|;",
        ";\";:;^;",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CShellFolderInfo *>::MoveNext(void)",
        "\\Program Files (x86)",
        "Previously failed to configure auto-unlock, will suspend protection on the OS volume",
        "\\r'hL",
        "<$<B<T<\\<b<t<",
        "DynamicUpdate.Critical",
        "%s.%s",
        "r5f9LF",
        "Failed to set the Online Apply rollback checkpoint",
        "0&0C0J0S0X0`0k0t0z0",
        "SPDeleteOldUpgradeSnapshots: Function called for query",
        "='=7=Q=[=l=",
        ".?AVCFindAllPathsData@@",
        "8?8o8",
        "eCInstallEula::DoExecute",
        "ERROR_EVT_MESSAGE_ID_NOT_FOUND",
        "SmPartition::EnumerateLogicalPartitions",
        "XConnectedStandby",
        "Cannot get the recovery image folder from the GlobalPath",
        "505>5L5Z5h5v5",
        ".?AV?$Array@PAVCWIMBootData@@@UnBCL@@",
        ".?AV?$DefaultInstanceFactory@VCSimpleCleanup@@@UnBCL@@",
        "PPVVV",
        "7h8@9",
        "5!5+5M5a5o5}5",
        "QVWh(",
        "CEnableSafeOSPageFile::DoExecute: NtCreatePagingFile failed to create a %llu byte page file at %s: 0x%08x",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *> *,int,int)",
        "%hs: Successfully register RollbackOnlineSystem into the Setup key",
        "3%3@3X3_3e3j3u3{3",
        "WINDOWS\\Panther",
        "?:?B?U?]?d?v?",
        "5*5w5",
        "class COperationResult *const *__thiscall UnBCL::ArrayList<class COperationResult *>::GetBuffer(int) const",
        "1^1}1",
        "<-<E<Z<",
        "NtSaveKeyEx",
        ".?AVCXXXXXHandledException@?BI@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "ERROR_REPARSE_TAG_MISMATCH",
        "OFFLINE PROFILES: Apply happens offline, no point in creating offline user profiles",
        "849c9j9",
        "2 3G3",
        "class CPartitionInfo *const *__thiscall UnBCL::ArrayList<class CPartitionInfo *>::GetBuffer(int) const",
        "5 5&5F5K5X5^5d5u5~5",
        "7 7$7(70787<7@7H7L7P7T7X7\\7d7h7l7p7t7x7|7",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *> *)",
        "%hs!%p: ",
        "j}Yf;",
        "DriverStoreGetObjectPropertyW",
        "DlTel.etl",
        "%hs: User %s%s%s%s from the new system does not have a profile on the old OS. Will not be restored.SPDoUninstallApply",
        "ERROR_STACK_BUFFER_OVERRUN",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@PAVMultiSz@2@@UnBCL@@@_@UnBCL@@",
        "5)5M5o5",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: \"%s\" does not exist.",
        "HKEY_USERS\\.DEFAULT",
        "CSetupAutomation::GetDiskInfo: Failed to iterate over disks: 0x%08x",
        "080F0P0Z0d0n0",
        ".?AVCMergeWIM@@",
        ":7:L:y:",
        "838E8^8k8s8",
        "%hs: PnpPropMigGatherW failed. Error: 0x%08X",
        "bootarm.efi",
        "FBf;E",
        "6#6-6@6~6",
        "Removing the recovery partition as an undo operation",
        "%hs: Failed to read %s boot entry GUID from %s. hr = 0x%08X",
        ":';D;g;",
        "pSPCopyFile",
        "Directory %s does not exist",
        "No crash detected, but we will attempt to boot again.",
        "7/777=7G7Q7g7~7",
        ">+>4>:>G>M>R>c>n>|>",
        ":):1:::@:T:j:t:",
        "=N=l={=",
        "(%lx): Unable to delete [%ws]",
        "ERROR_DS_ATTRIBUTE_TYPE_UNDEFINED",
        "000=0E0[0",
        "5/5G5c5j5p5u5",
        "5+5=5M5e5s5",
        "SPIsPathOnRecoveryPartition",
        "131>1N1X1j1r1x1",
        "Filter evaluation: Operator is not valid for a numeric property",
        "class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::get_Item(int)",
        "JET_errNotInTransaction",
        "5?5I5V5\\5c5m5z5",
        "GetObjectW",
        "=#=.=5===F=T=",
        "  Active: %s",
        ":B:U:",
        "Error creating Rollback entry %s. Error: 0x%08X",
        "CRYPT_E_ASN1_BADREAL",
        ".?AU?$ICollection@PAVCFilterDriverInfo@@@UnBCL@@",
        ".?AVCOfflineOCManager@OC@@",
        "VdsPlatform::ComputeHostInfo: Can't find host OS partition; no disk will be marked as the host",
        "0,030O0",
        "NtClose",
        "<:<A<T<h<o<",
        ">->j>",
        "2 21282>2C2N2[2c2i2}2",
        "CSetupPlatform::CreateNewSystem: No source image index provided.",
        "CNewSystem::QueueEnableFeature",
        "=$=0=9=E=J=S=_=k=p=y=",
        "8/888P8W8]8b8m8w8|8",
        "8 8$8<8@8X8\\8t8x8",
        "Failed to allocate memory for device object.",
        ".?AVbad_alloc@std@@",
        "pAddSafeOSDrivers: Failed to initialize DISM. Error: 0x%08X",
        "void __thiscall UnBCL::ArrayList<class CFileCreationData *>::Resize(int,int)",
        "na:Bootable",
        "__thiscall UnBCL::ArrayList<class CUserProfile *>::ArrayList(const struct UnBCL::ICollection<class CUserProfile *> *)",
        "ERROR_BAD_STACK",
        "QhP]8",
        "PVWhW",
        "false",
        "The subject failed the specified verification action. Most trust providers return a more detailed error code that describes the reason for the failure.",
        "JET_errDbTimeCorrupted",
        "SetupDiOpenDeviceInfoW",
        "ERROR_PROFILE_NOT_FOUND",
        "SVWj2",
        "ERROR_CLUSTER_LOCAL_NODE_NOT_FOUND",
        ">&>B>V>d>",
        "3(3A3H3O3U3d3j3~3",
        "class UnBCL::ArrayList<class CFileCreationData *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class CFileCreationData *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "The trust provider does not support the specified action.",
        "<FALLBACK LANGUAGE=\"%s\">%s</FALLBACK>",
        "ERROR_INSTALL_PACKAGE_REJECTED",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@W4OP_EXECUTION_PHASE@@PAV?$ArrayList@PAVCOperation@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "1 1'141K1W1g1y1",
        "161\\1d1u1",
        "3!353H3S3`3p3w3",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *> *)",
        "?+?=?c?",
        "L$,Qh",
        ".?AU?$ICollection@PAV?$DictionaryEntry@_JPAVCGlobalPath@@@UnBCL@@@UnBCL@@",
        "6)6K6_6m6{6",
        "Install",
        "7+767J7h7x7",
        "class CFailForwardSystem *__stdcall UnBCL::Try_Cast<classCFailForwardSystem*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "0'1K1o1",
        "=(=6=",
        "??0MultiSz@UnBCL@@QAE@XZ",
        ">'?1?;?@?J?Y?a?k?z?",
        "1!181?1E1J1U1`1e1r1}1",
        "void __thiscall UnBCL::Array<struct UnBCL::ISerializable *>::RemoveAt(int)",
        "SmDiskPartitionEnumerator::Initialize",
        ")BasePath",
        "132E2R2",
        "2)2?2\\2c2i2n2y2",
        ";6;O;^;n;",
        "< <%<0<:<M<V<_<h<u<|<",
        ":$:,:4:<:D:L:T:\\:d:l:",
        "pSetupStringTableEnum StrTabDriverStoreDeviceIds failed, Err = 0x%lx",
        "(%lx): Failed to process offline registry",
        "=,=<=J=]=f=l=s=",
        "FileName",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAI@Z",
        "D$@SV3",
        "5#5-575A5O5U5[5`5j5t5~5",
        "ERROR_FS_DRIVER_REQUIRED",
        "Php[G",
        "2*262=2C2H2S2a2u2~2",
        "VdsPartition::RefreshVdsProperties: Couldn't query disk extents (0x%08x)",
        "FeaturesOnDemand",
        ".?AV?$ArrayList@PAVCCopyInfo@@@UnBCL@@",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: DeletePath(%s) succeeded.",
        "int __thiscall OSRollbackService::CCheckpoint::MoveOrCopyDirectory(class UnBCL::String &,class UnBCL::String &)",
        "Onesettings: Querying Prod server",
        "SPStopSetupTracingSessionAndMergeFile",
        "struct SetupPlatform::IPartition **__thiscall UnBCL::ArrayList<struct SetupPlatform::IPartition *>::GetBuffer(int)",
        "CBS_E_SOURCE_MISSING_FROM_WUSUS_BYPASS_EXPRESS",
        ";/;};",
        ".PAVCXXXXXHandledException@?2??DoExecute@CValidateSafeOS@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "213J3Q3]3s3",
        "%hs: Recovery image folder: %s, image index: %u",
        "File %s is too large!",
        "8,8<8A8J8f8m8t8",
        "=&=-=4=R=Y=`=g=",
        "282^2k2",
        "1<1b1t1|1",
        "SYSTEM32",
        ".PAVCXXXXXHandledException@?FD@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *> *)",
        "4#5g5",
        "Apply statistics: uninstall",
        "BootNext",
        "int __thiscall UnBCL::ArrayList<struct DiskRange>::IndexOf(struct DiskRange,int,int) const",
        "pSPMergeWim: Invalid WIM file %s. Error: 0x%x",
        "void __thiscall UnBCL::Array<class CDriverInfo *>::InitLarva(class UnBCL::ArrayList<class CDriverInfo *> *)",
        "void __thiscall UnBCL::ArrayList<class CGlobalPathFindData *>::RemoveAt(int)",
        "%hs: The new boot entry will be set as default boot entry",
        ".?AV?$Array@PAVCCFGSectionValue@@@UnBCL@@",
        "??1type_info@@UAE@XZ",
        "JET_errStartingRestoreLogTooHigh",
        "ZwQueryKey",
        "int __thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,class UnBCL::DictionaryEntry<unsigned long,struct IVdsVDisk *>,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<unsigned long,struct IVdsVDisk *> __stdcall UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsVDisk *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "ERROR_GROUP_NOT_AVAILABLE",
        ".?AV?$SmartPtr@V?$ArrayList@E@UnBCL@@@UnBCL@@",
        ": :$:4:8:H:L:\\:`:p:t:",
        "wimserv.exe",
        "Couldn't find an executable in the command line",
        "    Failed to find elements stop node",
        "7%7G7\\7j7x7",
        "1!2'202;2y2~2",
        "6#6*686J6[6b6p6",
        "Failed reading uninstallwindow from Onesettings: 0x%x",
        ">*>L>i>z>",
        "ERROR_EC_LOG_DISABLED",
        "JET_errInvalidParameter",
        ".?AV?$SerializableBase@VCSetBusParams@@$0A@V?$DefaultInstanceFactory@VCSetBusParams@@@UnBCL@@@UnBCL@@",
        "232j2q2w2|2",
        "ERROR_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT",
        "MoveDirectoryFileCallback: Failed, creating directory %s",
        "ERROR_QUORUMLOG_OPEN_FAILED",
        "<9<Y<v<}<",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::MoveNext(void)",
        "class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::get_Item(int)",
        ":r8j:h",
        "SPAPI_E_DEVINFO_LIST_LOCKED",
        "void __thiscall UnBCL::ArrayList<class CDeploymentBase *>::RemoveAt(int)",
        "RPC_X_SS_CHAR_TRANS_SHORT_FILE",
        ".?AV?$CAutoCleanupBase@PAVTraceLoggingCorrelationVector@@@RAII@@",
        "SPAllocateRange: No space left on disk",
        "WIM handle created",
        "GetFileInformationByHandleEx",
        "Assert failed to build string.",
        "2'202:2C2M2V2`2i2r2|2",
        "%hs: Failed to enable global logger %s. Error: 0x%08X",
        ";,;G;N;W;\\;g;u;",
        "CSetupPlatform::CreateNewSystem: Compact OS installation is only supported if the source is a WIM file",
        "=/===V=]=d=j=v=",
        "1*1<1D1J1W1i1s1",
        "=I=e=p=",
        "6,686X6`6h6p6x6",
        "void __thiscall UnBCL::Array<class CAppInfo *>::Remove(class CAppInfo *)",
        "5'535<5H5Q5c5l5v5",
        ".?AU?$IEnumerator@PAVCCheckpoint@OSRollbackService@@@UnBCL@@",
        "pDeterminePageFileRequirements: Will need a total of %llu byte(s) from page files",
        "CleanupPhase",
        "DiskLayout::ApplyProperties: Failed to set volume label: 0x%08x",
        "1p2w2",
        "ERROR_FILE_VERSION_LIMIT_EXCEEDED",
        ".?AV?$SerializableBase@V?$Array@I@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@I@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        ":6:J:[:h:",
        "ERROR_DLL_INIT_FAILED",
        "3\"3S3",
        "90:P:",
        ";1;@;Z;",
        "0,040<0D0L0X0x0",
        "VdsImageDisk::InitializeProperties: Failed to get VDisk properties (0x%08x)",
        ".?AV?$SerializableBase@VCSetupClRequest@@$0A@V?$DefaultInstanceFactory@VCSetupClRequest@@@UnBCL@@@UnBCL@@",
        "COperationsProgress::RegisterProgress",
        "31393?3L3^3l3",
        ">,>1><>",
        "ValidateInput: Either UseAllSpace or TotalSetors must be specified for partition",
        "AntiVirusProduct",
        "Failed to set CI EA on temporarily extracted ci.dll.",
        ".?AV?$SerializableBase@V?$Array@PAVCFileCreationData@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCFileCreationData@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
        "1+141A1S1X1^1d1n1",
        "_DismApplyProvisioningPackage",
        ">,>4>?>G>N>c>y>",
        "9,9L9x9",
        "74797G7L7V7m7x7}7",
        ".PAVCXXXXXHandledException@?2??DoExecuteInternal@CDownloadDUUpdates@@IAEJHHPAUIDownloadCallback@SetupPlatform@@PAUIExecutionContext@@PAUITelemetry@@PAXPAUIDUDownloadProgress@4@PAPAVCDUPackageCollection@@@Z@",
        "?X?q?x?",
        "ERROR_LOST_WRITEBEHIND_DATA_NETWORK_SERVER_ERROR",
        "DiskLayout::VerifyPlanTypesValidForStyle",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::IndexOf(class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *,int,int) const",
        "9N9l9{9",
        "CSetupAutomation::CacheInstallTarget",
        "9!9+9>9X9_9e9j9y9",
        "SL_E_GRACE_TIME_EXPIRED",
        "080@0H0X0`0",
        ";,;1;6;;;Q;a;p;z;",
        "Fail to update the WIM header",
        "ProvisioningPackage::OpenProvisioningPackage",
        ">$>,>8>@>`>p>",
        "OC::COCCbsAdapter::InitOnline: Failed to find the Foundation Package name",
        "OPERATIONTRACK ExecuteOperations: Start execution phase %s",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCOperationResult@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "2#202B2P2h2m2",
        "7$727@7v7",
        "5#5+555=5C5H5W5n5u5{5",
        "SPCreateDiskImage",
        ".PAVCXXXXXHandledException@?CL@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "9\"9,959>9G9P9Y9b9k9t9}9",
        "PSVWR",
        "dv-MV",
        "5Z5r5",
        ".PAVCXXXXXTemp@?6??SPQuerySnapshotSize@@YGJPAVString@UnBCL@@PA_J11@Z@",
        ":D:p:",
        "BfsRepair: Failed to repair BCD store. Error: %08x",
        "    Failed to get value attribute value",
        "7$7E7S7|7",
        "WinHttpQueryHeaders",
        "<-<@<H<N<[<m<",
        "CompressionFolderList",
        "030L0_0x0",
        "SL_E_PLUGIN_INVALID_MANIFEST",
        "CARPValidator::CheckARPContainment",
        "RPC_S_PROCNUM_OUT_OF_RANGE",
        "<\"<)<3<I<g<n<w<|<",
        "f90tk",
        "4N4^4f4",
        "ERROR_INVALID_DLL",
        "D$@VP",
        "5!5-585M5b5~5",
        "8%8*858B8R8b8n8z8",
        "Create nucleus windows at %ws",
        "5%525C5P5\\5r5{5",
        "??_DStringPtr@UnBCL@@QAEXXZ",
        ".?AVVdsPhysDisk@@",
        "<*=4=",
        "SPReadXmlFile: Failed to read %s: 0x%08x",
        "5-545>5O5\\5e5v5",
        "REG_SZ",
        "<$<,<2<?<Q<_<",
        "JET_errMissingCurrentLogFiles",
        "SVWhx",
        "D$4WSP",
        ".?AV?$SerializableBase@VCCleanupEntry@CSimpleCleanup@@$0A@V?$DefaultInstanceFactory@VCCleanupEntry@CSimpleCleanup@@@UnBCL@@@UnBCL@@",
        "4#4.4<4h4r4",
        "232W2{2",
        "SKIPBOOTTRACK(SAFEOS): Skip Boot Validator: OS partition's file system has the dirty bit set, cannot continue with SafeOS boot removal.",
        "? ?'?.?5?9?=?A?E?I?k?",
        "1(121<1F1]1v1",
        "Failed to set element bootstat device. Status = %x",
        "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%",
        ".?AU?$IEnumerator@PAVCFileCreationData@@@UnBCL@@",
        "  Major Version = %d",
        "FirstBootTime",
        "|SYSROOT|",
        "?.?A?O?X?a?i?v?",
        "Onesettings: Failed to get fixed file info: 0x%x",
        "24292B2Q2g2l2u2",
        "6!6*636<6N6h6~6",
        "BootFilesServiced",
        "Failed to create reserved file's parent path",
        ".?AV?$SmartPtr@VCSPTelemetryData@@@UnBCL@@",
        "MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\PROFILELIST",
        "Name_U",
        "?+?2?=?J?\\?d?n?{?",
        "4,5I5P5V5[5f5p5u5",
        "8G8|8",
        "2$252B2L2[2d2j2w2}2",
        "1&171M1",
        "8T8m8r8",
        "Encountered file with excess reparse data. Id 0x%08x%08x",
        "DUInstallFailedReason",
        "9&979D9L9^9f9l9~9",
        "OC::COfflineOCManager::RestoreOCStatus",
        "Report progress failed",
        "Description",
        "4'4.4<4G4M4a4s4~4",
        ".PAVCXXXXXHandledException@?BA@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "%hs: Failed to create directory %s , ec = [%x]",
        "LayNtBootCode: Error writing existing boot sector to file on disk!",
        "??1Object@UnBCL@@UAE@XZ",
        "%hs: Error while writing the last migration scope value: 0x%08X",
        "?#?7?R?i?q?",
        ">!>R>c>x>}>",
        "ERROR_CLUSTER_NODE_NOT_FOUND",
        "343<3B3X3^3n3w3",
        "Downlevel OCs:",
        "989i9",
        ".?AV?$DefaultInstanceFactory@VCVHDImageInfo@@@UnBCL@@",
        "1#1G1k1}1",
        "323;3m3",
        "Element",
        "ERROR_FT_READ_RECOVERY_FROM_BACKUP",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCCmdLineExecutionTelemetryData@OC@@@UnBCL@@@UnBCL@@",
        "5-5B5Q5Z5f5u5",
        ">/>?>[>o>|>",
        "SmPlatform::IsAvailable: Failed to detect OS version (%0x%08X)",
        ".?AVCMountedPathInfo@CDeploymentBase@@",
        "142d2",
        "(%lx): Failed to open source key [%ws].",
        "SPGetDiskImage: Failed to copy disk image path (0x%08x)",
        "<$<.<Y<p<",
        "Upgrade hive updates ares only supported in online mode; cannot proceed...",
        "class CDeploymentBase::CMountedPathInfo *const *__thiscall UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *>::GetBuffer(int) const",
        "0123456789abcdef",
        "%hs: Default boot entry does not exist.",
        ":$:,:4:<:D:L:T:\\:h:",
        "4H5`5",
        "5&5:5D5k5",
        "ERROR_DS_DRA_MAIL_PROBLEM",
        "%hs: Could not build disk info from path %s. hr = 0x%08X",
        "SPProcessBitlockerOnDrives",
        "Software\\Microsoft\\Windows NT\\CurrentVersion\\",
        "void __thiscall UnBCL::Array<class CCFGSectionValue *>::RemoveAt(int)",
        ".?AV?$DictionaryEntry@W4OP_OPERATION_ID@@H@UnBCL@@",
        ">%>6>L>b>x>",
        "454Q4[4e4k4x4",
        ";#;(;3;=;P;^;e;k;p;{;",
        "SetFilePointerEx",
        "9%939I9p9x9",
        "virtual disk provider",
        "%hs: %s environment variable detected, verbose logging is enabled.",
        "5 5(5L5\\5d5l5t5|5",
        "8$8V8",
        "4#424<4A4I4P4\\4n4",
        "8&8<8F8[8m8u8{8",
        "_ExecuteRollback",
        "    Failed to get path root",
        "pDeterminePageFileRequirements: Will use existing %llu-byte page file at %s",
        ":+:<:W:f:m:s:x:",
        "WVhpA",
        ":MdSpt",
        "5\"5/5B5X5",
        ":*:=:D:J:O:Z:f:z:",
        "CAddAppxPackage::DoExecute: Failed to allocate Appx license paths.",
        "void __stdcall UnBCL::_::HTEnumerator<unsigned long,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,&protected: static struct IVdsVDisk * __stdcall UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsVDisk *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<unsigned long,struct IVdsVDisk *> *,class UnBCL::Array<struct IVdsVDisk *> *,int)",
        "SYSTEM\\Setup\\SQM\\DWORD64\\%08x",
        "Failed to initialize global state. Status = [%x]",
        "RestoreFileMetadata",
        "TRUST_E_NOSIGNATURE",
        ".PAVCXXXXXHandledException@?2??MoveOrCopyUpdates@CDownloadDUUpdates@@IAEJPAVCDUPackageCollection@@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@@UnBCL@@PAX@Z@",
        "7*7B7^7e7k7p7{7",
        "9#9.959I9w9",
        "%hs: Failed to save the boot manager timeout",
        "productState",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCRegCreationData@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCRegCreationData@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "ERROR_INVALID_DOMAIN_ROLE",
        "CSetupPlatformOnline::Initialize",
        ".?AVException@UnBCL@@",
        "%hs: Cannot relocate driver config file %s to %s. Error: 0x%08X",
        "ERROR_NOT_DOS_DISK",
        "0x1~1",
        "Quarantine.NewPaths",
        "OperationState",
        "ERROR_REGISTRY_HIVE_RECOVERED",
        ":,:<:H:T:[:j:t:{:",
        "%s%s%05u%s",
        ":::A:N:^:",
        "ERROR_PROCESS_IS_PROTECTED",
        "8 8,8?8D8I8U8o8{8",
        ".SP_ENV_DISABLE_NEO_PATH",
        "EventSetInformation",
        "7/7:7B7H7v7",
        "2?2I2Z2r2",
        "IVdsDiskPartitionMF2",
        "2(2?2V2]2c2h2s2~2",
        "=!=5=;=D=Z=h=",
        "4%5d5",
        "(%lx): Failed to set destination value key.",
        "7,838L8S8l8s8",
        "j\\Yf9L0`",
        "Image reference file %s for image on server %s",
        "; ;$;(;0;4;8;<;@;D;L;P;T;\\;h;l;p;t;x;|;",
        "8%8:8U8i8~8",
        "xNumPackagesAbandoned",
        "A;K$r",
        "<#=-=N=U=c=p=",
        "SPAPI_E_AUTHENTICODE_TRUST_NOT_ESTABLISHED",
        "Cannot remove the recovery partition. Error: 0x%08X",
        "%hs: Failure while loading image %d from file %s. Error 0x%08X",
        "<%<-<:<H<^<|<",
        "949O9|9",
        "AllowCommercialDataPipeline",
        "CExportWIM::DoExecute",
        "pGetImageInfoFromSoftwareHive: Failed to get image installation type from software hive. Error: 0x%08X",
        "LdrAccessResource",
        ";1;9;?;L;^;l;y;",
        ":):3:J:X:b:l:",
        ">!>&>J>`>s>z>",
        "5)6M6`6g6m6r6",
        "181X1x1",
        ".?AV?$DefaultInstanceFactory@VCAddDriver@@@UnBCL@@",
        "Failed to create XML writer",
        "RPC_S_UUID_LOCAL_ONLY",
        "Failed to export unload alterations to firmware. Status: %x",
        "Failed to move %s to %s. Error: 0x%08X",
        "7,787D7P7\\7h7t7",
        "Unable to get procedure OpenExistingOfflineStore",
        "__thiscall UnBCL::ArrayList<void *>::ArrayList(const struct UnBCL::ICollection<void *> *)",
        ".PAVCXXXXXHandledException@?2??BuildLPList@CLPValidator@@IAEJPAUIExecutionContext@@PAV?$ArrayList@PAVString@UnBCL@@@UnBCL@@@Z@",
        "0(00060@0J0^0t0",
        "SWhPO",
        "ERROR_SXS_XML_E_INVALIDSWITCH",
        "ERROR_USER_MAPPED_FILE",
        "6&6I6m6",
        ":+:I:\\:c:i:n:y:",
        "=2=L=q=",
        "4 4)4O4\\4d4m4w4~4",
        "ResurrectSetupPlatform: Did not find setup platform serialized data.",
        "Reserved.DynamicUpdate.Driver",
        "3&343B3P3^3",
        "L$$Q3",
        "%hs: Pending file rename operations:",
        "??0Exception@UnBCL@@QAE@XZ",
        "Apply statistics: offline",
        "File system type is: [%ws]",
        "=A=V=^=d=m=",
        "long __thiscall CMountWIM::DoExecute(struct IExecutionContext *,void *,struct IInternalOperationsProgress *)",
        "WWWPh",
        "%hs: progress: %d",
        ".?AV?$CAutoWdsLibFree@PAE@RAII@@",
        "5#5)5/545>5H5R5\\5j5p5v5{5",
        "6*616>6]6c6x6",
        ">*>;>K>d>n>",
        "7$767S7w7",
        "(NULL)",
        ";h;~;",
        ":6:=:C:H:S:]:l:x:",
        "3#494R4`4g4q4x4~4",
        "int __thiscall UnBCL::ArrayList<class ISPPluginData *>::IndexOf(class ISPPluginData *,int,int) const",
        "959?9I9O9]9",
        "7,8`8",
        "SL_E_VL_NOT_WINDOWS_SLP",
        "SetWindowTextW",
        "ERROR_SHUTDOWN_CLUSTER",
        "iswalpha",
        "SP_ENV_FAIL_FORWARD_INSTALL",
        "LastDeploymentChangeTime: %s",
        "Failed getting mum servicing LCU for package",
        "5C5J5P5U5`5h5m5",
        "ERROR_BAD_FUNCTION_TABLE",
        "diager.dll",
        "D$d9C",
        "CDUPackageCollection::Append",
        "f3G f3G4f",
        ";Y;z;",
        "Provisioning package is already in the final location, not need to relocate",
        "9*9>9E9K9Q9\\9f9y9",
        "ERROR_SERVICE_DATABASE_LOCKED",
        "7,747@7`7h7t7",
        "Failed to add Device ID to StrTabDriverStoreDeviceIds string table, Err = 0x%lx",
        "7+727P7",
        "void __thiscall UnBCL::ArrayList<class COperationInfo *>::RemoveAt(int)",
        "int __thiscall UnBCL::ArrayList<class CDeploymentBase *>::LastIndexOf(class CDeploymentBase *,int,int) const",
        "<&=\\=p=~=",
        "FieldName",
        "181@1L1l1t1|1",
        "2#2+202<2O2Y2m2z2",
        "WinPE\\bootstat.dat",
        ">\">5>A>",
        "PWh(v",
        ":&:E:M:X:a:l:t:",
        "ITimeTrigger::put_StartBoundary failed. hr = 0x%x",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CDriverDetails *>::MoveNext(void)",
        "9N:U:~:",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *> *)",
        "ERROR_DS_TIMELIMIT_EXCEEDED",
        "233^3",
        "9F9q9x9",
        "Failure while validating app path [%s]. Error: 0x%08X",
        ".PAVCXXXXXHandledException@?5??SPRemoveScheduledTask@@YGJPBG0H@Z@",
        "JET_errMissingRestoreLogFiles",
        "Current phase : %u",
        "=#=8=@=F=S=e=",
        "    Failed to delete temporary file",
        ";3;H;S;Z;k;y;",
        "DRIVERS",
        "> >$>(>0>T>\\>`>d>h>p>",
        "8$868@8J8T8n8|8",
        "JET_errNoBackupDirectory",
        "tjj:V",
        "0(0H0P0X0d0",
        ")SmDisk::EnumeratePartitions",
        ":*:u:",
        "5 545B5b5u5",
        "_RemoveSnapshot",
        "WWWPW",
        "?&?,?1?<?G?M?a?",
        "?%?2?]?j?",
        "9\"949P9W9]9i9u9",
        "CFailForwardSystem::QueueEULAAccepted",
        "ERROR_IMAGE_MACHINE_TYPE_MISMATCH",
        "6&6.646H6",
        "QueryServiceStatus",
        "ERROR_DEVICE_NOT_PARTITIONED",
        "6&6.646A6S6l6",
        "E_NOINTERFACE",
        "%systemdrive%\\Recovery",
        "4.4A4M4Y4e4q4}4",
        "=%=5=E=d=",
        "?L?^?f?l?y?",
        "1&181?1",
        "626C6",
        "Failed to stop trace: 0x%x",
        "7&7:7C7O7Y7g7o7{7",
        "9#:3:s:",
        "CRYPT_E_ASN1_NYI",
        "0%050<0B0G0R0]0",
        "> >%>*>5>L>f>k>p>|>",
        "FveOpenVolumeW",
        "6%6.676P6^6t6",
        "3&3D3L3a3j3",
        "OSRollbackService::CSetupRollbackService::RollbackInitialize",
        "ERROR_DS_SEMANTIC_ATT_TEST",
        ";%;,;5;A;H;N;S;^;h;{;",
        "FltCommStubRename",
        "1+1R1Y1_1d1o1~1",
        "080E0`0n0w0",
        "6 646<6D6T6`6",
        ">)>6>H>P>V>c>u>",
        "Manipulating SetupCl status in offline mode requires access to the offline SYSTEM hive.",
        "<*<4<I<j<s<x<~<",
        "BCryptCreateHash",
        ".?AU?$IDictionary@KPAUIVdsVDisk@@@UnBCL@@",
        "?0?7?=?B?V?`?s?",
        "4*444S4|4",
        "CARPValidator::BuildInfoList",
        "0&0v0",
        "8L8f8",
        "BatteryIsCritical",
        "1!282>2G2b2l2x2",
        "RtlInitializeBitMap",
        "WinRETel-M%c.etl",
        "2!2'2,272B2R2i2}2",
        "282D2d2l2t2|2",
        "ERROR_UNEXPECTED_MM_MAP_ERROR",
        "SWhpN",
        "PackageName",
        "939M9f9r9{9",
        "pDeterminePageFileRequirements: Failed to get existing page file info: 0x%08x. If there are existing page file(s), they might not be reused.",
        "set HKLM\\System\\Setup\\BuildUpdate\\RecoveryDestination",
        "Prepare SafeOS for rollback",
        "6d6u6",
        "2%212G2y2",
        "CreateMutexW",
        "FeatureOnDemand",
        "9%:,:2:7:B:P:d:q:",
        "VdsPlatform::Initialize: Initialize completed successfully.",
        "\\O#]`",
        "ERROR_FLOPPY_ID_MARK_NOT_FOUND",
        "int __thiscall UnBCL::ArrayList<class CCopyInfo *>::LastIndexOf(class CCopyInfo *,int,int) const",
        "5-5\\5n5v5|5",
        "NSVVVP",
        "ERROR_CLUSTER_RESOURCES_MUST_BE_ONLINE_ON_THE_SAME_NODE",
        "6F7'8",
        ".?AVCFinalizeCriticalBoundary@@",
        "Failed to load package list from old windows' servicing folder",
        "standalone",
        ".PAVCXXXXXHandledException@?M@??QueueRemoveFODPackage@CNewSystem@@UAEJPBGW4SP_ERROR_HANDLING@SetupPlatform@@@Z@",
        "CDownloadDUUpdates::DoExecuteInternal: Failed to store updates info. hr = 0x%x",
        "BfsRepair: Failed to get volume information %08x",
        "Failed creating target SOFTWARE hive path name %ls\\%ls",
        "< <C<h<~<",
        "ERROR_LOG_PINNED_ARCHIVE_TAIL",
        "92999r9",
        ".?AV?$SerializableArrayListBase@PAVCFileCreationData@@@_@UnBCL@@",
        "868Q8W8\\8q8",
        "868I8N8]8",
        "444b4p4z4",
        "SclRegProcessKeyByHandle",
        "%hs: Error while setting the SetupStartedBy value. Error: 0x%08X",
        "SL_E_TOKSTO_CANT_CREATE_MUTEX",
        "JET_errMissingLogFile",
        "<,<6<J<W<a<u<",
        "000Y0",
        "SetupPlatform::IsUninstallAllowed: Failed to check whether Uninstall Windowis is open. Error: 0x%08X",
        "7%7,72777C7N7b7",
        "6'6U6",
        "DiskLayout::Populate",
        "SWhPo",
        "94:H:m:",
        "3/3D3L3R3_3q3{3",
        "APPLICATION",
        "<$</<:<J<V<b<w<",
        "class UnBCL::DictionaryEntry<unsigned short,unsigned short> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::get_Current(void) const",
        ">,>1>=>J>",
        "=)=2=J=Q=`=g=r=",
        "0+0I0b0q0",
        "   OC: %s, Current State: %s",
        "4,4@4g4",
        "RtlGetThreadErrorMode",
        "=\"=C=`=w=",
        "ERROR_INVALID_COLORSPACE",
        "< <(<,<0<4<8<<<@<D<H<P<T<X<\\<d<h<l<p<t<x<|<",
        "525E5c5j5p5v5",
        ":,:0:H:L:d:h:",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,unsigned long>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,class ATL::CElementTraits<unsigned long> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "SKIPBOOTTRACK(FIRST): Skip Boot Validator: Will proceed with First boot removal.",
        "__thiscall UnBCL::ArrayList<struct PartitionLayoutArgs *>::ArrayList(const struct UnBCL::ICollection<struct PartitionLayoutArgs *> *)",
        "RPC_S_CANNOT_SUPPORT",
        "9)9/9B9X9u9",
        "ERROR_FAILED_DRIVER_ENTRY",
        "8&8j8",
        "Failure while requesting driver installation payload copy. Error: 0x%08X",
        "=\"=)=.=5=F=V=c=i=",
        "MIG_ROLLBACK_DIR",
        "DiskLayout::ApplyLayout: Failed to apply in-place partition resizes from disk layout (0x%08x)",
        "EncodedPath",
        "RegDeleteValueW",
        "int __thiscall UnBCL::ArrayList<class CRegCreationData *>::LastIndexOf(class CRegCreationData *,int,int) const",
        "BootManager",
        "SetupPlatform::DISK_PROPERTIES *__stdcall ReadProps(struct SetupPlatform::IDisk *)",
        "Failed to allocate memory for PBCDE_DEVICE. Error: %d",
        "4!4-454I4b4y4",
        ".?AV?$SerializableBase@VCSetProductKey@@$0A@V?$DefaultInstanceFactory@VCSetProductKey@@@UnBCL@@@UnBCL@@",
        "<+<=<E<K<X<j<",
        "5+575C5N5\\5",
        "Service %s is starting",
        "*szFormat",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::Add(class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *)",
        ";-;9;U;x;",
        "VdsPlatform::EnumerateDisks",
        "Can't get VARTYPE %u as String",
        "ERROR_EVENTLOG_CANT_START",
        "<%<=<z<",
        "8!8n8t8",
        "PendingFileRenameOperations",
        ".PAVCXXXXXHandledException@?2??SPShrinkPartition@@YGJH_K0@Z@",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCDeviceInfoData@CDeviceIdDatabase@@@UnBCL@@@UnBCL@@",
        "7%7+767U7b7p7",
        "8F8t8",
        "4!4,484I4P4V4[4g4r4",
        "int __thiscall UnBCL::ArrayList<class CShellFolderInfo *>::LastIndexOf(class CShellFolderInfo *,int,int) const",
        "Processing service %s",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@_J@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "\\StringFileInfo\\%04x%04x\\%s",
        "Filter evaluation: Can't read property from disk as a string",
        "323:3@3M3_3i3|3",
        "SclpMigrateHive",
        "2\"2e2",
        "ERROR_EVT_FILTER_NOTELTSET",
        "\\Device\\Harddisk%d\\Partition0",
        "Disk type was unrecognized!",
        "787X7e7n7v7}7",
        "?H?U?m?",
        "2+2M2T2b2x2",
        ">&>0>5>t>",
        ".?AVCXXXXXHandledException@?2??DoExecute@CFinalizeCriticalBoundary@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "CICBStore::RetrieveFile",
        ".?AV?$SmartPtr@VSysprepComponent@@@UnBCL@@",
        ">)???G?|?",
        "Dump type : %s",
        "748H8V8r8",
        "JET_errWriteConflict",
        "void __thiscall UnBCL::ArrayList<class CBasicEnvEntry *>::CopyTo(class UnBCL::Array<class CBasicEnvEntry *> *,int) const",
        "WpxSetLogger",
        "MIG_CONVERT_SECURITY_SID_CONSTANTS",
        "?,?>?L?c?y?",
        "? ?%?0?;?O?a?h?n?s?~?",
        "\\??\\PhysicalDrive%d",
        "Sleep",
        "9%9*929<9O9",
        "RegEnumValueW",
        "9.969A9H9N9S9^9l9",
        ">!>+>7>@>L>X>d>q>{>",
        "3+383A3R3r3",
        "int __thiscall UnBCL::Array<class CDeploymentBase *>::Add(class CDeploymentBase *)",
        "GetTraceEnableLevel",
        "= =.=4=:=?=I=S=]=g=u={=",
        ";+;D;K;_;",
        "8%8,838>8I8S8[8a8f8}8",
        "1'12191G1Q1V1j1",
        "RegFlushKey",
        ";/<N<`<h<n<{<",
        "Bugcheck binary info",
        "9>u+9}",
        ".?AV?$CAutoCleanupBase@PAVVdsDiskPartitionEnumerator@@@RAII@@",
        ")null key to Hashtable#Add()",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::RemoveAt(int)",
        "1,1<1L1\\1l1|1",
        "8!8)8/8<8N8X8k8s8y8",
        ".?AVCXXXXXHandledException@?GK@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "9F9S9h9u9",
        "SL_E_LICENSE_INVALID_ADDON_INFO",
        "JET_wrnDatabaseRepaired",
        "pGetExistingPageFiles: Resolved path: %s",
        "RPC_S_INVALID_NET_ADDR",
        "4#5*5s5",
        "JET_errRollbackError",
        "D$<9D$8u",
        "222x2",
        "ga-IE",
        "j?Xf;",
        "DU search returned a NULL collection of updates, without errors. Assuming no issues and proceeding.",
        "4A4o4v4",
        "ERROR_DS_NOT_SUPPORTED_SORT_ORDER",
        ".PAVCXXXXXTemp@?M@??pSPSplitWim@@YGJPAVString@UnBCL@@0P6GKT_LARGE_INTEGER@@111KKPAX22@Z22H@Z@",
        ".PAVCXXXXXHandledException@?8??SPCreateSnapshotWithScoping@@YGJPAVString@UnBCL@@_JPAV?$ArrayList@PAVString@UnBCL@@@3@PAPAV23@@Z@",
        "9;9N9^9d9v9",
        "RegDataUpdateCount",
        "CreateSetupPlatformOnline",
        ">P>l>v>",
        "Failed to get VolumeName for %ws %x",
        ";\";X;`>h>m>s>",
        "9(9:9H9U9g9o9u9",
        "|8N$}$",
        "    Failed to create directory",
        "SL_E_TOKSTO_INVALID_FILE",
        "9 949I9S9X9h9r9w9",
        "3(373>3D3I3T3_3s3",
        "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t7x7|7",
        ":0:8:@:H:X:`:|:",
        "050D0Q0a0t0",
        "@.didat",
        "#,|6d",
        ":7;>;J;O;_;f;t;",
        "OSRollbackService::CCheckpoint::ExtractCrashDump: Will not convert crash dump to minidump",
        "rollbackstate.dat",
        "L$`QP",
        "DiskLayout::ApplyCreatePartition: No suitable location to allocate this partition",
        "int __stdcall UnBCL::MP::ThrowCompare<struct DiskMatchFilter>::Compare(struct DiskMatchFilter,struct DiskMatchFilter)",
        ".PAVCXXXXXHandledException@?GD@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "zh-CN",
        "TlsAlloc",
        ";*;8;R;q;",
        "int __thiscall UnBCL::ArrayList<class CDrvStoreProperty *>::IndexOf(class CDrvStoreProperty *,int,int) const",
        "3(3:3K3R3h3",
        "5@5F5O5Z5",
        "VdsDisk::InitializeProperties: Couldn't determine whether USB disk is internal (0x%08x)",
        "1+1=1c1",
        ".?AV?$SmartPtr@VXmlAttribute@UnBCL@@@UnBCL@@",
        "Mount",
        "void __thiscall UnBCL::ArrayList<unsigned char>::Resize(int,int)",
        "VirtualFree",
        "Failed to allocate memory for EVENT_TRACE_PROPERTIES buffer",
        "ERROR_TOO_MANY_POSTS",
        ">6>@>Q>",
        "<7<]<",
        "Failed to restore OC status; HRESULT = 0x%08X",
        "=%=3=A=I=O=c=h=p=v=",
        ".PAVCXXXXXTemp@?3???0CUninstall@@QAE@PAVString@UnBCL@@H@Z@",
        "CSetupPlatform::StartTelemetry: StartTelemetry failed; hr = 0x%08X",
        ";D$4uV",
        "; ;(;,;0;8;<;@;H;P;T;X;`;d;h;p;t;x;",
        ".text$di",
        "7#7*7>7V7a7q7x7~7",
        "strcpy_s",
        ":%:6:K:`:p:",
        "?GetASCII@Encoding@UnBCL@@SGPAV12@XZ",
        "class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::get_Current(void) const",
        "InstallationCompleted",
        ".PAVCXXXXXHandledException@?P@??DoExecute@CTrustSafeOS@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "<&<N<]<g<n<t<y<",
        "9/969y9",
        "class DiskLayout *&__thiscall UnBCL::ArrayList<class DiskLayout *>::get_Item(int)",
        "RPC_S_TYPE_ALREADY_REGISTERED",
        ".?AVCXXXXXHandledException@?2??DoExecute@CSetupRecoveryPartition@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ">A?K?",
        "ContentRoot",
        ": :0:T:\\:d:l:t:|:",
        "3)3?3c3t3",
        "SPProcessBitlockerOnDrives: Bitlocker status does not need any change. Flags are: 0x%08X",
        "6%6?6E6P6Z6m6u6|6",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::Remove(class UnBCL::DictionaryEntry<class UnBCL::String *,int> *)",
        "RPC_S_PROXY_ACCESS_DENIED",
        "2&3=3F3R3_3g3n3",
        "WinReValidateWimFile",
        ":U;f;o;{;",
        "ERROR_DS_CANT_FIND_EXPECTED_NC",
        "%hs: Successfully created tag file [%s] to mark the system BCD store as temporary.",
        ".?AV?$SerializableBase@VCPrepareRecoveryImage@@$0A@V?$DefaultInstanceFactory@VCPrepareRecoveryImage@@@UnBCL@@@UnBCL@@",
        "ERROR_BAD_DLL_ENTRYPOINT",
        "PVWh~",
        "0S0g1s1",
        "3=3K3`3g3y3",
        "SetBrushOrgEx",
        "Failed to create partition enumerator",
        "Failed to write allow uninstall value to %s. Error: 0x%08X",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *> *)",
        "ERROR_EVT_UNRESOLVED_VALUE_INSERT",
        "um9t$",
        "808B8J8P8]8o8",
        "1(151?1g1w1",
        "Keyword",
        "Sh|Vb",
        "MaxDiskSpaceNeeded",
        "8#878Y8e8",
        "3c4j4p4|4",
        "1#1-161@1I1S1\\1f1|1",
        "0Q1f1u1",
        "ERROR_DBG_CONTINUE",
        ";C;i;p;y;~;",
        "2F3e3",
        "4(40464;4@4N4W4i4x4",
        "ERROR_DATABASE_DOES_NOT_EXIST",
        ">:>s>y>",
        "=7=~=",
        "202E2^2u2",
        "0)0<0V0f0m0z0",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *> *)",
        "toj@j",
        "=)>.>j>~>",
        "<\"=M=[=d={=",
        "void __thiscall UnBCL::Array<class COperationResult *>::Insert(int,class COperationResult *)",
        "?#?3?>?N?T?h?t?~?",
        "ERROR_CANNOT_COPY",
        "?Sanitize@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        "pExtractCrashDump: Will not convert crash dump to minidump",
        "Cannot enable or disable OCs on online images",
        "CMediaLayout::QueueCbsPackages: Failed to queue CBS pacakge %u (%s): 0x%08x",
        "ERROR_DS_EPOCH_MISMATCH",
        "ERROR_LOCK_VIOLATION",
        "CMediaLayout::QueueProvisioningPackages: Failed to query ICB: 0x%08x",
        "                                   Total memory : %I64u",
        "marked for deletion",
        "(%lx): Error copying security info from [%ws] to [%ws]",
        "SKIPBOOTTRACK(FIRST): Skip Boot Validator: Cannot find offline WinDir, cannot continue with First boot removal.",
        "7 7+7;7E7W7_7e7o7y7",
        "?$?+?1?6?A?K?P?d?",
        "4%4^4t4",
        ";$;<;p;",
        "CCFGSectionFile::IsValueUnchanged",
        "ERROR_NOT_ALL_ASSIGNED",
        "void __thiscall UnBCL::ArrayList<class COperation *>::RemoveAt(int)",
        "4:4T4",
        "Error expanding string %s. Last Error = %#x",
        ".?AV?$DefaultInstanceFactory@VCRestorePageFileSettings@@@UnBCL@@",
        "JET_errInstanceNameInUse",
        "ru-MD",
        "5!5'5-595M5V5e5",
        "=&=3=:=D=U=b=l={=",
        "Using device layout file: %s",
        "CSetDefaultBootEntry::DoExecute",
        "4&4;4C4I4N4b4s4",
        ";G;l;",
        ">,><>D>L>T>d>|>",
        "base\\ntsetup\\setupplatform\\deployment\\dll\\setupplatform.cpp",
        "struct SetupPlatform::IDisk *const &__thiscall UnBCL::ArrayList<struct SetupPlatform::IDisk *>::get_Item(int) const",
        "(%lx): Failed call to SclProcessObjectSecurity().",
        "WVhP;",
        "ERROR_DS_GC_NOT_AVAILABLE",
        "5<5x5",
        "GetTextExtentPoint32W",
        "1/1G1c1{1",
        "VdsImageDisk::InitializeProperties: Failed to copy VDisk path (0x%08x)",
        "0$0(0,00080<0@0D0H0L0T0X0\\0d0l0p0x0|0",
        "|$(h0",
        ".PAVCXXXXXHandledException@?FD@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "4$4,444<4D4L4T4\\4d4",
        "3(353G3O3U3^3t3",
        "  Param module name: %s",
        "4!454C4Q4_4",
        "303B3J3P3Y3o3",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::RemoveAt(int)",
        "ERROR_RPL_NOT_ALLOWED",
        "Not extracting the WinRE system, there is no need for it during the installation",
        "9i9{9",
        "FLOWTRACK(SAFEOS): Failing installation due to scenario constraint (%d). Skip SafeOS boot is turned off.",
        "4>5S5y5",
        ":):A:]:d:j:o:z:",
        ">,>J>\\>h>t>",
        ":9:G:Y:c:m:w:",
        "t$<hX[",
        "6'7F7",
        "DiagTrackRunner.exe",
        ";O;c;",
        ".PAVCXXXXXHandledException@?CIO@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "void __thiscall UnBCL::ArrayList<class SysprepComponent *>::set_Item(int,class SysprepComponent *)",
        "5\"5)5.545:5@5F5L5R5X5^5d5j5p5v5|5",
        "IsSetupComplete",
        ".PAVCXXXXXHandledException@?8??Execute@COperation@@QAEJW4OP_EXECUTION_PHASE@@PAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "4(40464J4d4l4s4z4",
        "D$@SVW3",
        "CCleanupSnapshot::CCleanupSnapshot",
        "ERROR_IPSEC_IKE_ADD_UPDATE_KEY_FAILED",
        "ControlSet001\\Control\\WMI\\Autologger\\SetupPlatformTel",
        "Execute.StopAsync",
        ":1:H:P:_:h:x:",
        "struct DISK_SPACE_IMPACT __thiscall UnBCL::_::ArrayListEnumerator<struct DISK_SPACE_IMPACT>::get_Current(void) const",
        "636O6V6~6",
        "Failed to query ICbsSession9",
        "2#2-262M2[2d2m2v2",
        "? ?(?4?<?T?",
        "%WINDIR%\\system",
        ".idata$2",
        "ERROR_SYSTEM_SHUTDOWN",
        "SPDeleteAllSnapshots: Failed to iterate over snapshots. Error: 0x%08X",
        "SclGenerateUniqueAccountDomainSid",
        "CDownloadDUUpdates::FilterUpdates: Cancelled. hr = 0x%x",
        ":<:Q:W:a:",
        "void __thiscall UnBCL::ArrayList<class COperation *>::Resize(int,int)",
        "9<9X9",
        "void __thiscall UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *>::set_Item(int,class OC::CCmdLineExecutionTelemetryData *)",
        "??_DStreamWriter@UnBCL@@QAEXXZ",
        ".?AV?$SmartPtr@VCWIMEntryIndex@CWIMBootHelper@@@UnBCL@@",
        ".PAVCXXXXXTemp@?BLM@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "class UnBCL::DictionaryEntry<unsigned short,unsigned short> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::get_Item(int) const",
        "long __stdcall pSPSplitWim(class UnBCL::String *,class UnBCL::String *,unsigned long (__stdcall *)(union _LARGE_INTEGER,union _LARGE_INTEGER,union _LARGE_INTEGER,union _LARGE_INTEGER,unsigned long,unsigned long,void *,void *,void *),void *,void *,int)",
        "1-1I1V1c1}1",
        "=1=W=_=t=",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CPartitionInfo *>::MoveNext(void)",
        "JET_errBadLogSignature",
        "Cannot get the volume name from sources directory",
        "7J7}7",
        "3!3)303<3N3c3r3|3",
        "9$9<9D9T9h9|9",
        "2!282E2R2j2",
        "4#4-4A4W4m4",
        "SPGetExistentImageInfo",
        "3=3R3Z3`3m3",
        "0(020<0]0~0",
        "Opening system store. Flags: 0x%x",
        "=W=p=w=~=",
        "Creating Recovery directory.",
        "C(;C$",
        "0&0,010=0E0m0z0",
        "405D5X5l5t5|5",
        "Could not move source file",
        "int __thiscall CSkipBootValidator::IsOperationExecuted(class COperationQueue *,enum OP_OPERATION_ID)",
        "D$DPj",
        ";=<B<`<f<",
        ".Push Button Reset - Servicing Stack",
        "OC::COCCbsAdapter::SearchFoundationPackageName succeeded. Foundation package name is %s",
        "MetaDeployment.cfg",
        "5*5/5M5R5W5a5y5~5",
        "CManifest::Initialize",
        "XSPGetFootprintCapabilities",
        "3T3x3",
        "L$$;D$",
        "void __stdcall pSetEnvironmentFromConfigSection(class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,int)",
        "SPRemoveScheduledTask: Cleanup the folder [%s] if it's empty",
        "2M3Z3b3s3z3",
        "9J9Y9",
        "    Failed to copy element type string",
        "\\RemInst\\",
        "tRetainPreviousSnapshot",
        "ERROR_CONNECTION_UNAVAIL",
        "ERROR_IMAGE_NOT_AT_BASE",
        "SVQht",
        "9#989@9F9S9b9{9",
        ".PAVCXXXXXHandledException@?EG@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "pOpenDiskImage: OpenVirtualDisk failed: %u",
        "=1=A=N=_=",
        "6(666J6S6`6v6",
        "0 0%000;0@0T0n0",
        "IsSystem",
        "Wofadk failed to attach volume!",
        "ERROR_INVALID_ACCESS",
        "ERROR_DS_SAM_INIT_FAILURE_CONSOLE",
        "Failed to seek the NT header in file: %S",
        "void __thiscall UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *>::AddRange(const struct UnBCL::ICollection<class OC::CCmdLineExecutionTelemetryData *> *)",
        "{4D36E96B-E325-11CE-BFC1-08002BE10318}",
        ".?AU?$IEnumerable@PAVCAppInfo@@@UnBCL@@",
        "CRYPT_E_NOT_DECRYPTED",
        "class CDeploymentBase **__thiscall UnBCL::ArrayList<class CDeploymentBase *>::GetBuffer(int)",
        ":!:):/:6:F:N:T:[:g:n:t:y:",
        "OSRollbackService::CCheckpoint::MoveOrCopyDirectory: ObliterateOrMoveDirectoryTree(%s) succeeded.",
        "DiskLayoutMakeRecovery",
        "8 808@8D8T8X8h8l8|8",
        "    Failed to allocate spPayloadPath.get()",
        "ERROR_PRIVILEGE_NOT_HELD",
        "SL_E_CHPA_UNKNOWN_PROPERTY_NAME",
        "B0I0R0Y0",
        "Failed to reset the friendly name for boot entry [%ws]",
        "3,3C3R3g3n3t3y3",
        ">$>(>8><>L>P>`>d>t>x>",
        "CInfFile::Parse: Failed to get targeted device IDs in driver package %s; hr = 0x%08X",
        ";!;5;L;",
        "DriverPackageEnumRegKeysW",
        "4'4;4D4K4U4b4i4s4",
        ">T?o?u?",
        ")create logical partition",
        ";7;V;",
        "{47281DD1-DC0F-4EB3-9F1C-AF2E1A6B9468}",
        "5H5M5W5k5r5x5}5",
        "GetSetupPlatformVersion",
        "O0M0K",
        "\\StringFileInfo\\%04X%04X\\%s",
        "BuildVolumeHierarchy processes %d entries",
        "PWVhM",
        "??0TimeSpan@UnBCL@@QAE@_J@Z",
        "CDeploymentProject::CreateFolderDeployment: Failed to get WIM image info. Error: 0x%08X",
        "realloc",
        "1+141A1F1O1V1c1o1x1",
        "2 2'2-222=2J2P2U2i2q2",
        "BackgroundColor",
        "No Updates To Download",
        "ZwUnloadKey2",
        "DPhpK",
        "9\"9)999B9S9{9",
        "3&353D3M3W3`3r3|3",
        "pExtractCrashDump: Pagefile at %s did not contain a crash dump.",
        "WIMFindNextImageFile",
        ".?AVCXXXXXHandledException@?JC@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "struct SPGetPartitionOrdinal::PartitionInfo __thiscall UnBCL::_::ArrayListEnumerator<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::get_Current(void) const",
        "ERROR_FILE_VERSION_NAME_COLLISION",
        "MigOpenExternalStore",
        ".?AV?$CAutoHeapFree@PAG@RAII@@",
        "Multithreaded chunked decoding disabled via environment variable; will skip!",
        "Progress start phase is: %u",
        ".?AV?$DefaultInstanceFactory@VCCloseLogFiles@@@UnBCL@@",
        "??0InvalidOperationException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
        "??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@PAVString@1@@Z",
        "2)292H2O2V2a2k2|2",
        "{AEA99718-477D-4317-BFF9-744E2F256EFD}",
        "mCUSTOM.WIM",
        ".PAVCXXXXXTemp@?3??DoExecute@CUpdateBootSector@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "6$6`6v6",
        "9!9-9P9\\9h9",
        "SKIPBOOTTRACK(FIRST): Skip Boot Validator: Offline first boot apply is not complete, online actions are needed. Cannot continue with First boot removal.",
        "<\"<3<><L<x<",
        ":+;8;K;S;_;e;u;",
        "struct PageFileDesc *const *__thiscall UnBCL::ArrayList<struct PageFileDesc *>::GetBuffer(int) const",
        "= =/=Q=_=l=y=",
        ".PAVCXXXXXTemp@?3??ReconstructWindows@CReconstructOS@@IAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "Deleting boot entry 0x%x",
        "898@8E8K8Q8W8]8c8i8o8u8{8",
        "001x1",
        "545D5H5X5\\5l5p5t5x5",
        "4E4c4",
        "4(484S4g4",
        "ERROR_FULL_BACKUP",
        "Initialize",
        "545<5D5L5X5|5",
        "1G1f1",
        ":(:N:c:{:",
        "3.4L4[4",
        "1!131C1d1",
        "WimExchangeFiles",
        "CMoveWIMBootEntriesAndPartition::DoExecuteCan't create folder %s",
        "2\"2'2,21272",
        "PWVhe",
        "ERROR_DS_INSUFFICIENT_ATTR_TO_CREATE_OBJECT",
        "?get_FirstChild@XmlNode@UnBCL@@QAEPAV12@XZ",
        ";*;6;A;I;O;T;h;t;|;",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@GG@UnBCL@@@UnBCL@@",
        "SPAPI_E_LINE_NOT_FOUND",
        "Failed to log servicing event to bootstat %ws. Status: 0x%x",
        "SmVirtDiskPooledDiskEnumerator::Initialize",
        ":,:G:M:W:\\:f:m:{:",
        ":%:=:D:J:O:Z:a:",
        "JET_wrnColumnSetNull",
        "|SOURCE|\\|FWTYPE|",
        "CSetBootCommand::DoExecute",
        "ERROR_IOPL_NOT_ENABLED",
        "2.252;2@2K2V2j2",
        "9):B:p:",
        ".?AV?$SerializableBase@VCSerializableArray@@$0A@V?$DefaultInstanceFactory@VCSerializableArray@@@UnBCL@@@UnBCL@@",
        "1$1;1K1W1k1",
        "505U5z5",
        ".?AV?$SmartPtr@VRegistryKey@UnBCL@@@UnBCL@@",
        "60646L6P6h6l6",
        "ERROR_SXS_SECTION_NOT_FOUND",
        "98:R:s:",
        "404l4",
        "pStopSetupPlatformETWSession",
        "D0V0^0d0q0",
        ":%:5:<:D:M:W:z:",
        "7!7*7U7^7l7z7",
        "ERROR_NO_EVENT_PAIR",
        "??1?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@UAE@XZ",
        ".?AVCXXXXXHandledException@?2??DoExecute@COrchestrateOSSwitch@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "SysprepSession::CreateSession: Unexpected exception, could not create session; Stack trace:",
        "0$000<0H0T0`0|0",
        "COCValidator::ValidatePreExecution",
        "41494?4S4n4",
        "5\"5+575A5M5d5k5q5v5",
        ">??F?j?",
        "= =3=:=@=E=P=Z=_=s=",
        "RPC_X_WRONG_ES_VERSION",
        "ERROR_INVALID_STARTING_CODESEG",
        "=!=5=}=",
        "AutoLaunchNarrator",
        "%hs: Enumerated a total of %d directories out of %d",
        "PSWhF",
        ">*>7>=>Q>n>~>",
        "7%7.7G7Q7Z7c7l7u7~7",
        ":!:/:=:",
        "0%0H0O0",
        "Final list of source symbolic mappings:",
        "ERROR_CLUSCFG_ALREADY_COMMITTED",
        "898N8f8p8",
        "ERROR_EA_FILE_CORRUPT",
        ".?AV?$CAutoWdsLibFree@PAU_DRIVE_LAYOUT_INFORMATION_EX@@@RAII@@",
        "ITriggerCollection::Create failed. hr = 0x%x",
        "?,?0?H?X?h?x?",
        ";!;`;",
        "XCDeploymentBase::StreamWrite",
        "2 2>2H2O2`2v2",
        "Unsupported partition usage %d",
        ":.:;:D:Q:e:v:",
        ":%:>:E:`:t:",
        ";%;2;J;i;q;~;",
        "30383>3K3]3",
        "L$4QP",
        "Apply statistics: %s",
        ".?AVCXXXXXHandledException@?BAP@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "void __thiscall UnBCL::Array<class CDriverInfo *>::Remove(class CDriverInfo *)",
        "All work (machine-specific) is complete, marking completion and removing the store.",
        "0/0E0U0",
        "JET_errInvalidDatabaseVersion",
        "ERROR_GROUP_NOT_ONLINE",
        "; ;$;4;8;H;L;\\;`;p;t;",
        "3\"3(3.343:3",
        "7@8p8",
        "6*676L6X6b6~6",
        ".PAVCXXXXXTemp@?M@??pSPCopyFile@@YGJPAVString@UnBCL@@0P6GKT_LARGE_INTEGER@@111KKPAX22@Z22HH@Z@",
        "?.?4?=?S?`?g?m?r?z?",
        "j[Yf;",
        "3*3>3I3Z3a3g3l3w3",
        "9%989?9E9K9V9f9z9",
        "=$=1=9=D=S=Z=c=h=|=",
        "ERROR_PNP_RESTART_ENUMERATION",
        "?A?Y?^?j?",
        "ERROR_CLUSTER_NO_RPC_PACKAGES_REGISTERED",
        "0J1P1V1\\1b1h1",
        "%hs(%d) tid(%x) %08X %ws",
        "CTestHookDUUpdate::UnpackContents",
        "CSetupPlatformTracing::StartUserModeTracing",
        "Failed to add the new string",
        "osver",
        "%hs: Failed to open {bootmgr}. Status = %d",
        "7&7.7C7]7e7n7t7",
        "SPCanChangeRecoveryPartition",
        "0 0(0,00040<0X0\\0`0d0l0",
        ".PAVCXXXXXHandledException@?2??BuildDiskInfoFromPath@CGlobalPath@@SGJPAVString@UnBCL@@PAPAV34@PAKPA_K21@Z@",
        "%hs: Failed to create ImageInfoSet. hr = 0X%x",
        "4*41474<4G4R4`4g4m4r4}4",
        "Unable to get procedure RtlWcpDllDebugEntrypoint",
        "7-7:7O7[7e7",
        "FIOGetFileNameByHandle",
        "ti-ER",
        "1$141<1D1\\1c1i1n1y1",
        "SPEnumUnallocated: Failed to Find Free Space (0x%08x)",
        "int __stdcall UnBCL::MP::ThrowCompare<struct SetupPlatform::IDisk *>::Compare(struct SetupPlatform::IDisk *,struct SetupPlatform::IDisk *)",
        ".?AV?$SerializableArrayBase@PAUISerializable@UnBCL@@@_@UnBCL@@",
        "OOBEInProgress",
        ".?AVCSaveConfigData@@",
        "><?p?",
        ".?AV?$SerializableBase@VCOOBEBootApply@@$0A@V?$DefaultInstanceFactory@VCOOBEBootApply@@@UnBCL@@@UnBCL@@",
        "|SYSPART|\\|DEST|\\|FONTS|",
        "yLWhv",
        "F PjhY",
        "1(181H1X1\\1t1x1",
        "__thiscall UnBCL::ArrayList<class COperationResult *>::ArrayList(const struct UnBCL::ICollection<class COperationResult *> *)",
        "> >(>,>0>4>8><>@>H>L>P>T>\\>`>h>l>p>t>|>",
        "3%323D3`3g3m3y3",
        "__thiscall UnBCL::ArrayList<class CGlobalPathFindData *>::ArrayList(const struct UnBCL::ICollection<class CGlobalPathFindData *> *)",
        "RegLoadKeyW failed to mount %s at %s",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@W4OP_EXECUTION_PHASE@@PAV?$ArrayList@PAVCOperation@@@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "9*959:9N9_9",
        "SKIPBOOTTRACK(SAFEOS): Cannot attempt SafeOS boot removal, source is a WIMBoot system",
        "=*=1=",
        "PQSSWPQSS",
        "Disconnecting WIMBoot entry %I64d (%s, %d) for drive %s",
        "%hs: Failed to set BCDE_LIBRARY_TYPE_ALLOW_PRERELEASE_SIGNATURES field for the new OS entry. Status = %d",
        "RegUnLoadKeyW",
        "SKIPBOOTTRACK(SAFEOS): Will attempt SafeOS boot removal",
        "404I4X4^4p4",
        "ZwCreateKey",
        "CCleanupSnapshot::DeleteSnapshot: Failed to query snapshot size for [%s]. Error: 0x%08X",
        "ERROR_PNP_INVALID_ID",
        "CSetupAutomation::GetDriveLetter: No host machine disk has signature %s",
        "y?Sh>",
        "2\"2*22282K2n2",
        "3:4O4a4i4o4",
        "GetFileNodeFromPath",
        ".?AU?$IEnumerable@PAVCCleanupEntry@CSimpleCleanup@@@UnBCL@@",
        "1*1/1S1Y1e1m1s1",
        "SPGetDiskImageNumber: Can't open %s (0x%08x)",
        ";$;-;6;?;Q;];f;r;~;",
        "RPC_X_NULL_REF_POINTER",
        ";?<t<",
        "<!<.<7<?<N<]<p<v<",
        "BfspSetSecurityDescriptor(%s) failed! Last Error = %#x",
        ".PAVCXXXXXTemp@?CB@??BuildInfoList@CARPValidator@@IAE?AW4MIGSTATUS@@PAVString@UnBCL@@0PAV?$ArrayList@PAVCAppInfo@@@5@PAV?$ArrayList@PAVCShellFolderInfo@@@5@@Z@",
        "4$464=4C4H4S4^4n4",
        "%hs: WIM split. Part path: [%s], part size: [%I64u]",
        "ERROR_CONNECTED_OTHER_PASSWORD",
        "en-SG",
        ".PAVCXXXXXTemp@?3??FindWimImageOnWDSServer@@YGJPAVString@UnBCL@@0000PAPAV23@1PAI@Z@",
        "?$?4?I?P?V?[?f?p?u?",
        "void __thiscall UnBCL::ArrayList<class CGlobalPath *>::Insert(int,class CGlobalPath *)",
        "Failed to write unified progress in file: %s. Error: 0x%08X",
        ";!;4;?;G;M;a;",
        "failed transaction rollback",
        "%hs: Error while setting rollback active value: 0x%08X",
        ";C(u#",
        "7\"747<7G7O7X7e7m7x7",
        "LP Validator: Failed to build the new language package list, skip verification. Error: %08X",
        "<#<.<A<`<g<m<s<~<",
        ";';2;9;>;C;[;b;i;t;",
        ".?AV?$SmartPtr@VCDrvStoreProperty@@@UnBCL@@",
        "?(?4?@?L?X?d?p?|?",
        "Settings",
        "IsHidden",
        "Cannot get OC dependencies on online images",
        "=/=8=E=Z=q=",
        "CSetupPlatformCheckpoint::CopyLogFiles: Cannot locate log restore file \"%s\". Did we even get this far?",
        "6!6*636q6",
        "..\\rollback\\setupact.log",
        "728s8y8",
        ".?AV?$SerializableArrayBase@E@_@UnBCL@@",
        "50575=5B5M5W5j5",
        "AcquireSRWLockExclusive",
        ":.:::A:G:L:W:b:g:{:",
        "void __thiscall UnBCL::Array<class CFailForwardSystem *>::InitLarva(class UnBCL::ArrayList<class CFailForwardSystem *> *)",
        ">)?E?Y?o?v?|?",
        "void __thiscall CDeploymentBase::ReleaseBase(const unsigned short *)",
        "ERROR_CLUSCFG_ROLLBACK_FAILED",
        "IDB_WIN_LOGO2",
        "=,=8=D=g={=",
        ".?AV?$SmartPtr@VCOperationQueue@@@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<class CProfileInfo *>::set_Item(int,class CProfileInfo *)",
        "6&606C6K6",
        "COperation::Execute",
        "6V6k6}6",
        ".?AV?$HTDictEnumBase@W4OP_OPERATION_ID@@@_@UnBCL@@",
        "??0StreamReader@UnBCL@@QAE@PAVStream@1@PAVEncoding@1@@Z",
        "414G4c4n4",
        "Current op string        : %s",
        "8 8(8,80888<8@8H8L8P8X8\\8`8h8l8p8x8|8",
        "4)515>5S5b5",
        "5J5e5",
        "9w4vV",
        "pFindOccupiedRegions: Failed to enumerate partitions (0x%08x)",
        "%hs: Get inconsistent BitLocker status for drive [%s]. Previous: [%s], Current: [%s]. Use latest one.",
        ".?AV?$DefaultInstanceFactory@VCApplyWIM@@@UnBCL@@",
        "3$31393A3J3R3X3^3k3",
        "OS partition old length: %I64u",
        "9%979?9E9N9d9n9",
        "{A9E51219-7AC1-4F2D-9510-48B7958829F8}",
        "Final decision for the driver package (WinPE): %s",
        "DriverClassName",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *> *,int,int)",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *> *)",
        "%hs: Windows path: %s",
        "8)838:8@8E8P8^8r8z8",
        "OperationStartTime",
        "Getting driver package properties is not supported; falling back to DismGetDrivers",
        ".?AVCGatherData@@",
        "%hs: Not able to add bucketing parameters to Diagnostics Error Reporting. Error = %d",
        "DiskLayout::ApplyLayout: Failed to apply creations from disk layout (0x%08x)",
        "4*464@4j4s4",
        "Failed to allocate memory for search pattern.",
        "353<3B3G3R3\\3a3u3",
        "Boot manager to be overwritten by user policy.",
        "ERROR_DS_SUB_CLS_TEST_FAIL",
        "SL_E_EVENT_ALREADY_REGISTERED",
        "3#3/3>3R3c3j3p3u3",
        "9K(tV",
        ".?AU?$ICollection@V?$DictionaryEntry@W4OP_OPERATION_ID@@H@UnBCL@@@UnBCL@@",
        "ReadBootCode: Error reading mystery boot sectors!",
        "7 8C8t8",
        "(%lx): Failed to create destination child key.",
        "5$5(585<5L5P5`5d5t5x5",
        "Register recovery image %s, index %d",
        "bs-BA-Cyrl",
        "ERROR_CLUSTER_PARTIAL_SEND",
        ">$>1>@>H>Q>^>c>l>w>",
        "SAME RANK",
        "2h3 4",
        ".PAVCXXXXXTemp@?3??DoExecute@CAddCbsPackage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "515;5",
        "No source symbolic mappings found",
        "struct PageFileDesc **__thiscall UnBCL::ArrayList<struct PageFileDesc *>::GetBuffer(int)",
        "SVh(6",
        ".?AVCSetupPlatformOnline@@",
        "10.0.19041.572 (WinBuild.160101.0800)",
        ":\":):3:D:Q:Y:a:g:p:x:",
        ".?AVCCleanupSnapshot@@",
        "Copying folder %s in the scratch directory to save space",
        ".?AV?$ArrayList@UDiskMatchFilter@@@UnBCL@@",
        "Requests to replace the account domain SID that don't provide an explicit 'old' SID require access to the SECURITY hive.",
        "0+02090E0O0b0",
        "CSIDL_COMMON_DOCUMENTS",
        "WinRE new partition information is incorrect. Assuming no partition was created.",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::Add(class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *)",
        "9/979<9A9V9f9v9",
        "0/0=0J0\\0d0j0w0",
        "9$9,949<9D9L9T9\\9d9l9t9|9",
        "0%0/0b0y0",
        "2%232W2{2",
        "3\\4`4d4h4l4p4t4x4|4",
        ".?AV?$SmartPtr@VCCFGSectionFile@@@UnBCL@@",
        "0'0-0:0L0",
        "<+<A<J<`<n<",
        "SysprepSession::ExecuteAction: stopService timeout invalid.",
        "WmiAssociation::MoveNext: Can't enumerate associated instances (0x%08x)",
        "0B0]0p0",
        "Failed to add boot entry. Status: %x",
        "8/858r8",
        "%hs: DU has already been initialized; proceeding.",
        ":*<P<W<]<b<m<x<}<",
        "IsManiOSStore",
        "=8=C=Q=_=m=",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *> *,int,int)",
        "5<5h5o5",
        "SysprepSession::Execute: Error in executing actions from %s; dwRet = 0x%x",
        "10181>1K1]1n1",
        "<$<,<4<<<D<P<p<x<",
        "Setup the recovery partition",
        "tFPPWj",
        "F(QPj",
        ">%>->2>9>C>W>o>",
        "_wcstoi64",
        "\"0:0M0a0",
        "FveKeyManagement",
        "2+2>2J2\\2z2",
        "111=1I1U1a1",
        "VdsDisk::Initialize: Failed to add disk to pack (0x%08x)",
        "7 7$74787H7L7P7T7\\7d7h7l7t7x7|7",
        "CDeploymentProject::AddProvisioningPackage: Failed to determine whether %s contains an ICB: 0x%08x",
        "<!<D<q<",
        "ERROR_CLUSTER_MEMBERSHIP_HALT",
        "040v0",
        "Fail-forward attempts left: %d",
        "656E6\\6c6u6",
        "pGetDriverInfoFromModule",
        "6#676=6F6\\6j6",
        ">8>@>N>V>`>g>m>r>}>",
        ".?AV?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "%hs: Cannot get volume path for VHD partition on known VHD boot. Error: 0x%08X",
        "2*212?2I2\\2",
        "242K2n2",
        "ERROR_OPLOCK_NOT_GRANTED",
        "int __thiscall UnBCL::ArrayList<struct PageFileDesc *>::BinarySearch(int,int,struct PageFileDesc *,struct UnBCL::IComparer<struct PageFileDesc *> *)",
        "AddDeviceIDsToInjectedDriverNodeHelper",
        "No more element types to enumerate",
        "<&<,<6<@<T<j<",
        "void __stdcall UnBCL::_::HTEnumerator<unsigned short,int,struct UnBCL::Hashtable<unsigned short,int>::TableKey,class UnBCL::DictionaryEntry<unsigned short,int>,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<unsigned short,int> __stdcall UnBCL::Hashtable<unsigned short,int>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned short,int>::TableKey,int,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<unsigned short,int> *,class UnBCL::Array<class UnBCL::DictionaryEntry<unsigned short,int> > *,int)",
        "Failed to enumerate devices for driver package, Err = 0x%lx",
        "Failed to backslash-terminate search pattern.",
        ".?AU?$IDictionaryEnumerator@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@",
        "505K5",
        "%hs: Disabling SE_SECURITY_NAME privilege",
        ";D;c;",
        "3&3,3;3K3S3`3h3o3",
        "?'?T?[?a?f?q?|?",
        "8-8h8u8",
        "6+6I6",
        "int __stdcall SPCanChangeRecoveryPartition(class UnBCL::String *,unsigned short,unsigned __int64,int *,unsigned __int64 *,unsigned __int64 *,unsigned __int64 *,unsigned __int64 *,unsigned __int64 *)",
        ":C:S:",
        "MININT",
        "PWShj",
        "??1ArgumentException@UnBCL@@UAE@XZ",
        "= =%=0=:=?=S=",
        "3%3-343:3?3J3[3c3i3}3",
        "    Failed to get next payload length",
        "2(252T2i2r2}2",
        "FsProcessingTimeInMS",
        "%SystemRoot%\\Panther\\WinRETel.etl",
        "ProvMigration",
        "j:Yf;O",
        ".?AV?$ValueCollection@PAVString@UnBCL@@PAVCSPInternalPluginData@@@_@UnBCL@@",
        "%hs: Unexpected host volume format: %s. Error: 0x%08X",
        "Apply Drivers",
        "SetEvent",
        "CSIDL_COMMON_VIDEO",
        "SPExecuteFirstBootApply",
        "ERROR_SXS_POLICY_PARSE_ERROR",
        "8.868<8I8[8i8",
        "6%6.676@6L6S6Y6^6i6s6x6",
        "= =(=0=8=H=P=l=t=|=",
        ".PAVCXXXXXHandledException@?2??DoExecute@CRefreshLocalizedString@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::get_Item(int) const",
        ".?AVCXXXXXHandledException@?2??SPValidateProductKey@@YGJPBG00PAPAUIProductKey@SetupPlatform@@@Z@",
        "151T1l1r1",
        "Element::GetMetadata",
        "Failed to delete %s. Error: 0x%08X",
        "=$=-=7=@=J=S=]=f=p=",
        ".?AV?$SerializableBase@V?$Array@_J@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@_J@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *__thiscall UnBCL::_::ArrayListEnumerator<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::get_Current(void) const",
        "CBS_E_PRIMITIVES_FAILED",
        "@Pht1",
        "void __thiscall UnBCL::Array<class CFilterDriverInfo *>::Remove(class CFilterDriverInfo *)",
        "dvGVV",
        "CSecurityHeaderWriterT<class CEmptyType>::CreateInstance",
        "CBS_E_RESOLVE_FAILED",
        "PVWh_",
        "%hs: Processing drive %c:",
        ".PAVCXXXXXHandledException@?ML@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "SPDoEndInstallGather",
        "SP_ENV_FAIL_VALIDATOR_CFG",
        "int __thiscall UnBCL::ArrayList<class OC::COptionalComponent *>::LastIndexOf(class OC::COptionalComponent *,int,int) const",
        ".PAVCXXXXXHandledException@?FB@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "5!5'595A5G5Y5h5",
        "SPScheduleTask: Description   : [%s]",
        "j$Yf;O",
        "1 1(10181@1P1X1|1",
        "Failed to open debug setting handle. Status = %d",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::Insert(int,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *)",
        "void __thiscall UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *>::Insert(int,class CSimpleCleanup::CCleanupEntry *)",
        "2?3Y3k3p3{3",
        "FOLDERID_Screenshots",
        "void __thiscall UnBCL::_::ArrayListEnumerator<unsigned short *>::Reset(void)",
        "?\"?+?>?E?K?P?\\?g?l?",
        "CSetupPlatformOSSwitchCheckpoint::Rollback: Errors were encountered restoring content of %s. The remaining content will not be removed",
        "hwcompatPE.txt",
        "VdsPlatformDiskEnumerator::GetNext: Failed to query IID_IVdsSwProvider interface [%s] (0x%08x)",
        "QVj~h",
        "6J6R6\\6d6q6",
        "737W7{7",
        "= =<=D=K=v=",
        "PPPPPSh",
        "6&6[6b6",
        ">(>4>@>L>]>d>p>u>",
        "8*878L8V8a8j8s8|8",
        "Verbose: Found %I64d bytes as possible customizations in OS WIM",
        "BCDFGHJKMPQRTVWXY2346789",
        "Failed to read the new OS entry GUID from %s. hr = 0x%X",
        "int __thiscall UnBCL::Array<class CShellFolderInfo *>::Add(class CShellFolderInfo *)",
        ": :2:F:S:\\:l:w:",
        "FileCounter",
        "4/464<4A4L4W4\\4p4",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::get_Item(int) const",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::Remove(class UnBCL::DictionaryEntry<class UnBCL::String *,long> *)",
        "%hs: Data migration request skips user profiles.",
        "JET_errLogReadVerifyFailure",
        "8$8*8/8:8D8W8b8",
        "6O6X6a6j6s6",
        "2(282<2@2H2P2X2`2h2p2x2",
        "3 3(303@3L3T3|3",
        "Execute.PreApply",
        "=1>T>[>",
        "Failed to get file counter",
        "2 2$2(2,242X2`2d2h2l2t2",
        ":?:P:",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *> *)",
        "System\\CurrentControlSet\\Services\\WofAdk",
        "GPQQh",
        "void __thiscall UnBCL::Array<class CCFGSectionValue *>::InitLarva(class UnBCL::ArrayList<class CCFGSectionValue *> *)",
        "4&4<4F4[4m4u4{4",
        "=$>)>x>",
        "3$3.353B3V3f3s3~3",
        "Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11CF-8B85-00AA005B4383}",
        "class COperation **__thiscall UnBCL::ArrayList<class COperation *>::GetBuffer(int)",
        "1'151>1G1U1d1",
        "4-494E4Q4]4i4",
        "SclRegCopyKeyRecursiveByName",
        "%hs: Boot app cmd line: %s",
        ".?AV?$SerializableBase@VCFailForwardSystem@@$0A@V?$DefaultInstanceFactory@VCFailForwardSystem@@@UnBCL@@@UnBCL@@",
        ".?AV?$ArrayListEnumerator@PAVCFileCreationData@@@_@UnBCL@@",
        "    Element metadata already exists",
        "CERT_E_ROLE",
        ">#>?>F>O>X>t>{>",
        "Failed to delete tracing files: %s",
        "ERROR_REPARSE",
        ";9;R;",
        "RestoreFileNodeList",
        ".?AU?$ICollection@V?$DictionaryEntry@KPAUIVdsVDisk@@@UnBCL@@@UnBCL@@",
        "484@4H4\\4d4l4|4",
        "    Failed to write element type attribute",
        "3!3'343F3T3a3s3{3",
        ";B<U<",
        "7$7,747T7\\7d7l7t7|7",
        "9 9+909C9J9P9U9`9k9p9z9",
        "=,=M=i=",
        "ITaskService::Connect failed. hr = 0x%x",
        "NtQueryKey",
        ":):7:_:q:",
        "5;5V5i5y5",
        "0+0K0`0g0m0r0}0",
        "{CD66E35B-7633-4E52-85B9-92462840FF02}",
        "?#?+?0?D?T?n?",
        "4$5+5<5D5Q5Y5b5k5",
        "?#?/?8?D?P?\\?e?n?w?",
        "1 1D1L1T1\\1d1l1t1|1",
        ";.;5;;;@;K;V;_;s;",
        "8&9<9q9}9",
        "x/h@B",
        "0%0G0S0_0k0x0",
        "RtlClearAllBits",
        "SPUninitializeDU",
        "WdsCopyFileEx: Failed to strip file attributes for %s, will delete. GLE = 0x%x",
        "ERROR_EXTRANEOUS_INFORMATION",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::GetBuffer(int)",
        ";a;o;",
        ">,>3>:>@>L>^>l>z>",
        "DISKSPACETRACK: After op     : %I64u",
        "4(484J4a4",
        ".PAVCXXXXXTemp@?LA@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "JET_errBadBackupDatabaseSize",
        "ControlSet%03u%s",
        "%hs: Failed to enable setup telemetry auto logger %s. Error: 0x%08X",
        "SPApplyAnswerFileSettings: Failed to initialize COM. hr = 0x%x",
        "525`5q5",
        "20272U2_2r2|2",
        "Failed Installing FoD packages.",
        "class COperationsValidator *const &__thiscall UnBCL::ArrayList<class COperationsValidator *>::get_Item(int) const",
        "VVhXj",
        "UtilGetReadyEvent",
        "ERROR_IPSEC_IKE_SOFT_SA_TORN_DOWN",
        "1f2m2s2x2",
        "fwprintf",
        ">7>D>R>_>f>p>",
        "0,0<0L0\\0l0|0",
        "BCryptFinishHash",
        ":5:P:V:`:e:o:v:",
        "class UnBCL::String *__stdcall GetEncodedPathFromPath(class UnBCL::String *,int)",
        "5.565<5P5k5",
        ".?AV?$ValueCollection@PAVString@UnBCL@@PAUHKEY__@@@_@UnBCL@@",
        ".?AV?$CAutoRelease@PAVVdsDiskPartitionEnumerator@@@RAII@@",
        "XSP_DRIVER_INFO",
        "na:SingleSectorAlignment",
        "ResurrectSetupPlatform: Not enough memory (1).",
        "6#6(6<6T6a6h6n6s6~6",
        "VWh0w",
        ">$>,>4><>H>l>t>|>",
        "3$3,343<3H3h3p3x3",
        "?7?[?m?u?{?",
        "6 646T6[6a6f6q6x6",
        "=N=k=",
        "PVWh2",
        "void __thiscall UnBCL::ArrayList<struct _GUID>::CopyTo(class UnBCL::Array<struct _GUID> *,int) const",
        ".?AV?$DefaultInstanceFactory@VCEnableTelemetryForImage@@@UnBCL@@",
        "; ;';1;7;C;X;];q;~;",
        "UpdateBootCode",
        ".?AV?$DefaultInstanceFactory@VCSetupPlatformTracing@@@UnBCL@@",
        "OC::CCmdLineManager::RunCmdLine: CreateProcessW(%s) failed. GLE = %d",
        "ShXTb",
        "u$j2[h",
        "CDeploymentProject::SetAutomaticShutdown: Audit mode is enabled, cannot also queue automatic shutdown.",
        "ERROR_CRM_PROTOCOL_NOT_FOUND",
        "Found override for watson parameter [%d] value=[%s].",
        "SSSSP",
        "1 141=1f1",
        "Unable to create tempory root key. Status: %x",
        "u$WSQ",
        "ERROR_RESOURCEMANAGER_READ_ONLY",
        "Number of reparse points updated",
        "void __thiscall UnBCL::_::HTEnumerator<enum OP_OPERATION_ID,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable<enum OP_OPERATION_ID,int>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::Reset(void)",
        "ERROR_DS_REFERRAL_LIMIT_EXCEEDED",
        "9A9i9",
        "8$8:8A8H8S8^8r8",
        "SL_E_VL_KEY_MANAGEMENT_SERVICE_VM_NOT_SUPPORTED",
        "607D7L7T7\\7d7p7x7",
        "6)676c6v6",
        "y)VhT",
        "9l9w9",
        "5)535F5l5s5",
        ".rdata$zETW9",
        "DismPostOobe",
        ":I:Y:a:p:|:",
        "t#h`z",
        "8!8,8<8F8X8`8f8p8z8",
        ".?AV?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::Remove(class UnBCL::DictionaryEntry<unsigned short,unsigned short> *)",
        ".?AV?$CAutoRelease@PAUIDeviceIdDatabase@@@Mig@@",
        ":MdLcu",
        "3%3/3Q3e3s3",
        "3!3<3",
        "WinRE driver/OEM tools migration action completed successfully.",
        "Applying WIM file: %s, index %d%s. %seference file %s, to %s",
        "Does not exist on sources, so no need to copy over Removed FOD Markers",
        "ERROR_DISK_CHANGE",
        "Enumerating files for WIMBoot entry %I64d (%s, %d) for drive %s",
        "7.757<7H7R7e7z7",
        "void __thiscall CMediaLayout::AddToStoredObjectsGroup(class UnBCL::String *,struct UnBCL::ISerializable *)",
        "Failed to get [%s] under [%s], we'll assume it never executed. Err: 0x%08X",
        "DiskLayout::ExecInitialize: Failed to wipe target disk: 0x%08x",
        "7,70747<7@7D7L7P7T7\\7d7h7l7p7t7|7",
        ";#<I<",
        "2$2,2F2L2p2",
        "FRAMEWORK",
        "int __thiscall CSetupPlatformPrivate::AnalyzeCrash(int)",
        "4'4;4O4`4p4",
        "OS partition was not extended, nothing to do.",
        ".?AU?$ICollection@PAVCCmdLineExecutionTelemetryData@OC@@@UnBCL@@",
        "2+2L2o2",
        "9/9;9G9T9`9l9x9",
        "{A3C5445F-EF52-45C0-8D40-D51A81760796}",
        "JET_errLogGenerationMismatch",
        "3%3=3x3",
        "pGetMemorySizes",
        "71797?7L7^7l7",
        "Prefetch $MFT failed. hr = 0x%x",
        "<?=N=",
        "onecore\\base\\ntsetup\\provpackageapi\\inc\\FileStream.h",
        "4 4$44484H4L4\\4`4p4t4",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class COSPieceInfo *>::MoveNext(void)",
        "class CImageInfo **__thiscall UnBCL::ArrayList<class CImageInfo *>::GetBuffer(int)",
        "void __thiscall UnBCL::ArrayList<class CDeploymentBase *>::CopyTo(class UnBCL::Array<class CDeploymentBase *> *,int) const",
        "ERROR_EVT_NON_VALIDATING_MSXML",
        "SPStorageReserveAvailable",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CDeploymentBase::CMountedPathInfo *>::MoveNext(void)",
        ";*;:;C;J;_;f;};",
        "4\"5)5/545?5I5\\5k5%6.6E6P6Z6g6o6u6",
        "    Name: %s, Original path: %s, Current path: %s (%sallow relocation)",
        "Unknown partition type %d",
        ".?AVCFFOperationsProgress@@",
        "= =1=A=M=S=m=w=",
        "Failed to set NET debugging host IP type. Status = 0x%X",
        "MapWindowPoints",
        "VdsPartition::SetUsage",
        "1!1+101D1Y1`1f1k1v1",
        "6%6/6A6H6P6Y6",
        "%hs: Executing machine-independent gather",
        "ERROR_NO_MORE_DEVICES",
        "memset",
        "?(?2?<?F?P?Z?d?n?x?",
        ";)<.<4<><G<P<^<p<v<",
        "CDUPackage::UnpackTo: SetupDUUpdateFiles failed. hr = 0x%x",
        "282P2W2^2d2q2",
        "0/0=0S0b0i0o0t0",
        "SmPartition::CreateLogicalPartition",
        "void __thiscall UnBCL::Array<struct DiskLayout::Partition>::InitLarva(class UnBCL::ArrayList<struct DiskLayout::Partition> *)",
        "CoInitializeEx",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::MoveNext(void)",
        "<$<,<4<<<D<L<T<\\<d<l<t<|<",
        "3*3<3c3",
        "CRYPT_E_ASN1_OVERFLOW",
        "tCSetupAutomation::SetTargetDisk",
        "void __thiscall UnBCL::ArrayList<struct PartitionLayoutArgs *>::CopyTo(class UnBCL::Array<struct PartitionLayoutArgs *> *,int) const",
        "ERROR_SUCCESS",
        ".?AV?$Array@PAV?$DictionaryEntry@W4SYNCEXEC_PHASE@SetupPlatform@@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "0$040?0U0]0",
        "void __thiscall UnBCL::ArrayList<class COperationsValidator *>::CopyTo(class UnBCL::Array<class COperationsValidator *> *,int) const",
        "ERROR_DS_ATTRIBUTE_OWNED_BY_SAM",
        "2(2<2O2e2l2r2w2",
        "0!080H0",
        ":\":0:",
        "%hs: Unable to set WIM temp path. Error: 0x%x",
        "void __thiscall UnBCL::ArrayList<class CFileCreationData *>::set_Item(int,class CFileCreationData *)",
        "Onesettings: Failed to duplicate branch name string: 0x%x",
        "8 8>8X8r8",
        "__iob_func",
        "RPC_S_INVALID_STRING_BINDING",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@_K@UnBCL@@@UnBCL@@",
        "VerifyFileByHandle",
        "2%2.2:2A2G2L2W2f2z2",
        "767>7S7`7m7",
        "0 0E0j0",
        "<,<2<F<Z<`<e<",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *> *)",
        "4(424?4E4L4V4c4j4t4",
        "ERROR_CLUSTER_INCOMPATIBLE_VERSIONS",
        "BiBindEfiNamespaceObjects failed %x",
        "? ?0?8?\\?d?l?|?",
        "4#5*5R5f5x5",
        "=0=M=q=",
        ";#;0;5;>;J;];",
        "9!9'9,969@9J9T9b9h9n9s9}9",
        "495A5I5\\5r5",
        "?-?h?u?",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,&protected: static class CSPInternalPluginData * __stdcall UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,class ATL::CElementTraits<class CSPInternalPluginData *> > const *,struct __POSITION * const &)>::Reset(void)",
        "DiskLayoutMakeRecovery: Failed to get target disk properties (0x%08x)",
        "4$414H4U4m4",
        "%hs: Migration phase caught an exception creating work/store directories.",
        "7 707J7R7]7e7o7u7",
        "void __thiscall UnBCL::ArrayList<class CDrvStoreProperty *>::CopyTo(class UnBCL::Array<class CDrvStoreProperty *> *,int) const",
        "ERROR_EVT_EVENT_DEFINITION_NOT_FOUND",
        "4+4S4c4o4y4~4",
        "4!454W4e4|4",
        ">(>P>p>",
        "9#9h9m9r9x9",
        "?,?;?R?e?",
        "SysprepComplete",
        "pIsUninstallInitiated: Failed getting uninstallinternal interface, hr = 0x%x",
        "WShp?",
        ".?AUIDisposable@UnBCL@@",
        "int __stdcall pCreateSystemRootDriveMapping(const unsigned short *,const unsigned short *,int,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *> *)",
        ".?AV?$DefaultInstanceFactory@VCAddBootEntry@@@UnBCL@@",
        "717^7{7",
        "7#7*71777C7W7e7s7",
        "1(2/2 343B3",
        "Filter data is NULL, cannot add pending filters",
        "SL_E_CAL_PRINCIPAL_INVALID",
        "? ?6?L?W?g?q?",
        "4*4<4{4",
        "0)0=0X0}0",
        "!070>0",
        "<3<D<N<h<y<",
        "7 707T7\\7d7l7t7|7",
        "=&===J=~=",
        "010?0a0u0",
        "Flush took %u ms.",
        "RollbackSetCheckpoint: Rollback is disabled.",
        "SclDosPathToNtPath error with %ws. Error: 0x%08X",
        "CSetupPlatformCheckpoint::CopyLogFiles: An error occurred while processing the networking log folders",
        "1.181?1E1J1[1k1u1|1",
        "D$(PS",
        "9/9v9}9",
        "int __thiscall UnBCL::ArrayList<class COperationResult *>::LastIndexOf(class COperationResult *,int,int) const",
        ":,:0:@:D:T:X:h:l:|:",
        "Multivariant",
        ">1>9>F>M>S>X>c>m>",
        "Removing  %s",
        " Microsoft Corporation. All rights reserved.",
        "void __thiscall UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::AddRange(const struct UnBCL::ICollection<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *> *)",
        "5 5I5N5S5^5j5q5w5|5",
        "XShPf",
        "0K1U1q1",
        ";D;w;",
        "SL_E_INVALID_CONTEXT",
        "070~0",
        "globalroot",
        "1G1Y1a1g1t1",
        ".?AVCXXXXXHandledException@?8??DoExecute@CMoveWIMBootEntriesAndPartition@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "4)4S4i4",
        "020?0V0f0r0",
        "474H4U4l4x4",
        "=$=,=4=<=D=L=T=\\=d=l=t=|=",
        "3)3=3D3N3^3g3o3t3y3",
        ".?AUISerializable@UnBCL@@",
        ";:;j;",
        "SPDeleteSnapshot: Failed to initialize VSS for backup. Error: 0x%08X",
        ">O>v>",
        "829I9",
        "\\Logs\\bfsvc\\repair.log",
        "3;3L3T3z3",
        "1\"1D1Z1v1",
        "Creating/Setting Pagefiles key  with %s",
        "DiskLayoutMakeSystem: Failed to get system partition volume (0x%08x)",
        "(%lx): Failed to create the SECURITY root descriptor.",
        "Deleting references to object %s",
        "8-8>8J8S8^8m8}8",
        "WdsSetupLogMessageA",
        "9 :h:",
        "3$3(3,30343<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "Failed to get package iid.",
        "class CBasicEnvEntry *__thiscall UnBCL::_::ArrayListEnumerator<class CBasicEnvEntry *>::get_Current(void) const",
        "Exception while adding migration XML: %s",
        "Failed to delete ProfileInterval key: 0x%x",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class COperationResult *>::Reset(void)",
        "ERROR_UNIDENTIFIED_ERROR",
        "6!6c6h6z6",
        ".?AV?$DefaultInstanceFactory@VCAccessCreds@@@UnBCL@@",
        ".?AVVdsPartition@@",
        "yMWh}",
        "CRYPT_E_DELETED_PREV",
        "IsCleanUpTerminated",
        ".PAVCXXXXXTemp@?3??SetRegDWORD@@YGJPAVString@UnBCL@@000K@Z@",
        "1'111A1L1X1j1u1",
        "Failed to delete duplicate winloads. Status = [%x]",
        "NtSetBootOptions",
        "CDeploymentProject::CreateBootableMediaDeployment: Failed to mark volume's partition as active (0x%08x)",
        "<,<?<H<v<",
        "?J?d?i?{?",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::RemoveAt(int)",
        ":(:.:B:Z:t:{:",
        "SKIPBOOTTRACK(FIRST): Turning OFF First boot removal per environment variable",
        "Could not set compression. Invalid cluster size.",
        "525;5P5",
        "ERROR_ACCESS_DISABLED_WEBBLADE_TAMPER",
        "FLOWTRACK(FIRST): Flow Validator: First Boot phase is still active, Skip First boot flow constraint cannot be satisfied.",
        "void __thiscall UnBCL::ArrayList<class SysprepComponent *>::QuickSort(class UnBCL::ArrayList<class SysprepComponent *> *,class UnBCL::ArrayList<class SysprepComponent *> *,int,int)",
        ".PAVCXXXXXTemp@?3??SPFindVssSnapshot@@YGJU_GUID@@0PAPAVString@UnBCL@@@Z@",
        "<*<3<T<b<k<u<",
        "SPApplyAnswerFileSettings",
        "  Class GUID: %s",
        "PWVhE",
        "0)0i0",
        "RecoveryPartitionBackup",
        "7!7(797B7V7r7",
        "9\\$<tN",
        "ERROR_GROUP_EXISTS",
        "SVWh@",
        "LangPack",
        "SPAPI_E_DUPLICATE_FOUND",
        "ERROR_DS_INVALID_DN_SYNTAX",
        "CReconstructOS::RestageWindows",
        "5%5+505;5F5Z5g5s5z5",
        "2%2=2z2",
        "OC::COCCbsAdapter::GetPackageByName: enumerating package for id %s.",
        "PhH\"d",
        "<key>",
        "ERROR_SXS_XML_E_RESERVEDNAMESPACE",
        "7)777_7q7",
        "!t$02",
        "6'6<6Q6X6o6y6",
        "3 3(3<3D3L3\\3h3",
        "CCleanupSnapshot::DeleteSnapshot: Query space will be freed",
        " SetupPlatformTelEvent",
        "838M8y8",
        "%hs: Failed to set BCDE_LIBRARY_TYPE_APPLICATION_DEVICE field. Status = %d",
        ":%:*:9:F:T:",
        "MIG_CMI_MACHINE_SPECIFIC",
        "base\\ntsetup\\setupplatform\\lib\\util\\snapshot.cpp",
        "NtEnumerateBootEntries",
        ".?AV?$SerializableBase@V?$ArrayList@_J@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@_J@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "FilterInfo is NULL, cannot fill in filter information",
        "\\\\.\\?:",
        ".?AV?$CAutoCleanupBase@PAUISetupOneSettings@@@RAII@@",
        "2'313@3R3W3",
        ".?AVCXXXXXHandledException@?8??Finalize@CNewSystem@@UAE?AW4SYSTEM_STATE@SetupPlatform@@PAUIOperationsProgress@4@H@Z@",
        "j.Zf9",
        "VdsPlatform::ComputeHostInfo",
        "%hs: Recovery partition backup directory: %s",
        "VdsPlatformDiskEnumerator::GetNext: Failed to query IID_IVdsDisk interface [%s] (0x%08x)",
        "=#=/=G=V=e=t=",
        "EnableShortnamesOnApplyTarget",
        "void __thiscall UnBCL::Array<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::RemoveAt(int)",
        "ERROR_IPSEC_IKE_PROCESS_ERR_NOTIFY",
        ";2;?;G;Y;a;u;",
        "%hs: Could not find the external storage, uninstall validation will fail. Error: 0x%08X",
        "%hs: Cannot create hardlink betweeen %s and %s. Error: 0x%08x",
        "rFailed to modify boot entry 0x%x. Status: %x",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@_JPAVString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "8$8:8[8q8",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::Reset(void)",
        "int __thiscall UnBCL::ArrayList<void *>::IndexOf(void *,int,int) const",
        "%hs: Cannot add driver %s. Error: 0x%08X",
        "u0SSSSS",
        "6+646:6S6c6}6",
        "2%2E2\\2g2q2",
        "CSetupPlatformRollback::SaveState",
        "Failed to save package list file, not fatal error.",
        ".?AV?$ArrayList@UPartition@DiskLayout@@@UnBCL@@",
        "7'7.757@7N7V7\\7a7u7",
        "ERROR_MP_PROCESSOR_MISMATCH",
        "ERROR_FLOAT_MULTIPLE_FAULTS",
        "VdsDisk::CreatePartition: Can't convert GUID type string %s to GUID (0x%08x)",
        "Gather statistics: %s",
        "ERROR_INVALID_GW_COMMAND",
        "6-6\\6n6v6|6",
        "?-?;?I?W?e?s?",
        ".?AU?$IEnumerable@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@",
        "4\"4'434>4R4g4",
        "=%=/=5=C=w=",
        "class UnBCL::ArrayList<class CImageInfo *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class CImageInfo *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "InitVDSService:Loading VDS service... ",
        "5&5+545@5L5Q5Z5f5r5w5",
        "ScheduleSnapshotCleanupTaskFailedHR",
        "PPSVS",
        "UblIsUSBDiskInternal: FindMatchingDeviceInfoData failed! Error = 0x%X.",
        "1'1/151>1T1^1s1",
        "6-6;6I6W6e6s6",
        "void __thiscall UnBCL::Array<class OSRollbackService::CCheckpoint *>::Insert(int,class OSRollbackService::CCheckpoint *)",
        "0 0,040H0V0g0n0t0y0",
        "9$949;9A9F9R9`9f9z9",
        "0'0O0`0",
        "2)252A2J2W2^2d2i2t2z2",
        ".?AVCXXXXXHandledException@?2??Execute@CSetupPlatformPrivate@@UAEJW4EXEC_PHASE@SetupPlatform@@PAU_PROGRESS_DATA@4@PAH@Z@",
        "???b?p?",
        "1 141H1d1n1u1{1",
        "6\"707Q7g7o7|7",
        "2,2:2F2R2\\2l2t2",
        "jo[f9\\0",
        "PnpCleanupDrivers failed. Error: 0x%08X",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::Insert(int,class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *)",
        "%hs: Extending the OS partition.",
        "8$8(8,80888T8X8\\8`8h8",
        ")pIterateAssociation",
        ".?AVCXXXXXHandledException@?5??SPFindSnapshotProp@@YGJPAVString@UnBCL@@PAU_VSS_SNAPSHOT_PROP@@@Z@",
        "WdsLogUnRegisterProvider",
        "9$9f9~9",
        "1(161@1P1\\1d1n1u1{1",
        "%hs: Error setting the %s value: 0x%08X",
        ">\">*>4>D>M>U>i>s>x>",
        "ERROR_DS_DRA_SCHEMA_INFO_SHIP",
        "4$4,444<4D4L4T4`4",
        "=F=c=",
        "(%lx): Failed to create destination child key",
        "8(8/8<8H8Q8^8c8l8s8",
        "6(6[6",
        ";'<c<k<",
        "CCleanupSnapshot::DeleteSnapshot: Failed to delete previous Upgrade snapshot. Error: 0x%08X",
        "ERROR_DS_CANT_MIX_MASTER_AND_REPS",
        "CDeploymentBase::RestoreMounts: Failed to get mounted image handle for path %s. Error: 0x%08X",
        ":-:5:W:`:f:{:",
        ".?AVCXXXXXHandledException@?2??TearDownCbsLogging@CReconstructOS@@IAEJXZ@",
        "333:3C3H3S3d3u3|3",
        "BCD: %ws",
        "ERROR_WAIT_2",
        ".?AV?$SerializableArrayListBase@PAVCShellFolderInfo@@@_@UnBCL@@",
        "6)696G6X6e6k6q6}6",
        "CSetupPlatformCheckpoint::CopyConfigFiles",
        "CSetupAutomation::GetDriveLetter: Failed to iterate over partitions: 0x%08x",
        "?get_ChildNodes@XmlNode@UnBCL@@QAEPAVXmlNodeList@2@XZ",
        "404:4D4J4X4",
        "1$1,141<1D1P1p1x1",
        "868t8",
        "ERROR_DS_OBJ_NOT_FOUND",
        "Failed copying from the source to the target Removed FOD Markers",
        "4-4E4f4",
        "$(runtime.windows)",
        "< <5<G<O<U<i<o<x<",
        "file corrupted in block at offset %p",
        "333W3",
        "SQj[Z",
        "epExecuteMove",
        "Failed to find a key to load store %s. Last attempted key: %ws",
        "ERROR_DS_ATT_IS_NOT_ON_OBJ",
        "8&8,818<8G8b8{8",
        "CUpdateBootCode::DoExecute: Begin to repair",
        "deleteValue",
        "IMAGE_STATE_GENERALIZE_RESEAL_TO_OOBE",
        ".?AV?$ArrayList@PAUIDisk@SetupPlatform@@@UnBCL@@",
        "spLogBugcheckData",
        "3,3c3r3",
        "ERROR_INVALID_SERVICENAME",
        "void __thiscall UnBCL::Array<class CFailForwardSystem *>::Insert(int,class CFailForwardSystem *)",
        "4+4l4",
        "6$6;6T6m6",
        "?E?L?R?W?b?m?",
        "Extents",
        "737?7O7c7q7y7",
        "SPGetWIMImageInfo: Failed to get image info from the software hive. Error: 0x%08X",
        "6,646G6O6\\6p6",
        "?GetUnicode@Encoding@UnBCL@@SGPAV12@XZ",
        "1\"1(1.141:1@1F1L1R1X1^1d1j1p1v1|1",
        "<#<8<P<V<{<",
        "es-MX",
        "Failed to restart Diagtrack service, error code=%d",
        "CDownloadDUUpdates::FilterUpdates: IWindowsDriverUpdate not available for update %s, will not filter. hr = 0x%x",
        "version.dll",
        "ERROR_CORRUPT_SYSTEM_FILE",
        "Skip merge diagnostics data since %s is not exist",
        "CDeploymentProject::Initialize",
        "void __thiscall UnBCL::ArrayList<void *>::RemoveAt(int)",
        "9@:T:f:n:t:}:",
        "727:7@7M7_7i7|7",
        "ChangeServiceConfigW",
        "4,4@4H4[4s4{4",
        "3=3D3_3f3",
        "Failed to enumerate BCD objects. Status = [%x]",
        "5 6[6",
        "=*=2=>=E=K=P=Y=j=~=",
        "?Assign@?$SmartPtr@VString@UnBCL@@@UnBCL@@AAEXPAVString@2@@Z",
        "CDUPackage::UnpackTo: IUpdate::get_Identity failed. hr = 0x%x",
        "5)6C6X6`6f6s6",
        "3!393b3q3",
        "SyspartGetPhysicalPartitions failed with error code: %x",
        "Reset() called on invalidated enumerator",
        "2-343S3e3o3|3",
        "jTjsj",
        "D$4_^[",
        "MIG Validator",
        "9%999B9U9\\9b9g9r9}9",
        "|SOURCE|\\|FONTS|",
        "OC Validator: Failed to gather OC status. Errors are %signored",
        "D$,PQ",
        "1(1,1<1@1P1T1d1h1x1|1",
        "=%>@>Q>f>n>t>",
        "ERROR_KM_DRIVER_BLOCKED",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *> *)",
        "D$LPV",
        ".?AV?$SerializableBase@V?$Array@K@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@K@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        ".?AVCPrepareSafeOSBootRemoval@@",
        "Remove WIMBoot entries%s",
        "SystemComponent",
        "212R2k2r2{2",
        "RPC_S_NAME_SERVICE_UNAVAILABLE",
        "ERROR_DS_CROSS_NC_DN_RENAME",
        ";,;4;<;H;l;t;|;",
        ".?AV?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a",
        "DUImageInfo->Version",
        "?Format@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXPBGZZ",
        "DownLevelEndTime",
        "7/747S7n7",
        "C;\\$$",
        ";1;U;u;",
        "CGatherEndInstall::DoExecute",
        "zu-ZA",
        "SKIPBOOTTRACK(FIRST): Cannot determine CBS completion status, cannot skip first boot. Error 0x%08X",
        ":+:j:w:",
        ">,>2>7>H>S>a>",
        "=$=,=8=X=`=p=",
        "Setup\\Snapshot",
        "CCompressedStoreHeaderWriterT<class CEmptyType>::Initialize",
        "Scratch path is not on a local drive",
        "O:%sG:%sD:P(A;;FA;;;%s)(A;;GRGX;;;BA)(A;;GRGX;;;SY)(A;;GRGX;;;BU)S:(AU;FASA;0x000D0116;;;WD)",
        ".?AV?$CAutoCleanupBase@PAUIProvisioningPackage@@@RAII@@",
        ".?AU?$IEnumerator@PAVCDeploymentBase@@@UnBCL@@",
        ":&:8:F:S:e:m:s:",
        "ERROR_DS_INTERNAL_FAILURE",
        "VdsDisk::BringOnline: Failed to bring disk online (0x%08x)",
        ";%;/;;;I;P;];m;y;",
        "ERROR_INVALID_CMM",
        ".PAVCXXXXXHandledException@?DP@??UndoTransformers@CSetupPlatformApplyRollbackCheckpoint@@IAEJPAVString@UnBCL@@00@Z@",
        ".PAVCXXXXXHandledException@?2??Initialize@CCFGSectionRegistry@@UAEJXZ@",
        "?,?u?",
        "6$6<6@6X6\\6t6x6",
        ".PAVCXXXXXHandledException@?6??SPValidateMigratedServices@@YGJPAVString@UnBCL@@@Z@",
        "> >D>L>T>\\>d>l>t>|>",
        "8 868D8Q8[8h8n8u8",
        "??_DStreamReader@UnBCL@@QAEXXZ",
        "xinstall.swm",
        "7&787@7F7S7e7o7",
        "class CFilterDriverInfo **__thiscall UnBCL::ArrayList<class CFilterDriverInfo *>::GetBuffer(int)",
        "??6SerializationStream@UnBCL@@QAEAAV01@H@Z",
        "XCEnableUsbDebugging::SetDebuggerTypeSpecificSettings",
        ".?AV?$CAutoRelease@PAUIDUUpdateCollection@DU@@@Mig@@",
        "ApplyFirstBootICBPluginErrorList",
        "%hs: BCD failed to retrieve default boot entry. Error: 0x%08X",
        ":/:;:M:",
        "4\"4;4Z4t4",
        "3!3,3@3E3Y3a3f3|3",
        "ERROR_SXS_XML_E_MULTIPLE_COLONS",
        "void __thiscall CSetupPlatformWinReRestoreCheckpoint::Rollback(const unsigned short *)",
        "ERROR_DS_COULDNT_UPDATE_SPNS",
        "JET_errDerivedColumnCorruption",
        "9+:<:T:x:",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Failed to copy \"%s\" to \"%s\" GLE = [%d].",
        "An error occurred while preparing the log restore file %s",
        "?-?F?M?T?Z?f?z?",
        "Apply (first boot apply, online phase): Migration phase failed. Result: %d, specific error: 0x%08X",
        "    Failed to write key attribute",
        ">->q>",
        "Attempting to disable user %s to match the source user",
        "Failed to add language pack.",
        "Downlevel,End",
        ";7;D;e;r;",
        "8$838;8T8f8o8t8",
        "5!5'5-53595?5E5K5Q5W5]5c5i5o5u5{5",
        "%hs: Failed to create parent directory %s",
        ".?AV?$ArrayList@PAVCAppInfo@@@UnBCL@@",
        ":$WIMMOUNTDATA",
        "WinHttpReadData",
        "QQQh<",
        ".?AV?$DefaultInstanceFactory@VCCompressOldOS@@@UnBCL@@",
        ";3rU;",
        ".?AV?$CAutoWdsLibFree@PAG@Mig@@",
        ".PAVCXXXXXHandledException@?2??DoExecute@CAddAppxPackage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "1$151<1I1`1p1",
        "CSetupPlatformRollback::RegisterRollbackOnlineUsr",
        "%hs: Failed to get downlevel OS version details. Error = %d",
        ":2:W:x:",
        "CSysprepSpecializeOffline::DoExecute: SPGetOSInformation did not find any footprint for the new OS.",
        "=$=8=F=",
        "f_f^fYf",
        "CBS_E_MANIFEST_VALIDATION_UPDATES_PARENT_MISSING",
        "ERROR_DS_DRA_INVALID_PARAMETER",
        "%hs: Cannot set key value %s. Error: 0x%08X",
        "int __thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,&protected: static struct IVdsVDisk * __stdcall UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsVDisk *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "ERROR_DEVICE_ALREADY_REMEMBERED",
        "\\REGISTRY\\MACHINE\\",
        ".?AU?$ICollection@PAV?$DictionaryEntry@GG@UnBCL@@@UnBCL@@",
        "5%5+545<5K5R5X5]5h5s5",
        "void __thiscall UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *>::RemoveAt(int)",
        "747E7R7b7t7",
        "VdsImageDisk::Initialize: Couldn't initialize properties (0x%08x)",
        "2#2?2F2L2Q2\\2g2{2",
        "4!555W5>6\\6z6",
        "324L4",
        "Microsoft\\StrongName\\Verification\\*,*",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: %s does not exist, skip.",
        "void __thiscall UnBCL::ArrayList<class CInfFile *>::set_Item(int,class CInfFile *)",
        "ERROR_SET_NOT_FOUND",
        "SetupPlatform opted-in to sqm",
        "ERROR_DS_FOREST_VERSION_TOO_HIGH",
        "Create file %s on the new system",
        "JET_errCallbackNotResolved",
        ">#>,>5>Q>^>g>p>z>",
        "L$L_^[3",
        ";$;/;=;e;w;",
        "void __thiscall UnBCL::ArrayList<class DiskLayout *>::CopyTo(class UnBCL::Array<class DiskLayout *> *,int) const",
        "Failed to open store from path. File: %ws Status: %x",
        "%systemdrive%\\System Volume Information",
        "ERROR_BUFFER_OVERFLOW",
        "8$8(8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8",
        "?'?4?A?M?Y?f?r?",
        "SL_E_CIDIID_INVALID_DATA_LENGTH",
        "7=7N7[7h7",
        ">B>O>e>",
        "=#=,===J=_=q=",
        "CMediaLayout::Execute: Failed to queue provisioning packages: 0x%08x",
        "nn-NO",
        "RestoreStreams",
        "Exists",
        ":2:::@:M:e:q:{:",
        "ERROR_PAGE_FAULT_DEMAND_ZERO",
        "6$606T6\\6d6l6t6|6",
        "?3?=?",
        "f7b29b7a-086b-43f9-9cc8-e1a2f8a31e08",
        "Failure while requesting feature source payload copy. Error: 0x%08X",
        ".PAVCXXXXXHandledException@?CA@??BuildInfoList@CARPValidator@@IAE?AW4MIGSTATUS@@PAVString@UnBCL@@0PAV?$ArrayList@PAVCAppInfo@@@5@PAV?$ArrayList@PAVCShellFolderInfo@@@5@@Z@",
        ".?AVCICBStore@@",
        "ERROR_CTX_SESSION_IN_USE",
        "6 6(60686@6H6X6`6",
        "pProcessResFileBackedByWim",
        "class OC::COCCollection *__stdcall UnBCL::Try_Cast<classOC::COCCollection*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "5(595F5V5h5o5|5",
        ";\";0;f;",
        "class UnBCL::ArrayList<__int64> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<__int64>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "DeleteCriticalSection",
        "4$4,444<4D4P4X4t4|4",
        "<1=X=z=",
        "=%=/=5=I=W=n=z=",
        "BcdOpenStore: Failed to add store from file %ws. StoreFlags: 0x%x Status: %x",
        "707G7U7",
        "4#565G5w5",
        ":\":/:<:T:`:l:x:",
        "CDeviceIdDatabase::AddInstallableInfs",
        "pa-Arab",
        "ConfigureTelemetryOptInSettingsUx",
        "\\WINDOWS\\WinSxS\\",
        ")Main gather (Machine Specific)",
        "%hs: BCD failed to set default boot entry. Error: 0x%08X",
        "Assertion failed in %hs(%i)",
        "SPUploadDiagnosticsData",
        "IMaintenanceSettings::put_Exclusive failed. hr = 0x%x",
        "class UnBCL::DictionaryEntry<void *,void *> *__thiscall UnBCL::_::HTEnumerator<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<void *,void *> * __stdcall UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::DictionaryEntry<void *,void *> *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "    Failed to get end node local name",
        "CI EA is not supported because the host OS and applied image have a signature type mismatch.",
        "CMediaLayout::QueueInstallImage: Failed to queue splitting the install image: 0x%08x",
        "??1ArgumentOutOfRangeException@UnBCL@@UAE@XZ",
        "??C?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$Array@PAVString@UnBCL@@@1@XZ",
        "?SetMessage@Exception@UnBCL@@MAEXPAVString@2@@Z",
        "OCs enabled and disabled successfully",
        ".?AV?$SerializableBase@VCReconstructOS@@$0A@V?$DefaultInstanceFactory@VCReconstructOS@@@UnBCL@@@UnBCL@@",
        "D$0PWWWW",
        ".?AV?$ArrayList@PAVDiskLayout@@@UnBCL@@",
        "Invalid OS piece found (no drive letter). Original path: %s, current path: %s",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::IndexOf(class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *,int,int) const",
        "void __thiscall UnBCL::ArrayList<struct DiskRange>::RemoveAt(int)",
        "=#=0=A=U=p=~=",
        "x\\System32\\Recovery",
        "u%I64u",
        "444S4w4",
        "Number of $Secure security descriptors updated",
        "HKLM\\",
        "232E2o2",
        "=!=*=3=<=E=N=W=a=n=w=",
        "9str(",
        "j{Yf9L0",
        "j/Xf;",
        "?X?_?",
        "5&5,565X5j5x5",
        "VirtualQuery",
        "?\"?:?Q?e?}?",
        "6(606<6\\6d6l6x6",
        "GetTextMetricsW",
        "Journaling is disabled on the applied volume.",
        "RemoveSourceHardlinks: Removing source hardlinks using journal: %s",
        "y#Vh$",
        "SPDeleteOldUpgradeSnapshots: Cannot open snapshot key. Error: 0x%08x",
        "0&0-0F0R0b0n0z0",
        "4%474E4j4|4",
        "?:?e?",
        "JET_errSessionInUse",
        "Failed to install optional component",
        "1$1,141@1`1l1",
        "6<6D6N6U6[6`6k6w6",
        "JET_errTempPathInUse",
        "ERROR_NO_USER_KEYS",
        "ERROR_IPSEC_IKE_INVALID_HASH_ALG",
        "3%3/3J3R3Y3g3",
        "3!3)363?3E3Y3i3u3",
        "%hs: Migration phase caught an exception.",
        "161@1L1W1o1",
        "5!5,5E5]5w5~5",
        ":/:8:P:W:^:d:q:",
        "(%lx): Failed to open source child key",
        ";(;5;F;];j;{;",
        "515F5e5|5",
        "93:>:N:Y:u:",
        "ERROR_LOST_WRITEBEHIND_DATA",
        "ERROR_INVALID_LDT_DESCRIPTOR",
        ">!>d>",
        "??0Win32Exception@UnBCL@@QAE@KPBGPAVException@1@@Z",
        "CSetupPlatform::GetAutomationFromAnswerFile: Can't initialize disk provisioning: 0x%08X",
        "ReadChunk",
        "Marking event [&SclEvent_ExecuteUpgHives_Start]",
        "%hs: Failed to find the WIM image. Error 0x%08X",
        "OFFLINE PROFILES: Offline profile creation turned off because of profiles folder redirection",
        "3)333G3]3v3",
        ":!:(:.:3:>:I:]:k:t:",
        "Cannot calculate weight for pre-finalize operations. Likely the sort operation failed.",
        "PackagePaths cannot be NULL.",
        ".?AV?$SerializableBase@VCSimpleCleanup@@$0A@V?$DefaultInstanceFactory@VCSimpleCleanup@@@UnBCL@@@UnBCL@@",
        "ChunkWriterEnqueue",
        "ERROR_XML_ENCODING_MISMATCH",
        "sd-Arab",
        ">#>7>",
        "pGlobalProgressBounds: Phase %d, Calculated progress : Global start: [%u], Global end: [%u]",
        "SKIPBOOTTRACK(SAFEOS): Will explicitly turn off SafeOS boot removal due to journal move conflicts",
        "0'010R0m0",
        "SKIPBOOTTRACK(SAFEOS): Skip Boot Validator: New OS does not have EAs applied, continuing due to force environment variable.",
        "ERROR_INVALID_REPARSE_DATA",
        "  Signature status: %s",
        "1#1*141E1R1\\1k1t1z1",
        "{fail} ",
        "2#383@3F3O3e3",
        "(%lx): Unable to get file system size information.",
        "Operation execution failed.",
        ".?AV?$ArrayListEnumerator@PAVCOperation@@@_@UnBCL@@",
        "7$7,747<7H7l7t7|7",
        "PSFX_E_APPLY_REVERSE_DELTA_FAILED",
        ":\":':2:<:A:N:U:[:`:k:u:z:",
        ">.>6>=>D>O>\\>p>u>",
        "km-KH",
        "class CCopyInfo *__stdcall UnBCL::Try_Cast<classCCopyInfo*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "9-9I9P9Y9^9j9v9~9",
        ":0:5:::D:[:`:{:",
        "9,939",
        ".?AV?$SmartPtr@VCFlowControls@@@UnBCL@@",
        ".?AVCDUPackage@@",
        "\\\\.\\%c:",
        ";$;*;4;>;R;h;",
        "unallocated disk image",
        "%s.Profile.Old",
        "PackageSuccessPath",
        "NEO installation path is allowed.",
        "FullPath",
        "Change tags mismatch for hive [%ws]; will skip the changed keys list.",
        ":8:E:]:",
        "SL_E_LUA_ACCESSDENIED",
        "3+373>3G3L3W3d3o3",
        "CStartSystemServices::DoExecute",
        ";$;*;/;@;K;Y;x;",
        "7C8U8]8c8p8",
        "9#9.9E9L9R9W9b9m9",
        "CMediaLayout::Execute",
        "void __thiscall UnBCL::ArrayList<class CUserProfile *>::CopyTo(class UnBCL::Array<class CUserProfile *> *,int) const",
        "Attempt %d: %s",
        "CNewSystem::QueueOperations: Failed to query soft reserve info on [%s]. Error: 0x%08x",
        "%hs: Cannot enable SE_SECURITY_NAME privilege",
        "?get_P@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBEPAVEncoding@2@XZ",
        "4 444H4\\4p4",
        "1,1>1L1Y1k1s1y1",
        "Install package: %S",
        ":+;W;",
        "VdsPhysDisk::GetProperties",
        "?IndexOf@String@UnBCL@@QBEHG@Z",
        "> >0>4>D>H>X>\\>l>p>",
        "-ShPg",
        "Uninstall window is still available, not allow to cleanup exipred snapshot",
        "%hs: Recovery image path is on the system volume.",
        ".?AV?$Array@PAV?$DictionaryEntry@_JPAVCGlobalPath@@@UnBCL@@@UnBCL@@",
        "CBSWdsLog",
        "?(?=?`?f?",
        "7'8D8",
        "Failed detect Hyper-V setting. Status = [%x]",
        "SPReadOSPiecesSection",
        "drvstore.props.dat",
        "QSj(j)h4!",
        "SPGetDiskImage: GetVolumePathNamesForVolumeName failed while reading path names (0x%08x)",
        "4$444D4T4d4t4",
        "int __thiscall UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::BinarySearch(int,int,struct SPGetPartitionOrdinal::PartitionInfo,struct UnBCL::IComparer<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo> *)",
        "8'868E8T8c8z8",
        "9$9,989X9`9h9p9",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class OC::CCmdLineExecutionTelemetryData *>::Reset(void)",
        "4=5S5t5",
        "ERROR_PNP_TRANSLATION_FAILED",
        "3%4O4",
        "Failed to create a new system store. Status = [%x]",
        "Scratch space %s does not have enough free disk space, required: %I64u, available: %I64u",
        "void __thiscall UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *>::Insert(int,class CDeploymentBase::CMountedPathInfo *)",
        "D$8PS",
        "Cannot reset file attributes for %s",
        "SPTurnOffStorageReserve: Failed to turn off reserves. hr = 0x%08X",
        "<$<7<M<r<",
        "?Steal@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEPAV?$ArrayList@PAVString@UnBCL@@@2@XZ",
        "8E8L8W8^8i8x8",
        "4@4G4M4R4^4f4z4",
        "CNewSystem::QueueSetupAutomation: Failed to get provisioning package %u: 0x%08x",
        ":$;H;",
        "3(3@3d3x3",
        "?/?G?l?s?y?~?",
        "SetImpersonationCount",
        "8B8f8q8",
        "onecore\\base\\ntsetup\\provpackageapi\\lib\\element.cpp",
        "DEFAULTAPP",
        ".didat$4",
        ":!:5:F:S:\\:r:",
        "250701214655Z0|1",
        "%hs: Recovery image path: %s, index: %u",
        "FirstBootTel.etl",
        "D$<QPQQ",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@GG@UnBCL@@@UnBCL@@@UnBCL@@",
        ":0:=:F:N:a:s:{:",
        "0<0`0",
        "0#0;0A0W0h0u0}0",
        ".PAVCXXXXXHandledException@?CO@??DoExecute@CMigrateFramework@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "2*282F2T2",
        "Reserved space (%I64d) not accurate; will perform additional buffer check.",
        "7q7w7}7",
        "CRelocateOS: Failed to write converted entries from %s to %s",
        "Cleaning up boot entries",
        ":):2:<:E:O:e:s:|:",
        "ERROR_SXS_XML_E_BADSTARTNAMECHAR",
        ";,<P<",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::MoveNext(void)",
        "9.9G9O9^9",
        "ERROR_DS_DRA_SOURCE_IS_PARTIAL_REPLICA",
        "SETUPPLATFORMEXE: Progress pipe connected.",
        "SL_E_CHPA_INVALID_BINDING_URI",
        "7,7<7D7L7Q7r7",
        ".PAVCXXXXXTemp@?CO@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "PWVha",
        "1$1)141>1Q1W1[1f1",
        ".?AV?$SerializableArrayListBase@PAVCBcdSetting@@@_@UnBCL@@",
        "5*575I5Q5W5`5v5",
        "=5>s>",
        "D$8SVW3",
        "JET_errTableInUse",
        "989C9N9j9v9",
        "void __thiscall UnBCL::_::ArrayListEnumerator<unsigned char>::Reset(void)",
        "4#474X4",
        "CDiagnosticsHelper::PersistDiagnosticsData",
        "Enable feature",
        "3!32393O3j3p3z3",
        "=!=.=6=S=Y=k=",
        "Delete reg key value failed: 0x%x",
        "??5SerializationStream@UnBCL@@QAEAAV01@AA_J@Z",
        "6#626<6A6I6P6\\6n6",
        "Hive file [%ws] is in use; will attempt retries to ensure unload",
        "7\"878U8a8s8",
        "5$5+51565A5N5T5h5x5",
        "8\"8)8/848@8H8j8u8",
        "242B2K2W2`2q2",
        ";#;1;:;C;L;U;^;g;p;y;",
        "%hs: Failed to initialize COM. hr = 0x%x",
        "ERROR_TXF_METADATA_ALREADY_PRESENT",
        "4!4)4/4<4N4\\4",
        "3k5r5y5",
        "2X2j2r2x2",
        "050G0O0U0b0t0~0",
        "6-6=6M6]6",
        "SPTagTarget: Get NULL for target path",
        "#comment",
        "onecore\\base\\ntsetup\\provpackageapi\\lib\\provisioningpackage.cpp",
        "?%?+?4?I?",
        ";8;t;",
        "2$272D2K2P2[2v2",
        "int __thiscall UnBCL::Hashtable<class UnBCL::String *,int>::ContainsKey(class UnBCL::String *) const",
        "fflush",
        "3)373i3",
        "OSEnv",
        "CBS_E_INVALID_PACKAGE_REQUEST_ON_MULTILINGUAL_FOD",
        "y#Wj+h",
        "737:7N7}7",
        ".PAVCXXXXXHandledException@?M@??DoExecute@CFinalizeSafeOSBootRemoval@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "?&?,?1?<?F?K?_?|?",
        "ERROR_INCORRECT_ADDRESS",
        "\\BOOT\\BCD",
        "4&404o4{4",
        "8I8m8",
        ".?AU?$IEnumerable@I@UnBCL@@",
        "%hs: Failed to write to file: %s. Error: 0x%08X",
        "%hs: Found invalid config value: %s",
        ";);7;E;S;",
        "Cannot convert GUID string %s to GUID",
        "int __thiscall UnBCL::_::ArrayListEnumerator<struct _GUID>::MoveNext(void)",
        "tzm-Arab-MA",
        "Deserialize/Execute pre-OOBEBoot operations failed",
        "dCDiagnosticsHelper::PersistDiagnosticsData",
        "0 1p1",
        ".?AV?$HTEnumerator@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@UTableKey@?$Hashtable@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@4@PAV34@UKeyTraits@64@$1?RetrieveValue@64@KGPAV34@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@PAV?$DictionaryEntry@PAXPAX@3@UKeyTraits@23@V?$CElementTraits@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "7'7-727C7N7\\7",
        ";$;-;3;S;k;u;",
        "<&<I<R<p<y<",
        "void __thiscall OC::COCCbsAdapter::InitOnline(void)",
        ";h;v;",
        "fr-MC",
        ">X>e>}>",
        "9$9,9d9",
        "8>8K8h8u8",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@KPAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "%%SystemDrive%%%s",
        "4%4,464C4J4T4e4r4|4",
        "5!535;5H5\\5h5x5",
        "GetHandleInformation",
        "1-1C1d1",
        "5 5=5R5e5z5",
        ".?AV?$SmartPtr@U?$IEnumerator@UDiskRange@@@UnBCL@@@UnBCL@@",
        "VdsPlatformDiskEnumerator::GetNext: Failed to get VDisk properties (0x%08x)",
        "Setting WMI Uint16 property %s: can't convert to VARIANT type %d",
        ".?AVCStartSuspendedServices@@",
        "4,404@4D4T4X4h4l4|4",
        "@te9|$",
        ".?AV?$CAutoWdsLibFree@PAU_ENUM_SERVICE_STATUSW@@@RAII@@",
        "9 9-939?9W9]9o9",
        "void __thiscall UnBCL::ArrayList<struct DiskRange>::AddRange(const struct UnBCL::ICollection<struct DiskRange> *)",
        ".?AV?$SerializableBase@VCEnableUsbDebugging@@$0A@V?$DefaultInstanceFactory@VCEnableUsbDebugging@@@UnBCL@@@UnBCL@@",
        ":+:7:C:O:[:h:t:",
        "6!6(626<6N6U6d6k6z6",
        "1]2g2",
        ".PAVCXXXXXTemp@?MM@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "7$7*777I7W7i7",
        "void __thiscall UnBCL::ArrayList<class CRegCreationData *>::QuickSort(class UnBCL::ArrayList<class CRegCreationData *> *,class UnBCL::ArrayList<class CRegCreationData *> *,int,int)",
        "0\"0=0V0c0p0{0",
        "%hs: Parent must have data migration queued as well.",
        "class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::get_Item(int)",
        "ERROR_CLUSTER_NODE_UNREACHABLE",
        "void __thiscall UnBCL::ArrayList<class CImageInfo *>::QuickSort(class UnBCL::ArrayList<class CImageInfo *> *,class UnBCL::ArrayList<class CImageInfo *> *,int,int)",
        "_(;_$|",
        "ERROR_PAGEFILE_QUOTA_EXCEEDED",
        "ERROR_CONTENT_BLOCKED",
        "8 8(8,84888<8@8D8H8L8P8T8X8`8d8h8l8t8x8",
        "class CBcdSetting *__stdcall UnBCL::Try_Cast<classCBcdSetting*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        ".CApplyDrivers::DoExecute",
        ".PAVCXXXXXTemp@?6??SPGetAllPartitions@@YGJIPAPAV?$ArrayList@PAVCPartitionInfo@@@UnBCL@@@Z@",
        "3'4-494R4n4t4",
        "DriverVersion",
        "=$=(=,=0=8=P=T=l=p=",
        "CRelocateOS: Moving new OS pieces from %s to %s",
        "ERROR_INVALID_HOOK_HANDLE",
        "=!=?=F=L=Q=\\=c=v=",
        "IMAGE\\LASTMODIFICATIONTIME\\HIGHPART",
        ":!:.:4:H:P:",
        "6(60686H6T6\\6",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,int> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::get_Item(int)",
        "\\Device\\MountPointManager",
        "XCNewSystem::QueueAddCbsPackage",
        "D$0PS",
        "3-3@3H3N3[3m3",
        "7\"7(7-787B7Q7]7l7t7{7",
        "(%lx): Failed to get boot entry.",
        "5-555A5H5N5S5_5j5~5",
        "0 0,0L0X0x0",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::RemoveAt(int)",
        "ActionPlatform::DeleteDirectory: Invalid directory path %s passed",
        "3:3@3J3O3Y3`3n3",
        "PQSVW",
        "< <,<8<D<P<\\<h<t<",
        "CSetupAutomation::GetDataMigration: Unknown migration option %u",
        "int __thiscall UnBCL::ArrayList<class CPartitionInfo *>::LastIndexOf(class CPartitionInfo *,int,int) const",
        "class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::get_Current(void) const",
        "void __thiscall UnBCL::Array<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::Remove(struct SPGetPartitionOrdinal::PartitionInfo)",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,struct UnBCL::ISerializable *>,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,struct UnBCL::ISerializable *> __stdcall UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,class ATL::CElementTraits<struct UnBCL::ISerializable *> > const *,struct __POSITION * const &)>::Reset(void)",
        ";7;A;G;T;r;};",
        "8\"8*8J8`8",
        ":!:0:5:O:V:\\:a:l:z:",
        "4,5C5",
        "405L5X5}5",
        "CFailForwardSystem::QueueDataMigration",
        ".?AV?$DefaultInstanceFactory@VCRemoveFODPackage@@@UnBCL@@",
        "ERROR_REVISION_MISMATCH",
        "OC::COCCbsAdapter::InitOnline: ICbsSession Initialize failed. hr = 0x%x",
        "JET_errSpaceHintsInvalid",
        "DU Client Application Information",
        "?&?,?1?<?K?Q?V?j?",
        "ERROR_CLASS_ALREADY_EXISTS",
        "int __thiscall UnBCL::ArrayList<struct PartitionLayoutArgs *>::IndexOf(struct PartitionLayoutArgs *,int,int) const",
        "343X3x3",
        "MSPWriteConfigValue",
        "Registry Value [%s] not found under [%s]. Error: 0x%08X",
        "dz-BT",
        "pReadPageFileSettingsAndWriteToConfigFile: Failed to read CrashDumpEnabled value, writing default value. Error: 0x%08x",
        "JET_errFileIOFail",
        "5$5)5=5E5R5Y5g5u5z5",
        ">&>3>:>D>U>b>l>{>",
        "SPAPI_E_DEVICE_INSTALL_BLOCKED",
        "Index of element to insert exceeds the number of elements.",
        "ERROR_MOUNT_POINT_NOT_RESOLVED",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class COperationInfo *>::Reset(void)",
        "?1?;?B?H?M?X?g?{?",
        "(%lx): RtlConvertSidToUnicodeString failed!",
        "%d.%d.%d.%d",
        ".PAVExternalException@UnBCL@@",
        ">%>Y>e>p>~>",
        "PWhXi",
        "IMAGE_STATE_COMPLETE",
        ".PAVCXXXXXTemp@?6??SPCreatePartition@@YGJH_K0HPA_K@Z@",
        "Copy feature source payload from %s to %s",
        "Try to get snapshot creation time via property",
        "2'21292?2D2X2a2j2}2",
        "Apply (oobe boot apply, online phase): Migration phase failed. Result: %d, specific error: 0x%08X",
        "Uninstall apply",
        "FindGlobalPath: Cannot get DOS path from NT path %s. Error: 0x%08X",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::Insert(int,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *)",
        "%s: Successfully injected driver package in the new OS: %s.",
        "?H?l?",
        "ERROR_FAIL_REBOOT_INITIATED",
        "=\"=/=Q=`=h=v=",
        ";(;:;H;",
        "747A7Y7d7r7",
        "Source system has WIMBoot entries:",
        "Failed to open new session: (%s). Error: 0x%08X",
        "ERROR_DS_ATT_VAL_ALREADY_EXISTS",
        "%hs: %s environment variable detected, but current scenario cannot be optimized for low disk space.",
        ">%>,>?>S>Z>`>e>p>w>",
        "ERROR_RELOC_CHAIN_XEEDS_SEGLIM",
        ":+;C;I;[;d;u;",
        "?&?/?9?E?N?`?",
        "BootPathOverride",
        "const unsigned char &__thiscall UnBCL::ArrayList<unsigned char>::get_Item(int) const",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Failed to restore BCD database from \"%s\" to \"%s\".",
        ".?AV?$DefaultInstanceFactory@VCSetBusParams@@@UnBCL@@",
        "? ?1?:?C?c?p?",
        "9#9P9",
        "8%8,82878B8M8a8",
        ";&;7;@;G;R;",
        "DISKSPACEQUERY(external request): Calculating disk space failed. Error: 0x%08X",
        "DiskLayout::Populate: Failed to get partition properties: 0x%08x",
        "_errno",
        "6,6<6L6\\6l6|6",
        "CBS_E_UNEXPECTED_PROCESSOR_ARCHITECTURE",
        "SmPartition::InitializeProperties: Unable to query %s (0x%08x)",
        "Uninstall is %sactive",
        "Cannot get the GUID from string %s. Ignoring class.",
        "8$8-8>8T8c8z8",
        "7$7,727;7V7o7u7",
        "%hs: Image %s. Progress: %d",
        "SL_E_EXTERNAL_SIGNATURE_NOT_FOUND",
        "__int64 &__thiscall UnBCL::ArrayList<__int64>::get_Item(int)",
        "2$2<2G2U2c2q2",
        "PShp[",
        "NEO installation path is turned off by external request",
        "CBS_E_ILLEGAL_COMPONENT_UPDATE",
        "\\Program Files",
        "%hs: EnumServicesStatusExW failed for group %s",
        ".PAVCXXXXXHandledException@?2??DoExecute@CRemoveOSUninstall@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ".?AU?$IDictionaryEnumerator@PAVString@UnBCL@@PAVCSPInternalPluginData@@@UnBCL@@",
        "0(0A0]0t0",
        "9;9Q9u9|9",
        "2&262>2K2S2Z2",
        "y$Vh`",
        "6\"6)61666A6H6N6b6z6",
        "1 1B1J1V1^1",
        "9]:d:j:o:{:",
        "<'<4<=<N<V<g<o<y<",
        "%hs: Migrate OEM tools: %s",
        "ERROR_DS_GOVERNSID_MISSING",
        ".?AV?$CAutoDeleteArray@E@RAII@@",
        "ShutdownQueued",
        "CInstallDUUpdatesOffline::FindOperation",
        "__thiscall UnBCL::ArrayList<class CGlobalPath *>::ArrayList(const struct UnBCL::ICollection<class CGlobalPath *> *)",
        "6!6E6d6",
        "hwcompat.txt",
        "CDUPackageCollection::Append: IDUUpdate::GetItem failed. hr = 0x%x",
        "5)565I5`5i5x5",
        ".?AV?$Array@W4OP_EXECUTION_PHASE@@@UnBCL@@",
        "t$ Wj",
        "int __thiscall UnBCL::ArrayList<__int64>::LastIndexOf(__int64,int,int) const",
        ".?AV?$SmartPtr@VCSPInternalPluginData@@@UnBCL@@",
        "GetTempPathW",
        "989@9H9T9\\9",
        "1\"1/191@1I1Q1W1^1n1",
        "1!1-1A1P1W1]1b1m1w1",
        "1.1@1H1N1[1m1{1",
        "4o5m6a7P8",
        "Skipping operation failed: %s. Error: 0x%08X",
        "9r4uC",
        ".?AVCXXXXXHandledException@?N@??SPProcessServiceDisable@@YGXPBG0@Z@",
        "pLaunchNarrator",
        "0$080F0T0b0",
        "class UnBCL::MultiSz *__stdcall UnBCL::Try_Cast<classUnBCL::MultiSz*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "7$707<7H7T7`7",
        "3!414G4W4g4",
        "OC_NETFX_REINSTALL_TIMEOUT",
        "=$=>=C=H=T=~=",
        "j\\j[j-j",
        "GetSecurityDescriptorGroup failed! Error code = %#x",
        "Failed to restore wimboot entries",
        "?GetFiles@Directory@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBVString@2@0H@Z",
        "OPERATIONTRACK: Remove Operation: %3d|%s",
        "INSTALLATIONTYPE",
        "ERROR_DS_OBJECT_BEING_REMOVED",
        "DiskLayout::VerifyLayoutModifyIndices: Failed to enumerate target disk partitions (0x%08x)",
        ".?AV?$SerializableBase@VCRelocateOS@@$0A@V?$DefaultInstanceFactory@VCRelocateOS@@@UnBCL@@@UnBCL@@",
        "WTSEnumerateSessionsW",
        "Failed to add prefix to UNC path.",
        "void __thiscall UnBCL::Array<class CCopyInfo *>::RemoveAt(int)",
        ">->>>m>",
        "3!3<3C3I3N3^3k3",
        "535:5A5L5W5\\5p5",
        "CSetupAutomation::SetImageIndex: Couldn't get info for image %u",
        "ResurrectSetupPlatform: Found invalid serialized data for setup platform.",
        "8+8?8M8[8d8m8",
        ";8;?;E;J;U;_;r;",
        "4*5;5Y5",
        "2(2[2",
        "Using Setup content folder: %s",
        ".PAVCXXXXXTemp@?3??SPExtendPartition@@YGJH_K0@Z@",
        "646k6r6x6}6",
        "base\\ntsetup\\setupplatform\\lib\\project\\deploymentproject.cpp",
        "void __thiscall UnBCL::ArrayList<class CFailForwardSystem *>::set_Item(int,class CFailForwardSystem *)",
        "COMPONENTS hive test failed, proceeding with Slow Mode Reset (Not re-using COMPONENTS hive)",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::Add(class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *)",
        "QSjvh",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::get_Item(int)",
        "GatherEndInstallPluginErrorList",
        ":*:7:H:O:V:a:l:q:",
        "6!626:6@6O6U6g6t6",
        "?H?p?",
        "Onesettings: Failed to AddParameter(%s): 0x%x",
        "3,fTidTq ,>gEB;",
        ">)>l>",
        "Failed to calculate space taken up by copy of updates",
        "ERROR_CANNOT_DETECT_DRIVER_FAILURE",
        "DiskLayout::ApplyLayout: Failed to apply deletions from disk layout (0x%08x)",
        "SPAPI_E_NON_WINDOWS_DRIVER",
        "GetModelSectionNameEx:Could not select section name using API.  Using default undecorated section name [%s]",
        "JET_errBufferTooSmall",
        ".?AVCInfFile@@",
        ".?AV?$SmartPtr@VCCmdLineManager@OC@@@UnBCL@@",
        "DriverInf",
        "CSVFS",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::set_Item(int,class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *)",
        "1C2e2m2t2z2",
        "ERROR_ACTIVE_CONNECTIONS",
        "?7?C?U?s?",
        "4 4$4<4L4\\4l4|4",
        "Failed to allocate space for object device.",
        "Failed reading Uninstall active from registry: 0x%08x, size: %d",
        "void __thiscall UnBCL::Array<class CSimpleCleanup::CCleanupEntry *>::RemoveAt(int)",
        "8)9:9O9b9j9",
        "5'5-525C5N5\\5",
        "RtlAllocateHeap",
        "CMediaLayout::ExecuteOptimization: Failed to get provisioning package path at index %d: 0x%08x",
        ";;;E;X;r;",
        "$0;0H0_0l0z0",
        "RemoveAccessPath",
        "<6<F<V<o<",
        ";0;c;z;",
        ".?AV?$SerializableBase@VCCFGSectionFile@@$0A@V?$DefaultInstanceFactory@VCCFGSectionFile@@@UnBCL@@@UnBCL@@",
        ".PAVCXXXXXHandledException@?CFM@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "9.9D9N9[9b9s9",
        ".?AV?$DefaultInstanceFactory@VCMigrateFramework@@@UnBCL@@",
        "JET_errLSCallbackNotSpecified",
        ";2;E;];p;|;",
        ".?AU?$IEnumerable@PAX@UnBCL@@",
        "int __thiscall UnBCL::ArrayList<unsigned char>::BinarySearch(int,int,unsigned char,struct UnBCL::IComparer<unsigned char> *)",
        "void __thiscall UnBCL::ArrayList<unsigned short *>::QuickSort(class UnBCL::ArrayList<unsigned short *> *,class UnBCL::ArrayList<unsigned short *> *,int,int)",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAUISerializable@2@UTableKey@?$Hashtable@PAVString@UnBCL@@PAUISerializable@2@@2@PAV12@UKeyTraits@52@$1?RetrieveKey@52@KGPAV12@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@PAUISerializable@3@UKeyTraits@23@V?$CElementTraits@PAUISerializable@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "ISPCAT",
        "CRYPT_E_OSS_ERROR",
        "60676A6H6T6Y6d6v6",
        ".?AVCXXXXXHandledException@?FH@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@",
        ".?AV?$ArrayListEnumerator@E@_@UnBCL@@",
        ":#:P:",
        "CInstallDUUpdatesOffline::DoExecute: Failed to open OS DISM session. Error: 0x%08X",
        "PPPVh",
        ".?AV?$SerializableBase@VCStopSuspendedServices@@$0A@V?$DefaultInstanceFactory@VCStopSuspendedServices@@@UnBCL@@@UnBCL@@",
        "?N?h?}?",
        "CReconstructOS::DeleteTempFiles: Deleting temporary file %s",
        "0+0;0@0L0\\0c0k0p0|0",
        "545<5D5L5T5\\5d5l5x5",
        "3!373?3T3[3f3",
        "=(=8=?=S=Z=z=",
        "939y9",
        "Wmi::OpenNamespace: Too late to initialize COM security (0x%08x)",
        ".?AV?$CAutoDelete@PAVString@UnBCL@@@Mig@@",
        "%hs: Error while writing the migration scope value: 0x%08X",
        "base\\ntsetup\\migration\\setup\\oc\\lib\\src\\ocmanager.cpp",
        "0'0>0N0V0t0",
        "ERROR_WMI_ITEMID_NOT_FOUND",
        "CReserveDiskSpaceFirstBoot::GetDiskSpaceImpact",
        "QWRPQ",
        "na:FileSystem",
        "Removing driver %s (%s)",
        "Suspending BitLocker on OS volume",
        "ERROR_INCOMPATIBLE_SERVICE_SID_TYPE",
        "?3?8?X?]?p?",
        "L$|_^[3",
        "CSetupPlatform::CreateAutomation: Failed to initialize automation: 0x%08x",
        "0#0-0>0K0T0\\0f0w0",
        "909J9O9T9`9z9",
        "Failed opening target COMPONENTS hive %ls",
        "%hs: Cannot get the real platform. Error: 0x%08X",
        "int __stdcall pSPRestoreUserShellFolder(class UnBCL::String *,struct IMigUser *,struct IMigEnvironment *,struct IMigUser *,struct IMigEnvironment *,struct IMigPlatform *)",
        "Operations.End",
        "SP_INSTALL_INFO",
        "7!878F8",
        ":b:r:",
        "5+6G6Z6l6q6",
        "282?2E2J2U2`2t2",
        "SeSecurityPrivilege",
        "D$$PSSh",
        "WINDOWS/VERSION/SPBUILD",
        "DetermineIfControllerIsXHCI: Failed to alloc property string. Error = 0x%X.",
        "3$313>3\\3c3}3",
        ">\">8>I>`>l>",
        "7)7>7N7^7n7{7",
        "SetupPlatformOSSwitchCheckpoint",
        "SysprepSession::ExecuteAction",
        "xSOFTWARE\\Microsoft\\SQMClient",
        "OrchestrateUpdateImageState: Updating image state from [%s] --> [%s]",
        "long __thiscall CSetupPlatformRollback::SaveState(void) const",
        "OC::COCCbsAdapter::Release: ICbsSession::Finalize failed.  hr = 0x%x",
        "FltCommExchangeDirs",
        "class SysprepComponent *__thiscall UnBCL::_::ArrayListEnumerator<class SysprepComponent *>::get_Current(void) const",
        "6$6,686@6X6`6x6",
        "WinNT",
        "QueryDosDevice failed for %s. GLE: %u",
        "5$5:5_5g5v5~5",
        ".?AV?$SerializableBase@VCAddAppxPackage@@$0A@V?$DefaultInstanceFactory@VCAddAppxPackage@@@UnBCL@@@UnBCL@@",
        "LCMapStringW",
        "6%616C6Q6_6m6",
        "%hs: Failed to open handle to BitLocker active volume",
        "_DismGetCapabilitiesEx",
        "CFailForwardSystem::QueueCreateRegistry",
        "CSetupAutomation::SuspendAndRelease: Failed to get existing deployment options: 0x%08x",
        "303A3H3P3U3`3g3m3",
        "7\"7(7.747:7@7F7L7R7X7^7d7j7p7v7|7",
        "base\\ntsetup\\lib\\bclib\\src\\bclib.c",
        "int __thiscall UnBCL::ArrayList<class CAntiVirusInfo *>::LastIndexOf(class CAntiVirusInfo *,int,int) const",
        "6#6)6.696@6T6j6t6",
        "JET_errCatalogCorrupted",
        "sCopy file from %s to %s",
        "Found WinPE inbox support for HW ID: %s",
        "class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *const *__thiscall UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::GetBuffer(int) const",
        ".?AV?$CAutoRelease@PAVVdsPlatform@@@RAII@@",
        "setValue",
        "ERROR_LOG_CONTAINER_LIMIT_EXCEEDED",
        "%hs:BcdCreateStore() for %s failed, ec = [%x]",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *> *,int,int)",
        "ERROR_BAD_EXE_FORMAT",
        "1(1:1K1T1",
        "WDSCORE.dll",
        "%hs: CreateRamdiskOptions succeeded.",
        "?MemAllocFailed@Allocator@UnBCL@@SGHXZ",
        "1-1I1P1V1[1g1r1",
        "j%j)j",
        "0%0H0k0y0",
        "PWSh ",
        ">(>.>5>?>L>S>]>n>{>",
        ";$<E<d<",
        ".PAVCXXXXXTemp@?BM@??GetCriticalDUPackageInformation@CNewSystem@@UAEJKPAPAUIDUPackageCollection@SetupPlatform@@@Z@",
        "<$<0<<<H<T<`<l<x<",
        "ERROR_DS_NO_MSDS_INTID",
        "OOBEBoot,Start",
        "fYf[fX",
        "; ;<;D;M;S;e;",
        "SPDoOfflineGather",
        "JET_errOutOfCursors",
        "CApplyWIM: Failed to set the reference WIM file %s for %s. Error: 0x%x",
        "ERROR_FILE_IDENTITY_NOT_PERSISTENT",
        "{C92C3228-3CA1-4264-9185-DAE0D347BAF9}",
        "WINDEPLOY error code is 0x%08X. Will not attempt uninstall",
        "dDeserialize/Execute pre-SysPrepoperations failed",
        "long __stdcall SPFixupRelocatedFolders(class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::ArrayList<class COSPieceInfo *> *,class UnBCL::ArrayList<class COSPieceInfo *> *,class UnBCL::String *)",
        "ExecuteCommandFromValue: Executing command line: %s",
        "7.7F7M7T7Z7e7",
        "RegisterClassExW",
        "void __thiscall UnBCL::Array<class OC::COptionalComponent *>::Insert(int,class OC::COptionalComponent *)",
        "1*1A1N1U1e1|1",
        "0$060V0^0h0r0y0",
        "unsigned long __thiscall SysprepSession::GetOfflineStateFromRegistry(class UnBCL::String *)",
        "sd-Arab-PK",
        ".?AU?$IEnumerable@PAUPartitionLayoutArgs@@@UnBCL@@",
        "3&3/3;3C3I3O3^3r3",
        "%hs: Failed to set BCDE_OSLOADER_TYPE_OS_DEVICE field. Status = %d",
        "Updating WIMBoot entry %I64d to path %s",
        "0'040<0G0S0a0j0s0|0",
        "Failed to get snapshot creation time from property. Error: 0x%08X",
        ".PAVCXXXXXHandledException@?P@??Rollback@CSetupPlatformWinReRestoreCheckpoint@@UAEXPBG@Z@",
        "9':G:a:h:n:s:~:",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCOperationInfo@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCOperationInfo@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "class UnBCL::String *__thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,class ATL::CElementTraits<struct UnBCL::ISerializable *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "DiskLayoutMakeSystem: Failed to convert the system partition into an ESP (0x%08x)",
        "E,t`jH",
        "CDownloadDUUpdates::DoExecuteInternal: Did not find hard disk space needed, when update cab files will not be extracted. This is unexpected! hr = 0x%x",
        "PWVh|",
        "9&9:9H9V9d9",
        "Current",
        "%hs: BCD failed to set timeout. Error: 0x%08X",
        ":&:o:",
        "9&9,999K9Y9z9",
        "4$484L4T4\\4d4l4t4|4",
        "1+1\\1f1~1",
        "  ID = %s",
        "ar-LY",
        ".?AV?$SmartPtr@VCBugcheckInfo@@@UnBCL@@",
        "?%?+?0?:?D?N?X?f?l?r?w?",
        ":4:I:Z:c:p:~:",
        "\\system32\\kernel32.dll",
        "1-1:1B1S1s1",
        "MIG_SCOPE_REQUIRED",
        "<H<U<m<",
        "222h2",
        ":=;L;",
        "Panther\\CustomAuditCommand",
        "5r6y6j7",
        ">B>^>n>|>",
        "class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::GetBuffer(int) const",
        "NtQueryValueKey",
        "=$=(=0=4=<=D=H=P=X=\\=d=l=p=x=",
        "ERROR_IPSEC_IKE_QUEUE_DROP_MM",
        "dNEODisabled",
        "CNewSystem::CreateFailForwardSystem",
        "8P8U8w8",
        "ferror",
        "Cancel event was signaled; will cancel new system operations",
        "CProcessDrivers::ProcessDriverMigration",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCOperationsValidator@@@UnBCL@@@UnBCL@@",
        "Run sysprep specialization offline on %s",
        "5%5=5",
        "pVdsDoAsyncWait: The %s wait failed (0x%08x)",
        ">&>8>@>F>X>l>y>",
        ".?AV?$DefaultInstanceFactory@VCSetEntropy@@@UnBCL@@",
        "_wcsnicmp",
        "ERROR_RETRY",
        "Did not find any packages in %s; no packages to install",
        "ERROR_CTX_CDM_CONNECT",
        "PauseRequested",
        ";0;C;O;V;\\;a;l;v;{;",
        "=&=-=4=;=A=K=m=",
        "0&0,010<0H0\\0t0",
        "Cannot revert execution of operation %d (%s). Execution queue is now compromised.",
        "2'3>3a3",
        "5%555>5K5W5q5{5",
        "FODRemovalSucceededList",
        "ARPInstalledList",
        "9B9N9`9m9w9",
        "void __thiscall UnBCL::ArrayList<__int64>::set_Item(int,__int64)",
        "CSIDL_PROGRAM_FILES",
        "SetTimer",
        "WINDOWS",
        "Processing links on volume [%ws]: old base = [%ws]; new base = [%ws]",
        "System\\CurrentControlSet\\Control\\WMI\\GlobalLogger",
        "Force-reflecting ",
        "ERROR_RECOVERY_FAILURE",
        "ERROR_DS_UNWILLING_TO_PERFORM",
        "Discover",
        "1#2:2e2",
        "System32\\spp\\tokens\\pkeyconfig\\pkeyconfig.xrm-ms",
        ".?AV?$CAutoDelete@PAVScopeSnapshotHelper@@@RAII@@",
        "4Jj(Y",
        "1/1B1Q1h1",
        ">&>2>J>P>b>r>",
        "OC::COCCbsAdapter::GetPackageByName: Failed to get String Id for package. hr = 0x%x",
        "4,5K5Z5m5",
        ";8<D<U<c<h<m<",
        "WIM\\IMAGE[*]\\WIMBOOT",
        ">(>0>8>@>H>P>\\>|>",
        "PostSysPrepBeginAvailableDiskSpace",
        ".?AV?$HTEnumerator@GHUTableKey@?$Hashtable@GH@UnBCL@@V?$DictionaryEntry@GH@3@UKeyTraits@23@$1?RetrieveEntry@23@KG?AV43@PBV?$CAtlMap@UTableKey@?$Hashtable@GH@UnBCL@@HUKeyTraits@23@V?$CElementTraits@H@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "ERROR_DS_LOOP_DETECT",
        ".PAVOutOfMemoryException@UnBCL@@",
        ".?AVFormatException@UnBCL@@",
        "6E6o6",
        "?$?S?Z?f?t?",
        "SPValidateProductKey",
        "Rollback completed successfully.",
        ":$:,:<:H:P:",
        ".?AV?$SmartPtr@VCDUImageInfo@@@UnBCL@@",
        "8.8?8Q8Z8e8m8",
        "6 6]6j6",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@@UnBCL@@",
        "Failed getting CbsPackagePropertyRemoveOnReset property",
        "> >4>H>\\>p>",
        "Rollback-Online-System started.",
        "OCs which will be enabled:",
        "D$0PQR",
        "DequeueNextChunk",
        "FindFirstVolumeW",
        "<1<><E<X<p<",
        "CUntagSourcesFolder::DoExecute: Failed to untag [%s]. Error 0x%08x",
        ".?AV?$DefaultInstanceFactory@VCGatherOCs@@@UnBCL@@",
        "3#3-3@3P3Z3g3n3u3",
        "VdsDisk::CreatePartition: Partition GUID not supported on non-GPT disk",
        "ERROR_EVT_CHANNEL_NOT_FOUND",
        "6+72787=7H7S7X7l7x7",
        ": :.:7:>:K:\\:s:y:",
        "7\"7C7J7P7U7`7j7o7",
        "SETUPPLATFORMCOMM: Error creating the progress pipe. Error: 0x%08X",
        "=-=P=",
        "u;9~0t6",
        "1*1@1T1\\1c1q1",
        "ERROR_ACCOUNT_EXPIRED",
        "SPProcessServiceEnable",
        "6-6V6m6",
        "Failed to allocate memory for CCreateRegistryData",
        "    Local name does not match",
        "PhP]8",
        "TraceSetInformation",
        "void __thiscall PathTranslator::BuildTranslationTables(void)",
        "No updates to install; leaving.",
        "T$@WP",
        "    Failed to create file",
        ".?AV?$Array@PAVCBcdSetting@@@UnBCL@@",
        "long __thiscall CApplyWIM::DoExecute(struct IExecutionContext *,void *,struct IInternalOperationsProgress *)",
        "Use Storage Reserve under low disk space",
        ".?AV?$SerializableBase@VCDisableFeature@@$0A@V?$DefaultInstanceFactory@VCDisableFeature@@@UnBCL@@@UnBCL@@",
        "5[6b6x6",
        "DeleteDirectory: Unable to delete directory [%s] GLE = 0x%x, ",
        "7 8%8",
        "void __thiscall UnBCL::_::ArrayListEnumerator<struct PartitionLayoutArgs *>::Reset(void)",
        "EditionId",
        "!t$42",
        "ERROR_DS_NO_CHAINED_EVAL",
        "SafeOS,Start",
        "                                   New filter driver Name: %s, InstanceName: %s, Altitude: %s, Frame: %u, Detached: %s",
        "http://www.w3.org/2000/xmlns/",
        "WdsCliGetImageNamespace",
        "9+9;9K9X9h9",
        "?0?8?@?T?\\?d?t?",
        "6-6@6X6j6",
        "1%121<1K1T1Z1g1m1r1",
        "CreateFileW",
        "PopulateFindDataFromFileNode",
        "Platform does not need restart since we cannot install updates.",
        ".?AVXmlNode@XmlLite@UnBCL@@",
        ".?AU?$IEnumerable@PAVCCheckpoint@OSRollbackService@@@UnBCL@@",
        "void __thiscall UnBCL::Array<struct PageFileDesc *>::InitLarva(class UnBCL::ArrayList<struct PageFileDesc *> *)",
        ";9;_;d;n;",
        "3'30393B3K3T3]3f3o3x3",
        "j\\^f9tB",
        ".PAVCXXXXXHandledException@?2??DoExecute@CMigrateBootSettings@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ".?AVCProductKey@@",
        "class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::GetBuffer(int) const",
        ".PAVCXXXXXHandledException@?CI@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        ".winmd",
        "5#565F5R5n5u5",
        ">,>>>L>p>",
        "WVhhO",
        "Could not open service key for %s",
        "Failed to convert uninstall time to FILETIME. Error: 0x%08X",
        "ERROR_SXS_DUPLICATE_CLSID",
        "1-1a1",
        "SPAPI_E_KEY_DOES_NOT_EXIST",
        "=4=B=Y=g=~=",
        "CReconstructOS::SetUpCbsLogging",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@_JPAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "JET_errLSNotSet",
        "long __thiscall CCompleteFileOps::DoExecute(struct IExecutionContext *,void *,struct IInternalOperationsProgress *)",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::IndexOf(class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *,int,int) const",
        ".?AVCSetupPlatform@@",
        "1\"242C2S2`2k2{2",
        "657F7K7U7",
        "Copying object. Flags: 0x%x",
        "Downlevel,Start",
        "ERROR_NOT_CONTAINER",
        "__thiscall UnBCL::ArrayList<class CFilterDriverInfo *>::ArrayList(const struct UnBCL::ICollection<class CFilterDriverInfo *> *)",
        "?!?4?V?",
        "WriteFile() failed or short write",
        ":G:S:j:p:",
        ".?AVlength_error@std@@",
        "DISM_{53BFAE52-B167-4E2F-A258-0A37B57FF845}",
        "Starting the AUTO_START services",
        ":6;>;K;S;`;h;",
        "Install updates",
        ">,>0>H>X>\\>`>d>l>",
        "=%=<=J=T=^=h=r=",
        "VdsVolume::AssignDriveLetter: Failed to query IID_IVdsVolumeMF interface [%s] (0x%08x)",
        "SL_E_INVALID_BINDING_BLOB",
        "2$242A2I2l2s2y2~2",
        "_9^<t",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<class UnBCL::String *,long> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *> *)",
        "=0=9=M=t=",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,int>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,int> *,class UnBCL::Array<class UnBCL::String *> *,int)",
        "5!535C5^5c5",
        "ERROR_RING2SEG_MUST_BE_MOVABLE",
        "Reset restore hardlinks error because of file redirection.",
        ".?AV?$DefaultInstanceFactory@VCVhdBootData@@@UnBCL@@",
        "ERROR_ACCESS_AUDIT_BY_POLICY",
        ".?AV?$ArrayList@PAVCGlobalPath@@@UnBCL@@",
        "516U6y6",
        "{D8513943-8127-468D-8835-A05FAD05ACD7}",
        "?0?4?L?P?h?l?",
        "90989P9t9",
        "=L=a=t=",
        "class UnBCL::ArrayList<class COperationsValidator *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class COperationsValidator *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "void __thiscall UnBCL::Array<class OSRollbackService::CCheckpoint *>::InitLarva(class UnBCL::ArrayList<class OSRollbackService::CCheckpoint *> *)",
        "=1=9=?=L=^=l=",
        "99:u:|:",
        ";9;D;U;r;",
        "DiskLayout::ApplyProperties: Unexpected partition usage %u",
        "ERROR_INSTALL_REMOTE_DISALLOWED",
        "3#3-3:3D3L3_3p3}3",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::MoveNext(void)",
        "    Failed to create intermediate directories",
        "hVdsVolume::Format",
        "pDUDownload: DUDownload failed. hr = 0x%x",
        "Writing FilterPages value: %s. to config file",
        "CRelocateOS: Failed to move path %s, we've unloaded all hives from it and will retry",
        "3!303<3T3s3",
        "<3<W<{<",
        "2$2,2<2H2P2",
        "D$pSVW3",
        "ERROR_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN",
        "4.474C4S4[4j4",
        "1.1>1N1^1n1~1",
        "WdsCliGetImagePath",
        "081x1",
        "9+929@9M9R9f9s9",
        "SmPartition::SetType",
        ":P:\\:g:u:",
        "%hs: Failed to add language pack update %s. Error: 0x%08X",
        "    Failed to write index element block",
        "Deserializing operations queue...",
        "CSetupPlatform::Initialize",
        ".?AUIDiskPlatform@@",
        "int __thiscall UnBCL::_::ArrayListEnumerator<struct DiskRange>::MoveNext(void)",
        ":3;S;v;",
        "@f9D$0v",
        "7!737=7\\7m7v7",
        "ERROR_NOT_EMPTY",
        "7$7(787<7@7X7h7l7p7t7",
        "WIMInitializeWofDriverInternal",
        "pFindAndAddFiles: Failed to add %s to appropriate folder list; Error: 0x%08X",
        "0(0K0k0",
        "t_j\\P",
        "JET_wrnColumnMoreTags",
        "586E6]6",
        ".?AUIUninstallInternal@@",
        ".?AV?$SerializableBase@VCOCValidator@@$0A@V?$DefaultInstanceFactory@VCOCValidator@@@UnBCL@@@UnBCL@@",
        "2%2+242J2W2i2q2w2",
        "6&626C6S6]6m6",
        "1*181E1W1_1e1r1",
        "8%878?8E8O8Y8r8",
        ".PAVCXXXXXTemp@?3??SPHexEncode@@YGPAVString@UnBCL@@QAEK@Z@",
        ":(:2:;:D:M:V:_:",
        "SetupPlatform.Drivers.External.ini",
        ".?AV?$CAutoRelease@PAVSmVolume@@@RAII@@",
        "=$>\\>",
        "8'898A8G8P8f8p8",
        "4'44494B4I4V4b4k4x4}4",
        "?A?S?[?a?n?",
        "The current (host) OS is not supported for FS SID replacement!",
        "JET_errTaggedNotNULL",
        ".?AV?$DefaultInstanceFactory@VCPrepareNewOSForFirstBoot@@@UnBCL@@",
        "8-848F8Q8",
        "VdsPartition::GetExtendedPartBounds: Failed to iterate over partitions (0x%08x)",
        "2$2,242<2D2L2T2\\2d2l2t2",
        "Failure while enumerating folder %s, will not touch it. Error: 0x%08X",
        "SPGetFootprintCapabilities: The requested footprint is present",
        ".?AV?$Array@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "ERROR_PAGE_FAULT_TRANSITION",
        "4)41474D4V4d4",
        "1.1<1N1p1",
        "CInfFile::Parse: Failed to detect targeted default install section in driver package %s; hr = 0x%08X",
        "ti-ET",
        "No targeted device IDs found in driver package %s, but it has a DefaultInstall section",
        "CERT_E_PATHLENCONST",
        ">%>7>>>D>I>T>_>o>x>",
        "262<2G2b2i2o2t2",
        "[WdsNativeLib] %ws",
        " !\"#$%&'()*+,-./01234KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK56789:;<=>?@ABCDEFGHIJ",
        "=0=7=S=a=y=",
        "Failed allocating old windows root path.",
        "WcpShutdown",
        "4,4>4M4]4j4u4",
        "ControlSet enumeration returned rc=%u",
        "j?Zf9T0",
        ".?AV?$SmartPtr@V?$ArrayList@PAVSysprepAction@@@UnBCL@@@UnBCL@@",
        "1A1R1\\1{1",
        "Cleanup caches in low-disk space",
        ".text$yd",
        "; ;+;6;?;H;Q;Z;h;",
        "364?4H4Y4a4n4}4",
        ".?AVCXXXXXHandledException@?BE@??QueueAddCbsPackage@CNewSystem@@IAEJHPAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@_K@UnBCL@@@UnBCL@@HW4SP_ERROR_HANDLING@SetupPlatform@@KW4OP_OPERATION_ID@@@Z@",
        "ERROR_UNABLE_TO_REMOVE_REPLACED",
        "<$<*</<:<F<Z<b<u<",
        "0 0<0C0J0U0b0v0",
        "OSRollbackService::CCheckpoint::MoveOrCopyDirectory: Directory copy failed",
        "=1>U>u>",
        "3 3&3+363@3E3Y3m3",
        "<%</<B<q<z<",
        "Crash dump file %s generated through crash capsule exists!",
        ".?AVCSysprepRespecialize@@",
        "<>=D=M=X=",
        "offline.xml",
        "6)696?6N6e6u6",
        ": ;k;",
        "ERROR_CLUSTER_INSTANCE_ID_MISMATCH",
        "?LastIndexOf@String@UnBCL@@QBEHG@Z",
        "6+7T7",
        "4$4(4,40444<4@4D4H4P4T4X4\\4`4h4l4p4t4|4",
        ".?AV?$SerializableArrayBase@PAVCAppInfo@@@_@UnBCL@@",
        ".?AV?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "SimpleException::SimpleException",
        "VWShXf",
        "8$848D8T8d8t8",
        "1'1<1A1O1p1",
        "9$9(9@9D9\\9`9x9|9",
        "Unknown partition usage %d",
        "0'0.0B0n0",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,&protected: static enum ActionType __stdcall UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,class ATL::CElementTraits<enum ActionType> > const *,struct __POSITION * const &)>::Reset(void)",
        "ERROR_IPSEC_MM_AUTH_EXISTS",
        "<7<?<F<",
        "Copying boot files CopyBootManager(%s) %s -> %s ",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform",
        "6)7E7a7h7",
        "787i7p7v7{7",
        ".PAVCXXXXXTemp@?GE@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<class UnBCL::String *,int> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *> *)",
        "GetAnswerFileContentsAsUnattend: Loaded schema information for Windows %s %s",
        "='=5=N=j=",
        "6 6-696O6W6c6i6r6",
        "Interruption requested - Prefech.",
        "< <;<F<T<b<p<~<",
        "void __thiscall UnBCL::ArrayList<class CAppInfo *>::Insert(int,class CAppInfo *)",
        "RollbackInitiatedPhase",
        "5$5(5@5D5\\5`5x5|5",
        "ActionPlatform::SetValue",
        "PWWRh",
        "pAddSafeOSDrivers: Failed to open image %u from file %s (0x%08x)",
        ">0V0]0d0k0q0",
        "5&6D6",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup\\Sysprep\\OfflineState\\%s",
        "1+1Z1",
        "void __thiscall UnBCL::ArrayList<class CInfFile *>::Insert(int,class CInfFile *)",
        ":$:-:::C:K:",
        "DriverSafeOSInstalledList",
        "Subkey:%s",
        ".?AV?$SmartPtr@U?$IEnumerator@H@UnBCL@@@UnBCL@@",
        "ReSpecialize",
        ".?AVCDeploymentProject@@",
        "0J1O1",
        ":&:::B:O:f:v:",
        "  Specific callback decision for package: %s",
        "SPAPI_E_DRIVER_STORE_ADD_FAILED",
        "Invalid disk information for WIMBoot entry path %s",
        ".?AV?$CAutoComFree@PAG@RAII@@",
        ";$;,;2;?;Q;b;t;|;",
        "base\\ntsetup\\setupplatform\\lib\\automation\\automation.cpp",
        "index out of range to ArrayList#CopyTo",
        "ERROR_PATCH_NO_SEQUENCE",
        "    Failed to remove file spec",
        "Failed to QueryDosDevice for %ws. Error: %u.",
        "CSplitWIM::DoExecute: Failed to create folder %s (0x%08x)",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCRegCreationData@@@UnBCL@@@UnBCL@@",
        "Failed to get WimMount ImagePath, 0x%x",
        "ERROR_TRANSACTION_RESPONSE_NOT_ENLISTED",
        "VdsDisk::Initialize: Failed to iterate over automatically-created partitions: 0x%08x",
        "0V0n0",
        "Error while creating the driver entry key %s. Error: 0x%08X",
        "BiExportBcdObjects failed %x",
        "VdsPartition::GetResizeBounds: Volume cannot be shrunk",
        "void __thiscall UnBCL::ArrayList<class CProfileInfo *>::AddRange(const struct UnBCL::ICollection<class CProfileInfo *> *)",
        "bad allocation",
        ".PAVCXXXXXTemp@?HD@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "Gather statistics: uninstall",
        ":$:,:4:<:D:L:T:l:t:|:",
        ":':7:C:K:U:i:v:",
        ".PAVCXXXXXHandledException@?FN@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "void __thiscall UnBCL::ArrayList<class COperation *>::set_Item(int,class COperation *)",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCBasicEnvEntry@@@UnBCL@@@UnBCL@@",
        "3(3A3I3i3",
        "CDeploymentProject::CreateVHDDeployment: Invalid disk image path %s",
        ".?AV?$SmartPtr@VSysprepAction@@@UnBCL@@",
        "GetSizeOfWinRE: Failed to open image %u to get WinRE size (0x%08x)",
        "void __thiscall UnBCL::ArrayList<class CBcdSetting *>::Insert(int,class CBcdSetting *)",
        "EqualSid",
        "int __thiscall UnBCL::_::ArrayListEnumerator<enum OP_OPERATION_ID>::MoveNext(void)",
        "545C5`5o5x5",
        ".?AV?$SmartPtr@V?$Hashtable@PAVString@UnBCL@@K@UnBCL@@@UnBCL@@",
        "D$,_^[",
        "6_6x6}6",
        "PWVhC",
        "jKjLj",
        "=4=;=A=F=Q=]=q=",
        "%d.Volume",
        "Start suspended services",
        "CheckCrashInfo: Crash detected, exiting.",
        "8%929=9D9K9W9d9x9",
        "1$1,141<1L1T1\\1d1l1t1|1",
        "SP_APPX_PACKAGE_INFO",
        "1\"2E2^2e2l2s2z2",
        "??1String@UnBCL@@UAE@XZ",
        "??0String@UnBCL@@QAE@XZ",
        "?>?X?m?u?{?",
        "RPC_S_UUID_NO_ADDRESS",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *> *,int,int)",
        ".?AV?$SmartPtr@V?$Hashtable@PAVString@UnBCL@@PAUHKEY__@@@UnBCL@@@UnBCL@@",
        "ERROR_CTX_INVALID_MODEMNAME",
        "L$$H;",
        "CreateThreadpoolTimer",
        "JET_errTransTooDeep",
        "LargestUnpartitionedSpace",
        "ZwSetBootEntryOrder",
        "6+6;6J6U6b6r6~6",
        "y Wh ",
        "Skip Boot Validator: OS partition's file system status is fine: 0x%08X.",
        "        Downloaded : %s",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::IndexOf(class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *,int,int) const",
        "SclRegCopyKeyRecursiveByHandle",
        "CERT_E_ISSUERCHAINING",
        "1D2V2^2d2q2",
        "6*666=6C6H6S6Z6n6",
        "5)5R5q5v5{5",
        "base\\ntsetup\\setupplatform\\lib\\src\\cleanup.cpp",
        "535:5@5E5P5g5{5",
        "No drivers to apply; returning.",
        "535L5S5Y5^5i5s5x5",
        "=3=<=K=f=p=z=",
        "PPPPPPPj",
        "1(1?1L1b1i1o1t1|1",
        "? ?$?(?,?0?4?8?<?@?H?L?P?T?X?\\?d?h?l?t?|?",
        "ERROR_VOLUME_MOUNTED",
        "class SysprepComponent *const *__thiscall UnBCL::ArrayList<class SysprepComponent *>::GetBuffer(int) const",
        "VdsPlatformDiskEnumerator::ReleaseObjects",
        "void __thiscall UnBCL::Array<__int64>::RemoveAt(int)",
        "<&<:<s<",
        "4 4%414E4L4`4|4",
        "v.j\\Yf9O",
        "2/272=2J2\\2y2",
        "auto __thiscall ForEachVolume::<lambda_aa0796c72c070d40a836a34c393a010b>::operator ()(struct SetupPlatform::IPartition *,SetupPlatform::PARTITION_PROPERTIES *const ) const",
        ".?AV?$SerializableBase@VCApplyWDSImage@@$0A@V?$DefaultInstanceFactory@VCApplyWDSImage@@@UnBCL@@@UnBCL@@",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CRegCreationData *>::Reset(void)",
        "7+7J7e7",
        "93:N:",
        ":%:+:8:J:c:",
        "9sduRVV",
        ":4;[;",
        "SmImageDisk::InitializeProperties: SmDisk property initialization failed (0x%08x)",
        "<%<+<?<O<Y<l<",
        "%hs: Failed to move %s to %s, error: 0x%08X",
        "syswow64\\license.rtf",
        "Redirecting BSD settings to %ws.",
        "jHh8&^",
        "Merging diagnostics data fails since not initiazed",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCGlobalPath@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "*.cab",
        "class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *__thiscall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::get_Item(class UnBCL::String *) const",
        ":/:5:B:T:p:w:}:",
        "5%575E5",
        "2 3'3X3_3x3",
        "Gather statistics (end install):",
        "ERROR_INVALID_LEVEL",
        ":%:,:8:>:D:U:",
        "%s(%d)",
        "%hs: Failed to deserialize operations queue. Error: 0x%08X",
        "9 9$9<9@9X9h9l9p9",
        "4#4E4b4i4q4v4",
        ".ppkg",
        "3&3.3c3u3{3",
        "6(6,6<6@6P6T6d6h6x6|6",
        "RtlPublishWnfStateData",
        "131S1q1",
        "<!<5<C<e<w<|<",
        "winsxs\\manifests",
        "CSetupPlatform::Initialize: Failed to create CSetupPlatformInfo instance",
        ".?AU?$ICollection@PAVCOperationInfo@@@UnBCL@@",
        "9*9?9W9^9g9l9y9",
        ".?AVCXXXXXHandledException@?M@??QueueOCReplication@CNewSystem@@UAEJW4SP_ERROR_HANDLING@SetupPlatform@@@Z@",
        "2 2)232<2S2a2{2",
        " SFVP",
        "?GetLogicalDriveNames@Environment@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@XZ",
        "484j4q4",
        ">#>>>L>f>",
        "2\"2-272G2S2X2e2t2|2",
        ".?AV?$SerializableArrayListBase@PAVCWIMBootData@@@_@UnBCL@@",
        "ERROR_DS_NAME_REFERENCE_INVALID",
        ".?AVCInternalOperationsProgress@@",
        "9,:`:k:y:",
        "2*21272<2G2R2f2n2",
        "VdsPartition::Resize: Failed to query IID_IVdsVolume interface [%s] (0x%08x)",
        "?3?W?{?",
        "Cannot set recovery phase",
        "PWVh\"",
        "9$929I9_9",
        "base\\ntsetup\\setupplatform\\lib\\src\\pagefile.cpp",
        "End of hive list",
        "QueueDataMigration called for fail-forward system %s, scope: %d",
        "%hs: GetProcAddress failed. Error: 0x%08X",
        "class CAntiVirusInfo **__thiscall UnBCL::ArrayList<class CAntiVirusInfo *>::GetBuffer(int)",
        "Mismatch",
        "VdsDisk::CreatePartition: Can't allocate partition (0x%08x)",
        ".?AVCXXXXXHandledException@?M@??SPDeleteOldUpgradeSnapshots@@YGJPAVString@UnBCL@@PAUITelemetry@@PBGHPAPAV23@PAU_FILETIME@@PA_J@Z@",
        "ERROR_BAD_DESCRIPTOR_FORMAT",
        "0,030;0@0L0_0i0}0",
        "int __thiscall UnBCL::ArrayList<class COperationInfo *>::IndexOf(class COperationInfo *,int,int) const",
        "ERROR_PROFILE_NOT_ASSOCIATED_WITH_DEVICE",
        "161D1N1X1b1l1",
        "?GetCurrentDir@Directory@UnBCL@@SGPAVString@2@XZ",
        "void __stdcall UnBCL::_::HTEnumerator<unsigned long,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,unsigned long,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,&protected: static unsigned long __stdcall UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsDisk *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<unsigned long,struct IVdsDisk *> *,class UnBCL::Array<unsigned long> *,int)",
        "class CDriverInstallInfo *__thiscall UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::get_Item(class UnBCL::String *) const",
        "CSetupPlatformPrivate::Rollback",
        ">4>Z>x>",
        "t0SSS",
        "7 70787\\7p7",
        ";$<T<",
        "Cannot get the disk/offset for the OS partition. Error: 0x%08X",
        "0\"060?0g0p0y0",
        "?1?J?c?t?",
        "5&5<5e5m5",
        "UPGFilterRollbackActive",
        "FirstBootPostSysprepEndTime",
        "ERROR_CLUSTER_MAX_NODES_IN_CLUSTER",
        "1(1>1c1u1{132b2l2",
        "6#6b6m6z6",
        "0.050;0@0K0W0\\0p0",
        ".?AVCXXXXXHandledException@?9??SPWriteMigrationScope@@YGJPBG0W4SP_MIG_SCOPE@SetupPlatform@@@Z@",
        "6N6`6h6n6{6",
        "j&j:j",
        ".?AVCBcdSetting@@",
        ".PAVCXXXXXHandledException@?BF@??DoExecute@CRemoveFODPackage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "2<2\\2b2k2s2",
        "%hs: Apply operation failed. Error: 0x%08X",
        "int __thiscall UnBCL::ArrayList<class SysprepAction *>::BinarySearch(int,int,class SysprepAction *,struct UnBCL::IComparer<class SysprepAction *> *)",
        "4!4'4,474E4Y4a4z4",
        "DISPLAYNAME",
        ".?AV?$SmartPtr@V?$ArrayList@G@UnBCL@@@UnBCL@@",
        "9!9,929A9L9R9a9l9r9",
        "_wcsupr",
        "NtQueryObject",
        ":':\\:p:",
        "void __thiscall UnBCL::ArrayList<class CInfFile *>::CopyTo(class UnBCL::Array<class CInfFile *> *,int) const",
        "checkpointSequence",
        "8)8I8P8[8i8",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::LastIndexOf(class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *,int,int) const",
        "PWSh6",
        "?-?6???H?_?m?v?",
        "505:5F5m5r5~5",
        "CMediaLayout::QueueInstallImage",
        "XSet safe OS boot command",
        "xSPGetPartitionOrdinal",
        "3K4W4\\4",
        "__thiscall CElementEnumerator::CElementEnumerator(class UnBCL::String *,class UnBCL::Array<class UnBCL::String *> *)",
        ".?AVCCreateRegistryForNewSystem@@",
        "ERROR_UNKNOWN_PATCH",
        "=+=n=",
        ".?AV?$HTDictEnumBase@V?$DictionaryEntry@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@UnBCL@@@_@UnBCL@@",
        ".?AV?$SerializableBase@VCGlobalPath@@$0A@V?$DefaultInstanceFactory@VCGlobalPath@@@UnBCL@@@UnBCL@@",
        "?*?5?F?X?",
        ".?AVCXXXXXHandledException@?2??DoExecute@CUpdateBootSector@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ":2:>:E:K:P:\\:g:{:",
        "84888P8`8d8h8|8",
        "CNewSystem::QueueSetupAutomation: Failed to get ICB (0x%08x)",
        ".?AVCXXXXXHandledException@?LG@??Rollback@CSetupPlatformOSSwitchCheckpoint@@UAEXPBG@Z@",
        "CRYPT_E_UNKNOWN_ALGO",
        "%hs: Failed to decode safe OS hash, cannot add it: 0x%08x",
        "Microsoft\\Windows\\CurrentVersion\\Setup\\State",
        "0<0a0",
        "SmVolume::GetProperties: Failed to initalize properties (0x%08x)",
        "{EB3505B5-C051-4192-A495-7A6447CDF004}",
        ".?AVCTelemetry@@",
        "Final list of source OS pieces:",
        "CFG Validator: Failed to revert execution of data gather operation. Error: 0x%08X",
        "Failed reading uninstallwindow from CSP: Error:0x%x, PolicySet:%d, reading registry",
        ".?AV?$SerializableBase@VCGatherData@@$0A@V?$DefaultInstanceFactory@VCGatherData@@@UnBCL@@@UnBCL@@",
        ":$:*:9:H:h:x:",
        "= =&=+=6=A=\\=k=p=~=",
        "1#171L1o1w1",
        "D$XSVW",
        "< <$<0<4<8<<<@<D<H<L<P<T<X<\\<`<d<h<l<p<t<x<",
        "class UnBCL::DictionaryEntry<unsigned short,int> __thiscall UnBCL::_::HTEnumerator<unsigned short,int,struct UnBCL::Hashtable<unsigned short,int>::TableKey,class UnBCL::DictionaryEntry<unsigned short,int>,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<unsigned short,int> __stdcall UnBCL::Hashtable<unsigned short,int>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned short,int>::TableKey,int,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "6*6K6S6`6z6",
        "3$383?3I3V3[3d3r3y3",
        "4$4:4X4j4r4",
        "Cleaning up %s",
        "QSjah",
        "8k8r8",
        "7#7.737d7",
        ":@:Z:",
        "6$6,626?6N6",
        "    Failed to read node type",
        "%hs: Host volume: %s",
        ":.:5:<:B:N:b:p:~:",
        "<O<n<",
        "CTrustSafeOS::DoExecute: Failed to add safe OS hash to BitLocker store: 0x%08x",
        "3&3.333C3N3X3l3}3",
        "SSSSSSS",
        ".?AVCXXXXXHandledException@?2??FindWimImageOnWDSServer@@YGJPAVString@UnBCL@@0000PAPAV23@1PAI@Z@",
        "5#6*60656@6G6[6q6x6~6",
        ">8>L>Y>e>q>}>",
        "lL7Ki\"0",
        "%s#%d failed with 0x%x.",
        "ERROR_DS_BUILD_HIERARCHY_TABLE_FAILED",
        "NtQueryDriverEntryOrder",
        "9)93989O9V9\\9a9l9w9|9",
        "7(7J7W7^7e7p7z7",
        "Current result: Unknown",
        "-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------",
        "<J=v=",
        "?+?C?N?\\?j?x?",
        "DiskLayout::ExecDeletions",
        "ERROR_CANT_TERMINATE_SELF",
        ".?AV?$ArrayList@_J@UnBCL@@",
        "  Crash module name: %s",
        "1(10161J1U1]1c1p1}1",
        "7&757=7G7N7T7Y7d7s7",
        "UpdateBackupBootCode: Couldn't get handle to device [%s]. GLE is [0x%X]",
        "CSetupPlatformPrivate::FindScratchDirectory",
        "%d updates were found",
        "yrhlH",
        "?-?=?K?X?d?",
        "Xuninstall.xml",
        "CreateSolidBrush",
        ":0f0t0",
        "Comparing OC status...",
        "8Y8l8|8",
        "1#1v1}1",
        "CSh0{",
        "SL_E_WINDOWS_INVALID_LICENSE_STATE",
        "0:0s0",
        "0 0>0Z0j0}0",
        "WIMReadImageFile",
        "%SystemRoot%\\Panther\\SafeOS-km.etl",
        "7/7@7F7K7Z7k7x7",
        "9$909<9H9T9`9l9x9",
        "Failed copying DerivedData keys",
        "UPGVhdPath",
        "ERROR_CONTINUE",
        "\\packages",
        ">0>4>L>P>h>l>",
        "3?3D3P3s3x3",
        "Skip Boot Validator: %s -> %s",
        ".?AVCXXXXXHandledException@?8??ExecuteCurrentOperations@CDeploymentBase@@QAE?AW4SYSTEM_STATE@SetupPlatform@@HPAUIOperationsProgress@4@@Z@",
        "SVh ~",
        "CurrentVersion",
        ">)>7>@>I>R>h>v>",
        "SOFTWARE",
        "%USERPROFILE%",
        "1)171H1u1|1",
        "Tracing: Autologger/user mode provider read from onesetting: %s",
        "1?1M1f1u1",
        "1#2\\2w2",
        "9 9$9(9,9094989<9@9H9L9P9T9\\9`9d9h9l9p9t9x9|9",
        "jVYf9L0",
        "= =4===N=a=h=n=s=~=",
        ".?AV?$CAutoRelease@PAVWmiAssociation@WMI@@@RAII@@",
        "Select",
        "__thiscall UnBCL::ArrayList<class CRegCreationData *>::ArrayList(const struct UnBCL::ICollection<class CRegCreationData *> *)",
        "5(5:5Z5l5t5z5",
        "CBS_E_INVALID_WINDOWS_UPDATE_COUNT_WSUS",
        "595D5R5`5n5|5",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCShellFolderInfo@@@UnBCL@@@UnBCL@@",
        "{1EBBB733-A77F-43BD-97C5-73F23A158915}",
        "MultiByteToWideChar",
        "QSjoh",
        "pLogInvalidWrite",
        "8/9D9j9",
        "<(=`=",
        "ERROR_NTLM_BLOCKED",
        "QSjTjsjd",
        "int __thiscall UnBCL::Array<unsigned long>::Add(unsigned long)",
        "7F7W7c7o7{7",
        "void __stdcall UnBCL::_::HTEnumerator<unsigned long,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,&protected: static struct IVdsDisk * __stdcall UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsDisk *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<unsigned long,struct IVdsDisk *> *,class UnBCL::Array<struct IVdsDisk *> *,int)",
        "=(=,=4=8=L=\\=`=d=|=",
        "CRelocateOS: Moving previous OS piece from %s to %s",
        "ValidateInput: ChunkSize is specified in Kilobytes and shouldn't be less than SectorSize",
        "%hs: Key value set",
        "ERROR_NOT_READY",
        "XCSetupPlatformInfo::StreamRead",
        "int __thiscall UnBCL::_::ArrayListEnumerator<struct PartitionLayoutArgs *>::MoveNext(void)",
        "w2t,-L",
        "SSQj2P",
        "5 5$5(50585<5@5D5L5P5T5X5\\5`5d5h5l5p5t5x5|5",
        "Control\\Windows",
        ".PAVCXXXXXTemp@?BEF@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "ERROR_UNEXPECTED_MM_CREATE_ERR",
        "D$,t S",
        "ActionPlatform::LaunchModule: Failed to allocate memory for DLL entry point",
        "?:?A?F?L?R?X?^?d?j?p?v?|?",
        "030N0Y0x0",
        ";%;V;];",
        "JET_errOutOfSessions",
        "ERROR_SXS_PROTECTION_RECOVERY_FAILED",
        "VERBOSE: MOVETRACK: %s does not exist, last error: 0x%08X",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *> *)",
        "RtlInitAnsiString",
        "ActionPlatform::LaunchModule: WideCharToMultiByte failed while converting %s; dwRet = 0x%x",
        "738L8Q8",
        ";!;&;U;t;z;",
        "PWVhc",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCOptionalComponent@OC@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCOptionalComponent@OC@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        ":$:2:\\:l:s:y:~:",
        "<%<-<3<@<R<`<y<",
        "pGetBootStatSummaryString",
        "CMediaLayout::QueueProvisioningPackages: Failed to queue splitting the ICB: 0x%08x",
        "CImageInfoSet::AddToImageInfoSet: Reference paths not supported for WDS installation.",
        "EndPaint",
        "WIMLoadImageInternal",
        "class CUserProfile *const *__thiscall UnBCL::ArrayList<class CUserProfile *>::GetBuffer(int) const",
        "Failed to restore the WIMBoot partition. Error: 0x%08X",
        "9\"9(9-989C9H9\\9",
        "?=?I?T?^?n?w?",
        "404L4h4",
        "ERROR_IPSEC_IKE_ENCRYPT",
        "Element::EnumerateMetadata",
        "__thiscall OC::COCDismAdapter::COCDismAdapter(class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::String *)",
        "CBS_E_SESSION_FINALIZED",
        "Source directory [%s] does not have newer files; will skip it",
        ">%>[>",
        "?\"?3?9???E?K?Q?X?_?f?m?t?{?",
        "2 2(2,24282@2D2L2P2X2\\2d2h2p2t2|2",
        ";-;:;C;T;r;",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCGlobalPath@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCGlobalPath@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "pDeterminePageFileRequirements: Final page file size: %llu",
        ";-;:;G;S;Z;j;};",
        "ERROR_SXS_RELEASE_ACTIVATION_CONTEXT",
        "Cannot apply the security template for the new OS. Error: 0x%08X",
        ">H>v>",
        ">&>6>>>H>P>W>",
        "2(30363H3P3b3",
        "8i8p8v8{8",
        ".SPDiagTrackSetInfoInPreSysprep",
        "ERROR_SXS_LEAF_MANIFEST_DEPENDENCY_NOT_INSTALLED",
        "5 535i5v5",
        "JET_errForceDetachNotAllowed",
        ".?AVCXXXXXHandledException@?EF@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "CInstallDUUpdatesOffline::FindOperation: Unexpected operation ID %d",
        "SPFindSnapshotProp: GetSnapshotProperties failed. Error: 0x%08X",
        "y3h8&",
        "class CDriverInfo *const *__thiscall UnBCL::ArrayList<class CDriverInfo *>::GetBuffer(int) const",
        ";&;A;X;`;~;",
        ">:>Z>q>",
        "8)9;9C9I9V9h9",
        "<2<T<\\<c<i<n<y<",
        "..\\rollback\\setupapi\\setupapi.dev.log",
        ">9>V>`>j>",
        "Failed to get NT path for %ws. Status: %x",
        "CMigrateFramework::DoExecute: Cannot convert new OS Dir %s to NT path. Error: 0x%08X",
        ";3;B;L;Q;Y;`;l;~;",
        "5$515@5Y5o5",
        "PWSht",
        "System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}",
        "9~(s+j",
        "='=>=P=x=",
        "CReconstructOS::RestageWindows: Failed to open DISM session for target image %s: 0x%08x",
        "ERROR_INVALID_VERIFY_SWITCH",
        ".?AV?$DefaultInstanceFactory@VCApplyDataOffline@@@UnBCL@@",
        "long __stdcall pAddNewOSDynamicUpdateOperations(const DU::ImageInfo *,unsigned long,const unsigned short *,int,int,const unsigned short *,int,const unsigned short *,const unsigned short *,const unsigned short *,int,class COperationQueue *,class CBaseInternalProgress *)",
        "SPAPI_E_NO_BACKUP",
        "ERROR_PARTIAL_COPY",
        "%wPtG",
        "Failed to copy memtest object. Status = [%x]",
        "OC::COCCbsAdapter::InitOnline: CbsSession initiating finished sucesssfully.",
        "SetupPlatform: Phase \"WinPE\" started. System drive letter: %c, temporary translated to: %c. Rollback is %s%s%s",
        "3<3D3L3`3h3p3",
        "_wtof",
        "void __thiscall UnBCL::Array<class CWIMBootData *>::RemoveAt(int)",
        "DiskLayout::VerifyPlanNoOverlap",
        "Vj<RQ",
        "Gather Optional Component status",
        "ERROR_TOO_MANY_bczED",
        "PPPPPPP",
        "W0^0k0r0",
        "6(616G6k6",
        "Failed to restore the start type for service. Error: 0x%08X",
        ".?AV?$ArrayListEnumerator@PAVISPPluginData@@@_@UnBCL@@",
        "VS_VERSION_INFO",
        "0T0{0",
        "ERROR_IPSEC_IKE_FAILQUERYSSP",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *> *)",
        "ConnectNamedPipe",
        "pCreateSystemRootDriveMapping: SystemRoot implicit mapping is [%s] -> [%s]",
        "?P?i?t?",
        "596@6F6K6V6a6u6",
        "IddCx",
        "2.3v3",
        "ERROR_BAD_DEVICE",
        "?Equals@?$Array@E@UnBCL@@UBEHPBVObject@2@@Z",
        "Wjuj#",
        "=*=>=R=[=",
        "uz-Cyrl-UZ",
        "3$363D3\\3a3x3",
        "6#6/6A6c6",
        "9H8t)",
        "class CRegCreationData **__thiscall UnBCL::ArrayList<class CRegCreationData *>::GetBuffer(int)",
        "DiskLayout::VerifyLayoutNewIfInitializing: Partition %u modifies existing partition %u, but existing partition %u will be deleted when the disk is initialized",
        "?'?.?4?9?D?O?V?[?o?t?",
        "4+4J4y4",
        "void __thiscall UnBCL::ArrayList<class CFileCreationData *>::QuickSort(class UnBCL::ArrayList<class CFileCreationData *> *,class UnBCL::ArrayList<class CFileCreationData *> *,int,int)",
        "XCallPidGenX",
        ">B?a?",
        "RestoreEncryptedFile",
        "%hs: BCD failed to remove the uninstall entry references for %s. Error: 0x%08X",
        "SL_E_VL_NOT_ENOUGH_COUNT",
        "ERROR_EFS_SERVER_NOT_TRUSTED",
        "0T0a0y0",
        "%hs: Error calling WinReGetConfig. Error: 0x%08X",
        "5'5D5K5Q5V5a5k5~5",
        "PWVhk",
        "4 4*404>4k4q4|4",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::RemoveAt(int)",
        "Failed to retrieve element device. Status: %x",
        ".?AV?$SerializableBase@VCEnableSerialDebugging@@$0A@V?$DefaultInstanceFactory@VCEnableSerialDebugging@@@UnBCL@@@UnBCL@@",
        "PagingFiles",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "SPQueryReserveInfo: Failed to get Reserve Info. hr = 0x%08X",
        "SWh0u",
        "Copying boot debugging files from %ws to %ws (%ws)",
        "3(4X4",
        "ERROR_DS_NO_OBJECT_MOVE_IN_SCHEMA_NC",
        "0-0A0I0",
        "?Copy@String@UnBCL@@SGPAV12@PBV12@@Z",
        "t(j|_j\\",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCOperation@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<unsigned short *>::Resize(int,int)",
        ";#;3;E;\\;",
        "Failed to control trace: 0x%x",
        "class CSetupClRequest *__stdcall UnBCL::Try_Cast<classCSetupClRequest*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "2 232@2M2m2u2",
        "SPEstimateSizeOfWIMBootRecompress: declared size: %I64d, estimated on disk: %I64d, expected for recompress: %I64d",
        "8/8;8A8U8h8",
        "5a5|5",
        "<%<3<g<s<~<",
        "9*92989=9B9U9k9",
        "?,?4?=?C?U?l?t?|?",
        "    Failed to copy key string",
        "void __thiscall UnBCL::_::HTEnumerator<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class CWIMBootHelper::CWIMEntryIndex *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,&protected: static class CWIMBootHelper::CWIMEntryIndex * __stdcall UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::DictionaryEntry<void *,void *> *> > const *,struct __POSITION * const &)>::Reset(void)",
        ">#>s>",
        "CExceptionHandler::HandleException",
        "ActionQueue.dll",
        ":4:S:w:",
        "CProcessDrivers::ReadFileInTable",
        ".?AVCFirstBootApplyFromICB@@",
        "4A4F4V4c4u4",
        "SYSTEM",
        "y2WhE",
        "<2<<<C<I<N<Y<d<x<",
        "393A3L3T3\\3s3z3",
        ">'>=>V>b>j>w>",
        "ProcessDirectory",
        "LogVdsStatus: Failed to open SCM to log VDS status: 0x%08x",
        "SL_E_VL_KEY_MANAGEMENT_SERVICE_NOT_ACTIVATED",
        "void __thiscall UnBCL::ArrayList<class CProfileInfo *>::QuickSort(class UnBCL::ArrayList<class CProfileInfo *> *,class UnBCL::ArrayList<class CProfileInfo *> *,int,int)",
        "ERROR_FILE_VERSION_DIRECTORY_NOT_FOUND",
        "8 8$8<8@8X8\\8t8",
        "int __thiscall UnBCL::Array<struct DISK_SPACE_IMPACT>::Add(struct DISK_SPACE_IMPACT)",
        "void __thiscall UnBCL::_::ArrayListEnumerator<struct SetupPlatform::IPartition *>::Reset(void)",
        "SetupType",
        "YY_[^",
        "ha-Latn",
        "SL_E_PRODUCT_SKU_NOT_INSTALLED",
        "1G1k1",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCOperationResult@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCOperationResult@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "7o7x7",
        "%hs: New recovery image not installed; skipping this because ReAgent.dll is not supported.",
        "=1>`>",
        "  %s: %08x:%08x",
        "0+070I0g0s0",
        "ERROR_CLUSTER_JOIN_IN_PROGRESS",
        "CRemoveOSUninstall::DoExecute",
        "ERROR_DS_FILTER_UNKNOWN",
        "\\Windows\\WinSxS\\",
        "KX+Kh",
        "Insufficient space to download and install updates",
        "SetCheckpoint: %s",
        "838Y8`8f8k8v8",
        "void __thiscall UnBCL::ArrayList<struct PartitionLayoutArgs *>::RemoveAt(int)",
        "Apply WIM file %s%s, index %d to %s",
        "0\"0M0",
        "SPDeleteOldUpgradeSnapshots: Cannot open snapshot key, assume not exist. Error: 0x%08x",
        "%hs: Cannot set environment variable %s=%s. Exception: %s",
        "_unlock",
        "<\"<-<8<=<Q<f<t<",
        "JET_wrnNyi",
        "%hs: Failed to create target file %s (hash value: %s). Error: 0x%08X",
        "    Failed to assemble search path string (asterisk)",
        "VdsPartition::SetActive: Failed to query IID_IVdsAdvancedDisk interface [%s] (0x%08x)",
        "int __stdcall UnBCL::MP::ThrowCompare<class DiskLayout *>::Compare(class DiskLayout *,class DiskLayout *)",
        "ERROR_CALLBACK_SUPPLIED_INVALID_DATA",
        "525R5p5",
        ".PAVCXXXXXTemp@?CGE@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "GetLastError",
        "base\\ntsetup\\setupplatform\\lib\\src\\appx.cpp",
        ")<no-message>",
        "303;3L3`3g3m3r3",
        "x$(runtime.system32)\\Sysprep\\ActionFiles\\%s.xml",
        "CSaveConfigData::DoExecute",
        "; ;2;G;P;Y;e;n;z;",
        ".PAVCXXXXXHandledException@?M@??UnpackTo@CDUPackage@@UAEJPBG@Z@",
        "%windir%\\panther\\actionqueue",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *> *)",
        "unsigned long *__thiscall UnBCL::ArrayList<unsigned long>::GetBuffer(int)",
        "0+0B0]0v0",
        "ERROR_SXS_SETTING_NOT_REGISTERED",
        ";%;/;8;G;U;Z;u;",
        "3=3W3a3h3",
        ">T?a?",
        "SrcWimFile",
        ";T$4|",
        "%hs: Failed to read the default GUID from file: %s. Error: 0x%08X",
        "UninstallMark",
        "CDeviceIdDatabase::Initialize",
        "%s:%s",
        "OFFLINE PROFILES: Offline profile creation turned off by environment variable",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@@UnBCL@@",
        "unsigned long __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,&protected: static unsigned long __stdcall UnBCL::Hashtable<class UnBCL::String *,unsigned long>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,class ATL::CElementTraits<unsigned long> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "void __thiscall UnBCL::ArrayList<struct SetupPlatform::IDisk *>::RemoveAt(int)",
        "2(2M2p2",
        "ERROR_BROKEN_PIPE",
        "7=7E7N7S7Y7i7q7z7",
        ";\";6;K;R;Y;d;q;w;",
        "ERROR_LONGJUMP",
        "<)<6<B<O<X<d<y<",
        "ResiliencySettingName",
        "DiskLayout::ApplyProperties: Failed to set MBR partition type: 0x%08x",
        "Adding driver package %s to safe OS %s",
        "<0<i<",
        ":;;k;|;",
        "3&3L3T3n3",
        ".?AV?$SerializableBase@VCVhdBootData@@$0A@V?$DefaultInstanceFactory@VCVhdBootData@@@UnBCL@@@UnBCL@@",
        "ERROR_CTX_WINSTATION_NOT_FOUND",
        "OC::CDownlevelOCStore::IsDetectable: Duplicate Manifest Identity exists %s.",
        "<0<4<L<P<h<l<",
        "SPDeleteAllSnapshots",
        "8'81898?8D8X8f8t8}8",
        "eCNewSystem::QueueAddAppxPackage",
        ".?AVCXXXXXHandledException@?2??DoExecute@CAddSetupClRequest@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "CSuspendBitlocker::StoreBitLockerStatus: Failed to get source inf enumerator; this is unexpected. Error: 0x%08X",
        "CSetupPlatformOnline::DoListenForProgress",
        "CSDVersion",
        "OOBE boot apply from ICB is using replacement manifests in %s",
        "3$3-373b3l3",
        "SmPartition::InitializeProperties: Couldn't allocate partition properties (0x%08x)",
        "CBS_E_SOURCE_MISSING",
        "NGEN cleanup: Removing folder %s",
        "    Failed to get next element",
        ">+>3>",
        "sysarm32",
        "ERROR_INVALID_FLAGS",
        ">H>|>",
        "97vhS",
        "%d,%I64u,%I64u",
        "233C3",
        ">'>6>;>G>S>b>g>s>",
        ";\";);/;4;@;J;];x;",
        "Failed allocating exisitng package list path.",
        "6)636=6G6U6[6a6f6p6z6",
        "3 303",
        "8%858E8Q8]8d8s8}8",
        "%hs: ExecuteCurrentOperations failed. Result: %d, Error: 0x%08X",
        "ERROR_DS_DRA_PREEMPTED",
        "CSysprepRespecialize::DoExecute: Failed to delete Respecialize registry value. Error: 0x%08X",
        ".?AV?$SmartPtr@U?$ICollection@K@UnBCL@@@UnBCL@@",
        "Failed to determine whether the system partition is in a space. Last Error = %#x",
        "No process found using %s file.",
        "Get unexpected storage reserve poilcy, ignore reserve",
        "pAddSafeOSDriversFromProvPackage: Failed to open provisioning package index %i, path %s (0x%08x)",
        "6 666A6Q6[6m6u6{6",
        ";9;E;W;",
        "advapi32",
        "??0?$IEnumerable@E@UnBCL@@QAE@XZ",
        "2 2$2(2,24282<2@2D2H2L2P2T2\\2d2h2l2p2t2|2",
        "==>D>a>h>",
        "<,<<<L<\\<l<|<",
        "=3=M=Y=e=u=}=",
        "ERROR_CLUSTER_NETWORK_NOT_INTERNAL",
        "VWhh`",
        "8(898@8N8f8m8t8{8",
        "CCompressedStoreHeaderWriterT<class CEmptyType>::CreateInstance",
        "VdsPartition::SetUsage: Couldn't change partition type (0x%08x)",
        "2+232>2Q2z2",
        "=)=3=F=V=",
        ">;>I>R>[>p>y>",
        "BiBuildIdentifierList failed %x",
        "CRYPT_E_ASN1_EXTENDED",
        "1,141:1G1Y1j1|1",
        "=D>o>",
        "?%?9?H?W?a?m?y?",
        "int __stdcall UnBCL::MP::ThrowCompare<struct DiskRange>::Compare(struct DiskRange,struct DiskRange)",
        "IsDriverSet",
        ":\":*:0:=:O:]:j:|:",
        "FOLDERID_SkyDrivePictures",
        "<%s>%s</%s>",
        "JET_errInvalidPath",
        "void __thiscall UnBCL::ArrayList<class CDUPackage *>::AddRange(const struct UnBCL::ICollection<class CDUPackage *> *)",
        "int __thiscall UnBCL::ArrayList<class DiskLayout *>::BinarySearch(int,int,class DiskLayout *,struct UnBCL::IComparer<class DiskLayout *> *)",
        "CorporationHelpCustomization",
        "CSetupAutomation::SuspendAndRelease: Couldn't get disk/partition for path %s: 0x%08x",
        "{6AA591AA-6969-4B16-9C58-123253536521}",
        "%hs: Malformed line found in %s, section %s. Line: %s",
        "struct SetupPlatform::IDisk **__thiscall UnBCL::ArrayList<struct SetupPlatform::IDisk *>::GetBuffer(int)",
        "4%43494?4D4N4X4b4l4z4",
        "8C8S8",
        "void __thiscall UnBCL::ArrayList<unsigned long>::Insert(int,unsigned long)",
        "Found driver store entry %s",
        ":#:*:1:7:C:U:c:q:",
        "int __thiscall UnBCL::ArrayList<unsigned int>::IndexOf(unsigned int,int,int) const",
        "7=7Q7X7l7",
        "SnapshotCreationTime",
        ".?AV?$DefaultInstanceFactory@VCBasicEnv@Mig@@@UnBCL@@",
        "8V8o8x8",
        "void __thiscall UnBCL::ArrayList<__int64>::AddRange(const struct UnBCL::ICollection<__int64> *)",
        ".?AVCUninstallHardLinkPolicy@@",
        "%hs: Adding OS piece: Name: %s, Original path: %s, Current path: %s (%sallow relocation)",
        ".?AVCDeploymentBase@@",
        "registryActions",
        "ERROR_IPSEC_IKE_SRVQUERYCRED",
        ">O>r>",
        "5-595A5H5T5d5o5",
        "__thiscall CICBStore::CICBStore(class UnBCL::String *,class UnBCL::String *,int)",
        "iu-Latn-CA",
        "OC detected: %s",
        "121K1`1h1n1{1",
        "void __thiscall UnBCL::Array<class CProfileInfo *>::Remove(class CProfileInfo *)",
        "VdsVolumePathEnumerator::Initialize",
        "3'3-3:3L3_3s3",
        ".PAVCXXXXXTemp@?7??SuspendAndRelease@CDeploymentBase@@QAEJPBG@Z@",
        "Starting service %s",
        "__thiscall CSPDiscoverProgress::CSPDiscoverProgress(struct ISPMigProgress *,unsigned long,unsigned long)",
        "5^5p5x5~5",
        " with error %8x",
        "L$,_^[3",
        ";K;[;k;{;",
        "? ?,?1?:?A?N?Z?c?o?t?}?",
        ":/:6:<:A:L:W:k:x:",
        "909?9I9y9",
        "7$7,747<7D7L7T7\\7d7l7t7|7",
        "SetupDisplayedEula",
        "j\\Yf9H",
        "CWriterHelperT<class CEmptyType>::SerializePlatformIds",
        "\\System Volume Information\\FVE2.{e40ad34d-dae9-4bc7-95bd-b16218c10f72}.X",
        "5'5-525W5]5f5q5",
        "1K1Z1",
        "int __thiscall UnBCL::Array<class CUserProfile *>::Add(class CUserProfile *)",
        "void __thiscall UnBCL::ArrayList<class OC::COptionalComponent *>::QuickSort(class UnBCL::ArrayList<class OC::COptionalComponent *> *,class UnBCL::ArrayList<class OC::COptionalComponent *> *,int,int)",
        "<*<C<m<s<~<",
        "SysprepSession::ExecuteAction: Start service with parameters:                    pstrServiceName:%s",
        "WINDOWS.OLD\\WINDOWS\\System32\\config",
        "JET_errDatabaseLogSetMismatch",
        "4(4>4_4f4l4q4|4",
        "WimBootSystem",
        "?&?0?:?H?i?p?w?",
        "9'969D9L9Q9^9p9",
        "?9?E?P?^?",
        "The current log location and new log location is same, no need to move",
        "=)>p>",
        "Corrupt line in the %s section. Line: %s",
        "5!585P5f5~5",
        "SPCopyFilesAndFolders: Failed to move file %s -> %s. hr = 0x%08X",
        "Failed to test whether this device is connected standby. Error: 0x%08X",
        "1)171I1l1",
        ":$:>:N:S:_:y:",
        "?get_TotalSeconds@TimeSpan@UnBCL@@QBENXZ",
        "ERROR_DS_COULDNT_LOCK_TREE_FOR_DELETE",
        "(%lx): Failed to process registry key!",
        "?TrimStart@String@UnBCL@@QBEPAV12@PBG@Z",
        "CMigrateFramework: Offline gather failed. Status: %d",
        ":W;e;y;",
        "\\$ Wj",
        "SPCopyFilesAndFolders: Failed to create target parent directory %s. hr = 0x%x",
        "<&=0=I=Z=o={=",
        ">M>\\>f>",
        "Committing WIM changes",
        "TotalDiskSpace",
        "SPGetDefaultOSGuid",
        "0'0Y0",
        "7(868P8|8",
        "_wcsicmp",
        "SPApplyDeviceLayoutDiskConfig: Device layout XML file %s does not exist",
        "<$=7=K=P=U=a=q=",
        "7@7M7",
        "Qj_SQW",
        "%hs: Cannot open subkey %s. Error: 0x%08X",
        "QQWPS3",
        "ERROR_CANCELLED",
        "ERROR_SXS_CORRUPTION",
        "%SystemDrive%\\ProgramData",
        "<?xmquot",
        "3;4B4H4M4X4b4v4~4",
        "Failed to set element associated resume object. Status = [%x]",
        "StartType",
        "<$<-<D<W<n<x<",
        "7 7+767;7O7[7b7v7~7",
        ".?AVCXXXXXHandledException@?2??DoExecute@CSetDefaultBootEntry@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "CSetupPlatformPrivate::ValidateUninstall",
        "747D7L7\\7t7|7",
        ".PAVCXXXXXTemp@?3??pAddSafeOSDrivers@@YGJPBGPAVCSetupAutomation@@000PAXPAUIGenericProgress@SetupPlatform@@@Z@",
        "=#=9=O=h=~=",
        "CreatedSnapshotsAllocatedSpace",
        "2 2,252>2W2}2",
        "base\\ntsetup\\setupplatform\\lib\\diskconfig\\diskconfigmisc.cpp",
        "MIG_CMI_SKIP_COMPONENTS",
        "ERROR_NO_MATCH",
        "j XPj",
        "ERROR_HOOK_TYPE_NOT_ALLOWED",
        ".?AV?$CAutoCleanupBase@PAVVdsImageDisk@@@RAII@@",
        "Debugger type = %d",
        ";!;';,;;;T;`;h;w;",
        "<not available>",
        ">&>0>5>@>K>P>d>~>",
        "!D$X3",
        "=/=S=s=",
        "<4<S<c<",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,&protected: static struct UnBCL::ISerializable * __stdcall UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,class ATL::CElementTraits<struct UnBCL::ISerializable *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "9A:u:|:",
        "ERROR_MAGAZINE_NOT_PRESENT",
        "%hs: Unknown element in OS pieces relocation. Expected USERS but found %s",
        "void __thiscall Mig::CBasicEnv::Add(const class UnBCL::String *,const class UnBCL::String *)",
        "u@hPn",
        "S0^0y0~0",
        "int __thiscall UnBCL::ArrayList<struct SetupPlatform::IPartition *>::BinarySearch(int,int,struct SetupPlatform::IPartition *,struct UnBCL::IComparer<struct SetupPlatform::IPartition *> *)",
        "CCFGValidator::ValidatePostExecution",
        "EndInstall",
        "9$999R9g9}9",
        "CSetupPlatformPrivate::Execute: Failed to save source drive letter. Error: 0x%08X",
        "ERROR_SEM_USER_LIMIT",
        "4\"404",
        "CInstallDUUpdatesOffline::DoExecute: Failed to remove DU folder %s after successful installation of updates",
        "=!=*=/=:=E=K=P=d=l=",
        ";pLtd3",
        "There are %d Setup updates to be installed by the client to directory %s",
        "8,858>8T8l8s8y8",
        "LoadStringW",
        "CFG Validator: Execution of data gather operation completed.",
        "Failed to copy string. Error: 0x%08X",
        "LSSSS",
        "attempt to StreamRead on non-larval Array instance",
        "6/6=6L6Z6l6",
        ";4<?<I<`<o<y<",
        "{AD4011DE-2C17-4FFA-9609-499B950DAA6C}",
        "SclpGptInitZeroedPartitionGuids",
        "1 1$1(1,10181@1H1L1T1X1\\1`1d1l1p1t1x1|1",
        "686L6T6\\6d6l6x6",
        "404U4]4i4q4{4",
        "6&6-63686C6\\6p6z6",
        "4 4*404=4S4}4",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@",
        "RegOpenKeyW",
        "%hs: Failed to read the source OS version. Error: 0x%08X",
        "0 0H0p0",
        "3\"3B3N3f3z3",
        ".?AV?$SerializableBase@VCApplyDrivers@@$0A@V?$DefaultInstanceFactory@VCApplyDrivers@@@UnBCL@@@UnBCL@@",
        "626h6|6",
        "=`=u={=",
        "%hs: Failure while calculating offline mappings",
        "SL_E_OUT_OF_TOLERANCE",
        ">9?N?S?q?",
        "?!?*???]?v?",
        "3H3a3h3o3u3",
        "SWVh@",
        "8@9n9",
        "class UnBCL::String *__thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,unsigned long>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,class ATL::CElementTraits<unsigned long> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "ERROR_CS_ENCRYPTION_FILE_NOT_CSE",
        "CRelocateOS: Cannot move path %s out of the way of the new OS. Error: 0x%08X",
        "CSetupPlatformOSSwitchCheckpoint::Rollback: Path \"%s\" cannot be removed, could be moved out of the way later. Error: 0x%08X",
        "8(848@8L8X8d8p8|8",
        "j:Zf9V",
        "848Q8e8",
        "ActionPlatform::SetValue: Invalid registry key path %s passed",
        "=4=h=|=",
        "FixReparsePointPath: Ignoring reparse point with tag [0x%X].",
        "161P1o1",
        "373W3",
        "Apply (first boot apply, offline phase): Migration phase failed. Result: %d, specific error: 0x%08X",
        "DUShutdown",
        ";\";*;0;=;O;Y;l;t;z;",
        "~(;~ r",
        ":W:^:",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCFilterDriverInfo@@@UnBCL@@@UnBCL@@",
        "33383A3L3V3g3p3}3",
        "00c0j0p0u0",
        ".?AU?$IList@PAVISPPluginData@@@UnBCL@@",
        "unsigned long __stdcall GetBytesPerSector(unsigned short)",
        "uM9xXu",
        "4\"404m4",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@W4ActionType@@UTableKey@?$Hashtable@PAVString@UnBCL@@W4ActionType@@@2@V?$DictionaryEntry@PAVString@UnBCL@@W4ActionType@@@2@UKeyTraits@52@$1?RetrieveEntry@52@KG?AV62@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@W4ActionType@@@UnBCL@@W4ActionType@@UKeyTraits@23@V?$CElementTraits@W4ActionType@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        ">!>*>?>H>j>q>z>",
        "=H>Z>b>h>u>",
        "ff-Latn",
        "Failed to read rollback or safe OS entry GUIDs from %s. hr = 0x%X",
        "In UEFI environment and couldn't find firmware boot disk; will try finding the non-removable disk",
        "ERROR_NO_UNICODE_TRANSLATION",
        ".PAVCXXXXXTemp@?EO@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "3 3(3-3=3H3Z3f3l3",
        "8%838A8O8",
        "6G8N8",
        "%hs: disable backup privilege",
        "3+323I3P3Z3a3",
        "5&5-53585C5M5`5i5v5",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::Insert(int,class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *)",
        "uD9pXu",
        "4.4i4",
        "SetupPlatform: Phase \"OOBEBoot\" started",
        ".PAVCXXXXXTemp@?3??DoExecute@CCloseLogFiles@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "4%4*454?4D4X4s4",
        "=$=,=4=@=d=l=t=|=",
        "ERROR_LOGON_TYPE_NOT_GRANTED",
        "4!4)4;4E4L4R4W4c4q4y4",
        "4&414A4H4N4S4^4e4j4",
        "=$=6=D=~=",
        "??0Version@UnBCL@@QAE@HHH@Z",
        "0!040T0a0x0",
        ".?AVCXXXXXHandledException@?KF@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "?:\\BOOTSECT.BAK",
        "0+0H0[0e0n0",
        "CSetupAutomation::CacheInstallImage: Incomplete WIM metadata specified",
        "%hs: Adding OS piece: Original path: %s, Current path: %s (do not allow relocation)",
        ".?AV?$SmartPtr@V?$ArrayList@PAX@UnBCL@@@UnBCL@@",
        "4,4<4V4d4k4q4v4",
        "2'242G2Q2V2c2n2x2",
        ":$:,:4:<:H:l:t:|:",
        "%hs: Unexpected OS volume format: %s. Error: 0x%08X",
        "BitLocker.On",
        "1N1m1",
        "\\Device\\Harddisk%u\\Partition%u",
        "DUDownloadFailedHR",
        ".PAVCXXXXXTemp@?BN@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        ":$:1:E:Q:",
        "4-4>4E4S4]4b4v4",
        ">$?+?D?K?d?k?z?",
        "%hs: Instantiating an ICbsSession9 interface",
        "1(141;1A1F1Q1]1q1",
        "1-141:1?1J1U1i1",
        "struct DiskRange &__thiscall UnBCL::ArrayList<struct DiskRange>::get_Item(int)",
        ".?AU?$IEnumerator@PAVCOSPieceInfo@@@UnBCL@@",
        "%hs: Pagefile: %s , Pagefilesize: %d",
        ";#;.;<;h;r;",
        ":\":,:5:?:H:R:^:w:",
        "j]Zf;",
        "9+909C9Y9}9",
        ".Online",
        "?'?.?4?9?D?K?_?w?",
        "xSystem\\Setup\\DiagTrack",
        "?#?5?B?I?_?f?",
        "CMediaLayout::QueueDirectoryCopy: Failed to add operation [%s]: 0x%08x",
        "Failed to create a new data partition. Error: 0x%08X",
        "VWh@V",
        "3(4<4D4L4T4\\4h4",
        "Add driver",
        "Merge original trace log [%s] to [%s]",
        "7$727;7D7[7h7r7|7",
        "%hs: Starting uninstall validation process",
        "4&4,4:4n4z4",
        "JET_errTooManyIO",
        "t$<h ",
        "ywVh(",
        "2&2/2;2J2S2d2m2~2",
        "2$242D2T2d2t2",
        "kDiskLayout::VerifyPlanDiskBoundaries",
        "ERROR_HIBERNATION_FAILURE",
        "4%4K4g4",
        ".PAVCXXXXXTemp@?3??DoExecute@CSaveBootEntriesOldOS@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "CApplyDrivers::CopyToDriverStore: Failed to get string from GUID. Error: 0x%08X",
        ".?AVCSplitWIM@@",
        "?$?4?D?T?d?t?",
        ".?AV?$ArrayList@UPartitionInfo@?1??SPGetPartitionOrdinal@@YGJPAUIPartition@SetupPlatform@@PAK@Z@@UnBCL@@",
        "Failed to allocate new string",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@KUTableKey@?$Hashtable@PAVString@UnBCL@@K@2@KUKeyTraits@42@$1?RetrieveValue@42@KGKPBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@K@UnBCL@@KUKeyTraits@23@V?$CElementTraits@K@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "{4D36E96F-E325-11CE-BFC1-08002BE10318}",
        "pCheckCanSetPartUsage",
        "9,9F9j9q9",
        "4\"464B4I4O4T4_4i4|4",
        "6!646L6Y6e6l6r6w6",
        "D$XAF",
        "?!?)?/?<?N?\\?",
        "Failed to determine source OS version.",
        "536:6K6R6",
        ".?AVCXXXXXHandledException@?JG@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        ".?AV?$DefaultInstanceFactory@VCOperationQueue@@@UnBCL@@",
        ";/;E;x;",
        ".?AV?$SmartPtr@V?$Hashtable@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@@UnBCL@@",
        "9$949D9T9d9t9",
        ".?AVCXXXXXHandledException@?EL@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "232K2R2Y2`2g2n2t2",
        "0 0(0.0;0M0s0",
        "class CGlobalPath *__stdcall SPGetGlobalPathFromConfigValue(class UnBCL::String *)",
        "OC::COCCbsAdapter::CbsUpdateToOC",
        "ERROR_DLL_MIGHT_BE_INSECURE",
        ":4;h;",
        "CorrelationVectorOriginal",
        "<!<*<2<<<C<I<N<Y<h<m<",
        "?$?,?4?<?L?T?\\?d?l?t?|?",
        "7(7<7K7\\7p7|7",
        "ERROR_SXS_PROTECTION_PUBLIC_KEY_TOO_SHORT",
        "  Deciding dynamic update download on update:",
        "3\"3.3B3Z3h3",
        "onecore\\base\\telemetry\\permission\\product\\telemetrypermission.cpp",
        "CSetupAutomation::ResolveTarget: Will choose a suitable partition automatically",
        "ERROR_CLUSTER_PARTIAL_READ",
        "ERROR_PRINT_PROCESSOR_ALREADY_INSTALLED",
        "FLOWTRACK(NEO): Failing installation due to scenario constraint (%d). NEO installation path is turned off.",
        "j\\Yf9LC",
        "{66B170CD-FC6C-402D-88D8-55F501952056}",
        "pRegisterRemovedDriver",
        "VhH0c",
        "DEFAULT",
        "SEH: Exit CExceptionHandler::CExceptionHandler",
        "No OCs need to be enabled or disabled",
        "Install recovery image",
        "CSetupAutomation::ResolveTarget: The host firmware type is %s (%u)",
        "Unmounting WIM file %s from %s",
        ".?AV?$ArrayList@PAV?$CAutoRelease@PAUIDUUpdateCollection@DU@@@Mig@@@UnBCL@@",
        ".?AV?$DefaultInstanceFactory@VCRemoveOSUninstall@@@UnBCL@@",
        "SclExpandString",
        ".?AVRegValueEnumAction@@",
        "5(656T6i6r6}6",
        "RPC_X_PIPE_EMPTY",
        "OptInLevel",
        "Failed to copy partition device string. Error: %d",
        "=&=;=^=h=m=",
        ">8?`?",
        "%hs: Failed to set BCDE_OSLOADER_TYPE_NX_POLICY field. Status = %d",
        ".?AVCXXXXXHandledException@?2??DoExecute@CRefreshLocalizedString@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "1 1X1_1",
        "2\"2;2D2",
        ".?AVCXXXXXHandledException@?FD@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "1$1,1<1H1P1x1",
        "6K7g7",
        ">'>1>H>V>`>j>t>~>",
        "5&5>5Y5c5t5",
        "< <<<T<`<h<|<",
        "CurrentBuild",
        ":0:I:P:W:]:i:}:",
        "RollbackBeginTime",
        ".?AV?$DefaultInstanceFactory@VCProvisioningMigration@@@UnBCL@@",
        "2J2b2",
        "SmDisk::InitializeProperties: Couldn't allocate disk properties (0x%08x)",
        "4#4-4@4G4M4R4]4h4|4",
        "No Antivirus software was found.",
        "101B1\\1c1i1n1y1",
        "System Volume Information",
        ")CDeploymentBase::UpdateDiskSpaceNeeded",
        "32373A3o3z3",
        "NtAddDriverEntry",
        "CCompressedPayloadWriterT<class CEmptyType>::Initialize",
        "DriveLetters",
        "NtSetInformationThread",
        "jmYf9L0",
        "3(4P4",
        "class CImageInfo *const *__thiscall UnBCL::ArrayList<class CImageInfo *>::GetBuffer(int) const",
        "7%727:7a7s7y7",
        "?'?1?C?K?Q?[?e?|?",
        "4 444F4N4X4_4f4q4|4",
        "XAvailableFreeSpace",
        "ZwQueryVolumeInformationFile",
        "Failed opening source configuration",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::GetBuffer(int) const",
        ":B:[:b:i:p:w:~:",
        ";!;);6;>;q;",
        "JET_errInvalidCreateIndex",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCOperationInfo@@@UnBCL@@@UnBCL@@",
        "%s\\Panther\\%s",
        "QQj`j",
        ":!:':,:7:>:R:{:",
        "Failed to enumerate objects. Status: %x",
        "SPDeleteOldUpgradeSnapshots: Failed to initialize COM. Error: 0x%08X",
        "808F8j8",
        "5<5|5",
        "ERROR_DS_NO_CROSSREF_FOR_NC",
        "5\"5I5^5",
        "JET_errGivenLogFileIsNotContiguous",
        "Microsoft\\Windows\\CurrentVersion\\RunOnce",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CGlobalPath *>::Reset(void)",
        "1#1,131@1L1U1b1g1p1w1",
        "j\\Yf9",
        ";$;,;4;<;D;L;T;\\;h;",
        "ERROR_CHILD_WINDOW_MENU",
        "fZf^fYf[fSfQfVfRf",
        ".?AU?$ICollection@PAVCShellFolderInfo@@@UnBCL@@",
        "?!?-?N?",
        "    Failed to re-add metadata file",
        ":2:9:@:F:R:d:r:",
        "989@9H9X9`9|9",
        "Driver removed successfully",
        "2#2*2/2Q2h2",
        "Registering recovery image with folder %s, image index %d, boot GUID: %s",
        "PreOOBEDone",
        "Failed to unmount WIM image. Error: 0x%08X",
        "YYW9]",
        "989S9[9q9",
        "5\"5.575C5H5Q5\\5i5v5",
        "B(PVVR",
        "2!2-2O2T2Y2e2",
        "Reflecting ",
        "Finalize Safe OS boot removal",
        "3,3<3@3P3T3\\3t3",
        "Failed Install permanent packages.",
        "='=p=",
        "ERROR_LICENSE_QUOTA_EXCEEDED",
        "96:W:v:",
        "SSQj2VP",
        "jzYf;",
        "{A69353C3-A55C-441F-AA7D-DC90D4B6C0B3}",
        "ERROR_DS_SCHEMA_UPDATE_DISALLOWED",
        "D$HSP",
        ":N:[:b:",
        "?IndexOf@String@UnBCL@@QBEHPBG@Z",
        "OC in %s does not have detect info so it's considered undetected.",
        "?*?1?A?s?",
        "9\"9+949K9Y9j9s9|9",
        ".?AV?$CAutoDelete@PAV?$ArrayList@UDiskRange@@@UnBCL@@@RAII@@",
        "DiskLayout::ParseCustomMbrType",
        "Failed to get architecture of %s. Error: 0x%08X",
        "ERROR_ADVANCED_INSTALLER_FAILED",
        ".?AVCSetSafeOSBootCommand@@",
        "ParseChunkRegionInternal",
        ".PAVCXXXXXTemp@?BH@??pSPDoOfflineApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0H0PAUISPMigProgress@@@Z@",
        "<#<0<V<",
        "Refreshing SCM with new start type %u",
        "y#Wjth",
        "Failed open key %ws. Status: %x",
        "int __thiscall UnBCL::ArrayList<__int64>::BinarySearch(int,int,__int64,struct UnBCL::IComparer<__int64> *)",
        "3+383B3S3`3i3v3",
        ".PAVCXXXXXHandledException@?5??Finalize@CDeploymentBase@@QAE?AW4SYSTEM_STATE@SetupPlatform@@PAUIOperationsProgress@4@H@Z@",
        "=0=:=R=t=",
        "SPAPI_E_NO_DRIVER_SELECTED",
        "NtQuerySecurityPolicy",
        "%hs: Cannot get mounted image handle for %s. Error 0x%08X",
        ".?AV?$HTEnumerator@KPAUIVdsDisk@@UTableKey@?$Hashtable@KPAUIVdsDisk@@@UnBCL@@PAU1@UKeyTraits@34@$1?RetrieveValue@34@KGPAU1@PBV?$CAtlMap@UTableKey@?$Hashtable@KPAUIVdsDisk@@@UnBCL@@PAUIVdsDisk@@UKeyTraits@23@V?$CElementTraits@PAUIVdsDisk@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "%s\\%s",
        "int __thiscall UnBCL::Array<enum OP_EXECUTION_PHASE>::Add(enum OP_EXECUTION_PHASE)",
        "\\\\?\\UNC\\",
        "6'6L6U6{6",
        ".?AV?$KeyCollection@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@_@UnBCL@@",
        "D$(;x",
        "void __thiscall UnBCL::ArrayList<class COSPieceInfo *>::Insert(int,class COSPieceInfo *)",
        "Failed to set bootmgr display order. Status = [%x]",
        ".?AU?$IEnumerator@PAVCOperationsValidator@@@UnBCL@@",
        ":4;E;",
        "    Failed to set wim reference file",
        "BitLocker turned On after upgrade",
        "int __thiscall UnBCL::ArrayList<class CAntiVirusInfo *>::IndexOf(class CAntiVirusInfo *,int,int) const",
        "7*787L7k7",
        "ERROR_STATIC_INIT",
        "=->7>@>I>S>\\>f>o>y>",
        "\\UNC\\",
        "708[8`8",
        "SPEnableGlobalLoggerSession",
        "void __thiscall UnBCL::ArrayList<class ISPPluginData *>::Insert(int,class ISPPluginData *)",
        "3$323R3m3s3}3",
        "?$?1?C?K?Q?^?p?~?",
        "_set_errno",
        "SPGenerateCopyListFromConfigFile: Failed to add file %s",
        "OC::COCCbsAdapter::InitOnline",
        "00070=0B0M0[0o0",
        "DiagTrack.dll.mui",
        ".?AV?$SerializableArrayBase@PAVCWIMBootData@@@_@UnBCL@@",
        "?get_Item@XmlNodeList@XmlLite@UnBCL@@QAEPAVXmlNode@23@H@Z",
        "0&020>0G0Q0Z0d0m0w0",
        "=#=4=<=F=N=T=k=r=",
        "4&5@5G5U5_5r5",
        "=E=M=V=[=a=v=",
        "WTSGetActiveConsoleSessionId",
        "Unable to get procedure CreateNewOfflineStore",
        "ERROR_IPSEC_IKE_PROCESS_ERR_TRANS",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long>,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> __stdcall UnBCL::Hashtable<class UnBCL::String *,unsigned long>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,class ATL::CElementTraits<unsigned long> > const *,struct __POSITION * const &)>::Reset(void)",
        "Marking event [&SclEvent_ExecuteRequest_Start]",
        "1%1=1x1",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::LastIndexOf(class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *,int,int) const",
        "/WIM/IMAGE[@INDEX=\"%d\"]",
        ".?AV?$SerializableBase@VCOrchestrateOSSwitch@@$0A@V?$DefaultInstanceFactory@VCOrchestrateOSSwitch@@@UnBCL@@@UnBCL@@",
        "UblIsUSBDiskInternal",
        "class CFileCreationData **__thiscall UnBCL::ArrayList<class CFileCreationData *>::GetBuffer(int)",
        "%hs: Cannot queue product key. Error: 0x%08X",
        "> >H>`>m>v>",
        ":H:x:",
        "Simple cleanup: Failed to completely remove requested folders. Error: 0x%08X",
        "6/6D6W6",
        "2$2+21262A2N2^2g2p2",
        "{4D36E96A-E325-11CE-BFC1-08002BE10318}",
        "!This program cannot be run in DOS mode.",
        "void __thiscall UnBCL::Array<class DiskLayout *>::RemoveAt(int)",
        "DiskLayout::VerifyLayoutNewIfInitializing",
        "; ;$;<;@;X;\\;t;x;",
        "8'8>8O8f8",
        "6$6(6,60686<6@6D6H6L6P6T6X6`6d6h6l6t6x6|6",
        "ku-Arab-IQ",
        "1W22383",
        "< <%<1<<<F<V<_<f<|<",
        ">'>1>6>N>d>u>",
        "Failed adding package identity to FOD array",
        "Y_^[]",
        "LogicalSectorSize",
        "C<+C(",
        "ERROR_RANGE_LIST_CONFLICT",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAPAUISerializable@1@@Z",
        ".?AU?$IEnumerator@UDiskMatchFilter@@@UnBCL@@",
        "ERROR_BAD_PATHNAME",
        "Backup path   : %s",
        "7-7^7|7",
        "__thiscall UnBCL::ArrayList<class CCFGSectionValue *>::ArrayList(const struct UnBCL::ICollection<class CCFGSectionValue *> *)",
        "9*909;9I9u9",
        "ERROR_BAD_THREADID_ADDR",
        "9)9]9|9",
        "0\"1?1F1L1Q1\\1g1{1",
        "5)565M5Y5i5n5z5",
        "pFinalizeUninstall: FinalizeUninstall succeeded",
        "Failed to write background color in file: %s. Error: 0x%08X",
        "ChkDskRun",
        "QQQQW",
        "6*6E6s6",
        "<.<G<_<r<",
        "1h2o2~2",
        "4H5O5",
        ".?AV?$SmartPtr@VCInternalGenericProgress@@@UnBCL@@",
        "OpenProcessToken",
        "31383>3G3R3^3j3v3",
        "SystemRoot",
        "3T3`3x3",
        "DeletePathEngine: Hit %d failure%s during recursive deletion of [%s]; 1st error = 0x%x, cd = [%s]",
        "Framework apply",
        "File [%s] is older than [%s]",
        "1.1S1}1",
        "SPAPI_E_PNP_REGISTRY_ERROR",
        "CNewSystem::QueueSetupAutomation: Failed to queue EULA acceptance (0x%08X)",
        "1 1,1G1U1[1m1~1",
        "Get object which is not snapshot",
        "?*?8?",
        "COperationQueue OPERATIONTRACK: Remove Operation: %3d|%s",
        "?#?3?A?J?X?k?",
        ": :&:+:7:I:O:c:y:",
        "!000B0W0",
        "6;6M6U6[6h6z6",
        "t$Dh0n",
        "LoadIntegrityInfo",
        "NtQuerySymbolicLinkObject",
        "??2Object@UnBCL@@SGPAXI@Z",
        "1)151i1",
        "j+j:j",
        "class DiskLayout *__thiscall UnBCL::_::ArrayListEnumerator<class DiskLayout *>::get_Current(void) const",
        "Uninstall gather completed successfully",
        "949}9",
        "Source directory [%s] has newer files; will copy it",
        "3$3(3,3034383<3@3D3L3T3X3\\3d3|3",
        "oc-FR",
        "SPProcessBitlockerOnDrives: Bitlocker was already suspended. Taking no action.",
        "1$1(1,10181<1@1D1L1P1T1X1`1d1h1l1t1",
        "VdsVolume::GetProperties: Failed to determine whether volume hosts a Windows install (0x%08x",
        "Failed to query object. Status: %x",
        "QWVSh",
        "%s does not exist",
        "uNj03",
        "8 8$8,84888@8H8P8T8X8`8h8l8p8x8|8",
        "CReconstructOS::SaveTelemetryFields: Failed to open Diagnostics key: 0x%08x",
        "<)=@=R=Z=`=i=",
        "ERROR_DS_CANT_RETRIEVE_SD",
        "void __thiscall UnBCL::ArrayList<class OC::COptionalComponent *>::set_Item(int,class OC::COptionalComponent *)",
        "CNewSystem::StreamRead",
        "? ?$?,?0?8?<?@?D?H?L?P?T?X?\\?`?d?h?l?p?t?x?|?",
        ";(;4;<;T;l;",
        "Profiles have been added on the new system",
        "2/292C2I2V2u2",
        "6/666<6A6L6W6k6y6",
        ".?AV?$HTDictEnumBase@V?$DictionaryEntry@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@@_@UnBCL@@",
        "3 3,3D3X3",
        "DismPostSysprep",
        ".?AV?$DefaultInstanceFactory@VCOOBEBootApply@@@UnBCL@@",
        "Required update unpack capability is not present",
        "VdsPlatformDiskEnumerator::Initialize: Failed to query the desired VDS providers 0x%x (0x%08x)",
        "ERROR_DS_INSTALL_SCHEMA_MISMATCH",
        "949Y9",
        "void __thiscall UnBCL::_::HTEnumerator<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *> __stdcall UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::DictionaryEntry<void *,void *> *> > const *,struct __POSITION * const &)>::Reset(void)",
        "6(646@6",
        "<1<O<V<\\<a<l<{<",
        "7\"787B7Z7",
        "7H7_7",
        "Control\\Class\\{4D36E966-E325-11CE-BFC1-08002BE10318}",
        "JET_errCannotDeleteSystemTable",
        "2&2F2i2o2",
        ";><r<y<",
        "CImageInfoSet::CreateFromWDSServer",
        "?*?:?A?\\?t?",
        "4)565T5`5r5",
        "5<5N5U5^5k5w5",
        "fQfPf",
        "9.9s9",
        "f92u9A",
        ".?AVCDUDownloadProgressWrapper@@",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$Array@E@2@@UnBCL@@@UnBCL@@@UnBCL@@",
        ";$;=;];w;",
        ">*>Y>f>}>",
        "%hs: Failed to convert new OS GUID. Error: 0x%08X",
        "pSPOpenOnlineSystemHive",
        "1-141:1?1J1Q1V1j1{1",
        ".?AVCXXXXXHandledException@?CAH@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ".backup",
        "PQQQS",
        ">5>W>_>m>t>z>",
        "5/565<5A5L5S5g5y5",
        "=a=n=",
        "Tag [%s] for Storage Reserve",
        "{9E295126-3D7A-4BCC-86A4-4DC7F5C68FD0}",
        "3*323:3@3E3W3g3",
        ":8:P:",
        "4'4-464L4h4v4",
        "2$2+21262A2N2W2]2q2",
        ";(;/;=;O;`;g;};",
        "4&4C4O4X4j4q4{4",
        "5%5+585J5c5",
        "5+555<5B5G5S5a5i5{5",
        "UnmapViewOfFile",
        ";&;/;8;A;J;S;\\;e;n;w;",
        "7@7Q7p7w7",
        "SafeOSTime",
        "8#8G8k8}8",
        "OC::OCSaveStatusOnline",
        "4#4*40454@4L4n4",
        "0'0K0]0e0k0x0",
        "de-CH",
        "Failed creating target component hive path name %ls\\SYSTEM",
        "sr-Latn",
        "Failed to create destination WIMBoot directory %s",
        "WinReSetupMigrateData",
        "C(R;F(tLR",
        "5\"51585A5T5\\5c5h5",
        ";$;-;C;Y;k;s;y;",
        "3 3(30383@3D3H3L3T3X3\\3`3d3h3l3p3t3x3|3",
        "ERROR_IPSEC_IKE_PROCESS_ERR_PROP",
        ";6<;<@<L<m<r<w<",
        "struct DiskLayout::Partition *__thiscall UnBCL::ArrayList<struct DiskLayout::Partition>::GetBuffer(int)",
        "2#252K2i2p2v2{2",
        "CheckCrashInfo: %d page files found: ",
        "PWShn",
        "40484@4H4P4X4d4",
        "030?0H0]0h0r0",
        "6)707C7z7",
        "2$20282T2\\2d2l2t2",
        ">%>8>=>B>h>s>",
        "CBS_E_SOURCE_MISSING_FROM_WUSUS_EXPRESS",
        ".?AV?$SmartPtr@VXmlDocument@XmlLite@UnBCL@@@UnBCL@@",
        "class SysprepAction **__thiscall UnBCL::ArrayList<class SysprepAction *>::GetBuffer(int)",
        "8\"8Q8c8p8z8",
        "=)=8=D=M=Z=d=q=",
        "161W1t1",
        "Failed to close recovery store. Status = [%x]",
        "OpenProcess",
        "7$8\\8",
        "7,707H7L7d7h7",
        "[ybVhl",
        "ERROR_DS_CANT_FIND_DSA_OBJ",
        ".PAVCXXXXXTemp@?9??SPCreateSnapshotWithScoping@@YGJPAVString@UnBCL@@_JPAV?$ArrayList@PAVString@UnBCL@@@3@PAPAV23@@Z@",
        "; ;&;3;E;X;j;r;x;",
        "?+?2?8?=?E?P?d?",
        "4 4Q4X4",
        "8*848;8A8F8Q8d8|8",
        "5(5<5H5Y5m5y5",
        "4\"4.4:4Q4^4k4w4",
        ">,>`>t>|>",
        ":(:[:p:",
        "tn-BW",
        ">8>X>x>",
        "5#525<5A5I5P5\\5n5",
        "CSIDL_COMMON_PICTURES",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *> *,int,int)",
        "Failure while requesting driver payload copy. Error: 0x%08X",
        "%hs: Failed to set the boot app %s. hr = 0x%08X",
        "CSetProductKey::DoExecute",
        "Apply image",
        "ConcatenateStrings failed: 1 - %ls 2 - %.*ws",
        "8]9n9",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,struct UnBCL::ISerializable *>,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,struct UnBCL::ISerializable *> __stdcall UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,class ATL::CElementTraits<struct UnBCL::ISerializable *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "ERROR_LOG_HARD_ERROR",
        "2-252;2H2Z2v2",
        ";^(~e",
        "int __thiscall UnBCL::ArrayList<class CBcdSetting *>::LastIndexOf(class CBcdSetting *,int,int) const",
        ";!;4;D;Y;|;",
        "<3<o<v<|<",
        "1G2 6(6-636B6S6`6r6z6",
        "WIMCreateFile",
        "2$2,2<2L2T2\\2d2l2t2",
        "RollbackFailureCode",
        "VdsPartition::SetType: Couldn't parse type GUID: 0x%08x",
        "<1<I<f<",
        "ERROR_DC_NOT_FOUND",
        "4%4/4<4B4I4S4`4g4q4",
        "?.?I?",
        "6!666c6|6",
        "RespecializeInOOBEBoot",
        "sw-KE",
        ".?AVCInternalDownloadProgress@@",
        ";(;1;6;X;_;e;j;u;",
        "8)858i8",
        "D$ +D$",
        "7S7`7",
        ".?AVCXXXXXHandledException@?2??LogVdsStatus@@YGXXZ@",
        ".?AU?$ICollection@V?$DictionaryEntry@GH@UnBCL@@@UnBCL@@",
        "JET_errGivenLogFileHasBadSignature",
        "606;6I6Y6",
        "Failed to open key for all objects. Status: %x",
        "VdsPlatform::Initialize: Creating VDS loader instance",
        ".PAVSimpleException@@",
        "3*383d3t3",
        "<\"<,<5<?<U<c<l<u<~<",
        "PWVhY",
        "5,53595>5I5Z5b5l5t5z5",
        "5:5R5",
        "SP_DU_INFO",
        "8\"8(8-888C8W8m8t8z8",
        "7'7?7e7l7",
        "9B9N9W9`9",
        "BootFilesRestoreCheckpoint: Failed to restore BCD database.",
        "%WinDir%",
        " /startasync",
        "SmPlatform::ComputeHostInfo: Can't find host OS partition; no disk will be marked as the host",
        "ERROR_DS_MASTERDSA_REQUIRED",
        ";4;\\;k;u;",
        "class CBasicEnvEntry *const &__thiscall UnBCL::ArrayList<class CBasicEnvEntry *>::get_Item(int) const",
        "Install but only in the store.",
        "ERROR_DS_LDAP_SEND_QUEUE_FULL",
        "ERROR_CTX_WINSTATION_NAME_INVALID",
        "5\"505N5d5u5",
        ")RelocatedNames",
        "SPGetCurrentOSGuid",
        "class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::GetBuffer(int) const",
        "%hs: Data size: %d",
        "ERROR_PROCESS_IN_JOB",
        "class CGlobalPath *const *__thiscall UnBCL::ArrayList<class CGlobalPath *>::GetBuffer(int) const",
        "ERROR_LOG_NOT_ENOUGH_CONTAINERS",
        ".?AU?$IEnumerable@PAUISerializable@UnBCL@@@UnBCL@@",
        ";\";3;9;Y;`;",
        "SVh4>",
        ".?AVCCFGSectionValue@@",
        "Failed to remove wimboot entry.",
        "CDeploymentProject::Initialize: Failed to initialize empty automation: 0x%08x",
        "6$616C6S6n6s6",
        "<$<<<T<l<",
        "BcdCopyObjectEx: Failed to get object identifier. Flags: 0x%x Status: %x",
        "4B4g4",
        "1$1,181X1`1h1t1",
        "UninstallGUID",
        "%u.%u.%s",
        "void __thiscall UnBCL::ArrayList<enum OP_OPERATION_ID>::Resize(int,int)",
        "7'717:7C7L7U7^7w7",
        "FIOFileOpenById",
        ":I:s:",
        "7/767<7A7L7W7q7",
        ":/:E:V:k:s:y:",
        ".?AV?$Array@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVCGlobalPath@@@UnBCL@@@UnBCL@@",
        "A8;B8",
        "<'<3<E<c<",
        "pDeleteWimBackedFilesAndWimBootEntries",
        "ERROR_CTX_PD_NOT_FOUND",
        "WIMCopyFileEx failed",
        "sRecovery\\WindowsRE",
        ":#:+:C:I:[:k:t:",
        ">+>B>P>W>]>b>m>x>",
        "SPClearSoftReserve: Clear Soft Reserve",
        "ERROR_OVERRIDE_NOCHANGES",
        "8$8=8g8|8",
        "Found information about the new WinRE partition: %s",
        ".PAVInvalidOperationException@UnBCL@@",
        "void __thiscall UnBCL::Array<class COSPieceInfo *>::InitLarva(class UnBCL::ArrayList<class COSPieceInfo *> *)",
        "CRYPT_E_SELF_SIGNED",
        "XExecute.PreSysprep",
        "Cannot migrate framework without setting the correct drive letter first",
        "JET_errLogFileSizeMismatch",
        "Incorrect filesize. Could be corrupted",
        "%hs: Failed to enable setup auto logger %s. Error: 0x%08X",
        "int __thiscall UnBCL::Array<class CAntiVirusInfo *>::Add(class CAntiVirusInfo *)",
        "2'292R2b2j2~2",
        ";*;B;[;b;h;m;x;",
        "NtAdjustPrivilegesToken",
        "=<=H=h=p=|=",
        "(%lx): Unable to get file system attributes.",
        "%c:\\Windows",
        "Set reg key value FirstBootTime failed: 0x%x",
        "202H2",
        "<@=y=",
        "CSetupAutomation::Clone",
        "SysprepSession::ExecuteAction: stopService ignoreFailureToStopDependentService invalid.",
        ".?AU?$IList@UDiskMatchFilter@@@UnBCL@@",
        ":#:1:I:m:",
        ":E;R;j;",
        "r~akow",
        "Gathering all device ids...",
        "0!0'0,070C0W0l0",
        "Element::OpenElement",
        "VdsPartition::BringOnline",
        "0\"010",
        "Source0",
        "4-4?4P4W4m4",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@_JPAVCGlobalPath@@@UnBCL@@@_@UnBCL@@",
        "4;4F4T4b4p4~4",
        ">4>;>C>H>S>`>q>",
        "ERROR_DS_DRA_RPC_CANCELLED",
        "3&484@4F4S4b4s4",
        "ERROR_EMPTY",
        ".PAVCXXXXXTemp@?BBJ@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ".PAVCXXXXXHandledException@?P@??Rollback@CSetupPlatformApplyRollbackCheckpoint@@UAEXPBG@Z@",
        ">&>.>?>X>h>q>{>",
        "=3===G=M=Z=c=k=x=",
        "=0=N=Z=l=",
        "Set reg key value SecondBootTime failed: 0x%x",
        "%hs: Number of entries: %d.",
        "CSetupPlatformPrivate::Execute: Failed to query snapshot size for [%]. Error: 0x%08X",
        "ZwQueryBootOptions",
        "ERROR_SXS_ACTIVATION_CONTEXT_DISABLED",
        "ARP Validator: Failed to revert execution of data gather operation. Error: %08X",
        "=(=8=H=X=h=x=",
        ".PAVCXXXXXTemp@?3??SPReportSnapshotState@@YGXPAVString@UnBCL@@PAUHKEY__@@PAUITelemetry@@@Z@",
        "373t3",
        ":):1:=:u:",
        ":&:5:F:Z:f:w:",
        "SP_MIGRATION_INFO",
        "CDownloadDUUpdates::FilterUpdates: IWindowsDriverUpdate::get_DriverManufacturer failed. hr = 0x%x",
        ".?AU?$ICollection@U_GUID@@@UnBCL@@",
        "Windows\\System32\\config\\SYSTEM",
        "1E1o1",
        "848T8x8",
        "VdsPlatformDiskEnumerator::GetNext: Failed to query packs (0x%08x)",
        "=#=1=Y=k={=",
        ".?AVCPartitionInfo@@",
        "9$9?9E9R9d9",
        "MIG_UPGRADE_STORE_PATH",
        ".?AVCXXXXXHandledException@?BA@??SPProcessServiceEnable@@YGXPBG@Z@",
        "Failed opening source WPA",
        "void __thiscall UnBCL::_::ArrayListEnumerator<struct DiskRange>::Reset(void)",
        "%hs: Cannot find source image info",
        "REG_NONE",
        "??1InvalidCastException@UnBCL@@UAE@XZ",
        "CAbstractDisk::GetDiskPartitionNumber",
        "D$@SVW",
        "Initial decision for this package (WinPE): %s",
        "<:<]<",
        "REG_RESOURCE_LIST",
        "5&5-5A5U5m5z5",
        "9\"9M9\\9b9",
        "CApplyDrivers::CopyToDriverStore: Failed to open driver store session from %s. Error: 0x%08X",
        "CEnableFeature::DoExecute",
        "8/8T8\\8r8",
        ".PAVCXXXXXTemp@?EH@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "ZwAllocateUuids",
        "7C7X7`7f7o7",
        "CApplyDrivers::CopyToDriverStore: Failed to load %s from offline servicing stack. Error: 0x%08X",
        "Printing processes using %s file.",
        "ImageUnmarshallHandle",
        ">.><>T>Y>p>",
        "7-7<7C7K7P7[7f7l7",
        ">*>5>P>W>]>b>m>x>",
        "OS partition current length: %I64u",
        "void __thiscall UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *>::QuickSort(class UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *> *,class UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *> *,int,int)",
        "9n9z9",
        "%I64u,%I64u",
        ".?AVCUserProfileEnumerator@@",
        "060E0",
        "ProvPackagePath",
        "5&5-53585D5P5d5q5",
        "$VWhx",
        "pAddSafeOSDriversFromProvPackage: Failed to get driver info for %s (0x%08x)",
        "%hs: Failed to extract Boot folder. Error 0x%08X",
        "class UnBCL::SmartPtr<class OC::COptionalComponent> __thiscall OC::COCCbsAdapter::CbsUpdateToOC(struct ICbsUpdate *)",
        "void __thiscall UnBCL::ArrayList<struct DISK_SPACE_IMPACT>::RemoveAt(int)",
        "?ToString@String@UnBCL@@UBEPAV12@XZ",
        ".?AVCSetupAutomation@@",
        "Failed to get diagnostics directory, data file cannot persist. hr = 0X%x",
        "%hs: WinRE image %s does not exist, we have nothing to do.",
        "SPExecuteCleanup: Failure while removing folder %s. Error: 0x%08X",
        "333?3I3U3e3n3u3",
        "BcdExportStore: Failed clone BCD to %ws. Status: %x",
        "L$,!t$0!t$4",
        "9 9$9(9094989<9@9D9H9P9T9X9\\9d9h9p9t9x9|9",
        ".?AV?$SerializableBase@VCSetSafeOSBootCommand@@$0A@V?$DefaultInstanceFactory@VCSetSafeOSBootCommand@@@UnBCL@@@UnBCL@@",
        "50585<5@5H5L5P5X5\\5",
        "Set reg key value DownLevelBuildNumber failed: 0x%x",
        "SL_E_PRODUCT_KEY_INSTALLATION_NOT_ALLOWED",
        ">$>@>G>M>Y>e>",
        "tRSV3",
        "?,?4???N?U?m?x?",
        "SP_ENV_TEST_DYNAMIC_UPDATE_PATH",
        "Deciding migration on driver package:",
        "stopService",
        "9 999O9v9",
        "SL_E_PKEY_INVALID_ALGORITHM",
        "WinRE driver and OEM tools migration is not required",
        ":\";.;P;\\;g;z;",
        "Mount path high",
        "0)070E0S0a0",
        "CSetupAutomation::Resurrect: Failed to parse deployment options: 0x%08x",
        "; ;$;(;,;0;4;<;@;D;H;P;T;X;\\;`;d;h;l;p;x;|;",
        "VhX{c",
        "5'555C5",
        "FveCheckSuspendBitLockerOnUpgrade",
        "Failed to merge telemetry file: %s. hr = 0X%x",
        "0&0.070@0O0e0j0s0",
        "RemoveFirstBoot",
        "Failed to reset setup. Abandoning recovery.",
        "CSetupPlatform::Initialize: Disk provisioning is not available; hr = 0x%08X",
        "5G5\\5r5z5",
        "<(<6<D<",
        "long __stdcall SPCalculateDriveMappings(class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *> **,int)",
        "void __thiscall UnBCL::ArrayList<struct DiskMatchFilter>::Resize(int,int)",
        "j Yf;",
        "SSSSVP",
        "j:Xf;G",
        "  Path: %s",
        "GetAnswerFileContentsAsUnattend: Couldn't parse answer file %s: 0x%08x",
        "ERROR_MCA_EXCEPTION",
        "#0A0Y0{0",
        "System\\CurrentControlSet\\Services\\Wof",
        "323t3",
        "void __thiscall UnBCL::_::ArrayListEnumerator<void *>::Reset(void)",
        "CTrustSafeOS::DoExecute: Failed to verify trust of %s",
        "y%SWh",
        "_ftol2_sse",
        "3$32383L3[3",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Found crash dump file (memory.dmp) in %s; attempting to copy to %s",
        "SysprepSession::Execute",
        "Attributes",
        "1 1$1<1@1X1\\1t1x1",
        "3!3*3@3N3g3n3u3{3",
        "QSVWf",
        "ERROR_INC_BACKUP",
        "8P8^8~8",
        "WIMCreateWofCompressedFile",
        "uqj-Zf9T00",
        ";+;2;?;L;X;f;",
        "?&?3?:?D?U?b?l?{?",
        "001<1O1c1y1",
        "CRelocateOS: Failing to remove existing %s directory, will move out of the way",
        "9=:l;",
        "8(8<8Z8a8g8l8w8~8",
        "5$5*5/5>5O5\\5e5v5~5",
        "SVh s",
        ".?AV?$DefaultInstanceFactory@VCCleanupEntry@CSimpleCleanup@@@UnBCL@@",
        "=M>c>",
        "void __thiscall UnBCL::ArrayList<class SysprepAction *>::AddRange(const struct UnBCL::ICollection<class SysprepAction *> *)",
        "InitVDSService:Successfully launched service.",
        "ProvisioningPackage::GetAssetSize",
        "ERROR_IPSEC_IKE_NO_PRIVATE_KEY",
        "1$1-171C1g1x1",
        "?$?1?H?^?w?",
        "\\Control\\Wmi\\GlobalLogger]",
        "SclResetDiskGuids",
        "QueueCreateRegistry called for %s [%s]",
        "9I:P:V:[:f:r:|:",
        "Identity contains invalid public key token: %*.*ws.",
        ":!;D;R;Y;_;d;p;{;",
        "SF Validator: Users/shell folders appeared/changed, will invalidate data gather operation",
        "SPScheduleTaskFailed to initialize COM. Error: 0x%08X",
        "ERROR_DS_CANT_TREE_DELETE_CRITICAL_OBJ",
        "8/888>8P8a8",
        "ERROR_DS_EXISTS_IN_AUX_CLS",
        ".?AV?$ArrayListEnumerator@PAVCGlobalPathFindData@@@_@UnBCL@@",
        "WIM_Skip_WIMBoot_Check",
        "\\REGISTRY\\MACHINE\\SYSTEM\\SETUP",
        ".?AV?$DictionaryEntry@PAUIOperationsProgress@SetupPlatform@@K@UnBCL@@",
        ".?AU?$IEnumerator@PAVCMountedPathInfo@CDeploymentBase@@@UnBCL@@",
        "FltCommStubCreateChild",
        "yOC::OCReinstallNetFx",
        "ProvisioningPackages",
        "6,6U6g6n6x6",
        "PSVhX",
        "8#939s9",
        "CBS_E_BUSY",
        "ParseDiskCriterion: Failed to parse numeric value '%s' for property %s (0x%08x)",
        "ERROR_LOG_BLOCK_INVALID",
        "OSRollbackService::CSetupRollbackService::Initialize",
        "class ISPPluginData *const *__thiscall UnBCL::ArrayList<class ISPPluginData *>::GetBuffer(int) const",
        "class CInfFile *const &__thiscall UnBCL::ArrayList<class CInfFile *>::get_Item(int) const",
        "?&?K?Z?",
        "3\"383O3V3\\3a3l3{3",
        "3 3$3(3,30383<3@3D3H3L3T3X3\\3d3l3p3x3|3",
        ": :+:8:=:Q:h:",
        "4W4{4",
        "RPC_S_ENTRY_ALREADY_EXISTS",
        "4,4S4^4h4o4u4z4",
        "575?5G5L5l5t5|5",
        "DiskLayoutMakeRecovery: Failed to set Recovery partition type (0x%08x)",
        "Failed to add working directory size and free space; SQM data will not be reliable. hr = 0x%08X",
        "ERROR_CAN_NOT_DEL_LOCAL_WINS",
        ".?AVCSetDefaultBootEntry@@",
        "7'787M7V7_7h7q7{7",
        ".PAVXPathException@UnBCL@@",
        "Operations are not consistent, incomplete operation is scheduled in already completed phase.",
        "JET_errTooManyActiveUsers",
        "base\\ntsetup\\lib\\rollback\\src\\bcdutils.cpp",
        "=(>h>",
        "ERROR_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME",
        "GetFileSizeEx",
        "CLPValidator::ValidatePreExecution",
        "Failed to close the system store. Status = [%x]",
        "1$1(1,10141<1D1H1P1T1\\1`1d1h1p1t1x1|1",
        "=!=C=O=\\=h=t=",
        "4&464B4J4Q4b4i4w4",
        ": :O:j:q:",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::Add(class UnBCL::String *,enum ActionType)",
        ".?AVCXXXXXHandledException@?8??SPSetOSEntropy@@YGJPBG@Z@",
        "Opening store from %ws",
        "606l6",
        "0$1e1j1o1{1",
        "Failed to get a handle to the OS loader. Status = [%x]",
        "3!3'3,373C3W3o3",
        "Error creating boot status data log(%s)! Unable to allocate memory",
        "4%444=4C4P4V4[4l4w4",
        "3'3F3{3",
        "long __thiscall CARPValidator::ValidatePostExecution(struct IExecutionContext *,enum OP_EXECUTION_PHASE,class COperation *,class COperationQueue *,int &)",
        "=,=0=@=D=T=X=h=l=|=",
        "0H0R0`0j0{0",
        ";E,u!",
        "Search was successfully optimized; will skip further filtering for download optimization",
        ".?AVSysprepAction@@",
        "8%8Y8s8",
        "8#898G8`8g8n8t8",
        "767Q7m7",
        "void __thiscall UnBCL::ArrayList<class CDeploymentBase *>::Resize(int,int)",
        "Not present",
        "CFailForwardSystem::QueueOCReplication",
        "9\\$Lt",
        "9*949:9B9L9Y9j9",
        "3#3.3<3h3r3",
        "onecore\\base\\cbs\\util\\inc\\CbsArray.h",
        ">@>H>P>d>l>t>",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCImageInfo@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "%hs: Failed to get NewOS root directory. Error: 0x%08X",
        "4&414E4c4",
        ";:<G<Y<a<g<t<",
        ");NEW;",
        "BootStat",
        "Failed to covert creation time to SYSTEMTIME. ERROR: 0x%08X",
        "SetupDiGetClassDevs failed for %s, error 0x%08X. Ignoring class.",
        ".?AVCSkipBootValidator@@",
        ":&:0:::D:N:e:s:}:",
        "212I2e2",
        "737e7",
        "PSSSSSW",
        "1)121H1V1_1i1r1{1",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCOperationsValidator@@@UnBCL@@@UnBCL@@",
        "9HXu:9H\\u5",
        ":>;N;h;",
        "8&8F8b8r8y8",
        "{DEA59573-7819-403E-B5E5-FD478208199E}",
        "%systemdrive%\\SkyDriveTemp",
        "InstallSecurityTemplate",
        "CoUninitialize",
        ":#:5:H:Z:b:h:u:",
        "VdsPartition::GetExtendedPartBounds: Failed to enumerate partitions (0x%08x)",
        "3/363<3A3L3W3k3",
        "2-2B2J2P2]2o2",
        "4-4h4u4",
        ".?AU?$IDictionaryEnumerator@PAVString@UnBCL@@PAUHKEY__@@@UnBCL@@",
        "CDeploymentProject::CreateVHDDeployment: Failed to save %s: 0x%08x",
        "MIG Validator: All work (machine-independent) is complete, marking completion and removing the store.",
        ".SP_ALWAYS_RESTART_DIAGTRACK",
        ".?AU?$IEnumerable@PAVCOperationInfo@@@UnBCL@@",
        "RemoveSafeOSBoot",
        "VdsPartition::GetResizeBounds: Couldn't get volume object (0x%08x)",
        "Failed to scope directory [%s]. Error: 0x%08X",
        ".?AUIMigExecuteProgress@@",
        "ConstructPartialMsgVW",
        "CDownloadDUUpdates::DoExecuteInternal: Failed to create reserved space file %s. hr = 0x%x",
        "PSSSSSS",
        "??1?$SmartPtr@VVersion@UnBCL@@@UnBCL@@UAE@XZ",
        "JET_errMissingFileToBackup",
        "1$111C1\\1{1",
        "2\"2+272G2O2Y2`2f2k2v2",
        ".?AVCXXXXXHandledException@?2??SPModifyOfflineHives@@YGHHHHPAVString@UnBCL@@@Z@",
        "8+8Z8",
        "ERROR_RESOURCE_PROPERTIES_STORED",
        ":%:,:G:Q:d:t:",
        "7*7:7C7L7a7j7~7",
        "8<:?<F<",
        "QueryDosDeviceW",
        "ERROR_COMMITMENT_LIMIT",
        "<4<M<",
        "Failed to set enhanced option for mobile reset",
        "Vh(Tb",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::Resize(int,int)",
        "1$1,1D1L1T1\\1d1",
        "6+6>6P6X6^6k6}6",
        "class UnBCL::ArrayList<class CAppInfo *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class CAppInfo *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "Failed to open or create setup key",
        "2'2-222C2N2\\2",
        "9^,s@9F0t",
        "HKEY_USERS",
        "Failed allocating full path for %S",
        "2\"242B2R2W2d2r2x2",
        ">->;>",
        "? ?$?(?<?@?D?L?T?X?l?p?",
        "ERROR_DS_ROOT_CANT_BE_SUBREF",
        "ERROR_INSTALL_TRANSFORM_REJECTED",
        "ZwQueryAttributesFile",
        "VdsVolume::Mount: Failed to copy volume access path [%s] (0x%08x)",
        "CI EA is only supported on when image contains OS version info.",
        "SL_E_TAMPER_RECOVERY_REQUIRES_ACTIVATION",
        "ERROR_MEMBER_IN_ALIAS",
        ".CRT$XLZ",
        "(%lx): Couldn't determine firmware type",
        "8-838E8_8q8v8{8",
        "1#1+171L1U1[1m1",
        "FatalErrorStatus:%d",
        "ERROR_SXS_XML_E_UNCLOSEDTAG",
        "pSPWaitAutoStartingSystemServices",
        "2)373h3",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAVCSPInternalPluginData@@UTableKey@?$Hashtable@PAVString@UnBCL@@PAVCSPInternalPluginData@@@2@V?$DictionaryEntry@PAVString@UnBCL@@PAVCSPInternalPluginData@@@2@UKeyTraits@52@$1?RetrieveEntry@52@KG?AV62@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAVCSPInternalPluginData@@@UnBCL@@PAVCSPInternalPluginData@@UKeyTraits@23@V?$CElementTraits@PAVCSPInternalPluginData@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "const struct DiskMatchFilter *__thiscall UnBCL::ArrayList<struct DiskMatchFilter>::GetBuffer(int) const",
        "<)<O<",
        "1 1.1<1J1X1f1",
        "484X4x4",
        "SetClassLongW",
        "6\"6/6A6O6u6",
        "5'575B5e5{5",
        "575>5E5K5U5|5",
        ";#;.;D;M;`;|;",
        "3&3-333>3m3t3",
        "RtlGetControlSecurityDescriptor",
        "?\"?)?/?5?A?Q?e?l?q?",
        "Wmi::GetCallParameters: Couldn't get the class object for %s (0x%08x)",
        "=0=8=@=H=P=\\=d=|=",
        "2%3/3@3`3",
        "5%575B5K5W5c5o5",
        ".PAVObject@UnBCL@@",
        ".?AV?$SerializableBase@VCReserveSpace@@$0A@V?$DefaultInstanceFactory@VCReserveSpace@@@UnBCL@@@UnBCL@@",
        ".?AV?$SerializableBase@VCFirstBootApply@@$0A@V?$DefaultInstanceFactory@VCFirstBootApply@@@UnBCL@@@UnBCL@@",
        "CImageInfoSet::AddToImageInfoSet: Failure in creating %s image info; Error: 0x%08X",
        "    Failed to copy long intermediate path string",
        "5$5?5E5R5d5",
        "Service start type is %u",
        "7+767F7j7",
        "6!6(6.636>6R6f6",
        "J0+J8",
        "T$@Ph@",
        "=d>v>{>",
        "SL_E_CHPA_NETWORK_ERROR",
        "Successfully set start type %u",
        "0#020<0A0I0P0\\0n0",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *> *)",
        "ERROR_INVALID_COMMAND_LINE",
        "DriverSafeOSMigratedList",
        ";G,u.",
        "int __thiscall UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::BinarySearch(int,int,class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *,struct UnBCL::IComparer<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *> *)",
        "<B<I<P<[<f<z<",
        "ERROR_INVALID_KEYBOARD_HANDLE",
        ".?AVCXXXXXHandledException@?FP@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "ERROR_INVALID_SPI_VALUE",
        "Relocate WinRE image",
        "t$@Shl:",
        "5S6Z6`6e6p6w6",
        "050B0H0g0~0",
        ":!:-:::B:V:g:{:",
        "int __thiscall UnBCL::Array<class COperation *>::Add(class COperation *)",
        "CERT_E_CRITICAL",
        "8)80868;8F8M8a8",
        ">%>B>I>Q>X>^>c>n>y>",
        "%hs: Capabilities not met, request is not supported",
        ".PAVCXXXXXTemp@?OL@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "545}5",
        "4*4G4",
        "8 8.8D8",
        "3+3x3",
        "Cannot set Tag for %s, error: 0x%08X",
        ".?AV?$DefaultInstanceFactory@VCSavePageFileSettings@@@UnBCL@@",
        "ERROR_HOST_NODE_NOT_GROUP_OWNER",
        "D$L9D$Ht",
        "Opted-in to SQM",
        "Failed to redirect logging to %ws. Status: %x",
        "Ignoring unrecognized reparse tag [0x%x], [ID=0x%I64x]",
        "pSPDeleteDirectory",
        "MEDIA",
        "0-0`0f0r0}0",
        "001`1,2p2(3",
        ".?AV?$SmartPtr@U?$IEnumerator@PAUIDisk@SetupPlatform@@@UnBCL@@@UnBCL@@",
        "6-6L6S6Y6^6j6{6",
        ";`<(=",
        "Bugcheck param 4",
        "<#<*<2<7<B<M<S<g<q<",
        "ERROR_IPSEC_IKE_ERROR",
        "SL_E_PROXY_POLICY_NOT_UPDATED",
        "BuildLabEx",
        "%hs: BCD failed to set the default boot entry. Error: 0x%08X",
        "xSP_ENV_TRY_SKIP_FIRST_BOOT",
        "ERROR_INVALID_COLORINDEX",
        "CSysprepSpecializeOffline::DoExecute",
        "CFastDeleteImplT<class CDirectoryProviderT<class CWindowsOldAdaptor>,1>::PerformDeletion",
        "0/070=0J0\\0j0",
        "3b4o4",
        "xdj(j",
        "Application",
        "0&0,010<0G0[0y0",
        ":>:]:",
        "8\"8/8F8Z8o8~8",
        "ERROR_CLUSTER_OWNER_NOT_IN_PREFLIST",
        "Info.Rec",
        "SPSelectDisk",
        "1#1Y1`1f1k1v1",
        "ERROR_CLUSTERLOG_RECORD_EXCEEDS_MAXSIZE",
        "8!8*838<8H8T8`8l8x8",
        "9 9D9L9T9\\9d9l9t9|9",
        "?.?<?E?V?c?",
        "t$Xh(",
        "8/9v9",
        "<6<U<\\<b<g<r<y<~<",
        "9U9j9|9",
        "7I8c8~8",
        "2D2Z2l2y2",
        "9\":;:M:V:_:l:x:",
        "?ToUpper@String@UnBCL@@QBEPAV12@XZ",
        "2M2w2",
        "1(161D1R1",
        "EnableActiveDump request received, will generate Active dump in case of crash.",
        "ERROR_SPARSE_NOT_ALLOWED_IN_TRANSACTION",
        "No dump was extracted",
        "ERROR_INVALID_MINALLOCSIZE",
        "t$TQh",
        "xSP_ENV_RESPECIALIZE_IN_OOBE_BOOT",
        ".?AV?$ValueCollection@PAVString@UnBCL@@W4ActionType@@@_@UnBCL@@",
        "can't compare instances of a noncomparable type",
        "tmf92th",
        ".?AV?$SerializableBase@VCMergeWIM@@$0A@V?$DefaultInstanceFactory@VCMergeWIM@@@UnBCL@@@UnBCL@@",
        "SYSTEM\\CurrentControlSet\\Services\\",
        "QQQQQQ",
        "\\ProgramData",
        "Suspending protection on this volume",
        ";!;+;5;?;V;d;n;x;",
        ":%:*:5:@:E:Y:b:k:t:}:",
        "4$40454A4Q4X4b4x4",
        "VWj43",
        ":$WIMMOUNTDATA:$DATA",
        ";8;B;O;U;\\;f;s;z;",
        "0!030L0k0",
        "%hs: Cannot preserve the recovery image from the current OS when installing on a different drive",
        "void __thiscall UnBCL::Array<unsigned long>::InitLarva(class UnBCL::ArrayList<unsigned long> *)",
        ": ;4;F;N;T;];s;};",
        "8 8E8j8",
        "VdsDisk::CreatePartition: Can't enumerate partitions (0x%08x)",
        "SSSSSSSj",
        "SPReportSnapshotState: Allocated space : %I64d",
        ";';1;>;J;Q;W;\\;g;r;",
        "6J6a6{6",
        "7&7.787@7J7R7\\7d7n7v7",
        "? ?3?;?B?P?f?z?",
        "7!7-7C7R7i7o7|7",
        "ERROR_TRANSACTION_OBJECT_EXPIRED",
        "FIOGetVolumeFlags",
        "CDUPackage::UnpackTo: IUpdateIdentity::get_UpdateID failed. hr = 0x%x",
        "VdsPlatform::Initialize: Waiting for VDS service to be ready",
        "_ftol2",
        "    Failed to delete directory",
        "ReparsePointUpdateCount",
        "MS_WindowsRemoteValidation",
        "int __thiscall UnBCL::ArrayList<class CFilterDriverInfo *>::IndexOf(class CFilterDriverInfo *,int,int) const",
        "QVjDjXV",
        "Migration.IgnoreSMI",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCOptionalComponent@OC@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "Failed to mark image for compact state.",
        "8!888L8\\8v8",
        "MigOpenHardLinkStore",
        "xh-ZA",
        "CRelocateWinReImage::DoExecute",
        "7-7:7D7]7f7l7",
        "WIMBoot partition is still present. Path is: %s",
        "<-=6=<=H=N=X=d=s=",
        "; ;';-;9;E;y;",
        "ERROR_DEPENDENT_RESOURCE_EXISTS",
        "ERROR_DS_AUDIT_FAILURE",
        "MIG_APPLY_GENERATE_PERF_DATA",
        "CurrentControlSet",
        ":$:2:@:i:q:~:",
        "StateStoreSetMountedImageStatus",
        ":\":+:0:D:L:c:m:v:",
        "XBitLocker.Disabled",
        "</<9<L<T<Z<g<y<",
        "ERROR_IPSEC_IKE_DH_FAILURE",
        "FindResourceW",
        "SPMoveFileWithShortName",
        ".?AVCXXXXXHandledException@?FN@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "5)606O6a6k6x6~6",
        ".?AV?$SerializableBase@VCVHDImageInfo@@$0A@V?$DefaultInstanceFactory@VCVHDImageInfo@@@UnBCL@@@UnBCL@@",
        "ERROR_UNKNOWN_PRINTER_DRIVER",
        "SPDismProgressCallback",
        "RPC_X_ENUM_VALUE_OUT_OF_RANGE",
        "PWVhH",
        "<!</<=<K<Y<g<u<",
        "=$=1=:=X=g=",
        "BootDebuggerFiles.UEFI",
        "??3Object@UnBCL@@SGXPAX@Z",
        "OrchestrateStartSystemServices: Timed out while waiting for SCM to create autostart-done event; timeout = %d ms.",
        "%hs: SPGetOSInformation did not find any footprint.",
        "Creation succeeded, actual partition offset: %I64u",
        "ActionPlatform::LaunchModule: Could not create worker thread for calling '%s' from %s; dwRet = 0x%x",
        "GetErrorMode",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::Reset(void)",
        "void __thiscall UnBCL::Array<class CUserProfile *>::Remove(class CUserProfile *)",
        "BitLocker turned on after upgrade",
        ";];p;",
        "class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::get_Item(int) const",
        "4Y4k4s4y4",
        "Target filter value: %s",
        "ntdll",
        "SKIPBOOTTRACK(SAFEOS): APPX Validator: Invalidated data gather, which may have invalidated OS image apply.",
        "ERROR_SERVICE_DOES_NOT_EXIST",
        ";$;3;E;",
        "=-=7=I=Q=]=g=x=",
        "CURRENT",
        "=I=P=W=b=m=r=",
        "0a0h0n0s0~0",
        "9WHvQ",
        "9:9D9N9X9b9l9v9",
        "GetDisk: Querying unallocated disks...",
        ">->=>N>[>j>z>",
        "5G5h5",
        "Diagnostics",
        ";&;.;4;:;J;Z;b;h;n;s;y;",
        "<X<`<",
        "(%lx): Failed writing boot entry size to boot entry recovery file.",
        "x8\"uIWW",
        "[QWjWjvW",
        "Failed to move/copy updates",
        "8&888@8F8S8e8s8",
        "XUpdate Boot Code",
        ";,;4;:;G;Y;g;y;",
        "class CFailForwardSystem *&__thiscall UnBCL::ArrayList<class CFailForwardSystem *>::get_Item(int)",
        "7#888C8p8",
        "ElementEnumerator::GetNextElement",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@I@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "Migration is queued for running OS, checking snapshot policy",
        "SPCreateFile",
        "ERROR_IPSEC_IKE_NO_CERT",
        "9\"969@9G9M9R9]9p9",
        "3>3b3t3|3",
        "90979=9B9M9X9l9",
        "4.4D4V4^4d4q4",
        "2#2*20252@2M2a2o2",
        "5%525@5",
        "__thiscall UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *>::ArrayList(const struct UnBCL::ICollection<class CSimpleCleanup::CCleanupEntry *> *)",
        ".PAVCXXXXXHandledException@?5??pSPRemoveSourceHardlinks@@YGXPAVString@UnBCL@@@Z@",
        "5'5x5",
        ">%>,>2>7>B>O>W>]>b>v>",
        "ERROR_DIR_NOT_ROOT",
        "class COSPieceInfo *const *__thiscall UnBCL::ArrayList<class COSPieceInfo *>::GetBuffer(int) const",
        "%hs: Found mapping from %s to %s",
        "Failed inserting element io cbs array",
        "\\EFI\\MICROSOFT\\BOOT\\BCD",
        "CNewSystem::QueueSetupAutomation: Failed to queue audit payload file copy: 0x%08x",
        "7\"787S7Y7c7h7r7y7",
        "CDeploymentProject::CreateVHDDeployment: Failed to get image index. Error: 0x%08X",
        "VdsPartition::SetType: Failed to query IID_IVdsAdvancedDisk2 interface [%s] (0x%08x)",
        "4&494Y4f4q4w4",
        "ERROR_INVALID_GROUP_ATTRIBUTES",
        "SclRegProcessOfflineRegistry",
        "ERROR_NO_SYSTEM_RESOURCES",
        "EventUnregister",
        ".?AU?$IEnumerable@PAUIPartition@SetupPlatform@@@UnBCL@@",
        "MEMORYTRACK: Total             : %I64u",
        "<(</<5<:<E<P<d<~<",
        ".?AU?$ICollection@PAV?$DictionaryEntry@PAVString@UnBCL@@PAVMultiSz@2@@UnBCL@@@UnBCL@@",
        "9):;:C:I:V:h:",
        "=1=H=k=",
        "CDeploymentProject::Release: Failed to delete work directory [%s]. Error: 0x%08X",
        "3+3G3`3",
        "gCSetupPlatform::SuspendAndRelease",
        "SnapshotCleanupPeriod",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::MoveNext(void)",
        "=(>X>",
        "Failed to create path for default EFI application. Last error = %#x",
        ".?AV?$HTDictEnumBase@PAVCDriverInstallInfo@@@_@UnBCL@@",
        "void __thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,&protected: static struct IVdsDisk * __stdcall UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsDisk *> > const *,struct __POSITION * const &)>::Reset(void)",
        "?$?9?A?G?T?f?p?",
        "5#5;5y5",
        "8&828A8Y8`8g8m8x8",
        ".PAVCXXXXXHandledException@?CI@??DoExecute@CUnmountWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "5$525:5G5S5j5q5",
        "BfsRepairSystemPartition flags(0x%08x), system root: %ws, online: %ws, boot files: %ws, caller: %d",
        "CBS_E_COMPONENT_NOT_INSTALLED_BY_CBS",
        "=\"=)=0=6=@=b=v=",
        "ERROR_CLUSTER_NODE_NOT_READY",
        "606U6g6",
        ".?AV?$SerializableBase@VCStartSystemServices@@$0A@V?$DefaultInstanceFactory@VCStartSystemServices@@@UnBCL@@@UnBCL@@",
        "<'<K<a<x<",
        ": :K:R:X:]:h:y:",
        "??C?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@1@XZ",
        "1>2H2p2",
        "Got Delete other snapshot OneSetting: %s",
        "CollectTrace",
        "; ;6;\\;c;i;n;y;",
        "4%4:4G4Q4a4j4r4{4",
        "3$353B3L3[3d3j3w3}3",
        "{6F5F3A68-433E-4E75-88FD-0BEBF8BACB90}",
        "void __thiscall UnBCL::ArrayList<class SysprepAction *>::QuickSort(class UnBCL::ArrayList<class SysprepAction *> *,class UnBCL::ArrayList<class SysprepAction *> *,int,int)",
        "ERROR_DS_SRC_GUID_MISMATCH",
        ".?AV?$SerializableBase@VCAddBootEntry@@$0A@V?$DefaultInstanceFactory@VCAddBootEntry@@@UnBCL@@@UnBCL@@",
        "CInfFile::IsInstallable",
        "!080?0",
        "9\"9S9",
        "0,040<0D0L0T0\\0d0l0t0|0",
        "ERROR_LOG_RESERVATION_INVALID",
        ".PAVCXXXXXTemp@?3??CreateFailForwardSystem@CNewSystem@@UAEJPBGPAPAUIFailForwardSystem@SetupPlatform@@@Z@",
        ";B;^;z;",
        "CGenericExecutionContext::UpdateDiskSpaceNeeded",
        "Failed to estimate space will be freed by cleanup snapshots",
        "?get_Value@XmlNode@UnBCL@@QAEPAVString@2@XZ",
        "    Failed to write element node shallow",
        ";E;T;^;",
        ".?AV?$CAutoRelease@PAVWmiCallResult@WMI@@@RAII@@",
        "ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND",
        "void __thiscall UnBCL::ArrayList<class CDriverInfo *>::QuickSort(class UnBCL::ArrayList<class CDriverInfo *> *,class UnBCL::ArrayList<class CDriverInfo *> *,int,int)",
        "(%lx): Error copying hive content from [%ws] to [%ws]",
        "=(=2===G=S=[=g=n=t=y=",
        "MigApply",
        "3`4H5",
        "NMTOKENS",
        "00080@0P0\\0d0|0",
        ".?AU?$IEnumerator@PAVCCmdLineExecutionTelemetryData@OC@@@UnBCL@@",
        "0%010=0\\0q0}0",
        ".PAVCXXXXXHandledException@?BJJ@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "202B2O2\\2f2p2",
        "QSjdh",
        "CDownloadDUUpdates::FilterUpdates: Failed to initialize DISM. Error: 0x%08X",
        "Attempting to remove DU directory %s",
        "CNewSystem::QueueSetupAutomation: Failed to queue dynamic updates (0x%08X)",
        "2,2D2O2",
        "9%959=9J9O9[9g9o9|9",
        "?J?b?",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@W4SYNCEXEC_PHASE@SetupPlatform@@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        ">\">->4>m>v>",
        "Apply (oobe boot apply from ICB, online phase): Migration phase failed. Result: %d, specific error: 0x%08X",
        "VdsVolume::GetProperties: Failed to build volume GUID path %s (0x%08x)",
        "CSetupAutomation::Resurrect: No disk/partition serialized, cannot fix path to answer file if the drive letter has changed",
        "?$?(?@?D?\\?`?x?|?",
        "SL_E_TOKSTO_ALREADY_INITIALIZED",
        "Suspending and releasing setup platform",
        "QQj`PQQhd",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::get_Item(int)",
        "DeleteSnapshotFailedHR",
        "ERROR_DS_CANT_MOD_PRIMARYGROUPID",
        "ERROR_NO_PROMOTION_ACTIVE",
        "<Z=n=",
        ".?AV?$ArrayListEnumerator@PAVCUserProfile@@@_@UnBCL@@",
        ";8;X;x;",
        "j-j%j",
        "?1?v?",
        "=&=H=O=W=\\=l=w=",
        "?get_Context@SerializationStream@UnBCL@@QBEPAVObject@2@XZ",
        ".?AV?$DefaultInstanceFactory@VCOperationResult@@@UnBCL@@",
        "CDownloadDUUpdates::CalculateSpaceNeeded: Failed to get update size of TestHook update. hr =0x%x",
        "SPDiagTrackSetInfoInPostOobe",
        "9\"9-9:9T9s9y9",
        "6B6I6V6]6c6h6s6",
        ".?AV?$ValueCollection@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@_@UnBCL@@",
        "ERROR_CANTREAD",
        "Qj2PW",
        ".PAVCXXXXXHandledException@?5??SPScheduleTask@@YGJPBG000@Z@",
        ":#:5:L:Y:c:j:q:x:",
        ":Q:X:",
        "SPWriteXmlFile: Failed to open %s: 0x%08x",
        "Failed to process Driver Store INFs for removal, Err = 0x%lx",
        "Failed to adopt new store. File: %ws Status: %x",
        "SETUPPLATFORMCOMM: Error creating the broadcast pipe. Error: 0x%08X",
        "Optional profile hive does not exist, skipping: [%ws].",
        "2/2W2u2",
        ":!:-:4:B:R:W:u:}:",
        "4\"4-444G4[4r4y4",
        ";\"<J<",
        "JET_errLogBufferTooSmall",
        ";(;1;:;C;L;U;^;g;p;y;",
        "%hs(%u)\\%hs!%p: ",
        "CSetupAutomation::ResolveTarget: Target volume resolved to disk %u, partition %u (drive letter %c)",
        "<.<C<Q<c<p<",
        "%hs: Failed to initialize the CBS session 8. hr = 0x%08X",
        "post-apply",
        "??C?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBEPAV?$Array@E@1@XZ",
        ":):K:W:i:",
        "4s9G:T:",
        "ERROR_TRANSACTION_NOT_REQUESTED",
        "; ;6;E;L;U;Z;b;o;",
        "ERROR_IS_JOIN_TARGET",
        "ERROR_IS_SUBSTED",
        "GetWindowsDirectoryW",
        "CFG Validator: Fail to find Path=[%s] Type=[%s] in the new list",
        "=G>L>",
        ".?AV?$DefaultInstanceFactory@VCApplyOCs@@@UnBCL@@",
        "void __thiscall UnBCL::_::ArrayListEnumerator<struct DiskMatchFilter>::Reset(void)",
        "< <$<(<,<4<8<<<@<H<d<",
        "333L3T3n3~3",
        "ParseManifest",
        "\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}",
        "7 7A7U7\\7c7n7{7",
        "; ;(;<;E;M;\\;e;m;",
        "4>4^4",
        ";%;6;=;K;c;j;q;x;",
        "void __thiscall UnBCL::Array<class COperationInfo *>::InitLarva(class UnBCL::ArrayList<class COperationInfo *> *)",
        ";#;H;O;U;Z;f;q;",
        "nSPGetPackageOperationID",
        "SysprepSession::ExecuteAction: Error bypassed for startService operation",
        ".Extract files from WDS image %s from %s to %s",
        "u,Wj ",
        "    Failed to find payload file",
        "5-5G5N5T5Y5d5o5",
        "%hs: Attempting to remove downlevel boot entry",
        "ERROR_PKINIT_FAILURE",
        "HKEY_LOCAL_MACHINE",
        " (reparse)",
        "\\cbscore.dll",
        ".?AVCAtlException@ATL@@",
        ".?AVCXXXXXHandledException@?2??SetRegDWORD@@YGJPAVString@UnBCL@@000K@Z@",
        "=)=a=",
        "KernelTracingFlags",
        "void __thiscall UnBCL::Array<class COSPieceInfo *>::Insert(int,class COSPieceInfo *)",
        ">+>S>]>d>j>o>z>",
        "DisableShiftF10",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@_JPAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "9+9M9",
        "<G<j<",
        "int __thiscall CDeploymentBase::GetStoredBOOL(class UnBCL::String *,int)",
        "?)???a?}?",
        "7*727?7P7W7]7b7m7x7",
        ";:;Z;s;z;",
        "ERROR_INVALID_PASSWORD",
        ":*:8:?:E:J:U:_:g:q:y:",
        "6;7J7Z7n7~7",
        "7L8p8w8",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Found tag file [%s] in system boot directory, deleting it.",
        "565D5M5W5w5",
        "Apply statistics (oobe boot apply, offline phase):",
        "ERROR_IPSEC_IKE_INVALID_HASH_SIZE",
        ">\">0>:>D>N>X>o>}>",
        "CreateNewPseudoWindowsEx",
        ".PAVCXXXXXHandledException@?2??DoExecute@CSetDefaultBootEntry@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "3K3]3s3",
        "3%3+303<3D3X3`3x3~3",
        "Prepare OOBE boot",
        ">*>3><>H>Q>Z>q>}>",
        "CDownloadDUUpdates::MoveOrCopyUpdates: IUpdate::get_Identity failed. hr = 0x%x",
        "??0ApplicationException@UnBCL@@QAE@PBG@Z",
        "<\"<-<8<L<\\<s<z<",
        ";(;H;P;X;`;h;t;",
        "SL_E_SRV_AUTHORIZATION_FAILED",
        "=2>D>Z>p>",
        ".?AVStringProperty@?1???$pDefineStringProperty@V<lambda_89b49b587fc905a6d9cea5d347a93468>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_89b49b587fc905a6d9cea5d347a93468>@@@Z@",
        "Will ignore error and continue processing",
        "%hs: BCD failed to set the BCDE_LIBRARY_TYPE_RESTART_ON_FAILURE element for the new boot entry. Error: 0x%08X",
        ";B;G;X;",
        "3!3.333@3E3R3W3a3g3s3",
        "ERROR_DS_DUP_MSDS_INTID",
        "RegDeleteKeyExW",
        "FindGlobalPath: Cannot find volume info for %s (%s). Error: 0x%08X",
        "Pass status for %s after running indicates more action to be run after reboot; but we can't run them",
        "2$222@2",
        "; <3<@<O<",
        "4$454`4j4{4",
        "Copy provisioning package from %s to %s",
        "BuildDriverFilesList",
        "SP_BITLOCKER_INFO",
        "; <`<",
        "SEH: Enter CExceptionHandler::CExceptionHandler",
        "void __thiscall UnBCL::Array<class CImageInfo *>::RemoveAt(int)",
        "? ?-?:?N?[?r?{?",
        "?#?-?M?^?k?x?",
        "8%8,82878B8P8X8b8h8m8",
        "%hs: Recovery/WIMBoot partition could be removed but we'll gain no space on the OS partition",
        "Onesettings: Settings not fresh after query: 0x%x",
        "VdsPlatformDiskEnumerator::GetNext: Failed to get the next pack (0x%08x)",
        "5!5:5",
        "GetCurrentThread",
        ";\";n;",
        "DiskNumber",
        "Marking event [&SclEvent_ResetDiskSignatures_Stop]",
        "0/050B0T0p0w0}0",
        "8(929?9E9L9V9c9j9t9",
        ".data$brc",
        ".PAVCXXXXXTemp@?JJ@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "9!9(9/969=9D9J9T9v9",
        "596V6",
        ";,;8;?;E;J;U;\\;p;",
        "VdsPlatform::EnumerateDisks: Can't initialize enumerator (0x%08x)",
        "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Syspart",
        "<-<;<S<f<x<",
        "D$(PQ",
        ".?AV?$ArrayList@PAUIPartition@SetupPlatform@@@UnBCL@@",
        ";c<x<",
        "<\"<*<0<=<O<Y<l<t<z<",
        "CNewSystem::GetCriticalDUPackageInformation",
        "ProvisioningPackage::EnumerateElements",
        "FindChunkForOffset",
        ".?AVCDriverInfo@@",
        "6$7=7R7Z7`7m7",
        "Recovery\\WimBoot",
        ";4;P;];c;y;",
        "Unable to get procedure FreeAndZeroCSI_BROKEN_COMPONENT",
        "9*:E:Y:^:c:o:",
        "SetLayout",
        "Get disable low disk snapshot policy Onesetting %s",
        "Set data source id failed.",
        "JET_errFileIOAbort",
        ".?AVCXXXXXHandledException@?BF@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "2#2-2K2^2c2m2",
        "8!8)8/8<8N8\\8",
        "    User SID: %s",
        "{22274046-753F-4832-93C5-FCF910858C31}",
        "SPDumpNtHiveListToLog",
        "PWhHg",
        "t$<PQQ",
        "An unattend GC requested that immediately reboot; we will resume queue execution after rebooting",
        ".?AV?$SerializableBase@VCMigChangesValidator@@$0A@V?$DefaultInstanceFactory@VCMigChangesValidator@@@UnBCL@@@UnBCL@@",
        "7(777R7\\7f7l7z7",
        "(%lx): Failed to create full path for source key.",
        "5&515K5c5u5|5",
        "CEnableSafeOSPageFile::EstimateDiskSpaceImpact",
        "(%lx): Failed to set value [%.*ws]",
        "pCreateSystemRootDriveMapping",
        "7 7$7(7,70787<7@7D7L7d7h7",
        "First Boot",
        ";Y;i;",
        "9)9/999>9H9O9]9o9",
        "VWh ,",
        ")Path",
        "windowsPE",
        "\\\\?\\GLOBALROOT%s\\",
        "323@3O3",
        "; ;(;0;8;@;H;P;X;`;h;p;x;",
        "ZwQuerySymbolicLinkObject",
        "738>8L8Z8h8v8",
        "=\"=7=B=P=h=y=",
        ";$;/;@;R;d;l;r;",
        "System\\Setup\\Status",
        "%hs: Cannot load the software hive for the offline OS %s. Error: 0x%08X",
        "VdsVolume::GetProperties: Failed to build volume device name %s (0x%08x)",
        "WinHttpGetProxyForUrl",
        "5'6.6h6~6",
        "ValidateInput: AttachDriverLetter should be true for %s",
        "CStoreHeaderWriterT<class CEmptyType>::CreateInstance",
        "OOBEFailure",
        "struct DISK_SPACE_IMPACT *__thiscall UnBCL::ArrayList<struct DISK_SPACE_IMPACT>::GetBuffer(int)",
        "2@2d2",
        "\\NTUSER.DAT",
        "111Q1^1u1",
        "0)000N0a0g0",
        ">(>t>",
        "SmPlatformDiskEnumerator::ConstructPhysicalDisk",
        "CPayloadWriterT<class CEmptyType>::CreateInstance",
        "OneSettings is disabled, will not query",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::LastIndexOf(class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *,int,int) const",
        "int __thiscall UnBCL::ArrayList<class CFileCreationData *>::IndexOf(class CFileCreationData *,int,int) const",
        "6/666;6a6h6",
        "\\$4Sj",
        ".?AVCUpdateBootCode@@",
        "ERROR_INVALID_PLUGPLAY_DEVICE_PATH",
        ".PAVCXXXXXTemp@?BG@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "?*?C?J?Q?W?c?u?",
        ".?AV?$CAutoCleanupBase@PAVVdsPhysDisk@@@RAII@@",
        "9$939<9B9O9U9Z9k9v9",
        "void __thiscall UnBCL::ArrayList<class CFileCreationData *>::Insert(int,class CFileCreationData *)",
        "Releasing the setup platform",
        "%hs: Failed to unload the SYSTEM hive, most likely a registry key leak",
        "void __thiscall UnBCL::ArrayList<class CFilterDriverInfo *>::CopyTo(class UnBCL::Array<class CFilterDriverInfo *> *,int) const",
        "SYSTEM\\Setup",
        "020a0v0",
        "int __thiscall OC::COCCbsAdapter::GetOCDependencies(class OC::COptionalComponent *,class UnBCL::SmartPtr<class OC::COCCollection> &)",
        "AllocationUnitSize",
        "7$717A7J7S7^7h7x7",
        "8$868M8S8e8t8{8",
        "8#9X9j9x9",
        "SPGetCBSCompletionStatus",
        "SPGetDiskImageNumber: Can't get device number for device %s (0x%08x)",
        "WINDOWS UPDATE",
        "OSRollbackUtils::CBCDManipulator::SetIdentityList",
        "ERROR_ENCRYPTION_FAILED",
        "ERROR_DISK_RECALIBRATE_FAILED",
        "%hs: Bitlocker suspended successfully.",
        "=;=M=U=[=h=z=",
        "Windows\\Setup\\Scripts",
        "yUnable to create the registry key HKLM\\%s",
        ".?AV?$SerializableArrayBase@PAVCOperation@@@_@UnBCL@@",
        "?3?A?J?R?X?^?h?y?",
        "323`3q3",
        "volume resize",
        "404C4L4U4^4|4",
        "4\"424:4E4Y4x4",
        "ERROR_INVALID_MONITOR_HANDLE",
        "CSetupPlatform::DownloadDynamicUpdates",
        "class CGlobalPath **__thiscall UnBCL::ArrayList<class CGlobalPath *>::GetBuffer(int)",
        "CNewSystem::QueueOperations: Estimated %llu bytes page file size for a dump file for dump setting %u",
        "5C5h5",
        ":!:4:D:K:R:]:d:j:z:",
        "</<6<<<A<M<Y<m<",
        "7.7E7k7",
        "SPAPI_E_INVALID_REG_PROPERTY",
        "    Failed to get metadata read temporary file",
        "ERROR_CTX_WD_NOT_FOUND",
        ">*>N>r>",
        "CSetupPlatformCheckpoint::CopyLogFiles: Invalid parameters.",
        "ERROR_CANTSCROLLBACKWARDS",
        "y2Vhl",
        "Setup Platform Core",
        "PendingSafeOsOperations",
        ".?AVCPrepareSafeOSForRollback@@",
        "SPValidateMigratedServices: binary file does not exist, attempting to create hardlink.",
        "2+292G2U2c2",
        ":@:Q:Z:u:|:",
        "10.0.19041.572",
        "7&737E7",
        "4-4Y4e4w4",
        ".?AV?$SerializableArrayBase@PAVCImageInfo@@@_@UnBCL@@",
        "1/1C1P1b1j1p1}1",
        "SetErrorMode",
        "PWVhN",
        ".?AUIDUPackage@SetupPlatform@@",
        ".?AV?$Array@UPartition@DiskLayout@@@UnBCL@@",
        ">/>@>I>d>m>v>",
        "DiskLayout::IsValidPartitionType",
        "6&656J6Q6W6\\6g6r6",
        "JET_errColumnDuplicate",
        "PWVh?",
        "OldOS",
        "ERROR_CLUSTERLOG_CORRUPT",
        "SetAttributes",
        "=*=2=<=D=S=[=y=",
        "SPEnumUnallocated: Failed to initialize SPDiskRangeEnumerator (0x%08x)",
        "tuf9:u",
        ";-;E;L;S;Y;f;{;",
        "637:7q7x7",
        "5K5f5",
        "<'=}=",
        "No OS pieces found",
        ".FolderMoveLog.TXT.BAK",
        "void __thiscall UnBCL::ArrayList<struct DISK_SPACE_IMPACT>::AddRange(const struct UnBCL::ICollection<struct DISK_SPACE_IMPACT> *)",
        "WinReUnInstall",
        "1 1%101:1M1[1b1l1",
        "?3?A?Z?w?",
        "4$454>4L4^4f4~4",
        ";+;2;8;=;H;R;\\;c;i;n;y;",
        "Skipped",
        ":(:L:T:\\:d:l:t:|:",
        "DiagERInitialize",
        "CDownloadDUUpdates::CalculateSpaceNeeded: IUpdate::get_MaxDownloadSize failed. hr = 0x%x",
        ".?AV?$SmartPtr@VXmlNode@UnBCL@@@UnBCL@@",
        "int __thiscall UnBCL::ArrayList<class OSRollbackService::CCheckpoint *>::IndexOf(class OSRollbackService::CCheckpoint *,int,int) const",
        "CNewSystem::QueueImageApplyOperations",
        "6A6F6R6v6{6",
        "CharUpperW",
        ".?AV?$SerializableBase@V?$ArrayList@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@E@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "NtCreateEvent",
        "4&4+4H4Q4`4h4r4",
        "DATASETTINGS",
        "7'7A7K7t7",
        "St:QQj",
        "Error copying rollback directory %s. Error: %s",
        "9'9>9U9n9",
        "FOD Validator: Get Capability [%s] State [%u]",
        "Error restoring directory metadata - ignoring failure",
        "WinHttpReceiveResponse",
        ".PAVCXXXXXHandledException@?BLL@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "JET_errInvalidDatabaseId",
        "849p9",
        "VdsPartition::SetGptAttributes: Failed to query IID_IVdsAdvancedDisk interface [%s] (0x%08x)",
        "6(626;6M6_6h6y6",
        "SPGetReserveManager: Storage Reserve is not supported.",
        "PWVh-",
        "QWWWP",
        ".?AV?$CAutoRelease@PAUIProvisioningPackage@@@RAII@@",
        "?GetObjectID@Object@UnBCL@@UBEIXZ",
        "?$?(?8?<?L?P?`?d?t?x?",
        "375Y5l5|5",
        "The provider %s is not formatted property, so skipping",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCDriverDetails@@@UnBCL@@@UnBCL@@",
        "2$2M2V2_2h2q2",
        "=!=)=0=<=N=c=r=|=",
        "IBSSetup",
        "CNewSystem::QueueOperations: Will turn off reserves",
        "SysprepSession::Execute: Sysprep mode %s specified, setting it in registry",
        "Error %s, 0x%08X while gathering/applying object: %s, %s. Will return %d",
        "1\"1-181^1p1w1}1",
        "?=?Q?k?",
        "q\\98u",
        "WinDir",
        "WVShHD",
        "8'828F8N8d8j8s8",
        ".?AU?$IEnumerator@V?$DictionaryEntry@GH@UnBCL@@@UnBCL@@",
        "Failed to extend the previous partition. Error: 0x%08X",
        "<#<,<><G<Q<Z<d<z<",
        "=)=1=>=R=b=}=",
        "_vsnprintf_s",
        "?(?5?G?Y?a?u?",
        "%hs: Failed to set Safe OS as default entry in the BCD. Status = 0x%08X",
        "ERROR_DEPENDENCY_TREE_TOO_COMPLEX",
        "= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=",
        ":5:>:G:P:Y:g:",
        "7#7,757?7H7Q7b7",
        "pSPRemoveTask",
        "%hs: Failed to load offline SYSTEM hive from %s. Error: 0x%08x",
        "5A5H5:6A6/767",
        ":+:8:D:X:l:y:",
        "ERROR_WORKING_SET_QUOTA",
        "ERROR_EXCL_SEM_ALREADY_OWNED",
        "  Resolved default install decision for package (WinPE): %s",
        "class CCFGSectionValue **__thiscall UnBCL::ArrayList<class CCFGSectionValue *>::GetBuffer(int)",
        "void __thiscall CDeploymentBase::StreamRead(class UnBCL::SerializationStream &)",
        "Vj.^f;1u",
        "LastCrashDumpInfo: Version %u",
        "4&41494|4",
        "SPTaskRemoveSnapshot: Can't create folder %s",
        "9 9&9+969=9G9M9m9x9",
        "(%lx): Failed to retrieve OS's SetupCl status",
        "Maximum recovery attempts reached.",
        "5)5;5C5M5U5[5o5|5",
        "0#0+02080=0H0S0g0s0",
        "int __thiscall UnBCL::ArrayList<class CGlobalPathFindData *>::BinarySearch(int,int,class CGlobalPathFindData *,struct UnBCL::IComparer<class CGlobalPathFindData *> *)",
        "8P9a9",
        "6(606E6N6T6a6s6",
        "2/2C2J2^2l2",
        "DriverStoreCopyW",
        "SPAPI_E_INVALID_COINSTALLER",
        "%ws changes to be made to hive [%ws]",
        "2)2?2v2}2",
        ">1>J>a>p>",
        ".?AVlogic_error@std@@",
        "Unable to open CDF file.",
        ".PAVCXXXXXTemp@?BJ@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: RestoreBCDDatabase failed, ec = [0x%X]",
        "5!5&5b5x5",
        "PVVVVh",
        "WpxCreateWriteOpt",
        "Installing WinRE created an extra recovery partition at offset %I64u, size %I64u",
        "The source image size is %I64u bytes; will not split it",
        "Rollback: Failed to create splash window. hr = 0x%08X",
        "void __thiscall UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *>::AddRange(const struct UnBCL::ICollection<class CSimpleCleanup::CCleanupEntry *> *)",
        ".?AVApplicationException@UnBCL@@",
        "=\"=/=>=V=]=d=j=u=",
        ">G?i?",
        "Failed to get the host OS version.",
        "ProcessTreeForDeletion marks %d entries",
        "4$4<4d4|4",
        "Could not disable journaling (to restore original state) on the applied volume.",
        ".?AV?$SmartPtr@VCInternalDownloadProgress@@@UnBCL@@",
        "%hs: BCD failed to set the boot manager timeout. Error: 0x%08X",
        "D$LQP",
        ".?AV?$DictionaryEntry@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@",
        ";!;);3;@;G;`;h;",
        "3$3D3P3p3|3",
        "SPAPI_E_NO_INF",
        "DismUnknown",
        "979?9I9Q9",
        "_wfopen_s",
        "5+5^5",
        "QWjYjojd",
        "CompressFileBackedByWim",
        "{e3c9e316-0b5c-4db8-817d-f92df00215ae}",
        "Failed allocating memory",
        "2)2:2C2O2\\2g2",
        "ERROR_DLL_INIT_FAILED_LOGOFF",
        "SPWimMergeCallback WIM. Progress: %d",
        "CSetupAutomation::Save: Failed to load settings from %s: 0x%08x",
        "808D8X8l8",
        "uninstall",
        "8B8z8",
        ".?AU?$IEnumerator@PAVCGlobalPathFindData@@@UnBCL@@",
        "Cannot open/load system hive from %s. Error: 0x%08X",
        "ERROR_RXACT_INVALID_STATE",
        ";E;`;q;",
        ":(:8:Q:w:",
        "ExtractBugCheckInfo: Unable to find file %s, error 0x%08X ",
        ".?AU?$IList@PAVCOptionalComponent@OC@@@UnBCL@@",
        ".?AU?$IList@PAV?$CAutoRelease@PAUIDUUpdateCollection@DU@@@Mig@@@UnBCL@@",
        "(%lx): Failed to unload key: [%ws]",
        "PVh(g",
        ".?AU?$IList@PAVDiskLayout@@@UnBCL@@",
        "  Build = %d",
        "<\"<;<^<o<{<",
        "0#0>0^0f0",
        "SPQuerySnapshotSize: Query snapshot size for [%s]",
        "OSRollbackService::CCheckpoint::MoveOrCopyFiles: Moved %s to %s",
        ".?AVCXXXXXHandledException@?2??Initialize@CCFGSectionFile@@UAEJXZ@",
        ">%>2><>K>T>Z>g>m>r>",
        "5$565>5D5Q5c5q5~5",
        "4!4-494L4S4a4u4",
        "LP Validator: Forcing validator failure due to environment variable.",
        "VjdRP",
        "Cannot find a suitable directory for the scratch space in %s.",
        "CSetupPlatformApplyRollbackCheckpoint::Rollback",
        "9*979C9e9m9",
        "IsStorageReserve",
        "WMI::_WmiProperties::Array",
        ".?AVCXXXXXHandledException@?GO@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "9#9A9H9N9S9^9h9m9",
        "<3<8<R<W<q<v<",
        "CRYPT_E_UNEXPECTED_ENCODING",
        "3/373>3L3U3Z3n3}3",
        "OperationRetrySpaceImpact",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,class ATL::CElementTraits<class CSPInternalPluginData *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *> *,class UnBCL::Array<class UnBCL::String *> *,int)",
        "D$pPj",
        ".PAVCXXXXXHandledException@?6??SuspendAndRelease@CDeploymentBase@@QAEJPBG@Z@",
        ".?AU?$IEnumerator@V?$DictionaryEntry@W4OP_OPERATION_ID@@H@UnBCL@@@UnBCL@@",
        "758Z8}8",
        "FirstBootApplyComplete",
        "CSetupPlatformOSSwitchCheckpoint: Failed to find setup platform path.",
        "Documents and Settings",
        "CoSetProxyBlanket",
        ".?AU?$IEnumerator@PAVCCopyInfo@@@UnBCL@@",
        ";$;*;4;>;Q;g;};",
        "6#6=6H6P6V6[6p6",
        "int __thiscall UnBCL::ArrayList<class OC::COptionalComponent *>::IndexOf(class OC::COptionalComponent *,int,int) const",
        "    Failed to allocate spSource.get()",
        "%hs: No files to extract from WDS image",
        ".?AU?$ICollection@PAVCOperation@@@UnBCL@@",
        "131K1c1m1}1",
        "6,7K7]7e7k7x7",
        "?A?Y?",
        "0.0<0]0",
        ";\";4;<;B;O;g;u;",
        "Copy Audit Mode Script Payload to New OS",
        "242K2\\2e2u2~2",
        "1+1=1O1_1q1",
        "CSetupPlatformInfo::SetCapabilities: Failed to get architecture of setup platform binary %s; hr = 0x%08X",
        "8\"979?9E9N9d9r9",
        ".PAVCXXXXXTemp@?9??Finalize@CNewSystem@@UAE?AW4SYSTEM_STATE@SetupPlatform@@PAUIOperationsProgress@4@H@Z@",
        ".?AVCXXXXXHandledException@?2??DoExecute@CPrepareRecoveryImage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "555P5a5v5~5",
        "void __thiscall UnBCL::Array<class CFilterDriverInfo *>::RemoveAt(int)",
        "Fail-Forward: Operation execution failed: %u. hr = 0x%X",
        "JET_errKeyBoundary",
        ".?AV?$SerializableBase@VCOfflineApplyFromICB@@$0A@V?$DefaultInstanceFactory@VCOfflineApplyFromICB@@@UnBCL@@@UnBCL@@",
        "1B2V2o2v2}2",
        "Failed to get kernel mode tracing flag, 0x%x",
        "5j6q6",
        ">1>I>P>^>h>{>",
        ".?AV?$DefaultInstanceFactory@VCApplyDrivers@@@UnBCL@@",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "7)747@7J7\\7d7j7t7~7",
        "CDownloadDUUpdates::FilterUpdates: IWindowsDriverUpdate::get_DriverHardwareID failed. hr = 0x%x",
        "  Line number: %d",
        "=#=1=I=\\=n=",
        "Injecting setup filter driver",
        "enum MIGSTATUS __stdcall SPDoFrameworkApply(class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::String *,class UnBCL::String *,int,struct ISPMigProgress *)",
        "CInfFile::Parse: Failed to get device IDs in driver %s; hr = 0x%08X",
        "onecore\\base\\ntsetup\\lib\\setupduhelp\\src\\setupduhelp.cpp",
        ".?AV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@",
        ",f~|z[WP",
        ".?AV?$CAutoCleanupBase@PAV?$Hashtable@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@@RAII@@",
        "CDownloadDUUpdates::FilterUpdates: IDUUpdateCollection::GetItem failed. hr = 0x%x",
        "ERROR_PRINTER_DRIVER_DOWNLOAD_NEEDED",
        "WimMount",
        "scan-success",
        "CBS_E_REPAIR_PACKAGE_CORRUPT",
        "CMediaLayout::QueueAuditScript",
        ";_;f;l;q;|;",
        "RpcBindingSetAuthInfoW",
        "Parameters",
        "VdsVolume::Unmount: Failed to delete volume access path [%s] (0x%08x)",
        "RemoveFontMemResourceEx",
        "9\"9-9:9@9T9c9",
        ":(;|;",
        ";%;<;A;\\;a;f;p;",
        "6 6$6(6,64686<6@6H6d6",
        "8(8d8",
        "ZwDeviceIoControlFile",
        "CSetupPlatformCheckpoint::CopyConfigFiles: Sources directory \"%s\" does not exist. Did we even get this far?",
        "ERROR_SERVICE_MARKED_FOR_DELETE",
        "40484>4K4]4k4x4",
        ">$>)>;>W>d>p>x>",
        ".PAVCXXXXXHandledException@?IF@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "QueueDisableFeature called with feature name %s",
        ".PAVCXXXXXHandledException@?CN@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ">$>,>4><>D>L>T>x>",
        "7a7h7o7",
        "JET_errUnicodeTranslationBufferTooSmall",
        "Failed to create current directory",
        "ERROR_SHARING_VIOLATION",
        "SysprepSession::ExecuteAction: Error bypassed for sysprepModule operation",
        ";L$ u",
        "SetTextAlign",
        "SPStorageReserveAvailable: Storage Reserve is not supported.",
        "<#=:=i=v=",
        ".?AVCBootFilesRestoreCheckpoint@OSRollbackService@@",
        ">\">)>0>7>=>G>i>{>",
        "9G tG",
        "int __thiscall UnBCL::Array<class COSPieceInfo *>::Add(class COSPieceInfo *)",
        "header type/size mismatch",
        "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7",
        "9,909@9D9T9X9h9l9|9",
        "SPAPI_E_DI_BAD_PATH",
        "ERROR_SXS_XML_E_UNCLOSEDDECL",
        ".PAVCXXXXXHandledException@?EF@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "DriverInfGetInfoFailedHR",
        "242;2@2F2L2R2X2^2d2j2p2v2|2",
        "CreateSetupOneSettings",
        "DiskLayout::ExecDeletions: Operation cancelled",
        "6$6(6@6D6\\6`6x6|6",
        "ValidateInput: Please provide a valid ChunkSize, should be power of 2",
        "Failed to disable feature %s in the OS: %s.",
        "X\\Program Files\\WindowsApps\\",
        "CBS_E_INVALID_PACKAGE",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long>,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> __stdcall UnBCL::Hashtable<class UnBCL::String *,unsigned long>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,class ATL::CElementTraits<unsigned long> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "9(9L9T9\\9d9l9t9|9",
        "LangpackDU",
        "8$8,8=8H8W8b8",
        "787L7S7Y7^7i7t7",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::Reset(void)",
        "809y9",
        "5&545=5V5_5i5r5|5",
        ".PAVCXXXXXHandledException@?2???0CUninstall@@QAE@PAVString@UnBCL@@H@Z@",
        "3P8X8]8c8r8",
        ">,>Q>",
        "0=0c0j0p0u0",
        "We will also remove it as soon as we finish the apply operation.",
        "?Delete@Directory@UnBCL@@SGXPBVString@2@H@Z",
        ":(:.:C:Z:j:q:~:",
        "Binary path (ORG): %s",
        "sr-Cyrl-CS",
        "GetCurrentProcessId",
        "1-151G1X1}1",
        "Failed to allocate root node.",
        "<)=B=p=",
        "|$89t$T",
        "ERROR_IPSEC_MM_AUTH_NOT_FOUND",
        "WIM file is on a different volume than the new OS and accessible during apply.",
        "SclRegRenameValue",
        "DiskLayout::WillBeExtended",
        "%hs: Finalize failed. Result: %d, Error: 0x%08X",
        "MPR.dll",
        "class COperation *__stdcall UnBCL::Try_Cast<classCOperation*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "%hs: Cannot copy filter from %s to %s. Error: 0x%08X",
        "%hs: WIM entry file %s no longer exists, was likely removed before getting here.",
        "<&<-<",
        "Software",
        ":,:=:T:a:r:",
        "void __thiscall UnBCL::Array<unsigned int>::Insert(int,unsigned int)",
        "1,1U1s1",
        "SourceFile",
        "5&5.5;5J5W5_5i5o5~5",
        "8?8H8Y8e8",
        "4'414I4s4",
        ">8?E?]?",
        "Execute.PreOOBE",
        "%hs: IEnumWbemClassObject::Next() failed (0x%08x)",
        "    Failed to find first payload path",
        "base\\ntsetup\\setupplatform\\lib\\utcutil\\utcutil.cpp",
        "CBS_S_BUSY",
        "5$5,545@5`5h5p5x5",
        ":);>;v;};",
        "CDeploymentProject::CreateFFUDeployment: Cannot find room for the VHD file.",
        "GetAnswerFileContentsAsUnattend",
        "5\"5)535H5\\5",
        "0H0U0m0",
        "Upgrade security completed",
        ".?AV?$SmartPtr@VCOperationsProgress@@@UnBCL@@",
        "< <2<9<?<D<O<Y<l<",
        "Failed to adjust token priveleges! Error code = %#x",
        "ERROR_READ_FAULT",
        ": :':4:",
        ".?AV?$DefaultInstanceFactory@VCBackupRecoveryPartition@@@UnBCL@@",
        ".?AVCSPInternalPluginData@@",
        ";\"<*<7<H<S<a<o<",
        "ERROR_PASSWORD_MUST_CHANGE",
        "3#3)3.393@3L3S3Y3^3i3p3",
        "Executing operation: %s",
        "pAddSafeOSDrivers: Failed to get driver package %u: 0x%08x",
        ";H;w;",
        ".?AV?$CAutoCleanupBase@PAVVdsPlatform@@@RAII@@",
        ">6>=>{>",
        "?ToString@Version@UnBCL@@UBEPAVString@2@XZ",
        "2\"2(2-282B2U2",
        "9$9,949<9D9L9T9\\9d9p9",
        "4X4e4}4",
        ">3>@>G>M>R>]>g>z>",
        "ERROR_PORT_UNREACHABLE",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *> *)",
        "7\"7.777D7L7U7^7k7s7|7",
        "1#2/2:2H2r2",
        ">??D?w?",
        "CreatePath: Unable to create [%s]; GLE = 0x%x",
        ".?AV?$Array@PAUISerializable@UnBCL@@@UnBCL@@",
        "5&5,595K5w5",
        "int __thiscall CSkipBootValidator::IsOperationRemovable(class COperationQueue *,enum OP_OPERATION_ID)",
        ";>;Q;X;`;e;u;",
        "?+?<?I?N?[?n?",
        "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control",
        "ERROR_INVALID_MENU_HANDLE",
        "01181>1C1N1Y1m1",
        ">8?E?^?g?m?",
        "CExecuteUnattend::DoExecute: Failed to initialize COM. hr = 0x%x",
        "CD9{Pt",
        "not found",
        "7'7I7]7k7y7",
        "void __thiscall UnBCL::ArrayList<class CShellFolderInfo *>::AddRange(const struct UnBCL::ICollection<class CShellFolderInfo *> *)",
        "CDUPackage::UnpackTo",
        "InjectUnattendFile",
        "void __thiscall UnBCL::ArrayList<class SysprepAction *>::CopyTo(class UnBCL::Array<class SysprepAction *> *,int) const",
        "pGetImageInfoFromSoftwareHive: Failed to get image version from software hive. Error: 0x%08X",
        "JET_errDatabaseCorrupted",
        "ERROR_INVALID_BLOCK",
        ".?AV?$DictionaryEntry@W4OP_EXECUTION_PHASE@@PAV?$ArrayList@PAVCOperation@@@UnBCL@@@UnBCL@@",
        "ERROR_CLUSTER_NO_QUORUM",
        "dNewSystem.dat",
        "CManifestCategory::Init",
        "?Copy@File@UnBCL@@SGPAVString@2@PBV32@0H@Z",
        "404i4",
        ">1>B>g>",
        ".PAVCXXXXXHandledException@?M@??OnErrorCommon@CSetupPlatformPrivate@@AAEJXZ@",
        "6/6?6I6\\6j6{6",
        "OSRollbackService::CCheckpoint::MoveOrCopyFiles: Copied %s to %s",
        "VdsPlatformDiskEnumerator::ReleaseObjects: Found unmatched disk image object for attached VHD: disk number is %u",
        "JET_errTableLocked",
        "?Append@MutableString@UnBCL@@QAEXPBG@Z",
        "<$<,<4<@<d<l<t<|<",
        "ar-LB",
        "D$4j4VP",
        "< <7<G<S<c<k<",
        "576X6w6",
        ".?AV?$SerializableBase@VCEnableNewOSPageFile@@$0A@V?$DefaultInstanceFactory@VCEnableNewOSPageFile@@@UnBCL@@@UnBCL@@",
        "JET_errDeleteBackupFileFail",
        "ERROR_IPSEC_IKE_PROCESS_ERR_DELETE",
        "878L8U8s8",
        "WIMExtractToHandleFromMountReparseDataEx",
        ">%>;>X>e>",
        "Adding drive %s to be processed",
        "ERROR_IPSEC_IKE_LOAD_SOFT_SA",
        "0,171E1l1s1z1",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *> *)",
        "ERROR_IPSEC_IKE_ATTRIB_FAIL",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCDrvStoreProperty@@@UnBCL@@@UnBCL@@",
        ":::_:o:",
        "CARPValidator::ValidatePreExecution",
        "Failed to set key for executed status. Error: 0x%08X",
        "> >V>k>w>",
        "si-LK",
        ".?AUINewSystem@SetupPlatform@@",
        ".?AV?$DefaultInstanceFactory@VCEnableSafeOSPageFile@@@UnBCL@@",
        "757N7b7v7",
        "OPERATIONTRACK: CNewSystem Release",
        "??0StreamReader@UnBCL@@QAE@PBVString@1@PAVEncoding@1@@Z",
        "CExecuteUnattend::DoExecute: Couldn't get pass status for %s: 0x%08x",
        "ERROR_BAD_LENGTH",
        ">>>T>p>",
        "int __thiscall UnBCL::ArrayList<__int64>::IndexOf(__int64,int,int) const",
        "PWh(0",
        ".?AUISetupPlatform@SetupPlatform@@",
        "414F4X4f4u4",
        ">,>J>m>",
        ">MdSpu",
        ".PAVSystemException@UnBCL@@",
        "8 8.8=8K8R8X8]8h8s8",
        "=2=>=P={=",
        "First boot apply is complete, nothing to do",
        "1&151D1W1a1f1r1z1",
        "<;<B<H<M<X<c<w<",
        "uINSTALL.ESD",
        ">1>=>P>a>q>v>",
        "?GetHashCode@String@UnBCL@@UBEHXZ",
        ".?AV?$ArrayList@PAVCCmdLineExecutionTelemetryData@OC@@@UnBCL@@",
        "QueueCreateFile called for fail-forward system %s, %s -> %s",
        ".?AV?$SerializableBase@V?$Array@PAVCAppInfo@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCAppInfo@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "IsBoot",
        "ERROR_INVALID_TRANSACTION",
        "                                   BIOS version : %s",
        ">->4>:>?>J>T>",
        "There are %d snapshots to delete",
        "9 9$9,9094989@9D9H9L9P9T9\\9`9d9l9t9x9",
        "Failed copying string",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVDiskLayout@@@UnBCL@@@UnBCL@@",
        "fQfVg",
        "6)7I7c7",
        "6 6$6,6064686H6X6`6d6h6l6t6x6|6",
        ";$;,;4;D;L;T;\\;h;",
        "=$=,=7=?=R=Z=_=f=s=",
        "2'2=2K2T2]2f2p2y2",
        "j/[f;",
        "?\"?(?-?8?D?S?_?",
        ">!>5>C>K>Q>V>[>y>",
        "RtlAppendUnicodeToString",
        "Y&iSan",
        ".?AU?$IEnumerable@PAVCBcdSetting@@@UnBCL@@",
        "auto __thiscall ForEachVolume::<lambda_803a65feb47116ea67afdf78ddf6f929>::operator ()(struct SetupPlatform::IPartition *,SetupPlatform::PARTITION_PROPERTIES *const ) const",
        "  Final decision for the update: %s",
        "878v8",
        ".?AVCXXXXXHandledException@?2??Rollback@CSetupPlatformPrivate@@UAEJW4ROLLBACK_PHASE@SetupPlatform@@HHPAU_PROGRESS_DATA@4@@Z@",
        "?@?G?M?R?]?d?x?",
        "81888>8C8N8X8k8",
        "CCleanupSnapshot::DeleteSnapshot: Failed to cleanup snapshot [%s]. Error: 0x%08X",
        "pAddSafeOSDrivers: Failed to open new OS DISM session. Error: 0x%08X",
        "8+838;8A8P8g8w8",
        "int __thiscall UnBCL::ArrayList<class CShellFolderInfo *>::BinarySearch(int,int,class CShellFolderInfo *,struct UnBCL::IComparer<class CShellFolderInfo *> *)",
        "6$606K6W6c6o6{6",
        "0 1d1",
        "Failed to remove directory",
        "8-888a8",
        ".?AU?$IList@PAVCCheckpoint@OSRollbackService@@@UnBCL@@",
        "0%030@0R0Z0`0m0",
        "=4>=>R>i>",
        "ERROR_DS_OPERATIONS_ERROR",
        "en-ZA",
        ".?AV?$CollectionBase@PAVCOptionalComponent@OC@@@UnBCL@@",
        "SPLoadKey",
        "ERROR_CLUSTER_INVALID_REQUEST",
        "MIG_UPGRADE",
        "WriteSectors: Failed to seek to offset 0x%I64x on disk. GLE is [0x%X]",
        "1S1{1",
        ";M;T;s;",
        "252P2c2",
        "0.080=0B0",
        "{7ebc3661-e661-4943-95a5-412378cb16d1}",
        "??1XmlDocument@XmlLite@UnBCL@@UAE@XZ",
        "XPrepare Safe OS boot removal",
        "teG;}",
        "1 1&1+161A1F1Z1k1",
        "4*464K4_4v4",
        "WIM Path",
        ".?AV?$DefaultInstanceFactory@VCEnableUsbDebugging@@@UnBCL@@",
        "? ?(?,?4?L?P?h?l?",
        "0:0^0f0",
        "30383>3G3]3k3",
        "<#<+<5<<<B<G<R<^<r<",
        "1(10161;1N1a1}1",
        "6s6z6",
        ";0;D;l;",
        "5 5(575@5I5]5~5",
        "Image Index: [%d]",
        "CreateProfileForUser succeeded but the user has no profile",
        ".PAVCXXXXXHandledException@?M@??QueueOCReplication@CNewSystem@@UAEJW4SP_ERROR_HANDLING@SetupPlatform@@@Z@",
        "0)0W0l0",
        "090G0_0~0",
        "%s (%s), long running: %s, rearms: %d, time(seconds): %d",
        "2/2<2V2j2",
        "Enabling Setup Autologger session with default providers",
        "SPScheduleSnapshotCleanupTask: Failed to remove existing snapshot cleanup task. Error: 0x%08X",
        "4'4.4>4J4V4e4t4",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class SysprepComponent *>::MoveNext(void)",
        "<%<2<G<U<c<q<",
        ">;>B>H>M>Y>g>p>v>",
        ".?AV?$SmartPtr@VCImageInfoSet@@@UnBCL@@",
        ";.;9;G;U;c;",
        "long __stdcall SPGetWIMImageInfo(class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::String *> *,unsigned long,enum SetupPlatform::IMAGE_TYPE *,unsigned short **,unsigned short **,unsigned short **,unsigned short **)",
        "808W8}8",
        "626B6I6Y6",
        ">$>4>D>T>d>t>",
        "7$70757>7J7V7[7d7k7x7",
        "Error copying boot files from %s to %s! Last Error = %#x",
        ".?AUWmiLogCallback@WMI@@",
        "686Q6d6",
        "ERROR_DS_WRONG_LINKED_ATT_SYNTAX",
        "CRYPT_E_ASN1_LARGE",
        "\\$4Ph",
        "SafeOS,End",
        "CSIDL_COMMON_STARTMENU",
        "ERROR_CLUSTER_NODE_PAUSED",
        ".?AU?$IList@UPartition@DiskLayout@@@UnBCL@@",
        "y/Wj%h",
        "REG_DWORD",
        "\\Program Files (Arm)",
        "3%363C3R3X3d3u3",
        "9#9-9",
        "CDeploymentProject::CreateVHDDeployment: Failed to detach temporary VHD. Error: 0x%08X",
        "<.<?<L<T<j<v<~<",
        "SetupPlatform: Executing StartAsync commands: Failure while executing commands.",
        "int __stdcall UnBCL::MP::ThrowCompare<struct DISK_SPACE_IMPACT>::Compare(struct DISK_SPACE_IMPACT,struct DISK_SPACE_IMPACT)",
        "4\"4,4?4R4x4",
        "WinRE driver removal is not required",
        "Failed setting staged state for package %S",
        "unsigned short *const &__thiscall UnBCL::ArrayList<unsigned short *>::get_Item(int) const",
        ":#:4:<:E:M:S:h:t:",
        "    Failed to get element metadata keys",
        ":):0:=:T:d:p:x:",
        "CInstallDUUpdatesOffline::DoExecute: Image is no longer serviceable; leaving. hr = 0x%x",
        "BiCreateBootEntry: Could not retrieve BCD Object application path. Status: %x",
        "No deferred service to disable",
        "No hard disk space needed, in absence of cab file extraction",
        "CCallRegisterRecoveryImage::DoExecute",
        "5S5b5",
        "ERROR_LOG_FILE_FULL",
        ";$;,;4;<;D;L;T;\\;d;l;x;",
        "5$6P6",
        "dbase\\ntsetup\\setupplatform\\lib\\tracing\\diagtrack.cpp",
        ".?AUITelemetryActivity@@",
        ".?AVCXXXXXHandledException@?8??AddToImageInfoSet@CImageInfoSet@@SGJPAV2@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@KPAV?$ArrayList@PAVCImageInfo@@@4@PBG4PAUtagWDS_CLI_CRED@@W4IMAGE_TYPE@SetupPlatform@@@Z@",
        "9!929;9H9Q9Y9`9o9",
        "__thiscall UnBCL::ArrayList<class COSPieceInfo *>::ArrayList(const struct UnBCL::ICollection<class COSPieceInfo *> *)",
        "<$<8<E<d<j<}<",
        "6#6R6b6",
        "JET_errTooManySorts",
        "4(40484@4H4X4|4",
        ".?AV?$SmartPtr@VCBasicEnv@Mig@@@UnBCL@@",
        ":/:U:a:z:",
        "?'?9?C?L?V?b?k?t?~?",
        "6,636H6X6i6{6",
        ";3<F<T<`<h<",
        "AccessPaths",
        "Np Sh",
        "string copy failed: %s, 0x%x",
        "=!=4=e=z=",
        "9 9-929_9p9w9}9",
        "RPRRj",
        "%hs: %s does not exist, skip.",
        "SysprepSession::Execute: Get NULL for EditionId string from registry key",
        "mn-Mong",
        "trPWQ",
        ":$:):=:I:^:k:r:",
        "Proceed",
        "9 919H9X9i9s9",
        "8&8-8A8V8d8",
        "SHLWAPI.dll",
        "pSPHardLinkFileForTask",
        "SPRemoveScheduledTask",
        "@u)j@j",
        "7+73797F7X7",
        "CSetupPlatformRollback::WriteBootInfoGUID",
        "515B5x5",
        ".?AV?$SmartPtr@VCOCDismAdapter@OC@@@UnBCL@@",
        "0C1J1\\1a1m1}1",
        "ERROR_LOG_POLICY_ALREADY_INSTALLED",
        "8$8,848<8D8L8T8l8t8",
        "  File System = %s",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@KPAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "4)4.474H4S4`4m4y4",
        "int __stdcall CProcessDrivers::ReadFileInTable(const unsigned short *,class UnBCL::Hashtable<class UnBCL::String *,unsigned long> *)",
        "</<;<G<S<_<k<w<",
        " (only in OS namespace)",
        "y.h\\'",
        "%hs: Full upgrade to specialized image is not supported",
        "%hs: Cannot delete %s. Error: %u",
        "6'6-6A6L6S6Y6e6p6{6",
        ":#:*:5:@:F:Z:e:l:s:~:",
        "< <$<4<8<H<L<\\<`<p<t<",
        "1S1c1",
        "=&=.=a=i=n=",
        "ERROR_PROCESS_ABORTED",
        "Setting WMI Uint32 property %s: can't convert to VARIANT type %d",
        "void __thiscall UnBCL::Array<class CGlobalPathFindData *>::RemoveAt(int)",
        "DiskLayoutMakeRecovery: Failed to get volume for Recovery partition (0x%08x)",
        "CAbstractWriter::AccumulateHashableBlocks",
        "939W9{9",
        ".PAVCXXXXXTemp@?3??DoExecute@CUnmountWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "x69T$",
        "0*0A0M0[0v0|0",
        "D$,PW",
        ":\":(:5:;:@:p:",
        "6k6r6",
        "CMediaLayout::QueueAuditScript: Failed to queue file copy from %s to %s: 0x%08x",
        "9%979?9E9R9d9r9",
        ":#:7:D:I:R:n:u:|:",
        "1?1c1u1}1",
        "Failed to query boot entry order. Status: %x",
        "{1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}",
        "5)5;5P5`5r5",
        "void __thiscall UnBCL::ArrayList<class OSRollbackService::CCheckpoint *>::set_Item(int,class OSRollbackService::CCheckpoint *)",
        ".PAVCXXXXXHandledException@?BJO@??Rollback@CSetupPlatformOSSwitchCheckpoint@@UAEXPBG@Z@",
        "344t4",
        "SL_E_CHPA_TIMEBASED_ACTIVATION_BEFORE_START_DATE",
        "?1?6?u?",
        "Failed to open boot manager object. Status = 0x%X",
        ";(;/;;;B;P;",
        "Failed to copy %s to %s. Error: 0x%08X",
        ";%;A;K;U;[;h;",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::Add(class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *)",
        "_DismGetInstallLanguage",
        "3@5V5",
        "1I2c2x2",
        ">->5>?>H>[>b>h>m>y>",
        "3&3S3l3",
        "VdsPlatform::Initialize: Can't create VDS loader instance (0x%08x)",
        ">:>m>",
        "pSPSplitWim: Failed to create folder %s (0x%08x)",
        "646<6H6h6p6x6",
        "?get_Attributes@XmlNode@UnBCL@@QAEPAVXmlAttributeCollection@2@XZ",
        "Vj7hh",
        ";*;1;7;<;G;N;",
        ".?AU?$IEnumerable@PAVCFilterDriverInfo@@@UnBCL@@",
        "<)<1<7<D<V<`<u<}<",
        "3$3:3A3G3L3W3b3o3w3",
        "9#9*91979C9W9e9s9",
        "6$606<6H6T6`6l6x6",
        "da-DK",
        "434:4",
        "ERROR_TRANSACTION_ALREADY_ABORTED",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@_JPAVCGlobalPath@@@UnBCL@@@UnBCL@@",
        "Install OS updates (DU) to keep installation up-to-date",
        "OneSettingsQuery",
        "CDeploymentBase::CleanupMounts: Error deleting file %s",
        "7#787F7T7b7",
        "OLE32.dll",
        ":$:+:2:::D:N:U:\\:d:n:x:",
        "void __thiscall UnBCL::ArrayList<class COSPieceInfo *>::QuickSort(class UnBCL::ArrayList<class COSPieceInfo *> *,class UnBCL::ArrayList<class COSPieceInfo *> *,int,int)",
        "4!4+4A4H4Q4V4a4o4u4",
        "0&040B0P0",
        "WinRePostBCDRepair",
        "ERROR_IPSEC_IKE_NEG_STATUS_BEGIN",
        "ERROR_CREATE_FAILED",
        "DiskLayoutMakeReserved: Skipping MSR creation because this disk has an MBR",
        "3@3o3x3",
        "<4===c=r=|=",
        "ControlSet001\\Control\\WMI\\GlobalLogger",
        "9)9;9c9o9",
        "%s\\%s\\System32\\Config",
        "6\"6~6",
        "0-020O0[0b0i0u0",
        "<(<2<<<S<a<k<u<",
        ":#:8:F:T:b:",
        "int __thiscall UnBCL::ArrayList<class CFilterDriverInfo *>::LastIndexOf(class CFilterDriverInfo *,int,int) const",
        "EDITIONID",
        "0$050<0I0W0_0h0q0",
        "7*7C7g7",
        "2)2Q2r2y2",
        "0(040T0`0",
        "SetupPlatformExternal.ini",
        "]_^[]",
        "474>4D4I4T4_4s4",
        "CDeploymentProject::CreateFolderDeployment",
        "182p2",
        "%hs: BCD Open failed, cannot remove uninstall entry %s. Error: 0x%08X",
        "SclRegLoadUnloadHive",
        "0'0@0I0R0[0d0m0v0",
        "|SYSPART|\\BOOTTGT",
        "1K1W1i1",
        "ERROR_INVALID_LOGON_TYPE",
        "CSetupAutomation::Initialize: Couldn't create configuration: 0x%08x",
        "PPPh0",
        ".PAVCXXXXXHandledException@?2??SPFindVssSnapshot@@YGJU_GUID@@0PAPAVString@UnBCL@@@Z@",
        ".?AV?$SmartPtr@U?$IEnumerator@UPartition@DiskLayout@@@UnBCL@@@UnBCL@@",
        "0.0;0I0Z0c0p0",
        "WIM entry for %s no longer exists, was likely removed before getting here.",
        "=H=m=",
        "5 5+575K5Z5",
        "COperation::StreamWrite",
        "xWj2WS",
        "D$ j8",
        "y,VjFh",
        "9^`u9SS",
        "EnumResourcesForExport",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,&protected: static unsigned long __stdcall UnBCL::Hashtable<class UnBCL::String *,unsigned long>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,class ATL::CElementTraits<unsigned long> > const *,struct __POSITION * const &)>::Reset(void)",
        "Failed to set bootmgr resume object. Status = [%x]",
        "Metadata",
        "ERROR_TRANSACTION_REQUIRED_PROMOTION",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::set_Item(int,class UnBCL::DictionaryEntry<class UnBCL::String *,long> *)",
        "OpenThread",
        "void __thiscall UnBCL::Array<class CShellFolderInfo *>::RemoveAt(int)",
        "int __stdcall SPIsPathInCurrentWindowsNamespace(class Mig::CBasicEnv *,class UnBCL::String *)",
        ".?AV?$DictionaryEntry@PAVCGlobalPath@@PAVString@UnBCL@@@UnBCL@@",
        "Main gather (Machine Independent)",
        "CDeploymentProject::CreateFolderDeployment: Failed to copy setup platform from [%s] to [%s]. Error: 0x%08X",
        "VdsPartition::RefreshVdsProperties",
        ".?AVCXXXXXHandledException@?BF@??SPGetExistentImageInfo@@YGJPBGPAW4IMAGE_TYPE@SetupPlatform@@PAPAG2222@Z@",
        ".?AV?$CAutoRelease@PAVVdsImageDisk@@@RAII@@",
        "SPUpdateUserModeTracingLocation",
        "Catalog length = %d, Hashtable length = %d",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CProfileInfo *>::Reset(void)",
        "u<Vj@",
        "1,141_1",
        "8!8=8c8",
        "<8<N<`<",
        "9)9K9c9i9{9",
        "FIOGetFileNameFromId",
        ".?AU?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@",
        ".?AV?$SerializableBase@VCExportWIM@@$0A@V?$DefaultInstanceFactory@VCExportWIM@@@UnBCL@@@UnBCL@@",
        "WdsCliAuthorizeSession",
        "SL_E_CHPA_INVALID_PRODUCT_KEY_CHAR",
        "2B2W2g2x2",
        "    Failed to copy path string",
        ">\">@>e>{>",
        "7.8L8V8w8}8",
        "SPDiagTrackSetCorrelationVector",
        "yuWh4",
        "41474A4F4P4W4e4w4",
        "Wow64DisableWow64FsRedirection",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CRegCreationData *>::MoveNext(void)",
        "Object GUID: %s",
        "na:TotalSectors",
        "ERROR_NO_PROC_SLOTS",
        ";I;h;n;w;",
        "xSPDeleteTempPageFileForCrashDumpCapsule",
        "ERROR_TOO_MANY_CMDS",
        "ERROR_ALREADY_INITIALIZED",
        "<#<1<?<M<",
        "%hs: Bitlocker already suspended. Taking no action.",
        "> >(>0>8>H>l>t>|>",
        "MALLOC failed",
        ";K;];e;k;x;",
        "Failed to remove elment.",
        "L$8PW",
        "ERROR_REMOTE_SESSION_LIMIT_EXCEEDED",
        "1%1+181J1X1{1",
        ",SVWj",
        "fo-FO",
        "Microsoft\\Windows\\CurrentVersion\\Setup\\ImageServicingData",
        "9#9D9_9e9r9",
        ":+:<:C:\\:w:",
        "yCBcdSettings::Apply",
        "class UnBCL::Object *__thiscall Mig::CKeywordTree::FindLongestMatch(class UnBCL::String *,int,int) const",
        "ERROR_NET_WRITE_FAULT",
        "2+222<2M2Z2d2s2|2",
        "6<6I6n6u6{6",
        "??6SerializationStream@UnBCL@@QAEAAV01@_K@Z",
        "ERROR_SXS_XML_E_WHITESPACEORQUESTIONMARK",
        "9(9/959:9E9P9d9",
        "3#3,3T3e3m3z3",
        ".idata",
        "DiskLayout::VerifyLayoutModifiedOrder: however, partitions cannot be relocated on disk.",
        "CheckDataAvailableForHash",
        "SPCreateSnapshotWithScoping: Failed to create snapshot. Error: 0x%08X",
        "<(<6<><D<I<]<o<",
        "CFlowValidator::ValidatePreExecution",
        "9&949H9|9",
        "Waiting for cancel thread to return",
        "4!4B4_4i4",
        ".?AVCXXXXXHandledException@?CN@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "ERROR_DDE_FAIL",
        "unsigned char __thiscall UnBCL::_::ArrayListEnumerator<unsigned char>::get_Current(void) const",
        "5-6`6",
        "5$5*5/5:5A5F5Z5",
        "SetupPlatformOnlineApplyCheckpoint",
        "4>5P5X5^5k5}5",
        "5=5E5S5Y5f5k5{5",
        "SysprepSession::ExecuteAction: Error bypassed for stopService operation",
        "0$010F0T0b0p0",
        " (reboot requested)",
        "? ?'?-?2?=?H?X?e?n?w?~?",
        "728z8",
        ".PAVCXXXXXHandledException@?MG@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "not performed",
        "pFindOccupiedRegions: Can't get partition properties (0x%08x)",
        "TUVWXYZ[",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCFailForwardSystem@@@UnBCL@@@UnBCL@@",
        ".?AVSmDiskPartitionEnumerator@@",
        "121F1S1m1",
        "0$101N1Z1l1",
        "ApplyServicingSettings",
        "1\"1+121;1S1Z1l1",
        "WIMCaptureImageInternal",
        "es-NI",
        "8/878A8H8N8S8^8e8j8~8",
        "No OS partition information was found. Assuming partition was not extended.",
        "Multiple non-removable disks found; cannot choose a boot disk (0x%08x)",
        ":%:+:8:J:X:o:",
        "5&5=5T5m5",
        "21262;2G2",
        "0 0$0(0,00040<0@0D0H0L0P0X0\\0`0d0h0l0p0t0x0|0",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *> *)",
        "SPReportSnapshotState: Snapshot size for [%s]:",
        "=M>j>y>",
        "ERROR_FILE_NOT_ENCRYPTED",
        "6+676B6J6W6^6~6",
        "WimFindClose",
        "GetElementMetadata",
        "int __thiscall UnBCL::ArrayList<unsigned long>::BinarySearch(int,int,unsigned long,struct UnBCL::IComparer<unsigned long> *)",
        ".PAVCXXXXXTemp@?FC@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "5'545<5L5Z5m5x5",
        "0i0g1",
        "4!4*434<4E4V4`4l4x4",
        "\\\\?\\PhysicalDrive%d",
        "2(2:2C2O2X2q2{2",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::Remove(class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *)",
        "SPCleanupAfterRollback: Cleaning up %s",
        "ar-AE",
        "{1BFF0ED9-3E87-4629-9806-B25854FD34AE}",
        "8#8.848G8z8",
        "??1?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@UAE@XZ",
        "NtLoadKey2",
        "CRYPT_E_ISSUER_SERIALNUMBER",
        "Failed to write verbose logging to %s. Error: 0x%08X",
        "? ?(?/?a?",
        ">G?Z?s?z?",
        "8$9`9",
        "RootKey",
        "FillRect",
        "2$2C2M2X2",
        "020_0g0q0y0",
        "DiskLayout::FindPartitionByOrdinal",
        "FreeDiskSpaceBegin",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CGlobalPathFindData *>::Reset(void)",
        "5:5p5",
        "RPC_S_NOT_LISTENING",
        ".PAVCXXXXXTemp@?3??MoveOrCopyUpdates@CDownloadDUUpdates@@IAEJPAVCDUPackageCollection@@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@@UnBCL@@PAX@Z@",
        "<#<(<3<:<?<S<c<",
        "9$9/9C9k9",
        ">,>1>y>",
        ": :%:0:;:A:F:[:b:h:m:x:",
        "Index",
        "6'676@6H6S6[6e6u6",
        "CAddAppxPackage::DoExecute: Failed to initialize DISM. Error: 0x%08X",
        "1(2/2;2B2H2M2X2e2m2s2",
        "ERROR_ALERTED",
        ".PAVCXXXXXHandledException@?JI@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "NtEnumerateKey",
        "=%=;=B=H=M=X=b=g={=",
        "6\"6/676=6C6S6g6s6",
        "WimLazyInitialize",
        "Cannot map user hive %s in HKEY_USERS\\%s. Error: 0x%08X",
        "ERROR_INFLOOP_IN_RELOC_CHAIN",
        ".?AV?$SerializableHashtableBase@PAVString@UnBCL@@PAUISerializable@2@@_@UnBCL@@",
        "=!>W>\\>{>",
        "CFastDeleteImplT<class CDirectoryProviderT<class CWindowsOldAdaptor>,1>::SppDeleteSnapshots",
        "GetVolumeNameForVolumeMountPointW",
        "<,<><F<L<Y<k<",
        "IMAGE\\WINDOWS\\VERSION\\MINOR",
        "Processing WIMBoot entry:",
        "SVWh0",
        "Partition Style = GPT",
        ".?AV?$CAutoDelete@PAVCImageInfoSet@@@RAII@@",
        "ERROR_UNKNOWN_FEATURE",
        ">,>8>L>W>d>t>",
        "7!7'767<7G7N7S7\\7c7h7q7x7}7",
        "CBS_E_ALREADY_INITIALIZED",
        "ERROR_PRIMARY_TRANSPORT_CONNECT_FAILED",
        ".?AV?$ArrayListEnumerator@PAVCFailForwardSystem@@@_@UnBCL@@",
        "5 545R5n5",
        "1!1*131<1E1O1X1n1",
        "Fail to check whether the [%s] changed. Error: 0x%08X",
        "pExtractWinREFromImage: Failed to get device element data. Error = 0x%08X",
        "JET_errMultiValuedColumnMustBeTagged",
        "7(767X7f7t7",
        "DeleteFileEx: Unable to get information on [%s]; GLE = 0x%x",
        ".?AV?$SerializableBase@V?$Array@PAVCWIMBootData@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCWIMBootData@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "#text",
        "1\"2*2c2j2p2u2",
        "636@6W6]6j6|6",
        "RollbackExecuteSequence: Failed to retrieve CheckpointImpressario.",
        ".?AV?$Hashtable@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@UnBCL@@",
        "SPAPI_E_INVALID_DEVINST_NAME",
        "Class GUID: %s",
        "%hs: Failed to convert rollback GUID. Error: 0x%08X",
        "fil-PH",
        "?GetStringValue@RegistryKey@UnBCL@@QAEPAVString@2@PBV32@H@Z",
        "818L8e8w8",
        "SetThreadIdealProcessor",
        "%hs: Begin run. WinOld: %s",
        ";:<_<h<q<z<",
        "5$5,545<5L5T5\\5t5|5",
        "void __thiscall UnBCL::ArrayList<class CGlobalPath *>::AddRange(const struct UnBCL::ICollection<class CGlobalPath *> *)",
        "?$?,?4?<?D?L?T?\\?d?l?t?|?",
        "7-7b7",
        "?MakeTrim@MutableString@UnBCL@@QAEXPBG@Z",
        "OC::COCDismAdapter::EnableDisableOCs",
        ".?AV?$ValueCollection@PAVString@UnBCL@@PAUISerializable@2@@_@UnBCL@@",
        "MinSectorCount",
        "Marking event [&SclEvent_RetargetLinks_Stop]",
        "?0?K?\\?",
        "CSetupPlatform::OptInToSqm",
        "DismountRegistryHives",
        "{77DAAD34-0187-4489-93F0-99E4897C3C3C}",
        ">1>:>H>O>U>Z>e>p>",
        "Elements",
        "Background color set to (%d %d %d)",
        "Successfully updated the boot sector",
        "ERROR_SERVICE_NOT_IN_EXE",
        "5R5z5",
        "FileMax",
        "0(0L0T0\\0d0l0t0|0",
        "WIMBoot.DelayedDelete",
        "627]7b7",
        ">(>4>@>L>c>o>",
        "Reserved.Sysprep",
        ".?AV?$DefaultInstanceFactory@VCEmptyOperation@@@UnBCL@@",
        "  Signed: %s",
        "?+?9?B?K?Y?h?",
        "< <(<0<<<\\<d<l<t<|<",
        "CBS_E_DPX_JOB_STATE_SAVED",
        "DriverNewOSInjectFailedList",
        "&&&&&&&&",
        "3!373B3Q3]3x3",
        ">\">2>;>M>U>[>d>",
        "SPQueryReserveInfoInternal: Failed to get Update Reserve manager. hr = 0x%08X",
        "SPWimMergeCallback",
        "CCreateScopedSnapshot::DoExecute: Creating Upgrade snapshot",
        "Could not copy partition name to extend %s; partition will not be extended. Error: 0x%08X",
        "6F7Z7l7t7z7",
        "9A:W:^:d:i:t:",
        "ERROR_CLUSTER_NETWORK_NOT_FOUND",
        ".PAVCXXXXXTemp@?GL@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "FatalErrorCode:%d",
        "7 7(707<7D7l7",
        "IsWindowVisible",
        "FreeSpaceEstimatedFromSoftReserve",
        "?!?+?0?5?I?Z?",
        "6%676E6i6",
        "< <(<,<4<8<<<@<H<L<T<X<\\<`<h<l<x<|<",
        "2 2$2(2,24282<2@2H2L2P2T2\\2`2d2h2p2t2x2|2",
        ".?AV?$SerializableBase@VCEmptyOperation@@$0A@V?$DefaultInstanceFactory@VCEmptyOperation@@@UnBCL@@@UnBCL@@",
        "7a9h9",
        "%s-%s-%s-%s-%s-%s-%s-%s-%s-%s-%s-%s",
        "8$8x8",
        ".?AV?$SerializableBase@V?$Array@PAVCFailForwardSystem@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCFailForwardSystem@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "SPAPI_E_INVALID_PROPPAGE_PROVIDER",
        "Failed to create apply directory %s",
        "SL_E_MISMATCHED_APPID",
        "1M1a1",
        "0 000@0P0`0d0t0x0",
        "CRYPT_E_INVALID_PRINTABLE_STRING",
        ".?AUIUninstall@SetupPlatform@@",
        "0\"060=0C0H0S0]0q0",
        "9Z9a9}9",
        "void __stdcall UnBCL::_::HTEnumerator<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<void *,void *> * __stdcall UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::DictionaryEntry<void *,void *> *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *> *,class UnBCL::Array<class UnBCL::DictionaryEntry<void *,void *> *> *,int)",
        "4A5V5k5",
        "4\"4P4a4v4",
        "DownlevelOSVersion",
        ":.:4:I:]:i:r:",
        "CSetupPlatformPrivate::Execute",
        "4&464@4R4Z4`4j4t4",
        "base\\ntsetup\\opktools\\sysprep\\platform\\sysprepcomponent.cpp",
        "8Z8n8",
        "0)0@0T0i0",
        "S _^[",
        "6&6-676D6W6b6v6",
        "2!2(2.232>2F2Z2o2",
        ">!>3><>E>N>W>`>i>r>{>",
        "Failed mark %S as installed.",
        "int __thiscall UnBCL::ArrayList<class CFailForwardSystem *>::LastIndexOf(class CFailForwardSystem *,int,int) const",
        "ObjectID",
        ".PAVCXXXXXHandledException@?KP@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "%hs: Profile for %s(%s) has been moved. Expected linked profile from %s to %s but found regular profile. Uninstall validation will fail.",
        "6$6.6E6S6]6f6o6",
        "\\FVEAPI.DLL",
        "SETUPPLATFORMCOMM: Received DISCONNECT progress message. Waiting for a new connection.",
        "ERROR_SERVICE_LOGON_FAILED",
        "7:7L7S7Y7^7i7t7",
        "<.<C<R<\\<a<i<p<|<",
        ";';.;B;Y;r;y;",
        "<?<F<L<Q<\\<g<{<",
        "sah-RU",
        "D$TPh",
        "111S1h1q1}1",
        "SERIALIZEVERBOSE: Serializing operation: %s",
        ";&;D;Z;s;",
        "Failed to allocate boot entry buffer.",
        "2!2+2B2P2Z2d2n2x2",
        ":(:1:C:[:",
        "\\\\.\\MountPointManager",
        "7&787@7F7Z7`7i7",
        "CFG Validator: Failed to process section [%s]. Error: %08X",
        "OFFLINE PROFILES: Offline profile creation is not available",
        "__thiscall UnBCL::ArrayList<struct SetupPlatform::IDisk *>::ArrayList(const struct UnBCL::ICollection<struct SetupPlatform::IDisk *> *)",
        "PREVALIDATION: Validator failed: %s (%s). Error: 0x%08X",
        "=$=4=D=H=X=\\=l=p=",
        "Error creating temp file.",
        "1(13181L1g1",
        "Backing up recovery image partition from %s to %s",
        "MoveDirectoryEx: Specified directory [%s] doesn't exist",
        "CNewSystem::QueueInstallDynamicUpdates: Failed to queue update %s; hr = 0x%x",
        "4-4>4F4S4m4",
        "3:4c4",
        "%hs: cannot convert %s to a GUID. Error: 0x%08X",
        "718r8",
        ":3:<:E:N:W:t:",
        "ImageMarshallHandle",
        "CreateFile failed",
        "2*2B2H2^2o2x2",
        "373^3k3",
        "Skipping operation (lack of disk space): %s",
        ".?AV?$DefaultInstanceFactory@VCSetSafeOSBootCommand@@@UnBCL@@",
        "CSetupAutomation::ResolveTarget: Failed to enumerate partitions: 0x%08x",
        "class COperationInfo *&__thiscall UnBCL::ArrayList<class COperationInfo *>::get_Item(int)",
        "CCFGSectionRegistry::Initialize",
        "ERROR_MEDIA_OFFLINE",
        "9[9q9",
        "x^VSh",
        "8)8m8",
        "8)8I8S8p8",
        "292V2",
        "rFrameworkBasic",
        "pRegOfflineGetDWord",
        "SPUninitializeNetwork",
        "CanBePooled",
        "CMediaLayout::QueueAuditScript: Failed to query whether automation has audit payload: 0x%08x",
        "Set reg key value NumberOfReboots failed: 0x%x",
        ":+:J:",
        ".PAVWin32Exception@UnBCL@@",
        "<%<2<G<M<{<",
        "5#5.5H5^5n5{5",
        "9*989A9J9S9\\9e9n9w9",
        "ERROR_DS_DRA_BAD_INSTANCE_TYPE",
        "Value [%ws] is not registry string value",
        "=J=Q=W=]=h=r=w=",
        "=(=4=<=T=\\=t=|=",
        "\\Windows\\System32\\WimBootCompress.ini",
        "Successfully moved %s to %s",
        ">*>2>8>A>W>a>v>",
        "404F4W4l4t4z4",
        "ERROR_INSTALL_TRANSFORM_FAILURE",
        "JET_errSessionContextAlreadySet",
        "0\"0/0<0U0~0",
        "<R<z<",
        "?AddStackTrace@Exception@UnBCL@@QAEXPBD@Z",
        "=$=,=4=L=T=\\=d=l=t=",
        "sysprepOrder",
        "ERROR_CTX_NO_FORCE_LOGOFF",
        "6)676>6D6I6T6^6r6",
        ";$;0;<;H;T;`;l;x;",
        "?Concat@String@UnBCL@@SGPAV12@PBG000@Z",
        "6-686H6R6d6l6r6|6",
        "9&949@9I9U9^9i9w9",
        "ERROR_PNP_REBOOT_REQUIRED",
        ".?AVCCmdLineExecutionTelemetryData@OC@@",
        "ExternalEntropy",
        "8 8,8L8X8|8",
        "XBugcheck",
        "VdsPlatformDiskEnumerator::GetNext: Failed to query VDisks (0x%08x)",
        ".?AV?$__func@V<lambda_4b29d149b8821cfbae4eba16ce6a2849>@@$$A6G_NPAXI0II@Z@__function@wistd@@",
        "SmDisk::InitializeProperties: Failed to determine disk SMART status: 0x%08x",
        "6#6/6;6G6",
        "<(<2<<<F<P<j<{<",
        "=6=R=Y=_=d=o=z=",
        "SPGetWIMImageInfo: Found previously loaded software hive, possibly from ungraceful exit. Unloading it",
        "?.?;?D?L?Z?b?w?",
        "6 6$6(6,6064686<6@6D6L6d6h6",
        "CWinOldCleanup::DoExecute",
        "ERROR_CLUSTER_NODE_SHUTTING_DOWN",
        ".?AVCXXXXXHandledException@?PG@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "?Exists@Directory@UnBCL@@SGHPBVString@2@@Z",
        "RtlFormatCurrentUserKeyPath",
        ".?AV?$HTDictEnumBase@PAUIVdsDisk@@@_@UnBCL@@",
        ".PAVCXXXXXHandledException@?DL@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "7P8Y8",
        "JET_errDatabase200Format",
        "ERROR_CONNECTION_ACTIVE",
        "GetTickCount",
        "Failed to expand default EFI application location.",
        "414>4L4b4",
        "7 787@7X7`7h7|7",
        "6!616>6C6L6Y6`6j6{6",
        "Capacity",
        "BcdExportStore: Failed delete existing file at %ws. Status: %x",
        ";=;X;^;h;m;w;~;",
        "??0XmlDocument@XmlLite@UnBCL@@QAE@XZ",
        "pStrings",
        ".?AV?$DefaultInstanceFactory@VCStartSystemServices@@@UnBCL@@",
        ".?AV?$SmartPtr@U?$IEnumerator@PAX@UnBCL@@@UnBCL@@",
        ".PAVCXXXXXHandledException@?M@??SPDeleteOldUpgradeSnapshots@@YGJPAVString@UnBCL@@PAUITelemetry@@PBGHPAPAV23@PAU_FILETIME@@PA_J@Z@",
        "6\"6,6=6D6J6O6Z6e6y6",
        "7#7:7P7",
        "<\"<X<o<~<",
        "=(=8=@=H=N=S=e=u=",
        "void __thiscall UnBCL::ArrayList<unsigned char>::CopyTo(class UnBCL::Array<unsigned char> *,int) const",
        ":%:*:>:F:Q:c:w:",
        "<$<,<4<<<D<L<",
        "ERROR_EXE_CANNOT_MODIFY_STRONG_SIGNED_BINARY",
        "Start.Backup",
        "1 141B1]1l1s1y1",
        "pSPSplitWim",
        "Apply statistics: framework",
        ".?AV?$CAutoDeleteArray@PAU_EVENT_TRACE_PROPERTIES@@@RAII@@",
        "SetupPlatfrom: Executing %s commands",
        "<*<<<B<T<e<r<{<",
        ";$;);4;@;F;Z;h;",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings",
        "ERROR_CLIPPING_NOT_SUPPORTED",
        "CreateStreamOnHGlobal",
        "2$2C2R2Y2",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
        "CTelemetry::MoveTelemetry",
        "=)=1=;=K=W=i=",
        "<$<*<0<6<<<B<H<N<T<Z<`<f<l<r<x<~<",
        ": :4:Y:}:",
        "=$=,=4=<=D=L=T=\\=d=p=",
        "8^8y8",
        "OS Version info is missing from the transformers INI file %s",
        "767M7a7o7",
        ".?AU?$IEnumerable@PAUIDisk@SetupPlatform@@@UnBCL@@",
        "%hs: %s value not found",
        ": :$:(:,:4:8:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:",
        "long __thiscall CRelocateOS::DoExecute(struct IExecutionContext *,void *,struct IInternalOperationsProgress *)",
        ".PAVCXXXXXHandledException@?GN@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "pAddSafeOSDrivers: Failed to mount image to %s (0x%08x)",
        ":$;:;Y;g;",
        "void __thiscall UnBCL::ArrayList<class CDriverInfo *>::CopyTo(class UnBCL::Array<class CDriverInfo *> *,int) const",
        "Set reg key value MaxFileSize failed: 0x%x",
        ";0;A;V;",
        "CNewSystem::QueueSetupAutomation: Failed to get data migration (0x%08X)",
        ":);0;6;;;F;P;c;};",
        "ERROR_NOT_ENOUGH_MEMORY",
        "?!?1?N?k?y?",
        "2 2(282@2\\2t2|2",
        "tfj,j",
        "3 3&3+363C3W3f3o3",
        "Failed to enumerate devices for driver package, returned Err = 0x%lx",
        "GetPrivateProfileSectionW",
        "=$>+>1>6>A>I>f>x>",
        "FlowConstraintReason",
        "DeletePath: Failed to obliterate [%s] after %d tries; GLE = 0x%x",
        "4 4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4",
        "JET_errDiskFull",
        "MachineSpecific_XMLs",
        "Environment",
        "volume format",
        "?F?T?`?i?q?~?",
        "= =3=E=l=",
        ";\";.;:;F;R;_;k;w;",
        "7 7D7L7T7\\7d7l7t7|7",
        "Server",
        "3(3/363",
        ".PAVCXXXXXTemp@?IN@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "?,?=?J?R?d?l?r?",
        "Neo installation path is turned off, pushing WIM apply to SafeOS phase",
        "%hs: User %s%s%s%s from the new system does not have an equivalent on the old OS. Will not be restored.SPDoEndInstallApply",
        "D$4SP",
        "=+=3=9=F=X=f=",
        "?D?p?",
        "?&?,?1?<?F?Y?a?z?",
        "SppDeleteSnapshots failed. hr = 0x%x",
        "Environment variable SP_ENV_TEST_DYNAMIC_UPDATE_PATH is set with non-existent path [%s].",
        "1)171E1S1",
        "ERROR_INVALID_OWNER",
        "ProvisioningPackage::GetNotes",
        "base\\ntsetup\\lib\\instextdrvrs\\src\\instextdrvrs.cpp",
        "= =$=8=<=L=\\=l=p=",
        ">/>F>\\>c>j>u>",
        "%hs: Deleting old BCD store failed, gle = [0x%X]",
        ":Y:z:",
        "8!808;8F8_8m8}8",
        "OpenThreadToken",
        "(%lx): Failed NtOpenFile on [%ws]",
        "CReconstructOS::TearDownCbsLogging: Failed to open HKLM\\System\\Setup: 0x%08x",
        "ERROR_MCA_INVALID_CAPABILITIES_STRING",
        "5!5'545",
        "4\"5)5/545@5M5a5",
        "6(6V6",
        "Uninstall apply completed successfully",
        "7S7]7",
        "ProfilesFolder",
        "D$$P3",
        "JET_errNullKeyDisallowed",
        "6:7d7",
        "pExtractWinREFromImage: Failed to set WIM temp directory to %s (0x%08x)",
        "<\"<)<=<Q<r<",
        "0'0=0J0R0a0n0v0",
        "4(4?4X4q4",
        "SPExecuteGather",
        "?-?6?<?I?O?T?",
        "3!3\\3",
        "Copying COMPONENTS hive from old windows.",
        "CDeploymentProject::CreateBootableMediaDeployment: Drive changed on disk re-format: [%c] -> [%c]",
        "4\"5>5K5e5",
        ":\":/:6:C:J:S:i:~:",
        "WIM\\IMAGE[*]",
        "=#=8=T={=",
        ":$:5:@:J:Z:c:k:",
        "IsAllUserProfileMigrated",
        "Failed to initialize objects key for store. Store: %s StoreKey: %ws Status: %x",
        "MIG_PLUGIN_CALL_TIMEOUT",
        "%hs: CI EAs cannot be applied at this time.",
        ".?AVArgumentNullException@UnBCL@@",
        "XSPFixOOBE",
        "    Failed to add metadata file",
        "Failed to get registry value. Status: %x",
        "7!7-787L7W7c7o7w7",
        "949D9f9",
        "5%6A6K6U6[6h6",
        "ATTLIST",
        "3!323E3V3d3p3|3",
        ">\">4>P>W>]>i>u>",
        "<!=&=A=",
        "2\"2.252;2@2K2Y2m2y2",
        "SVjD3",
        "7'7/757B7T7~7",
        ".?AV?$CAutoCleanupBase@PAVVdsDisk@@@RAII@@",
        "5%5-5=5M5g5z5",
        "ERROR_ENVVAR_NOT_FOUND",
        "pAddSafeOSDriversFromProvPackage: Failed to get next element for provisioning package %s (0x%08x)",
        "{ebd0a0a2-b9e5-4433-87c0-68b6b72699c7}",
        "ERROR_NETWORK_ACCESS_DENIED",
        "CDownloadDUUpdates::FilterUpdates: Allocation of DISM driver arrays failed. hr = 0x%x",
        "CMediaLayout::ExecuteOptimization",
        "CSetupPlatformTracing::SetTracingMode",
        "SL_E_CAL_PRINCIPAL_UNKNOWN",
        ".?AV?$HTEnumerator@W4OP_OPERATION_ID@@HUTableKey@?$Hashtable@W4OP_OPERATION_ID@@H@UnBCL@@W41@UKeyTraits@34@$1?RetrieveKey@34@KG?AW41@PBV?$CAtlMap@UTableKey@?$Hashtable@W4OP_OPERATION_ID@@H@UnBCL@@HUKeyTraits@23@V?$CElementTraits@H@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "sMAINOS",
        "CSetupAutomation::SetDUOptIn",
        ";$;0;T;\\;d;l;t;|;",
        "f;<Ht",
        ";5;Z;};",
        "3(4h4",
        ";%<G<_<t<{<",
        "1*2K2c2",
        "Incorrect mappings detected in apply phase, apply will continue but there might be errors",
        "CDUPackageCollection::Append: IDUUpdateCollection::GetCount failed. hr = 0x%x",
        "pRemoveOEMDriver",
        "BootCommandRecovery",
        ">(?/???d?|?",
        "4(555M5",
        "7@8R8Z8`8m8",
        "2\"232:2@2E2P2[2`2t2",
        "Cannot reset file attributes for %s. Error: 0x%08X",
        ">!>6>H>P>V>j>p>y>",
        "na:ClusterSize",
        "?&?D?r?~?",
        "RPC_S_GRP_ELT_NOT_REMOVED",
        "0\"141<1B1O1a1o1~1",
        "Failed to open online DISM session. Error: 0x%08X",
        "ERROR_FLOAT_MULTIPLE_TRAPS",
        "=!=7=]=",
        "4.5r5",
        "The specified key is invalid",
        "?(?T?",
        "void __thiscall UnBCL::ArrayList<enum OP_EXECUTION_PHASE>::Resize(int,int)",
        "3!3*3;3B3H3M3X3c3h3|3",
        "7(71797M7T7Z7_7j7t7~7",
        "5$5+555F5S5\\5m5z5",
        "3%313?3X3]3i3y3",
        "1 1%101;1O1p1",
        "base\\ntsetup\\migration\\setup\\oc\\lib\\src\\cmdlinemanager.cpp",
        "CBS_E_INVALID_NO_PRODUCT_REGISTERED",
        "pSPDeleteExpiredUpgradeSnapshots",
        "DISKSPACETRACK: WindowsOld.wim size: %I64u",
        "?;?M?U?[?h?z?",
        ".?AVCVhdBootData@@",
        "Successfully %s update %s to %s",
        "4 424@4X4]4t4",
        "50575>5D5Q5f5t5",
        "ERROR_CTX_WINSTATION_ACCESS_DENIED",
        "3;4o4",
        "ERROR_CONVERT_TO_LARGE",
        "SPUninitializeNetwork: Failed to get appropriate WinPE functions; Error: 0x%08X",
        "535`5r5",
        "WinREBeginAvailableDiskSpace",
        "CSetupPlatformCheckpoint::CopyLogFiles: An error occurred while processing the IIS log folders",
        "VdsPartition::GetResizeBounds: Couldn't get disk object (0x%08x)",
        "jdY+M",
        "7<7L7\\7l7|7",
        "CSetupPlatformPrivate::Execute: Execution of operations queue failed, abandoning. Error: 0x%08X",
        "? ?-???M?f?m?t?z?",
        "4-4=4M4U4_4e4y4",
        "6$6,646<6H6l6t6|6",
        "PWh(S",
        "6\"6*62676K6a6",
        "JET_errDatabaseSharingViolation",
        ".?AV?$SerializableBase@VCBasicEnv@Mig@@$0A@V?$DefaultInstanceFactory@VCBasicEnv@Mig@@@UnBCL@@@UnBCL@@",
        "DuplicateHandle",
        "323D3L3R3[3q3{3",
        "DISKSPACETRACK: Consumed     : %I64d",
        ";T<f<n<t<",
        "GetAnswerFileContentsAsUnattend: Failed to get deployment options from answer file to inject: 0x%08x",
        "> >C>a>x>",
        "keep protection active for OS volume",
        "$9|$ u",
        "ERROR_SXS_KEY_NOT_FOUND",
        "Failed to remove kernel file operations journal, error: 0x%08X. Error is fatal.",
        ":&:=:J:W:j:",
        "5)535:5G5S5\\5h5m5v5",
        "    Failed to copy element index string",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,int>::Remove(class UnBCL::String *)",
        ".?AV?$SerializableBase@V?$Array@PAVCGlobalPath@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCGlobalPath@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "j1j%j",
        ";&;:;A;P;W;",
        "<#<G<W<^<f<m<}<",
        "SL_E_SFS_DUPLICATE_TOKEN_NAME",
        "WINDOWS/SERVICINGDATA/IMAGESTATE",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCWIMBootData@@@UnBCL@@@UnBCL@@",
        "SKIPBOOTTRACK(SAFEOS): %hs: Disabled SafeOS skip. Error: 0x%08X",
        ".?AV?$CAutoRelease@PAUIDisk@SetupPlatform@@@RAII@@",
        ".Push Button Reset - Edition",
        "ts-ZA",
        "JET_errBadItagSequence",
        "OC::CInstalledOCStore::CInstalledOCStore",
        "ERROR_INTERNAL_DB_CORRUPTION",
        "t_Wh`",
        "6+6R6]6",
        "?GetSystemInfo@Environment@UnBCL@@SGPBVSystemInfo@2@H@Z",
        "onecore\\base\\cbs\\pbr\\offlinereghelper.cpp",
        "919G9]9v9",
        "ERROR_DS_NOT_CLOSEST",
        "050E0L0R0W0b0l0",
        "< <%<0<7<O<X<s<z<",
        ".?AV?$SerializableBase@VCRegisterAsyncProcess@@$0A@V?$DefaultInstanceFactory@VCRegisterAsyncProcess@@@UnBCL@@@UnBCL@@",
        ".?AVCXXXXXHandledException@?FF@??pSPDoOfflineApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0H0PAUISPMigProgress@@@Z@",
        "?/?F?_?}?",
        "1,1D1L1T1|1",
        "Failed to get archecture from ssshim.dll.",
        "Kernel-ProductInfo",
        "?GetPathRoot@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        "|$ WQQh",
        "Failed to re-extend the OS partition. Error: 0x%08X",
        "?*?2?M?U?_?f?l?q?|?",
        "1L2c2j2q2x2~2",
        ".idata$5",
        "?get_Item@XmlAttributeCollection@UnBCL@@QAEPAVXmlAttribute@2@PAVString@2@@Z",
        "SetupPlatform::IsUninstallAllowed: Uninstall is %sactive",
        "OperationErrorCode",
        "8&9<9",
        ".?AV?$CAutoCleanupBase@PAUtagVS_FIXEDFILEINFO@@@RAII@@",
        ".?AV?$CAutoRelease@PAUIPartitionEnumerator@SetupPlatform@@@RAII@@",
        ".PAVCXXXXXTemp@?DK@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "8)838:8@8E8P8\\8a8u8",
        "<2=9=F=M=",
        "Failed to get offline user migration OneSetting, 0x%x",
        "5%6X6",
        "%hs: Context or FOD list ID is null, nothing to do",
        "pSPRemoveUpgradeRegTree",
        "SmDiskPartitionEnumerator::GetNext: Failed to move to the next MSFT_Partition (0x%08x)",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,class ATL::CElementTraits<class CDriverInstallInfo *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,class UnBCL::Array<class UnBCL::String *> *,int)",
        "6#686?6E6J6U6\\6p6",
        "5%5+505;5F5Z5c5l5}5",
        "ExpandEnvironmentStringsW",
        "CBCDManipulator::SetDisplayList: Non existing entry in list {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}.",
        "5.5<5H5Q5Z5c5l5u5",
        "1 1-161C1L1o1x1",
        "NtQueryWnfStateData",
        ".PAVCXXXXXHandledException@?5??SPFindSnapshotProp@@YGJPAVString@UnBCL@@PAU_VSS_SNAPSHOT_PROP@@@Z@",
        "SPReserveSpace",
        "040904B0",
        "CApplyDrivers::ParseDrivers",
        ".?AVCBackupRecoveryPartition@@",
        "t;j#j",
        "0$0+03080H0S0_0l0v0",
        "Failed to open file: %S",
        "Microsoft Time-Stamp Service0",
        "ERROR_SXS_INVALID_ACTCTXDATA_FORMAT",
        "1#1)1P1b1o1",
        "Failed to apply BCD setting. hr = 0x%x",
        "SetupPlatform.exe",
        "545S5w5",
        "?E?L?",
        "748;8A8F8Q8^8c8",
        "pCreateSystemRootDriveMapping: Expected to find a \\ in offline Windows dir [%s]",
        "CDownloadDUUpdates::DoExecuteInternal: Insufficient space to install updates; will skip installation.",
        "4#4-4O4c4q4",
        "Boot WinPE",
        "ERROR_CANTFETCHBACKWARDS",
        "Failed to add source at %S",
        "?$?-?6???H?Q?Z?c?l?",
        ".?AVCOrchestrateOSSwitch@@",
        "Redmond1",
        "int __thiscall UnBCL::ArrayList<unsigned char>::LastIndexOf(unsigned char,int,int) const",
        "void __thiscall UnBCL::Array<struct SetupPlatform::IDisk *>::InitLarva(class UnBCL::ArrayList<struct SetupPlatform::IDisk *> *)",
        "7!7(7.737>7I7Y7e7q7v7",
        "First UX",
        "JET_errIndexTuplesSecondaryIndexOnly",
        "ERROR_INVALID_TASK_INDEX",
        "%hs: Failed to write rollback boot entry GUID to %s. Error: 0x%08X",
        ":%;O;",
        "0$0*0/070=0L0[0~0",
        "7*777K7Q7Z7c7u7",
        "CdPQV",
        "int __thiscall UnBCL::_::ArrayListEnumerator<unsigned int>::MoveNext(void)",
        "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8",
        "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464",
        ":\":6:]:d:r:y:",
        "010J0`0k0{0",
        "nMicrosoft-Hyper-V-Hypervisor",
        "3!3'343F3T3x3",
        "void __thiscall UnBCL::_::ArrayListEnumerator<unsigned long>::Reset(void)",
        "SL_E_DATATYPE_MISMATCHED",
        "PWVho",
        "ERROR_INVALID_ACCOUNT_NAME",
        "ERROR_SYSTEM_POWERSTATE_COMPLEX_TRANSITION",
        "2'212?2I2P2^2f2p2x2",
        "3-383B3V3",
        "Phpy`",
        ".?AV?$DefaultInstanceFactory@VCCreateRegistryForNewSystem@@@UnBCL@@",
        "\\Control\\Wmi\\AutoLogger\\SetupPlatform]",
        "int __thiscall UnBCL::Array<unsigned short *>::Add(unsigned short *)",
        ".?AV?$SerializableBase@V?$Array@PAVCOptionalComponent@OC@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCOptionalComponent@OC@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "0#070D0a0",
        "UncompressFile failed",
        "CBS_E_XML_PARSER_FAILURE",
        "4&4+464E4h4",
        "3.3R3d3l3r3",
        ".?AV?$SerializableBase@VCSetupPlatform@@$0A@V?$DefaultInstanceFactory@VCSetupPlatform@@@UnBCL@@@UnBCL@@",
        "onecore\\base\\ntsetup\\provpackageapi\\lib\\helper.cpp",
        ".?AVVdsImageDisk@@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *> *)",
        "SL_E_CHPA_INVALID_PRODUCT_KEY_FORMAT",
        "191P1a1w1",
        "7#7(7<7I7P7V7[7f7s7y7",
        "2$2(282<2L2P2`2d2t2x2",
        "apply-success",
        "Failed to read output %s of call to method %s on %s, although the output exists; unexpected type? (0x%08x)",
        "Skip OnError phase on old version of OS",
        "9$909T9\\9d9l9t9|9",
        "fVf@fPfH",
        "t!Shp",
        "CurrentIP",
        "PVWh]",
        "8\"8*808=8O8Y8l8t8z8",
        "=M=e=o=v=",
        ": :*:3:;:B:L:U:]:m:v:",
        "int __stdcall UnBCL::MP::OperatorCompare<__int64>::Compare(__int64,__int64)",
        "636b6i6o6u6",
        "pGetMemorySizes: Failed to query memory status: 0x%08x",
        "Cannot map classes hive %s in HKEY_USERS\\%s. Error: 0x%08X",
        "int __thiscall UnBCL::ArrayList<class CGlobalPathFindData *>::LastIndexOf(class CGlobalPathFindData *,int,int) const",
        ".PAVCXXXXXHandledException@?BC@??DoExecute@CUnmountWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "=)=[=`=u=",
        "4B4I4O4T4_4j4o4t4",
        "SPDeleteAllSnapshots: Failed to convert %s to VSS_ID. Error: 0x%08X",
        "4(464A4L4~4",
        "SVhX`",
        "^<9^<v",
        "FveGetStatus",
        "j<h8%^",
        "|SYSPART|\\|BOOTMGR|",
        "=5===C=W=m=r=",
        "292E2]2c2u2",
        "?'?/?9?F?S?[?b?m?{?",
        ":(:G:f:",
        "Failed to create new windows.",
        "ERROR_SXS_XML_E_MULTIPLEROOTS",
        "2$2*20262<2B2H2N2T2Z2`2f2l2r2x2~2",
        "\\\\.\\PHYSICALDRIVE%d",
        "bs-BA-Latn",
        ".PAVCXXXXXTemp@?LM@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "9q\\t7",
        "9/9:9G9W9c9k9r9",
        ";5;<;",
        "ERROR_TRANSACTIONMANAGER_IDENTITY_MISMATCH",
        "?%?H?a?h?o?v?}?",
        "0&040;0E0R0d0n0",
        ";&;-;3;8;C;Q;W;x;",
        "    CBS folder: %s",
        "{4d36e979-e325-11ce-bfc1-08002be10318}",
        "void __thiscall UnBCL::Array<class COperationResult *>::InitLarva(class UnBCL::ArrayList<class COperationResult *> *)",
        "??0InvalidOperationException@UnBCL@@QAE@PBG@Z",
        "718E8W8_8e8n8",
        "=/=R=i=",
        "ERROR_TRANSFORM_NOT_SUPPORTED",
        "8<9o9",
        ".?AV?$ArrayListEnumerator@UDISK_SPACE_IMPACT@@@_@UnBCL@@",
        "6F6M6^6d6|6",
        ".?AVCOCValidator@@",
        "2%222;2B2L2]2j2s2z2",
        "fRfQfRf",
        "7-7E7d7k7y7",
        "<$<9<?<L<^<l<",
        "4$5H5",
        "5(5K5R5X5]5h5s5",
        "0#010?0u0",
        "DiskLayout::ApplyProperties: Failed to mark partition as active: 0x%08x",
        "2\"272;2K2a2w2",
        "%hs: Failed to add CBS package. Error: 0x%08X",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::Insert(int,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *)",
        "CSetupAutomation::Resurrect: Failed to initialize WPX configuration: 0x%08x",
        "6!6'6-63696?6E6K6Q6W6]6c6i6o6u6{6",
        "WWWWS",
        "DiskLayout::CreatePartition",
        ":):::G:P:]:f:n:~:",
        "class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::get_Item(int) const",
        ".?AV?$SerializableBase@VCDUClientAppInfo@@$0A@V?$DefaultInstanceFactory@VCDUClientAppInfo@@@UnBCL@@@UnBCL@@",
        "%c:%s",
        "void __stdcall UnBCL::_::HTEnumerator<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *> __stdcall UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::DictionaryEntry<void *,void *> *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *> *,class UnBCL::Array<class UnBCL::DictionaryEntry<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *> > *,int)",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,&protected: static unsigned long __stdcall UnBCL::Hashtable<class UnBCL::String *,unsigned long>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,class ATL::CElementTraits<unsigned long> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "DiskLayout::Create: Failed to read disk's existing partition layout (0x%08x)",
        "Failed to open object. Status = [%x]",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::set_Item(int,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *)",
        "f;F$u",
        ".PAVCXXXXXHandledException@?4??DoExecute@CCreateScopedSnapshot@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "JET_errCheckpointDepthTooDeep",
        "CFinalizeCriticalBoundary::DoExecute",
        ".PAVCXXXXXHandledException@?IM@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "ITaskDefinition::get_RegistrationInfo failed. hr = 0x%x",
        ":4:;:B:H:T:f:t:",
        "0Q0^0p0x0~0",
        "VERBOSE: PREVALIDATION: Executing validator: %s (%s)",
        "4(4,4<4@4P4T4d4h4x4|4",
        ".?AVCStartSystemServices@@",
        "void __thiscall UnBCL::ArrayList<void *>::Resize(int,int)",
        "SP_VALIDATOR_INFO",
        "PackagePath cannot be NULL.",
        "SL_E_CAL_STORE_COLUMNISNULL",
        "5#5-525F5^5",
        "<*<O<V<\\<a<l<r<",
        "3)30373=3I3[3i3w3",
        ">*>7>@>L>X>s>",
        "WaitForThreadpoolTimerCallbacks",
        "8$8,848D8L8X8`8",
        ";<;A;o;",
        "{74BFAAE0-F483-4E61-8819-CD53F1D81ACB}",
        ".?AV?$SerializableArrayBase@PAVCMountedPathInfo@CDeploymentBase@@@_@UnBCL@@",
        "<2<7<<<F<r<",
        "Delete image path: %d",
        "ERROR_DS_DRA_NO_REPLICA",
        "989F9O9X9a9j9s9|9",
        ";*;J;_;",
        "1'2D2f2",
        "encoding",
        ".?AU?$IEnumerable@PAVCDeploymentBase@@@UnBCL@@",
        "BcdInitialized",
        ".?AU?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAUHKEY__@@@UnBCL@@@UnBCL@@",
        "Failed to set boot options. Status: %x",
        "= =*=4=K=T=^=h=r={=",
        "=!=G=t=",
        "%hs: Setting %s environment variable to: %s",
        "4(4<4R4f4y4",
        "SVWj@3",
        ": :6:J:}:",
        "4 4o4z4",
        ".PAVCXXXXXHandledException@?FB@??pSPDoOfflineApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0H0PAUISPMigProgress@@@Z@",
        "7!7d7",
        "ERROR_DS_ATT_SCHEMA_REQ_SYNTAX",
        "9!9-9=9B9N9d9n9",
        "CRYPT_E_NO_REVOCATION_DLL",
        "='>.>G>",
        ".?AV?$SmartPtr@VCICBStore@@@UnBCL@@",
        "FirstBootPreSysprepStartTime",
        "CLPValidator::ValidatePostExecution",
        "PVWh(",
        "SmPoolDisk::GetProperties",
        "%hs: Failed to remove %s, error: 0x%08X",
        "4#4G4",
        "Add unattend",
        "%hs: Upgrade internal session not available; will do normal startup.",
        "ERROR_INCOMPATIBLE_SERVICE_PRIVILEGE",
        "868H8Z8l8~8",
        "ocsToEnable",
        "4j4u4",
        "disk clean",
        "WShx9",
        "9%:,:::s:",
        "Drive path = %s",
        "%hs: No fail-forward data found, cannot continue.",
        "SPAPI_E_DEVICE_INTERFACE_ACTIVE",
        "%hs: Cannot create Setup Platform object. Error: 0x%08X",
        "0<0N0V0\\0i0{0",
        "{4D36E967-E325-11CE-BFC1-08002BE10318}",
        "BCryptCloseAlgorithmProvider",
        "8(8,8<8@8P8T8d8h8x8|8",
        "<.<@<R<\\<c<i<n<y<",
        "4L5w5|5",
        ".?AVCXXXXXHandledException@?5??GetCurrentDiskSpaceRequirements@CDeploymentBase@@QAEJPA_K0@Z@",
        ": :D:L:T:\\:d:l:t:|:",
        ".PAVCXXXXXTemp@?6??SPDeleteSnapshot@@YGJPAVString@UnBCL@@0@Z@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *> *)",
        "??4Object@UnBCL@@QAEAAV01@ABV01@@Z",
        "3-4E4P4|4",
        "void __thiscall UnBCL::ArrayList<class CGlobalPathFindData *>::Resize(int,int)",
        ";%;1;=;J;W;c;",
        "void __thiscall UnBCL::ArrayList<struct DISK_SPACE_IMPACT>::set_Item(int,struct DISK_SPACE_IMPACT)",
        "2 20282T2\\2l2t2|2",
        "5(535=5E5K5_5h5y5",
        "j:Xf;",
        "Mounting WIM file %s to %s",
        "0!0)0;0C0I0[0k0t0",
        "void __thiscall UnBCL::Array<unsigned long>::RemoveAt(int)",
        ".?AV?$SerializableBase@VCOperationQueue@@$0A@V?$DefaultInstanceFactory@VCOperationQueue@@@UnBCL@@@UnBCL@@",
        "Scratch path %s does not seem to be valid.",
        "memmove_s",
        "DiskLayout::Create: Failed to apply answer file layout to in-memory partition layout (0x%08x)",
        "FreeLibrary",
        "JET_errSPOwnExtCorrupted",
        ">#>*>5>>>M>]>",
        "1%1=1C1a1",
        "0)0@0N0d0r0{0",
        ".?AV?$SerializableBase@VCCreateFileForNewSystem@@$0A@V?$DefaultInstanceFactory@VCCreateFileForNewSystem@@@UnBCL@@@UnBCL@@",
        "@\\;B\\t",
        ".?AV?$SerializableBase@VCDumpSourcesData@@$0A@V?$DefaultInstanceFactory@VCDumpSourcesData@@@UnBCL@@@UnBCL@@",
        ".?AV?$SmartPtr@U?$ICollection@W4ActionType@@@UnBCL@@@UnBCL@@",
        "Failed to set bootmgr tools display order. Status = [%x]",
        "90959L9a9g9t9",
        "void __thiscall UnBCL::Array<class CPartitionInfo *>::Remove(class CPartitionInfo *)",
        "class OC::CCmdLineExecutionTelemetryData *const &__thiscall UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *>::get_Item(int) const",
        "?ToByteArray@MultiSz@UnBCL@@QBEPAV?$Array@E@2@XZ",
        "6&6G6P6d6m6",
        "int __thiscall UnBCL::ArrayList<class OSRollbackService::CCheckpoint *>::BinarySearch(int,int,class OSRollbackService::CCheckpoint *,struct UnBCL::IComparer<class OSRollbackService::CCheckpoint *> *)",
        "4&4:4P4f4|4",
        ".?AU?$ICollection@PAVCDriverInstallInfo@@@UnBCL@@",
        ".?AV?$CAutoHeapFree@PBG@RAII@@",
        ":&:.:4:A:S:c:~:",
        "bcrypt.dll",
        ":!:,:6:_:f:l:q:|:",
        "CmdLine",
        "?(?<?D?Y?b?h?u?",
        "ERROR_PROMOTION_ACTIVE",
        "?<?m?t?z?",
        "uw!\\$",
        "?$?)?4?F?N?T?Y?m?",
        "%0f0o0",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::IndexOf(class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *,int,int) const",
        "int __stdcall OC::OCCompareStatus(class UnBCL::String *,class UnBCL::String *)",
        "252G2O2U2b2t2",
        "?!?6?P?g?",
        "8p8w8}8",
        "=\"=-=>=F=S=[=a=u=",
        "434A4Y4k4",
        "1,1<1L1\\1l1p1",
        "0$0S0",
        "RewritePartition",
        "WINDEPLOY_ERR_ENV",
        "=(>/>5>:>E>L>`>s>",
        "\\Windows\\System32\\DriverStore",
        "Don't have the date/time label, cannot write the migration scope",
        ".?AV?$SmartPtr@V?$ArrayList@W4OP_OPERATION_ID@@@UnBCL@@@UnBCL@@",
        "2 2&2+262B2G2[2|2",
        ".?AV?$SerializableBase@V?$Array@PAVCCopyInfo@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCCopyInfo@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "<SVWh",
        "5<5`5",
        "spIsUninstallWindowOpen",
        "1!1)1=1F1P1]1k1|1",
        "1K1o1x1",
        "6+676O6a6s6",
        "jz^f;",
        "ERROR_SXS_XML_E_MISSINGWHITESPACE",
        ".?AV?$CAutoCleanupBase@PAUIVssEnumObject@@@RAII@@",
        "Microsoft reserved partition",
        "RegisterTraceGuidsW",
        "    Failed to write other node shallow",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@_JPAVCGlobalPath@@@UnBCL@@@UnBCL@@",
        "BiSpacesUpdatePhysicalDevicePath failed %x",
        "void __thiscall UnBCL::Array<struct PageFileDesc *>::Insert(int,struct PageFileDesc *)",
        "0)070@0I0W0f0",
        "242J2`2m2u2",
        "CMigrateFramework::DoExecute: Pending upgrade hive update request for setupcl",
        "VdsDisk::InitializeProperties: Failed to determine SMART status (0x%08x)",
        "ReadDirEntry",
        "CSetupPlatform::CreateDiskImage: Can't initialize disk provisioning! Error: 0x%08X",
        "VWhH]",
        "&jlSh",
        ".PAVCXXXXXTemp@?3??pSPCountMigUnitEvents@@YGIPAUIMigUnitNavigator@@HHH@Z@",
        "?#?/?7?M?T?Z?_?j?u?z?",
        ";#;<;E;V;`;r;{;",
        "5<5G5n5",
        "Failed to read install time for snapshot [%s] from registry key. Error: 0x%08X",
        "JET_errDatabaseCorruptedNoRepair",
        ">+>6>?>F>Q>c>j>",
        "JET_errCannotAddFixedVarColumnToDerivedTable",
        ".PAVCXXXXXHandledException@?2??SPExtendPartition@@YGJH_K0@Z@",
        "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[",
        "(0T1c1",
        "> >@>H>P>`>",
        "525@5E5J5U5w5",
        "5#5)525H5U5g5o5u5~5",
        "SetupPlatformTelActivityStarted",
        "SmVolume::ReadAllocUnit: Can't open %s to read allocation unit size (0x%08x)",
        "Failed to get proc address for ConstructPartialMsgVA.",
        "RtlSetBits",
        "?%?8?N?g?",
        "IVdsVolumeMF",
        "CBS_E_SOURCE_MISSING_FROM_WUSUS_BYPASS_CAB",
        "__thiscall UnBCL::ArrayList<class COperationsValidator *>::ArrayList(const struct UnBCL::ICollection<class COperationsValidator *> *)",
        "MIG Validator: Failed to revert execution of data gather operation. Error: %08X",
        "__thiscall UnBCL::ArrayList<class CProfileInfo *>::ArrayList(const struct UnBCL::ICollection<class CProfileInfo *> *)",
        "%hs: Failed to convert Safe OS entry GUID to string",
        "SetupPlatform:Launching narrator failed. Error: 0x%08X",
        ";1;C;X;h;y;",
        "Current retrieved on enumerator beyond list end",
        ".PAVCXXXXXHandledException@?2??DoExecute@CExecuteUnattend@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "ERROR_REMOTE_STORAGE_NOT_ACTIVE",
        "PWPPP",
        "StateStoreLoadMountEntryFromKey",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::MoveNext(void)",
        "CEnableTracingForImage::DoExecute",
        "2'2-262>2E2O2`2m2w2",
        "DiskLayout::FindTarget: Unknown disk property: %s",
        "; ;4;F;V;a;w;",
        "7.8Q9",
        "%hs: New display list has no elements, will not attempt to set it, rollback entry will remain visible",
        "ERROR_TS_INCOMPATIBLE_SESSIONS",
        "PSWVVh",
        "CImageHeaderWriterT<class CEmptyType>::Done",
        "626:6@6M6_6i6|6",
        "7'727>7L7`7e7q7",
        "FOD Validator: Execution of OC gather operation completed.",
        "FveGetSecureBootBindingState",
        "5\\5t5|5",
        "    %u",
        "int __thiscall UnBCL::ArrayList<class CDUPackage *>::IndexOf(class CDUPackage *,int,int) const",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAVCSPInternalPluginData@@UTableKey@?$Hashtable@PAVString@UnBCL@@PAVCSPInternalPluginData@@@2@PAV3@UKeyTraits@52@$1?RetrieveValue@52@KGPAV3@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAVCSPInternalPluginData@@@UnBCL@@PAVCSPInternalPluginData@@UKeyTraits@23@V?$CElementTraits@PAVCSPInternalPluginData@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        ".?AVCXXXXXHandledException@?FC@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "VERBOSEOPS: %sExecution phase %u is not part of the phases of the operations queue",
        "class COperationResult **__thiscall UnBCL::ArrayList<class COperationResult *>::GetBuffer(int)",
        "8.8C8R8\\8a8i8p8|8",
        ".?AV?$SerializableBase@VCInstallEula@@$0A@V?$DefaultInstanceFactory@VCInstallEula@@@UnBCL@@@UnBCL@@",
        ">'>7>h>m>}>",
        "=&=>=L=U=^=}=",
        "5#5>5C5p5",
        "nl-BE",
        "3(424?4E4L4V4c4j4t4",
        "tr-TR",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::LastIndexOf(class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *,int,int) const",
        "SPCreateSnapshotWithScoping: Successfully created snapshot [%s] on [%s] as [%s]",
        "9<9j9t9",
        "memcpy",
        "JET_errVersionStoreOutOfMemory",
        "4\"404@4E4J4^4m4v4",
        "CCleanupSnapshot::DeleteSnapshot: Prepare cleanup task",
        "> >$><>@>X>\\>t>x>",
        "4%4H4",
        "void __thiscall UnBCL::Array<class CUserProfile *>::RemoveAt(int)",
        "%hs: Executing offline apply operation",
        ".?AVCXXXXXHandledException@?2??BuildFoDList@CFODValidator@@IAEJPAUIExecutionContext@@PAV?$ArrayList@PAVString@UnBCL@@@UnBCL@@@Z@",
        "CreateWimQueue",
        "int __thiscall UnBCL::Array<class CCopyInfo *>::Add(class CCopyInfo *)",
        "%hs: Failed to get device element data. Error = 0x%08X",
        "Failed to flush system volume. Error = %#x",
        "(%lx): Failed to load hive: [%ws]",
        "SPGetGuidString",
        "  AddSpace: add: %15I64d, current: %15I64d, peak: %15I64d",
        "383c3",
        "??0?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAE@XZ",
        "ERROR_SXS_PROCESS_TERMINATION_REQUESTED",
        " http://www.microsoft.com/windows0",
        "RPC_S_UNKNOWN_IF",
        "1<1G1U1{1",
        "HKEY_USERS\\%s",
        "%hs: Unknown recovery image option %d. Abandoning.",
        "; ;+;8;=;C;M;Z;b;h;m;s;",
        ";(;\\;p;x;",
        ".?AVCXXXXXHandledException@?2??DoExecute@CExportWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ".?AU?$IEnumerator@PAVCOptionalComponent@OC@@@UnBCL@@",
        "MIG_COMPLETED_MIGUNITS_EXCEPTIONS",
        ".?AV?$CAutoRelease@PAVCTestHookDUUpdate@@@RAII@@",
        "OS partition information is incorrect. Assuming partition was not extended. Info read: %s",
        "3 3:3N3w3",
        "PSFX_E_INVALID_DELTA_COMBINATION",
        "4,444<4P4d4l4t4|4",
        "10;0B0H0M0X0d0x0",
        "No updates to download. Leaving...",
        "\\Program Files (Arm)\\Common Files",
        "WimMount.sys path: %s, build: %d",
        "  Driver Store properties:",
        "ERROR_CORE_DRIVER_PACKAGE_NOT_FOUND",
        "ParseDiskCriterion: Unhandled DiskMatch property type %u",
        ".?AVCXXXXXHandledException@?FB@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        ">*?B?[?c?{?",
        "ERROR_SXS_CANT_GEN_ACTCTX",
        ">1?>?P?X?^?k?}?",
        "7(787H7X7h7x7",
        "4-4K4Z4q4z4",
        "void __thiscall UnBCL::ArrayList<class OSRollbackService::CCheckpoint *>::QuickSort(class UnBCL::ArrayList<class OSRollbackService::CCheckpoint *> *,class UnBCL::ArrayList<class OSRollbackService::CCheckpoint *> *,int,int)",
        "spLogUpdateCollectionInfo",
        "CMergeWIM::DoExecute: Failed to create WIM file %s. Error: 0x%08X",
        "=%=E=S=]=f=o=",
        "9'9/9]9",
        "ControlSet001\\Control\\WMI\\Autologger\\SetupPlatform",
        "Unable to allocate buffer",
        "ReadOrWriteSectorsWinNt: Couldn't get handle to device [%s]",
        "7E7o7",
        "class CUserProfile **__thiscall UnBCL::ArrayList<class CUserProfile *>::GetBuffer(int)",
        "=)=6=C=P=]=j=w=",
        "CInstallDUUpdatesOffline::DoExecute: Failed to initialize DISM. Error: 0x%08X",
        "7\"7@7G7M7R7]7l7t7z7",
        "1&141B1P1",
        "Converting to NT filename failed",
        "Array doesn't support RemoveAt()",
        ".?AV?$ArrayListEnumerator@PAUPageFileDesc@@@_@UnBCL@@",
        "7.757<7B7N7`7n7|7",
        "1(171?1H1\\1e1n1w1",
        ".?AVISPPluginData@@",
        ".?AU?$ICollection@PAVCWIMEntryIndex@CWIMBootHelper@@@UnBCL@@",
        "ERROR_SERVICE_NOTIFICATION",
        "6S6r6",
        "L$\\_^[3",
        "8#8K8[8k8v8",
        "RPC_S_FP_DIV_ZERO",
        "ERROR_DS_OBJ_CLASS_VIOLATION",
        "                                   Processor architecture : %s",
        "DriverInfGetInfoFailedPath",
        "5$6a6",
        "class ISPPluginData **__thiscall UnBCL::ArrayList<class ISPPluginData *>::GetBuffer(int)",
        "CRYPT_E_SECURITY_SETTINGS",
        "3C3S3",
        "2B3x3",
        "Pre SysPrep",
        ":1;I;P;W;b;l;",
        ".?AVCXXXXXHandledException@?CM@??SPFixupRelocatedFolders@@YGJPAV?$ArrayList@PAVString@UnBCL@@@UnBCL@@PAV?$ArrayList@PAVCOSPieceInfo@@@3@1PAVString@3@@Z@",
        "WinRESkipOneSetting",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::get_Item(int) const",
        ";!;-;@;S;X;];",
        "%hs: Cannot reset setup state. Error: 0x%08X",
        "SysprepSession::ExecuteAction: Bad path %s passed for deleteFile operation",
        "%hs: Cannot retrieve volume name for the Recovery Image path.",
        "2 2H2d2h2l2p2t2x2|2",
        "ERROR_RESMON_CREATE_FAILED",
        "4(545?5M5u5",
        "7-7Z7d7|7",
        ".?AV?$HTEnumerator@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@UTableKey@?$Hashtable@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@4@PAV12@UKeyTraits@64@$1?RetrieveKey@64@KGPAV12@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@PAV?$DictionaryEntry@PAXPAX@3@UKeyTraits@23@V?$CElementTraits@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "class UnBCL::String *__thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "1-1C1h1",
        "CSetupAutomation::ResolveTarget: Failed to provision target disk: 0x%08x",
        "5!5/5P5W5",
        "9,9D9J9\\9p9}9",
        "wcschr",
        "SjdRP",
        ":$:):3:::H:Z:k:r:",
        "SetupPlatform: There is no migration, delete all snapshots",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@KPAVString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "2%222D2R2u2",
        "Pre-OOBE phase called again but we are already done with it",
        ".etl.00",
        "<#<(<3<=<B<V<q<",
        "> >)>2>;>D>",
        "Set reg key value LogFileMode failed: 0x%x",
        "0QRh4_",
        "Invalid Parameters",
        ">C?W?i?q?w?",
        "SaveOffset failed",
        "UniqueId",
        "6.6C6O6W6h6",
        ".?AV?$SmartPtr@V?$ArrayList@_J@UnBCL@@@UnBCL@@",
        "D$Hhp",
        "%hs: Failed to convert GUID to string. Error: 0x%08X",
        "3/3<3M3c3",
        "6F6R6h6u6",
        "AllocChunkInfo",
        "void __thiscall UnBCL::ArrayList<__int64>::Resize(int,int)",
        "ERROR_RM_CANNOT_BE_FROZEN_FOR_SNAPSHOT",
        "=L>n>",
        "%s-EulaLicenseFilename",
        "class UnBCL::String *__thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,class ATL::CElementTraits<class CDriverInstallInfo *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "0!0,0=0E0K0_0g0",
        "=*>T>s>",
        "666N6\\6l6s6y6~6",
        "OC::COCCbsAdapter::CbsUpdateToOC: Failed to get name for update. hr = 0x%x",
        "<&=B=b=|=",
        "?,?@?M?_?v?}?",
        "7;7T7f7n7t7",
        "<&=S=a=n=",
        "FirstBootSkipOff",
        "Leaving pSPStartAutoStartingServices",
        "1 161V1m1x1",
        "0(080H0X0h0x0",
        "9$989>9G9]9j9|9",
        "0&0>0D0U0n0x0}0",
        "3B3W3o3",
        "Run sysprep respecialization",
        ".PAVCXXXXXTemp@?DM@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "8#8*81888?8F8L8V8x8",
        "9#9@9S9p9v9",
        "; ;,;L;T;\\;h;",
        "4,4c4",
        "OperationName",
        "CSuspendBitlocker::CheckEncryptedByPath",
        "010<0P0e0u0",
        "unsigned short __thiscall UnBCL::_::HTEnumerator<unsigned short,int,struct UnBCL::Hashtable<unsigned short,int>::TableKey,unsigned short,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,&protected: static unsigned short __stdcall UnBCL::Hashtable<unsigned short,int>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned short,int>::TableKey,int,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "0#030G0a0",
        "PartitionNumber",
        "849<9W9_9h9",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAUISerializable@2@UTableKey@?$Hashtable@PAVString@UnBCL@@PAUISerializable@2@@2@PAU32@UKeyTraits@52@$1?RetrieveValue@52@KGPAU32@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@PAUISerializable@3@UKeyTraits@23@V?$CElementTraits@PAUISerializable@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "CAddSetupClRequest::DoExecute: Cannot load sam hive for offline OS %s. Error: 0x%08X",
        "3(333:3A3L3Z3b3t3{3",
        "OSVolumeFinder::Evaluate",
        "8'898a8m8",
        "CDownloadDUUpdates::CalculateSpaceNeeded: IUpdate::get_Identity failed. hr = 0x%x",
        ".?AVCXXXXXHandledException@?2??CreateFailForwardSystem@CNewSystem@@UAEJPBGPAPAUIFailForwardSystem@SetupPlatform@@@Z@",
        "8%8S8_8",
        "CDiskReader::GetBlockAllocationBitmapNtfs",
        "%hs: Size of current WinRE partition: %I64u",
        ">&>4>:>@>E>O>Y>c>m>{>",
        "QQQPPQ",
        "8%9I9`9",
        "1&1.141H1Q1Z1c1l1u1~1",
        "1%11161B1U1e1k1p1",
        "(%lx): Failed to calculate excluded hive path",
        "Skip Boot Validator: Cannot open volume for the OS partition (%s). Error: 0x%08X",
        "181C1f1",
        "3(363D3R3",
        "1(151M1x1",
        "2,292?2H2d2",
        "base\\ntsetup\\lib\\setupsecurity\\src\\setupsecurity.cpp",
        "%hs: Retrying on file [%s] GLE is [%d]",
        "SysprepSession::Execute: Encoutered mal-formed XPath; this is not expected",
        "InitializeCSI_BROKEN_COMPONENT",
        ".SYSPREP",
        "FIOOpenStreamById",
        "calloc",
        "2F2U2(353",
        "1#1*10151@1J1]1e1l1r1w1",
        "?+?<?C?I?N?Y?`?t?",
        "pReadUninstallWindowFromSource",
        "RPC_S_ENTRY_TYPE_MISMATCH",
        "ZwQueryInformationProcess",
        "8.8G8N8T8Y8d8r8",
        "8$8(888<8L8P8T8X8\\8d8h8l8t8x8|8",
        "1(12191?1D1",
        "9/949O9T9Y9c9z9",
        "?>?L?k?",
        "FreeSpaceReportHr",
        "000K0\\0",
        "9=9D9J9O9Z9f9z9",
        "VdsVolume::GetProperties: Failed to query IID_IVdsVolumeMF interface [%s] (0x%08x)",
        "No optimization support for requested update types; cannot optimize.",
        "tIf92tDj\\R",
        "070R0r0",
        "Successfully restored start type %u",
        "FOLDERID_CameraRoll",
        "DiskLayout::ApplyProperties: Failed to read target disk properties: 0x%08x",
        "PWVh]",
        "ASSERT: %hs",
        "ERROR_IPSEC_BAD_SPI",
        "232H2P2V2c2u2",
        ".PAVCXXXXXTemp@?GO@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "5!535E5W5m5",
        "=,>J>T>u>{>",
        "VERBOSEOPS: %sExecution phase %u is earlier or in the last completed phase %u",
        "ySetupPlatform",
        "3$3*373I3S3h3p3v3",
        "<,=2=?=F=O=Z=t=|=",
        "%windir%\\System32\\ProvMigrate.dll",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::set_Item(int,class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *)",
        "<6<@<J<P<^<",
        "%hs: OrchestrateOSSwitch: BCD Open failed. Error: 0x%08X",
        "1'1{1",
        "WdsCliFindNextImage",
        "8\"8-8:8N8V8]8d8j8p8|8",
        "OrchestrateStartSystemServices: Unable to create/open event to trigger start of autostart services; hr = 0x%x",
        ".?AV?$ArrayListEnumerator@PAVCBasicEnvEntry@@@_@UnBCL@@",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,&protected: static class CSPInternalPluginData * __stdcall UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,class ATL::CElementTraits<class CSPInternalPluginData *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        ";%;4;K;[;g;n;",
        "=)=5=>=G=P=Y=b=t=~=",
        "CFG Validator: Failed to initialize from registry [%s]. Error: 0x%08X",
        "6N6d6",
        "%hs: Top fail-forward option is complete, system will restart to continue installation.",
        "ProductType",
        ".PAVCXXXXXHandledException@?N@??SPProcessServiceDisable@@YGXPBG0@Z@",
        "export",
        ">/?<?N?V?\\?i?{?",
        "    Failed to assemble current directory string",
        "3/3?3Y3`3u3",
        "2!3&3+373`3o3",
        ".?AVInvalidOperationException@UnBCL@@",
        "WcpSetHelperCallback",
        "1'1,1A1W1t1{1",
        "xCDownloadDUUpdates::FilterUpdates",
        "SPDetachDiskImage",
        "RPC_S_UNSUPPORTED_TRANS_SYN",
        "<.<V<o<v<}<",
        "0%0*0f0|0",
        "0$0(0@0D0\\0`0x0|0",
        "9 9(909@9L9T9l9t9",
        "\"Microsoft Window",
        "FOLDERID_SavedSearches",
        ".?AVCXXXXXHandledException@?2??DoExecute@CExtractFilesFromWDSImage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "Process Name = %s",
        "2#3K3`3v3",
        "Replacing path %s as it's contained in %s",
        "2@2[2b2",
        "BfspCopyFile failed to delete temporary file (%s)! Last Error = %#x.",
        ".?AV?$CAutoCleanupBase@PAVCFfuInternalGenericProgress@@@RAII@@",
        "RpcBindingFromStringBindingW",
        ".?AV?$DictionaryEntry@GG@UnBCL@@",
        "Language Pack",
        "Add [%d] package %s",
        "ERROR_WX86_ERROR",
        "ValidateBinaryFileAndSetEA failed",
        "Store will be accessed with offline registry APIs.",
        "VdsPartition::RefreshVdsProperties: Failed to query IID_IVdsAdvancedDisk interface [%s] (0x%08x)",
        "\\??\\PhysicalDrive%lu",
        "CDiskReader::GetOsInformation",
        ":&:3:?:V:c:t:",
        "0$171=1R1i1y1",
        "ERROR_NO_SITE_SETTINGS_OBJECT",
        "SmVirtDisk::Delete: Can't delete underlying MSFT_StoragePool (0x%08x)",
        "9(9G9S9j9}9",
        "int __thiscall UnBCL::ArrayList<class CDUPackage *>::BinarySearch(int,int,class CDUPackage *,struct UnBCL::IComparer<class CDUPackage *> *)",
        "y.VjJ",
        "3I3Q3\\3d3",
        "XVPhh",
        "1\"1/191@1F1K1V1`1s1",
        "pFindAndAddFiles: Failed to copy %s to a new string; Error: 0x%08X",
        "RtlDeleteResource",
        "Unable to get procedure ParseManifestEx",
        "JET_errBackupNotAllowedYet",
        "6O6h6o6v6|6",
        ":H;];",
        "<(<.<}<",
        ".?AU?$IList@PAV?$DictionaryEntry@PAUIOperationsProgress@SetupPlatform@@K@UnBCL@@@UnBCL@@",
        "HPWhX",
        "SPAttachDiskImage",
        "ADVAPI32.dll",
        "828I8`8r8",
        "CRYPT_E_ASN1_EOD",
        "SjdPj2j",
        "ERROR_PRODUCT_VERSION",
        "CAddBootEntry::DoExecute",
        "=-=5=>=_=g=p=",
        "Set product key",
        "settings",
        "575M5`5u5",
        ">t_j0",
        "ERROR_SEM_TIMEOUT",
        "void __thiscall UnBCL::ArrayList<class CGlobalPath *>::Resize(int,int)",
        "7/878v8",
        "QSjeh",
        "=5=K=W=s=|=",
        "ERROR_CURRENT_DIRECTORY",
        "SPIsTargetTaggedForUpdate: Failed to get Scenario ID for [%s]. hr = 0x%08X",
        "?#?-?@?Q?]?e?k?p?",
        "Failed to open file %s for read! Error code = %#x",
        "ERROR_LOG_READ_MODE_INVALID",
        ">#>)>?>Y>^>d>",
        "Do not download.",
        "%hs: Cannot calculate offline drive mappings. Error: 0x%08X",
        "Rollback: Failed in ForcePrepareForUninstall. hr = 0x%08X",
        "wdscore.dll",
        "WARNING",
        "CreationTime",
        "ERROR_IPSEC_IKE_INVALID_CERT_KEYLEN",
        "sr-Latn-CS",
        "ERROR_INVALID_TABLE",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCOptionalComponent@OC@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "848<8D8\\8t8|8",
        "Certificate",
        ".?AU?$IList@PAVCDeploymentBase@@@UnBCL@@",
        "Pre OOBE Boot",
        "CTrustSafeOS::DoExecute: Failed to write hash to %s: 0x%08x",
        "ERROR_RESOURCE_REQUIREMENTS_CHANGED",
        "Mount Path:  [%s]",
        "void __thiscall UnBCL::ArrayList<class CBasicEnvEntry *>::RemoveAt(int)",
        "=0=4=L=P=h=l=",
        "5%525:5T5^5",
        "Failed to set the defatult ProductType",
        "onecore\\base\\cbs\\util\\inc\\CbsStringArray.h",
        "L$pPh",
        "CRYPT_E_NOT_CHAR_STRING",
        "848B8O8d8x8",
        "setupapi.app.log",
        "System32\\Drivers\\WinSetupBoot.sys",
        "9!9)9/9<9N9\\9",
        "ERROR_CANTWRITE",
        "fastfat",
        "6$6+6;6B6H6M6X6c6m6u6{6",
        "ERROR_PIPE_BUSY",
        "8$8;8M8S8e8v8",
        "OC Validator: Forcing validator failure due to environment variable.",
        "D$<Ph(",
        "  Language = %s",
        "CRYPT_E_ASN1_RULE",
        "Sj PjZ",
        "1\"2)2/242?2P2d2l2s2y2~2",
        ".?AV?$CAutoCleanupBase@PAG@Mig@@",
        "Failed to retrieve physical partitions. Last Error = %#x",
        "050U0m0",
        "VdsVolume::RemoveDriveLetter: Failed to get volume properties (0x%08x)",
        "3j\\Xf9",
        "?*?6?G?[?d?s?",
        "666P6e6m6s6",
        "SPAPI_E_DI_FUNCTION_OBSOLETE",
        "L$0QP",
        "5'5;5I5W5`5i5",
        "SPEstimateSizeOfFirstApply",
        "<#<-<7<A<K<Y<_<e<j<t<~<",
        "S@SPS",
        "%s,%s",
        "int __thiscall UnBCL::ArrayList<unsigned int>::BinarySearch(int,int,unsigned int,struct UnBCL::IComparer<unsigned int> *)",
        "ERROR_WAIT_63",
        "OSRollbackUtils::VolumeTracking::TrackVolume",
        ".?AV?$DefaultInstanceFactory@VCReserveSpace@@@UnBCL@@",
        "2#2)2.292C2V2b2l2y2",
        "<#<-<2<<<C<Q<c<t<{<",
        "0*080A0J0S0\\0e0n0w0",
        "ERROR_FOUND_OUT_OF_SCOPE",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@PAUIOperationsProgress@SetupPlatform@@K@UnBCL@@@UnBCL@@",
        "< <0<@<P<T<d<h<l<",
        "4!4,4v4",
        "VWj2^",
        "DiskLayout::ExecInitialize",
        "=,=4=:=C=Y=c=x=",
        "4$424@4N4\\4j4",
        "<,=D=Q=i=t=",
        "pSetEnvironmentFromConfigSection",
        "long __stdcall pParseRegFileForLoggerSettings(const unsigned short *,struct _LOGGER_SETTINGS *,struct _LOGGER_SETTINGS *)",
        "ERROR_DUPLICATE_SERVICE_NAME",
        "%hs: Could not find HKLM\\SYSTEM\\%s key for the offline system, perhaps this system was never started.",
        "Reserved.DynamicUpdate.FeaturesOnDemand",
        "    Failed to assemble directory path string",
        "ERROR_PATCH_MANAGED_ADVERTISED_PRODUCT",
        "SYSPREP_PLATFORM_PATH_TRANSLATOR_TEST",
        "7#7)7/757;7A7G7M7S7Y7_7e7k7q7w7}7",
        "-removesnapshot",
        "j(j'j&j",
        "SPDeleteSnapshot: Deleting snapshot [%s] on %s",
        "UpdatesFolder",
        "QueueDataImageApply called with drive %c",
        "070_0o0{0",
        "SeBackupPrivilege",
        "868N8l8|8",
        "2C2H2k2p2",
        "PVWh7",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::RemoveAt(int)",
        "3(30383>3S3i3",
        "?$?3?;?A?U?o?u?",
        "1;1X1",
        "Created boot entry 0x%x using cached variable",
        "0$0*00060<0B0H0N0T0Z0`0f0l0r0x0~0",
        ".?AUIProductKey@SetupPlatform@@",
        "long __stdcall SPSerializeOperations(class COperationQueue *,class UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *> *,const unsigned short *,int)",
        "D$ ht",
        "CreateWindowExW",
        ">/>F>\\>s>",
        "=#=)=.=9=D=X=b=k=~=",
        "8$888L8`8t8",
        "8$8,84898Z8p8",
        "ERROR_ILLEGAL_FLOAT_CONTEXT",
        "4$5D5",
        "2!2-2>2R2_2",
        "161N1",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::LastIndexOf(class UnBCL::DictionaryEntry<class UnBCL::String *,int> *,int,int) const",
        "CDeploymentProject::CreateFFUDeployment: Failed to delete the FFU. Error: 0x%08X",
        "8@8M8e8p8~8",
        "939O9[9f9s9",
        "PWh8a",
        "ERROR_FILE_ENCRYPTED",
        "WVh0&",
        ">=?R?x?",
        ".?AU?$ICollection@PAVCCFGSectionValue@@@UnBCL@@",
        "DiskLayout::ExecInitialize: Initializing disk",
        "7*717D7a7v7",
        ".idata$3",
        "7\"7'72797M7_7q7",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVCGlobalPath@@@UnBCL@@@UnBCL@@@UnBCL@@",
        ";*;g;n;u;",
        ">#>)>/>6><>B>H>N>X>c>i>o>u>{>",
        ".?AU?$IEnumerator@PAVCGlobalPath@@@UnBCL@@",
        "82878D8L8V8c8t8",
        "='=9=O=V=]=h=o=",
        "void __thiscall UnBCL::ArrayList<class CBcdSetting *>::RemoveAt(int)",
        "939>9H9U9^9i9q9{9",
        "Value",
        "Failed to initialize the CBS session. hr = 0x%08X",
        "CProvisioningMigration::DoExecute",
        "Applying WIM file: Downlevel apply detected and we were asked to delay apply, will return ERROR_RETRY",
        "7,757^7z7",
        ".PAVCXXXXXHandledException@?CA@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "class CAntiVirusInfo *&__thiscall UnBCL::ArrayList<class CAntiVirusInfo *>::get_Item(int)",
        "CMergeWIM::DoExecute",
        "const struct SPGetPartitionOrdinal::PartitionInfo *__thiscall UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::GetBuffer(int) const",
        "=.=Z=o=",
        "SetupPlatform: Phase \"Post-OOBEBoot\" started.",
        ">->;>^>",
        "Wj`SV",
        "2!2,262Q2[2e2o2",
        "?0?6?D?K?Q?V?a?l?r?",
        "    Failed to get next element type",
        "Call to register recovery image",
        "CSIDL_COMMON_PROGRAMS",
        "PVVj@Wh",
        "ImagePath: %s",
        ".PAVCXXXXXTemp@?O@??SPProcessServiceDisable@@YGXPBG0@Z@",
        "void __thiscall UnBCL::ArrayList<class COperationInfo *>::Insert(int,class COperationInfo *)",
        "D$@QPj",
        "?Equals@DateTime@UnBCL@@UBEHPBVObject@2@@Z",
        "? ?0?7?=?B?M?X?]?r?",
        "2#2,282D2I2R2Y2f2r2{2",
        "pSPDoMainGather",
        ".PAVCXXXXXHandledException@?PG@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "> >$>(>,>0>8><>@>D>L>P>T>X>\\>`>d>h>l>t>x>|>",
        "Path2",
        "(%lx): Failed to query object security for size.",
        "VERBOSE: Path %s is the exception, skipping",
        ">@>y>",
        "9H9f9m9s9x9",
        "??0StringBuilder@UnBCL@@QAE@XZ",
        "8+8N8v8",
        "Failed to set task registration info. hr = 0x%x",
        ".PAVCXXXXXHandledException@?BF@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "2(2@2d2x2",
        "pSPRestoreEnvVars",
        "ERROR_NO_TRUST_LSA_SECRET",
        "ITaskSettings::QueryInterface for IID_ITaskSettings2 failed. hr = 0x%x",
        "es-EC",
        "UnattendResultsFromSMIDataResults: failing invalid parameter %p %u %p %p",
        "%hs: ExpandEnvironmentStrings (%s) failed (error %u)",
        "???U?\\?b?g?s?}?",
        "8F8_8",
        "8@9h9",
        "ERROR_SERVICE_SPECIFIC_ERROR",
        "3$3>3E3K3P3[3j3r3x3",
        "<)<3<=<C<Q<~<",
        "0>0I0\\0g0y0",
        "6.6Z6p6",
        "ERROR_NONCORE_GROUPS_FOUND",
        "282W2q2x2",
        ".?AV?$DefaultInstanceFactory@VCOCCollection@OC@@@UnBCL@@",
        ".?AU?$IList@W4OP_EXECUTION_PHASE@@@UnBCL@@",
        ">S>b>",
        "282E2]2",
        "3*3<3M3T3p3w3}3",
        "Failed copying EditionID value",
        "CNewSystem::QueueInstallDynamicUpdates: Failed to find updates in %s. Cannot queue dynamic updates (0x%08X)",
        "8D9b9{9",
        "535e5",
        "0+060>0H0P0W0g0n0t0y0",
        "858Q8Y8t8{8",
        "CWIMPidgenxExtractor::ExtractPidgenx",
        "< <-<?<G<M<Z<l<",
        "1\"1(151",
        ".?AV?$DictionaryEntry@PAVString@UnBCL@@_K@UnBCL@@",
        "%hs: Module %s not available; skipping.",
        ">4>A>b>o>",
        ".?AV?$SerializableBase@VCCreateRegistryForNewSystem@@$0A@V?$DefaultInstanceFactory@VCCreateRegistryForNewSystem@@@UnBCL@@@UnBCL@@",
        "Failed to delete BSD log device element. Status: %x",
        "Failed to get usermode tracing setting, 0x%x",
        "<$<,<4<<<D<L<X<`<x<",
        "void __thiscall UnBCL::ArrayList<class CRegCreationData *>::CopyTo(class UnBCL::Array<class CRegCreationData *> *,int) const",
        ": :+:;:E:W:_:e:o:y:",
        "FVSVP",
        ":$:(:@:D:\\:`:x:|:",
        "0+040D0U0l0",
        "=$=4=<=D=P=X=|=",
        "Failed creating source component hive path name %ls\\SYSTEM",
        "CCompressedStoreHeaderWriterT<class CEmptyType>::Done",
        "SPGetDiskImage: Unrecognized DeviceId %u",
        "RestoreAllFiles",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::LastIndexOf(class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *,int,int) const",
        "ERROR_RESOURCE_NOT_AVAILABLE",
        "Fail-Forward: Global progress: %u, Phase progress: %u",
        "EventWriteTransfer",
        "=C=d=",
        "Recovery\\OEM",
        "1$1)1<1M1U1^1f1l1q1",
        "C,PhH",
        "{A794351B-A74A-4C8D-BCD5-A914A3F1D8B2}",
        "??6SerializationStream@UnBCL@@QAEAAV01@_J@Z",
        ";$;-;;;J;R;Y;_;d;s;};",
        "090N0p0",
        "ERROR_LABEL_TOO_LONG",
        "7$7,747@7`7h7p7x7",
        "IsContainerIDSameAsRootContainerID: SetupDiOpenDeviceInfo failed. Error = 0x%X.",
        "90:O:",
        "7(7C7",
        "Enabling and disabling OCs...",
        ".?AVCXXXXXHandledException@?KP@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "void __thiscall UnBCL::ArrayList<class COperationInfo *>::AddRange(const struct UnBCL::ICollection<class COperationInfo *> *)",
        ";4;<;H;h;p;x;",
        "SecObjectSDUpdateCount",
        ".PAVCXXXXXTemp@?CP@??DoExecute@CMigrateFramework@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "='=/=[=g=r=",
        "636t6",
        "JET_errTempFileOpenError",
        "?Compare@String@UnBCL@@SGHPBV12@0H@Z",
        "? ?;?Q?n?u?",
        ">+>=>E>K>X>j>x>",
        "ERROR_DS_CANT_DELETE_DSA_OBJ",
        ".?AV?$ArrayList@PAVCPartitionInfo@@@UnBCL@@",
        ">(>0>H>P>h>p>x>",
        ".?AU?$ICollection@PAUHKEY__@@@UnBCL@@",
        ":$:P:W:^:m:x:",
        "ERROR_NO_MORE_USER_HANDLES",
        "818E8c8j8p8u8",
        "Hive [%ws] changed before boot; will skip the changed keys list.",
        "6(7/787=7H7R7j7q7z7",
        ";(=p>",
        "tBSh b",
        "??0ArgumentNullException@UnBCL@@QAE@PBG@Z",
        ":%:@:U:^:s:",
        "5C5`5w5~5",
        "BootFiles",
        "5'5H5c5n5|5",
        "0=0V0`0t0}0",
        "192b2~2",
        ".?AV?$SmartPtr@VCOCCbsAdapter@OC@@@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<class COperationsValidator *>::RemoveAt(int)",
        "Scratch directory could not be found. Abandoning...",
        "SVh<z",
        "40474=4I4U4",
        "CSetupAutomation::ResolveTarget: Failed to check partition for a volume: 0x%08x",
        "CDumpSourcesData::DoExecute",
        "7\"7'727@7H7N7b7k7s7",
        ".?AV?$DefaultInstanceFactory@VCRegCreationData@@@UnBCL@@",
        ".?AVCAddSetupClRequest@@",
        "u.FAB;",
        "SSSh(",
        "?StartsWith@String@UnBCL@@QBEHPBGH@Z",
        "NtCreateKey",
        "sSecInfoStr",
        "IsCharAlphaW",
        "Error setting compression",
        "CBS_E_INVALID_EXECUTESTATE",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::IndexOf(class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *,int,int) const",
        "9(9;9O9~9",
        "SPAttachDiskImage: AttachVirtualDisk failed: %u",
        "%hs: Failed to write external rollback marker to %s. Error: 0x%08X",
        "2%2.2:2F2R2^2j2v2",
        "?+???R?Y?_?d?o?z?",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::Reset(void)",
        "?-?@?H?N?[?m?",
        "1I1y1",
        "6%7@7Q7f7n7t7",
        "class CPartitionInfo *__thiscall UnBCL::_::ArrayListEnumerator<class CPartitionInfo *>::get_Current(void) const",
        "RPC_S_GRP_ELT_NOT_ADDED",
        "63696E6M6_6f6l6q6|6",
        ">(><>P>d>n>",
        "DiskLayout::ParseSizeString: Allowed values are: B, KB, MB, GB, TB, PB, EB, ZB, YB",
        "class OC::CCmdLineExecutionTelemetryData **__thiscall UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *>::GetBuffer(int)",
        "9E9R9Y9",
        "SPAPI_E_SECTION_NAME_TOO_LONG",
        "%hs: Failed to find image index %d in image info set.",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,class ATL::CElementTraits<enum ActionType> > const *,struct __POSITION * const &)>::Reset(void)",
        "292W2f2",
        "enum MIGSTATUS __stdcall SPDoFrameworkGather(class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::String *,class UnBCL::String *,int,struct ISPMigProgress *)",
        "6'6,6@6[6",
        "CreateRestoreInfo",
        "7A7J7X7u7",
        "6)636C6M6]6h6|6",
        ">8>M>`>h>n>{>",
        "CSIDL_COMMON_DESKTOPDIRECTORY",
        "Exporting alterations to firmware.",
        "2&222>2J2V2b2n2w2",
        "ERROR_CANT_WAIT",
        "ERROR_DS_RDN_DOESNT_MATCH_SCHEMA",
        "(%lx): Unable to query mount points.",
        "Error creating ClassGUID value for %s. Error: 0x%08X",
        "class CAntiVirusInfo *const *__thiscall UnBCL::ArrayList<class CAntiVirusInfo *>::GetBuffer(int) const",
        "OSRollbackService::CCheckpoint::MoveOrCopyFiles: Moving/copying %s from %s to %s",
        "Paths.Exceptions",
        "de-LU",
        ")VdsPartition::Delete",
        "Failed to create destination WIMBoot partition directory.",
        "Gather end install, scope: %s",
        "j0h0$^",
        "9;9C9L9R9b9r9",
        "ValidateTracked",
        "MigCreateUpgradeStore",
        "?e?u?",
        ".?AVNumericProperty@?1???$pDefineNumericProperty@V<lambda_d14ac46bcd6b94be61fc2ffdefbf5b1b>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_d14ac46bcd6b94be61fc2ffdefbf5b1b>@@@Z@",
        "5'5.54595D5O5c5q5",
        ":8:X:x:",
        "CTelemetry::StartTelemetry",
        "??0?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAE@PAVEncoding@1@@Z",
        ">)?A?G?\\?s?",
        "DriverSafeOSInstallFailureIgnoredList",
        "ERROR_REPLY_MESSAGE_MISMATCH",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,&protected: static struct HKEY__ * __stdcall UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,class ATL::CElementTraits<struct HKEY__ *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "VdsPartition::RefreshVdsProperties: Couldn't get disk object (0x%08x)",
        "void __thiscall UnBCL::ArrayList<unsigned long>::RemoveAt(int)",
        "3$4F4K4h4m4y4",
        "5$5,525?5Q5_5}5",
        "4&4,414<4G4a4s4z4",
        "Failed allocating full path for %ws",
        "? ?-?@?a?k?u?",
        "JET_errAttachedDatabaseMismatch",
        "<$<,<4<D<P<X<",
        "VdsPartition::SetActive: Couldn't get disk object (0x%08x)",
        "<&<2<:<V<]<c<i<u<",
        "%hs: Executing machine-specific gather",
        "2,272I2P2V2[2g2o2t2",
        "6#6(6=6~6",
        "5'6S6",
        "FreeDiskSpaceEnd",
        "737E7l7|7",
        "void __thiscall UnBCL::Array<class CShellFolderInfo *>::Remove(class CShellFolderInfo *)",
        "pAddSafeOSDrivers: Failed to queue drivers from package %i (%s): 0x%08x",
        "CDeploymentProject::CreateFolderDeployment: Relative path to boot application for WinReSetBootApp wasn't found",
        "void __thiscall UnBCL::ArrayList<class CRegCreationData *>::RemoveAt(int)",
        "5&5C5|5",
        "!090B0W0",
        "volume",
        "MIG_UPGRADE_SCRIPTS",
        "en-PH",
        ".PAVCXXXXXTemp@?6??SPScheduleTask@@YGJPBG000@Z@",
        "Description_U",
        "Failed to remove WIM entry for %s. Error: 0x%08X",
        "404C4T4a4i4p4v4{4",
        "contain an operating system.",
        "4 4$4(4044484@4D4H4L4P4T4X4\\4`4d4h4l4p4x4|4",
        "6$6,646<6D6L6T6x6",
        ".?AVCXXXXXHandledException@?BA@??DoExecute@CInstallDUUpdatesOffline@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "int __thiscall UnBCL::Array<enum OP_OPERATION_ID>::Add(enum OP_OPERATION_ID)",
        "Failed to connect securitycenter2",
        ".?AV?$Array@UPartitionInfo@?1??SPGetPartitionOrdinal@@YGJPAUIPartition@SetupPlatform@@PAK@Z@@UnBCL@@",
        "6#6/6C6V6p6|6",
        "3%3{3",
        ":$:M:u:",
        "ERROR_GRACEFUL_DISCONNECT",
        "ERROR_SXS_IDENTITY_PARSE_ERROR",
        "3#3/373I3P3V3[3f3q3",
        "=&=,=1=<=G=L=`=",
        "3,3D3T3\\3l3",
        "Microsoft.Windows.Sysprep",
        "RtlSetThreadErrorMode",
        "=I=b=",
        "ERROR_NO_MORE_FILES",
        "323:3A3G3L3W3g3{3",
        "ERROR_DS_MAPI_ID_NOT_AVAILABLE",
        ";#;2;<;A;I;P;\\;n;",
        "SVWh@0",
        "9%9I9U9a9s9{9",
        "808F8\\8d8n8u8{8",
        "7H7M7f7m7",
        "7(7-787E7P7d7",
        "405706ed-f1d7-47ea-91e1-eb8860039715",
        "3&303:3G3O3V3\\3e3q3|3",
        "=D=W=^=f=u=",
        "5.555;5A5M5]5q5}5",
        "  Partition Length = %lld",
        "%hs: Removing offline migration storage",
        "5(575s5",
        ".?AV?$KeyCollection@PAVString@UnBCL@@K@_@UnBCL@@",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::Reset(void)",
        "SPGetWIMImageInfo: No software hive in WIM image index %d; assuming this is data image.",
        "                                   Number of logical CPUs : %u",
        "6F7O7\\7",
        "0\"0L0S0Y0^0i0s0x0",
        "RtlAreLongPathsEnabled",
        "%WINDIR%\\system32",
        "5$5?5F5L5Q5\\5c5",
        "Failed opening target software hive %ls",
        "NtQueryBootEntryOrder",
        "0#0r0",
        "5-5K5W5",
        "9\"9(9.949:9@9F9L9R9X9^9d9j9p9v9|9",
        "HashTable.blob=%s",
        "SPScheduleSnapshotCleanupTask",
        "0/0J0_0~0",
        "ValidateInput: Please provide a valid SectorSize, should be power of 2",
        "3#464X4q4",
        "DiskLayout::ApplyLayout: Layout contains unknown partition table type %u",
        "8.8F8^8v8",
        "%hs: Failed to write successful capture info to file: %s. Error: 0x%08X",
        "4$4/4=4E4L4`4e4v4~4",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,class ATL::CElementTraits<class CDriverInstallInfo *> > const *,struct __POSITION * const &)>::Reset(void)",
        "ar-JO",
        "SetupPlatform::_ExecuteRollback",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,&protected: static struct UnBCL::ISerializable * __stdcall UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,class ATL::CElementTraits<struct UnBCL::ISerializable *> > const *,struct __POSITION * const &)>::Reset(void)",
        "%hs: Profile for %s(%s) not found in rollback info. Must be an added profile. Uninstall validation will fail.",
        "Failure while getting image info set for %s",
        ".PAVCXXXXXTemp@?3??ConfigureImageForRAMBoot@CAddSafeOSBootEntry@@IAEJPBG00H00PAU_GUID@@@Z@",
        "%hs: %s does not exist, will fail.",
        "3?3Q3Y3_3l3~3",
        "2 282<2@2D2H2L2T2l2p2x2|2",
        "0)050B0O0\\0i0u0",
        ";6;S;k;t;~;",
        "?)?<?\\?s?",
        "9,9V9{9",
        ";$;);3;U;Z;d;",
        "Required profile hive does not exist: [%ws].",
        "CInternalOperationsProgress::RegisterError: Registered operations error: 0x%08X",
        "<3<\\<q<}<",
        "0(0H0h0",
        "??0?$ICollection@G@UnBCL@@QAE@XZ",
        "ERROR_DS_INVALID_SCRIPT",
        "CCFGSectionRegistry::IsValueUnchanged",
        "DISKSPACETRACK: Available      : %I64u",
        "848K8[8h8t8",
        "2 323:3@3M3_3r3~3",
        "int __thiscall OC::CDownlevelOCStore::IsDetectable(class UnBCL::XmlDocument *,class UnBCL::String *,class UnBCL::String *)",
        ".?AV?$SmartPtr@U?$IEnumerator@W4ActionType@@@UnBCL@@@UnBCL@@",
        "?)?/?C?K?b?i?{?",
        "&quot;",
        "2%2:2",
        "__thiscall CCreateRegistryForNewSystem::CCreateRegistryForNewSystem(const unsigned short *,const unsigned short *,const unsigned short *,unsigned long,unsigned char *,unsigned long,int,int,int,enum OP_OPERATION_ID)",
        ">!?-?@?",
        "SPAttachDiskImage: Can't open disk image: 0x%08x",
        "ERROR_DS_INVALID_DMD",
        "ReserveManager.dll",
        "class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::GetBuffer(int) const",
        "SKIPBOOTTRACK(SAFEOS): Skip Boot Validator: New OS image has not been applied, cannot continue with SafeOS boot removal.",
        "4E5L5{5",
        "MiniDump",
        "2&2`2",
        "RPC_S_COOKIE_AUTH_FAILED",
        "ERROR_ILLEGAL_DLL_RELOCATION",
        "7$7:7N7",
        "6(60666C6U6s6",
        "CreateNewWindows",
        "CreateEventW",
        ">>>C>Z>_>i>n>",
        "2J2o2",
        "de-DE",
        "ERROR_CANTOPEN",
        "InterlockedCompareExchange",
        "Some error occured while adding/starting pending services. Error: 0x%08X",
        ".?AVCXXXXXHandledException@?P@??Rollback@CSetupPlatformApplyRollbackCheckpoint@@UAEXPBG@Z@",
        "4&404J4Q4W4]4h4o4",
        "WIM %s, offset %.8x%.8x, length %x",
        "=M=f=m=t=z=",
        ".?AV?$Array@PAVCShellFolderInfo@@@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<enum OP_OPERATION_ID>::CopyTo(class UnBCL::Array<enum OP_OPERATION_ID> *,int) const",
        "ERROR_IPSEC_IKE_AUTH_FAIL",
        "y#Vhx",
        "es-419",
        "sa-IN",
        "memtest.efi",
        "ERROR_SXS_PROCESS_DEFAULT_ALREADY_SET",
        "?I?R?]?h?s?",
        "3>4P4X4^4k4}4",
        "ERROR_BAD_FILE_TYPE",
        "void __thiscall UnBCL::ArrayList<struct UnBCL::ISerializable *>::QuickSort(class UnBCL::ArrayList<struct UnBCL::ISerializable *> *,class UnBCL::ArrayList<struct UnBCL::ISerializable *> *,int,int)",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@_K@UnBCL@@@_@UnBCL@@",
        "2%2:2?2J2",
        "708`8",
        "class UnBCL::DictionaryEntry<void *,void *> *__thiscall UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::get_Item(class CWIMBootHelper::CWIMEntryIndex *) const",
        "%hs: Cannot set the reference WIM file %s for %s. Error 0x%08X",
        "InjectUnattendFile: Couldn't convert answer file contents to UTF-8: 0x%08x",
        "_snwscanf_s",
        "SafeOSDir",
        "CSysprepSpecializeOffline::DoExecute: Cannot set Sysprep \"upgrade\" mode in registry. Error: 0x%08X",
        "070R0m0",
        "ExtractBugCheckInfo: Valid Dump/ Signature not found, error 0x%08X ",
        "5 5D5L5T5\\5d5l5t5|5",
        ">/>_>q>y>",
        "6$6B6I6O6T6_6i6|6",
        "7G7k7",
        "?6?B?G?[?",
        "8#8-8E8L8R8W8b8m8",
        ".?AV?$ArrayListEnumerator@UPartition@DiskLayout@@@_@UnBCL@@",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,int>,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,int> __stdcall UnBCL::Hashtable<class UnBCL::String *,int>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::Reset(void)",
        ".?AV?$SerializableBase@VCRemoveOSUninstall@@$0A@V?$DefaultInstanceFactory@VCRemoveOSUninstall@@@UnBCL@@@UnBCL@@",
        "2+2C2J2Q2W2d2y2",
        ".PAVCXXXXXTemp@?3??DoExecute@COrchestrateOSSwitch@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "0R0v0",
        "?!?2?6?<?@?F?J?V?q?",
        "9#929<9A9I9P9\\9n9",
        "CUninstall::ValidateUninstall",
        "='=1=B=X=~=",
        "RPC_S_UNKNOWN_MGR_TYPE",
        ".PAVCXXXXXHandledException@?CCB@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ".?AV?$SerializableBase@VCFinalizeSafeOSBootRemoval@@$0A@V?$DefaultInstanceFactory@VCFinalizeSafeOSBootRemoval@@@UnBCL@@@UnBCL@@",
        "7$7*7/7:7D7W7g7",
        "{36B73C0C-BB81-4FAF-B37F-F42168B2C880}",
        "ERROR_NOLOGON_WORKSTATION_TRUST_ACCOUNT",
        "8/878B8V8t8",
        "DiskLayout::ApplyProperties: Failed to get partition's associated volume: 0x%08x",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CDUPackage *>::MoveNext(void)",
        "0#0)0/0:0D0W0b0l0s0z0",
        "8F8U8\\8b8g8r8|8",
        "LogFilePath: %s",
        "SPDeleteOldUpgradeSnapshots: Failed to delete snapshots",
        "y VjWh",
        "8.9b9m9{9",
        "</<j<v<",
        "5$5/595G5N5T5Y5d5n5",
        "RestoreDirTree",
        "pGetUninstallInterfaceCommon",
        "4$444<4D4L4T4\\4d4l4t4|4",
        "void *__thiscall UnBCL::_::ArrayListEnumerator<void *>::get_Current(void) const",
        ";$;);5;C;J;T;d;t;|;",
        "6\"6+646=6F6O6X6a6u6~6",
        "%programfiles(x86)%",
        "?4?C?",
        "Cannot upload snapshot state without telemetry helper",
        "%hs: Failed to mark system volume(%c:); hr = 0x%X",
        ".?AV?$SerializableArrayBase@PAVCRegCreationData@@@_@UnBCL@@",
        ";A$uJ",
        ".?AV?$DictionaryEntry@KPAUIVdsDisk@@@UnBCL@@",
        "9$9/9<9L9\\9h9q9",
        "8(80888@8H8P8\\8|8",
        "ERROR_IPSEC_IKE_INVALID_COOKIE",
        "OSVersion",
        "5,5L5l5",
        "5 6%6a6u6",
        "ERROR_NOT_LOGGED_ON",
        "5,5K5X5`5f5k5z5",
        "6)6D6_6",
        "=#>W>b>p>~>",
        "7 7/767@7N7X7b7s7",
        ".?AVCXXXXXHandledException@?5??SPCreatePartition@@YGJH_K0HPA_K@Z@",
        "Object alias resolves to %s",
        "Failed to call %s on %s (0x%08x)",
        "ERROR_NOT_CHILD_WINDOW",
        "2*2C2S2`2m2t2z2",
        "95$#d",
        ".?AV?$CAutoCleanupBase@PAVSmPartition@@@RAII@@",
        "SP_DOWNLEVEL_TELEMETRY_ETW_SESSION",
        "?\"?9?Z?q?",
        ".?AUIExecutionContext@@",
        "AppX Validator",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,&protected: static class CDriverInstallInfo * __stdcall UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,class ATL::CElementTraits<class CDriverInstallInfo *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,class UnBCL::Array<class CDriverInstallInfo *> *,int)",
        ">@>R>Z>`>m>",
        ";'<3<E<M<l<z<",
        "7=8B8X8]8",
        "=)>0>6>;>F>Q>e>x>",
        "long __thiscall CSetupPlatformPrivate::Execute(enum SetupPlatform::EXEC_PHASE,struct SetupPlatform::_PROGRESS_DATA *,int *)",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *> *)",
        "??0?$Array@G@UnBCL@@QAE@HH@Z",
        ":;:D:j:y:",
        "Execution of unattend GCs failed; hr = 0x%x; pResults->hrResult = 0x%x",
        "7,83898>8I8S8X8l8",
        "w(hdW",
        "CFastDeleteImplT<class CDirectoryProviderT<class CWindowsOldAdaptor>,1>::ProcessTreeForDeletionInternal",
        "<)<8<A<G<T<Z<_<x<",
        "tdj3W",
        "ERROR_CANNOT_ABORT_TRANSACTIONS",
        "=!='=,=7=@=T=",
        "060A0O0]0k0",
        "DiskLayout::ApplyLayout: Can't partition disk because it mixes declarative (WPAF) and imperative (unattend) partitioning",
        "1 1(1L1\\1d1h1l1p1x1",
        "Error moving alternate rollback directory %s. Error: 0x%08X",
        "%hs: Running in EFI mode, \"%s\" does not exist. Will create a temporary system BCD store to bind and save firmware settings.",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@H@UnBCL@@@UnBCL@@@UnBCL@@",
        "Failed allocating client",
        "JET_errDatabaseBufferDependenciesCorrupted",
        "pGetProvisioningPackagePayload",
        "ERROR_USER_APC",
        "OC::CDownlevelOCStore::CDownlevelOCStore: Translation Dll does not exist.",
        "PREVALIDATION: At least one validator failed, execution cannot continue.",
        "%hs: Cannot get the current user name. Error: 0x%08X",
        ":\":(:_:k:}:",
        "Using Update style progress",
        "y'Vj1",
        "\\Windows\\System32\\Recovery\\winre.wim",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *> *)",
        "UncompressFile",
        ".?AU?$IEnumerator@PAVCDeviceInfoData@CDeviceIdDatabase@@@UnBCL@@",
        "=)=;=I=j=",
        "Basic Info is different, Path=[%s] Type=[%s] and Path=[%s] Type=[%s] are different entry.",
        "Setup\\State",
        "< <(<,<0<4<8<<<@<D<H<L<P<T<\\<`<d<h<p<t<x<|<",
        "int __thiscall UnBCL::Array<class CPartitionInfo *>::Add(class CPartitionInfo *)",
        ";7;V;s;",
        ":$:D:^:r:",
        "2%2F2M2S2X2c2n2s2",
        "void __thiscall UnBCL::_::ArrayListEnumerator<unsigned int>::Reset(void)",
        "9D$$t",
        "ERROR_DS_SRC_AND_DST_NC_IDENTICAL",
        ";*;;;A;V;a;n;",
        "VdsPartition::RefreshVdsProperties: Couldn't find current partition (offset %llu) on the disk (0x%08x)",
        "void __thiscall UnBCL::Array<unsigned short *>::Insert(int,unsigned short *)",
        ".?AV?$ArrayList@PAVCFailForwardSystem@@@UnBCL@@",
        ".?AV?$Array@PAG@UnBCL@@",
        "Unknown existing partition style %d",
        "pFiltersKeyEnumCallback",
        "2@2L2\\2",
        "<&<B<[<k<u<",
        "95(#d",
        "int __thiscall UnBCL::ArrayList<class CDriverDetails *>::BinarySearch(int,int,class CDriverDetails *,struct UnBCL::IComparer<class CDriverDetails *> *)",
        "SKIPBOOTTRACK(SAFEOS): Reading OneSetting for SafeOS boot removal",
        "?SetLiteralStorage@_@UnBCL@@YGXPAPBVString@2@PBG@Z",
        "ERROR_PASSWORD_RESTRICTION",
        "%hs: Failed to insert %s into the RunOnce key. hr = 0x%X",
        ".?AU?$ICollection@I@UnBCL@@",
        "es-AR",
        "long __stdcall CImageInfoSet::CreateFromExistentSystem(const unsigned short *,class CImageInfoSet **)",
        "CDownloadDUUpdates::DoExecuteInternal: Failed to filter updates. hr = 0x%x",
        "QWj$jCh,",
        ";(;3;G;L;z;",
        "uSPApplyStandardDiskConfig",
        "    Failed to get wim attributes",
        ".?AV?$CAutoCleanupBase@PAVSPFreeDiskRangeEnumerator@@@RAII@@",
        "NO NAME    FAT12   3",
        "pSPScopeSnapshot: [%s] doesn't exist, skiping",
        "CNewSystem::QueueOperations:     Free Space    : %I64u",
        "Failure while requesting package payload copy. Error: 0x%08X",
        "x'jdSh",
        "383L3e3l3r3w3",
        ".?AVCXXXXXHandledException@?P@??Rollback@CSetupPlatformOSSwitchCheckpoint@@UAEXPBG@Z@",
        "j%jsj-j",
        "Global\\SetupLog",
        ".?AV?$CAutoDelete@PAVCOperationQueue@@@RAII@@",
        "%hs: Cannot queue OC replication for fail-forward system %d. Error: 0x%08X",
        "OC::CInstalledOCStore::GetOCCollection: Couldn't get the Foundation package OCs",
        "void __thiscall UnBCL::ArrayList<class CDriverDetails *>::AddRange(const struct UnBCL::ICollection<class CDriverDetails *> *)",
        "Failed to query object data. Status = [%x]",
        "4#4,454>4J4V4k4",
        "WSh@|",
        "zh-Hans",
        "8$8H8\\8d8l8t8|8",
        "SetupPlatform: Checking Narrator running status failed. Error: 0x%08X",
        "sCSetupPlatformTracing::ReadTracingOneSettings",
        "CReconstructOS::ReconstructWindows: ::ReconstructWindows succeeded (0x%08x). Deleting temp files ...",
        "The OS's pended SetupCl request is invalid!",
        "1%1Q1c1",
        "Failed to get low disk snapshot policy OneSetting, 0x%x",
        "ff-Latn-NG",
        "Unknow",
        "pExtractWinREFromImage: Failed to copy new device element path. Error = 0x%08X",
        "Prepare rollback",
        "?get_OuterXml@XmlNode@UnBCL@@QAEPAVString@2@XZ",
        "6%6S6k6",
        "strrchr",
        ":%:=:Y:`:f:k:v:",
        "6\"6*646E6N6[6d6l6v6}6",
        "3(303H3|3",
        ":$:+:j:q:",
        "CSetupAutomation::ResolveTarget: Couldn't update cached target information: 0x%08x",
        "??1NotSupportedException@UnBCL@@UAE@XZ",
        "MigrationScope",
        "WdsCopyFileEx: Failed to delete %s. GLE = 0x%x",
        "COrchestrateOSSwitch::DoExecute",
        "WriteNewElement",
        "ERROR_TRUSTED_RELATIONSHIP_FAILURE",
        "ERROR_DS_ROOT_MUST_BE_NC",
        "656_6",
        "80888@8H8P8X8h8",
        "2!2.2@2_2q2y2",
        "Sources\\OCStatus.dat",
        ">+>V>y>",
        "Service start type: %d",
        ";!;4;X;p;w;~;",
        "757M7d7q7}7",
        "Failed directory walk to determine its size",
        "5_5s5",
        "RestoreFileCompression",
        "SmDisk::CreatePartition: Can't get partition properties (0x%08x)",
        "BCryptDestroyHash",
        "System\\CurrentControlSet\\Control\\hivelist",
        "3%3-3:3I3e3o3y3",
        "void __thiscall UnBCL::ArrayList<struct SetupPlatform::IDisk *>::set_Item(int,struct SetupPlatform::IDisk *)",
        "pLogUpdateInfo",
        "CurrentMinorVersionNumber",
        ".?AVCSetupRecoveryPartition@@",
        "71888>8C8N8X8k8",
        "9#989D9W9",
        "151_1",
        "CMediaLayout::Execute: Failed to queue packages: 0x%08x",
        "System.Core.ni.dll",
        "D$pSV3",
        "Creating Pagefiles reg value failed with error 0x%08X.",
        "0,0O0",
        "7!777R7Y7v7}7",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@KPAVString@UnBCL@@@UnBCL@@@_@UnBCL@@",
        ".?AV?$SmartPtr@VCWIMBootHelper@@@UnBCL@@",
        "5$505H5R5\\5f5s5",
        ".?AVVersion@UnBCL@@",
        "Found WIMBoot entry for %s but it's not inside the OS namespace, ignoring",
        "hr-BA",
        ".?AVWpxLogger@@",
        "Complete",
        "int __thiscall UnBCL::_::ArrayListEnumerator<unsigned long>::MoveNext(void)",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::get_Current(void) const",
        ";D$@v!P",
        "ERROR_MEMBER_NOT_IN_GROUP",
        "CRYPT_E_ASN1_CONSTRAINT",
        "5(626?6E6L6V6c6j6t6",
        "VERBOSEICB: ICB 1st boot apply estimated size is: %I64u",
        "LocalPayload\\Appx\\Licenses",
        "\\REGISTRY\\MACHINE\\SYSTEM\\SETUP\\SETUPCL\\PendingRequest",
        "CNewSystem::QueueAddDriver",
        ".?AVCXXXXXHandledException@?BJJ@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "WdsCliClose",
        ".PAVCXXXXXTemp@?FI@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "VERBOSEOPS: %sOperation %u's dependent operation %u cannot run in execution phase %u or earlier",
        "111019184142Z",
        "Failed to copy logger name: 0x%x",
        "; ;(;.;;;M;[;",
        ".?AVCDownloadDUUpdates@@",
        "7&757O7g7y7",
        "CSetupAutomation::SuspendAndRelease: Failed to open %s for writing: 0x%08x",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Failed to find BT drive; hr = 0x%X",
        "CDeploymentProject::CreateBootableMediaDeployment: Failed to get next partition (0x%08x)",
        "SclRetrieveMultiSz",
        "Failed to read NT header from file: %S",
        "7<7N7V7\\7i7{7",
        "CSetupAutomation::ResolveTarget: Failed to iterate over partitions: 0x%08x",
        ":3:::@:L:X:",
        ">%>;>I>b>i>p>v>",
        "SL_E_VL_INVALID_TIMESTAMP",
        "4$4(4@4D4\\4`4x4|4",
        "BiCreateBootEntry: Could not retrieve BCD Object application device. Status: %x",
        "ERROR_CANNOT_FIND_WND_CLASS",
        ";-;7;L;T;Z;g;y;",
        "Failed to set registry data for element %s. Status: %x",
        "Provisioning package is local, no need to copy it",
        ".?AV?$SmartPtr@U?$IEnumerator@U_GUID@@@UnBCL@@@UnBCL@@",
        "%s %d %d",
        "=*=;=D=Q=o=",
        "__thiscall UnBCL::ArrayList<struct UnBCL::ISerializable *>::ArrayList(const struct UnBCL::ICollection<struct UnBCL::ISerializable *> *)",
        "Failed to convert data for element %s. Status: %x",
        ".?AV?$DictionaryEntry@PAVString@UnBCL@@PAVMultiSz@2@@UnBCL@@",
        "1\"101m1",
        "?&?-?C?^?d?n?s?}?",
        "</<\\<",
        "VERBOSE: Result (KRNL) : %s -> %s (%s)",
        "5$5,545<5D5P5X5t5|5",
        ">K?o?",
        "2$262>2D2Q2c2q2",
        "%hs: Attempting to refresh TPM for BitLocker.",
        "$SETUP$OFFLINE$SYSTEM",
        "?%?I?P?V?[?f?x?",
        "1?1I1h1",
        ">%>/>4>H>f>t>",
        "= =0=@=P=T=d=h=x=|=",
        "SclRegCopySecurityInfo",
        "6f6p6",
        "CERT_E_INVALID_NAME",
        "CRYPT_E_ASN1_CHOICE",
        ">3>W>",
        "ERROR_DS_NAME_UNPARSEABLE",
        "ERROR_DS_NCNAME_MUST_BE_NC",
        "7(757G7R7f7s7x7",
        "ZwQueryDirectoryObject",
        ";M;_;g;m;z;",
        "50595J5`5n5",
        "5)5?5G5T5n5",
        "RemoveSourceHardlinks: Malformed entry in folder move log file ignored: %s",
        "343D3",
        "SetupDiGetActualModelsSectionW",
        "4 444I4U4l4",
        "<$<4<<<D<L<T<\\<d<l<t<|<",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class COSPieceInfo *>::Reset(void)",
        "Attempting the re-create the WIMBoot partition",
        "? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\\?`?d?h?l?p?t?x?|?",
        ".?AV?$SerializableBase@VCRelocateWinReImage@@$0A@V?$DefaultInstanceFactory@VCRelocateWinReImage@@@UnBCL@@@UnBCL@@",
        "7)757A7P7\\7i7",
        "JET_errKeyTruncated",
        "Failed to adjust token privileges.",
        "WVh@&",
        "7Q8i8v8",
        "6#616I6P6V6[6f6x6",
        "Error creating Class value for %s. Error: 0x%08X",
        "_DismEnableDisableFeature",
        ".PAVCXXXXXTemp@?CO@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "GetUserNameExW",
        "08102",
        "SPWriteXmlFile",
        "SmPlatformDiskEnumerator::ConstructPhysicalDisk: Couldn't initialize disk (0x%08x)",
        "ERROR_DS_DESTINATION_AUDITING_NOT_ENABLED",
        "RPC_S_PROTSEQ_NOT_SUPPORTED",
        "5A5M5\\5r5{5",
        "4\"4*404=4O4b4n4",
        "1-1X1q1x1",
        "ERROR_REGISTRY_RECOVERED",
        "2<2p2",
        "Respecialize requested immediate reboot",
        "Invalid delimiter: %wc.",
        "Migration.WatchChanges",
        ">F>b>n>",
        "ERROR_CTX_SHADOW_DISABLED",
        ";$;,;4;D;P;X;",
        "IsInitialized",
        "8$80898E8N8Z8c8o8x8",
        "0'1l1",
        "epIsUninstallActive",
        "SL_E_DUPLICATE_POLICY",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@",
        ".?AVStreamWriter@UnBCL@@",
        "Reserve space with file %s (%I64u)",
        "=9=K=S=Y=f=x=",
        "SPDeleteOldUpgradeSnapshots",
        "X0_0g0l0w0",
        "9%9_9~9",
        "OOBEBootApplyComplete",
        "GlobalPath,",
        "WinReAddTrustedBootApp",
        "NtDeleteValueKey",
        "768e9}9",
        "Build Update",
        "ZwDeleteFile",
        "Failed load key %ws. Flags: 0x%x File: %s Status: %x",
        "?'?/?5?B?T?b?",
        ":@:G:[:m:t:z:",
        "CSuspendBitlocker::StoreBitLockerStatus",
        "7-7;7E7O7f7t7~7",
        "Copy OC payload from %s to %s",
        "3-3Y3",
        "0#070E0S0a0o0}0",
        "SVWQP",
        "chr-Cher-US",
        ">*>3><>E>N>X>a>k>|>",
        "3<3I3_3|3",
        "CCaptureIODispatcher::CreateInstance",
        ">,>=>E>L>X>_>f>q>",
        "D$ !\\$",
        "ERROR_IPSEC_TRANSPORT_FILTER_PENDING_DELETION",
        "<(<:<B<H<R<\\<t<",
        "3#3/343=3K3W3\\3e3v3",
        "6<7A7",
        "CMediaLayout::QueueInstallImage: Couldn't get full path to install WIM: 0x%08x",
        "=$=0=T=\\=d=l=t=|=",
        "D$ SPSh?",
        "6'6-626C6N6\\6",
        "0I0T0|0",
        "xCDeploymentProject::SetAutomaticShutdown",
        "ERROR_DS_CANT_ADD_SYSTEM_ONLY",
        "SclpGptInitGuids",
        "3UV?9",
        "081E1M1",
        "4&484@4F4V4g4",
        "4$4:4U4[4e4j4t4{4",
        "0g0r0y0",
        "9,949<9D9L9T9\\9d9l9t9|9",
        ".?AU?$IList@PAVCCmdLineExecutionTelemetryData@OC@@@UnBCL@@",
        "Failed to allocate ssshim path.",
        "0!0,060I0Q0f0r0y0",
        "j)j/j",
        "class CGlobalPathFindData *const *__thiscall UnBCL::ArrayList<class CGlobalPathFindData *>::GetBuffer(int) const",
        "DiskLayoutMakeSystem: Failed to set the system partition type to 0x%x (0x%08x)",
        "ERROR_DEVICE_ENUMERATION_ERROR",
        "7<7B7K7S7b7i7o7t7",
        "    Failed to get data source ID",
        "FH;A8",
        "CInstallDUUpdatesOffline::DoExecute: Failed to install dynamic updates. hr = 0x%x",
        ".?AVCXXXXXHandledException@?CL@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "XSP_ENV_SKIP_SAFEOS_BOOT_TEST_MODE",
        "Failed to enable debugger on boot manager. Status = 0x%X",
        "=\"=,=?=G=]=d=v=",
        "void __thiscall UnBCL::Array<unsigned short *>::InitLarva(class UnBCL::ArrayList<unsigned short *> *)",
        "ControlSet00%1u\\Control\\CrashControl",
        "%hs: BCD failed to remove new OS boot entry. Error: 0x%08X",
        "?!?+?0?:?A?O?a?r?y?",
        "Failed adding directory: %ws to stack",
        "=/=O=t=|=",
        "5#5)5.595D5J5^5h5m5z5",
        ";6;?;J;U;`;k;v;",
        "??0?$IList@E@UnBCL@@QAE@XZ",
        "7$7,7<7D7L7T7\\7d7l7|7",
        "int __thiscall UnBCL::ArrayList<class CDriverInfo *>::IndexOf(class CDriverInfo *,int,int) const",
        "FindMatchingDeviceInfoData: SetupDiEnumDeviceInterfaces buffer alloc failed. Error = 0x%X.",
        "4 4(40484@4H4P4X4`4h4p4x4",
        ":#:+:=:E:K:]:q:~:",
        "GetEnvironmentVariableW",
        "StartUninstallInitiated",
        "void __thiscall UnBCL::Array<unsigned int>::Remove(unsigned int)",
        "%hs: BCD failed to set back the current boot entry. Error: 0x%08X",
        "ERROR_SXS_XML_E_UNEXPECTED_STANDALONE",
        "232=2N2U2^2l2s2|2",
        ": :&:,:2:8:>:D:J:P:V:\\:b:h:n:t:z:",
        "0#090]0}0",
        "60686D6d6l6t6",
        "CoerceStringShallow failed - %ls",
        "3-3E3[3",
        "4\"4.4@4H4N4`4q4~4",
        "8*8H8T8f8",
        "5%5]5",
        "6#6A6`6v6",
        "0'1,161N1d1w1",
        "1'1-121C1N1\\1",
        "=$=*=0=6=<=B=H=N=T=Z=`=f=l=r=x=",
        "WdsRemoveDirectory: Unable to prepare path [%s]; GLE = 0x%x",
        "GetVolumeInformationW",
        ".PAVCXXXXXHandledException@?2??DoExecute@CDisableFeature@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "System32\\pidgenx.dll",
        "WinHttpConnect",
        "FfuLog",
        "MIG Validator: All work (machine-specific) is complete, marking completion and removing the store.",
        "Unable to get procedure GetAppIdAuthority",
        "(%lx): Error re-opening excluded key [%ws]",
        "6<6W6}6",
        "7.7;7V7l7",
        "QQQPQQj",
        "VdsPlatformDiskEnumerator::GetNext: Failed to get next unallocated disk (0x%08x)",
        "SclAcquireRequiredPrivileges",
        "ERROR_BAD_UNIT",
        "?%?:?H?N?[?m?",
        "CSetupPlatformPrivate::MoveTelemetry",
        "%hs: WinReUnInstall failed. Error: 0x%08x",
        "Reserves shouldn't be used during NEO, ignore reserve",
        "0+0Q0",
        "8(818:8L8b8p8y8",
        "272E2a2",
        "9C:i:",
        "ProgramFilesDir (x86)",
        "pAddSafeOSDrivers: Failed to set WIM temp directory to %s (0x%08x)",
        "0 0>0[0e0w0",
        "en-ID",
        "= =7=>=E=K=V=y=",
        ".?AVCXXXXXHandledException@?BA@??DoExecute@CCompressWIMBootFiles@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ".PAVCXXXXXTemp@?OE@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ":\":9:O:f:|:",
        "4!454=4C4Y4i4}4",
        "4#4B4d4",
        ".?AV?$CAutoComFree@PAU_VDS_PARTITION_PROP@@@RAII@@",
        "int __thiscall UnBCL::ArrayList<class CImageInfo *>::IndexOf(class CImageInfo *,int,int) const",
        "LocalAlloc",
        "VERBOSE: MOVETRACK: Destination reparse point could not be removed. Error: 0x%08X",
        "ERROR_INSUFFICIENT_POWER",
        "{326E6B18-8A25-4480-BCCB-B2CD57B4EB41}",
        "%SystemRoot%\\Panther\\SafeOS-um.etl",
        "%hs: Failed to get the host volume name for VHD boot OS.",
        "4(40484H4T4t4|4",
        "BfsMigrateLoaderSettings failed to migrate settings %#x",
        "struct IVdsDisk *__thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,&protected: static struct IVdsDisk * __stdcall UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsDisk *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "FH0_H",
        "HKEY_CURRENT_USER",
        "BootLogLastBootdiagErrorCode:%d",
        ">W>c>{>",
        "?Equals@Object@UnBCL@@UBEHPBV12@@Z",
        "4 4$4(4,4044484@4D4H4L4P4T4X4`4d4h4l4t4x4",
        ".?AU?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAUHKEY__@@@UnBCL@@@UnBCL@@",
        ".?AVCSetupPlatformPrivate@@",
        ".?AU?$IList@W4OP_OPERATION_ID@@@UnBCL@@",
        ".?AV?$SerializableBase@VCNewSystem@@$0A@V?$DefaultInstanceFactory@VCNewSystem@@@UnBCL@@@UnBCL@@",
        "pSetupStringTableEnum StrTabDriverStoreInfs failed, Err = 0x%lx",
        "; ;';<;L;];i;~;",
        "pCopyTelemetryFile: fail to write to file %s. Error code: %d",
        "%02hhx",
        ".?AU?$IEnumerable@PBG@UnBCL@@",
        ".?AV?$SmartPtr@V?$ArrayList@PAVDiskLayout@@@UnBCL@@@UnBCL@@",
        "CSetupPlatform::WriteLog",
        "xSuspend",
        "CSetupAutomation::CacheInstallTarget: Error getting install drive letter: 0x%08x",
        "DeviceIoControl",
        "8 9Y9r9",
        "struct SetupPlatform::IPartition *__thiscall UnBCL::_::ArrayListEnumerator<struct SetupPlatform::IPartition *>::get_Current(void) const",
        "Failed to get decoder context",
        "%ws.{%.8x-%.4x-%.4x-%.2x%.2x-%.2x%.2x%.2x%.2x%.2x%.2x}",
        "SysprepSession::CreateSession: Successfully created instance with action file %s, and mode %s",
        "=H=O=p=",
        "%hs: Cannot read main WIM image path. Error: 0x%08X",
        "$(runtime.programdata)",
        "?%?2?7?C?U?]?j?z?",
        "ERROR_INSTALL_PACKAGE_VERSION",
        "qps-Latn-x-sh",
        ">'>:>P>v>}>",
        "SPAPI_E_NON_WINDOWS_NT_DRIVER",
        "4$4.484O4]4g4q4",
        ":Q:c:k:q:z:",
        "    Failed to assemble destination folder",
        "CNewSystem::QueueSetupAutomation: Failed to get OC replication (0x%08X)",
        "  Initial decision for this driver (WinPE): %s",
        "PACKAGEID",
        "WVh (",
        "Failed to retrieve installed INF names for all devices, Err = 0x%lx",
        "<\"<P<e<x<",
        "JET_errInvalidLanguageId",
        ".?AV?$SmartPtr@VCDriverInstallInfo@@@UnBCL@@",
        "8'8=8F8L8]8f8o8y8",
        ":D:Q:o:{:",
        ";Q;Z;p;};",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::Insert(int,class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *)",
        "1 1<1@1\\1`1|1",
        "<4<J<n<",
        "7\"7@7M7k7",
        "ERROR_CANNOT_MAKE",
        "=%=4=P=Z=d=j=w=",
        ":>;t;",
        "?&?9?L?S?Y?^?i?x?",
        "OC::CInstalledOCStore::GetOCsThatNeedAStateChange",
        "CMigrateFramework: Gather framework failed. Status: %d",
        "8$8.8;8O8Y8b8l8",
        "<-<C<v<",
        "sv-FI",
        "UpdateBootCode: ReadBootCode failed!",
        "?get_TotalMilliseconds@TimeSpan@UnBCL@@QBENXZ",
        ".?AVCXXXXXHandledException@?EB@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        ".?AV?$SmartPtr@VDirectoryInfo@UnBCL@@@UnBCL@@",
        "__thiscall UnBCL::ArrayList<struct DiskMatchFilter>::ArrayList(const struct UnBCL::ICollection<struct DiskMatchFilter> *)",
        "5,6>6F6L6Y6k6y6",
        "0$0,080\\0d0l0t0|0",
        "There are %d created snapshots",
        ".?AV?$CAutoCleanupBase@PAUITracing@@@Mig@@",
        "> >(>4>T>`>",
        "DiagERSubmit",
        "ERROR_DISK_FULL",
        "ERROR_NO_USER_SESSION_KEY",
        "0 0&0,02080>0D0J0P0V0\\0b0h0n0t0z0",
        "1?1X1m1u1{1",
        "yMicrosoft-Windows-FodMetadata-Package~",
        "0#0*000<0H0v0",
        "0#0c0s0",
        "WINDOWS/VERSION/BUILD",
        "memcpy_s",
        "DeleteFileEx: Unable to allocate hardlink path buffer",
        "<5<K<",
        "GetTempFileNameW",
        "8;8O8",
        "4.4M4p4~4",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *> *)",
        "4#4)4.494J4R4X4]4q4}4",
        "DiskLayout::VerifyLayoutCreatedParams",
        "Failed to open service %s. Error: 0x%08X",
        "?FromMultiSz@MultiSz@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBG@Z",
        "8 8-848:8E8W8o8u8",
        ":0:7:G:v:",
        "6,606H6L6d6h6",
        ">3>J>V>i>s>",
        ".?AU?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@UnBCL@@@UnBCL@@",
        "ERROR_INVALID_PIXEL_FORMAT",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAUISerializable@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "=@=N=W=`=i=r=",
        "VhHAc",
        "Reserved.DynamicUpdate.Critical",
        "=!>)>>>U>[>f>t>",
        "VdsPlatform::IsAvailable",
        "?FormatV@String@UnBCL@@SGPAV12@PBGPAD@Z",
        "CBS_E_STORE_TOO_MUCH_CORRUPTION",
        ":%<L<i<",
        "Unexpected subsystem: %d specified in NT header from file: %S",
        "ERROR_INVALID_VARIANT",
        "VERBOSEOPS: %sChecking dependent operation (Must Execute Before) with ID %u",
        ".PAVCXXXXXTemp@?3??BuildDiskInfoFromPath@CGlobalPath@@SGJPAVString@UnBCL@@PAPAV34@PAKPA_K21@Z@",
        "RtlRandom",
        "CNGenCleanup::DoExecute",
        "class UnBCL::ArrayList<class SysprepAction *> *__stdcall SysprepComponent::CreateSysprepActionList(class UnBCL::XmlNode *)",
        "<#<*<<<U<b<t<",
        "4\"4)4A4K4",
        "SPEnableSetupAutoLoggerSession",
        "Boot entry exists for DontSync with ID 0x%x",
        "= =0=A=M=d=p=",
        "?GetOSVersion@Environment@UnBCL@@SGPBVOperatingSystem@2@H@Z",
        "3_3o3{3",
        "ERROR_PAGE_FAULT_COPY_ON_WRITE",
        ":#:>:C:p:",
        "1K2^2w2~2",
        ".?AV?$SmartPtr@VCCopyInfo@@@UnBCL@@",
        ".?AV?$CAutoCleanupBase@PAVSmPoolDisk@@@RAII@@",
        "<#<;<U<",
        "BcdCopyObjectEx: Failed to get generate object guid. Flags: 0x%x Status: %x",
        ".?AVSimpleException@@",
        "Shell folder %s: proposed path is the same with default path: %s",
        ".?AVVdsPlatform@@",
        ".PAVArgumentException@UnBCL@@",
        "WIM_Verbose_Logging",
        "%hs: Cannot queue file creation operation. Error: 0x%08X",
        "Failed to enable journaling on the applied volume.",
        "SPQuerySnapshotSize",
        "%hs: caught exception: %s",
        "~8;~0r",
        "=,=0=H=L=d=h=",
        "JET_errLogFileNotCopied",
        "class CFileCreationData *__thiscall UnBCL::_::ArrayListEnumerator<class CFileCreationData *>::get_Current(void) const",
        ";\";=;T;\\;b;g;|;",
        "(%lx): Could not allocate memory.",
        "??0RegistryKey@UnBCL@@QAE@PAUHKEY__@@H@Z",
        "{AFE86631-9937-473A-8537-939331A2A0C9}",
        "Failed to create HKLM\\SYSTEM\\Setup",
        "0.1;1[1i1",
        "9#979C9O9[9g9s9",
        "8#8)8.898@8T8l8",
        "CDeviceIdDatabase::Initialize: SetupDiGetClassDevs failed; hr = 0x%08X",
        "invalid string position",
        "8#858=8C8W8]8f8|8",
        "REG_DWORD_LITTLE_ENDIAN",
        "%hs: Delete unnecessary files",
        "VWhP^",
        "{2745B11E-DFF5-49FA-8143-F161F919EDB0}",
        "{4F39D4A5-281D-4C04-B879-772D7180C932}",
        "A,;F8u",
        ".PAVCXXXXXHandledException@?2??CreateRamdiskOptions@CAddSafeOSBootEntry@@IAEJPAXPBG1PAU_GUID@@@Z@",
        "%userprofile%",
        "7@8L8",
        "Failed to set default bootmgr object. Status = [%x]",
        "SPCreateTempPageFileForCrashDumpCapsule: Temporary page file at %s was already active",
        "7 808<8T8Z8l8|8",
        ".?AVCEnableSafeOSPageFile@@",
        "ERROR_SXS_PRIVATE_MANIFEST_CROSS_PATH_WITH_REPARSE_POINT",
        "ERROR_RING2_STACK_IN_USE",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,struct HKEY__ *> __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,struct HKEY__ *>,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,struct HKEY__ *> __stdcall UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,class ATL::CElementTraits<struct HKEY__ *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "PinningFolderList",
        "7$72797A7F7Q7d7n7",
        "ERROR_IPSEC_MM_POLICY_NOT_FOUND",
        "ERROR_IPSEC_IKE_NO_PEER_CERT",
        ":2;J;^;z;",
        "j`Yf;",
        ".?AV?$SmartPtr@VCDiagnosticsHelper@@@UnBCL@@",
        "LastModificationTime",
        ".?AUEmptyType@MP@UnBCL@@",
        ":?:]:l:{:",
        "E_ABORT",
        ".?AV?$CAutoRelease@PAVVdsPlatformDiskEnumerator@@@RAII@@",
        "21292?2L2^2l2",
        ">3>N>_>t>|>",
        "FsSecureSDFailedUpdateCount",
        "DriverStoreOpenW",
        ".?AU?$IList@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVCGlobalPath@@@UnBCL@@@UnBCL@@",
        "__thiscall UnBCL::ArrayList<struct DISK_SPACE_IMPACT>::ArrayList(const struct UnBCL::ICollection<struct DISK_SPACE_IMPACT> *)",
        "GetSecurityInfo",
        ":':2:=:H:S:X:d:",
        "void __thiscall UnBCL::Array<class ISPPluginData *>::InitLarva(class UnBCL::ArrayList<class ISPPluginData *> *)",
        "?\"?/?=?U?[?q?",
        "ERROR_NO_NET_OR_BAD_PATH",
        ";-;;;D;M;V;b;k;t;};",
        "=d>q>",
        "343d3",
        "3!3.383H3W3g3o3~3",
        "VWhX+",
        "s%08x",
        "7#727<7A7I7P7\\7n7",
        ";A$uI",
        "Cannot register driver to remove. Recovery cannot continue.",
        ".?AV?$ArrayList@PAVCOperationsValidator@@@UnBCL@@",
        "SL_E_CHPA_REISSUANCE_LIMIT_NOT_FOUND",
        "void __thiscall UnBCL::ArrayList<class CFailForwardSystem *>::RemoveAt(int)",
        "7)7<7D7K7R7]7j7~7",
        "<:<N<W<h<t<~<",
        "SPReportSnapshotState: Failed to initialize COM. Error: 0x%08X",
        "VdsPartition::CreateLogicalPartition: Can't get logical partition properties (0x%08x)",
        "1=1Y1|1",
        "666@6V6m6t6z6",
        ";&;,;8;I;V;b;j;t;|;",
        "848<8D8L8T8\\8d8l8t8|8",
        "7 7;7F7T7b7p7~7",
        "6/676",
        "fy-NL",
        ">)>5>:>C>J>W>c>l>x>}>",
        "WVhh+",
        "t9htm",
        "9&9:9H9X9_9e9j9v9",
        "3)3E3Z3s3",
        "__thiscall UnBCL::ArrayList<class CImageInfo *>::ArrayList(const struct UnBCL::ICollection<class CImageInfo *> *)",
        ".?AVCWIMImageInfo@@",
        "2004-01-02T06:00:00",
        "=*=K=S=Y=^=c=r=",
        ".?AUIBcdSettings@SetupPlatform@@",
        "om-ET",
        ".?AU?$IEnumerable@PAVCPartitionInfo@@@UnBCL@@",
        "CFastDeleteImplT<class CDirectoryProviderT<class CWindowsOldAdaptor>,1>::BuildVolumeHierarchy",
        "negative start index to CopyTo",
        "5:6t6",
        "<\"<+<3<",
        "9s\\tOVV",
        ".?AU?$IEnumerable@_J@UnBCL@@",
        ".?AV?$CAutoCleanupBase@PAUIMigFileAccess@@@RAII@@",
        "pkeyconfig.xrm-ms",
        ".?AV?$DefaultInstanceFactory@VCFirstBootApplyFromICB@@@UnBCL@@",
        ">#>0>6>;>]>i>{>",
        "5 51585N5i5o5y5~5",
        "<#<0<A<W<~<",
        "7 7(737;7a7h7o7{7",
        "_DismSysprepSpecialize",
        "<5<E<U<e<u<",
        "FolderMoveRollback: An error occurred reading the folder move list",
        "%hs: Failure",
        "121[1g1v1",
        "void __thiscall UnBCL::ArrayList<class CInfFile *>::RemoveAt(int)",
        "    Failed to create payload enumerator",
        "VdsPlatform::Initialize",
        "CleanupExtractRemainingStubs",
        "1&2m2",
        "6,7>7F7L7Y7k7y7",
        "SPProcessBitlockerOnDrives: Failed to determine bitlocker status. Error: 0x%08X",
        "void __thiscall UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *>::CopyTo(class UnBCL::Array<class CDeviceIdDatabase::CDeviceInfoData *> *,int) const",
        "QSVW3",
        ">2>@>J>T>k>y>",
        "D$$9E",
        "7C7N7e7{7",
        "<$<-<6<?<K<_<k<t<",
        "Start uploading diagnostics data for setup platform",
        ">.?C?i?~?",
        "1@1S1v1",
        "lb-LU",
        ")SmImageDisk::Initialize",
        "int __thiscall UnBCL::Array<class SysprepComponent *>::Add(class SysprepComponent *)",
        "WIMBoot",
        ";3;A;J;Z;j;};",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCCFGSectionValue@@@UnBCL@@@UnBCL@@",
        ">$>,>4><>L>T>\\>d>l>t>|>",
        "97:@:L:s:",
        "j)j#j",
        "8$878J8\\8{8",
        ">;?C?P?d?p?|?",
        "8.858<8B8O8d8r8",
        "DownLevelBuildNumber",
        "ERROR_FATAL_APP_EXIT",
        ".?AVCXXXXXHandledException@?M@??GetClientDUPackages@CSetupPlatform@@UAEJPAXPAUIDUDownloadProgress@SetupPlatform@@PAPAUIDUPackageCollection@4@PAH@Z@",
        "void __thiscall CMediaLayout::UpdateStoredPath(class UnBCL::String *,class UnBCL::String *)",
        "Failed to save rollback state, will continue execution. Error: 0x%08X",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAVCSPInternalPluginData@@UTableKey@?$Hashtable@PAVString@UnBCL@@PAVCSPInternalPluginData@@@2@PAV12@UKeyTraits@52@$1?RetrieveKey@52@KGPAV12@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAVCSPInternalPluginData@@@UnBCL@@PAVCSPInternalPluginData@@UKeyTraits@23@V?$CElementTraits@PAVCSPInternalPluginData@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "6/6?6F6L6Q6\\6i6q6z6",
        "CFG Validator: Failed to process section [%s], skip checking containment. Error: 0x%08X",
        "CSetupPlatformPrivate::Execute: Failed to serialize operations queue. Error: 0x%08X",
        "6 7`7",
        "XProvPackage%d",
        "2_2q2y2",
        "RestoreDirMetadata: RestoreFileInfo failed",
        "We have %d added profiles",
        "CSetupPlatform::DownloadDynamicUpdates: Failed to download updates. Error: 0x%08X",
        "979K9d9",
        ".PAVCXXXXXHandledException@?2??Rollback@CSetupPlatformPrivate@@UAEJW4ROLLBACK_PHASE@SetupPlatform@@HHPAU_PROGRESS_DATA@4@@Z@",
        "WVhTy",
        ">3?F?z?",
        "ERROR_TOO_MANY_SECRETS",
        "1&1B1Y1h1",
        "3%3F3j3{3",
        ";+;N;y;",
        "%hs: Failed to read the %s OS entry GUID from %s. hr = 0x%X",
        "CountChunkedByteCallback",
        "> >'>->2>:>A>N>Y>e>q>",
        "6/6W6l6",
        "ShutdownDeviceType:%u",
        "6)656:6H6j6w6",
        "CDiagnosticsHelper::Merge: Found Watson event name: external [%s] and internal [%s]; will keep internal value.",
        "8 8t8",
        "ERROR_CLUSTER_NETWORK_ALREADY_ONLINE",
        "?X?n?",
        "? ?'?.?4?A?V?d?r?",
        "DiskLayout::ExecDeletions: Failed to get properties for partition %u",
        "DiskLayout::ExecCreations: Failed to create partition %u",
        "='>->8>F>",
        ".?AVCXXXXXHandledException@?2??SPApplyCustomDiskConfig@@YGJPAUIWpxDeplInsSettings@@W4_FIRMWARE_TYPE@@PAUIDiskPlatform@@PAX@Z@",
        ".?AV?$DefaultInstanceFactory@VCSaveConfigData@@@UnBCL@@",
        "70787@7H7T7t7",
        ":;:U:p:",
        "5*5H5b5m5}5",
        ".PAVCXXXXXHandledException@?HC@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        ".?AVCXXXXXHandledException@?EM@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "494G4b4",
        "CFfuMiscHelpersT<class CEmptyType>::GenerateCatalog",
        "5.5C5d5",
        "DiskLayout::ExecCreations: Operation cancelled",
        "    Type: Driver",
        "First boot apply from ICB is using replacement manifests in %s",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,class CDriverInstallInfo *>,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,class CDriverInstallInfo *> __stdcall UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,class ATL::CElementTraits<class CDriverInstallInfo *> > const *,struct __POSITION * const &)>::Reset(void)",
        "%hs: Failed to set BCDE_OSLOADER_TYPE_WINPE field. Status = %d",
        "5/5H5]5p5x5~5",
        "7I7]7",
        ".?AV?$DefaultInstanceFactory@VCLPValidator@@@UnBCL@@",
        ";$;+;=;P;",
        "y SVh`",
        "void __stdcall ForEachPartition<class <lambda_2fdd735333666824fb4fff880b7fb12a>::()::<lambda_ec581b8e78ab927428d43afec0c37977>>(struct SetupPlatform::IDisk *,class <lambda_2fdd735333666824fb4fff880b7fb12a>::()::<lambda_ec581b8e78ab927428d43afec0c37977>)",
        "MIG_CONTENT_COMPARE_ACLS",
        "8!9L9a9v9",
        "ERROR_LOG_PINNED",
        "void __thiscall UnBCL::ArrayList<class ISPPluginData *>::CopyTo(class UnBCL::Array<class ISPPluginData *> *,int) const",
        "8K9S9",
        "ZwSetSecurityObject",
        "wof.sys",
        "6!6'646F6c6",
        "{625E6838-4D69-4746-8978-8D803193EBFD}",
        "void __thiscall UnBCL::ArrayList<class CUserProfile *>::RemoveAt(int)",
        "$0:0L0Y0",
        "CSetupAutomation::SetDataMigration: Unsupported data migration scope for automation",
        "SPAPI_E_NO_COMPAT_DRIVERS",
        "WER\\ReportQueue",
        "RemoveData",
        "SetupPlatform: Executing StopAsync commands: Failure while executing commands.",
        "6(6D6`6|6",
        " /stopasync",
        "ERROR_PRINTER_DRIVER_PACKAGE_IN_USE",
        "WinReInstallOnTargetOS",
        "DriveLetter",
        "winsxs",
        "GetTextAlign",
        "?%?5?F?N?U?Z?d?~?",
        "XCLPValidator::BuildLPList",
        "ERROR_BAD_REM_ADAP",
        "|SOURCE|\\|RESOURCES|",
        "BBBBB-BBBBB-BBBBB-BBBBB-BBBBB",
        ".PAVCXXXXXHandledException@?BE@??QueueAddCbsPackage@CNewSystem@@IAEJHPAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@_K@UnBCL@@@UnBCL@@HW4SP_ERROR_HANDLING@SetupPlatform@@KW4OP_OPERATION_ID@@@Z@",
        "8#8/8S8X8d8",
        ";3;t;",
        "8>8M8V8d8q8v8",
        ";%;8;@;F;K;];f;r;",
        "\\]^_`abcdefghijklmnopqrstuvwxyz{|}~",
        "CreateDirectoryW",
        "SPDeleteOldUpgradeSnapshots: Cannot load [%s]. Error: 0x%08x",
        "7'8J8",
        "{06FA00C9-411E-4F71-AF59-601EBA33796C}",
        "RegEnumKeyW",
        "es-VE",
        ":\":>:^:w:",
        "=D=w=",
        ":':A:R:Y:_:d:o:z:",
        "3 33383A3P3_3k3r3x3}3",
        "hr-HR",
        "VdsVolume::Format: Failed to query IID_IVdsVolumeMF3 interface [%s] (0x%08x)",
        "RPC_S_NOT_RPC_ERROR",
        "5)555F5S5c5v5",
        "4#5<5}5",
        "generalize",
        "2*262B2R2Z2a2f2r2~2",
        ">E>J>O>[>",
        "NtQueryDirectoryObject",
        "3,3B3J3T3\\3f3m3s3x3",
        "ERROR_IPSEC_IKE_NO_MM_POLICY",
        "%hs: Failed to persist diagnostics data: 0x%08X",
        "8%8*858E8Y8a8l8x8",
        ": :*:3:<:E:N:W:p:~:",
        "%s\\Control\\Windows",
        ";F<Z<l<t<z<",
        "3%3;3I3[3g3",
        "INF %ws was removed.",
        "class CUserProfile *&__thiscall UnBCL::ArrayList<class CUserProfile *>::get_Item(int)",
        "VSh0T",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CSimpleCleanup::CCleanupEntry *>::MoveNext(void)",
        "JET_errInvalidColumnType",
        ".?AU?$IList@PAG@UnBCL@@",
        "en-US",
        "PVWh<",
        "5&5K5^5e5k5p5{5",
        "4*4^4j4u4",
        "ERROR_DS_INVALID_NAME_FOR_SPN",
        "<)=<=g=s=",
        "Failed to open subkey: %ls",
        "Could not create new windows at %S",
        "SL_E_CHPA_TIMEBASED_ACTIVATION_AFTER_END_DATE",
        "< =`=",
        "Profiles have been added on the new system. Nevertheless, uninstall will continue.",
        "6<6l6s6y6~6",
        ".?AVCXXXXXHandledException@?EF@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "ERROR_REC_NON_EXISTENT",
        "SclpGetMountPoints",
        "startService",
        "ERROR_INVALID_LIBRARY",
        "Gather data, scope: %s",
        "StateStoreLoadMountEntry",
        "0 1:1j1x1",
        "SVWj@",
        "=%=3=<=]=s=",
        "~ ;^$~",
        "\\StringFileInfo\\%04x%04x\\InternalName",
        "<%<-<L<T<^<e<k<p<{<",
        "SetupPlatform::IsUninstallAllowed failed on %s. Error: 0x%08X",
        "Failed to copy source string to destination",
        "WPWh?",
        "ERROR_CLUSTER_DATABASE_SEQMISMATCH",
        "%d.Status",
        ":_;s;",
        ".?AVCXXXXXHandledException@?2??SaveTelemetryFields@CReconstructOS@@IAEXKK_N@Z@",
        "base\\ntsetup\\setup\\lib\\usbbootlib\\src\\usbbootlib.c",
        "Found WIMBoot entry for %s but it's in the list of exceptions, ignoring",
        "void __thiscall UnBCL::ArrayList<class COperationResult *>::set_Item(int,class COperationResult *)",
        "0:1L1b1",
        "=$=1=D=N=[=d=s=",
        "8(808H8P8h8p8x8",
        "CDownloadDUUpdates::MoveOrCopyUpdates: IDUUpdate::GetWUAInterface failed. hr = 0x%x",
        ".?AV?$SerializableArrayListBase@PAVCOperationsValidator@@@_@UnBCL@@",
        "333K3\\3c3t3",
        "ERROR_RESOURCE_TYPE_NOT_FOUND",
        "JET_errInvalidDatabase",
        "PLUGINPROC: Adding to an existent plugin: %s",
        "1\"1*101=1O1c1",
        "ocStatusFilePath",
        "7&7.7C7Z7`7k7y7",
        "CDeploymentBase::PreInitialize",
        "7-8Y8k8s8y8",
        "ERROR_WAIT_FOR_OPLOCK",
        "3L4T4l4",
        "989[9",
        "6*676>6D6I6T6^6c6w6",
        ")pRollbackRoot",
        "=$=:=H=Z=a=g=l=w=",
        "ERROR_USER_EXISTS",
        "0\"060?0H0_0m0~0",
        "                                   BIOS name : %s",
        "SWh|y",
        ".?AVCXXXXXHandledException@?BE@??SPValidateTrackedContent@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@000PAH1PAPAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@2@Z@",
        "4=4K4j4x4",
        "5$5<5D5L5T5\\5d5l5",
        "0jPh<",
        "?$?9?L?W?f?",
        "ERROR_SERVICE_NOTIFY_CLIENT_LAGGING",
        "?$?8?L?`?t?",
        "pSaveMountedImageWimbootEntries",
        "2%222<2K2T2Z2g2m2r2",
        ".?AVCApplyDrivers@@",
        "<.<7<@<N<]<u<|<",
        "CBS_E_EXCLUSIVE_WOULD_MERGE",
        "y#Vhh",
        "= =,=4=L=T=l=t=|=",
        "DUInstallFailedHR",
        ".?AVCXXXXXHandledException@?2??BuildLPList@CLPValidator@@IAEJPAUIExecutionContext@@PAV?$ArrayList@PAVString@UnBCL@@@UnBCL@@@Z@",
        "='=4=<=M=Z=b=s=",
        "ar-OM",
        "WINTRUST.dll",
        ".?AU?$IEnumerator@PAVCOperationResult@@@UnBCL@@",
        "8#888I8v8",
        "(%lx): Failed to expand [%ws]!",
        "2 20262J2]2i2p2",
        "5 545<5D5T5`5h5",
        "unsigned short *&__thiscall UnBCL::ArrayList<unsigned short *>::get_Item(int)",
        "1$1-161B1c1z1",
        "142M2T2[2a2m2",
        "Failed to get Upgrade snapshot policy OneSetting, 0x%x",
        "int __thiscall UnBCL::Array<class ISPPluginData *>::Add(class ISPPluginData *)",
        "Failed to create WIM handle for %s. Error: 0x%08X",
        "%hs: Failed to suspend bitlocker. Error: 0x%08X",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::RemoveAt(int)",
        ".?AVCDebuggingSetting@@",
        "5,51565B5R5",
        "void __thiscall UnBCL::Array<struct DiskRange>::Remove(struct DiskRange)",
        "enum MIGSTATUS __stdcall SPExecuteFirstBootApplyFromICB(class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,int,struct ISPTelemetryData **,struct ISPMigProgress *,long *)",
        ".?AU?$IDictionary@PAVString@UnBCL@@H@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *> *,int,int)",
        "3!4@4H4w4",
        "CBS_E_ABORT",
        "212T2",
        "CreatedSnapshotsQueriedNum",
        "%hs: Failed to load module %s. Error: 0x%08X",
        "Found loaded store at key %s",
        "void __thiscall UnBCL::Array<struct PartitionLayoutArgs *>::Insert(int,struct PartitionLayoutArgs *)",
        "5-6X6a6",
        ".?AVCUnmountWIM@@",
        "Rollback re-initialization failed",
        ">&>3>K>V>d>r>",
        "<'<5<I<^<",
        ".?AU?$ICollection@PAVSysprepComponent@@@UnBCL@@",
        "ERROR_DS_NOTIFY_FILTER_TOO_COMPLEX",
        "0\"0'030:0J0V0b0q0v0",
        "ERROR_CONTROL_ID_NOT_FOUND",
        ";0;G;U;_;i;s;};",
        ":(;h;",
        "%hs: Failure to delete %s. Error: 0x%08X",
        ": :;:T:[:a:f:q:|:",
        "DRVMIG: Upgrade and DISM disagree about boot critical driver status, we will need an extra driver migration phase for WinRE",
        "CCreateFileForNewSystem::DoExecute",
        "    Manufacturer: %s",
        "SVWj j",
        "RemoveDirectoryW",
        "DUNetworkPolicySwitched",
        "ERROR_SXS_XML_E_INVALID_VERSION",
        "1%1P1W1]1b1m1{1",
        "8+878R8_8o8",
        ">/>a>",
        "D$<PS",
        ".?AU?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@@UnBCL@@",
        "6)6G6g6",
        "9>9U9",
        "%systemdrive%\\windows.old",
        ":\":(:5:G:U:v:",
        "SWhp$",
        "SPFreeDiskRangeEnumerator::Initialize: Get NULL pointer as input ArrayList",
        "SPApplyAnswerFileSettings: Failed to inject unattend file (0x%08x)",
        "\\Panther\\Dl-km.etl",
        "CMediaLayout::QueueWIMSplit",
        "\\PFPort",
        "<%<;<Y<s<",
        "<#<*<3<8<C<U<i<r<{<",
        "7+787M7U7[7i7",
        "ERROR_INSTALL_ALREADY_RUNNING",
        "ERROR_ASSERTION_FAILURE",
        "EnumerateDirCallback",
        "0#0)0.090D0T0\\0o0w0",
        ":D:O:",
        "ERROR_LOG_CORRUPTION_DETECTED",
        ";!;5;:;?;E;J;S;d;o;y;",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::Add(class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *)",
        "<\"<4<=<E<K<P<_<l<",
        "<$=C=g=",
        "808F8]8e8n8",
        "=+=J=a=",
        "<U<Z<d<",
        "Failed to load WofAdk!",
        "We have %d moved profiles",
        "CSetupPlatformCheckpoint::CopyLogFiles: An error occurred while processing the setupapi log folder",
        ".?AVCXXXXXHandledException@?BPI@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "4!4?4X4y4",
        "MIG Validator: Could not log shell folder information. Status: %d",
        "Failed to empty store. Status: %x",
        "9#9+929M9U9m9t9z9",
        ";!;';4;F;T;u;",
        "Get all the OCs that must be enabled or disbled in the current system...",
        ":,:F:`:",
        "4&4@4d4",
        "WMU?5=",
        "Getting WMI Uint32 property %s: unexpected VARIANT type %d",
        "?\"?6?E?L?V?[?f?",
        "la-001",
        "NtOpenThreadTokenEx",
        "%hs: Unload hive %s",
        "RPC_S_UNSUPPORTED_NAME_SYNTAX",
        "758b8!9G9[9d9j9o9",
        "GetDiskFreeSpace(%s) failed.",
        "%hs: Failed to set BCDE_LIBRARY_TYPE_INHERIT field. Status = %d",
        "3%323D3N3c3k3q3~3",
        "3<3|3",
        "6i7r7",
        "void __thiscall UnBCL::ArrayList<class CGlobalPathFindData *>::AddRange(const struct UnBCL::ICollection<class CGlobalPathFindData *> *)",
        "%hs: Failed to get the edition ID for component ignore section %s. Error: 0x%08X",
        "pGetExistingPageFiles: Got zero size for page file %s: 0x%08x. Will not use.",
        ".PAVCXXXXXTemp@?3??DoExecute@CMergeWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "OC::COCCbsAdapter::GetOCsInPackage",
        "WVhp_",
        "Failed to cleanup recovery store. Status = [%x]",
        "int __thiscall OSRollbackService::CSetupRollbackService::RollbackInitialize(class OSRollbackService::CCheckpointSequence *,const unsigned short *)",
        "SmDisk::CreatePartition: MBR type not supported on non-MBR disk",
        "1)121>1Q1X1j1",
        ";7;C;L;T;[;a;f;q;};",
        "7\"757K7l7s7y7~7",
        ">*>I>\\>c>i>n>y>",
        ";;;_;",
        ">(>:>B>H>U>g>q>",
        "OC::CDownlevelOCStore::CDownlevelOCStore: Engine's InitDownlevelOCMode failed.",
        ".?AV?$DefaultInstanceFactory@VCInstallDUUpdatesOffline@@@UnBCL@@",
        "242<2D2L2T2\\2d2l2t2",
        "5!5)505<5N5c5r5|5",
        "ERROR_MINIVERSION_INACCESSIBLE_FROM_SPECIFIED_TRANSACTION",
        "MIG_DIAG_SESSION_NAME",
        "VERBOSE: MOVETRACK: Source does not exist, GLE=0x%08X",
        "2,202@2D2T2X2h2l2|2",
        "pSPEnumNextControlSet",
        "2(3p3",
        "?#?*?0?5?@?J?]?p?y?",
        "4 4.4;4M4U4[4h4z4",
        "8H9V9e9",
        "VssFreeSnapshotPropertiesInternal",
        "InitVDSService:Creating VDS loader...",
        "5B5X5k5",
        "9+959>9V9i9",
        "SVWj`3",
        "CSimpleCleanup::DoExecute",
        "283E3]3",
        "1'1N1^1j1q1y1~1",
        "SPCanChangeRecoveryPartition: FindNextVolume failed: 0x%08x",
        "Failed to get kernel mode tracing setting, 0x%x",
        "2)2D2r2",
        "Not enough disk space for the next set of operations.",
        "RegDeleteTreeW",
        "2 2h2",
        ".?AV?$SmartPtr@V?$ArrayList@PAVISPPluginData@@@UnBCL@@@UnBCL@@",
        "464D4M4V4_4h4",
        "RbTel.etl",
        ".PAVNotSupportedException@UnBCL@@",
        "GlobalPath",
        "1*141H1s1",
        "%hs: Begin run (%s)",
        "1 1&1/171F1M1S1X1c1n1~1",
        ": :$:<:@:X:\\:t:x:",
        ">;>F>T>b>p>",
        "9\"939>9L9x9",
        ".?AU?$IDictionary@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@",
        "?get_CString@String@UnBCL@@QBEPBGXZ",
        ".PAVCXXXXXTemp@?3??DoExecute@CSetBootCommand@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "CExecuteUnattend::DoExecute: Couldn't request reboot: 0x%08x",
        "FirstBootActive",
        "ERROR_TRANSACTION_ALREADY_COMMITTED",
        "pCleanupDriversLogCallback",
        "CAddDriver::DoExecute: Failed to initialize DISM. Error: 0x%08X",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::Add(class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *)",
        "SetCurrentDirectoryW",
        "pDUSearchAndDownload: DU search failed. hr = 0x%x",
        "SPDoFrameworkApply",
        "Command line executed successfully. Execution time: %d seconds",
        "Creating new system (5). Old system root: %s, System drive: %c",
        ".?AVXmlSchemaSet@UnBCL@@",
        "<!<(<?<T<n<u<",
        "VdsDisk::EnumeratePartitions: Failed to create partition enumerator (0x%08x)",
        "%windir%",
        "4)464<4B4N4[4c4m4u4{4",
        ")executionTime",
        ";0;>;U;c;z;",
        "ProgressUXType",
        "4(4:4B4H4U4g4u4",
        ".PAVCXXXXXTemp@?6??SPProcessServiceEnable@@YGXPBG@Z@",
        ":\":-:<:C:Q:^:v:",
        "%hs: Get NULL for WatsonEventName",
        "6:6G6j6w6",
        "3!333A3O3]3",
        "SL_E_TOKSTO_NO_ID_SET",
        "?9?@?",
        "ERROR_DS_RIDMGR_INIT_ERROR",
        "SetupDiGetClassDevsExW",
        "?get_InnerException@Exception@UnBCL@@UBEPBV12@XZ",
        "?4?;?A?F?Q?[?o?{?",
        ">E?Y?",
        "?#?b?",
        "Original list of new paths to be removed:",
        "Setting product key",
        "9 9*9C9Z9h9",
        "strncpy_s",
        "CSetupPlatform::CreateNewSystem: Failed to set target disk. hr = 0X%x",
        ";6;O;X;j;",
        "2W2h2o2u2z2",
        "{DB0BC052-0453-4083-AF2F-7418D93C76CC}",
        "?Append@StringBuilder@UnBCL@@QAEPAV12@G@Z",
        "%ProgramFiles%",
        "Setup\\Source OS (Updated on %s)",
        "Failed to get handle to the system store. Status = [%x]",
        ".?AVCSetupPlatformApplyRollbackCheckpoint@@",
        "FOLDERID_SavedPictures",
        "4,535[506>6",
        "ERROR_DS_ALIAS_PROBLEM",
        "ERROR_OPEN_FILES",
        "void __thiscall CSetupPlatformInfo::StreamRead(class UnBCL::SerializationStream &)",
        "_DismSetProductKey",
        "Failed to open registry key of last crash dump. Error: 0x%08X",
        ".?AVCSetBusParams@@",
        ";#;0;=;C;I;Y;i;",
        ".PAVCXXXXXHandledException@?BI@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "5*5J5",
        ";%;7;A;J;T;];s;",
        "OldWIMRollback: Unable to restore WindowsOld.wim",
        ".?AV?$SerializableBase@V?$ArrayList@PAUISerializable@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAUISerializable@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "pSystem32\\config\\SOFTWARE",
        "SPDetachDiskImage: DetachVirtualDisk failed: %u",
        "int __thiscall UnBCL::_::ArrayListEnumerator<void *>::MoveNext(void)",
        "MigGather",
        "WIMExtractImagePathByWimHandle",
        "CBS_E_STORE_CORRUPTION",
        "1#111?1",
        "2 202<2D2l2t2|2",
        ".?AV?$DefaultInstanceFactory@VCPrepareSafeOSForRollback@@@UnBCL@@",
        "Printed name string copy failed",
        "8(868V8q8w8",
        ":0:l:",
        "Failed to set ProfileInterval: 0x%x",
        "void __thiscall UnBCL::ArrayList<struct SetupPlatform::IPartition *>::Resize(int,int)",
        "ARPRemovedList",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::Insert(int,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *)",
        "6>6T6^6q6x6~6",
        "t,WVS",
        "030L0",
        "ro-MD",
        "fwprintf_s",
        "= >2>:>@>M>_>",
        "JET_errFileIOBeyondEOF",
        ";U;];h;o;z;",
        "=,=4=<=H=P=t=|=",
        "<,<4<H<\\<p<",
        ".?AVCXXXXXHandledException@?EI@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "ERROR_INVALID_LB_MESSAGE",
        "4(4D4H4L4P4`4h4l4p4t4|4",
        ";.;8;J;R;X;b;l;",
        "JET_errOutOfMemory",
        "=`>(?",
        "DiskLayout::ApplyLayout: Failed to apply partition in-place modification %u to disk layout (0x%08x)",
        "RPC_S_SEND_INCOMPLETE",
        "=0=7=>=I=T=h=",
        "ERROR_BAD_DRIVER_LEVEL",
        "9 9@9H9P9X9`9p9",
        "2)2/2A2R2_2",
        ".?AV?$SerializableBase@VCPrepareSafeOSBootRemoval@@$0A@V?$DefaultInstanceFactory@VCPrepareSafeOSBootRemoval@@@UnBCL@@@UnBCL@@",
        "ERROR_DS_DRA_CONNECTION_FAILED",
        "ERROR_EVT_SUBSCRIPTION_TO_DIRECT_CHANNEL",
        "0!0<0B0L0Q0[0b0p0",
        ".?AVOutOfMemoryException@UnBCL@@",
        "5 525H5c5i5s5x5",
        "nb-NO",
        ".?AV?$CAutoCleanupBase@PAVIVssBackupComponents@@@RAII@@",
        "999@9F9K9V9a9u9",
        "=6=q=",
        "%hs: Failed to initialize rollback infrastructure. Error: 0x%08X",
        "OC::COCDismAdapter::InitOffline: DismOpenSession failed. hr = 0x%x",
        ";!<(<.<3<><I<P<d<",
        "ERROR_DATABASE_FULL",
        "000A0V0",
        "=a=i=v=",
        "3T3f3n3t3",
        "1D4K4\"5&5a6",
        "8$8,848<8D8L8T8\\8d8l8t8",
        ";[<d<",
        "131@1S1[1a1n1u1",
        "%hs: Telemetry is not active, nothing to do.",
        "3%4f4",
        "    Failed to get local name",
        "1=1b1i1}1",
        "%ProgramData%\\Microsoft\\Windows\\WER",
        "ARP Validator: Failed to find application %s: %s (%s) - %s",
        ".?AVCOOBEBootApplyFromICB@@",
        "0R1f1x1",
        "9!9/9W9i9y9",
        "8$8+878G8N8Z8j8q8}8",
        "9 9-9?9I9\\9d9j9w9",
        "Substitue name string copy failed",
        "ERROR_IPSEC_IKE_DH_FAIL",
        "IsContainerIDSameAsRootContainerID",
        "void __thiscall UnBCL::ArrayList<class COperation *>::QuickSort(class UnBCL::ArrayList<class COperation *> *,class UnBCL::ArrayList<class COperation *> *,int,int)",
        "Cannot open %s key, uninstall Window expired",
        "7\"797K7S7Y7f7x7",
        "7 747N7m7w7",
        "0$040D0T0d0t0",
        "1#1)1.1:1N1V1\\1j1t1{1",
        "0$0.080F0q0",
        "CDeploymentProject::CreateFFUDeployment: The FFU file %s already exists",
        "9c:m:",
        "?<?`?",
        "9/9H9c9q9x9~9",
        "WVhp'",
        "%hs: BCD failed to retrieve current boot entry. Error: 0x%08X",
        ":%:;:P:n:s:",
        "class CCopyInfo **__thiscall UnBCL::ArrayList<class CCopyInfo *>::GetBuffer(int)",
        "%s\\Inf\\OEM*.inf",
        "CNewSystem::QueueOperations: Only turn off soft reserves",
        "<&<<<R<m<s<}<",
        "BfspPrintFileOwnerProcess: Failed to open file!Last Error = %#x",
        ":S;t;",
        ".?AVCSaveBootEntriesOldOS@@",
        "505L5P5p5",
        ".?AV?$SmartPtr@U?$IEnumerator@V?$DictionaryEntry@KPAUIVdsDisk@@@UnBCL@@@UnBCL@@@UnBCL@@",
        ".PAVCXXXXXTemp@?FP@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "5\"5-575<5P5g5",
        "Failed to delete \"%ws\" variable. Status: %x",
        "879n9u9",
        "2\"2>2F2[2c2p2u2",
        ">,>2>;>Q>^>p>x>~>",
        "SetupPlatform: Phase \"Post-SysPrep\" started",
        "GetFileVersionInfoW",
        "N0PSSS",
        ".?AVNumericProperty@?1???$pDefineNumericProperty@V<lambda_dc5d2efdeb78952c9370388602f93bf2>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_dc5d2efdeb78952c9370388602f93bf2>@@@Z@",
        "{62E7CBF7-AD76-4450-9959-4C3743ECB153}",
        "<'<2<M<Y<a<h<n<s<~<",
        "BOOTMGR is missing",
        "889K9Y9^9h9",
        "void __thiscall UnBCL::Array<class CAntiVirusInfo *>::Remove(class CAntiVirusInfo *)",
        ".?AVCStopSuspendedServices@@",
        "not present",
        "97:F:}:",
        "686S6d6",
        "8)8;8R8y8",
        "VdsDisk::Initialize: Failed to get the next provider (0x%08x)",
        "1I1^1i1s1x1",
        "CERT_E_UNTRUSTEDCA",
        "SPQueryReserveInfo: Get NULL for Reserve",
        "void __thiscall UnBCL::Array<class CGlobalPath *>::RemoveAt(int)",
        ".?AV?$HTDictEnumBase@V?$DictionaryEntry@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@@_@UnBCL@@",
        "6'656B6O6\\6g6m6w6",
        ".?AV?$DefaultInstanceFactory@VCShellFolderInfo@@@UnBCL@@",
        "3.3A3H3R3_3u3}3",
        "FindAllPaths: Cannot get DOS path from NT path %s. Error: 0x%08X",
        "D$8SVW",
        "ERROR_AUDIT_FAILED",
        "7=7P7i7",
        "WIMCommitImageHandle",
        "CImageInfoSet::CreateFromReconstructionSources: Failure in creating existent image info; Error: 0x%08X",
        "9.9C9h9",
        "?get_InnerText@XmlNode@UnBCL@@QAEPAVString@2@XZ",
        "5 505@5P5`5p5",
        "0.171_1j1",
        "%s.ActualProfile.Old",
        "yoPh0",
        "2 2$2(2,2024282<2@2H2L2P2T2X2\\2d2h2l2t2|2",
        "pGetExistingPageFiles: Failed to load offline SYSTEM hive: 0x%08x.",
        ";';-;2;M;Y;k;",
        "es-CL",
        "int __thiscall UnBCL::_::ArrayListEnumerator<enum OP_EXECUTION_PHASE>::MoveNext(void)",
        "8 8A8H8N8S8^8m8u8{8",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCBcdSetting@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "DriverClassGUID",
        "Final list of Windows.old roots:",
        "1/1D1L1R1_1n1",
        "5$5,545<5D5L5T5\\5d5l5t5|5",
        "? ?%?0?X?_?e?j?r?}?",
        "End Install apply",
        "1/1>1z1",
        "?Copy@Directory@UnBCL@@SGXPBVString@2@0HPAUICopyDelegate@12@@Z",
        "void __thiscall UnBCL::Array<class CImageInfo *>::Insert(int,class CImageInfo *)",
        "CoTaskMemAlloc",
        "WriteFileImage",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,&protected: static enum ActionType __stdcall UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,class ATL::CElementTraits<enum ActionType> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,enum ActionType> *,class UnBCL::Array<enum ActionType> *,int)",
        "CFG Validator: Changes occur in the new list, will invalidate data gather operation",
        "Interruption requested - Process tree for deletion.",
        "D$ SVW",
        "Set reg key value IsSetupComplete failed: 0x%x",
        "2\"2/262<2A2L2R2e2t2",
        ".?AVCExecuteUnattend@@",
        "CreateFileMapping(%s) failed! Error code = %#x",
        "WWWWP",
        ">R>d>m>w>",
        "<#<+<><Q<c<z<",
        "BeginPaint",
        "1F1j1",
        ".?AV?$ValueCollection@KPAUIVdsDisk@@@_@UnBCL@@",
        "Enabling GlobalLoggerSession",
        "Could not create the service, error: 0x%08X",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class OSRollbackService::CCheckpoint *>::Reset(void)",
        "ERROR_LOG_FULL_HANDLER_IN_PROGRESS",
        "DUInstallSkippedReason",
        "%hs: Attempting to remove rollback boot entry",
        ".?AV?$SerializableBase@VCSaveBootEntriesOldOS@@$0A@V?$DefaultInstanceFactory@VCSaveBootEntriesOldOS@@@UnBCL@@@UnBCL@@",
        "3!3k3",
        ".?AVCShellFolderInfo@@",
        "CSetupPlatformPrivate::Execute: Failed to deserialize/execute post-FirstBoot operations. Error: 0x%08X",
        ".?AV?$CAutoRelease@PAVVdsPhysDisk@@@RAII@@",
        ".PAVCXXXXXHandledException@?2??SPValidateProductKey@@YGJPBG00PAPAUIProductKey@SetupPlatform@@@Z@",
        "{2F0172E8-F3C3-45F9-937D-BC5CFA47FD45}",
        "RtlCreateSecurityDescriptor",
        "SPCreateTempPageFileForCrashDumpCapsule: Initialized a %llu byte temporary page file at %s",
        ":\":0:8:>:R:[:c:x:",
        "y'Wh4",
        "fQfWfRf",
        "1%181J1R1X1e1w1",
        "6!7@7",
        "Compare failed -- bad comparison routines?",
        ";$;(;,;4;8;<;D;H;L;T;X;\\;`;h;l;p;t;x;|;",
        "SETUPPLATFORMCOMM: Communication instance will now exit. Progress will not be reported to online setup platform instances.",
        "%hs: Deleting the WinRE partition.",
        "5<LuP",
        "void __thiscall CDeploymentBase::UpdateStoredPath(class UnBCL::String *,class UnBCL::String *)",
        "SetTextCharacterExtra",
        "1D1N1a1|1",
        "282>2H2M2W2^2l2~2",
        "818:8A8N8U8s8",
        ".?AVCXXXXXHandledException@?IM@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "2 2$2(2,2024282<2D2L2P2T2X2\\2`2d2h2l2t2x2|2",
        ":):1:7:D:V:s:",
        "ValidateInput: ByteAlignment cannot be smaller than ChunkSize",
        "MBRDh",
        ".?AV?$SerializableBase@VCStartSuspendedServices@@$0A@V?$DefaultInstanceFactory@VCStartSuspendedServices@@@UnBCL@@@UnBCL@@",
        ".?AU?$IDictionaryEnumerator@KPAUIVdsVDisk@@@UnBCL@@",
        "VdsDisk::Initialize: Disk already initialized (0x%08x)",
        ".?AV?$CAutoCleanupBase@PAE@Mig@@",
        "7)787O7V7g7t7",
        ".?AV?$Array@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@",
        ".?AV?$HTDictEnumBase@V?$DictionaryEntry@GH@UnBCL@@@_@UnBCL@@",
        "Directory \"%s\" exists, but it is not empty.",
        "QjMjIj",
        "Stopping logging before platform creation",
        "WTSFreeMemory",
        "SetupFiles",
        "9&949;9A9F9Q9\\9p9",
        "SetupState\\BTSourcesFolderPath",
        "ERROR_DS_NAME_NOT_UNIQUE",
        "ar-EG",
        "WmiObject::BeginCall: Couldn't get method %s from type %s (0x%08x)",
        "long __thiscall CNewSystem::PreInitialize(class CSetupPlatformInfo *,class CImageInfo *,enum SetupPlatform::SP_DISK_SPACE_OPTION,const unsigned short *,int,int,int,int,int,int,enum SetupPlatform::SP_STORAGE_RESERVE_POLICY,enum SetupPlatform::SP_BITLOCKER_HANDLING)",
        "CAbstractWriter::UpdateOffset",
        "fr-SN",
        "OC::COCCbsAdapter::GetPackageByName: Failed to open package. hr = 0x%x",
        "The type of registry [%s] changed from [%d] to [%d]",
        "L0^0f0l0y0",
        "CRYPT_E_ASN1_BADARGS",
        "6,7O7a7i7o7|7",
        "\\VarFileInfo\\Translation",
        "5,595K5S5Y5f5x5",
        "Getting WMI Iface property %s: unexpected VARIANT type %d",
        "=-=5=I=R=_=",
        "ERROR_INVALID_MESSAGEDEST",
        "CSetupPlatformPrivate::ExecuteFailForward",
        "GetDisk: Finished querying VDS providers.",
        "ERROR_PIPE_LOCAL",
        "OSPiecesOutsideOSVolume",
        "%hs: Failed to determine whether the package is split; Error: 0x%08X",
        "WIM file is inside our root folder, we don't need it anymore after apply.",
        ".PAVCXXXXXHandledException@?5??ValidateUninstall@CSetupPlatformPrivate@@UAEJXZ@",
        "{6A346BA0-593E-4365-A80B-BCCA88EC6D39}",
        "ERROR_NO_SUCH_ALIAS",
        "CSetupAutomation::ResolveTarget: Resolving the target install disk [%u]...",
        "L$(;\\",
        "7*8L8Z8}8",
        "VdsPlatformDiskEnumerator::GetNext: Failed to query IID_IVdsProvider interface [%s] (0x%08x)",
        "SVWj\\",
        "OC::COCDismAdapter::Release",
        "ERROR_HOOK_NOT_INSTALLED",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::RemoveAt(int)",
        "Write-descriptor length = %d",
        "    Failed to write full end element",
        "Cleanup Windows.old: Failed to completely remove requested folders. Error: 0x%08X",
        "CbsCoreInitialize",
        ".?AV?$ArrayListEnumerator@UPartitionInfo@?1??SPGetPartitionOrdinal@@YGJPAUIPartition@SetupPlatform@@PAK@Z@@_@UnBCL@@",
        "?C?P?h?u?",
        "CReconstructOS::ReconstructWindows: Failed to clean up temp files: 0x%08x",
        "SPCleanupInstallationDrive",
        "9D9L9`9t9|9",
        "6#6(6",
        "SKIPBOOTTRACK(SAFEOS): SafeOS boot removal maximum attempts reached, will continue due to force environment variable.",
        ".?AVCImageInfoSet@@",
        ".?AUIProvisioningPackage@@",
        "5,5E5d5~5",
        "4U4d4",
        "?%?0?A?L?Z?",
        "CNewSystem::Initialize",
        "3 3'3-323>3H3[3u3",
        ".?AV?$DefaultInstanceFactory@VCExtractFilesFromWIM@@@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<struct PageFileDesc *>::CopyTo(class UnBCL::Array<struct PageFileDesc *> *,int) const",
        "__thiscall UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *>::ArrayList(const struct UnBCL::ICollection<class OC::CCmdLineExecutionTelemetryData *> *)",
        "1,1C1K1R1",
        "VShha",
        "ERROR_EAS_NOT_SUPPORTED",
        "j\\[f;",
        "jBSSS",
        "LocalPayload\\Driver",
        "PWSh`",
        "IDREF",
        "NtLoadKey",
        "1!1*161B1]1p1x1~1",
        "0#0.0;0K0S0]0d0j0p0{0",
        "333Q3`3i3r3",
        ".?AU?$IList@PAVCMountedPathInfo@CDeploymentBase@@@UnBCL@@",
        "1%1*151@1T1w1~1",
        ".?AVCXXXXXHandledException@?6??SPGetCBSCompletionStatus@@YGJPAVString@UnBCL@@0PAH@Z@",
        "22292?2D2O2^2f2r2",
        "<$<@<D<H<L<\\<d<h<l<p<x<",
        "CDownloadDUUpdates::DoExecuteInternal: Failed to determine space needed by updates; skipping download. hr = 0x%x",
        "yWWht",
        "191@1I1N1Y1f1z1",
        "Failed to build path to ci.dll inside GUID folder.",
        "3#3)3.393D3X3m3",
        "class UnBCL::String *__thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,class ATL::CElementTraits<class CSPInternalPluginData *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "3+3P3b3j3p3}3",
        ".?AV?$SerializableArrayBase@K@_@UnBCL@@",
        ".?AUIInstanceFactory@UnBCL@@",
        "Rollback folder %s does not exist. Error: 0x%08X",
        ".?AV?$SerializableBase@V?$Array@PAVCBcdSetting@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCBcdSetting@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        ".?AV?$CAutoCleanupBase@PAVSmPlatform@@@RAII@@",
        "6!666@6Q6^6m6z6",
        "4)5>5d5y5",
        "VdsVolume::Format: Failed to query IID_IVdsVolumeMF2 interface [%s] (0x%08x)",
        "Cannot open system hive from online system. Error: 0x%08X",
        "int __thiscall UnBCL::ArrayList<class SysprepComponent *>::BinarySearch(int,int,class SysprepComponent *,struct UnBCL::IComparer<class SysprepComponent *> *)",
        "int __thiscall UnBCL::_::HTEnumerator<unsigned short,int,struct UnBCL::Hashtable<unsigned short,int>::TableKey,unsigned short,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,&protected: static unsigned short __stdcall UnBCL::Hashtable<unsigned short,int>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned short,int>::TableKey,int,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "=&=8=_=",
        ".?AVCXXXXXHandledException@?CII@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "7/7;7K7m7t7z7",
        "=T>f>n>t>",
        "%s_%d",
        "ERROR_DESTINATION_ELEMENT_FULL",
        "UpdateBackupBootCode:Failed to update back up boot sector. GLE is [0x%X]",
        "3<3`3",
        "0'050C0",
        "4$4,444@4`4h4p4",
        "3N3\\3k3r3x3}3",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::MoveNext(void)",
        "4F7M7",
        "SPCopyFilesAndFolders: Failed to build source file path %s ++ %s. hr = 0x%x",
        "SERIALIZEVERBOSE: Serializing mount data to %s",
        "1)1@1P1o1{1",
        "SL_E_APPLICATION_POLICIES_MISSING",
        "class CFileCreationData *__stdcall UnBCL::Try_Cast<classCFileCreationData*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "9\"9,9=9J9S9[9a9f9u9~9",
        "pCopyDiagTrack",
        ":/:C:W:^:d:i:t:",
        "SysprepSession::ExecuteAction: Error bypassed for deleteFile operation",
        "CBS_E_HANG_DETECTED",
        ">)?9?S?[?c?",
        "Wait for work queue failed!",
        ".PAVCXXXXXTemp@?N@??UnpackTo@CDUPackage@@UAEJPBG@Z@",
        "SP_KERNEL_MODE_PROVIDERS_DOWNLEVEL",
        "4&4/4<4S4`4w4",
        "3(3,34383@3D3H3L3P3T3\\3t3",
        "Removing setup event queue file: %s",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::RemoveAt(int)",
        ".?AVCXXXXXHandledException@?CO@??SPCanChangeRecoveryPartition@@YGHPAVString@UnBCL@@G_KPAHPA_K3333@Z@",
        "class COperationResult *&__thiscall UnBCL::ArrayList<class COperationResult *>::get_Item(int)",
        "1(141@1L1X1d1p1|1",
        "CDeploymentProject::CreateFFUDeployment: Failed to get image index. Error: 0x%08X",
        "CSetupAutomation::SuspendAndRelease: Failed to create temp configuration: 0x%08x",
        "=&=O=l=s=y=~=",
        "?+?2?8?=?H?a?u?",
        "9(90979>9I9O9b9j9",
        ">(>E>",
        "212T2l2",
        "1.1B1T1`1t1",
        "3\"383P3f3q3}3",
        "FOLDERID_SkyDriveCameraRoll",
        ".\\%s.mui",
        "void __thiscall UnBCL::_::ArrayListEnumerator<enum OP_OPERATION_ID>::Reset(void)",
        ">!>+>>>N>i>",
        ";<;Y;p;",
        "Operation queue is compromised, no execution is possible.",
        "2P2^2z2",
        "%hs: SaveSystemBCDDatabase returned sharing violation, waiting to retry. ",
        "ERROR_MUTANT_LIMIT_EXCEEDED",
        ":%:+:8:C:]:c:p:",
        ".?AV?$SmartPtr@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@",
        "808@8d8l8t8|8",
        "y,Sht",
        "1-242:2?2J2R2f2",
        "class UnBCL::Array<unsigned char> *__stdcall UnBCL::Try_Cast<classUnBCL::Array<unsigned char>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "SL_E_CHPA_FAILED_TO_UPDATE_PRODUCTKEY_BINDING",
        "9*9<9M9T9j9",
        "Number of $MFT security descriptors updated",
        "CRYPT_E_ASN1_ERROR",
        "5&585?5E5J5U5]5q5",
        "OSRollbackService::CCheckpointImpressario::SetCheckpoint",
        "HeapReAlloc",
        "Number of registry values renamed",
        "5U5\\5b5g5r5y5",
        "void __thiscall UnBCL::Array<struct DiskRange>::Insert(int,struct DiskRange)",
        "5,515E5V5i5p5v5{5",
        "SPAPI_E_INVALID_CLASS_INSTALLER",
        "<)<7<?<P<V<\\<g<q<|<",
        ".PAVCXXXXXTemp@?BF@??SPValidateTrackedContent@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@000PAH1PAPAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@2@Z@",
        ">'>1>8>I>V>a>p>",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::Insert(int,class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *)",
        "jWX_^",
        ">+>;>N>V>_>e>o>",
        "1E1]1c1x1",
        "CDeploymentProject::AddProvisioningPackage: Cannot add two ICBs to project. Original ICB: %s, new ICB: %s",
        "3&363C3J3W3n3~3",
        "int __thiscall UnBCL::Array<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::Add(class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *)",
        "5!5&515?5D5X5s5",
        "PWVh ",
        "CAbstractDisk::AreVolumesReady",
        "<.<7<N<[<j<r<{<",
        "3$373@3M3]3d3j3o3z3",
        "SyspartIsSpace failed for partition path: %s",
        "8,8S8",
        "1&1U1]1h1o1u1z1",
        "0 080>0T0e0r0",
        "T$pWP",
        "MoveFileExW",
        "7+787@7I7Q7X7^7c7n7",
        "ERROR_POLICY_ONLY_IN_DS",
        ";$;<;",
        "setupapi.dev.log",
        "060c0m0",
        "%hs: Copy operation cancelled by the progress routine.",
        ".?AU?$IEnumerable@PAVCCmdLineExecutionTelemetryData@OC@@@UnBCL@@",
        "class COperation *&__thiscall UnBCL::ArrayList<class COperation *>::get_Item(int)",
        "VdsVolume::GetProperties: Failed to determine volume encryption status (0x%08x)",
        "Failed directory walk to determine size for non-externally linked files",
        "?$?0?T?\\?d?l?t?|?",
        "%hs: Warning compress %s. GLE [%d]",
        "%hs: Cannot queue driver migration for fail-forward system %d. Error: 0x%08X",
        "?-?7?H?T?j?",
        ":&:,:1:=:E:Y:i;x;",
        ".?AV?$KeyCollection@PAVString@UnBCL@@PAUHKEY__@@@_@UnBCL@@",
        "7-7O7X7l7{7",
        "Final filter value: %s",
        ".?AV?$SmartPtr@V?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@",
        "1P1k1",
        "    Failed to get package metadata",
        "{B5D4091A-5FB7-4771-A5B3-98881B7DEF6E}",
        "F,9N0Q",
        "2.232`2",
        "<)<0<D<S<Z<a<h<o<v<",
        "7$747D7T7d7t7",
        ":@:Q:f:",
        "Failed to get the set of Driver Store INFs installed on devices, Err = 0x%lx",
        "\\WINDOWS",
        "struct ICbsPackage *__thiscall OC::COCCbsAdapter::GetPackageByName(class UnBCL::String *)",
        "ERROR_INVALID_SEPARATOR_FILE",
        "VdsPartition::Resize: Can't read resize bounds (0x%08x)",
        "9\"9[9a9g9m9s9y9",
        ", rollback directory: ",
        ">^>v>",
        "    Failed to append new element metadata",
        ".?AVCXXXXXHandledException@?DL@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        ".?AV?$CAutoCleanupBase@PAU_DRIVE_LAYOUT_INFORMATION_EX@@@RAII@@",
        "int __thiscall UnBCL::ArrayList<class COperationsValidator *>::IndexOf(class COperationsValidator *,int,int) const",
        "WinREEndAvailableDiskSpace",
        "JET_errDatabaseFileReadOnly",
        "?9?H?|?",
        "4\"464=4C4H4S4^4d4x4",
        "SPSerializeOperations",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCRegCreationData@@@UnBCL@@@UnBCL@@",
        "7*7S7m7",
        ">*>1>@>N>U>\\>g>y>",
        "1.1F1L1b1",
        "5&5,535?5F5L5Q5\\5f5y5",
        "?'?3?Q?]?o?",
        "SPAPI_E_NO_DEFAULT_DEVICE_INTERFACE",
        ": :+:0:",
        "ERROR_DBG_TERMINATE_PROCESS",
        "BCryptOpenAlgorithmProvider",
        "MIG Validator: Execution of offline apply operation completed.",
        "Sources\\operations.dat",
        "RegCreateKeyW",
        ".?AU?$IList@PAVCDeviceInfoData@CDeviceIdDatabase@@@UnBCL@@",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$Array@E@2@@UnBCL@@@UnBCL@@",
        ">\">*>0>=>O>]>u>|>",
        "Failed to cleanup ramdisk options in recovery store. Status = [%x]",
        "5U6_6",
        "7M7T7r7",
        "5'5,565=5K5]5n5u5",
        "1)151c1|1",
        ";D$$r",
        ".?AVCRemoveFODPackage@@",
        "=!=&=:=T=^=g=|=",
        "7'717<7D7Q7]7e7l7",
        "X%s,%u",
        "CDiagnosticsHelper::Initialize",
        "pDeterminePageFileRequirements: Will allocate at least %llu bytes of page file space to capture crash dumps",
        "ERROR_DS_DOMAIN_VERSION_TOO_LOW",
        "7$7,787\\7d7l7t7|7",
        ">$>D>f>~>",
        "484N4_4",
        "6*676C6z6",
        ":#:;:B:I:O:Z:",
        "SizeMin",
        "Unable to create tempory new store key. Status: %x",
        ".?AV?$SmartPtr@U?$IEnumerator@PAUIVdsVDisk@@@UnBCL@@@UnBCL@@",
        "VdsDisk::CreatePartition: Can't convert GUID Id string %s to GUID (0x%08x)",
        "1#151F1T1k1x1~1",
        "ERROR_TOO_MANY_LUIDS_REQUESTED",
        "CRelocateOS: Cannot move journal file from %s to %s. Error: 0x%08X",
        "PSShd",
        "[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[",
        "6#6*646A6K6f6m6v6{6",
        "SPUnloadKey",
        "DigitalProductId",
        "ERROR_TRANSACTION_NOT_FOUND",
        "void __thiscall UnBCL::_::HTEnumerator<unsigned short,int,struct UnBCL::Hashtable<unsigned short,int>::TableKey,class UnBCL::DictionaryEntry<unsigned short,int>,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<unsigned short,int> __stdcall UnBCL::Hashtable<unsigned short,int>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned short,int>::TableKey,int,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::Reset(void)",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAVMultiSz@2@@UnBCL@@@UnBCL@@",
        "7 707@7P7`7p7",
        "6,6D6L6T6x6",
        ";0uF9E",
        ";F tF",
        "Exception handler called! Details:",
        "2#2T2",
        "ERROR_IPSEC_IKE_INVALID_FILTER",
        "D$PjP",
        "ResurrectSetupPlatform",
        "CSetupPlatform::GetAutomationFromAnswerFile",
        "6#6<6D6I6]6i6",
        "Failed to acquire BCD sync mutant. Status: %x",
        "Microsoft Corporation1.0,",
        "CSetupPlatformWinReRestoreCheckpoint::Rollback",
        "5)5X5k5w5",
        "CheckCIEASupport",
        "2&2,212<2F2K2_2j2",
        "??5SerializationStream@UnBCL@@QAEAAV01@AA_K@Z",
        "CSIDL_SYSTEM",
        "           Version : %s",
        "SKIPBOOTTRACK(SAFEOS): Skip Boot Validator: Cannot remove one or more safe OS operations, cannot continue with SafeOS boot removal.",
        "9 9y<",
        "2)292B2z2",
        ".?AVCReserveSpace@@",
        "%s.%d.vhd",
        ">!>S>Z>`>e>p>{>",
        ".?AVTextReader@UnBCL@@",
        "0$0=0D0K0Q0]0q0",
        "CSetupPlatform::CreateNewSystem: OldSystemRoot cannot be NULL",
        "class CBasicEnvEntry **__thiscall UnBCL::ArrayList<class CBasicEnvEntry *>::GetBuffer(int)",
        "<$=X=",
        "SysprepFunctionStop",
        "?#?1?",
        "%hs: Failed to set BCDE_BOOTMGR_TYPE_DISPLAY_ORDER field. Status = %d",
        "3$3)3.383P3U3s3x3}3",
        "ImageGetLastModificationTime",
        "pLogUpdateCollectionInfo: IDUUpdateCollection::GetItem failed. hr = 0x%x",
        "WIM file is on the future OS volume but we don't have a disk space pressure.",
        "5A5P5\\5z5",
        "?#?,?5?>?G?W?o?",
        "VdsPartition::GetResizeBounds: Failed to query IID_IVdsVolumeShrink interface [%s] (0x%08x)",
        "ERROR_DS_FILTER_USES_CONTRUCTED_ATTRS",
        "DedicatedDumpFile",
        "Failed copying ServicingStackVersions keys",
        ".?AVCXXXXXHandledException@?2??DoExecute@CSplitWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "1%1,12171B1L1R1f1o1",
        "%hs: Failed to read the safe OS entry GUID from %s. hr = 0x%X",
        ";(;/;5;:;E;L;`;",
        "ERROR_LM_CROSS_ENCRYPTION_REQUIRED",
        "4c4x4",
        "CSetupPlatform::CreateNewSystem: SystemDrive must be a valid drive letter (A-Z)",
        "GetSystemInfo",
        "void __thiscall UnBCL::Array<class COSPieceInfo *>::Remove(class COSPieceInfo *)",
        "9*9`9o9v9",
        "DeleteDirectory: Unable to delete file/directory [%s] GLE = 0x%x, ",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *> *,int) const",
        "<$<0<T<\\<d<l<t<|<",
        ".?AU?$IEnumerator@PAVCAntiVirusInfo@@@UnBCL@@",
        "8 919F9s9",
        "<#=U=",
        "%hs: Image state is not supported for migration: %s",
        "5&5.545A5S5l5",
        "Apply (oobe boot apply, offline phase): Migration phase failed. Result: %d, no specific error",
        "ERROR_DS_CROSS_REF_BUSY",
        "void __thiscall UnBCL::ArrayList<__int64>::QuickSort(class UnBCL::ArrayList<__int64> *,class UnBCL::ArrayList<__int64> *,int,int)",
        "Failed to GetVolumePathName for %ws (%u).",
        "D$4PW",
        "7$747@7H7V7^7h7n7}7",
        ".?AU?$IEnumerable@PAVISPPluginData@@@UnBCL@@",
        "Failed to write PageFiles value to %s. Error: 0x%08X",
        "RestoreFileDataCallback",
        ".?AV?$ArrayListEnumerator@PAV?$CAutoRelease@PAUIDUUpdateCollection@DU@@@Mig@@@_@UnBCL@@",
        "onecore\\base\\cbs\\util\\cbsstr.cpp",
        "unbcl.dll",
        "5K5R5X5]5h5r5w5",
        "9\"9)9/949?9N9V9g9s9y9~9",
        "bootmgr",
        "CDeploymentProject::CreateVHDDeployment: Failed to get image info set; Error: 0x%08X",
        "6)6;6F6T6t6",
        "=H=l=",
        "VdsDisk::Initialize: Failed to create pack (0x%08x)",
        "t$(AS",
        "4.434`4",
        "=0=6=>=m=}=",
        ">&>1><>G>R>_>u>",
        "4*4J4e4",
        "Failed to retrieve ExtensionId (Err = 0x%lx), skipping package.",
        "?1?T?p?",
        "CompressCaptureNode",
        "0/031K1",
        "ERROR_BAD_CONFIGURATION",
        "End first boot",
        "=0=\\=f=m=s=x=",
        "SysWow64\\pidgenx.dll",
        "Snapshot InstallTime: %04d/%02d/%02d %02d:%02d:%02d:%03d",
        "ERROR_BAD_LOGON_SESSION_STATE",
        "?,?I?`?l?s?y?~?",
        "StartName",
        ".?AV?$Array@PAVCOptionalComponent@OC@@@UnBCL@@",
        "WindowsSysPartDevice",
        "(%lx): Error loading old hive [%ws] into [%ws]",
        "Old WinRE BitLocker hash matches new WinRE, will not delete",
        "]SPReportSnapshotState",
        "CreateSetupPlatform",
        "The existing WIM file became corrupted",
        "9&999T9d9s9",
        ";&;/;4;I;a;{;",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *> *,int,int)",
        "pSPDeleteExpiredUpgradeSnapshots: Remove snapshot ID [%s] from registry key",
        "4.4C4R4\\4a4i4p4|4",
        "5&6-63686C6N6b6q6z6",
        "Failed to initialize the CBS session 8. hr = 0x%08X",
        "010F0N0T0a0p0",
        "%hs: Failed to create fail forward system for option %d. Error: 0x%08X",
        "QueryServiceStatusEx",
        ">3>J>\\>c>i>n>y>",
        ">(>,><>@>P>T>d>h>x>|>",
        "=*=;=D=y=",
        "JET_wrnNoErrorInfo",
        "D$$Wh0",
        ".?AU?$IList@PAV?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@@UnBCL@@",
        "f;D$(t)S",
        "ScanDirNodeTree",
        ".?AVSmDisk@@",
        ".?AVCXXXXXHandledException@?FO@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "SVh0>",
        ">(>4>T>\\>h>",
        "WinReSetBootApp",
        "5+545:5G5M5R5c5n5|5",
        "SPReportSnapshotState: Max space       : %I64d",
        ".?AU?$ICollection@PAUIDisk@SetupPlatform@@@UnBCL@@",
        "CNewSystem::QueueDriverInstallation",
        "ERROR_PRINTER_DELETED",
        "int __thiscall UnBCL::Array<class CInfFile *>::Add(class CInfFile *)",
        "void __thiscall UnBCL::Array<enum OP_OPERATION_ID>::RemoveAt(int)",
        "%hs: Failed to persist diagnostics data.",
        "9(90969C9U9h9z9",
        "=!=K=X=b=p=z=",
        "4\"4/4A4I4O4\\4n4",
        "627E7o7",
        "4 5l5",
        "4'4-42474D4L4S4X4e4m4t4y4",
        "= =$=(=,=0=4=8=d=h=l=p=t=x=|=",
        "Service start type restored",
        "?&?0?C?K?R?Y?d?n?",
        "6 606@6P6`6p6",
        "5#5:5I5R5^5v5~5",
        "2(2P2n2}2",
        "%hs: Failed to write compress helper image path to file: %s. Error: 0x%08X",
        "7\"7-7;7g7s7",
        "= =$=(=0=T=\\=`=d=h=p=",
        "base\\ntsetup\\setupplatform\\lib\\inc\\SetupPlatformOperations.h",
        "Sp_^[",
        "3\"3-3A3V3x3",
        "ERROR_DS_CANT_ACCESS_REMOTE_PART_OF_AD",
        "Invalid checkpoint name \"%s\"",
        "?Flush@FileStream@UnBCL@@UAEXXZ",
        ".?AVCXXXXXHandledException@?2??DoExecute@CSysprepSpecializeOffline@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "FSCTL_GET_EXTERNAL_BACKING: %ls",
        "?*???M?Z?o?",
        "Failed adding package identity to AbandonedUpdatePackages array",
        ".?AU?$IEnumerable@K@UnBCL@@",
        "ERROR_SERVER_SHUTDOWN_IN_PROGRESS",
        "3-3s3",
        "3=3D3J3P3[3e3x3",
        "OC Validator: Failed to revert execution of OC gather operation. Error: %08X",
        ">/?8?z?",
        "na:ChunkSize",
        "6$6R6^6l6{6",
        ";#;D;_;e;r;",
        "ActionPlatform::StopService",
        "=%=@=G=M=R=]=d=|=",
        ";';7;<;H;_;o;t;",
        "GetFileVersionInfoSizeW",
        "SL_E_SLP_NOT_SIGNED",
        "CMediaLayout::QueueProvisioningPackages: Failed to open %s: 0x%08x",
        "(%lx): Failed to create full path for destination key/value.",
        "? ?]?j?",
        "1$1,121?1Q1_1",
        "8'848?8O8\\8g8{8",
        "DISKSPACEQUERY(external request): Final disk space needed estimate: %I64d, released after install: %I64d",
        "void __thiscall UnBCL::Array<struct PageFileDesc *>::RemoveAt(int)",
        "Cannot create backup directory for rollback: %s.",
        "12292?2D2O2U2h2",
        "CSetupPlatform::Initialize: Failed to initialize tracing",
        "7$7?7S7Z7`7e7p7{7",
        "ERROR_DS_CR_IMPOSSIBLE_TO_VALIDATE_V2",
        ":5:::A:M:h:v:",
        "class UnBCL::DictionaryEntry<unsigned long,struct IVdsVDisk *> __thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,class UnBCL::DictionaryEntry<unsigned long,struct IVdsVDisk *>,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<unsigned long,struct IVdsVDisk *> __stdcall UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsVDisk *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,class ATL::CElementTraits<struct UnBCL::ISerializable *> > const *,struct __POSITION * const &)>::Reset(void)",
        "\\boot\\BCD",
        "??_D?$ArrayList@G@UnBCL@@QAEXXZ",
        "K{m<KI",
        "HARDLINKBYTES",
        ".?AV?$DefaultInstanceFactory@VCWDSImageInfo@@@UnBCL@@",
        "CNewSystem::QueueSetupAutomation: Failed to get feature %u: 0x%08x",
        "VdsDisk::TakeOffline: Failed to query IID_IVdsDiskOnline interface [%s] (0x%08x)",
        "81888?8J8U8i8w8}8",
        "SVWPh",
        "<;<B<M<[<p<|<",
        "OC::COCDismAdapter::COCDismAdapter: wcscpy_s failed. Result = %d",
        ".?AVCTurnOffReserve@@",
        ".PAVCXXXXXTemp@?3??Rollback@CSetupPlatformPrivate@@UAEJW4ROLLBACK_PHASE@SetupPlatform@@HHPAU_PROGRESS_DATA@4@@Z@",
        "; ;@;H;P;`;h;",
        "Failed finding parent directory",
        "y!Sh!",
        "DiskLayoutMakeRecovery: Failed to get size of WinRE (0x%08x)",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@H@UnBCL@@@_@UnBCL@@",
        "7#727`7{7",
        "class CAntiVirusInfo *const &__thiscall UnBCL::ArrayList<class CAntiVirusInfo *>::get_Item(int) const",
        ".PAVCXXXXXHandledException@?FK@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "int __thiscall UnBCL::ArrayList<class CDriverDetails *>::IndexOf(class CDriverDetails *,int,int) const",
        "\\Windows\\Microsoft.NET\\",
        "reparse point tag too short in filestream",
        "Failed to get reference count to object. Status = [%x]",
        "3$3W3\\3a3m3",
        "void __thiscall UnBCL::Array<struct _GUID>::RemoveAt(int)",
        "%hs: Enabling SE_SECURITY_NAME privilege",
        "WofCompressFileWithHandle",
        "8B8H8S8a8",
        "ExecuteRollbackSequence: Checkpoint(%s) rollback finished.",
        "NtQueryAttributesFile",
        "JET_errInvalidLogSequence",
        ":<:D:L:T:d:l:|:",
        "void __thiscall UnBCL::ArrayList<unsigned short *>::AddRange(const struct UnBCL::ICollection<unsigned short *> *)",
        ">$>,>4><>D>L>T>`>h>",
        "SPAPI_E_WRONG_INF_TYPE",
        "WINDOWS/EDITIONID",
        "708d8o8}8",
        "ERROR_IPSEC_REPLAY_CHECK_FAILED",
        "2(3>3E3K3P3[3e3x3",
        ".PAVCXXXXXTemp@?3??SaveTelemetryFields@CReconstructOS@@IAEXKK_N@Z@",
        "class CRegCreationData *&__thiscall UnBCL::ArrayList<class CRegCreationData *>::get_Item(int)",
        "CDeploymentProject::EnableAuditMode: Failed to queue audit mode command: 0x%08x",
        "Install Language Pack Dynamic Updates",
        "%hs: Failed to allocate buffer for copy operation. Error: 0x%08X",
        "?J?k?",
        ":-;F;K;",
        "6;6L6S6Z6f6s6y6",
        ".?AVCXXXXXHandledException@?2??Parse@CInfFile@@IAEJXZ@",
        "UtilGetMountingEvent",
        "SL_E_CHPA_DATABASE_ERROR",
        "?$?,?4?<?T?\\?l?t?",
        "    Failed to create metadata enumerator",
        "1+191I1R1i1",
        "SERIALIZEVERBOSE: Deserializing mount data from %s",
        "void __thiscall UnBCL::Array<class SysprepComponent *>::RemoveAt(int)",
        "1(141;1H1T1[1l1",
        "3%4L4S4f4",
        "0R1<2K2a3g3p3{3",
        "%hs: WIM entry for %s no longer exists, was likely removed before getting here.",
        "474C4U4s4",
        ";&;G;];m;",
        "SPFindVssSnapshot: Failed to iterate over snapshots. Error: 0x%08X",
        "WriteEncryptedFileRaw",
        "VdsPlatformDiskEnumerator::ConstructPhysicalDisk",
        "JET_errObjectNotFound",
        "Setting WMI Uint32 property %s: the property does not exist",
        "%hs: Open subkey %s",
        "amd64",
        "ERROR_SYMLINK_CLASS_DISABLED",
        "Insufficient buffer to prefix string.",
        "GetSecurityDescriptorSacl",
        "686J6",
        "wcsncpy_s",
        "4.4D4i4t4|4",
        ".?AVCXXXXXHandledException@?L@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "9$9,9094989@9d9l9p9t9x9",
        "546]6",
        "CSetupAutomation::SetTargetDisk: Cannot use SetTargetDisk() to set a custom disk layout",
        ".?AV?$SmartPtr@VCUninstall@@@UnBCL@@",
        "0:0H0Q0Z0c0l0u0",
        "131@1X1p1}1",
        "ERROR_DS_CANT_REPLACE_HIDDEN_REC",
        "8g9q9x9",
        "9,999F9w9",
        "6D6K6X6]6c6q6x6~6",
        "xClose log files",
        "909A9J9k9r9x9}9",
        "Setting element %08x",
        "3/3=3F3O3X3a3j3s3|3",
        ".?AV?$SmartPtr@U?$IDictionaryEnumerator@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@@UnBCL@@",
        "ERROR_LB_WITHOUT_TABSTOPS",
        "405?5W5~5",
        "ERROR_SECTOR_NOT_FOUND",
        "0 00040D0H0X0\\0l0p0",
        "DriverFailedPathAndHR",
        "CSetupAutomation::SuspendAndRelease: Resurrection will not be able to fix paths if the volume drive letter changes.",
        "RestoreSecurityDescriptor",
        "> >,>4>\\>d>l>",
        "RegEnumKeyExW",
        "DiskLayout::ExecModifications: Modifying partition %u in-place",
        ":7:E:O:f:t:",
        "PVWh%",
        "1&1_1z1",
        "dUninstallActive",
        "QPQh?",
        "3'3P3[3",
        "9#9(9<9V9l9x9",
        "ERROR_INVALID_SHARENAME",
        "8$8,848@8d8l8t8|8",
        "9)9;9C9I9Z9f9x9",
        "4$4O4c4",
        "Recovery\\WimBoot\\Partition",
        "scratch",
        ".?AV?$SerializableBase@VCApplyEAs@@$0A@V?$DefaultInstanceFactory@VCApplyEAs@@@UnBCL@@@UnBCL@@",
        "7'7@7N7Z7d7",
        ".?AV?$SerializableBase@VCCompleteFileOps@@$0A@V?$DefaultInstanceFactory@VCCompleteFileOps@@@UnBCL@@@UnBCL@@",
        "0#060I0V0^0e0k0",
        "    Exception code: 0x%x",
        "    Windows directory: %s",
        "030T0e0q0}0",
        ".?AUITracing@@",
        "ERROR_REQUEST_OUT_OF_SEQUENCE",
        "6 6$6,6064686<6D6H6P6X6`6h6l6p6t6|6",
        "base\\ntsetup\\setupplatform\\lib\\src\\installation.cpp",
        ".?AV?$CAutoCleanupBase@PAX@RAII@@",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *> *)",
        "UpdateBootCode:Not laying NT Boot code. Drive = %c, FileSystem = %d",
        "void __thiscall UnBCL::ArrayList<class CFailForwardSystem *>::QuickSort(class UnBCL::ArrayList<class CFailForwardSystem *> *,class UnBCL::ArrayList<class CFailForwardSystem *> *,int,int)",
        ";%<:<P<v<",
        "SmPlatform::ComputeHostInfo: Failed to get %s (0x%08x)",
        "ExportResourceCallback",
        "CMediaLayout::Execute: Failed to execute media layout operations: 0x%08x",
        "WPQQQ",
        "ERROR_RECEIVE_PARTIAL_EXPEDITED",
        "1'121F1Q1W1c1p1~1",
        "2/252;2H2^2u2",
        "747:7F7N7`7g7m7r7}7",
        "ERROR_WAIT_1",
        "BfsRepair: Failed to get ChkdskEx proc address %08x",
        ";!;5;",
        "WdsSetupLogMessageW",
        "pDeterminePageFileRequirements: Extra space not needed for image apply",
        ".PAVCXXXXXTemp@?MH@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "1F1q1",
        "?%?/?F?T?s?",
        "?&?,?7?E?q?",
        "1.1C1J1P1U1a1m1",
        "OC::COCCbsAdapter::GetPackageByName",
        "fr-RE",
        "ERROR_MUI_INVALID_FILE",
        ";,;5;A;Q;Z;e;|;",
        ".text$mn$01",
        "GetOverlappedResult",
        "Failed to write installation ID to %s. Error: 0x%08X",
        "%hs: Cannot queue file creation operation for fail-forward system %d. Error: 0x%08X",
        "r(jZ^f;",
        ":':=:U:k:",
        "class CDUPackage **__thiscall UnBCL::ArrayList<class CDUPackage *>::GetBuffer(int)",
        "j}[f9\\0^",
        "%hs: Attempting to remove the drivers folder %s",
        "D$(+D$ P",
        "source",
        ":8:V:g:",
        "class CDeploymentBase *&__thiscall UnBCL::ArrayList<class CDeploymentBase *>::get_Item(int)",
        "RPC_S_NO_PROTSEQS_REGISTERED",
        "142x2",
        "GetStorageDependencyInformation",
        ":\":2:@:V:c:y:",
        "1/0-0",
        ".?AV?$Array@PAVCOperation@@@UnBCL@@",
        "6!7N7b7",
        "RemoveWindowsOld value is not set",
        "%s\\SEI",
        "1!1(1.131B1L1e1p1",
        "ActionPlatform::LaunchModule: Thread still claims to be active, unexpected; dwRet = 0x%x",
        "CBS_E_PENDING_VICTIM",
        ": :$:(:0:4:8:<:@:H:L:P:X:`:d:h:l:p:t:x:|:",
        "3 3)3.393G3S3g3t3{3",
        "3)3;3I3d3k3",
        "0\"0'02090P0Y0t0{0",
        "4[5q5",
        "6/6F6h6v6",
        "ERROR_RESTART_APPLICATION",
        "Volume{",
        "5,5{5",
        "WriteElementBlock",
        "4D4P4U4_4",
        ">:>@>I>Q>`>g>m>r>}>",
        "CSplitWIM::DoExecute: Failed to split WIM file %s. Error 0x%08X",
        "ERROR_MEDIA_NOT_AVAILABLE",
        ".?AVCXXXXXHandledException@?GD@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        ".PAVCXXXXXHandledException@?2??DoExecute@CStartSystemServices@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "ERROR_NO_EFS",
        ":3:e:",
        "int __thiscall UnBCL::Hashtable<class UnBCL::String *,int>::get_Item(class UnBCL::String *) const",
        "9&9<9B9K9a9x9",
        "??4?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "?$?;?\\?c?i?n?y?",
        "\\\\.\\#:",
        "_onexit",
        "G^{P&a",
        "ERROR_DS_NONEXISTENT_POSS_SUP",
        "CSetupPlatform::Initialize: Failed to initialize platform info; hr = 0x%08X",
        "CSetupPlatform::AttachDiskImage",
        "JET_wrnSortOverflow",
        "ERROR_DS_ILLEGAL_XDOM_MOVE_OPERATION",
        "OC::CDownlevelOCStore::GetOCCollection: Failed to load %s.",
        "pAddSafeOSDynamicUpdateOperations",
        "0 0,080D0P0\\0h0",
        "?0?9?F?P?W?]?b?m?x?",
        "RPC_S_NOT_ALL_OBJS_UNEXPORTED",
        "=(=:=S=w=",
        "4+4=4E4K4_4e4n4",
        "void __thiscall UnBCL::ArrayList<class COperationsValidator *>::set_Item(int,class COperationsValidator *)",
        "pGetImageEditionID",
        "AppList (finalize):",
        "= =(=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=x=|=",
        "7%717C7Q7_7m7",
        "ChkDisk: Failed %08x",
        "6\"6-6:6K6_6i6",
        "<#<+<@<H<V<^<j<{<",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::IndexOf(class UnBCL::DictionaryEntry<class UnBCL::String *,long> *,int,int) const",
        ";);^;",
        "?-?L?]?m?t?z?",
        ")SP_WINREBACKUP_INFO",
        "0!0.0@0N0[0m0u0{0",
        "=;>V>z>",
        "class UnBCL::ArrayList<unsigned long> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<unsigned long>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "class CBcdSetting *const &__thiscall UnBCL::ArrayList<class CBcdSetting *>::get_Item(int) const",
        "5/5\\5t5",
        "Failed to get element enumerator for provisioning package %s. Error: 0x%08X",
        "int __thiscall UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *>::LastIndexOf(class OC::CCmdLineExecutionTelemetryData *,int,int) const",
        ".?AV?$ValueCollection@KPAUIVdsVDisk@@@_@UnBCL@@",
        "=>>K>]>e>k>x>",
        ";\";4;E;R;[;l;",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::RemoveAt(int)",
        "FpW9~tt6h",
        ".?AV?$SerializableArrayBase@PAVCShellFolderInfo@@@_@UnBCL@@",
        "%SYSTEMROOT%",
        "1 1'1-191E1",
        "9 989<9T9X9p9t9",
        "6.7W7\\7f7",
        "SPTaskRemoveSnapshot: Failed to convert CorrelationVector to String",
        "0:0B0L0S0Y0^0i0u0",
        "VdsDiskPartitionEnumerator::Initialize: Failed to query IID_IVdsAdvancedDisk interface [%s] (0x%08x)",
        "9/9O9f9{9",
        "3 3(3D3\\3d3l3t3|3",
        "dReserved.SecondApply",
        "CRYPT_E_NO_PROVIDER",
        "usj$X",
        "040H0T0[0a0f0n0u0",
        "    Invalid file size",
        "<+<;<G<Y<x<",
        "The OS image is corrupt and cannot be repaired",
        ".?AVCXXXXXHandledException@?HP@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "QVjXjwh,",
        "000a0",
        "SPIsProvisioningPackageSplit: Failed to get file attributes for %s. Error: 0x%08X",
        "Failed to get watson parameter override. Hr=[0x%X]",
        "T$ QPR",
        "5(5-595@5P5\\5h5w5|5",
        "void __thiscall UnBCL::ArrayList<struct SetupPlatform::IPartition *>::AddRange(const struct UnBCL::ICollection<struct SetupPlatform::IPartition *> *)",
        "CSetupAutomation::SetImageInfoSet: Failed to update image path: 0x%08x",
        "PWVh>",
        "ySPGetSystemPartition",
        "CCFGSectionValue::IsIdentical",
        "UninstallSourceVersion",
        "pFindDriverStoreInfs",
        "2&2,212<2G2c2j2p2u2",
        ":e;y;",
        "T$0VP",
        "s%s (%d)",
        "\\REGISTRY\\USER\\",
        "8-8?8",
        "0;0P0X0^0g0}0",
        ">'>K>]>e>k>x>",
        ">'>c>",
        "D$`P!9",
        "M0K0I",
        "4%4H4h4o4z4",
        "6<6p6",
        "t2SSj",
        "JET_errCannotNestDDL",
        ".?AV?$Array@PAVCRegCreationData@@@UnBCL@@",
        "=`=s=",
        "SPDiagTrackWriteTimeToConfigFile",
        "JET_errDatabaseUnavailable",
        "ERROR_PROTOCOL_UNREACHABLE",
        "1$1;1B1H1M1X1g1o1u1}1",
        "ZwUnloadKey",
        ";'<:<K<e<",
        "353_3u3",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CDriverInfo *>::Reset(void)",
        "WinRETime",
        "? ?+?2?<?D?J?^?h?q?",
        "%hs: Malformed line found in %s. Line: %s",
        "ERROR_BAD_IMPERSONATION_LEVEL",
        "ERROR_LOG_BLOCK_VERSION",
        "ERROR_RESOURCE_PROPERTY_UNCHANGEABLE",
        "Failed to remove driver",
        "= =*=4=:=H=|=",
        "LookupPrivilegeValueW",
        "ERROR_DS_STRING_SD_CONVERSION_FAILED",
        ":%:2:D:L:R:[:q:",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::Resize(int,int)",
        "CAddSetupClRequest::DoExecute: Cannot load system hive for offline OS %s. Error: 0x%08X",
        "t]h`z",
        "ERROR_CTX_INVALID_PD",
        ".?AV?$DefaultInstanceFactory@VCSysprepSpecializeOffline@@@UnBCL@@",
        "2&2;2I2W2e2",
        "Yf9>u",
        ".?AV?$KeyCollection@PAVString@UnBCL@@PAVCDriverInstallInfo@@@_@UnBCL@@",
        "5)5:5B5O5i5",
        "\\$X9\\$0u/",
        ".edata",
        "8#888?8t8",
        "pIterateAssociation: Failed to enumerate (0x%08x)",
        "?&?/?8?A?J?S?\\?e?n?w?",
        "multi(%d)disk(%d)rdisk(%d)",
        "Uninstall validation failed with error: 0x%08X, examining results.",
        "SL_E_SFS_FILE_WRITE_ERROR",
        "5(5:5B5H5X5",
        "4!424S4j4p4~4",
        ";C<W<i<q<w<",
        "D0R0u0",
        "0!0@0Y0b0k0u0~0",
        "IExecAction::put_Arguments failed. hr = 0x%x",
        "enum MIGSTATUS __stdcall SPExecuteGather(class UnBCL::String *,class UnBCL::String *,enum SetupPlatform::SP_MIG_SCOPE,class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,int,int,int,struct ISPTelemetryData **,struct ISPMigProgress *)",
        "?#?)?:?Q?a?w?",
        "Source OS version: %s",
        ".?AVCXXXXXHandledException@?JI@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ".PAVCXXXXXHandledException@?CGD@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "_resetstkoflw",
        "ERROR_LOG_RECORDS_RESERVED_INVALID",
        "ResExtractToFile failed",
        "int __stdcall SPIsRecoveryType(class UnBCL::String *,struct _GUID *,class UnBCL::String **)",
        "?%?<?P?n?",
        "uReserved.FirstApply.%u",
        "8.8<8E8N8W8a8j8s8",
        ".00cfg",
        "suspend",
        "he-IL",
        "QQQQQQQj",
        ".PAVCXXXXXTemp@?3??DoExecute@CSysprepSpecializeOffline@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ".?AV?$ArrayList@PAVCOptionalComponent@OC@@@UnBCL@@",
        "1&171>1D1I1T1_1s1",
        "F;w$r",
        "void __thiscall UnBCL::ArrayList<class COperationResult *>::Insert(int,class COperationResult *)",
        "ERROR_WMI_GUID_NOT_FOUND",
        "7F7T7[7",
        "CBackupRecoveryPartition::DoExecute",
        "ERROR_DOMAIN_LIMIT_EXCEEDED",
        "ERROR_FILE_INVALID",
        "ar-QA",
        "5+5>5L5Y5j5",
        "    Unreachable code",
        "checkpointName",
        "2$2,2<2D2T2\\2d2l2t2|2",
        "5?5U5",
        "    Failed to find next file",
        "??0FormatException@UnBCL@@QAE@PBG@Z",
        "QSPSh",
        "WmiObject::BeginCall: Couldn't spawn instance of method parameter type for %s.%s (0x%08x)",
        "SPApplyCustomDiskConfig: About to apply disk layout %u to host machine disk %u",
        "ERROR_JOIN_TO_SUBST",
        "5>5V5c5t5",
        "0#000=0E0_0",
        "Initializing diagnostics helper; data file = %s",
        "ERROR_DS_DRA_EARLIER_SCHEMA_CONFLICT",
        "x\\Panther\\DlTel.etl",
        ";&;6;F;V;b;x;",
        "Wimserv process started for guid %s.  Id is %d",
        "SPEnableSetupTelemetryAutoLoggerSession",
        "STAT: %ws = %I64u",
        "WINDOWS/VERSION/BRANCH",
        "<!<,<7<I<P<V<[<f<q<",
        "t(Qjnh",
        "8)80868;8F8M8R8f8",
        "=)=1=A=I=X=`=s={=",
        "9*919G9_9e9w9",
        "<.=c=",
        "Enable telemetry for %s",
        ".?AVCSerializableArray@@",
        "6(686J6\\6n6}6",
        ";1;@;U;\\;b;g;r;y;",
        "3 3-3:3G3T3`3l3y3",
        "ProgramData\\Microsoft\\Diagnosis\\ETLLogs",
        "Exception",
        "8[8o8",
        "4#4;4P4l4",
        "9!9*9S9]9k9",
        "RegValueEnumAction::Enumerate: Failed to open key %s\\%s (error %d)",
        "(%lx): Failed to process reparse point [ID=0x%I64x]: [%ws]",
        ">%>+>5>?>Y>p>",
        "848A8J8O8U8k8z8",
        "343}3",
        "hsb-DE",
        "?$?6?>?D?Q?c?q?",
        "2X3a3r3",
        "SclpStateOpenStatusKey",
        "uGj}[f9\\0^",
        "< <\\<}<",
        "VdsPartition::TakeOffline: Failed to query IID_IVdsVolumeMF3 interface [%s] (0x%08x)",
        "CSetupPlatform::Initialize: StartKernelModeTracing failed; hr = 0x%08X",
        "6(656\\6",
        "?)?6?B?H?\\?~?",
        "=.=C=`=v=",
        "0U0f0m0t0",
        "SysprepSession::CreateSession: Sysprep online session is not supported under a WOW64 process",
        "Failed to adjust token privileges after resizing to accommodate modified privileges.",
        "%hs: Failed to save the rollback GUID",
        "CMediaLayout::QueueProvisioningPackages",
        "int __thiscall UnBCL::ArrayList<class CFilterDriverInfo *>::BinarySearch(int,int,class CFilterDriverInfo *,struct UnBCL::IComparer<class CFilterDriverInfo *> *)",
        "?D?P?\\?i?",
        "ERROR_IPSEC_IKE_QM_DELAY_DROP",
        "jUjth",
        "(%lx): Failed to calculate Windows.old's hive path for [%ws]",
        "6%6,62676B6L6_6|6",
        "%hs: Cannot get only OS version for offline OS. This operation is used incorrectly.",
        "Upgrade is using replacement manifests in %s",
        "3 3)353A3M3Y3e3n3z3",
        "{7F75113F-94B2-4B53-BEB6-45CCB1ED4814}",
        "42494E4[4",
        "{338A66EC-FDB2-4B89-BEC4-822978D0A7A1}",
        "arn-CL",
        "1 1.161=1F1N1U1e1",
        "2#2'2+2/23272;2?2C2G2K2O2S2W2[2_2c2g2k2o2s2w2{2",
        "int __thiscall OC::COCDismAdapter::GetOCDependencies(class OC::COptionalComponent *,class UnBCL::SmartPtr<class OC::COCCollection> &)",
        "ERROR_FLOPPY_VOLUME",
        "EnumImageDataEntries",
        "wH9\\$",
        "5$5,545@5H5l5t5|5",
        "NtSetEaFile",
        ".PAVCXXXXXHandledException@?8??SPDeleteAllSnapshots@@YGJPAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@3@HPA_J@Z@",
        "<4<8<P<T<l<p<",
        "9 969M9c9z9",
        "7@8E8g8",
        "ITaskSettings3::CreateMaintenanceSettings failed. hr = 0x%x",
        ".Push Button Reset - FoD",
        "LP Validator: New installed language package apeared, will invalidate OC gather operation",
        "2(2,2<2@2P2T2d2h2x2|2",
        "Restore page file settings in new os",
        "??0FileStream@UnBCL@@QAE@PBVString@1@W4FileMode@1@W4FileAccess@1@W4FileShare@1@K@Z",
        "pLogUpdateCollectionInfo: IDUUpdateCollection::GetCount failed. hr = 0x%x",
        "\\EFI\\Microsoft\\Boot\\bootmgfw.efi",
        "4m5t5",
        "?Append@StringBuilder@UnBCL@@QAEPAV12@PBVString@2@@Z",
        "UpdateBackupBootCode",
        "IDB_WIN_LOGO4",
        "CDUClientAppInfo::CDUClientAppInfo: Failed to get DU client version info string. GLE = 0x%x",
        "9w0t]",
        ".CRT$XIZ",
        "<'<4<=<H<\\<",
        "JET_errInvalidPlaceholderColumn",
        ":*:2:8:E:W:",
        "9-9F9M9S9X9c9n9",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCOperation@@@UnBCL@@@UnBCL@@",
        "0\"060J0R0Y0_0o0",
        "ERROR_DRIVE_LOCKED",
        "CEnableSafeOSPageFile::DoExecute: Cannot set %s [%s] value to full dump type: 0x%08x",
        "9t$Pt",
        "OC::COCCbsAdapter::GetOCsInPackage: EnumerateUpdates failed. hr = 0x%x",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class COperation *>::MoveNext(void)",
        "NtOpenSymbolicLinkObject",
        "=*=;=O=\\=h=y=",
        "P49Q4",
        "</<o<",
        "=9=@=F=K=V=e=m=s=",
        ">6>_>o>",
        "RPC_X_INVALID_PIPE_OBJECT",
        ":+:T:\\:i:z:",
        "QueueRegisterSyncProcess called with phase %d, command %s %s",
        "Unable to get procedure GetSystemStore",
        "Failed to get partition name. Status = %#x",
        "Windows.old",
        "ERROR_CTX_ENCRYPTION_LEVEL_REQUIRED",
        "4 6`7",
        "7#7*70757@7J7]7",
        "Microsoft.Windows.StartRepairCore",
        "ServiceBootFiles MuiOnly:%c Res:%c Fonts:%c BootMgrOvw:%c BootStatOvw:%c DbgTrn:%c SuspendBDE:%c",
        "int __thiscall UnBCL::_::HTEnumerator<enum OP_OPERATION_ID,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,enum OP_OPERATION_ID,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,&protected: static enum OP_OPERATION_ID __stdcall UnBCL::Hashtable<enum OP_OPERATION_ID,int>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "?-?<?F?~?",
        "Sparse mount enabled via override",
        "6R6t6",
        "RtlQueryFeatureConfiguration",
        "3#3A3P3m3|3",
        "RemovedDriverVersion",
        "Disk %u is raw, no partitions to enumerate",
        "404<4T4`4x4",
        "Operations are not consistent, already complete operation follow incomplete ones.",
        "Stop telemetry. Process id: %d",
        "Failed to retrieve image path for image on server %s. Error: 0x%08X",
        ".?AV?$CAutoDelete@PAVString@UnBCL@@@RAII@@",
        "<H<R<c<x<",
        "7'8?8K8]8u8",
        "0+080K0X0f0|0",
        "Array doesn't support Remove()",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class SysprepComponent *>::Reset(void)",
        "<4<`<s<",
        "?<?D?L?T?\\?d?l?t?",
        "ERROR_CLEANER_SLOT_NOT_SET",
        "void __thiscall CDeploymentBase::StreamWrite(class UnBCL::SerializationStream &) const",
        "8&8-8A8h8",
        "1:1V1o1",
        "%hs: Image state is not supported for ICB installation: %s",
        "9+9P9g9",
        "SKIPBOOTTRACK(FIRST): CBS completion status: %s, will %sneed to run in the 1st boot",
        "1$1+13181D1W1a1u1",
        "2$2H2\\2d2l2t2|2",
        "1'1.14191E1M1R1f1v1",
        "ERROR_DS_CANT_RETRIEVE_ATTS",
        "8!888U819L9r9y9",
        "SPAllocateRange: No free region contains the offset %llu",
        "Offline gather",
        "2#222<2A2I2P2\\2n2",
        "pDUSearch: Failed to retrieve count of updates. hr = 0x%x",
        "%hs: Cannot write migration scope to %s. Error: 0x%08X",
        "MigOpenIMGStore",
        ":\":):7:>:D:I:T:^:q:",
        "void __thiscall UnBCL::Array<class OC::CCmdLineExecutionTelemetryData *>::Remove(class OC::CCmdLineExecutionTelemetryData *)",
        ".?AVObject@UnBCL@@",
        "0 1`1",
        "MIGPERFTRACK: 1st boot apply (online) ========================================",
        "CInfFile::Parse",
        "CDownloadDUUpdates::DoExecuteInternal: Failed to move/copy updates. hr = 0x%x",
        "0!0/0=0E0R0Z0`0t0",
        "JET_errMultiValuedIndexViolation",
        "SVh`0",
        ":':E:R:\\:",
        "Loaded hive at BCD%08d",
        "2!2-2J2a2m2}2",
        "2.282J2R2X2b2l2",
        "ERROR_ALREADY_EXISTS",
        "\\Program Files (x86)\\Common Files",
        "1$1,121?1Q1_1l1~1",
        "AllowTelemetry",
        "= =$=<=@=X=\\=t=x=",
        "ERROR_IPSEC_IKE_CRITICAL_PAYLOAD_NOT_RECOGNIZED",
        ".?AU?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@UnBCL@@@UnBCL@@",
        "7(828?8E8L8V8c8j8t8",
        "7-7D7a7z7",
        ">1>O>]>h>p>}>",
        "ERROR_STREAM_MINIVERSION_NOT_FOUND",
        "6 6$6(6,64686<6@6D6L6P6X6`6d6l6p6x6|6",
        "{9836A2B7-D740-4E8D-9B59-A4CA095B8949}",
        ".?AVVdsPlatformDiskEnumerator@@",
        "WIMCAPTURE_SPARSE",
        "5$5+555F5S5\\5g5v5",
        "At least one user profile was not created, deselecting the default user",
        "SPApplyCustomDiskConfig: Successfully computed layout for disk %u",
        "7,797O7W7d7~7",
        "717D7Q7b7v7",
        "3+3?3Z3",
        "VERBOSE: Path %s has no children, nothing to move",
        "CSetupPlatform::CreateNewSystem: Platform version mismatch detected: current [%s], target [%s]",
        ".?AVCXXXXXHandledException@?6??DoCommunication@CSetupPlatformPrivate@@UAEXXZ@",
        "Cannot find setup key, uninstall is not valid",
        "ERROR_ROWSNOTRELEASED",
        "?'?7?K?W?g?o?",
        "Provisioning package is not on the OS partition, cannot write install order for it.",
        ":$:(:,:0:4:8:<:@:D:L:P:T:X:`:d:h:l:p:t:x:|:",
        "CNewSystem::QueueAddAppxPackage",
        "CRYPT_E_ASN1_BADPDU",
        ":!:3:D:X:`:g:m:s:",
        ">E?x?",
        ">P?W?|?",
        "5'5-565L5b5t5|5",
        "WinHttpGetDefaultProxyConfiguration",
        "SysprepSession::Execute: Beginning action execution from %s",
        "SYSTEM\\Setup\\SetupPlatform\\DownlevelActive",
        "030T0o0u0",
        "    Additional error details: %s",
        "1&101G1U1t1",
        "%hs: Verifying profile for %s(%s), path: %s, linked path: %s",
        "0,000H0L0d0h0",
        "$030o0",
        "(caller: %p) ",
        "void __thiscall UnBCL::ArrayList<enum OP_OPERATION_ID>::QuickSort(class UnBCL::ArrayList<enum OP_OPERATION_ID> *,class UnBCL::ArrayList<enum OP_OPERATION_ID> *,int,int)",
        "20H0^0o0",
        "Failed to set %ls",
        "ERROR_INVALID_LDT_OFFSET",
        ".PAVCXXXXXHandledException@?KJ@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "Bootstat.dat file: %s does not exist",
        "?GetValueKind@RegistryKey@UnBCL@@QAE?AW4RegistryValueKind@2@PBVString@2@@Z",
        "tIf9>tD",
        "8)808E8\\8l8x8",
        "7#7(737>7C7W7r7",
        "SetupPlatform::IsUninstallAllowed: Uninstall Window is %sopen",
        "ERROR_DS_NO_ATTRIBUTE_OR_VALUE",
        "ERROR_IPSEC_TRANSPORT_FILTER_NOT_FOUND",
        "SmPlatformDiskEnumerator::ConstructImageDisk: Couldn't initialize disk (0x%08x)",
        "Processing published drivers...",
        "CRYPT_E_REVOKED",
        "Unable to query InstallationType in registry: 0x%x",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\WUDF\\Services",
        "ImageOpenFile",
        "GetUserDefaultUILanguage",
        "= =$=,=4=8=@=D=L=P=X=\\=d=h=p=t=|=",
        "CMicrodom",
        "?>?Y?",
        "?&?4?>?H?R?\\?s?",
        "?8?U?z?",
        "0!0*0?0J0T0a0o0{0",
        "SclRegGetValue",
        "Qj.j<h",
        "ERROR_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER",
        "<&<0<M<\\<k<t<~<",
        ".NewOSWimApplyIncomplete",
        "1\"141K1b1r1",
        "7-7@7V7j7~7",
        "? ?,?5?A?F?O?[?g?l?u?",
        "void __thiscall UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::QuickSort(class UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *> *,class UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *> *,int,int)",
        ".PAVCXXXXXHandledException@?BAP@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "8!8-8E8L8\\8c8j8q8",
        "Old and new paths are identical ([%ws]); skipping link retargeting...",
        "7\"7)7/757A7K7P7d7v7",
        "PVWhX",
        ">%>*>4>>>H>R>`>f>l>q>{>",
        "=#=*=0=5=@=M=a=",
        "#t$(V",
        "IVdsDiskPartitionMF3",
        "CDeploymentBase::StreamWrite",
        "Rollback: Showing splash window with begin text: %s",
        "SPGetDevicePathFromVolumeName: Failed to get volume handle for %s. Error: 0x%08X",
        "xHj1^",
        "8$8B8Q8h8q8",
        "int __thiscall UnBCL::ArrayList<enum OP_EXECUTION_PHASE>::LastIndexOf(enum OP_EXECUTION_PHASE,int,int) const",
        ".?AV?$SmartPtr@U?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@@UnBCL@@",
        ":[;e;",
        "CSetupPlatformPrivate::Execute: Failed to deserialize/execute post-SysPrep operations. Error: 0x%08X",
        "6%6,62676B6M6a6",
        "6*6E6a6t6",
        "CDeploymentProject::CreateBootableMediaDeployment",
        "?#?2?I?P?V?[?g?q?",
        ".PAVCXXXXXHandledException@?GO@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCCleanupEntry@CSimpleCleanup@@@UnBCL@@@UnBCL@@",
        "0F0b0l0v0|0",
        "445M5T5[5b5i5p5v5",
        "GetCompressedFileSizeW",
        "9]$u&j ",
        "AddFileToImage",
        "8#848H8T8e8y8",
        "void __thiscall UnBCL::ArrayList<class CCopyInfo *>::CopyTo(class UnBCL::Array<class CCopyInfo *> *,int) const",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::get_Current(void) const",
        "VWj@^V3",
        "?,?c?|?",
        "SPGetCurrentUserName",
        "2)2=2[2n2",
        "1#1)141B1s1",
        "<#<0<s<",
        "9#9)9U9g9o9u9",
        "?:?Q?Y?",
        "<#<T<",
        "<%<*<5<<<",
        "CProvPackageLogger::LogW",
        "VERBOSEOPS: %sOperation %u can run in execution phase %u",
        "4\"4,454>4G4Q4e4n4x4",
        "ERROR_SXS_ROOT_MANIFEST_DEPENDENCY_NOT_INSTALLED",
        "y8VSh",
        "2'2:2G2w2~2",
        "ySPFlushDiagnosticsDataToDisk",
        "Invalid attributes (%#x) specified for %s file!",
        "7C7u7",
        "eCExtractFilesFromWIM::DoExecute",
        "OFFLINE PROFILES: Offline profile creation is available.",
        "1$1<1D1L1T1\\1d1l1t1|1",
        "VdsVolume::Unmount",
        ".?AVCApplyDataOffline@@",
        ";\";);3;@;S;[;h;p;z;",
        "?6?S?`?l?u?~?",
        "<'=m=x=",
        "%hs:Created Store %s",
        "suspend protection on non-OS volumes",
        "?*?J?e?k?u?z?",
        "?terminate@@YAXXZ",
        "6!6.6:6Q6t6",
        ";B<F<J<N<R<",
        "SL_E_CHPA_PRODUCT_KEY_BEING_USED",
        ":%:0:D:j:r:",
        ".?AV?$Array@PAV?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@@UnBCL@@",
        "OC::CInstalledOCStore::ModifyOCsState",
        ".?AVCXXXXXHandledException@?GE@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "ERROR_DS_INIT_FAILURE_CONSOLE",
        "na:ReadOnly",
        "void __thiscall UnBCL::Array<struct DiskLayout::Partition>::RemoveAt(int)",
        "QueryAllTracesW",
        "Successfully configured SetupCl %s at next boot; a registry change %s",
        "717K7e7w7",
        "  User: %s, Publisher: %s, App: %s, Version: %s",
        "Failed to service spaces default bootmgr",
        ".PAVCXXXXXHandledException@?NN@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ">#>(>3>=>P>\\>a>q>y>",
        "9#:<:O:h:}:",
        "?Compare@String@UnBCL@@SGHPBGPBV12@H@Z",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::RemoveAt(int)",
        "<#<1<?<",
        "6P6q6",
        "535^5",
        "void __thiscall UnBCL::Array<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::Remove(class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *)",
        ".PAVCXXXXXTemp@?M@??SPArePathsEqual@@YGHPAVString@UnBCL@@0@Z@",
        "9%909K9V9d9r9",
        "TreatAsSystem",
        ".?AVCXXXXXHandledException@?CFC@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "7%757H7S7g7",
        "=(===P=X=^=k=}=",
        "ERROR_IPSEC_MM_POLICY_EXISTS",
        "ERROR_WMI_INVALID_MOF",
        "u(j._f9z",
        "<8<?<E<J<U<`<t<",
        "?2?u?~?",
        "ERROR_EVT_FILTER_UNEXPECTEDTOKEN",
        "PSh8'",
        "void __thiscall UnBCL::ArrayList<unsigned char>::Insert(int,unsigned char)",
        ">(>4>>>O>X>a>n>s>|>",
        "=/=9=C=P=a=v=",
        "UninstallWindow",
        "5G5N5",
        "4)4n4t4",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *> *,int) const",
        "3,4M4b4j4p4}4",
        "REG_QWORD_LITTLE_ENDIAN",
        "Shpy`",
        ";#;);6;<;A;];i;{;",
        ".?AU?$IList@PAVCAppInfo@@@UnBCL@@",
        "3^3p3x3~3",
        ":):8:A:K:T:^:g:q:z:",
        "_stricmp",
        "Removing match for update %s",
        "System32\\%s\\Licenses\\%s\\%s\\%s",
        "RtlDosPathNameToRelativeNtPathName_U_WithStatus",
        "struct SetupPlatform::IDisk *const *__thiscall UnBCL::ArrayList<struct SetupPlatform::IDisk *>::GetBuffer(int) const",
        "ERROR_EVENTLOG_FILE_CORRUPT",
        "9KdtL",
        "7S7f7m7t7{7",
        "%hs: Found bogus system BCD store; a new one will be created.",
        "SecondBootPreOOBEEndTime",
        "Index out of bound.",
        "6#7<7O7h7}7",
        "2+2X2a2v2",
        ")SmVirtDisk::Delete",
        "8(808H8`8h8",
        "na:ByteAlignment",
        "jH^VR",
        "NTFS    ",
        "enum MIGSTATUS __stdcall SPExecuteOOBEBootApplyFromICB(class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,int,struct ISPTelemetryData **,struct ISPMigProgress *,long *)",
        "L$LPQQQ",
        "8M8f8",
        "ERROR_NOT_ENOUGH_SERVER_MEMORY",
        "6/6?6P6c6h6q6",
        "4'404F4T4^4h4q4z4",
        "Failed to build WimMount full file path",
        "    Failed to retrieve package metadata",
        "%hs: delete temporary page file %s successfully",
        "JET_errDirtyShutdown",
        "WriteDataCallback",
        "CAddCbsPackage::DoExecute: The new OS image is corrupt and cannot be repaired. Error: 0x%08X",
        "4I4j4",
        ".?AV?$SmartPtr@U?$ICollection@PAUISerializable@UnBCL@@@UnBCL@@@UnBCL@@",
        "MetaDeployment.dll",
        "<C<U<]<c<p<",
        "1,1J1W1h1o1u1z1",
        "9\"9,9B9P9b9y9",
        "#0P0k0",
        "1!1A1^1",
        "=$=8=E=S=k=q=",
        ".PAVCXXXXXHandledException@?BBI@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ";-<A<f<",
        "ERROR_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED",
        "<%<C<O<a<",
        "ERROR_EVT_INVALID_QUERY",
        ".?AU?$IEnumerator@W4OP_OPERATION_ID@@@UnBCL@@",
        "<,<=<R<Z<`<m<",
        "6)7J7i7",
        "ERROR_DS_NOT_AN_OBJECT",
        "ReadOrWriteSectorsWinNt",
        "void __thiscall UnBCL::ArrayList<class CBcdSetting *>::CopyTo(class UnBCL::Array<class CBcdSetting *> *,int) const",
        " Windows",
        "5'5C5H5Z5~5",
        "<1<@<F<",
        ":.:C:R:\\:a:i:p:|:",
        "ERROR_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED",
        ".?AV?$DefaultInstanceFactory@VCSetupPlatformPrivate@@@UnBCL@@",
        "?,?>?P?Z?q?",
        "PVWh)",
        "9*:`:",
        "0n1u1{1",
        "JET_errDatabaseAlreadyUpgraded",
        "Saving OC status for componentized system... OCStatusFilePath: %s; ReplacementManifestsDir: %s",
        "=#=+=7=>=D=I=T=b=j=p=u=",
        "<#<2<:<@<T<",
        "CSetupPlatformPrivate::RollbackOnlineSys",
        "7!7+7=7E7K7U7_7s7",
        "141T1t1",
        ".?AV?$SerializableArrayBase@PAVCOptionalComponent@OC@@@_@UnBCL@@",
        "2 2(22292?2D2O2Z2n2",
        "2#282@2F2S2e2s2",
        "RtlImageNtHeader",
        "2&202G2e2o2",
        "ERROR_SXS_XML_E_MISSINGEQUALS",
        "Source system appear as a WIMBoot, but there are no WIMBoot entries",
        "4!4f4z4",
        "SetSecurityInfo() failed",
        ">(>A>X>l>{>",
        "7!7.7;7C7L7Q7^7o7",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Successfully copied \"%s\" to \"%s\".",
        "<\"<.<;<C<O<W<b<i<p<{<",
        "9U t!",
        "ERROR_INVALID_EVENTNAME",
        "0$000@0L0T0[0a0q0",
        "6#63686L6f6t6",
        "EnumImageFiles",
        "RefreshAfter",
        "%hs: Failure while generating the list of files and folders to copy. Error: 0x%08X",
        "CExecuteUnattend::DoExecute: Unattend result indicates SMI pass failure: 0x%08x",
        ".?AU?$IList@PAVCPartitionInfo@@@UnBCL@@",
        ".?AV?$SerializableBase@VCMigrateBootSettings@@$0A@V?$DefaultInstanceFactory@VCMigrateBootSettings@@@UnBCL@@@UnBCL@@",
        "CInfFile::IsApplicableToDevice",
        "(%lx): Failed to validate if we should process symbolic link %s",
        "AppxSuccessPath",
        "?2?@?J?W?`?h?",
        "bootsect.bak",
        "::;^;",
        ".PAVCXXXXXTemp@?3??DoExecute@CUpdateBootCode@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ".SetupPlatform.exe /rollbackonlineuser",
        "<*=0=9=D=",
        "CReconstructOS::RestoreInstallationSKUOverrides: Couldn't find SKU overrides file %s",
        "0$0(0@0D0X0\\0t0x0|0",
        ".PAVCXXXXXTemp@?6??ValidateUninstall@CSetupPlatformPrivate@@UAEJXZ@",
        ":':7:G:M:R:j:",
        ">!>7>H>U>m>t>z>",
        "RestoreFileMetadata: RestoreHardlinks failed",
        "Unable to generate new account domain SID",
        "60888=8C8R8[8k8x8~8",
        "MigWiz",
        "=)>3>Z>z>",
        "4A4R4j4p4",
        "RPh\\|",
        "Setup\\Status\\SysprepStatus",
        "u:j`Xf;",
        "{55983C65-C275-44EB-B16D-210DF5F94E0A}",
        "1$1<1B1{1",
        ":&:1:A:H:N:S:^:e:j:",
        "SysprepSession::ExecuteInternal",
        "%hs: Compressing file %s, size: %I64u",
        "JET_wrnColumnTruncated",
        "S$[_^",
        "+0I0Y0",
        ":,:H:P:X:d:l:",
        "2$2)242>2Q2V2d2k2q2v2~2",
        "j-Yf9L00",
        "9X\\t93",
        "Failed to set task actions. hr = 0x%x",
        "OSRollbackService::CCheckpoint::ExtractCrashDump",
        ".?AVCXXXXXHandledException@?2??DoExecute@CMergeWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ".PAVCXXXXXTemp@?9??SPUninitializeNetwork@@YGXH@Z@",
        "=C>{>",
        "ControlSet%03u\\Control\\Session Manager\\Memory Management",
        "6(60686@6H6P6X6`6h6p6x6",
        ";';8;A;I;s;",
        "6!6-6E6K6]6q6~6",
        ".?AV?$ArrayListEnumerator@PAVCInfFile@@@_@UnBCL@@",
        "Cannot make device object of type BCDE_DEVICE_TYPE_PARTITION. Error: %d",
        "7@7d7v7~7",
        "0'050L0\\0j0z0",
        "CAddProvisioningPackage::DoExecute: Failed to load offline SOFTWARE hive: 0x%08x",
        "ExportPartialChunkedPortion",
        "SmDisk::EnumeratePartitions: Failed to create partition enumerator (0x%08x)",
        "Failed to copy EditionID value",
        "9E:T:",
        "tRecovery\\Customizations",
        "=(=0=E=X=o=",
        "<#=U=g=o=u=",
        "979O9]9f9",
        "{583018E5-CB23-4C11-B76C-762DE31876E3}",
        "ERROR_NO_TRUST_SAM_ACCOUNT",
        ".PAVCXXXXXTemp@?NK@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "CDeploymentBase::ReleaseBase",
        "bn-BD",
        "onecore\\base\\cbs\\pbr\\cbspbrui.cpp",
        "SPIsProvisioningPackageSplit: Failed to get WIM handle for %s. Error: 0x%08X",
        "0'0,0@0",
        "mxeagent.dll;csiagent.dll",
        "9\\$@t",
        "There is already a running kernel logger session!",
        "Upgrade store full path is: %s",
        "CDeploymentBase::StreamRead: Failed to restore mount paths. Error: 0x%08X",
        ".?AVCLPValidator@@",
        "JET_errLanguageNotSupported",
        "MEMORYTRACK: After op        : %I64u",
        "Push Button Reset - Update",
        ".?AU?$IDictionary@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@",
        "6+6E6`6",
        ";&;4;A;Q;c;q;",
        "ERROR_NOTIFY_ENUM_DIR",
        "GroupName",
        "NtQueryInformationFile",
        "464N4b4o4}4",
        "NDATA",
        "ERROR_DS_NC_MUST_HAVE_NC_PARENT",
        ":&:N:u:",
        "7%707@7J7\\7d7j7t7~7",
        "ERROR_INVALID_HW_PROFILE",
        "Failed initializing the client",
        "=3>C>",
        "7#777@7I7R7q7",
        "class UnBCL::ArrayList<class COperation *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class COperation *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@W4SYNCEXEC_PHASE@SetupPlatform@@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "Nothing to do, no offline sessions to work with.",
        ":*:4:>:E:K:P:[:f:z:",
        "CBS.LOG",
        "ERROR_TIMEOUT",
        "<<<D<P<X<p<",
        "SPGetReserveManager",
        "G QQVP",
        "3$3(3,30383<3@3D3L3P3T3X3`3d3h3l3t3x3|3",
        "7+727g7n7",
        ".?AU?$IEnumerable@PAUHKEY__@@@UnBCL@@",
        "5-5>5T5z5",
        "FindFirstFileW",
        "ERROR_DBG_UNABLE_TO_PROVIDE_HANDLE",
        "DeletePathDirectoryCallback: Spoofing detected deleting [%s] -> [%s]",
        "%hs: Missing information for the SafeOS for rollback.",
        "long __stdcall SPValidateMigratedServices(class UnBCL::String *)",
        "Source OCs:",
        ">&?@?",
        ".PAVCXXXXXTemp@?3??DoExecute@CEnableTracingForImage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "CSetupPlatformCheckpoint::CopyConfigFiles: Failed to copy [%s] -> [%s]; Error: 0x%08X",
        "7!7;7I7Q7Z7g7~7",
        "Start.Bak",
        "1$161F1\\1h1t1",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::Resize(int,int)",
        "Failed to open service control manager. Error: 0x%08X",
        "SVWQh",
        "IsBootable",
        "long __thiscall CDeploymentBase::SuspendAndRelease(const unsigned short *)",
        "&apos;",
        "VdsPlatformDiskEnumerator::Initialize: Failed to reenumerate disks (0x%08x)",
        "=(=0=6=C=U=c=y=",
        ":+:8:E:c:k:t:",
        "ERROR_CLUSCFG_SYSTEM_DISK_DRIVE_LETTER_CONFLICT",
        "{6AEE0681-52FD-447D-B2E8-73509235BE13}",
        ".PAVCXXXXXTemp@?CO@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "Call to SclAlloc failed!",
        ">c?|?",
        "CExceptionHandler::CExceptionHandler",
        "JET_errRecordDeleted",
        "??4?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "=\">:>O>V>",
        "PartitionTableType",
        "se-FI",
        "Copying font files from %s to %s...",
        "0;0n0",
        "WinHttpSetOption",
        "9%9/9;9c9j9p9u9",
        "?+?X?e?}?",
        "9-9C9z9",
        "\\KERNEL32.DLL",
        "2:2A2L2S2_2q2w2|2",
        "NTDETECT.COM",
        "moh-CA",
        "BootDebuggerFiles.PCAT",
        "ERROR_SXS_MANIFEST_MISSING_REQUIRED_DEFAULT_NAMESPACE",
        "COperationQueue::Sort",
        "Can't get largest free space",
        "We'll continue enumeration",
        "5I5\\5h5t5",
        "class CFailForwardSystem **__thiscall UnBCL::ArrayList<class CFailForwardSystem *>::GetBuffer(int)",
        "pExecuteMove",
        "=3=W={=",
        "ERROR_WRONG_COMPARTMENT",
        ".?AVCXXXXXHandledException@?JP@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "4 4-4\\4m4y4",
        "Rollback not configured correctly, AllowUninstall request will be ignored.",
        "ERROR_UNABLE_TO_LOCK_MEDIA",
        "4=5s5",
        "4$404P4X4`4h4p4|4",
        "3 3+3A3_3f3l3q3|3",
        "ZwEnumerateBootEntries",
        "%hs: Creating a compact OS",
        "9V9w9",
        "1\"1:1A1H1O1V1]1c1n1",
        "$OFFLINE_RW$DEFAULT",
        "?\"?)?B?I?O?T?_?e?x?",
        ";%;0;@;[;l;",
        "class CFilterDriverInfo *&__thiscall UnBCL::ArrayList<class CFilterDriverInfo *>::get_Item(int)",
        "ERROR_CTX_CLOSE_PENDING",
        "5$5H5X5`5|5",
        "SmVirtDisk::EnumeratePooledDisks",
        "DiskLayout::Populate: Failed to iterate over existing partitions: 0x%08x",
        "828<8T8k8",
        ".PAVCXXXXXHandledException@?2??SPTaskRemoveSnapshot@@YGJXZ@",
        "CMediaLayout::ExecuteOptimization: Failed to set new info set in automation: 0x%08x",
        "%hs: Failed to get firmware type. Status = 0x%08X",
        "3$3Z3",
        ": :,:>:j:",
        "OEMHelpCustomization",
        "2*2C2g2",
        "ERROR_SCREEN_ALREADY_LOCKED",
        ".?AVCXXXXXHandledException@?8??SPCreateSnapshotWithScoping@@YGJPAVString@UnBCL@@_JPAV?$ArrayList@PAVString@UnBCL@@@3@PAPAV23@@Z@",
        "class COperation *__thiscall UnBCL::_::ArrayListEnumerator<class COperation *>::get_Current(void) const",
        "SssGetServicingStackFilePath",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<unsigned short,unsigned short> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *> *)",
        "void __thiscall UnBCL::_::ArrayListEnumerator<struct _GUID>::Reset(void)",
        "=%=;=F=W=]=o=w=}=",
        "LayNtBootCode: Error writing disk sectors!",
        "0H0j0|0",
        "? ?(?0?8?D?d?l?t?|?",
        "L$,QR",
        "SPDeleteAllSnapshots: Failed to initialize VSS for backup. Error: 0x%08X",
        ".PAVCXXXXXTemp@?BA@??DoExecute@CTrustSafeOS@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ";'<B<",
        "666666666666666",
        "=$=+=1=6=B=M=a=s=",
        "  SP Level = %d",
        "SPRemoveScheduledTask: Cleanup the folder as it's empty",
        "GetWIMBootWIMPathInternal",
        "VdsDisk::PrepareForWipe",
        "System will shutdown after rollback",
        "9'949=9V9",
        "464>4K4p4",
        "CDeploymentProject::CreateBootableMediaDeployment: Failed to format target volume (0x%08x)",
        "9\"9*909B9V9c9",
        "9'9;9B9H9N9Z9h9p9v9",
        "JET_errInvalidLoggedOperation",
        ".?AV?$ArrayList@PAVCMountedPathInfo@CDeploymentBase@@@UnBCL@@",
        "CallPidGenX: PidGenX function failed on this product key. (hr = 0x%x)",
        "Failed to close the image handle for WIMBoot entry %I64u. Error: 0x%08X",
        "ERROR_OPLOCK_BREAK_IN_PROGRESS",
        "SetupPlatform::ResurrectSetupPlatform",
        "Expanded profile hive path: NT path = [%ws]",
        "No source OS pieces found",
        ";@;H;U;f;q;",
        "VERBOSE: Percents for pre-finalize: %d%% -> %d%%",
        "SPCopyFolder: Failed to copy file %s to %s. Error: 0x%08X",
        "Failed to allocate object info.",
        "CRYPT_E_ATTRIBUTES_MISSING",
        "void __thiscall UnBCL::ArrayList<class DiskLayout *>::QuickSort(class UnBCL::ArrayList<class DiskLayout *> *,class UnBCL::ArrayList<class DiskLayout *> *,int,int)",
        "Opening object %s",
        "\\\\?\\GLOBALROOT\\",
        ".?AU?$IEnumerable@PAVCGlobalPath@@@UnBCL@@",
        "EditionID",
        "=0=J=^=f=p=",
        "6&6+646P6W6^6i6v6",
        ".PAVCXXXXXHandledException@?8??Finalize@CNewSystem@@UAE?AW4SYSTEM_STATE@SetupPlatform@@PAUIOperationsProgress@4@H@Z@",
        "=2=9=@=L=S=f=s=z=",
        "; ;&;9;N;U;[;`;k;q;",
        "ERROR_PAGED_SYSTEM_RESOURCES",
        "CSetupPlatform::StartTelemetry",
        "9{xu6",
        "system32\\wbem\\repository",
        "CSetupPlatformPrivate::Initialize",
        "    Failed to setup input",
        "ProductVersion",
        "Boot sector does not need to be updated; skipping",
        "7 7(7,70747<7@7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7",
        " 070Q0X0^0c0n0",
        "NotEncrypted",
        "JET_errLogSequenceEndDatabasesConsistent",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@_JPAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "ERROR_PATCH_REMOVAL_DISALLOWED",
        "QQQh t",
        "435G5Y5a5g5p5",
        "3$3,343<3D3T3\\3l3t3|3",
        "ERROR_ATOMIC_LOCKS_NOT_SUPPORTED",
        "pDUDownload",
        ".PAVCXXXXXHandledException@?BG@??pSPDoOfflineApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0H0PAUISPMigProgress@@@Z@",
        "WIM\\IMAGE[INDEX=%d]\\WINDOWS\\SERVICINGDATA\\PKEYCONFIGVERSION",
        "7#787I7P7]7m7u7|7",
        "Completed.xml",
        "4,444;4I4S4f4n4",
        "ERROR_IMPLEMENTATION_LIMIT",
        ".?AV?$SerializableBase@VCSetupPlatformPrivate@@$0A@V?$DefaultInstanceFactory@VCSetupPlatformPrivate@@@UnBCL@@@UnBCL@@",
        ".PAVCXXXXXHandledException@?JO@??DoExecute@CRelocateOS@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "; ;0;L;h;",
        "QueueEULAAccepted called",
        "Inconsistencies found in recommended hard disk space; will not use it",
        "SPCleanupInstallationDrive: Unable to stop Setup Platform ETW session. Error: 0x%08X",
        "JET_errInvalidOperation",
        "?Equals@String@UnBCL@@UBEHPBVObject@2@@Z",
        "SL_E_OPERATION_NOT_ALLOWED",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@KPAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "Failed to upload Watson data. hr = 0x%X",
        "CDiagnosticsHelper::GetWatsonFilesToAttach",
        ";.;7;@;I;v;",
        "{7D34DF83-F4D1-4A0F-B87D-27688797D782}",
        "3-3T3\\3f3m3s3x3",
        "RetryValidator",
        "PVhP^",
        ";&;+;4;P;W;^;i;v;",
        "5$585@5H5P5X5`5h5p5x5",
        "PreSysPrepEndAvailableDiskSpace",
        "%hs: Copy operation cancelled by the cancel parameter.",
        "2!2-292O2e2n2w2",
        "UuidCreate failed with error: 0x%08X",
        "?&?-?3?8?C?N?S?g?{?",
        "<#<)<=<J<b<s<z<",
        "Failed to allocate memory for EVNET_TRACE_PROPERTIES",
        "2!2'282E2Y2`2f2k2v2",
        "9)969M9Y9e9q9}9",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAUHKEY__@@UTableKey@?$Hashtable@PAVString@UnBCL@@PAUHKEY__@@@2@PAV12@UKeyTraits@52@$1?RetrieveKey@52@KGPAV12@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAUHKEY__@@@UnBCL@@PAUHKEY__@@UKeyTraits@23@V?$CElementTraits@PAUHKEY__@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "Migration.Services.Deferred",
        "Service Pack %d",
        "j\\Yuk",
        "ERROR_NO_RECOVERY_PROGRAM",
        "050N0U0f0",
        "CRemoveSRCheckpoints::DoExecute",
        "ERROR_PRINT_CANCELLED",
        "f98tV",
        "SclpStateRecordStatField",
        "mn-MN",
        "CUninstall::SetUninstallWindow",
        "ERROR_SXS_INVALID_XML_NAMESPACE_URI",
        ":8;J;T;[;a;f;q;",
        "WIM entry with ID: %I64d no longer exists, was likely removed before getting here.",
        "CSetupPlatform::CreateNewSystem: Failed to resolve install target: 0x%08x",
        "$VWhP",
        "VdsVolumePathEnumerator::GetNext: Failed to copy volume access path index %d (0x%08x)",
        "CReconstructOS::RestageWindows: Failed to read source image preferred language: 0x%08x",
        "4&4-43484C4N4b4n4v4",
        "int __thiscall CFlowValidator::IsOperationExecuted(class COperationQueue *,enum OP_OPERATION_ID)",
        "ERROR_INVALID_TARGET_HANDLE",
        "IMAGE",
        "?Trim@String@UnBCL@@QBEPAV12@PBG@Z",
        "9%919C9_9h9u9|9",
        "CSetupPlatform::GetClientDUPackages: Failed to append updates to the CDUPackageCollection. hr = 0x%x",
        "ChunkWriterInit",
        "ERROR_DS_MODIFYDN_DISALLOWED_BY_FLAG",
        "<+<B<P<Z<d<n<x<",
        "=$=*=8=?=T=[=r=",
        "class CFilterDriverInfo *const &__thiscall UnBCL::ArrayList<class CFilterDriverInfo *>::get_Item(int) const",
        "QQVWh",
        "?!?@?^?|?",
        "PRODUCTTYPE",
        "settings-win.data.microsoft.com",
        "0-0@0E0O0t0y0",
        "void __thiscall UnBCL::ArrayList<class DiskLayout *>::RemoveAt(int)",
        ";C,t-3",
        "t$4hx",
        "Failed to open service manager, won't be able to refresh/start restored services. Error: 0x%08X",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *> *)",
        "HARDRESERVETRACK: Capacity     : %I64u",
        ".?AV?$HTEnumerator@KPAUIVdsVDisk@@UTableKey@?$Hashtable@KPAUIVdsVDisk@@@UnBCL@@KUKeyTraits@34@$1?RetrieveKey@34@KGKPBV?$CAtlMap@UTableKey@?$Hashtable@KPAUIVdsVDisk@@@UnBCL@@PAUIVdsVDisk@@UKeyTraits@23@V?$CElementTraits@PAUIVdsVDisk@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "RPC_X_SS_CONTEXT_DAMAGED",
        "9'9<9Y9_9j9x9",
        "2!2'242:2?2p2",
        "8'8.858@8P8d8p8",
        "DUSearchFailedHR",
        "IActionCollection::TaskDefinition failed. hr = 0x%x",
        "u&Sh|",
        "?(?[?u?}?",
        "9%9;9[9u9",
        "__thiscall UnBCL::ArrayList<class CAppInfo *>::ArrayList(const struct UnBCL::ICollection<class CAppInfo *> *)",
        "ERROR_WMI_GUID_DISCONNECTED",
        "0(040A0M0T0h0p0v0{0",
        "Disable Shift-F10 command prompt hotkey",
        "6 6/646[6a6j6r6",
        ".?AVCWIMEntryIndex@CWIMBootHelper@@",
        "Failed to write disk space to file: %s. Error = %d",
        "ERROR_INVALID_ADDRESS",
        "3)333K3b3~3",
        "%hs: Bitlocker is enabled but the current OS does not support suspending it.",
        "void __thiscall UnBCL::Array<struct DISK_SPACE_IMPACT>::InitLarva(class UnBCL::ArrayList<struct DISK_SPACE_IMPACT> *)",
        ".?AUIImageInfoSet@SetupPlatform@@",
        "?)?6?J?R?Z?`?e?w?",
        "Failed to read the ProcessorArchitecture value",
        "PWShD",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *> *)",
        "Operation",
        "? ?(?0?8?@?L?l?t?|?",
        "ERROR_SYSTEM_POWERSTATE_TRANSITION",
        "j`jRjej",
        "4$4;4Q4s4",
        "2 202@2P2`2p2",
        "6 6<6@6D6H6X6`6d6h6l6t6",
        "4 424:4@4M4_4m4",
        "8$8/898>8R8s8",
        "ERROR_NO_SIGNAL_SENT",
        "8 8$8(8,80888<8@8D8H8L8P8T8X8\\8`8d8h8p8t8|8",
        ">*>8>@>P>]>e>r>z>",
        ".?AVCSetupPlatformInfo@@",
        "6@7`7",
        "BiCreateEfiEntry failed %x",
        "3B4J4V4j4v4}4",
        "class UnBCL::ArrayList<class CGlobalPath *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class CGlobalPath *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "Copying objects. Version: %d. Type: 0x%08x",
        "ActionPlatform::LaunchModule: Invalid DLL path %s passed",
        "ERROR_INVALID_ID_AUTHORITY",
        ":\":,:1:9:@:L:^:s:",
        "!040j0y0",
        "CSPExecuteProgress::Recalculate",
        "Failed to set wof data for file backed by wim file",
        ".?AVIOCImageServicingAdapter@OC@@",
        "    Failed to assemble file path string",
        "3'3=3d3",
        "PnpPropMigApplyW",
        "se-SE",
        ".?AV?$DefaultInstanceFactory@VCAddUnattend@@@UnBCL@@",
        "</<;<y<",
        "GetExitCodeThread",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: \"Boot\" directory didn't exist before Setup was launched.",
        "7?7F7L7Q7\\7c7w7",
        ";.;>;J;Q;_;o;t;",
        "<$<4<D<T<d<t<",
        "0!0'0,0>0N0W0c0",
        "5$5)5=5[5",
        "ERROR_DS_ATT_ALREADY_EXISTS",
        "void __thiscall UnBCL::ArrayList<class CDeploymentBase *>::set_Item(int,class CDeploymentBase *)",
        ".PAVCXXXXXHandledException@?2??RestageWindows@CReconstructOS@@IAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "wimgapi.dll",
        ".?AV?$DefaultInstanceFactory@VCMountWIM@@@UnBCL@@",
        ">$>0>P>\\>d>",
        "Sh0Wb",
        "SPExecuteCleanup: Failure while building path to clean up file %s. Error: 0x%08X",
        "=#=*=F=M=i=r=z=i>s>",
        "CApplyDrivers::CopyToDriverStore: Failed to copy driver package %s to destination %s. Error: 0x%08X",
        "install.wim",
        ">#>*>4>E>R>\\>k>t>z>",
        "index out of range to ArrayList#Insert",
        "\\Device",
        "class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::get_Current(void) const",
        "t5j\\W",
        "=,=J=Y=",
        "Using payload path: %s",
        ">#>8>O>_>k>{>",
        "7%7*757<7P7q7",
        "242L2P2\\2|2",
        ".?AV?$DefaultInstanceFactory@VCSuspendBitlocker@@@UnBCL@@",
        ".?AV?$DefaultInstanceFactory@VCMountedPathInfo@CDeploymentBase@@@UnBCL@@",
        "CSetupAutomation::GetDiskInfo: Failed to read volume properties: 0x%08x",
        "HiveListEnumerator::ConvertWin32PathToNt",
        "ERROR_IPSEC_MM_AUTH_PENDING_DELETION",
        "CDeploymentProject::CreateVHDDeployment: Failed to delete the VHD. Error: 0x%08X",
        "576O6\\6t6",
        ">(>3>A>i>{>",
        "70757>7E7R7]7f7m7z7",
        "sCWinOldCleanup::CWinOldCleanup",
        "202[2d2k2",
        "class UnBCL::SmartPtr<class OC::COCCollection> __thiscall OC::CDownlevelOCStore::GetOCCollection(void)",
        "313I3N3e3z3",
        "; ;(;X;_;e;j;u;",
        "EnterpriseN",
        "6#6U6",
        "2*242G2\\2}2",
        "Crash 0x%08X detected",
        "?4?F?N?T?h?n?w?",
        "CImageInfoSet::ValidateProductKey: Failed to call SkuGetImageProductKeyFiles, hr=0x%x",
        "4+42484=4H4S4g4",
        "8$969>9D9Q9c9s9",
        "void __thiscall UnBCL::ArrayList<class ISPPluginData *>::set_Item(int,class ISPPluginData *)",
        "4:4z4",
        "SPCreateDiskImage: AttachVirtualDisk failed: %u",
        "2$393A3G3U3n3{3",
        "GetThreadDesktop",
        ":$:,:8:\\:d:l:t:|:",
        "%s\\System32\\Config",
        "CMediaLayout::ExecuteOptimization: Failed to get image info set from %s, the new source WIM: 0x%08x",
        "7D7I7N7X7m7r7",
        "FODRemovalList",
        "Ph`Bc",
        ".?AVCXXXXXHandledException@?BBI@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "CCompressedPayloadWriterT<class CEmptyType>::UpdateOffset",
        "ImagePath",
        "%hs: GetUninstallWindow returning default window: %d",
        "<&<.<4<9<K<[<g<n<|<",
        "SPDeserializeOperations",
        "JET_errFileClose",
        "EnumAndDeleteWimExternalFilesProc",
        "PVWhn",
        "6)63696G6z6",
        "%hs: Error while creating the setup OOBE key: 0x%08X",
        "788@8U8]8s8",
        "=;=B=a=u=}=",
        "9<:g:l:",
        "SetWindowPos",
        "8\"838>8L8}8",
        "CUninstall::IsUninstallInitiated",
        "=,=J=",
        "<%<-<=<O<j<}<",
        ":&:C:O:\\:h:",
        "Path.Win32",
        "RESOURCES",
        "0#0(030=0B0V0_0l0",
        "Compress",
        "3(484T4[4`4e4",
        "1)1=1N1T1w1}1",
        "7(7:7R7]7h7s7~7",
        "303I3_3k3q3y3",
        "SmPlatform::IsAvailable: SM API available",
        "fXfXfXfX",
        "%hs: Cannot publish uninstall disabled notification on offline OS; it will happen online",
        "=@=x=",
        "OC::CCryptoUtil::IsFileMicrosoftTrusted",
        "VERBOSE: MOVETRACK: Destination %s does not exist, error: 0x%08X",
        "GWh,U",
        "SPApplyStandardDiskConfig: Disk layout step %u failed (0x%08x)",
        "FsSecureSDUpdateCount",
        "747F7O7T7_7v7~7",
        "5)6=6D6J6O6Z6e6|6",
        "GetAnswerFileContentsAsUnattend: Opened, but failed to read %s: 0x%08x",
        "9!9,969I9R9y9",
        "Physical",
        "==>h>m>",
        "PVh8<",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *> *,int,int)",
        "Copy SYSTEM\\WPA key from old windows",
        "8B9I9x9",
        "es-PA",
        "CStoreHeaderWriterT<class CEmptyType>::Initialize",
        ">+>`>m>u>",
        "ZwModifyBootEntry",
        "WIM\\IMAGE[INDEX=%d]\\WINDOWS\\LANGUAGES\\FALLBACK[LANGUAGE=%s]",
        "[%d] %s%s%s%s",
        ":0;r;y;",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCFailForwardSystem@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "031I1v1~1",
        "IPrincipal::put_RunLevel failed. hr = 0x%x",
        "7 7$74787H7L7\\7`7p7t7",
        "=1=E=c=|=",
        "ERROR_DS_INSUFF_ACCESS_RIGHTS",
        "Software\\Microsoft\\Windows\\CurrentVersion\\Setup",
        "CSetupRollbackService::GetInstance \"%s\" already exists.",
        "void **__thiscall UnBCL::ArrayList<void *>::GetBuffer(int)",
        "4)444B4h4}4",
        "UblIsUSBDiskInternal: IsContainerIDSameAsRootContainerID failed! Error = 0x%X.",
        "WIMExtractImagePathAndGetFileHandle",
        "1'1E1Q1c1",
        "T$(94",
        "SYSTEM\\CurrentControlSet",
        "RaiseException",
        "737:7@7E7P7_7g7m7",
        "VdsVolume::GetProperties: Failed to get volume properties (0x%08x)",
        "RtlStringFromGUID",
        "1$1,10141<1@1H1L1X1\\1`1d1h1l1p1t1x1|1",
        "JET_errDefaultValueTooBig",
        "Found flight ID %s for update %s",
        "=&=I=P=V=[=f=m=",
        "3>3W3l3t3z3",
        "CCleanupSnapshot::DeleteSnapshot: Snapshot [%s] is retained",
        "struct PageFileDesc *const &__thiscall UnBCL::ArrayList<struct PageFileDesc *>::get_Item(int) const",
        "32373s3",
        "ERROR_WRONG_DISK",
        "7-7F7M7S7X7c7u7z7",
        "DiskLayout::VerifyLayoutModifiedOrder",
        "Failed to allocate path.",
        "SP_PLUGIN_INFO",
        "%hs: Did not find any offline mappings",
        "Query %s succeeded, but couldn't enumerate results (0x%08x)",
        "3.353<3G3Q3d3t3}3",
        ">$?=?B?~?",
        "class CBcdSetting *&__thiscall UnBCL::ArrayList<class CBcdSetting *>::get_Item(int)",
        "void __thiscall UnBCL::Array<unsigned int>::RemoveAt(int)",
        "6/6g6y6",
        "4G5M5\\5k5",
        "CurrentOperation",
        "MoveDirectoryFileCallback: Unable to move file from [%s] to [%s]; GLE = 0x%x, attempting copy",
        "ERROR_NO_ASSOCIATION",
        "203N3]3",
        "D$ Pj",
        "%hs: Failed to write WinOld mapping source %s to the %s config file. Error: 0x%08X",
        "XOldWinREHash",
        "3<4l4",
        "SP_WINRE_INFO",
        "AccessPath",
        ".?AVCFilterDriverInfo@@",
        "='=;=O=V=\\=a=l=w=",
        "[%hs(%hs)]",
        "8L9X9a9j9t9",
        "4'4C4",
        "%hs: Cannot enable SE_BACKUP_NAME privilege",
        "9'959",
        "4#4P4",
        ";$;1;=;M;Z;d;x;",
        "__thiscall UnBCL::ArrayList<class CDriverInfo *>::ArrayList(const struct UnBCL::ICollection<class CDriverInfo *> *)",
        ".PAVCXXXXXHandledException@?P@??QueueCustomizations@CNewSystem@@UAEJPAUISetupAutomation@SetupPlatform@@@Z@",
        "31393?3L3^3h3}3",
        "4&4h4{4",
        ";3;=;F;M;Z;f;o;{;",
        "717=7\\7e7p7",
        "<+<=<K<p<",
        "\\Device\\HarddiskVolume",
        "-Tz4q",
        "575M5V5w5",
        "SL_E_VALIDITY_PERIOD_EXPIRED",
        ".?AVNumericProperty@?1???$pDefineNumericProperty@V<lambda_45f26f953671ba29c8678a5b25f77b79>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_45f26f953671ba29c8678a5b25f77b79>@@@Z@",
        "f;D$Pu",
        "ERROR_CAN_NOT_COMPLETE",
        "CSplitWIM::DoExecute: Failed to open WIM file %s. Error: 0x%08X",
        "%hs: Attempting to hide rollback boot entry",
        "JET_errInvalidBackup",
        ".?AV?$DefaultInstanceFactory@VCOperationInfo@@@UnBCL@@",
        "Failed to set Wof data for file",
        "CSetupPlatform::CreateNewSystem: Failed to compare current platform %s with target platform %s",
        "DiskLayoutPrepare: Failed to read disk properties (0x%08x)",
        "skipped",
        "8%818=8D8S8]8d8p8u8",
        "6%63686F6P6^6h6u6",
        "171O1h1",
        "CodeIntegrity.Telemetry",
        "JET_wrnDefragAlreadyRunning",
        "0:1A1k1r1",
        "?!?6?H?P?Y?^?d?v?{?",
        ".?AV?$SerializableBase@V?$Array@PAVCOperationsValidator@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCOperationsValidator@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "2)222>2J2V2r2",
        "?@?H?P?d?l?t?",
        "6(6B6M6]6g6y6",
        "8\"8-8<8A8U8`8",
        "SVh q",
        "5(5>5K5^5k5",
        ">*>4>F>P>g>}>",
        "Failed to register progress bar handler",
        "9+9A9H9P9U9h9s9}9",
        "3%3:3B3H3U3g3z3",
        "=$=,=4=<=D=L=T=d=l=t=|=",
        "7$707;7O7m7t7z7",
        "757<7E7J7U7a7g7{7",
        "ERROR_DS_NO_PARENT_OBJECT",
        "?+?4?:?G?M?R?c?n?|?",
        "6/6;6V6l6",
        "%hs: We are now on the new OS, won't report pagefile/swapfile size anymore",
        ".?AU?$IEnumerator@PAVString@UnBCL@@@UnBCL@@",
        "=.=4===S=`=r=z=",
        "2/2o2",
        "FirstBootEndAvailableDiskSpace",
        "    Failed to allocate link path string",
        "7\"7>7U7`7p7z7",
        "8#8/8F8]8",
        "OfflineSysprepIncomplete",
        "5,595J5R5\\5i5t5|5",
        "9Xxvg",
        "3$313@3Y3o3",
        "949N9",
        "646<6D6L6T6l6t6|6",
        ":9:a:",
        "SL_E_PKEY_INTERNAL_ERROR",
        "PGWj(",
        "%hs: Parent must have driver migration turned on.",
        "0'0:0N0S0_0r0",
        "ERROR_LOG_CLIENT_NOT_REGISTERED",
        "0#040;0Q0l0r0|0",
        "JET_errRecordTooBig",
        ".PAVCXXXXXTemp@?BB@??DoExecute@CCompressWIMBootFiles@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ">[?m?",
        "??0?$IEnumerable@PAVString@UnBCL@@@UnBCL@@QAE@XZ",
        "Rollback-Online-User submitting watson report synchronously",
        "ERROR_CTX_CANNOT_MAKE_EVENTLOG_ENTRY",
        "5(555M5x5",
        ";B<T<",
        ":C:J:P:]:m:",
        "=(=2=K=[=l=w=",
        "334C4",
        "ErrorCode",
        "<'<X<l<x<",
        "9{0tW",
        "s%s\\Control\\Class\\%s",
        "Binary path (SCM): %s",
        "5 5$5(5054585<5@5D5H5L5P5X5`5d5h5l5p5t5x5|5",
        "\\Device\\Harddisk%lu\\Partition%lu",
        "ERROR_CANCEL_VIOLATION",
        "?(?,?<?@?P?T?d?h?x?|?",
        "tZ;O(rU;O$r",
        "4#5U5",
        "Attempting to add class filter data:",
        "jbj~P",
        "OC::COCDismAdapter::EnableDisableOCs: DismCheckImageHealth failed. hr = 0x%x",
        ";1;?;V;];c;l;u;",
        "servicing\\packages",
        "ERROR_IPSEC_IKE_LOAD_FAILED",
        "2)20262;2F2M2S2g2m2",
        "656\\6d6n6u6{6",
        ".?AU?$IList@PAVCShellFolderInfo@@@UnBCL@@",
        "%hs: Failed to read Safe OS boot entry GUID from %s. Error = 0x%08X",
        "Expected [%u] contiguous parts, but missing part number [%u] for [%s]!",
        "747<7D7L7T7\\7d7l7t7|7",
        "void __thiscall UnBCL::ArrayList<class CRegCreationData *>::Insert(int,class CRegCreationData *)",
        "CSetupAutomation::GetImageInfoSet: Failed to determine install image info: 0x%08x",
        "2,242<2H2h2p2x2",
        ";*;5;E;O;a;i;o;y;",
        "Directory",
        "WIMBootFiles.info",
        "Install Eula",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$Array@E@2@@UnBCL@@@UnBCL@@@UnBCL@@",
        "CMigrateFramework::DoExecute: Cannot load security hive for offline OS %s. Error: 0x%08X",
        "JET_errSesidTableIdMismatch",
        ".?AV?$Array@PAVCCheckpoint@OSRollbackService@@@UnBCL@@",
        ";/;;;E;N;[;d;};",
        "void __thiscall UnBCL::Array<struct DiskLayout::Partition>::Insert(int,struct DiskLayout::Partition)",
        "696B6J6Q6[6t6|6",
        ".?AU?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@",
        ":2:B:J:r:y:",
        "969J9",
        "ARP Validator: Ignoring validator failure due to environment variable.",
        "%hs: Failed to write bitlocker data to file: %s. Error: 0x%08X",
        "%hs: Failed to delete the boot status policy for the new OS. Error: %d",
        "xCMediaLayout::QueueFileCopy",
        "5'5<5Y5_5j5x5",
        "WVhx&",
        "5*6]6t6",
        "484J4R4X4e4t4",
        "%s_Classes",
        "QSj4jZjd",
        "4!5,5\\5f5",
        "~9sHt",
        "./IMAGE",
        "Tracing: support user mode provider %s",
        "?E?L?R?W?b?l?",
        "Compact apply failed because wof driver doesn't support it!",
        "8\"9k9u9",
        "SPRemovePath",
        "666K6Q6`6p6x6",
        "COfflineHiveT<class CEmptyType>::GetStringValue",
        "FIOSetAttributesByHandle",
        "pAddSafeOSDrivers: Failed to get provisioning package %u: 0x%08x",
        "%hs: failed to get Ksecdd entropy. Error: %08x",
        "Manipulating a pended request in offline mode requires access to the offline SYSTEM hive.",
        ".?AV?$Hashtable@PAVString@UnBCL@@PAVCSPInternalPluginData@@@UnBCL@@",
        "syr-SY",
        "ERROR_INVALID_FORM_NAME",
        "= =,=8=D=P=\\=h=t=",
        "Onesettings: Failed to get DeviceId from registry: 0x%x",
        "7)7G7",
        ">*><>W>",
        "2*2<2J2X2f2",
        "4r5x5",
        ";1;J;Y;a;g;l;~;",
        "Error creating Provider value for %s. Error: 0x%08X",
        "101>1Y1g1q1w1",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@PAUIOperationsProgress@SetupPlatform@@K@UnBCL@@@UnBCL@@@UnBCL@@",
        "Copy folder from %s to %s",
        "6*6<6C6I6N6Y6c6v6",
        "6&646j6",
        "<!<+<5<L<c<y<",
        "4'4=4I4S4`4",
        "{27A13AD2-27BC-4A08-8573-9CF3F96B1678}",
        "tif;O",
        "586D6P6i6s6|6",
        "4#4)424H4e4l4s4z4",
        "3!3.3@3N3r3",
        "  Operation (executed): %s",
        "9'9=9J9\\9d9j9s9",
        "9%9;9V9\\9f9k9u9|9",
        "7I7v7",
        "t$ hH",
        "7#7L7^7x7",
        "0 0$0<0L0P0T0X0l0p0",
        "[HKEY_LOCAL_MACHINE\\",
        "3,3>3F3L3Y3k3y3",
        "6%7O7",
        "Reg value [%ws] does not exist",
        "CreateIntermediateDirectories",
        "SETUPPLATFORMCOMM: Listening for progress messages.",
        ";(<C<^<c<",
        "nullptr != phHive",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::Insert(int,class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *)",
        "JET_wrnDatabaseAttached",
        "3 3$3(3,30343<3@3D3H3P3X3\\3d3h3l3p3t3|3",
        "6R6d6",
        "WpxGetAnswerFileType",
        "DiskLayout::VerifyPlanDiskBoundaries: The given logical partition layout exceeds the size of the extended partition",
        "pEnumExternalFilesCallback_2Can't create folder %s",
        "Number of $MFT security descriptors failed",
        "2,242<2D2L2T2\\2t2|2",
        "SmVirtDisk::Delete: Can't GetStoragePool() (0x%08x)",
        "2#202@2E2K2Q2a2f2v2{2",
        "%SYSTEMDRIVE%\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe /postsysprep",
        ".?AVCXXXXXHandledException@?OK@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "JET_errDatabaseInvalidName",
        "{BFF3C805-6587-4A85-97A0-EAD573D5493B}",
        "int __thiscall UnBCL::ArrayList<struct DiskRange>::BinarySearch(int,int,struct DiskRange,struct UnBCL::IComparer<struct DiskRange> *)",
        "=L>^>f>l>y>",
        "=0=8=>=K=]=k=",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CProfileInfo *>::MoveNext(void)",
        "%hs: Target image path: %s",
        "CSetupPlatformPrivate::Execute: Failed to execute sync commands. Error: 0x % 08X",
        "= =1=>=G=S=h=t=~=",
        "JET_errSPAvailExtCorrupted",
        "<%=<=L=R=d=u=",
        "void __thiscall UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::Remove(class CWIMBootHelper::CWIMEntryIndex *)",
        "5$5-5:5_5",
        "pFindAndAddFiles: Could not find anything matching the pattern %s",
        "SL_E_CAL_CLASS_UNKNOWN",
        "Respecialize completed; auto-start services have %sbeen started",
        "RtlAddAccessAllowedAceEx",
        "1,101H1L1d1h1",
        "?)?v?",
        ".?AU?$IList@PAV?$DictionaryEntry@_JPAVCGlobalPath@@@UnBCL@@@UnBCL@@",
        "8#9i9",
        "ERROR_EVT_FILTER_ALREADYSCOPED",
        ".?AVCRelocateOS@@",
        "SysprepSession::Execute: Unexpected exception; Stack trace:",
        "<$<0<P<X<h<",
        "CPayloadWriterT<class CEmptyType>::PreWrite",
        "1(10181D1d1p1",
        "pExtractWinREFromImage: Failed to extract winre.wim recovery image file (0x%08x)",
        "uninstallwindow is: %d",
        "<$<,<4<<<D<P<X<t<|<",
        "Failed allocation edition package identity string: %ws",
        "= =P=a=",
        "ERROR_SERVICE_NEVER_STARTED",
        "CFfuWriterAsyncT<class CSecurityHeaderWriterT<class CEmptyType>,class CImageHeaderWriterT<class CEmptyType>,class CStoreHeaderWriterT<class CEmptyType>,class CPayloadWriterT<class CEmptyType> >::PreWrite",
        "0.040:0@0F0L0R0X0^0d0v0",
        ";);7;];d;j;o;{;",
        "727H7s7~7",
        ":,;[;u;",
        "$Kernel.",
        "long __thiscall CCloseLogFiles::DoExecute(struct IExecutionContext *,void *,struct IInternalOperationsProgress *)",
        "0!0/0N0\\0p0",
        "<!<)</<<<N<\\<}<",
        "1$151B1L1[1d1j1w1}1",
        "525b5p5",
        ".?AV?$SmartPtr@VCGlobalPath@@@UnBCL@@",
        "3*333",
        "8$8/8=8e8w8",
        "Register sync process: %s with args %s",
        ";*;2;I;Y;l;s;y;~;",
        "j5j\\h0Z",
        "8 8+868J8a8x8}8",
        "3C3R3",
        "<#<.<><K<V<j<s<",
        "\\Boot\\BCD",
        "3 3(3D3H3L3P3X3t3x3|3",
        "CONTROLSET%03u\\CONTROL\\SESSION MANAGER",
        "8 8(8.8;8M8[8",
        "4(4<4E4l4",
        ".?AV?$Hashtable@W4OP_OPERATION_ID@@H@UnBCL@@",
        "SPAPI_E_WRONG_INF_STYLE",
        ".?AV?$CAutoRelease@PAUINewSystem@SetupPlatform@@@RAII@@",
        "FileSystemLabel",
        "Pass status for %s before running indicates a bad state; will still try to proceed",
        "<+<0<D<U<^<l<s<z<",
        "2*292",
        "1-141;1B1I1P1V1`1",
        "class SysprepComponent *&__thiscall UnBCL::ArrayList<class SysprepComponent *>::get_Item(int)",
        "7 7&787D7]7g7m7z7",
        "Rollback: (3) Showing splash window with restoring text: %s",
        "CUpdateBootSector::DoExecute",
        "ERROR_TRANSACTION_NOT_ROOT",
        "class CAppInfo *__thiscall UnBCL::_::ArrayListEnumerator<class CAppInfo *>::get_Current(void) const",
        "DriverVer",
        "DESCRIPTION",
        ">V>j>x>",
        "5Q5^5",
        "Failed to reduce winre entries in recovery store. Status = [%x]",
        "2(2/2=2G2L2`2m2~2",
        "JET_errUpdateNotPrepared",
        ".PAVCXXXXXHandledException@?2??DetectDefaultInstallSection@CInfFile@@KGJPBGPAVTARGET_INFO@@PAH@Z@",
        "Microsoft\\Windows\\CurrentVersion\\Setup\\OOBE",
        "8&9=9c9y9",
        ".?AV?$Array@PAVCInfFile@@@UnBCL@@",
        ":j;q;w;|;",
        "Type: %d, Id: %I64d, Volume: %s, WimPath: %s, WimIndex: %d, WIM size: %I64u, Expanded size: %I64u, Hardlinked size: %I64u",
        "timestamp",
        "CDeploymentBase::CleanupMounts: Error removing directory %s",
        "Resize",
        "RecoveryImageFolder",
        "CMigrateFramework::DoExecute: Pending updated setupcl request failed. Status = 0x%08X",
        "?$?,???F?L?Q?\\?j?r?x?",
        "BcdGetElementDataWithFlags: Failed to get registry value.Object: %ws Reg type: %lu Status: %x",
        "Hive unload failed; cancelling enumeration. GLE: %u",
        "6!606?6T6_6",
        "    Setup updates",
        "Global\\FFU_VOLUME_MUTEX",
        "1(1.1D1[1d1s1",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::Add(class UnBCL::String *,class CDriverInstallInfo *)",
        "Setting WMI Bool property %s: the property does not exist",
        "8#8.898M8b8",
        "90:B:u:",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CPartitionInfo *>::Reset(void)",
        "RecoveryPartition",
        "ERROR_NO_SUCH_PRIVILEGE",
        "SPExecuteCleanupFailure while removing file %s. Error: 0x%08X",
        "7P7T7X7d7h7l7p7t7x7|7",
        "CDUClientAppInfo::CDUClientAppInfo: Unexpected format of file version info; cannot extract branch: %s",
        "ProvisioningPackage::GetAltitude",
        "<#<0<=<M<c<~<",
        "CSetupPlatformPrivate::MoveTelemetry: Failed to move telemetry to [%s]; hr = 0x%08X",
        "void __thiscall UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *>::RemoveAt(int)",
        "<\"<:<@<R<b<o<t<}<",
        "IMAGE_STATE_UNDEPLOYABLE",
        "RollbackReinitialize in progress...",
        ".?AV?$HTDictEnumBase@V?$DictionaryEntry@PAVString@UnBCL@@PAVCSPInternalPluginData@@@UnBCL@@@_@UnBCL@@",
        "9!9&919?9F9L9Q9\\9f9y9",
        "ERROR_WMI_INVALID_REGINFO",
        "Sysprep specialize offline failed. Error: 0x%08X",
        "void __thiscall UnBCL::ArrayList<class CCFGSectionValue *>::Insert(int,class CCFGSectionValue *)",
        "7K8]8e8k8x8",
        "6!60676@6E6P6\\6b6g6{6",
        ".?AV?$CAutoRelease@PAUIPartition@SetupPlatform@@@RAII@@",
        "</<<<E<W<e<v<",
        "Element::GetAssetSize",
        "<$<.<8<B<H<U<",
        "?6?z?",
        "ERROR_LOGON_SESSION_COLLISION",
        "EventWrite",
        ";C;_;",
        "class COSPieceInfo **__thiscall UnBCL::ArrayList<class COSPieceInfo *>::GetBuffer(int)",
        "Disabling deferred services",
        "CreateCustomPartition: Failed to apply partition properties (0x%08x)",
        "919a9i9s9{9",
        ".?AVCXXXXXHandledException@?2??MakeBcdDeviceObject@CAddSafeOSBootEntry@@IAEJKPBG0PAU_GUID@@PAPAU_BCDE_DEVICE@@PAK@Z@",
        "Path=[%s] Type=[%s] and Path=[%s] Type=[%s] are different entry.",
        "wcscpy_s",
        "Marking event [&SclEvent_ProcessRegistry_Stop]",
        "BuildPath failed for %s and %s. GLE: %u",
        "FirmwareVariable",
        "Removing destination default shell folder path %s",
        "D$(PW",
        "6%6<6R6",
        "The mount path %s specified by the state store entry is no longer the mount path of this image.",
        "Removing duplicate object %wZ",
        "=#=)=6=<=A=]=i={=",
        "Uninstall validation result overwritten by environment variable. Uninstall will proceed.",
        "??2Object@UnBCL@@SGPAXII@Z",
        "9B9T9\\9b9k9",
        "2)262=2",
        "ERROR_PROCESS_MODE_ALREADY_BACKGROUND",
        "=*=F=Z=w=",
        "DiagERTerminate",
        "Bugcheck module",
        "(%lx): Error saving excluded key [%ws] to hive file [%ws]",
        "Moving folder %s to %s",
        "HARDRESERVETRACK: Hard-Reserve is turned off",
        "Failure while creating critical directories.",
        "7,747<7D7L7T7\\7d7l7t7",
        ".?AV?$CAutoCleanup@PAUtagSAFEARRAY@@@RAII@@",
        ".?AVCDriverPackageInfo@@",
        ";(;X;",
        "CreateCustomPartitions: Aborting at partition %s due to cancellation",
        "void __thiscall UnBCL::ArrayList<unsigned short *>::set_Item(int,unsigned short *)",
        "void __thiscall UnBCL::Array<class CPartitionInfo *>::RemoveAt(int)",
        "%hs: Failed to open %s. Error: 0x%08X",
        ":!;9;Q;i;",
        "xMicrosoft\\Windows\\CurrentVersion\\Reliability\\WinRE",
        "VVVVVVh",
        "Dependencies:",
        "8S9Z9p9w9",
        "Using Upgrade style progress",
        "=.=C=R=\\=a=i=p=|=",
        "30B0s0",
        ">%>,>2><>^>p>~>",
        "SVhPG",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::Resize(int,int)",
        "Error uncompressing boor manager (%s)! Last Error = %#x",
        "Disk space available: %I64u",
        "class CPartitionInfo *const &__thiscall UnBCL::ArrayList<class CPartitionInfo *>::get_Item(int) const",
        "6'646K6[6g6{6",
        "VERBOSE: MOVETRACK: Folder could not be removed. Error: 0x%08X",
        "ERROR_DS_ATT_NOT_DEF_FOR_CLASS",
        "5#52595?5D5O5\\5p5",
        ".?AV?$CAutoCleanupBase@PAVCImageInfoSet@@@RAII@@",
        "ERROR_DS_FOREST_VERSION_TOO_LOW",
        "<%<,<2<7<]<i<p<v<{<",
        ":4:<:D:P:p:x:",
        "ERROR_DS_DUPLICATE_ID_FOUND",
        "5!5I5O5a5u5",
        "%hs: Successfully removed WIM entry for %s.",
        "6/6J6",
        ".PAVCXXXXXHandledException@?2??ConfigureImageForRAMBoot@CAddSafeOSBootEntry@@IAEJPBG00H00PAU_GUID@@@Z@",
        ".?AV?$ArrayListEnumerator@PAVCAppInfo@@@_@UnBCL@@",
        ".?AU?$IList@PAVCDUPackage@@@UnBCL@@",
        "0(010:0C0L0U0^0g0p0y0",
        "  XML path: %s",
        "686M6h6}6",
        ";'<><K<z<",
        "t$ h@",
        "4$4+41464A4N4V4\\4p4}4",
        "Search attempt %d of %d",
        ">'>5>M>S>i>z>",
        ">P>h>u>",
        "CurrentPhase",
        "ProcessActionQueue",
        "ERROR_JOURNAL_NOT_ACTIVE",
        "Diagnostics data flush to disk successfully",
        ">$>(>@>D>\\>`>x>|>",
        "void __thiscall UnBCL::ArrayList<class CWIMBootData *>::QuickSort(class UnBCL::ArrayList<class CWIMBootData *> *,class UnBCL::ArrayList<class CWIMBootData *> *,int,int)",
        "595J5Q5W5\\5g5t5|5",
        "FilterGetMessage",
        "void __thiscall UnBCL::Array<enum OP_OPERATION_ID>::Remove(enum OP_OPERATION_ID)",
        "deviceid",
        "Upgrade",
        "%hs: Error while setting uninstall mark value: 0x%08X",
        "timeout",
        "RPC_S_INVALID_ASYNC_CALL",
        "7$7,7<7D7L7T7\\7d7l7t7|7",
        ".?AVCPrepareRecoveryImage@@",
        ".?AVCCreateScopedSnapshot@@",
        "9#9*949E9R9\\9k9t9z9",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@",
        "**********************************",
        "SPApplyCustomDiskConfig: Computing layout %u of %u",
        "0,0004080<0@0D0H0L0P0T0X0\\0`0h0l0p0t0x0|0",
        "576[6",
        "void __thiscall UnBCL::ArrayList<struct _GUID>::RemoveAt(int)",
        "LanguagePack",
        "3$3,343<3D3L3d3l3t3",
        "3\"4p4|4",
        "D$LPh`",
        "%hs: Internal rollback requested but it's not available in this scenario",
        ".?AVCBackupRestorePrivilegeEnabler@OSRollbackUtils@@",
        "XDependOnService",
        ".PAVCXXXXXHandledException@?EM@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "cbscore.dll",
        "class CWIMBootData *const &__thiscall UnBCL::ArrayList<class CWIMBootData *>::get_Item(int) const",
        "> >2>B>R>Y>g>x>",
        "525:5D5L5S5_5f5l5q5|5",
        "na:AttachDriveLetter",
        "DeleteFileEx: Trying to set back attributes on: %s",
        "ProvisioningPackage::CreateElement",
        "ERROR_DS_INAPPROPRIATE_AUTH",
        "pGetImageInfoFromSoftwareHive: Failed to get image state from software hive. Error: 0x%08X",
        "MoveFileW",
        "ConvertSidToStringSidW",
        ">6>D>d>",
        "=&=5=<=F=[=f=p=}=",
        "CDownloadDUUpdates::DoExecuteInternal: Failed to calculate space taken up by copy of updates. hr = 0x%x",
        "474?4F4a4h4",
        "?GetEnvironmentVar@Environment@UnBCL@@SGPAVString@2@PBV32@@Z",
        "mni-IN",
        "RPC_S_INTERFACE_NOT_EXPORTED",
        "EULA rejected",
        "<0<;<F<Q<b<i<",
        "WriteFile",
        "SVWj\\^V3",
        ";(;H;T;t;|;",
        "L$$PSV",
        "?2?I?Z?o?w?}?",
        "SVhpG",
        ".?AU?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@",
        "1#1c1s1",
        "434Z4~4",
        "3*3G3",
        "C(;C$}l3",
        "=%>E>^>",
        "FileVersion",
        "9&9[9b9h9m9x9",
        "7'7/7[7",
        "=%=0=D=R=^=r=",
        "1&2i2",
        "5/565=5C5O5c5q5",
        ":I;[;h;z;",
        ".?AV?$SerializableBase@V?$Array@PAVCCleanupEntry@CSimpleCleanup@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCCleanupEntry@CSimpleCleanup@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "=)=I=g=",
        "A(SSSSPSSQ",
        "50575V5d5x5",
        "SKIPBOOTTRACK(FIRST): Skip Boot Validator: ICB first boot apply exists and has not completed, cannot continue with First boot removal.",
        ":!;(;3;L;",
        "5 636",
        "2+32383=3H3O3c3r3",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCOSPieceInfo@@@UnBCL@@@UnBCL@@",
        "??6SerializationStream@UnBCL@@QAEAAV01@G@Z",
        "class UnBCL::String *__thiscall SysprepSession::GetArchitecture(void)",
        "D$ Xf",
        "4!4<4S4d4x4",
        "0'010G0^0e0l0w0",
        "JET_errTooManyOpenDatabases",
        "%hs: Failed to create rollback mutex. GLE = %d",
        "void __thiscall UnBCL::_::HTEnumerator<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<void *,void *> * __stdcall UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::DictionaryEntry<void *,void *> *> > const *,struct __POSITION * const &)>::Reset(void)",
        "CMigrateFramework::DoExecute: Cannot load system hive for offline OS %s. Error: 0x%08X",
        "0*0d0u0",
        "RPC_S_FP_UNDERFLOW",
        ";C;\\;o;",
        "</<6<F<M<]<d<o<",
        "0!010?0U0b0",
        "InstallSecurityTemplate: Error loading SCE DLL; Error: 0x%08lx",
        "677A7N7T7[7e7r7y7",
        "<'=1=_=f=",
        "6>7K7e7l7",
        ".PAVCXXXXXTemp@?GG@??ExecuteFailForward@CSetupPlatformPrivate@@IAEJHPAU_PROGRESS_DATA@SetupPlatform@@@Z@",
        "ERROR_DS_NO_CHECKPOINT_WITH_PDC",
        "void __thiscall UnBCL::ArrayList<struct PartitionLayoutArgs *>::Insert(int,struct PartitionLayoutArgs *)",
        ":#:1:E:U:",
        "%hs: Platform does not have servicing footprint capabilities",
        "Failed to add edition.",
        ">&>0>7>=>B>M>Y>m>v>",
        "%hs: Could not find the external storage, will fail. Error: 0x%08X",
        ".PAVCXXXXXHandledException@?5??SPSaveWinReInformation@@YGJPBGH@Z@",
        ";)<L<",
        "CMediaLayout::QueueWIMSplit: File not found: %s",
        ".PAVCXXXXXTemp@?N@??DoExecute@CFinalizeSafeOSBootRemoval@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "ERROR_PRODUCT_UNINSTALLED",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAUHKEY__@@UTableKey@?$Hashtable@PAVString@UnBCL@@PAUHKEY__@@@2@PAU3@UKeyTraits@52@$1?RetrieveValue@52@KGPAU3@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAUHKEY__@@@UnBCL@@PAUHKEY__@@UKeyTraits@23@V?$CElementTraits@PAUHKEY__@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "spCopyTelemetryFile",
        "VdsImageDisk::Initialize: VdsDisk initialization failed (0x%08x)",
        "RestoreHardlink",
        "<6===G=Z=a=k=",
        ".?AV?$Array@PAUPartitionLayoutArgs@@@UnBCL@@",
        "1!1(1;1d1",
        "=;=_=q=y=",
        "COperationQueue::DumpToLog",
        "#document",
        "0%0:0C0L0U0^0k0t0",
        "Service error control: %d",
        "7T8j8",
        ":-;->3>9>?>E>K>",
        "3<3X3_3h3m3x3",
        "CDiagnosticsHelper::SetWatsonBucketingParam",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$ArrayList@PAVCDriverDetails@@@2@@UnBCL@@@UnBCL@@",
        "8N8f8t8",
        "    Failed to assemble intermediate path string",
        "8$828;8H8f8",
        "6/696W6n6",
        "ERROR_ALLOTTED_SPACE_EXCEEDED",
        "0%000@0I0R0j0s0|0",
        "QQQQj",
        "pl]PQ",
        "?8???E?J?U?\\?p?",
        "CMigrateFramework::DoExecute: Cannot load default hive for offline OS %s. Error: 0x%08X",
        "0 0+070K0a0|0",
        "2$2,222;2Q2_2w2~2",
        "?4?<?D?L?X?x?",
        "7+70757A7N7S7X7d7t7~7",
        "ERROR_SXS_XML_E_MISSING_PAREN",
        ".PAVCXXXXXTemp@?CN@??SPFixupRelocatedFolders@@YGJPAV?$ArrayList@PAVString@UnBCL@@@UnBCL@@PAV?$ArrayList@PAVCOSPieceInfo@@@3@1PAVString@3@@Z@",
        "DiskLayout::ExecInitialize: Failed to read disk properties: 0x%08x",
        "1L2W2e2",
        "RegCreateKeyExW",
        "long __stdcall pSPCopyFile(class UnBCL::String *,class UnBCL::String *,unsigned long (__stdcall *)(union _LARGE_INTEGER,union _LARGE_INTEGER,union _LARGE_INTEGER,union _LARGE_INTEGER,unsigned long,unsigned long,void *,void *,void *),void *,void *,int,int)",
        ">\\>x>",
        "ERROR_DOMAIN_EXISTS",
        "ERROR_OBJECT_ALREADY_EXISTS",
        "RPC_S_INVALID_AUTH_IDENTITY",
        "CCreateRegistryForNewSystem::DoExecute",
        "BFSVC",
        "class COperationResult *__stdcall UnBCL::Try_Cast<classCOperationResult*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "void __thiscall UnBCL::ArrayList<class CShellFolderInfo *>::QuickSort(class UnBCL::ArrayList<class CShellFolderInfo *> *,class UnBCL::ArrayList<class CShellFolderInfo *> *,int,int)",
        "0!0'040F0~0",
        "%hs: Image Locale: %s",
        "161b1",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCCopyInfo@@@UnBCL@@@UnBCL@@",
        "606?6F6L6Q6\\6v6~6",
        "2!2=2M2S2i2",
        "ERROR_DIFFERENT_SERVICE_ACCOUNT",
        "CDeploymentProject::CreateBootableMediaDeployment: Failed to get volume from target partition (0x%08x)",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::Add(class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *)",
        "CEnableSafeOSPageFile::DoExecute: The page file at %s was already active and big enough (status: 0x%08x), no further action needed",
        "8$9O9Z9t9",
        "7!797I7O7U7i7",
        "Failed mark %S as staged.",
        "ERROR_CTX_LICENSE_CLIENT_INVALID",
        ".PAVCXXXXXTemp@?BB@??DoExecute@CInstallDUUpdatesOffline@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "$(runtime.",
        "RtlRegisterFeatureConfigurationChangeNotification",
        "0$1J1^1g1w1",
        "8!80878=8C8O8\\8a8u8|8",
        "Filter entry %s should be migrated",
        "ERROR_REDIR_PAUSED",
        "CDownloadDUUpdates::CalculateSpaceNeeded: IDUUpdate::GetWUAInterface failed. hr = 0x%x",
        "L$(VW",
        "|SYSPART|\\|DEST|\\bootspaces.dll",
        "xpSetUploadEtlFileConsentKey",
        "class COperationsValidator *__thiscall UnBCL::_::ArrayListEnumerator<class COperationsValidator *>::get_Current(void) const",
        "PRQj7h",
        "2*2:2N2V2]2c2h2s2",
        ".PAVCXXXXXTemp@?3??DoExecute@CRemoveOSUninstall@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "%hs: Failed to write string to file: %s. Error: 0x%08X",
        "8#8(8-878N8S8n8s8x8",
        "7\"7,7T7[7f7t7",
        ">#>5>A>K>\\>i>y>~>",
        ".?AV?$DefaultInstanceFactory@VCReserveDiskSpaceFirstBoot@@@UnBCL@@",
        "DefineDosDeviceW",
        "2f3~3",
        "ERROR_DRIVER_FAILED_SLEEP",
        "JET_errPageSizeMismatch",
        ";=<K<]<",
        "t*WPd",
        "j,XVPh",
        "7\"7)7?7Z7`7j7o7y7",
        "0!0A0O0X0d0p0y0",
        "fr-029",
        ": :,:8:D:P:\\:h:t:",
        "%hs: Failed to save source drive letter. Error: 0x%08X",
        "5)5:5C5\\5i5|5",
        "1&1V1",
        "base\\ntsetup\\setupplatform\\lib\\src\\exceptionhandler.cpp",
        "=!=;=H=S=X=e=r=y=",
        "pMergeTelemetryFile",
        ".?AV?$Array@PAVCDriverDetails@@@UnBCL@@",
        "ERROR_DS_OBJ_GUID_EXISTS",
        "?get_Days@TimeSpan@UnBCL@@QBEHXZ",
        ".PAVCXXXXXHandledException@?2??LogVdsStatus@@YGXXZ@",
        "8,848:8G8Y8g8y8",
        "int __thiscall OC::COCDismAdapter::GetOCsInPackage(class UnBCL::String *,class UnBCL::SmartPtr<class OC::COCCollection> &)",
        "pListenThread",
        "?WithLongPrefix@Path@UnBCL@@SGPAVString@2@PBV32@H@Z",
        "pSPBackUpServiceStartType",
        "?$?,?4?<?D?L?T?\\?d?l?t?",
        "VdsDisk::CreatePartition: Failed to create partition enumerator (0x%08x)",
        "CSetupPlatform::~CSetupPlatform",
        "Sh0%a",
        "class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::get_Item(int)",
        "ERROR_DBG_REPLY_LATER",
        "hi-IN",
        "CSetupPlatform::CreateNewSystem: Mismatched architectures: OS image is %u, platform is %u",
        "Failed to allocate memory for EVENT_TRACE_PROPERTIES pointers",
        "9&9-9K9Y9k9t9",
        "<$<0<8<\\<d<l<t<|<",
        ".?AV?$Array@PAVCMountedPathInfo@CDeploymentBase@@@UnBCL@@",
        "<+<1<G<[<h<p<",
        ">)>0>9>A>I>Y>b>k>t>}>",
        "Failed to get Snapshot Cleanup Period OneSetting, 0x%x",
        "    Failed to allocate spElementSearchPath.get()",
        "void __thiscall UnBCL::ArrayList<class CCFGSectionValue *>::set_Item(int,class CCFGSectionValue *)",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,struct HKEY__ *>,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,struct HKEY__ *> __stdcall UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,class ATL::CElementTraits<struct HKEY__ *> > const *,struct __POSITION * const &)>::Reset(void)",
        "0$0,040<0D0h0|0",
        "ERROR_IPSEC_IKE_NO_POLICY",
        "setupapi",
        "939@9O9W9",
        ".?AV?$SmartPtr@U?$IEnumerator@V?$DictionaryEntry@GH@UnBCL@@@UnBCL@@@UnBCL@@",
        ".PAVCXXXXXTemp@?3??ApplyServicingSettings@@YGXPBG000@Z@",
        "9#9.999M9Y9a9n9{9",
        "5%525V5d5n5w5",
        "j\\j|Z",
        "class UnBCL::ArrayList<class CCopyInfo *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class CCopyInfo *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "CSetupPlatform::AttachDiskImage: Can't initialize disk provisioning! Error: 0x%08X",
        "6 6$6(6,60646<6@6H6L6T6X6\\6d6l6p6t6x6|6",
        "OCLib",
        "struct UnBCL::ISerializable *__thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,&protected: static struct UnBCL::ISerializable * __stdcall UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,class ATL::CElementTraits<struct UnBCL::ISerializable *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "0 040J0i0",
        "='>.>O>V>`>t>",
        "ENTITIES",
        "RPC_S_NOT_ALL_OBJS_EXPORTED",
        "< <$<(<0<T<\\<`<d<h<p<",
        "Error deleting boot manager(%s)! Last Error = %#x",
        "cy-GB",
        "RtlDestroyEnvironment",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::Resize(int,int)",
        "am-ET",
        "7#7)7>7C7S7^7k7{7",
        ";#;(;P;W;];b;m;x;};",
        "8-858;8H8Z8s8",
        "Failed opening CanonicalData key",
        "3&3-33383C3N3f3",
        "757B7Z7e7s7",
        "CDeploymentProject::CreateBootableMediaDeployment: Failed to create partition on target disk (0x%08x)",
        "int __thiscall UnBCL::ArrayList<class DiskLayout *>::LastIndexOf(class DiskLayout *,int,int) const",
        "<,<:<H<",
        "5:5F5X5",
        ";);@;[;r;",
        "=.=I=U=|=",
        ".?AU?$IEnumerator@PAVISPPluginData@@@UnBCL@@",
        "\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\PROFILELIST",
        "Cannot get volume name for OS path. Error: 0x%08X",
        "<$<=<R<g<",
        ".?AVCOCCollection@OC@@",
        "int __thiscall UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::LastIndexOf(class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *,int,int) const",
        "7+7:7P7Y7j7y7",
        "?'?5?o?",
        "=\"=3=>=L=%?,?2?7???O?^?c?i?",
        "4$414K4",
        "Failed creating source SYSTEM hive path name %ls\\SYSTEM",
        "JET_errBadLogVersion",
        "void __thiscall UnBCL::ArrayList<class CFilterDriverInfo *>::QuickSort(class UnBCL::ArrayList<class CFilterDriverInfo *> *,class UnBCL::ArrayList<class CFilterDriverInfo *> *,int,int)",
        ";0;L;c;n;~;",
        "3A3P3W3^3q3",
        "ARP Validator",
        "3+323;3@3K3X3c3w3",
        "5+5N5\\5e5n5x5",
        "CInfFile::DetectDefaultInstallSection",
        ";!;);3;D;M;];x;",
        ".?AVCXXXXXHandledException@?BL@??GetCriticalDUPackageInformation@CNewSystem@@UAEJKPAPAUIDUPackageCollection@SetupPlatform@@@Z@",
        "9.9A9N9[9r9",
        "5\"5(525<5T5k5",
        "6=7i7",
        "tff;}",
        "SmDiskPartitionEnumerator::Initialize: Couldn't start enumerating (0x%08x)",
        "0$0,040<0D0T0d0l0t0|0",
        "9$939=9M9T9k9w9",
        "Set reg key value failed: 0x%x",
        "727`7q7",
        "CBS_E_SOURCE_MISSING_FROM_3RD_PARTY_EXPRESS",
        "5'5-5A5J5Y5o5v5",
        ".?AV?$HTDictEnumBase@PAUIVdsVDisk@@@_@UnBCL@@",
        "=,>B>",
        "=&=3=@=J=",
        "7!737D7K7a7|7",
        "6\"626B6J6i6p6v6{6",
        "?GetCallingModule@SerializationStream@UnBCL@@SGPAUHINSTANCE__@@XZ",
        "< <$<,<0<4<<<@<D<L<P<T<X<\\<`<d<h<l<p<t<x<|<",
        "ParseManifestEx",
        "Rollback will attempt to retry the boot operation.",
        ".?AV?$CAutoUnBCLFree@PBG@RAII@@",
        "class COperationInfo *const *__thiscall UnBCL::ArrayList<class COperationInfo *>::GetBuffer(int) const",
        "Failed allocating ui handler",
        ">)>h>v>",
        ".PAVCXXXXXTemp@?BF@??DoExecute@CMigrateFramework@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "4$4,444T4d4l4t4|4",
        "Persisting diagnostics data for future upload ",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,long> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::get_Item(int)",
        ":0:5:A:e:j:v:",
        "8 9-9?9G9M9Z9l9z9",
        "Install permanent package: %S",
        "void __thiscall UnBCL::ArrayList<enum OP_EXECUTION_PHASE>::RemoveAt(int)",
        "SecondBootPostOOBEStartTime",
        "WriteChunkedRegion",
        "6\"6(6-686F6N6X6`6f6z6",
        "SL_E_MISMATCHED_PRODUCT_SKU",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CDeploymentBase *>::MoveNext(void)",
        "ERROR_MEMBERS_PRIMARY_GROUP",
        "8G8L8Z8k8r8x8}8",
        "class CDeviceIdDatabase::CDeviceInfoData *&__thiscall UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *>::get_Item(int)",
        "?/?E?L?^?o?|?",
        "4%4+404<4G4[4c4s4",
        "GptType",
        "Failed opening target SYSTEM hive %ls",
        ".?AV?$CAutoCleanupBase@PAUITelemetry@@@Mig@@",
        "8#9L9p9|9",
        "8%9*969v9",
        "Cluster size (%llu) is larger than block size (%d) which is not supported",
        "1\"131@1E1R1Z1j1q1w1|1",
        "ERROR_IPSEC_IKE_PROCESS_ERR",
        "void __thiscall UnBCL::ArrayList<class COSPieceInfo *>::RemoveAt(int)",
        "class CSPInternalPluginData *__thiscall UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::get_Item(class UnBCL::String *) const",
        "SL_E_SLP_MISSING_SLP_MARKER",
        "void __thiscall UnBCL::ArrayList<class SysprepComponent *>::CopyTo(class UnBCL::Array<class SysprepComponent *> *,int) const",
        "686\\6x6",
        "|%s|%d|%I64d",
        "HKEY_",
        "2(212:2C2L2U2f2x2",
        "DeviceLayout.xsd",
        ":4:Y:i:",
        "SPFindSnapshotProp: Failed to set backup state. Error: 0x%08X",
        "CSysprepSpecializeOffline::DoExecute: Cannot set RespecializePending value in registry. Error: 0x%08X",
        ":,:4:?:O:V:\\:a:l:v:",
        "2$252>2S2e2{2",
        "Failed to move [%s] to Scratch Reserve. hr = 0x%x",
        "SetVolumeLabelW",
        "void __thiscall UnBCL::ArrayList<class CFailForwardSystem *>::Resize(int,int)",
        "ERROR_DEBUG_ATTACH_FAILED",
        ".?AV?$SmartPtr@U?$IEnumerator@UDISK_SPACE_IMPACT@@@UnBCL@@@UnBCL@@",
        "7 7-7?7G7M7Z7l7",
        ":\":0:f:",
        "ERROR_RESOURCE_NOT_ONLINE",
        "5'51585D5I5T5`5f5z5",
        "6+616;6@6J6Q6_6q6",
        "5!6A6_6v6",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class ISPPluginData *>::Reset(void)",
        "Failed to convert current time to FILETIME. Error: 0x%08X",
        "JET_errPreviousVersion",
        ".?AVCOperationQueue@@",
        ".PAVCXXXXXHandledException@?DP@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "8$9?9Q9",
        "1 1(141T1\\1h1",
        "%Microsoft Windows Production PCA 2011",
        "9*949H9`9",
        "  Decision for the driver package so far: %s",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCImageInfo@@@UnBCL@@@UnBCL@@",
        ">.>7>R>n>x>",
        "CDeploymentProject::CreateVHDDeployment: Failed to get image info set. Error: 0x%08X",
        "JET_wrnSeparateLongValue",
        "8$808<8H8T8`8l8x8",
        "1F1]1x1",
        "3'3/363L3`3t3",
        ".?AU?$ICollection@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::Resize(int,int)",
        "252<2J2Z2_2d2x2",
        ".?AV?$ArrayList@PAVCShellFolderInfo@@@UnBCL@@",
        ":):7:=:Q:h:",
        "GetAnswerFileContentsAsUnattend: Failed to create IWpxWriteOpt: 0x%08x",
        ".?AV?$CAutoCleanupBase@PAUIWpxIssueList@@@RAII@@",
        "t:9L$",
        ".?AV?$SmartPtr@V?$Hashtable@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@UnBCL@@@UnBCL@@",
        "SVh0[",
        "9#919?9u9",
        "CommonSettings",
        "Failed to shred identity.",
        "CMediaLayout::QueueAuditScript: Failed to write media-relative audit mode payload path to automation: 0x%08x",
        "Failed to suspend WIMBoot entry. Error: 0x%08X",
        "ERROR_DS_ADMIN_LIMIT_EXCEEDED",
        "ERROR_CLUSTER_INVALID_STRING_FORMAT",
        ".?AV?$KeyCollection@PAVString@UnBCL@@W4ActionType@@@_@UnBCL@@",
        "tzm-Tfng",
        "9!9.9@9N9r9",
        "5$5<5D5Q5h5x5",
        "int __thiscall UnBCL::ArrayList<struct UnBCL::ISerializable *>::BinarySearch(int,int,struct UnBCL::ISerializable *,struct UnBCL::IComparer<struct UnBCL::ISerializable *> *)",
        "FreeSpaceReportPhase",
        ">*>6>>>D>J>O>T>Z>d>k>q>v>",
        "unsigned long __thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,unsigned long,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,&protected: static unsigned long __stdcall UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsVDisk *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "GetSizeOfWinRE",
        "SmPartition::SetType: Unknown partition type %u",
        "\\DOSDEVICES\\",
        "Failed to create HKLM\\SYSTEM\\ControlSet001\\Control\\ProductOptions key",
        "> >'>->9>E>y>",
        "void __thiscall UnBCL::ArrayList<class CCFGSectionValue *>::CopyTo(class UnBCL::Array<class CCFGSectionValue *> *,int) const",
        "int __thiscall UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *>::BinarySearch(int,int,class CSimpleCleanup::CCleanupEntry *,struct UnBCL::IComparer<class CSimpleCleanup::CCleanupEntry *> *)",
        "5 5(585D5L5t5|5",
        "CDownloadDUUpdates::FilterUpdates: IWindowsDriverUpdate::get_DriverVerDate failed. hr = 0x%x",
        "<5<=<J<e<}<",
        "void __thiscall UnBCL::Array<struct PageFileDesc *>::Remove(struct PageFileDesc *)",
        "1$1,141<1L1d1l1t1|1",
        "Scratch space %s is on the same volume with the installation.",
        "There is no key under Snapshot Registry key, remove task",
        "MIG_MANIFESTS_DIR",
        "/na:DeviceLayout",
        " /UploadEtlFilesOnly",
        "JET_errBackupDirectoryNotEmpty",
        "3+3<3C3_3f3l3x3",
        "<not present>",
        "void __thiscall UnBCL::ArrayList<unsigned long>::Resize(int,int)",
        "void __thiscall OSRollbackService::CCheckpointImpressario::WriteCheckpoint(const unsigned short *,const unsigned short *)",
        "Hard-link Component Store from old windows",
        ".?AVCXXXXXHandledException@?OD@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "AdjustTokenPrivileges",
        "class UnBCL::String *__stdcall SPGetConfigValueFromGlobalPath(class CGlobalPath *)",
        "Failed to allocate heap space for bugcheck frames! Aborting...",
        "8$8B8G8^8j8x8",
        ".?AV?$SerializableBase@VCSavePageFileSettings@@$0A@V?$DefaultInstanceFactory@VCSavePageFileSettings@@@UnBCL@@@UnBCL@@",
        "ERROR_DEPENDENCY_NOT_FOUND",
        "pLogWimMountInfo",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::get_Current(void) const",
        "yEVhJ",
        "quz-PE",
        "UsableLength",
        "void __thiscall UnBCL::ArrayList<struct DiskMatchFilter>::RemoveAt(int)",
        "ERROR_PRINT_MONITOR_IN_USE",
        "8*878J8W8c8t8{8",
        ".?AV?$SerializableBase@VCLPValidator@@$0A@V?$DefaultInstanceFactory@VCLPValidator@@@UnBCL@@@UnBCL@@",
        "GetWindowTextW",
        "RemoveWindowsOld",
        "class CBcdSettings *__stdcall UnBCL::Try_Cast<classCBcdSettings*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "5 5A5R5^5j5v5",
        "ERROR_EVT_FILTER_UNSUPPORTEDOP",
        "int __thiscall UnBCL::Array<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::Add(struct SPGetPartitionOrdinal::PartitionInfo)",
        "6'7C7S7c7s7",
        "3.3<3W3a3k3q3",
        "jdj2S",
        "=3=G=",
        "int __thiscall CWIMBootHelper::CWIMEntryIndex::Equals(const class UnBCL::Object *) const",
        ":(:3:>:K:Y:l:z:",
        "CSetupPlatformCheckpoint::CopyConfigFiles: An error occurred while processing config files",
        "CDeploymentProject::CreateFolderDeployment: Failed to get image info set. Error: 0x%08X",
        "SkipZDP",
        "Install Driver Dynamic Updates",
        "? ?-?<?E?M?W?g?t?}?",
        "3 373E3V3w3",
        "%hs: Failed to remove source recovery WIM file %s. Error: 0x%08X",
        "Failed to create splash window Error: 0x%08X",
        "6 6+656D6]6d6k6w6",
        "Running in [%s] mode.",
        "<&<2<~<",
        "uPVV9",
        "7O8h8o8v8}8",
        "Setup10",
        "9'949D9P9X9]9q9",
        "Failed to clear system store flag. Status: %x",
        "class UnBCL::String *__thiscall CDeploymentBase::GetStoredPath(class UnBCL::String *)",
        "1G1k1w1",
        "class CSimpleCleanup::CCleanupEntry *const &__thiscall UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *>::get_Item(int) const",
        "CNewSystem::QueueRegisterSyncProcess",
        "void __thiscall UnBCL::Array<class CFileCreationData *>::Insert(int,class CFileCreationData *)",
        "9\"9.959;9@9K9V9j9z9",
        "595E5S5",
        "CReconstructOS::ReconstructWindows: Unknown target version: %u",
        ";,;<;L;\\;l;|;",
        "gsw-FR",
        "ERROR_CLUSTER_RESOURCE_PROVIDER_FAILED",
        "3%3C3S3",
        "363H3V3d3r3",
        "?7?D?c?k?",
        "ERROR_DS_PDC_OPERATION_IN_PROGRESS",
        "CMediaLayout::QueueAuditScript: Couldn't get file attributes for %s: 0x%08x. Does the path exist?",
        ".?AVCARPValidator@@",
        "class CImageInfo *__thiscall UnBCL::_::ArrayListEnumerator<class CImageInfo *>::get_Current(void) const",
        "7#777D7N7b7k7",
        "ERROR_SYSTEM_IMAGE_BAD_SIGNATURE",
        "NewStoreRoot",
        "ERROR_DS_DRA_SOURCE_DISABLED",
        "CMediaLayout::QueueAuditScript: Audit mode script directory %s is empty (FindFirstFile=0x%08x)",
        "{EBD23614-6C3E-4E05-AFA4-DC0149816745}",
        "2$2@2G2M2Y2e2",
        ":-:;:R:h:",
        "int __thiscall UnBCL::ArrayList<class CAppInfo *>::IndexOf(class CAppInfo *,int,int) const",
        "CSetupPlatformInfo::SetCapabilities",
        "VdsVolume::Format: Couldn't query format support information for volume (0x%08x)",
        "`0e0w0",
        "SPRemoveScheduledTaskFailed to initialize COM. Error: 0x%08X",
        "?EndsWith@String@UnBCL@@QBEHG@Z",
        "5(505H5T5\\5x5",
        "RestoreMountDirectory",
        "5B5K5{5",
        "long __stdcall CDeploymentBase::BackupMounts(const unsigned short *,class UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *> *)",
        "525Z5a5g5l5w5~5",
        "tCj\\P",
        ".?AU?$ICollection@PAVCDriverDetails@@@UnBCL@@",
        "VdsDiskPartitionEnumerator::Initialize: Couldn't query disk extents (0x%08x)",
        ";*;8;F;",
        "CProcessDrivers::ProcessDriverInstallation",
        "Failed to get snapshot install time. Error: 0x%08X",
        "int __thiscall UnBCL::ArrayList<struct DiskLayout::Partition>::LastIndexOf(struct DiskLayout::Partition,int,int) const",
        "FX;GXu",
        "UuidFromStringW",
        "<\"<8<M<U<\\<f<|<",
        "void __thiscall UnBCL::ArrayList<struct DiskMatchFilter>::set_Item(int,struct DiskMatchFilter)",
        "CompareStringOrdinal",
        "2.2<2I2[2c2i2v2",
        ".CRT$XCA",
        "void __thiscall UnBCL::Array<class CInfFile *>::InitLarva(class UnBCL::ArrayList<class CInfFile *> *)",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCShellFolderInfo@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCShellFolderInfo@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "8'8?8I8`8g8t8",
        "Apply (first boot apply, online phase): Migration phase failed. Result: %d, no specific error",
        "SPAPI_E_NO_ASSOCIATED_CLASS",
        ";I;l;",
        "DWORD registry value malformed",
        "?*?C?g?",
        "Failed to open system store. Status: %x",
        "SetFilePointer",
        "  Category IDs:",
        "ERROR_LOG_METADATA_CORRUPT",
        "3R4`4v4",
        "?%?2?G?O?U?j?y?",
        "7&717m7r7",
        "CCreateScopedSnapshot::DoExecute: Error while setting uninstall mark value: 0x%08X",
        "FOD Validator",
        ".?AU?$ICollection@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@",
        "D$`j ",
        ":#:G:",
        "7?7V7l7",
        "Failed to add WinRE entry. Status = [%x]",
        "3$323C3N3b3m3",
        "3 3.3<3J3",
        "upgrade",
        "<&<4<H<^<q<",
        "GetAnswerFileContentsAsUnattend: Failed to get answer file type: 0x%08x",
        "0 0$0(0,0004080<0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "%hs: Removing uninstall data failed with error 0x%08X",
        "class CProfileInfo *__thiscall UnBCL::_::ArrayListEnumerator<class CProfileInfo *>::get_Current(void) const",
        "CSuspendBitlocker::DoExecute: Fatal error checking whether protection is active for OS %s: 0x%08x",
        "ERROR_DS_DRA_SHUTDOWN",
        "ERROR_DHCP_ADDRESS_CONFLICT",
        "%hs: Error in %s of %s. GLE [%d]",
        "8,989\\9h9",
        "%3d|%-80s|%-7s |%19s|%19s|%8s|%18I64d|%18s|%17s|%20I64d|%20s|%19s|%17s|%-38s",
        "void __thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,class UnBCL::DictionaryEntry<unsigned long,struct IVdsDisk *>,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<unsigned long,struct IVdsDisk *> __stdcall UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsDisk *> > const *,struct __POSITION * const &)>::Reset(void)",
        ";,;4;<;D;L;T;\\;d;l;t;",
        ".?AV?$DefaultInstanceFactory@VCPrepareSafeOSBootRemoval@@@UnBCL@@",
        "0$060R0h0",
        "y0Vh/",
        "Using source OS version %I64x",
        "9V9_9g9w9",
        "\\SysArm32",
        ".?AVCXXXXXHandledException@?2??SPGetFileOpenedByPIDs@@YGPAV?$ArrayList@K@UnBCL@@PBG@Z@",
        "ERROR_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE",
        ":0:9:E:O:X:{:",
        "\\*[*]",
        "%hs: SetUninstallWindow setting default window: %d",
        "(%lx): Failed to query object security!",
        "ReparsePointProcessCount",
        "ERROR_QUOTA_LIST_INCONSISTENT",
        "tHVVVVh \"",
        "9;9B9p9",
        "1 1$1(1,1014181@1D1H1L1P1T1\\1`1d1l1t1x1|1",
        "const __int64 *__thiscall UnBCL::ArrayList<__int64>::GetBuffer(int) const",
        "base\\ntsetup\\migration\\setup\\oc\\lib\\src\\oc.cpp",
        ": :(:0:<:\\:d:l:x:",
        "5;6Q6",
        "RtlCompareMemory",
        "RegDeleteKeyW",
        "void __thiscall UnBCL::ArrayList<class CCopyInfo *>::Resize(int,int)",
        "void __thiscall UnBCL::Array<class CBasicEnvEntry *>::RemoveAt(int)",
        ";8;?;E;J;V;c;h;|;",
        "CRYPT_E_ASN1_PDU_TYPE",
        "                                   Name: %s, Path: %s, Timestamp: %s, State: %d",
        "5*545G5U5r5y5",
        ".?AV?$HTDictEnumBase@PAUISerializable@UnBCL@@@_@UnBCL@@",
        "9$9,949<9D9L9T9l9t9|9",
        "4\"4I4",
        "Service type: %d",
        "9 999E9L9R9W9c9n9w9}9",
        "\\ArcName\\",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::Add(class UnBCL::String *,struct UnBCL::ISerializable *)",
        "ERROR_NOINTERFACE",
        "7 8G8",
        "3$3(383<3@3D3H3L3T3X3\\3`3d3h3l3p3t3x3|3",
        "j\\XPR",
        "CSetupAutomation::SuspendAndRelease: Disk platform not available.",
        "CReconstructOS::DoExecute: Servicing stack failed to reconstruct OS: 0x%08x",
        "CRYPT_E_UNEXPECTED_MSG_TYPE",
        ".PAVCXXXXXTemp@?CIP@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "%hs: %s [%s] is already present, we were asked to not overwrite",
        "7,7:7H7",
        "596Z6a6u6",
        "t|Vh`",
        "8,808@8D8T8X8h8l8|8",
        "DismCloseSession",
        "1$141A1[1b1h1m1x1",
        "1\"1K1^1r1~1",
        "7$767D7V7y7",
        ".?AV?$CAutoRelease@PAUIMigUser@@@Mig@@",
        ".?AVCEmptyOperation@@",
        ".PAVArgumentNullException@UnBCL@@",
        "class COSPieceInfo *const &__thiscall UnBCL::ArrayList<class COSPieceInfo *>::get_Item(int) const",
        "Cannot remove WIM Boot entries. Current WIM Boot data is NULL",
        "=!>x>",
        "\\ntdll.dll",
        "?Concat@String@UnBCL@@SGPAV12@PBG00@Z",
        "7)8?8N8",
        "1.1@1U1y1",
        "6#7=7O7i7{7",
        "jaYf;",
        ".PAVCXXXXXHandledException@?2??DoExecute@CUpdateBootCode@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "FveDeleteAuthMethod",
        "=-=;=j=",
        "<;<a<k<r<x<}<",
        "CReconstructOS::DoExecute",
        "SPCopySetupPlatform: Failure while generating the list of files and folders to copy. Error: 0x%08X",
        "u'h|'",
        "061g1",
        "Failed adding element to cbs array",
        ":#;<;O;h;};",
        "Failed to delete external file.",
        "383k3",
        "=$=`=",
        "848I8j8",
        "FfuCaptureInternal",
        "LogDirectory",
        "Failed enumerating registry values",
        "int __thiscall UnBCL::Array<class COperationsValidator *>::Add(class COperationsValidator *)",
        ";$;,;4;@;`;h;p;|;",
        "6'6A6S6Z6`6e6p6}6",
        "2 2D2d2n2",
        "%hs: Creating file verifier, windir: %s",
        "Translate",
        ";$;0;<;D;`;g;m;s;",
        "0'0.0>0E0f0o0z0",
        "=(=<=P=W=]=b=m=x=",
        "class CImageInfoSet *__stdcall UnBCL::Try_Cast<classCImageInfoSet*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "4'434?4L4Y4e4r4~4",
        "s.vhd",
        "?#?)?/???P?]?h?q?y?",
        "Param4",
        "8 8$8(8,8084888<8@8H8L8P8T8X8\\8d8h8l8t8|8",
        "<*<3<D<M<^<g<x<",
        "{DF97F82A-13F9-4B1F-B09A-82C7E881543E}",
        "=,=<=H=O=W=g=",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::GetBuffer(int) const",
        "jRj)jMj",
        ":5:R:",
        ".?AVCCompleteFileOps@@",
        "%hs: Failed to set registry key %s. hr = 0x%08X",
        "<&<1<=<D<J<O<Z<g<p<v<",
        "ERROR_SERVER_NOT_DISABLED",
        "1O1]1~1",
        "6@6s6",
        ".?AV?$SerializableBase@VCBool@@$0A@V?$DefaultInstanceFactory@VCBool@@@UnBCL@@@UnBCL@@",
        "class CGlobalPathFindData *__thiscall UnBCL::_::ArrayListEnumerator<class CGlobalPathFindData *>::get_Current(void) const",
        "2$202P2X2`2l2",
        "6!6&61686=6Q6",
        "=0=i=",
        "7.7I7O7Y7^7h7o7}7",
        "VdsPlatformDiskEnumerator::GetNext: Failed to get disk interface from VDisk (0x%08x)",
        ">,>A>`>l>",
        "ERROR_NONPAGED_SYSTEM_RESOURCES",
        "?3?m?",
        ".?AV?$ArrayListEnumerator@PAVCDUPackage@@@_@UnBCL@@",
        ".?AUIPartition@SetupPlatform@@",
        "5!5(5e5l5r5w5",
        "5 5-525=5U5\\5n5",
        ">#>)>.>9>@>T>c>x>",
        "444]4g4w4",
        "wcstoul",
        ".?AVCXXXXXHandledException@?2??CallPidGenX@@YGJPBG000PAUDIGITALPID2@@PAUDIGITALPID3@@PAUDIGITALPID4@@@Z@",
        "Element::CreateElement",
        "5$5,545<5D5L5T5\\5d5l5t5",
        "__thiscall UnBCL::ArrayList<struct PageFileDesc *>::ArrayList(const struct UnBCL::ICollection<struct PageFileDesc *> *)",
        "SP_ENV_LOW_DISK_SPACE_WATERMARK",
        "void __thiscall UnBCL::ArrayList<class CFilterDriverInfo *>::AddRange(const struct UnBCL::ICollection<class CFilterDriverInfo *> *)",
        ">$>,>4>@>H>`>h>",
        "202C2J2P2U2`2j2}2",
        "?GetParentPath@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        ".PAVCXXXXXTemp@?BD@??QueueDriverInstallation@CNewSystem@@UAEJPBGW4SP_ERROR_HANDLING@SetupPlatform@@@Z@",
        "pDeleteTempCleanupFiles",
        "?%?H?T?`?",
        "8$8(8,80888<8D8H8L8T8\\8d8h8l8t8|8",
        "=,=0=L=P=l=p=",
        "Session Finalized, ID: %S",
        "CMediaLayout::Initialize: Failed to query install iamge index: 0x%08x",
        "void __thiscall UnBCL::Array<struct SetupPlatform::IPartition *>::RemoveAt(int)",
        "%hs: DUShutdown failed. hr = 0x%x",
        "JET_errCannotBeTagged",
        "4#4)4S4Y4_4e4k4",
        "JET_errNullInvalid",
        "CSetupAutomation::Resurrect: Failed to retrieve settings object from configuration: 0x%08x",
        ":(:/:5:::E:P:d:r:",
        "4+4J4a4t4{4",
        "PSFX_E_MATCHING_COMPONENT_DIRECTORY_MISSING",
        ">$>,>4>L>T>\\>d>l>t>|>",
        "<\"<K<Y<f<",
        "  %s: %u-%02u-%02u %02u:%02u:%02u.%03u",
        ".PAVCXXXXXTemp@?6??Finalize@CDeploymentBase@@QAE?AW4SYSTEM_STATE@SetupPlatform@@PAUIOperationsProgress@4@H@Z@",
        "ERROR_IPSEC_IKE_QUEUE_DROP_NO_MM",
        "GlobalFree",
        "031:1@1E1P1Z1_1s1",
        "void __thiscall UnBCL::ArrayList<struct DISK_SPACE_IMPACT>::QuickSort(class UnBCL::ArrayList<struct DISK_SPACE_IMPACT> *,class UnBCL::ArrayList<struct DISK_SPACE_IMPACT> *,int,int)",
        "void __thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,unsigned long,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,&protected: static unsigned long __stdcall UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsDisk *> > const *,struct __POSITION * const &)>::Reset(void)",
        ".PAVCXXXXXTemp@?BB@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$Array@E@2@@UnBCL@@@UnBCL@@",
        ".idata$6",
        "889J9R9X9e9w9",
        "CTrustSafeOSBootCommand::DoExecute: Failed to hash %s: 0x08x",
        "=,=8=G=P=Y=g=n=x=",
        "6 6(6,6064686H6P6l6p6t6x6|6",
        "Downlevel",
        "WIM_MetaData_Queue_Length",
        "dMICROSOFT\\WINDOWS NT\\CURRENTVERSION",
        "1(252M2",
        "9.9:9F9V9`9g9m9r9~9",
        "joZf9T0",
        ">*>/>:>V>s>",
        "1 1&1+161@1S1a1m1r1",
        "Element::LinkPayload",
        "SPFindSnapshotProp: Failed to initialize VSS for backup. Error: 0x%08X",
        "Failed to set boot entry order. Status: %x",
        "DiskLayout::Execute: Failed to read existing partitions from target disk (0x%08x)",
        "pSPSopeDirectoryCallBack",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::get_Item(int)",
        "7+7L7g7m7z7",
        "ERROR_ABANDONED_WAIT_63",
        "Compression time = %lld ms",
        "0?0T0]0s0",
        "MIG_UPGRADE_OPTIMIZE_GAC_MIGRATION",
        "?,?2?X?g?t?",
        "8#8,878|8",
        ";&;<;D;K;W;h;|;",
        ".?AU?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@W4ActionType@@@UnBCL@@@UnBCL@@",
        "=0===E=]=c=u=",
        "BufferSize",
        "4$4+4",
        "='=.=4=9=E=M=a=r=",
        "DismShutdown",
        "4 4'4-494M4[4i4w4",
        ";);=;F;N;o;v;|;",
        "4(4?4G4",
        "class CInfFile *__thiscall UnBCL::_::ArrayListEnumerator<class CInfFile *>::get_Current(void) const",
        "There is already a running setup user mode etw session!",
        "Onesettings: Failed to initialize onesettings: 0x%x",
        "6#6>6O6U6[6j6",
        "UpdateBootCode:Laying down NT Boot code. Drive = %c:",
        "0%030=0G0T0b0o0}0",
        ">9>R>",
        "6*6J6p6",
        "force-",
        "?+?K?R?]?",
        "null key to Hashtable#ContainsKey()",
        "SmVolume::ReadAllocUnit: Can't query filesystem info of %s (0x%08x)",
        "G0PjvV",
        "7)7E7\\7{7",
        "CSetBusParams::Apply",
        "0&0/0H0O0V0\\0h0|0",
        ".?AVCGenericExecutionContext@@",
        ".?AV?$CAutoCleanupBase@PAUIElement@@@RAII@@",
        "SPFindFirmwareBootDisk: Couldn't get firmware boot disk number (0x%08x)",
        "void __thiscall UnBCL::ArrayList<class CInfFile *>::AddRange(const struct UnBCL::ICollection<class CInfFile *> *)",
        ":0;X;",
        "    Reset clear out of range",
        "Failed to clean up references to %s. Status: %x",
        "%hs: User iterator could not be instantiated.",
        "LP Validator: Add installed language package [%s] to list",
        "ERROR_IO_PRIVILEGE_FAILED",
        "2(282[2r2",
        "CSetupAutomation::GetDriveLetter: The specified disk doesn't not have a partition #%u",
        "8$8,8<8D8T8\\8d8l8|8",
        "        GAC: %d",
        ".?AUIElementEnumerator@@",
        "SYSTEM\\ControlSet001\\Control\\WMI\\GlobalLogger",
        "<)<N<b<v<",
        "6(7@7G7N7T7a7v7",
        "void __thiscall UnBCL::ArrayList<class CCopyInfo *>::Insert(int,class CCopyInfo *)",
        "RPC_X_PIPE_DISCIPLINE_ERROR",
        "PolicyManager_FreeGetPolicyData",
        "5:5I5X5a5k5t5~5",
        ".PAVCXXXXXHandledException@?2??pSPSetSnapshotInfoToNewOS@@YGJPAVString@UnBCL@@PAUHKEY__@@U_FILETIME@@PAUITelemetry@@@Z@",
        "Querying snapshot [%s]",
        "System",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CBasicEnvEntry *>::MoveNext(void)",
        "f9^`u",
        "040;0A0F0Q0[0`0t0|0",
        "=,=<=L=\\=l=|=",
        "Failed to delete duplicate loader object. Status = [%x]",
        "?$?*?0?6?<?B?H?N?T?Z?`?f?l?r?x?~?",
        "KB Article ID's:",
        "ERROR_DS_LOCAL_MEMBER_OF_LOCAL_ONLY",
        "WTSAPI32.dll",
        "5%5>5E5K5P5[5i5q5w5",
        "<0<7<=<I<U<",
        "Resources",
        "Failed to add prefix to file path.",
        "OC::CCryptoUtil::IsFileMicrosoftTrusted: Error getting Provider Signer from Chain",
        "j\\Xf;",
        ">\">(>2><>P>f>",
        "6!666M6]6e6l6y6",
        "HWCOMPAT.dll",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::Insert(int,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *)",
        "6)6J6a6r6",
        "6$6.6H6O6V6a6o6w6}6",
        "969]9o9v9|9",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long>,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> __stdcall UnBCL::Hashtable<class UnBCL::String *,unsigned long>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,class ATL::CElementTraits<unsigned long> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,unsigned long> *,class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> > *,int)",
        "3 3(31373K3Q3W3y3",
        "SmDisk::CreatePartition: Can't allocate partition (0x%08x)",
        ".?AVCNGenCleanup@@",
        "    ERRORS:",
        ".?AU?$IEnumerable@PAVCOperationsValidator@@@UnBCL@@",
        "4X4j4r4x4",
        "CBS_E_3RD_PARTY_MISSING_PACKAGE_MAPPING_INDEX",
        "2\"32393?3D3O3Y3l3y3",
        "8#828A8P8_8n8}8",
        "unsigned int &__thiscall UnBCL::ArrayList<unsigned int>::get_Item(int)",
        "pShouldItemBeMerged",
        "jRj_jbj",
        "jlYf9L0",
        "class COperationResult *__thiscall UnBCL::_::ArrayListEnumerator<class COperationResult *>::get_Current(void) const",
        "D$$PV",
        "999g9n9t9y9",
        "1#1)1/151",
        "2-272A2K2U2l2z2",
        "tAQh\\",
        "O:%sG:%sD:P(A;CI;GA;;;%s)(A;;0x1201bf;;;SY)(A;IOCIOI;GA;;;SY)(A;;0x1201bf;;;BA)(A;IOCIOI;GA;;;BA)(A;CIOI;GRGX;;;BU)(A;OICIIO;GA;;;CO)",
        "FilterReplyMessage",
        "SL_E_PKEY_INVALID_KEYCHANGE2",
        ":%:*:>:L:b:y:",
        "0(0H0R0o0~0",
        "`V@Pj",
        "8&808A8N8X8g8p8v8",
        "CNewSystem::QueueAddProvisioningPackage",
        ".PAVCXXXXXHandledException@?2??SetRegDWORD@@YGJPAVString@UnBCL@@000K@Z@",
        "5$5L5W5m5",
        "CDeploymentProject::CreateVHDDeployment: Failed to execute current operations of the system. Error: 0x%08X",
        "my-MM",
        "> ?Y?r?",
        "0!0+000H0[0}0",
        "<3<t<",
        "%hs: Failed to retrieve the size of BCDE_BOOTMGR_TYPE_DISPLAY_ORDER field. Status = %d",
        "PayloadEnumerator::GetNextPayload",
        "?B?R?w?",
        "class CCFGSectionValue *&__thiscall UnBCL::ArrayList<class CCFGSectionValue *>::get_Item(int)",
        "|$L!\\$",
        ".?AVCXXXXXHandledException@?CD@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "6\"626n6",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@XZ",
        "3Y3^3d3k3z3",
        "ERROR_MCA_MONITOR_VIOLATES_MCCS_SPECIFICATION",
        "unsigned short **__thiscall UnBCL::ArrayList<unsigned short *>::GetBuffer(int)",
        "?set_Item@?$Array@E@UnBCL@@UAEXHE@Z",
        "Soft ",
        "_GetUninstallInterface",
        "3G3g3t3",
        "MigLog.xml",
        "DISKSPACEQUERY: Final disk space needed estimate: %I64d",
        "CSetupAutomation::SetImageInfoSet: Argument must be a WIM image info set with at least one image",
        "9,919b9",
        ".?AV?$ArrayListEnumerator@PAVCPartitionInfo@@@_@UnBCL@@",
        "2 303:3",
        "ERROR_DEBUGGER_INACTIVE",
        "4 40444D4H4X4\\4l4p4",
        "CSIDL_DESKTOP",
        "SPGetMemoryLoad: Failed to query memory status: 0x%08x",
        "PPPPPPj",
        "9;:T:",
        "Successfully read Cleanup Upgrade snapshot from Onesetting: %s",
        ".?AU?$IEnumerable@E@UnBCL@@",
        ".?AV?$ArrayList@PAVCBasicEnvEntry@@@UnBCL@@",
        "\\$$PSSS",
        "4 6h7",
        "SPGetFootprintCapabilities: Could not find footprint folder %s",
        "%s:(%d)",
        ".?AU?$IEnumerator@PAVCCleanupEntry@CSimpleCleanup@@@UnBCL@@",
        "565=5C5H5S5g5{5",
        ".?AV?$HTEnumerator@KPAUIVdsDisk@@UTableKey@?$Hashtable@KPAUIVdsDisk@@@UnBCL@@KUKeyTraits@34@$1?RetrieveKey@34@KGKPBV?$CAtlMap@UTableKey@?$Hashtable@KPAUIVdsDisk@@@UnBCL@@PAUIVdsDisk@@UKeyTraits@23@V?$CElementTraits@PAUIVdsDisk@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "3+3C3O3[3g3~3",
        "OC::COnlineOCManager::GetOCStatus",
        "t$<h89",
        "7+7C7V7b7o7{7",
        "1A1o1",
        "ERROR_PRINTER_DRIVER_BLOCKED",
        "ERROR_DOMAIN_CONTROLLER_EXISTS",
        "6%7/7I8\\8k8",
        "0$0,0<0H0h0t0",
        "PROCESSOR_ARCHITECTURE",
        "BfsRepair: Failed to open system store. Status: %08x",
        "OCStatusFilePath: %s",
        "7,7<7L7\\7l7|7",
        "=+=4=:=G=M=R=c=n=|=",
        "2.2?2u2",
        "11191?1S1Y1b1x1",
        "1!1Z1",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CAntiVirusInfo *>::Reset(void)",
        "t]SSj",
        "3#3-3?3G3M3W3a3u3",
        "3+3C3I3_3p3}3",
        "{FCF4885C-2913-41BD-A53D-F28210991A9C}",
        "656;6E6J6T6[6i6{6",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *> *)",
        "7$7/7:7b7i7o7t7",
        "2U2g2",
        "2 2.2;2M2U2[2h2z2",
        ".PAVCXXXXXTemp@?3??SPCreateRegistry@@YGJPAVString@UnBCL@@00KPAEKH@Z@",
        ")boot.wim",
        "4k9y9",
        "> >4>A>H>P>U>d>o>{>",
        ">#>,><>T>p>w>}>",
        "CFFOperationsProgress::RegisterError",
        "SPGetOSInformation",
        "2*2S2n2",
        "%hs: Failed to remove %s. Error: 0x%08X",
        "class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::GetBuffer(int) const",
        "? ?8?[?b?h?m?x?",
        ":%:*:6:C:S:_:z:",
        "ERROR_DS_CANT_ON_NON_LEAF",
        "?+?@?H?N?[?j?",
        "<!=(=.=3=B=L=Q=e={=",
        ">(>4>L>b>h>u>~>",
        ">;?X?g?",
        "D$ Z;D$ r",
        "3,3[3q3}3",
        "6/6H6U6]6n6",
        "6&636H6P6V6d6}6",
        "8@9`9X:",
        "class UnBCL::String *__stdcall SPRemapPath(class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *> *,int)",
        "D$lRRRRRh",
        "WimBoot capture failed because wimbootcompress.ini is not available!",
        ".?AVCCompressOldOS@@",
        "sysprepModule",
        ".?AU?$IDictionary@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@",
        "414?4I4Y4b4j4{4",
        ".?AV?$SerializableBase@VCSetupPlatformInfo@@$0A@V?$DefaultInstanceFactory@VCSetupPlatformInfo@@@UnBCL@@@UnBCL@@",
        "606d6~6",
        "=0=<=J=W=i=p=y=~=",
        ".?AV?$ArrayListEnumerator@PAVCDeploymentBase@@@_@UnBCL@@",
        "9#9<9[9u9",
        "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
        "SL_E_VALUE_NOT_FOUND",
        "Rollback completed with error: 0x%08X",
        "pFinalizeUninstall:Can't delete the directory: %s,  hr = 0x%x",
        "576h6",
        "InstallLanguage",
        "ParseDiskCriterion: Failed to look up disk match property %s: 0x%08x",
        ";8<Y<x<",
        "0!0@0W0^0e0l0r0",
        "RestoreMountStub: error creating destination file",
        "Continue to apply the image without setting CI EA.",
        ".?AU?$IEnumerable@PAVCDUPackage@@@UnBCL@@",
        ";#;);.;9;D;I;];};",
        "616;6X6_6e6k6v6|6",
        ".?AV?$DefaultInstanceFactory@VCCompleteFileOps@@@UnBCL@@",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::Remove(class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *)",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::RemoveAt(int)",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *> *)",
        "0(060D0R0",
        "%OSVersion%",
        "3M4l4",
        "94:j:",
        ".?AVHiveListEnumerator@@",
        "GDI32.dll",
        "%hs: Number of files deleted: %d.",
        "? ?-???S?w?",
        "value",
        "RtlInitUnicodeString",
        ".?AV?$SmartPtr@VMutableString@UnBCL@@@UnBCL@@",
        "q@boA",
        "void __thiscall OSRollbackService::CCheckpointImpressario::SetCheckpoint(const unsigned short *,struct OSRollbackService::ICheckpointParameters *)",
        "Failed getting package permanence",
        ".PAVCXXXXXTemp@?3??SPTaskRemoveSnapshot@@YGJXZ@",
        "Failed to read DOS header from file: %S",
        "9#9*989B9U9_9g9q9y9",
        "6,6:6Q6e6",
        "SPApplyAnswerFileSettings: Failed to apply offlineServicing settings (0x%08x)",
        "SPSelectDisk: Can't filter disks (0x%08x)",
        "SL_E_PLUGIN_ALREADY_REGISTERED",
        "3!3.3;3O3\\3k3r3",
        "Failed to enumerate subobject elements. Status: %x",
        ".?AVCOCDismAdapter@OC@@",
        "strtol",
        "Apply (oobe boot apply, online phase): Migration phase failed. Result: %d, no specific error",
        "?set_AutoDelete@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXH@Z",
        "%hs: Could not retrieve the actual file name from global path for item %d",
        ".?AVNumericProperty@?1???$pDefineNumericProperty@V<lambda_e1229b77e0c2a99a08717153395bfa4b>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_e1229b77e0c2a99a08717153395bfa4b>@@@Z@",
        "Push Button Reset - Enumerate",
        "void __thiscall UnBCL::ArrayList<unsigned short *>::RemoveAt(int)",
        "ERROR_TRANSACTIONS_UNSUPPORTED_REMOTE",
        "ERROR_WAS_UNLOCKED",
        "StoreId",
        "VERBOSE: MOVETRACK: Destination %s exists, attribs: 0x%08X",
        "SPSerializeOperations failed",
        "New trace file name [%s] is longger than MAX_LENGTH",
        "system32\\winevt\\logs",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCOperationsValidator@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCOperationsValidator@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "2\"2N2^2{2",
        "9(9,9<9@9P9T9d9h9x9|9",
        "6$656B6L6[6d6j6w6}6",
        "7$7*7>7J7S7m7",
        "5+585A5L5^5f5z5",
        "File [%s] has the same version as [%s]",
        "Failed to RegOpenKey %ls from the loaded hive %ls",
        "ERROR_MEDIA_CHECK",
        "BfsMigrateLoaderSettings failed to open target object %#x",
        "{2E03F715-6267-417F-8AAC-6B8D36794AF4}",
        "<&</<A<M<W<h<q<z<",
        "K0a0o0",
        "ConfigureFeatureUpdateUninstallPeriod",
        ": :<:",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *> *,int) const",
        "Failed adding edition package: %ws",
        "RPC_S_SERVER_UNAVAILABLE",
        "DiskLayout::Execute: Failed to modify existing partitions (0x%08x)",
        "??6SerializationStream@UnBCL@@QAEAAV01@K@Z",
        "5.5^5k5q5",
        "%hs: Phase %d, request is not supported",
        "CBS_E_INSTALLERS_FAILED",
        "7.747",
        " _^[Y]",
        "ERROR_EVT_EVENT_TEMPLATE_NOT_FOUND",
        "6$666E6M6T6g6z6",
        "$rGSV",
        "4;4N4d4",
        "6-6C6Z6h6r6|6",
        "SPAPI_E_SCE_DISABLED",
        "ERROR_DS_DRA_BAD_NC",
        "3+3:3C3T3^3q3z3",
        "SYSTEM\\CurrentControlSet\\Services\\WimMount",
        "ERROR_DS_SINGLE_USER_MODE_FAILED",
        "%hs: Failed to find proper image in IImageInfo parameter.",
        "5\"5'525<5S5Z5`5e5p5z5",
        "4>4X4u4",
        "2 232F2X2o2y2",
        "CEnableNewOSPageFile::DoExecute: Not a full upgrade, Saving default pagefile settings from new OS",
        "70797B7K7T7]7",
        "%hs: Uninstall initiated = %d.",
        "CARPValidator::GetRegNavigator",
        "%hs: Failed to open source file %s. Error: 0x%08X",
        "BootStat\\EFI\\bootstat.dat",
        "ERROR_LOGIN_TIME_RESTRICTION",
        "<7<><F<K<[<b<n<",
        "ERROR_BAD_CLUSTERS",
        "  WU cache redirected to volume %s",
        "ERROR_DEVICE_REINITIALIZATION_NEEDED",
        "%hs: Uninstall is not active on this machine.",
        "void __thiscall UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *>::Resize(int,int)",
        "FirstUXWndShowText",
        ".PAVCXXXXXTemp@?3??SetUpCbsLogging@CReconstructOS@@IAEJPBGPAH@Z@",
        "585D5d5l5t5",
        ">\\>b>{>",
        "ERROR_CONNECTED_OTHER_PASSWORD_DEFAULT",
        ".PAVCXXXXXTemp@?GP@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "3)3A3X3p3}3",
        "Component %s doesn't have a valid order",
        "CTrustSafeOSBootCommand::DoExecute",
        "ERROR_DS_SENSITIVE_GROUP_VIOLATION",
        "void __thiscall UnBCL::ArrayList<unsigned char>::QuickSort(class UnBCL::ArrayList<unsigned char> *,class UnBCL::ArrayList<unsigned char> *,int,int)",
        ".PAVCXXXXXTemp@?CP@??SPCanChangeRecoveryPartition@@YGHPAVString@UnBCL@@G_KPAHPA_K3333@Z@",
        "y#Vh'",
        ":&:-:4:?:J:O:c:",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *> *)",
        "%hs: Default WinRE image does not exist either, we have nothing to do.",
        "ymVh<3",
        "CDeploymentProject::CreateFolderDeployment: Failed to copy winre.wim Safe OS from inside [%s] to [%s]. Error: 0x%08X",
        "2F2M2S2X2c2n2",
        "??1FormatException@UnBCL@@UAE@XZ",
        ".?AU?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAVCSPInternalPluginData@@@UnBCL@@@UnBCL@@",
        "JET_errBadColumnId",
        "IActionCollection::put_Context. hr = 0x%x",
        ":#:*:4:E:R:\\:k:t:z:",
        "3C3P3",
        "2P2W2d2m2v2",
        "<'</<5<B<T<e<w<",
        "%hs: Default entry GUID: %s",
        "OC status saved successfully",
        "<'<5<I<Z<g<q<x<~<",
        "<3=B=s=",
        "assembly\\NativeImages_v4.0.30319_32",
        "AddCaptureNodeToImage",
        ".PAVCXXXXXHandledException@?2??FilterUpdates@CDownloadDUUpdates@@IAEJPAUIDUUpdateCollection@DU@@PAJPAUIDownloadCallback@SetupPlatform@@PAXPAUIDUDownloadProgress@6@PAUITelemetry@@PAUITelemetryActivity@@@Z@",
        "WINDOWS/PRODUCTSUITE",
        ".?AU?$IList@E@UnBCL@@",
        "\\System32\\config\\BCD-Template",
        "pExtractWinREFromImage: Failed to open %s to get recovery image (0x%08x)",
        "JET_errIndexBuildCorrupted",
        "WmiAssociation::Current: Unexpected error: Couldn't get %s (0x%08x)",
        "7+7?7J7V7^7i7q7}7",
        "Fail to update WIM header",
        ":.:::D:Q:Z:g:p:~:",
        "CMigrateBootSettings::DoExecute: Could not get old OS boot entry from param file; will skip migration",
        "void __thiscall CSkipBootValidator::RemoveOperation(class COperationQueue *,enum OP_OPERATION_ID)",
        "Attempting to move/copy/merge %s to %s",
        "5-535G5f5z5",
        "?S?^?n?",
        ";,;8;?;I;P;Z;a;k;r;|;",
        "??0MutableString@UnBCL@@QAE@XZ",
        ">\">(>->B>^>",
        ".?AV?$ArrayList@PAVCDriverDetails@@@UnBCL@@",
        ":2:<:P:l:",
        "9Z9p9",
        "Pj2hh",
        "3)464N4",
        "WIM file is already on the scratch space volume, nothing to do.",
        "CRYPT_E_ASN1_CORRUPT",
        ".?AV?$DefaultInstanceFactory@VCMoveWIMBootEntriesAndPartition@@@UnBCL@@",
        "Volume bitmap size is too large",
        "EFI\\Boot",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::set_Item(int,class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *)",
        "0!0*0@0Q0]0i0v0",
        "7%7+707;7E7J7^7y7",
        "<N<n<u<~<",
        "SL_E_CHPA_FAILED_TO_INSERT_PRODUCTKEY_BINDING",
        "SmPlatform::ComputeHostInfo: Failed to enumerate MSFT_PartitionToVolume instances (0x%08x)",
        "Transformer Commit succeeded",
        "FolderMoveRollback: Malformed entry ignored: %s",
        ".?AV?$ArrayList@I@UnBCL@@",
        "ERROR_WMI_ALREADY_DISABLED",
        "5.6N6[6x6",
        "ERROR_SERVICE_DEPENDENCY_FAIL",
        ".PAVCXXXXXHandledException@?2??DoExecute@CProcessDrivers@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "<$=:=L=Y=",
        ":3;Q;h;",
        "Signed",
        "j\\XPS",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::Resize(int,int)",
        "0&030:0D0U0b0l0{0",
        "SmPlatformDiskEnumerator::Initialize",
        "{1E12D13D-CB53-4611-BB58-0E14D049AF25}",
        "<&<0<H<O<V<b<",
        "<0<8<@<L<l<t<|<",
        "QSj\\jyjd",
        ".?AV?$CAutoRelease@PAVSmDiskPartitionEnumerator@@@RAII@@",
        ".PAVCXXXXXHandledException@?HD@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        ":/:<:L:S:`:y:",
        "1(111:1C1L1`1j1v1",
        "4H4q4",
        "na:SectorSize",
        "2.262C2S2[2b2h2m2x2",
        "ERROR_DS_DRA_SCHEMA_CONFLICT",
        "SPScheduleTask: Schedule Task : [%s]",
        "Successfully removed the recovery partition and extended the OS partition",
        "CMigrateFramework::DoExecute: Cannot load software hive for offline OS %s. Error: 0x%08X",
        "unallocated disk",
        "VdsDisk::GetProperties",
        "Rollback-Online-User completed with error: 0x%08X",
        "2-2G2a2{2",
        "<#=L=b=",
        ":-:>:S:Y:k:",
        "?(?0?8?H?T?\\?t?|?",
        "7%7+7?7E7N7d7q7",
        "void __thiscall UnBCL::Array<struct _GUID>::InitLarva(class UnBCL::ArrayList<struct _GUID> *)",
        ":&:-:3:8:C:J:^:s:",
        ".PAVCXXXXXTemp@?3??SuspendAndRelease@CSetupPlatform@@UAEJHHPBG@Z@",
        "8+8c8v8",
        "%w't%",
        ":@:G:M:R:]:h:|:",
        "2/2S2s2}2",
        "%hs: No downlevel OS GUID found.",
        "8#818:8C8N8Y8d8",
        "SclDeleteFileObject",
        "2)292F2R2",
        "OrchestratePublishWnfUninstallDisabled: Publishing WNF event for disabling uninstall",
        ":4:<:D:L:T:\\:d:l:t:|:",
        "4*4<4C4I4N4Y4`4m4s4",
        "Failed to set Compact",
        ".?AV?$Array@PAVISPPluginData@@@UnBCL@@",
        ":4:I:O:\\:n:|:",
        "?#?L?",
        "=,=9=E=M=T=m=t=",
        "8'9.94999D9K9_9m9y9",
        "ERROR_CLUSTERLOG_NOT_ENOUGH_SPACE",
        "%hs: %s cannot be converted to real path, uninstall validation will fail.",
        "JET_errLogSectorSizeMismatch",
        "UnifiedProgress",
        "JET_errSessionWriteConflict",
        "SPFindSnapshotProp: Failed to initialize COM. Error: 0x%08X",
        "=#=0=?=M=T=Z=_=k=u=",
        ";1;R;{;",
        "=,=E=U=^=h=u=",
        "CRemoveWIMBootEntries::DoExecute",
        ".?AU?$ICollection@PAUPartitionLayoutArgs@@@UnBCL@@",
        "0j@WP",
        "ERROR_DS_CANT_CACHE_ATT",
        "0&0,010<0B0W0^0d0i0t0{0",
        ":%:;:Q:\\:l:v:",
        ".?AU?$IEnumerable@UDiskMatchFilter@@@UnBCL@@",
        "ERROR_NO_SECURITY_ON_OBJECT",
        "ERROR_AMBIGUOUS_SYSTEM_DEVICE",
        "JET_errIndexMustStay",
        ".?AV?$KeyCollection@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@_@UnBCL@@",
        "SetBkColor",
        "@Foundation",
        ">a>t>{>",
        "=\"=H=O=l=s=",
        "BfsRepair: Failed to unload system store. Status: %08x",
        "JET_wrnDataHasChanged",
        "CDeploymentProject::CreateVHDDeployment: Failed to finalize the system. Error: 0x%08X",
        "QQQVS",
        "151:1C1R1h1m1v1",
        ".?AU?$ICollection@PAVCCopyInfo@@@UnBCL@@",
        "SmImageDisk::Initialize: SmDisk property initialization failed (0x%08x)",
        "60676>6D6Q6f6t6",
        "Creating MemTest object.",
        "9-9J9U9x9",
        "pSPLogNavigatorContent",
        "8 8$8(8084888<8D8H8L8P8X8\\8`8d8l8p8t8x8",
        "void __thiscall UnBCL::Array<enum OP_EXECUTION_PHASE>::InitLarva(class UnBCL::ArrayList<enum OP_EXECUTION_PHASE> *)",
        "ERROR_IPSEC_IKE_DECRYPT",
        "OC::COCDismAdapter::InitOffline",
        "< <8<<<T<X<p<t<",
        "tcjCj",
        "MIGRATION_SCRIPT_DIR",
        ":(;p;",
        "%hs: Failed to remove WIM entry for %s. Error: 0x%08X",
        ".?AU?$IEnumerator@PAV?$CAutoRelease@PAUIDUUpdateCollection@DU@@@Mig@@@UnBCL@@",
        "Current phase string     : %s",
        "y!VhT",
        "Message",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCFailForwardSystem@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "<S<c<",
        "2.2>2j2",
        "InjectUnattendFile: Couldn't read/convert answer file to inject: 0x%08x",
        "ERROR_CLUSTER_NODE_NOT_PAUSED",
        "2)2M2s2",
        "8O9[9r9",
        "Some image info for WIM %s, index %d is missing from WIM XML; trying to get it from registry.",
        "=)=3=E=M=S=]=g={=",
        "1)131D1M1Z1c1j1w1~1",
        ".?AVCEnableTelemetryForImage@@",
        "3\"4m4",
        "ERROR_DS_EXISTS_IN_SUB_CLS",
        "Failed to open file \"%s\".",
        "%c:\\Boot",
        "pLogUpdateInfo: VarBstrFromDate failed. hr = 0x%x",
        "ERROR_TLW_WITH_WSCHILD",
        "DRVINST: Failed to %sreflect driver package in WinRE: %s.",
        "4 4$4(4,44484<4@4H4L4P4T4\\4x4|4",
        ".?AU?$IList@PAVCDrvStoreProperty@@@UnBCL@@",
        "ERROR_DS_CANT_RETRIEVE_CHILD",
        "<$<)<4<C<K<R<W<k<y<",
        "?)?/?4?E?P?^?",
        "949;9A9F9Q9X9d9x9",
        "Suspending WIMBoot entry %I64u (%s, %d) for drive %s",
        ":C;m;",
        "FLOWTRACK(SAFEOS): Flow Validator: SafeOS phase is still active, Skip SafeOS boot flow constraint cannot be satisfied.",
        "SmPlatform::EnumerateDisks: Can't initialize enumerator (0x%08x)",
        "void __thiscall UnBCL::ArrayList<void *>::CopyTo(class UnBCL::Array<void *> *,int) const",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@HUTableKey@?$Hashtable@PAVString@UnBCL@@H@2@HUKeyTraits@42@$1?RetrieveValue@42@KGHPBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@H@UnBCL@@HUKeyTraits@23@V?$CElementTraits@H@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        ".?AVCXXXXXHandledException@?5??SPGetAllPartitions@@YGJIPAPAV?$ArrayList@PAVCPartitionInfo@@@UnBCL@@@Z@",
        "Successfully completed execution of GC queue",
        "0T1f1n1t1",
        "10X0i0",
        "3(3D3H3P3\\3",
        "ERROR_IPSEC_IKE_PROCESS_ERR_SIG",
        "SPFindSnapshotProp: Failed to create backup components. Error: 0x%08X",
        "{2F67DB44-B6BB-497C-B4C6-2C608B2CB44A}",
        "Tel-M1.etl",
        "=#=)=.=9=E=Y=z=",
        "%hs: Cannot queue EULA acceptance for fail-forward system %d. Error: 0x%08X",
        "QVj|h",
        "3$3,3<3D3L3T3\\3d3l3t3|3",
        "Cleanup snapshot is not allowed. skipping",
        "WpxCreateConfig",
        "CSIDL_TEMPLATES",
        "Scratch directory requested (%s), perfoming validation",
        "999P9W9i9z9",
        ";G<N<Y<w<",
        "= >`>",
        "XMerge WIM files (first part %s) to %s",
        "Failed to process Driver Store INF device ID matches, Err = 0x%lx",
        "ERROR_UNSUPPORTED_TYPE",
        "ERROR_REDIRECTOR_HAS_OPEN_HANDLES",
        "WimImageCreateWorkers",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::LastIndexOf(class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *,int,int) const",
        "Test mode enabled, following components will be skipped:",
        ".?AV?$DictionaryEntry@PAVString@UnBCL@@PAUHKEY__@@@UnBCL@@",
        "HKLM\\SYSTEM\\Setup\\FirstBoot\\Cleanup",
        "Setting WMI Uint64 property %s: can't convert to VARIANT type %d",
        "SPGetPackageOperationID",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCDriverDetails@@@UnBCL@@@UnBCL@@",
        "<$<-<@<G<N<Y<d<x<",
        "long __thiscall CNewSystem::PrepareForRun(void)",
        "<$<,<4<<<H<l<t<|<",
        ">1>9>X>s>",
        "TotalProcessingTimeInMS",
        "SL_E_CHPA_FAILED_TO_DELETE_PRODUCT_KEY_PROPERTY",
        ":5:P:a:j:",
        ".?AVCSetupPlatformRollback@@",
        "pLogUpdateInfo: IUpdate::GetType failed. hr = 0x%x",
        "JET_errBadParentPageLink",
        "Image time low",
        "3%373E3\\3r3",
        "5(515:5F5O5[5g5{5",
        "0%0@0|0",
        "ERROR_COMMITMENT_MINIMUM",
        "+D$ ;|$ ",
        ".?AU?$ICollection@PAV?$DictionaryEntry@PAVString@UnBCL@@H@UnBCL@@@UnBCL@@",
        "ERROR_DS_DRA_SCHEMA_MISMATCH",
        "???Q?Y?_?l?~?",
        ";4;D;T;X;p;t;",
        "<*</<8<D<P<U<^<j<v<{<",
        ">%>h>",
        "2&232C2U2\\2b2g2r2",
        "nOffline",
        "?&?>?G?Y?`?f?k?v?",
        "4$4,444<4P4X4`4h4|4",
        "null key to Hashtable#Item",
        "7,7X7",
        "SL_E_TOKEN_STORE_INVALID_STATE",
        ">#>0>S>_>v>}>",
        ":%:<:B:k:p:",
        "?!?,?1?E?W?e?",
        "Inspecting disk [%u]",
        "CMediaLayout::QueueAuditScript: Failed to queue folder copy from %s to %s: 0x%08x",
        "szAppend2",
        "CMediaLayout::QueueProvisioningPackages: Failed to get provisioning package %u: 0x%08x",
        "VdsPartition::Delete: Failed to query IID_IVdsAdvancedDisk interface [%s] (0x%08x)",
        "4[4b4",
        "1'111:1P1q1",
        "=$=,=4=<=D=L=d=t=",
        "4$4(484<4L4P4`4d4t4x4",
        "pGetRegSecurityInfo",
        ".?AVCFileCreationData@@",
        "1F1Q1e1t1{1",
        ".?AV?$DefaultInstanceFactory@VCWIMImageInfo@@@UnBCL@@",
        "7 7$7(7074787<7D7H7L7P7X7\\7`7d7h7l7p7x7",
        "TargetOSEditionId",
        ".?AVCXXXXXHandledException@?2??DoExecute@CAddDriver@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "CurrentMajorVersionNumber",
        "void __thiscall UnBCL::ArrayList<class COperation *>::AddRange(const struct UnBCL::ICollection<class COperation *> *)",
        "%hs: Failed to copy directory from [%s] to [%s]",
        ">V>h>o>u>z>",
        "void __thiscall UnBCL::ArrayList<class CCFGSectionValue *>::RemoveAt(int)",
        "Provided checkpoint sequence does not have checkpoints.",
        "SPAPI_E_EXPECTED_SECTION_NAME",
        "void __thiscall UnBCL::ArrayList<class CUserProfile *>::set_Item(int,class CUserProfile *)",
        "7$7A7Y7m7",
        "SPOpenProvisioningPackage",
        "    Failed to create element enumerator",
        "9 9(949T9\\9h9",
        "?Free@Allocator@UnBCL@@SGXPAXI@Z",
        "VWh(m",
        "=0=9=@=G=N=U=[=a=g=t=",
        "ERROR_PRINTER_DRIVER_ALREADY_INSTALLED",
        "?CompareTo@DateTime@UnBCL@@UBEHPBVObject@2@@Z",
        "7$7,747<7H7P7l7t7|7",
        "CFFOperationsProgress::RegisterProgress",
        ".?AVCXXXXXHandledException@?2??DoExecute@CEnableTelemetryForImage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "SmDisk::CreatePartition: SM API do not support partition names",
        "ERROR_CLIENT_SERVER_PARAMETERS_INVALID",
        "VWh8^",
        "8Q8\\8",
        "ERROR_INVALID_HOOK_FILTER",
        "545L5",
        "Successfully processed reparse point [%ws]; update %s",
        "WriteData failed",
        "Processing NGEN root folder %s",
        "DeletePath: Cannot delete <null>.",
        "_DismSetSkuIntlDefaults",
        "7-757;7M7\\7y7",
        "5.5^5h5q5w5",
        ".?AVCSetupPlatformWinReRestoreCheckpoint@@",
        "3(3/3>3H3[3}3",
        "5X5}5",
        "JET_errDbTimeTooOld",
        "PrepareVolumeAccessPath: Successfully created access path '%c:\\' for volume '%s'",
        "%hs: Fail-forward installation detected, allowing driver migration.",
        "f;D$Xu",
        "909J9",
        ">$>8>S>w>",
        "AdministratorPassword",
        ".?AVMemoryStream@UnBCL@@",
        "ApplyReparseFixup",
        "686X6x6",
        "4&4,494K4Y4z4",
        "ERROR_DS_EXISTS_IN_MAY_HAVE",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAVCDriverInstallInfo@@UTableKey@?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@PAV12@UKeyTraits@52@$1?RetrieveKey@52@KGPAV12@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@PAVCDriverInstallInfo@@UKeyTraits@23@V?$CElementTraits@PAVCDriverInstallInfo@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "Attempting to remove unused drivers",
        "252@2g2",
        ":H:Z:b:h:u:",
        "j.Zj0Xf;E",
        ".?AV?$Array@PAVSysprepComponent@@@UnBCL@@",
        ".?AV?$Array@PAVCAppInfo@@@UnBCL@@",
        "5+5A5O5\\5",
        "__thiscall UnBCL::ArrayList<unsigned long>::ArrayList(const struct UnBCL::ICollection<unsigned long> *)",
        ":-:V:",
        "SL_E_CHPA_DMAK_EXTENSION_LIMIT_EXCEEDED",
        ".?AV?$ArrayList@PAUPageFileDesc@@@UnBCL@@",
        "4'4;4",
        "u&f;_",
        ".?AV?$SerializableBase@VCARPValidator@@$0A@V?$DefaultInstanceFactory@VCARPValidator@@@UnBCL@@@UnBCL@@",
        "Move WIMBoot entries/partition",
        "Cannot extend the OS partition. Error: 0x%08X",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::MoveNext(void)",
        "0.1;1M1U1[1h1z1",
        ".?AVCXXXXXHandledException@?KJ@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "31363t3{3",
        "APPX Validator: Failed to find folder %s",
        ";(;7;<;H;T;c;h;t;",
        "<1=<=",
        "ERROR_PWD_TOO_RECENT",
        "9!9'919;9T9k9",
        "JET_errOSSnapshotInvalidSequence",
        "class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::GetBuffer(int) const",
        "4$4;4T4p4",
        "6,656>6G6g6u6",
        "Wmi::OpenNamespace: Failed to connect to namespace '%s' (0x%08x)",
        "8(8/858:8E8P8d8l8",
        "JET_errExclusiveTableLockRequired",
        "3R4Y4c4j4r4y4",
        "Microsoft Corporation1&0$",
        "Progress start phase was written: %u",
        "%hs: Failed to move Telemetry. Error: 0x%08X",
        "InitializeCSI_REPAIRED_COMPONENT",
        ":D:K:",
        "O(;O0vp;O,r",
        ".?AV?$CAutoComFree@PAU_VDS_FILE_SYSTEM_FORMAT_SUPPORT_PROP@@@RAII@@",
        "y6VSh$",
        "ERROR_DS_CANT_REMOVE_ATT_CACHE",
        "34383P3T3l3p3",
        "8\\8f8w8",
        "5&5:5Q5`5l5",
        "Disable feature %s",
        ".PAVCXXXXXHandledException@?2??ExtractPidgenx@CWIMPidgenxExtractor@@UAEJPAUIImageInfo@SetupPlatform@@PAPAVString@UnBCL@@1@Z@",
        ";M<R<y<",
        "DRVMIG: Reflecting driver package into WinPE: %s",
        "8_8f8",
        "%hs: Found unknown object in exception list. Object: %s",
        "ERROR_RECOVERY_NOT_NEEDED",
        "<4<{<",
        "5<5A5K5^5",
        "setupplatform.cfg",
        "ERROR_DS_NAMING_VIOLATION",
        "; ;$;(;0;4;8;<;D;H;L;P;T;X;`;d;h;l;p;t;x;|;",
        "7 7%7.797M7e7",
        "2,2h2",
        "<%<7<B<G<T<s<z<",
        "PSFX_E_MATCHING_COMPONENT_NOT_FOUND",
        "2%2,2=2E2l2s2y2~2",
        "]SPUpdateUserModeTracingLocation",
        "9\\$Dt",
        "; ;F;X;",
        "ERROR_QUORUM_OWNER_ALIVE",
        "0*02070<0m0",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCOperationResult@@@UnBCL@@@UnBCL@@",
        ".?AVCAppXValidator@@",
        "7#7C7]7m7x7",
        "5C5a5y5",
        "5#555E5Y5a5k5r5x5}5",
        "Disk space required (Begin: %I64u, End: %I64u): %I64u",
        "int __stdcall UnBCL::MP::ThrowCompare<void *>::Compare(void *,void *)",
        "7,7>7W7y7",
        "4!454@4G4M4R4]4j4o4",
        "(%lx): Failed to record perf results",
        "Failed to get driver package version info (Err = 0x%lx), skipping package.",
        "7,7C7g7",
        "CDeploymentProject::CreateVHDDeployment",
        "SnapshotUsedSpace",
        "<9<]<q<",
        "=1=G=S=l={=",
        ".PAVCXXXXXHandledException@?BE@??SPValidateTrackedContent@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@000PAH1PAPAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@2@Z@",
        ":5:?:V:b:",
        "COfflineHiveT<class CEmptyType>::GetMultiStringValue",
        "737E7O7\\7b7i7s7",
        "SetupPlatform::GetSetupPlatformVersion: Failed to build path to platform binary. hr = 0x%x",
        "base\\ntsetup\\setupplatform\\lib\\src\\dynamicupdate.cpp",
        "%hs: Failed to set attributes for %s. Error: 0x%08X",
        "Failed to get the size needed for the registry data. Status: %x",
        "ERROR_DS_CR_IMPOSSIBLE_TO_VALIDATE",
        "MigCopyFolder",
        ".?AV?$CAutoDelete@PAV?$Hashtable@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@@RAII@@",
        "SPReserveMoveInternal: Failed to find files for pattern [%s]. hr = 0x%08x",
        "2 2m2t2",
        "?4?@?K?Y?",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::Insert(int,class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *)",
        "JET_errDatabase400Format",
        "%hs: Cannot get the real platform, will not log shell folder information. Error: 0x%08X",
        "y)SVhT",
        "8,8<8K8V8^8",
        "ProgramFiles(X86)",
        ";T$$|",
        "CReconstructOS::ReconstructWindows",
        "P8X8]8c8r8",
        "242;2A2F2Q2]2b2v2",
        ".?AV?$HTDictEnumBase@H@_@UnBCL@@",
        ".?AV?$ArrayListEnumerator@PAUIPartition@SetupPlatform@@@_@UnBCL@@",
        "SYSTEM\\ControlSet001\\Control\\WMI\\AutoLogger\\SetupPlatformTel",
        "void __stdcall UnBCL::_::HTEnumerator<unsigned short,int,struct UnBCL::Hashtable<unsigned short,int>::TableKey,int,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable<unsigned short,int>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned short,int>::TableKey,int,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<unsigned short,int> *,class UnBCL::Array<int> *,int)",
        "SmDisk::CreatePartition: Can't enumerate partitions (0x%08x)",
        "ERROR_IPSEC_IKE_PROCESS_ERR_HASH",
        ".?AU?$IList@I@UnBCL@@",
        "Rollback: (2) Showing splash window with restoring text: %s",
        ".?AVCXXXXXHandledException@?2??SPReportSnapshotState@@YGXPAVString@UnBCL@@PAUHKEY__@@PAUITelemetry@@@Z@",
        "Cleanup NGEN from Safe OS",
        "Replicate optional components",
        "BCD Warning: %ws",
        "<+<D<K<Q<V<e<p<",
        "7&7,717B7M7[7x7",
        "ClockType",
        "4+474G4S4Z4b4s4",
        "3(363C3U3]3c3p3",
        "Copy HKLM\\SYSTEM\\CurrentControlSet\\Control\\ProductOptions\\ProductType value from old windows",
        "5 5$5,50545<5@5D5H5L5P5T5X5\\5`5d5h5l5t5x5",
        "1.141>1C1M1T1b1t1",
        "OperationEstimatedSpace",
        "NtQueryDirectoryFile",
        "ERROR_DS_ILLEGAL_SUPERIOR",
        "?1?9???I?S?n?",
        "Reserved.Recompress",
        "4&4A4k4",
        "void __thiscall UnBCL::Array<class COperationResult *>::RemoveAt(int)",
        "<3<K<_<",
        ">)>4>:>N>\\>a>f>q>~>",
        "5%5.5G5N5T5Y5d5k5~5",
        "    Failed to allocate _spMetadataFile.get()",
        "383X3e3r3",
        "?L?Q?",
        "Setting WMI String property %s: the property does not exist",
        "6K6Z6",
        "Failed to query hard reserve space. Error: 0x%08X",
        "FIOGetFileId",
        "void __thiscall UnBCL::ArrayList<class CDUPackage *>::Resize(int,int)",
        "abc45868-0c9c-4bc0-a36d-03d54113baf4",
        "7A7W7`7",
        "EnumeratePathEx: Callback requested enumeration interruption or hit internal enumeration failure on [%s]; GLE = 0x%x",
        ":D:Q:c:k:q:~:",
        ".PAVCXXXXXHandledException@?OD@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "?GetBinaryValue@RegistryKey@UnBCL@@QAEPAV?$Array@E@2@PBVString@2@@Z",
        ".PAVCXXXXXHandledException@?2??DoExecute@CSaveBootEntriesOldOS@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "050n0",
        "979L9a9",
        "81868;8H8c8j8q8|8",
        ";?;^;v;",
        "SetupPlatform::_GetUninstallInterface: Failed to create directory %s. Error: 0x%08X",
        ".PAVCXXXXXTemp@?BCD@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "000>0T0t0{0",
        "ERROR_NETLOGON_NOT_STARTED",
        ".PAVCXXXXXHandledException@?2??DoExecute@CBackupRecoveryPartition@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "Service %s state is %u",
        "616J6`6k6{6",
        "int __thiscall UnBCL::ArrayList<class CCFGSectionValue *>::LastIndexOf(class CCFGSectionValue *,int,int) const",
        "8,8@8",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::IndexOf(class UnBCL::DictionaryEntry<class UnBCL::String *,int> *,int,int) const",
        "8$8/878A8R8_8h8r8|8",
        ".?AU?$IEnumerable@PAVSysprepComponent@@@UnBCL@@",
        "SysprepSession::Execute: Ran out of memory while executing actions",
        "%hs: Cannot create the UNC store. Error: 0x%08X",
        "7\"7'737B7J7P7d7m7u7",
        "9X4u\\",
        "D$PSV",
        "0)0:0i0",
        "7\"7.7;7C7P7X7]7w7",
        "4%52595y5",
        ">:>A>G>L>W>^>r>",
        "CReconstructOS::SaveTelemetryFields",
        "767C7J7a7",
        "JET_errMultiValuedDuplicateAfterTruncation",
        "1 262L2T2]2p2",
        ">#>*>1>>>H>\\>f>y>",
        "%s\\System32\\DriverStore\\FileRepository\\*",
        "0-040M0T0l0s0",
        "  Disk size = %I64u Bytes (%.2f Gb)",
        "ERROR_TOO_MANY_TCBS",
        "int __stdcall UnBCL::MP::OperatorCompare<unsigned char>::Compare(unsigned char,unsigned char)",
        "    Altitude out of range",
        "=,=7=E=S=q=",
        "%hs: Failed to read the OS entry GUID from %s. hr = 0x%X",
        "Failed determining if the package is an SSU",
        "PVh(v",
        "Copy payload",
        "VdsVolume::EnumerateMountPaths",
        "0'090A0G0P0k0y0",
        "DUDownload",
        "FIOFileOpenRelative",
        "3 3&3,32383>3D3J3P3V3\\3b3h3n3t3z3",
        "SmVirtDiskPooledDiskEnumerator::Initialize: Can't enumerate storage pool disks (0x%08x)",
        "ERROR_TIMER_RESUME_IGNORED",
        "HARDRESERVETRACK: Consumed   : %I64d",
        "=/=L=n=~=",
        "ERROR_LISTBOX_ID_NOT_FOUND",
        "6:6A6G6L6W6^6r6",
        "%hs: OfflineWinDir is not specified",
        "838?8K8X8c8",
        "SVh05",
        "ERROR_IPSEC_DEFAULT_MM_AUTH_NOT_FOUND",
        "727@7I7Z7c7l7v7",
        "SP_ONESETTINGS_INFO",
        "CBS_E_SOURCE_MISSING_FROM_WUSUS_CAB",
        "1#1@1F1Q1_1",
        "int __thiscall UnBCL::ArrayList<unsigned long>::LastIndexOf(unsigned long,int,int) const",
        "7,7Y7n7",
        "2%282J2R2X2e2w2",
        "Failed to get token information! Error code = %#x",
        "<J=Y=f=m=w=",
        "2$202<2H2T2`2l2x2",
        "=#>A>",
        "(%lx): Failed to get canonical path for a changed reg key",
        "7&7.7>7E7K7P7[7h7|7",
        "y Wjnh",
        "void __thiscall UnBCL::ArrayList<struct SetupPlatform::IPartition *>::Insert(int,struct SetupPlatform::IPartition *)",
        "6;6]6",
        "RollbackSetCheckpoint(%s) failed. Disabling Rollback.",
        "<.<G<\\<o<w<}<",
        "Marking event [&SclEvent_ExtendPartition_Stop]",
        "ERROR_TIMER_RESOLUTION_NOT_SET",
        "[F$d*",
        "(%lx): Failed to create full path for source key/value.",
        "ImageFolder",
        "7 7(7=7X7n7",
        "=%=.=7=A=d=z=",
        "JET_errMissingFullBackup",
        "5%545=5D5",
        ".?AV?$SerializableBase@V?$Array@PAVCMountedPathInfo@CDeploymentBase@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCMountedPathInfo@CDeploymentBase@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "SPValidateMigratedServices",
        "?(?0?8?@?H?X?`?|?",
        "QjMjI3",
        "{5D1A81C9-679C-4385-9E4E-226D50BDDD31}",
        "CUntagSourcesFolder::DoExecute: Failed to query whether [%s] is tagged for upgrade. Assume tagged. Error 0x%08x",
        "ERROR_ITERATED_DATA_EXCEEDS_64k",
        "{BBF2EB3A-55BD-4BD8-8501-6AA193795A6F}",
        ":\":(:5:G:U:l:",
        ":8:B:O:U:\\:f:s:z:",
        "ERROR_DS_SAM_NEED_BOOTKEY_FLOPPY",
        "APPX Validator: Failed to revert execution of data gather operation. Error: %08X",
        "_wcstoui64",
        "class CUserProfile *__thiscall UnBCL::_::ArrayListEnumerator<class CUserProfile *>::get_Current(void) const",
        ":(:8:<:T:X:p:t:",
        "Will have to revert execution for %d, as its output might have been tainted by the current operation",
        "5&5,5@5I5Q5h5o5u5z5",
        "2\"202:2P2t2",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,&protected: static class CSPInternalPluginData * __stdcall UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,class ATL::CElementTraits<class CSPInternalPluginData *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *> *,class UnBCL::Array<class CSPInternalPluginData *> *,int)",
        "5:5@5J5y5",
        "pRegOfflineGetDWord: Cannot get value HKLM\\%s\\%s [%s] from offline image %s. Error: 0x%08X",
        "CDeploymentBase::ReleaseBase: Error deleting file %s",
        "5(5:5g5",
        "?2?M?[?m?",
        "4Q4W4k4",
        "=?=M=[=g=s=",
        ">7>@>Q>X>b>o>y>",
        "Compress WIMBoot files outside Windows namespace",
        "CEnableSafeOSPageFile::DoExecute: Page file space was a hard requirement, cannot continue setup",
        "6V6l6{6",
        "5&686@6F6S6e6s6",
        "ZwQuerySystemInformation",
        "8%8/888B8K8T8]8f8o8x8",
        "CAbstractDisk::FindVolume",
        "010O0^0",
        "000@0I0q0",
        "!\\REGISTRY\\MACHINE",
        "ERROR_LOG_SECTOR_REMAPPED",
        "SPStopGlobalLoggerSession",
        "PPPPPW",
        "2\"2(252G2U2",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCOperationsValidator@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "Successfully Forceuploaded the telemetry data.",
        "3/363<3A3M3Y3m3",
        "1a1z1",
        "7&7:7B7I7Q7V7e7p7|7",
        "CFG Validator: The value of Path=[%s] Type=[%s] changed",
        ":%:1:=:I:U:a:n:",
        "9$9)9=9W9t9",
        "ZwOpenMutant",
        "0(0,0D0H0`0d0|0",
        "Ph(Y-",
        "<\"</<@<I<V<_<g<m<v<~<",
        "u7WVhX",
        "%hs: Failed to install Eula. hr = 0x%08X",
        "int __thiscall UnBCL::ArrayList<class CGlobalPathFindData *>::IndexOf(class CGlobalPathFindData *,int,int) const",
        "DiskLayout::VerifyLayoutModifyIndices: The target disk does not have a partition with index %u",
        "Writing to NVRBoot file [%ws]",
        "Footprint.ICB",
        ".PAVCXXXXXHandledException@?EI@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "[%02x-%04x]",
        "IDB_WIN_LOGO3",
        "1+121=1H1S1g1",
        "SL_E_SRV_INVALID_RIGHTS_ACCOUNT_LICENSE",
        "Creating new system (3). System drive: %c",
        "SysprepSession::Execute: Win32 error (%d), could not execute actions",
        "na:DefaultPartitionByteAlignment",
        "CExtractFilesFromWIM::DoExecute",
        "VdsPartition::SetType: Unknown partition style",
        ">#>2><>A>I>P>\\>n>",
        "<+<3<=<D<J<O<Z<i<}<",
        "= ='=2=9=>=K=T=Y=m=u=",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::Remove(class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *)",
        "ProgramFiles",
        "ERROR_IPSEC_IKE_CGA_AUTH_FAILED",
        ".PAVCXXXXXTemp@?3??pSPSetSnapshotInfoToNewOS@@YGJPAVString@UnBCL@@PAUHKEY__@@U_FILETIME@@PAUITelemetry@@@Z@",
        "PVSShhY",
        "ERROR_ACCOUNT_LOCKED_OUT",
        "1&1<1R1h1~1",
        "JET_errOSSnapshotNotAllowed",
        "4*5U5p5",
        ";9;f;{;",
        "prs-AF",
        "%hs: Cannot open image %d for %s. Error 0x%08X",
        ".?AUIPathEnumerator@SetupPlatform@@",
        "D$@;D$P",
        "tmj\\W",
        ":\":0:>:L:Z:",
        "313H3_3f3l3q3|3",
        ";*<7<r<",
        ".?AU?$IList@PAUIDisk@SetupPlatform@@@UnBCL@@",
        "2!2.252;2@2K2U2Z2n2",
        ";%;2;D;R;_;q;y;",
        "</=^=e=k=p={=",
        "0&0H0_0s0",
        "Add unattend file %s",
        "9::O:a:i:o:",
        "(Ph|/",
        "6(6=6o6",
        ".?AVCAntiVirusInfo@@",
        "void __thiscall UnBCL::ArrayList<class CDrvStoreProperty *>::Insert(int,class CDrvStoreProperty *)",
        "Registry",
        "00B0K0]0i0s0|0",
        "%hs: SPGetOSInformation did not find any footprint for the target OS.",
        "u'QQQ",
        "base\\ntsetup\\setupplatform\\lib\\automation\\customdisk.cpp",
        ":J:t:",
        ".?AVCXXXXXHandledException@?L@??SPArePathsEqual@@YGHPAVString@UnBCL@@0@Z@",
        "WinHttpQueryDataAvailable",
        "<+<9<",
        "161>1M1b1j1p1u1",
        "1%111C1n1{1",
        ";4<<<Q<m<",
        "%hs: Get WatsonEventName=[%s]",
        "ERROR_TRANSACTIONS_NOT_FROZEN",
        "2*2=2H2V2o2",
        ">/>C>p>",
        "CDeploymentProject::CreateFFUDeployment: Environment not set up for creating FFU deployment; Error: 0x%08X",
        "SPDeleteSnapshot: Failed to set backup context. Error: 0x%08X",
        ".?AU?$IList@PAVCDriverInfo@@@UnBCL@@",
        "CRYPT_E_OID_FORMAT",
        ".?AU?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@W4ActionType@@@UnBCL@@@UnBCL@@",
        "9!9'939?9U9]9l9",
        "ERROR_HANDLES_CLOSED",
        "3%3>3R3[3w3",
        "pRegOfflineGetQWord: Cannot get value HKLM\\%s\\%s [%s] from offline image %s. Error: 0x%08X",
        "void __thiscall UnBCL::Array<class OC::COptionalComponent *>::Remove(class OC::COptionalComponent *)",
        "6A6]6o6~6",
        "3)3E3L3R3W3g3r3z3",
        "void __stdcall UnBCL::_::HTEnumerator<unsigned long,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,class UnBCL::DictionaryEntry<unsigned long,struct IVdsDisk *>,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<unsigned long,struct IVdsDisk *> __stdcall UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsDisk *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<unsigned long,struct IVdsDisk *> *,class UnBCL::Array<class UnBCL::DictionaryEntry<unsigned long,struct IVdsDisk *> > *,int)",
        ".PAVCXXXXXTemp@?JD@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        ";0;8;A;F;L;^;n;",
        "t$(SSh",
        "0'020v0",
        ";#;S;Z;h;r;",
        "dPluginString",
        "2(2=2C2P2b2p2",
        "isalpha",
        "070V0y0",
        "Updates downloaded successfully",
        "919;9W9e9l9y9",
        "epCreateSystemRootDriveMapping",
        "base\\ntsetup\\setupplatform\\lib\\diagnostics\\diagnostics.cpp",
        ";%<:<M<a<s<",
        "WINDOWS/SERVICINGDATA/GDRDUREVISION",
        "='=<=C=I=N=Y=d=x=",
        "<%<3<8<L<a<o<",
        "Failed to initialize COM. hr = 0x%08X",
        "9'9=9S9i9t9",
        "){5808c8aa-7e8f-42e0-85d2-e1e90434cfb3}",
        "CCreateScopedSnapshot::CCreateScopedSnapshot",
        "152F2_2o2",
        "RemoveOnReset package was found, scavenge will be run",
        ":.:U:",
        "Segoe UI Semilight",
        "void __thiscall UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::CopyTo(class UnBCL::Array<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *> *,int) const",
        "wcsnlen",
        "3\"3H3O3U3Z3e3l3",
        ".?AU?$IEnumerable@PAVSysprepAction@@@UnBCL@@",
        "%hs: Failed to read the new OS GUID from file: %s. Error: 0x%08X",
        "JET_errInstanceUnavailable",
        ".?AVArgumentOutOfRangeException@UnBCL@@",
        ".?AV?$SerializableBase@VCCallRegisterRecoveryImage@@$0A@V?$DefaultInstanceFactory@VCCallRegisterRecoveryImage@@@UnBCL@@@UnBCL@@",
        "0(000H0P0h0p0x0",
        "RPC_S_UNSUPPORTED_TYPE",
        "2#3M3",
        "{014B7BDE-7FFB-4533-B1FD-880B38F3B8C7}",
        ":0:8:D:d:l:x:",
        "=\"=/=5=<=F=S=Z=d=u=",
        "?LoadXml@XmlDocument@UnBCL@@QAEXPAVString@2@@Z",
        "Initiating fail-forward operations",
        "1$1,141<1D1L1T1d1l1t1",
        ">#>8>?>E>J>U>a>",
        "8*868B8^8k8w8",
        "We are not low on disk space, scratch space will not be used.",
        "VdsDisk::PrepareForWipe: Failed to dismount the volume (0x%08x)",
        "4+4>4R4e4q4x4~4",
        "0&010E0f0m0s0x0",
        "ERROR_DS_DRA_INCONSISTENT_DIT",
        "%profilesfolder%",
        "Number of worker threads = %d",
        "CTrustSafeOSBootCommand::DoExecute: Added hash of %s to %s successfully",
        "JET_errInvalidObject",
        "void __thiscall UnBCL::ArrayList<class CUserProfile *>::AddRange(const struct UnBCL::ICollection<class CUserProfile *> *)",
        "%hs: Failed to backup WinRE to the backup directory. hr = 0x%08X",
        "SnapshotMaxSpace",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@H@UnBCL@@@UnBCL@@@UnBCL@@",
        "Failed to QueryDosDevice for %ws (%u).",
        "? ?,?>?S?b?l?q?y?",
        "int __thiscall UnBCL::ArrayList<class CRegCreationData *>::BinarySearch(int,int,class CRegCreationData *,struct UnBCL::IComparer<class CRegCreationData *> *)",
        "6+676C6O6",
        "StorePath",
        "8#8(838B8V8_8m8v8",
        ".?AV?$ValueCollection@PAVString@UnBCL@@K@_@UnBCL@@",
        "; ;*;3;<;E;N;W;`;i;r;{;",
        "Array doesn't support Add()",
        "=>>V>c>{>",
        "DISKSPACETRACK: Needed for op  : %I64d",
        "Error opening setup key. Error: 0x%08X",
        "0\"0+070<0E0L0Y0e0n0z0",
        ".PAVCXXXXXHandledException@?2??Execute@CSetupPlatformPrivate@@UAEJW4EXEC_PHASE@SetupPlatform@@PAU_PROGRESS_DATA@4@PAH@Z@",
        "7J7T7",
        "?get_Count@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
        "090@0`0",
        "Cannot remove WIMBoot file %s. Error: 0x%08X",
        "CSetupAutomation::GetDriveLetter",
        "1'171Y1^1n1",
        ".?AV?$SerializableBase@VCSkipBootValidator@@$0A@V?$DefaultInstanceFactory@VCSkipBootValidator@@@UnBCL@@@UnBCL@@",
        ";);<;n;",
        "JET_errTooManyColumns",
        ":=:C:O:g:",
        "ERROR_MENU_ITEM_NOT_FOUND",
        "4'5.5M5X5~5",
        "void *const *__thiscall UnBCL::ArrayList<void *>::GetBuffer(int) const",
        "base\\ntsetup\\setupplatform\\lib\\imageinfo\\productkey.cpp",
        "LANGUAGES",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@HUTableKey@?$Hashtable@PAVString@UnBCL@@H@2@PAV12@UKeyTraits@42@$1?RetrieveKey@42@KGPAV12@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@H@UnBCL@@HUKeyTraits@23@V?$CElementTraits@H@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "- Current State: %u",
        ">L>^>f>l>y>",
        "> >$>4>8>H>L>\\>`>p>t>",
        "D$lSP",
        "ParamModule",
        "CreateDestinationFileEx",
        "VPh,E",
        "0(0@0e0z0",
        "ERROR_SXS_XML_E_BADCHARINSTRING",
        ".?AV?$CAutoRelease@PAUIMigRegistryNavigator@@@Mig@@",
        "SPGetWIMImageInfo",
        ".?AU?$ICollection@PAVCOperationResult@@@UnBCL@@",
        ":(:T:a:",
        "IMAGE\\WINDOWS\\VERSION\\BUILD",
        "?IsDriveLetterOrUncPrefix@Path@UnBCL@@SGHPBVString@2@@Z",
        "SPGetDiskImageNumber: Failed to open disk image handle (0x%08x)",
        "303M3X3_3m3t3z3",
        "0$0:0K0W0c0o0|0",
        "t.Wh,",
        "Failed to create create {bootmgr} object. Status = [%x]",
        "\\IA64",
        "currentOCStatus",
        "=$=/=9=>=K=S=Z=d=v=",
        "ERROR_DS_COMPARE_TRUE",
        "9%9*9>9Z9v9",
        "0 0h0+121G1",
        "%hs: Malformed driver package info found in %s. Line: %s",
        "ZwDeleteBootEntry",
        "ReadMetaDataFile",
        "3 3)3A3N3S3^3k3",
        "70787>7K7]7k7x7",
        "ERROR_SXS_DUPLICATE_TLBID",
        "5\"545<5B5O5a5o5",
        "2(2<2Z2{2",
        ";+;H;t;",
        "0.0<0J0X0f0t0",
        "9-9;9O9f9m9",
        ".?AU?$IEnumerator@UPartitionInfo@?1??SPGetPartitionOrdinal@@YGJPAUIPartition@SetupPlatform@@PAK@Z@@UnBCL@@",
        "PWVhg",
        "SmVirtDiskPooledDiskEnumerator::GetNext: Failed to advance internal enumerator (0x%08x)",
        "void __thiscall UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *>::Insert(int,class CDeviceIdDatabase::CDeviceInfoData *)",
        "(%lx): Failed to create full path for destination key.",
        "    Version Date: %s",
        "CSkipBootValidator::ValidatePreExecution",
        "const struct DISK_SPACE_IMPACT *__thiscall UnBCL::ArrayList<struct DISK_SPACE_IMPACT>::GetBuffer(int) const",
        "void __thiscall UnBCL::ArrayList<struct DiskLayout::Partition>::RemoveAt(int)",
        "%hs: Parent's system state does not allow for more requests to be queued. Current state is %d",
        "=#=.=<=v=",
        "SysprepSession::Execute: Error loading action XML file %s, XmlException message: %s",
        ".HTREE\\ROOT\\0",
        "ValidateInput",
        "717R7e7l7t7{7",
        "SVhl<",
        "7&7E7l7",
        "Version",
        "SPTaskRemoveSnapshot: Query Snapshot size state",
        "5C5M5",
        "WPh(1",
        "8!8.8E8_8v8",
        "=#=.=B=c=x=",
        "787Q7",
        "4P5U5Z5h5",
        "CDownloadDUUpdates::MarkDirectory",
        "0o0}0",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@E@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        ";\";*;4;;;A;F;Q;`;e;y;",
        "CSysprepSpecializeOffline::DoExecute: SPGetOSInformation failed with for new OS with error: 0x%08X",
        "Password",
        "CDeploymentProject::CreateVHDDeployment: Failed to get new system log path. Error: 0x%08X",
        "%hs: Scratch folder %s available, will evaluate required copy operations.",
        "=4>K>W>f>n>x>",
        "Source is a compact OS",
        "?)?8?A?G?T?Z?_?",
        "6 6%696r6",
        "2:2X2g2",
        "ERROR_ACPI_ERROR",
        "IoTEnterpriseS",
        "en-us",
        "<G<Y<a<g<t<",
        "Failed to move drivers to driver store. Error: 0x%08X",
        "DiskLayout::Create: Failed to identify target disk from description (0x%08x)",
        "4(484H4X4h4l4|4",
        "7F7Q7_7m7{7",
        "1*1G1\\1z1",
        "4$4,444<4D4L4T4\\4d4l4t4|4",
        ".?AV?$SerializableBase@VCValidateSafeOS@@$0A@V?$DefaultInstanceFactory@VCValidateSafeOS@@@UnBCL@@@UnBCL@@",
        "pVdsDoAsyncWait: Failed to wait for %s (0x%08x)",
        "8$9X9",
        "enum MIGSTATUS __stdcall SPValidateTrackedContent(class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,int *,int *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *> **,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *> **)",
        ".?AVCDUImageInfo@@",
        "fclose",
        "class OC::CCmdLineExecutionTelemetryData *__thiscall UnBCL::_::ArrayListEnumerator<class OC::CCmdLineExecutionTelemetryData *>::get_Current(void) const",
        "VdsPartition::SetType: Couldn't get disk object (0x%08x)",
        "pSPRemoveSourceHardlinks",
        "JET_wrnNoIdleActivity",
        ".PAVCXXXXXTemp@?EC@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "0.0>0E0K0P0[0h0p0v0{0",
        "2 20242D2H2X2\\2l2p2",
        "7\"7'72797>7R7o7",
        "es-GT",
        "ShutdownAfterInstallation",
        "Apply EAs for %s",
        "NtReadFile",
        "Creating Crashdumpenabled reg value failed with error 0x%08X.",
        "CDownloadDUUpdates::MoveOrCopyUpdates: Cancelled. hr = 0x%x",
        "int __thiscall UnBCL::ArrayList<struct UnBCL::ISerializable *>::LastIndexOf(struct UnBCL::ISerializable *,int,int) const",
        ".PAVCXXXXXHandledException@?2??SaveTelemetryFields@CReconstructOS@@IAEXKK_N@Z@",
        "SL_E_SFS_TOKEN_SIZE_MISMATCH",
        "SetupFindNextLine",
        "9$9@9D9H9L9T9X9\\9`9p9",
        "4:4^4p4x4~4",
        "CNewSystem::QueueOperations",
        "9 9(9.9;9M9[9",
        ".?AU?$IDictionaryEnumerator@W4OP_OPERATION_ID@@H@UnBCL@@",
        "8/8?8E8",
        "ERROR_SETMARK_DETECTED",
        "MSWIN4.1",
        "void __thiscall UnBCL::ArrayList<class CGlobalPathFindData *>::QuickSort(class UnBCL::ArrayList<class CGlobalPathFindData *> *,class UnBCL::ArrayList<class CGlobalPathFindData *> *,int,int)",
        "ERROR_DS_CONSTRAINT_VIOLATION",
        "..\\inf\\setupapi.setup.log",
        "void __thiscall UnBCL::Array<struct SetupPlatform::IPartition *>::Remove(struct SetupPlatform::IPartition *)",
        "D$XSVW3",
        ".?AU?$IList@PAUPageFileDesc@@@UnBCL@@",
        ";(;<;P;d;x;",
        "<1<K<^<e<k<p<{<",
        "%d.DataSourceID",
        "7'888\\8",
        "SL_E_MISSING_OVERRIDE_ONLY_ATTRIBUTE",
        "Cannot modify the state of OCs on downlevel systems",
        "4'4>4k4r4x4}4",
        "6&6-63686C6M6a6h6n6s6~6",
        "DriverSafeOSMigrateFailureIgnoredList",
        ":4;B;H;N;b;h;r;x;~;",
        ".?AU?$IList@PAVCOperationInfo@@@UnBCL@@",
        "\\$ ;E",
        "?T?[?k?p?",
        "Failed to open recovery store %ws. Status = [%x]",
        "ERROR_DS_NON_BASE_SEARCH",
        "%hs: Cannot set value indicating boot entries are handled. Error: 0x%08X",
        "6$6*6>6G6O6b6x6",
        "class CDrvStoreProperty **__thiscall UnBCL::ArrayList<class CDrvStoreProperty *>::GetBuffer(int)",
        "%hs: Failed to save the default boot entry",
        "Global\\OneSettingQueryMutex",
        "Failed to set sku assembly environment variable.",
        "base\\ntsetup\\setupplatform\\lib\\automation\\devicelayout.cpp",
        "%hs: Call to commit FVE changes failed, the error code is 0x%x",
        "Failed opening source Removed FOD Markers key",
        "ERROR_TM_VOLATILE",
        "#0<0O0h0}0",
        "=\"=D=P=\\=t=",
        ":5;`;g;m;r;};",
        ".didat$2",
        "SVhh>",
        "9$9*9/9:9E9Y9q9",
        ".?AV?$SmartPtr@U?$IEnumerator@PAG@UnBCL@@@UnBCL@@",
        "03041H1V1",
        "GetFullPathNameW",
        "353?3P3j3",
        ";%<+<1<7<=<C<e<k<q<w<}<",
        ">%>3>K>R>Y>`>g>n>t>",
        ".?AVSingleHiveUnloader@@",
        "6 6+6:6A6G6L6W6g6{6",
        "SP_AVAILABLEDISKSPACE_INFO",
        "ConfigureTelemetryOptInChangeNotification",
        "Failed copying configuration key",
        "1(1<1J1V1j1|1",
        "Failed to copy bootmgr object data. Status = [%x]",
        "ERROR_FSFILTER_OP_COMPLETED_SUCCESSFULLY",
        ".PAVCXXXXXHandledException@?BG@??GetAnswerFileContentsAsUnattend@@YGPAVString@UnBCL@@PBG0K@Z@",
        "5 5=5V5d5s5|5",
        "1D1g1",
        "%windir%\\WinSxS\\Reserve.tmp",
        "<4=;=A=F=Q=\\=a=u=}=",
        "CUntagSourcesFolder::DoExecute: [%s] is not tagged",
        "xpSetTaskActions",
        ".?AU?$ICollection@V?$DictionaryEntry@KPAUIVdsDisk@@@UnBCL@@@UnBCL@@",
        "CEnableSafeOSPageFile::DoExecute: Will continue, but kernel-mode crash dumps may not be captured",
        "343=3F3\\3",
        "6!656I6`6h6n6",
        "FilterAttach",
        "=/>6><>A>L>V>i>",
        "D$4QPW",
        "f;4At",
        "2>2W2^2e2k2w2",
        "j?Zf9TH",
        "6;6N6U6[6`6k6x6",
        "6,6?6X6m6",
        "CRefreshLocalizedString::DoExecute",
        "r.;T$",
        "<&<><",
        "4!4)434:4@4E4P4^4c4w4",
        "WaitForSingleObject",
        "2@3c4",
        "(%lx): Failed to query key [%ws]",
        "SVhH$",
        "GetAnswerFileContentsAsUnattend: - %s",
        "8$8D8L8T8`8",
        ":\";w;",
        "SPDoEndInstallApply",
        "4\"4'41484F4X4i4p4",
        "RollbackBsdSummary",
        "<#<B<W<a<n<",
        "162C2P2a2w2",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::RemoveAt(int)",
        ">8>|>",
        "7!7.7:7L7Q7]7o7w7",
        "Data Upgrade",
        ".arm64",
        "RecoveryDestination",
        "CFastDeleteImplT<class CDirectoryProviderT<class CWindowsOldAdaptor>,1>::DeleteFileW",
        "Failed to create reserved space file",
        "7+7?7O7\\7m7",
        ".?AUIUserProfileEnumerator@SetupPlatform@@",
        ":3:E:M:S:g:m:v:",
        "1!151P1k1p1",
        "void __thiscall UnBCL::ArrayList<struct DiskLayout::Partition>::CopyTo(class UnBCL::Array<struct DiskLayout::Partition> *,int) const",
        "454r4",
        "<$=K=X=a=r=",
        "3$3L3q3",
        "GetVirtualDiskPhysicalPath",
        ">3?Z?n?",
        "5\"5+5A5K5`5r5z5",
        "Offset",
        "y\"SVh|",
        "Remove System Restore checkpoints",
        "APPXRemovedList",
        ">$>*><>M>[>r>",
        "627M7k7w7",
        "void __thiscall UnBCL::ArrayList<class COperation *>::Insert(int,class COperation *)",
        "sr-BA-Cyrl",
        ">'?<?Z?f?x?",
        "0 0D0L0T0\\0d0l0t0|0",
        "WSSSSSSQSP",
        "u*VjKh",
        "ERROR_CANT_DISABLE_MANDATORY",
        ".?AVCXXXXXHandledException@?2??DoExecute@CSetProductKey@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "CRYPT_E_PENDING_CLOSE",
        "0)0S0|0",
        "CNewSystem::QueueAddLanguagePackages",
        "VdsPartition::GetVolume: Couldn't get volume object for partition (0x%08x)",
        "707R7Y7g7n7t7y7",
        "9=9p9",
        "DiskLayout::ParseSizeString: Unrecognized byte unit: %s",
        "4$4,4:4B4L4[4c4p4",
        "PSj@j",
        "8,8S8]8i8u8",
        "424;4D4M4V4_4h4q4z4",
        ">(>^>",
        "3A3f3{3",
        "OSRollbackService::CCheckpoint::MoveOrCopyFiles: Exception occurred while retrieving log files",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCOperationInfo@@@UnBCL@@@UnBCL@@",
        "\\GLOBAL??\\",
        "Global\\OOBE_MACHINE_NAME_DONE",
        ";b;i;o;t;",
        "class CDeviceIdDatabase::CDeviceInfoData *const &__thiscall UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *>::get_Item(int) const",
        "FOD Validator: Failed to Get Capabilities using DISM API. Error: %08X",
        "ERROR_DS_CANT_WITH_ACCT_GROUP_MEMBERSHPS",
        "IMaintenanceSettings::put_Deadline failed. hr = 0x%x",
        "ERROR_DS_NO_SUCH_OBJECT",
        "RtlAreBitsClear",
        "CDUClientAppInfo::CDUClientAppInfo: Failed to get DU client architecture for file %d. hr = 0x%x",
        "    FAiled to write metadata start element",
        "\\??\\GLOBALROOT",
        "WinReSetupBackupWinRE",
        "2!2N2S2X2d2",
        "void __thiscall UnBCL::Array<class CBasicEnvEntry *>::Insert(int,class CBasicEnvEntry *)",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCPartitionInfo@@@UnBCL@@@UnBCL@@",
        "0(080H0L0\\0`0p0t0",
        "::;A;G;L;W;i;q;w;",
        "<%<9<I<R<Z<e<m<w<~<",
        ".?AVCXXXXXHandledException@?JI@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "SL_E_INVALID_RUNNING_MODE",
        "5)525Q5b5n5z5",
        "?\"?.?:???H?N?[?l?y?",
        ".?AV?$CAutoRelease@PAVSmPoolDisk@@@RAII@@",
        "7`7g7m7r7}7",
        "Copy appx package payload from %s to %s",
        "WinPE",
        "jdYQj",
        "ERROR_CSCSHARE_OFFLINE",
        "000D0L0T0\\0d0|0",
        "='=S=h=o=u=z=",
        "ERROR_EVT_INVALID_EVENT_DATA",
        "9!959;9D9Z9g9y9",
        "7&7:7F7Z7e7",
        "GetLogicalDrives",
        "3(313@3X3^3p3}3",
        "6<6A6Z6a6",
        "Expected provided path \"%ws\" to start with %ws",
        "Cannot create log restore file %s. Error: 0x%08X",
        ".?AV?$DefaultInstanceFactory@VCPrepareRecoveryImage@@@UnBCL@@",
        "CTrustSafeOS::DoExecute: Successfully verified and added trust for %s",
        "void __thiscall UnBCL::ArrayList<struct DiskMatchFilter>::CopyTo(class UnBCL::Array<struct DiskMatchFilter> *,int) const",
        "9 9D9T9\\9d9l9t9|9",
        "(0T0f0n0t0",
        ".?AV?$Hashtable@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@",
        "  Target Architecture: %x",
        "int __thiscall UnBCL::ArrayList<struct SetupPlatform::IPartition *>::IndexOf(struct SetupPlatform::IPartition *,int,int) const",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@K@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "f9FHu",
        "RtlGUIDFromString",
        "1*11171<1G1P1d1",
        ".?AVCXXXXXHandledException@?CCB@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "Exception trying to create a profile for user.",
        "jRj_j",
        ";_$}+",
        "FileTimeToLocalFileTime",
        ">;?M?U?[?d?",
        "VdsDisk::CreatePartition: MBR type not supported on non-MBR disk",
        "WNetCancelConnection2W",
        "ERROR_INVALID_PASSWORDNAME",
        "8!8(8Q8`8q8x8",
        ".?AV?$SmartPtr@U?$IDictionaryEnumerator@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@@UnBCL@@",
        "7*7>7R7Z7j7y7",
        "(%lx): Failed writing boot number to boot entry recovery file.",
        "DiskLayout::ApplyProperties: Received unexpected filesystem type %u",
        "JET_errUnicodeTranslationFail",
        "2)3c3",
        "Error while disabling service. Error: 0x%08X",
        "upgrade_frmwrk.xml",
        "3\"444<4B4K4a4v4",
        "4'4,474B4H4\\4p4",
        "ERROR_CLUSTER_INVALID_NETWORK",
        ">!>3>A>e>",
        "SL_E_CHPA_INVALID_PRODUCT_DATA",
        "CDeviceIdDatabase::SelectInstallableInfs: Failed to get enumerator for installable inf paths in %s.",
        ";#;+;1;5;E;I;N;W;[;`;i;m;r;{;",
        "WinREPhaseStartTime",
        "2!252N2V2]2g2",
        ".?AV?$CAutoRelease@PAUIWbemLocator@@@RAII@@",
        "CNewSystem::QueueInstallDynamicUpdates: Failed to add safe OS dynamic update operations; hr = 0x%x",
        "JET_errDatabaseInvalidPath",
        "<.<j<",
        ".PAVCXXXXXTemp@?MA@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "CSetupPlatform::StartTelemetryCan't create folder %s",
        "<$<1<9<?<S<[<",
        ".?AV?$SmartPtr@U?$IEnumerator@V?$DictionaryEntry@KPAUIVdsVDisk@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "Index of element to remove exceeds number of the element.",
        "SPAPI_E_INVALID_INF_LOGCONFIG",
        "trVVVVh",
        ">/?`?",
        "3 3(3,34383@3D3H3L3P3T3X3\\3`3d3h3l3p3x3|3",
        "diagerr.xml",
        "dExternalRollback",
        "Get NULL at %d-th paths",
        "4(4.4S4Y4c4v4",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> > const *,struct __POSITION * const &)>::Reset(void)",
        ";&<K<",
        "GetAnswerFileContentsAsUnattend: Failed to serialize answers to an unattend file: 0x%08x",
        "ERROR_UNKNOWN_PRODUCT",
        "VdsVolume::EnumerateMountPaths: Failed to create mount path enumerator (0x%08x)",
        "}.Vh0",
        "Error while copying additional migration XMLs.",
        "2 2,242R2",
        "WinReHashBootApp",
        "SmPartition::Resize: Can't read resize bounds (0x%08x)",
        "9 9'929@9",
        "GetMessageW",
        ":U:o:u:",
        ".PAVCXXXXXHandledException@?2??DoExecute@CSysprepSpecializeOffline@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "9+9=9E9K9X9j9",
        "878V8",
        "576A6W6|6",
        "CApplyDrivers::DoExecute",
        "SPTurnOffStorageReserve: Turn off %sreserves",
        "IVdsDiskPartitionMF",
        "6#656F6S6[6m6u6{6",
        "<2=p=",
        ".?AV?$DefaultInstanceFactory@VCMergeWIM@@@UnBCL@@",
        "5 5.565<5P5[5a5n5{5",
        "JET_errPatchFileMissing",
        "9%9B9I9R9X9s9",
        "WpxResetDeplSettings",
        "QQSVW",
        "(%lx): Error re-opening excluded hive file [%ws]",
        "RPC_S_INVALID_BINDING",
        ">(>4>S>c>",
        "SclRegProcessUpgradeRegistryOnline",
        "0,040;0R0Y0_0d0o0{0",
        "Found matching disk and vdisk objects for disk number %u",
        "COperationQueue::GetDiskSpaceNeeded",
        "4!414Y4q4",
        "Update",
        "2Y2a2n2}2",
        "GetSystemDiskNumber: Couldn't open NT dir [%s]; status = 0x%x",
        ".PAVCXXXXXTemp@?3??DoExecute@CBackupRecoveryPartition@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "JET_wrnNoWriteLock",
        "1-1G1Q1Z1d1{1",
        "CSetupAutomation::ResolveTarget: Failed to refresh cached target info: 0x%08x",
        "%hs: Number of file names found: %d",
        "303H3M3d3y3",
        "j-[f9\\0&",
        ">(?.?4?:?@?F?L?R?",
        "2%2*252G2O2U2i2}2",
        "PAGEuE",
        "9,9Q9g9",
        "JET_errOutOfSequentialIndexValues",
        "3`5h5m5s5",
        "struct DiskMatchFilter __thiscall UnBCL::_::ArrayListEnumerator<struct DiskMatchFilter>::get_Current(void) const",
        "CSetupPlatformOSSwitchCheckpoint: Failed to restore the WIMBoot partition.",
        ":$;\\;",
        "Ignoring error due to operation configuration.",
        "(%lx): Failed to find loaded hive path for key: [%ws]",
        "CAddBootEntry: Failure while adding the boot entry. Error: 0x%08X",
        "ERROR_DS_CANT_REMOVE_CLASS_CACHE",
        "Hive [%ws] changed only after boot; will get the changed keys list.",
        ".?AU?$IEnumerator@PAUISerializable@UnBCL@@@UnBCL@@",
        ".PAVCXXXXXHandledException@?2??Parse@CInfFile@@IAEJXZ@",
        "RPC_S_INVALID_STRING_UUID",
        "<C<S<",
        ">J>u>",
        "3&4[4",
        "jHYf9",
        "ERROR_TRANSACTION_PROPAGATION_FAILED",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCWIMBootData@@@UnBCL@@@UnBCL@@",
        "6c7v7",
        "Created new boot entry 0x%x",
        "ERROR_CTX_MODEM_RESPONSE_VOICE",
        "Skipping folder %s since it's available on the media",
        "ERROR_TRANSACTION_FREEZE_IN_PROGRESS",
        "0#00060;0]0i0{0",
        "Attempting to remove the drivers folder %s",
        "int __thiscall UnBCL::ArrayList<class COSPieceInfo *>::IndexOf(class COSPieceInfo *,int,int) const",
        "1?2Q2Y2_2l2~2",
        "0*0B0Q0f0m0s0x0",
        "PQQhH",
        "FveCommitChanges",
        "ERROR_EVT_FILTER_INVARG",
        "6'6/696J6W6\\6e6v6",
        "Failed to set element system root. Status = [%x]",
        ">E>e>",
        "ERROR_SXS_INCORRECT_PUBLIC_KEY_TOKEN",
        "QQQQQQP",
        "FOLDERID_Playlists",
        "ZwFlushKey",
        "SetupPlatform: Phase \"WinPE\" phase completed successfully. Exiting.",
        "<$<0<?<D<P<\\<k<p<|<",
        "Virtual",
        "Successfully restored (by recursive copy) hive content for [%ws]",
        "ERROR_EVT_INVALID_PUBLISHER_NAME",
        "pGetProvisioningPackagePayload: Failed to get element enumerator for provisioning package. Error: 0x%08X",
        "414G4~4",
        "BatteryIsOnAC",
        "base\\ntsetup\\setupplatform\\lib\\util\\driverselection.cpp",
        "6*6<6J6n6",
        "Failed initiating changes",
        "failed to allocate string to format: %S",
        ".?AV?$KeyCollection@PAVString@UnBCL@@H@_@UnBCL@@",
        ">$>,>4>@>`>h>p>|>",
        "><>F>O>Y>h>v>",
        "CSetupAutomation::Clone: Failed to reinitialize COM: 0x%08x",
        "8 8^8p8x8",
        "Interruption requested - Build volume hierarchy.",
        "6!696@6F6K6V6f6n6t6",
        "4%464J4j4r4y4",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SPP",
        "%hs: Unable to get temp path. Error: 0x%x",
        ">\">)>2><>I>W>d>",
        ";1;D;K;R;];n;v;|;",
        "2+3W3k3z3",
        "<%<3<F<T<]<w<",
        "868\\8b8s8",
        "Failed to copy components information",
        "PVWhy",
        "{FFB3D7EA-0215-463C-9767-4767F5E4AB77}",
        "$(runtime.windir)",
        "VdsPartition::GetResizeBounds: Couldn't query partitions (0x%08x)",
        "class OC::COptionalComponent *const &__thiscall UnBCL::ArrayList<class OC::COptionalComponent *>::get_Item(int) const",
        ".?AVCXXXXXHandledException@?GK@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "CSetupPlatform::MoveTelemetry: Failed to move telemetry to [%s]; hr = 0x%08X",
        "void __thiscall UnBCL::Array<class CDrvStoreProperty *>::Insert(int,class CDrvStoreProperty *)",
        "='=;=I=",
        "3<3_3",
        "5 5(50545<5D5H5P5T5X5\\5d5h5p5t5x5|5",
        "210317011459Z0",
        "FOLDERID_SkyDriveDocuments",
        "MatchingDeviceId",
        "8\"8-888H8Q8Z8o8x8",
        "%hs: Cannot open the external store from %s. Error: 0x%08X",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCProfileInfo@@@UnBCL@@@UnBCL@@",
        "Setup",
        "LDM data partition",
        ":+:=:[:g:y:",
        "SetLastError",
        ".?AVCTrustSafeOS@@",
        ">&>u>",
        "5*52585E5W5e5",
        "3L3T3k3",
        ":%:+:8:J:X:q:x:",
        "4(4C4J4P4V4a4k4p4",
        "2)3C3X3`3f3s3",
        ";];<<",
        ">*>B>I>O>T>_>j>",
        "ERROR_TIME_SKEW",
        "ERROR_ICM_NOT_ENABLED",
        "void __thiscall UnBCL::ArrayList<class ISPPluginData *>::QuickSort(class UnBCL::ArrayList<class ISPPluginData *> *,class UnBCL::ArrayList<class ISPPluginData *> *,int,int)",
        "2,242<2T2",
        ".?AVCXXXXXHandledException@?GD@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "9?9U9_9h9r9",
        "it-IT",
        "OC::CCryptoUtil::IsFileMicrosoftTrusted: The given certificate chain cannot be verified",
        "CMoveWIMBootEntriesAndPartition::DoExecute",
        "F$;G$u",
        "MIG_ENABLE_DIAG",
        "%hs: Window %s does NOT exist",
        "Onesettings: Failed to get app version info: 0x%x",
        "AlwaysRestartDiagTrack",
        "D$0Pj",
        "D$0;D$(",
        "MigCreateIMGStore",
        "7$717C7\\7{7",
        "ERROR_DS_GCVERIFY_ERROR",
        "6/676L6U6[6h6z6",
        "L$ VW",
        "SKIPBOOTTRACK(SAFEOS): Failed to increment boot removal attempts. Error = 0x%08X",
        "PWVh:",
        ".?AVResultException@wil@@",
        "?Equals@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHPBVObject@2@@Z",
        "434?4I4s4|4",
        ">O>n>",
        ".PAVCXXXXXTemp@?3??SPDeletePartition@@YGJH_K@Z@",
        ";=;a;",
        "<(<6<W<e<m<z<",
        "4%4,4=4E4R4`4j4w4",
        "\\\\.\\Root\\Microsoft\\Windows\\Storage",
        "ERROR_DS_GENERIC_ERROR",
        "CSysprepRespecialize::DoExecute",
        "OC::CCmdLineManager::GetCmdLinesFromRegistryKey",
        "        SMI: %d",
        "6*7H7O7Z7a7~7",
        "DSVW3",
        "Could not Open SCM. Error: 0x%08X",
        "pSPStartAutoStartingServices: Failed to open SC_OOBE_MACHINE_NAME_DONE event. Error: 0x%08X",
        "%hs: Failure while gettting content for %s",
        ">b>~>",
        "2 242<2D2L2T2\\2d2l2t2",
        "Not able to find any qualified language pack package to install, store corrupted, please wait for the next major update.",
        "(0/0>0U0[0",
        "7:7L7T7Z7g7y7",
        "OSRollbackService::CSetupRollbackService::RollbackReinitialize",
        "363l3",
        "Auto-unlock was configured successfully, will not suspend protection on the OS volume",
        "RPC_S_MAX_CALLS_TOO_SMALL",
        "%hs: System state does not allow for current operations to be executed. Current state is %d",
        ">)>/><>N>\\>t>y>",
        "7,747v7",
        "CSetupAutomation::Initialize",
        "%hs: Disk is encypted and protection and active",
        "9%9;9W9n9y9",
        "Execute.PostRollback",
        "pLogUpdateInfo: IUpdate::get_Description failed. hr = 0x%x",
        "pEnumExternalFilesCallback_2",
        "JET_errPermissionDenied",
        "%s+%s+%s",
        ".?AVCExtractFilesFromWDSImage@@",
        "ERROR_DELETING_ICM_XFORM",
        "CoGetMalloc",
        "SetFileSize failed",
        "9.:@:H:N:[:m:{:",
        "Creating crash control key failed with error 0x%08X.",
        "SPApplyStandardDiskConfig: Aborting at step %u due to cancellation",
        "8%8x879`9",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::IndexOf(class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *,int,int) const",
        "4 4$4(4,4044484<4@4H4P4T4X4\\4`4h4l4p4t4|4",
        "SP_RETRY_INFO",
        "fr-CM",
        "fltlib.dll",
        ">:>H>}>",
        "3%363O3\\3c3i3n3y3",
        "    Failed to copy package path string",
        ": :(:U:k:r:x:}:",
        "FastCleanupTelemetryResult",
        "TlP0X",
        "7)7.7C7[7t7",
        "9#:d:",
        ":::]:k:",
        ".?AV?$Array@UDiskMatchFilter@@@UnBCL@@",
        "8(8G8`8g8n8u8|8",
        "Failed to allocate string to format: %S",
        "f9~bu",
        "&PWSV",
        "=(=1=>=C=L=S=`=l=u=",
        "    User Profile: %s",
        "ERROR_DRIVER_BLOCKED",
        "kl-GL",
        "%hs: Window %s exists",
        "9U9z9",
        "1-1B1H1Z1x1",
        "MIG Validator: Completed validation of apply operations:",
        "Evaluating NGEN inner folder %s",
        "Failed to write offline user migration to %s. Error: 0x%08X",
        "%hs: Error while setting uninstall window value: 0x%08X",
        "int __stdcall pSupportsCompression(class UnBCL::String *)",
        ":):4:@:J:\\:d:j:t:~:",
        "5$5*575I5S5h5p5v5",
        "VdsVolume::GetProperties: Failed to get volume name from mount point %s (0x%08x)",
        "3!30373D3K3b3i3",
        "\\\\?\\%ws%ws",
        ".?AVCProvPackageLogger@@",
        "CSetupPlatformCheckpoint::CopyLogFiles: An error occurred while processing the SCM log folder",
        "$0P0b0j0p0}0",
        "6%6+6?6H6U6_6f6l6q6|6",
        ";&;4;K;a;",
        "xKG;}",
        "? ?$?4?8?H?L?\\?`?p?t?",
        "|$(+|$0",
        "2*3B3I3O3T3_3i3x3",
        "PayloadEnumerator::GetNextPayloadPath",
        "DriverPackageGetVersionInfoW",
        ".?AV?$DefaultInstanceFactory@VCEnableNewOSPageFile@@@UnBCL@@",
        "0F0l0",
        "RpcStringBindingComposeW",
        "?Y?a?i?p?}?",
        "CMediaLayout::Execute: Failed to queue audit mode script: 0x%08x",
        "9x(uL",
        "%hs: PostMessage WM_SYSCOMMAND/SC_CLOSE to narrator wnd failed; Error:%u",
        "4&4;4C4I4R4h4v4",
        "ERROR_SXS_XML_E_BADNAMECHAR",
        "D$8QPh",
        "OC::CDownlevelOCStore::IsDetectable: Failed to parse manifest %s.",
        "__thiscall UnBCL::ArrayList<enum OP_EXECUTION_PHASE>::ArrayList(const struct UnBCL::ICollection<enum OP_EXECUTION_PHASE> *)",
        ":8:=:C:I:O:U:[:a:g:m:s:",
        "4\"414:4S4\\4m4v4",
        "PSFX_E_REVERSE_DELTA_MISSING",
        "NumberOfReboots",
        "3 3-3<3U3k3|3",
        "7e8l8",
        "9-979<9P9W9q9x9~9",
        "HARDRESERVETRACK: Available    : %I64u",
        "%hs: SPSaveWinReInformation failed. Error: 0x%08X",
        "pConnectProgressPipe",
        "5&5B5R5`5n5",
        "int __thiscall UnBCL::_::ArrayListEnumerator<struct SetupPlatform::IDisk *>::MoveNext(void)",
        ".?AU?$ICollection@V?$DictionaryEntry@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@@UnBCL@@",
        "Reserved.SecondApply.%u",
        "SclpGrowPartitionInternal",
        "5%6M6R6^6w6|6",
        "<!</<7<A<O<e<",
        "Copying folder %s to %s, size: %I64u",
        "isspace",
        "6+646E6h6y6",
        "%hs: Extracting file %s from image %s to %s.",
        "ujPVhD4",
        "BcdForciblyUnloadStore: Failed to acquire BCD sync mutant. Status: %x",
        "SmVolume::InitializeProperties: Can't query %s (0x%08x)",
        "class CDriverInfo *&__thiscall UnBCL::ArrayList<class CDriverInfo *>::get_Item(int)",
        "class UnBCL::ArrayList<class COperation *> *__thiscall COperationQueue::GetOperations(enum OP_OPERATION_ID,class UnBCL::ArrayList<class COperation *> *)",
        "XSVjD3",
        "j?_f9|B",
        "??_DRegistryKey@UnBCL@@QAEXXZ",
        "4(464|4",
        "> >8><>T>X>p>t>",
        "=[>}>",
        ">*>8>G>m>s>|>",
        "7\"7@7L7^7",
        "\\Windows",
        "7#7.757>7F7\\7z7",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *> *)",
        ".?AVCXXXXXHandledException@?M@??QueueAddAppxPackage@CNewSystem@@UAEJPBGQAPBGI_KW4SP_ERROR_HANDLING@SetupPlatform@@@Z@",
        "ERROR_INSTALL_PACKAGE_INVALID",
        "Using OEM device platform file: %s",
        "%hs: Failed to setup filters for %s-%s-%s. Error: 0x%08X",
        "0%0-0;0O0d0q0v0",
        "4#4>4E4y4",
        "ERROR_DS_UNABLE_TO_SURRENDER_ROLES",
        ";D$ uG;|$$uA",
        "3(3/3<3H3Q3^3c3l3x3",
        ".PAVCXXXXXHandledException@?BOL@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::Resize(int,int)",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::Remove(class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *)",
        "9A0vq",
        "> >$>(>,>4>X>`>|>",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::Insert(int,class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *)",
        "4!40484>4R4[4d4m4",
        "I0G1-0+",
        "7 7%707=7C7W7_7t7|7",
        "6*6I6V6]6c6h6s6~6",
        "class UnBCL::DictionaryEntry<unsigned short,unsigned short> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::GetBuffer(int) const",
        "j\\[f9\\0",
        ">'>1>J>X>a>r>{>",
        "pGetImageInfoFromSoftwareHive: Failed to get EditionID info from software hive. Error: 0x%08X",
        "3 3$3(3,3034383<3@3H3L3P3T3X3\\3h3l3p3t3x3|3",
        "0.1V1",
        "081`1",
        "0\"0-080O0",
        "GlobalPath,%d,%s,%u,%I64u,%u%s%s",
        "ERROR_BAD_RECOVERY_POLICY",
        "4!4)404<4N4c4r4|4",
        "9$9+9A9\\9b9l9q9{9",
        "WimMoveFile",
        "2 2024282<2@2H2L2P2X2\\2d2h2l2t2x2",
        "The last modified time of file [%s] has changed",
        "Moving rollback directory %s to %s",
        "void __thiscall UnBCL::_::ArrayListEnumerator<struct PageFileDesc *>::Reset(void)",
        ">1>8>?>F>M>T>Z>d>",
        "Part length: %I64u",
        "6*6<6D6J6W6i6w6",
        "RQh z",
        "<#<5<S<Y<t<",
        "Failed to commit WIM changes. Error: 0x%08X",
        "4,5I5",
        "7\"7'72797M7a7r7",
        "FOD Validator: Failed to build FoD list, will remove validator. Error: %08X",
        "SL_E_TOKSTO_NO_PROPERTIES",
        "f@f#E",
        "CFODValidator::CheckContainment",
        "void __thiscall UnBCL::ArrayList<class CBasicEnvEntry *>::QuickSort(class UnBCL::ArrayList<class CBasicEnvEntry *> *,class UnBCL::ArrayList<class CBasicEnvEntry *> *,int,int)",
        "4&4-4;4K4P4g4n4|4",
        "XIncomplete",
        "9.:::U:\\:h:",
        "BcdOpenObject for the new OS entry failed. Status = %d",
        "xStackCaching",
        ";*;5;A;^;i;u;",
        ".?AVCXXXXXHandledException@?CB@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        ".?AVCXXXXXHandledException@?2??Initialize@CCFGSectionRegistry@@UAEJXZ@",
        "Reason",
        "\\\\?\\PhysicalDrive",
        "CloseHandle",
        "2+232:2@2E2M2Z2`2u2~2",
        "7!8,818O8f8m8x8}8",
        "=&=5=:=F=M=]=i=u=",
        "Error removing SR checkpoint %u. Error: 0x%08X",
        "5B6r6y6",
        "Number of registry values processed",
        ".?AV?$CAutoRelease@PAUIDiskPlatform@@@RAII@@",
        "DiskLayout::FindTarget: Failed to select disk for criterion: 0x%08x",
        "4\"4H4i4w4",
        "> >.><>J>U>`>k>v>",
        "Failed to concat string.",
        "<,=S=",
        "6\"60656I6d6",
        "(%lx): Failed to acquire needed privileges",
        "SETUPPLATFORMCOMM: Cannot start connecting thread. Error: 0x%08X",
        "9~ ttS",
        ">[?v?",
        "WINDOWS_WCP_INSKUASSEMBLY",
        "5\"6)6/646?6J6^6y6",
        "class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::get_Item(int)",
        "3#3*383?3E3J3U3`3f3k3",
        "6\"626;6Z6`6h6",
        "; ;@;I;T;[;",
        "VERBOSE: Percents for finalize: %d%% -> %d%%",
        "ERROR_OLD_WIN_VERSION",
        "BfsRepair: System volume too large for chkdsk. Size: %llu MB Max: %llu MB",
        "<(<=<T<`<u<",
        ":*:U:c:w:",
        "Comment",
        "JET_errInvalidOnSort",
        "7@7\\7|7",
        ".?AV?$SmartPtr@V?$DictionaryEntry@PAVString@UnBCL@@PAV?$ArrayList@PAVCDriverDetails@@@2@@UnBCL@@@UnBCL@@",
        "0/0Z0g0",
        "3 3$34383H3L3\\3`3p3t3",
        ":0H0e0",
        "??0InvalidCastException@UnBCL@@QAE@XZ",
        "9=9l9~9",
        "jeYf9L0",
        "DismShutdown hr = 0x%x",
        "PWSho",
        "8;9e9",
        "<\"=6=H=P=V=_=u=",
        "class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::get_Item(int) const",
        "j6j]h",
        "na:UseAllSpace",
        "%hs:BcdImportStore failed, ec = [%x]",
        "9.9C9R9\\9a9i9p9|9",
        "?4?:?P?`?g?p?",
        "ERROR_DS_REFERRAL",
        "9\"969M9",
        "Driver package %ws missing or corrupt (Err = 0x%lx)",
        "%s is %s",
        "void __thiscall UnBCL::ArrayList<class CFileCreationData *>::RemoveAt(int)",
        "2&2,2>2M2j2p2",
        "7*727?7Y7u7",
        "SecObjectSDProcessCount",
        "PeakDiskSpaceNeeded",
        "14181P1T1l1p1",
        "SetupPlatform: Executing post-OOBE StopAsync commands",
        "8$8-858M8e8{8",
        ":2:B:Q:c:",
        ".?AV?$HTDictEnumBase@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@_@UnBCL@@",
        "020H0f0m0s0x0",
        "7 727c7",
        "Failed to delete snapshot group %s. hr = 0x%x",
        ".PAVCXXXXXHandledException@?BF@??QueueAddDriver@CNewSystem@@QAEJPBG000W4SP_ERROR_HANDLING@SetupPlatform@@@Z@",
        ":!:.:6:@:H:W:_:m:u:",
        "Execute provisioning migration",
        "CSetupPlatformOSSwitchCheckpoint::Rollback: Folder \"%s\" cannot be removed.",
        "CExecuteUnattend::DoExecute: Couldn't clean up unattend context: 0x%08x",
        ".PAVCXXXXXTemp@?LB@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "Out of memory",
        "SL_E_USE_LICENSE_NOT_INSTALLED",
        "t<Qj{jT3",
        "Enable Etw file %s",
        "8,838=8N8[8e8t8}8",
        "Failed to write rollback directory to %s. Error: 0x%08X",
        "Failed open newly loaded key %ws. Flags: 0x%x Status: %x",
        "Microsoft.Windows.BootFileServicing",
        "SysprepSession::ExecuteInternal: Error in execute actions for %s; dwRet = 0x%x",
        ".?AV?$DefaultInstanceFactory@VCFileCreationData@@@UnBCL@@",
        "6K6c6t6",
        "CMergeWIM::DoExecute: Cannot load image %u in %s. Error: 0x%x",
        "<$<-<W<o<{<",
        "?ffffff",
        "<D<Z<r<",
        "UCS-4",
        "8!8/8z8",
        "7&7-747:7D7f7x7",
        "GetSizeOfWinRE: Image does not contain WinRE.wim (0x%08x). Estimating its size instead.",
        "%hs: Move Downlevel Telemetry to [%s]",
        ".?AVCXXXXXHandledException@?LA@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "676?6W6o6",
        ";*<O<_<k<",
        "OC::COCCbsAdapter::OpenCbsPackage: ICbsSession::OpenPackage failed. hr = 0x%x",
        "<&<G<v<",
        "%hs: Cannot validate tracked content for machine-independent journal. Error: 0x%08X",
        "5)555=5X5h5~5",
        "nReadBootCode",
        "?D?c?",
        ":t:{:",
        "%hs: Store object created.",
        "Local\\SM0:%d:%d:%hs",
        "DisableShiftF10 request received, will not enable Shift-F10 command prompt hotkey.",
        ";C;[;{;",
        "int __thiscall UnBCL::ArrayList<struct PageFileDesc *>::LastIndexOf(struct PageFileDesc *,int,int) const",
        ";$;,;4;<;D;L;T;`;",
        "FveAddAuthMethodInformation",
        "</<B<L<^<",
        "2&292A2n2",
        "CWin32PrivilegeT<class CEmptyType>::Done",
        "4#4;4A4S4g4t4|4",
        "GetPackageMetadata",
        "GetImageErrorCode",
        "StretchBlt",
        "CReconstructOS::SetUpCbsLogging: Failed to set HKLM\\System\\Setup WorkingDirectory: 0x%08x",
        "ERROR_DS_CONFIDENTIALITY_REQUIRED",
        "%hs: Destination file: %s",
        "5]6e6r6",
        "7#787K7]7o7w7}7",
        "Failed to set writer output",
        "9,9K9e9",
        "5&525E5L5V5f5k5t5",
        "Failed to retrieve namespace %s from server %s. Error: 0x%08X",
        "Failed to add element",
        "<&<-<4<@<d<t<{<",
        "DetachVirtualDisk",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::get_Item(int) const",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,class ATL::CElementTraits<enum ActionType> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,enum ActionType> *,class UnBCL::Array<class UnBCL::String *> *,int)",
        ":):6:N:Y:g:u:",
        "Register async process: %s with args %s",
        "Failed to delete registry [%s]. Error: 0x%08x",
        "ERROR_FILE_READ_ONLY",
        "RestoreSecurityDescriptor failed",
        "Failed to write PageFiles to %s. Error: 0x%08X",
        "SPUninitializeNetwork: Not running in Windows PE; will not try to uninitialize network",
        "4 4%404:4T4\\4p4w4",
        "6#6/6W6",
        ":-;G;Q;d;",
        "ERROR_DS_NONEXISTENT_MAY_HAVE",
        "ERROR_IPSEC_INTEGRITY_CHECK_FAILED",
        "SclpGrowPartition",
        "2\"2C2u2",
        ":H:l:",
        "CreatePath: Unable to create parent directory for [%s]; GLE = 0x%x",
        "SafeOS.Mount",
        "??0?$ICollection@H@UnBCL@@QAE@XZ",
        "Failed to set task settings. hr = 0x%x",
        "  Starting Offset = %lld",
        "int __thiscall UnBCL::ArrayList<struct PageFileDesc *>::IndexOf(struct PageFileDesc *,int,int) const",
        "_purecall",
        "070E0^0j0u0",
        "BackupProductKeyDefault",
        ".?AV?$CAutoCleanupBase@PAU_DismDriverStoreProperty@@@RAII@@",
        "8&8H8O8U8Z8e8w8",
        "=0=7=C=J=b=i=",
        "<3<|<",
        "9%909G9",
        "=C>o>t>",
        "GatherDeviceIDsInDriverPackage",
        "  Forcing reflection",
        "3 424:4@4M4_4m4",
        "u\\!|$",
        "MCDUClientAppInfo::CDUClientAppInfo",
        "{BC3BF665-02B6-4388-BEC8-E4AE07EA9D60}",
        "bootfix.bin",
        "6%6+606;6B6G6s6",
        "WIMBoot entry %I64d (%s, %d) for drive %s will not be suspended",
        "200304183039Z",
        "j:Yf9LF",
        "7*7H7O7U7Z7e7p7",
        "{B6E1C602-780B-41BC-8422-49C251654C2F}",
        "DiskLayoutMakeRecovery: Failed to create Recovery partition (0x%08x)",
        "The source ICB size is %I64u bytes; will split it",
        "RPC_S_NO_MORE_BINDINGS",
        "8)8=8Z8c8t8{8",
        "SmVirtDisk::GetProperties: Treating unrecognized resiliency setting '%s' as RESILIENCY_NONE",
        ";$;P;X;^;k;r;x;};",
        "4$4M4a4x4",
        "CMediaLayout::ExecuteOptimization: Couldn't get full path to install WIM: 0x%08x",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CDeviceIdDatabase::CDeviceInfoData *>::Reset(void)",
        "DequeueWimData",
        ".?AV?$CAutoCleanupBase@PAUIMigFileNavigator@@@RAII@@",
        "onecore\\base\\ntsetup\\lib\\unattendlog\\src\\unattendlog.cpp",
        ".?AV?$SmartPtr@V?$Hashtable@W4OP_OPERATION_ID@@H@UnBCL@@@UnBCL@@",
        "SetCheckpoint: Checkpoint(\"%s\") in progress...",
        "===X=_=g=l=|=",
        "=3=:=@=L=X=",
        "Mirror",
        "Critical",
        ":$:(:,:0:8:T:X:\\:`:h:",
        ";;<I<j<x<",
        "t$X9u t",
        "545_5s5",
        "Failed to query creation time for snapshot [%s]. Error: 0x%08X",
        "4)4X4e4}4",
        "SPAPI_E_REMOTE_COMM_FAILURE",
        "6!606M6S6e6m6s6",
        "?9?N?Z?l?x?",
        "2&232C2T2\\2u2|2",
        "1%181A1R1q1",
        ":<:p:",
        "RPSVQ",
        "ERROR_BADDB",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,int>::Add(class UnBCL::String *,int)",
        "9&959F9S9\\9o9",
        "OC::COCCbsAdapter::Release: ICbsSession finalize with required action %d.  hr = 0x%x",
        "CAddProvisioningPackage::DoExecute: Cannot register provisioning package [%s] because it resides on a different volume than the main OS [%s]",
        "WinHttpQueryAuthSchemes",
        "VdsDisk::TakeOffline: Failed to take disk offline (0x%08x)",
        ">)>4>A>I>O>c>p>",
        "void __thiscall UnBCL::ArrayList<struct UnBCL::ISerializable *>::set_Item(int,struct UnBCL::ISerializable *)",
        "2,242:2G2Y2g2",
        "3&3C3g3",
        ".?AUIDriverInfo@SetupPlatform@@",
        "Mount WIM file %s, index %d to %s",
        "UtcUploadTelemetryData",
        "PSSSSSSSSj",
        "6#6.6<6h6r6",
        "9&9.9;9O9_9h9p9w9}9",
        "ERROR_CLUSTER_SYSTEM_CONFIG_CHANGED",
        "const enum OP_EXECUTION_PHASE *__thiscall UnBCL::ArrayList<enum OP_EXECUTION_PHASE>::GetBuffer(int) const",
        ".?AV?$ArrayListEnumerator@PAX@_@UnBCL@@",
        "2$2(2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2t2x2|2",
        "=,=B=\\=c=i=n=y=",
        "swinpemem.dmp",
        "1!1,181L1[1b1h1m1x1~1",
        "101E1Q1X1f1",
        "===H=X=m=",
        "ERROR_INVALID_AT_INTERRUPT_TIME",
        "6\"60696B6K6T6]6f6|6",
        "4 4(4.4;4M4m4",
        "SizeofResource",
        "= =1=9=J=R=\\=e=x=",
        "7G7h7",
        "2,272E2J2l2s2y2~2",
        "DiskLayout::VerifyLayoutExtendedIfLogical: To create logical partitions, you must have an extended partition",
        "080T0",
        "SL_E_SFS_FILE_READ_ERROR",
        ":\":):D:T:l:s:",
        "8Z9r9",
        "RestoreHardlinks",
        "long __thiscall CSaveConfigData::DoExecute(struct IExecutionContext *,void *,struct IInternalOperationsProgress *)",
        ".?AVCUpgradeSecurity@@",
        "9%939A9",
        "SVh`k",
        "VERBOSE: Successfully created target folder %s",
        "ERROR_SOURCE_ELEMENT_EMPTY",
        "xM9sdtF",
        "6,6@6T6h6|6",
        "CAddProvisioningPackage::DoExecute: Failed to open new OS DISM session. Error: 0x%08X",
        "ERROR_DS_NO_MORE_RIDS",
        "7G8h8",
        ".?AVCXXXXXHandledException@?KC@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "?,?1?=?I?X?]?i?u?",
        "%hs: cannot convert %s to a GUID",
        "SYSPART",
        "4#454=4C4P4b4p4}4",
        "2#2)2;2K2X2j2",
        "bSSSSSS",
        ".PAVCXXXXXHandledException@?EL@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "8I9s9",
        ".?AVCXXXXXHandledException@?HJ@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "OverallResult",
        "PSVh<",
        ".?AU?$ICollection@PAV?$DictionaryEntry@KPAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "::$DATA",
        "    Failed to get metadata write temporary file",
        "0&0;0H0_0n0",
        "3!3-393E3^3",
        ":':9:C:X:`:f:s:",
        "void __thiscall UnBCL::ArrayList<void *>::AddRange(const struct UnBCL::ICollection<void *> *)",
        "9w0uz",
        "Cleaning up debugger settings.",
        "0 0*000=0V0",
        "class CShellFolderInfo *&__thiscall UnBCL::ArrayList<class CShellFolderInfo *>::get_Item(int)",
        "5\"5'5,585I5N5S5_5",
        "090T0a0p0|0",
        "=,=0=@=D=H=L=P=X=\\=`=h=l=p=x=",
        "void __thiscall UnBCL::Array<class CWIMBootData *>::InitLarva(class UnBCL::ArrayList<class CWIMBootData *> *)",
        "SmPartition::EnumerateLogicalPartitions: SM API do not support logical partitions",
        "int __thiscall UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *>::LastIndexOf(class CDeviceIdDatabase::CDeviceInfoData *,int,int) const",
        "ConvertStyle",
        "Add driver %s",
        "Failed to start stackwalk: 0x%x",
        "1$2X2",
        "ERROR_CRM_PROTOCOL_ALREADY_EXISTS",
        "tOf97tJh",
        "Failed to remove duplicate object from bootmgr display order. Status = [%x]",
        "..\\rollback\\setupmem.dmp",
        "%hs: Failed to set enhanced options for the CBS session 9. hr = 0x%08X",
        "= =1=G=N=T=Y=d=p=x=",
        ";6;>;K;\\;g;u;",
        "Failed opening target CanonicalData key",
        "5$5,545<5`5t5",
        "383>3J3R3d3k3q3v3",
        "1 1*1F1K1U1",
        "6-676y6",
        "3%31373K3Y3b3l3",
        "ERROR_DS_CANT_CREATE_UNDER_SCHEMA",
        "DiskLayout::ExecCreations: Failed to create logical partition %u",
        "-0F0M0S0X0c0i0|0",
        "5 5*51575<5G5N5b5v5",
        ".?AV?$ArrayListEnumerator@PAVCCopyInfo@@@_@UnBCL@@",
        "404d4",
        "MIG_UPGRADE_CONFIG_SCRIPT",
        "696I6P6e6{6",
        "CRestorePageFileSettings::DoExecute",
        "3,3:3D3J3W3g3n3u3",
        ".?AVCSPExecuteProgress@@",
        "=@=N=W=`=i=r={=",
        "5&565?5L5X5n5y5",
        ".vhdx",
        ";*;;;f;};",
        "9 90949D9H9X9\\9l9p9",
        "VdsPartition::SetType: Couldn't change partition type (0x%08x)",
        "JET_errDatabaseStreamingFileMismatch",
        "8\"8-8p8}8",
        "3\"3)3/343@3O3c3",
        "9#9,959>9G9P9Y9b9k9t9}9",
        "{EF1A6EBC-36A5-4CA6-97FE-EB0505545350}",
        "8&8/8O8]8s8",
        "ERROR_NOT_LOCKED",
        "1)121H1\\1j1q1w1|1",
        "class OC::CCmdLineExecutionTelemetryData *&__thiscall UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *>::get_Item(int)",
        "int __thiscall UnBCL::ArrayList<struct _GUID>::BinarySearch(int,int,struct _GUID,struct UnBCL::IComparer<struct _GUID> *)",
        "class CDeploymentBase *const *__thiscall UnBCL::ArrayList<class CDeploymentBase *>::GetBuffer(int) const",
        "CRelocateOS: Collision detected for path %s, which is one of the OS pieces.",
        "0070>0I0W0k0",
        "ERROR_TRANSACTIONAL_CONFLICT",
        "PVWQRj+",
        "Source driver is missing. Ignoring due to operation configuration.",
        "memory.dmp",
        "BCD strings MUI load failure %ws (%u).",
        "393K3`3h3",
        "SKIPBOOTTRACK(FIRST): Skip Boot Validator: First boot removal explicitly turned off.",
        "9F sN",
        "2(2<2H2O2W2g2q2~2",
        ".?AV?$CAutoRelease@PAUIVolume@SetupPlatform@@@RAII@@",
        "6 6F6",
        "7<7s7",
        ".PAVCXXXXXHandledException@?5??DoExecute@CEnableFeature@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "9/:H:M:",
        ": :):2:?:K:`:",
        "fmalloc failed",
        "f9H<uK",
        "8'878=8O8\\8s8",
        "(%lx): Recursive call failed.",
        ".PAVCXXXXXHandledException@?BE@??DoExecute@CMigrateFramework@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "Installation type: Unknown",
        ">)>@>G>M>R>]>i>",
        "SetupDiSetDevicePropertyW",
        "int __thiscall Mig::CBasicEnv::Remove(const class UnBCL::String *)",
        "9$9,9;9B9H9M9X9c9s9|9",
        "Failed to get a handle to the memtest object. Status = [%x]",
        "class CShellFolderInfo *const *__thiscall UnBCL::ArrayList<class CShellFolderInfo *>::GetBuffer(int) const",
        "7*777K7T7a7i7t7{7",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::set_Item(int,class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *)",
        "=\"=7=O=u=",
        "CDeviceIdDatabase::SelectInstallableInfs: No driver INF was found in %s.",
        "SL_E_LICENSE_FILE_NOT_INSTALLED",
        "2+2M2V2b2k2w2",
        "9 9$9(9,949X9`9d9h9l9t9",
        "<==D=_=f=",
        ":G;];z;",
        "?\"?*?0?D?J?S?i?w?",
        "enum MIGSTATUS __stdcall SPDoUninstallApply(class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::String *,class UnBCL::String *,struct ISPMigProgress *)",
        "WinReReinstall",
        ".PAVCXXXXXHandledException@?LA@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "SetupPlatform: Phase \"FirstBoot\" started",
        "Unknown FILESYSTEM_TYPE %d",
        "void __thiscall UnBCL::Array<class CCFGSectionValue *>::Insert(int,class CCFGSectionValue *)",
        "#wXsA",
        "pSPStartAutoStartingServices",
        "OC::COCCbsAdapter::CbsUpdateToOC: get update %s",
        "  Applicable: %s",
        "{B175063E-5807-4BDE-8ACB-DBE895AE25C2}",
        "%hs: Source OS Windows dir: %s",
        "6#656I6P6V6[6f6q6",
        "Cleanup thread doesn't return in a timely manner after being interrupted.",
        "6#606B6M6a6q6v6",
        "void __thiscall UnBCL::ArrayList<class CFileCreationData *>::CopyTo(class UnBCL::Array<class CFileCreationData *> *,int) const",
        "=$=,=G=M=_=s=|=",
        "CSetupAutomation::ResolveTarget: Chose target partition %u",
        "0.080B0O0X0`0w0",
        "SPLoadKey: Failed to enable required privileges",
        "\\SysWOW64",
        "ERROR_NO_TXF_METADATA",
        "1!1^1o1",
        "Failed to convert source OS GUID to string. Error: 0x%08X",
        ".?AU?$IEnumerable@PAVCRegCreationData@@@UnBCL@@",
        "DiskLayoutMakeRecovery: Only installation WIMs are currently supported",
        "%hs: Executing framework apply operation",
        "{30349D5B-03E8-497E-8346-4D9A3E99ED0F}",
        "0\"070S0^0h0x0",
        "{FEFEF1D1-6533-4578-8B69-C1DC9050EF77}",
        "ERROR_INVALID_WORKSTATION",
        "PWj@Z",
        "ERROR_DECRYPTION_FAILED",
        "50565@5E5O5V5d5v5",
        "Unknown Error",
        "SPAPI_E_UNKNOWN_EXCEPTION",
        ".PAVCXXXXXTemp@?EA@??UndoTransformers@CSetupPlatformApplyRollbackCheckpoint@@IAEJPAVString@UnBCL@@00@Z@",
        "8P8h8u8",
        "<)<8<C<R<^<y<",
        "FALSE",
        ".?AU?$ICollection@PAVString@UnBCL@@@UnBCL@@",
        "Failed to read non-exsitend output %s of call to method %s on %s (0x%08x)",
        "void __thiscall UnBCL::Array<class COperationInfo *>::Insert(int,class COperationInfo *)",
        "Failed querying ICbsSession9 interface.",
        "474I4W4^4d4i4t4",
        ".?AUIInternalOperationsProgress@@",
        "2<3f3k3{3",
        "JET_errInvalidGrbit",
        ">'?,?`?",
        "SPReportSnapshotState: Failed to query snapshot size for [%s]. Error: 0x%08X",
        "VERBOSE: MOVETRACK: Destination reparse point removed successfully.",
        "=\"=(=5=G=U=l=",
        "sma-NO",
        "Wait for work queue abandoned!",
        "SetCheckpoint: Checkpoint \"%s\" successfully set.",
        "Failed to build path to GUID folder.",
        ".?AV?$SmartPtr@U?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@H@UnBCL@@@UnBCL@@@UnBCL@@",
        "3*373A3U3b3s3",
        "SnapshotAllocatedSpace",
        "9^8s,9Fpt",
        "585X5x5",
        "4\"484E4W4_4e4n4",
        "=%=+=0=;=L=T=Z=n=w=",
        ":*;E;M;_;f;l;q;|;",
        "ERROR_CTX_SECURITY_LAYER_ERROR",
        "SP_ENV_SIMULATE_COMPACT_OS",
        "7,747:7G7Y7",
        "838:8D8K8Q8V8a8o8u8",
        "1(1:1\\1m1",
        "MEMORYTRACK: Available for op  : %I64u",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAG@Z",
        "MetadataEnumerator::CreateMetadataEnumerator",
        "9B:W:c:m:y:",
        "SmDiskPartitionEnumerator::GetNext: Failed to construct SmPartition (0x%08x)",
        "6@6p6",
        "ResurrectSetupPlatform: Not enough memory (2).",
        "y#Vh~",
        "<L<^<f<l<y<",
        ">6>e>v>}>",
        "CSetupAutomation::Save: Failed to overwrite deployment settings: 0x%08x",
        "UpdateBootCode: Failed to update backup boot code.",
        "7#7.797I7V7b7w7",
        "0'010;0R0m0~0",
        "int __thiscall UnBCL::Array<class OC::CCmdLineExecutionTelemetryData *>::Add(class OC::CCmdLineExecutionTelemetryData *)",
        "7$7=7S7d7y7",
        "SL_E_CHPA_INVALID_PRODUCT_DATA_ID",
        "%hs: Started at %.2d:%.2d:%.2d",
        "<*<3<J<X<b<k<w<",
        ".?AV?$CAutoRelease@PAVVdsPartition@@@RAII@@",
        "4 444",
        "ARP Validator: Execution of data gather operation completed.",
        "Profiles have been moved on the new system. Nevertheless, uninstall will continue.",
        ":!;P;r;",
        "<3<G<X<y<",
        "void __thiscall UnBCL::ArrayList<class CRegCreationData *>::set_Item(int,class CRegCreationData *)",
        "ERROR_DS_DS_REQUIRED",
        "1h203",
        "SL_E_CAL_NOT_FOUND",
        "fr-MA",
        "Failed to clone store. Status: %x",
        "4 4$4(4,44484@4D4H4L4T4X4`4d4h4l4p4t4x4|4",
        "WTHelperGetProvSignerFromChain",
        "or-IN",
        "POSTVALIDATION: Validator failed: %s (%s). Error: 0x%08X",
        "SVWjP",
        "wasPassProcessed",
        "class CDeviceIdDatabase::CDeviceInfoData *const *__thiscall UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *>::GetBuffer(int) const",
        "spp.dll",
        "011@1G1P1U1`1s1",
        "base\\ntsetup\\setupplatform\\lib\\src\\imageapply.cpp",
        "6H6U6m6",
        "ERROR_DS_BACKLINK_WITHOUT_LINK",
        "2!2)2/2<2N2\\2",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "<+<7<L<",
        ">'?D?p?",
        ".?AU?$IEnumerator@PAUPartitionLayoutArgs@@@UnBCL@@",
        "CMergeWIM::DoExecute: Cannot set temp path for source WIM. Error: 0x%x",
        "class CRegCreationData *const &__thiscall UnBCL::ArrayList<class CRegCreationData *>::get_Item(int) const",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::Add(class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *)",
        "Opening online DISM session",
        "j:Xf;F",
        "Deleting BSD redirection elements.",
        ")SmDisk::InitializeProperties",
        "ERROR_VOLSNAP_HIBERNATE_READY",
        "CCompressedPayloadWriterT<class CEmptyType>::PreWrite",
        "?'?5?M?R?i?~?",
        "Creating new system (2). WSD Server: %s, WDS Namespace: %s, System drive: %c",
        "ERROR_DIR_EFS_DISALLOWED",
        ".?AU?$ICollection@PAVCGlobalPath@@@UnBCL@@",
        "181=1",
        "0!0,0S0^0l0",
        "Execute.PostSysprep",
        "4%4,454q4w4",
        "8 8$8(80888<8D8L8P8T8X8`8h8l8p8x8|8",
        "RollbackExecuteSequence finished.",
        "8\"848B8Z8_8v8",
        "ERROR_MUI_INVALID_LOCALE_NAME",
        "<!<5<B<I<P<[<i<q<w<",
        "9%8YWDQ",
        "=&=>=E=L=R=_=t=",
        "Cache",
        ".?AVCOOBEBootApply@@",
        "Invalid data. Recovery image folder %s does not end with the retrieved subfolder %s",
        "DriverDownloaded",
        "BfspSuspendBitLocker FAILED Error code = %#x",
        "ERROR_INSTALL_TEMP_UNWRITABLE",
        "ERROR_DS_NO_TREE_DELETE_ABOVE_NC",
        "0-0<0E0N0W0`0i0r0",
        "^(;~,~",
        "ReleaseSRWLockShared",
        "[%s] is already restored",
        ":$:*:0:6:<:B:H:N:T:Z:`:f:l:r:x:~:",
        ".?AVCApplyBCDSettings@@",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,&protected: static class CDriverInstallInfo * __stdcall UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,class ATL::CElementTraits<class CDriverInstallInfo *> > const *,struct __POSITION * const &)>::Reset(void)",
        ".?AV?$HTDictEnumBase@PAVString@UnBCL@@@_@UnBCL@@",
        "=0=F=X=p=w=}=",
        "3!31383>3C3N3\\3d3j3o3",
        "Could not find an ICB element in provisioning package %s.",
        "SPApplyDeviceLayoutDiskConfig: %s is missing. Will not validate input xml with schema",
        "1#171F1M1S1X1c1m1r1",
        "Executing phase [%s]",
        "OSRollbackService::CCheckpointImpressario::ExecuteRollbackSequence",
        "8$8,848<8H8l8t8|8",
        "ERROR_DS_UNAVAILABLE_CRIT_EXTENSION",
        "CBS_S_ALREADY_EXISTS",
        "1$1+181?1O1",
        "__thiscall UnBCL::ArrayList<class DiskLayout *>::ArrayList(const struct UnBCL::ICollection<class DiskLayout *> *)",
        "2E2l2",
        "r9f9LC",
        "void __thiscall UnBCL::ArrayList<class CDriverDetails *>::Insert(int,class CDriverDetails *)",
        "  Specific callback decision (WinPE): %s",
        "161=1",
        "OC::CCmdLineManager::RunCmdLine: Failed to get process exit code",
        "Extending the previous partition",
        "RPC_S_ZERO_DIVIDE",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::Insert(int,class UnBCL::DictionaryEntry<class UnBCL::String *,long> *)",
        "ERROR_COULD_NOT_RESIZE_LOG",
        "CBS_E_INVALID_CARDINALITY",
        "SPCleanupInstallationDrive: Unable to unmount the directory %s. Error: 0x%08X",
        ">4><>D>P>p>x>",
        "ERROR_DS_SINGLE_VALUE_CONSTRAINT",
        "?Equals@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHPBVObject@2@@Z",
        ";$<R<",
        ".?AVCXXXXXHandledException@?CI@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "2\"262D2z2",
        "3*4H4i4",
        "pGetExistingPageFiles: Unresolved path: %s",
        ">%?,?3?>?P?X?^?r?",
        "?8?X?x?",
        "?GetDirectoriesAndFiles@Directory@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBVString@2@0W4EnumerationType@12@H@Z",
        "0d0{0",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::get_Current(void) const",
        "WdsCliCreateSession",
        "SPCreateDiskImage: Can't open disk image: 0x%08x",
        ">%>.><>C>M>a>j>w>|>",
        ";$<+<1<6<A<H<\\<p<}<",
        "gl-ES",
        ".?AV?$CAutoRelease@PAUIWpxConfig@@@RAII@@",
        "9$9,9D9\\9d9l9t9|9",
        "ERROR_ALREADY_ASSIGNED",
        "Processed",
        "class CTelemetry *__stdcall UnBCL::Try_Cast<classCTelemetry*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "FveGetStatusW",
        "Error setting security attributes on %s. Last Error = %#x",
        "?J?[?w?",
        "InstallSecurityTemplate: Error in querying tick count. Error: 0x%08lx",
        "Getting WMI Uint16 property %s: unexpected VARIANT type %d",
        "ProcessJournalEntries: New OS: %s",
        ".PAVCXXXXXHandledException@?2??pSPCheckAndDeleteUpgradeSnapshot@@YGJPAVString@UnBCL@@0PAUHKEY__@@KHPBGPAUITelemetry@@PAH@Z@",
        "base\\ntsetup\\setupplatform\\lib\\rollback\\rollback.cpp",
        "Failed to allocate memory for CCreateRegistryData. Error: 0x%08X",
        "PREVALIDATION: Operations have been sorted again following a validator's request to retry, execution will continue.",
        "End-Install apply completed successfully",
        "3#3,3C3T3]3t3",
        "ERROR_NOT_EXPORT_FORMAT",
        ">+?L?S?r?y?",
        "1@2k2p2",
        "%s %s",
        "5&545",
        "Fail to alloc package path for %S.mum",
        "ERROR_REGISTRY_CORRUPT",
        "8$8,848@8`8h8p8x8",
        ".?AV?$Array@E@UnBCL@@",
        "CreateVssBackupComponentsInternal",
        "pExecutePostBootOperations",
        "ERROR_DS_NO_RIDS_ALLOCATED",
        ".?AVCXXXXXHandledException@?2??DoExecute@CValidateSafeOS@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "4 414F4N4T4a4s4",
        ";$;/;4;H;b;j;t;{;",
        "Operations recap:",
        "=,>`>",
        "0(00080L0T0\\0l0x0",
        ".?AV?$ArrayList@K@UnBCL@@",
        "int __thiscall UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *>::IndexOf(class CDeploymentBase::CMountedPathInfo *,int,int) const",
        "0$0(0,00080<0D0H0P0h0l0",
        "?+?=?L?\\?d?v?~?",
        "SKIPBOOTTRACK(FIRST): Turning ON First boot removal per install flow constraint",
        "OC Validator",
        "WVhT'",
        ">C>W>^>d>i>t>~>",
        "SOFTWARE\\Microsoft\\RecoveryEnvironment",
        "3#3(323<3F3P3^3d3j3o3y3",
        "8)818B8O8W8~8",
        "na:MinFreeSectors",
        "Marking event [&SclEvent_ResetDiskSignatures_Start]",
        ".?AU?$IDictionaryEnumerator@KPAUIVdsDisk@@@UnBCL@@",
        "=,=4=<=D=L=T=\\=d=l=t=|=",
        "SPFindImageDisk: Can't enumerate disks (0x%08x)",
        ":$:(:8:<:L:P:`:d:t:x:",
        "4%4=4x4",
        "CDeploymentBase::RestoreMounts: Remounting path %s which is needed for execution (mount info flags 0x%08x)",
        "?!?'?3?G?U?c?q?",
        ".?AV?$ArrayListEnumerator@PAVCAntiVirusInfo@@@_@UnBCL@@",
        "<#<*<4<E<R<\\<k<t<z<",
        "<$<6<><D<Q<c<q<~<",
        "2M2]2y2",
        "WVhL(",
        "40484>4K4]4",
        ":3:]:y:",
        "ZwLoadKey2",
        "?%?=?x?",
        "RPC_S_SEC_PKG_ERROR",
        ">&>->a>o>w>~>a?w?",
        "WIMFindFirstImageFile",
        "pAddSafeOSDriversFromProvPackage: Failed to get meta data info for %s (0x%08x)",
        "SPCopyFilesAndFolders: Failed to delete file %s. hr = 0x%08X",
        "3+343@3E3O3V3c3o3x3",
        "JET_errDatabaseDirtyShutdown",
        "?\"?)?/?4???F?R?Y?_?d?o?v?",
        "; hash = ",
        "434F4]4z4",
        "5/575=5J5\\5s5",
        ":=:Y:",
        "?EnqueueSbRegistration@SbRegistrationList@UnBCL@@SGXPBDHPAUHINSTANCE__@@PAUIInstanceFactory@2@@Z",
        ">$>,>8>X>`>h>t>",
        "SclpRegExpandProfileHivePath",
        "Snapshot still available, skiping",
        ".?AVCXXXXXHandledException@?2??pSPSetSnapshotInfoToNewOS@@YGJPAVString@UnBCL@@PAUHKEY__@@U_FILETIME@@PAUITelemetry@@@Z@",
        "8)8>8F8L8Y8k8",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCShellFolderInfo@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        ".PAVCXXXXXTemp@?CAI@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "EFIDEFAULT",
        "9$9-969?9V9d9m9v9",
        "void __thiscall UnBCL::Array<class CBcdSetting *>::InitLarva(class UnBCL::ArrayList<class CBcdSetting *> *)",
        "api-ms-win-eventing-provider-l1-1-0",
        "Bugcheck driver class",
        "t!Sh`",
        ".?AV?$DictionaryEntry@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@",
        "GetLocaleInfoEx",
        "040<0B0O0a0z0",
        "3 3-3?3M3f3m3t3z3",
        "void __thiscall UnBCL::ArrayList<enum OP_EXECUTION_PHASE>::Insert(int,enum OP_EXECUTION_PHASE)",
        "%hs: Cannot create the new system object. Error: 0x%08X",
        "DUDownloadSkippedReason",
        "CAbstractDisk::GetVolumePath",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::Add(class UnBCL::DictionaryEntry<unsigned short,unsigned short> *)",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::Remove(class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *)",
        "BOOTMGR",
        "7#7T8d8t8",
        "9&:C:e:y:",
        "eCSetupPlatform::Release",
        "4$4,444<4D4L4T4\\4d4l4x4",
        "BootLogOsLaunchCount:%d",
        "CMediaLayout::Initialize",
        "j<hx%^",
        "2 2-2I2Y2f2m2s2x2",
        "ERROR_INVALID_PROFILE",
        "Getting WMI Bool property %s: unexpected VARIANT type %d",
        ".?AV?$CAutoRelease@PAVCDUPackageCollection@@@RAII@@",
        "112A2b2j2r2",
        "5)6.6j6~6",
        "3-3F3M3T3Z3f3z3",
        "6'6?6`6u6",
        "szPrefix",
        "2 2$2(2,24282<2@2D2H2L2P2T2\\2d2h2p2x2|2",
        "Prepare the recovery image",
        "7S7_7",
        "ERROR_INVALID_BLOCK_LENGTH",
        "8&8Q8f8",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::Reset(void)",
        "    Failed to write end element",
        "SPGetMigScopeFromString",
        "%hs: Cannot open the UNC store. Error: 0x%08X",
        "DUInstallSkippedHR",
        "SmDisk::Wipe: MSFT_Disk.Clear() returned disk not initialized; treating as success case.",
        "4$4-464?4H4Q4Z4c4o4x4",
        ".rdata$zETW0",
        "3.3@3H3N3[3m3w3",
        "SPAPI_E_AUTHENTICODE_PUBLISHER_NOT_TRUSTED",
        ":7:D:",
        "setupapi.ev3",
        "\\EFI\\Microsoft\\Recovery\\BCD",
        "6/6<6L6q6x6~6",
        "4 4(4.4;4M4w4",
        ".?AV?$ArrayList@PAUPartitionLayoutArgs@@@UnBCL@@",
        ".?AV?$ArrayList@PAVString@UnBCL@@@UnBCL@@",
        "CMigrateBootSettings::DoExecute: Could not get new OS boot entry from param file. Error: 0x%08X",
        "EA^Wp",
        ".?AV?$ArrayList@G@UnBCL@@",
        "?,?4?<?H?h?p?x?",
        "FirmwareBootDevice",
        "void __thiscall UnBCL::ArrayList<class COperationsValidator *>::AddRange(const struct UnBCL::ICollection<class COperationsValidator *> *)",
        "8!878D8V8^8d8m8",
        "enum OP_OPERATION_ID *__thiscall UnBCL::ArrayList<enum OP_OPERATION_ID>::GetBuffer(int)",
        "%hs: Failed to open new BCD's safe OS entry. Status = 0x%08X",
        "ProvisioningPackage::GetDescription",
        "4&4<4C4y4",
        "DismApplyUnattend",
        "2,2>2L2d2i2",
        "%hs: Found WIMBoot entry that can be moved: %I64d (%s, %d) for drive %s, will free up %I64d bytes",
        "=(>M>",
        "ActionPlatform::LaunchModule: Could not load DLL %s; dwRet = 0x%x",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *> *,int,int)",
        ".?AU?$ICollection@E@UnBCL@@",
        "rmachine specific",
        "enum OP_OPERATION_ID &__thiscall UnBCL::ArrayList<enum OP_OPERATION_ID>::get_Item(int)",
        "Current retrieved on enumerator beyond table end",
        ";\";-;8;L;",
        "QueueDataMigration called with offline dir %s, scope %d",
        "CEnableSafeOSPageFile::DoExecute: Setting dump type to %d",
        "Current uninstall comment: %s",
        "SL_E_PKEY_INVALID_KEYCHANGE3",
        "4#4.4<4J4X4",
        "3$333;3A3O3X3d3",
        "ERROR_MCA_INVALID_TECHNOLOGY_TYPE_RETURNED",
        "=$=(=,=4=8=<=D=H=L=T=X=\\=d=l=p=t=|=",
        "%hs: BCD store does not exist, and a new one will be created.",
        "RegOpenKeyExW failed to open %s",
        "Path: %s",
        ":%:1:=:K:\\:p:",
        "5 50545D5H5X5\\5l5p5",
        "SPFindFreeSpace: Can't create partition enumerator (0x%08x)",
        "9&:Z:a:g:l:w:",
        ".?AVCXXXXXHandledException@?BC@??SPGetWIMImageInfo@@YGJPAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@3@KPAW4IMAGE_TYPE@SetupPlatform@@PAPAG333@Z@",
        "<&<2<B<R<Z<y<",
        "ERROR_EXE_MARKED_INVALID",
        "pExtractWinREFromImage: Failed to open BCD store at %s. Error = 0x%08X",
        "GetSecurityDescriptorControl",
        "{E48F4522-1CAA-42AD-B5CB-3B404B4F164A}",
        ".?AV?$SmartPtr@VIOCManager@OC@@@UnBCL@@",
        "Failed to copy Removed FOD Markers",
        "Copy package payload from %s to %s",
        "CSetupPlatform::ProcessTelemetry",
        "SL_E_CHPA_FAILED_TO_UPDATE_PRODUCT_KEY_RECORD",
        "3$343D3T3d3t3",
        "2:3G3",
        "jaYjz^j:Z",
        "<.<8<E<S<Z<e<t<~<",
        "%hs: PartitionName: %s.",
        "Path,%d,%s",
        ".?AU?$IList@PAVCImageInfo@@@UnBCL@@",
        "?(?8?H?X?h?x?",
        ": ;D;d;",
        "LastCrashDumpInfo: ContextFlags %u",
        "  Specific callback decision for external package: %s",
        "t VWP",
        ".?AUICheckpointParameters@OSRollbackService@@",
        ".?AVCXXXXXHandledException@?CH@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "%hs: Hive %s is in use, we'll attempt to unload it",
        "8$8,848<8D8L8T8`8h8",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::Insert(int,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *)",
        "CreateVirtualDisk",
        "mt-MT",
        "SPScheduleTask",
        "QueueRemoveFODPackage called with package name: %s",
        "30383>3K3]3n3",
        "Failure while opening image file %s. Error 0x%08X",
        "ERROR_IP_ADDRESS_CONFLICT1",
        "ActionPlatform::CreateKey: Invalid registry key path %s passed",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCCFGSectionValue@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "SPDoUninstallApply",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCOperationInfo@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "SBiUpdateEfiEntry failed %x",
        "<unknown registry key>",
        "ERROR_DS_REPL_LIFETIME_EXCEEDED",
        "SPDeleteTempPageFileForCrashDumpCapsule",
        "1<1I1[1c1i1v1",
        "r9&8-t",
        "ERROR_ALREADY_THREAD",
        "ERROR_MORE_WRITES",
        "0;0M0U0[0h0z0",
        "<;<b<",
        "9 9L9a9l9y9",
        "8@8t8",
        "GetSystemPartitionPath: Found non-NT drive path [%s] for NT system partition path [%s].",
        "WjdRP",
        "VdsVolume::AssignLabel",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCCheckpoint@OSRollbackService@@@UnBCL@@@UnBCL@@",
        "SF Validator: Failed to find shell folder %s: %s = %s",
        "\\system32\\config\\",
        "8S8~8",
        ".?AVCXXXXXHandledException@?2??DoExecute@CSysprepRespecialize@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "LayNtBootCode: Error opening backup boot sector file!",
        "<,<0<@<D<T<X<h<l<|<",
        "?e?{?",
        "8,848;8I8W8j8",
        ":d:v:~:",
        "> >$>,>4><>@>D>L>P>T>\\>`>d>l>p>t>|>",
        "?GetStackTrace@Exception@UnBCL@@QBEPAVString@2@XZ",
        "pStartCommunicationServer",
        "s.cab",
        "SysprepComponent::CreateSysprepActionList: No actions were found for component %s; this is unexpected",
        "SL_E_CHPA_PRODUCT_KEY_OUT_OF_RANGE",
        "2.2<2]2",
        "ERROR_CLUSTER_JOIN_NOT_IN_PROGRESS",
        "CDeploymentProject::CreateVHDDeployment: Failed to get WIM image info. Error: 0x%08X",
        "CBackupRecoveryPartition::DoExecute: Failed to write WIM hash to %s: 0x%08x",
        "Failed to add File [%s] to Scoping. Error: 0x%08X",
        ".?AVCXXXXXHandledException@?ID@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "?#?*?4?E?R?\\?k?t?z?",
        ";);j;",
        ":$:,:4:<:D:P:p:x:",
        "    Failed to add wof entry",
        "ERROR_INTERRUPT_VECTOR_ALREADY_CONNECTED",
        ".?AU?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@W4ActionType@@@UnBCL@@@UnBCL@@",
        "7B7T7\\7b7s7",
        "3-3=3I3a3g3y3",
        "3'393Z3a3g3l3w3",
        "2%212E2M2T2[2f2s2",
        "4#4/4;4W4d4s4",
        "7'72777K7i7",
        "=<=D=P=t=|=",
        "1e1v1",
        "Inconsistent full and destination paths; may lead to bad image meta-data.",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *> *,int,int)",
        ";L<V<j<q<",
        "Failed to remove backup start type for service %s. Error: 0x%08X",
        "VdsVolume::RemoveDriveLetter: Volume has no drive letter; returning",
        "void __thiscall UnBCL::ArrayList<class COperationInfo *>::set_Item(int,class COperationInfo *)",
        "6(6:6A6K6X6a6i6~6",
        "<0=7===B=M=Y=m=w=",
        "CBS_E_PACKAGE_DELETED",
        "4(5X5",
        "5)5O5d5l5r5{5",
        "NtSetDriverEntryOrder",
        "SVh`8",
        "2$21282>2C2N2]2e2n2",
        "0(070F0O0X0a0j0",
        ";.;u;",
        "D$@QQPQQQQ",
        "4$4A4P4m4|4",
        ".PAVCXXXXXHandledException@?2??CreateFromWDSServer@CImageInfoSet@@SGJPBGPAUtagWDS_CLI_CRED@@PAPAV2@@Z@",
        "{33A5537F-7961-48A0-81CA-0FC17FA1230F}",
        "?/???S?c?y?",
        "SPProcessBitlockerOnDrives: Bitlocker was already resumed. Taking no action.",
        ".?AV?$SerializableBase@VCExtractFilesFromWDSImage@@$0A@V?$DefaultInstanceFactory@VCExtractFilesFromWDSImage@@@UnBCL@@@UnBCL@@",
        ":#:9:E:J:O:X:^:n:s:",
        "989p9",
        "RRRR+",
        ":.:@:H:N:[:m:{:",
        "pSPOpenServiceKey",
        "VjPjQ",
        "class CDeviceIdDatabase::CDeviceInfoData **__thiscall UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *>::GetBuffer(int)",
        ")VdsDisk::Convert",
        "VdsVolume::GetProperties: Failed to get volume path name for path %s (0x%08x)",
        ".PAVCXXXXXHandledException@?BN@??UndoTransformers@CSetupPlatformApplyRollbackCheckpoint@@IAEJPAVString@UnBCL@@00@Z@",
        "ERROR_DS_INVALID_SEARCH_FLAG_TUPLE",
        "rSPIsSessionRunning",
        "9.9G9U9",
        "Failed to query OS loader identifier. Status = [%x]",
        "1B2k2u2",
        "8\"8.8>8`8s8",
        "Failed to get size of working directory %s; SQM data will not be reliable. Error = %d",
        "WinSetupDiag02",
        "Integer overflow after WriteData",
        "int __thiscall UnBCL::ArrayList<class CFileCreationData *>::LastIndexOf(class CFileCreationData *,int,int) const",
        "%s\\System32\\DriverStore\\FileRepository\\%s\\%s",
        "WaitRoutine",
        "11191J1`1",
        "CMediaLayout::QueueProvisioningPackages: Failed to queue ICB: 0x%08x",
        "%hs: Progress: %d",
        "2070Y0o0",
        "DynamicUpdate.Drivers",
        "class UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "ERROR_MAPPED_ALIGNMENT",
        ".PAVCXXXXXHandledException@?2??DoExecute@CSetupRecoveryPartition@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "OC::COCDismAdapter::EnableDisableOCs: DismDisableFeature failed; the image is no longer serviceable. hr = 0x%x",
        "=/=@=a=|=",
        ".?AU?$ICollection@PAVCSPInternalPluginData@@@UnBCL@@",
        "Logging boot file servicing to bootstat log %ws.",
        "RPC_X_WRONG_STUB_VERSION",
        ".PAVCXXXXXHandledException@?5??SPQuerySnapshotSize@@YGJPAVString@UnBCL@@PA_J11@Z@",
        "%hs: Failed to convert default entry GUID to string.",
        ";7;>;^;e;",
        "void __thiscall UnBCL::ArrayList<class CAppInfo *>::set_Item(int,class CAppInfo *)",
        "?.?9?K?R?X?]?i?q?v?",
        ";);3;F;Z;t;",
        "0Wh m",
        "tb9t$",
        "6=6g6",
        "CEnableNetDebugging::SetDebuggerTypeSpecificSettings",
        "2E2L2R2W2b2l2",
        "t*j\\Yf;H",
        "3E3t3",
        "%hs: Cannot determine current control set for the offline OS. Error: 0x%08X",
        "CBS_E_SESSION_CORRUPT",
        "> >$>,>4>8>@>H>L>T>\\>`>h>p>t>|>",
        "WmiAssociation::MoveNext: Can't get object property names (0x%08x)",
        ">)>S>t>",
        "5,5L5f5q5",
        ":,:C:j:v:",
        "Failed saving pagefile settings from old os, Error: 0x%08X.",
        "5#5-5A5_5",
        "QWj#jBh,",
        "long __stdcall CImageInfoSet::CreateFromWDSServer(const unsigned short *,struct tagWDS_CLI_CRED *,class CImageInfoSet **)",
        "CReconstructOS::DeleteTempFiles",
        "COperationQueue::CanOperationRunInPhase",
        "50595E5Y5z5",
        "5,5B5T5\\5b5o5",
        "Could not export BCD store to %s, error=0x%08x",
        "ERROR_LOG_SECTOR_PARITY_INVALID",
        "646B6a6~6",
        "ERROR_CLUSTER_WRONG_OS_VERSION",
        "WVh(m",
        "6*6<6J6c6j6q6w6",
        "WShpH",
        "343k3r3x3}3",
        "3 3$3(3034383<3@3D3H3L3P3T3X3\\3d3h3l3p3x3|3",
        "SPAPI_E_DEVICE_INSTALLER_NOT_READY",
        "9$979i9p9v9{9",
        "5+6?6R6^6",
        "SL_E_NONGENUINE_GRACE_TIME_EXPIRED",
        ".PAVCXXXXXHandledException@?5??SPDeleteSnapshot@@YGJPAVString@UnBCL@@0@Z@",
        "CStopSuspendedServices::DoExecute",
        ">&>/><>H>T>`>l>u>~>",
        "CSetupPlatformPrivate::RollbackOnlineCommon: Failed to decode new WinRE hash, cannot remove it: 0x%08x",
        "CSuspendBitlocker::DoExecute: Unknown BitLocker handling type %u",
        "SL_E_CIDIID_MISMATCHED",
        "Service %s deleted successfully.",
        "SPCreateDiskImage: Mismatched disk types: expected %u, actual %u",
        "class CAppInfo *__stdcall UnBCL::Try_Cast<classCAppInfo*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "9D$0sJ3",
        ".?AV?$Array@PAV?$DictionaryEntry@PAUIOperationsProgress@SetupPlatform@@K@UnBCL@@@UnBCL@@",
        "Failed to forcibly unload the system store. Status = [%x]",
        "SystemTimeToTzSpecificLocalTime",
        ".?AV?$DefaultInstanceFactory@VCRegisterAsyncProcess@@@UnBCL@@",
        "CFG Validator: Forcing validator failure due to environment variable.",
        "?*?@?G?",
        ")SPGetDiskImageNumber",
        "5<5J5S5\\5s5",
        "=:=k=|=",
        "?5?M?e?",
        "MEMORYTRACK: Load              : %u",
        "pExtractWinREFromImage: Failed to set new device element data. Error = 0x%08X",
        "ERROR_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY",
        "tCf97t>",
        "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "7:8A8P8H9O9",
        "8#9L9",
        "8!8&818=8\\8c8m8r8}8",
        "XCSetupPlatformRollback::Initialize",
        "6*686W6m6",
        "4#4.494D4O4Z4e4p4",
        "??_D?$Array@E@UnBCL@@QAEXXZ",
        "8(8-8",
        "0%030=0F0R0^0j0v0",
        "4&474M4f4m4t4z4",
        "ServiceSpaces: Failed to copy %s to %s. Last Error = %#x",
        "t!h\\I",
        "Couldn't get array element 0 (0x%08x)",
        "020s0",
        "1 1+181E1Q1\\1d1n1",
        ".?AU?$IEnumerator@PAVCOperation@@@UnBCL@@",
        "5 5$5(5,54585<5@5H5L5P5T5X5\\5`5d5h5p5t5x5|5",
        "PWVhJ",
        "1-1>1T1e1l1r1w1",
        "int __thiscall UnBCL::ArrayList<class CBcdSetting *>::IndexOf(class CBcdSetting *,int,int) const",
        "7&7A7G7Q7V7`7g7u7",
        ">1>@>|>",
        "ReadWriteDataInternal",
        ":):7:=:C:H:R:\\:f:p:~:",
        "??0OutOfMemoryException@UnBCL@@QAE@XZ",
        "qps-plocm",
        "suspending",
        "9\"9,9;9D9J9W9]9b9s9~9",
        "Queried allocated space : %I64d",
        "BFSVC: %ws",
        "?set_ValidateOnParse@XmlDocument@UnBCL@@QAEXH@Z",
        "?EndsWith@String@UnBCL@@QBEHPBGH@Z",
        "tCNewSystem::StreamRead",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *> *)",
        "5$6X6",
        "? ?4?M?W?m?",
        "545<5D5P5X5p5x5",
        "3 363M3V3",
        "RPC_S_INVALID_TIMEOUT",
        "CMediaLayout::QueueDirectoryCopy",
        "Executing command line \"%s\"...",
        "Number of $MFT security descriptors processed",
        "    Failed to open provisioning package",
        "474O4Y4_4j4}4",
        "CDeploymentBase::PrepareForRun",
        "t$<WP",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,&protected: static class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> * __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> *,class UnBCL::Array<class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> *,int)",
        "ERROR_PAGE_FAULT_PAGING_FILE",
        "616H6_6g6l6q6",
        "282V2",
        "WriteSectors: Failed to write the desired bytes onto disk. GLE is [0x%X]",
        "3!4[4d4",
        "RPC_S_NO_ENTRY_NAME",
        "1$191E1O1`1i1u1",
        "CNewSystem::QueueSetupAutomation: Failed to queue feature %u: 0x%08x",
        "SetupOpenInfFileW",
        "::;M;",
        ">8>?>E>K>V>g>o>u>",
        "DiskLayout::ApplyLayout",
        "ERROR_EXE_CANNOT_MODIFY_SIGNED_BINARY",
        "CMigChangesValidator::ValidatePreExecution: Failed to create working directory %s",
        "CFfuWriterAsyncT<class CSecurityHeaderWriterT<class CEmptyType>,class CImageHeaderWriterT<class CEmptyType>,class CCompressedStoreHeaderWriterT<class CEmptyType>,class CCompressedPayloadWriterT<class CEmptyType> >::Done",
        "RegOpenKeyExW",
        "Copying rollback directory %s to %s",
        "Microsoft Corporation1)0'",
        "9&90999D9S9d9p9z9",
        "%hs: %s environment variable detected, fail-forward installation is enabled.",
        "arm64",
        ": :2:::@:T:o:",
        "5X5o5v5|5",
        ".?AV?$SmartPtr@U?$IEnumerator@K@UnBCL@@@UnBCL@@",
        "sort failed -- bad comparison routines?",
        ":(:2:G:N:T:Y:d:q:y:",
        ".PAVCXXXXXTemp@?3??DoExecute@CAddAppxPackage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "0!0,070<0S0Z0`0e0p0{0",
        ";-;a;",
        "int __thiscall UnBCL::Array<class CFileCreationData *>::Add(class CFileCreationData *)",
        "7*7;7|7",
        "4%484J4R4X4e4w4",
        ".?AV?$DefaultInstanceFactory@VCCFGValidator@@@UnBCL@@",
        "\\syswow64\\ssshim.dll",
        "pGetEtlFileNameOnline %s, 0x%x.",
        "2g2w2",
        "SP_ENV_FORCE_SKIP_SAFEOS_BOOT",
        "DU disk space checkpoint after download:",
        "DiagERSubmitEx",
        "=A>P>Z>c>k>r>",
        ".?AVCXXXXXHandledException@?M@??OnErrorCommon@CSetupPlatformPrivate@@AAEJXZ@",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@PAUIOperationsProgress@SetupPlatform@@K@UnBCL@@@UnBCL@@@UnBCL@@",
        "363H3P3V3c3u3",
        "QueryParameters",
        "?,?0?H?L?d?h?",
        ".?AV?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "??B?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
        "ERROR_NO_SECRETS",
        "9%9+989J9X9e9w9",
        "{C17D6B2F-C9DB-4439-82D8-BAC5F6A72077}",
        "%hs: Cannot get volume name for the recovery image path.",
        "WVhx)",
        ":=:P:g:t:",
        "Tracing: Failed to parse guid : %s, 0x%x",
        "int __thiscall UnBCL::ArrayList<class COperation *>::IndexOf(class COperation *,int,int) const",
        ".?AU?$ICollection@PAVCFailForwardSystem@@@UnBCL@@",
        "Microsoft Time-Stamp PCA 2010",
        "??0MemoryStream@UnBCL@@QAE@PAV?$Array@E@1@HH@Z",
        "OC::COCCbsAdapter::InitOnline: CbsSession is initiating...",
        "ERROR_NO_MORE_ITEMS",
        "moduleName",
        "2!2)202<2N2c2r2|2",
        "CInstallDUUpdatesOffline::DoExecute",
        "6=6d6n6",
        "u_Shh",
        "CRelocateOS: Path %s\\%s excluded, will not be moved in the final place.",
        "pbr: Effective size: %I64u for directory: %ws%ws",
        ":\":.:@:^:j:|:",
        "void __thiscall UnBCL::Array<class SysprepComponent *>::Remove(class SysprepComponent *)",
        "6\"646;6A6F6Q6\\6p6",
        "CSetupPlatform::DownloadDynamicUpdates: Failed to clean up updates folder %s. Error: 0x%08X",
        "5%53585L5w5",
        "ERROR_CLUSTER_NOT_INSTALLED",
        "UpdateHardlinkFile",
        "class CDriverInstallInfo *__thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,&protected: static class CDriverInstallInfo * __stdcall UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,class ATL::CElementTraits<class CDriverInstallInfo *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "0J0g0",
        "pa-IN",
        "CheckProductKeyBlock: Windows Anytime Upgrade key is blocked",
        ".?AV?$CAutoCleanupBase@PAUIDUUpdateCollection@DU@@@RAII@@",
        "pUpdateNarratorStatusParameter",
        "8M8m8|8",
        "7&7+757<7J7\\7m7t7",
        "\\Logs\\SetupSnapshotCleanupTask",
        "pFinalizeUninstall: Can't register deferred target move.",
        ";(;.;5;B;M;S;Z;g;s;|;",
        "?.?5?;?@?K?\\?d?m?s?",
        "424x4",
        "393J3W3e3z3",
        ")SmDisk::GetProperties",
        "8&838G8b8i8w8",
        "ProcessOnlineRegistryHives",
        "(%lx): Error opening current hive key [%ws]",
        "SL_E_CHPA_SYSTEM_ERROR",
        ";&;B;r;y;~;",
        "wcscat_s",
        "5\"515G5X5`5f5k5z5",
        "WriteData failed during NULL block copy",
        "??1?$IEnumerator@PAVString@UnBCL@@@UnBCL@@UAE@XZ",
        ".?AV?$Hashtable@PAVString@UnBCL@@H@UnBCL@@",
        "CReconstructOS::DoExecute: Failed to re-stage Windows installation: 0x%08x",
        "Creating Pagefiles key failed with error 0x%08X.",
        "CSetupPlatformPrivate::Execute: Failed to deserialize/execute pre-OOBEBoot operations. Error: 0x%08X",
        "BinaryInfo",
        "2+282=2F2R2_2d2m2{2",
        "StartingUsableOffset",
        "ERROR_AUTHIP_FAILURE",
        "RpcExceptionFilter",
        "<*<><K<U<i<v<",
        "LoadLibraryW",
        "SetUnhandledExceptionFilter",
        "9 9w9",
        "SPExecuteCleanup: Cancelled",
        "%hs: rollback boot entry removed successfully",
        "Operations can no longer be sorted following an attempt to retry a failed operation.",
        "3\"353<3C3N3Y3m3",
        "9B\\t3",
        "1(101;1D1L1Y1a1m1u1",
        "1$1,1@1H1P1`1l1t1",
        "%hs: Cannot find stored path for exception ID %s",
        "CSetupAutomation::SuspendAndRelease",
        "void __thiscall UnBCL::Array<struct PartitionLayoutArgs *>::RemoveAt(int)",
        "tIA;M",
        "class SysprepAction *&__thiscall UnBCL::ArrayList<class SysprepAction *>::get_Item(int)",
        "4(4,4D4H4`4d4|4",
        ".PAVCXXXXXTemp@?KA@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        ";2<H<U<",
        "Recovery attempt was successful. The system will now restart.",
        "0+0D0\\0a0m0|0",
        "4!424?4I4X4a4g4t4z4",
        "8'8,858A8M8R8[8b8o8{8",
        "void __thiscall UnBCL::ArrayList<struct PageFileDesc *>::RemoveAt(int)",
        "<'<-<6<A<}<",
        "du.dll",
        ";<;D;L;T;\\;d;l;t;|;",
        "D$,@B",
        "2,2@2]2",
        "6(6:6G6T6a6n6{6",
        "6)626<6E6O6e6",
        "ERROR_DS_SRC_SID_EXISTS_IN_FOREST",
        "?=?[?x?",
        "1)1;1I1j1",
        "63696H6_6o6{6",
        "2,2e2j2|2",
        "Refresh localized strings",
        ".PAVCXXXXXHandledException@?2??CallPidGenX@@YGJPBG000PAUDIGITALPID2@@PAUDIGITALPID3@@PAUDIGITALPID4@@@Z@",
        "int __thiscall UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::ContainsKey(class UnBCL::String *) const",
        "%hs: Cannot capture WIM image. Error: 0x%x",
        "OSRollbackService::CCheckpoint::ExtractCrashDump: Successfully extracted crash dump from %s to %s.",
        "%systemdrive%\\",
        ">!>2>?>V>^>e>u>|>",
        "%hs: Recovery image not found",
        "9#9)9/959;9A9G9M9S9Y9_9e9k9q9w9}9",
        "7#7U7",
        "SPAPI_E_NO_CLASSINSTALL_PARAMS",
        "?8?V?p?z?",
        "ERROR_MALFORMED_SUBSTITUTION_STRING",
        "CBS_E_WU_MAPPING_UNAVAILABLE",
        "SmPartition::GetVolume",
        "ERROR_NETNAME_DELETED",
        "ERROR_CANT_EVICT_ACTIVE_NODE",
        "2'3-393D3R3",
        "Apply statistics: end install",
        "9#9.9<9h9r9",
        "NtQueryInformationThread",
        ".?AV?$CAutoCleanupBase@PAVSmVirtDiskPooledDiskEnumerator@@@RAII@@",
        "CSetupAutomation::GetTargetDrive",
        "D$HPh",
        "?'?,?<?A?Q?]?j?z?",
        "=3=t=",
        "?,?8?@?X?`?x?",
        "ERROR_DS_INCOMPATIBLE_CONTROLS_USED",
        "080P0W0^0d0q0",
        "COCValidator::ValidatePostExecution",
        "JET_errPartiallyAttachedDB",
        "=%===D=J=P=[=f=l=z=",
        "%hs: Cannot load the %s hive for the offline OS %s. Error: 0x%08X",
        "GenerateActionQueue",
        "[QVjGj",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$ArrayList@PAVCDriverDetails@@@2@@UnBCL@@@UnBCL@@@UnBCL@@",
        "0:1A1g1",
        "void __thiscall UnBCL::ArrayList<struct UnBCL::ISerializable *>::RemoveAt(int)",
        "SysprepMode",
        "Setting WMI Uint64 property %s: the property does not exist",
        ";4<<<Y<j<",
        ";\"<E<M<W<^<d<i<t<|<",
        "SPAPI_E_NO_CATALOG_FOR_OEM_INF",
        "SPDeleteSnapshot",
        "?Clone@String@UnBCL@@UBEPAVObject@2@XZ",
        "ERROR_IPSEC_IKE_NEGOTIATION_PENDING",
        "4,404@4D4\\4`4d4h4l4p4x4",
        "class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::GetBuffer(int) const",
        "j:Xf9B",
        "                                   Number of physical CPUs : %u",
        "<K<[<y<",
        ".text",
        "ERROR_DATATYPE_MISMATCH",
        ";#;.;:;@;T;r;",
        "8%828>8K8V8y8",
        "Excluding path: %s",
        "CApplyDrivers::CopyToDriverStore: Will not delete directory %s since we don't own the path",
        "ResurrectSetupPlatform: Error retrieving setup platform serialized data (2). Error: 0x%08X",
        "<<<W<e<u<",
        "020;0D0M0V0g0",
        "SafeOSActive",
        "Successfully updated layout",
        "=&=7=@=M=e=l=v=",
        "5B5O5y5",
        "ApplyPartitionProperties: Couldn't get volume properties (0x%08x)",
        ".?AV?$SerializableBase@VCEnableTelemetryForImage@@$0A@V?$DefaultInstanceFactory@VCEnableTelemetryForImage@@@UnBCL@@@UnBCL@@",
        "QueueCreateFile called. File %s -> %s",
        "1'1I1P1g1p1",
        "6#727c7",
        "313\\3q3",
        "=9>@>F>K>V>a>i>p>v>{>",
        "8 8)858>8J8W8c8p8",
        "class CBcdSetting **__thiscall UnBCL::ArrayList<class CBcdSetting *>::GetBuffer(int)",
        "5 5%505;5U5r5",
        "ITaskSettings::QueryInterface for IID_ITaskSettings3 failed. hr = 0x%x",
        "SL_E_CHPA_FAILED_TO_PROCESS_PRODUCT_KEY_BINDINGS_XML",
        "Initial decision for this package: %s",
        ".?AV?$CAutoCleanupBase@PAU_BCDE_DEVICE@@@RAII@@",
        "IsWow64Process",
        "Client requested to leave BitLocker untouched",
        "ERROR_MAX_THRDS_REACHED",
        "Failed to get session id.",
        "? ?$?,?4?8?<?D?H?L?P?T?X?`?d?h?l?p?t?x?|?",
        "void __thiscall UnBCL::ArrayList<class OC::COptionalComponent *>::CopyTo(class UnBCL::Array<class OC::COptionalComponent *> *,int) const",
        "%hs: Cannot create subkey %s. Error: 0x%08X",
        "j@[j ",
        "<*<4<C<L<R<_<e<j<{<",
        "No crash detected. Try to get the binary info of last crash dump.",
        "void __thiscall CSetupPlatformOSSwitchCheckpoint::Rollback(const unsigned short *)",
        "1 2D2\\2",
        "CMediaLayout::ExecuteOptimization: Didn't find audit mode payload in %s (FindFirstFile=0x%08x)",
        "2*272?2W2]2",
        "<(=A=H=O=U=a=s=",
        "Partition Style = MBR",
        "D$,BP",
        "3#353=3C3M3W3n3",
        "303A3V3^3d3q3",
        "8-8G8W8^8l8y8~8",
        "?#?.?7?R?Y?_?d?o?v?",
        "0\"0(030A0m0y0",
        ">2>9>E>J>O>j>{>",
        ": :t:",
        "2h3<4p4H5",
        "DiskLayout::FindTarget",
        "1 1,13191>1I1S1X1l1",
        ".?AU?$ICollection@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$Array@E@2@@UnBCL@@@UnBCL@@",
        "Removing the recovery partition",
        "Microsoft Corporation1200",
        "3(3/3E3`3f3p3u3",
        "void __thiscall UnBCL::Array<class CAntiVirusInfo *>::Insert(int,class CAntiVirusInfo *)",
        "CImageInfoSet::AddToImageInfoSet: Failed to initialize COM. Error: 0x%08X",
        "CBS_E_UNKNOWN_UPDATE",
        "QWj[h",
        "5;5H5",
        "(assemblyIdentity[@processorArchitecture = \"",
        "ERROR_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR",
        "QueueEnableFeature called with feature name %s",
        "?5?P?",
        ".?AVCXXXXXHandledException@?M@??QueueEnableFeature@CNewSystem@@UAEJPBGQAPBGI@Z@",
        "= =(=7=>=D=I=T=_=o=|=",
        "3'4/4<4F4M4S4X4c4j4",
        "ReconstructionProgressCallback::Error",
        "7#7;7M7T7Z7_7j7t7",
        "int __stdcall SPRegisterRecoveryImage(struct _GUID *,class UnBCL::String *,unsigned int,class UnBCL::String *)",
        "3$363=3G3T3]3e3l3",
        "2$2,2@2H2P2b2r2",
        "4SVW3",
        "??0?$IEnumerator@PAVString@UnBCL@@@UnBCL@@QAE@XZ",
        ">1>=>D>J>O>[>h>n>",
        ":1:i:",
        ";!;';>;E;K;P;[;g;t;",
        "333C3",
        "3?3o3",
        "|$ 9u",
        "t{93tw",
        ".?AU?$IList@PAUPartitionLayoutArgs@@@UnBCL@@",
        "6X6m6",
        "f3c2263d-b256-4c49-a246-973c0e366449",
        "sms-FI",
        "7 7(7.7;7M7[7",
        ";,;3;=;t;",
        "Copying WIMBoot file from %s to %s",
        "j\\Xf9",
        "CReconstructOS::RestageWindows: Failed to read install language: 0x%08x",
        "void __thiscall UnBCL::ArrayList<class CPartitionInfo *>::CopyTo(class UnBCL::Array<class CPartitionInfo *> *,int) const",
        "<\"<<<",
        "yLeaveUntouched",
        "CSetupPlatformPrivate::RollbackOnlineCommon: Failed to delete safe OS hash: 0x%08x",
        "?(?.?5???L?S?]?n?{?",
        "5 5-5;5C5W5f5",
        "WVhT<",
        ".?AV?$SerializableBase@VCMigrateFramework@@$0A@V?$DefaultInstanceFactory@VCMigrateFramework@@@UnBCL@@@UnBCL@@",
        "?&?4?;?A?F?N?X?k?y?",
        ".PAVCXXXXXTemp@?N@??QueueRemoveFODPackage@CNewSystem@@UAEJPBGW4SP_ERROR_HANDLING@SetupPlatform@@@Z@",
        "\\Program Files\\WindowsApps\\",
        "%d.BackupPath",
        "ERROR_ENLISTMENT_NOT_SUPERIOR",
        "ERROR_UNRECOGNIZED_MEDIA",
        "ERROR_DS_INAPPROPRIATE_MATCHING",
        "D$<SSSS",
        "__thiscall UnBCL::ArrayList<class SysprepComponent *>::ArrayList(const struct UnBCL::ICollection<class SysprepComponent *> *)",
        ".PAVCXXXXXHandledException@?2??SPReportSnapshotState@@YGXPAVString@UnBCL@@PAUHKEY__@@PAUITelemetry@@@Z@",
        "4)404?4M4U4[4`4t4{4",
        "2!333;3A3N3`3",
        "6 6*6G6V6e6n6x6",
        "<'<7<C<K<X<q<",
        "long __stdcall SPDeserializeOperations(const unsigned short *,unsigned short,unsigned short,class COperationQueue **,class UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *> **)",
        "2!2/2=2s2",
        "Failed to get log directory, diagnostics data cannot be uploaded. hr = 0X%x",
        ">[_^]",
        "Foundation",
        ":(:1:::C:L:U:e:p:{:",
        "OC::COCCbsAdapter::SearchFoundationPackageName: ICbsSession::CreateCbsIdentity failed %X.",
        "3,3>3H3`3",
        "r5f9LC",
        "MigGetStorePlatform",
        "Unable to get procedure CreateNewPseudoWindowsEx",
        "ERROR",
        "{DF45B23A-B36C-4B00-AB59-BFD896C3C7BD}",
        "Total size of the compressed files: %I64u",
        ".?AV?$ArrayListEnumerator@UDiskMatchFilter@@@_@UnBCL@@",
        "8O9i9",
        "ProvisioningPackage::ResetHandles",
        "Failed to get handle to the template store. Status = [%x]",
        "GetMountEntry",
        "5&565=5C5H5S5]5b5v5",
        ".?AVCMountWIM@@",
        "ERROR_DS_CANT_MOD_SYSTEM_ONLY",
        "ApplyPartitionProperties: Using System volume %s",
        "ERROR_LOG_CANT_DELETE",
        "0-0E0J0a0v0|0",
        "ar-YE",
        "4(4=4P4X4^4k4}4",
        "ERROR_FORMS_AUTH_REQUIRED",
        ";sHshj",
        "uHjW_VV",
        "LogDir",
        "DiskLayout::ApplyProperties: Unexpected partition table type %u",
        ".PAVOCException@OC@@",
        "9'9/959I9Q9X9l9z9",
        "__PATH",
        "SPWdslibLogCallback",
        "=)=.=m=y=~=",
        "CDownloadDUUpdates::DoExecuteInternal: DU initialization failed. hr = 0x%x",
        "SetupPlatform: Phase \"Post-OOBE\" started.",
        ">8>@>N>U>Z>k>w>",
        ".?AV?$SmartPtr@U?$IEnumerator@W4OP_OPERATION_ID@@@UnBCL@@@UnBCL@@",
        "SPGetCompactOSStatus",
        "j-j%^Vj",
        ".?AVCXXXXXHandledException@?CJ@??CreateFFUDeployment@CDeploymentProject@@UAEJPBGPAXPAUIGenericProgress@SetupPlatform@@@Z@",
        "Press Ctrl+Alt+Del to restart",
        "<Q<Y<f<",
        "1)171E1",
        "D$Lu&",
        "PPWPPV",
        "BcdLogCallback",
        "DisableDiagnosticDataViewer",
        ".?AU?$IEnumerator@U_GUID@@@UnBCL@@",
        "SetupPlatform::_GetUninstallInterface: Failed to get platform directory. Error: 0x%08X",
        "ERROR_IPSEC_IKE_SHUTTING_DOWN",
        ".?AUITelemetry@@",
        "CSkipBootValidator::CanRemoveSafeOSBoot",
        "ERROR_RM_DISCONNECTED",
        "OSPartitionSize",
        "Failed to create mount directory %s",
        ".?AU?$IEnumerable@PAVCOSPieceInfo@@@UnBCL@@",
        "ERROR_NET_OPEN_FAILED",
        "DiskLayout::ExecCreations",
        "RtlSubscribeWnfStateChangeNotification",
        "int __thiscall UnBCL::Array<class COperationInfo *>::Add(class COperationInfo *)",
        "6(6.6@6Q6^6g6t6",
        "upSPSetServiceStartType",
        "1#2U2",
        "RegCloseKey",
        "ExtractBugCheckInfo",
        "2#393}3",
        "5D6V6^6d6q6",
        ".?AV?$CAutoCleanupBase@PAUIWpxConfig@@@RAII@@",
        "Current op string    : %s",
        ";#;,;7;L;S;Y;^;i;o;",
        ".PAVCXXXXXTemp@?6??ExecuteFailForward@CSetupPlatformPrivate@@IAEJHPAU_PROGRESS_DATA@SetupPlatform@@@Z@",
        "void __thiscall UnBCL::ArrayList<class CBasicEnvEntry *>::Resize(int,int)",
        "SPApplyCustomDiskConfig",
        "3(3?3L3[3a3v3",
        ".?AVSmPartition@@",
        "Marking event [&SclEvent_RetargetLinks_Start]",
        "< <@<H<P<\\<|<",
        "5.5X5s5",
        "5/575D5Z5{5",
        " Microsoft Operations Puerto Rico1&0$",
        "pGetExistingPageFiles: Failed to load offline SYSTEM hive: no such path. Assuming there is no existing Windows installation from which to extract page file paths.",
        "Pre OOBE",
        "2-3k3y3",
        "eTriggerRespecialize",
        "int __thiscall CSkipBootValidator::DoesOperationExist(class COperationQueue *,enum OP_OPERATION_ID)",
        "CAddSafeOSBootEntry::DoExecute",
        "1'191A1G1Y1j1w1",
        "void __thiscall UnBCL::Array<void *>::Insert(int,void *)",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,class CSPInternalPluginData *>,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,class CSPInternalPluginData *> __stdcall UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,class ATL::CElementTraits<class CSPInternalPluginData *> > const *,struct __POSITION * const &)>::Reset(void)",
        "SysprepSession::ExecuteAction: Error bypassed for deleteKey operation",
        "Failed to read volume properties",
        "WinReIsInstalledOnSystemPartition",
        "%hs: Could not find WIMBoot entry with ID: %I64d on volume %s",
        "=4=J=",
        "3#424c4",
        "ERROR_CTX_LOGON_DISABLED",
        "2+23292B2X2n2",
        "2P2W2]2b2m2x2",
        "4$4.484B4L4V4`4j4t4~4",
        "SPCreateRegistry",
        "2%3X3",
        "=#=.=5=I=R=_=g=",
        "GetFileSize",
        "CSIDL_HISTORY",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::Reset(void)",
        "SETUPPLATFORMCOMM: Error while waiting for a progress pipe connection",
        "Onesettings: Failed to Query Onesettings: 0x%x",
        "DiskLayoutMakeWindows: Failed to format Windows volume (0x%08x)",
        "y/Wj=h",
        "1 111>1H1W1`1f1s1y1~1",
        ";D;p;",
        "RollbackMode",
        "  Exception record: %u",
        "SPCreateSnapshotWithScoping: Failed to scope out [%s] from snapshot. Error: 0x%08X",
        "pSendProgress",
        "ERROR_DESTROY_OBJECT_OF_OTHER_THREAD",
        "SPAPI_E_DEVINST_ALREADY_EXISTS",
        "r8f9LF",
        "jEjYjd",
        "Integer overflow after ReadData",
        ";&;9;Q;Z;`;",
        "6 626D6L6R6_6q6",
        "; ;,;D;J;\\;p;};",
        "(%lx): Failed to process key [%ws]",
        ".?AV?$CAutoCleanup@PAG@RAII@@",
        "Failed to apply data-only settings overrides; hr = 0x%x",
        "GetFileNodeFromPathEx",
        "CReconstructOS::SetUpCbsLogging: Failed to create HKLM\\System\\Setup: 0x%08x",
        "3'3,353C3J3T3a3f3o3}3",
        "zh-Hant",
        "Error handling option is 'fail,' will treat error as fatal",
        "DiskLayout::ApplyLayout: Failed to apply fill-space from disk layout (0x%08x)",
        "<8=^=v=",
        ".?AVCXXXXXHandledException@?2??DoExecute@CProcessDrivers@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "7 787<7T7d7h7l7p7t7|7",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::get_Item(int) const",
        "='=;=P=\\=c=h=n=z=",
        "gd-GB",
        "ERROR_SXS_XML_E_INVALID_UNICODE",
        "9 9&909:9Q9h9",
        "3'313:3D3d3z3",
        "ApplySecondBootOnlinePluginErrorList",
        "JET_errSectorSizeNotSupported",
        ".?AVVdsVolumePathEnumerator@@",
        "0\"0/0C0L0U0h0o0{0",
        "DiagERSetHeader",
        ";.;N;w;",
        "int __thiscall UnBCL::Array<class CWIMBootData *>::Add(class CWIMBootData *)",
        "%hs: Persisting control environment variables failed. Error: 0x%08X",
        "VdsPartition::GetProperties: Couldn't refresh VDS properties of the partition (0x%08x)",
        "void __thiscall UnBCL::Array<class OSRollbackService::CCheckpoint *>::Remove(class OSRollbackService::CCheckpoint *)",
        ";(;,;D;H;`;d;|;",
        "Time spent processing registry (in ms)",
        "S*SENSITIVE*DATA*DELETED*",
        "]Relocate OS from %s to %s",
        "WIMMountImageHandle",
        "7%7/7I7Z7c7m7w7",
        "__thiscall UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *>::ArrayList(const struct UnBCL::ICollection<class CDeploymentBase::CMountedPathInfo *> *)",
        "4<5V5i5",
        "7)777@7L7U7a7x7",
        "9-:2:",
        "base\\ntsetup\\setupplatform\\deployment\\dll\\delayloadhandler.cpp",
        "pRegOfflineGetQWord: Cannot load %s hive under alias %s, for offline OS %s. Error: 0x%08X",
        "---|--------------------------------------------------------------------------------|--------|-------------------|-------------------|--------|------------------|------------------|-----------------|--------------------|--------------------|-------------------|-----------------|--------------------------------------",
        "=(>A>",
        "pre-apply",
        "void __stdcall ForEachPartition<class ForEachVolume::<lambda_aa0796c72c070d40a836a34c393a010b>>(struct SetupPlatform::IDisk *,class ForEachVolume::<lambda_aa0796c72c070d40a836a34c393a010b>)",
        "ERROR_MUI_INTLSETTINGS_UILANG_NOT_INSTALLED",
        "ERROR_NO_WILDCARD_CHARACTERS",
        "Policy: Never suspend protection on any volume",
        "ERROR_VERIFIER_STOP",
        ">%>/><>C>M>^>k>u>",
        "j-[f9\\0:",
        "base\\ntsetup\\setupplatform\\lib\\src\\tracing.cpp",
        "int __thiscall UnBCL::ArrayList<struct DISK_SPACE_IMPACT>::LastIndexOf(struct DISK_SPACE_IMPACT,int,int) const",
        ":':/:4:\\:",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@W4SYNCEXEC_PHASE@SetupPlatform@@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "OC::COCDismAdapter::InitOffline: DISM session opened succeessfully",
        "?0?F?a?h?n?s?~?",
        "apply",
        "void __thiscall UnBCL::Array<class CUserProfile *>::Insert(int,class CUserProfile *)",
        "Not Exist",
        "OSRollbackService::CCheckpoint::ExtractCrashDump: Pagefile does not exist at %s.",
        "Source filter value: %s",
        "5 585U5j5",
        "373=3G3L3V3]3k3}3",
        "5 525@5d5",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@H@UnBCL@@@UnBCL@@",
        "{BA5802C7-BCCE-4AD7-8FA5-6C6338382E14}",
        ".PAVCXXXXXTemp@?KD@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "?ToString@MultiSz@UnBCL@@UBEPAVString@2@XZ",
        "6!7A7_7h7r7{7",
        "BcdGetElementDataWithFlags: Failed to open key.Object: %ws Type: %ws Status: %x",
        "PhpeN",
        "OfflineWinDirNULL",
        "7&7-787F7T7b7p7",
        "9+919G9W9`9v9",
        "JET_errDatabaseInvalidPages",
        "?!?(?H?f?m?",
        ".?AVCXXXXXHandledException@?6??SuspendAndRelease@CDeploymentBase@@QAEJPBG@Z@",
        "PSFX_E_UNSUPPORTED_COMPRESSION_SWITCH",
        "IsManifestDetected",
        "VdsVolumePathEnumerator::Initialize: Failed to query volume access paths (0x%08x)",
        "282]2",
        "Installing driver update package (path: %s)",
        "5%5G5Y5p5",
        "CSetupPlatformPrivate::Execute: Failed to deserialize operations queue. Error: 0x%08X",
        "%hs: Cannot find new system serialized data.",
        "7F8i8*:B:P:_<l<z<",
        "8%828;8O8[8d8q8",
        "1#1-1D1R1\\1f1p1z1",
        "6-696Z6",
        "%hs: Failed to find image %s in image info set.",
        "int __stdcall pExecuteMove(class UnBCL::String *,class UnBCL::String *,int,int)",
        "Cannot calculate the installation order file",
        "Failed to open for flush file %s. Error: 0x%08X",
        "MIG_UPGRADE_AGENT_NO_DISCOVER",
        ".PAVCXXXXXTemp@?FE@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "JET_errLogCorrupted",
        "5#5I5^5f5l5u5",
        "4&434?4S4g4t4",
        "ResNodesLoad",
        "> ><>D>L>T>\\>d>|>",
        "BCryptGetProperty",
        "9098:H;",
        ":#:1:G:q:",
        ":#:0:7:=:B:M:Z:`:t:",
        "RPC_S_ALREADY_REGISTERED",
        "ks-Arab",
        "SL_E_RIGHT_NOT_CONSUMED",
        "3+4`4g4m4r4}4",
        "Set reg key value FileMax failed: 0x%x",
        "9sHt'",
        "9|$(t",
        "5%6C6K6",
        "8#8D8_8e8r8",
        "2(262B2G2M2Z2j2r2y2",
        ".idata$4",
        "2+2P2b2j2p2}2",
        "%hs: Boot path: %s.",
        ":1;W;c;h;m;",
        "Failed to get string length for relative path. Error: %d",
        "en-GB",
        "void __thiscall UnBCL::ArrayList<class CDriverInfo *>::AddRange(const struct UnBCL::ICollection<class CDriverInfo *> *)",
        "5 5@5H5P5`5",
        "!D$T!D$$!D$",
        "%hs: Unable to load WIM image. Error: 0x%x",
        "class UnBCL::String *__thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,class ATL::CElementTraits<enum ActionType> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "void __thiscall UnBCL::Array<class DiskLayout *>::InitLarva(class UnBCL::ArrayList<class DiskLayout *> *)",
        "4#414Y4k4",
        "ITaskDefinition::NewTask failed. hr = 0x%x",
        "t=hPn",
        "el-GR",
        ".?AVCSysprepSpecializeOffline@@",
        "Marking event [&SclEvent_ProcessUserProfiles_Stop]",
        "4,4W4z4",
        "CNewSystem::QueueOCReplication",
        "Recovery\\DownlevelWindowsRE",
        "(_^[]",
        "1'131<1H1U1a1m1v1",
        "080X0x0",
        "1$121",
        "ERROR_SXS_WRONG_SECTION_TYPE",
        ">$>?>E>R>d>",
        "SmVolume::InitializeProperties: Failed to check volume encryption status (0x%08x)",
        "091?1J1X1o1{1",
        "ko-KR",
        "0 0(00040<0D0L0T0\\0d0l0p0x0",
        "1(222L3R3m3t3",
        "4$5H5T5k5",
        "VERBOSE: POSTVALIDATION: Executing validator %s (%s)",
        "101:1M1W1q1x1",
        "SL_E_CHPA_NO_RULES_TO_ACTIVATE",
        "<%<,<2<7<C<S<b<i<o<t<",
        "SPDeleteOldUpgradeSnapshots: Failed to get snapshot install time. Error: 0x%08X",
        "CSetupPlatformCheckpoint::CopyLogFiles: Cannot locate original log folder. Did we even get this far?",
        "TargetOSBranch",
        "ERROR_DUP_DOMAINNAME",
        ";0;4;L;P;h;l;",
        "?what@exception@@UBEPBDXZ",
        "3)333=3C3P3",
        "es-PE",
        ".?AVCXXXXXHandledException@?2??SPExtendPartition@@YGJH_K0@Z@",
        "383@3H3P3X3`3h3x3",
        "%hs: Failed to set the CBS log file to %s. hr = 0x%08X",
        "0\"0*00050D0Q0^0o0w0}0",
        "6#6.6G6Y6b6g6r6}6",
        "2'2,22282>2D2J2P2V2\\2b2h2n2t2z2",
        "Number of days since snapshot installtime been set: %d",
        "%s is not running.",
        "0 040H0\\0p0x0",
        "struct DiskRange *__thiscall UnBCL::ArrayList<struct DiskRange>::GetBuffer(int)",
        "struct _GUID *__thiscall UnBCL::ArrayList<struct _GUID>::GetBuffer(int)",
        "696M6T6Z6_6k6u6",
        "Microsoft\\Windows\\CurrentVersion\\OOBE",
        "ERROR_NON_ACCOUNT_SID",
        "??C?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBEPAVEncoding@1@XZ",
        "9*:::J:Q:W:\\:l:v:",
        ":/:g:~:",
        "7/7=7M7]7n7",
        "ZwWaitForSingleObject",
        "tLj:Xf9B",
        "%hs: Failed to unload image software hive from %s. Error: 0x%08X",
        "ERROR_FAIL_RESTART",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback",
        "(%lx): Unable to get volume disk extents.",
        "Client",
        "Cleanup Windows.old",
        "[SetupCl library] %S",
        "; <3<b<i<o<t<",
        "ERROR_CLUSTER_JOIN_ABORTED",
        "\\REGISTRY\\USER",
        "Failed to delete snapshot [%s]. Error: 0x%08X",
        "ERROR_NO_SUCH_MEMBER",
        "=#=/=;=G=S=_=~=",
        "void __thiscall UnBCL::ArrayList<class COperationInfo *>::Resize(int,int)",
        "_CxxThrowException",
        "VdsPartition::CreateLogicalPartition: Failed to create logical partition enumerator (0x%08x)",
        "0 0(00040<0D0H0P0X0\\0d0l0p0x0",
        "<$<S<~<",
        "j(hP$^",
        "8!8+8B8Y8o8",
        ";,;<;D;T;\\;d;l;t;|;",
        "VdsVolume::Unmount: Failed to copy volume access path [%s] (0x%08x)",
        "Copying [%ws]",
        ".PAVCXXXXXHandledException@?HP@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@K@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        ".?AVCUpdateBootSector@@",
        ";G;\\;n;v;|;",
        ";*;8;?;I;Z;g;p;x;",
        "909D9M9g9|9",
        "Invalid parameter %S - path not found",
        "<)<E<\\<{<",
        ">Y>g>",
        "LP Validator: Failed to build language package list, will remove validator. Error: %08X",
        "?\"?5?<?B?G?R?^?s?",
        "class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::get_Current(void) const",
        "8#909H9e9",
        ".?AV?$SerializableBase@VCOperationResult@@$0A@V?$DefaultInstanceFactory@VCOperationResult@@@UnBCL@@@UnBCL@@",
        "SPGenerateCopyListFromConfigFile: Failed to concatenate %s to %s; Error: 0x%08X",
        ";&;8;@;F;S;e;o;",
        "ID |Name                                                                            |Executed|Start Time         |End Time           |Elapsed |Disk space(estim.)|Disk space(actual)|Disk space(diff.)|Hard Reserve(estim.)|Hard Reserve(actual)|Hard Reserve(diff.)|Reserve available|GUID                                  ",
        "5(585D5P5u5",
        "sActionPlatform::DeleteKey",
        ":*:]:s:",
        "6&6,696K6U6j6r6x6",
        "8#8-8>8K8T8\\8f8t8|8",
        "OC::CDownlevelOCStore::CDownlevelOCStore: No translation entry point in the dll.",
        "eSourcePath",
        "969K9W9]9|9",
        "<#<=<F<P<Z<g<p<",
        "9$9H9O9c9q9",
        "Set reg key value DownlevelTime failed: 0x%x",
        "ERROR_IPSEC_IKE_GENERAL_PROCESSING_ERROR",
        "?#?0?6???G?N?X?i?v?",
        "MaxFailureAttempt",
        ";*;6;B;N;Z;l;v;",
        "9^$uqjH",
        "<3=r=",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CUserProfile *>::MoveNext(void)",
        "1<2N2V2\\2i2{2",
        "CBS_E_WUSUS_BYPASS_MAPPING_UNAVAILABLE",
        "fr-ML",
        "Exporting store.",
        "HKLM\\SYSTEM",
        "jbYf;",
        "99x4t",
        "1(181A1J1_1h1u1|1",
        "3#3-3C3f3|3",
        "727N7t7",
        "InitializeAcl",
        "7S8b8x8",
        "606L6k6r6",
        "                                   Firmware type: %s",
        "{80E1749E-68A8-49A2-A67B-4EE4EA4082A2}",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,int>,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,int> __stdcall UnBCL::Hashtable<class UnBCL::String *,int>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,int> *,class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,int> > *,int)",
        "4*40494O4]4o4w4}4",
        "0#050=0C0}0",
        "Microsoft\\Windows\\CurrentVersion\\SideBySide\\Configuration",
        "1$161>1D1X1^1g1}1",
        "ValidateFileAndSetEACallback",
        "= =8=L=S=Y=^=j=u=",
        "GetVolumeFileCountCallback",
        "    Failed to create reparse point",
        ".?AU?$IDictionary@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@UnBCL@@",
        "SPAPI_E_DEVINFO_DATA_LOCKED",
        "9)939H9P9V9c9u9",
        "Disk space is at the limit, able to proceed by allowing 100 MB error margin.",
        ":8:Q:[:z:",
        ".?AV?$ArrayList@PAVCDeviceInfoData@CDeviceIdDatabase@@@UnBCL@@",
        "JET_errOutOfLongValueIDs",
        "%hs: Setting OS Footprint value failed. Error: 0x%08X",
        "=J=~=",
        "=E=S=_=u=",
        ":X:i:r:",
        "5/5>5x5",
        "1 181@1H1\\1d1l1|1",
        "%hs: Cannot find either default or current BCD entry. Error: 0x%08X",
        "2!272H2U2c2}2",
        ".?AVCOfflineApplyFromICB@@",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCOperationResult@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        ";C;M;~;",
        "<-=5=D=K=Q=V=b=n=",
        ".?AU?$IEnumerator@PAVCBasicEnvEntry@@@UnBCL@@",
        "444c4u4",
        ".?AV?$SerializableBase@VCTrustSafeOSBootCommand@@$0A@V?$DefaultInstanceFactory@VCTrustSafeOSBootCommand@@@UnBCL@@@UnBCL@@",
        "RtlCompressBuffer",
        "4'414D4k4",
        "=$=0=P=X=h=",
        "ERROR_CLUSTERLOG_CHKPOINT_NOT_FOUND",
        "void __thiscall UnBCL::ArrayList<class CImageInfo *>::CopyTo(class UnBCL::Array<class CImageInfo *> *,int) const",
        ">'>L>T>i>",
        "SPCopyFilesAndFolders: Failed to remove target folder %s. Error: 0x%08X",
        "SetupPhase",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCGlobalPath@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "ERROR_END_OF_MEDIA",
        "6$6-656:6?6Q6^6f6l6}6",
        "?\"?0?f?",
        "<&<2<7<@<G<T<`<i<u<z<",
        "6&6:6V6s6}6",
        ".?AVCXXXXXHandledException@?5??Finalize@CDeploymentBase@@QAE?AW4SYSTEM_STATE@SetupPlatform@@PAUIOperationsProgress@4@H@Z@",
        "$(runtime.programfiles)",
        "0ba562e6-a6ba-490d-bdce-93a770ba8d21",
        "9(969C9U9]9c9p9",
        "1D1c1",
        "|%I64d",
        "Failed to get WimMount file version, %s, 0x%x",
        "<$<3<C<]<q<z<",
        ".?AV?$SmartPtr@U?$IEnumerator@PBG@UnBCL@@@UnBCL@@",
        "tStart system services",
        "void __thiscall UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::set_Item(int,class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *)",
        "ERROR_INVALID_PORT_ATTRIBUTES",
        "%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x\\",
        "\\\\?\\CdRom",
        ".rdata$T$brc",
        "8C8Y8h8",
        "1,1C1]1e1k1p1",
        "6%6*666>6K6_6o6x6",
        "<#<?<F<L<Q<\\<n<",
        "SPRemoveScheduledTask: Remove task [%s] under [%s]",
        "SPCalculateDriveMappings: %s already maps to %s, ignoring the newer mapping %s",
        ".PAVCXXXXXTemp@?3??CallPidGenX@@YGJPBG000PAUDIGITALPID2@@PAUDIGITALPID3@@PAUDIGITALPID4@@@Z@",
        "0F0M0S0X0c0n0s0",
        "50585@5H5X5|5",
        "class COperationInfo *const &__thiscall UnBCL::ArrayList<class COperationInfo *>::get_Item(int) const",
        "void __thiscall UnBCL::ArrayList<class CImageInfo *>::Insert(int,class CImageInfo *)",
        "Failed to get convert creation time to SYSTEMTIME, Error: 0x%08X",
        ")OC::COCCbsAdapter::InitOnline: CoCreateInstance of CbsSession failed. hr = 0x%x",
        "5@6k6p6",
        "TracingEnabled",
        "OC::COCDismAdapter::GetOCsInPackage: DismGetPackageInfo failed. hr = 0x%x",
        "ERROR_SIGNAL_REFUSED",
        "ERROR_DIRECTORY",
        "151Y1y1",
        "0#0I0N0u0",
        "4!414U4\\4b4g4r4|4",
        "CRelocateOS: Collision detected for path %s, which is not an OS piece. Moving out of the way.",
        "(%lx): Failed writing boot entry to boot entry recovery file.",
        "7(7-7:7N7Y7c7p7y7",
        "Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
        "<8<M<U<[<h<z<",
        "__CLASS",
        "6#6,6H6R6[6b6o6{6",
        "pFinalizeUninstall: Uninstall not yet initiated, cannot Finish Uninstall",
        "? ?$?,?0?4?8?@?D?H?L?P?T?X?\\?`?d?h?l?p?x?|?",
        "SclpLinkProcessReparsePoint",
        "PQQQj",
        "Failed to get API PolicyManager_IsPolicySetByMobileDeviceManager from DLL, hr = 0x%08X",
        ".?AV?$SerializableBase@VCDiagnosticsHelper@@$0A@V?$DefaultInstanceFactory@VCDiagnosticsHelper@@@UnBCL@@@UnBCL@@",
        "> >->E>P>^>l>z>",
        "444<4D4L4T4\\4d4p4x4",
        "CReconstructOS::SaveTelemetryFields: Failed to save NumPackagesFailed: 0x%08x",
        "CDeviceIdDatabase::SelectInstallableInfs",
        "CDeploymentBase::RestoreMounts: Failure (0x%08X)",
        "; ;,;L;T;\\;d;l;x;",
        "OutputDebugStringW",
        "DiskReference",
        "ERROR_NONE_MAPPED",
        ".?AVCXXXXXHandledException@?BG@??GetAnswerFileContentsAsUnattend@@YGPAVString@UnBCL@@PBG0K@Z@",
        ".?AV?$SerializableBase@VCSetDefaultBootEntry@@$0A@V?$DefaultInstanceFactory@VCSetDefaultBootEntry@@@UnBCL@@@UnBCL@@",
        "5/5F5",
        "9#9)9.999E9Y9d9l9",
        "%hs: Fail-forward rollback is only available for WIM-based installation",
        "ERROR_SERVICE_ALREADY_RUNNING",
        "Cannot read the number of recovery attempts made so far.",
        ">E>O>U>`>n>",
        "Current op    : %u",
        "282[2~2",
        "ERROR_SERVER_DISABLED",
        ".?AV?$SerializableBase@VCExistentImageInfo@@$0A@V?$DefaultInstanceFactory@VCExistentImageInfo@@@UnBCL@@@UnBCL@@",
        "%hs: Unexpected parent device type %d; expected %d.",
        "9*909D9R9`9n9|9",
        "< <0<5<E<]<e<r<",
        "long __stdcall SPExecuteFirstBootCompletion(class UnBCL::String *)",
        ".PAVCXXXXXTemp@?6??SPProcessServiceDisable@@YGXPBG0@Z@",
        "    Failed to allocate _spElementType.get()",
        "N,PW3",
        "Partition",
        "%02u:%02u:%02u",
        "    Failed to allocate spNewPath.get()",
        "ERROR_REGISTRY_IO_FAILED",
        "CApplyWIM: Failure while opening image %d for %s. Error 0x%08X",
        ".?AV?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@",
        ":);V;",
        "Unknown phase %d. Cannot establish global percent values",
        ".?AV?$CAutoCleanupBase@PAUIUnknown@@@RAII@@",
        "5!5&515<5P5c5w5",
        ".PAVCXXXXXTemp@?3??DoExecute@CApplyBCDSettings@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "898>8G8c8y8",
        "<+<F<M<S<X<c<j< =O=V=\\=a=n=t=",
        "Will %sprocess drivers for the Safe OS",
        "Set reg key value UplevelBuildNumber failed: 0x%x",
        "ERROR_DATA_LOST_REPAIR",
        "ConvertStringSecurityDescriptorToSecurityDescriptor failed! Error code = %#x",
        "?GetNow@DateTime@UnBCL@@SG?AV12@H@Z",
        "5)5;5L5S5e5p5~5",
        "0%030K0R0Y0_0l0",
        "SnapshotCleanupTaskFailedHR",
        "FreeSpaceAfterCleanup",
        "SPGetDiskImage: GetVolumePathNamesForVolumeName failed while getting buffer length (0x%08x)",
        "RPC_X_INVALID_ES_ACTION",
        "QjNjJ",
        "1\"101G1]1",
        "8+858B8G8S8b8j8t8",
        "@9F$u",
        "ERROR_SXS_EARLY_DEACTIVATION",
        "7\"7:7z7",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State",
        "3 3%303B3J3P3d3m3",
        "2 20282\\2d2l2t2|2",
        "CNewSystem::QueueOperations: Estimated %llu bytes required memory",
        "6'616?6E6K6P6Z6d6n6x6",
        "WVh@(",
        "RunPlatformActions:Could not create Sysprep session; dwRet = 0x%x",
        ".?AV?$SerializableBase@VCGatherEndInstall@@$0A@V?$DefaultInstanceFactory@VCGatherEndInstall@@@UnBCL@@@UnBCL@@",
        "3%313=3I3U3y3",
        ";%;3;E;V;];s;",
        "?4?I?",
        "RestoreDirMetadata",
        "string copy failed: 0x%x",
        "VdsVolume::GetProperties: Couldn't allocate volume properties (0x%08x)",
        "so-SO",
        "%sServicing\\Packages\\%s.mum",
        "jaYjz_j:Z",
        "void __thiscall UnBCL::ArrayList<class CDeploymentBase *>::AddRange(const struct UnBCL::ICollection<class CDeploymentBase *> *)",
        "919_9i9",
        ";\"<A<N<j<w<",
        "0 0)060;0G0N0[0g0p0",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@KUTableKey@?$Hashtable@PAVString@UnBCL@@K@2@PAV12@UKeyTraits@42@$1?RetrieveKey@42@KGPAV12@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@K@UnBCL@@KUKeyTraits@23@V?$CElementTraits@K@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "tOS Footprint",
        ".?AU?$IEnumerator@G@UnBCL@@",
        "7%7-747>7F7N7U7c7k7s7z7",
        ";2;9;I;P;`;g;w;~;",
        "BQPQP",
        "ERROR_WAKE_SYSTEM_DEBUGGER",
        "Element::ExportPayload",
        "%hs: Low disk space detected. Will enable optimized installation path.",
        "u!WhP",
        "818a8q8}8",
        ".?AV?$SmartPtr@U?$IEnumerator@PAUPartitionLayoutArgs@@@UnBCL@@@UnBCL@@",
        "_vsnprintf",
        "Failed to open new OS DISM session. Error: 0x%08X",
        "WinreSkipOff",
        ">2>C>",
        "int __thiscall UnBCL::_::ArrayListEnumerator<struct UnBCL::ISerializable *>::MoveNext(void)",
        ";-;C;b;o;",
        "9 9(90989@9H9P9X9`9h9p9x9",
        "Failed to get version from package identity: %S",
        "ERROR_CLUSTER_GROUP_SINGLETON_RESOURCE",
        "CBS_E_SOURCE_NOT_IN_LIST",
        ":+:7:R:`:f:x:",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@_JPAVString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "4#4[4",
        ".?AVCXXXXXHandledException@?BJO@??Rollback@CSetupPlatformOSSwitchCheckpoint@@UAEXPBG@Z@",
        "void __thiscall UnBCL::Array<class COSPieceInfo *>::RemoveAt(int)",
        "ERROR_INVALID_EA_NAME",
        "JET_errCheckpointCorrupt",
        "2!2&232@2T2`2h2u2",
        "NtSetSecurityObject",
        "7(7,7D7H7`7d7|7",
        "No updates to download after filtering. Leaving...",
        "ERROR_NO_MORE_MATCHES",
        ":#;2;B;};",
        ".?AV?$SmartPtr@VCDriverPackageInfo@@@UnBCL@@",
        "6'686A6K6h6y6",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::get_Current(void) const",
        "int __thiscall UnBCL::Array<class CFailForwardSystem *>::Add(class CFailForwardSystem *)",
        ":*:::J:Q:W:]:i:s:",
        "4-4A4e4",
        "CMergeWIM::DoExecute: Cannot get WIM attributes. Error: 0x%x",
        ";$;0;P;X;`;l;",
        "void __thiscall UnBCL::ArrayList<class CDrvStoreProperty *>::QuickSort(class UnBCL::ArrayList<class CDrvStoreProperty *> *,class UnBCL::ArrayList<class CDrvStoreProperty *> *,int,int)",
        "3,3K3",
        "9::D:S:Z:g:{:",
        "4/474=4O4`4m4",
        "7,7@7P7Y7a7h7{7",
        ">$?9?A?G?P?f?t?",
        "CSetupPlatformPrivate::RollbackOnlineCommon",
        "MIG Validator: Machine-independent: %s",
        "728F8M8",
        "%hs: Cannot copy WinRE image from %s to %s. Error: 0x%08X",
        ":\":5:H:Z:j:",
        "ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE",
        "3,343B3J3S3f3|3",
        "Writing Crashdump Enabled value: %s. to config file",
        "FolderMoveRollback: Cannot locate folder move log file \"%s\". Did we even get this far?",
        "=(=/===D=R=Y=g=n=|=",
        " !\"#$44444444444444444444444444444444444444444%&'()*44444444444444+,-./0123",
        ".PAVCXXXXXTemp@?3??LogVdsStatus@@YGXXZ@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::RemoveAt(int)",
        "ERROR_DS_SECURITY_CHECKING_ERROR",
        "5 5+5?5M5T5Z5`5k5u5",
        "SPFindFirmwareBootDisk",
        "3%313C3b3j3",
        "DiskLayoutMakeWindows: Couldn't assign a drive letter to Windows volume (0x%08x)",
        "class CInfFile **__thiscall UnBCL::ArrayList<class CInfFile *>::GetBuffer(int)",
        ".?AVStringProperty@?1???$pDefineStringProperty@V<lambda_717848d509cb921e33f43fded55a6c66>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_717848d509cb921e33f43fded55a6c66>@@@Z@",
        "ocStatusFilePath2",
        ";!;,;9;A;G;[;d;u;",
        "    Classes hive: %s",
        "(%lx): NtQueryVolumeInformationFile failed",
        "y/Sh{",
        "ERROR_GENERIC_NOT_MAPPED",
        "9D9u9",
        "= =/=>=G=Q=Z=d=m=w=",
        "ERROR_SERIAL_NO_DEVICE",
        "ITaskFolder::DeleteTask failed. hr = 0x%x",
        "7J8O8_8",
        "7\\7o7t7",
        ".?AV?$ArrayList@PAVCOperationResult@@@UnBCL@@",
        "CSetupPlatform::CreateNewSystem: Failed to get create helper automation. hr = 0X%x",
        "ERROR_FAIL_I24",
        "'tDVV",
        "1?2V2c2",
        "4#404<4L4T4[4a4f4q4{4",
        "%0J0T0[0a0f0q0",
        "wpx.dll",
        ".?AVCAddDriver@@",
        ".PAVCXXXXXTemp@?GL@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "9!9'959C9L9U9^9g9p9",
        "SPGetExistentImageInfo: Failed to get image info from the software hive. Error: 0x%08X",
        "QSVVV",
        ".?AU?$IEnumerator@PAVCDUPackage@@@UnBCL@@",
        "SPDeleteOldUpgradeSnapshots: Failed to query snapshot size for [%s]. Error: 0x%08X",
        ".?AU?$IEnumerable@PAVCWIMEntryIndex@CWIMBootHelper@@@UnBCL@@",
        "L$@QP",
        ".?AV?$SerializableBase@V?$Array@PAVCOperationResult@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCOperationResult@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        ".PAVCXXXXXHandledException@?DI@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "7>8A9",
        ":$:4:H:O:r:y:",
        "404H4U4m4{4",
        "Insufficient space to install updates",
        "Enable Page File in SafeOS",
        "t5htm",
        "ImageRebuildFromImageHandle",
        ".?AVCXXXXXHandledException@?ML@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "656=6U6]6",
        "kr-Latn-NG",
        "Number of big blocks = %d (%d bytes)",
        "WNetAddConnection2 failed. Error: 0x%08X",
        "WinRETel-Merge.etl",
        "9)9<9D9J9W9i9w9",
        "535k5p5u5",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *> *)",
        "Wj+j,",
        "%hs: Cannot queue sync command execution. Error: 0x%08X",
        "22O294",
        ".?AVSmPhysDisk@@",
        "void __thiscall UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *>::QuickSort(class UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *> *,class UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *> *,int,int)",
        "CreateDirectory failed",
        "3'33383L3f3",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,unsigned long>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,class ATL::CElementTraits<unsigned long> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,unsigned long> *,class UnBCL::Array<class UnBCL::String *> *,int)",
        "4 5k5",
        "OC::CDownlevelOCStore::CDownlevelOCStore",
        "SPHexDecode: Failed to decode digit [%u]",
        "9<9D9L9T9\\9d9|9",
        "<\"<(<.<4<:<@<F<L<R<X<^<d<j<p<v<|<",
        "?8?O?h?",
        "3,3;3R3X3e3v3",
        "0 0$04080H0L0\\0`0p0t0",
        "VdsDisk::InitializeProperties: Failed to get disk properties (0x%08x)",
        "6*626<6C6I6N6Y6e6y6",
        "2\"3@3",
        "ERROR_DS_NAME_ERROR_NO_SYNTACTICAL_MAPPING",
        "9c9j9p9v9",
        "?*?1?C?Z?g?p?",
        "ComponentUpdate:",
        "4'4f4v4",
        "\\system32\\ntoskrnl.exe",
        "ABCDEFGHIJKLMNOPQRSTUVWXYZ",
        ".?AVCGatherOCs@@",
        "IsLowDiskSpace",
        "SL_E_NOT_SUPPORTED",
        "pComponent->Name->CString",
        "VdsVolume::Mount: Failed to add volume access path [%s] (0x%08x)",
        ")Microsoft Root Certificate Authority 20100",
        "?$?.?8?B?P?V?\\?a?k?u?",
        ">&>8>@>F>S>e>s>",
        ".?AVCSPMigProgress@@",
        "838U8s8",
        "0&0;0C0I0R0h0",
        "StackWalkingFilter",
        "sq-AL",
        "6%626B6R6Z6h6p6",
        "<!<G<L<`<",
        "CExecuteUnattend::DoExecute: Couldn't restore the status of pass %s: 0x%08x",
        "9$959B9J9[9h9p9",
        "?G?M?V?a?",
        "SL_E_BLOCKED_PRODUCT_KEY",
        "ExecuteOperations: Failed execution phase %s. Error: 0x%08X",
        "SKIPBOOTTRACK(SAFEOS): %hs: Will not attempt the SafeOS boot removal, exiting",
        "6 6$6(6,64686<6@6D6H6L6P6T6\\6`6d6h6p6t6x6|6",
        "Only test hook available, skip download.",
        "8+848:8G8M8R8c8n8|8",
        "7,767?7G7f7|7",
        "LP Validator: Execution of OC gather operation completed.",
        "4,5`5",
        "%hs: BCD Open failed with error 0x%08X, likely this system does not have an active BCD",
        "Ph0aG",
        "6$6+62686B6d6v6",
        "?-?T?f?n?t?}?",
        "JET_errColumnTooBig",
        "SSSQh",
        "CDebuggingSetting::Apply",
        "?(?2?9???D?O?`?t?",
        "959M9o9u9",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCProfileInfo@@@UnBCL@@@UnBCL@@",
        "ERROR_IPSEC_IKE_SECLOADFAIL",
        "?Replace@String@UnBCL@@QBEPAV12@PBG0W4StringCasing@12@@Z",
        "=%=/=8=A=M=V=b=o=y=",
        ".?AV?$ArrayListEnumerator@PAVCOSPieceInfo@@@_@UnBCL@@",
        "=*=;=B=^=e=k=w=",
        "JET_errInvalidSesid",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCCleanupEntry@CSimpleCleanup@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "SetEnvironmentVariableW",
        "2!242;2M2n2u2",
        "ERROR_TAG_NOT_PRESENT",
        "int __thiscall UnBCL::_::ArrayListEnumerator<struct DiskMatchFilter>::MoveNext(void)",
        "ERROR_DS_EXISTS_IN_MUST_HAVE",
        "=)=2=C=T=a=f=n=v=",
        "41484?4O4V4\\4e4p4{4",
        "QQWP3",
        "CUninstall::StartUninstall",
        "6!6-6;6R6Y6_6d6o6",
        "     Full: %I64u",
        "5 5$5(5,5054585<5@5D5H5L5X5\\5`5d5h5l5p5t5x5|5",
        ";#;:;d;",
        "%hs: Cannot restore control environment variables",
        "CDiagnosticsHelper::Merge: Found external [%s] and internal [%s]; will keep internal value.",
        "ProvisioningPackage::GetPath",
        ":):/:4:H:X:k:s:y:",
        "%hs: Number of folder names found: %d",
        ";';;;D;M;Y;q;",
        "9MdHdu",
        "CDownloadDUUpdates::FilterUpdates: IDUUpdate::GetWUAInterface failed. hr = 0x%x",
        "7%727D7`7g7m7y7",
        "ERROR_INVALID_DATA",
        "7?7P7_7p7",
        "ERROR_DS_ROOT_REQUIRES_CLASS_TOP",
        "`f9>u6",
        ".PAVCXXXXXTemp@?FO@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "5!5)5/5<5N5\\5}5",
        "VVVVj",
        "SP_OPERATION_INFO",
        "JET_errInvalidLogDirectory",
        "Extracting BOOT directory from %s to %s",
        "7%717:7G7S7_7k7w7",
        "WimApplyPrivileges",
        "2+232<2B2T2e2r2~2",
        "4$40484=4B4V4d4k4q4v4",
        "ERROR_PROC_NOT_FOUND",
        "3 3$3(3,343X3`3|3",
        "int __thiscall UnBCL::ArrayList<struct SetupPlatform::IDisk *>::LastIndexOf(struct SetupPlatform::IDisk *,int,int) const",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@",
        "242E2Q2]2i2u2",
        "969<9N9^9g9",
        "4)4H4_4l4",
        "ERROR_DS_CROSS_DOM_MOVE_ERROR",
        "?'?K?]?e?k?x?",
        "2:3A3G3L3X3f3k3",
        "pSPSopeFileCallBack",
        "9 9$9<9@9X9\\9t9x9",
        "2(2Q2j2",
        "2 2(2,20242<2`2h2l2p2t2",
        "GetSystemPartitionPath: Hit error [0x%X] while inspecting drive [%c:].",
        "%hs: Cannot set temp path for new WIM. Error: 0x%x",
        ">$>(>,>0>4>8><>@>D>H>L>P>T>\\>`>d>l>p>t>|>",
        "ERROR_PRINTER_ALREADY_EXISTS",
        "Failed to prefix stack directory.",
        "0\"0:0K0R0d0z0",
        "=\"=[>",
        "base\\ntsetup\\opktools\\sysprep\\lib\\sysprepreg.cpp",
        "7(7:7M7Z7r7}7",
        "Cannot create WinPE boot logging directory %s.",
        "JET_errFileInvalidType",
        "class COSPieceInfo *__thiscall UnBCL::_::ArrayListEnumerator<class COSPieceInfo *>::get_Current(void) const",
        "<0<><W<^<e<l<s<z<",
        ">!>.>6>H>O>U>]>i>t>|>",
        ";&;7;e;j;w;",
        "6\"666t6",
        "SPCleanupInstallationDrive: Unable to unload mounted hives under %s. Error: 0x%08X",
        "ReadFile",
        "6&606D6U6h6",
        "=$=,=@=H=P=`=l=t=",
        "5 5%505C5J5R5Y5n5u5{5",
        "UblIsUSBDiskControllerXHCI",
        "DismApi.DLL",
        "=&=/=I=Y=c=m=v=",
        "COfflineApplyFromICB: Offline apply operation failed. Status: %d",
        ":':B:I:O:T:_:j:p:",
        "ERROR_EXCEPTION_IN_SERVICE",
        "CCreateScopedSnapshot::DoExecute: Failed to store snapshot ID into registry key. Error: 0x%08x",
        "pAddSafeOSDrivers: Failed to unomunt the mounted WinPE image at [%s]. Error: 0x%08X",
        "??_D?$Array@PAVString@UnBCL@@@UnBCL@@QAEXXZ",
        "<%<2<D<R<s<",
        "3X3x3",
        "1:1K1[1b1h1m1x1",
        "SL_E_SLP_MISSING_ACPI_SLIC",
        "SPValidateMigratedServices: validating presence of binary file: %s (%s)",
        "oeY<9",
        "QQQQh",
        "CAddCbsPackage::DoExecute: Failed to check new OS image health. Error: 0x%08X",
        "?\"?+?<?N?`?i?z?",
        "CDeploymentBase::RestoreMounts",
        "class CNewSystem *__stdcall UnBCL::Try_Cast<classCNewSystem*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "Error creating %s path! Last Error = %#x",
        "9B9X9}9",
        "6!6'636B6X6`6",
        "<$<H<X<`<|<",
        "5'525;5D5M5V5_5h5",
        "3I3P3",
        "0%0+0?0Z0q0y0",
        "Destination0",
        "DiskLayout::VerifyLayoutFillSpaceOnce",
        "OrchestratePublishWnfDwordData: Failed to get procedure RtlPublishWnfStateData from ntdll.dll",
        ";/<W<",
        ".?AV?$ArrayListEnumerator@PAVCCmdLineExecutionTelemetryData@OC@@@_@UnBCL@@",
        "Remove OS Uninstall",
        ":(:1:::C:L:U:c:",
        "9%9*979=9I9V9^9d9y9",
        "SEH: Could not find exception logger function; can't log exception",
        "??0MemoryStream@UnBCL@@QAE@XZ",
        ".?AV?$ArrayList@PAUISerializable@UnBCL@@@UnBCL@@",
        "System\\Setup\\Status\\SysprepStatus",
        "<,<0<H<L<d<h<",
        ".?AV?$ArrayList@PAVCFilterDriverInfo@@@UnBCL@@",
        ".PAVCXXXXXTemp@?3??DoExecute@CAddSetupClRequest@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "tMSj\\[f9",
        "7!737A7e7",
        "CSetupAutomation::GetDiskInfo: Cannot look up partition: disk platform not available",
        "ERROR_IPSEC_IKE_GETSPIFAIL",
        "System32",
        "6:6H6Q6b6j6w6",
        "Existing OS cannot expand %%SystemDriveNative%%, will not queue early apply",
        "ERROR_DS_OBJ_CLASS_NOT_DEFINED",
        "CDeploymentBase::PreInitialize: Error creating the DeploymentInProgress key. Error: 0x%08X",
        "= =/=4=U=i={=",
        "00080>0P0d0q0",
        "UpdateHardlinkDir",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Failed to create WinPE rollback directory: %s",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$ArrayList@PAVCDriverDetails@@@2@@UnBCL@@@UnBCL@@@UnBCL@@",
        ":X:s:",
        "WINHTTP.dll",
        "Current FirstUXWnd phase: %u",
        "6%6F6c6{6",
        ";\";);/;4;?;L;Q;e;l;q;",
        ".?AVCRefreshLocalizedString@@",
        "ERROR_SXS_DUPLICATE_WINDOWCLASS_NAME",
        "98:E:]:",
        "4)40464<4G4Q4d4t4",
        "QueueDriverMigration called with offline dir %s",
        "%hs: Closing narrator app, if it is running",
        "Failed to re-create the WIMBoot partition. Error: 0x%08X",
        "VdsPartition::Format: Couldn't query format support information for partition (0x%08x)",
        ".?AV?$ArrayListEnumerator@PAVCRegCreationData@@@_@UnBCL@@",
        "IExecAction::put_Path failed. hr = 0x%x",
        "Locating user profile hive: %ws",
        "SPReadXmlFile",
        "{272AB3B8-5B2C-41D9-B2C3-D8BD65BB015F}",
        "2%3m3r3",
        "CReconstructOS::RestageWindows: Failed to restore language selections: 0x%08x",
        "3(30383D3L3d3l3",
        "9+999|9",
        ".?AV?$SerializableBase@VCRefreshLocalizedString@@$0A@V?$DefaultInstanceFactory@VCRefreshLocalizedString@@@UnBCL@@@UnBCL@@",
        "Failed opening source CanonicalData key",
        "4S4`4h4{4",
        "3-3B3[3r3",
        "3\"3(353G3c3~3",
        "6 6$6(6,60646<6@6D6H6P6T6X6\\6`6d6l6p6t6|6",
        ".?AV?$CAutoRelease@PAVWmiCollection@WMI@@@RAII@@",
        "ReadData reparse tag from filestream failed",
        "Failed to delete debugger settings element %08x. Status = [%x]",
        "CRelocateOS: Error writing converted entries",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCDUPackage@@@UnBCL@@@UnBCL@@",
        "?get_P@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@2@XZ",
        "SymbolicLink",
        "xDlTel-Merge.etl",
        "?/?;?C?J?p?",
        "414H4]4d4j4o4z4",
        "9&979D9N9_9l9v9",
        ">)>A>W>f>z>",
        "6!6+62686=6H6S6g6s6{6",
        "void __thiscall UnBCL::Array<enum OP_OPERATION_ID>::InitLarva(class UnBCL::ArrayList<enum OP_OPERATION_ID> *)",
        "Failed to get Autologger setting, 0x%x",
        "RpcStringFreeW",
        "xBootStat\\EFI",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCGlobalPathFindData@@@UnBCL@@@UnBCL@@",
        "6 7p7",
        "AcquireSRWLockShared",
        "3.353<3B3N3`3n3|3",
        "Cannot move WIMBoot info file. Error: 0x%08X",
        "SL_E_CAL_STORE_ENDOFROWSET",
        "8@8M8i8",
        "WVhPI",
        ";$;;;b;",
        "%hs: Failed to write the OS pieces to the %s config file. Error: 0x%08X",
        "5.5B5I5O5T5g5q5",
        "PWWWWh(",
        "MessageBoxW",
        "?&?2?;?O?X?d?",
        "<)<1<7<I<Y<b<s<",
        "<q=}=:>C>",
        "pIsUninstallInitiated: Failed invoking IUninstallInternal::IsUninstallInitiated, hr = 0x%x",
        "BRANCH",
        "CBS_E_PAC_INITIAL_FAILURE",
        ":\":+:4:<:K:R:X:]:h:s:",
        "jwj1h@a",
        ".?AVCDeploymentInstallOptions@CDeploymentBase@@",
        "CApplyOCs::DoExecute",
        ">(>7>P>f>w>",
        "8#8(838A8U8q8",
        "WIM\\IMAGE[*]\\CREATIONTIME\\HIGHPART",
        "    Failed to copy the rest of the file",
        ".?AVCMigChangesValidator@@",
        ".?AU?$ICollection@PAUPageFileDesc@@@UnBCL@@",
        ".?AV?$SerializableBase@VCInstallDUUpdatesOffline@@$0A@V?$DefaultInstanceFactory@VCInstallDUUpdatesOffline@@@UnBCL@@@UnBCL@@",
        ".PAVCXXXXXHandledException@?JG@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "%hs: ocateOS: Failed to write WinOld mapping destination %s to the %s config file. Error: 0x%08X",
        "=\"=6=N=f=s=",
        "3#3.393>3R3y3",
        "5$505P5X5`5l5",
        "5/595g5",
        ".?AVStringProperty@?1???$pDefineStringProperty@V<lambda_c6a8c2cf9db53aedb2c0289d2f817317>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_c6a8c2cf9db53aedb2c0289d2f817317>@@@Z@",
        "1*2<2O2V2c2j2s2z2",
        "CERT_E_VALIDITYPERIODNESTING",
        "3)323;3D3M3Y3i3z3",
        "GatherDeviceIDsInDriverPackage:Failed to gather device ID's from [%s]. Error code is [0x%X]",
        "SysprepComponent::CreateSysprepActionList: Invalid inner action node under %s for component %s",
        "GetCurrentProcess",
        "PPPPSW",
        ".PAVCXXXXXHandledException@?2??DoExecute@CSplitWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "FileSystem of %s is %s",
        "=1=E=M=Z=q=}=",
        "ERROR_EVT_INVALID_CHANNEL_PROPERTY_VALUE",
        "4\"434:4G4T4[4h4m4}4",
        "ry9|$",
        ".PAVCXXXXXTemp@?M@??SPCalculateDriveMappings@@YGJPAVString@UnBCL@@PAPAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@3@H@Z@",
        ".PAVCXXXXXHandledException@?2??DoExecute@CSetBootCommand@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "8\"8^8r8",
        "A0H0U0\\0r0}0",
        ";4;8;P;T;l;p;",
        "PowerButtonShutdownInProgress:%d",
        ".?AVCInternalGenericProgress@@",
        "CNewSystem::QueueOperations: low diskspace policy detected, so we will collect only minidump",
        ":#:+:1:E:K:T:j:w:",
        ".?AU?$IEnumerator@UDISK_SPACE_IMPACT@@@UnBCL@@",
        "VdsDisk::InitializeProperties: Failed to convert disk GUID to string (0x%08x)",
        "RollbackInitialize finished.",
        "CFailForwardSystem::QueueDriverMigration",
        "SPAPI_E_NO_CLASS_DRIVER_LIST",
        "5:5A5G5P5[5g5s5",
        ";9;T;^;h;n;|;",
        ")WindowsOldDir",
        "?#?;?O?_?l?}?",
        "%hs: Cannot convert external GUID to a string. Error: 0x%08X",
        "unsigned int __thiscall UnBCL::_::ArrayListEnumerator<unsigned int>::get_Current(void) const",
        "2(2,2D2H2`2p2t2x2",
        "SPAPI_E_IN_WOW64",
        "MigStartupOffline",
        "7$7,737^7p7",
        ":(:7:Q:",
        "4%494F4Q4{4",
        "CFastDeleteImplT<class CDirectoryProviderT<class CWindowsOldAdaptor>,1>::ProcessTreeForDeletion",
        "REG_BINARY",
        ")Operations",
        ".?AV?$Array@PAV?$DictionaryEntry@PAVString@UnBCL@@H@UnBCL@@@UnBCL@@",
        "?$?9?K?^?o?w?}?",
        "20373=3B3M3X3l3",
        ":(:C:J:P:U:`:k:w:~:",
        ";$;);=;N;Y;^;c;{;",
        "2=3V3\\3b3q3x3",
        "; ;(;4;=;G;l;s;y;~;",
        "ERROR_DEVICE_ALREADY_ATTACHED",
        "4@4T4",
        "CallContext:[%hs] ",
        "ValidateInput: ByteAlignment assigned SectorSize",
        "GetAnswerFileContentsAsUnattend: Parsed %s, but found invalid setting data",
        "SL_E_TOKSTO_CANT_PARSE_PROPERTIES",
        ".?AU?$IEnumerator@PAVCDriverDetails@@@UnBCL@@",
        "7G7Q7i7",
        "1(1C1",
        "Apply BCD settings for %s",
        "2C2n2}2",
        ".?AV?$SerializableArrayBase@PAVCBcdSetting@@@_@UnBCL@@",
        "z.9Wv",
        "ProcessWimQueueNode",
        "Failed to write extra recovery partition info to file: %s. Error: 0x%08X",
        "void __thiscall UnBCL::ArrayList<class CInfFile *>::QuickSort(class UnBCL::ArrayList<class CInfFile *> *,class UnBCL::ArrayList<class CInfFile *> *,int,int)",
        "0$0,040<0L0T0\\0d0l0t0|0",
        ".?AVCImageInfo@@",
        "No more files to find",
        "$NeedDeleteBCD.tag",
        "CDeploymentProject::CreateVHDDeployment: Failed to queue automation into new system; Error: 0x%08X",
        ".PAVCXXXXXTemp@?HE@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "order",
        "void __thiscall UnBCL::ArrayList<class SysprepAction *>::Insert(int,class SysprepAction *)",
        "RPC_S_STRING_TOO_LONG",
        "3'333;3X3s3",
        "9U9^9z9",
        "VDS available",
        ":+:6:_:",
        ".?AVCDriverDetails@@",
        "SclRegProcessValue",
        "Enable feature %s",
        "\\\\?\\Harddisk%uPartition%u\\%s",
        ".?AU?$ICollection@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVCGlobalPath@@@UnBCL@@@UnBCL@@",
        "3+3E3N3v3",
        "VPiw&",
        ";E;S;Z;`;e;p;w;",
        ".PAVCXXXXXTemp@?3??DetectDefaultInstallSection@CInfFile@@KGJPBGPAVTARGET_INFO@@PAH@Z@",
        "<&<8<W<e<n<w<",
        "=$=S=|=",
        "DiskLayoutMakeSystem: Failed to set the system partition as active: 0x%08x",
        ">2>S>^>}>",
        "Hbg&~",
        "LogPath",
        "%hs: Move Telemetry to [%s]",
        "516E6W6_6e6n6",
        "Progress type is %d",
        "Rollback-Online-System completed with error: 0x%08X",
        ";.;Q;c;w;",
        "3\"333m3t3",
        "CDumpSourcesData: Failed to main source path to file: %s. Error: 0x%08X",
        "CDownloadDUUpdates::CalculateSpaceNeeded: Found a non-component update for which cab files will not be extracted. This is unexpected! hr = 0x%x",
        "0%020:0D0L0V0^0e0s0{0",
        "<!=-=G=_=d=w=~=",
        "SL_E_VL_BINDING_SERVICE_NOT_ENABLED",
        "CP9C<t",
        "ERROR_DS_MISSING_FSMO_SETTINGS",
        "5T5t5",
        ".PAVCXXXXXHandledException@?2??DoExecute@CMountWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ".PAVCXXXXXHandledException@?2??RegisterRollbackOnlineUsr@CSetupPlatformRollback@@UAEJPBG0@Z@",
        ">8>`>",
        "POLICY\\POLACDMS",
        "smiengine.dll",
        "3 3(303<3\\3d3l3x3",
        "9#9(9<9O9\\9h9o9u9z9",
        "7\"777I7]7",
        "ERROR_CTX_WINSTATION_BUSY",
        "3D3Q3l3",
        "! !!!\"!#!$!%!&!'!(!)!*!+!,!-!.!/!0!1!2!3!4!5!6!7!8!9!:!;!<!=!>!?!@!A!B!C!D!E!F!G!H!I!J!K!L!M!N!O!P!Q!R!S!T!U!V!W!X!Y!Z![!\\!]!^!_!p!q!r!s!t!u!v!w!x!y!z!{!|!}!~!",
        "CARPValidator::ValidatePreExecution: Failed to create working directory %s",
        "SPAPI_E_FILEQUEUE_LOCKED",
        ".?AV?$DefaultInstanceFactory@VCDUImageInfo@@@UnBCL@@",
        "31393K3f3",
        "Module",
        ".?AVCXXXXXHandledException@?2??CreateRamdiskOptions@CAddSafeOSBootEntry@@IAEJPAXPBG1PAU_GUID@@@Z@",
        "ERROR_TRANSACTIONMANAGER_NOT_ONLINE",
        ".?AV?$SerializableBase@VCEnableFeature@@$0A@V?$DefaultInstanceFactory@VCEnableFeature@@@UnBCL@@@UnBCL@@",
        ".?AVCXXXXXHandledException@?CCI@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ": :<:D:\\:d:l:t:|:",
        "CleanupUpgradeSnapshot",
        ">6>D>M>o>",
        "Successfully queried tick count (%u) for upgrade security template",
        "?*?R?p?",
        "2 2,2@2Q2e2l2r2w2",
        "8-949",
        ".?AV?$DefaultInstanceFactory@VCDiagnosticsHelper@@@UnBCL@@",
        "<0<Z<v<",
        "RPC_S_CALL_IN_PROGRESS",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UnattendSettings",
        "Failed to stop kernel mode tracing. hr = 0X%x",
        "=#=5=C=P=b=j=p=}=",
        ":E;O;g;",
        "Only TestHook update available.",
        "Bugcheck param 1",
        ".rdata$sxdata",
        "void __thiscall UnBCL::ArrayList<class COSPieceInfo *>::CopyTo(class UnBCL::Array<class COSPieceInfo *> *,int) const",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@@UnBCL@@",
        "?SetCompressionState@File@UnBCL@@SGHPBVString@2@G@Z",
        "JET_errFeatureNotAvailable",
        "/WIM/IMAGE[@INDEX=\"%u\"]%s",
        "_f9<B",
        "676=6O6c6p6x6",
        "void __thiscall UnBCL::ArrayList<class CFailForwardSystem *>::CopyTo(class UnBCL::Array<class CFailForwardSystem *> *,int) const",
        ":I:m:",
        "BfspPrintFileOwnerProcess: NtQueryInformationProcessfailed in unexpected manner! Status = %#x",
        " into: ",
        "0H0`0g0n0t0",
        "; <(<0<D<L<T<d<p<x<",
        "y.VhX",
        ".PAVCXXXXXHandledException@?2??DoExecute@CAddCbsPackage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "void __thiscall UnBCL::ArrayList<struct DiskLayout::Partition>::Resize(int,int)",
        "393O3T3`3",
        "RPC_S_INVALID_TAG",
        "6$6,646@6d6l6t6|6",
        ".PAVCXXXXXTemp@?3??TearDownCbsLogging@CReconstructOS@@IAEJXZ@",
        "lSVWjH",
        "Failed copying CanonicalData keys",
        "5*5>5U5f5",
        "<#<-<7<A<K<b<p<z<",
        "8,8w8",
        "SPDeleteAllSnapshots: Failed to create backup components. Error: 0x%08X",
        ";/;9;L;T;Z;g;y;",
        "3.3F3^3k3w3",
        "PWSh=",
        "8 8T8r8",
        "6)6;6G6O6\\6e6p6y6",
        "OSBitLockerHandling",
        "ERROR_IPSEC_IKE_NEG_STATUS_END",
        "VRQPh",
        "JET_errRecordNoCopy",
        "=@=S=f=y=",
        "5#575H5O5U5Z5f5s5",
        "ERROR_INVALID_FLAG_NUMBER",
        "Serializing operations queue...",
        ";(;L;Z;{;",
        "%hs: DUStartup failed. hr = 0x%x",
        "?*?=?D?M?T?",
        "  Pass: %s",
        "MIG_COMPONENTS_IGNORE_SMI",
        ".?AU?$ICollection@PAVSysprepAction@@@UnBCL@@",
        "NtDeviceIoControlFile",
        "ERROR_DS_INSTALL_NO_SRC_SCH_VERSION",
        "041P1t1",
        "3#303I3l3r3}3",
        "6 6$6,6D6H6`6p6t6x6",
        "setupapi.offline.log",
        "pSPDoOfflineApply",
        "void __thiscall UnBCL::Array<class CShellFolderInfo *>::InitLarva(class UnBCL::ArrayList<class CShellFolderInfo *> *)",
        "3#3H3e3v3",
        ";#;@;f;y;",
        "void __thiscall UnBCL::ArrayList<class CPartitionInfo *>::RemoveAt(int)",
        ";l<s<",
        "323@3`3g3m3r3}3",
        "VdsPlatformDiskEnumerator::Initialize: Failed to query unallocated disks (0x%08x)",
        "9H t&9H$t!",
        "    Failed to get meatdata write temporary file",
        ".?AU?$IEnumerator@PAUHKEY__@@@UnBCL@@",
        "0.0C0R0\\0a0i0p0|0",
        "Failed 'end' directory callback",
        "JET_errOutOfBuffers",
        "void __thiscall UnBCL::ArrayList<class CBcdSetting *>::AddRange(const struct UnBCL::ICollection<class CBcdSetting *> *)",
        "const struct _GUID &__thiscall UnBCL::ArrayList<struct _GUID>::get_Item(int) const",
        "ERROR_ARITHMETIC_OVERFLOW",
        "9A9T9b9p9",
        "9#9.9<9C9I9N9Y9d9x9",
        ".MIG_OSDB_CHECK_WINSXS",
        "BfsCleanupBcdStore flags(0x%x)",
        "Target key [%ws] already exists",
        "ERROR_IPSEC_MM_POLICY_IN_USE",
        "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6",
        "CAddProvisioningPackage::DoExecute: Invalid provisioning package path: %s",
        ";#;>;E;O;T;_;j;o;",
        "y!Vh=",
        ":):5:N:W:e:v:",
        ">9>Q>j>~>",
        "ERROR_DS_SCHEMA_ALLOC_FAILED",
        "SPGetWIMImageInfo: Software hive from temporary location in use; logging process names.",
        "9$989E9W9^9g9l9w9",
        "%Microsoft Windows Production PCA 20110",
        "MoveDirectoryFileCallback: Unable to copy file from [%s] to [%s]; GLE = 0x%x",
        ":*:A:O:e:",
        "3@3K3^3u3",
        "1.1:1H1T1k1x1",
        "<+<G<\\<i<y<",
        "%hs: Invalid package target",
        "5+5@5H5X5q5~5",
        "%hs: WIMFile parameter cannot be NULL.",
        "?,?D?c?x?",
        "?CompareTo@String@UnBCL@@QBEHPBGH@Z",
        "ServerRdsh",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::Remove(class UnBCL::String *)",
        ".?AVCEnableFeature@@",
        "6'636D6[6g6s6",
        ";;;M;U;[;h;z;",
        "CSh %",
        "pDUSearch: DUSearch result is not successful. Operation result code = %d",
        "Mum servicing LCU detected, ignore: %ws",
        ")SmPlatformDiskEnumerator::ConstructImageDisk",
        "ReadOrWriteSectorsWinNt: Couldn't set file pointer to 0x%I64x",
        "Failed to close the WIM handle for WIMBoot entry %I64u. Error: 0x%08X",
        "pLogUnattendResults",
        "<$<p<",
        ".PAVCXXXXXHandledException@?L@??pSPSplitWim@@YGJPAVString@UnBCL@@0P6GKT_LARGE_INTEGER@@111KKPAX22@Z22H@Z@",
        "EtwEventUnregister",
        ".PAVCXXXXXHandledException@?2??ApplyServicingSettings@@YGXPBG000@Z@",
        "=-=4=:=?=J=Q=V=j=",
        "CDownloadDUUpdates::FilterUpdates: IUpdateIdentity::get_UpdateID failed. hr = 0x%x",
        "^j?[;",
        ";%;3;@;T;b;l;r;",
        "SPCreateServicesKeyFirstBoot",
        "6+6H6^6",
        ".?AVCCloseLogFiles@@",
        "ERROR_DS_CANT_DEL_MASTER_CROSSREF",
        "3D4V4^4d4q4",
        "XFirstBootPreSysprepEndTime",
        "PhP!9",
        "Enumeration of hive list failed. GLE: %u",
        ".CFirstBootApply::DoExecute",
        "CreateMutexExW",
        "1,2h2",
        "2*262<2H2T2Z2f2t2z2",
        "7*7<7",
        ".PAVCXXXXXHandledException@?P@??Rollback@CSetupPlatformOSSwitchCheckpoint@@UAEXPBG@Z@",
        ".PAVCXXXXXTemp@?BF@??QueueAddCbsPackage@CNewSystem@@IAEJHPAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@_K@UnBCL@@@UnBCL@@HW4SP_ERROR_HANDLING@SetupPlatform@@KW4OP_OPERATION_ID@@@Z@",
        ".PAVCXXXXXTemp@?CE@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "1$1M1r1",
        "class CCopyInfo *__thiscall UnBCL::_::ArrayListEnumerator<class CCopyInfo *>::get_Current(void) const",
        "class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::get_Current(void) const",
        "DiskLayout::ApplyProperties: Setting drive letter to %c",
        "ZwAddBootEntry",
        "RPC_S_NO_CONTEXT_AVAILABLE",
        ";\";6;D;R;`;n;|;",
        ";\"<i<",
        ";\";);2;8;S;h;q;",
        "x-SSj",
        "Unable to write the start type. Error: %u",
        "9P t49P",
        ":&:/:M:q:",
        "<&<,<9<H<R<Z<`<e<w<",
        "Copy provisioning package locally",
        "5\"5*5=5Q5X5^5c5n5y5",
        "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0",
        "3*343G3U3\\3j3t3",
        "ERROR_REMOTE_FILE_VERSION_MISMATCH",
        "7(737G7\\7o7y7~7",
        "0\"0+040=0F0O0X0a0n0",
        "OSRollbackService::CCheckpoint::MoveOrCopyFiles: failed to create %s",
        "FindGlobalPath: Cannot find volume name for %s. Error: 0x%08X",
        "Cannot set Type for %s, error: 0x%08X",
        "ERROR_IPSEC_IKE_KERBEROS_ERROR",
        "8(80888@8H8X8`8|8",
        "??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEPAVString@1@XZ",
        "DiskLayout::ApplyModifyPartition",
        "{942C34A2-8D2E-45D3-90AB-08E73CEC615B}",
        "SclpStateOpenRequestKey",
        "4#454C4Z4p4",
        "WinREFilterActive",
        "Package type is not covered in test hook.",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::Remove(class UnBCL::String *)",
        "6 7(737:7@7E7P7`7t7",
        ":A:j:",
        ".?AVCXXXXXHandledException@?CN@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "GetFileStorageTierClass failed",
        "0!0+0B0P0Z0d0{0",
        ".?AV?$SmartPtr@VXmlNodeList@UnBCL@@@UnBCL@@",
        "SPFixupRelocatedFolders",
        "0%0d0",
        "?Compare@String@UnBCL@@SGHPBG0H@Z",
        ">!>?>F>L>Q>\\>c>w>",
        "__thiscall UnBCL::ArrayList<struct SetupPlatform::IPartition *>::ArrayList(const struct UnBCL::ICollection<struct SetupPlatform::IPartition *> *)",
        "%hs: Some error occured while validating migrated services. Error: 0x%08X",
        ".?AV?$SerializableBase@VCCompressOldOS@@$0A@V?$DefaultInstanceFactory@VCCompressOldOS@@@UnBCL@@@UnBCL@@",
        "u RRj",
        "WinDirNew",
        "9<9O9x9",
        "DiskLayout::WillBeLogical: Couldn't find partition with ordinal %u: 0x%08x",
        "9B9H9T9\\9n9u9{9",
        "2!242J2V2[2`2i2o2",
        "CCleanupSnapshot::DeleteSnapshot: Failed to cleanup existing snapshot. Error: 0x%08X",
        "<?=F=L=Q=]=o=",
        "VERBOSE: Path %s has no children, nothing to map",
        ".PAVCXXXXXHandledException@?CB@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "5D6t6",
        "OperationConsumedSpace",
        "CbsTemp",
        ".?AV?$SmartPtr@VCInfFile@@@UnBCL@@",
        "ProcessTreeForDeletionInternal - Cannot combine file paths. path1 = %s, path2 = %s. hr = 0x%x",
        "??1XmlSchemaSet@UnBCL@@UAE@XZ",
        "3(383Q3i3s3x3",
        "<,<=<D<`<g<m<y<",
        "BiBindEfiBootManager failed %x",
        ";~ ~l",
        "Error while copying log(s) from [%s] to [%s]",
        "1<2h2{2",
        "?*?=?I?[?t?",
        "Vh({c",
        "1 1$1(1,14181<1@1D1L1P1T1X1\\1d1h1p1t1x1|1",
        "CRYPT_E_NO_MATCH",
        "SPAPI_E_NO_AUTHENTICODE_CATALOG",
        "3H3U3m3",
        "ShouldSuspendBitlocker",
        "PWhl'",
        "New exception raised while handling an older one! De-activating.",
        "Filter evaluation: Operator is not valid for a string property",
        "const struct DISK_SPACE_IMPACT &__thiscall UnBCL::ArrayList<struct DISK_SPACE_IMPACT>::get_Item(int) const",
        ": :*:;:H:Q:m:",
        "<\"<)</<4<?<M<U<_<g<m<",
        "2$2X2l2t2|2",
        "SysprepSession::ExecuteAction: Failed during stopService operation; dwRet = 0x%x",
        "SPApplyCustomDiskConfig: Failed to execute disk layout, the disk may be in an inconsistent state.",
        "Control\\MUI\\UILanguages",
        ".?AU?$IEnumerable@PAVCMountedPathInfo@CDeploymentBase@@@UnBCL@@",
        "int __thiscall UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::ContainsKey(class UnBCL::String *) const",
        "0J0u0",
        "7*70797E7T7j7r7~7",
        "LSVWQ",
        "Copying %sfile %s to %s",
        "ERROR_SECRET_TOO_LONG",
        "9sTtr",
        ";#;/;F;R;g;",
        "9$989S9",
        "1&191B1S1n1x1",
        "[%hs]",
        ":\":(:5:G:Q:f:n:t:",
        "5)5C5J5P5U5`5k5",
        "555Z5}5",
        "3$3)343?3S3",
        "?0?I?^?f?l?y?",
        "4*474@4H4S4k4q4",
        "base\\ntsetup\\setup\\tools\\fastcleanup\\fastdeleteimpl.h",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *> *)",
        "0\"0+0A0`0s0z0",
        "s    Incorrect number of bytes written",
        "SPAPI_E_INVALID_REFERENCE_STRING",
        "9{d~RWW",
        "void __stdcall ForEachPartition<class ForEachVolume::<lambda_8bca54f81f488911d5b6188bc7acb381>>(struct SetupPlatform::IDisk *,class ForEachVolume::<lambda_8bca54f81f488911d5b6188bc7acb381>)",
        "2\"242:2O2a2i2",
        "Not able to find any qualified edition package to install, store corrupted, please wait for the next major update.",
        "SL_E_CHPA_UNKNOWN_PROPERTY_ID",
        "12191@1F1R1f1t1",
        "WIM_Chunked_Number_Of_Buffers",
        "CSetupPlatform::GetDefaultAutomation",
        "0/0s0",
        ";';-;:;L;V;i;q;w;",
        "SPAPI_E_CANT_REMOVE_DEVINST",
        "ysWhE",
        "<(=5=M=",
        "70<0H0`0",
        "Failed to unload hive at %s\\%s. Error: 0x%08X",
        "Pausing in phase %s for operation %s",
        "<@<K<P<Z<",
        ".?AV?$SmartPtr@VIOCMatcher@OC@@@UnBCL@@",
        "D$,h`",
        "3 3,383D3P3\\3h3t3",
        "4>4c4",
        "DiskLayout::ParseCustomMbrType: Invalid hex digit: %c",
        ".?AV?$CAutoCleanupBase@PAVCDUPackageCollection@@@RAII@@",
        "393C3J3[3b3",
        "8!8;8@8Z8_8y8~8",
        "20282>2K2]2k2",
        ".?AVCFODValidator@@",
        "CDeploymentProject::CreateVHDDeployment: Failed to get valid image info; Error: 0x%08X",
        "6%666M6Z6q6|6",
        "Cannot get the volume info for %s. Error: 0x%08X",
        ".?AVCXXXXXHandledException@?2??ExtractPidgenx@CWIMPidgenxExtractor@@UAEJPAUIImageInfo@SetupPlatform@@PAPAVString@UnBCL@@1@Z@",
        "Successfully %s WIM file %s.",
        "SKIPBOOTTRACK(SAFEOS): Turning OFF SafeOS boot removal per environment variable",
        ".PAVCXXXXXTemp@?DH@??CreateVHDDeployment@CDeploymentProject@@UAEJPBG_KW4_FIRMWARE_TYPE@@W4DISK_LAYOUT_TEMPLATE@SetupPlatform@@0PAXPAUIGenericProgress@5@@Z@",
        "CFG Validator",
        "4$4,444<4D4\\4d4l4t4",
        "9P:\\:n:",
        "RPC_S_UNKNOWN_AUTHN_SERVICE",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *> *)",
        ": :-:2:",
        "3.3@3H3N3[3m3{3",
        "VdsPartition::Resize: Couldn't shrink volume (0x%08x)",
        "ERROR_ILLEGAL_ELEMENT_ADDRESS",
        ".PAVCXXXXXHandledException@?7??BuildInfoList@CARPValidator@@IAE?AW4MIGSTATUS@@PAVString@UnBCL@@0PAV?$ArrayList@PAVCAppInfo@@@5@PAV?$ArrayList@PAVCShellFolderInfo@@@5@@Z@",
        "9 9$94989H9L9\\9`9p9t9",
        ".?AV?$DefaultInstanceFactory@VCSetupPlatformInfo@@@UnBCL@@",
        "BCD Error: %ws",
        "PathForNewOSFile",
        "9(9/959:9E9V9^9d9x9",
        "7#72797?7D7P7Z7m7",
        "IsDiskOnXHCI: DetermineIfControllerIsUSB failed. Error = 0x%X.",
        "int __thiscall UnBCL::_::HTEnumerator<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class CWIMBootHelper::CWIMEntryIndex *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,&protected: static class CWIMBootHelper::CWIMEntryIndex * __stdcall UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::DictionaryEntry<void *,void *> *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "6-7H7b7t7",
        "4$404T4\\4d4l4t4|4",
        "7/787?7G7X7k7|7",
        "?\"???S?a?",
        "ERROR_CLUSTER_OBJECT_ALREADY_USED",
        "6'7@7^7o7u7",
        "81888>8C8N8T8",
        "<)<P<f<}<",
        "InterlockedExchange",
        "CDeploymentProject::CreateFFUDeployment: Unsupported processor architecture %d of the image",
        ".?AU?$IEnumerable@PAVCFailForwardSystem@@@UnBCL@@",
        ".data$r$brc",
        "7(747@7L7X7d7p7|7",
        "int __thiscall UnBCL::ArrayList<class SysprepComponent *>::LastIndexOf(class SysprepComponent *,int,int) const",
        ".?AV?$KeyCollection@PAVString@UnBCL@@PAUISerializable@2@@_@UnBCL@@",
        "7'898A8G8T8f8",
        "Failed to re-delete the WIMBoot partition. Error: 0x%08X",
        "1+20252A2K2W2a2f2k2",
        "2Y2k2p2~2",
        "fSfRf",
        "7,7G7",
        "QueueEULAAccepted called for fail-forward system %s",
        "AddStreamsToImage",
        ";%;1;?;O;X;j;r;x;",
        "2$282K2S2Y2^2m2z2",
        "RPC_S_PRF_ELT_NOT_REMOVED",
        "6%6;6T6",
        "1'131?1H1T1",
        "class CShellFolderInfo *const &__thiscall UnBCL::ArrayList<class CShellFolderInfo *>::get_Item(int) const",
        "Merging diagnostics data for WatsonBucket",
        "pCopyFilesInSection",
        "yi-001",
        "BfsRepair: Failed to service boot files. Error: %08x",
        ".PAVCXXXXXTemp@?7??DoCommunication@CSetupPlatformPrivate@@UAEXXZ@",
        "class COSPieceInfo *&__thiscall UnBCL::ArrayList<class COSPieceInfo *>::get_Item(int)",
        "7#7)7/757;7a7h7m7s7y7",
        "JET_errRecoveredWithErrors",
        "60777=7B7M7X7l7",
        "class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::get_Item(int) const",
        "    Failed to set indent property",
        "t9QSSSj",
        ".PAVCXXXXXHandledException@?FH@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "RtlDosPathNameToNtPathName_U",
        "4+4a4",
        "<N<Z<",
        "5*5<5F5[5c5i5v5",
        "    Device present: %s",
        "?,?4?<?D?P?p?x?",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class COperationInfo *>::MoveNext(void)",
        "ERROR_VDM_DISALLOWED",
        ".?AVCAccessCreds@@",
        "MapViewOfFile",
        "4$404P4X4`4p4",
        "758R8Y8_8d8o8y8",
        "void __thiscall UnBCL::Array<class SysprepAction *>::RemoveAt(int)",
        "=#=2=<=A=I=P=\\=n=",
        "FveDisableAuthenticationW",
        "STATIC",
        ">6>=>D>J>V>j>x>",
        "2!2)272I2Q2[2l2u2",
        "Failed to stop telemetry. hr = 0X%x",
        "VerSetConditionMask",
        "979L9w9",
        ".?AVSmPoolDisk@@",
        "9$9*9/9:9D9W9c9x9",
        "oscomps.xml;upgrade_bulk.xml",
        ".?AV?$DefaultInstanceFactory@VCSkipBootValidator@@@UnBCL@@",
        "SetFileAttributes(%s) failed! Last Error = %#x.",
        "839I9p9",
        "QueueCustomizations called with answer file %s",
        "7'787b7i7x7}7",
        "ERROR_NODE_NOT_AVAILABLE",
        "= =$=4=8=H=L=\\=`=p=t=",
        "=.=C=c=s=",
        "VdsDisk::InitializeProperties: Couldn't copy disk signature (0x%08x)",
        "FLOWTRACK(NEO): Flow Validator: Main offline apply has not completed, NEO flow constraint cannot be satisfied.",
        "4%4+484J4]4i4{4",
        "?*?L?S?Y?^?i?t?",
        "long __thiscall CSetupPlatformPrivate::ExecuteFailForward(int,struct SetupPlatform::_PROGRESS_DATA *)",
        "D$,W3",
        "2+262=2D2^2t2",
        "onecore\\base\\ntsetup\\provpackageapi\\lib\\elementenumerator.cpp",
        "5?5d5p5",
        ">$>,>4><>D>P>t>|>",
        "D$@j(P3",
        "SVhp~",
        "en-AE",
        "<%<,<2<7<B<N<S<g<",
        ":1:H:s:",
        "626T6m6",
        ".PAVCXXXXXHandledException@?OO@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "SPScheduleTask: Action        : [%s]",
        "    Failed to get metadata temporary file",
        "VdsDisk::CreatePartition: Can't get disk properties (0x%08x)",
        "ERROR_DEVICE_REMOVED",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@I@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "<F<N<y<",
        "RunPlatformActions:Failed while executing Sysprep session actions; dwRet = 0x%x",
        "StringFileInfo",
        "CAddAppxPackage::DoExecute: Failed to open new OS DISM session. Error: 0x%08X",
        ".?AU?$ICollection@PAVCBcdSetting@@@UnBCL@@",
        "We'll continue enumerations",
        ">#>1>U>\\>b>g>r>|>",
        ".?AV?$Array@PAVCBasicEnvEntry@@@UnBCL@@",
        ".?AV?$SmartPtr@V?$ArrayList@PAUIDisk@SetupPlatform@@@UnBCL@@@UnBCL@@",
        "ApplyEANumDirs",
        "1.171a1j1s1|1",
        "SKIPBOOTTRACK(FIRST): Skip Boot Validator: Found pending actions in the new OS, continuing due to force environment variable.",
        ":4:D:T:d:t:",
        "0!1D1u1",
        ".PAVCXXXXXHandledException@?2??SPApplyCustomDiskConfig@@YGJPAUIWpxDeplInsSettings@@W4_FIRMWARE_TYPE@@PAUIDiskPlatform@@PAX@Z@",
        "SL_E_EVALUATION_FAILED",
        ".?AVCXXXXXHandledException@?BE@??DoExecute@CMigrateFramework@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ".?AV?$ArrayList@PAVISPPluginData@@@UnBCL@@",
        "5 5H5P5X5l5t5|5",
        "?,?5?>?G?P?c?j?p?u?",
        "ExFAT",
        "<^=c=",
        "2(252J2a2",
        "8F9N9m9u9",
        "ControlSet???",
        "3#3:3B3U3[3k3}3",
        "?;?S?^?",
        "Software\\Policies\\Microsoft\\Windows\\DataCollection",
        ">>>C>M>R>\\>a>k>p>z>",
        ".PAVCXXXXXTemp@?KM@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "Windows",
        ".?AV?$SerializableBase@VCWinOldCleanup@@$0A@V?$DefaultInstanceFactory@VCWinOldCleanup@@@UnBCL@@@UnBCL@@",
        ">3>E>M>S>`>r>",
        "CDeploymentBase::BackupMounts",
        "Error removing driver: DismCloseSession failed. hr = 0x%08X",
        "SidAccountDomainOld",
        "Finish merge diagnostics data",
        "j{[f9\\0",
        "ActionPlatform::DeleteKey: Error from RegDeleteTreeW on %s; dwRet = 0x%x",
        "3(343H3Y3s3",
        "AllocateReadChunk",
        "Failed allocating temporary stack directory.",
        ":S:_:q:",
        "5,52585G5^5n5v5",
        "int __thiscall UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::ContainsKey(class UnBCL::String *) const",
        "?(?L?T?\\?d?l?t?|?",
        "StrTabEnumDriverStoreDeviceIdSetBestMatchCallback returned Err = 0x%lx",
        "CMediaLayout::Execute: Failed to queue drivers: 0x%08x",
        "    Failed to allocate _spElementPath.get()",
        "3-373J3i3",
        "000G0N0U0`0k0",
        "1 1$1(1,14181<1@1P1`1h1l1p1t1|1",
        "=(=,=D=H=`=d=|=",
        "QueueProductKey called",
        "DiskLayout::ApplyProperties: Failed to set GPT partition type: 0x%08x",
        "G0PQh",
        "GetLocaleInfoW",
        "CreatePartition",
        "CStartSystemServices::DoExecute: Failed to determine whether system services have started. Error: 0x%08X",
        "3,303@3D3H3L3P3X3\\3`3h3l3p3x3|3",
        "070?0H0N0c0u0}0",
        ".?AU?$ICollection@PAVCGlobalPathFindData@@@UnBCL@@",
        "DiskLayoutMakeSystem: Using System volume %s",
        "141X1|1",
        "<<<^<",
        "SetMapMode",
        "6&676K6o6",
        "CImageInfoSet::ValidateProductKey: Unable to find the latest image version.",
        "RetryState",
        "jYjWjTjVj",
        "> >N>a>h>n>s>~>",
        "void __thiscall UnBCL::Array<class COperation *>::InitLarva(class UnBCL::ArrayList<class COperation *> *)",
        "0:1d1",
        "6!61686=6F6[6g6t6",
        "7]7z7",
        "0#030?0i0",
        "WVhdC",
        "DriveLabels",
        "Number of registry keys renamed",
        "SKIPBOOTTRACK(SAFEOS): %hs: SafeOS boot removal was not executed, exiting",
        "585H5M5x5",
        "CSetupAutomation::Initialize: Failed to parse %s:",
        "SETUPPLATFORMCOMM: Listening thread finished. We are exiting.",
        "BUILD",
        "484P4W4^4d4q4",
        "6\"636N6\\6v6",
        "InitVDSService: Failed to load VDS service; hr = 0x%x.",
        "long __stdcall pAddCopyOrMoveOperation(struct IExecutionContext *,class COperationQueue *,int,int,class UnBCL::String *,unsigned int,class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::ArrayList<unsigned int> *,class UnBCL::String *,unsigned __int64,class UnBCL::String *,int,enum OP_OPERATION_ID)",
        "7 757;7O7f7",
        "void __thiscall UnBCL::ArrayList<struct PageFileDesc *>::Insert(int,struct PageFileDesc *)",
        "|SYSPART|\\|EFIDEFAULT|",
        ".?AV?$KeyCollection@W4OP_OPERATION_ID@@H@_@UnBCL@@",
        "2#292M2Z2h2",
        "7-7?7G7a7x7",
        "ERROR_NO_LOGON_SERVERS",
        "5.5C5R5\\5a5i5p5|5",
        "4N4s4",
        "2,2H2h2",
        "Safe OS BitLocker hash matches WinRE, will not delete",
        "1(11171D1J1O1m1x1",
        "7.767<7I7[7i7",
        "Windows Setup",
        "XCFODValidator::ValidatePreExecution",
        "MIG_OFFLINE_PLATFORM_ARCH",
        "The registry key HKLM\\%s doesn't exist",
        "??0?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@PAV?$Array@PAVString@UnBCL@@@1@@Z",
        "ElementEnumerator::CreateElementEnumerator",
        "%s %s%u",
        ">>>V>b>p>",
        "<+=D=",
        "Snapshot Creation Time: %04d/%02d/%02d %02d:%02d:%02d:%03d",
        "0&000C0j0q0x0",
        "Error creating DriverVer value for %s. Error: 0x%08X",
        "ERROR_SXS_DUPLICATE_IID",
        "NtEnumerateValueKey",
        "ERROR_SHARING_BUFFER_EXCEEDED",
        "<#</<=<O<Y<l<",
        "MIG_SCENARIO_DATETIME",
        "4!4l4w4",
        "9*999H9W9f9o9y9",
        "RegisterHotKey",
        "DiskLayoutMakeWindows: Failed to get Windows partition volume (0x%08x)",
        "isdigit",
        "CSetupAutomation::MatchDisk: Couldn't parse disk criterion %u",
        ".?AV?$Hashtable@GH@UnBCL@@",
        "1a1v1",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBG@Z",
        "OC::COfflineOCManager::COfflineOCManager",
        "ERROR_SEM_IS_SET",
        "Failed to Restore filters key in First Boot. Error: 0x%08X",
        ";+<2<8<=<H<O<c<",
        "SetupPlatform: Unknown upgrade choice value: %d",
        "<*<S<c<",
        "es-SV",
        "SetupPlatform: Begin Post-OOBE: Global progress: %u, Phase progress: %u",
        "ERROR_IPSEC_IKE_INVALID_MM_FOR_QM",
        "2\"222B2R2b2r2w2",
        "9'9D9S9\\9f9o9y9",
        "4-535Q5q5",
        ";.;5;m;",
        "TrackVolume: Successfully marked that [%s] is on drive [%c:].",
        "jAYf;",
        "CRegisterRecoveryImage::DoExecute",
        "void __thiscall UnBCL::Array<class CDUPackage *>::Insert(int,class CDUPackage *)",
        ":0:Q:h:",
        ">$>->6>?>H>Q>Z>f>o>{>",
        "5!555K5",
        "VdsPartition::CreateLogicalPartition: Can't allocate partition (0x%08x)",
        "%hs: PnpPropMigApplyW failed. Error: 0x%08X",
        "?$?(?0?8?<?@?H?L?P?T?X?`?d?h?p?t?x?|?",
        "1F1M1S1X1c1n1s1",
        "<==I=P=V=[=f=q=w=|=",
        "<a=f=x=",
        ":5:C:a:o:x:",
        "VSh8f",
        "Successfully removed FOD %s",
        "<-<E<_<f<l<q<|<",
        "MIG_COMPARE_LOGICAL_CONTENT",
        "iis.log",
        "Translated a DontSync entry with ID 0x%x",
        "\\Windows\\System32\\boot.sdi",
        "See inner exception",
        "JET_errOutOfDbtimeValues",
        "6.6<6E6W6e6~6",
        "Number",
        "<$<2<F<X<",
        "CApplyDrivers::CopyToDriverStore: Failed to generate a GUID. Error: 0x%08X",
        "Set entropy for %s",
        ";$;(;@;D;\\;`;x;|;",
        "ERROR_DISK_CORRUPT",
        "Verbose: Will consider this as a standalone WIM",
        ".base\\ntsetup\\migration\\setup\\oc\\lib\\src\\ocstore.cpp",
        "Failed to query SD",
        "?6?n?z?",
        "WorkingDirectory",
        "PSh4(",
        "OC::CInstalledOCStore::GetOCsThatNeedAStateChange: Failed to get OC dependencies",
        "2#292_2f2l2q2|2",
        "SPApplyDeviceLayoutDiskConfig: Failed at creating partitions (0x%08X)",
        "2#3.353;3@3K3Q3d3t3",
        ":\":+:5:>:H:Q:p:~:",
        "fYfZ&f9",
        "|SYSPART|\\|DEST|\\BCD.LOG",
        "?(?0?X?`?h?|?",
        "pRegOfflineGetQWord",
        "2h2}2",
        "enable",
        ":!:':-:2:<:F:P:Z:h:n:t:y:",
        "ERROR_BAD_DEV_TYPE",
        ".?AVCBootCopyDelegate@@",
        "9-9B9J9P9]9o9y9",
        "7+7n7~7",
        "??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@XZ",
        ".?AV?$SerializableBase@VCRegisterRecoveryImage@@$0A@V?$DefaultInstanceFactory@VCRegisterRecoveryImage@@@UnBCL@@@UnBCL@@",
        "Filter evaluation: Property type is neither number nor string",
        "profsvc_group",
        "VdsPartition::GetProperties",
        "ncalrpc",
        ">/>>>",
        "848<8D8L8T8`8",
        "Failed to create subkey: %ls",
        "CDeploymentBase::BackupMounts: Failed to get mounted image handle for path %s. Error: 0x%08X",
        "CSetupAutomation::SuspendAndRelease: Failed to write updated deployment options to temp config: 0x%08x",
        "5$6l6",
        "ActionPlatform::SetValue: Error while decoding registry data \"%s\"; dwRet = 0x%x",
        ";%;2;9;G;Q;h;y;",
        "CMergeWIM::DoExecute: Cannot register WIM callback. Error: 0x%x",
        "void __thiscall UnBCL::ArrayList<class CGlobalPathFindData *>::CopyTo(class UnBCL::Array<class CGlobalPathFindData *> *,int) const",
        "Failed to check if %s is running or not, error code=0x%x",
        "ERROR_IPSEC_INVALID_PACKET",
        "\\??\\Volume{",
        "Rollback: Input parameter is set to disable splash windows",
        "SYSTEM\\CurrentControlSet\\Control\\MiniNT",
        "2$2,242<2L2T2\\2d2l2t2|2",
        "int __thiscall UnBCL::Array<class CImageInfo *>::Add(class CImageInfo *)",
        "ITaskSettings::get_Settings failed. hr = 0x%x",
        "SL_E_TOKSTO_PROPERTY_NOT_FOUND",
        ".PAVCXXXXXHandledException@?KF@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "Metadata not found",
        "j`Xf;",
        "2 2&2<2B2Z2a2v2",
        "Use Paged memory for telemetry",
        "454P4a4v4~4",
        "ERROR_FILE_EXISTS",
        "IsApplyWIMBootCompliant",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::GetBuffer(int)",
        "mxeagent.dll",
        "<,<3<9<><I<T<n<",
        "ServicingStackVersions",
        "2\"2'212;2E2O2]2c2i2n2x2",
        "ERROR_IMAGE_MACHINE_TYPE_MISMATCH_EXE",
        "DiskLayoutMakeWindows: Couldn't get Windows volume properties (0x%08x)",
        " (forced)",
        "ERROR_IPSEC_IKE_PEER_MM_ASSUMED_INVALID",
        "535W5",
        "HKLM\\SYSTEM\\CurrentControlSet\\Control\\CrashControl",
        "CMediaLayout::Execute: Failed to queue install image: 0x%08x",
        "3&303>3E3Z3a3x3",
        "<$<)<2<9<F<R<[<h<m<v<}<",
        "SYSTEM\\CurrentControlSet\\Control\\Session Manager",
        "%hs: Found config value that is not a global path: %s",
        "DUImageInfo",
        "VdsVolume::RemoveDriveLetter: Failed to query IID_IVdsVolumeMF interface [%s] (0x%08x)",
        "OS Piece %s has been relocated on the source OS. Expected %s but found %s. Relocation is %sallowed",
        "3#3+313E3K3Q3V3b3s3~3",
        ";*;7;@;N;l;~;",
        "<!<(<7<G<Q<_<q<}<",
        "Xdetailed",
        "0;0J0",
        "Package pointer is NULL",
        "NtCreatePagingFile",
        "InternalName",
        "ERROR_LOG_RESIZE_INVALID_SIZE",
        "%ws\\wcp.dll",
        ".?AVCCallRegisterRecoveryImage@@",
        ">\">,>?>G>N>U>`>j>}>",
        "4%424I4Y4i4u4}4",
        "CreatedSnapshotsUsedSpace",
        ">&>4>\\>s>",
        "pbr: Estimated reconstruction RAM needed: %I64u",
        "1(121H1Y1",
        "Failed to open handle to resume object. Status = [%x]",
        "InstallSecurityTemplate: Error getting SCE proc address; Error: 0x%08lx",
        ".PAVCXXXXXHandledException@?FH@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "PVWhI",
        "KeyName",
        "1,1^1c1h1t1",
        "GetSystemDiskNTPath: Unable to get required buffer size for system disk from BCD APIs; status = 0x%x",
        "CNewSystem::QueueDynamicUpdates: System state does not allow for more requests to be queued",
        "JET_errRecoveredWithoutUndo",
        "RtlNumberOfSetBits",
        "Setup\\FirstBoot\\Filters",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *> *,int,int)",
        "?.?:?G?S?`?l?t?z?",
        "void __thiscall UnBCL::ArrayList<struct DISK_SPACE_IMPACT>::CopyTo(class UnBCL::Array<struct DISK_SPACE_IMPACT> *,int) const",
        "6\"6+676C6H6Q6]6i6n6w6~6",
        "8\"8G8`8y8",
        "< <(<8<\\<d<l<t<|<",
        "ERROR_NOT_ENOUGH_QUOTA",
        "SETUPPLATFORMCOMM: Cannot start listening thread. Error: 0x%08X",
        "QQSW3",
        "1.282b2l2",
        "QSjVjuh,",
        ".?AV?$DefaultInstanceFactory@VCRefreshLocalizedString@@@UnBCL@@",
        "=@>X>e>}>",
        "3$3,343<3D3L3T3\\3h3p3",
        "5!555R5Y5_5d5o5y5",
        "WindowsPE",
        "pSPCheckAndDeleteUpgradeSnapshot",
        ".?AU?$IList@PAVCGlobalPath@@@UnBCL@@",
        "2!2:2C2Z2s2}2",
        "ve-ZA",
        "int __thiscall UnBCL::ArrayList<struct _GUID>::IndexOf(struct _GUID,int,int) const",
        "ERROR_SERVICE_EXISTS",
        "ioctl() failed or returned no data",
        "SPTaskRemoveSnapshot: Failed to remove the task for Snapshot cleanup. hr = 0x%08X",
        "ERROR_LOG_CONTAINER_OPEN_FAILED",
        ".?AV?$CAutoRelease@PAVSmVirtDisk@@@RAII@@",
        "$OFFLINE_RW$SOFTWARE",
        "WimBufferToHexString",
        "SPTagTarget: Failed to get Update Reserve manager. hr = 0x%08X",
        "9$9H9Z9f9|9",
        "Error handling option is 'continue,' ignoring failure",
        "CSetDefaultBootEntry: SPGuidFromString failed for %s. hr = 0x%X",
        "CallPidGenX: Either '%s' or '%s' was not found.  These files are required for product key validation.",
        "mr-IN",
        "CDeploymentProject::EnableAuditMode: Will copy just %s as audit mode payload",
        "%hs: Low disk space policy in place, adding compress operation.",
        ".?AV?$CAutoCleanupBase@PAUIWbemLocator@@@RAII@@",
        "SPFindFreeSpace: Can't enumerate disk partitions (0x%08x)",
        "<(=x=",
        "AddFontMemResourceEx",
        "Failed to create the transformer executor. hr = 0x%08X",
        "4%4/4<4I4Q4[4c4j4x4",
        ")SmVolume::InitializeProperties",
        "6!696F6S6[6{6",
        ".PAVCXXXXXTemp@?GP@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "9%9C9[9g9z9",
        "YY_^[",
        "?%?2?:?O?",
        ";#;.;8;=;Q;q;x;~;",
        "4 4*444:4G4",
        "1.1C1R1\\1a1i1p1|1",
        "<<<x<",
        ":0:\\:",
        ";+;C;];};",
        ".?AV?$DefaultInstanceFactory@VCApplyWDSImage@@@UnBCL@@",
        "0E0]0i0{0",
        ";);7;E;",
        "<6<A<Q<[<m<u<{<",
        "CSetupAutomation::ResolveTarget: Applying custom disk layouts ...",
        ">/>7>=>Q>l>|>",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCOperationsValidator@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "ZwSetValueKey",
        ":):M:_:g:m:z:",
        "4(424<4F4]4k4u4",
        "class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::get_Item(int)",
        "757<7B7G7R7\\7o7z7",
        "3\"3+343?3I3V3_3i3p3z3",
        "ERROR_PREDEFINED_HANDLE",
        "495J5r5",
        "CopyDirectoryFileCallback: The copy was canceled by the user.",
        "EnumRefExtEntries",
        "ERROR_WAIT_3",
        "Failed to add package.",
        "0:1N1`1h1n1w1",
        "8,848A8I8e8|8",
        "2 2,2o2~2",
        "Failed to get handle to BCD object. Status = [%x]",
        "?3?J?Z?l?",
        "void __thiscall UnBCL::ArrayList<class CPartitionInfo *>::set_Item(int,class CPartitionInfo *)",
        "20282>2K2]2",
        "RPC_S_INCOMPLETE_NAME",
        ".?AUIFailForwardSystem@SetupPlatform@@",
        "Failed to execute command line",
        "9i9p9y9~9",
        "0A0Z0h0o0",
        "bs-Cyrl",
        "%hs: Cannot register WIM callback. Error: 0x%x",
        "969z9",
        "%hs: OS pieces relocation list is too large. Expected one element but found %d",
        "SPSelectDisk: Can't enumerate disks (0x%08x)",
        "T$$RPQQ",
        "3,303H3L3d3h3",
        "2'212C2[2h2~2",
        "637f7",
        "Unpacking update %s",
        "<4<F<M<S<X<c<n<",
        "8E9m9",
        "?*?5?E?L?R?W?b?i?}?",
        "ProfessionalEducationN",
        "7\"7=7G7Q7W7e7",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCCFGSectionValue@@@UnBCL@@@UnBCL@@",
        "8 8(80888@8H8P8X8`8h8p8x8",
        "JET_errIndexDuplicate",
        "drvstore.dll",
        "ERROR_AUTHENTICATION_FIREWALL_FAILED",
        "void __thiscall UnBCL::Array<class CBcdSetting *>::RemoveAt(int)",
        "1/1?1D1M1]1d1l1q1}1",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@_K@UnBCL@@@UnBCL@@",
        "1$242@2G2O2T2d2r2~2",
        "8#8)8=8J8[8i8p8v8{8",
        "pFinalizeUninstall",
        "2)252A2R2f2r2",
        "Migration.Ignore",
        "ERROR_DS_RESERVED_MAPI_ID",
        "?#?/?9?M?W?j?q?w?|?",
        "FilterConnectCommunicationPort",
        "zh-CHT",
        "SPDeleteSnapshot: Failed to create backup components. Error: 0x%08X",
        "IRegisteredTaskCollection::get_Count failed. hr = 0x%x",
        "CSetupPlatformPrivate::Execute: Failed to deserialize/execute pre-SysPrep operations. Error: 0x%08X",
        "4+474I4Q4X4^4c4n4~4",
        "VERBOSE: MOVETRACK: Source short name: %s",
        "Failed to set 1394 debugging channel. Status = 0x%X",
        "4$5P5x5",
        "9$:9:A:G:P:f:t:",
        ">6>`>",
        "SWj43",
        "4%4*454@4T4\\4c4i4n4y4",
        "The current operation's changes could not be undone, we'll search for operations whose output might have been tainted",
        ".PAVCXXXXXHandledException@?BM@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "2&23282L2^2e2s2}2",
        "SL_E_TAMPER_DETECTED",
        "3+3:3?3K3R3b3n3z3",
        "class CDrvStoreProperty *&__thiscall UnBCL::ArrayList<class CDrvStoreProperty *>::get_Item(int)",
        "7\"7.7@7",
        "metadata",
        "ERROR_DEVICE_REQUIRES_CLEANING",
        "SPGetExistentImageInfo: No software hive in offline image; assuming this is data image.",
        "F8PSj",
        "9!9)909<9N9c9r9|9",
        "232J2U2j2q2x2",
        "Q4;P4|g",
        "$0C0g0",
        "9\"9'9;9Y9p9x9",
        "s%s\\Panther\\SetupInfo*",
        ".?AVCOperation@@",
        "474B4L4Y4j4r4|4",
        "D$dWP",
        "%3d|%-80s|%-7s |%19s|%19s|%8s|%18I64d|%18s|%17s|%-38s",
        ".PAVCXXXXXHandledException@?2??RemoveUninstall@CUninstall@@UAEJXZ@",
        "3*383F3T3",
        "OpenSemaphoreW",
        "2/2=2F2o2",
        "Failed to validate NT path %ws.",
        ":6:Z:",
        "929Q9Y9~9",
        "base\\ntsetup\\setupplatform\\lib\\src\\provisioning.cpp",
        "const enum OP_OPERATION_ID &__thiscall UnBCL::ArrayList<enum OP_OPERATION_ID>::get_Item(int) const",
        "CSIDL_FAVORITES",
        "PWRWQ",
        "7%7+707;7A7T7k7r7x7}7",
        "FreeSid",
        "?<?R?g?w?",
        "int __thiscall UnBCL::Array<struct PageFileDesc *>::Add(struct PageFileDesc *)",
        "SPReclaimRecoveryImagePartition",
        ".?AV?$CAutoCleanupBase@PAVWmi@WMI@@@RAII@@",
        "<%===g=",
        "3$323o3",
        "SPDisableRollback",
        ";:;I;",
        "1%121@1X1^1t1",
        "7S7c7",
        ".?AV?$ArrayList@PAVCOperation@@@UnBCL@@",
        "?6?C?M?c?",
        "<!<8<H<T<",
        "void __thiscall UnBCL::ArrayList<class CGlobalPath *>::QuickSort(class UnBCL::ArrayList<class CGlobalPath *> *,class UnBCL::ArrayList<class CGlobalPath *> *,int,int)",
        "http://www.w3.org/2000/09/xmldsig#",
        "ERROR_DS_SEC_DESC_INVALID",
        "4'424K4V4",
        "%hs: Parent must have OC replication queued as well.",
        "=i>v>",
        "Cannot retrieve disk information from the WIMBoot entry path %s. Error: 0x%08X",
        "4\"4(4.444:4@4F4L4R4X4^4d4j4p4v4|4",
        "Unable to get procedure DismountRegistryHives",
        "7!7,7@7U7p7",
        "1$1*171I1W1{1",
        "pGetProvisioningPackagePayload: Failed to open provisioning package. Error: 0x%08X",
        "<&</<8<@<N<W<f<p<}<",
        "void __thiscall UnBCL::Array<class CDriverInfo *>::Insert(int,class CDriverInfo *)",
        "3.3@3H3N3b3h3q3",
        "3Y3`3",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CInfFile *>::MoveNext(void)",
        "8C8Y8",
        "{D3D269BD-F77D-4DB3-B624-64805554E572}",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::Add(class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *)",
        "CInstallDUUpdatesOffline::FindUpdates: Unexpected operation ID %d",
        ":*:7:K:S:Z:a:l:y:",
        ":$;4;J;a;q;};",
        "long __stdcall CImageInfoSet::CreateFromReconstructionSources(const unsigned short *,enum SetupPlatform::SP_RECONSTRUCTION_TARGET_VERSION,class CImageInfoSet **)",
        "Invalid package location specified %S.  Must be a '.mum'",
        "?,?0?@?D?T?X?h?l?|?",
        "878l8s8y8",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCAppInfo@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "=(=0=6=C=U=c=p=",
        "Fail to get offline servicing stack path.",
        "=\"=-=3=D=X=`=n=v=",
        "%s\\BCD",
        "CBS_E_IDENTITY_MISMATCH",
        "3d3o3",
        "Failed to shrink the OS partition. Error: 0x%08X",
        "LoadLibraryExW",
        "ERROR_CTX_ACCOUNT_RESTRICTION",
        "f[f_f",
        "<(<5<<<F<W<d<n<}<",
        "pParseRegFileForLoggerSettings",
        "SetEndOfFile",
        "191?1N1z1",
        "Reserved.DynamicUpdate.GDR",
        ">6>?>K>W>p>~>",
        "Failed to enumerate and delete wimboot entries.",
        "QjJjF",
        "CDeploymentProject::CreateFFUDeployment",
        "02191",
        "JET_errExistingLogFileIsNotContiguous",
        "4\"4)464B4K4W4\\4f4m4z4",
        "VdsVolume::GetProperties: Failed to copy volume label (0x%08x)",
        "d    Failed to load wim image",
        "    Matching package: %s",
        ".?AV?$ArrayList@PAVSysprepAction@@@UnBCL@@",
        "CDownloadDUUpdates::MoveOrCopyUpdates: IDUUpdate::UnpackContents failed. hr = 0x%x",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion",
        "RegSetValueExW",
        "5-555;5H5Z5s5",
        "Can't rename reg value [%ws] to [%ws]; the target already exists",
        "0%0/090C0Q0W0]0b0l0v0",
        "j%XVPh",
        "t$8h`;",
        "7.787B7H7U7d7q7}7",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *> *,int) const",
        ";$;t;",
        "ERROR_DS_REFUSING_FSMO_ROLES",
        "+010U0\\0",
        "Class",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *> *,int) const",
        "6\"6+646=6F6X6b6k6u6",
        "7#7)767O7y7",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CDriverInfo *>::MoveNext(void)",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::Remove(class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *)",
        "1#171K1Y1`1f1k1v1",
        "ERROR_CTX_MODEM_RESPONSE_ERROR",
        "&0A0W0f0v0",
        "Diagtrack intergration is disabled.",
        "WdsLibEnumCallback",
        ".?AVCOperationsProgress@@",
        "SVh@E",
        ">!>'>,>7>B>V>b>v>",
        ".?AV?$SmartPtr@U?$ICollection@H@UnBCL@@@UnBCL@@",
        "606:6A6J6O6b6m6u6{6",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class OC::CCmdLineExecutionTelemetryData *>::MoveNext(void)",
        "4!464>4H4W4_4i4{4",
        "long __thiscall CSetupPlatform::SuspendAndRelease(int,int,const unsigned short *)",
        "9V9]9c9n9z9",
        "?%?0?B?W?]?b?i?",
        "7'797A7G7T7f7t7",
        "DISMAPI.DLL",
        "OC::OCSaveStatusOffline",
        "<m=t=z=",
        "ActionPlatform::DeleteValue: Error from RegOpenKeyExW on key %s; dwRet = 0x%x",
        "CAddDriver::DoExecute: Failed to open new OS DISM session. Error: 0x%08X",
        "pLogUpdateInfo: IUpdate::get_Identity failed. hr = 0x%x",
        "<!<2<G<O<U<b<t<",
        "pGetExistingPageFiles: Examining page file path '%s' extracted from old OS",
        "4!4+4:4B4L4]4f4s4}4",
        "<\"=:=",
        "8\"81888>8C8M8b8v8",
        "ERROR_DS_UNICODEPWD_NOT_IN_QUOTES",
        "Cannot create WIMBoot info file %s. Error: 0x%08X",
        "8 8-8=8D8P8W8]8b8m8~8",
        "uSPProcessServiceDisable",
        "FeatureOnDemandDU",
        "const __int64 &__thiscall UnBCL::ArrayList<__int64>::get_Item(int) const",
        "void __thiscall UnBCL::Array<class CFilterDriverInfo *>::InitLarva(class UnBCL::ArrayList<class CFilterDriverInfo *> *)",
        "5@5y5",
        "ERROR_ALREADY_WAITING",
        "SetupDiGetDeviceInterfaceDetailW",
        "VDS Status:",
        "5%595R5d5n5",
        "1!1)101<1N1c1r1|1",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::Add(class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *)",
        "202>2F2P2W2]2b2m2x2}2",
        "ARP Validator: Forcing validator failure due to environment variable.",
        "ERROR_OPERATION_NOT_SUPPORTED_IN_TRANSACTION",
        "Microsoft\\Windows\\CurrentVersion",
        "class CDiagnosticsHelper *__stdcall UnBCL::Try_Cast<classCDiagnosticsHelper*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "0 0(0@0X0`0",
        "Cannot open HKLM\\SYSTEM\\%s. Error: 0x%08X",
        "7!7)7/797C7Y7p7",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::Reset(void)",
        "NTSTATUS",
        "    Invalid element type",
        "8 8D8L8T8\\8d8l8t8|8",
        ".?AV?$CAutoCleanupBase@PAVDiskLayout@@@RAII@@",
        "3,3P3p3",
        "70787>7G7]7g7|7",
        ";$;(;8;<;L;P;`;d;h;p;t;x;|;",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CSimpleCleanup::CCleanupEntry *>::Reset(void)",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CCFGSectionValue *>::MoveNext(void)",
        "?%?,?2?7?B?L?y?",
        "class CDUImageInfo *__stdcall UnBCL::Try_Cast<classCDUImageInfo*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "SPTagTarget: %s [%s]",
        "1(13181L1U1e1r1~1",
        "Total size on disk: %I64d",
        "VShth",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::Insert(int,class UnBCL::DictionaryEntry<class UnBCL::String *,long> *)",
        "=-=h=u=",
        "9#9*999I9O9X9b9i9o9u9}9",
        "?#?(?3?>?R?p?w?|?",
        "CSetDefaultBootEntry: BCD Open failed. Error: 0x%08X",
        "9 9$9(9,90989<9@9D9L9P9T9X9\\9`9d9h9l9t9",
        "5$5.585@5P5[5c5m5~5",
        "8/9C9",
        "Volume",
        "2S3n3",
        "6#6,676h6u6",
        "%hs: Cannot remove recovery/WIMBoot partition",
        "=1=8=>=C=N=\\=d=j=~=",
        "Microsoft Windows Installation encountered a problem and needs to close. We are sorry for the inconvenience",
        "SHA256",
        "747P7l7p7t7x7",
        "?(?4?@?M?Z?g?t?",
        "FirstBootTel-M%c.etl",
        "long __thiscall CSysprepSpecializeOffline::DoExecute(struct IExecutionContext *,void *,struct IInternalOperationsProgress *)",
        "DeleteDC",
        "ERROR_DUP_NAME",
        "r4jZ^f;",
        "Install drivers",
        "5+575>5D5I5Q5\\5p5",
        "CSetupAutomation::ResolveTarget: Couldn't get volume properties: 0x%08x",
        "717`7u7",
        ".PAVCXXXXXTemp@?JD@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        ".PAVCXXXXXHandledException@?2??DoExecute@CSetProductKey@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "ERROR_NO_SUCH_GROUP",
        ">->l>",
        "ERROR_CLUSTER_INVALID_IPV6_NETWORK",
        "3=3I3U3a3m3y3",
        "|d-Vk",
        "CSetupPlatformOSSwitchCheckpoint::Rollback: Attempting to remove file/folder %s",
        "7H7u7",
        "XPQQhN",
        "CSIDL_PROGRAMS",
        "Element::AddMetadata",
        "t&f;E",
        "SPApplyCustomDiskConfig: The layout for disk %u is invalid; stopping",
        "System\\CurrentControlSet\\Services\\WofMob",
        "Node not found",
        "1 1H1U1m1",
        "5`5j5",
        ".PAVCXXXXXTemp@?3??ExtractPidgenx@CWIMPidgenxExtractor@@UAEJPAUIImageInfo@SetupPlatform@@PAPAVString@UnBCL@@1@Z@",
        "121Q1X1",
        "C@9s<t",
        ".?AVSmVolumePathEnumerator@@",
        "0.0:0L0t0z0",
        "ta-LK",
        "<[=q=",
        "2.2N2X2u2",
        "Sources\\SetupPlatform.Drivers.ini",
        "0 080<0T0X0p0t0",
        "8,808H8L8d8h8",
        ">\"?(?5?F?S?\\?d?k?z?",
        "j hp#^",
        "=\"=*=0===O=]=",
        "0!0;0E0N0W0`0i0r0{0",
        "BASIC",
        "CSetupAutomation::Save currently only supports saving answers for WIM images",
        ">F>Y>e>",
        ">(>9>Q>V>[>g>",
        "Begin first boot",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "?8?<?@?D?H?L?P?T?X?\\?`?d?h?l?p?t?x?|?",
        "%hs: Failed to set boot command line for phase %d. Error: 0x%08X",
        "5$5,5D5L5T5\\5d5l5t5|5",
        "4 4$4,4044484@4D4P4T4X4\\4`4d4h4l4p4t4x4|4",
        "0B0Z0e0q0z0",
        "687f5e48-d5bb-4d0d-ac8a-26ea828ae85a",
        "Processing ControlSet%03u",
        ";V<<=[=s=",
        "void __thiscall UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::Resize(int,int)",
        "ERROR_CANNOT_EXECUTE_FILE_IN_TRANSACTION",
        "6K6Q6\\6j6",
        "8#9(9-9:9@9P9`9g9x9}9",
        ".?AUIDriverPackageInfo@SetupPlatform@@",
        "454a4n4",
        "pAddSafeOSDriversFromProvPackage: Failed to export driver element to from provisioning package %s to %s (0x%08x)",
        "ERROR_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER",
        "939A9Q9X9^9c9n9{9",
        "DynamicUpdate.GDRs",
        "7.8V8]8c8h8s8~8",
        "Call to Transformer Uninstall failed. Error: 0x%08X",
        "DiskLayout::VerifyLayoutCreatedParams: Partition %u is newly created, but doesn't specify a size",
        ":\":=:C:M:R:\\:c:q:",
        "?L?`?",
        "<L<[<",
        "struct SetupPlatform::IPartition *&__thiscall UnBCL::ArrayList<struct SetupPlatform::IPartition *>::get_Item(int)",
        "0)0:0R0X0n0",
        "The size of file [%s] has changed from [%llu] to [%llu]",
        "pDUSearch",
        ":4:N:o:",
        "    Failed to write new element metadata",
        ";-;:;I;a;n;",
        "5&5/5D5Q5]5i5r5{5",
        "SssReleaseServicingStack",
        "0 0%0/060D0V0g0n0",
        "Users",
        "void __thiscall UnBCL::Array<class COperationInfo *>::Remove(class COperationInfo *)",
        "SPProcessBitlockerOnDrives: Bitlocker is %s but the current OS does not support %s it.",
        "RPC_S_INVALID_VERS_OPTION",
        "NtDelayExecution",
        "InitializeCriticalSectionAndSpinCount",
        "LP Validator: Failed to open DISM session. Error: %08X",
        "eu-ES",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *> *)",
        "<2<:<@<M<_<i<|<",
        "5*5@5W5^5e5p5",
        ".?AU?$IEnumerator@PAX@UnBCL@@",
        "1/171>1E1P1]1q1x1",
        "7\"7;7B7H7M7X7j7r7x7",
        "SPCopyFilesAndFolders: Number of file names found: %d",
        "%s\\Control\\Nls\\Language",
        "9$9,949<9D9L9T9\\9h9p9",
        "%hs: There is not enough free disk space for uninstall. Required: %I64u, available: %I64u",
        ":.:9:C:T:]:i:x:",
        "3&343B3P3",
        "3!44484<4@4D4H4L4P4c4",
        ";,<7<E<l<s<z<",
        "9'9B9V9]9c9h9s9}9",
        "=)=L=",
        "5J5S5d5",
        "252<2T2[2a2l2|2",
        "ERROR_NO_MEDIA_IN_DRIVE",
        "> >/>R>y>",
        "j\\Xf;A",
        "5:6O6a6i6o6",
        "LP Validator: Ignoring validator failure due to environment variable.",
        "2(252M2",
        "2`384",
        "D$4Ph8^",
        "ERROR_CTX_MODEM_RESPONSE_BUSY",
        "|SYSPART|\\|DEST|\\|RESOURCES|",
        ".?AU?$IList@PAVCGlobalPathFindData@@@UnBCL@@",
        "<9=^=e=l=",
        "struct DISK_SPACE_IMPACT &__thiscall UnBCL::ArrayList<struct DISK_SPACE_IMPACT>::get_Item(int)",
        "Failed to get volume root!",
        "CryptCATCDFClose",
        "AllowWindowsUpdate",
        "%hs: Failed to create downlevel volatile key for rollback. hr = 0x%X",
        ".?AV?$DictionaryEntry@PAVString@UnBCL@@PAV?$ArrayList@PAVCDriverDetails@@@2@@UnBCL@@",
        "%hs: Setting boot app %s for WinRe %s",
        "SPAllocateRange: Target offset (%llu) and size (%llu) overlap with an adjacent occupied region",
        "FindFirstChunk",
        "< <.<4<Z<`<l<t<",
        "4<4Y4j4",
        "CBS_E_DOWNLOAD_FAILURE",
        "2+2X2g2",
        ":3:W:w:",
        "Error retrieving ACL migration information: [0x%08X]",
        "<&<4<C<W<r<",
        "\\Device\\HardDisk%d\\Partition%d",
        "AppxFailedPathAndHR",
        ":$:*:7:I:W:d:v:~:",
        "class OC::CCmdLineExecutionTelemetryData *const *__thiscall UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *>::GetBuffer(int) const",
        "j\\YtLJ",
        ":):0:D:R:c:j:p:u:",
        "sDiskLayout::ParseSizeString",
        "Cannot open snapshot key, unable to update snapshot Info. Error: 0x%08x",
        "7$7<7D7h7|7",
        ">!>*>2>?>S>q>",
        "2$2-262?2H2Q2Z2c2l2",
        "0;0G0S0h0x0",
        "0'0:0M0a0q0v0",
        "= =$=(=,=0=4=8=<=@=H=L=P=T=\\=`=d=h=l=p=t=x=|=",
        "040<0H0h0p0|0",
        "SysPrep ReSpecialize",
        "??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UAE@XZ",
        "? ?(?0?@?L?T?l?t?",
        ".?AV?$Array@PAVCOperationsValidator@@@UnBCL@@",
        "1*161K1a1q1",
        "2-2E2Q2[2",
        ":#:>:R:b:o:",
        "OpenVirtualDisk",
        "SPDeleteAllSnapshots: Failed to convert snapshot ID to GUID string. Error: 0x%08X",
        "=*>\\>x>",
        "<c<{<",
        "6 616F6N6T6a6s6",
        "=#=5=S=",
        "wdsclientapi.dll",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,class ATL::CElementTraits<struct HKEY__ *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *> *,class UnBCL::Array<class UnBCL::String *> *,int)",
        "CApplyEAs::CallbackFiles",
        "?4?X?x?",
        "<!<'<,<7<D<L<R<f<p<",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@_JPAVCGlobalPath@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "EnableDebugger: Failed to enable debugging for the new OS entry. Status = 0x%X",
        "??0exception@@QAE@ABQBD@Z",
        ">=?`?m?",
        "ERROR_INSTALL_SUSPEND",
        "xCMediaLayout::QueueDrivers",
        "3-3E3K3a3r3",
        "ApplyFirstBootOnlinePluginList",
        "%hs: Set BCDE_DEVICE_TYPE_RAMDISK_SDI_PATH succeeded.",
        "=$=:=Q=|=",
        "SPFreeDiskRangeEnumerator::Initialize",
        "VdsPartition::SetType: SetType() cannot create extended/logical partitions",
        "?GetFileNameExtension@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        "int __thiscall UnBCL::ArrayList<enum OP_EXECUTION_PHASE>::BinarySearch(int,int,enum OP_EXECUTION_PHASE,struct UnBCL::IComparer<enum OP_EXECUTION_PHASE> *)",
        "void __thiscall UnBCL::ArrayList<struct DiskRange>::QuickSort(class UnBCL::ArrayList<struct DiskRange> *,class UnBCL::ArrayList<struct DiskRange> *,int,int)",
        ".?AVCXXXXXHandledException@?DI@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "ERROR_DELETE_PENDING",
        "unattend-original.xml",
        "9!9(9.939?9M9T9h9x9",
        "%hs: Persisting control environment variables failed.",
        ".?AVCXXXXXHandledException@?FH@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "D$(PSSS",
        "ProvisioningPackage::GetVersion",
        "void __thiscall UnBCL::_::ArrayListEnumerator<struct UnBCL::ISerializable *>::Reset(void)",
        "3$303T3\\3d3l3t3|3",
        ".PAVCXXXXXTemp@?3??DoExecute@CExportWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "2,2P2t2",
        "<F<w<",
        "Post OOBE",
        "sSPInitializeCOM",
        "DynamicUpdate.Langpacks",
        "9\"9'9;9O9V9\\9a9l9v9{9",
        "ExecuteOperations: Successfully processed execution phase %s",
        "121D1S1o1",
        "spPrintLastCrashDumpInfo",
        "ERROR_NETWORK_NOT_AVAILABLE",
        "OC::COCCbsAdapter::OpenCbsPackage: QueryInterface on __uuidof(ICbsPackage) failed. hr = 0x%x",
        "Failed copying WPA keys",
        "MoveDirectoryEx: Failed, creating parent directory %s",
        "CBS_E_INTERNAL_ERROR",
        ">=>u>{>",
        ";S;c;",
        "6'797A7G7T7f7",
        "?$?,?4?<?D?L?X?|?",
        "SetupPlatform::IsUninstallAllowed",
        ":$:2:I:",
        "?0?8?@?J?W?z?",
        "SVh U",
        "SRTPaging",
        "Failed allocating temp package list file path",
        "? ?4?A?K?_?l?v?",
        "%hs: BCD failed to remove the downlevel OS current boot entry. Error: 0x%08X",
        "8#8)8;8L8Y8b8i8r8",
        "%hs: Expected a vhd or vhdx file; got %ws.",
        "FriendlyName",
        "5\"5.5:5F5R5^5j5v5",
        "Failed to load the %.*ws hive to %.*ws",
        "6.656G6W6d6l6}6",
        "CInstallDUUpdatesOffline::DoExecute: Failed to find updates in the DU directory. Error: 0x%08X",
        "2)232F2V2g2l2q2|2",
        ">T>}>",
        "2=2B2~2",
        "ERROR_DS_MISSING_EXPECTED_ATT",
        "Add provisioning package",
        "class CBcdSetting *const *__thiscall UnBCL::ArrayList<class CBcdSetting *>::GetBuffer(int) const",
        "9<9N9V9\\9i9{9",
        ".?AV?$SmartPtr@VCDeviceIdDatabase@@@UnBCL@@",
        "SL_E_CHPA_NULL_VALUE_FOR_PROPERTY_NAME_OR_ID",
        "SmDisk::CreatePartition: SM API do not support partition Ids",
        ">!>E>d>",
        "Source has OS WIMBoot entries but is missing WIMBoot marker. However, we will consider it a WIMBoot system.",
        "ERROR_DS_CANT_DERIVE_SPN_WITHOUT_SERVER_REF",
        "MIGPERFTRACK: OOBE boot apply (online) =======================================",
        "GetFinalPathNameByHandleW",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,&protected: static enum ActionType __stdcall UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,class ATL::CElementTraits<enum ActionType> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "jYXVPhh",
        "<!<+<",
        "6'606J6S6h6",
        "tKWVj",
        "FOD Validator: Installed package or feature dissapeared, will invalidate OC gather operation",
        "0[0g0s0",
        "2$2,242<2D2L2T2\\2d2l2t2|2",
        "D$@PW",
        "1$1(1@1D1\\1`1x1|1",
        "4+4<4W4s4",
        "=5=e=n=",
        "3.3<304:4v4",
        "COfflineHiveT<class CEmptyType>::GetValue",
        "SclCreateKey returned STATUS_INSUFFICIENT_RESOURCES; skipping...",
        ".PAVCXXXXXHandledException@?BC@??QueueDriverInstallation@CNewSystem@@UAEJPBGW4SP_ERROR_HANDLING@SetupPlatform@@@Z@",
        "VdsDisk::Initialize: Failed to query IID_IVdsDisk interface [%s] (0x%08x)",
        "7$7+797F7Z7f7v7~7",
        "7^8v8",
        "TaskDefinition::get_Triggers failed. hr = 0x%x",
        "usbxhci",
        "Removing OS uninstall",
        "7)7e7",
        "ERROR_NETWORK_UNREACHABLE",
        "void __thiscall UnBCL::ArrayList<class CAppInfo *>::QuickSort(class UnBCL::ArrayList<class CAppInfo *> *,class UnBCL::ArrayList<class CAppInfo *> *,int,int)",
        "pResponse",
        "Journaling is enabled successfully on the applied volume.",
        "SL_E_SRV_SERVER_PONG",
        "?,?4?:?L?]?j?r?",
        "ERROR_WINDOW_NOT_COMBOBOX",
        "6'6.64696D6S6g6",
        "5$5,585\\5d5l5t5|5",
        "=:=K=S=Y=m=|=",
        ":(:0:7:A:L:X:l:{:",
        "7 70787\\7l7t7|7",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCMountedPathInfo@CDeploymentBase@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "pAdjustKernelLogFileName",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::Add(class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *)",
        "WINDOWS/VERSION/SPLEVEL",
        "SL_E_CHPA_DMAK_LIMIT_EXCEEDED",
        ".PAVCXXXXXTemp@?3??DoExecute@CExecuteUnattend@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "Failed to retrieve namespace for image on server %s. Error: 0x%08X",
        "Installation finished more than %d days ago. Uninstall is no longer valid.",
        "4!4&414<4P4\\4p4",
        "5-545:5?5J5U5e5n5}5",
        "%s will NOT be disabled because it's a dependency of one of the OCs that will be enabled",
        "?#?2?<?A?I?P?\\?n?",
        "0[0k0p0",
        "ERROR_CLEANER_CARTRIDGE_INSTALLED",
        "<*<8<B<N<d<m<s<",
        "?#?:?D?W?a?h?n?s?~?",
        "=%=+=0=;=A=T=",
        ":0:K:Q:c:v:",
        "OC::COnlineOCManager::COnlineOCManager",
        "suspended",
        "CompanyName",
        "7&7-747?7E7J7O7\\7s7z7",
        "=3=L=_=x=",
        "__thiscall CMoveWIMBootEntriesAndPartition::CMoveWIMBootEntriesAndPartition(const unsigned short *,const unsigned short *,class UnBCL::ArrayList<class CWIMBootData *> *,int,enum OP_OPERATION_ID)",
        "fIfKf",
        ":3;W;w;",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *> *)",
        "Failed to get user token! Error code = %#x",
        ".PAVCXXXXXHandledException@?HD@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "<&<N<d<q<",
        "Drivers %ws be removed during this pass.",
        "9#979D9",
        "20201009050501Z0w0=",
        "ERROR_INVALID_IMPORT_OF_NON_DLL",
        "5E5n5",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *> *)",
        "class CDeviceIdDatabase::CDeviceInfoData *__thiscall UnBCL::_::ArrayListEnumerator<class CDeviceIdDatabase::CDeviceInfoData *>::get_Current(void) const",
        "@\\WjdPQ",
        "444D4T4X4\\4`4t4x4|4",
        ".?AV?$CAutoRelease@PAUIEnumWbemClassObject@@@RAII@@",
        "9\"969<9E9[9i9{9",
        "%hs: QueryObject succeeded.",
        "6 6.6U6g6t6",
        "1P2d2u2|2",
        "    Failed to get element local name",
        "WIMAddImagePath",
        "='=/=6===H=T=h=p=w=~=",
        "> >(>;>K>S>f>v>~>",
        "8)8J8g8",
        "5 5b5",
        "OC::COCCbsAdapter::SearchFoundationPackageName: ICbsIdentity::GetProperty failed %X.",
        "; ;:;A;N;U;z; <'<",
        "0$0,040@0d0l0t0|0",
        "SP_ENV_DELAY_IMAGE_APPLY",
        "ERROR_INVALID_USER_BUFFER",
        ">4>=>F>P>\\>i>",
        "SmPartition::SetType: Couldn't get disk properties (0x%08x)",
        "JET_errLogWriteFail",
        ";-;7;B;R;a;n;",
        "SL_E_CHPA_OEM_SLP_COA0",
        "SP_ETW_TRACING_MODE",
        ">(>@>G>M>R>]>d>x>",
        "2B2U2z2",
        "SKIPBOOTTRACK(FIRST): Got First boot removal OneSetting: %s",
        "pAddSafeOSDrivers: Failed to create mount directory %s (0x%08x)",
        "JET_errNoBackup",
        "void __thiscall UnBCL::ArrayList<class CUserProfile *>::Insert(int,class CUserProfile *)",
        "IMAGE_STATE_SPECIALIZE_RESEAL_TO_OOBE",
        ".to remove",
        "CDownloadDUUpdates::DoExecuteInternal: Fail to get CDUPackage",
        "void __thiscall UnBCL::Array<class CDUPackage *>::InitLarva(class UnBCL::ArrayList<class CDUPackage *> *)",
        "XSPGenerateCopyListFromConfigFile",
        "ERROR_DS_OUT_OF_SCOPE",
        ".?AVCDownlevelOCStore@OC@@",
        ".?AV?$SerializableBase@V?$Array@PAVCShellFolderInfo@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCShellFolderInfo@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "4/5F5N5d5",
        "$WINDOWS.~ST",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class CSPInternalPluginData *> __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,class CSPInternalPluginData *>,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,class CSPInternalPluginData *> __stdcall UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,class ATL::CElementTraits<class CSPInternalPluginData *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "3T4]4",
        "SPUninitializeNetwork: Failed to uninitialize network in WinPE; Error: 0x%08X",
        ".?AU?$IEnumerable@UPartitionInfo@?1??SPGetPartitionOrdinal@@YGJPAUIPartition@SetupPlatform@@PAK@Z@@UnBCL@@",
        "void __thiscall CARPValidator::AddToSFList(class UnBCL::String *,struct IMigPlatform *,struct IMigUser *,class UnBCL::ArrayList<class CShellFolderInfo *> *)",
        "CMigrateFramework::DoExecute",
        ".?AV?$SerializableHashtableBase@GH@_@UnBCL@@",
        "ActionPlatform::LaunchModule: Executing method '%s' from %s",
        "?0?4?L?P?h?x?",
        "?$?H?_?q?",
        "DiskLayout::ApplyLayout: The disk layout provided is invalid",
        "9%9Y9s9",
        "6X6e6w6",
        "Uninstall gather",
        "int __thiscall UnBCL::ArrayList<class CWIMBootData *>::BinarySearch(int,int,class CWIMBootData *,struct UnBCL::IComparer<class CWIMBootData *> *)",
        ".?AVStringProperty@?1???$pDefineStringProperty@V<lambda_2fdd735333666824fb4fff880b7fb12a>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_2fdd735333666824fb4fff880b7fb12a>@@@Z@",
        "0(0C0q0",
        "8'8D8[8b8h8m8x8",
        "9^ps\"9Fxt",
        "CRYPT_E_BAD_MSG",
        "ERROR_SXS_UNTRANSLATABLE_HRESULT",
        "PPPPPP",
        "<O<U<\\<c<l<x<",
        "j`joj",
        "CBS_E_MORE_THAN_ONE_ACTIVE_EDITION",
        "Failed to get aliased identifier. Status: %x",
        "w(hPQ",
        "Installation type: Deployment",
        "  Deciding migration on driver:",
        "WIM\\IMAGE[*]\\FILECOUNT",
        "BOOTTGT",
        ".?AVCXXXXXHandledException@?HD@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "RemoveOEM",
        "6 767O7",
        "=(=0=D=",
        "ERROR_IPSEC_IKE_INVALID_PAYLOAD",
        "111`1m1",
        "7<7N7l7w7|7",
        ".?AV?$DefaultInstanceFactory@VCCreateFileForNewSystem@@@UnBCL@@",
        "1&151?1G1N1]1g1z1",
        "    FAiled to verify key attribute",
        "MapViewOfFile(%s) failed! Error code = %#x",
        "RESETCLEAR",
        "ERROR_MCA_OCCURED",
        "DISKSPACEQUERY: Calculating disk space failed. Error: 0x%08X",
        "CSetupAutomation::Resurrect: Failed to open %s for reading: 0x%08x",
        "<(<?<F<^<c<t<|<",
        "2,2=2B2M2l2z2",
        "E_INVALIDARG",
        "<\"<1<8<><C<N<Y<i<v<",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVCGlobalPath@@@UnBCL@@@UnBCL@@@UnBCL@@",
        ";$;4;D;T;d;t;",
        "CPrepareNewOSForFirstBoot::DoExecute",
        "6J6t6",
        "{4D36E97B-E325-11CE-BFC1-08002BE10318}",
        "pGetAppVersionInfo",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAUISerializable@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "1 2p2",
        "ParentKeyName",
        "9$:9:k:",
        ";#;,;5;A;M;V;_;k;w;",
        "1#1(1N1e1l1r1w1",
        "ERROR_CLUSTER_NODE_ALREADY_MEMBER",
        "4&494P4]4j4}4",
        "<*<;<D<",
        ">)>?>F>L>Q>Y>d>x>",
        "4&4-4:4A4h4",
        "VWhx ",
        "(%lx): Failed to get size for boot entry buffer.",
        "WdsLogStructuredException",
        "int __thiscall UnBCL::ArrayList<struct DiskMatchFilter>::LastIndexOf(struct DiskMatchFilter,int,int) const",
        "QueryPerformanceCounter",
        ":):F:k:",
        "~j\\XPW",
        ":E;L;R;W;b;p;",
        "ug-CN",
        "9$9,949<9D9P9p9x9",
        "ERROR_DS_NOT_AUTHORITIVE_FOR_DST_NC",
        "2_3f364=4",
        "9D9M9V9a9l9w9",
        "<'<5<><y<",
        ".?AV?$DefaultInstanceFactory@VCEnable1394Debugging@@@UnBCL@@",
        ".PAVCXXXXXTemp@?N@??OnErrorCommon@CSetupPlatformPrivate@@AAEJXZ@",
        "GetLocalTime",
        "ActionQueueCookie",
        "Recovery\\AutoApply",
        "Apply Optional Component status",
        "2\"252H2[2b2h2m2x2",
        "=>=P=X=^=k=}=",
        ".PAVCXXXXXTemp@?3??SPValidateProductKey@@YGJPBG00PAPAUIProductKey@SetupPlatform@@@Z@",
        "ERROR_MARSHALL_OVERFLOW",
        ".?AU?$ICollection@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "1!1a1q1~1",
        "<%<0<5<I<g<",
        "; ;';.;:;M;a;k;r;",
        "RtlEqualUnicodeString",
        "Failed getting release type for package",
        "D$HP3",
        "4'494A4G4T4f4t4",
        "BFSVC: %s",
        ":3;?;U;e;l;r;w;",
        "Cannot create proposed scratch directory %s.",
        "7T7c7w7",
        "SysprepSession::ExecuteAction: Failed during deleteDirectory operation; dwRet = 0x%x",
        "ERROR_NO_LOG_SPACE",
        "L$4Qh",
        "%s|%s|%d.%d.%d.%d.%d|%s|%d|%s",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::Insert(int,class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *)",
        "171A1Z1h1q1",
        "060<0N0b0o0",
        "1,1>1L1m1",
        "8 8*818?8Q8b8i8",
        "struct PartitionLayoutArgs *const *__thiscall UnBCL::ArrayList<struct PartitionLayoutArgs *>::GetBuffer(int) const",
        "CRYPT_E_NO_VERIFY_USAGE_CHECK",
        "Dumping hive list",
        ">->5>;>H>Z>s>",
        "8\"8(8-888C8W8o8~8",
        "pSetTaskSettings",
        ".?AV?$CAutoCleanupBase@PAVSmVirtDisk@@@RAII@@",
        "SP_KEEP_ETL_FILE",
        "?&?>?J?n?",
        "RestoreFileInfo",
        "ERROR_DBG_PRINTEXCEPTION_C",
        ".?AVUtcWrapperBase@Diagnostics@Microsoft@@",
        "I0a0n0",
        "class UnBCL::String *__thiscall Mig::CBasicEnv::Expand(const class UnBCL::String *)",
        "SmDisk::CreatePartition: Partition GUID not supported on non-GPT disk",
        "3(3H3P3X3`3h3p3x3",
        ".PAVCXXXXXHandledException@?2??ValidateProductKey@CImageInfoSet@@UAEJPBGPAPAUIProductKey@SetupPlatform@@@Z@",
        "LocalPayload\\Appx",
        "SL_E_LICENSE_DECRYPTION_FAILED",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@_JPAVString@UnBCL@@@UnBCL@@@_@UnBCL@@",
        "pAddSafeOSDrivers: Failed to queue drivers from ICB: 0x%08x",
        "8&8@8L8V8]8c8h8s8z8",
        ".PAVCXXXXXHandledException@?FL@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "CDownloadDUUpdates::CalculateSpaceNeeded: IDUUpdate::GetType failed. hr = 0x%x",
        "enum MIGSTATUS __stdcall pSPDoOfflineApply(class UnBCL::String *,enum SetupPlatform::SP_MIG_SCOPE,class UnBCL::String *,int,class UnBCL::String *,struct ISPMigProgress *)",
        ">,><>L>\\>l>|>",
        "unsigned char &__thiscall UnBCL::ArrayList<unsigned char>::get_Item(int)",
        "7'797W7c7u7",
        ".?AVCCFGValidator@@",
        "8%828:8@8T8a8k8",
        "CSetupAutomation::SetDataMigration",
        ".?AU?$IEnumerable@PAVCCFGSectionValue@@@UnBCL@@",
        "SVWj\\X",
        "484J4R4X4e4w4",
        "9'939?9h9p9}9",
        ";.;5;;;@;K;];e;k;",
        "SmImageDisk::GetProperties",
        "JET_wrnDefragNotRunning",
        "%s\\Inf\\%s",
        "XRemovedDriverClassGUID",
        "GetSecurityDescriptorControl failed! Error code = %#x",
        "6$6?6a6v6|6",
        "Final decision for the driver package: %s",
        "2#232B2Q2X2_2k2w2",
        "2#202B2P2",
        "D$tj PQ",
        "DiskLayout::ApplyLayout: This disk must be initialized before you create partitions (0x%08x)",
        "1\"1'121=1Q1b1n1s1",
        "RPhhy",
        "CAddUnattend::DoExecute: Failed to save copy of answer file to %s (0x%08x)",
        "Launching %s",
        "7&727<7M7V7b7o7y7",
        "%hs: SPGetOSInformation failed, uninstall validation will fail. Error: 0x%08X",
        "%systemdrive%\\inetpub",
        "RtlWcpDllDebugEntrypoint",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,class ATL::CElementTraits<enum ActionType> > const *,struct __POSITION * const &)>::MoveNext(void)",
        ".PAVCXXXXXHandledException@?L@??SPIsPathInsideFolder@@YGHPAVString@UnBCL@@0@Z@",
        "1&1,161@1X1o1",
        "SKIPBOOTTRACK(SAFEOS): Skip Boot Validator: Main offline apply has not completed, cannot continue with SafeOS boot removal.",
        ">1>7>M>a>n>|>",
        "ERROR_DS_INVALID_ATTRIBUTE_SYNTAX",
        "4\"4,424?4K4X4c4",
        "-0Q0u0",
        "0'1:1G1e1v1",
        "Update Boot Sector",
        "Scratch directory %s requested but cannot be used.",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCCopyInfo@@@UnBCL@@@UnBCL@@",
        "ERROR_APP_INIT_FAILURE",
        "ERROR_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER",
        "OC status changed, will invalidate OC gather operation",
        ".PAVCXXXXXTemp@?GJ@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "SetupPlatform: Begin SafeOS: Global progress: %u, Phase progress: %u",
        ".PAVCXXXXXTemp@?FG@??pSPDoOfflineApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0H0PAUISPMigProgress@@@Z@",
        "y-PSh",
        "InitializeCriticalSection",
        "SKIPBOOTTRACK(FIRST): Sysprep offline specialization has pending actions; needs to run online",
        ".?AV?$CAutoRelease@PAUIMigFileAccess@@@RAII@@",
        "0$0(080<0L0P0`0d0t0x0",
        ".?AV?$SerializableBase@VCUpdateBootCode@@$0A@V?$DefaultInstanceFactory@VCUpdateBootCode@@@UnBCL@@@UnBCL@@",
        ":<:D:L:T:\\:d:l:t:|:",
        "Changing SetupCl's boot-time execution status requires access to the offline SYSTEM hive.",
        ">$>*>7>I>W>i>",
        "SPGetFreeMemory: Failed to query memory status: 0x%08x",
        "Entering pSPStartAutoStartingServices",
        "WVh\\'",
        "Copy extra migration XMLs",
        "435:5@5E5P5Z5m5{5",
        "ProfessionalSingleLanguage",
        "long __thiscall OC::CDownlevelOCStore::ModifyOCsState(class OC::COCCollection *)",
        "SPAPI_E_DEVINSTALL_QUEUE_NONNATIVE",
        ">2>D>[>j>",
        "ERROR_INVALID_DOMAIN_STATE",
        "CSetupAutomation::GetDriveLetter: Failed to get volume properties: 0x%08x",
        "> >,>5>B>J>S>\\>i>q>z>",
        "9\"9'929=9X9q9",
        "DriverUpdate:",
        "class CSetupPlatformInfo *__stdcall UnBCL::Try_Cast<classCSetupPlatformInfo*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "class UnBCL::String *__stdcall Mig::CStringPatternUtil::EscapeSpecialChars(class UnBCL::String *,class UnBCL::String *,unsigned short)",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> *,class UnBCL::Array<class UnBCL::String *> *,int)",
        "JET_errIndexInUse",
        "1%212C2P2_2{2",
        "GetSecurityDescriptorOwner failed! Error code = %#x",
        ">->;>R>_>s>",
        "Some error occured while adding class filters. Error: 0x%08X",
        "SclpStateValidateAndRetrieveChangedKeys",
        "D$@PjZ",
        ":3:X:u:|:",
        "<)<><E<t<",
        ":*:@:R:_:",
        "5-5=5M5]5m5}5",
        "SPDeleteSnapshot: Failed to set backup state. Error: 0x%08X",
        "9E4uF3",
        "=(>5>M>",
        "979Y9s9",
        "%hs: Failed to get firmware type. Status = %d",
        "5)50565;5F5Q5[5c5m5u5{5",
        "T$0QQV",
        "pSPMergeWim: Skip split wim file %s.",
        "ERROR_DS_CONFIG_PARAM_MISSING",
        "CDeploymentBase::CleanupMounts: Unmounting directory %s",
        "    Exception address: %p",
        "5%5,565;5@5g5{5",
        "Failed to get driver enumerator; this is unexpected. Error: 0x%08X",
        "555_5",
        "UTF-16",
        "161Z1a1g1l1w1",
        ".?AU?$ICollection@H@UnBCL@@",
        "Deleting the system store is only supported in WinPE",
        "CSetupPlatformRollback::LoadState",
        "{FF3C6453-452D-4D85-A63D-8B463BC7668C}",
        ".?AV?$DefaultInstanceFactory@VCAddCbsPackage@@@UnBCL@@",
        ";#;8;>;I;P;X;^;r;z;",
        "OpenEventW",
        "ERROR_PROCESS_NOT_IN_JOB",
        "=%=Y=s=",
        ":#:(:<:]:k:u:|:",
        "WIMBoot entry suspended successfully.",
        "Exception while executing discover for user: %s",
        "WinreBootReason",
        "void __thiscall UnBCL::ArrayList<unsigned char>::AddRange(const struct UnBCL::ICollection<unsigned char> *)",
        "CBS_E_WUSUS_MAPPING_UNAVAILABLE",
        "0!0)000<0N0c0r0|0",
        "='=4=H=o=",
        "pDUSearch: DUSearch failed. hr = 0x%x",
        ";*;;;O;[;l;",
        "juj#Ph",
        "3*383I3S3m3~3",
        "\\REGISTRY\\MACHINE\\SECURITY\\POLICY\\POLACDMS",
        ";&;-;?;P;];s;",
        "2)2=2J2a2y2",
        "1\"131?1H1S1b1",
        "4$4,444@4d4l4t4|4",
        "RetrieveDiskLayout: Element %s is missing from partition",
        "191219011459Z",
        "6\"6(6.646:6@6F6L6R6X6^6d6j6p6v6|6",
        "8!8;8B8H8M8X8^8k8r8x8}8",
        "0$0,040<0L0\\0d0l0t0|0",
        ";!<&<+<S<X<]<",
        "WriteSectors: Requested to write [%d] bytes. Succesfully wrote [%d] bytes",
        "9!9+92989=9H9S9Z9n9",
        ".?AV?$DefaultInstanceFactory@VCGatherEndInstall@@@UnBCL@@",
        ".?AU?$IEnumerable@V?$DictionaryEntry@W4OP_OPERATION_ID@@H@UnBCL@@@UnBCL@@",
        "3*3;3H3Q3m3z3",
        "void __thiscall UnBCL::ArrayList<unsigned long>::CopyTo(class UnBCL::Array<unsigned long> *,int) const",
        "636:6@6E6P6V6i6",
        ">(>,>D>T>d>h>l>p>t>x>|>",
        "3.3B3N3l3",
        "3 30343D3H3X3\\3l3p3",
        "7@8_8",
        "1 1)121?1K1k1w1",
        "0$0.070A0J0T0]0g0p0z0",
        "BfsMigrateLoaderSettings: %wZ -> %wZ",
        "pRegOfflineGetDWord: Cannot load %s hive under alias %s, for offline OS %s. Error: 0x%08X",
        "wcsncmp",
        "xAvailableDiskSpace",
        "Execution of operations queue failed, abandoning",
        "%hs: %s does not exist in the configuration file, uninstall validation will fail",
        "SPGetSystemPartition: Cannot query system information. Error: 0x%08X",
        "FOD Validator: Failed to find FoD package [%s]",
        "void __thiscall UnBCL::ArrayList<struct DiskRange>::CopyTo(class UnBCL::Array<struct DiskRange> *,int) const",
        "unknown operation",
        "4)414;4B4H4M4X4c4w4",
        "%hs: Found device type %d; expected %d.",
        "8E8R8i8",
        "t1VVVVh",
        "<'<><U<l<",
        "= =&=+=6=B=G=[=p=",
        "CorrelationVector",
        "646s6",
        ".?AU?$IList@_J@UnBCL@@",
        ".PAVCXXXXXTemp@?BD@??SPGetWIMImageInfo@@YGJPAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@3@KPAW4IMAGE_TYPE@SetupPlatform@@PAPAG333@Z@",
        ">2>N>`>o>",
        "class UnBCL::String *__stdcall SPGetVolumeNameFromPath(class UnBCL::String *,class UnBCL::String **,int *)",
        "4I4^4e4k4p4{4",
        "Migration scope value is not set",
        "ERROR_CANT_OPEN_ANONYMOUS",
        ">%>1>C>Q>_>m>",
        "<,<6<G<T<^<o<|<",
        "MaxFileSize",
        ">/>G>X>_>i>v>~>",
        "8B8I8O8T8_8k8",
        "<)<@<L<X<e<q<~<",
        "EnumeratePathEx: FindFirstFile failed for [%s]; GLE = 0x%x",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *> *)",
        "t$pVQ",
        ".?AV?$Array@K@UnBCL@@",
        "5'5.54595D5U5]5c5w5",
        "void __thiscall UnBCL::Array<class CSimpleCleanup::CCleanupEntry *>::InitLarva(class UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *> *)",
        "MountDeletePathCallback",
        "     Class GUID:  %ws",
        "Failed allocation",
        ">#>0>B>P>b>",
        "<#<-<6<B<K<T<`<m<w<",
        "WritePrivateProfileStringW",
        "727@7V7h7}7",
        "auto __thiscall ForEachVolume::<lambda_93e097f692a0ecd7060ae525f7768550>::operator ()(struct SetupPlatform::IPartition *,SetupPlatform::PARTITION_PROPERTIES *const ) const",
        "ERROR_CLUSTER_RESOURCE_CONFIGURATION_ERROR",
        ".?AVCXXXXXHandledException@?5??Execute@DiskLayout@@QAEJPAX@Z@",
        "y#SWh",
        "ru-RU",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SysPrep\\",
        "JET_errIndexNotFound",
        "3-3M3d3r3",
        "Search succeeded; will skip subsequent attempts.",
        "7<7x7",
        "Substitute name string copy failed",
        "WinRETel.etl",
        "pLogBugcheckBinaryInfo",
        "RtlGetLastNtStatus",
        "  Reflecting",
        "8#8(838@8T8]8j8r8",
        "~8h0#d",
        "void __thiscall UnBCL::ArrayList<class CGlobalPath *>::CopyTo(class UnBCL::Array<class CGlobalPath *> *,int) const",
        "%hs: Will remove path: %s",
        "<$<2<@<N<\\<j<",
        "F;w4r",
        "> >%>a>w>",
        "Install recovery environment",
        "    Failed to extract payload file",
        "WIM file is not local, copying it to the %s directory",
        ".?AU?$ICollection@PAVCMountedPathInfo@CDeploymentBase@@@UnBCL@@",
        "7!7I7[7k7}7",
        "The trust provider is not recognized on this system.",
        "ERROR_PRINTER_NOT_FOUND",
        "JET_errLogFileSizeMismatchDatabasesConsistent",
        "Enabling sparse mount.",
        "  Final decision for this driver (WinPE): %s",
        "ValidateInput: Partition can't have both ByteAlignment and SingleSectorAlignment set",
        "%hs: Failed to read the boot entry GUID for the rollback entry. Error: 0x%08X",
        "SELECT",
        "ERROR_INVALID_CLEANER",
        "?IsPathRooted@Path@UnBCL@@SGHPBVString@2@@Z",
        "DiskLayout::ApplyProperties",
        ">#>)>/>5>;>A>G>M>S>Y>_>e>k>q>w>}>",
        "JET_wrnIdleFull",
        "ERROR_CLUSTER_EVICT_WITHOUT_CLEANUP",
        "=*=0=F=W=d=l=",
        "8!8/868>8C8N8`8j8~8",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,enum ActionType>,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,enum ActionType> __stdcall UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,class ATL::CElementTraits<enum ActionType> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "NtYieldExecution",
        "0#0G0f0",
        "0/090F0Z0q0",
        "ValidateInput: UseAllSpace could be specified only for one partition",
        "sExecuteOperations_start",
        "%hs: Disk partition changes are not allowed.",
        "?4?P?",
        ".?AV?$SerializableArrayListBase@PAVCOperation@@@_@UnBCL@@",
        "?5?<?C?J?Q?X?^?g?q?{?",
        "Invalid parameter passed to C runtime function.",
        "<0P0b0j0p0y0",
        ";(;1;=;P;W;i;u;|;",
        "%hs: Unable to apply WIM image. Error: 0x%x",
        "dRemoveWIMBootExceptionList",
        "5<5D5L5T5\\5d5p5",
        "WIMMOUNT_SPARSE",
        "Extracted Mini dump",
        "class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::GetBuffer(int) const",
        ".PAVCXXXXXHandledException@?PK@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        ">0>=>H>O>U>Z>e>u>",
        "= =+=?=H=Q=c=n=",
        "CInstallDUUpdatesOffline::FindUpdates: Failed to get installable drivers from package %s; hr = 0x%08X",
        "Setup will %scompress the upgrade store",
        ".?AV?$SerializableBase@VCFlowValidator@@$0A@V?$DefaultInstanceFactory@VCFlowValidator@@@UnBCL@@@UnBCL@@",
        "<*<G<u<",
        "<-<4<:<?<J<U<i<w<",
        "5C5J5`5",
        "ERROR_SYSTEM_TRACE",
        "Af;H(s",
        "ERROR_INVALID_HANDLE",
        "FindOtherMountsForWimCallback",
        "%hs: Successfully saved \"%s\".",
        "?#?L?T?a?r?}?",
        ".?AU?$ICollection@PAVISPPluginData@@@UnBCL@@",
        "=(=,=<=@=P=T=d=h=x=|=",
        "Windows Image",
        "NtQueryLicenseValue",
        "(%lx): Failed to get exclusive lock on hive file: [%ws]",
        "?$?r?",
        "3+353F3S3\\3d3j3o3",
        "Bugcheck driver version",
        "Save boot entries for the old OS",
        "<T=z=",
        ":\":2:G:Q:X:^:c:q:",
        "4(4<4T4[4a4f4q4x4~4",
        "OC::CDownlevelOCStore::IsDetectable",
        ".?AV?$ArrayListEnumerator@PAVCDriverInfo@@@_@UnBCL@@",
        "ServiceSpaces: %s does not exist",
        "Closing store. Flags: 0x%x",
        "9\"9*919J9T9|9",
        "7*7S7b7h7y7",
        "File %s does not exist",
        "L$49L$,w}r",
        "SKIPBOOTTRACK(SAFEOS): Turning ON SafeOS boot removal per install flow constraint",
        "737D7M7Z7a7k7x7",
        "tWVPj",
        "<#<7<C<U<i<u<",
        "quz-EC",
        "GdiAlphaBlend",
        "Failed to update WIMBoot entry.",
        "ERROR_CLUSTER_MEMBERSHIP_INVALID_STATE",
        "Failed to create buildupdate key",
        "1\"171>1D1I1T1_1r1",
        "sFirstBootSkipOneSetting",
        ".?AV?$SerializableBase@VCOptionalComponent@OC@@$0A@V?$DefaultInstanceFactory@VCOptionalComponent@OC@@@UnBCL@@@UnBCL@@",
        "040M0q0",
        "9(909J9R9",
        ":#:;:C:P:f:m:s:x:",
        ".?AV?$HTDictEnumBase@V?$DictionaryEntry@PAVString@UnBCL@@W4ActionType@@@UnBCL@@@_@UnBCL@@",
        "    Failed to add payload",
        "System\\CurrentControlSet\\Control\\WMI\\AutoLogger\\SetupPlatformTel",
        "3>4D4",
        "ActionPlatform::DeleteValue: Error from RegDeleteValueW for value %s under key %s; dwRet = 0x%x",
        "JET_errSuccess",
        "void __thiscall UnBCL::ArrayList<struct SetupPlatform::IPartition *>::CopyTo(class UnBCL::Array<struct SetupPlatform::IPartition *> *,int) const",
        "INF %ws not installed as primitive, skipping package.",
        "6A6M6X6f6",
        "<1<X<e<}<",
        "2(292r2y2",
        ":;:S:q:",
        "SVh0X",
        "CSetupAutomation::Save: Failed to create temporary configuration: 0x%08x",
        "8&8.858;8@8K8Y8a8g8l8",
        "6%666C6M6^6k6u6",
        "7,8P8t8",
        "__thiscall UnBCL::ArrayList<class CFailForwardSystem *>::ArrayList(const struct UnBCL::ICollection<class CFailForwardSystem *> *)",
        "SmPartition::GetOrdinal: Returning -1 because SPGetPartitionOrdinal failed with 0x%08x",
        "SL_E_INVALID_PACKAGE_VERSION",
        "<#<)<B<b<~<",
        "j\\Zf;TN",
        "    Failed to find element stop node",
        "VPh`B",
        "pServicesKeyEnumCallback",
        "RollbackDisableTime",
        "SL_E_TOKSTO_CANT_ACQUIRE_MUTEX",
        "4!5M5y5",
        "1!1(1<1a1",
        "t4f97t",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::Insert(int,class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *)",
        "%s_%s%d.%s",
        "6-7Q7",
        "ERROR_PROFILING_NOT_STARTED",
        ": :,:J:P:Y:a:q:x:~:",
        "SclStateValidateAndRetrieveChanges",
        "uCSetupAutomation::GetDataMigration",
        "RtlUnsubscribeWnfNotificationWaitForCompletion",
        "2#222>2J2`2j2",
        "wprintf",
        "??B?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
        "ERROR_IPSEC_MM_FILTER_PENDING_DELETION",
        "ERROR_DS_DRA_MISSING_PARENT",
        ".?AV?$SmartPtr@V?$ArrayList@PAVSysprepComponent@@@UnBCL@@@UnBCL@@",
        "SP_ENV_FAIL_VALIDATOR_OC",
        "AddAccessAllowedAce",
        "Translated a DontSync object to ID 0x%x",
        ".?AV?$ArrayListEnumerator@I@_@UnBCL@@",
        "3'3-3:3L3Z3",
        "CNewSystem::QueueSetupAutomation: Failed to get EULA acceptance (0x%08X)",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCRegCreationData@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "sl-SI",
        "7(7:7T7[7m7",
        "exitCode",
        ";#;7;G;U;h;t;",
        ">&>3>A>Y>_>u>",
        "2#2Y2`2f2k2x2~2",
        "=,=e=",
        "EstimatedCleanupSize",
        "AvailableSpace",
        "(%lx): Failed to enumerate src keys.",
        "?\"?(?-?A?\\?",
        ":>;O;e;r;y;",
        "142p2",
        ".?AV?$DefaultInstanceFactory@VCInstallEula@@@UnBCL@@",
        "SysprepSession::ExecuteAction: Failed during setValue operation; dwRet = 0x%x",
        "ERROR_DS_DRA_ACCESS_DENIED",
        "CFODValidator::BuildFoDList",
        "8*8=8I8Q8X8^8c8n8{8",
        "SPMountOfflineHive",
        ".?AV?$ArrayListEnumerator@PAVCOperationsValidator@@@_@UnBCL@@",
        "ERROR_SXS_DUPLICATE_ASSEMBLY_NAME",
        "7;8s8",
        "3&3.343A3S3a3",
        ">A>d>",
        "{27C6DAE2-A456-4DBB-94DA-36CAF746FE6D}",
        "4'4,4o4",
        "ERROR_IPSEC_IKE_PROCESS_ERR_VENDOR",
        "?#?+?1?E?U?\\?b?g?r?",
        "=)=/=4=I=e=",
        ";+;8;?;E;K;W;a;t;y;",
        "GPT partition name: %s",
        ".PAVCXXXXXTemp@?FI@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "1%111E1O1X1b1k1u1~1",
        "The input CCFGSectionValue pointer of [%s] cannot be dynamic cast to CCFGSectionRegistry*",
        "ERROR_GROUP_NOT_FOUND",
        "JET_errDatabase500Format",
        ":\":@:X:m:y:",
        "0U0o0",
        "Wj0jL",
        "j:^f9p",
        "SL_E_INVALID_LICENSE",
        "CGenericExecutionContext::CGenericExecutionContext",
        ".?AV?$Array@PAVCDriverInfo@@@UnBCL@@",
        "9'9,989\\9a9m9",
        "LANGUAGE",
        ";-;S;};",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Running in EFI mode and find tag file [%s] which means the current system BCD store is created for rollback only, will remove BCD store.",
        "9%9B9L9c9",
        "VdsDisk::Convert: Failed to convert style of the disk (0x%08x)",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::IndexOf(class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *,int,int) const",
        "7%8N8a8l8v8{8",
        "ERROR_UNABLE_TO_INVENTORY_DRIVE",
        "\\tVj0",
        "CMediaLayout::QueueCbsPackages: Failed to get package %u: 0x%08x",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::get_Item(int) const",
        "ERROR_APP_HANG",
        ":!:3:A:O:]:",
        "2=2J2T2[2a2f2q2",
        "int __thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,class UnBCL::DictionaryEntry<unsigned long,struct IVdsDisk *>,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<unsigned long,struct IVdsDisk *> __stdcall UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsDisk *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "DriverStoreClose",
        "SPDeleteAllSnapshots: Failed to set backup context. Error: 0x%08X",
        "SysprepSession::Execute: Unrecognized exception",
        "< =:=H=S=Y=f=",
        "8 8+8?8",
        "BOOTMGR is compressed",
        ".?AV?$Array@PAX@UnBCL@@",
        "void __thiscall UnBCL::Array<struct UnBCL::ISerializable *>::Remove(struct UnBCL::ISerializable *)",
        "626J6P6b6s6",
        ":4;J;",
        "%hs: New recovery image successfully installed. ",
        ".?AV?$CAutoDelete@PAVRegistryPath@@@RAII@@",
        "0.0=0V0\\0n0",
        "void __thiscall UnBCL::ArrayList<struct PartitionLayoutArgs *>::set_Item(int,struct PartitionLayoutArgs *)",
        "     Import Date: %04d/%02d/%02d %02d:%02d:%02d:%03d.",
        ">&?>?D?V?[?h?}?",
        "0 0+070K0W0_0f0l0q0|0",
        "2A2H2S2a2",
        "System\\Setup\\Status\\ChildCompletion",
        ":/:6:<:A:L:[:c:i:}:",
        ";/;8;A;J;X;f;~;",
        "void __thiscall UnBCL::Array<unsigned long>::Remove(unsigned long)",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::MoveNext(void)",
        "5 50545D5H5X5\\5`5d5h5p5x5|5",
        "ERROR_MEMORY_HARDWARE",
        "Prepare SysPrep run",
        "7-7F7j7",
        "CDeploymentProject::CreateFFUDeployment: Failed to convert VHD %s to FFU %s; Error: 0x%08X",
        ":0:E:L:a:h:",
        ";&;4;B;P;",
        "<3=C=",
        "0*0>0L0Q0V0a0}0",
        "1(161D1P1\\1h1",
        "<k<~<",
        "91989?9E9P9",
        "CDeploymentProject::CreateVHDDeployment: Failed to flush platform logs to [%s]. Error: 0x%08X",
        "__thiscall UnBCL::ArrayList<struct DiskLayout::Partition>::ArrayList(const struct UnBCL::ICollection<struct DiskLayout::Partition> *)",
        "SL_E_CHPA_INVALID_PRODUCT_KEY",
        "? ?,?Z?h?y?",
        "CBS_E_INVALID_ACTION_LIST_INSTALL_REASON",
        "t3SVh",
        "JET_wrnColumnSkipped",
        "0/191F1L1S1]1j1q1{1",
        "const unsigned int *__thiscall UnBCL::ArrayList<unsigned int>::GetBuffer(int) const",
        ".?AVCProvisioningElement@@",
        "Service has no start type backed up. Assuming autostart.",
        "VERBOSEICB: ICB OOBE boot apply estimated size is: %I64u",
        "sma-SE",
        "=$=,=4=<=D=P=p=x=",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::RemoveAt(int)",
        ")volume online",
        "DeleteAndRestoreDirectory",
        ".?AV?$SmartPtr@U?$ICollection@PAUIVdsDisk@@@UnBCL@@@UnBCL@@",
        "9%949p9",
        ".?AU?$IEnumerator@PAVCDrvStoreProperty@@@UnBCL@@",
        "8E8L8R8W8b8m8",
        "?I?o?",
        "1s2z2",
        ";&;/;<;E;Q;Z;f;o;x;",
        "?Trim@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ",
        "131X1~1",
        "Dependencies: <<None>>",
        "9'9;9Y9m9t9z9",
        "Profiles",
        "    Exception flags: 0x%x",
        "4!575=5W5x516c6q6x6",
        "JET_errAlreadyInitialized",
        "=$=_=f=",
        "int __thiscall UnBCL::ArrayList<class CCFGSectionValue *>::IndexOf(class CCFGSectionValue *,int,int) const",
        "6,7q7",
        ";(;3;9;W;k;",
        "dHostOSBuildNumber",
        ";9;G;W;i;",
        "online system",
        "969H9U9e9m9",
        "\\REGISTRY\\USER\\.DEFAULT",
        "1D1N1[1v1}1",
        "5$5*50565<5B5H5N5T5Z5`5f5l5r5x5~5",
        "8:8G8\\8h8m8r8",
        "GetMetadataPadding",
        "9$9-9V9g9s9",
        "Xenabling",
        "DismPreOobe",
        "Host system information:",
        "TelemetryMoveFailedHR",
        "CSetupPlatformPrivate::Execute: Failed to delete safe OS hash: 0x%08x",
        "ERROR_INTERRUPT_STILL_CONNECTED",
        "??1OutOfMemoryException@UnBCL@@UAE@XZ",
        "int __thiscall OSRollbackService::CCheckpoint::MoveOrCopyFiles(class UnBCL::String &,class UnBCL::String &,class UnBCL::String &)",
        "?Clone@MultiSz@UnBCL@@UBEPAVObject@2@XZ",
        "777D7|7",
        "CSetupPlatform::GetDefaultAutomation: Found default answer file at %s",
        "int __thiscall UnBCL::_::ArrayListEnumerator<unsigned char>::MoveNext(void)",
        "ERROR_MISSING_SYSTEMFILE",
        ">1>W>",
        ".?AVCInstallDUUpdates@@",
        "%hs: Cannot write migration settings scope to %s. Error: 0x%08X",
        "ExceptionListID is %s",
        "=#=c=h=",
        "Failed to delete file. Status: %x",
        "Caller",
        "class CVhdBootData *__stdcall UnBCL::Try_Cast<classCVhdBootData*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *> *)",
        "ERROR_ERRORS_ENCOUNTERED",
        "WIM\\TOTALBYTES",
        ";4;B;K;U;u;",
        "DeleteImagePath",
        "8$848;8A8F8Q8X8]8",
        "RestoreDirMetadata: RestoreFileStorageTierClass failed",
        "9-9N9k9",
        "void __thiscall UnBCL::Array<class DiskLayout *>::Insert(int,class DiskLayout *)",
        "COperationQueue::RemoveAt",
        "WimParseHexString",
        "QueueRecoveryImageInstallation called with recovery image option %d",
        "=/=<=F=U=^=d=q=w=|=",
        "60686@6H6P6\\6|6",
        "SPStopSetupTelemetryTracingSessionAndMergeFile",
        ".logical",
        ":.:C:`:",
        "Vh,.`",
        "void __thiscall UnBCL::ArrayList<class CWIMBootData *>::Insert(int,class CWIMBootData *)",
        "moving folder failed",
        "7%7;7d7",
        "0$0(0@0D0\\0l0|0",
        "CDeploymentProject::CreateBootableMediaDeployment: Failed to enumerate partitions (0x%08x)",
        "PShxa",
        "7-858<8q8w8",
        "54585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5",
        "7'747=7[7i7y7",
        "IDREFS",
        "ERROR_LOG_CONTAINER_READ_FAILED",
        "DRVINST",
        "CSetupAutomation::Resurrect: Disk platform not available, cannot fix path to answer file if the drive letter has changed",
        "??0Object@UnBCL@@QAE@ABV01@@Z",
        "pFiltersValueEnumCallback",
        "iu-Cans",
        "\\Mounted Images",
        ".gfids",
        "= =$=(=,=4=<=@=H=L=P=T=X=\\=`=d=h=l=p=t=x=",
        "CUninstall::CUninstall: Failed to open online SYSTEM hive. Error: 0x%08x",
        "515<5K5c5|5",
        "FindMatchingDeviceInfoData: SetupDiGetDeviceInterfaceDetail failed. Error = 0x%X.",
        "sr-Cyrl-ME",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::MoveNext(void)",
        "1J1T1`1v1",
        "8&8,858K8Y8r8y8",
        "SL_E_TOKSTO_CANT_CREATE_FILE",
        "9]:d:j:o:z:",
        "SrClient.dll",
        "SP_ENV_FORCE_SKIP_FIRST_BOOT",
        "<0=j=",
        ";$;5;=;G;N;T;Y;d;p;",
        "ERROR_SIGNAL_PENDING",
        "%hs: Failed to enable CM_SERVICE_VIRTUAL_DISK_BOOT_LOAD on BootDriverFlags. Error: 0x%08X",
        "9J:l:",
        "RPC_S_PROFILE_NOT_ADDED",
        "ERROR_CRC",
        "=^>w>~>",
        "SetupAPI.Dll",
        "en-BZ",
        "3d3E4",
        "SetupAutoLoggerEnabled",
        "6)60666;6k6",
        "6#6.6:6F6R6",
        ";t$ uPh",
        "NMTOKEN",
        "Failed opening source software hive %ls",
        "? ?4?U?j?",
        "=(=E=L=R=W=b=o=t=",
        ".PAVCXXXXXHandledException@?5??SPGetAllPartitions@@YGJIPAPAV?$ArrayList@PAVCPartitionInfo@@@UnBCL@@@Z@",
        "4%4/4<4C4M4^4k4u4",
        ".?AVCXXXXXHandledException@?FB@??pSPDoOfflineApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0H0PAUISPMigProgress@@@Z@",
        "OC::COCDismAdapter::EnableDisableOCs: DismDisableFeature failed. hr = 0x%x",
        "Failed to set element data type BCDE_DEVICE_TYPE_RAMDISK_SDI_DEVICE. Status = %d",
        "%hs: System volume drive path is [%s]",
        ".?AU?$IEnumerable@PAVString@UnBCL@@@UnBCL@@",
        "2-2h2u2",
        "6\"646B6z6",
        "Cannot reset completion status for setup.exe",
        "6#6G6f6",
        "6!6-666?6H6Q6Z6c6l6u6",
        "VERBOSE: MOVETRACK: Folder symbolic link could not be removed. Error: 0x%08X",
        "WWPWWWW",
        "Driver.Properties",
        "(%lx): Failed to query reg value [%ws].",
        "4,444<4D4L4T4\\4d4l4t4|4",
        "SysprepSession::Execute: Dynamic Store for offline OS [%s] has already been added",
        "CryptCATCDFOpen",
        "0!040A0I0N0V0k0",
        "0B0Q0]0n0u0",
        "Started logging after platform release",
        "(0/050:0F0T0]0c0",
        "5&5-53585C5M5`5e5q5x5",
        "5#5*50555@5J5]5n5",
        "SSSh<",
        "9t$ t",
        "=*=1=7=<=G=T=h={=",
        "2 2/2k2x2",
        "Source directory %s falls under top-level directory %s; using secure sub-directory %s",
        "linked ",
        "__dllonexit",
        "8Xu9j",
        "6+686D6[6d6j6|6",
        "OOBEStartTime",
        "void __stdcall ApplyServicingSettings(const unsigned short *,const unsigned short *,const unsigned short *,const unsigned short *)",
        "JET_errCannotDeleteTempTable",
        "6$6*60666<6i6p6u6{6",
        "5&5:5C5R5m5w5",
        "<zf;D9",
        "Initiating rollback/uninstall, phase = %d",
        "ERROR_SMI_PRIMITIVE_INSTALLER_FAILED",
        "$(runtime.bootdrive)",
        "WimBoot apply failed because there is no wof driver!",
        "    Node or stop node was not found",
        "%hs: Failed to estimate size of applying the package; Error: 0x%08X",
        "ERROR_SERVICE_DEPENDENCY_DELETED",
        "5#6o6v6",
        "struct PartitionLayoutArgs *const &__thiscall UnBCL::ArrayList<struct PartitionLayoutArgs *>::get_Item(int) const",
        "ERROR_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER",
        "8'83898^8j8q8",
        "=\"=/=J=b=|=",
        "1&1,1@1N1q1",
        "SPDiagTrackSetUploadBasedOnEnvVar",
        "Failed to validate file path %ws.",
        "JET_errSecondaryIndexCorrupted",
        ">;?\\?q?y?",
        "8(8:8^8e8k8p8{8",
        "SL_E_PKEY_INVALID_UNIQUEID",
        "6J7Q7i7p7~7",
        "DiskLayout::GatherExistingPartitions",
        "MarkImage",
        "OC::COCDismAdapter::AddOCDependencies",
        "CSetupPlatformRollback::Initialize",
        ".giats",
        "\\SVW3",
        "DownlevelDefault",
        "SetNamedSecurityInfo failed! Error code = %#x",
        "3)30363;3F3M3a3k3",
        "9#9-9B9J9P9]9o9",
        ".?AU?$IEnumerator@PAVCSPInternalPluginData@@@UnBCL@@",
        "GetAclInfo failed",
        "RPWSh@",
        "VERBOSE: Converting: %s",
        "ERROR_PORT_NOT_SET",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@",
        "    Failed to allocate spFullPayloadPath.get()",
        "6n6t6",
        "7\"8D8K8W8o8",
        "  Operation (remaining): %s",
        "SppDeleteSnapshots reclaimed %dKB space.",
        "ERROR_OBJECT_NOT_FOUND",
        "SERIALIZEVERBOSE: Deserializing mount path type: %s",
        "Failed to apply privileges!",
        "%hs: Cannot open the UNC store from %s. Error: 0x%08X",
        "ERROR_ADDRESS_ALREADY_ASSOCIATED",
        "CCleanupSnapshot::DeleteSnapshot: %s %I64d space from other snapshots",
        ":,:>:L:p:",
        "= =$=(=,=4=8=<=@=D=H=L=P=T=\\=`=d=h=p=t=x=|=",
        "3'4k5",
        "void __thiscall UnBCL::Array<class CDUPackage *>::RemoveAt(int)",
        "0D0N0U0[0`0k0w0|0",
        "Setup Platform",
        "SL_E_TOKSTO_NOT_INITIALIZED",
        "{317ECE54-B257-4536-94EE-D5D4B0D70EBB}",
        ".?AV?$SerializableBase@VCNGenCleanup@@$0A@V?$DefaultInstanceFactory@VCNGenCleanup@@@UnBCL@@@UnBCL@@",
        "CPrepareSafeOSBootRemoval::DoExecute",
        "int __thiscall UnBCL::ArrayList<struct SetupPlatform::IDisk *>::IndexOf(struct SetupPlatform::IDisk *,int,int) const",
        "CAddSetupClRequest::DoExecute: Failed to pend merge SetupCL request to offline OS %s. Error: 0x%08X",
        "<!<,<1<E<]<",
        "8(959M9x9",
        "Failed to read partition properties",
        "No existing diagnostics data",
        "DUDownloadPackageSize",
        "nSetupDUUpdateFiles",
        "243F3N3T3a3s3",
        "1/1e1p1",
        "GDRDURevisionNumber",
        "Windows\\Inf",
        "ERROR_NOT_SAME_DEVICE",
        "=D=^=j=p=",
        "SKYDRIVETEMP",
        "888@8H8X8|8",
        "SPGetMemoryLoad",
        "2#2*21272C2U2c2q2",
        "ERROR_DS_CANT_MOVE_RESOURCE_GROUP",
        "3\"353=3Q3Y3b3o3}3",
        "%s does not exist, attempting to copy it from the current OS",
        "class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::get_Item(int)",
        "ITaskFolder::RegisterTaskDefinition failed. hr = 0x%x",
        "JET_errContainerNotEmpty",
        "?)?<?E?M?Z?q?x?",
        "< =,=5=A=M=Y=b=n={=",
        "6&6+656X6",
        "3\"363A3M3T3Z3_3j3q3",
        "S-1-5-18",
        "CBS_E_SAFEMODE_ENTERED",
        "SPIsProvisioningPackageSplit: Failed to get WIM attributes for %s. Error: 0x%08X",
        "%hs: Listening thread was cancelled. Exiting.",
        ":*:>:R:_:o:v:|:",
        ".PAVCXXXXXHandledException@?2??BuildFoDList@CFODValidator@@IAEJPAUIExecutionContext@@PAV?$ArrayList@PAVString@UnBCL@@@UnBCL@@@Z@",
        "9 979R9b9y9",
        ":+;P;~;",
        ".?AV?$SerializableBase@VCMountWIM@@$0A@V?$DefaultInstanceFactory@VCMountWIM@@@UnBCL@@@UnBCL@@",
        "%hs: Failed to initialize the CBS session. hr = 0x%08X",
        "Contexts",
        "ERROR_INSTALL_UI_FAILURE",
        ";;;f;",
        "Failed to open file attributes. Status: %x",
        "PWhhg",
        "%hs: New number of entries: %d.",
        "ERROR_MESSAGE_SYNC_ONLY",
        "ERROR_PARTITION_FAILURE",
        "Skipped OS volume because protection is not active",
        ".PAVCXXXXXTemp@?FO@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "RestoreDirTree: WimImageCreateFile failed",
        "2 3?3b3",
        "ERROR_DS_DRA_REPL_PENDING",
        "2O2d2v2~2",
        ":7:V:",
        "SP_ENV_FAIL_VALIDATOR_ARP",
        "DUDownloadPackageSizeOnDisk",
        "CMutexT<class CEmptyType>::Lock",
        "ERROR_PLUGPLAY_QUERY_VETOED",
        "<$<,<3<:<`<s<",
        ".?AU?$IList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$ArrayList@PAVCDriverDetails@@@2@@UnBCL@@@UnBCL@@",
        "9.:C:i:~:",
        "=!=&=1=<=P=U=}=",
        "Final list of destination OS pieces:",
        "ERROR_DS_CANT_FIND_NC_IN_CACHE",
        "HKEY_LOCAL_MACHINE\\SAM",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@PAVString@UnBCL@@_K@UnBCL@@@UnBCL@@",
        "\\??\\%c:",
        "SysprepSession::ExecuteInternal: Found non-offline-capable action to run offline; will need to run it online",
        "9/949@9S9i9u9|9",
        "SVhp?",
        "6/6@6G6s6z6",
        "Download Critical SafeOS Dynamic Updates",
        "Partition [%ws] not found.",
        "=@=R=a=q=~=",
        "??_DVersion@UnBCL@@QAEXXZ",
        "class UnBCL::ArrayList<class CShellFolderInfo *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class CShellFolderInfo *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "5 5)5L5",
        "5#5+515>5P5^5p5",
        "    Failed to verify index attribute",
        "USER32.dll",
        "848:8D8I8S8Z8h8z8",
        "Vh8Sb",
        "3\"4.4@4^4j4|4",
        "=\"=(=-=8=C=P=h=n=",
        "2+2N2[2g2t2",
        "QSVWj",
        "ERROR_IPSEC_IKE_QM_ACQUIRE_DROP",
        ".sppkg",
        "Unable to retrieve Primitive INF family information (Err = 0x%lx), skipping package.",
        "pGetExistingPageFiles: Failed to get online windows directory: 0x%08x",
        "SclGetDiskLayout",
        ":':.:R:",
        "SPQuerySnapshotSize: Failed to convert ID to VSS_ID. Error: 0x%08X",
        ".PAVCXXXXXHandledException@?CG@??RestageWindows@CReconstructOS@@IAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "CManifestCategory::CreateInstance",
        "Move was successful, resetting the rollback dir to %s",
        "SetupPlatform: Read recovery image folder %s",
        "t htm",
        "1#1.151I1b1r1",
        "?C?u?",
        "ERROR_DS_NO_SERVER_OBJECT",
        "272G2^2w2",
        "RegValueProcessCount",
        "ERROR_IPSEC_TUNNEL_FILTER_EXISTS",
        "?:?{?",
        "141@1P1a1z1",
        "xmlns:na=\"%s\"",
        "Will revert execution for %d, as it needed to be executed after the current operation",
        ";=;J;P;~;",
        ";6;B;Q;X;^;c;n;t;y;",
        "99x8t",
        "Starting LCN is expected to be 0 but it is %llu",
        "ERROR_DS_NAME_TOO_LONG",
        ".?AVCTelemetryActivity@@",
        "=3=:=|=",
        ";';8;E;Q;\\;s;",
        ";4;9;u;",
        "1&151=1C1X1`1g1m1r1}1",
        "Initialization failed. hr = %x0x",
        "7(7/757:7E7S7[7a7u7",
        "FileTimeToSystemTime",
        "ERROR_TRANSACTION_RECORD_TOO_LONG",
        "?$?,?8?\\?d?l?t?|?",
        "1'2,252",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@PAUIOperationsProgress@SetupPlatform@@K@UnBCL@@@_@UnBCL@@",
        "tcShh8",
        "StackInfo",
        ".?AV?$HTEnumerator@GHUTableKey@?$Hashtable@GH@UnBCL@@HUKeyTraits@23@$1?RetrieveValue@23@KGHPBV?$CAtlMap@UTableKey@?$Hashtable@GH@UnBCL@@HUKeyTraits@23@V?$CElementTraits@H@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "2%2+202;2B2V2g2",
        "int __stdcall UnBCL::MP::ThrowCompare<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::Compare(struct SPGetPartitionOrdinal::PartitionInfo,struct SPGetPartitionOrdinal::PartitionInfo)",
        "?%?,?;?I?P?W?b?t?",
        "y!Vh1",
        "GetDriveTypeW",
        "2$222@2}2",
        "9)90969;9F9Q9W9\\9v9",
        "0%0@0J0X0",
        "?8?M?`?h?n?{?",
        "void __thiscall UnBCL::ArrayList<struct _GUID>::Insert(int,struct _GUID)",
        "smj-NO",
        ")deleteFile",
        "GetDeviceCaps",
        "L$8;U",
        "Tag ID: %d",
        "CRtlCompressionT<class CEmptyType>::Compress",
        ".?AVCSavePageFileSettings@@",
        "int __stdcall UnBCL::MP::OperatorCompare<enum OP_OPERATION_ID>::Compare(enum OP_OPERATION_ID,enum OP_OPERATION_ID)",
        "SPExecuteCleanup: Failure while enumerating folder %s. Error: 0x%08X",
        "8(888<8T8X8p8",
        "Failed enabling backup and restore privileges for the process hosting CBS core.",
        "5 5/5<5C5",
        ",0;0H0W0i0n0",
        "0'0>0F0L0w0~0",
        "8#8.8B8I8S8[8b8h8m8y8",
        "%hs: WinReSetupRestoreWinREEx succedded.",
        "PQQQQQQ",
        "{1F7184F1-E091-4D76-BEEC-2294DC3E3058}",
        "%hs: The new boot entry will be set as a one-time boot sequence",
        ">,>0>@>D>T>X>h>l>|>",
        "6#6G6m6",
        "9$9,949@9d9l9t9|9",
        "!~<9~@t",
        "%c:\\%s\\%s",
        "WIMApplyImageInternal",
        ":\":3:>:L:x:",
        "System\\Setup",
        "1 1$1,14181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1x1|1",
        "?5?G?O?U?b?t?",
        "Referencing object: %s.",
        "5*676J6c6j6q6w6",
        "__thiscall OSRollbackService::CCheckpointImpressario::CCheckpointImpressario(const unsigned short *,class OSRollbackService::CCheckpointSequence *,int)",
        ".PAVCXXXXXHandledException@?M@??GetClientDUPackages@CSetupPlatform@@UAEJPAXPAUIDUDownloadProgress@SetupPlatform@@PAPAUIDUPackageCollection@4@PAH@Z@",
        "CNewSystem::QueueInstallDynamicUpdates: Failed to find any dynamic updates for installation in %s; hr = 0x%x",
        "8;8E8Q8]8j8z8",
        "9\"9;9T9[9b9h9t9",
        "void __thiscall UnBCL::ArrayList<class CDUPackage *>::set_Item(int,class CDUPackage *)",
        "ERROR_LOG_METADATA_INVALID",
        "2C3Q3a3h3r3",
        "CreateCustomPartitions: Failed to create custom partition %s",
        "Retrieved",
        ".?AV?$Array@PAVCOperationResult@@@UnBCL@@",
        ">$>/>6>;>h>y>",
        ";H<|<",
        "void __thiscall UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *>::set_Item(int,class CSimpleCleanup::CCleanupEntry *)",
        "<Q<u<",
        "=)=.=:=B=t=",
        "%hs: Failed to set the old OS as recovery sequence for SafeOS. Status = 0x%08X",
        "5&595M5[5b5n5u5{5",
        "WorkDirectory",
        "9#9G9k9}9",
        "JET_wrnSkipThisRecord",
        "6-656;6H6Z6h6",
        "CReconstructOS::RestoreInstallationLanguageSettings: Seeding intl configuration using install language",
        "SysprepSession::CreateSession",
        "%d.OriginalPath",
        "Pj2jl",
        "4'454C4",
        "627m7t7",
        "3$4W4^4n4",
        "?.?<?W?v?",
        "IsHost",
        "\\REGISTRY\\MACHINE\\SECURITY",
        "3*3=3",
        "9$9,949<9D9L9X9|9",
        "es-CR",
        "Could not start service %s. Error: 0x%08X",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,struct UnBCL::ISerializable *>,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,struct UnBCL::ISerializable *> __stdcall UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,class ATL::CElementTraits<struct UnBCL::ISerializable *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *> *,class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,struct UnBCL::ISerializable *> > *,int)",
        "9 919>9G9\\9d9k9",
        "8!8j8",
        "6L7Y7",
        "Unloading hive at %s\\%s",
        "At least one system language is required.",
        "u(jXh",
        "7.8G8",
        ".?AV?$SerializableBase@VCCompressWIMBootFiles@@$0A@V?$DefaultInstanceFactory@VCCompressWIMBootFiles@@@UnBCL@@@UnBCL@@",
        ";\";(;3;A;m;};",
        "sr-Latn-RS",
        "<$=.=W=_=}=",
        "CDownloadDUUpdates::DoExecuteInternal: Failed to search for updates. hr = 0x%x",
        "4#5;5H5`5k5y5",
        "%hs: Failed to mount WIM file %s. Error 0x%08X",
        "T$@j[P",
        ".?AU?$IEnumerator@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@",
        "LogVdsStatus: Failed to query the configuration of VDS: 0x%08x",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::Resize(int,int)",
        "CFG Validator: Nodes are not supported: [%s].",
        "int __thiscall UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::LastIndexOf(struct SPGetPartitionOrdinal::PartitionInfo,int,int) const",
        "0(0=0M0T0Z0_0j0w0",
        ".?AVCXXXXXHandledException@?MG@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "7&747>7C7X7_7m7x7~7",
        "4!484c4",
        ".?AVCSetupPlatformTracing@@",
        "=#=*=1=8=?=F=L=W=y=",
        ":\":(:-:8:B:V:`:",
        "WINDOWS/PRODUCTTYPE",
        "ioctl: setting reparse point tag failed",
        "838:8?8I8O8_8d8|8",
        "3!3(3D3R3j3",
        "ProfilesDirectory",
        "CRelocateWinReImage::DoExecute: WinReReinstall failed. Error: 0x%08X",
        "9$9-9<9D9I9Y9a9i9v9~9",
        "Unknown package type for progress bar",
        ".?AV?$ArrayListEnumerator@PAVCDrvStoreProperty@@@_@UnBCL@@",
        "ERROR_DIR_NOT_EMPTY",
        "ERROR_SPL_NO_STARTDOC",
        "?get_Buffer@MultiSz@UnBCL@@QBEPBGXZ",
        "242W2",
        "<\"<*<0<D<M<g<o<u<z<",
        "304U4",
        "Failed to write scratch directory information to file: %s. Error = %d",
        "7#7)7<7",
        "?.?=?L?[?j?y?",
        "DiskLayout::VerifyPlanInOrder",
        ";Z;a;",
        "pSPExcludePath",
        "9':L:Z:",
        "VdsPlatformDiskEnumerator::GetNext: Failed to get disk number for VDisk %s (0x%08x)",
        "DiskLayout::ApplyLayout: Failed to apply partition creation %u to disk layout (0x%08x)",
        "ERROR_POLICY_OBJECT_NOT_FOUND",
        ".PAVCXXXXXHandledException@?2??pReadPageFileSettingsAndWriteToConfigFile@@YGJPAVString@UnBCL@@0@Z@",
        "0&060C0U0e0n0",
        "<#<(<<<D<K<Y<_<d<x<",
        "SPQuerySnapshotSize: Failed to initialize COM. Error: 0x%08X",
        ";%;7;E;S;a;o;};",
        ":&;b;r<",
        "OCStatus.cmp",
        "void __thiscall UnBCL::Array<struct DiskMatchFilter>::Remove(struct DiskMatchFilter)",
        "0$0,080X0`0p0",
        "na:GeneratedFileOverheadSectors",
        "dbootstat.dat",
        "=/=5=B=b=j=",
        "void __thiscall UnBCL::Array<class CDeviceIdDatabase::CDeviceInfoData *>::Insert(int,class CDeviceIdDatabase::CDeviceInfoData *)",
        "4&5A5H5N5S5^5e5q5x5~5",
        "System32\\config\\SYSTEM",
        "80868M8S8",
        "? ?0?4?D?H?X?\\?l?p?",
        "8-8^8|8",
        ">&>,>1>@>K>P>b>l>q>",
        "1!121G1R1s1",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@KUTableKey@?$Hashtable@PAVString@UnBCL@@K@2@V?$DictionaryEntry@PAVString@UnBCL@@K@2@UKeyTraits@42@$1?RetrieveEntry@42@KG?AV52@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@K@UnBCL@@KUKeyTraits@23@V?$CElementTraits@K@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "_DismRemoveOSUninstall",
        "2/2J2]2d2j2o2z2",
        ">->5>O>V>\\>a>l>{>",
        "> >&>1>W>c>o>",
        "GatherDeviceIDsInDriverPackage:Successfully gathered device ID's from [%s]",
        "ERROR_DS_VERSION_CHECK_FAILURE",
        "CBS_E_EMPTY_PACKAGE_MAPPING_INDEX",
        "SPGetRecoveryImagePath",
        ";(;2;H;V;_;h;q;z;",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::Resize(int,int)",
        "2 3K3P3Z3z3",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *> *)",
        ".?AVWmi@WMI@@",
        "RPC_S_CANT_CREATE_ENDPOINT",
        "St%QP",
        "??1MutableString@UnBCL@@UAE@XZ",
        "6#737s7",
        "m.wim",
        "%hs: Current entry GUID: %s",
        ":!:+:F:L:^:o:|:",
        "Rollback-Online-System completed successfully.",
        ":/:5:L:R:a:",
        "PSSSS",
        ".PAVCXXXXXHandledException@?HK@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "8;8H8N8]8q8",
        "void __thiscall UnBCL::ArrayList<unsigned char>::set_Item(int,unsigned char)",
        "===p=",
        ".?AU?$IEnumerable@PAVCDeviceInfoData@CDeviceIdDatabase@@@UnBCL@@",
        "1'1T1]1f1o1x1",
        "Number of registry values updated",
        "SL_E_EUL_CONSUMPTION_FAILED",
        "> >(>P>X>`>t>|>",
        "RestoreRefNode",
        "CReconstructOS::SaveTelemetryFields: Failed to open RecoveryEnvironment key: [0x%08x]",
        "SetupDiEnumDeviceInterfaces",
        ".PAVCXXXXXTemp@?3??BuildFoDList@CFODValidator@@IAEJPAUIExecutionContext@@PAV?$ArrayList@PAVString@UnBCL@@@UnBCL@@@Z@",
        ".?AVCReconstructOS@@",
        "DiskLayout::FindTarget: Unhandled DiskMatch property type %u",
        "AllowDiskPartitionChanges",
        "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3p3",
        "<.<3<?<^<",
        ".?AVCXXXXXHandledException@?GO@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "828J8^8f8r8",
        "SysprepSession::ExecuteAction: Offline sysprepModule requested reboot",
        "DismInitialize hr = 0x%x",
        "9(:<:a:",
        "%hs: Failed to set proxy blanket for the CBS session. Error: 0x%08X",
        "0=0l0~0",
        "Successfully read uninstallwindow from Onesetting: %d",
        "ProgramFiles(x86)",
        "9X8ur",
        ":$:,:4:<:D:L:T:\\:d:t:",
        "= =3=@=G=N=Y=c=v=",
        "Failed to get NTFS allocation bitmap. Fall back to do a raw copy",
        "QueueAddCbsPackage called with 0 paths, skip.",
        "ERROR_CALLBACK_POP_STACK",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::Insert(int,class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *)",
        "9 919I9S9v9",
        "<:<F<O<y<",
        "4!4(434>4C4W4i4",
        "?$?j?p?",
        "State",
        ".?AUISetupOneSettings@@",
        "wpeutil.dll",
        "S(_^[",
        "1'1.14191D1K1^1r1y1",
        "SetupPlatform: Executing Sync commands: Failure while executing commands.",
        "ERROR_DS_ATT_SCHEMA_REQ_ID",
        "ERROR_TRANSACTION_NO_SUPERIOR",
        "9\"9+979C9H9Q9]9i9n9w9",
        "7 7(7,747<7D7H7L7T7X7`7h7l7t7|7",
        "MIGPERFTRACK: Migration total: %.1f",
        ";%<,<Y<`<",
        ":):M:_:u:",
        ":<;x;",
        "7\"7T7\\7f7w7",
        "2N2U2[2`2k2v2{2",
        ";$;0;P;`;",
        "ERROR_BAD_SERVICE_ENTRYPOINT",
        "<)<0<6<<<G<Q<d<~<",
        "JET_errRecordPrimaryChanged",
        "SysprepSession::ExecuteAction: Failed during deleteKey operation; dwRet = 0x%x",
        ".?AV?$DefaultInstanceFactory@VCAddAppxPackage@@@UnBCL@@",
        "Process Drivers for Migration",
        "VdsPartition::RefreshVdsProperties: Couldn't query disk partitions (0x%08x)",
        ">(>=>E>K>X>j>",
        "9!:C:Z:",
        "t49C8u",
        ":(:5:=:G:N:T:Y:a:l:",
        "444`4v4",
        "Attempting to remove kernel file operations journal: %s",
        "<\"<'<2<=<Q<",
        "0,030N0Z0j0o0",
        ".?AU?$ICollection@PAVCBasicEnvEntry@@@UnBCL@@",
        "ARP Validator: Installed applications dissapeared, will invalidate data gather operation",
        "CMigrateFramework::DoExecute: Getting pended setupcl request failed. Status = 0x%08X",
        "%hs: CreateProcess(%s) failed (error %u)",
        "<F<^<j<|<",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::Reset(void)",
        "949P9p9",
        "{AA643D19-98BB-42E1-9B26-8BBD7BB87CDA}",
        "<'=4=U=b=x=",
        "ERROR_INVALID_EDIT_HEIGHT",
        ">!>F>S>]>d>j>o>z>",
        "9$:,:4:H:P:X:h:t:",
        "XInstallationType",
        "%hs: User %s%s%s%s from the new system does not have an equivalent on the old OS. Will not be restored.SPDoUninstallApply",
        "u2hI8",
        "3[4a4n4|4",
        "Attempting to remove rollback file operations journal: %s",
        "?U?i?v?",
        "VdsPartition::GetProperties: Couldn't get volume object for partition (0x%08x)",
        "E_NOTIMPL",
        "7$7,747<7D7P7t7|7",
        ".PAVCXXXXXTemp@?CE@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "3$3,383X3`3h3t3",
        "ERROR_IPSEC_IKE_INVALID_HASH",
        "    Failed to get key value",
        "0,040:0F0S0]0d0n0{0",
        "File %s is not available",
        "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4",
        "Did not find any driver packages in %s",
        "Failed to untag [%s] for Storage Reserve. Error: 0x%08X",
        "(%lx): Failed to open subkey '%ws'",
        "3:3T3f3",
        "SkipMigrateRootACL",
        "8 8T8m8t8{8",
        ".?AVCCFGSectionFile@@",
        "d%c:\\",
        "Registry Key [%s] not found. Error: 0x%08X",
        ".?AVCXXXXXHandledException@?CI@??DoExecute@CUnmountWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "%hs: Cannot create WIM file. Error: 0x%x",
        "sRetryOperation",
        "1%191G1U1c1",
        ")SPExecuteOOBEBootApplyFromICB",
        "=L>u>",
        ".?AU?$IList@UDiskRange@@@UnBCL@@",
        "? ?*?1?7?<?G?\\?p?",
        "NetLogs",
        "919Z9h9",
        "909=9E9V9c9k9|9",
        "7)7>7H7O7f7m7s7x7",
        "SPAPI_E_DI_NOFILECOPY",
        "SL_E_SPC_NOT_AVAILABLE",
        "2Q2f2m2s2x2",
        "CBS_E_NOT_INITIALIZED",
        "ERROR_PIPE_LISTENING",
        "DiskLayout::FindTarget: Failed to look up disk match property %s: 0x%08x",
        ".PAVCXXXXXHandledException@?5??Execute@DiskLayout@@QAEJPAX@Z@",
        ".?AV?$SmartPtr@U?$ICollection@PAUHKEY__@@@UnBCL@@@UnBCL@@",
        "Stage package: %S",
        ".PAVCXXXXXTemp@?7??SPExecuteFirstBootCompletion@@YGJPAVString@UnBCL@@@Z@",
        "%systemdrive%",
        ":-:2:8:>:D:J:P:V:\\:b:h:n:t:z:",
        "SVWPj",
        "u6hHu",
        "Create Finalize snapshot",
        "xmlns",
        ".PAVCXXXXXHandledException@?2??Initialize@CCFGSectionFile@@UAEJXZ@",
        "?0?=?D?J?O?Z?g?o?u?",
        "NtDeleteBootEntry",
        ">Z>a>~>",
        "SmDisk::InitializeProperties: Couldn't refresh disk object (0x%08x)",
        "JET_errFileIORetry",
        "INSTALL.WIM",
        "MountedDevices",
        ".PAVCXXXXXTemp@?IA@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "CDiskReader::GetNtfsVolumeBitmap",
        "<SVWQ",
        "The input CCFGSectionValue pointer of [%s] cannot be dynamic cast to CCFGSectionFile*",
        "\\system32\\winpeshl.exe",
        "=A=f=u=",
        ";;<I<V<k<r<",
        "=\"=,=6=D=J=P=U=_=i=s=}=",
        "8*9?9Q9Y9_9s9y9",
        "%hs: Cannot open the software key for the online OS. Error: 0x%08X",
        "CSetDefaultBootEntry: Failed to read boot entry GUID from %s. Error = %d",
        "2#20292E2L2R2W2c2m2",
        "{SSSP",
        "SPHexDecode",
        "%hs: Current boot entry does not exist.",
        "const struct SPGetPartitionOrdinal::PartitionInfo &__thiscall UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::get_Item(int) const",
        "long __thiscall OC::COnlineOCManager::RestoreOCStatus(class OC::COCCollection *)",
        "Main apply (Machine Independent)",
        ";$<2<P<W<]<b<m<w<",
        ":&:A:_:k:",
        "ERROR_BAD_INHERITANCE_ACL",
        "Unable to get procedure InitializeCSI_REPAIRED_COMPONENT",
        ">D>W>i>{>",
        "SspiCli.dll",
        "Failed to copy file name. hr = 0X%x",
        "uXj?Xf;G",
        "0,040<0L0X0`0",
        "ERROR_INSTALL_LANGUAGE_UNSUPPORTED",
        "CSetupAutomation::GetDiskInfo: Failed to enumerate disks: 0x%08x",
        "6%636A6O6r6",
        "9':::N:h:o:v:",
        "Copy external drivers payload from %s to %s",
        "8 :`;",
        "{35AFA17A-35C9-4BEA-9CC5-BD0C00CF5241}",
        "2&2/2C2O2V2e2y2",
        "CEnableSerialDebugging::SetDebuggerTypeSpecificSettings",
        "VdsPartition::SetGptAttributes: Couldn't get disk object (0x%08x)",
        ":N:Z:e:s:",
        "Sources\\SetupPlatform.ini",
        "t1VPQ",
        "Executing uninstall apply",
        ".?AVCEnableUsbDebugging@@",
        "8c27cdba-6a1c-455e-af20-46b7771bbb96",
        "Fonts",
        ".?AV?$SerializableArrayListBase@PAVCImageInfo@@@_@UnBCL@@",
        "3-343:3?3K3S3c3n3}3",
        "=$=(=0=4=<=@=H=L=T=X=`=d=l=p=x=|=",
        "Hardlink [%s] to [%s]",
        "mn-Mong-CN",
        "3)3K3`3n3|3",
        "ERROR_EXPIRED_HANDLE",
        ".?AUIElement@@",
        "D$T9D$Pt",
        "long __stdcall SPCopyFolder(class UnBCL::String *,class UnBCL::String *,unsigned long (__stdcall *)(union _LARGE_INTEGER,union _LARGE_INTEGER,union _LARGE_INTEGER,union _LARGE_INTEGER,unsigned long,unsigned long,void *,void *,void *),void *,void *,int,int,int,int)",
        "6$6*676I6W6z6",
        "windows",
        "OC::COCDismAdapter::AddOCDependencies: DismGetFeatureParent failed. hr = 0x%x",
        "5 585<5T5X5p5t5",
        "DriverStoreEnumRelatedDriversW",
        "void __thiscall UnBCL::Array<class SysprepAction *>::Remove(class SysprepAction *)",
        "7%747n7u7",
        "Failed to backup the WIMBoot WIM files and/or recovery image partition. Error: 0x%08X",
        "=$=3=:=O=V=i=p=",
        "Failed to get package version: %S",
        "Not enough information found to add this service",
        ":\":S:",
        "CStartSuspendedServices::DoExecute",
        " /start Narrator",
        "select * from MSFT_Disk",
        "6'6B6v6}6",
        "Could not restore OC status. Error: 0x%08X",
        "{54F788A3-2C73-44FF-9D64-5782EC0FB5CA}",
        "void __thiscall UnBCL::Array<class CRegCreationData *>::InitLarva(class UnBCL::ArrayList<class CRegCreationData *> *)",
        "8?8P8Y8b8w8~8",
        "5(565D5R5`5",
        "CSetupPlatformCheckpoint::CopyLogFiles: An error occurred while processing the event log folder",
        ".?AV?$Array@PAVCOSPieceInfo@@@UnBCL@@",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::RemoveAt(int)",
        ";*;2;8;E;W;s;",
        ">$>0>P>X>h>p>",
        "Out of disk space while executing operations.",
        "%hs: Recovery image path is not on a recovery partition.",
        "7F7]7r7",
        "F*Pht",
        "Plugin:%s - Error:%d - Phase:%s",
        "ERROR_INDIGENOUS_TYPE",
        "??0String@UnBCL@@QAE@ABV01@@Z",
        "050<0C0I0U0i0w0",
        "Registry creation failed with error 0x%08X. Ignoring error as per request.",
        "VolumePathName for %ws is %ws",
        "9{:J<",
        "<+<P<\\<e<o<t<",
        ">(>L>T>\\>d>l>t>|>",
        "=1=7=D=V=d=|=",
        "2'2D2u2",
        ".OperationSortSucceeded",
        "5+5F5R5^5j5v5",
        "VWRQSU",
        "2.2>2Q2]2h2r2y2",
        "void __thiscall UnBCL::Array<class CGlobalPathFindData *>::InitLarva(class UnBCL::ArrayList<class CGlobalPathFindData *> *)",
        "Operation execution failed: %u. hr = 0x%X",
        "UPGOsPath",
        "Language%d",
        ";!;';,;7;H;_;i;",
        "8#818?8M8",
        "1)1=1M1]1c1s1~1",
        "9&909:9D9e9s9}9",
        "f;D$4u",
        "{D3FB2D5F-248A-440F-9D17-A3E93184DBFA}",
        "TranslateMessage",
        "mk-MK",
        "7$7,747<7D7L7T7\\7h7",
        "ERROR_CLUSTER_NETINTERFACE_EXISTS",
        "WimImageEnqueueOperation",
        "\\RemInst",
        "SysprepSession::CreateSession: Ran out of memory while creating SysprepSession",
        "ERROR_THREAD_MODE_ALREADY_BACKGROUND",
        "2.282?2E2J2V2g2{2",
        "ActionPlatform::DeleteValue: Invalid registry key path %s passed",
        "    Failed to reset handles",
        "4*4D4K4Q4V4a4s4{4",
        "QVjAj",
        "ERROR_SET_POWER_STATE_FAILED",
        "RPC_S_OUT_OF_RESOURCES",
        ".CRT$XLA",
        "WVh\\9",
        ";D$(u",
        "ChkDskErrorCode",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::Insert(int,class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *)",
        "RestoreFileMetadata: RestoreFileInfo failed",
        "Move source WIM file to the scratch space",
        "Use creation time as Install time for snapshot [%s]",
        "<$<<<D<\\<d<l<",
        "?2?s?",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0",
        "void __thiscall UnBCL::ArrayList<class CDrvStoreProperty *>::RemoveAt(int)",
        "PSFX_E_REVERSE_AND_FORWARD_DELTAS_MISSING",
        "CMigrateFramework: Apply framework failed. Status: %d",
        "VdsDisk::GetProperties: Failed to get disk properties (0x%08x)",
        "ERROR_RECEIVE_PARTIAL",
        "mountpaths.dat",
        "8 8$8(8,848X8`8d8h8l8t8x8|8",
        "%SYSTEMDRIVE%",
        ".?AV?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "0.0Z0v0",
        "mi-NZ",
        "%hs: Failed to open new OS DISM session. Error: 0x%08X",
        "ERROR_DS_NO_RDN_DEFINED_IN_SCHEMA",
        "ERROR_DS_EXISTS_IN_POSS_SUP",
        "ERROR_DS_WKO_CONTAINER_CANNOT_BE_SPECIAL",
        "CDownloadDUUpdates::DoExecuteInternal: Required update unpack capability is not present; this scenario is not supported",
        "2%2_2~2",
        "SetupPlatform::GetSetupPlatformVersion",
        "void __thiscall UnBCL::ArrayList<struct DISK_SPACE_IMPACT>::Insert(int,struct DISK_SPACE_IMPACT)",
        "DiskLayout::ExecDeletions: Failed to delete partition %u: 0x%08x",
        "{B07EA1D3-3B91-4945-93F3-9D62CEA16829}",
        "ERROR_CLUSTER_SHUTTING_DOWN",
        "CNewSystem::QueueSetupAutomation: Failed to queue data migration (0x%08X)",
        "304R4g4",
        "SysprepSession::Execute: Add dynamic Store for offline OS [%s]",
        "PWVhL",
        "9(9=9E9K9X9j9}9",
        "lo-LA",
        "JET_wrnCallbackNotRegistered",
        "void __thiscall UnBCL::ArrayList<class SysprepComponent *>::AddRange(const struct UnBCL::ICollection<class SysprepComponent *> *)",
        "1#1J1g1}1",
        "class CDUPackage *const *__thiscall UnBCL::ArrayList<class CDUPackage *>::GetBuffer(int) const",
        "VdsDisk::Initialize: Failed to enumerate automatically-created partitions: 0x%08x",
        ".PAVCXXXXXHandledException@?2??DoExecute@CUpdateBootSector@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "ITaskFolder::GetTasks failed. hr = 0x%x",
        "5$6:6L6Y6",
        "LogRestore.TXT",
        ".?AU?$ICollection@PAV?$CAutoRelease@PAUIDUUpdateCollection@DU@@@Mig@@@UnBCL@@",
        "ValidateInput: Please provide a valid ByteAlignment, should be power of 2",
        "D$ hp",
        "151S1b1",
        "CUninstall::RemoveUninstall",
        "%hs: No driver found to migrate",
        "SP_ENV_VERBOSE_LOGGING",
        "4&434I4V4[4d4k4x4",
        ";:;c;j;p;u;",
        "1!1)1.1>1J1T1z1",
        "8+898G8",
        "6&7<7W7v7}7",
        "ERROR_INSUFFICIENT_RESOURCE_FOR_SPECIFIED_SHARED_SECTION_SIZE",
        "2J2t2",
        "3 3.3d3",
        ">\">?>F>s>",
        "\\EFI\\Microsoft\\Boot\\",
        "1\"2t2~2",
        "Failed to enumerate boot entries. Status: %x",
        ".?AVCXXXXXHandledException@?FI@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "L$D_^[3",
        "6$6,646<6D6L6T6\\6d6p6x6",
        "2\"242P2]2e2v2",
        "class UnBCL::DictionaryEntry<unsigned short,unsigned short> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::GetBuffer(int)",
        "ERROR_DS_OBJ_TOO_LARGE",
        "2F2k2",
        "CERT_E_WRONG_USAGE",
        "5<5\\5|5",
        "Failed to append wildcard to search pattern.",
        ";,;J;S;l;",
        "1/181]1r1y1",
        ";4;A;V;c;};",
        "2'252o2",
        "2$2.282K2a2|2",
        "ZwReleaseMutant",
        "%s: Exception while requesting registry navigator",
        "1 1$14181H1L1\\1`1p1t1",
        ";!;,;:;N;l;",
        "ERROR_DS_SRC_DC_MUST_BE_SP4_OR_GREATER",
        "{DC37F45E-8EC5-4134-87E6-DC836BB29CC0}",
        "Initial decision for external package (WinPE): %s",
        "%hs: Failed to save the current boot entry",
        "SmPlatformDiskEnumerator::ConstructVirtualDisk: Can't find matching MSFT_VirtualDisk (0x%08x)",
        "0 0I0b0",
        "pFindAndAddFiles: FindFirstFile failed when called with %s; Error: 0x%08X",
        "ERROR_EVT_QUERY_RESULT_STALE",
        "030H0P0V0c0u0",
        "Tracing: kernel mode enable flags: 0x%x, mode: 0x%x",
        "6;6c6",
        "Failed allocating string",
        "ARP Validator: Validator failed. Status: %d",
        "?DeleteNE@Directory@UnBCL@@SGHPBVString@2@H@Z",
        "CDeploymentProject::EnableAuditMode: Automatic shutdown is enabled, cannot also queue audit mode.",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *> *)",
        ".?AV?$ArrayListEnumerator@PAVCFilterDriverInfo@@@_@UnBCL@@",
        "WWWSW",
        ">->4>;>B>I>P>V>`>",
        "9%949=9C9P9V9[9}9",
        "CSetupAutomation::GetDiskInfo: Failed to iterate over partitions: 0x%08x",
        "SPGetWinReImagePath",
        "000X0",
        "?!?K?R?X?]?h?s?",
        ";O,w*",
        "=-=6=",
        "Disk error",
        "1g1u1",
        "Failed to save shutdown requirement to rollback config file. Error = %d",
        "616B6I6O6T6_6f6z6",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,class ATL::CElementTraits<class CDriverInstallInfo *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "7#737N7S7",
        "ReplacementManifests",
        "<2<><G<P<l<",
        "ERROR_VIRUS_INFECTED",
        "void __thiscall UnBCL::ArrayList<class CGlobalPath *>::set_Item(int,class CGlobalPath *)",
        "Uninstall validation failed with error: 0x%08X",
        "<@<F<O<Z<",
        "szAppend",
        "565A5H5N5S5^5l5",
        "2\"232:2@2E2P2Z2w2",
        "<&</<<<G<S<e<",
        "SysprepSession::ExecuteAction: stopService stopDependentService invalid.",
        "_DismAddDriverEx",
        "Sjtj\"",
        "3'3=3C3_3p3",
        "1'141@1L1X1d1p1",
        "< <4<<<D<L<T<`<",
        ">->J>V>f>",
        "yKVh_",
        "SmPartition::SetType: SetType() cannot create extended/logical partitions",
        "Suspend bitlocker if needed",
        "__thiscall UnBCL::ArrayList<class CBcdSetting *>::ArrayList(const struct UnBCL::ICollection<class CBcdSetting *> *)",
        "4 4$4,40484@4D4L4T4X4\\4d4l4p4x4",
        ">%>,>9>E>N>Z>_>h>o>|>",
        "moved",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::MoveNext(void)",
        "ERROR_IO_DEVICE",
        "<#=2=c=",
        "ProvPackage%d.%d",
        "fr-CA",
        "1#1.141G1_1",
        "ERROR_INVALID_ACL",
        "p    Failed to get temporary folder",
        "?Substring@String@UnBCL@@QBEPAV12@HH@Z",
        "7&797F7W7_7p7}7",
        "%hs: Rollback is disabled",
        "4 53585L5q5",
        "sCannot get the disk/offset for the OS partition",
        "5>5P5X5^5k5}5",
        "Failed to get system partition. Status: %x",
        ".050f0s0z0",
        "MigCreateUNCStore",
        "?)?/?A?U?b?u?",
        "1\"121B1R1b1r1",
        "?&?8?I?P?f?",
        "5+5O5o5",
        ".PAVCXXXXXHandledException@?LP@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "4\"4,464@4N4T4Z4_4i4s4}4",
        "Source VolumeName %ws",
        ";!;*;/;:;F;L;`;o;",
        "    Failed to create element",
        "<!<5<:<S<[<|<",
        ">(>0>8>D>L>d>l>",
        "4 4,454a4",
        "CPrepareSafeOSBootRemoval::DoExecute: Could not get old OS boot entry from param file.",
        ">(>;>K>^>o>",
        "=$=4=D=T=d=t=x=",
        "SPCreateTempPageFileForCrashDumpCapsule: Failed to create a %llu byte temporary page file at %s: 0x%08x",
        "> >+>S>Z>e>s>",
        "Failed adding package identity to SSU array",
        "3!3*343H3Q3[3d3m3w3",
        "Copy source WIM file to the %s directory",
        "5$585L5`5h5p5x5",
        "?GetArchitectureString@OperatingSystem@UnBCL@@SGPBGK@Z",
        "CReconstructOS::ReconstructWindows: Failed to tear down CBS logging: 0x%08x",
        "CMigrateFramework::DoExecute: Cannot convert new OS WinDir %s to NT path. Error: 0x%08X",
        "292R2",
        "3,3N3e3w3",
        ";(;A;R;[;};",
        "{6B5B36E8-31B2-4AC9-80EB-8B57B19B7D4D}",
        "twjW^",
        "pWorkingDir",
        "9'9H9c9i9v9",
        ".?AV?$SmartPtr@VIOCStore@OC@@@UnBCL@@",
        "DosDateTimeToFileTime",
        "8 8%808;8B8G8[8d8i8y8",
        "%hs: Attaching file %s",
        "%s\\Partition%lu",
        "CheckProcessFile",
        "=8=@=J=X=g=s=",
        "%s\\WINDOWS\\Boot",
        "APPX Validator: Existing AppX folders disappeared, will invalidate data gather operation",
        "Bugcheck driver INF name",
        "tbh(v",
        "0'040L0W0e0s0",
        ".?AVCXXXXXHandledException@?BM@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "The mount entry %s is corrupt.",
        "long __thiscall OC::COCDismAdapter::EnableDisableOCs(class OC::COCCollection *,class OC::COCCollection *)",
        "?3?=?G?Q?^?q?{?",
        "DismCheckImageHealth",
        "void __thiscall UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *>::set_Item(int,class CDeploymentBase::CMountedPathInfo *)",
        ".?AVCDUClientAppInfo@@",
        "SmDisk::CreatePartition",
        "555;5E5J5T5[5i5{5",
        ".PAVCXXXXXHandledException@?8??DoExecute@CPrepareSafeOSBootRemoval@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "NtQueryEaFile",
        "?Split@String@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@2@PBG@Z",
        "%hs: Error while writing the entropy to the new system hive: 0x%08X",
        "?+???P?V?v?}?",
        ">#>0>7>=>C>N>Y>m>v>~>",
        "NewOSPieces",
        "SmPlatform::IsAvailable",
        "PVWhPnP",
        "Execute.PostOOBE",
        "File [%s] is newer than [%s]",
        "ERROR_INVALID_FUNCTION",
        "=8=h=",
        "Failed to open DISM session: (%s). Error: 0x%08X",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCBcdSetting@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "%hs: Successfully deleted WIM file %s.",
        "535L5_5x5",
        "6!626M6W6a6g6u6",
        "3&363A3I3S3d3q3z3",
        "void __thiscall UnBCL::Array<class CRegCreationData *>::Remove(class CRegCreationData *)",
        ">+>7>w>}?",
        "808>8V8r8y8",
        "2 3)353=3L3_3h3t3|3",
        "RollbackExternal",
        "trh$Z",
        "SSSPW",
        "7e7l7~7",
        "?!?+?L?S?y?",
        "7\"7.7:7F7v7",
        ":F:n:",
        ">,>3>9>>>I>V>[>o>",
        ":*:/:C:S:",
        ";g;|;",
        "4+474C4O4[4g4~4",
        "6 676D6Q6^6v6",
        "%hs: Parent is not completely configured.",
        "CPayloadWriterT<class CEmptyType>::Done",
        "3 4C4x4",
        "?Clone@?$Array@E@UnBCL@@UBEPAVObject@2@XZ",
        "WaitForSingleObjectEx",
        "Opening DISM session for the source system (%s)",
        "Add Appx package %s",
        "BcdCopyObjectEx: Failed to set firmware object. Target: %ws Flags: 0x%x Status: %x",
        "8&838;8L8l8",
        "int __thiscall UnBCL::ArrayList<unsigned int>::LastIndexOf(unsigned int,int,int) const",
        "    Failed to retrieve payload",
        "2,2D2L2T2\\2d2l2x2",
        "<\"<6<C<O<e<k<",
        "info.ini",
        "int __thiscall UnBCL::Array<class CFilterDriverInfo *>::Add(class CFilterDriverInfo *)",
        "9\"92999?9D9O9V9[9",
        "ERROR_ACCESS_DISABLED_WEBBLADE",
        "4%494V4c4k4",
        "SetSysVolInfoPath",
        "=7=M=a=w=",
        "X%d.Path",
        "int __thiscall UnBCL::ArrayList<unsigned long>::IndexOf(unsigned long,int,int) const",
        ".?AVCXXXXXHandledException@?8??Execute@COperation@@QAEJW4OP_EXECUTION_PHASE@@PAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "686B6L6R6`6",
        "9A9t9",
        "    Failed to set file attributes to normal",
        "Failed adding package identity to permanent InstalledUpdatePackages array",
        ">#?8?^?s?{?",
        "CInstallDUUpdatesOffline::FindUpdates: Unexpected update type %d for path %s.",
        "IMPORT",
        "CSetupAutomation::Save: Failed to remove stale deployment options: 0x%08x",
        "N,PWj",
        "6=6F6N6[6v6",
        "8#80868J8a8",
        "(%lx): Error opening excluded hive file [%ws]",
        "ERROR_BOOT_ALREADY_ACCEPTED",
        "COperationsProgress::RegisterError",
        "Shouldn't use snapshot as not replacing running OS",
        "QueueRegisterSyncProcess called for fail-forward system %s, command: %s %s",
        "> >Z>z>",
        "LoadImageW",
        "< <(<2<8<O<V<^<c<t<",
        "6,646<6D6L6T6\\6d6l6t6|6",
        "ERROR_DS_INIT_FAILURE",
        "CRYPT_E_NO_DECRYPT_CERT",
        ";&;I;",
        "ERROR_CANNOT_OPEN_PROFILE",
        "ERROR_OUTOFMEMORY",
        "CDeploymentProject::CreateVHDDeployment: Failed to get image index; Error: 0x%08X",
        ")COPYRAW",
        "Failed to allocate data buffer.",
        "SetupPlatform: Executing OOBE boot StartAsync commands",
        ".?AU?$IList@PAV?$DictionaryEntry@PAVString@UnBCL@@_K@UnBCL@@@UnBCL@@",
        "FirstBoot-M1.etl",
        "- Service-specific Exit Code: %u",
        "ERROR_MCA_INVALID_VCP_VERSION",
        ".?AV?$SerializableBase@VCCleanupSnapshot@@$0A@V?$DefaultInstanceFactory@VCCleanupSnapshot@@@UnBCL@@@UnBCL@@",
        "enum ActionType __thiscall UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::get_Item(class UnBCL::String *) const",
        "?!?)?0?I?O?b?i?",
        "PSSh?",
        "2'272N2U2\\2g2r2",
        "CCreateRegistryForNewSystem::StreamRead",
        ".?AV?$SerializableBase@VCAccessCreds@@$0A@V?$DefaultInstanceFactory@VCAccessCreds@@@UnBCL@@@UnBCL@@",
        ".?AV?$CAutoLocalFree@PBG@RAII@@",
        "5J5z5",
        "ERROR_DS_DRA_SOURCE_REINSTALLED",
        "base\\ntsetup\\setupplatform\\lib\\util\\storagereserve.cpp",
        "595a5t5{5",
        ";*;L;[;l;y;",
        "CSetupAutomation::Save: Couldn't infer original answer file type: 0x%08x",
        "636H6P6V6c6u6",
        "?%?3?",
        "ERROR_SHUTDOWN_IN_PROGRESS",
        ".PAVCXXXXXHandledException@?BF@??SPGetExistentImageInfo@@YGJPBGPAW4IMAGE_TYPE@SetupPlatform@@PAPAG2222@Z@",
        ".?AU?$ICollection@UDISK_SPACE_IMPACT@@@UnBCL@@",
        "9 9$9(9,9094989<9@9D9L9P9X9`9d9h9p9t9x9|9",
        "WimAtExitReserve",
        "4C4R4",
        "CDeploymentProject::CreateBootableMediaDeployment: Failed to get next disk (0x%08x)",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCDrvStoreProperty@@@UnBCL@@@UnBCL@@",
        ":@:`:s:",
        "<$<+<1<6<A<K<P<d<l<",
        "?,?4?:?G?Y?g?y?",
        "ERROR_DS_DISALLOWED_IN_SYSTEM_CONTAINER",
        "int __thiscall UnBCL::ArrayList<class CBasicEnvEntry *>::IndexOf(class CBasicEnvEntry *,int,int) const",
        "ERROR_DS_LINK_ID_NOT_AVAILABLE",
        "1%1B1I1R1]1d1j1o1z1",
        "= =*=8=E=c=|=",
        ".?AV?$SmartPtr@VCDUPackage@@@UnBCL@@",
        "7$777^7l7u7",
        "SPUnloadKey: Failed to enable required privileges",
        "PVWhO",
        "y&VhE",
        "3 3'3-323=3G3Z3l3t3z3",
        "90:h:",
        "ERROR_IPSEC_IKE_MM_ACQUIRE_DROP",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::Insert(int,class UnBCL::DictionaryEntry<unsigned short,unsigned short> *)",
        "QQPQQQQW",
        ".?AVCXXXXXHandledException@?CD@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        ".PAVCXXXXXTemp@?3??FilterUpdates@CDownloadDUUpdates@@IAEJPAUIDUUpdateCollection@DU@@PAJPAUIDownloadCallback@SetupPlatform@@PAXPAUIDUDownloadProgress@6@PAUITelemetry@@PAUITelemetryActivity@@@Z@",
        "JET_wrnTableEmpty",
        ">+>9>Z>w>",
        "Apply detected on source OS before Win10 RS1, disabling NEO",
        "3#373W3`3|3",
        "RollbackActive",
        "3&3,3@3P3Z3z3",
        "EnumeratePathEx: Unable to get reparse tag for persistent reparse point; GLE = 0x%x",
        "747:7U7j7s7",
        "\\Users",
        "5W5p5u5",
        "4!4/4",
        "SPCreateDiskImage: Unrecognized DISK_IMAGE_TYPE %u",
        "SysprepSession::CreateSession: Action XML file %s does not exist",
        "ERROR_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN",
        "<$<D<L<T<\\<d<l<x<",
        "Operations.Begin",
        "<.<=<L<[<j<y<",
        "Failed to tag [%s] for Storage Reserve. Error: 0x%08X",
        "void __thiscall UnBCL::ArrayList<class CDriverInfo *>::Resize(int,int)",
        ".PAVCXXXXXTemp@?3??DoExecute@CSetupRecoveryPartition@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "Failed opening package",
        "Failed to remove wim entry when image apply failed.",
        ": :':-:::O:]:k:y:",
        "2(2:2X2d2v2",
        "void __thiscall UnBCL::ArrayList<class CCopyInfo *>::QuickSort(class UnBCL::ArrayList<class CCopyInfo *> *,class UnBCL::ArrayList<class CCopyInfo *> *,int,int)",
        "WIM file is on the OS volume but we don't have a disk space pressure.",
        "COperationQueue::DumpToLog: Failed to get hard reserve info. Error: 0x%08x",
        "=!=6=D=P=c=t=",
        "0 0-0?0G0M0Z0l0",
        "struct DiskMatchFilter &__thiscall UnBCL::ArrayList<struct DiskMatchFilter>::get_Item(int)",
        "4-4R4\\4",
        ">(>\\>c>i>n>y>",
        "7&898]8h8t8",
        ";/;U;",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::set_Item(int,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *)",
        "iswspace",
        "SPCopyFilesAndFolders: Failed to delete folder %s. Error: 0x%08X",
        "t\"j:V",
        ".?AU?$IList@PAVCFailForwardSystem@@@UnBCL@@",
        "Failed to query subkey count for Snapshot Registry key. Error: 0x%08X",
        "void __stdcall UnBCL::_::HTEnumerator<unsigned long,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,unsigned long,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,&protected: static unsigned long __stdcall UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsVDisk *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<unsigned long,struct IVdsVDisk *> *,class UnBCL::Array<unsigned long> *,int)",
        "=5===h=v=~=",
        ".?AV?$SerializableBase@VCRegCreationData@@$0A@V?$DefaultInstanceFactory@VCRegCreationData@@@UnBCL@@@UnBCL@@",
        "6L6t6",
        ">,>0>H>L>d>h>",
        "COfflineApplyFromICB::DoExecute",
        ".?AVStringProperty@?1???$pDefineStringProperty@V<lambda_2b2a0c49c086e583ea376806736bf3e2>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_2b2a0c49c086e583ea376806736bf3e2>@@@Z@",
        "5\"5+585P5z5",
        "=$=0=<=H=T=]=f=o=x=",
        "3&3,373E3m3y3",
        "- Error Control: %u",
        "8;8\\8",
        "2 2$2(2,20282<2@2D2L2P2T2X2\\2`2d2h2l2t2x2|2",
        "4?5G5U5_5",
        "</<V<l<",
        "=*>@>G>Y>f>v>",
        "SPAPI_E_INVALID_FILTER_DRIVER",
        "ZwQueryInformationFile",
        "Unable to open file %s for read because the file or path does not exist",
        "SysprepSession::ExecuteInternal: Skipping offline-capable module of %s when running online",
        "9-9n9",
        "9*9:9J9\\9t9z9",
        "0&020P0]0",
        ".?AV?$SmartPtr@V?$Hashtable@KPAUIVdsDisk@@@UnBCL@@@UnBCL@@",
        "Attempting to add service with data:",
        "5#5.5@5K5_5",
        "<:=d=",
        "BatteryTimeRemaining",
        "4W4x4",
        "class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::get_Current(void) const",
        "  Decision for the driver package so far (WinPE): %s",
        "?$?0?P?X?d?",
        "SWjH_Wj",
        "2$2(2,24282<2D2H2L2P2T2X2\\2`2d2h2p2t2x2|2",
        "class OC::COptionalComponent *__thiscall UnBCL::_::ArrayListEnumerator<class OC::COptionalComponent *>::get_Current(void) const",
        "X\\\\?\\",
        "VdsPartition::GetResizeBounds: Couldn't query disk extents (0x%08x)",
        "fYfZfQfVf",
        "<$</<5<I<Q<l<",
        ".?AVCXXXXXHandledException@?2??CopyToDriverStore@CApplyDrivers@@IAEJPAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@4@PAPAV54@@Z@",
        "?*?@?s?",
        "4 4$4,4044484<4@4D4H4L4T4X4\\4`4h4l4p4t4x4|4",
        ".?AV?$Array@PAV?$CAutoRelease@PAUIDUUpdateCollection@DU@@@Mig@@@UnBCL@@",
        "%hs: Migration file verifier is initialized",
        "6(6/656:6E6Q6a6q6",
        "9\"909D9R9[9e9n9",
        "=<=D=L=T=\\=h=",
        "System store path: %s",
        "v4SW3",
        "simplified",
        "Moving %s to %s",
        "253=3s3",
        "SPStorageReserveAvailable: Failed to get Update Reserve manager. hr = 0x%08X",
        "ERROR_SYNCHRONIZATION_REQUIRED",
        "=#=+=1=>=P=^=w=~=",
        "5'6V6_6g6n6",
        "SP_ROLLBACK_INFO",
        "2-2=2V2k2",
        ".PAVCXXXXXTemp@?3??DoExecute@CSetProductKey@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "<!=-=6=\\=",
        "Disk.PartitionTableType was neither MBR nor GPT!",
        ">,>M>|>",
        "GetDC",
        "SL_E_CHPA_INVALID_BINDING",
        "?Insert@String@UnBCL@@QBEPAV12@HPBG@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::Insert(int,class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *)",
        "8!8,878K8b8v8",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::RemoveAt(int)",
        "797T7g7u7",
        "SVhX:",
        "243;3J3",
        "File not found",
        "D$<Pj",
        "%hs: Failed to read the boot manager timeout from file: %s. Error: 0x%08X",
        "This is a restarted reset. Load saved package list from old windows' servicing folder",
        ".?AVNumericProperty@?1???$pDefineNumericProperty@V<lambda_15715bbe215efe593b047956a14a6a8f>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_15715bbe215efe593b047956a14a6a8f>@@@Z@",
        "CMountWIM::DoExecute",
        "CApplyDrivers::CopyToDriverStore: Failed to delete directory %s. Error: 0x%08X",
        "7*797",
        ".?AV?$Array@PAV?$DictionaryEntry@PAVString@UnBCL@@J@UnBCL@@@UnBCL@@",
        "809x9",
        "SPCopyFilesAndFolders: Cancelled",
        "?\"?(?-?:?J?T?y?",
        "9/9E9P9`9j9|9",
        "=`>h>m>s>",
        "3Z3n3{3",
        "9$969>9D9Q9c9q9~9",
        "8$8<8A8X8m8s8",
        "JET_errRunningInOneInstanceMode",
        "ERROR_CANT_DELETE_LAST_ITEM",
        "?\"?,?6?<?J?~?",
        "=9=@=F=K=V=`=s=",
        "{F6758725-4376-42EE-BDF1-A56289B16722}",
        "N0SSh",
        "=)=5=B=I=V=m=}=",
        "SL_E_HWID_ERROR",
        "(%lx): Failed to delay execution",
        "ERROR_CONNECTION_REFUSED",
        "445g5y5",
        "6&7<7Q7|7",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *> *)",
        "%s will be enabled",
        "8 888<8T8X8p8t8",
        "7.787R7Y7_7d7o7z7",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CBcdSetting *>::Reset(void)",
        "tzm-Latn",
        "5\"5)5/545?5J5Q5e5q5",
        "void __thiscall UnBCL::Array<class COperationsValidator *>::Remove(class COperationsValidator *)",
        "UblIsUSBDiskInternal: USB disk %u is %s to the system",
        "base\\ntsetup\\setupplatform\\lib\\src\\boothandling.cpp",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Failed to recover WinPE memory crash dump files",
        "void __thiscall UnBCL::Array<class CDeploymentBase::CMountedPathInfo *>::Remove(class CDeploymentBase::CMountedPathInfo *)",
        "EXFAT   ",
        "JET_errLogCorruptDuringHardRestore",
        "?!?'?4?:???[?e?r?x?",
        "VdsPartition::GetVolume: No volume is backed by this partition",
        "Hive %s matching %s is loaded at %s",
        "?7?K?W?g?o?v?{?",
        "3 3.3F3L3b3v3",
        ">0H0g0z0",
        "DriverPackageEnumDriversW",
        "%hs: WindowsOld.wim file deleted.",
        "?)?[?x?",
        "ERROR_ILL_FORMED_PASSWORD",
        ";,;3;9;>;I;S;f;w;",
        ">$>.>8>A>J>a>o>x>",
        "ERROR_SHARING_PAUSED",
        "    Failed to create new element folder",
        "CBS_E_NO_ACTIVE_EDITION",
        "RtlCreateEnvironment",
        "3&3+3K3z3",
        "DriverSafeOSInstallFailedList",
        "WriteSectors",
        ".?AV?$CAutoDelete@PAVCFfuInternalGenericProgress@@@RAII@@",
        "Failed to save low disk space state to file: %s. Error = %d",
        "VdsPlatformDiskEnumerator::GetNext: Failed to query IID_IVdsPack interface [%s] (0x%08x)",
        "979~9",
        "Sources\\OCPayload",
        ".PAVCXXXXXTemp@?JJ@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "7!7%7)7-7175797=7A7E7I7M7Q7U7Y7]7a7e7i7m7q7u7y7}7",
        "Re-Executing upgrade migration actions...",
        "7$7:7",
        " Ph0)",
        "CMigrateFramework::DoExecute: Failed to bypass root ACL migration. Error: 0x%08X",
        "ZwCreateFile",
        ".PAVCXXXXXHandledException@?GD@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "t$(PP",
        "int __thiscall UnBCL::ArrayList<class CFailForwardSystem *>::IndexOf(class CFailForwardSystem *,int,int) const",
        ".PAVCXXXXXTemp@?3??DoExecute@CSplitWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ";(;6;@;I;R;[;l;u;~;",
        ":8:T:p:",
        "CCFGValidator::CheckContainment",
        "WRITE",
        "CDeploymentProject::CreateFolderDeployment: Failed to copy boot files from [%s] to [%s]. Error: 0x%08X",
        "ERROR_SXS_VERSION_CONFLICT",
        "2\"252I2S2Z2`2e2p2z2",
        "='=-=6=L=Z=s=z=",
        "JET_errTooManyOpenTablesAndCleanupTimedOut",
        "1'1E1T1e1z1",
        "1-1A1R1o1w1~1",
        "=1=?=",
        "WakeAllConditionVariable",
        "?\"?/?;?S?Y?k?|?",
        ";&;.;4;A;S;l;",
        "6)6.6",
        "class CInfFile *const *__thiscall UnBCL::ArrayList<class CInfFile *>::GetBuffer(int) const",
        ";\";8;^;h;o;u;z;",
        "IISLogs",
        "Group",
        "Failed to save correlation vector to file: %s. Error = %d",
        "ERROR_CANT_OPEN_MINIVERSION_WITH_MODIFY_INTENT",
        "CompressChunk",
        "WIMSplitFileWorker",
        "9D$4wVr",
        "SWhh+",
        "1#1)1@1F1]1c1z1",
        ".?AV?$DefaultInstanceFactory@VCStopSuspendedServices@@@UnBCL@@",
        ".?AVCXXXXXHandledException@?5??pSPRemoveSourceHardlinks@@YGXPAVString@UnBCL@@@Z@",
        "0 0-0?0M0e0l0s0y0",
        "ERROR_INSTALL_SOURCE_ABSENT",
        "CDownloadDUUpdates::DoExecuteInternal",
        ".?AV?$DefaultInstanceFactory@VCApplyBCDSettings@@@UnBCL@@",
        "SPQuerySnapshotSize: Failed to query snapshot size. Error: 0x%08X",
        "ERROR_CTX_NO_OUTBUF",
        "pSPCopyFolder",
        "int __thiscall UnBCL::ArrayList<struct DiskLayout::Partition>::BinarySearch(int,int,struct DiskLayout::Partition,struct UnBCL::IComparer<struct DiskLayout::Partition> *)",
        ">$>,>4><>D>L>T>\\>h>p>",
        "ERROR_ALL_USER_TRUST_QUOTA_EXCEEDED",
        "Target OS is in a failed state from a previous failed execution of SetupCl; cannot proceed...",
        "889E9]9",
        "8$8+898K8\\8c8u8",
        "ERROR_CLUSTER_NODE_UP",
        ":(:::H:W:",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,unsigned long>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,class ATL::CElementTraits<unsigned long> > const *,struct __POSITION * const &)>::Reset(void)",
        "656B6L6Y6j6t6~6",
        ".?AV?$DefaultInstanceFactory@VCSaveBootEntriesOldOS@@@UnBCL@@",
        "4 4$4(4,4044484<4@4D4H4L4P4X4\\4d4l4p4t4x4|4",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        ":@;Z;`;h;",
        "5(5L5T5\\5d5l5t5|5",
        "5>5W5",
        "8%848;8A8F8R8`8h8n8",
        "4%454K4Z4j4",
        "SPSaveWinReInformation",
        "2E3V3]3c3h3s3z3",
        "8*8p8",
        "header version mismatch",
        "4(525`5h5",
        "SL_E_NOT_ACTIVATED",
        "6C6R6Y6a6f6u6",
        "GetSysDir",
        "4\"4*40494O4e4w4",
        "_XcptFilter",
        "<%<,<?<T<n<",
        "Upload files successfully so we can remove all etl files.",
        "pDeterminePageFileRequirements: Will create a new %llu-byte page file at %s",
        ";,;:;",
        "1B1X1",
        "%s\\HEI",
        "Enumerate packages for reset",
        "RPC_S_OBJECT_NOT_FOUND",
        "</%s>",
        "5b5l5",
        "6;6H6T6\\6o6v6|6",
        "8$8?8E8R8d8",
        "808e8|8",
        ".Push Button Reset - Language",
        "SVhhR",
        ".?AV?$ArrayList@PAVCGlobalPathFindData@@@UnBCL@@",
        "7L7^7f7l7y7",
        ".PAVCXXXXXTemp@?PL@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "ProvisioningPackage::GetName",
        "PVWh-",
        "SPOpenOnlineSystemHive",
        "DiagTrack",
        "WINDOWS/VERSION/MINOR",
        "ActionPlatform::DeleteFilePattern: Error occurred during file deletion; dwRet = 0x%x, Win32Exception message: %s",
        "ShlUb",
        "PVWhL",
        "%hs: Failed to set the new identity list, rollback entry will remain visible. Error: 0x%08X",
        ";H(v ",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCAppInfo@@@UnBCL@@@UnBCL@@",
        "DiskLayout::Execute: Failed to create new partitions (0x%08x)",
        "1&2F3",
        "+SVhp",
        "ms-MY",
        "8+83898F8X8f8s8",
        "? ?$?(?0?T?\\?`?d?h?p?",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CFailForwardSystem *>::MoveNext(void)",
        ".?AV?$CAutoCleanupBase@PAUIPathEnumerator@SetupPlatform@@@RAII@@",
        "142U2t2",
        "%hs: Failed to register RollbackOnlineUser. Error: 0x%08X",
        "3!3?3V3a3q3{3",
        "0,0=0Q0d0q0",
        "WimInitXmlInfo",
        "080H0U0m0",
        "%hs: Cannot validate tracked content for machine-specific journal. Error: 0x%08X",
        "6?6E6F7",
        "RPC_X_SS_IN_NULL_CONTEXT",
        "SSSSSSSSW",
        "IDB_WIN_LOGO5",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::Reset(void)",
        ".PAVCXXXXXTemp@?5??DoExecute@CCreateScopedSnapshot@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "RollbackTransaction",
        "%hs: Failed to write string to file: %s. hr = 0x%08X",
        "3X4e4t4",
        "8!858B8O8\\8i8v8",
        "2 2(262@2G2M2R2]2o2",
        "ERROR_CANT_ACCESS_FILE",
        "void __thiscall UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *>::AddRange(const struct UnBCL::ICollection<class CDeploymentBase::CMountedPathInfo *> *)",
        "DiskLayout::Create",
        "int __thiscall UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *>::BinarySearch(int,int,class CDeploymentBase::CMountedPathInfo *,struct UnBCL::IComparer<class CDeploymentBase::CMountedPathInfo *> *)",
        ".didat$6",
        "PROGRAMSX86",
        "FilterVolumeInstanceFindFirst",
        ".?AV?$HTEnumerator@W4OP_OPERATION_ID@@HUTableKey@?$Hashtable@W4OP_OPERATION_ID@@H@UnBCL@@HUKeyTraits@34@$1?RetrieveValue@34@KGHPBV?$CAtlMap@UTableKey@?$Hashtable@W4OP_OPERATION_ID@@H@UnBCL@@HUKeyTraits@23@V?$CElementTraits@H@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "RollbackInitiatedOperation",
        "4%434[4j4z4",
        "pGetImageEditionID: Failed to get CompositionEdition for VirtualEdition %s. Error : 0x%08x",
        "> >;>O>V>\\>a>l>w>",
        "%hs: Begin run",
        "D$HPj",
        ":#:7:=:F:\\:j:",
        ">%>,>2>7>C>P>d>n>u>{>",
        "2%2/262<2B2M2X2l2}2",
        ">->2>I>^>",
        "6(6=6G6S6i6",
        "CSetupAutomation::Save: Failed to parse original answer file data: 0x%08x",
        ">+>2>H>c>i>s>x>",
        ".?AU?$IEnumerator@UDiskRange@@@UnBCL@@",
        "ERROR_CS_ENCRYPTION_INVALID_SERVER_RESPONSE",
        "8/8>8Q8c8s8",
        "?/?@?",
        "pGetExistingPageFiles: Failed to open online SYSTEM hive: 0x%08x",
        "SPTaskRemoveSnapshot: Failed to generate CorrelationVector",
        "2!2A2S2[2a2n2",
        "9\"9*9A9g9o9|9",
        "5$50585P5X5`5p5x5",
        "SPApplyDeviceLayoutDiskConfig: Failed to read device layout XML %s (0x%08X)",
        "7%7a7i7",
        "DisableTelemetryOptInChangeNotification",
        ".?AU?$ICollection@PAV?$DictionaryEntry@PAVString@UnBCL@@J@UnBCL@@@UnBCL@@",
        "0&040",
        ".PAVCXXXXXTemp@?EJ@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "{1E472340-7A65-4108-898E-6FF897EC025A}",
        "0\"000>0L0Z0h0v0",
        "?Equals@?$ArrayList@G@UnBCL@@UBEHPBVObject@2@@Z",
        ">'>9>A>G>Q>[>n>",
        "99=G=",
        "3 5`6",
        "Final list of delete exceptions:",
        "void __thiscall UnBCL::Array<void *>::InitLarva(class UnBCL::ArrayList<void *> *)",
        "pReadPageFileSettingsAndWriteToConfigFile: Failed to read Filterpages value, writing default value. Error: 0x%08x",
        "OperationsQueue",
        ":$:F:X:f:t:",
        "ControlSet%03u\\%s",
        "Interruption requested - Perform deletion.",
        "{65CE0825-3505-4910-991F-3BDF0E6AF6FE}",
        "SmImageDisk::InitializeProperties",
        "int __thiscall UnBCL::ArrayList<class SysprepAction *>::LastIndexOf(class SysprepAction *,int,int) const",
        "6$6,6D6L6d6l6t6",
        "VdsPlatformDiskEnumerator::GetNext: Failed to query IID_IVdsVDisk interface [%s] (0x%08x)",
        "%hs: BCD failed to retrieve the default boot entry. Error: 0x%08X",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::Reset(void)",
        ":+:7:O:U:Z:q:w:",
        "3 3$3(3,3034383<3@3D3H3P3T3X3\\3`3d3h3p3t3x3|3",
        "?(?,?D?H?`?d?|?",
        "6+646J6X6u6",
        "UPGBootVhdVolumePath",
        "9G9P9c9p9|9",
        "void __thiscall UnBCL::Array<class CInfFile *>::Insert(int,class CInfFile *)",
        ".PAVCXXXXXTemp@?3??RemoveUninstall@CUninstall@@UAEJXZ@",
        "Cannot calculate weight for downlevel operations. Likely the sort operation failed.",
        "class CGlobalPathFindData *const &__thiscall UnBCL::ArrayList<class CGlobalPathFindData *>::get_Item(int) const",
        "9&9,919=9H9\\9~9",
        "ERROR_TRANSACTION_SUPERIOR_EXISTS",
        "Service key does not exist for %s",
        "3$353?3J3Q3W3`3e3y3",
        ">$>7>K>X>_>m>w>",
        ";$;-;6;Z;h;r;{;",
        "%hs: Failed to set the boot status policy for the new OS. Error: %d",
        "no short name",
        "505t5",
        "XFailed to get info set for image",
        "OC::COCCbsAdapter::Release",
        "2&2+252;2A2P2g2w2",
        ".PAVCXXXXXTemp@?IH@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "2 2$2(2024282<2D2H2P2X2`2d2h2l2p2x2|2",
        "ERROR_CLUSTER_INTERNAL_INVALID_FUNCTION",
        "yJVhe",
        "92999@9K9U9`9g9n9|9",
        "  File: %s, Version: %s",
        "3#3+313>3P3Z3o3w3}3",
        "pGetFileSystemInfoToFormat: Did not find file system support for %s",
        "4F4[4h4u4",
        "SPAPI_E_NO_DEVICE_SELECTED",
        "class SysprepComponent **__thiscall UnBCL::ArrayList<class SysprepComponent *>::GetBuffer(int)",
        ".?AV?$DefaultInstanceFactory@VCCopyFilesAndFolders@@@UnBCL@@",
        "3,343D3X3l3",
        "=)=3===N=W=`=i=",
        "3!3&3:3G3O3Y3a3h3x3",
        "ERROR_DS_SAM_NEED_BOOTKEY_PASSWORD",
        "5-5U5f5n5",
        "929?9F9L9Q9\\9g9l9",
        "9*:M:a:",
        "int __thiscall UnBCL::Array<void *>::Add(void *)",
        "DeletePath: Failed to obliterate [%s] (GLE = 0x%x); retrying...",
        ">'?4?F?N?T?a?s?",
        "CSetupPlatform::CreateNewSystem: Failed to create ImageInfoSet (0x%08x)",
        "0>0K0]0e0k0x0",
        "?.?<?]?",
        "5(6|6",
        ".?AUIDeploymentProject@SetupPlatform@@",
        "3'33383A3M3Y3^3g3n3{3",
        ">!?D?J?p?",
        "Pass status for %s before running: %d",
        ";>;a;",
        "= >'>U>w>",
        "1&141B1",
        "ERROR_SXS_XML_E_UNCLOSEDSTARTTAG",
        "System\\CurrentControlSet\\Control\\WMI\\AutoLogger\\SetupPlatform",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable<class UnBCL::String *,int>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::Reset(void)",
        ".?AVSmVirtDiskPooledDiskEnumerator@@",
        "Thales TSS ESN:0A56-E329-4D4D1%0#",
        ".?AV?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "7 8T8",
        "SYSTEM\\Setup\\SetupPlatform",
        "void __thiscall UnBCL::Array<class CInfFile *>::Remove(class CInfFile *)",
        "?SelectSingleNode@XmlNode@UnBCL@@QAEPAV12@PAVString@2@@Z",
        "2-282B2V2n2u2}2",
        "6 7k7",
        "?3?W?}?",
        "535A5Z5a5h5n5z5",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,int>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "dFailed during download operation",
        "909[9",
        "%hs: Cannot clear file attributes for %s. hr = 0x%08X",
        "9J9P9[9i9",
        "= =<=`=p=",
        "8$8,848<8D8\\8`8l8",
        "7'7,7?7D7N7r7",
        "PVWhd",
        "class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::GetBuffer(int)",
        "8/9A9I9O9\\9n9|9",
        "SKIPBOOTTRACK(FIRST): Skip Boot Validator: Cannot remove one or more operations, cannot continue with First boot removal.",
        "ERROR_SHUTDOWN_IS_SCHEDULED",
        "4D4K4w4~4",
        "?Close@FileStream@UnBCL@@UAEXXZ",
        "7=7C7b7h7",
        "RollbackSetCheckpoint(%s): threw exception.",
        "; ;,;7;W;w;",
        "ERROR_TM_INITIALIZATION_FAILED",
        "4#4*4=4G4M4{4",
        "je[f9\\0",
        "BfsMigrateLoaderSettings failed to open template store %#x",
        "?'?,?8?T?[?b?m?z?",
        "DUSearchAndDownloadStartTime",
        "ERROR_ACCESS_DISABLED_BY_POLICY",
        "Failed to enumerate subkeys. Status: %x",
        "%hs: No current boot entry was found. We will assume {current} == {default}",
        "void __thiscall UnBCL::ArrayList<class CPartitionInfo *>::QuickSort(class UnBCL::ArrayList<class CPartitionInfo *> *,class UnBCL::ArrayList<class CPartitionInfo *> *,int,int)",
        "ERROR_EVT_PUBLISHER_METADATA_NOT_FOUND",
        "{E6D0D3E2-C546-49CF-B9A5-84FD689289E2}",
        "5?5j5",
        "int __thiscall UnBCL::ArrayList<class COSPieceInfo *>::LastIndexOf(class COSPieceInfo *,int,int) const",
        ">E>K>T>_>",
        "select * from MSFT_StorageProvider",
        "ExportContextCopy",
        "%hs: Error setting OS Switch Rollback checkpoint. Error: 0x%08X",
        "Failed to move telemetry to %s. Error: 0x%08X",
        "index out of range to ArrayList#set_Item",
        "online",
        "3 3(3.3;3M3[3",
        "ERROR_DS_CANT_MOVE_APP_QUERY_GROUP",
        "VVPh ",
        ")RemapTable",
        "8/868<8A8L8V8[8o8x8",
        "1)1/1C1Q1`1n1u1{1",
        "BcdFlushStore: Failed to acquire BCD sync mutant. Status: %x",
        "%hs: Cannot make BCD temp pagefile device object of type BCDE_DEVICE_TYPE_PARTITION. Status = %d",
        ">*>8>@>J>Z>s>",
        "%hs: exception enumerating pending file rename operations: %s",
        "SPGetFootprintCapabilities: Could not find footprint file %s",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::get_Item(int)",
        "jRj)j",
        "    Source OS version: %d.%d.%d.%d",
        ".?AV?$ValueCollection@PAVString@UnBCL@@H@_@UnBCL@@",
        "?)?0?6?;?F?Q?^?f?l?q?",
        "4!494S4Z4`4e4p4",
        "InvalidateRect",
        "refreshInterval",
        "9#9)959F9Z9d9k9r9~9",
        "CRelocateWinReImage::DoExecute: WinRE image relocated",
        "int __thiscall UnBCL::ArrayList<struct DiskMatchFilter>::IndexOf(struct DiskMatchFilter,int,int) const",
        ".?AV?$CAutoRelease@PAVVdsVolume@@@RAII@@",
        "CDUPackage::UnpackTo: Failure creating a temporary directory. Error: 0x%08X",
        "ERROR_GENERIC_COMMAND_FAILED",
        "ERROR_DS_USER_BUFFER_TO_SMALL",
        "    Failed to allocate _spPayloadPath.get()",
        ": :$:<:@:D:H:L:P:T:h:x:",
        "JET_errInvalidBufferSize",
        "=)=4=S=g=w=",
        "FileSystem",
        "Connected standby str: %s",
        "CBS_E_DEPENDENT_FAILURE",
        "7#727:7@7E7Y7`7",
        "t7j.Zf;",
        "676B6P6^6l6z6",
        "pReadPageFileSettingsAndWriteToConfigFile",
        "COfflineHiveT<class CEmptyType>::Init",
        ">%>Q>[>b>h>m>x>",
        "6 626N6`6h6t6",
        "Start of service deferred",
        "TerminateThread",
        ".?AV?$DefaultInstanceFactory@VCCopyInfo@@@UnBCL@@",
        "TlsSetValue",
        "upgrade_comp.xml;upgrade_data.xml",
        "= =c=p=",
        "142l2",
        "1 1*12181=1P1W1]1b1m1x1",
        "System32\\OOBE\\SetupPlatform",
        ".?AU?$IEnumerable@PAV?$CAutoRelease@PAUIDUUpdateCollection@DU@@@Mig@@@UnBCL@@",
        "?$?0?O?_?}?",
        "{C5562288-FDD6-4444-8FEB-CC17522EC4B2}",
        "SetupShutdownRequired",
        "ERROR_DS_DRA_MISSING_KRBTGT_SECRET",
        "<+<3<<<B<W<o<u<",
        "Pass has failed status; system is in an invalid state.",
        "PWVhQ",
        "Failure while getting the source known folder path for %s",
        "DelayLoadHandler: Failed to get procedure %s from library %s; error code is 0x%x.",
        "1-1B1J1P1]1o1y1",
        ">)>.>B>Y>`>f>k>v>",
        "RegionReference",
        "jHXPd",
        ")drvfiles.dat",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::Reset(void)",
        ".?AU?$IEnumerator@PAVSysprepAction@@@UnBCL@@",
        "@kon|",
        "9%:J:e:i:m:q:u:y:}:",
        "=*=E=K=U=Z=d=k=y=",
        "!|$<9}",
        "9*9D9e9",
        "ERROR_KERNEL_APC",
        "3D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4",
        "5)5R5d5r5y5",
        "Found available test hook.",
        "ERROR_BEGINNING_OF_MEDIA",
        "SSj@j",
        "<%<5<A<J<W<k<{<",
        ">%>3>D>Q>Z>n>",
        "%hs: SPGetVolumeInfo failed. Error: 0x%08x",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,int> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::get_Current(void) const",
        "8&989@9F9S9e9",
        "%hs: Register RollbackOnlineSystem command %s%s%s",
        "\\REGISTRY\\MACHINE\\SOFTWARE",
        "y,ShK",
        "ERROR_CANNOT_LOAD_REGISTRY_FILE",
        "1)2H2f2s2",
        "6-6>6K6T6a6i6p6",
        "%hs: WIM temp path set.",
        "4/5^5",
        ".?AV?$SmartPtr@V?$ArrayList@K@UnBCL@@@UnBCL@@",
        "73787@7",
        "5#5)565K5Y5g5u5",
        ".PAVCXXXXXTemp@?3??DoExecute@CMigrateBootSettings@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "Memory Tester application not found. Skipping add.",
        "RtlDisownModuleHeapAllocation",
        "ERROR_SXS_XML_E_INTERNALERROR",
        "u SQh",
        "0>1P1X1^1k1}1",
        "Skip Boot Validator: Failed to get the stable volume name. Error: 0x%08X",
        "; ;);5;B;G;P;\\;i;n;w;",
        "VerboseLogging",
        "<1<F<X<`<f<z<",
        "ERROR_INSTALL_NOTUSED",
        "?$?0?C?J?\\?i?u?",
        "4$535o5",
        "$`2X`F",
        ";5;G;N;X;h;w;",
        "<%</<6<<<A<L<X<]<q<",
        "WDSCLIENTAPI.dll",
        "%hs: System partition: %s",
        "CSetupPlatform::GetAutomationFromAnswerFile: Failed to initialize automation: 0x%08x",
        "3/3C3a3x3",
        "class CProfileInfo *const *__thiscall UnBCL::ArrayList<class CProfileInfo *>::GetBuffer(int) const",
        "CReconstructOS::RestageWindows: Failed to initialize DISM: 0x%08x",
        "CSetupPlatformPrivate::RollbackOnlineCommon: Failed to delete new WinRE hash: 0x%08x",
        "GetFileVersionInfoSizeExW",
        "64686P6T6l6p6",
        "jtj\"h\\_",
        "{1C3EE89B-B56F-4EE2-80E0-48526B8B9879}",
        "ChkDisk: Finished Succesfully",
        ".boot.sdi",
        "!D$P9t$Xt",
        "8#8)8.8=8N8[8d8y8",
        "ERROR_LOG_RESTART_INVALID",
        "617=7L7^7c7",
        "5A6}6",
        "1'1G1N1U1a1o1u1",
        "\\windows\\system32\\winload.efi",
        ".PAVCXXXXXTemp@?L@??SPApplyAnswerFileSettings@@YGJPBG000PAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "2)2.282?2M2_2p2w2",
        "|SYSPART|\\|EFIDEFAULT|\\|DEFAULTAPP|",
        "6+6V6c6",
        "pShouldSplitMergeFile",
        "0 151N1^1e1k1p1{1",
        "CNewSystem::QueueSetupAutomation: Failed to get attributes of %s: 0x%08x",
        "_FinalizeUninstall",
        "Servicing debugger files",
        "6+666=6D6O6Y6l6q6z6",
        "SetupPlatform: Phase \"Post-OOBEBoot\" completed successfully.",
        "5?5c5u5}5",
        "ERROR_USER_PROFILE_LOAD",
        "QueueAddAppxPackage called with [%s]",
        "  Provider: %s",
        "=+=4=g=",
        "ERROR_NO_VOLUME_ID",
        "Wow64RevertWow64FsRedirection",
        "3!3'313;3S3j3",
        "Failed allocating m_sczNewWinDirPath path.",
        ";/;C;",
        ":F;T;c;",
        "ERROR_DS_DIFFERENT_REPL_EPOCHS",
        "SPAPI_E_BAD_SECTION_NAME_LINE",
        "5\"595@5F5K5V5b5|5",
        "CSetupAutomation::ResolveTarget: Failed to determine install image info: 0x%08x",
        "9c9r9",
        "Creating/Setting Filterpages reg value with %s.",
        "class CBasicEnvEntry *const *__thiscall UnBCL::ArrayList<class CBasicEnvEntry *>::GetBuffer(int) const",
        "5#5D5_5e5r5",
        "5'555J5Y5j5s5",
        "=#=(=3=:=_=u=~=",
        "DRVMIG: Successfully reflected driver package in WinPE: %s.",
        ";&;5;>;H;Q;[;d;n;w;",
        ".?AV?$SerializableBase@VCWIMImageInfo@@$0A@V?$DefaultInstanceFactory@VCWIMImageInfo@@@UnBCL@@@UnBCL@@",
        ";)<A<^<h<o<t<",
        "CDeploymentProject::CreateBootableMediaDeployment: Failed to find volume with drive root %s (0x%08x)",
        ".?AVCXXXXXHandledException@?2??BuildDiskInfoFromPath@CGlobalPath@@SGJPAVString@UnBCL@@PAPAV34@PAKPA_K21@Z@",
        "Failure writing the final filter data. Error: 0x%08X",
        ".?AVCXXXXXHandledException@?EF@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "Original path : %s",
        "4&404=4F4N4U4l4t4{4",
        "818:8S8n8",
        "808`8",
        "8'838?8",
        "Set reg key value MaximumBuffers failed: 0x%x",
        "VPhHu",
        "PSSSSSSh ",
        "3-4?4F4",
        "Backing up WIMBoot WIM file from %s to %s",
        "=-=2=n=",
        "Onesettings: Failed to AddParameterAppVer: 0x%x",
        ":':.:4:::F:O:[:b:l:v:}:",
        "Command line failed with exit code: %d",
        ".PAVCXXXXXHandledException@?2??DoExecute@CAddSetupClRequest@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "CAddCbsPackage::DoExecute",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::Remove(class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *)",
        "Cannot set DisplayName for %s, error: 0x%08X",
        "PortableOperatingSystem",
        "                                   Processor clock : %u",
        "(%lx): Failed to migrate security info for child key",
        "ERROR_CTX_CONSOLE_DISCONNECT",
        ".?AVCXXXXXHandledException@?2??ReconstructWindows@CReconstructOS@@IAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "7[8f8l8r8~8",
        "777C7K7R7X7^7i7y7",
        "0>1T1[1a1f1q1{1",
        "4(5C5",
        "pGetDumpTypeString",
        "Failed to copy ramdisk parent device string. Error: %d",
        "GDRDU",
        ".?AVCXXXXXHandledException@?GH@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "Cannot recover the system.",
        ".?AVCXXXXXHandledException@?2??RegisterRollbackOnlineUsr@CSetupPlatformRollback@@UAEJPBG0@Z@",
        "Source user remap approved environment is NULL, cannot continue.",
        "?Append@StringBuilder@UnBCL@@QAEPAV12@PBG@Z",
        "SPValidateProductKey: Failed to call PidGenX to validate product key",
        ":7:C:X:a:",
        "ITrigger::QueryInterface for IID_ITimeTrigger failed. hr = 0x%x",
        "NtDuplicateToken",
        "%hs: Cannot create the file verifier. Error: 0x%08X",
        "1 1(10181@1H1X1|1",
        ":%:8:=:F:b:i:p:{:",
        ".PAVCXXXXXHandledException@?MO@??Rollback@CSetupPlatformOSSwitchCheckpoint@@UAEXPBG@Z@",
        "SetupFindFirstLineW",
        ";.<D<S<",
        "Error while creating/opening the RemovedDrivers key. Error: 0x%08X",
        "ERROR_UNKNOWN_PROPERTY",
        ">R>b>i>o>t>",
        "dCFailForwardSystem::QueueDataMigration",
        "%hs: Adding reference file: %s",
        "OC::COCDismAdapter::EnableDisableOCs: Image is not serviceable; cannot proceed.",
        "{0A67BAC4-C53E-4012-A018-932163F62C88}",
        "Begin processing suspend policy",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class COperationsValidator *>::Reset(void)",
        "ERROR_REGISTRY_QUOTA_LIMIT",
        "2,272A2Y2`2q2|2",
        "8/858L8R8u8{8",
        "626\\6o6",
        "=$=,=D=L=d=l=t=",
        "FirstUXWndClass",
        "CSuspendBitlocker::DoExecute: Failed to store BitLocker Status",
        "Failed to get WIM attributes for %s. Error: 0x%08X",
        "?.?=?",
        "2'202S2",
        "SPProcessBitlockerOnDrives: Will attempt to %s bitlocker on %s",
        "??D?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEAAV?$ArrayList@PAVString@UnBCL@@@1@XZ",
        "<&<K<]<e<k<x<",
        "ProvisioningPackage::GetWimHandle",
        ":0:4:L:P:h:l:",
        "WilError_03",
        "y0WhN",
        "6%6=6x6",
        "%s(%d).%s",
        "CSetupAutomation::ResolveTarget: The override firmware type is %s (%u)",
        "VWjdY",
        "??7?$SmartPtr@VString@UnBCL@@@UnBCL@@QBE_NXZ",
        "D$0SVW",
        ">\">(>->8>D>k>u>",
        "POSTVALIDATION: Operations have been sorted again following a validator's request to retry, execution will continue.",
        "Error getting SR API. Error: 0x%08X",
        "SPCreateSnapshotWithScoping: Scope out [%s] from snapshot",
        ".PAVCXXXXXHandledException@?CD@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "<#<=<D<J<O<Z<l<t<",
        "ERROR_EAS_DIDNT_FIT",
        "void __thiscall UnBCL::ArrayList<class CRegCreationData *>::AddRange(const struct UnBCL::ICollection<class CRegCreationData *> *)",
        "?\"?4?I?Q?[?c?p?y?",
        "Splitting WIM file %s to %s",
        "HiveListEnumerator::UnloadHiveByNtPath",
        "t$4h<",
        "242@2`2h2p2x2",
        "{4277926B-6385-42E9-BBB5-F0D31D04DF37}",
        "060Z0z0",
        "=G=N=T=Y=d=n=",
        "%windir%\\Panther",
        "Restart Diagtrack service successfully",
        "U3U4@9H9M9S9b9u9}9",
        "?9?N?V?\\?e?{?",
        "=d=v=~=",
        "8.9J9`9",
        "Wait for cleanup thread abandoned.",
        "Successfully removed SR checkpoint %u",
        "9 9*949>9L9R9X9]9g9q9{9",
        "CRelocateOS: Cannot create %s. Error: 0x%08X",
        ".?AV?$ArrayListEnumerator@PAVSysprepComponent@@@_@UnBCL@@",
        "SpecialChars",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup\\Sysprep",
        "class UnBCL::String *__thiscall CDeploymentBase::GetStoredString(class UnBCL::String *)",
        "s|none|",
        "pExtractCrashDump: Found page file at %s; attempting to extract crash dump to %s",
        "Failed to get element data. Status = [%x]",
        "Persisting diagnostics data fails since not initialized",
        "SmPartition::GetProperties",
        "ERROR_IPSEC_IKE_INVALID_SITUATION",
        "10141L1P1h1l1",
        "3%4i4",
        "3;3C3P3d3r3",
        "8\"8(8-888I8Q8_8o8",
        ";#;:;Q;Y;v;",
        "3 3,3=3F3p3y3",
        "757_7f7l7q7|7",
        "Uninstall detected, performing validation, OS path: %s",
        "1 10141D1H1X1\\1l1p1",
        "void __thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,class UnBCL::DictionaryEntry<unsigned long,struct IVdsVDisk *>,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<unsigned long,struct IVdsVDisk *> __stdcall UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsVDisk *> > const *,struct __POSITION * const &)>::Reset(void)",
        "w,+w(",
        "ShTx`",
        "1d1v1~1",
        "?1?F?]?f?y?",
        "UploadEtlFileConsent",
        "3N6m6",
        "CSetupPlatformOSSwitchCheckpoint::Rollback: Attempting to remove folder \"%s\"",
        "305.1i%",
        "MachineSpecific",
        "0.0@0T0b0o0w0",
        "CNewSystem::QueueOperations: Dumptype: %u, Filterpages: %u will be generated in case of bugcheck",
        ".?AV?$Array@UDiskRange@@@UnBCL@@",
        ">!>*>@>N>g>n>u>|>",
        ">8>I>V>[>d>s>{>",
        "=+=E=`=",
        "5=5R5Z5`5m5",
        "7Q8]8",
        ">,>h>o>u>z>",
        ": :8:<:T:X:p:t:",
        "CSetupPlatformPrivate::Execute: Failed to delete %s. Error: 0x%08x",
        "3!3>3E3M3T3Z3_3j3u3",
        "FailedGetStableVolumeName",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *> *)",
        "=!=:=A=G=P=\\=g=o=u=",
        "6.7@7H7N7[7m7{7",
        "5.565<5I5[5i5",
        "Installing provisioning package: %s",
        ".?AVCXXXXXHandledException@?MG@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "CreateProcessW",
        "SPDeleteOldUpgradeSnapshots: %s %I64d space",
        "1,1\\1",
        "ERROR_DRIVERS_LEAKING_LOCKED_PAGES",
        "D$,u03",
        "    Failed to allocate spElementPath.get()",
        "8$8,848<8D8L8T8\\8d8l8t8|8",
        ".PAVCXXXXXHandledException@?CM@??SPFixupRelocatedFolders@@YGJPAV?$ArrayList@PAVString@UnBCL@@@UnBCL@@PAV?$ArrayList@PAVCOSPieceInfo@@@3@1PAVString@3@@Z@",
        "void __thiscall UnBCL::ArrayList<unsigned long>::QuickSort(class UnBCL::ArrayList<unsigned long> *,class UnBCL::ArrayList<unsigned long> *,int,int)",
        "CDiskReader::GetCurrentControlSet",
        "PWVh@",
        "6!6A6N6d6n6",
        "ERROR_IPSEC_IKE_SIMULTANEOUS_REKEY",
        "DrawTextW",
        "VdsDisk::Initialize: Failed to get provider properties (0x%08x)",
        "ERROR_CLUSTER_PARAMETER_MISMATCH",
        "SL_E_LICENSE_MANAGEMENT_DATA_NOT_FOUND",
        "=\"=0=>=",
        "OC::COfflineOCManager::GetOCStatus: Found and removed a duplicate OC (%s) in the list.",
        "config",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class DiskLayout *>::Reset(void)",
        "int __thiscall UnBCL::ArrayList<class COperationsValidator *>::BinarySearch(int,int,class COperationsValidator *,struct UnBCL::IComparer<class COperationsValidator *> *)",
        "FindNextVolumeW",
        "7$7,747<7D7L7T7`7",
        "OS partition info mismatch. Assuming partition was not extended.",
        "7%7.7L7Z7c7m7",
        "9$9,949<9D9L9T9\\9l9t9|9",
        ">&>,>1><>G>\\>o>v>|>",
        "class CImageInfo *__stdcall UnBCL::Try_Cast<classCImageInfo*,struct SetupPlatform::IImageInfo>(struct SetupPlatform::IImageInfo *)",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Failed to uncompress \"%s\", skip.",
        ".?AVCXXXXXHandledException@?2??ConfigureImageForRAMBoot@CAddSafeOSBootEntry@@IAEJPBG00H00PAU_GUID@@@Z@",
        ".?AVCOperationsValidator@@",
        "CApplyDrivers::CopyToDriverStore: Failed to get source inf enumerator; this is unexpected. Error: 0x%08X",
        "8\"8/848@8Q8X8e8u8",
        "GetFileAttributes(%s) failed: File not found.",
        "SysprepSession::CreateSession: Failed to allocate Sysprep session",
        "7&7g7",
        "7!7'7C7`7",
        "UNIQUE MATCH",
        "Microsoft\\Provisioning\\PackageLocations",
        "WVhP%",
        ";;;C;J;S;X;`;k;q;",
        "SclRegGetDWORD",
        "%hs: disable restore privilege",
        "BootLogErrorCount:%d",
        "3\"3/3A3O3\\3n3v3|3",
        ".?AUIDUObject@DU@@",
        "9#9+919>9N9U9\\9g9u9}9",
        ">'>4><>N>V>\\>n>",
        "ImpersonationCountInit",
        "GetSysVolRefNodePath",
        "ppscz",
        "373D3O3a3q3",
        "NtOpenThreadToken",
        "??1Win32Exception@UnBCL@@UAE@XZ",
        "partition format",
        "=)>P>k>|>",
        "SPCreateSnapshotWithScoping: Commit scoping",
        "CRYPT_E_NO_VERIFY_USAGE_DLL",
        "SPGetDiskSmartStatus",
        "0)0?0_0",
        "RPC_S_NO_INTERFACES",
        "SPTagTarget: Ignore tagging error as it's not critical",
        ".?AV?$DefaultInstanceFactory@VCSetupClRequest@@@UnBCL@@",
        "1\"1(1>1O1\\1j1",
        "Diagnostic file: %s",
        "ERROR_ELEVATION_REQUIRED",
        "void *const &__thiscall UnBCL::ArrayList<void *>::get_Item(int) const",
        "VRQPWWW",
        "j\\Yf9LP",
        ">\">6>^>o>{>",
        "(%lx): Failed to calculate full key for the new hive [%ws]",
        "{B085353D-AD98-4802-8BF1-D45F1EC5A63D}",
        "ERROR_CTX_SERVICE_NAME_COLLISION",
        "?Exists@File@UnBCL@@SGHPBVString@2@@Z",
        "8&888F8S8e8m8s8",
        "pCheckCanSetPartUsage: Can't query input parameters for MSFT_Partition.SetAttributes (0x%08x)",
        "SysprepSession::Execute: Failed while clear dynamic Store for offline OS; dwRet = 0x%x",
        "ERROR_DS_OBJECT_CLASS_REQUIRED",
        "ERROR_EVT_VERSION_TOO_NEW",
        "Failed to create wcp.dll path with %ws",
        "?L?|?",
        "ERROR_DS_CANT_DERIVE_SPN_FOR_DELETED_DOMAIN",
        "7\"747",
        "LogFileMode",
        ".?AV?$SmartPtr@V?$Hashtable@PAVString@UnBCL@@PAVCSPInternalPluginData@@@UnBCL@@@UnBCL@@",
        "ERROR_EVT_INVALID_CHANNEL_PATH",
        "XSPGetSnapshotCreationTimeFromVSS",
        "3 303@3P3`3p3",
        "Copy driver package payload from %s to %s",
        "u+jKh",
        "1#1(1W1o1-222f2",
        "9&9=9M9R9^9",
        "SleepConditionVariableSRW",
        ".PAVCXXXXXHandledException@?M@??QueueEnableFeature@CNewSystem@@UAEJPBGQAPBGI@Z@",
        "{07470B69-77CA-4B21-8D05-64F8A82FF143}",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::Add(class UnBCL::DictionaryEntry<class UnBCL::String *,long> *)",
        "Failed to get driver packages from the online system. Error: 0x%08X",
        "ServiceInfo is NULL, cannot fill in service information",
        "%hs: Failed to set BCDE_LIBRARY_TYPE_TRUSTED_OS_PARTITION_DEVICE field. Status = %d",
        "6#6P6",
        "4/4=4O4X4a4j4",
        "5#595W5n5y5",
        "52:2K2^2h2s2}2",
        "404Q4t4{4",
        "?.?;?O?Z?b?l?s?y?~?",
        ".?AUIDUDownloadProgress@SetupPlatform@@",
        "SP_ENV_ENABLE_FINALIZE_SNAPSHOT",
        "CInstallDUUpdatesOffline::DoExecute: This OS image does not support checking image health; skipping it.",
        "CAddAppxPackage::DoExecute",
        ".?AU?$IList@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@",
        "0;1M1U1[1h1z1",
        "6 6;6E6X6_6e6j6u6",
        "SclExtractSidSubString",
        "=#=*=4=E=R=\\=k=t=z=",
        "Binary path (WIN): %s",
        "232:2@2E2P2W2j2",
        "CSetupAutomation::Clone: Failed to get cloned deployment options: 0x%08x",
        "\\Device\\%s\\Partition%lu",
        "JET_errInvalidLCMapStringFlags",
        "CEnableSafeOSPageFile::DoExecute: Failed to determine page file requirements: 0x%08x",
        "717A7M7[7n7",
        "0,0c0r0",
        "6<6N6l6",
        "VdsPartition::Resize: Couldn't get volume object (0x%08x)",
        "3/4Y4",
        "int __thiscall UnBCL::Array<struct DiskMatchFilter>::Add(struct DiskMatchFilter)",
        "=\"=(=-=9=I=]=p=",
        "pLogUpdateInfo: IUpdate::GetHardwareID failed. hr = 0x%x",
        "void __thiscall UnBCL::ArrayList<class CBasicEnvEntry *>::Insert(int,class CBasicEnvEntry *)",
        "ERROR_EA_LIST_INCONSISTENT",
        "5.585K5S5Y5f5x5",
        "?(?-?7?[?u?",
        "969Q9U9e9n9z9",
        "9&929I9U9a9m9y9",
        ">.>@>O>_>l>x>",
        "5!5W5g5",
        "ar-SY",
        "int __thiscall UnBCL::ArrayList<class COperationResult *>::BinarySearch(int,int,class COperationResult *,struct UnBCL::IComparer<class COperationResult *> *)",
        "offline",
        "Executing uninstall gather",
        "6 636>6E6K6P6[6e6x6",
        "7$7*7/7:7D7W7\\7e7t7",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "6$6>6U6g6m6",
        "CAppXValidator::ValidatePreExecution",
        "Upload telemetry data based on environment variable",
        "0$0*070k0w0",
        "=$=0=8=T=\\=d=|=",
        "CNewSystem::QueueSetupAutomation: Failed to queue driver migration (0x%08X)",
        "6?6o6",
        "4D4[4b4}4",
        "??0?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAE@PAV?$Array@E@1@@Z",
        "71787L7d7n7",
        "SL_E_CHPA_INVALID_ACTCONFIG_ID",
        "404A4U4t4",
        "CertVerifyCertificateChainPolicy",
        "6.636?6F6V6b6n6}6",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,enum ActionType> __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,enum ActionType>,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,enum ActionType> __stdcall UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,class ATL::CElementTraits<enum ActionType> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "SWhx2",
        "PWhx`",
        "RollbackInitiatedBugCheckCode",
        "9-9:9G9Z9q9~9",
        "NtCreateFile",
        "CSetupAutomation::SuspendAndRelease: Failed to get full path to answer file: 0x%08x",
        "Force to delete all Upgrade snapshots",
        "2#2/282P2e2",
        "DRVMIG: Failed to reflect driver package in WinRE: %s.",
        "9G9N9T9Y9d9p9",
        "?WriteBytes@SerializationStream@UnBCL@@QAEXPBEH@Z",
        "class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::get_Item(int) const",
        "fYfYf3",
        ";0<F<\\<",
        "949G9V9d9q9z9",
        "\\Panther\\Dl-um.etl",
        "ERROR_DS_DSA_MUST_BE_INT_MASTER",
        "RtlAcquireResourceShared",
        "void __thiscall UnBCL::ArrayList<class CFilterDriverInfo *>::Insert(int,class CFilterDriverInfo *)",
        "pGetUninstallInterfaceCommon: Failed getting the uninstall interface, hr = 0x%x",
        "=8>t>",
        "CNewSystem::QueueRegisterAsyncProcess",
        "SelectObject",
        "<&<0<5<I<R<]<l<",
        "2!333;3A3N3`3n3",
        "?get_Source@Exception@UnBCL@@UBEPBVString@2@XZ",
        "5#5*545D5W5a5",
        "4\"4*414>4R4^4n4{4",
        "7\"7)7",
        "JET_wrnCommittedLogFilesRemoved",
        "1/171>1R1s1{1",
        "Failed to copy file %s, error code=%d",
        "SizeMax",
        "CAddProvisioningPackage::DoExecute: Failed to query whether %s has a value named %s",
        "ERROR_SXS_XML_E_INVALIDENCODING",
        "5&6:6Q6^6t6{6",
        "BitLockerOnRedirectedProfiles",
        "CCompleteFileOps::DoExecute",
        "FullDump",
        "en-AU",
        "CSetupAutomation::GetImageIndex: Failed to determine install image info: 0x%08x",
        ":&:,:1:<:C:S:\\:e:j:g;y;",
        "FindClose",
        "void __thiscall UnBCL::ArrayList<class CBcdSetting *>::set_Item(int,class CBcdSetting *)",
        "CSuspendBitlocker::DoExecute: Failed to suspend by final OS path %s: 0x%08x",
        "Info.OS",
        ".?AVCWIMPidgenxExtractor@@",
        "WinRE driver removal is active but not required, attempting to remove it",
        ".?AV?$SerializableBase@VCRemoveFODPackage@@$0A@V?$DefaultInstanceFactory@VCRemoveFODPackage@@@UnBCL@@@UnBCL@@",
        "6%6?6X6w6",
        "pDeterminePageFileRequirements: Need a total of %llu byte(s) for image apply",
        "7\"767F7M7S7X7c7q7y7",
        "3$3,343<3D3L3T3\\3l3|3",
        "=(=2=C=^=h=r=x=",
        "Creating/Setting FilterPages key  with %d",
        "7!7(7/7?7G7",
        ":*:5:?:O:T:`:n:u:",
        "  Initial decision for this driver: %s",
        "4#464=4C4H4S4^4r4",
        ">.>C>R>\\>a>i>p>|>",
        "void __thiscall UnBCL::ArrayList<void *>::QuickSort(class UnBCL::ArrayList<void *> *,class UnBCL::ArrayList<void *> *,int,int)",
        "VPQQQ",
        "9^0s69F8t",
        "6.6>6_6o6y6",
        ";%;-;=;E;Z;b;l;};",
        "7074787<7@7D7X7\\7d7h7p7x7|7",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@J@UnBCL@@@UnBCL@@@UnBCL@@",
        ".?AV?$ArrayList@PAG@UnBCL@@",
        "ERROR_CLUSTER_PROPERTY_DATA_TYPE_MISMATCH",
        "< <$<(<,<0<4<8<<<@<D<H<L<P<X<\\<`<h<p<t<x<|<",
        "void __thiscall UnBCL::ArrayList<class COperationsValidator *>::QuickSort(class UnBCL::ArrayList<class COperationsValidator *> *,class UnBCL::ArrayList<class COperationsValidator *> *,int,int)",
        "ERROR_DS_NOT_INSTALLED",
        "JET_errMissingPatchPage",
        "%17I64d",
        "CDownloadDUUpdates::MoveOrCopyUpdates: Fail to get CDUPackage",
        "ERROR_CTX_SHADOW_NOT_RUNNING",
        ".?AVCSetProductKey@@",
        "int __thiscall UnBCL::ArrayList<void *>::BinarySearch(int,int,void *,struct UnBCL::IComparer<void *> *)",
        "4;4H4U4p4}4",
        "414F4X4`4f4z4",
        "SL_E_CHPA_OVERRIDE_REQUEST_NOT_FOUND",
        "ERROR_OBJECT_IN_LIST",
        ".?AV?$CAutoRelease@PAUIDiskEnumerator@SetupPlatform@@@RAII@@",
        "1R1_1q1y1",
        ">%>@>F>P>U>_>f>t>",
        "1/1;1M1t1",
        ">7>`>",
        "Number of $Secure security descriptors processed",
        "2 2$2(2,20242<2T2X2p2t2",
        "RegValueEnumAction::Enumerate",
        "DismRemoveDriver",
        "Cleanup failed. hr = 0x%x",
        "ERROR_HANDLE_EOF",
        "RelocateOSExceptionList",
        ">)>1>;>B>H>M>X>f>l>",
        "%hs: Cannot create the IMG store. Error: 0x%08X",
        "647>7W7\\7a7m7}7",
        "class CAntiVirusInfo *__thiscall UnBCL::_::ArrayListEnumerator<class CAntiVirusInfo *>::get_Current(void) const",
        "ERROR_FAIL_REBOOT_REQUIRED",
        "(%lx): Failed to open PROFILELIST key.",
        "030n0w0",
        ":$:,:4:<:D:L:T:\\:d:l:t:|:",
        "ERROR_APP_WRONG_OS",
        "909>9w9",
        "??1ISerializable@UnBCL@@UAE@XZ",
        "=L>e>k>v>}>",
        "1;2K2k2z2",
        "CoTaskMemFree",
        "HeaderPresent:%d",
        "void __thiscall UnBCL::Array<struct DiskRange>::RemoveAt(int)",
        "4,4\\4c4i4n4y4",
        "=?=^=p=x=~=",
        "CMigrateBootSettings::DoExecute: An error occurred while migrating OS loader settings. Error: 0x%08X",
        "FONTS",
        "5+595C5L5U5^5g5p5",
        ";4;>;N;X;k;z;",
        "?'?5?;?A?F?P?Z?d?n?|?",
        ".PAVCXXXXXTemp@?OP@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "{af9b60a0-1431-4f62-bc68-3311714a69ad}",
        "CRemoveFODPackage::DoExecute",
        "    Failed to allocate spDestination.get()",
        "9 :1:B:O:[:m:t:{:",
        "ERROR_DS_NC_STILL_HAS_DSAS",
        ">8>?>G>L>W>f>p>",
        ">!>.>6>F>S>[>v>",
        "?E?M?d?|?",
        ";/;J;",
        "6'6.64696D6J6]6q6",
        "    Failed to write end document",
        "6$6,6<6D6L6T6d6t6|6",
        "SSSVS",
        "base\\ntsetup\\setupplatform\\lib\\src\\wimboot.cpp",
        "ERROR_DS_CROSS_REF_EXISTS",
        "void __thiscall UnBCL::ArrayList<class COperationResult *>::CopyTo(class UnBCL::Array<class COperationResult *> *,int) const",
        "VdsPartition::GetProperties: Couldn't allocate partition properties (0x%08x)",
        "===K=m=",
        "j\\j[j",
        "{00EC9EC2-0599-408F-BB4A-C8A18CFB8490}",
        "SPAPI_E_NO_CONFIGMGR_SERVICES",
        ".?AU?$IDictionary@W4OP_OPERATION_ID@@H@UnBCL@@",
        "MoveNext() called on invalidated enumerator",
        "%s: Exception while requesting registry info",
        "8\"8.838@8L8V8g8p8}8",
        "__thiscall UnBCL::ArrayList<__int64>::ArrayList(const struct UnBCL::ICollection<__int64> *)",
        ".?AV?$CAutoCleanupBase@PAV?$ArrayList@UDiskRange@@@UnBCL@@@RAII@@",
        "uProgressStartPhase",
        "?CreateTemporaryDirectory@Directory@UnBCL@@SGPAVString@2@XZ",
        "Failure while calling Transformer Commit. Error: 0x%08X",
        "RbTel-Merge.etl",
        "CRelocateOS: Can't find the new OS installation in %s",
        ";t04u",
        ".?AV?$HTEnumerator@KPAUIVdsVDisk@@UTableKey@?$Hashtable@KPAUIVdsVDisk@@@UnBCL@@V?$DictionaryEntry@KPAUIVdsVDisk@@@4@UKeyTraits@34@$1?RetrieveEntry@34@KG?AV54@PBV?$CAtlMap@UTableKey@?$Hashtable@KPAUIVdsVDisk@@@UnBCL@@PAUIVdsVDisk@@UKeyTraits@23@V?$CElementTraits@PAUIVdsVDisk@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "0#0D0Z0~0",
        "CDUPackage::UnpackTo: Failed to copy update contents to temporary location %s. hr = 0x%x",
        "MIG_USE_PROCESS_ENV",
        "9!939A9O9]9",
        "3(3,3D3H3`3d3|3",
        ":':3:?:K:W:c:o:{:",
        ".?AV?$SmartPtr@U?$IEnumerator@PAUIVdsDisk@@@UnBCL@@@UnBCL@@",
        "Failed to deserialize/execute post-OOBEBoot operations. Error: 0x%08X",
        "858I8V8g8{8",
        "Invoking NotifyUILanguageChange with upgrade flag turned %s",
        "8#878=8F8\\8j8",
        "<0<8<D<X<`<u<|<",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Failed to find system volume; hr = 0x%X",
        "RPC_X_WRONG_PIPE_ORDER",
        "CStoreHeaderWriterT<class CEmptyType>::PreWrite",
        "SPCalculateDriveMappings",
        "ERROR_DS_DRA_DN_EXISTS",
        "?GetBuffer@?$Array@G@UnBCL@@UAEPAGH@Z",
        "JET_errObjectDuplicate",
        "?TrimEnd@String@UnBCL@@QBEPAV12@PBG@Z",
        "j3j)jDj",
        "CEnableSafeOSPageFile::DoExecute: Cannot set %s [%s] value to filterpages to 1: 0x%08x",
        "Failed to save original correlation vector to file: %s. Error = %d",
        "CSetupPlatform::ResurrectAutomation: Failed to resurrect automation: 0x%08x",
        ";M;Z;r;};",
        "1,1<1L1P1T1l1|1",
        "?Clone@?$ArrayList@G@UnBCL@@UBEPAVObject@2@XZ",
        "7'8L8Y8p8",
        "5*575R5f5o5~5",
        "PartPath",
        ".?AVStringProperty@?1???$pDefineStringProperty@V<lambda_487069f17ac8e442cf35f8382c052b66>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_487069f17ac8e442cf35f8382c052b66>@@@Z@",
        "DiskLayout::ApplyProperties: Formatting volume (fs=%u)",
        "=#=,=9=B=K=T=]=i=u=",
        "void __thiscall UnBCL::ArrayList<struct DiskMatchFilter>::AddRange(const struct UnBCL::ICollection<struct DiskMatchFilter> *)",
        ";D$<s",
        "686E6]6",
        "7.7=7T7q7w7",
        "8 8$84888H8L8\\8`8p8t8",
        "COOBEBootApply::DoExecute",
        "5 5&5+535>5D5X5g5",
        "4,434:4A4H4O4U4`4{4",
        "4$4,484@4h4|4",
        "base\\ntsetup\\setupplatform\\lib\\src\\unattend.cpp",
        "1#2K2",
        "  Architecture = %d",
        "4&494U4\\4e4j4v4",
        "br-FR",
        "Complete new OS apply",
        "Deciding injection of external driver package:",
        "ERROR_SMARTCARD_SUBSYSTEM_FAILURE",
        "?get_Count@XmlAttributeCollection@UnBCL@@QAEHXZ",
        "0D0c0",
        ".?AV?$SerializableBase@VCWIMBootData@@$0A@V?$DefaultInstanceFactory@VCWIMBootData@@@UnBCL@@@UnBCL@@",
        "343K3Y3c3m3w3",
        "3(3:3H3]3b3n3u3",
        "OperationExecutedPhase",
        ".?AU?$ICollection@PAVCDeploymentBase@@@UnBCL@@",
        ".?AVCRemoveOSUninstall@@",
        "Reserved.DynamicUpdate.Langpack",
        "CSetupPlatformOSSwitchCheckpoint::Rollback: An error occurred while processing the NewOS setupapi log folder",
        "ERROR_FLOPPY_BAD_REGISTERS",
        "4<4[4",
        "Exporting split WIMs starting with file %s to %s",
        "6+676C6O6[6g6s6",
        "SetupGetLineTextW",
        "< <4<q<",
        ";!;3;B;O;_;d;p;",
        "SPWIMCallback",
        "0!0/0X0p0u0",
        "3<4H4P4Z4h4t4",
        "5%5+505;5E5X5d5v5",
        "?.?>?O?U?e?l?r?w?",
        "%hs: Created new BCD store; will not look for default or current entries.",
        "5$5+52595@5F5P5r5",
        "8x9p:h;`<X=P>",
        "C\\;G\\u",
        ":#;>;E;P;Z;l;t;~;",
        "1'1.14191D1Q1a1h1n1s1~1",
        "; ;,;8;D;P;\\;",
        "OOBE Boot",
        "Attempting to filter the update collection to optimize download",
        "LoadSMISettings: failed to deserialize settings stream; status 0x%08x",
        "<;=P=v=",
        "ERROR_EC_CIRCULAR_FORWARDING",
        "505A5N5Y5o5w5",
        "424C4\\4",
        "DtCSV",
        "3Z4h4",
        "Failed to coerce string.",
        "=#>_>",
        ".?AV?$DictionaryEntry@PAVCGlobalPath@@PAVCDriverInstallInfo@@@UnBCL@@",
        "File creation failed with error 0x%08X",
        "536E6L6b6o6~6",
        "2<3,5",
        "1'2Z2",
        "%hs: Failed to create directory %s",
        "Unexpected status or required buffer size. Required size: %ul Status: %x",
        "1!1B1_1",
        "7\\7a7g7",
        "FindWindowExW",
        ".?AV?$Array@PAUPageFileDesc@@@UnBCL@@",
        "7<7L7Q7Y7`7n7",
        "int __thiscall UnBCL::Array<struct UnBCL::ISerializable *>::Add(struct UnBCL::ISerializable *)",
        "Go back to UTC timestamp: 0x%S in filetime format",
        "9-9X9q9x9",
        "535`5u5",
        "pFindAndAddFiles",
        ".?AV?$CAutoCleanupBase@PAVSmVolumePathEnumerator@@@RAII@@",
        "DiskLayout::VerifyLayoutCreatedParams: Partition %u is newly created, but doesn't specify a partition type",
        ":#:,:6:B:N:Z:f:o:",
        "void __thiscall UnBCL::ArrayList<class CDUPackage *>::QuickSort(class UnBCL::ArrayList<class CDUPackage *> *,class UnBCL::ArrayList<class CDUPackage *> *,int,int)",
        "0-070L0T0Z0g0y0",
        "=#=*=1=7=C=W=e=s=",
        "Disabled",
        "Failed to query processes. Status: %x",
        "5&5:5D5",
        "Filter data is NULL, cannot validate migrated services",
        "7$7,7<7D7T7\\7d7t7|7",
        "Initialize Downlevel OC Store",
        "8.898U8_8",
        "OpenService(%s) failed with error %u",
        "CRelocateOS: Moving new OS piece from %s to %s",
        "=>=E=K=P=[=m=u=",
        "JET_errIndexTuplesOneColumnOnly",
        "5*515>5U5e5u5",
        "?Nullify@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV12@XZ",
        "1U3`4",
        "StorageTiering not supported",
        "Attempt to pop from empty stack",
        "j5j\\XPh0Z",
        "pl-PL",
        "172>2D2I2T2_2d2x2",
        ";\";?;F;",
        "CEnableSafeOSPageFile::DoExecute: Setting filterpages to %d",
        "ERROR_DS_NO_CHAINING",
        "=\"=6=?=K=R=X=]=i=s=",
        "1!1(151A1J1V1[1d1p1|1",
        "5'686H6k6",
        "6,727A7c7",
        "G$9G t",
        "?Sort@?$Array@PAVString@UnBCL@@@UnBCL@@SGXPAV12@@Z",
        "VWh\\.",
        "%s\\system32\\%s",
        "DismAddPackage",
        "{1838A7E2-55C8-42A6-BAF4-A143E721FECC}",
        "WcpInitialize",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class OSRollbackService::CCheckpoint *>::MoveNext(void)",
        "4@5`5",
        ":(:4:@:M:Y:e:q:}:",
        "Unattend processing result:",
        "Failed to create offline CBS session. hr = 0x%08X",
        "MulDiv",
        "%hs: Failed to remove unnecessary files. Error: 0x%08X",
        "CDUPackage::UnpackTo: Failed to get update type. hr = 0x%x",
        "V0WiW",
        "L$d_^[3",
        ">#>0>=>I>V>b>o>|>",
        "SmVolume::InitializeProperties: Couldn't allocate volume properties (0x%08x)",
        "COMPONENT_BASED_SERVICING_LOGFILE",
        ":&:D:T:d:q:}:",
        "3%3.373@3U3o3|3",
        "void __thiscall UnBCL::ArrayList<class SysprepComponent *>::RemoveAt(int)",
        "EnableDebugger: Failed to enable debugging for the WinPE entry. Status = 0x%X",
        ">->H>c>",
        "6-6Z6g6|6",
        "?%?9?D?L?\\?h?|?",
        "7&787F7S7e7m7s7",
        "IWbemClassObject has no __CLASS property",
        ".?AVCXXXXXHandledException@?2??SPShrinkPartition@@YGJH_K0@Z@",
        "?GetFileNameWithoutExtension@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        "BootLogInitCount:%d",
        "void __thiscall UnBCL::ArrayList<struct DiskLayout::Partition>::Insert(int,struct DiskLayout::Partition)",
        "7+757<7B7G7R7]7d7i7}7",
        ")VolumeName",
        ".PAVCXXXXXHandledException@?2??DoExecute@CExtractFilesFromWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ":N:`:h:n:{:",
        "1D1d1q1",
        "JET_errCannotIndex",
        "6$6-646A6M6V6b6g6p6|6",
        "GetDisk: Finished querying unallocated disks",
        "Driver",
        "3$4=4Q4^4j4",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCFilterDriverInfo@@@UnBCL@@@UnBCL@@",
        "SetStretchBltMode",
        "2!2+2A2O2Y2c2y2",
        "<D<|<",
        "PWVh0",
        "JET_errInvalidCreateDbVersion",
        "0(0<0L0l0t0|0",
        "> ?h?",
        "tn-ZA",
        "int __thiscall UnBCL::Array<class CDrvStoreProperty *>::Add(class CDrvStoreProperty *)",
        "1%11181>1C1O1a1u1~1",
        "0$0+050F0S0]0l0u0{0",
        "WinVerifyTrust",
        ".?AV?$SerializableBase@VCSysprepRespecialize@@$0A@V?$DefaultInstanceFactory@VCSysprepRespecialize@@@UnBCL@@@UnBCL@@",
        "Sh|\\c",
        "Download attempt %d of %d",
        ".PAVCXXXXXTemp@?BG@??QueueAddDriver@CNewSystem@@QAEJPBG000W4SP_ERROR_HANDLING@SetupPlatform@@@Z@",
        "Exception trying to create a profile for user. Will try again later.",
        ";$;(;,;0;8;\\;d;h;l;p;x;",
        "%s\\WindowsApps",
        "int __thiscall UnBCL::ArrayList<struct UnBCL::ISerializable *>::IndexOf(struct UnBCL::ISerializable *,int,int) const",
        "6*696@6I6N6[6k6u6",
        "OS partition after shrink:",
        "ERROR_DS_DRA_SECRETS_DENIED",
        "CBS_E_SOURCE_MISSING_FROM_WU_CAB",
        ".?AVString@UnBCL@@",
        "SmVolume::InitializeProperties: Failed to check whether volume hosts a Windows installation (0x%08x)",
        ":c;z;",
        "<4=C=N=g=r=",
        "7R7Y7w7",
        "BCDOBJECT=",
        "az-Latn-AZ",
        "void __thiscall UnBCL::ArrayList<struct _GUID>::AddRange(const struct UnBCL::ICollection<struct _GUID> *)",
        "TraceEvent",
        "%SYSTEMDRIVE%\\",
        "Uninstall is allowed",
        "Failed to write disable ShiftF10 value to %s. Error: 0x%08X",
        "CSetupAutomation::CacheInstallTarget: Couldn't match target disk to a host disk: 0x%08x",
        "AuditBoot",
        "ERROR_SERVICE_NOT_ACTIVE",
        "ZwOpenSymbolicLinkObject",
        "Disabling rollback, will %s remove rollback boot entry",
        "int __thiscall UnBCL::ArrayList<class CDeploymentBase *>::BinarySearch(int,int,class CDeploymentBase *,struct UnBCL::IComparer<class CDeploymentBase *> *)",
        "Failed to create compressed file %s. Error: 0x%08X",
        "5!5G5k5",
        "4A5H5N5S5^5k5",
        "D$tHP",
        "??0?$ICollection@E@UnBCL@@QAE@XZ",
        "8D9h9u9",
        "838N8i8",
        "  Found matching driver package in the current OS",
        "DeleteFileEx: Spoofing detected deleting [%s] -> [%s]",
        "SP_USER_MODE_PROVIDERS_DOWNLEVEL",
        "  GDR DU Revision = %d",
        ">%>=>x>",
        "Volume [%ws] is not an NTFS volume!",
        "ERROR_EXCEPTION_IN_RESOURCE_CALL",
        "FMIFS.DLL",
        ";#;(;2;9;?;E;P;[;`;t;",
        "void __thiscall UnBCL::Array<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::Insert(int,struct SPGetPartitionOrdinal::PartitionInfo)",
        "3:3N3i3",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Directory %s does not exist; looking for BT drive volume",
        "void __thiscall UnBCL::Array<class CCopyInfo *>::InitLarva(class UnBCL::ArrayList<class CCopyInfo *> *)",
        "JET_errTooManyOpenIndexes",
        "2'2-222F2O2^2r2y2",
        "ERROR_DS_AUTH_METHOD_NOT_SUPPORTED",
        "5+5E5L5R5W5b5l5",
        "6$696A6z6",
        "555?5",
        "Bugcheck driver downloaded",
        "3&303:3H3N3T3Y3c3m3w3",
        ".PAVCXXXXXTemp@?BA@??Rollback@CSetupPlatformApplyRollbackCheckpoint@@UAEXPBG@Z@",
        ">:?F?O?W?c?j?p?u?",
        "0#040Q0f0n0s0",
        "SPAPI_E_DI_POSTPROCESSING_REQUIRED",
        "CNewSystem::PreInitialize: Client requested to keep BitLocker active unconditionally, but the configuration cannot be auto-unlocked. Cannot continue",
        "<?<r<",
        "<,<?<K<]<{<",
        "=D=K=",
        ".PAVCXXXXXHandledException@?6??DoCommunication@CSetupPlatformPrivate@@UAEXXZ@",
        "5+5Z5",
        ".?AU?$ICollection@PAV?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *>::set_Item(int,class CDeviceIdDatabase::CDeviceInfoData *)",
        "SysprepComponent::CreateSysprepActionList: Invalid action node %s found for component %s",
        "VdsDisk::CreatePartition: Failed to get drive layout info (0x%08x)",
        "0,0@0T0\\0d0l0t0|0",
        "ERROR_WRONG_EFS",
        "Failed allocating new windows sxs path",
        "y&Sjq",
        ".?AV?$SerializableBase@VCShellFolderInfo@@$0A@V?$DefaultInstanceFactory@VCShellFolderInfo@@@UnBCL@@@UnBCL@@",
        "%hs: Internal structure is incorrect for operation %u",
        "2&2.2;2C2h2p2z2",
        "VdsPartition::CreateLogicalPartition: Can't find the logical partition that was just created",
        "Failed to create file %s. hr = 0x%08X",
        "SmPlatformDiskEnumerator::ConstructVirtualDisk: Couldn't initialize disk (0x%08x)",
        "9H9q9",
        "Verbose: Processing OS WIM file: %s",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@GG@UnBCL@@@UnBCL@@",
        "VdsVolume::Format: Failed to get parent partition properties (0x%08x)",
        "<%<5<I<~<",
        "5$50585\\5d5l5t5",
        ";8;D;L;d;l;",
        "BfsChkDsk: %ws",
        "%hs: '%s' still not running, waiting 3 sec...",
        "int __thiscall CDeploymentBase::IsOperationPresent(class COperationQueue *,enum OP_OPERATION_ID,const unsigned short *)",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@J@UnBCL@@@UnBCL@@",
        "\"))) and ",
        "6 636;6B6P6Z6_6s6{6",
        "0&0.0B0J0",
        ":$:,:4:<:D:L:T:d:l:t:",
        "NtQueryVolumeInformationFile",
        ">3>;>A>N>]>v>",
        "WVh$'",
        "ERROR_BACKUP_CONTROLLER",
        "JET_errDatabaseIncompleteUpgrade",
        "sWINDOWS\\Boot",
        "\\Partition0",
        "2 232?2L2X2h2t2",
        "<*=1=O=V=4>q>",
        "PartA_PrivTags",
        "4-4B4H4_4f4l4q4|4",
        "415=5O5z5",
        "=#=I=\\=a=",
        "2.2M2{2",
        "list<T> too long",
        "__thiscall UnBCL::ArrayList<class CBasicEnvEntry *>::ArrayList(const struct UnBCL::ICollection<class CBasicEnvEntry *> *)",
        "CMediaLayout::QueueInstallImage: Failed to update image path in answer file: 0x%08x",
        "?W?^?|?",
        ".?AV?$DefaultInstanceFactory@VCTelemetry@@@UnBCL@@",
        "1 1$14181H1L1P1T1X1`1d1h1p1x1",
        "ERROR_UNEXP_NET_ERR",
        "void __thiscall UnBCL::Array<class CGlobalPath *>::InitLarva(class UnBCL::ArrayList<class CGlobalPath *> *)",
        "CSetupPlatform::GetClientDUPackages: DU initialization failed. hr = 0x%x",
        "SmPoolDisk::GetProperties: Couldn't allocate disk properties (0x%08x)",
        "Finding the name of the Foundation package...",
        "? ?(?0?<?D?\\?t?|?",
        "JET_errColumnLong",
        "    Failed to retrieve metadata file",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCAppInfo@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCAppInfo@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        ";+;O;a;i;o;|;",
        "No source OS pieces found, we'll try to continue",
        "No available test hook.",
        "%hs: Failed to suspend bitlocker on some drives. Result: 0x%08X",
        "ERROR_PATCH_REMOVAL_UNSUPPORTED",
        "ERROR_CS_ENCRYPTION_NEW_ENCRYPTED_FILE",
        "__thiscall CCompressWIMBootFiles::CCompressWIMBootFiles(const unsigned short *,const unsigned short *,const unsigned short *,class UnBCL::ArrayList<class CWIMBootData *> *,int,enum OP_OPERATION_ID)",
        "5%626D6L6R6_6q6",
        "8H8f8p8|8",
        "=\">B>n>",
        "setup.exe",
        "LDM metadata partition",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCFileCreationData@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "Failed to get bootmgr element. Status = [%x]",
        ".?AV?$SerializableBase@VCSplitWIM@@$0A@V?$DefaultInstanceFactory@VCSplitWIM@@@UnBCL@@@UnBCL@@",
        "    Failed to assemble source path (index)",
        ";&;,;1;<;J;^;",
        "3$3t3z3",
        "7'8,8b8q8",
        "4%444A4I4S4Y4h4",
        "int __thiscall UnBCL::Array<class OC::COptionalComponent *>::Add(class OC::COptionalComponent *)",
        "242m2s2~2",
        "=(=A=W=b=r=|=",
        "8)878Z8v8",
        "0 0)050A0F0O0V0c0o0x0",
        "8.8G8]8n8",
        "5%5+51575=5C5I5O5U5[5a5g5m5s5y5",
        "242<2D2L2T2\\2d2l2t2|2",
        "Failed to query boot options. Status: %x",
        "2 2&2:2@2I2_2l2~2",
        "COperationQueue::Remove",
        "SPAllocateRange: No viable region to allocate %llu bytes",
        "OSRollbackService::CCheckpoint::MoveOrCopyDirectory: failed to recover files from \"%s\"",
        "SysprepComponent::CreateSysprepActionList: The component node is invalid; this is unexpected",
        ">3>e>",
        "ERROR_DS_DUP_SCHEMA_ID_GUID",
        "4 525A5Q5^5i5y5",
        "Failed to remove 1st boot completed journal, error: 0x%08X. Error is fatal.",
        "SclpUefiRefreshDiskBootConfig",
        "upgradeagent.xml",
        ": :(:,:0:8:<:@:H:L:P:X:\\:`:h:l:p:x:|:",
        "CDeploymentProject::CreateBootableMediaDeployment: Failed to get target volume properties (0x%08x)",
        "0(0<0L0\\0r0y0",
        "SPFindVssSnapshot",
        ".?AU?$IEnumerable@W4OP_OPERATION_ID@@@UnBCL@@",
        "Client requested to keep BitLocker active unconditionally, and the device supports it. Will keep BitLocker on.",
        "COperationQueue::AddExecutionPhase",
        "void __thiscall UnBCL::Array<unsigned long>::Insert(int,unsigned long)",
        "6D6U6\\6d6i6y6",
        ".?AV?$SerializableBase@VCImageInfoSet@@$0A@V?$DefaultInstanceFactory@VCImageInfoSet@@@UnBCL@@@UnBCL@@",
        "ERROR_CLUSTER_RESTYPE_NOT_SUPPORTED",
        "Failed to get a handle to the system store. Status = [%x]",
        "7$7<7D7L7d7l7t7|7",
        "0$060G0N0\\0t0{0",
        ".?AV?$DefaultInstanceFactory@VCValidateSafeOS@@@UnBCL@@",
        "%hs: Failed to retrieve BCDE_BOOTMGR_TYPE_DISPLAY_ORDER field. Status = %d",
        "8$8)848B8H8\\8|8",
        ":,:H:`:",
        "9/9I9",
        "DiskInitialize: Failed to bring disk online (0x%08x)",
        "XpGetCustomWIMBootSize",
        "0\"171O1h1}1",
        "2(2@2F2\\2p2}2",
        ";#;8;A;Y;~;",
        "2:3A3G3L3W3a3f3z3",
        "QSjzjSjd",
        ">\">0>P>k>q>{>",
        "0\"000>0L0Z0",
        ".?AV?$SerializableArrayBase@PAVCFailForwardSystem@@@_@UnBCL@@",
        "diagER.dll",
        "?GetFullPath@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        "JET_errFileIOSparse",
        "?$?0?8?`?h?p?",
        "CreateDIBitmap",
        "%hs: LoadLibraryEx failed. Error: 0x%08X",
        "3H3|3",
        "QSj[jxjd",
        "    Failed to set directory attributes to normal",
        ".PAVCXXXXXHandledException@?GO@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "4$4,444<4D4L4T4x4",
        ".?AU?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@@UnBCL@@",
        "__thiscall UnBCL::ArrayList<class OSRollbackService::CCheckpoint *>::ArrayList(const struct UnBCL::ICollection<class OSRollbackService::CCheckpoint *> *)",
        "0\\0`0d0",
        ":1:;:G:[:f:s:",
        "1)171",
        ">$?:?L?Y?",
        "Framework gather",
        "class CSetupPlatform *__stdcall UnBCL::Try_Cast<classCSetupPlatform*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "1 1&1+161A1U1j1~1",
        ": :-:9:P:\\:i:u:",
        "class CDUPackage *const &__thiscall UnBCL::ArrayList<class CDUPackage *>::get_Item(int) const",
        "GetSystemDirectoryW",
        "%hs: Circular dependency detected. Operations:",
        "?#?,?1?9?F?Z?h?q?",
        "C,;F,tLR",
        "A reboot was%s requested by pass %s",
        "SclpGetVolumeDiskExtents",
        "ERROR_SXS_XML_E_COMMENTSYNTAX",
        "upj\\XP",
        "No device IDs found in driver package %s, but it but it has a DefaultInstall section",
        "LP Validator: Opening DISM session for the source system (Online)",
        "The version of the current (host) OS is [%u.%u]",
        "JET_errSessionSharingViolation",
        "SmVolume::InitializeProperties: Failed to get parent partition properties (0x%08x)",
        "Found inbox support for compatible ID: %s",
        "9&9<9N9V9\\9i9{9",
        "Store %s is the system store",
        "FirstUXWndRefCount",
        "8$8+84898G8S8j8~8",
        "PVWhr",
        "CSetupPlatform::DownloadDynamicUpdates: DU initialization failed. hr = 0x%x",
        "Error copying font files from %s to %s.Last Error = %#x",
        ".?AU?$ICollection@PAVCProfileInfo@@@UnBCL@@",
        "ERROR_DS_BAD_NAME_SYNTAX",
        "4'4D4Z4y4",
        "1;1N1U1[1`1k1v1{1",
        ".?AV?$CAutoCleanupBase@PAVIUpdateReserveManager@@@RAII@@",
        "VdsPartition::Resize: Requested size outside resize bounds (0x%08x)",
        ">!>5>=>D>R>f>r>",
        "%hs: SPExtendPartition failed. Error: 0x%08x",
        "ERROR_IPSEC_TRANSPORT_FILTER_EXISTS",
        "void __thiscall UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *>::CopyTo(class UnBCL::Array<class CDeploymentBase::CMountedPathInfo *> *,int) const",
        "CBS_E_WINDOWS_AUTOMATIC_UPDATE_SETTING_DISALLOWED",
        ".?AUIDUDownloadProgressCallback@DU@@",
        "void __thiscall UnBCL::ArrayList<class COperationsValidator *>::Insert(int,class COperationsValidator *)",
        "3*3>3R3X3f3m3w3",
        "class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::get_Item(int) const",
        "=*=/=5=?=c=",
        "    Failed to allocate _spFileSearchPath.get()",
        "ERROR_CLUSTER_NULL_DATA",
        "8 949<9D9L9T9`9h9",
        "%hs: User %s%s%s%s from the new system does not have a profile on the old OS. Will not be restored.SPDoEndInstallApply",
        "ERROR_ACTIVATION_COUNT_EXCEEDED",
        "8-9Q9\\9W:j:",
        ".?AV?$SerializableBase@VCAddCbsPackage@@$0A@V?$DefaultInstanceFactory@VCAddCbsPackage@@@UnBCL@@@UnBCL@@",
        "t:SSSj",
        "ERROR_ROLLBACK_TIMER_EXPIRED",
        "int __thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,unsigned long,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,&protected: static unsigned long __stdcall UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsDisk *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "Disk number: %d",
        "CreateHardLinkW",
        "9'929C9P9[9l9u9",
        "9(:/:5:::E:O:T:h:",
        "838e8",
        "848J8\\8d8j8w8",
        "VdsPartition::SetType: Expected a GPT disk, got %u",
        "6 6$6(60646@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6",
        "ERROR_NETWORK_BUSY",
        "CAddUnattend::DoExecute: Failed to apply answer file settings (0x%08x)",
        "7!8D8I8S8r8",
        "void __thiscall UnBCL::Array<class CPartitionInfo *>::InitLarva(class UnBCL::ArrayList<class CPartitionInfo *> *)",
        "CSetupRollbackService::GetInstance service was already initialized",
        "<&=L=S=Y=^=i=r=z=",
        "CBS_E_INVALID_RECALL",
        "Time spent processing volumes (in ms)",
        "Path1",
        "GetFileSystemFlags",
        ".?AVCXXXXXHandledException@?CN@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "1*171<1P1d1w1~1",
        "void __thiscall UnBCL::Array<class CBcdSetting *>::Insert(int,class CBcdSetting *)",
        "0 0B0",
        ".?AUIVolume@SetupPlatform@@",
        "class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *const &__thiscall UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::get_Item(int) const",
        "CCreateScopedSnapshot::DoExecute: Failed to compate Upgrade snapshot. Error: 0x%08X",
        "Software\\Microsoft\\Windows NT\\CurrentVersion\\DefaultProductKey",
        "OC::CCmdLineManager::RunCmdLine: Process timed out",
        "3!3.393C3K3Q3e3l3q3",
        ".PAVCXXXXXHandledException@?5??SPCreatePartition@@YGJH_K0HPA_K@Z@",
        "=)>0>6>;>G>Q>d>{>",
        ".?AV?$DefaultInstanceFactory@VCExecuteUnattend@@@UnBCL@@",
        ":(;5;M;",
        "pSPDeleteExpiredUpgradeSnapshots: Force to delete snapshot [%s]",
        "ERROR_CLUSTER_RHS_FAILED_INITIALIZATION",
        "profapi.dll",
        "uk-UA",
        ">4>;>A>F>Q>X>h>v>{>",
        "4V5r5",
        "?0?7?>?I?S?f?",
        "<+<<<E<",
        "RPC_S_CALL_FAILED",
        "VdsPartition::GetProperties: Failed to query IID_IVdsVolume interface [%s] (0x%08x)",
        "%-10ws%ws",
        "CApplyDrivers::CopyToDriverStore: Failed to get required function pointers in %s. Error: 0x%08X",
        "void __thiscall UnBCL::ArrayList<struct DiskLayout::Partition>::AddRange(const struct UnBCL::ICollection<struct DiskLayout::Partition> *)",
        "=hK2/;",
        "Name=%s",
        "%s\\%s\\%s.mui",
        "Conversion to NT path failed for %s. Error: 0x%08X",
        ">+>E>`>",
        "Failed pushing parent delimiter",
        "; ;&;7;P;^;w;",
        "JET_errCommittedLogFileCorrupt",
        "ReadOrWriteSectorsWinNt: Couldn't %s [%u] bytes",
        "?Clone@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAVObject@2@XZ",
        "ERROR_LOG_INCONSISTENT_SECURITY",
        "ProfileInterval",
        ":\":/:;:P:g:o:",
        "__thiscall UnBCL::ArrayList<class CPartitionInfo *>::ArrayList(const struct UnBCL::ICollection<class CPartitionInfo *> *)",
        "LP Validator",
        "CreatedSnapshotsNumber",
        "VERBOSE: Validator asked to be removed: %s (%s)",
        "Initialize Installed OC Store",
        "j:Yf9H",
        ".?AU?$IList@PAVCCleanupEntry@CSimpleCleanup@@@UnBCL@@",
        "void __thiscall UnBCL::Array<class CImageInfo *>::Remove(class CImageInfo *)",
        "D$,QPj",
        "151P1a1",
        "2J2u2",
        ".?AVCXXXXXHandledException@?2??DetectDefaultInstallSection@CInfFile@@KGJPBGPAVTARGET_INFO@@PAH@Z@",
        "j\\^f;p",
        "2\"2,2=2E2g2o2",
        "0+0T0",
        ".?AV?$SerializableBase@VCSetupRecoveryPartition@@$0A@V?$DefaultInstanceFactory@VCSetupRecoveryPartition@@@UnBCL@@@UnBCL@@",
        "40484>4H4R4j4",
        "CInstallDUUpdatesOffline::FindUpdates: Malformed line found in updates section: %s",
        "1#2^2",
        "RegValueRenameCount",
        "<$=6=>=D=Q=c=s=",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Failed removed the system BCD store which is created for rollback only, status = 0x%x.",
        "3-3F3Z3o3~3",
        ":&;3;Q;];o;",
        "506p6",
        "2\"2(222T2f2t2",
        "ERROR_DS_NCNAME_MISSING_CR_REF",
        "Rollback: Force untag and delete reserves for Uninstall on %s",
        "ERROR_CLUSTER_OLD_VERSION",
        "int __thiscall UnBCL::Array<unsigned int>::Add(unsigned int)",
        "Failed to enumerate under [%s]. Error: 0x%08x",
        "y+VhD",
        "pFindAndAddFiles: Failed to build correct directory name for %s; Error: 0x%08X",
        "CAddProvisioningPackage::DoExecute: Failed to initialize DISM. Error: 0x%08X",
        "5%5-5?5G5M5_5p5y5",
        "0>1v1}1",
        "9):C:K:T:h:o:y:",
        "RunTime",
        "=9>@>F>K>V>e>m>s>",
        "?#?5?H?Z?b?h?u?",
        "D$8h!@",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CBasicEnvEntry *>::Reset(void)",
        "DecodeChunk",
        "CSysprepSpecializeOffline::DoExecute: Cannot load software hive for offline OS %s. Error: 0x%08X",
        "NewOSDir",
        "818C8K8W8o8{8",
        ":5:R:l:",
        "iu-CA-Latn",
        "1$161G1T1`1q1z1",
        "- Exit Code: %u",
        ";9;A;V;m;s;~;",
        "  Final decision for this driver: %s",
        ".?AVCXXXXXHandledException@?2??DoExecute@CSaveBootEntriesOldOS@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "9T$4~:",
        ":;;e;",
        "252S2",
        "6=7O7f7",
        "< >h?",
        ".?AV?$SmartPtr@VCGenericExecutionContext@@@UnBCL@@",
        "ERROR_PATCH_PACKAGE_OPEN_FAILED",
        "ERROR_DS_DRA_OUT_OF_MEM",
        "1,131<1A1N1^1h1",
        "~u@h>",
        "CReconstructOS::ReconstructWindows: ::ReconstructWindows failed: 0x%08x",
        "0K0~0",
        "9L$@u",
        "Failed to create system store path. Status: %x",
        "DU UpdateType: %s",
        "LaunchNarrator",
        "ReadMetaDataBuffer",
        "> >t>",
        "CMediaLayout::ExecuteOptimization: Failed to query selected image: 0x%08x",
        "external",
        "__thiscall UnBCL::ArrayList<class COperation *>::ArrayList(const struct UnBCL::ICollection<class COperation *> *)",
        ".?AVStringProperty@?1???$pDefineStringProperty@V<lambda_c99211e22c07b49b36bda6d406f2431b>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_c99211e22c07b49b36bda6d406f2431b>@@@Z@",
        ".?AV?$HTEnumerator@KPAUIVdsDisk@@UTableKey@?$Hashtable@KPAUIVdsDisk@@@UnBCL@@V?$DictionaryEntry@KPAUIVdsDisk@@@4@UKeyTraits@34@$1?RetrieveEntry@34@KG?AV54@PBV?$CAtlMap@UTableKey@?$Hashtable@KPAUIVdsDisk@@@UnBCL@@PAUIVdsDisk@@UKeyTraits@23@V?$CElementTraits@PAUIVdsDisk@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "=+=:=J=Q=W=\\=g=q=",
        "%s\\System32\\Drivers\\%s",
        "3V3l3{3",
        "SPFindAndUnloadHive",
        "class CFileCreationData *const &__thiscall UnBCL::ArrayList<class CFileCreationData *>::get_Item(int) const",
        ".PAVInvalidCastException@UnBCL@@",
        "0$0(0,00080T0X0\\0`0h0",
        "383X3x3",
        ".?AU?$IEnumerable@G@UnBCL@@",
        "BFSVC Warning: %s",
        "    Failed to allocate spFile.get()",
        "5 5(5,54585@5D5L5T5X5\\5`5d5l5p5t5x5",
        "Sources\\RegistryData",
        "pFindAndAddFiles: Failed to add %s to file list; Error: 0x%08X",
        "class CFilterDriverInfo *const *__thiscall UnBCL::ArrayList<class CFilterDriverInfo *>::GetBuffer(int) const",
        "map/set<T> too long",
        "FindVolume: Successfully found [%s] on drive [%c:]",
        "?#?3?@?L?\\?i?u?",
        "ERROR_CLUSTER_NODE_EXISTS",
        "ERROR_CLUSTER_QUORUMLOG_NOT_FOUND",
        ":&:2:F:d:r:~:",
        "313?3b3w3",
        "9*9;9A9S9^9h9x9}9",
        "smn-FI",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@W4SYNCEXEC_PHASE@SetupPlatform@@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@@_@UnBCL@@",
        "PQj2Z",
        "    Inbox support (WinPE): %s%s",
        "y Vhe",
        "6+686?6V6b6r6z6",
        "jxj0h",
        "(%lx): Value info buffer contains invalid offsets",
        "CoInitializeSecurity",
        "t$ h0",
        "1,1:1X1q1",
        "Failed to create instance AntiVirusProduct",
        "? ?$?(?,?8?<?@?D?H?L?P?T?X?\\?`?d?h?l?p?t?|?",
        "%hs: WIM image loaded.",
        "6)646D6N6`6h6n6x6",
        "Add boot entry for %s. Locale = %s",
        ";6;s;",
        "DiskLayout::Populate: Failed to enumerate over existing partitions: 0x%08x",
        "9P9W9^9i9s9",
        "6/676L6T6Z6p6v6",
        "WinREPhaseEndTime",
        "9'9,979N9U9g9z9",
        "Component update %s will not be extracted; we'll estimate the recommended hard disk space at [%ld] MB",
        "SPTaskRemoveSnapshot: Failed to initialize COM. Error: 0x%08X",
        "int __thiscall UnBCL::ArrayList<class DiskLayout *>::IndexOf(class DiskLayout *,int,int) const",
        "ERROR_DELAY_LOAD_FAILED",
        "CUpdateBootCode::DoExecute: Detect corruption error.",
        "1\"232:2A2L2\\2p2",
        "ERROR_CANT_RESOLVE_FILENAME",
        "Hash time: %lld ms",
        "pAddOSPiece",
        "                                   Manufacturer: %s",
        "int __thiscall UnBCL::ArrayList<unsigned char>::IndexOf(unsigned char,int,int) const",
        "7 7,7>7S7b7l7q7y7",
        "CExecuteUnattend::DoExecute: Unattend result indicates deserialize failure: 0x%08x",
        ".?AVCRemoveWIMBootEntries@@",
        "HPRh<",
        ">(>9>@>\\>c>i>u>",
        "DiskLayout::ApplyProperties: Failed to set volume drive letter: 0x%08x",
        "DriverStoreFindW",
        ".PAVCXXXXXHandledException@?2??DoExecute@CMergeWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "%hs: rollback boot entry references removed successfully",
        "int __thiscall UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *>::LastIndexOf(class CDeploymentBase::CMountedPathInfo *,int,int) const",
        "DUDownloadFailedReason",
        "struct UnBCL::ISerializable *__thiscall UnBCL::_::ArrayListEnumerator<struct UnBCL::ISerializable *>::get_Current(void) const",
        "%hs: Failed to copy \"%s\" to \"%s\", what to do?, skip.",
        "4 404@4P4`4d4t4x4",
        "Failed creating source software hive path name %ls\\SYSTEM",
        "0 0'0-020=0D0T0]0f0k0",
        "%hs: Serializing operations queue...",
        "OC Validator: Execution of OC gather operation completed.",
        ".?AU?$IList@PAVCWIMBootData@@@UnBCL@@",
        "CDownloadDUUpdates::CalculateSpaceNeeded",
        ".?AVCProvisioningPackage@@",
        "4 484<4T4X4p4t4",
        ":H:V:_:h:v:",
        "%hs: Target path: %s",
        "VdsPartition::RefreshVdsProperties: Couldn't find current extent (offset %llu) on the disk (0x%08x)",
        "ERROR_IPSEC_TUNNEL_FILTER_NOT_FOUND",
        ".?AV?$DefaultInstanceFactory@VCTrustSafeOS@@@UnBCL@@",
        "2;2B2X2_2n2u2",
        "JET_errCannotMaterializeForwardOnlySort",
        "Auto-start services have already been started",
        "Key CollectTrace is not available.",
        "??1ArgumentNullException@UnBCL@@UAE@XZ",
        "int __stdcall OC::OCRestoreStatus(class UnBCL::String *,class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::String *)",
        "??0?$Array@E@UnBCL@@QAE@PBU?$ICollection@E@1@@Z",
        "SEH: Enter CExceptionHandler::~CExceptionHandler",
        "242;2A2F2Q2X2l2",
        "ERROR_EXE_MACHINE_TYPE_MISMATCH",
        "SETUPEXECUTE",
        "ERROR_NOTIFY_CLEANUP",
        "020?0K0R0^0e0n0y0",
        "8+8?8S8g8{8",
        ">!>/>E>J>X>",
        "?)?1?7?D?V?d?{?",
        ".?AV?$CAutoDeleteArray@E@Mig@@",
        "CSysprepRespecialize::DoExecute: Failed to determine whether system services have started. Error: 0x%08X",
        "687]7s7{7",
        ".?AVCXXXXXHandledException@?BA@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "    Existing path is not a directory",
        ">T?y?",
        ";8;];g;w;",
        "WdsTerminate",
        "2!2*2<2K2R2Z2_2l2w2",
        "7$707T7\\7d7l7t7|7",
        "6#6)6.696D6X6",
        "%hs: Cannot queue data migration. Error: 0x%08X",
        "BFSVC Error: %s",
        ".?AU?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@@UnBCL@@",
        "4)454;4A4P4g4w4",
        ".?AVSysprepComponent@@",
        "ERROR_BAD_ARGUMENTS",
        "1/161<1A1L1W1k1}1",
        "??1TimeSpan@UnBCL@@UAE@XZ",
        "RtlAllocateAndInitializeSid",
        "080^0m0~0",
        "SPStartUserModeTracing",
        "Starting service",
        "j\\^f9_",
        "VdsPartition::GetVolume: Failed to query IID_IVdsVolume interface [%s] (0x%08x)",
        "ERROR_IPSEC_IKE_PROCESS_ERR_NATOA",
        "Download succeeded; will skip subsequent attempts.",
        "?Append@MutableString@UnBCL@@QAEXG@Z",
        "Service %s is still stopped, probably stopped automatically",
        "ERROR_LOG_METADATA_FLUSH_FAILED",
        "pGetExistingPageFiles: Failed to get current control set (0x%08x)",
        "QhP\\?",
        ".?AVCStoredPath@@",
        "    Failed to allocate _spElementIndex.get()",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::LastIndexOf(class UnBCL::DictionaryEntry<unsigned short,unsigned short> *,int,int) const",
        "Creating object. Version: %d. Type: 0x%08x",
        "SEH: Exception handler not active; allowing default handling.",
        "7%7,777I7Q7W7\\7p7",
        "%hs: Rollback in system context will not be registered.",
        "JET_errDatabaseInconsistent",
        "8,8;8K8X8c8s8|8",
        ".PAVCXXXXXTemp@?3??RegisterRollbackOnlineSys@CSetupPlatformRollback@@UAEJPBG0@Z@",
        "tmpgfile.sys",
        "1%2,2|2",
        "WIM file is on the OS volume, removing it after apply.",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::Resize(int,int)",
        ".PAVCXXXXXHandledException@?2??DoExecute@CUnmountWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ":@:M:n:{:",
        "sCOperation::StreamRead",
        "9\\$`t",
        ".?AVCXXXXXHandledException@?BOL@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "838@8E8J8e8o8v8|8",
        "NtSetBootEntryOrder",
        "8*8B8N8p8",
        "=G=Z=m=",
        ".?AVCSPPluginData@@",
        "343@3H3`3",
        "2 2,2;2@2L2S2c2o2{2",
        "void __thiscall UnBCL::Array<class CFailForwardSystem *>::Remove(class CFailForwardSystem *)",
        "Failed to write disabled rollback value to file: %s. Error = %d",
        "Failed to create store. Status: %x",
        ".050;0@0K0U0h0",
        "Setting environment variable to migrate users offline: %s",
        "void __stdcall UnBCL::_::HTEnumerator<enum OP_OPERATION_ID,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable<enum OP_OPERATION_ID,int>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<enum OP_OPERATION_ID,int> *,class UnBCL::Array<int> *,int)",
        ".?AU?$ICollection@PAVCDUPackage@@@UnBCL@@",
        "CUpgradeSecurity::DoExecute",
        "ERROR_EVT_PUBLISHER_DISABLED",
        "    Failed to get number of elements",
        "ERROR_DS_CHILDREN_EXIST",
        "7(7<7F7W7a7q7y7",
        "ERROR_DS_UNKNOWN_ERROR",
        ".?AVCXXXXXHandledException@?HD@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "<X<e<}<",
        "FltCommVerifyFilterPresent",
        "Failed to open handle to the OS loader object. Status = [%x]",
        "CSetupPlatform::Initialize: StartUserModeTracing failed; hr = 0x%08X",
        "SL_E_SFS_BAD_TOKEN_NAME",
        "070=0C0I0O0",
        "CEnableSafeOSPageFile::DoExecute: Failed to set NtSetSystemInformation for full memory dump: 0x%08x",
        "TraceMessage",
        "bootmgr.exe",
        "?)?/?E?Y?f?n?",
        "767J7R7e7x7",
        "3!313B3J3e3{3",
        "OCStatus.dat",
        "5(5G5N5T5`5l5x5",
        "BcdCopyObjectEx: Failed to get object description Flags: 0x%x Status: %x",
        "XSPMergeDiagnosticsData",
        "6%6/6=6Q6",
        ":V:o:t:",
        "Failed to QI for ICbsPackage interface.",
        "Failed to write external rollback GUID to file: %s. Error = %d",
        "9!9&9/9K9^9c9n9",
        "=-=W=v=",
        ">$>(>,>0>4>8><>@>D>H>L>P>T>\\>`>d>h>p>x>|>",
        "=.=6=<=I=[=i=",
        "SSWSWh",
        ": :2:B:O:W:o:u:",
        "NT Kernel Logger",
        "8 9p9",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@W4OP_EXECUTION_PHASE@@PAV?$ArrayList@PAVCOperation@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "8 80848D8H8X8\\8l8p8",
        "SetupDiGetClassDevsW",
        "0\\0x0",
        "IVdsVolumeMF2",
        "_initterm",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCAntiVirusInfo@@@UnBCL@@@UnBCL@@",
        "0<0L0S0`0g0p0|0",
        ">4?`?",
        "818?8H8^8t8",
        ">1>J>a>p>w>}>",
        "SetupPlatformTelActivityStopped",
        "6,646<6H6l6t6|6",
        "MIG_OFFLINE_FILES_HL_VS_SL",
        "??0String@UnBCL@@QAE@PBGHH@Z",
        ":$:>:`:p:",
        "8\"939?9K9W9c9",
        "9#9)949V9k9y9",
        "SPAPI_E_REMOTE_REQUEST_UNSUPPORTED",
        ">MdDtu",
        "9,9M9|9",
        "ERROR_IPSEC_IKE_SA_DELETED",
        "9%9s9",
        "7%7+767@7E7Y7q7",
        "9*969H9t9|9",
        "DRVINST: %sdriver package into WinPE: %s",
        ".rdata$brc",
        "%hs: Failure while gettting content for %s (attributes: 0x%08X)",
        "File [%s] already exists, will try a new file name",
        "GetMountedImagesKey",
        "GetDiskFreeSpace failed",
        "0*04090M0q0~0",
        "1#12191?1D1O1Z1}1",
        "class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::get_Current(void) const",
        ";);8;W;^;d;p;|;",
        "Skipping this path, it's on the OS volume",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::GetBuffer(int) const",
        "Custom MBR type: %u",
        "ProvisioningPackage::GetPackageID",
        "pAddSafeOSDrivers: Failed to get driver info for %s (0x%08x)",
        "<)<><J<T<e<n<z<",
        "9O9v9",
        "=\">:>",
        "int __thiscall OSRollbackService::CSetupRollbackService::RollbackReinitialize(class OSRollbackService::CCheckpointSequence *,const unsigned short *)",
        "class CShellFolderInfo **__thiscall UnBCL::ArrayList<class CShellFolderInfo *>::GetBuffer(int)",
        "4%4+404;4E4X4f4",
        "OffsetInSectors",
        "4*4B4H4^4o4x4",
        "SPTaskRemoveSnapshot: Failed to delete expired Upgrade snapshots",
        "2&262A2H2U2i2y2",
        "?&?-?J?Q?n?u?",
        "3'3L3p3x3",
        "ERROR_INVALID_ENVIRONMENT",
        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",
        "POSTVALIDATION: Operations can no longer be sorted following a validator's request to retry.",
        ";!;+;<;E;R;[;b;p;x;",
        "%hs: Failed to read the scenario type. Error: 0x%08X",
        "ERROR_TRANSACTION_MUST_WRITETHROUGH",
        "PartitionInfo",
        ".PAVCXXXXXTemp@?3??SPGetFileOpenedByPIDs@@YGPAV?$ArrayList@K@UnBCL@@PBG@Z@",
        "DefaultInstall",
        "u{9C(tZ",
        "QPVSQQh",
        "GetSystemDiskNTPath: Unable to retrieve system disk from BCD APIs; status = 0x%x",
        "7#717@7}7",
        "D$PPQ",
        "JET_errLogSequenceEnd",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::Add(class UnBCL::String *,class CSPInternalPluginData *)",
        ".PAVCXXXXXTemp@?GA@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "253<3B3G3R3_3d3",
        "%hs: Gather operation failed. Error: 0x%08X",
        "{4D45F781-C3D0-4765-B093-74B5CC0AB066}",
        ":E:n:",
        ".?AVCXXXXXHandledException@?2??MoveOrCopyUpdates@CDownloadDUUpdates@@IAEJPAVCDUPackageCollection@@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@@UnBCL@@PAX@Z@",
        "0*0G0P0Y0b0k0t0}0",
        "void __thiscall UnBCL::ArrayList<class CProfileInfo *>::RemoveAt(int)",
        "%windir%\\system32\\cmd.exe",
        "yOnDemand Pack",
        "?$?~?",
        "RPC_S_INTERNAL_ERROR",
        "NtSetInformationFile",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0",
        "SetupPlatformDelayLoadHook",
        "\\\\?\\GLOBALROOT",
        "PWVh$",
        "ERROR_BIOS_FAILED_TO_CONNECT_INTERRUPT",
        ">!>.>;>Z>l>",
        "9 949I9a9k9",
        "343H3P3c3v3",
        "int __thiscall OSRollbackService::CSetupRollbackService::RollbackSetCheckpoint(const unsigned short *,struct OSRollbackService::ICheckpointParameters *)",
        "CAddSetupClRequest::DoExecute: Cannot load default hive for offline OS %s. Error: 0x%08X",
        "class UnBCL::DictionaryEntry<unsigned short,unsigned short> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::get_Item(int)",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::Insert(int,class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *)",
        "ERROR_BUSY",
        "9\"9,969M9[9g9p9|9",
        "<%<V<u<|<",
        "VdsDisk::Wipe",
        "3+3;3K3\\3p3}3",
        "30373=3B3M3W3\\3p3",
        "%hs: WIM image applied.",
        "const unsigned long *__thiscall UnBCL::ArrayList<unsigned long>::GetBuffer(int) const",
        "1'1F1y1",
        "JET_wrnColumnNotLocal",
        "operations.dat",
        ";#;-;K;V;v;",
        "0%0+01060@0J0T0^0l0r0x0}0",
        "JET_errAfterInitialization",
        "%hs: Migration scope is invalid: %d",
        "Triggering respecialize per environment variable",
        ".?AV?$DefaultInstanceFactory@VCSerializableArray@@@UnBCL@@",
        "MigCreateHardLinkStore",
        "pDUDownload: DUDownload result is not successful. Operation result code = %d",
        "CSetupAutomation::GetDiskInfo: Failed to query partition for a volume: 0x%08x",
        "SPCopyFilesAndFolders: Number of folder names found: %d",
        "<M<Y<r<",
        "8(818L8X8`8l8t8{8",
        "> >&>+>6>C>W>k>",
        "8$8*878F8W8p8w8~8",
        "5.5N5S5b5~5",
        "%s\\Control\\Class\\{4D36E966-E325-11CE-BFC1-08002BE10318}",
        "CNewSystem::QueueCreateRegistry",
        "QVj^j|jd",
        "SEH: One-time exception handling is enabled. De-activating.",
        "pOpenDiskImage: Internal error: unexpected DISK_IMAGE_TYPE %u",
        "select * from MSFT_PartitionToVolume",
        "?ExpandEnvironmentVariables@Environment@UnBCL@@SGPAVString@2@PBV32@@Z",
        "t1QQS",
        "CNewSystem::QueueInstallDynamicUpdates: Failed to queue driver %s; hr = 0x%x",
        "CaptureIOWorkerCallback",
        "AppData\\Local\\Microsoft\\Windows\\UsrClass.dat",
        ">9>@>F>K>V>a>p>",
        "0%0O0d0p0w0",
        "??1StringBuilder@UnBCL@@UAE@XZ",
        "GetSysVolInfoPathFromMountPath",
        "=h>v>",
        "UnmarshallImageHandleFromId",
        "ERROR_IMPLICIT_TRANSACTION_NOT_SUPPORTED",
        "ERROR_DS_ILLEGAL_BASE_SCHEMA_MOD",
        "6!606F6N6]6s6",
        "Plugins:",
        "D$@Pj",
        "3*4E4U4a4m4t4z4",
        "1&1+141;1H1T1]1i1n1w1~1",
        "4 4$4(4,4044484<4@4D4L4P4T4X4`4d4h4l4p4t4|4",
        "j\\Xf;DJ",
        ":4:?:^:}:",
        ";](s?",
        "Failed to write converted entries from %s to %s",
        "%hs: Error while opening key %s: 0x%08X",
        "Attempting to set the OS switch checkpoint",
        "<'<K<]<e<k<x<",
        "BcdOpenSystemStore: Failed to acquire BCD sync mutant.Status: %x",
        "CRYPT_E_BAD_ENCODE",
        "=%=4=M=c=t=",
        "Store",
        "Checking driver %ws, source = %ws...",
        "3$3(383<3L3P3`3d3t3x3",
        "D$,SP",
        "; <Y<r<",
        "ActionPlatform::SetValue: Error from RegCreateKeyExW on %s; dwRet = 0x%x",
        ";/;4;w;",
        "767D7N7X7j7s7|7",
        "7$7,747@7`7",
        "tehtm",
        "ERROR_NO_DATA_DETECTED",
        "343<3A3K3^3}3",
        "GetAnswerFileContentsAsUnattend: Failed to create IWpxConfig: 0x%08x",
        "2b2o2",
        "1@1F1Q1_1",
        ".?AVIOCManager@OC@@",
        ">$>*>>>G>Z>h>|>",
        "?,???X?m?",
        "4D4q4",
        "y#Vj|h",
        "?\"?0?>?L?Z?",
        "??0?$ArrayList@G@UnBCL@@QAE@XZ",
        "PWWWWWWW",
        "%hs: Caller path: %s",
        ".PAVCXXXXXTemp@?BB@??SPProcessServiceEnable@@YGXPBG@Z@",
        "XSetup\\Scripts",
        "CSetupPlatform::CreateNewSystem: NewSystem cannot be NULL",
        ".PAVCXXXXXHandledException@?BA@??DoExecute@CCompressWIMBootFiles@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "_DismGetEffectiveSystemUILanguage",
        "CSetupPlatform::ResurrectNewSystem",
        ".?AV?$SerializableBase@VCMoveWIMBootEntriesAndPartition@@$0A@V?$DefaultInstanceFactory@VCMoveWIMBootEntriesAndPartition@@@UnBCL@@@UnBCL@@",
        ">*?y?",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,class CSPInternalPluginData *>,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,class CSPInternalPluginData *> __stdcall UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,class ATL::CElementTraits<class CSPInternalPluginData *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *> *,class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class CSPInternalPluginData *> > *,int)",
        ".PAVCXXXXXTemp@?GE@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "void __thiscall UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::Resize(int,int)",
        "839i9",
        "RPC_S_ADDRESS_ERROR",
        "0(0,0<0@0P0T0d0h0x0|0",
        "JET_wrnColumnDefault",
        "7%7/7?7R7]7r7y7",
        "JET_errEntryPointNotFound",
        "D$ SV",
        ".?AVCXXXXXHandledException@?L@??DoExecute@CApplyDrivers@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "int __thiscall UnBCL::ArrayList<struct PartitionLayoutArgs *>::LastIndexOf(struct PartitionLayoutArgs *,int,int) const",
        "CRYPT_E_FILE_ERROR",
        "class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::GetBuffer(int)",
        ".?AU?$IEnumerable@PAVCUserProfile@@@UnBCL@@",
        "Debugging was enabled successfully",
        "SPApplyAnswerFileSettings: Failed to get image target architecture (0x%08x)",
        "8*8=8K8R8X8]8h8s8",
        "struct UnBCL::ISerializable *__thiscall CDeploymentBase::GetStoredObject(class UnBCL::String *)",
        "5,5H5d5",
        "|SYSPART|\\|DEST|\\BOOTNXT",
        "RPC_S_NO_ENDPOINT_FOUND",
        ">#>)>.>6>@>S>a>t>",
        "UpgradeSnapshotPolicy",
        ";4<=<",
        "xActionPlatform::CreateKey",
        "262c2l2",
        ";%;3;A;O;",
        "void *&__thiscall UnBCL::ArrayList<void *>::get_Item(int)",
        "j}Zf;",
        "ERROR_DS_MACHINE_ACCOUNT_CREATED_PRENT4",
        "SYSTEM\\Setup\\FirstBoot\\Services",
        "Servicing spaces files",
        "Param2",
        "Service data is NULL, cannot add pending services",
        "QQh`@",
        "7$7-767?7P7Y7b7k7",
        "2)222A2]2g2q2w2",
        "4 5D5h5z5",
        " offline",
        "0%151g1",
        "SPGetVhdBootInfo",
        "ERROR_DS_SUBTREE_NOTIFY_NOT_NC_HEAD",
        ".?AV?$DefaultInstanceFactory@VCDumpSourcesData@@@UnBCL@@",
        "5 5$5<5@5X5\\5t5x5",
        "SPCompressOldOSCallback",
        "Failed to create file stream",
        "RtlFreeUnicodeString",
        "?$?,?4?<?H?h?t?",
        "132b2i2u2",
        "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;x;|;",
        ".?AU?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@@UnBCL@@",
        "Wmi::OpenNamespace: Failed to initialize security (0x%08x)",
        "1 1A1^1k1",
        "%hs: Uninstall boot entry %s does not exist, uninstall validation will fail.",
        "%hs: RegSetValueEx failed. Error: 0x%08X",
        ":4:}:",
        "8(8C8^8y8",
        "1T2~2",
        "bootmgfw.efi",
        "333W3{3",
        "PWVh2",
        "ERROR_DS_DRA_SINK_DISABLED",
        "StopKernelModeTracing",
        "yCNewSystem::CreateFailForwardSystem",
        "7,7C7X7m7",
        "ERROR_MACHINE_LOCKED",
        "CSPExecuteProgress::ObjectProcessed",
        "%s: Reconstituting wim at %s.",
        "1!1+171C1W1d1u1",
        "1*11171<1G1N1b1",
        "XpSPRestoreServiceStartType",
        "dNewRecoveryFolder",
        "3 3(343T3\\3d3p3",
        "SetNamedSecurityInfoW",
        ".?AVCXXXXXHandledException@?L@??SPCalculateDriveMappings@@YGJPAVString@UnBCL@@PAPAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@3@H@Z@",
        "?IndexOf@String@UnBCL@@QBEHPBGH@Z",
        "CSetupPlatform::CreateVirtualDisk",
        ".?AV?$CAutoRelease@PAVIVssBackupComponents@@@RAII@@",
        "System BCD store does not exist, creating.",
        "Onesettings: Failed to get full module path: 0x%x",
        "void __thiscall UnBCL::ArrayList<struct SetupPlatform::IPartition *>::QuickSort(class UnBCL::ArrayList<struct SetupPlatform::IPartition *> *,class UnBCL::ArrayList<struct SetupPlatform::IPartition *> *,int,int)",
        "%wNtE",
        ".?AVRollbackException@@",
        "(050M0",
        "CReconstructOS::RestoreInstallationLanguageSettings: Setting applicable intl settings to preferred language",
        "4 444<4T4\\4d4l4|4",
        "OSRollbackService::CCheckpoint::MoveOrCopyDirectory: source path \"%s\" does not exist; ignoring",
        "SPGetAllPartitions",
        "<(<8<H<X<h<x<",
        "SL_E_CIDIID_NOT_DEPOSITED",
        ".?AVCProcessDrivers@@",
        "7 7$7(7,7074787@7D7H7L7T7X7`7d7h7l7t7x7",
        "1,1A1^1y1",
        "7\"7^7t7",
        "void __thiscall UnBCL::ArrayList<class CDUPackage *>::Insert(int,class CDUPackage *)",
        "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;\\;`;d;h;p;t;x;|;",
        "CSetupPlatform::CreateNewSystem: Creating a compact OS",
        "0)070@0I0R0[0t0",
        ";\";(;-;8;@;T;l;};",
        "Framework",
        ">!>:>A>j>",
        "pExtractCrashDump: Pagefile does not exist at %s.",
        "4'4K4k4",
        "CRYPT_E_MISSING_PUBKEY_PARA",
        "Cleanup Windows.old at end",
        ":I:T:{:",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::RemoveAt(int)",
        "Marking event [&SclEvent_ProcessRegistry_Start]",
        "9 9$9(9,9094989<9D9H9L9P9X9\\9`9d9h9p9t9x9|9",
        "int __thiscall UnBCL::ArrayList<class CBasicEnvEntry *>::LastIndexOf(class CBasicEnvEntry *,int,int) const",
        "8\"838>8L8x8",
        "RegKeyProcessCount",
        "Cannot load the system hive for the offline OS. Error: 0x%08X",
        "Failed creating target SYSTEM hive path name %ls\\SYSTEM",
        "PShhY",
        "gpServicesValueEnumCallback",
        "void __thiscall UnBCL::ArrayList<class CDriverInfo *>::RemoveAt(int)",
        ".?AV?$CAutoCleanupBase@PAVSmImageDisk@@@RAII@@",
        "?%?.?D?Z?l?t?z?",
        "7\"7I7T7l7",
        ">$>@>l>",
        "<'<,<5<<<I<U<^<j<o<x<",
        "0&0:0Q0`0l0",
        "1%121;1C1I1R1Z1a1n1",
        "; ;+;2;<;];h;",
        "Array doesn't support Insert()",
        "%hs: Found completed operation (%d) that should execute after an incomplete one (%d)",
        "enon machine specific",
        "%%%s%%",
        "@(93u",
        "=%=2=O=X=r=",
        "=U>c>q>",
        "DisplayName",
        "base\\ntsetup\\setupplatform\\lib\\util\\recoveryutils.cpp",
        ".?AU?$IEnumerable@V?$DictionaryEntry@KPAUIVdsVDisk@@@UnBCL@@@UnBCL@@",
        "yCanonicalData",
        "%hs: OpenSCManagerW failed",
        "ERROR_SXS_COMPONENT_STORE_CORRUPT",
        ".?AV?$DefaultInstanceFactory@VCEnableTracingForImage@@@UnBCL@@",
        "ERROR_NOT_TINY_STREAM",
        "NtOpenFile",
        "='=/=5=B=T=b=",
        "6`6w6",
        "CSIDL_SENDTO",
        "CImageInfoSet::AddToImageInfoSet",
        "Failed opening source ServicingStackVersions key",
        "SPCreateSnapshotWithScoping: Failed to initialize COM. Error: 0x%08X",
        "%s: Error while moving folder %s to %s. Error: 0x%08X",
        "void __thiscall UnBCL::ArrayList<class SysprepComponent *>::Insert(int,class SysprepComponent *)",
        ">(>4>:>N>g>z>",
        ":':-:2:C:N:\\:",
        ".PAVCXXXXXTemp@?CIJ@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ".PAVCXXXXXHandledException@?CCI@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ";&;/;<;D;P;Y;f;n;z;",
        "ERROR_DS_ILLEGAL_MOD_OPERATION",
        "SPTagTarget: [%s] is in %s state, nothing to do.",
        "Failed getting COM allocator",
        "ERROR_DS_OBJ_CLASS_NOT_SUBCLASS",
        "%hs: Cannot write environment variable %s=%s to %s. Error: 0x%08X",
        "wdsutil.dll",
        ".PAVCXXXXXTemp@?CC@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "06da2f0c-7937-4e28-b46c-a37317eade73",
        "%hs: ExecuteRollback failed.",
        "8<8N8V8\\8i8{8",
        ">>>F>\\>",
        "%hs: Source OS had WIMBoot entries, will perform some cleanup if needed",
        ";9;];",
        "222L2S2Y2^2i2p2",
        ">!><>C>I>N>Y>`>s>",
        "%hs: Platform does not have migration footprint capabilities",
        "struct SetupPlatform::IDisk *__thiscall UnBCL::_::ArrayListEnumerator<struct SetupPlatform::IDisk *>::get_Current(void) const",
        "8$8,848<8D8L8T8\\8d8p8",
        "pDeterminePageFileRequirements: %llu byte(s) are still available in physical memory",
        "Failed to apply unattend file %s in the OS: %s. Error: 0x%08X",
        "StartServiceW",
        ";&;/;8;M;T;Z;_;j;y;",
        "j\\j[j)j",
        "%hs: Cannot open key %s. Error: 0x%08X",
        "WVhhB",
        "<\"<+<9<J<_<~<",
        "?&?-?G?R?`?k?",
        "Local\\SetupVolumeAccessMutex",
        "Malformed line found in section %s. Ignoring",
        "CDownloadDUUpdates::CalculateSpaceNeeded: IUpdate::get_RecommendedHardDiskSpace failed. hr = 0x%x",
        "2 2)2=2U2_2r2|2",
        "j\\Yf;",
        "Extracted Full dump",
        "889M9_9g9m9",
        "MigOpenUpgradeStore",
        "?#?P?",
        "__RTDynamicCast",
        "{86980EB4-C7BB-48A9-8123-AE80045087C7}",
        "MIG Validator: Could not validate tracked content, will attempt to undo all Gather operations",
        "898G8T8]8f8p8y8",
        "d%SystemDriveNative%",
        "66666666666666666666666666",
        "SceSetupSystemByInfName",
        "int __thiscall UnBCL::ArrayList<class CImageInfo *>::BinarySearch(int,int,class CImageInfo *,struct UnBCL::IComparer<class CImageInfo *> *)",
        "9!9+919>9]9c9p9",
        "8r SW",
        "?*?:?G?S?i?z?",
        "AppList (original):",
        "    Failed to allocate spPath->get()",
        "8$8.878A8J8T8]8g8p8z8",
        ".?AU?$IEnumerable@PAVCOperationResult@@@UnBCL@@",
        ":):A:U:\\:b:g:r:}:",
        "7(7@7P7Z7",
        "3$3+303P3`3g3m3r3}3",
        "SmDisk::Initialize",
        "CBS_E_3RD_PARTY_MAPPING_UNAVAILABLE",
        ".PAVCXXXXXHandledException@?2??FindWimImageOnWDSServer@@YGJPAVString@UnBCL@@0000PAPAV23@1PAI@Z@",
        "10181@1H1P1\\1|1",
        "OrchestrateStartSystemServices: Unknown error occurred while waiting for services to start; hr = 0x%x",
        ".?AV?$DefaultInstanceFactory@VCSetBootCommand@@@UnBCL@@",
        "QueueCreateRegistry called for fail-forward system %s, %s [%s]",
        "TrySubmitThreadpoolCallback",
        "FixReparsePointPath: Skipping the current symbolic link; it's relative.",
        "__thiscall OC::CDownlevelOCStore::CDownlevelOCStore(class UnBCL::String *,class UnBCL::String *)",
        "SP_HIVE_LOAD_ALIAS_%s",
        "5#5)565H5c5",
        "DetermineIfControllerIsXHCI: SetupDiOpenDeviceInfo failed. Error = 0x%X.",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@GG@UnBCL@@@_@UnBCL@@",
        "4#4(474G4a4s4",
        "5%5.545A5G5L5h5",
        "JET_wrnKeyChanged",
        "<+<5<><J<h<r<{<",
        "    Failed to set temporary path",
        "%hs: Attempting to set the current OS as default",
        ".?AU?$IEnumerator@PAVCPartitionInfo@@@UnBCL@@",
        "6,646@6H6O6]6j6~6",
        "<)<=<J<R<j<p<",
        "5(5a5r5y5",
        "SPAPI_E_NO_SUCH_INTERFACE_CLASS",
        "747M7T7Z7_7j7",
        "7C7\\7o7",
        "?4?K?R?d?u?",
        ".?AU?$IDictionaryEnumerator@GH@UnBCL@@",
        ";H;V;t;",
        "3(3/353@3_3j3x3",
        "343P3Z3d3j3w3",
        "ja-JP",
        "4,43494>4I4P4d4s4",
        "Failure while executing uninstall gather, uninstall will continue. Status: 0x%08X",
        "    Failed to allocate spIntermediate.get()",
        "7 8P8",
        "0/0>0W0l0y0",
        "3,4U4h4|4",
        "int __thiscall UnBCL::ArrayList<class SysprepComponent *>::IndexOf(class SysprepComponent *,int,int) const",
        ".?AU?$IEnumerable@PAG@UnBCL@@",
        "6'656C6",
        ".?AU?$IEnumerable@PAUPageFileDesc@@@UnBCL@@",
        "6\"6/656:6K6V6d6",
        "3D3]3",
        "CDeploymentProject::CreateFolderDeployment: Failed to copy setup 360 files from [%s] to [%s]. Error: 0x%08X",
        "ControlSet001\\Control",
        "y#Wjbh",
        ":(:8:<:L:P:T:l:|:",
        "=$=,=4=D=L=T=\\=d=l=t=|=",
        "5.5?5H5R5[5r5",
        ": :@:H:P:X:`:h:p:|:",
        "stopDependentService",
        "Sj2jN",
        "IsWindows",
        "v=j\\Zf9",
        "ERROR_DS_INCOMPATIBLE_VERSION",
        "t9f91t4",
        "JET_errColumnNoChunk",
        "9#969H9w9",
        "System volume drive path is [%s]",
        ":T:!;;;Q;u;",
        "5-5I5V5f5n5t5y5",
        "xfVhp",
        "2\"2.292M2",
        "6%7:7`7u7}7",
        "WIM\\IMAGE[*]\\TOTALBYTES",
        "First boot apply from ICB is not using replacement manifests",
        "9'9-929D9^9n9",
        "6(656?6F6L6Q6\\6j6~6",
        ":#:/:G:M:_:s:",
        "8@9R9Z9`9m9",
        "class UnBCL::String *__thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,int>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "1,131R1^1e1k1p1{1",
        "RPC_S_BINDING_INCOMPLETE",
        "0 0(0<0D0L0\\0h0p0",
        "\\EFI\\Microsoft\\Boot\\BCD",
        "ERROR_IP_ADDRESS_CONFLICT2",
        "848<8D8L8T8\\8d8l8",
        "Failed to get file data of [%s]. Error: 0x%08X",
        "535J5k5",
        "  Using WU driver applicability via IUpgradeInternalSession",
        "%hs: Registry key: %s",
        "=4=8=P=T=l=p=",
        "9(9:9S9w9",
        "RPC_S_ENTRY_NOT_FOUND",
        "tk-TM",
        "CNewSystem::QueueSetupAutomation: Failed to queue product key (0x%08X)",
        "1-141:1?1J1X1l1",
        "1\"151?1_1i1x1",
        "?'?,?P?W?]?b?m?w?|?",
        ".?AV?$SmartPtr@V?$ArrayList@PAUISerializable@UnBCL@@@UnBCL@@@UnBCL@@",
        ":+:4:q:",
        "5+5M5d5o5",
        "VdsDisk::Initialize",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CDrvStoreProperty *>::MoveNext(void)",
        "QWj\"j@h",
        ".?AVCApplyWDSImage@@",
        "2!202=2I2l2t2",
        "5%535p5",
        "1f;2u",
        ".?AVNotSupportedException@UnBCL@@",
        "2<3S3x3",
        "%hs: Failed to read BitLocker status for [%s], assume off",
        "<#<.<<<h<r<",
        "ProvisioningPackage::RetrievePackageMetadata",
        "Error setting OS Switch Rollback checkpoint",
        "9-9\\9n9v9|9",
        "8.8E8^8",
        "1*141G1X1i1",
        "ERROR_LOG_METADATA_INCONSISTENT",
        "?(?>?F?L?Y?q?",
        "failed to extract file from reference extension",
        "WINDOWS/LANGUAGES",
        "=J=`=w=",
        "COOBEBootApplyFromICB::DoExecute",
        ".?AVCCheckpoint@OSRollbackService@@",
        "Failed to query BCD object. Status = %d",
        "7+7D7K7Y7c7h7|7",
        "PPPPPPPPS",
        "9u uO",
        "PWVh!",
        "2\"242E2W2_2e2r2",
        "CSIDL_MYVIDEO",
        "0-070A0G0U0",
        "7 7:7L7k7y7",
        "6S6a6",
        "    Hardware ID: %s",
        "=(=U=[=f=t=",
        "RPhPP",
        "NTFSu",
        "0D0i0",
        "int __thiscall UnBCL::Array<class CRegCreationData *>::Add(class CRegCreationData *)",
        "ERROR_IPSEC_IKE_PROCESS_ERR_KE",
        "8#8,858>8G8P8Y8b8k8",
        "ERROR_DS_ALIAS_POINTS_TO_ALIAS",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::GetBuffer(int) const",
        "7$7*757=7D7V7d7z7",
        "UNKNOWN",
        ": :,:M:v:",
        "?V?`?v?",
        "<G<N<T<Y<e<o<t<",
        "ERROR_BAD_FORMAT",
        "1 1$1(1,141X1`1|1",
        "6*6@6O6d6k6q6v6",
        "SSSSSSSSQ",
        "xMachineId",
        "SL_E_TOKSTO_TOKEN_NOT_FOUND",
        "3/4:4H4V4d4",
        "EnumHashTable",
        "Failed creating/opening target Removed FOD Markers key",
        "Failed to backslash terminate path.",
        "6%676>6D6I6T6_6s6",
        "1 1/171>1M1U1\\1o1w1~1",
        "7 7%707;7@7T7_7f7l7q7|7",
        "ProductSuite",
        "?4?E?R?`?x?~?",
        "7I7`7l7",
        "3!3y3",
        "=$=6===C=H=S=^=n=~=",
        "class UnBCL::String *__thiscall OSRollbackService::CSetupBasicCheckpointParameters::GetSourcesDirectory(void)",
        "ERROR_POSSIBLE_DEADLOCK",
        "index and count do not denote a valid range of elements in ArrayList#BinarySearch",
        "?$?-?7?M?[?d?z?",
        "const enum OP_EXECUTION_PHASE &__thiscall UnBCL::ArrayList<enum OP_EXECUTION_PHASE>::get_Item(int) const",
        ".?AVStream@UnBCL@@",
        "??0XmlSchemaSet@UnBCL@@QAE@XZ",
        "%hs: Install flow constraint detected (%d). Will enable optimized installation path.",
        "6$686S6j6",
        ";8;E;d;y;",
        "181@1H1P1`1",
        "1$2+21262A2K2^2}2",
        "RPC_S_INTERFACE_NOT_FOUND",
        "WINDOWS/VERSION/MAJOR",
        "BBBBPj(",
        "enum MIGSTATUS __stdcall pSPExecuteApply(enum SetupPlatform::SP_MIG_SCOPE,class UnBCL::String *,int,int,int,class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::String *,class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *> *,class UnBCL::String *,int,int,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::ArrayList<class CWIMBootData *> *,class UnBCL::String *,int *,class CSPTelemetryData *,struct ISPMigProgress *,long *)",
        "=-=4=:=?=J=Q=e=",
        ".?AU?$ICollection@PAG@UnBCL@@",
        "CAddCbsPackage::DoExecute: Failed to initialize DISM. Error: 0x%08X",
        "SL_E_TOKSTO_CANT_WRITE_TO_FILE",
        "8#8E8b8t8",
        "ERROR_DS_DUP_OID",
        ".?AU?$IEnumerable@PAVCImageInfo@@@UnBCL@@",
        "WofAdk",
        ":&:.:?:L:T:j:v:~:",
        "=$>?>P>e>m>s>",
        "ParseDiskCriterion: Unknown disk property: %s",
        "8)838:8R8m8",
        ".?AV?$Array@U_GUID@@@UnBCL@@",
        "=,>3><>",
        "0Y0`0",
        "NtQuerySystemTime",
        ":):6:X:",
        "9'9?9I9X9e9y9~9",
        "IActionCollection::Create failed. hr = 0x%x",
        "8&8-898F8Z8b8i8w8",
        "DISKSPACEEXCEED: Operation consumed more disk space than declared. Exceeded by %I64d bytes",
        "NtDeleteDriverEntry",
        "ulIndex < m_ulSize",
        "1%1.1>1G1S1e1n1",
        "RPC_S_NOTHING_TO_EXPORT",
        "DuplicateTokenEx",
        "0|2W3^3",
        "ERROR_DS_AUX_CLS_TEST_FAIL",
        "7 747<7Q7Z7`7m7",
        "3$383L3T3\\3d3l3x3",
        "3%3,32373B3S3g3z3",
        "SETUP\\SETUPCL\\PendingRequest",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *> *)",
        "Create reg key failed: 0x%x",
        "SetupPlatform: Executing first boot StartAsync commands",
        "010@0\\0s0",
        "7!787?7F7M7S7u7",
        ".?AV?$CAutoRelease@PAUISetupPlatform@SetupPlatform@@@RAII@@",
        "CreateCompatibleDC",
        "1%111E1W1c1n1",
        "6!73787",
        "0'04090B0N0[0`0i0u0",
        "4)474=4R4Y4_4d4l4v4",
        "pSPReadInstallTimeFromRegistry",
        "?V?k?",
        "=.>F>Y>m>",
        "MigValidateTrackedContent",
        "Parallel chunk decode queue empty; switching to synchronous decode",
        "6!6)606<6N6c6r6|6",
        "auditSystem",
        ": :$:,:0:8:@:H:L:P:T:\\:`:h:l:p:t:x:|:",
        "COperationQueue::Add",
        ".?AV?$DefaultInstanceFactory@VCOptionalComponent@OC@@@UnBCL@@",
        ".?AU?$IList@PAUIPartition@SetupPlatform@@@UnBCL@@",
        "9N\\tX",
        "%hs: Current recovery image is inside Windows namespace. It cannot be preserved",
        "  Frame %2d, module: %s",
        "Transformers",
        "class CFileCreationData *const *__thiscall UnBCL::ArrayList<class CFileCreationData *>::GetBuffer(int) const",
        "void __thiscall UnBCL::ArrayList<class CImageInfo *>::RemoveAt(int)",
        "< <'<-<2<=<H<\\<t<",
        "0;1f1k1",
        "XScratchDirectory",
        "CAbstractWriter::ReleaseFileHandle",
        "WIMGetMountedImageHandle",
        "0&0+0?0X0_0e0j0u0",
        "ERROR_MORE_DATA",
        "ERROR_NO_RECOVERY_POLICY",
        "CMediaLayout::QueueProvisioningPackages: Failed to update path for ICB (%s) in answer file: 0x%08x",
        "7#7.7<7h7r7",
        "0$0*0@0",
        "CleanupHResult",
        "unattend\\settings[pass=%s]",
        "OC::COCDismAdapter::GetFoundationPackageName: Couldn't find the Foundation package",
        ">!>.>@>N>e>{>",
        "6\"6V6s6",
        "8VPhPC",
        "Copying driver package %s to %s",
        "RegQueryInfoKeyW",
        ".PAVCXXXXXHandledException@?L@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "8/9<9N9V9\\9i9{9",
        "JET_errTooManyKeys",
        "828G8_8e8z8",
        "pSPDeleteExpiredUpgradeSnapshots: Failed processing snapshot [%s]. Error: 0x%08X",
        "8.8:8L8w8",
        "515H5_5s5",
        "3.3H3O3Y3^3n3}3",
        "8!8'8P8]8o8w8}8",
        "6111a83d-7a6b-4a2c-a7c2-f222eebcabf4",
        "Global\\WIMGAPI-LOGFILE-%c%08x'%08x",
        "Disk-matching: %s (0x%08x)",
        "ERROR_CLUSTER_EVICT_INVALID_REQUEST",
        "6!7g7",
        "2;3B3\\3c3i3n3y3",
        "Failed to enumerate driver packages, returned Err = 0x%lx",
        ".?AVCCheckpointImpressario@OSRollbackService@@",
        "Fail to create offline store.",
        "?*?:?N?`?",
        ".?AV?$CAutoRelease@PAUIMigUserIterator@@@Mig@@",
        "(%lx): Unable to grow partition.",
        ".PAVCXXXXXHandledException@?NN@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "SPReadDriversList",
        "Failure while calling Transformer Initialize. Error: 0x%08X",
        "7%777_7x7",
        "int __thiscall UnBCL::_::ArrayListEnumerator<struct PageFileDesc *>::MoveNext(void)",
        "%hs: Loader relative path: %s",
        "CMediaLayout::QueueInstallImage: Failed to query selected image: 0x%08x",
        "<!<1<A<Q<a<r<z<",
        "RPC_S_UNKNOWN_AUTHN_LEVEL",
        "4'434O4t4",
        "OCPayloadPaths:",
        "ERROR_DS_DRA_BUSY",
        "RetrieveDiskLayout",
        "SETUPPLATFORMCOMM: Received DONE progress message. Exiting.",
        "ERROR_DS_OBJ_STRING_NAME_EXISTS",
        "class CPartitionInfo *&__thiscall UnBCL::ArrayList<class CPartitionInfo *>::get_Item(int)",
        "void __thiscall UnBCL::ArrayList<class CDriverInfo *>::Insert(int,class CDriverInfo *)",
        "SetupPlatform: Phase \"Pre-OOBE\" started.",
        "3/3D3p3",
        ">,>=>J>Y>k>u>~>",
        "Can't construct hive path",
        "ERROR_INVALID_DRIVE_OBJECT",
        "8 8*81878<8G8S8g8o8",
        "> >$>(>,>4>8><>@>H>L>P>T>X>\\>d>h>l>t>|>",
        "0$080L0T0\\0d0l0x0",
        "0.080M0U0[0h0z0",
        "3 383<3T3X3p3t3",
        "Extending the OS partition",
        ".?AV?$Array@PAV?$DictionaryEntry@_JPAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "=\"=/=<=U=d=x=",
        "CGatherEndInstall: Migration phase failed. Status: %d",
        "bs-Latn",
        "2,3;3B3H3M3X3c3w3",
        ".?AV?$SmartPtr@VStreamWriter@UnBCL@@@UnBCL@@",
        "%hs: Could not find an execution phase for %u",
        "%hs: Cannot find old WinRE folder for ID: %s",
        "SmPartition::SetType: Unknown partition style",
        "QQQh0",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\Sysprep",
        "%hs: SPGuidFromString failed for %s. hr = 0x%08X",
        "5$5(5,505D5H5`5d5|5",
        "pExtractWinREFromImage: Failed to get default boot entry from BCD store. Error = 0x%08X",
        "<.<;<G<~<",
        "ERROR_CONNECTION_ABORTED",
        "Part offset: %I64u",
        "=-=:=D=Z=",
        "MatchAnyKeyword",
        ";K;V;d;r;",
        "=3=N=d=y=",
        "%hs: WDSNamespace parameter cannot be NULL.",
        "Failed mark %S as install.",
        ">,>2>9>C>P>W>a>r>",
        "5)5/585@5O5V5\\5a5l5s5",
        "909N9Z9l9",
        "RPC_X_WRONG_PIPE_VERSION",
        "94:h:",
        "?Add@MultiSz@UnBCL@@QAEXPBG@Z",
        "const struct DiskLayout::Partition &__thiscall UnBCL::ArrayList<struct DiskLayout::Partition>::get_Item(int) const",
        ".?AVCXXXXXHandledException@?HC@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "?$?4?<?D?\\?d?l?t?|?",
        "void __thiscall UnBCL::_::HTEnumerator<unsigned short,int,struct UnBCL::Hashtable<unsigned short,int>::TableKey,int,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable<unsigned short,int>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned short,int>::TableKey,int,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::Reset(void)",
        "4%424G4O4_4x4",
        "SVh`}",
        "1(181\\1d1l1t1|1",
        "CUpdateBootCode::DoExecute: An error occurred while initializing system volume to [%s]. Error: 0x%08X",
        "SPCalculateDriveMappings: Will generate %s mappings from the registry SystemRoot value [%s] to the offline Windows dir [%s]",
        "aYd(z_C",
        ":K:t:",
        "<D=[=b=t=",
        "%hs: Successfully added driver %s. Error: 0x%08X",
        ".PAVCXXXXXHandledException@?2??SPModifyOfflineHives@@YGHHHHPAVString@UnBCL@@@Z@",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,long> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::GetBuffer(int)",
        "CDeploymentProject::CreateVHDDeployment: Failed to detach the VHD. Error: 0x%08X",
        ".PAVCXXXXXTemp@?EM@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "SPVolumeGetEncryptionStatus",
        "ActionPlatform::CallEntryPoint: Caught an unhandled exception (code %d) while trying to call module entry point",
        "%s: Failed to inject driver package in the new OS: %s. Error: 0x%08X",
        "6 6'6Y6b6k6t6}6",
        ".?AU?$IList@PAV?$DictionaryEntry@PAVString@UnBCL@@H@UnBCL@@@UnBCL@@",
        "ERROR_DS_SRC_NAME_MISMATCH",
        "FveRemoveTrustedWimData",
        "CAddBootEntry: Failed to write string to file: %s. hr = 0x%08X",
        "na:Name",
        "9#9J9Z9a9h9s9~9",
        "7\"72777C7T7[7h7",
        "version",
        "ResurrectSetupPlatform: Error retrieving setup platform serialized data (1). Error: 0x%08X",
        " SVW3",
        "WIMUnmountImageHandle",
        ".?AV?$SmartPtr@U?$ICollection@PAUIVdsVDisk@@@UnBCL@@@UnBCL@@",
        "CMigrateFramework::DoExecute: ModifyOfflineRegHives: Changing paths from %s to %s",
        "ERROR_DS_BAD_RDN_ATT_ID_SYNTAX",
        "VdsVolume::AssignLabel: Failed to set volume label [%s] (0x%08x)",
        ".?AVCXXXXXHandledException@?5??SPReclaimRecoveryImagePartition@@YGJPAVString@UnBCL@@00@Z@",
        "1(1:1B1H1U1g1u1",
        "Failed to get Retain previous snapshot OneSetting, 0x%x",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::Resize(int,int)",
        "8,9:9P9]9k9",
        "DiskLayout::ApplyLayout: Failed to read target disk properties (0x%08x)",
        "SetupPlatform: Executing StartAsync commands: Failure while executing command %s. Error: 0x%08X",
        "%SYSTEMDRIVE%\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe /postoobe",
        ".PAVCXXXXXHandledException@?CAH@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "8+858[8",
        "=#=(=3=>=C=H=\\=w=",
        "pLogImageInfo",
        "Failed opening the package %S",
        "MIG_XML_PHASE_FILTER",
        ";4;A;Y;d;r;",
        "struct HKEY__ *__thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,&protected: static struct HKEY__ * __stdcall UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,class ATL::CElementTraits<struct HKEY__ *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "6(63696D6N6_6h6u6~6",
        "class CWIMBootData **__thiscall UnBCL::ArrayList<class CWIMBootData *>::GetBuffer(int)",
        "1-2A2d2",
        "=?=Q=Y=_=l=~=",
        "%s,%c",
        "y#Vj.h",
        "CBS_E_MISSING_PACKAGE_MAPPING_INDEX",
        "9'90999B9J9h9v9",
        ")VdsPartition::Resize",
        "ERROR_NO_LINK_TRACKING_IN_TRANSACTION",
        "SPCreateSnapshotWithScoping",
        ".PAVCXXXXXTemp@?N@??QueueEnableFeature@CNewSystem@@UAEJPBGQAPBGI@Z@",
        "20201008071939.743Z0",
        "void __thiscall UnBCL::ArrayList<class COperationResult *>::RemoveAt(int)",
        "ERROR_DS_SUBREF_MUST_HAVE_PARENT",
        "595e5",
        ";(;?;F;L;Q;\\;g;",
        "8#9C9X9a9r9",
        "class CDeploymentBase::CMountedPathInfo *const &__thiscall UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *>::get_Item(int) const",
        "SL_E_CHPA_UNKNOWN_PRODUCT_KEY_TYPE",
        "%hs: System state does not allow for more requests to be queued. Current state is %d",
        "%s [%s]",
        "    Failed to write value attribute",
        "4#474D4I4R4b4i4o4t4",
        "<><K<i<q<",
        "ERROR_SXS_MANIFEST_INVALID_REQUIRED_DEFAULT_NAMESPACE",
        ".?AUIDiskMatchProperty@@",
        "< <$<(<,<4<8<<<@<H<L<P<T<\\<`<d<h<p<t<x<|<",
        "Disk space required for uninstall: %I64u",
        "0%0?0H0Q0X0^0g0r0}0",
        "3!3+3>3V3",
        "9!9)9.939H9X9d9k9q9v9",
        "%SystemDrive%\\hiberfil.sys",
        "?Add@XmlSchemaSet@UnBCL@@QAEXPAVString@2@PAVXmlDocument@2@@Z",
        "ERROR_IPSEC_IKE_BENIGN_REINIT",
        "4+4:4L4c4u4",
        "2!232A2^2f2",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::LastIndexOf(class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *,int,int) const",
        "0-0:0L0T0Z0g0y0",
        "SetupPlatform: Phase \"Pre-SysPrep\" started",
        "%hs: OOBE boot apply is only allowed in data, data+settings or full upgrade.",
        "8(929A9",
        "6+676C6O6h6n6w6",
        ";$;+;2;9;@;G;Q;[;a;k;",
        "restoring folder failed",
        "< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\\<`<d<h<l<p<t<x<|<",
        "=E=L=R=W=b=m=",
        "0\"151C1J1T1a1i1",
        "DISKSPACEQUERY: Calculating disk space needed:",
        ".PAVCXXXXXTemp@?GF@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "4 545M5U5[5`5o5",
        "NtWriteFile",
        "4]5o5|5",
        "5&5,515<5G5[5o5|5",
        "=&=.=4=D=N=X=d=n={=",
        "Compress old OS",
        "Could not start service. Error: 0x%08X",
        "2+282Q2j2v2",
        "?GetBuffer@?$Array@E@UnBCL@@UAEPAEH@Z",
        "<7=t=",
        "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@ABV01@@Z",
        "<6<A<M<l<s<|<",
        "9 ;`<",
        "N0PSSSSh",
        "void __thiscall UnBCL::Array<class ISPPluginData *>::RemoveAt(int)",
        "void __thiscall UnBCL::ArrayList<class CAntiVirusInfo *>::Insert(int,class CAntiVirusInfo *)",
        "?GetHashCode@Object@UnBCL@@UBEHXZ",
        "WinRE-Merge.etl",
        "void __thiscall UnBCL::ArrayList<class CGlobalPathFindData *>::set_Item(int,class CGlobalPathFindData *)",
        ";#<9<><",
        "9\"9,919",
        "5#565I5Z5f5",
        "%hs: Image info does not have system drive defined.",
        "Failed to get image info for WIM %s, index %d. Error: 0x%08X",
        "MetadataEnumerator::GetNextKey",
        ".?AV?$SmartPtr@U?$IEnumerator@PAUHKEY__@@@UnBCL@@@UnBCL@@",
        "SclLogCallback",
        "Failed to set serial debugging port. Status = 0x%X",
        "SPCreateSnapshotWithScoping: Failed to find created snapshot volume by ID. Error: 0x%08X",
        "WinReSetupRestoreWinREEx",
        ".?AV?$CAutoCleanupBase@PAUIDiskEnumerator@SetupPlatform@@@RAII@@",
        ".?AV?$SerializableBase@VCFODValidator@@$0A@V?$DefaultInstanceFactory@VCFODValidator@@@UnBCL@@@UnBCL@@",
        "Failed to flush trace: 0x%x",
        "UuidCreate",
        "6*656I6R6Z6e6m6t6y6",
        "Successfully read uninstallwindow from CSP: %d",
        "JET_errLoggingDisabled",
        ".?AU?$ICollection@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@",
        "ERROR_RECEIVE_EXPEDITED",
        "HKLM\\SOFTWARE",
        ".?AV?$ArrayListEnumerator@PAVCCheckpoint@OSRollbackService@@@_@UnBCL@@",
        "565M5f5",
        "Microsoft Corporation",
        "9!9&929:9?9S9",
        "SP_ENV_ALLOW_EARLY_APPLY",
        "jWXY]",
        ".?AV?$SerializableArrayListBase@PAVCCleanupEntry@CSimpleCleanup@@@_@UnBCL@@",
        "\\System32\\NtDll.dll",
        "class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::GetBuffer(int)",
        "GY;>r",
        "    Failed to find %s node",
        "CSIDL_PERSONAL",
        "End OOBE boot",
        "01080>0C0O0`0t0",
        "F\\;G\\u",
        "?%?,?6?C?J?T?e?r?|?",
        " --------!\"#$%--&'()*+,",
        "pLh`P",
        "?w$tQ",
        "??1?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@XZ",
        "CEnableNewOSPageFile::DoExecute",
        "9p\\t:",
        "273F3",
        "system32\\SMI\\Store\\Machine",
        "ExecuteOperations: Operations cannot be sorted. This is a fatal failure.",
        "pbr: Added alternate source: AddSource index: location: %S",
        "Store will be synchronized with firmware.",
        "4=4Z4",
        "3D3q3",
        "CSetupPlatform::CreateAutomation: Can't initialize disk provisioning: 0x%08X",
        "ERROR_SERVICE_CANNOT_ACCEPT_CTRL",
        "negative index or count to ArrayList#BinarySearch",
        ">9>N>V>\\>i>{>",
        ":&;9;I;N;X;z;",
        "<-<2<?<O<Y<c<p<y<",
        ":::W:",
        "0,0E0M0j0|0",
        "VdsPlatform::Initialize: Failed to wait for VDS service to be ready (0x%08x)",
        "JET_errBadBookmark",
        "CSetupPlatform::CreateNewSystem: Failed to create new system from automation. hr = 0X%x",
        "other",
        "DiskLayout::ApplyLayout: Unknown firmware type %u",
        "=0=8=@=H=P=`=",
        "Failed to parse drivers from config file. Error: 0x%08X",
        "=0=}=",
        ".PAVCXXXXXTemp@?JH@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "CSetupAutomation::Save: Failed to retrieve settings object: 0x%08x",
        "int __thiscall UnBCL::Array<struct _GUID>::Add(struct _GUID)",
        "CAppXValidator::ValidatePostExecution",
        "1$1?1E1R1d1",
        "99:C;",
        "SKIPBOOTTRACK(SAFEOS): Skip Boot Validator: Found OS pieces %s outside OS volume, cannot continue with SafeOS boot removal.",
        "ERROR_DS_BAD_ATT_SCHEMA_SYNTAX",
        ".?AVCXXXXXHandledException@?5??SPRemoveScheduledTask@@YGJPBG0H@Z@",
        "405`5",
        "Saving OC status for offline system... OCStatusFilePath: %s; imagepathDir: %s",
        "1(1q1",
        "5 5-555X5x5",
        "9#979C9J9e9l9",
        "?;?Y?`?f?k?v?",
        "6&646<6B6V6a6m6y6",
        "Prepare first boot",
        "<'<5<o<",
        "RPC_S_PRF_ELT_NOT_ADDED",
        "7)7Z7",
        "%hs: Cannot get volume name for the installation path.",
        "9<:x:",
        "j.Zf;",
        "101D1L1T1\\1d1p1",
        ".?AVCXXXXXHandledException@?CK@??SPValidateTrackedContent@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@000PAH1PAPAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@2@Z@",
        "0'050B0T0\\0b0o0",
        "?@?x?",
        "Number of compressed files: %lu",
        "545:5F5N5d5k5q5v5",
        "MINOR",
        "void __thiscall UnBCL::Array<enum OP_EXECUTION_PHASE>::RemoveAt(int)",
        "__thiscall UnBCL::ArrayList<class CDUPackage *>::ArrayList(const struct UnBCL::ICollection<class CDUPackage *> *)",
        "EtwEventEnabled",
        "j-Xf;",
        "?*?>?K?^?u?{?",
        "?+?3?:?D?K?Q?V?a?k?~?",
        "?#?4?=?U?]?d?n?",
        "JET_errBadDbSignature",
        "State.ini",
        "5&5=5S5",
        "2\"2/2;2J2\\2",
        "long __thiscall CDeploymentBase::PrepareForRun(void)",
        "CTrustSafeOSBootCommand::DoExecute: Failed to add hash of %s to %s: 0x%08x",
        "Searching for dynamic updates",
        "7(7:7B7H7U7g7u7",
        "CDeploymentProject::CreateVHDDeployment: Failed to copy new system log [%s] -> [%s]. Error: 0x%08X",
        "Professional",
        "9)9.9:9T9d9i9u9",
        "??1exception@@UAE@XZ",
        "VdsPlatform::Initialize: Failed to compute host info (0x%08x)",
        ".?AVCXXXXXHandledException@?MO@??Rollback@CSetupPlatformOSSwitchCheckpoint@@UAEXPBG@Z@",
        "class COperationsValidator *&__thiscall UnBCL::ArrayList<class COperationsValidator *>::get_Item(int)",
        "%hs: RAM Disk GUID: %s.",
        "4$4,444<4D4P4p4x4",
        "MoveOrCopyDirectory: Cannot move \"%s\" to \"%s\" (error %u); attempting to copy instead",
        "SERIALIZEVERBOSE: Deserializing operation type: %s",
        "CRYPT_E_RECIPIENT_NOT_FOUND",
        "UnregisterHotKey",
        "8&808A8O8\\8c8j8}8",
        "8%828D8R8i8",
        "< <4<F<c<p<",
        "0%090A0Q0X0^0c0o0z0",
        "SPValidateTrackedContent",
        "CSetupAutomation::Save: Failed to serialize answer file: 0x%08x",
        "WideCharToMultiByte",
        "1+2S2",
        "BfspPrintFileOwnerProcess: Malloc failed!Size = %#x",
        "%hs: Error compressing %s. GLE [%d]",
        "Current pass status for [%s] is [0x%x]",
        ">#>1>z>",
        ">#>;>C>Z>",
        "3)343H3V3",
        ".?AVCFinalizeSafeOSBootRemoval@@",
        "5\"5/5A5R5d5l5r5",
        "ERROR_INVALID_FILE_VERSION_FLAG",
        "4\\5v5",
        ";,;0;@;D;T;X;h;l;p;x;|;",
        "SL_E_VL_MACHINE_NOT_BOUND",
        "Failed to flush queues: 0x%x",
        "1 1$1(1,1014181<1@1H1L1P1T1\\1`1d1h1l1p1t1x1|1",
        "2&303H3w3",
        "void __thiscall UnBCL::ArrayList<struct DiskMatchFilter>::Insert(int,struct DiskMatchFilter)",
        "8/8<8H8`8",
        "GetDisk: Querying VDS providers...",
        "Failed copying ssshim.dll",
        "00000",
        "int __thiscall UnBCL::_::HTEnumerator<enum OP_OPERATION_ID,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable<enum OP_OPERATION_ID,int>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "int __thiscall UnBCL::ArrayList<class CGlobalPath *>::BinarySearch(int,int,class CGlobalPath *,struct UnBCL::IComparer<class CGlobalPath *> *)",
        "yRWhI",
        "New checkpoint \"%s\" is too long. ",
        "2$2,232V2]2c2h2s2",
        "zh-CHS",
        "2$2D2L2X2`2x2",
        "DefWindowProcW",
        ":!:):0:<:N:c:r:|:",
        "2,202H2X2h2x2",
        "CopyFile failed with error 0x%08X",
        "Sources\\Rollback",
        "ERROR_TRANSPORT_FULL",
        ".PAVCXXXXXHandledException@?L@??SPCalculateDriveMappings@@YGJPAVString@UnBCL@@PAPAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@3@H@Z@",
        "DisableTelemetryOptInSettingsUx",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCCFGSectionValue@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCCFGSectionValue@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "9$9,989X9`9h9p9x9",
        "7*717E7N7[7h7o7u7z7",
        "=!=1=9=L=\\=d=w=",
        "SSSSj",
        "6$626@6Q6_6z6",
        "Migration of root ACL: %ws",
        "1/151B1T1p1w1}1",
        "8(808=8M8U8[8a8n8",
        "%hs: Failure while opening image file %s. Error 0x%08X",
        "4\\4{4",
        "?\"?'?-?5?<?B?G?R?`?h?n?",
        "%hs: ExecuteRollback failed. GLE = %d",
        "5 5$5,5054585@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5",
        "QVVhx",
        "@*93u",
        ".?AVCXXXXXHandledException@?2??SuspendAndRelease@CSetupPlatform@@UAEJHHPBG@Z@",
        "3#323<3A3I3P3\\3n3",
        "  Using WU driver applicability via IgnoreInstalledDrivers",
        "< <(<D<L<d<l<",
        "x8-u{",
        "9,939:9I9k9r9y9",
        "9!9N9c9",
        "9#9,959F9O9X9n9",
        "Installed OCs (Source OS):",
        "verify no encrypted non-OS volumes",
        "ControlSet",
        "1#161G1T1^1o1x1",
        "ERROR_WMI_SERVER_UNAVAILABLE",
        "ERROR_BUS_RESET",
        "base\\ntsetup\\setupplatform\\lib\\automation\\diskmatching.cpp",
        "<$<(<8<<<L<P<`<d<t<x<",
        ".?AV?$CAutoCleanupBase@PAVSmPhysDisk@@@RAII@@",
        "SppFreeGroupPropArray",
        "=$=0=<=H=T=`=l=t=|=",
        "6,6C6d6",
        "Attempt to revert execution for operation %d",
        "ReleaseDC",
        "ActualPath",
        "8*9U9p9",
        "<T=c=",
        "8$8,828?8Q8d8x8",
        "D$,WP",
        "OC::OCRestoreStatus",
        "9 9(909H9\\9d9l9x9",
        "Unable to get procedure FreeAndZeroCSI_REPAIRED_COMPONENT",
        "Failed to get object identifier. Status: %x",
        "d    Failed to allocate spDestinationPath.get()",
        ".?AV?$DictionaryEntry@GH@UnBCL@@",
        "L$L!\\$H",
        "SKIPBOOTTRACK(SAFEOS): Skip Boot Validator: Found symbolic mappings in the configuration file, cannot continue with SafeOS boot removal.",
        ".?AV?$SmartPtr@U?$ICollection@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "1\"1^1q1x1~1",
        ";S<s<",
        "ERROR_BADSTARTPOSITION",
        "Store path: \"%s\"",
        "CDeploymentProject::CreateFolderDeployment: Failed to get image index. Error: 0x%08X",
        "1 1)131<1E1N1e1s1|1",
        "OperationResult",
        "4g5q5",
        "<+<8<B<\\<b<t<",
        "CBS_E_NOT_APPLICABLE ",
        "BusType",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *> *,int) const",
        "f9:tD",
        "ERROR_EA_ACCESS_DENIED",
        "ERROR_SWAPERROR",
        "RPC_X_NO_MORE_ENTRIES",
        "? ?,?1?:?F?R?W?`?l?x?}?",
        "PWVhs",
        "<#=G=Y=a=g=t=",
        "Failed to flush system partition. Error = [%x]",
        "SPWpeLogCallback: WinPE Bootstrap setting logged NULL format string",
        "JET_errOSSnapshotTimeOut",
        "?8?X?h?u?",
        "CBS_E_IMAGE_NOT_ACCESSIBLE",
        ".?AUIImageInfo@SetupPlatform@@",
        "PVWh>",
        "<$<,<4<<<D<L<T<\\<h<",
        "474S4Z4`4e4p4{4",
        "6'64696B6P6W6a6n6s6|6",
        "int __thiscall UnBCL::ArrayList<enum OP_OPERATION_ID>::BinarySearch(int,int,enum OP_OPERATION_ID,struct UnBCL::IComparer<enum OP_OPERATION_ID> *)",
        "struct IMigRegistryNavigator *__thiscall CARPValidator::GetRegNavigator(struct IMigRegistryAccess *,class UnBCL::String *)",
        "ERROR_SCOPE_NOT_FOUND",
        "The NTFS version of volume [%ws] is not supported!",
        "VdsImageDisk::Initialize",
        "3#3/3;3G3S3_3k3w3",
        "Process External Drivers",
        ".PAVCXXXXXHandledException@?2??SuspendAndRelease@CSetupPlatform@@UAEJHHPBG@Z@",
        "535:5A5L5V5i5",
        "?name@type_info@@QBEPBDXZ",
        "DriverStoreDriverPackageResolveCallbackW",
        "828[8e8",
        "< <m<",
        "8\"8,8D8b8s8z8",
        "nSuspendedData",
        "Cleanup completed successfully",
        "SmDisk::GetProperties: Couldn't initialize disk properties (0x%08x)",
        "9 :`:",
        "Failed to allocate memory for modified privilege tokens.",
        ".?AU?$ICollection@PAVCDeviceInfoData@CDeviceIdDatabase@@@UnBCL@@",
        "7%7/767<7A7L7Z7n7v7",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAVCDriverInstallInfo@@UTableKey@?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@V?$DictionaryEntry@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@UKeyTraits@52@$1?RetrieveEntry@52@KG?AV62@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@PAVCDriverInstallInfo@@UKeyTraits@23@V?$CElementTraits@PAVCDriverInstallInfo@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "?SanitizeTypeName@SerializationStream@UnBCL@@SGPAVString@2@ABV32@@Z",
        "SssGetServicingStackFilePathLength",
        "void __thiscall UnBCL::ArrayList<struct UnBCL::ISerializable *>::AddRange(const struct UnBCL::ICollection<struct UnBCL::ISerializable *> *)",
        "__thiscall UnBCL::ArrayList<class SysprepAction *>::ArrayList(const struct UnBCL::ICollection<class SysprepAction *> *)",
        ".?AU?$IEnumerator@_J@UnBCL@@",
        "?/?D?L?R?_?n?",
        "2$212C2U2`2n2",
        "6\"6-6O6j6",
        "868M8[8y8",
        "9$9,9D9L9T9h9p9x9",
        "CSetupAutomation::SetImageInfoSet",
        "Onesettings: Failed to AddParameterOsVer: 0x%x",
        "CBS_E_MANIFEST_VALIDATION_DUPLICATE_ELEMENT",
        "Failed to capture directory",
        "0.0A0I0O0\\0n0",
        "WmiAssociation::IsKeyObject: Unexpected error: Couldn't get %s (0x%08x)",
        "CBS_E_GROUPPOLICY_DISALLOWED",
        "__int64 __thiscall UnBCL::_::ArrayListEnumerator<__int64>::get_Current(void) const",
        "2#2*242A2H2R2c2p2z2",
        "CSavePageFileSettings::DoExecute",
        "ERROR_PNP_IRQ_TRANSLATION_FAILED",
        "SL_E_SRV_CLIENT_CLOCK_OUT_OF_SYNC",
        "?#?5?<?B?G?R?Y?^?",
        ".?AV?$SerializableBase@VCAddSafeOSBootEntry@@$0A@V?$DefaultInstanceFactory@VCAddSafeOSBootEntry@@@UnBCL@@@UnBCL@@",
        "Failed to create path %s. hr = 0x%08X",
        "Unable to get procedure GetIdentityAuthority",
        "ConfigValue",
        "Elapsed weight is %u",
        "??0?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@XZ",
        "SPExecuteFirstBootApplyFromICB",
        "ERROR_DBG_CONTROL_BREAK",
        "3*373A3R3_3h3r3",
        "DiagERAddBucketingParameters",
        "WSSSSP",
        "eCSetupPlatform::CreateAutomation",
        "2,20242H2L2d2h2l2p2t2x2",
        "fileActions",
        ".?AU?$IEnumerable@PAVCWIMBootData@@@UnBCL@@",
        "FindMatchingDeviceInfoData: SetupDiEnumDeviceInterfaces failed. Error = 0x%X.",
        "SPReserveSpace: Error setting the size of reserved disk space file %s. Error: 0x%08X",
        "int __thiscall UnBCL::ArrayList<class CUserProfile *>::IndexOf(class CUserProfile *,int,int) const",
        "1+1;1V1f1w1",
        "=<=I=O=}=",
        "enum MIGSTATUS __stdcall SPDoEndInstallGather(enum SetupPlatform::SP_MIG_SCOPE,class UnBCL::String *,class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,struct ISPTelemetryData **,struct ISPMigProgress *)",
        "OperationFlags",
        "CProcessDrivers::IsDriverPackageActive",
        "SPAPI_E_DRIVER_INSTALL_BLOCKED",
        "=$=)=4=B=J=P=d=",
        "Wim:         [%s]",
        ".?AVInvalidCastException@UnBCL@@",
        "2 2.2<2`2",
        "<+=O=e=",
        "HKEY_LOCAL_MACHINE\\SYSTEM",
        "sCWIMBootHelper::CreateFileW",
        "5H5[5k5x5",
        "Download Driver Dynamic Updates",
        ".?AV?$Array@_J@UnBCL@@",
        ":.;E;T;Y;c;y;~;",
        "  AddHardReserveSpace : add: %15I64d, available: %15I64u, consume from user space: %15I64d",
        ".?AV?$SmartPtr@VCSPMigProgress@@@UnBCL@@",
        ";$;m;",
        ".PAVCXXXXXHandledException@?5??GetCurrentDiskSpaceRequirements@CDeploymentBase@@QAEJPA_K0@Z@",
        "4%5]5",
        "MControlSet001\\Control\\ProductOptions\\",
        "=*>K>w>",
        ".?AV?$Array@PAV?$DictionaryEntry@W4OP_EXECUTION_PHASE@@PAV?$ArrayList@PAVCOperation@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "ERROR_FLOPPY_UNKNOWN_ERROR",
        "9\"9:9A9G9L9W9a9t9",
        "9{(tn",
        "FirmwareModified",
        "?%?/?9?C?M?d?r?|?",
        "CMergeWIM::DoExecute: Cannot delete reference file %s. Error: 0x%x",
        ":$;6;>;D;Q;c;s;",
        "6%606>6j6z6",
        "2-2C2N2^2h2z2",
        "WinREFolder",
        "54585P5T5l5p5",
        ".?AV?$DefaultInstanceFactory@VCOfflineApplyFromICB@@@UnBCL@@",
        "=!=8=@=^=e=k=p={=",
        "]Manufacturer",
        ":':1:B:O:Y:j:w:",
        "CDeploymentBase::GetCurrentDiskSpaceRequirements",
        "WSh 9",
        ".?AVCXXXXXHandledException@?2??pSPCountMigUnitEvents@@YGIPAUIMigUnitNavigator@@HHH@Z@",
        "WimStrDupe",
        "Recovery succeeded. Rollback will now restart the machine.",
        ".?AV?$SerializableBase@VCProcessDrivers@@$0A@V?$DefaultInstanceFactory@VCProcessDrivers@@@UnBCL@@@UnBCL@@",
        "=,=]=w=",
        "yNVjE",
        "6G6s6",
        "Found inbox support for HW ID: %s",
        "Machine-specific transformers directory not found",
        "CReconstructOS::SetUpCbsLogging: Failed to query whether HKLM\\System\\Setup WorkingDirectory has already been set: 0x%08x. Will reset.",
        ".PAVCXXXXXTemp@?3??DoExecute@CDisableFeature@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "LoadBitmapW",
        "0%0C0R0b0i0",
        "3\"313H3X3e3q3",
        "738C8",
        "7/7W7d7",
        "Failed Installing edition packages.",
        "8T9f9n9t9",
        "Create Upgrade snapshot",
        "5+565[5|5",
        "7'747H7]7j7%858H8X8",
        ":\":I:Q:^:r:",
        "BcdOpenSystemStore failed. Status = %d",
        ";\";7;U;",
        "EnumeratePathEx: Unable to enumerate [%s]; GLE = 0x%x",
        "uz-Latn-UZ",
        ">$>,>4><>D>L>T>\\>d>l>t>|>",
        ".?AVCXXXXXHandledException@?2??DoExecute@CMigrateBootSettings@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "1!1*1N1m1z1",
        "pDUDownload: Cancelled. hr = 0x%x",
        "6/7C7h7",
        "CRYPT_E_REVOCATION_OFFLINE",
        ">1>A>V>\\>b>r>w>}>",
        ".?AV?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@",
        "111>1J1c1{1",
        ";';9;\\;",
        "7$7-767?7H7f7",
        "CSetupAutomation::ResolveTarget: Cannot apply custom disk configuration: disk platform not available",
        "8<8R8d8k8q8v8",
        "__thiscall UnBCL::ArrayList<class CAntiVirusInfo *>::ArrayList(const struct UnBCL::ICollection<class CAntiVirusInfo *> *)",
        ".PAVCXXXXXHandledException@?2??RegisterRollbackOnlineSys@CSetupPlatformRollback@@UAEJPBG0@Z@",
        ".PAVCXXXXXTemp@?6??SPRemoveScheduledTask@@YGJPBG0H@Z@",
        "%hs: Failed to open BCD's new OS entry. Status = 0x%08X",
        " &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&!\"#$%",
        "Deleting new WinRE BitLocker hash %s",
        ".?AVCPrepareNewOSForFirstBoot@@",
        "1 111;1E1O1Y1c1m1w1",
        "pIsUninstallInitiated",
        "8-8A8J8[8j8~8",
        "DismRemoveCapability",
        "BcdGetElementDataWithFlags: Failed to acquire BCD sync mutant. Status: %x",
        "343F3N3T3h3n3w3",
        "1$1*14191C1J1X1j1{1",
        "void __thiscall UnBCL::Array<struct SetupPlatform::IDisk *>::Insert(int,struct SetupPlatform::IDisk *)",
        "WVhpI",
        "1%2s2",
        "void __thiscall UnBCL::Array<struct DiskMatchFilter>::RemoveAt(int)",
        ":#:\\:",
        ".?AVCProfileInfo@@",
        "7'7M7U7a7i7",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCCopyInfo@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "Orchestrate OS switch for %s with safe OS %s and rollback OS %s. DelayedSwitch: %d",
        "9,9<9L9\\9l9|9",
        "<0<><H<R<\\<f<}<",
        "4!4'4,474D4T4[4a4f4q4~4",
        "ERROR_INVALID_EA_HANDLE",
        "class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::GetBuffer(int)",
        ".?AU?$IEnumerable@PAVCOperation@@@UnBCL@@",
        ".?AVCDeviceIdDatabase@@",
        "WIM_Chunked_Number_Of_Threads",
        "2(2/2<2L2Y2k2",
        "ERROR_DS_CANT_DEMOTE_WITH_WRITEABLE_NC",
        "SETUPPLATFORMCOMM: Connecting thread was cancelled. Exiting.",
        "Final list of source move exceptions:",
        "7\"7F7M7u7|7",
        "313D3",
        "%hs: VHD path: %s",
        "LastCrashDumpInfo: BugcheckCode %u",
        "3$3,343<3D3L3T3`3h3",
        "JET_errInvalidBackupSequence",
        "DUCount",
        "WinDirOld",
        ":E:L:X:_:",
        "Y9w,u",
        "DiskLayoutMakeSystem: Failed to create system partition (0x%08x)",
        "<%<+<8<J<X<|<",
        ".?AV?$DictionaryEntry@PAXPAX@UnBCL@@",
        ".?AU?$ICollection@PAVCCheckpoint@OSRollbackService@@@UnBCL@@",
        "OSRollbackService::CCheckpoint::MoveOrCopyDirectory",
        "?'?.?B?U?k?",
        "x(9\\$Tt",
        "__thiscall UnBCL::ArrayList<class CCopyInfo *>::ArrayList(const struct UnBCL::ICollection<class CCopyInfo *> *)",
        "%hs: Failed to find image %d in image info set.",
        ".?AV?$SerializableBase@VCPrepareSysPrep@@$0A@V?$DefaultInstanceFactory@VCPrepareSysPrep@@@UnBCL@@@UnBCL@@",
        "5V5h5o5u5z5",
        ".?AU?$IList@K@UnBCL@@",
        "service.0.etl",
        "   OC: %s, Current State: %s, Target State: %s",
        "%sEdition.xml",
        "__thiscall UnBCL::ArrayList<class CInfFile *>::ArrayList(const struct UnBCL::ICollection<class CInfFile *> *)",
        "yWh(#",
        "0\"060D0R0`0n0|0",
        "WimCreateWorkerThreads",
        "3/363A3T3[3a3g3r3|3",
        "5,505H5L5d5h5",
        "{71A27CDD-812A-11D0-BEC7-08002BE2092F}",
        "8%8+888J8]8i8{8",
        "CInstallDUUpdatesOffline::FindOperation: Existing string %s does not match input string %s",
        ";';0;8;B;Y;",
        "StateStoreGetMountedImageTime",
        "xWdfExtensions",
        "=*=<=Z=f=x=",
        "SetupPlatform.exe /rollbackonlinesystem",
        "SETUPPLATFORMEXE: Attempting to connect to the progress pipe.",
        ".?AVXmlDocument@UnBCL@@",
        "=%=Q=_=v=",
        "ERROR_MCA_MCCS_VERSION_MISMATCH",
        "9(:0:p:",
        "ERROR_VALIDATE_CONTINUE",
        "9'999\\9",
        ">!>)>/><>N>\\>u>|>",
        "fTfVgf",
        "1>1a1",
        "= =<=F=P=V=c={=",
        "CFastDeleteImplT<class CDirectoryProviderT<class CWindowsOldAdaptor>,1>::Run",
        "?Equals@Version@UnBCL@@UBEHPBVObject@2@@Z",
        "jRjqVh",
        "base\\ntsetup\\opktools\\sysprep\\platform\\actionplatform.cpp",
        "= >X>",
        "ERROR_THREAD_MODE_NOT_BACKGROUND",
        "5(5d5o5t5",
        "CAbstractDisk::AssociateIoCompletionPort",
        "8.8=8G8T8Z8a8k8x8",
        "SetupAct.log",
        "SPWriteOSPiecesSection",
        "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAE@XZ",
        "5)5A5",
        "ERROR_PWD_HISTORY_CONFLICT",
        ";.;M;l;",
        "2!222@2G2M2R2]2d2x2",
        "CSetupPlatform::CreateNewSystem: Failed to get image index. hr = 0X%x",
        "%hs: Cannot access recovery image reference WIM. Error: 0x%08X. Retrying...",
        "1!1E1L1R1W1b1z1",
        ":%;V;~;",
        "?!?1?E?M?T?b?r?",
        "    Failed to allocate _spElementSearchPath.get()",
        ".?AV?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        ".?AV?$CAutoCleanupBase@PAVVdsPlatformDiskEnumerator@@@RAII@@",
        "= =(=,=0=4=<=@=D=H=L=P=T=X=\\=d=h=l=p=x=|=",
        "??6SerializationStream@UnBCL@@QAEAAV01@E@Z",
        "SPAPI_E_DEVICE_INTERFACE_REMOVED",
        "void __thiscall UnBCL::ArrayList<class COperationResult *>::Resize(int,int)",
        "4$5X5",
        "DynamicUpdate.FeaturesOnDemand",
        "JET_errNoCurrentRecord",
        ";\";0;",
        "1(1;1G1o1v1|1",
        "unsigned short *const *__thiscall UnBCL::ArrayList<unsigned short *>::GetBuffer(int) const",
        "<$=W=",
        "%hs: BCD failed to remove the downlevel OS current boot entry references. Error: 0x%08X",
        "CDeploymentBase::RestoreMounts: Failed to get mounted image info. Error: 0x%08X",
        "WdsCliFindFirstImage",
        "dword",
        "DiskLayout::VerifyLayoutNoRefsToDeletedLogical",
        "{3D76F89C-7343-4D8E-8C8C-E82D5F719DFA}",
        "SPExecuteCleanup",
        "7*8X8",
        "4%4-434@4O4",
        "unsigned long &__thiscall UnBCL::ArrayList<unsigned long>::get_Item(int)",
        "Failed to set EA on %s. Error: 0x%08X",
        "ERROR_IPSEC_IKE_NEG_STATUS_EXTENDED_END",
        "ERROR_SXS_XML_E_BADXMLCASE",
        "10181>1K1]1}1",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::Reset(void)",
        "ERROR_DS_DRA_OUT_SCHEDULE_WINDOW",
        "ERROR_NO_SHUTDOWN_IN_PROGRESS",
        ";);>;J;U;`;k;t;};",
        "void __thiscall UnBCL::Array<class CDriverDetails *>::Insert(int,class CDriverDetails *)",
        "%hs: BCD Open failed, uninstall cannot be validated. Error: 0x%08X",
        "PBR: Package is pending for uninstall, original state installed, add it to planning: %ws",
        "Onesettings: Failed to AddParameterDeviceId: 0x%x",
        "7F8b8s8",
        "Footprint.Migration",
        "4#4;4T4k4",
        "%systemdrive%\\PerfLogs",
        "VERBOSE: Successfully moved (2) %s to %s",
        "MIG_REPORT_PLUGIN_FAILURES_NEW",
        "3'34393B3P3W3a3n3s3|3",
        ">\">(>9>P>l>",
        ">*>8>F>T>",
        "SL_E_CHPA_TIMEBASED_PRODUCT_KEY_NOT_CONFIGURED",
        "CSetupPlatform::AttachDiskImage: Can't attach disk image '%s': 0x%08x",
        "pRegisterFailureData",
        "<!<W<",
        ".?AVCMigrateBootSettings@@",
        "='=9=W=c=u=",
        "\\boot\\",
        "CheckExcludeMetadata",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *> *,int,int)",
        "|SYSPART|\\|DEST|\\BOOTSTAT.DAT",
        "|SYSPART|\\BOOTNXT",
        ": :):;:D:c:q:",
        "1!2p2",
        "8 8.8<8",
        "?$?m?",
        ">B>O>e>|>",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::Insert(int,class UnBCL::DictionaryEntry<unsigned short,unsigned short> *)",
        "=$=A=P=o=",
        "WpxSetDeplSettings",
        "?0?<?E?R?a?i?w?",
        "TelemetryPermission-AllowDisable",
        "1\"2)2/242?2J2n2u2{2",
        "int __thiscall UnBCL::ArrayList<class OSRollbackService::CCheckpoint *>::LastIndexOf(class OSRollbackService::CCheckpoint *,int,int) const",
        "Update %s: download size [%I64d] bytes, install size [%ld] MB",
        "3$3,343<3D3L3X3`3",
        "int __stdcall UnBCL::MP::ThrowCompare<struct DiskLayout::Partition>::Compare(struct DiskLayout::Partition,struct DiskLayout::Partition)",
        "JET_errKeyDuplicate",
        ",0@0e0",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,unsigned long>::Remove(class UnBCL::String *)",
        "uHj\\[",
        "CApplyWIM::DoExecute",
        "qAZf4[C",
        ".PAVCXXXXXHandledException@?2??CreateFailForwardSystem@CNewSystem@@UAEJPBGPAPAUIFailForwardSystem@SetupPlatform@@@Z@",
        "969=9C9H9S9a9u9",
        "PQVjdQWQ",
        "CRYPT_E_ASN1_MEMORY",
        "int __thiscall UnBCL::ArrayList<class CDriverInfo *>::BinarySearch(int,int,class CDriverInfo *,struct UnBCL::IComparer<class CDriverInfo *> *)",
        "%hs: Boot.sdi path: %s.",
        "#0*00050A0K0^0~0",
        "DriverInstallPathAndInstallTime",
        "<&<6<",
        "Reducing duplicate resume entries.",
        "th-TH",
        "pLogUpdateInfo: IStringCollection::get_Count failed. hr = 0x%x",
        "CreateFontIndirectW",
        "7 8k8",
        "Error opening excluded key [%ws]: [0x%08X]",
        "; ;+;6;J;^;~;",
        "int __stdcall OC::OCSaveStatusOffline(class UnBCL::String *,class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::String *,class UnBCL::String *)",
        ".CRT$XCZ",
        "SmDisk::CreatePartition: Failed to get disk properties (0x%08x)",
        "Failed to open element %ws key for delete. Status: %x",
        "CSetupAutomation::SetDataMigration: Unrecognized data migration scope: %u",
        "0#0+0u0",
        "be-BY",
        "??0ApplicationException@UnBCL@@QAE@PAVException@1@PBG@Z",
        "4&444X4w4",
        "ObjectId",
        ".PAVCXXXXXHandledException@?CH@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "VERBOSE: MOVETRACK: Destination is a reparse point, we'll remove it",
        "MIG_NO_OSDB",
        "8E8Z8k8r8x8}8",
        "ITaskSettings2::put_UseUnifiedSchedulingEngine failed. hr = 0x%x",
        ".?AV?$CAutoCleanupBase@PAU_VDS_FILE_SYSTEM_FORMAT_SUPPORT_PROP@@@RAII@@",
        "5 6x6",
        "struct UnBCL::ISerializable **__thiscall UnBCL::ArrayList<struct UnBCL::ISerializable *>::GetBuffer(int)",
        "void __thiscall UnBCL::Array<struct SetupPlatform::IDisk *>::Remove(struct SetupPlatform::IDisk *)",
        "0 121:1@1M1_1s1",
        "=)=:=G=R=c=k=",
        "GUID: %s",
        "6)6J6g6",
        ";\\;l;",
        "void __thiscall UnBCL::Array<void *>::RemoveAt(int)",
        "223K3z3",
        "VdsImageDisk::InitializeProperties: VdsDisk properties initialization failed (0x%08x)",
        "(%lx): Unable to extend volume.",
        "Failed to create process on [%s], GLE=0x%x",
        ".PAVArgumentOutOfRangeException@UnBCL@@",
        "VSh|Z",
        "base\\ntsetup\\setupplatform\\lib\\src\\drivermigration.cpp",
        "CacheDisable",
        "1,181@1X1`1x1",
        "Failed to convert NT path %s to DOS path. Error: 0x%08X",
        "9 909<9P9_9g9n9",
        "8A8S8t8",
        ">;>B>p>x>",
        "=9=H=h=",
        "Cannot optimize for speed using an external storage.",
        "ERROR_INVALID_PATCH_XML",
        "ERROR_RESOURCE_ENUM_USER_STOP",
        "Cannot set ImagePath for %s, error: 0x%08X",
        ":(:,:<:@:P:T:d:h:x:|:",
        ".CRT$XIAA",
        "3/3N3Z3f3",
        "int __thiscall UnBCL::_::HTEnumerator<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *> __stdcall UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::DictionaryEntry<void *,void *> *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "RPC_S_GROUP_MEMBER_NOT_FOUND",
        "xCDownloadDUUpdates::SearchUpdates",
        "  Needed by download of updates: %I64d",
        "Sj*j+",
        "252:2Q2f2l2y2",
        ":A:T:d:",
        ";1;E;J;O;[;|;",
        "MigrationSettingsScope",
        ":#:9:F:X:`:f:o:",
        "=0>t>",
        "Processing security template succeeded",
        ".0@0H0N0[0m0{0",
        "=!=C=U=c=q=",
        "687E7]7",
        "ERROR_SXS_MANIFEST_TOO_BIG",
        "656>6G6P6Y6d6m6",
        "?&?-?\\?x?",
        "6?6T6[6a6f6q6|6",
        "4%5/5>5^5h5w5",
        ">+>=>N>U>[>`>k>v>",
        "4\\4u4|4",
        "ERROR_TRANSLATION_COMPLETE",
        "Failed to read binary info of last crash dump. Error: 0x%08X",
        "j\\Zf;Ty",
        "Failed to get respecialize OneSetting, 0x%x",
        "Failed to get snapshot creation time for [%s], delete it. Error: 0x%08X",
        "class UnBCL::DictionaryEntry<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *> __thiscall UnBCL::_::HTEnumerator<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *> __stdcall UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::DictionaryEntry<void *,void *> *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        ".?AVCXXXXXHandledException@?5??ValidateUninstall@CSetupPlatformPrivate@@UAEJXZ@",
        "CDiskReader::GetOsInfoHalName",
        "ERROR_ALL_NODES_NOT_AVAILABLE",
        "4)4.434?4O4T4Y4e4l4v4{4",
        "8:8X8s8",
        "5/6s6",
        "WmiObject::BeginCall: Couldn't get the class object for %s (0x%08x)",
        "? ?,?4?z?",
        "9/:D:T:",
        ")base\\ntsetup\\setupplatform\\lib\\diskconfig\\diskconfigvds.cpp",
        "=>=h=|=",
        "%hs: Cannot set file attributes for %s",
        ".?AU?$IEnumerable@W4ActionType@@@UnBCL@@",
        "ERROR_CLEANER_SLOT_SET",
        ":*:8:O:e:",
        "1$1,141@1H1l1t1|1",
        "ERROR_INVALID_COMBOBOX_MESSAGE",
        "@PPh,",
        "Disk size is not a multiple of block size.",
        "int __thiscall UnBCL::ArrayList<class CUserProfile *>::BinarySearch(int,int,class CUserProfile *,struct UnBCL::IComparer<class CUserProfile *> *)",
        "Failed to set element OS device. Status = [%x]",
        "??0XmlDocument@UnBCL@@QAE@XZ",
        "ERROR_DS_CANT_START",
        "pGetEtlFileNameOnline",
        "5?5F5U5",
        "ttVh`",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *> *)",
        "?#?7?F?O?b?n?x?",
        "ReleaseVolumeAccessPath: Access path '%c:\\' is no longer assigned, skipping release and zeroing reference count.",
        "QWj?jWjd",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCInfFile@@@UnBCL@@@UnBCL@@",
        "SPGetFootprintCapabilities: Footprint [%s] incomplete; the platform capability will not be available",
        "ERROR_IPSEC_IKE_PROCESS_ERR_SA",
        "515R5Y5_5d5o5z5",
        "Reconstruct OS from Packages",
        "ERROR_WMI_UNRESOLVED_INSTANCE_REF",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCMountedPathInfo@CDeploymentBase@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCMountedPathInfo@CDeploymentBase@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "RtlCreateAcl",
        "= >E>h>",
        "ERROR_SHARED_POLICY",
        "=$=9=f=",
        "Cloning store.",
        "2.2>2C2L2`2n2u2{2",
        "<(<?<O<T<`<w<",
        "CDeploymentProject::Initialize: Failed to load %s into automation: 0x%08x",
        ">7>O>l>{>",
        "VdsPartition::SetType: Unknown partition type %u",
        "JET_errAccessDenied",
        ":4:H:s:",
        ">L?^?f?l?y?",
        "ERROR_NO_NETWORK",
        "SPApplyCustomDiskConfig: Couldn't calculate disk layout for disk %u",
        ".?AV?$CAutoCleanupBase@PAUIWpxWriteOpt@@@RAII@@",
        "ERROR_HANDLE_NO_LONGER_VALID",
        ".?AU?$IEnumerable@U_GUID@@@UnBCL@@",
        "2'2/2e2q2",
        "SPAPI_E_SET_SYSTEM_RESTORE_POINT",
        "PWVh+",
        "2=3v3",
        "$OFFLINE_RW$SAM",
        "8)8:8F8[8r8~8",
        "FindWimImageOnWDSServer",
        "1-1I1S1t1z1",
        "Post First Boot",
        "Default user profile hive does not exist, skipping: [%ws].",
        ">3>G>i>",
        "0#0(030:0Y0z0",
        "=\"=+=4===S=a=k=t=",
        ".PAVCXXXXXTemp@?BA@??Rollback@CSetupPlatformWinReRestoreCheckpoint@@UAEXPBG@Z@",
        "ExportCopyStream",
        "SL_E_SFS_INVALID_SYNC",
        "ERROR_IPSEC_IKE_NO_PUBLIC_KEY",
        "Setup\\RemovedDrivers",
        "%hs: No files to extract from image %s.",
        "SclpGetVolumeHandle",
        ".?AU?$IEnumerable@PAUIVdsDisk@@@UnBCL@@",
        "ERROR_VOLSNAP_PREPARE_HIBERNATE",
        "SL_E_CHPA_FAILED_TO_INSERT_PRODUCT_KEY_PROPERTY",
        "8?8F8L8Q8\\8c8",
        "%hs: Failed to allocate memory for BCDE_BOOTMGR_TYPE_DISPLAY_ORDER field. Status = %d",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@PAUIOperationsProgress@SetupPlatform@@K@UnBCL@@@UnBCL@@",
        "F$_^[",
        "ImageEndImpersonation",
        "?Clone@Object@UnBCL@@UBEPAV12@XZ",
        "void __thiscall UnBCL::ArrayList<class CShellFolderInfo *>::Resize(int,int)",
        ":<:D:P:t:|:",
        "CNewSystem::QueueSetupAutomation: Failed to queue ICB: 0x%08x",
        "2-2@2",
        "??1?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@UAE@XZ",
        "GetModelSectionNameEx:Using section name [%s]",
        "?#?.?<?h?r?",
        "5)6/656;6A6G6M6",
        "Filesystems",
        "RestoreFileMetadata: RestoreFileStorageTierClass failed",
        "1%111=1F1W1`1i1u1",
        "9X90:",
        "StringFromGUID2",
        "41494I4Q4[4l4y4",
        "FIXED",
        "8 9T9",
        "j\\Xf;F",
        "void __thiscall UnBCL::Array<class CDrvStoreProperty *>::RemoveAt(int)",
        ".?AVCXXXXXHandledException@?2??pGetExistingPageFiles@@YGJPAVString@UnBCL@@PAV?$ArrayList@PAUPageFileDesc@@@3@@Z@",
        ">/>H>]>p>x>~>",
        "=3=J=Z=",
        "3&3<3Y3`3f3k3v3",
        "8&848=8P8`8w8~8",
        "es-US",
        "DefaultLanguage",
        "SclpSetDiskLayout",
        "9)979E9S9",
        "SL_E_SRV_INVALID_BINDING",
        "SysprepSession::ExecuteAction: Invalid operation code 0x%x",
        ".?AVCOnlineOCManager@OC@@",
        "5%5@5F5P5U5_5f5t5",
        "='=-=I=^=d=",
        ".?AV?$DefaultInstanceFactory@VCAddSetupClRequest@@@UnBCL@@",
        "CCreateScopedSnapshot::DoExecute: Ignore the error and continue Upgrade",
        "&0Q0a0v0",
        ".PAVCXXXXXTemp@?3??DoExecute@CSetDefaultBootEntry@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "We'll ignore the WIMBoot entry",
        "<1=>=Q=]=n=}=",
        "CUninstall::GetUninstallWindow",
        ".?AV?$CAutoRelease@PAVSmPhysDisk@@@RAII@@",
        "RtlAcquireResourceExclusive",
        "rw-RW",
        "7#707D7T7Y7b7~7",
        "CFfuWriterAsyncT<class CSecurityHeaderWriterT<class CEmptyType>,class CImageHeaderWriterT<class CEmptyType>,class CCompressedStoreHeaderWriterT<class CEmptyType>,class CCompressedPayloadWriterT<class CEmptyType> >::CreateInstance",
        "?(?/?x?",
        "?+?6?D?R?`?",
        ">+>2>8>=>H>U>i>w>",
        "=1=G=M=^=o={=",
        "    Failed to add element metadata",
        "0A0L0c0p0",
        "%hs: SPGetCurrentOSGuid failed. Error: 0x%08X",
        "ERROR_CLIPBOARD_NOT_OPEN",
        "ERROR_DS_DOMAIN_VERSION_TOO_HIGH",
        "6:6A6G6L6W6f6n6t6",
        "SP_FIRSTBOOT_INFO",
        ".?AVCXXXXXHandledException@?2??DoExecute@CAddBootEntry@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "5(5,5<5@5P5T5d5h5x5|5",
        "%hs: Failed to set BCDE_LIBRARY_TYPE_ALLOW_PRERELEASE_SIGNATURES field for the safe OS entry. Status = %d",
        "x8!D$",
        ">2>O>",
        "0K0U0t0{0",
        "PSjHhhk",
        ":-:=:C:T:m:",
        ".PAVCXXXXXTemp@?BJK@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "010I0V0`0u0",
        "t$$hx",
        "3\"3A3T3[3a3f3q3|3",
        "=,=G=Q=[=a=o=",
        ".?AV?$Array@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$Array@E@2@@UnBCL@@@UnBCL@@",
        "080@0J0Q0W0\\0g0s0",
        "CSetupPlatform::SuspendAndRelease: Error creating the Setup Platform key. Error: 0x%08X",
        "Failed adding GDR package: %ws",
        "FilterPages",
        ".?AV?$SmartPtr@V?$ArrayList@W4OP_EXECUTION_PHASE@@@UnBCL@@@UnBCL@@",
        "ClientName",
        "8<8]8r8z8",
        ">3?s?",
        ">$>6>E>a>~>",
        "6?6M6W6}6",
        "tCOperation::DumpToLog",
        "9'9<9D9J9W9i9w9",
        "95:Z:",
        "5'51585>5C5N5Z5_5t5",
        "9%909>9^9y9",
        "9\"9)9;9H9P9W9\\9x9",
        "7A7N7U7c7y7",
        "=(>A>H>O>U>a>s>",
        "QueueAddCbsPackage called with [%d] paths",
        "=$>->;>E>V>_>l>u>|>",
        ";G(w ",
        "%hs: Snapshot is disabled by caller",
        "eCleanup snapshot",
        ".?AV?$CAutoRelease@PAUIVssEnumObject@@@RAII@@",
        "\\DosDevices\\",
        "uDSSj",
        "<&<8<F<",
        "se-NO",
        "  Resolved default install decision for external package: %s",
        "<]<d<j<o<z<",
        "93:B:s:",
        "System\\Setup\\Status\\UnattendPasses",
        "<@<G<S<k<",
        "1(1.151?1L1S1]1n1{1",
        "2 2*242>2H2_2p2|2",
        "j\\Yf9LG",
        "          Provider : %s",
        "SPAPI_E_DRIVER_NONNATIVE",
        "L$ h?",
        ".?AVSPFreeDiskRangeEnumerator@@",
        ": :':-:2:=:G:L:`:l:x:",
        "4)4H4m4",
        "RecoveryPhase",
        ".?AV?$ArrayListEnumerator@PAVCProfileInfo@@@_@UnBCL@@",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVCGlobalPath@@@UnBCL@@@UnBCL@@",
        "0>0b0t0|0",
        "ks-Deva-IN",
        "PVht$",
        "Mounting new image.",
        "4'4<4D4J4W4i4|4",
        "ERROR_PRINTER_DRIVER_WARNED",
        "y#Wjeh",
        "9<9T9c9",
        "5#5)595A5w5",
        "ERROR_SXS_UNKNOWN_ENCODING",
        "5@5R5Z5`5m5",
        "{5F0FDAAE-58E4-48B7-8296-0D46BB5BCE6B}",
        ";#;*;4;E;R;\\;k;t;z;",
        ":4:8:P:T:l:p:",
        "ERROR_SXS_THREAD_QUERIES_DISABLED",
        "<8<X<x<",
        "Failed to create destination WIMBoot partition directory %s",
        ">&>8>Q>X>l>",
        "system32\\logfiles\\scm",
        "FILESYSTEM_TYPE %d cannot be used to format a volume; see the definition in SetupPlatform.h",
        "F,j\\P",
        "; ;8;<;T;X;p;t;",
        ".?AV?$Array@PAVCImageInfo@@@UnBCL@@",
        "void __thiscall UnBCL::Array<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::RemoveAt(int)",
        "3#3'3+3/33373;3?3C3G3K3O3S3W3[3_3c3g3k3o3s3w3{3",
        "Failed to reinstall WinRE. Error: 0x%08X",
        "%hs: Invalid registry key: %s",
        "pap-029",
        "9%9.979@9I9[9e9",
        "Setting Correlation vector: %s",
        "6 6(6@6H6P6h6|6",
        "e%profilesFolder%",
        "?)?]?d?j?o?z?",
        "pForceUpload",
        "RestoreDirTree: RestoreFileStorageTierClass failed",
        "j:Yf9",
        ">1>?>m>",
        ";(;3;G;P;Z;a;g;l;w;",
        "BX;AX",
        "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6p6t6x6|6",
        "base\\ntsetup\\migration\\setup\\oc\\lib\\src\\occollection.cpp",
        ":+:Z:",
        "$MARKER.LOGS",
        "0 0$0<0@0X0\\0t0x0",
        "Cannot start fastcleanup thread. Error: 0x%08X",
        "=#=0=B=P=q=",
        "    File exists and overwrite is disallowed",
        "HARDLINK",
        "_CreateDeploymentProject",
        "CDeploymentProject::CreateFolderDeployment: Failed to add drivers to winre.wim Safe OS [%s]. Error: 0x%08X",
        "8%8P8a8",
        "Use Soft Reserve only under low disk space",
        "555C5b5p5z5",
        "RegValueEnumAction::Enumerate: Error enumerating contents of key: %s\\%s (error %d)",
        ">'>1>?>L>T>[>t>|>",
        ":2:::Z:p:",
        "1,1@1T1h1|1",
        "WIMBoot partition path: %s",
        "SPWpeLogCallback",
        "Sources\\Boot",
        "Failed adding language package: %ws",
        "3(3=3P3X3^3k3}3",
        "StartService",
        ">1>J>c>|>",
        "tjVWh",
        ".PAVCXXXXXHandledException@?2??DoExecute@CAddProvisioningPackage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ">B>O>a>i>o>|>",
        "OC::CCmdLineManager::GetCmdLinesFromRegistryKey: Unexpected value kind. Value: %s Kind: %d",
        "f97tF",
        "<I<\\<",
        "636F6P6U6i6",
        "=-=>=C=N=j=z=",
        ":-:A:I:O:c:",
        "OriginalFilename",
        ">(>A>H>O>U>d>j>~>",
        "class UnBCL::ArrayList<class UnBCL::String *> *__stdcall SPGetPathsArrayFromGlobal(class UnBCL::String *)",
        ".PAVCXXXXXTemp@?9??DoExecute@CMoveWIMBootEntriesAndPartition@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ".?AU?$IEnumerable@PAVCProfileInfo@@@UnBCL@@",
        "$0L0t0",
        ">Z?n?",
        "Call to %s on %s returned an error code: %u",
        "6+6e6",
        "XModuleName",
        "4*4>4O4X4",
        "<S<Z<i=(?B?X?~?",
        "%hs: LoadLibraryEx failed for %s. Error: 0x%08X",
        ":+:=:E:K:X:j:",
        "w$_^]",
        ";\";5;y;",
        "@.reloc",
        "IO error while loading script %s. Message: %s",
        "|3j&h",
        "?\"?,???R?\\?l?",
        "\\\\?\\Volume{",
        "LogHr",
        "CFirstBootApplyFromICB::DoExecute",
        "SPDeleteOldUpgradeSnapshots: Keep latest snapshot [%s]",
        "0:0C0",
        ":,:4:<:D:L:T:\\:d:l:x:",
        "Failed to query creation time for snapshot [%s], remove it. Error: 0x%08X",
        "SP_ENV_SCRATCH_DRIVE",
        "]ReadOrWriteSectors",
        "4 41484>4C4L4W4u4|4",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::RemoveAt(int)",
        "CDeploymentProject::CreateFolderDeployment: Failed to compute media customization layout: 0x%08x",
        "9 :':>:e:}:",
        ": :Y:`:",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::Remove(class UnBCL::String *)",
        "Found WinPE inbox support for compatible ID: %s",
        "void __thiscall CSetupPlatformApplyRollbackCheckpoint::Rollback(const unsigned short *)",
        ">9>N>V>\\>e>{>",
        "=$=0=P=X=`=h=p=x=",
        "=F=q=",
        "9,949<9H9h9t9",
        "1%131",
        "%hs: WIM handle created.",
        "ERROR_DS_PARAM_ERROR",
        "6$6,646D6L6T6d6l6t6",
        "pCopyTelemetryFile: fail to create correlation vector for file %s. Error code: %d",
        "8 8c8s8",
        "<9<C<V<",
        "Filter evaluation: Can't read property from disk as a number",
        "    Type: Component",
        "PhaseLabel",
        "4*494>4J4V4e4j4v4",
        "?)?X?e?}?",
        "909>9K9]9e9k9x9",
        "long __thiscall CTestHookDUUpdate::UnpackContents(const unsigned short *,int,int)",
        "bn-IN",
        "CAddProvisioningPackage::DoExecute",
        "1 1&1<1M1Z1d1u1",
        "  Hardlinking payload",
        "CAddSafeOSBootEntry::CreateRamdiskOptions",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "%s\\ControlSet%03u",
        "void __thiscall UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::AddRange(const struct UnBCL::ICollection<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo> *)",
        "CReconstructOS::RestoreInstallationSKUOverrides",
        "6#6(636>6C6W6|6",
        "PWWhX",
        "int __thiscall UnBCL::ArrayList<class CBasicEnvEntry *>::BinarySearch(int,int,class CBasicEnvEntry *,struct UnBCL::IComparer<class CBasicEnvEntry *> *)",
        "Disable feature",
        "%hs: BCD failed to retrieve the current boot entry. Error: 0x%08X",
        "9+949;9C9J9P9U9`9k9",
        "6*7U7p7",
        "Vjsj!",
        "?ToMultisz@MultiSz@UnBCL@@SGPAGABU?$ICollection@PAVString@UnBCL@@@2@@Z",
        "?9?t?",
        "Execution phase [%s] exiting with HRESULT [0x%08X]",
        "Rollback: Executing Sync commands: Failure while executing commands. hr = 0x%08X",
        "Failed to retrieve payload from element. Label: %s, destination: %s, error: 0x%08X",
        "DiskLayout::WillBeExtended: Can't get partition properties: 0x%08x",
        "9%9?9d9",
        "1#10161;1]1i1{1",
        "void __thiscall UnBCL::ArrayList<class CWIMBootData *>::AddRange(const struct UnBCL::ICollection<class CWIMBootData *> *)",
        "=2>M?W?",
        "(%lx): Failed to open child key: [%.*ws]",
        "4(4/454A4M4{4",
        "040P0l0",
        "<#<)</<5<;<A<G<M<S<Y<_<e<k<q<w<}<",
        "?D?w?",
        "Microsoft Time-Stamp PCA 20100",
        "kAlignment",
        "ERROR_DIRECT_ACCESS_HANDLE",
        "3$3,33393>3F3V3j3{3",
        "CNewSystem::GetCriticalDUPackageInformation: Failed to initialize DU. hr = 0x%x",
        "%hs: Successfully deleted old BCD store",
        "long __thiscall CWIMPidgenxExtractor::ExtractPidgenx(struct SetupPlatform::IImageInfo *,class UnBCL::String **,class UnBCL::String **)",
        "\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION",
        "VdsDisk::CreatePartition: Failed to get disk properties (0x%08x)",
        "ERROR_CANT_BREAK_TRANSACTIONAL_DEPENDENCY",
        "1E1P1X1t1",
        "3'323:3Q3p3x3",
        "6\"666V6j6q6w6|6",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CDrvStoreProperty *>::Reset(void)",
        "<D<L<T<\\<d<l<t<",
        "CRelocateOS: Cannot find room to move stale %s out of the way. Error: 0x%08X",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::Add(class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *)",
        "WdsCreateBlackboard",
        "SjHj`",
        ";,;A;G;T;f;t;",
        ".?AU?$ICollection@K@UnBCL@@",
        ".?AV?$CAutoRelease@PAUIDUUpdate@DU@@@RAII@@",
        "5%6,62676B6M6R6f6",
        "5/5Z5",
        "PayloadEnumerator::CreatePayloadEnumerator",
        "Registry key [%s] is created.",
        "<J<W<o<z<",
        ".?AV?$DefaultInstanceFactory@VCApplyEAs@@@UnBCL@@",
        "??1XmlDocument@UnBCL@@UAE@XZ",
        ":-:;:`:r:z:",
        "8*9J9",
        "ERROR_WMI_ALREADY_ENABLED",
        "JET_wrnBufferTruncated",
        "%hs: BCD failed to set boot sequence list. Error: 0x%08X",
        "Unmount the image %s",
        "VdsPartition::GetResizeBounds: Failed to query IID_IVdsDisk interface [%s] (0x%08x)",
        ":$:,:4:<:D:P:t:|:",
        "    CreateFile failed for %s",
        "InitLZMSCompression",
        "0)1i1s1",
        "ERROR_IPSEC_IKE_MM_EXPIRED",
        "2,282A2K2X2v2",
        "8!808?8L8Y8f8",
        "323>3S3l3",
        "SVWhpH",
        "6(727?7E7L7V7c7j7t7",
        "(%lx): Error opening old hive key [%ws]",
        "SETUPAPI.dll",
        "505=5",
        "int __thiscall UnBCL::Array<struct DiskRange>::Add(struct DiskRange)",
        "Current result string: %s",
        "Simple Cleanup",
        "D$0Phh",
        ".PAVCXXXXXTemp@?LH@??Rollback@CSetupPlatformOSSwitchCheckpoint@@UAEXPBG@Z@",
        "dRespecializeReboot",
        "6&6h6",
        "XFinalDumpFileLocation",
        "Applying %d BCD settings...",
        "Update telemetry log file from [%s] to [%s]",
        "SPAPI_E_NO_SUCH_DEVICE_INTERFACE",
        "3(3<3J3R3Y3e3k3{3",
        "6'6:6I6V6e6n6v6|6",
        "y#Vhv",
        "VdsPlatformDiskEnumerator::GetNext: Failed to get the next provider (0x%08x)",
        "CSetupPlatformOSSwitchCheckpoint::Rollback",
        "SL_E_SRV_INVALID_SECURITY_PROCESSOR_LICENSE",
        "ERROR_ARENA_TRASHED",
        "SKIPBOOTTRACK(FIRST): Sysprep offline specialization has no pending actions; no need to run online",
        "%hs: Cannot delete %s",
        "9>9[9b9n9s9",
        "1\"161X1e1",
        ".?AU?$IDictionaryEnumerator@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@UnBCL@@",
        "121D1L1R1_1q1{1",
        "winre.wim",
        ".?AVCEnableNewOSPageFile@@",
        ":K;};",
        "Skipping effective size calculation for directory: %ws because it is missing",
        "3)343B3j3z3",
        "2&222>2J2V2b2n2z2",
        "SPGetDiskImage: Unrecognized VendorId",
        ".?AV?$ArrayList@PAVCUserProfile@@@UnBCL@@",
        "ReconstructionEstimationDiskNeed",
        "Remove FeaturesOnDemand",
        "?1?6?r?",
        "9'929@9N9\\9",
        ".?AV?$Array@PAVCOperationInfo@@@UnBCL@@",
        "Error creating boot status data log(%s)! Bytes written = %#x, desired = %#x",
        "ERROR_SPL_NO_ADDJOB",
        "const struct DiskLayout::Partition *__thiscall UnBCL::ArrayList<struct DiskLayout::Partition>::GetBuffer(int) const",
        "Did not find any files in %s",
        "ZeroOutEntireDisk",
        "=)=2=A=J=w=",
        "Result",
        "WSht!",
        "3.343F3W3d3",
        ".?AU?$ICollection@PAV?$DictionaryEntry@_JPAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "=H>\\>",
        "838W8",
        "ERROR_EC_SUBSCRIPTION_CANNOT_ACTIVATE",
        ".?AUICopyDelegate@Directory@UnBCL@@",
        "333b3",
        "jRj\\j_jbj",
        "sJ9F,t",
        "0&060K0a0r0",
        "void __thiscall UnBCL::Array<class CGlobalPath *>::Insert(int,class CGlobalPath *)",
        "ERROR_DS_RECALCSCHEMA_FAILED",
        "pidgenx.dll",
        "5+5:5V5`5j5p5}5",
        "  [%s] => %s",
        "checkpointFile",
        "ERROR_CTX_MODEM_RESPONSE_TIMEOUT",
        "void __stdcall UnBCL::_::HTEnumerator<unsigned short,int,struct UnBCL::Hashtable<unsigned short,int>::TableKey,unsigned short,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,&protected: static unsigned short __stdcall UnBCL::Hashtable<unsigned short,int>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned short,int>::TableKey,int,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<unsigned short,int> *,class UnBCL::Array<unsigned short> *,int)",
        "? ?D?L?T?\\?d?l?t?|?",
        "=0=C=d=",
        "?IsDirectoryEmpty@Directory@UnBCL@@SGHPBVString@2@@Z",
        "%hs: Parent must have at least the same scope of data migration queued as well (%d vs %d).",
        "RetrieveDiskLayout: Element %s is not supported",
        ".?AVCRestorePageFileSettings@@",
        "RPC_S_UNKNOWN_AUTHN_TYPE",
        "ERROR_CTX_CONSOLE_CONNECT",
        "> ?'?O?~?",
        "90999",
        "0!0(0/050A0S0a0o0}0",
        ".?AU?$IEnumerable@UDiskRange@@@UnBCL@@",
        "?get_P@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$Array@PAVString@UnBCL@@@2@XZ",
        "?&?G?d?q?}?",
        "    Failed to get image information",
        "JET_errCommittedLogFilesMissing",
        "7I7u7\\:",
        "Merging diagnostics data fails since not opted-in",
        "ERROR_SXS_XML_E_BADPEREFINSUBSET",
        "<+<I<q<",
        "StateStoreGetMountedImages",
        "3\"444<4B4O4^4s4",
        "?0?O?]?|?",
        "8#8-898F8\\8q8}8",
        "4#4)444>4Q4`4l4s4z4",
        "?GetWindowsDir@Directory@UnBCL@@SGPAVString@2@XZ",
        "ERROR_DS_MUST_BE_RUN_ON_DST_DC",
        ".?AVCXXXXXHandledException@?BG@??pSPDoOfflineApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0H0PAUISPMigProgress@@@Z@",
        "WimBoot apply failed because the image is NOT a WIMBoot compliant image!",
        "1X1\\1`1d1h1l1p1t1x1|1",
        "<%<.<7<@<s<|<",
        "POSTVALIDATION: At least one validator failed, execution cannot continue.",
        "2'282>2M2U2",
        "Rollback disabled successfully",
        "5W5^5d5i5t5~5",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::Remove(class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *)",
        "2H2S2n2u2{2",
        "ERROR_VIRUS_DELETED",
        "PShD4",
        "SKIPBOOTTRACK(FIRST): Triggering First boot removal per environment variable",
        "1;2P2o2",
        "999A9V9s9y9",
        "G;~$r",
        "O:SYG:SYD:P(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)",
        "828=8J8Z8f8n8t8z8",
        "%18I64d",
        ".?AVCXXXXXHandledException@?IG@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "1,2=2D2L2S2^2e2k2p2",
        "SetupDUUpdateFiles: Source directory [%s] does not exist.",
        "7:7A7G7M7Y7j7p7",
        "RPh0{",
        "7 7)7@7G7M7R7]7h7|7",
        "base\\ntsetup\\setupplatform\\lib\\util\\migutils.cpp",
        "2!2+212>2r2~2",
        ":+:8:L:]:d:j:o:z:",
        "RtlFindSetBits",
        "pGetFileSystemInfoToFormat: Unsupported file system type [%d] specified for format",
        "GetElementMetadataKeys",
        "Invalid pointer ppvObject",
        "1:1[1x1",
        "=-=]=u=",
        "<1<Z<p<",
        "void __thiscall UnBCL::ArrayList<unsigned char>::RemoveAt(int)",
        "10m0t0",
        "2,242D2L2T2\\2d2l2t2|2",
        "0,0A0P0_0r0",
        "root\\securitycenter2",
        ".?AV?$DefaultInstanceFactory@VCFlowValidator@@@UnBCL@@",
        "DetermineIfControllerIsXHCI: SetupDiGetDeviceProperty failed. Error = 0x%X.",
        "0*0E0p0y0",
        ".PAVCXXXXXHandledException@?BA@??DoExecute@CInstallDUUpdatesOffline@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "  END",
        "PackagePath cannot be NULL",
        "MIG Validator: Failed to delete %s. Error: 0x%08X",
        "6&6-6;6I6Q6W6k6s6z6",
        ": ;4;<;D;L;T;`;",
        "0:0D0V0j0",
        "6-646",
        "QRPh ",
        "3 3%3*3>3F3P3X3^3q3x3~3",
        "j0_f;",
        "DiskLayout::ApplyProperties: Invalid GPT type",
        "?5?X?",
        "SPGetDiskImageNumber: Failed to get physical path of disk image (0x%08x)",
        ";$;0;8;`;h;p;",
        "  Setting name: %s",
        "707w7",
        "3'303:3C3M3V3`3i3",
        "797K7S7Y7f7x7",
        "3\"3'323>3M3U3e3m3t3",
        "1&141<1D1Q1k1z1",
        "cdf Parse Error Callback - Area (0x%x), Error (0x%x), %s.",
        ".?AVCXXXXXHandledException@?2??DoExecute@CStartSystemServices@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "%hs: Failed to reset %s. Error: 0x%08X",
        "ntdll.dll",
        "ERROR_THREAD_ALREADY_IN_TASK",
        "WorkerStateDuplicate",
        "%s\\Windows",
        "WriteDirImage",
        "%u,end",
        "=#=A=d=r=",
        "WpxGetDeplSettings",
        "ActionPlatform::CreateKey: Error in creating registry key %s; dwRet = 0x%x",
        ")MSFT_StoragePoolToPhysicalDisk",
        "Failed to append backslash.",
        "=Y=x=",
        "%hs: Failed to set BCDE_OSLOADER_TYPE_TEMP_PAGEFILE_DEVICE field. Status = %d",
        "7%72797",
        "1;3i3p3v3{3",
        "5\"505B5S5Z5v5}5",
        "{26D76235-F19F-40EE-80BD-16AF362658F2}",
        "TransformersRollback.ini",
        "RetrieveDiskLayout: Unsupported file system %s",
        ".?AV?$DefaultInstanceFactory@VCRemoveSRCheckpoints@@@UnBCL@@",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::Add(class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *)",
        "Parity",
        "1$10151C1e1{1",
        "? ?+?9?[?e?r?x?",
        "DiskLayoutMakeSystem: Failed to format system partition (0x%08x)",
        "ERROR_EA_TABLE_FULL",
        "6+696F6]6i6y6",
        "=O=a=i=o=|=",
        "DiskLayoutPrepare: Failed to wipe target disk (0x%08x)",
        "CInstallDUUpdatesOffline::DoExecute: Failed to apply component update. hr = 0x%x",
        "ku-Arab",
        "4%4=4h4",
        "1%1I1P1V1[1f1v1",
        "FOD Validator: Opening DISM session for the source system (Online)",
        "|$(9D$",
        "4:4a4t4",
        "6 646;6G6O6X6h6",
        "Failed to add new store from file. File: %ws Status: %x",
        "int __thiscall UnBCL::ArrayList<struct DiskLayout::Partition>::IndexOf(struct DiskLayout::Partition,int,int) const",
        "ERROR_LOCAL_USER_SESSION_KEY",
        "121`1q1",
        "343<3D3L3T3\\3d3l3t3|3",
        "4*4B4M4[4i4w4",
        "?get_Major@Version@UnBCL@@QBEHXZ",
        "8(959M9",
        "7,888D8g8u8~8",
        ".PAVCXXXXXTemp@?EN@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "6*717B7I7",
        "< <$<(<,<4<8<<<@<H<L<T<X<\\<`<d<h<l<p<t<x<|<",
        "<&<j<",
        "CDownloadDUUpdates::CalculateSpaceNeeded: Fail to get CDUPackage",
        "VWhH\\",
        "Failed reading Uninstall mark from registry: 0x%08x, size: %d",
        "SmPartition::CreateLogicalPartition: SM API do not support logical partitions",
        "NtQuerySystemInformation",
        "SPDeleteAllSnapshots: Failed to initialize COM. Error: 0x%08X",
        ";+;5;F;S;];q;z;",
        "CManifestCategory::AppendGUID",
        "\\Program Files\\Common Files",
        "ERROR_LOG_INVALID_RANGE",
        "CRYPT_E_EXISTS",
        "Process %s is accessing file wim %s",
        "CMediaLayout::QueueCbsPackages: Failed to update path for package %u (%s) in answer file: 0x%08x",
        "0,000@0D0T0X0h0l0|0",
        "RtlFindAceByType",
        "Prepare the new OS for first boot",
        "4&424<4M4V4b4o4y4",
        ":&:6:>:K:S:Y:^:",
        ">4><>D>L>T>l>",
        ";@;c;",
        ".?AUIUserProfile@SetupPlatform@@",
        "CMergeWIM::DoExecute: Failed to open WIM file %s. Error: 0x%08X",
        "Found [%lu] disks",
        "JET_errStreamingDataNotLogged",
        "<*<U<",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@_JPAVCGlobalPath@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::GetBuffer(int)",
        "NhWWWj",
        "CFfuMiscHelpersT<class CEmptyType>::ValidateNotOnTheSameDisk",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: DeletePath(%s) failed, will try to overwrite.",
        "0,080@0h0p0x0",
        "void __thiscall UnBCL::Array<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::InitLarva(class UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo> *)",
        ".?AVCFlowValidator@@",
        "NO NAME    FAT32   3",
        "ERROR_UNKNOWN_PORT",
        "7-7;7@7E7P7_7d7",
        "pEnumPathDirCallback",
        "6&646B6P6",
        "<$<0<5<@<N<S<g<n<t<y<",
        ">6>c>",
        "ERROR_SERVICE_DISABLED",
        "DestinationPath",
        "858J8k8w8",
        "ActionPlatform::StartServiceW: Failed to start service %s; dwRet = 0x%x",
        "void __thiscall UnBCL::Array<class CAppInfo *>::RemoveAt(int)",
        "8&8S8l8",
        ">.>8>Q>[>{>",
        "class UnBCL::ArrayList<class CCFGSectionValue *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class CCFGSectionValue *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        ";,=~#@^&'$%",
        "base\\ntsetup\\setupplatform\\lib\\static\\utilities.cpp",
        "0#1d1l1",
        "CAddBootEntry: Failed to convert New OS entry GUID to string",
        "<=<P<`<y<",
        "%hs: Setting BCDE_LIBRARY_TYPE_PREFERRED_LOCALE field.",
        "5=5V5",
        "222J2U2_2",
        "SizeRemaining",
        "ERROR_PATCH_TARGET_NOT_FOUND",
        "0-0G0e0l0",
        "CNewSystem::QueueEULAAccepted",
        "SleepEx",
        ":&:J:p:",
        "(%lx): Failed to open [%ws]",
        "SPCopyFilesAndFolders: Failed to remove target file %s. Error: 0x%08X",
        "CDownloadDUUpdates::DoExecuteInternal: Failed to download updates. hr = 0x%x",
        ".PAVCXXXXXTemp@?FC@??pSPDoOfflineApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0H0PAUISPMigProgress@@@Z@",
        "9P9u9",
        ":-:6:B:K:W:c:o:x:",
        "SetupPlatform::IsUninstallAllowed: Failed to check whether Uninstall is active. Error: 0x%08X",
        "%hs: Remove filter driver: %s",
        "=#>0>s>",
        ";+;H;k;",
        "j{Yf;",
        "int __thiscall UnBCL::Array<__int64>::Add(__int64)",
        ".?AV?$DefaultInstanceFactory@VCFirstBootApply@@@UnBCL@@",
        "4(4F4\\4j4",
        "0#0.0<0h0r0",
        "%hs: Failed to allocate memory",
        "Using boot files content folder: %s",
        "9%9/9<9P9X9v9}9",
        "1$10191A1O1W1^1u1|1",
        "4.4<4V4y4",
        "6+656?6I6S6j6x6",
        "808N8X8b8",
        "Mount Path",
        "Global\\SC_AutoStartComplete",
        "ERROR_DS_AUTHORIZATION_FAILED",
        "<,=7=E=S=a=",
        "4(464J4f4u4~4",
        "SysprepSession::ExecuteAction: stopService with parameters:                        pstrServiceName:%s, dwTimeout:%d, bStopDependentService:%d, bIgnoreFailureToStopDependentService:%d",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$ArrayList@PAVCDriverDetails@@@2@@UnBCL@@@UnBCL@@",
        "1$1/191L1U1f1",
        "0(060D0}0",
        "ERROR_INVALID_OPLOCK_PROTOCOL",
        "szEntryPointA",
        "> >(>4>T>\\>d>p>x>",
        "434=4Z4o4",
        ">,><>D>N>S>Y>f>k>t>",
        "sMoveJournalKernel.TXT",
        "%hs: Migration phase caught exception: %s",
        "5!5.5C5K5Q5_5x5",
        "1t2z2",
        "ERROR_THREAD_WAS_SUSPENDED",
        ".?AV?$ArrayList@PAVCOSPieceInfo@@@UnBCL@@",
        "%hs: GetProcAddress failed. Error:0x%08X",
        "Set Watson bucketing parameter #%d to %s",
        "ERROR_LOG_TAIL_INVALID",
        "CSetupPlatformPrivate::Execute: Failed to initialize Setup Platform diagnostics. Error: 0x%08X",
        "?#?)?.?9?F?Z?c?r?",
        "StateStoreGetVolumeFileCount",
        "8SVW3",
        "JET_errRecordFormatConversionFailed",
        "<b<u<",
        "2/3S3g3v3",
        "    Failed to copy string",
        ":+:C:W:",
        ":H:[:",
        "uninstall_data.xml",
        "WinReSetupSetImage",
        "7+767U7[7}7",
        "int __thiscall UnBCL::Array<struct SetupPlatform::IPartition *>::Add(struct SetupPlatform::IPartition *)",
        "?>?k?",
        ";6;S;t;",
        "1$1,141<1D1L1X1x1",
        "y,Wj8h",
        ":+:D:V:j:w:",
        "<!<+<5<C<I<O<T<^<h<r<|<",
        ":0:5:@:N:b:o:}:",
        "ERROR_INVALID_STATE",
        "2\"2.2@2N2\\2j2",
        "%hs: Create subkey %s",
        "ERROR_CLUSTER_INVALID_NODE",
        ":$:::e:q:",
        "ERROR_HANDLE_DISK_FULL",
        "7m8t82999Q9X9",
        "void __thiscall UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::RemoveAt(int)",
        "VdsVolume::GetProperties",
        "Failed to open WinPE DISM session. Error: 0x%08X",
        ".PAVCXXXXXHandledException@?2??DoExecute@CExportWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "=#=)=;=L=Y=h=p=",
        "GetVolumeInformationByHandleW",
        "ERROR_IPSEC_IKE_NEGOTIATION_DISABLED",
        "9\\$8tXB",
        "UUUUf",
        "1 1M1s1",
        "1*1:1K1R1X1]1h1r1z1",
        "__thiscall CRemoveWIMBootEntries::CRemoveWIMBootEntries(class UnBCL::ArrayList<class CWIMBootData *> *,const unsigned short *,int,int,int,int,enum OP_OPERATION_ID)",
        "2#2.282L2`2g2o2t2",
        "1'1K1]1e1k1x1",
        "=%=^=",
        "<,<4<L<T<\\<d<l<t<|<",
        "Failed to set new BCD display list. Error: 0x%08X",
        "3V4p4",
        "CRYPT_E_NO_SIGNER",
        "Failed to update bootmgr display order. Status = [%x]",
        "ERROR_CORE_RESOURCE",
        "FveSetFipsAllowDisabled",
        "Diagtrack service is running",
        "?SetEnvironmentVar@Environment@UnBCL@@SGXPBVString@2@0@Z",
        "ActionPlatform::StartServiceW",
        ";,;7;E;S;a;",
        "ERROR_TRUSTED_DOMAIN_FAILURE",
        "2)2;2C2I2S2]2q2",
        "ParseSizeString: Allowed values are: B, KB, MB, GB, TB, PB, EB, ZB, YB",
        "L$(Qj",
        "8)838u8",
        "GetTickCount64",
        "6+6a6",
        "%hs: Deleting the Recovery partition.",
        "BfspSuspendBitLocker SUCCEEDED (Enabled:%c Suspended:%c)",
        ".?AV?$SerializableBase@VCWDSImageInfo@@$0A@V?$DefaultInstanceFactory@VCWDSImageInfo@@@UnBCL@@@UnBCL@@",
        "5 5(5,5054585@5d5l5",
        ":$:0:<:H:T:k:",
        "1!2^2s2",
        "pResetSetup",
        ";%;7;l;",
        "3#373C3Z3g3",
        "IMAGE_STATE_GENERALIZE_RESEAL_TO_AUDIT",
        "4S5v5",
        ".?AV?$CAutoCleanupBase@PAUIElementEnumerator@@@RAII@@",
        "int __thiscall UnBCL::_::ArrayListEnumerator<struct DISK_SPACE_IMPACT>::MoveNext(void)",
        "xKernelModeTracingEnabled",
        "SetupPlatform: Begin Pre-SysPrep: Global progress: %u, Phase progress: %u",
        "int __thiscall UnBCL::Array<class CAppInfo *>::Add(class CAppInfo *)",
        "void __thiscall UnBCL::ArrayList<class CCopyInfo *>::AddRange(const struct UnBCL::ICollection<class CCopyInfo *> *)",
        ";A$u[",
        "%hs: SPGetOSInformation failed with error: 0x%08X",
        "L$vPV",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE",
        ": :$:(:,:4:X:`:d:h:l:t:x:|:",
        "VWPhp(",
        "?#?)?<?I?h?n?",
        "< <7<",
        "Command line is not Microsoft trusted",
        "CMergeWIM::DoExecute: WIM path %s is ID, but there is no execution context to get stored path. Cannot proceed",
        "%s.00%d",
        "8 8'8-828>8E8U8^8r8",
        ":$:1:7:>:H:U:\\:f:w:",
        "6 6&6+666=6Q6_6x6",
        "tKf9>tF",
        "=@>d>",
        "Setting WMI String property %s: can't convert to VARIANT type %d",
        "    pkg: Argument cannot be NULL",
        "CSetupPlatformOSSwitchCheckpoint::Rollback: Folder \"%s\" successfully removed.",
        "Attempting to remove target file (reparse): %s",
        "ERROR_CLEANER_CARTRIDGE_SPENT",
        "ERROR_SXS_MULTIPLE_DEACTIVATION",
        "JET_errInstanceUnavailableDueToFatalLogDiskFull",
        "SysprepSession::ExecuteAction: Error bypassed for addKey operation",
        "JET_errColumnDoesNotFit",
        "Cleanup external drivers after installation",
        "szFilePath",
        "1 11181>1C1N1X1l1",
        "Moving file operations journal from %s to %s",
        "PVWh[",
        "void __thiscall UnBCL::_::HTEnumerator<enum OP_OPERATION_ID,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,class UnBCL::DictionaryEntry<enum OP_OPERATION_ID,int>,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<enum OP_OPERATION_ID,int> __stdcall UnBCL::Hashtable<enum OP_OPERATION_ID,int>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::Reset(void)",
        "D$hQP",
        "?#?.?<?h?x?",
        "Re-direction of WU cache volume is not supported; attempting normal download",
        "3'4O4",
        "; ;-;=;K;W;_;e;n;v;};",
        "Failed Installing SSU packages.",
        ":.:9:i:",
        "CReconstructOS::RestageWindows: Failed to open DISM session for source image %s: 0x%08x",
        "OC status restored successfully",
        "void __thiscall UnBCL::Array<unsigned short *>::RemoveAt(int)",
        "%hs: SaveSystemBCDDatabase failed, ec = [0x%X]",
        ".text$mn",
        "L$4^3",
        "JET_errSystemPathInUse",
        "System32\\Config\\SYSTEM",
        "long __thiscall CDiagnosticsHelper::PersistDiagnosticsData(const unsigned short *)",
        "AddElementMetadata",
        "class CAppInfo *&__thiscall UnBCL::ArrayList<class CAppInfo *>::get_Item(int)",
        "No onesetting configured or error getting onesetting",
        "<&<b<o<",
        "%hs: Profile for %s(%s) has been moved. Expected %s but found %s. Uninstall validation will fail.",
        "Snapshot expired, remove it",
        "0P0q0",
        "void __thiscall UnBCL::ArrayList<class DiskLayout *>::AddRange(const struct UnBCL::ICollection<class DiskLayout *> *)",
        ">Q>y>",
        "6+646:6G6M6R6c6n6|6",
        "Failed creating source SOFTWARE hive path name %ls\\%ls",
        "UpdateBootCode:Successfully laid down NT boot code.",
        "=#=5===C=P=b=p=",
        "8$8+82888D8V8d8r8",
        "enum OP_OPERATION_ID __thiscall UnBCL::_::ArrayListEnumerator<enum OP_OPERATION_ID>::get_Current(void) const",
        "uYf9S",
        ".?AV?$SmartPtr@VCOperationsProgressWrapper@?1??DoExecute@CDownloadDUUpdates@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@@UnBCL@@",
        "CAbstractDisk::InitializeInternal",
        "9 9(9,90989<9@9H9L9P9X9\\9`9h9l9p9x9|9",
        "5 5&5+565@5S5m5t5z5",
        ".RecoveryAttempts",
        "MIG Validator: Machine-specific   : %s",
        ":2;b;o;",
        "?.?3?`?",
        "WIMBootData",
        "=#=n=",
        "??0MutableString@UnBCL@@QAE@PBG@Z",
        ";(;/;5;:;E;O;b;",
        "5#5.5<5h5r5",
        "90989@9F9a9i9r9x9",
        "3\"333P3_3",
        "<+<:<X<",
        "1!1(1:1G1X1s1",
        "=)=0=6=;=F=U=i=u=",
        "9#9.9C9O9W9^9d9i9t9",
        "void __stdcall UnBCL::_::HTEnumerator<enum OP_OPERATION_ID,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,enum OP_OPERATION_ID,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,&protected: static enum OP_OPERATION_ID __stdcall UnBCL::Hashtable<enum OP_OPERATION_ID,int>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<enum OP_OPERATION_ID,int> *,class UnBCL::Array<enum OP_OPERATION_ID> *,int)",
        "SysprepSession::ExecuteInternal: Component %s does not have offline-capable module, will run it online",
        ".?AV?$CAutoWimClose@PAX@RAII@@",
        "42494?4D4T4^4k4u4",
        "505D5L5T5\\5d5p5",
        "MSCFu",
        "Add safe OS boot entry",
        "<P<b<j<p<}<",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::MoveNext(void)",
        "class CDriverDetails *const *__thiscall UnBCL::ArrayList<class CDriverDetails *>::GetBuffer(int) const",
        "JET_errIndexTuplesKeyTooSmall",
        "> >/>7>=>m>y>",
        "ERROR_CLUSTER_NETWORK_EXISTS",
        "6/6M6h6",
        ".PAVCXXXXXTemp@?CK@??CreateFFUDeployment@CDeploymentProject@@UAEJPBGPAXPAUIGenericProgress@SetupPlatform@@@Z@",
        "WVh|_",
        "?\"?(?=?I?Y?i?",
        "pathToSignedReportingExe",
        "9,9>9L9",
        "4 525:5@5M5_5m5",
        "long __thiscall CMigChangesValidator::ValidatePreExecution(struct IExecutionContext *,enum OP_EXECUTION_PHASE,class COperation *,class COperationQueue *,int &)",
        "ExitProcess",
        ".?AVCInstallEula@@",
        ".PAVCXXXXXTemp@?EJ@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "CSetupPlatformInfo::Initialize",
        ":7:@:N:U:[:`:k:v:{:",
        "Failed to delete BSD log path element. Status: %x",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::LastIndexOf(class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *,int,int) const",
        "_^[Y]",
        "Applying data-only settings overrides using SMI...",
        "DiskLayoutMakeReserved",
        ":K:q:",
        ";/;>;O;\\;g;x;",
        ".?AUIDisk@SetupPlatform@@",
        "?!?.?>?J?T?[?a?f?q?",
        "SKIPBOOTTRACK(FIRST): 1st boot apply became incomplete due to tracked object changes, will need to run online",
        ">,>6>?>U>c>y>",
        "  Name: %s, Order: %d",
        "Failed to get BCD display list. Error: 0x%08X",
        "SPProcessBitlockerOnDrives: Bitlocker suspended successfully.",
        "4,4D4N4t4",
        "CRYPT_E_NO_TRUSTED_SIGNER",
        "AppendNewElement",
        "ERROR_ABIOS_ERROR",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Failed to set compression state for \"%s\", skip.",
        "SL_E_PKEY_INVALID_UPGRADE",
        "1!1*1E1L1R1W1b1i1{1",
        "%SystemRoot%\\Panther\\FirstBootTel.etl",
        "ERROR_VDM_HARD_ERROR",
        "4'494G4Y4|4",
        ".PAVCXXXXXTemp@?3??DoExecute@CRefreshLocalizedString@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "9*979K9W9]9i9t9~9",
        "717I7a7y7",
        "long __thiscall CNewSystem::QueueOperations(class CImageInfo *,__int64,const unsigned short *,enum _FIRMWARE_TYPE,const unsigned short *,int)",
        ">0E0K0P0[0b0v0",
        "Error removing setup event queue file. Exception: %s",
        "ERROR_DS_AUTH_UNKNOWN",
        "tYh\\^",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *> *)",
        ".PAVCXXXXXHandledException@?KL@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "%hs: [%s] has BitLocker off before upgrade but now BitLocker is on, validation failed",
        "ERROR_PROFILE_DOES_NOT_MATCH_DEVICE",
        "2'2B2H2R2W2a2h2v2",
        "pGetExistingPageFiles: Failed to get PagingFiles value from %s: 0x%08x",
        "SmVirtDisk::EnumeratePooledDisks: Failed to create enumerator (0x%08x)",
        "CMediaLayout::QueueDrivers: Failed to update answer file path for driver %u (%s): 0x%08x",
        "ERROR_DS_CANT_MOD_OBJ_CLASS",
        "_CreateSetupPlatformPrivate",
        ".?AU?$ICollection@PAX@UnBCL@@",
        "7&7.757F7T7m7",
        "5\"5,5=5J5b5u5|5",
        "=%=7=E=",
        "777n7",
        "_lock",
        "4&4Y4_4k4v4",
        "ERROR_CLUSTER_NODE_NOT_MEMBER",
        "{26AFDF37-9DC0-42F6-94C4-4306805F056C}",
        "ERROR_INVALID_TIME",
        "Total time: %lld ms",
        "8#8D8P8e8}8",
        "%hs: Successfully register RollbackOnlineUser into the RunOnce key",
        ";*;0;A;];i;",
        "{4658ee7e-f050-11d1-b6bd-00c04fa372a7}",
        "CSIDL_RECENT",
        "SL_E_TOKSTO_NO_TOKEN_DATA",
        "?@?N?]?}?",
        "3&3-33383C3M3R3f3",
        "ERROR_CLUSTER_LAST_INTERNAL_NETWORK",
        "pLogUpdateInfo: IUpdate::get_KBArticleIDs failed. hr = 0x%x",
        ".?AVRegValueLogger@@",
        "SPTagTarget",
        "2!2D2Y2`2f2k2v2",
        ".?AV?$Array@PAVCUserProfile@@@UnBCL@@",
        "void __thiscall UnBCL::Array<class COperationsValidator *>::RemoveAt(int)",
        "%hs: Fail-forward rollback requested but it's not available in this scenario",
        ".PAVCXXXXXHandledException@?EL@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        ".?AV?$SmartPtr@VCFileCreationData@@@UnBCL@@",
        "%hs: Failed to redirect WinPE boot logging to %s. Error: 0x%08X",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: \"%s\" exists, obliterating.",
        "JET_errFixedDDL",
        "PQRj+",
        "VdsPartition::GetOrdinal",
        "<3<e<}<",
        "ERROR_LIBRARY_OFFLINE",
        "SPAPI_E_AUTHENTICODE_TRUSTED_PUBLISHER",
        "CRelocateOS: Will attempt to merge %s into %s",
        "ERROR_QUORUM_RESOURCE_ONLINE_FAILED",
        "SL_E_VL_KEY_MANAGEMENT_SERVICE_ID_MISMATCH",
        "CDeploymentProject::EnableAuditMode: Will copy %s recursively as audit mode payload",
        "9&9E9",
        "?)?3?=?T?b?l?v?",
        "\\microsoft\\windows\\devicesoftwareupdates\\",
        ">\">+>4>=>F>O>X>a>j>s>|>",
        "VSSAPI.DLL",
        "jdQj_SQW",
        "ImpersonateLoggedOnUser",
        "001{1",
        "JET_errInTransaction",
        "CNewSystem::QueueProductKey",
        " SVWj\\",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@GG@UnBCL@@@UnBCL@@@UnBCL@@",
        "8!8.8;8L8T8Z8_8n8",
        ">0>8>?>E>J>U>_>r>}>",
        "?get_HResult@Exception@UnBCL@@UBEJXZ",
        ".?AVCXXXXXHandledException@?2??DoExecute@CApplyBCDSettings@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "1Z2_2d2o2",
        ">+>1>7>=>C>I>P>W>^>e>l>s>z>",
        "7!717=7O7n7z7",
        "\\REGISTRY\\MACHINE\\SAM",
        "_vsnwprintf_s",
        "UndoTransformers failed for %s. Error: 0x%08X",
        "Failed to set element display order. Status = [%x]",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> > const *,struct __POSITION * const &)>::Reset(void)",
        "ERROR_GUID_SUBSTITUTION_MADE",
        "6-6;6G6P6g6",
        "void __thiscall UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *>::Resize(int,int)",
        "SPGetFootprintCapabilities: Failed to construct config file path. Error: 0x%08X",
        "? ?)?2?;?D?M?c?q?z?",
        "TextOutW",
        "y+VjHh",
        ".?AVCOCNameMatcher@OC@@",
        "8%82878J8[8t8",
        "??0StreamWriter@UnBCL@@QAE@PAVStream@1@PAVEncoding@1@HHH@Z",
        "JET_errInitInProgress",
        "Created by SetupPlatform",
        ".?AV?$SerializableBase@VCSuspendBitlocker@@$0A@V?$DefaultInstanceFactory@VCSuspendBitlocker@@@UnBCL@@@UnBCL@@",
        "CICBStore::OpenICBInPackage",
        "CManifestCategory::AppendString",
        "ServiceSpaces: Skipping %s",
        "UnmarshallImageHandleFromDirectory",
        "5C5c5",
        "2w3~3",
        "8/8A8I8O8c8i8r8",
        ".?AVCInstalledOCStore@OC@@",
        "VERBOSE: Path %s has no exceptions, trying a straight move",
        "VERBOSE: processing validator index %d",
        "CSetupPlatformCheckpoint::CopyConfigFiles: Cannot locate source config file \"%s\".",
        "long __thiscall CUnmountWIM::DoExecute(struct IExecutionContext *,void *,struct IInternalOperationsProgress *)",
        "SPCopyFilesAndFolders: Failed to cancel access to network share %s; Error: 0x%08X",
        "8:8H8U8c8x8",
        "RestoreReparsePoint",
        "SPGenerateCopyListFromConfigFile: Unsupported architecture %d",
        "SetupPlatformTel",
        "int __thiscall UnBCL::_::ArrayListEnumerator<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::MoveNext(void)",
        "VdsPartition::GetResizeBounds: Failed to query IID_IVdsAdvancedDisk interface [%s] (0x%08x)",
        ".?AU?$IList@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "3+3;3@3I3\\3j3q3z3",
        "=*=1=b=k=y=",
        "CProvisioningElement::RetrievePayload",
        "030T0i0m0q0u0y0}0",
        "7&7B7S7a7i7o7t7",
        "1-1:1b1i1o1t1",
        ">->;>g>w>",
        "8)848;8@8T8l8",
        "GetSizeOfWinRE: Failed to get the temp file directory (0x%08x)",
        "OC::COfflineOCManager::GetOCStatus",
        "2'3K3Y3`3f3k3v3",
        ";#;D;S;X;v;",
        "8,868J8S8f8n8",
        "=&=C=J=q>x>",
        "%hs: Failed to initialize DISM. Error: 0x%08X",
        "FOLDERID_SavedGames",
        "CreateCustomPartition",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVSysprepAction@@@UnBCL@@@UnBCL@@",
        "8$8C8J8Q8\\8n8v8",
        "ERROR_ALREADY_RUNNING_LKG",
        ".?AVCXXXXXHandledException@?LP@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "MIG_DISABLE_CONTENT_REMAP",
        "DriverPackageOpenW",
        "ERROR_CLUSTER_GROUP_MOVING",
        "SmPlatformDiskEnumerator::Initialize: Failed to query disk instance (0x%08x)",
        "1'131?1K1T1]1f1o1x1",
        ".PAVCXXXXXHandledException@?2??DoExecute@CExtractFilesFromWDSImage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "= =I=",
        "Xf9ABt",
        "JET_errClientRequestToStopJetService",
        "InstallICB",
        "Register sync process",
        "{7EBD8242-0970-4EC1-B830-B0D505B1A035}",
        "Error removing directory %s",
        ".PAVCXXXXXHandledException@?2??DoExecute@CCompressOldOS@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "ERROR_INVALID_LOGON_HOURS",
        "60777C7J7",
        "> >&>,>2>8>>>D>J>P>V>\\>b>h>n>t>z>",
        "9!939A9g9y9",
        "PostQueuedCompletionStatus",
        "<#<:<J<X<l<t<",
        "MAJOR",
        "BackupMounts failed",
        "7;7U7p7",
        "CERT_E_REVOCATION_FAILURE",
        "9<9Y9w9",
        "int __thiscall UnBCL::ArrayList<class COSPieceInfo *>::BinarySearch(int,int,class COSPieceInfo *,struct UnBCL::IComparer<class COSPieceInfo *> *)",
        "2,2=2D2Z2u2{2",
        "PendingOperations",
        ">,>M>j>",
        "f;D$,u",
        ".?AV?$SerializableBase@VCGatherOCs@@$0A@V?$DefaultInstanceFactory@VCGatherOCs@@@UnBCL@@@UnBCL@@",
        "_wtoi",
        "<!</<=<K<Y<",
        "CSetupPlatformPrivate::Execute: Failed to deserialize/execute pre-FirstBoot operations. Error: 0x%08X",
        "?\"?2?B?",
        "y9Vh[",
        "?.???F?\\?w?}?",
        "1)2B2p2",
        "Failed to remove OOBE boot completed journal, error: 0x%08X. Error is fatal.",
        "VdsDisk::CreatePartition: Could not get handle to disk to set partition name (0x%08x)",
        "1,1C1Q1q1",
        "CSetEntropy::DoExecute",
        "RtlSetControlSecurityDescriptor",
        "class CCFGSectionValue *__thiscall UnBCL::_::ArrayListEnumerator<class CCFGSectionValue *>::get_Current(void) const",
        "ERROR_CLUSTER_NETWORK_HAS_DEPENDENTS",
        ".?AV?$CAutoCleanupBase@PAVCOperationQueue@@@RAII@@",
        "8!8(8.838>8E8Y8c8y8",
        ": :,:8:L:]:l:s:y:~:",
        "888?8F8L8X8l8z8",
        "2&2:2Y2g2",
        "xGuid",
        ">,>M>Z>{>",
        "<;=M=S=e=k=}=",
        "6!6)61676=6I6]6f6z6",
        "JET_errIndexTuplesTextBinaryColumnsOnly",
        "282>2^2t2",
        "ApplyFirstBootOnlinePluginErrorList",
        "Failed to enumerate driver packages, Err = 0x%lx",
        "707D7X7l7",
        "Set reg key value ProfileInterval failed: 0x%x",
        "SL_E_CIDIID_INVALID_VERSION",
        "DiskLayout::Execute: Failed to initialize disk (0x%08x)",
        "8/8X8j8~8",
        ":$:6:>:D:V:g:t:",
        ".?AV?$ArrayListEnumerator@PAVCCleanupEntry@CSimpleCleanup@@@_@UnBCL@@",
        "int __thiscall UnBCL::ArrayList<class COperationsValidator *>::LastIndexOf(class COperationsValidator *,int,int) const",
        "32383J3R3X3j3y3",
        "void __thiscall UnBCL::ArrayList<struct _GUID>::set_Item(int,struct _GUID)",
        "base\\ntsetup\\setupplatform\\lib\\src\\ocmigration.cpp",
        "  Edition ID = %s",
        "9L$8~H",
        "Failed to finalize session: %S",
        "8-8A8M8i8w8",
        ">_9A t",
        "3*3^3}3",
        "0)050>0G0V0]0r0}0",
        "   Done",
        ".?AU?$IDictionary@PAVString@UnBCL@@PAUHKEY__@@@UnBCL@@",
        "1$141<1G1N1T1Y1d1q1",
        "Failed opening target WPA",
        ".?AVCXXXXXHandledException@?2??DoExecute@CUpdateBootCode@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "3$4C4g4",
        "<#<2<C<P<Y<z<",
        "3$3+31363A3H3M3a3",
        "TrackedVolumes.ini",
        "4!4(44494I4T4b4g4",
        ">,>4>:>G>V>g>",
        ".?AV?$HTDictEnumBase@K@_@UnBCL@@",
        "v1j:Xf;A",
        ".?AVCXXXXXHandledException@?2??ApplyServicingSettings@@YGXPBG000@Z@",
        "5\"5(5.545:5@5F5L5R5t5",
        "Processing OS volume",
        "ERROR_DS_PARENT_IS_AN_ALIAS",
        "OS pieces not found, cannot proceed with reparse point enumeration",
        "RunPlatformActions:Sysprep data was marked corrupt; cannot proceed",
        "=*=;=I=X=f=m=r=}=",
        "? ?'?",
        "ERROR_INVALID_NETNAME",
        ".?AV?$SerializableBase@VCUpdateBootSector@@$0A@V?$DefaultInstanceFactory@VCUpdateBootSector@@@UnBCL@@@UnBCL@@",
        "< <(<0<@<d<l<t<|<",
        "SPGetDiskImage",
        "VdsPartition::Delete: Couldn't delete partition (0x%08x)",
        "int __thiscall UnBCL::ArrayList<class COperationInfo *>::BinarySearch(int,int,class COperationInfo *,struct UnBCL::IComparer<class COperationInfo *> *)",
        ">#>G>",
        "SPGetDiskSmartStatus: Device %s didn't report SMART information (0x%08x)",
        "Reserve disk space first boot",
        ".?AVVdsDiskPartitionEnumerator@@",
        ":(:m:t:z:",
        ".?AU?$ICollection@PAVCOSPieceInfo@@@UnBCL@@",
        "2:2V2",
        ">!>M>^>k>w>",
        "?\"?,?3?9?>?F?Q?e?q?",
        "1#1-141:1?1J1V1j1",
        "9@9R9Z9`9m9",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@W4OP_EXECUTION_PHASE@@PAV?$ArrayList@PAVCOperation@@@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "^[w\"QRW",
        "Reinstalling the .NET Framework...",
        ".?AV?$Array@PAVCDUPackage@@@UnBCL@@",
        "CReconstructOS::RestoreInstallationLanguageSettings: No preferred language available. Will proceed, but system may be localized to the wrong language",
        "ERROR_WMI_READ_ONLY",
        "; ;';-;2;=;H;c;|;",
        "8'888A8J8T8]8f8",
        "%hs: Failed to copy \"%s\" to \"%s\" GLE = [%d].",
        "void __thiscall UnBCL::ArrayList<enum OP_EXECUTION_PHASE>::set_Item(int,enum OP_EXECUTION_PHASE)",
        ".?AVCBcdSettings@@",
        "b7f52cfb-c9e9-4481-9bc0-c8b4e208ba39",
        ".PAVCXXXXXTemp@?BOM@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "tO|Fnullptr != wszHiveFilePath",
        "1)191D1c1q1",
        "SmPlatform::ComputeHostInfo",
        "CUntagSourcesFolder::DoExecute: [%s] is tagged, untag it",
        "dScenarioDateTime",
        "setupcl.exe",
        ".?AV?$SmartPtr@V?$Hashtable@KPAUIVdsVDisk@@@UnBCL@@@UnBCL@@",
        "4-4B4M4T4`4g4n4z4",
        "void __thiscall UnBCL::Array<class CDeploymentBase *>::Insert(int,class CDeploymentBase *)",
        "][YZ_^_^[",
        "? ?<?@?D?H?X?`?d?h?l?t?",
        ":!:-:D:P:\\:h:t:",
        "2,242<2P2X2`2p2|2",
        "0 0,080D0P0\\0h0t0",
        "828X8",
        ".?AV?$CAutoCleanupBase@PAVWmiCallResult@WMI@@@RAII@@",
        "FIOClearAttributes",
        "Cannot open BCD, if this is a one-time boot sequence we can't make it permanent",
        "1 1-1=1I1Y1m1",
        "CTrustSafeOS::DoExecute: Failure while trying to validate %s: 0x%08x",
        "Set reg key value UploadEtlFileConsent failed: 0x%x",
        "<5<C<l<r<~<",
        ";.;;;W;^;d;i;t;",
        ".PAVCXXXXXTemp@?CI@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "3#3-3A3I3P3V3[3f3w3",
        "=8=m=",
        "JET_errRecordNotDeleted",
        "e4b04398-adbd-4b69-93b9-477322331cd3",
        "PhpK2",
        "0)0.0B0V0",
        "onecore\\base\\ntsetup\\provpackageapi\\lib\\metadataenumerator.cpp",
        "JET_errFileAccessDenied",
        "ERROR_CLUSTER_DATABASE_TRANSACTION_IN_PROGRESS",
        "CompareStringW",
        "0;0G0_0e0w0",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::set_Item(int,class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *)",
        "%systemroot%",
        "j j2j1j0jWj",
        "7 747V7]7c7h7s7~7",
        "9 9'9-979Y9_9s9",
        "#0>0V0l0",
        "2)2?2J2S2c2l2x2",
        "<%<6<^<k<",
        "ERROR_EVT_INVALID_PUBLISHER_PROPERTY_VALUE",
        ">D>c>",
        "    Failed to get value",
        "yPShI",
        "<D<O<`<g<m<r<}<",
        "AddReparsePointToImage",
        "CreateCustomPartitions: Total partitions size bigger than free space on disk",
        "QQQPQQWQQS",
        ".PAVApplicationException@UnBCL@@",
        "8!838D8V8^8d8q8",
        "void __thiscall UnBCL::Array<class CDeviceIdDatabase::CDeviceInfoData *>::RemoveAt(int)",
        "ERROR_DS_ROLE_NOT_VERIFIED",
        "<1<B<I<W<p<w<~<",
        "Failed to acquire permissions to load hive. Status: %x",
        ".?AVCOperationsProgressWrapper@?1??DoExecute@CDownloadDUUpdates@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "class CDeploymentBase::CMountedPathInfo *&__thiscall UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *>::get_Item(int)",
        "GetPropW",
        "Microsoft Time-Stamp Service",
        "WimExchangeFiles: Delete failed",
        "ERROR_DISK_REPAIR_DISABLED",
        "SetupPlatform: Begin Post-SysPrep: Global progress: %u, Phase progress: %u",
        "strncmp",
        "PRhD4",
        ">(>H>P>X>`>l>",
        "?2?>?N?W?^?k?",
        "2Z2e2",
        "2\"2.242<2T2\\2f2m2s2x2",
        "$(runtime.system32)",
        "2+2A2Y2f2",
        "CNewSystem::SaveProgressData",
        "ERROR_SESSION_CREDENTIAL_CONFLICT",
        "pFindOccupiedRegions",
        "CMicrodom_Blob",
        "    Failed to allocate spLongIntermediate.get()",
        "SPGetWIMImageInfo: Failed to extract software hive from WIM image. Error: 0x%08X",
        "9,949<9D9L9T9\\9d9|9",
        ".rsrc",
        ".?AVXmlDocument@XmlLite@UnBCL@@",
        "_wtoi64",
        "ERROR_IPSEC_IKE_MM_LIMIT",
        "0!01080>0C0O0W0k0{0",
        ">:?t?",
        "base\\ntsetup\\setupplatform\\lib\\util\\unattend.cpp",
        "0VShT!",
        "class CDriverInfo *__thiscall UnBCL::_::ArrayListEnumerator<class CDriverInfo *>::get_Current(void) const",
        "CSetupPlatformPrivate::Execute: Failed to write progress start phase in file: %s. Error: 0x%08X",
        "Found match for update %s. Current State: %s, Target State: %s",
        ">3>=>R>d>l>r>",
        "SysprepSession::CreateSession: Failed to determine whether online session's process is WOW64; GLE= %d",
        "9\\$ t3",
        "C;_$r",
        "284x4",
        "CSetupPlatform::EnumerateDisks: Can't initialize disk provisioning! Error: 0x%08X",
        ":*:{:",
        "6\"6,61696@6L6^6q6w6",
        ":':J:",
        "void __thiscall UnBCL::Array<class CAntiVirusInfo *>::InitLarva(class UnBCL::ArrayList<class CAntiVirusInfo *> *)",
        "class ISPPluginData *const &__thiscall UnBCL::ArrayList<class ISPPluginData *>::get_Item(int) const",
        ".?AVTextWriter@UnBCL@@",
        "535[5b5",
        "Cf9Y*",
        "8?8L8b8",
        ": :2:B:Z:t:{:",
        "5'5O5g5z5",
        "Failed to copy ProductType value",
        "6D6h6o6",
        "null array to Hashtable#CopyTo",
        "{5005DC89-763C-4E8B-8B7A-354D1D8126EC}",
        "WinReGetConfig",
        "40484@4H4P4X4`4h4p4x4",
        "ERROR_EVT_INVALID_OPERATION_OVER_ENABLED_DIRECT_CHANNEL",
        "VERBOSEOPS: SORTORDER: Setting operation order for phase %d",
        "L$ j8",
        "IsDebuggerPresent",
        "4@4T4l4s4z4",
        ".?AUISPMigProgress@@",
        "pbr: Estimating disk space requirements...",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCFileCreationData@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCFileCreationData@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<class CFilterDriverInfo *>::set_Item(int,class CFilterDriverInfo *)",
        "=5=L=o=",
        ".?AU?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@",
        "WIM_Chunked_Parallel_Decode",
        ";8;S;^;i;w;",
        "Failed to update object GUID string. Status: %x",
        ">(>,>0>4><>`>h>l>p>t>|>",
        "5'5;5V5k5w5",
        "JET_wrnTableInUseBySystem",
        "? ?%?0?=?Q?]?d?j?o?z?",
        "=2=F=T=b=p=~=",
        "3@3T3d3{3",
        "4>4C4",
        ":\":/:<:P:g:t:",
        "struct PageFileDesc *__thiscall UnBCL::_::ArrayListEnumerator<struct PageFileDesc *>::get_Current(void) const",
        "ERROR_INVALID_COMPUTERNAME",
        "OSUpdates",
        "Win32Exception trying to create a profile for user.",
        "s$97t",
        ":':0:R:`:j:s:|:",
        "CNewSystem::QueueInstallDynamicUpdates",
        ".PAVCXXXXXTemp@?7??SPGetCBSCompletionStatus@@YGJPAVString@UnBCL@@0PAH@Z@",
        ".PAVCXXXXXTemp@?N@??QueueAddAppxPackage@CNewSystem@@UAEJPBGQAPBGI_KW4SP_ERROR_HANDLING@SetupPlatform@@@Z@",
        ".?AV?$DefaultInstanceFactory@VCAddSafeOSBootEntry@@@UnBCL@@",
        "[%s] is not a HKLM registry.",
        "  Column number: %d",
        "<*<?<E<\\<m<",
        "3(3<3D3L3T3\\3h3p3",
        "$(runtime.commonfiles)",
        "2%232A2",
        "<!<*<C<J<Q<W<c<w<",
        "pAddSafeOSDriversFromProvPackage",
        "void __thiscall UnBCL::Array<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::Insert(int,class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *)",
        "%hs: Data migration with SP_MIG_SCOPE_NONE makes no sense",
        "%hs: Skipping non-critical driver %s",
        "6\"686E6]6",
        ".?AV?$SerializableArrayBase@PAVCOperationsValidator@@@_@UnBCL@@",
        "MIG_IGNORE_PROFILE_MISSING",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::Reset(void)",
        "Uninstall.IMG",
        ";!;,;3;F;R;`;g;m;r;};",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::GetBuffer(int)",
        "Failed to open WIM file %s. Error: 0x%08X",
        "base\\ntsetup\\setupplatform\\lib\\private\\crashrecovery.cpp",
        "class CWIMBootData *&__thiscall UnBCL::ArrayList<class CWIMBootData *>::get_Item(int)",
        "8M9u9",
        ".PAVCXXXXXTemp@?3??pSPCheckAndDeleteUpgradeSnapshot@@YGJPAVString@UnBCL@@0PAUHKEY__@@KHPBGPAUITelemetry@@PAH@Z@",
        "6b6i6t6",
        "565H5T5~5",
        ".PAVCXXXXXHandledException@?KJ@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "8_9j9",
        ";';-;3;8;B;L;V;`;n;t;z;",
        "3%3+303<3D3X3q3",
        "pSPHardLinkFileForTask: Cannot copy %s to %s. Error: 0x%08x",
        "8!8)808<8N8c8r8|8",
        "GetVersionExA",
        ":%:7:J:V:b:j:",
        "Snapshot Cleanup Period is not in rage; using default value: %d",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCCmdLineExecutionTelemetryData@OC@@@UnBCL@@@UnBCL@@",
        "TlsGetValue",
        "VdsPlatform::CreateVirtualDisk",
        "8 9V9",
        ".PAVCXXXXXHandledException@?IG@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "void __thiscall UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *>::QuickSort(class UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *> *,class UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *> *,int,int)",
        "RtlValidSid",
        "1Q1V1[1g1",
        "??1InvalidOperationException@UnBCL@@UAE@XZ",
        "ERROR_SERVICE_NO_THREAD",
        "202G2S2c2o2v2~2",
        "9 9*9A9L9Z9k9",
        "void __thiscall OC::CInstalledOCStore::GetOCsThatNeedAStateChange(class OC::COCCollection *,class UnBCL::SmartPtr<class OC::COCCollection> &,class UnBCL::SmartPtr<class OC::COCCollection> &)",
        "2 2E2",
        "Msg:[%ws] ",
        "=#=1=9=C=K=Q=V=c=j=p=u=",
        "SPInitializeDiskPlatform: Couldn't initialize VDS (0x%08x), trying to initialize SM API",
        "\\Device\\KsecDD",
        "ERROR_THREAD_NOT_IN_PROCESS",
        "4 4&4P4U4[4a4g4m4s4y4",
        ";\";.;6;h;",
        "?!?5?y?",
        "?2?c?",
        ";8<t<",
        "Multithreaded decoding for chunked WIM is enabled!",
        "6#686@6F6Z6j6r6",
        "Validate tracked content",
        "CUpdateBootCode::DoExecute: An error occurred while repair system partition. Root path [%s], boot path [%s]. Error: 0x%08X",
        "Failed to save downlevel phase to file: %s. Error = %d",
        "2$2,242<2D2L2T2\\2",
        ".?AV?$SmartPtr@VCNewOperationsInternalProgress@?1??ExecuteOperations@COperationQueue@@QAEJW4OP_EXECUTION_PHASE@@PAUIExecutionContext@@PAXPAUIOperationsProgress@SetupPlatform@@IIHPAH4@Z@@UnBCL@@",
        "0\"0-030:0G0S0\\0h0m0v0}0",
        ":#;<;B;T;",
        "y,Who",
        "0(000H0|0",
        ":t;{;",
        ";3;O;",
        ";.;C;R;\\;a;i;p;|;",
        "%s\\%s(%d)%s",
        "%hs: Cannot get WIM attributes for %s. Error 0x%08X",
        ".?AU?$IList@PAVCUserProfile@@@UnBCL@@",
        "3$3.3",
        "CompareFileVersions: Couldn't get fixed file info of [%s] and/or [%s]. GLE = %u",
        "Failed to copy object name %.*ws. Status: %x",
        "SPGetDiskImage: Can't open %s (0x%08x)",
        ": :9:X:r:",
        "0\"030@0H0O0U0Z0e0s0y0",
        "Failed to delete %s. hr = 0x%x",
        "7!8L8",
        "7&7I7Y7",
        "0&0F0t0",
        "CSetupAutomation::GetTargetDrive: Failed to refresh cached target info: 0x%08x",
        "t.PVh",
        "??0?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@HH@Z",
        "5+5;5A5a5m5w5",
        "CreateSemaphoreExW",
        "60686O6Y6b6",
        "SPCreateTempPageFileForCrashDumpCapsule",
        ".?AUICopyCallback@@",
        "4&4>4J4Z4",
        ";0;8;>;K;];k;x;",
        "UnmarshallCallback",
        "?0?V?~?",
        ".?AVCXXXXXHandledException@?9??SPApplyAnswerFileSettings@@YGJPBG000PAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "ERROR_REM_NOT_LIST",
        ".?AU?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@H@UnBCL@@@UnBCL@@",
        "void __thiscall CSetupPlatformCheckpoint::CopyConfigFiles(unsigned short,class UnBCL::String *,class UnBCL::String *)",
        ".PAVCXXXXXHandledException@?9??SPWriteMigrationScope@@YGJPBG0W4SP_MIG_SCOPE@SetupPlatform@@@Z@",
        "QWPh@b",
        "_vscwprintf",
        "JET_errRestoreOfNonBackupDatabase",
        ".didat$3",
        ".?AV?$DefaultInstanceFactory@VCNGenCleanup@@@UnBCL@@",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "?j?}?",
        "646<6D6L6T6\\6h6",
        "OC::COCDismAdapter::GetOCsInPackage",
        "DiskLayoutPrepare",
        "t$j\\Xf;DS",
        "<@<y<",
        "class UnBCL::ArrayList<struct UnBCL::ISerializable *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<struct UnBCL::ISerializable *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "SL_E_SRV_INVALID_PRODUCT_KEY_LICENSE",
        "7(797F7P7_7h7n7{7",
        "9(959A9R9_9i9z9",
        "XCSimpleCleanup::CSimpleCleanup",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *> *)",
        ".?AV?$SerializableBase@VCPrepareNewOSForFirstBoot@@$0A@V?$DefaultInstanceFactory@VCPrepareNewOSForFirstBoot@@@UnBCL@@@UnBCL@@",
        "iswctype",
        ".?AV?$SerializableBase@VCEnable1394Debugging@@$0A@V?$DefaultInstanceFactory@VCEnable1394Debugging@@@UnBCL@@@UnBCL@@",
        "onecore\\internal\\sdk\\inc\\wil\\opensource\\wil\\resource.h",
        "..\\inf\\setupapi.offline.log",
        "EnumHashListCallback",
        "9+949:9G9M9R9c9n9|9",
        "?!?'?1?Y?`?k?y?",
        "void __thiscall UnBCL::_::HTEnumerator<unsigned short,int,struct UnBCL::Hashtable<unsigned short,int>::TableKey,unsigned short,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,&protected: static unsigned short __stdcall UnBCL::Hashtable<unsigned short,int>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned short,int>::TableKey,int,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::Reset(void)",
        "7#737C7X7m7",
        "666@6",
        "9.969<9I9[9i9v9",
        "7,7A7X7p7",
        "2 2%212?2I2Y2b2j2v2}2",
        ".?AV?$ArrayListEnumerator@U_GUID@@@_@UnBCL@@",
        "<><]<u<",
        "RPC_S_WRONG_KIND_OF_BINDING",
        "<(<4<T<\\<d<l<t<|<",
        "Data source ID: %I64d",
        "%hs: Cannot queue EULA acceptance. Error: 0x%08X",
        ".?AVCInstallCheckpointSequence@@",
        ".?AVCBasicEnv@Mig@@",
        "SPClearSoftReserve: Failed to clear soft reserve. hr = 0x%08X",
        "EnumeratePathEx: Failed search path is >= MAX_PATH!",
        "CDeploymentProject::CreateVHDDeployment: Unsupported processor architecture %d of the image",
        "=0=^=x=",
        "6$6,6@6V6",
        "DUSearch",
        "9\":-:L:f:",
        "9A8t0",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::RemoveAt(int)",
        ".?AU?$IEnumerator@PAUIDisk@SetupPlatform@@@UnBCL@@",
        "ERROR_RESMON_INVALID_STATE",
        "~(9~0t",
        ".PAVCXXXXXTemp@?9??DoExecute@CPrepareSafeOSBootRemoval@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "pValidateServicesCallback",
        "GetAppIdAuthority",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCRegCreationData@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "t'j\\W",
        "1#1(1<1E1N1^1h1o1",
        "4)4>4F4L4Z4s4",
        "CDownloadDUUpdates::FilterUpdates: IDUUpdate::GetType failed. hr = 0x%x",
        "CSetupPlatformTracing::SetTracingFileName",
        "Operating on user-specific profile hives...",
        "6+636=6W6^6d6i6t6~6",
        "4Q4c4j4p4u4",
        "DiskLayout::ExecModifications: Failed to resize partition %u: 0x%08x",
        "4$454>4J4T4^4k4y4",
        "ERROR_REQ_NOT_ACCEP",
        "212N2U2[2`2k2z2",
        "6(7=7I7O7n7",
        "FirstBoot,End",
        "353P3",
        "2$2A2_2t2",
        "Reserved.PlatformSigned",
        "pExtractCrashDump",
        "struct UnBCL::ISerializable *__thiscall UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::get_Item(class UnBCL::String *) const",
        "CDeploymentProject::CreateVHDDeployment: Failed to create setup platform; Error: 0x%08X",
        ">$>+>6>A>M>a>j>u>}>",
        "9)9:9D9M9V9_9h9y9",
        "class OSRollbackService::CCheckpoint *&__thiscall UnBCL::ArrayList<class OSRollbackService::CCheckpoint *>::get_Item(int)",
        "<!<+<<<E<N<Z<c<j<{<",
        "_DismStage",
        "es-HN",
        "http://schemas.microsoft.com/embedded/2004/10/ImageUpdate",
        "No physical partitions found",
        "0$0L0~0",
        "D$pSVWj",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCUserProfile@@@UnBCL@@@UnBCL@@",
        "ERROR_DS_DRA_INTERNAL_ERROR",
        "2&2F2|2",
        "L$l_^[3",
        "=!=&=/=;=G=L=U=\\=i=u=~=",
        "6'656a6s6",
        "%hs: Unable to set the reference WIM file. Error: 0x%x",
        "1 2'2>2J2Z2f2r2",
        "%hs: Cannot get the system environment. Error: 0x%08X",
        "PathRemoveBackslashW",
        ".?AV?$HTDictEnumBase@V?$DictionaryEntry@KPAUIVdsDisk@@@UnBCL@@@_@UnBCL@@",
        ";';9;D;K;Q;V;d;o;t;",
        ".DetermineIfControllerIsXHCI",
        "WimGetPathFromHandle",
        "6 6(6.6H6O6U6Z6e6q6}6",
        "1@1x1",
        "Deleted %d files and reclaimed %.0f bytes of space from old setup folders",
        "8e8~8",
        "CAddProvisioningPackage::DoExecute: Failed to apply provisioning package. Error: 0x%08X",
        "2=2Y2f2|2",
        "%hs: Source file: %s",
        ".\\%s\\%s.mui",
        "%hs: Path is not on a recovery partition.",
        "526K6R6Y6_6k6}6",
        "4-4E4P4d4m4x4",
        "int __thiscall UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *>::IndexOf(class CDeviceIdDatabase::CDeviceInfoData *,int,int) const",
        "SPAPI_E_DI_DONT_INSTALL",
        "$LOADEDHIVE$",
        "ReadOrWriteSectors: Unable to allocate buffer for I/O operation",
        "pre-scan",
        ".?AV?$KeyCollection@KPAUIVdsVDisk@@@_@UnBCL@@",
        "PSVh!",
        "0%0.0;0B0O0c0s0~0",
        "%hs: Cannot build the needed paths.",
        "JET_errInvalidCountry",
        "t$8SVW",
        "RPC_X_BAD_STUB_DATA",
        "Exception file/folder does not exist, ignoring",
        "7:7V7",
        "DiskLayout::ApplyProperties: Setting the final partition type",
        "BitlockerSuspended",
        ";$;0;9;E;J;S;Z;g;s;|;",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,long> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::get_Current(void) const",
        "SPCopyFilesAndFolders: Failed to copy file %s -> %s. hr = 0x%08X",
        "CSetupAutomation::Initialize: - %s",
        "%wLtC",
        "9 9$9(909H9X9h9l9p9x9",
        "SPFindSnapshotProp",
        "msvcrt.dll",
        "CMergeWIM::DoExecute: Cannot export image %u to %s. Error: 0x%x",
        ":/:<:H:O:W:_:s:{:",
        ".PAVCXXXXXHandledException@?2??DoExecute@CSysprepRespecialize@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "PVWh3",
        "class UnBCL::SmartPtr<class OC::COCCollection> __thiscall OC::COCNameMatcher::Match(class OC::COCCollection *,class OC::COCCollection *)",
        "SecondBootEndAvailableDiskSpace",
        "CreateNamedPipeW",
        "void __thiscall UnBCL::ArrayList<class CGlobalPathFindData *>::Insert(int,class CGlobalPathFindData *)",
        "Reopening system store.",
        "9$919v9",
        ".?AV?$DefaultInstanceFactory@VCExportWIM@@@UnBCL@@",
        "WmiObject::GetAssociated: This object has no property named %s (0x%08x)",
        "9N:c:",
        "class UnBCL::String *__stdcall GetPathFromEncodedPath(class UnBCL::String *,int *)",
        "\\Registry\\Machine",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@2@PAV12@UKeyTraits@52@$1?RetrieveKey@52@KGPAV12@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@3@UKeyTraits@23@V?$CElementTraits@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "ReturnHr",
        "ERROR_DS_SYNTAX_MISMATCH",
        "%hs: Set BCDE_DEVICE_TYPE_RAMDISK_SDI_DEVICE succeeded.",
        "ERROR_CLUSTER_MISMATCHED_COMPUTER_ACCT_NAME",
        "1:2O2a2i2o2",
        ">%>7>?>E>R>d>r>",
        ";4;S;",
        "0\"020b0y0",
        "=A=M=e={=",
        "pSPMergeWim",
        "9-9h9u9",
        "<:<{<",
        ".PAVCXXXXXTemp@?3??Parse@CInfFile@@IAEJXZ@",
        "ERROR_CLUSTER_NODE_ALREADY_DOWN",
        "OrchestratePublishWnfDwordData: RtlPublishWnfStateData failed; NTSTATUS = 0x%08X",
        "1(1,1<1L1P1`1d1t1x1",
        "L$(@;E",
        "void __thiscall UnBCL::Array<class CDeploymentBase::CMountedPathInfo *>::InitLarva(class UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *> *)",
        ".PAVCXXXXXHandledException@?CN@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        ": <`=",
        ":(:3:9:M:p:x:",
        "Not changing symbolic link %s due to path restrictions",
        "\\\\*\\*[*]",
        "    Id: %s",
        "3g3l3",
        "SERIALIZEVERBOSE: Serializing mount path: %s",
        "void __thiscall UnBCL::Array<class CBasicEnvEntry *>::Remove(class CBasicEnvEntry *)",
        "ERROR_IPSEC_IKE_CRL_FAILED",
        "6 6D6L6{6",
        ".?AV?$CAutoCleanupBase@PAUIWbemClassObject@@@RAII@@",
        "RegUnLoadKeyW failed to unmount %s",
        "ERROR_INVALID_DWP_HANDLE",
        ":):=:G:[:h:x:",
        ";\";-;A;l;u;",
        "void __thiscall CDeploymentBase::SetStoredObject(class UnBCL::String *,struct UnBCL::ISerializable *)",
        "SmImageDisk::Initialize: SmDisk initialization failed (0x%08x)",
        ".?AVCXXXXXHandledException@?2??DoExecute@CCloseLogFiles@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "ERROR_INVALID_FIELD",
        "CSIDL_MYPICTURES",
        "CDeploymentProject::CreateBootableMediaDeployment: Failed to get disk enumerator (0x%08x)",
        ".?AV?$CAutoCleanupBase@PAU_VDS_PARTITION_PROP@@@RAII@@",
        "class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::get_Item(int)",
        "SPGetGlobalPathFromConfigValue",
        "4$585]5",
        "=$=*=0=6=<=B=H=N=T=Z=`=f=l=r=x=~=",
        "2 2<2]2r2",
        "ExportChunkedRegionWrite",
        "SPExecuteOOBEBootApplyFromICB",
        "PWVhZ",
        "    %s = %s",
        "2'2.2",
        "__thiscall UnBCL::ArrayList<unsigned long>::ArrayList(int,int)",
        ".?AU?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@H@UnBCL@@@UnBCL@@",
        "</<6<<<H<T<",
        "626C6\\6c6i6n6y6",
        "    Service name: %s",
        "SPCopySetupPlatform: Failure while building the config file path. Error: 0x%08X",
        "5#646;6A6F6Q6[6n6",
        "<(<.<4<9<C<M<W<a<o<u<{<",
        "Will apply%s from provisioning package: %s",
        "Failed to set description key value. Store: %s StoreKey: %ws Status: %x",
        "7!7'707L7]7z7",
        "1-141;1B1I1P1V1a1",
        "6\"7)7/747?7J7^7p7u7",
        "SetupPlatform.Drivers.ini",
        "CSetupPlatformRollback::Execute",
        "x\\Windows\\Servicing\\Editions",
        "SPGetFootprintCapabilities: Starting verification of footprint section %s",
        "pFindAndAddFiles: Failed to add %s to folder list; Error: 0x%08X",
        "    Failed to write element start element",
        "3%323;3L3`3h3",
        "6 6(6/656:6E6P6d6",
        "UserModeTracingEnabled",
        "9x8uFWW",
        ":):4:L:m:",
        "void __thiscall UnBCL::ArrayList<class ISPPluginData *>::AddRange(const struct UnBCL::ICollection<class ISPPluginData *> *)",
        "<(<,<<<@<P<T<d<h<x<|<",
        "Failed to get battery information. Error = %d",
        "EFI\\Microsoft\\Boot",
        "FailureOperation",
        "int __thiscall UnBCL::Array<class CDUPackage *>::Add(class CDUPackage *)",
        "xR9t$",
        "=,=0=@=D=T=d=t=",
        "tt-RU",
        "2+232=2D2J2O2Z2f2z2",
        "UtilReportProgressTick",
        "8$8*848>8Q8g8}8",
        "int __thiscall UnBCL::ArrayList<class CPartitionInfo *>::IndexOf(class CPartitionInfo *,int,int) const",
        "JET_errDatabasesNotFromSameSnapshot",
        "ERROR_PAGE_FAULT_GUARD_PAGE",
        "ERROR_SXS_FILE_HASH_MISMATCH",
        "onecore\\base\\ntsetup\\provpackageapi\\lib\\metadataxml.cpp",
        "ERROR_ONLY_IF_CONNECTED",
        "SetupPlatform.dll",
        "CDeploymentProject::EnableAuditMode",
        ":':7:C:K:P:U:j:z:",
        "ERROR_DS_STRONG_AUTH_REQUIRED",
        ": :-:?:I:\\:d:j:w:",
        "sCFastDeleteImplT<class CDirectoryProviderT<class CWindowsOldAdaptor>,1>::Init",
        "[QVjSjrh",
        ".?AV?$CAutoWdsLibFree@PAPBG@RAII@@",
        "ERROR_DBG_EXCEPTION_NOT_HANDLED",
        ": :6:B:J:Z:",
        ">$>8>X>q>",
        "CBS_E_CANCEL",
        ":!:E:P:d:n:w:",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable<class UnBCL::String *,int>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "9/9\\9g9",
        "CExecuteUnattend::DoExecute: Couldn't get new pass status for %s: 0x%08x",
        "CMediaLayout::QueueDrivers: Failed to get driver %u: 0x%08x",
        "y\"h\\'",
        "4 4*4:4J4R4i4p4",
        "9w,t8",
        "class CUserProfile *const &__thiscall UnBCL::ArrayList<class CUserProfile *>::get_Item(int) const",
        "6-676h6o6\"8)8i8p8",
        "9<9N9_9e9p9|9",
        "SetFileSystemLabel",
        "7'7=7I7N7S7",
        ".PAVCXXXXXTemp@?FJ@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "5!5-555G5N5T5Y5d5o5",
        "VdsPartition::TakeOffline: No volume backed by this partition; offline not supported",
        "JET_errWriteConflictPrimaryIndex",
        "PhPNK",
        "?$?N?U?[?`?h?s?",
        "051<1B1G1S1]1p1",
        "void __thiscall UnBCL::ArrayList<class CFileCreationData *>::AddRange(const struct UnBCL::ICollection<class CFileCreationData *> *)",
        "\"PVhh}",
        "4'4.484E4R4^4m4u4",
        "> >&>Y>k>",
        "2#2<2B2Y2_2v2|2",
        "BitLocker configured to trust Safe OS: %s",
        "8.8@8H8N8[8m8{8",
        "t$$RP",
        "eSeRestorePrivilege",
        "909@9G9Q9]9d9j9o9z9",
        "ERROR_DRIVE_MEDIA_MISMATCH",
        "SL_E_CHPA_GENERAL_ERROR",
        "void __thiscall UnBCL::ArrayList<class CCFGSectionValue *>::QuickSort(class UnBCL::ArrayList<class CCFGSectionValue *> *,class UnBCL::ArrayList<class CCFGSectionValue *> *,int,int)",
        "ERROR_DEVICE_NOT_CONNECTED",
        "int __thiscall UnBCL::Array<class CDeviceIdDatabase::CDeviceInfoData *>::Add(class CDeviceIdDatabase::CDeviceInfoData *)",
        "1 2H2~2",
        "9F$tj",
        "VdsDisk::Initialize: Failed to find the VDS software provider (0x%08x)",
        "Failed opening source `Select` key",
        "5/5@5M5U5z5",
        ".?AV?$SerializableBase@VCRegisterSyncProcess@@$0A@V?$DefaultInstanceFactory@VCRegisterSyncProcess@@@UnBCL@@@UnBCL@@",
        "SPAPI_E_INVALID_TARGET",
        ".?AVCRegisterAsyncProcess@@",
        "Microsoft.Windows.Setup.FirstUXRefCount",
        "REG_DWORD_BIG_ENDIAN",
        "class CFailForwardSystem *__thiscall UnBCL::_::ArrayListEnumerator<class CFailForwardSystem *>::get_Current(void) const",
        ";#;<;[;u;",
        "SmDisk::CreatePartition: SM API do not support read-only partition creation",
        ".?AV?$CSimpleStringT@G$0A@@ATL@@",
        "2A2\\2m2",
        "MIGRATION",
        ".?AVCXXXXXHandledException@?2??ValidateProductKey@CImageInfoSet@@UAEJPBGPAPAUIProductKey@SetupPlatform@@@Z@",
        ":$:=:R:e:m:s:",
        "OCStatusFilePath2: %s",
        "int __thiscall UnBCL::ArrayList<class OC::COptionalComponent *>::BinarySearch(int,int,class OC::COptionalComponent *,struct UnBCL::IComparer<class OC::COptionalComponent *> *)",
        "4/595v5",
        "void __thiscall UnBCL::Array<class CDeploymentBase::CMountedPathInfo *>::Insert(int,class CDeploymentBase::CMountedPathInfo *)",
        "474s4}4",
        "Deleting element %08x",
        "ERROR_WAIT_NO_CHILDREN",
        "6?6c6",
        "070V0f0",
        "long __stdcall CImageInfoSet::AddToImageInfoSet(class CImageInfoSet *,class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::String *> *,unsigned long,class UnBCL::ArrayList<class CImageInfo *> *,const unsigned short *,const unsigned short *,struct tagWDS_CLI_CRED *,enum SetupPlatform::IMAGE_TYPE)",
        ";$<`<,=`=",
        "VdsVolume::Unmount: Failed to query IID_IVdsVolumeMF interface [%s] (0x%08x)",
        "{AE6B521D-79E5-49D8-9420-4CC855975FB3}",
        "Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}",
        "CDiskReader::GetOsInfoLanguages",
        "5)6C6Y6w6~6",
        "<1<8<?<E<Q<c<q<",
        "041g1y1",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CWIMBootData *>::MoveNext(void)",
        "6-6h6u6",
        "ERROR_INVALID_SUB_AUTHORITY",
        "rhj\\Yf;",
        "505T5t5",
        "SETUPPLATFORMCOMM: Error connecting the progress pipe. Error: 0x%08X",
        "j\\Yf9L0`t",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCOptionalComponent@OC@@@UnBCL@@@UnBCL@@",
        "0&0,010<0G0[0w0",
        "?4?9?u?",
        ": :(:0:4:<:@:D:H:P:T:\\:`:h:",
        "212L2R2\\2a2k2r2",
        "SetThreadDesktop",
        "deque<T> too long",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCCleanupEntry@CSimpleCleanup@@@UnBCL@@@UnBCL@@",
        "JET_errFileCompressed",
        "4#4-4D4R4\\4f4}4",
        "    Process PID: %u",
        "7'747U7c7j7p7u7",
        "WIM\\IMAGE[*]\\HARDLINKBYTES",
        ".?AV?$SerializableArrayBase@PAVCCFGSectionValue@@@_@UnBCL@@",
        "ERROR_DS_CANT_REM_MISSING_ATT_VAL",
        "(%lx): Failure while loading SetupCl hive",
        "?Add@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEHPAVString@2@@Z",
        "pReadUninstallWindowFromPolicy",
        "<(=?=e=q=",
        "Enterprise",
        "Failed to open existing splash window. Error: 0x%08X",
        "ju[f9\\0",
        "WinReSetupInstall",
        "SPDoUninstallGather",
        "CWIMBootHelper::~CWIMBootHelper",
        "6%626H6U6m6",
        "4#4.4D4T4j4q4w4|4",
        ".?AV?$DefaultInstanceFactory@VCMigChangesValidator@@@UnBCL@@",
        "5/5O5U5",
        "E_ACCESSDENIED",
        "Failed Installing language packages: %S",
        ".?AU?$ICollection@G@UnBCL@@",
        "%SYSTEMDRIVE%\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe /onerror",
        "Failed adding top level directory to stack",
        "Skipped OS volume because of policy",
        "ERROR_TRANSACTION_NOT_ACTIVE",
        "zupkfb^ZVSOLIEB@=:7520-+)&$\" ",
        "sSPRestoreFiltersKeyFirstBoot",
        ".?AVXmlNode@UnBCL@@",
        ":\":,:;:D:J:W:]:b:s:~:",
        ">'>F>d>k>t>y>",
        "SP_ENV_MIGRATE_USERS_OFFLINE",
        ".?AVCSetupPlatformCheckpoint@@",
        "GetFileInformationByHandle",
        "Failed to remove rollback file operations journal, error: 0x%08X. Error is fatal.",
        "=&=4=>=H=_=m=w=",
        "SVWjz",
        "9M,tN",
        "CImageInfoSet::CreateFromExistentSystem",
        "@&0_DM",
        "3 3-3H3h3}3",
        "1%121?1K1X1e1r1",
        "BcdCopyObjectEx: Failed to create object. Target: %ws Flags: 0x%x  Status: %x",
        "6%6,62676C6Q6Y6k6u6|6",
        "CReconstructOS::DeleteTempFiles: Deleting temporary directory %s",
        "CInstallDUUpdatesOffline::DoExecute: Cannot delete %s. Error: 0x%08X",
        ".?AV?$CAutoCleanupBase@PAUIRollback@@@Mig@@",
        ":,:<:@:P:T:d:h:x:|:",
        ":8:L:T:\\:d:l:x:",
        "VWh`#",
        "272B2",
        "3.363P3W3^3j3x3~3",
        "9,959W9^9d9i9t9~9",
        "Calling Transformer Initialize with parameters:",
        "0&0Q0",
        "  Operation (optional) : %s",
        "767C7]7",
        "ERROR_NODE_CANT_HOST_RESOURCE",
        "5&5.545H5`5~5",
        ":&:9:b:i:o:t:",
        ";$;,;0;4;8;@;d;l;p;t;x;|;",
        "6B6T6\\6b6o6",
        "long __stdcall SPGetCBSCompletionStatus(class UnBCL::String *,class UnBCL::String *,int *)",
        "9\":7:?:E:N:d:r:",
        "ERROR_IPSEC_WRONG_SA",
        "SPUninitializeNetwork: Failed to load WinPE utility DLL; Error: 0x%08X",
        "5A5M5Y5o5v5",
        "CRYPT_E_FILERESIZED",
        "2(3/353:3F3P3c3m3t3z3",
        ".?AVCXXXXXHandledException@?DP@??UndoTransformers@CSetupPlatformApplyRollbackCheckpoint@@IAEJPAVString@UnBCL@@00@Z@",
        "8$8D8P8a8u8",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::GetBuffer(int)",
        "ERROR_FILE_VERSION_NOT_ALLOWED_FOR_VERSION",
        "t4h  ",
        "JET_wrnCorruptIndexDeleted",
        "1>1_1i1u1",
        "4 444<4d4l4t4|4",
        "SmVolumePathEnumerator::GetNext: Failed to copy volume access path %s (0x%08x)",
        "?!?(?2?;?H?^?u?",
        "Cannot create WDS client session to server %s. Error: 0x%08X",
        "Matching INF entry found: %s",
        "<#<4<;<A<F<Q<a<f<z<",
        ">P?W?]?b?m?x?",
        ".?AV?$SerializableBase@VCEnableSafeOSPageFile@@$0A@V?$DefaultInstanceFactory@VCEnableSafeOSPageFile@@@UnBCL@@@UnBCL@@",
        ".?AV?$DictionaryEntry@PAVString@UnBCL@@J@UnBCL@@",
        "7%737@7R7Z7`7m7",
        "%hs: Not able to initialize Diagnostics Error Reporting. Error = %d",
        "SmPartition::SetUsage",
        ".?AVCDUPackageCollection@@",
        "FilterSendMessage",
        "dsb-DE",
        "%hs: Cannot set progress info. Error: 0x%08X",
        "Copy Removed FOD Markers from old windows",
        "2I3z3",
        ".?AV?$CAutoCleanupBase@PAUIDeviceIdDatabase@@@Mig@@",
        ".?AVCDumpSourcesData@@",
        "<#<)</<5<;<Y<^<d<j<p<v<|<",
        "RestoreFileMetadata: RecordFileDataLocation failed",
        "=+>i>n>x>",
        "onecore\\internal\\sdk\\inc\\wil\\Staging.h",
        ":<:H:l:t:|:",
        "RpcCommAddImage",
        ".PAVRollbackException@@",
        "ERROR_MUI_INTLSETTINGS_INVALID_LOCALE_NAME",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCAppInfo@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "DisconnectNamedPipe",
        "?)???J?p?",
        "|SOURCE|\\|FWTYPE|\\|BOOTMGR|",
        "4\"474M4T4Z4_4j4u4{4",
        "RPC_S_NO_PRINC_NAME",
        "VdsDisk::CreatePartition: Can't find the partition that was just created",
        "%s\\%s\\%s",
        "SPEstimateSizeOfFirstApply: declared size: %I64d, estimated on disk: %I64d, expected for 1st boot: %I64d",
        "class UnBCL::ArrayList<unsigned int> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<unsigned int>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        ".?AU?$IList@PAV?$DictionaryEntry@KPAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::get_Current(void) const",
        "SetupGetStringFieldW",
        "dPartition length (%llu) is not a multiple of cluster size (%d)",
        "<'<@<^<u<",
        "=&=,=1=<=J=`=t=",
        "4*4K4^4c4n4u4{4",
        "VjKjG",
        "2 2(20282@2L2l2t2|2",
        "CCopyFilesAndFolders::AddConfigCopySection",
        "ERROR_CLUSTER_GUM_NOT_LOCKER",
        "EtwEventRegister",
        "ERROR_NOTHING_TO_TERMINATE",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@@UnBCL@@",
        ";-<<<N<S<",
        ">;>B>H>M>X>_>s>",
        "CCaptureIODispatcher::GetNextIOTask",
        "4>4F4\\4b4",
        "50585>5T5Z5r5y5",
        "class COperationsValidator *__stdcall UnBCL::Try_Cast<classCOperationsValidator*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        ".?AU?$IDictionaryEnumerator@PAVString@UnBCL@@K@UnBCL@@",
        "474Z4}4",
        "ERROR_RXACT_STATE_CREATED",
        ".?AV?$DefaultInstanceFactory@VCWIMBootData@@@UnBCL@@",
        "%hs: WinReSetupBackupWinRE succedded. WinRE path: %s",
        "Lp1R/",
        "0)0:0F0R0^0j0",
        "CCompressOldOS::DoExecute",
        "%hs: Failed to write file. Error: 0x%08X",
        "%hs: GetWindowsDirectory failed. Error: 0x%08X",
        ".?AV?$HTDictEnumBase@PAUHKEY__@@@_@UnBCL@@",
        ":/:=:J:\\:d:j:w:",
        "pCopyTelemetryFile: Wrote CV %S to ETL %s",
        "GY;~0r",
        "8,8A8I8O8\\8n8",
        "6$6+62686E6Z6h6v6",
        ";7;C;N;\\;",
        "ImageFlash  ",
        "SPWriteXmlFile: Failed to convert wide chars to ascii: 0x%08x",
        "InjectUnattendFile: Couldn't write answer file to target installation [%s]: 0x%08x",
        ">*>:>@>F>L>X>d>p>y>",
        ".?AVCXXXXXHandledException@?EL@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "ExecutionSuccessful",
        "FixReparsePointPath: Reparse points with ReparseTag [0x%x] cannot be updated.",
        ".?AV?$SmartPtr@V?$ArrayList@U_GUID@@@UnBCL@@@UnBCL@@",
        "Got offline user migration OneSetting: %s",
        "int __thiscall UnBCL::ArrayList<class CAntiVirusInfo *>::BinarySearch(int,int,class CAntiVirusInfo *,struct UnBCL::IComparer<class CAntiVirusInfo *> *)",
        "SeDebugPrivilege",
        " !\"#$%&'()*+,-./0",
        "%hs: Failed to configure image for RAM boot. Status = %d",
        "Requests to replace the OS drive path that don't provide an explicit 'new' path require access to the SOFTWARE hive.",
        "<%<,<9<E<N<Z<_<h<t<",
        "=&=-=k=r=",
        "CReconstructOS::DeleteTempFiles: Failed to delete %s: 0x%08x",
        ";.;N;X;_;e;j;u;};",
        "JET_errInvalidSystemPath",
        ".PAVCXXXXXTemp@?3??DoExecute@CAddProvisioningPackage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "6,6@6N6W6a6j6|6",
        "111>1J1a1",
        "=2=I=a=n=u=",
        "5$5,545<5D5L5\\5d5|5",
        "CSIDL_COMMON_TEMPLATES",
        "CDownloadDUUpdates::CheckTestHook",
        "7\"7(7-787B7U7l7",
        "PPPPSS",
        "3[3e3{3",
        "3!3(3.333>3L3`3n3",
        "ERROR_LIBRARY_FULL",
        "5(545H5Q5Z5c5n5v5",
        "7=7z7",
        "0!090L0e0",
        "__thiscall UnBCL::ArrayList<class CWIMBootData *>::ArrayList(const struct UnBCL::ICollection<class CWIMBootData *> *)",
        "CTrustSafeOS::DoExecute",
        "??_D?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAEXXZ",
        "WaitForMultipleObjectsEx",
        "es-ES_tradnl",
        ">P>W>~>",
        "9$9u9|9",
        "2(22272K2a2",
        "212E2[2r2",
        "242L2T2\\2d2l2t2|2",
        "ERROR_IPSEC_IKE_QM_LIMIT",
        ".PAVCXXXXXHandledException@?2??TearDownCbsLogging@CReconstructOS@@IAEJXZ@",
        "OC::COCDismAdapter::GetFoundationPackageName",
        "CSetupAutomation::ResolveTarget: Couldn't get partition properties: 0x%08x",
        "<2<9<@<K<X<l<u<",
        "8%8,8>8Q8Y8p8w8",
        "?,?4?s?",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Copying from \"%s\" to \"%s\".",
        "SysprepSession::ExecuteAction: Invalid module type %s found",
        "6$7`7",
        "9xLu@",
        "ERROR_DEVICE_IN_USE",
        "7$727@7",
        "base\\ntsetup\\lib\\rollback\\src\\rollback.cpp",
        "Failed to write non-exsitend input %s of call to method %s on %s (0x%08x)",
        "<'<2<@<N<\\<j<x<",
        "??0FileStream@UnBCL@@QAE@PAXW4FileAccess@1@@Z",
        ".?AU?$IList@PAVCRegCreationData@@@UnBCL@@",
        ":,:<:L:\\:l:|:",
        "%hs: Target OS Guid: %s",
        "SPApplyCustomDiskConfig: Cancelled layout calculation at disk %u of %u",
        "RtlReleaseResource",
        "0'080E0U0g0",
        "SmVirtDiskPooledDiskEnumerator::GetNext",
        "5&535C5_5q5",
        "WIMGetMountedImageInfoFromHandle",
        "9S0vmR",
        "4I4[4c4i4v4",
        "<(<7<@<F<S<Y<^<",
        "ERROR_CLUSTERLOG_EXCEEDS_MAXSIZE",
        "WinRE.NEW",
        ".?AVCBasicEnvEntry@@",
        "VdsImageDisk::InitializeProperties",
        "<,=E=Z=b=h=u=",
        "?/?Z?",
        "BootId:%d",
        "=/=6=D=T=h=",
        "ERROR_MEDIA_UNAVAILABLE",
        "Subkey:",
        "MigCloseCurrentStore",
        "SecondBootPhaseEndTime",
        "SPExecuteOOBEBootApply",
        "CSetupPlatformPrivate::Execute: Failed to add new WinRE hash: 0x%08x",
        "334@4",
        "040;0A0F0Q0[0n0|0",
        "2%2,262C2J2T2e2r2|2",
        "?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEPAVString@2@XZ",
        "ERROR_DISK_OPERATION_FAILED",
        ".PAVCXXXXXTemp@?BO@??UndoTransformers@CSetupPlatformApplyRollbackCheckpoint@@IAEJPAVString@UnBCL@@00@Z@",
        "{8114F741-C0CF-43D1-A85E-BFE7E9AC521A}",
        "2(282@2d2x2",
        ".?AU?$IList@PAV?$DictionaryEntry@GG@UnBCL@@@UnBCL@@",
        "SETUPPLATFORMEXE: Sending progress message: Phase: %s, Operation: %s, Percentage: %d%%",
        "ActionPlatform::LaunchModule: Could not terminate worker thread; dwRet = 0x%x",
        ".?AVCXXXXXHandledException@?IF@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "XSource%d",
        ":%:+:1:7:=:C:I:O:U:[:a:g:m:s:y:",
        "MbrType",
        "DiskLayoutMakeWindows: Failed to create Windows partition (0x%08x)",
        ">*>3><>E>N>Z>c>l>u>",
        ".?AV?$SerializableBase@VCAddProvisioningPackage@@$0A@V?$DefaultInstanceFactory@VCAddProvisioningPackage@@@UnBCL@@@UnBCL@@",
        "5#5/5<5H5T5a5n5z5",
        "? ?$?<?@?X?\\?t?",
        "void __thiscall UnBCL::ArrayList<struct DISK_SPACE_IMPACT>::Resize(int,int)",
        "Install Critical SafeOS Dynamic Updates",
        "4%4.4:4C4L4e4",
        ":QVEE",
        "3*494@4G4R4_4d4x4",
        "T$PSSSSSh",
        "class CSimpleCleanup::CCleanupEntry *__thiscall UnBCL::_::ArrayListEnumerator<class CSimpleCleanup::CCleanupEntry *>::get_Current(void) const",
        "</<;<C<H<\\<l<|<",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@PAVMultiSz@2@@UnBCL@@@UnBCL@@",
        "2 2(2.2;2M2w2",
        "9\"949>9G9Q9[9g9p9|9",
        "RtlGetVersion",
        "9\"9=9D9x9",
        "CSetupAutomation::Resurrect: Failed to read %s: 0x%08x",
        "ERROR_NON_DOMAIN_SID",
        "Failed opening target ServicingStackVersions key",
        "CDeploymentBase::ExecuteCurrentOperations",
        "void __thiscall UnBCL::ArrayList<class COSPieceInfo *>::AddRange(const struct UnBCL::ICollection<class COSPieceInfo *> *)",
        "61696?6L6^6l6y6",
        "0!0+0H0W0f0u0",
        "CBS_E_ARRAY_ELEMENT_MISSING",
        "WWWWV",
        "UseAllSpace",
        "2,2=2D2l2",
        ".?AV?$DictionaryEntry@PAVString@UnBCL@@H@UnBCL@@",
        "t;f97t6",
        "Description: %s",
        "Failed to open the provisioning package %s. Error: 0x%08X",
        "ERROR_DS_RESERVED_LINK_ID",
        "REQUIRED",
        "ERROR_MEMBER_NOT_IN_ALIAS",
        "$filehashes$.dat",
        "?get_Length@String@UnBCL@@QBEHXZ",
        "ERROR_INVALID_MESSAGE",
        "323[3",
        ".?AV?$CAutoDelete@PAPBG@RAII@@",
        "= =$=(=,=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=|=",
        "vswprintf_s",
        " Call to BsdSummarize for bootstat file %s failed with error: 0x%08x",
        "Unsigned",
        "unsigned long __thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,unsigned long,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,&protected: static unsigned long __stdcall UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsDisk *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "void __thiscall UnBCL::ArrayList<struct SetupPlatform::IDisk *>::Resize(int,int)",
        "? ?$?<?@?X?h?x?",
        ":':1:>:G:P:Z:d:n:{:",
        "ZwLoadKey",
        "int __thiscall UnBCL::ArrayList<class CDeploymentBase *>::IndexOf(class CDeploymentBase *,int,int) const",
        "9&:V:k:}:",
        "FilterLoad",
        " !\"#$%&'()*+666666666666666666666666666666666666666666,-./012345",
        "Y__^[",
        "Path,",
        "<%<5<<<J<X<`<f<z<",
        "ERROR_EVT_FILTER_INVTEST",
        "towlower",
        "VWSh8",
        "ERROR_FILE_CORRUPT",
        ".?AVCXXXXXHandledException@?HK@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "ERROR_SYNC_FOREGROUND_REFRESH_REQUIRED",
        "8(8:8B8H8U8g8u8",
        "2(2<2P2d2l2t2|2",
        "WMI Helper Library: %s",
        ".?AVCXXXXXHandledException@?M@??QueueRemoveFODPackage@CNewSystem@@UAEJPBGW4SP_ERROR_HANDLING@SetupPlatform@@@Z@",
        "SetFileInformationByHandle",
        "XSPQueryReserveInfo",
        ";3;m;",
        "winsxs\\filemaps",
        ".?AV?$CAutoCleanupBase@PAUIDisk@SetupPlatform@@@RAII@@",
        "CreateIoCompletionPort",
        "6.2.9200.16384.0",
        "|hK,_",
        "?=?C?]?w?",
        ".PAVCXXXXXTemp@?N@??GetClientDUPackages@CSetupPlatform@@UAEJPAXPAUIDUDownloadProgress@SetupPlatform@@PAPAUIDUPackageCollection@4@PAH@Z@",
        "ERROR_DS_ENCODING_ERROR",
        "%hs: Fail-forward rollback requested but is not supported in this scenario",
        "0,0@0T0h0|0",
        "uz-Latn",
        ".?AV?$ArrayList@UDiskRange@@@UnBCL@@",
        "SPFindVssSnapshot: Failed to enumerate snapshots. Error: 0x%08X",
        "SetupDiDestroyDeviceInfoList",
        ".?AV?$CAutoCleanupBase@PAPAU_EVENT_TRACE_PROPERTIES@@@RAII@@",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,&protected: static struct HKEY__ * __stdcall UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,class ATL::CElementTraits<struct HKEY__ *> > const *,struct __POSITION * const &)>::Reset(void)",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::Reset(void)",
        "SetupDUUpdateFiles: Could not determine whether target directory [%s] is empty.",
        ".?AV?$CAutoRelease@PAUIWpxIssueList@@@RAII@@",
        "E_UNEXPECTED",
        "J0b0o0",
        "9)9;9T9[9a9f9q9",
        ">7>C>L>Z>w>",
        ";8;D;N;U;[;`;k;z;",
        "<$=W=m=r=",
        "SysprepRebootPendingPlugins",
        "= =0=@=P=`=p=",
        "5%5+585J5X5o5",
        "Cannot set ErrorControl for %s, error: 0x%08X",
        "void __thiscall UnBCL::ArrayList<class CBasicEnvEntry *>::set_Item(int,class CBasicEnvEntry *)",
        ".PAVCXXXXXTemp@?M@??DoExecute@CApplyDrivers@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "6\"696I6U6]6d6}6",
        "FveGetStatusBasicW",
        "=+=Z=",
        "Failed to filter delete element %08x. Status: %x",
        "080J0R0X0e0w0",
        ":#:8:@:F:S:b:{:",
        "SKIPBOOTTRACK(FIRST): Skip Boot Validator: Cannot validate migrated services, cannot continue with First boot removal.",
        "?+?3?9?B?X?t?",
        "8@8x8",
        "1J1X1v1{1",
        ".?AVCXXXXXHandledException@?JO@??DoExecute@CRelocateOS@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "LoadLibraryExA",
        "4'5H5g5",
        "<4<N<V<",
        "<0<_<s<",
        "5)5K5V5g5",
        "%hs: Cannot copy %s to %s. hr = 0x%08X",
        "6<6K6",
        ":5:<:D:I:\\:g:t:",
        "void __thiscall UnBCL::Array<class COperationInfo *>::RemoveAt(int)",
        "=*=R=_=o=",
        ">3>:>?>f>y>",
        "111?1H1s1~1",
        "040A0V0]0n0",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@_JPAVCGlobalPath@@@UnBCL@@@UnBCL@@",
        "4#4)4.484B4L4V4d4j4p4u4",
        "ERROR_DS_NAME_ERROR_RESOLVING",
        "jYj\\j[j+j",
        "ERROR_DS_DRA_EXTN_CONNECTION_FAILED",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class OC::COptionalComponent *>::MoveNext(void)",
        "QPQPj",
        "ProvisioningPackage::GetDataSourceId",
        "%s=%s",
        "QWSPV",
        "8:8]8j8{8",
        "Error removing driver: DismOpenSession failed. hr = 0x%08X",
        "class UnBCL::String *__stdcall SPCalculateOfflineOSArchitecture(class UnBCL::String *)",
        "ERROR_IPSEC_IKE_SRVACQFAIL",
        ">,>4><>`>t>|>",
        "CInstallDUUpdatesOffline::FindUpdates: Failed to create devices database; hr = 0x%08X",
        "=F=~=",
        ",vXYbzGwu3bg2Ol16nZSevr1sO30I8Ys1zjX8lyaHxGc=0Z",
        ";#;,;=;F;W;`;q;};",
        "8 8(808<8\\8d8l8x8",
        "void __thiscall UnBCL::ArrayList<class CBasicEnvEntry *>::AddRange(const struct UnBCL::ICollection<class CBasicEnvEntry *> *)",
        "Failed to get size of full path.",
        "=*=>=Y=`=f=k=v=",
        ";1;8;>;J;V;",
        "787Y7p7~7",
        "sr-Cyrl",
        "Failed to get process token to set privileges into.",
        "void __thiscall UnBCL::Array<class CAppInfo *>::Insert(int,class CAppInfo *)",
        "Failed to cleanup ramdisk options. Status = [%x]",
        "ERROR_SXS_XML_E_UNCLOSEDENDTAG",
        "DiskLayout::Execute: Failed to delete existing partitions (0x%08x)",
        "class UnBCL::ArrayList<class UnBCL::String *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class UnBCL::String *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "243g3y3",
        ";3;>;L;R;w;",
        "7)767@7Q7^7h7y7",
        "<C<K<R<`<j<}<",
        "%hs: The TPM reseal failed, the error code is 0x%x and output flag is 0x%x",
        "Unable to get procedure WcpSetHelperCallback",
        "j+j,Sh",
        "313B3Y3`3f3k3x3",
        "~h_^]",
        "4$40474D4Q4Y4^4s4",
        ":(:4:@:L:X:d:p:|:",
        "ITaskService::GetFolder failed. hr = 0x%x",
        "<-<9<N<}<",
        "Failed to set {bootmgr} locale. Status = [%x]",
        "7$777@7G7T7",
        "ERROR_DS_SIZELIMIT_EXCEEDED",
        "Cannot create WinPE setupapi directory %s.",
        ".?AVCXXXXXHandledException@?2??DoExecute@CAddAppxPackage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ".?AU?$IEnumerator@PAVCInfFile@@@UnBCL@@",
        "AssignDriveLetter",
        "4-464N4",
        ";%;/;N;U;[;`;k;v;",
        "DiskLayout::Populate: Couldn't get the extended partition's properties (0x%08x)",
        "383F3O3X3a3k3t3}3",
        "RPC_S_NO_MORE_MEMBERS",
        ".?AVWmiObject@WMI@@",
        ".?AVCXXXXXHandledException@?2??DoExecute@CUnmountWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "CSetupAutomation::Resurrect: File not found: %s",
        "8*82898?8D8O8Z8n8z8",
        "3 3$3<3@3X3\\3t3x3",
        "CSetupPlatformCheckpoint::CopyLogFiles: An error occurred while collecting boot log files",
        "<!<5<E<_<}<",
        "ERROR_SXS_XML_E_BADXMLDECL",
        "3 3D3L3T3\\3d3l3t3|3",
        "%hs: Rollback boot entry is now hidden",
        "Failed to mark image for wimboot state.",
        "Failed creating source component hive path name %ls\\COMPONENTS",
        "{11C71C96-8D55-4AD1-B69D-13DA80D53A27}",
        "SPFindVssSnapshot: Failed to set backup context. Error: 0x%08X",
        "%hs: Copy directory [%s] to [%s]",
        "7(717:7D7N7W7`7i7r7{7",
        "9A9F9",
        "advapi32.dll",
        "Installed OCs (Target OS):",
        "ERROR_INSTALL_PLATFORM_UNSUPPORTED",
        ": :C:T:[:a:f:q:x:",
        "pDUSearchAndDownload: DU download failed. hr = 0x%x",
        "6 60646D6H6X6\\6l6p6",
        ";';Y;s;",
        "5&515>5R5`5w5~5",
        "1 1(10181@1H1P1X1`1h1p1x1",
        "=+=P=Y=`=",
        "8(818N8V8",
        "ERROR_LOG_START_OF_LOG",
        "=,=G=r=",
        "SetRegDWORD",
        "TargetSystem2",
        "pReadUninstallWindow",
        "Wmi::Get: Failed to get object at path '%s' (0x%08x)",
        "131Y1y1",
        "1\"101>1L1",
        "CBSLogs",
        "BOOTNXT",
        ".?AU?$IList@PAVCFileCreationData@@@UnBCL@@",
        "4$4,444<4D4\\4p4",
        "UpgradeTime",
        ")partition creation",
        ":3;:;@;E;T;_;d;x;",
        "Invalid object type. Type %ul Status: %x",
        "ERROR_CLUSTER_MAXNUM_OF_RESOURCES_EXCEEDED",
        "434e4",
        "PWhD4",
        "2!232C2^2c2",
        "ERROR_DS_SOURCE_AUDITING_NOT_ENABLED",
        "RPC_S_COMM_FAILURE",
        "CMediaLayout::QueueFileCopy: Failed to get full path for %s: 0x%08x",
        "External storage used during installation is missing",
        "ERROR_EVENT_DONE",
        " !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~",
        "?-?:?C?\\?j?s?|?",
        "VdsPlatform::Initialize: Loading VDS service",
        "0$0,080X0`0h0p0x0",
        "JET_errDatabaseIdInUse",
        ".?AU?$ICollection@PAVCOptionalComponent@OC@@@UnBCL@@",
        "XCSuspendBitlocker::DoExecute",
        "Binding EFI namespace objects",
        "Found %d processes using this file.",
        "D$hPW",
        "3 3&323?3G3Q3Y3^3c3s3y3",
        "VdsDisk::InitializeProperties: Unrecognized disk name [%s]; won't get index",
        "        Class Name : %s",
        "UblIsUSBDiskInternal: Invalid parameter. Error = 0x%X.",
        "DiskLayoutMakeRecovery: Failed to format Recovery partition (0x%08x)",
        "6$626E6N6e6l6r6w6",
        "void __thiscall UnBCL::Array<class CGlobalPath *>::Remove(class CGlobalPath *)",
        "CSetupAutomation::ResolveTarget: Looking for a volume with a capacity of at least %llu byts",
        "2%2+202;2B2V2_2h2",
        "838Y8n8v8|8",
        "9F9Y9g9",
        "; ;-;9;B;O;[;g;s;",
        "DiskLayoutMakeWindows",
        "2%212;2K2[2h2m2z2",
        "3 4x4",
        "t_SSj",
        "ERROR_LOG_EPHEMERAL",
        ".PAVCXXXXXHandledException@?JI@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "ERROR_COLORSPACE_MISMATCH",
        "UpdateBackupBootCode:Successfully updated back up boot sector.",
        "PhlUb",
        "=4=O=f=v=",
        ".?AV?$HTEnumerator@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@UTableKey@?$Hashtable@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@4@V?$DictionaryEntry@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@4@UKeyTraits@64@$1?RetrieveEntry@64@KG?AV74@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@PAV?$DictionaryEntry@PAXPAX@3@UKeyTraits@23@V?$CElementTraits@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "Failure while removing default shell folder path %s",
        "OOBE boot apply%s from ICB",
        "; ;-;E;S;w;",
        "9/959>9T9b9t9|9",
        "030Q0h0s0",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CDeploymentBase *>::Reset(void)",
        "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAE@HH@Z",
        "191S1k1",
        "2*383S3",
        "SPStopUserModeTracing",
        "null array argument to ArrayList#CopyTo",
        ".?AVCXXXXXHandledException@?DG@??CreateVHDDeployment@CDeploymentProject@@UAEJPBG_KW4_FIRMWARE_TYPE@@W4DISK_LAYOUT_TEMPLATE@SetupPlatform@@0PAXPAUIGenericProgress@5@@Z@",
        "JET_errDatabasePatchFileMismatch",
        ":&:2:B:I:R:W:b:n:y:",
        "5&5+5?5L5y5",
        "pSPSetSnapshotInfoToNewOS",
        "ERROR_BAD_NET_NAME",
        "Current bugcheck string: %s",
        "Excluded key not found: [%ws]",
        "u3j@Z",
        "BcdHandledExternally",
        ";&;C;g;",
        "{99464DC0-2E14-4A7C-8CB6-A42B0CF3809A}",
        "    Component updates",
        "IMAGE_STATE_SPECIALIZE_RESEAL_TO_AUDIT",
        ".PAVCXXXXXTemp@?BG@??DoExecute@CRemoveFODPackage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "2!2+2=2E2K2U2_2w2",
        "3;3@3|3",
        "Service %s does not exist, skipping",
        "0\"1=1",
        "int __thiscall UnBCL::ArrayList<class CRegCreationData *>::IndexOf(class CRegCreationData *,int,int) const",
        "VdsDisk::CreatePartition: Failed to set partition name %s (0x%08x)",
        "9;9L9U9g9",
        "Done servicing debugger files.",
        ":7;O;[;m;",
        ";Q;];q;",
        "VPh`$",
        "PWVhw",
        "~w&t:",
        "3\"343B3h3z3",
        ".?AV?$SmartPtr@VXmlNodeList@XmlLite@UnBCL@@@UnBCL@@",
        ";);9;F;V;b;m;",
        "j:Xf9A",
        "3=3l3~3",
        "Creating Offline OC Manager with ImagePath: %s",
        "2(2=2I2U2a2j2w2",
        "JET_errEndingRestoreLogTooLow",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@W4ActionType@@UTableKey@?$Hashtable@PAVString@UnBCL@@W4ActionType@@@2@W43@UKeyTraits@52@$1?RetrieveValue@52@KG?AW43@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@W4ActionType@@@UnBCL@@W4ActionType@@UKeyTraits@23@V?$CElementTraits@W4ActionType@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "8(868>8D8\\8d8k8w8~8",
        "Tracing: Read settings from onesettings:m_bGlobalLoggerEnabled: 0x%x,m_bSetupAutoLoggerEnabled: 0x%x,m_bUserModeTracingEnabled: 0x%x,m_bKernelModeTracingEnabled: 0x%x;m_dwKernelFlags: 0x%x;",
        "9.9D9a9h9n9s9~9",
        "[CatalogHeader]",
        "8$8*8/848^8h8",
        "0!080N0l0",
        "%hs: Scratch directory found: %s",
        "1!1+151?1I1W1]1c1h1r1|1",
        ".?AV?$CAutoCleanupBase@PAVWmiAssociation@WMI@@@RAII@@",
        "Error deleting boottgt(%s)! Last Error = %#x",
        "UserAccountState",
        ";!;6;>;D;Q;c;|;",
        "SetupGetFieldCount",
        "4#414A4U4n4v4|4",
        "<#=*=",
        "DiskLayout::GatherExistingPartitions: Failed to enumerate target disk partitions: 0x%08x",
        "CDiskReader::PreRead",
        "Failed to write WIMBoot partition info for rollback. Error: 0x%08X",
        "enum OP_EXECUTION_PHASE &__thiscall UnBCL::ArrayList<enum OP_EXECUTION_PHASE>::get_Item(int)",
        "D$(PVh",
        "<3<K<_<i<",
        "HeapAlloc",
        "<3<k<",
        "CRYPT_E_NOT_IN_REVOCATION_DATABASE",
        "ERROR_TOO_MANY_THREADS",
        "8<8L8d8l8v8",
        "/settings/component/",
        "CMediaLayout::Initialize: Failed to get full path to media sources dir: 0x%08x",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CFailForwardSystem *>::Reset(void)",
        "int __thiscall UnBCL::ArrayList<class CInfFile *>::LastIndexOf(class CInfFile *,int,int) const",
        "0&0/090B0L0U0_0h0r0{0",
        "Could not get exclusive lock on hive file %s. Error: 0x%08X",
        "ERROR_DS_DRA_DB_ERROR",
        "7'70797B7K7T7]7f7o7x7",
        "7)757I7Y7",
        "int __stdcall UnBCL::MP::ThrowCompare<class ISPPluginData *>::Compare(class ISPPluginData *,class ISPPluginData *)",
        "3SVVV",
        ";!;*;<;D;J;S;o;",
        "\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Hardware Profiles\\Current",
        "CMediaLayout::ExecuteOptimization: Failed to get audit payload: 0x%08x",
        "ScratchDir",
        "ERROR_NO_MORE_SEARCH_HANDLES",
        ";(;0;8;@;H;X;`;",
        "WIM\\IMAGE[*]\\DIRCOUNT",
        "pExtractCrashDump: Successfully extracted crash dump from %s to %s.",
        "8*868?8K8R8X8]8h8r8",
        "CSuspendBitlocker::DoExecute: Unsupported final OS dir path %s",
        "6(6^6o6{6",
        "2.282?2E2J2U2`2t2|2",
        "Failed to remove file operations journal, error: 0x%08X. Error is fatal.",
        "2/2?2L2Y2k2",
        ".?AVCXXXXXHandledException@?CIO@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "pGetExistingPageFiles",
        "DiskLayout::VerifyLayoutFillSpaceOnce: Only one logical partition may be extended to fill remaining space.",
        "3 3*343>3H3R3\\3f3p3z3",
        ":(:0:6:C:U:h:z:",
        "Failed to initialize COM security. Will use CoSetProxyBlanket instead. hr = 0x%08X",
        "%hs: Failed to open file %s for flush. Error: 0x%08X",
        "0(0X0]0",
        "=$=0=<=H=Z=o=w=}=",
        "BfsMigrateLoaderSettings failed to open template object %#x",
        "{C63B0205-C22D-4847-9645-B0242EA6C762}",
        "!D$03",
        "Gather statistics: framework",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::set_Item(int,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *)",
        "5/575A5H5N5S5^5i5p5",
        "8'858C8Q8_8m8",
        "int __thiscall UnBCL::ArrayList<class CGlobalPath *>::LastIndexOf(class CGlobalPath *,int,int) const",
        "%SystemDrive%",
        ".?AV?$SmartPtr@VStreamReader@UnBCL@@@UnBCL@@",
        "j)j:j_jbjWj",
        "8(858G8O8U8b8t8",
        "??4?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "Disk space info (Begin) is missing, cannot accurately estimate disk space needed by uninstall",
        "1.2C2i2~2",
        "%I64d",
        "CNewSystem::QueueSetupAutomation: Failed to queue driver %u: 0x%08x",
        ".?AV?$CAutoDelete@PAV?$ArrayList@PAVString@UnBCL@@@UnBCL@@@RAII@@",
        "wPf92tK",
        ";*;/;;;^;c;o;",
        "7#8I8p8",
        ">#>1>C>T>[>q>",
        "GetSecurityDescriptorOwner",
        "6'7,7j7t7",
        "']V2y/B",
        "CUpdateBootCode::DoExecute: Failed to get device path for volume name [%s]. Error: 0x%08X",
        "8*9Q9k9}9",
        "ERROR_EVT_CONFIGURATION_ERROR",
        "pAddSafeOSDrivers: Failed to delete temporary drivers directory [%s]. Error: 0x%08X",
        "class CCopyInfo *&__thiscall UnBCL::ArrayList<class CCopyInfo *>::get_Item(int)",
        "SVh z",
        ".PAVCXXXXXHandledException@?HJ@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "JET_errExistingLogFileHasBadSignature",
        "=!=.=@=J=_=g=m=z=",
        ";%;3;=;G;^;t;",
        "int __thiscall UnBCL::ArrayList<struct DiskMatchFilter>::BinarySearch(int,int,struct DiskMatchFilter,struct UnBCL::IComparer<struct DiskMatchFilter> *)",
        "r%MIG_DEFAULT_USER%",
        "enum OP_OPERATION_ID __thiscall UnBCL::_::HTEnumerator<enum OP_OPERATION_ID,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,enum OP_OPERATION_ID,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,&protected: static enum OP_OPERATION_ID __stdcall UnBCL::Hashtable<enum OP_OPERATION_ID,int>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::get_Current(void) const",
        ";(;L;T;\\;d;l;t;|;",
        "MIG_EFS_MODE",
        "ERROR_TOO_MANY_NAMES",
        "9B9f9x9",
        "CreateVolumeAccessPath: Successfully assigned (temp) drive letter [%c:] to [%s]",
        "?@?y?",
        "6(656G6O6U6^6t6",
        "SPValidateProductKey: Calling PidGenX",
        "6J7Q7`7",
        "CDownloadDUUpdates::DoExecute: Failed, but proceeding as this is non-fatal. hr = 0x%x",
        "<$<8<L<T<d<l<",
        "JET_errVersionStoreEntryTooBig",
        "6!6&6:6[6e6q6",
        "(%lx): Request execution failed",
        "ERROR_DS_OFFSET_RANGE_ERROR",
        "=+=2=8===H=N=`=g=m=r=}=",
        "Storage Reserve is not supported on this system",
        "base\\ntsetup\\setupplatform\\lib\\staticuninstall\\uninstallcheck.cpp",
        "APPXInstalledList",
        "0$0(0@0D0\\0`0x0",
        "?$?*?7?I?W?f?",
        ".PAVCXXXXXTemp@?3??DoExecute@CExtractFilesFromWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "8 8@8H8P8X8`8h8x8",
        "%s\\%s.mui",
        "4A5H5N5S5^5o5",
        ".PAVCXXXXXTemp@?3??Execute@CSetupPlatformPrivate@@UAEJW4EXEC_PHASE@SetupPlatform@@PAU_PROGRESS_DATA@4@PAH@Z@",
        "Driver packages %ws: %d",
        "1&121U1j1v1",
        ".PAVXmlException@UnBCL@@",
        "SQh`S",
        "XRollbackDirectory",
        "%hs: No copy needed.",
        ".?AUIDUUpdate@DU@@",
        "tVSSS",
        "@_^[]",
        "0&0.040H0U0o0u0",
        "ERROR_SXS_CORRUPT_ACTIVATION_STACK",
        "?8?=?B?N?e?j?o?{?",
        ".?AU?$IEnumerable@PAVCShellFolderInfo@@@UnBCL@@",
        "758O8d8l8r8",
        "BOOT.SDI",
        "DriverNewOSInjectFailureIgnoredList",
        ">l>w>",
        "CRYPT_E_ASN1_BADTAG",
        "CompareFileTime",
        "> ?T?",
        "Failed to set proxy blanket for the CBS session. Error: 0x%08X",
        "0'0-070A0X0o0",
        "2)4?4;5@5E5O5T5Y5c5h5m5t5y5~5",
        "?+?@?H?N?[?s?",
        "wcm://",
        "GetAttributeValue",
        "<K<Q<\\<j<",
        "packageName",
        "ERROR_DS_CANT_RETRIEVE_DN",
        ";,;D;X;a;v;",
        "< <(<0<8<D<d<l<t<|<",
        "%hs: Cannot set temp path. Error: 0x%x",
        "?ReadBytes@SerializationStream@UnBCL@@QAEXPAEH@Z",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::Remove(class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *)",
        "0:0_0q0y0",
        "9-979@9I9\\9a9r9",
        "4\"4,454O4a4",
        "]SYSTEM\\MountedDevices",
        "wintrust.dll",
        ".?AV?$SerializableArrayListPrimitiveBase@_J@_@UnBCL@@",
        "ERROR_CLUSTER_SINGLETON_RESOURCE",
        "5/5H5a5g5y5",
        "ERROR_DS_DUP_RDN",
        "40444L4P4h4l4",
        "5 545@5P5X5d5l5s5",
        "Operations requested reboot in non-online phase, this is a fatal error.",
        "0 0A0^0s0}0",
        "TelemetryPermission-DefaultLevel",
        "VdsPlatformDiskEnumerator::GetNext",
        "_GetMetaDeploymentVersion",
        "=(=F=V=i=t=",
        "    Failed to delete file",
        "2 2$2,24282@2D2H2L2T2X2\\2`2d2l2p2t2x2|2",
        "9!9'909F9Q9e9y9",
        "4#5H5^5p5",
        "?set_Schemas@XmlDocument@UnBCL@@QAEXPAVXmlSchemaSet@2@@Z",
        "Error while removing FOD %s. Error: 0x%08X",
        "2$2,242<2D2L2T2\\2d2|2",
        "Failed to find match for %s",
        "8E8o8",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@PAVString@UnBCL@@PAVMultiSz@2@@UnBCL@@@UnBCL@@",
        "> >'>->3>9>?>R>d>",
        "FAT32",
        "+030@0T0`0l0x0",
        "void __thiscall UnBCL::ArrayList<class CAppInfo *>::AddRange(const struct UnBCL::ICollection<class CAppInfo *> *)",
        "<$<:<E<U<_<q<y<",
        ".?AVCXXXXXHandledException@?2??DoExecute@CMountWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ".?AV?$Array@PAVCDeviceInfoData@CDeviceIdDatabase@@@UnBCL@@",
        "CheckSumMappedFile",
        ".PAVCXXXXXHandledException@?2??CopyToDriverStore@CApplyDrivers@@IAEJPAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@4@PAPAV54@@Z@",
        ".?AVCEnable1394Debugging@@",
        "121J1W1d1p1|1",
        "base\\ntsetup\\setupplatform\\lib\\src\\uninstall.cpp",
        "1,1K1k1u1",
        "WinREMigrateDrivers",
        "929>9L9S9Z9e9l9",
        "SSSSSS",
        "5*51575<5H5S5\\5b5v5",
        "ERROR_EVT_VERSION_TOO_OLD",
        ".?AV?$CAutoFreeLibrary@PAUHINSTANCE__@@@RAII@@",
        "ITimeTrigger::get_Repetition failed. hr = 0x%x",
        "In WindowsPE, shouldn't set flag to use Paged memory for telemetry",
        "?CanRegister@SerializationStream@UnBCL@@SGHXZ",
        "XmlLite.dll",
        ".data",
        "CDeploymentBase::BackupMounts: Failure (0x%08X)",
        "020F0M0S0X0c0j0~0",
        "y*Wh(",
        "void __thiscall UnBCL::_::ArrayListEnumerator<struct DiskLayout::Partition>::Reset(void)",
        "Copy file to destination instead",
        "ERROR_DOMAIN_TRUST_INCONSISTENT",
        "3*383@3F3Z3j3x3",
        "LogVdsStatus",
        "<!<8<B<Q<|<",
        "3$3B3N3`3~3",
        "Failed to extract image path",
        "ERROR_SXS_XML_E_UNCLOSEDCDATA",
        "D$4Ph",
        "tjj.W",
        "?3?>?G?P?^?l?u?",
        "=!>6>\\>q>y>",
        "!D$(!D$,!D$0",
        ".PAVCXXXXXTemp@?GI@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "2$3+3",
        "4c4y4",
        "SL_E_DECRYPTION_LICENSES_NOT_AVAILABLE",
        ".?AVSmVolume@@",
        "Request extension of partition name %s",
        "SL_E_SRV_GENERAL_ERROR",
        ".?AVCXXXXXHandledException@?5??SPSaveWinReInformation@@YGJPBGH@Z@",
        ".PAVCXXXXXHandledException@?GK@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        ">0>6>@>E>O>V>d>v>",
        "aSoftware\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection",
        "jklmnopqrstuvwxyz{|}~",
        ":2:?:g:s:~:",
        "Unable to get procedure CreateNewWindows",
        "6&6A6F6`6m6",
        "CreateNewQueueOnFirstBoot",
        "UnattendLogWV",
        "CSetupPlatform::DownloadDynamicUpdates: Failed to queue download operations. hr = 0x%x",
        "=(=9=>=R=f=t=",
        "D$,98t",
        "Cannot set the %s value. Error: 0x%08X",
        "SetupPlatform::_GetUninstallInterface",
        "External storage used during installation is missing, uninstall cannot continue.",
        "hu-HU",
        "yeSjRh",
        "RPC_X_SS_CANNOT_GET_CALL_HANDLE",
        "JET_errCannotDisableVersioning",
        "\"AUGio",
        ":g;n;",
        "    Failed to assemble element search path",
        "SecondBootPostOOBEEndTime",
        "SEH: Attempting to clean up failed installation",
        "556H6a6",
        "Param3",
        "708p8",
        ".?AVCXXXXXHandledException@?L@??pSPCopyFile@@YGJPAVString@UnBCL@@0P6GKT_LARGE_INTEGER@@111KKPAX22@Z22HH@Z@",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVCGlobalPath@@@UnBCL@@@UnBCL@@",
        "az-Cyrl",
        "Grow partition [%ws] and its volume from from [%lld] to [%lld].",
        ";(;8;?;E;J;U;_;r;",
        "{9F93F4A2-818C-4865-AAEE-DBCFF63CFFCE}",
        "1G1\\1z1",
        "Failed to deserialize/execute final operations. Error: 0x%08X",
        "SclpVolumeIsNtfs",
        "7)7;7s7",
        "2G3_3",
        "WSh #",
        ".?AV?$SmartPtr@VCSplitWIM@@@UnBCL@@",
        "Cannot revert execution in the queue, this is a fatal error.",
        "4>4Z4}4",
        ".PAVCXXXXXTemp@?BJP@??Rollback@CSetupPlatformOSSwitchCheckpoint@@UAEXPBG@Z@",
        "0&0,090R0|0",
        "ENVTRACK: Adding %s=%s",
        "?6?=?C?H?T?d?",
        "void __thiscall UnBCL::Array<struct SetupPlatform::IPartition *>::Insert(int,struct SetupPlatform::IPartition *)",
        "3A3H3N3S3_3i3",
        "7)7?7k7r7",
        "353=3J3R3Y3",
        "4A4O4]4i4u4",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::LastIndexOf(class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *,int,int) const",
        "6%62676@6M6T6^6r6{6",
        "CreateFileMappingW",
        "/sysprepInformation/imaging[",
        "ERROR_JOURNAL_ENTRY_DELETED",
        "JET_errDatabaseDuplicate",
        "CloseEncryptedFileRaw",
        "2'202F2g2",
        " (compact)",
        "ERROR_INVALID_PRIORITY",
        "ERROR_DBG_CONTROL_C",
        ">+?2?8?=?H?T?h?|?",
        "Failed to move %s to %s. Error 0x%08X",
        "4 4,444\\4d4l4",
        "EULAInstalled",
        "ProfessionalWorkstation",
        "VdsPartition::SetType: Couldn't set attribute for %s partition (0x%08x)",
        "VdsVolume::AssignDriveLetter",
        "8!8?8X8n8",
        "int __thiscall UnBCL::Hashtable<class UnBCL::String *,unsigned long>::ContainsKey(class UnBCL::String *) const",
        ">'>,>@>I>g>u>}>",
        "=&=:=[=q=",
        "Acquiring needed privileges...",
        "pExtractCrashDump: Failed to recover crash dump from %s, hr = 0x%X",
        ";1;9;?;L;^;l;",
        ";/<C<h<",
        "SysprepSession::CreateXPathForSelection: Sysprep mode in registry is %s",
        "8%8-8E8K8]8m8v8",
        "FreeAndZeroCSI_BROKEN_COMPONENT",
        ":3:::@:E:P:Z:m:u:",
        "ERROR_MCA_UNSUPPORTED_MCCS_VERSION",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@",
        "5,5=5`5g5n5y5",
        "void __stdcall UnBCL::_::HTEnumerator<enum OP_OPERATION_ID,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,class UnBCL::DictionaryEntry<enum OP_OPERATION_ID,int>,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<enum OP_OPERATION_ID,int> __stdcall UnBCL::Hashtable<enum OP_OPERATION_ID,int>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<enum OP_OPERATION_ID,int> *,class UnBCL::Array<class UnBCL::DictionaryEntry<enum OP_OPERATION_ID,int> > *,int)",
        "class UnBCL::ArrayList<struct UnBCL::ISerializable *> *__thiscall CDeploymentBase::GetStoredObjectsGroup(class UnBCL::String *)",
        "9%929D9]9s9",
        "ERROR_LOG_APPENDED_FLUSH_FAILED",
        ".PAVCXXXXXTemp@?M@??SPIsPathInsideFolder@@YGHPAVString@UnBCL@@0@Z@",
        "Control\\Nls\\Language",
        "DiskLayout::CreatePartition: Creating logical partition at offset=%llu, size=%llu",
        "taVVQj2",
        "void __thiscall UnBCL::Array<class CAntiVirusInfo *>::RemoveAt(int)",
        "ERROR_NOT_FOUND",
        ".?AVCXXXXXHandledException@?2??RestageWindows@CReconstructOS@@IAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "5%5,5S5h5o5",
        ">8?V?v?",
        "BsdSummarize Diagnostic Information: %s",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CBcdSetting *>::MoveNext(void)",
        "%hs: Found unknown object in FOD list. Object: %s",
        ".?AV?$DefaultInstanceFactory@VCBool@@@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *> *)",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@HUTableKey@?$Hashtable@PAVString@UnBCL@@H@2@V?$DictionaryEntry@PAVString@UnBCL@@H@2@UKeyTraits@42@$1?RetrieveEntry@42@KG?AV52@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@H@UnBCL@@HUKeyTraits@23@V?$CElementTraits@H@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "2,232I2t2",
        "<*<2<8<A<W<e<~<",
        ">\">.>F>L>^>r>",
        "203w3",
        "??0Exception@UnBCL@@QAE@PBG@Z",
        ":I:S:",
        "4(40484L4T4\\4l4x4",
        "?]?b?",
        "%hs: Cannot relocate config file %s to %s. Error: 0x%08X",
        "8%808>8d8",
        "969R9k9",
        "2/272>2D2Q2^2f2o2t2",
        ":!:.:@:Y:x:",
        "void __thiscall UnBCL::Array<class CShellFolderInfo *>::Insert(int,class CShellFolderInfo *)",
        "8$8.8K8T8[8y8",
        "=%=+=0=;=B=V=b=~=",
        "InitLZMSDecompression",
        "GetCurrentDirectoryW",
        "2(2L2T2\\2d2l2t2|2",
        "0L1S1Y1^1i1t1",
        "WINDP",
        "3Q3X3^3c3o3|3",
        "de-AT",
        "ERROR_LOG_CLIENT_ALREADY_REGISTERED",
        "class COperationInfo *__stdcall UnBCL::Try_Cast<classCOperationInfo*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "%hs: External rollback requested without an external rollback GUID",
        "141I1R1]1",
        "2!2-262B2K2W2`2h2q2",
        "6?6T6q6",
        "nPh`_",
        "7*71777<7G7R7W7\\7p7",
        "; <8<K<i<y<",
        ".?AV?$SmartPtr@VCRegCreationData@@@UnBCL@@",
        "base\\ntsetup\\setupplatform\\lib\\src\\sysprep.cpp",
        "CDeviceIdDatabase::SelectInstallableInfs: No driver INF in %s was applicable to the machine.",
        "ERROR_VC_DISCONNECTED",
        ".?AU?$IList@PAVCAntiVirusInfo@@@UnBCL@@",
        ">)>J>d>k>q>v>",
        "Failed to flush logs to disk. hr = 0X%x",
        "7&757F7M7a7h7",
        "ERROR_DS_RANGE_CONSTRAINT",
        "System32\\ssshim.dll",
        "656l6v6",
        "Creating new system (1). WIM File: %s, index: %d, System drive: %c",
        "1$1)1@1J1[1d1q1",
        "FilterVolumeInstanceFindNext",
        "ValidateInput: ByteAlignment was assigned DefaultPartitionByteAlignment",
        "L$(Ph",
        "9\"9K9r9x9",
        "5(5H5P5X5`5h5p5x5",
        "No more payloads to enumerate",
        "Failed allocating old windows sxs path",
        "smj-SE",
        "1!1*1?1K1g1",
        "Failed adding source directory.",
        "Onesettings: Querying PPE server",
        "Hive %s is loaded at %s",
        "828\\8b8m8{8",
        "4 4+464J4_4m4|4",
        "SMI data results dump: Description = %s",
        "ERROR_SXS_XML_E_DUPLICATEATTRIBUTE",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CFileCreationData *>::MoveNext(void)",
        "pLogUpdateInfo: IUpdateIdentity::get_UpdateID failed. hr = 0x%x",
        "152H2`2",
        "6 6$6(6,64686<6@6D6H6L6P6T6X6\\6`6d6l6p6x6|6",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::RemoveAt(int)",
        "686P6W6^6d6q6",
        "2R2_2l2u2",
        "ur-IN",
        "S,_^[",
        "ScenarioComplete",
        "CSIDL_COOKIES",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *> *,int) const",
        ".?AV?$DefaultInstanceFactory@VCExistentImageInfo@@@UnBCL@@",
        "?get_Ticks@DateTime@UnBCL@@QBE_JXZ",
        "%hs: Failed to open online SYSTEM hive. Error: 0x%08x",
        "7!727I7Z7o7",
        "1 1.1M1Z1y1",
        "SPIsTargetTaggedForUpdate: Failed to get Update Reserve manager. hr = 0x%08X",
        "U0S0Q",
        "JET_errColumnNotFound",
        "6\"646H6U6^6k6r6x6}6",
        "0\"0(0-080C0W0x0",
        "ERROR_CHILD_MUST_BE_VOLATILE",
        "DeleteFileEx: Unable to clear out attributes on [%s]; GLE = 0x%x",
        ":?:F:L:Q:\\:g:{:",
        "FveAddTrustedWimData",
        "0-0;0`0r0z0",
        "?CompareTo@Version@UnBCL@@UBEHPBVObject@2@@Z",
        "Failed to schedule snapshot cleanup task. Error: 0x%08X",
        "void __thiscall CMediaLayout::SetStoredObject(class UnBCL::String *,struct UnBCL::ISerializable *)",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::LastIndexOf(class UnBCL::DictionaryEntry<class UnBCL::String *,long> *,int,int) const",
        "LastBootSucceeded:%d",
        "4)41474D4V4s4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE",
        "RtlDosPathNameToNtPathName_U_WithStatus",
        "1(2G2o2",
        ".CDisableFeature::DoExecute",
        "; ;0;4;D;H;X;\\;l;p;",
        "<L={=",
        ":+:5:<:B:G:R:`:p:x:",
        ".?AU?$ICollection@PAVCAntiVirusInfo@@@UnBCL@@",
        "7$7*70767<7B7H7N7T7Z7`7f7l7r7x7~7",
        ".?AV?$DictionaryEntry@_JPAVCGlobalPath@@@UnBCL@@",
        "676>6D6I6T6^6q6",
        "ERROR_HOST_NODE_NOT_RESOURCE_OWNER",
        "/executeInstall",
        "MapViewOfFileEx",
        ".?AU?$ICollection@W4OP_EXECUTION_PHASE@@@UnBCL@@",
        ":0:A:`:g:",
        "3 3$3",
        "%hs: Failed to read the display list, rollback entry will remain visible. Error: 0x%08X",
        "3+434=4C4H4[4q4",
        "7&7/7F7S7h7",
        "f^fYf",
        "6<6t6",
        "< <,<<<H<T<y<",
        "?&?,?5?K?Y?r?y?",
        "|SYSPART|\\",
        ">/>D>n>",
        "Final decision for external driver package (WinPE): %s",
        ".PAVCXXXXXHandledException@?L@??SPArePathsEqual@@YGHPAVString@UnBCL@@0@Z@",
        "void __thiscall UnBCL::ArrayList<class CFilterDriverInfo *>::Resize(int,int)",
        "Failed allocation wcp.dll path to check compact.",
        ";(;0;6;C;U;f;",
        "%s.ActualProfile.New",
        "PPVSW",
        "6\"626<6N6V6\\6f6p6",
        "VWhpV",
        "QWWWWj",
        "SPGetWIMImageInfo: Failure creating a temporary directory. Error: 0x%08X",
        "=+=C=Q=[=h=q=x=",
        "MIG_IGNORE_PLUGINS",
        "%s\\Select",
        ".?AU?$IList@PAVSysprepAction@@@UnBCL@@",
        "282L2X2",
        "    Failed to assemble element folder path",
        "Package %ws will not be restaged because it was marked to be removed on reset",
        "= =$=(=0=4=<=@=D=H=P=T=X=\\=`=d=h=l=p=t=x=|=",
        "K32EnumProcessModules",
        "8=8X8`8j8r8",
        "404J4Q4X4e4o4",
        "ERROR_DRIVER_FAILED_PRIOR_UNLOAD",
        "8&828?8K8W8d8p8|8",
        "8#9*90959@9M9U9[9`9t9",
        "PostRollbackShutdown",
        "Split WIM file %s to %s in size %I64u",
        ":':.:@:K:Y:y:",
        "6!6(666H6Y6`6v6",
        "AttachVirtualDisk",
        "8,8E8d8~8",
        "Exception raised while handling the exception! De-activating.",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCOperationResult@@@UnBCL@@@UnBCL@@",
        ".?AV?$SerializableBase@VCApplyDataOffline@@$0A@V?$DefaultInstanceFactory@VCApplyDataOffline@@@UnBCL@@@UnBCL@@",
        "Cannot find %d from the indexes",
        "SPFindFirmwareBootDisk: Couldn't find firmware boot disk (0x%08x)",
        "ERROR_DS_OUT_OF_VERSION_STORE",
        "6:6?6D6N6f6k6",
        ".?AUIMigDiscoverProgress@@",
        "4!4L4V4d4r4",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::Resize(int,int)",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCCFGSectionValue@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::IndexOf(class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *,int,int) const",
        "6$6H6\\6m6x6",
        "ERROR_SERVICE_START_HANG",
        "DiskLayout::ExecModifications",
        "Failed to create file handler on %ls",
        "%s%s%s",
        "<$<0<<<H<T<]<f<o<x<",
        "122Y2`2f2k2w2",
        "\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SESSION MANAGER",
        "=4=:=C=K=[=b=h=m=x=",
        "CBS_E_STACK_SHUTDOWN_REQUIRED",
        "7/7Z7p7",
        "%hs: BCD failed to set back the default boot entry. Error: 0x%08X",
        "pLogInvalidRead",
        ";C$u+",
        "CTrustSafeOS::DoExecute: Failed to hash %s: 0x%08x",
        "5*575@5G5Q5b5o5",
        ".?AU?$IEnumerator@UPartition@DiskLayout@@@UnBCL@@",
        "%s-%s",
        "=,=3=9=>=I=X=`=f=z=",
        "%s\\%s\\%s\\%s\\%s",
        "8=9o9",
        "414L4S4Y4^4i4v4{4",
        "Canoot complete phase %u for operation %u in queued phases",
        "t&Qjxj0h",
        "5,535",
        "VdsPartition::Format: Couldn't format partition (0x%08x)",
        ";&<A<P<",
        "Failed to register the recovery image. Error: 0x%08X",
        "SPDeleteSnapshot: Target snapshot doesn't exist, assume it's already removed",
        "NtOpenProcess",
        "9/9E9[9f9v9",
        ": :):::B:O:^:z:",
        "3!3.373D3M3U3\\3",
        "ERROR_SXS_FILE_NOT_PART_OF_ASSEMBLY",
        "CMigrateFramework: Offline apply failed. Status: %d",
        "<$<0<9<P<}<",
        "354L4T4i4r4{4",
        "> >*>4>>>H>R>\\>f>p>z>",
        "%hs: Set key value %s",
        "WinRE driver/OEM tools migration action failed. Error: 0x%08X",
        "ERROR_DS_CANT_ADD_ATT_VALUES",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::IndexOf(class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *,int,int) const",
        "6&686B6U6]6c6p6",
        "ERROR_IPSEC_IKE_POLICY_MATCH",
        "6-6S6j6",
        "7'7-737@7O7k7s7}7",
        "System\\Setup\\WindowsUpdate",
        "DeleteFileEx: Unable to open [%s]; GLE = 0x%x",
        "Wmi::GetCallParameters: Couldn't get method %s from type %s (0x%08x)",
        "3+33393F3^3j3t3",
        "enum ActionType __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,&protected: static enum ActionType __stdcall UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,class ATL::CElementTraits<enum ActionType> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "Cannot find a place to backup the driver %s",
        "4-4j4w4",
        ".?AV?$SmartPtr@VCSetupPlatformInfo@@@UnBCL@@",
        "8$8*8/8:8E8S8b8v8",
        "%s\\%s\\%u",
        ":%:9:Q:^:",
        "CSetupAutomation::ResolveTarget: Chose System volume %s",
        "CMoveWIMBootEntriesAndPartition::GetDiskSpaceImpact",
        "OC::DumpOCCollection",
        "CReconstructOS::RestageWindows: Failed to stage installation: 0x%08x",
        "Download Critical Dynamic Updates",
        "=)=0=7=B=L=_=p=",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCOperation@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCOperation@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "=)=9=B=_={=",
        "6#6>6C6p6",
        ">\">I>W>`>w>",
        ":#:):6:<:A:R:]:k:",
        "SETUPPLATFORMCOMM: Connecting thread finished.",
        "Failed to open key for object's elements. Status: %x",
        ".rdata$r$brc",
        "FOD Validator: Failed to initialize DISM. Error: %08X",
        "425G5m5",
        "CReconstructOS::DoExecute: About to call ReconstructWindows()...",
        "CSetupAutomation::Initialize: Unable to read %s: 0x%0x",
        "SSSPhD",
        "CallPidGenX: Failed to get procedure address from '%s' to validate product key.",
        "Sh`Bc",
        "4%4=4B4`4e4j4t4",
        "FindNextFileNameW",
        "Calling into RunSMIActionPass to execute unattend GCs for pass [%s]",
        "2;2I2Q2^2f2",
        "8#8(838?8S8k8",
        ".?AV?$SerializableBase@VCCreateScopedSnapshot@@$0A@V?$DefaultInstanceFactory@VCCreateScopedSnapshot@@@UnBCL@@@UnBCL@@",
        "ConvertSecurityDescriptorToStringSecurityDescriptorW",
        "UPGSafeOSBootRemovalCount",
        "NoDump",
        "=0=I=P=W=b=w=",
        "SPAPI_E_CANT_LOAD_CLASS_ICON",
        "9&9?9i9o9z9",
        "ERROR_NO_SITENAME",
        "0#0(030>0R0q0",
        "ITaskDefinition::get_Principal failed. hr = 0x%x",
        "EnableTraceEx2",
        ":!:.:B:K:T:]:j:s:",
        "Full apply detected but the platform cannot create user profiles. Fatal error.",
        "8\"8,8<8q8",
        "BfsRepair: BCD failed validation check after file system repair.",
        "1'1E1]1i1u1",
        ".?AU?$IEnumerator@PAVCWIMEntryIndex@CWIMBootHelper@@@UnBCL@@",
        ";1;C;M;\\;o;",
        "6'646U6b6x6",
        "CFfuHash::CalculateHash",
        "Component %s ran offline, but required reboot; running pending parts",
        "Flow Constraint Validator",
        "FODRemovalFailedList",
        "MIG_PROCESS_DEFAULT_USER_AS_USER",
        "y+Sh[",
        ";);[;l;",
        "9&:w:",
        "SVWhD",
        "dStoreDir",
        "Setting WMI Uint16 property %s: the property does not exist",
        "ERROR_APPHELP_BLOCK",
        "3'3.3=3C3R3f3v3",
        "VdsPlatform::IsAvailable: Couldn't create VDS loader instance (0x%08x)",
        "90:x:",
        "7!7*747J7c7l7u7",
        "Start",
        "moduleType",
        "ERROR_DS_NO_DELETED_NAME",
        "<\"<6<=<J<U<_<l<z<",
        "class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::get_Item(int) const",
        "4 4T4n4",
        ">$>)>/>8>",
        "4 5p5",
        "CSetupPlatform::CreateNewSystem: Failed to create uplevel platform info object",
        "5G5Q5",
        "4%4-4B4I4W4b4h4|4",
        ":%:N:_:l:x:",
        "y!Wh ",
        "CCreateScopedSnapshot::DoExecute: Error while setting snapshot creation time value: 0x%08X",
        "y5VjNh0",
        "!t$$Pj",
        "=6=Y=",
        "SPReserveSpace: Error creating reserved disk space file %s. Error: 0x%08X",
        ": :,:G:L:Q:]:b:",
        "7-7D7O7T7a7{7",
        "6 6(60686@6H6P6X6`6h6p6x6",
        "OpenSCManagerW",
        "RPC_S_NO_CALL_ACTIVE",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *> *,int) const",
        "2%272E2X2~2",
        "4-474D4L4S4e4t4|4",
        "3-3y3",
        "SPInitializeDiskPlatform: Using VDS",
        ".?AV?$SmartPtr@U?$IEnumerator@_J@UnBCL@@@UnBCL@@",
        "6%6:6C6O6Y6e6|6",
        "6 6$64686H6L6\\6`6p6t6",
        "VdsPartition::SetGptAttributes: Setting non-GPT partition attributes is not supported",
        "f90tV",
        ".?AV?$DefaultInstanceFactory@VCOrchestrateOSSwitch@@@UnBCL@@",
        "CNameValueArray::InsertNew",
        "ERROR_DS_NAME_ERROR_NOT_UNIQUE",
        "X9F`tN3",
        "DumpType",
        "CRelocateOS: Cannot perform an OS piece relocation without the list of OS pieces from both systems.",
        "int __stdcall pSPRestoreCommonShellFolder(class UnBCL::String *,struct IMigPlatform *,struct IMigEnvironment *,struct IMigPlatform *,struct IMigEnvironment *)",
        "WWWhd",
        "ERROR_EVT_MAX_INSERTS_REACHED",
        "7'7?7U7Z7o7",
        ";%;=;x;",
        "__int64 *__thiscall UnBCL::ArrayList<__int64>::GetBuffer(int)",
        "8D8Z8l8y8",
        "5'6=6H6S6e6l6|6",
        "{BFE7410B-CD4D-4CC6-B2E5-4D20FD6090E5}",
        "70747L7P7h7l7",
        "121L1W1g1q1",
        "Process Name [%d]: %ws",
        "ERROR_UNWIND_CONSOLIDATE",
        "9%999?9H9^9l9",
        "SERIALIZEVERBOSE: After restoring name is: %s",
        "Removing WIMBoot WIM files on the OS partition",
        "9\"949F9[9l9y9",
        "ERROR_PROCESS_MODE_NOT_BACKGROUND",
        "?)?;?I?j?",
        "?$?.?:?S?d?q?",
        "5%5/585B5N5Z5c5t5",
        "SETUPP",
        "Failed to get Globallogger setting, 0x%x",
        "CSIDL_COMMON_STARTUP",
        "<$<,<D<L<d<l<t<",
        "en-TT",
        "Persist diagnostics data for new system for future uploading",
        "5#5c5s5",
        "=%=6===S=n=t=~=",
        "<2<F<[<m<u<{<",
        "completed",
        "CRYPT_E_SIGNER_NOT_FOUND",
        "@9F4u ",
        ".PAVCXXXXXTemp@?BCK@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ".?AV?$DefaultInstanceFactory@VCFinalizeCriticalBoundary@@@UnBCL@@",
        "SclpFsProcessVolumeByHandle",
        "POSTVALIDATION: Validator asked for retry: %s (%s)",
        "8@9G9s9z9",
        "@9F`tN3",
        "KB Article ID's: No Article's Found",
        "Onesettings: Failed to initialize and query: 0x%x",
        ".?AV?$CAutoRelease@PAUIMigFileNavigator@@@RAII@@",
        "6%6_6i6",
        "%hs: Writing the migration scope.",
        "5(5H5P5X5d5",
        "CUninstall::CUninstall",
        "<B<G<",
        "y!Vh,",
        "?get_Minor@Version@UnBCL@@QBEHXZ",
        "Failed to initialize DISM",
        ">$>(>8><>L>P>`>d>t>x>|>",
        "ISetupPlatformOnline initialized",
        "CUpdateBootCode::DoExecute: Retry one time for corruption",
        "IsContainerIDSameAsRootContainerID: SetupDiGetDeviceProperty failed. Error = 0x%X.",
        ":/:6:<:A:L:[:c:s:",
        "%c %ws %d %d",
        "> >0>T>\\>d>l>t>|>",
        "SPWriteDriversList",
        "swapfile.sys",
        "JET_errRestoreInProgress",
        "3,4w4",
        "ERROR_SXS_XML_E_UNEXPECTEDEOF",
        "222V2]2u2",
        "101D1K1Q1V1a1h1",
        "D$0Ph",
        "VSh4h",
        "VPh0y",
        ";I;U;f;",
        ".?AV?$DefaultInstanceFactory@VCRemoveWIMBootEntries@@@UnBCL@@",
        "7(777s7",
        "8/898R8_8g8",
        "2$2(2,242<2@2D2H2L2P2T2X2\\2`2d2h2l2t2x2|2",
        "7 8'888",
        "void __thiscall UnBCL::ArrayList<class CRegCreationData *>::Resize(int,int)",
        "VWj<j",
        "failed",
        "2I2f2v2}2",
        "JET_errInvalidCodePage",
        "L$4_^[3",
        "0$0(0,0004080<0@0D0H0L0P0T0\\0`0h0p0t0x0",
        "0D0c0u0}0",
        ";>;_;{;",
        "ERROR_DS_CANT_MOVE_DELETED_OBJECT",
        "SL_E_CHPA_ACTCONFIG_ID_NOT_FOUND",
        ":-;\\;e;z;",
        ":0:7:S:a:y:",
        "3 3$3(3,34383<3@3D3H3L3P3T3\\3`3d3h3p3t3x3|3",
        "4$4,444<4D4L4\\4d4l4x4",
        "base\\ntsetup\\setupplatform\\lib\\util\\serviceutils.cpp",
        "en-IE",
        "void __thiscall UnBCL::ArrayList<__int64>::Insert(int,__int64)",
        "7 7&70757?7F7T7f7w7~7",
        "%hs: Failed to remove new WinRE. hr = 0x%08X",
        "CExecuteUnattend::DoExecute: Failed to delete original answer file: 0x%08x",
        "3+343V3u3",
        "5E5_5f5l5q5|5",
        "5\"5.5B5P5^5l5",
        "5\"5,595K5V5j5z5",
        "3/373=3C3R3f3v3",
        "kernelbase.dll",
        ".?AV?$DictionaryEntry@PAVString@UnBCL@@W4ActionType@@@UnBCL@@",
        "    Failed to write end node shallow",
        "7(7=7O7W7]7q7w7",
        "CSetupPlatform::ResurrectAutomation",
        "ERROR_NO_INHERITANCE",
        "OutputDebugStringA",
        "6\"6@6",
        "ERROR_INVALID_ORDINAL",
        "4,5_5t5",
        "8-8B8P8^8l8z8",
        "2(2W2q2",
        "ERROR_INVALID_HANDLE_STATE",
        "pSPRestoreCommonShellFolder",
        "<\"<(<R<Y<^<d<j<p<v<|<",
        ":?:o:",
        "MIGRATION_SCRIPT_FILES",
        ";0;T;",
        "686J6R6X6e6w6",
        "CRYPT_E_STREAM_MSG_NOT_READY",
        "void __thiscall UnBCL::ArrayList<unsigned short *>::CopyTo(class UnBCL::Array<unsigned short *> *,int) const",
        "$VWh`",
        "OrchestrateStartSystemServices: Unable to set event to trigger start of autostart services; hr = 0x%x",
        "void __thiscall UnBCL::Array<class CDrvStoreProperty *>::InitLarva(class UnBCL::ArrayList<class CDrvStoreProperty *> *)",
        "%hs: Failed to create backup directory %s",
        ":7:Q:W:i:z:",
        ";';/;?;H;P;l;v;",
        "FsMftSDProcessCount",
        "NotifyUILanguageChange",
        "6n6u6",
        ".?AU?$IEnumerator@PAVDiskLayout@@@UnBCL@@",
        "void __thiscall UnBCL::Array<class ISPPluginData *>::Remove(class ISPPluginData *)",
        ";G,u^",
        "7)71787>7C7N7c7p7v7",
        "=A=T=",
        ":J:n:",
        "ERROR_INVALID_WINDOW_HANDLE",
        ";%;;;F;l;",
        "GetFileAttributesW",
        "Set to enable auto launch narrator",
        ".?AU?$IList@PAVCOperation@@@UnBCL@@",
        "Vj+j,",
        ":.:<:E:N:d:",
        "<(</<><E<K<P<]<e<y<",
        ".PAVCXXXXXTemp@?FI@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "GlobalTracingEnabled",
        "%hs: Unknown migration scope %s, will return SP_MIG_SCOPE_NOTHING",
        "6,6J6Y6h6w6",
        "t$$WV",
        "%hs: Invalid parameter",
        "HARDRESERVETRACK: Available  : %I64u",
        ".?AU?$IList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@",
        ".PAVCXXXXXHandledException@?OD@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        ">?>Q>b>",
        "7+7F7M7S7X7c7o7",
        "Error deleting bootnxt from the BOOT folder (%s)! Last Error = %#x",
        ".didat$5",
        "404=4I4U4a4",
        "4$4L4T4\\4p4x4",
        ";.;?;S;_;o;{;",
        ";.;[;t;~;",
        "BatteryChargePercent",
        "void __thiscall UnBCL::ArrayList<class CDriverDetails *>::set_Item(int,class CDriverDetails *)",
        "JET_errTooManySplits",
        "Current result: 0x%08X",
        ":#:(:3:>:R:\\:c:i:n:y:",
        "%hs: Not able to add files to Diagnostics Error Reporting. Error = %d",
        "8!8*8L8U8^8g8x8",
        ".PAVCXXXXXTemp@?BD@??DoExecute@CUnmountWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ";%;-;7;?;E;Y;a;{;",
        "Failed to get provider list setting, 0x%x",
        ".?AVSmPlatform@@",
        "9$9:9L9S9Y9^9i9t9",
        ".?AV?$SerializableBase@VCExtractFilesFromWIM@@$0A@V?$DefaultInstanceFactory@VCExtractFilesFromWIM@@@UnBCL@@@UnBCL@@",
        "=H=n=",
        "2$232C2[2i2",
        ">$>,>4><>D>L>T>\\>d>l>x>",
        "CDeploymentBase::CleanupMounts: Unable to unmount the directory %s. Error: 0x%08X",
        "SL_E_SLP_OEM_CERT_MISSING",
        ">!?@?e?",
        "5 5,5<5H5X5`5q5",
        "    Failed to verify %s attribute",
        "CDeploymentProject::CreateFFUDeployment: Failed to create VHD deployment; Error: 0x%08X",
        ".?AVCXXXXXHandledException@?2??DoExecute@CExecuteUnattend@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "7)8K8",
        "Bad request. Asked to inject the driver but not commit the image",
        "??1?$ICollection@PAVString@UnBCL@@@UnBCL@@UAE@XZ",
        "int __stdcall UnBCL::MP::OperatorCompare<unsigned int>::Compare(unsigned int,unsigned int)",
        "Error while executing QueueDataMigration. Exception: %s",
        "ERROR_DS_DRA_ABANDON_SYNC",
        "CDeploymentProject::CreateBootableMediaDeployment: Failed to get target disk properties (0x%08x)",
        "72787A7W7d7v7~7",
        "CSetupPlatform::MoveTelemetry",
        ".?AV?$CAutoCleanupBase@PAUIEnumWbemClassObject@@@RAII@@",
        "VdsPhysDisk::GetProperties: Can't read basic disk properties (0x%08x)",
        "ERROR_COULD_NOT_INTERPRET",
        ".PAVCXXXXXTemp@?3??DoExecute@CFinalizeCriticalBoundary@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "??0?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@XZ",
        "2#2*242E2R2\\2k2t2z2",
        "2 2D2T2\\2d2l2t2|2",
        "%hs: Cannot queue registry creation operation for fail-forward system %d. Error: 0x%08X",
        "2\"2E2J2V2u2",
        "PjdYQS",
        "NtFlushKey",
        "SmPartition::GetVolume: Can't enumerate MSFT_PartitionToVolume (0x%08x)",
        ".PAVCXXXXXHandledException@?BHB@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "0L0P0X0`0x0",
        "SYSPREP_PLATFORM_SESSION_TEST_SKIPLIST",
        "gu-IN",
        "4'4.4=4C4P4a4n4w4",
        "1$141D1T1d1t1",
        "OSRollbackService::CCheckpoint::MoveOrCopyFiles",
        ">!>,>:>?>L>T>x>",
        "BitBlt",
        ";7;R;];d;p;",
        "CBS_S_STACK_SHUTDOWN_REQUIRED",
        "%hs: failed to mount software hive. Error: %08x",
        "CopyFileW",
        "3!3)3.353=3C3R3i3y3",
        ";3;J;y;",
        "384?4J4r4",
        "VdsDisk::EnumeratePartitions",
        "1=1k1r1x1}1",
        ".?AVLogCallback@?1??pInitializeWmiLogging@@YGJXZ@",
        "%hs: Failed to convert default GUID. Error: 0x%08X",
        "7+757D7M7S7`7f7k7",
        "ERROR_LOG_BLOCKS_EXHAUSTED",
        ":#:(:5:J:O:v:",
        "CExecuteUnattend::DoExecute: Couldn't mark pass %s as not started: 0x%08x",
        "ERROR_CTX_SHADOW_ENDED_BY_MODE_CHANGE",
        "0/0<0K0R0X0]0h0t0",
        "ERROR_SPOOL_FILE_NOT_FOUND",
        "Invalid array index",
        ";\";8;F;O;s;",
        ";';5;>;G;P;",
        ".?AVCSetEntropy@@",
        "Post OOBE Boot",
        ".FirstBootTel-M1.etl",
        "void __thiscall UnBCL::ArrayList<class DiskLayout *>::set_Item(int,class DiskLayout *)",
        "SPAPI_E_BAD_INTERFACE_INSTALLSECT",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FveDetect",
        "class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::GetBuffer(int)",
        "ERROR_NO_SUPPORTING_DRIVES",
        "6'696A6G6Y6j6w6",
        ".?AV?$ArrayListEnumerator@PAVCGlobalPath@@@_@UnBCL@@",
        "LastIndex",
        ">)>7>`>h>u>",
        "030A0G0S0_0d0r0",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@@UnBCL@@@UnBCL@@",
        "4(5d5",
        "?4?a?p?}?",
        "9$9*90969<9B9H9N9T9Z9`9f9l9r9x9~9",
        ">$>*>0>6><>B>H>N>T>Z>b>f>j>n>r>v>z>~>",
        ".?AUIExternalStore@@",
        "3\"3(353G3U3",
        "|SOURCE|\\|RESOURCES|\\BOOTRES.DLL",
        "%hs: Disk is not encrypted or bitlocker is already suspended",
        "2 2$24282H2L2\\2`2p2t2",
        "JET_wrnColumnNull",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAUISerializable@2@UTableKey@?$Hashtable@PAVString@UnBCL@@PAUISerializable@2@@2@V?$DictionaryEntry@PAVString@UnBCL@@PAUISerializable@2@@2@UKeyTraits@52@$1?RetrieveEntry@52@KG?AV62@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@PAUISerializable@3@UKeyTraits@23@V?$CElementTraits@PAUISerializable@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "1#151C1g1",
        "8 8*8?8G8M8Z8l8",
        "1J1h1",
        "<,<=<Q<d<m<|<",
        "ERROR_IPSEC_MM_POLICY_PENDING_DELETION",
        "CSetupPlatformCheckpoint::CopyLogFiles: An error occurred while processing the CBS log folder",
        "5,6h6",
        "=C=S=",
        ">'>2>@>`>{>",
        "Copying [%ws] -> [%ws]",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::IndexOf(class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *,int,int) const",
        "6*7E7",
        "6-6;6j6",
        "void __thiscall CSPInternalPluginData::AddError(unsigned long,class UnBCL::String *)",
        "    Process name: %.*ws",
        "ERROR_SET_POWER_STATE_VETOED",
        "0*0L0w0",
        "RPCRT4.dll",
        "Failure while executing end-install apply, uninstall will continue. Status: 0x%08X",
        "\\Control\\Wmi\\Trace]",
        "Source system does not have %s either.",
        "Processing volume [%ws]...",
        "CTurnOffReserve::DoExecute: Failed to clear soft reserve on [%s]. Error: 0x%08x",
        "y,Wj*h",
        "SPTagTarget: Failed to %s [%s]. hr = 0x%08X",
        "CEnableSafeOSPageFile::DoExecute: Creating page file %s, min size %llu, max size %llu",
        ".?AU?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@",
        "Found environment variable value [%s] for offline user migration; skipping OneSettings query",
        "8,8K8e8",
        "5%535J5`5",
        "Client requested to keep BitLocker active on a best-effort basis, and the device supports it. Will try to keep BitLocker on, and fall back if needed.",
        "3;4|4",
        "#090R0d0",
        ".?AVCXXXXXHandledException@?2??DoExecute@CCompressOldOS@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "SPGetWIMImageInfo: Failed to set temporary WIM path. Error: 0x%08X",
        ".?AU?$IEnumerator@E@UnBCL@@",
        "5,585A5J5V5b5n5z5",
        "9G@tlj",
        "RtlGetAce",
        "202=2J2c2n2}2",
        "CFG Validator: Failed to initialize from file [%s]. Error: 0x%08X",
        "=-=5=;=H=Z=h=",
        "0\"0'020<0D0J0^0o0",
        "Execute.StartAsync",
        "Initial decision for external package: %s",
        "8&8.8:8A8G8L8W8b8v8{8",
        "9F9Z9",
        "PQQWh",
        "2 2$2(2,2024282<2D2H2L2P2T2\\2`2d2h2l2t2|2",
        "9!939L9k9",
        "ERROR_DLL_NOT_FOUND",
        "?%?2?<?K?T?Z?g?m?r?",
        ".?AV?$SerializableBase@VCUnmountWIM@@$0A@V?$DefaultInstanceFactory@VCUnmountWIM@@@UnBCL@@@UnBCL@@",
        "FindFirstFileNameW",
        "ERROR_IPSEC_IKE_PROCESS_ERR_CERT",
        "%hs: Starting the engine online",
        "pLogUpdateInfo: IUpdate::get_LastDeploymentChangeTime failed. hr = 0x%x",
        "TlsFree",
        "{F4DAA2DD-C582-4DE5-AFBE-92CCAB4378B0}",
        "\\Windows\\SystemApps\\",
        "><>D>L>T>\\>d>l>t>|>",
        "?$?*?>?J?a?n?{?",
        "    Failed to allocate ptr",
        "= =+=6=F=V=b=n=u=",
        "9)949U9i9t9",
        "%hs: Request already made, similar request are rejected",
        "0X1P2H3@48506 7",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "qps-ploca",
        "BiExportEfiBootManager failed: %x",
        "DiskLayout::IsValidPartitionType: Unknown partition table type: %u",
        ":#:9:J:\\:e:y:",
        "No driver store properties to migrate; skipping.",
        "1&121>1a1r1",
        "4&404B4L4c4q4z4",
        "0$0)050?0R0t0",
        "void __thiscall UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *>::CopyTo(class UnBCL::Array<class OC::CCmdLineExecutionTelemetryData *> *,int) const",
        "ERROR_ARBITRATION_UNHANDLED",
        "SPApplyDeviceLayoutDiskConfig: Failed to initialize target disk (0x%08X)",
        "ERROR_RXACT_COMMIT_FAILURE",
        ">/>R>_>v>",
        "Path.Org",
        "WimCreateDirectory",
        "QueueDriverInstallation called with dir %s",
        "SysprepSession::ExecuteInternal: Error in executing action for %s; dwRet = 0x%x",
        "long __stdcall pMergeEtlFiles(const unsigned short *,const unsigned short *,const unsigned short *,int)",
        "%s\\%s%s",
        "%hs: Failed to get attributes for %s. Error: 0x%08X",
        "rollbackinfo.ini",
        ".?AU?$ICollection@PAV?$DictionaryEntry@W4OP_EXECUTION_PHASE@@PAV?$ArrayList@PAVCOperation@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "0%020D0`0g0m0y0",
        ".?AVCVHDImageInfo@@",
        "0!0-050I0Y0a0",
        "=4=;=B=H=U=j=x=",
        "6%6-696A6M6U6l6",
        "<!<)<0<<<N<c<r<|<",
        ":':A:L:_:i:{:",
        "Failed to remove INF %ws, Err = 0x%lx",
        "MountEntryToInfoStruct",
        "ERROR_CRASH_DUMP",
        ".PAVCXXXXXTemp@?3??Initialize@CCFGSectionFile@@UAEJXZ@",
        "1X1r1",
        "2>2Z2e2",
        "7$7,747<7D7L7d7x7",
        "class CGlobalPath *__thiscall UnBCL::_::ArrayListEnumerator<class CGlobalPath *>::get_Current(void) const",
        "Failed to allocate memory for space for process name.",
        "<J<t<",
        "5 5,565?5L5U5]5n5u5",
        "SetupPlatformVersion",
        "0(0/0F0R0b0n0z0",
        "Failed opening source DerivedData",
        "j-Yf;",
        "unsigned long __thiscall UnBCL::Hashtable<class UnBCL::String *,unsigned long>::get_Item(class UnBCL::String *) const",
        "XCNewSystem::PrepareForRun",
        "?$?1?>?H?V?]?c?h?s?",
        "void __stdcall AllowWindowsUpdateDuringSetup(void)",
        ";><E<",
        "Failed to process migration of driver package %s. Error: 0x%08X",
        ".?AV?$ArrayList@PAVCDeploymentBase@@@UnBCL@@",
        "5.5G5N5T5Y5d5q5w5",
        "CBSPendingActions",
        "j7j^h@[",
        ":-:<:F:",
        "6\"6+646@6L6X6l6v6",
        "??0String@UnBCL@@QAE@PBV01@@Z",
        ".?AVCXXXXXHandledException@?OO@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "3!353",
        "class DiskLayout *const *__thiscall UnBCL::ArrayList<class DiskLayout *>::GetBuffer(int) const",
        ".PAVCXXXXXHandledException@?2??DoExecute@COrchestrateOSSwitch@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "SP_FLOW_CONTROLS_INFO",
        "?%?0?r?y?",
        "292a2",
        ".?AV?$SmartPtr@VCSetupClRequest@@@UnBCL@@",
        "JET_errLogDiskFull",
        ".?AV?$SmartPtr@U?$IEnumerator@PAUIPartition@SetupPlatform@@@UnBCL@@@UnBCL@@",
        "0%0G0R0}0",
        "1+1@1H1N1[1m1w1",
        "ERROR_RESOURCE_NAME_NOT_FOUND",
        "CSetupPlatform::CreateDiskImage",
        "ERROR_NO_SPOOL_SPACE",
        "?4?;?B?H?T?h?v?",
        "5'5A5O5d5n5w5",
        "%hs: Failure to publish uninstall disabled notification. Error: 0x%08X",
        "=4=\\=|=",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CCopyInfo *>::MoveNext(void)",
        "9$91999J9R9\\9i9s9",
        "vi-VN",
        "$windows.~bt",
        "index",
        "Windows\\System32\\ntdll.dll",
        "<c=y=",
        "Module %s might have caused the crash and was removed from boot path. Attempting to reset setup.",
        "6F6`6j6",
        "SPIsTargetTaggedForUpdate",
        "Failed saving default pagefile settings from new os, Error: 0x%08X.",
        "t!9~0v",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@PAVMultiSz@2@@UnBCL@@@UnBCL@@@UnBCL@@",
        "5D5]5",
        "5A5n5",
        "sredirected ",
        "ERROR_RXACT_COMMITTED",
        "OSRollbackService::CCheckpoint::ExtractCrashDump: Pagefile at %s did not contain a crash dump.",
        "=#=G=",
        "dSnapshot",
        "Search finished successfully",
        ".PAVCXXXXXTemp@?3??DoExecute@CSysprepRespecialize@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "B\\;A\\",
        "$VWh8",
        ".?AV?$CAutoFindClose@PAX@RAII@@",
        "Failed allocating edition package path.",
        "ERROR_BAD_COMMAND",
        "SclStateConfigureBootTimeExecution",
        "1J1Q1W1\\1g1n1",
        "DestinationFolder",
        "class SysprepAction *const *__thiscall UnBCL::ArrayList<class SysprepAction *>::GetBuffer(int) const",
        "sRecoveryImagePath",
        "YWjFh",
        "SPDeleteSnapshot: Failed to delete snapshot. Error: 0x%08X",
        "Tracing: Reading onesettings is disabled, will not query onesettings",
        "3&3<3L3\\3t3",
        "9(9H9P9X9d9l9",
        "30353?3`3e3x3}3",
        ";4;L;T;\\;p;",
        ".?AUIDiskEnumerator@SetupPlatform@@",
        "757@7N7\\7j7x7",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *> *)",
        "{FB2C23C9-27AE-4ACF-B0E1-871AD8BA403E}",
        "void __thiscall UnBCL::ArrayList<class CDUPackage *>::CopyTo(class UnBCL::Array<class CDUPackage *> *,int) const",
        "%s%02x",
        "int __thiscall OSRollbackService::CSetupRollbackService::RollbackExecuteSequence(void)",
        "SnapshotCleanupTask",
        "{1D227634-9921-42C5-8C37-A98EEA14C900}",
        "System partition is not in a space",
        "ControlSet%03d",
        "XPShP",
        "Execute.RollbackOnlineUser",
        "class CProfileInfo *&__thiscall UnBCL::ArrayList<class CProfileInfo *>::get_Item(int)",
        "ERROR_CLUSTER_NETWORK_NOT_FOUND_FOR_IP",
        "void __thiscall UnBCL::ArrayList<struct PartitionLayoutArgs *>::Resize(int,int)",
        ".?AVCElementEnumerator@@",
        "CFastDeleteImplT<class CDirectoryProviderT<class CWindowsOldAdaptor>,1>::MoveToScratch Failed to move [%s] to Scratch directory. status: %x",
        "Configure boot command for auto-unlock",
        "MigStartupOnline",
        "SPLogAntiVirusInfo",
        "ERROR_CLUSTER_INVALID_STRING_TERMINATION",
        "WdsCliGetWimImageReferenceFile",
        ".?AVSmPlatformDiskEnumerator@@",
        "int __thiscall UnBCL::Array<class OSRollbackService::CCheckpoint *>::Add(class OSRollbackService::CCheckpoint *)",
        ".PAVCXXXXXTemp@?N@??QueueOCReplication@CNewSystem@@UAEJW4SP_ERROR_HANDLING@SetupPlatform@@@Z@",
        "3'3C3K3T3Z3o3{3",
        "0m0s0",
        "ERROR_WINDOW_NOT_DIALOG",
        "SL_E_SRV_INVALID_PUBLISH_LICENSE",
        "5;5G5R5`5",
        "?GetValueNames@RegistryKey@UnBCL@@QAEPAV?$Array@PAVString@UnBCL@@@2@XZ",
        "4o4v4",
        ";T$$v",
        ".?AVCXXXXXHandledException@?2??DoExecute@CEnableTracingForImage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "8%868>8D8Q8c8v8",
        "4D5b5",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable<class UnBCL::String *,int>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "LoadFilterLibPointers",
        "K0S0d0l0v0",
        "CSetupPlatform::CreateNewSystem: Platform directory %s does not exist",
        ".?AVCXXXXXHandledException@?M@??UnpackTo@CDUPackage@@UAEJPBG@Z@",
        "WIM file is on the OS volume but we have a scratch directory, moving it there.",
        "Copy files and folders",
        "struct IMigRegistryInfo *__thiscall CARPValidator::GetRegInfo(struct IMigRegistryAccess *,class UnBCL::String *)",
        "HARDRESERVETRACK: Capacity   : %I64u",
        "Attempting to find and unload hive %s (%s)",
        "?Clone@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEPAVObject@2@XZ",
        "6$6-6:6A6J6R6_6f6p6",
        "(%lx): Unable to enable privilege [%u]!",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *> *,int,int)",
        "0#000B0P0t0",
        ".?AV?$Array@W4OP_OPERATION_ID@@@UnBCL@@",
        "5L5m5",
        "ACL mismatch detected, will initialize key",
        "8,8=8N8X8",
        "    Failed to enumerate elements",
        ":/:I:]:d:o:v:",
        "%ProgramFiles(X86)%",
        ".?AVCCryptoUtil@OC@@",
        "StateStoreInsertMountedImage",
        "class CSimpleCleanup::CCleanupEntry **__thiscall UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *>::GetBuffer(int)",
        "7Q8j8o8",
        "Get Upgrade snapshot policy Onesetting %d",
        "OSRollbackService::CSetupRollbackService::RollbackExecuteSequence",
        ".?AVDirectoryHiveUnloader@@",
        "SQMAvailableFreeSpace",
        "3!343J3Q3W3\\3g3t3",
        "Download Feature-On-Demand Dynamic Updates",
        "5o6u6{6",
        "8 848D8I8z8",
        "- Start Type: %u",
        ":$:4:D:T:d:t:",
        "SendMessageW",
        "Processing path: %s",
        "void __thiscall UnBCL::Array<struct _GUID>::Insert(int,struct _GUID)",
        "SL_E_MISMATCHED_PID",
        "uC9XXu",
        "%hs: Error while creating the OOBE key: 0x%08X",
        "<,=9=G=Q=[=e=o=|=",
        "__thiscall UnBCL::ArrayList<class CFileCreationData *>::ArrayList(const struct UnBCL::ICollection<class CFileCreationData *> *)",
        "%hs:Promoted the newly created store file to the system BCD Store",
        "485E5]5",
        "int __thiscall OC::COCCbsAdapter::GetOCsInPackage(class UnBCL::String *,class UnBCL::SmartPtr<class OC::COCCollection> &)",
        "System32\\Licenses\\%s\\%s\\%s\\%s",
        "VdsDisk::CreatePartition: Can't copy disk path (0x%08x)",
        "1 1$1(1,10181<1D1H1P1X1\\1d1h1l1p1t1x1",
        "<\"<3<=<G<[<",
        "FWTYPE",
        "SmVolume::InitializeProperties: Can't query allocation unit (0x%08x)",
        ";*;7;",
        "QPWSRh",
        "SecondBootTime",
        "ERROR_METAFILE_NOT_SUPPORTED",
        ":.;Q;j;",
        "Failed setting Edition: %ws as staged.",
        "Vj!j?",
        ";$;4;D;T;d;h;x;|;",
        "22282H2c2i2",
        "xForceTaskDeleteSnapshot",
        "%hs: OS partition extended",
        "D$TSP",
        "ZwClose",
        ";/;8;A;X;b;p;",
        "CSetupPlatformOSSwitchCheckpoint::Rollback: Deleting of \"%s\" directory failed.",
        "; ;6;K;a;",
        ".?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@",
        ":#;U;",
        "CAddProvisioningPackage::DoExecute: Failed to initialize COM. hr = 0x%08X",
        "ERROR_LOG_SPACE_RESERVED_INVALID",
        "VShPC",
        "SP_SECONDBOOT_INFO",
        "WSh0C",
        "xFailed to delete boot entry 0x%x. Status: %x",
        "ResExtract",
        "5&5:5F5N5T5Y5h5",
        ".?AU?$ICollection@PAVCOperationsValidator@@@UnBCL@@",
        "(%lx): Failed to create destination key [%ws].",
        "-0M0j0t0",
        "8!8*8C8L8U8_8k8t8",
        "51585>5G5R5^5j5v5",
        "%hs: Cannot read main WIM image index. Error: 0x%08X",
        ";\";,;;;D;J;W;];b;s;~;",
        "D$0SVW3",
        "2!242@2",
        "5*595X5_5e5q5}5",
        "%hs: Invalid parameter provided",
        "Persisting diagnostics data fails since DataFile is null",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAVMultiSz@2@@UnBCL@@@UnBCL@@@UnBCL@@",
        ".?AVCXXXXXHandledException@?2??SPTaskRemoveSnapshot@@YGJXZ@",
        "RtlGetCompressionWorkSpaceSize",
        "void __thiscall UnBCL::ArrayList<struct DiskLayout::Partition>::set_Item(int,struct DiskLayout::Partition)",
        "ControlSet%03u\\Services\\%s",
        "RollbackSetCheckpoint: Rollback hasn't yet been initialized (for this boot)",
        "pFindOEMInf",
        "void __thiscall UnBCL::Array<class OC::CCmdLineExecutionTelemetryData *>::Insert(int,class OC::CCmdLineExecutionTelemetryData *)",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::Resize(int,int)",
        "ERROR_SXS_ASSEMBLY_NOT_FOUND",
        "VdsVolume::RemoveDriveLetter: Failed to delete volume access path [%s] (0x%08x)",
        "SmDisk::CreatePartition: Can't find the partition that was just created",
        "=3=A=Y=}=",
        "u jfh",
        "=(>t>",
        "Service %s was already running.",
        "class CProfileInfo **__thiscall UnBCL::ArrayList<class CProfileInfo *>::GetBuffer(int)",
        ".?AV?$SerializableBase@VCAddDriver@@$0A@V?$DefaultInstanceFactory@VCAddDriver@@@UnBCL@@@UnBCL@@",
        "First boot apply",
        ".?AVOCException@OC@@",
        "%hs: Unexpected image state %s.",
        "ERROR_DEV_NOT_EXIST",
        "t5Qj2PPPPP",
        "040D0i0U1{1",
        "UtilBuildEndpoint",
        ".?AV?$SmartPtr@VXmlSchemaSet@UnBCL@@@UnBCL@@",
        ":+:9:E:M:T:h:z:",
        "class CAppInfo *const &__thiscall UnBCL::ArrayList<class CAppInfo *>::get_Item(int) const",
        "SetupPlatform: Global progress: %u, Phase progress: %u",
        ".?AV?$CAutoCleanupBase@PAPAG@RAII@@",
        ".PAVCXXXXXTemp@?BB@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "DiskInitialize: Failed to read disk properties (0x%08x)",
        ":p;w;};",
        "j?[f;",
        "CSetupPlatformTracing::StartKernelModeTracing",
        "CreateThread",
        "Removing duplicate entries.",
        "0U0m0",
        ";2;@;E;f;k;w;",
        "1\"1/1;1B1H1M1Y1f1l1",
        "int __thiscall UnBCL::ArrayList<class COperation *>::LastIndexOf(class COperation *,int,int) const",
        "Property value is an array; will return the first item.",
        "fSfPfQfVfW",
        "After sorting, components will be excuted in the following order:",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *> *)",
        "OpenServiceW",
        "void __thiscall UnBCL::ArrayList<class CPartitionInfo *>::Resize(int,int)",
        "StateStoreGetMountedImagePathId",
        "ERROR_DS_CANT_RETRIEVE_INSTANCE",
        "The last modified time of file [%s] has changed from [%d::%d] to [%d::%d]",
        "RPC_S_UNSUPPORTED_AUTHN_LEVEL",
        "ZwOpenKey",
        "Cannot get an actual path for ID: %s. Skipping registration.",
        "struct SetupPlatform::IPartition *const *__thiscall UnBCL::ArrayList<struct SetupPlatform::IPartition *>::GetBuffer(int) const",
        "SPInitializeCOM",
        ".PAVCXXXXXTemp@?3??SPShrinkPartition@@YGJH_K0@Z@",
        ".?AU?$IEnumerable@PAVCGlobalPathFindData@@@UnBCL@@",
        "SPLEVEL",
        "RtlNtStatusToDosError",
        ".?AVCFailForwardSystem@@",
        "|SYSPART|\\|DEST|\\BCD",
        ":(:0:H:`:",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::RemoveAt(int)",
        "LastCrashDumpInfo: BugcheckBootId %u",
        "QueueDriverMigration called for fail-forward system %s, Boot critical only: %s",
        "=:>d>",
        "ERROR_DISK_TOO_FRAGMENTED",
        "void __thiscall UnBCL::Array<class ISPPluginData *>::Insert(int,class ISPPluginData *)",
        "y0Vh[",
        "2'2,262Q2V2`2",
        "6$6,666=6C6H6S6_6s6",
        "4SVWQ",
        ";J<[<b<h<m<x<",
        "=\"=J=u=",
        "CApplyDrivers::DoExecute: Failed to get enumerator for paths to delete",
        "; ;%;.;J;Q;X;c;p;",
        "SPAPI_E_NO_DEVICE_ICON",
        "void __thiscall UnBCL::ArrayList<unsigned int>::set_Item(int,unsigned int)",
        "LayNtBootCode: Error allocating memory to overwrite boot sector!",
        "<&<,<9<K<Y<z<",
        "Failed to backup corrupt BCD store. Status = [%x]",
        "3&3.353C3S3g3o3v3",
        "646;6A6F6Q6]6q6",
        "?get_OSVersion@OperatingSystem@UnBCL@@QBEPBVVersion@2@XZ",
        ">+>9>",
        "<unknown>",
        "%public%",
        "\\wcp.dll",
        "6!6D6",
        ";&;3;;;M;U;a;i;u;~;",
        "7#7+7?7O7W7k7{7",
        "Sources\\Diagnostics",
        "ERROR_NO_TRACKING_SERVICE",
        "StateStoreGetMountedImageStatus",
        "void __thiscall UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *>::AddRange(const struct UnBCL::ICollection<class CDeviceIdDatabase::CDeviceInfoData *> *)",
        "void __thiscall UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::Insert(int,struct SPGetPartitionOrdinal::PartitionInfo)",
        "9 :K:v:",
        "Try to merge diagnostics data from default new system data file",
        "CMergeWIM::DoExecute: Cannot set temp path for target WIM. Error: 0x%x",
        ";9;Q;~;",
        "<path unavailable>",
        "                                   VM: %s",
        "TOTALBYTES",
        ".?AV?$DefaultInstanceFactory@VCAddProvisioningPackage@@@UnBCL@@",
        "FirstBootTel-M2.etl",
        "Simulating source as a compact OS due to environment variable",
        "void __thiscall UnBCL::ArrayList<struct PageFileDesc *>::Resize(int,int)",
        "0!050@0L0^0f0s0",
        "4%5a5s5{5",
        "?Nullify@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV12@XZ",
        "ServiceDebuggerFiles: %ws does not exist",
        ":+:^:",
        "GetSystemTime",
        "9*9x9",
        "ServiceSpaces: Failed to create path %s. Last error = %#x",
        "4 4(444T4\\4d4p4",
        "<Q<e<n<u<",
        "1-1B1J1P1]1o1",
        "WorkingDir",
        ".?AV?$SerializableBase@VCApplyBCDSettings@@$0A@V?$DefaultInstanceFactory@VCApplyBCDSettings@@@UnBCL@@@UnBCL@@",
        "5(555G5O5^5f5m5t5",
        ">8>P>",
        "JET_errIndexTuplesInvalidLimits",
        "%hs: Failed to convert dos path to NT path for system BCD store and firmware setting won't be saved for rollback.",
        "CAddCbsPackage::DoExecute: Failed to add package %s. Error: 0x%08X",
        "ERROR_DS_NO_RESULTS_RETURNED",
        "%s\\System32\\DriverStore\\FileRepository\\%s",
        "y6Vhj",
        "=<=N=V=\\=i={=",
        ".?AV?$CAutoCleanupBase@PAUIDUUpdate@DU@@@RAII@@",
        "CSetupPlatformPrivate::MoveTelemetry: No telemetry to move",
        "3+3K3",
        "Copy unattend payload from %s to %s",
        "%hs: BCD failed to set new OS boot entry as default. Error: 0x%08X",
        "7\"8)8/848?8J8^8",
        "class UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *> *__stdcall UnBCL::Try_Cast<classUnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "0(0<0P0d0x0",
        ".PAVCXXXXXHandledException@?2??SPCreateFile@@YGJPAVString@UnBCL@@K0H@Z@",
        "94989P9T9l9p9",
        "ERROR_LOG_RECORD_NONEXISTENT",
        "34f268b4-7e2d-40e1-8966-8bb6ea3dad27",
        "6.6C6R6\\6a6i6p6|6",
        "373B3",
        "Disk space needed   : %I64d",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@",
        "IsDiskOnXHCI: SetupDiGetClassDevs failed. Error = 0x%X.",
        "3*3:3Q3X3j3{3",
        ".?AU?$IDictionaryEnumerator@PAVString@UnBCL@@W4ActionType@@@UnBCL@@",
        "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\LOWPART",
        "WimEnterCriticalSectionWithLazyInitialization",
        ">->9>G>s>",
        "t$$9t$ vb",
        "72797T7p7",
        "SPRecordOSFootprint",
        "0+1R1",
        ":$:;:f:",
        "JET_errPrimaryIndexCorrupted",
        "6.6T6[6a6f6q6|6",
        "D$`SVW",
        ";-;N;o;",
        "RPC_S_NO_BINDINGS",
        "SPAddSpace",
        "1B1S1",
        ".?AVCStoredString@@",
        "\\$(9\\",
        "0#0+01060J0Q0`0n0u0|0",
        "int __stdcall UnBCL::MP::OperatorCompare<enum OP_EXECUTION_PHASE>::Compare(enum OP_EXECUTION_PHASE,enum OP_EXECUTION_PHASE)",
        ";\";6;B;];",
        ":#:2:<:A:I:P:\\:n:",
        "1-1B1Y1c1w1~1",
        "=.=i=p=v={=",
        "4D4X4k4w4",
        "?4?S?w?",
        "171Z1",
        "SSh @",
        "7+8@8f8{8",
        "StringCchCopyN failed",
        "PWhh0",
        "Failed to mark system store. File: %ws Status: %x",
        "8#828<8A8I8P8\\8n8",
        "void __thiscall UnBCL::ArrayList<class OSRollbackService::CCheckpoint *>::AddRange(const struct UnBCL::ICollection<class OSRollbackService::CCheckpoint *> *)",
        "setupapi.ev2",
        "4L6S6",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::set_Item(int,class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *)",
        "The source image size is %I64u bytes; will split it",
        "CRYPT_E_CONTROL_TYPE",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::Insert(int,class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *)",
        ".?AV?$CAutoComFree@PAU_VDS_DISK_EXTENT@@@RAII@@",
        "SpaceNeeded",
        "?0?U?w?",
        "9{ tS",
        ".PAVCXXXXXTemp@?N@??SPDeleteOldUpgradeSnapshots@@YGJPAVString@UnBCL@@PAUITelemetry@@PBGHPAPAV23@PAU_FILETIME@@PA_J@Z@",
        "SPAPI_E_INVALID_CLASS",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@ABV01@@Z",
        "CSVVWh",
        "1#1)1.191D1X1`1|1",
        "Failed to copy string.",
        "CAddProvisioningPackage::DoExecute: Failed to create or open package locations key %s: 0x%08x",
        "2%3H3e3",
        "?IndexOf@String@UnBCL@@QBEHGH@Z",
        "void __thiscall UnBCL::Array<struct DISK_SPACE_IMPACT>::Insert(int,struct DISK_SPACE_IMPACT)",
        "Verbose: Processing non-OS WIM file: %s",
        "CSetupAutomation::GetImageInfoSet",
        "PidGenX",
        ";2t]A",
        "4$4)444A4I4P4U4i4t4",
        "= =(=4=T=\\=d=l=t=",
        "51686>6C6K6S6g6",
        "A<Au%",
        "class OSRollbackService::CCheckpoint *const *__thiscall UnBCL::ArrayList<class OSRollbackService::CCheckpoint *>::GetBuffer(int) const",
        "9&909=9B9K9\\9c9m9z9",
        "PartitionStyle",
        "9C9k9",
        "2\"2+2=2G2P2Y2b2k2t2",
        "SETUPPLATFORMEXE: Error connecting to the progress pipe. Error: 0x%08X",
        ".?AU?$IList@PAV?$DictionaryEntry@PAVString@UnBCL@@J@UnBCL@@@UnBCL@@",
        "|$4tG",
        "6\\6r6",
        "ERROR_INVALID_QUOTA_LOWER",
        ": :$:(:,:0:8:P:T:l:p:",
        "7j7y7",
        "7 8*878=8D8N8[8b8l8}8",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class SysprepAction *>::Reset(void)",
        "8+8=8K8z8",
        "CSetupPlatformPrivate::RollbackOnlineUsr",
        "<V=n=",
        "                                   Model : %s",
        "Downloading dynamic updates",
        "COperationQueue::GetDiskSpaceNeeded: Failed to query hard reserve info",
        "SOURCE",
        "8\"8/868C8[8h8o8|8",
        "6(737}7",
        "ApplyEA",
        "int __thiscall UnBCL::ArrayList<struct DiskRange>::LastIndexOf(struct DiskRange,int,int) const",
        "737H7P7V7c7u7",
        "WVhP$",
        "9@9p9",
        ">*>8>A>J>S>i>w>",
        "N0L0J",
        "SKIPBOOTTRACK(SAFEOS): Got SafeOS boot removal OneSetting: %s",
        "252w2",
        "VdsVolume::Mount",
        "Set to unified progress",
        "9#999`9h9o9}9",
        "x$MFT",
        "SetupDUUpdateFiles: Target directory [%s] does not exist.",
        "Deserialize/Execute pre-OOBE operations failed",
        "RunPlatformActions",
        ":):S:Z:`:e:p:z:",
        "4#4.484K4S4",
        "ControlSet001\\Services\\WinSetupBoot",
        "8)8;8C8I8]8c8l8",
        "6!6&616;6O6",
        "JET_errFileNotFound",
        "EtwEventWrite",
        "ERROR_TOO_MANY_SESS",
        ".?AVCEnableNetDebugging@@",
        ":$:,:4:<:D:\\:d:l:t:|:",
        ":+:D:O:a:h:n:s:~:",
        "CrashDumpEnabled",
        "u&htu",
        "7(7<7P7d7x7",
        "(%lx): Failed to process value [%.*ws]",
        "9&9E9S9]9t9",
        "CMediaLayout::QueueFileCopy: File not found: %s",
        "ERROR_SEM_NOT_FOUND",
        "=8=@=d=p=",
        "2%2@2J2T2Z2h2",
        "INSTALL.SWM",
        "ERROR_NO_SCROLLBARS",
        ";);=;D;J;O;Z;e;};",
        "3 313:3a3r3z3",
        "VdsPartition::Delete: Couldn't get disk object (0x%08x)",
        "8#929p9",
        "JET_errMultiValuedDuplicate",
        "pGetResultCode",
        "t)j\\V",
        "SetFocus",
        "ERROR_WOW_ASSERTION",
        "3C3f3|3",
        "class CDeploymentBase *__thiscall UnBCL::_::ArrayListEnumerator<class CDeploymentBase *>::get_Current(void) const",
        "0 0%000:0G0N0T0Y0d0n0",
        "Attempting to remove target folder%s: %s",
        "Connected standby    : %s",
        "2(323?3E3L3V3c3j3t3",
        "MSFT_StoragePoolToVirtualDisk",
        "kttj0",
        "DEVICE ID MATCH",
        "SetupDUUpdateFiles: Target directory [%s] should be empty in the presence of reference directory [%s].",
        "1/3z3",
        "GatherDeviceIDsInDriverPackage:Driver package path is [%s]",
        "SPReserveMoveInternal: Failed to move child [%s] to [%d]. hr = 0x%08X",
        "6*6>6",
        "7(8x8",
        "7,8B8",
        "|$8+D$4;D$T",
        "ERROR_BADKEY",
        "RpcCommRemoveImage",
        "3!4J4R4^4e4k4p4{4",
        "select * from %s",
        "PWVhf",
        "L$t_^[3",
        "SETUP\\SETUPCL",
        "='=1=:=D=M=d=r={=",
        "File is not system store. File: %ws Status: %x",
        "4 4*434=4F4P4Y4k4u4",
        ">%>8>f>|>",
        "DriverPackageClose",
        "4L4u4",
        "%s (%s)",
        "WVhx+",
        ".?AV?$CAutoCleanupBase@PAD@RAII@@",
        ";+<6<`<",
        ".?AV?$DefaultInstanceFactory@VCRelocateWinReImage@@@UnBCL@@",
        "CSetupPlatform::CreateNewSystem: Failed to initialize uplevel platform info from %s. hr = 0X%x",
        "20282H2P2l2",
        "Current retrieved on enumerator before MoveNext()",
        "??C?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBEPAVVersion@1@XZ",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,&protected: static struct UnBCL::ISerializable * __stdcall UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,class ATL::CElementTraits<struct UnBCL::ISerializable *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *> *,class UnBCL::Array<struct UnBCL::ISerializable *> *,int)",
        "class CImageInfo *const &__thiscall UnBCL::ArrayList<class CImageInfo *>::get_Item(int) const",
        ".?AV?$HTDictEnumBase@PAVCWIMEntryIndex@CWIMBootHelper@@@_@UnBCL@@",
        "=(=0=6=G=Y=n=v=|=",
        "CApplyDataOffline::ProcessJournalEntries",
        "void __thiscall UnBCL::ArrayList<class CAntiVirusInfo *>::QuickSort(class UnBCL::ArrayList<class CAntiVirusInfo *> *,class UnBCL::ArrayList<class CAntiVirusInfo *> *,int,int)",
        "CreateCustomPartition: Failed to set partition type to %s (0x%08x)",
        "3>3g3r3w3",
        ";A u3",
        "ERROR_DS_ATTRIBUTE_OR_VALUE_EXISTS",
        "1#1*10151@1K1Z1a1j1o1z1",
        "ERROR_CLUSTER_PARTIAL_WRITE",
        "0%0.070@0I0R0[0d0m0v0",
        "RegisterRemovedDriver: Invalid arguments",
        "VdsDisk::InitializeProperties",
        "<8<?<F<Q<c<k<q<",
        "\\Microsoft\\Windows\\Setup",
        "101=1F1W1c1",
        "fPfVfXf^f;",
        "PRRRQ",
        "FOD Validator: New installed package or feature apeared, will invalidate OC gather operation",
        "long __thiscall CMoveWIMBootEntriesAndPartition::DoExecute(struct IExecutionContext *,void *,struct IInternalOperationsProgress *)",
        "ERROR_DBG_EXCEPTION_HANDLED",
        "JET_errRecoveredWithoutUndoDatabasesConsistent",
        "ImageCreate",
        "0$0,040<0D0L0T0`0",
        ":%:=:z:",
        "9#9.999M9Y9",
        "OrchestrateStartSystemServices: Unable to create/open event that signals autostart services have started; hr = 0x%x",
        "void __thiscall CSetupPlatformPrivate::DoCommunication(void)",
        "2\"3E3T3[3a3f3q3{3",
        "SWh P",
        "?(?:?B?H?Z?n?{?",
        "6>6E6J6P6V6\\6b6h6n6t6z6",
        "ERROR_LOG_FULL",
        "JET_errRfsFailure",
        "CEnableSafeOSPageFile::EstimateDiskSpaceImpact: Failed to get physical memory installed on this system: 0x%08x",
        "CSetupPlatformPrivate::RollbackOnlineUsr: Downlevel OS still hasn't rebooted. Re-register Rollback-Online and Exit.",
        ".?AVWmiArray@WMI@@",
        "?8?`?g?m?r?}?",
        "bg-BG",
        "JET_errPageBoundary",
        "HZo6m|",
        "memmove",
        "8\"898J8c8x8~8",
        "CSetupPlatform::CreateNewSystem: Insufficient information to create new system. hr = 0X%x",
        ">#>0><>E>Q>V>_>f>s>",
        ";E;q;",
        "Failed to get Force Task Delete Snapshot, 0x%x",
        "   Registry: %d",
        ":1;F;",
        "ERROR_REQUEST_REFUSED",
        "2;3\\3d3",
        ".?AV?$CAutoCleanupBase@PAVVdsVolumePathEnumerator@@@RAII@@",
        "AllowUninstall value found in the registry, will enable if rollback is active",
        "ERROR_DATA_NOT_ACCEPTED",
        "j;jbj:j",
        "_WSWf",
        "OpenExistingOfflineStore",
        "SmPartition::GetProperties: Failed to initialize properties (0x%08x)",
        "7)797E7S7f7r7~7",
        ".?AV?$SerializableBase@VCAddSetupClRequest@@$0A@V?$DefaultInstanceFactory@VCAddSetupClRequest@@@UnBCL@@@UnBCL@@",
        "void __thiscall UnBCL::Array<class SysprepComponent *>::Insert(int,class SysprepComponent *)",
        "6$6(686<6L6P6`6d6t6x6",
        "=6=B=i=o=u={=",
        "1E2[2",
        "Failed to open file \"%s\" for \"%s\" checkpoint.",
        ".PAVCXXXXXHandledException@?2??MakeBcdDeviceObject@CAddSafeOSBootEntry@@IAEJKPBG0PAU_GUID@@PAPAU_BCDE_DEVICE@@PAK@Z@",
        ".PAVCXXXXXHandledException@?2??pSPCountMigUnitEvents@@YGIPAUIMigUnitNavigator@@HHH@Z@",
        "strchr",
        "4+4F4d4",
        "void __thiscall UnBCL::ArrayList<class COperationResult *>::AddRange(const struct UnBCL::ICollection<class COperationResult *> *)",
        "QueryServiceConfigW",
        "?CreateDir@Directory@UnBCL@@SGPAVDirectoryInfo@2@PBVString@2@@Z",
        "G8t0j",
        "0*111",
        "SPGetWIMImageInfo: Failed to load software hive from temporary location. Error: 0x%08X",
        "UuidToString failed with error: 0x%08X",
        "ERROR_INVALID_SEGMENT_NUMBER",
        "2%2=2_2y2",
        "989N9t9~9",
        ">Y?o?",
        "??_D?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAEXXZ",
        "SPCleanupInstallationDrive: Cleaning up %s",
        "int __thiscall UnBCL::_::ArrayListEnumerator<struct SetupPlatform::IPartition *>::MoveNext(void)",
        "fr-CD",
        ".?AV?$CAutoRelease@PAUIRollback@@@Mig@@",
        "5;5B5I5T5f5",
        "fat32",
        ";);=;E;U;g;",
        "707H7i7",
        "2(2/2C2Y2",
        "  Volume Snapshots = %s",
        "6 717F7s7",
        "172<2A2K2c2h2",
        "SclpWdsNativeLibLogCallback",
        "<1<G<O<q<",
        "Apply statistics (first boot apply, offline phase):",
        "8\"848B8P8^8l8z8",
        "7?7L7",
        ";0;8;>;K;];",
        "j:j)j",
        "1$11181M1T1Z1f1",
        "PSh@n",
        "2O3[3v3}3",
        "{C4578D62-F787-4818-BBCD-AF8A4C439D25}",
        "0*1?1e1z1",
        "1(1?1M1T1Z1_1j1w1",
        "383x3",
        "Failed to get image information for existent system %s. Error: 0x%08X",
        "ServicingBootFiles failed. Error = %#x",
        "class UnBCL::String *__thiscall OSRollbackService::CCheckpointImpressario::ReadCheckpoint(const unsigned short *)",
        "5Y5w5",
        "0.0Y0",
        "4+4<4S4_4p4",
        "CAddCbsPackage::DoExecute: Image health check not supported; skipping due to operation configuration.",
        ".?AV?$SmartPtr@V?$ArrayList@UDISK_SPACE_IMPACT@@@UnBCL@@@UnBCL@@",
        "BiExportStoreAlterationsToEfi failed %x",
        "0$0-0E0p0u0",
        "0E0K0X0c0|0",
        "9_$v$",
        "ControlTrace(update) failed: 0x%x",
        "Applying WIM file: %s, index %d%s%s, to %s. Work dir: %s",
        "2f;1u",
        "9&9,919<9C9W9",
        "<Q<V<[<g<",
        "CbsCoreFinalize",
        "??1Exception@UnBCL@@UAE@XZ",
        "2%2O2Y2",
        "1 171u1",
        "CNewSystem::Finalize",
        "class CRegCreationData *__stdcall UnBCL::Try_Cast<classCRegCreationData*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "%hs: Cannot load the system hive for the offline OS %s. Error: 0x%08X",
        "3'3;3B3H3M3X3c3w3",
        "SmDisk::InitializeProperties: Couldn't determine whether USB controller is xHCI (0x%08x)",
        "OC Validator: Ignoring validator failure due to environment variable.",
        "XSafeOSHash",
        "ERROR_CTX_WINSTATIONS_DISABLED",
        "ignoreFailureToStopDependentService",
        "0%1@1Q1f1n1t1",
        "Existing OS cannot expand %%windir%%, will not queue early apply",
        "ERROR_IPSEC_IKE_UNKNOWN_DOI",
        "%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
        "RQhLO",
        "!E\\H4",
        "No instance of filter driver was found on volume %s",
        "$OFFLINE_RW$%s",
        "?Substring@String@UnBCL@@QBEPAV12@H@Z",
        ".?AV?$SerializableArrayBase@_J@_@UnBCL@@",
        "ERROR_DS_MAX_OBJ_SIZE_EXCEEDED",
        ".PAVCXXXXXTemp@?FD@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "void __thiscall UnBCL::Array<class SysprepAction *>::InitLarva(class UnBCL::ArrayList<class SysprepAction *> *)",
        "3&30373C3H3S3_3e3y3",
        "VdsPartition::Format: Failed to query IID_IVdsDiskPartitionMF interface [%s] (0x%08x)",
        ".?AV?$SmartPtr@V?$ArrayList@I@UnBCL@@@UnBCL@@",
        "t+PRh",
        "575I5",
        "8\"8.8:8U8a8m8y8",
        "ERROR_DYNLINK_FROM_INVALID_RING",
        "Will free",
        "void __thiscall UnBCL::_::HTEnumerator<enum OP_OPERATION_ID,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,enum OP_OPERATION_ID,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,&protected: static enum OP_OPERATION_ID __stdcall UnBCL::Hashtable<enum OP_OPERATION_ID,int>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::Reset(void)",
        "<!<4<A<I<Q<W<]<i<}<",
        "Opening official provisioning package: %s",
        "int __thiscall UnBCL::ArrayList<class CCopyInfo *>::BinarySearch(int,int,class CCopyInfo *,struct UnBCL::IComparer<class CCopyInfo *> *)",
        "JET_errInvalidTableId",
        "2@2R2Z2`2m2",
        ".PAVCXXXXXTemp@?CCJ@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "Adding mapping from %s to %s",
        "777P7h7m7x7",
        "=?=F=O=T=c=n=y=",
        "_DismAddPackage2",
        ".PAVCXXXXXTemp@?3??DoExecute@CExtractFilesFromWDSImage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "??6SerializationStream@UnBCL@@QAEAAV01@I@Z",
        "4#4)484O4W4^4w4}4",
        "<l=u=",
        "6#6B6n6w6",
        "??0StringPtr@UnBCL@@QAE@PAVString@1@@Z",
        ":9:g:m:|:",
        "8$818C8S8n8s8",
        ".PAVCXXXXXTemp@?3??SPApplyCustomDiskConfig@@YGJPAUIWpxDeplInsSettings@@W4_FIRMWARE_TYPE@@PAUIDiskPlatform@@PAX@Z@",
        "Failed to backup the statup type for service. Error: 0x%08X",
        "1&1:1K1j1",
        "Processing %ws",
        "383@3Z3a3g3l3w3",
        "%hs: Uninstall requested but rollback is not configured properly",
        "0$0(080<0L0P0T0X0\\0d0h0l0t0x0",
        "4!4)4?4F4L4Q4\\4l4|4",
        "bOfflineRan",
        "ERROR_INVALID_FILTER_PROC",
        "ha-Latn-NG",
        "8+9b9y9",
        "  KB Article ID #%d: %s",
        "%hs: Failed to delete %s. Error: 0x%08X",
        "Successfully removed WIMBoot WIM files on the OS partition",
        "9Q:Z:_:o:",
        "3$3@3F3L3\\3s3",
        "auto __thiscall ForEachVolume::<lambda_8bca54f81f488911d5b6188bc7acb381>::operator ()(struct SetupPlatform::IPartition *,SetupPlatform::PARTITION_PROPERTIES *const ) const",
        "8#8_8t8",
        "0)080>0O0f0",
        "6\"6'626=6B6V6|6",
        ">&>C>g>",
        "5)575E5S5",
        "RPC_S_PROTSEQ_NOT_FOUND",
        "7$7G7U7^7u7",
        "Copy HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\[EditionID] value from old windows",
        "sFirstBootPhaseStartTime",
        ".?AU?$ICollection@PAVCAppInfo@@@UnBCL@@",
        "CERT_E_REVOKED",
        "6$626@6v6",
        "=!='=;=J=U=\\=g=v=",
        "<#<2<_<l<s<",
        "Sh<Z`",
        "6@6Z6s6}6",
        "jdXPSPS",
        "<t<g?",
        "CSplitWIM::DoExecute: Cannot register WIM callback. Error: 0x%x",
        "SPTurnOffStorageReserve: Failed to get Update Reserve manager. hr = 0x%08X",
        "?&?;?X?i?u?",
        "ERROR_NOT_SUBSTED",
        "pDeterminePageFileRequirements: Will need additional memory for image apply phase",
        "9!929G9e9y9",
        "<!<8<H<T<d<l<r<x<",
        "int __thiscall UnBCL::ArrayList<class COperationResult *>::IndexOf(class COperationResult *,int,int) const",
        "ERROR_NOT_SUPPORTED_ON_SBS",
        "ucj-Yf9L0:",
        "=J=n=",
        "CNewSystem::QueueDisableFeature",
        "Wj jf",
        "=\"=,=@=M=a=o=",
        "4.4D4U4]4f4n4t4",
        "RtlIsStateSeparationEnabled",
        ".?AU?$IEnumerator@PAVCFilterDriverInfo@@@UnBCL@@",
        ".?AV?$CAutoDelete@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@@RAII@@",
        "8$8*838O8b8t8|8",
        "2C2S2",
        "VdsPlatformDiskEnumerator::ReleaseObjects: Found unmatched vdisk image object for attached VHD: disk number is %u",
        "0\"0Z0",
        "CBS_E_REESTABLISH_SESSION",
        "7-7:7G7V7q7{7",
        ")\\\\.\\PHYSICALDRIVE%u",
        "141X1",
        "ERROR_SXS_MANIFEST_FORMAT_ERROR",
        "041^1",
        "GetVolumePathNameW",
        "7!757M7[7k7r7x7}7",
        ":%;=;",
        "Failed to unload %s, this is most likely a registry leak from the transformer layer",
        "void __thiscall UnBCL::Array<class CImageInfo *>::InitLarva(class UnBCL::ArrayList<class CImageInfo *> *)",
        ".?AV?$SerializableBase@V?$ArrayList@I@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@I@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "<O=?>j?",
        "Extracted Active dump",
        "The system store is not already loaded",
        "void __thiscall UnBCL::ArrayList<class CShellFolderInfo *>::CopyTo(class UnBCL::Array<class CShellFolderInfo *> *,int) const",
        "void __thiscall UnBCL::Array<class OSRollbackService::CCheckpoint *>::RemoveAt(int)",
        ";0<[<`<",
        "0#0@0E0r0",
        "Rollback-Online-Common completed with error: 0x%08X",
        "0,020=0K0w0",
        "j0Sh`$d",
        "base\\ntsetup\\SetupPlatform\\lib\\inc\\SetupPlatformP.h",
        ".BlockOperations",
        "Translation",
        "CSetupPlatform::MoveTelemetry: No telemetry to move",
        "ERROR_TOO_MANY_MODULES",
        "4-434H4N4_4f4k4t4{4",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *> *)",
        "ERROR_BAD_COMPRESSION_BUFFER",
        ">->4>:>?>J>U>Z>n>",
        ".?AV?$CAutoCleanupBase@PAVWmiObject@WMI@@@RAII@@",
        "1'1:1R1g1~1",
        "NTSTATUS Error",
        "4$40474=4C4O4\\4p4{4",
        ".?AV?$Array@PAVString@UnBCL@@@UnBCL@@",
        "?\"?@?E?J?U?",
        "(%lx): Failed to open key: [%ws]",
        "6C6R6",
        "7 7'7.7L7_7f7l7q7}7",
        "1'191Q1X1j1",
        "%hs: System state does not allow for such requests to be queued. Current state is %d",
        "ERROR_SXS_ASSEMBLY_MISSING",
        "ERROR_SXS_DUPLICATE_PROGID",
        "ERROR_RM_ALREADY_STARTED",
        "D$0Wj0Pj",
        "enum MIGSTATUS __stdcall SPDoEndInstallApply(class UnBCL::String *,enum SetupPlatform::SP_MIG_SCOPE,class UnBCL::String *,class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,struct ISPTelemetryData **,struct ISPMigProgress *)",
        "WinHttpCloseHandle",
        "6\"6K6S6`6q6|6",
        "void __thiscall UnBCL::Array<class CDriverDetails *>::RemoveAt(int)",
        "4*4O4\\4s4z4",
        ".?AV?$SmartPtr@U?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAUHKEY__@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "%hs: Failed to set BCDE_LIBRARY_TYPE_APPLICATION_PATH field. Status = %d",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *> *,int,int)",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *> *)",
        "ERROR_CANT_CREATE_MORE_STREAM_MINIVERSIONS",
        "RPC_S_DUPLICATE_ENDPOINT",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAH@Z",
        "5,5<5C5I5N5Y5i5}5",
        "?Remove@String@UnBCL@@QBEPAV12@HH@Z",
        "swprintf_s",
        "onecore\\base\\ntsetup\\lib\\narratorutil\\src\\narratorutil.cpp",
        "8)81888I8Q8X8j8r8y8",
        "class CCFGSectionValue *__stdcall UnBCL::Try_Cast<classCCFGSectionValue*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        ".?AV?$Array@PAVCAntiVirusInfo@@@UnBCL@@",
        "{2729B5F4-EFFB-418F-A1B8-674067ECBCD6}",
        "4P4X4b4i4o4t4",
        "SKIPBOOTTRACK(FIRST): Sysprep specialize offline is not supported in this environment; will not run it",
        "CExtractFilesFromWDSImage::DoExecute",
        "JET_errRfsNotArmed",
        "PSShH",
        "0)1B1p1",
        "DiskLayout::FindPartitionByOrdinal: Can't get disk properties: 0x%08x",
        "BootDriverFlags",
        "Backup",
        "3%3*353?3R3j3",
        "%hs: Failed to initialize rollback. Error: 0x%08X",
        "Removed drivers: Count: %u, Size: %I64u",
        "SmPartition::GetVolume: Couldn't get %s (0x%08x)",
        ">#>_>",
        "7*7C7g7t7",
        "<$<,<4<<<H<h<t<",
        "void __thiscall UnBCL::Array<class CGlobalPathFindData *>::Insert(int,class CGlobalPathFindData *)",
        "CriticalDU",
        "SPDeleteOldUpgradeSnapshots: Delete old Upgrade snapshot on %s",
        "ERROR_BAD_NETPATH",
        "IMAGE_STATE_NONE",
        "ERROR_OBJECT_NO_LONGER_EXISTS",
        ";.;R;Y;`;k;};",
        "ERROR_TRANSACTION_INVALID_MARSHALL_BUFFER",
        "zSVh\\",
        "ProfessionalN",
        "7?7Q7Y7_7l7~7",
        "Failed to remove element.",
        "5?5s5~5",
        "ReturnValue",
        "DiskLayout::VerifyPlanDiskBoundaries: The given layout exceeds the capacity of the disk",
        "9\"9(93999L9W9s9",
        "4&484?4E4J4U4c4v4",
        "ERROR_ALLOCATE_BUCKET",
        "GetModuleHandleExW",
        "11181?1F1M1T1Z1d1",
        "*040k0",
        "WINDOWS/LANGUAGES/DEFAULT",
        "%hs: Profile for %s(%s) has been moved. Expected regular profile in %s but found linked profile. Uninstall validation will fail.",
        "VdsPartition::CreateLogicalPartition: Couldn't refresh VDS service (0x%08x)",
        "<'<0<A<F<R<x<",
        ":(:9:F:O:V:`:q:~:",
        "3&32393?3E3P3Z3m3{3",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class ISPPluginData *>::MoveNext(void)",
        "2%22292K2Z2i2|2",
        "tCreate Initial snapshot",
        ".?AV?$SerializableBase@VCStoredString@@$0A@V?$DefaultInstanceFactory@VCStoredString@@@UnBCL@@@UnBCL@@",
        "Failed to delete file: %s. Error = %d",
        "const struct _GUID *__thiscall UnBCL::ArrayList<struct _GUID>::GetBuffer(int) const",
        "9F9k9",
        "void __thiscall UnBCL::ArrayList<class SysprepAction *>::Resize(int,int)",
        ">$>*>4>X>_>s>",
        "6L6^6f6l6y6",
        "%windir%\\panther",
        "void __thiscall UnBCL::ArrayList<class CPartitionInfo *>::AddRange(const struct UnBCL::ICollection<class CPartitionInfo *> *)",
        "SclCreateKey failed to open child key [%.*ws], returning STATUS_ACCESS_DENIED; will try with lowered access rights",
        "Policy: Suspend only if protection cannot be kept active",
        "0\"0(0-080B0J0T0\\0b0v0",
        "CNewSystem::SetProgressInfo",
        "<#<1<U<t<",
        ">%>,>8>",
        "6(6/6H6N6i6",
        "<6<L<",
        "void __thiscall UnBCL::Array<class CGlobalPathFindData *>::Remove(class CGlobalPathFindData *)",
        "1&1D1g1",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@W4OP_EXECUTION_PHASE@@PAV?$ArrayList@PAVCOperation@@@UnBCL@@@UnBCL@@@_@UnBCL@@",
        "=R=`=t=|=",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCMountedPathInfo@CDeploymentBase@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "=/=S=",
        "DiagERAddFiles",
        "%hs: Failed to open destination file %s. Error: 0x%08X",
        "int __stdcall UnBCL::MP::ThrowCompare<struct PageFileDesc *>::Compare(struct PageFileDesc *,struct PageFileDesc *)",
        "JET_errLogDisabledDueToRecoveryFailure",
        ".?AU?$IEnumerable@PAVCDriverInfo@@@UnBCL@@",
        "t`9G<t",
        "2 242C2R2}2",
        "fYfZf3",
        "_DismSetFirstBootCommandLine",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::Insert(int,class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *)",
        "Unable to restore service start type %u. Error: %u",
        "4<4r4|4",
        "0'070R0\\0f0l0z0",
        "CSetupAutomation::Initialize: Loaded deployment settings from %s",
        "?FromString@MultiSz@UnBCL@@SGPAV12@PBGG@Z",
        ".?AVCProvisioningMigration@@",
        "3.3C3R3\\3a3i3p3|3",
        "CDeploymentProject::CreateVHDDeployment: Mismatched setup platform version: current (%u.%u), target (%u.%u)",
        "VdsDisk::CreatePartition: Can't copy reserved partition name (0x%08x)",
        ".?AV?$ArrayList@PAVCOperationInfo@@@UnBCL@@",
        "? ?'?C?Q?i?",
        "ERROR_SEGMENT_NOTIFICATION",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVCDriverInstallInfo@@@UnBCL@@@_@UnBCL@@",
        "CSetupPlatformPrivate::AnalyzeCrash: An error occurred while processing the pagefile",
        "=$=,=4=<=D=h=|=",
        "Control\\ProductOptions",
        "VdsDisk::InitializeProperties: Couldn't determine whether USB controller is xHCI (0x%08x)",
        "DuplicateFileNode",
        "base\\ntsetup\\lib\\rollback\\src\\checkpoints.cpp",
        "??0Win32Exception@UnBCL@@QAE@K@Z",
        "7=8O8W8]8j8|8",
        "0'0>0Z0h0n0",
        "6?7f7",
        "class CAppInfo *const *__thiscall UnBCL::ArrayList<class CAppInfo *>::GetBuffer(int) const",
        "141>1K1Q1X1b1o1v1",
        "RollbackExecuteSequence: threw exception.",
        "?Steal@?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEPAVString@2@XZ",
        "GetModelSectionNameEx",
        "SmVolume::EnumerateMountPaths",
        "= =$=4=8=H=L=\\=`=x=",
        ";3;K;a;",
        "1*1C1[1o1",
        ":?;`;",
        "ERROR_RESOURCE_FAILED",
        "AddResourceToHashTableCallback",
        "787@7L7l7t7|7",
        "Removing OS uninstall failed. Error: 0x%08X",
        "BcdCopyObjectEx: Failed to enumerate source elements. Target: %ws Flags: 0x%x Status: %x",
        ".?AV?$CAutoRelease@PAVWmiCall@WMI@@@RAII@@",
        "PWVh~",
        "?$?1?S?",
        "class CFilterDriverInfo *__thiscall UnBCL::_::ArrayListEnumerator<class CFilterDriverInfo *>::get_Current(void) const",
        "Failed file callback",
        "System32\\config\\COMPONENTS",
        "4&595@5H5M5]5h5t5",
        "XDeserialize/Execute pre-FirstBoot operations failed",
        "base\\ntsetup\\setupplatform\\lib\\static\\footprint.cpp",
        "SystemPartition",
        ";!;-;6;?;b;p;y;",
        ".?AV?$ArrayListEnumerator@PAVDiskLayout@@@_@UnBCL@@",
        "CSetupAutomation::CacheInstallTarget: Failed to enumerate disks: 0x%08x",
        "2\"2>2F2P2X2z2",
        "Failed to copy WPA subkeys",
        "4%4.4{4",
        "4p5,6l6",
        "%hs: Failed to create BCD object. Status = %d",
        "SVhP:",
        "Driver entry key %s already exists.",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@J@UnBCL@@@UnBCL@@@UnBCL@@",
        "ActionPlatform::LaunchModule: Successfully executed '%s' from %s%s",
        ".?AU?$ICollection@PAUIVdsDisk@@@UnBCL@@",
        "CTestHookDUUpdate::GetUpdateSize",
        "Cannot restore the status of OCs on online systems",
        "CMediaLayout::ExecuteOptimization: Failed to get package path at index %d: 0x%08x",
        "=Q>d>r>",
        "QueueRegisterAsyncProcess called with command %s %s",
        "7 7$7(7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7",
        " 020:0@0M0_0x0",
        ".?AU?$IEnumerator@PAVCUserProfile@@@UnBCL@@",
        "ERROR_CLUSTER_RESOURCE_TYPE_BUSY",
        ".?AU?$IDictionaryEnumerator@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::set_Item(int,class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *)",
        "SPQueryReserveInfo: Reserve scenario [%d] is not supported",
        "RollbackReinitialize finished.",
        "CSetupPlatform::CreateNewSystem: Failed to queue setup automation in new system. hr = 0X%x",
        "1&1,12171A1K1U1_1m1s1y1~1",
        "int __thiscall UnBCL::Array<struct PartitionLayoutArgs *>::Add(struct PartitionLayoutArgs *)",
        "The source ICB size is %I64u bytes; will not split it",
        "sysprepValidate",
        "2P2\\2s2",
        "OCStatusFilePath1: %s",
        "ERROR_QUORUM_NOT_ALLOWED_IN_THIS_GROUP",
        ".?AVCDriverInstallInfo@@",
        "j?jWh",
        "tZSSj",
        "?-?C?`?n?|?",
        "?'?.?=?D?",
        "SVWj43",
        ";$<X<",
        "CMediaLayout::QueueDrivers: Failed to get full path for %s: 0x%08x",
        "int __thiscall UnBCL::Array<class CProfileInfo *>::Add(class CProfileInfo *)",
        "SysprepSession::ExecuteAction: Error bypassed for deleteDirectory operation",
        "=\">e>x>",
        "2<2V2]2",
        "PPPPPPh ",
        "Update trace failed: 0x%x",
        "CNewSystem::QueueCreateFile",
        ">&>,>1><>F>Y>y>",
        "5(505L5T5l5t5|5",
        "7%7-737=7G7[7t7",
        "5Q6c6k6q6~6",
        "4/4T4d4j4",
        ";$;.;C;U;];c;w;};",
        "%hs: Invalid parameters",
        "struct _GUID __thiscall UnBCL::_::ArrayListEnumerator<struct _GUID>::get_Current(void) const",
        "Environment variable is set to use upgrade snapshot",
        "pDecodeHexDigit: Invalid hex char [%c]",
        "PWVh6",
        "0)0;0l0}0",
        "3*414",
        "4*4;4H4Q4b4k4t4",
        "Failed to copy Compact value",
        "bootnxt",
        "Using scratch directory %s",
        "void __thiscall UnBCL::ArrayList<class CUserProfile *>::QuickSort(class UnBCL::ArrayList<class CUserProfile *> *,class UnBCL::ArrayList<class CUserProfile *> *,int,int)",
        "NtDeleteFile",
        "ERROR_DS_CROSS_DOMAIN_CLEANUP_REQD",
        "VdsPartition::CreateLogicalPartition: Failed to get parent disk properties (0x%08x)",
        ".?AVCPrepareSysPrep@@",
        "ReadBootCode: Error not enough buffer size!",
        "(%lx): Failed to reset disk GUIDs.",
        "pDeterminePageFileRequirements: Failed to get host memory info: 0x%08x",
        "?get_P@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBEPAV?$Array@E@2@XZ",
        "> >%>0>:>@>T>f>w>~>",
        "CSetupAutomation::GetDriveLetter: Failed to enumerate disks: 0x%08x",
        "ERROR_EVENTLOG_FILE_CHANGED",
        "ar-SA",
        "555N5c5k5q5~5",
        "8(878F8U8d8m8v8",
        "%c:\\%s\\%s\\%s",
        "5$5,525?5Q5d5v5~5",
        "CBS_E_CYCLE_EVALUATION",
        "6(6Y6l6y6",
        "ActionPlatform::DeleteDirectory: Error occurred during directory deletion; dwRet = 0x%x, Win32Exception message: %s",
        "Exit code of %s: %d",
        "Marking event [&SclEvent_ExtendPartition_Start]",
        "REAGENT.DLL",
        ":g;n;|;",
        "> >+>6><>G>N>i>o>",
        "{91F8F5A8-E063-4DB8-B15F-583BE3169F4D}",
        "ERROR_REMOTE_STORAGE_MEDIA_ERROR",
        "=,=<=L=\\=`=p=t=",
        "8\"979O9h9}9",
        "8.8P8n8t8",
        "Error while creating/opening the Rollback key. Error: 0x%08X",
        "ApplyPartitionProperties: Failed to format target volume (0x%08x)",
        ".?AV?$SerializableBase@VCMountedPathInfo@CDeploymentBase@@$0A@V?$DefaultInstanceFactory@VCMountedPathInfo@CDeploymentBase@@@UnBCL@@@UnBCL@@",
        ":&:4:B:",
        "5(535=5J5S5[5a5g5l5r5x5",
        "3 3*343A3M3Y3e3q3}3",
        "CCreateScopedSnapshot::DoExecute: Failed to convert creation time to FILETIME. Error: 0x%08X",
        "ERROR_DS_NAME_ERROR_TRUST_REFERRAL",
        "SystemSetupInProgress",
        "Failed moving temp package list file to final path",
        "9$9(9,90989<9@9D9L9P9T9X9`9d9h9l9t9x9|9",
        "6,686@6W6i6",
        "RtlSetDaclSecurityDescriptor",
        "8/878A8H8N8S8^8j8~8",
        "0-1L1[1b1h1m1x1",
        "tg-Cyrl",
        "2*272g2t2",
        ":(:2:E:L:T:t:{:",
        ">,>F>T>b>k>",
        ";);3;F;T;[;i;s;",
        "3!3/3=3",
        "Failed to set element description. Status = [%x]",
        "=%=,=1=E=f=w=",
        "    Existing path is invalid",
        ".?AV?$SmartPtr@VCFailForwardSystem@@@UnBCL@@",
        "pa-Arab-PK",
        "\\$4YY",
        "E$thjH",
        "2%2-232@2R2`2m2",
        "; ;';3;Q;",
        "?!?+?0?D?_?",
        "9D9\\9s9",
        "= =$=(=,=0=4=8=<=D=H=L=P=X=\\=`=d=h=l=p=t=x=|=",
        ".?AVCXXXXXHandledException@?2??CreateFromWDSServer@CImageInfoSet@@SGJPBGPAUtagWDS_CLI_CRED@@PAPAV2@@Z@",
        "Filter driver information for volume [%s]:",
        "ControlSet%03u",
        ";,;J;V;h;",
        "QQSVW3",
        ">$>*>/>:>I>Q>W>k>|>",
        "=)=N=u=",
        "ERROR_CLUSTER_REGISTRY_INVALID_FUNCTION",
        "? ?(?P?X?`?t?|?",
        "2#232N2S2",
        ";!;';+;C;R;^;s;",
        ">N>Z>e>s>",
        "2(2?2\\2",
        "9r t1",
        "SL_E_EUL_NOT_AVAILABLE",
        "4(525?5E5L5V5c5j5t5",
        ";9;>;J;n;s;",
        ".?AVCMediaLayout@@",
        "5=5^5l5s5y5~5",
        ";(;0;T;\\;d;l;t;|;",
        "End Install gather",
        "%hs: Deserializing operations",
        "performed",
        "%wOtF",
        ":+:5:G:O:T:_:e:o:",
        "9*91979<9G9R9f9~9",
        "SL_E_CHPA_FAILED_TO_DELETE_PRODUCTKEY_BINDING",
        "9/9E9j9r9~9",
        "6'656>6G6]6k6t6}6",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::GetBuffer(int) const",
        ";(<h<",
        "OSRollbackUtils::VolumeTracking::FindVolume",
        ">(?=?D?J?O?Z?e?j?~?",
        "Microsoft\\Windows NT\\CurrentVersion",
        "MIG_MANIFESTS",
        "DriverSafeOSMigrateFailedList",
        "Destination user remap approved environment is NULL, cannot continue.",
        "2.2;2G2c2~2",
        "Snapshot is older than %d days, remove it even if cleanup is not allowed",
        "ERROR_CONNECTION_INVALID",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback:No crash dump files found: %s.",
        "233c3",
        "263;3",
        "7=7G7U7l7",
        "CDownloadDUUpdates::MarkDirectory: Unexpected operation ID %d",
        "30393B3v3",
        "CBS_E_PROPERTY_NOT_AVAILABLE",
        "L$(QP",
        "SPGetWIMBootEntries: Failed to initialize COM. Error: 0x%08X",
        "PWVhy",
        "Failed to start trace: 0x%x",
        ".?AVCXXXXXHandledException@?2??pSPCheckAndDeleteUpgradeSnapshot@@YGJPAVString@UnBCL@@0PAUHKEY__@@KHPBGPAUITelemetry@@PAH@Z@",
        "QSVWjd[h",
        "VERBOSE: Result : %s",
        "7 7(70787@7H7X7|7",
        ".ocsToDisable",
        "ERROR_INVALID_THREAD_ID",
        "RtlConvertSidToUnicodeString returned too short of a string.",
        "pGlobalProgressBounds",
        "%hs: Cannot open the system key for the online OS. Error: 0x%08X",
        "ERROR_DS_POLICY_NOT_KNOWN",
        "CSecurityHeaderWriterT<class CEmptyType>::Initialize",
        "ERROR_NO_SUCH_DOMAIN",
        "9)9L9}9",
        "base\\ntsetup\\setupplatform\\lib\\imageinfo\\imageinfo.cpp",
        "PVWhY",
        "< <(<,<0<4<<<T<X<p<t<",
        "VdsVolume::GetProperties: Failed to query IID_IVdsVolume2 interface [%s] (0x%08x)",
        ">(>,>D>H>`>d>|>",
        "%0P0y0",
        "GetSystemDiskNumber: Disk [%u] is the system disk.",
        "AX;BXu",
        "=%=D=J=i=o=",
        "<(<><T<_<o<y<",
        "The version of volume [%ws] is NTFS [%u.%u]",
        "Adding new WinRE BitLocker hash %s",
        "2\"2(272G2X2m2v2|2",
        "{CB48FA07-CAF3-4E72-B60F-3948FE04F51A}",
        "4#5]5",
        ";(;,;<;@;P;T;d;h;x;|;",
        "SPCleanupInstallationDrive: Unmounting directory %s",
        "ExtractRemainingCallback",
        "ERROR_INTERNAL_DB_ERROR",
        "pAddSafeOSDriversFromProvPackage: Failed to get element enumerator for provisioning package %s (0x%08x)",
        "0!0+0B0X0b0k0u0~0",
        "6#6<6N6`6h6n6w6",
        ":';9;A;G;T;f;",
        "1%131:1@1E1P1[1o1",
        ">!>6>Z>d>p>y>",
        "%hs: Failed to disable restartonfailure for SafeOS. Status = 0x%08X",
        ".?AV?$CAutoLocalFree@PAG@RAII@@",
        "CNewSystem::PrepareForRun",
        "9PAGE",
        "?ToLower@String@UnBCL@@QBEPAV12@XZ",
        "RollbackCleanupReserveFailureCode",
        "747G7]7d7j7o7z7",
        "Cannot find [%s], there is no service to add",
        "0C1M1",
        "SPCanChangeRecoveryPartition: FindFirstVolume/FindNextVolume returned and empty volume path",
        ".?AVCXXXXXHandledException@?5??SPDeleteSnapshot@@YGJPAVString@UnBCL@@0@Z@",
        "ERROR_DS_CANT_CREATE_IN_NONDOMAIN_NC",
        "8$818C8\\8{8",
        "3%323E3V3s3",
        "3#333<3W3h3r3",
        ";%;5;J;\\;o;",
        "7'717G7M7]7d7n7u7{7",
        "5%6g6q6}6",
        "<#<2<<<A<I<P<\\<n<",
        "CFailForwardSystem::QueueProductKey",
        ">'>f>m>",
        "ERROR_DS_UNAVAILABLE",
        "DismGetFeatureParent",
        "5#5G5X5_5e5j5u5",
        "<*=\\=m=",
        ":!:(:.:3:>:I:^:o:v:|:",
        "Validate WinRE boot driver",
        ">(>=>P>X>^>k>}>",
        "void __thiscall UnBCL::ArrayList<class CCopyInfo *>::RemoveAt(int)",
        ".?AV?$ArrayList@U_GUID@@@UnBCL@@",
        "ERROR_PIPE_NOT_CONNECTED",
        "?.?M?X?w?}?",
        "int __thiscall UnBCL::ArrayList<class CProfileInfo *>::IndexOf(class CProfileInfo *,int,int) const",
        "%hs: failed to mount system hive. Error: %08x",
        ";!<6<O<m<",
        "<*=3=<=E=N=W=`=i=r={=",
        "ERROR_PARAMETER_QUOTA_EXCEEDED",
        "2,242<2L2X2`2",
        ">Y>e>k>{>",
        "nso-ZA",
        "Merging diagnostics data success",
        "RPC_X_SS_HANDLES_MISMATCH",
        "6'60696E6Q6]6i6u6~6",
        "setting hardlink failed",
        "Installing component update package (path: %s)",
        "6(7C7K7V7^7i7|7",
        "HardwareID: %s",
        "> >H>P>X>l>t>|>",
        "RestoreMountStub: Could not move hardlink stub to prepopulate location",
        ".?AV?$Array@PAVCFileCreationData@@@UnBCL@@",
        "SPAPI_E_INF_IN_USE_BY_DEVICES",
        "void __thiscall UnBCL::Array<class OC::CCmdLineExecutionTelemetryData *>::RemoveAt(int)",
        "PnpPropMigGatherW",
        "onecore\\base\\ntsetup\\lib\\onesettings\\src\\onesettings.cpp",
        "D$L9A",
        "?/???O?\\?i?q?",
        "void __thiscall UnBCL::ArrayList<struct DiskMatchFilter>::QuickSort(class UnBCL::ArrayList<struct DiskMatchFilter> *,class UnBCL::ArrayList<struct DiskMatchFilter> *,int,int)",
        ".?AV?$SerializableArrayListBase@PAVCMountedPathInfo@CDeploymentBase@@@_@UnBCL@@",
        "6%6+6>6Q6Y6c6k6",
        "bfd3e48c-c96b-43fd-8b09-98cdc89dc77e",
        "4$484E4R4Y4g4n4t4y4",
        "606i6p6v6{6",
        ":+:@:S:d:",
        "Failed to query object name info for %ws. Status: %x",
        ">3>?>I>m>",
        "??4MutableString@UnBCL@@QAEAAV01@PBG@Z",
        ".?AV?$DefaultInstanceFactory@VCOCValidator@@@UnBCL@@",
        "SysprepComponent::CreateSysprepActionList",
        "E_HANDLE",
        "8.8H8g8",
        "SPAPI_E_DI_DO_DEFAULT",
        "?+???Z?a?g?l?w?~?",
        "void __thiscall UnBCL::Array<class COperation *>::RemoveAt(int)",
        ".PAVCXXXXXTemp@?CM@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "void __stdcall UnBCL::_::HTEnumerator<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class CWIMBootHelper::CWIMEntryIndex *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,&protected: static class CWIMBootHelper::CWIMEntryIndex * __stdcall UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::DictionaryEntry<void *,void *> *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *> *,class UnBCL::Array<class CWIMBootHelper::CWIMEntryIndex *> *,int)",
        "9+999M9U9",
        "=:=Z=d={=",
        "6J7m7",
        "0-0;0c0y0",
        "5'5}5",
        "?$?2?",
        ";$;,;4;@;H;d;l;",
        "y(WhD",
        "'0<0D0N0^0g0",
        "WINDOWS/ARCH",
        "SetupPlatform: Phase \"Post-OOBE\" completed successfully.",
        "0'0>0U0n0",
        "ERROR_FILENAME_EXCED_RANGE",
        "?M?U?",
        "ZwDeleteKey",
        "0%030G0U0o0w0",
        "?\"?+?=?F?R?[?d?m?v?",
        ">'>3>I>b>",
        ": :,:;:W:a:k:q:~:",
        "Upgrade security",
        "DRVINST: Successfully %sreflected driver package in WinPE: %s.",
        "ERROR_IRQ_BUSY",
        "SysprepSession::Execute: Failed while add dynamic Store for offline OS; dwRet = 0x%x",
        "Unable to get procedure CreateNewPseudoWindows",
        ".?AU?$IList@PAVCBcdSetting@@@UnBCL@@",
        "Logging process names:",
        "FindVolumeClose",
        "3@3I3R3[3f3o3x3",
        "0!0/0<0G0_0m0x0",
        "7&7;7I7W7e7",
        "=%=1=E=N=_=q=v=",
        "CBS_E_OPEN_FAILED",
        "ERROR_EVT_QUERY_RESULT_INVALID_POSITION",
        "=$=2=C=L=Q=b=t=",
        "3$3,343<3D3L3T3\\3d3l3t3|3",
        "4>4P4X4^4k4}4",
        "6*7p7",
        "0B1m1r1",
        "SPFindFreeSpace: Can't read partition properties (0x%08x)",
        "5@6d6",
        "6#6(636>6R6d6y6",
        "5*5/585F5M5W5h5q5~5",
        "2'2C2O2[2g2s2",
        "__thiscall UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *>::ArrayList(const struct UnBCL::ICollection<class CDeviceIdDatabase::CDeviceInfoData *> *)",
        "Create registry",
        "VdsDisk::PrepareForWipe: Failed to get IVdsVolumeMF interface (0x%08x)",
        "444C4j4",
        "<*<8<",
        "9%9Q9g9}9",
        ")SmPlatform::Initialize",
        "?)?;?C?I?V?h?v?",
        "ParseDiskCriterion: Unsupported diskmatch operator %u",
        "Creating Filterpages reg value failed with error 0x%08X.",
        ".?AV?$ArrayListEnumerator@PAVCBcdSetting@@@_@UnBCL@@",
        "8&8;8M8U8[8o8u8~8",
        "{6DD8F04C-64A9-4C66-B243-D0A2C0EB7C37}",
        "CDeploymentBase::Finalize",
        "?+?K?x?",
        "132B2s2",
        "SVhXK",
        "Failed to get img buf",
        "j$PhX",
        ".?AV?$CAutoCleanupBase@PAPBG@RAII@@",
        "Error executing final file operations",
        "%hs: Cannot queue sync command execution for fail-forward system %d. Error: 0x%08X",
        "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAE@PBU?$ICollection@PAVString@UnBCL@@@1@@Z",
        "515?5M5Y5e5q5",
        "Failed to Initialize Reserves. status: %x",
        "JET_errDataHasChanged",
        ".?AVCXXXXXHandledException@?2??Initialize@CSetupPlatform@@QAEJPBGH@Z@",
        ";.;C;X;q;",
        ">!?<?j?",
        "3(323;3E3O3X3a3",
        "2&282S2t2",
        "6$686L6T6\\6d6l6x6",
        "VERBOSEOPS: %sOperation with ID %u cannot be run as part of phase %u",
        "ERROR_MUTUAL_AUTH_FAILED",
        "VdsDisk::BringOnline",
        "Failure while getting the known folder path for %s",
        ">$>2>F>N>",
        "appBuildLab",
        "MigCreateFileVerifier",
        "Finalize",
        "ERROR_UNABLE_TO_CLEAN",
        "=!=&=1=<=P=d=",
        "ERROR_DOMAIN_CTRLR_CONFIG_ERROR",
        "SL_E_PROXY_KEY_NOT_FOUND",
        ".?AVCCompressWIMBootFiles@@",
        "7&7J7O7[7",
        "Y4?L8M",
        ">-?4?_?f?",
        "959O9c9p9|9",
        "7%7K7Q7]7e7w7~7",
        "yoj@j",
        "<)=0=;=B=\\=",
        "%hs: Failed to insert %s into the setup key. hr = 0x%X",
        "%hs: Error finding window %s; HR = 0x%x",
        "7&7,797K7Y7",
        ".?AU?$IList@PAVString@UnBCL@@@UnBCL@@",
        "<$<2<@<N<",
        "?3?H?O?U?Z?f?n?",
        "ERROR_WRONG_PASSWORD",
        "y!VhD",
        "PWSWWWh",
        "2C2V2d2p2~2",
        "2 2'2:2L2c2",
        ".?AU?$IEnumerator@PAVCOperationInfo@@@UnBCL@@",
        "?(?0?T?\\?d?l?t?|?",
        ".?AU?$IEnumerable@PAVCBasicEnvEntry@@@UnBCL@@",
        "9,9j9",
        ";%;-;K;V;q;x;~;",
        "NtUnloadKey2",
        "int __thiscall UnBCL::ArrayList<class CShellFolderInfo *>::IndexOf(class CShellFolderInfo *,int,int) const",
        ">'>5>o>",
        "<$<(<@<D<\\<`<x<|<",
        "9)959I9V9`9t9",
        "FOLDERID_SkyDrive",
        ":):0:6:;:F:M:n:{:",
        "ERROR_NOT_SAFE_MODE_DRIVER",
        "SL_E_PUBLISHING_LICENSE_NOT_INSTALLED",
        "??0Object@UnBCL@@QAE@XZ",
        ".PAVCXXXXXTemp@?BA@??Rollback@CSetupPlatformOSSwitchCheckpoint@@UAEXPBG@Z@",
        "ERROR_CARDBUS_NOT_SUPPORTED",
        "8-898I8V8h8",
        ":#:):6:H:c:",
        ">5>;>F>T>",
        "0,0^0y0",
        "0#0(030@0E0Y0g0n0t0y0",
        "=2>`>k>",
        "ERROR_WINDOW_OF_OTHER_THREAD",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::Reset(void)",
        "SmPlatform::Initialize: Not using SM API: The version on the host OS doesn't support setting the usage of a partition after it is initially created.",
        "ExportInResourceOrder",
        "?*?J?P?j?r?",
        "Failed to move file operations folder. Error 0x%08X",
        "Will add a new error",
        "IMAGE\\WIMBOOTENTRIES",
        "JET_wrnCopyLongValue",
        "jzXf;",
        "6$6.6?6H6U6_6j6t6",
        "2#2)2.2:2G2M2R2f2w2",
        "    Failed to assemble destination path",
        ";(;5;B;J;Q;Z;p;z;",
        "ERROR_DS_CANT_ADD_TO_GC",
        "%programfiles%",
        "<(<,<D<H<`<d<|<",
        "8$8,848X8l8t8|8",
        "fr-CI",
        "Context",
        "Windows Rollback",
        "?/?>?P?m?z?",
        ">C>Y>_>s>~>",
        "VdsPartition::SetType",
        "WIMExportImage",
        "GetDiskFreeSpaceW",
        "USERS",
        "8F8X8h8z8",
        "606D6[6b6h6m6x6",
        "Failed to initialize the boot options library.",
        "?'?-?2?C?N?\\?",
        "5,595",
        ">!>)>/>4>H>X>_>n>x>",
        "0+0E0Q0Y0c0j0p0u0",
        "NULL != Update",
        "Failed to copy key %ls",
        "OC::COCCbsAdapter::GetPackageByName: Open package successfully",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "Failed to set element application device. Status = [%x]",
        "=$=(=,=4=<=@=D=H=L=P=T=X=\\=`=d=h=l=t=x=|=",
        ">'?@?U?]?c?p?",
        "PSFX_E_NULL_DELTA_HYDRATION_FAILED",
        "  Minor Version = %d",
        "AuditMode",
        "OfflineWinDir",
        "ERROR_MEDIA_INCOMPATIBLE",
        "7\"7(747H7V7d7r7",
        ":<:R:X:^:c:m:w:",
        ";$;L;",
        "0\"1)1P1Z1g1",
        "9\"9.989K9o9t9}9",
        "SFList (original):",
        "9'9@9b9p9u9",
        "1*12181=1L1Y1l1t1",
        "4-4=4k4r4",
        "9c:h:",
        "CReconstructOS::DoExecute: ReconstructWindows() completed. Re-staging installation...",
        "int __thiscall UnBCL::ArrayList<class SysprepAction *>::IndexOf(class SysprepAction *,int,int) const",
        "1$1,141@1d1l1t1|1",
        "RestoreMountStub: setting reparse point data failed",
        "void __thiscall UnBCL::ArrayList<class CAntiVirusInfo *>::RemoveAt(int)",
        ":':-:::X:~:",
        "void __thiscall UnBCL::ArrayList<class CCFGSectionValue *>::Resize(int,int)",
        "7'7-7<7S7c7o7w7",
        ".?AV?$SmartPtr@VCGlobalPathFindData@@@UnBCL@@",
        "0+050?0E0R0Y0m0t0z0",
        "ZwOpenProcess",
        "<C<c<",
        ">?>E>N>V>e>l>r>w>",
        "CAddSafeOSBootEntry::MakeBcdDeviceObject",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::Add(class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *)",
        "ERROR_DS_REPLICATOR_ONLY",
        "SssBindServicingStack",
        "void __thiscall UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *>::QuickSort(class UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *> *,class UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *> *,int,int)",
        "8:8A8G8L8W8f8n8t8",
        "Error loading SrClient.dll. Error: 0x%08X",
        "ERROR_BAD_USERNAME",
        "7,8h8",
        "7!7&71787=7h7",
        "ERROR_IPSEC_IKE_PEER_CRL_FAILED",
        "?8?A?J?U?`?n?~?",
        "%hs: Failed to get the size for source file %s. Error: 0x%08X",
        "%hs: Cannot resurrect new system.",
        "?3?@?K?R?X?]?h?x?",
        "4\"4)4D4Z4h4o4",
        "base\\ntsetup\\setupplatform\\lib\\private\\rollback.cpp",
        "Processing known folders for user %s",
        "97u%j",
        "Opening recovery store from %ws",
        "3&303@3]3d3o3",
        "Kernel rename scenario detected",
        "VdsPartition::BringOnline: No volume backed by this partition; online not supported",
        "ConvertStringSecurityDescriptorToSecurityDescriptorW",
        "747V7",
        ":#;G;b;w;",
        "CTrustSafeOS::DoExecute: Failed to update %s: 0x%08x",
        "void __thiscall UnBCL::Array<class SysprepComponent *>::InitLarva(class UnBCL::ArrayList<class SysprepComponent *> *)",
        "7H7O7U7Z7e7p7u7",
        "5Q5W5]5c5i5o5",
        "2x3(4",
        "PVWh+",
        "AllowTelemetry_PolicyManager",
        "CSetupPlatform::CreateNewSystem",
        "7\"7S7",
        "ServiceDebuggerFiles: Failed to allocate config buffer",
        "WIMSendFileInfoMessage",
        "DiskLayout::ExecCreations: Couldn't find extended partition: 0x%08x",
        ">(>8>H>X>h>x>",
        "DISPLAYDESCRIPTION",
        "?I?a?",
        "pt-BR",
        "Partition Style = RAW",
        "__TlgCV__",
        ".?AVCXXXXXHandledException@?JC@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        ";;;E;O;U;b;~;",
        "0#0)0.0=0N0[0d0q0}0",
        "Microsoft Primitive Provider",
        "?:\\WINDOWS",
        "t$Xhx",
        "Failed to retrieve image reference file for namespace %s, server %s. Error: 0x%08X",
        "xtype",
        "ERROR_PROFILING_AT_LIMIT",
        "Cannot get the partition array %s. Error: 0x%08X",
        "Failed to Create services key in First Boot. Error: 0x%08X",
        "7%7H7o7w7",
        "ne-IN",
        "9!979R9X9b9g9q9x9",
        "6#7>7y7",
        ".PAVCXXXXXHandledException@?JC@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "    %s - %s",
        "%hs: BCD failed to remove new OS boot entry references. Error: 0x%08X",
        "7!7(7.737>7I7]7u7",
        "Failed to find an existent system in %s. Error: 0x%08X",
        "3%323<3K3T3Z3g3m3r3",
        "CReconstructOS::RestageWindows: Preferred system UI language: %s",
        "4+4`4",
        "Failed to set element data type BCDE_LIBRARY_TYPE_DESCRIPTION. Status = %d",
        "ERROR_EC_CREDSTORE_FULL",
        "8,8]8h8",
        "5,5:5S5Z5a5g5s5",
        "%hs: PnpPropMigGatherW is not supported; skipping.",
        "ERROR_CTX_INVALID_WD",
        "CDownloadDUUpdates::DoExecuteInternal: Total space estimate leaves low free space; skipping installation.",
        ".?AV?$SerializableBase@VCEnableNetDebugging@@$0A@V?$DefaultInstanceFactory@VCEnableNetDebugging@@@UnBCL@@@UnBCL@@",
        ".?AVCXXXXXHandledException@?2??FilterUpdates@CDownloadDUUpdates@@IAEJPAUIDUUpdateCollection@DU@@PAJPAUIDownloadCallback@SetupPlatform@@PAXPAUIDUDownloadProgress@6@PAUITelemetry@@PAUITelemetryActivity@@@Z@",
        "7!7E7e7",
        "SL_E_INVALID_GUID",
        "Copy etl files: source: %s, destination: %s",
        "ERROR_EVT_FILTER_INVTYPE",
        "NtWaitForSingleObject",
        "CCloseLogFiles::DoExecute",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Successfully restored \"Boot\" directory.",
        "<(<H<f<u<",
        "SKIPBOOTTRACK(SAFEOS): Skip Boot Validator: SafeOS boot removal explicitly turned off.",
        "AuthUsesFlags",
        "(%lx): Unable to recursively delete subkey '%ws'",
        "ExecuteFailForward: Input parameter is set to disable splash windows",
        ";*;X;",
        "ERROR_DS_NTDSCRIPT_PROCESS_ERROR",
        "2!2,262C2N2X2e2p2z2",
        ".?AV?$CAutoCleanupBase@PAUIDeviceIdDatabase@@@RAII@@",
        "PVWh$",
        "0-060d0u0}0",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::IndexOf(class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *,int,int) const",
        "7K7r7",
        "2)21272=2J2a2q2",
        "3!3?3M3w3",
        "7\"7.7A7\\7n7u7{7",
        "DiskLayout::Populate: Couldn't get the extended partition (0x%08x)",
        "VERBOSEICB: ICB offline apply estimated size is: %I64u",
        "WIM file will be applied during the downlevel phase, no need to copy it locally.",
        "DiskLayout::ApplyModifications: Couldn't find existing partition with ordinal %u",
        "WinHttpGetIEProxyConfigForCurrentUser",
        "pStopSetupPlatformETWSession: Failure while querying all traces. Error: 0x%08X",
        "Reflect in the image.",
        "6!6*626M6U6y6",
        ">%>+>1><>F>Y>{>",
        "SmVolumePathEnumerator::GetNext",
        "SysprepSession::Execute: Sysprep mode was not specified, deleting it from registry",
        "GetTraceEnableFlags",
        "<*<6<H<f<r<",
        "979G9N9T9Y9a9o9w9}9",
        "CSetupPlatform::CreateNewSystem: No image info set provided.",
        "1!2/2?2H2_2{2",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CFilterDriverInfo *>::MoveNext(void)",
        "JET_errRedoAbruptEnded",
        "Logs\\NetSetup",
        "(%lx): Failed to enumerate source value keys.",
        "ERROR_IPSEC_IKE_OUT_OF_MEMORY",
        "9(:0;@<",
        "CSetupOneSetting::InitializeAndQuery",
        "3=4F4l4{4",
        "7 70777D7[7g7w7|7",
        "Creating Resume object.",
        "=/=H=]=p=x=~=",
        "CUninstall::RemoveUninstall: Failed to decode old WinRE hash, cannot remove it: 0x%08x",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,class CDriverInstallInfo *>,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,class CDriverInstallInfo *> __stdcall UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,class ATL::CElementTraits<class CDriverInstallInfo *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class CDriverInstallInfo *> > *,int)",
        "_wcslwr",
        "2 2I2\\2d2j2w2",
        "CI EA is only supported on either WinPE host or one which supports extracted catalog folder.",
        "CSetupPlatform::CreateNewSystem: Failed to get ImageInfoSet. hr = 0X%x",
        "D$$t`",
        "LdrGetDllHandle",
        "2&2,2@2I2P2\\2c2q2",
        ">$?\\?",
        "CSetupAutomation::CacheInstallTarget: Failed to iterate over partitions; 0x%08x",
        ".?AV?$SerializableArrayListBase@PAVCAppInfo@@@_@UnBCL@@",
        "%hs: Could not find the scratch directory and we have no retry message",
        "232E2c2p2z2",
        "SourceDirDriveLetter",
        "D:(A;CI;KA;;;SY)(A;CI;RCWD;;;BA)",
        "  Update types:",
        "FileACLTime",
        "??_DMultiSz@UnBCL@@QAEXXZ",
        "5+5?5R5Y5_5e5p5z5",
        ":/:<:D:",
        ">#>1>?>M>",
        "=================",
        "2A2N2`2h2n2{2",
        "SmPartition::GetOrdinal",
        "ERROR_PER_USER_TRUST_QUOTA_EXCEEDED",
        ">0?7?=?B?Q?\\?a?u?",
        "1/1@1G1N1Y1d1i1}1",
        ";1;:;C;L;];r;",
        "IsVolumeSnapshotted",
        "SL_E_CHPA_BINDING_NOT_FOUND",
        ";);C;f;v;",
        "Attempt to get BsdSummarize Diagnostic Information for bootstat file: %s",
        "!\\$,P",
        "CAddSetupClRequest::DoExecute: Failed to get pended SetupCL request from offline OS %s. Error: 0x%08X",
        ")SPFindFreeSpace",
        "RPC_S_CALL_FAILED_DNE",
        "GetSystemDefaultUILanguage",
        "6)63686L6`6g6m6r6}6",
        ":,:J:V:h:",
        "0 101<1C1I1N1Y1`1t1",
        "3,4\\4",
        "{%08lx-%04x-%04x-%02x%02x%02x%02x%02x%02x%02x%02x--%x}{%x}",
        "Query succeeded, but couldn't enumerate results (0x%08x)",
        "_[yBVV",
        "< <'<-<A<i<",
        ".CRT$XCU",
        ":-:;:@:E:P:r:",
        "0a0v0",
        "ZwOpenFile",
        "0,0@0S0v0",
        "7$7,747<7D7L7X7|7",
        "<(<B<I<O<T<_<e<",
        "int __thiscall UnBCL::ArrayList<class CImageInfo *>::LastIndexOf(class CImageInfo *,int,int) const",
        "2%292G2U2c2",
        "5%5+585R5X5^5k5",
        "D$$PQ",
        "MCcQF",
        "$Setup_SystemVolume$",
        "SecondBootPreOOBEStartTime",
        "VdsDisk::Wipe: Failed to query IID_IVdsAdvancedDisk interface [%s] (0x%08x)",
        "050;0M0^0k0",
        "0 1'1.191D1I1]1{1",
        "Enabling and starting deferred services",
        "ERROR_DS_MISSING_REQUIRED_ATT",
        "int __thiscall UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *>::BinarySearch(int,int,class CDeviceIdDatabase::CDeviceInfoData *,struct UnBCL::IComparer<class CDeviceIdDatabase::CDeviceInfoData *> *)",
        "JET_errFixedInheritedDDL",
        "{D350FECE-F39F-430A-A8D5-813D2ED199E9}",
        "uninstallwindow was not in range; using default value: %d",
        "%hs: Cannot get volume path for host partition. Error: 0x%08X",
        "0$0*070=0B0X0b0o0u0|0",
        "5$5,545<5D5L5X5|5",
        "{FD748B78-3EF8-47CF-9D9A-867CC523F711}",
        "5#5G5k5}5",
        "DiskLayout::WillBeExtended: Couldn't find partition with ordinal %u: 0x%08x",
        "CSetupAutomation::CacheInstallTarget: Cannot look up target partition: disk platform not available",
        "CCleanupSnapshot::DeleteSnapshot: Cleanup existing snapshot not owned by Setup",
        "ParseSizeString: Unrecognized byte unit: %s",
        "SPAPI_E_NOT_DISABLEABLE",
        "%hs: Rollback is not properly configured for fail-forward capability",
        "=#=G=]=q=",
        "9 9,9<9C9O9_9f9r9",
        "%hs: Can't create folder %s",
        "Copy telemetry file: source folder: %s, destination folder: %s",
        "7%717=7O7c7p7|7",
        ";5<i<q<~<",
        "ERROR_DS_BAD_HIERARCHY_FILE",
        "ERROR_REPARSE_OBJECT",
        ".?AU?$IEnumerator@W4OP_EXECUTION_PHASE@@@UnBCL@@",
        "FirstBootPostSysprepStartTime",
        "ERROR_TOO_MANY_SEM_REQUESTS",
        "Failed to write enable narrator in file: %s. Error: 0x%08X",
        "CNewSystem::QueueOperations: Soft Reserve area:",
        "6+6`6",
        ".?AU?$IEnumerator@PAUIVdsVDisk@@@UnBCL@@",
        "vuShPu",
        "CompressionExclusionList",
        "7$7*777I7S7h7p7v7",
        "CSetupPlatform::CreateNewSystem: Failed to get compact OS information. hr = 0X%x",
        ";:;F;X;q;{;",
        ".PAVCXXXXXHandledException@?BCC@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "SPAPI_E_SECTION_NOT_FOUND",
        ":(:E:N:W:`:i:",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::IndexOf(class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *,int,int) const",
        ".%s\\setupmemtemp.dmp",
        "5.6M6_6g6m6z6",
        "Will run discover only for the default user",
        "4d4k4q4",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Failed to copy \"%s\" to \"%s\", what to do?, skip.",
        "ERROR_SUCCESS_REBOOT_REQUIRED",
        "2(2:2U2f2r2",
        "xJj&Y",
        "9'959a9r9",
        "Copy string failed: 0x%x",
        ">+>q>",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::RemoveAt(int)",
        "Creating new recovery store %ws",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class SysprepAction *>::MoveNext(void)",
        "void __thiscall UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *>::CopyTo(class UnBCL::Array<class CSimpleCleanup::CCleanupEntry *> *,int) const",
        "LowDiskSpace",
        "2$2-222?2Q2[2o2|2",
        "MBRCh",
        "string too long",
        ";!;(;.;3;>;N;b;q;w;",
        "8#9N9S9",
        "JET_errColumnIndexed",
        "[ybVh",
        "ACLTRACK: Original ACL: %s",
        "7$7,747<7D7L7X7`7|7",
        "2-2K2Q2a2q2y2",
        "CBS_E_WINDOWS_UPDATE_SEARCH_FAILURE",
        "  Flight ID: %s",
        "NtModifyBootEntry",
        ".PAVCXXXXXHandledException@?EN@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "void __thiscall UnBCL::Array<struct PartitionLayoutArgs *>::InitLarva(class UnBCL::ArrayList<struct PartitionLayoutArgs *> *)",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::set_Item(int,class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *)",
        "PRRj ",
        "6%6+686J6]6j6",
        "<$<,<4<<<L<T<\\<d<l<t<|<",
        "pUnloadMountedHives",
        ".?AU?$IList@U_GUID@@@UnBCL@@",
        "?)?9?E?M?b?r?",
        "ERROR_OBJECT_NAME_EXISTS",
        "RollbackInitiatedBugCheckBinaryInfo",
        "7$7+787D7M7Y7^7g7s7",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class COperationsValidator *>::MoveNext(void)",
        ".PAVCXXXXXHandledException@?2??DoExecute@CCloseLogFiles@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAPAVString@1@@Z",
        "Verbose: Will add dictionary entry for %I64d, volume: %s",
        "Failed to convert user SID! Error code = %#x",
        "9*:1:7:<:H:X:l:v:}:",
        "5 5,5O5]5f5o5",
        "CExceptionHandler::~CExceptionHandler",
        "tg-Cyrl-TJ",
        "SystemDriveNative",
        "ERROR_DS_NAME_TOO_MANY_PARTS",
        "%hs: Uninstall validation failed with error: 0x%08X",
        "0$0/0C0_0}0",
        "LastCrashDumpInfo: CurrentBootId %u",
        "707:7X7d7o7|7",
        "4X6h6o6",
        "SPGetWIMBootEntries",
        "config.sys",
        "lv-LV",
        "Status",
        "8r ,Y",
        "CReconstructOS::RestoreInstallationSKUOverrides: Failed to apply SKU overrides for %s from %s: 0x%08x",
        "0*0W0]0h0v0",
        ".PAVCXXXXXTemp@?9??SPGetWIMBootEntries@@YGPAV?$ArrayList@PAVCWIMBootData@@@UnBCL@@GH@Z@",
        ";(;4;@;L;X;d;p;|;",
        "<&<3<C<S<X<d<w<",
        "DiskLayout::ApplyProperties: Marking partition as active",
        "ERROR_TOO_MANY_SEMAPHORES",
        "Creating/Setting Pagefiles reg value with %s.",
        "CSetupPlatform::GetClientDUPackages",
        "838j8",
        "long __thiscall CSetupPlatformRollback::LoadState(void)",
        "CBS_E_SESSION_INTERRUPTED",
        "Creating new system (6).",
        "The existance state of [%s] changed from [%s] to [%s]",
        "2 2M2",
        "ExportDirTree",
        "ERROR_IPSEC_IKE_MM_DELAY_DROP",
        "Software\\Microsoft\\Windows\\CurrentVersion\\Setup\\ImageServicingData",
        "%hs: Starting the engine offline, windir: %s",
        "5M5^5k5r5}5",
        ":!:N:r:y:",
        "ERROR_INVALID_SERVICE_ACCOUNT",
        ">'>0>O>^>g>",
        "ERROR_WMI_TRY_AGAIN",
        "8$848C8R8b8",
        "ImageState",
        "9*949:9E9O9b9g9p9",
        "1$1,141<1D1L1T1\\1d1l1t1",
        "Specified flags prevent opening unloaded system store",
        "    Exception parameter %u: %p",
        "pCreateSystemRootDriveMapping: The parent path for SystemRoot value [%s] doesn't look like a drive letter",
        "void __thiscall OSRollbackService::CCheckpointImpressario::ExecuteRollbackSequence(void)",
        "1$1,141H1\\1d1l1t1|1",
        "%hs: Current recovery image not found.",
        "Old and new SID strings are identical ([%ws]); skipping SID replacement...",
        "243x3",
        "Failed to query all traces: 0x%x",
        "0$0-0C0d0",
        "%hs: New OS WinDir: %s",
        "WindowsOld.wim Image captured",
        "DiskLayout::VerifyLayoutExtendedIfLogical",
        "?!?L?",
        "base\\ntsetup\\setupplatform\\lib\\project\\medialayout.cpp",
        ";Q<[<x<",
        "CSetupPlatformPrivate::Execute: Failed to decode new WinRE hash, cannot add it: 0x%08x",
        ">M>b>i>",
        "7\"7*707@7K7U7^7e7r7",
        "2'2K2]2e2k2x2",
        "chr-Cher",
        "SPGetVolumeStableGuidStringFromVolumeName: Failed to get volume handle for %s. Error: 0x%08X",
        ".PAVCXXXXXHandledException@?BPI@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::RemoveAt(int)",
        "<(=I=^=f=l=y=",
        "j]Yf;",
        "GetAnswerFileContentsAsUnattend: Failed to re-encode answer file contents: 0x%08x",
        "CUpdateBootSector::DoExecute: Failed to update the boot sector. Error code is [0x%X]",
        ".rdata",
        "7&7,797K7",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCCopyInfo@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCCopyInfo@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "ERROR_DS_HIERARCHY_TABLE_MALLOC_FAILED",
        "010>0H0O0U0Z0e0v0{0",
        ">7?q?",
        "    Failed to assemble new path string",
        "serviceActions",
        "QueueOCReplication called",
        "SPValidateMigratedServices: copy file operation failed, error: 0x%08X.",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,int> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::get_Item(int) const",
        "SL_E_SLP_BAD_FORMAT",
        "2;2M2U2[2h2z2",
        "?/?7?=?J?Y?j?w?",
        "VdsDisk::Initialize: Couldn't refresh VDS service (0x%08x)",
        "7(7/757:7E7P7k7w7",
        "Partition Count = %d",
        "DeleteFileEx: hardlink given to us is: %s",
        "8 8(8.8;8M8w8",
        "9'9-969>9M9T9Z9_9j9u9",
        "SPBUILD",
        "3'3-323C3N3\\3",
        ";+;G;d;m;",
        "=1=;=P=W=_=|=",
        "X%windir%\\Panther\\Rollback",
        "ERROR_RESOURCE_NOT_FOUND",
        ".?AVCXXXXXHandledException@?NN@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ">!?(?.?3?>?I?]?}?",
        "SVWjb",
        "3$3@3G3M3Y3e3",
        "WIM changes committed, proceeding to unmount.",
        "?4?<?D?X?`?h?x?",
        "DismAddDriver",
        "ocStatusFilePath1",
        "(not(contains(@exclude, \"",
        "PWSh0",
        "8#8>8E8K8P8[8k8}8",
        "SPExecuteFirstBootCompletion",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCFileCreationData@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "1/1N1c1q1",
        "2#2I2\\2c2i2n2y2",
        ".?AVCDrvStoreProperty@@",
        "6#656I6V6e6t6",
        "CreateSemaphoreW",
        "9!9'9,9C9M9`9}9",
        "Failed creating package",
        ":\":5:T:Z:q:",
        "8*838=8F8P8Y8x8",
        "0$0-060?0H0Q0Z0c0",
        "CGlobalPath::FindGlobalPathCallback",
        "pFindAndAddFiles: Failed to build full path [%s]\\[%s] to check existence; Error: 0x%08X",
        "?*?4?>?D?Q?",
        "WimSetSecurityDescriptor",
        "RtlFreeHeap",
        "void __thiscall UnBCL::ArrayList<class OC::COptionalComponent *>::RemoveAt(int)",
        "SSh  ",
        "516G6V6",
        "7$7/7<7B7[7b7h7m7x7",
        "4(5@5G5l5z5",
        "CSetupPlatformInfo::StreamRead: Failed to set capabilities",
        "1 1$1,10181<1D1H1P1T1\\1`1h1l1t1x1",
        ".?AV?$ArrayList@PAVCRegCreationData@@@UnBCL@@",
        "    Failed to assemble payload path",
        "3_3v3",
        "5A6^6",
        "Failed to append %ws to %ws. Status: %x",
        "t[VW3",
        ".?AUIDeviceIdDatabase@@",
        "1D1d1|1",
        "< <,<><S<b<l<q<y<",
        "EnumDependentServicesW",
        "ExportHash",
        ":#:/:8:E:J:S:Z:g:s:|:",
        "0#0)0.090D0T0d0p0|0",
        "|DEST|\\bootspaces.dll",
        "1,141<1D1L1T1\\1d1l1t1|1",
        "0 0$0(0,040X0`0|0",
        "Failed to create offline session",
        "VdsPartition::SetType: Expected an MBR disk, got %u",
        "SL_E_CHPA_FAILED_TO_UPDATE_PRODUCT_KEY_PROPERTY",
        "?>?X?s?",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CAppInfo *>::Reset(void)",
        "DismGetDriverInfo",
        ".?AVCWDSPidgenxExtractor@@",
        ":1:9:?:S:Y:b:x:",
        "646<6D6L6T6\\6d6l6t6|6",
        "%hs: {bootmgr} opened.",
        "?*?Y?",
        "Failed to get non-existing property %s.%s (0x%08x)",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCAntiVirusInfo@@@UnBCL@@@UnBCL@@",
        "DiskLayout::VerifyLayoutNoRefsToDeletedLogical: Can't preserve partition %u in new partition %u because the extended partition that used to contain partition %u is being deleted",
        "9(979C9S9\\9s9",
        "<+=N=d=",
        "?%?2?C?O?f?m?",
        ".?AV?$ArrayListEnumerator@PAVCOptionalComponent@OC@@@_@UnBCL@@",
        "CAddProvisioningPackage::DoExecute: Failed to initialize COM security. Was it initialized before us? hr = 0x%08X",
        ">D?P?W?c?j?",
        "SysprepSession::CreateSession: Unrecognized exception",
        "CompareFileVersions: Couldn't get last modification time of [%s] and/or [%s]. GLE = %u",
        ".?AVCExportWIM@@",
        "?%?3?<?E?N?d?r?{?",
        ";$;,;@;T;\\;d;l;t;",
        "Migrated keys: %d, values: %d",
        "8<9p9",
        "?,?<?L?\\?l?|?",
        "5*5t5",
        "NtPowerInformation",
        "fr-BE",
        ".?AV_WmiProperties@WMI@@",
        "Error removing driver: DismRemoveDriver failed. hr = 0x%08X",
        "??_D?$Array@G@UnBCL@@QAEXXZ",
        "\\windows\\system32\\config\\SOFTWARE",
        "ERROR_SYSTEM_DEVICE_NOT_FOUND",
        "8%8+81878=8C8I8O8U8[8a8g8m8s8y8",
        "Cleanup operation \"%s\" will cleanup:",
        "base\\ntsetup\\opktools\\sysprep\\platform\\sysprepsession.cpp",
        "0\"0,02070@0T0_0i0v0",
        "7$7*7/7@7K7Y7x7",
        "CopyDirectoryFileCallback: Unable to %s file from [%s] to [%s]; GLE = 0x%x",
        "?>?C?",
        ".?AVCXXXXXHandledException@?2??pReadPageFileSettingsAndWriteToConfigFile@@YGJPAVString@UnBCL@@0@Z@",
        "SmVirtDiskPooledDiskEnumerator::Initialize: Can't get parent disk storage pool (0x%08x)",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *> *)",
        "ERROR_SEEK",
        "0.040;0]0",
        "FlushTimer",
        "2$2W2\\2",
        "4*414F4M4T4_4j4r4y4",
        "%s\\%s [%s]",
        "2+222E2O2q2{2",
        "SetCheckpoint: Sequence is disabled.",
        "D$HhX",
        "void __thiscall UnBCL::Array<class CProfileInfo *>::RemoveAt(int)",
        "3B3I3s3",
        "/na:DeviceLayout/na:Partitions/na:Partition",
        ".?AV?$DefaultInstanceFactory@VCNewSystem@@@UnBCL@@",
        "2C2S2n2s2",
        "OC::COCCbsAdapter::SearchFoundationPackageName: ICbsSession::LoadFromStringId failed %X.",
        "Error while enumerating first/next image for server %s. Error: 0x%08X",
        ">.>f>u>",
        "4<4X4",
        "diagnostics.dat",
        "VVVh<",
        "ERROR_DS_NAME_VALUE_TOO_LONG",
        "8@8o8v8~8",
        "CSetupPlatform::CreateNewSystem: Failed to set image index. hr = 0X%x",
        "5-575?5E5K5X5f5m5{5",
        "class CCopyInfo *const *__thiscall UnBCL::ArrayList<class CCopyInfo *>::GetBuffer(int) const",
        "%hs: all services running",
        "FIOReadFileIntoBuffer",
        "ERROR_JOIN_TO_JOIN",
        "ERROR_SXS_XML_E_UNCLOSEDSTRING",
        ".?AV?$ArrayListEnumerator@W4OP_EXECUTION_PHASE@@@_@UnBCL@@",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,&protected: static struct HKEY__ * __stdcall UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,class ATL::CElementTraits<struct HKEY__ *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *> *,class UnBCL::Array<struct HKEY__ *> *,int)",
        "WinHttpSetCredentials",
        "5*575@5Q5",
        "Failed to allocate memory for privilege tokens.",
        "WIMBoot.backup",
        "ERROR_DRIVER_CANCEL_TIMEOUT",
        ".?AV?$SmartPtr@U?$IDictionaryEnumerator@PAVString@UnBCL@@PAVCSPInternalPluginData@@@UnBCL@@@UnBCL@@",
        "GetSizeOfWinRE: Failed to set WIM temp directory to %s (0x%08x)",
        "0%0+0?0G0N0W0f0q0}0",
        "0'0/060D0R0Z0`0e0y0",
        ":#;d;",
        "ERROR_INVALID_STACKSEG",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCWIMBootData@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        ".?AV?$Array@PAVDiskLayout@@@UnBCL@@",
        "8l9z9",
        "041`1q1",
        "SclFsProcessVolume",
        "class SysprepAction *__thiscall UnBCL::_::ArrayListEnumerator<class SysprepAction *>::get_Current(void) const",
        "6)6@6N6n6",
        "Migrate boot settings",
        "7'797K7]7d7",
        ">,>5>=>D>W>`>{>",
        "%hs: Failed to read the new OS entry GUID from %s. hr = 0x%X",
        "?$?9?R?j?w?~?",
        "tU9q0uPV",
        "ERROR_FILE_SYSTEM_LIMITATION",
        ".?AU?$ICollection@PAVCCleanupEntry@CSimpleCleanup@@@UnBCL@@",
        "<unavailable>",
        "808l8",
        "SEH: Attempting to upload diagnostic data",
        "CNewSystem::QueueAddCbsPackage",
        ".?AVCXXXXXHandledException@?BCC@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "<&<:<A<G<L<W<b<g<{<",
        "y&Shh",
        "xConfigure Safe OS for auto-unlock",
        "JET_errLVCorrupted",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAJ@Z",
        "provider",
        "6.6<6V6b6q6",
        "Disk I/O time = %lld ms, File I/O time = %lld ms",
        "8&8;8C8I8R8h8",
        ".?AU?$IEnumerable@W4OP_EXECUTION_PHASE@@@UnBCL@@",
        "pAddSafeOSDriversFromProvPackage: Failed to create driver directory %s (0x%08x)",
        "8H8M8k8p8",
        "9\\$0t]",
        "null dictionary to Hashtable constructor",
        "Check snapshot [%s]",
        "j<hX%^",
        "%hs: Failed to validate package path [%s]. Error: 0x%08X",
        "252E2b2",
        ":1:B:I:_:z:",
        "{D5977B97-7AF2-4963-9437-5DA896D94328}",
        "enum MIGSTATUS __stdcall SPExecuteOOBEBootApply(int,class UnBCL::String *,class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *> *,enum SetupPlatform::SP_MIG_SCOPE,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::ArrayList<class CWIMBootData *> *,class UnBCL::String *,int,int *,struct ISPTelemetryData **,struct ISPMigProgress *,long *)",
        "00080@0H0P0`0",
        "int __stdcall UnBCL::MP::ThrowCompare<struct SetupPlatform::IPartition *>::Compare(struct SetupPlatform::IPartition *,struct SetupPlatform::IPartition *)",
        "9\"9/9P9]9x9",
        "Opening DISM session for the source system (Online)",
        "919Y9f9",
        "\\ArcName\\multi(0)disk(0)rdisk(1)",
        "NtEnumerateDriverEntries",
        "ZwSaveKey",
        "8I8P8V8[8f8p8",
        "3+393",
        "CBS_E_INVALID_DRIVER_OPERATION_KEY",
        ".?AU?$IList@G@UnBCL@@",
        "int __thiscall UnBCL::ArrayList<class CFailForwardSystem *>::BinarySearch(int,int,class CFailForwardSystem *,struct UnBCL::IComparer<class CFailForwardSystem *> *)",
        "1#1@1K1k1q1",
        "656M6^6r6",
        "!p!q!r!s!t!u!v!w!x!y!z!{!|!}!~!",
        "SPAPI_E_FILE_HASH_NOT_IN_CATALOG",
        ":X:e:}:",
        "8-9T9",
        ".NET framework reinstalled successfully",
        "4!4'4,474B4Z4~4",
        "IMaintenanceSettings::put_Period failed. hr = 0x%x",
        "<!<*<3<S<a<s<|<",
        "ERROR_SERVICE_NOT_FOUND",
        "9I;,<3<O<",
        "%USERPROFILELINK%",
        "SetupPlatform: Executing first boot StopAsync commands.",
        "RtlInitializeResource",
        "ControlSet%03d\\Control\\ProductOptions\\",
        "[%s:(%d) -> %s] %s",
        "RemovedDriverClassName",
        "ERROR_CTX_LICENSE_NOT_AVAILABLE",
        "Found high watermark override: %I64u",
        "uFlightID",
        "<4<[<q<",
        "Uninstall data validated successfully",
        "SclpGetAndWriteBootEntry",
        "1<1d1l1t1|1",
        "Failed to set directory extended attribute",
        "SetupPlatform: Begin Pre-OOBE: Global progress: %u, Phase progress: %u",
        "1[1c1",
        "979>9D9I9U9c9l9r9",
        "<-<8<Q<X<^<c<k<u<",
        "+a,Y?",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::Resize(int,int)",
        "6!6,676K6`6w6",
        "4N4U4",
        "< <'<-<2<=<H<M<a<r<",
        "CSetupPlatform::CreateVirtualDisk: Can't initialize disk provisioning! Error: 0x%08X",
        ":/;N;",
        "DiskLayout::ApplyProperties: Failed to update partition type: 0x%08x",
        "4$4*404<4M4Z4a4l4",
        "=@=i=x=",
        "5)565^5",
        "    Failed to move to first attribute",
        "Open reg key value failed: 0x%x",
        "class UnBCL::DictionaryEntry<enum OP_OPERATION_ID,int> __thiscall UnBCL::_::HTEnumerator<enum OP_OPERATION_ID,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,class UnBCL::DictionaryEntry<enum OP_OPERATION_ID,int>,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<enum OP_OPERATION_ID,int> __stdcall UnBCL::Hashtable<enum OP_OPERATION_ID,int>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "    Failed to move to next attribute",
        "CCreateScopedSnapshot::DoExecute: Failed to get snapshot creation time, use current time as snapshot creation time. Error: 0x%08X",
        "0'0-020C0N0\\0",
        "Unable to get procedure InitializeCSI_BROKEN_COMPONENT",
        "5 5$5(5,50545<5@5D5H5P5T5X5\\5`5d5l5p5t5|5",
        "3)333<3E3^3o3",
        "4!4-444:4?4J4T4g4r4{4",
        "1(1=1K1R1Z1a1g1m1x1",
        "2)363M3k3",
        "7*72797G7X7`7n7",
        "FirstBootReason",
        "111G1m1t1z1",
        ";1;B;O;X;h;o;u;~;",
        ".?AVout_of_range@std@@",
        "SYSTEM16",
        ".?AV?$SmartPtr@U?$IEnumerator@W4OP_EXECUTION_PHASE@@@UnBCL@@@UnBCL@@",
        "ERROR_LOG_BLOCK_INCOMPLETE",
        "3&303<3H3T3]3i3u3~3",
        "1$1/1<1L1Q1`1g1w1",
        "=#=-=7=>=E=L=S=Z=a=h=o=v=}=",
        "RtlDllShutdownInProgress",
        "3 3$3(3,3034383<3@3H3P3T3\\3`3d3h3p3x3",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,&protected: static class CDriverInstallInfo * __stdcall UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,class ATL::CElementTraits<class CDriverInstallInfo *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        ".?AV?$SerializableBase@VCFileCreationData@@$0A@V?$DefaultInstanceFactory@VCFileCreationData@@@UnBCL@@@UnBCL@@",
        "%hs: Cannot set file attributes for %s. hr = 0x%08X",
        "=(=9=F=K=W=f=n=x=",
        "8&8C8u8",
        "en-JM",
        "ExtractFile",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@@UnBCL@@",
        ";o;v;",
        "2)2?2U2k2",
        "5,53595>5I5T5Y5m5",
        "displayName",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::set_Item(int,class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *)",
        ";2<><I<W<",
        ">!>'>;>G>\\>",
        "1N2c2",
        "ERROR_FILE_NOT_FOUND",
        "0,040<0H0P0p0",
        "8 8&8,82888>8D8J8P8V8\\8b8h8n8t8z8",
        "SP_ENV_UNINSTALL_CHECK_IGNORE",
        "IVdsVolume2",
        "3=3D3l3",
        ">->;>E>O>Y>c>z>",
        "=(>/>5>:>E>L>\\>p>z>",
        "6S6c6",
        "7,7d7l7t7|7",
        "Could not open HKLM\\System. Error: %u",
        "ERROR_VOLUME_CONTAINS_SYS_FILES",
        ".PAVCXXXXXHandledException@?2??SPCreateRegistry@@YGJPAVString@UnBCL@@00KPAEKH@Z@",
        ".?AV?$CAutoCleanupBase@PAU_ENUM_SERVICE_STATUSW@@@RAII@@",
        ";&;/;P;u;",
        ":*:<:D:J:W:i:",
        "ERROR_DS_LOCAL_ERROR",
        "=B=V=d=s=",
        "?MdDlu",
        "_amsg_exit",
        "5@5v5",
        ".?AV?$CAutoCleanupBase@PAE@RAII@@",
        "5I6e6",
        ".?AU?$IList@PAVCProfileInfo@@@UnBCL@@",
        ">K>S>`>h>q>z>",
        "SSWPj",
        "void __thiscall UnBCL::Array<unsigned short *>::Remove(unsigned short *)",
        "ReadBootCode: Unknown File System",
        "1?1F1L1Q1\\1g1l1",
        "CInstallDUUpdatesOffline::DoExecute: Cannot reset file attributes for %s. Error: 0x%08X",
        "const struct DiskMatchFilter &__thiscall UnBCL::ArrayList<struct DiskMatchFilter>::get_Item(int) const",
        "0f;2u",
        "CDiagnosticsHelper::Initialize: Failed to load diagnostics data, will generate clean data.",
        "4(4:4N4a4~4",
        "LP Validator: Failed to get packages using DISM API. Error: %08X",
        ">6>B>Z>g>~>",
        ".?AV?$Array@PAVCProfileInfo@@@UnBCL@@",
        "Microsoft",
        "SPExecuteCleanup: Failure while building path to clean up folder %s. Error: 0x%08X",
        "SL_E_INVALID_PRODUCT_KEY",
        "FailFast",
        "__thiscall UnBCL::ArrayList<struct _GUID>::ArrayList(const struct UnBCL::ICollection<struct _GUID> *)",
        "Failed flushing the file.",
        "yValidateUninstall",
        "    Failed to create wim file",
        "    Driver updates",
        "t@f90t;",
        "UnhandledExceptionFilter",
        "6 6'656=6G6O6V6f6n6",
        "6$61696x6",
        "ERROR_NOT_AUTHENTICATED",
        "?\"?0?=?O?W?]?j?|?",
        ".?AV?$SerializableArrayBase@PAVCCleanupEntry@CSimpleCleanup@@@_@UnBCL@@",
        "2,232<2B2W2n2~2",
        "psczPath",
        "=)===T=j=",
        ".PAVCXXXXXHandledException@?6??SPGetCBSCompletionStatus@@YGJPAVString@UnBCL@@0PAH@Z@",
        "0-0A0M0]0e0{0",
        "%hs: Error while setting remove windows.old value: 0x%08X",
        "%s: COM is already initialized in apartment-threaded mode.",
        "GroupID",
        "Creating Offline OC DISM adapter... ImagePath = %s",
        ">&>,>E>Q>Y>_>d>z>",
        "void __thiscall UnBCL::ArrayList<class OC::COptionalComponent *>::Resize(int,int)",
        "ERROR_SEM_OWNER_DIED",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *> *)",
        "Set reg key value WinRETime failed: 0x%x",
        "WinReHashWimFile",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@J@UnBCL@@@UnBCL@@",
        "Drivers",
        "\\sources",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::Add(class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *)",
        "enum OP_EXECUTION_PHASE __thiscall UnBCL::_::ArrayListEnumerator<enum OP_EXECUTION_PHASE>::get_Current(void) const",
        "ERROR_DS_DRA_INCOMPATIBLE_PARTIAL_SET",
        "1(1=1P1X1^1k1}1",
        "5$5Q5V5\\5b5h5n5t5z5",
        "w?r8C;]",
        "ERROR_IPSEC_IKE_UNEXPECTED_MESSAGE_ID",
        "6\"6X6l6",
        "GetSystemDiskNTPath: Found system disk at [%s].",
        "CDeploymentBase::StreamWrite: Failed to backup mount paths. Error: 0x%08X",
        "CopyFileDataCallback",
        "SysprepSession::ExecuteAction: Error bypassed for setValue operation",
        "ImageGetFileCount",
        "w|PPP",
        "212:2",
        "?SetValue@RegistryKey@UnBCL@@QAEXPBVString@2@H@Z",
        "Failed to open a handle to the OS loader element. Status = [%x]",
        "CRYPT_E_INVALID_NUMERIC_STRING",
        ".?AV?$SmartPtr@VIOCImageServicingAdapter@OC@@@UnBCL@@",
        "7$7(787<7L7P7`7d7t7x7",
        "ERROR_PROFILING_NOT_STOPPED",
        "pDUDownload: DUDownload aborted due to change in network policy",
        "?9?R?Y?`?f?r?",
        "7)757?7P7Y7b7o7x7",
        "|$ WW",
        "4 4$4(4,444X4`4|4",
        "ERROR_IEPORT_FULL",
        "j?[VP",
        "4-474J4X4b4n4z4",
        "3S4l4s4z4",
        "0^0p0x0~0",
        "void __thiscall UnBCL::ArrayList<class CAntiVirusInfo *>::set_Item(int,class CAntiVirusInfo *)",
        "=#>5>A>S>[>a>s>",
        "j?Yf9L0",
        "??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        "CSetupAutomation::GetDiskInfo",
        ".PAVCXXXXXTemp@?L@??SPWriteMigrationScope@@YGJPBG0W4SP_MIG_SCOPE@SetupPlatform@@@Z@",
        "<+<2<B<I<f<m<s<x<",
        "0(030>0D0X0b0l0|0",
        "636I6]6m6v6",
        "?(?H?P?X?`?p?",
        ".?AVCCmdLineManager@OC@@",
        "struct UnBCL::ISerializable *const *__thiscall UnBCL::ArrayList<struct UnBCL::ISerializable *>::GetBuffer(int) const",
        "#rSPo",
        "PVj@Z",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable<class UnBCL::String *,int>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,int> *,class UnBCL::Array<int> *,int)",
        "\\Microsoft\\Windows\\Setup\\SnapshotCleanupTask",
        "FindNextFileW",
        "{4E24387E-7341-42E7-B949-07890E8F0F85}",
        "SETUPCL",
        ">#?>?X?e?",
        "removed",
        "en-IN",
        "SVhp=",
        "5%595L5b5r5",
        "?*?<?D?J?W?i?w?",
        "ReAgent.dll",
        "ERROR_IPSEC_QM_POLICY_IN_USE",
        "CSetupPlatformOSSwitchCheckpoint::Rollback: An error occurred while processing the crash dump",
        "?SelectNodes@XmlNode@UnBCL@@QAEPAVXmlNodeList@2@PAVString@2@@Z",
        "SPCopyFilesAndFolders: Failed to build target file path %s ++ %s. hr = 0x%x",
        "ERROR_INVALID_DEVICE_OBJECT_PARAMETER",
        ".CRemoveFODPackage::DoExecute",
        "1&181S1w1",
        "Component update %s has cab file(s); will install each one",
        "pReadPageFileSettingsAndWriteToConfigFile: Failed to get PagingFiles value from %s: 0x%08x",
        "ERROR_STACK_OVERFLOW_READ",
        "sCApplyDrivers::CopyToDriverStore",
        "f[fYf",
        "6%6-626C6P6]6e6o6u6}6",
        "D$,_^[3",
        ".?AV?$DefaultInstanceFactory@VCStartSuspendedServices@@@UnBCL@@",
        "(%lx): Error setting default security info to [%ws]",
        "ERROR_PATH_NOT_FOUND",
        ".?AVWin32Exception@UnBCL@@",
        ".?AV?$Array@PAVCDrvStoreProperty@@@UnBCL@@",
        ":\":4:<:B:O:a:o:|:",
        "?SelectNodes@XmlNode@XmlLite@UnBCL@@QAEPAVXmlNodeList@23@PAVString@3@@Z",
        "SclpRemoveContextNoOps",
        ".?AV?$ArrayListEnumerator@PAVCOperationInfo@@@_@UnBCL@@",
        ":+:2:8:=:H:S:g:p:",
        "6.757S7Z7",
        "3a4u4",
        "CreateParallelDecodeInfo",
        ".?AVCXXXXXHandledException@?FD@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        ":1;F;R;",
        ".?AU?$IEnumerator@PAVCDriverInstallInfo@@@UnBCL@@",
        "2 2(242<2T2d2t2|2",
        "void __thiscall UnBCL::ArrayList<class CWIMBootData *>::RemoveAt(int)",
        "taj=R",
        "5!5v5",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CWIMBootData *>::Reset(void)",
        "CSetupPlatformInfo::SetCapabilities: Failed to get footprint capabilities; hr = 0x%08X",
        "Test package directory [%s] does not exist for [%s].",
        "netcfg*.etl",
        ".?AVCXXXXXHandledException@?5??ExecuteFailForward@CSetupPlatformPrivate@@IAEJHPAU_PROGRESS_DATA@SetupPlatform@@@Z@",
        "tDiskLayout::Execute",
        "8*878?8Q8Y8_8q8",
        "Set boot command %s for phase %s",
        "1\"1/191H1Q1W1d1j1o1",
        "3!464E4Y4c4j4p4u4",
        "=0=E=",
        "SYSTEM\\CurrentControlSet\\Control\\CrashControl",
        "ERROR_NOT_SUPPORTED_ON_STANDARD_SERVER",
        ".?AU?$IDictionaryEnumerator@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@",
        ">->K>}>",
        ";$;,;4;<;T;`;h;",
        "ERROR_HOTKEY_ALREADY_REGISTERED",
        "SPVolumeGetEncryptionStatus: Failed to detect volume encryption status: 0x%08x",
        "E(SVW",
        "ERROR_DS_SRC_OBJ_NOT_GROUP_OR_USER",
        "int __stdcall UnBCL::MP::ThrowCompare<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::Compare(class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *,class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *)",
        "int __thiscall UnBCL::Array<class CDriverInfo *>::Add(class CDriverInfo *)",
        "de-LI",
        "0=0r0",
        "929:9@9Q9X9c9t9|9",
        "0/0@0T0d0",
        "<%<=<x<",
        "505B5J5P5]5o5",
        "0\"040?0F0L0Q0\\0g0{0",
        "DiskLayout::VerifyLayoutModifyIndices: Failed to iterate over target disk partitions: 0x%08x",
        "9>:X:e:}:",
        "Failed to write log directory to %s. Error: 0x%08X",
        "9 9'999N9y9",
        "DllGetClassObject",
        "CSh,U",
        "OOBE\\SetupPlatform",
        "WimBoot capture failed because the format of wim file is not compatible!",
        "0M0y0",
        "8E8W8_8e8r8",
        "5,5S5",
        "2$2*2/2;2H2\\2f2m2s2x2",
        "rm-CH",
        "JET_errIndexInvalidDef",
        "SPDisableGlobalLoggerSessionOnline",
        "=@=H=P=d=l=t=",
        ":!:*:?:G:N:f:o:",
        ":=:Q:",
        "VERBOSE: Target %s already exists, we'll attempt a merge",
        ".PAVCXXXXXHandledException@?2??DoExecute@CEnableTelemetryForImage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "unsigned long __thiscall UnBCL::_::ArrayListEnumerator<unsigned long>::get_Current(void) const",
        "ERROR_DS_NONEXISTENT_MUST_HAVE",
        "4@4u4",
        "CSplitWIM::DoExecute",
        "929D9X9q9z9",
        "%hs: Args cannot be NULL.",
        "40484P4f4",
        "D$<9D$",
        "?/?K?U?_?e?r?",
        "void __thiscall UnBCL::ArrayList<struct PageFileDesc *>::QuickSort(class UnBCL::ArrayList<struct PageFileDesc *> *,class UnBCL::ArrayList<struct PageFileDesc *> *,int,int)",
        "CSIDL_PROGRAM_FILESX86",
        "class CDeploymentBase *const &__thiscall UnBCL::ArrayList<class CDeploymentBase *>::get_Item(int) const",
        ";\";B;U;\\;b;g;r;z;",
        "2'2/262A2L2Y2`2f2k2v2",
        "CDUDownloadProgressWrapper::Invoke: DUCancel failed after cancel event was set. hr = 0x%x",
        "ERROR_INVALID_ACCEL_HANDLE",
        "Inspecting disk %u",
        "WimbootProcessBeforeApply",
        "9+9=9[9g9y9",
        "y#Sj:h",
        "ConstructPartialMsgVA",
        "EXFAT",
        "SPAPI_E_DEVINFO_NOT_REGISTERED",
        "2%2+202<2H2\\2y2",
        "Connected-Standby device detected.",
        ".?AV?$SmartPtr@U?$ICollection@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@@UnBCL@@",
        "? ?$?(?0?4?8?<?D?H?L?P?T?X?\\?`?d?l?p?t?x?",
        "CheckProductKeyBlock",
        "KERNEL32.dll",
        "Insufficient resources for multithreaded chunked decoding; will skip!",
        "dstate",
        "<X=(>p>",
        "2)212;2M2h2p2w2}2",
        "5+676I6o6t6",
        "<%<0<D<_<",
        "{053047AF-6FAE-469A-A1B3-107FCC5BC053}",
        "InnerProgress",
        "t(9\\$",
        "?-?W?v?",
        "SysprepSession::ExecuteAction: Failed during startService operation; dwRet = 0x%x",
        "MoveDirectoryEx: Source: [%s], Dest: [%s] failed, hr = 0x%x",
        "RtlAddAccessAllowedAce",
        "CProcessDrivers::DoExecute",
        "class CDriverDetails *&__thiscall UnBCL::ArrayList<class CDriverDetails *>::get_Item(int)",
        ">(>@>}>",
        "636N6T6^6c6m6t6",
        "<+<4<:<G<M<R<c<n<|<",
        "74899p<",
        "FirstBoot-M2.etl",
        "  Package path: %s",
        "9%999G9L9W9v9",
        ".PAVCXXXXXHandledException@?KC@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "MoveCaptureNode",
        "%hs: Profile for %s(%s) has been moved. Expected linked profile from %s to %s but the link is different. Uninstall validation will fail.",
        "Created telemetry file %s successfully.",
        ".?AV?$CAutoRelease@PAUIDeviceIdDatabase@@@RAII@@",
        "<'</<:<E<Q<Y<d<m<w<",
        "3$3,383@3X3",
        "^9sDt",
        ";E;Q;d;p;z;",
        "WinSetupBoot",
        "ERROR_MUI_INVALID_RC_CONFIG",
        "IVdsAdvancedDisk2",
        "void __thiscall UnBCL::ArrayList<struct UnBCL::ISerializable *>::Insert(int,struct UnBCL::ISerializable *)",
        "868S8[8",
        "CUninstall::RemoveUninstall: Failed to delete old WinRE hash: 0x%08x",
        ".?AV?$DefaultInstanceFactory@VCWinOldCleanup@@@UnBCL@@",
        "6*6R6g6",
        "<4<\\<",
        "CMediaLayout::QueueInstallImage: Failed to open %s: 0x%08x",
        "CopyFileExW",
        "Footprint.Basic",
        "DUCancel",
        "SVWj8j",
        ";';-;2;C;N;\\;",
        "struct SPGetPartitionOrdinal::PartitionInfo &__thiscall UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::get_Item(int)",
        "ClassGUID",
        "Copy operation failed. Error: 0x%08X",
        "ERROR_INSTALL_LOG_FAILURE",
        "szFormat",
        "3X3e3}3",
        "xCSetupAutomation::SetImageIndex",
        "ERROR_INSTALL_USEREXIT",
        ".?AV?$CAutoRelease@PAVVdsVolumePathEnumerator@@@RAII@@",
        "QQQQPQQ",
        "2(2>2R2\\2c2i2n2y2",
        ";!;';,;7;E;Y;a;",
        "CInstallDUUpdatesOffline::DoExecute: Failed to add driver update. hr = 0x%x",
        "D$$Xf",
        "=#=(=<=F=`=g=m=r=}=",
        "BootLogLastErrorEventCode:%d",
        "CSetupPlatform::CreateNewSystem: Failed to set ImageInfoSet. hr = 0X%x",
        "Start type is now %u",
        "<$<,<8<X<`<h<p<x<",
        "7(787L7Y7^7",
        "4 4$4,4044484@4D4H4L4P4T4X4\\4`4d4h4l4p4x4|4",
        "F,;G,",
        "SPDeleteSnapshot: Failed to convert ID to VSS_ID. Error: 0x%08X",
        "7\"7S7v7",
        "Failed to set USB target name. Status = 0x%X",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@@UnBCL@@@UnBCL@@",
        "Set reg key value StackWalkingFilter failed: 0x%x",
        "    Failed to write file",
        ">5>b>j>y>",
        "9$9(989<9L9P9`9d9t9x9",
        ";!;1;;;M;U;[;e;o;",
        "VWhd\\",
        "WinREPhaseSkip",
        "3:3E3P3o3z3",
        "Failed to get Delete other snapshot OneSetting, 0x%x",
        ">*>v>}>",
        "9!:{:",
        "VdsDisk::Initialize: Failed to query IID_IVdsSwProvider interface [%s] (0x%08x)",
        "VDisk file %s no longer exists; hence no disk to enumerate",
        "<$<0<8<K<{<",
        "7\\;`;d;h;l;p;t;x;|;",
        ".?AVCXXXXXHandledException@?2??SPCreateFile@@YGJPAVString@UnBCL@@K0H@Z@",
        "void __thiscall UnBCL::ArrayList<class CCopyInfo *>::set_Item(int,class CCopyInfo *)",
        "Provider",
        "UTF-8",
        "software\\Microsoft\\Windows\\CurrentVersion\\Diagnostics\\Diagtrack",
        ";*;7;@;Q;g;|;",
        ".PAVCXXXXXHandledException@?2??SetUpCbsLogging@CReconstructOS@@IAEJPBGPAH@Z@",
        "ERROR_UNABLE_TO_INVENTORY_SLOT",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::Insert(int,class UnBCL::DictionaryEntry<class UnBCL::String *,int> *)",
        "SPApplyDeviceLayoutDiskConfig: Failed to validate input DeviceLayout (0x%08X)",
        "=$=8=@=G=U=_=r=",
        "4)4U4m4",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCCleanupEntry@CSimpleCleanup@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "='=-=:=L=Z=g=y=",
        "number 0x%x",
        "ERROR_TXF_ATTRIBUTE_CORRUPT",
        "3\"3.3:3C3O3X3d3p3|3",
        "sv-SE",
        "void __thiscall UnBCL::ArrayList<unsigned short *>::Insert(int,unsigned short *)",
        ".PAVCXXXXXTemp@?KK@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "CMediaLayout::ExecuteOptimization: Failed to get driver path at index %d: 0x%08x",
        "D$<Ph",
        "%hs: Failed to open BCD's %s entry. Status = 0x%08X",
        "Resource files missing from %s. These files are required for some editions of Windows. If you are servicing older versions of Windows, you can ignore this message.",
        "1%1=1B1Y1n1t1",
        "Copying resource files from %s to %s...",
        "Ph0Wb",
        "void __thiscall UnBCL::ArrayList<unsigned int>::CopyTo(class UnBCL::Array<unsigned int> *,int) const",
        "6@7O7",
        "Start service: %d",
        "?\"?)?3?@?G?Q?b?o?y?",
        "5+5=5E5K5X5j5",
        ";0;d;",
        "NtModifyDriverEntry",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::RemoveAt(int)",
        "OC::COCCbsAdapter::CbsUpdateToOC: current status is %s",
        "; ;4;<;D;T;`;h;",
        "<S=g=y=",
        ".?AVStringProperty@?1???$pDefineStringProperty@V<lambda_b575957851718b12a9a1a96ff5ab41c6>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_b575957851718b12a9a1a96ff5ab41c6>@@@Z@",
        "9E4uFj",
        "CSysprepSpecializeOffline::DoExecute: Failed to create working directory %s",
        "4#404?4[4c4m4u4",
        ":#;c;u;};",
        "9)999E9R9b9s9z9",
        "hwexclude.txt",
        "5,565@5J5T5k5y5",
        "void __thiscall UnBCL::_::ArrayListEnumerator<enum OP_EXECUTION_PHASE>::Reset(void)",
        "?get_Item@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEAAPAVString@2@H@Z",
        "FveDetectTelemetry",
        ".?AV?$SmartPtr@VCCmdLineExecutionTelemetryData@OC@@@UnBCL@@",
        "Processing driver packages...",
        "{779E4904-02C8-4293-88E9-CC68D02ABB38}",
        "NtFsControlFile",
        "?&?+???N?g?p?",
        "8 81888>8C8N8U8i8",
        ";H;\\;i;s;",
        "{B815E158-A4AE-4A59-80FA-3B6EF494ECD2}",
        "CSetupAutomation::CacheInstallTarget: Failed to get partition drive letter: 0x%08x",
        ">!>(>/>6><>G>i>~>",
        ".?AV?$CAutoWdsLibFree@PAU_BCDE_DEVICE@@@RAII@@",
        "FOD Validator: Forcing validator failure due to environment variable.",
        "0'0C0X0]0g0",
        "Servicing\\cbs_pbr_package_list.txt",
        "0#1-1O1V1\\1a1l1s1",
        "=->A>f>",
        "\\Windows\\Assembly\\",
        "JET_errIllegalOperation",
        "=$=,=4=@=H=d=t=|=",
        "4 4'4;4N4{4",
        "CExecuteUnattend::DoExecute: Couldn't deserialize unattend context: 0x%08x",
        ".PAVCXXXXXTemp@?CCC@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ":&:A:O:f:",
        "]{F8F1CD5F-0BAE-43F1-897D-1374A749B5C3}",
        "Fail to convert snapshot ID to GUID string",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::Insert(int,class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *)",
        "3 444<4D4L4T4`4h4",
        "Failed listing packages",
        "?#?.?B?S?Z?`?e?p?{?",
        ";-;7;J;Y;`;f;k;v;",
        "int __stdcall pEvalFilter(const struct DiskMatchFilter &,struct SetupPlatform::IDisk *)",
        "jA^f;",
        "4'444l4y4",
        "sIsReadOnly",
        "CInfFile::IsApplicableToDevice: Failed when trying to parse %s; hr = 0x%08X",
        "182A2g2v2",
        "7#7Y7",
        "2(2,2D2T2d2t2",
        "??0ArgumentOutOfRangeException@UnBCL@@QAE@PBG@Z",
        "Critical_SafeOS",
        ";\";3;>;L;x;",
        "stat. failed",
        "CFailForwardSystem::QueueRegisterSyncProcess",
        "ntldr",
        "PolicyManager_GetPolicyInt",
        "CProvisioningElement::LinkPayload",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback:  \"%s\" does not exist.",
        "int __thiscall CFlowValidator::DoesOperationExist(class COperationQueue *,enum OP_OPERATION_ID)",
        ":/:5:K:\\:i:",
        "2'20252;2M2u2",
        "StateStoreGetMountedImageWimbootEntries",
        "2(232K2[2",
        "CApplyDrivers::CopyToDriverStore: Failed to create secure path %s. Error: 0x%08X",
        "D$ ;D$",
        "2.2C2R2\\2a2i2p2|2",
        "CDeploymentProject::Release: Failed to delete temporary directory [%s]. Error: 0x%08X",
        "<\"=(=-=C=",
        "%hs: SPGetOSInformation failed with for new OS with error: 0x%08X",
        "??0NotSupportedException@UnBCL@@QAE@PBG@Z",
        "747I7Q7W7d7s7",
        "?+?<?O?j?p?",
        "1/1D1b1l1x1",
        "Failed to get system store path. Status: %x",
        "VdsPartition::GetProperties: Couldn't get volume properties (0x%08x)",
        "MSPEstimateSizeOfWIMBootRecompress",
        "QueueOCReplication called for fail-forward system %s",
        "1%1P1Y1l1~1",
        "ApplyPartitionProperties: Failed to get volume from target partition (0x%08x)",
        "5*515H5^5d5v5",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$ArrayList@PAVCDriverDetails@@@2@@UnBCL@@@UnBCL@@",
        ":,;B;K;q;",
        "CNewSystem::QueueSetupAutomation: Failed to get driver %u: 0x%08x",
        "0 0'0-020>0I0]0m0",
        "ERROR_INVALID_SHOWWIN_COMMAND",
        "?/???H?f?",
        "</=?=S=j=",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::Add(class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *)",
        "2 2-2A2Q2]2m2t2",
        "Parts of the uninstall infrastructure are missing",
        "ERROR_SXS_XML_E_MISSINGROOT",
        "5+5=5g5",
        "void __thiscall UnBCL::ArrayList<class CProfileInfo *>::Insert(int,class CProfileInfo *)",
        "1 1n1",
        "3 3<3f3s3N4c4i4",
        "20242L2P2h2l2",
        ".?AU?$IEnumerator@PAVCAppInfo@@@UnBCL@@",
        "0 0,0L0T0\\0d0p0",
        ".?AVCXXXXXHandledException@?2???0CUninstall@@QAE@PAVString@UnBCL@@H@Z@",
        "ERROR_CLASS_DOES_NOT_EXIST",
        "Cannot get volume name for the WIMBoot partition. Error: 0x%08X",
        ":(:^:",
        "SetupCl hive file not found; no stored changes",
        "j?Yf97tQ",
        ";';1;;;E;S;Y;_;d;n;x;",
        ">Q>a>{>",
        "SMI data results dump: Context description = %s",
        "MigShutdown",
        "0 1k1",
        "t%Vh0I",
        "LockResource",
        "unsigned int *__thiscall UnBCL::ArrayList<unsigned int>::GetBuffer(int)",
        "4#4*40464B4L4_4l4y4",
        "Exist",
        "base\\ntsetup\\setupplatform\\lib\\src\\reconstruction.cpp",
        "545;5B5H5T5f5t5",
        "_TmpHive_",
        ".?AV?$Array@PAV?$DictionaryEntry@KPAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        ".PAVCXXXXXTemp@?GE@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        ": :$:(:,:0:4:8:<:@:D:H:L:T:X:\\:`:h:l:p:t:x:|:",
        ".PAVCXXXXXHandledException@?ID@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "93:D:/;d;",
        "{3B3F3583-20D8-484C-9183-CD2693A051A2}",
        "pCreateSystemRootDriveMapping: SystemRoot detailed mapping is [%s] -> [%s]",
        "CSetupPlatformTracing::SetRegFile",
        "CSetupAutomation::SetDUOptIn: Only SP_DU_OPTIN_CRITICAL and NONE are currently supported",
        "CRelocateOS::ProcessJournalEntries",
        "GetFileInformationByHandle failed",
        "5 5&515<5B5V5]5e5l5s5~5",
        "Failure while requesting OC payload copy. Error: 0x%08X",
        "8B8I8W8g8{8",
        ">3>H>P>V>c>u>",
        ".PAVCXXXXXTemp@?BA@??DownloadDynamicUpdates@CSetupPlatform@@IAEJPBUImageInfo@DU@@KPBGHPAUIDownloadCallback@SetupPlatform@@PAUIExecutionContext@@PAXPAUIGenericProgress@6@PAPAUIDUPackageCollection@6@@Z@",
        "CSetupAutomation::ResolveTarget: Failed to find a suitable target drive: 0x%08x",
        "sr-Latn-BA",
        "Failed to restore one of the WIMBoot files.",
        "Failed getting status for package state query.",
        "VdsDisk::CreatePartition: Can't create partition (0x%08x)",
        "%hs: %s does not exist, uninstall validation will fail.",
        "= =+=0=D=n=u={=",
        "CPidgenxExtractor::~CPidgenxExtractor",
        "_except_handler4_common",
        "8)8>8D8X8o8",
        "989X9",
        "NtTranslateFilePath",
        "0 0004080P0`0d0h0p0",
        "Attempting to resurrect a new system from %s",
        "Creating Filterpages key failed with error 0x%08X. ",
        "PRVQWj+",
        ".?AV?$DefaultInstanceFactory@VCSplitWIM@@@UnBCL@@",
        ":\":(:4:B:J:T:\\:b:g:x:",
        "<(<:<K<R<h<",
        "j8j[h",
        "=J=j=",
        "CRYPT_E_ALREADY_DECRYPTED",
        "<?<L<p<",
        "ybase\\ntsetup\\setupplatform\\lib\\src\\licensing.cpp",
        "ActionPlatform::StopService: Failed to stop service %s; dwRet = 0x%x",
        "ERROR_CLUSTER_CANT_DESERIALIZE_DATA",
        "/050;0A0G0M0",
        ":C;K;P;Y;w;",
        "1i2n2",
        "9#929:9D9T9\\9r9",
        "4$4,484X4`4h4p4x4",
        "=X>0?",
        "ERROR_CTX_CLIENT_LICENSE_NOT_SET",
        ":!:&:2:9:?:D:P:W:]:b:n:u:{:",
        "GetSecurityDescriptorDacl",
        "5\"5b5i5o5t5",
        "KtmW32.dll",
        "GL_^[",
        "5$5+5;5J5V5`5q5z5",
        "int __stdcall SPIsPathInsideFolder(class UnBCL::String *,class UnBCL::String *)",
        "VdsDisk::Initialize: Failed to get disk properties (0x%08x)",
        "void __thiscall UnBCL::Array<class OC::COptionalComponent *>::RemoveAt(int)",
        "828i8p8v8{8",
        "???R?`?n?",
        "0#0Y0",
        "2E3x3",
        "8!8D8x8",
        "CRelocateOS: Source path %s does not exist",
        "    Failed to recursively remove directory",
        "int __thiscall UnBCL::ArrayList<class ISPPluginData *>::LastIndexOf(class ISPPluginData *,int,int) const",
        "CGatherData::DoExecute",
        "Cannot find [%s], there are no filters to restore",
        "ExecutingRollback",
        "D$<;D$",
        "Set reg key value IsLowDiskUpgrade failed: 0x%x",
        "<F<M<S<^<j<v<",
        "ERROR_DS_INVALID_GROUP_TYPE",
        "5,5o5w5",
        "struct PageFileDesc *&__thiscall UnBCL::ArrayList<struct PageFileDesc *>::get_Item(int)",
        "FlushFileBuffers",
        "?IsEnvironmentVarSetTrue@Environment@UnBCL@@SGHPBVString@2@H@Z",
        "=%=,=7=I=Q=W=k=",
        "7(7.7:7D7K7Q7V7^7e7|7",
        "OPERATIONTRACK: Enqueue Operation: %3d|%s",
        "ERROR_COMPRESSION_NOT_ALLOWED_IN_TRANSACTION",
        "314E4",
        "VdsDisk::PrepareForWipe: Failed to unmount volume path [%s] (0x%08x)",
        "3)34393M3U3f3o3u3",
        "GetExitCodeProcess",
        "CreateCustomPartitions",
        "1[1d1q1",
        "6!6)606e6",
        "Local\\SetupVolumeAccessMapping",
        "0#0>0`0i0v0",
        ">1>;>O>k>",
        "Apply (first boot apply from ICB, online phase): Migration phase failed. Result: %d, specific error: 0x%08X",
        "4\"4@4G4V4a4u4",
        "8\"8/8C8K8R8Y8d8q8",
        "lt-LT",
        "1V1i1v1",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@PAUIOperationsProgress@SetupPlatform@@K@UnBCL@@@UnBCL@@",
        "SPAPI_E_DRIVER_STORE_DELETE_FAILED",
        ".?AU?$ICollection@_J@UnBCL@@",
        "void __thiscall UnBCL::Array<__int64>::InitLarva(class UnBCL::ArrayList<__int64> *)",
        "void __thiscall UnBCL::ArrayList<class SysprepAction *>::set_Item(int,class SysprepAction *)",
        "OC::COCCbsAdapter::InitOnline: CoGetMalloc failed. hr = 0x%x",
        "jYjoQP",
        "535@5E5N5^5e5k5p5~5",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long>,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> __stdcall UnBCL::Hashtable<class UnBCL::String *,unsigned long>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,class ATL::CElementTraits<unsigned long> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "SPFindSnapshotProp: Search snapshot [%s]",
        "Cannot install DUs for SetupPlatform because %s is not writeable dir",
        "Matching source and target OCs by name...",
        "SPGetVolumeStableGuidStringFromVolumeName",
        "%hs: Migrating drivers: %s",
        "5?5Q5Y5_5l5~5",
        "DiskLayout::ExecModifications: Operation cancelled",
        ":):9:F:V:b:j:x:",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::RemoveAt(int)",
        "SMI data results dump: Source = %s",
        ";\"<?<s<",
        "int __thiscall UnBCL::Array<struct SetupPlatform::IDisk *>::Add(struct SetupPlatform::IDisk *)",
        "A0W0{0",
        "Failed to validate boot manager checksum (%s)! Error code = %#x",
        "<$<*<7<I<W<i<",
        "SVWhP",
        "RPC_S_INVALID_RPC_PROTSEQ",
        "0)0x0",
        "WmiAssociation::MoveNext: Can't get first property name (0x%08x)",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::IndexOf(class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *,int,int) const",
        ">\">6>>>E>m>u>",
        "1 1'1-191E1y1",
        ";/;6;F;",
        "?'?@?F?O?Z?",
        "=<=N=\\=j=x=",
        "Failed to get ramdisk device string. Error: %d",
        "SysprepSession::CreateSession: Win32 error (%d), could not create session",
        "6&676>6a6v6",
        "6!6-6A6J6S6n6",
        "9!9-999E9Y9e9q9z9",
        "ZwQueryValueKey",
        "<0<@<D<T<d<h<",
        "989B9O9U9\\9f9s9z9",
        "sr-SP-Latn",
        "=;=Y=c=h=m=",
        "GetSystemPartitionPath: Unable to find DOS drive path for system partition [%s].",
        "UIA_WindowPatternEnabled",
        "OrchestratePublishWnfDwordData: Failed to get handle to ntdll.dll",
        "Verbose: Will consider this as a reference WIM",
        "7=8F8Z8}8",
        "VShh7",
        "class UnBCL::Object *__thiscall Mig::CKeywordTree::LookupKeyword(class UnBCL::String *) const",
        "ERROR_INVALID_SCROLLBAR_RANGE",
        "=&=9=A=H=V=d=l=z=",
        "CUpdateBootCode::DoExecute",
        "ERROR_INVALID_OPERATION",
        "??0ISerializable@UnBCL@@QAE@XZ",
        ".?AV?$CAutoRelease@PAVSPFreeDiskRangeEnumerator@@@RAII@@",
        "CUpdateBootCode::DoExecute: Try to repair BCD file due to potential corruption error",
        "CMergeWIM::DoExecute: Cannot set reference file %s to %s. Error: 0x%x",
        "CApplyDataOffline::UndoExecute",
        ".CSetupPlatformPrivate::RollbackOfflineCommon",
        "658<8",
        ".PAVCXXXXXTemp@?HL@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "1+1]1d1",
        "9*9A9M9\\9a9m9~9",
        "5\"525>5",
        "CDeploymentBase::CleanupMounts",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::set_Item(int,class UnBCL::DictionaryEntry<class UnBCL::String *,int> *)",
        ".?AV?$CAutoDeleteArray@G@RAII@@",
        "1 111F1N1T1a1s1",
        "5.6@6H6N6[6m6{6",
        "1#181@1F1S1e1x1",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *> *,int) const",
        "SPGetDevicePathFromVolumeName: Failed to query mounted device name. Error: 0x%08X",
        "ERROR_FULLSCREEN_MODE",
        "long __stdcall SPCreateFile(class UnBCL::String *,unsigned long,class UnBCL::String *,int)",
        "8(818:8K8T8]8f8o8x8",
        "2*242;2B2Q2\\2~2",
        "<\"<S<",
        "void __thiscall CSetupPlatformCheckpoint::CopyLogFiles(int,unsigned short,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *)",
        "List of debugger files is empty",
        "1)151I1j1",
        ".?AV?$CAutoRelease@PAVSmPartition@@@RAII@@",
        "ERROR_INVALID_MEMBER",
        "=)=/=9=>=H=O=]=o=",
        "5 5$54585H5L5\\5`5p5t5",
        "DiskLayout::ApplyProperties: Internal error: custom type data missing",
        "1 1,1L1X1|1",
        "Setup\\SetupCl\\PendingRequest",
        "1#1+12191D1U1]1c1h1|1",
        "Disk space needed   : %I64u",
        "?PAGEu",
        "CNewSystem::PreInitialize",
        "Hive file %s is in use; will attempt retries to ensure it is unloaded.",
        "DiskLayout::FindTarget: Unsupported diskmatch operator %u",
        "=(=H=P=X=`=p=",
        "Error executing file operations",
        "If-None-Match:",
        "Compact",
        "xSeSystemProfilePrivilege",
        "SVWh|z",
        "SP_ENV_PAUSE_BEFORE_FINALIZE",
        "SPWpeLogCallback: Unable to print WinPE bootstrap setting log message",
        ".PAVCXXXXXTemp@?3??DoExecute@CEnableTelemetryForImage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "?&?4?B?",
        "Operation completed successfully%s: %s",
        "Failed to lookup privelege! Error code = %#x",
        "10.0.14393.0.0",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAE@Z",
        "2\"2,262@2J2T2^2h2r2|2",
        "ERROR_DISCARDED",
        "x'hh`",
        ";-;4;A;I;h;|;",
        "<0<9<K<U<_<h<",
        "6O6\\6",
        "9$909<9H9T9k9x9",
        "QQVW3",
        "ERROR_LOG_ARCHIVE_NOT_IN_PROGRESS",
        "2&222<2X2",
        "5 535M5R5q5",
        "229879+4583620",
        "CSetupPlatform::Initialize: Failed to initialize diagnostics",
        "SmDisk::Wipe",
        "System32\\LogFiles\\WMI",
        "9$909<9H9V9^9l9t9}9",
        "717F7\\7d7q7",
        "t$0RW",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CAntiVirusInfo *>::MoveNext(void)",
        ":':8:?:U:p:v:",
        ".?AV?$DefaultInstanceFactory@VCAppXValidator@@@UnBCL@@",
        "OC::CDownlevelOCStore::GetOCCollection: Failed to get the OC collection.",
        "1A2y2",
        "8#8(838>8R8^8f8m8s8x8",
        "?'?3?A?I?S?`?h?o?",
        "LocalSize failed",
        "Cannot get the disk/offset for the recovery partition. Error: 0x%08X",
        "=$>?>W>\\>s>",
        "BcdCloseStore: Failed to acquire BCD sync mutant. Status: %x",
        "7#747;7Q7l7r7|7",
        "Could not save OC status. Error: 0x%08X",
        "SL_E_SRV_INVALID_LICENSE_STRUCTURE",
        "Finalize critical boundary",
        "Will add an extra error",
        "ERROR_PIPE_CONNECTED",
        "0)0V0g0n0t0y0",
        "2+2@2X2^2t2",
        "Fail to acquire access.",
        "8!838L8k8",
        ")Main apply (Machine Specific)",
        "515F5l5s5y5~5",
        "ERROR_INVALID_LDT_SIZE",
        "8'8-8b8t8",
        "Migrating SAM registry content",
        "SPFindVssSnapshot: Failed to create backup components. Error: 0x%08X",
        "ERROR_NO_SUCH_PACKAGE",
        "CSetupPlatformOSSwitchCheckpoint::Rollback: MoveFile(from \"%s\" to \"%s\") succeeded.",
        "ERROR_NON_MDICHILD_WINDOW",
        "LP Validator: Failed to find language package [%s]",
        ".?AV?$SerializableBase@VCSetupPlatformTracing@@$0A@V?$DefaultInstanceFactory@VCSetupPlatformTracing@@@UnBCL@@@UnBCL@@",
        "7$7,747<7H7P7h7",
        "<><a<",
        "ERROR_DUPLICATE_TAG",
        "BootStat\\PCAT",
        "4 424@4V4]4h4v4",
        "676A6J6T6`6l6",
        "ERROR_CLUSTER_PARAMETER_OUT_OF_BOUNDS",
        "SSSSSWPj",
        "? ?.?7?K?W?a?n?{?",
        "2$2D2K2Q2V2f2p2u2",
        "uMf9G",
        "ERROR_BAD_VALIDATION_CLASS",
        "%hs: Begin run. Package path: %s",
        ".?AV?$DefaultInstanceFactory@VCARPValidator@@@UnBCL@@",
        "4'4F4",
        "9P8t$",
        "CMediaLayout::ExecuteOptimization: Failed to query image information: 0x%08x",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCOperation@@@UnBCL@@@UnBCL@@",
        "SmPartition::Resize",
        ".?AV?$SerializableArrayListBase@PAVCOptionalComponent@OC@@@_@UnBCL@@",
        "PPPPj",
        ":$:,:0:4:8:@:d:l:p:t:x:",
        "SetupCloseInfFile",
        "%s returns: 0x%08X",
        "ERROR_DS_NAME_ERROR_NOT_FOUND",
        "Dependencies",
        "ERROR_DS_NONSAFE_SCHEMA_CHANGE",
        "?$?/?;?A?U?",
        "5/585A5J5X5h5}5",
        "6B6N6g6",
        "4%4B4O4[4g4p4y4",
        ".?AV?$SmartPtr@U?$IEnumerator@E@UnBCL@@@UnBCL@@",
        "Cannot find error code from WINDEPLOY. Will not attempt uninstall",
        "OrchestrateStartSystemServices: Timed out waiting for autostart services to start; timeout = %d ms.",
        "=5>L>S>Z>a>g>",
        "7=7R7Z7`7m7",
        ": :':9:@:",
        "swscanf_s",
        "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes",
        "SPTaskRemoveSnapshot: Snapshot Cleanup Task failed. hr = 0x%08X",
        "class DiskLayout **__thiscall UnBCL::ArrayList<class DiskLayout *>::GetBuffer(int)",
        ".?AV?$Array@I@UnBCL@@",
        "CPidgenxExtractor::Release: Unable to delete temporary directory.",
        "3$363F3S3[3s3x3",
        "kok-IN",
        "4$4+42484C4e4z4",
        "CUpdateBootSector::DoExecute: Failed to determine system volume path. Error code is [0x%X]",
        "= =D=L=T=\\=d=l=t=|=",
        "Download updates",
        "DOCTYPE",
        "ChunkWriterFlush",
        "<@<d<l<t<|<",
        "u jdP",
        "=B=^=~=",
        "97tXj",
        "long __thiscall CDeploymentBase::PreInitialize(class CSetupPlatformInfo *,class UnBCL::String *,const unsigned short *,int,int,int,int,int)",
        "base\\ntsetup\\setupplatform\\lib\\util\\registryutils.cpp",
        ">0>D>V>`>m>s>z>",
        ">#>9>O>a>i>o>|>",
        "SPFindVssSnapshot: Failed to initialize VSS for backup. Error: 0x%08X",
        "0 0'010B0O0Y0h0q0w0",
        "1=1`1",
        "D$4;D",
        "849[9",
        "SPMoveFile",
        "CApplyDrivers::CopyToDriverStore: Failed to bind offline servicing stack under %s. Error: 0x%08X",
        "Reference files:",
        "1(121G1N1T1Y1d1o1",
        "1A1^1e1}1",
        "2#2:2F2K2X2q2~2",
        "int __thiscall UnBCL::ArrayList<unsigned short *>::IndexOf(unsigned short *,int,int) const",
        "CFfuMiscHelpersT<class CEmptyType>::GenerateTempFileName",
        "JET_errAlreadyPrepared",
        "4!4*4?4L4U4b4k4x4",
        "SSShh",
        "4#484@4F4S4e4x4",
        "7#7;7u7",
        "0 0'0C0J0Q0\\0g0{0",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCMountedPathInfo@CDeploymentBase@@@UnBCL@@@UnBCL@@",
        ":!:7:O:\\:f:x:",
        "161V1{1",
        "Failed getting Identity as string",
        ":S:]:x:",
        "8/8l8",
        ".?AVCXXXXXHandledException@?2??DoExecute@CAddProvisioningPackage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "4,43494>4I4T4Z4n4",
        ">#>.>7>K>U>",
        ".?AU?$IList@PAVCCopyInfo@@@UnBCL@@",
        ";#;-;>;K;U;d;m;s;",
        "index out of range to ArrayList#RemoveAt",
        "LocalPayload\\Package",
        "en-ZW",
        "5%535S5s5",
        "SmDisk::InitializeProperties: Couldn't determine whether USB disk is internal (0x%08x)",
        "2-2<2M2|2",
        "CDeploymentProject::AddProvisioningPackage: Failed to check whether an ICB was already queued",
        ">\"?B?`?o?~?",
        "2#393",
        "7 7)7@7N7X7a7n7z7",
        "8!8)8^8w8",
        "ERROR_EC_CRED_NOT_FOUND",
        "070[0m0u0{0",
        "void __thiscall CCreateRegistryForNewSystem::StreamRead(class UnBCL::SerializationStream &)",
        "DiskLayout::Populate: Failed to enumerate partitions (0x%08x)",
        "6R6x6",
        "8(80878<8L8e8x8",
        ".?AV?$SmartPtr@U?$IDictionaryEnumerator@PAVString@UnBCL@@H@UnBCL@@@UnBCL@@",
        "ReorderContextInsert",
        "131G1N1U1\\1c1j1q1x1",
        "6+6@6T6k6z6",
        "j4h8#^",
        "7&868C8J8",
        "base\\ntsetup\\setupplatform\\lib\\tracing\\telemetry.cpp",
        "9 9,9o9~9",
        "int __thiscall UnBCL::ArrayList<class CInfFile *>::IndexOf(class CInfFile *,int,int) const",
        "SetupDiGetDeviceRegistryPropertyW",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCCleanupEntry@CSimpleCleanup@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCCleanupEntry@CSimpleCleanup@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        ".?AVCBaseInternalProgress@@",
        "9(:Q:",
        "SYSROOT",
        "CBootFilesRestoreCheckpoint::Finalize: Failed to mark system volume.",
        "class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::GetBuffer(int)",
        "3\"3)32393A3H3U3f3s3",
        "ERROR_DS_SHUTTING_DOWN",
        "ConfigFile",
        ".?AVCWDSImageInfo@@",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCGlobalPath@@@UnBCL@@@UnBCL@@",
        "{3E3FA923-444A-4FF2-93F5-D0AFEE933CB0}",
        "QueueAddCbsPackage called with path %s; install size %llu",
        ": :(:2:9:?:D:O:Z:n:z:",
        "=0=v=",
        ".?AV?$CAutoCleanup@PAX@RAII@@",
        "ERROR_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT",
        "3$343@3R3f3o3v3",
        "CCompressedStoreHeaderWriterT<class CEmptyType>::PreWrite",
        "tzm-Tfng-MA",
        "121<1T1}1",
        ".?AV?$CAutoCleanupBase@PAUIMigRegistryAccess@@@Mig@@",
        ":*:1:?:P:X:^:r:{:",
        "    Inbox support: %s%s",
        "4,404H4L4d4h4",
        "0%0,070?0G0^0e0k0p0{0",
        "333:3@3E3P3Z3j3q3w3|3",
        "VdsVolume::GetProperties: Failed to query access paths (0x%08x)",
        "OC Validator: Failed to revert execution of data gather operation. Error: %08X",
        ";&;.;@;H;N;`;q;~;",
        ".?AU?$IDictionary@GH@UnBCL@@",
        "SPValidateProductKey: An error occurred while fetching EulaType (a.k.a. ChannelType) for product key. (hr = 0x%X)",
        "FindAllPaths: Cannot find volume name for %s. Error: 0x%08X",
        "3*3:3A3G3L3Y3d3j3",
        ".?AU?$IList@PAVCInfFile@@@UnBCL@@",
        ";5;?;I;R;\\;e;o;",
        "6S6k6t6{6",
        ">4>_>u>",
        "ERROR_IPSEC_IKE_INVALID_KEY_USAGE",
        "Mappings",
        ":Z:g:",
        "JET_errInvalidFilename",
        "%hs: Source image path: %s",
        "Setup\\Status\\ChildCompletion",
        "CDownloadDUUpdates::DoExecuteInternal: Failed to remove DU folder %s when skipping DU",
        "?Clone@?$Array@PAVString@UnBCL@@@UnBCL@@UBEPAVObject@2@XZ",
        "class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::get_Item(int)",
        "?*?2?8?E?W?h?",
        "cs-CZ",
        ".?AVCXXXXXHandledException@?2??SPCreateRegistry@@YGJPAVString@UnBCL@@00KPAEKH@Z@",
        "%hs: Cannot delete temporary page file %s. Error: %u",
        "=\"=)=/=4=?=M=U=[=o=x=",
        "void __thiscall UnBCL::ArrayList<class CAntiVirusInfo *>::CopyTo(class UnBCL::Array<class CAntiVirusInfo *> *,int) const",
        "828H8l8s8z8",
        "3@3G3",
        ":$:,:4:L:d:|:",
        "WimAtExitInitialize",
        "void __thiscall UnBCL::Array<class CCFGSectionValue *>::Remove(class CCFGSectionValue *)",
        "No more nodes",
        "ERROR_INSTALL_SERVICE_FAILURE",
        "Setup platform version",
        "< <4<<<D<T<`<h<",
        ";$;,;8;X;`;h;t;|;",
        "7@7Y7d7o7|7",
        "CBS_E_INVALID_WINDOWS_UPDATE_COUNT",
        "7)757P7\\7h7t7",
        "8#878E8e8",
        "%hs: Not replacing the running OS, any online data migration request is not supported",
        "tLSSSS",
        ">4><>D>L>T>\\>d>l>t>|>",
        "policymanager.dll",
        "4 4)4=4B4K4U4e4j4z4",
        "4P9X9]9c9r9",
        ".?AU?$ICollection@UDiskMatchFilter@@@UnBCL@@",
        "9 9*939=9F9X9b9",
        "base\\ntsetup\\setupplatform\\lib\\src\\datamigration.cpp",
        "=0=D=L=T=\\=d=p=",
        "User profile suffix mismatch: upgrade asked for \"%s\", actual suffix is: \"%s\"",
        "3)3C3Q3d3y3",
        ";\";(;.;4;:;@;F;L;R;X;^;d;",
        "9 929:9@9M9_9m9z9",
        "1D1T1w1~1",
        ":4;r;y;",
        "QSVWj2^",
        ".?AU?$IEnumerator@PAVCRegCreationData@@@UnBCL@@",
        "< <*<8<X<}<",
        "D$(Pj",
        "2?2s2~2",
        "<4<C<H<f<x<",
        "%hs: Opening setupcl request key failed. Error: 0x%08X",
        "|$$WQQh",
        "= =;=A=K=P=Z=a=o=",
        "7'7/757J7[7p7x7~7",
        "8!858G8X8p8",
        "<WIM><TOTALBYTES>0</TOTALBYTES></WIM>",
        "ERROR_SXS_MISSING_ASSEMBLY_IDENTITY_ATTRIBUTE",
        "?Right@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@H@Z",
        ">)>1>F>N>X>i>v>{>",
        ":B:N:Z:f:r:~:",
        ";$;1;C;\\;{;",
        ".?AU?$IList@PAVCOSPieceInfo@@@UnBCL@@",
        ".?AV?$SerializableBase@VCRestorePageFileSettings@@$0A@V?$DefaultInstanceFactory@VCRestorePageFileSettings@@@UnBCL@@@UnBCL@@",
        ".?AV?$Array@PAV?$DictionaryEntry@GG@UnBCL@@@UnBCL@@",
        "4&4/4@4G4M4R4]4h4m4",
        "ERROR_INVALID_TASK_NAME",
        "02090?0D0O0Z0u0",
        "Unable to set start type %u. Error: %u",
        ".?AVCGlobalPathFindData@@",
        ">'>7>F>f>}>",
        ":\":':2:=:Q:d:",
        "(0R0e0x0",
        "9$:P:",
        ".?AV?$SerializableBase@VCCopyInfo@@$0A@V?$DefaultInstanceFactory@VCCopyInfo@@@UnBCL@@@UnBCL@@",
        "<`<r<z<",
        "ix out of range to ArrayList#P",
        "?$?8?u?",
        "pIterateAssociation: Iterator function failed (0x%08x)",
        "?%?8???J?U?`?t?",
        "6.6M6",
        "0,090A0Y0_0q0",
        "CApplyWDSImage::DoExecute",
        "D$8Pj",
        "Persisting diagnostics data to %s",
        "XMETADEP",
        "Fail to read WIM header",
        "Corresponding volume is also found.",
        "ERROR_IPSEC_TUNNEL_FILTER_PENDING_DELETION",
        "6,6K6",
        "ExecuteCommandFromLine:Invalid parameters",
        "class CFileCreationData *&__thiscall UnBCL::ArrayList<class CFileCreationData *>::get_Item(int)",
        "JET_errTermInProgress",
        "StateStoreSetMountedImageWimbootEntries",
        "?$?B?O?g?}?",
        "OC status result is: %s",
        "7,73797>7I7W7_7i7q7w7",
        "void __thiscall UnBCL::ArrayList<class DiskLayout *>::Insert(int,class DiskLayout *)",
        "%hs: Not able to submit Diagnostics Error Reporting. Erorr = %d",
        "9(:5:M:",
        "Failed to open process. Status: %x",
        "ERROR_BAD_PROFILE",
        "Total space estimate leaves low free space",
        "464^4{4",
        "9#9.979B9J9V9]9c9h9t9",
        "CFastDeleteImplT<class CDirectoryProviderT<class CWindowsOldAdaptor>,1>::MoveToScratch",
        ":%:+:0:;:C:H:\\:z:",
        "ChangeServiceConfig(%s,%u) failed with error %u",
        "GetCurrentThreadId",
        "3%3*363A3F3]3i3n3",
        "PathForNewOSFile%d",
        "No updates were found",
        "void __thiscall UnBCL::ArrayList<class CUserProfile *>::Resize(int,int)",
        "5 50585?5D5M5[5h5m5v5",
        ": ;8;K;|;",
        "878>8D8P8\\8",
        "ELEMENT",
        "ERROR_CTX_CLIENT_LICENSE_IN_USE",
        "PSShX",
        "%s\\%08d.xml",
        "pAddSafeOSDrivers: Failed to query ICB: 0x%08x",
        "SmPlatform::Initialize: Can't open SM API namespace %s (0x%08x)",
        "=8=@=H=\\=d=l=|=",
        "???J?X?f?t?",
        "?WithoutLongPrefix@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        "7*8?8Y8",
        "<?<N<X<",
        "4 5C5S5}5",
        "=!='=;=c=q=",
        ".?AU?$ICollection@PAVCPartitionInfo@@@UnBCL@@",
        "Cleanup Windows.old operation will cleanup:",
        "void __thiscall UnBCL::ArrayList<__int64>::RemoveAt(int)",
        "Setup\\FirstBoot\\Services",
        ";&;,;3;=;J;Q;[;l;y;",
        ">9sPt",
        "6M6_6g6m6z6",
        "JET_errLSAlreadySet",
        "2,2x2",
        ";t$ r",
        "CDeploymentProject::Initialize: Failed to initialize disk platform (0x%08x)",
        "SclRegProcessKeySubkeys",
        ":H:U:m:",
        "5M6T6h6t6|6",
        "Bugcheck stack",
        ";%;8;G;^;e;w;",
        "=+=3=C=J=P=U=a=l=",
        "VdsPlatform::ComputeHostInfo: Failed to get windows directory (%u)",
        "<6<b<",
        "555K5Y5k5t5",
        "5O5a5i5o5|5",
        "FveGetAuthMethodInformation",
        "2%2+292m2y2",
        "1*141?1f1",
        "8$8.888F8L8R8W8a8k8u8",
        "Failed to get element device type. Status = [%x]",
        "CNewSystem::QueueDataMigration",
        "|$0+|$",
        ".?AV?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@",
        "Failed adding FoD package: %ws",
        "ERROR_RESOURCE_DATA_NOT_FOUND",
        "3 34383P3T3l3p3",
        "=$=8=U=s=",
        "{CF82178E-7628-417A-847B-744C680032F6}",
        " 080?0M0Z0l0{0",
        "base\\ntsetup\\migration\\setup\\oc\\lib\\src\\cryptoutil.cpp",
        ".?AVCMoveWIMBootEntriesAndPartition@@",
        "0B0O0a0i0o0|0",
        ",*~_i",
        "<)<3<G<g<z<",
        "?@?M?_?g?m?z?",
        "SVhh;",
        ";*;O;V;\\;a;l;r;",
        "; ;;;A;K;P;Z;a;o;",
        ">\">*>0>D>J>S>i>v>",
        ".?AV?$Array@PAVCGlobalPathFindData@@@UnBCL@@",
        ".?AUIUnknown@@",
        "7A7H7N7S7^7d7w7",
        "5 5-535:5D5Q5X5b5s5",
        "SclGrowPartition",
        "<N=S=b=i=|=",
        "%s\\SetupPlatform.exe /communication",
        "DeleteObject",
        "WIMBoot.Relocated",
        "6C6\\6o6",
        "D$hPh",
        "CSetupAutomation::Resurrect: Couldn't find original answer file after fixing path to %s",
        "ERROR_RESOURCE_LANG_NOT_FOUND",
        "3 3$3,3034383@3D3H3L3P3X3\\3`3d3l3p3t3x3|3",
        "SPGetPartitionOrdinal: Failed to get the properties for partition %u: 0x%08x",
        "SL_E_RIGHT_NOT_GRANTED",
        "ERROR_FILEMARK_DETECTED",
        "Gather statistics: offline",
        "sr-Cyrl-BA",
        "? ?L?",
        "3E3Z3b3h3q3",
        ">%>7>?>E>N>d>z>",
        "Failed to concat backslash onto string.",
        "ImageInfoSet",
        "<#<2<=<F<S<[<g<p<}<",
        "9 9%9<9Q9W9d9v9",
        "<(<0<8<D<d<l<t<",
        ".?AV?$SerializableBase@VCOCCollection@OC@@$0A@V?$DefaultInstanceFactory@VCOCCollection@OC@@@UnBCL@@@UnBCL@@",
        "SmPartition::InitializeProperties: Custom GPT type GUID: %s",
        ":(:-:H:N:W:_:n:u:{:",
        "VWhX^",
        "ERROR_IPSEC_IKE_TIMED_OUT",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::IndexOf(class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *,int,int) const",
        "RespecializePending",
        ":$:*:7:I:W:i:",
        "SP_ENV_FAIL_VALIDATOR_MIG",
        "<+<2<",
        "828S8",
        "=#=7=D=I=U=q=x=",
        "5#5V5",
        "Apply (first boot apply, offline phase): Migration phase failed. Result: %d, no specific error",
        "0>0K0h0u0",
        "1(181T1a1g1y1",
        "969L9S9d9k9",
        ">'>9>A>G>T>f>t>",
        "RtlNotifyFeatureUsage",
        "void __thiscall UnBCL::ArrayList<class CFilterDriverInfo *>::RemoveAt(int)",
        "Calling Transformer Commit with parameters:",
        "SPInitializeDiskPlatform: Using SM API",
        "void __thiscall UnBCL::Array<class COperation *>::Remove(class COperation *)",
        "SetupDiGetActualSectionToInstallExW",
        "00080>0K0]0",
        "CBS_E_NOT_INSTALLABLE",
        "<%<0<?<F<L<Q<\\<j<y<",
        "void __thiscall UnBCL::ArrayList<class COSPieceInfo *>::Resize(int,int)",
        "CImageInfoSet::CreateFromExistentSystem: Failure in creating existent image info; Error: 0x%08X",
        "6$6|6",
        "JET_errOutOfThreads",
        "ERROR_DS_DRA_NAME_COLLISION",
        "Hard disk space needed: %I64d, space taken by copy: %I64d",
        ":%:.:8:A:K:T:^:g:q:z:",
        "%hs: Failed to add CBS packages. Error: 0x%08X",
        "4(444<4R4q4",
        "windows\\system32\\ntdll.dll",
        "=T=[=a=f=r=",
        ".?AV?$DefaultInstanceFactory@VCBcdSettings@@@UnBCL@@",
        "SPAPI_E_ONLY_VALIDATE_VIA_AUTHENTICODE",
        "FormatMessageW",
        "8$8,848<8D8\\8d8l8t8|8",
        "GetModuleHandleW",
        "121P1g1n1",
        ".?AU?$ICollection@PAVCInfFile@@@UnBCL@@",
        "IDB_WIN_LOGO1",
        ".?AVCApplyEAs@@",
        "3+4f4y4",
        "<3<V<l<",
        "SPGetWIMImageInfo: Failed to create WIM handle for %s. Error: 0x%08X",
        "cannot read WIM header",
        ">*>2>X>_>e>j>u>",
        "_Default",
        "int __thiscall UnBCL::ArrayList<class CDrvStoreProperty *>::LastIndexOf(class CDrvStoreProperty *,int,int) const",
        ";1<E<R<\\<p<}<",
        "3!3&3/353E3o3w3",
        "ERROR_CTX_NOT_CONSOLE",
        ".?AV?$DefaultInstanceFactory@VCFinalizeSafeOSBootRemoval@@@UnBCL@@",
        "%d,%d,%d,%d,%d",
        "CreateCaptureInfo",
        "ERROR_DS_WRONG_OM_OBJ_CLASS",
        "=?>j>u>",
        ".?AV?$CAutoCleanup@PAUSC_HANDLE__@@@RAII@@",
        "null collection to ArrayList#AddRange",
        "Will remove scratch directory: %s",
        "9094989@9X9h9l9p9",
        "pDeterminePageFileRequirements: Deciding where to allocate the page file",
        "ERROR_NO_QUOTAS_FOR_ACCOUNT",
        ":+:4:::G:M:R:c:n:|:",
        "VERBOSE: Path %s has no exceptions, trying a straight delete",
        ".?AV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@",
        "$0O0z0",
        "ERROR_IPSEC_IKE_TOO_MANY_FILTERS",
        "CARPValidator::ValidatePostExecution: Failed to create working directory %s",
        "9+9:9v9",
        "9 9&9,92989>9D9n9s9y9",
        "ResurrectSetupPlatform: Cannot deserialize data for setup platform.",
        "NtOpenDirectoryObject",
        ":.:C:Y:c:",
        "=;=f=n=t=y=~=",
        "PVhhg",
        "Cannot set the number recovery attempts made so far. Error: 0x%08X",
        ".Deserialize/Execute post-SysPrep operations failed",
        ".?AVCXXXXXHandledException@?CO@??DoExecute@CMigrateFramework@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ".?AVCXXXXXHandledException@?5??DoExecute@CEnableFeature@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "CSetupAutomation::SuspendAndRelease: Failed to serialize existing deployment options: 0x%08x",
        ":*:2:8:E:W:e:",
        "3J4Q4W4\\4g4q4",
        "353>3C3K3Q3V3^3d3i3q3w3|3",
        "SKIPBOOTTRACK(SAFEOS): Will not attempt SafeOS boot removal, maximum attempts reached",
        "8 8@8H8P8\\8|8",
        "%s\\Services\\%s",
        "CurrentBuildNumber",
        ">6>N>",
        "void __thiscall UnBCL::ArrayList<class CDriverDetails *>::RemoveAt(int)",
        "SOFTWARE\\Microsoft\\WIMMount",
        "9&949=9C9r9",
        ".?AV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVCGlobalPath@@@UnBCL@@",
        "8M8f8{8",
        ".?AVCXXXXXHandledException@?P@??QueueCustomizations@CNewSystem@@UAEJPAUISetupAutomation@SetupPlatform@@@Z@",
        "_wcsrev",
        "4\"4.484>4I4T4Y4m4",
        "wimmount",
        "  Initial decision for this update: %s",
        "void __thiscall UnBCL::Array<class CRegCreationData *>::Insert(int,class CRegCreationData *)",
        ">S>s>",
        ";5<J<V<e<",
        "8$8(8@8D8L8d8t8x8",
        ".?AVCXXXXXHandledException@?CFM@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "2&2Q2t2",
        "s09>uO",
        "637G7k7r7x7}7",
        "%hs: Recovery image is not available on this system",
        "3$333:3@3E3P3[3k3x3",
        "FileDescription",
        "ExecuteCommandFromValue: Command line returned result: 0x%08X",
        "><>E>O>X>r>",
        "3(3?3M3W3h3q3~3",
        "Sources\\Hives",
        "f9XBt",
        ".PAVCXXXXXTemp@?9??ExecuteCurrentOperations@CDeploymentBase@@QAE?AW4SYSTEM_STATE@SetupPlatform@@HPAUIOperationsProgress@4@@Z@",
        "void __thiscall UnBCL::ArrayList<class COperation *>::CopyTo(class UnBCL::Array<class COperation *> *,int) const",
        "1\"222:2A2k2r2x2}2",
        "4C4d4w4",
        "2%2.272C2L2U2x2",
        ";#;1;8;B;R;W;`;n;u;",
        "SetupPlatform::_ExecuteRollback: Failed to execute Rollback of SetupPlatform. Error: 0x%08X",
        "QPVQQh",
        "SjLjH",
        "UploadEtlSucceeded",
        "Source has WIMBoot entries but it's not a WIMBoot system.",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::Remove(class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *)",
        "3%3,383>3K3X3`3f3o3w3~3",
        "CCompressedPayloadWriterT<class CEmptyType>::CreateInstance",
        "JET_errSessionContextNotSetByThisThread",
        "CInstallEula::DoExecute",
        "=8=X=|=",
        "r%*U$",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::MoveNext(void)",
        "Hive does not exist: [%ws]",
        "<$<4<M<c<o<x<",
        "ZwSetBootOptions",
        "D$@Ph",
        "#0<0A0}0",
        ".?AU?$IEnumerator@PAVCFailForwardSystem@@@UnBCL@@",
        ".?AVCFirstBootApply@@",
        ">9>`>g>m>r>}>",
        "Service data is incomplete, cannot add pending services",
        "MIG_CMI_INNER_SECTION",
        "ERROR_DS_NO_FPO_IN_UNIVERSAL_GROUPS",
        "363<3F3K3U3\\3j3|3",
        ":,:3:9:>:J:S:g:w:",
        "upgrade_comp.xml",
        ".?AV?$SmartPtr@V?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@_K@UnBCL@@@UnBCL@@@UnBCL@@",
        "ttf97to9u",
        "setupmem.dmp",
        "SPProcessBitlockerOnDrives: Bitlocker resumed successfully.",
        ">1>?>G>N>m>",
        "Footprint.Servicing",
        "3&3,393K3Y3~3",
        "8=9p9",
        "Failed clear firmware namespace. File: %ws Flags: 0x%x Status: %x",
        "SPInitializeDU",
        "QjhQQj",
        "8\"838C8Y8_8q8",
        "=+=d=",
        "(create EAs)",
        "class UnBCL::ArrayList<class COperationInfo *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class COperationInfo *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "4(404:4A4G4L4W4b4v4",
        "8#8:8H8Z8d8n8x8",
        "5.5A5Y5n5|5",
        "0\"0B0P0Z0a0m0t0z0",
        "ITaskFolder::GetFolder failed. hr = 0x%x",
        "Failed to find search pattern: %ws",
        "9y t6",
        "5 5$5(5,545X5`5|5",
        "Failed to set locale data. Status = [%x]",
        "enum MIGSTATUS __stdcall SPDoOfflineGather(class UnBCL::String *,enum SetupPlatform::SP_MIG_SCOPE,class UnBCL::String *,class UnBCL::String *,struct ISPMigProgress *)",
        "CDeploymentBase::CMountedPathInfo::StreamWrite",
        "ERROR_BAD_TOKEN_TYPE",
        "LoadSMISettings: failing on invalid parameter %p %p %p %p",
        "Incorrect mappings detected in OS relocation phase, setup will continue but there might be errors",
        "3\"3-3P3X3^3r3",
        "SetupPlatform: write system event 2005 successfully",
        "9$969S9w9",
        "<%<2<7<@<P<W<_<d<p<",
        "8\"8I8b8s8z8",
        "9#9)9.999@9T9t9z9",
        "QjyjRj",
        "void __stdcall ForEachPartition<class <lambda_d14ac46bcd6b94be61fc2ffdefbf5b1b>::()::<lambda_6cf3053e42e21189e88cacd3e1111f2c>>(struct SetupPlatform::IDisk *,class <lambda_d14ac46bcd6b94be61fc2ffdefbf5b1b>::()::<lambda_6cf3053e42e21189e88cacd3e1111f2c>)",
        "SclpCanonicalizePaths failed. Error: 0x%08X",
        "JET_errInvalidName",
        "DownlevelProgress",
        "ERROR_TRANSACTIONAL_OPEN_NOT_ALLOWED",
        ";';e;",
        "?/?d?u?",
        "Creating Online OC Manager with ReplacementManifestDir: %s",
        "Microsoft.Windows.Setup.FastCleanUp",
        "8*878M8b8u8",
        "Finished processing policy, results: %s, %s",
        "ERROR_MUI_INVALID_ULTIMATEFALLBACK_NAME",
        ";3;W;{;",
        ".?AVCXXXXXHandledException@?6??SPValidateMigratedServices@@YGJPAVString@UnBCL@@@Z@",
        "FindAllPaths: Cannot get partition count for disk %d. Error: 0x%08X",
        "667A7d7q7",
        "SmPlatform::EnumerateDisks",
        "WIMBoot entry %I64d (%s, %d) is not a candidate for enumeration processing, ignoring",
        "ERROR_INVALID_DRIVE",
        "ERROR_EFS_DISABLED",
        "2$2)242;2@2`2p2w2}2",
        "    Failed to set file data location",
        "828l8s8y8~8",
        "SrcPathLong",
        "5&585@5F5S5e5s5",
        "s%c%s",
        "Could not find boot directory, error=0x%08x",
        ".?AV?$SerializableArrayListBase@PAVCFailForwardSystem@@@_@UnBCL@@",
        "ERROR_FIRMWARE_UPDATED",
        "1+1;1A1O1y1",
        "*Q`L]",
        ".?AV?$DefaultInstanceFactory@VCCFGSectionFile@@@UnBCL@@",
        "StateStoreGetMountedImagePath",
        "QRQWPQ",
        "2-3G3g3n3",
        "ERROR_INVALID_PRINTER_COMMAND",
        ": :2:::@:M:_:m:",
        "ERROR_LOG_POLICY_NOT_INSTALLED",
        "ERROR_RM_METADATA_CORRUPT",
        "void __thiscall UnBCL::ArrayList<class CFailForwardSystem *>::AddRange(const struct UnBCL::ICollection<class CFailForwardSystem *> *)",
        "00040L0P0h0l0",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,int>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::Reset(void)",
        "__thiscall OC::COfflineOCManager::COfflineOCManager(class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::String *,class UnBCL::String *)",
        ".?AV?$SerializableBase@VCCFGSectionRegistry@@$0A@V?$DefaultInstanceFactory@VCCFGSectionRegistry@@@UnBCL@@@UnBCL@@",
        "WIM_Chunk_Size",
        "5!535Q5y5",
        ">->@>S>Z>`>e>p>",
        "5$565>5K5`5i5x5",
        "%hs: Preliminary operations completed successfully. Clients should Finialize the Uninstall now",
        "pSPScopeSnapshot",
        "Failed to get Cleanup Upgrade snapshot Onesetting, 0x%x",
        "9+959:9N9f9p9u9",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAUHKEY__@@UTableKey@?$Hashtable@PAVString@UnBCL@@PAUHKEY__@@@2@V?$DictionaryEntry@PAVString@UnBCL@@PAUHKEY__@@@2@UKeyTraits@52@$1?RetrieveEntry@52@KG?AV62@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAUHKEY__@@@UnBCL@@PAUHKEY__@@UKeyTraits@23@V?$CElementTraits@PAUHKEY__@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        ".?AVFileStream@UnBCL@@",
        "6K6r6",
        ".CValidateSafeOS::DoExecute",
        "7$7,747<7D7L7T7\\7d7l7x7",
        "void __thiscall UnBCL::ArrayList<class CWIMBootData *>::set_Item(int,class CWIMBootData *)",
        ".?AV?$HTDictEnumBase@V?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@@_@UnBCL@@",
        "4\"454I4Y4|4",
        "Failed allocating mum path.",
        ".?AV?$ArrayListEnumerator@PAUPartitionLayoutArgs@@@_@UnBCL@@",
        "PnpPropMig.dll",
        "8)8@8G8M8R8]8h8|8",
        "void __thiscall UnBCL::Array<enum OP_EXECUTION_PHASE>::Insert(int,enum OP_EXECUTION_PHASE)",
        "%hs: Failed to write %s to the %s config file. Error: 0x%08X",
        ".?AVCXXXXXHandledException@?OD@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *> *,int) const",
        "4$4.4?4[4j4q4x4",
        ".?AVCXXXXXHandledException@?DJ@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "EducationN",
        "CBS_E_AC_POWER_REQUIRED",
        "R!s4Z",
        "9X`v^j",
        "CBS_E_WUSUS_BYPASS_MISSING_PACKAGE_MAPPING_INDEX",
        "999H9W9f9u9",
        "AllowUninstall",
        "222E2L2Y2`2",
        "ERROR_DS_CANT_FIND_DC_FOR_SRC_DOMAIN",
        "SetCursor",
        "8!8%8)8-818",
        "9$9.989B9Y9g9q9{9",
        "t\"9Z$t",
        "bitlocker                       ",
        "0D0w0",
        "assembly\\NativeImages_v4.0.30319_64",
        ";(;:;B;H;Q;g;};",
        "<Settings xmlns=\"urn:schemas-microsoft-com:windows-provisioning\" />",
        ".?AVCRegisterSyncProcess@@",
        "long __thiscall CGatherEndInstall::DoExecute(struct IExecutionContext *,void *,struct IInternalOperationsProgress *)",
        ":#:,:8:D:I:R:^:j:o:x:",
        "X%s,0x%08X",
        "xCSetupAutomation::ResolveTarget",
        "GetFileAttributes(%s) failed! Last Error = %#x.",
        "BootFilesRestoreCheckpoint: Failed to find system volume.",
        "et-EE",
        "CSetSafeOSBootCommand::DoExecute",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::set_Item(int,class UnBCL::DictionaryEntry<unsigned short,unsigned short> *)",
        "j?X_^f",
        "6\"626?6Q6e6|6",
        "ERROR_DS_EXISTS_IN_RDNATTID",
        "C;X`s",
        ":F;L;W;i;y;",
        ":):L:a:i:o:|:",
        "bo-CN",
        "PPPPPPV",
        "%hs: Removing uninstall data completed successfully",
        "VERBOSE: Path %s has no children, nothing to remove",
        "=!=,=:=B=H=\\=a=j=q=~=",
        "0'0.04090D0K0_0o0y0",
        ".?AVCCopyInfo@@",
        "SnapshotToDelete",
        "?&?5?J?R?h?u?",
        "D$TP3",
        "5(5>5",
        "HKU\\.DEFAULT",
        ".?AU?$ICollection@PAUISerializable@UnBCL@@@UnBCL@@",
        "4\"4.434<4H4T4Y4b4n4z4",
        "8%8+8?8]8q8y8",
        "ERROR_XML_PARSE_ERROR",
        "SclLinkProcessVolume",
        "GetWindowLongW",
        "DeleteFileEx: Unable to restore attributes on [%s]; GLE = 0x%x",
        "|EFIDEFAULT|\\|DEFAULTAPP|",
        "8 8.8D8Q8h8",
        "t`j.Zf;",
        "182E2]2",
        "SL_E_CAL_PRINCIPAL_UNEXPECTED_TYPE",
        ".PAVCXXXXXTemp@?9??SPDeleteAllSnapshots@@YGJPAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@3@HPA_J@Z@",
        "?C?U?]?c?p?",
        ".?AU?$IEnumerable@V?$DictionaryEntry@GH@UnBCL@@@UnBCL@@",
        "9\\$$v",
        "6Q6v6",
        "CMigChangesValidator::ValidatePreExecution",
        "D$ PQ",
        "int __thiscall UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::IndexOf(struct SPGetPartitionOrdinal::PartitionInfo,int,int) const",
        "JET_wrnExistingLogFileHasBadSignature",
        "CreateServiceW",
        "%hs: Failed to register RollbackOnlineSystem. Error: 0x%08X",
        "ERROR_PORT_MESSAGE_TOO_LONG",
        ".?AU?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@UnBCL@@@UnBCL@@",
        "pSetTaskRegistrationInfo",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCOperation@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "DiskLayout::WillBeLogical: Can't get partition properties: 0x%08x",
        "0!0)0?0F0L0Q0\\0l0|0",
        "write",
        ".?AU?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@H@UnBCL@@@UnBCL@@",
        "CDeploymentProject::CreateBootableMediaDeployment: Failed to assign volume label to %s (0x%08x)",
        "SP_ENV_ALLOW_EARLY_APPLY override detected, will not perform partial offline apply",
        "CloseServiceHandle",
        "List packages complete. hr: 0x%x",
        "int __thiscall UnBCL::ArrayList<class CDrvStoreProperty *>::BinarySearch(int,int,class CDrvStoreProperty *,struct UnBCL::IComparer<class CDrvStoreProperty *> *)",
        "ERROR_UNDEFINED_CHARACTER",
        "Failed to save shutdown requirement to setplatform config file. Error = %d",
        "ERROR_INVALID_MESSAGENAME",
        ">#>)>3>U>i>w>",
        "    Hardware description: %s",
        "PPPPV",
        "828>8^8k8",
        "WWSVj",
        ".?AU?$ICollection@W4ActionType@@@UnBCL@@",
        "?get_Count@XmlNodeList@XmlLite@UnBCL@@QBEHXZ",
        "%hs: Error while applying the EAs, the system might run slower for a while. Error: 0x%08X",
        "><>D>L>T>`>",
        "CSetupPlatformPrivate::StopTelemetry",
        "7#7_7l7~7",
        ".?AU?$IEnumerator@PAVCProfileInfo@@@UnBCL@@",
        "Different",
        "1+1=1E1K1X1j1",
        "SPAPI_E_CLASS_MISMATCH",
        "VdsDiskPartitionEnumerator::Initialize: Couldn't query disk partitions (0x%08x)",
        "\\$ hx#",
        "void __thiscall UnBCL::ArrayList<struct PartitionLayoutArgs *>::AddRange(const struct UnBCL::ICollection<struct PartitionLayoutArgs *> *)",
        "System32\\ntdll.dll",
        "5)565G5[5h5t5",
        "Can't get element %u as String (0x%08x)",
        ">0>;>P>W>^>i>t>~>",
        "= =E=L=R=W=b=q=",
        "sources",
        ";);7;>;S;X;_;f;",
        "4%414:4L4Z4o4",
        "=1>;>S>p>",
        "6.6L6S6`6g6s6x6",
        "class CCFGSectionValue *const *__thiscall UnBCL::ArrayList<class CCFGSectionValue *>::GetBuffer(int) const",
        "%hs: LoadlibraryEx failed with error: hr = 0x%08X",
        "?$?4?K?R?`?v?",
        "6r7(8n8",
        "<!<*<7<@<I<R<a<w<",
        "int __thiscall UnBCL::ArrayList<class CWIMBootData *>::LastIndexOf(class CWIMBootData *,int,int) const",
        "CNewSystem::QueueDynamicUpdates",
        ".?AV?$CAutoRelease@PAUITelemetry@@@Mig@@",
        ">0>8>>>K>]>",
        "4(5A5H5O5V5]5d5j5t5",
        "y&VhJ",
        ";#;);2;H;\\;n;v;|;",
        "VdsPlatformDiskEnumerator::ConstructPhysicalDisk: Couldn't initialize disk (0x%08x)",
        "3 3(30383@3H3P3X3`3h3p3x3",
        "=.=E=U=a=i=v=~=",
        "Settling on disk space requirements:",
        "JET_errSystemParamsAlreadySet",
        "void __thiscall UnBCL::Array<struct DISK_SPACE_IMPACT>::Remove(struct DISK_SPACE_IMPACT)",
        ".?AV?$DefaultInstanceFactory@VCEnableFeature@@@UnBCL@@",
        "%hs: Boot.sdi file path: %s.",
        "UuidToStringW",
        "ERROR_TOO_MANY_CONTEXT_IDS",
        "L$4PQ",
        "dNo Updates To Download After Filtering",
        "FOLDERID_AppCaptures",
        "VdsDisk::CreatePartition: Can't copy LDM data partition name (0x%08x)",
        "5?5G5Q5X5^5c5n5z5",
        "<(<4<@<i<q<~<",
        "9%919>9C9L9X9e9j9s9",
        "6 6*6@6Q6Z6d6z6",
        "\\\\?\\GlobalRoot",
        ":):<:N:i:|:",
        "2)2=2K2a2",
        "Objects",
        "%hs: Starting uninstall process",
        "RPC_S_INVALID_NAF_ID",
        ".?AV?$CAutoRelease@PAUIElement@@@RAII@@",
        "CGlobalPath::BuildDiskInfoFromPath",
        "void __thiscall UnBCL::ArrayList<enum OP_OPERATION_ID>::AddRange(const struct UnBCL::ICollection<enum OP_OPERATION_ID> *)",
        ":\":):/:4:?:P:X:^:r:",
        "7H7a7h7o7u7",
        "ImageInfo->SystemDrive",
        "??0IInstanceFactory@UnBCL@@QAE@XZ",
        "ERROR_WMI_INSTANCE_NOT_FOUND",
        "0!0/0S0r0",
        "<#<+<1<:<U<h<z<",
        "ERROR_HWNDS_HAVE_DIFF_PARENT",
        "<3<H<N<",
        "0 0&0+030>0D0X0^0p0w0}0",
        "xSPIsPathOnRecoveryPartition",
        "XDestPathLong",
        "JET_errTooManyOpenTables",
        "?get_InnerText@XmlNode@XmlLite@UnBCL@@QBEPAVString@3@XZ",
        "ERROR_IPSEC_MM_FILTER_EXISTS",
        "ERROR_RESOURCEMANAGER_NOT_FOUND",
        ":!:5:Y:a:x:",
        "6\"6/696>6G6T6e6u6",
        "ERROR_DEPENDENT_SERVICES_RUNNING",
        "CEnableSafeOSPageFile::DoExecute: Initialized a %llu byte page file at %s",
        "<@<R<_<",
        "!D$$!D$4",
        "bs-Cyrl-BA",
        ".?AV?$SerializableArrayBase@I@_@UnBCL@@",
        "VdsVolume::GetProperties: Unknown volume type %d",
        "VdsPartition::SetActive: Couldn't change partition type (0x%08x)",
        "0 0&0+0?0N0s0z0",
        "CCleanupSnapshot::DeleteSnapshot: Failed to schedule snapshot cleanup task. Error: 0x%08X",
        ".?AUISetupAutomation@SetupPlatform@@",
        "?9?N?p?",
        "WinReBackupFailedHR",
        "9-:x:",
        ".?AV?$SmartPtr@VCInternalOperationsProgress@@@UnBCL@@",
        "6J6_6",
        "ERROR_EFS_NOT_ALLOWED_IN_TRANSACTION",
        "tzm-Latn-DZ",
        "\\Windows\\System32\\config\\SYSTEM",
        "</<=<J<\\<d<j<w<",
        "Executing download operation: %s",
        "%hs: Destination path %s exists on the new system, we were asked to not overwrite",
        "VdsVolume::AssignDriveLetter: Failed to add volume access path [%s] (0x%08x)",
        "SL_E_CHPA_MAXIMUM_UNLOCK_EXCEEDED",
        "int __thiscall UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *>::IndexOf(class CSimpleCleanup::CCleanupEntry *,int,int) const",
        ">\">F>W>d>p>",
        "CSetupPlatform::DownloadDynamicUpdates: Target folder %s is not writeable dir",
        "Setting WMI Bool property %s: can't convert to VARIANT type %d",
        "int __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::Add(class UnBCL::DictionaryEntry<class UnBCL::String *,int> *)",
        ".?AVSystemException@UnBCL@@",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCBasicEnvEntry@@@UnBCL@@@UnBCL@@",
        ".?AV?$SerializableArrayListBase@PAVCOperationInfo@@@_@UnBCL@@",
        "0$0,040<0D0L0T0\\0d0l0t0|0",
        "$WINDOWS.~BT\\Sources\\Panther",
        "uZSW3",
        "1 121@1N1\\1",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CGlobalPath *>::MoveNext(void)",
        "1\"1.1:1F1\\1m1",
        "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\HIGHPART",
        "4&4:4",
        ";#;G;X;g;x;",
        "GetSystemStore",
        ":$:,:0:4:8:<:@:D:H:L:P:T:X:\\:d:h:l:p:x:",
        "6'656<6B6G6R6_6g6m6",
        ".?AU?$IDictionary@PAVString@UnBCL@@K@UnBCL@@",
        ">S>f>m>z>",
        ";\"<@<^<|<",
        "PWVh5",
        "4(414H4V4_4h4r4{4",
        "Backup start type is now %u",
        "ERROR_INVALID_PRINTER_NAME",
        "VPSWj",
        "evtlogs",
        "2'2-222V2n2z2",
        "  Specific callback decision: %s",
        "0+010T0Z0p0",
        "1!1>1D1V1^1d1v1",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CFilterDriverInfo *>::Reset(void)",
        ".?AVCApplyWIM@@",
        "9$9*999P9`9",
        "FIOVolumeOpen",
        "void __thiscall UnBCL::Array<class OC::COptionalComponent *>::InitLarva(class UnBCL::ArrayList<class OC::COptionalComponent *> *)",
        ".?AV?$HTDictEnumBase@W4ActionType@@@_@UnBCL@@",
        "1$1U1g1v1",
        "array of insufficient size to CopyTo",
        "void __thiscall UnBCL::Array<class CDeviceIdDatabase::CDeviceInfoData *>::InitLarva(class UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *> *)",
        "RetryOperationId",
        "pSPHardLinkFileForTask: Cannot create hardlink betweeen %s and %s. Error: 0x%08x",
        "4.4K4`4l4u4",
        "607p7",
        "<\"<(<-<9<D<X<",
        "RtlNtStatusToDosErrorNoTeb",
        "PartitionName",
        "Failed to retrieve image reference file for image on server %s. Error: 0x%08X",
        "=%=/=G=^=w=",
        "; ;';E;",
        "0/040C0P0`0",
        "?$?O?`?x?~?",
        "848K8X8_8r8",
        "<)<<<A<\\<b<k<s<",
        "050<0H0O0",
        "< <0<@<P<`<p<",
        "? ?3?L?S?Y?^?i?v?{?",
        "3+3n3~3",
        "%hs: Cannot create new WIM file %s. Error 0x%08X",
        ".?AU?$IEnumerable@PAVDiskLayout@@@UnBCL@@",
        "?$?(?8?<?L?P?`?d?t?x?|?",
        "&0;0P0m0",
        ">D?K?[?t?z?",
        "4 4.4<4J4",
        "RemoveSourceHardlinks: Cannot remove source hardlink %s. Error: 0x%08X",
        "</<<<K<\\<i<t<",
        "j.Xj:f",
        "VdsDisk::CreatePartition: Failed to query IID_IVdsCreatePartitionEx interface [%s] (0x%08x)",
        "Failure while validating package path [%s]. Error: 0x%08X",
        "8!858B8L8`8m8w8",
        "<4<R<a<p<",
        "OpenProvisioningPackageForRead",
        "5&5-575G5P5g5~5",
        "6,7`7k7y7",
        "KernelDump",
        "Cannot write install order for provisioning package %s",
        "<\"<4<B<O<a<i<o<|<",
        ">'>/>@>R>c>j>p>u>",
        "CRYPT_E_ASN1_INTERNAL",
        "646;6M6Z6k6",
        "Get last crash dump info",
        ".?AU?$ICollection@PAVCImageInfo@@@UnBCL@@",
        "8;8J8Z8b8n8z8",
        "5)585=5I5P5`5l5x5",
        "ERROR_INVALID_CLUSTER_IPV6_ADDRESS",
        "<\"=9=d=",
        "5$5.585?5E5J5U5]5b5",
        "ERROR_DIRECTORY_NOT_RM",
        "7 7$7<7@7X7\\7t7x7",
        "WinHttpOpenRequest",
        ": :(:,:0:D:H:X:\\:`:x:",
        ".PAVCXXXXXHandledException@?BCJ@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "4#5<5O5h5}5",
        "BiExportStoreToEfi failed %x",
        "81868?8G8M8S8`8m8t8",
        "class CGlobalPath *const &__thiscall UnBCL::ArrayList<class CGlobalPath *>::get_Item(int) const",
        "CSetupRecoveryPartition::DoExecute: Failed to write WIM hash to %s: 0x%08x",
        "SPBfsLogMessageCallback",
        "<0<G<X<m<t<z<",
        ">%>4>p>}>",
        "7#7/767<7A7L7V7i7",
        "long __thiscall CSetupPlatformPrivate::Initialize(const unsigned short *,const unsigned short *,int,int)",
        "RetrieveDiskLayout: Element %s only works for MBR table, but MBR isn't supported",
        "ERROR_CLUSTER_INVALID_NETWORK_PROVIDER",
        "9t$(tS",
        ".PAVCXXXXXHandledException@?L@??DoExecute@CApplyDrivers@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "%hs: Failed to set the reference WIM file %s for %s. Error: 0x%x",
        "Wmi::OpenNamespace: Failed to create locator instance (0x%08x)",
        "3(30383@3H3X3|3",
        ".PAVCXXXXXHandledException@?LL@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "SPTaskRemoveSnapshot",
        "ar-TN",
        "VdsImageDisk::GetProperties: Can't initialize VDisk properties (0x%08x)",
        "nl-NL",
        "JET_errCheckpointFileNotFound",
        "class CAccessCreds *__stdcall UnBCL::Try_Cast<classCAccessCreds*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        ";&;0;7;>;I;T;h;",
        "QSjih",
        "; <W<",
        "int __thiscall UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::ContainsKey(class UnBCL::String *) const",
        "7'7T7[7b7m7~7",
        "8 9Y9t9",
        "8+898G8U8",
        "4<4D4L4T4\\4d4l4t4|4",
        "_DismAddProvisionedAppxPackage",
        "RtlNtPathNameToDosPathName",
        ".?AV?$HTEnumerator@GHUTableKey@?$Hashtable@GH@UnBCL@@GUKeyTraits@23@$1?RetrieveKey@23@KGGPBV?$CAtlMap@UTableKey@?$Hashtable@GH@UnBCL@@HUKeyTraits@23@V?$CElementTraits@H@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        ";,;0;@;P;T;d;h;",
        "!0(030A0b0o0{0",
        "8M9i9",
        "7t8{8O9",
        "Download.",
        "4'424G4o4v4|4",
        "pSPPersistEnvVars",
        "ERROR_LOGON_FAILURE",
        "SclGetDiskHandle",
        "InitializeSecurityDescriptor",
        "CApplyWIM: Failure while applying image %s from %s. Error 0x%08X",
        ".?AV?$ArrayListEnumerator@PAVCDriverDetails@@@_@UnBCL@@",
        "0*070O0c0p0|0",
        "Failed to extract ci.dll from the WIM.",
        "%hs: New system's initialization failed. Error: 0x%08X",
        "_ultow_s",
        "Value [%ws] is not registry DWORD value",
        "??A?$CSimpleStringT@G$0A@@ATL@@QBEGH@Z",
        "9#9-969@9J9a9",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCDriverInfo@@@UnBCL@@@UnBCL@@",
        ">/>H>S>^>k>|>",
        "SPGetAllPartitions: Can't initialize disk provisioning! Error: 0x%08X",
        "Fail to find the value of binary info. Error: 0x%08X",
        "= ='=;=B=i=v=",
        "<I<S<e<",
        "<6<\\<|<",
        "<(<0<I<Q<i<",
        "6!7+767=7",
        "IPrincipal::put_Id failed. hr = 0x%x",
        "Service backup start type is %u",
        ";+<9<",
        "4 404@4P4`4p4",
        "%hs: Cannot set rollback active value. Error: 0x%08X",
        "5$505<5H5T5`5l5x5",
        ";$;,;9;A;N;V;m;y;",
        "L$T_^[3",
        "8'8D8~8",
        ">8>O>Z>j>t>",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,&protected: static class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> * __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "JET_errLogTornWriteDuringHardRecovery",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@_J@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "    Failed to get element metadata",
        "020?0F0L0Q0^0h0m0",
        "CCleanupSnapshot::DeleteSnapshot",
        "BootStat\\PCAT\\bootstat.dat",
        "4h506",
        "int __thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,&protected: static struct IVdsDisk * __stdcall UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsDisk *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "Reset RemoveWindowsOld value to 0",
        "40484>4K4]4k4",
        "9$969J9S9a9w9",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::Insert(int,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *)",
        ":R;];f;l;r;y;",
        "iu-Cans-CA",
        "int __thiscall UnBCL::ArrayList<class CCFGSectionValue *>::BinarySearch(int,int,class CCFGSectionValue *,struct UnBCL::IComparer<class CCFGSectionValue *> *)",
        "9&:@:]:",
        "4.4T4x4",
        "8j8{8",
        "NumPackagesFailed",
        "VdsVolume::AssignDriveLetter: No drive letter is available to be assigned (0x%08x)",
        ";&;,;9;K;Y;z;",
        "1'10191J1^1m1s1",
        "base\\ntsetup\\migration\\setup\\oc\\lib\\src\\ocmatcher.cpp",
        ".?AV?$SerializableBase@VCApplyOCs@@$0A@V?$DefaultInstanceFactory@VCApplyOCs@@@UnBCL@@@UnBCL@@",
        "CDownloadDUUpdates::DoExecuteInternal: Failed to get info set for image %s. hr = 0x%x",
        "606I6P6W6^6e6l6r6|6",
        "OC::OCCompareStatus",
        "%hs: Cannot move path %s from the previos OS to Windows.old. Error: 0x%08X",
        "OC::CCryptoUtil::IsFileMicrosoftTrusted: Error getting Provider Data from State Data",
        "Getting WMI String property %s: unexpected VARIANT type %d",
        "=F=L=R=X=^=d=",
        "w(h(&",
        "Suspending the new system from %s",
        "3%373E3",
        ">E>{>",
        "<+<2<8<=<H<Z<b<o<w<}<",
        ".PAVCXXXXXHandledException@?BC@??SPGetWIMImageInfo@@YGJPAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@3@KPAW4IMAGE_TYPE@SetupPlatform@@PAPAG333@Z@",
        ".?AV?$CAutoRelease@PAUIWbemServices@@@RAII@@",
        "=)=;=_=j=}=",
        "Restoring OC status...",
        "4.4<4]4",
        "JET_errColumnInRelationship",
        "?UnregisterType@SerializationStream@UnBCL@@SGXPBVString@2@HPAUHINSTANCE__@@@Z",
        "Failed to delete the newly created WinRE partition. Error: 0x%08X",
        "Failed to write OS partition info for rollback. Error: 0x%08X",
        "5A7K7s7",
        "ERROR_POINT_NOT_FOUND",
        "WimBootCompress.ini",
        "3I3b3",
        ".Merge.",
        "Vj@h`}",
        "fPfSfQf",
        "    Failed to assemble source path",
        ".?AV?$ArrayList@E@UnBCL@@",
        "7'7/767@7Q7^7f7r7z7",
        "8,8@8T8h8|8",
        "onecore\\base\\cbs\\util\\cbsfile.cpp",
        "ERROR_BAD_CURRENT_DIRECTORY",
        "ERROR_DS_DRA_GENERIC",
        "1$1<1D1L1T1\\1d1l1t1",
        "sk-SK",
        "SVWh8",
        "ErrorControl",
        "AddFolderToImage",
        "?/?D?R?c?k?x?",
        "7!7.7;7G7S7_7k7w7",
        "CSIDL_WINDOWS",
        "es-CO",
        "XCreateSnapshotFailedHR",
        "    Failed to assemble element path string",
        ".?AU?$IList@PAVCCFGSectionValue@@@UnBCL@@",
        "int __thiscall UnBCL::Array<class SysprepAction *>::Add(class SysprepAction *)",
        "CopyDirectoryEx2: Specified directory [%s] doesn't exist",
        "VSh`s",
        "Start name: %s",
        "BitLocker configured to trust Safe OS boot command: %s",
        "VdsDisk::Initialize: Failed to delete automatically-created partition: 0x%08x",
        "9Kdt_",
        "C;\\$<}jk",
        ":,:9:E:O:[:k:w:",
        "8T8`8r8",
        "CReconstructOS::RestageWindows: Install language: %s",
        "CSetupPlatformRollback::RegisterRollbackOnlineSys",
        "CDiskReader::Initialize",
        "    error: 0x%08X, phase: %s",
        "CNewSystem::PreInitialize: Velocity feature state for BitLocker auto-unlock is enabled",
        "Failed to save installation ID to %s. Error: 0x%08X",
        "JET_errSPAvailExtCacheOutOfSync",
        ":*:6:C:L:T:Z:c:k:r:",
        "\\WINDOWS\\",
        "0#0*070D0[0c0",
        "ERROR_LOCKED",
        "Operation queue is compromised, sorting is not possible.",
        "\\softwaredistribution\\download\\",
        "t$T+t$",
        ".?AV?$Array@PAVCGlobalPath@@@UnBCL@@",
        "8 8(80888@8H8T8t8|8",
        "4(454;4J4a4q4y4",
        "5\\5d5|5",
        "RPC_S_NOT_CANCELLED",
        "base\\ntsetup\\setupplatform\\lib\\src\\recoveryimage.cpp",
        "6#6c6s6",
        "=(=5=A=N=Z=f=s=",
        "2 2,2L2X2x2",
        "void __thiscall UnBCL::Array<class CDrvStoreProperty *>::Remove(class CDrvStoreProperty *)",
        ".?AVCXXXXXHandledException@?5??SPProcessServiceEnable@@YGXPBG@Z@",
        "0(0K0c0j0q0}0",
        "%hs: The \"Windows Setup\" BCD object does not exist",
        "=(=/=5=:=E=T=Z=n=",
        "; <(<^<j<",
        "8=8Z8q8",
        "_vsnwprintf",
        "class CWIMBootData *__thiscall UnBCL::_::ArrayListEnumerator<class CWIMBootData *>::get_Current(void) const",
        "CNewSystem::QueueOperations:     Capacity      : %I64u",
        "Ph@WG",
        "3#3)323H3U3g3o3u3~3",
        "SPFindFreeSpace: Can't read disk properties (0x%08x)",
        ".?AV?$Array@PAVCCleanupEntry@CSimpleCleanup@@@UnBCL@@",
        "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MiniNT",
        "3\"353G3T3\\3n3v3",
        "=/=@=P=a=h=n=s=~=",
        "VdsDisk::CreatePartition: Can't create GPT partition GUID (0x%08x)",
        "CSkipBootValidator::CanRemoveFirstBoot",
        "%hs: Malformed profile info received for %s(%s), path: %s, linked path: %s",
        "<!<,<6<C<L<]<e<o<w<}<",
        "%s;%s",
        "ControlService",
        "ERROR_IPSEC_IKE_NOTCBPRIV",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCImageInfo@@@UnBCL@@@UnBCL@@",
        "Failed to apply BCD settings. hr = 0x%X",
        ":$:(:,:4:<:@:D:L:T:\\:`:h:l:t:x:|:",
        "VdsPartition::EnumerateLogicalPartitions",
        "PPPPPV",
        "u2j?Xf;",
        "PostMessageW",
        "RtlExpandEnvironmentStrings",
        ">\">(>->8>G>L>Q>e>z>",
        "SmVirtDisk::Delete: Can't delete MSFT_VirtualDisk (0x%08x)",
        "0-050;0H0Z0h0u0",
        "=!=6=<=H=Y=f=",
        "CBS_E_INSUFFICIENT_DISK_SPACE",
        "5$5+51565A5H5]5o5v5|5",
        "9X:0;",
        "Processing security template for upgrade...",
        "SPExecuteSyncCommands",
        "hiberfil.sys",
        "------------------------------------------------",
        "5#6N6i6z6",
        "class UnBCL::ArrayList<class CFailForwardSystem *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class CFailForwardSystem *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        ".PAVCXXXXXTemp@?FL@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "ProcDirEntry",
        ":*:;:F:T:",
        "8!9.9=9F9M9X9",
        "SPFindImageDisk",
        ">$?b?p?",
        "171H1h1o1u1z1",
        "CApplyBCDSettings::DoExecute",
        "D$8Ph",
        "OC::COCCbsAdapter::SetProxyInterfaceSpecialSecurity",
        "ERROR_LOGON_NOT_GRANTED",
        "MoveDirectoryEx: Source: [%s], Dest: [%s] completed successfully",
        ".?AU?$ICollection@PAV?$DictionaryEntry@PAUIOperationsProgress@SetupPlatform@@K@UnBCL@@@UnBCL@@",
        "ERROR_IO_REISSUE_AS_CACHED",
        "SPCreateDiskImage: Unrecognized disk image type: %s",
        "en-029",
        "y/Vhx",
        ".?AV?$SerializableBase@VCUntagSourcesFolder@@$0A@V?$DefaultInstanceFactory@VCUntagSourcesFolder@@@UnBCL@@@UnBCL@@",
        "?&?=?K?U?_?i?s?",
        "5'5.585H5X5`5z5",
        "Failure while loading image %d from file %s. Error 0x%08X",
        "Antivirus software information:",
        "%hs: Error while setting short name %s for %s. Error: 0x%08X",
        "VdsVolume::GetProperties: Unknown filesystem type: %d",
        "7 7A7R7Z7`7f7r7",
        "=+=Y=",
        "SPCleanupBootEntries",
        "FindGlobalPath: Cannot get NT path for disk %d, partition %d. Error: 0x%08X",
        "Basic",
        "QQSVWh",
        ">->4>:>?>J>U>Z>n>~>",
        "393C3m3w3",
        "ERROR_INTERNAL_ERROR",
        "(%lx): Failed to open child key: [%ws]",
        "CWIMPidgenxExtractor::ExtractPidgenx: Failure creating a temporary directory. Error: 0x%08X",
        ";D<_<",
        "Harddisk",
        "RPC_X_PIPE_CLOSED",
        "3+3m3",
        "%hs: Successfully copied \"%s\" to \"%s\".",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "< <%<<<Q<W<d<v<",
        "{2B140946-F56C-4E27-8127-4F9F97C347CA}",
        ":9;x;};",
        "Fail to find the registry key of last crash dump. Error: 0x%08X",
        "ERROR_LOGIN_WKSTA_RESTRICTION",
        "ERROR_INDOUBT_TRANSACTIONS_EXIST",
        "ERROR_INVALID_SERVICE_CONTROL",
        "152J2\\2d2j2~2",
        "%s-%s-%s",
        "void __thiscall UnBCL::ArrayList<class CCFGSectionValue *>::AddRange(const struct UnBCL::ICollection<class CCFGSectionValue *> *)",
        "JET_errOutOfFileHandles",
        "pGetImageInfoFromSoftwareHive: Failed to get build lab info from software hive. Error: 0x%08X",
        "ERROR_SXS_XML_E_INVALID_DECIMAL",
        "Skip Boot Validator: Failed to query for the dirty bit for the OS partition. Error: 0x%08X",
        ">H?p?",
        "quc-Latn-GT",
        "1!1.1@1H1N1[1m1{1",
        "Failed to set bus params. Status = 0x%X",
        ";%;Z;c;",
        "4#454F4M4c4~4",
        ".?AV?$ArrayList@PAVCAntiVirusInfo@@@UnBCL@@",
        "0'030C0O0[0~0",
        "CSetupPlatformPrivate::Execute: Failed to decode safe OS hash, cannot remove it: 0x%08x",
        "SL_E_POLICY_CACHE_INVALID",
        "1$2W2i2q2w2",
        "?)?>?F?L?U?k?y?",
        "<+<Z<",
        "4*434<4R4[4d4z4",
        "444<4q4",
        "|DEST|\\|BOOTMGR|",
        ";&;J;j;",
        ")Default",
        "<0<=<H<X<k<s<y<",
        "IsDiskOnXHCI: SetupDiDestroyDeviceInfoList failed. Error = 0x%X.",
        "WIMCheckExistenceFromMountReparseData",
        "(%lx): FSCTL_SD_GLOBAL_CHANGE failed",
        "8$8,848<8D8L8X8`8",
        "8*878?8G8L8W8s8",
        "t$ThX",
        "142X2",
        "pSPIsSnapshotExpired",
        "6%696B6J6b6i6o6t6",
        "8#808?8X8c8o8y8",
        "ProcessJournalEntries: WinOLD: %s",
        "7)767B7M7W7g7p7z7",
        "2(2R2W2\\2l2s2|2",
        "9\"9D9n9",
        ">#>1>O>V>\\>a>i>t>",
        "IAction::QueryInterface for IID_IExecAction failed. hr = 0x%x",
        "class OSRollbackService::CCheckpoint *__thiscall UnBCL::_::ArrayListEnumerator<class OSRollbackService::CCheckpoint *>::get_Current(void) const",
        "3)3=3C3W3j3q3",
        "MIG_TIMEDOUT_PLUGIN_CALLS",
        ":%:7:D:]:x:",
        "Failed to get WIM image information for %s. Error: 0x%08X",
        ".Delayed",
        "> >,>H>P>p>w>}>",
        "ERROR_CACHE_PAGE_LOCKED",
        "ERROR_DS_NAME_TYPE_UNKNOWN",
        "; ;D;L;T;\\;d;l;t;|;",
        "2\"242B2",
        "Failed to get size of existing string",
        ";-;:;O;f;",
        "struct SetupPlatform::IPartition *const &__thiscall UnBCL::ArrayList<struct SetupPlatform::IPartition *>::get_Item(int) const",
        "ERROR_DS_REPLICA_SET_CHANGE_NOT_ALLOWED_ON_DISABLED_CR",
        "void __thiscall UnBCL::Array<class CDriverInfo *>::RemoveAt(int)",
        ".?AVCGlobalPath@@",
        "121E1J1",
        "GetAnswerFileContentsAsUnattend: Error while trying to parse answer file %s: 0x%08",
        ": :%:2:B:N:T:Y:m:",
        ".?AV?$Array@PAVCCmdLineExecutionTelemetryData@OC@@@UnBCL@@",
        "class COperationInfo *__thiscall UnBCL::_::ArrayListEnumerator<class COperationInfo *>::get_Current(void) const",
        "Failed to append ssshim.dll to offline windows directory path.",
        "GetProcAddress",
        "DelayLoadHandler: Failed to load library %s; error code is 0x%x.",
        ".PAVCXXXXXHandledException@?8??SPSetOSEntropy@@YGJPBG@Z@",
        "6%6*656I6]6p6w6}6",
        "  Parameter 3  : 0x%I64X",
        ";9<G<",
        ".?AV?$ArrayList@PAX@UnBCL@@",
        "?.?4???M?",
        "DiskLayout::Create: Couldn't get target disk properties (0x%08x)",
        "Creating General objects.",
        "6#656T6f6n6t6",
        "y%Vh ",
        "6%6V6c6n6",
        ".?AVCXXXXXHandledException@?2??DoExecute@CDisableFeature@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "    Failed to compose file name.",
        "L$(;L$ ",
        "9 91979D9I9R9a9p9",
        "3$383I3U3",
        "Failed to convert bootstat.dat file path: %s to NT path",
        "KernelRename",
        "Failed to enumerate subelements. Status: %x",
        "Present",
        "?$?2?@?H?R?Z?`?t?}?",
        "CDownloadDUUpdates::CalculateSpaceNeeded: VarI8FromDec failed. hr = 0x%x",
        "W93uH3",
        "CRYPT_E_INVALID_MSG_TYPE",
        "8$8,8084888@8d8l8p8t8x8",
        "8$8,848<8`8t8|8",
        "9(9,9<9@9P9T9d9h9l9p9x9",
        "ServicingErrorCode",
        "fPfQf",
        ";#;D;N;^;~;",
        "CRelocateOS: Cannot move path %s from Windows.NEW. Error: 0x%08X",
        "SPDeleteAllSnapshots: Failed to query snapshot size for [%s]. Error: 0x%08X",
        ">%>+>8>J>w>",
        ": :*:4:::G:V:c:o:",
        ":*:1:7:<:G:N:]:d:j:o:z:",
        "int __thiscall OC::CCryptoUtil::IsFileMicrosoftTrusted(class UnBCL::String *)",
        "InitialAvailableDiskSpace",
        "CSetupAutomation::GetDriveLetter: Failed to enumerate partitions: 0x%08x",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *> *)",
        "1*1:1U1\\1",
        "7(7,7<7@7P7T7d7h7x7|7",
        "=)>@>W>^>",
        "9/9A9^9w9",
        "4 4)4<4A4P4\\4f4w4",
        "w QSW",
        "6<7h7",
        "Failed opening source SOFTWARE hive %ls",
        "CFG Validator: Two list have different size [%d] vs [%s]",
        "NtSetCachedSigningLevel",
        "<><k<x<",
        "7!7-7=7",
        "AddCompressedFileToImage",
        "IRegisteredTaskCollection::DeleteFolder failed. hr = 0x%x",
        ".?AV?$SerializableBase@VCTrustSafeOS@@$0A@V?$DefaultInstanceFactory@VCTrustSafeOS@@@UnBCL@@@UnBCL@@",
        "<(<:<|<",
        "4#4-454B4N4e4~4",
        "= =(=8=\\=d=l=t=|=",
        "7d8k8",
        "7E7g7",
        "yLimitEnhancedDiagnosticDataWindowsAnalytics",
        ";&;-;3;8;C;M;`;u;",
        "SclRegProcessUserProfileHives",
        "%hs: Failed to write new path %s to the %s config file. Error: 0x%08X",
        "void __thiscall UnBCL::ArrayList<class CProfileInfo *>::Resize(int,int)",
        "%c %llu",
        "SL_E_LICENSE_MANAGEMENT_DATA_DUPLICATED",
        "<$<;<U<]<c<",
        "SPBuildOSEnvironment",
        "<!<'<,<7<B<R<W<k<",
        "3.363@3Q3Z3g3l3u3",
        "5\"545B5Q5",
        "7#777E7S7a7",
        "Failed reading uninstallwindow from registry: 0x%x, reading onesettings",
        "0.0;0X0e0}0",
        "NOTATION",
        "ERROR_LOG_CONTAINER_STATE_INVALID",
        "2#2G2k2}2",
        ".?AV?$CAutoCleanupBase@PAVVdsPartition@@@RAII@@",
        "707C7]7h7{7",
        "6'686O6e6~6",
        "SysprepFunctionStart",
        "PWShf",
        "Deleting element %08x blocked by secure boot policy.",
        ":,;`;",
        ".?AV?$CAutoCleanupBase@PAVScopeSnapshotHelper@@@RAII@@",
        ".?AV?$DefaultInstanceFactory@VCCFGSectionRegistry@@@UnBCL@@",
        "Failed to write enterprise attribution flags in file: %s. Error: 0x%08X",
        "j YWPS",
        "Exception while executing discover system",
        "=\"=)=/=;=O=]=k=y=",
        "*41;D$<s",
        "ERROR_TRANSACTION_SCOPE_CALLBACKS_NOT_SET",
        ".PAVCXXXXXHandledException@?BL@??GetCriticalDUPackageInformation@CNewSystem@@UAEJKPAPAUIDUPackageCollection@SetupPlatform@@@Z@",
        "5B5`5e5w5|5",
        "xDeleteOtherSnapshot",
        "0)0E0T0Z0n0",
        "scmlogs",
        "CBS_E_PUBLIC_OBJECT_LEAK",
        "010?0Q0Z0r0z0",
        "void __thiscall UnBCL::ArrayList<class OC::COptionalComponent *>::AddRange(const struct UnBCL::ICollection<class OC::COptionalComponent *> *)",
        "7)727:7D7Q7W7c7t7",
        "9&949=9G9d9",
        "Failed to set wof data",
        "414D4M4\\4w4",
        ".?AV?$ArrayList@W4OP_OPERATION_ID@@@UnBCL@@",
        "<+<?<l<",
        "void __thiscall UnBCL::ArrayList<class CDUPackage *>::RemoveAt(int)",
        "4 4.4C4H4T4[4h4",
        "CBS_E_SQM_REPORT_IGNORED_AI_FAILURES_ON_TRANSACTION_RESOLVE",
        "6,6>6O6V6l6",
        "IMAGE\\WINDOWS\\VERSION\\MAJOR",
        "=)=>=F=L=U=k=y=",
        ".?AU?$IEnumerable@V?$DictionaryEntry@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@@UnBCL@@",
        "<=<\\<",
        "7'747F7V7_7",
        "SPApplyDeviceLayoutDiskConfig: Failed to load XML content from %s (0x%08X)",
        "JET_errNoCurrentIndex",
        "=2=B=S=i=s=",
        ".?AV?$CAutoRelease@PAUIElementEnumerator@@@RAII@@",
        "DismGetDrivers",
        "WinHttpOpen",
        "=(=:=H=U=g=o=u=",
        "void __thiscall UnBCL::ArrayList<unsigned int>::RemoveAt(int)",
        "?@?R?Z?`?m?",
        "DiskLayout::ApplyProperties: Invalid MBR type",
        "5,7l7",
        "void __thiscall UnBCL::ArrayList<class CPartitionInfo *>::Insert(int,class CPartitionInfo *)",
        "_^[+P",
        "7-747^7j7r7",
        "File [%s] does not exist.",
        "class CProfileInfo *const &__thiscall UnBCL::ArrayList<class CProfileInfo *>::get_Item(int) const",
        ":%:,:3:::A:H:O:V:]:r:",
        "9)949J9r9",
        "?&?=?p?",
        ".?AV?$__base@$$A6G_NPAXI0II@Z@__function@wistd@@",
        "void __thiscall UnBCL::Array<struct UnBCL::ISerializable *>::Insert(int,struct UnBCL::ISerializable *)",
        ".?AVCEnableTracingForImage@@",
        "=$=,=4=<=H=h=p=x=",
        ".?AV?$DictionaryEntry@KPAVString@UnBCL@@@UnBCL@@",
        "=+=@=d=",
        "6+6S6f6",
        "DRVTEST: OEM inf path: %s",
        "6$7,7:7B7K7Y7_7e7t7",
        "Sources",
        "ERROR_SXS_XML_E_INVALIDATROOTLEVEL",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCBcdSetting@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCBcdSetting@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "<#<)<2<8<=<E<\\<k<p<w<",
        "SPGetConfigValueFromGlobalPath",
        "VhhFa",
        ":@:d:}:",
        "%windir%\\system32",
        "class CBasicEnvEntry *__stdcall UnBCL::Try_Cast<classCBasicEnvEntry*,class UnBCL::Object>(class UnBCL::Object *)",
        "int __thiscall UnBCL::ArrayList<class ISPPluginData *>::BinarySearch(int,int,class ISPPluginData *,struct UnBCL::IComparer<class ISPPluginData *> *)",
        "class CDrvStoreProperty *const *__thiscall UnBCL::ArrayList<class CDrvStoreProperty *>::GetBuffer(int) const",
        "=)=V=f=o=t=",
        "333=3D3J3O3Z3f3",
        ";$;5;;;B;S;Y;`;q;w;~;",
        "CFfuWriterAsyncT<class CSecurityHeaderWriterT<class CEmptyType>,class CImageHeaderWriterT<class CEmptyType>,class CCompressedStoreHeaderWriterT<class CEmptyType>,class CCompressedPayloadWriterT<class CEmptyType> >::Initialize",
        "SL_E_RAC_NOT_AVAILABLE",
        "70787>7K7]7k7",
        "ERROR_NOT_A_REPARSE_POINT",
        "4=4N4[4l4",
        "Microsoft\\Windows\\CurrentVersion\\Component Based Servicing\\Features on Demand\\Removed FOD Markers",
        "SPApplyDeviceLayoutDiskConfig",
        "VdsPartition::SetUsage: Failed to query IID_IVdsAdvancedDisk2 interface [%s] (0x%08x)",
        "Profiles have been moved on the new system",
        ">&>5>M>S>e>y>",
        "2<2D2L2T2\\2d2l2t2|2",
        "SKIPBOOTTRACK(SAFEOS): Skip Boot Validator: Will proceed with SafeOS boot removal.",
        "Exporting store alterations to efi",
        "WU_E_TIME_OUT",
        "Failed unloading hive file: {0}, key: {1}, with flags: {2}, NTSTATUS: {3}",
        "0?0c0r0",
        "  Resolved default install decision for external package (WinPE): %s",
        ";>;M;T;\\;a;l;w;};",
        ".?AVCDisableFeature@@",
        "? ?-???I?\\?d?j?w?",
        "Failed to allocate process ID buffer.",
        "=(=N=X=b=i=o=t=",
        ".CRT$XIA",
        "0 0$0(0004080@0D0H0P0T0X0`0h0l0p0x0|0",
        "                                   BIOS release date : %s",
        "SL_E_CIDIID_VERSION_NOT_SUPPORTED",
        "=,=5=N=U=\\=b=n=",
        "CMigChangesValidator::ValidatePostExecution",
        "Got Retain previous snapshot OneSetting: %s",
        ";';/;5;B;T;b;{;",
        "7 7/7@7L7S7c7o7{7",
        "tIVS3",
        "1'1/151B1T1b1",
        "2P2b2j2p2}2",
        "3V3a3",
        "<*<6<G<N<[<k<p<|<",
        "8'888E8N8[8t8}8",
        "fSfSfU",
        "ERROR_TRANSACTION_NOT_JOINED",
        "ERROR_DS_CANT_CACHE_CLASS",
        "ERROR_PASSWORD_EXPIRED",
        "9-9;9j9",
        "989@9L9l9t9|9",
        "CopyDirectoryEx2: Failed to copy [%s] to [%s], GLE = 0x%x; will retry in %u ms; am on try %u.",
        "CAppXValidator::CheckContainment",
        "CAddCbsPackage::DoExecute: Failed to allocate CBS package paths.",
        "%hs: Malformed global path found in %s. Line: %s",
        ";%;2;D;R;s;",
        "9$90999E9J9S9Z9g9s9|9",
        "6)7>7d7y7",
        "ERROR_FAIL_SHUTDOWN",
        "es-PY",
        "int __stdcall SPArePathsEqual(class UnBCL::String *,class UnBCL::String *)",
        "ERROR_UNKNOWN_PRINT_MONITOR",
        "PackageFailedPathAndHR",
        "3/3C3P3Y3e3~3",
        ">$>7>M>x>",
        ">$>,>8>@>\\>d>l>t>",
        "h    Failed to allocate pszDirectory",
        "?\"?6?<?T?",
        "9'929H9T9c9k9",
        "Failed to open recovery store. Status = [%x]",
        "FreeSpaceBeforeCleanup",
        "ApplyPartitionProperties",
        "ERROR_DS_DST_NC_MISMATCH",
        "lSkipBootFirst",
        "u6VVh",
        "GetFileTime",
        "IPrincipal::put_UserId failed. hr = 0x%x",
        ";-;h;u;",
        ".PAVCXXXXXTemp@?3??DoExecute@CPrepareRecoveryImage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "ERROR_FILE_CHECKED_OUT",
        "pAddToEnv",
        "3&3,333@3T3`3r3",
        "NtQuerySystemEnvironmentValueEx",
        "C QRRRRR",
        "VdsVolume::Format: Failed to format volume (0x%08x)",
        "%u,Start",
        "L$LPj",
        "az-Latn",
        "?<?]?r?z?",
        "MigOpenUNCStore",
        ".?AVCXXXXXHandledException@?DP@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "323C3O3[3g3s3",
        ";\";3;<;H;^;",
        "K32EnumProcesses",
        "void __thiscall CMediaLayout::UpdateDiskSpaceNeeded(void)",
        ".PAVCXXXXXHandledException@?CII@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "6D6H6P6T6\\6`6h6l6p6x6",
        "9&:8:O:`:~:",
        "7,747<7B7H7T7h7q7",
        "ERROR_CLUSTER_NO_SECURITY_CONTEXT",
        "tRVVj",
        "DiskLayoutPrepare: Failed to bring disk online (0x%08x)",
        "0R0n0}0",
        "%hs: BCD failed to remove rollback boot entry. Error: 0x%08X",
        "WTSQueryUserToken",
        "===Q=v=",
        "Global\\wimmount_mounting_event_%s",
        "class CAppInfo **__thiscall UnBCL::ArrayList<class CAppInfo *>::GetBuffer(int)",
        "<!<(<.<3<><E<Y<g<n<t<y<",
        "void __thiscall UnBCL::ArrayList<class COperationResult *>::QuickSort(class UnBCL::ArrayList<class COperationResult *> *,class UnBCL::ArrayList<class COperationResult *> *,int,int)",
        ".?AVCXXXXXHandledException@?2??DoExecute@CAddCbsPackage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "void __thiscall UnBCL::ArrayList<class CDriverDetails *>::Resize(int,int)",
        "9':L:",
        "ERROR_DEVICE_DOOR_OPEN",
        "void __thiscall UnBCL::_::ArrayListEnumerator<struct DISK_SPACE_IMPACT>::Reset(void)",
        "s%s\\system32\\config\\%s",
        "ERROR_GEN_FAILURE",
        "PQQQQQ",
        "?%?5???R?a?s?",
        "uZf9s",
        "VdsPlatformDiskEnumerator::GetNext: Failed to query disks (0x%08x)",
        "j|joj",
        "4+4F4^4o4",
        "CSetupAutomation::GetDriveLetter: Cannot look up drive letter: disk platform not available",
        "ERROR_UNRECOGNIZED_VOLUME",
        "<1<7<",
        "=(=7=H=O=U=Z=e=o=t=",
        ".?AV?$SerializableBase@VCReserveDiskSpaceFirstBoot@@$0A@V?$DefaultInstanceFactory@VCReserveDiskSpaceFirstBoot@@@UnBCL@@@UnBCL@@",
        "_callnewh",
        ":#:1:g:",
        "8I8b8",
        ".?AVCSPDiscoverProgress@@",
        "<$<2<K<R<Y<`<g<n<t<~<",
        "0>0X0f0r0y0",
        ".?AVCXXXXXHandledException@?8??DoExecute@CPrepareSafeOSBootRemoval@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "Element::RetrievePayload",
        ".PAVCXXXXXHandledException@?BEE@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "515?5}5",
        "111W1h1x1",
        "ERROR_PWD_TOO_SHORT",
        ".?AV?$Array@PAV?$DictionaryEntry@PAVString@UnBCL@@PAVMultiSz@2@@UnBCL@@@UnBCL@@",
        "pReadPageFileSettingsAndWriteToConfigFile: Failed to open %s: 0x%08x",
        "=/=<=R={=",
        "CRYPT_E_NOT_FOUND",
        "CSetupPlatform::UploadDiagnosticsData",
        "int __stdcall UnBCL::MP::ThrowCompare<struct _GUID>::Compare(struct _GUID,struct _GUID)",
        "class CPartitionInfo **__thiscall UnBCL::ArrayList<class CPartitionInfo *>::GetBuffer(int)",
        "=\"=1=9=W=^=d=i=t=",
        "CreateNewOfflineStore",
        "y)Whj",
        "RevertToSelf",
        ":4:O:U:b:t:",
        "7 7$7(7,7074787<7D7H7L7P7X7\\7`7d7h7l7t7x7|7",
        "40M0T0[0b0i0p0v0",
        "Create file",
        "8 8)828;8D8M8V8_8w8",
        "long __thiscall OC::COCCbsAdapter::EnableDisableOCs(class OC::COCCollection *,class OC::COCCollection *)",
        "y^hhR",
        "Upgrade is not using replacement manifests",
        "4-454;4H4W4p4",
        "<\"<,<9<E<Q<Z<d<n<",
        "ERROR_DEPENDENCY_NOT_ALLOWED",
        "Failed opening source SYSTEM hive %ls",
        ">*?/?k?",
        "0B0X0w0",
        "NarratorUIClass",
        "7!7)7F7f7l7",
        "E thjH",
        ":C:P:X:_:e:",
        "CPayloadWriterT<class CEmptyType>::Initialize",
        "eCNewSystem::QueueCreateRegistry",
        "1&1G1\\1r1z1",
        ".?AV?$ArrayList@PAVCDrvStoreProperty@@@UnBCL@@",
        "626>6E6K6P6[6e6x6",
        "= =0=4=D=H=X=\\=l=p=",
        ".?AVCXXXXXHandledException@?BA@??SPDoUninstallGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "SysprepSession::ExecuteAction: Failed during deleteFile operation; dwRet = 0x%x",
        ".?AV?$CAutoRelease@PAUISetupOneSettings@@@RAII@@",
        "void __thiscall UnBCL::Array<class CSimpleCleanup::CCleanupEntry *>::Remove(class CSimpleCleanup::CCleanupEntry *)",
        ":%:2:8:=:N:Y:g:",
        ".?AU?$ICollection@PAV?$DictionaryEntry@W4SYNCEXEC_PHASE@SetupPlatform@@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "DirectoryHiveUnloader::ProcessValue",
        ">/>D>Y>e>q>",
        "ERROR_FILE_TOO_LARGE",
        "7(7.777M7Z7l7t7z7",
        "SnapshotPolicy",
        "{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}",
        "2/2<2R2Z2a2q2",
        "PWVhW",
        "SetupPlatform: Phase \"FirstBoot\" completed successfully.",
        "class CSimpleCleanup::CCleanupEntry *const *__thiscall UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *>::GetBuffer(int) const",
        "%hs: External rollback requested but it's not available in this scenario",
        "BootStat\\BCD",
        "2 2*242B2H2N2S2]2g2q2{2",
        "SetWorldTransform",
        "=0=5=H=V=o=|=",
        "CFinalizeSafeOSBootRemoval::DoExecute",
        "0(050M0",
        "WindowsOld.Mappings",
        "Environment variable SP_ENV_TEST_DYNAMIC_UPDATE_PATH is set with an available path [%s].",
        "797G7_7~7",
        "ERROR_DS_ATT_NOT_DEF_IN_SCHEMA",
        "ERROR_DS_GROUP_CONVERSION_ERROR",
        "CSecurityHeaderWriterT<class CEmptyType>::PreWrite",
        "Read invalid DOS header from file: %S",
        "VirtualAlloc",
        ">S>]>j>p>w>",
        "6!6D6Y6a6g6t6",
        "?(?0?@?H?d?l?t?",
        ">1>8>>>C>N>X>k>",
        "VjOjP",
        "$SVW3",
        "RemoveSourceHardlinks: Error while setting short name %s for %s. Error: 0x%08X",
        "4(4f4l4{4",
        "Failed to open handle to %ws. Status: %x",
        "t SSSj",
        "<L<Y<k<s<y<",
        "SRQP3",
        "VALUE",
        "?\"?D?m?s?~?",
        "7 7(727:7D7R7\\7d7n7",
        "IMAGE\\FILECOUNT",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@PAVString@UnBCL@@H@UnBCL@@@UnBCL@@",
        "3I4P4V4[4f4m4",
        "?D?i?|?",
        "6#6(6-666<6L6c6r6~6",
        "|%I64u",
        "?get_Build@Version@UnBCL@@QBEHXZ",
        ":$:4:D:T:d:h:x:|:",
        "af-ZA",
        "DiscoveryLevel",
        "CRYPT_E_INVALID_IA5_STRING",
        "JET_errCannotDeleteTemplateTable",
        "2!232o2",
        "?)?7?K?Y?_?k?w?|?",
        "unsigned int __thiscall OSRollbackService::CCheckpointSequence::GetIndex(const unsigned short *) const",
        "ERROR_NOT_JOINED",
        "ERROR_CTX_GRAPHICS_INVALID",
        ".?AVCXXXXXHandledException@?CJ@??pSPDoOfflineApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0H0PAUISPMigProgress@@@Z@",
        "DriverDU",
        "GetSystemPartitionNTPath: BCD APIs could not find system partition; status = 0x%x",
        "5'5<5G5U5j5z5",
        "=<=T=",
        "9#:9:>:",
        ".PAVCXXXXXHandledException@?2??DoExecute@CPrepareRecoveryImage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ";+;U;[;f;t;",
        "SPCleanupInstallationDrive: Failure while building path to safe OS mount directory. Error: 0x%08X",
        "InstallSecurityTemplate: Error in processing upgrade template. Error: 0x%08lx",
        ".?AV?$CAutoCleanupBase@PAUIMigUser@@@Mig@@",
        "3%4D4f4",
        "7'7;7O7c7w7",
        "202=2H2U2e2m2z2",
        "WimBoot",
        "7)7:7O7W7]7j7|7",
        "747>7C7Y7`7f7k7v7",
        "ERROR_DS_THREAD_LIMIT_EXCEEDED",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CFileCreationData *>::Reset(void)",
        "9,9<9D9L9T9\\9d9l9t9|9",
        "VdsDisk::Initialize: Failed to initialize properties (0x%08x)",
        "FindMatchingDeviceInfoData: Failed to open a handle to the disk device. Error = 0x%X.",
        "t$HPh@",
        ">1>8>?>E>Q>c>q>",
        ".?AV?$SmartPtr@U?$ICollection@PAVCSPInternalPluginData@@@UnBCL@@@UnBCL@@",
        "SL_E_MISMATCHED_SECURITY_PROCESSOR",
        "ERROR_INVALID_IMAGE_HASH",
        "void __thiscall UnBCL::Array<class CFileCreationData *>::InitLarva(class UnBCL::ArrayList<class CFileCreationData *> *)",
        "(%lx): Failed to extend partition.",
        ".?AV?$SerializableBase@VCBcdSettings@@$0A@V?$DefaultInstanceFactory@VCBcdSettings@@@UnBCL@@@UnBCL@@",
        ".?AVCXXXXXHandledException@?FN@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "444@4Z4a4x4",
        "WimCopyResource",
        "__thiscall UnBCL::ArrayList<class CDrvStoreProperty *>::ArrayList(const struct UnBCL::ICollection<class CDrvStoreProperty *> *)",
        "Diagtrack service is NOT available",
        "9$9,94989<9D9L9P9X9\\9d9h9l9t9x9|9",
        "8&8.888>8R8]8|8",
        "%hs: WinReSetupRemoveWinRE succedded.",
        "VdsDisk::Initialize: Failed to get disk object (0x%08x)",
        "=%=8=C=J=Q=[=k=x=",
        "6$6B6S6X6o6v6|6",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        "%hs: Failed to backup BCD database from \"%s\" to \"%s\".",
        "7/7d7",
        ";1;?;c;",
        "ERROR_TRUST_FAILURE",
        "Failed to set reader input",
        "252?2M2Z2t2",
        "lstrcmpiW",
        "10151:1F1S1X1]1i1{1",
        "2&262?2F2R2Y2_2d2o2}2",
        "Comparing file modification times:",
        "  Number of drivers: %d",
        ":%:2:>:K:]:g:l:s:",
        "regKey",
        "SKIPBOOTTRACK(SAFEOS): Skip Boot Validator: New OS does not have EAs applied, cannot continue with SafeOS boot removal.",
        "%hs: Recovery partition is not large enough to hold the requested data.",
        ">(>4>@>L>X>d>p>|>",
        "1!1?1F1L1Q1\\1g1{1",
        "6X6e6}6",
        "777O7T7f7",
        ".?AVCRelocateWinReImage@@",
        "2?2Z2s2",
        "j.Yf;",
        "VdsDisk::Initialize: Failed to query software providers (0x%08x)",
        "RetrieveDiskLayout: Partition element is missing in DeviceLayout",
        "    Setup Platform updates",
        "_strnicmp",
        "Filter type: %s",
        "SPAPI_E_INCORRECTLY_COPIED_INF",
        "ERROR_NO_PAGEFILE",
        ".rsrc$01",
        "5$6H6l6",
        "pGetFileSystemInfoToFormat",
        "NtOpenProcessToken",
        "SPValidateMigratedServices: hardlink creation failed, error: 0x%08X. Attempting local copy.",
        "Z;\\$(",
        ".PAVCXXXXXTemp@?3??DoExecute@CProcessDrivers@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "MoveDirectoryEx: created parent directory %s",
        "u(PPj",
        ":4;A;S;[;a;n;",
        "fr-CH",
        ":%:_:s:",
        "9'9-929C9N9\\9",
        "Cannot get current boot entry, if this is a one-time boot sequence we can't make it permanent",
        "3+3?3P3X3s3z3",
        "171S1k1",
        "> >$>,>0>4>8><>D>H>L>P>T>\\>`>d>h>l>p>t>x>|>",
        "(%lx): Failed to process reg key or one of its descendants: [%ws]",
        "<!<.<:<s<",
        "<a<j<",
        ".?AVCCopyFilesAndFolders@@",
        "SP_PACKAGE_INFO",
        "UploadBasedOnEnvVar",
        "VERBOSEOPS: Maximum iteration count exceeded, likely a circular dependency",
        "    Failed to enumerate payload",
        ":(:8:D:L:b:x:",
        "%d days since installation",
        "=\"=+=7=<=E=L=Y=e=n=z=",
        "SYSTEM\\CurrentControlSet\\Services\\fastfat",
        ":/:9:L:T:Z:g:y:",
        "%hs: Failed to create working directory %s",
        "CMediaLayout::QueueProvisioningPackages: Failed to update path for provisioning package %u (%s) in answer file: 0x%08x",
        "REG_RESOURCE_REQUIREMENTS_LIST",
        "MIGSystemComponentList",
        "CSetupAutomation::Initialize: Couldn't get settings object; 0x%08x",
        "8'8>8E8K8P8[8f8z8",
        "0'0/050I0Y0`0",
        "3$363n3",
        "class SysprepAction *__stdcall SysprepAction::CreateAction(class UnBCL::XmlNode *)",
        ":=;\\;e;S<a<",
        ".?AV?$Array@PAV?$DictionaryEntry@PAVString@UnBCL@@_K@UnBCL@@@UnBCL@@",
        ":!:=:\\:~:d>",
        ".PAVCXXXXXTemp@?HE@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "%hs [HRESULT = 0x%08x - %hs]",
        "ERROR_DS_BAD_INSTANCE_TYPE",
        "1Z1a1g1l1w1~1",
        "ERROR_TRANSACTION_INTEGRITY_VIOLATED",
        ">#>0>7><>A>I>O>\\>j>r>y>",
        "ERROR_CLUSTER_NETINTERFACE_NOT_FOUND",
        "3C3u3",
        "24292E2k2",
        ".PAVCXXXXXHandledException@?FO@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        ".PAVCXXXXXHandledException@?JP@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "Identical",
        "es-CU",
        "%windir%\\Setup\\Scripts\\disablecmdrequest.tag",
        "ta-IN",
        "6(686",
        "<.=Y=`=f=k=v=",
        ".?AV?$DefaultInstanceFactory@VCUpdateBootCode@@@UnBCL@@",
        ".PAVCXXXXXTemp@?KK@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "?)?M?_?g?m?z?",
        ".?AU?$ICollection@UPartitionInfo@?1??SPGetPartitionOrdinal@@YGJPAUIPartition@SetupPlatform@@PAK@Z@@UnBCL@@",
        ";!;);0;<;N;c;r;|;",
        "ERROR_IS_SUBST_TARGET",
        "1\"1)1/141?1M1U1b1h1|1",
        "9#9A9M9_9}9",
        "T$@W3",
        "CGlobalPath::FindAllPathsCallback",
        "?<?E?d?w?",
        ".?AU?$IEnumerable@PAVCInfFile@@@UnBCL@@",
        ">!>(>.>3>>>H>d>l>v>",
        "0+090z0",
        "9&939C9O9c9j9z9",
        ".?AV?$Hashtable@PAVString@UnBCL@@W4ActionType@@@UnBCL@@",
        "1\"1I1Q1q1",
        "void __thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,unsigned long,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,&protected: static unsigned long __stdcall UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsVDisk *> > const *,struct __POSITION * const &)>::Reset(void)",
        "QSj;j",
        "Failed to set Watson bucketing parameter %d end time. hr = 0x%08X",
        "=)=/=C=Q=b=r=",
        "FIOReadHandleIntoBuffer",
        "??1ApplicationException@UnBCL@@UAE@XZ",
        "t.Vhx",
        "GetAnswerFileContentsAsUnattend: Failed to open schema store at %s: 0x%08x",
        "?set_Source@Exception@UnBCL@@UAEXPBVString@2@@Z",
        "@<j:f",
        "VdsPartition::SetActive: Marking non-MBR partition as active is not supported",
        "4U5r5",
        "ERROR_DS_BUSY",
        ".?AVCXXXXXHandledException@?P@??Rollback@CSetupPlatformWinReRestoreCheckpoint@@UAEXPBG@Z@",
        "7'7F7M7S7_7k7w7",
        "3.4]4l4v4",
        "%hs: Failed to add safe OS hash: 0x%08x",
        "JET_wrnColumnMaxTruncated",
        "SetGraphicsMode",
        "Foundation package name is %s",
        "0/070=0J0\\0j0|0",
        "Skip Boot Validator",
        "IWbemClassObject %s has no __PATH property",
        "int __thiscall CDiagnosticsHelper::Initialize(const unsigned short *)",
        ":%:e:v:{:",
        "333K3",
        "ShhZ`",
        ";0<@<L<l<x<",
        "s39T$",
        "SmPartition::GetVolume: Can't iterate over MSFT_PartitionToVolume (0x%08x)",
        "CRYPT32.dll",
        "=6>Q>l>",
        ">g?n?",
        "f;D$$u",
        "audit.exe",
        ":j:p:",
        "UpdateWIMHeader failed",
        ":1:<:M:V:",
        "SetupInfo",
        "ERROR_LOG_POLICY_CONFLICT",
        ";&;u;",
        "void __thiscall UnBCL::ArrayList<unsigned long>::set_Item(int,unsigned long)",
        "Failed to create new OS directory.",
        "File [%s] does not exist for comparison",
        ":<;];|;",
        "y-Vh ",
        "uz-Cyrl",
        ".?AU?$ICollection@PAVDiskLayout@@@UnBCL@@",
        "%hs: restored %s=%s",
        "CARPValidator::CheckSFContainment",
        "UninstallComment",
        "CSetupAutomation::Save: Unsupported answer file architecture: %u",
        "SPReadXmlFile: Failed to open %s: 0x%08x",
        ": :(:.:;:M:[:",
        "void __thiscall UnBCL::Array<class CPartitionInfo *>::Insert(int,class CPartitionInfo *)",
        "2A2P2V2b2n2",
        "3$3B3W3n3u3",
        "ERROR_JOURNAL_HOOK_SET",
        "%hs: BCD failed to remove the BCDE_LIBRARY_TYPE_RESTART_ON_FAILURE element for the new boot entry. Error: 0x%08X",
        "=G>v>d?",
        ":/;W;t;",
        "SPCreateSnapshotWithScoping: Failed to convert snapshot ID to GUID string. Error: 0x%08X",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class OC::COptionalComponent *>::Reset(void)",
        "707M7d7",
        "<,<<<L<\\<`<d<l<p<x<|<",
        "4J5^5v5",
        ":A:_:n:",
        "NotifyServiceStatusChangeW",
        "9%999G9U9c9",
        "SEH: Attempting to process telemetry",
        "=0=I=^=f=l=y=",
        "ERROR_FILE_VERSION_NAME_TOO_LONG",
        ".?AV?$SmartPtr@V?$Hashtable@PAVString@UnBCL@@W4ActionType@@@UnBCL@@@UnBCL@@",
        "CSetupPlatform::Initialize: Failed to create CDiagnosticsHelper instance",
        "PWSh%",
        "4 4=4",
        "ERROR_EVT_CHANNEL_CANNOT_ACTIVATE",
        "Phase: %s",
        "CSetupPlatform::SuspendAndRelease: Error setting the Setup Platform suspension state value. Error: 0x%08X",
        "5$565S5w5",
        ";/;Q;",
        "t<htm",
        "151P1",
        "6A6O6@7",
        "44484P4T4l4p4",
        "BcdExportStore: Failed create/open existing file at %ws. Status: %x",
        "ENTITY",
        "[%S] %S",
        "%s.vhd",
        ".PAVCXXXXXTemp@?IE@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ".?AV?$Array@UDISK_SPACE_IMPACT@@@UnBCL@@",
        ";$;+;1;=;O;];k;y;",
        ".PAVCXXXXXTemp@?3??DoExecute@CAddDriver@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "SPEstimatePageFileSizeAndRequiredMemory",
        "void __thiscall UnBCL::ArrayList<class DiskLayout *>::Resize(int,int)",
        "DiskLayout::ApplyProperties: Cannot create an EFI partition on an MBR disk",
        ".?AV?$Array@PAVCPartitionInfo@@@UnBCL@@",
        "0F0S0",
        "ERROR_WMI_SET_FAILURE",
        ".?AV?$ArrayListEnumerator@_J@_@UnBCL@@",
        "0-040:0?0J0U0[0`0z0",
        "%hs: Uninstall validation completed successfully.",
        ":.:E:[:y:",
        "0\"0'0K0w0",
        "9\"969U9f9~9",
        "4'4A4Q4X4^4c4p4v4",
        "2 202>2J2\\2g2t2",
        "3#3<3C3V3[3t3",
        "xVdsPartition::TakeOffline",
        "ESmVirtDisk::GetProperties",
        "CInstallDUUpdatesOffline::DoExecute: The OS image is corrupt and cannot be repaired. Error: 0x%08X",
        "2:2b2",
        "SysprepSession::Execute: Clear dynamic Store for offline OS [%s]",
        "5.5?5F5P5_5f5p5{5",
        "SPAPI_E_NOT_AN_INSTALLED_OEM_INF",
        ";F;L;_;k;",
        "4&4/484A4J4S4\\4e4{4",
        "Can delete old Upgrade snapshots as it has been more than %d days since the last snapshot installtime been set",
        "404D4L4T4\\4d4p4",
        "{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}",
        "[CatalogFiles]",
        "?4?<?D?L?T?\\?d?l?t?|?",
        "?#?0?J?U?g?w?|?",
        "Compact apply detected and source OS is before Win10, pushing WIM apply to SafeOS phase",
        "<R=^=",
        "CNewSystem::QueueDataImageApply",
        "MIG_VERBOSE_APPLY_PATTERNS",
        "DiagnosticsHelper is NULL",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CShellFolderInfo *>::Reset(void)",
        "LP Validator: Installed language package dissapeared, will invalidate OC gather operation",
        "3;4_4",
        ".PAVCXXXXXTemp@?3??pSPMergeWim@@YGJPAVString@UnBCL@@0P6GKT_LARGE_INTEGER@@111KKPAX22@Z22H@Z@",
        ":3:X:}:",
        "RollbackInitialize: threw exception.",
        "yCSetupPlatformPrivate::FindScratchDirectory",
        "{de94bba4-06d1-4d40-a16a-bfd50179d6ac}",
        "DU Image Information",
        ">*>@>",
        "ySP_ENV_ENABLE_UPGRADE_SNAPSHOT",
        "<-<B<J<P<]<o<y<",
        "base\\ntsetup\\setupplatform\\lib\\private\\communication.cpp",
        "%hs: BCD failed to remove rollback boot entry references. Error: 0x%08X",
        "  Available: %I64d",
        "=)=8=",
        "%hs: Hive %s was successfully mounted after unload",
        "<1<8<><C<N<[<",
        "jD_W3",
        "7#747J7p7",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@2@PAV32@UKeyTraits@52@$1?RetrieveValue@52@KGPAV32@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@3@UKeyTraits@23@V?$CElementTraits@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "261019185142Z0",
        "CLPValidator::CheckContainment",
        "5#5:5M5[5a5f5k5z5",
        "SmPlatformDiskEnumerator::Initialize: Can't enumerate storage providers (0x%08x)",
        "575`5",
        "%hs: Failed to open system store. Status = 0x%08X",
        ".?AUIGenericProgress@SetupPlatform@@",
        "&060=0C0H0S0Z0",
        "7$71787E7]7o7v7",
        "161A1M1W1i1q1w1",
        "868Q8[8e8k8y8",
        ".?AVCDiagnosticsHelper@@",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@2@V?$DictionaryEntry@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@2@UKeyTraits@52@$1?RetrieveEntry@52@KG?AV62@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@3@UKeyTraits@23@V?$CElementTraits@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "?,?3?:?A?H?O?U?`?{?",
        ".?AV?$SerializableBase@VCSaveConfigData@@$0A@V?$DefaultInstanceFactory@VCSaveConfigData@@@UnBCL@@@UnBCL@@",
        "pVdsDoAsyncWait",
        "5$545D5T5d5t5",
        ";-;5;;;H;Z;s;",
        "2A2V2h2p2v2",
        "SP_ENV_FAIL_VALIDATOR_APPX",
        "CSIDL_INTERNET_CACHE",
        "1V1k1~1",
        ".?AV?$SmartPtr@VFileStream@UnBCL@@@UnBCL@@",
        ".PAVCXXXXXTemp@?3??Initialize@CCFGSectionRegistry@@UAEJXZ@",
        ".?AV?$SerializableArrayListPrimitiveBase@E@_@UnBCL@@",
        "7!7D7",
        ": :0:4:D:H:X:\\:l:p:",
        "Failed to setup snapshot info in new OS. Error: 0x%08X",
        "%hs: Failed to setup services for %s-%s. Error: 0x%08X",
        "VdsPlatform::EnumerateDisks: Can't enumerate virtual disks; not supported",
        "0$0,040<0D0P0X0p0",
        "7$787L7a7p7",
        "ERROR_DS_NOT_ON_BACKLINK",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CUserProfile *>::Reset(void)",
        "RPC_S_NO_PROTSEQS",
        "JET_wrnColumnSingleValue",
        "DiskLayoutMakeReserved: Couldn't create MSR partition (0x%08x)",
        "6.6i6",
        "RegProcessingTimeInMS",
        "2$3-3E3",
        "JET_errPageNotInitialized",
        "ERROR_DS_KEY_NOT_UNIQUE",
        "ERROR_EOM_OVERFLOW",
        ":&:2:<:e:k:w:",
        "9%9/9@9I9U9f9m9{9",
        "(%lx): Failed to set security info.",
        "CImageHeaderWriterT<class CEmptyType>::PreWrite",
        "<2<@<W<e<|<",
        "Rollback folder not found",
        ".?AV?$SerializableBase@VCTelemetry@@$0A@V?$DefaultInstanceFactory@VCTelemetry@@@UnBCL@@@UnBCL@@",
        "Flush trace failed: 0x%x",
        "L$\\Qj",
        "<$<,<4<<<H<h<p<x<",
        "VdsPartition::SetGptAttributes: Couldn't change GPT partition attributes (0x%08x)",
        "828>8",
        "f98tT",
        "PWVhl",
        ":\":E:J:",
        "pSPRemoveUpgradeRegTree: failed to delete reg tree HKLM\\SYSTEM\\%s",
        "<$<1<8<C<j<x<",
        "j\\Zf;P",
        "PWVhd",
        "9/9U9i9p9v9{9",
        "%hs: SPGuidFromString failed for %s. hr = 0x%X",
        "VdsPartition::GetResizeBounds: Couldn't query maximum reclaimable bytes (0x%08x)",
        "7+747:7G7M7R7c7n7|7",
        "ERROR_LOG_DEDICATED",
        "uVj\\_f9:uN",
        "Number of $Secure security descriptors failed",
        "=#=I=^=f=l=u=",
        "1)1>1F1L1Y1k1~1",
        "5&5-525D5_5",
        "2 2)222;2G2S2_2y2",
        "? ?0?8?\\?d?h?l?p?x?",
        "8M8o8",
        "6!6-666B6N6f6o6{6",
        "CSetupAutomation::Save: Failed to write %s: 0x%08x",
        "040P0Z0d0j0w0",
        "5(5B5I5O5T5_5j5~5",
        "ActionPlatform::DeleteFilePattern: Invalid directory path %s passed",
        "INF %ws (source = %ws) is superseded by INF %ws, reason = %ws",
        "SPGetWIMImageInfo: Failed to set reference path %s for %s. Error: 0x%x",
        ".?AVCCheckpointSequence@OSRollbackService@@",
        "CDownloadDUUpdates::MoveOrCopyUpdates: IUpdateIdentity::get_UpdateID failed. hr = 0x%x",
        ".rdata$zETW2",
        "swscanf",
        "void __thiscall CNewSystem::StreamRead(class UnBCL::SerializationStream &)",
        "CReconstructOS::StageInstallation: Failed to stage target installation: 0x%08x",
        "343;3A3F3Q3\\3p3",
        ";/<=<^<l<u<",
        "676L6X6^6}6",
        "j0j)j",
        ".PAVCXXXXXTemp@?CJ@??DoExecute@CUnmountWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "Failed to set profile interval: 0x%x",
        "5,53595>5I5P5k5r5x5}5",
        "{B765110C-FC69-463C-B9E0-36F24E0CE93B}",
        ".?AV?$HTEnumerator@KPAUIVdsVDisk@@UTableKey@?$Hashtable@KPAUIVdsVDisk@@@UnBCL@@PAU1@UKeyTraits@34@$1?RetrieveValue@34@KGPAU1@PBV?$CAtlMap@UTableKey@?$Hashtable@KPAUIVdsVDisk@@@UnBCL@@PAUIVdsVDisk@@UKeyTraits@23@V?$CElementTraits@PAUIVdsVDisk@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        ":+:T:v:",
        "void __thiscall UnBCL::ArrayList<class CAppInfo *>::RemoveAt(int)",
        "null key to Hashtable#Remove",
        "3\"353C3R3h3",
        "9H9O9U9Z9e9l9",
        "Failed to create locator",
        "class UnBCL::SmartPtr<class OC::COCCollection> __thiscall OC::CInstalledOCStore::GetOCCollection(void)",
        "BCD failed to set boot entry description. Error: 0x%08X",
        "Failed to backup driver folder %s. Error: 0x%08X",
        "Failed to get %ls",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCFailForwardSystem@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCFailForwardSystem@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "WSh0:",
        "9'959<9D9I9Y9d9p9}9",
        "595T5o5z5",
        "class CShellFolderInfo *__thiscall UnBCL::_::ArrayListEnumerator<class CShellFolderInfo *>::get_Current(void) const",
        "ERROR_HOST_UNREACHABLE",
        "JET_errOutOfObjectIDs",
        "WmiAssociation::MoveNext: Can't get property name array length (0x%08x)",
        "WpeUnInitializeNetwork",
        "VVVVh(",
        ">H>X>m>",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *> *,int) const",
        "DiskLayout::VerifyLayoutNoActiveLogical",
        ";!<E<i<",
        "<!<,<6<I<Q<b<l<r<",
        "Failed to remove update item from update collection. Error: 0x%08X",
        "ERROR_IPSEC_QM_POLICY_PENDING_DELETION",
        "1$1/1?1L1W1k1t1",
        "int __thiscall UnBCL::ArrayList<struct SetupPlatform::IDisk *>::BinarySearch(int,int,struct SetupPlatform::IDisk *,struct UnBCL::IComparer<struct SetupPlatform::IDisk *> *)",
        "Failed opening CorruptionDetectedDuringAcr key",
        "ERROR_IPSEC_IKE_SA_REAPED",
        "8G8Y8a8g8t8",
        "4)464=4C4H4S4Y4^4",
        "0%0b0w0",
        "Failed to query creation time for snapshot [%s]. Errox: 0x%08X",
        "?ToString@Exception@UnBCL@@UBEPAVString@2@XZ",
        "int __thiscall UnBCL::_::ArrayListEnumerator<unsigned short *>::MoveNext(void)",
        "PATHNAME",
        ".PAVCXXXXXHandledException@?DJ@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "ERROR_SAM_INIT_FAILURE",
        "WVhH^",
        "BfsMigrateLoaderSettings failed to open source object %#x",
        ".?AVCXXXXXHandledException@?6??SPExecuteFirstBootCompletion@@YGJPAVString@UnBCL@@@Z@",
        "Extract files from WIM file %s, index %d to %s",
        ">C>{>",
        "!D$<!D$",
        "Quarantine.WinOld",
        "CImageInfoSet::AddToImageInfoSet: WinRE separate image not supported for WDS installation.",
        "BCryptHashData",
        "CERT_E_CHAINING",
        "6$6,646X6l6t6|6",
        "..\\rollback\\setupapi\\setupapi.setup.log",
        "ERROR_SUBST_TO_JOIN",
        "Invalid path provided to prefix.",
        "> >0><>D>\\>d>|>",
        ".?AU?$IEnumerator@PAVSysprepComponent@@@UnBCL@@",
        "8-82878C8U8Z8_8k879X9r9}9",
        "void __thiscall UnBCL::ArrayList<struct SetupPlatform::IDisk *>::QuickSort(class UnBCL::ArrayList<struct SetupPlatform::IDisk *> *,class UnBCL::ArrayList<struct SetupPlatform::IDisk *> *,int,int)",
        "=5=[=m=u={=",
        "Failed to open key for all object's elements. Status: %x",
        "CReconstructOS::StageInstallation",
        "1S1Z1`1e1q1{1",
        "3*363F3X3d3p3",
        "dfile",
        ":$:.:7:A:J:T:j:x:",
        "Failed to update WIMBoot entry. Error: 0x%08X",
        "232C2c2j2p2u2",
        "2(2E2T2",
        "?$?(?,?0?8?<?@?D?L?P?T?X?`?d?h?l?t?x?|?",
        "%hs: MoveFile(from \"%s\" to \"%s\") failed. Error: 0x%08X",
        ".?AV?$SerializableBase@VCProvisioningMigration@@$0A@V?$DefaultInstanceFactory@VCProvisioningMigration@@@UnBCL@@@UnBCL@@",
        "unknown",
        "(%lx): Failed to process OS volume",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVISPPluginData@@@UnBCL@@@UnBCL@@",
        "Failed to initialize rollback",
        "353A3W3c3m3y3",
        "3&363?3G3`3h3r3y3",
        "595j5",
        ".?AV?$SerializableArrayBase@PAVCGlobalPath@@@_@UnBCL@@",
        "CNewSystem::QueueRemoveFODPackage",
        "4N5e5",
        "class UnBCL::Array<class UnBCL::String *> *__stdcall pSplitEncodedString(class UnBCL::String *)",
        "BuildLab",
        "y@jcWh",
        "151G1O1U1b1t1",
        "3(30363C3R3k3",
        "0,040A0X0d0p0}0",
        ".?AVCWIMBootData@@",
        "Failed to set value: %ls",
        "647p7",
        "quc-Latn",
        "485d5",
        "=\"=-=8=L=Z=t=",
        "oK0D$\"<",
        ".?AV?$SmartPtr@VCSPDiscoverProgress@@@UnBCL@@",
        "%hs: Cannot enable SE_RESTORE_NAME privilege",
        ">/>O>V>\\>a>l>w>",
        "PostQuitMessage",
        "VERBOSE: Successfully removed %s",
        "828O8\\8",
        "Failed to Decode Hex Binary Info. Error: 0x%08X",
        "7?8~8",
        "%hs: Will skip any existing target files/folders",
        "class CDriverDetails *__thiscall UnBCL::_::ArrayListEnumerator<class CDriverDetails *>::get_Current(void) const",
        ";3;J;Y;^;|;",
        "Found non-null hash in file node",
        "SYSTEM\\Setup\\SetupWatson",
        "5.5F5Z5a5g5l5w5~5",
        "ERROR_INSUFFICIENT_BUFFER",
        "SPTaskRemoveSnapshot: Disk free space  : %I64d",
        "MSFT_VirtualDiskToDisk",
        "ERROR_SXS_XML_E_UNEXPECTED_WHITESPACE",
        "InstallationID",
        "void __thiscall UnBCL::Array<struct DISK_SPACE_IMPACT>::RemoveAt(int)",
        "rLogs\\CBS",
        "8*848N8d8",
        "UpdateWindow",
        "r    Failed to get asset size",
        ":(:::H:l:",
        "4 4&4+464G4O4U4i4y4",
        "CBS_E_WU_MISSING_PACKAGE_MAPPING_INDEX",
        " SVWj",
        "class CDrvStoreProperty *__thiscall UnBCL::_::ArrayListEnumerator<class CDrvStoreProperty *>::get_Current(void) const",
        ":K:p:",
        "CDeploymentProject::CreateFolderDeployment: Environment not set up for creating deployment; Error: 0x%08X",
        "SSt:Qj2",
        "1%151A1I1O1U1Z1_1e1q1y1~1",
        "%hs: ExecuteRollback succeeded",
        ">-?O?c?s?",
        "Failed to expand Recovery directory path",
        "5!5'515;5N5d5z5",
        ":!:1:E:S:j:",
        "ValidateAndClearWriteInProgressFlag",
        ".?AV?$CAutoWdsLibFree@PAUtagVS_FIXEDFILEINFO@@@RAII@@",
        "Bugcheck driver provider",
        "pMergeEtlFiles",
        "7.7:7L7j7v7",
        ")VdsPartition::Format",
        "Caller requested sparse mount",
        "SL_E_INVALID_EVENT_ID",
        ".?AV?$SerializableBase@VCOperationInfo@@$0A@V?$DefaultInstanceFactory@VCOperationInfo@@@UnBCL@@@UnBCL@@",
        "909@9R9b9q9",
        "6*62686L6R6[6q6",
        "JET_errCannotLogDuringRecoveryRedo",
        ".?AV?$Array@PAVCCopyInfo@@@UnBCL@@",
        "void __thiscall UnBCL::Array<class COperation *>::Insert(int,class COperation *)",
        "ERROR_TOO_MANY_MUXWAITERS",
        "Tel-M2.etl",
        "ERROR_BAD_ACCESSOR_FLAGS",
        ">'>0>G>\\>i>r>",
        "[%02hhx-%04lx]",
        "void __thiscall UnBCL::Array<class SysprepAction *>::Insert(int,class SysprepAction *)",
        "646;6A6F6Q6\\6a6f6v6",
        "GetLoadedHiveKeyName failed: HiveFilePath - %ls",
        "ERROR_NO_CALLBACK_ACTIVE",
        "ps-AF",
        "949:9L9\\9o9",
        "4 4D4L4T4\\4d4l4t4|4",
        "long __stdcall pGetRegSecurityInfo(struct HKEY__ *,class UnBCL::String *,unsigned long,class UnBCL::String **)",
        "%s\\System32\\ntoskrnl.exe",
        "A4;F<t2",
        "2\"252x2",
        "7h8u8",
        "5 515",
        "7-747:7?7K7S7g7",
        "Failed to enumerate elements for provisioning package %s. Error: 0x%08X",
        "2 242I2a2",
        "?ToString@DateTime@UnBCL@@UBEPAVString@2@XZ",
        "2\"232@2I2V2_2g2n2",
        "class UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "2$2(2,20282<2@2D2L2P2T2X2`2d2h2l2t2x2|2",
        "ERROR_EFS_VERSION_NOT_SUPPORT",
        "t1SRQh",
        "<$</<5<H<\\<v<",
        "596B6M6a6f6y6",
        "WmiAssociation::MoveNext: Can't get property %s (0x%08x)",
        "<8<Q<X<_<e<q<",
        "StartTraceW",
        "&amp;",
        "ERROR_DS_NO_NTDSA_OBJECT",
        "System BCD store is corrupt.",
        "void __thiscall UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::Add(class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *)",
        "SPGetTotalMemory: Failed to query memory status: 0x%08x",
        "ERROR_DS_CANT_ON_RDN",
        ";7;R;\\;l;",
        "DismOnError",
        "AddFileNodeToImage",
        "=\"=-=5=O=p=w=}=",
        "BitLocker",
        "void __thiscall UnBCL::ArrayList<class CWIMBootData *>::CopyTo(class UnBCL::Array<class CWIMBootData *> *,int) const",
        "WinSetupBoot.sys",
        "82898?8D8O8Z8n8~8",
        "ResAddFromFileAndHandle",
        ";$;6;D;Q;c;k;q;~;",
        "2-2F2\\2g2w2",
        "=#=5===C=P=b=p=}=",
        "<-<:<G<N<T<Y<d<n<s<",
        "Diagnostics data saved successfully",
        "SVWjD",
        "ERROR_SXS_IDENTITIES_DIFFERENT",
        "ERROR_DS_EXISTING_AD_CHILD_NC",
        "8.858;8@8K8R8f8",
        ".?AVCXXXXXHandledException@?2??SPFindVssSnapshot@@YGJU_GUID@@0PAPAVString@UnBCL@@@Z@",
        "FsMftSDUpdateCount",
        "GetSystemTimeAsFileTime",
        "6'6=6S6i6t6",
        "Getting WMI Object property %s: interface IID is not IID_IWbemClassObject",
        "Operation \"%s\" will scope out %d path(s) from snapshot.",
        "ERROR_DS_GC_REQUIRED",
        "=,=B=s=",
        "<%</<=<D<J<O<Z<h<p<v<",
        "%ws%ws\\%ws",
        "BfspCopyFile(%s, %s) failed! (Attempt %d of %d) Last Error = %#x",
        ":\":H:U:m:",
        "171|1",
        ";5<K<p<",
        "JET_errIndexHasPrimary",
        "8/8^8s8",
        ".PAVCXXXXXTemp@?3??Initialize@CSetupPlatform@@QAEJPBGH@Z@",
        "int __thiscall UnBCL::_::HTEnumerator<unsigned short,int,struct UnBCL::Hashtable<unsigned short,int>::TableKey,int,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable<unsigned short,int>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned short,int>::TableKey,int,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "??0MultiSz@UnBCL@@QAE@PBG@Z",
        "ERROR_SXS_XML_E_UNCLOSEDCOMMENT",
        ":*:2:8:?:I:Z:k:r:x:}:",
        "718M8_8y8",
        "9):1:9:@:J:^:r:z:",
        ".OperationSortFailed",
        "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
        ":$:0:<:H:T:`:o:",
        "CDownloadDUUpdates::FilterUpdates: VarBstrFromDate failed. hr = 0x%x",
        "Get OS information",
        "(%lx): Failure during enumeration of subkeys.",
        "unattend.xml",
        "=$=/=C=[=|=",
        "7!7.7@7N7s7",
        "CNewSystem::QueueSetupAutomation: Failed to queue OC replicateion (0x%08X)",
        ".PAVCXXXXXTemp@?3??DoExecute@CCompressOldOS@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ".?AVCMigrateFramework@@",
        "?Combine@Path@UnBCL@@SGPAVString@2@PBV32@0@Z",
        "void __thiscall UnBCL::_::ArrayListEnumerator<__int64>::Reset(void)",
        "<+<3<Q<s<z<",
        ".?AVCXXXXXHandledException@?BC@??DoExecute@CUnmountWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *> *,int) const",
        "606P6\\6|6",
        "__thiscall CGatherEndInstall::CGatherEndInstall(enum SetupPlatform::SP_MIG_SCOPE,const unsigned short *,const unsigned short *,const unsigned short *,const unsigned short *,int,int,enum OP_OPERATION_ID)",
        "ERROR_DS_DRA_OBJ_NC_MISMATCH",
        "=%=I=h=",
        "SP_ENV_FAIL_VALIDATOR_FOD",
        ".?AV?$SerializableBase@VCFirstBootApplyFromICB@@$0A@V?$DefaultInstanceFactory@VCFirstBootApplyFromICB@@@UnBCL@@@UnBCL@@",
        "Finalize Snapshot is enabled by policy",
        "%hs: Cannot extract file %s from %s. Error 0x%08X",
        "%hs: Cannot retrieve volume name of the specified path.",
        ">)>7>D>X>h>u>",
        "Clear",
        "5%5=5Y5`5f5k5v5",
        "4(4D4H4d4h4",
        "ERROR_PRINT_MONITOR_ALREADY_INSTALLED",
        "3'3E3Q3c3",
        "5+5M5Y5k5",
        "2$2*2/2;2C2H2\\2l2",
        ":&:1:E:f:{:",
        "BCD.LOG",
        "6 6(646T6\\6h6p6",
        "091f1",
        "SKIPBOOTTRACK(FIRST): Reading OneSetting for First boot removal",
        "CInstallDUUpdatesOffline::DoExecute: Failed to check OS image health. Error: 0x%08X",
        "SetFileTime",
        "=/=6=c=j=u=",
        ".PAVCXXXXXTemp@?CB@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        ":(:0:6:;:O:V:e:o:v:|:",
        "GetSecurityDescriptorGroup",
        "JET_errSoftRecoveryOnBackupDatabase",
        "CDUClientAppInfo::CDUClientAppInfo: Failed to get DU client fixed file information. GLE = 0x%x",
        "void __thiscall UnBCL::ArrayList<class CInfFile *>::Resize(int,int)",
        "=#=7=M=]=t={=",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@W4SYNCEXEC_PHASE@SetupPlatform@@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "334L4p4}4",
        "%windir%\\Panther\\FastCleanup",
        "(%lx): Failed to execute upgrade hive updates",
        "(%lx): Failed to update SETUPEXECUTE value.",
        "131W1{1",
        "? ?8?<?T?X?p?t?",
        "D$8G;}",
        "80uYj",
        ":9;C;O;s;",
        ".?AVCXXXXXHandledException@?5??SPQuerySnapshotSize@@YGJPAVString@UnBCL@@PA_J11@Z@",
        ":':9:A:G:T:f:t:",
        "GetPrivateProfileStringW",
        "9 9t9",
        "8l9v9",
        ".?AVCBugcheckInfo@@",
        "Not opted-in to SQM. Diagnostics data will NOT be uploaded",
        "?X?b?",
        ".?AV?$SmartPtr@VCCopyFilesAndFolders@@@UnBCL@@",
        "=)>@>P>]>i>",
        "Failed to service spaces bootmgr. Last Error = %#x",
        "<&</<6<C<K<T<[<h<o<",
        "SVhlc",
        "ResurrectSetupPlatform: Cannot initialize deserialized setup platform. Error: 0x%08X",
        "676[6m6u6{6",
        "819J9O9",
        "Microsoft\\Windows\\CurrentVersion\\Setup\\Sysprep",
        "?&?K?p?",
        "Failed to query registry value [%d]. Error: 0x%08X",
        "565@5G5W5m5",
        ".?AVCXXXXXHandledException@?BN@??UndoTransformers@CSetupPlatformApplyRollbackCheckpoint@@IAEJPAVString@UnBCL@@00@Z@",
        "T$<QP",
        "1(131:1S1",
        "3.383A3J3S3\\3f3w3",
        ".?AUIFreeDiskRangeEnumerator@SetupPlatform@@",
        "Partition extension not needed.",
        "zh-MO",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *> *)",
        "=3=A=X=v={=",
        "8'8-828C8N8\\8",
        ".?AVCXXXXXHandledException@?GN@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "18e5ea77-e3d1-43b6-a0a8-fa3dbcd42e93",
        "2 212F2N2T2a2s2",
        "7+7I7s7",
        "?'?>?L?V?`?w?",
        "Failed to create recovery store. Status = [%x]",
        "DeleteFileEx: Unable to delete [%s]; GLE = 0x%x",
        "2=2r2",
        "7)7<7D7K7R7]7i7}7",
        "CopyDirectoryDirCallback: The copy was canceled by the user.",
        "7/767<7A7L7W7i7",
        "VdsPartition::Format: Couldn't get file system info to format partition (0x%08x)",
        "CSetupAutomation::MatchDisk",
        "ERROR_IPSEC_IKE_KILL_DUMMY_NAP_TUNNEL",
        "Sources\\Panther\\setupinfo",
        "Resume application not found. Note, if you are servicing Windows PE or Windows RE boot files, you can ignore this message.",
        "GetDiskFreeSpaceExW",
        "353C3P3^3s3",
        "=(=:=B=H=U=g=u=",
        "2X2}2",
        "WimGetFileIdByHandle",
        "3'4J4",
        "KeepActive",
        "Failed to set the CBS log file to %s. hr = 0x%08X",
        "ERROR_NT_CROSS_ENCRYPTION_REQUIRED",
        ">H>l>{>",
        "Number of registry security descriptors processed",
        "Execute Sync commands: Failure while executing pre-apply commands.",
        "Apply (oobe boot apply from ICB, online phase): Migration phase failed. Result: %d, no specific error",
        ">&>8>X>j>r>x>",
        "NOTHING",
        "ERROR_LOG_ARCHIVE_IN_PROGRESS",
        "6(696F6Q6Y6c6t6",
        "8\"818H8O8U8Z8e8p8u8",
        ":-:C:v:~:",
        ";0;@;I;Y;b;r;{;",
        "ProgramData\\Microsoft\\Windows\\WER\\ReportQueue",
        "2'2/252I2Y2`2u2|2",
        "4)454M4Y4q4}4",
        "JET_wrnCommittedLogFilesLost",
        "=%=:=O=^=f=o=u=",
        "> >[>l>x>",
        "Cannot retrieve disk information from the recovery folder path %s. Error: 0x%08X",
        "8A8`8",
        "X.Variables",
        "6#6*60656@6F6U6h6p6w6",
        "0=1s1",
        "Failed to get system partition! Last Error = %#x",
        "JET_errLinkNotSupported",
        "CPrepareRecoveryImage::DoExecute",
        "9+979C9O9[9g9s9",
        "pSPLogUpgradeSnapshotState",
        "6,6064686<6@6D6H6P6T6X6\\6d6|6",
        "VDS Configuration",
        "SPApplyCustomDiskConfig: Cancelled partitioning at disk %u of %u",
        "Load order group: %s",
        "Image time high",
        "struct UnBCL::ISerializable *const &__thiscall UnBCL::ArrayList<struct UnBCL::ISerializable *>::get_Item(int) const",
        ">.?:?E?S?{?",
        "CSetupPlatformInfo::Initialize: failed to set capabilities; hr = 0x%08X",
        "CDownloadDUUpdates::FilterUpdates: IUpdate::get_Identity failed. hr = 0x%x",
        "StopTraceW",
        "3(3L3T3\\3d3l3t3|3",
        "8,9L9l9",
        "DiskLayout::VerifyPlanNoOverlap: The provided layout would require %s partitions %u and %u to overlap. Cannot continue.",
        "CSetupAutomation::ResolveTarget: Failed to read host firmware type: 0x%08x",
        "40454q4",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCWIMBootData@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        ";%;4;l;{;",
        "SP_ENV_TRY_SKIP_SAFEOS_BOOT",
        "x89~$v&",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::Insert(int,class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *)",
        "VdsDisk::CreatePartition: Can't get partition properties (0x%08x)",
        "959:9E9{9",
        "class CWIMBootHelper::CWIMEntryIndex *__thiscall UnBCL::_::HTEnumerator<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class CWIMBootHelper::CWIMEntryIndex *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,&protected: static class CWIMBootHelper::CWIMEntryIndex * __stdcall UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::TableKey,class UnBCL::DictionaryEntry<void *,void *> *,struct UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::DictionaryEntry<void *,void *> *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "3)3Q3c3s3",
        "4'4-4|4",
        "Failed to get last backslash in %ws. Status: %x",
        "    Failed to get element type string",
        "4!4,464I4U4]4c4h4m4",
        "y/SVh",
        "Failed to get file size for %s! Error code = %#x",
        "5A5W5",
        ">'>.>;>G>P>\\>a>j>v>",
        "9KLt,",
        ":p:x:",
        "SmVolume::ReadAllocUnit",
        "<&<3<;<A<G<T<h<q<",
        ":3:?:K:]:",
        "windir",
        "bootia32.efi",
        "Error creating ModuleName value for %s. Error: 0x%08X",
        "9%969E9^9e9k9p9|9",
        "class CSimpleCleanup::CCleanupEntry *__stdcall UnBCL::Try_Cast<classCSimpleCleanup::CCleanupEntry*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "Moving file %s to %s",
        "@0k0p0",
        "RemoveSourceHardlinks: Removing source hardlink: %s",
        "SetupUninstallOEMInfW",
        "747C7P7c7j7p7u7",
        "WmiAssociation::MoveNext: Expected association object to have 2 properites; found %u instead",
        "SysPrep Specialize",
        ".?AV?$SerializableArrayListBase@PAUISerializable@UnBCL@@@_@UnBCL@@",
        ">D?Z?k?",
        "ERROR_ALIAS_EXISTS",
        "=)=6=E=Y=e=s=",
        "CSetupPlatform::DownloadDynamicUpdates: Failed to append package collection. Error: 0x%08X",
        "5\"50595V5y5",
        ":,:6:n:",
        "  Upgrade boot critical: %s",
        "<,<7<E<h<r<",
        "ERROR_SXS_XML_E_INCOMPLETE_ENCODING",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::Remove(class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *)",
        "NtQueryInformationProcess",
        "No OCs were detected in %s.",
        ".?AVCXXXXXHandledException@?L@??SPIsPathInsideFolder@@YGHPAVString@UnBCL@@0@Z@",
        "offlineServicing",
        "=!=7=b=u=",
        "CSetupPlatform::CreateNewSystem: Failed to get target drive. hr = 0X%x",
        "4 4%414",
        "9D9v9}9",
        "scopied",
        ".?AV?$CAutoCleanupBase@PAUIPartition@SetupPlatform@@@RAII@@",
        "LwtNetLog.etl",
        "ERROR_BAD_QUERY_SYNTAX",
        "ERROR_UNABLE_TO_MOVE_REPLACEMENT_2",
        "4 4$4(4,444P4T4X4\\4d4",
        "void __thiscall UnBCL::ArrayList<enum OP_OPERATION_ID>::RemoveAt(int)",
        "%hs: Failed to make BCD trusted OS device object, Status = %d",
        "?.?;?M?U?[?d?z?",
        "6 6'6;6M6S6X6s6z6",
        "232>2C2a2o2",
        "=,=?=X=m=",
        "SPCopyFolder: Failed to copy folder %s to %s. Error: 0x%08X",
        "CSetupPlatform::CreateNewSystem: No target drive provided.",
        "CApplyDrivers::CopyToDriverStore: Failed to get source drivers enumerator; this is unexpected. Error: 0x%08X",
        ":$:D:L:T:\\:d:l:x:",
        ".?AVCXXXXXHandledException@?L@??pSPSplitWim@@YGJPAVString@UnBCL@@0P6GKT_LARGE_INTEGER@@111KKPAX22@Z22H@Z@",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *> *)",
        "system32",
        "FVEAPI.DLL",
        "unsigned char *__thiscall UnBCL::ArrayList<unsigned char>::GetBuffer(int)",
        "1$1,141<1D1L1X1|1",
        "struct DiskLayout::Partition __thiscall UnBCL::_::ArrayListEnumerator<struct DiskLayout::Partition>::get_Current(void) const",
        "SssPreloadDownlevelDependencies",
        ".?AV?$CAutoCleanupBase@PAUIDUUpdateCollection@DU@@@Mig@@",
        "?#?-?7?=?J?l?",
        "ERROR_CANT_ENABLE_DENY_ONLY",
        ".?AV?$SerializableBase@V?$Array@PAVCCFGSectionValue@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCCFGSectionValue@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<class CWIMBootData *>::Resize(int,int)",
        "1%1F1X1",
        ">!>+>?>I>\\>r>",
        ";G<O<Y<",
        "Execute.RollbackOnlineSystem",
        "2+2B2h2",
        "&0o0w0|0",
        "404=4N4[4k4p4}4",
        "WIM index %d",
        "base\\ntsetup\\setupplatform\\lib\\tracing\\tracing.cpp",
        "P9{<t",
        "Attempting to create a %suser profile%s in %s (suffix: %s)",
        "long __thiscall CProcessDrivers::DoExecute(struct IExecutionContext *,void *,struct IInternalOperationsProgress *)",
        "j-[f9\\0D",
        ".?AU?$ICollection@PAVCDrvStoreProperty@@@UnBCL@@",
        "8*80898O8]8u8|8",
        "5*52585L5\\5t5",
        "deleted",
        "0-0;0H0Z0b0h0u0",
        "Reading onesetting for tracing settings",
        "JET_wrnFileOpenReadOnly",
        "8c8k8y8",
        ".?AVCSimpleCleanup@@",
        "ResNodesSort",
        ".?AVCOptionalComponent@OC@@",
        "RestoreAllData",
        "RpcCommIsImageMounted",
        "=@=`=",
        "VERBOSEOPS: %sChecking dependent operation (Must Execute After) with ID %u",
        "SL_E_SFS_BAD_TOKEN_EXT",
        "0&0/080C0P0t0",
        "SWh0@",
        "SysprepSession::ExecuteAction: Failed during deleteValue operation; dwRet = 0x%x",
        "%hs: Compact OS installation is only supported if the source is a WIM file",
        ".?AV?$CAutoCleanupBase@PAVWmiCollection@WMI@@@RAII@@",
        "ERROR_BAD_USER_PROFILE",
        "Unknown marshall type %d, length %d",
        "=&=.=;=O=[=k=t=}=",
        "t_WWj",
        "2X2$3+353<3j3q3",
        "ReadWimHeader",
        "MinimumBuffers",
        "Perform setup folder cleanup with bPrefetch = %d and threshold = %d",
        "7\"8)8/848?8I8N8c8j8p8u8",
        "3*3C3J3Q3X3_3f3l3v3",
        "%hs: Failed to read New OS boot entry GUID from %s. Error = 0x%08X",
        "SPFindSnapshotProp: Failed to set backup context. Error: 0x%08X",
        "SPGuidFromString failed for %s. hr = 0x%X",
        "int __thiscall UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::ContainsKey(class UnBCL::String *) const",
        ">!>*>/>>>I>\\>g>{>",
        ">D>l>",
        "WRjUZ",
        "ERROR_CANNOT_DETECT_PROCESS_ABORT",
        "{6B2F14F9-EE46-4BC2-97CF-A6A0EA49141E}",
        "FIOGetDriveType",
        "DiskLayout::ApplyModifyPartition: No staged partition has index %u",
        "0$0*0/0:0F0Z0i0",
        "Failed to read checkpoint \"%s\" file.",
        "1/161Y1`1f1k1v1",
        ";-;5;B;Y;e;u;",
        "pCanAttemptRecover",
        ".?AU?$IEnumerator@H@UnBCL@@",
        "6$6,646<6D6L6T6\\6h6",
        "%hs: Cannot queue data migration for fail-forward system %d. Error: 0x%08X",
        "8\"80868<8A8K8U8_8i8w8}8",
        "2(3h3",
        "hy-AM",
        ";$;.;A;f;r;~;",
        ";+;<;M;b;{;",
        ".?AV?$SerializableBase@VCCloseLogFiles@@$0A@V?$DefaultInstanceFactory@VCCloseLogFiles@@@UnBCL@@@UnBCL@@",
        "74787P7T7l7|7",
        "?,?H?d?",
        "<'<,<5<J<V<c<p<~<",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCBcdSetting@@@UnBCL@@@UnBCL@@",
        "?!?)?/?<?N?\\?}?",
        "ERROR_DS_SAM_INIT_FAILURE",
        "Pre-OOBE phase called again but we are already done with it, failures will not be fatal.",
        "?,?4?<?D?\\?d?l?t?|?",
        "ERROR_NEGATIVE_SEEK",
        ";)<C<X<`<f<s<",
        "0<0D0L0T0\\0d0l0t0|0",
        "9$969D9R9`9n9|9",
        "\\??\\%c:\\%s",
        "Cannot find a location for %s. Error: 0x%08X",
        ">B>f>",
        ".WindowsOldPresent",
        "Immediate reboot requested during phase [%s]",
        "DiskSpaceReleasedPostInstall",
        ">.>6>K>Q>o>w>",
        ",SVW3",
        ".xdata$x",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@@UnBCL@@",
        "0)090A0H0N0[0k0r0|0",
        "CDeploymentProject::EnableAuditMode: Failed to set audit mode payload path: 0x%08x",
        "WWQj2",
        "NumPartitions",
        "3(4p4X6",
        "SPGetFootprintCapabilities: Failed to construct full path to folder %s. Error: 0x%08X",
        "SourceOSVersion",
        "SWh@;",
        "5*52585J5Z5`5l5{5",
        "struct SPGetPartitionOrdinal::PartitionInfo *__thiscall UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::GetBuffer(int)",
        "Create registry key %s (value name: %s) on the new system",
        "5;5M5U5[5h5z5",
        ".?AVCXXXXXHandledException@?EI@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::Remove(class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *)",
        "Wait for cleanup thread failed. Error: 0x%08X",
        "FsMftSDFailedUpdateCount",
        ".?AV?$SerializableArrayBase@PAVCCopyInfo@@@_@UnBCL@@",
        "Replacing existing OS, try delete previous Upgrade snapshot",
        "{2C677FFA-FB05-4BCC-B8AA-97198FD03744}",
        "winsxs\\backup",
        "ProvisioningPackage::GetNumElements",
        ".?AV?$ValueCollection@PAVString@UnBCL@@PAVCDriverInstallInfo@@@_@UnBCL@@",
        "2+2A2`2h2r2y2",
        "6<6J6Z6c6",
        "ERROR_SXS_INVALID_ASSEMBLY_IDENTITY_ATTRIBUTE",
        "CBS_E_NOT_ALLOWED_OFFLINE",
        "Failed to populate BCD store. Status = [%x]",
        "2A2V2e2w2",
        "SPFindImageDisk: Can't create disk enumerator (0x%08x)",
        "j\"[f;",
        ".?AVStringProperty@?1???$pDefineStringProperty@V<lambda_3c2eca7f14cfd9417aa9dfd7c80672cd>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_3c2eca7f14cfd9417aa9dfd7c80672cd>@@@Z@",
        ".?AV?$SmartPtr@VCSetupAutomation@@@UnBCL@@",
        "RtlLengthSid",
        ".PAVCXXXXXTemp@?CH@??RestageWindows@CReconstructOS@@IAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "fRfQf",
        "6)6D6T6\\6d6i6",
        "Error while reading lines from %s",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@K@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "ExtendedStatus",
        "Saw request(P): operation flags = 0x%X, progress callback %s",
        "NtDeleteKey",
        "    Failed to allocate spSearchPath.get()",
        "Cannot set the current boot entry as default, if this is a one-time boot sequence we can't make it permanent",
        "?ToString@Object@UnBCL@@UBEPAVString@2@XZ",
        "??1DateTime@UnBCL@@UAE@XZ",
        ">!>,>B>J>",
        "int __thiscall UnBCL::ArrayList<unsigned short *>::LastIndexOf(unsigned short *,int,int) const",
        ".DUSearchAndDownloadEndTime",
        "SKIPBOOTTRACK(FIRST): Skip Boot Validator: Found pending actions in the new OS, cannot continue with First boot removal.",
        "7,757B7K7X7g7p7x7",
        ".?AV?$CAutoRelease@PAVWmi@WMI@@@RAII@@",
        "$OFFLINE_RW$SECURITY",
        "CNewSystem::QueueSetupAutomation",
        ".?AVCXXXXXHandledException@?CGD@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "RtlpEnsureBufferSize",
        "CSetupPlatformPrivate::AnalyzeCrash",
        "c70f1038-66ac-443d-9e58-ac22e891e4fb",
        "KP+K`",
        "%hs: Cannot import filter hive %s. Error: 0x%08X",
        "3$3,30343<3@3D3L3P3T3\\3`3d3l3p3x3",
        "8H8U8m8",
        ">3>B>L>Q>Y>`>l>~>",
        ".?AV?$KeyCollection@KPAUIVdsDisk@@@_@UnBCL@@",
        ":%:J:m:",
        "ERROR_LOG_POLICY_INVALID",
        "Platform info deserialization failed",
        "Not under low disk space, ignore Storage Reserve",
        "SPAPI_E_ERROR_NOT_INSTALLED",
        "7n7~7",
        ".PAVCXXXXXTemp@?HK@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        ">$>0>P>X>`>h>t>",
        ".PAVCXXXXXTemp@?NO@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "y@h H",
        ".text$x",
        "515:5Q5z5",
        "Environment variable is set to enable Finalize snapshot",
        "SSShhj",
        "3*3/3E3L3R3W3b3l3q3v3",
        "DeletePath: [%s] doesn't exist as a directory; nothing to delete.",
        "5$5,585X5`5h5p5x5",
        "Estimation completed. Number of events: %d",
        "%hs: Unattend file already queued, request is not supported",
        "Marking event [&SclEvent_ProcessVolumes_Stop]",
        "%hs: Cannot open progress pipe. Error: 0x%08X",
        "WINDOWS\\Panther\\Excluded.hiv",
        ".?AVCCFGSectionRegistry@@",
        "SPFindVssSnapshot: Failed to initialize COM. Error: 0x%08X",
        ".?AV?$DefaultInstanceFactory@VCRegisterSyncProcess@@@UnBCL@@",
        "CSetupPlatformPrivate::OnErrorCommon",
        "SectorSize",
        ".?AU?$ICollection@UPartition@DiskLayout@@@UnBCL@@",
        "<'<4<<<k<",
        "CBS_E_EXCESSIVE_EVALUATION",
        "long __thiscall CNewSystem::Initialize(class CSetupPlatformInfo *,class CImageInfoSet *,int,const unsigned short *,enum _FIRMWARE_TYPE,const unsigned short *,enum SetupPlatform::SP_DISK_SPACE_OPTION,const unsigned short *,int,int,int,int,int,int,int,int,enum SetupPlatform::SP_STORAGE_RESERVE_POLICY,enum SetupPlatform::SP_BITLOCKER_HANDLING,const unsigned short *)",
        "YWSRP",
        "Failed to check OS image health",
        "?Format@String@UnBCL@@SAPAV12@PBGZZ",
        "9+93999F9X9f9s9",
        ":1:O:u:",
        "JET_errDatabaseInUse",
        "3,4p4",
        "VarFileInfo",
        "141<1D1L1T1\\1d1l1t1|1",
        "6%7-747D7K7V7]7m7t7",
        "=2=C=_=o=w=",
        "t'hxe",
        "9@9I9]9d9n9{9",
        "CBS_E_SOURCE_MISSING_FROM_3RD_PARTY_CAB",
        "=%===x=",
        "No device exists for VDisk %s; hence no disk to enumerate",
        "3,303L3P3X3\\3d3h3",
        "EnterpriseS",
        ";*;7;S;k;",
        "ERROR_XMLDSIG_ERROR",
        ".?AV?$CAutoRelease@PAUIWbemClassObject@@@RAII@@",
        "ca-ES-valencia",
        " CheckCrashInfo",
        "class UnBCL::String *__stdcall GetAnswerFileContentsAsUnattend(const unsigned short *,const unsigned short *,unsigned long)",
        "Operation can retry, we'll attempt to revert its execution.",
        "3 3<3@3D3H3X3`3|3",
        "ProcessTreeForDeletion failed. hr = 0x%x",
        "373<3A3M3]3{3",
        "?2?9???D?T?_?g?m?",
        "Failed to delete snapshot. Error: 0x%08X",
        "1(181V1a1",
        "CRYPT_E_INVALID_X500_STRING",
        ".?AVWmiAssociation@WMI@@",
        ".PAVCXXXXXHandledException@?2??DoExecute@CAddBootEntry@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "ERROR_ACCOUNT_DISABLED",
        "RECOVERY",
        "SysprepCorrupt",
        ":;;`;v;",
        "8!808A8N8W8d8v8}8",
        "ZwQueryBootEntryOrder",
        "2&303F3k3F4",
        "FirstBootSkip",
        "6(6,6D6H6`6d6|6",
        "8 8/868A8h8{8",
        "848@8K8Y8",
        "CCFGValidator::ReadFromSection",
        "=<>o>{>",
        "7,757?7H7Q7g7u7",
        ";\";.;:;j;",
        ":%:.:7:@:I:U:^:g:p:",
        "3F3M3l3",
        "ERROR_TRANSACTIONMANAGER_RECOVERY_NAME_COLLISION",
        ":':1:D:N:U:[:`:l:x:",
        "WIMMountExtractFileToHandle",
        ".?AVVdsDisk@@",
        "BfspPrintFileOwnerProcess: NtQueryInformationProcessfailed! Status = %#x",
        "Folder",
        "void __thiscall UnBCL::ArrayList<class CAppInfo *>::Resize(int,int)",
        "; ;$;(;,;0;4;8;@;D;H;L;P;T;X;`;d;h;l;t;x;",
        "JET_errDiskIO",
        "int __thiscall UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *>::IndexOf(class OC::CCmdLineExecutionTelemetryData *,int,int) const",
        "RollbackInitiatedOperationHR",
        "VdsPartition::GetExtendedPartBounds",
        "4 4(4>4D4V4j4s4",
        "?Subtract@DateTime@UnBCL@@QBE?AVTimeSpan@2@ABV12@@Z",
        "; ;(;0;8;@;\\;`;p;",
        "VdsPartition::Resize: Failed to query IID_IVdsVolumeShrink interface [%s] (0x%08x)",
        "9.:;:N:W:b:",
        "vssapi.dll",
        "CSetupAutomation::CacheInstallImage: Couldn't determine WIM image from filter criteria: 0x%08x",
        "%hs: Unable to open key %s. Error: 0x%08X",
        "2%272G2P2f2",
        "0$0W0q0x0~0",
        "CERT_E_INVALID_POLICY",
        "NTLDR",
        ">#>(>3>;>O>d>u>|>",
        ">0>R>h>",
        "PLUGINPROC: Adding a new plugin: %s",
        "464I4P4V4[4f4q4",
        "ERROR_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER",
        "717]7",
        "=%=9=T=y=",
        "en-HK",
        "ERROR_SXS_XML_E_INVALID_HEXIDECIMAL",
        ";3;C;Y;",
        "9%9=9x9",
        "ERROR_RESOURCE_NOT_PRESENT",
        "disk online",
        "Failed to query \"%ws\" variable. Status: %x",
        "CCleanupSnapshot::DeleteSnapshot: %s %I64d space from Upgrade snapshots",
        "7Y8h8o8~8",
        "SetupPlatform: Executing Sync commands: Failure while executing command %s. Error: 0x%08X",
        "ERROR_CLUSTER_NODE_DOWN",
        "313E3g3x3",
        "??0Win32Exception@UnBCL@@QAE@PBG@Z",
        ";2;>;J;S;_;k;t;",
        "OC::COCCbsAdapter::SearchFoundationPackageName",
        "304g4",
        ":>:]:u:",
        "PWhxa",
        "ERROR_NO_SUCH_LOGON_SESSION",
        "t#QQj",
        "CDeploymentProject::EnableAuditMode: Will execute [%s] during audit mode",
        "<*<2<8<E<W<e<",
        "OEMDevicePlatform",
        "3-3i3v3",
        "0E0L0R0W0b0i0}0",
        "3)3C3K3X3`3~3",
        "int __thiscall UnBCL::ArrayList<enum OP_EXECUTION_PHASE>::IndexOf(enum OP_EXECUTION_PHASE,int,int) const",
        ":-:>:N:^:n:|:",
        "t39>t/j",
        "=5>?>",
        ".?AV?$CAutoRelease@PAUISetupAutomation@SetupPlatform@@@RAII@@",
        "    Failed to copy parent path string",
        "%hs: BcdImportStore failed, ec = [0x%X]",
        "9W9S:b:o:v:",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::RemoveAt(int)",
        ".?AV?$SmartPtr@VCFFOperationsProgress@@@UnBCL@@",
        ".?AV?$SerializableBase@VCDUImageInfo@@$0A@V?$DefaultInstanceFactory@VCDUImageInfo@@@UnBCL@@@UnBCL@@",
        "2=2R2a2n2",
        "6&636D6J6V6c6k6u6}6",
        "323cceaf-b60b-4a0d-8a8a-3069efde76bf",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@GG@UnBCL@@@UnBCL@@",
        "ERROR_MCA_INTERNAL_ERROR",
        "1\"10161F1n1",
        "1!1/1S1w1",
        "ControlSet001\\Control\\WMI\\Trace",
        "Conflicting profile folder content (%s):",
        ".?AVCXXXXXHandledException@?4??DoExecute@CCreateScopedSnapshot@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "3!3=3D3J3O3Z3a3u3",
        ">N?f?s?",
        ">5>D>S>b>q>",
        ";*;2;8;E;W;e;|;",
        "< <.<7<@<I<b<l<",
        "%hs: Failed to setup the recovery partition. hr = 0x%08X",
        "YYj _",
        ".?AU?$IEnumerator@V?$DictionaryEntry@KPAUIVdsVDisk@@@UnBCL@@@UnBCL@@",
        "Failed reading uninstallwindow from registry: 0x%x, size: %d",
        "0&0H0\\0p0",
        "ERROR_CONTEXT_EXPIRED",
        "ERROR_INVALID_PARAMETER",
        "scecli.dll",
        "4#535s5",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *> *,int) const",
        ":K:R:o:v:",
        "{00000000-0000-0000-0000-000000000000}",
        "__thiscall UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::ArrayList(const struct UnBCL::ICollection<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *> *)",
        "void __thiscall UnBCL::Array<class CCopyInfo *>::Remove(class CCopyInfo *)",
        "OOBE boot apply is complete, nothing to do",
        ".?AV?$DefaultInstanceFactory@VCSetProductKey@@@UnBCL@@",
        "IoTEnterprise",
        "xUseOneSettingsTestServer",
        "6,696F6N6`6p6",
        "CreateNewPseudoWindows",
        "=<=e=t=",
        "8(8.8T8Z8f8n8",
        "SPWriteMigrationScope",
        "'0P0W0d0q0}0",
        "3 3*333I3W3`3i3r3{3",
        "CDownloadDUUpdates::MoveOrCopyUpdates",
        "PayloadEnumerator::GetNextPayloadLength",
        "ExportForCrossFileTarget",
        "VjMh<",
        "CDiskReader::CreateInstance",
        "Failed to get published Driver Store INFs failed, Err = 0x%lx",
        "An operating system wasn't found. Try disconnecting any drives that don't",
        "User profile suffix mismatch, upgrade cannot continue",
        "<Q<a<{<",
        "Failed to open key for element %s. Status: %x",
        "9'90979D9P9Y9f9k9t9{9",
        "8\"8@8K8p8w8}8",
        "ERROR_TOKEN_ALREADY_IN_USE",
        "was NOT needed",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *> *)",
        "RaiseFailFastException",
        "ERROR_META_EXPANSION_TOO_LONG",
        "SPAPI_E_UNRECOVERABLE_STACK_OVERFLOW",
        "9&989B9U9]9c9p9",
        "</<Q<]<e<n<x<",
        "ERROR_OUT_OF_STRUCTURES",
        "9] u&j ",
        "NdrClientCall2",
        ".?AV?$ArrayListEnumerator@PAVCOperationResult@@@_@UnBCL@@",
        "4A4S4[4a4n4",
        "<$<*</<`<q<",
        "3/3R3\\3e3o3{3",
        "Take the default install action.",
        "ERROR_CIRCULAR_DEPENDENCY",
        "JET_errBadCheckpointSignature",
        "ShD\\c",
        ".?AVRegistryPath@@",
        "ERROR_THREAD_1_INACTIVE",
        "= ='=.=5=<=C=I=S=u=",
        "Failed to query metadata",
        "OC::CInstalledOCStore::ModifyOCsState: Failed to enable and disable OCs; hr = 0x%08X",
        "class CInfFile *&__thiscall UnBCL::ArrayList<class CInfFile *>::get_Item(int)",
        "fr-HT",
        ";#;-;>;T;j;",
        "FindVolume: Failed while looking for [%s]; hr = 0x%X.",
        "DismInitialize",
        "CDF doesn't contain any member.",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::QuickSort(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *> *,class UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *> *,int,int)",
        "?*?4?W?s?",
        "0QQQQQ",
        ".PAVCXXXXXTemp@?3??CreateRamdiskOptions@CAddSafeOSBootEntry@@IAEJPAXPBG1PAU_GUID@@@Z@",
        "050=0G0N0T0Y0d0p0",
        "Install Feature-On-Demand Dynamic Updates",
        "CSPExecuteProgress::CSPExecuteProgress",
        "Failed to get processor architecture.",
        "Export image from WIM file %s, index %d to %s",
        "SmDisk::Initialize: Failed to delete automatically-created partition (0x%08x)",
        "ERROR_IPSEC_IKE_QM_EXPIRED",
        "ERROR_ADDRESS_NOT_ASSOCIATED",
        "void __thiscall UnBCL::Array<class CDeploymentBase *>::InitLarva(class UnBCL::ArrayList<class CDeploymentBase *> *)",
        "??6SerializationStream@UnBCL@@QAEAAV01@J@Z",
        "ERROR_DS_REMOTE_CROSSREF_OP_FAILED",
        "Press any key to restart",
        "jZjph",
        "9 9$9(9,94989<9@9D9H9L9P9T9\\9`9d9h9p9t9x9|9",
        "2)2=2^2s2z2",
        "ERROR_CS_ENCRYPTION_UNSUPPORTED_SERVER",
        ".?AV?$SmartPtr@V?$ArrayList@UDiskMatchFilter@@@UnBCL@@@UnBCL@@",
        "AllocNode",
        ":):3:;:A:F:X:l:s:y:~:",
        "UblIsUSBDiskControllerXHCI: IsDiskOnXHCI failed. Error = 0x%X.",
        "525Z5}5",
        "Execute Sync commands: Failure while executing post-apply commands.",
        "ERROR_SYSTEM_PROCESS_TERMINATED",
        "<H<]<o<w<}<",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::Remove(class UnBCL::String *)",
        ";*;7;H;\\;e;t;",
        ".?AV?$ArrayListEnumerator@PAVCImageInfo@@@_@UnBCL@@",
        "pFindAndAddFiles: Failed to build file path as [%s]\\[%s]; Error: 0x%08X",
        "ReadData failed",
        "GetTraceLoggerHandle",
        "SPCreateSnapshotWithScoping: Get empty scoping list",
        "ERROR_SXS_XML_E_INVALID_STANDALONE",
        "CDownloadDUUpdates::CalculateSpaceNeeded: IUpdateIdentity::get_UpdateID failed. hr = 0x%x",
        "<'=F=",
        "ERROR_PNP_BAD_MPS_TABLE",
        "MoveDirectoryEx: Error deleting destination [%s] ",
        "HQC!!",
        "<%<+<0<;<E<M<S<g<q<y<~<",
        "FindFirstFileExW",
        ".?AU?$IList@PAX@UnBCL@@",
        "ERROR_DS_CLASS_NOT_DSA",
        "IVdsAdvancedDisk",
        "tt9p0uo9p<t",
        "9>9G9P9Y9b9k9t9}9",
        "CTurnOffReserve::DoExecute: Failed to turn off storage reserve in [%s]. Error 0x%08x",
        "CReconstructOS::RestoreInstallationLanguageSettings: Failed to set defaults (0x%08x). Will proceed, but system may be localized to the wrong language",
        "7F7W7w7",
        "6)6:6U6[6h6p6z6",
        "Washington1",
        "SPQueryReserveInfoInternal",
        ";0;8;>;G;];k;",
        "7*818>8C8N8U8i8",
        "ERROR_DS_DRA_OBJ_IS_REP_SOURCE",
        "DEBUGTRACK: Operation GUID: %s",
        "ERROR_UNKNOWN_COMPONENT",
        "Failed to load hive into key %ws from %s. Status: %x",
        "Rollback-Online-User started.",
        "RegLoadKeyW",
        "2$222<2M2Z2c2k2q2x2",
        "SPGetPartitionOrdinal: Failed to enumerate the parent disk's partitions: 0x%08x",
        "  DISM boot critical: %s",
        "class SysprepComponent *const &__thiscall UnBCL::ArrayList<class SysprepComponent *>::get_Item(int) const",
        "$Recycle.Bin",
        "505;5O5V5^5k5w5",
        "2!242@2O2f2m2s2x2",
        "4!4'4,474F4Z4v4",
        "Detected system firmware type = 0x%X",
        ";;;c;j;",
        ">$>,>4><>D>L>T>\\>d>t>|>",
        "Will not process WIMBoot file %s, it does not have a drive letter",
        "=$=>=Y=",
        "4$464S4w4",
        "=X=e=}=",
        "8*878@8H8R8Z8`8e8x8",
        "949E9Q9b9t9}9",
        "ERROR_DS_CANT_MOVE_ACCOUNT_GROUP",
        "QRRRh(B",
        "ERROR_PATCH_PACKAGE_INVALID",
        "9\\$,t",
        "<(<4<<<X<d<l<",
        ".?AUIProvPackageLogger@@",
        "=$=,=4=@=`=h=p=",
        "252`2n2",
        "Invalid VolumePathNameLegth %ws",
        "3\"343<3B3O3a3o3",
        ".?AVCSetBootCommand@@",
        "Failed to allocate memory for EVENT_TRACE_PROPERTIES: 0x%x",
        ".?AV?$DefaultInstanceFactory@VCCompressWIMBootFiles@@@UnBCL@@",
        "j@XVPhh",
        "7 8h8",
        "DiskLayout::ExecDeletions: Deleting partition %u",
        "?%?*?5?@?T?b?p?",
        "pReadPageFileSettingsAndWriteToConfigFile: Failed to get current control set (0x%08x)",
        "void __thiscall UnBCL::ArrayList<class CDrvStoreProperty *>::AddRange(const struct UnBCL::ICollection<class CDrvStoreProperty *> *)",
        ".?AV?$HTDictEnumBase@PAVCSPInternalPluginData@@@_@UnBCL@@",
        "?(?1?9?P?j?",
        "CDeploymentProject::CreateBootableMediaDeployment: Failed to convert target disk to MBR style (0x%08x)",
        "Migrate data",
        "ERROR_UNABLE_TO_INVENTORY_TRANSPORT",
        "AllocateAndResize",
        "==- DUUpdateInfo -======================================",
        "QPWSQQhP",
        "Executing end-install apply",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "9-9?9G9M9Z9l9",
        "464=4J4R4]4e4o4v4|4",
        "%s\\%s%d%s",
        "void __thiscall UnBCL::Array<class DiskLayout *>::Remove(class DiskLayout *)",
        "8)818M8T8Z8d8t8",
        "SPInitializeDiskPlatform",
        "1)1O1b1n1u1{1",
        ":#:7:D:P:\\:p:z:",
        "8 8-898M8Y8m8",
        "QWj1jM",
        "y Phh",
        "PrepopulateList",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::MoveNext(void)",
        "MissingEAsNewOS",
        "StateStoreSetMountedImageTime",
        "1*1C1H1O1d1v1",
        "%hs: Register RollbackOnlineUser command %s%s%s",
        "< <?<I<f<",
        "spGetWIMFileSizes",
        ">*>@>K>[>e>w>",
        "CDeploymentProject::CreateBootableMediaDeployment: Failed to initialize target disk with MBR style (0x%08x)",
        "1&1/181A1J1S1w1",
        "L$\\Pj",
        "8 828:8@8M8_8m8z8",
        "3-454B4W4d4y4",
        "4/5f5s5",
        ":#:<:",
        "JET_errColumnInUse",
        "5*6X6",
        "f_fYf",
        "=\"='=1=8=F=X=i=p=",
        "SVhH|",
        "void __thiscall UnBCL::Array<class CWIMBootData *>::Remove(class CWIMBootData *)",
        "CreateProfileForUser succeeded but the user has no profile. Exiting.",
        "ZwOpenDirectoryObject",
        "void __thiscall UnBCL::ArrayList<class CShellFolderInfo *>::RemoveAt(int)",
        "RtlRaiseStatus",
        "<)<:<R<j<",
        ": :.:;:M:U:[:h:z:",
        "CSetupPlatform::ResurrectAutomation: Can't initialize disk provisioning: 0x%08X",
        "SmDisk::CreatePartition: Failed to create partition enumerator (0x%08x)",
        "?RegisterNamespaces@XmlDocument@UnBCL@@QAEXPAVString@2@@Z",
        "ERROR_INSUFFICIENT_LOGON_INFO",
        "151D1o1~1",
        "VdsVolume::RemoveDriveLetter",
        "VERBOSE: MOVETRACK: File%s could not be removed. Error: 0x%08X",
        "ERROR_DS_INVALID_ROLE_OWNER",
        "RpcBindingFree",
        "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;",
        "0)0.030>0M0e0n0",
        ".PAVCXXXXXTemp@?DJ@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "FindMatchingDeviceInfoData",
        ">,?N?`?t?",
        "SetupState",
        "XSP_ENV_FAIL_VALIDATOR_LP",
        "1(2d2",
        "Cannot delete %s. Error: 0x%08X",
        "SPGetPartitionOrdinal: Failed to iterate over the parent disk's partitions: 0x%08x",
        "<$<2<;<E<\\<r<",
        "OC::COCDismAdapter::GetFoundationPackageName: DismGetPackages failed. hr = 0x%x",
        "Reserved.FirstApply",
        ";/;_;",
        "Offline apply",
        "3(30383@3H3T3t3|3",
        "7(8t8",
        "syswow64",
        "='=B=H=R=W=a=h=v=",
        "'0?0K0]0{0",
        "304m4",
        "7G7N7U7\\7c7j7p7{7",
        "?K?a?v?|?",
        "=!=3=A=e=",
        "CSetupPlatformCheckpoint::CopyLogFiles",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCUserProfile@@@UnBCL@@@UnBCL@@",
        "1^1p1x1~1",
        ">(>1>=>G>j>",
        "    Failed to get next type",
        "InstallOrder.ini",
        "PostThreadMessageW",
        "  UploadTelemetryData: %d",
        "SearchPathW",
        "storeDir",
        "0-040:0?0J0U0e0n0w0",
        "Failed to merge tracing file: %s. hr = 0X%x",
        "%hs: WindowsOld.wim found",
        "class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::get_Current(void) const",
        ";!;(;F;p;",
        "2Q3s3",
        "t;htm",
        "Battery Information - LifePercent: %d, LifeTime: %d, ACLineStatus: %d, BatteryFlag: %d",
        "%hs: Could not find the scratch directory and the user cancelled",
        "Ix,N*I",
        "=\"=/=6=@=Q=^=h=w=",
        "void __thiscall UnBCL::ArrayList<class OSRollbackService::CCheckpoint *>::CopyTo(class UnBCL::Array<class OSRollbackService::CCheckpoint *> *,int) const",
        ".?AV?$SmartPtr@V?$ArrayList@UDiskRange@@@UnBCL@@@UnBCL@@",
        "base\\ntsetup\\migration\\setup\\oc\\lib\\src\\ocimageservicingadapter.cpp",
        "3 3%303;3O3m3",
        "Source key [%ws] didn't already exist",
        "CSecurityHeaderWriterT<class CEmptyType>::Done",
        "=%=+=0=;=E=X=a=h=",
        "8$8C8S8c8p8",
        "7%7+707;7A7T7Y7h7p7",
        "ERROR_NO_SUCH_USER",
        "9 9(909@9H9l9t9|9",
        "System32\\kernel32.dll",
        "WPRQh",
        "6>7I7v7",
        "3 3&3+363=3Q3]3",
        ";-;W;v;",
        "5 5*535=5F5`5",
        "WIMCommitImageChanges",
        "void __thiscall UnBCL::ArrayList<class COperationInfo *>::CopyTo(class UnBCL::Array<class COperationInfo *> *,int) const",
        "No deferred service to enable",
        "{D71D3ADF-AC1B-4D0B-BA89-EC7858A0B857}",
        "PVWh ",
        "5W5w5",
        "5 5,545\\5d5l5",
        "2\"2)2=2Z2v2",
        "CERT_E_EXPIRED",
        "xSP_ETW_TRACING_REG_FILE",
        "VdsPartition::BringOnline: Couldn't get volume object for partition (0x%08x)",
        "3%3,323T3b3p3|3",
        "    Failed to allocate spSourcePath.get()",
        "6\"757\\7",
        ".?AUIPartitionEnumerator@SetupPlatform@@",
        "?4?Z?o?w?}?",
        "=B=I=O=T=`=r=z=",
        "ERROR_CTX_SHADOW_INVALID",
        "=(=:=T=f=",
        "COperationQueue::ExecuteOperations",
        "<4<G<O<U<b<t<",
        "PPPPh",
        "An error occurred while preparing the WIMBoot info file %s",
        "5@6n6",
        "?8?@?J?\\?j?q?|?",
        "=*=8=F=T=",
        "2G2N2Z2_2o2w2",
        "9\"9?9m9",
        "L$,QP",
        "Enumeration of hive list failed. Error: 0x%08X",
        "6%6+686I6V6h6",
        ":#:-:7:D:a:k:u:",
        "__thiscall UnBCL::ArrayList<unsigned short *>::ArrayList(const struct UnBCL::ICollection<unsigned short *> *)",
        "\\lL\\q",
        "%hs: End run. Result: 0x%08X",
        "sSmVolume::Format",
        ">!>3>L>k>",
        "UD;UD",
        "VdsDisk::CreatePartition: Can't copy LDM metadata partition name (0x%08x)",
        "Driver package information not available; installation decisions might not be accurate",
        ".?AV?$SerializableBase@VCEnableTracingForImage@@$0A@V?$DefaultInstanceFactory@VCEnableTracingForImage@@@UnBCL@@@UnBCL@@",
        "Marking event [&SclEvent_ProcessSystemRegistry_Start]",
        "CRYPT_E_NO_REVOCATION_CHECK",
        "9B\\t\"9C8t",
        ".?AU?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@@UnBCL@@",
        "8!8*8;8M8V8_8h8q8",
        "ExclusionList",
        "CTrustSafeOS::DoExecute: Failed to remove safe OS hash on error path: 0x%08x",
        ";<;p;",
        "20>0P0[0h0x0",
        "void __thiscall UnBCL::Array<struct _GUID>::Remove(struct _GUID)",
        ">9>?>J>X>",
        "8'8m8",
        "CInstallDUUpdatesOffline::FindUpdates",
        "?1?h?p?",
        "    Failed to get temporary file",
        "class CDeploymentBase::CMountedPathInfo *__stdcall UnBCL::Try_Cast<classCDeploymentBase::CMountedPathInfo*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "<&<6<v<",
        "7#717y7",
        "0!0&0:0K0b0i0o0t0",
        "5\"5F5T5^5g5p5",
        "{14D11E35-4128-480C-A5F4-082D59FFF82C}",
        "void __thiscall UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::RemoveAt(int)",
        "%hs: Set the reference to the recovery WIM image \"%s\"",
        "IsSecureBootBound",
        "CDeploymentProject::CreateVHDDeployment: Failed to create VHD image %s; Error: 0x%08X",
        "8%898Q8_8",
        "2(292F2O2",
        "3U4Z4_4k4",
        "[Partition %d]",
        ":+:H:a:r:{:",
        "?&?;?E?m?",
        "SclRegGetString",
        "Untag Sources Folder",
        "91:Q:Y:r:",
        "Failed to set privileges.",
        "Set reg key value MinimumBuffers failed: 0x%x",
        "\\Device\\%s\\%s0",
        "<*<=<D<J<O<Z<k<s<y<~<",
        "7:8R8a8p8",
        "REG_FULL_RESOURCE_DESCRIPTOR",
        "<.<k<",
        ".?AV?$SmartPtr@VMemoryStream@UnBCL@@@UnBCL@@",
        "D$$PR",
        "SPGetReserveManager: Failed to get Update Reserve Manager. hr = 0x%08X",
        "Failed to enable bitlocker on some drives. Result: 0x%08X",
        "4)4>4C4P4^4t4",
        "ERROR_IPSEC_IKE_INVALID_AUTH_PAYLOAD",
        "3,393N3V3f3",
        ";+;7;?;U;a;i;};",
        "=k=r=",
        "CARPValidator::AddToSFList",
        "Failed to merge old telemetry file [%s]: 0x%x",
        "  Parameter 1  : 0x%I64X",
        "4/4@4G4M4R4a4h4",
        "DLManifests",
        "%hs: failed to copy crash dump file. Error: 0x%08X",
        "Locale",
        "CNewSystem::QueueOperations: Failed to estimate page file disk space impact: 0x%08x",
        "ERROR_NO_GUID_TRANSLATION",
        "BitLocker turned on after upgrade, uninstall cannot continue.",
        "JET_errConsistentTimeMismatch",
        "ERROR_OPEN_FAILED",
        "4'474>4D4I4T4^4c4w4",
        "struct PartitionLayoutArgs *&__thiscall UnBCL::ArrayList<struct PartitionLayoutArgs *>::get_Item(int)",
        "x&WVh",
        "Failed creating the package from %S",
        "class UnBCL::DictionaryEntry<unsigned long,struct IVdsDisk *> __thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,class UnBCL::DictionaryEntry<unsigned long,struct IVdsDisk *>,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<unsigned long,struct IVdsDisk *> __stdcall UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::TableKey,struct IVdsDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsDisk *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "int __thiscall UnBCL::Array<class CSimpleCleanup::CCleanupEntry *>::Add(class CSimpleCleanup::CCleanupEntry *)",
        "8'8|8",
        "5+505l5",
        "Adding driver payload with properties failed, trying to add without properties. Error: 0x%08",
        ".PAVCXXXXXTemp@?BHC@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "7'8L8",
        "Tel-Merge",
        "> >)>1>7><>A>Y>e>|>",
        "%SystemDrive%\\pagefile.sys",
        "ERROR_FILE_OFFLINE",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::TableKey,struct UnBCL::ISerializable *,struct UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *>::KeyTraits,class ATL::CElementTraits<struct UnBCL::ISerializable *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,struct UnBCL::ISerializable *> *,class UnBCL::Array<class UnBCL::String *> *,int)",
        "SPLogFilterDrivers",
        ">C?n?s?",
        ">$>3>D>Q>Z>m>~>",
        "JET_errLogFilePathInUse",
        "%hs: Cannot queue registry creation operation. Error: 0x%08X",
        "CDownloadDUUpdates::DoExecute",
        "%s: Error while moving %s to %s. Error: 0x%08X",
        "585R5g5o5u5",
        "ERROR_DS_MODIFYDN_DISALLOWED_BY_INSTANCE_TYPE",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAVCDriverInstallInfo@@UTableKey@?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@PAV3@UKeyTraits@52@$1?RetrieveValue@52@KGPAV3@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@PAVCDriverInstallInfo@@UKeyTraits@23@V?$CElementTraits@PAVCDriverInstallInfo@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        ")VdsImageDisk::GetProperties",
        "void __thiscall UnBCL::Array<struct UnBCL::ISerializable *>::InitLarva(class UnBCL::ArrayList<struct UnBCL::ISerializable *> *)",
        "na:Hidden",
        ".?AVCRemoveSRCheckpoints@@",
        "void __thiscall UnBCL::ArrayList<struct PageFileDesc *>::AddRange(const struct UnBCL::ICollection<struct PageFileDesc *> *)",
        "SWhx,",
        "979B9V9t9",
        "0!0&010<0P0X0`0o0w0",
        "Failed to initialize DISM. Error: 0x%08X",
        "void __thiscall UnBCL::ArrayList<struct SetupPlatform::IDisk *>::AddRange(const struct UnBCL::ICollection<struct SetupPlatform::IDisk *> *)",
        "20201008050501Z",
        "?ToString@StringBuilder@UnBCL@@UBEPAVString@2@XZ",
        "8$8(888<8L8P8`8d8t8x8",
        "?#?1?8???J?X?`?j?r?x?",
        "1#181A1F1N1_1p1",
        "1,1f1~1",
        "F0C;X",
        "252@2P2Z2l2t2z2",
        "?(?0?6?;?J?[?h?q?",
        "struct DiskRange __thiscall UnBCL::_::ArrayListEnumerator<struct DiskRange>::get_Current(void) const",
        ":\":4:B:e:z:",
        ">3>Y>`>f>k>v>",
        "1@2J2`2",
        "Exporting store to efi",
        "ERROR_CTX_LICENSE_EXPIRED",
        "4#4,454D4g4t4}4",
        "=&=.=4=I=R=b=i=o=t=",
        "747Q7h7",
        "7\"8;8P8X8^8k8}8",
        "8(8A8X8q8",
        "7l8z8G:R:]:{:",
        "VERBOSEOPS: %sChecking operation with ID %u for phase %u",
        "<@<_<d<p<",
        "0%0+080J0c0",
        "CSetupAutomation::Resurrect: Failed to initialize COM: 0x%08x",
        "818B8o8",
        ".?AU?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAVCSPInternalPluginData@@@UnBCL@@@UnBCL@@",
        ".?AUIFlowControls@@",
        "7-777A7G7T7p7",
        "5*6T6s6",
        "SetupPlatform::IsUninstallAllowed failed on online OS. Error: 0x%08X",
        "0 080\\0p0x0",
        "ERROR_EC_NO_ACTIVE_CHANNEL",
        ".?AV?$DefaultInstanceFactory@VCPrepareSysPrep@@@UnBCL@@",
        "=6=K=S=Y=b=x=",
        "void __thiscall UnBCL::ArrayList<void *>::set_Item(int,void *)",
        "91989>9C9K9R9r9{9",
        "3,343<3D3L3T3d3l3t3|3",
        ".didat$7",
        "SPCanChangeRecoveryPartition: FindFirstVolume failed: 0x%08x",
        ".PAVCXXXXXTemp@?3??DoExecuteInternal@CDownloadDUUpdates@@IAEJHHPAUIDownloadCallback@SetupPlatform@@PAUIExecutionContext@@PAUITelemetry@@PAXPAUIDUDownloadProgress@4@PAPAVCDUPackageCollection@@@Z@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *>::Insert(int,class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class CGlobalPath *> *)",
        "y VhH",
        "ERROR_VOLUME_DIRTY",
        "5$6?6]6i6",
        "Execute.PreRollback",
        "%04u-%02u-%02u %02u:%02u:%02u",
        "Low disk space detected, pushing WIM apply to SafeOS phase",
        "VdsPlatformDiskEnumerator::Initialize: Failed to refresh the service (0x%08x)",
        "X051N1S1w1|1",
        "%s %u%s",
        "3+353H3P3W3e3u3",
        "3.3R3Y3_3d3s3~3",
        "617N7`7j7",
        "K32GetModuleFileNameExW",
        "quz-BO",
        "%hs: Cannot load the SOFTWARE hive for the offline OS %s. Error: 0x%08X",
        "=5=h=",
        "SPAPI_E_MACHINE_UNAVAILABLE",
        ":%;:;O;V;\\;a;l;v;",
        "A disk read error occurred",
        "    Failed to copy value string",
        "void __thiscall UnBCL::ArrayList<struct DiskLayout::Partition>::QuickSort(class UnBCL::ArrayList<struct DiskLayout::Partition> *,class UnBCL::ArrayList<struct DiskLayout::Partition> *,int,int)",
        "3'333?3K3c3{3",
        "class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *const &__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::get_Item(int) const",
        "3+3?3Y3n3u3{3",
        "__thiscall UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::ArrayList(const struct UnBCL::ICollection<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo> *)",
        "xSPDisableSetupAutoLoggerSessionOnline",
        "RollbackException: Error(%d), %s",
        "282K2R2X2]2h2s2",
        "CDeploymentProject::CreateVHDDeployment: Environment not set up for creating VHD deployment; Error: 0x%08X",
        "F;t$ ",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::RemoveAt(int)",
        "7_8y8",
        "4,4H4h4",
        "0.0Q0X0_0j0~0",
        "6E6W6_6e6r6",
        "<\"<=<F<g<n<t<y<",
        "CMediaLayout::QueueProvisioningPackages: Failed to get the size of %s: 0x%08x",
        "6?6`6",
        "4\"4(42474A4H4V4h4y4",
        ".?AVCXXXXXHandledException@?BCJ@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        ".?AVCWinOldCleanup@@",
        "ZwDeleteValueKey",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVCGlobalPath@@@UnBCL@@@_@UnBCL@@",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,&protected: static unsigned long __stdcall UnBCL::Hashtable<class UnBCL::String *,unsigned long>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::TableKey,unsigned long,struct UnBCL::Hashtable<class UnBCL::String *,unsigned long>::KeyTraits,class ATL::CElementTraits<unsigned long> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,unsigned long> *,class UnBCL::Array<unsigned long> *,int)",
        ".?AV?$SerializableBase@VCAppXValidator@@$0A@V?$DefaultInstanceFactory@VCAppXValidator@@@UnBCL@@@UnBCL@@",
        "202I2P2\\2a2k2{2",
        ".?AVCXXXXXHandledException@?FL@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "  Operation (skipped)  : %s",
        "DriverStoreEnumW",
        "Failed to get package install timestamp for package: %ws.",
        "3%343=3C3P3V3[3}3",
        "ERROR_PRINTER_DRIVER_IN_USE",
        "V<^_]",
        "9*989A9S9e9o9x9",
        "?(?<?P?d?x?",
        "\\KernelObjects\\BcdSyncMutant",
        "7:7@7T7k7{7",
        ":!:0:7:F:T:{:M;T;`;v;",
        "RegGetValueW",
        ";,;0;@;D;T;X;h;l;|;",
        "RPC_S_INVALID_OBJECT",
        ".?AV?$SerializableBase@VCAppInfo@@$0A@V?$DefaultInstanceFactory@VCAppInfo@@@UnBCL@@@UnBCL@@",
        "\\windows\\system32\\winload.exe",
        "oobeSystem",
        "?7?}?",
        "j+Xf;",
        "9(909L9T9\\9t9|9",
        ":0;5;?;];x;",
        "|BOOTMGR|",
        "??1SerializationStream@UnBCL@@UAE@XZ",
        "CNewSystem::QueueSetupAutomation: Failed to get driver migration (0x%08X)",
        "6!757G7O7U7^7t7~7",
        ".?AV?$SmartPtr@VDateTime@UnBCL@@@UnBCL@@",
        "void __thiscall UnBCL::Array<class CDeviceIdDatabase::CDeviceInfoData *>::Remove(class CDeviceIdDatabase::CDeviceInfoData *)",
        "WinReSetupCheckWinRE",
        "=$=(=8=<=L=P=`=d=t=x=",
        ";);=;O;h;s;",
        "CSetupPlatform::CreateNewSystem: Failed to get binary architecture of %s. hr = 0X%x",
        "> >0>4>8>P>T>X>\\>d>h>l>",
        "3P3\\3b3g3",
        "9O9n9",
        ">(>0>6>C>U>f>",
        "Internal operation",
        "1&1<1J1\\1d1j1s1",
        ".?AVCXXXXXHandledException@?8??SPGetWIMBootEntries@@YGPAV?$ArrayList@PAVCWIMBootData@@@UnBCL@@GH@Z@",
        "1#101B1P1]1o1w1}1",
        "ERROR_UNWIND",
        "Exception while executing operation. Message: %s",
        "=0>7>",
        "?,?W?c?|?",
        "VERBOSE: MOVETRACK: Destination %s exists, attribs: 0x%08X, removing it",
        "VerifyAttribute",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *> *,int) const",
        ".?AVStreamReader@UnBCL@@",
        ".?AV?$SmartPtr@VCFindAllPathsData@@@UnBCL@@",
        ":#:K:Q:W:y:",
        ":\":.:>:C:O:d:n:",
        "{3A84AA31-E03B-4CF4-9E6F-60A7152F9006}",
        "PPPPW",
        "(%lx): Failed to initialize SetupCl context",
        ":&:-:3:8:C:P:d:x:",
        "Migrate SxS configuration from old windows",
        "8.9S9p9",
        "2e3{3",
        "9>9M9]9h9u9",
        "GetQueuedCompletionStatus",
        "/IMAGE/INDEX",
        "Partition/Volume extension succeeded.",
        "BCD%08d",
        "4%4,4",
        "SPCreateSnapshotWithScoping: Create snapshot on volume [%s]",
        "2C2P2q2~2",
        ">\">*>1>?>Q>^>k>q>",
        "7 7*71777<7G7R7f7u7",
        "5!5+5>5N5",
        "5,5H5l5|5",
        "%hs: Successfully created the downlevel volatile key for rollback",
        "QQj j",
        ".?AV?$SmartPtr@VCDUDownloadProgressWrapper@@@UnBCL@@",
        "Rollback-Online-User completed successfully.",
        "fSfRf+",
        "BcdOpenStore failed with unexpected error code, Status = [%x]",
        "Element::AddPayload",
        "CAbstractDisk::Initialize",
        "=4=;=A=F=V=]=c=h=s=",
        "1b1i1u1z1",
        "Couldn't store flight ID for driver package %s. hr = 0x%x",
        "<&<L<]<j<w<",
        "1#1(131=1B1V1}1",
        "|SYSPART|\\|DEST|\\|BOOTMGR|",
        "=+=N=W=",
        "4:4]4",
        "6-6F6_6f6m6s6",
        "8'838?8K8T8w8",
        "YY_f;",
        "CSetupPlatformOSSwitchCheckpoint::Rollback: Path %s was not yet moved to the root, skipping",
        "D$(PSj",
        "__CxxFrameHandler3",
        ".?AV?$ArrayList@PAVSysprepComponent@@@UnBCL@@",
        "PRQQh",
        "1 181<1T1X1p1t1",
        "class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *> *__stdcall SPReadDriversList(const unsigned short *)",
        "FveCloseVolume",
        "SPDeleteAllSnapshots: %s %I64d space",
        "Flushing registry to disk...",
        "9(90969J9P9Y9o9}9",
        "Service %s changed to start type 0x%08X successfully.",
        "ProcessJournalEntries: Old OS: %s",
        "1(0&0",
        "const unsigned int &__thiscall UnBCL::ArrayList<unsigned int>::get_Item(int) const",
        "VdsDisk::CreatePartition: Can't copy partition name %s (0x%08x)",
        "PSFX_E_APPLY_FORWARD_DELTA_FAILED",
        ".?AU?$IEnumerator@PAUIPartition@SetupPlatform@@@UnBCL@@",
        "3#3*383J3[3b3x3",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::MoveNext(void)",
        "?$?0?<?H?T?`?l?x?",
        "8&828Q8W8l8s8",
        "%hs: Load hive %s",
        "<;=M=U=[=h=z=",
        "ERROR_DS_DRA_NOT_SUPPORTED",
        "XClassGuid",
        "0&090B0Q0a0w0",
        "3(3,3<3@3P3T3d3h3x3|3",
        "%hs: Failed to get image state from the software hive. Error: 0x%08X",
        "ERROR_UNABLE_TO_MOVE_REPLACEMENT",
        ":&:2:N:[:a:f:u:",
        "9(9<9P9d9x9",
        "404@4V4o4v4",
        ";!<+<R<h<}<",
        "CleanupDuration",
        "onecore\\base\\ntsetup\\lib\\devicecompat\\src\\drvstore.cpp",
        "cbs.log",
        "Using default uninstallwindow: %d days",
        "ERROR_DS_DATABASE_ERROR",
        "MIG Validator: Forcing validator failure due to environment variable.",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::GetBuffer(int) const",
        "v1j\\^f;0u",
        ":1;6;D;^;c;q;",
        "pAddSafeOSDrivers",
        "ERROR_CTX_WINSTATION_ALREADY_EXISTS",
        "CoreSingleLanguage",
        "4#4.4:4F4R4",
        "ERROR_DS_DESTINATION_DOMAIN_NOT_IN_FOREST",
        ":):=:h:",
        "ERROR_PATCH_PACKAGE_UNSUPPORTED",
        "ERROR_DS_UNKNOWN_OPERATION",
        "010?0L0^0f0l0y0",
        "3%393C3j3",
        "7?7L7Y7",
        "DataAsset",
        ".PAVCXXXXXHandledException@?2??pGetExistingPageFiles@@YGJPAVString@UnBCL@@PAV?$ArrayList@PAUPageFileDesc@@@3@@Z@",
        "=\"=,=1=9=@=L=^=s=",
        ":1:C:V:]:s:",
        ";\"<@<G<M<R<]<n<",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: successfully recovered WinPE memory crash dump file",
        "<8<U<^<p<|<",
        "__thiscall UnBCL::ArrayList<unsigned int>::ArrayList(const struct UnBCL::ICollection<unsigned int> *)",
        "=+=0=9=E=Q=V=_=k=w=|=",
        "364=4",
        "CoCreateGuid",
        "6$60656I6d6r6y6",
        ".PAVCXXXXXTemp@?6??DoExecute@CEnableFeature@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "SclGetPendedRequest",
        "CMediaLayout::QueueInstallImage: Failed to get the size of %s: 0x%08x",
        "4\"4(4-4;4G4Q4Y4_4d4r4~4",
        "8Z8z8",
        "4S5Y5",
        "747l7s7y7~7",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,class ATL::CElementTraits<struct HKEY__ *> > const *,struct __POSITION * const &)>::Reset(void)",
        "717@7|7",
        "SKIPBOOTTRACK(FIRST): 1st boot apply complete, no need to run online",
        "3!3-353A3I3U3]3i3q3",
        "3O4V4\\4a4n4{4",
        "%hs: Set BCDE_LIBRARY_TYPE_DESCRIPTION succeeded.",
        "int __thiscall UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *>::BinarySearch(int,int,class OC::CCmdLineExecutionTelemetryData *,struct UnBCL::IComparer<class OC::CCmdLineExecutionTelemetryData *> *)",
        ">b?n?t?y?",
        "ReleaseVolumeAccessPath: Released access path '%c:\\'",
        ".?AVCUninstall@@",
        "CEnableTelemetryForImage::DoExecute",
        ")AddAccessPath",
        "CUpdateBootSector::DoExecute: Failed to get firmware type. Error code is [0x%X]",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class COperation *>::Reset(void)",
        "ERROR_DS_IS_LEAF",
        "void __thiscall UnBCL::Array<struct DiskRange>::InitLarva(class UnBCL::ArrayList<struct DiskRange> *)",
        "2 2$2<2@2X2\\2t2x2",
        "141\\1",
        "DiskInitialize",
        "y&ShE",
        "CGatherData: Migration phase failed. Status: %d",
        "CBS_E_IMAGE_UNSERVICEABLE",
        ";/;j;|;",
        "WIMExtractToHandleFromMountReparseData",
        "4=5n5",
        "0$141@1`1h1p1x1",
        "?&?>?F?P?W?]?b?m?x?",
        ".PAVCXXXXXTemp@?6??Execute@DiskLayout@@QAEJPAX@Z@",
        "<J<`<w<~<",
        "3'3?3F3U3m3s3",
        ".?AV?$SmartPtr@VCVhdBootData@@@UnBCL@@",
        "8!848s8",
        "5)5<5C5I5N5Y5c5v5",
        ".?AU?$IEnumerable@PAVCDrvStoreProperty@@@UnBCL@@",
        "GetSecInfo failed",
        "const unsigned char *__thiscall UnBCL::ArrayList<unsigned char>::GetBuffer(int) const",
        "int __thiscall UnBCL::ArrayList<class CCopyInfo *>::IndexOf(class CCopyInfo *,int,int) const",
        "QQVWh`",
        "CApplyDataOffline::DoExecute",
        ":B:I:W:i:}:",
        "CDeploymentProject::CreateVHDDeployment: Failed to get compact OS option; Error: 0x%08X",
        "CApplyWIM: Failure while opening image %s from %s. Error 0x%08X",
        "Found applicable driver %s; adding it to the installable list.",
        "BfsInitializeBcdStore flags(0x%08x) RetainElementData:%c DelExistinObject:%c",
        "=!>M>q>}>",
        "COMPONENTS",
        "void __thiscall UnBCL::Array<class COperationResult *>::Remove(class COperationResult *)",
        "989X9x9",
        "5/64696E6j6",
        "CreateXmlReader",
        "ERROR_WX86_WARNING",
        "ERROR_TRANSACTIONMANAGER_NOT_FOUND",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "IMPLIED",
        "tn8^\\t",
        "FirstUXWndObject",
        "RtlReAllocateHeap",
        "CDownloadDUUpdates::MoveOrCopyUpdates: IDUUpdate::GetType failed. hr = 0x%x",
        "?(?X?b?i?o?t?",
        ".?AVSmVirtDisk@@",
        ".?AV?$DictionaryEntry@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@",
        "Failed to convert guid to string. Status: %x",
        ";<;D;L;T;\\;d;l;t;",
        "<$<,<4<<<D<L<X<x<",
        ".?AV?$CAutoRelease@PAVWmiArray@WMI@@@RAII@@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::set_Item(int,class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *)",
        "DismDisableFeature",
        "8\"8*8j8",
        "2!2-292\\2c2i2n2y2",
        ".?AV?$SerializableBase@V?$Array@PAVCOperation@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCOperation@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        ";P;^;n;{;",
        "7(70787@7P7X7t7|7",
        "twSV3",
        "42484N4a4n4{4",
        "?#?,?=?E?R?o?",
        "EnvVariable",
        "7$777~7",
        "4#4-4@4M4T4c4m4",
        "3'3<3D3J3W3i3",
        "ExecuteFailForward: Showing splash window with begin text: %s",
        "8\"8+83898N8Z8j8z8",
        "4'4:4D4d4j4s4{4",
        "2<3J3",
        "Apply (oobe boot apply, offline phase): Migration phase failed. Result: %d, specific error: 0x%08X",
        "4 4-454;4O4[4c4h4m4",
        "DownLevelStartTime",
        "S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415",
        ":K:R:X:]:i:q:",
        "9+92999@9G9N9T9_9z9",
        "ERROR_DS_DUP_LDAP_DISPLAY_NAME",
        "SL_E_CHPA_FAILED_TO_INSERT_PRODUCT_KEY_RECORD",
        ">;>U>p>",
        "MetaDeployment.Env",
        ": :-:9:F:R:_:k:w:",
        ".?AV?$DefaultInstanceFactory@VCSetDefaultBootEntry@@@UnBCL@@",
        "int __thiscall UnBCL::ArrayList<struct DISK_SPACE_IMPACT>::BinarySearch(int,int,struct DISK_SPACE_IMPACT,struct UnBCL::IComparer<struct DISK_SPACE_IMPACT> *)",
        "CMediaLayout::ExecuteOptimization: Failed to estimate size of applying provisioning package at index %d: 0x%08x",
        ".?AVCXXXXXHandledException@?LF@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "lntdll.dll",
        "CSetupAutomation::Save: Custom layout XML %s was provided; saving automation not supported",
        "tK!|$(",
        "8&878u8",
        "<*<4<9<F<P<c<h<t<",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCDeploymentBase@@@UnBCL@@@UnBCL@@",
        "7 7$7(7,7074787<7@7D7H7L7P7\\7h7t7",
        "9$979K9R9`9p9",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::LastIndexOf(class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *,int,int) const",
        "1)1X1",
        "=H=X=w=",
        "sr-Latn-ME",
        ":=:Q:`:l:",
        "wxPQS",
        "5&5,595?5D5]5i5{5",
        "w(hDW",
        "onecore\\base\\ntsetup\\provpackageapi\\lib\\packageapi.cpp",
        "CDownloadDUUpdates::FilterUpdates: IWindowsDriverUpdate::get_DriverClass failed. hr = 0x%x",
        "Updating boot entries to use new GUIDs.",
        "j3j)j",
        "__thiscall UnBCL::ArrayList<class CDriverDetails *>::ArrayList(const struct UnBCL::ICollection<class CDriverDetails *> *)",
        "ERROR_FUNCTION_NOT_CALLED",
        "JET_errTableDuplicate",
        "0,070G0T0h0|0",
        "DisplayVersion",
        "ERROR_SYMLINK_NOT_SUPPORTED",
        "_FC;]",
        "Shell folder %s redirected from %s to %s",
        "=)=9=A=K=b=w=",
        "SYSTEM\\Setup\\Snapshot",
        ".PAVCXXXXXTemp@?3??RestageWindows@CReconstructOS@@IAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "2.252_2f2l2q2|2",
        "SETUPPLATFORMEXE: Started communication server. Result: 0x%08X",
        ".?AV?$SmartPtr@U?$ICollection@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@",
        "2#252C2Q2_2m2{2",
        "1-1@1E1P1\\1f1s1",
        "ProgramFilesDir",
        "2+252<2B2G2R2]2q2",
        ".?AV?$Hashtable@PAVString@UnBCL@@PAUHKEY__@@@UnBCL@@",
        "353N3d3l3|3",
        ".PAVCXXXXXHandledException@?2??Initialize@CSetupPlatform@@QAEJPBGH@Z@",
        "8+888=8F8N8X8i8v8",
        "384?4S4Z4",
        "A\\;B\\u",
        "1\"1G1q1",
        "?(?6?>?D?I?]?s?|?",
        "OC::CDownlevelOCStore::IsDetectable: %s has an invalid XML format.",
        ".?AV?$Array@PAVSysprepAction@@@UnBCL@@",
        "4,4<4L4\\4l4|4",
        "454F4S4X4",
        "2&242H2W2b2v2",
        ":,:4:<:H:h:p:x:",
        "{E65230A9-E684-4359-8920-6323F108B9A9}",
        ")advanced disk",
        "??0exception@@QAE@XZ",
        "void __thiscall UnBCL::Array<struct DiskLayout::Partition>::Remove(struct DiskLayout::Partition)",
        "<I<c<x<",
        "ReconstructionProgressCallback::Error: ReconstructWindows failed: 0x%08x: %s",
        ".?AV?$CAutoRelease@PAUITracing@@@Mig@@",
        "SPAPI_E_SIGNATURE_OSATTRIBUTE_MISMATCH",
        "Failed to copy OS loader object data. Status = [%x]",
        ".PAVCXXXXXHandledException@?CO@??SPCanChangeRecoveryPartition@@YGHPAVString@UnBCL@@G_KPAHPA_K3333@Z@",
        "4+494G4U4",
        "CProcessDrivers::CleanupDrivers",
        ".?AVCBool@@",
        ">Y>z>",
        "void __thiscall UnBCL::ArrayList<class COperationInfo *>::QuickSort(class UnBCL::ArrayList<class COperationInfo *> *,class UnBCL::ArrayList<class COperationInfo *> *,int,int)",
        "CWIMPidgenxExtractor::ExtractPidgenx: SkuGetProductKeyFilesByWIMHandle failed.",
        "ERROR_EVT_UNRESOLVED_PARAMETER_INSERT",
        "UNBCL.DLL",
        "CARPValidator::ValidatePostExecution",
        "SetBkMode",
        "6-626?6_6d6",
        "E$j$Z",
        "6'616T6s6",
        ";#;+;6;=;I;P;Y;b;y;",
        ".?AV?$DefaultInstanceFactory@VCStoredPath@@@UnBCL@@",
        "FOD Validator: Failed to open DISM session. Error: %08X",
        "2X304",
        "WdsRemoveDirectory: Unable to remove directory [%s]; GLE = 0x%x",
        "automation.dat",
        ":#:,:5:>:J:V:_:h:u:",
        "    Failed to find metadata start node before element stop node",
        "INF %ws (source = %ws) is primitive, reason = %ws",
        "4.4;4C4U4]4q4",
        "SetCheckpoint(%s): threw exception.",
        "NtQuerySecurityObject",
        "212D2K2Q2V2b2j2~2",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *>::Insert(int,class UnBCL::DictionaryEntry<enum SetupPlatform::SP_MIG_PHASE,class UnBCL::String *> *)",
        "0$040<0D0L0T0\\0d0p0x0",
        "6\\6}6",
        "xDownlevelTime",
        "4+40494@4M4Y4b4n4s4|4",
        "%hs: Cannot find ICB in provisioning package %s. Error: 0x%08X",
        "applicationHost.config",
        "Instantiating an ICbsSession9 interface",
        "Failed to set reset timestamp",
        "6)666?6G6L6]6j6w6",
        "                                   Processor manufacturer : %s",
        "ReleaseSemaphore",
        ":do not ",
        "jaXf;",
        "0.0>0J0b0h0z0",
        "1)11171D1V1s1",
        "JET_errTooManyAttachedDatabases",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@W4SYNCEXEC_PHASE@SetupPlatform@@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        ".?AV?$SerializableBase@VCExecuteUnattend@@$0A@V?$DefaultInstanceFactory@VCExecuteUnattend@@@UnBCL@@@UnBCL@@",
        "ERROR_RANGE_NOT_FOUND",
        "?\"?4?L?X?h?z?",
        "777[7m7u7{7",
        "ERROR_DS_MODIFYDN_WRONG_GRANDPARENT",
        "%s (Error = %d)",
        ">->5><>J>W>k>",
        "ERROR_PRINTQ_FULL",
        "CManifestCategory::AppendDword",
        "ii-CN",
        "D$LPh",
        "6 7?7b7",
        "5(5:5F5M5S5X5c5n5s5",
        "XWinSetupBoot.hiv",
        "void __thiscall UnBCL::_::HTEnumerator<unsigned long,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,&protected: static struct IVdsVDisk * __stdcall UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsVDisk *> > const *,struct __POSITION * const &)>::Reset(void)",
        "1 10141D1H1L1d1h1p1",
        "8H9W9i9n9",
        "VWh '",
        "QQSVWj",
        "1\"1+171C1H1Q1]1i1n1w1",
        "Windows.old\\",
        "ro-RO",
        "?@?h?",
        "VdsPartition::GetResizeBounds",
        ">(>7>M>g>",
        "class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class CGlobalPath *,class CDriverInstallInfo *> *>::GetBuffer(int)",
        "3C4R4",
        "SPCreateSnapshotWithScoping: Failed to commit scoping. Error: 0x%08X",
        "8%8-8d8m8",
        "%hs: OS guid: %s",
        "OC status file not found. OC configuration will not be restored.",
        "class COperationInfo **__thiscall UnBCL::ArrayList<class COperationInfo *>::GetBuffer(int)",
        "SPApplyDeviceLayoutDiskConfig: Failed to parse XML content from %s: line [%d], position [%d], message [%s] (0x%08X)",
        "PVWhi",
        "9#979k9",
        "SL_E_VL_BINDING_SERVICE_UNAVAILABLE",
        ">K?Z?v?",
        "partition",
        "ERROR_DBG_TERMINATE_THREAD",
        "0 0%000>0N0d0",
        "    Failed to allocate spElementIndex.get()",
        "7\"72797>7G7L7`7",
        "<(<L<T<\\<d<l<t<|<",
        "9,959B9K9R9_9f9}9",
        "1+1B1[1w1",
        "ResetEvent",
        " J9\\$$u",
        ":/:6:<:A:L:X:",
        "qps-ploc",
        "Setup\\Status",
        "%SystemDrive%\\Windows.old\\$WINDOWS.~BT",
        "ReleaseSRWLockExclusive",
        "ERROR_CONTROL_C_EXIT",
        "0'151>1P1c1k1q1~1",
        "TrackVolume: Failed to mark that [%s] is on drive [%c:]; hr = 0x%X",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::AddRange(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *> *)",
        "31393",
        "Error while mounting the system hive. Error: 0x%08X",
        "ERROR_CLUSTER_IPADDR_IN_USE",
        "324L4W4\\4",
        "JET_errLogCorruptDuringHardRecovery",
        "C:\\Windows",
        "bs-Latn-BA",
        "292T2\\2}2",
        "%hs (%hs:%d): %s",
        "2$212C2Q2u2",
        "CApplyWIM: Failure while retrieving the WIM file to apply. Error 0x%08X",
        "int __thiscall UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *>::LastIndexOf(class CSimpleCleanup::CCleanupEntry *,int,int) const",
        "RemoveTraceCallback",
        "50585>5K5]5k5",
        "2'292G2Y2|2",
        "?5?O?i?}?",
        "CBS_E_WUSUS_MISSING_PACKAGE_MAPPING_INDEX",
        "CDownloadDUUpdates::FilterUpdates: VariantTimeToSystemTime failed. hr = 0x%x",
        ";*;M;c;",
        ">#>I>",
        "0 0F0w0",
        ".?AV?$ArrayList@PAVCCleanupEntry@CSimpleCleanup@@@UnBCL@@",
        "RtlImpersonateSelf",
        "SPTurnOffStorageReserve",
        "6%676?6E6N6d6n6",
        ":%:F:a:g:t:",
        "JET_errIndexTuplesNonUniqueOnly",
        ")StoreDirectory",
        "2-252;2O2[2f2}2",
        "Attempting the shrink the OS partition",
        "3 353s3z3",
        "\\pipe\\wimfltr",
        "long __thiscall CNewSystem::QueueOperations(class CImageInfo *)",
        "ERROR_IPSEC_IKE_INVALID_CERT_TYPE",
        ".?AV?$SerializableArrayBase@PAVCOperationResult@@@_@UnBCL@@",
        "5=5e5",
        "ncacn_np",
        "989T9p9",
        ":-:A:N:W:d:k:r:}:",
        "BiBindEfiEntries failed %x",
        "DiskLayout::VerifyPlanInOrder: Internal error: planned partitions aren't sorted by ascending offset",
        "Loaded servicing stack for offline use only.",
        "4=4U4t4",
        ".?AU?$IList@PAV?$DictionaryEntry@W4OP_EXECUTION_PHASE@@PAV?$ArrayList@PAVCOperation@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "575K5U5",
        "SPValidateProductKey: An error occurred while fetching product key block. (hr = 0x%X)",
        "LogVdsStatus: Failed to open VDS service (%s) to log its status: 0x%08x",
        "5[6s6",
        "pFinalizeUninstall: MoveDirectoryEx Failed, uninstall will fail; hr = 0x%x",
        "0'0B0R0Z0c0o0w0~0",
        "1!1)111F1M1V1[1f1",
        "p!c5Mf",
        "787X7x7",
        ";-<J<\\<}<",
        "4-4U4k4",
        "DispatchMessageW",
        "ERROR_MAX_SESSIONS_REACHED",
        "RPC_X_SS_CHAR_TRANS_OPEN_FAIL",
        "CAddDriver::DoExecute",
        "CPayloadWriterT<class CEmptyType>::UpdateOffset",
        "class CShellFolderInfo *__stdcall UnBCL::Try_Cast<classCShellFolderInfo*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        ">.>6>@>T>a>i>p>v>|>",
        "ActionPlatform::DeleteValue",
        "2?2G3",
        "PQPQh",
        "A 3F ",
        "Turning OFF respecialize per explicit environment variable request",
        ".PAVCXXXXXHandledException@?EI@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "(%lx): Failed to set: %ws ! %.*ws",
        "ERROR_CURRENT_DOMAIN_NOT_ALLOWED",
        ":(;G;w;",
        "OC::COCDismAdapter::EnableDisableOCs: DismEnableDisableFeature failed; the image is no longer serviceable. hr = 0x%x",
        "Failed to service spaces DLL. Last Error = %#x",
        "2=2R2Z2`2m2",
        "6,7[7",
        ".?AV?$DefaultInstanceFactory@VCRelocateOS@@@UnBCL@@",
        "=$=(=@=D=\\=`=x=|=",
        "?-?2?I?P?V?[?f?r?w?",
        "=3=@=X=e=q=v={=",
        ".?AU?$IEnumerator@I@UnBCL@@",
        ".?AV?$CAutoRelease@PAVVdsDisk@@@RAII@@",
        "CSplitWIM::DoExecute: Cannot set temp path. Error: 0x%x",
        "File counter can't be bigger than 10.",
        ".PAVCXXXXXTemp@?3??SPModifyOfflineHives@@YGHHHHPAVString@UnBCL@@@Z@",
        "$MARKER.SETUP",
        "515T5Z5e5s5",
        "6(656>6O6W6p6",
        "0*1=1I1]1t1",
        "GetSystemPowerStatus",
        "Relocate provisioning package to final location",
        "DiskLayout::GatherExistingPartitions: Failed to iterate over target disk partitions: 0x%08x",
        "E_POINTER",
        ":<:h:",
        "ERROR_MEDIUM_NOT_ACCESSIBLE",
        "AhN~%",
        ">=>G>]>",
        "8H9p9",
        "Download Language Pack Dynamic Updates",
        ";$;8;V;",
        "6;6\\6u6",
        "ERROR_DS_OBJECT_RESULTS_TOO_LARGE",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class COperationResult *>::MoveNext(void)",
        "zh-HK",
        "ERROR_NOT_OWNER",
        "?%?<?J?S?[?b?u?~?",
        "DiskLayout::WillBeLogical",
        "ERROR_SXS_UNKNOWN_ENCODING_GROUP",
        "Failed to shred package identity: %S",
        "%hs: Error while setting the SkipZDP value. Error: 0x%08X",
        ".?AV?$DefaultInstanceFactory@VCImageInfoSet@@@UnBCL@@",
        "??0?$Array@PAVString@UnBCL@@@UnBCL@@QAE@HH@Z",
        ":1:G:r:",
        "0!0,0@0U0Z0i0n0",
        "j9j_h@\\",
        "%hs: Failed to initialize COM security. Will use CoSetProxyBlanket instead. hr = 0x%08X",
        ".PAVCXXXXXTemp@?BPJ@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "4&494h4",
        "Hive %s is loaded under %s",
        ".PAVCXXXXXHandledException@?2??pSPMergeWim@@YGJPAVString@UnBCL@@0P6GKT_LARGE_INTEGER@@111KKPAX22@Z22H@Z@",
        "ERROR_NOLOGON_SERVER_TRUST_ACCOUNT",
        "SidAccountDomainNew",
        "CSetupRecoveryPartition::DoExecute: Failed to hash WIM file %s: 0x%0x",
        ">$>(>0>8><>@>D>L>P>T>X>\\>`>d>h>l>p>t>x>|>",
        ";$;,;D;x;",
        "PRODUCTNAME",
        "2+2Q2l2",
        "ERROR_ABANDON_HIBERFILE",
        "CReconstructOS::SaveTelemetryFields: Abandoned to save NumPackagesAbandoned: 0x%08x",
        "Apply image %s from %s to %s",
        "CDeploymentBase::SuspendAndRelease",
        "8'858~8",
        "      Files: %d",
        "PSh(S",
        "=;=H=a=}=",
        "1\"1+1B1P1b1y1",
        "PWVt'h.",
        "=.=;=G=g=o=",
        "8 808<8D8\\8d8|8",
        ".?AV?$SmartPtr@U?$IEnumerator@UDiskMatchFilter@@@UnBCL@@@UnBCL@@",
        "xCopy audit mode script payload from %s to %s",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "upgrade_data.xml",
        "xo@PQj]Z",
        "?!?.?5?;?@?K?U?h?u?|?",
        ".?AU?$IList@PAVCDriverDetails@@@UnBCL@@",
        "5)515F5]5c5n5|5",
        "5%505D5b5|5",
        "5$505<5P5Y5`5",
        "ImageIsFileOwned",
        "GetTemporaryFile",
        "int __stdcall UnBCL::MP::OperatorCompare<unsigned long>::Compare(unsigned long,unsigned long)",
        "Rollback: Failed to execute rollback. hr = 0x%08X",
        "NtQueryBootOptions",
        "242D2L2\\2l2t2|2",
        "::;];",
        ".?AV?$ValueCollection@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@_@UnBCL@@",
        "XSPCopySetupPlatform",
        "Current phase string : %s",
        "3)30363;3F3P3c3",
        "ERROR_IPSEC_IKE_PROCESS_ERR_CERT_REQ",
        "2a3h3",
        "VdsDisk::InitializeProperties: Couldn't copy disk friendly name (0x%08x)",
        "SmPlatform::IsAvailable: Couldn't initialize SM API (0x%08x)",
        "    Failed to assemble metadata file path (element type)",
        ";r<M=",
        "4/4`4i4",
        "ERROR_DS_SECURITY_ILLEGAL_MODIFY",
        "%hs: WindowsOld.wim path: %s",
        "Marking event [&SclEvent_ProcessUserProfiles_Start]",
        "CBS_E_MANIFEST_VALIDATION_MISSING_REQUIRED_ELEMENTS",
        "JET_errDensityInvalid",
        ".?AU?$ICollection@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@",
        "Failed hard-link to winSxS of old windows",
        ";,;4;B;Z;b;~;",
        ">@>Q>f>",
        "222:2A2Z2`2v2|2",
        "CSetupAutomation::Clone: Failed to clone configuration: 0x%08x",
        "ERROR_SERVER_HAS_OPEN_HANDLES",
        "UplevelBuildNumber",
        "SVhX%",
        "%s %s:\"%s\"",
        "<)<1<7<D<V<d<",
        "<#<;<D<N<d<",
        "MachineIndependent",
        "SL_E_SFS_INVALID_FS_VERSION",
        "SL_E_CHPA_UNSUPPORTED_PRODUCT_KEY",
        "CBS_E_INVALID_ACTION_LIST_PACKAGE_COUNT",
        "t%jbYf;",
        "SetupDiEnumDeviceInfo",
        "6+6<6E6O6\\6h6",
        "CSIDL_STARTUP",
        "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\sync.c",
        "pDecodeHexDigit",
        "                                   Processor name : %s",
        "SPProcessBitlockerOnDrives: Bitlocker failed to resume. Error: 0x%08X",
        "RestoreFilesCallback",
        "uTj-[f9\\0D",
        "CTurnOffReserve::DoExecute",
        "282@2H2X2|2",
        "9+9E9Q9^9o9u9",
        "Invalid object type. This object must point to a ramdisk.",
        "CMigrateFramework::DoExecute: Could not find value %s in %s",
        "717\\7p7",
        "Error setting attributes on %s. Last Error = %#x",
        "SPReclaimRecoveryImagePartition: Failed to initialize COM. Error: 0x%08X",
        "%hs: Product key is not specified",
        ":S:[:n:",
        "InstallSecurityTemplate: Error expanding environment variables in log path; Error: 0x%08lx",
        "CRelocateOS: Exception while moving files: %s",
        "666F6V6o6",
        "3>3m3",
        "6\"6)6/6;6O6]6k6y6",
        "SclRegProcessKeyValues",
        ": :@:H:P:X:`:h:t:",
        "WVh\\@",
        "RtlInitializeCriticalSection",
        ".PAVCXXXXXHandledException@?BA@??SPProcessServiceEnable@@YGXPBG@Z@",
        "UninstallReason",
        ".?AU?$IEnumerator@V?$DictionaryEntry@KPAUIVdsDisk@@@UnBCL@@@UnBCL@@",
        "<(<4<F<h<u<",
        "JET_errNotInitialized",
        "bin-NG",
        ".?AV?$ArrayList@PAVCInfFile@@@UnBCL@@",
        "|SOURCE|\\Misc\\|FWTYPE|\\bootspaces.dll",
        ">F>T>]>f>|>",
        "%hs: Recovery image path is on the installation partition.",
        "ShowWindow",
        ".PAVCXXXXXTemp@?3??BuildLPList@CLPValidator@@IAEJPAUIExecutionContext@@PAV?$ArrayList@PAVString@UnBCL@@@UnBCL@@@Z@",
        "ServiceSpaces: Skipping non-Windows %s",
        "ReleaseVolumeAccessPath: Failed to undefine access path '%c:\\': 0x%08x",
        "L$DPP",
        "<I<b<",
        "(%lx): Failed to expand environment string!",
        "10171<1N1U1c1m1",
        "ERROR_INVALID_CRUNTIME_PARAMETER",
        "{E227E10A-2473-456B-A638-E12F19669B18}",
        "mount",
        "void __thiscall UnBCL::Array<void *>::Remove(void *)",
        "4-4N4_4k4",
        "2K3u3",
        "?$?.?;?J?d?p?",
        "CreateXmlWriter",
        "0@0R0`0n0|0",
        "ERROR_WRITE_FAULT",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class CDriverInstallInfo *> __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,class CDriverInstallInfo *>,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,class CDriverInstallInfo *> __stdcall UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,class ATL::CElementTraits<class CDriverInstallInfo *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "    Failed to find first file",
        "ExecuteRollbackSequence: Succesfully finished, current checkpoint state defaulted to empty.",
        "CCompressOldOS::DeleteUnnecessaryFiles",
        "7'7G7N7W7\\7g7s7y7",
        "%windir%\\Minidump",
        "ERROR_SXS_XML_E_BADCHARDATA",
        "ERROR_LOG_PINNED_RESERVATION",
        "Failed to mark store as system store. Status = [%x]",
        ".?AVStringProperty@?1???$pDefineStringProperty@V<lambda_b3920448a07f01c5d3e7f1ca2cd2b6bc>@@@@YGPAUIDiskMatchProperty@@PBGV<lambda_b3920448a07f01c5d3e7f1ca2cd2b6bc>@@@Z@",
        "{c12a7328-f81f-11d2-ba4b-00a0c93ec93b}",
        ".PAVCXXXXXHandledException@?FI@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "%hs: Failed to initialize COM. hr = 0x%08X",
        "ReadOrWriteSectors: Failed to %s sectors (start sector = 0x%I64x, sector count = 0x%x, sector size = 0x%x)",
        "4SVWj.",
        "8\"8(8.848:8@8F8L8R8X8",
        "Post SysPrep",
        "DaysSinceSnapshotTimeStamp",
        "2!222?2I2X2a2g2t2z2",
        "3\"3N3[3`3m3",
        "191W1",
        "> >(>L>\\>d>h>l>p>",
        ".?AV?$DefaultInstanceFactory@VCEnableSerialDebugging@@@UnBCL@@",
        "181<1@1D1T1\\1`1d1h1p1",
        "void __thiscall UnBCL::ArrayList<enum OP_OPERATION_ID>::set_Item(int,enum OP_OPERATION_ID)",
        "CMediaLayout::QueueDrivers: Failed to queue driver %u (%s): 0x%08x",
        "PVWh1",
        "=5>W>s>",
        "xSP_UPLOAD_ASIMOV",
        "3%3;3F3T3k3z3",
        "9(9/959:9E9O9b9",
        "=8=X=x=",
        "5%5D5",
        "ERROR_INVALID_DOMAINNAME",
        "6w7~7C8",
        "AllocatedSize",
        "8A8H8N8T8_8i8|8",
        "8)858>8K8P8\\8c8p8|8",
        "Failed to find search pattern: %S",
        "0x%08x",
        "ERROR_NOT_QUORUM_CLASS",
        "Failed to initialize description key for store. Store: %s StoreKey: %ws Status: %x",
        "REG_EXPAND_SZ",
        "Create BOOTMGR object RetainBootDefault:%c",
        "enum MIGSTATUS __thiscall CARPValidator::BuildInfoList(class UnBCL::String *,class UnBCL::String *,class UnBCL::ArrayList<class CAppInfo *> *,class UnBCL::ArrayList<class CShellFolderInfo *> *)",
        "REG_MULTI_SZ",
        "ERROR_NO_TOKEN",
        "ERROR_CLUSTER_NODE_ALREADY_UP",
        "int __stdcall UnBCL::MP::ThrowCompare<struct PartitionLayoutArgs *>::Compare(struct PartitionLayoutArgs *,struct PartitionLayoutArgs *)",
        "7&8J8o8",
        "<A<a<",
        "void __thiscall UnBCL::Array<struct PartitionLayoutArgs *>::Remove(struct PartitionLayoutArgs *)",
        "8$878\\8v8",
        ".?AV?$CAutoCleanupBase@PAUIPartitionEnumerator@SetupPlatform@@@RAII@@",
        ">+?F?L?",
        "?,?4?<?L?X?`?",
        "CMigrateFramework::DoExecute: Setting WinDirNew for setupcl pended request in new system",
        "<)<6<<<C<M<Z<a<k<|<",
        ";-;K;};",
        "4%4+404;4E4X4s4",
        "474M4V4_4h4q4z4",
        "ERROR_NO_IMPERSONATION_TOKEN",
        "ERROR_CTX_TD_ERROR",
        "9$9,949@9`9h9p9|9",
        "ActiveDump",
        ".PAVCXXXXXTemp@?3??CopyToDriverStore@CApplyDrivers@@IAEJPAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@4@PAPAV54@@Z@",
        ".?AVCAddCbsPackage@@",
        "void __thiscall UnBCL::ArrayList<unsigned int>::Resize(int,int)",
        "141z1",
        "Failed to create unique new file name from [%s]: 0x%x",
        "484m4t4z4",
        "Found existing diagnostics data, attempting to load it.",
        "ERROR_UNEXPECTED_OMID",
        "5\"565?5L5X5a5j5q5~5",
        "3$3:3q3x3~3",
        "0V0{0",
        ".?AV?$SmartPtr@VCSPExecuteProgress@@@UnBCL@@",
        ".PAVCXXXXXHandledException@?CD@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        ".?AV?$SerializableBase@VCApplyWIM@@$0A@V?$DefaultInstanceFactory@VCApplyWIM@@@UnBCL@@@UnBCL@@",
        "kn-IN",
        "LdrGetProcedureAddress",
        "(remove WIM file as well)",
        "4N4U4t4",
        "3&3-3A3V3q3{3",
        "; ;);D;K;Q;V;p;{;",
        "3 3$3(303H3X3h3l3p3x3",
        "DRVINST: Setup and DISM disagree about boot critical driver status, we will need an extra driver installation phase for WinRE",
        "base\\ntsetup\\lib\\rollback\\src\\common_checkpoints.cpp",
        "Setup\\Image Based Setup",
        "Found and updated NULL GUID at partition %u",
        "5*595M5T5a5p5",
        "%userprofilelink%",
        "2;2h2",
        "%hs: BCD Open failed. Error: 0x%08X",
        "SL_E_NO_PID_CONFIG_DATA",
        "JET_errLogFileCorrupt",
        ".?AV?$DefaultInstanceFactory@VCTrustSafeOSBootCommand@@@UnBCL@@",
        "int __thiscall UnBCL::ArrayList<class CDriverDetails *>::LastIndexOf(class CDriverDetails *,int,int) const",
        ":>:b:l:s:}:",
        "%u.%u",
        "CAbstractDisk::GetDriveLayoutInfoEx",
        "There is no crash dump file!",
        ".?AV?$CAutoRelease@PAUIMigRegistryInfo@@@Mig@@",
        "?4?>?H?N?\\?",
        ":\":K:s:",
        "ERROR_DS_COMPARE_FALSE",
        "ERROR_DS_DRA_CORRUPT_UTD_VECTOR",
        "='===b=o=",
        ";);<;H;c;w;~;",
        ";%;;;Q;c;k;q;~;",
        ".?AV?$SerializableBase@VCSetBootCommand@@$0A@V?$DefaultInstanceFactory@VCSetBootCommand@@@UnBCL@@@UnBCL@@",
        "ERROR_REQUIRES_INTERACTIVE_WINDOWSTATION",
        "?(?0?G?]?q?~?",
        "ERROR_UNABLE_TO_LOAD_MEDIUM",
        "1$1:1X1_1e1j1u1",
        "BfspPrintFileOwnerProcess: NtQueryInformationFilefailed! Status = %#x",
        ".PAVCXXXXXHandledException@?LG@??Rollback@CSetupPlatformOSSwitchCheckpoint@@UAEXPBG@Z@",
        "void __thiscall UnBCL::ArrayList<unsigned int>::QuickSort(class UnBCL::ArrayList<unsigned int> *,class UnBCL::ArrayList<unsigned int> *,int,int)",
        ":.:C:P:",
        "ERROR_IPSEC_IKE_INVALID_AUTH_ALG",
        "ERROR_INVALID_PRINTER_STATE",
        "Failed to create a new recovery store. Status = [%x]",
        "ERROR_SHUTDOWN_USERS_LOGGED_ON",
        "%SYSTEMDRIVE%\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe /presysprep",
        "CFG Validator: Received invalid entry [%s]",
        "%hs: Cannot find the new system's path for USERS folder",
        "4$4C4}4",
        "424:4@4V4\\4t4{4",
        "class CDUPackage *&__thiscall UnBCL::ArrayList<class CDUPackage *>::get_Item(int)",
        ":%:*:3:::G:S:\\:h:m:v:}:",
        "%hs: Will backup and remove recovery/WIMBoot partition recovering %I64u bytes",
        "SysprepSession::ExecuteAction: Unsupported registry value type %s passed for setValue operation",
        ".?AV?$CAutoCleanupBase@PAUIWbemServices@@@RAII@@",
        "9+9E9Z9s9",
        "8)81878K8S8Z8h8y8",
        "post-scan",
        "ERROR_RXACT_COMMIT_NECESSARY",
        ".?AU?$IList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAVMultiSz@2@@UnBCL@@@UnBCL@@",
        "ERROR_LOG_CONTAINER_WRITE_FAILED",
        "3@3F3R3Z3m3t3z3",
        ".PAVCXXXXXHandledException@?JC@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "Processing system hive [%ws]...",
        "Could not open the BCD template store. Status = [%x]",
        "6+6B6Y6p6",
        "class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<__int64,class CGlobalPath *> *>::GetBuffer(int)",
        "242>2S2e2m2s2",
        "6$6,646<6D6L6T6`6",
        "0 0c0",
        "    %s",
        "ERROR_CLUSTER_RESOURCE_TYPE_NOT_FOUND",
        "787O7a7g7{7",
        ".?AVCXXXXXHandledException@?5??SPProcessServiceDisable@@YGXPBG0@Z@",
        ";%;/;=;C;I;N;X;b;l;v;",
        "0!030F0M0S0Y0e0o0",
        "?-?U?n?u?|?",
        "LP Validator: Failed to initialize DISM. Error: %08X",
        ".PAVCXXXXXTemp@?CJ@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        ">!>.>5>?>P>Y>u>",
        "CUntagSourcesFolder::DoExecute",
        "5e6l6",
        "8/8:8}8",
        "ERROR_NO_YIELD_PERFORMED",
        "?8?@?H?P?X?`?l?",
        "@PPSSS",
        "GetModuleFileNameA",
        "Machine-independent transformers directory not found",
        "=0=g=",
        "Deleting old WinRE BitLocker hash %s",
        "%hs: Value name: %s",
        "CMediaLayout::ExecuteOptimization: Failed to execute media optimization operations: 0x%08x",
        "D$ h`f",
        "7'797\\7",
        ".?AV?$DefaultInstanceFactory@VCRegisterRecoveryImage@@@UnBCL@@",
        "<t;-d",
        "Reset setting hardlink failure because of folder redirection",
        "= =(=0=D=L=T=d=p=x=",
        "public",
        ".?AVCXXXXXHandledException@?CG@??RestageWindows@CReconstructOS@@IAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "Processing device ID matches...",
        "9C9U9]9c9p9",
        "9!979y9",
        ">$><>L>`>t>",
        "SkipMachineOOBE",
        "DebugBreak",
        "RPC_S_ALREADY_LISTENING",
        "NewOS",
        "7%747K7\\7c7",
        "SPDeleteSnapshot: Failed to initialize COM. Error: 0x%08X",
        "Error while setting uninstall mark value: 0x%08X",
        "DU UpdateType: Unknown",
        "L$L^3",
        "CInternalOperationsProgress::RegisterError",
        ":);-;1;5;9;L;\\;k;t;",
        "5,5n5z5",
        "Failed to create bootstat.dat. Status: %x",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2l2p2t2",
        "RefreshInterval",
        "2!2-2A2S2]2u2",
        "__thiscall UnBCL::ArrayList<enum OP_OPERATION_ID>::ArrayList(const struct UnBCL::ICollection<enum OP_OPERATION_ID> *)",
        "zh-TW",
        "CEnableSafeOSPageFile::DoExecute: Existing page file is already %llu, extending maximum size",
        ".?AU?$ICollection@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$ArrayList@PAVCDriverDetails@@@2@@UnBCL@@@UnBCL@@",
        "=+=0=5=A=a=",
        ".?AVCXXXXXHandledException@?2??DoExecute@CExtractFilesFromWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "=$=/===K=t=|=",
        "2'202I2l2",
        "0.0d0v0~0",
        "  Class Name: %s",
        "DismEnableFeature",
        "void __stdcall UnBCL::_::HTEnumerator<unsigned long,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,class UnBCL::DictionaryEntry<unsigned long,struct IVdsVDisk *>,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<unsigned long,struct IVdsVDisk *> __stdcall UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::TableKey,struct IVdsVDisk *,struct UnBCL::Hashtable<unsigned long,struct IVdsVDisk *>::KeyTraits,class ATL::CElementTraits<struct IVdsVDisk *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<unsigned long,struct IVdsVDisk *> *,class UnBCL::Array<class UnBCL::DictionaryEntry<unsigned long,struct IVdsVDisk *> > *,int)",
        "8$8;8Q8h8",
        "SPReserveMoveInternal",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,class CDriverInstallInfo *>,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,class CDriverInstallInfo *> __stdcall UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::TableKey,class CDriverInstallInfo *,struct UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *>::KeyTraits,class ATL::CElementTraits<class CDriverInstallInfo *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "5$5*5/5:5D5W5h5",
        "FVEAPI.dll",
        "DiskLayout::ApplyProperties: Setting volume label to: %s",
        "1!1/1",
        "RPC_S_FP_OVERFLOW",
        "SetupPlatformWinReRestoreCheckpoint",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,int> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::GetBuffer(int)",
        "*[local-name(.)='assembly']/*[local-name(.)='migration']/*[local-name(.)='registerSDF']/@name",
        ".?AVUtcApiWrapper@Diagnostics@Microsoft@@",
        "$Setup_BTFolderVolume$",
        "6/757Q7_7{7",
        ";.;K;^;e;q;",
        "XUPGFilterActive",
        "> >(>,>0>8>@>H>L>P>T>X>\\>`>d>h>l>p>t>x>",
        "ERROR_SXS_XML_E_MISSINGQUOTE",
        "0;0m0t0",
        "class CSetupPlatformTracing *__stdcall UnBCL::Try_Cast<classCSetupPlatformTracing*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "GetTemporaryFolder",
        "{27401371-6033-4869-A252-A926C9F1D1E2}",
        "=1=>=F=P=W=]=b=m=y=",
        "CRYPT_E_AUTH_ATTR_MISSING",
        ";0;8;>;K;];s;",
        "Wimboot entries",
        "int __thiscall UnBCL::_::HTEnumerator<enum OP_OPERATION_ID,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,class UnBCL::DictionaryEntry<enum OP_OPERATION_ID,int>,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<enum OP_OPERATION_ID,int> __stdcall UnBCL::Hashtable<enum OP_OPERATION_ID,int>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "CRYPT_E_ASN1_NOEOD",
        ";:<J<R<f<n<z<",
        "CMediaLayout::QueueDirectoryCopy: Failed to get full path for %s: 0x%08x",
        "PWWh?",
        "1'181A1R1h1",
        "3E3W3_3e3r3",
        "int __thiscall UnBCL::ArrayList<class CDUPackage *>::LastIndexOf(class CDUPackage *,int,int) const",
        "ActivityStoppedAutomatically",
        ".?AVCXXXXXHandledException@?KL@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "WdsCopyFileEx: Failed to copy [%s] to [%s], GLE = 0x%x; will retry in %u ms",
        "<&<1<9<?<S<_<",
        "JET_errDDLNotInheritable",
        "%hs (%hs:%d) - 0x%08x:",
        "='>5>T>l>",
        "CSetupPlatform::SetWatsonBucketingParam",
        "9+9<9C9I9N9Y9d9x9",
        "FailureOperationName",
        ".?AVCExistentImageInfo@@",
        "=+=5=H=e=",
        "pLogUpdateInfo: IDUUpdate::GetWUAInterface failed. hr = 0x%x",
        "G$+K(",
        "class UnBCL::SmartPtr<class UnBCL::String> __thiscall OC::COCDismAdapter::GetFoundationPackageName(void)",
        "Malformed entry ignored: %s",
        "WinVerifyTrust failed with error code: 0x%x",
        "ERROR_DATABASE_FAILURE",
        "CBS_E_MANIFEST_VALIDATION_MULTIPLE_UPDATE_COMPONENT_ON_SAME_FAMILY_NOT_ALLOWED",
        "!D$(!D$",
        "1%1/1O1u1",
        "CMigrateFramework::DoExecute: Updating paths in hives failed. Status = 0x%08X",
        "CSetupPlatformPrivate::RollbackOnlineCommon: Failed to execute rollback",
        "ERROR_CHILD_NOT_COMPLETE",
        "Unable to get procedure SetIsolationIMalloc",
        ".?AUIWpxLogger@@",
        "ReadBootCode: Invalid Sector Size!",
        "FsSecureSDProcessCount",
        "D$hSVWj`3",
        "SL_E_EVENT_NOT_REGISTERED",
        "CBS_E_NEW_SERVICING_STACK_REQUIRED",
        ":#:*:0:5:@:M:a:j:s:",
        "SysprepSession::Execute: Failed to query EditionId from registry key; dwRet = 0x%x",
        "LayNtBootCode",
        "ERROR_SXS_ASSEMBLY_NOT_LOCKED",
        "%systemdrive%\\windows.old\\*",
        "%hs: Error while opening RNG key: 0x%08X",
        "Failed to get API PolicyManager_GetPolicyInt from DLL, hr = 0x%08X",
        ".?AU?$IEnumerable@H@UnBCL@@",
        "5\"5,5R5}5",
        "VdsPlatform::Initialize: Computing host info",
        "4\"5G5y5",
        "%hs: Exception while writing drivers section to file %s",
        "    hImage: Argument cannot be NULL",
        "7.868D8L8U8p8",
        "CSysprepRespecialize::DoExecute: Failed to determine whether system will reboot. Error: 0x%08X",
        "VdsDiskPartitionEnumerator::Initialize: Couldn't get disk properties (0x%08x)",
        "; ;:;F;U;];o;",
        "7#8C8M8j8y8",
        "No processes are using this file.",
        "SPDeleteAllSnapshots: Delete all snapshots",
        "user32.dll",
        "1 10191A1H1Z1n1~1",
        "VdsPlatformDiskEnumerator::GetNext: Failed to construct disk: 0x%08x",
        "6<6s6",
        "9(9D9P9]9f9r9",
        "ERROR_DS_MISSING_SUPREF",
        "AllocateAndInitializeSid",
        "ar-BH",
        "5&545<5B5G5[5i5}5",
        "3-3K3\\3c3k3p3{3",
        "CMediaLayout::QueueCbsPackages",
        "5%5.575@5I5R5[5d5m5v5",
        "RegKeyRenameCount",
        "0&0/0G0`0k0",
        "3K3c3y3",
        "<)<5<B<I<Z<q<}<",
        "8(868C8O8U8]8b8g8|8",
        "ERROR_UNKNOWN_PRINTPROCESSOR",
        "=Y=a=n=}=",
        "EnumeratePathEx: Unable to construct path under [%s]; GLE = 0x%x",
        "Wmi::ExecQuery: Query [%s] failed (0x%08x)",
        "757=7G7O7",
        "Retail",
        "WINDOWS/PRODUCTNAME",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,int> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::GetBuffer(int) const",
        "OC::COCCbsAdapter::GetPackageByName: Find intended package",
        "ERROR_WRONG_TARGET_NAME",
        "6,63696>6I6S6f6{6",
        "j/Yf;",
        "2C2O2e2u2",
        "?/?J?Q?W?\\?g?q?|?",
        "ExportFileNode",
        "3'4F4",
        "JET_errIndexTuplesVarSegMacNotAllowed",
        "9C9J9Q9\\9g9{9",
        "ERROR_DS_NO_REQUESTED_ATTS_FOUND",
        "Queried used space      : %I64d",
        "909I9U9b9",
        "void __thiscall OSRollbackService::CBootFilesRestoreCheckpoint::Finalize(const unsigned short *,struct OSRollbackService::ICheckpointParameters *)",
        "1%1*161K1Q1e1",
        ":$:_:q:x:~:",
        "SmPlatformDiskEnumerator::GetNext: Couldn't classify %s",
        ";$;(;8;<;L;P;`;d;t;x;",
        "void __thiscall UnBCL::ArrayList<struct _GUID>::QuickSort(class UnBCL::ArrayList<struct _GUID> *,class UnBCL::ArrayList<struct _GUID> *,int,int)",
        "999c9",
        "Failed to write checkpoint \"%s\" checkpoint to \"%s\" file.",
        "<%<3<J<O<X<g<n<x<",
        "5O5z5",
        ".?AVCSetupBasicCheckpointParameters@OSRollbackService@@",
        "8\"8*868@8G8M8R8^8o8",
        "6:6G6e6{6",
        "666<6E6M6\\6c6i6n6y6",
        "PWWWWWW",
        "class UnBCL::String *__stdcall SPGetVolumeStableGuidStringFromVolumeName(class UnBCL::String *)",
        ";$;,;L;h;p;x;",
        "Reading onesetting for tracing settings completed, Error: 0x%x",
        "class UnBCL::ArrayList<class CBcdSetting *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class CBcdSetting *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        ".PAVCXXXXXHandledException@?5??SPReclaimRecoveryImagePartition@@YGJPAVString@UnBCL@@00@Z@",
        "Failed to read disk properties",
        "index and/or count out of range to ArrayList#IndexOf",
        "6!6)61666A6Q6Y6a6f6q6",
        "ENVTRACK: Result %s=%s",
        "%hs: Failed to create ramdisk options. Status = %d",
        "FLOWTRACK(NEO): Flow Validator: New OS image has not been applied, NEO path flow constraint cannot be satisfied.",
        "3-393H3T3p3u3",
        "SPClearSoftReserve: Failed to get Update Reserve manager. hr = 0x%08X",
        "Timeout",
        "DiskLayout::FindPartitionByOrdinal: Can't iterate over partitions: 0x%08x",
        ".?AV?$SerializableHashtableBase@PAVString@UnBCL@@H@_@UnBCL@@",
        "9H:k:",
        "base\\ntsetup\\setupplatform\\lib\\util\\utilities.cpp",
        "??1?$ICollection@E@UnBCL@@UAE@XZ",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *>::Insert(int,class UnBCL::DictionaryEntry<enum SetupPlatform::SYNCEXEC_PHASE,class UnBCL::DictionaryEntry<class CGlobalPath *,class UnBCL::String *> *> *)",
        "7*7=7F7K7V7m7t7",
        "='=;=N=U=[=`=h=r=",
        "<%<_<~<",
        "5+696>6R6_6d6",
        "0 0S0{0",
        "ERROR_BAD_PROVIDER",
        "SKIPBOOTTRACK(SAFEOS): Skip Boot Validator: Found Windows.OLD folder, cannot continue with SafeOS boot removal.",
        "6$696A6G6[6r6",
        "0-0C0[0q0",
        "j?Zf;",
        "Directory \"%s\" doesn't exists.",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "D$(;G tN",
        ";-;:;?;H;X;_;g;l;x;",
        ".?AV?$ArrayList@PAVCBcdSetting@@@UnBCL@@",
        "<#<4<S<Z<u<",
        ".?AVCAddSafeOSBootEntry@@",
        "5'5:5[5",
        "SEH: Exception type not supported for handling; allowing default handling.",
        "Force Task Delete Snapshot enabled, overwritten policy which didn't allow cleanup",
        "it-CH",
        "Setting {default} to %wZ",
        "void __thiscall UnBCL::ArrayList<enum OP_EXECUTION_PHASE>::AddRange(const struct UnBCL::ICollection<enum OP_EXECUTION_PHASE> *)",
        "fr-LU",
        "9 9V9e9l9r9x9",
        "<$<1<;<O<\\<f<z<",
        "5)5:5G5P5X5b5s5",
        ".?AU?$IEnumerator@PAVCShellFolderInfo@@@UnBCL@@",
        "4!5Q5",
        "Will revert execution for %d, as the current operation needed to be executed ahead of it",
        ".?AUIRollback@@",
        "void __thiscall UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *>::Resize(int,int)",
        "SetupDiEnumDeviceInfo failed for %s, %d, error 0x%08X.",
        "\\system32\\csrss.exe",
        "7'717;7R7`7j7t7",
        ".?AU?$ICollection@PAVCFileCreationData@@@UnBCL@@",
        "2,242X2`2|2",
        "9 :1:F:s:",
        "8/868L8g8m8w8|8",
        "%hs: Could not find HKLM\\%s key for the online system.",
        "ERROR_DS_NAMING_MASTER_GC",
        "es-ES",
        ":):P:",
        "=Z=o=",
        "<%<H<U<m<",
        "ZwQuerySystemEnvironmentValueEx",
        ".FileSystemDirtyBitSet",
        "CERT_E_UNTRUSTEDTESTROOT",
        "DestroyWindow",
        "void __thiscall UnBCL::Array<class CDeploymentBase *>::Remove(class CDeploymentBase *)",
        ".?AVCOSPieceInfo@@",
        "ERROR_NESTING_NOT_ALLOWED",
        "SPApplyStandardDiskConfig: Unknown firmware type %u",
        "4 4&434B4",
        "FindResourceExW",
        ".PAVCXXXXXHandledException@?FC@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        ":/:=:V:]:d:j:v:",
        "SSSSSWPS",
        "CBS_E_MANIFEST_INVALID_ITEM",
        ".PAVCXXXXXTemp@?3??pGetExistingPageFiles@@YGJPAVString@UnBCL@@PAV?$ArrayList@PAUPageFileDesc@@@3@@Z@",
        "WinPEBootFilesRestoreCheckpoint",
        "9(979@9F9S9Y9^9o9z9",
        ".PAVCXXXXXTemp@?EG@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "8)8J8e8k8x8",
        "%hs: Setting up the recovery partition for the OS",
        "8)838@8E8Q8_8f8p8",
        "    Failed to copy payload path",
        ".?AVCXXXXXHandledException@?BHB@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "SjZjp",
        "8 9=9U9a9j9t9}9",
        "WIMBoot v1 reparse points will be stored temporarily in %s",
        "SL_E_INVALID_PKEY",
        "FOLDERID_PublicDownloads",
        "4\"444J4e4k4u4z4",
        "SetIsolationIMalloc",
        ";#;/;;;E;L;R;W;b;s;{;",
        "Failed to duplicate sz",
        "3#3+383Z3b3o3",
        "<3<F<w<",
        "DeleteDisableCmdFile",
        "void __thiscall UnBCL::Array<class CCopyInfo *>::Insert(int,class CCopyInfo *)",
        "2A3M3",
        "3)3/343M3Y3k3",
        "5*5J5W5x5",
        "=*=5=I=Z=",
        "?get_Win32ErrorCode@Win32Exception@UnBCL@@QBEKXZ",
        "9 9/9C9a9",
        "ERROR_DS_NON_ASQ_SEARCH",
        "ERROR_IPSEC_IKE_DOS_COOKIE_SENT",
        "CPrepareSysPrep::DoExecute",
        "ERROR_DS_DST_DOMAIN_NOT_NATIVE",
        ".Unexpected!",
        "{E22D9999-76A7-4457-A589-6C0D04A367F3}",
        "void __thiscall UnBCL::ArrayList<unsigned int>::AddRange(const struct UnBCL::ICollection<unsigned int> *)",
        "All work (machine-independent) is complete, marking completion and removing the store.",
        "?!?)?0?<?N?c?r?|?",
        "6-6:6X6e6}6",
        "Signature",
        ";\";>;V;r;",
        "1$1(1,14181<1D1H1L1T1X1\\1`1h1l1p1t1x1|1",
        "8 8K8R8r8",
        "4=4D4J4O4Z4e4y4",
        "0(0-0A0I0\\0c0i0n0y0",
        "7#70767;7]7i7{7",
        "CFG Validator: Ignoring validator failure due to environment variable.",
        "CERT_E_MALFORMED",
        "Certificate chain verified, but did not satisfy the CERT_CHAIN_POLICY_MICROSOFT_ROOT policy. chainPolicyStatus.dwError = 0x%X",
        "9x\\tCW",
        "1&1:1t1|1",
        "GetSupportedSize",
        "Starting finalize operations.",
        "smss.exe",
        ">'>/>l>",
        "void __thiscall UnBCL::ArrayList<struct PageFileDesc *>::set_Item(int,struct PageFileDesc *)",
        "ERROR_DS_DRS_EXTENSIONS_CHANGED",
        "FOLDERID_Downloads",
        "CDeploymentProject::CreateFolderDeployment: Failed to save image customizations and assets: 0x%08x",
        "x83uIWW",
        "QVjjh",
        "Available: %I64u",
        ":3:N:X:b:h:v:",
        "Failed to open driver package %ws (Err = 0x%lx)",
        "sDiskLayout::ApplyModifications",
        "8\"8)80868@8b8v8",
        "ERROR_SXS_SYSTEM_DEFAULT_ACTIVATION_CONTEXT_EMPTY",
        ".?AVCXXXXXHandledException@?7??BuildInfoList@CARPValidator@@IAE?AW4MIGSTATUS@@PAVString@UnBCL@@0PAV?$ArrayList@PAVCAppInfo@@@5@PAV?$ArrayList@PAVCShellFolderInfo@@@5@@Z@",
        ":!:*:3:<:E:_:",
        ".PAVCXXXXXHandledException@?GD@??SPDoFrameworkApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "Successfully added class filter data",
        ";C;U;];c;p;",
        "<%<*<><t<",
        "; ;7;M;",
        "%hs: Command line for the safe OS: %s",
        "void __thiscall UnBCL::Array<class CUserProfile *>::InitLarva(class UnBCL::ArrayList<class CUserProfile *> *)",
        "y&Vh1",
        "SmPlatformDiskEnumerator::ConstructVirtualDisk",
        "?IsDriveLetterPrefix@Path@UnBCL@@SGHPBVString@2@@Z",
        "j\\Xf9DN",
        "6%616=6I6U6m6",
        "$Extend\\$Reparse:$R:$INDEX_ALLOCATION",
        "9\"9*959>9L9f9~9",
        "Resiliency",
        ".PAVCXXXXXHandledException@?8??DoExecute@CMoveWIMBootEntriesAndPartition@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "5#5H5`5g5m5r5}5",
        ";2;A;",
        "%hs: NotifyUILanguageChange failed. Error: 0x%08X",
        "Add provisioning package %s",
        "%hs: Failed to set Setup.exe completion status. Error: 0x%08X",
        ":\":-:7:<:P:Y:d:m:",
        "XpRwM5/:4",
        "9J9\\9d9j9w9",
        "XNTUSER.DAT",
        "2&2.242A2S2l2",
        ".?AV?$SerializableBase@VCStoredPath@@$0A@V?$DefaultInstanceFactory@VCStoredPath@@@UnBCL@@@UnBCL@@",
        "PVhtv",
        "CEnableSafeOSPageFile::DoExecute: Failed to get size of existing page file %s: 0x%08x",
        ";$;,;7;?;",
        "3#3G3k3}3",
        "?)?@?N?b?t?",
        ":&:/:8:A:J:S:\\:z:",
        "class CWIMBootData *const *__thiscall UnBCL::ArrayList<class CWIMBootData *>::GetBuffer(int) const",
        "122r2",
        "%hs: WinRE image folder: %s",
        "ERROR_STREAM_MINIVERSION_NOT_VALID",
        ";/;<;J;S;];e;n;v;|;",
        "Failed creating hardlink %S",
        "class CDeploymentBase::CMountedPathInfo **__thiscall UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *>::GetBuffer(int)",
        "8&888K8_8r8",
        "3F3Q3`3g3m3r3}3",
        "=!=+=5=;=H=W=d=p=",
        "%hs: No recovery folder available, cannot examine recovery/WIMBoot partition",
        ".?AU?$IEnumerable@PAVCDriverInstallInfo@@@UnBCL@@",
        "long __thiscall CSetupPlatform::ResurrectNewSystem(const unsigned short *,struct SetupPlatform::INewSystem **)",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@_K@UnBCL@@@UnBCL@@@UnBCL@@",
        "9#9<9O9Z9a9h9p9",
        "8\"9D9S9",
        "2=3G3b3i3",
        ";$;,;4;<;D;L;T;\\;d;l;",
        "; ;-;5;B;J;f;m;s;x;",
        "<1<8<H<O<^<k<",
        "CDeploymentBase::RestoreMounts: Failed to remount WIM mounted at %s. Error: 0x%08X",
        "CMigrateFramework::DoExecute: Cannot get security info for the source security hive. Error: 0x%08X",
        "CSetupAutomation::MatchDisk: Failed to select disk for given criteria: 0x%08x",
        "0$080@0H0X0d0",
        "SjPh<",
        "<'<<<V<]<r<",
        "9*999Q9x9",
        "VjEjY",
        "6$6+696C6H6\\6",
        "CSetupAutomation::Initialize: Failed to initialize COM: 0x%08x",
        ".?AV?$DictionaryEntry@PAVString@UnBCL@@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@2@@UnBCL@@",
        "?GetType@Object@UnBCL@@UBEPAVType@2@XZ",
        "ERROR_CLUSTER_DATABASE_TRANSACTION_NOT_IN_PROGRESS",
        "707M7Z7`7f7z7",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::Remove(class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *)",
        "5 5$5(5,585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5|5",
        ".?AV?$HTDictEnumBase@V?$DictionaryEntry@KPAUIVdsVDisk@@@UnBCL@@@_@UnBCL@@",
        "7,7<7@7D7L7P7T7X7\\7`7d7h7l7p7t7x7",
        "SPGetDiskSmartStatus: Can't open %s (0x%08x)",
        "FirstBoot,Start",
        "?+?=?E?K?X?j?",
        "2%2*242\\2k2",
        "MIG_UPGRADE_SERVICES_SKIP_VERSION_CHECK",
        "2-2;2M2Y2^2c2",
        "PWWhP",
        "Disk space info (End) is missing, cannot accurately estimate disk space needed by uninstall",
        "4&4.444A4S4a4",
        "Qjrj.",
        "%s.Profile.New",
        "CDeploymentProject::CreateBootableMediaDeployment: Failed to wipe target disk for drive root %s (0x%08x)",
        "2&2B2k2{2",
        "0Qh<>",
        ".PAVCXXXXXHandledException@?9??SPApplyAnswerFileSettings@@YGJPBG000PAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "$WINDOWS(%u).~TMP",
        "ERROR_ABANDONED_WAIT_0",
        ".PAVCXXXXXTemp@?3??ValidateProductKey@CImageInfoSet@@UAEJPBGPAPAUIProductKey@SetupPlatform@@@Z@",
        "ImageRecaptureDirectory",
        ":B;^;",
        "?&?2?S?j?s?",
        ".?AV?$SmartPtr@VCBcdSettings@@@UnBCL@@",
        "{313ADC30-1748-4139-89F0-4A75ED223DF7}",
        "MigRemapSymbolicLinks",
        "SPCopyFilesAndFolders: Number of objects to copy: %d",
        "void __thiscall UnBCL::Array<class CProfileInfo *>::Insert(int,class CProfileInfo *)",
        "%hs: Not removing rollback boot entry because it was an external rollback",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *> *,int) const",
        "11191?1H1^1l1",
        "8+8`8",
        "void __thiscall UnBCL::ArrayList<class ISPPluginData *>::Resize(int,int)",
        "?0?8?>?K?]?k?",
        "ETWProvidersList",
        "ImageGetMountGuid",
        "0*131H1~1",
        ";<;H;h;p;x;",
        "BfsRepair: Failed to get system partition size %08x",
        ";&;-;<;C;N;Z;l;w;",
        "=$=6=r=~=",
        "6(6/656:6D6a6h6o6t6~6",
        "Cannot capture an FFU image from the same disk.",
        ">(>2><>J>P>V>[>e>o>y>",
        "Disable snapshot on low disk space scenario according to policy",
        "XSetRegDWORD",
        "VdsDisk::Initialize: Failed to query IID_IVdsProvider interface [%s] (0x%08x)",
        "Uploading diagnostics data is not allowed from WinPE",
        "CEnableSafeOSPageFile::DoExecute",
        "    Failed to assemble element path",
        "CNewSystem::QueueSetupAutomation: Failed to queue audit payload folder copy: 0x%08x",
        "multi(%d)disk(%d)rdisk(%d)partition(%d)",
        "ERROR_MESSAGE_EXCEEDS_MAX_SIZE",
        ";,;6;@;F;T;",
        "=$=4=D=T=d=t=",
        "6a6~6",
        "PWVhp",
        "4 4%434:4H4R4e4u4",
        "ControlSet%03u\\Control\\CrashControl",
        "CSetupPlatformCheckpoint::CopyLogFiles: An error occurred while processing the WER log folders",
        "CreateVolumeAccessPath: DefineDosDevice failed",
        "0(0/050:0E0L0`0t0",
        "ERROR_DS_MEMBERSHIP_EVALUATED_LOCALLY",
        ".PAVFormatException@UnBCL@@",
        "?Clone@Version@UnBCL@@UBEPAVObject@2@XZ",
        "6,7`7",
        "828H8U8m8",
        "1$1,141<1D1L1T1\\1t1|1",
        "JET_errMakeBackupDirectoryFail",
        "8B8I8O8T8_8j8o8",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$CAutoRelease@PAUIDUUpdateCollection@DU@@@Mig@@@UnBCL@@@UnBCL@@",
        "ProvisioningPackage::GetResetClear",
        "=$=`=g=",
        "8 8\\8r8",
        "1-1h1u1",
        ".?AV?$SerializableArrayBase@PAVCOperationInfo@@@_@UnBCL@@",
        ">)>9>B>S>o>y>",
        ".?AV?$SmartPtr@U?$IDictionaryEnumerator@PAVString@UnBCL@@K@UnBCL@@@UnBCL@@",
        "Failed to get get volume path name for %ws. Error: %u",
        "|SYSPART|\\EFI\\Microsoft\\Recovery",
        "pSourceLocation",
        "CReconstructOS::RestageWindows: Failed to restore SKU overrides: 0x%08x",
        "%hs: Profile for %s(%s) not found in rollback info. Ignoring because of well-known SID or non-interactive status.",
        ".?AV?$Array@PAVCDeploymentBase@@@UnBCL@@",
        "t=Wj,j",
        "CTrustSafeOSBootCommand::DoExecute: Failed to update %s: 0x%08x",
        "9?9i9",
        "Failed to check if object is a ramdisk application. Status: %x",
        "invalid map/set<T> iterator",
        "int __thiscall UnBCL::ArrayList<class CPartitionInfo *>::BinarySearch(int,int,class CPartitionInfo *,struct UnBCL::IComparer<class CPartitionInfo *> *)",
        ";!;&;1;A;U;c;r;{;",
        "0-1a1l1z1",
        "JET_errOutOfAutoincrementValues",
        "1$1(181<1L1P1`1d1t1x1",
        "void __thiscall UnBCL::ArrayList<class CDeviceIdDatabase::CDeviceInfoData *>::RemoveAt(int)",
        "settings-win-ppe.data.microsoft.com",
        ">&>.>?>X>n>w>",
        "CCreateRegistryForNewSystem::CCreateRegistryForNewSystem",
        "WdsDestroyBlackboard",
        "ApplyFirstBootOfflinePluginErrorList",
        "6;6y6",
        ".?AVCXXXXXHandledException@?BEE@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "5!545",
        "CDeploymentProject::CreateVHDDeployment: Failed to get target setup platform version for [%s]; Error: 0x%08X",
        "9)90969<9G9M9`9x9",
        "Manifests",
        "SKIPBOOTTRACK(FIRST): Will attempt First boot removal",
        "System\\CurrentControlSet\\Control\\WMI\\Trace",
        "Source image or destination WIM is not WIMBoot compliant",
        ".?AV?$CAutoCleanupBase@PAUISetupPlatform@SetupPlatform@@@RAII@@",
        ".?AVCCreateFileForNewSystem@@",
        "Generating object GUID.",
        "8J8l8s8y8~8",
        ";9;|;",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::Insert(int,class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *)",
        "BOOTMGR    ",
        "WRQPj",
        "3#434s4",
        "7Z7c7",
        "253G3O3U3b3t3",
        ">(>1>@>X>_>f>l>w>",
        ">%><>O>d>z>",
        "?AddRef@Object@UnBCL@@QAEXXZ",
        "JET_errIndexCantBuild",
        ">(><>P>d>x>",
        "DUMPt",
        ":$:4:<:D:L:T:\\:d:l:t:",
        "8\"8-8=8D8J8O8Z8e8j8",
        "D$$Ph",
        "5 6h6",
        "=!=(=.=3=?=L=R=f=p=}=",
        "1 1$1(1,1014181<1@1D1H1L1X1\\1`1d1h1l1p1t1x1|1",
        "9,9c9r9",
        "=*===I=[=y=",
        "%hs: BCD failed to set back either the current or the default boot entry. It is unsafe to proceed, abandoning.",
        "ERROR_DRIVER_PROCESS_TERMINATED",
        ".?AV?$CAutoCleanupBase@PAVSmDiskPartitionEnumerator@@@RAII@@",
        "6!6,6<6P6_6f6l6q6|6",
        ".?AV?$SerializableArrayListBase@PAVCRegCreationData@@@_@UnBCL@@",
        "ne-NP",
        "){FDDB9DCE-4398-4212-95A0-ADF260C0CE9C}",
        "SPIsProvisioningPackageSplit",
        "888X8x8",
        "E_FAIL",
        "Analyzing system in %s",
        "1 212P2W2s2",
        "JET_errTooManyMempoolEntries",
        "CDUClientAppInfo::CDUClientAppInfo: Failed to get DU client module full path name. GLE = %d",
        "8P8n8}8",
        "0Vj03",
        "??0?$IEnumerable@G@UnBCL@@QAE@XZ",
        "5Fz<|",
        "QQPWQ",
        "1\"131<1H1a1r1{1",
        "A valid store must have a description key.",
        "%hs: Source image is NULL or does not exist, using default WinRE image from %s",
        "<*<2<8<L<R<[<q<~<",
        "1 1$1(1,1014181<1@1D1H1L1T1X1\\1`1h1l1p1t1x1|1",
        "<4<B<i<",
        "6$7V7r7",
        "SPInitializeDiskPlatform: Couldn't initialize SM API (0x%08x)",
        "ProductName",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::RemoveAt(int)",
        "CManifestCategory::AppendBoolean",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::Remove(class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *)",
        "525Q5[5",
        "class CBcdSetting *__thiscall UnBCL::_::ArrayListEnumerator<class CBcdSetting *>::get_Current(void) const",
        "void __thiscall UnBCL::ArrayList<class CImageInfo *>::set_Item(int,class CImageInfo *)",
        "%hs: Cannot extract Boot folder, target folder is NULL.",
        "Failed to reduce duplicate resume and recovery objects. Status = [%x]",
        "JET_errTransReadOnly",
        "CStoreHeaderWriterT<class CEmptyType>::Done",
        "fveapi.dll",
        "8X8e8}8",
        ".?AV?$CAutoRelease@PAVSmPlatformDiskEnumerator@@@RAII@@",
        "WIM\\IMAGE[*]\\WIMBOOTENTRIES",
        "int __thiscall UnBCL::Array<class DiskLayout *>::Add(class DiskLayout *)",
        "int __thiscall UnBCL::_::HTEnumerator<enum OP_OPERATION_ID,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable<enum OP_OPERATION_ID,int>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::TableKey,int,struct UnBCL::Hashtable<enum OP_OPERATION_ID,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::get_Current(void) const",
        ".?AVCUntagSourcesFolder@@",
        "%SYSTEMDRIVE%\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe /preoobe",
        "CBS_E_METERED_NETWORK",
        "GetAclInformation",
        "JET_wrnUniqueKey",
        "VdsPartition::BringOnline: Couldn't bring volume online (0x%08x)",
        ".?AV?$CAutoRelease@PAVSmPlatform@@@RAII@@",
        "ERROR_PATCH_PACKAGE_REJECTED",
        "fa-IR",
        "CSetupPlatform::CreateNewSystem: Using compact OS from new system options: %s",
        "7%777K7X7d7u7",
        "{D4F973EC-08BF-4E2B-838A-419C3BA420D4}",
        "%hs: SPDeletePartition failed. Error: 0x%08x",
        "CAddSetupClRequest::DoExecute",
        "RtlGetPersistedStateLocation",
        "9D$Pt",
        ".?AVMultiSz@UnBCL@@",
        "?'?8?A?M?]?h?",
        "OS.OLD.Pieces",
        "CheckCrashInfo: PageFile %d: '%s' ",
        "8$8O8[8t8",
        "6 6X6q6x6",
        ".PAVCXXXXXHandledException@?DG@??CreateVHDDeployment@CDeploymentProject@@UAEJPBG_KW4_FIRMWARE_TYPE@@W4DISK_LAYOUT_TEMPLATE@SetupPlatform@@0PAXPAUIGenericProgress@5@@Z@",
        "-eQkU",
        "5'565B5S5]5n5u5{5",
        "(%lx): Failed to retarget reparse point [ID=0x%I64x]: [%ws]",
        "SPAPI_E_BAD_SERVICE_INSTALLSECT",
        ".?AV?$Array@PAUIPartition@SetupPlatform@@@UnBCL@@",
        "EnableLevel",
        "7 7<7@7D7H7X7`7d7h7l7t7",
        "    Failed to assemble metadata file path (XML extension)",
        ";$;9;B;M;",
        "?w<t6",
        ".PAVCXXXXXTemp@?KG@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "1$2h2D3",
        "626Q6g6",
        "Process PID %d is accessing file wim %s",
        "E$tejH",
        "0 0%0*060",
        "?'?:?R?Y?v?}?",
        "606\\6o6",
        "ExtractBugCheckInfo: Error reading the pagefile %s, error 0x%08X ",
        ";L$$u",
        ".?AVCXXXXXHandledException@?2??DoExecute@CRemoveOSUninstall@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "8)858I8g8t8",
        "6+6?6Z6",
        "QSSSj",
        "QSj%jDh,",
        "void __thiscall UnBCL::ArrayList<struct SetupPlatform::IPartition *>::set_Item(int,struct SetupPlatform::IPartition *)",
        "1I1Y1d1i1}1",
        "8)868B8R8^8k8}8",
        "WIM file is on the future OS volume but we have a scratch directory, moving it there.",
        "4&4,4?4i4p4v4{4",
        "7(707L7d7l7t7|7",
        "OSDATA\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection",
        "DiskLayout::ApplyProperties: GPT disks cannot have extended/logical partitions",
        "SL_E_CIDIID_INVALID_DATA",
        "2!2,272L2X2_2e2j2u2",
        "5;5K5S5{5",
        "4b4i4w4",
        "  Needed by setup: %I64d",
        "  Specific callback decision for external package (WinPE): %s",
        "9\"9=9F9T9[9a9f9q9|9",
        "< <$<(<0<4<8<<<@<D<H<L<P<X<\\<`<d<l<p<t<x<|<",
        "4*4<4D4J4W4i4w4",
        "9T$$~D",
        "setupapi*.log",
        "8$8,848<8D8L8T8d8l8t8",
        "?get_Message@Exception@UnBCL@@UBEPBVString@2@XZ",
        "2D2Z2i2",
        "int __stdcall OC::OCSaveStatusOnline(class UnBCL::String *,class UnBCL::String *)",
        "ERROR_CONNECTION_COUNT_LIMIT",
        "=)=C=H=S=",
        "pDeterminePageFileRequirements: Will expand existing %llu-byte page file at %s to %llu byte(s)",
        "  Error: 0x%08x",
        "0m0t0",
        "Failed to create XML reader",
        "ERROR_DS_SORT_CONTROL_MISSING",
        ".?AVCXXXXXHandledException@?2??pSPMergeWim@@YGJPAVString@UnBCL@@0P6GKT_LARGE_INTEGER@@111KKPAX22@Z22H@Z@",
        "5$515:5H5]5d5j5o5z5",
        "0<0U0^0g0p0y0",
        "9r$tL;",
        "6?6d6u6~6",
        "556L6j6w6",
        "7 777E7O7Y7c7m7",
        "APPX Validator: Forcing validator failure due to environment variable.",
        "SKIPBOOTTRACK(SAFEOS): Turning ON SafeOS boot removal per environment variable",
        "5$5*5/5:5K5]5k5w5~5",
        "QQQQQQQW",
        "0*0>0\\0s0z0",
        "> >,>L>X>x>",
        "9$:Z:l:t:z:",
        "%hs: SPGetOSInformation did not find any footprint for the new OS.",
        "OSRollbackService::CCheckpoint::MoveOrCopyDirectory: ObliterateOrMoveDirectoryTree(%s) failed.",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCGlobalPath@@@UnBCL@@@UnBCL@@",
        "sMIG_DIAG_APPEND",
        "7(7@7K7h7",
        "ERROR_CS_ENCRYPTION_EXISTING_ENCRYPTED_FILE",
        "434W4{4",
        "JET_wrnRemainingVersions",
        "cmi2migxml.dll",
        "6#6:6F6Q6_6",
        "RemoveWindowsOld value is set",
        "long __thiscall CARPValidator::ValidatePreExecution(struct IExecutionContext *,enum OP_EXECUTION_PHASE,class COperation *,class COperationQueue *,int &)",
        "r6f;E",
        "273[3",
        "ERROR_INVALID_CURSOR_HANDLE",
        "txVSW",
        "3-3N3V3^3",
        "u VQS",
        "9$949<9D9P9t9|9",
        ".?AVCXXXXXHandledException@?FK@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "DiskLayout::VerifyLayoutFillSpaceOnce: Only one partition may be extended to fill remaining space.",
        "T$(9GL|X",
        ".PAVCXXXXXHandledException@?8??AddToImageInfoSet@CImageInfoSet@@SGJPAV2@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@KPAV?$ArrayList@PAVCImageInfo@@@4@PBG4PAUtagWDS_CLI_CRED@@W4IMAGE_TYPE@SetupPlatform@@@Z@",
        ";\\;};",
        "null collection to ArrayList constructor",
        "9$:C:I:R:Y:g:p:w:",
        "WilStaging_02",
        "y+Shq",
        ".?AU?$IList@PAV?$DictionaryEntry@W4SYNCEXEC_PHASE@SetupPlatform@@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "CreateCustomPartition: Failed to create partition on target disk (0x%08x)",
        "TCPAu$",
        "SPFindFirmwareBootDisk: Couldn't get firmware type (0x%08x)",
        ":&:6:>:G:M:Y:j:w:",
        "Found newly created WinRE partition, trying to remove it now.",
        "SPApplyDeviceLayoutDiskConfig: Failed to retrieve disk layout (0x%08X)",
        "DoneDownlevelOCMode",
        "0$0,060=0C0H0S0_0s0",
        ">3>g>n>t>y>",
        ".?AV?$ArrayList@PAVCFileCreationData@@@UnBCL@@",
        ".?AV?$CAutoCleanupBase@PAVVdsVolume@@@RAII@@",
        ".?AVCXXXXXHandledException@?2??pAddSafeOSDrivers@@YGJPBGPAVCSetupAutomation@@000PAXPAUIGenericProgress@SetupPlatform@@@Z@",
        "?/?8?H?M?Y?f?m?w?",
        "class CCFGSectionValue *const &__thiscall UnBCL::ArrayList<class CCFGSectionValue *>::get_Item(int) const",
        "4'525D5M5[5b5p5u5",
        "Got respecialize OneSetting: %s",
        ".?AV?$HTEnumerator@W4OP_OPERATION_ID@@HUTableKey@?$Hashtable@W4OP_OPERATION_ID@@H@UnBCL@@V?$DictionaryEntry@W4OP_OPERATION_ID@@H@4@UKeyTraits@34@$1?RetrieveEntry@34@KG?AV54@PBV?$CAtlMap@UTableKey@?$Hashtable@W4OP_OPERATION_ID@@H@UnBCL@@HUKeyTraits@23@V?$CElementTraits@H@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "ERROR_INVALID_LABEL",
        ">\">)>/>4>?>K>T>\\>c>x>",
        "t$09E",
        ":\":0:::C:L:U:o:}:",
        "ERROR_INVALID_PRIMARY_GROUP",
        ".wim.00",
        "ERROR_NOT_QUORUM_CAPABLE",
        ";T$ u",
        "8%8-838K8S8Z8f8m8s8x8",
        "Reducing duplicate winre entries.",
        "j[jxh\\",
        "ERROR_POTENTIAL_FILE_FOUND",
        "8/8<8I8g8r8",
        "6.0.6000.16386",
        "MIG_DIAG_SHELL_FOLDERS",
        ".?AV?$DictionaryEntry@PAVString@UnBCL@@PAV?$Array@E@2@@UnBCL@@",
        "SP_ENV_FORCE_NEO_PATH",
        "ERROR_DBG_RIPEXCEPTION",
        "?$?7?<?H?X?_?g?l?x?",
        ";,;6;",
        "es-DO",
        "9%92999@9K9U9h9r9",
        ".?AUISetupPlatformPrivate@SetupPlatform@@",
        "0&0L0j0",
        "void __thiscall UnBCL::ArrayList<class CShellFolderInfo *>::Insert(int,class CShellFolderInfo *)",
        "=0=y=",
        "    Failed to assemble full payload path",
        ".ChangeTag",
        "CNewSystem::QueueSetupAutomation: Failed to get DU opt-in (0x%08X)",
        "ERROR_CLUSTER_TOO_MANY_NODES",
        "7#7G7k7}7",
        "4.4:4?4a4g4v4",
        "Failed to open object's key. Status: %x",
        "?GetBaseException@Exception@UnBCL@@UBEPBV12@XZ",
        "5 5%505;5@5T5Y5l5",
        "ERROR_KEY_HAS_CHILDREN",
        "\\system32\\ssshim.dll",
        "ERROR_OPERATION_ABORTED",
        "Publisher",
        "Registry creation failed with error 0x%08X",
        "%hs: Failed to determine bitlocker status. Error: 0x%08X",
        "< </<;<C<L<T<Y<d<s<",
        "OC::CDownlevelOCStore::GetOCCollection",
        "ERROR_EXTENDED_ERROR",
        "232@2N2e2",
        ">D>I>W>n>s>",
        "%hs: Error creating tag file [%s] to mark the system BCD store as temporary, GLE=0x%x",
        "KeepEtlFile",
        "?&?8?F?T?b?p?~?",
        "WIMSetFileShortName",
        ".?AV?$ArrayListEnumerator@PAVCWIMBootData@@@_@UnBCL@@",
        "Failed to generate merge file name from [%s]: 0x%x",
        ">'>J>T>a>g>n>x>",
        ":^;i;};",
        "void __thiscall UnBCL::ArrayList<enum OP_EXECUTION_PHASE>::CopyTo(class UnBCL::Array<enum OP_EXECUTION_PHASE> *,int) const",
        "ERROR_BUFFER_ALL_ZEROS",
        "2 212H2a2z2",
        "RetryPhase",
        "  StopTelemetry: %d",
        "CApplyDrivers::CopyToDriverStore: Failed to create driver parent directory %s. Error: 0x%08X",
        "5,505@5D5T5X5h5l5|5",
        "=3=L=a=r=",
        "8$868J8X8_8e8j8u8",
        "8$8/8;8G8S8",
        "CAddSetupClRequest::DoExecute: Cannot load security hive for offline OS %s. Error: 0x%08X",
        "CMediaLayout::ExecuteOptimization: Failed to add operation [%s]: 0x%08x",
        "PUBLIC",
        "void __thiscall UnBCL::ArrayList<class CImageInfo *>::AddRange(const struct UnBCL::ICollection<class CImageInfo *> *)",
        "{4AC13FD2-63E7-45E0-A1DE-571D6F17445A}",
        "7#7*72777G7N7X7l7",
        ")volume shrink",
        "ERROR_SXS_XML_E_XMLDECLSYNTAX",
        "<(<.<5<?<L<S<]<n<{<",
        ":#:.:<:h:r:",
        "=H>U>t>",
        ".PAVCXXXXXTemp@?PH@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "9$9,949<9H9h9p9x9",
        "CSetupPlatform::FlushLogsToDisk",
        "int __thiscall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::ContainsKey(class UnBCL::String *) const",
        "1(3p4",
        ">'>4>H>T>d>m>u>",
        "void __thiscall UnBCL::ArrayList<unsigned long>::AddRange(const struct UnBCL::ICollection<unsigned long> *)",
        ".?AVDateTime@UnBCL@@",
        "868e8w8",
        "8 8$8(8,84888<8D8L8P8X8\\8d8h8p8t8x8|8",
        "CSPExecuteProgress::ProblemEncountered",
        "Wmi::GetCallParameters: Couldn't spawn instance of method parameter type for %s.%s (0x%08x)",
        "CDumpSourcesData: Failed to main source index to file: %s. Error: 0x%08X",
        "6,6M6|6",
        ".?AV?$DictionaryEntry@KPAUIVdsVDisk@@@UnBCL@@",
        "</=S=s=",
        "%c:\\SetupPlatformDebug.INI",
        "pInitializeWmiLogging::LogCallback::LogW",
        "3 3$3<3@3D3H3\\3`3x3|3",
        "Control trace failed: 0x%x",
        "ConvertToLegacyInfoLevel",
        ">Q>|>",
        "SPDoFrameworkGather",
        "Failed to create hive. Store: %ws Status: %x",
        "7'888?8V8]8v8}8",
        ":/;<;N;V;\\;i;{;",
        "= =,=>=F=S=c=o=}=",
        "en-CA",
        "8(8,8<8@8P8T8X8\\8`8h8l8p8x8|8",
        "f;4Bt",
        "<4<D<H<X<\\<p<",
        "CSetupPlatformPrivate::Execute: Failed to deserialize / execute pre - OOBE operations.Error: 0x % 08X",
        "ERROR_IPSEC_QM_POLICY_NOT_FOUND",
        "2\"2?2",
        "2J3n3",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> **__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> *>::GetBuffer(int)",
        ";?;o;",
        "<not set>",
        "6)6/6C6O6s6",
        ";(<`<",
        "131=1a1",
        "TerminateProcess",
        "SetThreadToken",
        "Save page file settings from old os",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Rollback: Directory copy failed",
        "u\"Pj ",
        "0:0~0",
        "0E0L0R0W0b0m0r0",
        "base\\ntsetup\\setupplatform\\lib\\static\\setupplatform.cpp",
        ";8<E<]<",
        "class CDriverInfo **__thiscall UnBCL::ArrayList<class CDriverInfo *>::GetBuffer(int)",
        "ExecuteFailForward: Failed to create splash window. hr = 0x%08X",
        "DiskLayout::VerifyLayoutNoActiveLogical: Can't make a logical partition active",
        "Failed to write %s to %s. Error: 0x%08X",
        "7C7S7",
        "An error occurred waiting for service %s to start. Error: 0x%08X",
        "t0WWj",
        ":e;m;",
        ".?AV?$CAutoCleanupBase@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@@RAII@@",
        "797>7Q7]7o7{7",
        "WindowsOld.wim",
        "Save config data",
        "VdsPlatformDiskEnumerator::GetNext: Failed to get next disk (0x%08x)",
        "Reading onesetting for offline user migration",
        "Successfully enabled feature in the OS: %s.",
        ".PAVCXXXXXTemp@?FE@??SPDoFrameworkGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00HPAUISPMigProgress@@@Z@",
        "<!<,<@<N<W<e<o<|<",
        "CurrentControlSet\\Control\\CrashControl\\MachineCrash",
        "Safe OS",
        "0,0:0A0K0V0a0g0{0",
        "VdsPlatform::Initialize: Can't load VDS service (0x%08x)",
        "%hs: OS entry name: %s",
        "<&<,<1<<<G<[<b<",
        "PWVh7",
        "51F1M1\\1c1n1",
        "2$292A2G2T2c2",
        "7!7)707<7N7c7r7|7",
        "ERROR_SPECIAL_GROUP",
        "SafeOSTrusted",
        "2<2]2r2z2",
        "ERROR_INVALID_SERVER_STATE",
        "OC::COCCbsAdapter::SetProxyInterfaceSpecialSecurity: CoSetProxyBlanket failed. hr = 0x%x",
        "Attempting to determine owner of file %ws.",
        "Exporting forcible unload to firmware",
        "onecore\\base\\ntsetup\\provpackageapi\\lib\\payloadenumerator.cpp",
        ":F;N;\\;e;",
        "Copy Setup Platform footprint",
        "%hs: Error while setting upgrade value: 0x%08X",
        "8)9T9|9",
        "4$4D4d4",
        "\\Windows\\Syswow64\\",
        "=<>G>U>|>",
        "CReconstructOS::TearDownCbsLogging",
        "Failed to wof compress file",
        "=H=U=m=",
        "CAddSafeOSBootEntry::ConfigureImageForRAMBoot",
        "Found WIMBoot partition backup directory in %s",
        ";%;*;5;@;T;d;k;q;v;",
        "?\"?'?,?8?Y?r?w?|?",
        "LSVW3",
        "gn-PY",
        " 0g0m0",
        "e104dd76-2895-41c4-9eb5-c483a61e9427",
        "SetFileStorageTierClass",
        "5*5<5I5c5j5p5u5",
        "JET_errInvalidSettings",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Upgrade\\.NETReinstall",
        "VdsDisk::InitializeProperties: Couldn't allocate disk properties (0x%08x)",
        ".?AV?$CAutoCleanupBase@PAVCTestHookDUUpdate@@@RAII@@",
        ":0:>:O:W:h:p:y:",
        ">.>:>G>W>g>o>v>|>",
        "0+0;0K0a0u0}0",
        "ERROR_DLL_MIGHT_BE_INCOMPATIBLE",
        "PVWhu",
        "ActionPlatform::LaunchModule: Failure occurred while executing '%s' from %s; dwRet = 0x%x",
        "1'171F1a1k1u1{1",
        "Creating new system (7).",
        "1%1-131@1R1z1",
        "%s_%u",
        "long __stdcall pAddSafeOSDynamicUpdateOperations(int,const DU::ImageInfo *,unsigned long,const unsigned short *,int,int,const unsigned short *,int,const unsigned short *,const unsigned short *,const unsigned short *,int,class COperationQueue *,class CBaseInternalProgress *)",
        "9 9,989D9P9\\9h9t9",
        "2$252>2K2V2h2p2z2",
        "6&6:6N6W6p6~6",
        "7(7/7",
        "313\\3c3q3",
        "ERROR_FILE_SHARE_RESOURCE_CONFLICT",
        "RtlSetCurrentTransaction",
        "4(4L4T4\\4d4l4t4|4",
        ".?AVCXXXXXHandledException@?2??RemoveUninstall@CUninstall@@UAEJXZ@",
        ".?AU?$IDictionaryEnumerator@PAVString@UnBCL@@H@UnBCL@@",
        "pExtractWinREFromImage: Failed to set new OS device element data. Error = 0x%08X",
        "PSFX_E_MATCHING_BINARY_MISSING",
        "$SVWh",
        "<5<D<M<W<`<j<s<",
        "t$,Wh",
        "9*969C9S9_9q9",
        "=!>L>q>",
        "343B3J3O3^3q3}3",
        "NOTES",
        "4)4J4g4",
        "(%lx): Failed to retrieve reparse point's path, path restrictions will not be honored [ID=0x%I64x]",
        "    from [%02d/%02d/%d %02d:%02d:%02d]",
        "6.787g7",
        "1)141B1P1^1l1x1",
        "FindMatchingDeviceInfoData: IOCTL_STORAGE_GET_DEVICE_NUMBER IOCTL failed. Error = 0x%X.",
        "CSetupAutomation::SuspendAndRelease: Couldn't find underlying host disk/partition for %s",
        ";!;%;);-;1;5;9;=;A;E;I;M;Q;U;",
        "JET_wrnColumnPresent",
        "6\"6+646=6F6O6X6a6j6s6|6",
        "7N7`7h7n7{7",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCShellFolderInfo@@@UnBCL@@@UnBCL@@",
        "<.=C=]=n=",
        "6\"646P6W6]6i6u6",
        "ERROR_BAD_NET_RESP",
        ";);Z;x;",
        "%hs: Registry Type: %d",
        ".?AVCSPTelemetryData@@",
        "ERROR_LOCK_FAILED",
        "PWWWV",
        "Bugcheck param 3",
        "ProfessionalWorkstationN",
        "RtlSetOwnerSecurityDescriptor",
        ".PAVCXXXXXTemp@?BA@??QueueCustomizations@CNewSystem@@UAEJPAUISetupAutomation@SetupPlatform@@@Z@",
        "XD:P(A;CI;KA;;;SY)(A;CI;RCWD;;;BA)",
        "t1h`N",
        "%s%s%s%s",
        "4-4<4Y4_4q4y4",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CGlobalPathFindData *>::MoveNext(void)",
        ".?AV?$ArrayList@PAVCWIMBootData@@@UnBCL@@",
        "?\"?(?5?G?U?",
        "Failed to delete the applied path.",
        "NOT INSTALLED",
        ".?AU?$IEnumerable@UDISK_SPACE_IMPACT@@@UnBCL@@",
        "3$3,343<3D3T3\\3d3l3t3",
        "?6?>?H?O?U?Z?e?q?v?",
        ".?AV?$ArrayListEnumerator@PAVCMountedPathInfo@CDeploymentBase@@@_@UnBCL@@",
        "s(Phx",
        ";-;4;H;V;d;r;",
        ".CompressHelper",
        "ERROR_SAME_DRIVE",
        "Adding class filters is complete",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::ArrayList<class CDriverDetails *> *> *> *)",
        ".PAVCXXXXXHandledException@?GH@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "ERROR_USER_DELETE_TRUST_QUOTA_EXCEEDED",
        "2-2B2L2",
        "<NULL>",
        "1-1<1O1a1s1",
        "%29s (%d)",
        "7#7)7.7H7c7t7",
        "0-050;0H0Z0v0",
        "4-4z4",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,class ATL::CElementTraits<class CSPInternalPluginData *> > const *,struct __POSITION * const &)>::Reset(void)",
        "00@0L0l0t0|0",
        "int __thiscall Mig::CKeywordTree::RemoveKeyword(class UnBCL::String *)",
        "long __thiscall CBackupRecoveryPartition::DoExecute(struct IExecutionContext *,void *,struct IInternalOperationsProgress *)",
        "ERROR_STOPPED_ON_SYMLINK",
        "607Q7",
        ";{Lwor",
        "%hs: Malformed line found in the staged updates section: %s",
        "Find snapshot [%s] from config file",
        "5,5K5W5l5~5",
        "5,555B5N5W5d5m5w5",
        "assemblyIdentity",
        "ERROR_MUI_FILE_NOT_LOADED",
        ".?AV?$ArrayList@PAVCCFGSectionValue@@@UnBCL@@",
        "<!<5<;<D<Z<g<y<",
        "%hs: Adding mapping from %s to %s",
        ".?AVCFlowControls@@",
        "Failed to set SD",
        "ERROR_REPARSE_TAG_INVALID",
        "ERROR_INVALID_DATATYPE",
        ">E>]>w>~>",
        "=;=B=H=M=X=_=s=",
        "1!1-151]1h1z1",
        "ProfessionalCountrySpecific",
        "5-5h5u5",
        "020<0Q0c0k0q0",
        "<#<*<5<@<E<Y<t<",
        "09^$t",
        "2G3\\3",
        "2*2F2\\2z2",
        "Execute default unattend file",
        "ERROR_DS_DOMAIN_RENAME_IN_PROGRESS",
        " !\"#[$%&'[[()*+,[-./[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[012345[[6789:;[<[[[[[[[[[[[[[=>?@ABCD[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[EFGHIJKLMNO[[PQRSTU[V[[WXY[Z",
        "<:=Z=b={=",
        "CExecuteUnattend::DoExecute: Couldn't mark pass %s as unused in unattend context: 0x%08x",
        "1#111P1[1x1",
        "IsDiskOnXHCI",
        "0$030C0P0\\0l0y0",
        "393789f5-61c1-4881-b5e7-c47bcca90f94",
        ".?AV?$SerializableBase@VCBackupRecoveryPartition@@$0A@V?$DefaultInstanceFactory@VCBackupRecoveryPartition@@@UnBCL@@@UnBCL@@",
        "<\"<'<2<A<I<O<_<i<s<",
        ".FailurePhase",
        "2(2,2D2H2`2d2|2",
        "3,33393>3J3Q3i3p3v3{3",
        "SPClearSoftReserve",
        ";!;-;>;E;R;b;n;v;|;",
        "9t$ u39t$",
        ".?AV?$Hashtable@PAVString@UnBCL@@K@UnBCL@@",
        ".?AV?$SmartPtr@V?$Hashtable@PAVString@UnBCL@@PAUISerializable@2@@UnBCL@@@UnBCL@@",
        "> >&>1>?>k>{>",
        "RtlSetEnvironmentVariable",
        "Failed creating source SYSTEM hive path name %ls\\COMPONENTS",
        "Delete all etl files because this is an async upload request.",
        "3+393O3Z3h3v3",
        "?6?O?Z?j?t?",
        "2\"2/252=2D2J2O2Z2h2n2",
        "Total time spent processing (in ms)",
        "D$(PjZ",
        "3$383i3p3v3{3",
        "ERROR_SINGLE_INSTANCE_APP",
        ".?AV?$ArrayListEnumerator@W4OP_OPERATION_ID@@@_@UnBCL@@",
        "7$7,787@7\\7d7l7",
        "5$50585Z5e5w5~5",
        "8!868>8D8Q8c8|8",
        "0\"0:0J0W0g0s0{0",
        "5>6f6m6",
        ":+;2;8;=;I;T;h;p;",
        "SymbolicMappingsFound",
        ".?AU?$IEnumerable@UPartition@DiskLayout@@@UnBCL@@",
        ">/>=>U>Z>q>",
        ".?AVCSetupClRequest@@",
        "ERROR_CANNOT_ACCEPT_TRANSACTED_WORK",
        "5'595@5J5[5h5o5y5",
        "RegValueLogger::ProcessValue",
        "3&3,31393F3L3`3i3",
        "dwRet",
        "2\"262I2R2c2j2p2u2}2",
        "void __thiscall UnBCL::Array<class CBcdSetting *>::Remove(class CBcdSetting *)",
        "             %d (recursively)",
        "5*5O5t5",
        "5(5S5q5",
        "5#5R5m5",
        "SetupPlatform: Phase \"Post-SysPrep\" completed successfully.",
        ">:>^>d>|>",
        "? ?$?,?0?8?@?D?H?P?T?X?`?d?h?p?t?|?",
        "ERROR_DOWNGRADE_DETECTED",
        "9N9U9`9f9s9~9",
        "    Failed to assemble search path string",
        "0*0A0L0Y0i0w0",
        ".?AV?$SerializableBase@VCPrepareSafeOSForRollback@@$0A@V?$DefaultInstanceFactory@VCPrepareSafeOSForRollback@@@UnBCL@@@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<struct SetupPlatform::IDisk *>::CopyTo(class UnBCL::Array<struct SetupPlatform::IDisk *> *,int) const",
        "? ?(?,?4?8?@?D?L?P?X?\\?h?l?p?t?x?|?",
        ":*:G:S:",
        "(SVW3",
        ")SPDeserializeOperations failed",
        "3,373G3Q3c3k3q3{3",
        "0 1E1",
        "7'8H8g8",
        "<!<)<.<><I<U<^<r<",
        "< =Y=r=",
        ".Move.",
        "<%</<8<O<]<o<x<",
        ":,;H;t;",
        "=+=4=:=N=m=",
        "SL_E_SFS_INVALID_FILE_POSITION",
        "VhP}E",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *>::InitLarva(class UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned long> *> *)",
        ">!>/>=>K>",
        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/b",
        "1'1@1Q1x1",
        ".?AV?$CAutoCleanupBase@PAV?$ArrayList@PAVString@UnBCL@@@UnBCL@@@RAII@@",
        ".?AVIOCStore@OC@@",
        "<;<O<\\<",
        "10191B1K1T1]1f1o1",
        "384J4R4f4v4",
        ";+;K;",
        "2\"3'3.3E3L3R3W3b3m3s3",
        "??0?$ICollection@PAVString@UnBCL@@@UnBCL@@QAE@XZ",
        "DiskLayout::FindPartitionByOrdinal: Can't enumerate partitions: 0x%08x",
        "OC::COnlineOCManager::GetOCStatus: Found and removed a duplicate OC (%s) in the list.",
        "  CorrelationVector: %s",
        "VdsPlatform::CreateVirtualDisk: Creating virtual disks is not supported using VDS",
        "OSRollbackService::CSetupRollbackService::RollbackSetCheckpoint",
        "CSetupPlatform::CreateNewSystem: Using compact OS from automation: %s",
        "I_RpcMapWin32Status",
        "5$5,545<5H5h5t5",
        "Failed to bind with firmware. Flags: 0x%x Status: %x",
        "3+4J4`4g4u4",
        "Performing estimation",
        "0%141;1G1N1}1",
        "Failed to open object %ws. Status: %x",
        "nOa-Q",
        "SPGetRecoveryImageFolder",
        "1 1$1(1,10141<1@1D1L1T1\\1d1h1l1p1t1x1",
        "s\"Ph@",
        ">'>;>J>T>`>o>{>",
        "8,818D8W8h8",
        "%hs: Cannot set upgrade value. Error: 0x%08X",
        "SysprepSession::ExecuteAction: Failed during sysprepModule operation; dwRet = 0x%x",
        "; ;(;4;T;\\;h;",
        "t=jPj",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@",
        "1!1G1N1T1Y1d1o1",
        "Cannot open setup key. Error: 0x%08x",
        "7(717G7U7^7g7s7",
        "Copy HKLM\\System\\Setup\\Compact value from old windows",
        "const unsigned long &__thiscall UnBCL::ArrayList<unsigned long>::get_Item(int) const",
        "Failed to read %s.%s, although the property exists; unexpected type? (0x%08x)",
        "Found %d driver packages in %s.",
        "??0Version@UnBCL@@QAE@HH@Z",
        "8F9N9]9c9v9",
        "141E1V1c1t1",
        "SYSTEM\\Setup\\Rollback",
        "void __thiscall UnBCL::ArrayList<class COSPieceInfo *>::set_Item(int,class COSPieceInfo *)",
        "    Failed to get next payload",
        "WdsGetBlackboardValue",
        "Failed config initialization.",
        "?>?P?X?^?k?}?",
        "dpSPGetSnapshotCreationTimeFromRegistry",
        "DUMPu9",
        "?'?3???K?W?c?o?",
        "SL_E_CHPA_TIMEBASED_ACTIVATION_NOT_AVAILABLE",
        ".PAVCXXXXXHandledException@?CJ@??pSPDoOfflineApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0H0PAUISPMigProgress@@@Z@",
        ":G:O:Y:`:f:k:w:",
        "EnumServicesStatusExW",
        "u:jW_SS",
        "GetSystemDiskNumber: Couldn't query NT dir [%s]; status = 0x%x",
        "707a7",
        "ERROR_DS_SERVER_DOWN",
        "1#161R1Y1`1l1|1",
        "?CompareTo@String@UnBCL@@UBEHPBVObject@2@@Z",
        "void __stdcall CDeploymentBase::CleanupMounts(const unsigned short *,class UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *> *)",
        ";&;T;",
        "ChkdskEx",
        "ERROR_ACCOUNT_RESTRICTION",
        " (with reboot request)",
        "JET_errTableNotEmpty",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::TableKey,struct HKEY__ *,struct UnBCL::Hashtable<class UnBCL::String *,struct HKEY__ *>::KeyTraits,class ATL::CElementTraits<struct HKEY__ *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "5 5$5(50585<5@5D5H5L5P5T5X5`5d5h5l5p5x5",
        ">@>P>o>u>",
        "5-595E5L5R5W5b5m5",
        "SmPartition::InitializeProperties",
        ">A>d>}>",
        "int __thiscall UnBCL::ArrayList<struct PartitionLayoutArgs *>::BinarySearch(int,int,struct PartitionLayoutArgs *,struct UnBCL::IComparer<struct PartitionLayoutArgs *> *)",
        "SL_E_VL_INFO_PRODUCT_USER_RIGHT",
        "%hs: Removing WIMBoot entry with ID: %I64d. WIM path: %s %s",
        "CorruptionDetectedDuringAcr",
        "SPExecuteCommandFromLine",
        "%hs: Failed to install the top fail-forward option, moving to the next one",
        "8(898X8g8y8",
        "< =6=<>r?",
        "ERROR_SXS_PROTECTION_CATALOG_NOT_VALID",
        ".?AV?$Array@PAUIDisk@SetupPlatform@@@UnBCL@@",
        "?$?,?4?<?H?h?p?",
        "0.070@0J0\\0h0s0",
        ">7>I>Q>W>d>v>",
        ".?AV?$CAutoRelease@PAUIPathEnumerator@SetupPlatform@@@RAII@@",
        "5N5Y5g5u5",
        "?get_Name@XmlNode@UnBCL@@QAEPAVString@2@XZ",
        "0#0U0u0|0",
        "PRODUCTSUITE",
        ">'>F>",
        "7'777K7R7X7]7h7y7",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,long> *const *__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,long> *>::GetBuffer(int) const",
        ".?AV?$SerializableBase@V?$Array@PAUISerializable@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAUISerializable@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "FOLDERID_Objects3D",
        "Onesettings: Core telemetry is not allowed; skipping",
        "<(<=<E<K<X<j<}<",
        ";`<f<",
        "RtlConvertSidToUnicodeString",
        "HashDigestLength",
        "4$4-474C4\\4m4z4",
        ".?AV?$ArrayList@PAVCDUPackage@@@UnBCL@@",
        "Vh0w`",
        "SmPlatform::ComputeHostInfo: Failed to get windows directory (%u)",
        "VerifyIntegrityChunk",
        ">5???L?R?Y?c?p?w?",
        "<6<><D<X<l<|<",
        ".?AVCOperationInfo@@",
        "101<1\\1d1l1t1|1",
        "Format",
        "ERROR_DS_NO_PKT_PRIVACY_ON_CONNECTION",
        "Qj)j*h",
        "<>>^>",
        ">#>G>k>}>",
        ".PAVCXXXXXTemp@?6??SPReclaimRecoveryImagePartition@@YGJPAVString@UnBCL@@00@Z@",
        "fr-FR",
        ".PAVCXXXXXHandledException@?BA@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "ERROR_DS_TREE_DELETE_NOT_FINISHED",
        "RPC_S_UNKNOWN_AUTHZ_SERVICE",
        "%hs: Will remove path (from ID): %s",
        "Cleaning up orphaned ramdisk options.",
        "ZwSetSystemEnvironmentValueEx",
        "=:=G=U=e=r=",
        "void __thiscall CDeploymentBase::AddToStoredObjectsGroup(class UnBCL::String *,struct UnBCL::ISerializable *)",
        ".tls$",
        "CreateCurrentDirectory",
        "ERROR_IPSEC_IKE_CERT_CHAIN_POLICY_MISMATCH",
        "5D6R6j6r6x6}6",
        "MaximumBuffers",
        ".?AVCXXXXXHandledException@?8??SPDeleteAllSnapshots@@YGJPAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@3@HPA_J@Z@",
        "class CRegCreationData *__thiscall UnBCL::_::ArrayListEnumerator<class CRegCreationData *>::get_Current(void) const",
        "ERROR_SXS_PROTECTION_CATALOG_FILE_MISSING",
        "1&1<1W1]1g1l1v1}1",
        "  Using WU driver applicability to skip existing drivers",
        "VdsPartition::SetGptAttributes",
        "2)252G2o2|2",
        "3%3*3R3i3",
        "ERROR_DS_DECODING_ERROR",
        "at2Nt",
        "rautoexec.bat",
        ":?:h:z:",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CImageInfo *>::MoveNext(void)",
        "=&=8=?=E=J=U=`=p=",
        "pOpenDiskImage: Unrecognized disk image type: %s",
        "LoadResource",
        "ApplyPartitionProperties: Failed to assign drive letter (0x%08x)",
        "?%?+?0?;?F?Z?f?v?",
        ">$>,>2>?>Q>n>",
        "=+=z=",
        "5+555?5I5S5j5x5",
        "SPFixOOBE",
        "9$9+9R9Y9a9j9v9",
        "PWSh|!",
        "969i9",
        "9N9U9[9`9l9v9",
        ";+;>;M;];j;u;",
        "1.1<1E1V1_1h1q1",
        "Install Critical Dynamic Updates",
        ".?AV?$ArrayListEnumerator@K@_@UnBCL@@",
        "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management",
        "DownlevelCurrent",
        "4;4X4g4u4|4",
        "7*7I7\\7c7i7n7y7",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::Insert(int,class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *)",
        "int __thiscall UnBCL::ArrayList<struct SetupPlatform::IPartition *>::LastIndexOf(struct SetupPlatform::IPartition *,int,int) const",
        "CInfFile::IsInstallable: Failed when trying to parse %s; hr = 0x%08X",
        "%hs: Cannot find a previous volume that can be extended.",
        "OC::COCDismAdapter::EnableDisableOCs: DismEnableDisableFeature failed. hr = 0x%x",
        ">\">4>?>I>V>_>f>u>|>",
        "ERROR_CTX_MODEM_INF_NOT_FOUND",
        "SmPlatformDiskEnumerator::Initialize: Couldn't discover (re-enumerate) storage provider objects (0x%08x)",
        "(%lx): Failure during enumeration of values.",
        "PVh81",
        "{60E9952C-881B-4B30-97E8-5E2208D63AFA}",
        "9B9]9n9",
        ".?AVCXXXXXHandledException@?2??DoExecute@CBackupRecoveryPartition@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "Migrate framework (%s)",
        "CDUPackage::UnpackTo: Failure enumerating updates in %s. Error: 0x%08X",
        "ASSERT: Assert failed to build string.",
        "False",
        "CSetupAutomation::CacheInstallTarget: Failed to enumerate partitions: 0x%08x",
        ".?AV?$ArrayList@PAVCImageInfo@@@UnBCL@@",
        "\"%s\" %s",
        "ERROR_MULTIPLE_FAULT_VIOLATION",
        "6 6(6.6;6M6w6",
        "Education",
        ".?AU?$IList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$Array@E@2@@UnBCL@@@UnBCL@@",
        "base\\ntsetup\\setupplatform\\lib\\util\\scheduletask.cpp",
        "CMediaLayout::QueueInstallImage: Failed to queue copying the install image: 0x%08x",
        "Attempting to enable user %s to match the source user",
        ":*:1:7:<:G:Q:d:x:",
        "3A4H4o4v4",
        "t)SSSSh",
        "? ?1?8?C?",
        ">#>(>0>:>M>V>d>~>",
        "ERROR_NOT_LOGON_PROCESS",
        "4(444<4d4l4t4",
        "Failed to copy objects of type %08x data. Status = [%x]",
        "%ls\\%ls\\%ls",
        "CRelocateOS: Failed to write %s to the %s config file. Error: 0x%08X",
        "checkpoint.info",
        "5 5,5>5S5b5l5q5y5",
        "NetFX reinstall cmd line: %s",
        "=P=d=t=",
        "%hs: Executing framework gather operation",
        "y+VhQ",
        "mxeagent.dll;upgradeagent.dll;csiagent.dll",
        "8*808@8P8V8b8n8",
        ".?AV?$CAutoWdsLibFree@PAG@RAII@@",
        "XReference%d",
        "F_[Qj",
        "IsOnline",
        "int __thiscall UnBCL::Array<class CBasicEnvEntry *>::Add(class CBasicEnvEntry *)",
        "2(222?2E2L2V2c2j2t2",
        "T$(RP",
        "WWWVt",
        ".?AV?$DictionaryEntry@PAVString@UnBCL@@PAVCSPInternalPluginData@@@UnBCL@@",
        "SetThreadpoolTimer",
        "SL_E_PKEY_INVALID_KEYCHANGE1",
        ".?AV?$SmartPtr@VCAccessCreds@@@UnBCL@@",
        "9\"9R9",
        "8 8+848I8]8e8",
        "8%888N8d8z8",
        "CImageInfoSet::CreateFromReconstructionSources",
        ".?AV?$SmartPtr@U?$IEnumerator@PAUISerializable@UnBCL@@@UnBCL@@@UnBCL@@",
        "6#6/6@6T6`6q6",
        "4-464@4z4",
        ": :T:`:y:",
        "4:4~4",
        "8+82888=8H8O8c8r8",
        "SL_E_MISMATCHED_PKEY_RANGE",
        "ActionPlatform::LaunchModule: Wait failed with 0x%x after launching worker thread; dwRet = 0x%x",
        ".?AV?$DefaultInstanceFactory@VCGlobalPath@@@UnBCL@@",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@K@UnBCL@@@_@UnBCL@@",
        "?6?T?i?p?v?{?",
        "1#1/191U1|1",
        "6\"6)6=6k6",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCSPInternalPluginData@@@UnBCL@@@UnBCL@@",
        "ERROR_MCA_UNSUPPORTED_COLOR_TEMPERATURE",
        "JET_wrnExistingLogFileIsNotContiguous",
        "On allocating cbs array",
        "1-171D1Y1n1",
        "DismGetPackages",
        ".?AV?$SmartPtr@VCOptionalComponent@OC@@@UnBCL@@",
        ".PAVCXXXXXHandledException@?2??SPDeletePartition@@YGJH_K@Z@",
        "4+4B4M4W4v4",
        "    Failed to extract file",
        "0%0;0M0U0[0h0z0",
        "GetSystemWindowsDirectoryW",
        "7]7d7y7",
        ".?AV?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@",
        "ERROR_SXS_XML_E_EXPECTINGCLOSEQUOTE",
        ")create partition",
        "Hjd[9]",
        "3&3/383N3\\3f3o3",
        "SPGetWIMImageInfo: Failed to unload image software hive. Error: 0x%08X",
        "1*131<1[1h1",
        "WIMMountExtractDirToHandle",
        "8!8,888=8Q8l8",
        "xHj\\S",
        "Scanning for driver updates; will optimize first search attempt.",
        "ERROR_IPSEC_MM_FILTER_NOT_FOUND",
        "CAddAppxPackage::DoExecute: Failed to add appx package %s. Error: 0x%08X",
        "3;3B3H3M3X3b3u3",
        ":O:n:",
        "6!656E6i6s6~6",
        "<*<;<H<P<]<o<w<",
        "1:1H1T1[1a1f1n1u1",
        "WinPE\\setupapi",
        "Closing Panther Logging",
        "474J4k4",
        "class CCFGSectionFile *__stdcall UnBCL::Try_Cast<classCCFGSectionFile*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "3E3L3Z3g3l3",
        "NEO installation path is turned off in low disk space scenario.",
        ".?AVCSetupOneSetting@@",
        "ERROR_BAD_PIPE",
        "Cleanup source WIM file(s)",
        "5?5b5",
        ">#?3?s?",
        "0 1-1h1",
        ":5:L:e:",
        "=>=R=h=",
        "=7=>=D=I=T=[=o=}=",
        "8!9I9U9g9",
        ";(;:;B;H;\\;e;|;",
        "2+22292@2G2N2T2_2",
        "boot.ini",
        "6#6)6/6<6L6Y6`6m6",
        "is-IS",
        "LoadOrderGroup",
        "ERROR_FAIL_NOACTION_REBOOT",
        "ID |Name                                                                            |Executed|Start Time         |End Time           |Elapsed |Disk space(estim.)|Disk space(actual)|Disk space(diff.)|GUID                                  ",
        "1&2C2f2",
        "5%5/555B5X5{5",
        ".?AVCInstallDUUpdatesOffline@@",
        "OC::COCCbsAdapter::GetPackageByName: Failed to query ICbsPackage object. hr = 0x%x",
        "L$hWVP",
        "=%=A=G=T=w=",
        "1&1.131F1\\1c1p1",
        "%hs: Cannot find original path for USERS folder",
        "2!3X3n3",
        ".PAVCXXXXXHandledException@?2??ReconstructWindows@CReconstructOS@@IAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        ".PAVCXXXXXTemp@?8??BuildInfoList@CARPValidator@@IAE?AW4MIGSTATUS@@PAVString@UnBCL@@0PAV?$ArrayList@PAVCAppInfo@@@5@PAV?$ArrayList@PAVCShellFolderInfo@@@5@@Z@",
        "[%d] out of [%d] created snapshots can be queired",
        "void __thiscall UnBCL::ArrayList<class CDrvStoreProperty *>::set_Item(int,class CDrvStoreProperty *)",
        "262I2_2u2",
        "ERROR_DS_CANT_DELETE",
        "void __thiscall UnBCL::Array<enum OP_EXECUTION_PHASE>::Remove(enum OP_EXECUTION_PHASE)",
        "Xuntag",
        "GWVVP",
        "?Compare@String@UnBCL@@SGHPBV12@PBGH@Z",
        "??0?$IEnumerable@H@UnBCL@@QAE@XZ",
        "?)?:?G?L?U?]?b?s?",
        "  Specific callback decision for package (WinPE): %s",
        "SclRegProcessKey",
        ";%<*<",
        "%hs: WinOld dir: %s",
        "ERROR_SXS_MANIFEST_PARSE_ERROR",
        "616T6[6g6",
        "jFYf9",
        ">%>0>@>J>\\>d>j>t>~>",
        "void __thiscall UnBCL::ArrayList<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::set_Item(int,struct SPGetPartitionOrdinal::PartitionInfo)",
        "#0B0i0",
        "9U$v3",
        "ERROR_SERVER_SID_MISMATCH",
        "4'4c4p4",
        "ERROR_UNKNOWN_REVISION",
        "__thiscall UnBCL::ArrayList<class CShellFolderInfo *>::ArrayList(const struct UnBCL::ICollection<class CShellFolderInfo *> *)",
        "void __thiscall UnBCL::Array<struct DiskMatchFilter>::Insert(int,struct DiskMatchFilter)",
        "< <)<.<><I<T<h<r<",
        ".?AV?$KeyCollection@PAVString@UnBCL@@PAVCSPInternalPluginData@@@_@UnBCL@@",
        "<5<P<V<`<e<o<v<",
        "6.696G6U6c6",
        "7'747H7]7p7",
        "CStartSystemServices::DoExecute: Failed to start system services. Error: 0x%08X",
        "NtAddBootEntry",
        "struct DiskLayout::Partition &__thiscall UnBCL::ArrayList<struct DiskLayout::Partition>::get_Item(int)",
        "ERROR_IS_JOIN_PATH",
        "ERROR_DS_NO_BEHAVIOR_VERSION_IN_MIXEDDOMAIN",
        "NtUnloadKey",
        "No drivers to process; leaving.",
        ";*;M;[;z;",
        "7,7>7I7]7m7}7",
        "Extracted Kernel dump",
        "DiskLayout::CreatePartition: Creating partition at offset=%llu, size=%llu",
        ">#>f>m>s>x>",
        "upgconfig.ini",
        "\\REGISTRY\\MACHINE\\SYSTEM",
        "pt-PT",
        "PWShI",
        "CAddCbsPackage::DoExecute: Image health check not supported.",
        "VdsPartition::BringOnline: Failed to query IID_IVdsVolumeOnline interface [%s] (0x%08x)",
        "ServiceName",
        "WIMUnmountImage",
        "ERROR_INVALID_ICON_HANDLE",
        ".?AV?$SerializableBase@V?$ArrayList@K@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@K@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "Failed creating target software hive path name %ls\\SYSTEM",
        "323C3J3P3U3h3r3w3",
        "|SOURCE|\\BootDebuggerFiles.ini",
        "%hs: Cannot set %s value. Error: 0x%08X",
        "CNewSystem::QueueSetupAutomation: Failed to queue unattend settings (0x%08X)",
        "OSRollbackService::CBootFilesRestoreCheckpoint::Finalize",
        "Set reg key value UpgradeTime failed: 0x%x",
        "<C<_<",
        "2#2.292N2_2f2m2x2",
        "SPProcessBitlockerOnDrives: Bitlocker failed to suspend. Error: 0x%08X",
        "=%=/=A=K=Z=k=x=",
        "Cannot set Group for %s, error: 0x%08X",
        "='=C=]=k=}=",
        "5(6d6",
        "class CDriverInfo *const &__thiscall UnBCL::ArrayList<class CDriverInfo *>::get_Item(int) const",
        "hSVW3",
        "ERROR_NO_VOLUME_LABEL",
        "5\"5C5`5",
        "Disabling rollback",
        ";.;<;N;Z;z;",
        "<(<0<8<D<d<l<x<",
        "=-=9=K=x=",
        "Sources\\SafeOS",
        "SYSTEM\\ControlSet001\\Control\\WMI\\AutoLogger\\SetupPlatform",
        ">&>+>;>N>_>o>{>",
        "CGatherOCs::DoExecute",
        ".?AU?$IEnumerator@PAVCCFGSectionValue@@@UnBCL@@",
        ":/:S:e:m:s:",
        "121P1_1h1q1",
        "    Failed to write whitespace",
        "9$9(9,9D9T9X9\\9p9t9|9",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::set_Item(int,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *)",
        "657H7O7U7Z7e7l7",
        "const struct DiskRange *__thiscall UnBCL::ArrayList<struct DiskRange>::GetBuffer(int) const",
        "8#888E8]8",
        "SEH: Attempting to log exception",
        "CSetupPlatform::CreateNewSystem: Invalid system volume information. hr = 0X%x",
        "IMAGE\\LASTMODIFICATIONTIME\\LOWPART",
        "313?3I3P3V3[3f3q3v3",
        "VQPWV",
        "JET_errDatabaseNotFound",
        "CNewSystem::PreInitialize: FveCheckSuspendBitLockerOnUpgrade failed: 0x%08x, assuming auto-unlock is not supported",
        "?OpenSubKey@RegistryKey@UnBCL@@QAEPAV12@PBVString@2@H@Z",
        "PQQQW",
        "4:4S4",
        "2'20292E2Q2]2i2u2~2",
        "80:x;",
        "ERROR_NOT_REGISTRY_FILE",
        "GetSecurityDescriptorLength",
        ".PAVCXXXXXHandledException@?2??DoExecute@CAddDriver@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,enum ActionType>,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,enum ActionType> __stdcall UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::TableKey,enum ActionType,struct UnBCL::Hashtable<class UnBCL::String *,enum ActionType>::KeyTraits,class ATL::CElementTraits<enum ActionType> > const *,struct __POSITION * const &)>::Reset(void)",
        "MoveDirectoryEx: MoveFile Failed, attempting to enumerate",
        "Failed to save available free space info to file: %s. Error = %d",
        "1?1L1e1m1v1|1",
        "Failed to copy resume object data. Status = [%x]",
        "01090C0T0]0j0x0",
        "SPFindSnapshotProp: Failed to convert ID to VSS_ID. Error: 0x%08X",
        "SPScheduleTask: Parameter     : [%s]",
        ";&;7;?;I;R;e;l;r;w;",
        "Failure to delete %s. Error: 0x%08X",
        ">'>9>Q>]>o>z>",
        ";#;:;Z;",
        "7\"7*777?7I7Q7X7b7s7|7",
        "SetupPlatform.ini",
        "void __thiscall UnBCL::ArrayList<class OSRollbackService::CCheckpoint *>::Resize(int,int)",
        "ERROR_QUORUM_RESOURCE",
        "ERROR_NOT_SAFEBOOT_SERVICE",
        "5!5+595?5E5J5T5^5h5r5",
        "9 90989>9C9I9V9f9m9w9",
        "5\\5y5",
        "Policy: Leave BitLocker untouched",
        ":$:C:f:l:w:",
        "ERROR_CTX_MODEM_RESPONSE_NO_CARRIER",
        "4<5Q5c5k5q5",
        "(%lx): Failed to open key [%ws]!",
        ".?AV?$Array@PAVCFilterDriverInfo@@@UnBCL@@",
        "FEATURESCORE",
        "EnterCriticalSection",
        "ERROR_SXS_DUPLICATE_DLL_NAME",
        "void __thiscall UnBCL::ArrayList<class CSimpleCleanup::CCleanupEntry *>::Resize(int,int)",
        "Marking event [&SclEvent_ExecuteUpgHives_Stop]",
        "class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> **__thiscall UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::GetBuffer(int)",
        "9$9;9C9M9f9x9",
        "class SysprepAction *const &__thiscall UnBCL::ArrayList<class SysprepAction *>::get_Item(int) const",
        "ERROR_DS_COULDNT_IDENTIFY_OBJECTS_FOR_TREE_DELETE",
        "7\"777>7D7I7T7^7c7w7",
        "CBS_E_INVALID_INSTALL_STATE",
        "ERROR_WINS_INTERNAL",
        "SYSTEMROOT",
        "CSetupAutomation::Save: Couldn't create write options object: 0x%08x",
        "1(10181@1H1P1\\1|1",
        "RollbackExecuteSequence in progress...",
        "ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT",
        "??0StringBuilder@UnBCL@@QAE@H@Z",
        "CBS_E_INVALID_CONFIG_VALUE",
        "2!2,2:2O2[2s2y2",
        "ERROR_SXS_FILE_HASH_MISSING",
        "3)373[3",
        ">)>>>J>\\>i>p>v>",
        "ReadBootCode: Error reading NTFS boot sectors!",
        "=)=2=:=@=F=K=P=V=^=e=k=t=",
        "class UnBCL::String *__thiscall SysprepSession::GetModeFromRegistry(void)",
        "SL_E_CHPA_INVALID_ARGUMENT",
        "%hs: Failed to disable misconfigured WinSetupBoot. Error: 0x%08X",
        "3!3'3,3R3X3d3l3~3",
        "Failed to store updates info",
        "_DismSetAllIntlSettings",
        "FailureHResult",
        "6 6(686@6H6X6`6h6x6",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *> *)",
        "NtUpdateWnfStateData",
        "?$?+?9?F?Z?",
        "TotalSectors",
        "DismGetFeatureInfo",
        "SmDisk::Initialize: Failed to check for automatically-created partitions (0x%08x)",
        "6*666?6V6i6~6",
        "=/=6=<=A=L=Y=m=~=",
        "sOC::COCCbsAdapter::OpenCbsPackage",
        "TagId",
        "JET_errColumnRedundant",
        "BfsMigrateLoaderSettings failed to open system store %#x",
        "SclRegProcessProfileHive",
        "t&jPj",
        "GetVolumeRootFromPath",
        "3)3O3`3g3u3",
        "='=G=i=",
        "?\"?7???E?R?d?",
        "Failed to open handle to fwbootmgr object. Status = [%x]",
        "2I2[2c2i2v2",
        "\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat",
        "Will skip installing WinRE operations.",
        ".?AVCXXXXXHandledException@?2??SPDeletePartition@@YGJH_K@Z@",
        "VdsVolume::GetProperties: Failed to refresh VDS service (0x%08x)",
        "IsNarratorRunning",
        ".?AU?$IEnumerator@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV?$Array@E@2@@UnBCL@@@UnBCL@@",
        "SPTagTarget: Failed to get Scenario ID for [%s]. hr = 0x%08X",
        "</<;<T<d<k<}<",
        "CONTROLSET001\\CONTROL\\SESSION MANAGER",
        ".NET reinstallation succeeded",
        "%hs: Failed to set BCDE_LIBRARY_TYPE_PREFERRED_LOCALE field. Status = %d",
        "5#575D5I5R5n5u5|5",
        "7 7%7/797C7M7[7a7g7l7v7",
        "Destination%d",
        "Rollback-Online-Common completed successfully.",
        "0$0+0>0E0K0P0[0g0o0x0",
        "Inconsistent structure for ID %u detected (4)",
        "181U1t1",
        "pagefile.sys",
        "Failed 'begin' directory callback",
        "586K6`6",
        "3'3K3\\3i3v3",
        "CanonicalizeObjectPath error with %ws. Error: 0x%08X",
        "SysprepComponent::CreateSysprepActionList: The component node for %s is empty; this is unexpected",
        "DecompressChunkedFile failed",
        "0\"1)171",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,unsigned long>::Add(class UnBCL::String *,unsigned long)",
        "SP_DOWNLEVEL_UM_ETW_SESSION",
        "    Failed to flush writer",
        "2F2n2",
        "SectionName",
        "1'1-161L1b1t1|1",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::Reset(void)",
        "na:Id",
        "0%0-0B0Y0_0j0x0",
        ".?AVCNewSystem@@",
        "SPAPI_E_AUTHENTICODE_DISALLOWED",
        "%hs: Image is already mounted to %s",
        "?get_IsEmpty@String@UnBCL@@QBEHXZ",
        "MIG_OSDB_DRV_FILES",
        "PWVh^",
        "9/959B9P9f9l9~9",
        "0$000G0T0[0w0",
        "1)181C1f1m1s1x1",
        "> >$>(>,>0>4>8><>@>D>X>\\>`>x>|>",
        "class CSPInternalPluginData *__thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,&protected: static class CSPInternalPluginData * __stdcall UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::TableKey,class CSPInternalPluginData *,struct UnBCL::Hashtable<class UnBCL::String *,class CSPInternalPluginData *>::KeyTraits,class ATL::CElementTraits<class CSPInternalPluginData *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "6%6.6C6[6t6|6",
        "SYSTEM\\Setup\\FirstBoot\\Filters",
        "QQPQQQQQQQQ",
        "CSetupPlatform::InitializeCan't create folder %s",
        "6$6.646A6^6d6j6w6",
        "LegalCopyright",
        "0!0(0.030?0J0O0c0k0q0v0",
        "ERROR_IPSEC_IKE_INVALID_SIGNATURE",
        ".?AV?$CAutoCleanupBase@PAUIVolume@SetupPlatform@@@RAII@@",
        "3!3.3i3v3",
        ".?AU?$IEnumerable@V?$DictionaryEntry@KPAUIVdsDisk@@@UnBCL@@@UnBCL@@",
        "CFODValidator::ValidatePostExecution",
        "void __thiscall UnBCL::ArrayList<struct _GUID>::Resize(int,int)",
        ";-<F<U<g<l<",
        ">!>'>->9>M>V>e>o>|>",
        "Failed to get element application path. Status = [%x]",
        "ERROR_PAGEFILE_QUOTA",
        "ERROR_DS_NAME_ERROR_NO_MAPPING",
        "class CWIMImageInfo *__stdcall UnBCL::Try_Cast<classCWIMImageInfo*,struct SetupPlatform::IImageInfo>(struct SetupPlatform::IImageInfo *)",
        "\\\\%s\\RemInst\\%s",
        "Failed to get system store path to delete. Status: %x",
        ":-:D:",
        "Fail to reset RemoveWindowsOld. hr = 0x%x",
        "VdsDisk::BringOnline: Failed to query IID_IVdsDiskOnline interface [%s] (0x%08x)",
        "L$(j8",
        "registry",
        "void __thiscall UnBCL::ArrayList<class CDeploymentBase *>::Insert(int,class CDeploymentBase *)",
        "%hs: Failed to current module name. GLE = %d",
        ".PAVCXXXXXTemp@?EG@??SPDoEndInstallGather@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@1PAV?$ArrayList@PAVString@UnBCL@@@6@111PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        "2#2-2>2G2T2]2e2u2",
        "OOBE boot apply",
        "ExistingPageFiles",
        "2'2A2V2`2m2{2",
        "080S0v0|0",
        "3 3-3?3R3d3l3r3",
        "$OFFLINE_RW$SYSTEM",
        "464K4S4Y4b4x4",
        "8*868B8N8e8q8}8",
        "0%0V0g0x0",
        ".?AVCApplyOCs@@",
        ".PAVCXXXXXHandledException@?CK@??SPValidateTrackedContent@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@000PAH1PAPAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@2@Z@",
        ": :+:6:J:^:z:",
        "WpxLogger::LogW",
        "<@<Q<f<",
        ".?AV?$ArrayListEnumerator@PAV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@",
        "Failed to set Watson bucketing parameter %d for New System #%d. hr = 0x%08X",
        "SL_E_CHPA_PRODUCT_KEY_BLOCKED",
        "tKVh(",
        "6-6H6q6",
        "VERBOSE: Percents for downlevel: %d%% -> %d%%",
        "5!6-6H6h6",
        ":3:<:G:O:V:]:h:r:",
        ">)>N>Z>`>f>u>",
        "T$(;B",
        "0H0Z0b0h0u0",
        ".rdata$zETW1",
        "regular ",
        ">??n?}?",
        "ERROR_TOO_MANY_LINKS",
        "?.?C?R?\\?a?i?p?|?",
        "    Failed to allocate _spPackagePath.get()",
        "S_FALSE",
        "}xF;u",
        "CCompressedPayloadWriterT<class CEmptyType>::Done",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,int>,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,int> __stdcall UnBCL::Hashtable<class UnBCL::String *,int>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,int>::TableKey,int,struct UnBCL::Hashtable<class UnBCL::String *,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "pstrModulePath->CString",
        "3 323j3",
        "9&909?9F9Q9",
        "VdsPlatformDiskEnumerator::Initialize",
        "Apply statistics:",
        "ERROR_UNABLE_TO_EJECT_MOUNTED_MEDIA",
        "class CGlobalPath *&__thiscall UnBCL::ArrayList<class CGlobalPath *>::get_Item(int)",
        "8U8k8",
        "?&?-?3?8?G?Q?V?j?",
        ">0>C>K>`>",
        "62686A6W6e6~6",
        "void __thiscall UnBCL::Array<class CSimpleCleanup::CCleanupEntry *>::Insert(int,class CSimpleCleanup::CCleanupEntry *)",
        "?5?=?[?v?",
        "PROGRAMS",
        "WIM_FileData_Number_Workers",
        "4(4A4V4b4",
        "93:L:S:Z:a:h:o:u:",
        "SnapshotInstallTime",
        ".?AU?$ICollection@PAV?$DictionaryEntry@PAVString@UnBCL@@_K@UnBCL@@@UnBCL@@",
        "__doserrno",
        "%hs: Failed to determine whether the package has ICB; Error: 0x%08X",
        "Adding additional providers to the Autologger tracing session",
        "CBS_E_SESSIONS_LEAKED",
        ".?AV?$SerializableBase@VCSetEntropy@@$0A@V?$DefaultInstanceFactory@VCSetEntropy@@@UnBCL@@@UnBCL@@",
        ">$>)>5>Q>X>f>s>",
        "2$222",
        "3X3y3",
        "0M1|1",
        "9\"9)939@9Q9X9i9s9",
        "?$?*?7?I?W?i?",
        "SWh$l",
        "1$1,141<1`1t1|1",
        "2!3E3W3_3e3r3",
        "HKEY_LOCAL_MACHINE\\SECURITY",
        "0V0]0c0o0{0",
        ".?AVCXXXXXHandledException@?2??DoExecute@CSetBootCommand@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "aSetupPlatform::GetSetupPlatformVersion: Failed get file info for [%s]. hr = 0x%x",
        "?.?k?",
        "CoCreateInstance",
        "j\\Zj:",
        "JET_errLogTornWriteDuringHardRestore",
        "Operation failed with error 0x%08X but we were asked to continue on errors.",
        "2%21292E2M2Y2a2",
        "404D4",
        "?GetLoadedModuleDir@Directory@UnBCL@@SGPAVString@2@PBV32@@Z",
        "Legal_Policy_Statement",
        "long __stdcall pSPCopyFolder(class UnBCL::String *,class UnBCL::String *,unsigned long (__stdcall *)(union _LARGE_INTEGER,union _LARGE_INTEGER,union _LARGE_INTEGER,union _LARGE_INTEGER,unsigned long,unsigned long,void *,void *,void *),void *,void *,int,int,int,int)",
        "void __thiscall SysprepSession::SetModeInRegistry(void)",
        "2F2[2p2",
        "present",
        "?&?2?>?J?V?b?n?z?",
        "CApplyDrivers::CopyToDriverStore: Failed to get source driver directory enumerator; this is unexpected. Error: 0x%08X",
        "=\"=S=",
        "CSystemVolumeSelectionCheckpoint: Failed to backup BCD database.",
        "ERROR_REPARSE_ATTRIBUTE_CONFLICT",
        "SPSetOSEntropy",
        "Failed creating directory %S",
        "1,1D1i1",
        ";4;<;D;L;T;\\;d;l;t;|;",
        "ERROR_CTX_CDM_DISCONNECT",
        "was required",
        "Ensure suspended services are stopped",
        "(%lx): Failed to ensure hive file [%ws] is unloaded",
        ".?AV?$SerializableArrayListPrimitiveBase@K@_@UnBCL@@",
        "system32\\config",
        "M0d0k0r0y0",
        "{2FD73702-E883-4A51-B7ED-4B43F2F1C7D9}",
        "long __stdcall SPWriteMigrationScope(const unsigned short *,const unsigned short *,enum SetupPlatform::SP_MIG_SCOPE)",
        "?(?/?5?:?E?Q?e?",
        ".PAVCXXXXXTemp@?BBA@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "5%5.5?5^5y5",
        ".PAVCXXXXXTemp@?EG@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "9\"9)979E9K9_9h9o9",
        "CApplyDrivers::DoExecute: Failed to delete directory %s. Error: 0x%08X",
        "9%9,92979B9L9_9r9",
        "9t$ t`",
        "2 2$2(20282<2D2H2L2P2T2\\2`2d2h2p2t2|2",
        "?&?>?H?Y?q?{?",
        "void __thiscall UnBCL::ArrayList<class OC::CCmdLineExecutionTelemetryData *>::RemoveAt(int)",
        "%hs: Failed to detect bitlocker status for [%s], assume off. Error: 0x%08X",
        "?&?K?U?m?t?z?",
        "JET_errInvalidBookmark",
        "\\AMD64",
        "<$<)<4<?<S<q<~<",
        "OC::CCmdLineManager::RunCmdLine: Process failed. GLE = %d",
        ">!>)>0><>N>c>r>|>",
        "xIsLowDiskUpgrade",
        "CSetupPlatformPrivate::Execute: Failed to add setup progress provider in Pre-SysPrep",
        ".?AV?$DefaultInstanceFactory@VCTurnOffReserve@@@UnBCL@@",
        "%hs: Cannot retrieve volume name for the WinRE path.",
        "Cannot find %s key, uninstall is not active",
        ">+>]>d>",
        "2\"2(2<2E2S2[2p2w2}2",
        ";%;Y;s;",
        "@0X0c0q0",
        "2<2\\2c2i2n2y2",
        "9)9Q9t9",
        "    Failed to get next payload path",
        "ERROR_TOO_MANY_SIDS",
        ".?AV?$DictionaryEntry@W4SYNCEXEC_PHASE@SetupPlatform@@PAV?$DictionaryEntry@PAVCGlobalPath@@PAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        ".PAVException@UnBCL@@",
        "y)ShQ",
        "ERROR_NOT_SUPPORTED",
        ";+;<;I;Z;n;{;",
        "Splash windows does not exist; creating one",
        ".?AV?$SerializableBase@VCCFGValidator@@$0A@V?$DefaultInstanceFactory@VCCFGValidator@@@UnBCL@@@UnBCL@@",
        "ERROR_INVALID_MSGBOX_STYLE",
        "const struct DiskRange &__thiscall UnBCL::ArrayList<struct DiskRange>::get_Item(int) const",
        "??0SerializationStream@UnBCL@@QAE@PAVStream@1@W4Mode@01@PAVObject@1@@Z",
        "SL_E_ISSUANCE_LICENSE_NOT_INSTALLED",
        "7\"7W7]7f7q7",
        "SlowMode",
        "element",
        "3$32383>3C3M3W3a3k3y3",
        "ERROR_BAD_ENVIRONMENT",
        "Interruption requested - Delete SPP snapshots.",
        "90979>9N9Z9b9h9m9",
        "6*6J6\\6d6j6w6",
        "<$<<<G<U<c<q<",
        "1*1F1P1Z1`1m1",
        "XEnterpriseAttribution",
        "CDeploymentBase::StreamRead",
        "OPERATIONTRACK: Add phase: %d|%s",
        "yHVh]",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVCCopyInfo@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "737@7M7Y7a7|7",
        "Client requested to replace the running OS, but no SafeOS is available. Cannot continue",
        "VVVWh",
        "1)171>1D1I1T1^1",
        "ERROR_DS_CANT_DEREF_ALIAS",
        "int __thiscall UnBCL::ArrayList<unsigned short *>::BinarySearch(int,int,unsigned short *,struct UnBCL::IComparer<unsigned short *> *)",
        "_DismGetDriversEx",
        "5#5,555>5G5]5",
        "base\\ntsetup\\setupplatform\\lib\\diskconfig\\diskconfigsmapi.cpp",
        "ERROR_DS_MISSING_INFRASTRUCTURE_CONTAINER",
        ";-;c;u;",
        ".?AV?$CAutoRelease@PAUIDUUpdateCollection@DU@@@RAII@@",
        "SPReadXmlFile: Failed to convert ascii to wide chars: 0x%08x",
        ";$;.;?;L;U;\\;f;w;",
        "0-040:0?0J0Q0e0n0",
        "5#535;5B5T5[5a5f5q5{5",
        ":):=:l:",
        ".PAVCXXXXXHandledException@?2??DoExecute@CApplyBCDSettings@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "Failed to copy the ProductType value",
        "2P3 4h4",
        "wcsrchr",
        "?'?7?t?~?",
        "565>5K5m5u5",
        "<\"<+<4<=<F<O<X<a<j<s<|<",
        "=1=7=I=]=j=r=",
        "8'8A8\\8j8",
        "FileMaps",
        "No more keys to enumerate",
        ">%>F>t>",
        "CRYPT_E_STREAM_INSUFFICIENT_DATA",
        "=)=<=Q=a=h=o=z=",
        ">!>*>3><>E>N>W>`>i>r>{>",
        "<3<@<J<R<Y<h<y<",
        "324G4w4",
        "%hs: Failed to serialize operations queue. Error: 0x%08X",
        "?-?\\?n?v?|?",
        "ERROR_SPECIAL_USER",
        "=\"=,=?=Z=d=",
        "<marshall data>",
        "System32\\config",
        "    Failed to open element",
        "N+@:81J",
        "VdsPartition::Format: Couldn't get disk object (0x%08x)",
        "void __thiscall UnBCL::Array<struct SetupPlatform::IPartition *>::InitLarva(class UnBCL::ArrayList<struct SetupPlatform::IPartition *> *)",
        "D$$Pht",
        "|$HSQ",
        "?!?=?g?m?x?",
        "CNewSystem::~CNewSystem",
        "9b9~9",
        ">\">@>X>",
        "D$4Phs",
        "2p5x5}5",
        "SPGetReserveManager: Get NULL for Reserve Manager ",
        "4\"4(454G4U4",
        "L$$_^[3",
        "%hs: Failed to re-initialize rollback",
        "=1=>=J=V=e=",
        "A0F0K0W0",
        "%s will be disabled",
        "=B=p=",
        "818a8",
        ".?AV?$ArrayListEnumerator@UDiskRange@@@_@UnBCL@@",
        ".?AVCXXXXXHandledException@?BC@??QueueDriverInstallation@CNewSystem@@UAEJPBGW4SP_ERROR_HANDLING@SetupPlatform@@@Z@",
        "No WIMBoot partition information was found. Assuming partition is intact.",
        "4$414:4B4H4M4\\4i4w4",
        "=#=.=<=P=",
        "                                   Processor caption : %s",
        "CSaveBootEntriesOldOS::DoExecute",
        "  Skipping on metered networks",
        "SetFileAttributesW",
        "co-FR",
        "class COperation *const &__thiscall UnBCL::ArrayList<class COperation *>::get_Item(int) const",
        "iswdigit",
        "class CRegCreationData *const *__thiscall UnBCL::ArrayList<class CRegCreationData *>::GetBuffer(int) const",
        ">a>t>",
        "CSetupAutomation::GetDriveLetter: Failed to iterate over host machine disks: 0x%08x",
        "Cannot set ObjectName for %s, error: 0x%08X",
        "SFList (finalize):",
        "3$3(3@3D3\\3`3x3|3",
        "ERROR_DS_CODE_INCONSISTENCY",
        "%hs: Failed to remove old WinRE folder %s. Error: 0x%08X",
        "?.?9?I?i?p?v?{?",
        "CSetupAutomation::GetImageIndex",
        "class COperationQueue *__stdcall UnBCL::Try_Cast<classCOperationQueue*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CDeploymentBase::CMountedPathInfo *>::Reset(void)",
        "3!353T3",
        "3)3@3F3Q3_3",
        "t$(Wh8k",
        "2&292B2O2_2j2",
        "4/595T5o5|5",
        "?)?/?A?R?_?m?",
        "%hs: Error while setting uninstall active value: 0x%08X",
        "{DC41856C-7810-44FE-86AC-15BAE96902E3}",
        "?*?=?I?[?y?",
        "CreateFile() failed",
        "CDeploymentProject::Initialize: Failed to set image info. Error: 0x%08X",
        "class CCopyInfo *const &__thiscall UnBCL::ArrayList<class CCopyInfo *>::get_Item(int) const",
        "CAddSetupClRequest::DoExecute: Cannot load software hive for offline OS %s. Error: 0x%08X",
        "7,737",
        "int __thiscall UnBCL::_::ArrayListEnumerator<__int64>::MoveNext(void)",
        "?$?H?d?",
        "CSetupAutomation::CacheInstallTarget: Couldn't find firmware boot disk: 0x%08x",
        "Source is VHD Boot OS",
        "5A5d5",
        "171R1c1",
        "708H8~8",
        ":0:8:@:P:`:",
        "DisableDeviceDelete",
        "7!7E7]7i7q7}7",
        "internal",
        "    %s => %s",
        "%hs: Preparing the recovery image",
        "SL_E_DEPENDENT_PROPERTY_NOT_SET",
        "5#5*50555@5G5[5j5",
        "BfsvcSyspartRepair",
        "5 5-5W5c5j5",
        "60777=7B7M7Z7p7}7",
        "PQj@Z",
        "ERROR_SERVICE_REQUEST_TIMEOUT",
        "QRPh@",
        "ERROR_DS_SOURCE_DOMAIN_IN_FOREST",
        "Failed to add %s [%s] to Scoping. Error: 0x%08X",
        ">(?5?M?",
        "class UnBCL::ArrayList<class CRegCreationData *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class CRegCreationData *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "<'</<C<P<]<m<r<~<",
        "0(00080@0L0l0t0|0",
        "{4B5343EC-7D74-4DF6-BAD7-3C37B8E77DE1}",
        "Policy is to verify no encrypted non-OS volumes, deployment cannot continue",
        "%hs: Suspending protection on drive %c:",
        "?get_CString@StringBuilder@UnBCL@@QBEPBGXZ",
        "CDeploymentProject::CreateBootableMediaDeployment: Failed to assign old drive letter [%c] to target volume (0x%08x)",
        "030A0Y0}0",
        "2+2?2L2",
        "DiskLayout::VerifyPlanTypesValidForStyle: Type for partition %u is invalid for the disk's partition style",
        "DumpType: %d, FilterPages: %d",
        "SPCopyFilesAndFolders: Failed to access network share %s using credentials for %s\\%s; Error: 0x%08X",
        "Failure while injecting entropy into the offline OS. Error: 0x%08X",
        "void __thiscall OC::COCDismAdapter::InitOffline(class UnBCL::String *)",
        "191R2",
        "CBS_E_MANIFEST_VALIDATION_MISSING_REQUIRED_ATTRIBUTES",
        "NtOpenProcessTokenEx",
        "SyspartIsSpace failed for %s",
        ".PAVCXXXXXTemp@?3??RegisterRollbackOnlineUsr@CSetupPlatformRollback@@UAEJPBG0@Z@",
        "D$4WP",
        "MIG_PROCESS_ORPHAN_PROFILES",
        "9/9;9G9R9^9",
        "D$$;D$ v",
        "Failed to get driver info from driver package %s. Error: 0x%08X",
        "7(757<7C7N7X7k7s7",
        "SetupPlatform.exe /rollback",
        "D$|PQ",
        ".PAVCXXXXXTemp@?M@??SPGetOSInformation@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@0PAPAV34@PAV?$ArrayList@PAVCOSPieceInfo@@@4@PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@PAV?$ArrayList@PAVCProfileInfo@@@4@@Z@",
        "?&?9?R?t?",
        "Migration.VerbosePatterns",
        "4,4W4s4",
        ".?AV?$CAutoCleanupBase@PAUISetupAutomation@SetupPlatform@@@RAII@@",
        "GetLengthSid",
        "=#=)=.=9=D=X=l=s=y=~=",
        "6%636=6G6Y6b6k6u6~6",
        "3<3D3L3T3\\3h3",
        "\\Locations\\LogicalVolumes",
        "ERROR_DS_INSTALL_NO_SCH_VERSION_IN_INIFILE",
        "141=1Q1Y1`1f1k1v1",
        "Error copying %s to %s. Last Error = %#x",
        "Failed to process installation of driver package %s. Error: 0x%08X",
        ".?AV?$DefaultInstanceFactory@VCExtractFilesFromWDSImage@@@UnBCL@@",
        "<.<3<`<",
        "SysprepSession::CreateXPathForSelection",
        "3<3D3L3T3\\3d3l3t3|3",
        "ERROR_CLUSTER_RESNAME_NOT_FOUND",
        "1)1:1G1O1g1m1",
        "0%020<0K0T0Z0g0m0r0",
        "7)717:7?7E7X7|7",
        "3+3N3z3",
        "303>3a3v3~3",
        "CAddDriver::DoExecute: Failed to inject %s driver package. Error 0x%08X",
        "=8=M=`=h=n={=",
        "1,161F1O1W1o1w1",
        "7$7Q7e7o7",
        "6\"6*606=6O6a6l6z6",
        "DUDownloadRetry",
        "Query trace failed: 0x%x",
        "ERROR_DISK_RESET_FAILED",
        "2D2Y2l2",
        "ERROR_DS_ALIAS_DEREF_PROBLEM",
        "Failed adding Permanent package: %ws",
        "Removing %s",
        "Unable to enumerate disks",
        "Found non-rollback boot entry %s",
        "ConnectThread",
        "ERROR_DS_INVALID_SEARCH_FLAG",
        "system",
        "90tXj",
        "Failed to set debugger type. Status = 0x%X",
        "> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>",
        ";';0;9;C;U;\\;c;",
        "Enabling debugging...",
        "upVhXV",
        "SPQueryReserveInfoInternal: Failed to query Resrve Area [%d]. hr = 0x%08X",
        "Installation.%u",
        "=0=8=?=E=J=U=e=y=",
        "r7jZYf;",
        "ERROR_INVALID_UNWIND_TARGET",
        "?6?B?N?Z?q?}?",
        "ObjectName",
        ":\":0:[:k:r:x:}:",
        "Failed to enable feature %s in the OS: %s.",
        "Failed progress callback",
        "int __thiscall UnBCL::Hashtable<class CWIMBootHelper::CWIMEntryIndex *,class UnBCL::DictionaryEntry<void *,void *> *>::ContainsKey(class CWIMBootHelper::CWIMEntryIndex *) const",
        "f;D$ u",
        "sSmPlatformDiskEnumerator::GetNext",
        "??0exception@@QAE@ABV0@@Z",
        "4-4U4c4l4u4~4",
        "QPSWQQV",
        "Failed to build WimMount file path, 0x%x",
        "0 0$0<0@0X0h0l0p0t0x0|0",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *> *)",
        "Processing installed devices...",
        "3,303@3D3T3X3h3l3|3",
        "ERROR_INVALID_LIST_FORMAT",
        "2&282@2F2S2e2s2",
        "ERROR_DS_SRC_AND_DST_OBJECT_CLASS_MISMATCH",
        "Injecting driver package into the new OS: %s",
        "PWVhI",
        ".?AU?$IDictionary@PAVString@UnBCL@@W4ActionType@@@UnBCL@@",
        "6$60676G6S6_6o6{6",
        ";=;D;c;",
        "%ws%ws",
        "ERROR_EVT_MALFORMED_XML_TEXT",
        ".PAVCXXXXXHandledException@?5??ExecuteFailForward@CSetupPlatformPrivate@@IAEJHPAU_PROGRESS_DATA@SetupPlatform@@@Z@",
        "3$343D3T3d3h3x3|3",
        ".?AV?$CAutoCleanupBase@PAUIMigUserIterator@@@Mig@@",
        ".?AU?$ICollection@PAUIVdsVDisk@@@UnBCL@@",
        "t (symbolic link)",
        "3%3;3B3H3M3X3d3l3",
        "  File path: %s",
        "base\\ntsetup\\lib\\rollback\\src\\volumetracking.cpp",
        "Compressed",
        "470bd53a-c36a-448f-b620-91feede01946",
        "SPOpenProvisioningPackage: Failed to open %s: 0x%08x",
        "int __thiscall UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::IndexOf(class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *,int,int) const",
        "class UnBCL::Object *__thiscall Mig::CKeywordTree::AddKeyword(class UnBCL::String *,class UnBCL::Object *)",
        "ERROR_INVALID_SECURITY_DESCR",
        "pDUSearch: DUSearch result code indicates abort. Operation result code = %d",
        "?\"?2?F?b?",
        "MIG_SCOPE",
        "Failed to find updates in the DU directory",
        "=:=G=h=u=",
        "void __thiscall SysprepSession::RemoveOfflineStateFromRegistry(class UnBCL::String *)",
        "jmZf9T0",
        "434I4^4}4",
        "GetModuleFileNameW",
        "JET_errDbTimeTooNew",
        "SKIPBOOTTRACK(FIRST): Skip Boot Validator: Offline sysprep is not complete, online actions are needed. Cannot continue with First boot removal.",
        ".?AV?$SerializableBase@VCUpgradeSecurity@@$0A@V?$DefaultInstanceFactory@VCUpgradeSecurity@@@UnBCL@@@UnBCL@@",
        "7@7P7k7r7x7}7",
        "7]8M9e9",
        "void __thiscall UnBCL::Array<class UnBCL::DictionaryEntry<__int64,class UnBCL::String *> *>::RemoveAt(int)",
        "QueueAddDriver called with driver package %s",
        "CMediaLayout::Initialize: Failed to query install image: 0x%08x",
        "9{|t#9|$",
        "Packages",
        "int __thiscall UnBCL::ArrayList<class CWIMBootData *>::IndexOf(class CWIMBootData *,int,int) const",
        "int __thiscall UnBCL::ArrayList<struct _GUID>::LastIndexOf(struct _GUID,int,int) const",
        "2-2H2R2\\2b2p2",
        "{556F32DC-D5CF-4DAF-ABC6-6E92221DF38E}",
        "LastCrashDumpInfo: OriginalDumpType %u",
        "enum OP_EXECUTION_PHASE *__thiscall UnBCL::ArrayList<enum OP_EXECUTION_PHASE>::GetBuffer(int)",
        ".?AV?$SmartPtr@U?$IEnumerator@PAV?$DictionaryEntry@KPAVString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "ERROR_DS_SEC_DESC_TOO_SHORT",
        "JET_errReadVerifyFailure",
        "8-848;8A8M8_8m8{8",
        "=M=`=f=",
        "void __thiscall UnBCL::ArrayList<class OSRollbackService::CCheckpoint *>::RemoveAt(int)",
        "?T?[?a?f?q?{?",
        "CSetupPlatformCheckpoint::CopyLogFiles: An error occurred while processing the log folder",
        "%SystemRoot%\\security\\logs\\sceupgrade.log",
        "ERROR_BEYOND_VDL",
        "VerifyVersionInfoW",
        "ERROR_INSTALL_SERVICE_SAFEBOOT",
        "int __thiscall OC::CCmdLineManager::RunCmdLine(class UnBCL::String *,int,int *,unsigned long *)",
        "bootaa64.efi",
        "7%787^7z7",
        ">8?N?",
        "\\\\.\\BitLocker\\%s",
        "5<5D5L5T5\\5d5l5t5|5",
        ">X>|>",
        "QueueProductKey called for fail-forward system %s",
        "Starting Slow mode reset.",
        ":*:8:",
        ".?AUIMigHardLinkPolicy@@",
        "CManifestCategory::AppendLongLong",
        "CDeploymentProject::CreateVHDDeployment: Failed to create log directory [%s]. Error: 0x%08X",
        ".PAVCXXXXXTemp@?BG@??SPGetExistentImageInfo@@YGJPBGPAW4IMAGE_TYPE@SetupPlatform@@PAPAG2222@Z@",
        "insufficient space available in target array",
        "Service %s is now running",
        "99x(t",
        "?\"?3?<?I?R?Y?c?t?}?",
        ".?AVexception@@",
        "CMediaLayout::Execute: Failed to save %s: 0x%08x",
        "?9?c?t?{?",
        "<<NULL>>",
        "5 595O5Z5j5t5",
        "626N6s6x6",
        ">#>(>3>>>D>X>k>r>x>}>",
        "2*2@2}2",
        "%hs: Cannot create the hardlink store. Error: 0x%08X",
        "ERROR_CONTROLLING_IEPORT",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@PAVString@UnBCL@@J@UnBCL@@@UnBCL@@",
        "0Q0a0",
        ".?AVCXXXXXHandledException@?KJ@??pSPDoMainGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@0HHPAV?$ArrayList@PAVString@UnBCL@@@4@0000HHPAVCSPTelemetryData@@PAUISPMigProgress@@@Z@",
        "CSetupPlatformTracing::Initialize",
        "<(<8<F<\\<",
        "3)3:3F3R3^3j3",
        ":%:4:<:C:Q:_:g:q:y:",
        ".?AVCOperationResult@@",
        "OC::COCCbsAdapter::CbsUpdateToOC: Failed to get state for update %s. hr = 0x%x",
        "NtSetCachedSigningLevel2",
        "Failed to reinstall .NET Framework",
        ">*>;>C>Q>Y>w>~>",
        ".?AV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@H@UnBCL@@@UnBCL@@",
        "(%lx): Failed to process registry",
        "(%lx): Unable to open handle to [%ws].",
        ".?AV?$SmartPtr@VCOCCollection@OC@@@UnBCL@@",
        "Begin OOBE boot",
        "{CBE641C0-F687-4083-A220-436743999F5E}",
        "SsShim.dll",
        "LogVdsStatus: Failed to query the status of VDS: 0x%08x",
        ".?AV?$CAutoCleanupBase@PAVRegistryPath@@@RAII@@",
        "class ISPPluginData *&__thiscall UnBCL::ArrayList<class ISPPluginData *>::get_Item(int)",
        "WorkDir",
        "The trust provider does not support the form specified for the subject.",
        ">!>->9>E>Q>]>i>u>",
        "Failed to open handle to Memtest object. Status = [%x]",
        "y/VhV",
        "5%555<5B5G5R5]5b5v5",
        ".?AVCXXXXXHandledException@?BF@??DoExecute@CRemoveFODPackage@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "CDeploymentProject::CreateFolderDeployment: Unsupported processor architecture %d of the image",
        "%hs: Cannot find [%s], no migrated services to validate",
        "; <p<",
        "4,474B4Z4}4",
        "Successfully applied data-only settings overrides.",
        "base\\ntsetup\\setupplatform\\lib\\private\\execution.cpp",
        "ERROR_RESOURCE_DISABLED",
        "??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "ERROR_DATABASE_BACKUP_CORRUPT",
        "enabled",
        "haw-US",
        "3:3H3Q3Z3p3",
        "LargestExistingPartitionSize",
        "class COperation *const *__thiscall UnBCL::ArrayList<class COperation *>::GetBuffer(int) const",
        "SetPropW",
        "2!2/2",
        "0$0,040<0D0L0T0`0h0",
        "Failed listing packages. hr: 0x%x",
        ".?AVCXXXXXHandledException@?LL@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "\\REGISTRY\\MACHINE\\SYSTEM\\SETUP\\SETUPCL",
        "5D5e5r5}5",
        "FfuCaptureImage",
        "void __thiscall SysprepSession::SetOfflineStateInRegistry(class UnBCL::String *,unsigned long)",
        "7,757=7I7Q7]7e7p7",
        "8!898?8Q8b8k8",
        ".?AV?$CAutoCleanup@PAG@Mig@@",
        "<A<X<d<",
        "QQQQQ",
        ":M;V;_;h;q;z;",
        "SKIPBOOTTRACK(FIRST): Failed to set setup completion status. Error = 0x%08X",
        "1#1'1+1/13171;1?1C1G1K1O1S1W1[1_1c1g1k1o1s1w1{1",
        "1-1^1|1",
        ".?AVCNewOperationsInternalProgress@?1??ExecuteOperations@COperationQueue@@QAEJW4OP_EXECUTION_PHASE@@PAUIExecutionContext@@PAXPAUIOperationsProgress@SetupPlatform@@IIHPAH4@Z@",
        "0!0*030<0E0^0}0",
        "Snapshot policy allow creating snapshot",
        "%hs: Cannot get OS information for online OS.",
        "5+5P5b5j5p5}5",
        "void __thiscall UnBCL::ArrayList<struct UnBCL::ISerializable *>::Resize(int,int)",
        "void __thiscall UnBCL::ArrayList<enum OP_OPERATION_ID>::Insert(int,enum OP_OPERATION_ID)",
        "t    Failed to setup output",
        "?$?,?4?<?D?L?X?x?",
        ".?AVCXXXXXHandledException@?PK@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "?!?'?4?F?T?l?q?",
        "= =&=,=2=8=>=D=J=P=V=\\=b=h=n=t=z=",
        "xOWWh",
        "?3?E?M?S?g?m?v?",
        ".Servicing.KnownDeviceClasses",
        "class UnBCL::SmartPtr<class UnBCL::ArrayList<class UnBCL::String *> > __thiscall OC::CCmdLineManager::GetCmdLinesFromRegistryKey(class UnBCL::RegistryKey *)",
        "4$4*4/4:4E4K4P4j4",
        "l.exe",
        ">(?/?<?C?Q?",
        "%SystemRoot%\\Panther\\FirstBoot-km.etl",
        "ERROR_NOACCESS",
        "2.262=2M2Z2b2i2|2",
        "4'4-424C4N4\\4",
        ";P;r;};",
        "int __thiscall UnBCL::ArrayList<class CBcdSetting *>::BinarySearch(int,int,class CBcdSetting *,struct UnBCL::IComparer<class CBcdSetting *> *)",
        "CMigrateFramework::DoExecute: New system's SystemRoot: %s",
        "=2=7=D=Z=b=t=",
        "2*2<2J2W2i2q2w2",
        "9+9E9L9R9W9b9q9y9",
        "SVh`p",
        "5(5:5B5H5U5g5u5",
        "0)0N0V0`0x0",
        "3\"3/3;3G3^3k3x3",
        "2=2h2t2",
        "D2J5A",
        ">!>)>2>F>N>a>j>|>",
        "CRYPT_E_BAD_LEN",
        ">9>{>",
        "IDR_SETUP10_FONT",
        ".?AU?$IList@PAVCOperationsValidator@@@UnBCL@@",
        "Gather statistics:",
        "?&?1?E?X?p?",
        "CDeploymentProject::CreateBootableMediaDeployment: Target disk is bigger than 32 GB; will cap partition size to 32 GB for FAT32 support",
        "9!959>9c9z9",
        "1<1D1L1T1\\1d1l1t1|1",
        ".?AV?$DefaultInstanceFactory@VCUntagSourcesFolder@@@UnBCL@@",
        "717F7N7T7a7p7",
        "3L4w4|4",
        "2#2(232=2P2X2j2s2y2",
        "4*464B4O4_4g4n4t4y4",
        "HiveTime",
        "8H9a9f9",
        ".corrupt",
        "L$LPW",
        "sr-BA-Latn",
        "jYjWj",
        "7!747B7I7O7T7_7j7~7",
        "VdsPartition::SetActive",
        ")SECURITY",
        "464L4w4",
        "080@0M0^0i0w0",
        "DiskLayoutMakeSystem: Failed to get system partition volume properties (0x%08x)",
        "7%7F7S7t7",
        "SclRetrieveSid",
        ">#>.><>h>r>",
        "8G8L8T8^8k8",
        ".PAVCXXXXXTemp@?OE@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "ERROR_INVALID_OPERATION_ON_QUORUM",
        ":2:L:Y:c:u:",
        ".?AVSmImageDisk@@",
        "   [%d]: %s",
        "1'131G1O1_1n1",
        ";(;:;D;T;];q;v;",
        "ExecuteRollbackSequence: Checkpoint(%s) rollback in progress.",
        ".?AVCXXXXXHandledException@?DJ@??SPDoEndInstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAV?$ArrayList@PAVString@UnBCL@@@4@000PAPAUISPTelemetryData@@PAUISPMigProgress@@@Z@",
        ".?AU?$IEnumerable@PAV?$DictionaryEntry@W4OP_EXECUTION_PHASE@@PAV?$ArrayList@PAVCOperation@@@UnBCL@@@UnBCL@@@UnBCL@@",
        ">0?Z?h?v?",
        ".?AV?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@K@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@K@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "{E7BD2E86-8E4E-4BA5-85C7-AF57E61EAD46}",
        "5%5,52575B5M5R5f5o5",
        "%hs: Backing up the recovery partition to %s",
        "\\Windows\\",
        "ERROR_POPUP_ALREADY_ACTIVE",
        ".PAVCXXXXXTemp@?3??pReadPageFileSettingsAndWriteToConfigFile@@YGJPAVString@UnBCL@@0@Z@",
        "84888P8T8l8p8",
        "6 6@6H6P6X6h6p6",
        "6#616?6|6",
        ":.;=;j;",
        ".w.t,",
        "VERBOSEICB: ICB estimated size is: %I64u",
        "SPApplyDeviceLayoutDiskConfig: Aborting at disk initialization due to cancellation (0x%08X)",
        "9 :::H:d:x:}:",
        ";4;P;l;",
        ">(>0>>>L>b>",
        "Failed to retrieve payload from element. Label: %s, destination: %s, error: 0x%08X (translated to 0x%08X)",
        "9(9=9P9X9^9k9}9",
        "8%8;8Q8g8}8",
        ">J?|?",
        ".?AV?$HTDictEnumBase@V?$DictionaryEntry@W4OP_OPERATION_ID@@H@UnBCL@@@_@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,int> *>::RemoveAt(int)",
        "CSetupPlatformCheckpoint::CopyLogFiles: An error occurred while processing the minidump folder",
        "6;6_6q6y6",
        ".?AV?$DefaultInstanceFactory@VCUpgradeSecurity@@@UnBCL@@",
        "%hs: FOD package path cannot be NULL",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "5\"5-5[5c5",
        "%hs: Failed to save the new OS GUID",
        "?#?G?k?}?",
        "PROFILEIMAGEPATH",
        "u|QV3",
        "1E1M1[1e1",
        "pGetImageInfoFromSoftwareHive",
        "VdsPlatformDiskEnumerator::ConstructImageDisk: Couldn't initialize disk (0x%08x)",
        "OC::CCmdLineManager::RunCmdLine",
        "SPFindFirmwareBootDisk: Couldn't enumerate system disks (0x%08x)",
        "<K<d<k<r<x<",
        "class CCFGSectionRegistry *__stdcall UnBCL::Try_Cast<classCCFGSectionRegistry*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "595X5_5w5~5",
        "%hs: Failed to properly configure WinSetupBoot. Error: 0x%08X",
        "(%lx): Unable to get disk layout.",
        "SL_E_PKEY_INVALID_KEYCHANGE4",
        "6)646B6b6}6",
        "ERROR_IPSEC_IKE_DROP_NO_RESPONSE",
        "unsigned short *__thiscall UnBCL::_::ArrayListEnumerator<unsigned short *>::get_Current(void) const",
        "j:Yf;",
        "=7=x=",
        "{AFDDC76E-CC98-41AB-AC6F-209030ACA9FD}",
        "=(=0=8=@=H=P=`=h=",
        "Attempting to stop the telemetry",
        "{bf1a281b-ad7b-4476-ac95-f47682990ce7}",
        "8$8(8@8D8\\8`8x8|8",
        "1$1(1,10141H1X1\\1t1",
        ">G>p>",
        "Number of registry keys processed",
        "4H5\\5p5",
        "SEH: Exit CExceptionHandler::~CExceptionHandler",
        "Cannot get the volume name from recovery folder %s. Error: 0x%08X",
        "negative size to ArrayList#Resize()",
        "yEVjp",
        "class UnBCL::ArrayList<class UnBCL::String *> *__thiscall CNewSystem::BuildPathsToCleanup(class Mig::CBasicEnv *,enum CLEANUP_ITEM_TYPE,class UnBCL::ArrayList<class UnBCL::String *> *)",
        "9#9*90959@9K9_9v9",
        "9#9)9[9a9g9m9s9y9",
        ".?AU?$IEnumerable@PAVCCopyInfo@@@UnBCL@@",
        "=$=)=3===G=Q=_=e=k=p=z=",
        ".?AVCOCCbsAdapter@OC@@",
        ">%>`>",
        "1=1G1e1k1s1{1",
        "FindVolume: Unable to find volume marked as [%s]",
        "= ='=-=9=E=y=",
        "SclRegSetValue_UStr",
        "SysprepOnlinePlugins",
        ">,>H>P>|>",
        "506W6",
        "?%?B?m?",
        "1,101@1D1T1X1h1l1|1",
        "??0?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@PAV?$ArrayList@PAVString@UnBCL@@@1@@Z",
        ";J;t;",
        "T$HQQ",
        "FindGlobalPath: Cannot get disk info for disk %d. Error: 0x%08X",
        "Migration scope value %d",
        ">@.6Y",
        "040h0",
        "WinReSetupRemoveWinRE",
        "6\"6-686L6c6y6",
        "ERROR_DS_NO_REF_DOMAIN",
        "deleteKey",
        "2$2,242<2D2L2T2`2",
        "Sources\\XMLs",
        ".?AVCRegisterRecoveryImage@@",
        ".?AU?$ICollection@W4OP_OPERATION_ID@@@UnBCL@@",
        ".?AV?$SmartPtr@U?$IDictionaryEnumerator@GH@UnBCL@@@UnBCL@@",
        ";+;E;`;",
        "858Y8k8s8y8",
        "int __thiscall UnBCL::ArrayList<enum OP_OPERATION_ID>::LastIndexOf(enum OP_OPERATION_ID,int,int) const",
        "void __thiscall UnBCL::ArrayList<class CFailForwardSystem *>::Insert(int,class CFailForwardSystem *)",
        ".PAVCXXXXXTemp@?3??DoExecute@CMountWIM@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "DeleteService",
        "%hs: Failed to convert New OS entry GUID to string",
        ">)><>K>[>h>s>",
        "8*8L8S8Y8^8j8u8}8",
        "VERBOSE: Result (RLBK) : %s",
        "wimserv.exe %s",
        ":):<:",
        "8.8n8",
        "7>7I7W7e7s7",
        "Failed to adjust kernel mode log file name: 0x%x",
        "f;3t\\",
        "SL_E_VALIDITY_TIME_EXPIRED",
        "u%h|'",
        "DISKSPACETRACK: Needed total   : %I64d",
        ".PAVCXXXXXHandledException@?DJ@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        ".PAVCXXXXXTemp@?3??DoExecute@CValidateSafeOS@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "__thiscall OSRollbackService::CCheckpoint::CCheckpoint(const unsigned short *)",
        "CDeploymentProject::CreateFFUDeployment: Failed to delete the VHD [%s]. Error: 0x%08X",
        ";!;&;:;C;T;[;a;f;q;|;",
        "3$3,343@3`3p3",
        "SPApplyAnswerFileSettings: The architecture of the target image is unknown",
        "CRYPT_E_ASN1_UTF8",
        "ObjectLength",
        "</=9=@=E=V=r=",
        "OOBE boot apply from ICB is not using replacement manifests",
        "7 787<7T7d7t7x7|7",
        "int __thiscall UnBCL::_::HTEnumerator<unsigned short,int,struct UnBCL::Hashtable<unsigned short,int>::TableKey,int,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable<unsigned short,int>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<unsigned short,int>::TableKey,int,struct UnBCL::Hashtable<unsigned short,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "3#353T3}3",
        "ERROR_WMI_DP_FAILED",
        "UblIsUSBDiskInternal: SetupDiGetClassDevs failed! Error = 0x%X.",
        ".?AU?$ICollection@UDiskRange@@@UnBCL@@",
        "1J1t1",
        "SPAPI_E_INVALID_MACHINENAME",
        "pCopyFilesInSection: Failure while generating the list of files and folders to copy. Error: 0x%08X",
        ";!;';-;3;9;?;E;K;Q;W;];c;",
        "4 5x5",
        "=#=.=<=h=r=",
        "LeaveCriticalSection",
        "??1?$ICollection@G@UnBCL@@UAE@XZ",
        "909M9V9_9f9l9q9|9",
        "6.676D6L6\\6c6q6~6",
        "DriverProvider",
        "%hs: Failed to convert downlevel OS current GUID. Error: 0x%08X",
        ";&;2;:;D;Y;`;f;k;s;~;",
        ".PAVCXXXXXTemp@?3??DoExecute@CStartSystemServices@@UAEJPAUIExecutionContext@@PAXPAUIInternalOperationsProgress@@@Z@",
        "282X2x2",
        "void __thiscall UnBCL::_::ArrayListEnumerator<struct `long __stdcall SPGetPartitionOrdinal(struct SetupPlatform::IPartition *,unsigned long *)'::`2'::PartitionInfo>::Reset(void)",
        "  Parameter 2  : 0x%I64X",
        "9%969K9b9y9",
        "<\"=0=7=%>,>m>t>",
        ")`yJb",
        "ERROR_FAILED_SERVICE_CONTROLLER_CONNECT",
        "First boot apply%s from ICB",
        "3,4B4m4",
        "PrepareVolumeAccessPath: Found existing access path NOT assigned by AccessPaths: '%c:\\' for volume '%s'",
        "2g2}2",
        "3*32393J3Q3]3d3r3",
        "3/3\\3d3n3v3",
        "6L6m6",
        "6#656C6Z6p6",
        "SmPlatform::ComputeHostInfo: Failed to query MSFT_PartitionToVolume (0x%08x)",
        ";O;U;[;a;g;m;",
        "MIG_FILE_COMPARE",
        "CDeploymentProject::CreateFFUDeployment: Failed to get WIM image info. Error: 0x%08X",
        ".?AVCXXXXXHandledException@?CA@??BuildInfoList@CARPValidator@@IAE?AW4MIGSTATUS@@PAVString@UnBCL@@0PAV?$ArrayList@PAVCAppInfo@@@5@PAV?$ArrayList@PAVCShellFolderInfo@@@5@@Z@",
        "3*31373<3G3T3Z3_3s3{3",
        "575]5o5w5}5",
        "ERROR_DS_DRA_REF_NOT_FOUND",
        "pGetUninstallInterfaceCommon: Failed loading the setupplatform, hr = 0x%x",
        "ERROR_DS_DUP_LINK_ID",
        "ExecuteProgress: Elapsed events:%d of %d, Percent: %d",
        "SSSSS",
        "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9",
        "9 9'9j9|9",
        ">>>L>U>k>",
        ">,>4><>D>L>T>\\>d>l>t>|>",
        ">&><>S>i>",
        "0\"0-0=0G0Y0a0g0q0{0",
        "PrepareVolumeAccessPath: Found existing access path assigned by AccessPaths: '%c:\\' for volume '%s'",
        "8#898U8l8",
        "6/686>6P6a6n6y6",
        "4#4(434@4T4}4",
        "VdsImageDisk::InitializeProperties: Unknown VDisk device type: %d",
        "4 525:5@5M5_5r5~5",
        "GlobalPathStr",
        "?Read@FileStream@UnBCL@@UAEHPAEHH@Z",
        "DiskLayout::VerifyLayoutSingleExtended",
        "SL_E_PKEY_INVALID_CONFIG",
        ".?AU?$IEnumerable@PAVCFileCreationData@@@UnBCL@@",
        "CMediaLayout::QueueProvisioningPackages: Failed to queue provisioning package %u (%s): 0x%08x",
        "?&?1?B?I?P?[?f?k?",
        "VWhlC",
        "0'090G0Y0|0",
        "t#G;{",
        "ms-BN",
        "000^0x0",
        "Can't iterate over disk partitions",
        "Failed to set RecoveryDestination timestamp",
        "ar-IQ",
        "ERROR_RESMON_ONLINE_FAILED",
        "\\Registry\\Machine\\System\\CurrentControlSet\\BootConfigurationData",
        "515D5X5h5",
        "CUpdateBootCode::DoExecute: Get NULL for soure OS Windows Directory. Cannot execute repair",
        "<\"=1=s=z=",
        "2!2*2:2E2N2\\2i2n2w2~2",
        "{ADDE7F8F-17B2-4928-BBC3-ADA17C08347F}",
        "ERROR_IPSEC_SA_LIFETIME_EXPIRED",
        "t[WWW",
        ".?AV?$DefaultInstanceFactory@VCCreateScopedSnapshot@@@UnBCL@@",
        "=)=1=7=K=Y=`=l=s=",
        ">1>D>s>",
        "Windows\\Panther",
        ">$>*>6><>F>R>_>g>q>y>~>",
        "8\"9q:",
        "Failed enumerating packages",
        ".PAVCXXXXXHandledException@?OK@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "8p9H: ;",
        "?get_Item@XmlNodeList@UnBCL@@QAEPAVXmlNode@2@H@Z",
        "SystemStartOptions",
        "int __thiscall UnBCL::Array<class CGlobalPathFindData *>::Add(class CGlobalPathFindData *)",
        "ERROR_DISK_QUOTA_EXCEEDED",
        "ERROR_IPSEC_IKE_INVALID_HEADER",
        "VdsPartition::CreateLogicalPartition: Can't enumerate logical partitions (0x%08x)",
        "VERSION.dll",
        "575p7",
        "SPFindFirmwareBootDisk: Couldn't iterate over system disks (0x%08x)",
        "Failed enumerating keys",
        "1 1(141G1X1d1p1|1",
        "8\"8-8;8D8O8W8a8h8n8s8~8",
        "='=6===D=K=T=Z=d=i=o=|=",
        "=2=z=",
        "8(888H8w8}8",
        ":$:+:2:9:@:F:P:r:",
        "j}XWPh",
        "DiskLayoutPrepare: Failed to initialize target disk (0x%08x)",
        "Number of registry security descriptors updated",
        "4)4/484@4O4V4\\4a4l4s4",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCWIMBootData@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCWIMBootData@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "ERROR_SUBST_TO_SUBST",
        "VdsPartition::Resize: Couldn't extend volume (0x%08x)",
        "RPC_S_PROTOCOL_ERROR",
        "IsOsPreRS1",
        "6,606@6D6T6X6h6l6|6",
        "neutral",
        "t_;T$",
        "</<G<b<|<",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCFailForwardSystem@@@UnBCL@@@UnBCL@@",
        ".?AU?$IDictionary@KPAUIVdsDisk@@@UnBCL@@",
        "SysprepSession::ExecuteAction: Failed during addKey operation; dwRet = 0x%x",
        "9(9,9D9H9`9d9|9",
        "Alive",
        "UninstallScenario",
        "=?=i=",
        ":?:F:K:P:",
        "??6SerializationStream@UnBCL@@QAEAAV01@V?$SmartPtr@UISerializable@UnBCL@@@1@@Z",
        "VVVWS",
        "9x(uH",
        "2'2<2D2J2W2i2|2",
        "Current uninstall reason : %s",
        "SPDetachDiskImage: Can't open disk image: 0x%08x",
        "4 4+464J4h4",
        "CSetupPlatformPrivate::Rollback: Failed to initialize Setup Platform diagnostics. Error: 0x%08X",
        ">!>&>1>8>",
        "<+<7<C<O<[<g<s<",
        "CDiskReader::GetOsInfoBinaryArchitecture",
        "CDiskReader::GetBlockAllocationBitmap",
        "VdsPartition::TakeOffline: Couldn't get volume object for partition (0x%08x)",
        "PPPjdPW",
        "CApplyEAs::DoExecute",
        ".?AVRegistryKey@UnBCL@@",
        "9,939=9N9[9e9t9}9",
        "CFfuWriterAsyncT<class CSecurityHeaderWriterT<class CEmptyType>,class CImageHeaderWriterT<class CEmptyType>,class CStoreHeaderWriterT<class CEmptyType>,class CPayloadWriterT<class CEmptyType> >::Done",
        "SPCopyFilesAndFolders: Failed while copying folder %s -> %s. hr = 0x%x",
        "JET_errBackupInProgress",
        "JET_errOSSnapshotInvalidSnapId",
        "VWQQP3",
        "LangIDIsRightToLeft:GetLocaleInfo() returned failure, GLE=0x%x",
        ";)<p<",
        "6*6<6S6Z6l6",
        "4)444H4k4",
        ".?AV?$SerializableArrayListBase@PAVCCopyInfo@@@_@UnBCL@@",
        ".?AVCSuspendBitlocker@@",
        "?GetDirectories@Directory@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBVString@2@0H@Z",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCOperationInfo@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "CGenericExecutionContext: %s environment variable detected, verbose logging is enabled.",
        "void __thiscall UnBCL::ArrayList<void *>::Insert(int,void *)",
        "enum MIGSTATUS __stdcall pSPDoMainGather(class UnBCL::String *,enum SetupPlatform::SP_MIG_SCOPE,class UnBCL::String *,int,int,class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,int,int,class CSPTelemetryData *,struct ISPMigProgress *)",
        "CBS_E_DUPLICATE_UPDATENAME",
        "%hs: Cannot get the system information. Error: 0x%08X",
        "3 3*343",
        "Dump source WIM info for %s, index %d",
        "int __thiscall UnBCL::ArrayList<class COperationInfo *>::LastIndexOf(class COperationInfo *,int,int) const",
        "%hs: WindowsOld.wim is not available",
        "int __thiscall UnBCL::Array<class CBcdSetting *>::Add(class CBcdSetting *)",
        ".?AUIOperationsProgress@SetupPlatform@@",
        "9+979J9U9b9r9w9",
        "1#121<1A1I1P1\\1n1",
        "5 5(585\\5d5l5t5|5",
        "Service is AUTO_START, will start it after all processing is done",
        "6)696B6Q6l6v6",
        "4 444Q4X4`4g4m4r4}4",
        "8 868K8l8",
        "1!1+141>1G1Q1Z1d1m1w1",
        "Bugcheck code",
        "enum MIGSTATUS __stdcall SPDoUninstallGather(class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::String *,class UnBCL::String *,struct ISPMigProgress *)",
        ">*?T?s?",
        ".PAVCXXXXXTemp@?DK@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "ERROR_EVT_FILTER_PARSEERR",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned short,unsigned short> *>::Resize(int,int)",
        "GetLongPathNameW",
        "CCreateRegistryData deserialization failed",
        ".?AU?$IEnumerator@V?$DictionaryEntry@PAVCWIMEntryIndex@CWIMBootHelper@@PAV?$DictionaryEntry@PAXPAX@UnBCL@@@UnBCL@@@UnBCL@@",
        "(%lx): Failed to enumerate reparse points on volume [%ws]",
        ".?AV?$CAutoCleanupBase@PAU_VDS_DISK_EXTENT@@@RAII@@",
        "LdrFindResource_U",
        "GuidCache",
        "The restored system has incomplete profile %s for user %s. This profile will have to be removed manually",
        "jejkj",
        "0%0,0:0L0]0d0z0",
        ":$:1:C:\\:{:",
        "9%9C9R9a9j9s9|9",
        "6N6Y6g6u6",
        "Recovery\\ReAgentOld.xml",
        "JET_errMissingPreviousLogFile",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVSysprepComponent@@@UnBCL@@@UnBCL@@",
        "=:>O>u>",
        "0 0'0.090D0X0a0h0q0x0",
        "SPCopyFilesAndFolders: Failed to get file attributes on source path %s. hr = 0x%08X",
        "CSetupAutomation::SetImageIndex: Failed to determine install image info: 0x%08x",
        "SysprepSession::ExecuteInternal: Ran offline-capable action of %s offline; skipping it online",
        "CSetupAutomation::CacheInstallImage",
        "KillTimer",
        "EstimateProgressForChunkedExport",
        ".PAVCXXXXXTemp@?CL@??SPValidateTrackedContent@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@000PAH1PAPAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@4@2@Z@",
        "ShH@a",
        "<F<N<[<v<",
        "='=,=B=L=U=^=o=",
        "?0?D?e?r?",
        "Applying extra filtering to %ws because it is an MBS driver",
        "j.Xf;",
        "=8>E>]>",
        "Failed to delete watson parameter overrides. Hr=[0x%X]",
        "3%474?4E4R4d4",
        "IsOffline",
        ".?AV?$DictionaryEntry@W4SP_MIG_PHASE@SetupPlatform@@PAVString@UnBCL@@@UnBCL@@",
        "Fail install",
        "185K6U687=7r7|7",
        "class UnBCL::ArrayList<class CWIMBootData *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class CWIMBootData *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "SKIPBOOTTRACK(FIRST): Failed to get First boot removal OneSetting, 0x%x",
        "ERROR_INVALID_SID",
        "CDATA",
        "ERROR_SXS_INVALID_DEACTIVATION",
        "9&9<9D9M9U9b9j9w9",
        "ERROR_MEMBER_IN_GROUP",
        ":;;n;",
        "yASVh",
        "0 0&0+030D0Y0f0v0",
        "?$?H?\\?d?l?t?|?",
        "SPGetVolumeStableGuidStringFromVolumeName: Failed to query volume stable guid. Error: 0x%08X",
        "94:{:",
        "919N9U9\\9c9j9q9w9",
        "3-4C4V4k4",
        "GetNextFile",
        "= >I>Y>}>",
        ">'>4>J>X>a>j>s>",
        ":$:,:4:<:D:L:T:\\:d:l:|:",
        "ERROR_LOG_GROWTH_FAILED",
        "414G4n4",
        "7#717V7h7p7v7",
        "m_ulSize == 0",
        "DelayLoadHandler: Failed to look up the delay load handler for procedure %s from library %s.",
        "%SystemRoot%\\Panther\\FirstBoot-um.etl",
        ".?AUISetupPlatformOnline@SetupPlatform@@",
        "Failed initiating PBR session",
        ">,>E>L>S>Y>e>y>",
        "8A9R9Y9_9d9o9}9",
        "22393?3D3O3Z3_3s3",
        "CallPidGenX: Load Library call on %s failed",
        ".?AVCWIMBootHelper@@",
        "20282?2M2d2k2r2}2",
        "SVh 1",
        "Creating store.",
        "%hs: Successfully saved BCD[%s].",
        "CDeploymentProject::Release",
        "WimImageSetInformationFile",
        "3&303=3F3N3V3~3",
        "6#6)626:6A6T6j6",
        "%SystemDrive%\\$WINDOWS.~BT",
        "int __thiscall UnBCL::Array<class CDriverDetails *>::Add(class CDriverDetails *)",
        ";L;h;",
        ".?AU?$IEnumerable@PAUIVdsVDisk@@@UnBCL@@",
        "ERROR_SXS_XML_E_EXPECTINGTAGEND",
        "u7h(B",
        ".PAVCXXXXXTemp@?LG@??SPDoUninstallApply@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@PAV?$ArrayList@PAVString@UnBCL@@@4@00PAUISPMigProgress@@@Z@",
        "ERROR_TIMER_NOT_CANCELED",
        "Unable to GetVolumeNameForVolumeMountPoint %ws (%u).",
        "VdsDisk::CreatePartition: Couldn't refresh VDS service (0x%08x)",
        "Global\\Microsoft.Windows.Setup.Rollback",
        "7(7:7M7Y7k7",
        "8 8(808@8L8T8|8",
        "Failed to copy Boot Manager to default EFI application. Last error = %#x",
        "222>2E2K2P2[2i2o2",
        "void __thiscall UnBCL::Array<class CFailForwardSystem *>::RemoveAt(int)",
        "L$PhP",
        "?\"?/?;?H?U?b?n?{?",
        "VolumeKeyPath",
        "?#?*?0?5?@?K?[?d?m?r?",
        "< <4<H<V<m<",
        "SL_E_BASE_SKU_NOT_AVAILABLE",
        "2-2F2f2",
        ".?AV?$SmartPtr@VXmlAttributeCollection@UnBCL@@@UnBCL@@",
        "5'5?5^5t5",
        "<$<(<,<0<8<<<@<D<H<L<T<X<\\<d<l<t<x<",
        ".PAVCXXXXXHandledException@?FH@??SPDoOfflineGather@@YG?AW4MIGSTATUS@@PAVString@UnBCL@@W4SP_MIG_SCOPE@SetupPlatform@@00PAUISPMigProgress@@@Z@",
        "100701213655Z",
        "RollbackOnline",
        ".?AV?$KeyCollection@GH@_@UnBCL@@",
        ".?AU?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAVCSPInternalPluginData@@@UnBCL@@@UnBCL@@",
        "class COperationsValidator *const *__thiscall UnBCL::ArrayList<class COperationsValidator *>::GetBuffer(int) const",
        "ERROR_SXS_IDENTITY_DUPLICATE_ATTRIBUTE",
        "RPC_S_INVALID_NETWORK_OPTIONS",
        "Mount Version",
        "Failed to query process information for size. Status: %x",
        "=&=7=>=X=",
        "SERIALIZEVERBOSE: After restoring mount path is: %s",
        "3#4F4w4",
        "0#0)090P0`0l0s0",
        "OpenFilterPort",
        "PhH@a",
        "Failed to create device database, error 0x%08X.",
        "RollbackInitialize in progress...",
        ">&>1>=>D>J>O>Z>a>r>",
        "5$545E5Q5]5i5u5",
        "SingleHiveUnloader::ProcessValue",
        "=#=7=G=W=g=|=",
        "< <(<,<0<4<8<<<D<H<P<X<`<d<h<p<t<x<|<",
        "858?8j8v8",
        "t$$)D$X",
        ".PAVCXXXXXHandledException@?2??SPHexEncode@@YGPAVString@UnBCL@@QAEK@Z@",
        "JET_errLogSectorSizeMismatchDatabasesConsistent",
        "7\"747;7A7F7Q7\\7r7",
        "1-1;1U1g1y1",
        "Failed to create temp dir",
        "SclGetVolumeHandle",
        "{181644F6-E6F1-451D-9772-447533EBE249}",
        ".PAVCXXXXXHandledException@?GF@??ExecuteFailForward@CSetupPlatformPrivate@@IAEJHPAU_PROGRESS_DATA@SetupPlatform@@@Z@",
        "SPScheduleSnapshotCleanupTask: Failed to prepare [%s]. Error: 0x%08X",
        "DiskLayout::ExecInitialize: Failed to install partition table: 0x%08x",
        "7,707@7D7T7X7h7l7|7",
        "SkipBootSafeOS",
        "SL_E_CIDIID_INVALID_CHECK_DIGITS",
        "_scwprintf",
        "0!0W0",
        "?RegisterType@SerializationStream@UnBCL@@SGXPBVString@2@HPAUHINSTANCE__@@PAUIInstanceFactory@2@@Z",
        ".?AV?$SerializableBase@V?$ArrayList@PAVCImageInfo@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVCImageInfo@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "0123456789ABCDEFGHIJKLMNOPQRSTUV",
        "void __stdcall pAddOSPiece(class UnBCL::ArrayList<class COSPieceInfo *> *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,int)",
        "SVWQ3",
        "9$919C9S9n9s9",
        ".?AU?$IEnumerator@PAVCBcdSetting@@@UnBCL@@",
        "727?7\\7g7",
        "0&0G0O0q0x0~0",
        "8(898F8W8l8",
        "0\"0)0o0|0",
        "323F3L3]3t3",
        ";2;9;?;D;O;Y;m;u;|;",
        "%c:\\%s",
        ";$;,;2;?;Q;r;",
        "    WU Class Name: %s",
        "5,5C5P5]5l5~5",
        "BfspPrintFileOwnerProcess: NtOpenProcess failed!Status = %#x",
        "RollbackEndTime",
        "1%1*1>1\\1r1y1",
        ".PAVCXXXXXTemp@?3??MakeBcdDeviceObject@CAddSafeOSBootEntry@@IAEJKPBG0PAU_GUID@@PAPAU_BCDE_DEVICE@@PAK@Z@",
        "7 7(7,70787<7@7H7L7P7X7\\7`7h7l7p7x7|7",
        "9&9,9L9R9[9c9r9y9",
        "5(5,5D5H5`5d5|5",
        "CNGenCleanup::FindNGenExceptionsInFolder",
        "api-ms-win-eventing-provider-l1-1-0.dll",
        "Architecture",
        "050L0o0",
        "pLogBugcheckDriver",
        "?&?D?S?\\?e?{?",
        "CMigrateFramework::DoExecute: Cannot load security hive for source offline OS %s. Error: 0x%08X",
        "3(3.3@3L3^3f3l3~3",
        "%hs: Invalid package type for SafeOS",
        "2F2S2e2m2s2",
        "ControlTraceW",
        "int __thiscall UnBCL::Array<class CGlobalPath *>::Add(class CGlobalPath *)",
        "ZwEnumerateKey",
        "ERROR_ADAP_HDW_ERR",
        "<'<-<7<<<F<M<[<m<~<",
        ";,;z;",
        "t3Qj{jT3",
        "void __thiscall UnBCL::ArrayList<class COperationsValidator *>::Resize(int,int)",
        "2&282O2]2w2",
        "ERROR_SPECIAL_ACCOUNT",
        "1-141:1?1J1T1g1",
        "11161F1V1_1h1t1z1",
        "3,33383I3y3",
        "FrameworkFull",
        "3-3]3d3j3o3{3",
        "323?3b3",
        "CSetupPlatform::CreateDiskImage: Can't create disk image '%s': 0x%08x",
        "ERROR_IPSEC_IKE_RPC_DELETE",
        "ERROR_DS_CLASS_MUST_BE_CONCRETE",
        "class CFailForwardSystem *const *__thiscall UnBCL::ArrayList<class CFailForwardSystem *>::GetBuffer(int) const",
        "=!=3=A=O=]=",
        "0*030?0H0T0]0i0r0~0",
        "CSetupRecoveryPartition::DoExecute",
        ";!;(;<;V;];c;h;s;y;",
        "?,?3?9?>?J?W?]?q?",
        "PPIPro",
        "FilterFindClose",
        "JET_errOutOfDatabaseSpace",
        "ERROR_SOME_NOT_MAPPED",
        "1$1J1V1[1`1",
        "8 8&888L8Y8a8z8",
        "JET_errInvalidInstance",
        "5$5/595@5F5K5V5b5v5",
        "Deployment",
        "ERROR_FLOATED_SECTION",
        "WdsFreeData",
        "CryptCATCDFEnumMembersByCDFTagEx",
        ":<:H:O:",
        "CSetupAutomation::CacheInstallTarget: Failed to iterate over disks: 0x%08x",
        "7A8V8|8",
        "5#565=5L5V5i5|5",
        "Rollback.BAK",
        "?$?,?1?E?U?e?m?w?}?",
        "t.Wh`",
        "SVh8%",
        "LocalPayload\\Feature",
        "CBS_E_INVALID_PARAMETER",
        "CReconstructOS::RestoreInstallationLanguageSettings",
        "Moving WIMBoot info file from %s to %s",
        "WimBoot apply failed because the wim file has to be local!",
        "CSetupPlatform::Initialize: %s environment variable detected, verbose logging is enabled.",
        "The byte content registry [%s] changed from [%s] to [%s]",
        "9\"9B9O9Y9m9y9",
        "SPAllocateRange",
        ":$:,:4:<:D:P:X:p:x:",
        "616=6J6V6^6d6m6u6|6",
        "SmImageDisk::InitializeProperties: Failed to get image backing %s (0x%08x)",
        "u#j~h",
        "PageFileConfigurationOldOs",
        "3s3z3",
        "PQQjB",
        "Either AlwaysRestartDiagTrack was specified, or ForceUpload failed with error code=0x%x, restarting the diagtrack service to upload the etl",
        "RemovedDriverProviderName",
        "FSCTL_SD_GLOBAL_CHANGE succeeded",
        ".?AV?$HTDictEnumBase@PAV?$Hashtable@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@@_@UnBCL@@",
        "SPDeleteAllSnapshots: Find [%s] in exclusion list, skip it",
        "SPCalculateDriveMappings: Did not read SystemRoot from SOFTWARE hive, will not create implicit mapping",
        "dbgeng.dll",
        "6$6,646<6D6L6T6\\6d6l6t6|6",
        ">.?@?G?M?R?]?c?v?",
        "8+8A8W8m8}8",
        "OS.NEW.Pieces",
        "G,PSWh",
        "%hs: Failed to read the migration scope from %s. hr = 0x%08X",
        "SPCopyFilesAndFolders: Failed to copy folder %s to %s. Error: 0x%08X",
        "4&4:4H4V4d4",
        "                                   Legacy filter driver Name: %s, Altitude: %s, Detached: %s",
        "7(808=8L8d8k8q8|8",
        "Prepare safe OS",
        "2*202C2Z2i2y2",
        ".?AV?$SmartPtr@V?$ArrayList@PAVCOSPieceInfo@@@UnBCL@@@UnBCL@@",
        ";);5;i;",
        "sOrgPath",
        "PPPPP",
        "1+181A1K1R1\\1m1z1",
        "Bugcheck code : 0x%08X",
        ".?AV?$CAutoCleanupBase@PAUINewSystem@SetupPlatform@@@RAII@@",
        "3#3r3",
        "?%?9?M?Y?e?q?}?",
        "4*464H4f4r4",
        "7)767?7L7e7n7}7",
        "<!<-<6<B<J<]<i<{<",
        "ERROR_INVALID_NAME",
        "JET_errColumnNotUpdatable",
        "< <(<,<4<8<@<D<L<P<X<\\<d<h<p<t<|<",
        ":%:+:5:W:i:w:",
        "System partition: %s",
        "\\??\\%s",
        "9):0:6:;:F:Q:V:j:",
        "VdsPlatformDiskEnumerator::GetNext: Failed to get next VDisk (0x%08x)",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *>::CopyTo(class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,unsigned __int64> *> *,int) const",
        "0,040D0X0l0t0|0",
        "void __thiscall UnBCL::ArrayList<struct UnBCL::ISerializable *>::CopyTo(class UnBCL::Array<struct UnBCL::ISerializable *> *,int) const",
        "64696S6g6v6",
        "1 1-1?1I1\\1d1j1w1",
        "class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *&__thiscall UnBCL::ArrayList<class Mig::CAutoRelease<struct DU::IDUUpdateCollection *> *>::get_Item(int)",
        "VWh@R",
        "6$6E6d6k6q6v6",
        "void __thiscall UnBCL::Array<class COperationsValidator *>::Insert(int,class COperationsValidator *)",
        "9*949G9[9f9o9~9",
        "?3?N?T?^?c?m?t?",
        "The size of registry [%s] changed from [%d] to [%d]",
        "24282P2T2l2p2",
        "SYSTEM\\CurrentControlSet\\Control\\ProductOptions",
        ":4;t;",
        ".?AV?$DictionaryEntry@_JPAVString@UnBCL@@@UnBCL@@",
        "setupapi.ev1",
        "4I4[4f4",
        "CSetupAutomation::Resurrect",
        "SPFindFirmwareBootDisk: Couldn't get disk properties for disk %d (0x%08x)",
        "serviceName",
        "<)<A<\\<c<u<",
        ">$><>a>t>{>",
        "RtlAdjustPrivilege",
        "3 3(3,30343<3@3D3H3L3P3T3X3\\3d3h3l3p3x3|3",
        "Failed to write progress type in file: %s. Error: 0x%08X",
        ">$>W>k>",
        "DiskLayout::VerifyLayoutModifiedOrder: This layout requires partition %u to appear after %u;",
        "=+=K=P=t=",
        "=C=P=X=_=e=j=r=y=",
        "Failed to add INF to StrTabDriverStoreInfs string table, Err = 0x%lx",
        "L$d;O",
        "%hs: Cannot get the size of the recovery partition.",
        "=+=0=D=",
        "CMediaLayout::Execute: Failed to execute media optimization: 0x%08x",
        "StrTabEnumDriverStoreInfForRemovalCallback returned Err = 0x%lx",
        ":):3:H:_:f:l:q:|:",
        "es-UY",
        "%hs: Error while setting the %s value. Error: 0x%08X",
        "1+141A1I1R1Z1a1g1m1x1",
        "Initial list of source symbolic mappings:",
        "OSRollbackService::CCheckpoint::MoveOrCopyDirectory: MoveFile(from \"%s\" to \"%s\") succeeded.",
        "?GetHashCode@Version@UnBCL@@UBEHXZ",
        ":G;g;w;",
        ".?AVCXXXXXHandledException@?2??SetUpCbsLogging@CReconstructOS@@IAEJPBGPAH@Z@",
        "CFfuWriterAsyncT<class CSecurityHeaderWriterT<class CEmptyType>,class CImageHeaderWriterT<class CEmptyType>,class CCompressedStoreHeaderWriterT<class CEmptyType>,class CCompressedPayloadWriterT<class CEmptyType> >::PreWrite",
        ".?AV?$ArrayListEnumerator@PAUISerializable@UnBCL@@@_@UnBCL@@",
        "292@2F2K2V2a2u2}2",
        "Current result string    : %s",
        ".?AV?$CAutoRelease@PAVIUpdateReserveManager@@@RAII@@",
        "void __thiscall UnBCL::Array<unsigned int>::InitLarva(class UnBCL::ArrayList<unsigned int> *)",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::LastIndexOf(class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *,int,int) const",
        "Too many delimiters in string id.",
        "Display name: %s",
        "5=5j5q5",
        "RPC_X_BYTE_COUNT_TOO_SMALL",
        "?/?;?M?k?w?",
        "<\"<(<-<8<G<W<_<e<y<",
        ">\">)>/>4>?>J>S>Z>_>s>|>",
        "(null)",
        ".?AU?$ICollection@PAVCUserProfile@@@UnBCL@@",
        "L$$Qh",
        "software provider",
        "Failed to save UploadBasedOnEnvVar to file: %s. Error = %d",
        "7 727C7J7X7p7w7~7",
        "StateStoreRemoveMountedImage",
        ".PAVCXXXXXTemp@?CFD@??pSPExecuteApply@@YG?AW4MIGSTATUS@@W4SP_MIG_SCOPE@SetupPlatform@@PAVString@UnBCL@@HHHPAV?$ArrayList@PAVString@UnBCL@@@6@11PAV?$ArrayList@PAV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@6@1HH111111PAV?$ArrayList@PAVCWIMBootData@@@6@1PAHPAVCSPTelemetryData@@PAUISPMigProgress@@PAJ@Z@",
        "8#80888D8K8Q8V8b8",
        "Enabled",
        "3&323F3l3t3",
        "8#878R8X8g8",
        "CMediaLayout::QueueInstallImage: Failed to query image information: 0x%08x",
        "9;:M:U:[:h:z:",
        "6$6,666>6E6X6b6p6w6}6",
        "9 9.979@9L9X9d9m9",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CDeviceIdDatabase::CDeviceInfoData *>::MoveNext(void)",
        "Error deleting stale spaces dll (%s)! Last Error = %#x",
        ":):1:7:D:V:t:",
        "VdsVolume::Format: Couldn't get file system info to format volume (0x%08x)",
        ".?AV?$ArrayList@PAVCCheckpoint@OSRollbackService@@@UnBCL@@",
        "System\\CurrentControlSet\\Control\\CrashControl\\LastCrashdump",
        "ApplySecondBootOnlinePluginList",
        "1'11181>1C1N1\\1p1",
        "Failed to add driver update",
        "Failed to get proc address for WdsSetupLogMessageA.",
        "%hs: Exception while reading drivers section to file %s",
        "QueueAddCbsPackage called with package target: %d type: %d, [%d] paths",
        "xDl-Merge.etl",
        "_wtol",
        ";!<=<I<e<m<",
        "9!9/9b9h9t9",
        "SPAPI_E_NO_SUCH_DEVINST",
        "Microsoft Windows0",
        ">\">v>",
        "CreateTransaction",
        "void __thiscall UnBCL::ArrayList<class ISPPluginData *>::RemoveAt(int)",
        "VERBOSE: Successfully moved (1) %s to %s",
        "class UnBCL::String *__stdcall SPGetDevicePathFromVolumeName(class UnBCL::String *)",
        ".?AU?$IEnumerable@PAVCAntiVirusInfo@@@UnBCL@@",
        ";1;@;p;w;",
        "282J2R2X2e2w2",
        ".?AV?$CAutoRelease@PAVWmiObject@WMI@@@RAII@@",
        "000D0Q0]0s0y0",
        "Successfully read Force Task Delete Snapshot from Onesetting: %s",
        "RPC_S_INVALID_ENDPOINT_FORMAT",
        ";A;^;",
        "Sj<VW",
        "4;4`4p4w4",
        ".?AV?$DefaultInstanceFactory@VCUnmountWIM@@@UnBCL@@",
        " Operating System",
        "CDiagnosticsHelper::UploadWatsonData",
        "1$1,141<1D1P1X1t1",
        "QSVWh(",
        "ERROR_INVALID_GROUPNAME",
        "SPReportSnapshotState: Used space      : %I64d",
        "...\\inf\\setupapi.dev.log",
        "class COperationResult *const &__thiscall UnBCL::ArrayList<class COperationResult *>::get_Item(int) const",
        "void __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::MultiSz *> *>::RemoveAt(int)",
        "6&6-6C6^6d6n6s6}6",
        "0-0>0Y0c0m0s0",
        "system32\\license.rtf",
        "t$(h`Y",
        "9#959H9Z9b9h9u9",
        "<#<)<6<C<K<Q<^<k<r<~<",
        "%hs: %s. GLE [%d]",
        "CUpdateBootCode::DoExecute: An error occurred while servicing the boot files from [%s]. Error: 0x%08X",
        "1.1U1\\1b1g1r1}1",
        ":5:]:",
        "131[1i1x1",
        ".?AV?$Hashtable@KPAUIVdsDisk@@@UnBCL@@",
        "? ?(?,?0?4?8?<?D?L?P?X?\\?d?h?p?t?x?",
        "RecursiveRemoveDirectory",
        "VWh8+",
        "=(=T=i=",
        "8,9\\9",
        "?<?_?l?x?",
        "7 70747D7H7X7\\7l7p7",
        "=T=Y=`=z=g>z>2?7?A?l?",
        "VdsDiskPartitionEnumerator::Initialize",
        "int __stdcall SPMoveFileWithShortName(class UnBCL::String *,class UnBCL::String *,class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::String *> *,int,int,int)",
        "= =<=X=t=",
        "VdsPlatformDiskEnumerator::ConstructImageDisk",
        "ERROR_IPSEC_DEFAULT_MM_POLICY_NOT_FOUND",
        "base\\ntsetup\\setupplatform\\lib\\src\\miscoperations.cpp",
        "Failed allocating new windows root path.",
        "\\\\.\\pipe\\broadcast",
        " 0K0P0",
        ";L$8|",
        ";$;);4;F;N;T;h;",
        "7+777C7O7X7d7p7|7",
        ";+;3;K;a;",
        ";);F;\\;",
        "CSysprepRespecialize::DoExecute: Failed to initialize COM. Error: 0x%08X",
        "CUpdateBootCode::DoExecute: Retry set OS Switch Rollback checkpoint",
        "CSIDL_STARTMENU",
        "7#7-7E7K7i7",
        "int __thiscall UnBCL::ArrayList<void *>::LastIndexOf(void *,int,int) const",
        "Cannot get the volume name from sources folder %s. Error: 0x%08X",
        ".?AV?$Hashtable@KPAUIVdsVDisk@@@UnBCL@@",
        "8)8T8a8s8",
        "= =%=0=A=U=a=m=y=",
        "sSPFixupRelocatedFolders",
        "~$_^[",
        "6=6H6}6",
        "MIG_REPL_MANIFESTS_DIR",
        "1\"1-141H1",
        ":2:A:",
        "2!3Y3t3",
        "2 242Y2a2f2k2",
        ";%;3;E;W;^;l;{;",
        ".?AU?$IEnumerator@PAUIVdsDisk@@@UnBCL@@",
        "SPWriteXmlFile: Failed to write %s: 0x%08x",
        "7\"7-727F7^7~7",
        "void __thiscall UnBCL::Array<struct SetupPlatform::IDisk *>::RemoveAt(int)",
        "=!=&=1=F=N=T=h=",
        "Error setting WinRE Restore checkpoint",
        "y&SVhh",
        "Getting WMI Uint64 property %s: unexpected VARIANT type %d",
        "INDEX",
        "ERROR_IPSEC_IKE_INVALID_ENCRYPT_ALG",
        ".?AU?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAVCDriverInstallInfo@@@UnBCL@@@UnBCL@@",
        "ERROR_NODE_CANNOT_BE_CLUSTERED",
        "ProfessionalEducation",
        ".?AV?$DefaultInstanceFactory@VCGatherData@@@UnBCL@@",
        "=@>e>",
        "3)363B3L3l3",
        "%hs: Removing framework migration storage",
        "7'7-7:7L7l7y7",
        "343L3T3\\3d3t3|3",
        "818;8D8N8e8v8",
        "=+=7=C=L=U=o=}=",
        "Updates required for link; Old SubstName = [%s], Old PrintName = [%s]",
        "ERROR_CTX_CLIENT_QUERY_TIMEOUT",
        ".?AVCXXXXXHandledException@?8??SPUninitializeNetwork@@YGXH@Z@",
        "rDisableSnapshotPolicy",
        "6$646D6T6X6h6l6|6",
        "CDiskReader::IsVolumeSnapshotsPresent",
        "9&9G9Z9_9d9p9",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class CAppInfo *>::MoveNext(void)",
        "fZfYfBfQfV",
        "LP Validator: Failed to revert execution of data gather operation. Error: %08X",
        "959<9B9N9Z9",
        "SPCopyFilesAndFolders: Failed to copy file %s -> %s. hr = 0x%x",
        "1 1@1H1T1t1|1",
        "8(838G8\\8p8",
        "VdsDisk::TakeOffline",
        "ERROR_SXS_XML_E_UNEXPECTEDENDTAG",
        ".?AV?$SerializableArrayListBase@PAVCCFGSectionValue@@@_@UnBCL@@",
        ">/?9?V?~?",
        "y4Whl",
        "    Failed to create temporary directory",
        "2,2<2D2L2T2l2|2",
        "95 #d",
        "%hs: Invalid disk space option %d",
        ".?AVReconstructionProgressCallback@@",
        "int __thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *>::BinarySearch(int,int,class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *,struct UnBCL::IComparer<class UnBCL::DictionaryEntry<unsigned long,class UnBCL::String *> *> *)",
        "ERROR_DS_CANT_REM_MISSING_ATT",
        "282@2H2P2X2h2",
        "Provider %s added to setup autologger tracing session",
        "CCompressWIMBootFiles::DoExecute",
        "CAddCbsPackage::DoExecute: Failed to open new OS DISM session. Error: 0x%08X",
        "6%6,6T6[6",
        "2$3@3J3T3Z3g3",
        "mn-Cyrl",
        "-FVE-FS-",
        "GatherPluginErrorList",
        " !\"\"\"#$ &&&%%%%%%%",
        "ERROR_CALL_NOT_IMPLEMENTED",
        "SETUPPLATFORM.DLL",
        "61666K6",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::DictionaryEntry<enum OP_EXECUTION_PHASE,class UnBCL::ArrayList<class COperation *> *> *>::MoveNext(void)",
        "BfsRepair: Failed to load FMIFS.DLL %08x",
        "? ?$?<?@?X?\\?t?x?",
        "int __thiscall UnBCL::ArrayList<class CAppInfo *>::BinarySearch(int,int,class CAppInfo *,struct UnBCL::IComparer<class CAppInfo *> *)",
        ":5;i;",
        "LocalFree",
        "3'3p3",
        "> >$>,>4><>D>H>L>P>X>\\>`>d>h>l>p>t>x>|>",
        "='=8=E=N=W=`=o=w=",
        "7'7<7K7Z7s7z7",
        "CSetupAutomation::Initialize: Error while attempting to parse %s: 0x%08x",
        "%hs: %s does not exist, uninstall cannot continue",
        "SVhPg",
        ".?AV?$SerializableArrayListBase@PAVCGlobalPath@@@_@UnBCL@@",
        ".PAVCXXXXXHandledException@?M@??QueueAddAppxPackage@CNewSystem@@UAEJPBGQAPBGI_KW4SP_ERROR_HANDLING@SetupPlatform@@@Z@",
        "\\??\\UNC\\",
        "8#8.8<8h8r8",
        "CEnableSafeOSPageFile::DoExecute: Page file space only needed to capture kernel crash dumps",
        "<5<Z<}<",
        "32373[3u3",
        "cdefghi",
        ": :$:(:,:0:4:<:@:D:H:L:P:X:p:t:",
        "5(5@5K5Y5g5u5",
        "9+979>9K9b9r9~9",
        "ActionPlatform::LaunchModule: Could not get thread exit code from worker thread; dwRet = 0x%x",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,&protected: static class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> * __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::TableKey,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *>::KeyTraits,class ATL::CElementTraits<class UnBCL::Hashtable<class UnBCL::String *,class CDriverInstallInfo *> *> > const *,struct __POSITION * const &)>::Reset(void)",
        "1*1;1[1b1i1t1",
        "SPFindFreeSpace: Can't enumerate logical partitions (0x%08x)",
        "?FromASCII@String@UnBCL@@SGPAV12@PBD@Z",
        ">0>B>W>t>",
        ">*>J>j>t>",
        "141<1T1\\1d1x1",
        "APPX Validator: Failed to get the list of AppX folders.",
        "PBR: Package is pending for uninstall, original state not installed, skip: %ws",
        "CSetupPlatformOSSwitchCheckpoint::Rollback: MoveFile(from \"%s\" to \"%s\") failed. Error: 0x%08X",
        ">7>>>D>I>T>_>s>|>",
        "PSFX_E_DELTA_NOT_SUPPORTED_FOR_COMPONENT",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVCInfFile@@@UnBCL@@@UnBCL@@",
        "9$9,949<9D9L9T9`9",
        ":4:N:Y:i:s:",
        "8 878X8u8",
        "RestoreDirData",
        "UpdateHardlinks",
        "~>Vh`{",
        "?$?,?4?<?D?L?T?\\?d?l?x?",
        ">6>C>K>\\>x>",
        "t$QWh",
        "<(<0<6<C<U<c<",
        "8F8v8",
        "9 9(90989@9H9P9X9`9p9x9",
        "JET_errRecordNotFound",
        ":#:/:T:e:m:s:y:",
        "3-323I3^3d3q3",
        "4>4W4a4n4t4{4",
        "5&5@5W5z5",
        "8+868D8R8k8",
        "=Q=g=s=",
        "= =-=?=R=^=p=",
        "Failed to export alterations to firmware. Status: %x",
        "CSysprepRespecialize::DoExecute: Failed while running Respecialize phase. Error: 0x%08X",
        "BcdErrorCode",
        "3$3,343<3D3L3T3\\3h3",
        "New checkpoint \"%s\" broke sequence.",
        "CUntagSourcesFolder::DoExecute: Reserve is not available on [%s].",
        "SetupPlatform.pdb",
        "%hs: Path to EXE is NULL",
        ":4:P:l:",
        "CSetupAutomation::SuspendAndRelease: Failed to write to output stream: 0x%08x",
        "7&7,797K7Y7z7",
        "7 7,747L7T7l7t7|7",
        "WimbootCleanup",
        "{273156D2-3A23-47CD-9853-D9EAC39008CE}",
        "5 5,575=5Q5^5j5r5",
        "ERROR_RESOURCE_ONLINE",
        ";%;-;?;G;[;o;|;",
        "IDB_WIN_LOGO3N",
        "5/565<5A5L5V5i5v5}5",
        "kk-KZ",
        ";8;B;H;X;u;",
        ".?AU?$IEnumerator@PAG@UnBCL@@",
        "9/9:9H9O9U9Z9e9p9u9",
        "=<=O=c=",
        "1)2W2r2~2",
        "Marking event [&SclEvent_ProcessVolumes_Start]",
        ".?AV?$SerializableBase@VCRemoveSRCheckpoints@@$0A@V?$DefaultInstanceFactory@VCRemoveSRCheckpoints@@@UnBCL@@@UnBCL@@",
        "Tracing: add user mode provider %s",
        "CApplyWIM: Failed to write EA information to file: %s. Error = %d",
        "Applying WIM file: Failed to set the reference WIM file %s for %s. Error 0x%08X",
        "  User: %s, SFName: %s, SFPath: %s",
        "Onesettings: Failed to get module version: 0x%x",
        ".?AV?$SerializableArrayListPrimitiveBase@I@_@UnBCL@@",
        "%hs: Migration path: %s",
        "Downlevel progress is %u",
        "Setup\\Upgrade",
        ":\":+:<:D:T:",
        "5)525=5",
        "<#<+<1<:<P<f<~<",
        "ERROR_PRIVATE_DIALOG_INDEX",
        "t{j?Yf;",
        "DiskLayout::VerifyLayoutSingleExtended: A disk cannot have multiple extended partitions",
        "%hs: Operation completed",
        "202U2z2",
        "CUninstall::CUninstall: Failed to load offline SYSTEM hive from %s. Error: 0x%08x",
        "4!4?4F4L4Q4\\4k4s4",
        "JET_errCallbackFailed",
        "Encountered a reparse point which is also a hard-link",
        "5,545:5?5S5\\5e5m5t5",
        "CMigrateFramework::DoExecute: Cannot load sam hive for offline OS %s. Error: 0x%08X",
        "8#8D8R8Y8`8k8v8",
        "%s||%s",
        "t%jCY",
        "2(212=2F2M2g2r2|2",
        "1,262C2I2P2Z2g2n2x2",
        "SPGetDiskImage: GetStorageDependencyInformation failed (%u)",
        "=7=H=",
        ":.:A:S:f:{:",
        "<#<5<S<_<q<",
        "M(PVh",
        "ERROR_IPSEC_IKE_PROCESS_ERR_ID",
        "__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::DictionaryEntry<struct SetupPlatform::IOperationsProgress *,unsigned long> *> *)",
        "818A8R8",
        "9E9W9_9e9r9",
        "void __thiscall UnBCL::Array<struct DiskMatchFilter>::InitLarva(class UnBCL::ArrayList<struct DiskMatchFilter> *)",
        "DerivedData",
        "6<6C6J6Q6X6_6e6p6",
        "8C8R8",
        "%hs: Failed to write WinOld path %s to the %s config file. Error: 0x%08X",
        "535R5g5",
        "ERROR_EVENT_PENDING",
        "void __thiscall UnBCL::ArrayList<struct SetupPlatform::IPartition *>::RemoveAt(int)",
        "5$5*5/5:5D5[5b5h5m5x5",
        "9$9,949D9L9T9d9l9t9|9",
        "as-IN",
        "9*9C9L9X9n9",
        "to run",
        "4$404<4H4T4`4l4x4",
        ".?AVCPidgenxExtractor@@",
        "long __stdcall CDeploymentBase::RestoreMounts(const unsigned short *,class UnBCL::ArrayList<class CDeploymentBase::CMountedPathInfo *> **)",
        "ERROR_SXS_XML_E_MISSINGSEMICOLON",
        "d<null>",
        "??_DFileStream@UnBCL@@QAEXXZ",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *&__thiscall UnBCL::ArrayList<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::Array<unsigned char> *> *>::get_Item(int)",
        "90989@9L9T9l9",
        ".?AU?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAUHKEY__@@@UnBCL@@@UnBCL@@",
        "OSRollbackService::CCheckpoint::ExtractCrashDump: Failed to recover crash dump from %s, hr = 0x%X",
        "3-4B4T4\\4b4v4|4",
        ".?AV?$DefaultInstanceFactory@VCStoredString@@@UnBCL@@",
        "7$8F8M8S8X8c8m8",
        "8$8,848<8D8P8p8x8",
        ".rdata$zzzdbg",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1`1x1|1",
        "2!2/2P2k2q2~2",
        ".PAVCXXXXXHandledException@?L@??pSPCopyFile@@YGJPAVString@UnBCL@@0P6GKT_LARGE_INTEGER@@111KKPAX22@Z22HH@Z@",
        "2(252A2X2_2h2q2",
        "Exception trying to enable/disable destination user, will ignore and proceed.",
        "%hs: Failed to set reboot status for the CBS session 9. hr = 0x%08X",
        ".?AV?$SmartPtr@U?$IEnumerator@UPartitionInfo@?1??SPGetPartitionOrdinal@@YGJPAUIPartition@SetupPlatform@@PAK@Z@@UnBCL@@@UnBCL@@",
        "5 50555>5L5S5]5n5w5",
        "pAddSafeOSDrivers: Failed to add driver %s in the OS: %s. Error: 0x%08X",
        "CloseNarrator",
        "Component %s successfully ran offline; skipping it online",
        ";|$`t",
        ".?AV?$SerializableBase@VCRemoveWIMBootEntries@@$0A@V?$DefaultInstanceFactory@VCRemoveWIMBootEntries@@@UnBCL@@@UnBCL@@",
        "657?7J7Q7o7",
        "?Y?_?",
        ";!;-;Y;^;c;o;",
        "7*72787E7W7e7",
        "?!?'?",
        "?0?6?J?]?r?",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class CImageInfo *>::Reset(void)",
        "2(20282@2P2t2|2"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "92e47d86c6aaa245870d8cdc52b75e3ade85325ef26e7516aa0fcfc59485887e",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/92e47d86c6aaa245870d8cdc52b75e3ade85325ef26e7516aa0fcfc59485887e",
              "guest_paths": [
                "overlay"
              ],
              "size": 8520,
              "crc32": "74189BD9",
              "md5": "a806015d494e0ca0437dbddd6eb49821",
              "sha1": "7403c949b22c0fd014bc67771dc0cb115767ebb4",
              "sha256": "92e47d86c6aaa245870d8cdc52b75e3ade85325ef26e7516aa0fcfc59485887e",
              "sha512": "8ec5294a90f984a9f2e56e5c401cf3225fd9b35a9fafbb06e122c1cf2ea81b964e8e2f66bdf2237cfe60c4a4be656367b702e846ab6946519308209018415fec",
              "rh_hash": null,
              "ssdeep": "96:bAMDXvDbzC0cr8OAlpVHKzDmowDD0pBDXiebs/Am2grWXGueDX5JN0BDqh0hDf5O:ar8VHwDDBQABJsN0Q2SkqnajKs9Oek",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T1AC0219D1CB785403DE96B980139CE9837C3D63CB18609176259AF9A91CDB7C3EF085AE",
              "sha3_384": "d9a10d6b85056b44ac69615a448a0d8940c674f36831fb6181fe3263a49594a1718adf834e2dbde85f30b25dae24760c",
              "data": null
            }
          ],
          "extracted_files_time": 0.0005484079993038904,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "Eula.rtf"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/7fbf900fdd0eabe63def6c5b432b5d3ff51f8ec9af7d9e9ab3a9d7441d032c22",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
      ],
      "size": 204389,
      "crc32": "939AD1B2",
      "md5": "cd28b51516a9309b350607dc57faca76",
      "sha1": "c9f8e72f1184dac6ad40a94295a594a94b1e48c4",
      "sha256": "7fbf900fdd0eabe63def6c5b432b5d3ff51f8ec9af7d9e9ab3a9d7441d032c22",
      "sha512": "7c7cb19b814debcdd5a1717f2039492ef9fd018ddf5ff0647cfb13fcff550eb20f44960ce239033e8bef4bffc0d2668e9574f2aff3b4385606ab1aecc1e1de12",
      "rh_hash": null,
      "ssdeep": "1536:sT9Ps8LkRAdnz0g2qnCcuwXiSjwJ7RSnhkcA9Zs5uu3lQL:sVwzgFs",
      "type": "Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T19A14F0784546D7D5C373C349A86EF1CE9C36F00128F934E9A2AEC3BA817FD249E69446",
      "sha3_384": "15e8d7b36cabb8fdf7d8405c0a9efe7685bc8d22e5712efc75e2084b0e0fe57a6672bd8b0e12e6c6dbce5ce08888e4b9",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": "{\\rtf1\\adeflang1025\\ansi\\ansicpg1252\\uc1\\adeff40\\deff0\\stshfdbch11\\stshfloch0\\stshfhich0\\stshfbi0\\deflang1033\\deflangfe1033\\themelang1033\\themelangfe2052\\themelangcs1025{\\fonttbl{\\f0\\fbidi \\froman\\fcharset0\\fprq2{\\*\\panose 02020603050405020304}Times New Roman;}\n{\\f2\\fbidi \\fmodern\\fcharset0\\fprq1{\\*\\panose 02070309020205020404}Courier New;}{\\f3\\fbidi \\froman\\fcharset2\\fprq2{\\*\\panose 05050102010706020507}Symbol;}{\\f10\\fbidi \\fnil\\fcharset2\\fprq2{\\*\\panose 05000000000000000000}Wingdings;}\n{\\f11\\fbidi \\froman\\fcharset128\\fprq1{\\*\\panose 02020609040205080304}MS Mincho{\\*\\falt \\'82\\'6c\\'82\\'72 \\'96\\'be\\'92\\'a9};}{\\f34\\fbidi \\froman\\fcharset1\\fprq2{\\*\\panose 02040503050406030204}Cambria Math;}\n{\\f40\\fbidi \\fswiss\\fcharset0\\fprq2{\\*\\panose 00000000000000000000}Tahoma;}{\\f41\\fbidi \\fswiss\\fcharset0\\fprq2{\\*\\panose 020b0603020202020204}Trebuchet MS;}{\\f43\\fbidi \\froman\\fcharset128\\fprq1{\\*\\panose 02020609040205080304}@MS Mincho;}\n{\\flomajor\\f31500\\fbidi \\froman\\fcharset0\\fprq2{\\*\\panose 02020603050405020304}Times New Roman;}{\\fdbmajor\\f31501\\fbidi \\fnil\\fcharset134\\fprq2{\\*\\panose 02010600030101010101}SimSun{\\*\\falt \\'cb\\'ce\\'cc\\'e5};}\n{\\fhimajor\\f31502\\fbidi \\froman\\fcharset0\\fprq2{\\*\\panose 00000000000000000000}Cambria;}{\\fbimajor\\f31503\\fbidi \\froman\\fcharset0\\fprq2{\\*\\panose 02020603050405020304}Times New Roman;}\n{\\flominor\\f31504\\fbidi \\froman\\fcharset0\\fprq2{\\*\\panose 02020603050405020304}Times New Roman;}{\\fdbminor\\f31505\\fbidi \\fnil\\fcharset134\\fprq2{\\*\\panose 02010600030101010101}SimSun{\\*\\falt \\'cb\\'ce\\'cc\\'e5};}\n{\\fhiminor\\f31506\\fbidi \\fswiss\\fcharset0\\fprq2{\\*\\panose 020f0502020204030204}Calibri;}{\\fbiminor\\f31507\\fbidi \\fswiss\\fcharset0\\fprq2{\\*\\panose 020b0604020202020204}Arial;}{\\f44\\fbidi \\froman\\fcharset238\\fprq2 Times New Roman CE;}\n{\\f45\\fbidi \\froman\\fcharset204\\fprq2 Times New Roman Cyr;}{\\f47\\fbidi \\froman\\fcharset161\\fprq2 Times New Roman Greek;}{\\f48\\fbidi \\froman\\fcharset162\\fprq2 Times New Roman Tur;}{\\f49\\fbidi \\froman\\fcharset177\\fprq2 Times New Roman (Hebrew);}\n{\\f50\\fbidi \\froman\\fcharset178\\fprq2 Times New Roman (Arabic);}{\\f51\\fbidi \\froman\\fcharset186\\fprq2 Times New Roman Baltic;}{\\f52\\fbidi \\froman\\fcharset163\\fprq2 Times New Roman (Vietnamese);}{\\f64\\fbidi \\fmodern\\fcharset238\\fprq1 Courier New CE;}\n{\\f65\\fbidi \\fmodern\\fcharset204\\fprq1 Courier New Cyr;}{\\f67\\fbidi \\fmodern\\fcharset161\\fprq1 Courier New Greek;}{\\f68\\fbidi \\fmodern\\fcharset162\\fprq1 Courier New Tur;}{\\f69\\fbidi \\fmodern\\fcharset177\\fprq1 Courier New (Hebrew);}\n{\\f70\\fbidi \\fmodern\\fcharset178\\fprq1 Courier New (Arabic);}{\\f71\\fbidi \\fmodern\\fcharset186\\fprq1 Courier New Baltic;}{\\f72\\fbidi \\fmodern\\fcharset163\\fprq1 Courier New (Vietnamese);}{\\f444\\fbidi \\fswiss\\fcharset238\\fprq2 Tahoma CE;}\n{\\f445\\fbidi \\fswiss\\fcharset204\\fprq2 Tahoma Cyr;}{\\f447\\fbidi \\fswiss\\fcharset161\\fprq2 Tahoma Greek;}{\\f448\\fbidi \\fswiss\\fcharset162\\fprq2 Tahoma Tur;}{\\f449\\fbidi \\fswiss\\fcharset177\\fprq2 Tahoma (Hebrew);}\n{\\f450\\fbidi \\fswiss\\fcharset178\\fprq2 Tahoma (Arabic);}{\\f451\\fbidi \\fswiss\\fcharset186\\fprq2 Tahoma Baltic;}{\\f452\\fbidi \\fswiss\\fcharset163\\fprq2 Tahoma (Vietnamese);}{\\f453\\fbidi \\fswiss\\fcharset222\\fprq2 Tahoma (Thai);}\n{\\f454\\fbidi \\fswiss\\fcharset238\\fprq2 Trebuchet MS CE;}{\\f455\\fbidi \\fswiss\\fcharset204\\fprq2 Trebuchet MS Cyr;}{\\f457\\fbidi \\fswiss\\fcharset161\\fprq2 Trebuchet MS Greek;}{\\f458\\fbidi \\fswiss\\fcharset162\\fprq2 Trebuchet MS Tur;}\n{\\f461\\fbidi \\fswiss\\fcharset186\\fprq2 Trebuchet MS Baltic;}{\\flomajor\\f31508\\fbidi \\froman\\fcharset238\\fprq2 Times New Roman CE;}{\\flomajor\\f31509\\fbidi \\froman\\fcharset204\\fprq2 Times New Roman Cyr;}\n{\\flomajor\\f31511\\fbidi \\froman\\fcharset161\\fprq2 Times New Roman Greek;}{\\flomajor\\f31512\\fbidi \\froman\\fcharset162\\fprq2 Times New Roman Tur;}{\\flomajor\\f31513\\fbidi \\froman\\fcharset177\\fprq2 Times New Roman (Hebrew);}\n{\\flomajor\\f31514\\fbidi \\froman\\fcharset178\\fprq2 Times New Roman (Arabic);}{\\flomajor\\f31515\\fbidi \\froman\\fcharset186\\fprq2 Times New Roman Baltic;}{\\flomajor\\f31516\\fbidi \\froman\\fcharset163\\fprq2 Times New Roman (Vietnamese);}\n{\\fdbmajor\\f31520\\fbidi \\fnil\\fcharset0\\fprq2 SimSun Western{\\*\\falt \\'cb\\'ce\\'cc\\'e5};}{\\fhimajor\\f31528\\fbidi \\froman\\fcharset238\\fprq2 Cambria CE;}{\\fhimajor\\f31529\\fbidi \\froman\\fcharset204\\fprq2 Cambria Cyr;}\n{\\fhimajor\\f31531\\fbidi \\froman\\fcharset161\\fprq2 Cambria Greek;}{\\fhimajor\\f31532\\fbidi \\froman\\fcharset162\\fprq2 Cambria Tur;}{\\fhimajor\\f31535\\fbidi \\froman\\fcharset186\\fprq2 Cambria Baltic;}\n{\\fhimajor\\f31536\\fbidi \\froman\\fcharset163\\fprq2 Cambria (Vietnamese);}{\\fbimajor\\f31538\\fbidi \\froman\\fcharset238\\fprq2 Times New Roman CE;}{\\fbimajor\\f31539\\fbidi \\froman\\fcharset204\\fprq2 Times New Roman Cyr;}\n{\\fbimajor\\f31541\\fbidi \\froman\\fcharset161\\fprq2 Times New Roman Greek;}{\\fbimajor\\f31542\\fbidi \\froman\\fcharset162\\fprq2 Times New Roman Tur;}{\\fbimajor\\f31543\\fbidi \\froman\\fcharset177\\fprq2 Times New Roman (Hebrew);}\n{\\fbimajor\\f31544\\fbidi \\froman\\fcharset178\\fprq2 Times New Roman (Arabic);}{\\fbimajor\\f31545\\fbidi \\froman\\fcharset186\\fprq2 Times New Roman Baltic;}{\\fbimajor\\f31546\\fbidi \\froman\\fcharset163\\fprq2 Times New Roman (Vietnamese);}\n{\\flominor\\f31548\\fbidi \\froman\\fcharset238\\fprq2 Times New Roman CE;}{\\flominor\\f31549\\fbidi \\froman\\fcharset204\\fprq2 Times New Roman Cyr;}{\\flominor\\f31551\\fbidi \\froman\\fcharset161\\fprq2 Times New Roman Greek;}\n{\\flominor\\f31552\\fbidi \\froman\\fcharset162\\fprq2 Times New Roman Tur;}{\\flominor\\f31553\\fbidi \\froman\\fcharset177\\fprq2 Times New Roman (Hebrew);}{\\flominor\\f31554\\fbidi \\froman\\fcharset178\\fprq2 Times New Roman (Arabic);}\n{\\flominor\\f31555\\fbidi \\froman\\fcharset186\\fprq2 Times New Roman Baltic;}{\\flominor\\f31556\\fbidi \\froman\\fcharset163\\fprq2 Times New Roman (Vietnamese);}{\\fdbminor\\f31560\\fbidi \\fnil\\fcharset0\\fprq2 SimSun Western{\\*\\falt \\'cb\\'ce\\'cc\\'e5};}\n{\\fhiminor\\f31568\\fbidi \\fswiss\\fcharset238\\fprq2 Calibri CE;}{\\fhiminor\\f31569\\fbidi \\fswiss\\fcharset204\\fprq2 Calibri Cyr;}{\\fhiminor\\f31571\\fbidi \\fswiss\\fcharset161\\fprq2 Calibri Greek;}{\\fhiminor\\f31572\\fbidi \\fswiss\\fcharset162\\fprq2 Calibri Tur;}\n{\\fhiminor\\f31575\\fbidi \\fswiss\\fcharset186\\fprq2 Calibri Baltic;}{\\fhiminor\\f31576\\fbidi \\fswiss\\fcharset163\\fprq2 Calibri (Vietnamese);}{\\fbiminor\\f31578\\fbidi \\fswiss\\fcharset238\\fprq2 Arial CE;}\n{\\fbiminor\\f31579\\fbidi \\fswiss\\fcharset204\\fprq2 Arial Cyr;}{\\fbiminor\\f31581\\fbidi \\fswiss\\fcharset161\\fprq2 Arial Greek;}{\\fbiminor\\f31582\\fbidi \\fswiss\\fcharset162\\fprq2 Arial Tur;}{\\fbiminor\\f31583\\fbidi \\fswiss\\fcharset177\\fprq2 Arial (Hebrew);}\n{\\fbiminor\\f31584\\fbidi \\fswiss\\fcharset178\\fprq2 Arial (Arabic);}{\\fbiminor\\f31585\\fbidi \\fswiss\\fcharset186\\fprq2 Arial Baltic;}{\\fbiminor\\f31586\\fbidi \\fswiss\\fcharset163\\fprq2 Arial (Vietnamese);}}{\\colortbl;\\red0\\green0\\blue0;\\red0\\green0\\blue255;\n\\red0\\green255\\blue255;\\red0\\green255\\blue0;\\red255\\green0\\blue255;\\red255\\green0\\blue0;\\red255\\green255\\blue0;\\red255\\green255\\blue255;\\red0\\green0\\blue128;\\red0\\green128\\blue128;\\red0\\green128\\blue0;\\red128\\green0\\blue128;\\red128\\green0\\blue0;\n\\red128\\green128\\blue0;\\red128\\green128\\blue128;\\red192\\green192\\blue192;\\cfollowedhyperlink\\ctint255\\cshade255\\red128\\green0\\blue128;\\ctextone\\ctint255\\cshade255\\red0\\green0\\blue0;}{\\*\\defchp \\fs22\\dbch\\af11 }{\\*\\defpap \\ql \\li0\\ri0\\sa200\\sl276\\slmult1\n\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 }\\noqfpromote {\\stylesheet{\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \n\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\snext0 \\sautoupd \\sqformat \\spriority0 Normal;}{\\s1\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\outlinelevel0\\adjustright\\rin0\\lin0\\itap0 \n\\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext1 \\slink15 \\sqformat heading 1;}{\n\\s2\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\outlinelevel1\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\l <truncated>",
      "strings": [
        "{\\fhimajor\\f31502\\fbidi \\froman\\fcharset0\\fprq2{\\*\\panose 00000000000000000000}Cambria;}{\\fbimajor\\f31503\\fbidi \\froman\\fcharset0\\fprq2{\\*\\panose 02020603050405020304}Times New Roman;}",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935\\charrsid14122191 \\hich\\af40\\dbch\\af11\\loch\\f40  agree to these terms.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid11996719\\charrsid869748 {\\*\\bkmkend OLE_LINK5}{\\*\\bkmkend OLE_LINK6}",
        "\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'02);}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li1080\\lin1080 }}{\\lfolevel\\listoverrideformat{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0",
        "\\levelspace0\\levelindent0{\\leveltext\\'02\\'02.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab\\ai0\\af40\\afs20 \\ltrch\\fcs0 \\b\\i0\\f40\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li1077\\jclisttab\\tx1440\\lin1077 }{\\listlevel\\levelnfc3\\levelnfcn3\\leveljc0\\leveljcn0\\levelfollow0",
        "b9f7dec44b7904cfbca4f3f6443ab2a49c9c2c41476dafd55c6e7ac8c769db1bc399161ee314bc2e75cf8759081743be1236ec4f4d6693e5336fb672c5dc24a8",
        "\\fi-360\\li2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li2880\\lin2880 }{\\listlevel",
        "\\levelspace0\\levelindent0{\\leveltext\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\jclisttab\\tx1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext",
        "\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'03.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\strike0\\f41\\fs20\\ulnone\\fbias0\\hres0\\chhres0 \\fi-358\\li1435\\jclisttab\\tx1437\\lin1435 }{\\listlevel\\levelnfc1\\levelnfcn1",
        "\\sbasedon0 \\snext29 Body 6;}{\\s30\\ql \\li2506\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin2506\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\b0\\insrsid14971392\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 publish}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid14578447\\charrsid12455646 ,}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid14971392\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40  }{",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s1 \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 \\b\\f40\\fs20\\insrsid14971392\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 4.\\tab}}\\pard\\plain \\ltrpar\\s1\\ql \\fi-357\\li357\\ri0\\sb120\\sa120\\widctlpar",
        " laws of the state or province where you live (or, if a business, where your principal place of business is located) govern the interpretation of }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8394664 \\hich\\af40\\dbch\\af11\\loch\\f40 this agreement}{\\rtlch\\fcs1 ",
        "\\lsdpriority72 \\lsdlocked0 Colorful List Accent 6;\\lsdpriority73 \\lsdlocked0 Colorful Grid Accent 6;\\lsdqformat1 \\lsdpriority19 \\lsdlocked0 Subtle Emphasis;\\lsdqformat1 \\lsdpriority21 \\lsdlocked0 Intense Emphasis;",
        "\\ltrch\\fcs0 \\insrsid5844502 \\hich\\af40\\dbch\\af11\\loch\\f40 y}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40  of the software}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid3606489 \\hich\\af40\\dbch\\af11\\loch\\f40  }{",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 Third Party }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid15949659 \\hich\\af40\\dbch\\af11\\loch\\f40 Software}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid7406168\\charrsid2110843 .}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8743060 \\hich\\af40\\dbch\\af11\\loch\\f40 FAA }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11996719\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 governs everything related to arbitration}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\b0\\insrsid5791644\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40  the software as a stand-alone }{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid935470\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 hosted solution}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 ",
        "\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'08.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li3240\\lin3240 }}\\ls14}{\\listoverride\\listid759907437\\listoverridecount0\\ls15}{\\listoverride\\listid1433478290",
        "\\mdispDef1\\mlMargin0\\mrMargin0\\mdefJc1\\mwrapIndent1440\\mintLim0\\mnaryLim1}{\\info{\\title Microsoft Media Creation Tool - Standalone (free) Use Terms}{\\creatim\\yr2016\\mo6\\dy27\\hr13\\min21}{\\revtim\\yr2016\\mo6\\dy27\\hr13\\min21}{\\version1}{\\edmins0}{\\nofpages3}",
        "\\hich\\af40\\dbch\\af11\\loch\\f40  the entire agreement for the software.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid15818407\\charrsid9003929 ",
        "\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li3600\\lin3600 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693",
        "{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li5760\\lin5760 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693",
        "\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid-1175557160\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\s37\\fi-357\\li1792\\jclisttab\\tx1795\\lin1792 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0",
        "\\lsdpriority63 \\lsdlocked0 Medium Shading 1;\\lsdpriority64 \\lsdlocked0 Medium Shading 2;\\lsdpriority65 \\lsdlocked0 Medium List 1;\\lsdpriority66 \\lsdlocked0 Medium List 2;\\lsdpriority67 \\lsdlocked0 Medium Grid 1;\\lsdpriority68 \\lsdlocked0 Medium Grid 2;",
        "\\par }\\pard\\plain \\ltrpar\\s43\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0\\pararsid4605562 \\rtlch\\fcs1 \\ab\\af40\\afs28\\alang1025 \\ltrch\\fcs0 ",
        "b01d583deee5f99824e290b4ba3f364eac4a430883b3c092d4eca8f946c916422ecab927f52ea42b89a1cd59c254f919b0e85e6535d135a8de20f20b8c12c3b0",
        "\\insrsid7406168 \\hich\\af40\\dbch\\af11\\loch\\f40 Any included notices}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7406168\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40  for third party applications are for your information only.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext3 \\slink17 \\sqformat heading 3;}{\\s4\\ql \\fi-358\\li1435\\ri0\\sb120\\sa120\\widctlpar",
        "\\levelnfcn4\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'03(\\'04);}{\\levelnumbers\\'02;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\fbias0\\hres0\\chhres0 \\fi-360\\li1800\\jclisttab\\tx1800\\lin1800 }{\\listlevel\\levelnfc2\\levelnfcn2",
        "656e74323d22616363656e74322220616363656e74333d22616363656e74332220616363656e74343d22616363656e74342220616363656e74353d22616363656e74352220616363656e74363d22616363656e74362220686c696e6b3d22686c696e6b2220666f6c486c696e6b3d22666f6c486c696e6b222f3e}",
        "\\lsdpriority49 \\lsdlocked0 Grid Table 4 Accent 2;\\lsdpriority50 \\lsdlocked0 Grid Table 5 Dark Accent 2;\\lsdpriority51 \\lsdlocked0 Grid Table 6 Colorful Accent 2;\\lsdpriority52 \\lsdlocked0 Grid Table 7 Colorful Accent 2;",
        "; nor is combining individual proceedings without the consent of all parties. The complete Arbitration Agreement contains more terms and is at }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8743060\\charrsid14811859 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\insrsid11952046\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 Microsoft Privacy Statement}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11952046\\delrsid16459130\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid16656908 ",
        "696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b46314138323141452d353231362d344643462d413243352d3246313637413345363531317d2220786d6c6e733a64733d2268",
        "\\lsdpriority52 \\lsdlocked0 Grid Table 7 Colorful Accent 1;\\lsdpriority46 \\lsdlocked0 Grid Table 1 Light Accent 2;\\lsdpriority47 \\lsdlocked0 Grid Table 2 Accent 2;\\lsdpriority48 \\lsdlocked0 Grid Table 3 Accent 2;",
        "\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\strike0\\f41\\fs20\\ulnone\\fbias0\\hres0\\chhres0 \\fi-358\\li1795\\jclisttab\\tx1797\\lin1795 }{\\listlevel\\levelnfc1\\levelnfcn1\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11952046\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 If not, you }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11996719\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 and }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8394664 ",
        "0000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b35303841",
        "\\lang9\\langfe1033\\langnp9\\insrsid8403787\\charrsid339141 \\hich\\af40\\dbch\\af11\\loch\\f40 (except to the extent }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\lang9\\langfe1033\\langnp9\\insrsid8403787\\charrsid8875785 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        " or country do not permit it to do so. For example, if you acquired the software in one of the below regions, or mandatory country law applies, then the following provisions apply to you:}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid7227263\\charrsid9003929 ",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext9 \\slink23 \\sqformat heading 9;}{\\*\\cs10 \\additive \\ssemihidden \\sunhideused \\spriority1 Default Paragraph Font;}{\\*",
        "SUPPORT SERVICES.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8394664 \\hich\\af40\\dbch\\af11\\loch\\f40 Microsoft}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid7227263\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 Australia.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 ",
        "aka.ms/arb-agreement-1}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935\\charrsid14122191 \\hich\\af40\\dbch\\af11\\loch\\f40 . You an\\hich\\af40\\dbch\\af11\\loch\\f40 d }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935 \\hich\\af40\\dbch\\af11\\loch\\f40 Microsoft}{",
        "\\af40\\afs16\\alang1025 \\ltrch\\fcs0 \\b\\fs16\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext74 \\slink75 \\ssemihidden Balloon Text;}{\\*\\cs75 \\additive \\rtlch\\fcs1 \\af40\\afs16 \\ltrch\\fcs0 \\f40\\fs16 ",
        "\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li3600\\lin3600 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0",
        "\\levelnfc255\\levelnfcn255\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02i.;}{\\levelnumbers;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li2863\\jclisttab\\tx2866\\lin2863 }",
        "\\insrsid12068987\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 may also specify }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid615889\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 how to turn off updates for yo\\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\lin6480 }{\\listname ;}\\listid937249388}{\\list\\listtemplateid290096466\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext",
        "\\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext1 \\slink15 \\sqformat heading 1;}{",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'05.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li2149\\jclisttab\\tx2152\\lin2149 }{\\listlevel\\levelnfc4\\levelnfcn4",
        "f074481847bd804859b5e696007d4b4edfc150b12addbecba6b18b148a1e54d1bc81392f23b7f84137c2715a851dd0242a633f900710a218ed715505dfe56e86",
        "\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\jclisttab\\tx6480\\lin6480 }{\\listname ;}\\listid477573462}{\\list\\listtemplateid29543036\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1",
        "\\picscalex1\\picscaley1\\piccropl0\\piccropr0\\piccropt0\\piccropb0\\picw7620\\pich7620\\picwgoal4320\\pichgoal4320\\wmetafile8}}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\lang9\\langfe1033\\langnp9\\insrsid4605562 ",
        "\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li4320\\jclisttab\\tx4320\\lin4320 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext",
        "\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\lin6480 }{\\listname ;}\\listid489490308}{\\list\\listtemplateid154583766{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'00.;}{\\levelnumbers\\'01;}",
        ";}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li5760\\lin5760 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}",
        "\\picscalex1\\picscaley1\\piccropl0\\piccropr0\\piccropt0\\piccropb0\\picw7620\\pich7620\\picwgoal4320\\pichgoal4320\\wmetafile8}}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 IF YOU LIVE IN (OR",
        "{\\listlevel\\levelnfc255\\levelnfcn255\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02A.;}{\\levelnumbers;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\fi-358\\li3221",
        "\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af0\\afs22\\alang1025 \\ltrch\\fcs0 \\fs22\\lang1033\\langfe1033\\loch\\f0\\hich\\af0\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\snext11 \\ssemihidden \\sunhideused Normal Table;}{\\*",
        "\\additive \\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\f40\\lang1033\\langfe1033\\langnp1033\\langfenp1033 \\sbasedon10 Body 1 Char;}{\\s61\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\brdrt\\brdrs\\brdrw10\\brsp20 \\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 ",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid2110843 {\\*\\bkmkstart OLE_LINK52}{\\*\\bkmkstart OLE_LINK53}{\\*\\bkmkend OLE_LINK52}{\\*\\bkmkend OLE_LINK53}\\hich\\af40\\dbch\\af11\\loch\\f40 MICROSOFT SOFTWARE LICENSE TERMS}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\af40 \\ltrch\\fcs0 \\insrsid9003929\\charrsid4136656 \\hich\\af40\\dbch\\af11\\loch\\f40 country may not allow the exclusion or limitation of incidental, consequential, or other damages.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid2501791 ",
        "\\listoverridecount0\\ls11}{\\listoverride\\listid1197885460\\listoverridecount0\\ls12}{\\listoverride\\listid72362087\\listoverridecount0\\ls13}{\\listoverride\\listid514420648\\listoverridecount9{\\lfolevel\\listoverrideformat{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid14971392\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 EXPORT R\\hich\\af40\\dbch\\af11\\loch\\f40 ESTRICTIONS.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 ",
        "\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li720\\lin720 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext",
        "{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\lin6480 }{\\listname ",
        "\\b\\fs19\\ul\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon35 \\snext88 Bullet 3 Underlined;}{\\*\\cs89 \\additive \\rtlch\\fcs1 \\af40\\afs19 \\ltrch\\fcs0 ",
        "\\jclisttab\\tx4320\\lin4320 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li5040\\jclisttab\\tx5040\\lin5040 }{\\listlevel",
        "\\ltrch\\fcs0 \\cs118\\b\\insrsid4879935\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 . IT AFFECTS HOW DISPUTES ARE RESOLVED.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid6121706 {\\pict{\\*\\picprop\\shplid1026{\\sp{\\sn shapeType}{\\sv 1}}{\\sp{\\sn fFlipH}{\\sv 0}}",
        "{\\fbimajor\\f31544\\fbidi \\froman\\fcharset178\\fprq2 Times New Roman (Arabic);}{\\fbimajor\\f31545\\fbidi \\froman\\fcharset186\\fprq2 Times New Roman Baltic;}{\\fbimajor\\f31546\\fbidi \\froman\\fcharset163\\fprq2 Times New Roman (Vietnamese);}",
        "3849c26ae66252c6ed637c58c5bb8b13c7bfbd490a75330f4b47f16e441c31f7184e140e494214d273fc80900aedee52ead87597fa824b3e56e82e451d4c2b4d",
        "\\'02\\'01.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li1440\\jclisttab\\tx1440\\lin1440 }{\\listlevel\\levelnfc2\\levelnfcn2\\leveljc2\\leveljcn2\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698715",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698703\\'02\\'03.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li2880\\jclisttab\\tx2880\\lin2880 }{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0",
        "000000000000000000d60200007468656d652f7468656d652f7468656d65312e786d6c504b01022d00140006000800000021000dd1909fb60000001b01000027",
        "use the software in any way \\hich\\af40\\dbch\\af11\\loch\\f40 that is against the law}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid14578447\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40  or to create or propagate malware}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 ",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\lang9\\langfe1033\\langnp9\\insrsid13051670\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 These}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\lang9\\langfe1033\\langnp9\\insrsid10833228\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40  license}{",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 (i)\\tab Warranty.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li2863\\jclisttab\\tx2866\\lin2863 }{\\listlevel\\levelnfc255\\levelnfcn255\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02A.;}{\\levelnumbers;}\\rtlch\\fcs1 ",
        "\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\lin6480 }{\\listname ;}\\listid208151644}{\\list\\listtemplateid-1793664660",
        "\\lsdqformat1 \\lsdpriority31 \\lsdlocked0 Subtle Reference;\\lsdqformat1 \\lsdpriority32 \\lsdlocked0 Intense Reference;\\lsdqformat1 \\lsdpriority33 \\lsdlocked0 Book Title;\\lsdsemihidden1 \\lsdunhideused1 \\lsdpriority37 \\lsdlocked0 Bibliography;",
        "\\insrsid11952046\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 . If you acquired the software in any other country, its laws apply}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8743060 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "{\\flominor\\f31555\\fbidi \\froman\\fcharset186\\fprq2 Times New Roman Baltic;}{\\flominor\\f31556\\fbidi \\froman\\fcharset163\\fprq2 Times New Roman (Vietnamese);}{\\fdbminor\\f31560\\fbidi \\fnil\\fcharset0\\fprq2 SimSun Western{\\*\\falt \\'cb\\'ce\\'cc\\'e5};}",
        "\\insrsid14578447\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 ny support }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8394664 \\hich\\af40\\dbch\\af11\\loch\\f40 provided}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8394664\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40  ",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 you and Microsoft}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935\\charrsid14122191 \\hich\\af40\\dbch\\af11\\loch\\f40  have a dispute, you and }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935 \\hich\\af40\\dbch\\af11\\loch\\f40 Microsoft}",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 HTML Address;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 HTML Cite;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 HTML Code;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 HTML Definition;",
        "{\\rtf1\\adeflang1025\\ansi\\ansicpg1252\\uc1\\adeff40\\deff0\\stshfdbch11\\stshfloch0\\stshfhich0\\stshfbi0\\deflang1033\\deflangfe1033\\themelang1033\\themelangfe2052\\themelangcs1025{\\fonttbl{\\f0\\fbidi \\froman\\fcharset0\\fprq2{\\*\\panose 02020603050405020304}Times New Roman;}",
        "\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\jclisttab\\tx2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1",
        "\\af40 \\ltrch\\fcs0 \\insrsid11952046\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 , claims for }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8394664 \\hich\\af40\\dbch\\af11\\loch\\f40 its }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11952046\\charrsid9003929 ",
        "\\lsdpriority51 \\lsdlocked0 List Table 6 Colorful;\\lsdpriority52 \\lsdlocked0 List Table 7 Colorful;\\lsdpriority46 \\lsdlocked0 List Table 1 Light Accent 1;\\lsdpriority47 \\lsdlocked0 List Table 2 Accent 1;\\lsdpriority48 \\lsdlocked0 List Table 3 Accent 1;",
        "You must comply with all domestic and international export laws and regulations that apply to the software, which include restrictions on destinations, end users, and end use. For further information on export restrictions, visit (aka.ms/expor",
        "d10120a6b16eb1d0d1010000000000000000000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff04000000ffffffff000000000000000000000000000000000000000000000000",
        "{\\f450\\fbidi \\fswiss\\fcharset178\\fprq2 Tahoma (Arabic);}{\\f451\\fbidi \\fswiss\\fcharset186\\fprq2 Tahoma Baltic;}{\\f452\\fbidi \\fswiss\\fcharset163\\fprq2 Tahoma (Vietnamese);}{\\f453\\fbidi \\fswiss\\fcharset222\\fprq2 Tahoma (Thai);}",
        "ENTIRE AGREEMENT.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  This agre\\hich\\af40\\dbch\\af11\\loch\\f40 ement, and }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid5452915\\charrsid9003929 ",
        "0f88d94fbc52ae4264d1c910d24a45db3462247fa791715fd71f989e19e0364cd3f51652d73760ae8fa8c9ffb3c330cc9e4fc17faf2ce545046e37944c69e462",
        "\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li3600\\jclisttab\\tx3600\\lin3600 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext",
        "\\'01;}\\rtlch\\fcs1 \\ab\\ai0\\af40\\afs20 \\ltrch\\fcs0 \\b\\i0\\f40\\fs20\\fbias0\\hres0\\chhres0 \\s3\\fi-357\\li1077\\jclisttab\\tx1440\\lin1077 }{\\listlevel\\levelnfc3\\levelnfcn3\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext",
        "/2003/wordml}}\\paperw12240\\paperh15840\\margl1440\\margr1440\\margt1440\\margb1440\\gutter0\\ltrsect ",
        "\\jclisttab\\tx2866\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls21\\ilvl7\\outlinelevel7\\adjustright\\rin0\\lin2863\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 ",
        "\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02A.;}{\\levelnumbers;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\fi-358\\li3581\\jclisttab\\tx3583\\lin3581 }{\\listname ",
        "LIMITATION ON AND EXCLUSION OF DAMAGES. IF YOU HAVE ANY BASIS FOR RECOVERING DAMAGES DESPITE }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid199942 \\hich\\af40\\dbch\\af11\\loch\\f40 THE PRECEDING }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid12275164 ",
        "\\pnlcltr\\pnstart1\\pnindent720\\pnhang {\\pntxtb (}{\\pntxta )}}{\\*\\pnseclvl9\\pnlcrm\\pnstart1\\pnindent720\\pnhang {\\pntxtb (}{\\pntxta )}}\\pard\\plain \\ltrpar",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s34 \\rtlch\\fcs1 \\ab\\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19\\insrsid935470\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 d)\\tab}}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid935470\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\insrsid13202321\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  (a) }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\f2\\cf15\\lang1024\\langfe1024\\noproof tw4winExternal;}{\\*\\cs96 \\additive \\v\\f2\\fs24\\cf12\\sub tw4winMark;}{\\*\\cs97 \\additive \\b\\f40 Preamble Char;}{\\*\\cs98 \\additive \\f2\\fs40\\cf4 tw4winError;}{\\*\\cs99 \\additive \\cf2 tw4winTerm;}{\\*\\cs100 \\additive ",
        "\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\jclisttab\\tx1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0",
        "\\ltrch\\fcs0 \\insrsid9190298\\charrsid339141 \\hich\\af40\\dbch\\af11\\loch\\f40  warranty, guarantee}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9190298 ,}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9190298\\charrsid339141 \\hich\\af40\\dbch\\af11\\loch\\f40  or condition}{",
        "\\lsdpriority45 \\lsdlocked0 Plain Table 5;\\lsdpriority40 \\lsdlocked0 Grid Table Light;\\lsdpriority46 \\lsdlocked0 Grid Table 1 Light;\\lsdpriority47 \\lsdlocked0 Grid Table 2;\\lsdpriority48 \\lsdlocked0 Grid Table 3;\\lsdpriority49 \\lsdlocked0 Grid Table 4;",
        ", except that the FAA governs everything related to arbitration}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11952046\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 . \\hich\\af40\\dbch\\af11\\loch\\f40 If }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 ou agree to receive these auto\\hich\\af40\\dbch\\af11\\loch\\f40 matic updates without any additional notice. Updates may not include or support all existing software features, services}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 DISCLAIMER OF WARRANTY}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid9003929\\charrsid4136656 \\hich\\af40\\dbch\\af11\\loch\\f40 , YOU CAN RECOVER FROM MICROSOFT AND ITS SUPPLIERS ONLY DIRECT DAMAGES UP TO\\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 ware;}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid16591162 ",
        "6dce591a26ade1c0a7f669880485fd484582903d284b26fa4e2156cff62e4b9265844c4495c495a9157b440e091bea1ab8aaf7760f4510eaa69a6465c0e04ec6",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 index 9;\\lsdsemihidden1 \\lsdunhideused1 \\lsdpriority39 \\lsdlocked0 toc 1;\\lsdsemihidden1 \\lsdunhideused1 \\lsdpriority39 \\lsdlocked0 toc 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdpriority39 \\lsdlocked0 toc 3;",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698703\\'02\\'06.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li5040\\jclisttab\\tx5040\\lin5040 }{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0",
        "\\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19 \\sbasedon10 \\slink3 \\slocked Heading 3 Char;}{\\*\\cs18 \\additive \\rtlch\\fcs1 \\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19 \\sbasedon10 \\slink4 \\slocked Heading 4 Char;}{\\*\\cs19 \\additive \\rtlch\\fcs1 \\af40\\afs19 \\ltrch\\fcs0 ",
        "\\jclisttab\\tx4320\\lin4320 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li5040",
        "\\lsdpriority50 \\lsdlocked0 List Table 5 Dark Accent 6;\\lsdpriority51 \\lsdlocked0 List Table 6 Colorful Accent 6;\\lsdpriority52 \\lsdlocked0 List Table 7 Colorful Accent 6;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Mention;}}{\\*\\datastore 0105000002000000",
        "313433352d384337372d344635382d384442342d3242324633413541324238437d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c",
        "\\jclisttab\\tx360\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls11\\adjustright\\rin0\\lin360\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext93 \\spriority0 ",
        "\\fi-360\\li5760\\lin5760 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 ",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935\\charrsid14122191 \\hich\\af40\\dbch\\af11\\loch\\f40  can\\hich\\f40 \\rquote \\loch\\f40 t, you and }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935 \\hich\\af40\\dbch\\af11\\loch\\f40 Microsoft}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        " In case of intentional conduct, gross negligence, claims based on the Product Liability Act, as well as, in case of death or personal or physical injury, Microsoft is liable according to the statutory\\hich\\af40\\dbch\\af11\\loch\\f40  law.}{\\rtlch\\fcs1 ",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List 4;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List 5;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List Bullet 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List Bullet 3;",
        "{\\f454\\fbidi \\fswiss\\fcharset238\\fprq2 Trebuchet MS CE;}{\\f455\\fbidi \\fswiss\\fcharset204\\fprq2 Trebuchet MS Cyr;}{\\f457\\fbidi \\fswiss\\fcharset161\\fprq2 Trebuchet MS Greek;}{\\f458\\fbidi \\fswiss\\fcharset162\\fprq2 Trebuchet MS Tur;}",
        "000000000000000000000000000000000000000000000000000000000000040000005401000000000000cb00c2004700c800dc0052005a005300d300d400de00c200d1005300dc0057003400c300d900c500450051003d003d000000000000000000000000000000000032000100ffffffffffffffff0600000000000000",
        "0000000000000000000000000000000000000000000000000000000000000000000000000d00000051010000000000006e6573732d696e746567726974792e636f6d2f6465616c6275696c6465722f323030362f64696374696f6e617279222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72",
        "\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\jclisttab\\tx6480\\lin6480 }{\\listname ;}\\listid1567649130}{\\list\\listtemplateid-154908222\\listhybrid{\\listlevel\\levelnfc3\\levelnfcn3\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid12068987\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 T}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid615889\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 he product documentation, if any, }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s1 \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 \\cs118\\b\\f40\\fs20\\lang9\\langfe1033\\langnp9\\insrsid869748\\charrsid3034803 \\hich\\af40\\dbch\\af11\\loch\\f40 8.\\tab}}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 ",
        "\\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext5 \\slink19 \\sqformat heading 5;}{\\s6\\ql \\fi-357\\li2149\\ri0\\sb120\\sa120\\widctlpar",
        "\\jclisttab\\tx2152\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls6\\adjustright\\rin0\\lin2149\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext38 Bullet 6;}{",
        "\\lsdpriority63 \\lsdlocked0 Medium Shading 1 Accent 6;\\lsdpriority64 \\lsdlocked0 Medium Shading 2 Accent 6;\\lsdpriority65 \\lsdlocked0 Medium List 1 Accent 6;\\lsdpriority66 \\lsdlocked0 Medium List 2 Accent 6;",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\jclisttab\\tx1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0",
        "999fb7b4717509af678b985ab0b6b4ae6f7ed9ba6c4170b06c788a705430adf71bad2b5b057d03606a1ed7ebf5babd7a41cf00b0ef83a6569632cd467faddec9",
        "\\ltrch\\fcs0 \\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\snext112 \\shidden \\ssemihidden Revision;}{",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s1 \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 \\b\\f40\\fs20\\insrsid14971392\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 10.\\tab}}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid14971392\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "5e85f3b9660d0713cc48a0ed6ef7dedc2dc60b17e92219e180643ed27acffba86e9c94c78ab90980d8a9f0913ee49d62b512b79626fb06dccee2a432bbc60276",
        "\\b\\fs19\\ul\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon35 \\snext51 Bullet 3 Underline;}{\\s52\\ql \\li720\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin720\\itap0 \\rtlch\\fcs1 ",
        "{\\fbiminor\\f31584\\fbidi \\fswiss\\fcharset178\\fprq2 Arial (Arabic);}{\\fbiminor\\f31585\\fbidi \\fswiss\\fcharset186\\fprq2 Arial Baltic;}{\\fbiminor\\f31586\\fbidi \\fswiss\\fcharset163\\fprq2 Arial (Vietnamese);}}{\\colortbl;\\red0\\green0\\blue0;\\red0\\green0\\blue255;",
        "Bullet 3;}{\\s36\\ql \\fi-358\\li1435\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx1437\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls4\\adjustright\\rin0\\lin1435\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\fs28\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14383224 \\hich\\af40\\dbch\\af11\\loch\\f40 MICROSOFT MEDIA CREATION TOOL}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\ul\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon25 \\snext52 Body 2 Underline;}{",
        "\\fi-360\\li2883\\lin2883 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 ",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 Microsoft}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8394664\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11952046\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 consent to exclusive ",
        "6e22206267313d226c743122207478313d22646b3122206267323d226c743222207478323d22646b322220616363656e74313d22616363656e74312220616363",
        "\\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid14227545\\charrsid10583668 ",
        "\\b\\insrsid15818407\\charrsid9003929 ",
        "\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'06\\'00.\\'01.\\'02.;}{\\levelnumbers\\'01\\'03\\'05;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-504\\li1224\\lin1224 }{\\listlevel\\levelnfc0\\levelnfcn0",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid6121706 \\chftnsep ",
        "\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'10\\'00.\\'01.\\'02.\\'03.\\'04.\\'05.\\'06.\\'07.;}{\\levelnumbers\\'01\\'03\\'05\\'07\\'09\\'0b\\'0d\\'0f;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 ",
        "\\levelnfcn1\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'04.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\strike0\\f41\\fs20\\ulnone\\fbias0\\hres0\\chhres0 \\fi-357\\li1792",
        "\\ltrch\\fcs0 \\insrsid14971392\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40  The software is licensed, not sold. Microsoft reserves all other rights. Unless applicable law gives you more rights despite this limitation, you }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\lsdpriority63 \\lsdlocked0 Medium Shading 1 Accent 5;\\lsdpriority64 \\lsdlocked0 Medium Shading 2 Accent 5;\\lsdpriority65 \\lsdlocked0 Medium List 1 Accent 5;\\lsdpriority66 \\lsdlocked0 Medium List 2 Accent 5;",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698715\\'02\\'08.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-180\\li6480\\jclisttab\\tx6480\\lin6480 }{\\listname ;}\\listid1795057320}",
        "\\'02\\'05.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-180\\li4320\\jclisttab\\tx4320\\lin4320 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698703",
        "\\jclisttab\\tx2152\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls21\\ilvl5\\outlinelevel5\\adjustright\\rin0\\lin2149\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 ",
        "\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li720\\lin720 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0",
        "\\jclisttab\\tx720\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls30\\adjustright\\rin0\\lin720\\itap0\\pararsid13714870 {\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid14971392\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "Endnote Text Char;}{\\*\\cs67 \\additive \\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\super \\sbasedon10 \\ssemihidden endnote reference;}{\\s68\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 ",
        "{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'05.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li2149",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\jclisttab\\tx6480\\lin6480 }{\\listname ;}\\listid810947713}{\\list\\listtemplateid1922756776\\listhybrid{\\listlevel\\levelnfc23",
        "\\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid6567068 \\hich\\af40\\dbch\\af11\\loch\\f40 SECTION }{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid12938773 \\hich\\af40\\dbch\\af11\\loch\\f40 BELOW}{\\rtlch\\fcs1 \\ab0\\af40 ",
        "52282e3198720e274a939cd08a54f980ae38a38f56e422a3a641c8bbd048f7757da0f19b017cc524bd62107bd5001996509affb3fd381a89672f1f165dfe5141",
        ";}\\listid196815738}{\\list\\listtemplateid-834665388\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}",
        "\\insrsid1998008 ",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s2 \\rtlch\\fcs1 \\ab\\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19\\insrsid7227263\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 c)\\tab}\\hich\\af40\\dbch\\af11\\loch\\f40 Germany and Austria.",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9190298 \\hich\\af40\\dbch\\af11\\loch\\f40 ;}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9190298\\charrsid339141 \\hich\\af40\\dbch\\af11\\loch\\f40  strict liability}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9190298 ,}{\\rtlch\\fcs1 ",
        "\\fi-360\\li1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 ",
        "\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689",
        "\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext83 \\slink84 footer;}{\\*\\cs84 \\additive \\rtlch\\fcs1 \\af40\\afs19 \\ltrch\\fcs0 \\f40\\fs19 \\sbasedon10 \\slink83 \\slocked ",
        "{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6120\\lin6120 }{\\listname ",
        "\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li4320\\lin4320 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689",
        "\\jclisttab\\tx360\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls26\\outlinelevel0\\adjustright\\rin0\\lin357\\itap0\\pararsid2110843 \\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {",
        "\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid1493466940\\'02\\'00);}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\b\\fbias0\\hres0\\chhres0 \\fi-363\\li720\\jclisttab\\tx720\\lin720 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s34 \\rtlch\\fcs1 \\ab\\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19\\insrsid16591162\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 c)\\tab}}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid16591162\\charrsid12455646 ",
        "\\insrsid7435018\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9190298\\charrsid339141 \\hich\\af40\\dbch\\af11\\loch\\f40 claims for breach of contract}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9190298 ,}{\\rtlch\\fcs1 \\af40 ",
        "\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li1800\\lin1800 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List Bullet;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List Number;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List 3;",
        "\\sbasedon0 \\snext72 Char Char Char Char;}{\\*\\cs73 \\additive \\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\ul\\cf2 \\sbasedon10 Hyperlink,Char Char7;}{\\s74\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 ",
        "\\lsdpriority48 \\lsdlocked0 Grid Table 3 Accent 1;\\lsdpriority49 \\lsdlocked0 Grid Table 4 Accent 1;\\lsdpriority50 \\lsdlocked0 Grid Table 5 Dark Accent 1;\\lsdpriority51 \\lsdlocked0 Grid Table 6 Colorful Accent 1;",
        "\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'02.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab\\ai0\\af40\\afs20 \\ltrch\\fcs0 \\b\\i0\\f40\\fs20\\cf0\\fbias0\\hres0\\chhres0 \\s49\\fi-357\\li1077\\jclisttab\\tx1440\\lin1077 }{\\listlevel",
        "\\fi-358\\li3221\\jclisttab\\tx3223\\lin3221 }{\\listname ;}\\listid727923163}{\\list\\listtemplateid-757808988\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689",
        "\\lsdpriority46 \\lsdlocked0 Grid Table 1 Light Accent 3;\\lsdpriority47 \\lsdlocked0 Grid Table 2 Accent 3;\\lsdpriority48 \\lsdlocked0 Grid Table 3 Accent 3;\\lsdpriority49 \\lsdlocked0 Grid Table 4 Accent 3;",
        "\\s42\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0\\pararsid2110843 \\rtlch\\fcs1 \\ab\\af40\\afs28\\alang1025 \\ltrch\\fcs0 \\fs28\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {",
        "\\insrsid339141\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 Some features in the software may enable collection of data from users of }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8781842\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 your }{\\rtlch\\fcs1 \\af40 ",
        "\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1",
        "Your opt-out rights}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8781842\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 , if any,}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4329485\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40  are describ}{\\rtlch\\fcs1 \\af40 ",
        "\\fi-360\\li3600\\lin3600 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 ",
        " Without prejudice to any other rights, Microsoft may terminate this agreement if you fail to comply with any of its terms or conditions. In such event, you must destroy all copies of the software and all of its component parts.}{\\rtlch\\fcs1 \\af40 ",
        "Heading EULA;}{\\s43\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\brdrb\\brdrs\\brdrw10\\brsp20 \\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\ab\\af40\\afs28\\alang1025 \\ltrch\\fcs0 ",
        "\\f3\\fbias0\\hres0\\chhres0 \\s41\\fi-358\\li3221\\jclisttab\\tx3223\\lin3221 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}",
        "\\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext44 Preamble;}{\\s45\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\brdrb\\brdrs\\brdrw10\\brsp20 ",
        "\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li5760\\lin5760 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693",
        "\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li5040\\lin5040 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext",
        "000000000000300100005f72656c732f2e72656c73504b01022d00140006000800000021006b799616830000008a0000001c0000000000000000000000000019",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Simple 3;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Classic 1;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Classic 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Classic 3;",
        "\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext28 Body 5;}{",
        "\\fs28\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext0 Heading Software Title;}{\\s44\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 ",
        "\\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\fi-358\\li3221\\jclisttab\\tx3223\\lin3221 }{\\listname ;}\\listid1317346407}{\\list\\listtemplateid1714699980\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0",
        "59d366ad93b65abe595f70a75bf03d616c2dd959fc7d4e6317cd99cbcec9c58b34766661c7d6766ca1a9c1b327531486c6f941c638c67cd22a7f75e2a37be0e8",
        "\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon3 \\snext49 \\slink107 Heading 3 Bold;}{\\s50\\ql \\fi-358\\li1435\\ri0\\sb120\\sa120\\widctlpar",
        "\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext71 Char;}{",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdpriority39 \\lsdlocked0 toc 7;\\lsdsemihidden1 \\lsdunhideused1 \\lsdpriority39 \\lsdlocked0 toc 8;\\lsdsemihidden1 \\lsdunhideused1 \\lsdpriority39 \\lsdlocked0 toc 9;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Normal Indent;",
        "\\sbasedon10 \\spriority0 Char Char1;}{\\s92\\ql \\fi-358\\li1435\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx1437\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls4\\adjustright\\rin0\\lin1435\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-1440\\li4320\\lin4320 }{\\listname ;}\\listid1157527705}{\\list\\listtemplateid1370270076\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698713\\'02\\'07.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li5760\\jclisttab\\tx5760\\lin5760 }{\\listlevel\\levelnfc2\\levelnfcn2\\leveljc2\\leveljcn2",
        "\\lsdqformat1 \\lsdlocked0 heading 3;\\lsdqformat1 \\lsdlocked0 heading 4;\\lsdqformat1 \\lsdlocked0 heading 5;\\lsdqformat1 \\lsdlocked0 heading 6;\\lsdqformat1 \\lsdlocked0 heading 7;\\lsdqformat1 \\lsdlocked0 heading 8;\\lsdqformat1 \\lsdlocked0 heading 9;",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 index 1;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 index 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 index 3;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 index 4;",
        "3d9058edf2c00eafe8e1fc5c509031bb4d680e9f39a3154de0accc56ae644441edd76156d7429d995bdd88664a9dc3ad50197c38af1a0c16d684060441db0256",
        "\\fi-360\\li3603\\lin3603 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 ",
        "{\\fbiminor\\f31579\\fbidi \\fswiss\\fcharset204\\fprq2 Arial Cyr;}{\\fbiminor\\f31581\\fbidi \\fswiss\\fcharset161\\fprq2 Arial Greek;}{\\fbiminor\\f31582\\fbidi \\fswiss\\fcharset162\\fprq2 Arial Tur;}{\\fbiminor\\f31583\\fbidi \\fswiss\\fcharset177\\fprq2 Arial (Hebrew);}",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698713\\'02\\'04.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li3600\\jclisttab\\tx3600\\lin3600 }{\\listlevel\\levelnfc2\\levelnfcn2\\leveljc2\\leveljcn2",
        "\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1443\\lin1443 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}",
        "\\lsdqformat1 \\lsdpriority20 \\lsdlocked0 Emphasis;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Document Map;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Plain Text;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 E-mail Signature;",
        "\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\jclisttab\\tx1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0",
        "\\lsdpriority67 \\lsdlocked0 Medium Grid 1 Accent 5;\\lsdpriority68 \\lsdlocked0 Medium Grid 2 Accent 5;\\lsdpriority69 \\lsdlocked0 Medium Grid 3 Accent 5;\\lsdpriority70 \\lsdlocked0 Dark List Accent 5;\\lsdpriority71 \\lsdlocked0 Colorful Shading Accent 5;",
        "\\s29\\ql \\li2160\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin2160\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 ",
        "20a6b16eb1d0d1010000000000000000000000004e00520053004b005500480034004d0057004500de004e00cd004300cc00cf004f00c500c800cb00c30041003d003d000000000000000000000000000000000032000101ffffffff0500000003000000000000000000000000000000000000000000000020a6b16eb1d0",
        "6409fb44d08741bdce9c0e4971624a2378cceaba830b05366b90e0ea23aaa241845368b0eb9e2612ca8c742851ca251ceccc70256d8d87265dd96361531f186c",
        "\\fi-360\\li6480\\jclisttab\\tx6480\\lin6480 }{\\listname ;}\\listid514420648}{\\list\\listtemplateid530381240{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'00.;}{\\levelnumbers\\'01;}",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Block Text;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Hyperlink;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 FollowedHyperlink;\\lsdqformat1 \\lsdpriority22 \\lsdlocked0 Strong;",
        "\\lsdpriority67 \\lsdlocked0 Medium Grid 1 Accent 4;\\lsdpriority68 \\lsdlocked0 Medium Grid 2 Accent 4;\\lsdpriority69 \\lsdlocked0 Medium Grid 3 Accent 4;\\lsdpriority70 \\lsdlocked0 Dark List Accent 4;\\lsdpriority71 \\lsdlocked0 Colorful Shading Accent 4;",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext24 Body 1;}{\\s25\\ql \\li720\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin720\\itap0 \\rtlch\\fcs1 ",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\s39\\fi-357\\li2506\\jclisttab\\tx2509\\lin2506 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1",
        "\\s1\\ql \\fi-357\\li357\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx360\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls26\\outlinelevel0\\adjustright\\rin0\\lin357\\itap0\\pararsid9003929 {\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935\\charrsid14122191 ",
        "\\lsdpriority72 \\lsdlocked0 Colorful List Accent 2;\\lsdpriority73 \\lsdlocked0 Colorful Grid Accent 2;\\lsdpriority60 \\lsdlocked0 Light Shading Accent 3;\\lsdpriority61 \\lsdlocked0 Light List Accent 3;\\lsdpriority62 \\lsdlocked0 Light Grid Accent 3;",
        "\\par }\\pard\\plain \\ltrpar\\ql \\li720\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin720\\itap0\\pararsid9003929 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 index 5;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 index 6;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 index 7;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 index 8;",
        "0000000000000000000000000000000020a6b16eb1d0d10120a6b16eb1d0d1010000000000000000000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff07000000ffffffff0000",
        "5d8a314d3c94e018c8de1a8fa94fd05093f43672e23d06af89927ac06762a049136785c10607758d9053d965021d62d6f6804fc08f86e4bef210c352c144dbab",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Classic 4;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Colorful 1;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Colorful 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Colorful 3;",
        "64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e62757369500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff000000000000",
        "7474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e627573696e6573732d69",
        "\\sbasedon0 \\snext8 \\slink22 \\sqformat heading 8;}{\\s9\\ql \\fi-358\\li3221\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx3223\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls21\\ilvl8\\outlinelevel8\\adjustright\\rin0\\lin3221\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 envelope address;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 envelope return;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 footnote reference;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 annotation reference;",
        "\\fi-360\\li2880\\jclisttab\\tx2880\\lin2880 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\'02\\'04.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 ",
        " The software may collect information about you and your use of the software and send that to Microsoft. Microsoft may use this information to provide \\hich\\af40\\dbch\\af11\\loch\\f40 services and improve }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid406406 ",
        "\\sbasedon0 \\snext4 \\slink18 \\sqformat heading 4;}{\\s5\\ql \\fi-357\\li1792\\ri0\\sb120\\sa120\\widctlpar\\tx1792\\jclisttab\\tx2155\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls21\\ilvl4\\outlinelevel4\\adjustright\\rin0\\lin1792\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 ",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid14971392\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 INSTALLATION AND USE RIGHTS.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid11798191\\charrsid2110843 ",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'07.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\fbias0\\hres0\\chhres0 \\fi-360\\li2880\\jclisttab\\tx2880\\lin2880 }{\\listlevel\\levelnfc2\\levelnfcn2\\leveljc0\\leveljcn0\\levelfollow0",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 jurisdiction and venue in the Superior Court of King County, Washington}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11996719\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  for all disputes heard in court (excluding arbitration)}{",
        "\\insrsid12285173\\charrsid12285173 \\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 You may install and use }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid16594239 ",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 to the licensed software.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 ",
        "\\fi-360\\li6480\\lin6480 }{\\listname ;}\\listid72362087}{\\list\\listtemplateid-2085821330{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01\\u-3913 ?;}{\\levelnumbers;}",
        "\\jclisttab\\tx3223\\lin3221 }{\\listname ;}\\listid562957195}{\\list\\listtemplateid1159212252{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'00.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 ",
        "\\lsdpriority67 \\lsdlocked0 Medium Grid 1 Accent 3;\\lsdpriority68 \\lsdlocked0 Medium Grid 2 Accent 3;\\lsdpriority69 \\lsdlocked0 Medium Grid 3 Accent 3;\\lsdpriority70 \\lsdlocked0 Dark List Accent 3;\\lsdpriority71 \\lsdlocked0 Colorful Shading Accent 3;",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext33 Bullet 1;}{\\s34\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 ",
        "\\fi-360\\li360\\lin360 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'04\\'00.\\'01.;}{\\levelnumbers\\'01\\'03;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-432\\li792\\lin792 }{\\listlevel",
        "\\levelindent0{\\leveltext\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\jclisttab\\tx6480\\lin6480 }{\\listname ;}\\listid1559511898}{\\list\\listtemplateid-743794326\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0",
        "\\jexpand\\viewkind1\\viewscale110\\pgbrdrhead\\pgbrdrfoot\\splytwnine\\ftnlytwnine\\htmautsp\\nolnhtadjtbl\\useltbaln\\alntblind\\lytcalctblwd\\lyttblrtgr\\lnbrkrule\\nobrkwrptbl\\snaptogridincell\\rempersonalinfo\\allowfieldendsel",
        "\\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  is intended to affect those rights.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid7227263\\charrsid9003929 ",
        "ur specific device or software}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 .}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid7227263\\charrsid9003929 ",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext0 \\slink119 Heading 1 Warranty;}{\\s48\\ql \\fi-360\\li720\\ri0\\sb120\\sa120\\widctlpar",
        "{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'01.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab\\ai0\\af0 \\ltrch\\fcs0 \\b\\i0\\fbias0\\hres0\\chhres0 \\s48\\fi-360\\li720\\jclisttab\\tx720\\lin720 }",
        "\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01\\u-3913 ?;}{\\levelnumbers;}\\b0\\i0\\strike0\\f3\\fs20\\ulnone\\fbias0\\hres0\\chhres0 \\fi-358\\li1435\\jclisttab\\tx1437\\lin1435 }{\\listlevel\\levelnfc1",
        "\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid-317712510\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-363\\li720\\jclisttab\\tx720\\lin720 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1",
        "\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li5760\\lin5760 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative",
        "e877f0034e16bafb0e258ebb4faf06b769e888340b103d3311da9750aa9d0a1cd3e4efca31a3508f6d0c5c5c398602f8e2ebc71591f5b616e24dd893aa3261fb",
        "{\\flomajor\\f31514\\fbidi \\froman\\fcharset178\\fprq2 Times New Roman (Arabic);}{\\flomajor\\f31515\\fbidi \\froman\\fcharset186\\fprq2 Times New Roman Baltic;}{\\flomajor\\f31516\\fbidi \\froman\\fcharset163\\fprq2 Times New Roman (Vietnamese);}",
        "\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'0c\\'00.\\'01.\\'02.\\'03.\\'04.\\'05.;}{\\levelnumbers\\'01\\'03\\'05\\'07\\'09\\'0b;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-936\\li2736\\lin2736 }{\\listlevel\\levelnfc0\\levelnfcn0",
        "\\fs20\\lang1026\\langfe2052\\super\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1026\\langfenp2052 \\sbasedon0 \\snext110 \\slink111 LIMPA_T4WINEXTERNAL;}{\\*\\cs111 \\additive \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 ",
        "\\ql \\li0\\ri0\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af0\\afs22\\alang1025 \\ltrch\\fcs0 \\fs22\\lang1033\\langfe1033\\loch\\f0\\hich\\af0\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon11 \\snext116 \\spriority59 ",
        "\\par }}{\\*\\aftnsep \\ltrpar \\pard\\plain \\ltrpar\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0\\pararsid2841647 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "CONSUMER RIGHTS; REGIONAL VARIATIONS.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  This agreement describes certain legal rights. You may have other rights, including consu\\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\fi-360\\li4680\\lin4680 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li5400\\lin5400 }",
        "{\\fdbmajor\\f31520\\fbidi \\fnil\\fcharset0\\fprq2 SimSun Western{\\*\\falt \\'cb\\'ce\\'cc\\'e5};}{\\fhimajor\\f31528\\fbidi \\froman\\fcharset238\\fprq2 Cambria CE;}{\\fhimajor\\f31529\\fbidi \\froman\\fcharset204\\fprq2 Cambria Cyr;}",
        "\\'02\\'03.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li2880\\jclisttab\\tx2880\\lin2880 }{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698713",
        "\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\jclisttab\\tx2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1",
        "\\widowctrl\\ftnbj\\aenddoc\\trackmoves0\\trackformatting0\\donotembedsysfont0\\relyonvml1\\donotembedlingdata0\\grfdocevents0\\validatexml1\\showplaceholdtext0\\ignoremixedcontent0\\saveinvalidxml0\\showxmlerrors1\\noxlattoyen",
        "\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li4320\\lin4320 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}",
        "\\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935\\charrsid14122191 \\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935\\charrsid14122191 \\hich\\af40\\dbch\\af11\\loch\\f40 If }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935 ",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7935102\\charrsid2110843 .}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11952046\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14578447\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 Y",
        "\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid14971392\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 work around any technical \\hich\\af40\\dbch\\af11\\loch\\f40 limitations in the software}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid9572917\\charrsid12455646 ",
        "7468656d65312e786d6cec594f6fdb3614bf0fd87720746f6327761a07758ad8b19b2d4d1bc46e871e698996d850a240d2497d1bdae38001c3ba618715d86d87",
        "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
        "{\\f11\\fbidi \\froman\\fcharset128\\fprq1{\\*\\panose 02020609040205080304}MS Mincho{\\*\\falt \\'82\\'6c\\'82\\'72 \\'96\\'be\\'92\\'a9};}{\\f34\\fbidi \\froman\\fcharset1\\fprq2{\\*\\panose 02040503050406030204}Cambria Math;}",
        "\\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext34 Bullet 2;}{\\s35\\ql \\fi-357\\li1077\\ri0\\sb120\\sa120\\widctlpar",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext39 Bullet 7;}{\\s40\\ql \\fi-357\\li2863\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx2866\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls8\\adjustright\\rin0\\lin2863\\itap0 ",
        "\\s53\\ql \\li1077\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin1077\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\ul\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 ",
        "\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'03(\\'03);}{\\levelnumbers\\'02;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li1440\\lin1440 }}{\\lfolevel\\listoverrideformat{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0\\levelfollow0",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698713\\'02\\'01.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li1440\\jclisttab\\tx1440\\lin1440 }{\\listlevel\\levelnfc2\\levelnfcn2\\leveljc2\\leveljcn2",
        "\\ltrch\\fcs0 \\insrsid339141\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 applications}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8781842\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40  that access or use the software}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "crosoft knew or should have known about the possibility of the damages. The above limitation or exclusion may not apply to you because your }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8743060 \\hich\\af40\\dbch\\af11\\loch\\f40 state, province, or }{\\rtlch\\fcs1 ",
        "\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext",
        "\\rtlch\\fcs1 \\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19 \\sbasedon10 \\slink47 \\slocked Heading 1 Warranty Char Char;}{\\s120\\ql \\li0\\ri0\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af31507\\afs22\\alang1025 \\ltrch\\fcs0 ",
        "\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\jclisttab\\tx2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0",
        "\\s44\\ql \\li0\\ri0\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0\\pararsid4602528 \\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {",
        "\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 ARBITRATION AND CLASS ACTION WAIVER}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935 \\loch\\af40\\dbch\\af11\\hich\\f40 \\'94}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935\\charrsid2110843 ",
        "\\ltrch\\fcs0 \\b\\insrsid15818407\\charrsid14158055 ",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li5760\\jclisttab\\tx5760\\lin5760 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext65 \\slink66 \\ssemihidden endnote text;}{\\*\\cs66 \\additive \\rtlch\\fcs1 \\af40\\afs20 \\ltrch\\fcs0 \\f40\\fs20 \\sbasedon10 \\slink65 \\slocked \\ssemihidden ",
        "share their data}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid5511034\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 . You can learn more about}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7935102\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40  Microsoft\\hich\\f40 ",
        "2db8df9f30254d30c1372581a1f51c983c80e4b71ccdd28dbf000000ffff0300504b0304140006000800000021000dd1909fb60000001b010000270000007468",
        "\\b0\\insrsid14971392\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 the software}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid935470\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 , provide}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 ",
        "\\af40 \\ltrch\\fcs0 \\insrsid1577493\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "DO_NOT_TRANSLATE;}{\\s104\\ql \\li0\\ri0\\sb120\\sa120\\sl480\\slmult1\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\fi-360\\li2160\\jclisttab\\tx2160\\lin2160 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\'02\\'03.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 ",
        "\\jclisttab\\tx1437\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls21\\ilvl3\\outlinelevel3\\adjustright\\rin0\\lin1435\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 ",
        "\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\b\\hres0\\chhres0 \\fi-360\\li720\\jclisttab\\tx720\\lin720 }{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'01.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 ",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 BINDING ARBITRATION AND CLASS ACTION WAIVER}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935 .}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935\\charrsid14122191 \\hich\\af40\\dbch\\af11\\loch\\f40  }{",
        "\\b\\i0\\f3\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li717\\jclisttab\\tx720\\lin717 }{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'01.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab\\ai0\\af40\\afs20 ",
        "not to sue in court in front of a judge or jury}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935\\charrsid14122191 \\hich\\af40\\dbch\\af11\\loch\\f40 . Instead, a neutral arbitrator will decide. }{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 ",
        "\\jclisttab\\tx3223\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls9\\adjustright\\rin0\\lin3221\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon32 \\snext41 Bullet 9;}{",
        "\\ltrch\\fcs0 \\b\\f40\\fs19 \\sbasedon10 \\slink35 \\slocked Bullet 3 Char1;}{\\s88\\ql \\fi-357\\li1077\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx1080\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls3\\adjustright\\rin0\\lin1077\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\f2\\cf11\\lang1024\\langfe1024\\noproof tw4winPopup;}{\\*\\cs101 \\additive \\f2\\cf10\\lang1024\\langfe1024\\noproof tw4winJump;}{\\*\\cs102 \\additive \\f2\\cf6\\lang1024\\langfe1024\\noproof tw4winInternal;}{\\*\\cs103 \\additive \\f2\\cf13\\lang1024\\langfe1024\\noproof ",
        "\\lsdpriority52 \\lsdlocked0 Grid Table 7 Colorful Accent 5;\\lsdpriority46 \\lsdlocked0 Grid Table 1 Light Accent 6;\\lsdpriority47 \\lsdlocked0 Grid Table 2 Accent 6;\\lsdpriority48 \\lsdlocked0 Grid Table 3 Accent 6;",
        "\\lsdpriority69 \\lsdlocked0 Medium Grid 3;\\lsdpriority70 \\lsdlocked0 Dark List;\\lsdpriority71 \\lsdlocked0 Colorful Shading;\\lsdpriority72 \\lsdlocked0 Colorful List;\\lsdpriority73 \\lsdlocked0 Colorful Grid;\\lsdpriority60 \\lsdlocked0 Light Shading Accent 1;",
        "\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'03(\\'03);}{\\levelnumbers\\'02;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\jclisttab\\tx1440\\lin1440 }{\\listlevel\\levelnfc4",
        "\\par }}{\\*\\pnseclvl1\\pnucrm\\pnstart1\\pnindent720\\pnhang {\\pntxta .}}{\\*\\pnseclvl2\\pnucltr\\pnstart1\\pnindent720\\pnhang {\\pntxta .}}{\\*\\pnseclvl3\\pndec\\pnstart1\\pnindent720\\pnhang {\\pntxta .}}{\\*\\pnseclvl4\\pnlcltr\\pnstart1\\pnindent720\\pnhang {\\pntxta )}}",
        "\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li2520\\lin2520 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 ",
        "\\af40 \\ltrch\\fcs0 \\insrsid9572917\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 Separate and apart from your relationship with Microsoft, y}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\levelnfcn4\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'06.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\s7\\fi-357\\li2506\\jclisttab\\tx2509\\lin2506 }",
        "not obligated under this agreement to }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 provide }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14578447\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 any }{\\rtlch\\fcs1 ",
        "\\fi-360\\li2880\\lin2880 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li3600\\lin3600 }",
        "\\rtlch\\fcs1 \\ab\\ai0\\af0\\afs20 \\ltrch\\fcs0 \\b\\i0\\fs20\\fbias0\\hres0\\chhres0 \\fi-363\\li720\\jclisttab\\tx720\\lin720 }{\\listlevel\\levelnfc2\\levelnfcn2\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'02.;}{\\levelnumbers",
        "\\f31506\\fs22\\lang1033\\langfe1033\\cgrid\\langnp1033\\langfenp1033 \\snext120 \\sqformat \\spriority1 No Spacing;}{\\*\\cs121 \\additive \\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\f0\\fs16 \\sbasedon10 \\ssemihidden DocID;}}{\\*\\listtable{\\list\\listtemplateid915539384\\listhybrid",
        "204d696e696d756d56657273696f6e3d22352e332e302e302220786d6c6e733d22687474703a2f2f736368656d61732e627573696e6573732d696e746567726974792e636f6d2f6465616c6275696c6465722f323030362f64696374696f6e617279222f3e00000000000000000000000000000000000000000000000000",
        "{\\listoverride\\listid2091727482\\listoverridecount0\\ls30}{\\listoverride\\listid1182742101\\listoverridecount0\\ls31}{\\listoverride\\listid14618468\\listoverridecount0\\ls32}{\\listoverride\\listid14618468\\listoverridecount0\\ls33}}{\\*\\pgptbl {\\pgp\\ipgp21\\itap0\\li0",
        "\\s2\\ql \\fi-360\\li717\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls14\\ilvl1\\outlinelevel1\\adjustright\\rin0\\lin717\\itap0\\pararsid9003929 \\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "Footer Char;}{\\s85\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\ab\\af40\\afs20\\alang1025 \\ltrch\\fcs0 \\fs20\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 ",
        "\\fi-360\\li5040\\lin5040 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li5760\\lin5760 }",
        "{\\f45\\fbidi \\froman\\fcharset204\\fprq2 Times New Roman Cyr;}{\\f47\\fbidi \\froman\\fcharset161\\fprq2 Times New Roman Greek;}{\\f48\\fbidi \\froman\\fcharset162\\fprq2 Times New Roman Tur;}{\\f49\\fbidi \\froman\\fcharset177\\fprq2 Times New Roman (Hebrew);}",
        "\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0",
        "\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'03(\\'05);}{\\levelnumbers\\'02;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li2160\\lin2160 }}{\\lfolevel\\listoverrideformat{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0",
        "6d652f7468656d654d616e616765722e786d6c0ccc4d0ac3201040e17da17790d93763bb284562b2cbaebbf600439c1a41c7a0d29fdbd7e5e38337cedf14d59b",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698715\\'02\\'05.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-180\\li4320\\jclisttab\\tx4320\\lin4320 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0",
        "\\tqc\\tx4320\\tqr\\tx8640\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "UPDATES.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid1984800\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40  The software may periodically check for updates, and download and install them for you. You may obtain updates only from Microsoft or authorized sources",
        "{\\f50\\fbidi \\froman\\fcharset178\\fprq2 Times New Roman (Arabic);}{\\f51\\fbidi \\froman\\fcharset186\\fprq2 Times New Roman Baltic;}{\\f52\\fbidi \\froman\\fcharset163\\fprq2 Times New Roman (Vietnamese);}{\\f64\\fbidi \\fmodern\\fcharset238\\fprq1 Courier New CE;}",
        "79482a9c0498f184b4bd2991deb58df7dfbb8ad755446282607d22d771db8b944ad79796a40fc3585ee62949606ecc458c15bc8a702910f808e8c66c69b9565b",
        "180000004d73786d6c322e534158584d4c5265616465722e362e3000000000000000000000100000",
        "\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\jclisttab\\tx2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11952046\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 consent to exclusive jurisdiction and venue in the federal court in King County, Washington}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11996719\\charrsid9003929 ",
        "\\lsdpriority50 \\lsdlocked0 Grid Table 5 Dark Accent 3;\\lsdpriority51 \\lsdlocked0 Grid Table 6 Colorful Accent 3;\\lsdpriority52 \\lsdlocked0 Grid Table 7 Colorful Accent 3;\\lsdpriority46 \\lsdlocked0 Grid Table 1 Light Accent 4;",
        "\\sbasedon10 \\slink74 \\slocked \\ssemihidden Balloon Text Char;}{\\*\\cs76 \\additive \\rtlch\\fcs1 \\ab\\af41 \\ltrch\\fcs0 \\b\\f41\\lang1033\\langfe1033\\langnp1033\\langfenp1033 \\sbasedon10 Heading 2 Char1;}{\\*\\cs77 \\additive \\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\sbasedon10 ",
        "\\'02\\'03.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\strike0\\f41\\fs20\\ulnone\\fbias0\\hres0\\chhres0 \\fi-358\\li1435\\jclisttab\\tx1437\\lin1435 }{\\listlevel\\levelnfc1\\levelnfcn1\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1",
        "\\jclisttab\\tx3600\\lin3600 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li4320\\jclisttab\\tx4320\\lin4320 }{\\listlevel",
        "\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'08.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\fbias0\\hres0\\chhres0 \\fi-360\\li3240\\jclisttab\\tx3240\\lin3240 }{\\listname ;}\\listid394402059}{\\list\\listtemplateid1399633684{\\listlevel",
        "\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li2880\\jclisttab\\tx2880\\lin2880 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li3600",
        "\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li5040\\lin5040 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0",
        "Body Text Indent Char;}{\\s56\\ql \\fi-358\\li1435\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx1437\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls4\\adjustright\\rin0\\lin1435\\itap0 \\rtlch\\fcs1 \\ai\\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\cs121\\f0\\fs16\\insrsid1998008\\charrsid7233124 \\hich\\af0\\dbch\\af11\\loch\\f0 DWT 28909236v1 0085000-001126}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\insrsid5452915\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 U.S. }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11952046\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 federal jurisdiction exists, you }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "}{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\jclisttab\\tx6480\\lin6480 }{\\listname ",
        "\\jclisttab\\tx360\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls26\\outlinelevel0\\adjustright\\rin0\\lin357\\itap0\\pararsid12455646 {\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid14971392\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 SCOPE OF LICENSE.}{\\rtlch\\fcs1 \\af40 ",
        "\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'0a\\'00.\\'01.\\'02.\\'03.\\'04.;}{\\levelnumbers\\'01\\'03\\'05\\'07\\'09;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-792\\li2232\\lin2232 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0",
        "\\s2\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\outlinelevel1\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 ",
        "anything related to the software, services, content (including code) on third party Internet s\\hich\\af40\\dbch\\af11\\loch\\f40 ites, or third party }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid13202321\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 applications}{",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 are not allowed}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935\\charrsid14122191 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 , province,}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Contemporary;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Elegant;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Professional;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Subtle 1;",
        " required user consent, and maintain a prominent privacy policy that accurately informs users about how you use}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9572917\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 , collect, and \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\red0\\green255\\blue255;\\red0\\green255\\blue0;\\red255\\green0\\blue255;\\red255\\green0\\blue0;\\red255\\green255\\blue0;\\red255\\green255\\blue255;\\red0\\green0\\blue128;\\red0\\green128\\blue128;\\red0\\green128\\blue0;\\red128\\green0\\blue128;\\red128\\green0\\blue0;",
        "\\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\snext0 \\slink109 Body 0 Bold;}{\\s80\\ql \\li0\\ri0\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 ",
        "\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid6121706 \\chftnsep ",
        "{\\sp{\\sn fFlipV}{\\sv 0}}{\\sp{\\sn fillColor}{\\sv 10526880}}{\\sp{\\sn fFilled}{\\sv 1}}{\\sp{\\sn fLine}{\\sv 0}}{\\sp{\\sn alignHR}{\\sv 1}}{\\sp{\\sn dxHeightHR}{\\sv 30}}{\\sp{\\sn fStandardHR}{\\sv 1}}{\\sp{\\sn fHorizRule}{\\sv 1}}{\\sp{\\sn fLayoutInCell}{\\sv 1}}}",
        "\\lsdpriority51 \\lsdlocked0 List Table 6 Colorful Accent 3;\\lsdpriority52 \\lsdlocked0 List Table 7 Colorful Accent 3;\\lsdpriority46 \\lsdlocked0 List Table 1 Light Accent 4;\\lsdpriority47 \\lsdlocked0 List Table 2 Accent 4;",
        "{\\f2\\fbidi \\fmodern\\fcharset0\\fprq1{\\*\\panose 02070309020205020404}Courier New;}{\\f3\\fbidi \\froman\\fcharset2\\fprq2{\\*\\panose 05050102010706020507}Symbol;}{\\f10\\fbidi \\fnil\\fcharset2\\fprq2{\\*\\panose 05000000000000000000}Wingdings;}",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9190298 \\hich\\af40\\dbch\\af11\\loch\\f40 ; or any other claim; in each case}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9190298\\charrsid339141 \\hich\\af40\\dbch\\af11\\loch\\f40  to the extent permitted by applicable law.}{",
        "\\listoverridecount0\\ls16}{\\listoverride\\listid1349603174\\listoverridecount0\\ls17}{\\listoverride\\listid398796681\\listoverridecount0\\ls18}{\\listoverride\\listid208151644\\listoverridecount0\\ls19}{\\listoverride\\listid1157527705\\listoverridecount0\\ls20}",
        "\\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4067708 \\hich\\af40\\dbch\\af11\\loch\\f40 BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\lang9\\langfe1033\\langnp9\\insrsid15818407\\charrsid2110843 ",
        "\\fi-360\\li4320\\lin4320 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 ",
        "such services or updates are accompanied by new or }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8403787\\charrsid339141 \\hich\\af40\\dbch\\af11\\loch\\f40 additional terms}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8403787 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\'02\\'07.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li5760\\jclisttab\\tx5760\\lin5760 }{\\listlevel\\levelnfc2\\levelnfcn2\\leveljc2\\leveljcn2\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698715",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 s}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11952046\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  principles}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11996719\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 , except that the }{",
        "\\sbasedon0 \\snext26 Body 3;}{\\s27\\ql \\li1435\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin1435\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "reverse engineer, decompile or disassemble the software;}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid15818407\\charrsid12455646 ",
        "\\sbasedon0 \\snext6 \\slink20 \\sqformat heading 6;}{\\s7\\ql \\fi-357\\li2506\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx2509\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls21\\ilvl6\\outlinelevel6\\adjustright\\rin0\\lin2506\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Outline List 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Outline List 3;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Simple 1;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Simple 2;",
        "\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li5040\\jclisttab\\tx5040\\lin5040 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0",
        "b21be5ceaf8a49f90b52a51cc6ff3355f47e0237052b81f6800fd7b802239daf6d8f0b1571a8426944fdbe80c6c1d40e8816b88b8569082ab84c36ff0539d4ff",
        "\\af40 \\ltrch\\fcs0 \\insrsid9190298\\charrsid339141 \\hich\\af40\\dbch\\af11\\loch\\f40  negligence}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9190298 ,}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9190298\\charrsid339141 \\hich\\af40\\dbch\\af11\\loch\\f40  or other tort}{",
        "\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li720\\lin720 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 ",
        "\\levelindent0{\\leveltext\\leveltemplateid612407812\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\cf18\\fbias0\\hres0\\chhres0 \\s36\\fi-358\\li1435\\jclisttab\\tx1437\\lin1435 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0",
        "\\par }\\pard\\plain \\ltrpar\\s1\\ql \\li357\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\outlinelevel0\\adjustright\\rin0\\lin357\\itap0\\pararsid10583668 \\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'0e\\'00.\\'01.\\'02.\\'03.\\'04.\\'05.\\'06.;}{\\levelnumbers\\'01\\'03\\'05\\'07\\'09\\'0b\\'0d;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-1080\\li3240\\lin3240 }{\\listlevel",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s34 \\rtlch\\fcs1 \\ab\\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19\\insrsid14971392\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 a)\\tab}}\\pard\\plain \\ltrpar\\s34\\ql \\fi-363\\li720\\ri0\\sb120\\sa120\\widctlpar",
        "Bullet 4 Underline;}{\\s51\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "{\\fhimajor\\f31536\\fbidi \\froman\\fcharset163\\fprq2 Cambria (Vietnamese);}{\\fbimajor\\f31538\\fbidi \\froman\\fcharset238\\fprq2 Times New Roman CE;}{\\fbimajor\\f31539\\fbidi \\froman\\fcharset204\\fprq2 Times New Roman Cyr;}",
        "\\fi-360\\li4320\\jclisttab\\tx4320\\lin4320 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\'02\\'06.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 ",
        "{\\fhiminor\\f31575\\fbidi \\fswiss\\fcharset186\\fprq2 Calibri Baltic;}{\\fhiminor\\f31576\\fbidi \\fswiss\\fcharset163\\fprq2 Calibri (Vietnamese);}{\\fbiminor\\f31578\\fbidi \\fswiss\\fcharset238\\fprq2 Arial CE;}",
        "\\fi-360\\li3960\\lin3960 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 ",
        "{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935\\charrsid14122191 \\hich\\af40\\dbch\\af11\\loch\\f40  agree to try for 60 days to resolve it informally. If }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935 \\hich\\af40\\dbch\\af11\\loch\\f40 you and Microsoft}{",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 HTML Variable;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 annotation subject;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 No List;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Outline List 1;",
        "b16eb1d0d10103000000c0040000000000004d0073006f004400610074006100530074006f0072006500000000000000000000000000000000000000000000000000000000000000000000000000000000001a000101ffffffffffffffff02000000000000000000000000000000000000000000000020a6b16eb1d0d101",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 HTML Keyboard;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 HTML Preformatted;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 HTML Sample;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 HTML Typewriter;",
        "\\expshrtn\\noultrlspc\\dntblnsbdb\\nospaceforul\\hyphcaps0\\formshade\\horzdoc\\dgmargin\\dghspace95\\dgvspace180\\dghorigin1440\\dgvorigin1440\\dghshow2\\dgvshow1",
        "\\insrsid8781842\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40  any}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid339141\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\hich\\af40\\dbch\\af11\\loch\\f40  that only allow you to use it in certain ways}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid14971392\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 ;}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid15818407\\charrsid12455646 ",
        "Heading 9 Char;}{\\s24\\ql \\li357\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin357\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\s113\\ql \\li720\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin720\\itap0\\contextualspace \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'01);}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li720\\lin720 }}{\\lfolevel\\listoverrideformat{\\listlevel\\levelnfc2\\levelnfcn2\\leveljc0\\leveljcn0\\levelfollow0",
        "\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid15818407 ",
        "\\insrsid14971392\\charrsid2771280 .}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14578447\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8394664 \\hich\\af40\\dbch\\af11\\loch\\f40 A}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "8b37a088d1e4600ead1ddaef67d40bc898b3ed4af81ac0d76a197c86826828a24bb318f3442d8ab518dfe3a20f000d6458d104a9694ac6d88728eee2782428d6",
        "\\ltrch\\fcs0 \\lang9\\langfe1033\\langnp9\\insrsid13051670\\charrsid2110843 .}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\lang9\\langfe1033\\langnp9\\insrsid8875785\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li2163\\lin2163 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 ",
        "\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li2880\\jclisttab\\tx2880\\lin2880 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext",
        "\\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid5452915\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 may provide }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "c7060abb0884a4eff7a93dfeae8bf9e194e720169aaa06c3e2433fcb68e1763dbf7f82c985a4a725085b787086a37bdbb55fbc50d1a33ccd311ba548b6309512",
        "\\par }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9003929\\charrsid4136656 \\hich\\af40\\dbch\\af11\\loch\\f40 It also applies even if Mi\\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\lsdpriority48 \\lsdlocked0 Grid Table 3 Accent 5;\\lsdpriority49 \\lsdlocked0 Grid Table 4 Accent 5;\\lsdpriority50 \\lsdlocked0 Grid Table 5 Dark Accent 5;\\lsdpriority51 \\lsdlocked0 Grid Table 6 Colorful Accent 5;",
        "\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li2880\\lin2880 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers",
        "\\insrsid14578447\\charrsid2771280 ,}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid1984800\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40  or peripheral devices.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid1984800\\charrsid2771280 ",
        "\\lsdpriority63 \\lsdlocked0 Medium Shading 1 Accent 4;\\lsdpriority64 \\lsdlocked0 Medium Shading 2 Accent 4;\\lsdpriority65 \\lsdlocked0 Medium List 1 Accent 4;\\lsdpriority66 \\lsdlocked0 Medium List 2 Accent 4;",
        "\\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\snext0 Body 0;}{\\s81\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid15818407\\charrsid9003929 ",
        "\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01\\u-3913 ?;}{\\levelnumbers;}\\b\\i0\\f3\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li357\\jclisttab\\tx360\\lin357 }{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0",
        "{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li2880\\lin2880 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext",
        "\\levelindent0{\\leveltext\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\jclisttab\\tx1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0",
        "{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li2880\\jclisttab\\tx2880\\lin2880 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext",
        "{\\flominor\\f31548\\fbidi \\froman\\fcharset238\\fprq2 Times New Roman CE;}{\\flominor\\f31549\\fbidi \\froman\\fcharset204\\fprq2 Times New Roman Cyr;}{\\flominor\\f31551\\fbidi \\froman\\fcharset161\\fprq2 Times New Roman Greek;}",
        "9cb2400825e982c78ec7a27cc0c8992416c9d8b2a755fbf74cd25442a820166c2cd933f79e3be372bd1f07b5c3989ca74aaff2422b24eb1b475da5df374fd9ad",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid6121706 \\chftnsepc ",
        "\\lsdpriority72 \\lsdlocked0 Colorful List Accent 5;\\lsdpriority73 \\lsdlocked0 Colorful Grid Accent 5;\\lsdpriority60 \\lsdlocked0 Light Shading Accent 6;\\lsdpriority61 \\lsdlocked0 Light List Accent 6;\\lsdpriority62 \\lsdlocked0 Light Grid Accent 6;",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li4320\\lin4320 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1",
        ";}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li3600\\lin3600 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}",
        "\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'00.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab\\ai0\\af40\\afs20 \\ltrch\\fcs0 \\b\\i0\\f40\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li357\\jclisttab\\tx360\\lin357 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext7 \\slink21 \\sqformat heading 7;}{\\s8\\ql \\fi-357\\li2863\\ri0\\sb120\\sa120\\widctlpar",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Body Text 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Body Text 3;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Body Text Indent 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Body Text Indent 3;",
        "\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li720\\lin720 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691",
        "44f95d843b5974bb5c04f4edafb95b7892ec1108f3f98de75dc97d5772bdff7cc95d94cf672db4b3da0a6557f70db629362d72bcb0431e53c6066acac80d699a",
        "\\rtlch\\fcs1 \\ab\\ai0\\af40\\afs20 \\ltrch\\fcs0 \\b\\i0\\f40\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li1077\\jclisttab\\tx1440\\lin1077 }{\\listlevel\\levelnfc3\\levelnfcn3\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext",
        "51440ca2e0088dd844ec6370bf0e55d027a012ae264c45d02f708fa6ad6da6dce29c255df9f6cae0ec38666984b372ab5334cf640b37795cc860de4ae2816e95",
        "\\loch\\f40 \\hich\\f40 FAA\\'94\\loch\\f40 )}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935\\charrsid14122191 \\hich\\af40\\dbch\\af11\\loch\\f40 , and }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid4879935\\charrsid4879935 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li5760\\lin5760 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0",
        "\\sbasedon26 \\snext53 Body 3 Underline;}{\\s54\\ql \\li0\\ri0\\sb120\\sa120\\sl480\\slmult1\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 index heading;\\lsdsemihidden1 \\lsdunhideused1 \\lsdqformat1 \\lsdpriority35 \\lsdlocked0 caption;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 table of figures;",
        "\\insrsid9572917\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 foregoing clause (ii)}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid2033377338\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\s35\\fi-357\\li1077\\jclisttab\\tx1080\\lin1077 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0",
        "\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'03(\\'04);}{\\levelnumbers\\'02;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li1800\\lin1800 }}{\\lfolevel\\listoverrideformat{\\listlevel\\levelnfc2\\levelnfcn2\\leveljc0\\leveljcn0\\levelfollow0",
        "{\\flominor\\f31504\\fbidi \\froman\\fcharset0\\fprq2{\\*\\panose 02020603050405020304}Times New Roman;}{\\fdbminor\\f31505\\fbidi \\fnil\\fcharset134\\fprq2{\\*\\panose 02010600030101010101}SimSun{\\*\\falt \\'cb\\'ce\\'cc\\'e5};}",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 This limitation applies to}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 ",
        "\\'01\\u-3913 ?;}{\\levelnumbers;}\\b\\i0\\f3\\fs20\\fbias0\\hres0\\chhres0 \\fi-363\\li720\\jclisttab\\tx720\\lin720 }{\\listlevel\\levelnfc2\\levelnfcn2\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'02.;}{\\levelnumbers\\'01;}",
        "\\cs118\\b\\lang9\\langfe1033\\langnp9\\insrsid869748\\charrsid3034803 \\hich\\af40\\dbch\\af11\\loch\\f40 TERMINATION.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid869748\\charrsid3034803 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "4b0d592c9c070d8a65cd2e88b7f07c2ca71ba8da481cc52c6ce1c715e6e97818c9b48d13df49c873517d23d59085adb5dd20d6b52bd521ef2cdd5eb9246a3d8b",
        "\\lsdpriority47 \\lsdlocked0 Grid Table 2 Accent 4;\\lsdpriority48 \\lsdlocked0 Grid Table 3 Accent 4;\\lsdpriority49 \\lsdlocked0 Grid Table 4 Accent 4;\\lsdpriority50 \\lsdlocked0 Grid Table 5 Dark Accent 4;",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext78 Char Char Char Char1;}{\\s79\\ql \\li0\\ri0\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 ",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 ting).}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid15818407\\charrsid2771280 ",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s1 \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 \\b\\f40\\fs20\\insrsid9003929\\charrsid4136656 \\hich\\af40\\dbch\\af11\\loch\\f40 13.\\tab}}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid9003929\\charrsid4136656 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Signature;\\lsdsemihidden1 \\lsdunhideused1 \\lsdpriority1 \\lsdlocked0 Default Paragraph Font;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Body Text;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Body Text Indent;",
        "{\\flominor\\f31552\\fbidi \\froman\\fcharset162\\fprq2 Times New Roman Tur;}{\\flominor\\f31553\\fbidi \\froman\\fcharset177\\fprq2 Times New Roman (Hebrew);}{\\flominor\\f31554\\fbidi \\froman\\fcharset178\\fprq2 Times New Roman (Arabic);}",
        "\\b\\f40\\fs20\\lang1026\\langfe2052\\super\\langnp1026\\langfenp2052 \\sbasedon10 \\slink110 \\slocked LIMPA_T4WINEXTERNAL Char;}{\\s112\\ql \\li0\\ri0\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 ",
        "\\s114\\ql \\li0\\ri0\\sb100\\sa100\\sbauto1\\saauto1\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af0\\afs24\\alang1025 \\ltrch\\fcs0 \\b\\fs24\\lang1033\\langfe1033\\loch\\f0\\hich\\af0\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 ",
        "\\af40 \\ltrch\\fcs0 \\insrsid4879935\\charrsid14122191 \\hich\\af40\\dbch\\af11\\loch\\f40  and a\\hich\\af40\\dbch\\af11\\loch\\f40 ny other proceeding where someone acts in a representative capacity }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid4879935\\charrsid4879935 ",
        "\\lsdpriority49 \\lsdlocked0 List Table 4 Accent 1;\\lsdpriority50 \\lsdlocked0 List Table 5 Dark Accent 1;\\lsdpriority51 \\lsdlocked0 List Table 6 Colorful Accent 1;\\lsdpriority52 \\lsdlocked0 List Table 7 Colorful Accent 1;",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\snext0 \\sautoupd \\sqformat \\spriority0 Normal;}{\\s1\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\outlinelevel0\\adjustright\\rin0\\lin0\\itap0 ",
        "\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\jclisttab\\tx2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}",
        "617020786d6c6e733a613d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f64726177696e676d6c2f323030362f6d6169",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List Continue 5;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Message Header;\\lsdqformat1 \\lsdpriority11 \\lsdlocked0 Subtitle;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Salutation;",
        "\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1080\\lin1080 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}",
        "\\par }\\pard\\plain \\ltrpar\\s1\\ql \\li720\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\outlinelevel0\\adjustright\\rin0\\lin720\\itap0\\pararsid9003929 \\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\fi-357\\li2149\\jclisttab\\tx2152\\lin2149 }{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'06.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 ",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11952046\\charrsid9003929 .}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid15818407\\charrsid2501791 ",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s1 \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 \\b\\f40\\fs20\\insrsid7227263\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 11.\\tab}}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid7227263\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\fi-360\\li6480\\lin6480 }{\\listname ;}\\listid1349603174}{\\list\\listtemplateid1515209974\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689",
        "\\'02\\'02.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-180\\li2160\\jclisttab\\tx2160\\lin2160 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698703",
        "Heading French Warranty;}{\\*\\cs94 \\additive \\f40\\lang1033\\langfe0\\langnp1033\\langfenp0 \\slocked Body 3 Char Car Car Car Car Car Car Car Car Car Car Car Car Car Car Car Car Car Car Car Car Car Car Car Car;}{\\*\\cs95 \\additive ",
        "{\\listlevel\\levelnfc2\\levelnfcn2\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'02);}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\fbias0\\hres0\\chhres0 \\fi-360\\li1080\\jclisttab\\tx1080\\lin1080 }{\\listlevel",
        "\\par }{\\*\\themedata 504b030414000600080000002100e9de0fbfff0000001c020000130000005b436f6e74656e745f54797065735d2e786d6cac91cb4ec3301045f748fc83e52d4a",
        "the software will resume checking for and installing updates)}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9572917\\charrsid9003929 ,}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid615889\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  or uninstalling the software. }{",
        "ffffffffffffffffffffffffffffffff52006f006f007400200045006e00740072007900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000500ffffffffffffffff010000000c6ad98892f1d411a65f0040963251e500000000000000000000000020a6",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext27 Body 4;}{\\s28\\ql \\li1803\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin1803\\itap0 \\rtlch\\fcs1 ",
        " U.S. $5.00. YOU CANNOT RECOVER ANY OTHER DAMAGES, INCLUDING CONSEQUENTIAL, LOST PROFITS, SPECIAL, INDIRECT OR INCIDENTAL DAMAGES}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid14971392\\charrsid9003929 .}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s1 \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 \\b\\f40\\fs20\\insrsid14971392\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 5.\\tab}}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid14971392\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\insrsid7406168\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40  The software may include third party applications that Microsoft, not the third party, licenses to you under this agr\\hich\\af40\\dbch\\af11\\loch\\f40 eement. }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\sbasedon0 \\snext2 \\slink16 \\sqformat heading 2;}{\\s3\\ql \\fi-357\\li1077\\ri0\\sb120\\sa120\\widctlpar\\tx1077\\jclisttab\\tx1440\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls21\\ilvl2\\outlinelevel2\\adjustright\\rin0\\lin1077\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 ",
        "\\lsdpriority49 \\lsdlocked0 List Table 4 Accent 5;\\lsdpriority50 \\lsdlocked0 List Table 5 Dark Accent 5;\\lsdpriority51 \\lsdlocked0 List Table 6 Colorful Accent 5;\\lsdpriority52 \\lsdlocked0 List Table 7 Colorful Accent 5;",
        "\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li5760\\jclisttab\\tx5760\\lin5760 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 one}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid5844502\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 cop}{\\rtlch\\fcs1 \\af40 ",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Date;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Body Text First Indent;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Body Text First Indent 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Note Heading;",
        "\\red128\\green128\\blue0;\\red128\\green128\\blue128;\\red192\\green192\\blue192;\\cfollowedhyperlink\\ctint255\\cshade255\\red128\\green0\\blue128;\\ctextone\\ctint255\\cshade255\\red0\\green0\\blue0;}{\\*\\defchp \\fs22\\dbch\\af11 }{\\*\\defpap \\ql \\li0\\ri0\\sa200\\sl276\\slmult1",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Grid 4;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Grid 5;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Grid 6;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Grid 7;",
        "{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li720\\lin720 }{\\listlevel\\levelnfc23\\levelnfcn23",
        "699640f6719e76b7d6ac355c7c89feca9cccad4ea7d36c65b258a206641f1b73f8b5da6a6373d9c11b90c537e7f08dce66b7bbeae00dc8e257e7f0fd2badd586",
        "\\lsdpriority52 \\lsdlocked0 List Table 7 Colorful Accent 4;\\lsdpriority46 \\lsdlocked0 List Table 1 Light Accent 5;\\lsdpriority47 \\lsdlocked0 List Table 2 Accent 5;\\lsdpriority48 \\lsdlocked0 List Table 3 Accent 5;",
        "\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext1 Preamble Border;}{",
        "{\\fhiminor\\f31506\\fbidi \\fswiss\\fcharset0\\fprq2{\\*\\panose 020f0502020204030204}Calibri;}{\\fbiminor\\f31507\\fbidi \\fswiss\\fcharset0\\fprq2{\\*\\panose 020b0604020202020204}Arial;}{\\f44\\fbidi \\froman\\fcharset238\\fprq2 Times New Roman CE;}",
        "\\lang9\\langfe1033\\langnp9\\insrsid14971392\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 IF YOU COMPLY WITH THESE LICENSE TERMS, YOU HAVE THE}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\lang9\\langfe1033\\langnp9\\insrsid16415067\\charrsid2110843 ",
        "\\par }\\pard\\plain \\ltrpar\\s24\\ql \\li357\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin357\\itap0\\pararsid9003929 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\b\\insrsid5511034\\charrsid2110843 .}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid5511034\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\jclisttab\\tx1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext",
        "\\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 , }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid5452915\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 is}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid9003929 ",
        "\\jclisttab\\tx2866\\lin2863 }{\\listlevel\\levelnfc255\\levelnfcn255\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02A.;}{\\levelnumbers;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\s9",
        "\\jclisttab\\tx2155\\lin1792 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'05.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 ",
        "\\s39\\ql \\fi-357\\li2506\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx2509\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls7\\adjustright\\rin0\\lin2506\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\ltrch\\fcs0 \\insrsid10845592\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid5511034\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 documentation and the }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\levelspace0\\levelindent0{\\leveltext\\'02\\'05.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li2509\\jclisttab\\tx2512\\lin2509 }{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0\\levelfollow0",
        "2f2f736368656d61732e627573696e6573732d696e746567726974792e636f6d2f6465616c6275696c6465722f323030362f616e7377657273222f3e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 breach, and all other claims (including consumer protection, unfair competition\\hich\\af40\\dbch\\af11\\loch\\f40 , and tort claims), regardless of conflict of law}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11996719\\charrsid9003929 ",
        "\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext25 Body 2;}{",
        "\\lsdpriority49 \\lsdlocked0 Grid Table 4 Accent 6;\\lsdpriority50 \\lsdlocked0 Grid Table 5 Dark Accent 6;\\lsdpriority51 \\lsdlocked0 Grid Table 6 Colorful Accent 6;\\lsdpriority52 \\lsdlocked0 Grid Table 7 Colorful Accent 6;",
        "\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li2880\\lin2880 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative",
        "\\af40 \\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 ",
        "\\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 support services for }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14578447\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 the software}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li5040\\lin5040 }{\\listlevel\\levelnfc23",
        "\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\jclisttab\\tx2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext",
        "\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\jclisttab\\tx2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01\\u-3913 ?;}{\\levelnumbers;}",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Grid 8;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table List 1;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table List 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table List 3;",
        "\\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\fi-358\\li3221\\jclisttab\\tx3223\\lin3221 }{\\listname ;}\\listid398796681}{\\list\\listtemplateid789093748\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0",
        "\\b\\f40\\fs19 \\sbasedon10 \\slink5 \\slocked Heading 5 Char;}{\\*\\cs20 \\additive \\rtlch\\fcs1 \\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19 \\sbasedon10 \\slink6 \\slocked Heading 6 Char;}{\\*\\cs21 \\additive \\rtlch\\fcs1 \\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19 ",
        "\\s26\\ql \\li1077\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin1077\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 ",
        "\\par }}{\\*\\aftnsepc \\ltrpar \\pard\\plain \\ltrpar\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0\\pararsid2841647 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp15\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp22\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp2\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp33\\itap0\\li0\\ri0\\sb0\\sa0}}{\\*\\rsidtbl \\rsid6121706\\rsid8391759}{\\mmathPr\\mmathFont34\\mbrkBin0\\mbrkBinSub0\\msmallFrac0",
        "\\listoverridecount0\\ls25}{\\listoverride\\listid562957195\\listoverridecount0\\ls26}{\\listoverride\\listid937249388\\listoverridecount0\\ls27}{\\listoverride\\listid959527732\\listoverridecount0\\ls28}{\\listoverride\\listid760681750\\listoverridecount0\\ls29}",
        "\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\jclisttab\\tx1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0",
        "\\cs121\\f0\\fs16\\insrsid1998008\\charrsid7233124 \\hich\\af0\\dbch\\af11\\loch\\f0 DWT 28909236v1 0085000-001126}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid1998008 ",
        "\\fi-360\\li2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 ",
        "\\par }\\sectd \\ltrsect\\psz1\\linex0\\headery0\\footery0\\endnhere\\sectlinegrid360\\sectdefaultcl\\sectrsid16390706\\sftnbj {\\footerl \\ltrpar \\pard\\plain \\ltrpar\\s83\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar",
        "}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14578447\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 \\hich\\f40 is \\'93\\loch\\f40 \\hich\\f40 as is\\'94\\loch\\f40 \\hich\\f40 , \\'93\\loch\\f40 \\hich\\f40 with all faults\\'94\\loch\\f40 , and without warranty of any kind.}{",
        ";}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Columns 1;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Columns 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Columns 3;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Columns 4;",
        "\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li2880\\lin2880 }{\\listlevel\\levelnfc23",
        "\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\lin6480 }{\\listname ;}\\listid14618468}{\\list\\listtemplateid1748391000\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0",
        "\\ri0\\sb0\\sa0}{\\pgp\\ipgp19\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp6\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp0\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp36\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp39\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp38\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp19\\itap0\\li0\\ri0\\sb0\\sa0",
        "\\fs18\\lang1033\\langfe1033\\loch\\f41\\hich\\af41\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\snext90 \\spriority0 AdditionalSoftware;}{\\*\\cs91 \\additive \\rtlch\\fcs1 \\af40\\afs24\\alang1025 \\ltrch\\fcs0 \\b\\f41\\fs24\\lang1033\\langfe1033\\langnp1033\\langfenp1033 ",
        "{\\list\\listtemplateid-1901582996\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 ",
        "\\sbasedon10 \\slink68 \\slocked \\ssemihidden Comment Text Char;}{\\*\\cs70 \\additive \\rtlch\\fcs1 \\af0\\afs16 \\ltrch\\fcs0 \\fs16 \\sbasedon10 \\ssemihidden annotation reference;}{\\s71\\ql \\li0\\ri0\\sa160\\sl-240\\slmult0",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 Microsoft\\hich\\f40 \\rquote \\loch\\f40 s}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14182033\\charrsid15598355 \\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8403787\\charrsid15598355 ",
        "\\jclisttab\\tx720\\tx4950\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls30\\adjustright\\rin0\\lin720\\itap0\\pararsid13714870 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {",
        ";}\\listid1182742101}{\\list\\listtemplateid-831589228\\listhybrid{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid-1420630512\\'02\\'00.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 ",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698715\\'02\\'02.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-180\\li2160\\jclisttab\\tx2160\\lin2160 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0",
        "\\insrsid4879935\\charrsid14122191 \\hich\\af40\\dbch\\af11\\loch\\f40  agree to }{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\b\\insrsid4879935\\charrsid4879935 \\hich\\af40\\dbch\\af11\\loch\\f40 binding individual arbitration before the Ame\\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li2880\\lin2880 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext",
        "ou may also have rights with respect to the party from which you acquired the software. This agreement does not change those other ri\\hich\\af40\\dbch\\af11\\loch\\f40 ghts if the laws of your state}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8743060 ",
        "d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff0900060000000000000000000000010000000100000000000000001000000200000001000000feffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
        "\\par {\\*\\bkmkend OLE_LINK7}{\\*\\bkmkend OLE_LINK8}{\\listtext\\pard\\plain\\ltrpar \\s2 \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 \\b\\f40\\fs20\\insrsid7406168\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 b)\\tab}}\\pard \\ltrpar",
        "}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7935102\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 ou agree to }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11952046\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 comply with all applicable provisions of the Mic",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List Bullet 4;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List Bullet 5;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List Number 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List Number 3;",
        "\\wrppunct\\asianbrkrule\\rsidroot8391759\\newtblstyruls\\nogrowautofit\\remdttm\\usenormstyforlist\\noindnmbrts\\felnbrelev\\nocxsptable\\indrlsweleven\\noafcnsttbl\\afelev\\utinl\\hwelev\\spltpgpar\\notcvasp\\notbrkcnstfrctbl\\notvatxbx\\krnprsnet\\cachedcolbal ",
        ", in which case those d}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8403787\\charrsid15598355 \\hich\\af40\\dbch\\af11\\loch\\f40 ifferent terms apply prospectively and do not alter your or }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14182033 ",
        "\\s72\\ql \\li0\\ri0\\sa160\\sl-240\\slmult0\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 ",
        "APPLICABLE LAW}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid11952046\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  AND }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid11996719\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 PLACE TO RESOLVE DISPUTES}{\\rtlch\\fcs1 ",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List Number 4;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List Number 5;\\lsdqformat1 \\lsdpriority10 \\lsdlocked0 Title;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Closing;",
        "\\sbasedon0 \\snext114 \\ssemihidden \\sunhideused Normal (Web);}{\\s115\\ql \\fi-360\\li720\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx360\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls12\\adjustright\\rin0\\lin720\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li4320\\lin4320 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0",
        "\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'01.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\fi-363\\li720\\jclisttab\\tx720\\lin720 }{\\listlevel\\levelnfc2\\levelnfcn2",
        "{\\flomajor\\f31511\\fbidi \\froman\\fcharset161\\fprq2 Times New Roman Greek;}{\\flomajor\\f31512\\fbidi \\froman\\fcharset162\\fprq2 Times New Roman Tur;}{\\flomajor\\f31513\\fbidi \\froman\\fcharset177\\fprq2 Times New Roman (Hebrew);}",
        "\\af40 \\ltrch\\fcs0 \\b\\insrsid11952046\\charrsid9003929 .}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11952046\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  If you acquired the software in the United States or Canada, the\\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext36 Bullet 4;}{\\s37\\ql \\fi-357\\li1792\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx1795\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls5\\adjustright\\rin0\\lin1792\\itap0 ",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext104 \\slink105 Body Text 2;}{\\*\\cs105 \\additive \\rtlch\\fcs1 \\af40\\afs19 \\ltrch\\fcs0 \\f40\\fs19 \\sbasedon10 \\slink104 \\slocked Body Text 2 Char;}{",
        "\\trbrdrh\\brdrs\\brdrw10 \\trbrdrv\\brdrs\\brdrw10 \\trftsWidthB3\\trpaddl108\\trpaddr108\\trpaddfl3\\trpaddft3\\trpaddfb3\\trpaddfr3\\trcbpat1\\trcfpat1\\tblind0\\tblindtype3\\tsvertalt\\tsbrdrt\\tsbrdrl\\tsbrdrb\\tsbrdrr\\tsbrdrdgl\\tsbrdrdgr\\tsbrdrh\\tsbrdrv ",
        "{\\listlevel\\levelnfc255\\levelnfcn255\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02i.;}{\\levelnumbers;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\s8\\fi-357\\li2863",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid5511034\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 DATA}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid15949659 \\hich\\af40\\dbch\\af11\\loch\\f40  COLLECTION}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d227574662d3822207374616e64616c6f6e653d22796573223f3e3c44696374696f6e617279205361766564427956657273696f6e3d22352e342e313532342e3022",
        "\\cs58 \\additive \\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\f40\\lang1033\\langfe1033\\langnp1033\\langfenp1033 \\sbasedon10 Body 3 Char;}{\\*\\cs59 \\additive \\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\f40\\lang1033\\langfe1033\\langnp1033\\langfenp1033 \\sbasedon10 Body 4 Char;}{\\*\\cs60 ",
        "\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'03(\\'05);}{\\levelnumbers\\'02;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\jclisttab\\tx2160\\lin2160 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0",
        "0000000000000000005b436f6e74656e745f54797065735d2e786d6c504b01022d0014000600080000002100a5d6a7e7c0000000360100000b00000000000000",
        "{\\f445\\fbidi \\fswiss\\fcharset204\\fprq2 Tahoma Cyr;}{\\f447\\fbidi \\fswiss\\fcharset161\\fprq2 Tahoma Greek;}{\\f448\\fbidi \\fswiss\\fcharset162\\fprq2 Tahoma Tur;}{\\f449\\fbidi \\fswiss\\fcharset177\\fprq2 Tahoma (Hebrew);}",
        "\\jclisttab\\tx5040\\lin5040 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li5760\\jclisttab\\tx5760\\lin5760 ",
        "{\\listoverride\\listid727923163\\listoverridecount0\\ls21}{\\listoverride\\listid127548676\\listoverridecount0\\ls22}{\\listoverride\\listid1317346407\\listoverridecount0\\ls23}{\\listoverride\\listid489490308\\listoverridecount0\\ls24}{\\listoverride\\listid1803033172",
        "\\cs118\\b\\insrsid4879935 \\loch\\af40\\dbch\\af11\\hich\\f40 \\'93}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 BINDING }{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935\\charrsid2110843 ",
        "\\par }}\\ltrpar \\sectd \\ltrsect\\psz1\\linex0\\headery0\\footery0\\endnhere\\sectlinegrid360\\sectdefaultcl\\sectrsid16390706\\sftnbj {\\footerl \\ltrpar \\pard\\plain \\ltrpar\\s83\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar",
        "\\sbasedon0 \\snext46 Heading Warranty;}{\\s47\\ql \\fi-360\\li360\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx360\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls10\\outlinelevel0\\adjustright\\rin0\\lin360\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 footnote text;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 annotation text;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 header;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 footer;",
        "{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li4320\\lin4320 }{\\listlevel",
        "{\\fhimajor\\f31531\\fbidi \\froman\\fcharset161\\fprq2 Cambria Greek;}{\\fhimajor\\f31532\\fbidi \\froman\\fcharset162\\fprq2 Cambria Tur;}{\\fhimajor\\f31535\\fbidi \\froman\\fcharset186\\fprq2 Cambria Baltic;}",
        "\\b\\insrsid7406168\\charrsid2041904 ",
        "\\'02\\'04.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li3600\\jclisttab\\tx3600\\lin3600 }{\\listlevel\\levelnfc2\\levelnfcn2\\leveljc2\\leveljcn2\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698715",
        "\\par \\hich\\af40\\dbch\\af11\\loch\\f40 (ii)\\tab Limitation of Liability.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b0\\insrsid7227263\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "654974656d3e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d227574662d3822207374616e64616c6f6e653d22796573223f3e3c53657373696f6e20786d6c6e733d22687474703a",
        "\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0",
        "\\sbasedon0 \\snext62 \\slink63 \\ssemihidden footnote text;}{\\*\\cs63 \\additive \\rtlch\\fcs1 \\af40\\afs20 \\ltrch\\fcs0 \\f40\\fs20 \\sbasedon10 \\slink62 \\slocked \\ssemihidden Footnote Text Char;}{\\*\\cs64 \\additive \\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\super ",
        "a7e7c0000000360100000b0000005f72656c732f2e72656c73848fcf6ac3300c87ef85bd83d17d51d2c31825762fa590432fa37d00e1287f68221bdb1bebdb4f",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext30 Body 7;}{\\s31\\ql \\li2863\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin2863\\itap0 \\rtlch\\fcs1 ",
        "\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li3600\\jclisttab\\tx3600\\lin3600 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693",
        "\\pnlcltr\\pnstart1\\pnindent720\\pnhang {\\pntxtb (}{\\pntxta )}}{\\*\\pnseclvl9\\pnlcrm\\pnstart1\\pnindent720\\pnhang {\\pntxtb (}{\\pntxta )}}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\lsdpriority63 \\lsdlocked0 Medium Shading 1 Accent 2;\\lsdpriority64 \\lsdlocked0 Medium Shading 2 Accent 2;\\lsdpriority65 \\lsdlocked0 Medium List 1 Accent 2;\\lsdpriority66 \\lsdlocked0 Medium List 2 Accent 2;",
        "If you acquired this software in Canada, you may stop receiving updates by turning off the automatic update feature, disconnecting you\\hich\\af40\\dbch\\af11\\loch\\f40 r device from the Internet}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid2181518\\charrsid9003929 ",
        ";}\\listid759907437}{\\list\\listtemplateid854634446\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}",
        "\\s2\\ql \\fi-363\\li720\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx720\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls21\\ilvl1\\outlinelevel1\\adjustright\\rin0\\lin720\\itap0\\pararsid10303970 \\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        ";}\\listid959527732}{\\list\\listtemplateid67698719{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'00.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 ",
        "\\fi-360\\li3600\\jclisttab\\tx3600\\lin3600 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li4320",
        "\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li4320\\jclisttab\\tx4320\\lin4320 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689",
        "\\s62\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 ",
        "{\\listoverride\\listid1219436735\\listoverridecount0\\ls7}{\\listoverride\\listid810947713\\listoverridecount0\\ls8}{\\listoverride\\listid196815738\\listoverridecount0\\ls9}{\\listoverride\\listid394402059\\listoverridecount0\\ls10}{\\listoverride\\listid1795057320",
        "\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 }\\noqfpromote {\\stylesheet{\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01\\u-3913 ?;}{\\levelnumbers;}\\b\\i0\\f3\\fs20\\fbias0\\hres0\\chhres0 \\fi-363\\li720\\jclisttab\\tx720\\lin720 }{\\listlevel\\levelnfc2\\levelnfcn2\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1",
        " terms are an agreement between you and Microsoft Corporation (or one of its affiliates). They apply to the software named above and any Microsoft servi\\hich\\af40\\dbch\\af11\\loch\\f40 ces or software updates }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\af40 \\ltrch\\fcs0 \\b\\insrsid9003929\\charrsid4136656 \\hich\\af40\\dbch\\af11\\loch\\f40  INCLUDING MERCHANTABILITY, FITNE\\hich\\af40\\dbch\\af11\\loch\\f40 SS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "6e746567726974792e636f6d2f6465616c6275696c6465722f323030362f616e7377657273222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
        "\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li5040\\jclisttab\\tx5040\\lin5040 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext115 \\sautoupd Heading 2 French Warranty;}{\\*\\ts116\\tsrowd\\trbrdrt\\brdrs\\brdrw10 \\trbrdrl\\brdrs\\brdrw10 \\trbrdrb\\brdrs\\brdrw10 \\trbrdrr\\brdrs\\brdrw10 ",
        "\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'07.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li2880\\lin2880 }}{\\lfolevel\\listoverrideformat{\\listlevel\\levelnfc2\\levelnfcn2\\leveljc0\\leveljcn0\\levelfollow0",
        "\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li5040\\lin5040 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers",
        "\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li5040\\jclisttab\\tx5040\\lin5040 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext",
        "\\lsdpriority46 \\lsdlocked0 List Table 1 Light;\\lsdpriority47 \\lsdlocked0 List Table 2;\\lsdpriority48 \\lsdlocked0 List Table 3;\\lsdpriority49 \\lsdlocked0 List Table 4;\\lsdpriority50 \\lsdlocked0 List Table 5 Dark;",
        "\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li5760\\jclisttab\\tx5760\\lin5760 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693",
        "00000000000000000000000000000000c300000000000000010000000200000003000000feffffff0500000006000000070000000800000009000000feffffff0b0000000c000000feffffff0e0000000f000000100000001100000012000000feffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
        "\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\jclisttab\\tx1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}",
        "\\b\\i\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon36 \\snext56 Bullet 4 Italics;}{\\*\\cs57 \\additive \\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\f40\\lang1033\\langfe1033\\langnp1033\\langfenp1033 \\sbasedon10 Body 2 Char;}{\\*",
        "{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li4320\\lin4320 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext",
        "\\rtlch\\fcs1 \\ab\\ai0\\af40\\afs20 \\ltrch\\fcs0 \\b\\i0\\f40\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li357\\jclisttab\\tx360\\lin357 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext",
        "\\'02\\'08.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-180\\li6480\\jclisttab\\tx6480\\lin6480 }{\\listname ;}\\listid1197885460}{\\list\\listtemplateid-1813845996\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0",
        "\\sbasedon0 \\snext0 Heading 2 Warranty;}{\\s49\\ql \\fi-357\\li1077\\ri0\\sb120\\sa120\\widctlpar\\tx1077\\jclisttab\\tx1440\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls18\\ilvl2\\outlinelevel2\\adjustright\\rin0\\lin1077\\itap0 \\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\fi-1224\\li3744\\lin3744 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'12\\'00.\\'01.\\'02.\\'03.\\'04.\\'05.\\'06.\\'07.\\'08.;}{\\levelnumbers\\'01\\'03\\'05\\'07\\'09\\'0b\\'0d\\'0f\\'11;}\\rtlch\\fcs1 ",
        "\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\jclisttab\\tx6480\\lin6480 }{\\listname ;}\\listid2054619191}{\\list\\listtemplateid-494402964\\listhybrid{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1",
        "\\ltrch\\fcs0 \\insrsid9572917\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 ed in the product documentation}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid5511034\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 . }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\hich\\af40\\dbch\\af11\\loch\\f40  for all disputes heard in court (excluding arbitration)}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11952046\\charrsid9003929 .}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid5452915\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  }{",
        "\\lsdpriority48 \\lsdlocked0 List Table 3 Accent 4;\\lsdpriority49 \\lsdlocked0 List Table 4 Accent 4;\\lsdpriority50 \\lsdlocked0 List Table 5 Dark Accent 4;\\lsdpriority51 \\lsdlocked0 List Table 6 Colorful Accent 4;",
        "{\\fhiminor\\f31568\\fbidi \\fswiss\\fcharset238\\fprq2 Calibri CE;}{\\fhiminor\\f31569\\fbidi \\fswiss\\fcharset204\\fprq2 Calibri Cyr;}{\\fhiminor\\f31571\\fbidi \\fswiss\\fcharset161\\fprq2 Calibri Greek;}{\\fhiminor\\f31572\\fbidi \\fswiss\\fcharset162\\fprq2 Calibri Tur;}",
        "\\ts11\\tsrowd\\trftsWidthB3\\trpaddl108\\trpaddr108\\trpaddfl3\\trpaddft3\\trpaddfb3\\trpaddfr3\\trcbpat1\\trcfpat1\\tblind0\\tblindtype3\\tsvertalt\\tsbrdrt\\tsbrdrl\\tsbrdrb\\tsbrdrr\\tsbrdrdgl\\tsbrdrdgr\\tsbrdrh\\tsbrdrv \\ql \\li0\\ri0\\sa200\\sl276\\slmult1",
        "\\'02\\'03.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\strike0\\f41\\fs20\\ulnone\\fbias0\\hres0\\chhres0 \\s4\\fi-358\\li1435\\jclisttab\\tx1437\\lin1435 }{\\listlevel\\levelnfc1\\levelnfcn1\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1",
        "\\fi-360\\li4323\\lin4323 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li5043\\lin5043 }",
        "\\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid11994707\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 General.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "0200007468656d652f7468656d652f7468656d654d616e616765722e786d6c504b01022d001400060008000000210096b5ade296060000501b00001600000000",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 line number;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 page number;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 endnote reference;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 endnote text;",
        "\\lsdpriority46 \\lsdlocked0 List Table 1 Light Accent 2;\\lsdpriority47 \\lsdlocked0 List Table 2 Accent 2;\\lsdpriority48 \\lsdlocked0 List Table 3 Accent 2;\\lsdpriority49 \\lsdlocked0 List Table 4 Accent 2;",
        "\\nouicompat \\fet0{\\*\\wgrffmtfilter 013f}\\nofeaturethrottle1\\ilfomacatclnup26{\\*\\ftnsep \\ltrpar \\pard\\plain \\ltrpar\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0\\pararsid2841647 \\rtlch\\fcs1 ",
        "\\lsdpriority72 \\lsdlocked0 Colorful List Accent 1;\\lsdpriority73 \\lsdlocked0 Colorful Grid Accent 1;\\lsdpriority60 \\lsdlocked0 Light Shading Accent 2;\\lsdpriority61 \\lsdlocked0 Light List Accent 2;\\lsdpriority62 \\lsdlocked0 Light Grid Accent 2;",
        "{\\*\\pnseclvl5\\pndec\\pnstart1\\pnindent720\\pnhang {\\pntxtb (}{\\pntxta )}}{\\*\\pnseclvl6\\pnlcltr\\pnstart1\\pnindent720\\pnhang {\\pntxtb (}{\\pntxta )}}{\\*\\pnseclvl7\\pnlcrm\\pnstart1\\pnindent720\\pnhang {\\pntxtb (}{\\pntxta )}}{\\*\\pnseclvl8",
        "}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid1577493\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 . }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid1984800\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        ", Microsoft will only be liable for slight negligence if Microsoft is in breach of such material contractual obligations, the fulfillment of which facilitate the due performance of this agreement, the breach of whi\\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\lsdpriority59 \\lsdlocked0 Table Grid;\\lsdsemihidden1 \\lsdlocked0 Placeholder Text;\\lsdqformat1 \\lsdpriority1 \\lsdlocked0 No Spacing;\\lsdpriority60 \\lsdlocked0 Light Shading;\\lsdpriority61 \\lsdlocked0 Light List;\\lsdpriority62 \\lsdlocked0 Light Grid;",
        "\\'02\\'04.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\strike0\\f41\\fs20\\ulnone\\fbias0\\hres0\\chhres0 \\fi-357\\li2152\\jclisttab\\tx2515\\lin2152 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1",
        "\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'04.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\strike0\\f41\\fs20\\ulnone\\fbias0\\hres0\\chhres0 \\fi-357\\li1792\\jclisttab\\tx2155\\lin1792 }",
        "\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li720\\lin720 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0",
        "\\insrsid339141\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 . If\\hich\\af40\\dbch\\af11\\loch\\f40  you use these features to enable data collection in your applications, you must comply with applicable law, including getting}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "9ffb9e65d028d44d4e39df9c1a52ecbd3607fee9cec7263328e5d661d3d0e4f62f44acd855ed7ab33cdf7bcb8ae889599bd5c8b3029895b6825696f6af29c239",
        "\\cs15 \\additive \\rtlch\\fcs1 \\ab\\af40\\afs19 \\ltrch\\fcs0 \\f40\\fs19 \\sbasedon10 \\slink1 \\slocked Heading 1 Char;}{\\*\\cs16 \\additive \\rtlch\\fcs1 \\ab\\af40\\afs19 \\ltrch\\fcs0 \\f40\\fs19 \\sbasedon10 \\slink2 \\slocked Heading 2 Char;}{\\*\\cs17 \\additive \\rtlch\\fcs1 ",
        "\\par }\\pard\\plain \\ltrpar\\s44\\ql \\li0\\ri0\\sb120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0\\pararsid4602528 \\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid15818407\\charrsid2771280 ",
        "\\hich\\af40\\dbch\\af11\\loch\\f40  (}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9572917\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 i}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid2181518\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\jclisttab\\tx1437\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls4\\adjustright\\rin0\\lin1435\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\ul\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon36 \\snext50 ",
        "{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\jclisttab\\tx2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s1 \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 \\b\\f40\\fs20\\insrsid1984800\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 6.\\tab}}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid1984800\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext113 \\sqformat \\spriority34 List Paragraph;}{",
        " YOU BEAR THE RISK OF USING IT. MICROSOFT GIVES NO EXPRESS WARRANTIES, GUARANTEES, OR CONDITIONS. TO THE EXTENT PERMITTED UNDER APPLICABLE LAWS, MICROSOFT EXCLUDES ALL IMPLIED WARRANTIES}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid9003929 ,}{\\rtlch\\fcs1 ",
        "{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li5763\\lin5763 }{\\listname ",
        "\\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\lang9\\langfe1033\\langnp9\\insrsid14971392\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 RIGHTS BELOW.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4067708\\charrsid4067708 ",
        "\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li723\\lin723 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Columns 5;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Grid 1;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Grid 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Grid 3;",
        "\\par {\\*\\bkmkstart OLE_LINK7}{\\*\\bkmkstart OLE_LINK8}{\\listtext\\pard\\plain\\ltrpar \\s2 \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 \\b\\f40\\fs20\\insrsid11994707\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 a)\\tab}}\\pard\\plain \\ltrpar",
        "\\lsdpriority72 \\lsdlocked0 Colorful List Accent 4;\\lsdpriority73 \\lsdlocked0 Colorful Grid Accent 4;\\lsdpriority60 \\lsdlocked0 Light Shading Accent 5;\\lsdpriority61 \\lsdlocked0 Light List Accent 5;\\lsdpriority62 \\lsdlocked0 Light Grid Accent 5;",
        "\\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext68 \\slink69 \\ssemihidden annotation text;}{\\*\\cs69 \\additive \\rtlch\\fcs1 \\af40\\afs20 \\ltrch\\fcs0 \\f40\\fs20 ",
        "\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li5040\\lin5040 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0",
        "4757e8d3f729e245eb2b260a0238fd010000ffff0300504b03041400060008000000210096b5ade296060000501b0000160000007468656d652f7468656d652f",
        "\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'06.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li2506\\jclisttab\\tx2509\\lin2506 }{\\listlevel",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 remove, minimize, block}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid8721050\\charrsid12455646 ,}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid16591162\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\lsdpriority67 \\lsdlocked0 Medium Grid 1 Accent 1;\\lsdpriority68 \\lsdlocked0 Medium Grid 2 Accent 1;\\lsdpriority69 \\lsdlocked0 Medium Grid 3 Accent 1;\\lsdpriority70 \\lsdlocked0 Dark List Accent 1;\\lsdpriority71 \\lsdlocked0 Colorful Shading Accent 1;",
        "\\jclisttab\\tx360\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls26\\outlinelevel0\\adjustright\\rin0\\lin357\\itap0\\pararsid9003929 {\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid9003929\\charrsid4136656 \\hich\\af40\\dbch\\af11\\loch\\f40 DISCLAIMER OF WARRANT",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext54 \\slink55 Body Text Indent;}{\\*\\cs55 \\additive \\rtlch\\fcs1 \\af40\\afs19 \\ltrch\\fcs0 \\f40\\fs19 \\sbasedon10 \\slink54 \\slocked \\ssemihidden ",
        "\\jclisttab\\tx720\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls10\\ilvl1\\outlinelevel1\\adjustright\\rin0\\lin720\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 ",
        "\\lsdpriority51 \\lsdlocked0 Grid Table 6 Colorful Accent 4;\\lsdpriority52 \\lsdlocked0 Grid Table 7 Colorful Accent 4;\\lsdpriority46 \\lsdlocked0 Grid Table 1 Light Accent 5;\\lsdpriority47 \\lsdlocked0 Grid Table 2 Accent 5;",
        "page number;}{\\s78\\ql \\li0\\ri0\\sa160\\sl-240\\slmult0\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li720\\lin720 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}",
        "\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li360\\lin360 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}",
        "\\lsdsemihidden1 \\lsdlocked0 Revision;\\lsdqformat1 \\lsdpriority34 \\lsdlocked0 List Paragraph;\\lsdqformat1 \\lsdpriority29 \\lsdlocked0 Quote;\\lsdqformat1 \\lsdpriority30 \\lsdlocked0 Intense Quote;\\lsdpriority66 \\lsdlocked0 Medium List 2 Accent 1;",
        "\\ltrch\\fcs0 \\b\\i0\\f40\\fs20\\fbias0\\hres0\\chhres0 \\fi-363\\li1080\\jclisttab\\tx1080\\lin1080 }{\\listlevel\\levelnfc2\\levelnfcn2\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'02.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 ",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 Microsoft\\hich\\f40 \\rquote \\loch\\f40 s}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid406406\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid5511034\\charrsid2110843 ",
        "\\insrsid15818407\\charrsid2110843 ",
        "\\ab\\ai0\\af0 \\ltrch\\fcs0 \\b\\i0\\fbias0\\hres0\\chhres0 \\s115\\fi-360\\li720\\jclisttab\\tx360\\lin720 }{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698713",
        "\\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 Subject to the }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "0c895fcf6720192de6bf3b9e89ecdbd6596cbcdd8eb28e7c365ecc4ec1ff1460f53fe813d3cc7f5b7f020000ffff0300504b030414000600080000002100a5d6",
        "a1a82fe353bd90a865aad41ed0b5b8f9d6fd010000ffff0300504b0304140006000800000021006b799616830000008a0000001c0000007468656d652f746865",
        "\\sbasedon10 \\slink49 \\slocked Heading 3 Bold Char;}{\\*\\cs108 \\additive \\rtlch\\fcs1 \\ab0\\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19 \\sbasedon107 \\slink106 \\slocked Style Heading 3 Bold + (Asian) Times New Roman 9.5 pt Char;}{\\*\\cs109 \\additive \\rtlch\\fcs1 ",
        "\\ltrch\\fcs0 \\b\\insrsid869748\\charrsid4879935 ",
        "\\lsdpriority50 \\lsdlocked0 List Table 5 Dark Accent 2;\\lsdpriority51 \\lsdlocked0 List Table 6 Colorful Accent 2;\\lsdpriority52 \\lsdlocked0 List Table 7 Colorful Accent 2;\\lsdpriority46 \\lsdlocked0 List Table 1 Light Accent 3;",
        "\\lsdpriority72 \\lsdlocked0 Colorful List Accent 3;\\lsdpriority73 \\lsdlocked0 Colorful Grid Accent 3;\\lsdpriority60 \\lsdlocked0 Light Shading Accent 4;\\lsdpriority61 \\lsdlocked0 Light List Accent 4;\\lsdpriority62 \\lsdlocked0 Light Grid Accent 4;",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 products and services.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7762260\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4329485\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li2880\\jclisttab\\tx2880\\lin2880 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 ",
        "\\fi-360\\li5760\\jclisttab\\tx5760\\lin5760 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\'02\\'08.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 ",
        "{\\nofwords1440}{\\nofchars8209}{\\nofcharsws9630}{\\vern7}}{\\*\\userprops {\\propname db_document_id}\\proptype30{\\staticval 10057}{\\propname db_contract_version}\\proptype30{\\staticval AAAAAAAAES8=}}{\\*\\xmlnstbl {\\xmlns1 http://schemas.microsoft.com/office/word",
        "\\b\\insrsid4879935\\charrsid4879935 \\hich\\af40\\dbch\\af11\\loch\\f40 Class action lawsuits, class-wide arbitrations, private attorney-gene}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid4879935\\charrsid4879935 \\hich\\af40\\dbch\\af11\\loch\\f40 ral actions,}{\\rtlch\\fcs1 ",
        "\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid-596080174\\'02\\'00.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab\\ai0\\af0 \\ltrch\\fcs0 \\b\\i0\\fbias0\\hres0\\chhres0 \\s93\\fi-360\\li360\\jclisttab\\tx360\\lin360 }{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List Continue;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List Continue 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List Continue 3;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List Continue 4;",
        "Table Grid;}{\\*\\cs117 \\additive \\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\ul\\cf17 \\sbasedon10 \\ssemihidden \\sunhideused FollowedHyperlink;}{\\*\\cs118 \\additive \\rtlch\\fcs1 \\ab\\af0 \\ltrch\\fcs0 \\b \\sbasedon10 \\sqformat \\spriority22 Strong;}{\\*\\cs119 \\additive ",
        "\\fi-360\\li720\\lin720 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\lin1440 }",
        "\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 any o}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 the}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid5452915\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 r}{\\rtlch\\fcs1 \\af40 ",
        "\\fi-360\\li3240\\lin3240 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 ",
        "\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon49 \\snext106 \\slink108 Style Heading 3 Bold + (Asian) Times New Roman 9.5 pt;}{\\*\\cs107 \\additive \\rtlch\\fcs1 \\ab\\af40\\afs19 \\ltrch\\fcs0 \\f40\\fs19 ",
        "\\jclisttab\\tx1080\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls3\\adjustright\\rin0\\lin1077\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext35 \\slink87 ",
        "\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'05.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\s6\\fi-357\\li2149\\jclisttab\\tx2152\\lin2149 }{\\listlevel\\levelnfc4",
        "}{\\pgp\\ipgp24\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp7\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp42\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp0\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp16\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp35\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp13\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp",
        "\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li2880\\lin2880 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 ",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s1 \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 \\b\\f40\\fs20\\insrsid5511034\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 2.\\tab}}\\pard\\plain \\ltrpar\\s1\\ql \\fi-357\\li357\\ri0\\sb120\\sa120\\widctlpar",
        "\\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li2863\\jclisttab\\tx2866\\lin2863 }{\\listlevel\\levelnfc255\\levelnfcn255\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02A.;}{\\levelnumbers;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 ",
        "fffffffffffffffffdffffff04000000feffffff05000000feffffff06000000feffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
        "\\fi-360\\li5040\\jclisttab\\tx5040\\lin5040 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\'02\\'07.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 ",
        "\\b0\\insrsid14971392\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40  for others to }{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid935470\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 use, or transfer the software or this agreement to any third party.}{",
        "\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li3600\\lin3600 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0",
        "Microsoft may need to update your system to provide you with updates. }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14578447\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 Y}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid1984800\\charrsid2771280 ",
        "\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li5040\\lin5040 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 ",
        " or modify any notices of Microsoft or its suppli}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid935470\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 ers in the soft}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid16591162\\charrsid12455646 ",
        "\\sbasedon10 \\slink7 \\slocked Heading 7 Char;}{\\*\\cs22 \\additive \\rtlch\\fcs1 \\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19 \\sbasedon10 \\slink8 \\slocked Heading 8 Char;}{\\*\\cs23 \\additive \\rtlch\\fcs1 \\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19 \\sbasedon10 \\slink9 \\slocked ",
        "000000000000000000000000000000000000000000000000000000000000000000000a0000008800000000000000500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff",
        "\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02i.;}{\\levelnumbers;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li3223\\jclisttab\\tx3226\\lin3223 }{\\listlevel\\levelnfc255\\levelnfcn255",
        "\\fi-357\\li2506\\jclisttab\\tx2509\\lin2506 }{\\listlevel\\levelnfc255\\levelnfcn255\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02i.;}{\\levelnumbers;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 ",
        "\\par }}{\\*\\ftnsepc \\ltrpar \\pard\\plain \\ltrpar\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0\\pararsid2841647 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "for supplements, updates}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid5452915\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 , or third-party }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid5461513\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 applications}{\\rtlch\\fcs1 ",
        "\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid1637229796\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\s33\\fi-357\\li357\\jclisttab\\tx360\\lin357 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0",
        "\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'06.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li2866\\jclisttab\\tx2869\\lin2866 }{\\listlevel\\levelnfc255\\levelnfcn255\\leveljc0",
        "\\lsdpriority63 \\lsdlocked0 Medium Shading 1 Accent 3;\\lsdpriority64 \\lsdlocked0 Medium Shading 2 Accent 3;\\lsdpriority65 \\lsdlocked0 Medium List 1 Accent 3;\\lsdpriority66 \\lsdlocked0 Medium List 2 Accent 3;",
        "{\\f70\\fbidi \\fmodern\\fcharset178\\fprq1 Courier New (Arabic);}{\\f71\\fbidi \\fmodern\\fcharset186\\fprq1 Courier New Baltic;}{\\f72\\fbidi \\fmodern\\fcharset163\\fprq1 Courier New (Vietnamese);}{\\f444\\fbidi \\fswiss\\fcharset238\\fprq2 Tahoma CE;}",
        "\\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext37 Bullet 5;}{\\s38\\ql \\fi-357\\li2149\\ri0\\sb120\\sa120\\widctlpar",
        "73d9850528a2c6cce0239baa4c04ca5bbabac4df000000ffff0300504b01022d0014000600080000002100e9de0fbfff0000001c020000130000000000000000",
        "\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li5760\\jclisttab\\tx5760\\lin5760 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693",
        "\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'06.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li2520\\lin2520 }}{\\lfolevel\\listoverrideformat{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0\\levelfollow0",
        "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
        "f and when you re-connect to the Internet, }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9572917\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 however, }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid2181518\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid3606489\\charrsid4401995 \\hich\\af40\\dbch\\af11\\loch\\f40 to develop and test your applications}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\lang9\\langfe1033\\langnp9\\insrsid1723598 \\hich\\af40\\dbch\\af11\\loch\\f40 , and solely",
        "\\insrsid16594239 \\hich\\af40\\dbch\\af11\\loch\\f40 one}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14181361\\charrsid4401995 \\hich\\af40\\dbch\\af11\\loch\\f40  backup copy of the software for the sole purpose of reinstalling the software.}{\\rtlch\\fcs1 \\af40 ",
        "\\lsdpriority46 \\lsdlocked0 List Table 1 Light Accent 6;\\lsdpriority47 \\lsdlocked0 List Table 2 Accent 6;\\lsdpriority48 \\lsdlocked0 List Table 3 Accent 6;\\lsdpriority49 \\lsdlocked0 List Table 4 Accent 6;",
        "9e7ef3f2d117d57859c6fffac327bffcfc793510d26726ce8b2f9ffcf6ecc98baf3efdfdbb4715f04d814765f890c644a29be408edf3181433567125272371be",
        "\\hich\\af40\\dbch\\af11\\loch\\f40  You have statuto\\hich\\af40\\dbch\\af11\\loch\\f40 ry guarantees under the Australian Consumer Law and nothing in }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8394664 \\hich\\af40\\dbch\\af11\\loch\\f40 this agreement}{\\rtlch\\fcs1 \\af40 ",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s34 \\rtlch\\fcs1 \\ab\\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19\\insrsid935470\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 e)\\tab}\\hich\\af40\\dbch\\af11\\loch\\f40 share, }{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 ",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Subtle 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Web 1;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table Web 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Balloon Text;",
        "}\\sectd \\ltrsect\\psz1\\linex0\\headery0\\footery0\\endnhere\\sectlinegrid360\\sectdefaultcl\\sectrsid16390706\\sftnbj {\\footerl \\ltrpar \\pard\\plain \\ltrpar\\s83\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar",
        "15c308d3f28acd249438c19a4b05fd9e8a1cf4cd296699771c393ac4b5e01d01e5a30a787d72cf1178108989a2159c77a2d801ee72ce3a5c545a6147f32a9979",
        "\\insrsid14578447\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid6962140 \\hich\\af40\\dbch\\af11\\loch\\f40 is }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14578447\\charrsid2771280 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 HTML Top of Form;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 HTML Bottom of Form;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Normal (Web);\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 HTML Acronym;",
        "\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp3\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp0\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp0\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp0\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp0\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp0\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp0\\itap0\\li0\\ri0\\sb0\\sa0}",
        "\\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li2506\\jclisttab\\tx2509\\lin2506 }{\\listlevel\\levelnfc255\\levelnfcn255\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02i.;}{\\levelnumbers;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 ",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s1 \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 \\b\\f40\\fs20\\insrsid14971392\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 1.\\tab}}\\pard\\plain \\ltrpar\\s1\\ql \\fi-357\\li357\\ri0\\sb120\\sa120\\widctlpar",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table List 8;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table 3D effects 1;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table 3D effects 2;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table 3D effects 3;",
        "\\s46\\qc \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 ",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 \\hich\\f40 Y. THE SOFTWARE IS LICENSED \\'93\\loch\\f40 \\hich\\f40 AS IS.\\'94\\loch\\f40 ",
        "5689811a183c61a50f98f4babebc2837878049899a52a57be670674cb23d8e90721f90a4d2fa3802cb35762680fd800ecd7551dc18eb899138e3c943d7e503b6",
        "{\\fbimajor\\f31541\\fbidi \\froman\\fcharset161\\fprq2 Times New Roman Greek;}{\\fbimajor\\f31542\\fbidi \\froman\\fcharset162\\fprq2 Times New Roman Tur;}{\\fbimajor\\f31543\\fbidi \\froman\\fcharset177\\fprq2 Times New Roman (Hebrew);}",
        "c33585b5fb9cc24e1d4885545b58463634cc5416022cd19cacfccb4d30eb45296023fd35a458598360f8d7a4003bbaae25e331f155d9d9a5116d3bfb9a95523e",
        "{\\*\\colorschememapping 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d22796573223f3e0d0a3c613a636c724d",
        "\\s42\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\ab\\af40\\afs28\\alang1025 \\ltrch\\fcs0 \\fs28\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext0 ",
        "\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li720\\lin720 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 ",
        "\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li723\\lin723 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689",
        "\\jclisttab\\tx360\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls26\\outlinelevel0\\adjustright\\rin0\\lin357\\itap0\\pararsid2771280 \\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {",
        "\\lsdpriority67 \\lsdlocked0 Medium Grid 1 Accent 6;\\lsdpriority68 \\lsdlocked0 Medium Grid 2 Accent 6;\\lsdpriority69 \\lsdlocked0 Medium Grid 3 Accent 6;\\lsdpriority70 \\lsdlocked0 Dark List Accent 6;\\lsdpriority71 \\lsdlocked0 Colorful Shading Accent 6;",
        "\\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid615889\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\insrsid11996719\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 and }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8394664 \\hich\\af40\\dbch\\af11\\loch\\f40 Microsoft}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8394664\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  }{",
        "\\sbasedon10 \\ssemihidden footnote reference;}{\\s65\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698689\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li2880\\jclisttab\\tx2880\\lin2880 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0",
        "\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'06.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\fbias0\\hres0\\chhres0 \\fi-360\\li2520\\jclisttab\\tx2520\\lin2520 }{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 rights relating to pre-updated software or servi\\hich\\af40\\dbch\\af11\\loch\\f40 ces}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\lang9\\langfe1033\\langnp9\\insrsid8403787\\charrsid339141 \\hich\\af40\\dbch\\af11\\loch\\f40 )}{\\rtlch\\fcs1 \\af40 ",
        "\\sbasedon68 \\snext68 \\slink86 \\ssemihidden \\sunhideused annotation subject;}{\\*\\cs86 \\additive \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 \\b\\f40\\fs20 \\sbasedon69 \\slink85 \\slocked \\ssemihidden Comment Subject Char;}{\\*\\cs87 \\additive \\rtlch\\fcs1 \\af40\\afs19 ",
        "\\ab\\ai0\\af40\\afs20 \\ltrch\\fcs0 \\b\\i0\\f40\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li357\\jclisttab\\tx360\\lin357 }{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'01);}{\\levelnumbers\\'01;}",
        "00000000000000000000000000a00900007468656d652f7468656d652f5f72656c732f7468656d654d616e616765722e786d6c2e72656c73504b050600000000050005005d0100009b0a00000000}",
        "\\insrsid14578447\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 will}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40  not}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14578447\\charrsid12455646 ",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s34 \\rtlch\\fcs1 \\ab\\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19\\insrsid14971392\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 b)\\tab}}\\pard \\ltrpar\\s34\\ql \\fi-363\\li720\\ri0\\sb120\\sa120\\widctlpar",
        "mer rights, under the laws of your state}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8743060 \\hich\\af40\\dbch\\af11\\loch\\f40 , province,}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  or country. }{\\rtlch\\fcs1 ",
        "\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\jclisttab\\tx6480\\lin6480 }{\\listname ;}\\listid1877695764}{\\list\\listtemplateid1186249844\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1",
        "{\\leveltext\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\fi-360\\li2880\\jclisttab\\tx2880\\lin2880 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01o;}{\\levelnumbers;}",
        "\\hich\\af40\\dbch\\af11\\loch\\f40  (and have no right to)}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid9572917\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 :}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid15818407\\charrsid12455646 ",
        "header;}{\\*\\cs82 \\additive \\rtlch\\fcs1 \\af40\\afs19 \\ltrch\\fcs0 \\f40\\fs19 \\sbasedon10 \\slink81 \\slocked Header Char;}{\\s83\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\tqc\\tx4320\\tqr\\tx8640\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 ",
        "\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\lin6480 }{\\listname ;}\\listid1803033172}{\\list\\listtemplateid-961874242\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23",
        "\\lsdpriority47 \\lsdlocked0 List Table 2 Accent 3;\\lsdpriority48 \\lsdlocked0 List Table 3 Accent 3;\\lsdpriority49 \\lsdlocked0 List Table 4 Accent 3;\\lsdpriority50 \\lsdlocked0 List Table 5 Dark Accent 3;",
        "\\'02\\'06.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li5040\\jclisttab\\tx5040\\lin5040 }{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698713",
        "\\fi-360\\li3600\\jclisttab\\tx3600\\lin3600 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\'02\\'05.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 ",
        "\\levelspace0\\levelindent0{\\leveltext\\'02\\'04.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\strike0\\f41\\fs20\\ulnone\\fbias0\\hres0\\chhres0 \\fi-357\\li1792\\jclisttab\\tx2155\\lin1792 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s1 \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 \\b\\f40\\fs20\\insrsid9003929\\charrsid4136656 \\hich\\af40\\dbch\\af11\\loch\\f40 12.\\tab}}\\pard \\ltrpar\\s1\\ql \\fi-357\\li357\\ri0\\sb120\\sa120\\widctlpar",
        "\\s106\\ql \\fi-357\\li1077\\ri0\\sb120\\sa120\\widctlpar\\tx1077\\jclisttab\\tx1440\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls18\\ilvl2\\outlinelevel2\\adjustright\\rin0\\lin1077\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "615b8116d8a5fb34d93a6c1dd0afb0475292c5585e9236d88aad3e2412f9e3fbff1e1fa9abd7eec70c1d1221294fda5efd72cd4324f1794093b0eddd1ef62fad",
        "\\b\\fs19\\ul\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon36 \\snext92 \\spriority0 Bullet 4 Underlined;}{\\s93\\ql \\fi-360\\li360\\ri0\\sb120\\sa120\\widctlpar",
        "\\jclisttab\\tx360\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls26\\outlinelevel0\\adjustright\\rin0\\lin357\\itap0\\pararsid3953303 \\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {",
        "0cf03ac1a5193be4cbb921cd0b495fd054b5bd0f530c1931a3f7eaf9f7af9e3f45c70f9e1d3ff8e9f8e1c3e3073f5a42ceaa6d9c84e5552fbffdeccfc71fa33f",
        "\\insrsid4605562\\charrsid5057356 ",
        "\\rquote \\loch\\f40 s}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid5511034\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40  data collection and use in the }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid10845592 \\hich\\af40\\dbch\\af11\\loch\\f40 product}{\\rtlch\\fcs1 \\af40 ",
        "\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\s40\\fi-357\\li2863\\jclisttab\\tx2866\\lin2863 }{\\listlevel\\levelnfc23",
        "\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext31 Body 8;}{",
        "\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\lin6480 }{\\listname ;}\\listid760681750}{\\list\\listtemplateid-296591990",
        "\\b0\\insrsid935470\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 ;}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid16415067\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40  or}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid935470\\charrsid12455646 ",
        "\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\lin6480 }{\\listname ;}\\listid1433478290}{\\list\\listtemplateid303218272\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s1 \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 \\b\\f40\\fs20\\insrsid14971392\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 9.\\tab}}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid14971392\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\jclisttab\\tx2152\\lin2149 }{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'06.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\f41\\fs20\\fbias0\\hres0\\chhres0 ",
        "\\b0\\insrsid7227263\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  The properly licensed software will perform substantially as described in any Microsoft materials that accompany the software. However, Microsoft gives no contractual guarantee in relation ",
        "{\\*\\latentstyles\\lsdstimax372\\lsdlockeddef0\\lsdsemihiddendef0\\lsdunhideuseddef0\\lsdqformatdef0\\lsdprioritydef99{\\lsdlockedexcept \\lsdqformat1 \\lsdpriority0 \\lsdlocked0 Normal;\\lsdqformat1 \\lsdlocked0 heading 1;\\lsdqformat1 \\lsdlocked0 heading 2;",
        "\\lsdpriority50 \\lsdlocked0 Grid Table 5 Dark;\\lsdpriority51 \\lsdlocked0 Grid Table 6 Colorful;\\lsdpriority52 \\lsdlocked0 Grid Table 7 Colorful;\\lsdpriority46 \\lsdlocked0 Grid Table 1 Light Accent 1;\\lsdpriority47 \\lsdlocked0 Grid Table 2 Accent 1;",
        "\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935 \\hich\\af40\\dbch\\af11\\loch\\f40 This Section applies if you live in (or, if a business, your princ\\hich\\af40\\dbch\\af11\\loch\\f40 ipal place of business is in) the United States. }{\\rtlch\\fcs1 ",
        "\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693",
        "\\tqc\\tx4320\\tqr\\tx8640\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext81 \\slink82 ",
        "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000105000000000000}}",
        "{\\listlevel\\levelnfc3\\levelnfcn3\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'00.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab\\ai0\\af0 \\ltrch\\fcs0 \\b\\i0\\fbias0\\hres0\\chhres0 \\s47\\fi-360\\li360\\jclisttab\\tx360\\lin360 }",
        "\\ipgp20\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp9\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp0\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp32\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp1\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp0\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp37\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp5\\itap0",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\lang9\\langfe1033\\langnp9\\insrsid13051670\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 ",
        "\\lsdpriority61 \\lsdlocked0 Light List Accent 1;\\lsdpriority62 \\lsdlocked0 Light Grid Accent 1;\\lsdpriority63 \\lsdlocked0 Medium Shading 1 Accent 1;\\lsdpriority64 \\lsdlocked0 Medium Shading 2 Accent 1;\\lsdpriority65 \\lsdlocked0 Medium List 1 Accent 1;",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table List 4;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table List 5;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table List 6;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 Table List 7;",
        "\\levelindent0{\\leveltext\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\jclisttab\\tx6480\\lin6480 }{\\listname ;}\\listid1219436735}{\\list\\listtemplateid530381240{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\\levelfollow0",
        "\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li1440\\jclisttab\\tx1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s2 \\rtlch\\fcs1 \\ab\\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19\\insrsid7227263\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 a)\\tab}}\\pard\\plain \\ltrpar",
        "{\\flomajor\\f31500\\fbidi \\froman\\fcharset0\\fprq2{\\*\\panose 02020603050405020304}Times New Roman;}{\\fdbmajor\\f31501\\fbidi \\fnil\\fcharset134\\fprq2{\\*\\panose 02010600030101010101}SimSun{\\*\\falt \\'cb\\'ce\\'cc\\'e5};}",
        "{\\pgp\\ipgp0\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp14\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp22\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp0\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp0\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp19\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp8\\itap0\\li0\\ri0\\sb0\\sa0}{\\pgp\\ipgp17",
        "\\sbasedon0 \\snext32 Body 9;}{\\s33\\ql \\fi-357\\li357\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx360\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls1\\adjustright\\rin0\\lin357\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\ltrch\\fcs0 \\insrsid14971392\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  terms }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935 \\hich\\af40\\dbch\\af11\\loch\\f40 Microsoft}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935\\charrsid9003929 ",
        "\\levelspace0\\levelindent0{\\leveltext\\'02\\'04.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\strike0\\f41\\fs20\\ulnone\\fbias0\\hres0\\chhres0 \\s5\\fi-357\\li1792\\jclisttab\\tx2155\\lin1792 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0",
        "\\par }}{\\footerf \\ltrpar \\pard\\plain \\ltrpar\\s83\\ql \\li0\\ri0\\sb120\\sa120\\widctlpar\\tqc\\tx4320\\tqr\\tx8640\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 ",
        "\\s32\\ql \\li3221\\ri0\\sb120\\sa120\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin3221\\itap0 \\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 ",
        "{\\f65\\fbidi \\fmodern\\fcharset204\\fprq1 Courier New Cyr;}{\\f67\\fbidi \\fmodern\\fcharset161\\fprq1 Courier New Greek;}{\\f68\\fbidi \\fmodern\\fcharset162\\fprq1 Courier New Tur;}{\\f69\\fbidi \\fmodern\\fcharset177\\fprq1 Courier New (Hebrew);}",
        "\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\jclisttab\\tx6480\\lin6480 }{\\listname ;}\\listid2091727482}}{\\*\\listoverridetable{\\listoverride\\listid2054619191\\listoverridecount0\\ls1}{\\listoverride\\listid477573462",
        "\\s2\\ql \\fi-363\\li720\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx720\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls21\\ilvl1\\outlinelevel1\\adjustright\\rin0\\lin720\\itap0\\pararsid7406168 {\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid7406168\\charrsid2110843 ",
        "\\listoverridecount0\\ls2}{\\listoverride\\listid1567649130\\listoverridecount0\\ls3}{\\listoverride\\listid1559511898\\listoverridecount0\\ls4}{\\listoverride\\listid1848404271\\listoverridecount0\\ls5}{\\listoverride\\listid1877695764\\listoverridecount0\\ls6}",
        "350d363f2451eced0dae2c082e8761be9969bb979dc9136332de3168aa1a083ae995719ac16db8ec8e4052164e89d93b64b060828e6f37ed1567914b284d2624",
        ";}\\listid127548676}{\\list\\listtemplateid176468498\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid692200086\\'01\\u-3913 ?;}{\\levelnumbers;}",
        "\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li3600\\jclisttab\\tx3600\\lin3600 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li4320",
        "\\rtlch\\fcs1 \\ab\\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon44 \\snext61 Preamble Border Above;}{",
        "\\ltrch\\fcs0 \\insrsid15818407\\charrsid9003929 ",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdpriority39 \\lsdlocked0 toc 4;\\lsdsemihidden1 \\lsdunhideused1 \\lsdpriority39 \\lsdlocked0 toc 5;\\lsdsemihidden1 \\lsdunhideused1 \\lsdpriority39 \\lsdlocked0 toc 6;",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s1 \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 \\b\\f40\\fs20\\insrsid14971392\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 3.\\tab}}\\pard \\ltrpar\\s1\\ql \\fi-357\\li357\\ri0\\sb120\\sa120\\widctlpar",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 table of authorities;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 macro;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 toa heading;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 List;",
        "\\ab\\ai0\\af40\\afs20 \\ltrch\\fcs0 \\b\\i0\\f40\\fs20\\fbias0\\hres0\\chhres0 \\fi-357\\li1437\\jclisttab\\tx1800\\lin1437 }{\\listlevel\\levelnfc3\\levelnfcn3\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'03.;}{\\levelnumbers\\'01;}",
        "\\ltrch\\fcs0 \\b\\hres0\\chhres0 \\fi-360\\li1440\\jclisttab\\tx1440\\lin1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fs20\\fbias0\\hres0\\chhres0 ",
        "rican Arbitration Association}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4879935\\charrsid14122191 \\hich\\af40\\dbch\\af11\\loch\\f40  under the Federal Arbitration Act}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8743060 \\hich\\af40\\dbch\\af11\\loch\\f40 \\hich\\f40  (\\'93",
        "ch would endanger the purpose of this agreement and the compliance with which a party may constantly trust in (so-called \"cardinal obligations\"). In other cases of slight negligence, Microsoft will not be liable for slight negligence.}{\\rtlch\\fcs1 \\af40 ",
        "656d652f7468656d652f5f72656c732f7468656d654d616e616765722e786d6c2e72656c73848f4d0ac2301484f78277086f6fd3ba109126dd88d0add40384e4",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 rosoft Privacy Statement.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid5511034\\charrsid6823409 ",
        "{\\f461\\fbidi \\fswiss\\fcharset186\\fprq2 Trebuchet MS Baltic;}{\\flomajor\\f31508\\fbidi \\froman\\fcharset238\\fprq2 Times New Roman CE;}{\\flomajor\\f31509\\fbidi \\froman\\fcharset204\\fprq2 Times New Roman Cyr;}",
        "\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid1229593488\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\s38\\fi-357\\li2149\\jclisttab\\tx2152\\lin2149 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0",
        "\\hich\\af40\\dbch\\af11\\loch\\f40  for use on Windows}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid3606489\\charrsid4401995 .}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14181361\\charrsid4401995 \\hich\\af40\\dbch\\af11\\loch\\f40  You may make }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'08\\'00.\\'01.\\'02.\\'03.;}{\\levelnumbers\\'01\\'03\\'05\\'07;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-648\\li1728\\lin1728 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0",
        "32a423279a668bb6690c7e9956e90cfe766cb37b077538abd27a8b1cba48c80acc2a841f12e698f13a9e281c57911ce298950d7e03aba84ac8c154f8655c4f2a",
        "\\hich\\af40\\dbch\\af11\\loch\\f40 at }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid3953303\\charrsid3953303 \\hich\\af40\\dbch\\af11\\loch\\f40 https://go.micr}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4934089 \\hich\\af40\\dbch\\af11\\loch\\f40 osoft.com/fwlink/?LinkId=521839}{",
        "\\par {\\*\\bkmkstart OLE_LINK5}{\\*\\bkmkstart OLE_LINK6}{\\listtext\\pard\\plain\\ltrpar \\s1 \\rtlch\\fcs1 \\ab\\af40\\afs20 \\ltrch\\fcs0 \\cs118\\b\\f40\\fs20\\insrsid4879935\\charrsid14122191 \\hich\\af40\\dbch\\af11\\loch\\f40 7.\\tab}}\\pard \\ltrpar",
        "{\\f40\\fbidi \\fswiss\\fcharset0\\fprq2{\\*\\panose 00000000000000000000}Tahoma;}{\\f41\\fbidi \\fswiss\\fcharset0\\fprq2{\\*\\panose 020b0603020202020204}Trebuchet MS;}{\\f43\\fbidi \\froman\\fcharset128\\fprq1{\\*\\panose 02020609040205080304}@MS Mincho;}",
        "\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid12285173 \\hich\\af40\\dbch\\af11\\loch\\f40 distribute, }{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid935470\\charrsid12455646 \\hich\\af40\\dbch\\af11\\loch\\f40 or lend }{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 ",
        "\\b\\insrsid14971392\\charrsid9003929 .}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b\\insrsid15818407\\charrsid9003929 ",
        "\\ab\\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19 \\sbasedon10 \\slink79 \\slocked Body 0 Bold Char;}{\\s110\\ql \\li0\\ri0\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\ab\\af40\\afs20\\alang1025 \\ltrch\\fcs0 ",
        "\\fs19\\lang1033\\langfe1033\\loch\\af40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 {\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid6121706 {\\pict{\\*\\picprop\\shplid1025{\\sp{\\sn shapeType}{\\sv 1}}{\\sp{\\sn fFlipH}{\\sv 0}}",
        "\\lsdpriority67 \\lsdlocked0 Medium Grid 1 Accent 2;\\lsdpriority68 \\lsdlocked0 Medium Grid 2 Accent 2;\\lsdpriority69 \\lsdlocked0 Medium Grid 3 Accent 2;\\lsdpriority70 \\lsdlocked0 Dark List Accent 2;\\lsdpriority71 \\lsdlocked0 Colorful Shading Accent 2;",
        " ARE A BUSINESS WITH A PRINCIPAL PLACE OF BUSINESS IN}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 ) THE UNITED STATES, PLEASE READ THE }{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 ",
        "\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\langnp1033\\langfenp1033 \\sbasedon10 Char Char;}{\\s90\\ql \\li0\\ri0\\sl-240\\slmult0\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af40\\afs20\\alang1025 \\ltrch\\fcs0 ",
        "\\par {\\listtext\\pard\\plain\\ltrpar \\s2 \\rtlch\\fcs1 \\ab\\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19\\insrsid7227263\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 b)\\tab}\\hich\\af40\\dbch\\af11\\loch\\f40 Canada.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 ",
        "\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid14971392\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 ; and}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid13202321\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40  (b)}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 ",
        "\\rtlch\\fcs1 \\af40\\afs19\\alang1025 \\ltrch\\fcs0 \\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext40 Bullet 8;}{\\s41\\ql \\fi-358\\li3221\\ri0\\sb120\\sa120\\widctlpar",
        "{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\lin2160 }{\\listlevel",
        "\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li3600\\lin3600 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0",
        "\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\'02\\'00);}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li360\\lin360 }}{\\lfolevel\\listoverrideformat{\\listlevel\\levelnfc4\\levelnfcn4\\leveljc0\\leveljcn0",
        "\\lsdsemihidden1 \\lsdunhideused1 \\lsdqformat1 \\lsdpriority39 \\lsdlocked0 TOC Heading;\\lsdpriority41 \\lsdlocked0 Plain Table 1;\\lsdpriority42 \\lsdlocked0 Plain Table 2;\\lsdpriority43 \\lsdlocked0 Plain Table 3;\\lsdpriority44 \\lsdlocked0 Plain Table 4;",
        "b75a5bb1e6345e6ee6c28117e73586c1a2214ae1be07e93fb0ff51e133fb65426fa843be0fb515c187064d0cc206a2fa926d3c902e907670048d931db4c1a449",
        "\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\jclisttab\\tx6480\\lin6480 }{\\listname ;}\\listid1848404271}{\\list\\listtemplateid-1802592190\\listhybrid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5932
    },
    {
      "name": [
        "MAPPING3.MAP"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/89bfc82a0fefaa759d06ea13ba0d703e1f7399cec191c7ff8564767d9cc43afe",
      "guest_paths": [
        "C:\\Windows\\System32\\wbem\\repository\\MAPPING3.MAP"
      ],
      "size": 76744,
      "crc32": "715DE4EC",
      "md5": "4625154bdaa261d69b5eaf79135cf6a3",
      "sha1": "09ad045cc05a329d6cdf4f05c597daa51a15f0d4",
      "sha256": "89bfc82a0fefaa759d06ea13ba0d703e1f7399cec191c7ff8564767d9cc43afe",
      "sha512": "a59ee15ade9ee6f7bce6c9de1cdaefe56b23f64007dd1db0199a1a26a41f736cbc865e772fbc533ffcc014ee93f30b9225995dc3151ad25663d1f7a894bfef00",
      "rh_hash": null,
      "ssdeep": "768:T7OVVV8HvfNKDttJsnB9BSyffbzRVbUQOZcucKgCYsq6AJv+drZgNKIO:HOR8P6Gn0KfXRVQQe5jg4qLVcgNxO",
      "type": "data",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T16E736F48F9F09A86D0C54F3095222760C8ABF41BE318B797731912E16D16B736F8FE5A",
      "sha3_384": "ca6903c1d26805a8e4eb843682a19f4775a0d8434ff65bc60c90404db014410ac4034a6342584a9647d3403ea1fd35f6",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": null,
      "strings": [
        "zxg!F",
        "WG9LD",
        "09jvJ",
        "s;Vm>",
        "s`40.",
        "`WM-Q",
        "KOk9C"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 4344
    },
    {
      "name": [
        "diagerr.xml"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/a97207c2f87481b56fa4cc3d29e72e970397af596b52afb88f8239550d0161ee",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
      ],
      "size": 2210,
      "crc32": "409959F7",
      "md5": "d9da769a4f7237829633cef7c6b92516",
      "sha1": "b262510f3e0c5e94f75232b8e47af218b65b62c8",
      "sha256": "a97207c2f87481b56fa4cc3d29e72e970397af596b52afb88f8239550d0161ee",
      "sha512": "09cea621365b2c11f9e6d8f579292cd44a51ed90d6f2de98325e8ca0f2bae182ca11dedf03f78c2eb109abd8da4823f974d93f45802c7f3db84ccabf47122f27",
      "rh_hash": null,
      "ssdeep": "24:5I5aVbJDP+tUI0X3AN0/1Cvf/g3vvQ/1Cv8Gh/1Cvze/g3vO/1CvVL/1CvR/g3vB:5MwiGI0P4GsfT/7YQPo+",
      "type": "Unicode text, UTF-8 (with BOM) text, with very long lines (319)",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1E741E92DB1992EBB5C9406B8DFD038C26F8097794106A03791C4FDAFA275082F5B17CD",
      "sha3_384": "286edf432e4fc1fbb38dfcbbc4dfcffac452d834da0abf993ea85295f1d1633cfef1f0ac6ed87daebef164366629b65b",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": "\\xfeff<xml xmlns:s=\"uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882\"\n xmlns:dt=\"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882\"\n xmlns:rs=\"urn:schemas-microsoft-com:rowset\"\n xmlns:z=\"#RowsetSchema\">\n<s:Schema id=\"RowsetSchema\">\n<s:ElementType name=\"row\" content=\"eltOnly\" rs:updatable=\"true\">\n<s:AttributeType name=\"Cls\" rs:number=\"0\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Sev\" rs:number=\"1\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Maj\" rs:number=\"2\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Min\" rs:number=\"3\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"LN\" rs:number=\"4\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Fil\" rs:number=\"5\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Fun\" rs:number=\"6\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Uid\" rs:number=\"7\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Msg\" rs:number=\"8\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"PID\" rs:number=\"9\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"TID\" rs:number=\"10\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Con\" rs:number=\"11\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Exe\" rs:number=\"12\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Mod\" rs:number=\"13\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Err\" rs:number=\"14\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"MD\" rs:number=\"15\">\n<s:datatype dt:type=\"hexBinary\"/>\n</s:AttributeType>\n<s:AttributeType name=\"DT\" rs:number=\"16\">\n<s:datatype dt:type=\"dateTime\"/>\n</s:AttributeType>\n</s:ElementType>\n</s:Schema>\n<rs:data>\n<z:row Cls=\"D\" Sev=\"33554432\" Maj=\"Def\" Min=\"Def\" LN=\"663\" Fil=\"\" Fun=\"CSetupDiagnostics::LogString\" Uid=\"34242560\" Msg=\"CInstallUI::GetDefaultLanguage(2027): Result = 0x80070002\" PID=\"5932\" TID=\"4316\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod=\"MediaSetupUIMgr.dll\" Err=\"2\" MD=\"\" DT=\"2026-05-28T15:59:35\"/>\n",
      "strings": [],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5932
    },
    {
      "name": [
        "SetupMgr.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/45c2ee2387026a50f0c6b9c9119f39b6d2b6505312dbdf352399fd41e8deb78f",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\SetupMgr.dll"
      ],
      "size": 747320,
      "crc32": "9F138076",
      "md5": "59d1a173f6b27a8a1cc367ca9ff6e560",
      "sha1": "15b2c60011d97b99c4cd2eedb62ccab14d748df6",
      "sha256": "45c2ee2387026a50f0c6b9c9119f39b6d2b6505312dbdf352399fd41e8deb78f",
      "sha512": "a14d89fcf4964f7929936a16c0ef9d4896d14913b3e5bc050cd7044a1a0da50e58520de80a7966832f514365d031012d0e1829cd7b93d1b547812f8abbcf7557",
      "rh_hash": null,
      "ssdeep": "12288:yMv8NZ0L0YEgAt2dBVtnliFAAF02WPy6e5W7JrAa3vpz/VXGGT3m/YvZ0YPej/O8:yMv6q0YEgAt2RtnliFAW0jPG5wXJSDjf",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1FDF44A12BAC80169F5B73631A639373B947E79256EB4C4CF1310F91D29B29829D3C72B",
      "sha3_384": "5e832596e649dda3cf3e75f1af89a5ff3e7ef7814bebeee1811630678294995e9695ccba642ab1223bff35ff66fea8f8",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x000a2b40",
        "ep_bytes": "8bff558bec837d0c017505e8c1090000",
        "peid_signatures": null,
        "reported_checksum": "0x000b7b97",
        "actual_checksum": "0x000b7b97",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "SetupMgr.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x100b134c",
                "name": "wcsncmp"
              },
              {
                "address": "0x100b1350",
                "name": "qsort"
              },
              {
                "address": "0x100b1354",
                "name": "towlower"
              },
              {
                "address": "0x100b1358",
                "name": "memmove_s"
              },
              {
                "address": "0x100b135c",
                "name": "printf"
              },
              {
                "address": "0x100b1360",
                "name": "strrchr"
              },
              {
                "address": "0x100b1364",
                "name": "toupper"
              },
              {
                "address": "0x100b1368",
                "name": "_wtoi"
              },
              {
                "address": "0x100b136c",
                "name": "swscanf_s"
              },
              {
                "address": "0x100b1370",
                "name": "iswspace"
              },
              {
                "address": "0x100b1374",
                "name": "towupper"
              },
              {
                "address": "0x100b1378",
                "name": "_vscwprintf"
              },
              {
                "address": "0x100b137c",
                "name": "memcpy_s"
              },
              {
                "address": "0x100b1380",
                "name": "_snwprintf_s"
              },
              {
                "address": "0x100b1384",
                "name": "strstr"
              },
              {
                "address": "0x100b1388",
                "name": "strpbrk"
              },
              {
                "address": "0x100b138c",
                "name": "_snprintf_s"
              },
              {
                "address": "0x100b1390",
                "name": "strncmp"
              },
              {
                "address": "0x100b1394",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x100b1398",
                "name": "wcsrchr"
              },
              {
                "address": "0x100b139c",
                "name": "_errno"
              },
              {
                "address": "0x100b13a0",
                "name": "_vsnprintf"
              },
              {
                "address": "0x100b13a4",
                "name": "_wcsicmp"
              },
              {
                "address": "0x100b13a8",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x100b13ac",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x100b13b0",
                "name": "_purecall"
              },
              {
                "address": "0x100b13b4",
                "name": "wcschr"
              },
              {
                "address": "0x100b13b8",
                "name": "_XcptFilter"
              },
              {
                "address": "0x100b13bc",
                "name": "_amsg_exit"
              },
              {
                "address": "0x100b13c0",
                "name": "free"
              },
              {
                "address": "0x100b13c4",
                "name": "malloc"
              },
              {
                "address": "0x100b13c8",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x100b13cc",
                "name": "_lock"
              },
              {
                "address": "0x100b13d0",
                "name": "_unlock"
              },
              {
                "address": "0x100b13d4",
                "name": "__dllonexit"
              },
              {
                "address": "0x100b13d8",
                "name": "_onexit"
              },
              {
                "address": "0x100b13dc",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x100b13e0",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x100b13e4",
                "name": "memmove"
              },
              {
                "address": "0x100b13e8",
                "name": "memcpy"
              },
              {
                "address": "0x100b13ec",
                "name": "memcmp"
              },
              {
                "address": "0x100b13f0",
                "name": "_initterm"
              },
              {
                "address": "0x100b13f4",
                "name": "memset"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x100b13fc",
                "name": "RtlGetNtProductType"
              },
              {
                "address": "0x100b1400",
                "name": "RtlRandom"
              },
              {
                "address": "0x100b1404",
                "name": "NtQueryVolumeInformationFile"
              },
              {
                "address": "0x100b1408",
                "name": "RtlDeleteResource"
              },
              {
                "address": "0x100b140c",
                "name": "RtlReleaseResource"
              },
              {
                "address": "0x100b1410",
                "name": "RtlAcquireResourceShared"
              },
              {
                "address": "0x100b1414",
                "name": "RtlAcquireResourceExclusive"
              },
              {
                "address": "0x100b1418",
                "name": "RtlInitializeResource"
              },
              {
                "address": "0x100b141c",
                "name": "NtPowerInformation"
              },
              {
                "address": "0x100b1420",
                "name": "DbgPrintEx"
              },
              {
                "address": "0x100b1424",
                "name": "NtYieldExecution"
              },
              {
                "address": "0x100b1428",
                "name": "NtQueryInformationFile"
              },
              {
                "address": "0x100b142c",
                "name": "RtlReAllocateHeap"
              },
              {
                "address": "0x100b1430",
                "name": "RtlNtStatusToDosError"
              },
              {
                "address": "0x100b1434",
                "name": "NtSetInformationFile"
              },
              {
                "address": "0x100b1438",
                "name": "RtlAdjustPrivilege"
              },
              {
                "address": "0x100b143c",
                "name": "RtlGetVersion"
              },
              {
                "address": "0x100b1440",
                "name": "RtlTimeToSecondsSince1970"
              },
              {
                "address": "0x100b1444",
                "name": "RtlDestroyHeap"
              },
              {
                "address": "0x100b1448",
                "name": "RtlAllocateHeap"
              },
              {
                "address": "0x100b144c",
                "name": "RtlCreateHeap"
              },
              {
                "address": "0x100b1450",
                "name": "RtlRaiseStatus"
              },
              {
                "address": "0x100b1454",
                "name": "NtClose"
              },
              {
                "address": "0x100b1458",
                "name": "RtlDeleteCriticalSection"
              },
              {
                "address": "0x100b145c",
                "name": "RtlAcquirePrivilege"
              },
              {
                "address": "0x100b1460",
                "name": "RtlInitializeCriticalSection"
              },
              {
                "address": "0x100b1464",
                "name": "RtlNtStatusToDosErrorNoTeb"
              },
              {
                "address": "0x100b1468",
                "name": "NtSetInformationThread"
              },
              {
                "address": "0x100b146c",
                "name": "NtQueryInformationProcess"
              },
              {
                "address": "0x100b1470",
                "name": "NtCreateFile"
              },
              {
                "address": "0x100b1474",
                "name": "RtlFreeHeap"
              },
              {
                "address": "0x100b1478",
                "name": "RtlDosPathNameToNtPathName_U"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x100b10b8",
                "name": "MultiByteToWideChar"
              },
              {
                "address": "0x100b10bc",
                "name": "GetTickCount64"
              },
              {
                "address": "0x100b10c0",
                "name": "GetLastError"
              },
              {
                "address": "0x100b10c4",
                "name": "DisableThreadLibraryCalls"
              },
              {
                "address": "0x100b10c8",
                "name": "GetCurrentThread"
              },
              {
                "address": "0x100b10cc",
                "name": "DeleteFileW"
              },
              {
                "address": "0x100b10d0",
                "name": "CloseHandle"
              },
              {
                "address": "0x100b10d4",
                "name": "GetNativeSystemInfo"
              },
              {
                "address": "0x100b10d8",
                "name": "HeapAlloc"
              },
              {
                "address": "0x100b10dc",
                "name": "GetUserGeoID"
              },
              {
                "address": "0x100b10e0",
                "name": "GetProcAddress"
              },
              {
                "address": "0x100b10e4",
                "name": "LocalFree"
              },
              {
                "address": "0x100b10e8",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x100b10ec",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x100b10f0",
                "name": "CreateProcessW"
              },
              {
                "address": "0x100b10f4",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x100b10f8",
                "name": "FreeLibrary"
              },
              {
                "address": "0x100b10fc",
                "name": "WideCharToMultiByte"
              },
              {
                "address": "0x100b1100",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x100b1104",
                "name": "MoveFileW"
              },
              {
                "address": "0x100b1108",
                "name": "IsWow64Process"
              },
              {
                "address": "0x100b110c",
                "name": "GetDriveTypeW"
              },
              {
                "address": "0x100b1110",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x100b1114",
                "name": "GetExitCodeProcess"
              },
              {
                "address": "0x100b1118",
                "name": "Sleep"
              },
              {
                "address": "0x100b111c",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x100b1120",
                "name": "AcquireSRWLockExclusive"
              },
              {
                "address": "0x100b1124",
                "name": "WakeAllConditionVariable"
              },
              {
                "address": "0x100b1128",
                "name": "SleepConditionVariableSRW"
              },
              {
                "address": "0x100b112c",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x100b1130",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x100b1134",
                "name": "TerminateProcess"
              },
              {
                "address": "0x100b1138",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x100b113c",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x100b1140",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x100b1144",
                "name": "GetTickCount"
              },
              {
                "address": "0x100b1148",
                "name": "RaiseFailFastException"
              },
              {
                "address": "0x100b114c",
                "name": "OutputDebugStringA"
              },
              {
                "address": "0x100b1150",
                "name": "CompareStringOrdinal"
              },
              {
                "address": "0x100b1154",
                "name": "IsDebuggerPresent"
              },
              {
                "address": "0x100b1158",
                "name": "LoadLibraryW"
              },
              {
                "address": "0x100b115c",
                "name": "DebugBreak"
              },
              {
                "address": "0x100b1160",
                "name": "OpenProcess"
              },
              {
                "address": "0x100b1164",
                "name": "GetFileInformationByHandleEx"
              },
              {
                "address": "0x100b1168",
                "name": "DeviceIoControl"
              },
              {
                "address": "0x100b116c",
                "name": "SetFilePointer"
              },
              {
                "address": "0x100b1170",
                "name": "SetFileInformationByHandle"
              },
              {
                "address": "0x100b1174",
                "name": "FlushFileBuffers"
              },
              {
                "address": "0x100b1178",
                "name": "TlsSetValue"
              },
              {
                "address": "0x100b117c",
                "name": "TlsGetValue"
              },
              {
                "address": "0x100b1180",
                "name": "TlsFree"
              },
              {
                "address": "0x100b1184",
                "name": "SetFileTime"
              },
              {
                "address": "0x100b1188",
                "name": "GetLocalTime"
              },
              {
                "address": "0x100b118c",
                "name": "SystemTimeToFileTime"
              },
              {
                "address": "0x100b1190",
                "name": "SetFilePointerEx"
              },
              {
                "address": "0x100b1194",
                "name": "SetLastError"
              },
              {
                "address": "0x100b1198",
                "name": "WritePrivateProfileStringW"
              },
              {
                "address": "0x100b119c",
                "name": "GetPrivateProfileStringW"
              },
              {
                "address": "0x100b11a0",
                "name": "GetFileInformationByHandle"
              },
              {
                "address": "0x100b11a4",
                "name": "CopyFileExW"
              },
              {
                "address": "0x100b11a8",
                "name": "GetCurrentDirectoryW"
              },
              {
                "address": "0x100b11ac",
                "name": "FormatMessageW"
              },
              {
                "address": "0x100b11b0",
                "name": "SetEvent"
              },
              {
                "address": "0x100b11b4",
                "name": "SetFileAttributesW"
              },
              {
                "address": "0x100b11b8",
                "name": "ResetEvent"
              },
              {
                "address": "0x100b11bc",
                "name": "GetLongPathNameW"
              },
              {
                "address": "0x100b11c0",
                "name": "GetFinalPathNameByHandleW"
              },
              {
                "address": "0x100b11c4",
                "name": "GetVolumeNameForVolumeMountPointW"
              },
              {
                "address": "0x100b11c8",
                "name": "RaiseException"
              },
              {
                "address": "0x100b11cc",
                "name": "FindClose"
              },
              {
                "address": "0x100b11d0",
                "name": "GetEnvironmentVariableW"
              },
              {
                "address": "0x100b11d4",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x100b11d8",
                "name": "InitializeCriticalSectionAndSpinCount"
              },
              {
                "address": "0x100b11dc",
                "name": "GetProductInfo"
              },
              {
                "address": "0x100b11e0",
                "name": "GetGeoInfoW"
              },
              {
                "address": "0x100b11e4",
                "name": "SetEnvironmentVariableW"
              },
              {
                "address": "0x100b11e8",
                "name": "GetModuleFileNameW"
              },
              {
                "address": "0x100b11ec",
                "name": "ExpandEnvironmentStringsW"
              },
              {
                "address": "0x100b11f0",
                "name": "GetModuleHandleExW"
              },
              {
                "address": "0x100b11f4",
                "name": "WriteFile"
              },
              {
                "address": "0x100b11f8",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x100b11fc",
                "name": "FindNextFileW"
              },
              {
                "address": "0x100b1200",
                "name": "GetFullPathNameW"
              },
              {
                "address": "0x100b1204",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x100b1208",
                "name": "HeapFree"
              },
              {
                "address": "0x100b120c",
                "name": "CompareStringW"
              },
              {
                "address": "0x100b1210",
                "name": "GetFileSizeEx"
              },
              {
                "address": "0x100b1214",
                "name": "FindFirstFileW"
              },
              {
                "address": "0x100b1218",
                "name": "ReadFile"
              },
              {
                "address": "0x100b121c",
                "name": "CreateDirectoryW"
              },
              {
                "address": "0x100b1220",
                "name": "HeapSize"
              },
              {
                "address": "0x100b1224",
                "name": "HeapDestroy"
              },
              {
                "address": "0x100b1228",
                "name": "GetFileSize"
              },
              {
                "address": "0x100b122c",
                "name": "GetVolumePathNamesForVolumeNameW"
              },
              {
                "address": "0x100b1230",
                "name": "K32GetPerformanceInfo"
              },
              {
                "address": "0x100b1234",
                "name": "QueryPerformanceFrequency"
              },
              {
                "address": "0x100b1238",
                "name": "PowerCreateRequest"
              },
              {
                "address": "0x100b123c",
                "name": "LocalFileTimeToFileTime"
              },
              {
                "address": "0x100b1240",
                "name": "DosDateTimeToFileTime"
              },
              {
                "address": "0x100b1244",
                "name": "UnmapViewOfFile"
              },
              {
                "address": "0x100b1248",
                "name": "MapViewOfFile"
              },
              {
                "address": "0x100b124c",
                "name": "CreateFileMappingW"
              },
              {
                "address": "0x100b1250",
                "name": "LocalAlloc"
              },
              {
                "address": "0x100b1254",
                "name": "CreateMutexW"
              },
              {
                "address": "0x100b1258",
                "name": "ReleaseMutex"
              },
              {
                "address": "0x100b125c",
                "name": "GetHandleInformation"
              },
              {
                "address": "0x100b1260",
                "name": "SetEndOfFile"
              },
              {
                "address": "0x100b1264",
                "name": "GetOverlappedResult"
              },
              {
                "address": "0x100b1268",
                "name": "GetSystemDirectoryW"
              },
              {
                "address": "0x100b126c",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x100b1270",
                "name": "ReleaseSemaphore"
              },
              {
                "address": "0x100b1274",
                "name": "GetVolumeInformationW"
              },
              {
                "address": "0x100b1278",
                "name": "HeapReAlloc"
              },
              {
                "address": "0x100b127c",
                "name": "GetVersionExW"
              },
              {
                "address": "0x100b1280",
                "name": "WaitForMultipleObjects"
              },
              {
                "address": "0x100b1284",
                "name": "GetSystemInfo"
              },
              {
                "address": "0x100b1288",
                "name": "DuplicateHandle"
              },
              {
                "address": "0x100b128c",
                "name": "GetModuleFileNameA"
              },
              {
                "address": "0x100b1290",
                "name": "VirtualQuery"
              },
              {
                "address": "0x100b1294",
                "name": "GetTempFileNameW"
              },
              {
                "address": "0x100b1298",
                "name": "ExitProcess"
              },
              {
                "address": "0x100b129c",
                "name": "UnlockFileEx"
              },
              {
                "address": "0x100b12a0",
                "name": "LockFileEx"
              },
              {
                "address": "0x100b12a4",
                "name": "CreateEventW"
              },
              {
                "address": "0x100b12a8",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x100b12ac",
                "name": "CreateFileW"
              },
              {
                "address": "0x100b12b0",
                "name": "GetLogicalDriveStringsW"
              },
              {
                "address": "0x100b12b4",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x100b12b8",
                "name": "CreateThread"
              },
              {
                "address": "0x100b12bc",
                "name": "GetVolumePathNameW"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x100b1000",
                "name": "CheckTokenMembership"
              },
              {
                "address": "0x100b1004",
                "name": "GetTraceLoggerHandle"
              },
              {
                "address": "0x100b1008",
                "name": "GetTraceEnableFlags"
              },
              {
                "address": "0x100b100c",
                "name": "GetTraceEnableLevel"
              },
              {
                "address": "0x100b1010",
                "name": "RegisterTraceGuidsW"
              },
              {
                "address": "0x100b1014",
                "name": "UnregisterTraceGuids"
              },
              {
                "address": "0x100b1018",
                "name": "AdjustTokenPrivileges"
              },
              {
                "address": "0x100b101c",
                "name": "RevertToSelf"
              },
              {
                "address": "0x100b1020",
                "name": "EventWriteTransfer"
              },
              {
                "address": "0x100b1024",
                "name": "EventRegister"
              },
              {
                "address": "0x100b1028",
                "name": "EventProviderEnabled"
              },
              {
                "address": "0x100b102c",
                "name": "EventUnregister"
              },
              {
                "address": "0x100b1030",
                "name": "ImpersonateLoggedOnUser"
              },
              {
                "address": "0x100b1034",
                "name": "EqualSid"
              },
              {
                "address": "0x100b1038",
                "name": "SetSecurityDescriptorDacl"
              },
              {
                "address": "0x100b103c",
                "name": "RegCloseKey"
              },
              {
                "address": "0x100b1040",
                "name": "RegEnumKeyW"
              },
              {
                "address": "0x100b1044",
                "name": "RegQueryInfoKeyW"
              },
              {
                "address": "0x100b1048",
                "name": "SetSecurityDescriptorOwner"
              },
              {
                "address": "0x100b104c",
                "name": "GetAce"
              },
              {
                "address": "0x100b1050",
                "name": "RegDeleteKeyW"
              },
              {
                "address": "0x100b1054",
                "name": "AllocateAndInitializeSid"
              },
              {
                "address": "0x100b1058",
                "name": "RegCreateKeyExW"
              },
              {
                "address": "0x100b105c",
                "name": "CopySid"
              },
              {
                "address": "0x100b1060",
                "name": "RegSetKeySecurity"
              },
              {
                "address": "0x100b1064",
                "name": "RegSetValueExW"
              },
              {
                "address": "0x100b1068",
                "name": "OpenProcessToken"
              },
              {
                "address": "0x100b106c",
                "name": "FreeSid"
              },
              {
                "address": "0x100b1070",
                "name": "InitializeSecurityDescriptor"
              },
              {
                "address": "0x100b1074",
                "name": "InitializeAcl"
              },
              {
                "address": "0x100b1078",
                "name": "RegOpenKeyExW"
              },
              {
                "address": "0x100b107c",
                "name": "RegDeleteValueW"
              },
              {
                "address": "0x100b1080",
                "name": "GetLengthSid"
              },
              {
                "address": "0x100b1084",
                "name": "SetSecurityDescriptorControl"
              },
              {
                "address": "0x100b1088",
                "name": "AddAccessAllowedAce"
              },
              {
                "address": "0x100b108c",
                "name": "OpenThreadToken"
              },
              {
                "address": "0x100b1090",
                "name": "RegQueryValueExW"
              },
              {
                "address": "0x100b1094",
                "name": "SetSecurityDescriptorGroup"
              },
              {
                "address": "0x100b1098",
                "name": "GetTokenInformation"
              }
            ]
          },
          "USER32": {
            "dll": "USER32.dll",
            "imports": [
              {
                "address": "0x100b12f4",
                "name": "UnregisterClassA"
              },
              {
                "address": "0x100b12f8",
                "name": "CharNextW"
              }
            ]
          },
          "ole32": {
            "dll": "ole32.dll",
            "imports": [
              {
                "address": "0x100b1480",
                "name": "CoCreateInstance"
              },
              {
                "address": "0x100b1484",
                "name": "CoTaskMemFree"
              },
              {
                "address": "0x100b1488",
                "name": "CoSetProxyBlanket"
              }
            ]
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x100b12c4",
                "name": "SystemTimeToVariantTime"
              },
              {
                "address": "0x100b12c8",
                "name": "SysAllocString"
              },
              {
                "address": "0x100b12cc",
                "name": "SysFreeString"
              },
              {
                "address": "0x100b12d0",
                "name": "VariantInit"
              }
            ]
          },
          "RPCRT4": {
            "dll": "RPCRT4.dll",
            "imports": [
              {
                "address": "0x100b12d8",
                "name": "UuidCreate"
              },
              {
                "address": "0x100b12dc",
                "name": "UuidToStringW"
              },
              {
                "address": "0x100b12e0",
                "name": "RpcStringFreeW"
              },
              {
                "address": "0x100b12e4",
                "name": "UuidFromStringW"
              }
            ]
          },
          "SETUPAPI": {
            "dll": "SETUPAPI.dll",
            "imports": [
              {
                "address": "0x100b12ec",
                "name": "SetupIterateCabinetW"
              }
            ]
          },
          "VERSION": {
            "dll": "VERSION.dll",
            "imports": [
              {
                "address": "0x100b1300",
                "name": "GetFileVersionInfoExW"
              },
              {
                "address": "0x100b1304",
                "name": "VerQueryValueW"
              },
              {
                "address": "0x100b1308",
                "name": "GetFileVersionInfoSizeExW"
              }
            ]
          },
          "Cabinet": {
            "dll": "Cabinet.dll",
            "imports": []
          },
          "WINDLP": {
            "dll": "WINDLP.DLL",
            "imports": [
              {
                "address": "0x100b1310",
                "name": "CreateDlpRegistrar"
              },
              {
                "address": "0x100b1314",
                "name": "CreateDlpManager"
              }
            ]
          },
          "CRYPT32": {
            "dll": "CRYPT32.dll",
            "imports": [
              {
                "address": "0x100b10a0",
                "name": "CertVerifyCertificateChainPolicy"
              }
            ]
          },
          "WINTRUST": {
            "dll": "WINTRUST.dll",
            "imports": [
              {
                "address": "0x100b131c",
                "name": "WTHelperProvDataFromStateData"
              },
              {
                "address": "0x100b1320",
                "name": "WTHelperGetProvSignerFromChain"
              },
              {
                "address": "0x100b1324",
                "name": "WinVerifyTrust"
              }
            ]
          },
          "bcrypt": {
            "dll": "bcrypt.dll",
            "imports": [
              {
                "address": "0x100b132c",
                "name": "BCryptDestroyHash"
              },
              {
                "address": "0x100b1330",
                "name": "BCryptCreateHash"
              },
              {
                "address": "0x100b1334",
                "name": "BCryptFinishHash"
              },
              {
                "address": "0x100b1338",
                "name": "BCryptHashData"
              },
              {
                "address": "0x100b133c",
                "name": "BCryptCloseAlgorithmProvider"
              },
              {
                "address": "0x100b1340",
                "name": "BCryptGetProperty"
              },
              {
                "address": "0x100b1344",
                "name": "BCryptOpenAlgorithmProvider"
              }
            ]
          }
        },
        "exported_dll_name": "SETUPMGR.DLL",
        "exports": [
          {
            "address": "0x100406b0",
            "name": "CreateSetupObject",
            "ordinal": 1
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x000aa790",
            "size": "0x00000051"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x000b1494",
            "size": "0x00000140"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x000b3000",
            "size": "0x00000410"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x000b4600",
            "size": "0x00002138"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x000b4000",
            "size": "0x00006690"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x00021280",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x00001b8c",
            "size": "0x00000018"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x00001ae0",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x000b1000",
            "size": "0x00000490"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x000a97e1",
            "size_of_data": "0x000a9800",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.51"
          },
          {
            "name": ".data",
            "raw_address": "0x000a9c00",
            "virtual_address": "0x000ab000",
            "virtual_size": "0x00005028",
            "size_of_data": "0x00001c00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "1.95"
          },
          {
            "name": ".idata",
            "raw_address": "0x000ab800",
            "virtual_address": "0x000b1000",
            "virtual_size": "0x00001f78",
            "size_of_data": "0x00002000",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.63"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x000ad800",
            "virtual_address": "0x000b3000",
            "virtual_size": "0x00000410",
            "size_of_data": "0x00000600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "2.48"
          },
          {
            "name": ".reloc",
            "raw_address": "0x000ade00",
            "virtual_address": "0x000b4000",
            "virtual_size": "0x00006690",
            "size_of_data": "0x00006800",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.77"
          }
        ],
        "overlay": {
          "offset": "0x000b4600",
          "size": "0x00002138"
        },
        "resources": [
          {
            "name": "RT_VERSION",
            "offset": "0x000b3060",
            "size": "0x000003b0",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.48"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Setup Manager Implementation"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "SetupMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "77aa7403c352db0b66072ba19eeb47c8",
        "timestamp": "2067-04-11 23:07:06",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 15
      },
      "data": null,
      "strings": [
        "u.ht+",
        "SSWh8",
        "WimImageEnqueueOperation",
        "LogAdapter::Logger::LogNumObjects",
        "GetTokenInformation",
        "u+hm)",
        "7e8o8",
        "SetupManager: Error reporting Data. DataId = [%lu], HRESULT = [0x%X]",
        "SetupManager: Uninstall Disabled via install choice.",
        ".?AV?$CZeroInit@VCMoReserveManager@@$00@@",
        "STATUS_SXS_IDENTITY_DUPLICATE_ATTRIBUTE",
        "373G3",
        "CompatInstallReq",
        ".CRT$XLA",
        "(ulElementType == (0x2)) || (ulElementType == (0x3)) || (ulElementType == (0x5)) || (ulElementType == (0x1)) || (ulElementType == (0x6)) || (ulElementType == (0x7)) || (ulElementType == (0x4))",
        "(Flags & ((0x00000002) | (0x00000004))) != ((0x00000002) | (0x00000004))",
        "0R1Y1g1",
        "0(1H1r1",
        "SetupManager: Copying custom driver reflect files from [%s] -> [%s]...",
        "R0Y0w0~0",
        "CSetupManager::CopyUserProvidedFiles",
        "FailedRAMSizeCheck",
        "Microsoft Time-Stamp Service",
        "tChxK",
        "BuildInfo",
        ";!<K<P<W<^<e<l<s<z<",
        "CSetupManager::InitializeUpdateMediaAction",
        "<K=u=",
        "ExecuteMitigations: Mitigation module not found.",
        ">->=>b>",
        "%SYSTEMDRIVE%",
        "SystemTimeToFileTime",
        "STATUS_SXS_ASSEMBLY_NOT_FOUND",
        "strncmp",
        "9@9V9o9",
        "@LvT2",
        "SetupManager: Detected RS4+ upgrade, privacy consents are not required.",
        "\\\\.\\?:",
        "TelemetryAssert",
        "j\\Yuj",
        "4*464P4X4d4r4",
        "8F8j8",
        ">%>G>",
        "CSetupManager::ExecuteRollbackModeUser",
        "incomplete dynamic bit lengths tree",
        "CSetupManager::DlpManagerCallback",
        "QPWSQQh",
        "http://www.w3.org/XML/1998/namespace",
        "x9!D$",
        "9:9T9m9w9",
        "RtlNtStatusToDosError",
        "SetupManager: WIM does not contain a server image. Adding host OS and SKULIB to pkey search locations.",
        "%wNtE",
        ",X\\Rich",
        "8&838H8N8k8q8y8",
        "EnterpriseG",
        "EnableShortnamesOnApplyTarget",
        "CSetupManager::InitializeCompatGatedAction",
        "Compact",
        "WIMSetFileShortName",
        ">\"?/?v?",
        "pHeader->ulTotalSize == m_MicrodomDataBlob.Length",
        ">@d>]*R",
        "f92u9A",
        ".?AV?$CMoReserveManagerT@V?$CUnknownImpl@UIUnknown@@@@@@",
        "#document",
        "DiskSpaceInstallReq",
        "CMicrodom_Blob",
        "CompactEvalPolicyFlags",
        "DateStamp",
        "Not-null check failed: Source",
        "malloc",
        "9sTtr",
        "8U9t9",
        "7U8\\8j8&919?9U9",
        "5#6g6",
        "?MdDlt",
        "465B5K5P5]5c5",
        "CMicrodomBuilder::InsertDefaultAttributes",
        "SetupManager: Detected storage reserves mode [%d]",
        ";Y;`;",
        "QQQQj",
        "f9HBt",
        "<v<{<",
        "UCS-4",
        "SetupManager: CompactOS Disabled via Server detection.",
        "t1h<c",
        "=&=+=4=_=u=|=",
        "jThh,",
        "0\"0-33393?3d5",
        "NtQueryInformationProcess",
        "QQVW3",
        "*ppObject = State->m_pAllocator->Allocate<Actions>()",
        "Sh_^[",
        "Suspend of current task requested...",
        "RegCreateKeyExW",
        "STATUS_DUPLICATE_NAME",
        "PUBLIC",
        "DuplicateHandle",
        "UnmapViewOfFile",
        "9&:F:",
        ":!:k:",
        "<{u%;",
        "Cf9Y*",
        "676Y6`6r6y6",
        "SetupManager: No BitLocker command line option specified, will try to keep active but suspend on errors",
        "HeapSize",
        "8=8i8",
        "ESD\\Download",
        "<unknown>",
        "CSetupManager::InitializeRecoveryAction",
        "RtlReallocateLBlob",
        "Setup Phase: [%u]",
        "L$D_^[3",
        "PPSVS",
        "6e7k7{7",
        "IsDebuggerPresent",
        "\\<>:\"|?*",
        "BUCL::Rtl::BlockLookupTable<unsigned __int64,unsigned __int64,&long __stdcall Windows::Rtl::CompareIntegers<unsigned __int64>(unsigned __int64 const &,unsigned __int64 const &,int *),struct BUCL::Rtl::BlockLookupTablePODSetPolicy<unsigned __int64,unsigned __int64> >::Insert",
        "SetupManager: Error setting Count registry value: [0x%X]",
        "CMicrodomBuilder::ConsumeAttdef",
        "GetImageErrorCode",
        "CPUHeadroomPerc",
        "0%101I1U1f1{1",
        "UUPDU",
        "0\"1`1",
        "0+080`0",
        "CSetupManager::ExecuteFinalizeMode",
        "FailedRequestPerfBoost",
        "CMicrodomBuilder::CFourStringIdTable<unsigned short>::Initialize",
        "Windows::uDom::Rtl::RtlMicrodomUpdateCreateElementNs",
        "= ><>X>w>}>",
        "6;6I6R6",
        "8&8G8i8",
        "4$4O4\\4t4",
        "STATUS_NOT_SUPPORTED",
        "OpenProcess",
        "ConX::Setup::Common::COSInfoHelper::GetHostOSVersion",
        "SessionId",
        ":@:Y:",
        "9n:z:",
        "[ybVhl",
        "SetupPhaseFinalize",
        "8\"9*9=9O9\\9q9w9",
        "?3?d?p?{?",
        "MobileUpdate",
        "768A8O8v8",
        "t(j\\W",
        ";1;=;R;q;|;",
        "SetupManager: Copying user-provided private files from [%s] -> [%s]...",
        "TerminateProcess",
        "CERT_E_UNTRUSTEDCA",
        "s$97t",
        ".idata$5",
        "3n4u4}4",
        "SetupManager::ExecuteRollbackScripts: Rollback script [%s] returned: [0x%X]",
        "SetupManager: WebSetup client version not found.",
        "?*?N?T?l?s?",
        "CSetupManager::SetShowOobeOption",
        "%08lx",
        "D$8SVW",
        "RtlTranscodeLBlobs",
        ";$;);6;O;\\;",
        "<*<7<Y<w<}<",
        "CreatePath: Unable to create parent directory for [%s]; GLE = 0x%x",
        "\\imagehlp.dll",
        "20201008074259.414Z0",
        "TelemetryAssertDiagTrack",
        "4<4Z4l4",
        "ExpandEnvironmentStringsW",
        "8#8.868@8Q8d8",
        "0+02080?0T0^0p0",
        ":i;s;s<x<",
        "5.5U5]5",
        "file corrupted in block at offset %p",
        "STATUS_RESOURCE_NAME_NOT_FOUND",
        "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\LOWPART",
        "ResNodesSort",
        "onecore\\private\\base\\inc\\udom_xmlwalker.h",
        "WimEnterCriticalSectionWithLazyInitialization",
        "_purecall",
        "WIMCreateFile",
        "; ;0;O;q;",
        "040904B0",
        "Microsoft Time-Stamp Service0",
        "t;j#j",
        "Not-null check failed: MatchIndex",
        "WebSetup",
        "HeapFree",
        "MicrodomImplementation::CMicrodom::IRtlMicrodom_Cast",
        "swscanf_s",
        "SetSecurityDescriptorDacl",
        "Task progress: [%u%%]",
        "9;:B:",
        "D$ SVW",
        ".data$r$brc",
        "TlsGetValue",
        "3;3x3",
        "3#33364F4M4b4i4F5R5]5",
        "0x%08X",
        "%c:\\$Windows.~BT\\Sources",
        "Redmond1",
        "DequeueWimData",
        "ReadWimHeader",
        "DOCTYPE",
        "SetupManager::Initialize: Flags                  = [0x%X]",
        "_^u.hPR",
        "8 82898@8I8O8U8Z8i8p8",
        "091X1d1o1",
        "LockFileEx",
        "1'191^1|1",
        "ChunkWriterFlush",
        "t$Vh ",
        "ole32.dll",
        ">Y?e?",
        "LocationCode",
        "SSh @",
        ">$>*>3><>A>F>Q>V>\\>e>n>s>y>",
        "ENTITIES",
        "Failed to populate install actions from {0}",
        "2B2q2",
        "t$X9u t",
        "STATUS_REQUEST_OUT_OF_SEQUENCE",
        "j\\Yf;",
        ":.;Y;",
        "6)7Y7",
        "6<6D6L6T6\\6d6p6",
        "SetupManager::ExecuteRollbackScripts: Error launching rollback script [%s]: hr = [0x%X]",
        "4<6C6O6",
        "9<:I:V:",
        "https://go.microsoft.com/fwlink/?LinkId=841361",
        "Criticals",
        ".?AV?$CDlpWimInfoT@V?$CUnknownImpl@UIUnknown@@@@@@",
        "SetupPhaseWelcome",
        ":4:Q:g:",
        "(Properties.Elements != 0) && (Results.Elements != 0)",
        "D$4_^[",
        "UnregisterClassA",
        "888F8~8",
        ";)<;<U<",
        "SetupManager: Error Executing Custom Failure Rollback Scripts: hr = [0x%X]",
        "Not-null check failed: szWin32FilePath",
        "0&090",
        "INVALID_DISPOSITION",
        "STATUS_UNMAPPABLE_CHARACTER",
        "BUCL::Rtl::Add(cbReturnSize, cbThisSize, cbReturnSize)",
        "8(8/8=8g8n8",
        ";`<r<",
        "CompactEvalCPUHeadRoomPerc",
        "RtlDosPathNameToNtPathName_U",
        "*ppObject = State->m_pAllocator->Allocate<Downloads>()",
        "SetupCleanupTask",
        "MainOS",
        ">!>,>3>:>e>",
        "5<LuP",
        "SetupManager: Initializing paths from ActionList [%s]",
        "7'7/757P7W7i7",
        "MapViewOfFile",
        "SetupManager: ShowPrivacySettingsUI Value [%lu]",
        "ConX::Setup::Common::COSInfoHelper::GetCurrentSystemBranchName",
        "ExecuteMitigations: Loading mitigations...",
        "Z9WPt",
        "UncompressFile failed",
        "pDoctype->ulSignature == ('tDdM')",
        "MicrodomImplementation::CreateBinaryMicrodomFromXml",
        "1$1=1C1[1h1",
        "RtlXmlDefaultCompareStrings(&m_State.ParseState, Left, Right, pResult)",
        "MoSetupPhase",
        "SetupManager: ActionList install file not found.",
        "SetupManager: Error setting SetupPhase registry value: [0x%X]",
        "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a",
        ".?AVCSetupManager@@",
        "NewEntityDecl = this->AllocateStreamObject()",
        "8o8|8",
        "9%979Q9",
        "MicrodomImplementation::CMicrodom::GetElementNodeSet",
        "> >(>0>8>D>d>l>t>",
        "L$8QPS",
        "DosDateTimeToFileTime",
        "RtlCompareEncodedLBlobs",
        "PVh a",
        "$SVWh",
        "314@4O4^4k4x4",
        "SetupManager: Custom Script execution failed: [0x%X]",
        "WIMCopyFileEx failed",
        "m_AttdefListTable.Initialize()",
        "0(040?0Z0",
        "CompatMigChoice",
        "L$<_^[3",
        "=4=N=u=",
        "SetupManager: Error retrieving setup platform uninstall reason: [0x%X]",
        "Windows\\Setup\\LatentAcquisition\\ActionList.xml",
        "m_StoredTable.FindOrInsertIfNotPresent(Pair, pAttDef)",
        "3Z4r4",
        ",SVW3",
        ".xdata$x",
        "1J1Y1f1N2j2p2",
        "f90tKPhx",
        "SetupManager: CompactOS Enabled via WimBoot detection.",
        "SetupManager: User-provided driver install path [%s] does not exist.",
        "SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\RecoveredFrom",
        "8@8V8}8",
        "SYSTEM\\Setup\\MoSetup",
        "xM9sdtF",
        "_vscwprintf",
        "1.1.4",
        "7-7T7b7",
        "Microsoft Corporation1",
        "SetupManager::DetermineSetupPhase: CurrentSetupPhase [%s]",
        "Incorrect filesize. Could be corrupted",
        "\\VarFileInfo\\Translation",
        "D$@j(P3",
        "CSetupManager::OpenOrCreateDownloadTask",
        "8,8M8^8m8",
        "7[7l7",
        "4)474>4",
        "<a<h<",
        "H1S1a1\"4",
        "Not-null check failed: Context",
        "949J9q9",
        "CSetupManager::InitializeBootFinalizeAction",
        "=u=|=",
        "t(F;u",
        "Not-null check failed: Matches",
        "202H2",
        "SetupManager: CompactOS Enabled via override.",
        "StringFileInfo",
        "0g0r0",
        "1]2m2",
        "N0L0J",
        "r~akow",
        "5#505;5I5T5a5o5z5",
        "ProcessorCount",
        ">1>E>P>r>",
        "reflectdrivers",
        "2/2U2",
        "BUCL::Rtl::Increment(m_NextStringId)",
        "1 1+101V1^1g1l1x1}1",
        "090F0b0o0",
        "LowStoragePhoneMB (GB): %u (%u)",
        "CMicrodomUpdateContext::GetNodeUpdatePtr",
        "6&616J6",
        "success.cmd",
        "EvalFlags",
        "5 5.5[5a5",
        "EtwEventWrite",
        "9s8uh",
        "080@0L0l0t0|0",
        "https://go.microsoft.com/fwlink/?LinkId=624736",
        "PolicyParams:",
        "Server Core",
        "invalid stored block lengths",
        "::RtlIsLBlobValid(Blob)",
        "SetupManager: Error setting WU instance TimeStamp registry value: [0x%X]",
        "UseUUPDownload registry value: [%d], setting channels to DCAT and MuV6",
        "wLhHz",
        ">^?h?",
        "RtlWriteMicrodomXml",
        "CSetupManager::IsDeviceManaged",
        "PrivacyConsentStatus",
        "SetupManager: WebSetup data file not found",
        "? ?(?4?:?@?F?O?X?`?k?u?}?",
        "SetupManager: ActionList Language Pack Path [%s]",
        "%u.%u.%u.%u",
        "VPhxR",
        "Calling CoCreateInstance with CLSCTX_SERVER on ICbsServicingProcessor.",
        "TimeStamp",
        "<L=a=n=",
        "|%s|%d|%I64d",
        "FailedPowerCreateRequest",
        "tOf97tJh",
        "='=L=j=",
        "t)j\\V",
        "=1=N=U=c=",
        ">:>H>",
        "<.<D<^<r<",
        "t9f91t4",
        "4+464",
        ";3rU;",
        "PreDownload",
        "Attempting to cancel current task...",
        "WdsSetupLogInit",
        "SVh(Y",
        ";O;a;n;",
        "CSetupManager::SetPhase",
        "Windows",
        "EnumeratePathEx: Failed search path is >= MAX_PATH!",
        "IDREF",
        ";);3;Y;^;h;r;|;",
        "<L<w<",
        "::RtlXmlExtentToUtf8String( 0, &m_State.ParseState.RawTokenState, &Src, TempString.GetMutablePointer(), &cRequired)",
        "SetupManager: DiagnosticPrompt Enabled via detection.",
        "DecompressionRateKBs",
        "WIM\\IMAGE[*]\\TOTALBYTES",
        "AllocateReadChunk",
        "(Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::Stream) || (Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::BlobProvider) || (Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::Blob)",
        "SetupManager: Could not get ShowPrivacySettingsUI value. [0x%X]",
        "SetupMgr: Deleting environment variable SP_UPLOAD_ASIMOV.",
        "Not-null check failed: BytesRequired",
        "<%=0=n=y=",
        "DbgPrintEx",
        "575A5^5e5z6",
        "L$t_^[3",
        "SetupManager: NEO Enabled via scenario detection.",
        "RtlCopyLUtf8StringToLUnicodeString",
        "~(9~0t",
        "SetupManager: Use FU reserve for Download Disk space checks.",
        "L$$RP",
        "%Microsoft Windows Production PCA 2011",
        "Windows::Rtl::CRtlObjectTypeDescription<class MicrodomWriterImplementation::CMicrodomWriter>::CreateInstance",
        "<L=S=",
        "FailedDeCompressionRateCheck",
        "2 292",
        "CMicrodomBuilder::CNamespaceNamePrefixToAttDef::Find",
        "CSetupManager::InitializeWimLayoutAction",
        "Windows::Rtl::IPoolAllocator::AddAlignedBlob",
        "QSVWj\\",
        "=L9o<",
        "XmlParserGenerator::ParseLString",
        "ERROR_INVALID_DATATYPE",
        "4<7n7s:",
        "? ?3?F?Y?l?",
        "SetupManager: PreSelected Arch is = [%s].",
        ".text$x",
        "6(6?6]6b6v6",
        "GUARD_PAGE",
        "= >/><>",
        "7.858",
        "CSetupManager::ReportGlobalData",
        "SetupManager: Drivers Path:       [%s]",
        "count",
        "CSetupManager::SetInstallPrivatesPath",
        "SetupManager: Error incrementing rollback count value: [0x%X]",
        "<'<g<",
        "%hs: Failed to read 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber'. Error = %d",
        "<*<G<b<",
        "DeletePath: [%s] doesn't exist as a directory; nothing to delete.",
        "onecore\\base\\lstring\\lutf8_string.cpp",
        "need dictionary",
        "SYSTEM\\Setup\\MoSetup\\Volatile\\Telemetry",
        "3/8H8P8",
        "303x3",
        "CBasicNodeType::ChangeName",
        "SetupManager: Launching setup.",
        "WimAtExitInitialize",
        "ActionListParser::ParseRemoveFeature",
        "\\Microsoft\\Windows\\Setup",
        "919M9",
        "SetupManager: Error creating WU rollback registry key: [0x%X]",
        "BUCL::Rtl::Add(pCachedInfo->m_ulChildCount, pCachedInfo->m_ulAttributeCount, cNecessary)",
        "Summary",
        "CXmlCursor::CompareExtents",
        "9F sN",
        "Enumerate_Editions",
        "wn>Jj",
        "dSVWjH",
        "SetupPhasePostFinalize",
        "=$=}=m>x>",
        "SetupManager: UpdateMedia Setup Version -> [%s]",
        "RtlAppendLUtf8StringToLUtf8String",
        "=!=1=7=N=T=q=w=",
        "SetupManager: Error clearing WU rollback key: [0x%X]",
        "SetupDU",
        "NewChild->Attribute.Allocate()",
        "CompactEvalSystemPolicy",
        "failed to extract file from reference extension",
        "SetupManager: CompactOS Enabled via cached policy detection.",
        "CMicrodomBuilder::ConsumePCData",
        "CSetupManager::InitializeEulaAction",
        "VarFileInfo",
        "fmalloc failed",
        "9?:J:",
        "SetupManager: Eula action not found in Welcome task. [0x%X]",
        "CSetupManager::InitializeCompatInstallReqAction",
        "SetupManager: Cannot get BITS transport due to error 0x%X",
        "OutputLString.Buffer = static_cast<PWCHAR>(Allocator.ReserveBytes(BytesRequired, alignof(WCHAR)))",
        "CXmlNamespaceManager::Initialize",
        "000E0",
        "License.xml",
        "CSetupManager::LaunchMediaCreationTool",
        "?!?(?`?",
        "@(97u",
        ">9?@?N?",
        "7C7]7c7",
        ">??N?[?",
        "DeleteCriticalSection",
        ";B;J;r;",
        "NTSTATUS_FROM_WIN32(",
        "QSVWj2^",
        "SetupPhasePreDownload",
        "=G=N=a=",
        "DownloadSize",
        "PackageType",
        "CSetupManager::SetCompatFlags",
        "memmove",
        ">%>7>b>",
        "-F%11S({",
        "5#6)6<6B6M6T6Y6b6i6n6w6~6",
        "AdjustTokenPrivileges",
        "<WIM><TOTALBYTES>0</TOTALBYTES></WIM>",
        "pToInsertInto->Element != 0",
        "1 1=1G1Q1[1",
        "RtlXmlInitializeNextLogicalThing(this, &Init)",
        "    Language        [ %s ]",
        "CMicrodomUpdateContext::CreateVirtualAttribute",
        "5(6L6d6",
        "?#?-?7?A?",
        "8B8I8T8|8",
        "encoding",
        "2 2>2",
        "CSetupManager::InitializeComponents",
        "WimAtExitReserve",
        ":1:9:@:F:L:z:",
        "EulaDeclineTimeStamp",
        "Failed to get img event",
        "SetupManager: Error setting Eula decline TimeStamp registry value: [0x%X]",
        "919D9O9n9",
        ">(?X?",
        "7+727L7S7`7g7",
        "9$9.9F9d9u9|9",
        ":8;l;",
        "#wXsA",
        "D$0PQ",
        "1%232",
        "SVWj@3",
        "SetupManager: X64 Url = [%s], Target=[%s]",
        "%I64x",
        "Assertion failed in %hs(%i)",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteText",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetXml",
        "*ppObject = State->m_pAllocator->Allocate<RemovePackage>()",
        "SetupManager: Rollback Strictly Disabled via scenario detection.",
        "u6VVhL",
        "6!6*666d6",
        "ForceNoCompression",
        "STATUS_UNDEFINED_CHARACTER",
        "4*484W4y4",
        "CloudE",
        "=t={=",
        "HeapReAlloc",
        "UnlockFileEx",
        "ObjectHeader->uElementType == ucObjectType",
        "FACILITY_ACPI_ERROR_CODE",
        "RtlDeleteCriticalSection",
        ";(;0;8;@;H;P;\\;|;",
        "Drivers\\User",
        "SetupManager::Initialize: ActionListFilePath     = [%s]",
        "NewContext.Allocate()",
        "j Yf;",
        ">7>D>f>s>",
        "CSetupPhase::Initialize",
        "CSetupManager::OnFinishDiskSpaceInstallReqAction",
        "=&=9=L=_=",
        "STATUS_ACCESS_VIOLATION",
        "incorrect header check",
        "<*<:<D<",
        "CSetupManager::OpenOrCreateWimLayoutTask",
        "EnumeratePathEx: Unable to get reparse tag for persistent reparse point; GLE = 0x%x",
        "%hs: Registry value 'CSDBuildNumber' is not the correct type (REG_SZ).",
        "7 7N7",
        "RAMSizeMB",
        "RtlXmlDetermineStreamEncoding(&TokenizerState, &EncodingLength)",
        "=-=A=\\=",
        "SetupManager: LoadActionList failed. Error [0x%X]",
        "VirtualQuery",
        "8$8/8N8p8",
        "Failed to populate download actions from {0}",
        ";.<H<]<",
        "Fail to read WIM header",
        "t$(VW",
        ";H;O;m;",
        "092@2",
        "DeleteFileEx: Unable to remove [%s]; GLE = 0x%x",
        "BCryptCloseAlgorithmProvider",
        "Failed inserting element to cbs array at index %lu",
        "%wLtC",
        "msvcrt.dll",
        "3'4.4Z405b5",
        "LowStoragePhoneMB",
        "9$:Y:d:",
        "FALSE",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetItem",
        "4=5L5Y5y5",
        "GetCurrentThreadId",
        "8&8n8",
        "6G7N7p7z7",
        "6&717?7",
        "010@0G0V0d0",
        "CSetupManager::InitializePathsFromActionList",
        "Could not open file {0}",
        "tdj;^",
        "9R9\\9",
        "6&7;7I7O7q7",
        "=(=5=",
        "CERT_E_INVALID_POLICY",
        "Mapped Global progress: [%u%%]",
        "iswspace",
        "RtlpGenericMicrodomUpdateGetCookieForExistingThing",
        "u'hT'",
        "::RtlIsLBlobValid(Source)",
        "FreeLibrary",
        "memmove_s",
        "3*4N4q4",
        "`.data",
        "SetupPhaseLaunchSetup",
        "ELEMENT",
        "SetupMgr.dll",
        "CSetupManager::DetectNeo",
        "WIM\\IMAGE[*]\\WINDOWS\\VERSION\\SPBUILD",
        "DUImageSandbox",
        "RtlInitializeSmartLBlobWritingContext",
        "4*575\\5b5r5",
        "SetupManager: ProductCode Value [%s]",
        "STATUS_INTEGER_OVERFLOW",
        "ReadChunk",
        "onecore\\base\\xml\\udom_modify.cpp",
        "Setup Manager Implementation",
        "SetupManager: Found Activation issues",
        "InstallPackage",
        "9(:B:O:",
        "5=6W6",
        "?'?/?l?",
        "ChunkWriterEnqueue",
        "CSetupManager::ReportInitialExecuteData",
        "0A0g0",
        "%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
        "CreateSetupObject",
        "!E\\H4",
        "<5<E<j<",
        "1\"202A2I2_2g2",
        "nOa-Q",
        ";.;=;o;",
        "303E3R3u4",
        "CSetupManager::ExecuteCmdLineRollbackScripts",
        "bcrypt.dll",
        "FltCommStubCreateChild",
        "ObjectCookie.Opaque != 0",
        "6B6[6b6y6",
        "Facility=",
        "NewElement = this->AllocateStreamObject()",
        "L$(@;E",
        "2#2*212O2V2]2d2",
        "RtlIsLBlobValid(BinaryData)",
        "5*515y5",
        "5+6W6_6",
        "7T80989_9g9P:v:",
        "?9?S?[?",
        "=!>t>",
        "Parallel chunk decode queue empty; switching to synchronous decode",
        "UuidFromStringW",
        "415F8_8g8",
        "ulWhich < TheMap->Length",
        "CompareStringOrdinal",
        "ulIndex < m_Header->ulTotalNodeCount",
        ".CRT$XCA",
        "D$ $o",
        "BCryptOpenAlgorithmProvider",
        "ExecuteMitigations: Loading [%s]...",
        "6)737F7|7[8",
        "5F5d5",
        "SetupManager: Detected successful uninstall.",
        "Log: Failed To Get Msg From ID",
        "GetFileSizeEx",
        "4%4,434M4R4Y4`4g4n4u4|4",
        "CSetupManager::InitializeDUImageAction",
        "CXmlLogicalState::Initialize",
        "MigrationData",
        "SYSTEM\\Setup\\Rollback",
        "Qkkbal",
        "SetFilePointer",
        "*ppObject = State->m_pAllocator->Allocate<DownloadPackage>()",
        "STATUS_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT",
        "WTHelperGetProvSignerFromChain",
        "bucketArgument1",
        "RegisterTraceGuidsW",
        "SetupManager: Working Path:       [%s] (before)",
        "CSetupManager::SetSecurityInfo",
        "KxhL@",
        "D$0PW",
        ";R;k;s;",
        "NewTearoff.Allocate()",
        "<$<D<L<T<\\<d<p<",
        "9\\$Lt",
        ".?AUIUnknown@@",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "pDomLayout->ulSignature == ('lDdM')",
        "XkZu=",
        "RegQueryInfoKeyW",
        ":+;Y;g;",
        "Exception (code 0x%08X: %s) occurred at 0x%p in %s (+%p).  Minidump attached (%d bytes) to diagerr.xml and %s.",
        "CBSWdsLog",
        "202J2P2\\2p2w2",
        "j:Xf;F",
        "CERT_E_REVOKED",
        "STATUS_TRANSACTION_NOT_ACTIVE",
        "Not-null check failed: DocumentNode",
        ":#:0:C:I:x:",
        "SetupManager: UpdateMedia Tool Url -> [%s]",
        "Global\\WIMGAPI-LOGFILE-%c%08x'%08x",
        "Fail to flush file buffers",
        "HostOSBranchName",
        ".?AV?$CZeroInit@V?$CDlpAutoDelayLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@$00@@",
        "9$9/9@9F9O9Y9k9r9z9",
        "RtlHashEncodedLBlob",
        "4%4g4x4",
        "99t$ t",
        "s(Phhc",
        "SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability",
        "4,575Q5v5",
        "SetupManager: Copying user-provided driver reflect package files from [%s] -> [%s]...",
        "D$<Pj",
        "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\utility.c",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetMicrodomBinaryRepresentation",
        "Phase",
        "9M9l9s9",
        "9%8YWDQ",
        "NewChild->Comment.Allocate()",
        "D$8PS",
        "MigrationPackage",
        "CSetupManager::InitializePkeyGetEditionAction",
        "SLGetLicensingStatusInformation",
        "QPSVW",
        "    Product Name    [ %s ]",
        "CSetupManager::IsWebSetupCreatedMedia",
        "=H=P=v=",
        "printf",
        "2/2>2g2w2",
        "MediaBasedUpgradeUsingDynamicUpdate",
        "RtlMatchLUtf8StringAgainstPointerList",
        "252B2t2",
        "Drivers\\Reflect",
        "RtlAcquirePrivilege",
        "RegDeleteKeyW",
        "MicrodomImplementation::CMicrodom::FindObject",
        "798l8",
        ";(<2<M<_<h<z<",
        "STATUS_OBJECT_PATH_NOT_FOUND",
        "SetupManager: Unable to get geographical location [0x%X]",
        "FailedSeekLatencyCheck",
        "InternalName",
        "CryptoX86",
        "2b2i2",
        "Microsoft Corporation1.0,",
        "MaxMHz",
        "STATUS_TRANSACTIONAL_CONFLICT",
        "<==K=^=q=",
        "<8=y>~?",
        ":#;h;",
        "SetupManager: Error setting SetupProgress registry value: [0x%X]",
        "MinProcessorCount",
        "SetupManager: Error executing Feature on Demand LatentAcquisiton: [0x%X]",
        "6)666Z6+767D7]7w7",
        "NoSeekLatency",
        "250701214655Z0|1",
        "urn:schemas-microsoft-com:os-update-actionlist",
        "ERROR_SXS_FILE_HASH_MISMATCH",
        ";-<k<v<}<",
        "EffectiveFlags",
        "495k5w5",
        "SetupManager: Install file not found.",
        "9C0t%",
        "SetupManager: Could not get NV Domain. [0x%X]",
        "GetVolumePathNameW",
        "VerifyIntegrityChunk",
        "0C0J0V0d0",
        "383G3T3",
        "RaiseFailFastException",
        "oversubscribed dynamic bit lengths tree",
        "???K?R?f?p?",
        "SetupManager: Rollback Enabled via override.",
        "Overall progress: [%u%%]",
        "273I3",
        "ImageDeploy",
        "Not-null check failed: Params->Source.pIStream",
        "CSetupManager::InitializeGetWebSetupUserInputAction",
        "Scripts",
        "NewChild.Allocate()",
        ".?AVCDlpEsdWimInfo@@",
        ">R?i?t?",
        "WindowsPE",
        "FACILITY_NTSSPI",
        ":9:e:L={=",
        "Translation",
        "STATUS_FILE_CORRUPT_ERROR",
        ";1<<<",
        ":*:7:u:",
        "DecompressChunkedFile",
        ".tls$",
        "SetupManager: Skipping ActionList supplied path as it doesn't exist [%s]",
        "::BUCL::Rtl::Add<SIZE_T>( *pcElements, 10, NewCapacity)",
        "Setting %ws to %u",
        "We can only update the same product once per operation. CompDBs specified updating product at least twice: {0} with versions {1} and {2} and types {3} and {4}",
        "SetupManager: bIsDeviceManaged from UseWUServer: [%s]",
        "9#:.:N:[:",
        "WimBufferToHexString",
        "7G8Q8W8g8n8",
        "CloserElement = this->AllocateStreamObject()",
        "v.BT9",
        "FormatMessageW",
        "memcpy",
        "6Q6g6",
        "kernel32.dll",
        "GetModuleHandleW",
        "8O8c8p8",
        "STATUS_RESOURCE_TYPE_NOT_FOUND",
        "L$djo_",
        ".CRT$XLZ",
        "WVj0P",
        "GetSystemInfo",
        "SetupManager: Setting latent acquisiton ActionList path: [%s]",
        "RRA'.l",
        "cannot read WIM header",
        "3%4<4",
        "Drivers\\DU",
        "0H0y0",
        "aYd(z_C",
        "ERROR_SXS_ASSEMBLY_MISSING",
        "#comment",
        "MicrodomImplementation::CDomLayoutCache::FindObject",
        "SetupManager::ExecuteCustomScript: Script [%s] exceeded [%d] secs timeout",
        "PsfHash",
        "474F4S4|4",
        "Windows::uDom::Rtl::RtlMicrodomUpdateSetNodeName",
        "7=8D8",
        ":&:5:<:y:",
        " http://www.microsoft.com/windows0",
        "3*3R3r3",
        "VolumeSizeMB",
        "ulValue < MultFactor",
        "sources\\install.esd",
        "ReadData failed",
        "NewDocument = this->AllocateStreamObject()",
        ":&:T:^:h:r:|:",
        "GetTraceLoggerHandle",
        ";(;8;E;",
        "?(?6?e?",
        "3'474",
        "(unknown enumerant ",
        "runonce",
        "powrprof.dll",
        "HQC!!",
        "version",
        "CopyDirectoryFileCallback: The copy was canceled by the user.",
        "RegSetKeySecurity",
        "SetupLog",
        "%s %s",
        " SVW3",
        "D$ QP",
        "SetupManager: IsPrivacySettingsComplete: [%s]",
        "Hf99t",
        "1<1X1g1m1v1}1",
        "SetupManager: Unknown package category under path [%s]",
        "WIM\\IMAGE",
        ":,:N:^:n:",
        "MicrodomImplementation::CMicrodom::GetNamedNodeMapItem",
        "CSetupManager::InitializeDiskSpaceInstallReqAction",
        "CompressCaptureNode",
        "SetupManager: Welcome task not found. [0x%X]",
        "MicrodomImplementation::CMicrodom::Initialize",
        ";&;_;x;",
        "FLT_UNDERFLOW",
        "File too large {0}",
        ">L>x>",
        "Washington1",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteCData",
        ".?AVCMoReserveManager@@",
        "WakeAllConditionVariable",
        "919<9C9m9B:M:[:",
        "2 2@2L2l2t2",
        "RtlTimeToSecondsSince1970",
        "(Value == 0) || RtlIsLUtf8StringValid(Value)",
        "ASSERT: Assert failed to build string.",
        "Group",
        "TempNodes.Allocate(UpperIndex - TheElement.Reserved)",
        "RtlIsLUtf8StringValid(TagName) || (TagName == 0)",
        "RtlDestroyHeap",
        "3O3]3i3r3z3",
        "<L>[>b>p>",
        "u_Sh<",
        "1J1W1y1",
        ":%;0;K;Q;e;y;",
        ";E<O<",
        "2D2K2U2o2",
        "=3>T?",
        "@*97u",
        "RtlReallocateLUnicodeString",
        "374G4[4s4",
        "\"%s\" %s",
        "FailedLoadPowrProf",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNSNode",
        "?#?C?c?",
        "STATUS_SXS_IDENTITY_PARSE_ERROR",
        "ReleaseMutex",
        "CElementModification::ChangeTextValue",
        "BUCL::Rtl::Add<SIZE_T>(DataLength, OldLength, TempSize)",
        "SetupManager: NV Domain Value [%s]",
        "Not-null check failed: String",
        "0,070E0L0S0`0q0u0y0}0",
        "5U6\\6m6t6",
        "MediaCreate",
        "2%2l2",
        "SetupManager::ExecuteRollbackScripts: Running rollback script: [%s]",
        "1(1<1",
        "CSetupManager::InitializeActivationAction",
        "%ws\\%ws",
        "RtlpSmartLBlobWritingContextResizePolicy",
        "><>I>",
        "The existing WIM file became corrupted",
        "(NamespaceURI == 0) || RtlIsLUtf8StringValid(NamespaceURI)",
        "8^9\\:P;?<",
        "718N8`8j8",
        "dwBytesRead == dwSizeToRead",
        "BuildRevision",
        "GetHandleInformation",
        "<&<T<X=e=",
        "<(<7<z<",
        "WIM\\IMAGE[*]\\HARDLINKBYTES",
        "GetModuleHandleExW",
        ".tls$ZZZ",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\WebSetup",
        "STATUS_MEDIA_WRITE_PROTECTED",
        "PoolHeader->Signature == ('pSdM')",
        "t$j\\Q",
        "9\\$,t",
        "3$3@3i3y3",
        "8Q9`;j;~;",
        "C`j0Q",
        "WTHelperProvDataFromStateData",
        "VWPj)Z",
        "5=6H6V6",
        "Welcome",
        "272D2Q2",
        "0)1C1X1b1",
        "CSetupManager::OpenOrCreateInstallTask",
        "(system)",
        "L$\\_^[3",
        "AboveNormal",
        "3%3L3",
        "SetupManager: NEO Disabled via scenario detection.",
        "8/979",
        "SetupManager: UseWUServer Value [%lu]",
        "header version mismatch",
        "FileDescription",
        "; hash = ",
        "RtlIsLUtf8StringValid(LocalName) || (LocalName == 0)",
        "343F3r3y3",
        "2/363=3D3K3",
        "_XcptFilter",
        "STATUS_ENTRYPOINT_NOT_FOUND",
        "SWj43",
        "On allocating cbs array",
        "zupkfb^ZVSOLIEB@=:7520-+)&$\" ",
        "CompactEvalEvalFlags",
        "Not-null check failed: Params",
        ":,:1:J:W:",
        "5]5l5",
        "=3=9=i=t=",
        "SetupManager: Geographical information is not available",
        "9&969[9y9",
        "Log: Cannot convert ansi->unicode.",
        "PackagePath",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "CompatSysReq",
        "F8PSj",
        "1;1D1K1T1[1",
        "GetFileInformationByHandle",
        ">$>(>,>0>4>8><>P>T>d>h>l>",
        "SetupManager: Error setting LastBuild registry value: [0x%X]",
        "9M,tN",
        "r%*U$",
        ".idata$6",
        "@&0_DM",
        "CSetupManager::OnFinishMediaLayoutAction",
        ",Y\\*-X\\",
        "SetupManager: Detected RS2+ upgrade with privacy consents that were still pending",
        "    Image Count     [ %d ]",
        "=:=l=",
        "wcschr",
        "252B2",
        "ws.dat",
        "PRIV_INSTRUCTION",
        "assertVersion",
        "CompatGated",
        "SetSecurityDescriptorOwner",
        "D$0PS",
        "CreateMitigationManager",
        "CXmlCursor::XmlAlloc",
        "ShowWelcomeScreen",
        "9s v5",
        "onecore\\internal\\base\\inc\\rtlstringutil.h",
        "CBasicNodeType::ChangeNamespacePrefix",
        "SetupManager: DU Choice Cmdline -> [0x%X]",
        "3!3~3",
        "PPj PPPVP",
        "Wj(Q3",
        "FreeSid",
        "=:=A=c=",
        "SetupManager: Privacy Settings Complete Value [%lu]",
        "SaveOffset failed",
        "4$4Y4e4p4",
        "PQSVW",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetNamedItemNs",
        "Not-null check failed: NewXmlStream",
        "5K5r5",
        "SetupSubPhase",
        "t\"hT)",
        "onecore\\base\\cbs\\util\\cbsutil.cpp",
        "AllocChunkInfo",
        ";;<P<",
        "RtlRaiseStatus",
        "onecore\\base\\servicing\\util\\servicinghelper.cpp",
        "BUCL::Rtl::QuickSort(Pairs, CompareStringSlot)",
        "1c2j2~2",
        "UuidCreate",
        "=0=;=l=w=->5>",
        "WimInitXmlInfo",
        "b:zGl",
        "http://www.w3.org/2000/09/xmldsig#",
        "WIM\\IMAGE[*]\\WINDOWS\\VERSION\\MINOR",
        "425F5",
        ".rdata$zETW0",
        "686?6",
        "1#8,8",
        "3!31373B3P3a3q3",
        "onecore\\private\\base\\inc\\BlockLookupTable.h",
        "Stage",
        "UCS-2",
        "Microsoft Corporation",
        "BUCL::Rtl::Add<SIZE_T>( cbNecessary, Iter.Key.Length, sizeof(UCHAR), cbNecessary)",
        "ERROR_FAIL_NOACTION_REBOOT",
        "K{m<KI",
        "ForceDURestart",
        "ActionListParser::ParseDocument",
        "InstallAttempts",
        "?-?:?g?",
        "6Z7p7",
        "RSDSb",
        "EA^Wp",
        "CSetupManager::SetEulaPath",
        "SetupManager: Requesting a restart for dynamic update",
        "Customer,",
        "6(60686H6P6X6h6p6x6|6",
        "Revision",
        "STACK_OVERFLOW",
        "Failed to insert product: {0} with version {1} and type {2}",
        "=F>S>x>",
        "::RtlIsUnicodeStringValid(Source)",
        "RegQueryValueExW",
        "Index of element to insert exceeds the number of elements.",
        "Media",
        "?w$tQ",
        "SetupManager::Initialize: Mode                   = [0x%X]",
        "SetupManager: Requesting exit due to media update decision",
        "SetupManager: Could not get UseWUServer value. [0x%X]",
        ":D:{:",
        "pPQQj",
        "0$0@0",
        "STATUS_XML_PARSE_ERROR",
        "ActionListParser::ParseActions",
        "GWVVP",
        "STATUS_SXS_ASSEMBLY_MISSING",
        "GetAce",
        "9?9G9|9",
        "5G5g5y5",
        "MicrodomImplementation::CDomLayoutCache::AdvanceCachedPointer",
        "ERROR_SXS_MANIFEST_PARSE_ERROR",
        "ERROR_FAIL_REBOOT_INITIATED",
        "MicrodomImplementation::CMicrodom::CreateInterface",
        "GetProcessHeap",
        "BuildNumber",
        "4H4f4u4",
        "798h8",
        "EventProviderEnabled",
        "0&0A0S0x0",
        "CSetupManager::InitializeIsoLayoutAction",
        "CMicrodomBuilder::EndAttlist",
        "oversubscribed distance tree",
        "LoadLibraryExW",
        "*Q`L]",
        "*ppObject = State->m_pAllocator->Allocate<UpdateProduct>()",
        "SetupManager: Copying user-provided FOD package files from [%s] -> [%s]...",
        "RtlInitializeGrowingList( this, sizeof(TStoredObject), m_ulElementsPerChunk, (PVOID)m_InternalBuffer, sizeof(m_InternalBuffer), Allocator )",
        "9+9u9",
        "SetupManager: Scratch Path:       [%s]",
        "SetupManager: Found install image at [%s]!",
        "%sCore",
        "m_pTargetObject->IsNamedNodeMapValid(NodeMap)",
        "0|1:2r2",
        "3N3]3j3",
        "<*=U=",
        "SetupManager::ExecuteRollbackRecovery - Deleting all tasks except Unpack Task",
        "<%<4<M<S<m<",
        "SetupManager: Setup was suspended and error from last action is [0x%x]",
        "$OEM$",
        "SetupManager: Error setting DateStamp registry value: [0x%X]",
        "_errno",
        ";K8t ",
        "SetEndOfFile",
        "4J5^5e5",
        "ExportRepository",
        "EtwEventRegister",
        "737^7o7",
        "7%7S7k7z7!8:8G8",
        "WIMCommitImageChanges",
        "445v5}5",
        "CSetupManager::LaunchSetup",
        "2)3N3d3",
        "FeatureId",
        ";W>^>",
        "SetupManager: Requesting reboot of system...",
        "< =C=Y=p=",
        "RtlGetNtProductType",
        "CERT_E_EXPIRED",
        "E0C1)0'",
        "282d2",
        "jaYjz^j:Z",
        "?8?[?t?|?",
        "GetModuleVersion",
        "CabFileName",
        "*ppObject = State->m_pAllocator->Allocate<InstallFeature>()",
        "303L3P3p3",
        "ASSERT: %hs",
        "RegSetValueExW",
        "STATUS_BUFFER_OVERFLOW",
        "2%222Q2^2m2",
        "StringId < m_Entries.Length",
        "EtwEventEnabled",
        "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5x5",
        "Actions",
        "TempNode != Windows::Microdom::Rtl::Node::InvalidValue()",
        "040C0P0r0",
        "m_MicrodomDataBlob.Length >= sizeof(MICRODOM_HEADER)",
        "ActionListParser::ParsePlan",
        "MicrodomImplementation::CStringpoolCache::AttachToStringPool",
        "L$,QP",
        "4D5H6",
        "8@8]8",
        ";)<3<i<",
        "hSVW3",
        "\\lL\\q",
        "CSetupManager::InitializeDebuggerOptionsAction",
        "?$?)?.?8?=?B?G?V?[?a?j?t?y?",
        "SetupManager: CompactOS Enabled via AzureHost Override.",
        "UD;UD",
        "SetupManager: ActionList SafeOS Dynamic Update Path [%s]",
        "ERROR_SERVICE_DOES_NOT_EXIST",
        "=4=O=j=z=",
        "5N6[6",
        "R!s4Z",
        "SetupManager: Copying Dynamic update files from [%s] -> [%s]...",
        "SetupManager: Error setting WU ErrorCode registry value: [0x%X]",
        "CSetupManager::InitializeDiskSpaceDownloadReqAction",
        "Source.Length >= 3",
        "9X`v^j",
        "CMicrodomXmlWalker::XmlError",
        "MediaBasedUpgrade",
        "9WHvQ",
        "ProductType",
        ">+?U?",
        "Not-null check failed: Root",
        "DeletePath: Failed to obliterate [%s] (GLE = 0x%x); retrying...",
        "PsfSourceName",
        "CSetupManager::SuspendCurrentTask",
        "Latent Acquistion ActionList.xml path: [%s]",
        "`V@Pj",
        "?'?S?",
        "CSetupManager::ExecuteDownlevelMode",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNode",
        "97t?j",
        "FInvalid parameter passed to C runtime function.",
        "C;X`s",
        "WideCharToMultiByte",
        "WIM\\IMAGE[*]\\WINDOWS\\VERSION\\MAJOR",
        "MinDecompressionRateKBs",
        "\"Microsoft Window",
        "9E$u.hJ",
        "ServicingStackUpdate",
        "9H9R9",
        ">5>a>",
        "STATUS_REVISION_MISMATCH",
        "7(8;8",
        "OnDemandRetry",
        "CSetupManager::LaunchNewSetupInstance",
        "020p0x0",
        ";C;P;];",
        "9r4uC",
        "3'3a3",
        "QPQh?",
        "? ?$?<?L?P?T?l?p?t?x?",
        "SetupManager: Reporting Data - DataId = [%lu], Value = [%lu]",
        "CallNtPowerInformation",
        "ConX::Setup::Common::COSInfoHelper::GetCurrentSystemBranchName Could not open ImageHlep DLL:  Err=%d",
        "DeleteFileEx: Unable to restore attributes on [%s]; GLE = 0x%x",
        "SetupManager: PreSelected Language is = [%s].",
        "SetupManager: Detected RS2+ data-only upgrade, privacy consents are required.",
        "7 7-7D7e7j7",
        ";M w#r",
        "Criticals\\DU",
        "CMicrodomBuilder::DetermineStringTableSize",
        "<:=L=f={=",
        "FACILITY_HYPERVISOR",
        "D$$PR",
        "7#7(72777<7F7K7P7W7\\7a7h7m7r7",
        "Failed inserting element io cbs array",
        ";F$s\"j",
        "CSetupManager::SetReportId",
        "RtlDeleteResource",
        "pToRemoveFrom != 0",
        "SetupManager: Detected RS2-RS3 upgrade, privacy consents may be required in some regions.",
        "%s:(%d)",
        "ERROR_REQUEST_OUT_OF_SEQUENCE",
        "3=3r3",
        ">S>j>u>",
        "ADVAPI32.dll",
        "md3rQ@",
        "30474M4T4",
        "9\\:c:",
        "EnterCriticalSection",
        "4p5~5",
        "6(6H6d6h6",
        "CMicrodomBuilder::Initialize",
        "SVh(X",
        "SetupManager: Error setting Rollback registry values: [0x%X]",
        "MinRAMSizeMB",
        "767B7R7\\7w7",
        "EventUnregister",
        ":D:N:j:r:",
        "t$ RP",
        "5+6:6L6S6",
        "FBf;E",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::BeginOpenElement",
        "3,343<3D3L3T3\\3d3p3",
        "ybhR ",
        ">?>z>",
        "RtlReleaseResource",
        ">#?U?]?w?",
        "\\$4YY",
        "7 7'7d7o7}728=8K8",
        "STATUS_SXS_IDENTITIES_DIFFERENT",
        "SetupManager: [%s] doesn't exist! Failed to exctract license file from [%s]! ",
        "<%<,<5<H<O<X<}<",
        "ERROR_SUCCESS_REBOOT_INITIATED",
        "3,fTidTq ,>gEB;",
        "STATUS_ADVANCED_INSTALLER_FAILED",
        "=,=7=D=I=Z=_=e=j=s=x=}=",
        "9+9-:_=c=g=k=o=s=w={=",
        "ClientVersion",
        "CMicrodomBuilder::StartAttlist",
        "SetupManager: Found gated compat issues",
        "strpbrk",
        "CSetupManager::SetRollbackModeRegKeys",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate",
        "(*m_State.ParseState.pfnCompareSpecialString)(&m_State.ParseState, Extent, &ss, pResult, 0)",
        ".?AVCDlpWimInfo@@",
        "9S0vmR",
        "7%80878",
        "Express",
        "<-=]=v=",
        "SetupManager: ActionList install file found: [%s]",
        "?!?'?5?>?I?P?e?k?q?w?}?",
        "ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT",
        "RtlDuplicateLBlob",
        "GetOverlappedResult",
        "7(7H7h7",
        "SetupManager: Failed to increment rollback count. hr = [0x%X]",
        "m_StoredTable.Initialize()",
        "PPPPPj",
        "SetupManager: User-provided driver reflect path [%s] does not exist.",
        "7F7Q7_7y7",
        "MediaCreateSuccess",
        "(DynamicBuffer == 0) || (DynamicBuffer->Length == 0)",
        "<)<:<",
        "CBasicNodeType::EncodeLUtf8String",
        "RtlAllocateHeap",
        "SetupManager: Decryption key found. Deleting cached files",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::EmitAttribute",
        "|d-Vk",
        "QQSVW3",
        ".?AV?$CZeroInit@VCDlpEsdWimInfo@@$00@@",
        "Integer overflow after WriteData",
        "8&898",
        ";8;S;^;",
        "7\"8/8<8Y8",
        "1/0-0",
        "SetupManager: InstallAttempts = [%d]",
        "5!585d5",
        "1,1`1",
        "SetupManager: ActionList checking directory existence for express package [%s]",
        "Sjd[9]",
        "2*212:2I2",
        "SetupManager: Target Drive Letter set to [%c] via override.",
        "9(989E9b9",
        "t&f;E",
        "F0C;X",
        "MicrodomImplementation::CDomLayoutCache::DecodeElementCounts",
        "SetupManager: Error Executing Custom PostUninstall Scripts: hr = [0x%X]",
        "D$,WP",
        "ExecuteMitigations: Existing mitigation hash matches.",
        ".text$s",
        "NtClose",
        "MinReqDecompressionRateKBs",
        "SetupManager: Reporting Data - DataId = [%lu], Value = [%llu]",
        ":):6:V:f:s:",
        "Unable to delete install failure count REG key. GLE is [%d]",
        ";i<s<",
        "SetupManager: Error setting WU Count registry value: [0x%X]",
        "TlsSetValue",
        "%wOtF",
        "?9?O?X?b?q?{?",
        "2>3l3",
        "BUCL::Rtl::Add<SIZE_T>( sizeof(MICRODOM_HEADER), cbStringPoolSize, cbDomLayoutSize, cbPositionDataSize, cbDoctypeDataSize, cbRequiredSize)",
        "8I9P9k9r9",
        ";4;w;",
        "UuidToStringW",
        "Activation",
        "NMTOKENS",
        "false",
        "GetVolumeRootFromPath",
        "pToRemove != 0",
        ">H?T?e?p?",
        "SetupManager: Clearing Eula Declined TimeStamp key",
        ":2:f: ;U;",
        "SourceBuild",
        "ActionListParser::ParseMediaPackage",
        "SVWj2",
        "G^{P&a",
        "_onexit",
        "3c3x3",
        "preinstall.cmd",
        "\\\\?\\GlobalRoot",
        ":QVEE",
        "CSetupManager::OnFinishDiskSpaceDownloadReqAction",
        "<\"<G<e<",
        "7+7;7b7n7",
        "=<>y>",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttribute",
        "SetupManager: NEO Disabled via low cost device mode.",
        "Temp = (PUCHAR)((*RtlAllocateStringRoutine)(Bytes))",
        "=#>*>8>}>",
        "RtlGetVersion",
        "Windows::uDom::Rtl::RtlDestroyMicrodomUpdateContext",
        "<7<h<",
        "bucketArgument2",
        ">$?+?a?",
        "0\"1)1F1M1",
        "1+181",
        "5\"5@5O5X5a5v5",
        "t?Wh8",
        "RtlCalculateUtf16StringLengthFromLUtf8String",
        "q@boA",
        "Install",
        "%systemdrive%\\ESD\\Windows",
        "WWWWV",
        "> ?@?U?d?",
        "!|$<9}",
        ":5:N:",
        "CBasicNodeType::ForceValue",
        "t;f97t6",
        "DecompressChunkedFile failed",
        "TheNode != TheNode.InvalidValue()",
        "REQUIRED",
        "SetupManager: NEO Disabled via domain controller detection.",
        "?<?W?k?",
        "installx86.esd",
        "InitializeCriticalSectionAndSpinCount",
        "6S7m7s7{7",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\OSUpgrade",
        "SetupManager: Target Drive Letter set to [%c] via default.",
        "CSetupManager::InitializeDataMigrationAction",
        "=%=:=",
        "1Q1W1u1",
        "STATUS_OBJECT_NAME_COLLISION",
        "u7WVh",
        "FACILITY_DEBUGGER",
        "?$?R?_?",
        "LegalCopyright",
        "6(6<6w6",
        "PsfSourcePath",
        "<#<.<U<c<",
        "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "Duplicate remove action item or out of memory. Keyform: {0}",
        "; ;(;0;H;",
        "*ppObject = State->m_pAllocator->Allocate<InstallPackage>()",
        "NewCData = this->AllocateStreamObject()",
        ".?AV?$CMoSetupUnknownImpl@VCSetupManager@@@@",
        "Removal",
        "Y__^[",
        "tzVW3",
        "CSetupManager::InitializeCompatMigChoiceAction",
        "Expanded",
        "0&0-070I0W0^0r0y0",
        ".idata$3",
        "STATUS_SUCCESS",
        "SetupManager: User-provided privates path [%s] does not exist.",
        "SetupManager: ActionList Feature On Demand Path [%s]",
        "towlower",
        ">l>p>t>x>|>",
        "ATV&4T",
        "=$=7=>=O=V=n=u=",
        "SetupManager: Postponed Install task to Finalize phase...",
        "SetupManager: ActionList Servicing Stack Update Path [%s]",
        "STATUS_SXS_COMPONENT_STORE_CORRUPT",
        "$`2X`F",
        "Creating directory: %s",
        "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\HIGHPART",
        "SetupManager: Failed requested cleanup: [0x%X]",
        "M0K0I",
        "=Q=u=",
        "Failed to load action list:{0}",
        "9!939@9`9",
        "SetFileInformationByHandle",
        "SETUP360_LOW_COST_DEVICE",
        "wd9=4",
        "1+1T1",
        "ReadWriteDataInternal",
        "Suspend request sent.",
        "CMicrodomUpdateContext::CreateVirtualElement",
        "GetFileVersionInfoSizeExW",
        "Transfer progress: [%u%%]",
        "6$636^6",
        "FindFirstChunk",
        "??1type_info@@UAE@XZ",
        ";E;R;n;{;",
        "DriverUpdate",
        "7=7R7Y7o7v7",
        "SetupManager: PreSelected Edition is = [%s].",
        "CSetupManager::GetDUSetupResults",
        "Failed to duplicate string",
        "invalid window size",
        "PowerCreateRequest",
        "|hK,_",
        "CSetupManager::InitializePaths",
        "Host OS version: %u.%u.%u.%u %s (%hu.%hu) Platform 0x%X, SuiteMask 0x%hX, ProdType 0x%hX",
        "onecore\\base\\servicing\\actionlist\\lib\\loadactionlist\\objfre\\i386\\actionlistparser.cpp",
        "NewTempBytesRequired > TempBytesRequired",
        "EventRegister",
        "CMicrodomBuilder::EndElement",
        "808N8l8~8",
        "6]6s6",
        "7u7{7",
        "><>P>b>w>~>",
        "FLT_INVALID_OPERATION",
        "<2=F=S=",
        "E_UNEXPECTED",
        "j+Xf;",
        ">A>H>V>r>y>",
        "invalid block type",
        "CompactEvalProcessorCount",
        "ERROR_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT",
        "8I8S8k8",
        "RtlConcatenateLUtf8Strings",
        "STATUS_INVALID_SID",
        ".rdata$zETW1",
        ".edata",
        "invalid distance code",
        "= =(=1=N=o=v=",
        "SetupManager: Rollback %s via disk space detection.",
        "4F4f5",
        "S_FALSE",
        "Flags: %u",
        "SetupManager: ActionList checking file existence for canonical package [%s]",
        "RtlNtStatusToDosErrorNoTeb",
        "CSetupManager::GetCustomScriptNameFromType",
        "__rv.UcsCharacter != (0xffffffff)",
        "SetupManager: Error setting WU instance ErrorCode registry value: [0x%X]",
        "ActionListParser::ParseInstallFeature",
        "TempElements.Allocate(NewCapacity)",
        "GetFileInformationByHandleEx",
        "Assert failed to build string.",
        "1s1}1",
        "7?7N7[7y7",
        "SetupManager: Extracting the license file from [%s]...",
        "%s %s %s %s",
        "SetupManager: Rollback Disabled via scenario detection.",
        "RegOpenKeyExW",
        "postuninstall.cmd",
        "arm64",
        "FACILITY_HID_ERROR_CODE",
        ".?AVCDlpInstallWimInfo@@",
        "    Architecture    [ %s ]",
        "Failed install count for build [%s] is [%d]",
        "GetLogicalDriveStringsW",
        "9!979<9A9h9x9}9",
        "F4QQS",
        ": {0}",
        ".00cfg",
        "8%:0;",
        "?0?7?M?T?",
        "RegDeleteKeyExW",
        "9!939_9o9",
        "Not-null check failed: Length",
        "2C2G2K2O2S2W2[2_2c2g2k2l6W7n7",
        "2!3(3~3",
        "D$L9A",
        "INT_DIVIDE_BY_ZERO",
        "CMicrodomBuilder::ProduceStringTable",
        "39HPt",
        ">*?6?A?a?",
        "<-<7<",
        "2Q2s2",
        "0)070",
        "BuildBranch",
        ":=:[:y:",
        "CSetupManager::CheckForStorageReserves",
        "PSSSSSSh ",
        "F;w$r",
        "WimStrDupe",
        "r Item ",
        "585D5`5",
        "SetupPhaseMediaCreate",
        "Remapping ERROR_CANCELLED to ERROR_REQUEST_ABORTED",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
        "7%7N7",
        "GetCurrentThread",
        "CSetupManager::ExecuteMitigations",
        "4D5O5V5x5",
        "KERNEL32",
        "AddCaptureNodeToImage",
        "    WIM Path        [ %s ]",
        ".data$brc",
        "t>j<j",
        "888Q8^8",
        "8B8L8f8y8",
        "CoCreateInstance",
        "0P0~0",
        "HostOSBuildNumber",
        "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters",
        "EventWriteTransfer",
        "(NewPrefix == 0) || RtlIsLUtf8StringValid(NewPrefix)",
        "Microsoft Time-Stamp PCA 2010",
        "8 8(808<8\\8d8l8x8",
        "4=4t4",
        "Fail to update WIM header",
        "=>=e=",
        ";,;Q;",
        "SetupManager: bIsDeviceManaged from NV Domain: [%s]",
        "STATUS_NO_MORE_ENTRIES",
        "D$(PQ",
        "9,;7;",
        "Duplicate remove feature. Group: {0}, FMID: {1} , Feature: {2} or out of memory.",
        ">8>?>W>",
        "LastBuild",
        "%temp%\\UpdateMedia",
        "0'0-1F4U4s4",
        "WINDLP.DLL",
        "Legal_Policy_Statement",
        ": :9:F:W:g:",
        "819I9",
        "    Version         [ %d.%d.%d (%d.%d) ]",
        "CRYPT_E_ASN1_CORRUPT",
        "ExpressPackagePath",
        "3 3?3R3^3}3",
        "FindChunkForOffset",
        "WIM\\IMAGE[*]\\WINDOWS\\LANGUAGES\\DEFAULT",
        "::RtlIsLBlobValid(Data)",
        "ActionList",
        "__CxxFrameHandler3",
        "_wcsnicmp",
        "EnumeratePathEx: Unable to enumerate [%s]; GLE = 0x%x",
        "3G3X3t3z3",
        ">MdDtt",
        "8!8b8",
        "SetupPhaseUnknown",
        "5!6.6\\6",
        "425O5\\5|5",
        "=g={=",
        "onecore\\base\\lstring\\lunicode_string.cpp",
        "STATUS_NO_MORE_MATCHES",
        "ERROR_SERVICE_DEPENDENCY_FAIL",
        "WIM\\IMAGE[*]\\WINDOWS\\ARCH",
        "PSSSSSSh!",
        "< <N<k<t<",
        ">,>1>7>=>C>J>Z>j>r>y>",
        "1(0&0",
        "SetupManager::ExecuteCustomScript: Encountered unknown script type [0x%X]",
        "ExecutableName: ",
        "CSetupManager::OpenOrCreatePrepareTask",
        "CompressChunk",
        "__tempErr",
        "More payload found than expected",
        "0 0%0+040=0C0H0N0^0c0i0n0{0",
        "707=7W7",
        "SetupManager: Creation of failure task failed: [0x%X]",
        "WriteData failed during NULL block copy",
        "<(<0<=<W<i<v<",
        ";(;l;",
        "RtlIsLUtf8StringValid(Name)",
        "SetupManager: Uninstall Disabled via rollback option.",
        "SetupManager: Error retrieving setup platform operation: [0x%X]",
        "/ConfigFile",
        "5$5,545<5D5L5T5\\5d5p5",
        "1:1D1b1|1",
        "Windows::uDom::Rtl::RtlMicrodomUpdateCreateTextual",
        "InitializeSecurityDescriptor",
        "GetFinalPathNameByHandleW",
        ">->C>J>O>Y>_>o>t>",
        ">I?c?",
        "=I>P>",
        "CSetupManager::OpenOrCreateFinalizeTask",
        "CheckTokenMembership",
        "LoadLibraryW",
        "SetUnhandledExceptionFilter",
        "D$@PW",
        "SetupManager: Error Executing CmdLine Rollback Scripts: hr = [0x%X]",
        "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%",
        "Payload",
        ":g;n;s<z<",
        "Enumerate_OnDemand",
        "MicrodomImplementation::CDomPositionCache::GetLocation",
        "CSetupManager::ExecuteCustomFailureScripts",
        "WIM\\IMAGE[*]\\WIMBOOT",
        "DATATYPE_MISALIGNMENT",
        "SetupManager: Uninstall Enabled via override.",
        "/DynamicUpdate",
        "Failed to get img buf",
        "8X8^8p8",
        "(Bytes % sizeof(WCHAR)) == 0",
        "u.FAB;",
        "3&4>4^4",
        "%w't%",
        "NONCONTINUABLE_EXCEPTION",
        "DynamicUpdateImage",
        "advapi32.dll",
        "onecore\\base\\xml\\udom_microdom.cpp",
        "FACILITY_FILTER_MANAGER",
        "6O7a7n7",
        "DequeueNextChunk",
        "TempNodes.Allocate(this->m_LayoutCache.TotalObjectCount())",
        "t?WhP",
        "L$T_^[3",
        "=#=*=N=X=m=t=|=",
        "CSetupManager::SetFlightData",
        ":<:D:P:p:x:",
        "Finalize",
        "\\\\?\\GLOBALROOT",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::CloseElement",
        "wH9\\$",
        "Failed to add product.",
        "Y4?L8M",
        "LangPacks",
        "RtlXmlNextLogicalThing( &m_State, &m_Namespaces, &m_CurrentThing, &m_AttributeList )",
        "3'3@3H3",
        "RtlInitLUnicodeStringFromUnicodeString",
        "yoj@j",
        "20201009151940Z0w0=",
        "SetupManager: No BitLocker command line option specified, Suspending Bitlocker on Aruba device",
        "Sources\\ws.dat",
        "%windir%\\Panther",
        "A4;F<t?",
        "\\$4Sj",
        "STATUS_BUFFER_TOO_SMALL",
        "ERROR_BAD_ENVIRONMENT",
        "this->m_PositionList.Allocate(LocationHeader->ulItemCount)",
        "SetupManager: Error setting WU LocationCode registry value: [0x%X]",
        ".CRT$XIZ",
        "STATUS_DISK_FULL",
        "MicrodomImplementation::CDomLayoutCache::GetNodeChildren",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetNamedItem",
        "((HRESULT)0x8007000EL)",
        "_snprintf_s",
        "pToRemoveFrom->Element != 0",
        ";M;T;v;};",
        "PANTHER_ENABLE_TELASSERT",
        "Progress stalled: [ Error: 0x%X ] %s ",
        "Global\\WdsSetupLogInit",
        "CompanyName",
        "CSetupManager::OnFinishUpdateMedia",
        "4=4z4",
        "'030>0d0x0",
        "CXmlCursor::CompareStrings",
        "667=7h7o7",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteProcessingInstruction",
        "SYSTEM\\Setup",
        "EditionId",
        "FLT_OVERFLOW",
        "RtlIsLUtf8StringValid(ElementId)",
        "CSetupManager::IsCustomScriptRunningInUpLevel",
        "diagerr.mdmp",
        "4#5[5",
        "484M4Z4t4",
        "D$hPW",
        "t';_(w\"",
        "SetupManager::OpenOrCreateTask: Found task [%s] in state [0x%x] - Action [0x%X].",
        "0123456789abcdef",
        "t$PPj",
        "CSetupManager::CheckMCTUpgradeNow",
        "http://www.w3.org/2000/xmlns/",
        ";Z<d<",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementNodeSet",
        "3!4h4p4",
        ":_;o;",
        "CSetupManager::DetectCompactOS",
        "748I8[8q8",
        "<i=p=",
        "UpdateProduct",
        "?4?<?`?h?",
        ">;?B?V?]?i?",
        "CSetupManager::SetInstallPackagePaths",
        "SetupManager: Found downloadreq disk space issues",
        "CreateFileW",
        ";5<z<",
        "SetFilePointerEx",
        "Windows::StringUtil::Rtl::Impl::CalculateEncodingLengthForString",
        "SetupManager::DetermineSetupPhase: Task [%s] already completed.",
        "?.???T?i?z?",
        "4(474E4T4",
        "SetupManager: Media Path:         [%s] (found)",
        ";s s%k",
        "PayloadFileName",
        "<=<h<",
        "onecore\\internal\\base\\inc\\rtl_object_library.h",
        "9\":/:W:{:",
        ".?AV?$CDlpAutoDelayLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@",
        "STATUS_NOINTERFACE",
        "wcsrchr",
        ";%;,;D;];j;q;",
        "SLC.DLL",
        "Not-null check failed: pContents",
        "<V=|=",
        ";;;Y;z;",
        ".text",
        "Layout",
        "9i9p9",
        "SetupManager: HTTP protocol will be used for download.",
        "CreateProcessW",
        ":MdSpt",
        "181M1g1o1",
        "3@3^3j3u3",
        "FACILITY_WIN32",
        ";*;<;a;",
        "GetGeoInfoW",
        "6+606R6f6u6",
        "WIM\\IMAGE[*]\\WINDOWS\\EDITIONID",
        "LogSharingViolationErrorInfo",
        "STATUS_SHARING_VIOLATION",
        "TRUST_E_NOSIGNATURE",
        "CopyDirectoryEx2: Specified directory [%s] doesn't exist",
        "7-7o7",
        "SetupManager: User needs to go through welcome task.",
        "NewAttribute = this->AllocateStreamObject()",
        "575F5S5s5",
        "RtlAppendUcsCharacterToLUtf8String",
        "SetupManager::Initialize: Scenario               = [0x%X]",
        "CompactEvalCurrentMHz",
        "=S>Z>",
        "No more than one flag set check failed: __e",
        "FLT_DENORMAL_OPERAND",
        "3!3*363B3G3Q3]3b3n3x3}3",
        "9Kdt_",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNS",
        "N+@:81J",
        "0PQQj",
        "4)4F4Y4i4v4",
        "Windows::uDom::Rtl::RtlMicrodomUpdateRemoveChild",
        "FODs\\User",
        "tO|FCould not open {0}",
        "|$HSQ",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "Not-null check failed: pOutputStream",
        "10.0.19041.572",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "?,?V?]?n?",
        "IMPLIED",
        "pHeader->ulOffsetToPositionData < pHeader->ulTotalSize",
        "tn8^\\t",
        "SVWjd",
        "WIM\\IMAGE[*]\\CREATIONTIME\\LOWPART",
        "LPforAnalysis",
        "RtlReAllocateHeap",
        ":!;h;",
        "Not-null check failed: fHasAttributes",
        "<#=)=@=P=e=u=",
        "tIWPd",
        "232B2}2",
        "SetupManager: DU Channels Flag -> [0x%X]",
        "t$T+t$",
        "MicrodomImplementation::CMicrodom::GetNodeMapNamedItem",
        "IsWow64Process",
        "0 080E0^0k0z0",
        "5I6b6j6",
        "9(:0:r:",
        "L$$_^[3",
        "MaxDecompressionRateKBs",
        "SetupManager::ExecuteCustomScript: Failed error GUID telemetry: hr = [0x%X], dataid = [0x%X], value = [%s]",
        "onecore\\base\\xml\\udom_xmlwalker.h",
        "5\"5>5R5a5y5",
        "LocationHeader->Signature == ('cLdM')",
        "CSetupManager::Cancel",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementsByTagNameNS",
        "EventSetInformation",
        "< <(<<<L<P<h<l<t<|<",
        "CSetupManager::OnFinishWimLayoutAction",
        " 0'050",
        "D$(SVW3",
        "ERROR_ALREADY_EXISTS",
        "SetFileAttributesW",
        "VWhp]",
        "939N9i9",
        "WIM\\IMAGE[*]\\FILECOUNT",
        "_vsnwprintf",
        "CoCreateInstance on ICbsServicingProcessor result: [0x%X]",
        "%016I64x",
        ";#;9;B;Q;c;p;",
        "(LocationHeader->ulFlags & ~((0x00000001) | (0x00000002) | (0x00000003))) == 0",
        "ConstructPartialMsgVW: MALLOC failed",
        "BUCL::Rtl::ConvertInteger(pObject->m_cChildren, pDocument->usChildNodes)",
        "6L7R7b7v7~7",
        ";8;I;X;p;",
        ">$>0>P>X>`>h>p>x>",
        "GetVersionExW",
        "rz9|$ |t",
        "OnDemandLateAcquisition",
        "5E6K6]6w6",
        "E_INVALIDARG",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttributes",
        "D$XPj",
        "ActionListParser::ParseUpdateProduct",
        "3#3;3J3X3j3u3",
        "TheDocument.Reserved == m_pTargetObject->m_LayoutCache.DocumentId()",
        "Microsoft Corporation1200",
        "SetupManager: Failed to check if Privacy Settings complete. Assuming incomplete. Error: [0x%X]",
        ">4?C?P?d?j?{?",
        "too many length or distance symbols",
        "SetupManager: Error deleting cleanup task: [0x%X]",
        "DetermineSetupPhase: Welcome phase unexpected in this mode.",
        "FACILITY_CLUSTER_ERROR_CODE",
        ",Code=",
        ";/;<;",
        "Not-null check failed: Document",
        "4<416",
        "2K2x2S4]4",
        ">H?~?",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocumentElement",
        "HeapAlloc",
        "2*282R2{2",
        "8)8C8t8",
        "MinProcessorCount: %u",
        "7:7A7J7n7",
        ";N;n;",
        "invalid bit length repeat",
        "7L8u8",
        "2.2\\2",
        "SetupManager: Uninstall Disabled via override.",
        "SetupManager: In case of no cleanup, we should set the original state back.",
        "u+jKh",
        "QueryPerformanceCounter",
        "WdsLogStructuredException",
        "~j\\XPW",
        "SleepConditionVariableSRW",
        "4.5E5l5",
        "BuildString",
        "Not-null check failed: Data",
        "SetupManager: PartitionResize Disabled via override.",
        "ActionListParser::ParsePayload",
        "SetupPhasePrepare",
        ",3W6Jv5kV0INlt84D0kqiBH+ZJyxms2eZMlcK2gbFmH0=0Z",
        "GetLocalTime",
        "EnablePreviewBuilds",
        "PsfTargetName",
        "Informational,",
        "464b4",
        "SP_UPLOAD_ASIMOV",
        "ConX::Setup::Common::COSInfoHelper::GetCurrentSystemBranchName GetSystemDirectory() failed :  Err=%d",
        "HRESULT_FROM_WIN32(",
        "Not-null check failed: NodeList",
        ".CRT$XCZ",
        "STATUS_NO_MORE_FILES",
        "SVWj,3",
        "_FC;]",
        "6S6l6t6",
        "6^6{6",
        "0,1Y1",
        "ModuleCollection",
        "&quot;",
        "WIM\\IMAGE[*]\\DIRCOUNT",
        ";P<^<t<",
        "toupper",
        ";5;S;c;",
        "CSetupManager::OnFinishCompatGatedAction",
        "INT_OVERFLOW",
        "Not-null check failed: Value",
        "1B1T1a1z1",
        "<*<1<J<Q<i<p<",
        "ReserveManager.dll",
        "CMicrodom",
        "~(G;~",
        "CreateEventW",
        "\\Program Files\\WindowsApps\\",
        "7 7(747T7\\7d7l7t7",
        "FLT_STACK_CHECK",
        "1!1*151=1F1P1U1Z1_1j1o1w1|1",
        "D$|PQ",
        "?-?:?u?",
        "Warning,",
        "WIM %s, offset %.8x%.8x, length %x",
        "Failed to populate Plan from {0}",
        "SetupManager: Error setting TimeStamp registry value: [0x%X]",
        "ERROR_INTERNAL_ERROR",
        "D$d9C",
        "DUDownload\\Setup",
        "invalid literal/length code",
        ";/;{;",
        "9 9(949T9\\9h9",
        "GetLengthSid",
        "EncodingSizer != 0",
        "< <(<0<H<P<X<`<h<",
        "onecore\\base\\xml\\parsergenerator\\lib\\xpgutil.cpp",
        "*** Assertion failed: %s",
        "SetupManager: FailureCount = [%d]",
        "Task cancel request returned: [0x%X]",
        "9$9,949<9D9L9T9\\9d9l9t9",
        "CXmlCursor::Next",
        "%I64d",
        "Not-null check failed: pUpdateCookie",
        "K32GetPerformanceInfo",
        "0E0R0",
        "6/656H6`6",
        "PQVj\\Z",
        "2#2P2n2",
        "SetupProgress",
        "979D9i9",
        "SetupManager: User-provided langpack path [%s] does not exist.",
        "CSetupManager::OpenOrCreateWelcomeTask",
        "8+8N8",
        "<9<H<U<",
        "CurrentMHz",
        "1\"2/2Z2}2",
        "3=4Y4t4",
        "8^9e9",
        ".text$yd",
        "WriteData failed",
        "SetupManager: Found downloadreq compat issues",
        "CompactEvalVolumeSizeMB",
        "SetupManager: Error setting SetupSubPhase registry value: [0x%X]",
        "TelemetryAssertList",
        "SetupManager: bIsDeviceManaged from EditionId: [%s]",
        "0 0$0(0<0@0D0\\0l0p0x0",
        ".CRT$XIAA",
        "Enumerate",
        "E$j$Z",
        "3>3T3[3y3",
        ":8:Z:|:",
        "0B0I0R1Y1",
        "FACILITY_TERMINAL_SERVER",
        "MultiLayout",
        "DeletePath: Cannot delete <null>.",
        "8%828J8Z8",
        "CSetupPhase::Set",
        "Advertise",
        "ERROR_ACCESS_DENIED",
        "WdsRemoveDirectory: Unable to remove directory [%s]; GLE = 0x%x",
        "SetupManager: Failed to set WebSetup session Id",
        "1H2O2",
        "fAlreadyExisted",
        "CertVerifyCertificateChainPolicy",
        "j\\Zf;Ty",
        "=^=v=",
        "= =$=<=L=P=`=d=|=",
        "CMicrodomBuilder::AddString",
        "OnDemand",
        "PVVVVh",
        "8!9+959?9I9w9",
        "base\\ntsetup\\conx\\common\\setuplib\\src\\osinfo.cpp",
        "OfferPackage",
        "ActionListParser::ParseRemovePackage",
        "Not-null check failed: pWriter",
        "NtCreateFile",
        "060W0f0s031}1",
        "CBasicNodeType::ForceNameSetting",
        "=%=:=K=o=",
        "MinCPUHeadroom (Perc): %u",
        "DeleteFileW",
        "SetupPlatform",
        "SetupManager: Scratch Path:       [%s] (after)",
        "CSetupManager::InitializeUpgLayoutAction",
        "Count",
        "RtlXmlDestroyNextLogicalThing(this)",
        "=1>I>Z>h>",
        "DetermineSetupPhase: Converting Welcome phase to Prepare phase.",
        "Duplicate install feature. Group: {0}, FMID: {1} , Feature: {2} or out of memory.",
        "F(9^$u",
        "GetTraceEnableFlags",
        "CSetupManager::ReportSetupMgrData",
        "RtlAcquireResourceShared",
        "4/4M4a4g4",
        "7!7*7",
        "ReleaseSemaphore",
        "RtlXmlInitializeTokenization(&TokenizerState, &TokenizerInit)",
        "8#848=8G8X8l8t8",
        "ActionListParser::ParseOfferPackage",
        "pStringPool->Signature == ('pSdM')",
        "TempTempElements.Allocate(NewCapacity)",
        "?terminate@@YAXXZ",
        "ActionListParser::ParseActionListDocument",
        "RegCloseKey",
        "t!h`I",
        "FACILITY_USB_ERROR_CODE",
        "9$:t:",
        "Microsoft America Operations1&0$",
        "onecore\\base\\Cbs\\Util\\inc\\CbsArray.h",
        "%s (Error = %d)",
        "CSetupManager::InitializeCryptoAction",
        "@_^[]",
        "Not-null check failed: NewMicrodom",
        "9J:o:",
        "<Y<z<",
        "QQSVWj",
        "CompressFileBackedByWim",
        "%hs: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber' does not exist. Assume 0",
        "01181",
        "<+<p<",
        "0F0O0~0",
        "<5<i<{<",
        "SetupManager: EditionID Value [%s]",
        "SystemPolicy",
        "FLT_DIVIDE_BY_ZERO",
        "Not-null check failed: PseudoKeyOut",
        "GetProcAddress",
        "2<2j2",
        "FindClose",
        ";(;N;s;{;",
        "SetupMgr: Expanding cab [%s] to [%s].",
        "t[SSSP",
        "CMicrodomBuilder::CFourStringIdTable<struct _MICRODOM_XML_ATTDEF const *>::Initialize",
        "InitializeCriticalSection",
        "2(3C3d3t3",
        "GetFileContents",
        "BCryptCreateHash",
        "RegValue %ws is %u",
        "Not-null check failed: pDocument",
        "Microsoft Corporation1&0$",
        "1.2K2P2i2p2",
        "GetModuleFileNameW",
        "2R2{2",
        "ExecuteMitigations: Executing desktop upgrade mitigations...",
        "t$h(b",
        "CSetupManager::ConfigureProgress",
        "STATUS_ACCESS_DENIED",
        "onecore\\base\\xml\\isolib_parser.h",
        "ResetEvent",
        "4!5E5W5d5",
        "CSetupManager::ExecuteCustomPostUninstallScripts",
        "*ppvAlloc = RtlAllocateHeap((((PPEB)__readfsdword(((LONG)(LONG_PTR)&(((TEB *)0)->ProcessEnvironmentBlock))))->ProcessHeap), 0, cb)",
        "CSetupManager::SetEsdDiskCleanupRegistryValues",
        "Not-null check failed: DataBlock",
        "Array size too big",
        "GetFileSize",
        "0#1;1f1y1",
        "ReleaseSRWLockExclusive",
        "RVPht",
        "CSetupManager::GetDUImageResults",
        "RtlAllocateLBlob",
        "WWWWVP",
        ".CRT$XCU",
        "CreateMutexW",
        "SetupPhaseInstall",
        "SetupManager: CompactOS Disabled via policy detection.",
        "MediaBasedUpgradeUsingLocalCompDB",
        ">+>:>G>",
        "3*4u5",
        "]._g*",
        "SetupManager: Initializing paths from ActionList [%s] for SetupDU",
        "D$0SV",
        "\\O#]`",
        ">(?D?]?",
        "Integer overflow after ReadData",
        "9KdtL",
        "SetupManager: Found sysreq compat issues",
        "CMicrodomBuilder::ConsumeComment",
        "YY_^]",
        "BUCL::Rtl::AddInPlaceWithOverflowCheck(&MaximumLength, Sources[i].Length)",
        "<1<S<",
        "STATUS_SXS_MANIFEST_PARSE_ERROR",
        "Index out of bound.",
        "D$$PQ",
        "::RtlIsLUtf8StringValid(Candidates[i])",
        "CoSetProxyBlanket",
        "standalone",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementsByTagName",
        "LowStorageSSDMinRAMSizeMB",
        "RtlIsMicrodomUpdateContextValid(TheContext)",
        "9;9b9",
        "LangPacks\\User",
        "CMicrodomBuilder::CNamespaceNamePrefixToAttDef::Insert",
        "9?:f:",
        "'XD}*",
        "RtlGetCharacterSetDecoder",
        "JVVVS",
        "IsoLayout",
        "EqualSid",
        "STATUS_OBJECT_NAME_NOT_FOUND",
        "223J3W3|3;4Y4f4",
        ">\"?,?X?_?r?",
        "ERROR_FAIL_REBOOT_REQUIRED",
        "GetWebSetupUserInput",
        ":t:|:",
        "UTF-16",
        "5-6$737K7i7",
        "CSetupManager::CancelCurrentTask",
        "ERROR_MOD_NOT_FOUND",
        "1+181M1S1u1",
        "m_StoredTable.FindOrInsertIfNotPresent(p, (USHORT)0, 0, &fExisted)",
        "FACILITY_FVE_ERROR_CODE",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::CTempOutputStream::CreateInterface",
        "SetupManager: Error setting WU BuildString registry value: [0x%X]",
        "FACILTIY_MUI_ERROR_CODE",
        "SetupManager: Error retrieving setup platform result: [0x%X]",
        "::RtlIsLBlobValid(Destination)",
        "WriteDataCallback",
        "> >'>->3>9>>>D>U>\\>b>l>|>",
        "SetupManager: DU Categories Flag -> [0x%X]",
        "SetupPhaseDownload",
        "D$$;D$",
        "5&6[6f6",
        "SetupManager: Target Drive Letter not set.",
        "Download to external drive [%c]",
        "*ppObject = State->m_pAllocator->Allocate<Media>()",
        "%s(%d): Result = 0x%X",
        "CoTaskMemFree",
        "UseWUServer",
        "=4>j>",
        ".data",
        ".?AV?$CZeroInit@VCDlpWimInfo@@$00@@",
        "fFound",
        ";S s!k",
        "SetupPhaseUnpack",
        "SetupManager: Detected Pre-RS2 upgrade, privacy consents are required.",
        "UncompressFile",
        "DetermineSetupPhase: Converting Welcome phase to Predownload phase.",
        "?0?7?H?O?h?",
        "1 1L1Y1`1",
        "SetupManager: Deleting task: [%s]...",
        ";_;l;+=",
        "empty distance tree with lengths",
        "NOTATION",
        "STATUS_DUPLICATE_OBJECTID",
        "FIXED",
        "SetupManager::ExecuteCustomScript: Failed error exit code telemetry: hr = [0x%X], dataid = [0x%X], value = [0x%X]",
        "CSetupManager::CopyDynamicUpdateFiles",
        "CeipIsOptedIn",
        "525I5Q5^5x5",
        "5\"6'6B6H6N6T6",
        "\"RR9Rp",
        "+RjjQ3",
        " Windows",
        "t-j._f;9u",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\OSUpgrade\\Rollback",
        "p!c5Mf",
        "FACILITY_RPC_RUNTIME",
        "DetermineSetupPhase: Found Welcome phase from serialization.",
        "tGhHF",
        "%windir%\\Logs\\MoSetup",
        ",f~|z[WP",
        "SetupManager: Scratch Path:       [%s] (before)",
        ";\";x;",
        "?W?h?y?",
        "3$343;3H3O3V3",
        "strstr",
        "Pairs.Allocate(m_StringTable.GetEntryCount())",
        "SetupManager: Uninstall Disabled via scenario detection.",
        "SetupMgr: Error deleting environment variable SP_UPLOAD_ASIMOV. GLE = [%d]",
        "failure.cmd",
        "CERT_E_ISSUERCHAINING",
        "Not-null check failed: ComparisonResult",
        "585C5J5",
        "SetupManager: Cannot cancel existing BITS downloads due to error 0x%X",
        "*41;D$<s",
        "CharNextW",
        "RegDeleteValueW",
        "7&7D7b7r7",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetPropertiesSetup",
        ">MdSpt",
        "0,040<0D0L0T0\\0d0l0t0",
        "RtlIsLUtf8StringValid(Source)",
        "2W3g3t3",
        "ERROR_SUCCESS_REBOOT_REQUIRED",
        "CSetupManager::InitializeCompatSysReqAction",
        "xJj&Y",
        "SetupManager: Error requesting priority -> [0x%X]",
        "CSetupManager::SetPriority",
        "RtlAcquireResourceExclusive",
        "1[1h1C2{2",
        "y/VhV",
        "MinDecompressionRateHeadroomKBs",
        "wcsncmp",
        "=#=O=j=",
        "Cabinet.dll",
        "*ppObject = State->m_pAllocator->Allocate<RemoveFeature>()",
        "STATUS_SMI_PRIMITIVE_INSTALLER_FAILED",
        "y)Vhy",
        "=K>f>",
        "Could not query file size for {0}",
        "SetupManager: Requesting WINDLP priority: [0x%X]...",
        ":r:~:",
        "WIM\\IMAGE[*]\\WINDOWS\\INSTALLATIONTYPE",
        "CSetupManager::CreatePidTxtFile",
        "[ybVh",
        "/Telemetry",
        ";%;E;W;",
        "ERROR_SHARING_VIOLATION",
        "STATUS_CANNOT_DELETE",
        "6#6r6",
        ">1>8>",
        "5*595s5",
        "CSetupManager::Execute",
        "CSetupManager::GetCurrentPrivacyConsentStatus",
        "Global\\SetupLog",
        "SessionData",
        "header type/size mismatch",
        "CorrelationVector",
        "PackageHash",
        "SetupManager: Region detected [%s]",
        "Not-null check failed: Decoder",
        "m_Entries.Allocate(PoolHeader->TotalCount)",
        "SetupManager: DiagnosticPrompt Disabled via detection.",
        "Not-null check failed: fHasChildNodes",
        "MaxVolumeSizeMB",
        "787i7",
        "<E=J=",
        "TheEndElement = this->AllocateStreamObject()",
        "Keyform",
        "C0_^[]",
        "Value=%s",
        "_^[+P",
        "CreateFileMappingW",
        "Normal",
        "originatingBinary",
        "E_POINTER",
        "SetupManager: ActionList Local Experience Pack Path [%s]",
        "tpSVj",
        "rAhp^",
        "EnumeratePathEx: FindFirstFile failed for [%s]; GLE = 0x%x",
        "SLGetSLIDList",
        "Sleep",
        "strrchr",
        "STATUS_NAME_TOO_LONG",
        "SetupManager: Local Media Path:   [%s] (after)",
        "EnumeratePathEx: Callback requested enumeration interruption or hit internal enumeration failure on [%s]; GLE = 0x%x",
        "*ppObject = State->m_pAllocator->Allocate<OfferPackage>()",
        "S$[_^",
        ":7:H:p:",
        "CSetupManager::OpenOrCreateTask",
        "CreatorsUpdateSettingsComplete",
        "T$`@3",
        "Windows::Rtl::CRtlObjectTypeDescription<class MicrodomImplementation::CMicrodom>::CreateTearoff",
        "GetCurrentProcessId",
        "?A?G?h?|?",
        "WWWWWWWPWWWV",
        "SetupManager: Reset WinDlp State failed with error [0x%X]",
        "WdsCopyFileEx: Failed to delete %s. GLE = 0x%x",
        "Sources",
        "WritePrivateProfileStringW",
        "GetTraceEnableLevel",
        "VerQueryValueW",
        ">>>W>d>p>",
        "Sources\\pid.txt",
        "(NewName == 0) || RtlIsLUtf8StringValid(NewName)",
        "=8=U=h=o={=",
        "LocalFileTimeToFileTime",
        ";D$<s",
        "ResNodesLoad",
        "=#=d=",
        " || SourceName: ",
        "<#=7=",
        "BCryptGetProperty",
        "SetupManager: Rollback Enabled via scenario detection.",
        "1D2K2d4",
        "0.0Q0X0i0p0",
        "5A5N5v5",
        "SYSTEM\\Setup\\Panther",
        "FACILITY_ITF",
        ">)>9>F>",
        "8r ,Y",
        "INVALID_HANDLE",
        "SumPSQR3",
        "RemovePackage",
        "2$2,2",
        "7]8d8",
        "CSetupManager::IsPrivacySettingsComplete",
        "FACILITY_MONITOR",
        "BCryptDestroyHash",
        "229879+4583610",
        "*ppObject = State->m_pAllocator->Allocate<Payload>()",
        " || LogMessage: ",
        "D$PSV",
        "SetupManager: Error setting RecoveredFrom registry value: [0x%X]",
        ".idata$4",
        "SetupManager::ExecuteRollbackRecovery - Reseting action [%s] in the [%s] task",
        "\\\\?\\UNC",
        "TargetName",
        "0%1K1q1",
        "9*:9:F:w:",
        "7 7'7:7",
        "7$7>7R7",
        "8j:q:",
        "515b5i5o5",
        ":.:?:q:",
        "SetupIterateCabinetW",
        "SetupManager: Error setting incremented Count registry value: [0x%X]",
        "SLClose",
        "Not-null check failed: Target",
        "5;5N5~5",
        "6T6^6",
        "212N2V2",
        "3*444]4",
        "MicrodomImplementation::CMicrodom::GetElementById",
        "6'6?6J6v6",
        "TRUST_E_EXPLICIT_DISTRUST",
        "SetupManager: Error retrieving setup platform phase: [0x%X]",
        "(SourceCount == 0) || (Sources != 0)",
        "D2J5A",
        "CMicrodomBuilder::CElementNameToAttributeListTable::Find",
        "GetFailedInstallCount:RegGetDword failed. GLE is [%d]",
        "*ppObject = State->m_pAllocator->Allocate<Plan>()",
        "<f=~=",
        ".?AV?$CZeroInit@VCDlpInstallWimInfo@@$00@@",
        "3)343H3O3W3d3p3",
        "636V6y6",
        "QueryPerformanceFrequency",
        "(if non-rotational disk) ",
        "NtYieldExecution",
        "6D7\\7i7",
        "SetupManager: PartitionResize Enabled by default.",
        "GetVolumePathNamesForVolumeNameW",
        ";B;[;c;",
        "Cancel request sent.",
        "%c:\\$Windows.~BT",
        "SetupManager: Success Mode Detected",
        "NtQueryInformationFile",
        "NDATA",
        "#,|6d",
        "onecore\\base\\servicing\\actionlist\\lib\\cactionlist.cpp",
        ".CRT$XIA",
        "tIVS3",
        "9(9/9B9I9v9}9",
        "P0]0l0",
        "333T3s3",
        "210303183038Z0p1",
        "u.h;#",
        "::RtlIsLUtf8StringValid(String)",
        "=g>o>",
        "InitLZMSDecompression",
        "5p6z6",
        "CSetupManager::InitializeImageFinalizeAction",
        "8 8&8,82888>8F8J8N8R8V8Z8^8b8f8v8",
        "DiskSpaceDownloadReq",
        "111019184142Z",
        "GetCurrentDirectoryW",
        "CopyDirectoryEx2: Failed to copy [%s] to [%s], GLE = 0x%x; will retry in %u ms; am on try %u.",
        "060C0h0",
        "G QQVP",
        "969W9",
        "IsUpgradeNow",
        "FACILITY_TRANSACTION",
        "[F$d*",
        "021A1N1p1",
        "CSetupManager::DetermineSetupPhase",
        "Af;H(s",
        "FindFirstFileW",
        "CreatePath: Unable to create [%s]; GLE = 0x%x",
        "DeletePathDirectoryCallback: Spoofing detected deleting [%s] -> [%s]",
        "ERROR_INVALID_HANDLE",
        "0%0,050D0f0l0",
        ":L>P>T>X>\\>`>d>h>l>p>t>x>|>",
        ".rdata",
        "SetupManager: ActionList file [%s] does not exist.",
        "D$pSVW",
        "4Q4^4",
        "SetupManager: Adding LXP license file [%s]",
        "-------------------------",
        ">(>1>@>Q>b>p>z>",
        "UseUUPDownload registry value: [%d].",
        "Params->fRequireUtf8",
        ";&;Z;k;|;$=.=L=`>",
        "UpdateMedia",
        "SetupManager: pPrivacyConsentOption: [%lu]",
        "ActionListParser::ParseInstallPackage",
        "pToInsert != 0",
        "State.m_WalkCursor.IsUtf8()",
        ";D$4uV",
        ".text$di",
        "%s%c%s",
        "D$TPQQ",
        "111;1i1",
        "&apos;",
        "j3VWh",
        "Task suspend request returned: [0x%X]",
        "536o6u6",
        "STATUS_UNSUCCESSFUL",
        "9#9+9N9b9",
        "DeleteFileEx: hardlink given to us is: %s",
        "Module path is [%s]",
        "Disabled",
        "u-h,&",
        "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\sync.c",
        "tXVWj",
        ".w.t,",
        "FODs\\DU",
        "Directory [%s] tagged as Hard Reserve: [%s]",
        "OriginalFilename",
        "SetupManager: Deleting existing LXP expansion folder: [%s]",
        "CMicrodomBuilder::CElementNameToAttributeListTable::MaybeInsert",
        "Module version is [%s]",
        "tWVPj",
        "2U3l374Z4?7",
        "CSetupManager::SetBitLockerMode",
        "CERT_E_INVALID_NAME",
        "101=1T1a1p1",
        ";>;L;",
        "SetupManager: Copying user-provided driver install package files from [%s] -> [%s]...",
        "incomplete distance tree",
        "2*222",
        "Not-null check failed: Out",
        "Microsoft Corporation1%0#",
        "SetupManager::OpenOrCreateTask: Deleting...",
        "y!h_\"",
        "SetupManager::OpenOrCreateTask: Deleted task [%s]",
        "GetUserGeoID",
        "CSetupManager::InitializeAdvertiseAction",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteEscapedString",
        ">(>M>Y>q>w>|>",
        "CSetupManager::SetRollbackContext",
        "STATUS_OBJECT_PATH_SYNTAX_BAD",
        "Action progress: [%u%%]",
        "Failed to read file {0}",
        "@.reloc",
        ".?AV?$CZeroInit@VCSetupManager@@$00@@",
        "&0B0O0]0f0k0w0|0",
        "__rv.NewCursorValue != 0",
        "S,_^[",
        "SetupManager::ExecuteCustomScript: No scripts found. Finished type [0x%X]",
        "\\\\?\\Volume{",
        "0 0:0N0_0n0",
        "<$<1<O<\\<f<",
        "CSetupManager::GetMigrateCustomScriptName",
        ">N?V?",
        "RtlInitializeCriticalSection",
        "SetupManager: Local Media Path:   [%s]",
        "6=8 9;9G9a9o9",
        "RtlFreeHeap",
        "%hs: Failed to open 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion'. Error = %d",
        "UninstallReason",
        "U0S0Q",
        "Windows::uDom::Rtl::RtlMicrodomUpdateSetNodeTextContent",
        "SetupManager: Found packagereq disk space issues",
        "SetupManager: No cleanup requested.",
        "CompactEvalMaxMHz",
        "272B2I2",
        ">2>9>F>",
        "DeleteFileEx: Unable to clear out attributes on [%s]; GLE = 0x%x",
        "Setup SubPhase: [%u]",
        "SetupManager: Error retrieving setup platform uninstall comment: [0x%X]",
        "NewChild->Element.Allocate()",
        "RemoveFeature",
        "8v8)9",
        "SetupManager: X86 Url = [%s], Target=[%s]",
        "CSetupManager::GetSetupResult",
        "Isolationp::Parse::CTemplatizedStringIterator<struct _LUTF8_STRING>::Attach",
        "yEVjp",
        "8/8E8o8",
        "MicrodomImplementation::CMicrodom::GetElementsByTagName",
        "DebuggerOptions",
        "9(9.9N9T9e9k9|9",
        "qsort",
        "5(575U5i5x5",
        "RollbackCount",
        "DestinationMaximumLength >= SourceLength",
        "CSetupManager::InitializeMediaLayoutAction",
        "BREAKPOINT",
        "6W6g6n6a7}7",
        "SetupManager: UpdateMedia Enabled -> [%s]",
        "SetupManager: Install file not found. Remapping HRESULT_FILE_NOT_FOUND to WU_E_UH_NEEDANOTHERDOWNLOAD",
        "GetFailedInstallCount",
        ";7;B;c;",
        "1*2|2",
        "RtlReallocateLUtf8String",
        "8\"8K8}8",
        "Driver",
        "t4f97t",
        "InitializeAcl",
        "CSetupManager::ExecutePreDownloadMode",
        "RtlWriteDataIntoSmartLBlobWritingContext",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "CRYPT_E_NOT_FOUND",
        "SetupManager: PartitionResize Enabled via override.",
        ">*>]>5?",
        ">@.6Y",
        "656@6",
        "tmj\\W",
        "WinVerifyTrust",
        "5(5H5T5t5",
        "ProductKeyGetEdition",
        "6 6H6O6",
        "ActionListParser::ParseMedia",
        "LanmanNT",
        ": ;_;i;};",
        "FailureCount",
        "CSetupManager::Pause",
        "MicrodomImplementation::CMicrodom::GetNamedNodeMapLength",
        "ConX::Setup::Common::COSInfoHelper::GetCurrentSystemBranchName StringCchCat() failed :  hr=0x%d",
        "HRESULT_FROM_NT(",
        "_snwprintf_s",
        "9S:x:",
        "MultiByteToWideChar",
        "8 8L8",
        "CRtlGrowingList<struct _XMLDOC_ATTRIBUTE,50,6>::Initialize",
        "RevertToSelf",
        "0 0&01070C0S0\\0m0s0y0",
        "t?Whh",
        "@.rsrc",
        "memcmp",
        "AddAccessAllowedAce",
        "9+919C9S9`9",
        "495G5W5^5i5",
        "y$hn*",
        "t*h@(",
        "XML parse error: {0} at line {1}, column {2} : {3}",
        "Attempting to suspend current task...",
        "CSetupManager::SetDebuggerInfo",
        "Microsoft Time-Stamp PCA 20100",
        "ARRAY_BOUNDS_EXCEEDED",
        "CSetupManager::InitializeImageDeployAction",
        "Not-null check failed: String2",
        "tdhDR",
        "u'QQQ",
        "NtPowerInformation",
        "CSetupManager::InitializeImageExitAction",
        "GetWIMBootWIMPathInternal",
        "3.474>4M4",
        "CSetupManager::ExecuteRollbackModeSys",
        "ICbsServicingProcessor->Process failed: [0x%X]",
        "D$tHP",
        "<+<D<W<i<v<",
        "Error,",
        "757Q7Y7a7m7",
        "DeleteFileEx: Spoofing detected deleting [%s] -> [%s]",
        "LowStorageSSDDesktopMinProcessorCount",
        "ACCESS_VIOLATION",
        "CopyDirectoryFileCallback: Unable to %s file from [%s] to [%s]; GLE = 0x%x",
        "::RtlIsLUtf8StringValid(Destination)",
        "CMicrodomBuilder::ConsumeEntityDecl",
        "InstallFeature",
        "DefaultAttribute.Allocate()",
        "VWj 3",
        "SetupPhase",
        ".idata$2",
        "1$1Z1",
        ":4:g:",
        "0x%08x",
        "@\\jdPQ",
        "242:2S2[2~2",
        "5'6<6C6K6X6",
        ".?AVISetupManager@@",
        "4\\4r4",
        ":%;>;I;P;z;",
        "FH;A8",
        "CSetupManager::GetCustomScriptDirs",
        ".CRT$XCL",
        "<\"<*<^<",
        "SetupManager: CompactOS Enabled via policy detection.",
        "ObjectLength",
        "ProductKeyValidate",
        "RtlIsLUtf8StringValid(LocalName)",
        "(NewNamespace == 0) || RtlIsLUtf8StringValid(NewNamespace)",
        ":%:I:l:{:",
        "SetupManager: ESD Download Path:  [%s]",
        "EditionID",
        "SetupManager: bIsDeviceManaged from ProductCode: [%s]",
        "Optional",
        "5T5|5",
        "InitLZMSCompression",
        "System\\CurrentControlSet\\Control\\ProductOptions",
        "?'?3?X?e?t?",
        "precommit.cmd",
        "DesktopReservicing",
        "<(=:=F=O=^=f=k={=",
        "LeaveCriticalSection",
        "GetEnvironmentVariableW",
        "SETUPAPI.dll",
        "CSetupManager::Resume",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementById",
        "Windows::uDom::Rtl::RtlMicrodomUpdateCreateAttributeNs",
        "7Q7c7q7",
        "UsbLayout",
        "8P9]9",
        "6,6J6\\6",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttribute",
        ")`yJb",
        "3E3g3v3",
        "<9<d<w<",
        "CSetupManager::GetCustomReflectDriverDirectories",
        "SetupManager: Reporting Data - DataId = [%lu], Value = [%s]",
        "C(;C$",
        ".rdata$T$brc",
        ">>?[?m?",
        "PVSSh ",
        "CSetupManager::GetWuIdFromRegistry",
        "PayloadType",
        "D$DPj",
        "6I6c6",
        "0,0s0",
        ";Z;`;s;",
        "Canonical",
        "STATUS_RM_METADATA_CORRUPT",
        "F @;F",
        "TmpNodes.Resize(cNecessary)",
        "41484L4S4",
        "STATUS_INVALID_IMAGE_FORMAT",
        "ProductVersion",
        "1V1_1i1y1",
        "WdsRemoveDirectory: Unable to prepare path [%s]; GLE = 0x%x",
        "?(?B?\\?",
        "STATUS_INFO_LENGTH_MISMATCH",
        "Failure from: %hs, line: %d, you can set break point on 'DebugOnError' function",
        "MinDecompressionRateKBs (MBs): %u (%u)",
        "GetVolumeInformationW",
        "NewInstance.Allocate()",
        "STATUS_NO_MEMORY",
        "748a8",
        "SetupManager: ActionList InstallFile Path [%s]",
        "installx64.esd",
        "FACILITY_FIREWIRE_ERROR_CODE",
        "STATUS_INSUFFICIENT_RESOURCES",
        "oversubscribed literal/length tree",
        "NewProcessingInstruction = this->AllocateStreamObject()",
        "SetupManager::ExecuteCustomScript: Script [%s] returned: [0x%X]",
        "NtQueryVolumeInformationFile",
        "SetupManager: System Rollback Mode Detected",
        "<2<=<V<^<",
        "imageName",
        "STATUS_INVALID_PARAMETER",
        "?$?,?4?<?D?P?p?x?",
        "%wPtG",
        "Failed to allocate memory",
        "(FixedSizeBuffer != 0) || (DynamicBuffer != 0)",
        "<#=A=Q=`=e=n=t=}=",
        "7#7C7P7f7p7",
        "t$hX@",
        "Root != Root.InvalidValue()",
        "Result",
        "HeapDestroy",
        "Wx\\x6",
        "ERROR_SXS_FILE_NOT_PART_OF_ASSEMBLY",
        "SetupManager::Initialize: WorkingPath            = [%s]",
        "RtlNsInitialize(this, Comparison, pvCompareContext, Alloc)",
        ";);7;a;{;",
        "(if rotational disk) MinDecompressionRateKBs (MBs): %u (%u)",
        "::BUCL::Rtl::Add<SIZE_T>( cElements, 10, NewCapacity)",
        "393N3T3z3",
        "Success,",
        "es.T#=\"",
        "0Y1f1",
        "<unavailable>",
        "VWhlC",
        "VS_VERSION_INFO",
        "424P4j4",
        "t#G;{",
        "STATUS_EFS_NOT_ALLOWED_IN_TRANSACTION",
        "dCSDBuildNumber",
        "FACILITY_COMMONLOG",
        "ActionListParser::ParseDownloadPackage",
        "7$8E8L8",
        "CSetupManager::InitializeCompatDownloadReqAction",
        "3_^[]",
        "tij:V",
        "0:0S0",
        "LocalAlloc",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasChildNodes",
        "DeleteFileEx: Unable to open [%s]; GLE = 0x%x",
        "ProductCode",
        ":9;G;",
        "HasSeekMinReqDeCompressionRateKBs",
        "OLEAUT32.dll",
        "SetupManager: Found installreq disk space issues",
        "CMicrodomBuilder::StartDocument",
        "8Y8j8{8j:",
        "    WinPE Count     [ %d ]",
        "050T0",
        "6@6H6o6w6",
        "6:6X6v6",
        "CSetupManager::GetTelemetryOptIn",
        "O0M0K",
        "\\StringFileInfo\\%04X%04X\\%s",
        "? ?*?5?<?i?y?",
        "DUSetupSandbox",
        "WIMCloseWIM",
        "0A0V0a0",
        "%systemdrive%\\Windows\\system32\\update",
        ">->3>P>e>r>",
        "STATUS_DIRECTORY_NOT_EMPTY",
        "Crypto",
        "1+1y1",
        ":(:>:e:{:",
        "<%=,=B=d=k=}=",
        "<.=V=r=",
        "WimBoot",
        "2g2y2",
        "0W0n0u0",
        "SetupManager::ExecuteCustomScript: Error running script [%s]: hr = [0x%X]",
        "STATUS_INVALID_HANDLE",
        "NV Domain",
        "CSetupManager::PerformCleanupTasks",
        "7&7:7U7",
        "imageSize",
        "<4=;=r=",
        "VERSION.dll",
        "Partition",
        "SetupManager: Rollback option to be determined later.",
        "212w2",
        ">E>b>",
        "SetupManager: Adding download files.",
        ".rdata$r$brc",
        "IMAGE",
        "DUDownload\\Cab",
        "DeviceIoControl",
        "GlobalCollection",
        "xsG;}",
        "dSVWj8",
        "D$lSP",
        "SetupManager: Error executing custom success scripts",
        "SetupManager: Uninstall Enabled via host OS version.",
        "9,999",
        "CreateDestinationFileEx",
        "SafeOSDU",
        "Failed to get decoder context",
        "=2>V?",
        "SetupManager: BITS protocol will be used for download.",
        "SPQQRQf",
        "SetupManager: Exiting due to Flighting BVT mode.",
        "GetMetadataPadding",
        "FindNextFileNameW",
        "0+1=1",
        ":(:F:V:~:",
        ";#<N<q<",
        "Enable",
        "CMicrodomBuilder::CNamespaceNameExistenceCheck::AddAndCheckExistence",
        "GDv(PV",
        "SetupManager: RollbackCount = [%d]",
        "Flags",
        "FLT_INEXACT_RESULT",
        "71787",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        "3?3P3",
        "4'5?5W5_5",
        "555>5t5",
        "CSetupManager::BucketizeFoDPackage",
        "SETUPMGR.DLL",
        "RtlInitializeResource",
        "[%s:(%d) -> %s] %s",
        "DiskPartition",
        "Duplicate media item: {0}, or out of memory.",
        "Thales TSS ESN:E5A6-E27C-592E1%0#",
        "Not-null check failed: Result",
        "5+5z5",
        "base\\ntsetup\\diagnostics\\lib\\diagutil\\src\\setupfailurecount.cpp",
        "SYSTEM",
        "8'9Q9\\9",
        "ulLocation < m_PositionList.Length",
        "tJj\\P",
        "wXhX~",
        "Temp = (*RtlReallocateStringRoutine)(Bytes, Blob->Buffer)",
        "FilePath",
        "525F5P5`5t5",
        ":6:U:c:z:",
        "Recovery",
        "SetupManager: Detected Azure Host Scenario. Rollback completely disabled without disk space detection.",
        "y+h(-",
        "8(848@8L8X8d8l8t8|8",
        "1@7x7",
        "FACILITY_DRIVER_FRAMEWORK",
        "jaYjz_j:Z",
        "trPWQ",
        "SetupManager: ActionList Setup Dynamic Update Path [%s]",
        "Failed to get [%s] directory Hard Reserve status: [0x%X]...",
        "m_StoredTable.FindOrInsertIfNotPresent(Pair, Value, 0, pfExisted)",
        "CSetupManager::ExecuteDownloadMode",
        "GetModuleFileNameA",
        "YY_[^",
        "1 2G2m2",
        ":&:>:`:f:",
        "9%909G9Z9`9x9",
        "WIM\\TOTALBYTES",
        "Not-null check failed: Blob",
        ";5<B<W<b<",
        "6+666Q6V6f6",
        " || SourceFunction: ",
        "1$2+2U2h2p2z2",
        "0(000T0\\0",
        "CSetupManager::ExecuteFeatureOnDemandLatentAcquisition",
        "AssertWithArgs",
        "<#<0<E<T<a<z<",
        "0 0$0E0X0i0",
        "STATUS_FILE_IS_A_DIRECTORY",
        "CSetupManager::GetRecoveryResults",
        "\\Windows\\WinSxS\\",
        ";C<u<",
        "GetSystemDirectoryW",
        "=K>a>",
        "CSetupManager::ExecuteInstallMode",
        "LowMemPhoneMinRAMSizeMB",
        "STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME",
        "STATUS_INTERNAL_ERROR",
        ".rsrc$01",
        "1m2z2",
        "=7>D>L>",
        "7/7b7i7",
        "6&646a6i6",
        "1$1,141<1D1L1T1\\1d1l1t1|1",
        "BelowNormal",
        "_vsnprintf",
        "Valid flags check failed: Flags",
        "DebugBreak",
        "SetupManager::OpenOrCreateTask: Incorrect number of actions found [%u]. Deleting...",
        "SetupManager: Media Path:         [%s]",
        "Check for FU Reserve tag on directory: [%s]",
        "IDREFS",
        "RtlCopyLBlob",
        "SetupManager: LowCostDevice mode detected.",
        "<A=j=",
        "_unlock",
        "RtlDuplicateLUtf8StringToLUnicodeString",
        ":3:N=U=_=",
        "2#2Q2",
        "SetupManager: Resetting WinDlp state for full cleanup...",
        "SetupConfig.ini",
        "7F8M8",
        "SetupManager::ExecuteCustomScript: Type = [0x%X]",
        "4q5|5",
        "6N6Z6e6",
        "Version",
        "Invalid pointer ppvObject",
        "GeoAvailability",
        "Operation",
        "? ?)?0?=?G?W?`?h?y?",
        "SetupManager: CompactOS Enabled via Recovery detection.",
        "ERROR_DISK_FULL",
        "SetupManager: Execution of failure task failed: [0x%X]",
        ".gfids",
        "(Value != 0) || RtlIsLUtf8StringValid(Value)",
        "SystemManifest",
        "SetupManager: Rollback Option is still detect during Image Deploy action - setting Rollback Enabled.",
        "5(5N5\\5g5",
        ".rsrc$02",
        ":%:R:Y:j:q:",
        ">\">'>->1>6><>Q>a>k>",
        "GetLastError",
        "memcpy_s",
        "0U0\\0h0o0",
        "DeleteFileEx: Unable to allocate hardlink path buffer",
        "%I64u",
        "u<Vh$",
        ">A>]>",
        "5)545B5o5",
        "GetTempFileNameW",
        "8 8@8P8t8|8",
        "onecore\\base\\xml\\udom_writer.cpp",
        "SetupManager: Creating a LXP expansion folder: [%s]",
        "BaseCPUHeadroomPerc",
        "9H9b9s9",
        "?\"?v?",
        "ESD-USB",
        "9+929{9",
        "Satellite",
        "?;?q?",
        "x}G;}",
        "ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE",
        "GetLongPathNameW",
        "3o3y3>4D4`4",
        "2*252C2",
        "SetupManager: ActionList Critical Dynamic Update Path [%s]",
        "?5?[?j?w?",
        "]SYSTEM\\Setup\\FailedInstallations",
        "CSetupManager::SetDownloadToExtStorage",
        "ERROR_FILE_NOT_FOUND",
        "SetupManager: Found installreq compat issues",
        "SetSecurityDescriptorControl",
        "SetupManager: Rollback completely disabled via AzureHost scenario detection.",
        "%hs [HRESULT = 0x%08x - %hs]",
        "='=4=\\=",
        "Not-null check failed: String1",
        "NMTOKEN",
        "ntdll.dll",
        "CSetupManager::InitializePkeyValidateAction",
        ">9?j?v?",
        "GetNativeSystemInfo",
        "NewAttlist = this->AllocateStreamObject()",
        "wimgapi.dll",
        "SetupManager: Error executing mitigations: [0x%X]",
        "2\"2M2h2",
        "SetupManager: Error creating task scheduler helper: [0x%X]",
        "pChild->pBasicNode != 0",
        ">0>?>",
        "8F8K8v8",
        "_amsg_exit",
        "\\Device",
        "m_CurrentStreamObject != 0",
        "CSetupManager::OnFinishCompatSysReqAction",
        "------------",
        "CSetupManager::ExecuteCustomScript",
        "4;5L5y5",
        "999x9",
        "11191T1Z1`1h1",
        "5T6[6",
        "incorrect data check",
        "SetupManager: BITS service disabled. Trying HTTP protocol.",
        "CSetupManager::SetDownloadSizeInMB",
        "2,2U2p2",
        "< =V=",
        "RtlRandom",
        "SetupManager::ExecuteRollbackScripts: Rollback script not found: [%s]",
        "STATUS_SXS_INVALID_ACTCTXDATA_FORMAT",
        ".?AVISetupObject@@",
        "SetupManager: WebSetup session id not found.",
        "XPSh U",
        "WIM\\IMAGE[*]\\WINDOWS\\VERSION\\SPLEVEL",
        "Microsoft",
        "TRUST_E_FAIL",
        "Unpack",
        "<#<5<`<{<",
        "SetupManager: DiagnosticPrompt Disabled via override.",
        "STATUS_INVALID_DEVICE_REQUEST",
        "CSetupManager::InitializePreFinalizeAction",
        "4 4P4p4|4",
        "Software\\Microsoft\\Windows\\CurrentVersion\\CreatorsUpdatePrivacySettings",
        ";2;u;",
        ":;;N;o;",
        "WdsCopyFileEx: Failed to copy [%s] to [%s], GLE = 0x%x; will retry in %u ms",
        "CDATA",
        "RtlCreateMicrodom",
        "8!8J8f8",
        "<0<P<v<",
        "UnhandledExceptionFilter",
        "=c=l=u=",
        "SetupManager: Unknown Region string [%s]",
        "__dllonexit",
        "ERROR_INVALID_FLAGS",
        "8$9,9J9W9y9",
        ";Y<i<",
        "3O3{3",
        ";X;w;",
        "CSetupManager::GetMigChoiceResults",
        "97vhS",
        "Panther",
        "3.353N3m3",
        "D$XSVW3",
        "><>q>",
        "3\"474H4]4n4",
        "WIM_Verbose_Logging",
        "<zf;D9",
        ";-<]<s<",
        "SetupManager::ExecuteCustomScript: Failed timeout telemetry: hr = [0x%X], dataid = [0x%X], value = [%d]",
        "SetSecurityDescriptorGroup",
        ":Q;c;",
        "4a4k4",
        "]_^[]",
        "\\$ ;E",
        "m_ulSize == 0",
        "InstanceId",
        "=hK2/;",
        "advapi32",
        "9):f:",
        ";0;:;I;P;[;",
        "Drivers",
        "<$<,<4<@<`<h<t<",
        "2K2_2{2",
        "SOFTWARE\\Microsoft\\SMS\\Mobile Client",
        "CryptoX64",
        "Process %s is accessing file wim %s",
        "%s /CorrelationVector %s",
        "CRYPT32.dll",
        "pHeader->ulSignature == ('dHdM')",
        "%0D0|0",
        "CSetupManager::OpenOrCreateUnpackTask",
        ";/;D;a;u;",
        "4!4E4e4k4",
        "UpdateWIMHeader failed",
        "SINGLE_STEP",
        "384A4[4j4y4",
        "GetFullPathNameW",
        "3S3W6",
        ":6:R:l:",
        "SetupManager: Clearing WU rollback key",
        ">)>o>",
        "SetupManager: Copying user-provided langpack package files from [%s] -> [%s]...",
        ".giats",
        "A,;F8u",
        ";4;<;D;L;T;`;",
        "    Install Count   [ %d ]",
        "2'212;2B2I2P2W2",
        "151F1",
        "SYSTEM\\Setup\\MoSetup\\Volatile",
        "ImageLocation",
        "j:Yf9H",
        ";L;W;",
        "w|PPP",
        "BUCL::Rtl::AddInPlaceWithOverflowCheck(&cbRequired, (*EncodingSizer)(ucsch))",
        "9I9d9",
        "SetupManager: Searching for install images...",
        "m.Reserved < m_NamedNodeMaps.Size()",
        "<'=W=\">1>>>",
        "DisableThreadLibraryCalls",
        "UninstallComment",
        "    Install Index   [ %d ]",
        "+T$\\+",
        "STATUS_TOO_LATE",
        "191113214033Z",
        "user32.dll",
        "3$333@3b3",
        "989D9d9l9t9|9",
        "AllocateAndInitializeSid",
        "failed",
        "41494`4h4",
        "CMicrodomUpdateContext::Construct",
        "?(?0?8?D?d?p?",
        "Source.Length >= 2",
        "STATUS_RM_NOT_ACTIVE",
        "CMicrodomUpdateContext::CreateVirtualTextual",
        "697g7",
        "L$4_^[3",
        ")Microsoft Root Certificate Authority 20100",
        "CSetupManager::SetAutomationResponseArgs",
        "SetupManager::ExecuteCustomScript: Ignoring script error because type is [0x%X]",
        "ShowUI",
        "EnumeratePathEx: Unable to construct path under [%s]; GLE = 0x%x",
        "6K6\\6",
        "8&8D8T8y8",
        "1@1m1s1",
        "232:2R2",
        ".?AV?$CUnknownImpl@V?$CUnknownImpl@UIUnknown@@@@@@",
        "AcquireSRWLockExclusive",
        "?3?:?I?Y?_?h?r?y?",
        "9MdHdt",
        "100701213655Z",
        "SetupManager: ActionList InstallFile Reference Path [%s]",
        "515b5",
        "ESD-ISO",
        "=)=o=",
        "Failed to populate Media from {0}",
        ">)>5><>r>",
        "WaitForSingleObject",
        "<N<n<{<",
        "unknown compression method",
        "8;8M8Z8",
        "products.xml",
        ">,>T>}>",
        "080s0",
        "13282=2B2G2L2Q2W2",
        ">!>%>)>->1>5>9>=>A>E>",
        "0.0=0\\0p0",
        "Failed to increment failed install count. GLE is [%d]",
        "SetupManager: Rollback Disabled via override.",
        "[%d] %s%s%s%s",
        "#rSPo",
        "898V8",
        "CSetupManager::SetMigrationInfo",
        "FindNextFileW",
        "2 2@2H2T2t2|2",
        "OutputDebugStringA",
        "DecodeChunk",
        "6!7C7R7_7",
        "373v3",
        "3,4`4}4",
        "WdsRemoveDirectory: Unable to clear attributes on [%s]; GLE = 0x%x",
        "RtlIsLUtf8StringValid(NamespaceURI)",
        "SLGetProductSkuInformation",
        "ENTITY",
        "T$(94",
        "IN_PAGE_ERROR",
        "Failed to get saved failed install count. GLE is [%d]",
        "RaiseException",
        "CreateDlpRegistrar",
        "CritDU",
        "9 9f9y9*:t:{:",
        "Windows::StringUtil::Rtl::Impl::AppendTranscodedStringToPreallocatedBuffer",
        "totalHits",
        "ExecuteMitigations Calculating file hash...",
        "SetEnvironmentVariableW",
        "DesktopUpgrade",
        "L$8PW",
        "::RtlIsLUnicodeStringValid(Source)",
        "FACILITY_STATE_MANAGEMENT",
        "WimLayout",
        ";9;Q;X;l;",
        "CSetupManager::InitializeUsbLayoutAction",
        ":!:P:l:",
        "ulIndex < UpdateChildNodes.Size()",
        "<(<y>",
        "CiXPath",
        "ImageExit",
        "353;3^3~3",
        "CBasicNodeType::ChangeNamespace",
        "Windows::uDom::Rtl::RtlMicrodomUpdateRemoveElement",
        "D$,_^[3",
        "=*>5>C>l>",
        "SetupManager: Requesting cleanup level [0x%X] from parent process.",
        "ERROR_PATH_NOT_FOUND",
        "m_StoredTable.Find(Pair, ppusAttrListNumber)",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocumentNodeSet",
        "::RtlIsLUnicodeStringValid(String)",
        "***   Source File: %s, line %ld",
        "MaxVolumeSizeMB (GB): %u (%u)",
        "979r9",
        ":C:b:",
        "SetupManager: Working Directory:  [%s]",
        "Package",
        "Repair",
        "ERROR_INVALID_DATA",
        "SetupManager: Detected RS2+ upgrade on a managed device, privacy consents are not required.",
        "6:6u6",
        ":#<.<<<",
        "[PID]",
        "api-ms-win-eventing-provider-l1-1-0.dll",
        "STATUS_ILLEGAL_CHARACTER",
        "Windows::uDom::Rtl::RtlCreateUpdatedMicrodomAsUtf8",
        "4$4/4J4^4u4",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "FailedVolumeSizeCheck",
        "D$ Pj",
        "_wcsicmp",
        "QQSV3",
        ".idata",
        "GetFileAttributesW",
        "FACILITY_NDIS_ERROR_CODE",
        "8.8|8",
        ";%;r;",
        "onecore\\private\\base\\inc\\LogAdapter.h",
        "10.0.19041.572 (WinBuild.160101.0800)",
        "BinaryPartition",
        "(DestinationMaximumLength == 0) || (DestinationBuffer != 0)",
        "4R5j5",
        "::RtlIsLUtf8StringValid(&Sources[i])",
        "949R9d9",
        "=/>9>]> ?*?`?",
        "6k7y7",
        "QSVW3",
        "NewComment = this->AllocateStreamObject()",
        "setuprollback.cmd",
        "-Tz4q",
        "1*1;1N1_1",
        "E(SVW",
        "8%:@:",
        "MinRAMSizeMB: %u",
        "SourceName",
        "CSetupManager::InitializeSummaryAction",
        "Windows::uDom::Rtl::RtlCreateUpdatedMicrodomAsMicrodom",
        "Download",
        "=\"=O=f=r=~=",
        "f;D$Pu",
        "2(2,2D2H2L2P2d2h2",
        "pHeader->ulOffsetToStringPool < pHeader->ulTotalSize",
        "6*757T7Z7{7",
        "Not-null check failed: Params->Source.pBlob",
        "PPIPro",
        "261019185142Z0",
        "SetupManager: Setup was suspended",
        "RtlIsLBlobValid(Source)",
        "CERT_E_UNTRUSTEDTESTROOT",
        "products.cab",
        "4e4w4",
        "DynamicUpdateSetup",
        "MicrodomImplementation::DecodeXmlCharacterToUcsChar",
        "393Z3u3",
        "7#8F8T8",
        "ILLEGAL_INSTRUCTION",
        "9(9>9I9R9Y9d9v9}9",
        "D$(Lo",
        "UUUUf",
        "1L1c1",
        "onecore\\base\\lstring\\ucsdecoders.cpp",
        "ReadFile",
        "CXmlLogicalState::{dtor}::<lambda_0fd40d3b956627884e315ff69db4f18c>::operator ()",
        "onecore\\base\\lstring\\lblob.cpp",
        "USER32.dll",
        "SetupManager: ActionList Latest Cumulative Update Path [%s]",
        "=\"=a=",
        "CSetupManager::DetectUninstall",
        "ForceAlgorithm",
        "2j3%4]4c4",
        "STATUS_NOT_SAME_DEVICE",
        "f9FHu",
        "2b2p2",
        "1#161B1X1b1",
        "STATUS_CANCELLED",
        "SetupManager: Copying dynamic update files failed: [0x%X]",
        "CSetupManager::SetPartnerID",
        "STATUS_LOG_GROWTH_FAILED",
        "Not-null check failed: Writer",
        "Failed to load actionlist from {0}",
        "5\"525[5v5",
        "WimFindClose",
        "WIM_Enumerate_Directory_Reparse_Point",
        "incomplete literal/length tree",
        "oeY<9",
        "<H=!>/>K>j>|>",
        "SetupManager: Detected unexpected rollback success. Forcing default error code.",
        "Prepare",
        "SetupManager: bIsDeviceManaged from ShowPrivacySettingsUI: [%s]",
        "GetTickCount64",
        "SetupManager: Rebooting system... prevented by command line override.",
        "1 1$1(1<1@1H1L1P1T1X1`1x1",
        "3<3m3",
        "FACILITY_GRAPHICS_KERNEL",
        "?P?k?",
        "pToInsertInto != 0",
        "CSetupManager::Initialize",
        "SetupManager: Error clearing Eula Declined TimeStamp key: [0x%X]",
        "2#2,222;2E2N2T2]2f2k2p2v2",
        "1A1H1X1_1",
        "ExecuteMitigations: Storing file hash...",
        "towupper",
        "CSetupManager::InitializeDUSetupAction",
        "93:Y:m:",
        "5 5C5T5a5u5",
        "UnregisterTraceGuids",
        "WIM\\IMAGE[*]\\WINDOWS\\VERSION\\BUILD",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE",
        " Microsoft Operations Puerto Rico1",
        "3'343N3g3{3",
        "ErrorCode",
        "KERNEL32.dll",
        "GetDriveTypeW",
        "1W1u1",
        "SetupPhaseError",
        "Mitigation.dll",
        "929?:",
        "pContext != 0",
        "StagedSize",
        "PPPPP",
        ":E:p:",
        "WinSqmIsOptedIn",
        "6 6(60686@6L6l6t6|6",
        "MinCPUHeadroomPerc",
        "STATUS_RESOURCE_DATA_NOT_FOUND",
        ">!>m>u>",
        "<\"=/=P=h=s=",
        "L$8;U",
        "20201008151940Z",
        "CERT_E_MALFORMED",
        "SetupManager::Execute called",
        "MoveCaptureNode",
        "SetEvent",
        "=(=3=T=_=|=",
        "WimLazyInitialize",
        "SetupUpdate",
        "LocationHeader != 0",
        ">[>c>",
        "3!4{4",
        "0&010L0",
        "SetupManager: Could not get ProductCode. [0x%X]",
        "STATUS_DLL_NOT_FOUND",
        "GetVolumeNameForVolumeMountPointW",
        ".0a0n0",
        ":MdLct",
        "STATUS_IMPLEMENTATION_LIMIT",
        "FailedCPUHeadroomCheck",
        "Downloads",
        "707B7i7",
        "CSetupManager::OpenOrCreateExitTask",
        "Moving file: %s",
        ".rdata$zETW2",
        ">%>`>.?5?",
        "CMicrodomBuilder::StartElement",
        "161F1Z1",
        "LangPacks\\DU",
        "QQSVW",
        ":<:E:",
        "CopyFileExW",
        ".?AV?$CZeroInit@V?$CDlpAutoLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@$00@@",
        "m_PropertyCache.Allocate(m_LayoutCache.TotalObjectCount())",
        ".?AV?$CSetupObject@VCSetupManager@@VISetupManager@@@@",
        "5q5|5",
        "4\"4@4P4u4",
        "SetupManager: CompactOS Enabled via CompactOS detection.",
        "STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_VALUE",
        "Not-null check failed: NodeSet",
        "Exception (code 0x%08X: %s) occurred at 0x%p in %s (+%p).",
        "#text",
        "FDj<P",
        ">8>R>X>v>}>",
        "SetupManager: CompactOS detected in host OS.",
        "SetupManager: Uninstall Disabled.",
        "DeleteFileEx: Unable to get information on [%s]; GLE = 0x%x",
        "RtlAdjustPrivilege",
        "NodeMap != Windows::Microdom::Rtl::NamedNodeMap::InvalidValue()",
        "WIM\\IMAGE[*]\\WINDOWS\\PRODUCTNAME",
        "CMicrodomBuilder::ConsumeCData",
        "0D8i8",
        ".text$mn",
        ";.<a<r<",
        "SetupManager::OpenOrCreateTask: Creating new task [%s].",
        "onecore\\base\\xml\\udom_xmlcursor.cpp",
        ";$;J;Q;b;i;",
        "STATUS_INVALID_TRANSACTION",
        "CompactEvalDecompressionRateKBs",
        "RpcStringFreeW",
        "?$?6?",
        "STATUS_OBJECT_TYPE_MISMATCH",
        "j\\Xf9DN",
        "V0]0g0}0",
        "2:2P2W2",
        "SetupManager: Failed to increment install failure count. hr = [0x%X]",
        "FACILITY_VIDEO",
        "3L3W30484",
        "CSetupManager::ExecuteTask",
        "9?9[9y9",
        "SetupManager: Uninstall Disabled by AzureHost.",
        "Pj2jl",
        "CSetupManager::OnFinishCompatDownloadReqAction",
        "5#696`6v6",
        "1)1\\1}1",
        "SetupMgr.pdb",
        "CSetupManager::OnFinishActivation",
        ":&;L;S;b;u;",
        "UncompressFileBase",
        "STATUS_SXS_FILE_HASH_MISMATCH",
        ": :(:4:T:\\:d:l:t:|:",
        "<&<9<><E<J<",
        "CreateDirectoryW",
        "CSetupManager::OpenCABFile",
        "RegEnumKeyW",
        "2/2<2S2X2q2",
        "BootFinalize",
        "9\\$`t",
        "MitigationHash",
        "9A9N9s9",
        "WIM\\IMAGE[*]\\CREATIONTIME\\HIGHPART",
        "Entity.Length != 0",
        "%systemdrive%\\Windows\\Setup\\Scripts\\update",
        "STATUS_DELETE_PENDING",
        "SetupManager: Failed to set WebSetup ImageLocation registry value. Error: [0x%X]",
        ";p;w;~<",
        "SourceMicrodom != 0",
        "=L=W=",
        "0)000W0^0",
        "MicrodomWriterImplementation::CMicrodomWriter::CreateInterface",
        "*ppObject = State->m_pAllocator->Allocate<ActionListDocument>()",
        ":(:l:y:",
        "MSCFu",
        "W9{HuI",
        "(null)",
        "RPCRT4.dll",
        ">@>J>T>^>h>r>",
        "BCryptHashData",
        "CERT_E_CHAINING",
        "UTF-8",
        "T$@j[P",
        "2'363C3",
        "<*<2<O<Y<o<",
        "Enabled",
        "Cleanup",
        "SetupManager::ExecuteCustomScript: Failed notifying UI of subphase change: hr = [0x%X], old phase = [0x%X], new phase = [0x%X]",
        "SetupManager::ExecuteCustomScript: Path failed GUID search [%s]: hr = [0x%X]",
        "GetCurrentProcess",
        "CSetupManager::SetPreOobeScriptPath",
        "ExitProcess",
        "Duplicate install action item or out of memory. KeyForm: {0}, Id {1}",
        "_^[Y]",
        "Setup360",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::EndOpenElement",
        "1@1M1",
        ";y-{e",
        "191@1O1V1c1j1",
        "9%:@:P:~:",
        "= =(=4=T=\\=d=l=x=",
        "ForceCompression",
        "NewAttdef = this->AllocateStreamObject()",
        "244-5",
        "8K9w9",
        "FailedLPCountCheck",
        "?$?4?D?T?d?t?",
        "Microsoft Windows0",
        "CSetupManager::InitializePackageMigrationAction",
        "SetupManager: User Rollback Mode Detected",
        "Unknown",
        "WofCompressionPolicyEval",
        "CSetupManager::OnFinishDUImageAction",
        "CMicrodomBuilder::ConstructAndWriteMicrodom",
        "4$4@4\\4`4l4",
        "5C5N5",
        "6.7<7X7",
        "SetupManager: CompactOS Disabled via Recovery detection.",
        "MicrodomImplementation::CMicrodom::DecodeXmlString",
        "CSetupManager::InitializeMediaSuccessAction",
        "CSetupManager::InitializeDiskPartitionAction",
        "FindFirstFileNameW",
        "tvVW3",
        "CompatDownloadReq",
        ">D?u?",
        "D$XAF",
        ";~$s$",
        "whichDoc.Reserved == m_pTargetObject->m_LayoutCache.DocumentId()",
        "4`5{5",
        "SetupManager::ExecuteRollbackRecovery - Unpack Action reset successful",
        "='=/=m=s=",
        "Blob->Buffer = (PUCHAR)((*RtlAllocateStringRoutine)(Bytes))",
        "TlsFree",
        "Windows::uDom::Rtl::RtlCreateMicrodomUpdateContext",
        "CompactEvalRAMSizeMB",
        "819E9",
        "MCT.exe",
        " Operating System",
        "OutMut->Buffer = static_cast<BYTE*>(this->ReserveBytes(InBlob.Length, Alignment))",
        ":(:4:@:H:P:\\:h:t:",
        ">G>b>t>",
        "3%3I3V3f3",
        "5*515R5e5",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "S _^[",
        "_initterm",
        "Latent Acquistion CBS sandbox path: [%s]",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteComment",
        ";&;.;y;",
        "<!<J<Z<q<~<",
        "m_StoredTable.Find(Pair, ppAttDef)",
        "040X0_0",
        ":(:>:V:s:",
        ";+<8<`<",
        "839>9c9w9",
        "X[_^]",
        "2I2P2",
        "D$4PQ",
        "515Y5x5",
        "8 8j8t8~8",
        "SetLastError",
        "WdsCopyFileEx: Failed to strip file attributes for %s, will delete. GLE = 0x%x",
        "0:0D0u0|0",
        ">0?J?",
        "<r<y<",
        "oK0D$\"<",
        "_lock",
        "RtlDuplicateLUnicodeStringToLUtf8String",
        "8+888m8",
        "CSetupManager::ExecuteRollbackRecovery",
        ".rdata$brc",
        "Storage Reserve Manager Unavailable: [0x%X]",
        "SetupManager: Error creating RecoveredFrom registry key: [0x%X]",
        "SetupManager: Failed to set WebSetup client version.",
        "CMicrodomBuilder::GetXmlDomSize",
        "0,0]0",
        "6+7N7",
        "3-3z3",
        "7?<G<Q<W<b<i<n<t<z<",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteRawString",
        "SetupManager::GetCustomScriptDirs: Non-GUID directory found [%s]",
        "0Q2X2/333X4_4m4",
        "SetupManager: Local Media Path:   [%s] (before)",
        "SetupManager: Failed to get EditionID. Error: [0x%X]",
        "ERROR_INSUFFICIENT_BUFFER",
        "BCryptFinishHash",
        "5>6E6",
        "z.9Wv",
        "STATUS_TM_INITIALIZATION_FAILED",
        "788?8l8s8",
        "Not-null check failed: UpdateContext",
        "SetupManager: User-provided FOD path [%s] does not exist.",
        "u;9_0t6",
        "CSetupManager::OpenOrCreatePreDownloadTask",
        "CSetupManager::OnFinishCompatInstallReqAction",
        "rv.UcsCharacter < 0x110000",
        "Wof Policy Check",
        "D$0;D$(",
        ":R:Z:~:",
        "::RtlIsLUtf8StringValid(StringIn)",
        "CSetupManager::FindInstallImageFile",
        "CSetupManager::OnFinishMultiLayoutAction",
        "RtlAppendLBlobToLBlob",
        "8 9D9K9U9o9",
        "CreateFile failed",
        ">:?b?j?",
        "SetupManager::ExecuteCustomScript: Finished type [0x%X]",
        "Properties.Length == Results.Length",
        "SourceDom != 0",
        "=A=v=",
        "pHeader->ulOffsetToDomLayout < pHeader->ulTotalSize",
        "3'3?3U3d3y3",
        "9'969",
        "010A0H0",
        "7A7K7U7_7i7",
        "SVWh(",
        "u$WSQ",
        ":5:>:D:",
        "ImpersonateLoggedOnUser",
        "<(<p<}<",
        "CMicrodomBuilder::WriteXmlDom",
        "SetupManager: Error setting WU DateStamp registry value: [0x%X]",
        "VPiw&",
        ":$:^:c:{:",
        "Encoder != 0",
        "SetupManager: Error setting WU BuildNumber registry value: [0x%X]",
        "D$ ;D$",
        "timestamp",
        "GetFileVersionInfoExW",
        "= >->[>",
        "8?8l8",
        "wTh@}",
        "WINTRUST.dll",
        "RtlIsLUtf8StringValid(NamespaceURI) || (NamespaceURI == 0)",
        ".rdata$zETW9",
        "4k5!6k<",
        "<9<F<S<v<",
        "MaxDecompressionRateHeadroomKBs",
        "CP9C<t",
        ">Y>c>",
        "S(_^[",
        "8)878e8",
        "FACILITY_IO_ERROR_CODE",
        "D$PPQ",
        "2$3;3",
        "CSetupManager::SetPostRebootArgs",
        "ImageFinalize",
        "CumulativeUpdate",
        ":#:-:A:I:R:\\:",
        "CMicrodomUpdateContext::CreateVirtualComment",
        "4 4D4L4T4\\4d4l4t4|4",
        "SetupManager: Found unpack task! Restarting layout action...",
        "INDEX",
        "0-0:0I0",
        "NtSetInformationThread",
        "SetFileSize failed",
        "t=Wj,j",
        "pGetHostCSDBuildNumber",
        "6:7F7M7Y7`7",
        "6+6?6Q6",
        "j < ValidProperties.Length",
        "4-484l4z4",
        "6>6D6]6d6s6z6",
        "SetupManager: Error setting WU TimeStamp registry value: [0x%X]",
        ".?AV?$CUnknownImpl@UIUnknown@@@@",
        "SetupManager: Working Path:       [%s] (after)",
        "PoolHeader != 0",
        "RtlCreateDefaultMicrodomXmlWriter",
        ";'<x<C>",
        "NtSetInformationFile",
        "CSetupManager::DownloadProductsXml",
        "9*989>9[9",
        "Windows::Rtl::CRtlObjectTypeDescription<class MicrodomWriterImplementation::CMicrodomWriter>::CreateTearoff",
        "Create_Media",
        "DesktopInplaceUpgrade",
        "9 919t9|9",
        "9A:L:",
        "TlP0X",
        "383V3t3",
        "STATUS_KEY_DELETED",
        "GDRs\\DU",
        "*ppObject = State->m_pAllocator->Allocate<MediaPackage>()",
        "FACILITY_FWP_ERROR_CODE",
        "&amp;",
        "Not-null check failed: StringIn",
        "PWhpZ",
        "9>:J:U:w:",
        "1/2+3;3G3",
        "8.848C8I8T8[8`8i8p8u8~8",
        "SetupManager: CompactOS Disabled via override.",
        "Priority",
        "CSetupManager::OnFinishGetWebSetupUserInput",
        "<c=y=",
        "586C6J607;7B7",
        "'F!X8^",
        "WimCloseImageFile",
        "ResAddFromFileAndHandle",
        "EventWrite",
        "j\\Yf9",
        "1-1F1",
        "ActionListParser::ParseDownloads",
        ":%:8:?:K:R:^:e:q:x:",
        "CXmlCursor::DecodeExtent",
        "onecore\\internal\\base\\inc\\blockpool.h",
        "CSetupManager::InitializeMultiLayoutAciton",
        "Not-null check failed: pStream",
        ".rdata$sxdata",
        ">->i>p>",
        "SetupManager: Failed to get WU Id from host. Reporting default value. Error: [0x%X]",
        "DesktopServicing",
        "this->ChildList[u]->Text != 0",
        ";Q;~;",
        "ERROR_SXS_IDENTITIES_DIFFERENT",
        "SetupManager: Launching media creation tool",
        "TRUST_E_PROVIDER_UNKNOWN",
        "Locals.Allocate()",
        "=1=m=w=",
        "SetupManager: CompactOS Disabled via cached policy detection.",
        "SetupManager: Error setting WU instance LocationCode registry value: [0x%X]",
        "7 707<7H7T7`7l7x7",
        "1D1T1n1u1",
        "PSSSSSSSj",
        ";%<_<k<v<",
        "=1=9=g=",
        "GetSystemTimeAsFileTime",
        "memset",
        "4*5Q5e5q5",
        "Cancel of current task requested...",
        "STATUS_NOT_IMPLEMENTED",
        "GetTickCount",
        "InstalledSize",
        "E_FAIL",
        "2%3;3",
        "SetupManager::OpenOrCreateTask: Invalid State.",
        "DependsOn",
        "PQWj\\X",
        "u,SSS",
        "E_NOTIMPL",
        " !\"\"\"#$ &&&%%%%%%%",
        "STATUS_NOT_CAPABLE",
        "5Fz<|",
        "rExecuteMitigations: Creating MitigationMgr object...",
        "SetupManager: LangPacks Path:     [%s]",
        "TheElement != TheElement.InvalidValue()",
        "Could not parse {0}",
        "!fExisted",
        "LocalFree",
        "2,2S2i2",
        "939M9U9",
        "80878A8m8",
        "8/868L8S8b8i8",
        "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4",
        "PreFinalize",
        "SetupManager: Detecting CompactOS via policy...",
        "ERROR_ADVANCED_INSTALLER_FAILED",
        "10181D1d1l1t1|1",
        "536?6M6",
        "Decoder != 0",
        "NodeIndex < m_pTargetObject->m_LayoutCache.TotalObjectCount()",
        "ParseChunkRegionInternal",
        "ProductName",
        "CERT_E_UNTRUSTEDROOT",
        "P!\\$0",
        "(Destination->Buffer != 0) || (Destination->MaximumLength == 0)",
        "VerifyFileByHandle",
        "SYSTEM\\Setup\\MoSetup\\Tracking",
        "Xf9ABt",
        ": ;M;",
        "CSetupManager::GetSetupPlatformResult",
        "CopySid",
        "<0L0Y0s0",
        "<S<X<z<",
        "%s\\%s",
        ":,:L:^:m:",
        "SetupManager: Error setting WU BuildRevision registry value: [0x%X]",
        "200304183038Z",
        "CSetupManager::DetectRollback",
        "_except_handler4_common",
        "Duplicate download item: {0}, or out of memory.",
        "8,9t9",
        "WIM\\IMAGE[*]\\WIMBOOTENTRIES",
        "SetupManager: Starting to extract the license from LXP package [%s]...",
        "1(1/181G1i1o1",
        "FACILITY_SXS_ERROR_CODE",
        "SetupManager: Failed to set MCT UpgradeNow value",
        "2/363E3L3",
        ".?AV?$CDlpAutoLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@",
        "u$h7&",
        "4,4;4Q4V4r4",
        "1L2i2",
        "BUCL::Rtl::Multiply(WorkingBufferSize, MultiplicativeGrowthFactor, WorkingBufferSize)",
        "::RtlIsLUtf8StringValid(Source)",
        "212>2X2~2",
        "?X?e?",
        "tPSVP",
        "MicrodomImplementation::CMicrodom::GetDocumentNodeSet",
        "Windows::uDom::Rtl::RtlMicrodomUpdateGetCookieForExistingNode",
        "74797|7",
        "SVWPj",
        "_wtoi",
        "STATUS_SXS_TRANSACTION_CLOSURE_INCOMPLETE",
        "7$8{8+9u9",
        "1M3`3v3",
        "111A1r1",
        "    Edition         [ %s ]",
        "setup",
        "SetFileTime",
        "2;2e2m2",
        "xmlns",
        "IncrementFailedInstallCount",
        "onecore\\base\\xml\\udom_builder.cpp",
        "Not-null check failed: Destination",
        "LegacyInterrupt.dat",
        "y=hL(",
        "SetupManager::ExecuteCustomScript: Running [%s]",
        ">*>b>m>{>",
        "-eQkU",
        "1%1I1V1f1",
        "SusClientId",
        "7,8Y8o8",
        "637?7J7e7",
        "SetupManager: Install file found: [%s]",
        "%Microsoft Windows Production PCA 20110",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::Length",
        "3,494c4q4",
        ";](s?",
        "SetupManager: Error setting WU instance DateStamp registry value: [0x%X]",
        "RtlIsMicrodomUpdateContextValid(HostUpdate)",
        "Progress stalled...",
        "?w<t6",
        "(New == 0) || RtlIsLUtf8StringValid(New)",
        "D$8G;}",
        ";/<9<O<v<",
        "FACILITY_NTWIN32,Code=",
        "9A0vq",
        "=?=F=M=Z=d=n=",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocument",
        "GetPrivateProfileStringW",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttributeNs",
        "CSetupManager::GetParametersDriverMigrationAction",
        "Process PID %d is accessing file wim %s",
        "SetupManager: Found packagereq compat issues",
        "ImageBasedPBR",
        "CSetupManager::MarkWebSetupMedia",
        "XmlParserGenerator::ReportError",
        "CSetupManager::OnFinishDUSetupAction",
        "4:4u4",
        "210211214033Z0",
        "DeletePath: Failed to obliterate [%s] after %d tries; GLE = 0x%x",
        " Microsoft Corporation. All rights reserved.",
        "MicrodomImplementation::CStringpoolCache::FindString",
        "93uD3",
        "Not-null check failed: fHasAttribute",
        "6)707>7",
        "SLOpen",
        "SendMessageW",
        "<><_<u<|<",
        "= =+=6=A=R=Y=r=",
        "EtwEventUnregister",
        ">9?T?",
        "[0x%.8x] ",
        "^j?[;",
        "OOBEComplete",
        "FellBackToCanonical",
        "FlushFileBuffers",
        "3!404=4U4",
        "!This program cannot be run in DOS mode.",
        "3'3S3X3",
        "Server",
        "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU",
        "SetupManager: DiagnosticPrompt Enabled via override.",
        "575Y5e5",
        "GetExitCodeProcess",
        "t1VPQ",
        "%s\\%4.4d",
        "NewChild->Text.Allocate()",
        "QPWSRh",
        "C<+C(",
        "SetupManager: Error calling RtlTimeToSecondsSince1970",
        "PayloadFilePath",
        "SetupManager::Initialize: InstallFilePath        = [%s]",
        "NewPcData = this->AllocateStreamObject()",
        "%s_%u%s",
        "535A5Z5e5",
        "eSystemManifest",
        "20O0j0t0~0",
        "Setup phase change: [%s] -> [%s]",
        "NewAttlistClose = this->AllocateStreamObject()",
        "FACILITY_RPC_STUBS",
        "f@f#E",
        "1P1\\1f1l1y1",
        "SetupManager: NEO Constraint set via override: [%d].",
        "CreateDlpManager",
        "DeleteFileEx: Unable to delete [%s]; GLE = 0x%x",
        "Windows::Rtl::IsValid(ptr)",
        "GetUpdateReserveManager",
        "9r$tL;",
        ":*:C:U:r:}:",
        "2!343C3g3",
        "SetupManager: CompactOS Enabled via Scenario detection.",
        "CopyDirectoryDirCallback: The copy was canceled by the user.",
        "9K:R:g:~:",
        "DeleteFileEx: Trying to set back attributes on: %s",
        "ResExtract",
        "FlushSink.Hr()",
        "whichElement != Windows::Microdom::Rtl::Element::InvalidValue()",
        "GetProductInfo",
        "CMicrodomBuilder::ConsumeProcessingInstruction",
        "OpenThreadToken",
        "OpenProcessToken",
        "747@7`7h7p7|7",
        "Reason",
        "__tempE",
        "QQQQQQQW",
        "MoveFileW",
        "nCSetupManager::LogWimInfo",
        "CloseHandle",
        "=A>L>",
        ">+?:?A?",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\WOF",
        "SetupManager: Failed to create WebSetup registry key. Error: [0x%X]",
        "0!060h0",
        "^[w\"QRW",
        "DeletePathEngine: Hit %d failure%s during recursive deletion of [%s]; 1st error = 0x%x, cd = [%s]",
        "SetupManager: Try to cancel existing BITS downloads to %s",
        "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0",
        "041F1S1",
        "060t0",
        "> >/>E>b>y>",
        "<><_<x<",
        "WriteFile",
        "0`0u0",
        "SourcePath",
        "MicrodomImplementation::CDomPositionCache::AttachToPositionList",
        "SetupManager: Using BitLocker mode specified via command line",
        "SVWhP",
        "WIM\\IMAGE[*]",
        "6 7(7D7v7",
        "CSetupManager::ExecuteSuccessMode",
        "TRUST_E_SUBJECT_NOT_TRUSTED",
        "x,j\\Xj",
        "Windows::Rtl::CRtlObjectTypeDescription<class MicrodomImplementation::CMicrodom>::CreateInstance",
        "SetupManager: Facilitator Url -> [%s]",
        "T$(9GL|X",
        "ERROR_SXS_ASSEMBLY_NOT_FOUND",
        "][YZ_^_^[",
        "WaitForMultipleObjects",
        "CSetupManager::SetRunRollbackScript",
        "CSetupManager::InitializeCompatFinalizeReqAction",
        "; <'<B<R<j<q<",
        "FileVersion",
        "CSetupManager::OpenOrCreateMediaCreateTask",
        "RtlDuplicateLUtf8String",
        "1&2l2y2",
        "m_AttdefListTable.FindOrInsertIfNotPresent( ulElementName, NewAttdefList, &pAttdefList)",
        "?,?7?N?[?f?t?{?",
        "6 8*888\\8f8t8",
        "?=?_?",
        ">C>T>h>",
        "ATTLIST",
        "LoadIntegrityInfo",
        "(Params->InputType == Windows::Microdom::Rtl::CreateMicrodomSource::Binary) || (Params->InputType == Windows::Microdom::Rtl::CreateMicrodomSource::Xml)",
        ".rdata$zzzdbg",
        "SetupManager: WimBoot detected in host OS.",
        "2*282W2y2",
        "SetupManager: Decryption key not found. Not deleting cached files",
        "Action",
        "5:5A5",
        "Windows::uDom::Rtl::RtlMicrodomUpdateInsertChild",
        "VWRQSU",
        "RtlCreateHeap",
        "=$=0=P=X=`=l=",
        "3$4k4z4",
        "3 4I4c4i4y4",
        "6 7'7;7B7W7^7m7t7",
        "SetupManager::Initialize: MediaPath              = [%s]",
        "MicrodomImplementation::CMicrodom::GetElementsByTagNameCommon",
        "CompareStringW",
        "LangPack",
        "CreateThread",
        "SetupManager: Successfully completed current mode"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "804ca630b63c281679b95d104a90ecaf0c1310fd965c2c284553df3b799a7a39",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/804ca630b63c281679b95d104a90ecaf0c1310fd965c2c284553df3b799a7a39",
              "guest_paths": [
                "overlay"
              ],
              "size": 8504,
              "crc32": "6912A090",
              "md5": "49d98c9cb367c23148ad518a1aa0cc59",
              "sha1": "2c4f45606ad2a40eb1297e916f2f42e7f5e61d4a",
              "sha256": "804ca630b63c281679b95d104a90ecaf0c1310fd965c2c284553df3b799a7a39",
              "sha512": "870820dd192d7b1291b83e0f5c9b775bac05e2016fccabb7d8f27231f8645d573d5b7bb300d86152d44ef800edbe98a7845930c80d4a300d79c35d8a4d607651",
              "rh_hash": null,
              "ssdeep": "96:brDXBDbz9MekJ3AhNpVtEiJhwDD0pBDXiebs/Am2grWXGuGDXOHpiJDuU4tDfvDt:eF2q8hDBQABJFJr35jWqnajN58",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T1A3023AD28F6C5447DAA7B84063A8F8877D3E43CF1864846A099BF9E42C873C5DF14A6D",
              "sha3_384": "14824fe7b64f4835ccce5d25e06e1d48015c03dd09122498338d262941887189fb30325992b27066aeed25acab8ca9e5",
              "data": null
            }
          ],
          "extracted_files_time": 0.00050910700156237,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "SetupHost.exe"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/f33e7bce0ca712baac95557823096f929f78927e521c0448ed237f429141efd9",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\SetupHost.exe"
      ],
      "size": 699192,
      "crc32": "E37C2BB1",
      "md5": "a5d94f9587f97e9c674447447721b77f",
      "sha1": "1c130f95c82ab28a4a11a7ed41eb9ea9f613a339",
      "sha256": "f33e7bce0ca712baac95557823096f929f78927e521c0448ed237f429141efd9",
      "sha512": "e5e35480a489b0f63a2938a1c4ea19aca197a16020bb330662b62e98759fb5f7b6056416dc1d8894e433607c5b4fb3e7ae61f0d2fa3c7455dd000916ec3d5d62",
      "rh_hash": null,
      "ssdeep": "12288:aoBJUei8NJTRJUrJJMOy2pWShbJAnpRj5pcRpGbov5IUfiHrCOTmfVjRagSPD:jBJUj8NJTRJUVJN59VjwbPD",
      "type": "PE32 executable (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T18CE48D1276D88075E6B325308AB9A635587EFA310F31F6CF6354DA9D26306C4CE393A7",
      "sha3_384": "e063a174d44a23a5edfea72eff4fa50c6d5ff2031dd08f47663e971e5a52a4314fe32155e934f98e1281fe7a0220cf46",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x00400000",
        "entrypoint": "0x0008ea50",
        "ep_bytes": "e8f0070000e979fdffffff259c754900",
        "peid_signatures": null,
        "reported_checksum": "0x000aeb3c",
        "actual_checksum": "0x000aeb3c",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "SetupHost.pdb",
        "imports": {
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x497000",
                "name": "GetTokenInformation"
              },
              {
                "address": "0x497004",
                "name": "RegQueryValueExW"
              },
              {
                "address": "0x497008",
                "name": "OpenThreadToken"
              },
              {
                "address": "0x49700c",
                "name": "AddAccessAllowedAce"
              },
              {
                "address": "0x497010",
                "name": "InitiateSystemShutdownExW"
              },
              {
                "address": "0x497014",
                "name": "GetLengthSid"
              },
              {
                "address": "0x497018",
                "name": "EventUnregister"
              },
              {
                "address": "0x49701c",
                "name": "RegOpenKeyExW"
              },
              {
                "address": "0x497020",
                "name": "InitializeAcl"
              },
              {
                "address": "0x497024",
                "name": "InitializeSecurityDescriptor"
              },
              {
                "address": "0x497028",
                "name": "FreeSid"
              },
              {
                "address": "0x49702c",
                "name": "OpenProcessToken"
              },
              {
                "address": "0x497030",
                "name": "RegSetValueExW"
              },
              {
                "address": "0x497034",
                "name": "RegSetKeySecurity"
              },
              {
                "address": "0x497038",
                "name": "CopySid"
              },
              {
                "address": "0x49703c",
                "name": "RegCreateKeyExW"
              },
              {
                "address": "0x497040",
                "name": "AllocateAndInitializeSid"
              },
              {
                "address": "0x497044",
                "name": "EventRegister"
              },
              {
                "address": "0x497048",
                "name": "EventWriteTransfer"
              },
              {
                "address": "0x49704c",
                "name": "RegCloseKey"
              },
              {
                "address": "0x497050",
                "name": "SetSecurityDescriptorDacl"
              },
              {
                "address": "0x497054",
                "name": "RegQueryInfoKeyW"
              },
              {
                "address": "0x497058",
                "name": "CredReadW"
              },
              {
                "address": "0x49705c",
                "name": "ImpersonateLoggedOnUser"
              },
              {
                "address": "0x497060",
                "name": "RegGetValueW"
              },
              {
                "address": "0x497064",
                "name": "EventProviderEnabled"
              },
              {
                "address": "0x497068",
                "name": "RevertToSelf"
              },
              {
                "address": "0x49706c",
                "name": "EqualSid"
              },
              {
                "address": "0x497070",
                "name": "AdjustTokenPrivileges"
              },
              {
                "address": "0x497074",
                "name": "CheckTokenMembership"
              },
              {
                "address": "0x497078",
                "name": "RegEnumKeyExW"
              },
              {
                "address": "0x49707c",
                "name": "RegDeleteTreeW"
              },
              {
                "address": "0x497080",
                "name": "RegDeleteValueW"
              },
              {
                "address": "0x497084",
                "name": "RegEnumValueW"
              },
              {
                "address": "0x497088",
                "name": "UnregisterTraceGuids"
              },
              {
                "address": "0x49708c",
                "name": "RegisterTraceGuidsW"
              },
              {
                "address": "0x497090",
                "name": "GetTraceEnableLevel"
              },
              {
                "address": "0x497094",
                "name": "GetTraceEnableFlags"
              },
              {
                "address": "0x497098",
                "name": "GetTraceLoggerHandle"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x4970b0",
                "name": "HeapAlloc"
              },
              {
                "address": "0x4970b4",
                "name": "GetProcessPreferredUILanguages"
              },
              {
                "address": "0x4970b8",
                "name": "SetCurrentDirectoryW"
              },
              {
                "address": "0x4970bc",
                "name": "GetProcAddress"
              },
              {
                "address": "0x4970c0",
                "name": "LocalFree"
              },
              {
                "address": "0x4970c4",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x4970c8",
                "name": "ExitProcess"
              },
              {
                "address": "0x4970cc",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x4970d0",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x4970d4",
                "name": "CreateProcessW"
              },
              {
                "address": "0x4970d8",
                "name": "FreeLibrary"
              },
              {
                "address": "0x4970dc",
                "name": "CopyFileW"
              },
              {
                "address": "0x4970e0",
                "name": "WideCharToMultiByte"
              },
              {
                "address": "0x4970e4",
                "name": "SystemTimeToTzSpecificLocalTime"
              },
              {
                "address": "0x4970e8",
                "name": "GetSystemTime"
              },
              {
                "address": "0x4970ec",
                "name": "DebugBreak"
              },
              {
                "address": "0x4970f0",
                "name": "GetSystemWindowsDirectoryW"
              },
              {
                "address": "0x4970f4",
                "name": "AllocConsole"
              },
              {
                "address": "0x4970f8",
                "name": "IsWow64Process"
              },
              {
                "address": "0x4970fc",
                "name": "GetDriveTypeW"
              },
              {
                "address": "0x497100",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x497104",
                "name": "IsDebuggerPresent"
              },
              {
                "address": "0x497108",
                "name": "GetExitCodeProcess"
              },
              {
                "address": "0x49710c",
                "name": "HeapSize"
              },
              {
                "address": "0x497110",
                "name": "CloseHandle"
              },
              {
                "address": "0x497114",
                "name": "GlobalFree"
              },
              {
                "address": "0x497118",
                "name": "GetCurrentThread"
              },
              {
                "address": "0x49711c",
                "name": "SetEvent"
              },
              {
                "address": "0x497120",
                "name": "AttachConsole"
              },
              {
                "address": "0x497124",
                "name": "OutputDebugStringW"
              },
              {
                "address": "0x497128",
                "name": "WTSGetActiveConsoleSessionId"
              },
              {
                "address": "0x49712c",
                "name": "OutputDebugStringA"
              },
              {
                "address": "0x497130",
                "name": "GlobalUnlock"
              },
              {
                "address": "0x497134",
                "name": "GlobalMemoryStatus"
              },
              {
                "address": "0x497138",
                "name": "GetFileType"
              },
              {
                "address": "0x49713c",
                "name": "CreateProcessA"
              },
              {
                "address": "0x497140",
                "name": "MoveFileExW"
              },
              {
                "address": "0x497144",
                "name": "GlobalLock"
              },
              {
                "address": "0x497148",
                "name": "HeapDestroy"
              },
              {
                "address": "0x49714c",
                "name": "HeapCompact"
              },
              {
                "address": "0x497150",
                "name": "GetLastError"
              },
              {
                "address": "0x497154",
                "name": "GlobalSize"
              },
              {
                "address": "0x497158",
                "name": "HeapValidate"
              },
              {
                "address": "0x49715c",
                "name": "HeapWalk"
              },
              {
                "address": "0x497160",
                "name": "GetComputerNameExW"
              },
              {
                "address": "0x497164",
                "name": "GetLocaleInfoW"
              },
              {
                "address": "0x497168",
                "name": "SetErrorMode"
              },
              {
                "address": "0x49716c",
                "name": "VirtualAlloc"
              },
              {
                "address": "0x497170",
                "name": "GetShortPathNameW"
              },
              {
                "address": "0x497174",
                "name": "VirtualFree"
              },
              {
                "address": "0x497178",
                "name": "HeapCreate"
              },
              {
                "address": "0x49717c",
                "name": "CreateThread"
              },
              {
                "address": "0x497180",
                "name": "CreateFileMappingA"
              },
              {
                "address": "0x497184",
                "name": "DeleteFileA"
              },
              {
                "address": "0x497188",
                "name": "CreateFileA"
              },
              {
                "address": "0x49718c",
                "name": "GetVersion"
              },
              {
                "address": "0x497190",
                "name": "CreateMutexA"
              },
              {
                "address": "0x497194",
                "name": "VirtualQuery"
              },
              {
                "address": "0x497198",
                "name": "GetTempFileNameW"
              },
              {
                "address": "0x49719c",
                "name": "GetLocalTime"
              },
              {
                "address": "0x4971a0",
                "name": "GetWindowsDirectoryA"
              },
              {
                "address": "0x4971a4",
                "name": "RaiseException"
              },
              {
                "address": "0x4971a8",
                "name": "GetModuleFileNameA"
              },
              {
                "address": "0x4971ac",
                "name": "GetDiskFreeSpaceExW"
              },
              {
                "address": "0x4971b0",
                "name": "GetVersionExA"
              },
              {
                "address": "0x4971b4",
                "name": "GetFileSize"
              },
              {
                "address": "0x4971b8",
                "name": "GetVolumePathNamesForVolumeNameW"
              },
              {
                "address": "0x4971bc",
                "name": "GetWindowsDirectoryW"
              },
              {
                "address": "0x4971c0",
                "name": "TlsSetValue"
              },
              {
                "address": "0x4971c4",
                "name": "TlsGetValue"
              },
              {
                "address": "0x4971c8",
                "name": "TlsFree"
              },
              {
                "address": "0x4971cc",
                "name": "TlsAlloc"
              },
              {
                "address": "0x4971d0",
                "name": "SetFileTime"
              },
              {
                "address": "0x4971d4",
                "name": "LocalFileTimeToFileTime"
              },
              {
                "address": "0x4971d8",
                "name": "DosDateTimeToFileTime"
              },
              {
                "address": "0x4971dc",
                "name": "RemoveDirectoryW"
              },
              {
                "address": "0x4971e0",
                "name": "UnmapViewOfFile"
              },
              {
                "address": "0x4971e4",
                "name": "MapViewOfFile"
              },
              {
                "address": "0x4971e8",
                "name": "CreateFileMappingW"
              },
              {
                "address": "0x4971ec",
                "name": "WaitForMultipleObjects"
              },
              {
                "address": "0x4971f0",
                "name": "UnlockFileEx"
              },
              {
                "address": "0x4971f4",
                "name": "LockFileEx"
              },
              {
                "address": "0x4971f8",
                "name": "HeapReAlloc"
              },
              {
                "address": "0x4971fc",
                "name": "GetVolumeInformationW"
              },
              {
                "address": "0x497200",
                "name": "WaitForMultipleObjectsEx"
              },
              {
                "address": "0x497204",
                "name": "ReleaseSemaphore"
              },
              {
                "address": "0x497208",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x49720c",
                "name": "GetOverlappedResult"
              },
              {
                "address": "0x497210",
                "name": "SetEndOfFile"
              },
              {
                "address": "0x497214",
                "name": "SetFilePointerEx"
              },
              {
                "address": "0x497218",
                "name": "GetHandleInformation"
              },
              {
                "address": "0x49721c",
                "name": "OpenProcess"
              },
              {
                "address": "0x497220",
                "name": "SetFilePointer"
              },
              {
                "address": "0x497224",
                "name": "ReleaseMutex"
              },
              {
                "address": "0x497228",
                "name": "WriteFile"
              },
              {
                "address": "0x49722c",
                "name": "ReadFile"
              },
              {
                "address": "0x497230",
                "name": "LoadLibraryW"
              },
              {
                "address": "0x497234",
                "name": "PowerClearRequest"
              },
              {
                "address": "0x497238",
                "name": "FreeConsole"
              },
              {
                "address": "0x49723c",
                "name": "GetLogicalDrives"
              },
              {
                "address": "0x497240",
                "name": "LocalAlloc"
              },
              {
                "address": "0x497244",
                "name": "ResetEvent"
              },
              {
                "address": "0x497248",
                "name": "FormatMessageW"
              },
              {
                "address": "0x49724c",
                "name": "GetEnvironmentVariableW"
              },
              {
                "address": "0x497250",
                "name": "PowerCreateRequest"
              },
              {
                "address": "0x497254",
                "name": "GetTimeZoneInformation"
              },
              {
                "address": "0x497258",
                "name": "ProcessIdToSessionId"
              },
              {
                "address": "0x49725c",
                "name": "MultiByteToWideChar"
              },
              {
                "address": "0x497260",
                "name": "CreateEventW"
              },
              {
                "address": "0x497264",
                "name": "GetLogicalDriveStringsW"
              },
              {
                "address": "0x497268",
                "name": "GetVolumeNameForVolumeMountPointW"
              },
              {
                "address": "0x49726c",
                "name": "DuplicateHandle"
              },
              {
                "address": "0x497270",
                "name": "OpenEventW"
              },
              {
                "address": "0x497274",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x497278",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x49727c",
                "name": "CreateFileW"
              },
              {
                "address": "0x497280",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x497284",
                "name": "CreateMutexW"
              },
              {
                "address": "0x497288",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x49728c",
                "name": "InitializeCriticalSectionAndSpinCount"
              },
              {
                "address": "0x497290",
                "name": "GetProductInfo"
              },
              {
                "address": "0x497294",
                "name": "GetUserDefaultUILanguage"
              },
              {
                "address": "0x497298",
                "name": "SetEnvironmentVariableW"
              },
              {
                "address": "0x49729c",
                "name": "GetModuleFileNameW"
              },
              {
                "address": "0x4972a0",
                "name": "TerminateProcess"
              },
              {
                "address": "0x4972a4",
                "name": "GetSystemDefaultUILanguage"
              },
              {
                "address": "0x4972a8",
                "name": "ExpandEnvironmentStringsW"
              },
              {
                "address": "0x4972ac",
                "name": "GetModuleHandleExW"
              },
              {
                "address": "0x4972b0",
                "name": "GetStdHandle"
              },
              {
                "address": "0x4972b4",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x4972b8",
                "name": "GetFullPathNameW"
              },
              {
                "address": "0x4972bc",
                "name": "GetCommandLineW"
              },
              {
                "address": "0x4972c0",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x4972c4",
                "name": "HeapFree"
              },
              {
                "address": "0x4972c8",
                "name": "CompareStringW"
              },
              {
                "address": "0x4972cc",
                "name": "SetConsoleCtrlHandler"
              },
              {
                "address": "0x4972d0",
                "name": "PowerSetRequest"
              },
              {
                "address": "0x4972d4",
                "name": "CreateDirectoryW"
              },
              {
                "address": "0x4972d8",
                "name": "SetProcessPreferredUILanguages"
              },
              {
                "address": "0x4972dc",
                "name": "GlobalAlloc"
              },
              {
                "address": "0x4972e0",
                "name": "Sleep"
              },
              {
                "address": "0x4972e4",
                "name": "GetStartupInfoW"
              },
              {
                "address": "0x4972e8",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x4972ec",
                "name": "AcquireSRWLockExclusive"
              },
              {
                "address": "0x4972f0",
                "name": "WakeAllConditionVariable"
              },
              {
                "address": "0x4972f4",
                "name": "SleepConditionVariableSRW"
              },
              {
                "address": "0x4972f8",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x4972fc",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x497300",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x497304",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x497308",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x49730c",
                "name": "GetTickCount"
              },
              {
                "address": "0x497310",
                "name": "GetFileInformationByHandleEx"
              },
              {
                "address": "0x497314",
                "name": "FindFirstFileW"
              },
              {
                "address": "0x497318",
                "name": "SetLastError"
              },
              {
                "address": "0x49731c",
                "name": "FindNextFileW"
              },
              {
                "address": "0x497320",
                "name": "GetDiskFreeSpaceW"
              },
              {
                "address": "0x497324",
                "name": "DeviceIoControl"
              },
              {
                "address": "0x497328",
                "name": "GetTempPathW"
              },
              {
                "address": "0x49732c",
                "name": "FindClose"
              },
              {
                "address": "0x497330",
                "name": "SetFileAttributesW"
              },
              {
                "address": "0x497334",
                "name": "GetFileInformationByHandle"
              },
              {
                "address": "0x497338",
                "name": "SetFileInformationByHandle"
              },
              {
                "address": "0x49733c",
                "name": "DeleteFileW"
              },
              {
                "address": "0x497340",
                "name": "CopyFileExW"
              },
              {
                "address": "0x497344",
                "name": "FlushFileBuffers"
              },
              {
                "address": "0x497348",
                "name": "GetVersionExW"
              },
              {
                "address": "0x49734c",
                "name": "GetNativeSystemInfo"
              },
              {
                "address": "0x497350",
                "name": "GetSystemInfo"
              },
              {
                "address": "0x497354",
                "name": "GetLongPathNameW"
              },
              {
                "address": "0x497358",
                "name": "GetFinalPathNameByHandleW"
              },
              {
                "address": "0x49735c",
                "name": "GetVolumePathNameW"
              },
              {
                "address": "0x497360",
                "name": "GetCurrentDirectoryW"
              },
              {
                "address": "0x497364",
                "name": "GetPrivateProfileSectionW"
              },
              {
                "address": "0x497368",
                "name": "GetPrivateProfileStringW"
              },
              {
                "address": "0x49736c",
                "name": "GetFileSizeEx"
              }
            ]
          },
          "USER32": {
            "dll": "USER32.dll",
            "imports": [
              {
                "address": "0x4973ac",
                "name": "SetWindowTextW"
              },
              {
                "address": "0x4973b0",
                "name": "SendMessageW"
              },
              {
                "address": "0x4973b4",
                "name": "ShowWindow"
              },
              {
                "address": "0x4973b8",
                "name": "DispatchMessageW"
              },
              {
                "address": "0x4973bc",
                "name": "RegisterClassW"
              },
              {
                "address": "0x4973c0",
                "name": "CreateWindowExW"
              },
              {
                "address": "0x4973c4",
                "name": "UnregisterClassA"
              },
              {
                "address": "0x4973c8",
                "name": "DestroyWindow"
              },
              {
                "address": "0x4973cc",
                "name": "LoadImageW"
              },
              {
                "address": "0x4973d0",
                "name": "UpdateWindow"
              },
              {
                "address": "0x4973d4",
                "name": "ShutdownBlockReasonDestroy"
              },
              {
                "address": "0x4973d8",
                "name": "PostQuitMessage"
              },
              {
                "address": "0x4973dc",
                "name": "CharNextW"
              },
              {
                "address": "0x4973e0",
                "name": "SetWindowLongW"
              },
              {
                "address": "0x4973e4",
                "name": "IsCharAlphaW"
              },
              {
                "address": "0x4973e8",
                "name": "GetMessageW"
              },
              {
                "address": "0x4973ec",
                "name": "LoadCursorW"
              },
              {
                "address": "0x4973f0",
                "name": "ChangeWindowMessageFilterEx"
              },
              {
                "address": "0x4973f4",
                "name": "TranslateMessage"
              },
              {
                "address": "0x4973f8",
                "name": "ShutdownBlockReasonCreate"
              },
              {
                "address": "0x4973fc",
                "name": "MessageBoxTimeoutW"
              },
              {
                "address": "0x497400",
                "name": "DefWindowProcW"
              },
              {
                "address": "0x497404",
                "name": "GetWindowLongW"
              },
              {
                "address": "0x497408",
                "name": "SetTimer"
              }
            ]
          },
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x497498",
                "name": "_purecall"
              },
              {
                "address": "0x49749c",
                "name": "_set_errno"
              },
              {
                "address": "0x4974a0",
                "name": "_errno"
              },
              {
                "address": "0x4974a4",
                "name": "wcschr"
              },
              {
                "address": "0x4974a8",
                "name": "strtol"
              },
              {
                "address": "0x4974ac",
                "name": "__iob_func"
              },
              {
                "address": "0x4974b0",
                "name": "_wcsicmp"
              },
              {
                "address": "0x4974b4",
                "name": "wcscpy_s"
              },
              {
                "address": "0x4974b8",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x4974bc",
                "name": "wcsrchr"
              },
              {
                "address": "0x4974c0",
                "name": "_vsnprintf"
              },
              {
                "address": "0x4974c4",
                "name": "_vscwprintf"
              },
              {
                "address": "0x4974c8",
                "name": "towupper"
              },
              {
                "address": "0x4974cc",
                "name": "iswspace"
              },
              {
                "address": "0x4974d0",
                "name": "swscanf_s"
              },
              {
                "address": "0x4974d4",
                "name": "wcsncmp"
              },
              {
                "address": "0x4974d8",
                "name": "qsort"
              },
              {
                "address": "0x4974dc",
                "name": "towlower"
              },
              {
                "address": "0x4974e0",
                "name": "memmove_s"
              },
              {
                "address": "0x4974e4",
                "name": "free"
              },
              {
                "address": "0x4974e8",
                "name": "toupper"
              },
              {
                "address": "0x4974ec",
                "name": "iswctype"
              },
              {
                "address": "0x4974f0",
                "name": "fclose"
              },
              {
                "address": "0x4974f4",
                "name": "_wtoi"
              },
              {
                "address": "0x4974f8",
                "name": "_wfopen"
              },
              {
                "address": "0x4974fc",
                "name": "fgetws"
              },
              {
                "address": "0x497500",
                "name": "feof"
              },
              {
                "address": "0x497504",
                "name": "_wtof"
              },
              {
                "address": "0x497508",
                "name": "setvbuf"
              },
              {
                "address": "0x49750c",
                "name": "strchr"
              },
              {
                "address": "0x497510",
                "name": "_wtol"
              },
              {
                "address": "0x497514",
                "name": "strrchr"
              },
              {
                "address": "0x497518",
                "name": "_open_osfhandle"
              },
              {
                "address": "0x49751c",
                "name": "sprintf_s"
              },
              {
                "address": "0x497520",
                "name": "_XcptFilter"
              },
              {
                "address": "0x497524",
                "name": "__p__commode"
              },
              {
                "address": "0x497528",
                "name": "_amsg_exit"
              },
              {
                "address": "0x49752c",
                "name": "__wgetmainargs"
              },
              {
                "address": "0x497530",
                "name": "__set_app_type"
              },
              {
                "address": "0x497534",
                "name": "exit"
              },
              {
                "address": "0x497538",
                "name": "_exit"
              },
              {
                "address": "0x49753c",
                "name": "_cexit"
              },
              {
                "address": "0x497540",
                "name": "__p__fmode"
              },
              {
                "address": "0x497544",
                "name": "__setusermatherr"
              },
              {
                "address": "0x497548",
                "name": "_initterm"
              },
              {
                "address": "0x49754c",
                "name": "_wcmdln"
              },
              {
                "address": "0x497550",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x497554",
                "name": "_lock"
              },
              {
                "address": "0x497558",
                "name": "_unlock"
              },
              {
                "address": "0x49755c",
                "name": "__dllonexit"
              },
              {
                "address": "0x497560",
                "name": "_onexit"
              },
              {
                "address": "0x497564",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x497568",
                "name": "_controlfp"
              },
              {
                "address": "0x49756c",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x497570",
                "name": "bsearch"
              },
              {
                "address": "0x497574",
                "name": "memcmp"
              },
              {
                "address": "0x497578",
                "name": "memcpy"
              },
              {
                "address": "0x49757c",
                "name": "memmove"
              },
              {
                "address": "0x497580",
                "name": "wcstoul"
              },
              {
                "address": "0x497584",
                "name": "_fdopen"
              },
              {
                "address": "0x497588",
                "name": "strncpy_s"
              },
              {
                "address": "0x49758c",
                "name": "memcpy_s"
              },
              {
                "address": "0x497590",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x497594",
                "name": "wprintf"
              },
              {
                "address": "0x497598",
                "name": "wcstok_s"
              },
              {
                "address": "0x49759c",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x4975a0",
                "name": "memset"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x4975a8",
                "name": "RtlDeleteResource"
              },
              {
                "address": "0x4975ac",
                "name": "RtlReleaseResource"
              },
              {
                "address": "0x4975b0",
                "name": "RtlAcquireResourceShared"
              },
              {
                "address": "0x4975b4",
                "name": "RtlAcquireResourceExclusive"
              },
              {
                "address": "0x4975b8",
                "name": "RtlInitializeResource"
              },
              {
                "address": "0x4975bc",
                "name": "NtQueryInformationProcess"
              },
              {
                "address": "0x4975c0",
                "name": "NtQueryLicenseValue"
              },
              {
                "address": "0x4975c4",
                "name": "DbgPrintEx"
              },
              {
                "address": "0x4975c8",
                "name": "NtYieldExecution"
              },
              {
                "address": "0x4975cc",
                "name": "RtlRaiseStatus"
              },
              {
                "address": "0x4975d0",
                "name": "NtCreateFile"
              },
              {
                "address": "0x4975d4",
                "name": "NtQueryInformationFile"
              },
              {
                "address": "0x4975d8",
                "name": "NtClose"
              },
              {
                "address": "0x4975dc",
                "name": "RtlReAllocateHeap"
              },
              {
                "address": "0x4975e0",
                "name": "RtlFreeHeap"
              },
              {
                "address": "0x4975e4",
                "name": "RtlNtStatusToDosError"
              },
              {
                "address": "0x4975e8",
                "name": "NtSetInformationFile"
              },
              {
                "address": "0x4975ec",
                "name": "RtlAllocateHeap"
              },
              {
                "address": "0x4975f0",
                "name": "RtlDosPathNameToNtPathName_U"
              },
              {
                "address": "0x4975f4",
                "name": "NtPowerInformation"
              },
              {
                "address": "0x4975f8",
                "name": "RtlAdjustPrivilege"
              },
              {
                "address": "0x4975fc",
                "name": "RtlGetVersion"
              }
            ]
          },
          "ole32": {
            "dll": "ole32.dll",
            "imports": [
              {
                "address": "0x497604",
                "name": "CoTaskMemFree"
              },
              {
                "address": "0x497608",
                "name": "CoInitializeSecurity"
              },
              {
                "address": "0x49760c",
                "name": "CoInitializeEx"
              },
              {
                "address": "0x497610",
                "name": "CoCreateInstance"
              },
              {
                "address": "0x497614",
                "name": "CoUninitialize"
              }
            ]
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x497374",
                "name": "SystemTimeToVariantTime"
              },
              {
                "address": "0x497378",
                "name": "SysFreeString"
              },
              {
                "address": "0x49737c",
                "name": "VariantTimeToSystemTime"
              },
              {
                "address": "0x497380",
                "name": "SysAllocString"
              }
            ]
          },
          "RPCRT4": {
            "dll": "RPCRT4.dll",
            "imports": [
              {
                "address": "0x497388",
                "name": "UuidFromStringW"
              },
              {
                "address": "0x49738c",
                "name": "UuidToStringW"
              },
              {
                "address": "0x497390",
                "name": "I_RpcMapWin32Status"
              },
              {
                "address": "0x497394",
                "name": "RpcStringFreeW"
              },
              {
                "address": "0x497398",
                "name": "UuidCreate"
              }
            ]
          },
          "VERSION": {
            "dll": "VERSION.dll",
            "imports": [
              {
                "address": "0x497410",
                "name": "GetFileVersionInfoSizeExW"
              },
              {
                "address": "0x497414",
                "name": "VerQueryValueW"
              },
              {
                "address": "0x497418",
                "name": "GetFileVersionInfoExW"
              }
            ]
          },
          "Cabinet": {
            "dll": "Cabinet.dll",
            "imports": []
          },
          "SHELL32": {
            "dll": "SHELL32.dll",
            "imports": [
              {
                "address": "0x4973a0",
                "name": "Shell_NotifyIconW"
              },
              {
                "address": "0x4973a4",
                "name": "CommandLineToArgvW"
              }
            ]
          },
          "WTSAPI32": {
            "dll": "WTSAPI32.dll",
            "imports": [
              {
                "address": "0x497460",
                "name": "WTSEnumerateSessionsW"
              },
              {
                "address": "0x497464",
                "name": "WTSRegisterSessionNotification"
              },
              {
                "address": "0x497468",
                "name": "WTSQueryUserToken"
              },
              {
                "address": "0x49746c",
                "name": "WTSUnRegisterSessionNotification"
              },
              {
                "address": "0x497470",
                "name": "WTSFreeMemory"
              }
            ]
          },
          "bcrypt": {
            "dll": "bcrypt.dll",
            "imports": [
              {
                "address": "0x497478",
                "name": "BCryptCreateHash"
              },
              {
                "address": "0x49747c",
                "name": "BCryptCloseAlgorithmProvider"
              },
              {
                "address": "0x497480",
                "name": "BCryptOpenAlgorithmProvider"
              },
              {
                "address": "0x497484",
                "name": "BCryptHashData"
              },
              {
                "address": "0x497488",
                "name": "BCryptDestroyHash"
              },
              {
                "address": "0x49748c",
                "name": "BCryptFinishHash"
              },
              {
                "address": "0x497490",
                "name": "BCryptGetProperty"
              }
            ]
          },
          "WINHTTP": {
            "dll": "WINHTTP.dll",
            "imports": [
              {
                "address": "0x497420",
                "name": "WinHttpOpen"
              },
              {
                "address": "0x497424",
                "name": "WinHttpReceiveResponse"
              },
              {
                "address": "0x497428",
                "name": "WinHttpGetDefaultProxyConfiguration"
              },
              {
                "address": "0x49742c",
                "name": "WinHttpOpenRequest"
              },
              {
                "address": "0x497430",
                "name": "WinHttpSetOption"
              },
              {
                "address": "0x497434",
                "name": "WinHttpCloseHandle"
              },
              {
                "address": "0x497438",
                "name": "WinHttpGetIEProxyConfigForCurrentUser"
              },
              {
                "address": "0x49743c",
                "name": "WinHttpQueryAuthSchemes"
              },
              {
                "address": "0x497440",
                "name": "WinHttpGetProxyForUrl"
              },
              {
                "address": "0x497444",
                "name": "WinHttpSendRequest"
              },
              {
                "address": "0x497448",
                "name": "WinHttpSetCredentials"
              },
              {
                "address": "0x49744c",
                "name": "WinHttpQueryHeaders"
              },
              {
                "address": "0x497450",
                "name": "WinHttpConnect"
              },
              {
                "address": "0x497454",
                "name": "WinHttpQueryDataAvailable"
              },
              {
                "address": "0x497458",
                "name": "WinHttpReadData"
              }
            ]
          }
        },
        "exported_dll_name": null,
        "exports": [],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x00097620",
            "size": "0x0000012c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x0009a000",
            "size": "0x0000c748"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x000a8a00",
            "size": "0x00002138"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x000a7000",
            "size": "0x0000657c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x0001f220",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x00003294",
            "size": "0x00000018"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x000031e8",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x00097000",
            "size": "0x0000061c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x00091e84",
            "size_of_data": "0x00092000",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.39"
          },
          {
            "name": ".data",
            "raw_address": "0x00092400",
            "virtual_address": "0x00093000",
            "virtual_size": "0x00003fa0",
            "size_of_data": "0x00000e00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "3.98"
          },
          {
            "name": ".idata",
            "raw_address": "0x00093200",
            "virtual_address": "0x00097000",
            "virtual_size": "0x00002914",
            "size_of_data": "0x00002a00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.67"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x00095c00",
            "virtual_address": "0x0009a000",
            "virtual_size": "0x0000c748",
            "size_of_data": "0x0000c800",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.70"
          },
          {
            "name": ".reloc",
            "raw_address": "0x000a2400",
            "virtual_address": "0x000a7000",
            "virtual_size": "0x0000657c",
            "size_of_data": "0x00006600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.79"
          }
        ],
        "overlay": {
          "offset": "0x000a8a00",
          "size": "0x00002138"
        },
        "resources": [
          {
            "name": "RT_ICON",
            "offset": "0x0009afb8",
            "size": "0x00000668",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.80"
          },
          {
            "name": "RT_ICON",
            "offset": "0x0009b620",
            "size": "0x000002e8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.88"
          },
          {
            "name": "RT_ICON",
            "offset": "0x0009b908",
            "size": "0x000001e8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.61"
          },
          {
            "name": "RT_ICON",
            "offset": "0x0009baf0",
            "size": "0x00000128",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.60"
          },
          {
            "name": "RT_ICON",
            "offset": "0x0009bc18",
            "size": "0x00000ea8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.35"
          },
          {
            "name": "RT_ICON",
            "offset": "0x0009cac0",
            "size": "0x000008a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.11"
          },
          {
            "name": "RT_ICON",
            "offset": "0x0009d368",
            "size": "0x000006c8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.49"
          },
          {
            "name": "RT_ICON",
            "offset": "0x0009da30",
            "size": "0x00000568",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.49"
          },
          {
            "name": "RT_ICON",
            "offset": "0x0009df98",
            "size": "0x0000424f",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.91"
          },
          {
            "name": "RT_ICON",
            "offset": "0x000a21e8",
            "size": "0x000025a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.43"
          },
          {
            "name": "RT_ICON",
            "offset": "0x000a4790",
            "size": "0x000010a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.60"
          },
          {
            "name": "RT_ICON",
            "offset": "0x000a5838",
            "size": "0x000009e8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.62"
          },
          {
            "name": "RT_ICON",
            "offset": "0x000a6220",
            "size": "0x00000468",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.98"
          },
          {
            "name": "RT_GROUP_ICON",
            "offset": "0x000a6688",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.08"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x0009a370",
            "size": "0x000003b0",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.52"
          },
          {
            "name": "RT_MANIFEST",
            "offset": "0x0009a720",
            "size": "0x00000897",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.82"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Modern Setup Host"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (vb_release_svc_prod1.201007-1724)"
          },
          {
            "name": "InternalName",
            "value": "SetupHost.exe"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "SetupHost.exe"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "44552524134d5ece63599d64b9fc0a66",
        "timestamp": "2023-11-21 01:41:00",
        "icon": "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAHWUlEQVR4nO2YWWwdVxnHf+fMzF1tX+9xYqfOWieOs7goTVpKKTRKA6qgEAgg9QGE1IJ4QEjwgEBVQJHgDd7KS5/Y1JKoKUFUKk1YwhZKA01j4pSgJk0c3zhNvNxt7sxZeLj32jderh3HYZH8l0ajq/HM+f3Pd77vfMewrGXdkcR/cjClVGU8UXXZqgvXde3tfFMuJeBcUkoJpZQEHCACRMtX5KkffTG19Vv9KxbLctcjUAaXgAt4vzr3avzrL35z85XRK525Yr6jsalttVvvxZ0xdfDCocFrtxsB965QM7lcRHkM79iZX6S+cfSZnZfGh3Z3PrTlPTv6PrK2Y013R/qdi5dO/eDosace+GyGqSW1YN2VCJThK7Me3f3dh3a+MXT2ka599z+y64Pv22liNtrlrlSv/vAnR66cPv+znhU9fz35tV8PAfp2I7DkBqbBx3sPbvvARCzc1/e5xz6ZaK1rinoea1gd/PK5517I/evG4QuHBk8ARUAB9n9hCVWWTWzLwe17/DY+9uDnP3MgiBdcZRT9Yqt+4dnv/1ikiy9dODT4WyAE9GLgYYmrUHn2HSCy7dv3vd9fIZ547xeePODH867RPuvcbv5w6pXfi3Tx5TPPnP4d4JcNmMXAwxIaqFo63p7v7ds2osce3fX0J/ZPREZdUKz0ulFhfmjg8Imf/vxLL55cCnhY2ggIwAMSg+nzO/q//NH9oadixoRoAe10cPzZ51/etfb+gTUt3VmWAL4y6Jx6/cyZMaVNSmk9y9PSuLY8vBAgpeTc9UFOqFOEH+7gph3GxSMiEnQHLaSOZNm7fi/KaLQxWAvWWrBgqfqNQEqBHwSkb9wYevpTB7rmYqyZxEWlUtb1ePPsmwR+sUQrxCS1rdyxuI6LF4nwm6vH8b7aQ54MHlEytsBK0c7bJwbovdHJXyZOEyqFVgZjbfkbt8LH43GaWppJNqS4OjSUqsVY04DSmn8MDHD0rY2zPhcChJA4nqQuHsGLTnAh1cp9TophO4JAcN2Oso5NXB7uIFj1JFecNnxlMAassVhrMMZijMEajTEGozV63PBg+EeK+XwtxPlzQCs18yUBUoLnusRiLnXxCA3JKHnzNo27GxhnHM96jOssaXWDKBGcCUOqrpmIA54UeNIihQEsTIfXpXtjfR3SrV3paz4VgBSzeBQl+GjUJR5xSCYipOqiXB15l7beFBmuEaiAa2qUTJijGA2I4pCKRXAxSCyBAmEFRmusnQlvtCIWjSIdZ/EGJl1U/xQgpQNOnpHCWUYnBvE8F8+RuK5kk7eDN8LLZMIco8VRtAoICfCV5shr38FYizYWYywdqe20JPsRtg47DV4rjRBiMs8Wb2C6HyFxXMl4eB65d4Q9ux+gmQQxPASSi1yEQDHmj5MvZsAPeD32N9Z8pYvAL1Io+gS+TxAEvPXaTdanJe3J3TPgjdZY7NIaEFIiHYmUDu112xk/KRisv0Rsi+JdP02DiSM0hIFPpjCGKgRQDDn/zz9z3tdQVBCGOM1rWXdlMz3XHqY52YdSM+FVqKqOOXOrZhJbqup8Bd5xkI5DJJKiI9WPc7wNddGjIdZMNshhghC/WCCfz2JzBcgWIRtAzod8AKl7WD98L73DD9Oe3IqwSbTW6GnwKgzLY9d2UNtAeQYq8I7j4Lgu0nWx0iHitbKisZ9rz9/EvBPFTSTJ5ifw8xmKmSzkgpKBfAi+hlQn3SMbaBpop62uD0EjKtRoNRNehyEWOzWDizFQ8m9vgXe8kgEhHTQOkUgnO1Z/mvHDOcxQBD/mkcmOYbJ+adb9AAoB1HfSNbaBjsFOtqzaD6YVP1CEYYiaBV6FIVg7H/98BkpJVA1fuQvXBemgrCAW66av8+P4L4G+HmPCjaNyBcirUhQaVrIidw+dg91saX8CR3RQCBRhMDe8DlXV7rxIA5UPTIev3HEcrJCEBhLxjfR2PE7klQSpfAu6vrU0+w0raSp0s+bcRja3PY4jOyn4Jdha8KUN1M57vqxZhay1WOys8KVkliAkGkFRGerjvWxq1+g/HSOzbYJ0XZ561cWGwR42tX6IiNNNvlBaNmFYG14rhUXOa2GeMlrqFOeCl1KCFBgLaCgaTUO8l41NRcLTmsKqkPWXe7i35TGi7noKvl4wvNGahZzx54lA6fVa8BWf2loMBqMtqdg2+lrraBn5O+2tfcScLgq+JgiCBcMbYya/vfgIlF+eD97aqa5SWwNW48ouVjeuQmlDwQ9RSt02/HwVaF4DlQqwEHhb1RJbY27pbbRW8ybsjJmvSNT+x0ntCAiIJ5JIvXD42brK2TaphcA7Ut7ZRiaFoLm1+b8CXxnfmDtIYj8MiSeSPNpwivpEgojnTRmoOgaWkr3Ud1QmrFKCbbmhstXPytUN62BxYNq7Ukq01lzPZCnkcos3MJwezqXT6WQhl8f1PISQ5TVZDV85lNvyGRewZsoAUz3V5N+Xd/ipuZ3ZMmil8AsFlNbFmg6WtaxlLWtZy1rWspb1/6t/Ay5Oahn19l3HAAAAAElFTkSuQmCC",
        "icon_hash": "60608a07d112ace9d7a180ee9deaa3d4",
        "icon_fuzzy": "bc85df9c7cdf2d8ba0f53a0f681e6f31",
        "icon_dhash": "6060f0d8ecfc4000",
        "imported_dll_count": 14
      },
      "data": null,
      "strings": [
        "InstallReqCleanupTaskTime",
        "=H=N=",
        "TranslateMessage",
        "ro-MD",
        "mk-MK",
        "WindowsLicenseState",
        "wt$\"evu",
        "?'?0?5?;?@?F?J?O?Y?b?j?o?t?y?",
        "WimImageEnqueueOperation",
        "GetTokenInformation",
        "CSystemHelper::SetMainTitle",
        "1+2e2i2m2q2u2y2}2",
        "/ReflectDrivers",
        "sr-Cyrl-RS",
        ">-?\\?",
        "CSystemHelper::SetApplicationName",
        "es-DO",
        "5@5\\5z5",
        ".CRT$XLA",
        "(ulElementType == (0x2)) || (ulElementType == (0x3)) || (ulElementType == (0x5)) || (ulElementType == (0x1)) || (ulElementType == (0x6)) || (ulElementType == (0x7)) || (ulElementType == (0x4))",
        "(Flags & ((0x00000002) | (0x00000004))) != ((0x00000002) | (0x00000004))",
        "1v1~1",
        "Microsoft Time-Stamp Service",
        "2'2C2_2~2",
        "7B8`8g8r8y8",
        "181P1",
        "mi-NZ",
        "505?5c5{5",
        "\\\\.\\?:",
        "TelemetryAssert",
        "j\\Yuj",
        "xaj&Y",
        "9#919:9?9D9J9N9U9[9g9r9w9}9",
        "/InstallDrivers",
        "SetupUI: Got a timer message",
        "868<8d8",
        "5(545@5L5X5d5p5|5",
        "ar-MA",
        "QPWSQQh",
        "http://www.w3.org/XML/1998/namespace",
        "9'9.9A9",
        ">\">,>1>;>@>N>X>b>l>v>",
        "RtlNtStatusToDosError",
        "EnableShortnamesOnApplyTarget",
        "%wNtE",
        "ml-IN",
        "9H:c:u:",
        "If-None-Match:",
        "nb-NO",
        "/Recovery",
        "WIMSetFileShortName",
        "8V8h8w8",
        "pHeader->ulTotalSize == m_MicrodomDataBlob.Length",
        ";:;L;h;z;",
        "f92u9A",
        ">@d>]*R",
        "lo-LA",
        "#document",
        "CSetupHost::SetMigrationInfo",
        "/baudrate",
        "CMicrodom_Blob",
        "es-BO",
        "Not-null check failed: Source",
        "9sTtr",
        "0B1N1g1",
        "?MdDlt",
        "CMicrodomBuilder::InsertDefaultAttributes",
        "QQQQj",
        "UCS-4",
        "ActivationBlockSkipped",
        "SetupUI: ShutdownBlockReasonCreate succeeded!",
        "[%hs]",
        "6h8N@",
        "setvbuf",
        ".CRT$XIY",
        "798@8H8O8W8^8{8",
        "NtQueryInformationProcess",
        "(d(e`",
        "><>y>",
        "Global\\Microsoft.Windows.Setup",
        "/Pkey",
        "=#='=,=8=A=F=L=U=[=_=d=n=w=|=",
        "RegCreateKeyExW",
        "PUBLIC",
        "CSetupHost::SetInstallPrivatesPath",
        "DuplicateHandle",
        "UnmapViewOfFile",
        "0 0w0",
        "OneSettings: AppVer [%s.%s.%s.%s]",
        "&{}K~[",
        "9 :+:2:T:V;];k;",
        "Cf9Y*",
        "az-Cyrl-AZ",
        "HeapSize",
        ";';-;2;8;<;A;K;P;V;_;e;j;p;t;y;",
        "uiG;}",
        "4<4F4^4e4t4",
        "2+2P2Z2o2z2",
        "9]\\WIFS",
        "<unknown>",
        "2,3X3",
        "=E=q=",
        "030E0l0~0",
        "de-CH",
        "SetupHost: Automation initialization failed: [0x%X]",
        "RtlReallocateLBlob",
        "sr-Latn",
        "Ctrl-Break: Exiting process...",
        "L$D_^[3",
        "PPSVS",
        "IsDebuggerPresent",
        "DownloadReqToggledtoExtStorageFlow",
        "3.5O6W6_6",
        "GetStdHandle",
        "SOFTWARE\\Microsoft\\SQMClient",
        "CMicrodomBuilder::ConsumeAttdef",
        "IsWebSetupCreatedMedia",
        "HeapWalk",
        "GetImageErrorCode",
        "? ?)?C?J?V?_?o?",
        "6IXYYXXAFC=:",
        "[gle=0x%.8x]",
        "8:8N8",
        "en-CA",
        "7'747\\7",
        "SystemPartitionFreeSpaceWinRe",
        "/RollbackUser",
        "CMicrodomBuilder::CFourStringIdTable<unsigned short>::Initialize",
        "Windows::uDom::Rtl::RtlMicrodomUpdateCreateElementNs",
        "ts-ZA",
        "GetSystemTime",
        "ImageDeployTime",
        "PowerClearRequest",
        "?%?*?1?g?w?~?",
        "CSystemHelper::CheckConnectedStandby",
        "<Q=v=",
        "Setup360Telemetry",
        "/FlightData",
        "OpenProcess",
        "UPDATEMEDIAMCTLINK",
        "u2G;}",
        "ConX::Setup::Common::COSInfoHelper::GetHostOSVersion",
        "[ybVhl",
        "899T9a9v9",
        "WebSetupInputMediaType",
        "Kernel-ProductInfo",
        "5@6P6]6",
        "t(j\\W",
        "TerminateProcess",
        "s$97t",
        "9@9M9",
        ".idata$5",
        "52595D5",
        "1!1)121:1C1M1_1g1",
        "ServerStandard",
        "4,6^6",
        "fr-029",
        ": :,:8:D:P:\\:h:t:",
        "9[9b9{9",
        "6#787S7~7",
        "tn-BW",
        "D$8SVW",
        "RtlTranscodeLBlobs",
        "SetupHost::Create inproc installation agent result: [0x%X]",
        "FileCount",
        "nodhcp",
        "4@4X4c4|4",
        "WindowsUpdateFailure",
        "CreatePath: Unable to create parent directory for [%s]; GLE = 0x%x",
        "/NoReboot",
        "TelemetryAssertDiagTrack",
        "/InstallFile",
        "PPPPj",
        "ExpandEnvironmentStringsW",
        "929l9",
        "CompatPollingTime",
        "=F=M=x=",
        "OneSettings: Blocked by policy settings.",
        "es-CL",
        "CompatFinalizeScanTime",
        "file corrupted in block at offset %p",
        ";)<><K<",
        "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\LOWPART",
        "ResNodesSort",
        "TTZfbO30$",
        "_purecall",
        "onecore\\base\\ntsetup\\panther\\wdslog\\setuplog.cpp",
        ">c?q?",
        "WIMCreateFile",
        "040904B0",
        ">:?j?q?",
        ";);/;?;\\;r;y;S<Z<",
        "Microsoft Time-Stamp Service0",
        "t;j#j",
        "hi-IN",
        "CSetupHost::GetDiagnosticToolPath",
        "Not-null check failed: MatchIndex",
        "SetupHost: Remapping early stage [0x%X] to [0x%X]",
        "HeapFree",
        ":D:i;p;b<",
        "GetVersionExA",
        "u6G;}",
        "sw-KE",
        "MicrodomImplementation::CMicrodom::IRtlMicrodom_Cast",
        "Total",
        "swscanf_s",
        "SetSecurityDescriptorDacl",
        "9.959_9",
        "WebSetupInputSelectedEdition",
        "+8`^r",
        "SetupHost: Reporting pending reboot event",
        "2\"373>3k3",
        "7;7M7i7{7",
        "D$ SVW",
        ".data$r$brc",
        "TlsGetValue",
        "8(9G9R9X9~9",
        "636@6M6g6r6",
        ".?AVISetupHost@@",
        "6<7\\7",
        "<\"<2<B<X<h<x<",
        "EXTERNALFREESPACEREQUIRED",
        "1B2[2b2",
        "SetupHost: Requesting SetupMgr resume...",
        "/PostOobe",
        "es-MX",
        "?A?e?",
        "; ;9;?;I;g;",
        "0K0R0",
        "CSystemHelper::CreateTrayIcon",
        "0x%08X",
        "Redmond1",
        "DequeueWimData",
        " Setup360DynamicUpdate",
        "ReadWimHeader",
        "kok-IN",
        "fr-CA",
        "Tel#Asmv",
        "?E?M?",
        "DOCTYPE",
        "ChunkWriterFlush",
        "D$ h$",
        "8O9a:",
        "LockFileEx",
        "2.2=2_2m2{2",
        "<*=:=G=p=",
        "0,0C0x0",
        "ole32.dll",
        "1&2D2u3{3",
        "1n2z2",
        "Target OS version: %u.%u.%u.%u",
        "SetupHost::Initialize: Flags                  = [0x%X]",
        "CSetupHost::ReportEventW",
        "Msg:[%ws] ",
        "DebuggerOptionsTime",
        "SSh @",
        "SetupHost: Unable to copy failure logs - [0x%X]",
        "ENTITIES",
        "cy-GB",
        "9%9)90959?9J9O9T9Y9^9d9h9m9w9|9",
        "wcstok_s",
        "t$X9u t",
        "j\\Yf;",
        "CSystemHelper::ThreadExecute",
        "/ClientId",
        "UpdateMediaDownloadResult",
        "am-ET",
        ";,;m;y;",
        "gn-PY",
        "SetupHost: Using decryption key from registry.",
        "QPhhb@",
        "                type=\"win32\"",
        ".?AV?$CDlpWimInfoT@V?$CUnknownImpl@UIUnknown@@@@@@",
        ":#:+:",
        "(Properties.Elements != 0) && (Results.Elements != 0)",
        "D$4_^[",
        "UnregisterClassA",
        "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8",
        "GetWindowsDirectoryA",
        "yi-001",
        "INVALID_DISPOSITION",
        "hy-AM",
        "<rs:data>",
        "BUCL::Rtl::Add(cbReturnSize, cbThisSize, cbReturnSize)",
        "<xml xmlns:s=\"uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882\"",
        "%MB=:4",
        "3!333O3a3~3",
        "j8hP*I",
        "RtlDosPathNameToNtPathName_U",
        ",+&#0",
        "CSetupDiagnostics: Tracing Data [STRING] -> [%s]=[%s] [%s][%s][%s][0x%X]",
        "OneSettings: ScenarioId [%s]",
        "SetupCleanupTask",
        "WinHttpQueryAuthSchemes",
        "5<LuP",
        ".?AVIDlpDiagnostics@@",
        "292X2n2u2",
        "TargetOsAllowPartitionChanges",
        "9%9E9_9",
        "MOUPG",
        "D$dPS",
        "SYSPRP",
        ".?AV?$CZeroInit@VCSystemHelper@@$00@@",
        "MapViewOfFile",
        "353\\3",
        "t`Phh",
        "8#8(8.83898B8G8M8Q8[8`8f8k8r8y8",
        "SetupHost.exe",
        "GlobalUnlock",
        "UncompressFile failed",
        "1$2(20282P2",
        "pDoctype->ulSignature == ('tDdM')",
        "MicrodomImplementation::CreateBinaryMicrodomFromXml",
        "%u.%u.%s",
        "RtlXmlDefaultCompareStrings(&m_State.ParseState, Left, Right, pResult)",
        ";]<T>",
        "OSPartitionDownloadReqSpaceFreedByCleanupTask",
        "EulaTime",
        "4I4d4p4{4",
        "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a",
        ":k:|:",
        "NewEntityDecl = this->AllocateStreamObject()",
        "SetupHost: Reporting external storage location for download to WU [%s]",
        ">&>->_>",
        "5M6]6q6}6",
        "MicrodomImplementation::CMicrodom::GetElementNodeSet",
        "SetupUI::Uninitialize - UnblockShutdown failed: [0x%X]",
        "DosDateTimeToFileTime",
        ":-;4;",
        "OSPartitionInstallReqSpaceFreedByStorageCleanup",
        "0'1D1K1",
        "4,4H4d4",
        "RtlCompareEncodedLBlobs",
        "$SVWh",
        "zu-ZA",
        "<)=3=i=u=",
        "WIMCopyFileEx failed",
        "m_AttdefListTable.Initialize()",
        ">.>5>",
        "ur-PK",
        "WTSFreeMemory",
        "L$<_^[3",
        "nl^w!",
        "ar-EG",
        "m_StoredTable.FindOrInsertIfNotPresent(Pair, pAttDef)",
        ",SVW3",
        "CSetupDiagnostics: Tracing Data [CUSTOM] -> [%s] -> [%s][%s][%s][%s][0x%X]",
        ".xdata$x",
        "SetupHost: Unable to check for server media. [0x%X]",
        "Global\\Microsoft.Windows.Setup.Cleanup",
        "fr-SN",
        "en-ZW",
        "SYSTEM\\Setup\\MoSetup",
        "xM9sdtF",
        "_vscwprintf",
        "Incorrect filesize. Could be corrupted",
        "<&=Q=l=",
        "Microsoft Corporation1",
        "\\VarFileInfo\\Translation",
        "D$@j(P3",
        "2`2g2q2",
        "HomePremiumN",
        "en-AE",
        "            <assemblyIdentity",
        "Not-null check failed: Context",
        "sprintf_s",
        "3m5x5",
        "OneSettings: InstallationType [%s]",
        "Not-null check failed: Matches",
        "StringFileInfo",
        "1\"2P2b2",
        "N0L0J",
        "SourceOsMinorVersion",
        "r~akow",
        "ja-JP",
        "Rollback",
        "ugG;}",
        "busparams=",
        "BUCL::Rtl::Increment(m_NextStringId)",
        "SetupHost.pdb",
        "hexBinary",
        "j\"[f;",
        "iswctype",
        "7$737@7]7",
        "CMicrodomUpdateContext::GetNodeUpdatePtr",
        "EtwEventWrite",
        "9s8uh",
        "        </dependentAssembly>",
        "Server Core",
        "::RtlIsLBlobValid(Blob)",
        "Blocked",
        "ExtDriveDownloadReqFreeSpace",
        "0;0z0",
        "9~pt*",
        "RtlWriteMicrodomXml",
        ".?AVCIlKernel32@@",
        "%windir%\\logs\\SetupDiag",
        ":(;4;;;",
        "|%s|%d|%I64d",
        "tOf97tJh",
        "GetComputerNameExW",
        "t)j\\V",
        "WinHttpReadData",
        "iu-Latn",
        "tzm-Tfng-MA",
        "/Console",
        "t9f91t4",
        ";3rU;",
        "xxxxh",
        "Software\\Policies\\Microsoft\\Windows\\DataCollection",
        "settings/v2.0/%ls/%ls",
        "%ls\\%ls\\%ls\\%ls",
        "EnumeratePathEx: Failed search path is >= MAX_PATH!",
        "PKeyGatherOSStateExitCode",
        "IDREF",
        "SetupUI: Got a message from Store",
        " Setup360OneSettings",
        ":%;8;N;];",
        "::RtlXmlExtentToUtf8String( 0, &m_State.ParseState.RawTokenState, &Src, TempString.GetMutablePointer(), &cRequired)",
        "SourceOsBuildNumber",
        "ka-GE",
        "WIM\\IMAGE[*]\\TOTALBYTES",
        "AllocateReadChunk",
        "(Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::Stream) || (Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::BlobProvider) || (Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::Blob)",
        "0@1G1N2U2",
        "@'*'%#",
        "Not-null check failed: BytesRequired",
        "='=4=Q=[=",
        "DbgPrintEx",
        "2B3I3W3B4I4W4",
        ";$<<<v<",
        "SetupHost: External Download %s [0x%X]",
        "L$t_^[3",
        "?:?N?U?",
        ".?AUIKernel32Interface@@",
        "8U8a8h8t8",
        "RtlCopyLUtf8StringToLUnicodeString",
        "ckh_YS",
        "~(9~0t",
        "121W1u1",
        "70787X7d7",
        "L$$RP",
        "%Microsoft Windows Production PCA 2011",
        "Windows::Rtl::CRtlObjectTypeDescription<class MicrodomWriterImplementation::CMicrodomWriter>::CreateInstance",
        "WdsVectoredExceptionHandler",
        "CMicrodomBuilder::CNamespaceNamePrefixToAttDef::Find",
        ";4;8;D;d;l;t;",
        "SetupHost: Tracing post reboot success event",
        "QSVWj\\",
        ";0;<;j;s;",
        "=L9o<",
        "cs-CZ",
        "Ctrl-C: Requesting cancellation...",
        "SetupVersionBuildNumber",
        "            <supportedOS Id=\"{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}\"/>",
        ".text$x",
        "GUARD_PAGE",
        "ScanOnly",
        "ff-Latn-SN",
        "Whps@",
        "?e?v?",
        "setupcomplete.cmd",
        "t#VSj",
        "count",
        "GetLocaleInfoW",
        "tk-TM",
        "%hs: Failed to read 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber'. Error = %d",
        "DeletePath: [%s] doesn't exist as a directory; nothing to delete.",
        "CSystemHelper::SetMessage",
        "onecore\\base\\lstring\\lutf8_string.cpp",
        "SetupHost::EulaFile path: [%s]",
        "fi-FI",
        "CSystemHelper::HideTrayIcon",
        "tzm-Tfng",
        "LogGlobalFilter",
        "CBasicNodeType::ChangeName",
        "WimAtExitInitialize",
        "LoadImageW",
        ",KQmc9DrtS6p6EP1P1qenrXDlLgwdskz6ROdG1FIPk7s=0Z",
        "SetupHost: Using Diagnostic tool: [%s]",
        "SetupMediaDriveType",
        "Reserved.PlatformSigned",
        "BUCL::Rtl::Add(pCachedInfo->m_ulChildCount, pCachedInfo->m_ulAttributeCount, cNecessary)",
        "%-21S %-6S %S",
        "g G~3",
        "nn-NO",
        "CXmlCursor::CompareExtents",
        "9F sN",
        "1f;2u",
        "0#080f0",
        "CSetupHost::SetRollbackContext",
        "RtlAppendLUtf8StringToLUtf8String",
        "hostip=",
        "NewChild->Attribute.Allocate()",
        "es-HN",
        "failed to extract file from reference extension",
        "policymanager.dll",
        "CMicrodomBuilder::ConsumePCData",
        "VarFileInfo",
        "fmalloc failed",
        "9z:};",
        "ar-DZ",
        "SetupNotify::ReportEvent - Report ID or Event Reporter not available.",
        "</xml>",
        "CXmlNamespaceManager::Initialize",
        "bg-BG",
        "@(97u",
        "4J4T4n4t4",
        " PreDownloadQuiet",
        "1(141@1L1X1d1p1|1",
        "4Y5k5",
        "CSetupHost::InitializeComponents",
        "ActivationGatherOSStateExitCode",
        "PANTHR",
        "DeleteCriticalSection",
        "ibb-NG",
        "IDATx",
        "QSVWj2^",
        "Available",
        "0W0h0",
        "=6===N=U=",
        "ca-ES-valencia",
        "memmove",
        "<la@ ",
        "-F%11S({",
        "AdjustTokenPrivileges",
        "SetupHost: Unable to copy Rollback logs - [0x%X]",
        "<WIM><TOTALBYTES>0</TOTALBYTES></WIM>",
        "pToInsertInto->Element != 0",
        "?F?V?p?w?",
        "RtlXmlInitializeNextLogicalThing(this, &Init)",
        "CMicrodomUpdateContext::CreateVirtualAttribute",
        "SPSh?",
        "9_Tt\"",
        "3%3.33393>3D3H3M3W3`3f3k3q3u3z3",
        "u+j_Xf;",
        "encoding",
        "WimAtExitReserve",
        "pa-Arab",
        "4$4<4@4`4|4",
        "SetupHost: Diagnostic tool execution result: [0x%X]",
        "Failed to get img event",
        "5C5h5z5",
        "SetupUI: Creating tray icon...",
        "3#4=4C4",
        "ConfigureTelemetryOptInSettingsUx",
        "9!9^9",
        "HostOsEditionId",
        "n &JB",
        "#wXsA",
        "D$0PQ",
        "B~s>w",
        "SVWj@3",
        "CSetupDiagnostics: TraceOneSettingsEvent -> [0x%X][%d][%s][%s][%s][%s][%s][%s][0x%X]",
        "4 5+5",
        "OneSettings: Branch [%s]",
        "quz-PE",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteText",
        "TargetOsEditionId",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetXml",
        "ig-NG",
        "strchr",
        "<!<B<I<c<j<",
        "QQVWj",
        "0;1H1Y1g1",
        "_exit",
        "3(3-33383>3B3G3S3^3c3i3n3t3x3}3",
        "HeapReAlloc",
        "UnlockFileEx",
        "ObjectHeader->uElementType == ucObjectType",
        "NoDrivers",
        ":J;P;V;];d;m;",
        "D$,haA",
        "+|'T*",
        "NewContext.Allocate()",
        "j Yf;",
        "9{Dt)",
        "5 5/5:5`5{5",
        "CSystemHelper::ShowBalloon",
        " %S=\"",
        "EnumeratePathEx: Unable to get reparse tag for persistent reparse point; GLE = 0x%x",
        "es-SV",
        "%hs: Registry value 'CSDBuildNumber' is not the correct type (REG_SZ).",
        "fr-CD",
        "\\Users",
        "RtlXmlDetermineStreamEncoding(&TokenizerState, &EncodingLength)",
        "/unattend",
        "SetupHost: GetSecurityData succeeded!",
        "VirtualQuery",
        "SourcesFolderTaggedAsHardReserve",
        "Fail to read WIM header",
        "t$(VW",
        ";*;1;W;d;k;",
        "DiskSpaceDownloadReqBlocked",
        "onecore\\base\\ntsetup\\panther\\engine\\bb.cpp",
        "SetupUI: Posting Quit Message...",
        "SetupHost::Initialize",
        "CSetupHost::CreatePostRebootArgs",
        "DeleteFileEx: Unable to remove [%s]; GLE = 0x%x",
        "r%windir%\\system32\\dbghelp.dll",
        "BCryptCloseAlgorithmProvider",
        "22393",
        "6(6w6~6",
        "%wLtC",
        ";!;';5;>;I;P;b;h;n;t;z;",
        "CSetupHost::SetCachedFileNames",
        "msvcrt.dll",
        "9~:<<",
        ":%:U:i:",
        "=)=5=A=J=Y=c=",
        "<$=+=w=~=",
        "DownloadReqSysDriveReqSatisfied",
        ".?AV?$CZeroInit@VCSetupHost@@$00@@",
        "WebSetupInputUpgradeNow",
        "z|M5u2",
        "FALSE",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetItem",
        "GetCurrentThreadId",
        "0^0h0p0",
        "/MigRollback",
        "MoveFileExW",
        "DUImageTotalDrivers",
        "t#hxoI",
        "        </application>",
        "gsw-FR",
        "tdj;^",
        "93:l:",
        "AdvertiseTime",
        "sma-NO",
        ";b;x;",
        "iswspace",
        "RtlpGenericMicrodomUpdateGetCookieForExistingThing",
        "t\"j:V",
        "quc-Latn",
        "::RtlIsLBlobValid(Source)",
        "FreeLibrary",
        "memmove_s",
        "`.data",
        "POSTUPGRADEFREESPACEPERCENTAGE",
        "324S4Z4",
        "SetupMgr.dll",
        ":P:i:",
        "ELEMENT",
        "en-HK",
        ">%>*>/>5>>>D>H>M>W>b>k>t>y>",
        "RtlInitializeSmartLBlobWritingContext",
        "ReturnHr",
        "I_RpcMapWin32Status",
        "5/545C5r5y5",
        "SetupHost: Initializing automation...",
        "576D6f6l6",
        "ReadChunk",
        "onecore\\base\\xml\\udom_modify.cpp",
        "DUSetupTime",
        "343B3h3",
        "WebSetupInputDefaultLang",
        "uBWj$3",
        "/InstallFOD",
        "%systemdrive%\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WSUS\\SetupConfig.ini",
        "ChunkWriterEnqueue",
        "    <compatibility xmlns=\"urn:schemas-microsoft-com:compatibility.v1\">",
        "sd-Arab",
        "6!6,6_6i6",
        "CreateSetupObject",
        "!E\\H4",
        "=J>b>s>",
        "DUImageDownloadedDrivers",
        "nOa-Q",
        "bcrypt.dll",
        "9):P:a:",
        "/CopyLogs",
        "CmdLine",
        "ObjectCookie.Opaque != 0",
        "FltCommStubCreateChild",
        "NewElement = this->AllocateStreamObject()",
        "L$(@;E",
        "DigitalProductId4",
        "RtlIsLBlobValid(BinaryData)",
        "/ExpressPackage",
        ";I;W;^;",
        "SetupNotify::ReportEvent - ReportSetupEvent [%s,0x%X,0x%X,0x%X,0x%X]",
        "7'7@7`7n7",
        "InstallReqLearnMoreLinkClicked",
        "OSPartitionDownloadReqRequiredSpace",
        "=+>Y>",
        "<)<M<d<",
        "<s:datatype dt:type=\"%s\"/>",
        "6\"6(61676;6@6J6S6X6]6c6g6n6t6y6",
        "km-KH",
        "Parallel chunk decode queue empty; switching to synchronous decode",
        "UuidFromStringW",
        "/PostRollback",
        "ulWhich < TheMap->Length",
        "ulIndex < m_Header->ulTotalNodeCount",
        ".CRT$XCA",
        "BCryptOpenAlgorithmProvider",
        "767R7",
        "Log: Failed To Get Msg From ID",
        "GetFileSizeEx",
        "686s6",
        "SetupHost: Error requesting SetupMgr pause: hr = [0x%X]",
        "<@<R<",
        "x}N_s",
        "CXmlLogicalState::Initialize",
        "7:7J7W7",
        ">1>Y>g>",
        "/Advertisement",
        "SetFilePointer",
        " xmlns:rs=\"urn:schemas-microsoft-com:rowset\"",
        "fr-MA",
        "SetupHost: Create WebSetup mutex for MCT UpgradeNow scenario.",
        "SetupHost::Initialize: ModulePath             = [%s]",
        "Qhx<A",
        "        </windowsSettings>",
        "or-IN",
        "3&454B4^4{4",
        "bucketArgument1",
        "RegisterTraceGuidsW",
        "ha-Latn-NG",
        "%s%-S(%S)",
        "SYSTEM\\CurrentControlSet\\Control\\MiniNT",
        "7!717;7Q7`7f7",
        "3c3k3",
        "/CompactOS",
        "=,=>=H=",
        "7\"828?8a8x8",
        "<!<'<,<2<6<;<G<P<V<[<`<f<j<p<z<",
        "2%282_2|2",
        "NewTearoff.Allocate()",
        "9\\$Lt",
        ".?AUIUnknown@@",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "pDomLayout->ulSignature == ('lDdM')",
        "XkZu=",
        "RegQueryInfoKeyW",
        "/Uninstall",
        "/SkipSummary",
        "CMoSetupOneSettingsHelperT<class CEmptyType>::GetSettingsValues",
        "Exception (code 0x%08X: %s) occurred at 0x%p in %s (+%p).  Minidump attached (%d bytes) to diagerr.xml and %s.",
        "CredReadW",
        "=)=Z=a=g=}=",
        "j:Xf;F",
        "dOSDATA\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection",
        "Not-null check failed: DocumentNode",
        " xmlns:z=\"#RowsetSchema\">",
        "Fail to flush file buffers",
        ".?AV?$CZeroInit@V?$CDlpAutoDelayLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@$00@@",
        "fgetws",
        "SourceOsLanguage",
        "RtlHashEncodedLBlob",
        "t+PPj",
        "Values",
        "99t$ t",
        "SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability",
        "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\utility.c",
        "D$<Pj",
        "5#5*5N5X5m5t5|5",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetMicrodomBinaryRepresentation",
        "PShhb@",
        "                name=\"Microsoft.Windows.Common-Controls\" version=\"6.0.0.0\"",
        "656B6N6r6",
        "NewChild->Comment.Allocate()",
        "9%8YWDQ",
        "D$8PS",
        "SLGetLicensingStatusInformation",
        "QPSVW",
        "sr-Cyrl-BA",
        "8 8$8<8@8H8`8d8h8l8t8",
        "708!9",
        "CSetupHost::SetPostInstallPaths",
        "?=?I?T?",
        "CoUninitialize",
        "RtlIsStateSeparationEnabled",
        "uNPPV",
        "RtlMatchLUtf8StringAgainstPointerList",
        "Assert",
        "MicrodomImplementation::CMicrodom::FindObject",
        "tt-RU",
        "DiskSpaceDownloadReqFixedDriveAutoSelected",
        "InternalName",
        "393@3U4\\4",
        "6F6S6Z6i6z6",
        "Microsoft Corporation1.0,",
        "Clean",
        "8M9T9k9",
        "SetupUI: Removing tray icon...",
        "OSPartitionInstallDiskSpaceReqWithoutReservesInfo",
        "Setup360Scenario",
        "=0=;=i={=",
        "9!:3:[:m:",
        "250701214655Z0|1",
        "SetupUpgradeAttempts",
        ";\";&;+;5;:;?;G;K;R;W;];e;q;w;};",
        ":-;3;i;",
        "ExtDriveInstallReqFreeSpace",
        ".~*N,",
        "GetVolumePathNameW",
        "%04d-%02d-%02d %02d:%02d:%02d",
        "0(141?1Z1",
        "/Download",
        "828>8I8g8~8",
        "*|&Q%",
        "/WaitForDebugger switch detected. Please attach a debugger to continue...",
        ">W@H;",
        "VerifyIntegrityChunk",
        "MitigationScenario",
        "bs-Latn",
        "97u4h0",
        "TC@KP",
        "u(G;}",
        "3\"3(343C3g3",
        "CSetupHost::TraceDiagnosticAnalysisResult",
        "5#505O5[5%6p6",
        "Not-null check failed: Params->Source.pIStream",
        "XPQSh",
        "Scripts",
        "NewChild.Allocate()",
        "TargetOsLanguage",
        "WindowsPE",
        "CSetupHost::GetScriptExecutionContext",
        "fr-FR",
        "</rs:data>",
        "platformEdition",
        "Translation",
        "RWVQPh",
        "2W2^2l2",
        "CSetupHost::CheckSetupMutex",
        "DecompressChunkedFile",
        "5!6Q6",
        "ve-ZA",
        ".tls$",
        "FACILITATORURL",
        "nl-BE",
        "::BUCL::Rtl::Add<SIZE_T>( *pcElements, 10, NewCapacity)",
        "tzm-Latn",
        "t$4t%S",
        "tr-TR",
        "fr-HT",
        "WimBufferToHexString",
        "7$74787H7L7d7h7",
        "3R4|4",
        "CloserElement = this->AllocateStreamObject()",
        "We were unable to clear the study id.[0x%X]",
        "mr-IN",
        "FormatMessageW",
        "TargetOsVersionMajor",
        "memcpy",
        "SetupHost: OneSettings initialization failed: [0x%X]",
        "3i4s4",
        "NoDriversNoLCU",
        "kernel32.dll",
        "GetModuleHandleW",
        "UnexpectedEvent",
        "stQVRW",
        "SetupHost::Create local server event reporter result: [0x%X]",
        "3$3-353F3T3\\3",
        "^##P#",
        "L$djo_",
        "<5=C=_=m=",
        ".CRT$XLZ",
        "xSSWhPfB",
        "    Host OS License State   [ UNAVAILABLE ]",
        "GetSystemInfo",
        "0#0'0,060A0F0L0Q0W0[0`0j0v0{0",
        "RRA'.l",
        "cannot read WIM header",
        "D$ X A",
        "WhpI@",
        "7/777e7",
        "aYd(z_C",
        "6}7,888?8",
        "4.5;5B5",
        "?a?~?",
        "#comment",
        "?=?R?Y?o?v?",
        "<#=-=S=",
        "MicrodomImplementation::CDomLayoutCache::FindObject",
        "gl-ES",
        "Ph<eA",
        "Windows::uDom::Rtl::RtlMicrodomUpdateSetNodeName",
        "7+737@7`7h7t7",
        "5,5E5{5",
        " http://www.microsoft.com/windows0",
        "WinHttpCloseHandle",
        "ulValue < MultFactor",
        "ReadData failed",
        "NewDocument = this->AllocateStreamObject()",
        "%-20S %-10S [0x%06x] %-6S %S",
        "GetTraceLoggerHandle",
        "7@7R7i7{7",
        "SetupUI: Modifying tray icon...",
        "%u/%u/%u",
        "WSWh@",
        "HQC!!",
        "%s %[^",
        "version",
        "CopyDirectoryFileCallback: The copy was canceled by the user.",
        "RegSetKeySecurity",
        "I~c4&",
        "DiskSpaceInstallReqExtDriveUsed",
        "SetupLog",
        "%s %s",
        "SetupHost: Error requesting SetupMgr cancel: hr = [0x%X]",
        ":9:l:",
        "SetupHost: Skipping diagnostic tool timing trace",
        " SVW3",
        "D$ QP",
        "6V6]6r6",
        "CSetupHost::SetAutomationResponseArgs",
        "WIM\\IMAGE",
        ">:?K?",
        "MicrodomImplementation::CMicrodom::GetNamedNodeMapItem",
        "AttachConsole",
        "ServerDatacenter",
        "CompressCaptureNode",
        "bs-Cyrl",
        "tzm-Arab-MA",
        "MicrodomImplementation::CMicrodom::Initialize",
        "5E7L7_7",
        "_open_osfhandle",
        "MediaSetupUIMgr.dll",
        "FLT_UNDERFLOW",
        "9#979>9W9",
        "Washington1",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteCData",
        "WakeAllConditionVariable",
        "TimeDiff",
        "4E5O5",
        "(Value == 0) || RtlIsLUtf8StringValid(Value)",
        "TempNodes.Allocate(UpperIndex - TheElement.Reserved)",
        "RRhlcA",
        "RtlIsLUtf8StringValid(TagName) || (TagName == 0)",
        "CSetupHost::SetRunRollbackScript",
        "False",
        "u5SSS",
        "OneSettings: Failed to update UBR: [0x%X]",
        "?!?=?c?s?z?",
        "Digital",
        "CompressChunk",
        "899E9P9m9",
        "@*97u",
        "4a5l5",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNSNode",
        "ReleaseMutex",
        "4e4l4",
        "CElementModification::ChangeTextValue",
        "SetupHost::Execute",
        "BUCL::Rtl::Add<SIZE_T>(DataLength, OldLength, TempSize)",
        "ShutdownBlockReasonDestroy",
        "Not-null check failed: String",
        "%ws\\%ws",
        "stRVQ",
        "909P9p9",
        "wcstoul",
        "8-8:8^8r8}8",
        "5!60676B6U6",
        "%ls\\%ls\\%ls",
        "RtlpSmartLBlobWritingContextResizePolicy",
        "SetConsoleCtrlHandler",
        "The existing WIM file became corrupted",
        "6`7q7",
        "fr-MC",
        "(NamespaceURI == 0) || RtlIsLUtf8StringValid(NamespaceURI)",
        "t$Vhp",
        "OneSettings: Failed to get UBR: [0x%X]",
        "SetupNotify::Remapping disk full error [0x%X] -> [0x%X]",
        "ProfessionalN",
        "PostRebootInstall",
        "SetupUI: ShutdownBlockReasonCreate failed! Error: 0x%X",
        "GetHandleInformation",
        "<%<9<F<d<q<{<",
        "WIM\\IMAGE[*]\\HARDLINKBYTES",
        "GetModuleHandleExW",
        "919@9M9g9",
        ".tls$ZZZ",
        "f;D$(t)S",
        "t$j\\Q",
        "PoolHeader->Signature == ('pSdM')",
        "9\\$,t",
        "9g9q9",
        "1&181G1Y1",
        ":.;R;X;v;",
        "                language=\"*\"",
        "te-IN",
        "7!7%7*747=7B7G7M7V7\\7`7e7q7z7",
        "CompatSysReqScanTime",
        "AboveNormal",
        "L$\\_^[3",
        "header version mismatch",
        "FileDescription",
        "5P6_6",
        "; hash = ",
        "SetupHost: Setup build version is: %s",
        "RtlIsLUtf8StringValid(LocalName) || (LocalName == 0)",
        "5(555y5",
        "5P6W6f6",
        "UPDATEMEDIASETUPVERSION",
        "SetupHost: Creating directory: [%s]",
        "f9XBt",
        "_XcptFilter",
        "2d3v3",
        "5\"5)5.545P5",
        "zupkfb^ZVSOLIEB@=:7520-+)&$\" ",
        "yo-NG",
        "9\":?:",
        "Not-null check failed: Params",
        ";%;1;B;o;",
        "ChangeWindowMessageFilterEx",
        "Setup StudyID was [%s]",
        "PolicyManager_GetPolicy",
        "ar-KW",
        "aK!.X)Y",
        "Log: Cannot convert ansi->unicode.",
        "GetSystemWindowsDirectoryW",
        "CSetupDiagnostics: Tracing Data [TIME] -> [%s] [%s][%s][%s][0x%X]",
        "Windows Setup activity log",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "F8PSj",
        "<!<&<,<7<=<A<F<P<[<`<f<o<u<y<~<",
        "GetFileInformationByHandle",
        "GlobalFree",
        "9M,tN",
        "r%*U$",
        "Unknown360",
        "4b5w5",
        ".idata$6",
        "2H3T3",
        "@&0_DM",
        "/Prompt",
        "8K9]9}9",
        "3#3*313?3i3",
        "9shu Q",
        "OSPartitionDownloadReqSpaceFreedByStorageCleanup",
        "4#4C4H4M4R4a4g4r4",
        "Setup360Result",
        "Downlevel",
        "031:1",
        "InstallTicks",
        "wcschr",
        "BuildLabEx",
        "WSVhp",
        "7s7}7",
        "3M4=5H5Y5`5k5",
        "/Drive",
        "5$54585<5@5D5H5L5P5X5\\5p5t5",
        "2#4N4",
        "PRIV_INSTRUCTION",
        "assertVersion",
        "7tl9V~",
        "D$0PS",
        " Finalize",
        "=0>S>a>r>z>",
        "CXmlCursor::XmlAlloc",
        "ShowWelcomeScreen",
        "9s v5",
        "CMoSetupOneSettingsHelperT<class CEmptyType>::AddSettingsAppVer",
        "CBasicNodeType::ChangeNamespacePrefix",
        "            <supportedOS Id=\"{1f676c76-80e1-4239-95bb-83d0f6d0da78}\"/>",
        "Wj(Q3",
        "FreeSid",
        "0-1115191=1A1E1I1M1Q1U1Y1]1a1e1",
        "8&8-898@8L8S8f8",
        "%s.%s.%s.%u.%s.%s.%s",
        "SaveOffset failed",
        "/RunRollbackScript",
        "\\$,VQP",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetNamedItemNs",
        "Not-null check failed: NewXmlStream",
        "ms-MY",
        "2#262w2",
        "OperationIndex",
        "ounknown",
        ".?AV?$CMoSetupUnknownImpl@VCSetupDiagnostics@@@@",
        "AllocChunkInfo",
        "Business",
        ";\";q;",
        "3r3w3",
        "/BitLocker",
        "99:n:z:",
        "<8<`=",
        "SetupHost: OneSettings Initialized -> [%s]",
        "RtlRaiseStatus",
        "BUCL::Rtl::QuickSort(Pairs, CompareStringSlot)",
        "%VF;+",
        "UuidCreate",
        "WimInitXmlInfo",
        "CustomRunTotalTime",
        ">>>D>]>d>s>z>",
        "0:1A1j1q1",
        "CreateFileA",
        "http://www.w3.org/2000/09/xmldsig#",
        ":%:0:=:W:m:z:",
        "/EnterpriseAttribution",
        ".rdata$zETW0",
        "SUPPRESS",
        "is-IS",
        "CompatBlockedCategories",
        "b:zGlABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",
        "UCS-2",
        "DiskSpaceInstallReqFixedDriveAutoSelected",
        "9*9@9W9",
        "Microsoft Corporation",
        ";(;b;j;",
        "BUCL::Rtl::Add<SIZE_T>( cbNecessary, Iter.Key.Length, sizeof(UCHAR), cbNecessary)",
        "Buh_[S",
        "7H8k8r8",
        "9L<*=",
        "SetupHost: Creating setup mutex...",
        "5;5M5",
        "K{m<KI",
        "SetupHost: Error requesting SetupMgr resume: hr = [0x%X]",
        "OperationName",
        "EA^Wp",
        "GlobalLock",
        "0=0U0",
        "6 6$6(6<6@6P6T6l6p6",
        ">)>1>7>",
        "dz-BT",
        "(KPK~~",
        "=$=,=4=<=D=L=d=h=x=",
        "STACK_OVERFLOW",
        "1%1,1`1",
        "~ f;F*sp",
        "= >*>?>F>`>x>",
        ";!;1;a;l;z;",
        "<=<[<u<",
        "RegQueryValueExW",
        "CompatSysGatedTime",
        "?w$tQ",
        "Media",
        "OSPartitionDownloadReqTotalSpace",
        "HostOsInstallationType",
        "ky-KG",
        "%d.%d.%d.%d",
        "dsb-DE",
        "pPQQj",
        "8'898?8a8v8",
        "9o9v9",
        "?=?h?",
        "GWVVP",
        "GetShortPathNameW",
        "SetupHost: Requesting SetupMgr cancel...",
        "c0j0x0",
        "MicrodomImplementation::CDomLayoutCache::AdvanceCachedPointer",
        "            <!--This Id value indicates the application supports Windows 8/Server 2012 functionality-->",
        "1 1/1>1K1X1e1",
        "617\\7",
        "212L2j2q2",
        "PolicyManager_FreeGetPolicyData",
        "{X_^[",
        "hostip",
        "MicrodomImplementation::CMicrodom::CreateInterface",
        "GetProcessHeap",
        "appver",
        "3 4Q4",
        "System",
        "EventProviderEnabled",
        "1'383R3c3y3",
        "DisableTelemetryOptInChangeNotification",
        "CMicrodomBuilder::EndAttlist",
        "LoadLibraryExW",
        "2H2y2",
        "__setusermatherr",
        "SetupUI: ShutdownBlockReasonDestroy succeeded!",
        "*Q`L]",
        "WTSAPI32.dll",
        "{{|||{xqokg_YS",
        "RtlInitializeGrowingList( this, sizeof(TStoredObject), m_ulElementsPerChunk, (PVOID)m_InternalBuffer, sizeof(m_InternalBuffer), Allocator )",
        "%sCore",
        "m_pTargetObject->IsNamedNodeMapValid(NodeMap)",
        "9{,u(h",
        "_errno",
        "SetEndOfFile",
        "839R9",
        "xh-ZA",
        ">3>C>J>",
        "D$PVP",
        "HostOsMajorVersion",
        "EtwEventRegister",
        "pt-PT",
        "2R3a3",
        "OsUninstall",
        "{|||{{qokg_[S",
        "WIMCommitImageChanges",
        "<@=O=\\=",
        "3 3,3L3X3x3",
        "wlPRQ",
        "243u3",
        "1)1;1g1y1",
        "DIAGER",
        "t2hXF@",
        "5)5/5?5D5\\5j5",
        "E0C1)0'",
        "SetupUI::BlockSystemSleep - CheckConnectedStandby failed: [0x%X]",
        "/LaunchSetupWithConfig",
        "            />",
        "/Auto",
        "jaYjz^j:Z",
        "010?0u0",
        "RegSetValueExW",
        "/DownloadSizeInMB",
        "OSPartitionDownloadReqFreeSpace",
        "wLP9^",
        "o\\#P\\",
        "0)0O0^0e0m0u0",
        "StringId < m_Entries.Length",
        "6+656",
        "5:5L5U5s5",
        "    </dependency>",
        "EtwEventEnabled",
        "j-Xf;",
        "TempNode != Windows::Microdom::Rtl::Node::InvalidValue()",
        "?(?8?H?X?h?x?",
        "TargetOsVersionBuildNumber",
        "m_MicrodomDataBlob.Length >= sizeof(MICRODOM_HEADER)",
        "amd64",
        "MicrodomImplementation::CStringpoolCache::AttachToStringPool",
        "L$,QP",
        "t VWP",
        "hSVW3",
        "\\lL\\q",
        "mt-MT",
        ":):6:d:n:",
        "<,<3<A<",
        "UD;UD",
        "Professional",
        "021A1N1j1t1",
        "202L2h2",
        "R!s4Z",
        "Source.Length >= 3",
        "3$303<3H3T3`3l3x3",
        ";%;7;D;",
        "1a2~2",
        "9X`v^j",
        "0'0-01060@0E0K0T0Z0c0i0m0r0{0",
        "5(545T5`5",
        "CMicrodomXmlWalker::XmlError",
        ".?AV?$CSetupObject@VCSystemHelper@@VISystemHelper@@@@",
        "PowerSetRequest",
        "9WHvQ",
        "InstallReqStorageCleanupTime",
        "Not-null check failed: Root",
        "DeletePath: Failed to obliterate [%s] (GLE = 0x%x); retrying...",
        "/PreOobe",
        "`V@Pj",
        "8P8b8}8",
        "OneSettingsVersion",
        "j<h@'I",
        "7$7*7<7h7u7|7b8~8",
        "CSetupHost::SetAutomationPaths",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNode",
        "ChPgI",
        "ar-SA",
        "GetTempPathW",
        "et-EE",
        "my-MM",
        "CSetupHost::InitializeOneSettings",
        "WideCharToMultiByte",
        "C;X`s",
        "\"Microsoft Window",
        "DIAGNOSTICANALYSISENABLED",
        "bo-CN",
        "?d?s?",
        ":$:0:4:8:<:@:D:P:\\:h:t:",
        "RegEnumKeyExW",
        "/~=sd",
        "<i<p<~<(=/===",
        "5%545;5",
        "9r4uC",
        "2%272H2W2^2o2v2",
        ".?AV?$CZeroInit@VCSetupDiagnostics@@$00@@",
        " UnexpectedEvent",
        "WaitForMultipleObjectsEx",
        "es-ES_tradnl",
        "tqShl",
        "GetWindowLongW",
        "setuperr.log",
        "DeleteFileEx: Unable to restore attributes on [%s]; GLE = 0x%x",
        "    Host OS Version         [ %d.%d.%d ]",
        "2=2H2V2",
        "^?42B`^GE@)q",
        "2$2)2/23282=2D2I2S2^2c2i2n2t2x2}2",
        "5!6,6w6",
        "bsearch",
        "CMicrodomBuilder::DetermineStringTableSize",
        "9\\$$v",
        "0\"1)1:1A1",
        "CSetupDiagnostics: ReportEventMitigationResult -> [0x%X][%d][%s][%d][%s][%d][%d][%d][%d][%s][%d][%I64u][%s][%s][%s][%s][0x%X]",
        "D$$PR",
        "2C2}2",
        ">$>t>{>",
        "CSetupHost::OnMCTUpgradeNow",
        "RtlDeleteResource",
        "<s:ElementType name=\"row\" content=\"eltOnly\" rs:updatable=\"true\">",
        "pToRemoveFrom != 0",
        "WTSEnumerateSessionsW",
        "%s:(%d)",
        "7p8w8",
        "ADVAPI32.dll",
        "tg-Cyrl",
        "md3rQ@",
        "1/1P1",
        "2h3o3",
        "%hs!%p: ",
        "j}Yf;",
        "EnterCriticalSection",
        "DefWindowProcW",
        "SetupHost: Attempting to initialize OneSettings values",
        "    Host OS License State   [ %s ]",
        "CMicrodomBuilder::Initialize",
        "settings",
        "C<j@WWj",
        "PKeySkipButtonClicked",
        "7*818@8G8T8[8r8y8",
        "EventUnregister",
        "DisableTelemetryOptInSettingsUx",
        "Failed to determine source edition type!  Error: [0x%X]",
        "t$ RP",
        "Sv5X2?",
        "FBf;E",
        "DebugFilter",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::BeginOpenElement",
        "<;<~<",
        "<a=p=",
        "pa-Arab-PK",
        "RtlReleaseResource",
        "WARNING",
        "\\$4YY",
        "CompatRecoveryReqTime",
        "sr-Latn-CS",
        "3,fTidTq ,>gEB;",
        ":':q:",
        "CMicrodomBuilder::StartAttlist",
        "Failed",
        "/MigXmlPath",
        "DUImageOptIn",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate",
        "fr-RE",
        "DOWNLOADFREESPACEREQUIRED",
        "(*m_State.ParseState.pfnCompareSpecialString)(&m_State.ParseState, Extent, &ss, pResult, 0)",
        ".?AVCDlpWimInfo@@",
        "1V1]1e1",
        "9S0vmR",
        "SetupHost: Diagnostic Analysis failed [0x%X]",
        "/usbdebug",
        "\" )S6636i",
        "SetupUI: Creating main window...",
        ".text$mn$01",
        "RtlDuplicateLBlob",
        "GetOverlappedResult",
        "CompatInstallReqTime",
        "m_StoredTable.Initialize()",
        "/Retail",
        "InstallReqToggledtoExtStorageFlow",
        "ConX::Setup::Common::COSInfoHelper::GetHostOSSKUInfo",
        "?+?a?",
        "%-20S %-21S %-6S %s",
        "061F1M1|1",
        "found",
        "refreshInterval",
        "7\"7'7,727;7A7E7J7T7[7`7f7p7v7z7",
        "(DynamicBuffer == 0) || (DynamicBuffer->Length == 0)",
        "1%1:1",
        "CBasicNodeType::EncodeLUtf8String",
        "RtlAllocateHeap",
        "7/777E7a7",
        "2K2U2z2",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::EmitAttribute",
        "|d-Vk",
        "QQSVW3",
        "Integer overflow after WriteData",
        "InstallModeFinalizeSkipped",
        "<s:AttributeType name=\"%S\" rs:number=\"%d\">",
        "1/0-0",
        ">->k>y>j?",
        "TargetOsImageIndex",
        ":)<v<",
        "t&f;E",
        "F0C;X",
        "MicrodomImplementation::CDomLayoutCache::DecodeElementCounts",
        "D$,WP",
        "NtClose",
        "4(5p5",
        "ta-LK",
        "System\\Setup\\MoSetup\\Volatile",
        "5'6?6F6W6h6",
        "4?5p5w5",
        "TlsSetValue",
        "CompatHardBlockedProviders",
        "%wOtF",
        "=+=I=j=",
        "CSetupHost::OnWorkingPathChanged",
        "CSystemHelper::SetSystemSleepBlockReason",
        "OneSettings: Initialization succeeded, but no values found.",
        "707<7\\7h7",
        "BUCL::Rtl::Add<SIZE_T>( sizeof(MICRODOM_HEADER), cbStringPoolSize, cbDomLayoutSize, cbPositionDataSize, cbDoctypeDataSize, cbRequiredSize)",
        "UuidToStringW",
        "NMTOKENS",
        "?&?-?",
        "SourceOsEditionId",
        "2!3D3o3",
        "false",
        "GetVolumeRootFromPath",
        "pToRemove != 0",
        "5>5E5v5",
        "7 787f7|7",
        "SVWj2",
        "_onexit",
        "G^{P&a",
        "\\\\?\\GlobalRoot",
        "PhxcA",
        "Server Workstation",
        "/Compact",
        ":QVEE",
        "CommandLineToArgvW",
        "busparams",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttribute",
        "2%2.282Y2a2h2r2",
        "NewSetupMigChoice",
        "CSetupHost::FreeWuSecurityInfo",
        "Temp = (PUCHAR)((*RtlAllocateStringRoutine)(Bytes))",
        "L$|_^[3",
        "SetupHost::Initialize: CmdLine                = [%s]",
        "Client Workstation",
        ".?AVISystemHelper@@",
        "Windows::uDom::Rtl::RtlDestroyMicrodomUpdateContext",
        "RtlGetVersion",
        "bucketArgument2",
        "wwwwwwwwwwwwwwwwp",
        "3<3C3",
        ";B<O<\\<y<",
        "DUCHANNELS_FLAG",
        "?%'**",
        "RtlCalculateUtf16StringLengthFromLUtf8String",
        "q@boA",
        "AddVectoredExceptionHandler",
        ">'>A>[>",
        "__wgetmainargs",
        ">p>w>",
        "WWWWV",
        "TestId",
        "!|$<9}",
        "h2;Q/",
        "SetupHost: Skipping OneSettings initialization for Azure Host",
        "CBasicNodeType::ForceValue",
        "t;f97t6",
        "TargetBranch",
        "Fkg_[",
        "DecompressChunkedFile failed",
        "SetupHost: Unable to configure diagnostics cleanup - [0x%X]",
        "/AzureHost",
        "TheNode != TheNode.InvalidValue()",
        "526@6\\6",
        "REQUIRED",
        "strtol",
        "~~{w{ok",
        "WebSetupDownloadTotalTime",
        "InitializeCriticalSectionAndSpinCount",
        "CreateWindowExW",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\OSUpgrade",
        "quz-BO",
        "eu-ES",
        "SystemTimeToTzSpecificLocalTime",
        "0m0w0",
        "bs-Cyrl-BA",
        "QQPQQQQQQQQ",
        "LegalCopyright",
        "debug.log",
        "3#4F4\\4",
        "0T1[1v1}1",
        ";';H;N;n;",
        "AppVer=%d.%d.%d.%d",
        "y}gg2i",
        "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "/MediaPath",
        "AlwaysSuspend",
        "NewCData = this->AllocateStreamObject()",
        "HeapCompact",
        "CSystemHelper::SetShutdownBlockReason",
        "%hs(%u)\\%hs!%p: ",
        "Y__^[",
        ".:<@^",
        ".idata$3",
        ":\";P;Y;q;z;",
        "tzm-Latn-DZ",
        "se-SE",
        "dateTime",
        "towlower",
        "626X6",
        "/MigNEO",
        ":':1:<:\\:b:w:~:",
        "GetWindowsDirectoryW",
        "424<4N4V4a4h4o4|4",
        "_A3DEc",
        "AzureDownlevel",
        "$`2X`F",
        "4a4r4}4",
        "DiskSpaceDownloadReqFUReservesTotalSpace",
        "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\HIGHPART",
        "M0K0I",
        "==>O>p>v>",
        "Value",
        "SetFileInformationByHandle",
        "2.2H2O2",
        "A previous StudyID was [%s]",
        "ReadWriteDataInternal",
        "\\CONOUT$",
        "CMicrodomUpdateContext::CreateVirtualElement",
        "GetFileVersionInfoSizeExW",
        "FindFirstChunk",
        "??1type_info@@UAE@XZ",
        "?;?K?X?p?",
        "qps-plocm",
        "NativeProcessorArchitecture",
        "PowerCreateRequest",
        "=%>R>",
        "1V2t2",
        "9L9[9",
        "|hK,_",
        "SOFTWARE\\Microsoft\\Sysprep",
        "{$VWP",
        "oo{|||{{wjkk_YS",
        "/busparams",
        "WWPRh",
        "/ActionListFile",
        "8<:C:U:\\:w:~:",
        "Host OS version: %u.%u.%u.%u %s (%hu.%hu) Platform 0x%X, SuiteMask 0x%hX, ProdType 0x%hX",
        "uz-Latn",
        "NewTempBytesRequired > TempBytesRequired",
        ":+:::",
        "EventRegister",
        "CMicrodomBuilder::EndElement",
        "SetupUI: Requesting ShutdownBlockReasonCreate...",
        "9\":.:O:[:|:",
        "ShPm@",
        "RegGetValueW",
        "SetupUI::Uninitialize - RemoveMainWindow failed: [0x%X]",
        "%systemdrive%\\$Windows.~BT\\Sources\\Panther",
        "CMoSetupOneSettingsHelperT<class CEmptyType>::InitializeSettings",
        "<$<0<<<H<T<`<l<x<",
        "FLT_INVALID_OPERATION",
        "u6VVhlcA",
        "=&=/=W=^=m=",
        "IBSLIB",
        "j+Xf;",
        "8+959@9Q9W9`9j9|9",
        "3'3-3",
        "6+7[7~7",
        "RtlConcatenateLUtf8Strings",
        ":+:K:V:d:}:",
        "            <supportedOS Id=\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\"/> ",
        ".rdata$zETW1",
        "UpgLayoutTime",
        "3!4T4i4z4",
        "Global\\Microsoft.Windows.Websetup",
        "__rv.UcsCharacter != (0xffffffff)",
        "253K3^3p3",
        "TempElements.Allocate(NewCapacity)",
        "GlobalSize",
        "SetupHost::Initialize: ActionListFilePath     = [%s]",
        "GetFileInformationByHandleEx",
        "NoSeverity",
        "sd-Arab-PK",
        "w~~xp",
        "1\"181H1X1h1x1",
        "4!5-585[5o5",
        "es-EC",
        "WVhXz@",
        "SetupNotify::Leaving well-known error [0x%X] as-is for WU/Store",
        "<-<F<h<o<|<",
        ":(:H:h:",
        "SetupHost: Detected existing setup mutex... exiting.",
        "8E9j9",
        "nso-ZA",
        "242H2O2W2d2",
        "RegOpenKeyExW",
        "u G;}",
        "1%1+1/141?1D1J1O1U1`1e1k1o1y1",
        "arm64",
        "    Host OS Build String    [ %s ]",
        "<\"=E=o=",
        "3F4M4",
        "GetLogicalDriveStringsW",
        "F4QQS",
        ".00cfg",
        "Not-null check failed: Length",
        "7:7P7",
        "D$L9A",
        "INT_DIVIDE_BY_ZERO",
        "CompatActionableScanTime",
        "CMicrodomBuilder::ProduceStringTable",
        "39HPt",
        "9:9L9{9",
        "he-IL",
        "ar-LY",
        "j?Yf;",
        "%s /%s %s",
        ":%;$=9=",
        "PSSSSSSh ",
        "F;w$r",
        "WinHttpOpenRequest",
        "6[6v6",
        "3(3@3",
        "CSystemHelper::UnblockSystemSleep",
        "WimStrDupe",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
        "HostOsCompact",
        "BrandingFormatString",
        "QueryParameters",
        "4#5R5g5t5",
        "GetCurrentThread",
        "%s=%s",
        "8#8f8l8}8",
        "ar-QA",
        "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>",
        "AddCaptureNodeToImage",
        "WIM\\IMAGE[*]\\CREATIONTIME\\LOWPART",
        ".data$brc",
        "Ath_[S",
        "CoCreateInstance",
        "HostOSBuildNumber",
        "EventWriteTransfer",
        "(NewPrefix == 0) || RtlIsLUtf8StringValid(NewPrefix)",
        "Microsoft Time-Stamp PCA 2010",
        "ujG;}",
        "6+6q6",
        "Fail to update WIM header",
        "D$(PQ",
        "DownloadReqCleanupTaskTime",
        "<program name unknown>",
        "sr-Cyrl",
        "0+050<0F0r0",
        "?M?z?",
        "9$9/9?9\\9f9p9z9",
        "Legal_Policy_Statement",
        "s4PPPPPPh",
        "646R6w6",
        "CSetupDiagnostics::LogString",
        "FindChunkForOffset",
        "3g4m4s4",
        "%s{%s}",
        "/preoobecmd",
        "ar-TN",
        "j,h0*I",
        "::RtlIsLBlobValid(Data)",
        "__CxxFrameHandler3",
        "_wcsnicmp",
        "4W4b4p4",
        "EnumeratePathEx: Unable to enumerate [%s]; GLE = 0x%x",
        "nl-NL",
        ">MdDtt",
        "1%2@2U2b2~2",
        "OneSettings: Ring [%s]",
        "uz-Latn-UZ",
        "pa-IN",
        "dv-MV",
        "<.<4<L<S<c<w<",
        "868=8",
        "umG;}",
        ">$>,>4><>D>L>T>\\>d>l>t>|>",
        "WinHttpQueryHeaders",
        "SetupNotify: A finalize was already requested. We should not clean up in this case so the other install can resume.",
        "=G>^>",
        "Exception",
        "?.?e?~?",
        "?V?h?",
        "4;4\\4c4",
        "UpdateMediaOptInDefaultValue",
        "8g<n<M>",
        "1(0&0",
        "ExecutableName: ",
        "4X5^5t5",
        "Fvk__",
        ">5><>M>t>",
        "            <!--This Id value indicates the application supports Windows Vista/Server 2008 functionality -->",
        "hsb-DE",
        "SetupConfig",
        "/1394debug",
        "SetTimer",
        "/Media",
        "?'?7?D?v?",
        "SetupUI: Logging EndSession [0x%X] notification...",
        "WriteData failed during NULL block copy",
        "MiniDumpWriteDump",
        ":9:E:P:i:",
        "3>3o3",
        "OSPartitionDownloadReqMinimumRequiredSpace",
        "?$?0?<?H?T?`?l?x?",
        "RtlIsLUtf8StringValid(Name)",
        ">I>f>l>",
        "/ConfigFile",
        "N!@|V",
        "SetupHost: Diagnostic Analysis timeout value: [%d] ms",
        "OSPartitionInstallReqSpaceFreedByCleanupTask",
        "xxwwx",
        "Windows::uDom::Rtl::RtlMicrodomUpdateCreateTextual",
        "InitializeSecurityDescriptor",
        "GetFinalPathNameByHandleW",
        "SetupHost: Unable to get info from install file. [0x%X]",
        "CheckTokenMembership",
        "LoadLibraryW",
        "SetUnhandledExceptionFilter",
        "D$@PW",
        ":#;B;s;",
        "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%",
        "> >@>\\>`>|>",
        "WIM\\IMAGE[*]\\WIMBOOT",
        "DATATYPE_MISALIGNMENT",
        "MicrodomImplementation::CDomPositionCache::GetLocation",
        "GetCommandLineW",
        "737:7",
        ":,:2:<:",
        "WimLayoutTime",
        "/debug",
        "/DynamicUpdate",
        "Failed to get img buf",
        "            </requestedPrivileges>",
        "DOWNLOADFREESPACEPADDING",
        "SetupUI: Creating power request...",
        "u.FAB;",
        "WinHttpGetProxyForUrl",
        "%w't%",
        "qu?Dh",
        "NONCONTINUABLE_EXCEPTION",
        "IsCharAlphaW",
        "PhXuA",
        "2%2A2H2T2[2b2r2",
        "191@1P1W1k1v1",
        "advapi32.dll",
        "onecore\\base\\xml\\udom_microdom.cpp",
        "SetupHost: Diagnostic Analysis not requested.",
        "LayoutISOTime",
        "arn-CL",
        "DequeueNextChunk",
        "OneSettings: OS [%s]",
        "TempNodes.Allocate(this->m_LayoutCache.TotalObjectCount())",
        "L$T_^[3",
        "appBuildLab",
        "Finalize",
        "SetupUI: Setting shutdown block message: [%s]",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::CloseElement",
        "CMoSetupOneSettingsHelperT<class CEmptyType>::AddSettingsStringParameter",
        "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection",
        "wH9\\$",
        "<!<,<5<J<W<_<j<",
        "Y4?L8M",
        "RtlXmlNextLogicalThing( &m_State, &m_Namespaces, &m_CurrentThing, &m_AttributeList )",
        "CompatBlockEncountered",
        "yoj@j",
        "upG;}",
        "20201009151940Z0w0=",
        ".WdsSetupLogInit",
        "%windir%\\Panther",
        "A4;F<t?",
        "6+686X6g6t6",
        "iu-Cans-CA",
        "\\$4Sj",
        "%s /%s",
        "334^4j4u4",
        "DebugFormatterAndDevice",
        "{<nLL",
        "0#0^0h0s0}0",
        "st-ZA",
        "this->m_PositionList.Allocate(LocationHeader->ulItemCount)",
        "OneSettings: Initialization succeeded, found %d values.",
        ".CRT$XIZ",
        "MicrodomImplementation::CDomLayoutCache::GetNodeChildren",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetNamedItem",
        "PANTHER_ENABLE_TELASSERT",
        "pToRemoveFrom->Element != 0",
        "1:1O1",
        "Global\\WdsSetupLogInit",
        "CompanyName",
        "MigratePackageRemovedFODRetrievalCount",
        "CXmlCursor::CompareStrings",
        "6\"686^6u7|7",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteProcessingInstruction",
        "575{5",
        "EditionId",
        "FLT_OVERFLOW",
        "Starter",
        "RtlIsLUtf8StringValid(ElementId)",
        "= =,=8=<=D=L=T=\\=d=l=x=",
        ">*>H>]>",
        "de-LU",
        "diagerr.mdmp",
        "D$hPW",
        "=b=h=",
        "0123456789abcdef",
        "CSetupHost::ExecuteDiagnosticAnalysis",
        "/Package",
        "http://www.w3.org/2000/xmlns/",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementNodeSet",
        "WinHttpSendRequest",
        "2f2k2r2x2",
        "<(=7=D=_=d=",
        "GlobalAlloc",
        "5O6q6",
        "?%p!Gn",
        "7 7,787D7P7\\7h7t7",
        "SetupHost: Reporting post reboot event failed: hr = [0x%X]",
        "CreateFileW",
        "SetupHost: Unable to copy Panther logs - [0x%X]",
        "SetFilePointerEx",
        "5 545W5g5{5",
        "/MeteredNetwork",
        "sk-SK",
        ";s s%k",
        "port=",
        "Shell_NotifyIconW",
        "onecore\\internal\\base\\inc\\rtl_object_library.h",
        "CSetupHost::LoadSetupObject",
        ".?AV?$CDlpAutoDelayLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@",
        "wcsrchr",
        "/Quiet",
        "ComplianceProviderBlockMessageIds",
        "SLC.DLL",
        "QQQPQ",
        "t$ 95PnI",
        "SetupPriority",
        ".text",
        "SetupUI: Detecting connected standby capability...",
        "CreateProcessW",
        ":MdSpt",
        "            <supportedOS Id=\"{35138b9a-5d96-4fbd-8e2d-a2440225f93a}\"/>",
        "80C0J0",
        "es-CO",
        "WIM\\IMAGE[*]\\WINDOWS\\EDITIONID",
        "en-PH",
        "LogSharingViolationErrorInfo",
        "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\">",
        "fr-CI",
        "?#?*?N?U?e?l?",
        "CopyDirectoryEx2: Specified directory [%s] doesn't exist",
        "NewAttribute = this->AllocateStreamObject()",
        "<(<=<C<i<",
        "0T0`0u0",
        "CSystemHelper::UnblockShutdown",
        "RtlAppendUcsCharacterToLUtf8String",
        "GetDiskFreeSpaceW",
        "No more than one flag set check failed: __e",
        "%-10S [0x%06x] %-6S %S",
        "ba-RU",
        "FLT_DENORMAL_OPERAND",
        "CSystemHelper::BlockShutdown",
        "9Kdt_",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNS",
        "N+@:81J",
        "0PQQj",
        "CSetupHost::Initialize",
        "Unstaged Image",
        ">x>~>",
        "Windows::uDom::Rtl::RtlMicrodomUpdateRemoveChild",
        "|$HSQ",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        ">1?H?",
        "/MigChoice",
        "Windows Setup error log",
        "SetupHost: Copying MoSetup log files from: [%s] -> [%s]...",
        "Not-null check failed: pOutputStream",
        "10.0.19041.572",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "IMPLIED",
        "pHeader->ulOffsetToPositionData < pHeader->ulTotalSize",
        "tn8^\\t",
        "SetupNotify::ReportEvent - Remapping extended data [0x%X] -> [0x%X] for testing mode.",
        "RtlReAllocateHeap",
        "Not-null check failed: fHasAttributes",
        "/Finalize",
        "tIWPd",
        ".?AVCSetupDiagnostics@@",
        "t$T+t$",
        "MicrodomImplementation::CMicrodom::GetNodeMapNamedItem",
        "IsWow64Process",
        "OSPartitionInstallReqFreeSpace",
        "SetErrorMode",
        "L$$_^[3",
        "ENABLED",
        "onecore\\base\\xml\\udom_xmlwalker.h",
        "SetupHost: Cleaning alternate storage path [%s] -> Result: [0x%X]",
        "LocationHeader->Signature == ('cLdM')",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementsByTagNameNS",
        "EventSetInformation",
        ".?AV?$CMoSetupUnknownImpl@VCSetupHost@@@@",
        "SWj`j",
        "=\"=4=M=_=x=",
        "646;6C6T6]6i6",
        "SetupUI::UnblockSystemSleep - Power request does not exist!",
        ":<:H:h:p:x:",
        "Ph<K@",
        "            <supportedOS Id=\"{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}\"/>",
        "SetupHost::Initialize: Scenario               = [0x%X]",
        "DownloadReqOpenDownloadsClicked",
        "Whhb@",
        "SetFileAttributesW",
        "co-FR",
        "WIM\\IMAGE[*]\\FILECOUNT",
        "dSVWjD3",
        "5\"535H5N5q5",
        "_vsnwprintf",
        ">*>7>>>",
        "AllowTelemetry",
        "SetupUI: Calling registered callback...",
        "CustomRunTimeout",
        "MIGUI",
        "(LocationHeader->ulFlags & ~((0x00000001) | (0x00000002) | (0x00000003))) == 0",
        "OneSettings: Sku [%s]",
        "5)6e6K7i7",
        "ConstructPartialMsgVW: MALLOC failed",
        "BUCL::Rtl::ConvertInteger(pObject->m_cChildren, pDocument->usChildNodes)",
        ".?AVIMitiDiagnostics@@",
        "InstallReqOpenRecycleBinClicked",
        "u(VSP",
        ":':4:@:l:z:",
        "GetVersionExW",
        "<!=C=c=i=",
        "rz9|$ |t",
        "AllowCommercialDataPipeline",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttributes",
        "QPRh8Q@",
        "OneSettings: Unexpected number of tokens in the build string: [%s]",
        "=\\>j>",
        "Setup360Mode",
        "TheDocument.Reserved == m_pTargetObject->m_LayoutCache.DocumentId()",
        "222R2d2",
        "Microsoft Corporation1200",
        "UpdateMediaSkipButtonClicked",
        ";$;J;\\;",
        "8$8,8K8",
        "OneSettings: EditionId [%s]",
        "CSystemHelper::ShowTrayIcon",
        "UpdateMediaNotSupported",
        "FatalError",
        "xxxxxp",
        "0,0P0T0X0d0",
        "&010?0",
        "TelemetryPermission-AllowDisable",
        ">&>0>J>V>a>u>",
        "/Success",
        "CreateUpgradeMedia",
        "Not-null check failed: Document",
        "/PostRollbackContext",
        "DisableDeviceDelete",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocumentElement",
        "HeapAlloc",
        "ar-JO",
        "WinHttpGetDefaultProxyConfiguration",
        "Dth_YS",
        "*************** SetupHost Logging Begin ***************",
        "WinHttpReceiveResponse",
        "SetupHost: Loading complete.",
        "SetupUI: Returning %s to QueryEndSession [0x%X] request...",
        "sr-Latn-ME",
        "Disable",
        "7/767a7k7",
        "061G1w1",
        "QueryPerformanceCounter",
        "WdsLogStructuredException",
        "(caller: %p) ",
        "~j\\XPW",
        "SleepConditionVariableSRW",
        "t)hXF@",
        "ug-CN",
        "9$9,949<9D9P9p9x9",
        "FlightData",
        "Not-null check failed: Data",
        "<M=)>H>",
        "CSetupHost::ModifyCommandLine",
        ":#;*;V;];",
        "AllowTelemetry_PolicyManager",
        ";+;8;J;m;t;",
        "th-TH",
        "sms-FI",
        "GetLocalTime",
        "<_=~=",
        "Package360",
        "?$?s?",
        "SetupNotify: Specifying extended data [0x%X] for error [0x%X].",
        "sd-Deva-IN",
        "SetupManager: Diagnostic Analysis Timeout [%d ms] via override.",
        ">(>8>H>X>h>x>",
        "50HkP",
        "818;8a8",
        "Not-null check failed: NodeList",
        "pt-BR",
        ".CRT$XCZ",
        "939f9y9",
        "__TlgCV__",
        "_FC;]",
        "WIM\\IMAGE[*]\\DIRCOUNT",
        "uaG;}",
        "ModuleCollection",
        "&quot;",
        "toupper",
        "INT_OVERFLOW",
        "en-029",
        "Not-null check failed: Value",
        "GetUserDefaultUILanguage",
        "3%383=3D3I3",
        "6b6x6",
        "CMicrodom",
        "3'3A3[3",
        "be-BY",
        "CSetupHost::IsDiagnosticAnalysisEnabled",
        "ne-IN",
        "VWj0SP",
        "6 6(61676=6C6M6X6]6b6g6m6u6{6",
        "OSPartitionInstallReqTotalSpace",
        ".?AV?$CSetupObject@VCSetupHost@@VISetupHost@@@@",
        "3 30343H3X3h3l3|3",
        "CreateEventW",
        "\\Program Files\\WindowsApps\\",
        "SetWindowTextW",
        "FLT_STACK_CHECK",
        "de-DE",
        "/MediaArch",
        "20201008074306.253Z0",
        "QVQPh0",
        "D$|PQ",
        "<F<R<]<",
        "WIM %s, offset %.8x%.8x, length %x",
        "DUImageSkippedDrivers",
        "HostOsArchitecture",
        "u.G;}",
        "D$d9C",
        "ti-ET",
        "es-419",
        "D$ Vh",
        "sa-IN",
        "10.0.19041.572 (vb_release_svc_prod1.201007-1724)",
        "GetLengthSid",
        "EncodingSizer != 0",
        "TZggvc+'",
        "Section",
        "*** Assertion failed: %s",
        "CXmlCursor::Next",
        "Not-null check failed: pUpdateCookie",
        ":[:f:",
        "1[2b2",
        ">%?B?",
        "GlobalMemoryStatus",
        "PKeyLocationsTried",
        "CSetupHost::OnSetupExiting",
        "=FB~G",
        ">&>@>O>\\>",
        "ERROR",
        "ar-SY",
        ";,;<;R;w;",
        "SetupHost: Diagnostic results location: [%s]",
        "FieldName",
        "D$,`+A",
        ";$;P;o;",
        "GetTimeZoneInformation",
        "?$?3?B?",
        "WebSetupInstanceId",
        ".text$yd",
        "CSetupHost::HasExternalDownloadStorageCapability",
        "WriteData failed",
        "%-20S %-21S [0x%06x] %s",
        "6c7m7",
        "MIGNEOENABLED",
        "TelemetryAssertList",
        ">F?M?",
        ".CRT$XIAA",
        "E$j$Z",
        "2)303E3\\3c3",
        "setupact.log",
        "quc-Latn-GT",
        "DeletePath: Cannot delete <null>.",
        "ar-YE",
        "SXYYXXIFB=:",
        "j0Yf+",
        "3B3P3",
        "3#3-383=3C3N3U3Y3^3h3o3u3~3",
        "SetupHost::Initialize: LoggingPath            = [%s]",
        " S}k6",
        "WdsRemoveDirectory: Unable to remove directory [%s]; GLE = 0x%x",
        "PRIORITYLEVEL",
        "=8=D=a=k=",
        "winbrand.dll",
        "ForceKeepActive",
        "97u\"3",
        "0-1@1Z1",
        "j\\Zf;Ty",
        "[06xm*.",
        "SetupUI: Setting main title: [%s]",
        "SetupHost: Successfully copied Panther folder!",
        "CMicrodomBuilder::AddString",
        "Ph jA",
        "PVVVVh",
        "6O6a6",
        "base\\ntsetup\\conx\\common\\setuplib\\src\\osinfo.cpp",
        "1/282",
        "Exception (code 0x%08X: %s) occurred at 0x%p in %s.",
        "Not-null check failed: pWriter",
        "NtCreateFile",
        "=#=(=-=2=8=<=B=L=W=\\=b=g=m=q=v=",
        "CBasicNodeType::ForceNameSetting",
        "DeleteFileW",
        "WinHttpGetIEProxyConfigForCurrentUser",
        "9.999^9m9z9",
        "5.6W6d6q6",
        "Count",
        "7?7\\7",
        "RtlXmlDestroyNextLogicalThing(this)",
        "DisableDiagnosticDataViewer",
        "u7G;}",
        "SetupHost: Reporting error event -> [0x%X, 0x%X]",
        "5 6@6",
        "GetTraceEnableFlags",
        "RtlAcquireResourceShared",
        "\"%s\" /Scenario:Upgrade /ZipLogs:False /Format:%s /Output:%s /RegPath:%s",
        "~||xp",
        "ReleaseSemaphore",
        "Unable to load global log filter.",
        ";\\<L=d=",
        "RtlXmlInitializeTokenization(&TokenizerState, &TokenizerInit)",
        "0!0e0",
        "pStringPool->Signature == ('pSdM')",
        "<0<8<D<d<l<t<",
        "TempTempElements.Allocate(NewCapacity)",
        "j.Zj0Xf;E",
        "?terminate@@YAXXZ",
        "RegCloseKey",
        "SACSetupErr",
        "Microsoft America Operations1&0$",
        "__set_app_type",
        "#Tn! {[",
        "@_^[]",
        "Not-null check failed: NewMicrodom",
        "9C9Q9X9",
        "tDh@F@",
        "$Windows.~LS",
        "ii-CN",
        "3*353P3",
        "?2?I?",
        "4:4F4Q4l4",
        "?:\\wdslog.inf",
        "><?q?",
        "QQSVWj",
        "CompressFileBackedByWim",
        "ro-RO",
        "%hs: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber' does not exist. Assume 0",
        "SetupUI: Got a message for session state change",
        "PPPPjdh$",
        ">->C>K>X>r>",
        "5\"5.5^5",
        "171>1",
        ";$;0;P;\\;|;",
        "===K=[=m=z=",
        "PKeyDownlevelInstallChannel",
        "FLT_DIVIDE_BY_ZERO",
        "Not-null check failed: PseudoKeyOut",
        "en-AU",
        "GetProcAddress",
        "636B6Z6",
        "FindClose",
        "2?2m2",
        "-0N0[0",
        "CMicrodomBuilder::CFourStringIdTable<struct _MICRODOM_XML_ATTDEF const *>::Initialize",
        "6-7G7N7",
        "InitializeCriticalSection",
        "/UpdateMedia",
        "8+8F8S8j8",
        "BCryptCreateHash",
        "We are exiting in Update Setup due to compat issues. We should not clean up in this case so we can resume.",
        "=a>s>~>",
        "Not-null check failed: pDocument",
        "SetupHost: Unexpected scenario - defaulting postoobe/rollback commands!",
        "Microsoft Corporation1&0$",
        "GetModuleFileNameW",
        "/SkipFinalize",
        "ResetEvent",
        "onecore\\base\\xml\\isolib_parser.h",
        "=$>+>",
        "CommandLines",
        "qps-ploc",
        "9'9G9r9",
        "8)9A9T9^9H:",
        "*ppvAlloc = RtlAllocateHeap((((PPEB)__readfsdword(((LONG)(LONG_PTR)&(((TEB *)0)->ProcessEnvironmentBlock))))->ProcessHeap), 0, cb)",
        "GetSystemDefaultUILanguage",
        "Not-null check failed: DataBlock",
        "8 909=9",
        "PostRollbackContext",
        "TelemetryPermission-DefaultLevel",
        "GetFileSize",
        "1=1\\1",
        "A~vbbS",
        "W93uH3",
        "ReleaseSRWLockExclusive",
        "Software\\Microsoft\\Windows NT\\CurrentVersion",
        "DEPLOY",
        "RtlAllocateLBlob",
        "<<<E<J<U<Z<u<",
        "9#90989A9J9f9s9",
        ".CRT$XCU",
        "CreateMutexW",
        "314t4",
        "SetupHostResult",
        "bs-Latn-BA",
        "]._g*",
        "%-20S %-21S %-6S %S",
        "~w~zz",
        "D$0SV",
        "\\O#]`",
        "5.5A5^5d5s5y5",
        "Integer overflow after ReadData",
        "9KdtL",
        "CMicrodomBuilder::ConsumeComment",
        "BUCL::Rtl::AddInPlaceWithOverflowCheck(&MaximumLength, Sources[i].Length)",
        "2+2>2",
        "%hs: couldn't get host edition id",
        "363Z3w3",
        "Warning",
        "D$$PQ",
        "::RtlIsLUtf8StringValid(Candidates[i])",
        "standalone",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementsByTagName",
        "_T^9_Xt&",
        "6H7u7",
        "zh-Hant",
        "RtlIsMicrodomUpdateContextValid(TheContext)",
        "/PauseId",
        "CMicrodomBuilder::CNamespaceNamePrefixToAttDef::Insert",
        "'XD}*",
        "6B7S7b7",
        "RtlGetCharacterSetDecoder",
        "JVVVS",
        "8M8f8",
        "EqualSid",
        "6D7u7",
        "HostOsProductType",
        ";%<<<",
        ":&:]:",
        "/Priority",
        "6#7e7|7",
        "t?h@F@",
        "UTF-16",
        "gd-GB",
        "m_StoredTable.FindOrInsertIfNotPresent(p, (USHORT)0, 0, &fExisted)",
        "Applicable",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::CTempOutputStream::CreateInterface",
        "1 1,181D1P1\\1h1t1",
        "8*8<8D8I8N8p8v8}8",
        "Recovery360",
        "::RtlIsLBlobValid(Destination)",
        ";$;4;;;H;O;V;",
        "WriteDataCallback",
        "0'040K0R0u0",
        "D$$;D$",
        "< <2<N<`<y<",
        "/Boot",
        "?V?]?k?",
        "OpenEventW",
        "SetupUI: Button click detected - calling registered callback...",
        "%s(%d): Result = 0x%X",
        "w8hxa@",
        ".?AV?$CSetupObject@VCSetupDiagnostics@@VISetupDiagnostics@@@@",
        "CoTaskMemFree",
        ".data",
        ".?AV?$CZeroInit@VCDlpWimInfo@@$00@@",
        "CSetupHost::OnAutoResume",
        "fFound",
        ";S s!k",
        "20R0y0",
        "UncompressFile",
        "405S5v5",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupDiag\\Results",
        "PhXSA",
        "8,999G9_9y9",
        "CSetupHost::SetDebuggerInfo",
        "/ClientId %s",
        "/DiagnosticAnalysis",
        "NOTATION",
        "HPWhTgA",
        "?&?8?N?`?}?",
        "FIXED",
        "6&6,60656>6D6I6N6T6]6c6g6l6v6{6",
        "ServerComputeCluster",
        "CSetupHost::GetWuSecurityInfo",
        " Windows",
        "3/464i4|4",
        "+RjjQ3",
        "t-j._f;9u",
        ";);q;",
        "p!c5Mf",
        "Euh_YS",
        ",f~|z[WP",
        "DispatchMessageW",
        "6S6^6l6",
        "5!5(545;5g5q5",
        "2K2c2",
        "es-US",
        "5#5'5,565A5F5L5Q5W5[5`5j5u5z5",
        "Pairs.Allocate(m_StringTable.GetEntryCount())",
        "Parameters",
        "CommandCount",
        "566A6H6",
        "WebSetupInputDefaultArch",
        "ShhT@",
        "Not-null check failed: ComparisonResult",
        "CustomCount",
        "_wfopen",
        "9+979A9M9|9",
        "*41;D$<s",
        "CharNextW",
        "RegDeleteValueW",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetPropertiesSetup",
        ">MdSpt",
        "jXhP-I",
        "RtlIsLUtf8StringValid(Source)",
        ":^;m;",
        "            <dpiAware xmlns=\"http://schemas.microsoft.com/SMI/2005/WindowsSettings\">true</dpiAware>",
        "99:@:F:L:l:q:",
        "DownloadReqExtDriveReqSatisfied",
        "es-AR",
        " PostRebootInstall",
        "InstallationType",
        "RtlAcquireResourceExclusive",
        "y/VhV",
        "SetupUI: ShutdownBlockReasonDestroy failed! Error: 0x%X",
        "Logs\\MoSetup",
        "rw-RW",
        "7=7D7",
        "wcsncmp",
        "BusinessN",
        "Cabinet.dll",
        "hu-HU",
        "LegacySetupInterrupt",
        "InstallReqOpenDownloadsClicked",
        "y)Vhy",
        "_cexit",
        "CSystemHelper::ExecuteAsync",
        "CSystemHelper::RemoveMainWindow",
        "RefreshAfter",
        ">8>y>",
        "                    level=\"asInvoker\"",
        "8!8&80878<8B8L8R8V8[8e8j8o8t8z8",
        "WIM\\IMAGE[*]\\WINDOWS\\INSTALLATIONTYPE",
        "616A6V6r6",
        "[ybVh",
        "<T<4=J=U=/>:>H>^>",
        "/Telemetry",
        "CMoSetupOneSettingsHelperT<class CEmptyType>::GetSettingAsBool",
        "DiagnosticAnalysisResult",
        "MultiLayoutTime",
        "haw-US",
        "**************** SetupHost Logging End ****************",
        "TargetOsServicePackBuildNumber",
        "Global\\SetupLog",
        "az-Cyrl",
        "DownlevelProductName",
        "header type/size mismatch",
        "<$</<7<U<`<",
        "6$6)606<6Q6",
        "CorrelationVector",
        "x8!D$",
        "3+353",
        "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7",
        "DiagPath",
        "CSetupDiagnostics: Tracing Data [DWORD] -> [%s]=[0x%X] [%s][%s][%s][0x%X]",
        "Not-null check failed: Decoder",
        "m_Entries.Allocate(PoolHeader->TotalCount)",
        "?)?9?F?`?r?",
        "Not-null check failed: fHasChildNodes",
        "7M9d<",
        "WinHttpOpen",
        "User is cancelling Media Setup on compat report. We should not clean up in this case so we can resume.",
        "TheEndElement = this->AllocateStreamObject()",
        "zh-Hans",
        ";\"<J<W<d<",
        "_^[+P",
        "CreateFileMappingW",
        "=6=d=",
        "originatingBinary",
        "SetupHost::Initialize: WorkingPath            = [%s]",
        "<R<c<",
        "SetupUI: Calling PowerClearRequest with type [0x%X]...",
        "SetupHost: Successfully copied MoSetup folder!",
        "Normal",
        "MachineId",
        "    Host OS Edition         [ %s ]",
        "ff-Latn-NG",
        "FreeConsole",
        "SetupHost: Unable to configure diagnostics cleanup [0x%X]",
        "    User UI Language Id     [ %d ]",
        "EnumeratePathEx: FindFirstFile failed for [%s]; GLE = 0x%x",
        "SLGetSLIDList",
        "strrchr",
        "Sleep",
        "203;3",
        "6,6E6L6",
        "EnumeratePathEx: Callback requested enumeration interruption or hit internal enumeration failure on [%s]; GLE = 0x%x",
        "tg-Cyrl-TJ",
        "zh-HK",
        "RegEnumValueW",
        "GetDirHardReserveStatusFailureOnSrcs",
        "6o7T8i8",
        "939b9m9",
        "9.:k:",
        "%-20S %-10S [0x%06x] %-6S %s",
        "020M0}0",
        "sr-Cyrl-CS",
        "Windows::Rtl::CRtlObjectTypeDescription<class MicrodomImplementation::CMicrodom>::CreateTearoff",
        "GetCurrentProcessId",
        " PreInstallUX",
        "LoadCursorW",
        "Sources",
        "&9q0u",
        "GetTraceEnableLevel",
        "VerQueryValueW",
        ";D;L;j;",
        "deviceId",
        "WdsCopyFileEx: Failed to delete %s. GLE = 0x%x",
        "(NewName == 0) || RtlIsLUtf8StringValid(NewName)",
        "ru-RU",
        "LocalFileTimeToFileTime",
        ";D$<s",
        "ResNodesLoad",
        "2/292I2X2",
        "Modern Setup Host",
        " || SourceName: ",
        "CSystemHelper::CreateMainWindow",
        "BCryptGetProperty",
        "8.878[8b8}8",
        "7L9~9",
        "SYSTEM\\Setup\\Panther",
        "lv-LV",
        "Status",
        "u+jKhLvA",
        "se-NO",
        "8r ,Y",
        "ks-Arab",
        "INVALID_HANDLE",
        ";(;4;@;L;X;d;p;|;",
        "br-FR",
        "BCryptDestroyHash",
        "229879+4583610",
        " || LogMessage: ",
        "%S(%d) : %S",
        "D$PSV",
        ".idata$4",
        "\\\\?\\UNC",
        "ga-IE",
        "SetupUI: Calling ShutdownBlockReasonCreate...",
        "3)3?3s3",
        "en-GB",
        "6,696N6",
        "SLClose",
        "RegisterClassW",
        "Not-null check failed: Target",
        "ks-Deva-IN",
        "bn-BD",
        "    <application xmlns=\"urn:schemas-microsoft-com:asm.v3\">",
        "SetupHost: Cleaning alternate storage paths failed: hr = [0x%X]",
        "CBlackboard::Close: %s.",
        "MicrodomImplementation::CMicrodom::GetElementById",
        "t;Sh0",
        "95\\oI",
        "HostOsWimBoot",
        "_gov{~~Q",
        "(SourceCount == 0) || (Sources != 0)",
        "898K8n8",
        "D2J5A",
        "CSystemHelper::SetTrayTitle",
        "SourceOsBuildQFE",
        ".?AVISetupDiagnostics@@",
        "CMicrodomBuilder::CElementNameToAttributeListTable::Find",
        "hr-BA",
        "2E2o2",
        "el-GR",
        "DeleteFileA",
        "w8hH`@",
        "NoLCU",
        "es-PR",
        "NtYieldExecution",
        "334M4S4[4u4{4",
        "CSetupHost::OnSetupFail",
        "Complete",
        "GetVolumePathNamesForVolumeNameW",
        "1\"2/2p2",
        "NtQueryInformationFile",
        "NDATA",
        "#,|6d",
        ".CRT$XIA",
        "MIGROLLBACKENABLED",
        "; ;';5;?;",
        "6/7X7",
        "DataSetting",
        "MigratePackageRemovedFODRetrievalStatus",
        "1.252T2_2v2",
        "HostOsBuildNumber",
        "tIVS3",
        "pap-029",
        "/FlightData %s",
        "5L5S5",
        "ko-KR",
        "5!5'5@5`5",
        "210303183038Z0p1",
        "::RtlIsLUtf8StringValid(String)",
        "zh-CN",
        "8G8l8",
        "TlsAlloc",
        "InitLZMSDecompression",
        "Error",
        "495J5O5",
        "757r7",
        "chr-Cher",
        "SetupCore.dll",
        "111019184142Z",
        "DecryptionKey",
        "GetCurrentDirectoryW",
        "CopyDirectoryEx2: Failed to copy [%s] to [%s], GLE = 0x%x; will retry in %u ms; am on try %u.",
        "=X>q>v>",
        "WebSetupTransport",
        "G QQVP",
        "<-<d<",
        "VirtualFree",
        "de-AT",
        "es-PE",
        "j]Yf;",
        "[F$d*",
        "</s:ElementType>",
        "es-PY",
        ":9:T:d:",
        "CreatePath: Unable to create [%s]; GLE = 0x%x",
        "Af;H(s",
        "FindFirstFileW",
        "4$4)43494=4B4L4Q4W4`4e4l4r4v4{4",
        "4_5d5i5s5x5}5",
        "DeletePathDirectoryCallback: Spoofing detected deleting [%s] -> [%s]",
        ".rdata",
        "D$pSVW",
        "'FC=P",
        "CSetupHost::TraceDiagnosticAnalysisStartTime",
        "%-10S [0x%06x] %-6S %s",
        ">\"?)?",
        "TargetOsInstallationType",
        "ProvTemp",
        " 9{Du5",
        "Params->fRequireUtf8",
        ";J=m=t=",
        "7\"7(787D7J7Q7Z7`7h7n7{7",
        "SetupUI: Requesting ShutdownBlockReasonDestroy...",
        "NtQueryLicenseValue",
        "SetupHost: Successfully copied Rollback folder!",
        "pToInsert != 0",
        ";D$4uV",
        ";B;W;",
        ".text$di",
        "/LaunchSetup",
        "I9/.]",
        "    <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\">",
        "6)6/686B6I6O6U6]6w6",
        "9.9?9N9Z9v9",
        "&apos;",
        ":\":&:7:;:C:G:M:Q:W:[:a:e:k:o:u:y:",
        "not found",
        "/ImageIndex",
        "eHomeEdition",
        "/PartnerID",
        "DeleteFileEx: hardlink given to us is: %s",
        "%S(%d) : ",
        "Client",
        ":b'^^!",
        "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\sync.c",
        "tXVWj",
        ".w.t,",
        "2I2Q2_2h2",
        "1^2d2",
        "OriginalFilename",
        "4S5k5",
        "UpgradeNow",
        "CMicrodomBuilder::CElementNameToAttributeListTable::MaybeInsert",
        "smj-SE",
        "quz-EC",
        "95XoI",
        "tWVPj",
        "default",
        "az-Latn",
        "%hs: couldn't get host product name",
        "CSystemHelper::GetShowUIMsgID",
        "se-FI",
        "Not-null check failed: Out",
        "Microsoft Corporation1%0#",
        "/NoAutoExit",
        ">\">P>b>}>",
        "2H2l2",
        "Undefined",
        "/DiagnosticPrompt",
        "0\"080H0X0h0x0",
        "ca-ES",
        "6>7P7",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteEscapedString",
        "WinHttpSetOption",
        "?0?:?",
        "ar-LB",
        "ur-IN",
        "pl-PL",
        "@.reloc",
        "WTSQueryUserToken",
        ">*>/>5>:>@>D>J>T>_>d>j>o>u>y>~>",
        "/ShowOobe",
        "moh-CA",
        "__rv.NewCursorValue != 0",
        "S,_^[",
        "\\\\?\\Volume{",
        "LogHr",
        "344T4Z4`4f4",
        "We are exiting in Media Setup due on compat report page. We should not clean up in this case so we can resume.",
        "9(:3:X:r:}:",
        ">5?M?",
        "TargetOsServicePackLevel",
        "Verbose",
        "bF-~cYZ",
        "j:Yf;",
        "%hs: Failed to open 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion'. Error = %d",
        "RtlFreeHeap",
        "UninstallReason",
        "7&8-8:8",
        "si-LK",
        "8 8(80888D8d8",
        "U0S0Q",
        "Windows::uDom::Rtl::RtlMicrodomUpdateSetNodeTextContent",
        "HomePremium",
        "CSystemHelper::BlockSystemSleep",
        "1n2u2",
        "E SVW",
        "DeleteFileEx: Unable to clear out attributes on [%s]; GLE = 0x%x",
        "StandardSetupLogFilter",
        "Trace",
        "            <!-- This Id value indicates the application supports Windows Threshold functionality-->            ",
        "5#5J5S5d5k5",
        "bin-NG",
        "NewChild->Element.Allocate()",
        "%WINDOWS_LONG%",
        "<unnamed>",
        "SetupHost: Skipping check for HasExternalDownloadStorageCapability.",
        " @H!BXo",
        "Isolationp::Parse::CTemplatizedStringIterator<struct _LUTF8_STRING>::Attach",
        "%-21S %-6S %s",
        "ShowWindow",
        "7r7z7",
        "t[VW3",
        "MicrodomImplementation::CMicrodom::GetElementsByTagName",
        "DownloadReqOpenRecycleBinClicked",
        "4.696G6",
        "fr-ML",
        "qsort",
        ">&>=>d>|>",
        "9$909<9H9T9`9l9x9",
        "88882200..",
        "DestinationMaximumLength >= SourceLength",
        "BREAKPOINT",
        "bn-IN",
        "DiskSpaceDownloadReqExtDriveUsed",
        "RtlReallocateLUtf8String",
        "93:@:M:U:b:",
        "8$8,848@8`8h8t8",
        "t4f97t",
        "WPh wA",
        "InitializeAcl",
        "<:<A<U<\\<z<",
        ":C;f;~;",
        "CSetupHost::SetDownloadSizeInMB",
        "RtlWriteDataIntoSmartLBlobWritingContext",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "DownloadReqLearnMoreLinkClicked",
        "tn-ZA",
        "prs-AF",
        "ru-MD",
        "7'8f8y8",
        "PrevStudyID",
        ".?AVISetupNotify@@",
        "0 131y1",
        "Update360",
        ">@.6Y",
        "tmj\\W",
        "6-747i7",
        "x/j\\Xf;E",
        "8P9_9",
        "97:F:r:{:",
        "PKeyLocationFound",
        "wprintf",
        "MicrodomImplementation::CMicrodom::GetNamedNodeMapLength",
        "<U<c<q<",
        "2 2D2L2T2\\2d2l2t2|2",
        "MultiByteToWideChar",
        "0&0/040:0C0I0M0R0\\0g0l0r0{0",
        "CRtlGrowingList<struct _XMLDOC_ATTRIBUTE,50,6>::Initialize",
        "en-NZ",
        "RevertToSelf",
        "1 1O1^1u1~1",
        "3%474`4r4",
        "9=`nI",
        "@.rsrc",
        "memcmp",
        "AddAccessAllowedAce",
        "az-Latn-AZ",
        "/ResizeRecoveryPartition",
        " AzureDownlevel",
        "chr-Cher-US",
        "4SVWj.",
        "Microsoft Time-Stamp PCA 20100",
        "/PreDownload",
        "ARRAY_BOUNDS_EXCEEDED",
        "sl-SI",
        "Not-null check failed: String2",
        "NtPowerInformation",
        "\\D~bx",
        "restored",
        "fr-BE",
        ":9;D;R;P<",
        "GetStartupInfoW",
        "D$tHP",
        "InstallReqExtDriveReqSatisfied",
        "TargetOsArchitecture",
        "ProductKeyEditionId",
        "6O6]6",
        "WinHttpQueryDataAvailable",
        "Decline",
        "DeleteFileEx: Spoofing detected deleting [%s] -> [%s]",
        "ACCESS_VIOLATION",
        "CopyDirectoryFileCallback: Unable to %s file from [%s] to [%s]; GLE = 0x%x",
        "::RtlIsLUtf8StringValid(Destination)",
        "CMicrodomBuilder::ConsumeEntityDecl",
        "9&909a9h9!:(:J:T:",
        "CBlackboard::~CBlackboard",
        "DefaultAttribute.Allocate()",
        "SetProcessPreferredUILanguages",
        "CreateMutexA",
        "VWj 3",
        "Azure360",
        "CSystemHelper::GetHWND",
        ".idata$2",
        "7#7)7/797C7K7P7V7\\7b7l7r7|7",
        "@\\jdPQ",
        "><>B>K>Z>d>",
        ";-;4;E;O;^;e;p;",
        "FH;A8",
        "SetupHost::Create IWUInstallationSession2 result: [0x%X]",
        ".CRT$XCL",
        "ObjectLength",
        "RtlIsLUtf8StringValid(LocalName)",
        "(NewNamespace == 0) || RtlIsLUtf8StringValid(NewNamespace)",
        ":\":(:.:3:F:X:t:",
        ":%:,:8:v:",
        "InitLZMSCompression",
        "SetupUI::Uninitialize - RemoveTrayIcon failed: [0x%X]",
        "ShowEula",
        "CreateMedia",
        "SSSPhd",
        "LeaveCriticalSection",
        "en-ZA",
        "GetEnvironmentVariableW",
        "<!=q=",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementById",
        "Windows::uDom::Rtl::RtlMicrodomUpdateCreateAttributeNs",
        "CMoSetupOneSettingsHelperT<class CEmptyType>::GetSettingAsString",
        "5(5/545:5H5N5R5W5a5f5k5p5v5",
        "MessageBoxTimeoutW",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttribute",
        ")`yJb",
        "8,8T8s8",
        "C(;C$",
        ".rdata$T$brc",
        "    <dependency>",
        ";';;;d;",
        "CSetupHost::SetPartnerID",
        "D$DPj",
        "HeapCreate",
        " AzureFinalize",
        ":3:O:_:n:",
        ";+<2<;<",
        "DiagnosticAnalysisStart",
        "CustomRunErrorGUID",
        "TmpNodes.Resize(cNecessary)",
        "ProductVersion",
        "=C>O>Z>",
        "WdsRemoveDirectory: Unable to prepare path [%s]; GLE = 0x%x",
        "GetVolumeInformationW",
        "NewInstance.Allocate()",
        "WinHttpConnect",
        "                />",
        "81989L9~9",
        "We are exiting in Setup because we do Compat Scan Only command line. We should clean up in this case.",
        "###  q",
        "DownlevelBuildNumber",
        "~~vkkg",
        "9H:U:",
        "NewProcessingInstruction = this->AllocateStreamObject()",
        "6!6,636:6e6",
        "CMoSetupOneSettingsHelperT<class CEmptyType>::AddQueryStringParameters",
        "SetupHost: GetSecurityData result: [0x%X].",
        "kn-IN",
        "VirtualAlloc",
        "WinHttpSetCredentials",
        "SetupHost: Diagnostic Analysis - START",
        "4!4=4^4",
        "CSetupHost::SetReportingInfo",
        "imageName",
        ":C;t;",
        "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9",
        "%wPtG",
        "=*>F>",
        "(FixedSizeBuffer != 0) || (DynamicBuffer != 0)",
        "Detected existing websetup mutex... exiting.",
        "<!=(=J=Q=",
        "2.252E2L2X2_2",
        "Root != Root.InvalidValue()",
        "Result",
        "/Tempdrive",
        "_wtof",
        "HeapDestroy",
        "=V=r=",
        "Wx\\x6",
        "en-ID",
        "%d-%02d-%02dT%02d:%02d:%02d",
        "RtlNsInitialize(this, Comparison, pvCompareContext, Alloc)",
        "0-1^1",
        "1C1m1",
        "::BUCL::Rtl::Add<SIZE_T>( cElements, 10, NewCapacity)",
        ";&<,<",
        "es.T#=\"",
        "CSetupDiagnostics: Tracing Data [CUSTOM] -> [%s] -> [%s][%s][%s][%s][%s][%s][%s][%d][%d][%d][0x%x][0x%X][%d]",
        "7h7}7",
        "5+565O5b5o5",
        "<unavailable>",
        "VWhlC",
        "VS_VERSION_INFO",
        "ms-BN",
        "808:8}8",
        "dCSDBuildNumber",
        "ar-IQ",
        "SetupUI: Button click detected - no registered callback.",
        "; <(<Q<`<",
        "3_^[]",
        "333a3r3",
        "tij:V",
        "        </security>",
        "1 1@1L1l1x1",
        "LocalAlloc",
        "uMG;}",
        "af-ZA",
        "3l4{4",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasChildNodes",
        "6h8M@",
        "OutputDebugStringW",
        "<7=B=\\=",
        "ScenarioId",
        "            <requestedPrivileges>",
        "2(242@2L2X2d2p2|2",
        "/Override",
        "DeleteFileEx: Unable to open [%s]; GLE = 0x%x",
        "sma-SE",
        "OLEAUT32.dll",
        "#?JPd",
        "CMicrodomBuilder::StartDocument",
        "UNINSTALLENABLED",
        ">$>/>6>y>",
        "O0M0K",
        "go{{|||~H",
        "UPDATEMEDIAENABLED",
        "Requesting full cleanup.",
        "\\StringFileInfo\\%04X%04X\\%s",
        "WIMCloseWIM",
        "uz-Cyrl-UZ",
        "HomeBasicN",
        ";(;,;0;D;H;L;T;l;p;x;",
        "2+2K2]2",
        "2Y2`2|2",
        "InstallReqSysDriveReqSatisfied",
        "PQh`gA",
        "OneSettings: Initialization failed -> [0x%X]",
        "=>=X>_>i>",
        "7d8g9",
        "6V7]7",
        "mn-MN",
        "4@4p4",
        "5G6S7X7n7",
        "DigitalPKeyCmdUsed",
        "SetupHost: Skipping diagnostic tool result trace",
        "imageSize",
        "SetupDiag.exe",
        "VERSION.dll",
        "2\\3P4",
        "5.5Z5u5",
        "PreInstallQuiet",
        ".rdata$r$brc",
        "IMAGE",
        "TestMode",
        "DeviceIoControl",
        "627;7@7W7",
        "GlobalCollection",
        "D$lSP",
        ">U>k>",
        "CreateDestinationFileEx",
        "Failed to get decoder context",
        "    </application>",
        "5$5-525A5",
        "ConX::Setup::Common::COSInfoHelper::GetTargetOSVersion",
        ";=;D;",
        "9$9B9b9",
        "GetMetadataPadding",
        "FindNextFileNameW",
        "0*0G0S0t0{0",
        "?0?N?l?",
        "DownloadReqStorageCleanupTime",
        "HostOsSuiteMask",
        "Enable",
        "CMicrodomBuilder::CNamespaceNameExistenceCheck::AddAndCheckExistence",
        "qps-Latn-x-sh",
        "CreateFileMappingA",
        "HomeBasic",
        "FLT_INEXACT_RESULT",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        "settings-win.data.microsoft.com",
        ";X<e<",
        "=E>^>",
        "RtlInitializeResource",
        "9::U:\\:h:o:~:",
        "Global\\MoSetup",
        "[%s:(%d) -> %s] %s",
        "D$$hp",
        "=#=)=2=8=<=A=K=S=\\=b=k=q=u=z=",
        "/ReportId",
        "Thales TSS ESN:E5A6-E27C-592E1%0#",
        "Not-null check failed: Result",
        "SYSTEM",
        "ulLocation < m_PositionList.Length",
        "9=PnI",
        "tJj\\P",
        "Temp = (*RtlReallocateStringRoutine)(Bytes, Blob->Buffer)",
        "so-SO",
        "mn-Mong",
        "CBlackboard::m_lAccessSpinLock = %d for BB=\"%s\"",
        "                publicKeyToken=\"6595b64144ccf1df\"",
        "3Z3e3",
        "jaYjz_j:Z",
        "~~~~~yyyyxxxxxx",
        "%s, LOG: [0x%X] [%s] [%s]",
        ">(>4>@>L>X>d>p>|>",
        "trPWQ",
        "92:C:",
        "5e6l6",
        "m_StoredTable.FindOrInsertIfNotPresent(Pair, Value, 0, pfExisted)",
        "GetModuleFileNameA",
        "YY_[^",
        "CSetupHost::Execute",
        "4!4+494]4g4u4",
        "HostOsMinorVersion",
        "WIM\\TOTALBYTES",
        "ha-Latn",
        "Not-null check failed: Blob",
        "3'3S3Y3l3r3}3",
        "sv-FI",
        " || SourceFunction: ",
        "/MigrateDrivers",
        "AssertWithArgs",
        "        <windowsSettings>",
        "COMPACTOSENABLED",
        "SetupManager: Diagnostic Tool override found: [%s]",
        "CustomRunErrorExitCode",
        "t;h@E@",
        "DefaultPKeyUsed",
        "8,8@8X8",
        "\\Windows\\WinSxS\\",
        "2I2p2",
        "1)1P1b1",
        ".rsrc$01",
        "cm4t5",
        "1+282E2e2q2x2",
        "001y1",
        "4%454<4U4\\4t4{4",
        "1$1,141<1D1L1T1\\1d1l1t1|1",
        "BelowNormal",
        "_vsnprintf",
        "Valid flags check failed: Flags",
        "DebugBreak",
        ":':;:I:",
        "IDREFS",
        "RtlCopyLBlob",
        "    Host OS Architecture    [ %s ]",
        ";T<j<",
        "_unlock",
        "RtlDuplicateLUtf8StringToLUnicodeString",
        "<+<1<Q<V<`<r<x<",
        "DiskSpaceDownloadReqFUReservesClaimedSpace",
        "fr-CH",
        "Operation",
        "iu-Cans",
        "%s;%s=%s",
        "            <!-- This Id value indicates the application supports Windows Blue/Server 2012 R2 functionality-->            ",
        ".gfids",
        "(Value != 0) || RtlIsLUtf8StringValid(Value)",
        "<]=q=x=",
        "=Q?w?",
        "SetupHost: Reporting failure event failed: hr = [0x%X]",
        "RefreshInterval",
        "zh-TW",
        "sr-Cyrl-ME",
        "/MediaEdition",
        "5T6_6m6",
        "OneSettings: Found [%s] -> [%s]",
        ".rsrc$02",
        "SOFTWARE\\Microsoft\\SQMClient\\Windows",
        "SetupHost: Copying failure log files from: [%s] -> [%s]...",
        "GetLastError",
        "memcpy_s",
        "DeleteFileEx: Unable to allocate hardlink path buffer",
        "%I64u",
        "677{8",
        ";^<e<",
        "GetTempFileNameW",
        "495i5x5",
        "onecore\\base\\xml\\udom_writer.cpp",
        "95@nI",
        "5#5M5W5",
        "en-JM",
        "SetupHost: Unable to copy MoSetup logs - [0x%X]",
        "0(0H0P0X0`0l0",
        "SetupUI: Setting message: [%s]",
        ">n?u?",
        "ExtDriveDownloadReqRequiredSpace",
        "OSPartitionInstallReqFreeSpacePostUpgrade",
        "WINPE",
        " PreInstallQuiet",
        "SetupUI: No registered callback.",
        ".<>I(",
        "`03*:",
        "inf\\setup.cfg",
        "GetLongPathNameW",
        "/tempdrive",
        "PreDownloadUX",
        "%S\\%s",
        "2$2)2/282>2B2G2Q2X2]2c2l2r2v2{2",
        "en-BZ",
        "ResultCode",
        "4<4N4f4",
        "/Selfhost",
        "Not-null check failed: String1",
        "NMTOKEN",
        "ntdll.dll",
        "MoSetup",
        "GetNativeSystemInfo",
        "NewAttlist = this->AllocateStreamObject()",
        ">W?^?",
        "/Action",
        "5)5N5w5",
        "fclose",
        "pChild->pBasicNode != 0",
        "9A:?;r;'<K<",
        "_amsg_exit",
        "\\Device",
        "m_CurrentStreamObject != 0",
        "j[Yf;",
        "SetupHost: Automation information initialized.",
        "1:1[1",
        "es-CU",
        "7m8v8",
        "%hs(%d) tid(%x) %08X %ws",
        "CSetupHost::OnProgressChanged",
        "%s %s \"%[^\"]\"",
        "<#=*=6=D=`=z=",
        "da-DK",
        "osver",
        "6$606<6H6T6`6l6x6",
        "CSetupHost::SetCompatFlags",
        "ta-IN",
        "es-GT",
        "='=<=M=r=",
        "4K4X4",
        "~~v~v",
        "/performdu",
        "0f;2u",
        ":/:l:",
        "OneSettingsQuery",
        "0\\1c1",
        "ServerHPC",
        "SetupHost: Putting external storage location for download in Reg [%c]",
        "$SVh4",
        "CompatLayer",
        ".?AVISetupObject@@",
        "SetupStartTime",
        "StarterN",
        "/Unattend",
        "j.Xf;",
        "Microsoft",
        "10181D1R1p1x1",
        "%s\\%d",
        "FailFast",
        "CSetupDiagnostics: Tracing Data [TIME] -> [%s]=[%s] [%s][%s][%s][0x%X]",
        "ku-Arab",
        "CSystemHelper::RemoveTrayIcon",
        "WdsCopyFileEx: Failed to copy [%s] to [%s], GLE = 0x%x; will retry in %u ms",
        "0X1]1o1",
        "StorageDriveLetter",
        "CDATA",
        "RtlCreateMicrodom",
        "ti-ER",
        "Source OS: Host SKU Info: Edition = '%s', Edition Type = '%s', Installation Type = '%s', Product Name = '%s', Arch = %s, StationType = %s, Stage type = %s",
        "UnhandledExceptionFilter",
        "334O4s4",
        "__dllonexit",
        "en-TT",
        "97vhS",
        "Panther",
        "1 1%1\\1b1m1t1",
        "/CancelId",
        "SetupFailureCount",
        "t;j?Yf;",
        ">6>Q>g>u>",
        "WIM_Verbose_Logging",
        "<zf;D9",
        " xmlns:dt=\"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882\"",
        "uk-UA",
        "5%5+515;5D5I5O5T5Z5`5f5p5y5~5",
        ">(>^>h>",
        "CMoSetupOneSettingsHelperT<class CEmptyType>::BuildStringUpdateUBR",
        "=<>k>",
        "Succeeded",
        "]_^[]",
        "SecureBootCheckFailure",
        "?D?e?{?",
        "\\$ ;E",
        "=3=?=J=j=",
        "=*=M=j=}=",
        "InstanceId",
        "=hK2/;",
        "stVRQ",
        "ProcessIdToSessionId",
        "Scenario",
        "Global\\OneSettingQueryMutex",
        "Process %s is accessing file wim %s",
        "kr-Latn-NG",
        "pHeader->ulSignature == ('dHdM')",
        "OSPartitionDownloadReqFreeSpaceAfterResponse",
        "536E6Q6`6",
        "%s%-20S%S",
        "    Host OS Language Id     [ %d ]",
        ":`:}:",
        "DiskSpaceInstallReqFUReservesClaimedSpace",
        "UpdateWIMHeader failed",
        "SINGLE_STEP",
        "GetFullPathNameW",
        "<2=m=",
        "=K>v>",
        "DIAGNOSTICANALYSISTIMEOUT",
        "CSetupHost::OnSetupPostReboot",
        ".giats",
        "A,;F8u",
        "3>DI\\+",
        "InstallReqFreeUpSpaceButtonClicked",
        "j(hx)I",
        "en-SG",
        "GetProcessPreferredUILanguages",
        "SYSTEM\\Setup\\MoSetup\\Volatile",
        "u|G;}",
        "uz-Cyrl",
        "uJG;}",
        "j:Yf9H",
        "ConfigureTelemetryOptInChangeNotification",
        "Vh|sA",
        "BUCL::Rtl::AddInPlaceWithOverflowCheck(&cbRequired, (*EncodingSizer)(ucsch))",
        "w|PPP",
        "m.Reserved < m_NamedNodeMaps.Size()",
        "3!373@3E3M3S3X3`3f3k3s3y3~3",
        "/MediaLangCode",
        "UninstallComment",
        "+T$\\+",
        "SetupUI: Requesting main window removal...",
        "/DefaultApps",
        "191113214033Z",
        "CMoSetupOneSettingsHelperT<class CEmptyType>::GetBuildLabEx",
        "user32.dll",
        "3E4P4`4",
        "/FlightBVT",
        "ar-BH",
        "7)737",
        "AllocateAndInitializeSid",
        "failed",
        "s(Ph8",
        "2.2A2H2Q2d2k2t2",
        "CMicrodomUpdateContext::Construct",
        "HSVW3",
        "SetupHost: Loading AutomationManager manager...",
        "Source.Length >= 2",
        "CMicrodomUpdateContext::CreateVirtualTextual",
        "?(?4?@?L?X?d?p?|?",
        "L$4_^[3",
        "_fdopen",
        ">\">'>1>6><>E>J>O>U>Y>^>h>m>s>x>~>",
        ")Microsoft Root Certificate Authority 20100",
        "Settings",
        "EnumeratePathEx: Unable to construct path under [%s]; GLE = 0x%x",
        "CSetupDiagnostics: Tracing Data [QUADWORD] -> [%s]=[0x%I64x] [%s][%s][%s][0x%X]",
        "4#4/484=4C4H4N4R4W4a4j4p4u4}4",
        "8S?\\?",
        ">K>V>]>C?N?U?",
        "/InstallLangPacks",
        "sq-AL",
        "AcquireSRWLockExclusive",
        "100701213655Z",
        "en-IE",
        "9MdHdt",
        "EXTERNALFREESPACEPADDING",
        "iu-Latn-CA",
        "es-PA",
        "WaitForSingleObject",
        "x1iYk",
        "WTSRegisterSessionNotification",
        ".::;?0_",
        "SetupUI: Calling ShutdownBlockReasonDestroy...",
        "#rSPo",
        "SetupUI::Uninitialize - UnblockSystemSleep failed: [0x%X]",
        "JaaZ92-,+",
        ";;;G;7<y<",
        "FindNextFileW",
        "9Q9c9",
        "9$9(9,90989@9D9H9L9P9T9X9\\9d9h9l9p9t9x9|9",
        "1#2l2",
        "CSetupHost::SetBitLockerMode",
        ";A=8>X>_>",
        "CMoSetupOneSettingsHelperT<class CEmptyType>::SetServerEndpoint",
        "</s:AttributeType>",
        "L$,_^[3",
        "SetupHost: Reporting post reboot event -> [0x%X, 0x%X]",
        "=!>3>A>a>g>",
        "4Y4k4|4",
        "TargetOsAllowUninstall",
        "OutputDebugStringA",
        "DecodeChunk",
        "zh-SG",
        "WdsRemoveDirectory: Unable to clear attributes on [%s]; GLE = 0x%x",
        "SetupHost::Create inproc event reporter result: [0x%X]",
        "    </trustInfo>",
        "en-IN",
        "RtlIsLUtf8StringValid(NamespaceURI)",
        "4 4,484D4P4\\4h4t4",
        "SLGetProductSkuInformation",
        ";#;G;Y;_;q;w;",
        "DISABLED",
        "T$(94",
        "ENTITY",
        "IN_PAGE_ERROR",
        "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5p5x5",
        "RaiseException",
        "            <!--This Id value indicates the application supports Windows 7/Server 2008 R2 functionality-->",
        "<H<]<d<}<",
        "WebSetupOnlineStoreVersion",
        " Setup360",
        "totalHits",
        "8(?5?",
        "WebSetupImageDefaultsCheckboxChecked",
        "OneSettings: OsVer [%s]",
        "SetEnvironmentVariableW",
        "10H0W0n0",
        "DataOnly",
        "L$8PW",
        "::RtlIsLUnicodeStringValid(Source)",
        "j{Yf;",
        "R EX[",
        "SetupUI: Power request denied!  Error = [0x%X]",
        "fy-NL",
        "/Update",
        "                processorArchitecture=\"*\"",
        ">&>V>\\>",
        "SetupHost: Loading ID: [%s] from [%s\\%s]...",
        "Final=0x%X",
        "ulIndex < UpdateChildNodes.Size()",
        "]..%Fo",
        ">D>p>}>",
        "fo-FO",
        "040k0",
        "CBasicNodeType::ChangeNamespace",
        "Windows::uDom::Rtl::RtlMicrodomUpdateRemoveElement",
        "D$,_^[3",
        "/UpdateAndShutdown",
        "=!=>=N=U=",
        "9?9j9q9}9",
        "/WaitForDebugger",
        "m_StoredTable.Find(Pair, ppusAttrListNumber)",
        "om-ET",
        "0\"0?0e0",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocumentNodeSet",
        "***   Source File: %s, line %ld",
        "8-878F8Q8X8h8o8",
        "api-ms-win-eventing-provider-l1-1-0.dll",
        "/Install",
        "6f6m6",
        "Windows::uDom::Rtl::RtlCreateUpdatedMicrodomAsUtf8",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "1$1+121J1a1m1r1|1",
        "_wcsicmp",
        "cZ[D3-++",
        "4 4>4G4",
        "QQSV3",
        ";m=w=",
        "SetupHost: Using automation file: [%s]...",
        "Ph@O@",
        "3 4'4.454<4C4J4p495f5",
        "CMoSetupOneSettingsHelperT<class CEmptyType>::GetUBR",
        ".idata",
        "GetFileAttributesW",
        "it-CH",
        "fr-LU",
        ".?AVCSystemHelper@@",
        "[%hs(%hs)]",
        "Y2{#z",
        "SummaryTime",
        "(DestinationMaximumLength == 0) || (DestinationBuffer != 0)",
        " OsUninstall",
        "0\"0)0",
        ";0<K<",
        "::RtlIsLUtf8StringValid(&Sources[i])",
        "Tel#Sqm",
        "Genuine",
        "CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x%X]",
        "QSVW3",
        "SetupHost::Initialize: Mode                   = [0x%X]",
        "NewComment = this->AllocateStreamObject()",
        "platformInstallationType",
        "setuprollback.cmd",
        "-Tz4q",
        "smn-FI",
        "E(SVW",
        "3+3L3d3k3",
        "=$=+=>=O=W=^=",
        "es-ES",
        "Windows::uDom::Rtl::RtlCreateUpdatedMicrodomAsMicrodom",
        "f;D$Pu",
        "0#0Q0c0~0",
        "pHeader->ulOffsetToStringPool < pHeader->ulTotalSize",
        "2O3c3",
        "Not-null check failed: Params->Source.pBlob",
        "070C0",
        "261019185142Z0",
        "not restored",
        "de-LI",
        "lb-LU",
        "CoInitializeSecurity",
        ">\">O>m>t>",
        "RtlIsLBlobValid(Source)",
        "es-NI",
        "DestroyWindow",
        "MicrodomImplementation::DecodeXmlCharacterToUcsChar",
        "ILLEGAL_INSTRUCTION",
        "GetLogicalDrives",
        "CodeIntegrity.Telemetry",
        "UUUUf",
        "onecore\\base\\lstring\\ucsdecoders.cpp",
        "j(hh$I",
        "ReadFile",
        "</s:Schema>",
        "PerformMediaUpdate",
        "CXmlLogicalState::{dtor}::<lambda_0fd40d3b956627884e315ff69db4f18c>::operator ()",
        "onecore\\base\\lstring\\lblob.cpp",
        "USER32.dll",
        "client",
        "1!1&10151;1D1J1S1Y1]1b1l1q1w1",
        "ClientId",
        ":9:V:[:t:{:",
        ">9?@?v?",
        "CSetupHost::ReportStorageLocation",
        "QSVWj",
        "=\"='=.=5=V=",
        ";)<3<J<^<Y>",
        "?(?0?8?@?H?P?\\?|?",
        "f9FHu",
        "8&999",
        "SetupDiagResults.xml",
        "Setup360Extended",
        "Not-null check failed: Writer",
        "Ph8fA",
        "WimFindClose",
        "WIM_Enumerate_Directory_Reparse_Point",
        "<z:row",
        "4 4044484@4X4\\4t4",
        "6$6(6H6h6t6",
        "oeY<9",
        "rm-CH",
        "vtPRQW",
        "/SMode",
        "ar-AE",
        "F95loI",
        "3*393P3x3",
        "SetupHost: Diagnostic tool does not exist [%s]",
        "SetupUI: Setting tray title: [%s]",
        "%WINDIR%\\Minidump",
        "CSetupHost::SetInstallPackagePaths",
        "<u>X?_?{?",
        "454V4d4",
        "9_@tD",
        "setuplog.cfg",
        "PQQjB",
        "SetupHost::Initialize: InstallFilePath        = [%s]",
        "pToInsertInto != 0",
        "SetupHost: Looking for automation file...",
        "9p:~:",
        "9^@u)h",
        "3'3F3d3",
        "towupper",
        "DiskSpaceInstallReqFUReservesTotalSpace",
        "WebSetupInputSelectedLang",
        "DiskSpaceInstallReqBlocked",
        ":,:<:@:D:H:L:P:X:p:t:",
        "UnregisterTraceGuids",
        "gu-IN",
        "CMoSetupOneSettingsHelperT<class CEmptyType>::GetSettingsParameters",
        " Microsoft Operations Puerto Rico1",
        "CSetupHost::GetDiagnosticAnalysisTimeout",
        "6$6T6[6f6m6x6",
        "KERNEL32.dll",
        "GetDriveTypeW",
        "SetupHost::Create IWUInstallationSession result: [0x%X]",
        "diagerr.xml",
        "=0>x>",
        "CSystemHelper::SetUserSessionChangedCallback",
        "\"CBlackboard::Close",
        "mn-Mong-MN",
        "pContext != 0",
        "Index",
        "?6?=?W?^?k?r?",
        "2p2x2",
        ".!0*Y",
        "2[~TM",
        "smj-NO",
        "L$8;U",
        "20201008151940Z",
        "WINHTTP.dll",
        "CopyFileW",
        ":1:C:_:q:",
        "1%1,1E1Z1o1",
        "8(848@8L8X8d8p8|8",
        "SetEvent",
        "?\"?:?T?[?",
        "MoveCaptureNode",
        "WimLazyInitialize",
        "GetMessageW",
        "LocationHeader != 0",
        "/progressCLSID",
        "<&<?<R<_<",
        "> >,>8>D>P>\\>h>t>",
        "PQQQQQQ",
        "7#7@7J7S7[7o7~7",
        "GetVolumeNameForVolumeMountPointW",
        "SetupUI: Waiting for message thread...",
        ":MdLct",
        "95loI",
        "5'595\\5n5",
        "=?>W>e>",
        "UpdateMediaUIShown",
        "PPPPjdh",
        "4'484L4T4m4",
        ".rdata$zETW2",
        "SetupHost: External Download %s",
        "CMicrodomBuilder::StartElement",
        "HostOsEditionType",
        "L$HQRP",
        "QQSVW",
        "AllocConsole",
        "                <requestedExecutionLevel",
        "CopyFileExW",
        ".?AV?$CZeroInit@V?$CDlpAutoLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@$00@@",
        "m_PropertyCache.Allocate(m_LayoutCache.TotalObjectCount())",
        "ff-Latn",
        "9'9-979o9u9",
        "<3<F<",
        "DecryptTime",
        "Not-null check failed: NodeSet",
        "Exception (code 0x%08X: %s) occurred at 0x%p in %s (+%p).",
        "DeleteFileEx: Unable to get information on [%s]; GLE = 0x%x",
        "#text",
        "RtlAdjustPrivilege",
        "SetupManager: Diagnostic Analysis [%s] via override.",
        "NodeMap != Windows::Microdom::Rtl::NamedNodeMap::InvalidValue()",
        "CMicrodomBuilder::ConsumeCData",
        "fil-PH",
        ".text$mn",
        "93:8:=:B:G:L:Q:W:",
        "SetupUI: Main window removed.",
        "4)454@4N4[4h4",
        "    </compatibility>",
        "onecore\\base\\xml\\udom_xmlcursor.cpp",
        "RpcStringFreeW",
        "4O5\"696",
        "j\\Xf9DN",
        "D$,VP",
        "0$000<0H0T0`0l0x0",
        "2#2Q2c2~2",
        "SetupUI: Connected standby: [%s]",
        " Setup360MitigationSummary",
        "0?1m2",
        "?#?)?3?8?>?B?G?Q?V?\\?a?g?p?v?z?",
        "%s;AppVer=%d.%d.%d.%d",
        "syr-SY",
        "= =,=8=D=P=\\=h=t=",
        "=+=F=X=",
        "Pj2jl",
        "8!868h8",
        "es-UY",
        "WindowsUpdateSuccess",
        "StandardSetupLogFormatter",
        "UncompressFileBase",
        "/optinsqm",
        "u/G;}",
        "OneSettings: Invalid boolean value [%s] for setting [%s].",
        "CMoSetupOneSettingsHelperT<class CEmptyType>::GetOsVer",
        "Web360",
        "kernel32",
        "CreateDirectoryW",
        "es-CR",
        "es-VE",
        "OMLvjWcElu",
        "=7=C=N=",
        "9\\$`t",
        "0!1(1",
        "WIM\\IMAGE[*]\\CREATIONTIME\\HIGHPART",
        "Entity.Length != 0",
        "M>B~1",
        "=(>9>",
        "7&818k8x8",
        "SetupHost: Proceeding without decryption key.",
        "SourceMicrodom != 0",
        "D$ h<",
        "MicrodomWriterImplementation::CMicrodomWriter::CreateInterface",
        "CSetupHost::SetUIInfo",
        " PreDownloadUX",
        "sr-Latn-RS",
        "hr-HR",
        "MSCFu",
        "HostOsSkuName",
        "?(?:?f?x?",
        "W9{HuI",
        "RPCRT4.dll",
        "838O8c8",
        "SetupUI: Power request granted!",
        "BCryptHashData",
        "j]Zf;",
        "UTF-8",
        "T$@j[P",
        "HWARE",
        "454\\4",
        "SetupUI: Setting system sleep block message: [%s]",
        "GetCurrentProcess",
        "QQQQQQP",
        "292@2",
        "?9?Z?a?",
        "Virtual",
        "1&252B2i2q2",
        "ExitProcess",
        "Cancelled",
        "SetupHost: Automation information not found. Releasing automation object.",
        "?<?D?\\?z?",
        "_^[Y]",
        "9_4u.",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::EndOpenElement",
        "Setup360",
        "        <application> ",
        ";y-{e",
        "D$$d*A",
        "PKeyINeedAPkeyClicked",
        "en-US",
        "233:3I4",
        "8&858j8",
        "sv-SE",
        "NewAttdef = this->AllocateStreamObject()",
        "Accept",
        "_wtol",
        "080X0",
        "Microsoft Windows0",
        "Unknown",
        "SetupNotify::CleanupCachedFile - Cleaning up cached file [%s].",
        "7@8^8",
        "CMicrodomBuilder::ConstructAndWriteMicrodom",
        "1::&*a`",
        "< <!=X=_=p=w=",
        "MicrodomImplementation::CMicrodom::DecodeXmlString",
        "PreDownloadQuiet",
        "FindFirstFileNameW",
        "TryKeepActive",
        "D$XAF",
        "whichDoc.Reserved == m_pTargetObject->m_LayoutCache.DocumentId()",
        "EventType=0x%X",
        "Blob->Buffer = (PUCHAR)((*RtlAllocateStringRoutine)(Bytes))",
        ".CRT$XCAA",
        "Windows::uDom::Rtl::RtlCreateMicrodomUpdateContext",
        "TlsFree",
        "3O3^3",
        " Operating System",
        "SystemPartitionFreeSpace",
        "%u-%u-%u",
        "/Compat",
        "9~HtI",
        "060E0{0",
        "VhpsA",
        "_initterm",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteComment",
        "9):D:P:[:x:",
        "yQ^?%?",
        "qps-ploca",
        "m_StoredTable.Find(Pair, ppAttDef)",
        "Z_hn{}Q",
        "5#5w5",
        "<#<.<4<@<P<Y<j<p<v<|<",
        "L$,Wh",
        "=0>E>R>y>",
        "Boot360",
        "Extended=0x%X",
        "SetupNotify::Remapping missing decrypt key error [0x%X] -> [0x%X]",
        "D$4PQ",
        "6$6D6L6X6x6",
        "%d-%02d-%02d %02d:%02d:%02d,",
        "AzureFinalize",
        "7<7M7T7_7l7",
        "?!?+?>?L?x?",
        "Requesting full cleanup for unpack errors.",
        "2$2)2/242:2>2C2M2X2]2c2h2n2r2w2",
        "_wcmdln",
        "C<Ph\\E@",
        "SetLastError",
        ">^?i?",
        "Staged Image",
        "ActivationBlocked",
        "WdsCopyFileEx: Failed to strip file attributes for %s, will delete. GLE = 0x%x",
        "sah-RU",
        "SetupNotify::ReportEvent - RecordInstallationResult [%s,0x%X,%s,%s,%s]",
        "__p__commode",
        "oK0D$\"<",
        "_lock",
        "CSetupHost::Register",
        "RtlDuplicateLUnicodeStringToLUtf8String",
        "HostOsStageType",
        "onecore\\base\\telemetry\\permission\\product\\telemetrypermission.cpp",
        ".rdata$brc",
        "PostQuitMessage",
        "CallContext:[%hs] ",
        "CMicrodomBuilder::GetXmlDomSize",
        ":\";1;>;",
        ";,;N;o;u;",
        "HostOsLanguage",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteRawString",
        "CSystemHelper::Initialize",
        "=/>V>",
        "9 ;k;",
        "<R<a<r<y<",
        "BCryptFinishHash",
        "it-IT",
        "z.9Wv",
        "_controlfp",
        "8,989_9|9",
        "Not-null check failed: UpdateContext",
        "NewSetupMigChoicesOffered",
        "string",
        "0)000P0Y0d0k0",
        "    <description>Windows Blue Setup Host</description>",
        "UpdateWindow",
        "u;9_0t6",
        "rv.UcsCharacter < 0x110000",
        "D$0Pj",
        "D$0;D$(",
        " SVWj",
        "Not-Genuine",
        "OSPartitionInstallReqRequiredSpace",
        "::RtlIsLUtf8StringValid(StringIn)",
        "293G3",
        "RtlAppendLBlobToLBlob",
        "CreateFile failed",
        "t9jT3",
        "P{(G}",
        "CompatMigScanTime",
        "Properties.Length == Results.Length",
        "SourceDom != 0",
        "pHeader->ulOffsetToDomLayout < pHeader->ulTotalSize",
        ";B<e<",
        "5#5m5",
        "OptInLevel",
        "en-MY",
        "9[9q9",
        "2%2L2",
        ".?AVCSetupHost@@",
        "#0b0l0",
        "u$WSQ",
        "ImpersonateLoggedOnUser",
        "<==F=v=",
        "CMicrodomBuilder::WriteXmlDom",
        "~~~v|gf",
        "VPiw&",
        "TargetBuild",
        "Encoder != 0",
        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",
        "1A1m1",
        "$1(1,1014181<1@1D1H1@6",
        "D$ ;D$",
        "timestamp",
        "GetFileVersionInfoExW",
        "3@4G4",
        "OneSettings: Could not convert 4th token in the build string to a number: [0x%X] [%s]",
        "/MCTUILanguage",
        "stQWR",
        "Defer",
        "6*676D6c6",
        "#sG{1a",
        ": :&:*:/:9:B:G:L:R:V:]:c:t:y:",
        "1,292c2",
        "ar-OM",
        "RtlIsLUtf8StringValid(NamespaceURI) || (NamespaceURI == 0)",
        "Unavailable",
        "ServerEnterprise",
        ".rdata$zETW9",
        "State",
        "CP9C<t",
        ":!:&:+:1:::@:D:I:S:X:]:b:h:t:z:~:",
        "S(_^[",
        "8?8Q8~8",
        "                    uiAccess=\"false\"",
        "D$PPQ",
        "3)373N3o3",
        "1[5i5",
        "%s+%s+%s",
        "ps-AF",
        "SetFileSize failed",
        "INDEX",
        "CMicrodomUpdateContext::CreateVirtualComment",
        "t=Wj,j",
        "pGetHostCSDBuildNumber",
        "4<4G4`4s4",
        "1-121;1A1J1Q1W1]1c1i1o1v1",
        ":&:-:::m:t:",
        "j < ValidProperties.Length",
        "settings-win-ppe.data.microsoft.com",
        "/ReportId %s",
        ".?AV?$CUnknownImpl@UIUnknown@@@@",
        "fr-CM",
        "CSetupHost::CleanupCachedFiles",
        "PoolHeader != 0",
        "RtlCreateDefaultMicrodomXmlWriter",
        "NtSetInformationFile",
        "ServerWeb",
        "0\"080`0",
        "SetupHost: Ignoring priority setting.",
        "Windows::Rtl::CRtlObjectTypeDescription<class MicrodomWriterImplementation::CMicrodomWriter>::CreateTearoff",
        "TlP0X",
        ": :.:5:W:^:n:u:",
        "SetWindowLongW",
        "&amp;",
        "\\\\?\\GLOBALROOT",
        "Not-null check failed: StringIn",
        "=$>+>7>>>",
        "vi-VN",
        " Setup360MitigationResult",
        "'F!X8^",
        "WebSetupInputSelectedArch",
        "RegistryCount",
        "WinDLP System Reboot",
        "        <security>",
        "020C0V0i0|0",
        "WimCloseImageFile",
        "?#?)?/?5?;?A?I?M?Q?U?Y?]?a?e?i?y?",
        "kl-GL",
        "ResAddFromFileAndHandle",
        ":H;~;",
        "EventWrite",
        "j\\Yf9",
        "__p__fmode",
        "CXmlCursor::DecodeExtent",
        "0\"0)040F0M0",
        "Not-null check failed: pStream",
        ".rdata$sxdata",
        "3!323?3h3s3",
        "HostOsBranchName",
        "{6c104913-738b-4411-a4ec-8b594e314f6b}",
        "this->ChildList[u]->Text != 0",
        "base\\ntsetup\\conx\\mosetup\\setuphost\\DiagnosticsImpl.h",
        "/WUCachedFileName",
        "t\"Wh8o@",
        "IgnoreWarning",
        "server",
        "3<3f3",
        "wcscpy_s",
        "CSetupHost::LogBuildInfo",
        "464Y4|4",
        "Locals.Allocate()",
        "InitiateSystemShutdownExW",
        "RemoveDirectoryW",
        "PSSSSSSSj",
        "3H3w3",
        "POSTUPGRADEFREESPACEREQUIRED",
        "<8<><==O=\\=v=",
        "GetSystemTimeAsFileTime",
        "memset",
        "ne-NP",
        " Downlevel",
        "/CopyLogs \"%s\"",
        "739:9N9",
        "01070@0G0",
        "GetTickCount",
        "OSPartitionInstallReqMinimumRequiredSpace",
        "CoInitializeEx",
        "mn-Cyrl",
        "DependsOn",
        "\\\\.\\SAC",
        "<$<,<4<<<D<L<T<\\<d<l<t<|<",
        "=;=_=x=",
        "SetupHost::Initialize: MediaPath              = [%s]",
        " !\"\"\"#$ &&&%%%%%%%",
        "DownloadReqFreeUpSpaceButtonClicked",
        "5Fz<|",
        "%systemdrive%\\$Windows.~BT\\Sources\\Rollback",
        "id-ID",
        "4=5K5^5q5",
        "TheElement != TheElement.InvalidValue()",
        "7&747[7q7",
        "4IKXY\\+",
        "SACSetupAct",
        "!fExisted",
        "LocalFree",
        "6'7G7U7q7",
        "DY\"eI",
        "5M6U6G7O7",
        "&9q,u",
        "ShutdownBlockReasonCreate",
        "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4",
        "`Y=.+",
        "u<G;}",
        "6\"6)6V6]6h6",
        "We are exiting in Setup because the machine was Gated BLocked and should not be offered the upgrade. We should clean up in this case.",
        "NTzGq",
        "setuplog.xml",
        "Decoder != 0",
        "?F?M?q?",
        "NodeIndex < m_pTargetObject->m_LayoutCache.TotalObjectCount()",
        "3$3E3N3c3r3{3",
        "ParseChunkRegionInternal",
        "95`oI",
        "MediaLayoutTime",
        "ProductName",
        "(Destination->Buffer != 0) || (Destination->MaximumLength == 0)",
        "sr-Latn-BA",
        "CreateProcessA",
        "__iob_func",
        "VerifyFileByHandle",
        "Xf9ABt",
        "UE~n]",
        "TargetOsVersionMinor",
        "SetupHost::GetEulaFile result: [0x%X]. Proceeding without EULA.",
        "CopySid",
        "NtQuerySecurityPolicy",
        "OSPartitionInstallReqFreeSpaceAfterResponse",
        "%s\\%s",
        "<$<0<P<l<p<|<",
        "200304183038Z",
        "_except_handler4_common",
        "DUImageTime",
        "TargetOsDisableNEO",
        "TargetOsCompact",
        "WIM\\IMAGE[*]\\WIMBOOTENTRIES",
        ">0E0y0",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings",
        ".?AV?$CDlpAutoLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@",
        "::RtlIsLUtf8StringValid(Source)",
        "BUCL::Rtl::Multiply(WorkingBufferSize, MultiplicativeGrowthFactor, WorkingBufferSize)",
        "7)797`7{7",
        "wo-SN",
        "la-001",
        ".?AV?$CMoSetupUnknownImpl@VCSystemHelper@@@@",
        "fa-IR",
        "tPSVP",
        "454J4e4",
        "7?7E7|7",
        "MicrodomImplementation::CMicrodom::GetDocumentNodeSet",
        "Windows::uDom::Rtl::RtlMicrodomUpdateGetCookieForExistingNode",
        "8+8;8M8i8x8",
        "RtlGetPersistedStateLocation",
        "$bSr6'QF78S9",
        "1+181M1c1n1",
        "CMoSetupOneSettingsHelperT<class CEmptyType>::GetSettingAsDword",
        "_wtoi",
        "SetFileTime",
        "6C6J6b6",
        "xmlns",
        "SetupHost: Tracing post reboot failure event",
        "/InstallPrivates",
        "OSPartitionDownloadReqFreeSpaceBeforeSilentCleanup",
        "_set_errno",
        "onecore\\base\\xml\\udom_builder.cpp",
        "Not-null check failed: Destination",
        "ReportId",
        "WTSUnRegisterSessionNotification",
        "-eQkU",
        "95 =I",
        "rXBGW",
        "SusClientId",
        "<s:Schema id=\"RowsetSchema\">",
        "diagwrn.xml",
        "/CorrelationVector",
        "PreInstallUX",
        "%Microsoft Windows Production PCA 20110",
        "SetupNotify::Remapping internal cancellation request [0x%X] -> [0x%X]",
        "WebSetupInputDefaultEdition",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::Length",
        "7\"7V7]7s7",
        ";](s?",
        "ExtDriveInstallReqRequiredSpace",
        "RtlIsMicrodomUpdateContextValid(HostUpdate)",
        "?w<t6",
        "(New == 0) || RtlIsLUtf8StringValid(New)",
        "D$8G;}",
        "9A0vq",
        "ReflectDrivers",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocument",
        "GetPrivateProfileStringW",
        "WTSGetActiveConsoleSessionId",
        "/Eula",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttributeNs",
        "Process PID %d is accessing file wim %s",
        "?0l0s0",
        "1V2]2",
        "8'9E9",
        "kk-KZ",
        "5;6Y6h6u6",
        "CSetupHost::SetShowOobeOption",
        "YN1Okt}",
        "210211214033Z0",
        "GetPrivateProfileSectionW",
        "9 :`:r:",
        "DataMigrationTime",
        "DeletePath: Failed to obliterate [%s] after %d tries; GLE = 0x%x",
        " Microsoft Corporation. All rights reserved.",
        "MicrodomImplementation::CStringpoolCache::FindString",
        "DriverMigrationTime",
        "1H1O1",
        ":u~6E",
        "Not-null check failed: fHasAttribute",
        ":S;_;j;",
        "/netdebug",
        "SLOpen",
        "SendMessageW",
        "SetupHost: Requesting SetupMgr pause...",
        "HeapValidate",
        "EtwEventUnregister",
        "CSetupHost::OnActionChanged",
        "^j?[;",
        "SourceOsMajorVersion",
        "Upgrade",
        "FlushFileBuffers",
        "Server",
        ";6;J;e;",
        "!This program cannot be run in DOS mode.",
        "6Q7v7B8g8",
        "D$8j\\P",
        "RegDeleteTreeW",
        "ku-Arab-IQ",
        "5.5B5O5",
        "u7WVh0",
        "zh-MO",
        "GetExitCodeProcess",
        "t1VPQ",
        ";!;&;,;0;5;?;J;O;U;Z;`;d;i;s;",
        ".XMLLogFormatter",
        "OneSettingsBranch",
        "8+888]8s8)9~9",
        ":':e:",
        "NewChild->Text.Allocate()",
        "|||v|xp",
        "DUSetupOptIn",
        "C<+C(",
        "CSetupDiagnostics: ReportEventMitigationSummary -> [0x%X][%d][%d][%d][%d][%I64u][%s][%s][%s][%s][0x%X]",
        "NewPcData = this->AllocateStreamObject()",
        "LayoutUSBTime",
        "=$=,=4=<=D=L=T=\\=d=l=t=|=",
        "NewAttlistClose = this->AllocateStreamObject()",
        "mn-Mong-CN",
        "f@f#E",
        "6%6>6C6l6~6",
        "lt-LT",
        "DeleteFileEx: Unable to delete [%s]; GLE = 0x%x",
        "Windows::Rtl::IsValid(ptr)",
        "9r$tL;",
        "%d.%d",
        "CopyDirectoryDirCallback: The copy was canceled by the user.",
        "SetCurrentDirectoryW",
        "<!<*<0<5<;<E<J<P<T<Y<c<h<n<s<y<",
        "        <dependentAssembly>",
        "SetupHost: Tracing post reboot event failed: hr = [0x%X]",
        "6?6M6i6|6",
        "DeleteFileEx: Trying to set back attributes on: %s",
        "windows",
        "ResExtract",
        "GetDiskFreeSpaceExW",
        "WebSetupClientVersion",
        "whichElement != Windows::Microdom::Rtl::Element::InvalidValue()",
        "GetProductInfo",
        "CMicrodomBuilder::ConsumeProcessingInstruction",
        "OpenThreadToken",
        "OpenProcessToken",
        "QQQQQQQW",
        "DUCATEGORIES_FLAG",
        "preoobescript.cmd",
        "CloseHandle",
        "DeletePathEngine: Hit %d failure%s during recursive deletion of [%s]; 1st error = 0x%x, cd = [%s]",
        "^[w\"QRW",
        "1$1*1.141>1J1O1T1Y1_1c1i1s1",
        "as-IN",
        "PKeyValidateTime",
        "SetupUI: Power request cleared!",
        "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0",
        "mni-IN",
        "3\"3P3a3j3t3}3",
        "9#939=9C9K9Q9_9f9l9p9y9",
        ":7:>:W:^:l:s:",
        "858n8",
        "J0V;A",
        "WriteFile",
        "Media360",
        "MicrodomImplementation::CDomPositionCache::AttachToPositionList",
        "?]?d?",
        "GetVersion",
        "Ph0gA",
        "0X0~0",
        "WIM\\IMAGE[*]",
        "strncpy_s",
        "Windows::Rtl::CRtlObjectTypeDescription<class MicrodomImplementation::CMicrodom>::CreateInstance",
        "j}Zf;",
        ">!>3>L>^>w>",
        "T$(9GL|X",
        "][YZ_^_^[",
        "WaitForMultipleObjects",
        "777a7h7y7",
        "SetupHost::InitializeComponents",
        "DiskPartitionTime",
        "scenarioId",
        "FileVersion",
        "0 0,080D0P0\\0h0t0",
        "RtlDuplicateLUtf8String",
        "StudyID",
        "m_AttdefListTable.FindOrInsertIfNotPresent( ulElementName, NewAttdefList, &pAttdefList)",
        "ATTLIST",
        "LoadIntegrityInfo",
        "SetupHost: Reporting pending reboot event failed: hr = [0x%X]",
        "(Params->InputType == Windows::Microdom::Rtl::CreateMicrodomSource::Binary) || (Params->InputType == Windows::Microdom::Rtl::CreateMicrodomSource::Xml)",
        ".rdata$zzzdbg",
        "3+464D4",
        "D$(4^A",
        "j---.7",
        "H0YM O",
        "OneSettings: DeviceId [%s]",
        "?#?(?.?2?7?A?L?Q?W?`?f?j?o?y?",
        "6 60686@6P6X6h6l6p6|6",
        "030I0P0Z0q0x0",
        "SystemPartitionTotalSpace",
        "rqsppnmmTP84211h",
        "OSPartitionInstallReqFreeSpaceBeforeSilentCleanup",
        "oc-FR",
        "GetFileType",
        "3B3]3",
        "Windows::uDom::Rtl::RtlMicrodomUpdateInsertChild",
        "VWRQSU",
        "Lg ;M@c",
        "HostOsSkuId",
        "</assembly>",
        "aLimitEnhancedDiagnosticDataWindowsAnalytics",
        "MicrodomImplementation::CMicrodom::GetElementsByTagNameCommon",
        "SetupUI: Calling PowerSetRequest with type [0x%X]...",
        "CompareStringW",
        "=E>L>^>e>",
        "PPPPh@",
        "/RollbackSys",
        "%-20S %-21S [0x%06x] %S",
        "SHELL32.dll",
        "CreateThread",
        "3e4p4~4"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "e32c76ebad7261cce80aee4db54d1bf22c0fd8c3cf52876d66fe14bc029508b6",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/e32c76ebad7261cce80aee4db54d1bf22c0fd8c3cf52876d66fe14bc029508b6",
              "guest_paths": [
                "overlay"
              ],
              "size": 8504,
              "crc32": "25CEDC9E",
              "md5": "3e466cc0253fcc1330590f60aff9c02e",
              "sha1": "c68ad7ca6814a9e2ace380a5d27b0753eee84436",
              "sha256": "e32c76ebad7261cce80aee4db54d1bf22c0fd8c3cf52876d66fe14bc029508b6",
              "sha512": "61de38fd84de2dbc06db38c6c955fc5dd1b2389bbff219c30061dab37123ea07da70c45335f1c4458badba926b819f7bd07107df394bba5c1313a757eeaad6de",
              "rh_hash": null,
              "ssdeep": "96:bH0DXBDbz9MekJ3AhNpVtEiJhwDD0pBDXiebs/Am2grWXGuGDXvQQsi2DuU4tDfr:zF2q8hDBQABJYh35jWqnajNQX",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T1BB022BD28FAC5047D9A7BC405398F8877D3D83CB1864846619ABF6E52C437C6DF08A6D",
              "sha3_384": "2d31e695a811303dce2e64ef637847ba1f66d65f2add67114eb3ea200f82dd09dd8e694ba6d37fc5e4a12b4c9a5bb10c",
              "data": null
            }
          ],
          "extracted_files_time": 0.0004958640020049643,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "diagwrn.xml"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/d56c2cf5d46b8fca32e2d040e45e0385e3c8bd53d7b1edb9a478e46c7dc45a4c",
      "guest_paths": [
        "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
      ],
      "size": 5021,
      "crc32": "CA96AEA1",
      "md5": "2deab91dbe561be453841d53ae6112a4",
      "sha1": "2276c30ca5d8575d946dd06f461d5af66e47f4b7",
      "sha256": "d56c2cf5d46b8fca32e2d040e45e0385e3c8bd53d7b1edb9a478e46c7dc45a4c",
      "sha512": "e2818baa0a5742d1df37cefffe99756ad01206afa9dc40ec378ad671978458d50d57285c79b5c51cdb9a496ec2b9ec8bce8e0affa7aa9d9f00d6d9ce03c63b3b",
      "rh_hash": null,
      "ssdeep": "96:5MwiGdgbnE0jiecR0jiecn0jiecp0jiecbNao0y9SPStSD1MVniy:53gbELRLnLpLbNlj8SkD1MxV",
      "type": "Unicode text, UTF-8 (with BOM) text, with very long lines (375)",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T18CA1131C71AA1DB79E5402C9CFF23E8213816D3A47A2E13F30C5FDAA556508AD6B93DC",
      "sha3_384": "d9ad07049c7641489b81002ce0d30a50ef7bdee074ebca174f64ee66f6a28828f13d90e8d7c66ab23d4deefd4c47bccf",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": "\\xfeff<xml xmlns:s=\"uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882\"\n xmlns:dt=\"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882\"\n xmlns:rs=\"urn:schemas-microsoft-com:rowset\"\n xmlns:z=\"#RowsetSchema\">\n<s:Schema id=\"RowsetSchema\">\n<s:ElementType name=\"row\" content=\"eltOnly\" rs:updatable=\"true\">\n<s:AttributeType name=\"Cls\" rs:number=\"0\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Sev\" rs:number=\"1\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Maj\" rs:number=\"2\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Min\" rs:number=\"3\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"LN\" rs:number=\"4\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Fil\" rs:number=\"5\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Fun\" rs:number=\"6\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Uid\" rs:number=\"7\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Msg\" rs:number=\"8\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"PID\" rs:number=\"9\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"TID\" rs:number=\"10\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Con\" rs:number=\"11\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Exe\" rs:number=\"12\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Mod\" rs:number=\"13\">\n<s:datatype dt:type=\"string\"/>\n</s:AttributeType>\n<s:AttributeType name=\"Err\" rs:number=\"14\">\n<s:datatype dt:type=\"int\"/>\n</s:AttributeType>\n<s:AttributeType name=\"MD\" rs:number=\"15\">\n<s:datatype dt:type=\"hexBinary\"/>\n</s:AttributeType>\n<s:AttributeType name=\"DT\" rs:number=\"16\">\n<s:datatype dt:type=\"dateTime\"/>\n</s:AttributeType>\n</s:ElementType>\n</s:Schema>\n<rs:data>\n<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"565\" Fil=\"\" Fun=\"SPGetFootprintCapabilities\" Uid=\"50331648\" Msg=\"SPGetFootprintCapabilities: Footprint [Footprint.Basic] incomplete; the platform capability will not be available\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod=\"SetupPlatform.dll\" Err=\"2\" MD=\"\" DT=\"2026-05-28T15:59:40\"/>\n<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"565\" Fil=\"\" Fun=\"SPGetFootprintCapabilities\" Uid=\"50331648\" Msg=\"SPGetFootprintCapabilities: Footprint [Footprint.Servicing] incomplete; the platform capability will not be available\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod=\"SetupPlatform.dll\" Err=\"2\" MD=\"\" DT=\"2026-05-28T15:59:40\"/>\n<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"565\" Fil=\"\" Fun=\"SPGetFootprintCapabilities\" Uid=\"50331648\" Msg=\"SPGetFootprintCapabilities: Footprint [Footprint.ICB] incomplete; the platform capability will not be available\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod=\"SetupPlatform.dll\" Err=\"2\" MD=\"\" DT=\"2026-05-28T15:59:40\"/>\n<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"565\" Fil=\"\" Fun=\"SPGetFootprintCapabilities\" Uid=\"50331648\" Msg=\"SPGetFootprintCapabilities: Footprint [Footprint.Migration] incomplete; the platform capability will not be available\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod=\"SetupPlatform.dll\" Err=\"2\" MD=\"\" DT=\"2026-05-28T15:59:40\"/>\n<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"274\" Fil=\"\" Fun=\"CSetupOneSetting::InitializeAndQuery\" Uid=\"50331648\" Msg=\"Onesettings: Failed to get DeviceId from registry: 0x80070002\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod=\"SetupPlatform.dll\" Err=\"2\" MD=\"\" DT=\"2026-05-28T15:59:40\"/>\n<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"119\" Fil=\"\" Fun=\"CreateSetupOneSettings\" Uid=\"50331648\" Msg=\"Onesettings: Failed to initialize and query: 0x80070002\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod=\"SetupPlatform.dll\" Err=\"2\" MD=\"\" DT=\"2026-05-28T15:59:40\"/>\n<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"398\" Fil=\"\" Fun=\"CSetupPlatformTracing::ReadTracingOneSettings\" Uid=\"50331648\" Msg=\"Failed to create OneSettings infrastructure. Error: 0x0880070002\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod=\"SetupPlatform.dll\" Err=\"2\" MD=\"\" DT=\"2026-05-28T15:59:40\"/>\n<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"520\" Fil=\"\" Fun=\"CSetupPlatformTracing::Initialize\" Uid=\"50331648\" Msg=\"No onesetting configured or error getting onesetting\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod=\"SetupPlatform.dll\" Err=\"2\" MD=\"\" DT=\"2026-05-28T15:59:40\"/>\n<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"13030\" Fil=\"\" Fun=\"CSetupPlatform::Initialize\" Uid=\"51150848\" Msg=\"CSetupPlatform::Initialize: Failed to initialize tracing\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod=\"SetupPlatform.dll\" Err=\"203\" MD=\"\" DT=\"2026-05-28T15:59:40\"/>\n</rs:data>\n</xml>\n",
      "strings": [],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5932
    },
    {
      "name": [
        "setupact.log"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/1edb1bb26ec6ca3a1d6f6e308aa838b4e5bb90f6d5f6f2f19416b524b41ef20b",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
      ],
      "size": 18821,
      "crc32": "A0370C81",
      "md5": "7a3c1fe15868b3bd287da00eb156861f",
      "sha1": "b63e3f89a1da790b8956b3f8c7695ee7ef26e1a0",
      "sha256": "1edb1bb26ec6ca3a1d6f6e308aa838b4e5bb90f6d5f6f2f19416b524b41ef20b",
      "sha512": "caeccb4c8f6abfcb93cbb5fa95ce367a20f69f2ea603a577250e47cf2e4910288cb8d226d568920bede86839f349a7db7e6e27ea585d193b0eef214813de8068",
      "rh_hash": null,
      "ssdeep": "192:Urd4yPsVO/jlmNxveC+3Lwf2bwmjARQ52sRAhhSiB4fV5yNY/iyWEJl4IQmSzh7m:4eNbQxFBVEwEmzx",
      "type": "CSV Unicode text, UTF-8 (with BOM) text",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1F0823B277BBB14237629A501B3418A4D7A53345A33D8601F73BFC65A6B03368CAFDB85",
      "sha3_384": "29244559b4bc105ffcd6fd963221efa716e06e8a6ee64a5199b679dbba51f048483ba25a045c839caa004c5e6bc9429c",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": "\\xfeff2026-05-28 15:59:34, Info                  MOUPG  *************** SetupHost Logging Begin ***************\n2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize\n2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: ModulePath             = [C:\\$Windows.~WS\\Sources]\n2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: WorkingPath            = [C:\\$Windows.~WS\\Sources]\n2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: LoggingPath            = [C:\\$Windows.~WS\\Sources\\Panther]\n2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: MediaPath              = []\n2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: InstallFilePath        = []\n2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: ActionListFilePath     = []\n2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: CmdLine                = [/Download /Web  ]\n2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: Mode                   = [0x8]\n2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: Scenario               = [0x7]\n2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: Flags                  = [0x800]\n2026-05-28 15:59:34, Info                  MOUPG  SetupHost: Setup build version is: 10.0.19041.572 (vb_release_svc_prod1.201007-1724)\n2026-05-28 15:59:34, Info                  CONX   pGetHostCSDBuildNumber: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber' does not exist. Assume 0\n2026-05-28 15:59:34, Info                  CONX   Host OS version: 10.0.19045.0  (0.0) Platform 0x2, SuiteMask 0x100, ProdType 0x1\n2026-05-28 15:59:34, Info                  CONX   Source OS: Host SKU Info: Edition = 'Professional', Edition Type = 'Client', Installation Type = 'Complete', Product Name = 'Windows 10 Pro', Arch = amd64, StationType = Client Workstation, Stage type = Staged Image\n2026-05-28 15:59:34, Info                  MOUPG      Host OS License State   [ Not-Genuine ]\n2026-05-28 15:59:34, Info                  MOUPG      Host OS Architecture    [ x64 ]\n2026-05-28 15:59:34, Info                  MOUPG      Host OS Language Id     [ 1033 ]\n2026-05-28 15:59:34, Info                  MOUPG      User UI Language Id     [ 1033 ]\n2026-05-28 15:59:34, Info                  MOUPG      Host OS Edition         [ Professional ]\n2026-05-28 15:59:34, Info                  MOUPG      Host OS Version         [ 10.0.19045 ]\n2026-05-28 15:59:34, Info                  MOUPG      Host OS Build String    [ 19041.1.amd64fre.vb_release.191206-1406 ]\n2026-05-28 15:59:34, Info                  MOUPG  SetupHost::InitializeComponents\n2026-05-28 15:59:34, Info                  MOUPG  SetupHost: Loading ID: [c7b6e4de-b741-42d8-ac05-16738c9e0bc5] from [C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll]...\n2026-05-28 15:59:35, Info                  MOUPG  SetupHost: Loading complete.\n2026-05-28 15:59:35, Info                  MOUPG  CInstallUI::Initialize\n2026-05-28 15:59:35, Info                  MOUPG  SetupHost: Loading ID: [3d3ad714-f8d8-4c84-ad5f-10938c2f3339] from [C:\\$Windows.~WS\\Sources\\SetupCore.dll]...\n2026-05-28 15:59:35, Error                 MOUPG  CInstallUI::GetDefaultLanguage(2027): Result = 0x80070002[gle=0x00000002]\n2026-05-28 15:59:35, Info                  MOUPG  SetupHost: Loading complete.\n2026-05-28 15:59:35, Info                  MOUPG  SetupHost: Loading AutomationManager manager...\n2026-05-28 15:59:35, Info                  MOUPG  SetupHost: Loading ID: [edac948b-844e-4a51-9ba9-34520bd9ff9f] from [C:\\$Windows.~WS\\Sources\\SetupCore.dll]...\n2026-05-28 15:59:35, Info                  MOUPG  SetupHost: Loading complete.\n2026-05-28 15:59:35, Info                  MOUPG  SetupHost: Initializing automation...\n2026-05-28 15:59:40, Info                  MOUPG  SetupHost: Automation information not found. Releasing automation object.\n2026-05-28 15:59:40, Info                  MOUPG  SetupHost: Attempting to initialize OneSettings values\n2026-05-28 15:59:40, Info                  MOUPG  OneSettings: OS [windows]\n2026-05-28 15:59:40, Info                  MOUPG  OneSettings: OsVer [10.0.19041.3803.amd64fre.vb_release.191206-1406]\n2026-05-28 15:59:40, Info                  MOUPG  OneSettings: ScenarioId [7]\n2026-05-28 15:59:40, Info                  MOUPG  OneSettings: EditionId [Professional]\n2026-05-28 15:59:40, Info                  MOUPG  OneSettings: InstallationType [Client]\n2026-05-28 15:59:40, Info                  MOUPG  OneSettings: Sku [48]\n2026-05-28 15:59:40, Info                  MOUPG  OneSettings: DeviceId [{088B0758-31C5-47D8-9C4B-32E98EB1AB80}]\n2026-05-28 15:59:40, Info                  CONX   Target OS version: 10.0.19041.572\n2026-05-28 15:59:40, Info                  MOUPG  OneSettings: AppVer [10.0.19041.572]\n2026-05-28 15:59:40, Info                  MOUPG  OneSettings: Branch [vb_release_svc_prod1]\n2026-05-28 15:59:41, Info                  MOUPG  OneSettings: Initialization succeeded, but no values found.\n2026-05-28 15:59:41, Info                  MOUPG  SetupHost: OneSettings Initialized -> [No]\n2026-05-28 15:59:41, Info                  MOUPG  SetupHost: Loading ID: [c7b6e4de-b741-42d8-ac05-16738c9e0bc5] from [C:\\$Windows.~WS\\Sources\\SetupMgr.dll]...\n2026-05-28 15:59:41, Info                  MOUPG  SetupHost: Loading complete.\n2026-05-28 15:59:41, Info                  MOUPG  SetupManager::Initialize: WorkingPath            = [C:\\$Windows.~WS\\Sources]\n2026-05-28 15:59:41, Info                  MOUPG  SetupManager::Initialize: MediaPath              = []\n2026-05-28 15:59:41, Info                  MOUPG  SetupManager::Initialize: InstallFilePath        = []\n2026-05-28 15:59:41, Info                  MOUPG  SetupManager::Initialize: ActionListFilePath     = []\n2026-05-28 15:59:41, Info                  MOUPG  SetupManager::Initialize: Mode                   = [0x8]\n2026-05-28 15:59:41, Info                  MOUPG  SetupManager::Initialize: Scenario               = [0x7]\n2026-05-28 15:59:41, Info                  MOUPG  SetupManager::Initialize: Flags                  = [0x800]\n2026-05-28 15:59:41, Info                  MOUPG  SetupManager: Working Directory:  [C:\\$Windows.~WS\\Sources]\n2026-05-28 15:59:41, Info                  MOUPG  SetupManager: Local Media Path:   [C:\\$Windows.~WS]\n2026-05-28 15:59:41, Info                  MOUPG  SetupManager: Scratch Path:       [C:\\$Windows.~WS\\Sources\\Panther]\n2026-05-28 15:59:41, Info                  MOUPG  SetupManager: ESD Download Path:  [C:\\ESD\\Download]\n2026-05-28 15:59:41, Info                  MOUPG  SetupManager: Media Path:         []\n2026-05-28 15:59:41, Info                  MOUPG  SetupManager: Drivers Path:       [C:\\$Windows.~WS\\Drivers]\n2026-05-28 15:59:41, Info                  MOUPG  SetupManager: LangPacks Path:     [C:\\$Windows.~WS\\LangPacks]\n2026-05-28 15:59:41, Info                  MOUPG  SetupCore::Initialize\n2026-05-28 15:59:41, Info                  MOUPG  SetupCore::RegisterSetupActions\n2026-05-28 15:59:41, Info                  MOUPG  SetupCore: Registered IMAGE_EXIT action\n2026-05-28 15:59:41, Info                  MOUPG  SetupCore: Registered DU_SETUP action\n2026-05-28 15:59:41, Info                  MOUPG  SetupCore: Registered DU_IMAGE action\n2026-05-28 15:59:41, Info                  MOUPG  SetupCore: Registered COMPAT_SYSREQ action\n2026-05-28 15:59:41, Info                  MOUPG  SetupCore: Registered COMPAT_GATED action\n2026-05-28 15:59:41, Info                  MOUPG  SetupCore: Registered COMPAT_DOWNLOADREQ action\n2026-05-28 15:59:41, Info                  MOUPG  SetupCore: Registered DISKSPACE_DOWNLOADREQ action\n2026-05-28 15:59:41, Info                  MOUPG  SetupCore: Registered DISKSPACE_INSTALLREQ action\n2026-05-28 15:59:41, Info                  MOUPG  SetupCore: Registered COMPAT_MIGCHOICE action\n2026-05-28 15:59:41, Info                  MOUPG  SetupCore: Registered PKEY_VALIDATE action\n2026-05-28 15:59:41, Info                  MOUPG  SetupCore: Registered EULA action\n2026-05-28 15:59:41, Info                  MOUPG  SetupCore: Registered COMPAT_INSTALLREQ action\n202 <trunc",
      "strings": [],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5932
    },
    {
      "name": [
        "WinDlp.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/26b66b81267dfda7a78890f20a4ed0d104db1cd350d2d9f649fdb496b6c11333",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\WinDlp.dll"
      ],
      "size": 1165624,
      "crc32": "F8E27C3A",
      "md5": "6f12ba2d5cb564f73d9813d105e5c1fe",
      "sha1": "b634e34149f99f4336efc0c5de5e850c61be48e1",
      "sha256": "26b66b81267dfda7a78890f20a4ed0d104db1cd350d2d9f649fdb496b6c11333",
      "sha512": "4462f38b0a4eca1d09eb747853cc15c804e2e42e91812604a0aef25de06d5fa5a5a4d79731aeb462f61ed46d63dd904d0a943919aabd5adb771f94c63e6a175a",
      "rh_hash": null,
      "ssdeep": "24576:sHChbi7VH3Cg3G49W4qjbuK5nwTShiPGm/ap:Bhbi7VHSCGF7wTDOzp",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T12A452A117FECDA5BF1B37A3166756222457EBA227E35C4CF02A0890D79B0A81DD3472B",
      "sha3_384": "a26b269d614bb978585d0c02ac30198cd0f1f39d84f4bec88624e5674eb9b9ccbbf3df6c9284db42f57d3e124918c331",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x000f16a0",
        "ep_bytes": "8bff558bec837d0c017505e845050000",
        "peid_signatures": null,
        "reported_checksum": "0x0011de38",
        "actual_checksum": "0x0011de38",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "WinDlp.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x100fc3b4",
                "name": "wcsnlen"
              },
              {
                "address": "0x100fc3b8",
                "name": "_ultow_s"
              },
              {
                "address": "0x100fc3bc",
                "name": "towupper"
              },
              {
                "address": "0x100fc3c0",
                "name": "strcpy_s"
              },
              {
                "address": "0x100fc3c4",
                "name": "_wcsupr"
              },
              {
                "address": "0x100fc3c8",
                "name": "strncmp"
              },
              {
                "address": "0x100fc3cc",
                "name": "iswspace"
              },
              {
                "address": "0x100fc3d0",
                "name": "memcpy_s"
              },
              {
                "address": "0x100fc3d4",
                "name": "swscanf_s"
              },
              {
                "address": "0x100fc3d8",
                "name": "wcsncmp"
              },
              {
                "address": "0x100fc3dc",
                "name": "_wcstoi64"
              },
              {
                "address": "0x100fc3e0",
                "name": "strncpy_s"
              },
              {
                "address": "0x100fc3e4",
                "name": "_strnicmp"
              },
              {
                "address": "0x100fc3e8",
                "name": "_wcsrev"
              },
              {
                "address": "0x100fc3ec",
                "name": "qsort"
              },
              {
                "address": "0x100fc3f0",
                "name": "wcstok_s"
              },
              {
                "address": "0x100fc3f4",
                "name": "bsearch"
              },
              {
                "address": "0x100fc3f8",
                "name": "memmove_s"
              },
              {
                "address": "0x100fc3fc",
                "name": "wcschr"
              },
              {
                "address": "0x100fc400",
                "name": "wcscpy_s"
              },
              {
                "address": "0x100fc404",
                "name": "_snwscanf_s"
              },
              {
                "address": "0x100fc408",
                "name": "_wcstoui64"
              },
              {
                "address": "0x100fc40c",
                "name": "_purecall"
              },
              {
                "address": "0x100fc410",
                "name": "wcstoul"
              },
              {
                "address": "0x100fc414",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x100fc418",
                "name": "_wcslwr"
              },
              {
                "address": "0x100fc41c",
                "name": "iswalpha"
              },
              {
                "address": "0x100fc420",
                "name": "_vscwprintf"
              },
              {
                "address": "0x100fc424",
                "name": "_wtoi"
              },
              {
                "address": "0x100fc428",
                "name": "__iob_func"
              },
              {
                "address": "0x100fc42c",
                "name": "wcsstr"
              },
              {
                "address": "0x100fc430",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x100fc434",
                "name": "memmove"
              },
              {
                "address": "0x100fc438",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x100fc43c",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x100fc440",
                "name": "_onexit"
              },
              {
                "address": "0x100fc444",
                "name": "__dllonexit"
              },
              {
                "address": "0x100fc448",
                "name": "_unlock"
              },
              {
                "address": "0x100fc44c",
                "name": "_lock"
              },
              {
                "address": "0x100fc450",
                "name": "_initterm"
              },
              {
                "address": "0x100fc454",
                "name": "malloc"
              },
              {
                "address": "0x100fc458",
                "name": "free"
              },
              {
                "address": "0x100fc45c",
                "name": "_amsg_exit"
              },
              {
                "address": "0x100fc460",
                "name": "_XcptFilter"
              },
              {
                "address": "0x100fc464",
                "name": "_wcsicmp"
              },
              {
                "address": "0x100fc468",
                "name": "wcsrchr"
              },
              {
                "address": "0x100fc46c",
                "name": "fflush"
              },
              {
                "address": "0x100fc470",
                "name": "_vsnwprintf_s"
              },
              {
                "address": "0x100fc474",
                "name": "fwprintf"
              },
              {
                "address": "0x100fc478",
                "name": "swprintf_s"
              },
              {
                "address": "0x100fc47c",
                "name": "memcpy"
              },
              {
                "address": "0x100fc480",
                "name": "memcmp"
              },
              {
                "address": "0x100fc484",
                "name": "_ftol2_sse"
              },
              {
                "address": "0x100fc488",
                "name": "_ftol2"
              },
              {
                "address": "0x100fc48c",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x100fc490",
                "name": "wcscat_s"
              },
              {
                "address": "0x100fc494",
                "name": "memset"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x100fc0ec",
                "name": "GetVolumePathNamesForVolumeNameW"
              },
              {
                "address": "0x100fc0f0",
                "name": "SetFileTime"
              },
              {
                "address": "0x100fc0f4",
                "name": "LocalFileTimeToFileTime"
              },
              {
                "address": "0x100fc0f8",
                "name": "DosDateTimeToFileTime"
              },
              {
                "address": "0x100fc0fc",
                "name": "MultiByteToWideChar"
              },
              {
                "address": "0x100fc100",
                "name": "TlsSetValue"
              },
              {
                "address": "0x100fc104",
                "name": "TlsGetValue"
              },
              {
                "address": "0x100fc108",
                "name": "CompareStringW"
              },
              {
                "address": "0x100fc10c",
                "name": "SetPriorityClass"
              },
              {
                "address": "0x100fc110",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x100fc114",
                "name": "GetFullPathNameW"
              },
              {
                "address": "0x100fc118",
                "name": "WriteFile"
              },
              {
                "address": "0x100fc11c",
                "name": "WaitForMultipleObjects"
              },
              {
                "address": "0x100fc120",
                "name": "SetThreadPriority"
              },
              {
                "address": "0x100fc124",
                "name": "InitializeCriticalSectionAndSpinCount"
              },
              {
                "address": "0x100fc128",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x100fc12c",
                "name": "SetEndOfFile"
              },
              {
                "address": "0x100fc130",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x100fc134",
                "name": "CreateFileW"
              },
              {
                "address": "0x100fc138",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x100fc13c",
                "name": "CreateEventW"
              },
              {
                "address": "0x100fc140",
                "name": "GetExitCodeThread"
              },
              {
                "address": "0x100fc144",
                "name": "FormatMessageW"
              },
              {
                "address": "0x100fc148",
                "name": "GetTimeZoneInformation"
              },
              {
                "address": "0x100fc14c",
                "name": "GetLastError"
              },
              {
                "address": "0x100fc150",
                "name": "TlsFree"
              },
              {
                "address": "0x100fc154",
                "name": "SetEvent"
              },
              {
                "address": "0x100fc158",
                "name": "GetCurrentThread"
              },
              {
                "address": "0x100fc15c",
                "name": "GetThreadPriority"
              },
              {
                "address": "0x100fc160",
                "name": "DeleteFileW"
              },
              {
                "address": "0x100fc164",
                "name": "GlobalFree"
              },
              {
                "address": "0x100fc168",
                "name": "CloseHandle"
              },
              {
                "address": "0x100fc16c",
                "name": "CreateThread"
              },
              {
                "address": "0x100fc170",
                "name": "ResetEvent"
              },
              {
                "address": "0x100fc174",
                "name": "GetPriorityClass"
              },
              {
                "address": "0x100fc178",
                "name": "SetFilePointerEx"
              },
              {
                "address": "0x100fc17c",
                "name": "LocalFree"
              },
              {
                "address": "0x100fc180",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x100fc184",
                "name": "SystemTimeToTzSpecificLocalTime"
              },
              {
                "address": "0x100fc188",
                "name": "GetSystemTime"
              },
              {
                "address": "0x100fc18c",
                "name": "lstrcmpW"
              },
              {
                "address": "0x100fc190",
                "name": "VirtualQuery"
              },
              {
                "address": "0x100fc194",
                "name": "IsDebuggerPresent"
              },
              {
                "address": "0x100fc198",
                "name": "FlushFileBuffers"
              },
              {
                "address": "0x100fc19c",
                "name": "CreateDirectoryW"
              },
              {
                "address": "0x100fc1a0",
                "name": "ReadFile"
              },
              {
                "address": "0x100fc1a4",
                "name": "GetVolumeInformationW"
              },
              {
                "address": "0x100fc1a8",
                "name": "FindFirstFileW"
              },
              {
                "address": "0x100fc1ac",
                "name": "GetFileSizeEx"
              },
              {
                "address": "0x100fc1b0",
                "name": "SetLastError"
              },
              {
                "address": "0x100fc1b4",
                "name": "FindNextFileW"
              },
              {
                "address": "0x100fc1b8",
                "name": "RemoveDirectoryW"
              },
              {
                "address": "0x100fc1bc",
                "name": "SetErrorMode"
              },
              {
                "address": "0x100fc1c0",
                "name": "WriteFileEx"
              },
              {
                "address": "0x100fc1c4",
                "name": "GetTempPathW"
              },
              {
                "address": "0x100fc1c8",
                "name": "FindClose"
              },
              {
                "address": "0x100fc1cc",
                "name": "GetVolumePathNameW"
              },
              {
                "address": "0x100fc1d0",
                "name": "LocalAlloc"
              },
              {
                "address": "0x100fc1d4",
                "name": "GetVolumeNameForVolumeMountPointW"
              },
              {
                "address": "0x100fc1d8",
                "name": "SetFileAttributesW"
              },
              {
                "address": "0x100fc1dc",
                "name": "SetVolumeLabelW"
              },
              {
                "address": "0x100fc1e0",
                "name": "ReadFileEx"
              },
              {
                "address": "0x100fc1e4",
                "name": "LoadLibraryW"
              },
              {
                "address": "0x100fc1e8",
                "name": "MoveFileExW"
              },
              {
                "address": "0x100fc1ec",
                "name": "CopyFileW"
              },
              {
                "address": "0x100fc1f0",
                "name": "GetTempFileNameW"
              },
              {
                "address": "0x100fc1f4",
                "name": "GetSystemWindowsDirectoryW"
              },
              {
                "address": "0x100fc1f8",
                "name": "QueryDosDeviceW"
              },
              {
                "address": "0x100fc1fc",
                "name": "DeviceIoControl"
              },
              {
                "address": "0x100fc200",
                "name": "UnmapViewOfFile"
              },
              {
                "address": "0x100fc204",
                "name": "CreateFileMappingW"
              },
              {
                "address": "0x100fc208",
                "name": "MapViewOfFile"
              },
              {
                "address": "0x100fc20c",
                "name": "GetPrivateProfileSectionW"
              },
              {
                "address": "0x100fc210",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x100fc214",
                "name": "FreeLibrary"
              },
              {
                "address": "0x100fc218",
                "name": "GetLongPathNameW"
              },
              {
                "address": "0x100fc21c",
                "name": "GetFinalPathNameByHandleW"
              },
              {
                "address": "0x100fc220",
                "name": "GetCurrentDirectoryW"
              },
              {
                "address": "0x100fc224",
                "name": "GetDriveTypeW"
              },
              {
                "address": "0x100fc228",
                "name": "GetFileInformationByHandleEx"
              },
              {
                "address": "0x100fc22c",
                "name": "GetFileInformationByHandle"
              },
              {
                "address": "0x100fc230",
                "name": "SetFileInformationByHandle"
              },
              {
                "address": "0x100fc234",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x100fc238",
                "name": "CopyFileExW"
              },
              {
                "address": "0x100fc23c",
                "name": "ExpandEnvironmentStringsW"
              },
              {
                "address": "0x100fc240",
                "name": "GetEnvironmentVariableW"
              },
              {
                "address": "0x100fc244",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x100fc248",
                "name": "GetSystemDirectoryW"
              },
              {
                "address": "0x100fc24c",
                "name": "VirtualAlloc"
              },
              {
                "address": "0x100fc250",
                "name": "VirtualFree"
              },
              {
                "address": "0x100fc254",
                "name": "TlsAlloc"
              },
              {
                "address": "0x100fc258",
                "name": "WaitForMultipleObjectsEx"
              },
              {
                "address": "0x100fc25c",
                "name": "CreateSemaphoreExW"
              },
              {
                "address": "0x100fc260",
                "name": "GlobalMemoryStatusEx"
              },
              {
                "address": "0x100fc264",
                "name": "GetVolumeInformationByHandleW"
              },
              {
                "address": "0x100fc268",
                "name": "CreateSemaphoreW"
              },
              {
                "address": "0x100fc26c",
                "name": "ReleaseSemaphore"
              },
              {
                "address": "0x100fc270",
                "name": "DuplicateHandle"
              },
              {
                "address": "0x100fc274",
                "name": "OpenProcess"
              },
              {
                "address": "0x100fc278",
                "name": "TerminateProcess"
              },
              {
                "address": "0x100fc27c",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x100fc280",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x100fc284",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x100fc288",
                "name": "GetTickCount"
              },
              {
                "address": "0x100fc28c",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x100fc290",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x100fc294",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x100fc298",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x100fc29c",
                "name": "Sleep"
              },
              {
                "address": "0x100fc2a0",
                "name": "DisableThreadLibraryCalls"
              },
              {
                "address": "0x100fc2a4",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x100fc2a8",
                "name": "GetProcAddress"
              },
              {
                "address": "0x100fc2ac",
                "name": "HeapAlloc"
              },
              {
                "address": "0x100fc2b0",
                "name": "GetModuleHandleExW"
              },
              {
                "address": "0x100fc2b4",
                "name": "HeapFree"
              },
              {
                "address": "0x100fc2b8",
                "name": "WideCharToMultiByte"
              },
              {
                "address": "0x100fc2bc",
                "name": "GetFileSize"
              },
              {
                "address": "0x100fc2c0",
                "name": "SetThreadIdealProcessor"
              },
              {
                "address": "0x100fc2c4",
                "name": "GetSystemInfo"
              },
              {
                "address": "0x100fc2c8",
                "name": "UnlockFileEx"
              },
              {
                "address": "0x100fc2cc",
                "name": "LockFileEx"
              },
              {
                "address": "0x100fc2d0",
                "name": "SetFilePointer"
              },
              {
                "address": "0x100fc2d4",
                "name": "HeapReAlloc"
              },
              {
                "address": "0x100fc2d8",
                "name": "GetOverlappedResult"
              },
              {
                "address": "0x100fc2dc",
                "name": "GetHandleInformation"
              },
              {
                "address": "0x100fc2e0",
                "name": "OutputDebugStringW"
              }
            ]
          },
          "RPCRT4": {
            "dll": "RPCRT4.dll",
            "imports": [
              {
                "address": "0x100fc30c",
                "name": "UuidToStringW"
              },
              {
                "address": "0x100fc310",
                "name": "I_RpcMapWin32Status"
              },
              {
                "address": "0x100fc314",
                "name": "RpcStringFreeW"
              },
              {
                "address": "0x100fc318",
                "name": "UuidFromStringW"
              },
              {
                "address": "0x100fc31c",
                "name": "UuidCreate"
              }
            ]
          },
          "imagehlp": {
            "dll": "imagehlp.dll",
            "imports": [
              {
                "address": "0x100fc3ac",
                "name": "CheckSumMappedFile"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x100fc49c",
                "name": "ZwReleaseMutant"
              },
              {
                "address": "0x100fc4a0",
                "name": "ZwOpenMutant"
              },
              {
                "address": "0x100fc4a4",
                "name": "ZwCreateKey"
              },
              {
                "address": "0x100fc4a8",
                "name": "ZwLoadKey"
              },
              {
                "address": "0x100fc4ac",
                "name": "ZwDeleteValueKey"
              },
              {
                "address": "0x100fc4b0",
                "name": "ZwDeleteKey"
              },
              {
                "address": "0x100fc4b4",
                "name": "ZwEnumerateKey"
              },
              {
                "address": "0x100fc4b8",
                "name": "ZwQueryValueKey"
              },
              {
                "address": "0x100fc4bc",
                "name": "ZwSetSecurityObject"
              },
              {
                "address": "0x100fc4c0",
                "name": "ZwUnloadKey"
              },
              {
                "address": "0x100fc4c4",
                "name": "ZwSetValueKey"
              },
              {
                "address": "0x100fc4c8",
                "name": "ZwOpenKey"
              },
              {
                "address": "0x100fc4cc",
                "name": "ZwAllocateUuids"
              },
              {
                "address": "0x100fc4d0",
                "name": "LdrGetProcedureAddress"
              },
              {
                "address": "0x100fc4d4",
                "name": "LdrGetDllHandle"
              },
              {
                "address": "0x100fc4d8",
                "name": "ZwQueryInformationProcess"
              },
              {
                "address": "0x100fc4dc",
                "name": "RtlInitAnsiString"
              },
              {
                "address": "0x100fc4e0",
                "name": "ZwQueryInformationFile"
              },
              {
                "address": "0x100fc4e4",
                "name": "ZwOpenProcess"
              },
              {
                "address": "0x100fc4e8",
                "name": "ZwQuerySymbolicLinkObject"
              },
              {
                "address": "0x100fc4ec",
                "name": "ZwDeviceIoControlFile"
              },
              {
                "address": "0x100fc4f0",
                "name": "ZwQueryDirectoryObject"
              },
              {
                "address": "0x100fc4f4",
                "name": "ZwOpenSymbolicLinkObject"
              },
              {
                "address": "0x100fc4f8",
                "name": "ZwOpenDirectoryObject"
              },
              {
                "address": "0x100fc4fc",
                "name": "RtlReAllocateHeap"
              },
              {
                "address": "0x100fc500",
                "name": "RtlExpandEnvironmentStrings"
              },
              {
                "address": "0x100fc504",
                "name": "RtlRaiseStatus"
              },
              {
                "address": "0x100fc508",
                "name": "NtYieldExecution"
              },
              {
                "address": "0x100fc50c",
                "name": "DbgPrintEx"
              },
              {
                "address": "0x100fc510",
                "name": "RtlDowncaseUnicodeChar"
              },
              {
                "address": "0x100fc514",
                "name": "RtlGetLastNtStatus"
              },
              {
                "address": "0x100fc518",
                "name": "RtlSetControlSecurityDescriptor"
              },
              {
                "address": "0x100fc51c",
                "name": "RtlFindAceByType"
              },
              {
                "address": "0x100fc520",
                "name": "NtQueryDirectoryFile"
              },
              {
                "address": "0x100fc524",
                "name": "NtQueryVolumeInformationFile"
              },
              {
                "address": "0x100fc528",
                "name": "NtQueryEaFile"
              },
              {
                "address": "0x100fc52c",
                "name": "RtlInitializeResource"
              },
              {
                "address": "0x100fc530",
                "name": "RtlAcquireResourceExclusive"
              },
              {
                "address": "0x100fc534",
                "name": "ZwQueryKey"
              },
              {
                "address": "0x100fc538",
                "name": "RtlReleaseResource"
              },
              {
                "address": "0x100fc53c",
                "name": "RtlDeleteResource"
              },
              {
                "address": "0x100fc540",
                "name": "NtSetEaFile"
              },
              {
                "address": "0x100fc544",
                "name": "NtUnloadKey2"
              },
              {
                "address": "0x100fc548",
                "name": "ZwQueryAttributesFile"
              },
              {
                "address": "0x100fc54c",
                "name": "RtlAppendUnicodeToString"
              },
              {
                "address": "0x100fc550",
                "name": "ZwClose"
              },
              {
                "address": "0x100fc554",
                "name": "ZwOpenFile"
              },
              {
                "address": "0x100fc558",
                "name": "RtlStringFromGUID"
              },
              {
                "address": "0x100fc55c",
                "name": "RtlFreeUnicodeString"
              },
              {
                "address": "0x100fc560",
                "name": "RtlGUIDFromString"
              },
              {
                "address": "0x100fc564",
                "name": "ZwQuerySystemInformation"
              },
              {
                "address": "0x100fc568",
                "name": "RtlImpersonateSelf"
              },
              {
                "address": "0x100fc56c",
                "name": "NtOpenThreadTokenEx"
              },
              {
                "address": "0x100fc570",
                "name": "NtOpenProcessTokenEx"
              },
              {
                "address": "0x100fc574",
                "name": "NtAdjustPrivilegesToken"
              },
              {
                "address": "0x100fc578",
                "name": "NtEnumerateBootEntries"
              },
              {
                "address": "0x100fc57c",
                "name": "NtTranslateFilePath"
              },
              {
                "address": "0x100fc580",
                "name": "NtSetSecurityObject"
              },
              {
                "address": "0x100fc584",
                "name": "NtQueryBootOptions"
              },
              {
                "address": "0x100fc588",
                "name": "NtQueryBootEntryOrder"
              },
              {
                "address": "0x100fc58c",
                "name": "RtlCreateSecurityDescriptor"
              },
              {
                "address": "0x100fc590",
                "name": "RtlCreateAcl"
              },
              {
                "address": "0x100fc594",
                "name": "RtlFreeSid"
              },
              {
                "address": "0x100fc598",
                "name": "RtlLengthSid"
              },
              {
                "address": "0x100fc59c",
                "name": "RtlAllocateAndInitializeSid"
              },
              {
                "address": "0x100fc5a0",
                "name": "RtlAddAccessAllowedAceEx"
              },
              {
                "address": "0x100fc5a4",
                "name": "NtQuerySymbolicLinkObject"
              },
              {
                "address": "0x100fc5a8",
                "name": "RtlSetDaclSecurityDescriptor"
              },
              {
                "address": "0x100fc5ac",
                "name": "NtOpenSymbolicLinkObject"
              },
              {
                "address": "0x100fc5b0",
                "name": "RtlSetOwnerSecurityDescriptor"
              },
              {
                "address": "0x100fc5b4",
                "name": "RtlLengthSecurityDescriptor"
              },
              {
                "address": "0x100fc5b8",
                "name": "NtQueryValueKey"
              },
              {
                "address": "0x100fc5bc",
                "name": "NtOpenKey"
              },
              {
                "address": "0x100fc5c0",
                "name": "RtlCompareMemory"
              },
              {
                "address": "0x100fc5c4",
                "name": "RtlSetThreadErrorMode"
              },
              {
                "address": "0x100fc5c8",
                "name": "RtlGetThreadErrorMode"
              },
              {
                "address": "0x100fc5cc",
                "name": "RtlFreeHeap"
              },
              {
                "address": "0x100fc5d0",
                "name": "NtQueryDirectoryObject"
              },
              {
                "address": "0x100fc5d4",
                "name": "NtOpenDirectoryObject"
              },
              {
                "address": "0x100fc5d8",
                "name": "NtSetInformationFile"
              },
              {
                "address": "0x100fc5dc",
                "name": "RtlDosPathNameToNtPathName_U_WithStatus"
              },
              {
                "address": "0x100fc5e0",
                "name": "RtlAcquireResourceShared"
              },
              {
                "address": "0x100fc5e4",
                "name": "NtSetInformationThread"
              },
              {
                "address": "0x100fc5e8",
                "name": "RtlAdjustPrivilege"
              },
              {
                "address": "0x100fc5ec",
                "name": "RtlGetVersion"
              },
              {
                "address": "0x100fc5f0",
                "name": "NtShutdownSystem"
              },
              {
                "address": "0x100fc5f4",
                "name": "NtSetInformationProcess"
              },
              {
                "address": "0x100fc5f8",
                "name": "LdrAccessResource"
              },
              {
                "address": "0x100fc5fc",
                "name": "LdrFindResource_U"
              },
              {
                "address": "0x100fc600",
                "name": "NtCreateFile"
              },
              {
                "address": "0x100fc604",
                "name": "NtQuerySystemInformation"
              },
              {
                "address": "0x100fc608",
                "name": "NtOpenFile"
              },
              {
                "address": "0x100fc60c",
                "name": "NtWaitForSingleObject"
              },
              {
                "address": "0x100fc610",
                "name": "RtlNtStatusToDosError"
              },
              {
                "address": "0x100fc614",
                "name": "NtQueryInformationThread"
              },
              {
                "address": "0x100fc618",
                "name": "NtQueryInformationFile"
              },
              {
                "address": "0x100fc61c",
                "name": "NtClose"
              },
              {
                "address": "0x100fc620",
                "name": "RtlImageNtHeader"
              },
              {
                "address": "0x100fc624",
                "name": "NtDeviceIoControlFile"
              },
              {
                "address": "0x100fc628",
                "name": "NtReadFile"
              },
              {
                "address": "0x100fc62c",
                "name": "NtOpenProcess"
              },
              {
                "address": "0x100fc630",
                "name": "NtQueryInformationProcess"
              },
              {
                "address": "0x100fc634",
                "name": "NtWriteFile"
              },
              {
                "address": "0x100fc638",
                "name": "RtlDosPathNameToNtPathName_U"
              },
              {
                "address": "0x100fc63c",
                "name": "RtlInitUnicodeString"
              },
              {
                "address": "0x100fc640",
                "name": "RtlAllocateHeap"
              },
              {
                "address": "0x100fc644",
                "name": "ZwWaitForSingleObject"
              }
            ]
          },
          "WINHTTP": {
            "dll": "WINHTTP.dll",
            "imports": [
              {
                "address": "0x100fc34c",
                "name": "WinHttpCrackUrl"
              },
              {
                "address": "0x100fc350",
                "name": "WinHttpConnect"
              },
              {
                "address": "0x100fc354",
                "name": "WinHttpReceiveResponse"
              },
              {
                "address": "0x100fc358",
                "name": "WinHttpQueryDataAvailable"
              },
              {
                "address": "0x100fc35c",
                "name": "WinHttpSendRequest"
              },
              {
                "address": "0x100fc360",
                "name": "WinHttpGetProxyForUrl"
              },
              {
                "address": "0x100fc364",
                "name": "WinHttpGetIEProxyConfigForCurrentUser"
              },
              {
                "address": "0x100fc368",
                "name": "WinHttpCloseHandle"
              },
              {
                "address": "0x100fc36c",
                "name": "WinHttpSetOption"
              },
              {
                "address": "0x100fc370",
                "name": "WinHttpOpenRequest"
              },
              {
                "address": "0x100fc374",
                "name": "WinHttpReadData"
              },
              {
                "address": "0x100fc378",
                "name": "WinHttpQueryHeaders"
              },
              {
                "address": "0x100fc37c",
                "name": "WinHttpAddRequestHeaders"
              },
              {
                "address": "0x100fc380",
                "name": "WinHttpOpen"
              },
              {
                "address": "0x100fc384",
                "name": "WinHttpSetTimeouts"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x100fc000",
                "name": "GetSecurityDescriptorSacl"
              },
              {
                "address": "0x100fc004",
                "name": "AdjustTokenPrivileges"
              },
              {
                "address": "0x100fc008",
                "name": "GetSecurityDescriptorDacl"
              },
              {
                "address": "0x100fc00c",
                "name": "GetSecurityDescriptorGroup"
              },
              {
                "address": "0x100fc010",
                "name": "SetNamedSecurityInfoW"
              },
              {
                "address": "0x100fc014",
                "name": "GetSecurityDescriptorControl"
              },
              {
                "address": "0x100fc018",
                "name": "GetSecurityDescriptorOwner"
              },
              {
                "address": "0x100fc01c",
                "name": "ConvertSidToStringSidW"
              },
              {
                "address": "0x100fc020",
                "name": "ConvertStringSecurityDescriptorToSecurityDescriptorW"
              },
              {
                "address": "0x100fc024",
                "name": "RegCloseKey"
              },
              {
                "address": "0x100fc028",
                "name": "RegSetValueExW"
              },
              {
                "address": "0x100fc02c",
                "name": "RegOpenKeyExW"
              },
              {
                "address": "0x100fc030",
                "name": "RegGetValueW"
              },
              {
                "address": "0x100fc034",
                "name": "CryptDestroyKey"
              },
              {
                "address": "0x100fc038",
                "name": "CryptGetUserKey"
              },
              {
                "address": "0x100fc03c",
                "name": "CryptGetKeyParam"
              },
              {
                "address": "0x100fc040",
                "name": "CryptAcquireContextW"
              },
              {
                "address": "0x100fc044",
                "name": "CryptEncrypt"
              },
              {
                "address": "0x100fc048",
                "name": "CryptDecrypt"
              },
              {
                "address": "0x100fc04c",
                "name": "CryptExportKey"
              },
              {
                "address": "0x100fc050",
                "name": "CryptSetKeyParam"
              },
              {
                "address": "0x100fc054",
                "name": "CryptImportKey"
              },
              {
                "address": "0x100fc058",
                "name": "CryptGenKey"
              },
              {
                "address": "0x100fc05c",
                "name": "CryptReleaseContext"
              },
              {
                "address": "0x100fc060",
                "name": "AllocateAndInitializeSid"
              },
              {
                "address": "0x100fc064",
                "name": "CopySid"
              },
              {
                "address": "0x100fc068",
                "name": "OpenProcessToken"
              },
              {
                "address": "0x100fc06c",
                "name": "FreeSid"
              },
              {
                "address": "0x100fc070",
                "name": "InitializeAcl"
              },
              {
                "address": "0x100fc074",
                "name": "SetSecurityInfo"
              },
              {
                "address": "0x100fc078",
                "name": "GetLengthSid"
              },
              {
                "address": "0x100fc07c",
                "name": "InitiateSystemShutdownExW"
              },
              {
                "address": "0x100fc080",
                "name": "AddAccessAllowedAce"
              },
              {
                "address": "0x100fc084",
                "name": "OpenThreadToken"
              },
              {
                "address": "0x100fc088",
                "name": "GetTokenInformation"
              },
              {
                "address": "0x100fc08c",
                "name": "LookupPrivilegeValueW"
              },
              {
                "address": "0x100fc090",
                "name": "RegQueryValueExW"
              },
              {
                "address": "0x100fc094",
                "name": "RegEnumValueW"
              },
              {
                "address": "0x100fc098",
                "name": "RegEnumKeyExW"
              },
              {
                "address": "0x100fc09c",
                "name": "RegCreateKeyExW"
              },
              {
                "address": "0x100fc0a0",
                "name": "RegFlushKey"
              },
              {
                "address": "0x100fc0a4",
                "name": "RegLoadKeyW"
              },
              {
                "address": "0x100fc0a8",
                "name": "RegUnLoadKeyW"
              },
              {
                "address": "0x100fc0ac",
                "name": "GetSecurityDescriptorLength"
              },
              {
                "address": "0x100fc0b0",
                "name": "GetAclInformation"
              },
              {
                "address": "0x100fc0b4",
                "name": "SetThreadToken"
              },
              {
                "address": "0x100fc0b8",
                "name": "DuplicateTokenEx"
              },
              {
                "address": "0x100fc0bc",
                "name": "RegQueryInfoKeyW"
              },
              {
                "address": "0x100fc0c0",
                "name": "ReadEncryptedFileRaw"
              },
              {
                "address": "0x100fc0c4",
                "name": "CloseEncryptedFileRaw"
              },
              {
                "address": "0x100fc0c8",
                "name": "WriteEncryptedFileRaw"
              },
              {
                "address": "0x100fc0cc",
                "name": "OpenEncryptedFileRawW"
              },
              {
                "address": "0x100fc0d0",
                "name": "RevertToSelf"
              },
              {
                "address": "0x100fc0d4",
                "name": "GetSecurityInfo"
              }
            ]
          },
          "USER32": {
            "dll": "USER32.dll",
            "imports": [
              {
                "address": "0x100fc330",
                "name": "CharUpperW"
              },
              {
                "address": "0x100fc334",
                "name": "LoadStringW"
              }
            ]
          },
          "ole32": {
            "dll": "ole32.dll",
            "imports": [
              {
                "address": "0x100fc64c",
                "name": "CoTaskMemFree"
              },
              {
                "address": "0x100fc650",
                "name": "CoSetProxyBlanket"
              },
              {
                "address": "0x100fc654",
                "name": "CoInitializeEx"
              },
              {
                "address": "0x100fc658",
                "name": "CoCreateInstance"
              },
              {
                "address": "0x100fc65c",
                "name": "CoUninitialize"
              }
            ]
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x100fc2e8",
                "name": "SysAllocStringLen"
              },
              {
                "address": "0x100fc2ec",
                "name": "SysAllocString"
              },
              {
                "address": "0x100fc2f0",
                "name": "VariantClear"
              },
              {
                "address": "0x100fc2f4",
                "name": "SafeArrayDestroy"
              },
              {
                "address": "0x100fc2f8",
                "name": "VariantInit"
              },
              {
                "address": "0x100fc2fc",
                "name": "SafeArrayPutElement"
              },
              {
                "address": "0x100fc300",
                "name": "SafeArrayCreateVector"
              },
              {
                "address": "0x100fc304",
                "name": "SysFreeString"
              }
            ]
          },
          "SHLWAPI": {
            "dll": "SHLWAPI.dll",
            "imports": [
              {
                "address": "0x100fc324",
                "name": "PathRemoveBackslashW"
              },
              {
                "address": "0x100fc328",
                "name": "SHCreateStreamOnFileW"
              }
            ]
          },
          "Cabinet": {
            "dll": "Cabinet.dll",
            "imports": []
          },
          "bcrypt": {
            "dll": "bcrypt.dll",
            "imports": [
              {
                "address": "0x100fc38c",
                "name": "BCryptGetProperty"
              },
              {
                "address": "0x100fc390",
                "name": "BCryptDestroyHash"
              },
              {
                "address": "0x100fc394",
                "name": "BCryptHashData"
              },
              {
                "address": "0x100fc398",
                "name": "BCryptCreateHash"
              },
              {
                "address": "0x100fc39c",
                "name": "BCryptCloseAlgorithmProvider"
              },
              {
                "address": "0x100fc3a0",
                "name": "BCryptFinishHash"
              },
              {
                "address": "0x100fc3a4",
                "name": "BCryptOpenAlgorithmProvider"
              }
            ]
          },
          "VERSION": {
            "dll": "VERSION.dll",
            "imports": [
              {
                "address": "0x100fc33c",
                "name": "GetFileVersionInfoSizeExW"
              },
              {
                "address": "0x100fc340",
                "name": "GetFileVersionInfoExW"
              },
              {
                "address": "0x100fc344",
                "name": "VerQueryValueW"
              }
            ]
          }
        },
        "exported_dll_name": "WINDLP.DLL",
        "exports": [
          {
            "address": "0x10076060",
            "name": "CreateDlpManager",
            "ordinal": 1
          },
          {
            "address": "0x100563d0",
            "name": "CreateDlpRegistrar",
            "ordinal": 2
          },
          {
            "address": "0x100311a0",
            "name": "DllMain",
            "ordinal": 3
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x000fa7d0",
            "size": "0x0000007d"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x000fc668",
            "size": "0x0000012c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x000ff000",
            "size": "0x0001434c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x0011a800",
            "size": "0x00002138"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x00114000",
            "size": "0x00009548"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x00030920",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x000038a8",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x000fc000",
            "size": "0x00000664"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x000f984d",
            "size_of_data": "0x000f9a00",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.44"
          },
          {
            "name": ".data",
            "raw_address": "0x000f9e00",
            "virtual_address": "0x000fb000",
            "virtual_size": "0x00000de4",
            "size_of_data": "0x00000400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "3.68"
          },
          {
            "name": ".idata",
            "raw_address": "0x000fa200",
            "virtual_address": "0x000fc000",
            "virtual_size": "0x00002bf6",
            "size_of_data": "0x00002c00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.79"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x000fce00",
            "virtual_address": "0x000ff000",
            "virtual_size": "0x00015000",
            "size_of_data": "0x00014400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "4.23"
          },
          {
            "name": ".reloc",
            "raw_address": "0x00111200",
            "virtual_address": "0x00114000",
            "virtual_size": "0x00009548",
            "size_of_data": "0x00009600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.80"
          }
        ],
        "overlay": {
          "offset": "0x0011a800",
          "size": "0x00002138"
        },
        "resources": [
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x000ff460",
            "size": "0x000004b0",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.64"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x000ff910",
            "size": "0x00000b84",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.61"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x00100494",
            "size": "0x00000be4",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.33"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x00101078",
            "size": "0x00000e1c",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.37"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x00101e94",
            "size": "0x00000e38",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.94"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x00102ccc",
            "size": "0x00000bcc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.32"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x00103898",
            "size": "0x00000bac",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.32"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x00104444",
            "size": "0x00000cf8",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.38"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x0010513c",
            "size": "0x00000b38",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.53"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x00105c74",
            "size": "0x00000d48",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.31"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001069bc",
            "size": "0x00000728",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.95"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001070e4",
            "size": "0x000006f0",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.17"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001077d4",
            "size": "0x00000d00",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.30"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001084d4",
            "size": "0x00000c1c",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.32"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x001090f0",
            "size": "0x00000b70",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.59"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x00109c60",
            "size": "0x00000c9c",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.36"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x0010a8fc",
            "size": "0x00000bf8",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.91"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x0010b4f4",
            "size": "0x00000bdc",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.37"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x0010c0d0",
            "size": "0x00000a8c",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x0010cb5c",
            "size": "0x000004b8",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.48"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x0010d014",
            "size": "0x00000cd0",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.34"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x0010dce4",
            "size": "0x00000d28",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.30"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x0010ea0c",
            "size": "0x00000380",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.55"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x0010ed8c",
            "size": "0x0000039c",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x0010f128",
            "size": "0x000003a8",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.51"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x0010f4d0",
            "size": "0x0000039c",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.53"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x0010f86c",
            "size": "0x000003bc",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.03"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x0010fc28",
            "size": "0x000003a0",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.50"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x0010ffc8",
            "size": "0x000003ac",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.54"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00110374",
            "size": "0x000003c4",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.53"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00110738",
            "size": "0x000003a4",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.51"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00110adc",
            "size": "0x000003ac",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.48"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00110e88",
            "size": "0x000003a4",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.52"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x0011122c",
            "size": "0x00000390",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.49"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x001115bc",
            "size": "0x000003c0",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x0011197c",
            "size": "0x000003c0",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.48"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00111d3c",
            "size": "0x000003d8",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.92"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00112114",
            "size": "0x0000039c",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.51"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x001124b0",
            "size": "0x00000398",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00112848",
            "size": "0x00000380",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.56"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00112bc8",
            "size": "0x000003c8",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.49"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00112f90",
            "size": "0x000003bc",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.50"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 下載平台"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0404 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows Download Platform"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Všechna práva vyhrazena."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Operační systém Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0405 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows Download Platform"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Alle rettigheder forbeholdes."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operativsystem"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0406 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows-Downloadplattform"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Alle Rechte vorbehalten."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Betriebssystem Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0407 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Πλατφόρμα λήψης Windows"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Με επιφύλαξη κάθε νόμιμου δικαιώματος."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Λειτουργικό σύστημα Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0408 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows Download Platform"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windowsin latausympäristö"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Kaikki oikeudet pidätetään."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® -käyttöjärjestelmä"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x040b 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Plateforme de téléchargement de Windows"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Tous droits réservés."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Système d’exploitation Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x040c 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows letöltési platform"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Minden jog fenntartva."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® operációs rendszer"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x040e 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Piattaforma download Windows"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Tutti i diritti riservati."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Sistema operativo Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0410 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows-downloadplatform"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Alle rechten voorbehouden."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows®-besturingssysteem"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0413 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows Nedlastingsplattform"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Med enerett."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Operativsystemet Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0414 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Platforma pobierania systemu Windows"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Wszelkie prawa zastrzeżone."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "System operacyjny Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0415 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Plataforma de Download do Windows"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Todos os direitos reservados."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Sistema Operacional Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0416 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Платформа скачивания Windows"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Корпорация Майкрософт (Microsoft Corporation). Все права защищены."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Операционная система Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0419 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Plattform för Windows-nedladdning"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Med ensamrätt."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Operativsystemet Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x041d 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows Ä°ndirme Platformu"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Tüm hakları saklıdır."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® İşletim Sistemi"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x041f 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 下载平台"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0804 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Plataforma de Transferência do Windows"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Todos os direitos reservados."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Sistema Operativo Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0816 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Plataforma de descarga de Windows"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WinDlp.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Todos los derechos reservados."
          },
          {
            "name": "OriginalFilename",
            "value": "WinDlp.dll"
          },
          {
            "name": "ProductName",
            "value": "Sistema operativo Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0c0a 0x04b0"
          }
        ],
        "imphash": "7508cd4709759e08d5ac01557cc7c022",
        "timestamp": "2058-11-01 02:46:38",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 14
      },
      "data": null,
      "strings": [
        "<#=V=",
        "?5?]?v?",
        "BiBindEfiBootManager failed %x",
        " Microsoft Corporation. Med ensamr",
        "A tarefa BITS est",
        "FPData",
        ";6;`;l;w;",
        ";,<v<",
        "555O5",
        "ShouldSuspendBitlocker",
        "2V3`3",
        "ZwOpenKey",
        "=/=T=",
        "4)4A4h4",
        " bulunamad",
        "2\\3h3o3L4",
        "ar-MA",
        "SPLEVEL",
        "QPWSQQh",
        "http://www.w3.org/XML/1998/namespace",
        "RtlNtStatusToDosError",
        "|SYSPART|\\|DEST|\\BCD",
        "ml-IN",
        "DwordCount",
        "Control\\MUI\\UILanguages",
        "ritetty levy on liian pieni.%0",
        ">:>Y>",
        "9(9V9",
        "y0Vh[",
        "MultiLayout: Initializing Wim Path X86: [%s]",
        "9sTtr",
        "4SVWQ",
        "?MdDlt",
        "7&7O7V7]7d7",
        ">&>_>",
        " operace do",
        "SendAbortMessage",
        "=3>o>",
        "DuplicateHandle",
        " stato superato il limite di tentativi di riparazione per blocco. Il file ",
        "czona.%0",
        "gga till en fil f",
        "az-Cyrl-AZ",
        "Angitt handlingsobjekt er ikke initialisert.%0",
        "UpgLayout: Initializing Wim Path: [%s]",
        "Range: bytes=%I64u-%I64u",
        "9'959N9k9",
        "x*g1\\",
        "LayoutUsb: Initializing File System: [%s]",
        "WIM_Chunked_Number_Of_Buffers",
        "CDlpTask::GetFileByName",
        "ysWhE",
        "3 3,383D3P3\\3h3t3",
        "3=3K3R3",
        "ServiceDebuggerFiles: %ws does not exist",
        "0k0o0",
        "ts-ZA",
        "GetSystemTime",
        "ServiceSpaces: Failed to create path %s. Last error = %#x",
        "4\"484?4N4U4",
        "7N8b8s8z8",
        "y6Vhj",
        "Zadan",
        "=6>A>O>",
        "7@8w8",
        ".idata$5",
        "6O7V7",
        "BCD Error: %ws",
        "RtlTranscodeLBlobs",
        ">*>q>",
        "FileCount",
        "1.1=1Q1m1v1",
        "041604B0",
        "Could not retrieve error description from transport for [0x%X].",
        "ExpandEnvironmentStringsW",
        "tva.%0",
        "Blok ba",
        "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\LOWPART",
        "scht, da er eine BitLocker-Verschl",
        "040904B0",
        "Microsoft Time-Stamp Service0",
        "t;j#j",
        "Not-null check failed: MatchIndex",
        "ncia do Windows",
        "0/0E0P0",
        "D$`SVW",
        "1>1Z1i1v1",
        "boot\\BCD",
        "7(747@7L7X7d7p7|7",
        "OpenEncryptedFileRawW",
        "PWj@j",
        "4G5N5",
        "Redmond1",
        "0I0P0",
        "SetPriorityClass",
        "0$0A0~0",
        "LockFileEx",
        "ConnectToSourceUrl: Unable to retrieve proxy info for URL -> [0x%x].",
        "AddStreamsToImage",
        "999|9",
        "SSh @",
        "StringCchCopyN failed",
        "Failed to mark system store. File: %ws Status: %x",
        "+070A0n0",
        "4C4_4w4",
        "yi-001",
        "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8",
        "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464",
        "CDlpTask::ReportDiagTime",
        "878W8f8s8",
        "CDlpActionRecoverCrypto::GetSavedCryptedBuffer",
        "mite de reintentos de reparaci",
        "RtlDosPathNameToNtPathName_U",
        "161j1",
        "MapViewOfFile",
        "WIM\\IMAGE[*]\\NAME",
        "FveDisableAuthenticationW",
        "BcdCopyObjectEx: Failed to copy object. Target: %ws Flags: 0x%x Status: %x",
        "UncompressFile failed",
        "TransferFile: User requesting retry...",
        "MicrodomImplementation::CMicrodom::GetElementNodeSet",
        "TransferFile: Not updating remote source path.",
        "A<Au%",
        "SetFileAttributes(%s) failed! Last Error = %#x.",
        "4I4V4r4~4",
        "|$4tG",
        "nti jav",
        "Reconstruct",
        "FindFreeExtent: Found no free extents matching criteria on specified disk",
        "?\"?M?e?",
        "LayoutUsb: Copying files to [%s]...",
        "D$@j(P3",
        "en-AE",
        " toiminto-objektia ei ole alustettu.%0",
        " em andamento.%0",
        "SOURCE",
        "VERSION",
        "^<9^<v",
        "FveGetStatus",
        "6U7d7k7v7",
        "|SYSPART|\\|BOOTMGR|",
        "StringFileInfo",
        "6=6W6d6",
        "N0L0J",
        "n OEM porque contiene la imagen de Recuperaci",
        "+131v1",
        "<(<V<~<",
        "d\\Og0",
        "\\\\.\\PHYSICALDRIVE%d",
        "EtwEventWrite",
        "545A5a5p5",
        "::RtlIsLBlobValid(Blob)",
        ";5;<;",
        "9!:b:|:",
        "ResolvePartitionTypeToCreate: %s: disk %d already has %d allocated partitions",
        "L$4PV",
        " WIM.%0",
        "ControlSet???",
        "t)j\\V",
        ":]:i:",
        "CDlpRegistrar::RegisterResponseFactory",
        ":0;l;r;",
        "m soubor",
        "A BITS-feladat v",
        "::RtlXmlExtentToUtf8String( 0, &m_State.ParseState.RawTokenState, &Src, TempString.GetMutablePointer(), &cRequired)",
        "5@5h5",
        "AllocateReadChunk",
        "(Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::Stream) || (Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::BlobProvider) || (Params->SourceType == Windows::Microdom::Rtl::CreateMicrodomSource::Blob)",
        "DbgPrintEx",
        "< <*<",
        "L$t_^[3",
        "696Z6",
        "vel adicionar um ficheiro para transfer",
        "File is not system store. File: %ws Status: %x",
        "A opera",
        "3#4W4k4v4",
        " operace prob",
        "BiCreateBootEntry: Could not retrieve BCD Object application description. Status: %x",
        ":F:R:\\:",
        "ff-Latn-SN",
        "velet m",
        "tOj/Xf;",
        "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD",
        "CreatePartition",
        "f;F$u",
        ";A u3",
        "fi-FI",
        "lem zaten duraklat",
        "autorun.inf",
        "Wim Capture: Capturing [%u] files from [%s] to [%s], PartSize: [0x%I64X]",
        ":F:c:",
        "ho svazku je p",
        "CXmlCursor::CompareExtents",
        "CDlpRegistrar::CreateResponse",
        "ritetty aseman koko on liian pieni.%0",
        "The requested operation is being cancelled.%0",
        "RtlAppendLUtf8StringToLUtf8String",
        "BUILD",
        "m os dados de descriptografia necess",
        "ar-DZ",
        " stata completata.%0",
        "Zum Entschl",
        "|SYSPART|\\|EFIDEFAULT|",
        "bg-BG",
        "RtlLengthSecurityDescriptor",
        "Er is een fout opgetreden met de aangevraagde bewerking.%0",
        ";&;<;\\;c;",
        "ibb-NG",
        "HZo6m|",
        "929@9O9",
        "memmove",
        "122M2Z2r2",
        " ISO ",
        "080i0",
        " OEM ",
        "encoding",
        "NtOpenKey",
        "Failed to set boot options. Status: %x",
        "292h2",
        "Die angeforderte Volumegr",
        "7\"707x7",
        "SVWj@3",
        "InitVDSServiceNoStatic: Failed to load VDS service; hr = 0x%x.",
        "3T3e3",
        ">D>w>",
        "8?8I8v8",
        "5,52595\\5h5",
        "CDlpActionLayoutUsb::GetMaxFileSize",
        "UnlockFileEx",
        "9::h:s:",
        "NewContext.Allocate()",
        "2'2:2?2t2",
        "=&=1=g=",
        "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5",
        "es-SV",
        "r das FAT32-Dateisystem.%0",
        "fr-CD",
        "0 0+0a0m0",
        "t$(VW",
        "The requested volume size is too small.%0",
        "CDlpWimCapture::WimSplitThresholdReached",
        "809?9",
        "EsdLayout: Copying layout to working directory...",
        "BCryptCloseAlgorithmProvider",
        "OemWinreWimPath",
        ":\";M;r;",
        "2+2F2a2x2",
        "SSSSSh",
        "ServicingBootFiles failed. Error = %#x",
        "CDlpWimCapture::Capture",
        "Translated a DontSync entry with ID 0x%x",
        "BiExportStoreAlterationsToEfi failed %x",
        "quc-Latn",
        "::RtlIsLBlobValid(Source)",
        "FreeLibrary",
        "memmove_s",
        "`.data",
        "@\\;B\\t",
        "pvQ-N",
        "CDlpManager::GetDwordPropertyByIndex",
        "3C4P4W4m4",
        "t$ Ph",
        "7)8;8",
        "112T2w2",
        "7I7W7A8{8",
        "!E\\H4",
        "BG_ERROR_CONTEXT_REMOTE_FILE",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::GetState",
        "bcrypt.dll",
        "8(9L9W9R:e:",
        ">->D>b>",
        "si lemezk",
        "|SYSPART|\\|DEST|\\BCD.LOG",
        "RtlIsLBlobValid(BinaryData)",
        ">*>I>\\>u>",
        "uw!\\$",
        "BitsExecute: Cancelling BITS job due to error: 0x%X",
        ";0;<;\\;h;",
        "979>9",
        "Betriebssystem Microsoft",
        "CDlpManager::DeleteQuadwordProperty",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::ResetState",
        "ulIndex < m_Header->ulTotalNodeCount",
        "6!6,6^6x6",
        ":6:B:c:",
        "Not wiping disk because files exist on a volume that resides on this disk.%0",
        "210303183039Z0p1",
        ":C:x:",
        "3 3|3",
        "1H2U2",
        "BiSpacesUpdatePhysicalDevicePath failed %x",
        "ha-Latn-NG",
        "LayoutUsb: Initializing Install WIM Path: [%s]",
        "est pas lanc",
        "Failed to create Recovery directory. Last error = %#x",
        "idat pro p",
        "?7?S?k?",
        "ReadDirEntry",
        "BUCL::Rtl::Multiply<TraitsT::TSize>(Count, TraitsT::TCharSize, cbCount)",
        "XkZu=",
        "0)0A1G1v1i2",
        ";,<;<",
        "3R4v4",
        "585D5d5p5",
        "De gevraagde volumegrootte is te klein.%0",
        "CheckHttpRequestStatus: WinHttpQueryHeaders Status -> [%d]",
        "rrelsen er for liten.%0",
        "2j3w3~3",
        "8;8E8b8i8~9",
        "5/6G6Y6f6",
        "$Microsoft Ireland Operations Limited1&0$",
        "CDlpActionRecoverCrypto::VerifyWimHasIntegrityData",
        "2+2G2",
        "677t7",
        "6*6>6I6g6",
        "2T3~3",
        "WimLayout: Initializing DeleteSource: [%s]",
        "InternalName",
        "=7>r>",
        "KeyName",
        " poss",
        "GetVolumePathNameW",
        " Microsoft Corporation. Tutti i diritti riservati.",
        "PSWVVh",
        "FveGetSecureBootBindingState",
        "kleme dosyas",
        "The system store is not already loaded",
        "NewChild.Allocate()",
        "<)<1<G<S<[<u<",
        "WindowsPE",
        "%s: Progress exceeds total -> [0x%I64X / 0x%I64X]",
        "Translation",
        "nl-BE",
        "ve-ZA",
        "ioctl() failed or returned no data",
        "tr-TR",
        " soubor WIM neobsahuje po",
        "WimBufferToHexString",
        "CloserElement = this->AllocateStreamObject()",
        "=!=;=H=a=o=",
        "mr-IN",
        "0)0@0M0",
        "6L6s6",
        "memcpy",
        "1,2x2",
        "<#<g<p<}<",
        "WZ:h ",
        "CreateWimQueue",
        "0A1[1f1",
        ";7;U;s;",
        "=#=E=]=",
        "Failed to flush system volume. Error = %#x",
        "MediaPath",
        "6$6O6",
        "Windows::uDom::Rtl::RtlMicrodomUpdateSetNodeName",
        " http://www.microsoft.com/windows0",
        "WinHttpCloseHandle",
        "ulValue < MultFactor",
        "sources\\install.esd",
        "ZwSetValueKey",
        "3C3y3",
        "swprintf_s",
        "CopyDirectoryFileCallback: The copy was canceled by the user.",
        "EnumRefExtEntries",
        "9(:>:K:a:",
        "lusSanitizedFilePath.Length != 0",
        "ConvertDiskStyle: Successfully converted disk [%d] to %s.",
        "bs-Cyrl",
        "MicrodomImplementation::CMicrodom::Initialize",
        "0f0D0~0[0",
        "l kicsi.%0",
        "RecoverCrypto",
        ">f>3?",
        "0I0_0",
        "TempNodes.Allocate(UpperIndex - TheElement.Reserved)",
        "5@5G5",
        "T$$RPQQ",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNSNode",
        ";=;d;",
        "CDlpActionLayoutUsb::PopulateWimPaths",
        "CElementModification::ChangeTextValue",
        "WimPathX64",
        "Cancelling BITS job due to error: 0x%X",
        "a chiffr",
        "3:3N3U3s3}3",
        "LayoutIso: Specified EFI boot file [%s] is missing!",
        "5\"575D5a5j5p5",
        "CDlpTransportBits::InternalResumeJob",
        "GetModuleHandleExW",
        "D$LSP",
        "SeTakeOwnershipPrivilege",
        "LayoutUsb: Source maximum file size -> [%I64d] bytes",
        "Converting to NT filename failed",
        "3*4c4",
        "te-IN",
        "232^2",
        "L$\\_^[3",
        " egyik f",
        "lanmad",
        "909:9q9",
        "?*?I?a?",
        "yo-NG",
        "Not-null check failed: Params",
        "ar-KW",
        "20201008074315.149Z0",
        "F8PSj",
        "<3<o<",
        "Synchronizing store with firmware",
        "r megszak",
        "828H8S8w8",
        "wcschr",
        "819G9T9t9~9",
        "6&6-6U6e6",
        "081l1",
        "6W8^8",
        "9s v5",
        "1U1n1",
        "FreeSid",
        "6#6)6=6B6N6_6g6z6",
        "SaveOffset failed",
        "2D2k2v2",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetNamedItemNs",
        "AllocChunkInfo",
        "Bits Error: SourceUrl Unmodified: [%s]",
        "9=9C9c9j9",
        "DlpTask: Deserialize(): ActionIndex = [0x%X]",
        "LayoutIso: Initializing EFI BootFile Path: [%s]",
        "Control\\ProductOptions",
        "http://www.w3.org/2000/09/xmldsig#",
        "DuplicateFileNode",
        "\\System Volume Information\\FVE.{e40ad34d-dae9-4bc7-95bd-b16218c10f72}.X",
        ">1><>J>d>",
        " est trop petite.%0",
        "UCS-2",
        "cch <= (((((SIZE_T)~((SIZE_T)0)) - (((SIZE_T)~((SIZE_T)0)) % sizeof(WCHAR))) / sizeof(WCHAR)) - 1)",
        "n aktar",
        "90:7:Z:a:",
        "AddResourceToHashTableCallback",
        "7)8M8",
        "BcdCopyObjectEx: Failed to enumerate source elements. Target: %ws Flags: 0x%x Status: %x",
        ":):0:?:J:|:",
        "<B<P<",
        "RegQueryValueExW",
        "ky-KG",
        "QQQPPQ",
        "LayoutUsb: Initializing Boot WIM Path: [%s]",
        "132q2",
        "Failed to Enumerate elements from %ws. Status: %x",
        "g0M0~0[0",
        "SystemPartition",
        "La limite du nombre de tentatives de r",
        "828h8",
        "5O5T5v5",
        "GetProcessHeap",
        " disken fordi filer finnes p",
        "CDlpActionWimLayout::ExecuteRoutine",
        "LoadLibraryExW",
        "0Y0_0e0m0",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::GetTransportIndex",
        "RtlInitializeGrowingList( this, sizeof(TStoredObject), m_ulElementsPerChunk, (PVOID)m_InternalBuffer, sizeof(m_InternalBuffer), Allocator )",
        "me.%0",
        "909D9R9",
        "WimLayout: File deleted successfully.",
        "Skipping capture path [%s] because it is the WIM temp path",
        "SetEndOfFile",
        "ZwQueryInformationProcess",
        "sources\\boot.wim",
        "5)6A6L6m6x6",
        "WimCopyStream failed",
        "Pyydetty toiminto on valmis.%0",
        "8%868=8g8",
        " diskenheden er for lille.%0",
        "ExportChunkedPortion",
        "ProgressCurrent",
        "5 5B5[5x5",
        "o solicitada encontrou um erro.%0",
        "TransferFile: TransferFileWorker succeeded.",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::Suspend",
        "1`2n2u2",
        "CDlpManager::GetDwordPropertyCount",
        "j\\Zf;",
        "RegSetValueExW",
        "=L>r>}>",
        "232C2J2",
        "SVWj43",
        "lle.%0",
        "MicrodomImplementation::CStringpoolCache::AttachToStringPool",
        "Failed to delete boot entry 0x%x. Status: %x",
        "CMicrodomXmlWalker::XmlError",
        "o foi disponibilizada nenhuma chave para desencriptar o ficheiro WIM especificado.%0",
        "0f0D0~0Y0",
        "C`h`h",
        "1F1[1g1n1|1",
        "ProductType",
        "u|9\\$",
        ";4;c;n;|;",
        "9:9H9a9",
        "ar-SA",
        "ReleaseDataRange",
        "\"Microsoft Window",
        "IMAGE\\NAME",
        "Windows-downloadplatform",
        "Process Name = %s",
        "BfspCopyFile failed to delete temporary file (%s)! Last Error = %#x.",
        "BitsTransport: Entering TransferFile Method",
        "5:6o6",
        "RestoreFileData",
        ";-=@=V=e=",
        "ValidateBinaryFileAndSetEA failed",
        "\\??\\PhysicalDrive%lu",
        " transport sieciowy.%0",
        "El volumen solicitado es demasiado grande para el sistema de archivos FAT32.%0",
        "boot.wim",
        "y.VjJ",
        "bsearch",
        "UnknownType",
        "RtlDeleteResource",
        "RtlSetDaclSecurityDescriptor",
        "3S3i3p3",
        "EsdLayout: Exporting install image [%d] to ESD file...",
        "ADVAPI32.dll",
        "tg-Cyrl",
        "1(141<1D1L1T1\\1d1l1t1x1",
        "Error creating boot status data log(%s)! Last Error = %#x",
        "3 3=3N3`3r3",
        "Failed to open file %s for read! Error code = %#x",
        "lo k chyb",
        "pa-Arab-PK",
        "CDlpActionWimLayout::DeleteSourceFile",
        "WARNING",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::SerializeRoutine",
        "040504B0",
        "\\$4YY",
        "sr-Latn-CS",
        "Det forespurte volumet er for stort for FAT32-filsystemet.%0",
        "(*m_State.ParseState.pfnCompareSpecialString)(&m_State.ParseState, Extent, &ss, pResult, 0)",
        "6\"6/6<6^6m6u6",
        "RtlDuplicateLBlob",
        ">,>3>K>R>X>_>t>~>",
        "m_StoredTable.Initialize()",
        "Den forespurte volumst",
        "838@8l8y8",
        "6A7r7",
        "ControlSet%03u",
        "606K6",
        ":7:`:j:z:",
        "080L0Y0",
        "Opening store. Flags: 0x%x",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::SerializeRoutine",
        "|d-Vk",
        "QQSVW3",
        "t$Vh@3",
        "9r t1",
        "2B3W3",
        "t&f;E",
        ":\\:a:x:",
        "BcdCopyObjectEx: Failed to set target elements. Target: %ws Flags: 0x%x Element type: %lu Status: %x",
        "Sj PjZ",
        "Failed to retrieve physical partitions. Last Error = %#x",
        "ta-LK",
        "%wOtF",
        ":C:S:l:",
        "3>3T3n3",
        "0L0zv",
        "Microsoft\\Windows NT\\CurrentVersion",
        "0&0X0z0",
        "pToRemove != 0",
        "4)4W4o4",
        " nebyla zah",
        "041D04B0",
        "t1j\\P",
        " danneggiato.%0",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::DeserializeRoutine",
        " initialis",
        "Der BITS-Auftrag befindet sich zurzeit in der Warteschlange.%0",
        "3<3C3",
        ">V>_>f>o>v>",
        "<9=L=w=",
        "SeBackupPrivilege",
        "danego woluminu jest za ma",
        "CDlpTransportHttp::ConnectToSourceUrl",
        "SetSecurityInfo",
        "=1>=>K>",
        "CDlpTask::Cancel",
        "TheNode != TheNode.InvalidValue()",
        "Created boot entry 0x%x using cached variable",
        "131w1",
        ":A;K;];z;",
        "InitializeCriticalSectionAndSpinCount",
        "eu-ES",
        "j<_WR",
        "Rozmiar ",
        "AX;BXu",
        "6`7|7",
        "Ingen nyckel har angetts f",
        "3.353D3K3[3b3{3",
        "= =T=n={=",
        "j\\Xf;A",
        ".idata$3",
        "3E3O3z3",
        ";';>;U;",
        "|SYSPART|\\|DEST|\\|RESOURCES|",
        ";F;w;",
        "=)>B>m>x>",
        "PrepareFile: Content-Length header not found.  Trying GET...",
        "Value",
        "CMicrodomUpdateContext::CreateVirtualElement",
        "Het opgegeven actieobject is niet ge",
        "LayoutUsb: Failed to run BfsServiceBootFiles with source path [%s], Firmware type [%s]",
        "ImageWorkerThread",
        "FindFirstChunk",
        "Sistema Operativo Microsoft",
        "ifre ",
        "JobError: Job State: [%s]",
        "4#4*4Y4",
        "PVVj@Wh",
        "PPPjd",
        "j\\YtLJ",
        "CDlpManager::DeleteTask",
        "WINDLP",
        ";[<u<",
        "=$={=",
        "6%6=6r6",
        "CDlpTask::ProgressHandlerAction",
        "__rv.UcsCharacter != (0xffffffff)",
        "v3Qhx}",
        "es-EC",
        "o de reparo por bloco excedido. Arquivo corrompido.%0",
        " ISO-f",
        "nso-ZA",
        "veletet m",
        ";,;L;j;",
        "?)?7?P?z?",
        "setting hardlink failed",
        "?0?S?",
        "7#8e8u9",
        "RestoreMountStub: Could not move hardlink stub to prepopulate location",
        "rda volymen ",
        "CDlpManager::AsyncSerializeEnable",
        "F4QQS",
        "<]=p={=",
        "D$L9A",
        "CMicrodomBuilder::ProduceStringTable",
        "39HPt",
        "TraceData failed: Error = [0x%X]",
        "CDlpTransportHttp::CheckHttpRequestStatus",
        "4F4g4",
        "9(969",
        " sendo apagado, pois h",
        "<0=l=",
        ";*;M;f;",
        "WriteFileEx",
        "WIM\\IMAGE[*]\\CREATIONTIME\\LOWPART",
        "ssel in der angegebenen WIM-Datei konnte nicht entschl",
        "Error uncompressing boot status data log(%s)! Last Error = %#x",
        "RestoreAllFiles",
        "9>9q9",
        "\\ArcName\\multi(0)disk(0)rdisk(0)",
        "(NewPrefix == 0) || RtlIsLUtf8StringValid(NewPrefix)",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::Initialize",
        "839q9",
        "ZwDeleteKey",
        "2@:e:",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::GetTransportId",
        "CDlpActionWimLayout::WimLayoutApplyImage",
        "ttelep",
        "<-<:<k<",
        "EsdLayout: Initializing Compression Type: [0x%x]",
        ">MdDtt",
        ", koska se sis",
        ":0;7;",
        "0+1E1^1",
        "<1=S=",
        "8'808[8d8u8",
        "5,6l6O7",
        "?!?.?]?h?",
        "The requested operation has already been cancelled.%0",
        "?w?~?",
        "=@=`=h=p=x=",
        "<G=_=",
        "m a imagem de Recupera",
        "RtlIsLUtf8StringValid(Name)",
        "2(31373c3w3",
        "GetFinalPathNameByHandleW",
        "tKWVj",
        "D$@PW",
        "d\\Ock(W",
        "MicrodomImplementation::CDomPositionCache::GetLocation",
        "Failed to get img buf",
        "u.FAB;",
        " toimintoa peruutetaan.%0",
        "Error setting compression",
        "GetPriorityClass",
        "767M7",
        "Enheten rensas inte eftersom BitLocker-kryptering anv",
        "Y4?L8M",
        ";\\<v<",
        "yoj@j",
        "CDlpTransportBits::GetTransportIndex",
        "CDlpRegistrar::GetTransport",
        "st-ZA",
        "1o2y2",
        "this->m_PositionList.Allocate(LocationHeader->ulItemCount)",
        "CreateRestoreInfo",
        "MicrodomImplementation::CDomLayoutCache::GetNodeChildren",
        "PWSWWWh",
        "Exporting alterations to firmware.",
        "1-1A1L1j1",
        "Le disque sp",
        "CompanyName",
        "#D$ P",
        "CDlpManager::DeleteQuadwordPropertyByIndex",
        "NtUnloadKey2",
        "RecoverCrypto: Verified WIM file size.",
        "=#>;>\\>o>",
        "Thales TSS ESN:86DF-4BBC-93351%0#",
        " disk je p",
        "Failed to get user token! Error code = %#x",
        "RtlIsLUtf8StringValid(ElementId)",
        "de-LU",
        "support",
        "0%0.030G0O0[0c0|0",
        "De aangevraagde bewerking is al geannuleerd.%0",
        "tt med den beg",
        "1 1'151",
        "@\\WjdPQ",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementNodeSet",
        " atualmente em fila%0",
        "WinHttpSendRequest",
        "rts.%0",
        "NKNMR",
        "WIMAddImagePath",
        "?$?,?8?X?`?l?",
        "De opgegeven schijf is niet gereed.%0",
        "ExportInResourceOrder",
        "5c6j6t6",
        "IMAGE\\WIMBOOTENTRIES",
        "da.%0",
        " klucza w okre",
        "en-PH",
        "LogSharingViolationErrorInfo",
        "878a8|8",
        "fr-CI",
        "CDlpManager::GetTransport",
        "RtlAppendUcsCharacterToLUtf8String",
        "WIMExportImage",
        "Microsoft Corporation1-0+",
        "5%5/5^5",
        "8C8\\8",
        "No more than one flag set check failed: __e",
        "The specified action object has not been initialized.%0",
        "Le fichier de d",
        "ba-RU",
        "3$4+4",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "9%:=:",
        "RtlSetThreadErrorMode",
        "CreatePartition: Need to decide the type of the partition to create",
        "CDlpActionLayoutUsb::PopulateSwmPaths",
        "enos, mus",
        "9<9B9",
        "Der angeforderte Vorgang wurde abgeschlossen.%0",
        ";H;p;",
        "CDlpTransportBits::GetState",
        "9Q9^9m9v9}9",
        "PPPPPP",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::Execute",
        "verskridits. Filen ",
        "Failed to get aliased identifier. Status: %x",
        "RestoreMountStub: setting reparse point data failed",
        "WIM\\IMAGE[*]\\FILECOUNT",
        "QSVWQQ",
        "ZwOpenProcess",
        "O tamanho do volume pedido ",
        "CDlpManager::GetState",
        "BG_ERROR_CONTEXT_QUEUE_MANAGER_NOTIFICATION",
        "CDlpRegistrar::GetTransportFactory",
        "NtQueryBootEntryOrder",
        "MapViewOfFile(%s) failed! Error code = %#x",
        "OEM-partitie wordt niet verwijderd omdat deze de installatiekopie van Windows Herstel bevat.%0",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttributes",
        "ggesztve.%0",
        "HPRh ",
        " dekryptere den angitte WIM-filen.%0",
        "BitsTransport: Entering Prepare Method",
        "WinHttpAddRequestHeaders",
        "WimLayout: Initializing DisableBootSupport: [%s]",
        ">H?T?x?",
        "Not-null check failed: Document",
        "ar-JO",
        "WIM\\ESD\\ENCRYPTED",
        "CDlpActionLayoutUsb::SendActionMessage",
        "9<9\\9",
        "ConvertStringSecurityDescriptorToSecurityDescriptorW",
        "QueryPerformanceCounter",
        "020P0m0",
        "~j\\XPW",
        "$Microsoft Ireland Operations Limited1",
        "ug-CN",
        "CDlpFile::GetError",
        "StringProperty",
        "ServiceDebuggerFiles: Failed to allocate config buffer",
        "sd-Deva-IN",
        "WIMSendFileInfoMessage",
        "pt-BR",
        "CDlpTask::GetAction",
        " en curso.%0",
        "767L7Y7",
        "&quot;",
        "CryptReleaseContext",
        "Not-null check failed: Value",
        "rden p",
        "ne-IN",
        ";E;R;f;l;",
        ";.;<;",
        "CreateEventW",
        "BFSVC: %s",
        "de-DE",
        "CDlpManager::DeleteTaskByName",
        "Microsoft Enhanced RSA and AES Cryptographic Provider",
        "WIM %s, offset %.8x%.8x, length %x",
        "::RtlStringCchCopyNW(KeyNameBuffer, KeyNameBufferSize, lusKeyName.Buffer, cchKeyName)",
        " wstrzymana.%0",
        "7G7_7u7",
        "es-419",
        ">=>C>H>[>k>q>",
        "sa-IN",
        "4*595F5{5",
        "CXmlCursor::Next",
        "5!5Z5",
        "NtWaitForSingleObject",
        "RestoreFileInfo",
        "echna pr",
        "_snwscanf_s",
        "=+=>=",
        "LayoutUsb: Opening source WIM file: [%s]...",
        "2;2F2M2",
        "BitsTransport: Cancelled existing BITS Download Job to directory %s",
        "AuthUsesFlags",
        "3:4x4",
        " sijaitsevassa asemassa on tiedostoja.%0",
        "glen blev ikke dekrypteret i den angivne WIM-fil.%0",
        "BUCL::Rtl::Multiply<TraitsT::TSize>(Offset, TraitsT::TCharSize, cbOffset)",
        "8$8D8L8X8x8",
        "RemoteSourcePath",
        "97u\"3",
        "CDlpTask::PushChronicleResponse",
        "nkung f",
        "Not-null check failed: pWriter",
        "CBasicNodeType::ForceNameSetting",
        "JobId",
        "WinHttpGetIEProxyConfigForCurrentUser",
        "DeleteFileW",
        "CDlpActionRecoverCrypto::ClearKeyFromXml",
        "Bytes",
        "GetSecurityDescriptorControl failed! Error code = %#x",
        "A parti",
        "RtlXmlInitializeTokenization(&TokenizerState, &TokenizerInit)",
        "2(2H2T2t2|2",
        "pStringPool->Signature == ('pSdM')",
        "9R9x9",
        "ConnectToSourceUrl: Trying auto-detect...",
        ":7:Q:f:",
        "RestoreDirTree",
        "2-3H3",
        "=3>?>J>e>",
        "_wcslwr",
        "354h4",
        "RecoverCrypto: SetProgressRange: [%u] [%u]",
        "LdrGetDllHandle",
        " actualmente en cola.%0",
        "<%={=",
        "Not-null check failed: PseudoKeyOut",
        "RecoverOem",
        "RecoverCrypto: Delete failure ignored. hr = [0x%X]",
        "3Z3{3",
        " operace byla dokon",
        "869Q9i9",
        "InitializeCriticalSection",
        "FveEnableAuthenticationW",
        "8C8`8",
        "Object alias resolves to %s",
        "Error restoring directory metadata",
        "<M=X=f=",
        "Not-null check failed: pDocument",
        "WinDLP System Shutdown",
        " sakl",
        "CDlpTask::GetCurrentAction",
        "?*?7?D?",
        "9'9_9",
        "RtlAllocateLBlob",
        "Hash mismatch: Offset = [0x%I64X]",
        ".CRT$XCU",
        "DLPLOG: [0x%X] [%s] [%s]",
        "]._g*",
        "0a0v0",
        "D$0SV",
        "3,3B3g3",
        "ZwOpenFile",
        "GetSecurityDescriptorOwner failed! Error code = %#x",
        "<@<q<",
        "BUCL::Rtl::AddInPlaceWithOverflowCheck(&MaximumLength, Sources[i].Length)",
        "3#3U3`3",
        "D$@PjZ",
        "D$$PQ",
        ":K;v;",
        "nce bir a",
        "0S0]0",
        "424I4P4",
        "6\"6S6p6",
        " BitLocker ",
        "UTF-16",
        "|SYSPART|\\|DEST|",
        "CurentBytes",
        "::RtlIsLBlobValid(Destination)",
        ";:;N;r;",
        "<)=C=P=s=",
        "9R:Y:c:o:",
        "y'Vj1",
        "UncompressFile",
        "CDlpActionRecoverCrypto::GetImageRangesFromWim",
        "<K=h=y=c?j?|?",
        ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:",
        "BuildFileNodeHashTable",
        "Belirtilen disk ",
        "?*?1?@?G?S?Z?i?p?",
        "CompressionExclusionList",
        "9D$$t",
        "PQQQQQQh ",
        "mu Windows.%0",
        "Pairs.Allocate(m_StringTable.GetEntryCount())",
        "5.595f5",
        "WIM\\ESD\\KEY",
        "6(6{6",
        "111X1",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetPropertiesSetup",
        ">MdSpt",
        "RtlIsLUtf8StringValid(Source)",
        "es-AR",
        "xJj&Y",
        "CDlpManager::Reset",
        "wcsncmp",
        "Cabinet.dll",
        "CDlpTask::GetChronologyIndexById",
        "[ybVh",
        "?Y?^?",
        "WimDetermineImages: Checking image [%d] for InstallationType: [%s]",
        "SSSjdQ",
        "Not-null check failed: Decoder",
        "Not-null check failed: fHasChildNodes",
        ";L;W;i;",
        "zh-Hans",
        "CDlpTransportBits::UpdateTaskProgress",
        "CDlpActionLayoutUsb::PopulateBootPath",
        "CDlpTransportBitsFactory::GetTransportCount",
        "ff-Latn-NG",
        ";0<a<",
        "EnumeratePathEx: FindFirstFile failed for [%s]; GLE = 0x%x",
        "Failed to convert user SID! Error code = %#x",
        "tg-Cyrl-TJ",
        ">\"?/?<?Y?",
        "0#1L1V1t1",
        "ya al",
        "WdsCopyFileEx: Failed to delete %s. GLE = 0x%x",
        "VerQueryValueW",
        "7R7v7",
        "ru-RU",
        "LocalFileTimeToFileTime",
        "617F7",
        "CDlpManager::CreateTask",
        "363L3W3",
        "<H<Q<[<k<",
        "1#2(2-22272<2A2G2",
        "Substitute name string copy failed",
        "lv-LV",
        "Er is geen sleutel is opgegeven voor het ontsleutelen van het opgegeven WIM-bestand.%0",
        "RtlGetLastNtStatus",
        "8r ,Y",
        "RestoreFileCompression",
        ";(;4;@;L;X;d;p;|;",
        "BCryptDestroyHash",
        "223E3\\3",
        "RecoverUsb: Populating splittable Oem Path: [%s] -> [%s]",
        "7!777B7",
        "CurrentMinorVersionNumber",
        "041504B0",
        "=@=V=",
        "9J:W:j:s:~:",
        ";<;T;",
        " syst",
        "ExportDirTree",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::PrepareRoutine",
        "D$pSV3",
        "7K7z7",
        "LayoutUsb: Retrying wipe of disk [%u]",
        "CDlpActionRecoverCrypto::GenerateCryptoArray",
        "=?=`=x=",
        "hr-BA",
        "CMicrodomBuilder::CElementNameToAttributeListTable::Find",
        "Specified flags prevent opening unloaded system store",
        "Um ficheiro na localiza",
        "o pedida j",
        "n solicitada.%0",
        "es-PR",
        "NtYieldExecution",
        "GetVolumePathNamesForVolumeNameW",
        "LayoutUsb: OCDUS blob [%s] does not exist",
        "505b5z5",
        "191023231918Z",
        ">E>L>g>",
        "\\ProgramData\\Microsoft\\Windows",
        "chr-Cher",
        "lectionner un transport r",
        "111019184142Z",
        "0o04x",
        "Af;H(s",
        "3@3]3d3l3",
        ".rdata",
        "D$pSVW",
        "BiCreateBootEntry: Could not retrieve BCD Object application device. Status: %x",
        "EsdLayout: Closing ESD file (with verify)...",
        "Params->fRequireUtf8",
        "Failed to set registry data for element %s. Status: %x",
        "P0d0o0",
        "CryptSetKeyParam",
        "CDlpActionWimLayout::WimLayoutExportImage",
        "ServiceSpaces: %s does not exist",
        "Failed to convert data for element %s. Status: %x",
        "D$$;D$Tw'r",
        "Closing store. Flags: 0x%x",
        "DeleteFileEx: hardlink given to us is: %s",
        "SPBUILD",
        "L$49L$,w}r",
        "RecoverCrypto: Initializing Crypto Key [%s]",
        "L$$9t$ t",
        "quz-EC",
        "0k1r1",
        "hlt werden, bevor eine Datei zur ",
        "WimLayout: Exporting MediaBoot WinPe image to [%s]...",
        ":$:<:C:",
        "ca-ES",
        "ZwQueryDirectoryObject",
        "9w:D;{;",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteEscapedString",
        "sz.%0",
        "WimLayout: Failed to load setup.exe module from x86 layout path. LastError=[0x%X]",
        "CreateSemaphoreW",
        "CDlpTask::EnqueueAction",
        "CDlpTask::GetIndex",
        "CDlpTask::GetActionFriendlyName",
        "t&9Z$t!",
        "jHh@b",
        "WimSetSecurityDescriptor",
        "RtlFreeHeap",
        "tiPQP",
        ";B<J<T<",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::CheckInitialized",
        "ExportHash",
        "9h9o9}9",
        "|DEST|\\bootspaces.dll",
        "qsort",
        "si adatokat.%0",
        "DestinationMaximumLength >= SourceLength",
        "0f0D0",
        "1!1e1",
        "CDlpTask::SendCallbackMessage",
        "Too many unexplained failures. File: %s Last status: %x",
        "o foi inicializado.%0",
        "t4f97t",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::ExecuteRoutine",
        "RtlWriteDataIntoSmartLBlobWritingContext",
        "748y8",
        "0L0B0",
        "=X=s=",
        "MicrodomImplementation::CMicrodom::GetNamedNodeMapLength",
        "Failed load key %ws. Flags: 0x%x File: %s Status: %x",
        "en-NZ",
        "memcmp",
        "AddAccessAllowedAce",
        "chr-Cher-US",
        "Translated a DontSync object to ID 0x%x",
        "sl-SI",
        "9A9d9n9}9",
        ";P<\\<g<",
        "1Y1s1",
        "8I8d8p8{8",
        "fr-BE",
        ":E<w>-?",
        "4$4,444<4H4h4p4x4",
        "9/9B9I9P9W9",
        "CopyDirectoryFileCallback: Unable to %s file from [%s] to [%s]; GLE = 0x%x",
        "rjats.%0",
        "DefaultAttribute.Allocate()",
        "VWj 3",
        "BitsExecute: Suspending BITS job at user request.",
        "7/8_8i8",
        "3*4C4z4",
        "The per-block repair retry limit has been exceeded. The file is corrupt.%0",
        "FH;A8",
        "GetFileStorageTierClass",
        "3#4e4",
        ">E?l?",
        "De aangevraagde bewerking is niet gestart.%0",
        "?&?z?",
        "ller avbildningen f",
        "install*.swm",
        "394f4",
        "LANGUAGE",
        "GetEnvironmentVariableW",
        "030S0a0",
        ";P;W;",
        "5F5S5.6C6I6",
        "Den anmodede diskenhed er for stor for FAT32-filsystemet.%0",
        "ReadEncryptedFileRaw",
        "TmpNodes.Resize(cNecessary)",
        "WdsRemoveDirectory: Unable to prepare path [%s]; GLE = 0x%x",
        "3,434",
        "GetVolumeInformationW",
        "Aucune cl",
        "WinHttpConnect",
        "Den angivna disken ",
        "CDlpTask::GetTransferProgress",
        "QQQPQQj",
        "D$(;t$\\r",
        "CDlpTask::Resume",
        "en-ID",
        "::BUCL::Rtl::Add<SIZE_T>( cElements, 10, NewCapacity)",
        "7#797",
        "WimDetermineImages: Install index: [%d], Install count: [%d]",
        "<unavailable>",
        " WIM-",
        " pronto.%0",
        "3_^[]",
        "tij:V",
        "lem ba",
        "LocalAlloc",
        "sma-SE",
        "OLEAUT32.dll",
        "$0,050K0Z0",
        "CryptGenKey",
        "9\\$0t]",
        "sources\\FP",
        "636@6J6",
        "8-9=9Q9]9h9",
        " obecnie w kolejce.%0",
        "3!3B3e3",
        "849N:",
        "\\ArcName\\multi(0)disk(0)rdisk(1)",
        ":?:T:i:p:",
        "CDlpTransportBits::GetTransportId",
        "!p!q!r!s!t!u!v!w!x!y!z!{!|!}!~!",
        "DeviceIoControl",
        "Failed to get decoder context",
        "%ws.{%.8x-%.4x-%.4x-%.2x%.2x-%.2x%.2x%.2x%.2x%.2x%.2x}",
        "6 6,686D6P6\\6h6t6",
        "DeleteTaskByName: Error serializing state!  [0x%x]",
        " Microsoft Corporation. Todos os direitos reservados.",
        "GetMetadataPadding",
        ">2?m?",
        "8/8~8",
        "qps-Latn-x-sh",
        "7%7<7Q7u8",
        " BitLocker.%0",
        "RtlInitializeResource",
        "[%s:(%d) -> %s] %s",
        "5!5O5k5",
        " et volum p",
        "Failed to set directory extended attribute",
        "Not wiping disk because it contains BitLocker encryption.%0",
        "O trabalho BITS est",
        "WIM\\TOTALBYTES",
        "RestoreDirMetadata: RestoreFileStorageTierClass failed",
        "sv-FI",
        "%s: Leaving Execute Method",
        "RecordFileDataLocation",
        "WimParseHexString",
        "3R4Y4",
        "CDlpActionLayoutUsb::SerializeRoutine",
        "?#?<?",
        "5(5K5n5",
        "EsdLayout: Boot image count: [%d]",
        ";><H<",
        "OEM b",
        "IDREFS",
        ":`;d;",
        "?%?l?r?",
        "iu-Cans",
        ".gfids",
        "7=7t7",
        "sr-Cyrl-ME",
        ".rsrc$02",
        "memcpy_s",
        "DeleteFileEx: Unable to allocate hardlink path buffer",
        "O arquivo WIM especificado n",
        "%I64u",
        "Failed to query process info. Status: %x",
        "GetTempFileNameW",
        "MultiLayout: Initializing DisableBootSupport: [%s]",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionLayoutIsoFactory,class CDlpActionLayoutIso>::SetActionId",
        "CryptEncrypt",
        "en-JM",
        ":7:N:",
        ";B;v;l<",
        "en-BZ",
        "n solicitada ya est",
        "171B1k1u1",
        "CDlpManager::CreateAction",
        "Bir dosyan",
        "NMTOKEN",
        "MultiLayout: Initializing CleanTargetPath: [%s]",
        "RecoverOem: Creating partition on disk [%d] at offset [0x%I64X]",
        ";1<8<p<|<",
        "Failed to delete [%s]: [0x%x]",
        "pChild->pBasicNode != 0",
        "_amsg_exit",
        "R\\Oir",
        "m kald",
        ":v:|:",
        "?J?T?",
        "WIM_FileData_Queue_Length",
        ">!?'?k?y?",
        "4I4k4",
        "4Z5r5",
        "1!2P2w2",
        "Bits Error: Unable to obtain IBackgroundCopyFile2 interface, hr = [0x%X]",
        "7J8n8",
        "ngen wurde ",
        "2<2Y2c2",
        "]_cOW",
        "CDlpTransportBits::UpdateState",
        "WWPWWWW",
        "jHXPj",
        "Microsoft",
        ";7<S<c<p<",
        "Boot entry exists for DontSync with ID 0x%x",
        "SERVICINGDATA",
        "t@f90t;",
        "UnhandledExceptionFilter",
        "7[8s8",
        "__dllonexit",
        "BcdCopyObjectEx: Failed to get generate object guid. Flags: 0x%x Status: %x",
        "InitVDSServiceNoStatic:Successfully launched service.",
        "5 636S6X6]6b6q6",
        "WIM_Verbose_Logging",
        "<zf;D9",
        "? ?$?(?,?0?4?8?@?L?X?d?p?|?",
        "9g9~9",
        "DlpTask: Leaving Execute Method",
        "0 0,0P0p0x0",
        "1A1F1",
        "imagehlp.dll",
        ".giats",
        "A,;F8u",
        "\"000^0",
        "CopyFileDataCallback",
        "w|PPP",
        "BUCL::Rtl::AddInPlaceWithOverflowCheck(&cbRequired, (*EncodingSizer)(ucsch))",
        "SetNamedSecurityInfo failed! Error code = %#x",
        "GetAclInfo failed",
        "+T$\\+",
        ";1<M<W<x<",
        "|$@9D$P",
        " zawiera pliki systemowe.%0",
        "PinningFolderList",
        "HSVW3",
        "Failed to apply privileges!",
        "9 :T:",
        "2!3-3=3T3m3",
        "\\I386",
        "BitsExecute: Resuming BITS job.",
        "040704B0",
        "515W5",
        "030v0",
        "GetSecurityInfo",
        "<3<e<p<",
        "=P>v>",
        "windlp.state-old.xml",
        "#rSPo",
        "PVj@Z",
        "FindNextFileW",
        "383p3",
        ">2>L>Y>w>",
        "zh-SG",
        "WdsRemoveDirectory: Unable to clear attributes on [%s]; GLE = 0x%x",
        "ResolvePartitionTypeToCreate: %s: disk %d is of an unknown type and is on an EFI computer; assuming %s setting wants to create GPT basic data partition",
        "en-IN",
        "='=.=>=E=Y=d=r=",
        "8e8r8",
        "646;6",
        "chiffrement requis.%0",
        "CDlpActionLayoutUsb::CopyBootFiles",
        "fy-NL",
        "CDlpTask::GetActionInterfaces",
        ">#>*>F>m>",
        "CBasicNodeType::ChangeNamespace",
        "D$,_^[3",
        "g pr. blok er overskredet. Filen er beskadiget.%0",
        "L$hQS",
        "202F2c2k2r2}2",
        "Create",
        "om-ET",
        "\\Windows\\System32\\",
        "BitsExecute: Resuming BITS job at user request.",
        "Failed to open file attributes. Status: %x",
        "CreatePartition: Got invalid offset of 0",
        "q@hLN",
        "Windows::uDom::Rtl::RtlCreateUpdatedMicrodomAsUtf8",
        "CreateParallelDecodeInfo",
        ";(;H;P;X;`;h;p;x;",
        "RestoreDirTree: WimImageCreateFile failed",
        "QQSV3",
        "=B=V=]=l=",
        "taj=R",
        "?#?0?R?l?",
        "t!VVSW",
        "2,292U2",
        "=*=7=c=n=",
        "QSVW3",
        "\\??\\%c:",
        "NewComment = this->AllocateStreamObject()",
        "u6WPj(",
        "6#747V7",
        "ProcessSecurityData",
        "de-LI",
        "=7=R=",
        "6,6B6M6V6]6h6z6",
        "Il file WIM specificato non contiene i dati di decrittografia richiesti.%0",
        "lb-LU",
        "RtlIsLBlobValid(Source)",
        "kkel ble oppgitt for ",
        "708_9",
        "CDlpTransportBits::GetParameters",
        "USER32.dll",
        ">6>N>o>",
        "WimBoot capture failed because the format of wim file is not compatible!",
        "t*QVjd",
        "Windows-Downloadplattform",
        "2?3Y3_3g3",
        "3(4L4b4",
        "RestoreDirMetadata: RestoreFileInfo failed",
        "WIM_Enumerate_Directory_Reparse_Point",
        "rm-CH",
        "0\\0b0l0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::GetActionId",
        "dana operacja nie zosta",
        "Ein Netzwerktransport muss ausgew",
        "CountChunkedByteCallback",
        "7I8P8d8j8v8",
        "RestoreMountStub",
        "EXFAT",
        "towupper",
        "CDlpTask::Pause",
        "6,6?6H6S6",
        "3#3<3_3m3",
        "n OEM porque contiene archivos del sistema.%0",
        "CDlpActionLayoutUsb::GetMaxFileListSize",
        "KERNEL32.dll",
        "GetDriveTypeW",
        "Insufficient resources for multithreaded chunked decoding; will skip!",
        "mn-Mong-MN",
        ";P;\\;g;",
        "t(9\\$",
        " zawieszona.%0",
        "lemiyor.%0",
        "smj-NO",
        "< <w<",
        "L$8;U",
        "0A0m0",
        "DlpTask: Transferring Files...",
        "MoveCaptureNode",
        "j+Yf;",
        "D$@;D$",
        "<D<`<r<",
        "=#>X>",
        "Soubor ve zdrojov",
        "!~<9~@t",
        "WIMApplyImageInternal",
        "CDlpActionRecoverCrypto::GetEncryptedRangesFromWim",
        "Resuming BITS job due to caller request.",
        "CopyFileExW",
        "ZwSetSecurityObject",
        "SVWj8j",
        "m_PropertyCache.Allocate(m_LayoutCache.TotalObjectCount())",
        "<!<@<]<q<|<",
        "0,0L0T0\\0d0l0t0|0",
        "162a2h2r2y2",
        "0W0~0[0",
        ":n;u;",
        "<%s></%s>",
        "738[8b8u8",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::PrepareRoutine",
        "?Z?c?",
        "677B7P7",
        " byla pozastavena.%0",
        "CDlpTransportBits::UpdateFileProgress",
        "|SOURCE|\\|RESOURCES|",
        "WIMWriteFileWithIntegrity",
        "o solicitada j",
        "Pj2jl",
        "UncompressFileBase",
        "7,8r8",
        "<6<C<d<~<",
        "es-CR",
        "CreateDirectoryW",
        "BITS-jobbet er i ",
        "es-VE",
        ", mert egyik k",
        "1(1>1",
        "MicrodomWriterImplementation::CMicrodomWriter::CreateInterface",
        "sr-Latn-RS",
        "hr-HR",
        "DllMain",
        "RetryCount",
        "UTF-8",
        "T$@j[P",
        "NtQueryDirectoryObject",
        "=$=&>->;>",
        "< <@<L<l<t<",
        " Microsoft Corporation. Med enerett.",
        "8<8N8^8",
        "ioctl: setting reparse point tag failed",
        "<,<8<X<d<",
        "Piattaforma download Windows",
        ";y-{e",
        "en-US",
        "j\\Zf9",
        "sv-SE",
        "Resource files missing from %s. These files are required for some editions of Windows. If you are servicing older versions of Windows, you can ignore this message.",
        "7&7B7b7|7",
        "667N7",
        "Copying resource files from %s to %s...",
        "ReconstructionPath",
        "2-2C2v2",
        "PVVh<",
        "Zadanie us",
        "CDlpTransportBits::GetError",
        "4?5F5",
        "BG_ERROR_CONTEXT_UNKNOWN",
        "\\StringFileInfo\\%04x%04x\\InternalName",
        "L$ Qh,g",
        "=1=@=P=",
        "FveDetectTelemetry",
        "\\ProgramData\\Microsoft",
        ",x7ZnRKl8NoATpJ6pGjzRLDey3uSQTsYU2RWVKBxE2a0=0Z",
        "PPQh@s",
        "313N3\\3t3",
        "7/8<8C8n8",
        "RtlDuplicateLUnicodeStringToLUtf8String",
        ";V;s;",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteRawString",
        "2/2E2K2h2o2",
        "\\Windows\\Assembly\\",
        "<a=<>F>",
        "9D$4r",
        ">4?G?",
        "CDlpTransportBits::Suspend",
        "4 4'4;4F4T4q4",
        "CreateTask: Name = [%s], WorkingPath = [%s%s], TransportId = [%s], Flags = [0x%X]",
        "install.esd",
        "000U0u0",
        "-besturingssysteem",
        "rv.UcsCharacter < 0x110000",
        "1W2^2",
        "RestoreRefNode",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::CheckUserInterrupt",
        "WimLayout: Initializing Layout Path: [%s]",
        "BITS-jobbet ",
        "stat. failed",
        "en-MY",
        "CMicrodomBuilder::WriteXmlDom",
        "GetFileVersionInfoExW",
        "ger ist zu klein.%0",
        "ar-OM",
        "=N>R>V>Z>^>b>f>j>n>r>v>z>~>",
        "RtlIsLUtf8StringValid(NamespaceURI) || (NamespaceURI == 0)",
        "lem zaten ask",
        "State",
        "Failed to get system store path. Status: %x",
        "S(_^[",
        ":7?>?",
        "nitialiseerd.%0",
        "CDlpActionLayoutIso::InitializeRoutine",
        "CMicrodomUpdateContext::CreateVirtualComment",
        "PRh F",
        "letim Sistemi",
        "9r:2;@;l;z;",
        "RtlCreateDefaultMicrodomXmlWriter",
        "Not-null check failed: pfnDecode",
        "Found loaded store at key %s",
        "t49C8u",
        "j?Yf97tQ",
        "WimCloseImageFile",
        "8VWh`'",
        ">M?X?j?{?",
        "QuadwordProperty",
        "1v2~2",
        "RemoveDirectoryW",
        "PSSSSSSSj",
        "ger befindet, Dateien vorhanden sind.%0",
        "En nettverkstransport m",
        "Waiting for transfer thread to exit.",
        "8-8:8i8",
        "=E=Y=}=",
        "CreatePartition: Requesting creation of partition with { offset = [0x%I64x], size [0x%I64x] }",
        "_TmpHive_",
        "030M0Z0x0",
        "id-ID",
        "9%9Y9",
        "2<2l2",
        "!fExisted",
        "GetFileInformationByHandle failed",
        "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4",
        ":/;O;Z;k;",
        ";W<T>a>w>",
        "CDlpActionLayoutUsb::PopulateOemPaths",
        "6[6b6i6p6w6",
        "sr-Latn-BA",
        "Schijf wordt niet gewist omdat een volume op deze schijf bestanden bevat.%0",
        "Nie podano klucza do odszyfrowania okre",
        "Balayage du disque impossible, car des fichiers se trouvent sur un volume r",
        "HashType",
        "zati ",
        "_except_handler4_common",
        "NtTranslateFilePath",
        "536:6J6r6|6",
        "4G4o4",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::Pause",
        "BUCL::Rtl::Multiply(WorkingBufferSize, MultiplicativeGrowthFactor, WorkingBufferSize)",
        "5G5_5j5",
        "P@SJX",
        "wo-SN",
        "la-001",
        "t#j\\Q",
        "NtOpenThreadTokenEx",
        "EFI\\Microsoft\\Boot\\Policies",
        "\\WINNT",
        "RestoreRefNodeCallback",
        "rrelse p",
        "xmlns",
        "2$2,242<2D2P2\\2d2l2x2",
        "WimDetermineImages: WinPE index: [%d]",
        "Den angivne handling er allerede blevet annulleret.%0",
        "GetSecurityDescriptorDacl",
        "CDlpActionLayoutUsb::SplitProgressWorker",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::Length",
        "\\system32\\winpeshl.exe",
        ":(;I;|;",
        "728T8^8",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocument",
        "<&<+<k<r<",
        "ges visszafejt",
        "CDlpActionLayoutUsb::GetDiskAndOffsetFromPath",
        "MicrodomImplementation::CStringpoolCache::FindString",
        "6&636e6",
        "FlushFileBuffers",
        "MediaLayout: Copying layout path: [%s]...",
        "EsdLayout: Initializing Image Index: [%d]",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::CheckUserInterruptEx",
        "l nagy a FAT32 f",
        "WPWPQ",
        "t1VPQ",
        "7+888)9Y9",
        "Fonts",
        "CDlpTransportHttpFactory::GetTransportCount",
        "EsdLayout: Closing ESD file (without verify)...",
        "<H=^=",
        "mn-Mong-CN",
        "RecoverCrypto: Successfully recovered the WIM file",
        "lt-LT",
        "reagent.xml",
        "LayoutUsb: Requesting cancel from copy engine",
        "Den forespurte operasjonen er fullf",
        "windows",
        "=w>~>",
        "whichElement != Windows::Microdom::Rtl::Element::InvalidValue()",
        "r en fil kan legges til for overf",
        "Der angeforderte Vorgang wurde bereits abgebrochen.%0",
        "1'141`1{1",
        "=&=s=",
        "h0W0f0",
        "MicrodomImplementation::CDomPositionCache::AttachToPositionList",
        "SendCallbackMessage: [0x%X] -> Cancel request returned 0x%X",
        "Failed to validate boot manager checksum (%s)! Error code = %#x",
        "SVWhP",
        "strncpy_s",
        "WaitForMultipleObjects",
        "8*8c8",
        "8I9P9^9v9",
        "tESWV",
        "7 8N8d8k8",
        "3*3I3P3e3",
        "ZwQueryValueKey",
        "596j6v6",
        " disken fordi den inneholder BitLocker-kryptering.%0",
        "CreatePartition: Failed to get property and partition count for disk %d, hr = 0x%x",
        ";6<E<L<",
        "VWRQSU",
        "Die pro Block geltende Beschr",
        " la operaci",
        "879z9",
        "Printed name string copy failed",
        "D0Q0{0",
        "WimLayoutCaptureImage: Capturing image from [%s]",
        "yTShI",
        ":/:I:V:",
        "f;D$4u",
        "PQQQV",
        "ro-MD",
        ";\"<8<C<f<u<",
        "mk-MK",
        "WimImageEnqueueOperation",
        "GetTokenInformation",
        "sr-Cyrl-RS",
        "=(>/>X>_>}>",
        "LayoutUsb: Copying file [%s] to [%s]...",
        "(Flags & ((0x00000002) | (0x00000004))) != ((0x00000002) | (0x00000004))",
        "RestoreFileMetadata: RestoreFileInfo failed",
        "<2<e<{<",
        "List of debugger files is empty",
        "RecoverUsb",
        "D$,0?",
        "mi-NZ",
        "9T:^:",
        "0 0@0",
        ">6?T?",
        "Wim Capture: Creating target WIM file: [%s] (without verification)...",
        "LayoutIso: Deleting ISO file due to error: 0x%X",
        "nb-NO",
        "5A5k5",
        "lo-LA",
        "Failed to lookup privelege! Error code = %#x",
        "es-BO",
        "Not-null check failed: Source",
        "malloc",
        "o pedida n",
        " kildeplaceringen er for stor for FAT32-filsystemet.%0",
        "6P7^7t7",
        "QQVW3",
        "Pyydetty asema on liian suuri FAT32-tiedostoj",
        "229879+4583620",
        "Substitue name string copy failed",
        "o pedida detetou um erro.%0",
        "rios.%0",
        "RtlReallocateLBlob",
        "9C9Y9d9",
        "Failed to enumerate boot entries. Status: %x",
        "5@5G5u5",
        "L$D_^[3",
        "WIM\\ESD\\ENCRYPTED\\RANGE[*]",
        "CDlpTransportBits::Pause",
        "LocalSize failed",
        "BfspPrintFileOwnerProcess: Failed to open file!Last Error = %#x",
        "1$1D1L1X1x1",
        "BcdCloseStore: Failed to acquire BCD sync mutant. Status: %x",
        "ration demand",
        "CMicrodomBuilder::ConsumeAttdef",
        "Failed to delete \"%ws\" variable. Status: %x",
        "7\"7s7",
        "wcsstr",
        "EsdLayout: Initializing ESD Path: [%s]",
        "bootx64.efi",
        "GetFileVersionInfoW",
        "ZwReleaseMutant",
        "OCDUS\\Policies",
        "Um transporte de rede deve ser selecionado para o arquivo ser adicionado para transfer",
        "CDlpManager::SetThreadPriority",
        ">2>8>O>V>",
        "CMicrodomBuilder::CFourStringIdTable<unsigned short>::Initialize",
        "Windows::uDom::Rtl::RtlMicrodomUpdateCreateElementNs",
        "L'oggetto azione specificato non ",
        "Error copying boot debugging files from %ws to %ws (%ws). Last Error = %#x",
        ">&>G>",
        "BitsTransport: Leaving Execute Method",
        "? ?f?m?",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::Pause",
        "Operativsystemet Microsoft",
        "Sistema Operacional Microsoft",
        "Az OEM-part",
        "system32\\recovery\\$PBR_ResetConfig.xml",
        "D$8SVW",
        "Waiting for prepare thread to exit.",
        ":#:w:",
        "es-CL",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FveDetect\\Cache",
        "LayoutPath",
        ":$;+;F;M;w;",
        "yKVh_",
        "HeapFree",
        "Windows Dlp Manager",
        "swscanf_s",
        "ConnectToSourceUrl: Using existing WinHttp connection...",
        "WriteFileImage",
        "2E2z2",
        "D$ SVW",
        "CDlpTransportBits::Deserialize",
        "Failed to add system store from file. File: %ws Status: %x",
        "0x%08X",
        "kok-IN",
        "x@S-N",
        "CreateFileMapping(%s) failed! Error code = %#x",
        "fr-CA",
        "0\\1`1d1h1l1p1t1x1|1",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::Deserialize",
        "DOCTYPE",
        "ChunkWriterFlush",
        ">0>C>W>",
        "ole32.dll",
        "0*0=0",
        "CDlpTask::GetError",
        "Failed to get system partition. Status: %x",
        ":D:h:",
        "wcstok_s",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::Execute",
        "5\"505O5p5}5",
        "0I0N0Z0",
        ";b<l<",
        "RtlCreateSecurityDescriptor",
        "WinHttpSetTimeouts",
        "Failed to modify boot entry 0x%x. Status: %x",
        "t+F;u",
        "5<LuP",
        "0$0+0t0",
        "8q9x9",
        "132U2",
        "<)<;<",
        "Bits Error: Ignoring error...",
        "pDoctype->ulSignature == ('tDdM')",
        "RtlXmlDefaultCompareStrings(&m_State.ParseState, Left, Right, pResult)",
        "jlban l",
        "1.181F1O1",
        "j.[SV",
        "CheckProcessFile",
        "DosDateTimeToFileTime",
        "%s\\Partition%lu",
        "No se puede quitar la partici",
        "6d7_8r8",
        "FormatPartition: Re-setting original OEM partition type (lost during format)...",
        "5 6C6e6",
        "ur-PK",
        "7N8x8",
        "CDlpManager::DeleteStringProperty",
        "L$<_^[3",
        "ar-EG",
        "m_StoredTable.FindOrInsertIfNotPresent(Pair, pAttDef)",
        "658P8y8",
        "CDlpManager::CreateDlpFile",
        "El tama",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::Serialize",
        "fr-SN",
        "en-ZW",
        ">7>Q>c>",
        "Microsoft Corporation1",
        "Belirtilen eylem nesnesi ba",
        "GetDisk: Finished querying VDS providers.",
        "n solicitada detect",
        "ReorderContextInsert",
        "Not-null check failed: Context",
        "CDlpWimCapture::CreateWimForSplitCapture",
        "96:J:T:",
        "NtQueryEaFile",
        "0P1Z1w1~1",
        "rjestelm",
        "Le dimensioni di un file nel percorso di origine sono troppo grandi per il file system FAT32.%0",
        "shelyen tal",
        "[2g2t2",
        "=X=q=",
        "4/454X4x4",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::GetActionName",
        "TotalBytes",
        "lem tamamland",
        "SYSROOT",
        "=#=6=",
        "858A8I8m8}8",
        ":5;U;b;",
        "7<8z8",
        "CDlpActionWimLayout::ActionLayoutToEsd",
        "D$ ;D$Ps",
        "7 7(747T7\\7d7p7",
        "iu-Latn",
        "tzm-Tfng-MA",
        "1-1c1q1",
        "Prima di aggiungere un file per il trasferimento, ",
        "IDREF",
        "BcdCopyObjectEx: Failed to set firmware object. Target: %ws Flags: 0x%x Status: %x",
        " suspendue.%0",
        "9X9\\9`9l9",
        "2!2x2",
        "2M3b3",
        "ka-GE",
        "Transfer thread has exited.",
        "ller systemfiler.%0",
        "Wim Capture: Skipping [%s] because access was denied",
        "Not-null check failed: BytesRequired",
        "9F9\\9",
        "O objeto da a",
        "SetSysVolInfoPath",
        "lonego pliku WIM.%0",
        "<P<Y<",
        "7;7U7b7",
        "Windows::Rtl::CRtlObjectTypeDescription<class MicrodomWriterImplementation::CMicrodomWriter>::CreateInstance",
        "WINDLP_BITS_PRIORITY_FOREGROUND",
        "EsdLayout: Initializing Layout Path: [%s]",
        "m haklar",
        "cs-CZ",
        "CDlpActionLayoutUsbFactory::CreateInstanceRoutine",
        "6\"7)7m7t7",
        ". Soubor je po",
        "2A2|2",
        "Failed to set file extended attribute",
        "BitsCancel: Cancelling interrupted BITS job due to caller request",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::Cancel",
        "=R>a>h>z>",
        "WimAtExitInitialize",
        "rvarande placerat i k",
        "6,646<6D6L6T6\\6d6l6t6|6",
        "CDlpActionWimLayout::ActionMediaToLayout",
        "CDlpRegistrar::CreateAction",
        "WimMatchImageCriteria: Comparing image [%d] value [%s] against [%s]",
        "NewChild->Attribute.Allocate()",
        "CMicrodomBuilder::ConsumePCData",
        "1(1/1B1I1Y1v1}1",
        "Wait for work queue failed!",
        "4:5A5",
        "1(141@1L1X1d1p1|1",
        "3o4|4",
        "D$(Pj",
        " WIM-tiedostossa olevan avaimen salausta ei voi purkaa.%0",
        "<WIM><TOTALBYTES>0</TOTALBYTES></WIM>",
        "RtlXmlInitializeNextLogicalThing(this, &Init)",
        "WimAtExitReserve",
        "CDlpRegistrar::RegisterActionFactory",
        "DeleteSource",
        "Failed to get img event",
        "<$<3<<<E<Z<o<~<",
        "D$0PQ",
        "jl nem tal",
        "IsCaptureWIMBootCompliant",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetXml",
        "ig-NG",
        "EfiBootFilePath",
        "QjdVj",
        "1*2i2s2",
        "HeapReAlloc",
        "QQPQQQQW",
        "stenen i",
        "RtlFreeSid",
        "6+6l6",
        "boot\\boot.sdi",
        "CreateTask: Error serializing state!  [0x%x]",
        "EnumeratePathEx: Unable to get reparse tag for persistent reparse point; GLE = 0x%x",
        "\\Users",
        "gt werden kann.%0",
        "Fail to read WIM header",
        "DeleteFileEx: Unable to remove [%s]; GLE = 0x%x",
        "WofMob",
        "CDlpTask::CreateDlpFile",
        "A network transport must be selected before a file can be added for transfer.%0",
        "A@;ALt",
        "SyspartIsSpace failed for partition path: %s",
        "Failed to open process. Status: %x",
        "undan, bu b",
        "9-9e9",
        "BcdOpenStore: Failed to acquire BCD sync Mutant. Store: %wsFlags: 0x%x Status: %x",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetItem",
        "T$pWP",
        "GetCurrentThreadId",
        "1+2F2P2",
        "MoveFileExW",
        "CDlpManager::GetTaskIndexByName",
        "D$(`@",
        "Aby bylo mo",
        "3A3Z3",
        "4*5@5R5",
        "iswspace",
        "RtlpGenericMicrodomUpdateGetCookieForExistingThing",
        "161~1",
        "ELEMENT",
        "1<2C2M2c2j2t2",
        "va vyhrazena.",
        "RtlInitializeSmartLBlobWritingContext",
        "n solicitada no se ha iniciado.%0",
        "495L5]5",
        "ZwQueryInformationFile",
        "Unable to open file %s for read because the file or path does not exist",
        "\\WINDOWS",
        "040804B0",
        "ObjectCookie.Opaque != 0",
        "jWX_^[",
        "SWjH_Wj",
        "onecore\\base\\servicing\\offlinehives\\offlinehives.cpp",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::Prepare",
        "OEM-partitie wordt niet verwijderd omdat deze systeembestanden bevat.%0",
        "BCryptOpenAlgorithmProvider",
        "LayoutIso: Specified boot file [%s] is missing!",
        ":]:d:q:x:6;=;",
        "CDlpActionRecoverCryptoFactory::CreateInstanceRoutine",
        "FveGetAuthMethodInformation",
        ";&;+;6;N;q;~;",
        "9J9u9",
        "CDlpManager::GetPriority",
        "System store path: %s",
        "PL0g0M0f0D0~0[0",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionRecoverCryptoFactory,class CDlpActionRecoverCrypto>::GetActionId",
        "Wim Capture: Lost underlying device handle. Retrying in [%u] ms",
        "i prov",
        "D$ T-",
        "Die angegebene WIM-Datei enth",
        "546?6M6x6",
        "9':;:F:k:",
        "5/6@6G6[6",
        "Not-null check failed: DocumentNode",
        "5:5[5x5",
        "Fail to flush file buffers",
        "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\utility.c",
        "D$<Pj",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetMicrodomBinaryRepresentation",
        "LayoutUsb: Initializing OEM Winre WIM Path: [%s]",
        "sr-Cyrl-BA",
        "CDlpActionLayoutUsb::GetPartitionInfo",
        "9Q9n9s9",
        "Vous devez s",
        "CTh T",
        "CDlpRegistrar::GetResponseFactory",
        "Failed to acquire BCD sync mutant. Status: %x",
        "Microsoft Corporation1.0,",
        "4%4C4n4z4",
        "5#6*676>6",
        "4D7]7j7",
        "Den forespurte operasjonen er allerede stoppet midlertidig.%0",
        "2#2>2E2T2l2",
        "WimSplit: PartPath: [%s], PartSize: [0x%I64X]",
        "?4?R?w?",
        "Impossibile decrittografare la chiave nel file WIM specificato.%0",
        "<B<`<",
        "4*4<4M4T4b4i4{4",
        "L'objet d'action sp",
        "5!6.6",
        "6(7R7h7y7",
        "?B?J?x?",
        "DecompressChunkedFile",
        "tzm-Latn",
        "CDlpManager::GetTaskCount",
        "CDlpActionWimLayout::UpgInitialize",
        "FormatMessageW",
        "EXFAT   ",
        "velet hib",
        "kernel32.dll",
        " un volume che risiede in questo disco contiene file.%0",
        "GetModuleHandleW",
        "CDlpActionRecoverCrypto::ClearRangesFromXml",
        "L$djo_",
        "?6?P?i?s?",
        "210121231918Z0",
        "GetSystemInfo",
        ">O>o>",
        "cannot read WIM header",
        "Failed to open description key for store. Store: %s StoreKey: %ws Status: %x",
        "4:4l4",
        "MicrodomImplementation::CDomLayoutCache::FindObject",
        "787s7",
        "BitsTransferFile: Cancelling BITS job due to error: 0x%X",
        ";)<A<L<t<",
        "nskede operasjonen er allerede avbrutt.%0",
        "CreateCaptureInfo",
        ":;:S:]:",
        "nde Windows Kurtarma g",
        "NewDocument = this->AllocateStreamObject()",
        "RestoreFileDataCallback",
        "bootmgr",
        " oper",
        "BfspPrintFileOwnerProcess: Failed to acquire debugprivilege",
        "WIM\\IMAGE",
        "0<1P1[1",
        "ret t",
        "7/8X8p8",
        ":C:^:",
        "ServiceDebuggerFiles: ConfigBuffer is too small",
        "CompressCaptureNode",
        "WimPathX86",
        "NtOpenDirectoryObject",
        "3-383p3",
        "444F4",
        "8A9Y9",
        ">(>F>S>]>+?H?[?b?n?",
        "RtlIsLUtf8StringValid(TagName) || (TagName == 0)",
        "CompressChunk",
        "CDlpActionLayoutUsb::PrepareUsbMedia",
        "WIMSplitFileWorker",
        "CurrentBuildNumber",
        "WindowsSysPartDevice",
        "%ws\\%ws",
        "ceQGO",
        "9F9`9k9",
        ">1>A>k>",
        "sources\\vista",
        "<2<9<H<O<",
        "CDlpTask::CheckUserInterruptEx",
        "The existing WIM file became corrupted",
        " FAT32.%0",
        "(NamespaceURI == 0) || RtlIsLUtf8StringValid(NamespaceURI)",
        "WimLayout: Creating scratch path: [%s]",
        "kkelen i angitt WIM-fil.%0",
        "687M7T7m7t7",
        "=/=E=",
        "CDlpManager::CheckInitialized",
        "CXhhe",
        "3E3N3U3d3",
        "_wcsrev",
        "D$@9D$",
        "EsdLayout",
        "ScanDirNodeTree",
        "2-2N2",
        "<F<`<k<",
        "WimLayout: Checking ESD package file: [%s]",
        "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6",
        "<(=B=O=",
        "2-3A3L3j3",
        "DlpTask: Transport not set. Skipping download phase.",
        "tu opakov",
        "2E2^2i2p2",
        "<'<6<C<",
        "=H=b=o=",
        "header version mismatch",
        "FileDescription",
        "689j9o<",
        "L0p0{0",
        "t. A f",
        "f9XBt",
        "_XcptFilter",
        "4!5,5",
        "5.555b5i5t5",
        ";8<x<",
        "4)404",
        "r%*U$",
        "5>5E5v5&6@6Y6",
        "</%s>",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::CheckUserInterruptEx",
        "DlpTask: Skipping action progress reset due to task cancellation request.",
        "ZwSetBootOptions",
        "7H8g8n8u8|8",
        "0&0_0",
        "CXmlCursor::XmlAlloc",
        "CDlpManager::GetStringPropertyCount",
        "QVPWj",
        "onecore\\internal\\base\\inc\\rtlstringutil.h",
        " stata avviata.%0",
        "919R9h9u9",
        "CDlpManager::GetWorkingPath",
        "DwordProperty",
        "ms-MY",
        "GetFileVersionInfoSizeW",
        "WimInitXmlInfo",
        "CDlpTask::ExecuteTransfer",
        "TransferFile: TransferFileWorker failed, hr = [0x%X]",
        "BUCL::Rtl::Add<SIZE_T>( cbNecessary, Iter.Key.Length, sizeof(UCHAR), cbNecessary)",
        "SetPartitionType: The request to set type id and partition specified are both MBR format.",
        "K{m<KI",
        "929R9l9y9",
        "|SYSPART|",
        "8.8;8a8{8",
        "GlobalMemoryStatusEx",
        "4(444@4L4X4d4p4|4",
        "4#494D4c4",
        "6v7|7",
        "jrendszerhez.%0",
        "<,<k<u<",
        "r antal nya f",
        "D$HPj",
        "uW0~0W0_0",
        "\\Windows\\Microsoft.NET\\",
        "reparse point tag too short in filestream",
        "6%707@7",
        "WofCompressFileWithHandle",
        "TransferFile: User not requesting retry.",
        "CMicrodomBuilder::EndAttlist",
        "2u3{3",
        "*Q`L]",
        " wolumin, kt",
        "DlpTask: Adding file: Name = [%s], Source = [%s], Target = [%s]",
        "WIM_Chunk_Size",
        "LayoutUsb: Populating WIM Path: [%s] -> [%s]",
        " BitLocker-salauksen.%0",
        "TaskCount",
        " sendo cancelada.%0",
        "3'4A4|5",
        "7$7,747<7D7L7T7\\7d7l7x7",
        " Microsoft Corporation. Alle rechten voorbehouden.",
        "?A?d?",
        "WriteEncryptedFileRaw",
        "777O7w7",
        ";d;~;",
        "StringId < m_Entries.Length",
        "899R9}9",
        "ZwTranslateFilePath",
        ">&>O>e>p>",
        "BcdGetElementDataWithFlags: Failed to open elements key.Object: %ws Status: %x",
        "GetSecurityDescriptorSacl",
        "jHh-N",
        "j\\[f;\\A",
        "R!s4Z",
        "9X`v^j",
        ">4>A>U>c>",
        ":9:O:V:i:",
        "Not-null check failed: Root",
        "DeletePath: Failed to obliterate [%s] (GLE = 0x%x); retrying...",
        "bitlocker                       ",
        "BITS i",
        "6/6X6d6o6",
        "BitLocker ",
        "GetFileAttributes(%s) failed! Last Error = %#x.",
        "et-EE",
        "Setting element %08x",
        "575K5V5",
        "LayoutUsb: Path [%s] not found!",
        "C;X`s",
        "bo-CN",
        "4!414C4W4",
        "PPPPPPV",
        "RestoreSecurityDescriptor",
        "RegEnumKeyExW",
        "d\\O|v",
        "6$6+6",
        "FileSplitSize",
        "2%21282p2",
        "DeleteFileEx: Unable to restore attributes on [%s]; GLE = 0x%x",
        "|EFIDEFAULT|\\|DEFAULTAPP|",
        " Microsoft Corporation. T",
        "OEM-partitionen tas inte bort eftersom den inneh",
        "2;2E2o2y2",
        "dvendige dekrypteringsdata.%0",
        "6(7J7m7w7",
        "RecoverOem: Extending the system partition failed!  hr = [0x%X]",
        "9\\$$v",
        "CDlpManager::CreateTransport",
        "2O3^3",
        "CDlpRegistrar::GetState",
        "979D9Q9",
        "Failed to enumerate subkeys. Status: %x",
        "ConnectToSourceUrl: Using IE proxy settings...",
        "CMicrodomBuilder::Initialize",
        "ExportResourceCallback",
        "Transfer: %d%%, Totals: %0.2lfs, Bytes: %0.3lfMB, Rvg: %0.3lf Mbps, Tvg: %0.3lf Mbps",
        "CryptoKey",
        "EsdLayout: Opening boot wim: [%s]",
        "bootarm.efi",
        "FBf;E",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::BeginOpenElement",
        "ExportContextCopy",
        "0(181L1S1p1w1",
        "PPPPV",
        " mise en pause.%0",
        "7]7j7",
        "='>.>",
        "lony dysk nie jest gotowy.%0",
        "fr-RE",
        "GetOverlappedResult",
        "sources",
        ":8;?;N;d;",
        "l OEM nebyl odebr",
        "1&131:1b1i1w1",
        "(DynamicBuffer == 0) || (DynamicBuffer->Length == 0)",
        "CBasicNodeType::EncodeLUtf8String",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::EmitAttribute",
        "CDlpActionWimLayout::ProcessImageFile",
        ";';4;;;F;^;e;u;|;",
        "MicrodomImplementation::CDomLayoutCache::DecodeElementCounts",
        "NtClose",
        "t$ WV",
        "LayoutUsb: Initializing OEM AutoApply Directory: [%s]",
        "<'=-=W=",
        "6A6k6",
        "TlsSetValue",
        ";8;T;`;w;",
        "2$2,242<2D2L2X2x2",
        "2L3V3w3",
        "CDlpTask::NotifyActionStateChanged",
        "UuidToStringW",
        "false",
        "0*050",
        "1)151j1~1",
        "=D=V=]=g=",
        "SVWj2",
        "_onexit",
        "G^{P&a",
        " annullata.%0",
        "\\\\?\\GlobalRoot",
        "3?4k4x4",
        "Objects",
        "<FALLBACK LANGUAGE=\"%s\">%s</FALLBACK>",
        "jHXPd",
        "Limite de repeti",
        "SetPartitionType: ChangePartitionType failed, hr = 0x%x.",
        "stenen birimin boyutu ",
        "@kon|",
        ";o;w;",
        "!|$<9}",
        "8#949^9v9",
        "LayoutIso: Initializing BootFile Path: [%s]",
        ">\"?t?",
        "=d>z>",
        "lges en netv",
        "CheckBitLocker: Volume [%c:] -> FVE Flags: [0x%x]",
        "bs-Cyrl-BA",
        "L$,;L$ ",
        "WimLayoutExportImage: Exporting image index [%d]",
        "CDlpTask::UpdateState",
        "4 4$4(4,40484D4P4\\4h4t4",
        ";\";3;:;S;`;",
        "%s, DLPLOG: [0x%X] [%s] [%s]",
        "tzm-Latn-DZ",
        "File %s is too large!",
        "$`2X`F",
        "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\HIGHPART",
        "4[5i5",
        "M0K0I",
        "LayoutUsb: A volume on disk [%d] contains data. Aborting operation.",
        "GetFileVersionInfoSizeExW",
        "BootNext",
        "263@3X3^3o3",
        "ZwUnloadKey",
        "ZwQueryKey",
        "8W8u8",
        "n solicitada se est",
        "@tZ9}",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::Prepare",
        "rden avbryts.%0",
        "|SYSPART|\\|EFIDEFAULT|\\|DEFAULTAPP|",
        "LookupPrivilegeValueW",
        "MediaLayout: Initializing PreserveExistingFiles: [%s]",
        "Servicing debugger files",
        "5F5`5m5",
        "u%jXh",
        ".edata",
        "5L6Y6`6",
        "multi(%d)disk(%d)rdisk(%d)",
        "WimLayout: ESD package info: Flags: 0x%X, CompressionType: %d, BootIndex: %d",
        "Verkkosiirto on valittava, ennen kuin tiedoston voi lis",
        "TempElements.Allocate(NewCapacity)",
        "GetFileInformationByHandleEx",
        "Plataforma de Download do Windows",
        ": :@:H:P:\\:|:",
        "9{:Z;",
        "0~0Y0",
        ";Y<c<",
        " muito grande para o sistema de arquivos FAT32.%0",
        "ResExtractToFile failed",
        "7K>V>d>",
        ".00cfg",
        ":9:j:t:",
        "?:?e?|?",
        "MultiLayout: Initializing Wim Path X64: [%s]",
        "Resetting rolling average list.",
        "he-IL",
        "151<1G1",
        "RSA1Q",
        "image de r",
        "WjpVP",
        " Microsoft Corporation. Tous droits r",
        "Den angitte WIM-filen inneholder ikke de n",
        "PSSSSSSh ",
        "F;w$r",
        "WinHttpOpenRequest",
        "<C<L<",
        "llning.%0",
        "ar-QA",
        "PortableOperatingSystem",
        "rdsobjektet har inte initierats.%0",
        "Fail to update the WIM header",
        "9t$(tS",
        ">0?F?k?",
        "ar-TN",
        "::RtlIsLBlobValid(Data)",
        "nl-NL",
        "ConnectToSourceUrl: IE specifies auto-config URL.",
        "dv-MV",
        ":>;L;b;",
        "2(2H2P2X2`2h2p2x2",
        "umSSSjdQ",
        " a ser cancelada.%0",
        "3+424A4H4p4w4",
        "=F=S=Z=",
        "WinHttpQueryHeaders",
        "CompressionFolderList",
        "4<4D4L4T4\\4d4l4t4|4",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::SetParameters",
        "hsb-DE",
        "CDlpTransportHttp::PrepareRoutine",
        "CDlpRegistrar::GetActionFactory",
        "CDlpManager::TraceData",
        "tDj0j",
        "Windows::uDom::Rtl::RtlMicrodomUpdateCreateTextual",
        "sources\\recovery\\old",
        "_ultow_s",
        "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%",
        "?'?H?f?",
        "CQn04X@bk0B0",
        "96:A:b:w:",
        "|SYSROOT|",
        "363J3",
        "CDlpTask::ExecuteAction",
        "4/5D5[5b5v5~5",
        "CDlpTask::Serialize",
        "arn-CL",
        "5$505<5H5T5`5l5x5",
        "o do Windows.%0",
        "L$T_^[3",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::CloseElement",
        ":6:C:",
        "EnumImageDataEntries",
        "wH9\\$",
        "WimDetermineImages: Layout index: [%d]",
        "NtSetEaFile",
        "jHh*g",
        " en pausa.%0",
        "Description",
        "CDlpTransportBits::Cancel",
        "iu-Cans-CA",
        "\\EFI\\Microsoft\\Boot\\bootmgfw.efi",
        "tt.%0",
        ">#>*>V>]>n>u>",
        "324m4",
        "1P1y1",
        "Element",
        "WPVhx",
        ".CRT$XIZ",
        ":=:D:K:R:W:p:z:",
        "pToRemoveFrom->Element != 0",
        "E0r0Q1~1",
        "9t$Pt",
        "0F0b0v0",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteProcessingInstruction",
        "NtOpenSymbolicLinkObject",
        ";*<t<",
        "RecoverCrypto: Initializing Flags: [0x%X]",
        "<J<j<",
        "Failed to get partition name. Status = %#x",
        "0123456789abcdef",
        "ServiceBootFiles MuiOnly:%c Res:%c Fonts:%c BootMgrOvw:%c BootStatOvw:%c DbgTrn:%c SuspendBDE:%c",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionLayoutUsbFactory,class CDlpActionLayoutUsb>::CreateAction",
        "#9s0t",
        "WimBootCompress.ini",
        "SetFilePointerEx",
        "PreserveExistingFiles",
        "WimLayout: Checking ESD target path: [%s]",
        "4+4H4o4",
        "sk-SK",
        "?1?8?h?o?",
        "7+787U7h7",
        "vel desencriptar a chave no ficheiro WIM especificado.%0",
        "3$3+383?3F3",
        "AddFolderToImage",
        "RecoverCrypto: Initializing DeleteSource Value: [%s]",
        ":MdSpt",
        "es-CO",
        "CryptDestroyKey",
        "RestoreFileMetadata",
        "7&717L7",
        "The requested operation has not started.%0",
        "CopyDirectoryEx2: Specified directory [%s] doesn't exist",
        "CDlpActionWimLayout::CreateMultiArchBcdEntries",
        "4+464O4",
        "?M?T?",
        "No se puede borrar el disco porque contiene cifrado BitLocker.%0",
        "9Kdt_",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNS",
        "config",
        "2>3u3",
        "CDlpTransportBits::CleanupPath",
        "8+828?8F8K8Y8x8~8",
        "2O2n2x2",
        "0a3y3",
        "Not-null check failed: fHasAttributes",
        "El archivo WIM especificado no contiene los datos de cifrado requeridos.%0",
        "3)353H3U3r3",
        "t$T+t$",
        "? ?(?0?8?@?H?T?t?",
        "MicrodomImplementation::CMicrodom::GetNodeMapNamedItem",
        "onecore\\base\\xml\\udom_xmlwalker.h",
        "LocationHeader->Signature == ('cLdM')",
        "GetFileAttributes(%s) failed: File not found.",
        "tTf97tO",
        "Loaded hive at BCD%08d",
        "ImpersonationCountInit",
        "_vsnwprintf",
        "3E3V3]3",
        "GetSysVolRefNodePath",
        "3 3<3@3H3L3T3X3t3x3",
        "O tamanho do volume solicitado ",
        "A;K$r",
        "4=4K4d4",
        "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MiniNT",
        "1A2H2",
        "WIMCAPTURE_SPARSE",
        "01282",
        "LdrAccessResource",
        "CDlpActionWimLayout::ActionEsdToLayout",
        "4'5.5<5",
        "LayoutIso: Initializing Layout Path: [%s]",
        "jl megs",
        " on ylittynyt. Tiedosto on vioittunut.%0",
        "RtlExpandEnvironmentStrings",
        "Failed to export unload alterations to firmware. Status: %x",
        "LayoutUsb: Successfully opened source file for simple splitting.",
        "RecoverOem: Automatic file system selection: [%s]",
        "u+jKh",
        "9]:g:",
        "9D:K:S:m:",
        "ProcDirEntry",
        "454M4^4i4",
        "LayoutUsb: Leaving volume label blank!",
        "000W0e0l0",
        "CreatePartition: Failure while waiting for partition creation; hr = 0x%x, hrWait = 0x%x",
        "727@7`7w7",
        "Not-null check failed: NodeList",
        "8\"8w8",
        "050a0",
        "Belirtilen WIM dosyas",
        "en-029",
        "CMicrodom",
        "\\Device\\%s\\Partition%lu",
        "iswalpha",
        "Wim Capture: Reopened WIM handles successfully",
        "QQSVWh",
        "rda volymstorleken ",
        "4*5`5",
        "Wim Capture: Successfully reopened WIM file.",
        "Harddisk",
        "D$d9C",
        "><>R>Y>3?:?",
        "0*1^1",
        "EncodingSizer != 0",
        "Not-null check failed: pUpdateCookie",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::CleanupPath",
        "xHj1^",
        "ar-SY",
        "+q{-50",
        "93:;:K:N;^;e;z;",
        "CDlpTransportBits::Resume",
        "PrepareFile: Content-Length=[%I64u]",
        "<4<<<D<L<T<\\<d<p<",
        " zadan",
        "444B4Y4",
        "CDlpManager::DeleteStringPropertyByIndex",
        "AddFileToImage",
        "quc-Latn-GT",
        "WimLayout: Delete failure ignored. hr = [0x%X]",
        "1(151f1|1",
        "zmek i",
        "|DEST|\\|BOOTMGR|",
        "WIMCheckExistenceFromMountReparseData",
        "y8VSh",
        "NtCreateFile",
        "dana operacja napotka",
        "Invalid attributes (%#x) specified for %s file!",
        ":3:N:b:",
        "4'5M5",
        "RtlAcquireResourceShared",
        "o cont",
        "?terminate@@YAXXZ",
        "\\U0Y0N0~0Y0",
        "Not-null check failed: NewMicrodom",
        "5 6P6",
        "FveOpenVolumeW",
        "?!?r?",
        "Failed to service spaces default bootmgr",
        "en-AU",
        "GetProcAddress",
        ">5>u>",
        "Il disco specificato non ",
        "FindClose",
        "FltCommStubRename",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::Resume",
        "CMicrodomBuilder::CFourStringIdTable<struct _MICRODOM_XML_ATTDEF const *>::Initialize",
        "0MRk0",
        "<+<\\<{<",
        "TreatAsSystem",
        "WINDLP_BITS_PRIORITY_HIGH",
        "282?2w2",
        "BCryptCreateHash",
        "CDlpActionRecoverCrypto::SetProgressRange",
        "onecore\\base\\xml\\isolib_parser.h",
        "VPQQQ",
        "Prepare thread has exited.",
        "Failed to enumerate subelements. Status: %x",
        "*ppvAlloc = RtlAllocateHeap((((PPEB)__readfsdword(((LONG)(LONG_PTR)&(((TEB *)0)->ProcessEnvironmentBlock))))->ProcessHeap), 0, cb)",
        " Microsoft Corporation. Alle rettigheder forbeholdes.",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::Serialize",
        "The requested volume is too large for the FAT32 file system.%0",
        "W93uH3",
        "Nie mo",
        "\\O#]`",
        "9KdtL",
        "BitsTransferFile: Suspending execution at user request.",
        "7(7r7",
        "=H=i=",
        "3<3R3[3e3t3~3",
        " in coda.%0",
        "standalone",
        "w QSW",
        "Den angitte disken er for liten.%0",
        "jH^VR",
        ";/;F;S;",
        "0 181N1Y1",
        "NtSetCachedSigningLevel",
        "AddCompressedFileToImage",
        "Customizations",
        "CDlpTask::ExecuteActions",
        "NTFS    ",
        "7I7T7",
        "0$0,040<0D0L0T0\\0d0l0x0",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::CTempOutputStream::CreateInterface",
        "WriteDataCallback",
        "CoTaskMemFree",
        "474N4h4",
        "fFound",
        "FONTS",
        "NOTATION",
        " Windows",
        "RtlGetThreadErrorMode",
        "2%2J2",
        "BITS ",
        "Deleting element %08x blocked by secure boot policy.",
        "Der skal v",
        "j YWPS",
        "RtlImageNtHeader",
        "*41;D$<s",
        ":D;K;",
        "<\"<5<B<h<z<",
        "SetSecurityInfo() failed",
        "5A6|6",
        "6E7L7c7q7",
        "Failed to set wof data",
        "EnumImageFiles",
        "%s[*]",
        "9<9H9",
        "9%9[9}9",
        "En fil p",
        "CDlpActionWimLayout::WimInitialize",
        "\\StringFileInfo\\%04x%04x\\%s",
        " aktar",
        "pte a blokkonk",
        "m_Entries.Allocate(PoolHeader->TotalCount)",
        "G`h`b",
        "WinHttpOpen",
        "RestoreFileMetadata: RestoreHardlinks failed",
        "StringCount",
        "_^[+P",
        "1I1c1",
        "\\??\\PhysicalDrive%d",
        "Sleep",
        "1H2q2",
        "RegEnumValueW",
        "9X\\t93",
        "Windows Download Platform",
        "0Z0D1Y1",
        "Sources",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::DeserializeRoutine",
        "CDlpWimCapture::CreateNextSplitCaptureWim",
        "L$ ;L$$r",
        "(NewName == 0) || RtlIsLUtf8StringValid(NewName)",
        "=:>A>3?P?W?",
        ";D$<s",
        "RegFlushKey",
        "CDlpActionRecoverCrypto::VerifyFileSize",
        ">g>{>",
        "%windir%\\system32",
        "ExportPartialChunkedPortion",
        "SumPSQR3",
        "jlrendszerhez.%0",
        "Windows Nedlastingsplattform",
        "br-FR",
        "CDlpTransportBits::GetBitsJobStateString",
        "7/8`8",
        "nsen f",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::InitializeRoutine",
        "ga-IE",
        "RecoverCrypto: Initializing Hash Type: [%u]",
        "j?Xf;",
        "bn-BD",
        "4&4`4z4",
        "Exporting store alterations to efi",
        "(SourceCount == 0) || (Sources != 0)",
        "SL0+T~0",
        "C\\;G\\u",
        "NtQueryInformationFile",
        "CDlpActionWimLayout::MultiInitialize",
        "Failed to allocate process ID buffer.",
        "Wim Capture: Seeding WIM with an empty image [%s]",
        "#,|6d",
        ".CRT$XIA",
        "NDATA",
        "Velikost po",
        "Grensen for oppf",
        " Windows ",
        "tIVS3",
        "::RtlIsLUtf8StringValid(String)",
        "zh-CN",
        "TlsAlloc",
        "CopyDirectoryEx2: Failed to copy [%s] to [%s], GLE = 0x%x; will retry in %u ms; am on try %u.",
        "G QQVP",
        "VirtualFree",
        "CDlpActionLayoutUsb::InitializeRoutine",
        "2+323",
        "4<5c5",
        "es-PY",
        " den h",
        "FindFirstFileW",
        "ConnectToSourceUrl: IE specifies auto-detect.",
        "DeletePathDirectoryCallback: Spoofing detected deleting [%s] -> [%s]",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::Cancel",
        " soubor p",
        "9Q:X:",
        "LayoutUsb: Source directory size -> [%I64d] bytes",
        ">)>9>B>S>Y>_>e>k>q>x>",
        "ResolvePartitionTypeToCreate: %s: disk %d is a RAW disk on an EFI computer; assuming %s setting wants to create GPT basic data partition",
        "=#=G=Q=f=m=u=",
        "344S4",
        ";';g;",
        " en volym p",
        ";D$4uV",
        ".text$di",
        "u6VVh",
        "strcpy_s",
        "&apos;",
        "Den anmodede handling er allerede stoppet midlertidigt.%0",
        "CDlpFile::GetName",
        "CDlpActionWimLayout::InitializeRoutine",
        "0,1s1",
        "Failed to query processes. Status: %x",
        "C QRRRRR",
        "A rendszer t",
        "IMAGE\\DESCRIPTION",
        "Fjerner ikke OEM-partisjon fordi den inneholder Windows-gjenopprettingsavbildningen.%0",
        "2#262=2P2W2j2q2",
        "az-Latn",
        "1#2=2R2\\2",
        "3 3`3",
        "SetThreadPriority",
        "se-FI",
        "Not-null check failed: Out",
        "Copying font files from %s to %s...",
        "terst",
        "WinHttpSetOption",
        "tRVVj",
        "StorageTiering not supported",
        "pl-PL",
        "CreateDlpFile: Source = [%s], Target = [%s]",
        "moh-CA",
        "2=3{4",
        "BootDebuggerFiles.PCAT",
        "G$9G t",
        "DlpTask: Resetting transport progress start time.",
        "455J5`5",
        "? ?>?",
        "toj@j",
        "0\"0U0",
        "ZwEnumerateBootEntries",
        "ritetyss",
        "CDlpActionWimLayout::ActionMultiEsdToLayout",
        "MicrodomImplementation::CMicrodom::GetElementsByTagName",
        "<C<]<i<t<",
        "0(0.080=0B0R0c0i0z0",
        "WimSourcePath",
        "CustomizationDirPath",
        "RecoverCrypto: The source file [%s] is not a WIM that contains integrity data",
        ">H?j?",
        "Der angegebene Datentr",
        "efi\\microsoft\\boot\\efisys.bin",
        "GetDisk: Finished querying unallocated disks",
        "Error expanding string %s. Last Error = %#x",
        "lem zaten iptal edildi.%0",
        ";8;e;",
        ";P<}<",
        "ru-MD",
        "tn-ZA",
        " toimintoa ei ole aloitettu.%0",
        "lony plik WIM nie zawiera wymaganych danych odszyfrowywania.%0",
        "CDlpFile::SetSourceUrl",
        "6H6f6a7",
        "Den forespurte operasjonen er allerede avbrutt.%0",
        "6/666B6",
        "istiedoston.%0",
        " ninguna clave para descifrar el archivo WIM especificado.%0",
        "1&1Y1u1",
        "8-888b8m8",
        "RevertToSelf",
        "az-Latn-AZ",
        "RecoverCrypto: File is encrypted, but no key was provided.",
        "788b8t8",
        "LayoutUsb: Initializing OEM Extensibility Directory: [%s]",
        "273B3b3",
        "ZwOpenSymbolicLinkObject",
        "1 2:2G2m2",
        "Den angivne ISO-startfil blev ikke fundet.%0",
        "D$@SVW3",
        "5;5B5m5t5",
        "1%2<2e2",
        "DeleteFileEx: Spoofing detected deleting [%s] -> [%s]",
        "8-848H8u8|8",
        "CMicrodomBuilder::ConsumeEntityDecl",
        "ProgressTotal",
        "The specified ISO boot file was not found.%0",
        ".idata$2",
        "e obsahuje bitovou kopii pro obnoven",
        "LayoutUsb: Install WIM is spanned - TotalParts: [%d]",
        "Opening object %s",
        "\\\\?\\GLOBALROOT\\",
        "jeblikket sat i k",
        "EditionID",
        "RecoverCrypto: Successfully processed the WIM file",
        "040Y0o0z0",
        "t jZS",
        "6$6N6",
        "ljas innan det g",
        "?R?u?",
        "Opening system store. Flags: 0x%x",
        "Creating Recovery directory.",
        "C(;C$",
        "Could not move source file",
        ">$>f>l>",
        "D$DPj",
        "ProductVersion",
        " arquivos em um volume que reside no disco.%0",
        "0g0W0_0",
        "CDlpTask::GetActionByName",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::PreInit",
        "VirtualAlloc",
        "NtQueryVolumeInformationFile",
        "rakozik.%0",
        "\\Partition0",
        "zere eklenebilmesi i",
        "$SVW3",
        "ifresini ",
        "m os dados de desencripta",
        "?(?S?}?",
        "2*3:3T3[3m3",
        "<DiskConfiguration>",
        "5(6r6",
        "af-ZA",
        ":@:G:",
        "setup.exe",
        "DlpTask: Suspending task after transfer...",
        "Die OEM-Partition wird nicht entfernt, da sie das Windows-Wiederherstellungsimage enth",
        "7>8E8",
        "O0M0K",
        "WIMCloseWIM",
        "6>8I8W8",
        "Failed to query boot options. Status: %x",
        "ZwUnloadKey2",
        "CDlpTransportBits::Serialize",
        "Nenhuma chave foi fornecida para descriptografar o arquivo WIM especificado.%0",
        "mn-MN",
        "1(1/1",
        "na onar",
        "0=0D0[0d0{0",
        "4I4u4",
        "Multithreaded chunked decoding disabled via environment variable; will skip!",
        "9T$Hr",
        "Default",
        "CDlpActionRecoverCrypto::RepairBlock",
        "IMAGE",
        "ChunkWriterInit",
        "u*9BXu",
        "8!9'999@9M9S9g9n9",
        "Deleting boot entry 0x%x",
        "0R1n1y1",
        "WimCopyResource",
        "ActionWeight",
        "lt.%0",
        "TransportId",
        "?,?3?>?",
        "QQVWh",
        "PRODUCTTYPE",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        "3<3`3g3",
        "Den anmodede st",
        "ResolvePartitionTypeToCreate: %s: disk %d is a GPT disk and has more than zero existing partitions; assuming %s setting wants to create GPT basic data partition",
        "041404B0",
        "Failed to log servicing event to bootstat %ws. Status: 0x%x",
        "6!6/6g6z6",
        "ConnectToSourceUrl: Refreshing WinHttp connection...",
        ">(>4>@>L>X>d>p>|>",
        ":3:R:",
        "|SOURCE|\\|FWTYPE|",
        "?G?Q?m?}?",
        "Not-null check failed: Blob",
        "LayoutUsb: Creating partition on disk [%u]",
        "j.Yf;",
        "GetSystemDirectoryW",
        "_strnicmp",
        ".rsrc$01",
        "='=.===D=",
        "yoWhI",
        "= =+=H=",
        "Der Schl",
        "Not removing OEM partition because it contains the Windows Recovery image.%0",
        "fr-CH",
        "o foi iniciada.%0",
        "9`9j9",
        "CDlpTask::GetActionCount",
        "434I4",
        "Store %s is the system store",
        ";9<k<w<",
        "<,<:<",
        "[penc",
        "BiCreateEfiEntry failed %x",
        "1)1S2Y2",
        "onecore\\base\\xml\\udom_writer.cpp",
        "Error copying font files from %s to %s.Last Error = %#x",
        "Range: bytes=%I64u-",
        "001=1x1",
        "Failed to set wof data for file backed by wim file",
        "=0=^=i=",
        "jnXPjyPPjyjyPh(",
        "se-SE",
        "DeleteTask: Error serializing state!  [0x%x]",
        "=*>4>M>a>l>",
        " spou",
        "GetExitCodeThread",
        "2\"2L2[2h2",
        "4m4v4",
        "%c:\\sources",
        "RecoverCrypto: Transferred repair block from to [%s]",
        "install.wim",
        "BootWimPath",
        ";(<D<K<V<",
        "\\Device",
        "es-CU",
        "0?1S1a1",
        "ta-IN",
        "enos.%0",
        "QQWSQ",
        "ration Windows.%0",
        "w FAT32.%0",
        "7%888F8b8",
        "GetFileSystemFlags",
        "Przed dodaniem pliku do transferu nale",
        "marrage ISO sp",
        "0Q1g1n1",
        "uYf9s",
        "45595=5A5E5I5M5Q5U5Y5]5a5e5i5m5q5u5y5}5",
        "n por bloque. El archivo est",
        "RtlCreateMicrodom",
        "ti-ER",
        ";/<g<q<",
        "AutoApply",
        "|SYSPART|\\|DEST|\\|FONTS|",
        "?F?`?",
        "7 7@7\\7`7|7",
        "uk-UA",
        "ConvertUnallocatedDisk: Successfully added unallocated disk to a new basic pack",
        "RegUnLoadKeyW",
        "%-10ws%ws",
        "ZwCreateKey",
        "=hK2/;",
        "GetFileNodeFromPath",
        "667=7t7",
        "<(=y=",
        "3;4A4S4[4q4",
        "UpdateWIMHeader failed",
        "AutoApplyDirPath",
        "BfspSetSecurityDescriptor(%s) failed! Last Error = %#x",
        "en-SG",
        "y-Vh ",
        "uz-Cyrl",
        "j:Yf9H",
        "253E3Q3",
        "PPWh0n",
        ">+>m>",
        "RESOURCES",
        "e obsahuje syst",
        "4U5u5",
        "jlokat ",
        "Source.Length >= 2",
        "829^9h9",
        "4G4}4",
        "CDlpTask::SetCallbackRoutine",
        "CXh@W",
        "9MdHdt",
        "CDlpTransportHttp::PrepareFile",
        "es-PA",
        "CDlpTask::CheckInitialized",
        "CDlpTask::GetState",
        "CDlpActionLayoutUsb::SplitWimList",
        "sidant sur ce disque.%0",
        "La operaci",
        ":!;g;",
        "858c8",
        "ZwModifyBootEntry",
        "LayoutUsb: OEM Folder: [%s], Volume Root: [%s]",
        "D$8h!@",
        "4)4A4x4",
        "Der Datentr",
        "DecodeChunk",
        "RtlIsLUtf8StringValid(NamespaceURI)",
        "ENTITY",
        "WIMExtractImagePathAndGetFileHandle",
        "T$(94",
        "=8>O>q>",
        "Disken slettes ikke, fordi den indeholder BitLocker-kryptering.%0",
        "CreateDlpRegistrar",
        "RtlStringFromGUID",
        "525a5",
        ";1;\\;",
        ";H;b;o;",
        "ulIndex < UpdateChildNodes.Size()",
        "031U1",
        "313c3",
        "ReadMetaDataBuffer",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocumentNodeSet",
        ">7>Q>w>",
        "***   Source File: %s, line %ld",
        "<3<h<",
        "?*?F?^?r?",
        ";B;w;",
        ">,>S>m>",
        "BFSVC Warning: %s",
        "BitsTransport: SetParameters - Job Priority = [%s]",
        "ger ist nicht bereit.%0",
        "10.0.19041.572 (WinBuild.160101.0800)",
        "?6?L?W?",
        "::RtlIsLUtf8StringValid(&Sources[i])",
        ";4;Z;",
        "040604B0",
        "CryptGetUserKey",
        "\\Device\\HarddiskVolume",
        "-Tz4q",
        "smn-FI",
        ":';:;k;r;",
        ">O>u>",
        "f;D$Pu",
        "9T9]9",
        "y Vhe",
        "Action execution thread timeout period: [%d ms]",
        "261019185142Z0",
        "Failed to set Wof data for file",
        "MicrodomImplementation::DecodeXmlCharacterToUcsChar",
        "4#4<4F4g4p4",
        "onecore\\base\\lstring\\lblob.cpp",
        "6#7)7k7",
        "El disco especificado no est",
        "tLVVVW",
        "DlpTask: Suspending task during action...",
        "Failed to add boot entry. Status: %x",
        "131>1d1",
        "Not-null check failed: Writer",
        "tFPPWj",
        "F(QPj",
        "_wcstoi64",
        "ncia%0",
        "BitsExecute: Transfer already completed - returning already completed",
        "ritetty WIM-tiedosto ei sis",
        "CDlpFile::Deserialize",
        "CDlpTransportBits::GetBitsJobErrorContextString",
        "Den angivne disk er ikke klar.%0",
        "040u0",
        "8A8K8",
        "BITS-jobben er for ",
        "Pyydetty",
        "jlokat tartalmaz.%0",
        "CDlpActionRecoverCrypto::ExecuteRoutine",
        "u anda s",
        "pToInsertInto != 0",
        "2;3D3",
        "9@9N9",
        "e ne s",
        "(inherited) ",
        ";|$Xt",
        "ErrorCode",
        "9/9:9e9",
        "t0WVh,",
        "De aangevraagde bewerking wordt geannuleerd.%0",
        "\\Device\\Harddisk%lu\\Partition%lu",
        "MININT",
        " stata sospesa.%0",
        "SetEvent",
        "<A=H=S=g=l=x=",
        "o vai ser removida porque cont",
        "LocationHeader != 0",
        "Expected [%u] contiguous parts, but missing part number [%u] for [%s]!",
        ":MdLct",
        "1N1U1f1",
        "7!7M7Y7x7",
        "velet nincs elind",
        "393T3c3s3z3+4",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::UpdateState",
        "Directory",
        ".rdata$zETW2",
        "ProgressHandlerAction FinalUpdate: 0x%X, 0x%I64X / 0x%I64X, 0x%I64X",
        ";-;<;B;",
        "CDlpActionRecoverCrypto::SaveCryptedBuffer",
        " jest szyfrowany funkcj",
        "BFSVC Error: %s",
        "4a5J7",
        "RtlAllocateAndInitializeSid",
        "8*979v9",
        "NodeMap != Windows::Microdom::Rtl::NamedNodeMap::InvalidValue()",
        "0F0~0",
        ";(<B<O<",
        "r stor f",
        "2K2D4j4",
        "Creating object. Version: %d. Type: 0x%08x",
        "j$Yf;O",
        "6,7:7D7f7",
        "VVVVh(",
        "8A9H9",
        "syr-SY",
        "= =,=8=D=P=\\=h=t=",
        "7/7G7R7d7v7",
        "6+666Z6m6",
        "314o4|4",
        "718g8",
        "6,7C7",
        "Entity.Length != 0",
        "BCryptHashData",
        "t!jZjP",
        "= ='=P=",
        "041\\1",
        "GPQQh",
        "Failed to open key for all object's elements. Status: %x",
        "CDlpTask::GetParameters",
        "1E1U1h1q1",
        "bootmgr.exe",
        "2&2c2y2",
        "attente.%0",
        "CMicrodomBuilder::ConstructAndWriteMicrodom",
        "BcdCopyObjectEx: Failed to get object description Flags: 0x%x Status: %x",
        " velk",
        "RestoreFileNodeList",
        "070g0~0",
        "m criptografia BitLocker.%0",
        "The requested operation has already been paused.%0",
        "=&=+=7=M=b=j=q=",
        "r Windows-nedladdning",
        "RtlAddAccessAllowedAceEx",
        "BuildLab",
        "_initterm",
        "<)<J<d<q<",
        "NX[(W",
        "<5<<<",
        "WdsCopyFileEx: Failed to strip file attributes for %s, will delete. GLE = 0x%x",
        "oK0D$\"<",
        "$Kernel.",
        ".rdata$brc",
        "CMicrodomBuilder::GetXmlDomSize",
        "RecoverCrypto: Initializing Size: [0x%I64X]",
        "Found non-null hash in file node",
        "rkstransport, f",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::Restart",
        "=0T0k0",
        "%s: Entering Prepare Method",
        "fwprintf",
        "BCryptFinishHash",
        "5,545@5`5h5t5",
        "\\Boot\\BCD",
        ":,;`;};",
        "st tartalmaz.%0",
        "1%1F1_1",
        " SVWj",
        ";/<9<j<t<",
        "BitsExecute: Completing BITS job.",
        "RtlAppendLBlobToLBlob",
        "9!9)9",
        "uVf9S",
        "RecoverCrypto: Incorrect WIM file size [0x%I64X, 0x%I64X]",
        "Failed to expand Recovery directory path",
        "2$2;2E2L2c3r3",
        "CDlpManager::Serialize",
        "A megadott m",
        "ValidateAndClearWriteInProgressFlag",
        "en limit po",
        "lem s",
        "EsdLayout: Setting install.wim temp path to [%s]",
        "EsdLayout: Opening install wim: [%s]",
        "Encoder != 0",
        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",
        "6L6y6",
        "lonym pliku WIM.%0",
        "BcdGetElementDataWithFlags: Failed to get registry value.Object: %ws Reg type: %lu Status: %x",
        "<;<B<e=l=",
        "Wim Capture: Successfully created WIM file.",
        "<\"<-<X<_<o<v<",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionWimLayoutFactory,class CDlpActionWimLayout>::CreateAction",
        "D$PPQ",
        "Windows::StringUtil::Rtl::SubStringByCharCount",
        "9!:+:2:r:",
        "Pausing BITS job due to caller request.",
        "ps-AF",
        " opravy podle blok",
        "CDlpActionRecoverCrypto::DoFullEncryption",
        "DlpTask: Suspending task during transfer...",
        "5<6b6m6",
        "j < ValidProperties.Length",
        "WimMatchImageCriteria: Image [%d] value not found",
        "m ficheiros de sistema.%0",
        "dW0f0D0~0Y0",
        "PoolHeader != 0",
        "NtSetInformationFile",
        "Windows::Rtl::CRtlObjectTypeDescription<class MicrodomWriterImplementation::CMicrodomWriter>::CreateTearoff",
        "<O<Z<t<",
        "&amp;",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionLayoutIsoFactory,class CDlpActionLayoutIso>::CreateAction",
        "\\\\?\\GLOBALROOT",
        "Det g",
        "AddFileNodeToImage",
        "9%:k:",
        "ResAddFromFileAndHandle",
        "Den forespurte operasjonen har ikke startet.%0",
        "='=1=@=G=R=",
        "=&>E>h>",
        "7N8[8",
        "wcscpy_s",
        "FirmwareVariable",
        "Locals.Allocate()",
        "GetSystemTimeAsFileTime",
        "memset",
        "5-5X5h5",
        "BfspCopyFile(%s, %s) failed! (Attempt %d of %d) Last Error = %#x",
        "<><i<",
        "0\"0)0o0",
        "CoInitializeEx",
        "ConvertDiskStyle: Conversion failed since disk [%d] is not empty.",
        "9%919",
        "0\"0;0T0i0",
        "=/>[>",
        "CDlpActionRecoverCrypto::InitializeRoutine",
        "J\\98u",
        "CDlpActionLayoutUsb::GetDataSize",
        "MediaLayout: Initializing Source Layout Path: [%s]",
        "NodeIndex < m_pTargetObject->m_LayoutCache.TotalObjectCount()",
        "333n3",
        "__iob_func",
        "RepairAttemptsCount",
        "VerifyFileByHandle",
        "3 3%3O3",
        "7%8;8k8",
        "ConnectToSourceUrl: No IE proxy settings.",
        ">#>X>r>",
        "737>7s7",
        "digt.%0",
        "CopySid",
        "?<?D?P?t?",
        "606;6g6r6",
        "BiBindEfiNamespaceObjects failed %x",
        "EsdLayout: Cleaning scratch path: [%s]",
        "1L2i2",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::CheckInitialized",
        "2/2=2",
        "Error uncompressing boor manager (%s)! Last Error = %#x",
        "GetSysVolInfoPathFromMountPath",
        "SetFileTime",
        "GetSecurityDescriptorGroup",
        "LayoutUsb: Setting volume label to: [%s]",
        " Operativsystem",
        "LayoutUsb: Populating Boot Path: [%s, %s] -> [%s]",
        "C0K0U0[0f0m0r0x0~0",
        ";](s?",
        "boot\\etfsboot.com",
        "D$8G;}",
        "InstallWimPath",
        "=4=;=V=\\=l=s=",
        "7N8U8",
        "9$9H9h9",
        " Microsoft Corporation. All rights reserved.",
        "Failed to service spaces bootmgr. Last Error = %#x",
        "9b9i9",
        "il.%0",
        "o de origem ",
        "LayoutUsb: Setting temp path to [%s]",
        "u7WVh0",
        "zh-MO",
        "0?0\\0w0",
        "5%51585n5{5",
        "Partycja OEM nie jest usuwana, poniewa",
        "2(3/3<3C3b3",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionLayoutIsoFactory,class CDlpActionLayoutIso>::GetActionId",
        "DeleteFileEx: Unable to delete [%s]; GLE = 0x%x",
        "CopyDirectoryDirCallback: The copy was canceled by the user.",
        "MediaLayout: Initializing Target Layout Path: [%s]",
        "DeleteFileEx: Trying to set back attributes on: %s",
        "; ;8;F;g;",
        "CDlpFile::CheckInitialized",
        "WimGetFileIdByHandle",
        "ConvertSidToStringSidW",
        "annulation.%0",
        "|SYSPART|\\|DEST|\\BOOTNXT",
        "mni-IN",
        ":m;q;u;y;};",
        "\\*g/T",
        "yMWh}",
        "5F5p5",
        "r megkezd",
        "WinDlp.dll",
        "WriteFile",
        ";8;J;W;",
        "LayoutIso: Initializing Media Type: [0x%X]",
        "L$$PSV",
        "SetPartitionType: This is a recovery partition; setting specific attributes.",
        "jrapr",
        ":Q:]:d:p:w:",
        "Servicing spaces files",
        "FileVersion",
        "TRANSPORT",
        "Failed to get system partition! Last Error = %#x",
        "RtlDuplicateLUtf8String",
        "Could not set compression. Invalid cluster size.",
        "ynniss",
        "; ;5;A;",
        "0*0>0E0]0v0",
        "(Params->InputType == Windows::Microdom::Rtl::CreateMicrodomSource::Binary) || (Params->InputType == Windows::Microdom::Rtl::CreateMicrodomSource::Xml)",
        ">!?C?e?",
        "C`hPd",
        "CDlpManager::GetQuadwordProperty",
        "RtlFreeUnicodeString",
        "9&9E9T9a9w9",
        "BitsTransport: Entering Execute Method",
        "CDlpTransportHttp::Initialize",
        "WorkingPath",
        "The specified WIM file does not contain the required decryption data.%0",
        "bootmgfw.efi",
        "nde sistem dosyalar",
        "d\\O*g",
        ":B;\\;g;};",
        "(ulElementType == (0x2)) || (ulElementType == (0x3)) || (ulElementType == (0x5)) || (ulElementType == (0x1)) || (ulElementType == (0x6)) || (ulElementType == (0x7)) || (ulElementType == (0x4))",
        "Failed to get file size for %s! Error code = %#x",
        "CDlpTransportBits::TransferFile",
        "Finner ikke den angitte ISO-omstartsfilen.%0",
        "NtEnumerateBootEntries",
        "bootia32.efi",
        "1/1:1d1o1",
        "LayoutUsb",
        "\\\\.\\?:",
        "j\\Yuj",
        "SetNamedSecurityInfoW",
        "5(545@5L5X5d5p5|5",
        "Nelze de",
        "FAT32 ",
        "RestoreHardlink",
        "EnableShortnamesOnApplyTarget",
        "%wNtE",
        "2+222y2",
        "*g Rd",
        "ritetty",
        "pHeader->ulTotalSize == m_MicrodomDataBlob.Length",
        "3H3z3",
        "#document",
        "1B2V2a2",
        "<)===H=t=",
        "8P8o8",
        "5%5v5}5",
        " WIM ",
        "CMicrodomBuilder::InsertDefaultAttributes",
        "QQQQj",
        "tFWj;P",
        "=%=1=?=G=M=",
        "9-:4:Y:",
        "NtQueryInformationProcess",
        " contiene i file di sistema.%0",
        "RegCreateKeyExW",
        "30B1I1u1K2}2",
        "9:9r9y9",
        "<!<I<U<_<v<",
        "DisableBootSupport",
        "velet befejez",
        "tet t",
        "sources\\custom.swm",
        "Transferring",
        "787c7",
        " listo.%0",
        "system32",
        ">L>d>o>",
        "o solicitada n",
        "|SYSPART|\\|DEST|\\bootspaces.dll",
        "9F$tr",
        "@(93u",
        ":#:c:",
        "NW0f0D0~0Y0",
        "QWPhh",
        "BCD: %ws",
        ":1:=:D:X:b:~:",
        "NtOpenFile",
        "CDlpActionWimLayout::WimDetermineImages",
        ": :,:8:D:P:\\:h:t:",
        "fr-029",
        "?#?E?_?x?",
        "%I64X",
        "757`7",
        "LayoutUsb: Initializing File Split Size: [0x%I64X]",
        "LayoutUsb: Error setting volume label!  hr = [0x%X]",
        "Die angegebene ISO-Startdatei wurde nicht gefunden.%0",
        "file corrupted in block at offset %p",
        "dana operacja jest w toku.%0",
        "ResNodesSort",
        "Failed to find a key to load store %s. Last attempted key: %ws",
        "RestoreAllData",
        "hi-IN",
        "9'9:9",
        "-Ng0Y0",
        "es-MX",
        "version.dll",
        "velet megszak",
        "4<5y5",
        "ReadWimHeader",
        "ENTITIES",
        "Error deleting boot manager(%s)! Last Error = %#x",
        "cy-GB",
        "j\\Yf;",
        "am-ET",
        "WinDlp.pdb",
        "SyspartGetPhysicalPartitions failed with error code: %x",
        "ado.%0",
        "D$4_^[",
        "|SOURCE|\\|FONTS|",
        "=$=,=8=X=d=",
        "223<3W3i3r3",
        "hy-AM",
        "BUCL::Rtl::Add(cbReturnSize, cbThisSize, cbReturnSize)",
        "3\"4R4a4",
        "C(hLG",
        "8r SW",
        "CDlpActionWimLayout::DeserializeRoutine",
        ":\":<:I:\\:j:",
        "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a",
        "GetPartitionInfo: Partition Number [%u] found at offet [0x%I64X]",
        "NewEntityDecl = this->AllocateStreamObject()",
        "?)?d?",
        "Er moet een netwerktransport zijn geselecteerd voordat een bestand kan worden toegevoegd voor overdracht.%0",
        "zu-ZA",
        ",SVW3",
        ".xdata$x",
        "5X5_5",
        "Een bestand op de bronlocatie is te groot voor het FAT32-bestandssysteem.%0",
        "O:%sG:%sD:P(A;;FA;;;%s)(A;;GRGX;;;BA)(A;;GRGX;;;SY)(A;;GRGX;;;BU)S:(AU;FASA;0x000D0116;;;WD)",
        "CDlpTransportBits::JobError",
        "El trabajo de BITS est",
        "tj98rZ",
        "o pedida est",
        ";J;a;h;",
        "?!?X?",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::CheckUserInterrupt",
        "DVD\\EFI\\boot.sdi",
        "te9w0t",
        "ja-JP",
        "WriteChunkedRegion",
        "uI;D$",
        "SetPartitionType: Either the partition style for the request [%s] is either unknown, or does not match the style of the specified partition [%s].",
        "JobModification: Error [0x%X] retrieving BITS job queued message.",
        "RtlLengthSid",
        "CryptDecrypt",
        "CDlpFile::Initialize",
        "vel descriptografar a chave no arquivo WIM especificado.%0",
        "<0<=<X<r<",
        "ProgressHandlerAction: Skipping progress for uninitialized action [%d].",
        "rt.%0",
        "RtlWriteMicrodomXml",
        "G`h(g",
        ":O:i:v:",
        "9 9]9p9",
        "1+2A2N2",
        "|%s|%d|%I64d",
        "v=j\\Zf9",
        "WinHttpReadData",
        " velges f",
        "CDlpActionLayoutUsb::RecoverOemPartition",
        "t9f91t4",
        ";$;S;e;",
        ";3rU;",
        "SetVolumeLabelW",
        "646B6`6t6",
        "WIM\\IMAGE[*]\\TOTALBYTES",
        "9/9A9f9",
        "3?3u3",
        "RtlCopyLUtf8StringToLUnicodeString",
        "6:6Q6d6w6",
        "O(uY0",
        "%Microsoft Windows Production PCA 2011",
        "No se puede descifrar la clave en el archivo WIM especificado.%0",
        "MediaLayout",
        "8$808<8H8T8`8l8x8",
        "\\EFI\\Microsoft\\Boot\\BCD",
        ".text$x",
        "t:9L$",
        "tk-TM",
        "DeletePath: [%s] doesn't exist as a directory; nothing to delete.",
        "tzm-Tfng",
        ";\";J;Q;^;q;",
        "LayoutUsb: Flushing volume [%s]...",
        "0f;1u",
        "Wim Capture: Successfully reopened image in WIM",
        "> >0>8>@>P>X>`>p>x>",
        "nn-NO",
        "Le volume demand",
        "RestoreStreams",
        "LayoutUsb: Skipping OEM Path: [%s]",
        "888?8F8M8T8[8a8w8|8",
        "loha BITS je aktu",
        "=E=o=",
        "failed to extract file from reference extension",
        "VarFileInfo",
        "lonego pliku rozruchowego ISO.%0",
        " siirrett",
        "CXmlNamespaceManager::Initialize",
        ">9?@?N?",
        "pProcessResFileBackedByWim",
        "DeleteCriticalSection",
        "989A9",
        "ca-ES-valencia",
        "CompressionType",
        "AdjustTokenPrivileges",
        "=0>g>",
        "CDlpTask::Initialize",
        "BcdOpenStore: Failed to add store from file %ws. StoreFlags: 0x%x Status: %x",
        "CMicrodomUpdateContext::CreateVirtualAttribute",
        "pa-Arab",
        "2Y3z3",
        "quz-PE",
        "UNKNOWN",
        "EnumHashTable",
        "De opgegeven schijf is te klein.%0",
        "ObjectHeader->uElementType == ucObjectType",
        "De aangevraagde bewerking is voltooid.%0",
        "818E8R8l8~8",
        "ZwQueryBootEntryOrder",
        "o del volumen solicitado es demasiado peque",
        "vs.%0",
        "l.sys",
        "RecoverCrypto: File size DOES NOT match.",
        "ProductSuite",
        "RtlXmlDetermineStreamEncoding(&TokenizerState, &EncodingLength)",
        "VirtualQuery",
        "1J1P1n1",
        "<,=w=",
        "BfspPrintFileOwnerProcess: NtQueryInformationProcessfailed! Status = %#x",
        "CDlpTask::SetWorkingPath",
        "Failed to clear system store flag. Status: %x",
        "Die OEM-Partition wird nicht entfernt, da sie Systemdateien enth",
        "<-=k={=",
        "m encripta",
        ">.?n?",
        "^[w!QRW",
        "Den forespurte operasjonen blir avbrutt.%0",
        "gsw-FR",
        "2!2,2Q2",
        "0XSMOn06RP",
        "WofAdk",
        "en-HK",
        "CDlpActionRecoverCrypto::DoFastEncryption",
        "LayoutUsb: Populating Layout Path: [%s]",
        "?,?b?m?",
        "5-5K5",
        "7?8Z8",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::Suspend",
        "ReadChunk",
        "onecore\\base\\xml\\udom_modify.cpp",
        "Failed to query \"%ws\" variable. Status: %x",
        "ChunkWriterEnqueue",
        "sd-Arab",
        "5=7F7b708",
        "051Y1",
        "O ficheiro de arranque ISO especificado n",
        "Reset: Error serializing state!  [0x%x]",
        "DuplicateTokenEx",
        "8R;b;",
        "O volume pedido ",
        "CDlpManager::SetStringProperty",
        "km-KH",
        "FX;GXu",
        "Parallel chunk decode queue empty; switching to synchronous decode",
        "UuidFromStringW",
        "ulWhich < TheMap->Length",
        ">G>]>",
        ".CRT$XCA",
        "EsdLayout: Exporting boot image(s) to ESD file...",
        ". Dosya bozuk.%0",
        "CDlpFile::UpdateState",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::ExecuteRoutine",
        "jl visszafejt",
        "The requested operation has completed.%0",
        "CXmlLogicalState::Initialize",
        "QQPh@",
        ">6>Q>i>",
        "Failed to open system store. Status: %x",
        "SetFilePointer",
        "354r4",
        "CDlpActionRecoverCrypto::SetProgressData",
        "<6<X<z<",
        "lony dysk jest za ma",
        "1!3#4",
        "ynnistystiedostoa ei l",
        "NewTearoff.Allocate()",
        "RegQueryInfoKeyW",
        "?0?X?s?",
        "LayoutIso: Successfully retrieved IFileSystemImage2 object!",
        "y0Vh/",
        "9)9S9l9",
        "sources\\install.wim",
        "Using source OS version %I64x",
        "99t$ t",
        "NewChild->Comment.Allocate()",
        " Microsoft Corporation. Todos los derechos reservados.",
        "D$8PS",
        "90M0[0",
        "0k0o0'YM0Y0N0~0Y0",
        " soubor ISO nebyl nalezen.%0",
        "5*585F5T5b5p5~5",
        "RtlMatchLUtf8StringAgainstPointerList",
        "RtlCompareMemory",
        "MicrodomImplementation::CMicrodom::FindObject",
        "SetImpersonationCount",
        ":::I:Z:a:w:~:",
        "DEFAULTAPP",
        "ExportForCrossFileTarget",
        "250701214655Z0|1",
        "FindFreeExtent: Trying to find extent matching these criteria (byte offset of 0 implies no offset preference): [WithinContainer = %s] [Size >= 0x%I64x bytes] [Byte offset = 0x%I64x]",
        "Failed to open key for element %s. Status: %x",
        "%04d-%02d-%02d %02d:%02d:%02d",
        "\\ArcName\\",
        "bs-Latn",
        "RecoverOem: Extending the system partition succeeded!",
        "ConvertDiskStyle: Failed to convert disk [%d] to %s; hr = 0x%x",
        "Not-null check failed: Params->Source.pIStream",
        "::BUCL::Rtl::Add<SIZE_T>( *pcElements, 10, NewCapacity)",
        "fr-HT",
        "UpgLayout: Initializing FP data...",
        "040404B0",
        "jd^-x",
        "LayoutUsb: Recover usb. Using BfsServiceBootFiles to copy boot files",
        "51575d5",
        "7*757[7o7",
        " necessario selezionare una rete del trasporto.%0",
        "<4<V<x<",
        "CreatePartition: Successfully created partition on disk %d at {offset = [%I64u], size = [%I64u]}",
        "C`h(c",
        "1\"1.151>1P1W1e1o1",
        "9#:y:",
        "FveDeleteAuthMethod",
        "aYd(z_C",
        "#comment",
        "<9<U<",
        "fflush",
        "AllocNode",
        "CDlpManager::GetTask",
        "FveRemoveTrustedWimData",
        "ReadData failed",
        "CDlpWimCapture::Initialize",
        "HQC!!",
        "CDlpWimCapture::WimSplitCaptureFile",
        "version",
        "Schijf wordt niet gewist omdat deze BitLocker-versleuteling bevat.%0",
        ":9:l:",
        " SVW3",
        "8Z8}8",
        ">%>P>",
        "MicrodomImplementation::CMicrodom::GetNamedNodeMapItem",
        "tzm-Arab-MA",
        "CDlpActionLayoutUsb::RestartRoutine",
        "Washington1",
        "0(0G0c0",
        "Unable to decrypt the key in the specified WIM file.%0",
        "LayoutUsb: Failed to run BfsInitializeSystemVolume with path [%s], Firmware type [%s]",
        " operace u",
        "Failed to load hive into key %ws from %s. Status: %x",
        "RegLoadKeyW",
        "TransientCount",
        "BUCL::Rtl::Add<SIZE_T>(DataLength, OldLength, TempSize)",
        "CDlpTask::GetNextActionIndex",
        "Not-null check failed: String",
        "BitsTransferFile: Suspending BITS job at user request.",
        "$Recycle.Bin",
        "wcstoul",
        "626M6S6l6s6",
        "fr-MC",
        "CDlpTransportBitsFactory::GetTransportId",
        "RtlpSmartLBlobWritingContextResizePolicy",
        "Den angivne handling er allerede afbrudt midlertidigt.%0",
        "3@3X3",
        "171D1b1|1",
        "GetHandleInformation",
        "ritetty levy ei ole valmiina.%0",
        "1R1l1y1",
        "PoolHeader->Signature == ('pSdM')",
        "Het opgegeven ISO-opstartbestand is niet gevonden.%0",
        "seau avant de pouvoir ajouter un fichier au transfert.%0",
        ":%:.:::h:",
        "ReconstructionRoot",
        "030M0_0",
        "ZutA;",
        ">O?V?",
        "QPWSQQhP",
        "Impossible de supprimer la partition OEM, car elle contient les fichiers syst",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "Transfer execution thread timeout period: [%d ms]",
        "GlobalFree",
        " on parhaillaan jonossa.%0",
        ".idata$6",
        "< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\\<`<d<h<l<p<t<x<|<",
        "PrepopulateList",
        "9!9(9~9",
        " ne contient pas les donn",
        "dana operacja jest anulowana.%0",
        "NtWriteFile",
        "=N=Z=e=",
        ">?>F>",
        "WIM_MetaData_Queue_Length",
        "k att reparera block har ",
        "CryptImportKey",
        "D$0PS",
        "526Q6X6",
        "1'2.233:3H3O3",
        "2_3y3",
        "> >@>H>P>\\>|>",
        "System operacyjny Microsoft",
        "Nie odnaleziono okre",
        "ZwOpenDirectoryObject",
        "818G8T8",
        "Transferred",
        "RtlRaiseStatus",
        "Le fichier sp",
        "Opera",
        "UuidCreate",
        "<V<y<",
        "CDlpActionRecoverCrypto::DoRecovery",
        ";%<f<m<t<{<",
        "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;",
        "Microsoft Corporation",
        "RecoverCrypto:GetImageRangesFromWim -> Searching for Image ranges...",
        "N*Y'Y",
        "F\\;G\\u",
        "<7=o=",
        "dz-BT",
        "ndaki anahtar",
        "n\\\\?\\UNC",
        "?w$tQ",
        "; ;8;q;",
        "velet folyamatban van.%0",
        "9p\\t:",
        "D$$;L$`u-;D$du'",
        "L$DPj",
        "BG_ERROR_CONTEXT_REMOTE_APPLICATION",
        "WinHttpCrackUrl",
        "MicrodomImplementation::CMicrodom::CreateInterface",
        "System",
        "JobModification: Retrying [%d/%d]",
        "Plataforma de Transfer",
        "Resources",
        ">M?T?p?w?",
        "m_pTargetObject->IsNamedNodeMapValid(NodeMap)",
        "3-4o4",
        "dvendige dekrypteringsdataene.%0",
        " na tym dysku, zawiera pliki.%0",
        "fD\\I?",
        " kulcsot.%0",
        "WIMCommitImageChanges",
        "A megadott rendszerind",
        "3/3e3E4",
        "m Microsoft",
        ":H:^:i:",
        "Dosyalar bu diskte bulunan bir birimde oldu",
        "Un archivo de la ubicaci",
        "0'0U0k0",
        ";2;N;f;",
        ":!:1:Y:q:",
        "MINOR",
        "7@8P8_8",
        "EtwEventEnabled",
        "Plik w lokalizacji ",
        "TempNode != Windows::Microdom::Rtl::Node::InvalidValue()",
        "4?4k4",
        "2?2i2s2",
        "L$,QP",
        "DlpTask: Deserialize(): ActionId = [%s]",
        "\\lL\\q",
        "4&5F5",
        "RtlInitLUnicodeStringFromNullTerminatedString",
        "UD;UD",
        "5X6d6k6&7A7\\7w7",
        "Source.Length >= 3",
        "9B\\t\"9C8t",
        "1b2|2",
        "UpgLayout: Initializing Layout Path: [%s]",
        "O:%sG:%sD:P(A;CI;GA;;;%s)(A;;0x1201bf;;;SY)(A;IOCIOI;GA;;;SY)(A;;0x1201bf;;;BA)(A;IOCIOI;GA;;;BA)(A;CIOI;GRGX;;;BU)(A;OICIIO;GA;;;CO)",
        "ExclusionList",
        "3W3f3s3",
        "MediaLayout: Checking target layout path: [%s]",
        "Den angivne WIM-fil indeholder ikke de n",
        "5(5I5n5|5",
        "`V@Pj",
        "0)060T0n0{0",
        "3F4M4[4b4u4",
        "my-MM",
        "GetTempPathW",
        "WideCharToMultiByte",
        "ReconstructionPathCount",
        "CDlpActionLayoutUsb::CopyFileLists",
        "IsSecureBootBound",
        "858Y8",
        "O volume solicitado ",
        "9r4uC",
        "BfspPrintFileOwnerProcess: Malloc failed!Size = %#x",
        "raya al",
        "9 9+9V9",
        ";(<R<g<",
        "Se proporcion",
        "CMicrodomBuilder::DetermineStringTableSize",
        "=(=/=E=Y=`=i=n=",
        "GetSecurityDescriptorGroup failed! Error code = %#x",
        "GetDisk: Querying VDS providers...",
        "Failed to restore wimboot entries",
        "Balayage du disque impossible car BitLocker l",
        "D$$PR",
        "INSTALLATIONTYPE",
        "pToRemoveFrom != 0",
        "> >A>a>{>",
        "%s:(%d)",
        "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@",
        "rio selecionar um transporte de rede antes de ser poss",
        "858\\8q8",
        " stato inizializzato.%0",
        " pro de",
        "ReportData failed: Error = [0x%X]",
        "3,fTidTq ,>gEB;",
        ":::j:",
        "475O5",
        " a Windows helyre",
        "041904B0",
        "t=hH0",
        "@*93u",
        "3 3(30383@3H3T3t3|3",
        "CDlpTask::Suspend",
        "0@0b0",
        "system32\\recovery\\$PBR_Diskpart.txt",
        "6%6F6y6",
        "7A8]8p8z8",
        "RtlAllocateHeap",
        " levyll",
        "r die Ausf",
        "CDlpTask::PopChronicleResponse",
        "CDlpWimCapture::RefreshWimHandles",
        "es de d",
        "WimBoot capture failed because wimbootcompress.ini is not available!",
        "m arquivos do sistema.%0",
        "F0C;X",
        "Failed to get object identifier. Status: %x",
        "ISPCAT",
        "9G:b:",
        "Ignoring delete source directive. Only recovery has been requested",
        "Fjerner ikke OEM-partitionen, da den indeholder Windows-genoprettelsesafbildning.%0",
        "=%>H>",
        "576h6",
        "CDlpTransportBits::JobModification",
        "t1PSh(P",
        "=6>l>",
        "Store path: \"%s\"",
        ";.<L<S<_<f<q<",
        "BUCL::Rtl::Add<SIZE_T>( sizeof(MICRODOM_HEADER), cbStringPoolSize, cbDomLayoutSize, cbPositionDataSize, cbDoctypeDataSize, cbRequiredSize)",
        "InstallLanguage",
        "JobError: Retrying [%d/%d]",
        "RestoreMountStub: error creating destination file",
        "C`hli",
        "f9:tD",
        " stata gi",
        "5J6Q6?7_7v7",
        "20201008095051Z",
        ";U;f;",
        "Temp = (PUCHAR)((*RtlAllocateStringRoutine)(Bytes))",
        "L$|_^[3",
        "<*<;<Q<f<~<",
        "1#2V2{2",
        "Windows::uDom::Rtl::RtlDestroyMicrodomUpdateContext",
        "RepairRetryCount",
        "RtlInitUnicodeString",
        "q@boA",
        "8)868W8q8~8",
        "7+7Y7`7_8y8",
        " fournie pour d",
        ";=;Q;W;",
        "Failed to enumerate subobject elements. Status: %x",
        "SeSecurityPrivilege",
        "Il processo BITS ",
        "jlok tal",
        "Acknowledged",
        "quz-BO",
        "BitsExecute: Leaving BITS job suspended.",
        "8f8w8",
        "t$$hHg",
        "CDlpTask::TraceData",
        "Failed to capture directory",
        "L$(QhHg",
        "9H9o9",
        "040l0",
        "NewCData = this->AllocateStreamObject()",
        "RecoverCrypto: Initializing Hash Value: [%s]",
        "r skadad.%0",
        "415m5",
        "1%1?1|1",
        "rden har slutf",
        " nem t",
        "ZwDeleteValueKey",
        "o vai ser limpo porque cont",
        "CDlpActionLayoutIsoFactory::CreateInstanceRoutine",
        "LayoutUsb: Initializing Reconstruction Volume: [%s]",
        "9%9R9]9x9",
        "NewTempBytesRequired > TempBytesRequired",
        "ek0-N",
        "\\KernelObjects\\BcdSyncMutant",
        "RegGetValueW",
        "<$<0<<<H<T<`<l<x<",
        "j+Xf;",
        "|BOOTMGR|",
        "<4?e?",
        "hdesijainnissa sijaitseva tiedosto on liian suuri FAT32-tiedostoj",
        "=2=U=",
        "GetPartitionInfo: [%u] partitions found",
        "t$\\h(",
        "sd-Arab-PK",
        "4X5_5",
        "616B6X6c6",
        "FirmwareModified",
        "Current",
        "Not-null check failed: Length",
        "PPPPW",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::GetState",
        "ar-LY",
        "\\system32\\kernel32.dll",
        "BCD%08d",
        "WimStrDupe",
        "WimLayout: Opening ESD package file: [%s]",
        "0(0_0{0",
        "yNVjE",
        "rden har redan pausats.%0",
        "LayoutUsb: Copying folder [%s] to [%s]...",
        "=;>n>{>",
        "AddCaptureNodeToImage",
        "7d8~8",
        "NtQueryValueKey",
        ";&<M<i<",
        "Fail to update WIM header",
        " n'a pas ",
        "BG_ERROR_CONTEXT_LOCAL_FILE",
        "n solicitada ya se ha suspendido.%0",
        "o vai ser limpo porque existem ficheiros num volume que reside neste disco.%0",
        "|SYSPART|\\|DEST|\\|BOOTMGR|",
        "WINDLP.DLL",
        "Der angeforderte Vorgang wurde nicht gestartet.%0",
        "EFI\\Boot",
        ">1>?>G>",
        "__CxxFrameHandler3",
        "_wcsnicmp",
        "EnumeratePathEx: Unable to enumerate [%s]; GLE = 0x%x",
        "uz-Latn-UZ",
        " disk nen",
        ">)?0?",
        "onecore\\base\\lstring\\lunicode_string.cpp",
        "FveCloseVolume",
        "3$3,3",
        "j\\XPS",
        ">7>P>",
        "1(0&0",
        "CDlpActionRecoverCrypto::SetupWimIoCallbacks",
        "NtSetInformationProcess",
        "WINDOWS",
        "?$?0?<?H?T?`?l?x?",
        "CDlpTask::GetTransport",
        "6$7`7{7",
        "6 6N6q6w6",
        "> ?t?",
        "BcdGetElementDataWithFlags: Failed to acquire BCD sync mutant. Status: %x",
        "O disco especificado n",
        "WIM\\IMAGE[*]\\WIMBOOT",
        "hrt.%0",
        "%w't%",
        "Not-null check failed: FullOfflineHiveFilePath",
        "<&=3=:=P=W=h=o=",
        "494U4m4",
        "D$0PQR",
        "DequeueNextChunk",
        " el archivo de arranque ISO especificado.%0",
        "TempNodes.Allocate(this->m_LayoutCache.TotalObjectCount())",
        ";?;v;",
        "WIM_Chunked_Number_Of_Threads",
        "RecoverOem: System partition was not extended beyond OEM partition!",
        "Pyydetty toiminto on jo keskeytetty.%0",
        "u;9~0t6",
        "=&=U=d=k=",
        "ifrelemesi i",
        "A4;F<t?",
        "Impossible de d",
        "sselungsdaten.%0",
        "T$@WP",
        "9\"9)9/9E9`9h9n9",
        "Windows let",
        " se nach",
        "8#9.9<9Y9",
        "Der angeforderte Vorgang wird abgebrochen.%0",
        "CDlpRegistrar::CheckInitialized",
        "8,8J8_8",
        "CDlpActionRecoverCrypto::DeleteSourceFile",
        ": :(:0:8:@:L:l:t:|:",
        "a rozpocz",
        "http://www.w3.org/2000/xmlns/",
        "WimCreateWorkerThreads",
        "Bits Error: Transient Error [%d]",
        "RecoverCrypto: File deleted successfully.",
        " atualmente em fila.%0",
        "CDlpManager::GetThreadPriority",
        "CreateFileW",
        "Not-null check failed: KeyNameBuffer",
        "t~j?Yf;",
        "tcjCj",
        "9::a:",
        "RecoverOem: Partition at offset [0x%I64X] has drive letter [%c]",
        "j\\^f9tB",
        ".winmd",
        "ConvertDiskStyle: Disk [%d] is an %s disk; converting to %s...",
        "QQQPQ",
        "vwS*Y'Y",
        "899\\9~:&;-;U;s;z;",
        "1A1a1",
        "GetSecInfo failed",
        "NewAttribute = this->AllocateStreamObject()",
        "o especificada n",
        "MediaLayout: Calculating size of media path: [%s]...",
        "3\"3o3",
        "8 9I9",
        " necess",
        "Copying object. Flags: 0x%x",
        "stenen birim FAT32 dosya sistemi i",
        "r inte att dekryptera nyckeln i den angivna WIM-filen.%0",
        "WriteFile() failed or short write",
        "1!1'1/171C1I1O1U1^1g1o1z1",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "IMPLIED",
        "pHeader->ulOffsetToPositionData < pHeader->ulTotalSize",
        "tn8^\\t",
        "RtlReAllocateHeap",
        "tIWPd",
        "5<7F7n7",
        "Failed to convert guid to string. Status: %x",
        "_9^<t",
        "CryptGetKeyParam",
        "Reset restore hardlinks error because of file redirection.",
        "Pyydetty toiminto on jo peruutettu.%0",
        "9M9d9",
        "Enheten rensas inte eftersom det finns filer p",
        "VolumeLabel",
        ";2;S;",
        "vwS'Y",
        "ringen.%0",
        "565k5",
        "WimImageCreateWorkers",
        "LayoutUsb: Partition at offset [0x%I64X] has drive letter [%c]",
        "?0?7?",
        "CDlpTask::ResetActionProgress",
        "azena ve front",
        "CheckExcludeMetadata",
        "|SYSPART|\\|DEST|\\BOOTSTAT.DAT",
        "|SYSPART|\\BOOTNXT",
        "TheDocument.Reserved == m_pTargetObject->m_LayoutCache.DocumentId()",
        "SourceUrl",
        "8(8x9",
        "2&3P3h3",
        "Suspended",
        ", koska t",
        "+D$ ;|$ ",
        ";H;R;h;",
        "BitsTransport: Trying to cancel existing BITS Download Job to directory %s",
        "sr-Latn-ME",
        "LayoutUsb: Successfully created destination file part.",
        "e est termin",
        ";4;j;",
        "3SjdSjdQ",
        "rslen.%0",
        "th-TH",
        "Ett fel har uppst",
        "5/565@5m5w5",
        "213Z3r3",
        "0R1a1",
        ".CRT$XCZ",
        "CDlpManager::Deserialize",
        "_FC;]",
        "Failed to open element %ws key for delete. Status: %x",
        "020?0k0",
        "8 9%9:9J9O9a9f9y9",
        "be-BY",
        "RecoverCrypto: Initializing Remote Source Path: [%s]",
        "t\"jdY",
        "2;4J4Q4_4",
        "CurrentMajorVersionNumber",
        "1$2&3F3",
        "A\\;B\\u",
        "ti-ET",
        "<2<9<r<",
        "RVPhPs",
        ";G;s;",
        "FileHash",
        "CacheDisable",
        "4J4i4w4",
        "9/9F9^9i9",
        " v zadan",
        ".text$yd",
        "WriteData failed",
        "H0~0W0_0",
        " soubory.%0",
        ".CRT$XIAA",
        "E$j$Z",
        "6@6c6",
        "CreatePartition: Automatically converted disk [%d] to %s. The offset for the partition to create is updated to 0 (means no preference).",
        "DeletePath: Cannot delete <null>.",
        ":,:4:<:D:L:T:\\:h:",
        "ssel bereitgestellt.%0",
        "626Z6",
        "WdsRemoveDirectory: Unable to remove directory [%s]; GLE = 0x%x",
        "BitsTransferFile: Completing BITS job.",
        "7%7,737:7",
        "3#4;4F4a4",
        "j\\Zf;Ty",
        "CMicrodomBuilder::AddString",
        "Bits Error: SourceUrl Modified: [%s] => [%s]",
        "444L4",
        "CDlpActionLayoutUsb::PopulateOemPath",
        "LayoutUsb: Restoring previous error mode: [0x%X]...",
        "=$=S=",
        "CDlpTransportBits::HandleJobError",
        "DlpMgrInit: WorkingPath = [%s], Disposition = [%s], Flags = [0x%X], Diagnostics = [%s], StockRegistrar = [%s], UserRegistrar = [%s]",
        "Plattform f",
        "7/8q8",
        "berschritten. Die Datei ist besch",
        "DVD\\PCAT\\BCD",
        "ApplyReparseFixup",
        "ReleaseSemaphore",
        "1K2e2",
        "<h=w=}=",
        "Copying boot files CopyBootManager(%s) %s -> %s ",
        "8/898s8",
        "chargement de Windows",
        "G\\h(P",
        "6I7P7",
        "?$?*?",
        "ii-CN",
        "v j\\Xf;",
        ";2;S;f;",
        "<p=z=",
        "QQSVWj",
        "CDlpTask::GetName",
        "CDlpTask::ProgressHandlerTransfer",
        "ro-RO",
        "A megadott lemez t",
        "u&f98t",
        "RtlCreateAcl",
        "<3=e=w=",
        "1!1F1j1",
        "n de origen es demasiado grande para el sistema de archivos FAT32.%0",
        "Der blev ikke angivet en n",
        "Microsoft Corporation1&0$",
        "707=7Q7^7",
        "BiExportBcdObjects failed %x",
        "ResetEvent",
        " J9\\$$u",
        "qps-ploc",
        "CDlpTask::Deserialize",
        "Le dimensioni del disco specificato sono insufficienti.%0",
        "565N5y5",
        "bs-Latn-BA",
        "?\"?-?|?",
        "949<9H9h9p9|9",
        "060y0",
        ":+;g;",
        "CDlpFile::Serialize",
        "ExportCopyStream",
        "2(2F2q2z2",
        "::RtlIsLUtf8StringValid(Candidates[i])",
        "RtlImpersonateSelf",
        "Ignoring delete source directive. We are in FastEncryption mode",
        "CMicrodomBuilder::CNamespaceNamePrefixToAttDef::Insert",
        "WimDetermineImages: Checking image [%d] for Name: [%s]",
        "?)?_?d?}?",
        "t'h4#",
        "r inte klar.%0",
        "4#4C4z4",
        "161C1a1{1",
        "4N4h4u4",
        "A file in the source location is too large for the FAT32 file system.%0",
        "809c9",
        "m souboru WIM.%0",
        " contiene crittografia BitLocker.%0",
        "6 6R6",
        "%s(%d): Result = 0x%X",
        "BiBindEfiEntries failed %x",
        "4!4:4\\4j4",
        "RestoreFileMetadata: RestoreFileStorageTierClass failed",
        "rden har redan avbrutits.%0",
        "@@@@@@",
        ">->C>n>",
        "FIXED",
        "+RjjQ3",
        "CDlpTransportBits::CheckInitialized",
        "7A8Y8",
        "p!c5Mf",
        ">Q?e?s?",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::UpdateState",
        "Failed to get the size needed for the registry data. Status: %x",
        "ZwSetBootEntryOrder",
        "es-US",
        "No se puede borrar el disco porque hay archivos en un volumen que reside en este disco%0",
        ";C;Z;",
        "ACTION",
        "4M4a4h4",
        "A 3F ",
        "0[0#1@1G1[1",
        "BCD Warning: %ws",
        "RtlAcquireResourceExclusive",
        "tiedostoja.%0",
        "rw-RW",
        "RecoverCrypto:GetImageRangesFromWim -> ImageCount = [%d]",
        "Failed to service spaces DLL. Last Error = %#x",
        ";;;B;",
        "NtQueryDirectoryFile",
        "WIM\\IMAGE[*]\\WINDOWS\\INSTALLATIONTYPE",
        "6%616Q6",
        "x8!D$",
        "3V3s3",
        "na odszyfrowa",
        "7#7-747:7@7F7L7|7",
        "G`hx\\",
        "Canceling reconstruct.wim capture due to failure in progress callback: 0x%08x",
        "EnumeratePathEx: Callback requested enumeration interruption or hit internal enumeration failure on [%s]; GLE = 0x%x",
        " SFVP",
        "4K5e5r5",
        "zh-HK",
        "Queued",
        "4;4B4b4i4~4",
        "7V8]8t8",
        "969J9U9x9",
        "Den angivna WIM-filen inneh",
        "t$Th8f",
        "6*6W6",
        "BootFilePath",
        "BitsExecute: Suspending execution at user request.",
        "4n6u6",
        "CDlpActionRecoverCrypto::SaveEncryptedRangesToWim",
        "se-NO",
        "PRODUCTNAME",
        " Microsoft Corporation. Wszelkie prawa zastrze",
        "L$ h?",
        "=$>v>",
        "ks-Deva-IN",
        "Not-null check failed: Target",
        "MicrodomImplementation::CMicrodom::GetElementById",
        " toiminnossa on tapahtunut virhe.%0",
        "ksi.%0",
        "<3<N<[<m<}<",
        "En fil i kildeplasseringen er for stor for FAT32-filsystemet.%0",
        "F,j\\P",
        "e ist zu klein.%0",
        "NtQueryBootOptions",
        "_wcsupr",
        "pap-029",
        "Failed to get token information! Error code = %#x",
        "2$202<2H2T2`2l2x2",
        "4\\4x4",
        "CDlpManager::GetDwordProperty",
        "Error",
        "RestoreDirTree: RestoreFileStorageTierClass failed",
        "BX;AX",
        "<,=[=}=",
        "in disk silinmiyor.%0",
        "<-<d<",
        "[F$d*",
        " el, mert rendszerf",
        "!0(0L1S1",
        "Kan ikke dekryptere n",
        "\"0\\0c0",
        "t0jLWV",
        ";8;F;K;R;d;",
        "_wcstoui64",
        "Signalling actions thread to shut down.",
        "CDlpFile::GetTargetFullPath",
        "?C?o?",
        "tnVSj",
        "tXVWj",
        "WimLayout: Successfully opened ESD package file.",
        "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\sync.c",
        "4S4|4",
        "4^4q4",
        "OriginalFilename",
        "CDlpManager::DeleteDwordProperty",
        "RestoreFilesCallback",
        "RecoverOem: Formatting the partition on disk [%d] at offset [0x%I64X] with filesystem [%s]",
        " zawiera obraz odzyskiwania systemu Windows.%0",
        "494S4",
        "CDlpManager::SetDwordProperty",
        "395T5",
        "Error setting attributes on %s. Last Error = %#x",
        "LayoutUsb: Converting partition layout to MBR on disk [%u]",
        "lL7Ki\"0",
        "ZwQuerySystemInformation",
        "0W0j0D0g0O0`0U0D0",
        "@.reloc",
        "8M9T9z9",
        ";&;4;Z;g;",
        "CDlpManager::SetPriority",
        "CDlpManager::ReportData",
        "lt nicht die erforderlichen Entschl",
        "\\\\?\\Volume{",
        "2>3o3v3",
        "ZwOpenMutant",
        "hrung von Reparaturvorg",
        "6!717G7",
        "Ph(Y-",
        "bin-NG",
        "|SOURCE|\\Misc\\|FWTYPE|\\bootspaces.dll",
        "NewChild->Element.Allocate()",
        ":#;h<",
        "8\\8|8",
        "Isolationp::Parse::CTemplatizedStringIterator<struct _LUTF8_STRING>::Attach",
        "ServiceSpaces: Skipping non-Windows %s",
        "MediaLayout: Checking source layout path: [%s]",
        "lemde bir hatayla kar",
        "1=1R1Y1c1{1",
        "9$909<9H9T9`9l9x9",
        " Windows.%0",
        "bn-IN",
        "RtlReallocateLUtf8String",
        "?(?C?]?j?",
        "0B1u1",
        "%s: Leaving Prepare Method",
        "9b:u:",
        "SOFTWARE",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "prs-AF",
        "%s\\ControlSet%03u",
        "D$@;D$P",
        "3;4g4",
        "MaxVolumeSize",
        "tmj\\W",
        "Select",
        "ifrovat kl",
        " anulowana.%0",
        "MultiByteToWideChar",
        "@.rsrc",
        "LayoutUsb: Initializing Reconstruction Path: [%s]",
        "8%8\\8",
        "Microsoft Time-Stamp PCA 20100",
        "RQRRR",
        "u'QQQ",
        "Qj2QQ",
        "NtShutdownSystem",
        "w2t,-L",
        "WinHttpQueryDataAvailable",
        "Control\\Windows",
        "R:S-N",
        "?!?U?\\?k?r?",
        "1+1u1",
        "RtlInitAnsiString",
        "Failed to initialize description key for store. Store: %s StoreKey: %ws Status: %x",
        "PrepareFile: WinHttpQueryHeaders failed -> [0x%X]",
        "CDlpActionLayoutUsb::SplitFileList",
        "WIMLoadImageInternal",
        "6C7J7",
        "InitLZMSCompression",
        "1.1S1h1r1",
        "<8<J<q<",
        "Fjerner ikke OEM-partisjon fordi den inneholder systemfiler.%0",
        "LayoutUsb: Splitting WIM file...",
        "242Z2",
        "353y3",
        " BITS ",
        "NewInstance.Allocate()",
        "0 0<0",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::GetParameters",
        "Le dimensioni del volume richiesto sono insufficienti.%0",
        "wcsnlen",
        ">H>c>{>",
        "7E7x7",
        "Het gevraagde volume is te groot voor het FAT32-bestandssysteem.%0",
        "kn-IN",
        "RtlDowncaseUnicodeChar",
        ";@;w;",
        "?;?F?r?}?",
        "LdrGetProcedureAddress",
        "LayoutUsb: Skipped disk prep for drive %c",
        "ZuyA;",
        "%wPtG",
        "Error creating boot status data log(%s)! Bytes written = %#x, desired = %#x",
        "7#8=8",
        "Root != Root.InvalidValue()",
        "2=2W2d2",
        ">p?w?",
        "sources\\install.swm",
        "PPPPPPP",
        "VS_VERSION_INFO",
        "Impossible de supprimer la partition OEM, car elle contient l",
        "4(40494C4U4]4f4p4",
        "<a?h?",
        "1,2B2",
        "747@7K7h7",
        "0K1y1",
        "CMicrodomBuilder::StartDocument",
        "<G<k<",
        "uz-Cyrl-UZ",
        " en enhed, der er placeret p",
        "LayoutUsb: Initializing Volume Label: [%s]",
        ";:;F;V;`;{;",
        "<&<><w<",
        "?A?x?",
        "RestoreEncryptedFile",
        "TransferFile: Updating remote source path: [%s] => [%s]",
        "BfspPrintFileOwnerProcess: NtQueryInformationFilefailed! Status = %#x",
        "LayoutUsb: Initializing Flags: [0x%x]",
        "7-7<7l7",
        "=4=R=Z=i=",
        "Wim Capture: Timeout elapsed, refreshing device handles ...",
        "MultiLayout: Initializing DeleteSource: [%s]",
        "LANGUAGES",
        "4M5h5f7",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::Deserialize",
        "D$lSP",
        "CreateDestinationFileEx",
        "Copying boot debugging files from %ws to %ws (%ws)",
        "The BITS job is currently queued.",
        "Nie zainicjowano okre",
        "UpgLayout",
        "CMicrodomBuilder::CNamespaceNameExistenceCheck::AddAndCheckExistence",
        "CDlpTransportHttpFactory::GetTransportId",
        "7j7}7",
        "CDlpTask::UpdateProgressAction",
        "ger wird nicht gel",
        "\\IA64",
        "SYSTEM",
        "ProcessDirectory",
        "Temp = (*RtlReallocateStringRoutine)(Bytes, Blob->Buffer)",
        "?-?C?",
        "ZwDeleteBootEntry",
        "ReadMetaDataFile",
        "m_StoredTable.FindOrInsertIfNotPresent(Pair, Value, 0, pfExisted)",
        "ProgressHandlerAction: Sending final progress message for action [%d].",
        "YY_[^",
        "O:SYG:SYD:P(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)",
        "ha-Latn",
        "1G1k1",
        " je p",
        "CreatePartition: Asked to create partition of unknown DC type 0x%x",
        "Det angivna ",
        "Reset setting hardlink failure because of folder redirection",
        "WimLayout: Attempting to load setup.exe module from x64 layout path.",
        "\\Windows\\WinSxS\\",
        "1,242",
        "ytynyt.%0",
        "SetPartitionType: The request to set type id and partition specified are both GPT format.",
        "RtlCopyLBlob",
        "_unlock",
        "5/6E6m6",
        "3O4Y4o4",
        "zh-TW",
        "<9=r=",
        " em curso.%0",
        "0I0h0",
        "GetLastError",
        "V:NMO",
        ":':C:R:Y:h:",
        "LayoutUsb: OCDUS blob [%s] exists, back up into USB",
        "j0_f;",
        "5-545y5",
        "WimLayout: ESD package info: %d images, %d install images",
        "nda gereken ",
        " in corso.%0",
        "0L0X[(WY0",
        "Not-null check failed: String1",
        "ntdll.dll",
        "WorkerStateDuplicate",
        "5=6a6",
        "WriteDirImage",
        "=I=[=",
        "%s:%s",
        ";\";);4;G;i;",
        "=M=T=,>B>g>\"?Q?",
        "tt a f",
        "m_CurrentStreamObject != 0",
        "es-GT",
        "DlpTask: Skipping action progress reset due to action cancellation request.",
        "me de fichiers FAT32.%0",
        "CDlpActionLayoutUsb::CopyFileList",
        "kozen.%0",
        ">*?>?I?q?",
        "NtReadFile",
        "2C2a2u2",
        "rden.%0",
        "<P<W<g<",
        "0E1z1",
        "s0h`;",
        "=1=:=P=Z=",
        "ipraven.%0",
        "CSDVersion",
        "6)7B7]7",
        "ku-Arab",
        "WdsCopyFileEx: Failed to copy [%s] to [%s], GLE = 0x%x; will retry in %u ms",
        "2&3?3J3]3j3",
        "7=7Y7",
        "InitVDSServiceNoStatic:Loading VDS service... ",
        "Se ha superado el l",
        "97vhS",
        "BG_ERROR_CONTEXT_GENERAL_TRANSPORT",
        "Windows Setup Media",
        "CDlpActionWimLayout::WimLayoutExportImages",
        "Failed to determine whether the system partition is in a space. Last Error = %#x",
        "NtQuerySystemInformation",
        "\\$ ;E",
        "No process found using %s file.",
        "5)6q6",
        "CorruptBlocksCount",
        "undan disk silinmiyor.%0",
        "Process %s is accessing file wim %s",
        "$0+0d061=1p1w1",
        "RtlFindAceByType",
        "BiBuildIdentifierList failed %x",
        "The specified disk is too small.%0",
        "GetFullPathNameW",
        "CleanTargetPath",
        "<%s>%s</%s>",
        "No processes are using this file.",
        "user32.dll",
        "CDlpManager::SetQuadwordProperty",
        "ar-BH",
        "AllocateAndInitializeSid",
        "Cancellazione del disco non eseguita, perch",
        "LayoutUsb: Initializing Customizations Directory: [%s]",
        "FilterAttach",
        "EnumeratePathEx: Unable to construct path under [%s]; GLE = 0x%x",
        "j?Zf9TH",
        "?V?q?{?",
        "LayoutUsb: Retrying partition acquisition on disk [%u]",
        "Den angivne handling annulleres.%0",
        "4i4s4",
        "iu-Latn-CA",
        "WaitForSingleObject",
        "ExportFileNode",
        "Den angivne handling udf",
        "9Q:\\:",
        "=5>X>g>t>",
        "CDlpActionWimLayout::SerializeRoutine",
        "WimLayout: Initializing CleanTargetPath: [%s]",
        ";*</<4<><C<H<R<W<\\<c<h<m<t<y<~<",
        "n solicitada est",
        "5W5p5",
        "L$,_^[3",
        "chiffrer la cl",
        ">;?H?v?",
        " oldu",
        "RecoverOem: Assigning drive letter to partition at offset [0x%I64X]",
        "\\System Volume Information\\FVE2.{e40ad34d-dae9-4bc7-95bd-b16218c10f72}.X",
        ":#:V:a:w:",
        ";&;,;I;O;",
        "RtlString::FixedString<struct _LUNICODE_STRING,255>::Reallocate",
        "Kan de opgegeven code in het WIM-bestand niet versleutelen.%0",
        "Offset",
        "=(=A=R=",
        "CDlpTransportBitsFactory::GetTransport",
        "Wim Capture: Attempting to refresh handle to [%s]",
        "WimLayout",
        ":K:^:",
        "Timeout",
        "Windows::uDom::Rtl::RtlMicrodomUpdateRemoveElement",
        "LayoutUsb: Install WIM is not spanned.",
        "DVD\\EFI\\BCD",
        "m_StoredTable.Find(Pair, ppusAttrListNumber)",
        "PSj@j",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "_wcsicmp",
        "6 6@6`6",
        "it-CH",
        "fr-LU",
        ">'?]?",
        "8.8|8",
        "\\??\\GLOBALROOT",
        "9,:c:",
        "Eine Datei im Quellpfad ist zu gro",
        "Den forespurte operasjonen p",
        ">_?x?",
        "\\system32\\csrss.exe",
        "adovan",
        "1$1,141<1D1L1X1x1",
        "hez nincs kulcs megadva.%0",
        "CDlpActionLayoutUsb::PopulateWimPath",
        "=1>E>N>U>",
        "De aangevraagde bewerking wordt uitgevoerd.%0",
        "> >'>.>B>P>a>{>",
        "es-ES",
        "8M9o9",
        "ZwQuerySystemEnvironmentValueEx",
        "?2?Y?`?",
        "6!6;6",
        "GetVolumeInformationByHandleW",
        "4'5K5\\5",
        ">7>c>j>",
        "EsdLayout: Creating esd file: [%s]",
        "UUUUf",
        "CXmlLogicalState::{dtor}::<lambda_0fd40d3b956627884e315ff69db4f18c>::operator ()",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::GetResultsRoutine",
        "WimFileSize",
        "FveSetFipsAllowDisabled",
        "f9FHu",
        "RtlGUIDFromString",
        ":>;F;",
        "CDlpManager::AsyncSerializeDisable",
        "4M5T5",
        "nsen for reparationsfors",
        "C,Wh8",
        " dans le fichier WIM sp",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::GetResults",
        "6_7i7",
        "LoadStringW",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionLayoutUsbFactory,class CDlpActionLayoutUsb>::GetActionId",
        "uV9{4t",
        "<Z=l=",
        "CDlpTransportBits::SetParameters",
        "Ingen n",
        "L'operazione richiesta viene annullata.%0",
        "CDlpTask::GetChronicleResponseCount",
        "4$5C5w5",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::GetTransportName",
        "Fehler beim angeforderten Vorgang.%0",
        "tKf9>tF",
        "9x\\tCW",
        "8(848@8L8X8d8p8|8",
        "LayoutIso: Initializing Volume Label: [%s]",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::GetProgress",
        "WimLayout: Exporting HdBoot WinPe image to [%s]...",
        "CMicrodomBuilder::StartElement",
        "uM9xXu",
        "BitsTransport: SetParameters - RetryLimit = [%d]",
        "QQSVW",
        "969U9\\9o9v9",
        "\\x86\\sources\\boot.wim",
        "ff-Latn",
        "2R3Y3Z4",
        "Not-null check failed: NodeSet",
        "LayoutUsb: Wiping disk [%u]",
        "CMicrodomBuilder::ConsumeCData",
        ".text$mn",
        "uD9pXu",
        " une erreur.%0",
        "0S0i0",
        "r fel van f",
        "est pas pr",
        "j\\Xf9DN",
        "ConnectToSourceUrl: Requesting -> [%s]",
        " operace ji",
        "< <=<i<",
        "a uko",
        "20201009095051Z0t0:",
        "PrepareFile: HEAD -> Content-Length=[%I64u]",
        ";$;H;h;p;x;",
        ":3:[:u:",
        "\\Device\\Harddisk%u\\Partition%u",
        "RecoverOem: Extending the system partition on disk [%d] at offset [0x%I64X]",
        "Created new boot entry 0x%x",
        "9!9t9",
        "PQQhH",
        "MSCFu",
        "owej jest za du",
        "6!7'7Y7d7",
        "CDlpTransportHttpFactory::GetTransport",
        "FveCommitChanges",
        ">Y>c>j>",
        "1?2W2",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::GetError",
        "Cancelled",
        "_^[Y]",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::EndOpenElement",
        "ywVh(",
        "<1<6<K<",
        "?\"?/?g?t?",
        "<*<{<",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::SetParameters",
        "MicrodomImplementation::CMicrodom::DecodeXmlString",
        "0~0[0",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::SendCallbackMessage",
        "D$XAF",
        "UseSimplifiedWimSplit",
        "whichDoc.Reserved == m_pTargetObject->m_LayoutCache.DocumentId()",
        "CryptAcquireContextW",
        "Failed to determine source OS version.",
        "yJVh(",
        "ilmelidir.%0",
        "m_StoredTable.Find(Pair, ppAttDef)",
        "MatchingDeviceId",
        "The requested operation is in progress.%0",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::GetError",
        "ry znajduje si",
        "D$4PQ",
        "WimLayout: Checking ESD package file X86: [%s]",
        "CDlpTransportBits::GetBitsCopyManager",
        "uGj\\[",
        "jes til overf",
        "SetLastError",
        "3$314",
        "CDlpManager::Initialize",
        "_lock",
        ">+?J?",
        "415E5",
        "CDlpActionWimLayout::WimMatchImageCriteria",
        "rda ISO-startfilen.%0",
        "De limiet voor nieuwe herstelpogingen per blok is overschreden. Het bestand is beschadigd.%0",
        "DEFAULT",
        "gle til at dekryptere den angivne WIM-fil.%0",
        "it-IT",
        "?#?V?p?{?",
        "LayoutUsb: Disk [%d] size -> [%I64d] bytes",
        "multi(%d)disk(%d)rdisk(%d)partition(%d)",
        "D$0;D$(",
        "1a1h1 2'2",
        "::RtlIsLUtf8StringValid(StringIn)",
        "yeblikket i k",
        "pHeader->ulOffsetToDomLayout < pHeader->ulTotalSize",
        ">%>0>A>P>[>",
        ">#>*>U>",
        "041F04B0",
        "DlpTask: Entering Execute Method",
        ":F:}:",
        "Action: %d%%, Delta: %0.2lfs, %0.0lf ticks, Avg: %0.3lf ticks/s",
        "8>9W9m9",
        "|SYSPART|\\EFI\\Microsoft\\Recovery",
        "_vsnwprintf_s",
        "WimLayout: Exporting install images to [%s]...",
        "Bits Error: Reset retry count to zero.",
        "\\\\?\\GLOBALROOT%s",
        "System Volume Information",
        "CDlpFile::GetSourceUrl",
        "SetFileSize failed",
        "2#2h3",
        "NtSetInformationThread",
        "t=Wj,j",
        "t$Xhp",
        "ConnectToSourceUrl: Unable to retrieve IE proxy settings -> [0x%x].",
        "0C0A04B0",
        "CDlpManager::ShutdownSystem",
        " danificado.%0",
        "fr-CM",
        "fltlib.dll",
        "Waiting for actions thread to exit.",
        "ServiceSpaces: Skipping %s",
        "696S6",
        "TlP0X",
        "EsdLayout: Setting ESD temp path to [%s]",
        ";:;D;j;t;",
        " cancelando.%0",
        "Generating object GUID.",
        "D$, @",
        "WinDLP System Reboot",
        "kl-GL",
        "j\\Yf9",
        " na tomto disku.%0",
        "Not-null check failed: pStream",
        ">=?[?s?",
        "CDlpActionWimLayout::WimLayoutCaptureImage",
        "RestoreReparsePoint",
        ">!?;?F?n?",
        "6;7E7",
        "ne-NP",
        "YYW9]",
        "B(PVVR",
        "CreatePartition: Failed to convert disk [%d] to %s; hr = 0x%x",
        "5Fz<|",
        "Wim Capture: Splitting into a new WIM file: [%s]",
        "A valid store must have a description key.",
        "TheElement != TheElement.InvalidValue()",
        "=1=;=i=",
        "Decoder != 0",
        "ParseChunkRegionInternal",
        "ProductName",
        "?0?;?s?",
        "(Destination->Buffer != 0) || (Destination->MaximumLength == 0)",
        "Failed open key %ws. Status: %x",
        "dany wolumin jest za du",
        "7s8<9",
        "Xf9ABt",
        "8(9>9L9W9",
        "%s\\%s",
        "=&=u={=",
        "TransportName",
        "O disco especificado ",
        "3%3X3_32494@4U4_4f4",
        "ProgressHandlerAction: Sending initial progress message for action [%d].",
        "WIM\\IMAGE[*]\\WIMBOOTENTRIES",
        "8/8C8U8",
        "MAJOR",
        "5(565j5b6r6y6",
        "::RtlIsLUtf8StringValid(Source)",
        "GetAclInformation",
        "fa-IR",
        "BcdForciblyUnloadStore: Failed to acquire BCD sync mutant. Status: %x",
        "|$Pjd",
        "Windows::uDom::Rtl::RtlMicrodomUpdateGetCookieForExistingNode",
        "_wtoi",
        "j?_f9|B",
        "\\Windows",
        "CDlpTransportHttpFactory::CreateTransport",
        "O disco n",
        "-eQkU",
        "RtlSetControlSecurityDescriptor",
        "CDlpActionLayoutUsb::PopulateBootPaths",
        "526H6e6",
        "4*4N4",
        "RSA1t",
        "RtlIsMicrodomUpdateContextValid(HostUpdate)",
        "?w<t6",
        ">(>H>P>X>`>h>p>x>",
        "9A0vq",
        "CDlpManager::GetStringPropertyByIndex",
        "Process PID %d is accessing file wim %s",
        "I0G1-0+",
        "4!595]5u5",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionWimLayoutFactory,class CDlpActionWimLayout>::GetActionId",
        "lt visszafejteni a megadott WIM-f",
        "4V4n4",
        "CDlpRegistrar::RegisterTransportFactory",
        "3$4+4X4_4",
        "WimMoveFile",
        "Task->Deserialize(): TransportId = [%s]",
        "rFailed to set boot entry order. Status: %x",
        "QuadwordCount",
        "!This program cannot be run in DOS mode.",
        "o por bloco foi excedido. O ficheiro est",
        "SBCDOBJECT=",
        "ku-Arab-IQ",
        "NewChild->Text.Allocate()",
        ";5;?;p;",
        "stroje BitLocker.%0",
        "C<+C(",
        "6#7;7B70868e8",
        " foi pausada.%0",
        "NewPcData = this->AllocateStreamObject()",
        " byla zru",
        ":$:2:N:g:t:",
        "NewAttlistClose = this->AllocateStreamObject()",
        "0+0e0}0",
        "f@f#E",
        ";P;X>{>",
        "142T2b2q2",
        "Windows::Rtl::IsValid(ptr)",
        "9r$tL;",
        ">+>L>",
        "CMicrodomBuilder::ConsumeProcessingInstruction",
        "OpenProcessToken",
        "QQQQQQQW",
        "Windows::StringUtil::Rtl::SubStringByByteCount",
        "CloseHandle",
        "DeletePathEngine: Hit %d failure%s during recursive deletion of [%s]; 1st error = 0x%x, cd = [%s]",
        "LayoutUsb: Initializing Max Volume: [0x%I64X]",
        "0X1b1",
        "8)9?9J9",
        "T$(9GL|X",
        "][YZ_^_^[",
        "2&2h2y2",
        "xSVW3",
        "0 0,080D0P0\\0h0t0",
        "Connecting",
        "n de Windows.%0",
        "ReadFileEx",
        "m_AttdefListTable.FindOrInsertIfNotPresent( ulElementName, NewAttdefList, &pAttdefList)",
        "sseln der angegebenen WIM-Datei wurde kein Schl",
        "LoadIntegrityInfo",
        "NtQuerySymbolicLinkObject",
        " est trop petit.%0",
        "tBSh8",
        "ncia.%0",
        "7N7f7",
        "192Z2l2r2",
        "oc-FR",
        "Windows::uDom::Rtl::RtlMicrodomUpdateInsertChild",
        "<8=f=",
        "6 6D6d6l6t6|6",
        ">(>p>",
        ":\";>;L;f;",
        "uNj03",
        "CompareStringW",
        "7(70787@7H7P7X7`7h7p7x7",
        "E0_0r0",
        "ndirme Platformu",
        "AddReparsePointToImage",
        "es-DO",
        " Microsoft Corporation. Alle Rechte vorbehalten.",
        "QQQPQQWQQS",
        "9B\\t ",
        ":[;~;",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::Resume",
        "Failed to acquire permissions to load hive. Status: %x",
        ">%>?>L>",
        "00090E0b0",
        "Microsoft Time-Stamp Service",
        "Het opgegeven WIM-bestand bevat niet de vereiste ontsleutelingsgegevens.%0",
        "1(1?1N1h1",
        "Control\\Class\\{4D36E966-E325-11CE-BFC1-08002BE10318}",
        "Failed to open object's key. Status: %x",
        "949n9y9",
        "strncmp",
        "@LvT2",
        "6q6x6",
        "\\system32\\ssshim.dll",
        "Lohkokohtainen korjausyritysten enimm",
        "WIMSetFileShortName",
        "f92u9A",
        "CMicrodom_Blob",
        "Failed open newly loaded key %ws. Flags: 0x%x Status: %x",
        "0)1x1",
        "tvitelt.%0",
        "9)9e9",
        "97u$VV",
        "?ffffff",
        "UCS-4",
        "RecoverCrypto: File is not encrypted.",
        "7&7.7D7i7",
        "5<5N5",
        "C;_$r",
        "PUBLIC",
        "UnmapViewOfFile",
        "=q=x=",
        "141T1",
        "Cf9Y*",
        "de-CH",
        " Microsoft Corporation. V",
        "ringen for reparasjon per blokk har blitt overskredet. Filen er skadet.%0",
        "sr-Latn",
        "efi\\microsoft\\boot\\BCD",
        "CDlpRegistrar::CreateTransport",
        "IsDebuggerPresent",
        "Der angeforderte Vorgang wurde bereits angehalten.%0",
        "CDlpTask::ReportData",
        "FveAddAuthMethodInformation",
        ",`ZwFilterBootOption",
        "WIM_Chunked_Parallel_Decode",
        "GetImageErrorCode",
        "Failed to update object GUID string. Status: %x",
        "en-CA",
        "9<9C9J9Y9a9",
        "OpenProcess",
        "CDlpTask::GetFileCount",
        "[ybVhl",
        "WimLayoutExportImages: Exporting [%d] images",
        " !\"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@",
        "TerminateProcess",
        "SetThreadToken",
        "203:3R3s3",
        "s$97t",
        "RestoreSecurityDescriptor failed",
        "EsdLayout: Setting boot.wim temp path to [%s]",
        "0:0~0",
        "u\"Pj ",
        "5E5_5j5",
        "2@3G3[3",
        "CDlpManager::GetStringProperty",
        "3[3h3o3",
        "tn-BW",
        "n, proto",
        "CreatePath: Unable to create parent directory for [%s]; GLE = 0x%x",
        "9X:j:",
        "Wim Capture: Setting temp path to [%s]",
        "WimLayout: Applying Media Layout image to [%s]...",
        "_purecall",
        "WIMCreateFile",
        "e a d",
        "bootfix.bin",
        "WimPath",
        "sw-KE",
        "Attempting to determine owner of file %ws.",
        "MicrodomImplementation::CMicrodom::IRtlMicrodom_Cast",
        "=0I0~0",
        "200304183039Z",
        "Exporting forcible unload to firmware",
        "0+1D1Z1e1",
        "TlsGetValue",
        "040C04B0",
        "\\Windows\\Syswow64\\",
        "DequeueWimData",
        "Failed to open key for all objects. Status: %x",
        ";2;p;y;",
        "t$X9u t",
        "Det angivne handlingsobjekt er ikke initialiseret.%0",
        "LSVW3",
        "=,=4=@=`=h=p=|=",
        "gn-PY",
        "Multithreaded decoding for chunked WIM is enabled!",
        "SetFileStorageTierClass",
        "(Properties.Elements != 0) && (Results.Elements != 0)",
        "y,Who",
        "93:@:i:t:",
        "BcdCopyObjectEx: Failed to get object identifier. Flags: 0x%x Status: %x",
        "RecoverCrypto: Repaired block at offset [0x%I64X] of size [0x%I64X]",
        "=5=N=Y=",
        "MicrodomImplementation::CreateBinaryMicrodomFromXml",
        " vaadittuja salauksenpurkutietoja.%0",
        "res.%0",
        " Microsoft Corporation. ",
        "3!4/484?4N4d4t4{4",
        "LayoutIso",
        "CreateSemaphoreExW",
        "0k0eQc0f0D0~0Y0",
        "5+6D6|6",
        "?=?X?",
        "bertragung hinzugef",
        "RtlCompareEncodedLBlobs",
        "$SVWh",
        "1\\1c1",
        "The specified disk is not ready.%0",
        "WIMCopyFileEx failed",
        "m_AttdefListTable.Initialize()",
        "The BITS job is currently queued.%0",
        "1K2^2",
        "C,Wh`",
        "RestoreHardlinks",
        "=B=O=|=",
        "<_=t=",
        "xM9sdtF",
        "_vscwprintf",
        "Incorrect filesize. Could be corrupted",
        "Sistema operativo Microsoft",
        "SYSPART",
        "NtAdjustPrivilegesToken",
        "Not-null check failed: Matches",
        "r~akow",
        "5?5_5e5",
        "::$DATA",
        "BUCL::Rtl::Increment(m_NextStringId)",
        "CMicrodomUpdateContext::GetNodeUpdatePtr",
        "PWWWV",
        "CDlpActionLayoutIso::ExecuteRoutine",
        "EnumHashListCallback",
        "RtlSetOwnerSecurityDescriptor",
        "9~Pt.Q",
        "RecoverCrypto: File size matches.",
        " disken.%0",
        "D$ `4",
        "ZwQueryBootOptions",
        "tOf97tJh",
        "212?2v2",
        "BG_ERROR_CONTEXT_NONE",
        "Disken slettes ikke, fordi der findes filer p",
        "EnumeratePathEx: Failed search path is >= MAX_PATH!",
        "GetLoadedHiveKeyNameInternal",
        "ho souboru WIM.%0",
        "CDlpActionLayoutUsb::PopulateLayoutPath",
        "5N6U6",
        "SSSjd",
        "~(9~0t",
        "t'j\\W",
        "CMicrodomBuilder::CNamespaceNamePrefixToAttDef::Find",
        "ritetyn WIM-tiedoston salauksen purkamista varten ei annettu avainta.%0",
        "Wim Capture: Creating a new WIM file: [%s]",
        "4.484P4",
        "=:>S>",
        "ZwAllocateUuids",
        "onecore\\base\\lstring\\lutf8_string.cpp",
        "sxh|J",
        "Printing processes using %s file.",
        "CBasicNodeType::ChangeName",
        "BUCL::Rtl::Add(pCachedInfo->m_ulChildCount, pCachedInfo->m_ulAttributeCount, cNecessary)",
        "CDlpActionRecoverCrypto::DoCrypto",
        "9F sN",
        "1-1W1d1",
        "8/8H8s8",
        "484h4o4",
        "es-HN",
        "fmalloc failed",
        ">O>Z>",
        "No physical partitions found",
        ":C:d:",
        "L$,!t$0!t$4",
        "3\"303?5L5Z5",
        "CDlpTransportBits::GetTransportName",
        ":<:b:|:",
        "4%4b4p4",
        "687w7",
        "PathRemoveBackslashW",
        "pToInsertInto->Element != 0",
        "?7?D?\\?m?",
        "Det oppstod en feil i den forespurte operasjonen.%0",
        "CDlpFile::GetProgress",
        "tRSV3",
        "RecoverCrypto: Attempting to delete file [%s]",
        "sources\\$PBR_Diskpart.txt",
        "=4>i>v>}>",
        "CDlpActionLayoutIso::DeserializeRoutine",
        "3k4_5",
        "0!0E0c0",
        "si korl",
        "0!1C1",
        "4.5p7",
        "#wXsA",
        " FAT32 ",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteText",
        "emplacement source est trop grand pour le syst",
        ">=>W>d>",
        "CDlpTransportBitsFactory::CreateTransport",
        "8H9O9a9",
        "FveCheckSuspendBitLockerOnUpgrade",
        "4\"4&4*4.42464x4|8",
        "j Yf;",
        "?$?7?Z?",
        "EWjTV",
        "_ftol2_sse",
        "=&=I=S=^=e=",
        "tverkstransport m",
        "(SVW3",
        "%wLtC",
        "\\x64\\sources\\boot.wim",
        "112O2n2",
        "msvcrt.dll",
        "L'operazione richiesta non ",
        "2G2x2",
        "FALSE",
        "o ISO especificado n",
        "sma-NO",
        "Wait for work queue abandoned!",
        "Wim Capture: Capturing [%s] to [%s]",
        "ifrov",
        "CXh4u",
        "585X5x5",
        "\\Registry\\Machine",
        "I_RpcMapWin32Status",
        "Failed to bind with firmware. Flags: 0x%x Status: %x",
        "WIM_Skip_WIMBoot_Check",
        "Failed to open object %ws. Status: %x",
        "nOa-Q",
        "FltCommStubCreateChild",
        "CDlpActionLayoutUsb::DeserializeRoutine",
        "NewElement = this->AllocateStreamObject()",
        "L$(@;E",
        "t8Whx",
        "CDlpTask::InternalSetError",
        "1/1O1",
        "0C0c0",
        "6\"676I6e7",
        "t=jPj",
        "FindFreeExtent: Found suitable extent: [WithinContainer = %s], [Byte size of found extent = 0x%I64x], [Byte offset of found extent = 0x%I64x], [Return size of found extent = 0x%I64x], [Return offset of found extent = 0x%I64x].",
        "D$$0?",
        "GetFileSizeEx",
        "*** JobTransferred ***. Job State: [%s]",
        "Error creating boot status data log(%s)! Unable to allocate memory",
        "fr-MA",
        "ActionId",
        "or-IN",
        "SVWjP",
        "ExportChunkedRegionWrite",
        "sselung enth",
        "6\"6Y6",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "pDomLayout->ulSignature == ('lDdM')",
        "<*<X<e<{<",
        "<&<L<s<!=+=9=^=s=",
        "Failed to set description key value. Store: %s StoreKey: %ws Status: %x",
        "9!:;:H:t:",
        "j:Xf;F",
        "<P=^=g=",
        ":l;s;",
        "9-:Y:",
        "scht, da auf einem Volume, das sich auf dem Datentr",
        "9D9s9",
        " (Microsoft Corporation). ",
        "RtlHashEncodedLBlob",
        "d\\Oo0",
        "9HXu:9H\\u5",
        "9%8YWDQ",
        "=1=I=q=",
        "Cache",
        ">I?|?",
        "s rendszer",
        "EFI\\Microsoft\\Boot",
        "CoUninitialize",
        "HPWhD",
        "tt-RU",
        "PRODUCTSUITE",
        "7\"7D7U7_7~7",
        "3@3]3}3",
        "CDlpFile::UpdateProgress",
        "6e7|7",
        "2.2A2K2|2",
        "LayoutUsb: Failed to run SyspartGetSystemPartition with Error [0x%08x]",
        "VerifyIntegrityChunk",
        "PSSSSSS",
        "Pyydetty toiminto on k",
        ": ;4;B;h;",
        "CDlpActionWimLayout::ApplyMediaLayoutImage",
        "8#8d8",
        "081604B0",
        "QueryDosDeviceW",
        "fr-FR",
        "Den angivne disk er for lille.%0",
        "ZwSetSystemEnvironmentValueEx",
        "CreateCurrentDirectory",
        "ZwQueryAttributesFile",
        "CDlpTask::Execute",
        "505>5W5m5x5",
        "t$$RP",
        "The requested operation has already been suspended.%0",
        "Windows ",
        "1e1l1u1|1",
        "Um arquivo no local de origem ",
        "2S3t3",
        "CDlpActionWimLayoutFactory::CreateInstanceRoutine",
        "gl-ES",
        "t+C;]",
        "CDlpActionRecoverCrypto::CallbackVerify",
        "Error setting security attributes on %s. Last Error = %#x",
        "CDlpManager::GetQuadwordPropertyCount",
        "<]=d=r=",
        "o solicitada conclu",
        "Deleting element %08x",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionRecoverCryptoFactory,class CDlpActionRecoverCrypto>::SetActionId",
        ">2>9>`>",
        "7L8c8.9Q9",
        "CDlpActionWimLayout::MediaInitialize",
        "7+8d8}8",
        "=D>}>",
        "LayoutUsb: Assigning drive letter to partition at offset [0x%I64X]",
        "windlp.state.xml",
        "T$@Ph@",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteCData",
        "6%6C6c6",
        "Fjerner ikke OEM-partitionen, da den indeholder systemfiler.%0",
        "(Value == 0) || RtlIsLUtf8StringValid(Value)",
        "False",
        ";G,u.",
        "5/6n6u6",
        "yJWhe",
        "=R?Y?",
        "e je ",
        "y+VhQ",
        "Task error [0x%X] is being set while task is not in Error state.",
        "LayoutUsb: Automatic file system selection: [%s]",
        "WIM\\IMAGE[*]\\HARDLINKBYTES",
        "ZwLoadKey2",
        "=+=1=d=z=",
        "WWWVt",
        "CDlpTransportHttp::ExecuteRoutine",
        "?_?l?",
        "=<=V=c=z=",
        "; hash = ",
        "RtlIsLUtf8StringValid(LocalName) || (LocalName == 0)",
        "6!7+7C7P7V7m7",
        "zupkfb^ZVSOLIEB@=:7520-+)&$\" ",
        "o necess",
        "3,484>4C4M4Z4`4g4n4s4x4~4",
        "GetSystemWindowsDirectoryW",
        "EFIDEFAULT",
        "<$<=<Z<`<y<",
        "WimLayout: Cleaning target path: [%s]",
        ":!:i:",
        ":\":>:J:W:`:~:",
        "GetFileInformationByHandle",
        "dana operacja zosta",
        "SVWjz",
        "9M,tN",
        "2H3T3",
        "@&0_DM",
        "2O2V2",
        "<6<I<P<^<",
        "BcdCopyObjectEx: Failed to create object. Target: %ws Flags: 0x%x  Status: %x",
        " pro syst",
        "Det gick inte att hitta den beg",
        "1/1:1Q1}1",
        "-0B0I0d0v0(1P1i1s1",
        "ugi BITS znajduje si",
        "xdj(j",
        "BOOTMGR",
        "2(3O3g3}3",
        "5&616f6q6",
        "CBasicNodeType::ChangeNamespacePrefix",
        "5_6f6",
        "PPPPh$q",
        "Not-null check failed: NewXmlStream",
        "t$Xh(",
        ":?;d;x;",
        "BITS-ty",
        "BUCL::Rtl::QuickSort(Pairs, CompareStringSlot)",
        "D$<QPj",
        "CThto",
        "=B>H>",
        "is-IS",
        "S+T@b",
        "\\ProgramData",
        "EA^Wp",
        "FirmwareBootDevice",
        " sendo apagado, pois cont",
        ":$WIMMOUNTDATA:$DATA",
        "e est en cours d",
        "Failed to create handle for %s. GLE = 0x%x",
        "sselt werden.%0",
        " annul",
        "dsb-DE",
        "9^9e9",
        "RestoreFileMetadata: RecordFileDataLocation failed",
        "GWVVP",
        "1d1l1t1",
        "El disco especificado es demasiado peque",
        "MicrodomImplementation::CDomLayoutCache::AdvanceCachedPointer",
        "0!0Y0s0",
        "949B9^9n9u9",
        "|SOURCE|\\|FWTYPE|\\|BOOTMGR|",
        "n solicitada ya se ha cancelado.%0",
        "_ftol2",
        "t vybr",
        "3!4+4W4a4",
        "C(h`F",
        "080?0F0Q0X0`0p0",
        "A(VVVVPVVQ",
        "xh-ZA",
        "GetSecurityDescriptorControl",
        "Plateforme de t",
        "EtwEventRegister",
        "La partizione OEM non viene rimossa perch",
        "pt-PT",
        " est trop grand pour le syst",
        "585R5_5",
        "|SOURCE|\\BootDebuggerFiles.ini",
        "jaYjz^j:Z",
        "5&5?5b5o5",
        "4K5R5`5g5",
        "m_MicrodomDataBlob.Length >= sizeof(MICRODOM_HEADER)",
        "BootDebuggerFiles.UEFI",
        "hSVW3",
        "mt-MT",
        "8&9-9P9",
        "SeDebugPrivilege",
        "ConnectToSourceUrl: Port: [%d], Secure -> [%s]",
        "C(h`H",
        "O limite de tentativas de repara",
        "=7>x>",
        "9WHvQ",
        "GetDisk: Querying unallocated disks...",
        "8%888i8",
        "DlpTask: Executing Actions...",
        " n'a ",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttributeNode",
        "LayoutUsb: Skipping duplicate file path: [%s]",
        "PQQQW",
        "GetSecurityDescriptorLength",
        "ResolvePartitionTypeToCreate: %s: Couldn't figure out the number of partitions on disk %d, assume there're at least one partition.",
        "\\system32\\config\\",
        "WaitForMultipleObjectsEx",
        "es-ES_tradnl",
        "Kaynak konumundaki bir dosya FAT32 dosya sistemi i",
        " foi cancelada.%0",
        "3:3A3",
        ":\";K;R;c;",
        "333333",
        "CDlpTask::GetWorkingPath",
        "RecoverCrypto: File hash matches.",
        "5 5+5V5",
        "Inconsistent full and destination paths; may lead to bad image meta-data.",
        "EnterCriticalSection",
        ">->4>N>U>o>v>",
        "3S3Z3",
        "181c1",
        "0/0=0b0",
        "RecoverOem: Deleting the partition on disk [%d] at offset [0x%I64X]",
        "Debe seleccionarse un transporte de red antes de poder agregar un archivo para la transferencia%0",
        "RtlReleaseResource",
        " un error.%0",
        "1R2p2",
        ":$:<:Z:",
        "9H:r:z:",
        "Failed to create path for default EFI application. Last error = %#x",
        "CMicrodomBuilder::StartAttlist",
        "SYSTEMROOT",
        "8'9>9",
        "BiUpdateEfiEntry failed %x",
        "9S0vmR",
        "Wim Capture: Failed to refresh device handles (0x%08x)",
        ", meg kell adnia egy h",
        "7B8f8",
        ">2>I>",
        "6B6u6",
        ">*>1>K>e>t>",
        "1!2~2",
        "Integer overflow after WriteData",
        "jdt\"jZ",
        "7 7_7i7",
        "7a8M9T9d9k9z9",
        "O ficheiro WIM especificado n",
        "The requested operation has encountered an error.%0",
        "Logging boot file servicing to bootstat log %ws.",
        "5-5<5C5\\5g5n5",
        "828Z8",
        "tb9t$",
        "$010]0|0",
        "D$lj PQ",
        "No key was provided to decrypt the specified WIM file.%0",
        "5%5,5b5r5",
        " data pro de",
        "NMTOKENS",
        "t&jPj",
        "GetVolumeRootFromPath",
        "9):[:",
        ":QVEE",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetAttribute",
        "RtlGetVersion",
        "DlpTask: Preparing Files...",
        "RtlCalculateUtf16StringLengthFromLUtf8String",
        " foi colocada em pausa.%0",
        "WWWWV",
        "CBasicNodeType::ForceValue",
        "9+9N9V9g9",
        "t;f97t6",
        "<\"<,<J<g<",
        "DecompressChunkedFile failed",
        "2)303",
        "<8<S<d<",
        "REQUIRED",
        "CDlpActionRecoverCrypto::DeleteSavedCryptedBuffer",
        "$filehashes$.dat",
        "CurrentRangeWritten",
        "8F8`8m8",
        "4>5E5",
        "SystemTimeToTzSpecificLocalTime",
        "Den angitte disken er ikke klar.%0",
        "ZwLoadKey",
        "o OEM n",
        "LegalCopyright",
        " est introuvable.%0",
        "b naprawy na blok. Plik jest uszkodzony.%0",
        "4,4g4}5",
        "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "Y__^[",
        "WimLayout: File does not exist.",
        "Fjerner ikke alt innhold p",
        ">Q?X?",
        "ServiceSpaces: Failed to copy %s to %s. Last Error = %#x",
        " operace je",
        "9 :;:G:R:p:",
        "RecoverOem: Setting volume label to: [%s]",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::SetProgress",
        "=5=K=X=n=",
        "CDlpActionLayoutUsb::SendOemMessage",
        "CDlpTask::CheckUserInterrupt",
        "BUCL::Rtl::Add<TraitsT::TSize>(Offset, Count, TotalSize)",
        "CreatePartition: Disk %d doesn't support creation of partitions of the specified type",
        "SetFileInformationByHandle",
        "ReadWriteDataInternal",
        "qps-plocm",
        "De BITS-taak bevindt zich momenteel in de wachtrij.%0",
        "WimDetermineImages: Media WinPE index: [%d]",
        "|hK,_",
        " 0o0z0",
        "CryptoSavedBuffer.tmp",
        "uz-Latn",
        "CMicrodomBuilder::EndElement",
        " sendo removida, pois cont",
        "<2<R<z<",
        " verificato un errore per l'operazione richiesta.%0",
        "RtlConcatenateLUtf8Strings",
        ".rdata$zETW1",
        ":R;d;~;",
        "2\"3M3z3",
        " OEM, ",
        "Not crypting [%d] bytes at the end of the buffer.",
        "Failed to filter delete element %08x. Status: %x",
        "FveGetStatusBasicW",
        "Plataforma de descarga de Windows",
        "RegOpenKeyExW",
        "252^2",
        "sthhJ",
        "444A4M4q4~4",
        "o pedida foi conclu",
        "CDlpActionLayoutUsb::FindOemFilePath",
        "WimLayout: Cleaning scratch path: [%s]",
        "WIM_FileData_Number_Workers",
        "RecoverCrypto: Initializing Wim Source Path: [%s]",
        "ta.%0",
        "CDlpWimCapture::InvokeCallback",
        "QPQPj",
        "GetCurrentThread",
        ".data$brc",
        "CoCreateInstance",
        "BitsTransferFile: Leaving BITS job suspended.",
        "<#=d=~=",
        "Microsoft Time-Stamp PCA 2010",
        "j\\Zj:",
        "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Syspart",
        "D$(PQ",
        "1+121\\1",
        "BG_ERROR_CONTEXT_GENERAL_QUEUE_MANAGER",
        "sr-Cyrl",
        "CDlpTask::ExecutePrepare",
        "Legal_Policy_Statement",
        "QSVWQ",
        "FindChunkForOffset",
        "UpdateHardlinkFile",
        "EsdLayout: Exporting install images [1 through %d] to ESD file...",
        "pa-IN",
        "313L3]3j3v3",
        "RecoverCrypto: Decrypted ESD path [%s]",
        "0+1Z1a1",
        "W\\VarFileInfo\\Translation",
        "ResolvePartitionTypeToCreate: %s: disk %d has zero existing partitions on an EFI computer; assuming %s setting wants to create GPT basic data partition",
        "wcscat_s",
        "WriteData failed during NULL block copy",
        "RSDSf:",
        "5F6c6u6|6",
        "BitsTransport: Leaving Prepare Method",
        "LoadLibraryW",
        "SetUnhandledExceptionFilter",
        "\\AMD64",
        "9(909<9\\9d9p9",
        "9B\\t3",
        "ZwQuerySymbolicLinkObject",
        "r enheten.%0",
        "6%7=7^7y7",
        "WinHttpGetProxyForUrl",
        "onecore\\base\\xml\\udom_microdom.cpp",
        ";9;F;X;_;",
        "RecoverUsb: Populating Oem Path: [%s] -> [%s]",
        "RtlXmlNextLogicalThing( &m_State, &m_Namespaces, &m_CurrentThing, &m_AttributeList )",
        "CDlpActionRecoverCrypto::VerifyFileHash",
        "\\$4Sj",
        "CDlpFile::GetState",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::CheckUninitialized",
        "373M3X3",
        "C`hlT",
        "1/2=2s2",
        "9&90989B9S9]9t9",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetNamedItem",
        "sources\\xp",
        "yHVh]",
        "paration par blocs a ",
        "CXmlCursor::CompareStrings",
        " !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~",
        "_W0f0",
        "VVVWh",
        "NtQueryInformationThread",
        "Binding EFI namespace objects",
        "x@S'Y",
        "CDlpTask::SetParameters",
        "D$hPW",
        "Found %d processes using this file.",
        "CDlpTask::PerformAsyncOperation",
        "RecoverCrypto: Updating remote source path: [%s] => [%s]",
        "LayoutUsb: Initializing Customization WIM Path: [%s]",
        "!01080",
        "t5vn=",
        "?&?w?",
        ">3>^>",
        "7 7,787D7P7\\7h7t7",
        "ActionCount",
        "3 3O3",
        ";O;o;",
        "<m=B>",
        "e. Le fichier est endommag",
        "onecore\\internal\\base\\inc\\rtl_object_library.h",
        "C(h$F",
        "wcsrchr",
        ".text",
        "7X7k7",
        "<'=P=c=z=",
        "2 3A3m374",
        "t*j\\Xf;",
        "2U2s2",
        "N+@:81J",
        "Windows::uDom::Rtl::RtlMicrodomUpdateRemoveChild",
        "3&4N4",
        "|$HSQ",
        "WimSplit: File Size failed for [%s]!  hr = [0x%X]",
        "Not-null check failed: pOutputStream",
        "10.0.19041.572",
        "Bits Error: File [%s] => [%s]",
        ";-;C;",
        "lem iptal ediliyor.%0",
        ">_?z?",
        "3M4k4",
        "SetErrorMode",
        "L$$_^[3",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementsByTagNameNS",
        "91:3;I;P;",
        "Done servicing debugger files.",
        "A megadott lemez nincs k",
        "A forr",
        "6&6-646;6",
        "SetFileAttributesW",
        "co-FR",
        "9\"999~9",
        ";:;N;Y;w;",
        "(LocationHeader->ulFlags & ~((0x00000001) | (0x00000002) | (0x00000003))) == 0",
        "BUCL::Rtl::ConvertInteger(pObject->m_cChildren, pDocument->usChildNodes)",
        "90:7:S:Z:",
        "Bits Error: Fatal = [%s], State = [%s], Error_Context = [%s], hr = [0x%X], Description = [%s] ",
        ";!;M;c;",
        "CharUpperW",
        "Error deleting boottgt(%s)! Last Error = %#x",
        "9':b:",
        "Microsoft Corporation1200",
        "CreateFile() failed",
        "FormatPartition: Partition type ID (0x%X) needs to be carefully preserved across format.",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetDocumentElement",
        "HeapAlloc",
        "Error restoring directory metadata - ignoring failure",
        "WinHttpReceiveResponse",
        "nds p",
        ":#:0:d:~:",
        "Disk nebyl vymaz",
        "n pomoc",
        "PQj@Z",
        "=#=S=u=",
        "QWWWP",
        "WimLayout: Attempting to delete file [%s]",
        "t{93tw",
        "Not-null check failed: Data",
        "LayoutUsb: Formatting the partition at offset [0x%I64X] with filesystem [%s]",
        "3SVVV",
        "1F2M2\\2c2",
        "sms-FI",
        "0o0JRd",
        "j\\Xf9",
        "Przekroczono limit liczby ponownych pr",
        "WIM\\IMAGE[*]\\DIRCOUNT",
        " el, mert azon tal",
        " objekt akce nebyl inicializov",
        "NtOpenProcessTokenEx",
        "SyspartIsSpace failed for %s",
        ";j<8=L=V=",
        "Das angegebene Aktionsobjekt wurde nicht initialisiert.%0",
        "D$$;D$ v",
        "\\Program Files\\WindowsApps\\",
        "D$|PQ",
        "ErrorState",
        "O objeto de a",
        "o BitLocker.%0",
        "= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=",
        "EsdLayout: Install image count: [%d]",
        "Le dimensioni del volume richiesto sono troppo grandi per il file system FAT32.%0",
        "GetLengthSid",
        ">[_^]",
        "*** Assertion failed: %s",
        "222@2\\2",
        "%I64d",
        "Task->Deserialize(): SourceUrl = [%s], DestPath = [%s]",
        "Error copying %s to %s. Last Error = %#x",
        "Vj.^f;1u",
        "6O6i6v6",
        "wPf92tK",
        "ERROR",
        "GetSecurityDescriptorOwner",
        "GetTimeZoneInformation",
        "2!2,282>2E2",
        "4)404:4L4Z4a4u4|4",
        "031;1J1P1c1",
        "MultiLayout",
        "ar-YE",
        "3:3A3{3",
        "Den beg",
        "PVVVVh",
        "767f7",
        "PPWPPV",
        "Un fichier situ",
        "Count",
        "RtlXmlDestroyNextLogicalThing(this)",
        "4)4@4G4",
        "f;D$ u",
        "TempTempElements.Allocate(NewCapacity)",
        "RegCloseKey",
        "QPSWQQV",
        "f7~P`A",
        "El objeto de acci",
        "@_^[]",
        "122k2}2",
        "TargetFullPath",
        "FileSystemType",
        ">Z>l>w>",
        "GetThreadPriority",
        "CompressFileBackedByWim",
        "WINDLP_BITS_PRIORITY_NORMAL",
        "979D9x9",
        "?(?=?D?e?l?s?",
        "4%5;5R5k5",
        "Cancelling running action...",
        "<*<1<}<",
        "BitsTransferFile: Resuming BITS job at user request.",
        "microsoft\\boot\\bcd",
        "<3=k=z>",
        "%s: Entering Execute Method",
        "RSA2u",
        "1F1^1i1",
        "7-777E7k7v7",
        "veletobjektum nincs inicializ",
        "Not-null check failed: DataBlock",
        "UpgLayout: Initializing PreserveExistingFiles: [%s]",
        "GetFileSize",
        "878G8[8m8}8",
        "CDlpTransportBits::JobTransferred",
        "Integer overflow after ReadData",
        "CMicrodomBuilder::ConsumeComment",
        "Belirtilen disk haz",
        "in bir anahtar sa",
        "5+585c5}5",
        "bootaa64.efi",
        "CoSetProxyBlanket",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementsByTagName",
        "zh-Hant",
        "RtlIsMicrodomUpdateContextValid(TheContext)",
        "FAT32",
        "RtlGetCharacterSetDecoder",
        "454^4t4",
        "CheckSumMappedFile",
        "No se encontr",
        "gd-GB",
        "m_StoredTable.FindOrInsertIfNotPresent(p, (USHORT)0, 0, &fExisted)",
        "5\"555",
        "6Q6~6",
        "<3<=<V<y<",
        ", mert BitLocker titkos",
        "CDlpActionLayoutUsb::ExecuteRoutine",
        ".data",
        ">B>c>",
        "6M7T7|7",
        "Nem siker",
        " operace.%0",
        ";@;T;_;",
        "NtSetCachedSigningLevel2",
        ",f~|z[WP",
        "WimMount",
        "<9<K<X<v<",
        "exploitation Microsoft",
        "0E1[1",
        "Not-null check failed: ComparisonResult",
        "9\"9b9",
        "UsbDriveLetter",
        "r att l",
        "2d2m2",
        "ZwDeviceIoControlFile",
        "?2?M?",
        "InstallationType",
        "8$9F9",
        "y/VhV",
        "030t0",
        "hu-HU",
        "CDlpActionRecoverCrypto::GetInfoRangesFromWim",
        "BcdGetElementDataWithFlags: Failed to open key.Object: %ws Type: %ws Status: %x",
        "Failed to create current directory",
        ">>?]?",
        "haw-US",
        "4'5t5",
        "8*8d8~8",
        "az-Cyrl",
        "header type/size mismatch",
        "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7",
        "?3?>?S?t?",
        "RC{%s}",
        "o foi encontrado.%0",
        "4*4_4",
        "TheEndElement = this->AllocateStreamObject()",
        "CreateFileMappingW",
        "CloseEncryptedFileRaw",
        "G`hhg",
        "sr-Cyrl-CS",
        "Windows::Rtl::CRtlObjectTypeDescription<class MicrodomImplementation::CMicrodom>::CreateTearoff",
        "GetCurrentProcessId",
        "Failed to allocate root node.",
        "IsoPath",
        "ResNodesLoad",
        "BitsCancel: Cancelling BITS job due to caller request",
        "0L0+T~0",
        "BCryptGetProperty",
        "0 0(0,0004080",
        "A lemez nem t",
        "W0~0[0",
        "ks-Arab",
        "2!3:3q3",
        "?)?F?",
        "8B8L8",
        "CDlpActionRecoverCrypto::EncryptRanges",
        ".idata$4",
        "=F>Q>t>",
        "WimLayout: Setting scratch path for [%s] to [%s]",
        "en-GB",
        "[u*A;",
        "1 1,1L1T1`1",
        "CDlpWimCapture::Gather",
        "<8<F<",
        "D2J5A",
        "L'operazione richiesta ",
        "Control\\Nls\\Language",
        ":2:A:G:",
        "el-GR",
        "Failed to adjust token priveleges! Error code = %#x",
        ":B:X:c:",
        "979I9W9w9}9",
        "4<4Z4i4v4",
        "9\\:y:",
        "CDlpTask::AddFile",
        "zme verileri yok.%0",
        "L$LPW",
        "ko-KR",
        "3,3F3`3",
        "InitLZMSDecompression",
        "GetCurrentDirectoryW",
        ":?:Y:f:t:",
        "WINDP",
        "4$4+494?4\\4c4",
        "de-AT",
        "es-PE",
        "Actions thread has exited.",
        "CreatePath: Unable to create [%s]; GLE = 0x%x",
        "La taille du volume demand",
        " Microsoft Corporation. Kaikki oikeudet pid",
        "CDlpActionLayoutUsb::PopulateSplitOemPath",
        "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control",
        "Den angivne handling har registreret en fejl.%0",
        "848A8o8",
        "pToInsert != 0",
        "ZwWaitForSingleObject",
        "EsdLayout: Capturing layout image to ESD file...",
        "Client",
        "CDlpTransportHttp::TransferFile",
        ".w.t,",
        "2o2w2",
        "3I3>4",
        "CMicrodomBuilder::CElementNameToAttributeListTable::MaybeInsert",
        "smj-SE",
        "5&5:5G5^5x5",
        "1-2U2a2",
        "=A=K=^=f=l=w=",
        "<;=[='>-?",
        "ar-LB",
        "ur-IN",
        "9(:3:::L:",
        "LayoutUsb: Successfully opened source WIM file.",
        "Dysk nie jest czyszczony, poniewa",
        "__rv.NewCursorValue != 0",
        "S,_^[",
        "1?2[2",
        ";E;K;",
        "si-LK",
        "lonego obiektu akcji.%0",
        "U0S0Q",
        "Windows::uDom::Rtl::RtlMicrodomUpdateSetNodeTextContent",
        "1'2.2",
        "DeleteFileEx: Unable to clear out attributes on [%s]; GLE = 0x%x",
        "{bf1a281b-ad7b-4476-ac95-f47682990ce7}",
        "1-1h1",
        "FveAddTrustedWimData",
        ">1>S>m>y>",
        ";';t;",
        "RtlDosPathNameToNtPathName_U_WithStatus",
        "e est en cours.%0",
        ">T?^?",
        "5 5v5",
        "fr-ML",
        "4;5]6",
        "o especificado n",
        "Byl p",
        " ei tyhjennet",
        "9+9m9",
        "InitializeAcl",
        "lva.%0",
        "6*686Y6s6",
        ">@.6Y",
        "SendCallbackMessage: [0x%X] -> user callback returned 0x%X",
        "ajdjZ",
        "Der angeforderte Vorgang wird ausgef",
        "040h0",
        "|SYSPART|\\",
        "JobModification: Job State: [%s]",
        "CRtlGrowingList<struct _XMLDOC_ATTRIBUTE,50,6>::Initialize",
        "3/3Q3s3",
        "ValidateFileAndSetEACallback",
        "jena.%0",
        "*** JobTransferred ***. Error: [0x%X]",
        "Not-null check failed: String2",
        "%s\\Select",
        "='=2=9=K=Q=W=]=c=i=p=w=~=",
        "5#6;6W6",
        "RtlAppendUnicodeToString",
        "::RtlIsLUtf8StringValid(Destination)",
        "808=8\\8",
        "6N6b6~6",
        "t8SWSSh",
        "ck(WgbL",
        "ObjectLength",
        "RtlIsLUtf8StringValid(LocalName)",
        "(NewNamespace == 0) || RtlIsLUtf8StringValid(NewNamespace)",
        "3I3[3b3",
        "t`jdjZ",
        "131P1w1",
        "SeRestorePrivilege",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::ResetActionProgress",
        "LeaveCriticalSection",
        "en-ZA",
        "v5j:Xf;A",
        "9-9R9z9",
        "1(1I1j1",
        "CDlpActionRecoverCrypto::SerializeRoutine",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::GetElementById",
        "Windows::uDom::Rtl::RtlMicrodomUpdateCreateAttributeNs",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttribute",
        ")`yJb",
        "5(6R6",
        "jl nem tartalmazza a sz",
        "=?=F=",
        "{7ebc3661-e661-4943-95a5-412378cb16d1}",
        "Platforma pobierania systemu Windows",
        "=/=<=C=k=w=",
        "teG;}",
        "858_8",
        " denne disk.%0",
        "5B5`5",
        "NewProcessingInstruction = this->AllocateStreamObject()",
        "9 9H9b9",
        "0+0u0",
        ";%<S<",
        "5/595f5q5",
        "9_0t\"",
        "3'3J3m3",
        "CDlpActionLayoutUsb::CheckBitLocker",
        "?2?P?k?",
        "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9",
        "(FixedSizeBuffer != 0) || (DynamicBuffer != 0)",
        "CDlpManager::SerializeSynchronous",
        "NtOpenProcess",
        "6'7.7G7N7g7n7",
        "80Z0r0;1S1x1",
        "CDlpTransportBits::TransferFileWorker",
        "RtlNsInitialize(this, Comparison, pvCompareContext, Alloc)",
        "080404B0",
        "ste v",
        "<B>I>",
        "Error copying boot files from %s to %s! Last Error = %#x",
        "VWhlC",
        "ms-BN",
        "040E04B0",
        ">:>U>",
        "ar-IQ",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasChildNodes",
        "OutputDebugStringW",
        "DeleteFileEx: Unable to open [%s]; GLE = 0x%x",
        "RecoverCrypto: Searching for info ranges...",
        "=%>0>]>j>",
        "llplatsen ",
        "7-7>7",
        "?W?g?o?",
        "5'6G6u6",
        "SystemStartOptions",
        "VERSION.dll",
        "=L=S=",
        "Failed to open key for object's elements. Status: %x",
        "8S9_9j9",
        "EsdLayout: Opening esd file: [%s] (with verify)",
        "<#<@<",
        "BiCreateBootEntry: Could not retrieve BCD Object application path. Status: %x",
        "ConvertStringSecurityDescriptorToSecurityDescriptor failed! Error code = %#x",
        "LayoutUsb: Failed to set new partition at offset [0x%I64X] active - partition not found",
        "IsOsPreRS1",
        "FindNextFileNameW",
        "o solicitada est",
        "@9F$u",
        "041304B0",
        "Flags",
        "nskede handling er afsluttet.%0",
        "NBf\\PbkW0f0D0~0Y0",
        "CDlpTask::UpdateProgressTransfer",
        " Microsoft",
        "EsdLayout: Creating scratch path: [%s]",
        "ifresi ",
        "t#h X",
        "sre kijel",
        "Not-null check failed: Result",
        "RPRRj",
        "ulLocation < m_PositionList.Length",
        "RestoreDirMetadata",
        "9(9r9",
        "so-SO",
        "6&6l6",
        "7!8W8",
        "CurrentRangeSaved",
        "mn-Mong",
        "jaYjz_j:Z",
        " foi suspensa.%0",
        "trPWQ",
        "<<=d=x=",
        "y\"VSh",
        "SHLWAPI.dll",
        "RecoverCrypto: File does not exist.",
        "@u)j@j",
        "ImageIndex",
        ":?:]:",
        "WimDetermineImages: Checking [%d] images for matching criteria...",
        "BQPQP",
        "1T1\\1o1",
        ":\":^:",
        "=,=Q=k=x=",
        "DEBUG",
        "TransientError",
        "Valid flags check failed: Flags",
        "RtlDuplicateLUtf8StringToLUnicodeString",
        "(Value != 0) || RtlIsLUtf8StringValid(Value)",
        "ller inte de dekrypteringsdata som kr",
        "!t$$Pj",
        "8T9n9",
        "WINDLP_BITS_PRIORITY_LOW",
        "d\\Oo02",
        "NtSetSecurityObject",
        ";B;X;c;",
        "x69T$",
        "RecoverCrypto: Initializing Wim Target Path: [%s]",
        "m yeniden deneme s",
        "LayoutUsb: Initializing Reconstruction Path Count: [%u]",
        "Failed to query boot entry order. Status: %x",
        "e soubor existuje na svazku, kter",
        "676N6^6",
        "r att dekryptera den angivna WIM-filen.%0",
        "GetLongPathNameW",
        "LdrFindResource_U",
        "GuidCache",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::GetSerializeOnProgress",
        ";P<W<.>5>",
        "NewAttlist = this->AllocateStreamObject()",
        "041004B0",
        "8W8c8m8s8",
        "CustomizationWimPath",
        "da-DK",
        "6$606<6H6T6`6l6x6",
        "EstimateProgressForChunkedExport",
        "De aangevraagde bewerking is al onderbroken.%0",
        "CDlpTransportBits::Prepare",
        "Process Name [%d]: %ws",
        "r liten.%0",
        "Windowsin latausymp",
        "j.Xf;",
        ":9:o:",
        "606;6j6",
        "7<8R8",
        "CDATA",
        "CryptExportKey",
        "lmak ",
        "<1=p=",
        "2%2;2F2r2",
        "LayoutUsb: Setting as active the new partition at offset [0x%I64X]",
        " demasiado pequeno.%0",
        "QSVVV",
        "en-TT",
        "CDlpActionRecoverCrypto::GetKeyFromWim",
        "6O6d6",
        ":<:m:",
        "132g2",
        "2*252h2r2",
        "L$@QP",
        "EDITIONID",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::GetWorkingPath",
        "]_^[]",
        "6&717f7q7",
        "|SYSPART|\\BOOTTGT",
        "kr-Latn-NG",
        "pHeader->ulSignature == ('dHdM')",
        "CDlpActionLayoutIso::SerializeRoutine",
        "CDlpActionRecoverCrypto::CryptWimFile",
        "2N3U3r5|5",
        "CDlpActionFactoryImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpActionFactory> >,class CDlpActionRecoverCryptoFactory,class CDlpActionRecoverCrypto>::CreateAction",
        "Encryption/decryption resumed. Saved range: [%d], last written range: [%d].",
        "WimImageSetInformationFile",
        "A megadott WIM-f",
        "<A<[<",
        "CreateDirectory failed",
        "k*NWW",
        "=$=>=K=i=",
        "050W0e0~0",
        "EnumResourcesForExport",
        "m.Reserved < m_NamedNodeMaps.Size()",
        "DisableThreadLibraryCalls",
        "=9>d>",
        "Failed to copy Boot Manager to default EFI application. Last error = %#x",
        "202F2S2w2",
        "failed",
        "\\system32\\ntoskrnl.exe",
        "CMicrodomUpdateContext::Construct",
        "CMicrodomUpdateContext::CreateVirtualTextual",
        "020A0H0Q0W0_0q0",
        "L$4_^[3",
        ")Microsoft Root Certificate Authority 20100",
        "=2===a=|=",
        "u<Vj@",
        "131_1t1",
        "Could not retrieve error description from action for [0x%X].",
        "en-IE",
        "sq-AL",
        "100701213655Z",
        "5$565E5L5q5x5",
        "Failed to query process information for size. Status: %x",
        "yuWh4",
        "6%6C6",
        "CDlpManager::DeleteDwordPropertyByIndex",
        "Object GUID: %s",
        "0F0a0w0",
        "D$TuA",
        "sources\\$PBR_ResetConfig.xml",
        "MALLOC failed",
        "1X1i1|1",
        "L$8PW",
        "::RtlIsLUnicodeStringValid(Source)",
        " muito pequeno.%0",
        " demasiado grande para o sistema de ficheiros FAT32.%0",
        ",SVWj",
        "5>6t6",
        "CDlpManager::CreateResponse",
        "fo-FO",
        "Microsoft\\Windows\\CurrentVersion\\Setup\\ImageServicingData",
        "=%>/>E>j>",
        "WPhp=",
        "BfspPrintFileOwnerProcess: NtOpenProcess failed!Status = %#x",
        "Rich)",
        "7L8`8",
        "LayoutIso: Successfully created IFileSystemImage object!",
        "system32\\recovery\\reagent.xml",
        "Not removing OEM partition because it contains system files.%0",
        ";G,u^",
        "ZwEnumerateKey",
        "6!7(7",
        "InitVDSServiceNoStatic:Creating VDS loader...",
        "WimApplyPrivileges",
        ".idata",
        "GetFileAttributesW",
        "CheckDataAvailableForHash",
        "2'3X3",
        "(DestinationMaximumLength == 0) || (DestinationBuffer != 0)",
        "7*8}8",
        "Belirtilen ISO ",
        "4$5+5",
        "3$4>4K4",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::PreInit",
        "e a rencontr",
        "CDlpManager::GetQuadwordPropertyByIndex",
        "3P3w3",
        "si platform",
        "Windows::uDom::Rtl::RtlCreateUpdatedMicrodomAsMicrodom",
        "Error deleting bootnxt from the BOOT folder (%s)! Last Error = %#x",
        "pHeader->ulOffsetToStringPool < pHeader->ulTotalSize",
        "Not-null check failed: Params->Source.pBlob",
        "Impossibile trovare il file di avvio dell'ISO specificato.%0",
        "WIMCaptureImageInternal",
        "OEM-osiota ei poisteta, koska se sis",
        "DlpTask: Suspending task after prepare...",
        "es-NI",
        ":4;;;",
        "6-686l6",
        "LayoutUsb: Initializing USB Drive: [%c:]",
        "onecore\\base\\lstring\\ucsdecoders.cpp",
        "ReadFile",
        "3$3N3d3",
        "2F3V3",
        "r Windows-",
        "3W3v3",
        "WimLayout: Initializing Wim Path: [%s]",
        "WimFindClose",
        "\\\\?\\PhysicalDrive%d",
        "oeY<9",
        "lstrcmpW",
        "n especificado no se ha inicializado.%0",
        "ActionName",
        "Error creating %s path! Last Error = %#x",
        "ar-AE",
        "LayoutUsb: Initializing Use Simplified Wim Split: [%s]",
        "686u6",
        " ISO-k",
        ";.<[<h<u<",
        "44484T4X4t4x4",
        "gu-IN",
        "8;8a8n8",
        "tCVhh",
        "pContext != 0",
        "PPPPP",
        "CDlpTask::GetFile",
        "3K4i4p4{4",
        "UpdateHardlinkDir",
        "?M?X?",
        "WINHTTP.dll",
        "CopyFileW",
        "5a5,6j6",
        "WimLazyInitialize",
        "r en fil kan f",
        "System partition: %s",
        "GetVolumeNameForVolumeMountPointW",
        "7l8|8",
        "OemExtensibilityDirPath",
        "f90u'",
        "SVWh0",
        "CDlpActionWimLayout::EsdInitialize",
        "o est",
        "0'1H1l1",
        "CDlpTask::RestartAction",
        ":<:E:",
        "?333333",
        "939|9",
        "8\"838A8I8O8V8d8o8x8}8",
        "ReadData reparse tag from filestream failed",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FveDetect",
        "2M3]3",
        "LayoutIso: Unable to retrieve IFileSystemImage2 interface! Error: [0x%X]",
        "3S3w3",
        "1!2-2c2~2",
        "SymbolicLink",
        "DeleteFileEx: Unable to get information on [%s]; GLE = 0x%x",
        "#text",
        "WimTargetPath",
        "RtlAdjustPrivilege",
        "2*3>3I3o3",
        "=0=7=\\=v=",
        "fil-PH",
        "onecore\\base\\xml\\udom_xmlcursor.cpp",
        "SetThreadIdealProcessor",
        "RpcStringFreeW",
        "|SOURCE|\\|RESOURCES|\\BOOTRES.DLL",
        "2!3[3g3r3",
        "1L1_1",
        "5'6Z6c6i6",
        "CDlpTransportBits::Initialize",
        "=+>d>",
        "chiffrer le fichier WIM sp",
        "Elements",
        "PWWWWh(",
        "es-UY",
        "BRANCH",
        "WIM\\IMAGE[*]\\CREATIONTIME\\HIGHPART",
        "SourceMicrodom != 0",
        "WimLayoutApplyImage: Applying image index [%d] to [%s]",
        " Windowsin palautuksen n",
        "0#020A0N0[0h0",
        "RPCRT4.dll",
        "304S4i4",
        "2#2K2",
        "GetCurrentProcess",
        "7P7|7",
        "PPPPSW",
        ">C>y>",
        "Error deleting stale spaces dll (%s)! Last Error = %#x",
        "1,0*0",
        "9t$$t",
        "NewAttdef = this->AllocateStreamObject()",
        "ry9|$",
        "Se complet",
        "Microsoft Windows0",
        ">(>H>T>t>",
        "=$===H=",
        ":C;|;",
        "FindFirstFileNameW",
        "4e4u4|4",
        "Blob->Buffer = (PUCHAR)((*RtlAllocateStringRoutine)(Bytes))",
        "TlsFree",
        "Windows::uDom::Rtl::RtlCreateMicrodomUpdateContext",
        "Sj<VW",
        "\\Windows\\SystemApps\\",
        ";,<A<",
        " Operating System",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "MultiLayout: Initializing Layout Path: [%s]",
        "MicrodomWriterImplementation::CMicrodomWriter_IRtlMicrodomXmlWriter::WriteComment",
        "qps-ploca",
        "BiExportEfiBootManager failed: %x",
        "LayoutIso: Initializing ISO Path: [%s]",
        "\\FVEAPI.DLL",
        "8 8(80888@8H8P8X8`8h8t8",
        "y dla systemu plik",
        "7*7M7k7",
        "CDlpWimCapture::GatherSplitCaptureFiles",
        " &n~Lj",
        "sah-RU",
        "(0N0n0",
        "WimCreateDirectory",
        "2)2f2",
        "0D1Y1d1",
        "y wybra",
        "262`2",
        "8D8c8",
        "CDlpManager::GetTaskByName",
        ">$>2>0?",
        "323y3",
        "< <7<m<",
        "6U7x7",
        "z.9Wv",
        "ProcessWimQueueNode",
        "3<3D3P3p3x3",
        "Not-null check failed: UpdateContext",
        ":s;B<O<V<",
        "BitsTransport: Leaving TransferFile Method",
        "ena.%0",
        "CreateFile failed",
        "CDlpManager::SetWorkingPath",
        "Properties.Length == Results.Length",
        "SourceDom != 0",
        "=D=Z=",
        "\\\\?\\Harddisk%uPartition%u\\%s",
        "O arquivo de inicializa",
        "636I6n677",
        "Failed to allocate memory for space for process name.",
        "VPiw&",
        "j-Yf;",
        "Hbg&~",
        "6;7y7",
        ">&?>?q?x?",
        "5)6e6s6",
        "829E9L9Y9t9{9",
        "CP9C<t",
        "INDEX",
        "CDlpTransportBits::Execute",
        "040B04B0",
        "! !!!\"!#!$!%!&!'!(!)!*!+!,!-!.!/!0!1!2!3!4!5!6!7!8!9!:!;!<!=!>!?!@!A!B!C!D!E!F!G!H!I!J!K!L!M!N!O!P!Q!R!S!T!U!V!W!X!Y!Z![!\\!]!^!_!p!q!r!s!t!u!v!w!x!y!z!{!|!}!~!",
        "\\Windows\\System32\\WimBootCompress.ini",
        "bootmgr.efi",
        "rden har inte p",
        ";C;W;b;",
        " den.%0",
        "RecoverCrypto: File hash DOES NOT match.",
        "2/2T2t2",
        "797]7",
        "Not-null check failed: StringIn",
        "0~0W0_0",
        "vi-VN",
        "WimLayout: Layout Index: %d, WinPe Index: %d, MediaBoot Index: %d, Install Index: %d",
        "CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::ReportData",
        "5|6 7c7j7z7",
        "CDlpTask::ResetTransferProgress",
        "CXmlCursor::DecodeExtent",
        ".rdata$sxdata",
        "0%1p1",
        ">C>i>",
        "Pyydetyss",
        "this->ChildList[u]->Text != 0",
        "_f9<B",
        "t#h\\#",
        "BfspPrintFileOwnerProcess: NtQueryInformationProcessfailed in unexpected manner! Status = %#x",
        ":5:E:[:",
        "B\\;A\\",
        "InitiateSystemShutdownExW",
        "CDlpTransportImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownRefChainImpl<class IDlpTransport> > > >::CheckUninitialized",
        "GetTickCount",
        "Failed to expand default EFI application location.",
        "mn-Cyrl",
        "-FVE-FS-",
        " !\"\"\"#$ &&&%%%%%%%",
        "%050A0",
        "CDlpActionRecoverCrypto::DeserializeRoutine",
        "LocalFree",
        "CreatePartition: Requested partition looks invalid (offset = [%I64u], size = [%I64u])",
        "System partition is not in a space",
        "NtDeviceIoControlFile",
        "5#5L5",
        "BitsTransport: Directory %s do not exist.",
        "7:7T7a7v7",
        "9$9,949<9D9L9T9`9",
        "UpdateHardlinks",
        "RestoreDirData",
        "tPSVP",
        "MicrodomImplementation::CMicrodom::GetDocumentNodeSet",
        "0%0@0p0w0",
        "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6",
        "onecore\\base\\xml\\udom_builder.cpp",
        "Not-null check failed: Destination",
        "8`9|9",
        "Failed to export alterations to firmware. Status: %x",
        "%Microsoft Windows Production PCA 20110",
        "CDlpActionLayoutUsb::GetDataListSize",
        "DlpTask: Resetting action [%d] progress start time.",
        "656I6Z6a6",
        "(New == 0) || RtlIsLUtf8StringValid(New)",
        "MicrodomImplementation::CMicrodom_IRtlMicrodomTearoff::HasAttributeNs",
        "kk-KZ",
        "e est d",
        ";.<O<",
        "GetPrivateProfileSectionW",
        "DeletePath: Failed to obliterate [%s] after %d tries; GLE = 0x%x",
        "SHCreateStreamOnFileW",
        "Not-null check failed: fHasAttribute",
        "7%7-7U7a7",
        "6E7P7^7",
        "SendMessageW",
        "6F7a7",
        "EtwEventUnregister",
        "uC9XXu",
        "{d3536bdb-3c4a-4896-84fd-825e4d700b4f}",
        "^j?[;",
        "^u$A;",
        "FWTYPE",
        "5.555=5J5V5",
        "WimLayout: Requesting cancel from copy engine",
        "Encountered a reparse point which is also a hard-link",
        "CDlpActionRecoverCrypto::CallbackCopyBuffer",
        "WimLayout: Checking ESD package file X64: [%s]",
        "1@1d1",
        "ZwClose",
        "CreateDlpManager",
        "r filsystemet FAT32.%0",
        "ZwAddBootEntry",
        "ResExtract",
        "OpenThreadToken",
        " k dispozici ",
        "9P t49P",
        "1B1]1",
        "Den angivne handling er ikke startet.%0",
        "as-IN",
        "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0",
        "J0V;A",
        "=*>K>",
        "Das angeforderte Volume ist zu gro",
        "707W7",
        "WIM\\IMAGE[*]",
        "ring.%0",
        "Failed to initialize objects key for store. Store: %s StoreKey: %ws Status: %x",
        " Microsoft Corporation. Minden jog fenntartva.",
        "Windows::Rtl::CRtlObjectTypeDescription<class MicrodomImplementation::CMicrodom>::CreateInstance",
        "Nessuna chiave specificata per decrittografare il file WIM specificato. %0",
        "Failed to get registry value. Status: %x",
        "2Y2f2",
        "ATTLIST",
        ".rdata$zzzdbg",
        "GetFileStorageTierClass failed",
        "=4=>=T=y=",
        "che BITS actuellement en file d",
        "MicrodomImplementation::CMicrodom::GetElementsByTagNameCommon",
        "<8<Q<",
        "CDlpActionRecoverCrypto::SaveKeyToWim",
        "CreateThread",
        "yor.%0"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "4ce785aa63f41644449127f5c101218a44130a250e829d23ebeabd0ccd27ce75",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/4ce785aa63f41644449127f5c101218a44130a250e829d23ebeabd0ccd27ce75",
              "guest_paths": [
                "overlay"
              ],
              "size": 8504,
              "crc32": "063B8DBB",
              "md5": "50867e494e4c69b2d03f6f0e2e24fb10",
              "sha1": "98fb4974ef5c446dc610c9c8008990363ad832dc",
              "sha256": "4ce785aa63f41644449127f5c101218a44130a250e829d23ebeabd0ccd27ce75",
              "sha512": "2026d4e0e0f9bd881c01ca5d2f82d1bca821531ab018ee6b45a4aba428493bc4dfe064c067968deb956565c7f2061487c4b2ada4d0f45b115361ab1aad2525d8",
              "rh_hash": null,
              "ssdeep": "192:3r8VHwDDBQABJe3S4kOqnajlf7te0mbcpD:3r6wDDBRJSlhc0OcpD",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T1B50229E2CE686543DBA67C50139CE5837C3C53CB5C3085A6159AF4A92C873C6EF048AF",
              "sha3_384": "0e80533c1ae245fb87b383ccc5d72383b81aef0cf9343bcf79c481c3946e55d71d1b9ed87ab44e856e59bfee110b4d60",
              "data": null
            }
          ],
          "extracted_files_time": 0.00048430600145366043,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "INDEX.BTR"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/dceaf8aa74443e3ff2ec368302b74220a64a632d792d661276dd0c0b02545bce",
      "guest_paths": [
        "C:\\Windows\\System32\\wbem\\repository\\INDEX.BTR"
      ],
      "size": 4341760,
      "crc32": "787F60A8",
      "md5": "c19ceeafb136277a40d5e9efb257ab78",
      "sha1": "12f6cfbec8cac05d7ec1ae866bee6354441a9b1a",
      "sha256": "dceaf8aa74443e3ff2ec368302b74220a64a632d792d661276dd0c0b02545bce",
      "sha512": "53ea056e6108e139e48335c95f2416c5bcb98934a923097ab258b8cbc0f0091bbca4db13b8b655c55f51faa216c76091e5cbc0410628339c8a961f34f95639c1",
      "rh_hash": null,
      "ssdeep": "24576:iW56+ehp1pZCAXsCOSjDTP+lm16lXEms+R0Yfa6zRS0wvxFpSr:Z",
      "type": "data",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1D116BED532666CE3C804DBB99A325887D7348EF2EB73435819A77A040AF70DA4E97C35",
      "sha3_384": "22a9d48b390d3c4661836272494e0991ab11da55979218d876e6f5c5e4e7b00c4761148f5ab79db784af11d31c1280de",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": null,
      "strings": [
        "CD_9191719F2DF63C7538995F259914C03A19424624970470BC4FF958A554AE5D5C.2532.2109469681.391",
        "CD_E00F912E9047D1A2BF3DA9E198CE534F57C5B76F41F1AAB4887EE2C73627DAB0.2055.1045486451.2516",
        "CD_DF85153FB4444BFC904B433D6CDD9675CBBAF1556A07F0E7E082E4B4F8C33E3A.124.3753526408.646",
        "C_DB064F6F00AC6B8D3FA5B61DC9E5BA4F856D1F834E95E30D538DC0E3B653D24D",
        "CD_F3FE9F8C3A3CF33804F815B29E77D41E1175AE360C63A072F4404033FF71E150.2082.2637756748.624",
        "CD_2488FEDA0086E3CFE455C054B5411BD75907C4F387D842CC57B9DFCAEBC8AF2B.2640.2105228737.454",
        "Array of XPSS States",
        "CD_B463D489D65702642CB926E52778D8BA86FADF16643D384646C07BE40A7A3338.2542.346230145.514",
        "CD_9A0DB23B4C5307A117BBF9E162F8E0A10B387D66AA6B5AEFE4F2996B31F1D028.1501.2349830031.379",
        "C_D5472BB4000403F6D6CDB0F595804CE62C0D292549796526CA9E7773798E5F24",
        "IL_1E9EFE85EC956BF8DE3D3A533CC9BD481AE5E8268E151BDBCF68F64CF9515931.1187.1944937189.370",
        "C_92D27F5AD057C6845E59D20A0204BA27D930223DAAF414F66CE86D4BED468D66",
        "C_B60435CE818644D9A1F2567E6140BE72B7D5B428518C568542A8DA95A34DD30F",
        "C_C4C4AC3CDD7A9E38A340BB56FE91B2D1BB13CEAA14A840B9C15B1953B57A1EE9",
        "IL_B97E9E93D58BEBD51D211F64285471E2BF32C6577BCD8CEF45154512813BE359.2724.913504501.279",
        "CD_C4F59114EF1914FF05B5796404E0ED8DD63799DB51A6E299D0727FBDE6B4E0E1.254.2353033564.247",
        "I_6A74CC4F9844DC41C4680A4D057CD66FCD594011ED5CFE5E6EB3D85FDD99E4D6.2712.1835851554.302",
        "CR_47C79E62C2227EDD0FF29BF44D87F2FAF9FEDF60A18D9F82597602BD95E20BD3",
        "C_DCE585FC8090201AD2A481DCDA9678ADBEED6FFAAA2CD50925EF913678001533",
        "C_520F4A6CD1D22F206E6F5473B669F39AB1310B253B4678DE0F3ED216986A8D0A",
        "CR_5D3D82E165425301EA97694D98E5FD2162C162CBCCEECEC5C4215C7B648589FC",
        "C_B3C81C13898C78829E8DEF02131D7FE87DA6C4CF126C25D1E3FED7A0F888E25A",
        "CD_D4A704CC54B92BC73DA5A42C080CA819D44C09E46E5482AE8726E1C416015730.2554.3400965723.545",
        "C_4CC0370E76BEF5EB3ABEFBBBA06A2B5D702C8937DC380431CA450C9591785D13",
        "CD_ED6C3A2F6CC04DF3DD2F991B72C978A94559E5D3850ACCDF521D9DB88CF8E809.1165.1610215079.698",
        "SEL_EVM_REV",
        "I_9BCB6EE80506EEA7F0DDE8F3FD5863FA24235D4AE853C41E5C8DF6847C43E2FE.2684.3290165897.286",
        "CD_3A1D2B9036996AE4681DD029594209329760282E8301045223F1DC6AF85114EF.2378.2792842310.678",
        "CR_6FA80CC34C4BD31681946B7211AC65F5C0BC3FAED8972E7F4815E1CC4161ABFC",
        "R_8C95DEEDC9CB4353DFFEE67307938B32516EC9DE5E44BFF559CD7C35E2DDADCF.1976.1001273992.552",
        "CD_F08FCE87204BA565CC8D5019202DC93CAE2C1D89D6CA6369E7617C4B178BC16E.65.1327697793.656",
        "CD_6B2889479D57435939038FBF287B4AFDC16FF0B74EF9BB25FE6D86160746289D.117.471347044.1541",
        "C_59CC62799ED4524121BE28A013B19C8FA8396DA9DB0959637F6F4B761CC22896",
        "CD_D3CDA97FEF298BE8B5C29382D62A09C47E793CC57029F401B975F6F8DA62C223.2656.1202399670.268",
        "C_4310F4B6525F39CA804DEC0D13A5CDF1C1FCF37012DD6FF02E0E11B2712E56F7",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2473.1344709254.368",
        "IL_E6057E13FE970CCCFD412B9430F8AE283C5F0F26F3042BF9D4BE880FD273F587.2708.1262655379.292",
        "CD_75B21F448BC6FF62B3ED2CD311F63E496645D7FB9BF098798AFD0623A4CD84C1.1949.590286568.788",
        "CD_DE2F09E5209C548EB2CA373A925D80847E176AA4A3A4ACC0CB143A779C8154B2.311.1435931471.190",
        "CD_E991E45745117956DEAFF1C67CF04DB972E8AC05E236ED8130C434E25D63E63D.1700.1734488677.359",
        "IL_E2F8F3516DD675822F38DB86494AEDFCE23BCF6EB0AB54F9C2B64A36571F2CD5.2708.2309793059.288",
        "IL_C6EA9ADB21355CF6DA787E0D8D62E59CF47237122DE78FA8959CE74E2782F2F8.2462.3241871843.335",
        "C_1B44CE641DEBE8226ABC64761E7FF4D2BD61A5ADA9BC945BBC307822FB8B9D29",
        "CD_7E68D046DB13BCE41C3337B31F82C6F35EBC386E53A1006A94CDF711AEF82870.130.1765822355.2281",
        "This class exposes operations that can be performed on a Fibre Channel port. There should be one instance of this class for each port.",
        "CD_857A93520BEDC9F703DB461D5CC8192FB10A25C77E5665D06DE039388F19CB72.1621.2325709263.7893",
        "CD_3185D5C87B795C19200377606F945624F3779B631EE5626D7BE05E1CE6DB71A9.1522.1045056670.358",
        "CD_DFBB94A659989B2A127D27F9BECBDC304A8CD959BBFFCD2DBE5D1F68A91B0DB9.2623.2458857994.233",
        "C_5FB5EBAFE683F2B8A9760625199D7A9E30FF040F32563D01A62D2DB109DD42D1",
        "Type of eventlog message",
        "FwpuclntTraceProvider",
        "IL_06DFAB71A3D8DBB356E2B69812AA4BD05249772CB8E5CA24F5D2BBA6FF1926AF.2469.3067110696.282",
        "CD_A4EC63AB97A7B2E5BE0CA4F94F437234A9A9409211D7024967367333BFD09ED9.1576.4014922009.511",
        "C_0053847C9174B114F63255F7E8E42BF75E9B7A4222D19AA84EE0BCCF56E90337",
        ".2565700494.249",
        "CD_D760BC36A4E7F2EC138BE2205EECF2AA17893C6B9D8DB739718A0ED0B078D4B0.1734.3127800020.756",
        "CD_0EF25E0655446505590EC36F9A653AEDF70F0B9D192667BF1343EE94F4B529F2.2508.2496442428.513",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2197.1807584343.368",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.286.175755000.180",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1714.3433306020.180",
        "CD_6745FD83171C912384932B2460F0A939D3A35DD708158F930D2B33D61C719953.270.1549762355.546",
        "CD_A3CDC244A79A815521A8D6C0B832C3F9285789277B7E7D570DD27AC360EEA44B.1758.2952686013.411",
        "NS_CAB27DE1BAB7670ABD52803B0A42E2A423F561EE80F3363FD5AA3CE6C352CAC6",
        "C_E6B31A90E686795D9E916C75179C5E297CC54460E452CC51EA148281AD5C6D23",
        "I_FE01CA94EBFE1E38D4982931DE8E0A94AF72B7EB31FF8CE5134F33F2B9B7B5EE.2728.806641307.283",
        "CD_B18A79A265A485271ADF7583A11B74126B27D0421B9B453C88A99D39E80DF5B2.1999.479553662.604",
        "CD_9A36BB4E390B7DD04D76CD832679A7EB96B353EDC2C276A7C316493A7FCF4652.1374.1.13010",
        "I_75A63512835A63119A561536FF3C9FF40F6EF10BA441CECC3B232D6774FD49EB.2711.1108445118.289",
        "R_76BB6040C0A675FA423A6CA22509EC4DE76B9BA03A8395D93A841C89C7021729.2462.1807262749.554",
        "C_1264B24DE1BE75E3F3EC343E410405743BED271CC6F6A49DF7ED18F73A72F2ED",
        "CD_F31EBD8BA35B453CF95737829E224A0B8C314F43C824C500D5EB4164B9823141.1602.3636520061.593",
        "IL_E2A1C17D64AC2484E915F0EF57EF0F27CD8B66CF0E3757C335DF40A2CDB774FF.2735.3011151588.272",
        "C_5872AF16FB59CA1F21F2D919AFAC7561AC0FBDAA19BFF7FE9364C3663EA2969D",
        "CD_AC53CE5DA52F8730E6EB207A1453E345675537E4CF8D4D541D7A48167AC26146.1940.2280587416.339",
        "IL_07518836069F28661B2BDE63EA95AFE81F3822D4677A49CBAE5F594ED13FEBAF.1147.2579130481.309",
        "IL_84DAE394D72EEC44948504C5752A6FB488C2F34AF0DDE614A4D6BA8E4EF41579.1151.76143916.266",
        "ProcessorAcpiTss",
        "IL_274125530D008215D8CB18263720C7219B09FB41743DBD5128545D1A7CE5A3B8.2685.986932993.278",
        "I_D4E43E8D6402787246818DB415E351662948AB5FF42C923A78F8B45F7D5279BA.2714.767746018.285",
        "A power plan.",
        "C_1E256BD8DCA98CF585AFBCD17E60B7F15C576695CFE9FBD18524E23BC8C6128D",
        "CD_B1FA91D7E357A98D1F2A81E3A4C3A1F016D6EE080633A0348AB241030664D0FD.1563.1192372851.514",
        "CD_B6BF4F280E8F41D5C682A73285BD377F4F1516D4792C5D8362BF30684045009A.18.2268232416.637",
        "I_7E686F9D61EDF11086E78252FCD41558F7EFA25ADD316FFADF03AEA3869D1C7A.313.2707046731.297",
        "C_723EBFFA3225590F92EB3AA29897D263F99A6A39FF7268CD763229669325C42E",
        "IL_04E9526EEB869D4C7BC87D82E1E940F2C1F8AF087E2883F393904958074840FA.2764.3955190034.293",
        "C_DA3DC1260150EA9B0B2628C0C2AA81125377900B91EB681EA05BC31E6A7900FC",
        "CD_697DA7CFBF1A5367B42159FA584B6D6C58403D44C1543977ACD7BED9F2898E8B.75.962605817.186",
        "C_89B3BC9F91AF19FD95569CEC4AE8264DCAA2B513E756CCAD927560FA5C73CDE5",
        "CR_14614F807043038CFEB6FE0C7E3AB6A79783E1690BBEDE1801E1EB78C70D3066",
        "R_204821DC9B3CBA57DBAE216CBCB7CCD898EC8A2FA7B415E726A3F4D0D827DBFE.297.4179218363.548",
        "CD_6B87A2FD09C6892F4F975A26E2D24DFF27E8D9BD67B9DB050A7E8D7BE4DA7F6F.0.2028764097.902",
        "CD_960A016BC71A8D938443FD5B4BD545FA10D9D76A0776A92D75D4E23235CAD0D0.112.655872022.1335",
        "E$Tfc~",
        "CD_8D031DD0CB1D97D890A5740097E55E48F1625CDB53BFD253DBA62D3E95BCF78C.2052.113877942.158",
        "C_B15F1C934A00B71F41A13FBABA86A8403DDA67EC134BBA1DA3DF829F95422809",
        "CD_44199FEB2EA5AA114C34FEFCE15EC340288F3AE7F2F9B159DAE8176076473712.1078.791831514.342",
        "CD_486C78842972E048EB3AF4A98B44D84B41374C16F30B7064983012EA8F4D33E4.2730.833924918.92",
        "CD_FB02245EE2505E5D90FC704D39CDAE9BCF7C7408D392BD5B8D624E7B60A6BBD8.2094.250969078.2709",
        "CD_0AD4DE64AD6766E900118148CD8470714DBEEA985A4EC80DD4AD11985B5223BF.1196.2680661093.3262",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1480.269741312.368",
        "I_EF244F687390AAEB7DB2AB5AEE1C214A0915E4E8F5494159E34EEB8CED952484.2676.3183648974.271",
        "CD_3DC19EB63130D5D067481058AA0623474C0FB1A27F327D53A9EC2BB38EAE5DC0.1241.4149791210.1046",
        "CD_52C78D6E955B575AC3A033FD1685CC8CDC0EBD4484E5394917410F9F0A706A02.1490.3489614352.1167",
        "CD_F93FF2A96C50D14227C3B5A46C71238AD8A9CB5A39DA885445A37353F42C6EE7.1922.4056607381.1010",
        "CD_39111DE6643E0CE135E3218054CABDAE5D22F63BCDD71E8E8F760C46C7306F9F.1335.451443012.324",
        "C_F02A14F60269536C803E2FDE6118151BD8A40B0303F36B063D46BE78647E36E4",
        "CD_CD6AA036460DC62F8FEA24B1FBA9E9DE4AAE50D611B3048D1DAD706FB3E65A26.2543.1352629834.777",
        "Describes an instance in time as returned by Win32ClockProvider.  When a query is submitted to the Win32LocalClockProvider, the results are returned as Win32_LocalTime objects with times matching the query.  These are returned as part of __InstanceModificationEvents",
        "C_490405DFECEDBAF0721E3F7C59E6937997D0E58587EF6B9AA2763981C1499E86",
        "C_214CE1426D6101A6A1828EB7583A1623D82AD7602F044FE3634C76546F0199F7",
        "CD_53DCE9419CDBBAC59B50863124DFEDC7E011A4B01B39B0C102140C30194270E0.2564.3503018528.479",
        "CD_DFC25D46E8711DD4634FF6390AFD6E0F348F88B4F5FAE966D405DF4EAE83DD54.1837.1.12858",
        "C_5AE4D9A96CCED4ACA315569D7534DE1BE24FE40210ABFFCED132F6A8ABA68F50",
        "IL_D74AEE2AC2014B217B0849FED89F3E1A0597BEB0925C80E032A7FA8E11DC5607.2690.1052199355.266",
        "I_F64CBB6502987426C70B3559DBDC49D7508E36CCA9EC2C17804EE9C4A5287859.1781.1862597321.384",
        "CD_37F745714D456922ABC6A6C3392453CACBCC48856287D98BA28B9B6BD50EA75C.2736.3246863216.341",
        "I_8EE1599FF8FC85A746344F0326B3C05ADF3156BD2ADF38D44A17BAF8DE774923.2723.1395661552.276",
        "IL_760CEE7D587790884F861B014304A0C2F694A3595D60743DF14B6842269A95F6.2695.225351419.264",
        "CD_B860282B4A1153A407ECADB9A68A7564DFACE81902C1C29A9243B46F5679275A.37.999193019.261",
        "I_9545D47CB7940C8EE8FE2C049EAD79559EF469E4974E863E6E51191453619675.2726.1708912885.280",
        "C_B7C7EBA056B6878B96913AC0866EB26FE6BD64B4655DF4094E2D5C0299905F93",
        "I_F63CF3E14D74019559889A52EAECDC75281D7CB9F2BF83BB9B1E966CA8396563.2727.2243417145.284",
        "CD_155D9E7AE6D9F85361D5CC740FA1EFEDE91BCBF995E255746E05290A3497CB99.2278.1.22083",
        "I_F29B7A2DDA607A820C01A6084774262633A7D7048E9240AF094D62E3ACEE7413.1936.2270089716.202",
        "C_E2E2A81BA6531CCB646BB356AEB482B936F76C45C7E84F89581E39873BFB299D",
        "{$'*-03",
        "CD_34D27244C1F99E829B51167C8BDF2F0DB27B59978C3CF277F9D1CBA753030BF3.2636.247449022.1011",
        "CD_8B5848CF178AC283A6EA3092920CFF5B15F81499D839D7D7B16301709CE26AE1.2051.761776358.365",
        "MSFT_LocalizablePropertyValue",
        "CD_BC68F03B4B8F91EBABF0C9EFED9C57ABF605182A4D8760A0679947CF4F1C5F19.1700.1130230244.380",
        "CR_006AB7DFED58A8FB352581D21227922FA9FD887AC08F63A547BAEA9722B5F62B",
        "IL_006AA8E57BE8BA283D94ED2034077307A9F16665C71DF3E25108F9CBF63101CC.2685.3162186238.284",
        "I_383E852A9891D5276F4A193447C9C24B8BEE8ED6DC96DA67A3DB4D25BECBD802.2710.1886774568.294",
        "BE56EC9C3A9BB95285.2727.2458310269.279",
        "I_653B6A35271DAA7F4D6EDFC2E9E795101F58B4B177E4E4A5A213F1257972A915.1938.97287056.283",
        "IL_90E778219594B3DCC71F632018DF12DB59F05985DA797142C94047AE997D6828.2676.2098405763.280",
        "IL_37ECB0FC067D850AC282384258FD54C71F901EB4FE0DA87DE18B8C19E1262A36.587.1.74409",
        "C_A3462FA053AF6E151FDA78404CA3481C64A83DCCBF5748EADF4E7C93603C858B",
        "CIM_DataFile",
        "Win32_LogicalFileAccess",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.297.864305396.180",
        "I_2E31AC6CC351BCC9BFA78493D8B97E49D4E7FFA3928279503F92FE6E22F6067E.2689.3878770108.276",
        "I_0E9849D44E8A92F007CC7648B79CBD989C2CF28FF06279CDB1EDDE6F58A57E3C.2721.3435331300.281",
        "CD_FDA51E5A7FEC04F05BA768B870478212830881C45AE5889BF118736487DE2187.1526.2081498528.4548",
        "IL_E3DC31FA375DA42A8150A733A12E22C9CC1FCB3548CB4C211B732B0CBA295D66.2764.3609688890.279",
        "R_A05B58817295181CBA7B676653ED97C1E23D591F86C20D99BF4C67B62E0E211D",
        "CD_5EBC0509B184E537F175AB2001B7D3B1122250BA7C4FD6F1A0F9BCCB6CB0EF76.2611.2426712953.527",
        "I_92BD2D526811612049DEE66A4882EE4D3EC5839785BFED4D6537BC916B3CAFCA.2690.236457105.265",
        "CD_C51E70FE88DEB37F2E85B037DEEDA0EF21742DD637312A3E1B9ABBB2A7F6C657.2535.521568134.361",
        "C_253C1C96FB7F3D1A75A530DE68BF9EF86C6D306A9F09AAA285B8339C5035F10C",
        "CD_7EC6FF58E9EEF4EDC93B5F895A41B1B0DEC2BDC5260802227931619EE6182F7A.2745.956211807.357",
        "ProxyServer",
        "C_8B16F5C9D08DC38A0015EC6EC9F81FE1D24CB08BFC118E051784D65CFEF9FC94",
        "CR_A810B8BCB28B4593289F5B14287BCC8F9F33A8E5A5BE4903C9226502B53FB3AA",
        "CR_AF3D854FF025C11AE0CB78C559DC0BD55EB8A356EAE34913761A09B3CF6B045E",
        "IL_F0042948ECBA803A94D8CA796F6D4DD68A4F72206CCABA1D98BD986A7FEB68F0.2695.217060527.264",
        "UmsDirectedSwitchStart",
        "CD_512BD8C9F96EB955A49B938966FD525EE21A051EF82DE0FACC89259643B42F44.2472.700133038.1127",
        "CD_11D484FDE19A8F43D1F07FDCD47FC2D8E23EAFB01FF975179CD32C427E1C3CA4.214.3809718706.339",
        "I_E00A8EF4F74D23B882355F3A0D21293BA28C6F1C8A1BC8F9B30030B2F4330712.655.1.32485",
        "CD_E58DB6F2713150A46F7C4D8E4C78CFE7E744DC308B2C7F2F5D3E19AF5E925D5A.1977.3201225958.616",
        "I_1CBEC35B21C3A3C066BCEB7783C4F3098F803D3B771BBAEC00A00E09EB5A43BB.2719.721753376.269",
        "CR_3BDC2F0A0A90E9AC9B64A580B95D437559985136A7FD8C2487C72223A8541D52",
        "C_45F5A698FE1F369FCC9E35170EFC43E4DFBC18F38DA62C3D1FEF22A7B3B706DD",
        "C_DE5458D3BFF2A527DD725F3F09E672B546B170976DDC415866356D5387ABFF2B",
        "C_6777C29C6FFBFED630ED248E6134785671202A133177438787EF8C19819E0737",
        "CD_9257E4A3C9993B750EBCB6C34C9BA11105FABAD75B9C0DE005A64417B00B58B0.16.3329448629.3276",
        "CD_BEDCE10B1E31B78D9DE85D53323668D23ECBF447CB87EDE5B44EC2D1406B528F.1332.598207397.537",
        "I_8DA716445EA26247BDCD502C872559133B29770F7B55AFBFF871D80915CA3DBD.710.1.40746",
        "I_2434375DAB41148BCD1913876890073C2F819094944EC6E0EE4282858B24539D.2686.2080766437.271",
        "IL_EE648E68C650198115F67C1918B28DA41AAC66692AF3F38325507E597ED6AD9A.2695.2848477745.277",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2065.2755160865.368",
        "CR_E0FC2E4340A084EE9B1101BF52F20C14B78BA7DF0D8E224E8218B82E66190D39",
        "C_6B33047A2BDF2BAB0CD0739A0FA079F659110147A353A1D7656288F585E7D3FB",
        "C_FF70EA848D8A2CED13D60639BCB9255AF55EB37BFFEA39ABBA5DBDB0C764B466",
        "CD_244B2D44BCFE4686A8EB1967E3535273855A686C9B62600F3309068E24B5ABB8.249.1187248378.396",
        "C_4FF4249F26D9E59373D26D5D99D701C7574287A15B68AF7201676961B495AA06",
        "C_B59B61CC7D9A09771322E31CC4E05FF1DCA2EFD4C76A82AC0B86177C3096E55B",
        "CD_D373AE5F38B7FBC99F3F2A938B5B2F41F6670B434E5300D35C9C175381801CD6.2637.3631483290.469",
        "IR_88DF7CABF5BD1981831821654FEAF820A29780F13EEE1AF86755DD96BDDE9FDF",
        "IL_801E730D1DC30DF33D03872644EDBBBA856C89C0BF94040CB2AF6F25FD261AB9.2715.901176634.290",
        "!9f$c'u*-<QE",
        "I_529D75D2AC1AFBF725198649B43B0C8D813D2B8486436C04C090494A8AB1E0A8.2716.3197862783.273",
        "CD_556C6D300BDEA99DE8588E2B5D8DB1D5A33F34F7DA1F6E6A0DA0951B22252081.140.1903618779.567",
        "hotIconPath",
        "C_EAB63970C0C08943D473111F249624351EB5AAD600FD375231EB2F93F7AA8EFA",
        "CD_E92F7F6859DA3540BD4772DC997C69CDE333458F416E1FC00383C239893539BD.265.3996204342.509",
        "CD_5243094142BFF50E230A225F471ECAE0DCF0FC00D9021F08F10118DC4E9AD84C.1081.837755269.1048",
        "C_FC9E01349E08A98452DDAB16AF1AEDB5BCA867ACBFA422162975D70294A03F4B",
        "CD_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396.1467.1.8981",
        "C_E6041D969E0A83C6273254AECEEFB2E2E4BA3E5ADE2661BB572D7A354A85D2B6",
        "I_FD7092A4531E1D5420328B4DF5F17D0BB4CCBF2A132542C00A61B45BBF11451C.394.1.26559",
        "KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109",
        "CD_AC74BA8CCBB8B7653E84CC3AAB6F43C1B7147F57F54B0A2F4FF0A55FCB7892BB.1201.1954791070.374",
        "IL_8152FE70FC7FC62B5D4D4A7489CC2E328BD608A8F355E208E9C4AA34398DE48C.2701.2661185673.286",
        "RSOP_PolmkrIE7Setting",
        "R_8B7F99C264005A257FC33FC5B8BB55F758A76C6761D36338B6FB1E0C0931778A",
        "CR_5FDD5C517B158FA6F136FDA5163883910AF54452C20644A4B22DCE61A6AAF3A7",
        "C_81E71CD6BF54F730FEDC98CAF91AFC2B597F2C22AEB0626A38F278436A564F49",
        "I_5619F5F895C3D573343163A85231441998067CF9B7F0925D97380D29EEA3F575.423.1.33645",
        "IR_90E068D44393D7BB2A2DCBF3BD9EE2F9187E027BFC63E373D546D08CCCB3E5C3",
        "C_532671ED26AC2835681FE0B122A526862616ED33CAB2C220F171DB7BD5AD8B02",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1475.418471363.292",
        "CD_FE4BE07CAB11C06CEFEEBE3FCFBA7662CCA6F6ACE9DF4D17739E2ECA022C4B39.2652.1670209530.682",
        "FF4BAC19F700279002C19BEDBAFF",
        "CD_9C256CE37E6F9177BC0EC95344373747E0112D20D664373933986EE480BE67C9.294.2172044272.1751",
        "IL_14021AAC6E970C807FAF1CF19FE5C780A789D3D4663E5F6B3BA731B749E2DA16.2676.595283944.278",
        "R_E6F405501CF9EB51604EF826550E0336D9FF9DAB805C48FA3ECE279D5B21648A",
        "CR_3863CF198183B50B73BF68A52390640EB8E4B2490D653E0A1079EFA26ABECE5A",
        "C_6A1E1209B7AC078571FC6D261612887A1DE93BA434C982E140EC3C17F637D3FF",
        "IL_8E23EB78FFAC4A759215B5BD6EC35386D5DAFFB04E17A1E0F3F33C9BDCE81E56.1197.3581331220.259",
        "C_4F238F7611EB52D50DDC75C17C92F0DC91196D190BA8E13F4A12D59BEF4C4414",
        "IL_4E8B4EB6A9B16006AB3200684161B678F30DF885EB15C30D7CE2EEE255AC35BC.1088.72614020.336",
        "RegisteredGuids",
        "IL_A87D41B4C2C9172F26125D10DA8DE639F52C18A451846541B1CAFDED8E0CB132.2691.1449333380.267",
        "CD_193704CD663D13C9E84B3DCFC7B70A6594657C5FA1EF671959A670E734FAB578.2644.2774283604.345",
        "C_0834413373BFA65FA8219E678F81DD2C215A5FF7D7CBAA4CCA4B0C24350A6C82",
        "C_1B319F1F6B442943CD996FC1C57BB42D7AABA5E18673D64CB4BE3A2D7BB179E8",
        "IL_5430A0963BDFE45F48448BEFE49162AB9A7F5390BEE895620AB94C03956A31E5.805.1.36972",
        "C_7791F92BD2074299074F34A87240036D31864BA3C20893ABE274505A2016A794",
        "CD_B82CED78F3481E9AF93561312036161F961F9F165E8BC3F82FFF9DED08106912.2645.2323443836.621",
        "CD_EAAD7B12E42E8FD5A718C58D486924CE945F2F9D6534A799FEB67D3ED29E5A5B.2370.319598120.1220",
        "R_5F24F19683720FD1EB4928C01BE6B72971BB4F46F372476DC9706705301704D6",
        "I_CA7CE6FFAF43B56926F209A331362CC194ADC07878E9BCCA1137E8869300AA67.1934.2755846958.293",
        "IL_BCD0CC9D55D768E78E889337A09A284C84021DF2794ADE4C48598E6DDC097256.2707.4231325818.295",
        "C_E18DB3EAC6347E2FEA4BE12F740509FF8499D2E40E3CE861C65CC1D7E71BB2BB",
        "I_07518836069F28661B2BDE63EA95AFE81F3822D4677A49CBAE5F594ED13FEBAF.1147.2579130481.309",
        "CD_C7AECD2744BC078D929494CBA36C2323E889E91F4B1A9028514BB732B6F153CB.2574.3195135266.807",
        "CD_5BCEC8C970B710AE4D6EA0AEE105386763F11854C3DF460A38EF1FFF51743FE0.2638.3118808143.1199",
        "IL_08D7059D9196F1356A9DED2681EB4B426E31F380F9B41BD056E9948F49712DF0.2680.1378718958.304",
        "ModuleIndex",
        "C_8966DB6657BC4B4A3A46AC2810F4B56EFAFFFCB04543E6C12475FF36464179F4",
        "CD_9AB53806E88665C047824D5369B271C53B233BBEAC7C15BE3BA9BD214E527500.292.1640080779.174",
        "CD_72022A8BDF25089F605FC84A81EE8AE05C8F18AE100EE84E0479148488E12E1B.1584.956370149.455",
        "CR_57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "C_4FE08F2EC3E3D4E37005F91A110E8BC58CF8DFEAB30497EBBDCA1E4558D45E8E",
        "IL_1021E42F9A3BCB8DFB967F0F8A2041A7E229AA6B902C8FDF48E58953EF28CB39.2729.1815682319.254",
        "Msft_WmiProvider_CancelQuery_Post",
        "CR_07EB437F0AE27464845667363470C3C266A764B68056A1F9C1D3B1EEB778B9BF",
        "C_8BEFE0C3FA9603D25777ADFD7B22B3D62FD05669C5A791CDF5C6C494D608847F",
        "IR_198CEDBECF355E383EA00C07F341498EAF6FFEAA92AE5A2964D525AD6FF65BE7",
        "CD_05411DB4575F606BDA4BDD0D50A031BA32BBE01F306EE4E3DFF67BDBC2325F30.2584.902634917.507",
        "CD_125249D4EFFECBE0173319BB999B626A8F1F8DA26493B11A58923199699B3F45.2004.403303968.1334",
        "IL_B4EF83B2170E86900805291C7D4A439621A7B437105B7572FE6C744F6B8E13C7.134.1063702033.191",
        "CD_7AD3618E408CCE364CF59736F72F83CE9C862E7FDFCB8CDA2E73043A4D2C4B43.1921.1828402264.1028",
        "I_7EB83C5857223C7B60AD7DCBA263498F0049E48ADC13F6C3EF920BA0E7B234F1.2726.4259781790.278",
        "CD_322E03EFB160A47DE71A7AC4A5E201730C10AF1089A23A514F137F0DFEF012D7.1050.1154062854.335",
        "CD_0DFC323CB20829C5E894EB23D45A1551C36C2D6CBC549C00B9D8952023FE2DC0.1516.411982241.1869",
        "CD_7B5FDA91F5DD1FFC82E20D5F3963DD7D7657FEDDAFE32D552743090171A78DCF.2636.3988231497.263",
        "CD_DFF73235A7D1E97A73AEFB2323A09D07551BBAF25A9390A9E1C9B7C9B1F0A40A.2565.4048878493.3354",
        "I_00A3D44FFAF8698AE63571084DAA6CF90AC720DEC2AEF17232DB655787BF4EA0.275.751087239.296",
        "IL_6952BC8C6187412BA6F7CAEE56328B9DCA8AFF615B18BF7135EB8A91F51729F6.1020.2968348805.268",
        "I_F99CAFBFD1BEA9376C1ACAF25C7EB7A1DDD763523D5909A4E05974DFF2B28CAC.2723.3895327857.284",
        "CR_0D4A09511C06326D5D345B08A0B467BA70A695848B2E0A8AE92A1F33516CC3D6",
        "IR_4E8B4EB6A9B16006AB3200684161B678F30DF885EB15C30D7CE2EEE255AC35BC",
        "CD_55301A82B2B0B70CEFF12C2EDFE569786052F57B0A795053DBC7F37A225FA709.1190.886250882.244",
        "CD_25245316A9D3FA38DB37C9B83D3D9B2E2A5C8AB3690AC27BD6B5746485DD433D.1202.189581785.564",
        "9DA44CE88EBDB5463BE3F426.2720.3093271709.293",
        "CD_8BA1D21E61960B29D0AFE87B07C528E316D314C9CDB4E6E4157971C5502F0ED5.1093.66669023.614",
        "IL_46525BAD3099F51458A5D518030526DE848A3DE564DD8816A47DE935CCD3FA82.2457.398566487.279",
        "C_1F9156897A32A9ACC545E10D9BC352A3422528236465082E98E5F86D2498DB4E",
        "CD_BE3C9A0F3A301859A6C844B2145A4F44B9BD768BEE695F45C60A8F416A0E9077.2105.3693214232.4674",
        "Suspend (3) stops the job temporarily. The intention is to subsequently restart the job with \\'Start\\'. It might be possible to enter the \\'Service\\' state while suspended. (This is job-specific.) ",
        "IL_9B21E79BD226E9CE78753816680029AA7376864DAFE781BDE0648EA1AFB0E87D.2720.2580848050.286",
        "C_DED77797B1689BED6B94AFBF9C743E829865A2A20644965BAF07B0D354CDC951",
        "*T3lQ",
        "IL_7E6A00AAB8467A7129258A087A168DE70442F1968001FDE8C28653B84A0C1849.1783.2181022474.281",
        "CD_83FE6007ACA7CBFCFFECDEAF04CC25BAB1807917E74F65A7A46C4B6A4B61A057.2522.405664664.587",
        "CD_DDF6C28E0817A892AD961C6153A65D3B4E91439CE35FD7C3560BE452BEA978DB.1936.1847422028.1373",
        "CD_31A0633F8FCEDD0E962DDA1E15C22C2730E3E3CB506260E11EB192F6109C813B.2734.3535663100.521",
        "CD_85B4B55B4DA3A76844274036843269B38513FD6871B2701B1927FB85D7B8E8B7.1779.85901259.280",
        "Stressed",
        "CD_E368B979EB51ADB10F5BE3CEE15B821029C1FBFE745D7D61E954902FADED7A9D.312.169326676.440",
        "CD_5430A0963BDFE45F48448BEFE49162AB9A7F5390BEE895620AB94C03956A31E5.2643.2154705962.245",
        "5F08666368CD5A38FA1690B9B7D8CD03F1DE7CEAA3CE254AEFD1FD576E8D3717.2725.668640269.271",
        "C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "C_6386D8D2B88A7BC7CBA096E4EC6DEAA50527411C63B9CC5BBE2CA14F5AD32DBC",
        "R_84F8BABB6CA8331C4E9169FA40BA6E129D7FC9914E1CFF1EF6A24C2F4E5BC1E2",
        "CD_7F586BA17943C172DA17564383FF9D3B7933EA9BA65A58BF1162084BFFFFF070.1952.1.20117",
        "Win32_SecuritySettingGroup",
        "CD_E306E17928F5CE290021F4389D925B031C7FC2C7179F9BCEC2F74EEFB178968D.93.3047340908.468",
        "CD_3D40309243C3189A20FC387CB4CDBF6FB94680381677F00E2028F7CDF8AF65AE.2613.2201248886.370",
        "CD_3E5BFB8894CF4160E98325D2EB8EBC4A2FB4A38C35600D811CAF7E871FB488EB.1927.217457554.277",
        "CD_03CFFCC6C1542E35804D1F6A5B36702D2553306CC4D7F61D8BAD38DB9237934A.2734.3055360983.1450",
        "C_AA0B4A55EEE4C1E476A0BDD0D3A0653497872B02CC12BE52258AE7DCEF46F38E",
        "ProcessorThrottleStateEvent",
        "ProcessorAcpiCsdDependency",
        "C_9D6744533171E0AA4C64E98982376A00322E3135FA3701918441437BEC34C877",
        "NS_412D18ACCC816FEF94AC89284CD0EA077B30BADD4F7644BF353AFD024AD15156",
        "C_FBE6F235041E0E3AE3541BE5BCDC297FFC96D908B951996F32623E2BBA30BD16",
        "CD_95092F78A9C37B9D260D753733F7A0C73EB4F2C2027E3035DD546DE4EA2081AE.139.1985918680.642",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1480.269741312.368",
        "CD_5FEC17D2A692E21EEC8DB94637D5BF52B054EFD1DC032078BF1B5DD5BA812C6F.281.2514456244.822",
        "CD_45999BE1E716B224CDC60BBAEC2E4A9422A7548870411AB5310F9D9DCF7A8F92.18.2064360059.505",
        "CD_AAD0D760D72ECB11742773406575974B851067AEA4863E381AADAD2897C3D328.209.3397134220.551",
        "C_CB9DA8F818847880A98243AA481C84850316FD89209321940EA2299F955A3CBE",
        "C_639FF9819F7116977CD3319FE02DC954F7BCABB6A465676C5A5A023955C58EBD",
        "C_31B243F60B661B4A8A09FB08C57077A0B3874EE963301B97C84DEB1A7C98605B",
        "IL_F0237BEF228AEFB7A281AD1D606EE75C69C46CA4F644A06129E1E7450C160230.2695.3809578658.269",
        "RemoteAddress",
        ".dll[MofResourceName]",
        "I_010FE08CC153DC11B4971C18AA25B426DA166841A530748D5F8B5C0F7FA99E8E.1777.171688014.308",
        "CD_19013C0D9FB0DBD6A6866F06455DC6D7F3ED27798047559CCAD58D324FA53F0D.1601.992697439.680",
        "C_CF99DDC70B35132A88C7557FE89C5077A71D226B5E14B62E751EA68760F6B4E5",
        "R_71EE5F79894D16B695FC7A21F13EF2575CA7DCEEBB9C3C0590C06F20F958D488.1523.1374631850.540",
        "IL_6D22E6765B24082487DC01F79A0CBFCBC29DD914668BD112A684AC2DADA054F2.2688.760013831.265",
        "IL_AB7A98ABE03850B8E06CED9E1508EB71E180F9AB6F2B87339FE7B79B061E268B.2719.2679953722.272",
        "CD_6FFBA8B5854E9C5C5C698A9277971D04E447B67166A26CB7D9DD0D9F278C2D8B.1463.263749111.837",
        "Total Percent Fragmentation",
        "C_8B70439EE46FAD5A5F853DC982F916AC93055BC01548CCFAD507BBFC83ABA779",
        "CD_DE686E0AFFF23370D2FDECB51DA77DCAC9E9B16339038E833B1D60474ACECEBC.1478.4220941567.268",
        "CR_3A4B092E649E9EDDE3FA5F08BAF4EBD82A1D1063DB19A1DD0454E516CA8119BC",
        "CD_C067A199C1ACCE03298DA4A596E9323C2C865C447DF4449AEE4DAF3E29B9DD32.156.2219025017.729",
        "APPLE",
        "8<@Dp",
        "CD_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C.0.745213410.239",
        "I_D60588E1B02718D01376C75726A4BF9D492EBCE52028F9E5AC8F77A2A753F538.2675.1022153021.278",
        "C_91272CCB786B80704637F2DA5FEC31804C0D45A10039A155AE9DF9B9224919E1",
        "I_F1D3F07AA8D073A7891441AB62C487810EC5FFFDF0E30C32C3C91AD16D6A4FC2.2672.2173848480.273",
        "CR_5736C87A30783FE64957593D8F34FF03FFA145529E369A853C7692EB2B1E8349",
        "CR_ED0FE1836A8A43CE00507F00708D770A7EF86A8D404DA2B6D5FE190709C3FC86",
        "CD_D93383F051CF2C999A0FC0254121E096274608DFBA24CD421A9ABB46E7A53319.214.187563565.957",
        "IL_1BAC7DD50DA631222A930BD41DEFDA0562F12F4F44A515385572C56D60AF68ED.2710.1647950498.285",
        "C_54B0E217B287F6F85D4DEAB32DF5A8CE4DFDF560D8AC01819FC50FC0ACC66BC3",
        "RoutineAddr",
        "IL_2C512BFB94ABD9066ADD9D1F1A25B99160B9F22A302E26BEF753D4B75E44E000.2679.229246160.276",
        "I_A87D41B4C2C9172F26125D10DA8DE639F52C18A451846541B1CAFDED8E0CB132.2691.1449333380.267",
        "IL_B0D346C46B9FB4AC80F0B10779D27F152046C18A7D474120D250279643DB5AB0.2685.2533309537.275",
        "I_0838E195DF995C3567F7B9E54B2A6E8213E8784D0269832960FB0B161AADD820.2719.1643290395.272",
        "CD_961B71EE3CEF77853FD06FD1FD078D670615B8B606936AC4407F5BADB29E35F4.1147.247680740.3532",
        "CD_80FC29E4245D9040B48B4CD2FA8E17BBE43284D1E036BE8B06A9EF2961F74550.2589.2766925833.1072",
        "LPTX\\`d",
        "C_E5893386A7B4C018092F4F8B136F60610FB13ED7B0A8A3475C8F55E3E9FBCB90",
        "IL_3CD2DBCB6E1FE8937C7A78E928272F66CBB9872E3B999158006A3D5BBA4FCBB7.2725.4189518982.276",
        "NS_822BF93DF9C3C1C79665F622BFB88ADE1B36A57966014C1ECF6C9DBE68DBADA5",
        "R_F92A0D5681117D1CEF870C2B5B62BEBEA9CBBF90CF6808073B35F5F2B9F2F624.297.265303002.548",
        "CD_F33D7C5F62C48A98254F1B0ADED8C5A8E56D1601D517CF44369F4A800E4AA9F6.2014.3503249355.666",
        "CD_BC0FC27106A767FEC0851E8860A023F04DDFD5CE172A9F5CC2B8EE5C7AD4FF73.1829.3561860301.248",
        "C_19BBB29094E342ADE6943287FA27AB5704DB7461B952CA2D3D236B915D80FF5B",
        "C_8E06F8A253AE0A7703F13AD4EB4C65D4E0C2634FF3666E5F2D0DCC0FEBE693BB",
        "CD_2FB30DC8F94A0A113AD4A141F719C8A8C70B3119C9037B1814178A55C7A7F2FD.2419.1235858880.683",
        "TP@HX\\D",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1097.2755930373.480",
        "IR_B7AB74F9882BDF78202B38ED087C2D749D94DCB49E9443E63C93252324D94824",
        "CD_CAEED6243C47285827AC6434674ED523459EB8C970204592D2B83B0408FC431D.1103.1190619373.2576",
        "ref:MSFT_StorageJob",
        "IL_A600B813C3AEE4D495996259138D2BE996C368532199D64507DCA6E373C2D027.779.1.56137",
        "CD_4FF4249F26D9E59373D26D5D99D701C7574287A15B68AF7201676961B495AA06.2554.735396113.1770",
        "rceModes",
        "C_0A4A77B99E06085632BB6F0B20A342FB9C17A36A3889D5E85FF4837055C41CA3",
        "CD_C1AE8E83DBC2736145A9E1FDDBAB7977992014FACBCB21CA209B94E19685EE62.1930.2631467234.315",
        "Supporting Entity in Error",
        "CD_9E824F6E13B5FC1DD52C0D8CBEEE39BA48EBDD8253035A9F85F9EE08399887E5.2591.1329496399.226",
        "FadtC2Latency",
        "C_240A82FDAA0D94EA330D46BB6134EDD042EDB0638EE2018884B19E56BCAB7467",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.2804936995.180",
        "CR_0CEA2BFA85C402C6870520D8882306321579F18BD47E8E598ED675B423931597",
        "IL_6211AAB1062F5F857F8CF4D9D50D7DD98604CC50B8D3A755123ED244E2C8142D.2736.4164110465.287",
        "I_BFCF764FA6860E86A3549A14AEDB64BB948BEE447641B9576D3AE38EC7701FE6.2414.193098774.188",
        "C_71712F369A8546159D3AE0D8F7E7C5B4D58C20FD7BAFB853CFA7C4E57C03E637",
        "C_04992E5C7CE2295E6031900D8FF9DBAC52E8ECD5C3C6E6D474AD88FAEE2D3163",
        "I_10B708ED92090289D585E6148CB02ECEF24A35EE3889A3AB808AC5B7D3E69B31.2756.3322440922.244",
        "Process_V0",
        "IL_E0F2EFD539B7928A3CD461462D4CD79A5C30C390909F42CDB98D7B4B987E4A6E.715.1.265536",
        "CD_7B5ADFA4ED7A8BAEBEA3D33835D773079137AF910C6A6BB79C44E772F2B6859D.2665.778379256.492",
        "CD_A2D35C5C5ED7C049EF3C2376FA4E7B1FAE108AF8E6C6E786BA37F66F3B83AE4D.1780.1982160393.306",
        "TraceIoctl Flag",
        "C_9A0E4B10C24AFAE23D25837341C73AF3317EA35AC13D0352F93F4194616EEDFF",
        "HBAStatus",
        "CD_1DCEB1693B085B2991E1748C5527FE1000E59774A81597D782C7656FA24FA810.98.534759504.3310",
        "s to be uniquely identified.",
        "CR_D3C4DFA37F26EE4C7CA31BA9B8E724B042DE4802517C8F5FAFF10A17FF77557F",
        "CD_11966DA6B788C09A209299D797026F84E9D25CFA758BE1C1AD03FCADB98C44B2.2581.394499255.223",
        "C_642EBC67FF61EFF34AD21679C796E3CB07BEBCB918B03A2FC1E43AD624F651E4",
        "CD_17F8BC3833237B1EA834BBEC43AD4224D002BECFAA4FFA94A67748C23C3FA2BD.2541.350994598.526",
        "CD_C6F302354CD11663A914DC4001850FBF0A66C16EFA86F9329AFF93A3CB628944.1612.1.29093",
        "IL_E0287A0DF7E0067D3F23A5C135469B8B28232A5D98BB15312397EB6AD2B40F9C.2688.1339615880.279",
        "ROOT\\StandardCimv2\\MS_409",
        "(L,$pt",
        "R_3E0A397671AEE86972BB6BD15E62EEDC01E7A1AE56914FF674DADFD530B32274.2469.4236235804.558",
        "CD_ED6C3A2F6CC04DF3DD2F991B72C978A94559E5D3850ACCDF521D9DB88CF8E809.1172.2482395800.1826",
        "C_A396892928B3FF941F2573928A77A9B90AEB4327426B7F78F3019287D0D5B645",
        "CD_90BEFD5DB48494878DB04E68E99BC36C64E916ACEBE36216625D7CE508C8EF7E.33.1594536848.458",
        "IL_33E04994CA4A70429FE677E9D3FD3A84A89CF8D3D2921E1207010996980144D0.311.4076504440.249",
        "CD_4C388CE7AE5DC6521AA42C4856C6B40FD20A765CE0A1AB00E36A2A499F181279.2098.1479643864.1013",
        "I_562C4F9A0D39409F54FB42B6863A5644312498E663250515AF07C434FE2D1D39.2697.3526296515.276",
        "CR_95EC7A4EFEC83ABBDDA5099FF99F34F3F0A26217E92C58663611DD1463FB39C5",
        "IL_53C427DB57E8A19A5ACAFC20C0AF8B6240BAD1E45C16357EAC3FA912BE065D83.2729.2968553115.281",
        "C_F361CD902D6FB5B5BC72726163E8257DF5E310350EACFCB5758995876F4EB4D6",
        "C_9DC0A5652B71803D627A0DEBBA10D1832C8C71C7B53C3FDE13C8544A09726631",
        "IL_2EB727B695E7BDF9788B469B281CD94061E2224BEB57815D05B9244E308106A6.2694.2393515164.267",
        "IL_E08D4981872FD3B2AFA0F1FB57EC86FC31C078350F35DB4223FAD426E315F43A.2735.1763478566.264",
        "IL_A5BD9A772A5FCF58DD572039DB5832A910BFAB78915D787FCC6C323F8E7F290B.2706.1341576515.283",
        "CD_F4ABAF574BE7C40EF2484F3F003F0DE1713CC64EFD2AA983D8543B07B49C826C.1805.2702794983.426",
        "IL_A1D5F02E3491B010F201B5073B17B53AFCCD5A0131A765FA4DA05F38783FA482.1777.153436026.329",
        "C_5F192F4806ED9253ACBA1FFAD785D4714394819D725BEB5E03EB10475B8DEC95",
        "CD_533CBF6479FCC2785E9F95ADF9F8F22751BD25BC1632BE19273DB9579FAC4C83.1296.1.49308",
        "IL_4A3DDCEADF875B43B86031D680AEC99D3EBB91A5667B84178BECB0ED04142818.822.1.43301",
        "I_025723475512337E2E6C7ADA8B7B242C285559FC3FEF7CD4126C89810130ED40.2679.739303209.270",
        "CD_103563D59E224884B92C8B7934BDD6592D64C63C0FEB52D1B636E2F48012EA04.2154.1311828558.1813",
        "CR_C169AFB4FE2A5E4B69B441A9ECCF47EAE66EADEAA0A487B5AEF1D497919B36E0",
        "DHLPTX\\`dhlptx|",
        "CD_D0256D3D79C9F0FEBFA5EB7501ACD139E5E7E3AD4E5333A7FA7B5464011E3F34.1779.511673827.291",
        "CD_5B55CC60E350D260A8F85A1D6D077A9EC7EC36F61E7CF7459841A5E66A160FAF.2422.3238981691.671",
        "$9ic?{fNTQ*",
        "CD_40930BE1E8F934F03344F1FE602D3CE9551B1517303C4D41B014924DEACD3746.1270.1369146371.238",
        "C_3417EC6F6FDD4AD6ADF59EE04391675B6783F7D8A26A76EDF8D519610D0392D6",
        "C_18A46D7BB56A85A77A8B14FC7C4A83D15E2F885E67C71399BAA10EFBE87C920E",
        "CD_8CB4A8C4AE0DA8CEB0CFD6BB61EF3B4F6166FD0C6E711E54D6688A14B9EB8CF6.2558.721901443.698",
        "CD_EC54BECB03915F3B8D1B884127688EDC4BEC45436169D86F9940C3622CB3B981.2612.1903283800.372",
        "I_1652B601D82CAC4E6C305F6382CD81E4E2F42654A09F9F1E0967D6CB0B8A7D26.2709.2899149957.291",
        "R_C013BAEF52C1702952D5C4A7F180A34E20C7F843E3022D39040318DA1B2232C2",
        "CD_852580057F8E6155822579BE3A47822371F2A72F79BA24784B9CC5E5F79678B5.2654.2751901361.313",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.1522629790.224",
        "CD_BA591BD8B27F441C811869BE1DF44DAE00F08BE9A7051676EA2B61A487918FB4.2021.60648359.7466",
        "C_935B071362B928DF8D6A74C10986C5790CCB0ED5E141E88F1610752926D4F6DB",
        "CD_85629F8188EA39A73B996B8807A12AC606DFF36E46B01D25C3DE26A6E97E2C56.2582.2717415381.399",
        "IR_8F1D0EEFF09882E0AA524E87B53BDFC6C73AAB5D286B5498249DD4CCD51331DD",
        "CD_149A27F19116F7BD8DB3767BD20FC5C894B45C207E040B561A2205EF78DC6727.2529.839636607.178",
        "CD_A50F2C71334A2A338CC6F1C013DEEB31B3684F92B727656C378E98BCCF3ADD1F.2060.128139322.590",
        "\"%(+.195a",
        "ref:HNet_PortMappingProtocol",
        "CR_BEB5CFC405938CF504C4F022B26457B8BA4AAA062A6E8AB4E49ECA4FF82FF69D",
        "I_1E9EFE85EC956BF8DE3D3A533CC9BD481AE5E8268E151BDBCF68F64CF9515931.1187.1944937189.370",
        "AllowInboundEchoRequest",
        "C_361D98FB17C2BCDC621D6A7CFCE49AF430F4AC02365C7EBFB53223536307BD5A",
        "VideoModeDescriptor",
        "IL_C047B36449BCD8B3193FE1423103CA0FE4E73B50B0CF883047EFABB50BE6D88B.1017.3454250458.336",
        "IL_791AD4EEB22FCD6897BBFC6379B0E921AA16C1C447CBDBD7E8FD98A37471246D.2712.3522741979.287",
        "CD_1D8AF94E43CAA7DC78EEB167F2FCA41288361566745343E55E2730385A1CC51D.2422.2720745051.697",
        "C_378C3B019BA81FF898F9BF06FF0AC5FC705DA51C0F56DBDDF9AC986BBEE3099E",
        "C_80AFDCC52F3C92AD7D0F8DD0B12150C7B0CC34A13BF2D3DD52C62A73F9713B79",
        "CD_C8016B6B0049BC20107AF6058F0D557305357C2E4A27EC0BC24AF4A11B9B1028.1481.79514048.1283",
        "CR_3C3DC1FC0A2C3362852034A421CA1C0F5DEFC85E5D2010545B210907E075E4DF",
        "CD_422BD4D12469E52722B5F3143C70049EF3049B5B1547DE0B5D622839DE0FF5F1.2647.593752606.252",
        "CD_800B22335E7C5DA38CC321333C135D97E9AEDC239D54BF4DF5BC03D028B50520.121.1276138638.572",
        "IL_2551D3F477A531F4B6B2D48DFA8A62D9175DE8539BC5B3481CB863A2022D75CE.1934.2125348382.350",
        "I_B4B9C0E0A1B1EF66210125EBFD6621F5B74551232E8C2B141C88B28F365EC8D6.2707.4274338110.288",
        "IR_B8C33F190EAFB29D36FABE6814AE0585A5A0E54FB864FF9E1C19C9732CC65F5E",
        "C_61E83C4219F5D6E6B7DD4D1FC3ACC22EFF835D5C2DD848400DBFBC504549FFD1",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1131.2861187749.180",
        "CD_403AACAE2825C9BF5B51FF916E370CD0670FC129E1492AE9CD4E8A7515217BBC.2745.16830252.313",
        "CD_308A38A70C7E63C8B0D223B592F8A2FBAAB2069E8358BFE6F473E432CFDFF602.2007.1885550215.2914",
        "CD_40CAB48C933E1E9666D5FABEFF3A33253D381F532056E6A9DD2195EEC2E121B0.2584.2846256423.219",
        "KI_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251",
        "I_AF8C4C517F0723ACC162532458D1167F9378C0599A2476CC4B8A03045BE91BB2.2713.853600938.285",
        "C_7F637DAE12A5C57B84338EBF2100C5D2953335CDC28294203995748012501B4E",
        "IL_12DB2590D5AF370254A4FA02A2D08AC6D9EBEF98D6101C4F6B2628A2617B04AE.2714.1463200892.285",
        "C_20CFEAED94ACDCC3A138A72CB986A84D9FCBF45A8FD6E58CA8EE0387379B9D44",
        "I_8F1D0EEFF09882E0AA524E87B53BDFC6C73AAB5D286B5498249DD4CCD51331DD.2749.2953650039.201",
        "I_0BE16089DDC1582CDB25043DB42CD7AE12C51808071C234ECBB1734648B1CD8B.659.1.73443",
        "C_8688B6B3A5AFA46698CC5C2A2A938F01175B6D9F4A0E5E74F0C3AA6D73897983",
        "IR_6E9DD02E52C196C71CD529E2D8111E7EE60BD0D43965AAC2D903C8F515A0E666",
        "ref:MSFT_NetConSecRule",
        "CD_0B351C69AB78CF07883C6DB3BB0F07ADEEDCAA9674115111D7DA21E852ACC0DC.1548.2617825557.461",
        "CD_9C6D6FF9B9D03B5113EB79662290652D2C90B044404DF90E5AE9AB4E9323EE10.93.3309919921.556",
        "CD_715ED4FE059236E0D9FC94E624645193F9F27AD440D64189FA0681CA9A717570.2618.2560031697.1695",
        "\\`dhlpt",
        "Count of instance names associated with this PnPId",
        "CD_B4352AE5BAF16E9168697F87BE74E2D35A37557397C95E650D63E6588187DC82.1802.3432748852.326",
        "CD_92C92331781DF35B14382C2C18FCF4F9CE2A3F0D9A27B8F847108A01941602A7.2188.2483160277.288",
        "LastBackgroundRegistryUploadTime",
        "CD_3451F9DD4139B1FBD33D4308F2E5CFA926B897AE835CF84F8952E3D2EE3E6005.2615.3486485148.405",
        "Non-Recoverable Error",
        "I_DE468BF74FB57C16C2FE0AF90126FE83C9B098410A7D38A4977B5C5D80E7C5B5.797.1.60719",
        "IL_8CFC2CAF33B810DF7092F61D5C127074ECB267DFDB661C78F41EBF2E18D8670C.2724.1566859869.279",
        "CD_64457EF5CB2213C8C7821D96680776498F2D259D55C9A6F7B9175A130435CF08.2571.561101535.1373",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.147.668787003.368",
        "IL_86B3BCA296587429BCD61A2968A848617DB93023BC6D3C1858853C5540E12A3E.11.2927719112.294",
        "Starting",
        "CD_4B73D56414C32450B76C83F50259BEF1BF1973367F51A9AA685F527A570A98B1.1171.757340439.299",
        "CD_0A6750C7348B537B441FD2B8326BDF41C8B5D59AA69254D1D9F804769C8106B9.2098.643799999.3372",
        "CR_22E55A76AF91714908793A9D6F196391BDBB704CE7B4C27172941A36699A38A0",
        "R_CF8C5D2298E729B081D1C131BD290A9E84673DFED35C60023220564D66F04E17",
        "Windows 2000",
        "R_F3D296D1C914EDF8803ECD011A7409564726E746429D463FDA0926858F4A59A5.1784.3226412631.584",
        "C_FD4E702E602A432E7AB9CE0A91059DB9571223DB712493258C6527C16FC78E38",
        "CD_C80F6E9FDDA5B4FCB7E91E04A37B343ACE2C1B4C4C7D997B61E1037420FC6413.1080.3059402716.748",
        "C_8DDAFEF7C9DC68CC1C82BFED03D0FB0A632319FACD23827BADAB05BE80A11447",
        "CD_D5D74C06622314233E53DDBA8B2858E9C39F19EA4E9C34576583CC8C5481468C.1049.3506482603.1539",
        "IL_BD76E4E915E74A83D2340D42E4CAF372346456594329E68D465238C9A0D033B2.2723.4153164937.285",
        "CD_BF2E32F34A5F7D261B7E7910E52DB1F5079B7B7A7D2B77621CB4C50273B0FED9.2613.3908647409.404",
        "IL_7BEB918E7FAA67D6D742244360485A978EF25007530E0D04055CC08887CA2263.2698.2318318361.264",
        "CD_054A38929ECC5F2B71B017259D5DF98C968C29C9039A37FA5C286398E463CDBA.264.1120675712.714",
        "CD_5A992D16EF22078118FA0BDA7433526341ED13487F3C60B1417463784E5040F9.1187.1020133295.475",
        "CD_403AACAE2825C9BF5B51FF916E370CD0670FC129E1492AE9CD4E8A7515217BBC.2759.3477890117.313",
        "CD_06BAA5D4669A9FF5B5FD35414B6353315AC4BB24F6507E6658FAA9831018BDC5.1332.1049198791.227",
        "CD_04992E5C7CE2295E6031900D8FF9DBAC52E8ECD5C3C6E6D474AD88FAEE2D3163.2541.2674541117.530",
        "CD_C28A33C3EE15539FED60F709568673A3B8236EB3328C61F785107F8EA0BD78C2.13.522119676.1961",
        "8011.733",
        "CD_888F2D9B25BB449B1BAC54A21282A4102E2AA23BFD3BD4A5CFCE4F20063B155C.2540.3111997957.593",
        "CD_188537EDA39ABDD3901DF3031016E2D37D171396BF2CA8AE3EC736DFC5E4AF5B.1756.1495224937.1355",
        "C_3447964AD4B51A40682639E2C45B8A122022C3FEC3E3B3FE7276444680D9A4BB",
        "C_F495BAA939384D98D2E8F4D62F1C4774C029EAB6F5263F63DE034CE1A8FB2CB7",
        "CD_C20D4B021E0AFFB61E5D90A8AD1A949CBA948B6ED6C506FD3F623477DE2DDF5D.1992.4154103515.1809",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.493323525.180",
        "CD_95FB3FABFA971E67BBC725545D4CD1F75233F0599BB8B29A944361BD82FEDE56.66.3735846749.2054",
        "CD_49077985F3FCF4259B2FE7EFC831F5599CA91F6DC9D11720E6A401A1DE18B2D2.276.864729439.733",
        "CD_ECD0991E788BDD3F18D05B1734161881A31F5E3936FFF793B7C468C358EFC90B.2623.3362034075.432",
        "Drive Requires Cleaning",
        "C_422BD4D12469E52722B5F3143C70049EF3049B5B1547DE0B5D622839DE0FF5F1",
        "C_7C47B73E5E9A5506254AEC98C6F5B5C4749A5453EF79AF4AD8EFFB7A16B6EBFE",
        "C_A76FA854887A9BBAD49C12D899F57D5ACA788AD06725AAE7A65B4BDA71ED1B54",
        "C_CBFB019273A83D799DE0D6429AFEC221C503DD9A65F54D080290A928F614273D",
        "C_12183719BCD9EB7D22B9308969B6B6DC3137B4D6221089AD2836983383C1EA0E",
        "R_2421525B5330978D29177E2F4D577234961B03F32E0C906FA40DC69A623A7166",
        "IL_E1F2E9E694FC3E6DCEC59C12E874FB421C81C7C8C6E51D83EC06148ECEC44681.2728.3038766463.296",
        "CD_DCD7C1FCC05FDA8882A741091C884485FA94218566ED7A15A2356A202938112C.2652.344632431.545",
        "CD_3D10A0A77CAA5B54D6D0F826577C9C9001B09013C6D023D93A420AB24027FBBB.1166.445254643.348",
        "CD_85EB5C1F7ED82992828A8C9B34BB659D93173335D569D676E001DE6284BAA924.2524.614105086.426",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1997.1433866239.368",
        "CD_570AC14B603ED67798F9B0D128B6E9968954B5548539020B86BDF4DFF952FCF6.2637.1165673898.1243",
        "IL_87B518D7597C8A8933F5AB5EA8FE8FD538E0F850F7299C048FF0F3B5D43ED3A0.2709.4053869683.293",
        "CR_E8CE06DB509B0590994561E0942576B49C1468E2ADAE12E9135A0B28175DA679",
        "CR_5F36D1944A2418B5A351C20BD9C1B5E3BF64E7FA512D227A09AA6978A5B805AC",
        "R_BDE5107C5341475AE649B7075E5FB1B219CF6D2FF755D735AA60A09AE0ED6BD6",
        "CD_29496EE13A50FC208C78C52B2E38D7EBB9517F3108A323CCB520DE03AFA2EB81.2219.1520024917.7330",
        "x<or?B",
        "CD_C37D9971D6153A3A2ED7382F649D1D9C05125BC9AFF86A5588FB70F9C87A751C.1921.3713742271.295",
        "CD_1D9D9F860D11A9D4B55F4C6910A7BB99E4046682A588042085A8C0D379BB6068.1102.3508104237.213",
        "I_EE4BF864E92FBE1337A72D07C758BAEF29F255DDB24AA03101ABCF07C22EDF2C.2599.3421760806.272",
        "TraceParameter Flag",
        "C_F7E10C2E2B48C52ACA99548FFAFB6BFFFF056CE9E9128CD48CB817FDF7995302",
        "CD_11BDD83D3BDB7F7DD4A04A3CC49869E53E73157A8718941705A791A42E561334.2067.3342357913.858",
        "C_76C38B6783FAEB293B78B22E0D0E1B6074F7C0D71F3859FC7FCD18DDF5F5203F",
        "C_DA922784A2271FBA6F7ACE36F0F9DB023914E59E18D78414D91406A5D3145AC4",
        "C_5DCEADFA575A67B8870603880BD491602DCD3BD7BDE6B9896E3244EBC7BD1866",
        "CD_EE926C10D8DB2362A084C286637A937C23BD1B08558667C32893A01C572D0682.2560.2380992898.82",
        "IL_AA80F0C23FBEF67AEE8147F7B242D90F12EF5EF056EFD5BC7D7634A1E90D2AD8.2709.3629589333.298",
        "C_1B55B55FA6B082DE82471ED3376542A1505C8C97D1118986FF01EC622C5CF23B",
        "I_925137A2B897F7FF7AAAAEDE4D33BD8EE6B170C57D85E3C0CCA785169A34F8C1.2724.643111608.287",
        "I_1B1382F4123F74B3898AE98A89FF49C4FE1953A2A9D44449CB4E3A8519119132.2694.2286880099.267",
        "CD_CDD91708E1AF6D153701E44760D97DF285964853499CA6DDD22864F53E1EDBD5.2038.1263546996.2628",
        "I_CCF501838BA5AAD510BEFDD6841658FBDAC10C710F64CE578E0D6771544E3581.2693.4242826120.265",
        "CR_FE8C3873BDAD1853EA9CE4F9A8CC51817A3AA40D4095EE7168936C23511B49CF",
        "CD_2F12799EC4705459E9FD61FC6C601B5A8AAE36085966AD27E0D7247EDCA6524B.1616.1235341498.1589",
        "CR_EA2A17F7F9011AC9DF174FA64700FA87A332EAD70BB23C4338DE684F34E350D6",
        "C_8AC77D4657C341EA62F010DBBCE9C60C34967B183584E34A69DC6BB5BF0070D6",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2473.3028845912.180",
        "CD_FBFFFF984DA9B7029EE7078D02385B8FF23DEF8E12B59491A9BDEA2549806FA0.1829.3389255468.435",
        "I_F678A751B35F24E73ED997A6F7DA86CAF31A3FD2B20B914F4ADF37FCE38CEF97.2698.1740638920.268",
        "parentPath",
        "CD_5B63DA83F2DA3F034A69D17BB71318BD33D3644232536A8D873D1D51AA8420C7.2602.2939684445.1052",
        "I_07279D2FCEE6456AC33C3657A7BEE3196789CF4EC826448DF732B46A6335B0E2.2689.1128467637.271",
        "CD_0E4E110C89487B5FD6AB427D66ED1F8D51CB7738A04B3C4E1D9404F59DFE3267.2627.1486099854.624",
        "CR_C80F6E9FDDA5B4FCB7E91E04A37B343ACE2C1B4C4C7D997B61E1037420FC6413",
        "IL_AF25D8805F3B512CE077E12B9EC07A7664A32A328B0F1BF77828BC5BA1C8AEBC.1187.4049391707.376",
        "C_D446C28F44A94776D61EB3F1162CC22D32990679FFC3B5C6CE4863712E69A92D",
        "C_35A718313A1D788647FBE70E3BDCD7DD0916025FCA299E4EDF879E32418A1A55",
        "CD_BB21B74C59017FA9490DAC0AC5AD9CF6A59C120618360720FB0ED08A9D1125FE.1780.2257458309.291",
        "CD_DA3DC1260150EA9B0B2628C0C2AA81125377900B91EB681EA05BC31E6A7900FC.1169.1.8347",
        "Vendor Reserved",
        "R_82B5DE0B52236FBA718C6012FF3A7FD447F711EA1896FB5FD863DEC9F4CC1877",
        "R_58E2E57AE3257AAF7BD068A3244169CADFB546C1CB34AF28AA5179754528E358",
        "C_81BE9C63EB8A3405D994E7603DC3ADF9A42254FF17D1981C7FC4E773D0EE7D7F",
        "I_0B2F54DC248571B756F7BF8B112CC00CF7EC2CD6588E2E36744B13AA0012BCBD.2706.1201808501.285",
        "CD_688EDFFAE1CD3706709D790A6046157BB8A78E3308174A187E2C588BBB236985.1744.3662791810.254",
        "R_152B27DC0EF520A28DC6E7B6AECD7C476DEBCF0E080964D51299B263308AD0D4.2457.2502726923.558",
        "C_DF63DA4731494DE04BDDA4D884913821094DB03ED408823FA36FE78B0159CEB1",
        "I_9D360E12E76893327DDD95AD8B4D48DF0DB44A875D92EFA188277285FADA93CA.1016.243194336.305",
        "CD_2C20DADFFEFB0D4F975C63DD75672A978E1E07AB4428454CD70C2EBDF11D6E21.2637.1690495447.434",
        "R_1F2A1950CEC7D0AF21DF3763DDEA32BEDEE3070A1108B8C27D89F991559DD349.1611.497439556.554",
        "CD_CDB4D0999BBE2F5F01BF7E500A934D82190F379CD1604609DAB79E05390DCEF9.118.3403670194.1148",
        "CR_EDDF316486234851D86580CFE9B06D5A43E06F671105861787434F12D58AD4EC",
        "CD_AA6C5D908B8566786B88A70F7AF714B635801A6132689DE308CB55CF16910BA9.1020.1199299891.254",
        "CD_592D05C8B6862C9EBAB101DFDFC8706B44232EC87D176AEAC787159631899DED.2426.1644053016.296",
        "CD_D1B2F4E6056A69A2D8AF80AAE4B443CB0029F3E62BFF8D77A98B6230DF9AE6C1.1941.1.37301",
        "CD_0DD571F45F5EA085CD790DA753EBE3871D02FDCBFA3623CC2C0D5E1F7466DD4B.1351.1483765389.713",
        "CR_2CEA3682CC09E7F94D9FBC1BBA63FC6DB39872E53B9187129DFF772A12215DD5",
        "The Flags property contains the flags associated with the call.",
        "I_83E2267005A1F43AB3FA4E99A215A72F7958A58CFED30D986C823441CB0084ED.2676.2430761422.280",
        "CD_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D.1808.3669741516.4366",
        "CD_95968214F8D6C069EDA24D437119F94157AEA55BA5600F38F33105E2DA2858D4.2520.2618760581.1853",
        "C_7A167BBDF45B83A696F84C3A949AD0334E4C02429B5F7494290F95DC7940CA17",
        "IL_00A3D44FFAF8698AE63571084DAA6CF90AC720DEC2AEF17232DB655787BF4EA0.275.751087239.296",
        "NS_E9B749FAC938A42C5A021B8195BC99015D3E509222ADA5BB98A53C9CF3ADF3A4",
        "CR_1388B74AC4B1A1248035D019490B1CAAA479C4415233A9E50223DD0802BA383C",
        "C_9D477AC3DF7741E8993375CB7B6EC3870626780031363A4F5096C4CACA7F4F5E",
        "CD_942CF06D69278E969506DEFD551223FD0C23BC45394E9D8ADDB78467847321D7.2417.2478343638.3537",
        "IL_8ECEB18F5D5956ADBB92C60B6BBF657386F0BE596CEC9435AABD185EAE1B6B42.1352.1842879048.280",
        "ProcessorBiosTStates",
        "CR_512BD8C9F96EB955A49B938966FD525EE21A051EF82DE0FACC89259643B42F44",
        "IL_8505A887128C69538DDCBB65A648BA3193C1E1C9CFAAAD31B4C65C5A95A76282.2675.674742379.282",
        "CD_7FCF3928CE1A9575028B7746073AE3C5F6F2163882EECBCF60F66F9FAFB60664.2033.3251075099.231",
        "CD_9EE045C4E2FFD0DF955EEE77C315F6E7AE148A81490C1DE25137DB14C2197D9A.2020.3765077208.2197",
        "CD_6A28C9121AC74A9EB361B4BCCF85389D5F225385AD9FDFA10E6FCB506E2CAE2C.68.1054540287.653",
        "R_5CC5CF05A7A1041C246328BDD1081AC6C5D60C48F12D405A2F1C3A3CF42897DE",
        "IL_E7674BC4E2BEB76BC5C9730C20206782A359CF0805BC42546BAC2D0ABE525D71.2705.1710781757.299",
        "CD_592D05C8B6862C9EBAB101DFDFC8706B44232EC87D176AEAC787159631899DED.2424.4239270865.296",
        "I_B164027B8F8EDAE57EABF8CD1B8464CBA3C565F2CE3EE41FF4CD5FD7099DFE7C.2700.315704175.275",
        "CD_93BED21E4403FE1925B49EFFDF6A432C635492492790F985993F805DBF244D7D.51.359449940.250",
        "R_A026C2EC35B3A4AF24593EC09BC3F9A24F374F1087E00B13F499CB6268CBD64E",
        "A13DC08F44A6FF8FA90B0CB647BC3B13CDA21BF9F159BE57037059909A7B6D41.2712.2162134753.291",
        "CD_FEFA247A44DA15F04BB7D182136FFF162D3B44823003F2BD085C2A572B331BDD.1190.3443903435.622",
        "R_35485A3627935FD5B9811EC1FF659B28F480DAAE3470BA831CF2A89F085B6179.1337.350504848.534",
        "C_C17B838CE4C54DFFFE941CEDE0C043600C1F47F6B10515AA6CED6D6BF948A8E4",
        "R_472E59D95C6C98C94622E4AD82DADA0687549064441307EEB295733E6DD86F4B.293.3983489529.514",
        "CD_35FE0F2AF2D5B86CBC794195519170432F5D5323DD65B59310A1399B7795BD77.27.993016879.498",
        "CD_0AFA2FC50AC99E903158F6DE8F18BAF5156D729C7A9028FFF4642E3DB96C640A.1924.1995534599.311",
        "BitValues",
        "CR_830BF8BFA5BF93F39AE2488CCF30ECCF24868D5104B63DE9163FCAF3C26491CA",
        "I_2551D3F477A531F4B6B2D48DFA8A62D9175DE8539BC5B3481CB863A2022D75CE.1934.2125348382.350",
        "CD_214CE1426D6101A6A1828EB7583A1623D82AD7602F044FE3634C76546F0199F7.65.3645276799.655",
        "CD_3433832E25334061F01C0641448819BF2A3230BFACAEB03FAC6E5BFD4E772DA0.1758.1288811334.526",
        "CD_D57A35ED36C1BFA881E33DD1D96B9406375D7760056EA2A2CE40FA8EB184855B.2069.758645421.791",
        "CD_B2287B7C7375EAC6C3F512941317C3A57D34B32E4D080470E5E3D04FD567BA70.1198.2527762791.313",
        "CD_978F575657B58CCD4ADDD20377EBE045FC67DB638FC034EF8F9A1689AD6805E5.2120.699517028.2138",
        "C_A66D0E591535F85D5DA7C1BDF3A1DC73BE40E7ED75F810DC35A2C1D0250B7F4C",
        "CD_5F192F4806ED9253ACBA1FFAD785D4714394819D725BEB5E03EB10475B8DEC95.2732.2602105718.707",
        "C_00B3AB9882FAFE5C6152ADC249422592DD6C82405F70D062289FE869D61E0C9F",
        "C_D8BEC467EA6717066477C35FFA771DC325A01CAD232BDD75CF5D7DED469A2442",
        "C_9B85FF5CF1326F4370A0D245830AD60317CB312C53E60E05480454CFB6E5D2C1",
        "IL_F4CD7BB7762CAB958C999CDBB22A7A9239D971F6E35AAA4808E4BDD00E4FA4C7.2708.4260800985.280",
        "CD_2DA1DCDDAC5BCABB5D2F3CD09A1396CB44D9E59B2256D18A12D7AC169D134976.1230.3767667563.2716",
        "R_46782F06EC58C8C916C062A5E79D6F4E68F6E57049485ED56043B6013534D92E",
        "C_F15DE552171C286D0AEEE0B9E6A1C50C119FA39F1FAF228FBB5F509C5C408C27",
        "CD_11B7E238469A440C390DEB83C2D70566DE9E0AA13AE1162B1FD2AE946273C542.2490.3165772874.1367",
        "ModelCorrespondence",
        "I_364C92FBE34CA323742706382DCDD9A3ED2D70098ACB72D59A96DA6D97493944.2699.1937693571.264",
        "I_8AE63FB9425B2EBA4A6772703A9318CEC3AF151F134C1C916D46F252C1D7D2CE.2724.1770552678.290",
        "CR_9E064E4DC0D110210A0F35639C83ED75CA571522B2C951BEF2951DE6D3CADF05",
        "C_540B818981BABE906DEA2779C9B6CD77EA433C87873091262FF7A72CBAF2E503",
        "CD_7EB5BFFAD139FAB3A00B44612A64C007723F66DEF2B850A4322740021A1EBE89.2732.16770219.610",
        "C_DC2C3C4D84AA0ADFA24581041DE99C73785404938653351ED57413D02E966BAD",
        "CD_A3A917B37289A096C22D65E16A2D843BE7DD92A63211AFA365E0D93B7D8DCC53.2628.3030067986.5637",
        "IL_78C567B9CD6121022EB4703FFA6CCB8AC4BDB74D599F63CD66F434F0AC82F270.1014.1863881692.294",
        "CD_D0FCA61461F580F5651E9E9219AB1FF74BEE4671D57E3148B30C5A652AC89945.1958.1522746840.683",
        "CD_946F4B9CC4FC67CBB30182CFEF8E5287FF27217BE36B1392758F9655E96E5C2F.1103.3117063693.734",
        "CD_C4F661973CD3C0A0D2984AF60EF23047396681C367251D4E47D1DDBCE0BCDFE6.2011.2679864073.6307",
        "IL_C248C547DC15B784B3A402BBD30D036FD929AD807FC5B87D093257C8615FE4B2.279.3409176461.312",
        "CD_4C6CD71FCC442DE647DE566A7976E508BB0047F456840F2469A44C2BA062A4A9.61.1889457469.250",
        "C_A845C3809E8DF42635819F5D4441FC804E08EFF7CF893C7B960B207ABE392F53",
        "CD_308A38A70C7E63C8B0D223B592F8A2FBAAB2069E8358BFE6F473E432CFDFF602.1078.2087798533.1521",
        "CD_2F43B8EB8E14762A257D84DCB10913E4CD9E8069D8AEA3384120BB143668FB2E.250.199839771.966",
        "EventTypeName",
        "  <migration settingsVersion=\"0\">",
        "CD_0A3ED80DFF0A7A8EACA9D802C83A2110C6D7BDAB1EFDEE73E88F2ECF8116F7E1.265.81108703.392",
        "CD_25DB973753814296778CE91619DACD1D75BADC5FEADDBE8C05CED0CE57CC8084.1521.1887231006.277",
        "CD_DE1CC8B13EE598B44F246CEABE4DBF6D1E268CE3A67867331876566C40CB4C9A.2546.479938644.877",
        "C_4725B2A55879D0E15B24B42E1D8F36FD060F6802356C013408946754222CF4DB",
        "I_772A8F3C1A879F6F522DB41802413FB92A41FCC7ABC89F8B927D3553A3CDD265.2677.2040318047.280",
        "CD_264DACE30DFDF75A51B9E979ABD65B07E47DD7DF3824D1BD7D92A8F6E964F507.1835.2329375516.3743",
        "IL_511F4789E4422A6FBC095B24CEA0FC371975762D13382D739A2A7ED6638FF240.1217.1768452693.322",
        "C_14E641BBBA19FE01ED4F7B56399B3039D27F91A2D89B0360E0981CC179990D0B",
        "CD_B22B427F2794F083D59CAB3CBAECCCBC3A99C22CA4382A86ACBEEBD3E7AEF4E7.2745.2707918305.294",
        "CD_B130181D2980461AD5B86C96CD2A0DBB4871D92261D4C26B8D91B344AD4F5F87.2070.3240680291.498",
        "I_25571D9908561A792D2F025988DBC70E1069F47EFE7D2616FB603CC74329F006.2723.1441340093.287",
        "I_B1CA4324A757DDD58567627DD36F9B666F172DF97B3B65FE93751C1BF30285F4.2688.3050951499.274",
        "CD_C62347F459E9E9A6DD2944145D972E253F3D3E7B606F67BA3892A54A2CDCC625.2423.2103492262.332",
        "CD_A8B7F475B823CD27197221367DA5046937A001F70FDA319AF654A4CA16237214.1749.3339730608.332",
        "CD_C711C8BB002D8E9EB1110FD878EE6D746D43AA84016338F03543498D8359252E.2530.644554689.487",
        "C_70ED15AE36076B03FB84A9185347E7ABB659938D476877C2CE101581262809EB",
        "R_22B14E32392721F3F2276DC26BA5C650DB3CB76E266DEFEFB743ADDC20EE185E.1187.2430907364.524",
        "IPAddressV6",
        "CD_A58CC04E1962AAA1290354C8B0360D7B0924AB99741E39FF4F70A7E4E73660A3.1589.4097107872.631",
        "QuTWZ]",
        "I_F8F3342AAC8E8514CE664171B4E2B5243B4D670C3C962B7E219C1726BEC43087.2684.2079467062.280",
        "IL_704BABFF5AFDEFFA3F6BF78265E4E645897FCDC212CC21E1A4FF490E2DA2C1BE.2678.1716499752.280",
        "CD_0F2DD3599D613DB74CB1ED2BE9F8DA01F5C4A980B89415432A1F6BEC216D618E.1192.1028644754.616",
        "IR_9E4BACCE11F49E9D089586BC1222A0D92425B46D601EBAD2E04BFC3E26B9CE55",
        "I_42AADC48E8CAE9112EE9681824CCBFE2E91BE5E02C5B39F0A8D63F75CFAF0152.2736.1893140457.284",
        "RecordLog for IPMI",
        "I_38B5526AB241CFD133D27C180995B96476263672300A7AA3F8F93C0D0DCAA5FA.2706.2406138394.286",
        "I_629D5C466CEBA04BA20C9B0FF5E1065CEFAF88EEC0DCF7E7926225BCB6FD50FA.1150.952521520.281",
        "CD_5E19A5BEC74DDC9E86727DBA63BC4327AF72CEDD016ADAE3EE720DF35FE1ADDE.1580.625265346.627",
        "CD_A767797A466AD9FDC0F5359973FEDCB08DB02EBA93D9932DECBA6455A686C8BB.124.1646047243.460",
        "C_DF80435D3E5FC16DFFC6C486D3AEA3D7EEA4CC923E5206FCF82ADE2C4977A73D",
        "I_147D4AC53AF6A8CF6A38367007145E6227FA7EAA89729F8BF52CDAD51A73A7D3.2722.3655789032.279",
        "C_A810B8BCB28B4593289F5B14287BCC8F9F33A8E5A5BE4903C9226502B53FB3AA",
        "CD_902EBF22FB4493016C59437C05B915816E83C21CD09DC66922A850F179A8B844.1462.2284290804.880",
        "I_FC9CDC4116DEA0D604B5B2F0BBCDBD3F1D6D526C260DFA9BD8E557B3AD574899.1015.2391886511.307",
        "boolean",
        "An incompatibility has been detected among the library and driver modules",
        "C_5804C21BF439D9B2A4A434019B49CA7642F87CD45917B950E9BCC9A16634FB55",
        "CD_4CC0370E76BEF5EB3ABEFBBBA06A2B5D702C8937DC380431CA450C9591785D13.1929.2612209846.305",
        "CR_E21660815AC462FFBD7FBEDD97A63305E05561610CCB37ECFFD00C1772D0FF5E",
        "CD_703C562B7404A6234AAFEB9B3BB242E3FF62C76339F84C997DCEF89443C2DF65.2040.2476293942.327",
        "IL_AF7867B9AE5D20E558CB91D2040C206D22A53D2E9E3016E0BA32C334607A2EEC.2712.1177730705.288",
        "IL_178E3CFAAD67F68051F62C30058B044ABE2CFC21508B4939B040A353BA0CEBCB.1195.1404862867.376",
        "6404C6BBC789A7EE3D5ACCDE9C5AB09583CC8BC05AB7F7F7498213BA102D4C",
        "IL_AEDC90AF54A3D5AF696D2BD78F01D79B909BB9F082E2736232A14FE22A818FB2.2688.3844657391.268",
        "MSNdis_FddiFramesLost",
        "Describes the amount of information that will be synchronized when an item is synchronized.",
        "CD_F7E9A52C76555077F4DA7D39B6593B2F1BE8BB803F9421C298C6579BFE9568D1.1539.3461538962.424",
        "C_110FD38773EB914F177E2A2E2C39AE6211724EE16D7552119DAF151E92D1509A",
        "CD_AF9FF42200D7F24F94D2D927172EDE6E75DA70A13982C42099804CFF0709A576.2110.1857941684.1951",
        "C_35C0F224CC2308A9D8BACDB20F08468AE9D1134753B5808A41A3EA43EE4C047D",
        "IL_0ED380DCCE5F8BBB4D1AC97ADFE47418E9E71153132861C7AA0B46AF1DD6829F.2723.2755789728.283",
        "CD_B0D2109EB44421C900FA5B72C26E7A0C5F67A5578AD9D78EE2099AE90CC32E3A.1188.1331124929.636",
        "CD_55EDCCF4E5A9ABD76428DEC07ABF127ABAF79D731BF9177B4B1A7951CA86E45C.2020.676453803.318",
        "C_BE54B322833AC65DE68786188F013C51591B282969E32D07CEC53664341FD910",
        "I_C823434F58D39F84FCEC4968C5989AB0E3FFDD4C4BC71708F6CE48516EDE1644.2712.2483974247.292",
        "CD_2A1EA88566C251C922ABAB65FF63CC8104AAD5E5A141FA41759E87856BC3DD82.2669.1452960232.617",
        "CD_8FB4AE7FB95F6C0BE8AB8888FDB9CFEBD55177E913A0E356746707635DBAF008.1555.4232759184.1016",
        "C_0B98E22EDABDC081A9355CD8F72426A59F036FD02AA08181EA8718C327C84183",
        "I_BAE2729FB2A4F61D06933B050C473303CCE7911F610104E1004CA977C52C3E87.2434.3417119911.354",
        "I_DE50088336F875798BFB15108F4718270A4C3C350B7499FF903E170E79D0FF76.1015.560389850.303",
        "I_C37EDF4D99838173F025C5008B0F6CFC7E5A06EA0D6BBF7D98A5134BB48D14F0.2729.3534511313.284",
        "I_D09C3A6D674FEFD65CD0D0D64473712A664E77B7E6103663EB5B659F57FA6916.1164.3017632335.190",
        "C_A95A48ADDAA5329765847F8DF03DCF18CBC9E5FA6B59EBCB8E1768298695D7C8",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1339.3242186287.180",
        "CD_54300AC69CD22DF016BB3F2AF97DBCDBD81A1D838D9588007B40A7B95D4F9C12.2588.3172331961.226",
        "CD_44176E2582D203C4E24AFCA28B3D2E229104AC44AFAB0DE90ED2E93CD38781CD.107.2999164959.182",
        "        <UseUnifiedSchedulingEngine>true",
        "CD_B15F1C934A00B71F41A13FBABA86A8403DDA67EC134BBA1DA3DF829F95422809.1130.2729339824.1609",
        "CD_7BED87BDB52EA7B1358064DBF771E27C411EDD63C82A01FBC7742FD607C32DEE.2604.3121104177.334",
        "I_F1FB40D6875967280A04902873AD3B2FD9C801AD289E9C6345A726CBFB99DEBC.2684.254880008.292",
        "I_091DDEBD0E937D2CF46C96939CD06E76BE0D80E96886D4C071A63198A86E324B.2675.1041129576.275",
        "CD_5CC5CF05A7A1041C246328BDD1081AC6C5D60C48F12D405A2F1C3A3CF42897DE.1149.2692298785.448",
        "CD_FD437FE09A5F0D1CF8BBE227B2A7EE19B06671F0890E0CBE2EE538D3FF52E3B8.2637.2313557932.263",
        "CD_35002FCC142049858649CB1BCD62043BE23AE98B3CC34288C266F1C2B8C4A3A3.29.535386793.396",
        "CR_B39F79BEF0550EE7F9E981A83A152A3A4B6173B3A32D2E630E92CBAA2FE60E90",
        "SECAM D",
        "CD_4752ADF61D0AD3FC745339A237E83C0674E08E78D184202E33EA183DE0FCD7F1.2621.1034320446.1831",
        "CD_754E5946CBB29D1190B8A84A81859EECBF1905D53963E568FAE53B4A9E6590F4.254.4186460893.771",
        "C_FB02245EE2505E5D90FC704D39CDAE9BCF7C7408D392BD5B8D624E7B60A6BBD8",
        "C_83C100BE0F817015BF0575F5A3496A636C9309D7E4EB3062A76F5F113E51D626",
        "CD_DFCE5B8EEFC1AF231A170E8413130AF6AA4A71FD22AC6E352C7DBF46462589FC.1647.1.9014",
        "CD_D336428E5FE02B93C4413230D0BA8394C3D8D327B0A951AB98E34E7C718B63E6.125.2953036498.6671",
        "IL_621C1D2820FEF6D532F75DA12683DDC0C2FB03AF4DFE46D049135A28268B973A.137.3164472942.302",
        "C_E24FA471FA616F0FEE1A4B19D9469B11315F0ABE663B66CC48A1193183ACBF97",
        "IL_B164027B8F8EDAE57EABF8CD1B8464CBA3C565F2CE3EE41FF4CD5FD7099DFE7C.2700.315704175.275",
        "I_5306A39AE8099BE250137B7B473C6C6DC916A35E8018A185B5C9A31EB97EDE85.706.1.27844",
        "C_F76773412E97B049DE12EF0A4B3FEE352558F541338523F30899C82C78D5CB29",
        "R_941298FE57B01D7A1E5DB7CD7C2688B06D8CF556A38C47811E3130A1974EF1B2",
        "I_1AC1FF9846D54F9F0147D2DB85F9B6094C79EC82E32CB9B2EA521A35465B977B.2710.2507324345.295",
        "534.1300651731.499",
        "IL_9FEB8C7FB68A967F3AC52B4C2CD64DBE4D1E17EA9C3590D162C3D62C6B7FDA21.2678.2974643458.284",
        "C_487970C846EAAE83F1C18D91427BE18DFEB32621B7F4638C663D34EA5516710C",
        "q\"%(+.147:=@CFIMQUYm]aei",
        "CD_32D454A462735D9F0A52FCE5591CA2A13A2526DC13869FABC5CDFB370DFF9CD3.2617.3950222422.1667",
        "WP^eIB",
        "CR_2B0CB21E4574B83D661A7C62AD7BF3133DF3FBA914EA55D3A45DC4A7214DD006",
        "C_54FD8049B00C834D5B43ABB9E3C88851310B1C9A3D5D62073ABF12B543C311F3",
        "CD_BA2C021F642EFC72B5ED5FC31813540F5BA649D97F9C2021662B9F43F49C356E.43.3318644549.4889",
        "I_0B5EDAA42C9675F8D2021C39B37DD031763091DE8523969BAB52C951879C0978.2722.2990860299.287",
        "69<?BEHK~NQT",
        "418548042567684.1248.1968126672.582",
        "IL_A67B9FFFA0CFDC97B3FC55A15A9D50F12D2051478D153EB76E83F279C120D408.2728.1819149996.289",
        "CD_B6BF4F280E8F41D5C682A73285BD377F4F1516D4792C5D8362BF30684045009A.112.2690004815.1472",
        "C_FF74CDAE39923232968131488C628881C63A5FB177CC4E0E28EB62D76E9B7164",
        "C_766206E818648233F1D08F1C00805E3E5967D15F801236FDA71EE3E046A5669A",
        "CD_E6F405501CF9EB51604EF826550E0336D9FF9DAB805C48FA3ECE279D5B21648A.2309.2640421897.250",
        "r<*`'$",
        "R_8DE46DD6446B26621A23E11758AE5CBC62C9F72998CAFB08B9CD58DF66902A20",
        "I_DA9C4A07385BAAEACDBD6D11FF08AB3D3C2CF09DDD29DF54A21898C212C31969.2723.3637418311.273",
        "CD_2DA1DCDDAC5BCABB5D2F3CD09A1396CB44D9E59B2256D18A12D7AC169D134976.1266.861209697.1558",
        "CD_1E9D769216F5F64948BC57944D9242020C6E241FF162F83F13C4D2C6777D0477.1778.423272904.1827",
        "\\\\.\\root\\cimv2\\mdm\\dmmap:__Win32Provider.Name=\"DMWmiBridgeProv\"",
        "R_19008355CEEE6D6B9A2B58CFA241D6A4F19597B3FB46498B77333FB86C667E64.2469.1043737626.554",
        "CD_F63E9DDBFEF6B5F00A102DFF31BE7441561DE4396AD9FF89BE26AD8D006CEB79.1500.3172255832.254",
        "IL_364BBD5A8139AAABF6ABFCD0BC11369EDAD78856E35184B469FD18AE3CC9E67D.2702.1453602151.270",
        "I_D50AEC47AB29E04FA6D203696193B42FDCBE6C8D0D9B7E93BD81124BED02C35A.2688.1853903349.264",
        "C_C7753872127F972FAB5A4ECF3A59238F36736CDCAD139F5290039065976DB9ED",
        "C_16D6E45D9DC3C2448BBB5DF12E5A17B75BBAD53607DFAC1CCE27C411AB0AEA61",
        "5189449E13D88BE3724B6F2E9D3",
        "C_1592BFFCE522F75E708AF00D4ECAEEBA5AFE422B12D1211F8015509DB1FF98D6",
        "R_B4DB4EF3B67C7CC0A235AAEBA9B8E55EA87767EED998CC57051CA0E2F91BF648.1051.3689690740.518",
        "CR_41B7AA8AC52906BD0F9EB940AD635202AF89B38F24F2BF12D2C0A98B1014B8D9",
        "CD_085B7593B1CE40D92007E7E7F4B676333B0F0F7158D072E9115D8F206A3DB6EA.2565.3842949884.699",
        "C_AA6C5D908B8566786B88A70F7AF714B635801A6132689DE308CB55CF16910BA9",
        "CD_9877A07ED842BA5F1FB4691948C0CDD95DF656BC3733002FE0D6F9D48056C255.2556.3113481387.680",
        "CD_4F1C732DE8891B6735DABB456D12844B78FD522910A121B420BCDDEB9B10CF13.279.1947345948.444",
        "IL_3FB1CC987258F8087BD78386B8DDA093F7A2030F966FAF6199D43EFA0F6275CC.1530.2477947574.253",
        "CD_9ED4C67E3712DE07C86D1861FC69841608A536EC7A7415988B2BEFAFF875D077.2422.1640275264.683",
        "C_56D8A63CA95E0F8506AA7DC81F76BFBF31CC0706D19B7EC4CB60FC3074D6BC87",
        "CD_E11F69BEF07331FBCA401012B573BF0C27782CC80A65353DC598333FB7469F8E.1927.2988370458.1024",
        "R_3303D514509C890AB8BEBE50F44B913774000A6CAB1EAFFC8AC95F2755DFAD1E",
        "CancelKTimer2",
        "C_011B1BAF67EA69E2DE34409D684C80464FA202C09EB167987497A892748D7728",
        "HNet_PortMappingProtocol",
        "CD_581FDBF3A3E51D753168374466B7C40E39F607E7397DAAFA13C9AC84F1F3CEA3.2422.1512199145.685",
        "R_B375528E053EA0FB3757BF45E457E25A87BD55DE51CAC5F0670A466CE3A30962",
        "C_6FF828EC04080EC9C73773961C6786394920BC16665D53EC22DE1788D6AD154D",
        "IL_687B15A6814DFBC44BD24E7676CFA5FF5818E5BC0ABD402D52CDCCCDDF974C90.2696.1354368597.273",
        "CD_9A2FA4B503D51BA72E7F874AA07B2D2639867C129B89B4AF2230D146C0DBAD9A.1836.2429246904.415",
        "CR_F71CEDE68D110C46E631A74BD74BB02467459B066EB8F2E32432A8044C4EFD32",
        "IL_653B6A35271DAA7F4D6EDFC2E9E795101F58B4B177E4E4A5A213F1257972A915.1938.97287056.283",
        "R_30544E69098FEB7B3DBD10E5E79FA9F73E13B4CE82E27F9768299AB561F3C59F",
        "I_D561A989983561316EA3A55A87DAD22914BB56B565B33FF158F19E157541DF20.2721.1520236733.279",
        "IL_B4CEDC7298731DC189C689B2C13995D9B2F04481C7C38618779AA70678131A13.2679.1183075092.284",
        "I_11D2E97DDF1CF080928910BF09863669E0E14A4659127F6B001724FBE86FEC93.2697.2945396924.271",
        "I_F0942C8520796673214492D034FB55DB50870EA9B2FDBCA5F5104947C55D3283.2704.19907065.283",
        "R_5568D9406818EC7D25F6DD0ECD3BC28AB9840FC9891F58E36141C6AF33486A4B.271.2061032503.524",
        "C_E6EBC22951212AA0FD20E4F98E4D28A1040E077B7BD57C8A6ED5195CB15000F1",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2503.1363774787.368",
        "I_E2B1773F5498E7CFED96AE2740F08CD38CBE2FD8B5129A90F38F90CA675CAD67.1017.3909181872.320",
        "D8ABE2.280.3403356471.6445",
        "CD_0B2F1E4D65E20B886626EA752F67851C929ED510CEF4614AF076326308ED89AF.1936.3098398764.281",
        "CR_9306698C01F89BF0B51534BC38CEB10F9556344574338B9E17B1FD19E593FD78",
        "Tape format not supported",
        "IL_BAA18A0F308B3C04BE1332D9A501751138A2195D06A6840A073C72573A13B4BC.2698.2192740371.265",
        "I_88B5971EC8A2769F9118A68A354A2CF85CDDA150669BA79458D69ED38EABA628.2708.1268172054.295",
        "R_68988603F70E94DB41A96D6CCAF4C1247D2A19BC8932E751AE8871C31295C890",
        "CD_9AB73F8DA60B37A5DAD8EB945BB4F0C79687E3F0DF399D6BD50EEB5E9D647763.2626.2673264152.2182",
        "I_59C0D279AC4D00AA33C5DAB5CDF28150F681AA6C3210CD3E34E5D560A87ADB96.311.1142537083.249",
        "C_A08E07C4C18BB43F9FD19B5E02B121082F63046F918F76002425E185ED85C61F",
        "CD_476CE3FDB3E7B1BE651492EA8D1B3527492ECA7EB32703BE458BCD6F6B7B15FF.2652.2872934307.751",
        "IL_CF84B7AE1C70A4C46731A07D676018CA2827AFD30745BBECAD484168EA147839.2699.36478885.270",
        "CD_329C7091D99134315D75F4D3A2328F98C961B173B884F03A89824A063291C3C4.29.1648239283.419",
        "CR_39986A48BD79716B6060A37DC5740DDD40082DED190FB55EA39601F1955977CD",
        "C_89FE4ECD715508D84EE36BC94DB9C9AB6DC6A560D227442061D4288D96910660",
        "CR_674A600DCCAA63BD9D394037EF94415E97BD130F08DC05DC75146875725ECC64",
        "CR_7AC6B537C17B7A0CE625AFA6380E4FC98418E800AD64DF240D5A7AD2482283AD",
        "Network Operations Center",
        "C_0FD0888899B6AE2520B6E2DBF0621375C2A450EF8AEE903A752140EFA51EAA5D",
        "v^VzjJnfbNRrZ",
        "C_A2D2F566D6334C154D68DEF2209801DEA0F8C0E6B66CFE89905D2737E6AAC2AD",
        "C_444A7A3BAC32F6DC8230C2D59CC5C5F4CF794CBBFE30EF01834E74555D738F83",
        "BuiltIn",
        "IL_F725542BCC5EE818BB3268E2A39F3A53C7872F274EFAD1FD935D8C2ED42D5A80.1076.2672245562.263",
        "R_7C82262F50CE3724AC8434FD0FE0E31A40C9A7B353ABD3DEF2E6DE0816F201C4",
        "I_7D726A53C2E109A7102AA0733AF15E0ABEDDFCEA169FD750AACBD377D8D29F56.1476.1859033999.253",
        "I_80D5B672D4FDEF4948549EA563BCB3471211BC3C8A3B39D04776E37EFA2DE870.2678.1534286831.282",
        "IL_EFBA8DA1DE1CEACD1DA7078787494D65198245F93477A8E8A3F8D46A6673CFEF.2701.1291922020.286",
        "CD_11A7ECD9144579B152069208B2E368C32AC66D74E37C0FB050800C74CDAD8EE0.2551.1654037620.1742",
        "Re-run Job",
        "CD_E924940DBDA6BB136C3383CD29AB2546ADB5364C986CB6EE98CB12EA6F955309.2668.2688930665.2877",
        "CD_EDF405E5A8AED1408B4231A69625FA74DED38312558073DAEE4924A3AAB425BD.1020.175978079.317",
        "1D57E3148B30C5A652AC89945.2387.2595096870.668",
        "C_322909C324E622DDD863C72515146E16B95F7BFB1C53D81AF6A8766C2DAF9100",
        "CD_FBBE075DD8BF09CF56F5E18528E64829DF169227E061EAB31220ED102922500C.1227.809815937.7854",
        "C_9EEEA1652B076E9BDEC87667C9754CDF2B2DE5F2891C36893BB67F67716CC28C",
        "CD_6ED1CC69327A33D759019C559267CFDE48C858749D7A22192B7DE8573CFC19A6.1535.3491659407.3547",
        "IL_943FB043D19DF8236449807C77494980CD7C694AC533B5FE86CB655A23D50A9E.2696.1929810549.273",
        "CD_9ED4C67E3712DE07C86D1861FC69841608A536EC7A7415988B2BEFAFF875D077.2745.3368594079.363",
        "C_F9D4723921ADF841BA7CC65756244CF775FD9B7C648EEDAFF1E2DDD459957AE2",
        "CD_4DCCEBD0E58C35B09A2D042DE05886080ECEF7D86F9C682EB2F9362B7BB75582.2580.2617184289.177",
        "C_73FDCA103A6930FD52B50CB857297C58B950838604AAF9FA2A8A8AC7D06D4361",
        "ModuleSize",
        "EscEnabled",
        "CD_261DE8310EEFAF922E2BD8E73AAF0133E58FC007ECF50D7BD09C9D3D538CF4BD.1779.185891983.281",
        "CD_76B6B178A02236EDB6A8F36A0CE71BC97D59F8FEDFEABD15CAA3569E6D4DFE0E.2538.2489368492.4512",
        "Uninstall",
        "C_F262F70EA5BF28D85ABB5E29A2DC0DA2AE6549733C60C20BDC35DE79FAE05821",
        "C_3221B359A5416B849210C8EDE6CA9A31AE77982A28D76140A2605705EA5F2416",
        "C_5608C71543FDDF779F8513E4CC24C4DEA60B46017206C3AB0BF7959308FEA837",
        "IL_2AC9D268AD71E14801AE8344243D9A45BDEAFA269C1BE645A564A2D049857CCE.2689.1260473207.274",
        "CD_0DCE749AD0E30C5A74941D6C326877243635B3D92AE3FA1BB77A2C716BB28364.1135.4132144727.526",
        "IL_81E1B447115AA495169E968D729B808E6AFAAA8904F1D6ECCF6F17BC5CB9988C.1094.2847669381.276",
        "I_232A204ED3674E4DD8A1AC408942109BECA0D2D609D1D4D8CDDFAB9386CF0BF3.2710.98987292.298",
        "C_6B87A2FD09C6892F4F975A26E2D24DFF27E8D9BD67B9DB050A7E8D7BE4DA7F6F",
        "`<?03",
        "RSOP_IEToolbarButton",
        "CD_3653C174656650D4A02A47BA68627F0FB4B224B6A036E2091CB484BE8F8933BE.1776.917665293.260",
        "Number of vertically blanking pixels",
        "LogicalFile",
        "CD_F1835778B5902B32FE03208266D52230255459BA290386430668E3E8C11C68A7.1266.2360275267.2774",
        "C_193A1F93E9A6CD7A4161C999356A3002DCBF3CA9FF51ADA6126191BC996D2103",
        "CD_C7753872127F972FAB5A4ECF3A59238F36736CDCAD139F5290039065976DB9ED.1070.2835133801.416",
        "Abnormal exit or termination",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2012.1282760975.188",
        "CR_BF60071AF2C3DDF2AED3F8F1BE212D887152724D7DDF24F313DABC672EFA8F5F",
        "IL_1F1B5C0356632FD18DAD38522A30D771E9348D9DA0CB01364E9975CE6521FB32.2693.1828944787.269",
        "I_1A671C0E762995F8E9061178C1591B318A37CF6147DE1AD7F5C9591F6F8F3EAC.2490.2381767898.326",
        "C_5E4C61B5F4870A86C87C8D3A31C679CD8547F13761DF48FEE0C77BF5C516F817",
        "I_BA3B700F7CCD60EB3A5AC441EEEBB48F4C6C8FCD722C0CF10445CA229B9746BC.2702.1721748005.286",
        "CR_353ED06D06D3F543C1F82745622C061EF12A64D07607F4A41BBE9C01357C9257",
        "C_DB6E0EFA4A4955084B9781E96833D815504B83527431DC12DE9BBE2E1823B500",
        "R_9437CDD252D8899EB7AD00D86C43831F2CC65E71AFA52343D401A7ED5367A82A",
        "C_8A00FF3E28E2491BD7475BE0DBBFA1E38AE556F30FA37A400006A8673FBC26B8",
        "CD_35B1B65B914DF07FAC7860C3407AEAACB382311D5C7C7979B2E9A007C56D4FA3.26.3618076441.372",
        "I_2AED356462B2786C0E1FA1993CF981AE917D300D3F467D583FB4D81ECCFDFFA0.1931.4260316071.278",
        "C_92FBAE457B17EE6F876EEE39AE9C2C3BC4B007C81CA929319E36EE45F722CDC5",
        "CD_E991E45745117956DEAFF1C67CF04DB972E8AC05E236ED8130C434E25D63E63D.1794.4255940260.252",
        "CR_AD28C82889667A5985FA157872F7F42C3CF0F9FD284883BEB8BA71DEFF026FBB",
        "R_049B7D43E89DB89B210565090C00C2A16E2EE337E68DDE45A5FF5E39AC208759.1053.1539938444.524",
        "Scripting Standard Consumer Setting",
        "CD_7758B30874183320F25F4F9789C477D48C7F6AAB3A386DF09B6FBEBA7488BB28.1097.8325008.417",
        "VALIDATION_BITS",
        "C_5401A055411F9811A09125DE8462BF6A4D708D8C770ADE3D670BFB9DAD21A39A",
        "C_0670B73B6B090142BD85762A0781366FE00115AA7451B9B2750B5D23B1B3C0EE",
        "I_45569AA056ADC9524DBBD290145103D4DAFF08E0CDB98D574F6E8F827058279E.2505.3778392268.333",
        "I_5CA19EB2395D61F96178B4A4A94739BBE756FBB157E53F43B5D54BA1E594DAC1.2676.1130397772.279",
        "CD_DE441B498E4159017D84748ACDE9ADF7B1C36301A35BECAC369393D024220578.2552.670211249.1605",
        "CD_F5AE7EBD1A24FC6EF2564B157BD7071D5387FB9F7DDBC55154E64530233BEE38.2543.72003723.918",
        "CR_39AC0100AEED67043710A65F5DEC2D0CE31D07895E6DF01491EEBF7E2088F387",
        "BlockSize",
        "CR_9ED4218811E2E2DC555C6195DF95C97920247EF5A997EEA5E4BE65B094EAD727",
        "CD_9E0CE8EFA5382EFCF4A61BAE5C006427367204E75B0194A869F998F4EEE5DBDD.211.2085787248.770",
        "C_0CEA2BFA85C402C6870520D8882306321579F18BD47E8E598ED675B423931597",
        "IL_1DD0636463BEBEFDAD7DF06C3E438379DC37186F6C024609079E5B87928695EE.2706.4004410529.297",
        "IL_B172B57AB4090106752242BE8F0DADF40014B35B6FAB79F108D12C9ECBAE4D1D.1094.3712133186.336",
        "CD_98555ECC0A03254E6955B33BEB7A0BEA8E21E72A2C28A45377D63C309FFD4864.41.3644311581.244",
        "CD_CE60FD48B8554305653B63F3FF89DE9F487AA367010DE6A864E4D5A7550F953A.1744.181948403.3384",
        "CD_B035CFCE41CEF1FE5604243CAA5700B13BB8AD4D69A92424A83B7D202927FA55.1061.1.18157",
        "C_87DD29F7553A736CDD2DA76F2E87018EB0A43C3178746219777AE1FAB39964ED",
        "CIM_PolicyActionStructure",
        "CD_484456E3E724C112AF20813C7339BF5577C8FC1EC72751890A0F458FF4330C9D.2369.3163662557.391",
        "CD_592D05C8B6862C9EBAB101DFDFC8706B44232EC87D176AEAC787159631899DED.2745.3906949027.296",
        "I_00C5C7DC8B420D1822F26248BE36B9B14263BB425C7E8B7E1182A13ED64E21A6.2716.28893167.275",
        "R_6CE5293A4991040589451CEEA5CB3FB1F0BCB9AC8B0C16A2D34DE39822CD1F34",
        "CR_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11",
        "`,@X80tH\\TL<d4DPphl",
        "C_BBC3416990D99E7DB8C39F2E507F441E712209658D69697F0053C220DDC70FE3",
        "CR_91882C4E4700146BC908AC03DB139338C0844AE5A877163990AFB47483D7264C",
        "IL_33FDC4282BB58B439A7D511CDEC9A74D10A9DF009B2C0A85C15B468717622CEC.2684.2162424456.293",
        "CD_4720AF4CA174274F71D8038B37E58001F7A92E2A83E49C05ABD2C15725C10921.2425.510992893.302",
        "-]$Q{BN",
        "I_AF9342E98D42AF93D6B6DE01168D36238A3AA5B6BE6AF5714A68580A93B2B964.2695.3085137077.273",
        "7CF40D004E2BC1C3C9AA54865F4.292.2766552311.172",
        "CD_6DEE17E27A5048051F81C43886E369D7F42F31B01A5FCD6AE03F4F5C668FA219.279.2567931860.484",
        "PS_MMAgent",
        "CD_54C8B2145FBF6DCDCAEFF33B39FBF359799D5087F9B974E853C4A5903604B330.1820.1957000544.340",
        "CD_B4442D1051C4005225332D6A3F9917C9EE5F09E38BBE394F5F49F7356CCA2592.2581.2613621172.699",
        "C_AB5494CB2548839F327060B92E88F6B76451ECBACC24686132764AE0175E9434",
        "C_AD62CEAF5404095E0C59FDC3960F04E8AD9E8341B0B9252CE4B8968D02FBF29D",
        "C_976460FC508BD53D3838566D8C58041C0F122103C6C680E64E3D0EE074E4E90C",
        "CD_FC7FFCA0C7A5D89DD371B2F0B241E87A604E23DE48746B1BF4F9C2034FE72A72.1667.1456759291.230",
        "CD_E0C55BEA2BBEB604B7FDA1662DA6041DA8767BF74D24BFE7A9F43067C0A21CFA.1570.718215742.550",
        "IL_128E3497A7B9585C582706F0CB14E662A033FEADFABF19FD1304E460A1023EBB.2707.3225679955.279",
        "IL_6183C880C0E210C01CB868355D3DEA1ECFDC3AC47320C74339B61B9F92D3D561.2727.1022412374.283",
        "CD_3218B9989B938326A5858B34E6B5229D688B0E45C61F57E86A18678454B9C8C1.1070.2465041901.693",
        "CD_9CF93B4CC1BA3A3821CB93A70057B3494ED76B95F0DD947CA799629B3F94C395.1303.692693988.1550",
        "I_3FB1CC987258F8087BD78386B8DDA093F7A2030F966FAF6199D43EFA0F6275CC.1523.1979146114.302",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1210.1086012025.236",
        "R_C78A0F34C91F6CF29E496D61A9C0045732574C3CBE36ADD59CDFC7096B17E742.2503.4032903559.540",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.2371.1314380468.116",
        "IL_FC2BFFA6927303B4EA6E4BF8BFA5EE1163BF97ADE47296175A18CABC7358E25A.1187.70584318.272",
        "Control bitmask",
        "C_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396",
        "CD_68F60BCE5ED1CEFD06D072F2C79847AF4A3C52BA9A8E9F51041AA990EA82C70E.2033.3360216869.247",
        "CD_9D6DAF01BF9FEB3EF2C9DA9CCCD42495EF0FF0EB48CFEA8E496981FAD2449D94.2110.1955686057.5035",
        "CR_ED6C3A2F6CC04DF3DD2F991B72C978A94559E5D3850ACCDF521D9DB88CF8E809",
        "LocalDirtyByteCount",
        "CD_D36BA3ECD67E70A681B6A3C59013CFFFBADE74E531546E307816C80C79F820CF.37.1972622953.406",
        "WIN95",
        "CD_EAB61DD44B853A5368E6DEF80BB5C6272003255B9203C275FD85B8806E87A024.1054.1632440978.330",
        "UmsContextSwitch",
        "IL_7A1C70A9CCBE8D4F5636C84475E206BF854859962E9B576A2FE1C50C3060C265.2682.3217477734.284",
        "IL_36045C1EB878565670F72F3D1E7587983677C025BCAD734E43E3B9A93BA9EFD8.80.1846795204.310",
        "CD_960A016BC71A8D938443FD5B4BD545FA10D9D76A0776A92D75D4E23235CAD0D0.18.3076245752.626",
        "CD_57AD49AAA93A9DB4C747A5522BD17E886017CE9B2B40450392A8012CE5FE8334.2750.2965014452.341",
        "I_31693429C4F4DAC696FAB29F1B10FB9D329CF192F0DBCAB56B643EE2D3B042E6.2521.2252718637.542",
        "C_486709A1BC1AEA1713B7B7854CB54E0BA9471BB018357C834E1DD6BAF7DE7457",
        "I_2BC2AD40DC0B25F52BCA8C62620E36AE11AB018F067148F71F4DAEA21CC32361.2689.2177199401.265",
        "CD_2E01D6AE66069E61FE9FBEB254EE45B257107A95EB7A55FBD179811B508038C6.2384.3020723058.3865",
        "C_2DC5A6B44F3255647A4F9E3D4F932FDB937FF6A6BFC90FAEFA2788D220375335",
        "CD_DE7D77F89C87D9F9005DF4E9FDF0CF25EF5AAE159C4D26A1FF500F7A7277BA41.1172.516586198.287",
        "I_0691CBC7B6A8F71067EE710A186E15C9F1BAFA0CF84741F937171595C87C8EE5.2722.1345710257.281",
        "C_CC18C1970080B4FFF58C595866822F3DA823CFBA977008C1C68DD95950E96D07",
        "CD_034D78523931C983BAECE5A02A4B6934DD8AF2673197544B9922FB153D366359.2644.453842074.544",
        "C_F288534564F7CEA5A7BE0115B4FF5B20B967ADA096D3CA8E077825C980B49E14",
        "CD_D372B3B5E5263BE45000B58CB0886A0FC67B0AB412380DC8153CED5AB90E9181.1548.232958340.521",
        "CR_46224D79234790478799E373715902A3BEF0846D474FEF97E0FCD898A61C06EA",
        "CD_E9E54EEA82B8A799BAB440BC9A0D51FEA49FF0156E4DB012B3AF1E723AA4EFD5.1193.2565074915.621",
        "CD_BB925C26F6C4E973C68AC5FC9E68CE66EBB8087D6E05ABF71723D446983422A5.193.1.30059",
        "CD_A9AE64C03C11270991C8BCE26EBE3DD0FF3F841C3C80D3A28DC949EF9B62D60B.1700.210717562.374",
        "IL_B9EE4A50A67D6134A9B62FB7EC1E9B243A0F3C36ECEF51393A3D740A782225E0.293.1582197474.310",
        "I_8496088B206D2FC48938FB34421304CD43C910D9F8120D7DB88587BA11A0380B.1090.450606569.339",
        "CD_2504DC1AC3CAB9C6ED112DDC44AEE64529224B292ABC0946F5963E4C35C80939.1501.2813936869.384",
        "CD_7A3B231F7857F436EA541134B8B2B23DC95CD36328F957D4EEB31FA93298AA7F.2542.357752537.526",
        "CI_9057D65F1A25A157C2ABB405A133D0F21AB61118DC6B4FBB2C013A804086D040",
        "This class associates the setting data for a power setting with the power setting.",
        "CD_BE8F1260CC7D3D8D65E679E452849F43342AC07EE5E67F79C0602AEF0D925B48.2016.3908261694.2151",
        "bytes",
        "ACPI version of throttle states in use",
        "I_CD1415C46A3C7C50B6A1D0B8589B081CCA7C0DFD775A4144839DF5B0AF21165E.2707.1102675543.284",
        "CD_FCB8F5186AFCE657559BD1E3B7945F03AFA3222D1F02A94B0C21BFF34C6501B2.139.3343782571.653",
        "CD_4D4CE956D39D51456603D4ED1BF7ABAD64E72F02B0D569299B434D13F41AD4C4.141.1651113188.3046",
        "R_403C7DAFD38411FBB7FFA51AD2D0CC5E3462A61D34EA60E279877DCCDC222D62",
        "CR_CCDB0F33BA6966E88C9C16D64D85DE69D152BBDDCA55C4187234D7D768C27675",
        "R_6A4FF838847E8BE43B20B870EA3CD7AB282402675223F236F36C36A43AFEC77C.100.2633903039.520",
        "Image",
        "flags",
        "C_9A0DB23B4C5307A117BBF9E162F8E0A10B387D66AA6B5AEFE4F2996B31F1D028",
        "CD_6E829D6C833E13BD25C214813BBF6AF82F4C3B96923B74C3959F33364ED6E372.2534.116346992.506",
        "CR_6E75D4C819749F5E9722A83F3C343A6D80EF23A64BAA743C46005810D5648AA0",
        "IL_53CE600361D9DC049AB7920A4B0095959C43531AA0DA3E5EEA49EBF699C0A9D2.457.1.47278",
        "IL_2E0D8F8A398E657175BD6FC8CDC3751C5169A8D1DCF2BBE70883B5A71F80CD16.2692.1197285522.276",
        "CD_1388B74AC4B1A1248035D019490B1CAAA479C4415233A9E50223DD0802BA383C.2743.569860282.3304",
        "Total percent fragmentation on the volume. This property is deprecated because the computed value is unreliable.  Use FilePercentFragmentation to evaluate the fragmentation of the volume.",
        "CR_B496E3C91F33B99F414E0CF911598E2EF9133E94328E67220F22C24A7531B226",
        "VerticalImageSize",
        "I_A0645C5482C6C0990FF3D834DE810EE73DD1C560AC29409CF0FE88CEBDDB1D73.311.2804001211.249",
        "C_1AB5CEA68F83455554B391B4DDCFE58CDFEE256A79562EE34B38ED037BA0EE30",
        "CD_0CEA2BFA85C402C6870520D8882306321579F18BD47E8E598ED675B423931597.1677.4157864808.371",
        "CR_9F036BA68CA921AFF06984BDB9CEE80E8A2696D8DB098A0C679A6507C62F4DAD",
        "C_9DD2597311C29BD08E085D0347CF2A159A6DBD82B7A0B5D91EAAC81FF9077FEA",
        "MSFC_FibrePortHBAMethods",
        "CD_3929A976292C0E92F1EE078CF7C2D3C5371AB7D7BA2E3A5C78D38FD26BACE479.100.1665134047.2101",
        "I_205887C744703AC8F3F642361E4742AB22945D825FED20CA5B721B6BD1D35235.846.1.54129",
        "IL_D2EC1BEEEF8BD7E6DF62521A5DC7CD9E1F4B90D3ABCE3B2115D7BDE3450B5DF5.2685.3078453749.277",
        "!$'*-0",
        "CD_61AD70324F8E2B3494420EEDDA5029E5D1AF2B0083C1CC1767F12EF889E146D1.155.2761505552.1164",
        "CR_8E8BBE32398A61BB41BAE9F60F150534B4CF02BF80975023BEB14B7EC8CB91E5",
        "CD_9B2F150615D5CEBF9CA60938A935C312A66EEB48D0E73B55EAB7F994DCD0BBB4.2584.3769398064.625",
        "C_E630E2A029E4FDA59B5EE4D96DE915A5BAC16FFA2DD9BD47541BCA0DD720D334",
        "C_F275C6D7762007AACAC2F7FFC21BE64DB98987C474F6928DE4850F09C68CB078",
        "I_442676A0C1F4DC308F6C2B7D1BABADB3209DD2A9B0D3DDD17987CC3AD80CCBE1.2691.985760022.273",
        "I_498D26241CF6F54582AC8CA339B3E4E7FFDB01A01B2E83CEB94DD48296976445.2711.2443990039.292",
        "C_6B6D0B828C66AFA5D96ABFFC61FD129B9C2E80C49CA8F276476B6798C33F6D5A",
        "93B.2579.2875369913.1694",
        "C_160EABDC96778D770525694D91EB3D28B431D3754F4699DE97314AA3F85E4954",
        "CD_1E95EB134BD1F60C54BD011E7F7F0F99F605256CE2A10E758B49368E488FD646.1563.2664683965.2795",
        "R_2A2D6E6AC8E9DC7CFD3B145ECD6507F431971D2D607AF7EC159B3B5EAE53046F",
        "C_323D5E05836B46F5664F2463C34212E1954E843C0EAA64BAC76FC3916A5923F5",
        "CD_F5724025314AF2191A5ACDDDAEBDC7BAD281D1F316129FF85CF79A35F3D586DF.2531.3150984864.293",
        "Vertical polarity is positive",
        "IL_466F1E826D19323DB7FFE80040B5ADD211A417F90EF997C2716C16E499FAECE7.2695.3985898832.273",
        "I_41AE0E8A27F69BB81713327447DFEB3E4D47E6C961601828958257151B049D62.1617.2932729107.256",
        "CD_A68B01B18C25C8BFC9B36419B9B64DB698A481D87C42ADCA7EC744307E0456D7.21.4086711713.993",
        "RSOP ID",
        "IL_91401F2B7C98797EE0E4F6F89184179F6B71019B9C198D9A0006AC6A265AA2AF.2700.1962823044.270",
        "IL_52ACF7EA31FE51DFB6033D39218F9329238AF8BE0C84379186949A860333D2FB.2711.3345584353.292",
        "This method allows the virtual disk's intended usage to be updated. Not all virtual disks may allow this and will return 1 - 'Not Supported' if this operation cannot be performed.",
        "C_8A299070719A67E2118FDC95A71E8BEC0CD6176770B7F252C94DA895AFA7A82D",
        "IL_317D1F2687177AFA27CB8EA6F6A360902286E215810936DE250861D000157F69.2460.749615048.336",
        "C_40A02E8FDAC46B2551275BE49F53DF91F9AAFECFF566E59007B7BE16747B091A",
        "MSNdis_HardwareStatus",
        "IL_6A6B9E2BBE3244917A6F8976955E1E6E04DDACCE833988626D557DC094A5D1C2.2469.2992845625.349",
        "CD_4D409582B9E7F83CB63AE537576DCB0EE80F099F2DB087CD2C4B26E6A30448E2.2102.3161945721.860",
        "CD_FFBBEEB41878AC75CD38671CF9A4CECEB2F673622833FAA9EA04376FB4297330.154.4188203967.364",
        "CD_24DDD679D1882479B2F8FF4AF859BE0088ACDCC7691D1F75049F173178F9EE5B.1757.1552625840.336",
        "I_33A7BFA2025BA7F7DB0CEEE1B24DBF7556E415894EBBCB30BC86C2A1966AD8CB.1480.2036682156.194",
        "IL_C347ACE19BBBAD723C40AC19E2DFEEB31D6F13664EB3609CDE5B098C6EFDC816.2711.3442957805.303",
        "C_8163F817343339B5E10A75E5D9ECCB7DED2F4F1B41C40C672B95F8BB7CCED36B",
        "CD_20EDCE2D529E2E6BCE41DEE4170C3E9E6D3DEAF61091F14E5541886CD554DE30.1802.2107655979.439",
        "I_90E778219594B3DCC71F632018DF12DB59F05985DA797142C94047AE997D6828.2676.2098405763.280",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2167.1045814340.188",
        "IL_F321FD31D139FBAE0F6F7DB23BD2CDF26FE9FE62566455A898A88AD7A02917C0.2706.3673377254.294",
        "C_47A1D2A8BCF5F91E1526321DD0154B4FC3C4CAC8A7D6DF2C21F3DBE6A8700273",
        "Not pinned",
        "IL_9025C44479FF81CC37552E9E15484B67725972910FD071DCA563F8E23E7E64A1.2713.2287922391.269",
        "CD_9226DE8FE74359C1BFD228B1593D6C5E10185F550FF2997587B5AB69BBBB9891.2580.2967113741.219",
        "I_2671C73C258D39CEEBE8399DB62EEE11B5B9BDE263220703C7A03C2DDCA3D03F.2735.3906584807.277",
        "I_80B4FB12F93F8F9E46B7B3D88D1D395B44E63D1E42C4BBD5690A8433C69C16A0.2729.3200228428.280",
        "IL_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6.1489.3736534883.282",
        "CD_E787F19CC95B92FD39FF9311EE9ED6339BAB88C807BFF054C3B0B7D91166FE2E.2555.1321294119.497",
        "C_8B5A6B942AA5416825152D8055EE6894FDA3E8C591F37D309F86A2C72141DDBF",
        "C_8BC061EB0082E96D5DC5828FD96C3FC2A01095E7E42C720BCD36F363CA556A85",
        "IL_9B98F8669D7BFE6D1E546081833BAAE57F20F24BDFE0EEB328E9AF7526175F40.2693.4151873662.260",
        "CD_7F6515E2EBD9049AE896B25B99B1906533354EA0DB3289C03EFADA9D23B196C7.2031.2011816334.603",
        "CD_9F8D978C4969B38F6B12BD156ED032890417BE936A9EE501730FE38AEB7DC52B.263.1682314298.942",
        "C_90A9EF86FF70A029BC2CE69881FE867FC03EE19BB520398B9DE2D02EEBE30B96",
        "I_1AC1FF9846D54F9F0147D2DB85F9B6094C79EC82E32CB9B2EA521A35465B977B.2710.1224757709.295",
        "CD_524ED280AB38E3BD86074B4D556A261D98A4E9D85B8A2DCDD6AA2F85E3342805.29.3391548092.1474",
        "C_FFF2AE454B5EBA423321420C962DDADA7E00808CE9D4E5B4FF81481A2E9CA1B6",
        "CD_777DF9CE1D7A4D5EDA5D1AA51A89D7A89F8ED9170D2417F1F28E7E4AEF3AD464.1341.4110514106.1115",
        "I_CE15A28990A8AF1557619E69E9D387E8E0E2FDEEA17DD198F8741FEE3581E83B.2681.875278252.278",
        "C_D9C1A31E38D8ED408C173A996AAB7388592772DBA1A90C224E58684940B6635C",
        "CD_84A63FB7A3FB9450516F5A71E160284AF2F9D586FAEECFC8F7755F2A2FBD437B.1087.2967616596.697",
        "IL_715A8576DE8CF6D78CE0AE7D8041141A05B4A1E1DF7BF401DDFF5E4E706ADB4B.2675.1223174665.275",
        "I_858C3D9F6BE74015ADEB4435C1A8E93ADECE95DC03F2E1F11AC3EBDBA0AD47BE.2709.546884313.293",
        "Manufacturer",
        "IL_53AF8608C104F86655F42A8871E5F73225A8D681F66B8151B7C200C46C518C50.1462.1027896524.253",
        "Detailed",
        "CD_C811BCFC8FA021E0ED24EAF2AB4D586D8740EFE02D81CF2A5551BE06CCCF53EA.2759.3786693620.355",
        "CD_901F44D3DA0774EA1CD96ACECDAE8DE6806E0673AF788724704275292D2A4E60.1543.124420292.1703",
        "C_6F0AE2681972D35A5F9DC1D57740875F1F03F7B6D986B3D66007EA5984B706F3",
        "C_8CFD3BDCF459E28A190CCF46FF43F533DE3394389F988133FD28EA5A0AEA1616",
        "C_3F47C7C5EDE1255249E372E90C4D8EAB77757D572A8E1F6E22B79B0FD3819343",
        "I_9FEE5F109177A11961D03E9415C6B3223CDAF24650E561C999695318D53B71AC.2709.1901861931.297",
        "C_6B2889479D57435939038FBF287B4AFDC16FF0B74EF9BB25FE6D86160746289D",
        "CD_9C256CE37E6F9177BC0EC95344373747E0112D20D664373933986EE480BE67C9.294.2549561938.1046",
        "CD_DBA99A7D488C87C166C15C9F1723F214A2817799E8F4CB02CBB2C24C78077720.2087.2098491453.436",
        "C_032899FDDB4113F09C2927CFF27D91F643A853996B6D3CD2E896FC0EB3B90344",
        "C_5C6828A3364FB35ACCB00567C7BCB4FAA9D96E7DAA4FEE16FD257A946F33EA50",
        "7DCEFB1E634599916220181F35C3DB70B94808983CB78C381325F1AAF3.1678.1.70946",
        "CD_5E33BA8BB8301B0D571DB35AB12D7C91B7A0EB2F54B87081058135E8F4EE33DF.1955.773278799.656",
        "!{$'EW*H-0369",
        "C_C504B91CF040A007F72C24FC0CC99A78401C1C475112424D0A789E6908FEF373",
        "C_7E08DBFF5396CB780182AC2736970878C566F9BF15005E66B9A69F8EE7B0F2BA",
        "I_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251.295.2733276401.333",
        "I_61F2AD851C54E6137B3949DCDABE99F61429DB318AA9014CAA2219DA82996B87.2715.2046477307.275",
        "IL_F2E3FEB3970C3254AB28CCCAFA698A79FE77936CF6DCCDA4CC054208AFF26367.1014.1518610667.301",
        "Volume is not mounted",
        "IL_E4A35312C830CE9926C27E04A2917C3A7B7DA9FF912B8915FD022768BFB91934.2718.1814732759.278",
        "CD_9EEEA1652B076E9BDEC87667C9754CDF2B2DE5F2891C36893BB67F67716CC28C.2599.2322544865.2516",
        "C_A4B7E1219FA76BD23A588641B4F3CEC1D9A3585F7F85B74432295927C547BE69",
        "CD_88F114F729A668FD2C1B85D0992A0E7B8F743B0CB06B7BE867F689C1410526C6.1802.2790001246.1994",
        "IL_6FAD6F5A3EAE1935829EF4FC6A99FC807CB5D8AD89CE9BF67AB558DA70C47AAE.2682.2273171534.301",
        "CD_F9AF1E0E64A5F88E91652C8C44C8A5E0B35B46F211646049A589ADDFD182AD4B.2102.262100735.1304",
        "ReadWarning",
        "CD_B1DD166515EFBE9CA9A9BC05F545A35C45C3F834A45BC50D492ACD05C6CBB96D.1018.3291359271.291",
        "R_01F6508C1866E0E79B21585B0217BD595D533D4A180A35479737402276CAE352",
        "C_9CF93B4CC1BA3A3821CB93A70057B3494ED76B95F0DD947CA799629B3F94C395",
        "CD_4B73D65E2FE4553C66EBB3CAEECF929ED3C6295923490BCF82E45AB15E13C3B2.143.1519770697.580",
        "CD_18BBD01AB9B011850ED53F3C153FB85C4D5FA9678EC8589287B293A340368BF6.2084.1.12902",
        "CD_4C5229B4915A098FA9E249BF643245728F52EEA4263D760742E82296F3E1B97E.214.2539525460.738",
        "C_BA3FC4E8301B193C5A48BFCA7961F2A1447DB65DBFCEF017938E455E2B82923A",
        "CD_46782F06EC58C8C916C062A5E79D6F4E68F6E57049485ED56043B6013534D92E.1205.1635734062.258",
        "illivolts",
        "C_60F176EC0AF17AB7C6FC2843157E8D086806E5F0522F8004584440762F45B2A7",
        "C_8724BEA2FF9D9B28718AB2DA764FE15C27C309D192B8F3C70C0BADEEA7D258BF",
        "CD_0165CAB89BDC44E6A103BBB55829CE27E96FFC1FBC965B1148A99781C10E7A7B.1469.2768273348.762",
        "CD_27CF2379D55C0D9FB04788B37F03791666FBE227F5B5256A959C5EECD8D8ABE2.288.1.14602",
        "CD_8B7F99C264005A257FC33FC5B8BB55F758A76C6761D36338B6FB1E0C0931778A.1054.882746760.486",
        "VESA GTF",
        "CD_39F7C38967E34297331D59592931F4CD7BF528ABBF3FC3480C6D46EB20F990B2.2018.1910141584.726",
        "CD_CE2D741F2F76D8B2DEF2CE5F7AFEC89E6175D7B4F954957AFC4C2CCF01EA7DB4.2159.238340872.402",
        "CD_2029D50C77548B518321A5119A9BC922C0E0B7DB421A8864B7194AFAB76E0963.2674.948202040.727",
        "R_A881933FA9D51D73AE6214A1138DCCB4CB1BEEF83EA181C268577ADB44A0FB56",
        "CD_46FBEF9017E8ACE97E9FA4E87DA4466AB9594D8D5A576C11D8231FA55DACDC4D.1539.1475900363.425",
        "CD_A031CEAC5953C8D3D1F35E1808CFDA9CF75C860B9E43860077ADEB4071235C56.198.2769707086.695",
        "C_6FF9530F5A013B9899083097E643F11387356FB784EC25D80243162D741E08C7",
        "CD_0AD525E3425E2C8CE42AB7D5E0BAF525C78B2BFF44C9B8186D684A5F7DEC44AE.2597.1498291845.1330",
        "CD_D23AAFA64D52613F87736011BE31B8C96B9BB059D3D70DEA823EBA275624C0A6.1931.3662004575.254",
        "C_94F2726A101D2A1E24F4ECAA94319E60322E839528620ABF5ACEF14DF1CEC5F0",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.292.1554222953.188",
        "I_E6BF7C973B75A1F7778872511AB36E41C9381387E2118374DFD3DFDA6CD51238.2704.1194482450.283",
        "CD_C6FCF4E8BDB79DD332BC21F4BA68D00DAB00411CDF0A5E259112BA2CED429F90.1595.2470083624.489",
        "C_01E49F2BC300B8406F535D199FFE723C66F3CBCD052B872FA9DADCCDBACAAF50",
        "46857EAD.2098.1523510017.511",
        "CR_90BEFD5DB48494878DB04E68E99BC36C64E916ACEBE36216625D7CE508C8EF7E",
        "I_C118F2758DE872E67CC7F957EEC75E4D1322D45AE193AF4A33FBB1AB37DDF2C8.2681.1727853428.281",
        "CD_4C941C9DE20A2632BB21CA3987571DC02CB561982F3A7D0379036161DF189433.1353.813881388.1197",
        "C_8FC06777C7644BB6E532C5BFB40D2341249BD9B41054098B6ABCBB54057FFC4F",
        "I_7A1C70A9CCBE8D4F5636C84475E206BF854859962E9B576A2FE1C50C3060C265.2682.3217477734.284",
        "OtherErrorSourceFormat",
        "CR_08D881D450D0615D55EC2939B63E533A7629C39B5BF81A337BC629700DA3A69D",
        "C_972576376A5F2C5C3EBE5402A0C00A72BB51E33D448C072392A8C26DEF804EC3",
        "IL_F0E679DAC6E66C90CFEA8749B4C30BE044ECDBBAA7E17FF5A20E0A0F881AD779.2720.395268258.276",
        "CD_5A25B87C229EBA73993CBCAA6C98D2ABE024422E1CEED3A8A096904B578EC322.98.2438259581.1112",
        "I_F0D7D27CA58F49F3CE8F17BA3D8E77591279CB75F59D8A3D3291E84A28AA6CE9.2677.2063022300.277",
        "IL_BAE2729FB2A4F61D06933B050C473303CCE7911F610104E1004CA977C52C3E87.2434.3417119911.354",
        "C_46C4D7624EF726AE82EECFECC7D2FAFCB46460D191B35F158A7EEAE469E508E2",
        "CD_7456FDAA562B6B522C0F5D4979880E459C60E9269739279EBBF720AA7C155265.2644.1245951961.752",
        "SECAM H",
        "C_51E88707378BBC9C3F0262A228CB3838BB1907FCEEDFA527CFB3A2F422A1118A",
        "CD_9AF43985A821E0DAFDFFF503E1B889FE2ECAA20F51010244BA510E3FA76182CC.1341.245339072.643",
        "IR_2493B293FAE24B9DB6F542A76F6954F10DD366AAEC07782F39E87A24408C09BC",
        "CD_10C4E860C968580648DC441565AA0E8E7188A06B6B5DE086FEEF7868F45558D5.2449.3479885442.605",
        "CD_20B4E701C3271ED94785243972C16A9A8FA123A78EDAC768D9A7B370EC4A42D1.2756.2443591597.348",
        "CD_EB253439DF03A5FA4831121FE91AC54603FE3863E8A53093564B49A3926CCAA1.1915.3272434852.256",
        "IL_C0406F771E2762D51D71E72E6570A0AE6C617FB931ABE8CC68B7711AA6A0E7F1.311.3044912591.229",
        "CD_72E10357AFA80C4709DA78E39ADBCD46611EBF6A98AE76E1460089057D38D498.1248.3421694232.589",
        "I_CEEB04238836B14B55751D5FC8F0C378A54AF1942F10226666FDE7520B51B7EC.699.1.57184",
        "NS_FCBAF5A1255D45B1176570C0B63AA60199749700C79A11D5811D54A83A1F4EFD",
        "CD_15D17602950F6C84D799561B467DD6E41D14A7C8F3BB2D223F118DC47EBDE909.1609.182019657.699",
        "CD_FE3818270093A67B72B546EA3ACF6E4265D33BD8A3B28562DCE0CFA8C720DE41.1.293509503.173",
        "I_2FD8DCDD9272028411CDB92D628888781F863A853FD409FF5C59AF68D5452AC6.986.1.101105",
        "IL_D17C32F22586C7FF68377F9A82DA79BF8D54BB445B387B595E64C515CC034A7D.1479.3870380055.302",
        "CD_7DB1E30FC06BBCD83555FCA1DA86A907938086DE88B466575ED4B935DD61EAE7.1998.2378983960.1742",
        "CR_32F111A45E7594771F4B831EC4C51F536473C63323692A7F6C33516AB1164EDA",
        "I_08837FBDBD3097471CC2C297165FAF98E393B0957D4C58A3770FE396DE076DF5.2710.1230526157.299",
        "CD_F2C608EA415A514E5DDE0744E350C5D6F7B19EFAF19967D7E934C8B89CA08EE8.1973.363235824.4264",
        "CD_DAF09917B9CFA8B255E2F8328EEFD54CDCBF643D68C0AC3F94A83078C17C15DB.1526.2463519838.573",
        "I_9E8B26DC09F8BC8981ED0BE484716F2638BD5B08766978ADCDE0FC3354AE393C.1053.1404244556.347",
        "IL_5C4C1F05C0F04C4E26AA438C1129133711DF946298177E9991FD1204C790219F.2724.4050780076.283",
        "CR_5E46683FD84F3219E379253BDA01FEC308C95988FDF4807D31199D70DC1E39D4",
        "C_110AE6309AE2428224AA19A1DF291C0EC1E01C277EE0FBFA7CE4C91884A74444",
        "I_66D0911D2E593F3A030F739B357141769143C63FBFE86B3D6089E24DE4662608.2709.2019070949.308",
        " $(,048<p@DHLPlhTtX\\`d",
        "C_F3A809748DB54B5207976175318AA0D64DF505174ADD1D464E1C50800B1B617E",
        "CD_0B8D0CD35EF9C37B2A0F0A7A5A12FCC21F082587427AFAC5F5A4AE61B8034D36.146.2764961514.642",
        "CR_48A5B17344C48EDAFAA391BF26A48FFF52648D73B54F3E703A672629602CEB4B",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1330.2476940105.211",
        "C_F78D535F784AB5BF2A7DF53DE5ACAAF1C73DACC48189425DF45543879C147259",
        "I_0152BE1E4A994A7C0D8D41959FFB458DA1D806B79A7FC07EFB5457858BA9AD43.2714.1143836868.279",
        "Win32_RDAllowListFileAssociation",
        "I_1783899442EF78D0F328C4F66255C049430186458D7A954FB1E0A7102EFA7079.2688.2084836354.273",
        "C_CE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0",
        "C_3BBF6D4F66D3DF1398ED81700FAB6C7981988924128EF9F6E933D2D4C1E103E9",
        "C_E92E47C86489DA48917E83D712F4258EEDF7A9FA5063E409A1EAF630ECC0F6DB",
        "NTSC M",
        "CD_42EF75732F6EFB96178FF742AAA73EF32DE5B0335EA10065BD30F22EA794CDDB.1564.1167325258.751",
        "IL_7F6ABA44FE1132DCDC9A8108D73718A7249FF04F5FB0B38E68E51501E325A7EB.2718.1200886120.277",
        "TandemNT",
        "C_EC835FD001719DF0125212FFB95D0470D32F9067FFBFAA346321BD635810CDC2",
        "CD_89B3BC9F91AF19FD95569CEC4AE8264DCAA2B513E756CCAD927560FA5C73CDE5.18.2239793584.523",
        "IL_74D6957A2807BE355D99943728005C3B31EAB1ABEF112E8AA77ED527A633CE24.2681.319713099.284",
        "I_FBF50E9B05799DA2F07A79202B0E7B53E9C07349CE7F1C414483261C33333909.2508.2601338466.269",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.190.3698743403.332",
        "CD_E706FF8586C52A7176ACA48D7702EC2A6550564F0E42B0C09AE3FD1CCEA62CD4.1076.2130159895.911",
        "11.284",
        "C_961B71EE3CEF77853FD06FD1FD078D670615B8B606936AC4407F5BADB29E35F4",
        "I_A41A2A506F07DE19FA26EBBA5A53B62D2C62BAF775EC8BEA2B152B5D21A711E3.1489.2658302389.339",
        "I_2C3E0B2C69ECC1F533E094C6BC0D6FE2FF50B62467F6FB0D4116BA80049303DF.2505.1781271333.301",
        "CD_D81338524AFCA60B0F4075974363E8831DDB3AC972CD263F00EE914E81792460.2575.3121179756.665",
        "ProcessorAcpiCst",
        "CD_581FDBF3A3E51D753168374466B7C40E39F607E7397DAAFA13C9AC84F1F3CEA3.2744.3635038278.364",
        "Unknown",
        "CR_47A1D2A8BCF5F91E1526321DD0154B4FC3C4CAC8A7D6DF2C21F3DBE6A8700273",
        "R_B05992ED3AD54EF8B8B009DBC877FA06AC4885430770F03FD5362C077B5C44D2.1934.1965892537.524",
        "CD_E593BEDE8ABB842DB1631394ECD41A318019F9AEA2160EF1EB883CEF54FF1974.2598.2111539553.718",
        "I_61642E797CBA7FD308765D422A26458A770AD0BC77553C0534CCCD9FCA1BD187.2417.2810255257.295",
        "I_BF593FDA4BA33F9ED167DAD655EB0DCA41D164E127B57BF7155EB8BC36FD4AEB.398.1.150684",
        "CD_F15DE552171C286D0AEEE0B9E6A1C50C119FA39F1FAF228FBB5F509C5C408C27.2605.52925687.7346",
        "IL_129AB6E1DAC83B8A4F15F872069B1769D0052D0A7D6F69174C6CC64702798ABF.2712.1831612025.298",
        "IL_440D803EA4D2D6EA54DF96FC35ABE408DF3F784C63D6E36B9876465535513619.2702.4050137494.292",
        "C_366404C6BBC789A7EE3D5ACCDE9C5AB09583CC8BC05AB7F7F7498213BA102D4C",
        "C_A82DF9B10154EC9C0F8A403786D7520B52229D45691E2690C3B352DE9F05F32F",
        "IL_FD322ACEB4A2053F5989E8883B52E8442665045C72824585C0C101F70B5D252B.2723.701907449.274",
        "CD_DA73568A33421108A6DACFCC11E7E041F3E9C8CE8D59EB3EF5250A5065604FCD.1465.3232810636.587",
        "C_4B73D56414C32450B76C83F50259BEF1BF1973367F51A9AA685F527A570A98B1",
        "IL_A149399DE5D286F444C4B111636DFBC68048E4FDC5152AA24ED98EA642F0ABAF.2457.373749567.361",
        "CD_FDF44B7A491FBFF7D82AA60088512F5C196339142429AA6E3D11133F28C6759F.2575.2454956301.418",
        "IL_8A5E598AD3DAAACA2CBFD013039B4D99FEDA8AD6F7C7816556A4320148526877.2710.244252911.293",
        "CD_CF019908D018696858253B4DB7E2B0B890C35E62094F820AE236F7B784A381ED.2669.1360669441.458",
        "I_8EAA7A72AD83AACE2BF0F766050BAE26274F7689DA939B1BF7D6C7DB68799326.2685.2660112009.266",
        "C06A7839AF030746D343DE6FF14B8AB.2705.3966710648.303",
        "C_3861033CD1DBF897690A8E4F8C0E20A546EBDB5E84B5C3D96DEF6D51B883609D",
        "AppAlias",
        "CD_06D136F7B0ADFCDC593CD2915E41E046885B6FE2B8DA0198F3B2B133CE772261.2528.1543153044.318",
        "C_97C7D526C4DBEB7083476F235A5653C31F00C78AFD98652230E17D721E353ADD",
        "I_6C1DA6BA9869E9DB42E035636E56048FB84F53484731502D87BF716D0FFE14EA.1090.256707327.498",
        "0= (5",
        "CD_2B4521AB2FE85B7E58E501B16EC7C21CBF35FC912BB1BB164FCFBA34D7094CB7.1603.1578832089.218",
        "C_3351358FBBEDAF8C7F9F2E844C4D143C5C07E38C7FCE1FD88842DE1283A57796",
        "I_8A5E598AD3DAAACA2CBFD013039B4D99FEDA8AD6F7C7816556A4320148526877.2710.244252911.293",
        "CD_E8A8D6B4FC24D90ADB5A9D008E4FC2860257836A2DC3482FE5576FCC1546870D.1102.4091909736.6510",
        "C_7CBBFC903B769BFE526D96D753E16AD7ABA21D8A6B6B1A1612CBB8FF7201B692",
        "IL_2A8E85BB31065B3FC60BA81CED6A654079AE6D371D42FEE2259112FC3A521E06.290.3903742088.330",
        "CD_1592BFFCE522F75E708AF00D4ECAEEBA5AFE422B12D1211F8015509DB1FF98D6.158.2315880255.544",
        "The firewall profile.",
        "C_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C",
        "CD_D53A9412B3B8ECCFFA3767816157FDEF777B7E45473579907CA9B8D821A34EF7.2545.3450036824.787",
        "X`DH|",
        "IL_D60588E1B02718D01376C75726A4BF9D492EBCE52028F9E5AC8F77A2A753F538.2675.1022153021.278",
        "CR_20699BECD68BB2E715DB1990E4FEC1EF2DAF88A1D4AFC17A800FD50774598318",
        "IL_5EBF93E0C149B1B151E338091E85B09A85B53ED88BB6E56FB2EB094E120431E2.2461.1736558589.329",
        "IL_B9EA4E4294BFAD4BF680A19D237326A3AB39882D24932A1112CF7A54CF8BA248.1931.401831312.328",
        "IL_2AED356462B2786C0E1FA1993CF981AE917D300D3F467D583FB4D81ECCFDFFA0.1931.4260316071.278",
        "C_1B21127D666DE7149D38FAE87BB50D5044EE42AA689C0781F72EAFDDA2BF1383",
        "C_4B625BD46CD9F6645F33476CE1E5AC2D9C2B5C6721426559A5E5B53B80B4B21C",
        "CD_A9FE98FE5C3E9051AEEC71D48BD2011F883E1553AA2DD7968A20C510AD60108F.281.4084949831.450",
        "IL_386D85B50BE3D60DC60B4C867F85C74A8FF08C6659102D9DF5C88A27B2D9E507.2696.562378574.273",
        "CR_C6322B6314CFF4E509A8264F41852433F9D38AD4057623ECC6D130FA2261F1CD",
        "Win32_WIN32_TSSESSIONDIRECTORY_Prov",
        "C_CC8D8F676137BCD5D5531414C0F461E5894D404FA15D384607EF32C9D2D87E32",
        "CD_000FA1AD23A342CC5409A97F904028C08F562A8841D024941D8FC5EF860D44AA.2674.330934672.1246",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2473.3028845912.180",
        "CR_88D44DAE596A9A7ABF169CD599EFF3D9F693DFEA80491C3B4C3E21A1F5B46218",
        "C_78FAA10AEF4BD66496AC972E3E24B846C0EB9855D0D6515D7EED8628B54F3A1B",
        "ROOT\\cimv2\\mdm\\dmmap",
        "C_9978C56E212E6F386849955B323679D38EE89596C89F4734B0D545F76D348E8C",
        "CD_672AC91064DD7727FB109DFF59E95A1F605E4D89A741855158B3D85A026CCD54.1794.3104842928.3764",
        "CD_15BB74500CCB05CD5AC2C91DC16CB85AAAE5FB06E9A05F8A5AA7D6BCB68E38B6.1737.2857677278.1116",
        "CD_E21BA0963ADD9F282F163368EA328AFD0A42D3ED5A163FFA12C0C1B41FB686E9.2583.2582111670.467",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.2051.162862963.466",
        "B7BD18ACD1F30074C3DFE4AE.2649.3934538968.244",
        "IL_35B3BA3D4E3452B9FD358FEC9D1F382046EF61B6EA2F3D32FF2B776BA565D15B.2734.2803422054.306",
        "CD_66987DC488F04E3DC6BA6B1845D5EB313904DDD6D9EA97184EA6AED23E5B39CA.305.2621047284.2052",
        "CR_C787CDD6148B3A1710BABB66FFAAB061F700558EE123742FA9A22BAEF228EE96",
        "CD_41D84F93E168026991704896B6AB8BD6B7DB82CBC17BBAA1442A047D10A853E1.121.2119483860.459",
        "CD_56ACCF81C026D704BF64439555ED0FE36A1018BEC0E78E085DF8A96CFE6A37EE.2451.2342195477.524",
        "I_52BE714A8A14995D7A27D4DF5CF5140919A47D8E9D40A9E22276831462CCBC61.2691.2353329500.262",
        "IL_05871F7367735F5F486B28150ED59EA0C3553ADBEDC56F11017BA47141A37867.2708.1156921452.285",
        "WmiMonitorAnalogVideoInputParams",
        "IL_D146EF793EFA8D39AD579F3524C7184A9F992483F9FEF9F4D1BCDFDD20ECB4BD.2691.2589322182.273",
        "CD_A45E0068C31ECE71DB8386F48AAC28A201C918A54BA7B6C803A07E1B151C3D4D.2730.2543586049.384",
        "C_A6E4C6A48C4E3DE2EFC53C308E095CF2E1895E3989736D6F733AF610DA0807FE",
        "DriveHardwareError",
        "I_66E6CB76E1CBB5C5C14CAA8D90DA0CEC84C6EFA9E1FDA743B2C669976130E260.1490.58942205.328",
        "CD_84BBAE9FD8A6E21188B2D0767DBEB321A61D32EF3C67D9E47C565889A9DA260D.1622.1.17766",
        "CD_B8C74E67C39B608082AB2CF31CA5066A5D2AB9D167B8974B8B36B9FDA8E10D1E.1059.3016751556.526",
        "CD_5243094142BFF50E230A225F471ECAE0DCF0FC00D9021F08F10118DC4E9AD84C.1086.582107323.1048",
        "CD_F841B632C0B2584CF30B2004D8CB79959F456B5795456033F557C9A443CA86F0.1059.3905362423.620",
        "R_2CEA3682CC09E7F94D9FBC1BBA63FC6DB39872E53B9187129DFF772A12215DD5",
        "CD_6BA587F6AF181129EF94B57125FFF3ABFF81218B46E9C3323CB782B9288DC94A.186.2457994583.992",
        "CD_418C5DB6A4996A7931075FA27FB4B9D160A819D899115082794D414F286000CD.1050.238635868.242",
        "CR_C3F7C0409DA0A77A93DAA31B205DA3FD17BB822F308D9326F5F4ADB0332FBC81",
        "CD_F18B3A507112161BF62B88964CB56177DEDC15DBCF23B36584CEE511D5EC710F.1970.544644106.2289",
        "CD_A656B709CF7506FA0ED9A4A22CF1CA6B0C1E6E71BC032CAF75FC1489092E677F.1576.4127653716.539",
        "CD_316028CB4766215C2B0D3643DCC0FC70FE66BE560FA2335CAFFF2477CB4C6F30.1538.1069046242.535",
        "If this property does not contain 0 or null and the implementation does not support this parameter, a return code of \\'Use Of Timeout Parameter Not Supported\\' must be returned.",
        "I_0405F6BF94233FA7AD22704F8B3A0B81C7FCD79FA3E732DCD4EFC495396F9ADB.1014.1183321281.295",
        "C_5EA07488A9CBC676B6ADCCAF378807D330C6A6A97786CF041307B3FDB3A6030B",
        "CD_2962574DBABC9D74020CE2DACD4F495EE01650AB6A58D69BDFEB23855FE777E7.117.3155449967.1042",
        "CR_DA8E15B78CFB4F9B2BE10A65957A921FD8C6894DA0C2CF425B855C7658787703",
        "CR_BAF75302566D567EA01CB2EED45B5C1B4A6B65E2564A45EE8181990FD5703235",
        "I_98233BC0D6E21C2CA3187CB9E2307592DF6D759478E209568F3CA340985F3F72.1163.1217761889.326",
        "ROOT\\Rsop\\User\\S_1_5_21_3968686040_3210279463_847977608_1001",
        "CR_AD7EFADAD1289B4A3FEF0D60EBF19DD1D014EA7A1302D0431E7F57E3F564CBFB",
        "CD_F2BF551D2C47E413C4BD58FCB0E48E0B3211C53383EC4051E655BB8319ADD47D.32.2244598954.441",
        "C_E4346FA7675883A4AC1E72B73F27717F3DF9FAD2FE9003A5A4DA0ECE1E363C29",
        "D04CAB50536C3870BE8C32D1CA4CBD9D.2195.4286869377.4819",
        "50003",
        "IL_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.3007692339.360",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1352.459577058.332",
        "BE5A295C25749B68FCB3C6C54CCCEE17321E25B3884CA.1065.1409787257.765",
        "CR_4310F4B6525F39CA804DEC0D13A5CDF1C1FCF37012DD6FF02E0E11B2712E56F7",
        "CD_2CEA3682CC09E7F94D9FBC1BBA63FC6DB39872E53B9187129DFF772A12215DD5.1836.1449033494.444",
        "CD_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D.2744.1115302219.656",
        "R_CDD18BD6BAC64C13F4B1B0FB17B7D75DF1366B89CD0EC7AF6BCCB323B247B082.1147.2096603149.536",
        "CR_19C500FDB2411645397763142D9A3522EA74E9619B1C45A89DC1DCDB49E04CDD",
        "CD_F0EF832F7E32814D7777DD11888257DC22CAE482B915B9B0977CF796309CDC79.1836.264942133.332",
        "IL_8E5E113F407E760B5B6024C60D7EFAD89D7B8A04204C71AED6C00713A07553A7.2726.3623949685.285",
        "CD_3FF4ADBFE846023B8A5412007D4350B3CC0DA66B9B5ACC61FC6D1F4DFFE32951.2388.1384604793.3667",
        "CD_4BBA71B8B969B6626A0E7F60779736282C60AEC40553354F5884C7B9E51AF36A.17.1896102235.288",
        "CD_E0EEAE849B77FB536D0FAE8399101840388F63D0FA098869692C2222770FB614.2653.306806056.262",
        "CD_30544E69098FEB7B3DBD10E5E79FA9F73E13B4CE82E27F9768299AB561F3C59F.305.2437489311.1019",
        "CD_C76A2357C563F8327629F6520FC6E0C137736C8DB9CC9339D6CB051EC3BF777F.66.4268918038.252",
        "CD_3C22EE36FF380B4D0BD35CEC3718A5763A272DCD4163EFF8590784BADF9E36CF.2284.547567875.1378",
        "CD_A646895EAC509EB3B2094674B90663C9DFA1CACB6E96F7A0CFC675420DC35FF7.264.4083071536.627",
        "C_F3B6C9CF81B87870F765FA553DDC4C6E7DCF74DC71874D055E1623595FEAD0A7",
        "CD_C089BE570AD24F592E44F1AB17521DCC9203176DB1FE73F89D8F1D13C2998CF4.29.3961409435.1924",
        "R_23DDB252CC4D2FD4A1F4DD3D5C1D39DC829D566848D6F27132AE759E1E502D48",
        "CR_85D86CD958DA6FAD92EA55F1468078F0400F29C2B1A327B27C870BF7829AB8FB",
        "3F85E4F05948A22C8B9B138E770DF765F9B0B2561A71FAB",
        "C_48639F22C84BFCDA5B7656A21504677ED77A6D8810250F31ACE17701DB0416EB",
        "object:MSNdis_NetworkDirectAdapterInfo",
        "CD_36D4896E467DE39097850E65446D5E83BB401EDA6D0F2AEAC5EC836BC1B7F0F9.2637.3672444921.1001",
        "CR_707EE99B189F38B22A202668F97D1506AB3E7D7110120E38ADE31DBAE193C07E",
        "I_57EDD7478A1EC2FDEE97D13FF6668B714DC1AC17DE87F0CA3A1167D91838013C.2735.3579027665.274",
        "R_DD65DCCCF94B294A159B1976955652736468E9C2375F9198A05555F7A9DD6CB9.2466.2959430166.554",
        "IL_925137A2B897F7FF7AAAAEDE4D33BD8EE6B170C57D85E3C0CCA785169A34F8C1.2724.643111608.287",
        "CD_0685F0E7DE4E9ADE69B83CB6CC4B69291D69C22AD0E71A095A2E4AEBC8EC8B85.143.1865389416.1395",
        "I_BC924067C3E1B3909A3F48E989D12366F2431FCABD30DE7CB3142DFAFC8754F8.2717.807539801.287",
        "CD_06FC0AE99192039AD3DBC9A60D9D3329CE5644911B9200854CEAD799C76E19C9.2756.4245754193.317",
        "IL_75E052968B77CE674E5707D73917DCC54A57D06B4EC6BB0C76F03D980241B325.2693.3924284008.268",
        "CD_B4C1D5CA2F445738E1D1E9A535B6C314D6AD1127F6B87994EA756B275A939A08.2559.2814611708.682",
        "ref:RSOP_IEAKPolicySetting",
        "ClassVersion",
        "C_73D24DCA2A6CC59ABEA47FD1392F5F97FE83683983A1A509120D038B5A332AAD",
        "CD_DEF6358C5F0DB3A8C212B6EB5152B0DBA8FDCC511B86D1F1B5A68B1427787DDC.1189.2199422935.238",
        "ProcessorStatus",
        "CD_9E824F6E13B5FC1DD52C0D8CBEEE39BA48EBDD8253035A9F85F9EE08399887E5.2635.3644220368.268",
        "CD_E28AA1D8B52A95E7D7669D7E7E560FC2B4623233BBA77035C999EFF1330E4AEA.2611.2354728768.320",
        "R_6207FC985B813296446B1804CB375DB5F534F2ECBDB07E00035AFBECB15FD3A9",
        "CD_CF7E5037F6563CE949872FEF4BA72C8CE3F9C68DD9A3E9BD325E8B9ECC946118.1734.3897513760.475",
        "CD_C8C9B465F9F30A2A1BEB0281C9AB6A7FA52E9AEBFCD84E87083549340BEA987E.80.1487039238.699",
        "CR_36FFCD7C103F4CB151534CDC404DD1E71C91E39EA5D1DCB2E130739044899EBB",
        "CD_4CA056ECD90B64BBABE15360B8C9B299FCBE735F03E37CAC28415171B65F6E4A.2731.794619891.454",
        "CD_EC31DBAC8296A2F597184183FC259C7595AD4BCCFF23FB0BD832DE414BDE578A.40.592058408.553",
        "I_2167A8504603DC514C99AD225AB5C2449107CAFBCB6E98C789F49218AFE2F965.2701.2730031560.286",
        "CD_0887FC386FA8BA2C2DB0458AF0A1764BEC13D490407167F361F1F0B4090E71B4.1070.3435841532.356",
        "CD_F4AD89F24C5E59F704DEBE5DF4920F1D71930B871988589A8D9D698640C4E7BA.202.2821775645.7059",
        "CD_596EF184AF75145FD253B916034B629E5E36C13CEB7B67258E544A06633F43E1.276.2716764515.400",
        "!$'*-0369<?BEHKNQTWZ]`cfilor",
        "IL_48A149224EB1E1FC2BB5A39F13145CDD64322D3CF176AF9A0974FEEF94413F0D.2723.1024711909.274",
        "R_85D86CD958DA6FAD92EA55F1468078F0400F29C2B1A327B27C870BF7829AB8FB",
        "I_B914AE6481C0B1CC51CCE33DF86A64969A0B4A7510F6F35CCDFECF2B06D09350.2716.3872195865.284",
        "I_DC48548AD292F286EE816940E45BC5B0725DD008BCACDB78AFDBAAF1FAF6D5C0.2721.110231648.278",
        "MMCSSEvent",
        "CD_B66074B0831FA2823CF6B697A61A3423369B606CDCAF1C630A34F2E146F8EC8E.282.2986356400.750",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1355.1261870644.180",
        "CD_56D8A63CA95E0F8506AA7DC81F76BFBF31CC0706D19B7EC4CB60FC3074D6BC87.2541.4274170768.524",
        "R_F2E343E65489C46FCADC0B994106A0353C51A8AA63B0EDC626BCDD45CD534EA5.1479.1296475600.572",
        "C_DC8E72CA352CA269E6DDEE517B876BA7FAA771BCBCF1AFC1EF4BDE4F8BD8E504",
        "IR_EBF6936E6C9BCA72F0513569683DC50AAF6985750D21624859069228CB4387EA",
        "CR_2B83AA8F75CFC714C0F50F640CCF8FA5668E9F3C1EC370E4CB154F1F7A1D7265",
        "MSFT_Printer",
        "CD_15AA9E5C08C912088DB12148021E6F808EE6412DBA54846E39AFBD33E4BDE769.2758.4215773898.362",
        "C_5378B299266A56152DC649F543170D9E07DF4C60543C8B9C2F666A461A2F0442",
        "R_3F82EE31D83B18D246D7774830C1021C0BC36D39A20BC99C61EDEE13101B1C56.1334.4121792424.538",
        "C_6FFBA8B5854E9C5C5C698A9277971D04E447B67166A26CB7D9DD0D9F278C2D8B",
        "CD_4BD0F8A6C8D9EC0678D50228DC3CB44B9F26CFF9B291F8B882B0AD7C252B23A9.42.3154021213.219",
        "C_1792F692B1B901CE5F142D9BC7B1C3E488E25543B8B8E05EAF3F3EDFDAFC9B5C",
        "I_FD2C5547FFE1F8AE5543C4178384019AC9604DE68E2D71F4D4CAD1DB441347D3.2664.318208373.283",
        "IL_336D9D1CB371782D5EA557B5BD4674C6EC73652F6BDE91FBA1DD6910F1449D93.2684.3891439813.261",
        "Sensor type code of the sensor that generated the event",
        "CR_FAB579260306CF6BFF8AA42E9AAC8900DD8AC191A796F9430DC39085EEC7005A",
        "IL_4BEF46BD8AF1424B994565A4F30353F70D9AAA5FA171745944447722281AE60C.2719.2281240530.280",
        "CD_9D4D42EF4D46EC567E6840F10CFA556BDE7CBE6C48D995FDA290957FB3CB6CCF.2425.2234087328.360",
        "CR_901AC56EC8F00C00FBAC686F0B7E1614E207CC1998593D930358F2BBE88093FF",
        "HLPTX\\`",
        "C_7791A711A5B5A7519657E417C7257B17DC36A8205BDFFFE1C1C88B07496AA0E5",
        "Event Data Field 2",
        "IL_562C4F9A0D39409F54FB42B6863A5644312498E663250515AF07C434FE2D1D39.2697.3999877960.276",
        " $(,048<@DHLP",
        "CD_9FAFCCC688F5A73C3B168A2E3CFB29D7012E555844D21034E40221A532E99A1D.223.1.207422",
        "BaseAddress",
        "I_1995796D46FBBADF683F188A8F5B6786F1CAF6B7267EB99233EACBA15CA2FEFE.2694.580754448.279",
        "CD_44176E2582D203C4E24AFCA28B3D2E229104AC44AFAB0DE90ED2E93CD38781CD.276.1213186376.139",
        "CD_BC1364958E3C7F9CA5ABA0C9A15549E0C0B0F96B96EE058473CACD93E1EABD27.1977.210729100.603",
        "CR_10733E6D3C722406D792B3FE235AEEB733EA7659B833A33F18A708085238B2B0",
        "IL_8CF241F803CB0862FF2769516928293955BEF82DBEAA565EFB3532A22F8FC545.2698.1999019845.262",
        "CD_EE95DA75DAF58996DD64AF173044F543D1582822947D33302AD4D1498AE0C965.2145.1.35209",
        "I_EA5166D043906337C6AAA3F803574238733C1C80B083B34F0CD3FC0F90EA07B3.2729.540325973.289",
        "CD_57AD49AAA93A9DB4C747A5522BD17E886017CE9B2B40450392A8012CE5FE8334.2739.1242909701.341",
        "folderItem",
        "I_DCE59F6C7C63334E18A306990C7E3F40935D3C3094BA39D0D325874C32868A3C.2676.2443650219.280",
        "CD_1D8AF94E43CAA7DC78EEB167F2FCA41288361566745343E55E2730385A1CC51D.2422.3477041077.370",
        "CD_8BF7316094E8A80DC0D7725F4A2CC6D98B4E58683C02D8C287671872E3109F47.1808.209458957.308",
        "CR_133926115907D1CAA329A707F5DA6057F1FEF2436D8F8041CFE6E68664D6F252",
        "Win32_SecuritySettingOfObject",
        "CD_E4786A08CF3335E88102AE00434A382BEF190C917949773F1CE0DBCB609258D9.1202.2600958015.5317",
        "CD_CB8902267994B97206E0B7D2D48E5A733ABE6C5272CD230F09306A7AC1595890.123.3111666134.324",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSNETWORKADAPTERSETTING_Prov\"",
        "CD_1DC5050B83682C310993D0E23C7DB3EBF7DFCB3434893B4CCE67A03B9E83366B.1781.3945260413.6194",
        "CD_8DE46DD6446B26621A23E11758AE5CBC62C9F72998CAFB08B9CD58DF66902A20.1149.2006706579.422",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2116.87553775.180",
        "R_DB5473922EBFCD451C7BFFCF4F8736492AD527572D7AA8C2CC86D89880674085.1932.85014363.520",
        "R_FC7D3378D1DC67F512BCF3EFB19471A307C46119DC62738B7B6512B57CDA306A.1197.4284827137.560",
        "lGPO\"",
        "CR_CFA7490FC441CDBFE3AC487F4E7E6794E550150460C43DF35BA636FBEF5C66C5",
        "C_85FAFD283C1CBD7F1505470DCB5AE71CB038E283B72DF215B58C5421DD9F4046",
        "CD_5004C352A375179C0A302A2B62DC334A1826F55A19CBE1D52AE237EFD9FA481C.2423.1623245339.374",
        "IL_94837FE507FD3B20A1DD984F030C2757F59BCE309D22B5FB4CCFFB1555BCB45F.2694.653034401.258",
        "CR_BA2C021F642EFC72B5ED5FC31813540F5BA649D97F9C2021662B9F43F49C356E",
        "C_E92F7F6859DA3540BD4772DC997C69CDE333458F416E1FC00383C239893539BD",
        "Msft_CliAlias.FriendlyName=\"RDNIC\"",
        "C_8F783D220B8A0BD04FC50E7EA1E40E37A1439DBF5972B30B3D51392105E018F5",
        "CD_216DB76437F8B84D04CA1AE8D4A960CE5436A185FD2383065B11CC5178009ADF.277.1507847214.371",
        "CD_F62E0666212AC3F3422A2CD244B01C66D5C5B4C6B82C02CAED0A73F78C5069FA.1093.3181117109.657",
        "CD_1CFBA5075C2575EA7735C1AEBF0DCDE2BBE1A5063C546AD01C618D77E2D7C06E.36.3119398456.245",
        "CD_355DB6CE31803BDDBDD2FF491BD2AAE24F28E7ADF16402B3F3B9C4CF695702EB.1090.1961428093.1126",
        "CR_73859BDECC6E59555AB103C0DF5302F8942C19E249A9E48DB616B611E1AA3893",
        "CD_7D654D806B89248A9B6887EAC11F1807114D49A174CE2C32046A0DDE6243209C.1599.3572569743.899",
        "IL_5EB07D2314046EF10B949E19E6473ABDC641AC1157736FE12C9A9521B49E4FE2.2688.1210369147.263",
        "Force option required",
        "C_3BCF4C02D0A41EB523B8FF2DA4C32F97E022499682A6B17DB192BED984F9E902",
        "CI_2432A5ABBE7173FA98223D70B4EDFB312E0AA87F456103A25E4B4191AB55FA02",
        "CD_4922BF9FCF270243FFD4F9D426E064C4BF15B5F3EDE04C2DF03239BF6E262DE2.1040.1.70491",
        "CD_53C9505D2D8D5E4C029EC4B036D21F227EB8A3A950C13155EEE4FD0AF03B4451.1129.4147830401.849",
        "CD_4BD0F8A6C8D9EC0678D50228DC3CB44B9F26CFF9B291F8B882B0AD7C252B23A9.158.2332006738.198",
        "object:ProcessorAcpiCst",
        "I_FB445B81C0C6D297780B021A8A2FFDCA5D4B3CFC4F9A65422D04EB9A41F45A20.2687.2741445532.264",
        "C_5F6A26DF07A5DA70632EF719A83E3D129886AB8FE61A12C90B97B5CED67CAA50",
        "The security settings of the share",
        "I_6A45106079E6F226EAB7745F737D012FE89627A4DE0B29EA2DB4253105999FDE.2709.1124548777.298",
        "CD_FAE2ECC09FED2EB4B7A4EC8980CE634E75CF805CEDF86064A82170B68F9B5074.2154.2989287663.1710",
        "FwpkclntTraceProvider",
        "C_A646895EAC509EB3B2094674B90663C9DFA1CACB6E96F7A0CFC675420DC35FF7",
        "Delta Replica Target",
        "C_D13827DA0ED443FFD82DBB415FC1698F7DC60C2E8774ABDA878946AA14F41C91",
        "CD_488B67E05BD8C144F890DD1628D2D632822D5CE3B99BFDA24BA6CC55C387B3C4.30.1560784502.718",
        "C_FE8C3873BDAD1853EA9CE4F9A8CC51817A3AA40D4095EE7168936C23511B49CF",
        "CD_5594A51ADFFCCA3EC367A4CE2DFCF20E3EBFDE91FB6ADD84404CCEBF1B0FF2E1.2652.665193333.646",
        "C_EB5DF692E5695761F8BB75E5CAB5C2E64C9D570F7A2AE8F24E9823A6FAB0CA95",
        "C_F9D38D348FC17C2197F17E4023229520C6A842B2796EB1118A92108A9751F1D0",
        "I_4680976D74568AAE04FB2D5BBCD585E7393EEA815176A5E2B34B0927C0600509.2691.4247015367.267",
        "C_9FC6DCD975DB936A96BDA112F630B5077DFAC45847E4C4ADA37D138916DD09C7",
        "C_12A251E4688047981D607B15F79436DB837E075ADA0B6AC78025F676ADBF2AD7",
        "Local Replica Source or Target",
        "IL_D0A9E3D19612BAC18B00E1B087870AA5A89611AE0FF7ADB6E3776B1E505C26AE.1015.2403639777.314",
        "CD_2442933444240B68F1B8232208304D509D6ECF5830E4F4F8E4EDD13186DE1B28.38.1710327355.1251",
        "CR_5E9AFB2824E4C09259A80739D70D94E550D572E8A9E41593DAFDA14D65369AE4",
        "I_2443123D93EE5A3B000A2E3E2B1C5A3E9397ADE0764C1EB9B2E8ADFB8AD23D17.2712.744782486.293",
        "The Microsoft Defender Antivirus WDO Scan Class",
        "075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "I_7BA978978EBF3CD1200A10044AC0BD6F4758993016B7F6B6A538255F2BFBBE7A.1714.3603523673.277",
        "I_9FAA8D02B91A759FF677BC63F05CB2AFDCA81703746EDFE0BFAA56AE8647B3AD.2724.2768712682.283",
        "HasCertificate",
        "I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D.2749.3276073663.255",
        "CR_37D6265F83F0B4A807334DDDEAC8A1C96BFA3B726A45400FF628A9564B8A2E7A",
        "CD_AC08CDDB7433769D37C6A6528B8CE57C28FD33ED152F2651E59B9F045070D6C8.2151.2980430834.610",
        "CD_85BCCA784055D328056C1C24739AD97E319F99340CA068ADB03810455562DCFF.2640.1567872391.927",
        "PoolTrace",
        "Reference to the dial-up connection settings.",
        "CD_EA2F4ED6B8AA0BEEE14A7235028BAD0C1DDD97703732E8317B8FE1581E43A3CF.36.4016821109.632",
        "C_BC8304297DAEA08EF836B71DA253942E5C6B510805DB5280CDD11086EF113EFB",
        "I_F82E49DA5F8363B8E92178CDD962839B4338D3C758210E6DAA9D9AE4D125FA8D.2696.1255515438.278",
        "IL_1CAB6CD0CA026391202802389688F029EA197A09B6936787961334A89D4FB25A.2714.1260187424.277",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.2236362174.368",
        "RSOP_PolmkrNtServiceSetting",
        "CD_FAADE44B531DE024B0353D8C1E63935B3A7FF9CC1113545A747C5176FA0E7352.293.1699918151.205",
        "R_094555A29C724CB99AD80F8257BA7ACBF3FB68F96D97E3E687892E1586B8D179",
        "CD_9AAF3BC6AD36F8829CC6FBD50259D024EA00D998ADB66289BB6A5295426711D6.2761.4099952461.1809",
        "I_FC15237E3EE5D15D1A7FBD1AA39C0F99DE3DF457225294AED82A7FD447F88BA8.2715.4138342168.279",
        "CD_5D8A70064F693F027290F7573CE6C1A3BB6513B39CC41447AC81334C5DC5B8F9.139.3464097879.3509",
        "I_97E92C3F71297B1EB2782D24AE0369226083C76FAF4378DC734B43C15D8FEF6C.2687.40764424.275",
        "CD_231C34EACA6E9E68FABB7AA3DADD079A379826158D2123254977F7CD79559E18.1060.2096994539.675",
        "I_E45C027B16EAF2DF15CD7F551E5D76AB67032F42F3B3C9F37B53C66F456F15A2.2703.3738519472.291",
        "IL_360885C5E46B70800B6EAE78F3641423F332D4218615BE5AFD9061C882DE9F38.2718.2823291432.270",
        "C_C7FBAD005972F7843A0300A01B4152A8540EBC9591F80D03685C4491BC0F4E13",
        "CD_AF073815367B438138F1E5B4B3B3699ACF3DE3D6AC4291FED26D085AC83489E2.2606.2527427352.195",
        "I_41FE5FF45E777EAF90EFDE49FCDA387F57132F9D7F0A754AC7DE115CDEE0227F.2730.508520424.279",
        "IL_B6D3F825E820BC5144FD63DDE116DC93607063EC3EA54E3AF98BEF3D763EADB1.2696.4187176743.283",
        "I_60155E7D43FA190B76DCF5E57C2AAB745B6D4E34248AFC988DBC5F55FF8C5124.2709.3872195848.294",
        "IL_978BA29293E78530769780611F7221DB2CD2912B8EF2B7783CB3594CFD3E9506.2683.2338201688.279",
        "I_3D96CF7EBAA8465EF07F9D6626CAAC510A9695CFEEB1774A41007A63C1CC4509.2682.777595413.288",
        "CD_A4EB4EC52D8DA9648AD8CEB515F7B48D8AD3CB4BAA5E5FDD062CC77087B6C136.2658.4206986522.281",
        "CD_044C6F3044E48C22993C2C07FFE6E4308713F44D28305AEAA2DE9289AE1E867E.2555.3021878382.523",
        "I_466F1E826D19323DB7FFE80040B5ADD211A417F90EF997C2716C16E499FAECE7.2695.3985898832.273",
        "I_54D90EBF2630D0BC11C6B6DBE98653E97CA23BD481DBF30E14637141C7BBD987.2725.4011659211.284",
        "C_E71494930AC32E2C68006820D0A4C9D92CA2B3E5E2EBF055BAEDFDE6EE348455",
        "!$'f]*S-036c9=AYEIi",
        "Allow",
        "I_8CFC2CAF33B810DF7092F61D5C127074ECB267DFDB661C78F41EBF2E18D8670C.2724.1566859869.279",
        "IL_808149E7750A151FD7D49B0C0AFB094E68745E543DF52A3CC5BBCC1AB8B6D1E7.2686.3772337448.283",
        "C_4FA45B282A1D3B86520D426489066CF088D4054B5887E8BDB7A6C026C3B8CE60",
        "MaxPartitionCount",
        "C_B0F8BF006A881EDD5F1AB7C6C5C658BE31F57C66C14090343C8399CE5BC043A8",
        "CD_2A82469DE4EDED369FA467BEF3E6440FE893BBC1F56ED2AB23AD8D2515E35AC8.39.3633314286.1042",
        "CR_8F21C89CAF771FFCC47E28C59A7D76DBF0F63931FC16518B322428129F505FDF",
        "IL_C6FB0B64E322669245193F1A21E2E91C5D29169A465DB01989DF56A2F069FA5E.2688.590336605.272",
        "CR_6A87D660F0F6A66279CF024432941A2BC16A9043D5A3CF26ADC36D1DFFEBF2B9",
        "C_BA11A442C4B6BACB0B77A87AAEC21B7292F7F1A01CCD5A6A6D27CE9E1D19DF7A",
        "CD_193A1F93E9A6CD7A4161C999356A3002DCBF3CA9FF51ADA6126191BC996D2103.2623.2154352180.653",
        "I_2A8E85BB31065B3FC60BA81CED6A654079AE6D371D42FEE2259112FC3A521E06.290.3903742088.330",
        "I_4F0BC1994D1136D3357DCDA5A9CF33694FD285B2867DFD0EE5E8A215737DADF7.1479.3234706888.193",
        "CI_7982F1017538FCA639874841D68FAD4E24866671A5CDE2C6CB4C169C859203D9",
        "CESSORWMI]",
        "IL_F39BE2F2CC7551BDE90E624B5C7301C158A68D618B887A135B21C9CB3CEFD863.138.843589863.260",
        "CD_6EDB414A272FF229BB33606CCC694211C55817ABAE713A5736D1E4CA0295AB08.2426.972945746.356",
        "R_7F637DAE12A5C57B84338EBF2100C5D2953335CDC28294203995748012501B4E",
        "CD_9D477AC3DF7741E8993375CB7B6EC3870626780031363A4F5096C4CACA7F4F5E.7.3168286766.374",
        "IL_65940DC6219C0A2A56E49507886828639D862B915C2E790ECF4494E290735A03.2714.917675366.290",
        "GNU Hurd",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1758.2637058705.368",
        "C_68708B0D28964CD8F016516FC22BA5B964B21C85D4D8AED50B2A4BBA811EE32C",
        "C_3DBA7E264DDA7F8A7A309588967A7B5C3508359FF35613C96FF730C82E46EDC2",
        "CD_846C560B82577D9FF88EE61507FEFE652D765E2149E65AD69717E4D9BBA459B8.1266.1826044257.992",
        "CR_D7E5160C539A0B6F0E4DAC59284A5E27B97E67D93CF88E4C35B4F0FB64E90C36",
        "IL_0CD345CD328C12E181201A1AF5FC238E8C7063787A2C0D3BB8A0184594786F96.2721.1704865656.279",
        "CD_DF9F2FC6FD92145061FBD996E3F615861A2861FB55A5CEE4F16822FB71A07AF1.2523.816536859.406",
        "CD_8266AF202DDED4D8ACC1F156FF4A630B98F3A46071CCA388BE5FB0D13AB20A5A.1599.4005627205.651",
        "C_B37806D65A12F54B08313C4EED9D2CA81EB0583A9508D49E36A1323121A772F5",
        "C_5C90AD83ADE4C22FE8FF44C299AD3236C77C12C54C212C5C5502E0B121FDD0A8",
        "IL_4BD704EFD82E90D58D3C406978C7C044F013A64518E8C54785195D2358D9CFAE.1806.2760646680.425",
        "OtherAuthenticationMethod",
        "CD_197AC7D184C8FB7AE4353D80B67A53A62AFB8962E788E6E6756C5B11036C7B44.2334.1716285225.1021",
        "R_41D84F93E168026991704896B6AB8BD6B7DB82CBC17BBAA1442A047D10A853E1",
        "CD_EA6D636347E78DD7F5DE266FFACD22FFC73A50A7A4638C0F1C2AE320AE6BA10C.1194.148492858.616",
        "R_DC75EB8D61AF59F2FEB9BAFCC51C26F93B19442C9F5E9F7C071B8627E9152155",
        "R_87FC3FB8BB46E54395D1465C589976A9AA29C410A5423CB9E87537B93EB847AD",
        "R_62D05C4ECF40774F04063E6FDE0B1A6CE4B671271358A09E1596B6EBA1E2DD4A",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2167.898719816.180",
        "CD_83DE1B746C28092F6432A88AA76D0759ECF002B2851A36CEC64C72AE248F616D.2537.1770082250.500",
        "R_B837FF0F19509FD7BD0B7ED8ED2B62529F924B69EF7322F8463864ECBCB01E5E",
        "CD_3447964AD4B51A40682639E2C45B8A122022C3FEC3E3B3FE7276444680D9A4BB.2038.2381060688.238",
        "CD_B3F4A5E799165E5BA2CB97AE575C11DCA4F6D7931E6C7C903A686A45D038C618.2614.459268989.377",
        "Name]",
        "C_9288F1883D88E26CE36C018E5C8D526DCB0F72E9D8B2A41E65BBC15B92D92821",
        "IL_DF1D72ECC9268213FCB43A06A38DBF2A7452DFF83D9A2AF1D89F3CECA76D4AF1.11.3930159484.246",
        "IL_B498B69E308CCD72907DFE63279C92042927888BB64E0D473D3C48463EEABEA9.1074.2136562927.301",
        "Validation bits to indicate the validity of the subsequent fields",
        "CR_3A1D2B9036996AE4681DD029594209329760282E8301045223F1DC6AF85114EF",
        "CD_5FEC17D2A692E21EEC8DB94637D5BF52B054EFD1DC032078BF1B5DD5BA812C6F.277.1190344461.376",
        "I_25F47D71265847CFE558B579C83F67890E8183744685A4BE4B2FE5DE135F5117.2723.1288667172.275",
        "CD_87CE846EC002DBA12914102AFF6ED89E0F6DD6CA407A1F7C8C0CBFF801124A9B.2745.1175156545.301",
        "I_F89271732C858BDBAE016F666248FF8D12FD9E283E03A2F4AAD8525E1356EE34.2678.1663028984.281",
        "CD_E5D4D776B7B585D555547688115A6F8AC1380E1C8D52767A06A9776972F7BC0E.310.3693403664.2297",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.293.3263075446.368",
        "I_41CD80BFBD3EF2A72B1311F93D87AFDE77273A97897B7B012F0BFA851DE8E60A.154.2607592767.297",
        "CD_831AA66AA33E94794A3BE28998D5135FCA9FB48FF5649C034A00E2F57ED4C256.2667.2442880671.118",
        "C_3FDA482EEA11D105F777BB4C0E86194FDFA63901845D94A245BC2172A88E5638",
        "CD_D5312D2CB1C1201CA5C65DFF999460FF4879179CFEF4C66A96B6BFBDF88AAF0B.2758.1058927793.337",
        "I_AE91F29EF550201BD116F39FD4660111D2D7567B1B027758CC9F7782A63B92BA.1015.4065632248.299",
        "CD_AE1E409B63FFA5CA9526C32D0BC23BBDDF2BD385B696CA68BF7BE5AF59847B4C.1561.1443536116.423",
        "IL_2BC2AD40DC0B25F52BCA8C62620E36AE11AB018F067148F71F4DAEA21CC32361.2689.2177199401.265",
        "CD_53DCE9419CDBBAC59B50863124DFEDC7E011A4B01B39B0C102140C30194270E0.2642.2124087098.553",
        "IL_EFE41996B6528DA71C5D9F71F47A3F33107E49205F01C1A05CFF6C62B645E7F7.2698.354292778.271",
        "R_20EDCE2D529E2E6BCE41DEE4170C3E9E6D3DEAF61091F14E5541886CD554DE30",
        "C_77A58C176298EAEDD16295F07B3FAAB9E2EC89D31A3D4C3CEC3E4EFC8377E9CA",
        "N - The minor version (in numeric form). ",
        "ScriptFilename",
        "17FB898D6D0191CAAF3F4DD71444D2EA05FC34F19E3A2898C8.2652.988530805.254",
        "C_63879166E36DD9652B2DA0F13B468273E5FE81CA1F80A337E45AE51370AD3FBA",
        "I_AF15677D860D9794D335112F0E9678DFDEC13579C5E4184FC4C1D282E060AC8C.2426.2865042132.198",
        "C_000C7A4E24A831A8B57321EC87550EE50B20B429272C7ADD8CFEBC5632299194",
        "CD_BA7526B37D90714D7B62CC8C0306D68C0FA9CA2FF62FAB9215A612E133C74CD5.1649.3416858697.2266",
        "I_19F19EBDE3623ACE5D56C39A41365A30232EF811B7476015E216C83EE09FF62E.2695.2399593920.273",
        "IL_524D8014A2F8B82E7E182DFCFB31165E09D82EBD11E7B9899B8F3E970A2BBC60.2710.4141668719.287",
        "I_ABA4DAE0EB695E77576BF3A7EA335DDC9FEB1F629AFAAC7C7FAA67E875E659E4.2724.2583323054.288",
        "CD_D853AB6209D8A11783FB9991FAFED1455C3BE9CAE115768B2C2CE0E0FB306714.140.406840374.2016",
        "Time To Clean Drive",
        "CD_5120F8DED242719988A9B53EE954218632D3A896BD93867D072F4224AC3F8FBA.144.2613022002.717",
        "CD_2E4619832D87866ADCA097DAEB4AD1F340C2EEE23DC720838DA96CCF55B2CA54.198.1648906250.1101",
        "IL_E313BA094E9A73CB5C908E8526F6C018354DBF29EF0C9AD7F6882E010ABCF531.2697.1950607599.283",
        "IL_BF593FDA4BA33F9ED167DAD655EB0DCA41D164E127B57BF7155EB8BC36FD4AEB.398.1.150684",
        "CD_3B2DEB628DABE7D4AFE58BCCA12E2FE850BD8110A3238C161DF85D5C51FAC297.2667.1971839218.233",
        "CD_CE2D741F2F76D8B2DEF2CE5F7AFEC89E6175D7B4F954957AFC4C2CCF01EA7DB4.1538.1312213933.391",
        "MMCSS_TypeGroup",
        "C_810BF28A7C26F6878E189604887AB1090DF3478356CCB47422DB03C98B71BD38",
        "C_AAEDA1FD61325BC0D86B140D66A91281FE871D9B4FBF60BD8537F2A662C67E1B",
        "C_65E8E46531523AFACBCA9F72515F99ABBC1E45654E781033384C13AD4219C6E3",
        "I_AA80F0C23FBEF67AEE8147F7B242D90F12EF5EF056EFD5BC7D7634A1E90D2AD8.2709.3629589333.298",
        "C_7D6C83B23F09AE427F0F210CAC35450338EA73FBCC7D3A2335FBB72CF5113C2A",
        "CR_F9C9BF1D438816A18A92B3E8522F73D7F60F0DD6F678D67DAD4AE3DD5EBC727E",
        "CR_B8B4905F90700DF9ED4B891C0012569544A0582CBC77B58905D3AC53EF089A50",
        "IL_74B55E6F9F6C41FD46CB45A5E24EA7BB337888BBB65724CC1519C36DDCAEC15A.2691.3761107364.259",
        "CR_488B67E05BD8C144F890DD1628D2D632822D5CE3B99BFDA24BA6CC55C387B3C4",
        "CD_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416.291.3037945618.616",
        "L|\\TxPd",
        "CR_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937",
        "C_D4EE14E9B8DC621A0E06EC7E7B7FF7A062EBF6FD9A03F97DD9FA99C22506F07E",
        "C_85629F8188EA39A73B996B8807A12AC606DFF36E46B01D25C3DE26A6E97E2C56",
        "IL_876030205185E73325510A86538AC5681B346421B7CE9798544621F4C31CB308.2726.685659278.279",
        "CD_A435E1CD6D36EB19C6DA0BA1C7E62224942A59031964EC981FF17A68812E1011.1222.844616146.326",
        "CR_79CE5C3FFCFDB2E387AFB15F738C96DF562D23EEC0B9CE854EFF2796A5403198",
        "KI_A2F0F731789B8BD6294886FFBA95B74CEA7B86072988F101ACF53FD6E840B35A",
        "nelbase.dll.mui[MofResourceName]",
        "IL_0E9849D44E8A92F007CC7648B79CBD989C2CF28FF06279CDB1EDDE6F58A57E3C.2721.3435331300.281",
        "C_76B6B178A02236EDB6A8F36A0CE71BC97D59F8FEDFEABD15CAA3569E6D4DFE0E",
        "CD_1049D5E6018CB5BAEEEFD8D443D433D445F89F6711D57A1BCF5F2CDBFE578ED8.1352.961435306.1955",
        "CR_A2D35C5C5ED7C049EF3C2376FA4E7B1FAE108AF8E6C6E786BA37F66F3B83AE4D",
        "I_0FE84CB7228184819434E73184A33B5694CEFAED93B282C50B930127F187504C.2434.2312830320.287",
        "IL_A30FC1F5DC72C77B62FBA6AA763CDA99FAB2150F57E392AD56DB55CCB8C7A0F1.2725.3192501927.277",
        "CD_34D27244C1F99E829B51167C8BDF2F0DB27B59978C3CF277F9D1CBA753030BF3.2568.1147201038.1007",
        "IL_C823434F58D39F84FCEC4968C5989AB0E3FFDD4C4BC71708F6CE48516EDE1644.2712.2483974247.292",
        "IL_F5C662EAE9A620A1D133F40BC3C0372E943189A09967E87D330334B2F916ACBD.2697.124149596.270",
        "CD_A17354395E79A088E63A18457CAA51A441A886387058324A6BE95873BE2C4E38.1998.3000079254.649",
        "I_8AD2C3841741429DE3C06C6390BC0586472D4410DF073F6209738B3E27E69D1C.2679.1199244044.283",
        "C_7D462EA5E87CA015476942A58BACB3893636973868980DA68AC5EC3B5A1C690A",
        "CR_D9A10218F30FA4E428551F3E416442A7D38AB8762B28D40A8E89B4D3006D1DA2",
        "CD_988CC64B9858C06D7E29C18EDBED8CE13CF165862E4E03964EAC303F3A8E79F6.1849.264504177.297",
        "CD_10733E6D3C722406D792B3FE235AEEB733EA7659B833A33F18A708085238B2B0.129.863339886.2780",
        "C_1D169410B8B805F1ECD27322AB7A731FC553836A8F92AC0D372B6B972CA98337",
        "I_AD976713564515C89D00D2943EE72DCA758E7457CC3E706223AFC489A6C21922.2717.1007688508.289",
        "{CCBA37FC-982B-433b-8AC2-455E616A8559}",
        "RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl",
        "CD_13C9E4CEE0DB2A141FCA5D32D5944FEDB123223947948622D17B40B794518D0D.2513.39259484.1944",
        "CD_D90316B018BEEB2B1E88D6840D4570916FDF527A1A6CAAC9F2E7E462B55B6534.2539.1225809477.488",
        "IL_D2E45D3626E75100691BE2B74400098FDF837DDED67CE9EEDDE7F125324E2AAB.2676.2477547688.281",
        "C_C089BE570AD24F592E44F1AB17521DCC9203176DB1FE73F89D8F1D13C2998CF4",
        "Image Load",
        "IL_8B68560B534A6D3AF089AA733C222DB25352C8528E5767D325B8757B271F3DD1.2508.3011359751.343",
        "CD_D301EB050FFFFB91F3BF1F6274877F7EFD35FC266AF4AC45A7968B005C4EBA69.2730.4160365341.748",
        "CD_9A0E4B10C24AFAE23D25837341C73AF3317EA35AC13D0352F93F4194616EEDFF.2531.3271625074.82",
        "IR_787A200B25B0F5C6729D1D578C8F78CD412BA6F80EDCC079C80146CB69F7319B",
        "CD_81F5CC7DCEFB1E634599916220181F35C3DB70B94808983CB78C381325F1AAF3.1392.1.175152",
        "CD_2029D50C77548B518321A5119A9BC922C0E0B7DB421A8864B7194AFAB76E0963.2603.4203991118.571",
        "C_20EA07CEE9CA490CA033FB2C117DB216DD2382445258C0099435360113084CE8",
        "I_5DC8A82F00A984AAE8665DAA43DD52D52CEEA49D8887E14BF0BCC39A4C10FFF6.2698.1951472259.264",
        "CD_208AE2247013C3372A171DBD4988D1DBD87A3518363B9A8CB1FE166BE1D06432.1466.3148756612.831",
        "CD_817E7AD084EFE77D83D93F44E314532D39102CC61BC99316DD0EDCC0B95A5A7B.2659.4238655808.979",
        "C_5F2E90A9A61A21E31A81AEB905C87625CB9816F843D7A0D3E82978F41D9AF6B3",
        "I_46525BAD3099F51458A5D518030526DE848A3DE564DD8816A47DE935CCD3FA82.2457.398566487.279",
        "VM/ESA",
        "CD_6F71654DC948E1EB11B435B2742F01766B113983E761ED75069E656F44119002.283.689125788.1438",
        "CR_65BDD6212EF53E137C74914F0E8C6D83526505C01E3A3FBAAA47518944B541DD",
        "WmiMonitorColorCharacteristics",
        "C_E02AB7B49575715400AA81D4F29AC25F671C3F156359A5BF4B3C01A096EB8A80",
        "CD_5C1EBB1EFDECB60A5B91BA9F722DAB3A0E05202BA30E0AD646FC630B197BF855.40.3551136730.403",
        "I_A905E989052353FA9D8F60E873BC56BF35837561C775D74EDFE4D77EF4FED58C.1500.283983751.381",
        "IL_6E14D2561FA1BFB1620E2B19A2DDB814D3F1CA805CC531AAB6D243D461E64EB4.2685.2599420907.281",
        "CD_EF5859518AF699EADFEF83344B1EC83C53B162AAFC3675188AE399275DA07521.2546.3592198136.450",
        "C:\\Windows\\system32\\kernelbase.dll[MofResourceName]",
        "C_0FD7C978CE5F9F156AC49A8595D5B21E685E253948841F43E73ADBAAEE729F87",
        "CD_E78B24A63ACB40A253226DA76298C783683B9FFCFE28CF1078C510D46CEF2248.287.4236143200.396",
        "C_998F3774EFD99EE364D0E26FD868917690CC4AA071C4ABAB4D58906B9D2FAF38",
        "I_DDFAA8472709EE307C5FA9B130CACC65EFE10C5908BDEA18267CA49A5DB0F95F.2724.612875334.279",
        "R_12B44998951A18C05CEB407A59B6802A15C3E6B5204777F28106106376F6FBF8.1197.1441662724.520",
        "CR_2BBDC6530C208169E005CD28108E36BCD72310DD490D1F6D9817675EE3291874",
        "IL_6621D875A4D1A0FDA9A316DABB272E99D910F3403F7E069ABA1A8A8DC068DEBA.1016.2201123094.305",
        "C_2CEA3682CC09E7F94D9FBC1BBA63FC6DB39872E53B9187129DFF772A12215DD5",
        "I_AAB5209D6E5DE824077B832BEE626E4A7526E6409B1EBBED1CDBDB278848FBBE.2714.2319342508.282",
        "C_F9B170C89D56233A8A5661042F3B670A16FB55B73910DD19B9F3814C67D2D427",
        "IL_1877C5CB7F48C52086F19F29C9FF7A95274730D00813E5764E1041E2DE77FC01.2675.2605780115.261",
        "CD_BCFFCC5A22D2740C320A7FDB3EAAC4A750026811E61430ADA48FBA2937496A0E.15.1649108248.1397",
        "CR_ED34D9141DAAA89570F479B7904D4A54BEE568C398745E94687501AFF6347D73",
        "TWZ9K]<?",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2197.3533351326.188",
        "CD_3451F9DD4139B1FBD33D4308F2E5CFA926B897AE835CF84F8952E3D2EE3E6005.2542.3786279949.536",
        "      <rules context=\"User\">",
        "I_3C259524726051D7603A4BD17307563E6BEB326182791CA695BB2B6FEF3A682F.311.293400504.249",
        "CD_94293EF90A7A22C703D24325A49A6EB7D4CD2936D5E4CA05611608ADEC14586C.1926.827264054.1014",
        "I_8D2F058AE4ED0CEA3824A472732D53F547DA724744C9666A10B23982ECD48E86.2684.4259208894.289",
        "IL_80D5B672D4FDEF4948549EA563BCB3471211BC3C8A3B39D04776E37EFA2DE870.2678.1534286831.282",
        "CD_FC7E4729FBD99558A3DD7F878A1DC4A01CF31A2989C5EA7E0C36CF5077F8D7BD.2573.1842417326.804",
        "MSSmBios_SysidUUIDList",
        "I_154B639D792F97524FEAF961CDA64CEB4858CFFB277AD3F35C3C43B7B37F9DF8.2685.2383849509.262",
        "CD_1B21127D666DE7149D38FAE87BB50D5044EE42AA689C0781F72EAFDDA2BF1383.2602.1374640589.2557",
        "CD_F3D2C3C803E42F5C002431583B973181E378451C989945D642E593BB0D9101A2.2531.1854920383.369",
        "C_53C9505D2D8D5E4C029EC4B036D21F227EB8A3A950C13155EEE4FD0AF03B4451",
        "The current second of the current minute (0-59)",
        "CD_5CB6A0A003499DF6531A245112372798390EB984E42ACEC32EC128E82F56ADB5.2746.4248347341.722",
        "CD_78FA9D111B7CF0DEE8224D3C3786A340C11D0822D9189C4C7744F02CD1A1D627.1330.2631037933.1310",
        "Header",
        "IL_D60AF79B9589ED18D416653DADBFA1520AD2BE7E2AAEFAD60E13B3048C5B4F73.1195.1701226726.268",
        "CD_D1EF7C1E0812A2A26C6327F2A3B7DD906B634F362ECF030C8FD523C6163A7423.2642.2751347799.256",
        "CD_BCAAEBA95E435CA5300A680BE9BF735F04A93ECECD18F46C56865C6158D43B74.216.3876783444.2089",
        "I_848E55FD5F4FC523C00864C2E37F5A0ECCC3D19673B52AA68E334B012EECD2F9.1730.684144567.281",
        "CD_10DF5666D33CAB7B9847BCB7DE779D4D05ACC6BB9BE7D314C4C1F73F38A78383.2391.398416554.1380",
        "$~'*-0369",
        "UsedSpace",
        "4162BC8CBC26FE1AC4E7CA717DE3E44BF2C4B173BCCA10F4CBDEF.2710.2445353677.292",
        "IL_6A74CC4F9844DC41C4680A4D057CD66FCD594011ED5CFE5E6EB3D85FDD99E4D6.2712.1835851554.302",
        "IL_E933CB4D8EFFD77961C5320C56284269A85879F173BF61B7E73A46E75A7E7F64.2688.2121592787.271",
        "CD_58E2E57AE3257AAF7BD068A3244169CADFB546C1CB34AF28AA5179754528E358.121.2615233112.661",
        "R_0DBF24518A515720E2ADFC25BEC0135E619157C7551EB33A738576F79BC03C73.2436.4194446420.554",
        "CD_8D031DD0CB1D97D890A5740097E55E48F1625CDB53BFD253DBA62D3E95BCF78C.1521.108368021.922",
        "IL_9C256CE37E6F9177BC0EC95344373747E0112D20D664373933986EE480BE67C9.298.3005903279.338",
        "CD_6C9B6879A26D36FA804084B2409422299600D124FA7251CA869851652B58B90D.1049.2443523029.210",
        "CD_890BCDA7A71C2F5D3AB573AA4BB373800CDBDD716FA1D90996A9ACA074A722A6.2503.3846959726.5143",
        "C_5CC5CF05A7A1041C246328BDD1081AC6C5D60C48F12D405A2F1C3A3CF42897DE",
        "C_10E742B9ECC86ED440568BF61B0442BA9BC3AB32EBAC793C867FE3DDEE6FBA5B",
        "CD_0C79684F32FD7D7088A468F0BE92EA35ACEB9FB4BBDF74F4E887F74EA9111458.1201.3378945855.232",
        "C_062E519DF64095D82428626FCC1CAD3361E295AFA643D5462A0FC5A948BBA34A",
        "CD_E8CE06DB509B0590994561E0942576B49C1468E2ADAE12E9135A0B28175DA679.1152.2615082360.253",
        "CD_F77EA4DCA78917FF5BEAD9815A0440B9CD3C526312D9427341EC66F96C8BAA82.1190.2982746886.244",
        "CD_06F5F6B28C8CF9B7239F51992CED65E9076CB252470411CD4455838A2FF091F7.2542.1989152860.530",
        "CD_E6EBC22951212AA0FD20E4F98E4D28A1040E077B7BD57C8A6ED5195CB15000F1.2482.328891381.1245",
        "I_72C1496F7784128083E72CEC41F798E9FB123597685B971FB9648A3D450D807E.2735.2254848462.278",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1068.2673901424.340",
        "I_74B55E6F9F6C41FD46CB45A5E24EA7BB337888BBB65724CC1519C36DDCAEC15A.2691.3761107364.259",
        "CD_E4EC3642DBAAC119BB7D98363E08333001320E1E613FB7C4977DB452606906F4.1705.1.71522",
        "CD_88057F4853FAFFBCAA324F022CBE7B7579DAEAEA64628A39AFC4B91F61CE7752.1463.653706146.418",
        "C_F8DBCCC9EC3564253249A34557C34EC79D44268E23A36532F093DF4A918D7FBA",
        "CD_4382409C2BA25AB891FE25D9946357B2012609A915D0D018CA8A80D2ABEE1CA0.1616.972010509.258",
        "I_E098463CCEDA2B7BB0AFBA90C9CE4685015E15BA48F56829DB08584C5452610B.2695.2165260353.277",
        "CD_0CBFFE574FB1083943BF455D0289FB753DE3C367B01850F06C12D786A0419EFE.2609.3554024477.4257",
        "CD_349957449457FCB3DC5CC416323F05E6E56083B532266B79EAB7F5AB720C36C1.219.20154152.740",
        "C_91FD3FC418CCFA3F854B7CFFC8C9D234CCEF5C333EE30099C64BF1B8CDFC9468",
        "C_8026A46DAE8D15BDF9E8EF11F43EE077A14B188A857E40F1C5117BE33A9138C3",
        "FacialFeaturesUseEnhancedAntiSpoofing",
        "I_C71EA4E99AF3E77E47D6352CF7D2A252CBF2D9A64C752881757DE215D5C75F50.2683.3585954419.281",
        "C_5A25B87C229EBA73993CBCAA6C98D2ABE024422E1CEED3A8A096904B578EC322",
        "I_BCD0CC9D55D768E78E889337A09A284C84021DF2794ADE4C48598E6DDC097256.2707.4231325818.295",
        "RestrictedSitesZoneAllowCopyPasteViaScript",
        "Event Data Field 3",
        "CD_BE08AD186AFCF3A3FD391638F6ACA602500A13B82D80FEEA8F3E35668C9545E9.1926.3625630527.269",
        "I_94A9308AC80772269CB5A3765C6C4827A9F1D2247705F97DE024F02F61BB669E.2693.1462610338.265",
        "IL_A9C3BEBD1DBF5DF12D9143DC928A9442BE5735B93F335C7F86430C6319E8FA73.2716.3991818438.281",
        "CR_B6BF4F280E8F41D5C682A73285BD377F4F1516D4792C5D8362BF30684045009A",
        "TP_V2_ThreadSet",
        "I_D1B648BE68EC7094B701AE10865E8710BF3CA0727020E467239EE608D1A161DA.691.1.31519",
        "Element Component",
        "CD_ECDF6473AEB5680FD494BFD070A3EC2B36A681EE68A62E383213B3D773EF9B61.32.1882114853.460",
        "Suspend",
        "Is AC Setting",
        "3486718037.956",
        "CD_39937D1A990EDB6E14CA46EA323A9EE91A51DB10D306E4059B3A249A61F356A4.2667.3562804550.242",
        "BitMap",
        "IL_13D5F130BD0D16DA955C40F466B88954326103C38F814171A7C2E77C674795B3.2716.2557549276.294",
        "CD_7F586BA17943C172DA17564383FF9D3B7933EA9BA65A58BF1162084BFFFFF070.2380.1.26596",
        "CR_9D89FA2B309F38D240606161FF6D4D1DD686574B6527CC994C80F23BE2267FCF",
        "C_ECA4BCE942A7519C8BD48784B00775961389BBC39B370F76AE4A3294CBE6E51C",
        "C_41618FAF81D0E53A7763CE9C298451077D86596F7351D97EBBBC77A817526A99",
        "I_853B8DF86013EF9E50A10116D68422B73AC0D9586E4DD5313DA8D6A7948E320C.2716.1901174011.284",
        "IL_5AA238D8067F4EA12DEFEDB4E026F4DA107DFD5E36EDA87F4AFD56D7A92521D9.2689.4128263844.271",
        "Volume Size",
        "C_A0A150CA5213FD3CBDE2DB5507EB556997D615915D27644E5F01AB072F205064",
        "I_EBF6936E6C9BCA72F0513569683DC50AAF6985750D21624859069228CB4387EA.2466.1946828672.363",
        "IL_F2F75FF4B10277F949A9B903139033583DF34DA60B8DA578A7348DD7729D5B05.2698.1634475983.264",
        "R_A2392D279E55559D3F1D33DB8F42981C4F8134A3716602C2005C822A63CFED06",
        "CD_264DACE30DFDF75A51B9E979ABD65B07E47DD7DF3824D1BD7D92A8F6E964F507.2308.3600143250.6446",
        "CD_3291FB921A7A46D993643033A1F3CE6CCA102D7424F9ECF11FD996085AFA4DAD.1546.2290713361.1023",
        "em32\\en-US\\kernelbase.dll.mui[MofResourceName]",
        "C_FC20EE275CBDBB5DCCFF390F786A4E446220959FE7B3B5319E000553B67DC64F",
        "CD_E67DF64CBE3D01A3E33D2078FC61C5DAF3C494C4A4DFFEC9CB77DA207B5AEF2D.2119.1171935994.613",
        "IL_E351839041D42B9806641F1E00EEDB7E4B172C8FDA07E122AD66C5B9F9ECDC02.2702.1960752244.291",
        "C_850A6EC05E8D95D38CB257E525F7CA63816BE1356601C37E6AE5F127D45C21C5",
        "CD_5101B5920BE56811A454DBA3737FE64D06D0BF17EE943A64E7DC910ABDC79B70.2645.1241005641.657",
        "Access denied",
        "\"RY&*NaA.]=u29k}",
        "SDBUS_DEBUG_DUMP_REGS",
        "CD_A4F5A56059DDF119F4CC303056A7BB3F243745A5AAA1FF57F146D0A87968F7FD.2309.1108978600.272",
        "CD_62D705EEE1342BED8EAA270755244DE39EAF602D11698E63DBE2E645EB742AFE.36.3979828116.332",
        "CD_BC87BA25BB1436D8750E91A07B8979FA977826D3814CE58B45979E745F750C02.2520.962939106.416",
        "CR_7F311F5FE12DC8FBDC8986B639AA5BA7CD954740905CF54801CF77F8F3C84DD5",
        "CD_49AC1F5412340A7B3AF318277037F701CE239A6BB2F7176101D1105B89038C98.1939.2013241752.363",
        "MDM_Policy_Config01_FactoryComposer02",
        "CD_B496E3C91F33B99F414E0CF911598E2EF9133E94328E67220F22C24A7531B226.14.4216117398.303",
        "IL_38B5526AB241CFD133D27C180995B96476263672300A7AA3F8F93C0D0DCAA5FA.2706.2406138394.286",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1489.2360746573.368",
        "I_AE846573D9FBAF73B25A4AB00FE51279DECE2FE4CF73D7586CF8A1B070ECF2C7.2703.1561996053.296",
        "IL_548C7B8CAA43CC9635C7EFD11A316C9E16085EF464E2F7DF7BF493D60EC389A2.2458.3903285571.354",
        " $(,048<@",
        "IR_13C28897773F6F5A9F386870999C3296188ED475D6EBA22A9A6782D9237F4CE8",
        "C_2029D50C77548B518321A5119A9BC922C0E0B7DB421A8864B7194AFAB76E0963",
        "CD_84F8BABB6CA8331C4E9169FA40BA6E129D7FC9914E1CFF1EF6A24C2F4E5BC1E2.1747.2591917215.489",
        "I_53AF8608C104F86655F42A8871E5F73225A8D681F66B8151B7C200C46C518C50.1462.1027896524.253",
        "IL_51F1B3F79A7B4ED97B0674EB43E08DA91CFECC8C7DD36FB67E79BB9CCC86EA15.2708.3836478760.288",
        "C_0A5DCBDCC4320C6314CD6EB830F4C97344090EC565D71BFEB9D454B9AD1D8788",
        "C_DBC9D7448979766FC3AA5E546B9F7F37A6E0C06BC06D343F27EAFCD412F13D2A",
        "I_26AA386EE5FE14FD497F2BF115C4FE84BBEB4BAC3827DE5B6E890C4BF37142D5.2701.2563248275.291",
        "C_1EECFBC333FB318D97035F424A15E988A239C9452A1ECDBD654416B8121FB37E",
        "CR_9A1BB0482D33C76729D4E4E83E5DB60EF19255F1B7BD18ACD1F30074C3DFE4AE",
        "R_B62EF94C0FEB44D6E3137A4D55D778D6D9B593E905CB1FDABB63E5A04095CCFA.2485.1006886511.524",
        "CD_110FD38773EB914F177E2A2E2C39AE6211724EE16D7552119DAF151E92D1509A.1543.1586461176.490",
        "Install",
        "CD_3845DF884A9870820C258E1FCDFDC06294500F6C55F2D32133ABE22F6C920434.1241.1885197063.610",
        "IL_22E42EE14F4CDDB4CDB538C96531FD6BE0BCF4E4E9AC5C535D731AFD6825433B.2707.3091022352.300",
        "I_6A556E4A28DC410707EB1F351CEBF32DAFA6D249CBF15DE2882253AA39F209B0.2676.1194764269.277",
        "0x00000100",
        "CR_E6B31A90E686795D9E916C75179C5E297CC54460E452CC51EA148281AD5C6D23",
        "CD_6F49E037E6F2BFB72144CC48C974D93CBE7417A8F27ACAB5CA25D34A28C29442.1414.1.135448",
        "C_00B170B62C2F3CE0CF652E9172FD442FD4ED6E6431FA0C941DE48C4F06E373D1",
        "\"The Green Grid\" identifies \"The Green Grid Association\"",
        "CD_D4EE14E9B8DC621A0E06EC7E7B7FF7A062EBF6FD9A03F97DD9FA99C22506F07E.65.1311032340.606",
        "I_C29A46A6A8E2AEF9ED28D3FD6B34AB52381EE88CCAD6A9E341A0A3B41900CD64.2704.1792034551.289",
        "0x00004000",
        "IR_3CA6A8A46045BF954508B3340CD11FE30993A59816D6AA3EB1B345A8EEDF8A01",
        "CD_0A8460FC46C2746BD21F545AC61155DB7CAC54BE761314A2A7E02864EFA1BFE6.2067.4131829609.167",
        ",16;@EIMQUY]ae",
        "CD_40BEEFCD86669714A96D09FC1ADF38E568E0B01D634EF8F9AD700B7740B2B19A.146.785281549.1303",
        "C_632DEB324ADB39E99E029B3D88D503FFEF1874CB755EBE99E55CFDC82CE6D7E4",
        "C_DDCE0EEC8025DB3F389EB360CE7C50BBC0E131D334E8FAB08585F4C0CA2A98A2",
        "CD_5FDD5C517B158FA6F136FDA5163883910AF54452C20644A4B22DCE61A6AAF3A7.1649.3633128212.319",
        "CD_20435E8E6AE6B07C92579F794D715DB6D35677395F702CF6B0B37C21C5C70F22.146.754619585.220",
        "I_60FE62CC590A046D73FF6995A02E1BEE389B879032494DEF607C4D24A9672B79.2714.1880317712.285",
        "CD_253C1C96FB7F3D1A75A530DE68BF9EF86C6D306A9F09AAA285B8339C5035F10C.17.902807093.741",
        "I_065D83C7BF91F80BFDCA92364FEA852DB3FE639CFB3B2F41624F0D1AEBABD401.1016.2537665243.314",
        "KI_0B714A230756027CB9D944F3C101E5485E82B469361846E74358E5EEBA5C05B7",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2020.336309311.180",
        "CD_9B6218EFA94C067C7A0C80C5056C3D58C66F39DA9385FB7012B7F51EB8C27ACA.1802.3158356711.331",
        "I_BC000CFE04C2A23B745105FB1571CA3D890D9580D1AA6746224E398C7587FD84.1976.1227997592.261",
        "IL_08658952F2A9B8243A38D0892FAC67F5178667823A2DC6A1BAF3EE69F80C3292.2682.1889598731.289",
        "CD_AC9AD25BD40B6722261E256701F4549D4AD6E3CDC6187FFACB6CAF3D4F5CC978.266.2371338877.672",
        "CD_98DDD343F1A3CCFCF53110E519D29143FCD35034C8FA337D26D77DD90382C3DC.2661.3251811563.719",
        "ErrorDescription",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2426.2306175704.404",
        "C_9E824F6E13B5FC1DD52C0D8CBEEE39BA48EBDD8253035A9F85F9EE08399887E5",
        "CD_0B98E22EDABDC081A9355CD8F72426A59F036FD02AA08181EA8718C327C84183.1779.4167091025.302",
        "Some error in cabling, or connection.",
        "C_CE6FCCCBDF3E0139B08C5FFFB4D0F2AF40864CC7B7E000C38C0F3B168FA0E2DD",
        "cfilor",
        "CR_57711AB71326AC7AC810A538890F0BEE67A7DF25C7DE219237D14AFA4CFC51AC",
        "CD_C1AADA81CC90204D247CE9C64F57DC565C182F4956EBCAA2C9288DCAB7FDB656.1568.3658305228.829",
        "CR_4B5A98799E9F89299CF2B3F25F26C1BCCD944C8F4FF1171DA43EA42211F0976D",
        "CD_7A288281B12CD5978F882BFE4E06591343F1E62E2C1F812A6EF10FF3AC723D09.1908.1.26041",
        "C_845E1029436FB5CEAE897C4994B71C71B5FA45055CD8AFB3EF1896587669D285",
        "C_18DF4E7DC43FB5F7943BBAB3261441AF37AC157D8DEB54891BB97D3B897A5305",
        "IL_D3325D789A6AB0006C7E6456F0D073F619C36BC61261CD262027F7CE6C7B3120.2713.1391020292.302",
        "IL_1C6A553DF33F649A465BA3DC6148CCD3D895AED36C59B785D940AC6F55611A0F.2718.3848490697.279",
        "C_D878682017FDFE3FFC3BE47E7AA8B69EA18CE5000B41D11FA815F1FE13934384",
        "IL_46ACA7AC3CBC0F3ED7820D11DE0C916B1AC1A76D2292CABFF82D395CEAF02DF0.2736.2470088108.283",
        "CD_65DDAC6706A72751C31AAB0BB7F91380298C39BCFDED1B7FFA9B96AF2A3115FD.1849.2583044062.359",
        "I_86B3BCA296587429BCD61A2968A848617DB93023BC6D3C1858853C5540E12A3E.11.1554124308.245",
        "AntiVirusProduct",
        "CD_79C99D491B31E838D4F4A34A56F06848BE2DB0B4DAEDE7B1D57503CDA3A8ABD2.2544.1566727394.1406",
        "C_3E78A37E1DE70357C353A15D6BBB8A17A1D31F8D501ED8F1C3EB8104F5B04F97",
        "I_A04502EE4601BD859A13FEFB614206FF59E7276D74025F90A456579AC0628EBD.2503.2662653416.321",
        "C_A7642BB5BD25E38C8455D7FA5B5711E5CBB864E5CBFEC400B5BACCE7267F35B4",
        "CIM_Error.MessageID",
        "|l4(8",
        "I_FD02E7E23CBC32284DE7AE55B2306E3865E8819973EAD7BFAAF47CBD68DCAD7F.2701.3179860626.265",
        "CD_47A47D9B6C73D6463867F73A57E933DD2525E443C9FB15C91CF6A9FC4BA05F96.2082.4205250405.6277",
        "C_4BD0F8A6C8D9EC0678D50228DC3CB44B9F26CFF9B291F8B882B0AD7C252B23A9",
        "CD_9E43C134D778B6B917DF493A1156A24AD7B4B0BDFC30D8396FE004F3FDA32D3E.1548.1693735200.1282",
        "CR_BB925C26F6C4E973C68AC5FC9E68CE66EBB8087D6E05ABF71723D446983422A5",
        "CD_6E42F619B70AE9A2B05F70FCE3E0B6857CF973C6024DBCB714BC2386FB5CDB64.280.439929116.1148",
        "CD_3C7F00744A118738B0F07DC8C0576BC0E9D6C8254424A8F90C2292912ED03907.1930.3862784225.310",
        "C_9F036BA68CA921AFF06984BDB9CEE80E8A2696D8DB098A0C679A6507C62F4DAD",
        "CR_037F73558996BA2785098F824A14DE2797E69E82C9ABBC6D1677D799C2469137",
        "CR_199CFC4A1FC7A648AECC1FFEF43CFCD6FD4BBDB0667CA99257540823E6C76661",
        "CD_259A5E159C9BC70687CA1D3524FF3E5AFC0180D51D46E1351D0D2A9510F67A46.152.281067340.763",
        "C_E8438569A234983E9F3E72114D67C2A8F312591D9F4E7EF448973ABB653C95D9",
        "I_01C03DFC0B62C3B09F74501F0C80260AE479ED5CA24F033FE6FF5F8BE8E1A046.2764.1395928415.284",
        "C_AE1DADDBDD55CD086B091C2242170CB95C526932518425242374F8EF9564F554",
        "IL_D4BED9B6DD6FC82BA566BF8C092FFED4F8C7024BA1CFE6E985D9D0D485FBFD9D.2688.1560624429.282",
        "CR_249E58828B05B219C8BA8313BA785229871D4134A57BDB6BE040EADBBFCCD561",
        "C_C31EA868CB014D678DA84B98337697F37382F9A1219F5545B8C0F63812A2B18A",
        "CD_F71363625297B341F74A07A3245FC4F57BC952A1603833C9D340BD8DDA150C05.1562.1775636700.3207",
        "CD_E74AE202199C3BCCC455E82ABE0275331EE227666C9BEE443B7082437E29EAF6.1325.1.25645",
        "s too large",
        "CD_C2B48D57E7FB92EB84394A622E8976ABCFC0A72689795DFBF3816E1F26EC5623.2614.3673004189.380",
        "CD_C8016B6B0049BC20107AF6058F0D557305357C2E4A27EC0BC24AF4A11B9B1028.1490.13351909.1291",
        "IL_5E389F5D18C38EEFF5C365746A65203C9D9A928EAFC421BCE5234023F35E2F45.2704.2682359898.286",
        "I_0BF1F14F0E0C43957D66FE26E430827322F9091C1E5C92D04AB8BA791B9F67E0.2417.3461368136.273",
        "CD_06FC0AE99192039AD3DBC9A60D9D3329CE5644911B9200854CEAD799C76E19C9.100.638240412.640",
        "IL_DBB260705AB56469925C2269D5CF4DEA13534B8B63D09847F69148EC698640DF.2722.1666425238.284",
        "CD_9A79CFFC989C9C99D981C62F583AD3436C0315D149ACB31253CF2C9B6F8A1D52.2603.3014325872.671",
        "CD_0B714A230756027CB9D944F3C101E5485E82B469361846E74358E5EEBA5C05B7.2756.1261041860.607",
        "CR_91604F794B64A61196688751D972A0B3626DF7A1827369CDD4AD7A23AC00FD14",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1075.3252102185.312",
        "CD_AF8EF437987396E623AD20A5D6E988F723A5D1D3D167C9E711D2D495849F12B5.1211.1.11615",
        "CD_85D421B84B5B7251EBC11B8632E5849431920BE0B65D215F3D35E1300F5D0BE1.2509.2808255949.990",
        "CR_B1D75A909E6CF2DABA2DE9D5B0D2A805DDF2E38027D332B19EBFB8BA7F770899",
        "CD_D353A723558494456907934904E2EEA7D4159B1627D44F40729031ACBDED0D25.124.1771776631.630",
        "C_6862B6F533E21D68E1D23D0712A1C13DE999D91F14704477263EFE22A55CE495",
        "7D32AAD32B90A78248186522A99459E30407AC8D00521.2717.1969802484.275",
        "CD_81BC6D4A35C783287D4CB9EC1A6AB30E5FE03B53E0F1DFF036747248C7533221.1596.1637537282.922",
        "Description",
        "C_0085D9877CA4455C14CC08522BE2A35BD6BDD5C767F64875E5726A387A0D9FAD",
        "CD_B77F00C0AAB396341AF90E0CBAB7DE2932BB0B2F69B6D24907BE1A641C3162D0.2222.1.10988",
        "Element",
        "CD_3893EDBA1FFE14E31D305F26A8C305A156A91E1EF7F83521E3C67BFA88E1702E.2225.3846910753.950",
        "Read Failure",
        "C_08802E8C03811ED7B07D82942CD9F025CE302A278EC5904A6CDEA63BFA636223",
        "CritSecInit",
        "C_BF60071AF2C3DDF2AED3F8F1BE212D887152724D7DDF24F313DABC672EFA8F5F",
        "CD_E71494930AC32E2C68006820D0A4C9D92CA2B3E5E2EBF055BAEDFDE6EE348455.1926.1119036734.1016",
        "Total number of XPSS States",
        "C_34FAD62383244E37DE87E761987190C0E223C1AA97503DF98FC7B3BF572DAA9B",
        "CD_2F12799EC4705459E9FD61FC6C601B5A8AAE36085966AD27E0D7247EDCA6524B.2196.4259822052.2465",
        "Digital Unix",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.293.2901462612.180",
        "C_3E82FB959451C3E35A276AAA1FE1C0F9B93A0726AEE69E99BECBBEB606DABFAD",
        "CD_35C0F224CC2308A9D8BACDB20F08468AE9D1134753B5808A41A3EA43EE4C047D.150.2272564689.754",
        "C_956218CB3B130B9E0F4C99989C08F085EB3D3D40CE439ED3E9C6DD8BE7E440E8",
        "C_73501BF09C2970508D1FF696B5776EC0C8584B1DB70DECD71711B4417DBDE434",
        "CD_8322231D4A6F73C0873B20B3D825400E9B44E18CDC9756CF0152A7F3BD39197C.1923.2892361916.289",
        "IL_E3C662E70B54DE090495B5AB6B06A3C347DF1A4C721F2DCB6E173C9CA1591DAB.2699.2147945317.266",
        "IL_170F6465B2A7A392C41416D3E656CE54DE77B64EECB04DB67B3D2B3999A4A0E1.1015.4259979364.291",
        "CD_B1B14559B824E121394FE392FF430F8FD008843C4AB8D519479CE971B3AF84D1.1667.46554871.699",
        "CD_9E201978C09DFBC722894D8CAC5CC2344D30A294DD7D8D49AF08F959D13F3919.2588.2988565665.990",
        "CD_88F6BCC90DFA936CEB051CC0CC5EBEAC8E426A3D0DFAE58E560CEF1E3E70C3AE.74.3125173293.497",
        "CD_FC87001C8A293FEE277D61D93452225F44D005BDB34C116869AD3A6E3FF54998.2653.3188330540.468",
        "CD_CFA7490FC441CDBFE3AC487F4E7E6794E550150460C43DF35BA636FBEF5C66C5.41.3475988656.1034",
        "CD_DDC6E09996B73E0FB9A8193017E7B68C6C9B1BCA3521A86A20F4A24B758197AA.1050.99102731.352",
        "C_5C866111FD8D1933EECCE5D44B619D3E64BDDD0B43BC6F39166BF254D48A504F",
        "CD_11727D0817B89F7123E6B6DD53CF1B739F2A79E64D7B5FD98F4BEC8A77C74EE0.1930.3989674340.291",
        "CR_DC6801328AD20F0D19416832CF71DA80FF8FDB25194CF233A39A0BBA13B68D4C",
        "CD_25A225BFD7C0706940B21958E1B4E7879B81C1069B2DA72D3945C2F2A653CB92.131.2465278809.590",
        "C_050953C58E97660582926667045FD157390A1B7EE9E1CDFCB3DD57BDA1E5B26D",
        "CD_FAA87DA9696C5DDA8779735D0CDD82F772B3863DFCBC34954A3E6021F405A249.2572.454155135.222",
        "CR_B449E4C982007699901F8B11448557481BCA2B35C4809156A6C3E1390C860FE7",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.100.2474730606.188",
        "C_C231F504E2F0694DB5EE26E89F896D184F3E353B388345FC3E332D3F432F31D0",
        "C_576EF4A0CA90F6D8810BFB793D022B2E61E1CD9C1C9EC856ECD04FF80D2D4518",
        "CD_CB8902267994B97206E0B7D2D48E5A733ABE6C5272CD230F09306A7AC1595890.1064.2716390630.423",
        "IR_2A8E85BB31065B3FC60BA81CED6A654079AE6D371D42FEE2259112FC3A521E06",
        "I_5C1DF294EF7D28EEE66F41030D76BD514F02CC448CB61E4124123E427781AED7.2720.2225744105.284",
        "StartMenu",
        "CD_8966DB6657BC4B4A3A46AC2810F4B56EFAFFFCB04543E6C12475FF36464179F4.1202.3223302417.1817",
        "C_724155B2CA7FBBC304551F8A171392C3CA07A2D9AD12D47C6D2D987EFBFD727B",
        "C_D57A35ED36C1BFA881E33DD1D96B9406375D7760056EA2A2CE40FA8EB184855B",
        "ref:Win32_LogicalShareSecuritySetting",
        "R_295BA595E75CC7D3A74C5F0B838A92FD0FC68A91DEB19B5C9E13269F4655BEC7.279.2824381758.518",
        "IL_F9B72CA76EC1D3B52109C1244A7F2F0FD89252855F69B97F985B666E29D5ECD0.2716.3515488736.288",
        "CD_976E9CD39F31ACFAAF8B7B730E468AD5B2E5984554170330FFB447FBCE0ADA0E.1521.171539932.410",
        "CD_87C10E264E287342D3206BEE44C1E60CA6C7D6B38EBABA03EFD1FEBF2C09580E.2490.2201601670.3776",
        "C_C69F291BE89C7DCF47D514EEA88ABF7BDEC9B45B40FE7D549762134D0ED90168",
        "I_C9D8708392C35375A49B7EED2C8C85B729536413677A139F9BF0F448A6D4EEA8.2686.1176899886.272",
        "CR_79BE4703D74D1AEA9541FA58F2B00142CCE440AAF1482F39D9D52E228ACD0FC2",
        "I_0AE842411B3B68BDB60FB4610360E1ECD2D583F7968316F79131DB25BF102F63.311.3444058254.217",
        "C_034D78523931C983BAECE5A02A4B6934DD8AF2673197544B9922FB153D366359",
        "InstanceID",
        "CR_532671ED26AC2835681FE0B122A526862616ED33CAB2C220F171DB7BD5AD8B02",
        "R_B05CCAA71F3A61FD632B96A8D0CBAC4A42DD424FB85CD76DB922673FA7A32DD9",
        "C_93864AC72C045144B9543F656A7A5DDAC273FC07B857F897DAC274D9C967D3A0",
        "NS_5C32F5574E5163FE018847F3BD73D0368BC221B55ACBAFCE19E9093EB8E4E713",
        "22449D208",
        "CD_E21660815AC462FFBD7FBEDD97A63305E05561610CCB37ECFFD00C1772D0FF5E.2570.1036245015.220",
        "CD_92DB14183145FECB25D8F810D51EB91465DF70CF55ECB1D5FEEDBFFC4B20AADD.2060.1621076014.652",
        "C_54B484B8C5179A454100ECDF2DB8FC85525379AF704F06F9B2379CAF47C81134",
        "CD_8804D243AE7A52758E6F83E5472ED92BCF2D0EC1642375FE251024B3FABA24DB.1667.868417273.1187",
        "I_7A779F4330E50C4FC579B3DCF27C60137473DEB41677EE9A1455DEB3F9CBDCDC.2715.3595765299.273",
        "I_86C28C34394062303FC75F2777443AF2AEFE397FE5F57AE0CC82E3E4BA986771.2724.300483189.285",
        "I_B4CEDC7298731DC189C689B2C13995D9B2F04481C7C38618779AA70678131A13.2679.1183075092.284",
        "I_DAD8C8D4FCAA87D69D3F943F3F1660E3777E7C27DE2F3028372C840EEF63075C.2686.2819588879.280",
        "IL_8A5316EB1BF9CB1B232B12A3128C065F838B4C59AC9656AFA33AAF95E93A4787.2717.1785394700.283",
        "Component",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2510.556897021.368",
        "CD_328F09EA94A11C49CE9879973AEFE371583535ABF3A24603CDCD08371B636C41.158.1661896450.1470",
        "C_B62E3BC0ED4669CB12D462E1CA25681D5779A9B4C4E1FD95E1263BCD94258894",
        "C_5F24F19683720FD1EB4928C01BE6B72971BB4F46F372476DC9706705301704D6",
        "!$'*-03x69<?{BEHKNQ",
        "I_367B2B126DAB556D40B8009D4C3779282D22DD8E6BCB2458BF749B9FC0D2765B.2735.2986809290.273",
        "CD_A026C2EC35B3A4AF24593EC09BC3F9A24F374F1087E00B13F499CB6268CBD64E.1070.1807815823.251",
        "DetectGateway",
        "I_AFB1F2A4391AB360C9692594F916CB837FC1E6CCCCC7C79E1D6F44A2E3986C3C.2450.252884842.269",
        "object:MSFT_StoragePool",
        "IL_20A2FCD02AFF243CF774088A45E089FBE5A849A9F82F70950D8BFE6D4323904A.1018.3371477435.326",
        "CD_1A551646721AA7A2EA278525964261E10C989429101DC80D914D36CBD92BEDBB.2135.3858906983.2656",
        "CD_0A4592DF371B0F1C9E35DCF899DDC0B30F2B23CFF106F5805254E0E64E1E04F4.216.2658909573.644",
        "C_80B699E54B84239FD1066E5A81EB19D570A7344B7D65738ED8C91406D3A0502D",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.3636123003.368",
        "CD_AFF439DA68A5DEA8558ACE689A32DD26F12C2D443C918BA2D3EF3B42461D8D30.1928.1816692320.282",
        "CD_43B35DA4EAEBC0284206ADBC4132DA71EB8556E731586CFE46B5A658E2C2F498.51.1518680481.682",
        "C_1E1566DEC98AD7EEA11B96CAEF5FEB6AE754AB31A01EE8B2B82E97FC4849BD59",
        "C_E0EEAE849B77FB536D0FAE8399101840388F63D0FA098869692C2222770FB614",
        "CD_760A5CD37813CDB0802F97A15FFFC44EE06FFB8EC97E61F0CF228A37D3D46FFB.35.729959090.390",
        "CD_447DB725B00964FE6AC3F949F305AFD597B2128B6EE19CC95CB28870926BA091.2545.57767808.727",
        "CR_B7706B28FDE42900BD4C0DBC550087B0F05CF9BC30AB26E796AD48A7E503711E",
        "CD_BEC7957390E69545622E33DF7D0A224770A47F3DEA408861F4867699D17DC297.1204.1743627604.1758",
        "SEL_EVENT_DATA3 is valid",
        "I_C1051F006B768D96E4FCE6F2A8DC0C03012ECC7B68B7C95E31F5861C5B982207.1534.2812249662.333",
        "IL_1FABC0661754BD6B3A73A87C9593EDF0ACCE3474AEEAD9FF9AE8D98AAA2A584A.1714.1735106094.184",
        "I_B97E9E93D58BEBD51D211F64285471E2BF32C6577BCD8CEF45154512813BE359.2724.913504501.279",
        "CIM_Error.ProbableCause",
        "I_2C512BFB94ABD9066ADD9D1F1A25B99160B9F22A302E26BEF753D4B75E44E000.2679.229246160.276",
        "I_32AE2A5F17D13D0986757B3194A9D15399A6CD22AE1C58988AA3DFA10660243E.2696.513844225.280",
        "KI_6EDCAD2493CB9C9AE066E77642818C8D9B9BC312C7B4C3A76A07871F0E60FEB1",
        "CD_ECA4BCE942A7519C8BD48784B00775961389BBC39B370F76AE4A3294CBE6E51C.1149.1165349225.1350",
        "R_A66D0E591535F85D5DA7C1BDF3A1DC73BE40E7ED75F810DC35A2C1D0250B7F4C",
        "CD_F403B2915B550FE9485A23E9B50313A3835CEBAF72BAEF73F6D6D65501009E73.1589.1725133316.436",
        "C_45D7E6F87ACB8E8D445CCFB669888583D94123CEF1D8C0B902BDB864D192ADA3",
        "CIM_ServiceAccessPoint",
        "IL_3641218BBB4887CC713D0E6D5D803C013DC990DAFD3FF3D0CE1C6648CA737F00.2710.256303480.290",
        "CD_19BC29932E779E4ECDCA3D2FD99CD32E93FC4AD3FBD8BAF371CFBE02B8675037.276.3386973629.402",
        "IL_11DC9B6A513916A4D323430E59B223090625B5769C0F700CDF56011654E2084D.1802.1445999930.336",
        "CD_39F7C38967E34297331D59592931F4CD7BF528ABBF3FC3480C6D46EB20F990B2.1218.199010441.1527",
        "Tt048<d@DP",
        "IL_0B3ACE4B1539B95DC7096541D9EF45153B9996E5F763DE3A3235C63B9A58EDBF.2728.2013752038.285",
        "CD_54B0E217B287F6F85D4DEAB32DF5A8CE4DFDF560D8AC01819FC50FC0ACC66BC3.220.180899736.4290",
        "I_60E73D270C0AAF405200C83C2004E20ADD441F756EE8A87BD48C1BE17A90AF6E.2713.1788351777.274",
        "CD_D1786CF1703A5EE88ECCB609DF5C081BC2D647617B6872C7F1D52C9FA2FF8990.2557.1745102350.553",
        "f6<]iH",
        "CD_3F821AD6ECD189962128C4700637490830A0FFF6630C63DB1A008457C9E0A4AF.311.795792973.213",
        "C_5B62370FE5E6AF64717CE8FFF4DF7EE9BFEC8C45A936A424E7796E87491BE149",
        "CD_D1448E1E08523D621DD678836B336A7287BB557D1F1B5D247B55051BE70A76E6.1922.3798071666.243",
        "IL_7BA978978EBF3CD1200A10044AC0BD6F4758993016B7F6B6A538255F2BFBBE7A.1714.3603523673.277",
        "CD_B39E27CA2A0129CAF7998081FB67E78792DE0588A33F7B163B6B3F6E2863377C.2597.4249676516.512",
        "I_C0DCD2330B402CCB79ADC9A534E5029F8DDEDEFB826D41905F5E8463B821C3EF.2457.3939950857.361",
        "IL_AFB1F2A4391AB360C9692594F916CB837FC1E6CCCCC7C79E1D6F44A2E3986C3C.2449.2850169286.318",
        "R_3D48C23EFF67A2389D2D6B76CFDE53ED48EE3978CE73F111DBA847C2A8B63248",
        "CD_13EC1BE17DC892DCFA7E3A89B2381E177D560D8CC74CCA31E1E844B305EBB081.253.207156420.620",
        "CR_0FB727CBD11D8AA74B3B2793A1C7EA749C62FCE60E8F20DACD959B04FA118436",
        "CD_51A4A09354423C467E946EF4050F2DF0E13DE3BBAD00C291A488D4E05F085A24.1197.2288015404.2987",
        "SDBUS_DEBUG_CARD_EVT",
        "IL_724155B2CA7FBBC304551F8A171392C3CA07A2D9AD12D47C6D2D987EFBFD727B.1163.872217503.187",
        "C_15AA9E5C08C912088DB12148021E6F808EE6412DBA54846E39AFBD33E4BDE769",
        "=AEIMQ{",
        "MSMCAEvent_PCIComponentError",
        ".2340397220.283",
        "CD_C17B838CE4C54DFFFE941CEDE0C043600C1F47F6B10515AA6CED6D6BF948A8E4.1193.908269859.606",
        "NS_892F8DB69C4EDFBC68165C91087B7A08323F6CE5B5EF342C0F93E02A0590BFC4",
        " $(,x",
        "CD_838E75DF6AB0A59C9F2477F1CA99D3050323945F5A9DCAAC9E77A5F334C030A9.2426.1159242908.355",
        "CD_82125485D5F16E1009D3E6E30832E080E69D894F4C7422BB7A4A96AB3D5314BD.2667.1555988208.683",
        "CD_1E7637AE86BE9B7FCC266B24B2671ECCB9515C8B3A1845306C8B4FE9C0197220.1068.1451296472.2487",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.2567028959.368",
        "C_FC764EFFFFC628FB4F4C4E749D35F8CADAE14FFC3FCA171EB5E7EEED097A21DF",
        "CD_5F9C3AB92CA2BEE4365F705F76AB07B9D0B1B5C83E9191E42305414D5BA10EAB.1579.2090859226.703",
        "X[^ad",
        "R_5F3BD5E67807B789407C7E70FEA47B190EAF980A9E799D25A963DF46E602BBB8.291.970711598.520",
        "I_AD37F4C915F4A35C464D56C640CEE52171476D7BA48275B71B2FFDFD6CA9F8E8.2714.612732418.285",
        "GroupComponent",
        "C06194D4D96931CCBF8B3053F5A8AF",
        "HeapTrace_V2",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1751.3522617866.368",
        "I_675C8C02435D74D2BF9FB2F1ACC8A427A072276AD5C19F68D5A3EC506D13F5D8.118.2343476280.299",
        "CR_9E927C42162CFFA3624D55690B21114853C375D15511354B30627B7E45D7DB02",
        "I_27234A891DE14CDE5C320713C8C4AA047B5F469BA126B978EDED130A37F10417.2712.1031906111.269",
        "CD_3C5AA3CDEAEB585AB43C65A0F5E950F0F3FA0B98B670B232E78B6416314D7405.1351.2061620976.2955",
        "Vertical refresh rate denominator",
        "CD_4E5F0B888397E4532A37F63C9F9EA0A293D8E13FC549C1AB0831AC14D99C4786.2625.606450530.590",
        "C_127F8BF97DE5B984D84C3FF0673304373AA677B9E2EE6800AD16FB9A0674887B",
        "CD_A726CC10C860A315296DCD93520657C7C068B6652EE5FFD6550B3E0DAB8CACAE.18.2324741754.732",
        "CD_7C25BD6439936A4252A1C4B7A8B8FC81A8215FA3F5561F5E7030947B64B43638.1805.1312454638.597",
        "CD_0D4A09511C06326D5D345B08A0B467BA70A695848B2E0A8AE92A1F33516CC3D6.1650.1201488098.562",
        "95B27F0CF574FB9DAB9102B371BF6DFA3132EE58FBB84AC5229A6FC.2727.57686035.283",
        "CD_17C0C742144CF5FC4AE8EA9E1463C99C7B74A2C4D58756A1E2DF35FD85D11576.1349.3090708574.748",
        "{C7BF35D3-AADB-11d1-BF4A-00A0C9062910}",
        "C_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1081.768419745.180",
        "CD_C5063773359C977AE8BCD38A9E0C82B16648D007322D0390A3BA0ED23E18A8CD.2642.3422712461.399",
        "IL_08DCEDFE4B19614167C5D13C99B3EC7CF1E58552D5D908D4C43BCE7CDBC1455E.2719.341435090.283",
        "CD_26A733ED1A98D240B4CCC7A4F1493F59464EF2A0970B39F2C9B821A24049FC7E.1915.3439336937.263",
        "Protocol",
        "C_CDE4A8C7C0B03EC0C311F78F07CE34C050F510D55C1F5373A349277F064EB193",
        "C_5953574AD268C37F4681AD557CF3BEA3442C419F9086A8F65CC3774027E8952E",
        "WSC_CallerAMPPLData",
        "C_38D82DBAF247C62CB271C7F968D7EF903F6B890D72656BFC47D699684D55D030",
        "CD_894D1306345D6B047AD14593D78A9D4FDBD2D6DA5717032BE0FC560EFD5A0FC9.2647.148933663.249",
        "CD_2A4F98E46770D35357CEB6ADA3489C9F0FD306040FCD6B065CED71BECBE5700A.132.898966755.573",
        "CD_B209BBC3E9792036932058EAFDFF59DF6B02D2E0E24C683DBB3CFAD2B25B83E4.2000.3893159145.1951",
        "IL_F4D8FF98B431C9DE08E30EA0A5DA0DAF034B776838F75E67F5013FB3EFE9B591.2734.2566914989.283",
        "IL_F58EA9A4248FB79DDBF112DB65B98127C9A78FF4DF9FC34835E8B50C808C985B.1747.168804341.304",
        "C_58C7114452DEAD938A8EF4255730EF055ED47CABE4C0DD5F512430F5448F1DEF",
        "CD_674A600DCCAA63BD9D394037EF94415E97BD130F08DC05DC75146875725ECC64.38.590421357.251",
        "CD_556BED9C5C7B0EE930A3BB6724BD19CEA9521081CDD971D1A19DD19DC37599CE.2427.1822125525.331",
        "CD_AD7EFADAD1289B4A3FEF0D60EBF19DD1D014EA7A1302D0431E7F57E3F564CBFB.1500.4180685050.694",
        "CD_253C1C96FB7F3D1A75A530DE68BF9EF86C6D306A9F09AAA285B8339C5035F10C.110.346569818.1693",
        "CD_B7CB0F72C5888EFB87CAA914B3258F858F11D8FC7438CC22070822389ABE2635.1084.2556627288.953",
        "CD_FF71E202E2A34447E8E5354267F9FFD470AC6E6D127AAB0563CB37424C6A85DF.198.961021157.216",
        "C_44179BB601F070AC8C34C5B9994988FDFF5DD1A2C985178B6D48CCB665B74AD6",
        "CD_C11E0B2968F07899C3C15A08181C55EA86BBBF2FCDF1D89855EC8855E08BA914.2111.682128206.1884",
        "IL_434C67A3E3C6A58262C4FE45F3128F8CC7E0BF15C9B24B8E0102EAE7EAB66665.2705.637143694.292",
        "CD_355DB6CE31803BDDBDD2FF491BD2AAE24F28E7ADF16402B3F3B9C4CF695702EB.1094.684664960.3947",
        "CD_D2ACF3A15366C591C175442AA1C3A391925DA701286688C53A9845211C124C25.2472.1944115749.1849",
        "I_F3D736CB863DF514A8C1737F82725E91286393D6F6918E8129ABD7BB13872F02.2724.83674566.285",
        "er consumption in milliwatts",
        "C_122152BC995251C3FCF68650245D240F361D06B5F08943C45B791533ECBA25B4",
        "C_EBD10294D9026876E835673F3CA0BB526578638585FDB3FD6B9DE34EBA8FE9B8",
        "CD_B5C20DFC0112AE561EF6233E9F943AE819AAD596DC3786CFC0B88DA112FDEA2D.1929.2794652972.297",
        "C_4E6B2407BBFA735CD558FA956E39FDDAEBB739747AD4109DB6B2E67ADBD0148A",
        "3~69<",
        "I_07C0F1F3C37EBF65E6F83EFB70F6AD730277C54ED63555AFCBE9AEC0BA5C2057.1017.3719469808.329",
        "CD_B3CF2C36A1D52D539D1072349C9C5912060B70BD7C865FC1912BDB78F2BE1EF4.2540.43130279.540",
        "I_2368358296D3DA2AC5F13C1802E3BA26ACD82B7A72CA620809592C5CBB23F883.2688.4092771976.266",
        "R_08286EC82422798EB55E2AAF268DF8DFAD19BAB9EEA3214B28BA6715B96716CB.1802.3055940035.540",
        "IL_2C6B4FBDC9F6B702033F6D5FF8ACC5D0A736F2D87EC55CFB39B53EB8345F27D0.1187.1133654144.357",
        "CD_E00F7419D4B48E1A92C27BB2EF8DE2D2C0B5AA67F6D9F7937C1978404CDBA2C6.1217.277033985.2169",
        "CD_5CBA40F57DD1C39C5446D4C1AED98236A1F94F251B54CA16ABB677B02EE7B56B.1498.246310359.2034",
        "I_94CF12D6B59E5FB1D3AB0344EC66ACEEEE807D6CBDE8CF0404B1D31219731882.2693.3225958961.268",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2426.2306175704.404",
        "C_7B2381E53BC461FB5BE5892F6D8B646850BE4B97761D0A77A966BD4E7C587F57",
        "R_D7EB793B75C6F156CBBCBB27B0A24E108C9A84EDEB0EC2650B7AF5A46C642B74.103.805349364.518",
        "I_C37E005F0ABC8E952CCA8ED708B9D68408FDCF0879CF855CB11F937CEEB4007E.2687.2894415755.275",
        "C_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB",
        "0x00080000",
        "CD_C1EDB2C3B16B75C05D994CBAD887CFED943CA4B2E1180F3891F60984B8988B63.19.498107267.1654",
        "R_3E82FB959451C3E35A276AAA1FE1C0F9B93A0726AEE69E99BECBBEB606DABFAD",
        "IL_A4E92491184161E36C68A11A49A32C76538C1D204ECB0E49FC3950D462C793F1.2704.135469033.285",
        "a bad local SCSI logical unit number",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2065.4189954886.180",
        "CR_F34DE71B2CAA78B0B6E197AEC8F7CB5876472AEDE7848CCF66EF8194FE5EA5F3",
        "R_B1BDF04F409DA8A1218BDCCDF869651E770462250C203BC00DEB8F3479804AE1",
        "C_52FCD2E5BE7CE0007B4E896F37512A3F9F16709231D802A1F0878D02E5765394",
        "IL_6EA9F2C3FCEE35A10CF321FF135D92BFB9D8BBD96163C1D731E8ED4565828218.2693.3790602425.266",
        "C_6C789C13A4D61164E88FEB10C276C4AFC909A00FF2D9876B44EE4E6CCB8A9546",
        "I_2F614DE7B96AEF9D65EBC8096C0533998A03001F7BDBC16F17AC0691C0EF61B2.2694.881534551.266",
        "C_157A266214F731F02CD911D15EDD9F64398FCF66562D529CFE3E0B93A5F5F029",
        "tem32\\en-US\\kernelbase.dll.mui[MofResourceName]",
        "I_F2F75FF4B10277F949A9B903139033583DF34DA60B8DA578A7348DD7729D5B05.2698.1634475983.264",
        "CD_C43EFC04AA57188F81F06E127B541FCB4E02CC3940B347504A70CE9D5B7DABA3.2759.697976578.354",
        "C_BFE8824DD38CFCF8E5C18FD190F5AFD951CFCCBCFCAC142E912A160B869182BC",
        "IL_06CC9A05CCFB455B8B3221C638E29AC28A8100390B50D06A005C4CE3D39E48DD.2683.2986057804.285",
        "RSOP_GPLink",
        "I_978BA29293E78530769780611F7221DB2CD2912B8EF2B7783CB3594CFD3E9506.2683.2338201688.279",
        "I_03EDBEA0B26E95DAF602708173A280941CE4510066EAE0F07753492A3AA559B9.1049.2066504159.367",
        "C_DD19013C5DC1E320E81019FC349982C55E1E96FA47B8CD4B261815CDCB293CAE",
        "C_4B73D65E2FE4553C66EBB3CAEECF929ED3C6295923490BCF82E45AB15E13C3B2",
        "DMWmiBridgeProv1",
        "CR_ED267EE324D3421C9BD582F00F7F4EC3645A8F358122D414EE824EC6E0323BB4",
        "Mount",
        "C_3D48C23EFF67A2389D2D6B76CFDE53ED48EE3978CE73F111DBA847C2A8B63248",
        "C_6D1FE252E44FF3546ECC7BED576DC3967B39474BC0CE652BF027660AF117633A",
        "C_7AC6B537C17B7A0CE625AFA6380E4FC98418E800AD64DF240D5A7AD2482283AD",
        "C_756ADF3A38037C884D036F3D193150C71CD696CC6C340246CD1DB26B98747BF7",
        "CD_5C8731DFA7B62375F729E30B13DBD95B5FB295782D16E78D50C89099570DA8EC.2042.4036869259.703",
        "I_8F1D0EEFF09882E0AA524E87B53BDFC6C73AAB5D286B5498249DD4CCD51331DD.2763.1318601741.201",
        "CR_20EDCE2D529E2E6BCE41DEE4170C3E9E6D3DEAF61091F14E5541886CD554DE30",
        "I_20B6439E3DEC4CEB76B09FEBCD3B770F8B7A551B618CF8502C758D605929F000.2706.3670207048.294",
        "IL_3061B166CFBF6742FECFE7755FF14887EA2F8F0CF5C355B7F23D2CCDCEC46AF3.2679.1696751788.275",
        "C_DAA0835D90559AB1BED3F4706FE66DA711EF5A48A581A0339267CD41A8EB5EF9",
        "I_9999CE7BE2F7DFF5A650789A4ECB638EE8010B0E955DAF1D73AC5808D527D79C.1498.3046117437.333",
        "CD_73DBE827D23692912B7FB3F1364551B060463FC365FED71D77258CE9C6B8DC8E.1928.2984735921.283",
        "CD_E8E72C534ABA427E69CE6B883E8FFA9701DE1CDD9E04D7D1815F4420292F16DC.293.3680546768.841",
        "I_9AD67B066E360AC663AE2A69F8D96641C9C6E666E44B5E5426C493004D269540.2719.1635019920.272",
        "IL_8072BBCEF949AD08C3FD6035377954D54186B39AE522E1CEA1EF61B2FB3A1593.2698.632374131.269",
        "CD_7AFC0D42052E9C59679F25978A7C6BB4EBBFFCAAA7E1A1214D251ACD02FCFF67.121.3607088286.637",
        "CD_06F709A163637DA41871EC661878543C4C8F0288DCF32B1331F472D89C57FA5E.2377.481822045.789",
        "CD_5E46683FD84F3219E379253BDA01FEC308C95988FDF4807D31199D70DC1E39D4.2285.1412410570.243",
        "Minute",
        "R_CA2D9CAD55F788BDDBEEB1BEFBBE80B4829CC0B88C20F28872DE5F91E068E98E.2505.1653669329.540",
        "C_82FA3A19B147BBAB62F558F1C6EC189FD15707390ACB5D1DA80D0238BA7670FF",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.1522629790.224",
        "IL_8B109770B70CC6D7972AE94E395D34EF4AF2D27D834986AE7388EC1225644A3F.1606.1789527066.329",
        "CD_82BFC012D11F72AAE5389CA53908757EE14710A6CCDE0F075889F10711D09D04.2484.1500182562.1632",
        "CD_51E88707378BBC9C3F0262A228CB3838BB1907FCEEDFA527CFB3A2F422A1118A.2654.1051207231.337",
        "CD_05D3203C0AC8D19D2C308667A810FE5B8035D169B8097B184681B340000218A8.2634.792637861.1974",
        "CD_CDB4D0999BBE2F5F01BF7E500A934D82190F379CD1604609DAB79E05390DCEF9.21.2600707090.914",
        "I_735452BBEBEFDAEBC6A68DCD86C8369C33E470B585707BA64EB646095B631099.1196.495475129.331",
        "IR_59543DA79A0A83C48BB9222B5916E17BBA9A5688C362D35DD3F13589A2596294",
        "Tp|h04d8tl",
        "C_81CBCA9C0215B59E860943652530299E5FB0DE537CE83929081B409741C1FE81",
        "all the drivers for this device.",
        "CIM_Error.ProbableCauseDescription",
        "The virtual disk could not complete the operation because another computer controls its configuration.",
        "CD_0A4A77B99E06085632BB6F0B20A342FB9C17A36A3889D5E85FF4837055C41CA3.1617.1427124413.252",
        "IL_A6E5FA940D738F7DF2A306209FD839869FBE09960339784A8B593361232D3D86.2675.2386162767.280",
        "CD_E0EEAE849B77FB536D0FAE8399101840388F63D0FA098869692C2222770FB614.2583.1584889313.157",
        "C_404A8A60F06FF86C891EF2776F930A45A835547F74E3D08788D5D842F92EEA38",
        "!~$N'",
        "AppDataRoaming",
        "IL_73743B4EB2A5F909581B64D1890DF2596BB60EC0F50E374FFE9EEF7294F21EC7.1607.4124435553.206",
        "CD_4725B2A55879D0E15B24B42E1D8F36FD060F6802356C013408946754222CF4DB.2665.355122567.550",
        "DrvMjFnRet",
        "CD_4DA7E71A9CC400DDCB891860F95A9DA5B5C3BDE919E0221C377225E0CF8C99AE.1064.3168709239.654",
        "(,|0<",
        "I_4BD704EFD82E90D58D3C406978C7C044F013A64518E8C54785195D2358D9CFAE.1806.2760646680.425",
        "CD_BD8329DC9A85A4919F9F60EB4D48B035D2F30D4D189BD4EEBE828F7FED6AA535.2119.3933150316.2203",
        "IL_EA5166D043906337C6AAA3F803574238733C1C80B083B34F0CD3FC0F90EA07B3.2729.540325973.289",
        "C_F71CEDE68D110C46E631A74BD74BB02467459B066EB8F2E32432A8044C4EFD32",
        "C_9C46A759D30423AAF4F69D77D418152E94C7E20506D0B665994363777B2CCBC6",
        "CD_5FB7B77EA5E2C3BFCAE4E2AEE1C523572B9C00CB53A36167EDA3CA812EECDDE0.2559.1771057362.62",
        "CD_89D253C7F34DE1BDBB149B2A6193A187FAB48CDF693200563636A89559A9C956.141.82724732.1159",
        "C_93BF28F302E6443FAB621D1A850026535EB5CC363B6312B15CCC1CCDEB884B1E",
        "CR_B621516DFDE9B6E0B0023289F774341B5AB73BBA9615079DB6C60B9EDFB63DE9",
        "I_11D7A97FBDCD50D87E0E138CFF9AA45DE71FE994A925D0CA23980E1BC61DBBFD.1014.433114907.325",
        "select * from MSFT_MpEvent",
        "I_9D15CA27C42BBEC156CF0F243AF08B68DD4A573441ED0FBE81E8CC9CF011567D.2707.2808223030.280",
        "CI_4477CA66979EB36A4812EB84064B57FCF10A17595E6D43320B7012BE2EEBF12B",
        "CR_9BCC36936A7CD2114CBD6BB3117D20BDC217533B6143F306B044A23AE20B32DC",
        "CD_ED0FE1836A8A43CE00507F00708D770A7EF86A8D404DA2B6D5FE190709C3FC86.1155.479555746.445",
        "Specify the scan type to use for a scheduled scan.",
        "CD_410A7F9BCBF68F143E8FFFBF91BEB08109AC58714E0E02572A1BE71E6EE2A05C.207.2086087381.1472",
        "IL_927DB08761B3FE464A2914E8AB4DBB9E74A1737A91590E3FD3985A126B04D44D.2704.3413318601.289",
        "IL_5BB37259D5CC25306A3611D2ED686AFC58E38CCEED024E8AC562ECE33C896DC6.1338.418677725.192",
        "CR_F32492DA8D1952EDCCAB707AFA3F69E046829AB6D46D4B2279EAC5E6BCBBB3FB",
        "CR_DEF6358C5F0DB3A8C212B6EB5152B0DBA8FDCC511B86D1F1B5A68B1427787DDC",
        "C_E7009F8345E6F3D959CA1331053B26729D4CFA2A9BE412F35DB4F889D7ACACE0",
        "C_FDF44B7A491FBFF7D82AA60088512F5C196339142429AA6E3D11133F28C6759F",
        "AllowInboundTimestampRequest",
        "C_E8334B1044E5E9391241F02C3A6477EAC7B1BC964EB7954067F8CB3768E4DDB2",
        "CD_0D4A09511C06326D5D345B08A0B467BA70A695848B2E0A8AE92A1F33516CC3D6.2198.3413957900.810",
        "CD_AB754770CC19ECF1708863E61B4513A3C8CECABE89D78E5D727A64FE3F1CF111.2177.471101885.2552",
        "I_DCF3A71A69441266D0851FEF561016D8CC73D9A70911ED441127DAB3F21A7B44.207.1212613759.304",
        "I_78C567B9CD6121022EB4703FFA6CCB8AC4BDB74D599F63CD66F434F0AC82F270.1014.1863881692.294",
        "IL_228EBD5F3D358C3CF86C30734E7259A9B51A3D5346E336635FEDC15F32D3D97D.1017.3288142190.302",
        "CD_9EEFA7F0102D053BFCA7454808100573EC06479AFFE9665BB59D010E83D6FD0D.1154.3243359327.893",
        "C_91BBCE5BC61E1DC47C4EBF730A35B9AF4C8A68FE40C45D7F1899EA3F67F6B400",
        "NeighborCacheLimit",
        "IL_209504AC1F48FE9F9D4D387BACABE2CE7B4E17C0EC9B21BCD006B465D4B1D555.202.3912646404.297",
        "C_7A288281B12CD5978F882BFE4E06591343F1E62E2C1F812A6EF10FF3AC723D09",
        "C_D1B22386C05D6CCE039F3E2E81A633B5C0FFE40FF5DDEB6DE1E49489FD86B241",
        "CD_F1E9AAE7800A10F7BC98325C4E972C96F68F306DB3BACCEEFC0D635A11A01226.1828.2948381712.346",
        "CD_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655.12.2167383571.520",
        "I_D6891511BC8631D6D7EA867BCB13ED7FDCA6FFE780220289B76EE6569D609F63.2726.376950452.284",
        "CD_349E3A31D1133135695017907CF38FA6787B7F880BB1D36773A1D88E19A7CE09.1.993235433.177",
        "CD_82B5DE0B52236FBA718C6012FF3A7FD447F711EA1896FB5FD863DEC9F4CC1877.271.1806068916.520",
        "CD_651E1CF574F41D7ADB83E2088A2BE31E56053138D6E9D2570D7714EEE6709D8A.2558.4188312427.690",
        "CD_01F6508C1866E0E79B21585B0217BD595D533D4A180A35479737402276CAE352.263.1814521396.767",
        "C_D0256D3D79C9F0FEBFA5EB7501ACD139E5E7E3AD4E5333A7FA7B5464011E3F34",
        "IL_309FE57B0AB30723A7D25C630AEA84325DAEDA17B9713727A9184623284A496F.2718.443886145.273",
        "IL_5C670A419305640007AA9AA161CE0975646DEEA64973112E2DE223893C0FA422.1499.570302633.340",
        "ApplicationID",
        "CD_94F2726A101D2A1E24F4ECAA94319E60322E839528620ABF5ACEF14DF1CEC5F0.2425.414442577.358",
        "C_A97591AB6200CED26E3FB14B24594C24502E3ED2ECD1D03B90CDA66E21B32DA6",
        "CD_01E1BC020A762ADC8945816F21D23E994CAF727D5579290522A7B046C6C167F5.2547.2740247068.1678",
        "C_D40443FAA4BC832CC8C5119EF318B422387F0E5530C5A9E40FAC797FB6D785CD",
        "I_726DB399168CD81D137829E7E423593BC5984A9976A11F757044F530613326D6.2680.2747942734.271",
        "SECAM B",
        "IL_0B80258DB20F78C812419F350CB492491FD1F51CFDE794F94FBCCC1B7768782E.2709.1210721042.295",
        "CD_3E78A37E1DE70357C353A15D6BBB8A17A1D31F8D501ED8F1C3EB8104F5B04F97.299.4019040788.965",
        "71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "format",
        "C_25A225BFD7C0706940B21958E1B4E7879B81C1069B2DA72D3945C2F2A653CB92",
        "R_5E6C5AE950083E175CA12D415FB0E496349A073C308734F5F004DB31E4895266.1148.1910482409.536",
        "C_9AB73F8DA60B37A5DAD8EB945BB4F0C79687E3F0DF399D6BD50EEB5E9D647763",
        "IL_AA41A8343BA1D329E4982E46F903D80197DFB87E55CE7405A84B7AC638E427A0.1938.3012639979.336",
        "I_321148A67F08C76CE816B5AA8968830318FDD971163E19FE03DB272AB60A88E6.2705.901307455.301",
        "IL_5954B2EE48B0569ED1CF47EC527342448303BF9F4B0D574E1C6226C072A73F74.2683.775160014.282",
        "IL_75757880EAB8961D1A3C186FDB42A3E5F36F1FCF20B2679D12A2FFFCA63470FF.551.1.33689",
        "C_B27DA316981A9435E5F33C2E09D6D47737795150F8F8764872B71DDD4662D813",
        "CD_4B0679EF2CCA448145114D6A472865C92C4C9C07F908BEEF43360F54325B5BA0.2636.1415924492.1236",
        "I_CD9EC36D2D714FD596C89C8948EFD3B9072EFDBF46A4D8963108D0D85C3E7446.287.2963456541.210",
        "CD_A63432BCF943E97E2C33E4FCFB1880CB0F896835B1EEE341FAE246D77AE1B7A6.2559.1622902982.1168",
        "C_B295D8909277E377626B8A67422DBF8A8A8D1D4D62BA23B5F85473AAE33B0377",
        "CD_486730B0C62C887E945DF074DD24ED6717120317D02115D40420B0BF288FF266.1802.3921354531.1975",
        "CD_B37806D65A12F54B08313C4EED9D2CA81EB0583A9508D49E36A1323121A772F5.1570.3363215234.685",
        "IL_BA84EC20ABE5A08AFF533CB30B04D5E52B8BC5D61AE0EFAE5942539F703A04F7.2722.2481568991.281",
        "CD_935B071362B928DF8D6A74C10986C5790CCB0ED5E141E88F1610752926D4F6DB.2623.3358712077.350",
        "R_147CCC17B8B7A002238CCA8A8EB23A41D4D8038179D274740B42B93CB4583AE4.1074.4010199060.524",
        "IL_D06E059A85457A6E717907422F19AC6395529A2FEB736C01CF15AA098D540570.2709.2645312123.301",
        "704C2B50E4463864CF2615B27D56E94A95716A",
        "CD_E540585DCA2960F60394B8EF9EDC432CF6F41DA95FE565F23D6AD3E1AFE40536.1539.1099854327.481",
        "C_57E5D882D51A73B98D160F0B765B4683E2474C910159548BDA9FB2A8BE2E0941",
        "NS_8C42BEBD02EFBAC62404CD4CEA999A517B5A01487A2C77E2EFAE4ADBEB0788A8",
        "CD_4720AF4CA174274F71D8038B37E58001F7A92E2A83E49C05ABD2C15725C10921.2401.2398386612.302",
        "C_9D65F32BB045C84F10A30407BED77807C86E51BA801E6C1E84A72041D5A6B599",
        "IL_EBC8DC0D2750AD130E4002896E8811EB34F045DD11ED4983709CA779CA7216A3.2723.1628836079.283",
        "I_F29747F1B42309B32693FE58FBF3044CD0D70EBD90B65C0FCD3114E1F2EB0B4C.2693.2785841877.266",
        "C_D368279AC7611DFF322A93B0CD77B818394B5868D25FB187B8F5084FDA0E03D9",
        "C_DEEF6E11F8EFF79A39C1C076E84D33771696CCAA591C51477D7A5F5A26D53CF5",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2120.2905763984.368",
        "I_FD64A52CC0B7981195F173477472F4CA7515294815503FA15EE5A180A24C6DE8.1019.516358712.339",
        "C_66374619E9C0979063D25924688BF0A633AF40A0F101EDE7778BD7EAEEF33E32",
        "IL_1759FA689EF85045FCF1654275E53C4D9455D7E6C9FCAB0FA67AACCEADBB9360.1195.622011599.325",
        "CD_0ABF3D1589A9B18F0AFA08F69190699B7E9CE95E28F1B4B39B6534E41F4C3C0E.2558.3975692563.700",
        "SystemConfig_V2_NIC",
        "CD_2610AE43344CB8A8BEBCBF0C082C8831B2C58FDE9BB071E6F1F013E7085FE453.1155.469463893.470",
        "C_94F1590FDB905D950BAF02FFACAD42721EB43DE671A1F6B19626D4AD98635FF6",
        "CD_4D2B02733931A1414F84FFA98E841B8FB5019C035007B0664BF41E07873DA206.2534.3129275204.368",
        "C_3BDC2F0A0A90E9AC9B64A580B95D437559985136A7FD8C2487C72223A8541D52",
        "R_F22CF0C74A9002156D476F4DBA031C7F3F706A1A94FD4FF91611BCB6BD8FBB7C",
        "I_BD76E4E915E74A83D2340D42E4CAF372346456594329E68D465238C9A0D033B2.2723.4153164937.285",
        "I_DF997EC39F274D7BC0CBE37723AA168BCDB6FEA427F22782EC7E0536E0171BB3.2699.1076751264.273",
        "R_5250EC9304AFCED3B4B4C6E595A1730CDF3C33CD4C1A0C35D2E9C70B3EAA91C7",
        "C_84BBAE9FD8A6E21188B2D0767DBEB321A61D32EF3C67D9E47C565889A9DA260D",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2197.3533351326.188",
        "CD_048516085D0CFD11B2F57F36AC760E979F1E172A7E7675BE4EBC8F8315497197.1793.2726980417.1759",
        "CD_57711AB71326AC7AC810A538890F0BEE67A7DF25C7DE219237D14AFA4CFC51AC.264.3953272882.1952",
        "I_2131D12DF8DC91B90E78FC755ED4582266C39BA38311D0FBDFF39B35E73BC330.2711.3886806218.294",
        "CD_11966DA6B788C09A209299D797026F84E9D25CFA758BE1C1AD03FCADB98C44B2.2651.4143701268.258",
        "CD_4922BF9FCF270243FFD4F9D426E064C4BF15B5F3EDE04C2DF03239BF6E262DE2.1021.1.34849",
        "CD_09855C27687BDB8520C47679461255159BA91E0E3C4C7686E42D9642ABA23A95.2543.1472271915.496",
        "C_7D60A6BC1BF80C348C255CD9C78A30B16F7F9A390E537387D471354838C57ABA",
        "IL_84C50CAE138BE8DBF0961918247F6BEE4A1E2653F7AB56ED2DAD85047B7399C8.76.2268304904.305",
        "IL_4A337591F2CF0CF9A6CB36702CB9BA02C480D747C7FE0A4839C187B5572FC7B1.2709.917778799.288",
        "C_4FF6A0D7C7A873EB07C9F2EA16C1C5FF4B6E7F5EC9C729192D48026A285849C5",
        "CD_2A2D6E6AC8E9DC7CFD3B145ECD6507F431971D2D607AF7EC159B3B5EAE53046F.33.2142122399.553",
        "CD_75562CFBB77C496AC5F7654A2A8412CA6C73A2BA8CBA12AD5B61673913C280C9.2617.1983736955.1646",
        "IL_2493B293FAE24B9DB6F542A76F6954F10DD366AAEC07782F39E87A24408C09BC.1476.3634927419.329",
        "CR_094CD032BE77E24831D84EE3DE38C46FBDC0C57F2466CC9AAB2CC4B43209B790",
        "R_DDEDD07282B8324F60B5A48A479C1B42607AE5EA149F90058D5C2368C1337E02",
        "I_A2792B4AEC31F728576B7EAF18441C9644ED89D63F2FF60CB2EFFED7BCFB3544.2682.1515821774.278",
        "CD_2C912D30C6F2C9872585F2917A9F51466121BD73DCC0AA6A9A6D8C6362427472.0.3337754800.200",
        "I_0CB77DC4DB404FFC73A7D7CD309C63B25B8D493261A429B347895BCF6C673A7E.2694.3060068880.272",
        "I_198CEDBECF355E383EA00C07F341498EAF6FFEAA92AE5A2964D525AD6FF65BE7.1936.3456731293.347",
        "CD_4EFE28EFCD0C2B5177C06210204A407FCEB7434631D258DE8A983EFF1957B86E.1154.1020639767.302",
        "CD_342D3B3E95C15CE5558C1B7C7C427B6C66E4F69853BB4D1A94056D76079B0240.1.2617676423.263",
        "MSWmi_ProviderInfo",
        "I_215FA2B6AAAF72700FEDA4F12DAC195DF0005A0680EEAA6F449C9E29A3798052.2723.16826116.287",
        "Failure",
        "I_050953C58E97660582926667045FD157390A1B7EE9E1CDFCB3DD57BDA1E5B26D.1783.3258806950.333",
        "CD_D69FC867849192EF796EE1B806DE90914F0120B94B59D00FF9D8DE94BF138B71.2639.2673304392.728",
        "NS_D8D295EDF64C7F3A5E94E377F9D35AA7B08D0DF6C56C2323D31A8EE4AEE51E6D",
        "I_66A84D15B2A2DB4932978909375E7B7E078FD44FAD3E1A44F246DC21DAC037D6.2680.2694796933.282",
        "I_C2E2D7F294A39E950FCB0FE91EB41D6C66630273B2EF4990C97F60DB582F2E17.1480.1186044840.302",
        "%ProgramFiles%\\Windows Defender\\MsMpeng.exe",
        "ElementSize",
        "I_60A5765510C92FD1A23D35B17166095EC19CB0AF39A2470CE764AD667451BF6A.2717.2616565661.281",
        "CD_669DAE17C175FAC3B675D5D90C908AB50C0C5C178E12A057415922E3E43CDAA4.1570.2931076182.987",
        "C_BF863113FECC488583C3B24A38578EF328A998D46C0973BC43C2DBE34CE5AD58",
        "CD_5604D87ACA5767C7A56A3D5E3948E3BC37CB66F37B666A666269A63E689DEE06.1329.926314107.1648",
        "Event Dir",
        "IL_F5E021D5620DF76DB11A714354730BFDB3845D5ACC1D57EAF3889D51C85AA6FB.1498.765048173.281",
        "I_D084275BA14EAAA6BF00AE1A622764D7189EC037B66EE266070541F581D56ECF.2714.1988486237.290",
        "CD_272E5753DC3EECDD6057038DB6F26170E7D1CD565B954C6C4A406CB1BC2D023E.2756.2075621891.323",
        "I_D7A152250C610C2970CE9A6D93F6F33B21F6B08678E777DDE0EFCA493D2DB396.2679.2174348878.275",
        "FormFactor",
        "8B038A4089ED5626B5D1D159529697F84C38788359E6DFBE8EF8E26DC.2706.1103561493.286",
        "IL_3ED0B3FD4FC7DB80F64E8348D4A42B4EA6BA5C19338495C90DCAFE2FD4308C53.2677.5690151.273",
        "t71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "I_484E758FE9E8771C4D7ABA3AC78CC97E6F18D973A677D64C893B06012A9090D9.2723.4088041916.280",
        "CD_E2929E24A4D3F33074BBFC9EB2E285BE087B76057F553B22FB5CA19B172B3C4A.112.1704226478.626",
        "CD_0E4E110C89487B5FD6AB427D66ED1F8D51CB7738A04B3C4E1D9404F59DFE3267.2560.3714261405.607",
        "valueType",
        "C_1D6ECBE40B5437F7025E3AB3D98C93AE3CD05163ABA83C03E800D8940B38572F",
        "CR_44176E2582D203C4E24AFCA28B3D2E229104AC44AFAB0DE90ED2E93CD38781CD",
        "CD_A810B8BCB28B4593289F5B14287BCC8F9F33A8E5A5BE4903C9226502B53FB3AA.39.1964842008.520",
        "CD_7F6D7AB071C5599637F51EC5AFFAE51440877864BBF7579093A40694E069604E.2745.2597259354.368",
        "R_29E8AA5244375C87F1F5AB9F42A22D9A1B648F420047277D7A92CD564C59256E",
        "CD_E6695722F42AFD2A38B87A3A03743A182D780F4AE622B7E7DF87DC65E7D101EB.75.1430516308.535",
        "CD_D6A6EA1A8D221E89FC673A3598514D55CB598FA3553640D9F77DC1AF20825ECC.1603.884720632.690",
        "C_231C34EACA6E9E68FABB7AA3DADD079A379826158D2123254977F7CD79559E18",
        "C_01F6508C1866E0E79B21585B0217BD595D533D4A180A35479737402276CAE352",
        "CR_D40443FAA4BC832CC8C5119EF318B422387F0E5530C5A9E40FAC797FB6D785CD",
        "Message Description",
        "NS_CCA03770E562E2A170EDED20A589C069A2045A9BCD7412B77D068846D9054EC4",
        "Error Type.",
        "CD_59890B66D97A7EBBAFAE0E2B038286FC98213E10C2CCB5067C6CAFF2E8027655.1926.2600339371.1062",
        "07C56D4FA3",
        "C_7819F9BD391801AE3CE3F3C4B0B744CBFCC71ADDEA13DECCFEDE9307D2BCF35F",
        "I_92A7D456EF5B430C328FDC54E4DDFB623DA8EB3D625FAC2D624125916B534CC3.2718.1437127008.280",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.1973968525.368",
        "OtherErrorType",
        "QueryLanguage",
        "I_5C4C1F05C0F04C4E26AA438C1129133711DF946298177E9991FD1204C790219F.2724.4050780076.283",
        "I_9DE14B7E9F2BD68AFDB33C7AB12FBA084F48B20BC2ED1EEB96FF5377EC30AA04.2675.1428109939.276",
        "R_D5A3EBD97A73CFDC27E08386A530EED97BF2E30688C85397114E4C3FF38F8975.1751.1276060558.552",
        "CD_040EEFB9D32ACFDF35093E1B9FBC87E0DA3C6102445122A04A158078F02AF3C6.2168.807813711.4161",
        "IL_979EE137B7C11A7F0F75CEC1E27403E614C52F360419B7A48D6C0A49CFA16637.2684.1921070963.286",
        "F40D004E2BC1C3C9AA54865F4",
        "Permissions to a specific Remote Desktop connection.",
        "CD_AAEDA1FD61325BC0D86B140D66A91281FE871D9B4FBF60BD8537F2A662C67E1B.305.1511888186.1088",
        "I_EF834228966C1F2CC7874FBBF528776CCCACEA997767675859CB79A3FD180C8A.2726.316239879.279",
        "CR_C504B91CF040A007F72C24FC0CC99A78401C1C475112424D0A789E6908FEF373",
        "CD_4D8DFA1656A0EF3C4D96AD8437B73A10EFFDDE609C718E95E7BEF8FBACD2A3DF.2595.2374762855.171",
        "C_D32DA41D9017CF8A14ADDF68399E82398D01887534F91B652E82F022449D154F",
        "I_6364649A8E999BF0369CB45A4EC7F540D3070EADA1EC23CEDA2CE0DD36E90AD6.2716.791125313.273",
        "C_DE89CEAF49F8C74091CFA54D65C5205930932DBBEA319F95370A8BB021E5EAFD",
        "KI_818DB2B3AB26C49A2AEB1D243B555363E794DB6E712436AF8BBB2D25701B24B8",
        "CD_A15A00CD5014B43F15BAFD3D0F7CB556BF54FF60085CBA96C47BF4ABDD28D656.311.2693324341.1698",
        "vAE{IMQUX[^",
        "IL_A3EAD9474AF49011D7761EBFC6FF3E823718261785C28E5099B3B72B6959BB30.2729.387522730.265",
        "I_D17C32F22586C7FF68377F9A82DA79BF8D54BB445B387B595E64C515CC034A7D.1479.3870380055.302",
        "C_D372B3B5E5263BE45000B58CB0886A0FC67B0AB412380DC8153CED5AB90E9181",
        "CD_939BDE950037625234CD85F8C6B1EA2B080202B0F17AF76D4D121C0816452127.1523.3533172544.2351",
        "Vertical polarity is negative",
        "IL_6C11749CF1AE1583453B87DD92AA1C40BE952C725430FE95A9BD0EC19A79EF17.2722.2063478766.289",
        "C_FAE2ECC09FED2EB4B7A4EC8980CE634E75CF805CEDF86064A82170B68F9B5074",
        "C_5F07E9A66A14C03CEA70F14BB69F6D6A77D54ED7E0162E55A1871003B04B5B0D",
        "IL_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D.2749.3276073663.255",
        "R_DA2B7733DF2BD3EF26A98D0C67C53F3AE08EF07915BF46D535095C4431D97FF1",
        "CD_6AFC03E55253E21322FCA663D825D0FB816D6FBD02CA8A1BBA06E585EA971CD4.1758.3516343335.1783",
        "Require Server Authentication (DEPRECATED)",
        "C_9437CDD252D8899EB7AD00D86C43831F2CC65E71AFA52343D401A7ED5367A82A",
        "CD_524ED280AB38E3BD86074B4D556A261D98A4E9D85B8A2DCDD6AA2F85E3342805.135.3490861980.2345",
        "CD_E52BD2BB65ED90ABABACDFC8937D94C5808CFF6C3FD9A7BEE235CE9F6DF64BCB.208.4029438982.1221",
        "CD_097A52F05DC16AD6657CED4065B1B398CDB1D2CE8FFD05363E002CCDC2980FAB.1192.1382001956.242",
        "C_0165CAB89BDC44E6A103BBB55829CE27E96FFC1FBC965B1148A99781C10E7A7B",
        "C_57DAE5D6F0455ADEAD486789BD3D641999E687462388031EF82C523529E0E36F",
        "I_E00AA51439CFEF2CB1C8968598F9EDCB88E110D118FD610991FA2919E478D23F.2503.593264483.265",
        "CD_E367B12CF12DEB20E317AE3B028692F15635A4C17B759C34D4B8D5D615A27793.1.1934871860.155",
        "CD_3205C234B2D5F02B734949988492FBCD94159F50911E0F44A000D975CE1C5819.146.3772566482.453",
        "CR_0E5696839A5AB639CE4CA331881E4EEE21A91F994E8EF5EFC523806BDC11D8EF",
        "IL_3700AAC1070AD9D4B538ED8C2992FCCE657B6C2DD716241B57A2876AEAEC8B12.2711.362692361.301",
        "I_0C2827B0B19FF43CDB1184DD854CE1642571144637667019B118E6D6C5135F76.2700.3324796765.275",
        "C_C6360CC70BAA2BFD5CC045D8DF9E4E80EB0DF7ADF14FEC0C55CFBD508A2954A4",
        "CD_7DB8FCF5A62EB938976237647188940E46D7DB299B4C92C573081357C1E79365.2595.1774581504.381",
        "C_3DC91A797E626AC72558CF32A344BB47D2E2EC35EEBC7E9ECDD67B034B53206A",
        "I_9861CF067EDEFA63BB145945CD027555021C06D2F6160C33A61B587C410853D5.2693.1232529987.272",
        "I_F4D8FF98B431C9DE08E30EA0A5DA0DAF034B776838F75E67F5013FB3EFE9B591.2759.1485817710.283",
        "CR_B035CFCE41CEF1FE5604243CAA5700B13BB8AD4D69A92424A83B7D202927FA55",
        "\"%(+.195v",
        "C_55795F81C8422B8993E279C97F35D31AD4DD7851F75BE99F367F8BA09963EB67",
        "C_468BE71EAD96390F4DBADDFAC08A97896E0369987CA06ED6C3FE7833E35AE219",
        "C_5B81692050F83AFBC70426A27EC09C2345CAC4183BA0529AB3CFCE0E87409447",
        "IL_F7892AFD6D9BA41C6D80FE1ADB06C631B78639A087981A07715ED269E2F38DAD.2736.2125260837.290",
        "CD_6BE9B1C8C5C3B4255DA0665A39E69608A741A6E82E2CE4B5CCEEE025A6A87F82.2510.632908615.1753",
        "IL_F0942C8520796673214492D034FB55DB50870EA9B2FDBCA5F5104947C55D3283.2704.19907065.283",
        "I_DA69CC6321E02D0F3D5F134617631BCFA371EC60531D22F447951EA5C0B78733.2681.2658208212.270",
        "CD_EDF405E5A8AED1408B4231A69625FA74DED38312558073DAEE4924A3AAB425BD.1019.2505900894.317",
        "CD_410D7099EDD88BE50D962D5B670D3AC5CA5FD46428D3FEEB55DA5CF9C0146EC2.1.837364299.269",
        "C_56BB19692EC0F16AB4670B21CC11FD91410229C5E3EC8B45AF60003DC3CD47A8",
        "C_4AD29349B1757D9DE5B7D27395671493BF42FB1B4E0DC3C5CE33AC8A31C3C3D3",
        "I_EA5166D043906337C6AAA3F803574238733C1C80B083B34F0CD3FC0F90EA07B3.2729.1010944697.289",
        "Dirty",
        "CD_D5761D323211BB16C55E16614F63113A292B3522B59675D05934B2A4AD11001F.2040.825389681.1417",
        "C_C0B311FB88D088E1FF41B26AAA753EA711EA8CEB4414671F02FC20238411A83D",
        "R_0887FC386FA8BA2C2DB0458AF0A1764BEC13D490407167F361F1F0B4090E71B4",
        "5 = \"Run Recovery Job\", meaning run the Job associated using the RecoveryJob relationship. Note that the recovery Job must already be in the queue from which it will run.",
        "VESA DMT",
        "IL_4F5BFD54BFDCB120C9338CACEF0C2FAD83DD681A4080EF183BC2952802410422.2684.2561231253.280",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1078.185050652.368",
        "CD_404A8A60F06FF86C891EF2776F930A45A835547F74E3D08788D5D842F92EEA38.206.4287893113.729",
        "CD_894D1306345D6B047AD14593D78A9D4FDBD2D6DA5717032BE0FC560EFD5A0FC9.2578.4010047909.216",
        "I_E6EA3F9ABAB0F7F735ABB83D47A0BDA517A98F36F7D197BB63E64B363D115BDE.2512.997523342.332",
        "CD_5AE4D9A96CCED4ACA315569D7534DE1BE24FE40210ABFFCED132F6A8ABA68F50.2646.162676667.866",
        "CR_C502D67664F16B0C26C80BA30AFBE91ABD4375BB24F8697FCA1AF3070D29CC71",
        "C_2432A5ABBE7173FA98223D70B4EDFB312E0AA87F456103A25E4B4191AB55FA02",
        "RemoteAddressDynamicKeywords",
        "CD_532671ED26AC2835681FE0B122A526862616ED33CAB2C220F171DB7BD5AD8B02.1355.1842705089.461",
        "CD_064843E966479C3B4CF71DBA14623DC8C5CF1B385A02FDC292B3B3F5C45F4BAC.2052.3124294998.164",
        "I_4FCEEE0FC91DDAA3FFCBF86FCC6A36BE25C6B2A714B925F63A0F691C86AC0C6B.2676.3733151675.286",
        "CD_CA74733E8EBB65936479983FDEF15889A858264274FC3538A37DA4671D61B564.276.4167104116.235",
        "CD_E306E17928F5CE290021F4389D925B031C7FC2C7179F9BCEC2F74EEFB178968D.253.1172304572.474",
        "R_556BED9C5C7B0EE930A3BB6724BD19CEA9521081CDD971D1A19DD19DC37599CE",
        "C_35002FCC142049858649CB1BCD62043BE23AE98B3CC34288C266F1C2B8C4A3A3",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.454126105.368",
        "R_DDB73D0F02FF17367F3458F82AD4C84E13BBC8D3B2C869DBFA99C5BA8000FD1A.2461.1202471016.558",
        "IL_4F1213BC8D143D2FDF9FE58A5222244D36D58B8C40C030A2FC371FF1812DCFEA.2685.3502845615.264",
        "CD_FF70EA848D8A2CED13D60639BCB9255AF55EB37BFFEA39ABBA5DBDB0C764B466.2559.1926926699.1520",
        "C_2A7649576C810E2039E9EE14A94AD920395C83CBA45A6BC9D33333590A724EDE",
        "CD_C32DF9F947B29FF4184A098E1939B4BC6F452D2B88C38983D24946818DE6DD9B.2309.723445026.366",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1475.3487665334.180",
        "CD_8A299070719A67E2118FDC95A71E8BEC0CD6176770B7F252C94DA895AFA7A82D.2417.1767418717.454",
        "C_00677180F57FE40C90A823DF9297D042CBC58C7AF83C3FAD79D7AB4D3438298D",
        "CD_F15C23121D56EB64CEDC9D19B9CBACBF5742596C0D8EF3BAB76E325DE01F06D6.1052.156975340.1954",
        "KI_20F26C6236C8252E1FCBB508B5F5781449304BFBC276C5E3DD747A3A26989746",
        "I_C6AF1792603C0685641118698C891DADF409FEF593264B2F7959F4CCD4EF45C6.2693.970187483.265",
        "CD_6E3B0B1EAA3CEE6F69030D230938ABFEE442E704D8FB8F3769C2B3DBD83C3284.1346.3727557117.446",
        "CD_51F3F9CABF21479B5E00904A33BC282B6528414D4B4FFFAC999E337071761517.1520.3555833859.513",
        "CD_C4045A14FE292F5DCE118CBE7A18E1997339F3CB7C3124B21C33A6E18EE0C114.2059.4200095740.217",
        "o!]{$'*?",
        "R_ECA4BCE942A7519C8BD48784B00775961389BBC39B370F76AE4A3294CBE6E51C",
        "C_14D51D24DB66114873799E12B4A2E6FCF763C91E008A265EA02571ED5A0087CD",
        "C_D7F3D9E12DEEE204449B9CAA8D3A0464D39F0FE9902E503068BD45CB162CC389",
        "CD_4F238F7611EB52D50DDC75C17C92F0DC91196D190BA8E13F4A12D59BEF4C4414.1020.2634187633.252",
        "IL_6F56C35F680A05850333701C0F0A9B7F8DB1521F3B378B0B3CD05788894E8D2D.2680.4274746755.289",
        "KI_A0108CE261D6CD70D350F5B72F2E9874AE6E004D3029015B0919B1BD326BB649",
        "C_7ABDEDE62AF59CDA60BEDBDCA13049242DAF45DCEB3789967B7E6D43C5411ACA",
        "C_C19B458CE57692C92F3ACD4536E552D997ADC4C56D2CA218BF4C7284B38BE1C6",
        "CD_3CB16F7658F55687F79DE5BB04EB14BC84CDE14351D95F09AF20D745287445F8.1336.4149508634.2537",
        "C_58C24AFB2A991AA6785137E0BFB334A98FD6BC947AB0904D8F9C5CB0750B421E",
        "CD_9F25211DB7D04527A2718EFAB934C1664FA38400093282D5A337A37681C23242.1668.1.17269",
        "CD_6DEF0D7E940B545B1F815DB3466E2E096310F0994D59451D4A228F863D49F32D.1915.2259097106.324",
        "I_4E4095F9EC17EB909E41364F64990241F2B4AFF71A980DDB6074D12F3A7CFA73.2684.3820619885.292",
        "C_1E6F678E6BCE749DF0153368FB664AFDF910F4DA39F359B6718D12E67F50AF65",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.2473563520.180",
        "IL_E3ED1C0C53B3A12F5B72002368F8F9A20828885FF309DAEA09AC4B7573352F81.2686.1334017341.287",
        "R_E340FB8EB4DB3A4F1ED0804CB2A3406B4CA2DC92297E79DEEE6E8BA2BD0D28FC",
        "I_5D1CB9943635DDFFF5060D9D4FC471D7E4AF1FACF942A52D742A41C8A853246D.2728.2241789360.264",
        "E6c*Wu!",
        "C_C619EAF0DF6CA8AB0EC64764605BB47166AB4B422807E3FBD9547096D16318E3",
        "CR_B94A787F77AF023D219A0EE0DAC66FC04A9B36B8A75CF39D1E1673DD4839FE01",
        "CD_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251.295.4248856426.1247",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2484.1653932254.180",
        "PAL NC",
        "IL_1DF0C5371D8CF34F87386FCF024CF70DB077C88A753A26CB852461A42DA0147E.2721.3680098612.275",
        "IL_D9CA77A28458DAB82032495E4A3515F122C9C091BE22AEAFBAFFC1FCF8603676.2703.2057494158.290",
        "C_4B76EDDC0A97BB29191FFF0343FE28556E1B96E4EEC76B915F488D62FBD633FF",
        "IL_F0F20B7BC2BB8AE98761C771B26D8094AEEA9127BF8A7250DF1972ED91260F7A.1016.1267790705.298",
        "C_E763711E2F865B0BD95274A728A183E97B0FFE938A90F67174325F503A036106",
        "C_F868F055868CB444BDD76D275762DD6CA91787A71E8E2E82BE9CC7E971E6EDDE",
        "CD_BE8F1260CC7D3D8D65E679E452849F43342AC07EE5E67F79C0602AEF0D925B48.2761.4197131296.867",
        "C_3574CA0F26B4AC51BE1A9D13287FDF35F510716AB14315900C3DD347BA7A0FA0",
        "CD_D69FC867849192EF796EE1B806DE90914F0120B94B59D00FF9D8DE94BF138B71.2571.2738434751.636",
        "CD_71D1ED134C3945D531E64E4EED1102B93E591CAF758F7BDE265F8C737B6383A6.1564.2762323333.455",
        "C_F9806F1F2B507793E6A71330B14A8A23FB4580D5E9F8AB836C72D241C50417C2",
        "A request was made to enable unimplemented capabilities for a port",
        "IL_E3D7F95EFC48281E54DB3A2A989097F8A85E22189B283A6B9F1940D3598C3A2C.1778.1872325156.332",
        "CD_2FB30DC8F94A0A113AD4A141F719C8A8C70B3119C9037B1814178A55C7A7F2FD.2423.3429899072.683",
        "IR_C1051F006B768D96E4FCE6F2A8DC0C03012ECC7B68B7C95E31F5861C5B982207",
        "SystemConfig_V2_DeviceFamily",
        "I_18B6D4EB7C4A1ECD9E8ACA9EE4BB46AFABE66672A92365FB5A8AEA913BD3EDDC.1751.21967571.185",
        "IL_0B5AC83FB2725D33B41CFF3B51EF33467B960FD4E7B54F055ED580C64C086270.100.2571236503.268",
        "CD_92FBAE457B17EE6F876EEE39AE9C2C3BC4B007C81CA929319E36EE45F722CDC5.2587.1958331533.1359",
        "C_0992284CF6AEAC48C1F5BDF0973A6119AD14B4C683C698E5BA85ECEAF0A68CE1",
        "`qO6zTiC",
        "C_39DCEF2AB20FDF7CAFAA304F91E99DB86E3E37A5DC94A931621C7269DB8703BF",
        "IL_6A2D64311EC014F2420B69AC5E273EC9C43FF2001567839D1EEC32310C28B27F.2699.3027441984.281",
        "IL_DE1319F884ADBC5D67568BE5807174256941679CF79B9EA2CE82ED095CDE14F5.2679.2643554633.274",
        "CR_656CBCD78DC3BDBCFB58D6DE3DB4D810E2F34DFAE48DDA4A1B5D5CE93FB860E1",
        "CD_2FB30DC8F94A0A113AD4A141F719C8A8C70B3119C9037B1814178A55C7A7F2FD.2758.1119596603.363",
        "CD_938698B0DF6D498AC9977F56BC06022F271BD32FB79DBFC9EF3962F022C26E04.2542.146965719.666",
        "CD_6AC83E7C3405E237BE031334BE2B1588654DC981BE9868FD8B2192931F6350E6.2159.455123032.2050",
        "CD_B8A367B6799F63452F0D33325AE9B052BBCEE0513101249959EE38B74646590F.2580.3292332857.299",
        "C_4F0D52044CEE6BA44A797C21E074FB5F72A44E740DF64604538AC24885525391",
        "IL_6B4187392529ACC8AE266FF8A91482AC207285C338478E3710A134C0B31782AD.2683.1408610320.282",
        "IL_96BD44C201D86F0DBF6D193C06ED59D7A3A327EF4048CFECAB45DE235BD2A443.2709.2232911713.309",
        "CD_7EC6FF58E9EEF4EDC93B5F895A41B1B0DEC2BDC5260802227931619EE6182F7A.2409.808185834.671",
        "Security Descriptor controlling access to the application, in SDDL Format. Empty string implies allow all access. Does not support DENY ACEs, or ACEs referring to non-domain users or groups.",
        "I_25C266AA5180FB124465D525B63255DF24162F5B3AE71784F6BB25B65D0957D8.2683.250917281.282",
        "R_D1059F498C6D8924F1D2E27B51300529E1C8CFFC649E572AB323782BF6529035.1777.3569981422.562",
        "CD_756ADF3A38037C884D036F3D193150C71CD696CC6C340246CD1DB26B98747BF7.2424.2001867965.296",
        "C_26F2DFA12DD4E238DF19BAA4547B3B8EF9BC62B9AB940056F71629B35FA95FCC",
        "I_220C48173AEFCF83CE8603A9A9BFCE7A8CDC4D50C0929429223D9E2CF6DCDD96.1015.3271743896.303",
        "IL_205887C744703AC8F3F642361E4742AB22945D825FED20CA5B721B6BD1D35235.846.1.54129",
        "I_E1E7CF334D3BE8410218B00EACD988F6C3A86B3D0F743679BFCC3E63F13FB8FC.2680.501871841.284",
        "Sequent",
        "CD_5CB6A0A003499DF6531A245112372798390EB984E42ACEC32EC128E82F56ADB5.2760.3814778550.722",
        "IL_CE92B89E1C7F23AE2FE567D929CC5B9B811C8871F68DC601BC14263F301C4A75.2688.1420790750.278",
        "CR_FA52CB5E7D6BA7133233B22EA252FFA4A8C664E7F86ACC00B362A212DA58071C",
        "IdleAccounting",
        "CD_21F45FDE5CB0D8A9E63EE52BCBC43E2AAAE1308BD552214731725278E86346E6.2669.4213799333.300",
        "CR_B209BBC3E9792036932058EAFDFF59DF6B02D2E0E24C683DBB3CFAD2B25B83E4",
        "I_2794C24A33206B514450E2AD3A586863360805BAC3DD8B70881AA9199FB2E840.2677.1614396168.271",
        "C_7FB7BA0DBA074B35AFC3D4294E020BED8632DC6DA6BFD74D3F6713AC283B7860",
        "CD_CE00F2E7D1FE143547221CDE461E1688B57FA754557F032C9C2CEB24353C9185.2613.4015724851.391",
        "I_D5E2B1D144AA5509C690BCC9AF86ACAE0569ACC0B4301DC2CB504E9A2087965D.2727.4265016371.286",
        "I_22311D477D8BB476DB364B8EFB13C2770461078F73D1937E1045CAAA7594A1F4.1016.76579939.322",
        "CD_E284DDF7F9BBC191C804CE3AADDF197ECFC83C10E016C1AED712528DDDFB1F1C.1730.116998595.516",
        "I_F504AFA6F9A141BC7801D87FAE2607276EEE57A330DE33914A0D2EC4FF8C2BEE.1480.1412314230.190",
        "C_E6211D2EE9E3D772F3F5092CE86BF256E8A0ACC7D6C04BC5100CBFDD67DEE026",
        "C_85C6074F6112BC611F9B9BAD9B2B1988190242A8CA85FA687E6954F6DBF6F043",
        "C_4C51C80A2BAFAD3102FF110F62EC213D34DD3E23F9AFBD5B7FE6DAFCFBF7A94A",
        "C_4B00361A67C5CDF2974099DDAE160DCEF1B6C6E0313747F04CBBD7F11CCBFC71",
        "I_C6EA9ADB21355CF6DA787E0D8D62E59CF47237122DE78FA8959CE74E2782F2F8.2462.3241871843.335",
        "CD_C1B039C6B15CB1268319C147066B90BAE1F5E0DA59EE23E8DFE59CEDEE8D5513.2638.4051239417.260",
        "CD_1B410CA2C4AD84A438C361AB2935A45E1487677A7411DBBFAE5D52EC6FB1AD7F.171.1.73042",
        "CD_112D5871031FA8548B77FA449AA39B2BB51A4848F5CC93A4CF0AC90CF6249BE0.139.255788638.1036",
        "hl|\\x $(,",
        "C_50E2EF079B9FBAAF9D94FB8FDAA61134DC1E148B80881B48AAD04236871436C0",
        "C_4956F7377CADF88BAEF29AB167534942D2330E0E6BECB3AE4512BFCC91561A1E",
        "CD_8C64C742C17295C471BDDFBB0449A20033FBA45FC5101E58D4755F4826009F5A.1809.1231897365.265",
        "CD_FD962A7CCACAB88D552FB4EA114CD68ED5194A98AC098089803CCB7DCC90E78C.2160.1394293551.668",
        "CR_8124978EC1B10AEACA2D165201147DA1CBABB9C526A77FFC04D016C0C64A5CE3",
        "I_0B3D3B201DAF91954F37635E1B0484B26EAF205BF08C64EBC74A53FBDB057BA2.2696.3523574569.282",
        "CR_C955FE3691938CB4E504845F7B7CF5F1DDE17A84F886B06E297A90849911ACC8",
        "IL_529D75D2AC1AFBF725198649B43B0C8D813D2B8486436C04C090494A8AB1E0A8.2716.3197862783.273",
        "C_7F382DD324E73D1EE29B1DAF82BC1A0F402BD2F7E746EE4F0FBAA0F200B37629",
        "CD_778AD787830FB6503DBDA7CAA392EFCA8ACEC01E4CC5031286B5843857FF9554.1337.3469448704.2540",
        "NS_127B451CD685BF0DE131A6787BF6B66926311BF5D825DC0E69AA8DC3B4ADCAC1",
        "I_BCF5D4FFA95493F49502260F4C40EA5B4501BF1BA80B2E34F667F39D273CBA23.2692.1219757758.269",
        "I_95FCC1852F7D47EDE857E51B1C80EE9C502F62B794354E0C4EDA55E4D70B53C7.2696.2152323564.275",
        "C_1FD7B26C8C4FFE0BF45F5DDC5492AED41895B4A7FEA3E20CF6E8FADC218E797E",
        "Frame Relay",
        "IL_95CB120F7297824918CEA5A1263DB00A65E3AF757627DD3A88751B475FC39D92.2504.1665161030.294",
        "C_C6C7322634E5ED35EBCD1F5D0E8BFEDB63442E280DFDFC57940A99EEB54D8018",
        "C_3DF6C8A32B6DFD5082D03F7D9A331784CABA023B138F82AD0F1AF437E7F59DF0",
        "CD_3C7C27E9E69E2100F7687A005817F1CBD7EBEA972CCE25FD772EC69DA58DF296.1259.1.51793",
        "C_46AA6DB53AC46BAA33853977D7E4DA4D42054013D01A0E1C7E44D0593EAD8697",
        "CD_0E81B0078BCCCABE83B42D33CA74161EF66C3A92F490501FD2245115FBCE545D.2401.723172469.1986",
        "I_17DDB24E06C80D313A770A8371F66D654B7CABC1BB0EE94CAD421F946D9BF27D.2707.116747591.314",
        "C_3A1E8C6ABCBF6CE8E93D082CCC274F6AA9174C864DC045530449FD4EA27D4BCC",
        "CD_8D853E1BDB26604596D79BD889DC19104FDC79558D9E85FED9A1E91AE19F5837.1330.1255486229.1625",
        "I_54BBF40E19FE5F0CE8FD57918CEFA4A1969D570EBD46B32003DB10D6E81927AE.1075.15506189.186",
        "CD_FF26EE1E822090646FAD145AA9A6AA2ADDD373CED2E3B2B3D92A588873B3BEC9.1190.953010909.244",
        "C_168D1FBC4F92BFD424550E619A823212CA28C3AA57199386A543480216F80081",
        "CD_936BC108002D796CB3D4C11DD4392A4B48E3CD97B36DACA42B975D9D84CC7463.2592.3251624323.1401",
        "C_14BE33F6F696D0BE50F856D0D30EA3D3F6599DAEB2DB2FE27EC78B72EE863191",
        "CD_CDB78955683E4A4FEC301253A65C7F4393788ECFF600BBB16F696704AAF38583.2667.3565597108.791",
        "CD_9DC0A5652B71803D627A0DEBBA10D1832C8C71C7B53C3FDE13C8544A09726631.2163.2690388442.6813",
        "C_9A0B9BE92E150DE97D04DFD1D25F032060FD23B9216A37E30A99CD1239F28BFE",
        "IL_B8EE61BA0014D46C757C730412BF9CECF1DB43E7B29AB92088ABA2A97A58F27B.2701.547806292.278",
        "CD_177D26EEC1A3EEE9C918CE0D02D131303B46FC66DC9D37A73FFD4DC66006CE0E.2562.1.8577",
        "CR_E4E3C277AFADB65E535A86CD5AAE23B1AEF585A2BE1A21A282B170B7F4278F9E",
        "KI_C0C025C38981E58EE50CB7BB4E4786CBA14FD933E638861EA3A6A2E0C806211E",
        "CD_73C8D20F8CA3C376F0CE63F48C27E4D700E969BEE425C758839EF39468252510.2442.4285157985.713",
        "CD_500B791BBFEDD0EF6DC1FA9B56C1442D75CF8FCFADAEBCDCA51CF4251B2B1ECD.1958.1163361281.591",
        "R_9F036BA68CA921AFF06984BDB9CEE80E8A2696D8DB098A0C679A6507C62F4DAD",
        "CD_AC63429FE4716555DE1C78C4ABC52C6F5128C0FC3C7A7BBC67A237A382D5F3E5.2472.881420476.507",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.180.4072806678.122",
        "CD_0F7A430DEF253394F97964E584980B0C9B20898A34602A4FF7CD0E3D7511EDB6.2541.1333916306.504",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1936.1115957478.180",
        "48<@DHLPTX\\`dh",
        "CD_7CF10777A83944C691D1A683CDA92A1AC66E7CCB112EC02DAA85CF4E62053EF6.1777.1695040606.251",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.297.864305396.180",
        "Not Available",
        "C_F145A6FDA9DDA8FE3479DACF04486517A38EE43E84A8A1C9E4CED735C9CE24FD",
        "C_22D8A39A1CF9CE9CE697F268DA58EA0D7E31E6462A1BF40587EE288638CAEA7B",
        "CD_BA885398BE174F1F7801A16318AAD62AEB981E3F5EEB2272CF873A91B96E49E3.190.825298717.4269",
        "C_0AA4B25606ACE1B27A769310C3690CE6F8881D4D211004373368B13CED6A08FA",
        "CD_7A6AA51FA3C366E6824EA7F4B97566E3B04D858CCC46A0E172408E22570C1F7E.2529.2562470878.4085",
        "CR_9DC0A5652B71803D627A0DEBBA10D1832C8C71C7B53C3FDE13C8544A09726631",
        ".CE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0",
        "Resizes the volume. ",
        "C_FA21EBCF6E5D32820AD55E9B2F2B94C75A7711947B6C3050C8DBA3A61357B1E9",
        "CD_A3CFA2EA2CF7EBAE83315F59909BFC6F8978ACBDBD24E7ACA6B979B7B86A9975.2033.3840105443.197",
        "CD_707EE99B189F38B22A202668F97D1506AB3E7D7110120E38ADE31DBAE193C07E.2598.1544690405.86",
        "CD_1B1F12E77F513A1F34170D72EBDFB89B7AA666D5ABEE6CC04756D419F4107E74.2378.3246330840.786",
        "CD_70C90949E0D1D36557D4029047A128AB1B87AC928C46ECB81EB8625954A4B495.2621.3464816575.306",
        "CD_EC87315EA07FEB82B95B6ECC853900B53DFD9FAE520CF4C1FE8CD7F52B679C09.78.1.8441",
        "CD_EC218CCE39B1A69692B8F67C46683B41BCCB3079635712D8AAB3061393D01076.1477.3662383928.192",
        "63CAED9A02B73B9B563740059198D9ED7DF28E5923A029E487.2729.298670185.264",
        "CD_0B9091A7705333E08909D2D04FE2D8C67B717AD489BDF891C00D458657EAF4C7.200.539872924.7343",
        "CR_44B2B33F232E78585BC06F82C484DB1BDFCFCAAFCAC5D29C12B11CCF8EE5BA88",
        "CD_8219AE5FDEB0734346FA82CF8304A2DED0377556768BA6A8933AE5DD15664AE0.2587.4247075506.1722",
        "I_90EAEB9E7832AE37A430296BF8D528423F4A2B78383FC56899F558FF340CB602.2690.2797858148.268",
        "IL_445507205DF7D1E1BEE19C348E5F25938E56B8183FCE82C7881903791C62087E.2686.4059942594.274",
        "I_02E3B029E91BD2F58BF6CF927BE5C0627DB8324470F3AE50EE9B8F6058666DE9.2704.2346721390.289",
        "CD_3EC633BF060A39C201FB3365682E90372DE72DDF28B24BE016E2C6A6195F1EFB.1973.3820499023.578",
        "IL_97E6172E74E893520E1CEAC14F93BBC3873069D2B734C94CAF9ED72724C5FB40.2733.4177148411.273",
        "CD_19BBB29094E342ADE6943287FA27AB5704DB7461B952CA2D3D236B915D80FF5B.2576.1556382695.874",
        "CD_E837FA5B478BEDED44320E3A480DE1EA4A5820B99185EB351156356529FE5C28.201.2691450945.860",
        "C_23E0D0B8777EB7B06384C6C4FEA93EADF588BEDC4180BA0D86CA1E1ECB843EC0",
        "IL_B118EE698BE02687058C3362FD08FEA7BFF7E07108E3DD6784657256C3E1834F.2724.3765932508.283",
        "IL_DC929B1288558AAD28038FDD84EC14EA0E5B882F6B557679F005D20EABEACEF2.2701.2981207781.262",
        "CD_DEEF6E11F8EFF79A39C1C076E84D33771696CCAA591C51477D7A5F5A26D53CF5.284.1297834337.1373",
        "C_0ED1C3985408CF8B2B34893CFA150055B29DB00EC2B161251E2022B947EB8ECF",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2088.672349805.180",
        "CD_8950872A12F7D2C94B8C7D080DB29BDCF4FDD3AE62780BA9D92B3DD00B3F7D6D.1129.1472415037.778",
        "C_983B4451C80CBF8C28AA7D3AE44B31F386CD9D49DCF52E720114DECC8C984041",
        "CD_FC8B41EB78B371A9156F12694B821F06ED5FAA1A372B17839CA0FE6258178DAA.1876.3003763383.346",
        "I_AB77324ECEB43D44AE3698FAA1E0A0C60B85CDDC8B1485179C442181DCD968BA.2735.1052961339.277",
        "CD_FCC0EDCD98987B170977FF03A99675590794A9287D1EA9AC977901A84CA5EC8A.2489.2970332487.1663",
        "I_8081B8C91C1BB9B5B5AFEC1FB4FCDDCF11F2ED723DD22BAE1818E20E5CD22E04.2716.3969617142.281",
        "I_91572A941C754998E2E40E6D09323D7020C1641D86272396AE2BF71B7A9BCC68.2707.2117245439.298",
        "CD_E7845F3041269988C5A1847DE98EF0D88E59CE50ED3A8AA1E310C1A1F393BB81.151.1621844215.348",
        "I_3E4A819BA8CC28DB3EBF2245BDD33C8862E18CC1F006DA28F99A8DE39B4F23CB.1014.1796014734.286",
        "C_D3A4E8FE161CC4A1F531817BBE934C433FF20A5861307C6E0D6D08DF319C7AF1",
        "CD_1FF99FD98547CA076FAA0DD1F2AF44F1BFF4454EC9483F61CC85AF85FC12393D.2613.3902641381.364",
        "I_A0C7E06B49DCED80A3BEF7A40C85A5869C293D4E559E80C1A5DBCB8DF3F1149C.2702.3535107535.283",
        "C:\\Windows\\System32\\drivers\\mssmbios.sys[MofResource]",
        "R_259C5FBCDDA2F46A05D031FE1474E0BE7FAD9CC9F46018D9F05C6852D39E0093",
        "Driver Major Function Return",
        "R_32F111A45E7594771F4B831EC4C51F536473C63323692A7F6C33516AB1164EDA",
        "NS_59411655A8F95EE7BEABDFB898861DFA8E2BF23293A8AFE96B2E5BB236E7FE01",
        "C_26A733ED1A98D240B4CCC7A4F1493F59464EF2A0970B39F2C9B821A24049FC7E",
        "Er]KT$Nux",
        "CD_3541C5A84659CAC98F91C5637C1C9F472B091ECDBCFBE8002BA8E0AC93E4496A.2554.874302772.530",
        "CD_D342013599855A865E248E2771354D6599E6CC7C20CFBF4356520ECD87A126D7.1551.1.29660",
        "AllowRedirect",
        "CD_520C6C258019D67D7AE1EE1496B8D93D4FD98E1A9CA11CE69862665A1CB25D4B.215.3705013756.509",
        "IL_629FDB613B28B97B89D4476B67AEDA9C8857AA702527EA669F3829F1475A5431.1075.2681718548.186",
        "C_F4FEF988E7256B64289F1FEF1273A667F21EB83A5DB1731752AF9AC27A4871C8",
        "CD_468BE71EAD96390F4DBADDFAC08A97896E0369987CA06ED6C3FE7833E35AE219.2534.1300651731.499",
        "R_5FB7EBFF7E65F2B5A8D86A305D94319B3C99F6846C3536F671E3F448D940CE69",
        "\\T`x8t",
        "The Open Group",
        "CD_4ADAB88E88FA3365EF115F04B0CA33E4C812E19F7552260C1DECF170F7399B0F.1194.686866415.603",
        "CD_12FF1403706247189D78D34D4BF5A52AD6B7A216ACBCD5F201B98855D7C7F8E4.1329.2874951537.1617",
        "IL_4BD704EFD82E90D58D3C406978C7C044F013A64518E8C54785195D2358D9CFAE.1806.3545598754.276",
        "CD_51F3F9CABF21479B5E00904A33BC282B6528414D4B4FFFAC999E337071761517.2136.2442725491.643",
        "I_6DA2E915A7D0F1546EFC6CE718DD07232995DED8C409D2D6CB07F6041DAE5E2F.2717.4225387875.272",
        "2147549445 - RPC Server Fault Error. ",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2167.2887667098.188",
        "I_CBCAA80C85B61EEB89C59D11E82160D510413B50184700B0DC7225BB3530114E.2713.3614247248.297",
        "IL_4FCFA3F9AE48D205EFCAF39D83C31E8BE1862FF7B8766D68269B4335D9A043F8.2682.3389959600.283",
        "CD_455876B64E565F4962FC035AF2C8087D1797E42AAA9586F45C5A3E20F37175C3.286.2237151350.450",
        "CD_0A58F1099E1858890A23C17CEB7DF497DF64C99BE6E6E018304675E56C7BEE40.29.3514967253.473",
        "IL_53D75572FCE95F80C91561DC225542041A284A87D7D3C4BC247CCB4A988D11E5.100.3929026545.302",
        "CD_1F3197D7C6521D74E6D1E769091B4B54E59448DC4E720E9578B42FD15142C60A.1542.847266794.2146",
        "C_85B4B55B4DA3A76844274036843269B38513FD6871B2701B1927FB85D7B8E8B7",
        "CD_D5761D323211BB16C55E16614F63113A292B3522B59675D05934B2A4AD11001F.1354.1887497746.593",
        "IL_8C8B08C63C60FA495AD4A37FD159E67F25E9095E1F11C9A3B0D2BE0439540AFC.2711.1229956133.286",
        "C_C80F6E9FDDA5B4FCB7E91E04A37B343ACE2C1B4C4C7D997B61E1037420FC6413",
        "C_F21F1D740D9B9C099DB99FAEA668DEB9592F3D05BBF3FF4FE3FFDDCCFCCC136F",
        "CD_D4EE14E9B8DC621A0E06EC7E7B7FF7A062EBF6FD9A03F97DD9FA99C22506F07E.197.3282239844.707",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.100.1983798760.368",
        "CD_1E4F7F64C6FA4C6BFF02774064A8D31BE7BD47D4E667FBBCDE1CCED6C19DEE3C.1598.535619555.623",
        "IL_484E758FE9E8771C4D7ABA3AC78CC97E6F18D973A677D64C893B06012A9090D9.2723.4088041916.280",
        "A Win32_FolderRedirectionHealth object that represents the hea",
        "C_6BA587F6AF181129EF94B57125FFF3ABFF81218B46E9C3323CB782B9288DC94A",
        "I_643C62C2DB1DA96A4AB1598E9B3EA5327704B17FCA98FC5E2D4F441497103580.2694.2934335121.278",
        "Pred Fail",
        "R_F2BF551D2C47E413C4BD58FCB0E48E0B3211C53383EC4051E655BB8319ADD47D",
        "CD_2703A8E21C310CB49F8D78606E1171ECCEEAFC54D7874D34C41113E240A97A5D.1191.1886593908.621",
        "Transfer Size in Bytes",
        "UseMultimon",
        "CD_D847B696615F74276F510B61C4D4B2E1A80D45A53AB93D7AC103F7CEBC54D09F.1561.779686053.571",
        "R_556C6D300BDEA99DE8588E2B5D8DB1D5A33F34F7DA1F6E6A0DA0951B22252081",
        "CD_37B5E41337BC2DEBE4978DA36B66C355BB5CCC6EACD73D55AE155C2E9032B9DD.2545.1258606476.318",
        "CD_5E46683FD84F3219E379253BDA01FEC308C95988FDF4807D31199D70DC1E39D4.1830.243613312.416",
        "CD_D026E850A950A9D63C34F64A5E38E45C3571A8EBA044220775DEEA311EFAE9B8.1958.560487097.591",
        "CD_5CB6A0A003499DF6531A245112372798390EB984E42ACEC32EC128E82F56ADB5.1083.3049332099.722",
        "CD_3303D514509C890AB8BEBE50F44B913774000A6CAB1EAFFC8AC95F2755DFAD1E.2443.944030150.481",
        "CD_32BA494AD7426AEBC66A2FD485788F7B931AA8B5D73A66D480AADA613122B7B0.2635.3378671996.1131",
        "IL_154B639D792F97524FEAF961CDA64CEB4858CFFB277AD3F35C3C43B7B37F9DF8.2685.2383849509.262",
        "C_B47F156CE22E5A2752D5E542D2A77EC08E0BE3C5145CCE8F3E46DCC3D35C3613",
        "2A1BD4A1EF145F3C99D41",
        "IR_F5FDDA4F96E1012532E65A365C05BE661ED9E25ED5B65DE83713A92BAC59E2AC",
        "C_30756419C75AD9071C6B26EFDC29E973F64157E9E9415823E0E0D4E3B981BC76",
        ",048<@DHLPTX\\`dhlptx|",
        "R_D8BD75C31B4188F58EE7595C40AE39A7BCAABC31F390E77957F1B4DAC7F7FC4A.1067.2176329414.524",
        "I_2653AD5506DB997EDD160C597615CED8DC5051430F34D01AFC27AEAC56407DB4.2707.638319484.289",
        "C_1388B74AC4B1A1248035D019490B1CAAA479C4415233A9E50223DD0802BA383C",
        "CD_8519F629D57644187514674C7FCF7F8B0B70EEA799638913C1E17DC7E507CB73.2228.2036279718.1805",
        "I_135166566E800EB190505E3C7FF772C1A4A90F934CC4DA71A9874466D85A98FF.2677.1690590847.279",
        "C_76FC0B4AFF84404E9F25DF4AA97D3CC2B42B3C84934BDB4647AA8D3D31FF5644",
        "local-system",
        "C_1AAD15D0EB29FC4E49A68DD6B88432FE2B29874A40629B9F43B85BE2528F2B3D",
        "CD_DED77797B1689BED6B94AFBF9C743E829865A2A20644965BAF07B0D354CDC951.197.3412702347.851",
        "CD_062E519DF64095D82428626FCC1CAD3361E295AFA643D5462A0FC5A948BBA34A.2645.403509107.790",
        "R_FA518327502159AE84FD3F6F4EC621E64209CEF758E8DC599CB8C2ED467053EB",
        "CR_6C756EB273723D495E0077DD8DF32546A295F700D41FDDFEE417E7E6BD757CE9",
        "I_06DFAB71A3D8DBB356E2B69812AA4BD05249772CB8E5CA24F5D2BBA6FF1926AF.2469.3633344261.331",
        "C_ECE4D023CCE2A8DA3585E072533CD9C2FABE638E31BF9A9356E6B337DBCD49AE",
        "There are not enough resources to complete the operation.",
        "C_CDE927435CAEB1D62EE8A15E5309F00C6263566F2B069604C803AE5D37D85A14",
        "IL_6AE3DC7DF7E343BE6C05459A97DD7F3FFD2C5DD77C327113405CBB9D1D012CA0.2696.4194901714.273",
        "R_231C34EACA6E9E68FABB7AA3DADD079A379826158D2123254977F7CD79559E18",
        "C_5C019BBCF7CD2BCBAB2E1080A9EEA832173CDA76E5635A18F883174B94FE0F77",
        "C_475DC738959A6644A439D03D5CB8431B3F6A7C1B747C351A2E92646ECC0B1213",
        "I_5048D981A8918290C35B6F3CFD74A1A8AB3DF57DA776309B4775A5049506044F.2678.3507054416.290",
        "C_61BD99E07DD9B896C168C32D63CDE78875D8845FB21EAF979A76CC25C89D073F",
        "IL_29423EECC0C80705D26DECEE443B5A95FF519CCF4367CF59F0D98AF49CB87433.314.3567425932.185",
        "The virtual disk could not complete the operation because its health or operational status does not permit it.",
        "CD_BA1712135E2C9766CB6DFE0CCDDC8590C3F7AF3B44B9DAE601D4E1FEFD0E276A.2196.533082962.661",
        "C_33B5610D2FA7FFB4F03D69D80739EE47F91550643A1F839B5E730B9BC59F3A9F",
        "C_A197A2E8E346C5375E5D0AF295B78A2E735B718CFC86D2835DC277AE3619AAD8",
        "IR_752BF18DDD5A926AECB492CF5F791DAA2495FFD9675699FBDF61554FC1FE5AB6",
        "CD_487970C846EAAE83F1C18D91427BE18DFEB32621B7F4638C663D34EA5516710C.1059.696724150.488",
        "I_70DC379FAF6D0138A96410FFB376C0F9F2BFAD3CFE410925E1F60D7597D58E65.2730.403174953.264",
        "CR_0ED8829CD55CB10045BE12FF28DC63BFD30CC65BF9376DAA6A5D15ADE3CAC700",
        "C_8D357DFC4C878A0DE5A366543020A4BEF98C2B085CAA548AF24CF3ADFF66C0FF",
        "I_81E1B447115AA495169E968D729B808E6AFAAA8904F1D6ECCF6F17BC5CB9988C.1094.2847669381.276",
        "`xlh,048",
        "CD_6FF828EC04080EC9C73773961C6786394920BC16665D53EC22DE1788D6AD154D.2651.2008457919.666",
        "IL_7936F4E9E742684133235874979A0A6DA7B2773C2CAE6185B42674E8D0E79BA7.2683.338989049.280",
        "Number of bytes needing synchronization from the server to the client.",
        "IL_CBB7FC2D702638F2B6EA795EBD56AD5F16262F1969926AC916906FB0DAAA97BB.2682.3415943441.275",
        "CD_622368177CCCD4D1F30C92569493319DE5ED96D12790391924374F88DEB142A9.1559.722791420.1925",
        "uint8",
        "I_E1B0B84F789F8D4A723143E6CC1D687E2507C707531AE083C2E8886AFB9011D4.2725.2998746778.280",
        "CD_4FF6A0D7C7A873EB07C9F2EA16C1C5FF4B6E7F5EC9C729192D48026A285849C5.40.2129231988.241",
        "C_88057F4853FAFFBCAA324F022CBE7B7579DAEAEA64628A39AFC4B91F61CE7752",
        "IL_B72DB25D852B486CA279896971C6C5CA3485A2040B48225AC280E3B83AB61766.2694.3709484382.271",
        "C_2A4F98E46770D35357CEB6ADA3489C9F0FD306040FCD6B065CED71BECBE5700A",
        "CD_08F544E69EA05A815B974A37DB4AEA943B8DDCD4A90A8DEB8F8B62D690EA1619.2672.172686534.618",
        "R_5953574AD268C37F4681AD557CF3BEA3442C419F9086A8F65CC3774027E8952E",
        "SystemConfig_V4_PnP",
        "CR_639FCCE3DE726C47FF30745340C22FCB819E5E4DFCA7546346272EDDA843022D",
        "I_35B3BA3D4E3452B9FD358FEC9D1F382046EF61B6EA2F3D32FF2B776BA565D15B.2749.851527284.306",
        "IL_0B8645AAE8365A921E6AB402A97682BB4F516F905DBB8B814BF3EA695FB9FFF7.74.4270898279.352",
        "C_0B58988EE51E845FF30CE0AE20CF3552F562FD4E143A317A18BFEE7AE063006D",
        "I_DEB3483995C458731139A4CE82083934DD30E2ADD62D3031814AC6B04852F167.2706.2086234859.293",
        "CD_F2984F836656306DFA8E2AE41D08C60DF8CD88A0E6AEAAAF9B747A88F60C0C5B.1463.4253010261.610",
        "CD_4F646AAD57F3432C253520E0CA1B158B33F1559C208E36C6F6CACB8CCADE3139.1333.949978441.2217",
        "CD_0ABAFED91AF3160513FD4A097A7FC5F22572733C3EBFF5EDB2C1119EA3585424.1616.1780296830.792",
        "IL_A258CF02BEF223BFAB6BA5CFC7CC4706C5194DF3E20F2157447169D2255E897B.2712.3087737123.300",
        "R_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170",
        "CD_5FB5EBAFE683F2B8A9760625199D7A9E30FF040F32563D01A62D2DB109DD42D1.1568.2220944701.4462",
        "CD_DDB9E5284035E7C991E364E045E2FE8D29BD27906672F0EE3919740EC2221800.1849.4289825189.297",
        "CD_AA41A8343BA1D329E4982E46F903D80197DFB87E55CE7405A84B7AC638E427A0.1946.1.24524",
        "IL_AB77324ECEB43D44AE3698FAA1E0A0C60B85CDDC8B1485179C442181DCD968BA.2735.1052961339.277",
        "MS\\0x409",
        "I_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.1670575241.360",
        "I_801E730D1DC30DF33D03872644EDBBBA856C89C0BF94040CB2AF6F25FD261AB9.2715.901176634.290",
        "CD_9AEDC27392ADF6836FDF14F702636E837186EC380D2BECF38CAA9ECF290ACC9F.122.890740700.573",
        "CD_20A86FF9BCE2704D3211C5DF2F6EE611B397EFC650CD0CC8097C4D642C5980FF.2195.1202782095.1190",
        "CD_61F33C9DE75CB13B4A6469AE01D1FD6BD56B098ED457BDC27158A62BBACE11D9.2758.3160692591.363",
        "CD_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2.294.305479693.566",
        "CD_BF2E32F34A5F7D261B7E7910E52DB1F5079B7B7A7D2B77621CB4C50273B0FED9.2540.2919858040.510",
        "stryEventProvider\"",
        "I_6AC3B256775EBDB5CC7BCB67660B77DDB0CB42A96EB81FE29EBCD316CD3971F0.2726.2952311574.274",
        "CD_48D4F256702BE1E23719E035364C5226D32D66BD4161C39CF31B8494F0ADE28B.2760.2484762327.4110",
        "NS_70510928A17E0AE7C516357BFE4903931B93CD566BD3293C433D896D0FD7AFC0",
        "December",
        "CD_D0F4E3620A7828AAE5A40AF4D4360C5582C0BA2DCD78FD96FE0C14267800808A.2670.1670646031.1130",
        "I_59BFAFEBF60E8B2104B07BA7FADAF4FCFEB18999FE92B11F1C00E938CB4B93A6.1020.4071404913.270",
        "CD_FCA23D7E7FB2A6133938DE6DCBC133A13C9DBA9E399EC6CE05160880408CAB52.2484.3528385047.310",
        "I_E5C6355DB89C2D0BA38D309F93C594B4514016C92E6D96D5153661EBF39CF9AD.2695.3386892871.273",
        " 64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41",
        "DefaultHopLimit",
        "C_6AD386ADF7788A35467E769D3EC3DE89211503B8A449E2B53EAB5B8CCD719DFD",
        "This class supplies the PnPDeviceId for a specific device",
        "R_681F04C717B34C7842AFE82074DEC59FCDB97C166864F9245FF3327284F1AF2E",
        "Eu{HKN",
        "C_3DD77965331D6A3ED843F982AA9DE8CE1497BA7CE8488A02DC4AF69E8AEB7A94",
        "R_0ED1C3985408CF8B2B34893CFA150055B29DB00EC2B161251E2022B947EB8ECF",
        "C_52F5ACBDAE24F4A28C0779E6C390795B2874AE035CBE1817D5BCF3119F482468",
        "I_6CE79943F6ABBB9DF682A55D8B4D22AEC9D2E4EA593752762B78D600DF092301.2701.2774636790.293",
        "R_3FDA9FF251C6BD5841FB280A37A767A97FBDE0A3950C58F141AF2BCE7A64366D",
        "IL_DD8055C1F282549114EA42F9E9C43B0EAFEB97C566499DA3B9764E61B5C7AA7F.2698.418076095.266",
        "CD_7C983320414DFF8D2BA0128B25033C8FB169F5189449E13D88BE3724B6F2E9D3.1936.1474054375.585",
        "CD_9B01CFBED85021F674652BB25CFFC191CB28785D5E349AE5E91AB199C2788033.2570.260960157.1201",
        "CD_C95F3DFCE1D4AA3558DE11BE7F4A4D14A06E95D50BB19EA639F8B6302D753409.1597.611961323.522",
        "TDP`$",
        "StorageWMI",
        "C_47C79E62C2227EDD0FF29BF44D87F2FAF9FEDF60A18D9F82597602BD95E20BD3",
        "static",
        "CD_0E5696839A5AB639CE4CA331881E4EEE21A91F994E8EF5EFC523806BDC11D8EF.1153.3131162578.264",
        "OtherUsageDescription",
        "CD_936BC108002D796CB3D4C11DD4392A4B48E3CD97B36DACA42B975D9D84CC7463.2662.2010777537.1108",
        "CD_CF5E27B8D911095CD7FEC61CA4431ABFEE0B23C5631E7FF85508BFA2D107C4E0.1354.3107404731.302",
        "CD_523C638C908DDE7662F7522F26AE86EDDEE32DBFE4A87A273D23892766373D37.1348.2350966817.974",
        "Turn on removal of items from scan history folder. This setting defines the number of days items should be kept in the scan history folder before being permanently removed. The value represents the number of days to keep items in the folder. If set to zero, items will be kept forever and will not be automatically removed.",
        "CD_99526796DD78031C7C2FAD6BF8D8F64825A2F3F58DED87A8E35BA27BB08D1659.2033.1057221546.225",
        "CD_63A1FE81FBEC96DF829C5431EBEA9F1CBB9A0D22D4B1BBC01BCA21BBDA82E9B0.310.2945748121.766",
        "CD_7F6D7AB071C5599637F51EC5AFFAE51440877864BBF7579093A40694E069604E.2421.3599220108.368",
        "FFE0E6C807F2",
        "IL_6AA0C48B0CDF9C82612CFBBA27DEB8DABBFC99934CA4104DB63E6888ACF8E5FC.2686.1176486659.293",
        "IL_6CB44413DE06159E1A76930DECB884456218DBEAAF79A37FABA402E7EDEE6F05.2712.173192057.285",
        "I_EFABB3366C8BBFCED6E39DB3820AA3E72AE06FB508A3A360E7B7C5137B01E602.2679.2591135826.274",
        "I_2493B293FAE24B9DB6F542A76F6954F10DD366AAEC07782F39E87A24408C09BC.1476.3634927419.329",
        "SetupDateTime",
        "CD_76B92FF8B3AA20856691665FB718428ADC2A8F423D381B9A75A40096351B6F0B.2285.274241414.6871",
        "object:MSNdis_NetworkDirectAdapterCapabilities",
        "R_34C7F02584835C9F53DA8B610B74BCACB61B9E0BCE6D8A239F117F5D7E99EE2B",
        "CD_4C26D2BE83497715CCF0A765E00CDE590BAFFBAC1830AA3DBCBEFFDF01BCDBCF.2167.924359669.736",
        "{D2D588B5-D081-11d0-99E0-00C04FC2F8EC}",
        "CD_2FB30DC8F94A0A113AD4A141F719C8A8C70B3119C9037B1814178A55C7A7F2FD.2744.491538964.363",
        "2356FE70E70C3F.1714.871754287.345",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1353.3692867184.368",
        "CD_DE1BB7427464FC34126231A7118D222B6BA6A62C9FD1A924C2E5B131CD85E987.1191.2190653916.622",
        "CR_729C810203CC3BEFA1C055392DFA457C6E7FCBABF87C7B3F5286CDF28B07E2DD",
        "CD_75A8E9BDDDA51B5D1D891C00799220E5C1C3A6CF1F951600FBF99252804E2F0C.2745.1628109553.365",
        "IL_BDF1D05ED5D2EC6B697CE077D1F3059A3379DB3CC4AB13FC98F316772304195E.2709.903428955.305",
        "CD_88AFB8925BED57D785F853EA39F60A2597B7DD047C4BBEFEFD01EFF42AC83C8A.37.2016315395.365",
        "Quarter",
        "CD_249E58828B05B219C8BA8313BA785229871D4134A57BDB6BE040EADBBFCCD561.1782.894736836.597",
        "C_F01107CB054F8A386963F327634C557818A4B4AC71917F4F3A17F67A816EEA4B",
        "ACPI _CST",
        "C_E2FADB78F8CF602A6380BA4884A3104114B6539650C2B9840B980ECDEFA5DFE2",
        "CD_7F6515E2EBD9049AE896B25B99B1906533354EA0DB3289C03EFADA9D23B196C7.1389.3937290022.590",
        "C_979D1EA059854DCEDF2345318722F29EF1D55F537C02E38427A8558140AFFFB1",
        "CD_D6EC41525ABC21864A19F0FDAF8BF6677886C4CAC1281F55DE47919C07EC9C67.1155.3722419277.804",
        "IL_4F28049B29ED0162FE0090B43C7F9ACB02BB2A7DA2E5515A9A1D50C0DC210D88.975.1.48287",
        "CR_C3D9531050A687F226B048E1BDC0D3CDBC35A231C063FDD30671825B68A3AF36",
        "C_FCC0EDCD98987B170977FF03A99675590794A9287D1EA9AC977901A84CA5EC8A",
        "IL_D763806FB9ABAAA8606A4E9202FB1CCCE4F5FF33FAF2B45072F3B3347E8AC485.2708.4010078342.296",
        "\\K\"*v2e.",
        "IR_058D03EAB4D58BD68178C926B8674C3667FE7B3464201E046707D1197C7413AA",
        "I_A41A2A506F07DE19FA26EBBA5A53B62D2C62BAF775EC8BEA2B152B5D21A711E3.1489.1494767708.202",
        "C_B463D489D65702642CB926E52778D8BA86FADF16643D384646C07BE40A7A3338",
        "C_AE04C9051F0EB0D5BEF6B71DD5AAC69C1301952192332A53F9A676861E551DB6",
        "C_D8FA39278C1247AB8B1FBB10D8F82DA6DF57FDCA81312F4541EF472290E1F3B0",
        "IL_12F9C45C633D9A35EAD4B21831269F92F066A3C04FA000604BBFDB67F87BF6AC.2503.2850609599.298",
        "CD_B087905D10C7A0BA64B4093C95085AD27ECD7163E26FBDC94BA64545BE9DF66C.1547.1346069196.420",
        "ofResourceName]",
        "Z]`cf",
        "C_07EB437F0AE27464845667363470C3C266A764B68056A1F9C1D3B1EEB778B9BF",
        "CD_462363B61D0D5970B6403061AD625C62E7F77E0DEE1FFE5F4CA69451C82B9D71.2019.3336593414.1071",
        " N$>V(,05",
        "IL_F82E49DA5F8363B8E92178CDD962839B4338D3C758210E6DAA9D9AE4D125FA8D.2696.1255515438.278",
        "IL_3C6E3183A5CA8DB3D3CC199418B0C8DF0600BEDEFA361AFEB5C6A9E973A330A0.1090.3915776663.400",
        "I_6FAD6F5A3EAE1935829EF4FC6A99FC807CB5D8AD89CE9BF67AB558DA70C47AAE.2682.2273171534.301",
        "CD_A031CEAC5953C8D3D1F35E1808CFDA9CF75C860B9E43860077ADEB4071235C56.66.1079618968.609",
        "CD_A783BE4FF3046B33166C1A6F99019CD67D8F2778416BB5227386D1986EA6AA35.1568.3092901892.436",
        "CD_FD01511EE67712BF18E22D5987177172AC0FC136DA3801B80EDFACBDC4A53CCF.93.4070397171.1404",
        "C_33AFC5533FEF2AB8957C705077D2CB2428067503BF4A8D79697DC98C53B8A138",
        "IL_1DA4E180531B401F40077208B50BBADCB6F447B0318A02A094D8CA2E1EE53845.1752.2353653569.294",
        "C_FAADE44B531DE024B0353D8C1E63935B3A7FF9CC1113545A747C5176FA0E7352",
        "CD_49FB736F05F6E9A78F87E84FC5279EF60B08777EF5A714391B9E97553F332914.276.1439197231.173",
        "CD_AD65270397043F902D9F90C1B5BD4DFD9541ED0218BD51B3C4F8E8DBE71A2624.121.3073441248.362",
        "IL_D13D78A8B49C9009D64F6AF25B0E74411A42F0AEADA9C45D7A99752140A29831.2713.898349626.272",
        "ac6d1350600005Q",
        "/BHEK",
        "C_25245316A9D3FA38DB37C9B83D3D9B2E2A5C8AB3690AC27BD6B5746485DD433D",
        "CF40D004E2BC1C3C9AA54865F4",
        "{0 = none, 1 = ACPI 1.0, 3 = ACPI 3.0}",
        "CD_BEB09ED4AE60EA02D0906C72210DE0A889B4969BA537FC2684A64B66607CC566.1500.2463720529.344",
        "CD_4AC7D53B353FF907A3871574884AE20E2C77DD82D160B77856929A17F6C699D4.2033.251139252.249",
        "CD_3BDC2F0A0A90E9AC9B64A580B95D437559985136A7FD8C2487C72223A8541D52.1069.3705489622.330",
        "CR_D63BC7563E6D81203297654B46F4C100817863DC21DB2D7C0F010EBB549665E0",
        "C_D90278F1335965AC0FCA71D26CDCA31711F63D556BDACBB19DE789B7DA17A26F",
        "I_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.533201076.338",
        "Error Category.",
        "I_903CD9CC70691CBCE7B3CD663E4D38DA3D203A8C74FE018A97CF9FDC9B12BA21.2712.1932332857.270",
        "C_C715276855681875EAD9B4C27918B77F2C51A90901FA2466AA1F9D875F93EC5D",
        "C_27A364644C1B83931E072B22EAC45B45C2531EB36360F82204598576E1DF4301",
        "C_22047DD6AA3D899430A0653518593E646A07EB4284EA1D69CDA2422FA176EAD6",
        "CR_847B47B3B9DFABC8A17BC79B345074758B8A3E5B2BEBFAC49A4BE58E4D1CE00A",
        "CD_E706FF8586C52A7176ACA48D7702EC2A6550564F0E42B0C09AE3FD1CCEA62CD4.1082.4035970028.911",
        "CD_48BC67131BFD22F5DA28A903403A15608DD05C18742BBFEFD4FFEEC39F82B3B1.1807.2938418289.421",
        "IL_BF707F0F3DD9935101FE132494CCDEA4AB6EBB6DE9AFE90709432956AC994BF9.2693.1227632236.261",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1196.579707988.368",
        "IL_6DD48BA8C9F115A3A96F3B0385E669764D8C4359B2B9BE931749B764D79904FF.2684.719242343.276",
        "C_7456FDAA562B6B522C0F5D4979880E459C60E9269739279EBBF720AA7C155265",
        "CD_30030CB54ABE2607519AFE5F5B291553C4CBCA712D0343FC3CCA099002D9033C.2654.176141691.346",
        "C_37D6265F83F0B4A807334DDDEAC8A1C96BFA3B726A45400FF628A9564B8A2E7A",
        "CD_D9305F07E7EC33FE79ECC40BFB08CCBEAF8C31795EBDD080A54420FCDE7E017E.39.297566173.355",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1973.2882004949.180",
        "C_CCDB0F33BA6966E88C9C16D64D85DE69D152BBDDCA55C4187234D7D768C27675",
        "I_1ADD61D0238A16AF5CE6407A8ACCC4C916D3C88A9642586BAE68479CCC65167C.2679.520627990.290",
        "LogRecord for IPMI",
        "TracePower Flag",
        "CD_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7.0.356834401.209",
        "IL_B95BDF87E92ACD247E62430960464230E718B561AAAF0432E23253C0393E32FB.2703.693216090.281",
        "CD_603BDAA9A25265B21A3A0DB9BB762CEC6EF64A9203EDED426B28B86FE3E71633.1925.2811448329.1032",
        "IL_AFB1F2A4391AB360C9692594F916CB837FC1E6CCCCC7C79E1D6F44A2E3986C3C.2450.252884842.269",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2087.1221336150.368",
        "IL_76EB16D02C3BB02EFA78F2097770B96E54920137B8BB6F785F9C112617CDEA9A.2689.159389361.271",
        "C_FFBBC80B52BA6E5CEFFFFEE397E621C41EE37D878B66C5EB73F2E53B9F10084A",
        "SettingIndexValue",
        "CD_EF24FA098DD374D95C101EAF1EFB06042051D9D0523BE6004CF30C75E16A8C5A.2595.6065558.881",
        "CD_8B5848CF178AC283A6EA3092920CFF5B15F81499D839D7D7B16301709CE26AE1.2632.1960086696.469",
        "UseGateway",
        "Win32_SystemDriver",
        "CR_AAF98D409E1E163FD1524923D9043946E210EC98C51D718F7EAA521044F5D1C0",
        "CD_581FDBF3A3E51D753168374466B7C40E39F607E7397DAAFA13C9AC84F1F3CEA3.2424.2028431797.364",
        "CD_A70AED88FABBE3115886EEFD655DA2D884AE8E474FEA14C9253CABCA6FD98254.1805.665781732.663",
        "CR_1B410CA2C4AD84A438C361AB2935A45E1487677A7411DBBFAE5D52EC6FB1AD7F",
        "I_A4F640EA01E8E0975BA8BC876EC644CAB5707442FA9CA6E8B0CCDDF9DBF724D5.1020.311931531.254",
        "CD_C3B06A748C5CA18E21F932127722CCF781DEF129D3EAFCCF9594055AB3377559.2578.518557264.1053",
        "PartitionCount",
        "C_445022CE506EAAB770F5E88F3AA9A3B3BB9043E1D2F57842DF958AC9BF261EF1",
        "I_7E3FC52173BBB0BAC6E789BDD1BE5FCFF346F5F20489B64EB487016A0284A279.2460.4151036418.347",
        "R_9436245449B3462827025A176C8658F8B2C7743E35FFF20FBD4F09A2D6A9EADB.2505.3672898925.540",
        "C_9C13B8AC64E6798C561DBC69C0B490F021B424520B516F03E8E801BA8A8E4040",
        "I_FEEC37D9CECBE7C8F44A44A75478B44EA9D3711241A3E088771761D61532C907.2703.2774269613.285",
        "CD_5430A0963BDFE45F48448BEFE49162AB9A7F5390BEE895620AB94C03956A31E5.2574.1291750099.219",
        "I_79EBD7047AB6731CFFBEB617E3868137D79766DAFF26D466DAE840AD5C0138C0.2691.316001455.262",
        "R_73447B89194EA500995C2E5AA4E3BE7AE297170CB5846782DDA43B3F2BA77D09",
        "#'+/37;?CGKO",
        "CR_9C249B506244FB7EBFF9753C728C15CC6F408B144591C0ACA30DB0C62A64551F",
        "CR_5759507746BAB79045AE2A46B326813A2A0F0097AA7AA167503FFCBD4304189D",
        "CD_FD01511EE67712BF18E22D5987177172AC0FC136DA3801B80EDFACBDC4A53CCF.1991.2862288285.2535",
        "C_B574BD7AA8153BC8653A87ACEC6DE25F1869E46546B507B9FACF9F4382AE73DA",
        "D6D60CF7B02015DD6EAA0272.2642.837909254.263",
        "C_199F8BD2C63EA7935AD06C4A530278FE453B1FE80DEFF18B6BDA97081D8B8C0A",
        "CD_E3986C58985C31A7B50C2B93346FDBF5A3AAEABC808F7C0A616D7544B7D2150D.1780.2974742380.879",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.1005103121.368",
        "CD_A17354395E79A088E63A18457CAA51A441A886387058324A6BE95873BE2C4E38.2744.3224457053.313",
        "IL_A4F229D72D127953AFBDFD3FD290AEA94A8F46D87804C1D89B08E702E32AB7DE.2764.4019358166.283",
        "NBFJR^Z>V:6",
        "CR_9A0DB23B4C5307A117BBF9E162F8E0A10B387D66AA6B5AEFE4F2996B31F1D028",
        "C_DB6D3B84420B8B2E5B0952A4263B4AAE435874E5D752A7B6377F6681799057A9",
        "CD_8804D243AE7A52758E6F83E5472ED92BCF2D0EC1642375FE251024B3FABA24DB.1784.802631136.2282",
        "CD_9D4D42EF4D46EC567E6840F10CFA556BDE7CBE6C48D995FDA290957FB3CB6CCF.2419.3624968294.677",
        "I_E2D5D373C81DF022ABFAB7E3F3EC3983441E62E990CB761F5ED83B7AE7156B5C.2699.2824830913.269",
        "TransitionLatency",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2065.1796729260.188",
        "CD_79E3C00FBE813A068B3D4FC2E51AF90DABBF6243E57E6DCF318C4B1FD4AE43E2.2484.1161170345.728",
        "I_A19CA7904BA6023329E4C0D49B16DE932698A9CF7CBE865A805529294FEAC4CE.2698.1291570579.275",
        "C_C937FF2960366D3679AB8F23C7A6B508B41E35226B8C5FD67AC45163D3C64350",
        "CD_63879166E36DD9652B2DA0F13B468273E5FE81CA1F80A337E45AE51370AD3FBA.2634.2636697703.1414",
        "CD_1556B1A5E87D4310C75D4BC7292B6D4E10E4ED4FFA6353E1CEFCF645DF12E488.2541.4270558462.666",
        "I_F085035129E8BD20AA503C90B65BF6D8CC18D4928F9D39B5A51D3A8636249864.2689.68401602.260",
        "CD_6C707473A832E8EC791BEE1730A35E787F78F19C8E76CAC82C47C44288E55A89.1734.1284122541.499",
        "Where: ",
        "mP!I%)-15c9=AE",
        "C_39EA2BFBD151895F8DCBD416FDD9E78356607422DBB08BECE9A9C96986D175E8",
        "C_5EFCF904257809CCEBA12F2D16BCA7E033314FD809E788777A1CF4664A6A2689",
        "IL_A1C1D10CC78BE7A5C3AB54515C19F31277BB3701F61C98AD4F3CEB32242F741C.860.1.30027",
        "C_35FE0F2AF2D5B86CBC794195519170432F5D5323DD65B59310A1399B7795BD77",
        "CR_41695C2AF45A08336AFE1BDB6F027AEAD97E2A04551B2329B3A302DF92AC01FC",
        "C_4863CCD7EA7AAB9B370DC41C90A9C0EAFEA91FBA205A7BBE9446323C4F6EDFAB",
        "CD_14FFC489A434D581FBF6E06A9A803439863075160D7DFAE0D83E42734806076A.1996.1243975398.2984",
        "CD_B8E7124F48C023C11FAE803E1FFF7A22F4E8805CA5CAC5D71AB511201DC2D4E6.1539.3070863206.573",
        "CD_AEF5A70C706EB1C2AF0BC5B36F14C87FA31F991587A5360179E66B8CF9ECD4E1.1829.2742539786.332",
        "C_4E3D5CCD808B0F3A82A4648CCBC5888F1991C867B5C5012B61DFDD621BEB3D91",
        "CD_8B5A6B942AA5416825152D8055EE6894FDA3E8C591F37D309F86A2C72141DDBF.2114.304791894.2136",
        "CD_93D683378335762C284317F9836C36B73320C30A8A815437365079222449D208.13.1353766202.446",
        "LINUX",
        "CD_A3D3980C32FA18D3D98369F8A523D2756A2B0B161451E04A631ED0FE459C5FA2.1490.1335448166.1033",
        "SEL_GENERATOR_ID is valid",
        "C_6F93E3C20E769A2E31A47F868595D90BB20911F83ED119FD74983B46CBD844BA",
        "CR_B1C946E1263303C29E3017D392A1F8F4869D847328AB0898DACC0D0C3324DDEB",
        "CD_22D8A39A1CF9CE9CE697F268DA58EA0D7E31E6462A1BF40587EE288638CAEA7B.2556.575058469.991",
        "A SCSI command was requested to an Nx_Port that was not a SCSI Target Port",
        "CR_73DBE827D23692912B7FB3F1364551B060463FC365FED71D77258CE9C6B8DC8E",
        "I_302159DD437DF31C3447740E0D66617756BB40FBE840878868510D22B9CA0618.1195.840868639.263",
        "The Win32_SystemMemoryResource class represents a system memory resource on a Win32 system.",
        "CD_684131B90FCFA4E2B8AEC19D8AF6C3AAE1B3CB476764A35745FC299F2105E41E.2160.1676723135.992",
        "CD_F58FFC0FC8B956F0D972BCF0F695E0980C1562E6A9119DDB8C681A1382993AFE.51.1540842173.1004",
        "CD_EA2A17F7F9011AC9DF174FA64700FA87A332EAD70BB23C4338DE684F34E350D6.214.3047283465.726",
        "C_FBC71D3D1DD9772ECC7466D75E7CA5C00F778C7F0EA2DC410B71690DEDB23FFB",
        "CD_C3C6D8FB3474EE785958EA6FF4182273D2A6254E9DC15AB0F00C01432187E439.2746.1703749204.362",
        "3-!E0",
        "R_55BF0CC0F072F8672008BA2E217FC98D14173100D32640D32F61CC0295647162",
        "IL_0AE842411B3B68BDB60FB4610360E1ECD2D583F7968316F79131DB25BF102F63.311.3444058254.217",
        "C_06BAA5D4669A9FF5B5FD35414B6353315AC4BB24F6507E6658FAA9831018BDC5",
        "R_21FFEC50CA6D88C1A01C91A2FEDAABFBC2DFA9AC2868B9D42E7A86793D46946C.1355.2816662444.540",
        "IL_DD64F3DD69AC6AA9DD729C4E6C42B0A80EFB1B297E7D02AFEABCC6933514C2A9.1017.3289069461.321",
        "C_9B2F150615D5CEBF9CA60938A935C312A66EEB48D0E73B55EAB7F994DCD0BBB4",
        "CR_14EA8D1B614BC6D260E31F428D1651D98B6F7F8F49C7964016B24597B70B73AE",
        "C_40CAFB87B847B798AC8F2045737A2A8390AC0416A38406D6F38EE740FBB0A4AC",
        "pHl|tx",
        "CD_6BF4074B06004A36C71E7251D583F11D93600EE30099410036224B7AAB597368.2583.508854275.567",
        "IL_8D2F058AE4ED0CEA3824A472732D53F547DA724744C9666A10B23982ECD48E86.2684.4259208894.289",
        "AcpiPssState",
        "C_FCA9F76AC6C239B0B01B1672252F6805168C019918C672ED3A9DA5B69DB47E2C",
        "C_8DE46DD6446B26621A23E11758AE5CBC62C9F72998CAFB08B9CD58DF66902A20",
        "CD_86063DABE8CE896A69DCD5B43BD505C1E3B2A298B4207DEC8AA9B679D5A8639E.158.3664591562.263",
        "CD_2D600EDEB86FB22AC5475ED284E8022AA05DCE0A01ED5CD478BD3E89B6038610.1366.1.39313",
        "R_1DE76A14218809A4BBAECDA99DCF12499E4B2F2C31612087FF7D8191EF84EF3A.1020.504989508.524",
        "CD_86E4864B1CF6600CE4B6DDC1904F1615B807835856FD99C1037F22B392220711.2615.3961754011.440",
        "CD_032D0BBE36FD51D3CED741D9163A914BF52481E88F0EC17115F81A8ED3B68630.1541.2476585842.473",
        "C_E4786A08CF3335E88102AE00434A382BEF190C917949773F1CE0DBCB609258D9",
        "I_A7052B08B09938CCE53BEAD9E47D91E93EAD5FD6F9FCC85F6C2DA7C752981F58.2728.3560978420.294",
        "CD_6564FB1CD2D5988AEDE725ED2C882BA239A76008840A51609EAC2AD369BF9E1E.313.3795462558.490",
        "CR_16DADF7B882F03A24B4CBB8BF019AD75A37563B4BB21A28112B781908EB8D5AF",
        "The month during which the Job should be processed. Specify 0 for January, 1 for February, and so on.",
        "I_61135FD5141F35DCD46306456F3CDB5AEBDAE18836EED0F93BFC45AAFAF7E45F.2711.1750736373.295",
        "CD_1BF53C3456EC72A78CA950A5E0CF23CE50C15ACE883B55C1F16FD4CFB99D57ED.1562.1312139317.423",
        "CD_D494E492A3A0BF7E3C7D842F7DFC0957D5D8EFA61B08674E106F0CEEA4957122.1332.3912824833.1463",
        "I_FAE94FD79301135A232A3FB9B04423B61DF3B13B672B5017E2D69DB06590444E.2687.2440482473.274",
        "CD_783F27E34E5C5D4D60E761148DA5CB8835B5F7C975356BFBACBAB29334321728.147.4195006888.4146",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.292.162291849.188",
        "IL_3D3170EF13FDCE33C2F2323904C439F40CEE924CB36F810DFF4FA1EE5D56359C.2676.2574734296.277",
        "CR_7ADB3A758B71404FF95472D98780622B0177ABFE993DE8C448448F3816B71A61",
        "IL_0051C5DF1ECF71C50620AD90C854C2D1EFEE09CCFFEDDC4FD5FB6A7E4EA2A505.2736.1709913072.288",
        "CD_1F25AAFC1DFD302234A597D09198F965D3DA468B1863CE8D32B13C0CE151009D.146.3569463062.1338",
        "C_9191719F2DF63C7538995F259914C03A19424624970470BC4FF958A554AE5D5C",
        "CR_0B714A230756027CB9D944F3C101E5485E82B469361846E74358E5EEBA5C05B7",
        "R_34FD9E1177E28334594B80DCA69BD741401DD280ADBA44870846F7381632F88D",
        "C_1BF53C3456EC72A78CA950A5E0CF23CE50C15ACE883B55C1F16FD4CFB99D57ED",
        "Values: TRUE or FALSE. If TRUE, the slot is shared.",
        "Failed",
        "C_F6A5511071B6ADA7B69A807654FC692011B1BDF2F229A77550F5BAF2AAD135DE",
        "CD_03BA14961F0EFCDB8006A9DD42AD2411E53376D22F7B3DE79F555B7592D5B560.1559.1340064989.552",
        "IL_EF2F28F2F14BBA41E2857F9632ADB94061523DF033662871BF2E867FE6BCE483.2706.4157848954.286",
        "SecuritySetting",
        "I_CE252AA91A6FFA46FEA2B838786203E2F0BE4357376AC351FF7B23B65B99BE4B.2698.4138931889.265",
        "C_3303D514509C890AB8BEBE50F44B913774000A6CAB1EAFFC8AC95F2755DFAD1E",
        "I_A111E7F89C1C848588C2514B9F7117AA41CDA991BF49D22CA3C7528AAAD3EBCB.1184.2693893620.249",
        "CD_FCF416010D567B5041BC82F46732C142DC125B68750168BA980728F3E2F25AEF.1097.3409332761.204",
        "R_E7B3BF5CA85CDF3ABB8EF64431ED7D1A67B9FD70D9D851344D21F9BEA7F92B3E",
        "I_173DA5A6BBA120BFA1F003499F1CA5518076940AFB7C35F9074818D37BC225BF.2764.88580085.274",
        "C_73B76905DE8D62EEFC35FDC779F0748B6AA4421D4B0EB21785C52189DE44B66F",
        "IL_09EC1D8756C30F8ED5D8EB9852B2047C26527A4C71465277DE80068199B8E56B.2717.506464875.270",
        "IL_76DF8F121B35B901DBCADF39EBD6CEAA1050C4BAF7F1C5586332DBB26DB37A7C.2684.2034701232.277",
        "C_1B410CA2C4AD84A438C361AB2935A45E1487677A7411DBBFAE5D52EC6FB1AD7F",
        "ventlog",
        "R_5241CFC05A716A77CB0F36844F9A62538AED075865B9C000AF8A5A2832337841",
        "SECAM G",
        "C_C43EFC04AA57188F81F06E127B541FCB4E02CC3940B347504A70CE9D5B7DABA3",
        "R_772F556B04D98F51D070688680FBBEB205D86BB8F4E24F468AE459F92ED94CDD",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.43.4088938489.180",
        "C_0A00EAAED5E9520571A49951AF6325C3BC14CED89AD4286E9ED8A3D18057C7FD",
        "OperationalStatus",
        "I_6E9DD02E52C196C71CD529E2D8111E7EE60BD0D43965AAC2D903C8F515A0E666.11.330131292.330",
        "CD_FF89590C844CBA58D43564BFAF3A9C1E0ACA3DFA20CB42FA7E832F2021AD16C0.132.440936376.1677",
        "The Shared property indicates whether the two or more slots shared a location on the base board such as a PCI/EISA shared slot.",
        "CD_5DEB181FA3808D9D7D9C352C844B65D0C9A0221A91C57777C58BAB412DD30F67.1807.695577921.395",
        "C_78AB2C692DAA3A4CDADED46AFA07DE51142E7138D313F37FE748C3A17F36D445",
        "Association between the security settings of a file/directory and its group",
        "CD_D81338524AFCA60B0F4075974363E8831DDB3AC972CD263F00EE914E81792460.2644.399650949.767",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.3877943233.368",
        "C_C811BCFC8FA021E0ED24EAF2AB4D586D8740EFE02D81CF2A5551BE06CCCF53EA",
        "How Gateway is Used",
        "Address",
        "CD_E7009F8345E6F3D959CA1331053B26729D4CFA2A9BE412F35DB4F889D7ACACE0.1779.3792504346.279",
        "CD_33CF99EE359367737EBFC91E6221019D46F7219044317527292271867795E5F8.2013.3536176300.681",
        "I_47A3A313781875019EF675B4263C00ED88049A293CFE060A5DA87EA2EBF4DEB1.2690.2780638143.273",
        "CD_A8F32ED73CC909392CBB6D2CFB5C52391FFF3A4DD4AE1EBE1F9D40C03A8C9EA6.1701.1.28867",
        "CD_5BCEC8C970B710AE4D6EA0AEE105386763F11854C3DF460A38EF1FFF51743FE0.2570.3074772246.1217",
        "Q]36u9<~?H",
        "IL_E119939FF7AD69A2E7790AF70FAA1FF64503A28E9040F5A58FA54DBF42E56214.2686.3512473346.262",
        "I_B36809B464D5F3386AC2DAC9925407E2C31833817AD3999276882F13E1D8EA34.2713.377369837.278",
        "CD_CC2460B137D2455D9F0C67827356166977724AD7178162AC44CD4490C453391F.2513.174973178.2907",
        "C_38BD5C5FBE64888D5B30C67C4333B4A6856A6BD1D71F9FA08E4958EA88393E70",
        "The setting data associated with a power setting.",
        "HL@480(,$d`XPT\\",
        "CD_B59B61CC7D9A09771322E31CC4E05FF1DCA2EFD4C76A82AC0B86177C3096E55B.310.4018809603.734",
        "CD_6F49E037E6F2BFB72144CC48C974D93CBE7417A8F27ACAB5CA25D34A28C29442.1690.1.81873",
        "C_FA683FDF6D6B9D2FD9455FE7A9C71C1392512648AE2DE3FBFDEF09A26764DEFD",
        "C_D48886C73DD49B540F592803EAFD1F804FC85FA1E036602F910CF8A02AF4AEBA",
        "C_9D6C206BD45CB880974789F4931A2F78CDAE201EFF7E32B71E8E7698AD1EB3A8",
        "C_AE01E14A20F57BFD98D6AD94A76C705104070514D24AEA318BE6A6A137F33F5A",
        "IL_8E23EB78FFAC4A759215B5BD6EC35386D5DAFFB04E17A1E0F3F33C9BDCE81E56.1194.2393799953.283",
        "CD_7791F92BD2074299074F34A87240036D31864BA3C20893ABE274505A2016A794.1836.2028055955.267",
        "!%)-16r:>BEHKNQTWZ]`cfilo|",
        "IL_B3082C3F9799617E93A60B0A5A46A9C812E71430D2C694055B03ADABB08B0D1C.2674.1718239285.262",
        "CR_17E7C86738B59EB875E05FB8D2106E803DF9A9B0E69B9182F0E97C3BD2B3B709",
        "CD_BE8F1260CC7D3D8D65E679E452849F43342AC07EE5E67F79C0602AEF0D925B48.2004.927806345.2151",
        "I_F321FD31D139FBAE0F6F7DB23BD2CDF26FE9FE62566455A898A88AD7A02917C0.2706.3673377254.294",
        "buttonOrder",
        "PAL G",
        "CD_F62E0666212AC3F3422A2CD244B01C66D5C5B4C6B82C02CAED0A73F78C5069FA.1090.458955872.533",
        "C_575BF2A48D80B1DDD390E6D0D7DA5FFF82B3780F7B654DA3812C485F78F42F88",
        "I_370D362D24157E77A6D437A1B6E44D31636578C65BA57AE250B7372F533440DE.2457.1240054415.346",
        "Setting",
        "CD_13A0E5F9AA254675F3D05231BD456443292E04A663554FB864E708C72EAB70D4.2734.3262651767.1657",
        "CD_C4F661973CD3C0A0D2984AF60EF23047396681C367251D4E47D1DDBCE0BCDFE6.2748.1429163913.2897",
        "C_CE1E2946EA75133DF1C863E5B411D4CB200B9A15566E82CC0D10E975E292F2B5",
        "CD_D7F29C6D74222A2F53039DD4BC77A6BF91AEF843F0144C1443D812EF420EA4EF.2532.3357799312.409",
        "CD_6386D8D2B88A7BC7CBA096E4EC6DEAA50527411C63B9CC5BBE2CA14F5AD32DBC.1188.3263113584.491",
        "C_71EAB4D274B62BE0548BF7FDDBAA028C0F0BB11297C86BCB4512412235E01F04",
        "C_07175BBA4C96099E611E7C4DB8EA7DEC92B3AEAE5EC6DF957DB2495087F658D2",
        "CD_D7CE34A38EC480B367D84FE3F007BA659A4FACF5ECBD204D1511C653FC730B26.1924.2980359579.1047",
        "CD_79773BD5BEFC486DAAE05E5E8B1D31984FEAADB212CBBA311F38FEF122B52E0A.1781.1402251876.421",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1352.1199241364.180",
        "I_60C0138448B18454795E1F1C4FE300BAB09D220E9E0406F27853FA165D081DA2.2727.3114976785.285",
        "If this profile is a roaming profile, this property is a DATETIME value that indicates the last time the profile's registry hive was uploaded to the server.",
        "CD_7E68D046DB13BCE41C3337B31F82C6F35EBC386E53A1006A94CDF711AEF82870.26.2324764976.2018",
        "95EC2C3520619632AF5FF0B02D2F47A4F2D9.2715.2426944491.274",
        "CD_7D462EA5E87CA015476942A58BACB3893636973868980DA68AC5EC3B5A1C690A.2759.2735085229.358",
        "CD_8E3D9DE775219AEB41FA7BD5EDBE39725FD15E4E783E70F0941CCE144ABD6BC2.1019.30475927.135",
        "IL_46B008C4FA1EC92AED42D75BDD19C87A16151364C2745870AF862251E091444D.2717.2145587502.281",
        "IL_85B4AD3F0FD1698C2E245E49DBEAFE6FD440BA2E76BA5385AFD33DC433920AAA.2703.2731508834.279",
        "CD_C51E70FE88DEB37F2E85B037DEEDA0EF21742DD637312A3E1B9ABBB2A7F6C657.2641.354375390.439",
        "I_17E3B25660DF0E83C14987F66FA161A3FC7CA5227F82DA840EE11463022499D8.2691.2883425063.268",
        "C_01938EB24A6B33B65014DBACDE3C7CA2C2E7C61637395768C92D80CCEFF91F8C",
        "C_ED1FC035EB371A90C41246D116BA4A660CBEBB27C216B9B1947EA219BC5F06E7",
        "CD_BE8F1260CC7D3D8D65E679E452849F43342AC07EE5E67F79C0602AEF0D925B48.1082.664007808.867",
        "CD_6ED1CC69327A33D759019C559267CFDE48C858749D7A22192B7DE8573CFC19A6.2160.1942695875.3743",
        "CD_D38B3C9A7ADBDFA86718C75F06DD0E52B783C225D8399E8BFAE7D86BC2E5E7A1.2616.3165374155.2093",
        "CD_AC08CDDB7433769D37C6A6528B8CE57C28FD33ED152F2651E59B9F045070D6C8.1533.1162932369.507",
        "NameFormat",
        "C_BA1712135E2C9766CB6DFE0CCDDC8590C3F7AF3B44B9DAE601D4E1FEFD0E276A",
        "C_B59800CFB156A4D66DF19514C7F17F6B187814B22A45C5335652A54E148DEA54",
        "CD_9C8D7CB31C84BA37EB783B79D06AB5B7B22F9EBCB2A38F6EBA686DD609042FD6.65.3265934299.250",
        "C_7B578A2256D7105EDC7F31C853BECFD075DC8E0C980179EF401FA89F93C8C5F5",
        "1B174.153.651581944.1494",
        "CD_DCE585FC8090201AD2A481DCDA9678ADBEED6FFAAA2CD50925EF913678001533.1677.1500019269.347",
        "CIM::Event",
        "CD_0755C98F98A88832CE4AF388D7FD0A485984E8C8093D5B69AF797BCD21D684DE.2052.216095128.145",
        "a3c02200700000P",
        "C_4988CD2D7F85D5C17FF2774D58B894734938D3599DCA6128DBFB2C7CBD3F8289",
        "IL_EC5563AA1C02A695A8B900B5625F2AC295403980DAD926C76DB8DF19BFE8AECD.2683.1605751085.274",
        "IL_E75CBCE90B4C0E20DAFFEEAAA1EC804BF8BA7DF9DDF2A9FB208487F0BEA7C47D.1501.1235489992.338",
        "CD_C811BCFC8FA021E0ED24EAF2AB4D586D8740EFE02D81CF2A5551BE06CCCF53EA.2425.446065511.355",
        "IL_4CA07DFA9C307922F271E8FD10821CAD444F0C43296FA9D2FFF97657FB680115.2685.1793870385.283",
        "CD_51219B2D884EF21668EB59BA30463FA5A52EEBFAFF61E950DA5A48E013805D47.1924.3752432563.1040",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1081.768419745.180",
        "CD_B25DA333436380B14065F5CAF15967BBB759113E2ED71069E1E95253766795D5.2375.4007977999.750",
        "JNRVZ^",
        "This device is using an Interrupt Request (IRQ) resource that another device is using.",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.1968.2898736535.188",
        "C_089084A9F2C065B07097839183786A1564DECA9FE2E250A27CB3C47E8FE89ED6",
        "IkeextTraceProvider",
        "CD_2BBDC6530C208169E005CD28108E36BCD72310DD490D1F6D9817675EE3291874.159.1.9113",
        "IL_B29690E8C1ACC1A5A2143A5BDCFF8C67E2BB645250492E1EAE03B419B30D089A.2716.3556071350.284",
        "NS_8C31E837D18DD5B2F5A6595D90480BF8E8731F0D7C29001E3F22318EC8F6F6A6",
        "C_DE5401B6E43B578E2EFB53DA6E566DA26347625121707C9D1C476F9131518ABE",
        "CR_1CE82144EE1299C77E9BD021B10420F34770A35F06A428C70CB37484054DF692",
        "CD_DC39EB125CD5896A582C9CCFCFEF5267AF9611EEF285D00CC4FF5DF7F8AE6FFC.40.40615820.573",
        "I_17D399E35013E1803B92CFB7F367FC3EDAE2C98EDA1A366A6659C348B931520B.2693.1545574130.260",
        "MSFT_StorageSubSystemToVirtualDisk",
        "I_A0E4FF4D405D5F6019501D2F297F3A1AD85F35E1C780115CB8498F115E1183E8.2704.1940737881.281",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1075.2208756393.180",
        "CD_C715276855681875EAD9B4C27918B77F2C51A90901FA2466AA1F9D875F93EC5D.1354.1409376110.260",
        "CR_4AC1D3A26D87995319BF08535EEE6BAC00658FC9706A2D0A430BCE00D546062C",
        "Control value",
        "C_FDDCF7A397736C527499E50A8D69DB45370CBE0C7A871712D3F74C6D430F1251",
        "C_871F96B8C8A803F6E7D793A0854F07290B5BF0DAFF7F0657002709AEE1E2A5F2",
        "C_17F8BC3833237B1EA834BBEC43AD4224D002BECFAA4FFA94A67748C23C3FA2BD",
        "CD_943386A936885D346F0D61FA24D7BB2533B7B797B4E446178A40D4E6F2C1683A.1671.2332948108.1176",
        "CD_D3EDA6D3072598111F4D360786284F18068B3C68DDCCA5982ABB599E92A62555.1210.833163341.284",
        "CD_9D89FA2B309F38D240606161FF6D4D1DD686574B6527CC994C80F23BE2267FCF.1745.3562593171.4742",
        "C_5652DF4B99BD8BBF66A57878F7DCA92E59A0F6271A501161B97B1009D0D4EA8A",
        "CD_6B2889479D57435939038FBF287B4AFDC16FF0B74EF9BB25FE6D86160746289D.18.143699010.929",
        "C_E4331DF18896E69637CDDB420EDB4490D51A6789B8AD769669991F6030309A42",
        "R_49C003F958AE429B51E409471F01A643359D07DB4A4E6AA865D8578747CC13A3",
        "DATA_PROVIDER_PNPID_GUID",
        "C_8B7BE16E7251A1D8A537B09E04EB4085D2030EAE15ED1B2F980976175F47B5C6",
        "C_D06FF5A6CE3076476D1F40A765F73FF8BA96747E87381434E3700375D9AC8EB6",
        "I_C720FF9CC8690827A29417243CBBF0FD4D669B06F1180EF063E385072CF079C1.2713.3133862721.286",
        "I_6E3B4399FA4EDE750602EAE85FB276C1B64644E78344F6BB3EF3F442D17FE8D8.352.1.287457",
        "CD_45D7E6F87ACB8E8D445CCFB669888583D94123CEF1D8C0B902BDB864D192ADA3.1149.1758528885.469",
        "Infiniband",
        "IL_C312DE87ECDA41B4BA349E56094AF7BF97D35C035BC82923118A777854760462.2712.3168035425.290",
        "C_E4FC7CCBE036059F139218E837508435F1EEA217B72843BBC84B1DD56DF78DB9",
        "I_1877C5CB7F48C52086F19F29C9FF7A95274730D00813E5764E1041E2DE77FC01.2675.2605780115.261",
        "I_799587A38265D8F759455FE0390B3A3F4BE7CB087B942FC471F97281FA3E5A55.2722.3221678492.283",
        "problem.",
        "CD_8005D3B4D5C33976D476C37A3ADF1FDDC2AEED60D44FABDB17B96E9525EA9F87.1241.3235094592.2998",
        "C_A4EB4EC52D8DA9648AD8CEB515F7B48D8AD3CB4BAA5E5FDD062CC77087B6C136",
        "C_3C12FDF66EDCAF83C238DAE5C9D20887F76A735A1575586292CCB828F70A0785",
        "0385A1CC51D.2758.3930428667.370",
        "I_13770FB29B535A976ABDF141714ADA919FC9C51EFC37EDB5C1E955ACE56BE9DB.1938.551476840.252",
        "CD_AD7A55DBCE4A8D8485FDA925323C27900C64AA391BDA086258F10BE24098BF8F.2579.1884638751.666",
        "CD_79F50ECB454C073E4E5CB137ED1F04F729BBE896F53092F9F794786916DFD292.1489.911613200.86",
        "C_0BB30ECFE96792174DE6C88157E151B103283BC5FCF35E650468C2280E66AA49",
        "CD_62D2D3D876D49666DAC947AA6AD4CEC5448D7F82C5F2A5DFBFEE7B1BE68D4817.1779.3131035983.308",
        "C_61A3C0D6CB2A10AE4FD5F19276429EF7E249D991E911A200F124BE12E4F8F8C2",
        "CR_CDB4D0999BBE2F5F01BF7E500A934D82190F379CD1604609DAB79E05390DCEF9",
        "CD_38D82DBAF247C62CB271C7F968D7EF903F6B890D72656BFC47D699684D55D030.1190.3851673236.611",
        "CD_E32E80DC72B8C4215628F30ECA0289426647C256341362660CCAFB5ECC66DFE7.1927.2394650379.1064",
        "I_86C4D3FB4A59FED5EF3DBD11F9592F88D1682B7D71F55FD807DD3283918426E4.2717.746418418.285",
        "CD_5B3B46A0474CE5B901A724DB872ECFD6D25FD9AD2154C87989375CFB1A21DCFB.312.1540133610.415",
        "C_1D8AF94E43CAA7DC78EEB167F2FCA41288361566745343E55E2730385A1CC51D",
        "C_4EF24D0957FB71C83C7AD35B30B8A4808EE94D32528B7C1738A8F12F7FFBB5AE",
        "CR_5C90AD83ADE4C22FE8FF44C299AD3236C77C12C54C212C5C5502E0B121FDD0A8",
        "The Msft_WmiProvider_CancelQuery_Post event class represents an event generated immediately following completion of the provider's implementation of IWbemEventProviderQuerySink :: CancelQuery.",
        "CD_2D613B3FE870BA3F1517153C24257C4A37BDB33C8933EEF948458580B93ED05B.2645.3494636170.923",
        "C_76EDEC3083FF868BB73CC3D9FF8C4C1459B539DB853C36A4B53FDED1A9C389BB",
        "CD_214CE1426D6101A6A1828EB7583A1623D82AD7602F044FE3634C76546F0199F7.197.1148654880.837",
        "C_B76FC809524DDD6408CB4666DBDFB0898FA0540BCB633CA73A3A65B466115BF3",
        "IL_8771F6EE1926E505F2C5A2E187598C5CF7AB7DF75BB546648E19414531518528.2705.1256167159.292",
        "CD_BABA8B3CC6A6141F442ED3F0892F94D169E27C609E94AB277DE73957AD024C83.2653.2807850379.346",
        "IL_30511FEF4D7229EDD9F61828DA461D3542432F60B6FAD9B220078B9E544898DC.2724.2965865318.288",
        "R_639FF9819F7116977CD3319FE02DC954F7BCABB6A465676C5A5A023955C58EBD",
        "CD_DF9ECB8F01904CBCD3018F693DF94DA3A02D29F356223BB0838117D8F2475343.1970.2228778442.4372",
        "IL_74CF1EDBEB2A88AE2B7F2B31226DC6989203AD486527D338B157184A36F210BE.981.1.23321",
        "C_06FC0AE99192039AD3DBC9A60D9D3329CE5644911B9200854CEAD799C76E19C9",
        "C_69F693B09761D259F9E36F2E07509E240E77C62CCA21F57F463D23C41F558900",
        "CD_20B4E701C3271ED94785243972C16A9A8FA123A78EDAC768D9A7B370EC4A42D1.1078.2547918132.348",
        "R_6DEF0D7E940B545B1F815DB3466E2E096310F0994D59451D4A228F863D49F32D",
        "IL_532D8B7E6990C4CE6AA56764F7998FD3C85D0E0296E30EF8F69051435FB58217.2725.2776454089.276",
        "IL_E66BB9E894A4ED0016C47ADEA36918C495E7C0B6F2CB1E5BBE051145718DDF9C.2720.3881536490.281",
        "CD_A38536DC7BCBA3E56B010D4CA8130EE7B550EF925A37CCDCA254F671D413FD08.1547.596903972.550",
        "__EventProviderRegistration",
        "IL_CF9548F39545C51C0566C199A2B00D75B80CE4ACCE8A14BBFB690E777E106C83.1130.2971655542.184",
        "C_BE7387966DF1F18E3CBF77DF02DD0D63D3B38DAF2C46A4C69CFFD4512374A7DE",
        "CD_3E78A37E1DE70357C353A15D6BBB8A17A1D31F8D501ED8F1C3EB8104F5B04F97.293.3683828368.965",
        "IL_DD370C83218E3ACF4ED3E50B021E588714258891A76B1EDBDF23E122A58854C5.2764.1475232320.287",
        "CD_F9D38D348FC17C2197F17E4023229520C6A842B2796EB1118A92108A9751F1D0.1335.1700536675.5265",
        "C_FD4BFDCF85609A332980A19BB1E61752A72B4581A198C993B54596D7CA3B05E9",
        "CD_110AE6309AE2428224AA19A1DF291C0EC1E01C277EE0FBFA7CE4C91884A74444.2068.1646830325.8125",
        "CR_883826ABD14D23FF1A9047BE3D0351B0DE42808C003FF03170B08842AAABBB6D",
        "IL_0C9560B089ED0BBE537EDBE57097F3C6215297211AEC47A712BBBA735FF3430A.2693.888195114.268",
        "CD_BCA42990FC39B227E073409B792CF09215D06F9DF9B1D54CFEF0BF6A5329A1B8.1545.1490394177.638",
        "C_F9C1E1A7069B9B36C3E7210F7D307B0A9A014B690546123D4B32550C45DB3C57",
        "IL_DB3DC047ADFDB9AA95432DAA8C113C49A05B0BE4377EF4AFACA04D37246D6A54.2729.57080638.254",
        "R_61AD70324F8E2B3494420EEDDA5029E5D1AF2B0083C1CC1767F12EF889E146D1",
        "CD_91BBCE5BC61E1DC47C4EBF730A35B9AF4C8A68FE40C45D7F1899EA3F67F6B400.2666.2609132366.807",
        "CD_7EB464F197DCBE575080B9282C967BE21B4306F539F2D486C42140F55C5D0FC8.17.3999369408.407",
        "CD_44DEF9F59661637DE2A93E3776876E3A1438B9BE8089F1C0465114ED219CA8E8.2672.3496602332.563",
        "C_40A24DF0170D3D162FDD7C849B2D46C54DA402D695FB97CA12BAADDBC62C83AA",
        "IL_025723475512337E2E6C7ADA8B7B242C285559FC3FEF7CD4126C89810130ED40.2679.739303209.270",
        "CR_396FD3CB54728B5B7E193E8232D1A7853585BB3CAD758E58A36AD470D80A78E2",
        "C_0B5C44F8259E201E409A59CCC827AEA5F69AAF6BCED724865BCF62AE4F5D48E1",
        "CD_57E5D882D51A73B98D160F0B765B4683E2474C910159548BDA9FB2A8BE2E0941.1608.3971454592.1633",
        "R_AF4BDB6DD9BB57D16C8BADF348F545B1D2FD7AE633E0E8A6436B37636CE2E03F.1617.592781436.596",
        "CD_B6D5ABBE2F1027301C23A1CF884681090FD42092F2E95A0F33AA6207C9180DA3.2065.1410675615.600",
        "C_F329A9AA0CD7A7CB8F5B766F435284C69A84B4ACBC92612E21AD74FFB8C0C1F1",
        "CD_95EC7A4EFEC83ABBDDA5099FF99F34F3F0A26217E92C58663611DD1463FB39C5.1191.2553648132.314",
        "ApicId",
        "CD_4F0D368317167225ACF46119D014C5D4BCCDAE790A6109A6768873BB8F046D1F.2732.509356915.661",
        "843438F9EA397897C0E954A6BE0361A15C053E12F2A28323.2714.2625135702.303",
        "Failure using the VxD loader.",
        "348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "CD_524EAE20B913314A702A0EBDD5A10C21EED93FAAED87245845E0CDD9834CDE3F.1.3703833417.180",
        "CD_542662E51FDBFBEA6DA0FE85EB364D5F9CA6EF91BBCDB6172E88F1ECB3E9ECA8.1958.796863509.660",
        "CD_9191719F2DF63C7538995F259914C03A19424624970470BC4FF958A554AE5D5C.2605.690193309.197",
        "CD_76391C5F827BE50BAD62D3F132AB199D19DD265648929C5B938B0F42F0FC59BA.2559.1146695353.86",
        "ProcessorCStateEvent",
        "CD_E6F405501CF9EB51604EF826550E0336D9FF9DAB805C48FA3ECE279D5B21648A.1584.1652742082.356",
        "CD_43A96857609592D2C0CCDC633A9E2BFC7303D634E1F8D71CB3C5A3DAC25BC112.1064.1674307975.521",
        "CD_8415A398133EAE0716C73F02F5C279072A12B0ED56A7172F6985A7EBD9376FCE.65.856353979.250",
        "C_D875B95E503572905224A8A8F72FE8BB5E4F4F123949FE42D8A350DB69DB1BB2",
        "36E0D9FC94E624645193F9F27AD440D64189FA0681CA9A717570.2618.2560031697.1695",
        "CD_AE91D46A333A370D09132417089AF125E776EF57E4B0B159D0C6DE0E14D65D5E.2758.2326519587.336",
        "CD_EC346D4B55B7A3D064DA670AC46B8BE53932F3BCFC8908523A9CE445AF651CD8.1955.549041785.425",
        "`X\\Tu:",
        "CR_DDBF2272AD53D1E9DA14E7F99DB9C4644CC139435FA2E500211498B44899C2D9",
        "I_9634FA8EA8666E17362935E85D317FF216D0E456B4F0F4516AB4F0B62EDB0821.1053.392897305.316",
        "l?`i$",
        "CD_D8C4BEE78676847DDA567812087141E2560365728D8010694F2F477EFE65ACF9.260.2190646612.1694",
        "C_6C707473A832E8EC791BEE1730A35E787F78F19C8E76CAC82C47C44288E55A89",
        "CD_19F23F01E81DD69D7577258538EBF1C8D0852EF9E76BBF75714E72C8A413982D.2640.789486958.572",
        "I_E57D75B361243F2E2B78DA73BE942446A5860B3B577BC2450A98F33FBEEDA2E0.2725.2302106577.283",
        "I_8E80D45658E49966FC3BA567F2C75690AE48EBAB9A2568429675180214107ACE.313.2989851214.331",
        "I_E313BA094E9A73CB5C908E8526F6C018354DBF29EF0C9AD7F6882E010ABCF531.2697.1950607599.283",
        "CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this",
        "C_264DACE30DFDF75A51B9E979ABD65B07E47DD7DF3824D1BD7D92A8F6E964F507",
        "CD_4F238F7611EB52D50DDC75C17C92F0DC91196D190BA8E13F4A12D59BEF4C4414.1019.478297306.252",
        "A7C395006660",
        "I_704BABFF5AFDEFFA3F6BF78265E4E645897FCDC212CC21E1A4FF490E2DA2C1BE.2678.1716499752.280",
        "CD_B94A787F77AF023D219A0EE0DAC66FC04A9B36B8A75CF39D1E1673DD4839FE01.1928.1838855318.304",
        "I_7546229425D80B6C5F5E9411306AB27472AA8DECA01F7891A6CA483FF68A1955.2683.3263157587.278",
        "CD_46E9116EF037218841FA4F4762CB05CA6F461F560F5188FCE32620ADDD026F1F.1928.3210368045.1032",
        "C_2B9B02800ABE42641C8BCC50415FCA86F11FB9ADC08A648EB89569C471775E68",
        "C_46E9116EF037218841FA4F4762CB05CA6F461F560F5188FCE32620ADDD026F1F",
        "CD_DCE75436D8B2B23F9B44B6DFA11CAD570BB57B2FDFB30D4B243923774090A86C.1188.3564745271.382",
        "C_1D9D9F860D11A9D4B55F4C6910A7BB99E4046682A588042085A8C0D379BB6068",
        "CD_AD19852B659F95D5A51E327D83B06F4CFE38AB7F7821BA9B06B5184C781CDC4D.1530.3240501102.3645",
        "CD_14695F4F2E480F31BFA56CFE3E3BC1DDB0CDDB1F205DF793FF5DF038C8BA59D9.2520.1363183279.2111",
        "I_1275BE448083C5AAB33DAF19956853ED9EA842E05F94D0AD39A63BA94DDA43EA.1020.3298090352.330",
        "C_A4366444DE6E953D2C93A1247381154B05C29C6FDD363835660F5F90BFCDEB05",
        "IL_54275311190E6AF40C7E1ECA677C26F666E21555D2DB9537A0D6F20293E6715D.2749.3296711995.350",
        "CD_D976921998798468D8EFB51691DF5718F6940847EED18DB5BE23F1BC9D2E5D09.1189.1260271262.632",
        "CD_1D8AF94E43CAA7DC78EEB167F2FCA41288361566745343E55E2730385A1CC51D.2758.3930428667.370",
        "    </migXml>",
        "CD_CB9297368BD3D60B9C9822D5B6B73F15F431BB59E5791B2F4E04F1008BD11D93.2609.1046034847.298",
        "C_9D451FE1048C25B1734C21AA9BF5F52F617BAC50A46B49E962E9AA59BDD63A0E",
        "CD_FFBBC80B52BA6E5CEFFFFEE397E621C41EE37D878B66C5EB73F2E53B9F10084A.2612.432077989.391",
        "CI_57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "SecureBootCapable",
        "C_2984FA06B08FEFDAC105BD3D893B7E605A4C10A9504DD67FBC13D12F8FFFF9AF",
        "CR_C7753872127F972FAB5A4ECF3A59238F36736CDCAD139F5290039065976DB9ED",
        "Reserved by Migration Services",
        "C_34895944DE541E1BDB606B5CC8E0832E8753C3EC1DF088BA96B2C1F930C39ECB",
        "C_40C12CAACA910BDCDC268A44F63FDE93601C53B5B501C80C38FD1FB3930C98D8",
        "MDM_DeviceStatus_NetworkIdentifiers01_01",
        "IL_058A5B1FB7DC952F689B612BDA615642767025FE637F2552CD2356FE70E70C3F.1714.1529246066.345",
        "C_2F2AE0FB3032782CFC02A53ECB298C92CED59F438DE994CDC658EE55155A3AD8",
        "IL_D50AEC47AB29E04FA6D203696193B42FDCBE6C8D0D9B7E93BD81124BED02C35A.2688.1853903349.264",
        "C_4CFD343F89F816CAAD34AEFE39C410FEBAEC57C4ECEFF6313E9D0F9D93057526",
        "CD_8004469B272AD6E985FD9425D404D1E20848FC64B0B2AD18655B397D61FAF076.1581.2661055391.683",
        "IL_AD1AFCF480FFD2E44D92A21C141A07DC0AFEF5AAB3FA466F5736E5569B7E6693.2717.346705904.287",
        "CR_61AD70324F8E2B3494420EEDDA5029E5D1AF2B0083C1CC1767F12EF889E146D1",
        "CR_8A3B6432A229F674039F0136B188BB0F847AE08B53B1611977C2FC30461CBDDC",
        "R_3AE83E61965FB27603BA5CEF6287221F55B7F43E8EF0935F985E7B5963177B6A",
        "C_B7CFE88CDD4E2F20D43EF63AF2894F6D14A41F54E4CF74F7D9A3F5B4EC2A87C0",
        "CD_B0C982D069DF886A21B9C5D6D3E55712FDD589640A126AD308207FF3B01B9DAF.281.1919235478.1915",
        "I_9EF38E04076AFC6B1BE30A9AC99F95011E1B7B88354BDF3BAFE630856D6A17E1.2701.3865761939.289",
        "CD_5C5AB2F5F8F966BB634B5BDAD222EA2AE9371E40D37C49EF5B43EA71CE83231D.1576.202726768.1016",
        "CD_C8D0F277D7F7D59AF0E214825AC68160FC59DD15097C20883A4D4AAFF0736D39.1733.1152319089.498",
        "I_3FE61113A54972D39C7E5615E7D63812829629BCC43F572ED878A906F5EFD883.2710.564751029.289",
        "IL_065D83C7BF91F80BFDCA92364FEA852DB3FE639CFB3B2F41624F0D1AEBABD401.1016.2537665243.314",
        "CD_B837FF0F19509FD7BD0B7ED8ED2B62529F924B69EF7322F8463864ECBCB01E5E.1151.3975447537.874",
        "CD_531B755AACF530EF0E073B9207E450A2EDCA2159A7AE00C6697E526492783911.1191.1438044756.612",
        "R_6C707473A832E8EC791BEE1730A35E787F78F19C8E76CAC82C47C44288E55A89",
        "CD_AF073815367B438138F1E5B4B3B3699ACF3DE3D6AC4291FED26D085AC83489E2.2528.4142266084.317",
        "CD_127F8BF97DE5B984D84C3FF0673304373AA677B9E2EE6800AD16FB9A0674887B.1757.1659568757.281",
        "CD_FE094C1FB84B65B5783A09EE15B884BF95BBD94173D9D96178608B50F8C0ACDD.2611.3361877808.383",
        "IL_9BCB6EE80506EEA7F0DDE8F3FD5863FA24235D4AE853C41E5C8DF6847C43E2FE.2684.3290165897.286",
        "E2100F7687A005817F1CBD7EBEA972CCE25FD772EC69DA58DF296",
        "I_A1510C6BB269195E4C4132E154A1A13BA6F6D857198BE9112475CFA673DCB04C.2727.75805707.278",
        "MDM_DeviceStatus_UAC01",
        "C_3E152FC2D094C0BFE09B842BEF965DEEDFBD99FA03D75E47107F03F5A9453659",
        "DeviceID",
        "CD_160EABDC96778D770525694D91EB3D28B431D3754F4699DE97314AA3F85E4954.75.2253873726.452",
        "40002",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.287.2897653058.368",
        "C_9CE28F3097463A7A7B3E8F7210FB0203F0EE1A77010AA6FEBF898B2CA50079D1",
        "CD_0F823E129BF22EE50D23DA52951787D623D48F86E765838C92011DD9DC1A6F31.2635.222149393.2936",
        "IppUrl",
        "CR_A9FE98FE5C3E9051AEEC71D48BD2011F883E1553AA2DD7968A20C510AD60108F",
        "C_63C984F6A28C9F19A7CCE6D9F6AC06148224451FDC94B8A24EF9D1E0C2887EAE",
        "CD_C8D3DE13E6122CBF2D995A000BAAE0C9FE6D4A2CB5F6BDFC3533203D5FD634C8.2581.1078115782.935",
        "C_FFBBEEB41878AC75CD38671CF9A4CECEB2F673622833FAA9EA04376FB4297330",
        "CD_DA7ED363AC11772E9EB036073A9510EF1E6C1D05C270A6F3BEFB2C129ED6E488.1758.3952180622.875",
        "LockAddress",
        "CD_BA7526B37D90714D7B62CC8C0306D68C0FA9CA2FF62FAB9215A612E133C74CD5.2244.389949181.3700",
        "IL_2FA9E9C28332D8F7D1BD39E588EA9E1C83D3389E22D9D5B31EE0F3BEFE106AFF.2699.4194412096.273",
        "C_EE926C10D8DB2362A084C286637A937C23BD1B08558667C32893A01C572D0682",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2426.2699293546.211",
        "CR_BEDF72E134298660523B4E81EF8162ADF7F5779BAA2B7F5A24367EC1E150C6BC",
        "CD_C8C4D941E3D754218CD879478817458E5800188A44CBBE5B0BBF1CFE323B08C1.2734.3009425754.499",
        "I_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.3053127222.360",
        "IL_9FAA8D02B91A759FF677BC63F05CB2AFDCA81703746EDFE0BFAA56AE8647B3AD.2724.2768712682.283",
        "R_51F3F9CABF21479B5E00904A33BC282B6528414D4B4FFFAC999E337071761517",
        "CD_0A70694BBDE45FE716DBDD82139D079800EE031CE266D9AC5DACE5E061A86710.1059.2915247703.215",
        "CD_4F1C732DE8891B6735DABB456D12844B78FD522910A121B420BCDDEB9B10CF13.277.1430608735.233",
        "CD_89D253C7F34DE1BDBB149B2A6193A187FAB48CDF693200563636A89559A9C956.32.2672319720.506",
        "CD_5716C70CEABD7700D5C5EB7506E45B47E45DC14D92F979C8251DF16C83BF2C0F.1541.2136851433.394",
        "CD_3A2370D9C6889B9467796DA6A6976384304863021FC49BC99B9E42776EC37B08.311.3829979747.426",
        "R_DEA224BBEF40A5F2D4A2CA371BF633744D610A42E8901085FCD10393CC6D8624",
        "C_7857FC1888FD538485A47D972780448CD733BE76C6B908A47AD01147FD85AA69",
        "CD_D14B35935271CE0CFC0B73FF55CDF115EA5E7A2716F3A5C2E409A53B3653FB6B.2558.3915153296.692",
        "CR_E306E17928F5CE290021F4389D925B031C7FC2C7179F9BCEC2F74EEFB178968D",
        "I_3BE5A640A89AD29F589CAC254A6E30F3B039E3494990D439674937EA1CCEFF58.2695.1512814887.266",
        "C_34904804988920D5ADDD4699E89CCA3704B43C3E300E615C1194ACA851BF70B5",
        "CD_6A23F044A3652D7FC71AC14411C94E256DCCF9AC4805A4A211FBC6A5B34872FD.1951.1445433687.656",
        "C_DDF41F712058E6FEF4B65E9EE58420E8EC3BE99BA2F5F0ECA951B626FF28D64A",
        "IL_6E14DC5BF582D82643F5DA24C299D59E6027084CD201981E27D848AB75E18610.2692.2872660835.282",
        "C_87FC3FB8BB46E54395D1465C589976A9AA29C410A5423CB9E87537B93EB847AD",
        "NS_0634BEAAA6D47E6371999AD405E0DDAFDA3BDAB3659C4858F565936A4909981F\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_1035B0F62EAAECC9C984E7834D0AB6A9928506852D8C840D14F9BAB2AAE4A68B",
        "CD_EC77747DFA1A56E57865C924EFFC4FF3B343A32F0410A14B86E627A721399A15.2387.2512408251.587",
        "IL_D51CFC40A0903188604CC64991F31DD6847EAEF5A7A909FA035EA7CDD8FFC9C7.2725.4258154937.286",
        "I_02E3B8C824FD0B9C15B4D49AB84CF02FA38E02CAF699DC3CBDCBB2D79F3025DF.1596.3058000770.287",
        "CD_9D6C206BD45CB880974789F4931A2F78CDAE201EFF7E32B71E8E7698AD1EB3A8.254.1568015181.737",
        "C_71B9737797902C207AE6EA27F94A2CE1B75787EE1092EC060CEB70575BF68076",
        "CD_AB1C96FED05D62166C94AAB8AE8E68ADBB7D202B0967CAE80232063AA6F41C6A.265.2281815119.403",
        "C_DCD7C1FCC05FDA8882A741091C884485FA94218566ED7A15A2356A202938112C",
        "IL_C38BCBD59C8501680BC5A14D1BE86945712BE5E122F4BDED1BBFA68576C2B1BB.2706.65642243.296",
        "\\Windows\\system32\\kernelbase.dll[MofResourceName]",
        "R_DFDE88020E8208FB9A9BABABF09C4E7DA5EA19AE68DF510A6EF373C809A9D3B4.2485.1561044957.520",
        "CD_C20D4B021E0AFFB61E5D90A8AD1A949CBA948B6ED6C506FD3F623477DE2DDF5D.2748.943603517.822",
        "Local Replica Target",
        "IL_75253219D674CF0117C64521CECCEF8B18A40F301D32F791873AA54E8F1E1537.2687.1294428517.275",
        "CD_4FD2270AA7CC321848B51530B7A77A9E39B5486B55CE0C09A2B597A1F1FCE1E6.1184.1810200560.5392",
        "IL_3F56798EC1082F3DBA19B1704559BE52E6D08564BDBD24CCEDC4608E836DCB27.2719.3169657888.277",
        "R_CC6FE457DAE151024825F4EE4C7042E0D85BAB50188619D281F5641582BDEA93.1714.2186688784.564",
        "6$~E9",
        "CD_D853AB6209D8A11783FB9991FAFED1455C3BE9CAE115768B2C2CE0E0FB306714.140.2925976488.2008",
        "CD_94F1590FDB905D950BAF02FFACAD42721EB43DE671A1F6B19626D4AD98635FF6.1550.4148085832.685",
        "C_BEDF72E134298660523B4E81EF8162ADF7F5779BAA2B7F5A24367EC1E150C6BC",
        "3D87AFDE77273A97897B7B012F0BFA851DE8E60A.154.1130414801.297",
        "CD_3574CA0F26B4AC51BE1A9D13287FDF35F510716AB14315900C3DD347BA7A0FA0.1611.3203698528.2254",
        "IL_2CD761BE49E7EC8EF1DD4C23DCFB4BB2F4200B0920FB8C88552A739511C1DB30.2711.1911607274.293",
        "CD_9D65F32BB045C84F10A30407BED77807C86E51BA801E6C1E84A72041D5A6B599.1568.3368976806.419",
        "CD_8DD78BF674D4620E5CE2BF96A17EDA8C9FC0C81974896480F1045B5C1405CB1A.1542.2197024107.1511",
        "CD_33AFC5533FEF2AB8957C705077D2CB2428067503BF4A8D79697DC98C53B8A138.146.3569496020.750",
        "R_8771AE8CEBB5614A0203ECA1F5690F7C9DE50BB712DED367D1D2978F0B190194",
        "IL_84B577359129FEB26351DE1AB13F43F46378EA3288A2291DBD252ED06583C9B6.2711.2473161024.300",
        "CR_D75AF298547A60BC5DC28CC5F9BB9F112DC00D9A181668F25979B122809C5257",
        "C_0A3ED80DFF0A7A8EACA9D802C83A2110C6D7BDAB1EFDEE73E88F2ECF8116F7E1",
        "ModifyAuditPermissions",
        "C_D9305F07E7EC33FE79ECC40BFB08CCBEAF8C31795EBDD080A54420FCDE7E017E",
        "Error",
        "R_B657787761DD3065C6C5713524442ECA87F724490C33FD75FD3A4566782A0D78.2472.3998919546.558",
        "C_AC7BB2CE72891CEE5B24D1161F798647F6D5827CC518A0A64C2F1BC7D1BEC738",
        "R_EDAC6CE99B7D69460A458E3C2C8E05C22CDD633B0DAEEA07EBF046960AE82F53.1476.2416644123.534",
        "C_500B791BBFEDD0EF6DC1FA9B56C1442D75CF8FCFADAEBCDCA51CF4251B2B1ECD",
        "IL_DEF1BF075B261799D0512C40440084B446EB057FD2BB0DE92129B3BC752F69F5.2685.3590575534.278",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1353.3692867184.368",
        "CD_15BEF6DF5E996A00A5E54D9D43780EA4F3A24C6AA9148C8B53886E72522A6FAF.1550.1768556350.425",
        "IL_1FBD6E3E8AAC9A5E67D7B33B5E6D55396EACF61AD9387460D6D6F48EAF33EBB8.2735.2218745371.264",
        "CD_753AE586E2D74399EE7F6C1BA988331E5E7982E68E33445A3EC32F0EC6B48917.2578.611410117.1218",
        "C_BE6093C5139ED6F3240B5CB2E75015E9A86B9CC5A18B658B35FBB879B98498B3",
        "CD_D368279AC7611DFF322A93B0CD77B818394B5868D25FB187B8F5084FDA0E03D9.2575.531492545.792",
        "UniquePortId",
        "PerceivedSeverity",
        "I_81E1B447115AA495169E968D729B808E6AFAAA8904F1D6ECCF6F17BC5CB9988C.1094.3764814740.252",
        "I_6B4187392529ACC8AE266FF8A91482AC207285C338478E3710A134C0B31782AD.2683.2420775145.282",
        "I_7936F4E9E742684133235874979A0A6DA7B2773C2CAE6185B42674E8D0E79BA7.2683.338989049.280",
        "CD_67B957B7FD1451F4008C60D3B500296D0371242C5A3269FED6DD43B17D84C14E.2614.3933405256.427",
        "C_0F00E7B059327B1D3BD2203D577D90DD0AEFBB2429D93A104A20F3A088A7A888",
        "CD_AD7EFADAD1289B4A3FEF0D60EBF19DD1D014EA7A1302D0431E7F57E3F564CBFB.2152.3457610475.3209",
        "CD_85629F8188EA39A73B996B8807A12AC606DFF36E46B01D25C3DE26A6E97E2C56.2652.4160205230.441",
        "Vertical refresh rate numerator (Hz)",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.1521.2141289580.3778",
        "CR_E4EC3642DBAAC119BB7D98363E08333001320E1E613FB7C4977DB452606906F4",
        "CD_27545EF9AF30016456878C73334927CEF42796F61B60EF109A3D4C4944732250.2019.3406995501.3104",
        "WmiMonitorListedSupportedSourceModes",
        "Source File Alias",
        "IL_D8AFD32452F445AFB78E038E1748BAC7F8865646D1D4329C8A673315241ED6B6.2677.875791444.288",
        "IL_2C3390DA0D8113E7B067C5F12CC8E1742CA924FE4948190A81257D1A9CF5BDEB.2512.1267080331.280",
        "C_AD421F11CEFDE45C82C30BA4C4CE4B25170DC00E4DA588502ABA946455B19C47",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.1504080944.180",
        "I_C05A3FC584E4C7E77B91779FD601E18B96ADE577875DEFB7E16A4A239857CD17.100.1385632911.325",
        "CR_328F09EA94A11C49CE9879973AEFE371583535ABF3A24603CDCD08371B636C41",
        "CD_F9806F1F2B507793E6A71330B14A8A23FB4580D5E9F8AB836C72D241C50417C2.2627.3338554628.709",
        "CD_23E0D0B8777EB7B06384C6C4FEA93EADF588BEDC4180BA0D86CA1E1ECB843EC0.1581.3240850414.1303",
        "I_74DB269AD97C14528C528C1449F1DD3ED8338C809E68E4848164BBCE7DFE6620.1053.3517424961.351",
        "I_C199E3EDAA2732EA998817EE4E25986E194C5F1A34740C8F193110B7B426B361.2721.3229312945.282",
        "I_F5E021D5620DF76DB11A714354730BFDB3845D5ACC1D57EAF3889D51C85AA6FB.1498.765048173.281",
        "I_E94566BF504DD530A5B6CDD8332E0677930FBB4322E53A9C53D84633C933B6EF.2764.2387448604.288",
        "I_B56173B7DF96EC3A79651A1BACD77E8355FF4B6D4EB6076A54F9E16DBA8BEA7C.2682.3309255573.288",
        "C_E444CD7B23739F9E179DAD07B13CB31D8D111ED6AEEFD52B89FB204BF93A5A2C",
        "C_E1339E45991CFF28C6A45A0DB3B482D0FFBAEAE0DEF0210F7EB4489B09CB933E",
        "CD_4922BF9FCF270243FFD4F9D426E064C4BF15B5F3EDE04C2DF03239BF6E262DE2.1031.1.70571",
        "I_4F28049B29ED0162FE0090B43C7F9ACB02BB2A7DA2E5515A9A1D50C0DC210D88.975.1.48287",
        "IL_6CCA910ED692A20FC05D2E2F3F038996446CB86CE2DBA190B79D021048C8880C.1150.3511467665.296",
        "CD_B96031C532B0B65B8A381FC99C330B723A6082950CAD96992CF66C16EB037045.2420.3607192866.677",
        "CD_8DABC771033D66BFABC743103A93BBF348734BB768C18069B00A756AB4906B64.1541.3101592618.668",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.3725407623.180",
        "59=AEIMUY]aeimu!y}",
        "C_BEC7957390E69545622E33DF7D0A224770A47F3DEA408861F4867699D17DC297",
        "IR_A41A2A506F07DE19FA26EBBA5A53B62D2C62BAF775EC8BEA2B152B5D21A711E3",
        "CD_92F96D470C0B7C61CA6FF1288FC335BCE4A6A5FC50FC3D3E646C17CCD603F881.2065.884498504.778",
        "CD_A0E041B4B9BA2D45BCD93AED10DECA3DEEC4B9F73DCEDC4BFA8CABABF351AE00.1191.86337108.607",
        "IL_5E94DA09A144573A82F81610B3CF5A67CFC779709E041C4BF14CF4C648F2CACF.2712.1906993237.297",
        "CD_7FB3A1D15087A8B0862F6DCD3981161C8E3BF501A2EAFE3B6D31AED8419C27C8.1344.220070095.1209",
        "CD_EAB63970C0C08943D473111F249624351EB5AAD600FD375231EB2F93F7AA8EFA.1544.729510163.534",
        "IL_F75DB8B281A6C85DC52EEDE82A2A8475D45877024A70F3C20E4494FB9EB94FB1.2710.375845903.286",
        "C_00C6462083FD672A44B8025327FBF19254FE0D419FBB67AA8CABB84936A16323",
        "C_3228C3C4A6C3076AB2B5BF5923243297F76E5D04DB6C72B457774CBEAFF090B7",
        "CD_95FB3FABFA971E67BBC725545D4CD1F75233F0599BB8B29A944361BD82FEDE56.198.1432041922.4579",
        "Digital Separate",
        "IL_DC48548AD292F286EE816940E45BC5B0725DD008BCACDB78AFDBAAF1FAF6D5C0.2721.110231648.278",
        "C_BD2E1382E86FE7DC3FDD841FB021E9B63AE65FF929B53BB8499204A9A85529D9",
        "CD_87FC3FB8BB46E54395D1465C589976A9AA29C410A5423CB9E87537B93EB847AD.2403.1589183505.672",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2070.1590554102.368",
        "C_D4DE714020C13AB0D412D492BA93C206B924A3D361B84FB3EF8E572392E96180",
        "I_09EC1D8756C30F8ED5D8EB9852B2047C26527A4C71465277DE80068199B8E56B.2717.506464875.270",
        "CD_0F988AA56217E8EB25B7DE4FB153503009567FC06222C017E84DCD1623DC5829.1516.3719131667.559",
        "CD_61340937E5D8C4D3C9D45CD88D4999E65F9C88FB548157F118E02C98B67C9BD8.198.3579121322.718",
        "IL_BA0A62B9B252B8DF15D9E586D8D36A00E214D826B2BD41C8DD9DDC772381781C.1148.2517947688.342",
        "I_292966F6674F4A3E9EB6641260640C2C721A91045ABE4947920347839B068269.2691.2413738261.273",
        "CD_E4EC3642DBAAC119BB7D98363E08333001320E1E613FB7C4977DB452606906F4.1437.1.105503",
        "CD_12B929733A58D0160C0FDFDB23E8B6DD247E7D1693029B77B484D1BBA4C89AC6.2612.1302707197.476",
        "CD_4DF972D0AE0EDCDFD3BB253394B1DE692787B6CBFCFAD61D9568CE731F4B1BA4.2534.3061635954.483",
        "C_9E0C8790D6EC22D495C0683C2874C55C68F20E49180E09C4510CBF9601E9CF64",
        "I_1DA4E180531B401F40077208B50BBADCB6F447B0318A02A094D8CA2E1EE53845.1752.2353653569.294",
        "Centralized Publishing Server Information Service",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.3332474462.279",
        "C_75DCC5501459F92CDB3FEB632F97BB7C31AAA71AE0E5B660A7C1DBFC51ECAF25",
        "C_8BCD1158FA55A97ECB80A8A0C49F60B30BE674F3AC52C77B04DD60E3D775D71A",
        "I_E91F0F943EC52AD54AE098D029DD21BDDCDC72D558689BCCADE99FA90F74F3C9.2678.367834356.283",
        "I_00A6FEF1B7DB377460CEA9E1CC721F7C9B56A8F48457D47C52B82FAD5B171EF2.2708.2475723418.293",
        "C_E32E80DC72B8C4215628F30ECA0289426647C256341362660CCAFB5ECC66DFE7",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1780.3650505445.180",
        "CD_BB1864ED13E60C22074D25C584FF59AF554CE92715925E31CED372950D2F6DF6.1186.2573564704.6787",
        "C_AE5557242873CF979D93E87FECAB292ACCC2C01318E17F5504ADCAE7A065AF1F",
        "IL_AE153DFBF602DFA10CE6A6B855346AE025E257F8D1EF346D5547F01008CCDC3E.2712.3148423235.296",
        "CD_EB5DF692E5695761F8BB75E5CAB5C2E64C9D570F7A2AE8F24E9823A6FAB0CA95.277.1265055182.232",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.1080.4140634058.188",
        "C_7C4D4C779B8655DD6A7E86DC91922E10770F67B8451A5A7276C3310C51D0FD42",
        "I_17DC93F83304BA95BAD1E83CF1A534B5F2E493B534BE48F87B588F229F5FF956.2681.2430488508.282",
        "IL_25113E617ECC09EE814F219BEAB83095F0F754B95D43DF3BB32E8A347078D141.2688.2157912072.263",
        "IL_E40B350B9BB81074A88A01DF558BE6E740B757A79BA5DDB554D0F7289A193F17.2490.3040695989.257",
        "C_8E41820F5D3747F37A9AFB4C6D31D95936F76250DC1731B0B518951FA4D1C211",
        "NS_6C47599266B9BA84952719E087E8E66E4BC74C97F7F06A55E52E1C43037AC181",
        "!$H_S'*-03e\\6V9<B?bKO",
        "I_DE57F7AE8FB501996807E146319066676112A55DF9DC0135A1A8C6E4EBECC8B8.341.1.89245",
        "NS_33649B8965454C922467A4F161F8843CBCFBC36216BF16B17C1FAAEAE38C9913",
        "CD_3FF4ADBFE846023B8A5412007D4350B3CC0DA66B9B5ACC61FC6D1F4DFFE32951.1959.907996601.1353",
        "CD_76A570B33AD5E980266DA88075A5C8D352CFF0581C8C28B18A7DED74969E7051.1155.275168397.386",
        "I_68DDC0CBADF746460BAA2773BA9404108071083714FE79386D5843AA94F942D7.2687.1418894872.274",
        "IL_A963FF6A8458E9C4FEA354824C031F4237B8648981577F19FD6854C86994DA8C.1797.2375707628.192",
        "C_046B79FF8FEA26EEFB72057DF7A67A7CB75727CCDA1025821CA0170FD33BCD6E",
        "IsACSetting",
        "IL_2B425BF8CE8732BEB182F0BC728E928FFB0498DF8A9FBACA0C514518961A5460.1020.2464951227.256",
        "IL_28ED281B94DD458CF13AE557A2E074E5845B460E71ADC792A8CE8BDE8E5F1A21.2714.2724209430.274",
        "{266c72e7-62e8-11d1-ad89-00c04fd8fdff}",
        "98EC80B84653C13E848134F7D8974F0E.2726.1034906803.278",
        "PnPDeviceId",
        "C_BE638133AD205E7E82E7EE572C3B8A31E527A6DE4CE929382C29EA547A1E1AF4",
        "$(,048<@DH",
        "R_C57579C0A82CAC4A333EFFC4A521C136480A413CDEE903BC5BD3E3E491643B9D.266.1379541087.524",
        "IL_E05691F288C6C845F6C109251FA16F160C3FB2345B71ECBDDF85E83B275E5B39.1017.1816352371.313",
        "CD_6BF4074B06004A36C71E7251D583F11D93600EE30099410036224B7AAB597368.2652.2834036341.673",
        "CD_AA4B70EA5255AA64C74A83CD5BA0B9857A87B20B85485E53E4E0251E0DBD36A9.2543.67360379.497",
        "CreatedStoragePool",
        "C_AF3DAFA72013C3690171F734765DB1412DBEFDA2A461CB66FFED0CC4B21B88F0",
        "C_7D654D806B89248A9B6887EAC11F1807114D49A174CE2C32046A0DDE6243209C",
        "A3D79D07678BABB3F0902F35B2DDD280D3A8A7FFFDEC625AE416BB28D3.1303.523801834.849",
        "C_3845DF884A9870820C258E1FCDFDC06294500F6C55F2D32133ABE22F6C920434",
        "CD_76782355937384EA09D0B0554B1178EFBBA438E86E7F7385EC42DBEC33B0A109.1928.1605761246.259",
        "I_27BDB5613C2488A72059BBDAD0ED91A11C338E50F62F3996CFC1DA830AD63EEB.2709.801147140.311",
        "TX\\`dhlp",
        "CD_44199FEB2EA5AA114C34FEFCE15EC340288F3AE7F2F9B159DAE8176076473712.2008.112494920.743",
        "IL_81E98ACDC034F2662D7DBA9846C0A8DB94AB1CCCD39C50054DE08EA9F05DE08F.2706.2270185458.290",
        "CD_6D677F300F8EDB57C4344519EFFFC67AD59F24CFC7D2D479945BE7862B950AB4.1950.3776319333.256",
        "hkwnzqt",
        "C_7D3568009A8212EFE2BFED9D89FF4D8CBC4A83050B48D8214C1E0B27F36119C6",
        "C_FCBAF5A1255D45B1176570C0B63AA60199749700C79A11D5811D54A83A1F4EFD",
        "C_9D81E9CFE685557496FE0B37978C7E405A0EF479104986F29B311A83F21B61A4",
        "CD_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C.0.2208768175.275",
        "I_06CC9A05CCFB455B8B3221C638E29AC28A8100390B50D06A005C4CE3D39E48DD.2683.2986057804.285",
        "C_329DCF22CC9EA0788BB9C3FFFB20B99F00D18849EEFBD38BCC78B3640485E3D9",
        "CD_620890A69B80D6D0D8B61CEA61FC6B42048D649BC6C1CA981E37A0A2496AF4AC.2651.3598898158.679",
        "CD_0670B73B6B090142BD85762A0781366FE00115AA7451B9B2750B5D23B1B3C0EE.124.1212206233.4693",
        "CD_44343FA1011CD581BAA71CF6D5100CB65A1326765FF439F0714CFF1B592561AE.2574.2434526202.1246",
        "CD_7A2E82FAA3D7445BB721477AEF5A828AA728D419801621CF35B28E55DA9D6FA6.1745.3436595000.475",
        "R_E091E6755173CEDA0C35AF424854DECB26CF90627B78F06DB8E87E6ED8C5E2E3",
        "I_DE005066FEFC9FF24C8817ABB8A5DD45FAD11D751BA11D5A04F7861C2D0B3DAE.2736.2738140148.227",
        "CR_7AA68F24A3819A669E00384CD6D5128FA13DBD361BC7AF482EC99DF104E6488C",
        "C_857A93520BEDC9F703DB461D5CC8192FB10A25C77E5665D06DE039388F19CB72",
        "CD_20A36A4D13FFEDA4F3BF68F20D7254C0839ABA34ECA738010C8AC2B49156D61F.2115.1218701693.1466",
        "R_43D2FF9F27C9DEB49402058FFFFEABC225D67F17C30DC663FA2980525D05DB01",
        "CD_07A4F1F03F4FE5CC2CBB8412BF6A16EDD132FB8AC435D217731A7A09A64C0DE3.2418.2407124636.374",
        "C_4B0B895503E2FC2B96590F7FC492EFBE7327B376D3B4FEDF8FE7EC36373A4C97",
        "IL_11AD18A79EBCEB689369B81E350D3496AC2AF45588A574E361F6358743201A7E.2707.4045560932.288",
        "C_DA6435B5A6AFDE1EA49B0F1FA576B2FE264B6CCD6A9F163C86C6173386BDC535",
        "I_A463F46E3F13722E26A5B52AAA3F819E820EDC2228754A7CFC8924C226A44BAF.2723.1032476379.285",
        "CD_0F0246B85DFB21465F504A8F9FDE4CE80FA27F918FC6B2E414038FC937B02771.1601.2824644008.763",
        "TraceDriver",
        "IL_9EAEFDB09214473EA9656E8585880B718CEBABEF51CDA98D5AA27614E2783AFD.2728.975735250.280",
        "I_F009668D2B4A779B3AD3C2BE1EADF707D2996FBD6CA406371FA7E00243DE837E.2712.4203298787.285",
        "I_BDF1D05ED5D2EC6B697CE077D1F3059A3379DB3CC4AB13FC98F316772304195E.2709.903428955.305",
        "CD_9908FF01855D016DB247597026090F753BADB4AD0E4EFB1386220A76CAD43211.2557.841580195.680",
        "Friendly Name",
        "object:VpnConnectionTriggerDnsConfiguration",
        "I_5168D0B4A17AF61C869189B9ECADC0C8A5A38A6081627D231985143C518DC742.1090.3344568924.377",
        "C_1DC5050B83682C310993D0E23C7DB3EBF7DFCB3434893B4CCE67A03B9E83366B",
        "C_72B9EBDA753C736D01652E3A64B55ABADDF5DF6176D787338F799F912E7173EB",
        "LoaderCodedEventStatus",
        "PowerConsumption",
        "C_A1D67EDA20E5B60C7C1FCB2628243152EDF1177800C5956CEE6DABE22B3EA0E6",
        "CD_65C33823125A389998EE918715634996D26443DD7799EEDA88DD0650D03B9936.2066.2958395638.778",
        "I_FE49F3187010A17140FEE6D88E26E9D9D4E2B221F35F75777C8AABD303B2045D.2685.846581176.289",
        "CD_81CCD9F49463DE42E5F24116205A8C2F9DB6E6D4063663217E282C3E20BE0A3D.37.3090022237.420",
        "I_BB8A83D677A9FC08DA3FCD78BEA677C8D8861EE1068A03174636F3EC2BDAAFE0.2700.2551233292.283",
        "IL_17DDB24E06C80D313A770A8371F66D654B7CABC1BB0EE94CAD421F946D9BF27D.2707.116747591.314",
        "CD_02B5557CADEF33CFA29F52E782D8C5DEF3C67D29A7C0C3B389FF34D1D0708EC3.1060.1263373871.5240",
        "CD_19B836CC5C277C06F277CF4D6E071080E3AEFC1E57F6073AF4E11957163EFFD2.1550.4215589049.419",
        "C_C1B039C6B15CB1268319C147066B90BAE1F5E0DA59EE23E8DFE59CEDEE8D5513",
        "C_F6E6FB7278461ACDB6C8A1357DE4FC989962054E99B446DDD1C8D6A670D2FA0C",
        "C_C013BAEF52C1702952D5C4A7F180A34E20C7F843E3022D39040318DA1B2232C2",
        "C_1D5B7D85296C726B09C241F1DBAB33DFBAC888F063F0064418C3F95F3FA642F8",
        "I_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.3705192055.338",
        "C_156B8A4042E45863463CBEA7606B8486296C5FD66B55B4AAA7739008B570D8EB",
        "Predictive Failure",
        "I_9566D31591AFEBE89E462D729CD961E8565B18C89CA9B093CA338027ED8836FC.1016.99382667.314",
        "C_09AA62D4FA690685039BD35AF8429B94B397ADCC4F469333BE67A53F943C12F1",
        "CD_CE73BC7D26AAF30679FF45CD07C91081A8FDCC9A1636CE37493179FB839EB641.2593.1402107536.219",
        "CD_8CBE6A0EFA02AB4F93C3A1CC477E795A624A7AD23C5328A0447BAE721BD99CA0.1334.989374452.993",
        "C_69682A3F4E660CE94CF4FDF3F99EE5C0DEEAC14F4AC4474928CFB8FDF1B19380",
        "C_85D421B84B5B7251EBC11B8632E5849431920BE0B65D215F3D35E1300F5D0BE1",
        "SEL_RECORD_TYPE",
        "CD_556C6D300BDEA99DE8588E2B5D8DB1D5A33F34F7DA1F6E6A0DA0951B22252081.31.2712234224.470",
        "Bus master latency in microseconds",
        "ref:Win32_PageFileUsage",
        "CR_520F4A6CD1D22F206E6F5473B669F39AB1310B253B4678DE0F3ED216986A8D0A",
        "IL_A250203A9552D6E624849E78B7794C5B61FC5501C6701BE9D9218B908C709439.2700.2913281474.273",
        "C_4F1C732DE8891B6735DABB456D12844B78FD522910A121B420BCDDEB9B10CF13",
        "CR_C4F661973CD3C0A0D2984AF60EF23047396681C367251D4E47D1DDBCE0BCDFE6",
        "CD_E5C7C1FE3E6D7A2A16D7E74AFFD769F1A6084374257017AE4D85D9B4B8AA55D8.1163.2383880963.298",
        "CD_82CA71B3FEC6DA6EB4F924B77D0FB3271A2915AF06140B4E929C663B08F996C1.1541.4231463872.589",
        "CR_75C9956E7779838B54824FF45E13C905411B41652E6FFADA64041E0E4ECBDBAF",
        "C_5A992D16EF22078118FA0BDA7433526341ED13487F3C60B1417463784E5040F9",
        "CD_E69678D95075FB6BA6844B84FE0DE69C85BE49AC691754C5A6AA3AE728E45697.93.4250014313.1847",
        "CD_77A58C176298EAEDD16295F07B3FAAB9E2EC89D31A3D4C3CEC3E4EFC8377E9CA.1928.9888466.1040",
        "I_AD8A41A11757A955B842BF5D3088E2B483ECD1357A92C5ED54EFCFC30D69D599.2735.3331639432.280",
        "CD_C3C6D8FB3474EE785958EA6FF4182273D2A6254E9DC15AB0F00C01432187E439.2425.3027724890.362",
        "CR_ED570D21D0D7F1575600CF30D60A5C9A675A42E8F301530AECD595FF166AFB26",
        "CD_939FCC6B5B4675BB5CEC42A6515416373AC42FCCBCF280E4E5D7805BB730869F.1382.307292831.271",
        "CR_D336428E5FE02B93C4413230D0BA8394C3D8D327B0A951AB98E34E7C718B63E6",
        "I_0F7F13DE43E9D814455F803EB91230753AE96BA9DA56B4E4422BA553F2EB4174.2693.3174317615.257",
        "IR_F64CBB6502987426C70B3559DBDC49D7508E36CCA9EC2C17804EE9C4A5287859",
        "I_687B15A6814DFBC44BD24E7676CFA5FF5818E5BC0ABD402D52CDCCCDDF974C90.2696.3859527666.273",
        "CD_ED32C790EDC45FEA848CEF5DF0CB83F1E1D371237F64D00529CD1A7DB924F38B.1194.1014631282.658",
        "CD_F3ED82F33431603D84B59AD5C9C4CA59DF4FDC6F04E98BD4826D692A26D5A5C0.94.3343714706.769",
        "CR_0E67BB25323DC3EA41359AD7146AF598B2070A0BF4C85FF998893FA100060D77",
        "CD_8613F5C7954CE62C88FC8F762439D00AD2C7D41714A9053A0C9F43F4A8F54243.1570.2091498176.425",
        "CD_C5B405B6E0B6808F8C21D9ECCACCEA423774925D78B35437176C3B1A93D8C59B.2558.2348535612.670",
        "IL_66DA71BA28E298AFE44B6F7A671DF042F12441319F66F1B266CB86486B7E2819.2691.4146939013.273",
        "CD_C7B7FFF993314953BE1A6F3ACE26353D36CC0DC4B7DED5F1ED16B7B7499EF72F.1463.3538575064.687",
        "CD_1B44CE641DEBE8226ABC64761E7FF4D2BD61A5ADA9BC945BBC307822FB8B9D29.2590.1207308479.1863",
        "CD_C05C95F46166D09617D40B3234DF5D418002473BC054BEFB1B5410F8425E2AFA.1779.586404641.316",
        "CR_F4AD89F24C5E59F704DEBE5DF4920F1D71930B871988589A8D9D698640C4E7BA",
        "CD_A4CC62D79FF3BEE16BDA851BF3B4C6100B812B5CCA4229E192A675F8D51A19A1.2587.355648536.1772",
        "Win32_PowerSettingSubgroup",
        "C_065EB15DF476F783A483B00F674DFF856DF35C72E87B7E414EE69BE5DF4E9372",
        "C_DCE75436D8B2B23F9B44B6DFA11CAD570BB57B2FDFB30D4B243923774090A86C",
        "R_FB45B8D9320E818405D79801CDC499E87D50956AC9FA6D71D017C76991D657C0",
        "IL_805B941F9D4C36C4537FF593D07075399E2D32F7AA49BFCC5322B779E6E9EE9B.2709.1690070654.304",
        "CD_DF545E8A447AE67DAD82438E1F3562DF5CD3473F59D562B7C0DB49601F84DD81.2120.420241707.2116",
        "R_838E13828F10196D3F66F7B92E25AEB70BD0868AFEF218970174CFCF1AE4D54E",
        "I_74D6C8F0E1FAEFD682A009EFD732BE4C07205D2B16A2DDB975E0E123C01843B2.2715.3251878779.276",
        "46001",
        "R_33B0A3C692AD567B6C92E618FD5072156CC98A3BCAA3A93CB3F15A5E87E34AD2",
        "CD_475DC738959A6644A439D03D5CB8431B3F6A7C1B747C351A2E92646ECC0B1213.1365.1378920531.620",
        "CD_CA5E03B6357EEF3C2F92CFD39219BA6C5D6285B9E53EBC324CA96967ADC89A91.1520.166928778.662",
        "C_3541C5A84659CAC98F91C5637C1C9F472B091ECDBCFBE8002BA8E0AC93E4496A",
        "CR_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D",
        "CD_3C3DC1FC0A2C3362852034A421CA1C0F5DEFC85E5D2010545B210907E075E4DF.1192.4026624119.246",
        "I_53A1DC0DDA2E39C523B626FE8ECD05C37BEC420D592C1BC708D9489C28C35DE9.1066.916608438.262",
        "@d`PX\\",
        "CD_BEDF72E134298660523B4E81EF8162ADF7F5779BAA2B7F5A24367EC1E150C6BC.36.2389595550.691",
        "C_C84DD871FB7E9CB6D29DCC02EA27D46F8AC10106A4A5F7B1A7A789F07E15462D",
        "CD_84E4DC9ADD84591845DDE4D56A48ED16102383DDBEA596D81378CA24FC85D652.184.3678030144.1329",
        "ll.mui[MofResourceName]",
        "C_5430A0963BDFE45F48448BEFE49162AB9A7F5390BEE895620AB94C03956A31E5",
        "ImageFileName",
        "CD_21A80891DF55F17F9156BBC6AF5DFB17171E94A3610E79FE912FDF2AA405DE37.2652.905384924.626",
        "R_A24ADD302EAB273CFE6B09BFCCE2A5EB53CB3E4340505E546264D022430FD671.2736.2628844849.492",
        "CD_BA3FC4E8301B193C5A48BFCA7961F2A1447DB65DBFCEF017938E455E2B82923A.259.3987215669.1405",
        "R_E991E45745117956DEAFF1C67CF04DB972E8AC05E236ED8130C434E25D63E63D",
        "CD_93BF28F302E6443FAB621D1A850026535EB5CC363B6312B15CCC1CCDEB884B1E.1601.2903299731.593",
        "CD_06F709A163637DA41871EC661878543C4C8F0288DCF32B1331F472D89C57FA5E.1955.3713149549.593",
        "CD_DE762D4F54CA8D4A72A933CCB954C233CBA0EFE5ACE7AC56E99804B37A313953.2593.2643931843.474",
        "CD_9EA1914F1B3969D0904DC11AB6E8C7BAC75F195080FB4370BDA5C6102822240F.1490.641032500.362",
        "C_35B1B65B914DF07FAC7860C3407AEAACB382311D5C7C7979B2E9A007C56D4FA3",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.185318268.231",
        "CI_FD3BBD4C42AC2F7FEF264340A9EB78A581FE5C28561CB63EDF780B329EAC2EE4",
        "CD_BE6093C5139ED6F3240B5CB2E75015E9A86B9CC5A18B658B35FBB879B98498B3.2582.3105197311.640",
        "CD_B83EDC36E507DD94F76EF80785D352A67A9AA551229CAD025BE35DAFB6624CD2.2615.2430239113.409",
        "IL_B25C862B29E8B024B3C05FB2CE86F6AD358524C7F69C212F2336553D031C6BEA.2703.1555011938.290",
        "SessionPoolAllocFree",
        "CD_1D13F523791F1EB20EAEF6F153AF80EF4F13EE29DAAF24D54E908D208A687279.2285.3078372897.233",
        "C_5001D415C6B6A7F33344EC2166974BCA3ED1A6D95B9DFF048A69B10233E39F47",
        "I_CF9548F39545C51C0566C199A2B00D75B80CE4ACCE8A14BBFB690E777E106C83.1130.2971655542.184",
        "I_11E7CFD2E458F6C890E351AC0A37FC5E0C06A7839AF030746D343DE6FF14B8AB.2705.3686318298.303",
        "CD_754E5946CBB29D1190B8A84A81859EECBF1905D53963E568FAE53B4A9E6590F4.97.943232929.667",
        "CD_DEC0FC4E25BE960BC9ABA34186A4EFEF64A55170F52CD37DACB7598B3A49CA31.2595.2441918729.754",
        "Transitions to offline the remote file system scope associated with the item.",
        "CE538B24F14E9AE9F0F8EBF9CC275EF6FFF33FA86B2918CC9BD3D0BFD4.277.2060025413.627",
        "C_E0C55BEA2BBEB604B7FDA1662DA6041DA8767BF74D24BFE7A9F43067C0A21CFA",
        "C_ED8B429C0C6338550E0A0839881523DDE7B3F918D56816FE1DA9ACD95BEB7295",
        "I_2D0C01B191AA42E37D3700F82901BB11F68C84D0E59E61C6344C7FCE29F0993B.2709.2040667514.296",
        "__ArbitratorConfiguration",
        "I_2381C996A59A0D1EB6DDD79E1C697FECC05884247B858E341AE1AAFDFB086D7B.1197.2250181767.316",
        "C_418C5DB6A4996A7931075FA27FB4B9D160A819D899115082794D414F286000CD",
        "CD_67A1B3C9E888999A376BF0D2860E1A2126F2751ED4812118CBBE4C62C8E3AB0F.2485.130698210.794",
        "C_76F06702E66816F9A4EE931DBEF795220B2BBD5798222D30A793AAB4882409B7",
        "I_CC18B7AB606AD9D10B8810BCCC8DA26ED9F1CFB9F3C552928EF6CA039EDB8F40.2695.2549826986.269",
        "RequestStateChange changes the state of a job. The possible values are as follows: ",
        "C_C8D3DE13E6122CBF2D995A000BAAE0C9FE6D4A2CB5F6BDFC3533203D5FD634C8",
        "CD_FC4E0F3A799ADFC0F2DF9988A333610A6C5A2427E1901404FD3CB754B0E93B5F.2619.2355492212.2163",
        "CD_EC218CCE39B1A69692B8F67C46683B41BCCB3079635712D8AAB3061393D01076.66.1377918102.190",
        "I_866A032D6B2FE1717CF10787541C36C6A6484D51105E647FF1A0225D5CEBCD96.1475.1829273927.329",
        "CR_92D90F38218063ED84DEBF091001DAB75383FEA23B31338C700BDB5B69D9A383",
        "C_82899768E5AE4BBBD9569934B91FBC458CFC15B5022DABD88277069C398DDD41",
        "C_81A3B19DAF97A060286E4C71C6B3D0CC78A51FE8093E9D9FADD83D8A9A121EF0",
        "IL_F6E7F08B31B0C78E8BF9EFF146D032533F3586EC90E61B1DA66A9257751BC9C5.2712.647954723.271",
        "CD_259C5FBCDDA2F46A05D031FE1474E0BE7FAD9CC9F46018D9F05C6852D39E0093.1097.3969769485.346",
        "CR_C21EED7191192F2ADBCB9708104DAD6A17FD5A43846B186D22E5E8405D0D7A69",
        "IL_687C973F5689E18D23E76DF9E9019301006B8C4CC5C6A3F3DC3A6A8B646AFA2E.2686.4284999006.295",
        "CR_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416",
        "C_E9D1340FA30260FE6DC9A13A7C426F447F5CFE8119285A157042BB8CB324B46E",
        "I_DBE43902C1D97C6C3F9F5FB6B0775FB8806F63D427E93436E0965B70CE6B70EB.2716.452751123.278",
        "IL_9E4BACCE11F49E9D089586BC1222A0D92425B46D601EBAD2E04BFC3E26B9CE55.2451.518996735.362",
        "CD_E9A271CDB0AA8DC93908354AF625A7677ECC24A76A0652A26604EE491F530085.1543.3553280417.521",
        "CD_1F9156897A32A9ACC545E10D9BC352A3422528236465082E98E5F86D2498DB4E.1929.4082960664.288",
        "CD_200C90EF1F37F3C6854C8BC7B412F068290AE1652EB71A6D74CD3129536DEEED.1070.104978772.2151",
        "MaximumCapacity",
        "CR_B9D58526785010F225A5B7C3571EBE488D29C0DEC319541C93BE914E77155B6C",
        "IL_00A6FEF1B7DB377460CEA9E1CC721F7C9B56A8F48457D47C52B82FAD5B171EF2.2708.2475723418.293",
        "I_409829D4D1713FBB71FD7A81B3A5F25767A05D20057DC65532BEF81AEFEEC704.2699.596837138.281",
        "CD_777909665755481973F85E4F05948A22C8B9B138E770DF765F9B0B2561A71FAB.1171.900177526.303",
        "C_E47161AC3705BA90647C0859FC3CEEDE043DA30F37CB0CAB0AB9AEB3B28CF01B",
        "I_7ACAFB87635355B17C12000045BC83DC17FCA98944EFE99F5659D0D85614FAF0.2686.3684627172.267",
        "Restarts a print job in a print queue.",
        "I_1FABC0661754BD6B3A73A87C9593EDF0ACCE3474AEEAD9FF9AE8D98AAA2A584A.1714.1735106094.184",
        "C_FEDCA171A0F0221C9CCCA432160431D72B4C8C69357C96E8F7681B02FBE88410",
        "CD_20C8A4313A9882D64219A6814548B8CA23AA20618BD06EA1320CC257373FA4D3.21.1466421988.769",
        "IL_EED29279036F2DE32DCEC9B0B83E02E56C40B6DD4AB0C1698F2AC62B58F66CE6.313.1817249689.352",
        "RSOP_PolicySettingBlocked",
        "CD_5B63DA83F2DA3F034A69D17BB71318BD33D3644232536A8D873D1D51AA8420C7.2673.2704940403.1153",
        "CR_8804D243AE7A52758E6F83E5472ED92BCF2D0EC1642375FE251024B3FABA24DB",
        "I_4AD8D98679E6E28B46B07F55A69C6B16DADF843DE33DB92B8F144193F2945614.2713.1603373305.274",
        "NS_0634BEAAA6D47E6371999AD405E0DDAFDA3BDAB3659C4858F565936A4909981F",
        "C_DC39EB125CD5896A582C9CCFCFEF5267AF9611EEF285D00CC4FF5DF7F8AE6FFC",
        "CD_B96031C532B0B65B8A381FC99C330B723A6082950CAD96992CF66C16EB037045.2746.2468596236.360",
        "CD_89EF5B0E6A39F2A2970E3E102F92EF0C67087374518D87E3376022DE86BFE766.27.4056680019.466",
        "CIM_ProtocolEndpoint",
        "IL_E303FFAE6F81C647089D83B9136B2447FE6B9BCA2CFE24CC936B4992876D8F67.2042.3749529865.254",
        "CD_5FEF9CC2240C005D9D1EA2FFCB7EBF7520D253B381EE1C9BA714DF32C3C6DCFD.2651.2139223936.823",
        "CD_850A6EC05E8D95D38CB257E525F7CA63816BE1356601C37E6AE5F127D45C21C5.1930.3523218922.1072",
        "IL_594B1F2AE7ABF41F7A9A2DFF46DF2A3F493C3DA60820236CE3DD2D380FEC2131.2728.4156462290.298",
        "CD_5255B80468290401F7B5537740678AC23F37D96AADA8BC3C2DB81FD63548D25E.2636.2999418254.610",
        "IL_70DC379FAF6D0138A96410FFB376C0F9F2BFAD3CFE410925E1F60D7597D58E65.2730.403174953.264",
        "I_86613FEBF331CFC4D4E554D201BF08C798863AD94FBE8224B5699C0130B69D40.2689.2886932224.265",
        "IL_D497BD7A02FEEDDA3BFAC81C9103BF5261B59635D4CB02ED4DABB9C044188FE1.2700.1899625607.282",
        "CD_4DA007FAA59D85678F2228217B51DFDDAA6D35079858ED061C1D1AF77F57DEA0.2659.3760764381.699",
        "CD_C817DD8C4529B1D43D8C1DAC084B54DB9AB1718E7FD5F201164920A53BE23ADD.1514.3813868098.544",
        "CD_BBFCCB444CF66AA09AE6F15967A6865175BB0ED216D19970A7988B72CDF0A3A4.297.1386819367.2068",
        "CD_5F07E9A66A14C03CEA70F14BB69F6D6A77D54ED7E0162E55A1871003B04B5B0D.38.253026547.1505",
        "CI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D",
        "CD_5255B80468290401F7B5537740678AC23F37D96AADA8BC3C2DB81FD63548D25E.2568.3927623637.521",
        "CD_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2.12.1651994020.792",
        "I_B72DB25D852B486CA279896971C6C5CA3485A2040B48225AC280E3B83AB61766.2694.3709484382.271",
        "CD_86D7CCEA6869E457637E2E5CB69E46D8D864161EF56DA1781B622C505BA013E9.2653.3525648011.733",
        "I_A85EB91570422B050DB7748E0E8B03DED2263BB8BCFA7BAB1D3902444584ECDA.2681.2810793203.284",
        "CD_F262F70EA5BF28D85ABB5E29A2DC0DA2AE6549733C60C20BDC35DE79FAE05821.2566.2524338030.2774",
        "MSNdis_TransmitsError",
        "CD_E8A8D6B4FC24D90ADB5A9D008E4FC2860257836A2DC3482FE5576FCC1546870D.1097.761507621.2446",
        "NS_1EBEBCBF50415CCAFB547032CB72DA91A6E1A4AA2EBD10A138F0B7ED132BF57C",
        "C_B09B2F86C7A55023F82FE86D323CC07C044D718E99AAF895494770C3126344C7",
        "CR_F888AA6AC586756C18E219B06406D7BCD62E2EB0C94B51FB48F127652DA7E3EB",
        "CD_FBFFFF984DA9B7029EE7078D02385B8FF23DEF8E12B59491A9BDEA2549806FA0.1605.3271774267.359",
        "IL_C03DC5BA2B5585E0F65E3B0FAC80DBD1BF371C488C7B41509D549A777531D174.2718.2813665472.273",
        "State type",
        "CR_11966DA6B788C09A209299D797026F84E9D25CFA758BE1C1AD03FCADB98C44B2",
        "CD_CE0403D1F6C8F032B580CC54FFD1B59326317C97C1A606939745A3B9BE941D11.1793.3676170971.268",
        "CD_1C06FA152DAF97258D99D731FF917040529592936586FC456CA74403EF6A2F73.2743.3277265616.761",
        "C_A299EE85058E283CBAFC4B7374A0444D373E45244817F91F31D618B68CB69E72",
        "CD_2D5BE2B23BA8B748FE728A0E39B335CC2B3500262599CB2529C98BB713577B01.1478.1830568369.6707",
        "CD_A9DFA8F5D04BEC57E3F9583151851B160E15DF6C81FBFB70856AD90B0968BB53.2585.619382003.1186",
        "CD_DEC0FC4E25BE960BC9ABA34186A4EFEF64A55170F52CD37DACB7598B3A49CA31.2665.333102795.769",
        "CD_4EF24D0957FB71C83C7AD35B30B8A4808EE94D32528B7C1738A8F12F7FFBB5AE.1204.3680005563.1743",
        "R_C7DE85BB0BE62FDEE5BCA54AF80B62987183267910F719A4722202AC121B45BD.1730.1621980324.578",
        "CD_BCB08593912195820FC0E1809F361B6089BD604B5033AAC8CBF736B3C9F21996.2642.216664878.553",
        "C_7E68D046DB13BCE41C3337B31F82C6F35EBC386E53A1006A94CDF711AEF82870",
        "CD_C3A11869D2470DF86CB2D202694B5F3EF52AC8341AC1C59FF5ED618B2C1231E8.1595.2977872191.894",
        "C_58EBCE462A5C99EEA826226A8DAA39BB4E44016ACD1726174C7DBA9B5E2879BE",
        "IL_80D5B5FD58BFD9AB1037850509FCE09E53F1B6E15470DAB24486F2CF0F2293EB.2735.2706017557.277",
        "TrW{oZ",
        "x25Facilities",
        "C_4235C3882F55ECC1A6DB4EAD3A34440B234054AB27AEC08E48ED2ADEDF2BCD51",
        "I_48A149224EB1E1FC2BB5A39F13145CDD64322D3CF176AF9A0974FEEF94413F0D.2723.1024711909.274",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.2441.847094316.274",
        "C_020D216315EBE851D1E95EB38EBC3A47071878BADCF464608068D12F0A2A6B6D",
        "IL_FDFF3C9B0664E0FAF284BFA12AE8B9782E6E99E4BAEA05AB7851730AFE40F092.1465.2422988892.307",
        "CD_7C38D5FAB4F054CA9F5CEDBC314151C720F14D0E0F70190236B681A725C62BA2.1559.2674240996.953",
        "C_F7E9A52C76555077F4DA7D39B6593B2F1BE8BB803F9421C298C6579BFE9568D1",
        "CR_9E184B0D1F692A8FC81688E709FDB961CA1DFCCD6CB6126E1E7994D280B1E898",
        "CD_FDDCF7A397736C527499E50A8D69DB45370CBE0C7A871712D3F74C6D430F1251.1330.2501140858.1654",
        "CR_F495BAA939384D98D2E8F4D62F1C4774C029EAB6F5263F63DE034CE1A8FB2CB7",
        "I_96BF81795E1D8A3228350F8E74BCFB3DE8581F255129511C5057DD024CD5C7C6.2703.2921927041.289",
        "C_10733E6D3C722406D792B3FE235AEEB733EA7659B833A33F18A708085238B2B0",
        "CD_4BD0F8A6C8D9EC0678D50228DC3CB44B9F26CFF9B291F8B882B0AD7C252B23A9.158.2314769936.274",
        "DEFAULT",
        "C_D3C9044B159C496421A96D1C29415B1FCCE8B1F381A6F6000E544FCF3C9C536C",
        "C_EAA4CBEB7BB9CF88FDD43FED82BEACA99806984E20E3D7B69232FF5F6CB9EE6E",
        "CD_7EF96F2C01A6F5A405F830ABE0BE0746C626D817FEEEB605AD8817C16046D746.1051.3331817104.375",
        "C_6A87D660F0F6A66279CF024432941A2BC16A9043D5A3CF26ADC36D1DFFEBF2B9",
        "CD_C5E17D61729E7377496CB88367D8A18CD6A24A14E576524968A24894CCE3FA5F.41.1062438361.508",
        "IL_2131D12DF8DC91B90E78FC755ED4582266C39BA38311D0FBDFF39B35E73BC330.2711.3886806218.294",
        "CD_9DA9A42CAE7919197E51305D69CEECAE7B645320A73D6DC468ACB11BA2001D79.58.1833399383.825",
        "Script File",
        "I_28D48A04944306B5CD569F65525DD5EF6F0B43EA24A0CF8D60E0BE8490DB1D5B.2686.173290860.280",
        "C_4DA19C7C1345D18991969860D5303884780EF4410093048FC0F1820643E62177",
        "C_03E318994DE320A2B2B6A80EC1700D149A451607E607421E61E8F027E9429B85",
        "CD_B6A3DCDB97084B5AC4FE4FED6FDDF2AC8904E59EA78E2E887EC614E42011F697.1464.1729343387.1692",
        "C_57711AB71326AC7AC810A538890F0BEE67A7DF25C7DE219237D14AFA4CFC51AC",
        "CD_044BD4F4AF9E96DD48DDBD1666684018230534EFDE72CF711BC2F8C5D5E9C959.276.93458255.282",
        "C_A856DF8087E1CBAC4060F307F9FBA2B5667CAC9AA4310847E3CD2F374CD83580",
        "0x00000008",
        "IL_010FE08CC153DC11B4971C18AA25B426DA166841A530748D5F8B5C0F7FA99E8E.1777.171688014.308",
        "CD_9F8D978C4969B38F6B12BD156ED032890417BE936A9EE501730FE38AEB7DC52B.97.2280715540.410",
        "CD_7C82262F50CE3724AC8434FD0FE0E31A40C9A7B353ABD3DEF2E6DE0816F201C4.65.2767462665.636",
        "C_B55C81E6C68BC4C439BC0ABBC4E8C0BD3216FAB41830394E3FAC0034894B6231",
        "C_82CA71B3FEC6DA6EB4F924B77D0FB3271A2915AF06140B4E929C663B08F996C1",
        "CR_B45E8974D99AEE9CFBA3AAD1257F341531ED5809367CE4B614DF68E300B793CC",
        "CD_666AB4303990992F36C1E67C5D472114E6703C6735120683CA3C40AFD0A2FBBA.1929.1950983716.305",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2120.966352701.180",
        "C_33EE4C1AC07BE6512CF605AF711CBF96FBE10D768A03C147E56A6E6BCB8CD88D",
        "IL_BA6B32FC71B1CA0F3C377906D1D8B14A8D56A7C468F97B08687CA1A6CE72F4AF.2719.2739097969.277",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1606.690108275.180",
        "CD_9908FF01855D016DB247597026090F753BADB4AD0E4EFB1386220A76CAD43211.2624.3634242138.531",
        "C_D2E1F5EB4F84E0C0B2E61F3513674DF2B7151098EA22604925123769286041D2",
        "CD_6D429FD402093547E603FFEF7F3DCBB64D26C88E650742C35EAA4E9D319AB841.14.1305825366.298",
        "CD_1FF3E8B084EF958D6CA51930B35BA398A9AA3DBAED426E535ABE1FF42F771AC3.2745.884939176.298",
        "CD_133926115907D1CAA329A707F5DA6057F1FEF2436D8F8041CFE6E68664D6F252.2244.2435415366.2603",
        "CD_AB458ED9D1DD4314F88AF5FEEC588DFA53BAF8DC0A56FC3E30B319CA4FCADC37.27.3511190330.2695",
        "C_14695F4F2E480F31BFA56CFE3E3BC1DDB0CDDB1F205DF793FF5DF038C8BA59D9",
        "R_45D7E6F87ACB8E8D445CCFB669888583D94123CEF1D8C0B902BDB864D192ADA3",
        "IL_498D26241CF6F54582AC8CA339B3E4E7FFDB01A01B2E83CEB94DD48296976445.2711.2443990039.292",
        "C_8E8EC8825EB3580EEA03FDD01E5C469CACC252792E96F681DA3159E2E3F0FF4F",
        "C_5D4131D5A516AE8353C44119767CA1EB7600ECED6A11D9400A199065F73B27E1",
        "CD_C6F2B33A9F7EE971E46DC4A05944D1F3ED258A4BBB229A6782F76407411C3AAF.157.2996761408.1201",
        "IL_1288A9F7AA57049E9963E48CE6150F40D8080204ED4013CE91E0269EB74BD0EA.2721.1397381558.271",
        "CD_E92F7F6859DA3540BD4772DC997C69CDE333458F416E1FC00383C239893539BD.275.4159841549.639",
        "CD_A0EE46252458600B3D11AD46CF5C24AF0B828C60CEE54B5A3DDF79ECBEEE1419.1602.1415844349.1437",
        "CD_0C1B95E6D290B66E321C724410DB4355B639D2A083CB9491EF83C50DE14B1E8C.2070.2566867204.4740",
        "CD_847B47B3B9DFABC8A17BC79B345074758B8A3E5B2BEBFAC49A4BE58E4D1CE00A.91.2348668385.1395",
        "IL_858C3D9F6BE74015ADEB4435C1A8E93ADECE95DC03F2E1F11AC3EBDBA0AD47BE.2709.546884313.293",
        "CD_FD437FE09A5F0D1CF8BBE227B2A7EE19B06671F0890E0CBE2EE538D3FF52E3B8.2569.4235970901.221",
        "IL_44B4FBAF7064AC4A9A0CE5BD362866AD87208DD2F228C69E237210C814370453.2727.3403419544.276",
        "C_E10E5CA0977E853520D0A743D4ED155E966A9810077470B844AB3080C1B57208",
        "CD_1487B33C97E71F69AA0345641EFEF13BD7DA6F4C2559FDB4EC81D5B8CAB2B199.1559.109077163.720",
        "C_A883D58443A0276690606F149210FB8EEC2F26A746B711BB5A87FB7EE2B3D5F7",
        "C_8669524660923BEB3DA81E87F326B831E705D4AD2D26F7C6F43EC5D8367BA37C",
        "CR_DF9ECB8F01904CBCD3018F693DF94DA3A02D29F356223BB0838117D8F2475343",
        "IR_C72044C5359DF7DC4480B7B809AE99A37C9C4FD06BB902C72B46C39D4D671757",
        "CD_5CA50576C5279E0DDE375D3AEC8ECA8E1927A238C54501EB1C8A33D455D3852E.2577.379503383.852",
        "IL_CE14254D96A0A6FD6498C780FB0F68231706541B91EDEFC57A0A5543057F10EA.2557.2165690296.271",
        "CR_16C3460778AD17C374A21EA3EAA4769942B4820B8F8AA76B353EDCE060C07C55",
        "I_1571B37F62927FFB7498686AF977ED5A49C694977BC024587F2890D0691A6555.2680.345023975.285",
        "CD_88D44DAE596A9A7ABF169CD599EFF3D9F693DFEA80491C3B4C3E21A1F5B46218.263.2875735698.325",
        "IL_2167A8504603DC514C99AD225AB5C2449107CAFBCB6E98C789F49218AFE2F965.2701.2730031560.286",
        "I_6043BE6E12C20875172CA555985196ECF8D1C6C066B65DAF470B3DB6ADD62B11.2701.3253654736.274",
        "CR_4F3E89FFD328D071A7EF820B6542CC8779DD91A8E0E7900B2A3BF4F5F4353427",
        "R_378C3B019BA81FF898F9BF06FF0AC5FC705DA51C0F56DBDDF9AC986BBEE3099E",
        "CD_038FB93272FAE6ABFA86F7DB95C50EABB70457A3A4C501BDC273939A1E6BDB9D.1472.1.9679",
        "NS_7100C6423C40622098AFCC4AD8087F3ECEFAC621ACFC3A5D9490E740DC79989B",
        "Aborted",
        "IL_9CD19EF47CD0FC5109D45EEC67CA09F42C58923400F61C074C9EE2D38F7F689F.2724.833967666.283",
        "CD_A340B5A350335A2F698A9D474151FF7803797C56DD9A727636F061641184011B.311.1489080159.223",
        "CD_1CE82144EE1299C77E9BD021B10420F34770A35F06A428C70CB37484054DF692.2652.2941274055.254",
        "C_FF159D71CBDBE76CD3A5D20DD10524A5A1A348C9E7D67EDF646E6CECE8CFB385",
        "CD_199F8BD2C63EA7935AD06C4A530278FE453B1FE80DEFF18B6BDA97081D8B8C0A.2421.1752429935.1054",
        "CD_688EDFFAE1CD3706709D790A6046157BB8A78E3308174A187E2C588BBB236985.1700.1504515628.362",
        "CD_B18A79A265A485271ADF7583A11B74126B27D0421B9B453C88A99D39E80DF5B2.2757.3365488312.314",
        "IL_6364649A8E999BF0369CB45A4EC7F540D3070EADA1EC23CEDA2CE0DD36E90AD6.2716.791125313.273",
        "R_5847C21BC6927B979DCCC7E87CBA9AC34DE69BF0C904AF77E2C0BE3CEEA06FCB",
        "I_9B21E79BD226E9CE78753816680029AA7376864DAFE781BDE0648EA1AFB0E87D.2720.2580848050.286",
        "C_79F50ECB454C073E4E5CB137ED1F04F729BBE896F53092F9F794786916DFD292",
        "CR_2D600EDEB86FB22AC5475ED284E8022AA05DCE0A01ED5CD478BD3E89B6038610",
        "Indicates if any of the file's time values were modified while working offline.",
        "IL_0AB5FE8B82025AB1311A722ADBCABA39548BD06B6E3EE3FDC272C88EEDCF65DC.1053.2060809386.304",
        "I_F995CE4CC76FB75C234072D4A96D01ED6A4BC17C2608DB401D59ED3E24F70E86.2700.2412514758.271",
        "I_DDA7D9196CC1FA44E5F7847951C406A4FD236FB796E75935821F2729692C49E7.2732.1372383943.274",
        "CD_4FF4249F26D9E59373D26D5D99D701C7574287A15B68AF7201676961B495AA06.2622.3479296477.1814",
        "CR_22047DD6AA3D899430A0653518593E646A07EB4284EA1D69CDA2422FA176EAD6",
        "R_ABFE30C50BAF3AB972E3043201A50007AA02C32BFD1280D1D2409177C55185BE.1462.1984497982.536",
        "CD_CE7D63CC7C1BAB7611CA21A73577CE89CE851959DA14BBE073B0286801C57456.2601.3382620785.839",
        "CR_7E0816BCB5F44018ABCEB520770DDD7EE174F2DB2071F89833FE5E4D9500CE80",
        "NS_267C220794F508648239FA7778B7AB861354859A3A3BC7CD92CDCFF5E2286F1D",
        "C_CC6586F4D65EF9450E803F2203B7C9A68B0B78EF2F31FFBE2672214EE70C46CF",
        "IL_6AC3B256775EBDB5CC7BCB67660B77DDB0CB42A96EB81FE29EBCD316CD3971F0.2726.2952311574.274",
        "I_1502D9F0CCAB385E5D8C39EB62FD64F6896573B4FCB5D2655FED7CDDC28879C6.1463.2148215366.331",
        "CD_7B77AAF8CFE9D64F5F55603B6550445F8297D32FDCD8C233B865DA54D2599C12.1779.288150258.309",
        "CD_36FFCD7C103F4CB151534CDC404DD1E71C91E39EA5D1DCB2E130739044899EBB.1502.2738750101.4551",
        "CD_6B8F637EF3630A38CD797596532C058BB5BD87D7D03BC5AC52F6F7A12A311BA2.2583.388189469.260",
        "R_26EBDAC8F156752113DE91B4EE3267ABEDBAA0A241ECD93D9A2C887C1566A5A3",
        "MediaLife",
        "CD_8D348295F5C8039788FF0FD535EA84E2DE9FD1810A97F958930762614BE11757.2532.1396254780.409",
        "IL_340CBE78ECDC147CC0D8E08D25E28D5812DD352A6020A7847860B23A3D747C84.266.1304879836.245",
        "4890EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "CD_8C6449E2DF9D42E8B328C8B95C19DA35BA5DD1B3E90C6134AD1B5E625248E2F0.2008.1799873905.3491",
        "7CC4CFC75909834CACE9BE0CA65832B107411.2726.1698626000.285",
        "C_A1FDEDE7CEDFE5C8E19FD85650C6CE61DEFE385164ECD849CB5636A26A1B8561",
        "I_129AB6E1DAC83B8A4F15F872069B1769D0052D0A7D6F69174C6CC64702798ABF.2712.2490011464.298",
        "R_1319481AE46A12CC16DCD2CF74CC91B9F47EC011AFDF72991BF4AEE0746B16E4",
        "R_3184B6ABE34403D0CB2F0498F5E873F5E68F9DEDB09393F85C30E13ED693563D.1187.3669482378.518",
        "CD_CCD3AA66883B977C4564194B988642D386C6A68CC8CD0C50E860BF4069F1B799.1053.1970292736.579",
        "CD_9D6C206BD45CB880974789F4931A2F78CDAE201EFF7E32B71E8E7698AD1EB3A8.93.4117653861.552",
        "R_2CC630B18DF4E4BDB892E97D7993F8195F439FE3B4EA7CFD44737030C04A3133.2070.3667104348.540",
        "IL_06EB11CA476EB54DA99CC756F9E21054F41FDDA8614931EDBCAC5316883D1EE2.2718.299715860.280",
        "CD_8753AFFD6FF7988B6BD5723778343D3CBE2068B8054CFA332AC07BDAA246DC64.315.784258508.2399",
        "CD_87704A8EA0D222E3FBFFC1A8755A4B520E874A42E0CCEE43262F1D7B8EA4C38A.2482.4243691158.1522",
        "C_CEBD2B5E33353736EB8594168A2AA1BCDFF196AA90419752C30E0B5CE08A9D54",
        "KI_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "CD_DBC9D7448979766FC3AA5E546B9F7F37A6E0C06BC06D343F27EAFCD412F13D2A.206.2589407967.2863",
        "MSNdis_PortArray",
        "CD_0E00A89CD9A41AC0AD01E0DA6C3FD34503F8AA86894EAFB2552F2D7711004F1A.2614.2821547623.377",
        "C_FC07F6E0375A047ACC1C9CE89E72A2C841B5C2CB6633B35D7C8A7F576CB2B31D",
        "IL_DAE88C6BA42241C7878269BBE6B05B24AAA3AEFFEE6E9DC25B51935689FBED87.2715.992261019.284",
        "C_EA9A1A204A0FA59819F57AD1F744E0CAB4BE1F06A46B3D439B85E87A7B3A09A6",
        "I_D74AEE2AC2014B217B0849FED89F3E1A0597BEB0925C80E032A7FA8E11DC5607.2690.1052199355.266",
        "CR_D1553F25D903A7D66D6E3513928D0B42C977674C3BC0CB6A4E19EA9B3FD794EA",
        "CD_038FB93272FAE6ABFA86F7DB95C50EABB70457A3A4C501BDC273939A1E6BDB9D.2063.1.10081",
        "CD_B6FE190DA3DA92C5835085980A5F0844A541BB53B1038C06EB63E0231624C2B9.1635.804577854.754",
        "CD_B2C9C24AF9AD18C51D1616B107CC0D5F87B040D09EC9AC43F2721AC9F9AEA790.2188.2614969113.2812",
        "CR_F22CAC1390F7E25096EEDDC9A22578C183AAC4BC2920068C5646D2049B964F6C",
        "C_87CE846EC002DBA12914102AFF6ED89E0F6DD6CA407A1F7C8C0CBFF801124A9B",
        "CD_9C93CDD5D73BA485572281BADA11A2A3674A64CD9F400FDD1797E1E153C6A4D7.1353.2994787377.3079",
        "C_6E7226B042F9E10708887BD9806A544872A6CE45EC018C548A61885557568A89",
        "C_E0C7C041EF8A11355189C6C96C368318DB11749FB49518CB2835E8C2CDDDA84F",
        "C_11B7E238469A440C390DEB83C2D70566DE9E0AA13AE1162B1FD2AE946273C542",
        "C_DF379D8F76A55619B723A06EB9700DDD2DAB1DA5884458BF3B892BC18330CC62",
        "CD_B390F1C634902338C5C1550ABA1DCF340D9E88E53F272BDFC30EB49C6392E4E9.2568.1189036665.613",
        "C_DFC0B10F96FE89477D6E5E3DD30C3B04040D3B499C9AF187BD9C2AEBC6B2C85B",
        "I_310E6C3804674023A3AAB349BAF2AD2EDE32ADCA1138B7A047A2B6D35C645F8C.2688.1783800665.263",
        "CD_945E0D785EBE9AFA48EF45547D26D1AF268739A26006972196EDF0166C1F7FDE.2559.2958973961.688",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2005.729656931.368",
        "I_E510D6A65DDB547829D88F3B6ED3A42F378FC95E94BA49A45FC6C413EDB510B2.2684.938546622.284",
        "C_2B88F31612D07208335917632CBA42B5144EFFDFF3C42A0D46D364832769C7A2",
        "CD_9D81E9CFE685557496FE0B37978C7E405A0EF479104986F29B311A83F21B61A4.29.366300884.243",
        "CD_9A376F6E77D1E893429991208782EDA1E1B82E08D8048C53AFF147F9753BF1B3.2052.3065457867.2267",
        "I_648EFF9F0AA2DC717DF307694D985212C57CB5DFD08154D93E1723BF3749F62B.2726.408613654.275",
        "CD_8902E5B6F3915AEE33F9C4DB3E3E29595C0B92D3A49BA074403355A42233E5A8.1576.748571672.2649",
        "IL_214E18D38F4C809C2A0D7F73B5150FCBD7795379A1148AB93B4ED4B8C529C167.1015.3485321847.324",
        "I_6124F773E528AE06BE26B7FF99E0DD4F607A04D894A09640A54BC3A4D4D08D5A.1015.1697436836.313",
        "C_F5C834F5C60D3BABC115E6B6BE5546E7D8A66BBAF89B5C7BFA41187C8795D13E",
        "CD_FC0B89BABD686A9FC7C4BA7310FB243E4149DD82079E1DA8FB106D19B546215F.1606.2365178889.571",
        "IL_DA9C4A07385BAAEACDBD6D11FF08AB3D3C2CF09DDD29DF54A21898C212C31969.2723.3637418311.273",
        "IL_35470FF5DCAB681C7A225233B7BCCE391C1C7BCD4C2AC4F16C30CACAAAC0561F.2702.4214347319.285",
        "I_FA358256CFC1417A3F83D2A8D16731070A567599CF742519595BE9AD65D0A198.2697.591705588.266",
        "I_9B6ED9BA5FA5C4E077E105FA66727DEDD18446BA6FFD49E7BA14D0E3188DEC86.2693.2140003252.269",
        "NS_5383CAE6BA7DF67C8540FB8486138E8E7854E1A417C357D4708E676797F6FF28",
        "CD_C17ED95D6E5740D010C5F626BCBA6BA13C3D25FCD60EFCFD20048944A39B3D79.1928.222344772.289",
        "CD_E0FC2E4340A084EE9B1101BF52F20C14B78BA7DF0D8E224E8218B82E66190D39.1779.2510941081.303",
        "dP4\\(",
        "C19C8849E8",
        "CD_0CD3432EB17462BFB5BD92FE309EBEDE9286A9F3ADCBFE4044D787F3CCDADE24.157.545939982.915",
        "CD_852580057F8E6155822579BE3A47822371F2A72F79BA24784B9CC5E5F79678B5.2527.3764415745.218",
        "CD_33CF99EE359367737EBFC91E6221019D46F7219044317527292271867795E5F8.1081.474627621.349",
        "CD_5594A51ADFFCCA3EC367A4CE2DFCF20E3EBFDE91FB6ADD84404CCEBF1B0FF2E1.2582.3540940395.556",
        "CR_E6F405501CF9EB51604EF826550E0336D9FF9DAB805C48FA3ECE279D5B21648A",
        "C_E4B9E363341E220C0B9387216D08857F2822C5CEF7B76EE54306D729CC7A27DB",
        "I_A1BF3344CE9B08129717794169613E8A42C2192EB099D08C7E4ED3F87584A370.2687.3878438740.282",
        "IL_58F8973372F3501A9EC11539D15E25FC4FCFC2D0AB8D64BD3D0FD5BE87B740C6.42.56100039.269",
        "I_197FE2781AD290D79D54CDED2A2907BAC7900D803508924C3B3FDF97526325F4.2694.3554915579.265",
        "C_31380B1CBE2DE48F4953061E943634793359C618E73F753682430004D4E36FB0",
        "C_3E723A91647379E7E1D55A0DF4F361499D3E76B67681C256B269430F469E4FFE",
        "CD_756ADF3A38037C884D036F3D193150C71CD696CC6C340246CD1DB26B98747BF7.2423.2341723786.362",
        "IL_6F54BA62DA550A229FC046AAFC1C0CFE12E454FE3FD82D56A60CB00A73DE7D0A.2698.1181391689.269",
        "CD_4DCCEBD0E58C35B09A2D042DE05886080ECEF7D86F9C682EB2F9362B7BB75582.2650.933559719.424",
        "CD_6BC8B317F18D27286388A1D8A6DFBBAE21776749F856791E591914AAD69B0BCF.2579.2138711891.219",
        "CR_7450B933028ED3A9668E73BC07A8325B939DC7781D6560E2446E75795DDC2C3E",
        "CD_044C6F3044E48C22993C2C07FFE6E4308713F44D28305AEAA2DE9289AE1E867E.2623.4009577955.400",
        "I_84ED151E5BDBC6C2B652BFFA4E3E7932A71A51E8FF4F53D598C9469CF82C24ED.2718.587289002.283",
        "CD_4310F4B6525F39CA804DEC0D13A5CDF1C1FCF37012DD6FF02E0E11B2712E56F7.2532.4091997517.221",
        "CD_A2392D279E55559D3F1D33DB8F42981C4F8134A3716602C2005C822A63CFED06.65.1569782799.669",
        "R_18DF4E7DC43FB5F7943BBAB3261441AF37AC157D8DEB54891BB97D3B897A5305",
        "CR_B7D757AC18FF2608497B974C70CC80BE5C41C99B984057C2991D1A13D3816E92",
        "CD_F0FFD49170849459EF1E56EC96E25B839FBB919B41D88FE54D6EA0BA45C84F18.2527.2952672309.85",
        "CD_BFFBB3D86E600A82D520DD30A8659721378043D33095F0E858A6F28BF4593D34.310.861787669.317",
        "I_8A284882505EBA2BE9CAC311031BB8A28F97386D488AD21523C9CCEDAE5F876B.2702.4008995715.299",
        "CD_49844BBFC96404D65D55FCDEE9A5600B03E3ADA7C6190D9FBE82C292C1309911.2672.104968079.954",
        "ProtectKeyWithExternalKey",
        "C_DE7D77F89C87D9F9005DF4E9FDF0CF25EF5AAE159C4D26A1FF500F7A7277BA41",
        "I_C18626E27D5153E5E65B72B574D4E2FD4416299A7B7135AC8C51438B7D94212E.1730.3176561917.307",
        "CD_0B8D0CD35EF9C37B2A0F0A7A5A12FCC21F082587427AFAC5F5A4AE61B8034D36.35.4292354994.420",
        "C_67116DECC851701AEE92E8219560CF2CCD164F49129870A0C72AA75DD00ADA3F",
        "CR_CA5E03B6357EEF3C2F92CFD39219BA6C5D6285B9E53EBC324CA96967ADC89A91",
        "C_8D99B89B2E26FAE38502F957460FFF2E9E23E0C0D9AA3DEF32147EBB968C38FA",
        "I_334565C6E478D907215A01BC774AA539F4EA7359B2CF03193CD5435DC030DC32.2693.2414356086.271",
        "CD_428941D3E4DA5D73C4ACFBC21B050EE334D4553F43C52B09A9D3CA1C7657E068.75.353606162.243",
        "CD_44179BB601F070AC8C34C5B9994988FDFF5DD1A2C985178B6D48CCB665B74AD6.1876.3675858384.332",
        "C_7AD3618E408CCE364CF59736F72F83CE9C862E7FDFCB8CDA2E73043A4D2C4B43",
        "I_5E604AC13A084AE3258A5FB5ECC21F7B434FF6A3C71A7EE33A73627FB9C64E62.2764.3345697170.282",
        "40001",
        "C_E4E3C277AFADB65E535A86CD5AAE23B1AEF585A2BE1A21A282B170B7F4278F9E",
        "HeapTrace",
        "IL_F8B808D7A9252DEF065341C8B8313C296ECB08839CCF4A94507BC66DA5D3F382.1478.2587650861.329",
        "CR_717B9447F64FF1DDD9BE96845CFF451CD699E26415487F373586ABC0F3E7F533",
        "I_46ACA7AC3CBC0F3ED7820D11DE0C916B1AC1A76D2292CABFF82D395CEAF02DF0.2764.2201326577.283",
        "IL_867009D1FACF80A1E2C919A8EEB83F6A5BB16EF95BACD064E526589732F91844.1148.4075638430.259",
        "C_7B77AAF8CFE9D64F5F55603B6550445F8297D32FDCD8C233B865DA54D2599C12",
        "PTX\\`dhlptx|",
        "I_9CFC0980194C6A9C8AB45A36BDF6696661A62D18A171E8D534441323B3F89DC7.1015.1280045618.340",
        "IL_32A9A9FD17AEDB80DD18DE17F968EB0990C6330E13B17AFF0769D3BE6FA6556E.2669.50604980.273",
        "CD_C7AECD2744BC078D929494CBA36C2323E889E91F4B1A9028514BB732B6F153CB.2643.3898796269.927",
        "CD_9CE28F3097463A7A7B3E8F7210FB0203F0EE1A77010AA6FEBF898B2CA50079D1.2602.3098701477.1235",
        "C_D853AB6209D8A11783FB9991FAFED1455C3BE9CAE115768B2C2CE0E0FB306714",
        "C_90D6DB96E4E52DF3FCB751D8C2491313C169EEA2DEA2212CBFE4EFF8C0A5E947",
        "I_758767A138065C58C7C2FD020F199EF93645B9F6B698FF67697C3888260DED30.2687.1765201650.264",
        "CD_84BD991F6EF99EE3A0301A722C367F9824F244968ABA37A64CDBE6307013A8EC.1926.3011029453.300",
        "CD_2C755AC62396ABBDA4DF17AA88E448E6599BEF0ABD01ACD402D70497EDC686A8.1849.558959729.348",
        "IL_E5CEF6CD651CD4903C707AAD1983A88B64E967128AF69B3D31D4AD560BEC45A5.2705.2905088871.293",
        "IL_02E3B029E91BD2F58BF6CF927BE5C0627DB8324470F3AE50EE9B8F6058666DE9.2704.465252739.289",
        "I_DE0C410F96DB3D27018AAEFF93300898D7630D40AA22335FB1CE264ACE5042E5.2714.1250223084.282",
        "CD_6634D213315E8C29DABB7CFB305DD30D72DDD830AAFC4CDA9EBF4BD88079EDFA.263.4283974367.410",
        "MSNdis_FddiRingManagmentState",
        "IL_272BF13D8B8FD82DEE112F290564C1A0506076042BF403D11208536F22D26508.2687.804018355.264",
        "I_7B4638F9968ED4EE682DAB9020772C3FDE0994A1C6BB9B4467CEB158F71815EB.2685.3522640684.288",
        "CD_6E3B4399FA4EDE750602EAE85FB276C1B64644E78344F6BB3EF3F442D17FE8D8.1185.667104842.320",
        "CD_D952138C984CF58C87BDA12F14B85644C3D9BFE8E192BBBA791425FA27B18EDC.2590.190305557.863",
        "WMI|Win32_PageFileUsage",
        "I_045C9A425E2C0146E5E15C2A8CD5E606A5655DFFAB2AC41A2AA46A35489E43CA.2719.3382053489.269",
        "R_35C0F224CC2308A9D8BACDB20F08468AE9D1134753B5808A41A3EA43EE4C047D",
        "I_4A3DDCEADF875B43B86031D680AEC99D3EBB91A5667B84178BECB0ED04142818.822.1.43301",
        "CD_34C7F02584835C9F53DA8B610B74BCACB61B9E0BCE6D8A239F117F5D7E99EE2B.1093.2710851020.615",
        "C_471398BB3B8692315637EDCB5ADCF0C2D1A9A53F4C29EB6AA1D710BBC247EF58",
        "CIM_ElementSetting",
        "C_79BFFA82A64715EF01503A4F07A073E2813081ED91CE09901D87790E269BEACF",
        "C_331837EF40A0EBEFDA1431B1717E4905FB3596E860268A515E766537AFF172BB",
        "C_776C7B251A3644C357F700DC6453A035C7DE2B39B88FC78EB15D96AB23A5C2DE",
        "C_23661D69AF1192D73D2CA18E9EAE4F8747A8AD619CA09B24089CE9CBFB6DC7C2",
        "CR_93D683378335762C284317F9836C36B73320C30A8A815437365079222449D208",
        "CD_B5621FFEC1C8B1219D99E9EA2FFA370611A11F7916B9B95C226F3B8DBE0160A4.1075.1141479132.703",
        "CD_4A9BADBF619D7C360E2E222A1D05EF4C32E9769C9232CA2631F4E74AC78597AC.2744.979169959.361",
        "CD_8ABE67FBD5A1340493A95993FFC9400A05F43F4592B349676E9AEC5CDBCA2F85.1550.202922373.829",
        "CD_D5E5B3762A5113A6C262F653E8716557160CDA5C8EFF2A001BCEF56E204DD0C1.1757.1204531561.416",
        "C_BAB7BCFBF35C64FF2F6C4FF32538BACB0A2D69B14B109975FD801C994E89CBB5",
        "IL_0DE793052A989728A13BB43C65CE1D88790BBBCE06B85EE4E1CA97BBFE608E08.2714.3440397671.290",
        "on is read-only.",
        "C_0266FE61C304EB19A16F927BEA069A8CF03940D65EA14EDA962A2A0ACE0B3505",
        "IL_55BA3B97EE945A5FFAA048F94EB0B1F3BCDC2B26C8F2588BFFB42050A21365DE.337.1.27578",
        "CD_5ADA758B11BB1BEBE55E93637EF1E2FD07B1E1906989C07106D282B72DAECDAE.2167.2891423955.1522",
        "NS_5CF6F9641D4AAF44F18181FA22B732295FA75500CE844EE9D6144DAF9F98E074",
        "IR_B8F2F2BF1619AAC712E46ACDC25F9EE9CD9413AE0C42388950720F238FD4DDA1",
        "I_C109EAE1C13F3F3A6A73CF2442EEA104952B0608551FB7CBA0C21D6A0605B001.2711.91096168.291",
        "C_7758B30874183320F25F4F9789C477D48C7F6AAB3A386DF09B6FBEBA7488BB28",
        "C_D627BE392D7F1FDFAF7F353065ADCD27A759659F36B80C18191FB06C996520C5",
        "CD_A50F2C71334A2A338CC6F1C013DEEB31B3684F92B727656C378E98BCCF3ADD1F.1469.3399152346.602",
        "C_B1BDF04F409DA8A1218BDCCDF869651E770462250C203BC00DEB8F3479804AE1",
        "IL_FECFBCC25BED015E01BE0019A5C5C82CB134ACE25D9191E3D91D53B7327D42D3.2690.4146926068.272",
        "CD_41C0D0E89FF0DAE8E6A4A279F27B261407C89E7ED8943F6FEDE9D0A4CD8F2131.1538.306253848.724",
        "IL_760CEE7D587790884F861B014304A0C2F694A3595D60743DF14B6842269A95F6.2695.2208648517.264",
        "C_3DA09466BD5D17A4FE0B633E962F9D4150B210137F89EB9BBF5F24EDF1B00135",
        "SDBUS_DEBUG_ENUM",
        "WHc?6!i",
        "C_5FEE9FE17604B3B0B11393D9C308B561F2BCE1205661C541AA8565F8DC13A7A4",
        "CD_486709A1BC1AEA1713B7B7854CB54E0BA9471BB018357C834E1DD6BAF7DE7457.149.3749590408.690",
        "CD_75C9956E7779838B54824FF45E13C905411B41652E6FFADA64041E0E4ECBDBAF.2470.1.8603",
        "IL_B56173B7DF96EC3A79651A1BACD77E8355FF4B6D4EB6076A54F9E16DBA8BEA7C.2682.3309255573.288",
        "I_562C4F9A0D39409F54FB42B6863A5644312498E663250515AF07C434FE2D1D39.2697.3999877960.276",
        "CI_43C86C3E5B2B7F1DD0443A6DA4E17AA95D65F56EE0C19CF4FD3B5D9A5F63C522",
        "CR_4B835375C85830D11DAA3F01F5AF9F28573A4521B9279B28C7605832DE3B39C3",
        "IL_EFABB3366C8BBFCED6E39DB3820AA3E72AE06FB508A3A360E7B7C5137B01E602.2679.2591135826.274",
        "CR_DCE585FC8090201AD2A481DCDA9678ADBEED6FFAAA2CD50925EF913678001533",
        "I_A265944DE9F9253F1E3F972A06B3B034EF943B6985045F07B528B95C68BF25B9.2728.2124684575.287",
        "CD_08802E8C03811ED7B07D82942CD9F025CE302A278EC5904A6CDEA63BFA636223.2591.772868519.990",
        "C_5DEB181FA3808D9D7D9C352C844B65D0C9A0221A91C57777C58BAB412DD30F67",
        "This method will configure the associated instance of Win32_Product to the specified install state and level. The method can return the following values:",
        "CD_9378929BCE127447D66F1472F6CC39E5CC7C4B21AB66617AED19F5689DC55677.2555.1879004857.511",
        "CD_2442933444240B68F1B8232208304D509D6ECF5830E4F4F8E4EDD13186DE1B28.152.1054273590.2517",
        "IL_7EB83C5857223C7B60AD7DCBA263498F0049E48ADC13F6C3EF920BA0E7B234F1.2726.4259781790.278",
        "C_51A4A09354423C467E946EF4050F2DF0E13DE3BBAD00C291A488D4E05F085A24",
        "C_FB60C1AF4D6C46482A1812E45C6387D7979085C05A1408B5980C3DA6770C2B4A",
        "CR_1B565D8B02DDE679557F2CBAB41916CA553B573D803E48E8137768E2235FAAF0",
        "CR_47B8D9FB99659B3546500CA55AB79FFA62B2FC16F96D81F5B390216EEB78A7A9",
        "I_55AABCE3A737B45AAAE548EA36C5A61E7A37B3493091B2AC676F2D7679A51E73.2702.3098572845.286",
        "CR_F4CCDC8609D32257535E7A999BF7C9477C973FD53B9B19B85FFD5EEE88F83086",
        "IL_1F2E6BCA4EEBACB6509E1D1DFA1DABFCDA2BD7E41B2B3D970CA09564AC197F68.2718.3912969687.281",
        "CR_EC28E29E31F548462327C3037DF69482A82EBE159236DA81AE2E5AA78F5CFB04",
        "CD_4C30D2B0F562E7ECB133EDD52DE8120D85640B338DF07115C2057AA8BFDCC64E.2421.1152885239.675",
        "I_FD322ACEB4A2053F5989E8883B52E8442665045C72824585C0C101F70B5D252B.2723.701907449.274",
        "IL_41FE5FF45E777EAF90EFDE49FCDA387F57132F9D7F0A754AC7DE115CDEE0227F.2730.508520424.279",
        "C_B0C982D069DF886A21B9C5D6D3E55712FDD589640A126AD308207FF3B01B9DAF",
        "CD_7E0816BCB5F44018ABCEB520770DDD7EE174F2DB2071F89833FE5E4D9500CE80.109.4234702181.3655",
        "R_70B5C3F445D36D84AF1F9F0E062B6A21EF707E1616BEC072F41A3F1113BAD785",
        "IL_BD8FF3D8C60C28F38413C5FBB301596E9B180C9779802E934B182C0749890D02.2684.3655826469.291",
        "C_AC891A70DE67F8B532E5CA5EF7F5543B0D61F7E43127B27AC65391BA1CAC72E0",
        "C_2D600EDEB86FB22AC5475ED284E8022AA05DCE0A01ED5CD478BD3E89B6038610",
        "RequiresEncryption",
        "C_297F9CD2C4D90784A706075815B3C6FEB973BBF31843338D7FDBBB5184B8AA72",
        "CD_F8A40DE76638BC2D6B465FB946B5587EB32CE4928E4F71A985E7A4A1C7848063.2016.2550723046.766",
        "IL_D78E65D43C587EB37A9E43FCF3F4E7363727C5F50EEB63C8CEDB36F05164AC6D.2489.3834681307.328",
        "CD_14E641BBBA19FE01ED4F7B56399B3039D27F91A2D89B0360E0981CC179990D0B.1589.3749017480.425",
        "C_6C45CE5327BFD1794DA2A5C6CE11457F4941795C30AB80AF27DA45757D38802C",
        "IL_38432675AF2E211B94C26E2D3C2F893124B46B984988E2EA9FB022AE375353A0.2720.137845199.282",
        "CD_DA2CC882B6BCEAC9BF31E89756B8510C103D6DA8CC0721E36AB1395322663D45.2484.403010983.637",
        "RandomizeIdentifiers",
        "CD_FFEB2E6E5C2BB60DF1E88218FF16E68C6AFD2FB957B5DD1907DD42EDC6D70FE0.1549.3846544125.4462",
        "The path to the package that contains the upgrade",
        "IL_F693A7033BB33D7405BFB98C5A3415923CC9F4EC8AC330AFF545CF21BB41905F.1751.3881507600.272",
        "C_918165F99F828C6B53BA10EEE3979256F3A73E636E22656D27D129A14FA67468",
        "Local",
        "CD_69C7869757A5F0A0B753F6CBF641632E43C401B354F79939A20946D52BD05C51.1667.3546741872.234",
        "C_E21660815AC462FFBD7FBEDD97A63305E05561610CCB37ECFFD00C1772D0FF5E",
        "C_2E01D6AE66069E61FE9FBEB254EE45B257107A95EB7A55FBD179811B508038C6",
        "C_D961660AAEF0556B521437C09527B25BC63FA793558ADDCC51A8B8293B5EACDF",
        "CD_30AF15919E81B988983A5B979DE55F3F2889A968ADB0D35777060C9D66C4FFDD.2656.1761876664.1106",
        "R_BEB5CFC405938CF504C4F022B26457B8BA4AAA062A6E8AB4E49ECA4FF82FF69D",
        "C_6A34DEB33A28A5C79FACD308002DEAAFD811689101AD1C977E557E3DB84950D4",
        "I_8387A2597CE908C8ABE53DCE7802689A012D3F66939EB1AD78399DA988F28FF4.2690.2921107562.267",
        "CD_B9D58526785010F225A5B7C3571EBE488D29C0DEC319541C93BE914E77155B6C.1677.3799619585.362",
        "C_7E8AD53A486173A3F5BA7467CEBF7B1550C1E17C0A356223A9B63225DABF0B50",
        "C_9A1017286536204EE41BC4DBCAEFFB55E2F3765B5ADC8B288415356B63CAD2D3",
        "CD_E4EBFEE191211D0CB9EEC30A93A853003343DA9E1479B64383841F499755E77A.2593.3689117983.302",
        "CD_CDA55B79C9BF42A4F068209AEB65324E0A8D38BCF2A91E94C352F25F1E982009.1925.3793449100.246",
        "IL_C802B3FD1D8F1224D0A710EDCEC6D18AB91874479ABC3E364CA52163437907A6.2690.1813658899.266",
        "Options 2",
        "I_33A51A20D06504B858D5BBA09A85A50D699CE20D21C5B7B62740A95DBE6CAF43.2700.4168634246.270",
        "CD_FC636783BFDB1A64DBDDC9D0C2A0FF3C8D482E7053A4FDFBCC7ACD0C12601125.1569.1620535831.1282",
        "CR_C4045A14FE292F5DCE118CBE7A18E1997339F3CB7C3124B21C33A6E18EE0C114",
        "CD_E6165A2C7DA53547A217F4B5D9149125910FEBA09B8BB9B320094C6ECF81FDC5.311.2130075939.535",
        "CD_D55F423829DA78B95BAA2BAAAA5D6B94935135291CDBAE66CE6C5E9FBF8E4E77.2540.3725189662.508",
        "CD_3E2769185393DADAF821E1723DCF561EDDF22F73B1FF1BC035D1A9B87F916628.1541.1537690781.1107",
        "CD_318C41B790C73AD23330721F5FA83CE8CB8B0D762F5F83DFC686FAFD74664F53.1991.3306616085.423",
        "I_619604095069A40FC54061C2D59C1C0447FF52FF8159B271BA6440FD5B5341A7.2718.1525292586.281",
        "I_24BCCF7B591DB29195248BF2B6CDDE6A24176027E52D64A8FD348C9CCB414627.2699.433477300.274",
        "TraceDriver Flag",
        "CD_186915C028DB302F51311CBCC5A8139806C4A3DD8133E0744A122DF58FD5C571.2531.1877383993.469",
        "IR_7B708F0EBAA300F444DB0951BD36383EFB8EE1ADB2E2E601E975D6BD67C66815",
        "57FE40C90A823DF9297D042CBC58C7AF83C3FAD79D7AB4D3438298D.2591.4190390301.397",
        "CD_1388B74AC4B1A1248035D019490B1CAAA479C4415233A9E50223DD0802BA383C.2002.3130161080.6968",
        "object:Win32_OfflineFilesSuspendInfo",
        "IL_1502D9F0CCAB385E5D8C39EB62FD64F6896573B4FCB5D2655FED7CDDC28879C6.1463.2148215366.331",
        "I_432480F6D45DC2F1B60F7C58CFC2746FD13AA4A9D190175266A50C4EF19AC5AE.2718.3719290733.284",
        "C_D77BDD0DD4F6BB62BC92DBF5720E7FCA0369F287A12A85BAA24D4BD2A63029F3",
        "C_FBBE075DD8BF09CF56F5E18528E64829DF169227E061EAB31220ED102922500C",
        "R_D817F92A995CD8CEB7B9B6D66DFC820B92D445855F800F0DCEB0A8FBBC324D78.2763.1968102091.628",
        "CIM_Error.ErrorType",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.1520.583582620.442",
        "CD_BBA1346A9C805CEA07BAFA5C355F44C1B2F964A3E4206CF99F830A814FABF801.1983.1253725351.1595",
        "C_974F68602E2292AC89BD27596E610F3132E5D27B95115A1EF4740F8D7EC0ADFD",
        "NS_2442BCC28C4B5A2EF54CB557CCCCCCDDEB8CA20A5F8F2C7C0CF36D2475F133F7",
        "CD_1A53C27717254634421006A16C1AA377239E0FDC903C1336CD4C4BD340D2B379.1923.4167384706.283",
        "C_C149B0FCA32CABFF7747FC6208AAE6EA9989E86ECD4BDD3CB57B7E59EB1D27CE",
        "R_648E22D24F9EB6F8321B02B9615E14079D2A7A16C80CF39550CE0B7934E748B8.1714.2855255693.566",
        "connectionSettings",
        "C_7DB76B3DD456363F496D78BB6E6B5352F812D97AF3EFBED78BEB66F92C943C4B",
        "IL_258D18D5BD59864635A4A499346D3159140CFC98629C83EA57F498F1873B7A84.2681.2119877503.295",
        "I_2514C9BB750D6214ACD0788B5C2CF2B1F3C6214009885421A2A43B7121A35A21.2676.828162062.293",
        "CD_1DE1D06D7EB25E718A8B4717CC2834F5D199085AFABE977E92B5CC3DCFD8A932.1266.3923510228.944",
        "I_4AB8B718BCED40CD13B099C54A6BC7459144DF3AF86EA1B35DB5EB6EBC6C202B.1349.115352558.284",
        "IL_3C46EE4FBAE2382C39C5BFD57BFA0E87EA70DFE71D28BACDC4E07A426EE10E5E.2682.3916761200.289",
        "C_64D49429068BE056D7485C9CA44E655C0EF5D1AE8B845E9E65096D5CE0BAC891",
        "CD_5C1EBB1EFDECB60A5B91BA9F722DAB3A0E05202BA30E0AD646FC630B197BF855.156.2401695026.992",
        "C_622368177CCCD4D1F30C92569493319DE5ED96D12790391924374F88DEB142A9",
        "VmName",
        "CD_B4744AE091F96C1897CB0086813E1AABE89C9AB276818B172EDE2A19A9884429.2003.3947137051.749",
        "1B623FAD3FEFC4769A.2580.3516284724.1041",
        "R_04589B8E69D739E8BA85F89339183A4F2A42AD8EF099262C8B3A7F57BB14C64E.2417.666001363.526",
        "R_B45E8974D99AEE9CFBA3AAD1257F341531ED5809367CE4B614DF68E300B793CC",
        "CD_DACB9CF054C4E86C828A247EC8DC850FA3036240686D11B03BDFBEB866D387C6.272.1312877003.1093",
        "TRACE_LEVEL_VERBOSE",
        "I_9E20357DC6D5C061E0B89A7E65B974A12E2731D028E769172D464A3AD38B0664.2707.3401987120.281",
        "CD_60AA2D59BD4951256029E6833C70FE73BBB4CFE957159680F2FCA6207FE78961.1779.1562621590.277",
        "CD_C2B48D57E7FB92EB84394A622E8976ABCFC0A72689795DFBF3816E1F26EC5623.2541.1010183838.527",
        "IL_59BFAFEBF60E8B2104B07BA7FADAF4FCFEB18999FE92B11F1C00E938CB4B93A6.1018.2627328795.246",
        "C_4382409C2BA25AB891FE25D9946357B2012609A915D0D018CA8A80D2ABEE1CA0",
        "CD_27CF2379D55C0D9FB04788B37F03791666FBE227F5B5256A959C5EECD8D8ABE2.288.1.14594",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.3877943233.368",
        "I_D2146A2515BBD75A542FD6AD5B1A96D82E9D9B2E1EFCA80434625FC396EBECA9.2692.3432124425.280",
        "I_14748AC91A286711439C90A88E46F607B6AAABE5929E6129FB506DC60AB27746.2690.4265603012.263",
        "C_D7860DB1594CB37DCB237A6AE7D8C1717E5D55CF386BCF7514E74D4C578E100D",
        "WQL:UnarySelect",
        "CD_FE21788C436CFF985E8FC1B783A31A0C4A2BDB769702ED6630B901A6864AF8E8.1915.3296240871.288",
        "CD_6572B1CC4CD6AC35D80FB14E68E5854FA4FA40953667D1578E6FFD075F930AA0.1171.1725191780.262",
        "C_E48A4B0B75A5A155A35AFDD8B31D5057F6867CE560F2B48F35D0656B9CFA7C3F",
        "IR_2E32DD3C4304AB7C0A3A6A35FE2D5283221F256440C1893B09E3BF79A85CFB96",
        "C_009DFC3DA14443327C88310F7AB659375A268B5057D937CC75544FD68DBB5B6C",
        "CD_5847C21BC6927B979DCCC7E87CBA9AC34DE69BF0C904AF77E2C0BE3CEEA06FCB.2309.1821268625.283",
        "C_A1DF2352D44EE2A7A518D708DCD1479E935C9B8906C0915308DC02E74A1C6BEE",
        "SecureBootEnabled",
        "CR_EAA85E0EF5AB3ED5507588B38184431B1FB4FB2BA84FC2208EE7F5D77DBBCFE4",
        "'!WH$9",
        "CI_5DCEADFA575A67B8870603880BD491602DCD3BD7BDE6B9896E3244EBC7BD1866",
        "IL_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251.297.1719363822.333",
        "C_5E9AFB2824E4C09259A80739D70D94E550D572E8A9E41593DAFDA14D65369AE4",
        "C_9BC3125C48B891C7E277E0D05B1E9C0901D367808E2E9E9F7838AC0E2BC60E79",
        "C_3F223B3BCE2BEEB6E263559A80A1DB72691DAB2FEA0A10FAFD7FCB4B0275A0E4",
        "CD_CCD3AA66883B977C4564194B988642D386C6A68CC8CD0C50E860BF4069F1B799.1054.283367781.790",
        "IL_D5E2B1D144AA5509C690BCC9AF86ACAE0569ACC0B4301DC2CB504E9A2087965D.2727.4265016371.286",
        "CD_5243094142BFF50E230A225F471ECAE0DCF0FC00D9021F08F10118DC4E9AD84C.2743.2053767695.1048",
        "C_B5BC305FDB6B1BA4B82B81FDF0E9F46A4D26DC35C4DA3F1208F7A3E1625B2883",
        "I_FC703C2B714C1AA83C6B989BB18065B4E83C7BAC31B06914805DF0A8E68C5D86.2698.1647053630.269",
        "C_EAAD7B12E42E8FD5A718C58D486924CE945F2F9D6534A799FEB67D3ED29E5A5B",
        "CR_1B319F1F6B442943CD996FC1C57BB42D7AABA5E18673D64CB4BE3A2D7BB179E8",
        "CI_9AB53806E88665C047824D5369B271C53B233BBEAC7C15BE3BA9BD214E527500",
        "CD_231C34EACA6E9E68FABB7AA3DADD079A379826158D2123254977F7CD79559E18.2756.477182986.343",
        "CD_B0CABE1A8A062D484B15926B839DD85BE290434AB73617430C4831E218290BC6.1667.1700580522.658",
        "String",
        "C_C57A3A3856FF5576ECAC058357B4B09A4EE30B72779C888B7BB26DA2B6FB5F77",
        "CD_CEDA967BE18BB6CFCE80E11488429372F9B550100D4D99059A8B8A740BD83EBB.1189.1867535848.252",
        "C_6EB3291DAFAF5E4121A6DBB7E0E41C22E85218F8922D3C0FEDA4960BE686F47A",
        "\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "C_09416880DC950121CF927099A50B486F189A631C326B4B438123E20ABA622175",
        "CD_6E75D4C819749F5E9722A83F3C343A6D80EF23A64BAA743C46005810D5648AA0.1922.1120161740.284",
        "I_5CA6226339CDEC0181D588BAE34D46FD8F5E18E93D5ED51ED2B3875AC5F5414E.2724.3655576709.283",
        "CD_1DE1D06D7EB25E718A8B4717CC2834F5D199085AFABE977E92B5CC3DCFD8A932.1303.518322397.133",
        "C_D9ACC786040BEB03B0BFA580026B159E4F14D3F3DA042378A3F7A6904DFD7A2B",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1534.585318014.292",
        "CD_A2D2F566D6334C154D68DEF2209801DEA0F8C0E6B66CFE89905D2737E6AAC2AD.2594.1412041128.4455",
        "I_03769CE641C73CF36AB93ECE6D86E2079B4A86260E33B16409F6C222A26182F2.2701.1660410404.287",
        "CD_1EAA623E5E2107E59DEB71245C575469EF4587B65CD6A524FC65E9E8A98BAC62.2615.3674171710.406",
        "CD_73560CA166D1D6DC199E43C7D578F3B7069BB5A584E5CB8D107C4AC9E5EE5ACC.2167.158818882.3708",
        "IL_4CF85043460E3B2B5B63DC6AAD0A6E2078DE7199CCF0E11FCF9B933447CE9C1D.2681.2634585345.280",
        "CD_2C1FABC8728F9E076F6727DBB7BA1358C4F010407356DEB983BF769E41D5848D.1105.3101978551.640",
        "KI_4890EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "378DBAD554A36F17B1E70A6D27BA95F2106CFE9A117AF6.2731.553324253.1283",
        "IL_6EACF9EBFCA10986AA504ECF943BEA549FB8DE4850FBADD0F165D6E5FD0E4DBB.1010.1.30190",
        "C_531B755AACF530EF0E073B9207E450A2EDCA2159A7AE00C6697E526492783911",
        "I_6E14DC5BF582D82643F5DA24C299D59E6027084CD201981E27D848AB75E18610.2692.2872660835.282",
        "CD_1E6F678E6BCE749DF0153368FB664AFDF910F4DA39F359B6718D12E67F50AF65.2472.415892926.395",
        "R_222DF203C973F518B041E16D6EB9535A2C2769AB54CE757BDD3BACC7415B45E4.1730.280141482.574",
        "This parameter controls the asynchronous behavior the method will follow.",
        "NS_741D1F510F67B02AECEE46B61323C34AF59FB3846CC56C042067E65CEDF537D4",
        "CD_1CAC18FCDD389660F406EB5935DF9224FBFB7E21ED4BBB2D0F1CD467E7026A90.2595.1929356492.292",
        "C_69C7869757A5F0A0B753F6CBF641632E43C401B354F79939A20946D52BD05C51",
        "IL_33283F629BC457D453E27AADE5FB75ED4ED011FB899DE00B9C2DF3390CD41B7B.2703.1316371457.281",
        "C_F2C608EA415A514E5DDE0744E350C5D6F7B19EFAF19967D7E934C8B89CA08EE8",
        "3E`T69",
        "I_C533843AE595437B2859D3257CC53E43D20D9B1BEA0A51515A7314E5BFEA66F3.2717.1963368420.279",
        "CR_4CC99CFC9275918BD831680B062D25E87A34D427349AA13CFBBAC5888CFC907F",
        "Reserved3",
        "C_342D3B3E95C15CE5558C1B7C7C427B6C66E4F69853BB4D1A94056D76079B0240",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.290.3656572807.2987",
        "C_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "SEL_SENSOR_NUM",
        "IL_D78E65D43C587EB37A9E43FCF3F4E7363727C5F50EEB63C8CEDB36F05164AC6D.2489.2498381217.304",
        "I_CFB4FE5D80C9161EF88C36BBDBFD45F14E6B150C82D875A7CA6E75C97BB79D11.2702.3399681683.283",
        "E.164",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.2372.1.14291",
        "IL_273916CA2B58B48A229EEB4DAA16569C8F2085E4B982DC10A4A95B25D2F7C556.2699.3366413135.268",
        "I_EEB2A6DD6B38F795AC77113BA83599068A7E118A282BC39D06B88CFA643E0D04.2722.3038232358.275",
        "CD_5FDD5C517B158FA6F136FDA5163883910AF54452C20644A4B22DCE61A6AAF3A7.2031.1762259041.336",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.3970565038.219",
        "I_C3DB5E4C947813DDCE1476AE37F36462D87A057537FC28E893FE938DCC5B0763.2709.718112191.305",
        "I_548C7B8CAA43CC9635C7EFD11A316C9E16085EF464E2F7DF7BF493D60EC389A2.2458.3903285571.354",
        "ThreadPoolTrace",
        " $(,0p",
        "CD_2CA439D710E0A0B65B98B6AC9F38FE01A2B22B06C769C1CEA38D591EF238CF9F.1925.3067374573.1059",
        "R_6FB0BF23C977A082AD6486AA68604A8A467437FCDD33A1007F65DDA14DAA86F4.2490.4034577742.520",
        "CD_BCB08593912195820FC0E1809F361B6089BD604B5033AAC8CBF736B3C9F21996.2573.1704528555.481",
        "I_87B7817CF998401290480D0C395A2D3099149668173D3F9C54C86527493E4F5E.2689.1144142057.266",
        "IL_75E052968B77CE674E5707D73917DCC54A57D06B4EC6BB0C76F03D980241B325.2693.2746291050.268",
        "CD_8ECE7C7C47CF43406FD76752B14AB6773AC6A469FE0CCF9D82803F9A9B14C786.2643.1379311340.248",
        "CD_3845DF884A9870820C258E1FCDFDC06294500F6C55F2D32133ABE22F6C920434.1270.780605499.422",
        "SMBIOS Segment Group Number.",
        "The Setting reference represents a boot configuration for the computer system.",
        "CD_DE00475055EACC7B53BF4B3D912C0AED441AE802F9CCA17A5072BACBD47797C3.1064.999985743.1383",
        "D x$d(",
        "C_41695C2AF45A08336AFE1BDB6F027AEAD97E2A04551B2329B3A302DF92AC01FC",
        "CD_3DFF91AF50FCE1887E36B1997DC21FA068E0AE4638B74BBFAAD315E88692001F.2596.2741567715.848",
        "CD_7B80BB9B980E08807703E2208510514F434259D517AD9393FAE73145E633CF1C.1584.86081177.1147",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.190.3698743403.332",
        "CD_C4DED7ECA25B95F591906DAA16FEE49AAF9419718F2D225EABB3257FC891ABD8.2617.3685995060.1638",
        "R_8526133117576DD793C5FBE12D825D346FCC6B0DCB7DCB25789FC2082421D4B2",
        "C_6848AE51A98A2B17FB898D6D0191CAAF3F4DD71444D2EA05FC34F19E3A2898C8",
        "IR_178E3CFAAD67F68051F62C30058B044ABE2CFC21508B4939B040A353BA0CEBCB",
        "CR_20C200D9E838157679E42B001B4147A35D03B45050CB643ED29839B5C1F1E6F1",
        "CD_EF2B7DC0EB341A8F463C94D322352FFC844C71A2889934DEDB50779AC5CCABF5.2614.3118847382.408",
        "AllowOutboundTimeExceeded",
        "IL_D8EB5722B4AE7D0ECC5A4B4C341CCDFADAE06A65B6E6443163CEC33F2AFAE3CE.2684.2770032514.285",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.1382.1134244066.188",
        "C_9908FF01855D016DB247597026090F753BADB4AD0E4EFB1386220A76CAD43211",
        "CD_99ECCFA08F1936CA8BEACA1D5B448FCFE9E2EFA426F4813F0AAD60F2EDD7E7BF.1068.2041037320.596",
        "0x00040000",
        "R_7FCF3928CE1A9575028B7746073AE3C5F6F2163882EECBCF60F66F9FAFB60664",
        "C_6EA20F94EB6B47BA2F6B0363088D421DA9B65293B80BB1FFCC1B564E4ED04B0E",
        "CD_3D99FB3CA80AE1CE212D0927EC12435777EEF4DA6F5F65601554C83DBFCAA5F3.2664.3916314331.896",
        "CD_AD547D8BC0F447772171D34927B4E8F9F5F0EE2793A91997022D273EBA01574A.1152.2891375752.1237",
        "CD_8DB9CA143932A4C51E260C5D1072E9BD7AE7C19F1FFEC91457E2AFF9C2F82DDE.1579.1126888653.552",
        "CR_2277447C6063BFBAC05CE459DB8B2E90B2D0D7BB283ED825F0C1EAA1C62A123A",
        "CD_BFADFC7C01226A013315DA8D6A490777F3088D0548B91B44B7B3C64DD75485EE.73.1316258826.5552",
        "C_D628E03D0677752FF789EA97E9BA34C4E2A9B6A38484A7C74F4BA213CAD47E8C",
        "I_B890A69DD6A6A1793A78448FF5EF434D2AB04D3D34D2D1B12E9A02E877CA8847.2764.830831791.294",
        "IL_72C1496F7784128083E72CEC41F798E9FB123597685B971FB9648A3D450D807E.2735.2254848462.278",
        "CD_F495BAA939384D98D2E8F4D62F1C4774C029EAB6F5263F63DE034CE1A8FB2CB7.1463.2800728910.2467",
        "C_08A5326D25CFED909AB0A296563DCFC521D59CAF145159CF516E0E2D49E487D7",
        "M - The major version (in numeric form). ",
        "I_401972D598FE435424FC85222E24B658B2468C69FDB79469C0A547B9281FB823.2726.2664927104.275",
        "CD_F3A809748DB54B5207976175318AA0D64DF505174ADD1D464E1C50800B1B617E.1335.2634635982.527",
        "CD_B159926F0CC27D6492317BDFB79C85235741AEFF3D5B427CD61D2FFD2C6EA2BB.1611.3426533018.634",
        "CR_259A5E159C9BC70687CA1D3524FF3E5AFC0180D51D46E1351D0D2A9510F67A46",
        "CD_C3D9531050A687F226B048E1BDC0D3CDBC35A231C063FDD30671825B68A3AF36.2664.648193652.244",
        "C_FF56DB01712594ACFC5870C12CAB792EDCC37A5B84E2F39F3A65E6A4D9626E3B",
        "CR_FD4F4D3C59F149D4ECD4F84E3818809F406BCF7E122C03BCFA93C04C2B2F4607",
        "CD_DBBD84EF91CECC27B905BD3504998EC3FAFFD6A1F5D11327943B474B842AEACD.1616.1410676825.280",
        "C_08D91009B4ED68E4353E05322783CB69F176F87E9111E33A5121866D19386BA0",
        "CD_753700D668A51B8B5E7F6080EC2CFCE8CF258A17D33CBA4E34D637C64FD9CCD4.2582.809039183.464",
        "IL_84DF976B9F987EB5C1681ABAE52C871FD0AB2F6910A3BF51C4EBF06A71550900.2690.3861359295.271",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.293.2901462612.180",
        "CD_6A87D660F0F6A66279CF024432941A2BC16A9043D5A3CF26ADC36D1DFFEBF2B9.1228.1.9113",
        "C_390D5ED0BE7821A9A41296EE6280A1479152221DCE5D93BE2F8AC7791409FDC4",
        "A4B33FD33818817F911188312F8511BE1.2728.435339241.290",
        "C_AEB1302AC843DE3720FDF5243FA6FA29740C3EF6F87994A8A6D26F14FA996B57",
        "CD_D446C28F44A94776D61EB3F1162CC22D32990679FFC3B5C6CE4863712E69A92D.2406.1.16661",
        "I_E73BC8E8ACC0C61B2F330C62D6B1120D9501D75C332FCECCD9A6E057C4EECFF3.2686.2962906850.280",
        "I_96F63FF73FB6C3F76805DEDAE09B904491E34633C330A7073457181E138CD54B.2715.1050821582.284",
        "CD_90D6DB96E4E52DF3FCB751D8C2491313C169EEA2DEA2212CBFE4EFF8C0A5E947.1503.1.9213",
        "CD_AC1DE55C5A9AF50A58F5DCABBEE0A68A4BF9B2E40C5A252681785A6229C17029.1925.1403610141.272",
        "CD_FA52CB5E7D6BA7133233B22EA252FFA4A8C664E7F86ACC00B362A212DA58071C.1502.3802494538.1567",
        "CD_E5B9DAB25A46409E53C7163FCAB062505567F69B2967779FFA51AE5E30243288.1148.1779647149.465",
        "CD_A96A7ECF39CCB33BE4192A33B3DCCF8594AD17A0E017A148DD467E9A270976C4.2578.2127773682.1222",
        "F4A11B9B1028.108.3844429678.215",
        "CD_6950671007C747CA29BE37421723DF7334666E44C868944CF21712604BE6CCBF.2646.1157481889.555",
        "CR_512A49E5E77AB2EF2262ECFFC535BC2D9589F81384D38E23194DFCE306ABF068",
        "CD_D615AD06B2950BCF3011017989F72253D49A49EB12D1AA036862EA83AA76C88D.1545.556749219.726",
        "CD_371FE29547194A0030F3A243D08A73EECB0D2D9F84C9D71BDB0741B3A2ECA618.1581.3249144734.1050",
        "CD_92DB14183145FECB25D8F810D51EB91465DF70CF55ECB1D5FEEDBFFC4B20AADD.1469.874884988.635",
        "CD_244B2D44BCFE4686A8EB1967E3535273855A686C9B62600F3309068E24B5ABB8.42.3961631018.562",
        "CD_15DF3954917D19E28725C2F53AE379712BC276A2F92080C36C49446645CD4952.1210.2200520601.2626",
        "y41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "C_2800F9F89075C56302A7CF7269B5300116A62BE579546FA42D0E22E3EA14FE1F",
        "IL_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.1156875190.338",
        "I_44409F3234E2E4E4F256651DA16CA2AB76816DE3447386A9E3D72AB56C8419AC.2682.1234320660.280",
        "I_882A4EB1638524A596E9B8BEA150E50E37DE5B2011A8962449531201C84A2243.2730.4051854582.276",
        "IL_B509840F0E293759DA8703A7C2AB007CF2CA9C5BD3B15E9D713098835BDBC78C.2689.819947387.277",
        "IL_CB0EDA837B0FE5DA8B4FB99828EF038E0A52B79D351F37BF7E32A6211C3B3E4C.2715.3971088746.274",
        "I_95836D7E2E497A1F78FB3DE04D6CC7B1E86FB113E1FC2C16F2960FB52159CE1E.556.1.28406",
        "C_7CF10777A83944C691D1A683CDA92A1AC66E7CCB112EC02DAA85CF4E62053EF6",
        "C_B7CB0F72C5888EFB87CAA914B3258F858F11D8FC7438CC22070822389ABE2635",
        "CD_4B5A98799E9F89299CF2B3F25F26C1BCCD944C8F4FF1171DA43EA42211F0976D.2379.1917893155.652",
        "I_B52768CEEA488AEA2A9ABB4A1228A6F91737E2049F5634EF0930693B14A51297.2717.2548925521.281",
        "CD_A9999FA3D79D07678BABB3F0902F35B2DDD280D3A8A7FFFDEC625AE416BB28D3.1303.523801834.849",
        "C_F6F676B6527CD98B77439BE3F1B79580E1B2ABA32BC12680DDB49F3F5AF69B70",
        "LocalServiceHost",
        "IL_D864ADF7E1A72B2185F425204EF595F1DCFA97AB1004E11ACE503C4721AAD51A.2683.1496429000.277",
        "IL_AAB5209D6E5DE824077B832BEE626E4A7526E6409B1EBBED1CDBDB278848FBBE.2714.2319342508.282",
        "CD_76F06702E66816F9A4EE931DBEF795220B2BBD5798222D30A793AAB4882409B7.1060.1364411629.1115",
        "I_278ACDA8111230CF8A3BF0DE3D91EFA1CD600C37AE187140904EFBB7CC210FCA.2675.2609831562.277",
        "C_F33B13E58D7A9AAB64E31B8DEDA19CFF557C834DF5EDDCB1F5F929CFA150BD59",
        "IL_D793223CDCA6A28528EDAE01B792603C67B80E8371E54C98572BCC6497D93F94.1014.189214118.877",
        "CR_4C65AB3247B160952785E8934037647E2EE8A6BB9A835112593E991D11BDF33B",
        "A call was made to HBA_LoadLibrary when a library was already loaded",
        "        <include>",
        "IR_1275BE448083C5AAB33DAF19956853ED9EA842E05F94D0AD39A63BA94DDA43EA",
        "I_04E9526EEB869D4C7BC87D82E1E940F2C1F8AF087E2883F393904958074840FA.2764.3955190034.293",
        "C_2343A770CBD378E144650E17140F5ED4B60707DE8E9E1C4FF188F8883A2D6939",
        "CD_7ADB3A758B71404FF95472D98780622B0177ABFE993DE8C448448F3816B71A61.1054.2829005159.1250",
        "C_D63BC7563E6D81203297654B46F4C100817863DC21DB2D7C0F010EBB549665E0",
        "CD_AD7EFADAD1289B4A3FEF0D60EBF19DD1D014EA7A1302D0431E7F57E3F564CBFB.2198.3176583093.3209",
        "C_15D17602950F6C84D799561B467DD6E41D14A7C8F3BB2D223F118DC47EBDE909",
        "C_DCE2026ED26CB0FBF10B78E8B97608E5F27A055E0A11B1BC99B2DBD53F24F7F0",
        "object:Win32_FolderRedirectionHealth",
        "R_A7E164E66BC7BA8FC3752641961C8B1829E354DA32CDE974E0423F3F5730EDE5",
        "CD_4922BF9FCF270243FFD4F9D426E064C4BF15B5F3EDE04C2DF03239BF6E262DE2.1026.1.34769",
        "@,(<pdP",
        "CD_0E8AE3127572E18A442A470FD92690849C0B09462B19ABA7B3E6660DEABF9827.2420.2148013625.673",
        "CD_B89F81602D340760DCBF9C7FA464908E742B64A7C6E08A776FA3C9E7E3DE6507.1080.124692755.784",
        "C_15A139866A05DA114FEFEDBCDD1A1CE7ECC7161C7A0053EFB8918A0783845D31",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2070.810431740.180",
        "CD_308A38A70C7E63C8B0D223B592F8A2FBAAB2069E8358BFE6F473E432CFDFF602.2746.3563652239.1521",
        "I_E95DE8A58F7A0B8BE8199A37DC9F2A4739FC0BDFAABA87D3B8EEB2F9DF7ADC4A.1806.922661647.380",
        "R_371B99EAC7A90A5236CCFB6AAA21E86782D010716CB9A5D8B21ACD2546B950BA.276.1973707585.518",
        "R_1A141A07F10DDA6BADA2E27D8A875EEFF29A63B028173A6AA1C053701AEFCC49.1730.1635498943.572",
        "I_3E2032ABD75380BE66AE394FD0DE94789EEBF9D4FE0C600ED99854F4C29A29EF.2706.4286516945.293",
        "IL_83C662E8E967C9A219A412D15D8A7353A8ABB472C0E6A3C888402711D2B4E9AC.2691.1112796968.259",
        "C_FBD8C5E53E09306926C4A97ACDB9C4FE5F1E24FABD58C6E18FCDBF7AF5106FB4",
        "CD_BBE16080A7EF2F0B1445053D0994143FB21FAF6CBC7F65EF8D2106E74618BE06.1499.1440657218.584",
        "IL_734CDBB0A96C4D756A7CF7167930A1D2F245EC20E3EC71E3463DDB83E8979E59.2696.4247290160.269",
        "IL_FD64A52CC0B7981195F173477472F4CA7515294815503FA15EE5A180A24C6DE8.1019.516358712.339",
        "CD_C62347F459E9E9A6DD2944145D972E253F3D3E7B606F67BA3892A54A2CDCC625.2424.1814053000.237",
        "CD_CCF174B484763861274B422B027A53D668C2557EB827A557AB0E7FF6CCAC8EF5.2041.308462118.859",
        "CD_F18B3A507112161BF62B88964CB56177DEDC15DBCF23B36584CEE511D5EC710F.2402.931514285.3756",
        "CD_4FC7350D0697D65B1585376855E9596964780B95A8CAA540BF3CC2CD97C19696.1807.2496893599.408",
        "CD_8004469B272AD6E985FD9425D404D1E20848FC64B0B2AD18655B397D61FAF076.2603.153074449.744",
        "CD_4BB7B0DB9385969FCED14AD9320DB3AC26B18FCC6D3C66F2AAA7AB1D63250287.2581.7962400.737",
        "CD_21F1E1F149DFC99965A781A396AF7873962AA365AB6A21C1E301F1804CC089AE.1955.4096304870.656",
        "CD_7EB464F197DCBE575080B9282C967BE21B4306F539F2D486C42140F55C5D0FC8.101.752463962.488",
        "C_DE762D4F54CA8D4A72A933CCB954C233CBA0EFE5ACE7AC56E99804B37A313953",
        "CD_DEA8D123D2837564BA4B047464487F2B0A38E0732ED982DAB6FC5F0842A72630.1936.2494345454.285",
        "IL_3953E3CA3EB29D2A15D48E7E3BD0EB54821E7CEE225D0663D482C1D82B63D2F3.2715.2113446044.285",
        "3N!$'",
        "CD_2C6F54CB3676514A8A4DB7A3E8B5DDBBC5E0E9B8160B66CADCBE260B9BBFA994.1541.2432284252.521",
        "CD_34FAD62383244E37DE87E761987190C0E223C1AA97503DF98FC7B3BF572DAA9B.1149.3663744886.437",
        "C_EA2A17F7F9011AC9DF174FA64700FA87A332EAD70BB23C4338DE684F34E350D6",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.293.288254012.188",
        "C_ED267EE324D3421C9BD582F00F7F4EC3645A8F358122D414EE824EC6E0323BB4",
        "C_B1B3F51451050560540508AE61C59186CBB46746C5DF2B2C8763635DE336A9D9",
        "CD_D24E2EBBCB5BF5B1D3AED870FA2B420D231828139B5704014F72023D34FA89F6.2596.3637239006.378",
        "3EB914F177E2A2E2C39AE6211724EE16D7552119DAF151E92D1509A",
        "CD_3303D514509C890AB8BEBE50F44B913774000A6CAB1EAFFC8AC95F2755DFAD1E.2469.934761122.520",
        "I_0529A4964A85F839306A13F8B1C9A58AA6A8FEEDD877A9E4A1D8D8612B0062A7.2680.1795030748.288",
        "SampleSharing",
        "NS_BF81EEB152F9504FAE8BA5A2D59673178E69D3BCB61DC871E430180E22B74F84",
        "C_87E1C2F47BC6AFE40A0BA43A6B695BEEF3A012F8171DEAE2BA90DB3F65BDBED9",
        "CD_B18E35596C7AC0C7A9B67022489D5864495B96E12E56FDACDF13C1E2D5D12666.1469.2616428220.4155",
        "CR_518737FCD9736D06CAEE43D2445A32ADF7BA5172ECE7281110883C447A0C8E05",
        "FD284883BEB8BA71DEFF026FBB",
        "IL_0A4A8CC499F46BAAE9FF49E6D68BB631793D5F6FAD2719C0358ED54A87A84829.1607.1290395288.239",
        "I_B2F4DEE709884EF7002D621C6ED2EFE2E258CB0DC2AE58BA3FB06EF994CEAC78.2702.1922028325.287",
        "CR_E6CDEC66D704E11F45B0F0D82E7A048CB93CA008B57E83A2372C128C06C6ABCD",
        "I_62A60E2741DCAC062AD3EF4B8A219DF408DCF3C859AE6CE6D95D23F4E56AD8E3.1016.3900931076.301",
        "IL_7E686F9D61EDF11086E78252FCD41558F7EFA25ADD316FFADF03AEA3869D1C7A.313.2707046731.297",
        "C_097A52F05DC16AD6657CED4065B1B398CDB1D2CE8FFD05363E002CCDC2980FAB",
        "A power setting data.",
        "C_2515B1950A64510A509CF61C80D68865E7CFF5446886",
        "R_058D669F3B99A388BB8D1F1BAFC9202BEC4D2384EDA7810CC1FFDDDBF965001E.2459.3997658301.558",
        "CD_81E71CD6BF54F730FEDC98CAF91AFC2B597F2C22AEB0626A38F278436A564F49.1758.1867202698.353",
        "CD_D4DE714020C13AB0D412D492BA93C206B924A3D361B84FB3EF8E572392E96180.2592.906707521.1795",
        "CD_13A0E5F9AA254675F3D05231BD456443292E04A663554FB864E708C72EAB70D4.2731.3612770752.1480",
        "C_18488E32552B12B20AFF109B1C469144409190DFA262326863BED6DDC834F584",
        "CD_BA482156053C9C0750D79B8792FC85053C434CAD589DE87E1E6A57C269C49064.1117.1.19662",
        "R_1970207D688FD91CF43D59BBE2F3B3F9CCB42103C7DB5F8CB850BFE6E1F2B955.2508.677371088.536",
        "IL_5386CC6AC469C7F08CD169C28544D1F527C5084ADD70DCC11E9F92885E748C22.26.2765184564.195",
        "CD_D760BC36A4E7F2EC138BE2205EECF2AA17893C6B9D8DB739718A0ED0B078D4B0.2099.202234144.1286",
        "R_63AE4E45903071352AF2BD8A706C93C6350EBABCD37D7081D126C78DAB2B5B46.313.3042202754.518",
        "Line Number",
        "CD_0CEA2BFA85C402C6870520D8882306321579F18BD47E8E598ED675B423931597.2216.1074879716.260",
        "I_30C8573C75A6AD43602C0DDD39EED1C9A588AC05FC2919403F1829E918061C5B.2701.1398455091.293",
        "IL_2E857E8085C23F260E4A5714870E085AF1A5EB43D390A00657752F8ABAC8FA75.2459.2781981217.352",
        "CD_B34654FD886C899A98B32211E3BFE4436030D29559C7BED49C8FA0B0A67FE9A5.2627.472941957.2200",
        "C_E041C52D2D9760641E834D8EFDCA76888D007C61B5E01BBAA13A8494549AD77A",
        "IL_B0A591E0FA79B0A35E33827E8EE7FAA02C773C7B9DC2117EFC5619AA882D49AD.2678.1215784558.287",
        "IL_DDFAA8472709EE307C5FA9B130CACC65EFE10C5908BDEA18267CA49A5DB0F95F.2724.612875334.279",
        "CR_838E75DF6AB0A59C9F2477F1CA99D3050323945F5A9DCAAC9E77A5F334C030A9",
        "I_DE350DEA48CCE31EF2397589D4B6C59DB89980CFD862DBF3B2A5DB92C3A0BC63.1017.1613574852.298",
        "R_D441AD3F69852AA912E7DB88FCCCC4374628FEB4888BBCF4D0B24CAE723208E2",
        "IL_4030128FEAADED7B8FEE761F2E9F017FE75DD0D5CCF76B2F9C5095CB796A0190.2673.3329456953.282",
        "I_290358381D29E05404EC74ACEC8C4140CCD1016B36F6A1B516F4F361DE45F8D7.2697.765963333.267",
        "CD_13D55C842CDBA0C119A52B652E2B026F106F2E9BE68DD61A338E909E5F70C55C.1149.3464545490.608",
        "IR_00F1B9CB59FCE26F2EA8376B2C4CA47CD07713170C440DCF6EEF30CCF5385026",
        "Suspend state information for item.  Applicable to Share, Directory, and File items.",
        "I_DE7D9A2881E8380EC27DBC38B315B2ABB6571F52BCA72FBC807D288D40DA3B91.2716.2772376066.273",
        "CD_C94E6AFCDAFCBF5EA00ABE8B2F4F19C81D5C47BF5C093E7C720DBD8884BCAB6A.1927.1502946931.292",
        "C_894D1306345D6B047AD14593D78A9D4FDBD2D6DA5717032BE0FC560EFD5A0FC9",
        "CD_A881933FA9D51D73AE6214A1138DCCB4CB1BEEF83EA181C268577ADB44A0FB56.1073.2409337299.684",
        "CR_9257E4A3C9993B750EBCB6C34C9BA11105FABAD75B9C0DE005A64417B00B58B0",
        "R_30D380391F0C7BBDBEB938061EF85587FF8CAC2EB47D3C2BB31A90F771936E23",
        "WriteFailure",
        "C_0329C1D1556F3FE0688DDABAA7029791319A9617145815E21A087B12FCECF5EB",
        "IL_F3CBEFF98C5308451720C0F4181C6A2ABE764CEC30B208CE682B8F0079180C08.2725.1045098373.288",
        "K{NQT",
        "CR_20EA07CEE9CA490CA033FB2C117DB216DD2382445258C0099435360113084CE8",
        "C_2E98DAAFDC2E0486524C1D822E6475C52FB539347AD8EA11CE593C8CB744EA9A",
        "C_5FB7B77EA5E2C3BFCAE4E2AEE1C523572B9C00CB53A36167EDA3CA812EECDDE0",
        "CR_7E9D3FC591CA732EEA61C4B739CB4B4C95CC90462692A33742DEEEDCF2ED6366",
        "CR_F77EA4DCA78917FF5BEAD9815A0440B9CD3C526312D9427341EC66F96C8BAA82",
        "GuidName1",
        "A59E85539029DCC00971.2710.2562276374.290",
        "I_3976F9C940649B19FA49610296C5FE509FA915DE07C17201C52676F0D9E3C4A7.2693.2706457429.261",
        "I_5F08666368CD5A38FA1690B9B7D8CD03F1DE7CEAA3CE254AEFD1FD576E8D3717.2725.668640269.271",
        "CD_298A82190EB25998365528AB4442CD971C3CCE3115D859EA184ABC77CF5A033E.2653.1883400296.331",
        "#'+@/8b4Vf",
        "CIM_InstIndication",
        "C_45999BE1E716B224CDC60BBAEC2E4A9422A7548870411AB5310F9D9DCF7A8F92",
        "91.274",
        "LastErrorCode",
        "MSFT_PrinterPort",
        "CD_B72992879F6DC823F6267C256838F35D96B57836E37CB0558435E32B2B16111B.2590.2936013793.913",
        "CD_A2D2F566D6334C154D68DEF2209801DEA0F8C0E6B66CFE89905D2737E6AAC2AD.2663.2189864841.4877",
        "CD_AAD0D760D72ECB11742773406575974B851067AEA4863E381AADAD2897C3D328.265.3618148292.625",
        "CD_2A7539D06CFD0D04A9740E1B6FFBC157CAB87AAB6CE0B359936AD7F498EB3563.1810.1.12377",
        "If Usage is set to 1 - 'Other', this parameter takes in the string representation of a v",
        "An enumerated integer that indicates that the referenced setting is used when the system is running in AC. ",
        "TotalUnmovableFiles",
        "C_94BCFE87DCC2646309FB0D14E8A88AA9E4F4AA46940EF1448DB7AFC278BFB67A",
        "CD_52C78D6E955B575AC3A033FD1685CC8CDC0EBD4484E5394917410F9F0A706A02.117.642869747.225",
        "C_E21BA0963ADD9F282F163368EA328AFD0A42D3ED5A163FFA12C0C1B41FB686E9",
        "CD_6C9B6879A26D36FA804084B2409422299600D124FA7251CA869851652B58B90D.1050.4208103530.459",
        "CD_3BDBA442E8DE5FD0C97625EBC2E671BAA7CA52B571B7C8E96AB3E76C4549E8EE.1293.1.21384",
        "I_D5FAA70AF9F9BAE40FA47833C07D0CC366DB83E0973CD8E9E5C121D4195039B0.1530.4145922506.329",
        "CI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "CD_8DEBD963AB0F9B4B0BF30721FCF8B1B7D372A8DA71A85D7B52A1614E38C3B78D.1849.1345272763.341",
        "IL_35B3BA3D4E3452B9FD358FEC9D1F382046EF61B6EA2F3D32FF2B776BA565D15B.2763.289847794.306",
        "IL_334565C6E478D907215A01BC774AA539F4EA7359B2CF03193CD5435DC030DC32.2693.2414356086.271",
        "I_04FEBEF6008A339891E2CFC2903FEE331B5735302797216DF8B0F8019B79AAB1.2695.4269635019.273",
        "C_92C20EF171FF814C89A447738B20EB69EE2E21C1A97F4419FF2142FC840F509C",
        "An array (bag) of strings that specify the administrator -defined roles this System plays in the managed environment. Examples might be 'Building 8 print server' or 'Boise user directories'. A single system may perform multiple roles. ",
        "CD_3934CBC8B9BF633BD2177FD587E49EB900491D088D14CD34FD22E79571DFC824.1929.779955382.316",
        "IL_94E33301D73E4974FF93CC2E4346E7CF0C60421C92F3402CA23C97C90CC344E2.2686.2919753938.274",
        "MSFT_NetTCPConnection",
        " boot configuration.",
        "CD_1C2F941263BDB4D92A351438E56E28591B1250FBFEB226516D6B0C7665E5DC71.2732.3365425281.1539",
        "C_A6252CAE691CD1E28C026D5CDCC06F6213D81E91E114D969C8F008BE1E621E83",
        "CD_998F3774EFD99EE364D0E26FD868917690CC4AA071C4ABAB4D58906B9D2FAF38.1058.1267312698.531",
        "C_E3986C58985C31A7B50C2B93346FDBF5A3AAEABC808F7C0A616D7544B7D2150D",
        "CD_9027205FD7E053DF439410755A9BD704E454F745D87AB219C121424FF63B731D.305.3486535854.953",
        "ref:Win32_ODBCSourceAttribute",
        "11D8FC7438CC22070822389ABE2635",
        "I_DFDB823EC9AE7ABF8CA75F563F09D9CEDD7C9370D62FC361D5927DE17A82FCE5.2713.2434541595.287",
        "CD_7034F2AB3C1C7C569B6070FE8B60A5FAB08FEAEECD9AA784DCD8B0D2B23C7F99.2616.3303683283.1806",
        "C_D6F23AC5CCBEB47ECCF7BF129523258879FDED9D282F558043FF80249A7ED596",
        "IL_E75E1C1A39AEC12A657774CE994C00870C76D5FC4F060E2032E4C98997ABC062.2714.2162800867.284",
        "CD_199F8BD2C63EA7935AD06C4A530278FE453B1FE80DEFF18B6BDA97081D8B8C0A.2425.2098911955.703",
        "C_B7706B28FDE42900BD4C0DBC550087B0F05CF9BC30AB26E796AD48A7E503711E",
        "C_708C32C766D9971484B0E64ECC9BA26A9738A3C69831CA885AADB8A4B125BF1A",
        "CD_D3F24716BAA23615BF51040AFEC8FC7E21FFC31388E8FE17AF94A465BAFD43A9.2613.552020580.389",
        "R_3AA1CCF33D8CEFD2B415A45A121A40E7E45802CD4F254AAE61989F4AA8DC738A",
        "IR_1502D9F0CCAB385E5D8C39EB62FD64F6896573B4FCB5D2655FED7CDDC28879C6",
        "I_E39CFA925B8402D1FA59EEEFA52F1D0908ABF272AE68B00BB3566ED134F7626B.1499.2202787247.188",
        "CD_75A8E9BDDDA51B5D1D891C00799220E5C1C3A6CF1F951600FBF99252804E2F0C.2424.198893509.365",
        "CD_EB9E795F43B762D3D38837138F4AB68D1F6C9489A93A8726D25010DC91A8FC39.1514.611300018.2549",
        "R_49FD2F1BA8FB39BB918A893D2C86517249AEA0BC5D4FB8986FD52F26FC513518.1074.4098478714.520",
        "CD_D0D38706741BF33F799152A05A2F8D04FFE2013A793BDC2D1977DD231C1FEDEE.1346.2899605558.557",
        "IR_31693429C4F4DAC696FAB29F1B10FB9D329CF192F0DBCAB56B643EE2D3B042E6",
        "CD_FCF416010D567B5041BC82F46732C142DC125B68750168BA980728F3E2F25AEF.1149.1542997555.288",
        "C_C56C7608FF9CFCC8A840FA69CC790774A3CB4E3B2FDC6233899BCC626F12C6E2",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.314.1925181483.368",
        "CD_28DAF7E88E6FDBAA130469111BCF0046D7AA8CFBDF0A7839B0A4F7215AD3B619.1527.4292547455.733",
        "R_D026E850A950A9D63C34F64A5E38E45C3571A8EBA044220775DEEA311EFAE9B8",
        "CIM::Core::Service",
        "I_2381C996A59A0D1EB6DDD79E1C697FECC05884247B858E341AE1AAFDFB086D7B.1196.3074802508.267",
        "IL_CA172AD660395B7E8318076D3ABFB2D903E8954CFE0714462B3683ACA1CE8C8B.2699.2873230368.279",
        "I_B9EA4E4294BFAD4BF680A19D237326A3AB39882D24932A1112CF7A54CF8BA248.1931.401831312.328",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1938.1399279803.180",
        "CD_A9756BF34BF29220A7B7ED9624A09410B903D557F574058934882D94F40FC62C.1256.1.22092",
        "CR_62C9F140909076218EE5278EA8A962B5322866C7B9FEC741FAFB594868A887A9",
        "C2F1B60F7C58CFC2746FD13AA4A9D190175266A50C4EF19AC5AE.2718.3719290733.284",
        "CD_297B009625C3BEC5F682DA65A87D7971BDE24BF0C5093DE7BD3ABBE18CF35D09.1222.1682379743.6697",
        "C_56ACCF81C026D704BF64439555ED0FE36A1018BEC0E78E085DF8A96CFE6A37EE",
        "I_FD49BFCB5A034F2DE40FD1D17E460C511F7594F4FAA424A3C6F9CD6F04FE7AC6.2698.2778012881.274",
        "CD_696458CF2676799CFE15561DC95060B16AFF52FCF4E0D19900C2981C3D512363.1191.2402046714.242",
        "CD_24BE268C5603D757BD8CCA53193660D8F104AD29F4F74D327C13832A44E7DF1F.110.2342327583.632",
        "CD_9AAF3BC6AD36F8829CC6FBD50259D024EA00D998ADB66289BB6A5295426711D6.1087.802354750.1809",
        "I_EDC35BAB08C17A232132A1674585BA48F6A693D93FC9029866D5AFAC23E66440.2389.434244371.264",
        "CR_FB13906D346FD1937AEB762793605AF720F07CC036588017ACD7E44E97A28121",
        "CD_3B46459D96BAF6024CC69D0B547D339FA3140A99F61C6D7F2039EDDAAF55977A.2076.1.25199",
        "CD_15DF3954917D19E28725C2F53AE379712BC276A2F92080C36C49446645CD4952.2019.557995404.2064",
        "CD_00FB20AFF0BCCA524ABD6DAB177F9751027934D1490C8FF1272B32FE7B6C4631.1541.3143665745.482",
        "CD_6B9AC560D28F493249132555B3E41644DBAE7E183CD96D6C4A88332FF1D8E0DC.2513.2990252201.672",
        "*fiorulx{",
        "C_2A005D230FB555A5235DADB2795F61BC8E5EA1E4A7D7294F45B45D0B7EECC847",
        "CompTIA",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.1938.754925068.442",
        "CD_BFADFC7C01226A013315DA8D6A490777F3088D0548B91B44B7B3C64DD75485EE.212.1.12069",
        "BmLatency",
        "CD_17431B4BA51D33CDA0A6628CA12FC7DFF5F227BEC60D95CF88873EA792342553.41.4100992215.1025",
        "se.dll[MofResourceName]",
        "I_02B739C3EDAEF0D30BF435DDE3398CB6A025C2810BB0F2FF2E60FB58DCEB2C36.1049.637538807.469",
        "0F3F59606E1BD8488C4B7DB168B1A6CD1CB3AEB6E33.2703.2016533132.284",
        "IL_F60EB53436D6291A5CA381CCEC704B4F119A4D095DBB7398C4E6AC1D85D5A994.2764.1761812823.268",
        "CD_06F499F2E4D54A4C7A3A14DB963938B9CE4FF6BC0CFF9EA9D0113E9D4BE3E7C9.2547.3388488306.609",
        "I_16ED3DFDA841F48FBB2366794307D1860617F98AC7034CEC38D34566447D33DE.2678.3699017877.289",
        "CD_7006D0335AE3481FF77E834074E3321CA4F5AAE95F4A071E78CEE5CFB4E9C23A.2652.1918168216.479",
        "CIM_InstModification notifies when an instance is modified.",
        "CD_6EDB414A272FF229BB33606CCC694211C55817ABAE713A5736D1E4CA0295AB08.2424.511893651.356",
        "C_0ED8829CD55CB10045BE12FF28DC63BFD30CC65BF9376DAA6A5D15ADE3CAC700",
        "C_77DBF4A2C876542515BB91822C77D6AAB627C74A2589D8CBC4096845BC539307",
        "I_6BED86547A30ACCAD1302C7FA283B163848C4E58E936CB646E57DB7DE244D555.1020.2824652200.339",
        "CD_8DD4117F0A6CA8322CEA3B2EE2E937FF189016C7342D650B227DA4C96B557695.1649.3403034461.236",
        "C_298A82190EB25998365528AB4442CD971C3CCE3115D859EA184ABC77CF5A033E",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.305.307563796.372",
        "1 - Pinned ",
        "CD_A042D558C8D8C5910DD5298BC5D29889BA5CEA0D1A22A1BD4A1EF145F3C99D41.1081.1439227569.309",
        "The Win32_SystemDriver class represents the system driver for a base service.",
        "C_7679A6A4DB35275227614187F15B694A07842EA06C2B8D3D34850D990649BC73",
        "IL_619604095069A40FC54061C2D59C1C0447FF52FF8159B271BA6440FD5B5341A7.2718.1525292586.281",
        "IL_8DA716445EA26247BDCD502C872559133B29770F7B55AFBFF871D80915CA3DBD.710.1.40746",
        "CD_9A3419D1BEB3DD772F317128C59554641FCDDB696104EEE43BBF4385A72BA8A9.31.2295786835.459",
        "R_EC77747DFA1A56E57865C924EFFC4FF3B343A32F0410A14B86E627A721399A15",
        "CD_85F4FD558CEB2D53836A59CA16C7897C522A861DD40C1B575F3D3B0B10636B7E.1937.736702098.236",
        "I_6AB7FF86877A69A2199854B3220F74AB68A2E4627C6AF2DAEF65D55543EC0952.2764.127612870.293",
        "I_5E7DEBBF962531F01D86A0E0059F80ED5DC1F33DBB7C0F296C0786E73BB7FA43.2724.2829331782.285",
        "CD_2F1391EEA94D4D7024BFE5FA53A12470ACFEB3E1715FE776C6E0FCCB952C60E7.1601.95588220.412",
        "CD_323A428F42246FBEB526509F757EED1F4F82E82540AB3A2C0A824F6B79F837EE.1544.1945813059.410",
        "CD_108D5E4ECF642598B0720912427FF7D58266E4483E2C4F3BF418548042567684.1248.1968126672.582",
        "NS_FAD236DC88D4A39D9B808B598227AC32F45800A0F09FB4E10AAE80BE63A63AD1",
        "CR_80B699E54B84239FD1066E5A81EB19D570A7344B7D65738ED8C91406D3A0502D",
        "CD_A9FE98FE5C3E9051AEEC71D48BD2011F883E1553AA2DD7968A20C510AD60108F.27.1334009401.439",
        "C_7564DE160753682806BFBB9AE3DC7D3E1BBEA72CC1D5BCEA2C7C08B97EC32311",
        "I_3AA9DADD55B999E70B7D98B725AD93D51EC7F4E8E0BBA4322C1971480F73A8CF.2690.3536088366.263",
        "C_33E9F891CC90BF32E6669A30E5EBE2196EAD69F35378260B9252DB174DDF3026",
        "CD_A5E1AA71C64A6E4F73F07C2B8390FCFA2D21D2EE5253540934D342DF02582845.2592.2082752193.860",
        "C_B644DBBE73F79FB0842E1C171405F67338509DC40A93651BAD6519043B41B89B",
        "CD_C013BAEF52C1702952D5C4A7F180A34E20C7F843E3022D39040318DA1B2232C2.74.2270172602.664",
        "C_A54AA5BD56CD9E0A15FD4E390B4435EE2DF86F4BBCFEE6C64ADDF6EA5F87A9B4",
        "C_D5312D2CB1C1201CA5C65DFF999460FF4879179CFEF4C66A96B6BFBDF88AAF0B",
        "CD_868ACDF7C673B81A9B86641640BBAD191E1BD447F658CE37AD4CAFBF6FB97C0E.2664.2180655825.585",
        "CD_9C13B8AC64E6798C561DBC69C0B490F021B424520B516F03E8E801BA8A8E4040.1555.1218235788.426",
        "I_F912EB3190FD19582E9490517E0B81548015A8E7F0C08F5CBEE584C8B2A79409.2726.153369943.272",
        "CD_27C5DB26AE68508026F2941BF0889CA12BF5D10E1510169C1D865712E77233F4.1188.3480417587.587",
        "CD_9BC3125C48B891C7E277E0D05B1E9C0901D367808E2E9E9F7838AC0E2BC60E79.2637.1334059742.1126",
        "CD_684131B90FCFA4E2B8AEC19D8AF6C3AAE1B3CB476764A35745FC299F2105E41E.1194.1935223560.697",
        "CD_72F6E06014740E33BF77857BA13684FD2DE1B4C686AF87D9EA70874A34A68B7A.2652.1838996316.355",
        "CD_A32E78F452946944B493C9750EF53414AB7A288F9EC50AFA095C45B0E5870216.2472.1625319574.522",
        "C_30544E69098FEB7B3DBD10E5E79FA9F73E13B4CE82E27F9768299AB561F3C59F",
        "C_2337B9B06F01E50F06D083E14CD407858889BA1306F3231FBD80D8DA1B8F42E1",
        "CD_B7CB0F72C5888EFB87CAA914B3258F858F11D8FC7438CC22070822389ABE2635.2013.1008408953.2974",
        "CD_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D.1174.1.9472",
        "IL_C533843AE595437B2859D3257CC53E43D20D9B1BEA0A51515A7314E5BFEA66F3.2717.1963368420.279",
        "IL_84DAE394D72EEC44948504C5752A6FB488C2F34AF0DDE614A4D6BA8E4EF41579.1105.3603858765.242",
        "SEL_DATA3",
        "C_EA2F4ED6B8AA0BEEE14A7235028BAD0C1DDD97703732E8317B8FE1581E43A3CF",
        "{35B78F79-B973-48c8-A045-CAEC732A35D5}",
        "R_53F361C92B689C209884B5B758327060224E1EE2A715868AFD6C828FF0E150D3",
        "CD_CF2FBF293DD7221E4D59FC656C884E2F1D90ACD7290D16379DD028C135AFE7FC.312.3249972929.572",
        "IL_B81BBFACEE62DE706A28655A7C08A91C36581107478F8F80312BF365EA8E32EA.2749.3578762850.269",
        "C_D7F48DC4425F710DA602FCF6C28C143A9D53D970A26FE8EB312B2FAF7E8F7D93",
        "4-way Interleaved Stereo",
        "Header_PartitionInfoExtensionV2_TypeGroup",
        "CD_8CB3FFD7A1A650625018591E5EB6DCDAB3ED214411C673CFC9AAA91D2D57C51F.1152.803999655.1475",
        "IL_BEBE3BE0B1AF43DDE4D65ED028A12909D01BD89CA2B3EB8E387C308BA66E0111.2704.2511378584.286",
        "C_124B2D8A86058DD102C833379996E9AF4D90CC4B792958ACD8E55DB72860976E",
        "IL_8D9107E4ECAF109CE6D86793D80E0B566CE8692178AEB151294771B38F8935EA.2465.3858079449.340",
        "I_3D3170EF13FDCE33C2F2323904C439F40CEE924CB36F810DFF4FA1EE5D56359C.2676.2574734296.277",
        "CD_A61EC5F6C4AA87644BB2D88C4FF2995A030DA38FC8A704A16AEACEBE64D6DAEE.11.3924321140.135",
        "CD_48D4F256702BE1E23719E035364C5226D32D66BD4161C39CF31B8494F0ADE28B.2746.1572967309.4110",
        "Time in minutes for a detection in the 'failed' state to move to the 'cleared' state.",
        "CD_5D33094C3BDDDEFAC95A7B008EBF2F99A268C52B1C3A20519425F7E8B739FDA2.2651.356906125.877",
        "CR_58EBCE462A5C99EEA826226A8DAA39BB4E44016ACD1726174C7DBA9B5E2879BE",
        "CD_BB1864ED13E60C22074D25C584FF59AF554CE92715925E31CED372950D2F6DF6.1171.3506823635.1103",
        "TM Forum",
        "C_9E064E4DC0D110210A0F35639C83ED75CA571522B2C951BEF2951DE6D3CADF05",
        "CD_AFC2C77E00949B535F20B4C49C402E7EDC81D11016552B9C9324031BE73C36C7.2549.3208603361.1730",
        "CD_930877E805DC4FE95AC6F1E943D1DB43C1561BEDE5B613B8E3A3B85C32FB8071.2657.3559834410.1822",
        "I_3985A64DD548C159337A855FB2D96B222C50720949C8FDEAE049F7ADFD2826A5.1784.2691966461.423",
        "R_B97F7F3BF84885AE8D15094DD1097B6927A8BF3FC26CB042AF1DB5843AA87943.11.2563379885.524",
        "I_F09D5F9D0249487F8E1F69CEEEDC11ACE977B752E9987A45F721389AD20D7C8A.2674.3871480263.268",
        "I_3AD74DD44942EA2E3D5CBF11BA9CB0A9949A58918994AEC381F1EF94F778BAC9.2696.2133637917.275",
        "R_FFF2AE454B5EBA423321420C962DDADA7E00808CE9D4E5B4FF81481A2E9CA1B6",
        "CR_EC0D9BE803395BC39DBCCA5405BADA8B14A82223193D36895536EB3BAC2EA6D7",
        "xfo{K",
        "CR_7531D0F73C9D0FCC20C0C9C036C7F34D7F189FB9D62AC61E8FFDD74B2A07A836",
        "IL_A265944DE9F9253F1E3F972A06B3B034EF943B6985045F07B528B95C68BF25B9.2728.3714738466.287",
        "CD_5A900E37ECD3AD176DF3B2408CEE2A05339FDF5781218575370BC8E3B869737D.66.4179516367.2211",
        "IL_DCF3A71A69441266D0851FEF561016D8CC73D9A70911ED441127DAB3F21A7B44.207.1212613759.304",
        "I_59F51D139436E0D4074EF36B3D938375E75E533F45C88D96B575A1B7A1D8E980.2675.4184411164.276",
        "CR_D1B2F4E6056A69A2D8AF80AAE4B443CB0029F3E62BFF8D77A98B6230DF9AE6C1",
        "CR_736DA1BE1383B0FEB2F66F7268F46979989C22B45120DC2F7115B633EBF80496",
        "C_532D40BC8D2DCAE0B935582EB7E7A966051D83F4E459415CF450B3F76F74D4BE",
        "I_C46A8C2DAA6CE63BCB801F840965A26508A6BA3B315EAC5AF8FFA709D21935E7.2702.3706164383.292",
        "R_F5C834F5C60D3BABC115E6B6BE5546E7D8A66BBAF89B5C7BFA41187C8795D13E",
        "CD_ADADA2B2CDD3BACE2485D2B360E811514E03484B4187AE7DDB3778A03ABAD994.2284.3818532892.3832",
        "CD_76C38B6783FAEB293B78B22E0D0E1B6074F7C0D71F3859FC7FCD18DDF5F5203F.1836.304411041.436",
        "I_320EA2B9CFAC2AC8DA8920958C45DD96FC615BD6279A0DDB2CEE450982A4E8ED.2722.294487866.282",
        "C_082C07D164552D2B77F2EAD04875A64B40DC14D08A8AF625C8BCA071DE48CDE0",
        "CD_E706FF8586C52A7176ACA48D7702EC2A6550564F0E42B0C09AE3FD1CCEA62CD4.2006.1112327221.2180",
        "C_FD437FE09A5F0D1CF8BBE227B2A7EE19B06671F0890E0CBE2EE538D3FF52E3B8",
        "CD_1A1A53BAD8EC584BD47E87E10AA8670CC6D8419F3C4B73FA6EEAB440322DC0D1.2580.2735321881.257",
        "I_B84D4A8F309AF2F6984062AB08B3B336381470849C9D00DBE645D458571018B8.1996.391881786.292",
        "IL_C88CFE3EC418CD56F628ABCC68CD4E30B918C0167CDDC43AC92FC5222BBFA7FE.2715.101330324.282",
        "CD_936D541CD85969DF0CC7874005A3CA167B065E798E6CB9B3817781424E973EAA.1270.3182780062.2776",
        "CD_847B47B3B9DFABC8A17BC79B345074758B8A3E5B2BEBFAC49A4BE58E4D1CE00A.250.4114011993.1679",
        "IL_6E9DD02E52C196C71CD529E2D8111E7EE60BD0D43965AAC2D903C8F515A0E666.11.330131292.330",
        "I_2BC4B96F539BE0CF3C85A05639F9F1B7EAD4BA5F4047BD74245015D575E495CB.1015.665898166.341",
        "SelfHost",
        "C_DB82B7491F87C54932ED0B7927014B81BA5EBB7963CC0FF12599DC8D11B6A951",
        "Vertical sync offset",
        "TraceEntryExit Flag",
        "IL_3509E993E1B22CC95823C713A9E632AD3EB56594C59C0A073AB0FDF7765D776C.2686.1920747093.281",
        "C_7D2D68730949E5EE75E3C50237992854349528E2C6E36831BFC90A236C99C00C",
        "RespondentServerUrl",
        "CD_318C41B790C73AD23330721F5FA83CE8CB8B0D762F5F83DFC686FAFD74664F53.1197.3318579711.412",
        "C_803E283D75B31FC987B7EC08347BA9088A22475CEE4377C7AE84C9F0F1991181",
        "C_09CCBE426DD52D60374145524B2F98C4F709DE617A8D3D97D699BC5E8702A3D1",
        "C_85616F703BB41919B48C4869294417D5BDA27AE8BF1EBBCC58D3F39A497E2550",
        "I_1EBA270562C682B81F29698E50E9ED769AC9519D3C2F8B287BD70B9609EE21D6.2679.2817958383.278",
        "IL_5B104B1A1FD8AAD2B44F01BF67722EFFACB6D9A71C19AE761C0348FB376BA4C3.2706.2938299320.292",
        "CR_5608C71543FDDF779F8513E4CC24C4DEA60B46017206C3AB0BF7959308FEA837",
        "I_F98CD8F4EA96B0B77910240E3039FCC377A97641ECA44728EE7350A6200A681A.2462.640519852.342",
        "IL_31B4D11C0951560ECDDBB097ADF07A700E42A371ED5F0946FE50F3092ED7A136.2697.2294315214.274",
        "SourceFileName",
        "C_A906A7709427F12DDE6D6641BDCB16CA4F2938A2A88AC6967D518CEE727A69AC",
        "CD_BBC3416990D99E7DB8C39F2E507F441E712209658D69697F0053C220DDC70FE3.1331.194345995.1547",
        "I_A2F5B899DB2752A3E856C76966BA13B0BDEA92AF49BD315895482F20FD67DF4A.2683.2268626235.275",
        "I_35470FF5DCAB681C7A225233B7BCCE391C1C7BCD4C2AC4F16C30CACAAAC0561F.2702.4214347319.285",
        "R_A24ADD302EAB273CFE6B09BFCCE2A5EB53CB3E4340505E546264D022430FD671.2736.2214603815.492",
        "ref:Win32_SID",
        "CD_2A112266506173779E6485F94910F63ED293C987DD4727C603E3F53E6471F5B6.2436.1885612000.627",
        "CD_4988CD2D7F85D5C17FF2774D58B894734938D3599DCA6128DBFB2C7CBD3F8289.2574.2921176094.803",
        "I_E3DC31FA375DA42A8150A733A12E22C9CC1FCB3548CB4C211B732B0CBA295D66.2764.3609688890.279",
        "C_BA66F6FB1EA83037593F1D7C182F6E90BF7F08862C9B6D8B2B85562F54962932",
        "CD_1DCEB1693B085B2991E1748C5527FE1000E59774A81597D782C7656FA24FA810.260.2447344276.4844",
        "C_5D8A70064F693F027290F7573CE6C1A3BB6513B39CC41447AC81334C5DC5B8F9",
        "CR_1A56F41D63578C6740DEEE2D125A595986E3783B82D23576EACB16C1622C2314",
        "94.444",
        "CD_8519F629D57644187514674C7FCF7F8B0B70EEA799638913C1E17DC7E507CB73.1638.1077066923.768",
        "CD_4BE589ACCA6072A68F165F37DA3FAF78551449C5735F577FB914BFF88C4DFF8B.1631.547311630.1023",
        "C_4B5A98799E9F89299CF2B3F25F26C1BCCD944C8F4FF1171DA43EA42211F0976D",
        "IL_0D0C408DA61D1D81B5295D02AF7B7B37B653E3A9A8C3EC1985E8DB9FFB9B3ECA.2709.3191107679.305",
        "KI_2432A5ABBE7173FA98223D70B4EDFB312E0AA87F456103A25E4B4191AB55FA02",
        "CD_FB25BAB4ADE9A8788CC5262D13341BE83D9579F1AFAE9D6BA6F8DF76F6595862.1748.62288727.610",
        "CD_09F918FAD220A296DA8B905DD4636D77F7A42233B3E1893192A0FB626A5F6E0D.2591.3374447409.280",
        "I_317D1F2687177AFA27CB8EA6F6A360902286E215810936DE250861D000157F69.2460.1550424754.287",
        "uint64",
        "CD_C4745EA3423FBDFB01E969B9658C85F67EC23C1A13C01BC3493AE45ADE3D3F39.1575.3541592637.6710",
        "IL_E6EA3F9ABAB0F7F735ABB83D47A0BDA517A98F36F7D197BB63E64B363D115BDE.2512.997523342.332",
        "CD_70C90949E0D1D36557D4029047A128AB1B87AC928C46ECB81EB8625954A4B495.2548.3920546393.446",
        "CD_8A3B6432A229F674039F0136B188BB0F847AE08B53B1611977C2FC30461CBDDC.1589.3044945482.347",
        "C_EC31DBAC8296A2F597184183FC259C7595AD4BCCFF23FB0BD832DE414BDE578A",
        "IL_871CF60B6790A91BE6A295359CD1421781487F5067A3513CC71EB8B1029EBEE5.2719.1177181942.280",
        "CD_CA28E6386CB43A066BE2561E182A1EEE9C70BBC65B5975ED1D17667F17262B9A.2549.1826393354.1730",
        "CD_AF4BE4279039B330700F9676DFB82FB8AA7B80608BAF978E72E54EFC9915FE11.204.1.14435",
        "CD_4720AF4CA174274F71D8038B37E58001F7A92E2A83E49C05ABD2C15725C10921.2745.3437421172.302",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.136.2525514145.180",
        "VerticalSyncPulseWidth",
        "CD_E44C50E01AA689218378F25B1207310CAB1FDAEB49F9F7888B050672D3D44374.2669.2957495714.609",
        "I_58C040DD5012452AB107F852079062EA9811E3F1CADD1541BC9B20706E492EFB.2729.4011188058.275",
        "IL_5AD190D6B25479F68194F51DBECDCF63D6CC0D9344607A23A86C810FE23CDF8E.2689.2993149574.272",
        "xhdlp",
        "CD_E10E5CA0977E853520D0A743D4ED155E966A9810077470B844AB3080C1B57208.1924.2061463799.1019",
        "PAL B1",
        "C_243302F4ED326C4625A4CBD70133A669B2EF782BDD805336E89C6CF9975728E8",
        "DC/OS",
        "R_DD2178271091FB1F73210A7F6D8E8121024FBB7967C9EA5A686C5C1AA5AFE401.1501.832184567.584",
        "CD_7E33A4E4E69DE9ACDED83C5A5E95E6AADC05B16D4A189A8F046304FEE3958BEF.1524.1.14822",
        "C_293C515626057C49BE9FEBCADE3529905E03FDEE2BB0FB67FF107DAC390E7179",
        "TargetName",
        "C_DDC1CE722F186F71EBB5E11C2ABCDF911566A3A8729D02AA993562ECD3859FE5",
        "CD_601DEF79F7AA8603C2C98382F775A0B90F77F76016FA8C6D63B31705D050EB9C.1342.3594532816.1208",
        "IL_EF7C691A31BC411EA8C4487B4FEAB2B287B462EFB21257431F0C9E82A58ACA34.2695.2527911997.278",
        "R_664FCFB4C8DBC3167BFA873C90979DDE17B851EEF4DBA9A6155969A1A7AD64ED.2461.2184674864.554",
        "'*-036",
        "CD_259FCFE2A3935A15F180BDB11D2BB86ACCAE71C54E422895B35143097454A85F.1876.1393705184.321",
        "_UUUUUU",
        "C_3035B16D02866D7EE030442132A18B7ACF25E1EBBE385D31EBEA6DA0AB2F86A6",
        "ref:Win32_Share",
        "I_6211AAB1062F5F857F8CF4D9D50D7DD98604CC50B8D3A755123ED244E2C8142D.2736.4164110465.287",
        "CD_DBA99A7D488C87C166C15C9F1723F214A2817799E8F4CB02CBB2C24C78077720.1741.3649447187.352",
        "C_947907BE0C21868B3B6C1E2B3F2F4D8F4078DF318D2CD738491AC5AC30B4B16C",
        "I_BF0361BA762647E2CB9D96E9B6CA1495FDE6071569DF91B2E375C7A552C2EFB9.2681.1758887888.289",
        "E0E11B2712E56F7",
        "CR_03B5275A0D380627593F835B4AD2B03749EDE19E5B92F5526106699F68C22F4B",
        "CD_7EC6FF58E9EEF4EDC93B5F895A41B1B0DEC2BDC5260802227931619EE6182F7A.2425.454952698.357",
        "Indicates the record type",
        "CD_AF381E654B1D4D615B1590FE7663989B45D5E01B0E914F360B9D5BE7CAE77340.2583.2443383700.398",
        "IL_AB995CDC4EF208FA9B882B68B87F5FCFEAFD232BBD8A1EF148EE45BF3D99A6EB.1218.3692575739.189",
        "IL_5AE4C65F88CA296DF22A3A98A9517F0448451B783C721C545F1B3C0ABE106206.2677.2200677351.280",
        "CD_27A364644C1B83931E072B22EAC45B45C2531EB36360F82204598576E1DF4301.2436.4096324972.6868",
        "IL_FD26F844BBCA0235ED4C6E1628807CC844F9CC678E10AAFA6C284EE9D675C98C.2721.333233622.277",
        "CD_0ED1C3985408CF8B2B34893CFA150055B29DB00EC2B161251E2022B947EB8ECF.2105.2486443830.531",
        "R_15B889373568EAE556241F24EDAA1A327AA0BEB4DECAB175E13E65E1BA9218BC.1051.3716469155.524",
        "CD_7B5FDA91F5DD1FFC82E20D5F3963DD7D7657FEDDAFE32D552743090171A78DCF.2568.1539850588.221",
        "C_281CDD03B8C5818D9F90DDBBCC29A216594631B26D65DB48B400C2836A46FB95",
        "        </include>",
        "CD_7E8AD53A486173A3F5BA7467CEBF7B1550C1E17C0A356223A9B63225DABF0B50.1465.3594880688.1385",
        "CD_9545373C4C410A85043435CEFDB53CA783FCE515B65345546AA266D2B18EC658.134.1850930805.992",
        "I_C49F79BDFAD7EE475A1EB6E0C0C70CB5BCCC4C39035FC619BE1A57A531F5B2AF.2449.3977614343.353",
        "C_7C256082C028FC113E44225862F56FE496A6FB4D4EE2AD50DD39EB6DF6A574DF",
        "IL_4E3C5019E7EDFD66729F1899A6916549F5165AA1E927CDD13C24FD0F056D9269.2735.3290035095.284",
        "C_9E178FA2A34645B8FAC228D88E7D08922CA628703FFC498A6C1FBFD97A3CB433",
        "CD_EA2F4ED6B8AA0BEEE14A7235028BAD0C1DDD97703732E8317B8FE1581E43A3CF.148.2936667464.1318",
        "CD_1E81C3B7838F4D33A0DBCA06EFC99B61816E8507E0CB2D2FE7B2D8431699B9E0.1018.1539097505.313",
        "C_734554B436D696983B7A89C30AB69B4CBFDD31A6E31EAB13C0DA848C2163A36D",
        "C_85595B738BE1333389D2F0D432EA1652CCBFD76389AC1442A504C9C8DE6CBD03",
        "I_4DDD1B2F52671B9809054476CBF492325A0EE02E3E73A2798DAC9BAFCAD7212C.2674.1797238991.276",
        "IL_AEA9A6C20A5CDE3FE05BB0AD73D3F62C4A3D3F9C9AEA68C518E6B5CD1117BB7E.2679.2770851414.281",
        "C_F2E5B645DF6978E5AB18256B0F51A44E754826A7C900B35CBE3234B8A07F16B9",
        "CD_3F47C7C5EDE1255249E372E90C4D8EAB77757D572A8E1F6E22B79B0FD3819343.1231.2797175121.589",
        "C_47D67180E30861ACEA3AF23A6DE84A4F96CD6019DCC0A0301E4F92DE3ADCED2A",
        "C_E28AA1D8B52A95E7D7669D7E7E560FC2B4623233BBA77035C999EFF1330E4AEA",
        "I_9941D4A730650AA796EDC14E5504D4BFC2FBCE2F80390D817AE03973C308A837.2719.1003903223.283",
        "C_406F546FAB6014271EADE336F5C1DA060EE35CB23E405330559A7A1A746C6CC8",
        "CD_B574BD7AA8153BC8653A87ACEC6DE25F1869E46546B507B9FACF9F4382AE73DA.1539.1218665998.418",
        "CD_EDC552B835EFC5DE821208E3F9AEA0AA9771EB8639D25966017B5229C652D1DE.1544.1731286331.414",
        "C_5D2C2C389F5259E45332A86ADEF5107186DA3990C071FED897FC6FAECC4A4DBE",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.12.3821327255.274",
        "CD_240A82FDAA0D94EA330D46BB6134EDD042EDB0638EE2018884B19E56BCAB7467.1539.3701002883.653",
        "CD_1D9A9343F720B6D89833DCA8A7B92F53169B46316C0AEF3756FA68AE0584CC8D.0.4262520113.435",
        "LocalAddressRanges",
        "C_1A826788D5CB396EF46883163CDFF0FAFFB8ED9B8BC20D60D3B7762CBFBD2C44",
        "IL_251DF572EC65B42D6CE95DB4C839FD6728CEC6633EF525F0041081BB60681183.2764.4022667224.284",
        "CIM_RegisteredSpecification.OtherSpecificationType",
        "CD_BD27ECB0ABA308B208AA9811DD1A6EF25258EB65F89EC1120D9161B0217F9A7E.71.4078756071.419",
        "IL_AD6336C175D9F9D2E56D05ECB1A5E2CBA761DB39CD3155C45C4ABCA3DE2AF082.2676.2756531391.275",
        "IL_B498B69E308CCD72907DFE63279C92042927888BB64E0D473D3C48463EEABEA9.1074.1643993770.252",
        "CD_20B4E701C3271ED94785243972C16A9A8FA123A78EDAC768D9A7B370EC4A42D1.2743.2947812549.348",
        "I_63AD87026C4198465666C0137FD7F5BA63E3619137A942C6B415985E5F63E2FB.2680.1049819951.283",
        "CD_396FD3CB54728B5B7E193E8232D1A7853585BB3CAD758E58A36AD470D80A78E2.1342.3790386044.3666",
        "CD_83C100BE0F817015BF0575F5A3496A636C9309D7E4EB3062A76F5F113E51D626.1334.3929837118.241",
        "C_C24ADB089A817190D891D780894EA43829C18A3F6AEC62A7CBC31FDB9DA08405",
        "IL_8DD5B4325D414AEB9A2E89B2A9012972DB466402E099F6F23B86F048D798271C.505.1.85098",
        "R_260291CE381A56E26869D14B7E011063D4B0CB57641D757C0AF6F81E93388786.1054.2174779108.520",
        "Force open files closed.",
        "R_6B87A2FD09C6892F4F975A26E2D24DFF27E8D9BD67B9DB050A7E8D7BE4DA7F6F",
        "I_BCA765E446D9097DBEA6C9E4DFDE858DC64A1737FEE09A95AB480242FE45EE06.2469.3429856957.289",
        "C_94145E2C57E0D4603F8377F5BA5E611EAA5A57D8CBDF073A7F4BA777C46D367E",
        "CD_4B625BD46CD9F6645F33476CE1E5AC2D9C2B5C6721426559A5E5B53B80B4B21C.1194.2746471374.2546",
        "CD_F184832B4631E42C2D983F7EFCE295CB4A79F3A6CBFB4FAACF42325448D6184A.1576.1920700125.803",
        "C_C51E70FE88DEB37F2E85B037DEEDA0EF21742DD637312A3E1B9ABBB2A7F6C657",
        "CD_8B7F99C264005A257FC33FC5B8BB55F758A76C6761D36338B6FB1E0C0931778A.1056.4052245847.754",
        "IL_C52295624F06C940B122D80C080F06A7E8A3B72E8DBB8DAB3530E90B3C01E0C8.1501.1965779237.618",
        "CD_E2B2F2A9C4A7BE777C95CFBAC1ADF577ACC960E4E5C2F6E896E757D1BB542084.69.1503878399.450",
        "C_8FBFA6B18AAB7B589FCD4C8B4ABD0E58545EB816B5459111B04088F74A1FA745",
        "C_128B2D3C252FFFC5768D285553F59F5171808A8CB495FDE06EFD9BA8DA4D8D8D",
        "CD_560A954CF1AFD0E34DF6D157DCE8FA7B48ACDEFF72420CA6796A4E93E34C62E0.1562.2727810577.3083",
        "IL_CD9EC36D2D714FD596C89C8948EFD3B9072EFDBF46A4D8963108D0D85C3E7446.287.2963456541.210",
        "CD_10BA8F34398164EB825D029D658F9DC9D3E8CF0E22F699C41582D155EB085087.2545.3086622055.1222",
        "R_59924E8F64B8AF338F6FDD7078AE5603B0E617DBF52294AF699E010A93F587A7.2489.2657567322.590",
        "I_0E771EED7AE4F2FD86B4EE591BCEAAB2658DA14859A78258313CD4E9C7B177B7.2679.1891015008.281",
        "CD_CC0ACF58FA3646F311BC16A78942AC6DB48973323025BC27052C3593D5CE6061.1078.4267440841.779",
        "I_31B67F22EFB46B12ECC674B40474C42146C85B10B72D3B0D6656EA2E5D0F6100.2720.3071751668.274",
        "CD_6762A6236B4D2CB4C3C4CAFCF2156B752A35D34287DC36F6247727EF542AA084.1925.3988243719.282",
        "CD_810BF28A7C26F6878E189604887AB1090DF3478356CCB47422DB03C98B71BD38.2005.743100155.246",
        "IL_215FA2B6AAAF72700FEDA4F12DAC195DF0005A0680EEAA6F449C9E29A3798052.2723.16826116.287",
        "C_729C810203CC3BEFA1C055392DFA457C6E7FCBABF87C7B3F5286CDF28B07E2DD",
        "C_9BCC8ECA3532BADE5AA73BEC8D82CD8868D955BD3F2FBCC16B8A5B3B30F8CCD3",
        "CD_B4C1D5CA2F445738E1D1E9A535B6C314D6AD1127F6B87994EA756B275A939A08.2625.4063690928.552",
        "IL_A7E84BB1D3739B54369DFFE44BADD220083DD356D5C5AB46BF570D9C77D7DC19.295.4244090149.306",
        "C_41D84F93E168026991704896B6AB8BD6B7DB82CBC17BBAA1442A047D10A853E1",
        "CD_4697BA37C7F203503C8202661BE5106E633035DF77AC384B519A1851A6E29E79.1589.3496519377.417",
        "C_066880EE966FE7D86CCB39E13B59F3C7EA026EB96DBC471703C7B38EF25FC1D9",
        "MinorFunction",
        "CD_F8EF7CD33C3F2510D1C17CE3538977B71D5AF70C10D3ABB08287498FE3E23A15.1455.1.16027",
        "C_CEDA967BE18BB6CFCE80E11488429372F9B550100D4D99059A8B8A740BD83EBB",
        "CD_160EABDC96778D770525694D91EB3D28B431D3754F4699DE97314AA3F85E4954.215.4268802414.477",
        "C_CD6AA036460DC62F8FEA24B1FBA9E9DE4AAE50D611B3048D1DAD706FB3E65A26",
        "R_CE3BD7958DF29814D59DAC8422592164271EC69E371218B0819029BD62E51D7E.1464.2809056066.540",
        "C_B429188FA54704573DAD15C5B0E5FF08520FADF30A37A2EE248A1753BAE26638",
        "C_F841B632C0B2584CF30B2004D8CB79959F456B5795456033F557C9A443CA86F0",
        "CD_54B0E217B287F6F85D4DEAB32DF5A8CE4DFDF560D8AC01819FC50FC0ACC66BC3.80.2810469449.2949",
        "R_A09DF16E80CB8250C7E8F768EDC2F0DB283873E2BF1AF5FB3DCD5C1A024C9766",
        "C_A767797A466AD9FDC0F5359973FEDCB08DB02EBA93D9932DECBA6455A686C8BB",
        "MSSmBios_SMBiosEventlog",
        "CD_6645319666642BE1F4631A5D96E8D9936FE5918F64DF61DD73804D6AB3CF6C32.2619.2714508940.367",
        "CR_5ACAF83AC17F3EA7F1672F287BF1DD774125A890420CE4F482AACA090A7C6160",
        "CD_DACB9CF054C4E86C828A247EC8DC850FA3036240686D11B03BDFBEB866D387C6.267.1078228341.1113",
        "CD_710A61940BD7E6F894BB04EC5095168D9BAB6C3B16D20CD7CF6F51DE93A6FCDF.1924.2080005141.300",
        "C_512BD8C9F96EB955A49B938966FD525EE21A051EF82DE0FACC89259643B42F44",
        "]9AA54865F4",
        "CD_AF3DAFA72013C3690171F734765DB1412DBEFDA2A461CB66FFED0CC4B21B88F0.33.4074951041.532",
        "Msft_WmiProvider_AccessCheck_Post",
        "CD_C7B5EDC184E23DC87E71460BAAE89AB503EB1813107397179B644648906147C9.1595.2611343294.858",
        "C_5250EC9304AFCED3B4B4C6E595A1730CDF3C33CD4C1A0C35D2E9C70B3EAA91C7",
        "CD_B82CED78F3481E9AF93561312036161F961F9F165E8BC3F82FFF9DED08106912.2580.239370142.638",
        "CD_8178AA877B333871BA3CD48D786892AB7A32B541EF0156A73BCFDAC6C25B828F.1589.1030594033.420",
        "C_9EEFA7F0102D053BFCA7454808100573EC06479AFFE9665BB59D010E83D6FD0D",
        "CD_8EF0A83E2CE3C1D36E6DA951CB64B432165D8447385FAA4B9621140D1ADC2405.1635.1387527399.1058",
        "h`dpl$ (,4<8",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.314.1731029449.188",
        "C_4681EF836838586C3156B7A3DCE97C81840063EE41095E9248EEE4435A659C5F",
        "I_89F00A61FD174515DDC1800FF69D136D37611FA6ABE1227CD28EC2795014ECD8.2704.413117232.286",
        "C_D13D81348F7983969C884BA6E5AABC73AE0A128B3CF746A401623C9284F0BB59",
        "C_AA9C35FD43405602C3CB92A608E9261205300DEA694427FCF98EBA8499E2378F",
        "IL_F0869A20E9CA750DED462A6856877F3B941D81878599086B33EDD22902004649.2681.2966676459.283",
        "nd its s",
        "C_410A7F9BCBF68F143E8FFFBF91BEB08109AC58714E0E02572A1BE71E6EE2A05C",
        "C_CA74733E8EBB65936479983FDEF15889A858264274FC3538A37DA4671D61B564",
        "C_A2E68741BBB2869A917DDFD8C9DA73647EFA8AC0B63D90B82F4EE838A6078824",
        "IL_688D8931EE2A8487D9B5A44690AFE9778BD88A1AEC3CF68732A2A8C47B5E2165.2689.4174508309.277",
        "yp>hBlK~6",
        "CD_A96A7ECF39CCB33BE4192A33B3DCCF8594AD17A0E017A148DD467E9A270976C4.2647.2024176878.1233",
        "CD_4C651BEF9F64ADBC535D5D50D8B78E30EE7720ACDE0BCE9B84F7D66AF315E962.1479.301181322.506",
        "I_AF1EC31F9D52CED588A2CF637F321B04B95D0B076BF99F2FD31094917A943784.2681.251723435.275",
        "IL_1DD4224855CD47B7DCE45D2885AA6BE67CB0E54B6C1DED5463F46D73F7AA3E59.2692.1212126100.259",
        "ZahSLE",
        "C_DDF6C28E0817A892AD961C6153A65D3B4E91439CE35FD7C3560BE452BEA978DB",
        "CD_403AACAE2825C9BF5B51FF916E370CD0670FC129E1492AE9CD4E8A7515217BBC.2378.3625684955.372",
        "CD_5378B299266A56152DC649F543170D9E07DF4C60543C8B9C2F666A461A2F0442.1066.1428288615.459",
        "CR_349957449457FCB3DC5CC416323F05E6E56083B532266B79EAB7F5AB720C36C1",
        "C_E02282611F6C18E1D6DF1DA91FB4178F40700A342C1440834524C343B96AC8F8",
        "IL_396599AF6EA691E2B0721E6891E04A15F73BA67E38E37D8501FF8C43D8AB87DD.2699.1674697541.275",
        "CR_9D9326DBD5B904F2FA39C7A8BD8707BEB4F5A372DD531987B409839FFAE50966",
        "CD_1E88F907B6AB946BA7ADADEE8E260F06B3FB1525A4BFD9A858EFE9DCEC84BE35.2556.1839169005.410",
        "CD_91882C4E4700146BC908AC03DB139338C0844AE5A877163990AFB47483D7264C.67.2289634409.1444",
        "I_A652C2031A398BA1BCC19829AA29BBA940B833717CFD10EB3A678C370F38E883.449.1.60127",
        "CD_FBD11BA7DCC0C416362AC2A1F8EEFD82230A37B2505B7C99363ED198FE2F89CA.126.2393194686.5883",
        "IL_91BB5F8AFE5873E9BA8EBD1189F17D947DC5BB7E366AF568F25A5BD3FADD34E6.1334.3559712411.305",
        "NS_B5BE6D2581FD459963ECFF75444197E932C1625927945B80D34915B8FF7AFB3D",
        "CD_A44408E1DD38D6545C617326A4354A58277DE2EC9DC5930CD9DADCDCF31C706D.2369.477985188.770",
        "R_D19777074C5B32D9DC9992840BAA8166B47EC1038BA93E9572C45BE663CDE8EC",
        "R_479C79EBC313F0C9885D7ED035558984DE29F129D7D42110CF8E24E5D81264DF.2749.1426796819.576",
        "R_55795F81C8422B8993E279C97F35D31AD4DD7851F75BE99F367F8BA09963EB67",
        "CD_A54AA5BD56CD9E0A15FD4E390B4435EE2DF86F4BBCFEE6C64ADDF6EA5F87A9B4.1582.944947382.423",
        "C_D070CB0D31C7B0D15CD21428F609EAF8F3D6DC5BFAE4B42064D802D13848BA8A",
        "C_E7845F3041269988C5A1847DE98EF0D88E59CE50ED3A8AA1E310C1A1F393BB81",
        "I_E6057E13FE970CCCFD412B9430F8AE283C5F0F26F3042BF9D4BE880FD273F587.2708.1262655379.292",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2167.2889658748.180",
        "I_D1EC70FBE41F163737E8EEA318CBECA1FC7FD6AB6FA4794FE4CDC5E47BA99F5D.2723.4232706374.276",
        "R_E32A17E9FE8DCD7490FFB745E03CAC336F0DEA370E0F636B9ED800555F83A8B0.264.236356448.518",
        "IL_72E8476B7FE01FDDE3B0BA4617F1FE112ED4F621894E1B09F1A32A8206DDFFC3.2716.1986995484.290",
        "IL_D4C5B1295D7F3E08DA22C2967F502C8285AD006AF203438BF38B8290DF3B43EA.2727.1242757079.274",
        "IL_6325C5C96DFD6B51FE5D97621FD65EC8FE5EA211AEF50ECB08E778B30E57BCAC.1018.3247761884.484",
        "C_84F8BABB6CA8331C4E9169FA40BA6E129D7FC9914E1CFF1EF6A24C2F4E5BC1E2",
        "C_1A5D106CEFB4CEA257AA3A4714757C2AC76A0800E27895E553FD11D6C31800B8",
        "CD_48D4F256702BE1E23719E035364C5226D32D66BD4161C39CF31B8494F0ADE28B.1084.63468358.4110",
        "uQTWZ]`cfil",
        "CD_61AD70324F8E2B3494420EEDDA5029E5D1AF2B0083C1CC1767F12EF889E146D1.1500.1528867493.453",
        "C_BABA8B3CC6A6141F442ED3F0892F94D169E27C609E94AB277DE73957AD024C83",
        "C_EFC301AD50CF7400DE3E25D8E0D5A8D1B7C96DA2B66F07663C39FE11E2C00C70",
        "CD_3E93490AD7E19BA9FBA51E3DC8E6582CA6AAC992C61FC9D54D14390E9939C366.1956.1.9168",
        "I_084C69706203FE83DA8AC777CB426125B247348B780CAB92A1374AB474E9D189.2698.2974897117.269",
        "CD_EAB06445AE40CB0AB3321BBA04962C98586E49396B67AFD5B74F4985163D9EC2.150.1008541491.1063",
        "C_82389622F0014D1AEBC7CBBD10ECF0B5E66F16E4794C2046DCC791564783DD1D",
        "C_D5E5B3762A5113A6C262F653E8716557160CDA5C8EFF2A001BCEF56E204DD0C1",
        "CD_F58FFC0FC8B956F0D972BCF0F695E0980C1562E6A9119DDB8C681A1382993AFE.180.937647591.1391",
        "CD_8669524660923BEB3DA81E87F326B831E705D4AD2D26F7C6F43EC5D8367BA37C.1560.47244273.331",
        "C_308A38A70C7E63C8B0D223B592F8A2FBAAB2069E8358BFE6F473E432CFDFF602",
        "C_D6F87EC61B61A3BE74CF6F98796051F97BF5D3FC96E82F69A2F8FE9703C8F224",
        "IL_34E397CA10A0ECC11845AAB49CF54B3C91179B0B7BBDCCBAA021A6F03BE68A0C.2681.3729945574.285",
        "I_EC5563AA1C02A695A8B900B5625F2AC295403980DAD926C76DB8DF19BFE8AECD.2683.1605751085.274",
        "R_D769628D5FBDC4BA586DBAD54F9BBC7939E2EAE50970F6EE1F1C2EEC6A00F545",
        "C_E9CDE95B78A19AEE2B087772DB9EB45B8857BFE7606062680ECCF0441F1E7AB7",
        "IL_412C48135F0659768A8D638CF71C02128E9CD17B9F30AE8D224F4E868C4B60C7.2682.3464011586.289",
        "IL_3985A64DD548C159337A855FB2D96B222C50720949C8FDEAE049F7ADFD2826A5.1784.2691966461.423",
        "CD_9D8D293A690FFEF350AE4D7C020869D528F57982A60CEA02D406951DA64B57DC.2542.991807135.672",
        "I_A7EBF4EA5D57361BA1D3AADD4406AD2D7B8227BB6CEC99F9510484BF112085A8.2725.2150583155.277",
        "IL_B02C06EE12AE984BF1BF93B0C21BB33BCCA2B3DCDC5165F334E449E4631052B4.2718.2086711136.276",
        "I_481C5641FC31ECDFEDB9CC27B9B4AC9E3EDA5479D72ABC3676DE78027620D064.1058.1943163685.360",
        "IL_59BFAFEBF60E8B2104B07BA7FADAF4FCFEB18999FE92B11F1C00E938CB4B93A6.1020.4071404913.270",
        "CD_DA6435B5A6AFDE1EA49B0F1FA576B2FE264B6CCD6A9F163C86C6173386BDC535.20.4235065349.7270",
        "IL_74D6C8F0E1FAEFD682A009EFD732BE4C07205D2B16A2DDB975E0E123C01843B2.2715.3251878779.276",
        "pointer",
        "C_C78F62EB300A2F46E13E980E55E92EE07DB990928728C002F67074E4CBEC12B7",
        "CD_F7113F6F79893405611B3E0C1184CFF87E4747F2432D2CE16AC2FA972D4FCE30.142.2227648524.807",
        "C_9A3419D1BEB3DD772F317128C59554641FCDDB696104EEE43BBF4385A72BA8A9",
        "IL_6EB0E9583B3959CAC2FCB91416803ECC387F3F7CBB83A3396F0D86C2536E6EDD.2685.614553457.285",
        "IL_84A175A026D7855D7565477E8B9562FE04D5057189DA1A94988C809A141ED73C.2705.2188819442.286",
        "CD_39986A48BD79716B6060A37DC5740DDD40082DED190FB55EA39601F1955977CD.2666.1930308372.216",
        "C_4E41A9ACBA3A28CC69C6A183B9DAA78E0DE0FEC5659A25BFBD89FF102BC593B2",
        "C_2B0CB21E4574B83D661A7C62AD7BF3133DF3FBA914EA55D3A45DC4A7214DD006",
        "I_821EBEA056BBED293234AD9B26F9D08D3CAAA130F6BE60AB8973FD6EF872D0AE.2713.2123517395.304",
        "C_89EF5B0E6A39F2A2970E3E102F92EF0C67087374518D87E3376022DE86BFE766",
        "CR_84A63FB7A3FB9450516F5A71E160284AF2F9D586FAEECFC8F7755F2A2FBD437B",
        "C_92DB14183145FECB25D8F810D51EB91465DF70CF55ECB1D5FEEDBFFC4B20AADD",
        "C_FFFB2CAA212EDE7C934B4B2BAED8A37394A19E638FDF46D5CB25D07EF0827F51",
        "CD_F71CEDE68D110C46E631A74BD74BB02467459B066EB8F2E32432A8044C4EFD32.2059.2885419304.225",
        "R_9316BAD06E1352C8BFCA04DCBEA16F83E85015D607FA57EEBFAE65209EAA0995.2508.173262996.540",
        "SpecificationVersion",
        "C_0499414692D783CDA863FDC3CD3ACD2DB8AE713F8A8DDED3EFB28B37782E127C",
        "CD_3ECEC01C420881AB727C5A252F1906D89E4F18FAF1CF2242E43D26D1EBE6804A.1550.3915184548.752",
        "IL_364C92FBE34CA323742706382DCDD9A3ED2D70098ACB72D59A96DA6D97493944.2699.1937693571.264",
        "CD_549FFC4FBA712DE9539E28A7F1F2C8B32CD81A7B8C28FE57471160A51DB75A89.1172.244633991.233",
        "CD_DCD0D619EF8A182EED9A67E50FF805F66843D183EA6353EF5D3D8CF6F3EB1769.1595.2650721807.416",
        "I_2C954BC688DA51FBB5260AB5E002A5C395A6540DE89E02F3E5A9E1A1CEE1E69D.76.2693172746.336",
        "IL_3FB1CC987258F8087BD78386B8DDA093F7A2030F966FAF6199D43EFA0F6275CC.1523.1979146114.302",
        "328480BC1065468AD9C6801937D3CF87A4",
        "CR_EFD628FF86806AF6B75E95FDA0EBECCB53F0013E3C801AD54DA913AA26319D53",
        "CD_28D3480019EDB8568B100B133C2E45279CD6E1AD49C4AEEDB510EEF8207E9610.27.4262261146.520",
        "C_CE727832ACA71A76A7C4BA18B784DCE93A436565AC691EE960FF2B3DBDFA7C74",
        "C_16090B1DCEF7F16A5E9DEBED60D9476077271C26AA679352AC98DA64B800088B",
        "C_B837FF0F19509FD7BD0B7ED8ED2B62529F924B69EF7322F8463864ECBCB01E5E",
        "CD_2FB30DC8F94A0A113AD4A141F719C8A8C70B3119C9037B1814178A55C7A7F2FD.2426.760804122.363",
        "IL_5DC8A82F00A984AAE8665DAA43DD52D52CEEA49D8887E14BF0BCC39A4C10FFF6.2698.1951472259.264",
        "C_2A7539D06CFD0D04A9740E1B6FFBC157CAB87AAB6CE0B359936AD7F498EB3563",
        "Redirection Options is configured by adding the following flags  None(0), Drives(1), Printers(2), Clipboard(4), Plug and Play(8), Smart Card(16)",
        "CD_E4346FA7675883A4AC1E72B73F27717F3DF9FAD2FE9003A5A4DA0ECE1E363C29.2528.761881267.380",
        "C_87C10E264E287342D3206BEE44C1E60CA6C7D6B38EBABA03EFD1FEBF2C09580E",
        "R_15F1AB5CCDD72E94E858C6CDC3C0B07D8A487137278E4350F78596E94480F4D1.1730.2412932045.540",
        "I_B27B9B082435EB0782A13A45AE5831DF41424D0B630A9D154D7A8DB7E1021A0A.2703.2704080646.298",
        "MS_WmiInternal",
        "I_43E62AB0AD3F0F54666953AC95C414EE36B3A6541513F8BFD8A755EEC9A7E6E5.328.1.65559",
        "R_8E82F22F00BE10A2BC028100E8A1A080AD346FFCD97EEEAB61E9AA6AEE7320EA.2469.3585460829.554",
        "IL_F84E62E806DA3B389C18B7B45E8D2FC0FBFAE4B1DBA14F53EE15ABAEF0C58920.2679.559934440.269",
        "CR_A883D58443A0276690606F149210FB8EEC2F26A746B711BB5A87FB7EE2B3D5F7",
        "C_3FCA69ED8F3BDFDCD044F14AAF5FF2C2F58AB3BAC2575FC16BF0119A940BCED8",
        "IL_91BB5F8AFE5873E9BA8EBD1189F17D947DC5BB7E366AF568F25A5BD3FADD34E6.1335.816371373.256",
        "I_C61169F2236F99670F39649A88C651828DAFAA21726C58E53F190DDE5CD62B06.2676.954324443.275",
        "IL_329C0DD224742A8A2F3E1162540E53902DC984F52EC54923592299CB2B958B9C.2683.4047330402.279",
        "CD_FF9B90BE4979DE749F8B505502B345E073E79C3A6AE6091B78D5A7C395006660.2647.1578854874.1028",
        "CD_0BEADEF5D3A88C78AC78DA4B138F927C4277A4A7EF33E41BF5355AB5E59743F0.1065.423107419.1945",
        "NS_B6791A1CF7802A901B1534CADBB1A0E82FB154100B2BE08AF47386C43CEC462A\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6",
        "CD_BC057C00247E0EBE8B5C7BBFA7A3835C20ABF511E4136D781B5E3ECDC42459EE.1561.3574203664.422",
        "IL_8F1D0EEFF09882E0AA524E87B53BDFC6C73AAB5D286B5498249DD4CCD51331DD.2736.1352933053.201",
        "C_AF9FF42200D7F24F94D2D927172EDE6E75DA70A13982C42099804CFF0709A576",
        "I_F0E87F1679DB786B033D4F291294C732A80A8DE66D6ECA32F416D6AA364D7B99.2683.148135701.273",
        "R_FF7B698D13887CABED0D09BAAB4261C96310F487DB3C5693E4C32259872DFA0C.1082.3580186990.524",
        "CD_05FC8C25744A61FCE1B7262C6904EED1191403B85176B40933E4DB3BDE9A1EAF.2582.2863105170.222",
        "I_6621D875A4D1A0FDA9A316DABB272E99D910F3403F7E069ABA1A8A8DC068DEBA.1016.2201123094.305",
        "C_3AA9C8A0942F537FDAE95E548CCBAD1AD1FFA8F4AD1AFE2EE57031F74E67B391",
        "I_CEFA1B411BC11C0243320DB385ADED0A22B006769FDA616F37991785CE2BB305.2713.3481169658.291",
        "CD_8C6449E2DF9D42E8B328C8B95C19DA35BA5DD1B3E90C6134AD1B5E625248E2F0.1084.2317535527.1477",
        "I_42AE987BCC3394FD03FAED491897A69E75DB821244ED5C3EFECED18696E07708.2727.3238350837.272",
        "CD_33DCEF5A25E042E234D6018C36A73BB8BD2E0A0D570AA0A57D43D363A2232E3B.1505.1.9979",
        "CD_BBB921103ACFB8CF67BE65ECAC36017334C498210BA85E0325F23ED68B750E59.1189.1506952269.556",
        "00000000000500.000000:000",
        "IL_618BE348A47753A2409C56D8BA15B824FE864BAE4B7AEC8D5761691B87263426.1463.2195306647.251",
        "MSRedbook_DriverInformation",
        "DrvComplRout",
        "IL_A4F640EA01E8E0975BA8BC876EC644CAB5707442FA9CA6E8B0CCDDF9DBF724D5.1020.311931531.254",
        "CD_6B6E099E11689A83F0DC500069A409572F5633F1702D3669455D70159BB2B714.122.3581360778.887",
        "CR_C6877D93883C0A287546253E157907791BC6A0C92D8F12064B0617A40E589308",
        "CD_D026E850A950A9D63C34F64A5E38E45C3571A8EBA044220775DEEA311EFAE9B8.2403.672660441.760",
        "C_3E2F13A021D0850DA50BCD140A9F1AEF8BFEE1F533F4B83B67156601A0B1C84E",
        ",0$ 8",
        "CD_AEF4BCAFA3CEE844FC32B54865C308E2A65BDF0B3637732FB1712E3C76E4A368.1203.3882397673.1857",
        "Policy Setting",
        "CD_16D6E45D9DC3C2448BBB5DF12E5A17B75BBAD53607DFAC1CCE27C411AB0AEA61.126.2017731812.1436",
        "C_6147F993AF256833A5576FFB2C6527B32DD0A80720419520043AEAC80AA92F51",
        "C_2095EEA1CCD8C1CFEEBDA5FC6FC84B8ED7715409578D2FABD172B27E3EA581F9",
        "IL_25571D9908561A792D2F025988DBC70E1069F47EFE7D2616FB603CC74329F006.2723.1441340093.287",
        "I_2A150544FBBB76484A8148DF5C6E123C9CD69276BE55D6BEDB1E3BC77F0ABCD3.2603.3134352859.264",
        "NameActive",
        "IL_07518836069F28661B2BDE63EA95AFE81F3822D4677A49CBAE5F594ED13FEBAF.1147.1898380277.285",
        "IL_77AA21E117B27175491ED8F5119E7B5E6B5FBBA733549F12E2357A163363B480.2718.231678321.279",
        "I_2EB727B695E7BDF9788B469B281CD94061E2224BEB57815D05B9244E308106A6.2694.2393515164.267",
        "Continue With Next Job",
        "CR_FCBAF5A1255D45B1176570C0B63AA60199749700C79A11D5811D54A83A1F4EFD",
        "CD_9F6D9AEF44C6D6D731582B47CFA9BC650A236C1F46BF8FBD13E2443B7BC5F904.1344.458306031.587",
        "CD_E87C6D1DF020D21117D566D92C9BF8737A877FA32E48AC715BE7C467C0845954.2580.1050679508.1466",
        "I_8B135916A7D126EE8FCD7F8E7AB4C2A214B51FEBE767392567D6060C207CFAA1.2717.2492328047.281",
        "I_3096353BE616257278E75A17E3CC131AA8CD6F780948A369786166B033A50ABF.2703.1348667348.287",
        "CD_5EBC0509B184E537F175AB2001B7D3B1122250BA7C4FD6F1A0F9BCCB6CB0EF76.2536.1933320852.558",
        "CD_F0FFD49170849459EF1E56EC96E25B839FBB919B41D88FE54D6EA0BA45C84F18.2606.437559942.115",
        "CD_9F13C5A432B6292E5BCBF6D4FA65154CF0D5CDBEC6C0D20732479F8D80A97555.2637.3538494820.372",
        "Timestamp of the event log",
        "CR_1F25AAFC1DFD302234A597D09198F965D3DA468B1863CE8D32B13C0CE151009D",
        "C_B9845544951A3B035DE4DE7FD4E415EC9B667E42A6D89461752D201AF24E4FC6",
        "CD_ADD63404B54D72293E84E37338B556310E9392076D5D8A2C41D64BECC71833D5.2550.4005777613.520",
        "C_329C7091D99134315D75F4D3A2328F98C961B173B884F03A89824A063291C3C4",
        "CD_057DBED191A93075F16FF3FD87CBC67F17C999F14E2DB4CC2AED9F24BB4E2107.92.1826583910.627",
        "RecordLog",
        "IR_098D2BC6F12E73776192C2458399FA507AEC03E53B212D94397DDD13D12328E0",
        "IL_1783899442EF78D0F328C4F66255C049430186458D7A954FB1E0A7102EFA7079.2688.2084836354.273",
        "I_F60EB53436D6291A5CA381CCEC704B4F119A4D095DBB7398C4E6AC1D85D5A994.2764.1761812823.268",
        "C_8ECE7C7C47CF43406FD76752B14AB6773AC6A469FE0CCF9D82803F9A9B14C786",
        "C_A1FA642616E07036085EF84F710036D00B5AABB5B7AF69C0A4DCF1DE76D3E553",
        "CD_4C11DEAF7A8558F3989E0E42F67497A3DF8A0B97EC73A206C1E9955B630EFD68.2118.1233035055.624",
        "CD_3F71F51676E0E4D666CAF1EBCB8834168AA41A1C9D4D74E4D596C66D86A39AA9.201.270970962.878",
        "C_821FCC238F627B3C78AF6F9EAC85DA5F86FE1B2A0EA8142CAF6057765FD44631",
        "IL_9EF38E04076AFC6B1BE30A9AC99F95011E1B7B88354BDF3BAFE630856D6A17E1.2701.3865761939.289",
        "R_BAF75302566D567EA01CB2EED45B5C1B4A6B65E2564A45EE8181990FD5703235",
        "CD_5EFCF904257809CCEBA12F2D16BCA7E033314FD809E788777A1CF4664A6A2689.1192.3822896050.602",
        "CR_9F25211DB7D04527A2718EFAB934C1664FA38400093282D5A337A37681C23242",
        "CD_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416.104.489271717.567",
        "CD_4681EF836838586C3156B7A3DCE97C81840063EE41095E9248EEE4435A659C5F.2489.568621232.1965",
        "Indicates if the item was created while working offline.",
        "CD_1BA3904BE59BF13076F67B68478754255F37AB77B70CB1F11C34B96A27231EAE.313.3329796835.342",
        "IL_E08FBBA6E042339D13F187E0CA81C8ACFCF8DE7F5098B93A7D8812374DEB0F62.2691.419273231.270",
        "CD_3BBF6D4F66D3DF1398ED81700FAB6C7981988924128EF9F6E933D2D4C1E103E9.2568.541045046.536",
        "CR_122152BC995251C3FCF68650245D240F361D06B5F08943C45B791533ECBA25B4",
        "C_62523CD9347FEC90C4D769CB3F74810C750EEB7D6102ABE0F8A3924C1484C14F",
        "GPO ID",
        "CD_4D409582B9E7F83CB63AE537576DCB0EE80F099F2DB087CD2C4B26E6A30448E2.1334.2809288392.2155",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.2567028959.368",
        "I_428F05E4B03853C84BBEFA8A1D4314B3CF989D06DEC7F7D2BA2DB4C3CA876FF9.2714.1202561926.299",
        "CD_C715276855681875EAD9B4C27918B77F2C51A90901FA2466AA1F9D875F93EC5D.2040.1438462020.583",
        "IL_A1510C6BB269195E4C4132E154A1A13BA6F6D857198BE9112475CFA673DCB04C.2727.75805707.278",
        "CD_60F176EC0AF17AB7C6FC2843157E8D086806E5F0522F8004584440762F45B2A7.2403.937599909.693",
        "CD_759160644DC63F3466AD1F94F864CCEF928FCBB42CC94A976BE157D734014BE8.2624.3954010868.510",
        "C_B4352AE5BAF16E9168697F87BE74E2D35A37557397C95E650D63E6588187DC82",
        "CD_4FC7350D0697D65B1585376855E9596964780B95A8CAA540BF3CC2CD97C19696.1222.3525699389.335",
        "CD_2B0CB21E4574B83D661A7C62AD7BF3133DF3FBA914EA55D3A45DC4A7214DD006.1700.3243377670.359",
        "C_7C2448C779B501004A8AC92BAE296EF71C889D4A4797C480FE572242B6C55673",
        "IL_C4A452EED7EF196AD95D8FC96148D07FF507095EFA65D3A90AF421C2D1053E67.2702.446487375.290",
        "C_F5724025314AF2191A5ACDDDAEBDC7BAD281D1F316129FF85CF79A35F3D586DF",
        "I_84DAE394D72EEC44948504C5752A6FB488C2F34AF0DDE614A4D6BA8E4EF41579.1151.76143916.266",
        "C_C17ED95D6E5740D010C5F626BCBA6BA13C3D25FCD60EFCFD20048944A39B3D79",
        "R_7B2F35FE020C015C27E5303A73A6689342638C22D1969B462A84B8B90501905F.1105.3553415097.564",
        "C_8D438C565310E95809DBB3581FC76968BAB1801A4D1A32B498FF8D19BC26268D",
        "C_EF449CE69828797E16ABEAB272BB63851199331E1B3809DFFF02FC6CB2F0B417",
        "IL_97E92C3F71297B1EB2782D24AE0369226083C76FAF4378DC734B43C15D8FEF6C.2687.40764424.275",
        "CD_A69E6356161425C607A95D0BEE4B01A3CB60EF906822BEC375F551028A8A52E8.2544.978362380.736",
        "C_197AC7D184C8FB7AE4353D80B67A53A62AFB8962E788E6E6756C5B11036C7B44",
        "Operation was successful ",
        "A copy of the 'previous' instance whose change generated the Indication. PreviousInstance contains 'older' values of an instance's properties (as compared to SourceInstance), selected by the IndicationFilter's Query.",
        "CD_76EDEC3083FF868BB73CC3D9FF8C4C1459B539DB853C36A4B53FDED1A9C389BB.261.1.12462",
        "CD_22E55A76AF91714908793A9D6F196391BDBB704CE7B4C27172941A36699A38A0.1450.1.39580",
        "C_CE2D741F2F76D8B2DEF2CE5F7AFEC89E6175D7B4F954957AFC4C2CCF01EA7DB4",
        "C_3983F17F5C72021A2F47538559532CA9764ABCC7F5CEB4E220AD932FDEC0C98C",
        "C_64871D54F6D14BAF727492950051A7415055C7E730517B11F0B0AC9AABD72A57",
        "C_311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1355.1261870644.180",
        "CD_C3440650E548BFF63B5539FA293CA94632CF3A6097074784DC3E6A84D3E44079.314.894106404.337",
        "NTSC 433",
        "CD_5C6828A3364FB35ACCB00567C7BCB4FAA9D96E7DAA4FEE16FD257A946F33EA50.150.2297980741.1199",
        "CIM::Policy",
        "IL_0AE940523E9149F8DCB37899955FEB1D727C7276BE5EB071A1500D0D93DDE082.2679.2356854199.275",
        "I_BA0A62B9B252B8DF15D9E586D8D36A00E214D826B2BD41C8DD9DDC772381781C.1148.2517947688.342",
        "C_34069A8F0B605CD9C68FBE546D59E0558CACF01AED052259604DFBDF9878FC93",
        "CD_9B2F150615D5CEBF9CA60938A935C312A66EEB48D0E73B55EAB7F994DCD0BBB4.2653.1795429633.710",
        "CD_E73791EBD8A2A4E4F92906978CDB7151C51B74DF4CCCD1257A0E79377B27F049.2553.3851012603.1620",
        "CD_5DCEADFA575A67B8870603880BD491602DCD3BD7BDE6B9896E3244EBC7BD1866.315.2817653633.581",
        "R_B4ED6CD6BB039C8A40404514D33A068C19B058FAE7508C9C445CEEFE558E436D",
        "CD_E6CDEC66D704E11F45B0F0D82E7A048CB93CA008B57E83A2372C128C06C6ABCD.2378.1964388375.6221",
        "CD_7DB76B3DD456363F496D78BB6E6B5352F812D97AF3EFBED78BEB66F92C943C4B.16.1823649388.367",
        "CD_156B8A4042E45863463CBEA7606B8486296C5FD66B55B4AAA7739008B570D8EB.1104.613482531.518",
        "C_AD19852B659F95D5A51E327D83B06F4CFE38AB7F7821BA9B06B5184C781CDC4D",
        "IL_FCE386D97BD4F6A3C4D5F94E039D3AB7CC960290258A1383A2314D5C05FF8D10.2691.3819820740.270",
        "CR_5243094142BFF50E230A225F471ECAE0DCF0FC00D9021F08F10118DC4E9AD84C",
        "I_D980EB9E5642F0999DC4AB724E6D1AB5BD3BF32EB2B6ED1230F2BCEF6E536E10.1019.3058486171.300",
        "IR_3040C92D4D1C9502DF63374E427875FB5F024B0D5B541BAF38EE58053D345D20",
        "C_0454DDDA9AB999B5E05A2F468BA888F0D0794E6BA1EBDCCF2A4463EC03258CC6",
        "CD_E7B3BF5CA85CDF3ABB8EF64431ED7D1A67B9FD70D9D851344D21F9BEA7F92B3E.1951.3147006768.620",
        "IL_1E28BD5B5EC9698EF3EF715EFDD1FE4C5EF5FE3E26E02CD0A9EE265CC7C2D50D.2725.1420763722.293",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2750.2844578257.348",
        "I_3D096813E2EDB450D08B33432EB128E3CBE44A3FBCE6E2307B21EB677701178C.2697.533441832.264",
        "CD_DF597A1A2BAD4809466E7A636A80CAB8A01D7F4907CEA5AC6B1078FB23BB559B.2164.2335535025.328",
        "WNFPublish",
        "CD_F32492DA8D1952EDCCAB707AFA3F69E046829AB6D46D4B2279EAC5E6BCBBB3FB.256.1.10538",
        "I_99CCAE1040A6F30415BC5EAC84D071356A8461C5B06669DF71A62A91A8F3D6B4.2735.3208427087.273",
        "KI_4FD2270AA7CC321848B51530B7A77A9E39B5486B55CE0C09A2B597A1F1FCE1E6",
        "C_6EE562F9CE34E3BB818812CE4284F5CF1EB787E76D4B158EA1D7F5687A628C0F",
        "CD_6EE562F9CE34E3BB818812CE4284F5CF1EB787E76D4B158EA1D7F5687A628C0F.2465.1964536613.2373",
        "IL_5DDBF2CDD6543FCB86DF3357AC66F2164A031E7F1DD6567B28D373330EC9BDA2.2682.984040182.291",
        "C_FD21BC8E1DC58C57FAB927138617C0437B0BFAD6702439A97F4F168631CA48B1",
        "I_681927C62E79E8B0A6FD008BA8315BC81525548D98471AA54E87E66CA8F6ADED.2722.2801581974.287",
        "C_44EA48F1447554EE6A5F1B2B75B3D13F8D9F6E269F5EA85D941FE91968D91A16",
        "CD_B7D694BD6E54C6C257A930A7AC179613D232B4C4655931D3353EFDA5D04618F9.1241.187348692.820",
        "R_153A90D31DAA2BB98D107166F8216FEE25A312878D4AECBB89966D3EAC52B5F6",
        "IL_7E6A00AAB8467A7129258A087A168DE70442F1968001FDE8C28653B84A0C1849.1783.2922899065.257",
        "IL_D02D90925472D1FB8327DFEA372E4A36DCE60A11BEDCF9147E6315F61B4ED759.2726.195161938.281",
        "CD_D9ACC786040BEB03B0BFA580026B159E4F14D3F3DA042378A3F7A6904DFD7A2B.2618.1867590143.1700",
        "CD_D2E1F5EB4F84E0C0B2E61F3513674DF2B7151098EA22604925123769286041D2.1149.4099257968.463",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.1153235212.368",
        "CD_D93383F051CF2C999A0FC0254121E096274608DFBA24CD421A9ABB46E7A53319.68.595917726.632",
        "R_3447964AD4B51A40682639E2C45B8A122022C3FEC3E3B3FE7276444680D9A4BB",
        "C_A58EC39ED92649A90AED1FFF5AE4D021DDCC83A8D429CDB678D3D29879253FD3",
        "PrimaryOwnerContact",
        "IL_2368358296D3DA2AC5F13C1802E3BA26ACD82B7A72CA620809592C5CBB23F883.2688.4092771976.266",
        "CD_AA9C61DD6F708369D775774E2B0242CC044244C6152DD57BFFA159C58FB426FA.2622.1554087127.1793",
        "9F401B975F6F8DA62C223",
        "NS_CCC29D03D4E6FBE5C7F923DA21C7394564CE2AFFEE4FB60EA024B63A53FECA72",
        "CD_8E00C05F9C7AF889450AC5E1CAD304CFC7B180A1B25B24C78DB3783F494A027B.2734.1633006485.1193",
        "I_1DD0636463BEBEFDAD7DF06C3E438379DC37186F6C024609079E5B87928695EE.2706.4004410529.297",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2020.2776175683.368",
        "IL_F4C141EF54CBABD5685CF26F77105864507DE5B5D5FD07984D472381A8A94C0C.2709.3388265455.286",
        "CD_C0A77ED799B7351F2E397137E839919102D123FCD7350D8EF328ED8645D917E5.2593.2484027907.223",
        "C_5E26522E72CD626FE622D6939EEBC8B063B5698BADD88171A20ABE64FE2C3B02",
        "CR_8CFEA92C5E4C9F8DC3D0C728FF03B8DD4C940C51F3D7E77FB19C8CA135C2FE6F",
        "RSOP_ExtensionEventSource.id=\"{1256F140-6095-4722-A2C4-B5E3D47F1690}\"",
        "CD_9CF59D58FAC9A98A4A3EA953B45548B5589438D2DAFC7788C3503F11F40E4CA5.2587.2032476575.863",
        "CD_F27728D32A3636F45280AD3F71C73821FAB17D765ED15BCD09B89B7007E5475A.74.4278201750.667",
        "I@5VX",
        "IL_442676A0C1F4DC308F6C2B7D1BABADB3209DD2A9B0D3DDD17987CC3AD80CCBE1.2691.985760022.273",
        "IL_173DA5A6BBA120BFA1F003499F1CA5518076940AFB7C35F9074818D37BC225BF.2736.1052150205.274",
        "IL_41AB94F35F1A9484D598308CC85AC16F1E3D0452456DE3794A2343CCACD11DDD.2626.2391607354.272",
        "I_6410C0A37918C7B8F4A9286D7CA70C520DA5E83691A1C812FA90C1384352799E.2697.2881464094.263",
        "IL_7D969FE3038908C46C5ABAF75E782DE74226F0709C9770A525030087CC21D418.2681.3992222235.275",
        "C_1F1EA86E0738F564A4BAE50B2508172878C88623AEBE218CE1455E5B6B0990AB",
        "IL_757F5C630DCED3753F8E1E30E85653C98EA7F0D2F00764B048366DB24E4AE08E.2683.3887394605.275",
        "WINCE",
        "CR_EE35AEE540BCEDF1393FC978093FBF16399E5CE3BB4E7B096885CF94D130CD38",
        "IL_340CBE78ECDC147CC0D8E08D25E28D5812DD352A6020A7847860B23A3D747C84.266.2545556400.294",
        "AMENDMENT",
        "0x00000800",
        "CR_3433832E25334061F01C0641448819BF2A3230BFACAEB03FAC6E5BFD4E772DA0",
        "CD_7C256082C028FC113E44225862F56FE496A6FB4D4EE2AD50DD39EB6DF6A574DF.1528.2101419478.2192",
        "CD_9EA1914F1B3969D0904DC11AB6E8C7BAC75F195080FB4370BDA5C6102822240F.2225.1871869292.466",
        "I_C9323E261C8577542F978545E924307FDE0B29889C1A9D51F66630696142C9C5.2693.3124001651.265",
        "KI_CE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0",
        "C_AF3D854FF025C11AE0CB78C559DC0BD55EB8A356EAE34913761A09B3CF6B045E",
        "Number of ACPI processor idle states supported by the platform",
        "C_A8F083634F7BEB2D8EFE48AF75FCBDCB76893C654FD99D7F0E74A43B54E530E2",
        "CD_BFE8824DD38CFCF8E5C18FD190F5AFD951CFCCBCFCAC142E912A160B869182BC.1188.332352611.503",
        "CD_1A826788D5CB396EF46883163CDFF0FAFFB8ED9B8BC20D60D3B7762CBFBD2C44.91.3587023940.625",
        "I_DE5DED6D07DECF0472341E41FE3D169DEEC3429C779AFE73487ED140FBB6B7C7.2714.2909007524.305",
        "CD_9ED4C67E3712DE07C86D1861FC69841608A536EC7A7415988B2BEFAFF875D077.2759.2429578711.363",
        "C_B02DDA61DB0037C986F5337E33ABDD70E15678DC49B7560A8C701C26B9D13251",
        "I_F2EE10607F13DDC2BBEA7C095910DBF7A4196F542C5CB491FE93F3A880351E16.2703.2206139252.287",
        "IL_6DD34E7238542990DA569D84FA721E85E6B9B1018BD449122353F55EEA401EAF.2704.3077023596.281",
        "I_7D195790BD4C419F05DBAF92E7A7A810E7672BE3763E9D07715D999176F339D8.2697.1769784366.276",
        "ReassemblyLimit",
        "IR_BA0A62B9B252B8DF15D9E586D8D36A00E214D826B2BD41C8DD9DDC772381781C",
        "CD_3C0F796244DFD96C7B5E800FBA3681576ACEE35F389BAAEBD707BBA1A2C07ADE.2070.2524344538.169",
        "0x00000002 - Console.  All interaction directed to console. ",
        "C_21F45FDE5CB0D8A9E63EE52BCBC43E2AAAE1308BD552214731725278E86346E6",
        "IL_C00914885257A59D087BF17CF6D92E3E0CE6FF4AA6EA44EB35243AB7C1D41EFE.1931.2798519993.320",
        "C_FB169B858D615D75D1CBD0091651D06C44C4A6BEF87F764B832ECE1406D95CDE",
        "Win32_TSPublishedApplicationList",
        "CD_E60EF1B207B541A3969FE52605168C53DE4EA7E5A1D37600D0478D235286E6BE.2225.752760191.951",
        "R_9B6218EFA94C067C7A0C80C5056C3D58C66F39DA9385FB7012B7F51EB8C27ACA",
        "CD_7982F1017538FCA639874841D68FAD4E24866671A5CDE2C6CB4C169C859203D9.10.798620949.251",
        "IL_240BF642EEB2D24F74A6C1C5D0983A9FEE0C7193926FAC8056ED582EFB04FB00.2700.584287826.275",
        "C_C1E785065FF2200D3B3B1E2B57CCCD85E5FF27AD2E1A1DDD0FF7C216FAC54966",
        "I_0F33828E8CD7660C131A9B819C3D5A577748424BC8568964D9428FE644F6572B.2707.3821872533.284",
        "IL_78B6F38D069EF7E1419A54226868D93B0F8715683284BA9C0F9C5AE33B7A0F47.1015.2915752813.282",
        "Bad argument ",
        "I_1302BC33D2CC0B7398266EFA48293A54977795ADEE83F81DC208486EEB94307D.2689.3630002167.263",
        "C_BDACCDF30E4365DB12FF650DE68D87624BA9FF4BAC19F700279002C19BEDBAFF",
        "C_68F60BCE5ED1CEFD06D072F2C79847AF4A3C52BA9A8E9F51041AA990EA82C70E",
        "#'+/37w;?r",
        "C_2F1391EEA94D4D7024BFE5FA53A12470ACFEB3E1715FE776C6E0FCCB952C60E7",
        "IPAddressV4",
        "I_0CD345CD328C12E181201A1AF5FC238E8C7063787A2C0D3BB8A0184594786F96.2721.1704865656.279",
        "R_43B35DA4EAEBC0284206ADBC4132DA71EB8556E731586CFE46B5A658E2C2F498",
        "CR_9596A53E85F3F0D633D696BB9EA3E48E9EAB2B18CDA373E2DEE09E41AF442CA6",
        "CR_BE3C9A0F3A301859A6C844B2145A4F44B9BD768BEE695F45C60A8F416A0E9077",
        "CD_8D313BA715C6E6DAA1BFFDA728F33F642CD2C0D480FDF81C6ED87298338EF1E4.2573.2170310235.795",
        "I_6958F049D8AE3BF88427AEF88FD43358D91B32EE71F581203C3F847A84813901.2681.3155126044.284",
        "I_83D5E6F80CF85C411B5ECAF0B1D72053419B8C2E555CC28C05F9EB41C64B647A.2722.4176674305.268",
        "CD_77180C0DD5EEAD25C8B37709B95F5C0C1CEF9AAD0FBF890C140A18A25D2F2525.1935.4257726409.1705",
        "IL_F20A17854D196E5F5EAFB2F68B5391393593509411BC3D5F3DE70A824F1D4E22.2504.998400869.326",
        "IL_CEAD552E2AE5FCD4C0CBC67C638CC88717910D81178C5CD70B0A399716A9D84C.2680.725799826.290",
        "InstanceName",
        "IL_DE9AF71A2E4B1D02150A7D2BD0501E5D0536591C69AB2B5C8597953089B63892.2678.2345208460.279",
        "27977608_1000",
        "IL_197FE2781AD290D79D54CDED2A2907BAC7900D803508924C3B3FDF97526325F4.2694.3554915579.265",
        "IL_531AD7252F13C937D05139940B5914F81F6E4E6063DE24DFAB1C3109164C7352.2722.3056209734.277",
        "CR_FAA87DA9696C5DDA8779735D0CDD82F772B3863DFCBC34954A3E6021F405A249",
        "IR_EB8665A808B44B1EC684D558DCE4736DB3B63938754369F4C2483F918071F26C",
        "Not Supported",
        "CD_CDB424FE67340CCC2621376F2156DC346548CA8F3622EA235EAF7BC515A8CBC2.314.224804471.226",
        "CD_BC8304297DAEA08EF836B71DA253942E5C6B510805DB5280CDD11086EF113EFB.1149.4169456742.236",
        "CD_CE60FD48B8554305653B63F3FF89DE9F487AA367010DE6A864E4D5A7550F953A.2109.3474982620.3127",
        "CD_F4127176F1A46570141C18E1E1865CF6B68B9CF63BEEBB46409414612F2C6395.1923.2348377157.303",
        "CR_943386A936885D346F0D61FA24D7BB2533B7B797B4E446178A40D4E6F2C1683A",
        "IL_F461AA66D8B7B7D281791B03410E52860C27B31270AE3EE90F1659A118058546.388.1.47882",
        "CD_C4C4AC3CDD7A9E38A340BB56FE91B2D1BB13CEAA14A840B9C15B1953B57A1EE9.12.1389909274.750",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1085.615373410.180",
        "C_67A1B3C9E888999A376BF0D2860E1A2126F2751ED4812118CBBE4C62C8E3AB0F",
        "Read Warning",
        "I_1DD4224855CD47B7DCE45D2885AA6BE67CB0E54B6C1DED5463F46D73F7AA3E59.2692.1212126100.259",
        "CD_6119709D50505721012C3E070D3A27B989925B6DA18791E194C0502824847725.1187.3200888565.387",
        "C_73859BDECC6E59555AB103C0DF5302F8942C19E249A9E48DB616B611E1AA3893",
        "pXl|$(xt",
        "I_E5CEF6CD651CD4903C707AAD1983A88B64E967128AF69B3D31D4AD560BEC45A5.2705.2905088871.293",
        "CD_97E0533A6FD37D7B4F42C138D3F910EF7AFF6D78F1A820A11C33EF12521B5B2B.1304.1.47088",
        "The byte offset of this extent from the start of the virtual disk.",
        "EventVersion",
        "IL_84131F9A32B4874C0583828C0E1077E64824915D221A9E51CEF50EEB612107B8.2699.739019603.266",
        "Padding indicates the number of bytes inserted between blocks on a tape Media.",
        "CD_05A2F7DA01784E24AEC74AE25AC1E45FCCF48AC863629F5475D0E862F884FF9F.2643.2835865452.823",
        "C_B5A3125475EC1999F845D9B1427844DB11B8F89FA6DCA7DE9440334DF7CE477E",
        "C_9E184B0D1F692A8FC81688E709FDB961CA1DFCCD6CB6126E1E7994D280B1E898",
        "r #'+/37:>BFJ",
        "CD_7C97DB83528DB0DCCA024135D74FFAAEB94DE3136E4FAB4F9307AAD2022D7B26.2601.730923476.1530",
        "C_68B50ADFA4EADE3DE4E3425660F192D734ACA76704D8243D430424BFC5680E0C",
        "CD_7791A711A5B5A7519657E417C7257B17DC36A8205BDFFFE1C1C88B07496AA0E5.53.1.10693",
        "CD_3DA09466BD5D17A4FE0B633E962F9D4150B210137F89EB9BBF5F24EDF1B00135.1846.1.18274",
        "$x(,0",
        "CD_0750888F7DA336796CAD46D09BBCA6EE8FE708CB3E6A5972E9507072892D3743.2623.3928339205.219",
        "IR_26A8A21DF89D1FC7CB08CD7898DEF4B5BF45DA1A28ABDE9B3244E0539D59DEDE",
        "I_AA899FD0C3F4EE4BA32282847A8D6EF726723A11F0468E9F2CB0DA8A4C07ADCC.2705.2397306402.291",
        "CD_4AC7D53B353FF907A3871574884AE20E2C77DD82D160B77856929A17F6C699D4.1205.2742897983.362",
        "CD_B1D75A909E6CF2DABA2DE9D5B0D2A805DDF2E38027D332B19EBFB8BA7F770899.71.1863216342.2135",
        "CD_BC381B81B90336F98B1808B59D5F1A4026258C030F7F90F1CC12FB4A44D72477.2628.1371884188.506",
        "C_E4EBFEE191211D0CB9EEC30A93A853003343DA9E1479B64383841F499755E77A",
        "CD_094555A29C724CB99AD80F8257BA7ACBF3FB68F96D97E3E687892E1586B8D179.139.3995166526.663",
        "IL_1995796D46FBBADF683F188A8F5B6786F1CAF6B7267EB99233EACBA15CA2FEFE.2694.580754448.279",
        "C_E19750357E2A13069554F30160B51C803652B034BFB8C93284F4D3A5B6AB9DA3",
        "NS_511626FAE4F57DBD20DF5CD44A41DAECED28CF7B3FD8B12012C7F4B58F44E665",
        "object:MSNdis_CountedString",
        "R_027708FDC4F21C8AE43624362617A067ABEAE7FC96FE6B2F6BAB070555EAA6F0",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.139.1256933423.180",
        "CD_EDDF316486234851D86580CFE9B06D5A43E06F671105861787434F12D58AD4EC.2763.418292523.623",
        "I_A258CF02BEF223BFAB6BA5CFC7CC4706C5194DF3E20F2157447169D2255E897B.2712.3087737123.300",
        "CD_70E019181198CB42C1737293D79C34B6386D677E681DFCF2E02DF64B188202F0.1949.3003050712.2087",
        "IL_FE19C9DDAC04ED4249E80EBD5050641EA1081DDF5329EB1A51379B4777705FDD.2417.1583772651.332",
        "76921998798468D8EFB51691DF5718F6940847EED18DB5BE23F1BC9D2E5D09.1189.1260271262.632",
        "I_0B5AC83FB2725D33B41CFF3B51EF33467B960FD4E7B54F055ED580C64C086270.100.2571236503.268",
        "IL_629C5244396AAA6AE24894FA9A4A212739458627A2BB41CE139C1105ABB1FDC0.2723.3809758341.301",
        "IL_77A9A19F9CA0E466966766C9A77200AECD2A762D960D5E97AB1D526824AE69EF.2757.2501718590.265",
        "TP_V2_TimerCancelled",
        "CD_54FD8049B00C834D5B43ABB9E3C88851310B1C9A3D5D62073ABF12B543C311F3.75.1119298250.240",
        "C_649A96A7525C03C672BD4CABDF65BD579104DAE8BCF03213836A9B50A7DFDB15",
        "IL_8620435B38BE1E99E74C0209777119091A237CDBD9A1C0FEF68B28339128BA61.2521.606677117.342",
        "DomainPortWWN",
        "$xQN'~BEH<{",
        "C_5243094142BFF50E230A225F471ECAE0DCF0FC00D9021F08F10118DC4E9AD84C",
        "I_C7BED1CCC8E3279B70E4846D9154BA63003D9E227AE14E0590492F865356BD94.1499.2854629194.270",
        "C_3196586F94E9CFEA6D912774CB2A6C6FDB2471424853F54D4C0F4EE4F94880DF",
        "{7969ba4d-dd80-4bc7-b3e6-68043997e519}",
        "NS_EA3097416692F8FC803A1F4692E60E87151AD44E2791A9FD501A502D88A4093A",
        "C_0B714A230756027CB9D944F3C101E5485E82B469361846E74358E5EEBA5C05B7",
        "CD_2B0CB21E4574B83D661A7C62AD7BF3133DF3FBA914EA55D3A45DC4A7214DD006.1836.885597706.435",
        "CR_7E68D046DB13BCE41C3337B31F82C6F35EBC386E53A1006A94CDF711AEF82870",
        "CR_13F8CBA3C82C56751066C09B89C76BE6E4E2E2A1DB6E05D411BC404F24CF967F",
        "| $(,048<@xDtHLPTX\\`dhlp",
        "CR_6762A6236B4D2CB4C3C4CAFCF2156B752A35D34287DC36F6247727EF542AA084",
        "IL_E1EAB736DF81BC8E670920B2CE9D6569872B38D69DA44CE88EBDB5463BE3F426.2720.3093271709.293",
        "I_02BE0D0F4383EA07C00615531BF67EAFD4EDE92AB28CE4D74EBD94EDB757160D.2702.3253260769.296",
        "CD_1990BA6B868083E5BDD438C1C9438F9F7D36FE1A112C7FDBF6648416023E84DA.283.2177957471.997",
        "IL_2FDCD537A8B7A50CD1D6083D52F18663AE4AE9EB2AA1DB025B14EA9525C5F389.1014.2592147053.307",
        "C_FAE72FC32B483E3ABA437AEAC24AF6CB9EE1B66A400EC68CDEA30069E7A8A2A0",
        "CD_F2F304BEF42556C432C5A7D1B6A2CB5F5A5034C33F73E5E8567E46282BF32B4E.1595.2250501703.506",
        "CI_A0108CE261D6CD70D350F5B72F2E9874AE6E004D3029015B0919B1BD326BB649",
        "        <assemblyIdentity name=\"_\" version=\"1.0.0.0\"></assemblyIdentity>",
        "CR_AA429B70C768974D13BFCC6D4D962AE6C7D2E46A2B24E5B0ABDECE10F90FE8E6",
        "R_DEFA254B5111B4FA7ADCAE8857BF29A2E7FD1456026F7A024C9658EE7DB22400.1781.1619915233.580",
        "CD_272E5753DC3EECDD6057038DB6F26170E7D1CD565B954C6C4A406CB1BC2D023E.1079.2321735830.323",
        "CD_1F1219F96576A4588331D02100737379E76B59AFFFE01B2EACFBBB0DBCD4C75C.1714.2403629231.436",
        "C_527E06AE9ED45572524985C48E4812D5807B4FF3D509658D30652F5A852DD578",
        "CD_96A5470A9748A5F228C216657A9DE5F01BB3D899482629507545192083B50D88.1925.4241078609.279",
        "CR_243302F4ED326C4625A4CBD70133A669B2EF782BDD805336E89C6CF9975728E8",
        "C_D4639B8A3A234C7C421B844825ADE1FE2360CB4CE746D79998FBB9573B4B4A5C",
        "CD_F8950447585CD6743131FC688F3AC5EE4D2DE57B4CA01C83E91AB8FD7ED70E93.1667.2297125398.268",
        "I_F3B112B202A2190E1B5B0BCCE56BB6B60FE7D55DF5AC265F06D09C0F840B92AB.2688.3231167761.274",
        "IL_674D91721DBB80B993698A04EB424D75B547784E615A0FE3D6B08FC38B4729DA.2726.1607930134.290",
        "CD_7F37FED1C026EDCE926CB499855DB24934E3ECD34B906BCF0F300E633AFADD55.1758.1092245992.217",
        "CD_82125485D5F16E1009D3E6E30832E080E69D894F4C7422BB7A4A96AB3D5314BD.2597.2285959071.646",
        "CD_6862B6F533E21D68E1D23D0712A1C13DE999D91F14704477263EFE22A55CE495.2573.371737832.801",
        "CD_69682A3F4E660CE94CF4FDF3F99EE5C0DEEAC14F4AC4474928CFB8FDF1B19380.2041.2912353550.4659",
        "A positive or negative integer used in conjunction with RunDay to indicate the day of the week on which the Job is processed. RunDayOfWeek is set to 0 to indicate an exact day of the month, such as March 1. A positive integer (representing Sunday, Monday, ..., Saturday) means that the day of week is found on or after the specified RunDay. A negative integer (representing -Sunday, -Monday, ..., -Saturday) means that the day of week is found on or BEFORE the RunDay.",
        "C_D63B2E428B324CE42216B4AC30F80D2A5C018A79E096B20541D71F81E50F1ADF",
        "CD_0954B67BE64513B4D9B9F714CAF4BD4F81866B122780FFA4FF13B48AEC697DF0.264.1703675536.1352",
        "CD_8B17286CE20B53B60A53F0F3419E02C6D6F55BAEB70C0211CE95ACABF0B90BC4.1545.548879870.951",
        "C_201FE927724BFBB52451599DF95A1C7B68005C00C3BD7C951DA4C557AD4DA9BB",
        "C_9BBFA8C910BEB6D0D53CEEB430D18F841848C699BA0FF9BC9D7BC0530FBF0559",
        "C_361E83FEF391365986E94F2BBF4BD6326369726C0BCD78D3A3D70680E3E3C24D",
        "IL_E3CC77148E0B39520C5C44F2222ED6255D3DE8DFDC6AAD0E80078105F56CA20B.2674.728605399.271",
        "I_0FCD55CFA46AEEB52F53BA4A255EAD5AF6771EA55E53002CAC4E98AE74ADFB9C.2698.1659596386.275",
        "IL_C5A2F70461183E1D5A31AA11A355422FC0105D25F9A65821D9FEDEB7DBB0136F.2713.4193208116.294",
        "CD_3DF6C8A32B6DFD5082D03F7D9A331784CABA023B138F82AD0F1AF437E7F59DF0.2543.4140330655.606",
        "IL_C2E2D7F294A39E950FCB0FE91EB41D6C66630273B2EF4990C97F60DB582F2E17.1480.2071170959.317",
        "C_BE454F6C402AF8C16FC12197B80EB1F7ED1F22A86325293F4C71A4EEFC7BE40B",
        "CD_D900AA79F2E09113EB5CF87ED36150207AAB2E0DBF0F9D43086B26B7638809AF.1915.1588405438.295",
        "I_2331F35620F64382C23A766044CE4900AFD2E35F365E3D83D01B80A0B81790C1.2710.1480883202.289",
        "IL_04E9526EEB869D4C7BC87D82E1E940F2C1F8AF087E2883F393904958074840FA.2736.3445682780.293",
        "CD_76B92FF8B3AA20856691665FB718428ADC2A8F423D381B9A75A40096351B6F0B.1830.2241931150.7162",
        "CD_6F2EDFBE6222C2212C6DCE17E0A96AB75C4054C34F3E4779AA732E76185E808E.2576.60546507.590",
        "CD_9F13C5A432B6292E5BCBF6D4FA65154CF0D5CDBEC6C0D20732479F8D80A97555.2569.2262136826.288",
        "R_2E8EE9C6B4DD7F94AE324B90012C7E11969F5CDE356156FDEA2C39A33B2AA017.1617.1650307745.524",
        "I_CE1AB475306539B9E244C98908B04E7D335C952B0802573B7D36EFEB15743AA7.695.1.29172",
        "CD_8E3D9DE775219AEB41FA7BD5EDBE39725FD15E4E783E70F0941CCE144ABD6BC2.1020.3696851638.135",
        "I_A257EFCC363B87C1FEB359036E69B7F334B8ECF32469F03197B83AFA94D2F9FE.2706.902958567.283",
        "KI_D5472BB4000403F6D6CDB0F595804CE62C0D292549796526CA9E7773798E5F24",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1976.1119557561.180",
        "I_12B7B7D68053B4F79E27B6FA51D3C5955D5B39B70248BABBC3470DF12043572D.2683.1422670703.279",
        "C_0AD4DE64AD6766E900118148CD8470714DBEEA985A4EC80DD4AD11985B5223BF",
        "C_5613BC9F25CE44203106B76227B25ADA3DADE5F777054D3D589CEC059E3BEFAD",
        "NS_E8C4F9926E52E9240C37C4E59745CEB61A67A77C9F6692EA4295A97E0AF583C5",
        "(,04LH8<@D",
        "CD_71EAB4D274B62BE0548BF7FDDBAA028C0F0BB11297C86BCB4512412235E01F04.100.3509898719.442",
        "eo mode.",
        "52D7994E741AE80C7E8529557980E5.1564.2920737640.534",
        "CD_D57A35ED36C1BFA881E33DD1D96B9406375D7760056EA2A2CE40FA8EB184855B.1534.756032440.482",
        "IL_6A62672AACEA57C9A845CABCFD1E4FE73986B8CD9A6F66FFAA553BA275F4C58E.2699.544353267.270",
        "R_95151EBC7602F93A6E06460EF447E398F547B7CD3033E5B6ADD3848197B31384",
        "I_7D969FE3038908C46C5ABAF75E782DE74226F0709C9770A525030087CC21D418.2681.3992222235.275",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.2720839561.184",
        "IR_A149399DE5D286F444C4B111636DFBC68048E4FDC5152AA24ED98EA642F0ABAF",
        "CD_5B55CC60E350D260A8F85A1D6D077A9EC7EC36F61E7CF7459841A5E66A160FAF.2745.1530806952.357",
        "HNet_ConnectionProperties",
        "CD_798C4124D7D90A7F5EA5F56915A8B09A351FDAAAE449D9E1AAD82D024C9D7528.1539.3639152021.519",
        "CD_D5B792B23BC4AFF33F84619861154DB6F0B75D6C62833CE80A0CA636DA5E664B.0.2396170707.88",
        "I_49645A7E73D822346D709311ADBAC1C95851F17A85507279169A1C26AD7A76DF.923.1.104721",
        "!$'*v.26:~>BFJNRVZ^bfzjnr",
        "IL_DB657578748F36ADA2E7ECC2B787DFF0402D153B54ADDEEB72E0DE2A3B27152E.2709.1459812872.295",
        "I_774C0D3FB90D8C3708FCA060B0FD40C7A62E78F386D82A25E0A3213CB29DF03B.2697.2198964765.284",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1976.1119557561.180",
        "CD_CA5E03B6357EEF3C2F92CFD39219BA6C5D6285B9E53EBC324CA96967ADC89A91.2136.2180413532.880",
        "C_AC63429FE4716555DE1C78C4ABC52C6F5128C0FC3C7A7BBC67A237A382D5F3E5",
        "CD_1E13B2A6A26C0B91CF44A18D05250BDD9F1542236D3B9606359BA7D34FECE455.2645.1491238244.1030",
        "I_A963FF6A8458E9C4FEA354824C031F4237B8648981577F19FD6854C86994DA8C.1499.2362602321.331",
        "IL_AE846573D9FBAF73B25A4AB00FE51279DECE2FE4CF73D7586CF8A1B070ECF2C7.2703.1561996053.296",
        "CD_697DA7CFBF1A5367B42159FA584B6D6C58403D44C1543977ACD7BED9F2898E8B.1172.4166405448.226",
        "I_DC8C2893B74808E659A3694AE409588A118969D352C3E87A4B7F9C102C99E793.2679.815139356.286",
        "I_D526A21FD5D0FFB11FC248B0999BF183F70ECCC2D12B67966E7DFAEC1F8B21CB.2688.1109235405.273",
        "CR_FBFFFF984DA9B7029EE7078D02385B8FF23DEF8E12B59491A9BDEA2549806FA0",
        "CD_006AB7DFED58A8FB352581D21227922FA9FD887AC08F63A547BAEA9722B5F62B.94.622034228.810",
        "Win32_SecuritySettingAuditing",
        "CD_16B53E03546E9EFF1F249075B4FA58DB5F9FC819CCD55304DDB4EF78A2D0DC79.2653.1844847148.350",
        "CD_3C0F9FF380E6F9A5EF7C4A02EB445487886965C0BFB27D361EBE326C146C0648.2577.1797449268.835",
        "IL_DBE43902C1D97C6C3F9F5FB6B0775FB8806F63D427E93436E0965B70CE6B70EB.2716.452751123.278",
        "I_0B8645AAE8365A921E6AB402A97682BB4F516F905DBB8B814BF3EA695FB9FFF7.74.4270898279.352",
        "D5692A4BC}",
        "IR_3E78A37E1DE70357C353A15D6BBB8A17A1D31F8D501ED8F1C3EB8104F5B04F97",
        "C_8D031DD0CB1D97D890A5740097E55E48F1625CDB53BFD253DBA62D3E95BCF78C",
        "CD_4B3CC5F49167F6FB69E56B79BCD6431008E7D86DB966C05AB2DF4218DD0EABBE.107.1244508444.226",
        "nettcpip",
        "CD_43AD532E95E5D238ED8820543872B53F0ECF9646B749AD9BB6E4F2D3E320695E.121.2794588976.543",
        "I_52ACF7EA31FE51DFB6033D39218F9329238AF8BE0C84379186949A860333D2FB.2711.3345584353.292",
        "CD_AA1DD3640D7B2D57CFE7C2BEFC6486AE9A0D1C4F244663B25B67A3D81A74611F.1204.3474553274.1402",
        "SystemConfig",
        "I_0D0C408DA61D1D81B5295D02AF7B7B37B653E3A9A8C3EC1985E8DB9FFB9B3ECA.2709.3191107679.305",
        "R_99526796DD78031C7C2FAD6BF8D8F64825A2F3F58DED87A8E35BA27BB08D1659",
        "CD_80FC29E4245D9040B48B4CD2FA8E17BBE43284D1E036BE8B06A9EF2961F74550.2659.3284102230.1106",
        "C_9A1C938ACA675F962ECF2A2D496BBF16933C0F6F4FA335A59840FFDE0DC3612B",
        "CD_4B3CC5F49167F6FB69E56B79BCD6431008E7D86DB966C05AB2DF4218DD0EABBE.1481.1787599395.621",
        "CD_2F2AE0FB3032782CFC02A53ECB298C92CED59F438DE994CDC658EE55155A3AD8.2596.3653166630.309",
        "CR_9C46A759D30423AAF4F69D77D418152E94C7E20506D0B665994363777B2CCBC6",
        "C_3C9B280FE36066C71935582444208E7A035DCCE4FA30F0C0FD2BD6D3FC96AE2A",
        "ref:Win32_PowerPlan",
        "CD_3A281986D2DC73E5FFAF5C10E516D033611D0B81732C1211B5A9AB1B8BCF2D1D.1741.3218303423.610",
        "CR_4EB6D1B0651A9BCB05273D40A94D002733C3A80273FBEF6807ADDE10DBD5A05C",
        "The size of this extent in bytes.",
        "R_45999BE1E716B224CDC60BBAEC2E4A9422A7548870411AB5310F9D9DCF7A8F92",
        "CD_592D05C8B6862C9EBAB101DFDFC8706B44232EC87D176AEAC787159631899DED.2419.2160670576.359",
        "CD_AE5557242873CF979D93E87FECAB292ACCC2C01318E17F5504ADCAE7A065AF1F.2537.1044016784.630",
        "CD_C6322B6314CFF4E509A8264F41852433F9D38AD4057623ECC6D130FA2261F1CD.2644.3283044067.245",
        "IL_2E31AC6CC351BCC9BFA78493D8B97E49D4E7FFA3928279503F92FE6E22F6067E.2689.2236458503.276",
        "C_CD980EADF185372EE242A5AB60E992FCF69D3939F9209EEA837A4F7EE8E1AE0A",
        "I_4A5EC507EE2D38FBD32F8B716D161A648F3F58A8D6DDAA85B108A66095CFCC39.2691.4046279288.270",
        "CD_62E24D2113A63A9168766C2091AEA6BB0D5DCD627F35EF3E18E56D8C5BDF10A1.1054.2939305985.480",
        "IL_3E2E07ACB0B0FD08C5AC8969B0D25BD27F59A39A880D678674F36A838D31EEED.1014.1975740487.296",
        "CD_5E23632FA7BB1BF329A2928789D28708FB0B1FB5501D722BFDC5839EEC3CDB56.1071.445088198.213",
        "CD_520C6C258019D67D7AE1EE1496B8D93D4FD98E1A9CA11CE69862665A1CB25D4B.75.1773117769.472",
        "C_9EBA3A64353F235FA676D5A579FE650C8E0A1DAF053F4A2C836DEFA15E9FEE38",
        "CD_DEAAA05DB0E75460BE1047C5B84914B1289AD29D36D5088DA38B7120128DD367.1931.3573039731.325",
        "I_9731A66D417FDC024A9D93DAD0B38C4D96CBFD2BEC45E5FB4706D56140B553A0.11.3517407419.329",
        "CD_6FD9AC26FD9A05EE0C1C596653420C32E2FD09FC50F0C520FC62FF40EABF1948.1921.2071984098.299",
        "CD_49164C7AB89E7FE6DA81BECB881C8C4D65839FBBD034989674E74CAE234E85F7.254.357411054.581",
        "VerticalPolarityType",
        "I_F1CDDC8C4AAB83AFB4CEF129DBCDCFBFD3CFD4B7B0A3E038792E733F73599196.2697.1975835424.262",
        "IL_E5C6355DB89C2D0BA38D309F93C594B4514016C92E6D96D5153661EBF39CF9AD.2695.3386892871.273",
        "CR_7BC06DFC2CCE54A0D578DEA59EBB1A8ADB06CF1508741E02D2DCC0BB4C755E69",
        "CD_7F0BCCF0F309353695E66B6692B97AD29C859CFB167DE9C2C1DAEAD8ECD0C810.2532.3061425555.490",
        "CD_1DB22C932495AA30067925EEDE764934B81E45E244C0C04ADCBD0150277FF930.1602.1238660441.828",
        "IL_57EDD7478A1EC2FDEE97D13FF6668B714DC1AC17DE87F0CA3A1167D91838013C.2735.3579027665.274",
        "CD_BDB1FB83B60E9BD18231450213923BBA0EC1BFB3618EC2AD0ABF9ED38791F05A.2465.163344536.3581",
        "I_EE648E68C650198115F67C1918B28DA41AAC66692AF3F38325507E597ED6AD9A.2695.2848477745.277",
        "CD_E1F49EF371430AF3D1B27ED477D994BFDA7C8EF9480CA58344AED470649A8AF1.2643.597224544.810",
        "C_52D2D582CC450E6D07EBF7F5FA5E6D36BE955E5652346A68534B9BBF05E2BB4B",
        "I_C1441FB12D4A7F475AFE53ECDA8940162CEABEA79A209975A22998A7E3661346.2677.510966157.276",
        "IL_7123B60FE0B72F1C57F72E3EAB013337D11B665291CA2F49685F4750EAD74F42.2698.2740028169.268",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.100.1983798760.368",
        "CD_175CBCDF1FE1A3D1006BEE5BB1EEB6A6DED276EE5BB03CA516D694240172D5A8.2547.1258802826.580",
        "C_669DAE17C175FAC3B675D5D90C908AB50C0C5C178E12A057415922E3E43CDAA4",
        "CD_857A93520BEDC9F703DB461D5CC8192FB10A25C77E5665D06DE039388F19CB72.2137.1.11416",
        "CD_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D.2049.1.11765",
        "CD_30A8BABCE38054F1FCE6452E0F348F3D9BA89959F67A425751C931560042A8E5.1479.2361239911.889",
        "C_D6D14A967FE76867E0613EC607774F87ECD794228F246D5534936182A6F4EF9B",
        "CD_87C10E264E287342D3206BEE44C1E60CA6C7D6B38EBABA03EFD1FEBF2C09580E.2483.1234155087.4750",
        "NS_0E3BAD336658AC1790DE65EC93590431EA8C91776907175DA4BAE9AE7DB97611",
        "CD_F1BA28E60C6EFF4420FC6CB551CF2C0DAE65353DC7A28CA753F3AFD5F33221C9.2000.33540574.398",
        "CD_3861033CD1DBF897690A8E4F8C0E20A546EBDB5E84B5C3D96DEF6D51B883609D.1666.2789767812.251",
        "CD_3FDA482EEA11D105F777BB4C0E86194FDFA63901845D94A245BC2172A88E5638.1638.2415188411.3918",
        "C_83D7B7362AB73F157F3C52E091E73C081D504CD4CCE7A6A43B8A3249A1C97801",
        "I_84B577359129FEB26351DE1AB13F43F46378EA3288A2291DBD252ED06583C9B6.2711.2473161024.300",
        "CR_C0C743A36644538406F13B21A67062ECC3AC599CBDDB4F077787EC27F2AC44C6",
        "JNR2:FV>.6Bg*tbkZ^p&",
        "CD_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D.1139.1.12849",
        "8<@DH",
        "C_4DD50BF821F6AB9924CBC702AA24BFCC6D9952BFB0AE1C1E0C61030AB779A8D1",
        "CD_4E05A85C7C9DB6824A0AEFA83C9B26B28AFA6D8D088521A8F0444E981BA3B980.2423.1624563707.354",
        "CD_742E9B93637882507F385BA153B7841CA1D9B1C432715D51E29011AA3B0D693C.283.1945362009.642",
        "R_3EA73D2E00ED14D42FAC9F0BEBFB30940E80D92636BD2423331E14FAA19796EF",
        "CD_84ED32E7ED04F469B11E1DF74E7E118AFE5E1CC1C17891C6425CB1D7BE20096D.293.3384264536.622",
        "C_1DCEB1693B085B2991E1748C5527FE1000E59774A81597D782C7656FA24FA810",
        "CR_61A3C0D6CB2A10AE4FD5F19276429EF7E249D991E911A200F124BE12E4F8F8C2",
        "CD_C12F1595FB14302AC3BDABF5969819839654D56DFF22512157B1EA1002807534.1805.2939089465.4771",
        "CD_EC5C4DC0FE89185F526B955C798149CABA4B33211BEF571147AFFE5014EB1AA6.1740.3886288786.475",
        "D4E22.2504.998400869.326",
        "CD_1C02230D43C9B8D44FC222151EB58484D52368F85F771DFBA9F0D7FDEF76885A.1929.2353322708.1065",
        "IL_36225EFA14E145C3219DDFACA9268CF7EA21D2A45E69B26776839674D64261E7.2726.1300248525.275",
        "CD_D16B91CE54438C2B0BC70CA30F18A1D01B64E1D3178977285B1DE67A30CFD3CE.1184.3068388190.1788",
        "RSOP_IEConnectionSettingsLink",
        "CD_FBD8C5E53E09306926C4A97ACDB9C4FE5F1E24FABD58C6E18FCDBF7AF5106FB4.1159.1.29298",
        "I_E14960055650ADAC2C06C29022467C3EF58831F50C9AFF42B1D1C7B072FAC7F1.668.1.53493",
        "I_3CAECC7DDABB2C6E1511184232D03450EC2EEEF0C1F9E9ECC841148029751BFA.2682.3999801118.294",
        "I_35B3BA3D4E3452B9FD358FEC9D1F382046EF61B6EA2F3D32FF2B776BA565D15B.2734.2803422054.306",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1976.3172404278.352",
        "IL_9910AEA82606F44A7D6B3D0FF84B5470154C1782A7044B0BBC20DFD85E449BA4.2675.4136205236.274",
        "CR_1750EE3B65915B0BBCFBE5A295C25749B68FCB3C6C54CCCEE17321E25B3884CA",
        "CD_D79D62511A51C80D6036FF60B20805B5B133C69E918F679C69D47C33516A36CA.2570.210149032.486",
        "C_6ED1CC69327A33D759019C559267CFDE48C858749D7A22192B7DE8573CFC19A6",
        "0663B59BC79B2415F2F523FE46FD51DC.1071.3985150615.882",
        "CD_15544B0DAFDF759BD10B745F7A926F46821115EF3BE25FE076FC3A533C317B2D.1784.2128900220.372",
        "CD_79C2B8878CA0CC7D263478DAA5B22069FB6ABEB9CC6BF0071DCCD3AD247D51A9.113.1813991893.616",
        "CD_12C8B809AE9CE5F53FFB63FC457B4D2DCB7488DD14E84D1D82A5FA5D35BEFF46.2560.2939838905.88",
        "IL_66FD63E07CDA0847196FA78021C366E969CEEEADE5775B379E698302297BE344.2685.1094387673.271",
        "R_6745FD83171C912384932B2460F0A939D3A35DD708158F930D2B33D61C719953",
        "CD_7EF96F2C01A6F5A405F830ABE0BE0746C626D817FEEEB605AD8817C16046D746.1051.4059599823.225",
        "I_9B7FD3BD75964EDAA2535DCFDD7318D8161266FCC6A8F563295F2A6541F02092.2677.1600973069.276",
        "C_60FCE805C6071BE87E9CBEDA37820FB36CF37AE4223143B61E8F29860F4C3E57",
        "I_84B0232F39143ED311317E399D2E2A8930FF5F10FA3DA1D56F1894104002A841.2713.704309705.279",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2473.1344709254.368",
        "CR_48BC67131BFD22F5DA28A903403A15608DD05C18742BBFEFD4FFEEC39F82B3B1",
        "CD_A881933FA9D51D73AE6214A1138DCCB4CB1BEEF83EA181C268577ADB44A0FB56.1071.4210146656.439",
        "I_9E27032EA77C22C71E928D6C54089CE950FF131DD8D26C429BA0946E9CA36A19.2711.2801621187.290",
        "CR_26F2DFA12DD4E238DF19BAA4547B3B8EF9BC62B9AB940056F71629B35FA95FCC",
        "CD_C4F661973CD3C0A0D2984AF60EF23047396681C367251D4E47D1DDBCE0BCDFE6.1085.591095349.2897",
        "C_8A4CE91E2CD3F00CCBC42B48A0F1A77FDADBC577D201010EEF9328E68E880837",
        "CR_AA9C35FD43405602C3CB92A608E9261205300DEA694427FCF98EBA8499E2378F",
        "CD_37F745714D456922ABC6A6C3392453CACBCC48856287D98BA28B9B6BD50EA75C.2750.894307344.341",
        "CR_E284DDF7F9BBC191C804CE3AADDF197ECFC83C10E016C1AED712528DDDFB1F1C",
        "I_F1AE9B23970D5C43D2977F5D1DCCE4BEF595D5D1E15445BF8E2522BA6CDBA4F6.2688.1050422235.269",
        "I_22E27286708E339CD1F553AA968411C46237D9161F7CBE5E9E422DB51E772F46.2533.44794429.276",
        "CD_B415611B7F1F7EF497B171E8534C52AA364C2819C0AC05E70DBF6ECE9861825C.2547.3671149834.898",
        "I_B3CCF51DA7E2E82EF4B967050224C72E8B5296498ACE167E310066C0B48C98F4.1802.3932315074.260",
        "CI_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB",
        "CD_410A7F9BCBF68F143E8FFFBF91BEB08109AC58714E0E02572A1BE71E6EE2A05C.71.797393471.1122",
        "C_9AAF3BC6AD36F8829CC6FBD50259D024EA00D998ADB66289BB6A5295426711D6",
        "Per user storage volume quota management.",
        "CD_9A1C938ACA675F962ECF2A2D496BBF16933C0F6F4FA335A59840FFDE0DC3612B.1466.1312951038.861",
        "I_D0A9E3D19612BAC18B00E1B087870AA5A89611AE0FF7ADB6E3776B1E505C26AE.1015.2403639777.314",
        "CD_EE35AEE540BCEDF1393FC978093FBF16399E5CE3BB4E7B096885CF94D130CD38.1343.3710782997.3742",
        "axSrqCount",
        "0~{<i",
        "C_1C871A69AE42FDAE2404C626ED2A6EE58970B1ADBD41309118A0347F713B188E",
        "CD_E707FBA0E2CA2FF8FDB82241C8B012B9A1B221B3B69ACD6A3EDCF3E478558D31.131.4164570819.1018",
        "IL_75A63512835A63119A561536FF3C9FF40F6EF10BA441CECC3B232D6774FD49EB.2711.1108445118.289",
        "CD_9E6BE90DCA6B96CBA3BF12EFB579708613DA0A405A49EA5E6B87A7FDB2747D9E.1226.3070921010.365",
        "CD_58EBCE462A5C99EEA826226A8DAA39BB4E44016ACD1726174C7DBA9B5E2879BE.7.2180866009.280",
        "NS_249921F3CE88C11455C9B24CA21BA6C160824D0FB1957DC288BC7721C86DB55D",
        "C_47CBD249A2C567357686E5ED6091D88133AC6ACBBE7BC216472A737EDFCF1867",
        "IL_5CA19EB2395D61F96178B4A4A94739BBE756FBB157E53F43B5D54BA1E594DAC1.2676.1130397772.279",
        "IL_3096353BE616257278E75A17E3CC131AA8CD6F780948A369786166B033A50ABF.2703.1348667348.287",
        "IL_ABD504D4660345C0768AAE3A45E3240E43BCCA6F6D9D29FA0B7677D9B247603A.2675.378557046.271",
        "IL_30B8EC6BB224B03221F74013E30D043476C841FF505E2B10A5CBA7529AF31DFD.2679.1639779357.279",
        "I_D7933B909E6971472A6EDD596BA80A56F62FDBD317E77A5694F7D4529E39B358.2692.3187968237.273",
        "C_CA28E6386CB43A066BE2561E182A1EEE9C70BBC65B5975ED1D17667F17262B9A",
        "8A799BAB440BC9A0D51FEA49FF0156E4DB012B3AF1E723AA4EFD5.1193.2565074915.621",
        "C_B34654FD886C899A98B32211E3BFE4436030D29559C7BED49C8FA0B0A67FE9A5",
        "CD_4235C3882F55ECC1A6DB4EAD3A34440B234054AB27AEC08E48ED2ADEDF2BCD51.2674.615577767.1022",
        "I_6E3F794B6CAF44E66A5D9BD610842B886CAAFA95D9F1ED89BA412209C5F72837.2715.3919750851.277",
        "-9E44-DA132C1ACF46}",
        "EIA861A",
        "CD_245A60CB3C83282C66619417FDBED882D5813DD3587BF8C3DB855021F3BF28C1.2613.4101373547.452",
        "C_05626F557F4AFBF612C90AF1E2E15959B61A760539882427584EEF68B7C3ED90",
        "AcpiGenAddr",
        "C_07A0EC78D0058B8682505D47D43629FCC504426EFCBD83A930870EABFD27DA03",
        "CD_36998BBD1F34ACF15B900E670E327F028E4B196C8A6E911E23965EC2D63ED47F.2745.2139870003.318",
        "CR_7B5FDA91F5DD1FFC82E20D5F3963DD7D7657FEDDAFE32D552743090171A78DCF",
        "I_A0B6CBCB3E1468ED64AF9F60ECE1EB9BE6B074D1A7044C3A5A7AF233BBE8C92D.2691.1667993838.262",
        "I_11DC9B6A513916A4D323430E59B223090625B5769C0F700CDF56011654E2084D.1802.1445999930.336",
        "C_A963FF6A8458E9C4FEA354824C031F4237B8648981577F19FD6854C86994DA8C",
        "IL_9BCEBFBD099FD1DBA49B8E7BCF49EE9762FC2EFF302F652F7F56BF3EDE25D1FA.74.3024936235.324",
        "C_15CCADCAF3B14E896FF023CB4F58C808DF0635585DF3790B0E9ACA025DF83D69",
        "CR_9C6A7E3E087A5B8DA585FF771A2BB4634D1FA2F66F376E9BF7FD6F960807500B",
        "CD_484456E3E724C112AF20813C7339BF5577C8FC1EC72751890A0F458FF4330C9D.1782.3754858147.391",
        "C_93B4EC179BEC4D03F2FFE439720FFEF4C1271764B5DC6411F6BC0C453ED58B71",
        "E1EAB736DF81BC8E670920B2CE9D6569872B38D69DA44CE88EBDB5463BE3F426.2720.3093271709.293",
        "CD_54B484B8C5179A454100ECDF2DB8FC85525379AF704F06F9B2379CAF47C81134.2566.568979855.1723",
        "CD_7AFC0D42052E9C59679F25978A7C6BB4EBBFFCAAA7E1A1214D251ACD02FCFF67.1069.2907442861.2438",
        "PerfDetail",
        "ExternalKey",
        "iB{'Z",
        "CD_DE5401B6E43B578E2EFB53DA6E566DA26347625121707C9D1C476F9131518ABE.1195.3893447642.617",
        "I_E2F8F3516DD675822F38DB86494AEDFCE23BCF6EB0AB54F9C2B64A36571F2CD5.2708.2309793059.288",
        "CD_BA2C021F642EFC72B5ED5FC31813540F5BA649D97F9C2021662B9F43F49C356E.161.1.8626",
        "C_B82CED78F3481E9AF93561312036161F961F9F165E8BC3F82FFF9DED08106912",
        "CI_83FE6007ACA7CBFCFFECDEAF04CC25BAB1807917E74F65A7A46C4B6A4B61A057",
        "StringTermination",
        "I_AFE0B214715E009EB39E889D6A30648F260CAF9CF7AD6AB6605ECADF2A378251.2717.3424355617.282",
        "IL_A4B65D3934C7A43FBA7365925E7DFCE76B9A6B9EF2042FD3060D17EEA520D0C5.2727.3281150336.283",
        "CR_D8C4BEE78676847DDA567812087141E2560365728D8010694F2F477EFE65ACF9",
        "CD_9C52BC59A122CC7517413B34FA6839E69A7AE3C55A75FE6EBEADED4D113D421E.2557.2065512082.676",
        "CD_6A421289EBE2DF884AB995C52B4329037FEA70E4E000530BA3A801B38989E59F.1543.2816669925.2565",
        "CD_C24ADB089A817190D891D780894EA43829C18A3F6AEC62A7CBC31FDB9DA08405.1915.1837109530.1023",
        "C_75C9956E7779838B54824FF45E13C905411B41652E6FFADA64041E0E4ECBDBAF",
        "I_8B109770B70CC6D7972AE94E395D34EF4AF2D27D834986AE7388EC1225644A3F.1606.1789527066.329",
        "CD_C3231029EA3655A198378DBAD554A36F17B1E70A6D27BA95F2106CFE9A117AF6.2733.1164761477.1396",
        "C_08F544E69EA05A815B974A37DB4AEA943B8DDCD4A90A8DEB8F8B62D690EA1619",
        "IL_AB918DE70BD4F4D14A04227982C11B4D62C0D0FB3AAE79AA85D87600D071A687.1163.2072875178.189",
        "CD_EB6AD886198E6F65EE0C752A5FF5E8A8CEAC439C9AF6E57BB6318A547969C13C.1876.1213413830.356",
        "CD_7A167BBDF45B83A696F84C3A949AD0334E4C02429B5F7494290F95DC7940CA17.2596.3571626796.260",
        ",048<",
        "C_D38B3C9A7ADBDFA86718C75F06DD0E52B783C225D8399E8BFAE7D86BC2E5E7A1",
        "CD_4DA19C7C1345D18991969860D5303884780EF4410093048FC0F1820643E62177.190.3920484266.905",
        "u!$'*l-0{o369<?BEHKNQTWZ]`dh",
        "IL_BA7745C2ED7DA83CB930E3AEFF818AD8286EDF65355759102555F063E18D13B8.1714.3776607028.185",
        "CD_9058D572D5B6F75770F806D0DE0C0EE50FEBB3F396FE7FF2CAC02E0CA91E0E2E.2512.1106496088.602",
        "CD_5D3D82E165425301EA97694D98E5FD2162C162CBCCEECEC5C4215C7B648589FC.36.1485827043.283",
        "CD_6F1D850858EF02D0889AD0CA1703D1700194AA8D4FA27667FC3CDD1F09CF1E5F.2567.2361144868.2762",
        "IL_282534304FA1FEB8D9B54895719DA12FC0DC5D04D5D0B3ADA0BECCCB4FE5D211.2554.249282375.272",
        "Power Setting Data",
        "X8|dL(",
        "CD_322909C324E622DDD863C72515146E16B95F7BFB1C53D81AF6A8766C2DAF9100.2595.3045537163.496",
        "I_AEDC90AF54A3D5AF696D2BD78F01D79B909BB9F082E2736232A14FE22A818FB2.2688.3844657391.268",
        "I_5FCF22E7F83486186670EFA53DB2D1F5A509BD40E34AE4A9BF25979A07DCE04B.2716.2262283759.274",
        "CD_80B699E54B84239FD1066E5A81EB19D570A7344B7D65738ED8C91406D3A0502D.1535.4164111158.651",
        "CD_C0932D78F140997A49C8B45C94D66A040A7701473EF29BB14AA1C56EBE031CB2.282.3417847660.813",
        "I_A6AE5821B60484A06D0AC9D7E0B3DFA474C1237C520458835B314783E8E1D54E.2678.3200760396.279",
        "C_512A49E5E77AB2EF2262ECFFC535BC2D9589F81384D38E23194DFCE306ABF068",
        "ROOT\\wmi",
        "CD_199F8BD2C63EA7935AD06C4A530278FE453B1FE80DEFF18B6BDA97081D8B8C0A.2744.2806644854.703",
        "C_1435E6F01506FDAE4AA2C842B37209EDA7E3776319E85DC60053661DEFC190B7",
        "C_55EDCCF4E5A9ABD76428DEC07ABF127ABAF79D731BF9177B4B1A7951CA86E45C",
        "CR_3653C174656650D4A02A47BA68627F0FB4B224B6A036E2091CB484BE8F8933BE",
        "CD_1E7637AE86BE9B7FCC266B24B2671ECCB9515C8B3A1845306C8B4FE9C0197220.122.1123166319.905",
        "68530BF42F687579F4795E6FAE9D6D60CF7B02015DD6EAA0272.2642.837909254.263",
        "CD_AA89F446191A5311D6195827FCB555530663B59BC79B2415F2F523FE46FD51DC.1071.3985150615.882",
        "IL_47A3A313781875019EF675B4263C00ED88049A293CFE060A5DA87EA2EBF4DEB1.2690.2780638143.273",
        "ResourceName]",
        "C_B159926F0CC27D6492317BDFB79C85235741AEFF3D5B427CD61D2FFD2C6EA2BB",
        "I_F4D3591FBB73B629A7C321C5AD504E9A8359C09FA6F974222EB6494D3100C2D8.2680.3568111899.285",
        "C_F3FE9F8C3A3CF33804F815B29E77D41E1175AE360C63A072F4404033FF71E150",
        "C_054A38929ECC5F2B71B017259D5DF98C968C29C9039A37FA5C286398E463CDBA",
        "IL_18139DD2E089A97F8057A3FF2900D5FADB33344A7E208D73A836287EC56658B2.2678.2653422764.286",
        "I_0CF2AC6255B121D622EC45FE14E7E9D07C0760E987A0964A8A827D2FF5BA64BD.2686.2855216389.267",
        "IL_1E83286B2C3777C538780A179DBE46EE910AB840D4D58E97D94D9CC9A38397AF.2684.867651186.286",
        "CD_C867B637B25E413A5893A8DF403F24B113B36FB9DA058811D901C232D15C4E60.145.4048412995.1385",
        "C_61AD70324F8E2B3494420EEDDA5029E5D1AF2B0083C1CC1767F12EF889E146D1",
        "IL_9E8B26DC09F8BC8981ED0BE484716F2638BD5B08766978ADCDE0FC3354AE393C.1053.1404244556.347",
        "CD_AC7BB2CE72891CEE5B24D1161F798647F6D5827CC518A0A64C2F1BC7D1BEC738.314.2862054318.1238",
        "IL_3E5C71F597B81038891F6DBE304274708E2BB2389008548AA6B8A0CCE07BBFD8.500.1.38483",
        "CD_93A56FD79060DE7C5C63B9201FEC3583B30A043D5DCAC083E3F4C84A7931B27C.2424.955715138.295",
        "P0<`X,",
        "C_27BD06140C1A1F8932E87156F8647090C9F195504BF06BA40A70C3770B3F31D8",
        "_PageFileUsage",
        "R_F4663152AE3837F467703D43AFBBB6630C1BA3529FA8A88B46C0496F26CBAAD5",
        "CD_E6041D969E0A83C6273254AECEEFB2E2E4BA3E5ADE2661BB572D7A354A85D2B6.1584.326815355.631",
        "I_C047B36449BCD8B3193FE1423103CA0FE4E73B50B0CF883047EFABB50BE6D88B.1017.3454250458.336",
        "CD_B1B3F51451050560540508AE61C59186CBB46746C5DF2B2C8763635DE336A9D9.2155.2579431692.3189",
        "C_6FD9AC26FD9A05EE0C1C596653420C32E2FD09FC50F0C520FC62FF40EABF1948",
        "WIN3x",
        "SettingID",
        "CD_8D36CA25014FC3D1E225A7C28F608753348B2A8115F75C792A0330884C670CDB.1991.45385144.479",
        "CD_AA0B4A55EEE4C1E476A0BDD0D3A0653497872B02CC12BE52258AE7DCEF46F38E.2033.3103682518.241",
        "ref:Win32_QuotaSetting",
        "WNFCallback",
        "IL_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.281.3674678782.266",
        "I_CE85ABBB45D3C6F53CC78DA2989B42346ECE19173973203EF6178923B888B1B2.2696.199672103.273",
        "CD_6F2EDFBE6222C2212C6DCE17E0A96AB75C4054C34F3E4779AA732E76185E808E.2645.1138710425.645",
        "C_CDB424FE67340CCC2621376F2156DC346548CA8F3622EA235EAF7BC515A8CBC2",
        "I_97C7369A0CC3DAF8A65D93A71284BDDC3938384061D8AD2ED5B2DF9E638CB6AB.1016.4100651551.295",
        "CD_D266306FE2E96A3EE8770CE67DBE546B0BF71F7E68572A79B961704C44143357.278.2488595384.575",
        "IL_52BE714A8A14995D7A27D4DF5CF5140919A47D8E9D40A9E22276831462CCBC61.2691.2353329500.262",
        "CD_50478FEF0FA679E50347C8BAB55834F418A1E60E2411E2B1CF088F78A1275598.1193.3243271486.612",
        "CD_6E42F619B70AE9A2B05F70FCE3E0B6857CF973C6024DBCB714BC2386FB5CDB64.277.2880831975.380",
        "Minimum",
        "C_4DA007FAA59D85678F2228217B51DFDDAA6D35079858ED061C1D1AF77F57DEA0",
        "IL_484C62416F9109449E6722EA83698F214609F546DF356538332A14AC279B6115.1014.1217742604.297",
        "CD_7A16CB145A4311D526736B897DD968162F4158895AE48A1FD97D7728640B7509.2645.2030730140.923",
        "C_0CBFFE574FB1083943BF455D0289FB753DE3C367B01850F06C12D786A0419EFE",
        "I_7FF87840EC71051C0B44624DD4387D011C70E334C57569D0DB2110560F18F3BF.2684.2970974831.275",
        "CD_AB458ED9D1DD4314F88AF5FEEC588DFA53BAF8DC0A56FC3E30B319CA4FCADC37.132.1714367127.4056",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.1940.3407612383.3773",
        "CD_55610B2834CEE9FAD49B0C8226C89FEF7A98C0A18580FA893D81FD8C8B007A30.2576.1140342491.436",
        "CD_EA0396D932FDC5A40D76EE05C8C42408E2A644C1B6540849C7A56ED78D13F40A.1602.2971351569.492",
        "CD_47DA5E0552419DC8335CC62E42730675F46D97E851C5D17093E25A5F5DC94EE2.1570.1813403728.421",
        "I_BF6901C41BC3F70A2E12B9E6997F8D7E348AE9FF5E0B8ED060D61681E2CAE2EA.1758.3676325466.196",
        "CD_3E578EE07841672D662C242E733DB5203704061876BB0F37E75B8DD60B9864DA.1350.3660156486.318",
        "CD_ECE4D023CCE2A8DA3585E072533CD9C2FABE638E31BF9A9356E6B337DBCD49AE.1064.2750825004.1444",
        "CD_ED570D21D0D7F1575600CF30D60A5C9A675A42E8F301530AECD595FF166AFB26.1927.1491863795.318",
        "IL_821EBEA056BBED293234AD9B26F9D08D3CAAA130F6BE60AB8973FD6EF872D0AE.2713.2123517395.304",
        "HeapAffinitySlotChanged",
        "I_3727967AE16249212954511AC74C954897073D7ACD8965A73C9EC055B6AD358E.2719.64907602.280",
        "C_E1F49EF371430AF3D1B27ED477D994BFDA7C8EF9480CA58344AED470649A8AF1",
        "CD_231C34EACA6E9E68FABB7AA3DADD079A379826158D2123254977F7CD79559E18.170.3147488321.675",
        "C_C711C8BB002D8E9EB1110FD878EE6D746D43AA84016338F03543498D8359252E",
        "CD_5B65E7078766FF07A6904B792E37F0CB98C934FE8F6E820DD0987C16E5C48B56.2636.4249698851.263",
        "CD_C69021AD1257EACAD7939BF557F7345378A0D2A133C46981184D4659B6575E49.1203.1013698384.1334",
        "IL_F009668D2B4A779B3AD3C2BE1EADF707D2996FBD6CA406371FA7E00243DE837E.2712.4203298787.285",
        "I_A7BBC3A122BC0B00376D72E453158C9EA78057DC91EE1CE66E3F2AB64BE29689.2675.3043558374.277",
        "C_B977125944CA8326977A414325742B1EF12C40157E5C5D20B7B02407CD6122F8",
        "C_F8EF7CD33C3F2510D1C17CE3538977B71D5AF70C10D3ABB08287498FE3E23A15",
        "C_A62F9CC5A61A3B5647B63F9D3EF75B6D796465E4641B09EA7A6CA665E878FA9C",
        "CD_D79E32EFA738782858549B5180893EA1A5E71401A6BAAE362DAE46E23511E634.1352.4207425442.549",
        "#'+/37;CKOW[_co",
        "R_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "CR_76391C5F827BE50BAD62D3F132AB199D19DD265648929C5B938B0F42F0FC59BA",
        "R_6EA54EB6200DEACD9472C174A208E0EE91D2B991209F364CEE6C8C621CE142BD.1356.2547888708.584",
        "C_E67DF64CBE3D01A3E33D2078FC61C5DAF3C494C4A4DFFEC9CB77DA207B5AEF2D",
        "I_75AD4008D50FCE8D6BD04E3DA2A5288455288A8B985CA51E4483E037E4416DFD.2717.1530343366.291",
        "C_4D4CE956D39D51456603D4ED1BF7ABAD64E72F02B0D569299B434D13F41AD4C4",
        "IL_CABD896996601881CFE18964A9466DC7EFD1B4BE32C62E388952653075AF8DE9.2682.2283574034.282",
        "CD_19D64438B52BB0867C48D699E88A863202CAB587F93FF7433FDE4846517B3774.2229.1663599953.2213",
        "C_1F25AAFC1DFD302234A597D09198F965D3DA468B1863CE8D32B13C0CE151009D",
        "    </asmv3:configurationSchema>",
        "34633C330A7073457181E138CD54B.2715.1050821582.284",
        "C_3B46459D96BAF6024CC69D0B547D339FA3140A99F61C6D7F2039EDDAAF55977A",
        "I_C3282AA80DA339EFCA4A6811C7928828B016D54F51939633276BDB2A4B84C760.2683.69782534.280",
        "CD_676E663A52AA5A4BF1581676E7DAD4A65786BE12379551692652B9B04BB4F426.2404.1.11964",
        "IR_BBFCCB444CF66AA09AE6F15967A6865175BB0ED216D19970A7988B72CDF0A3A4",
        "CD_29496EE13A50FC208C78C52B2E38D7EBB9517F3108A323CCB520DE03AFA2EB81.1516.1811511309.5434",
        "R_45C3849F1CED88D3DB3B9DF69DB3BE1511980D0B7E53324DABF666602B9152A3.1184.3862534201.520",
        "IL_0E7E7A28509E7ACE2924505EA5F22B7C7491503A0BC64FD1A201F15D5038BB47.2679.3140839499.279",
        "CD_E23A8DF513F1C7607D4B78DB0A216DB5EE78D445489B6EC4EB9A64448026BC0B.1779.1606817319.283",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.2165.1.14612",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2120.2084505154.188",
        "IL_0B2F54DC248571B756F7BF8B112CC00CF7EC2CD6588E2E36744B13AA0012BCBD.2706.1201808501.285",
        "CD_1D9D9F860D11A9D4B55F4C6910A7BB99E4046682A588042085A8C0D379BB6068.2001.1050611897.319",
        "I_C7F6C86A8A9FCED582321F4B85EDB080E99048AE5D7AF273DAB14F22AC9AE7C0.2712.4008156233.296",
        "IL_A19CA7904BA6023329E4C0D49B16DE932698A9CF7CBE865A805529294FEAC4CE.2698.1291570579.275",
        "CD_64F4B56BA62AEA878667E6108D37F2CEACD96FEFA33698E5EA8E29A16F7965CD.2625.2270361136.552",
        "IL_84E4B76F6444EF39B8B7DC8A81CF89190AD522CD0F68513A037647D5384883D3.1183.1231291022.333",
        "C_335C9D1C30BF96E7BC1FFA98ECADFD675A3EA69829813F59062A99C13DC71866",
        "I_8D616FBF552F3D3BA75D6013C6C4ABE6161A9130C129F927767BE486D9ED089F.2728.2159775033.295",
        "R_57999785729C617E0940F08A69B76DE9550166D43EEA37880AE2D6FC23FB5859",
        "CD_161C469CDEBA430DDED22BFEB8E493F5D9ACA6AE468ED0C2839064885A1BFF7B.2451.1487477924.2453",
        "C_485DE6FD5B7FABB57148D51FF4971D53D237B9A8E1B6DF50C62BD5AB1731516A",
        "CR_D56193964E51CF773304523DD4D95B2AA6C5D33866F47DB7D43681D0C19210B9",
        "C_7660C01C2193732D49EB153B60D0FBFC8E4D8FBEFB0292EB549A2C90E8679497",
        "I_DD64F3DD69AC6AA9DD729C4E6C42B0A80EFB1B297E7D02AFEABCC6933514C2A9.1017.3289069461.321",
        "I_216A204E83A179FD2824A7345124F94B7379D951C92D195DD87ACF85108CF332.2677.314985929.286",
        "IL_8387112FA3E19914BFCEC9696AF4D624B29A433BB94295DD4D4C59F2B49E5641.2692.2118308811.270",
        "C_8B3C017D4428136AA9032BCF9FC656670ACA0B318BBA4C22D2ED590B175FAAB4",
        "C_E7ACEB5389BA8C32B04736209B872B130DCE3B94FF3A17F3972AEE3EFE29C3CE",
        "I_BA84EC20ABE5A08AFF533CB30B04D5E52B8BC5D61AE0EFAE5942539F703A04F7.2722.2481568991.281",
        "IR_E6EA3F9ABAB0F7F735ABB83D47A0BDA517A98F36F7D197BB63E64B363D115BDE",
        "C_9FF3B8277CB0A08E39C226B2DFED0B409E028660D30214AD93EC8C84BCD48618",
        "R_EC346D4B55B7A3D064DA670AC46B8BE53932F3BCFC8908523A9CE445AF651CD8",
        "TracePnP",
        "IL_0DCB38B872FB59592D18B80943B89BEC42F008EB48C9E96443375D95C2BE138E.2724.1332542786.290",
        "NS_5B2CC7EB2AAF010DD5D0084F2DEFC340AFEEECC12F24D870DFC50B8EB7C98139",
        "CD_9B47552D4116308DF54B1B8BABEB3824E2EAF0C2CFA9CF24D51A58C19C8849E8.2462.3213873635.1714",
        "IL_7D726A53C2E109A7102AA0733AF15E0ABEDDFCEA169FD750AACBD377D8D29F56.1476.1899862249.277",
        "I_2D25E7A823A345CC4C30BE115246470F105169F049D267FF05E26B1D0CEF1DDE.2696.1969426336.273",
        "CD_B3C81C13898C78829E8DEF02131D7FE87DA6C4CF126C25D1E3FED7A0F888E25A.143.1073816525.435",
        "AllowOutboundDestinationUnreachable",
        "IL_AB4AD3FE4521911441D375273A1BC7BED386BF6D625BAB238E03436FE4742989.1015.2947338353.314",
        "IL_DC022C56ADDC30CC3E115551AF0C2E3A0D951D2FE3A0143EA391171B0F62E529.946.1.67353",
        "CD_0DB45CACA25E882906575B2D36934F555FC5B0E4AC7554F46788D84D3F95C547.2561.1082702262.356",
        "CD_A552F567B8A5F7AFC0DE40BEA66707D69F4D09E38B49B8EFD3AC625219B7FD45.2579.2258299960.1218",
        "I_4C51D994F56A9CBB2BEC23EE88AAF4CD5448E1130361F2595B8AB9BDE9C47372.2685.924171561.259",
        "CD_20E26719BC549B0C77D8B4DFD99B77B83DDEDCE4C0758F4F0F87734411D6F4B5.1350.2789187864.915",
        "CD_7AA68F24A3819A669E00384CD6D5128FA13DBD361BC7AF482EC99DF104E6488C.1915.3768687766.293",
        "I_B14D0FD3D5A8CFC6EB06319633CCC6B11EAB364BE3A00E6ABC259B60FA974330.2690.1663296439.268",
        "I_ABAFF26A954D1C98B7369DD9DD561E63B101887A4E8D958C085057A4F843012F.2676.2286314530.275",
        "CR_8A4037032A1E93595308B4A4BD6D8BFAF65C3C979F3304AFFC616809C573E05E",
        "CD_D5D74C06622314233E53DDBA8B2858E9C39F19EA4E9C34576583CC8C5481468C.1050.3894088345.3292",
        "CD_C9D9452296EB13E3615C122157CD56E9BB0D20377DF2B13731EB18D5AF7A66B0.144.2354574003.483",
        "IL_32AE2A5F17D13D0986757B3194A9D15399A6CD22AE1C58988AA3DFA10660243E.2696.513844225.280",
        "CD_5967C66DE43EAAFFC361A239E261C584AE151D5B580641425F8CB979F59DD32F.2585.1548441746.670",
        "R_33CF99EE359367737EBFC91E6221019D46F7219044317527292271867795E5F8",
        "C_199CFC4A1FC7A648AECC1FFEF43CFCD6FD4BBDB0667CA99257540823E6C76661",
        "C_BD8329DC9A85A4919F9F60EB4D48B035D2F30D4D189BD4EEBE828F7FED6AA535",
        "C_86E8A5569DCAE5B400BCD0BC7C48FFAE53C06283B9698944273225E1996E11CF",
        "CD_A1D67EDA20E5B60C7C1FCB2628243152EDF1177800C5956CEE6DABE22B3EA0E6.1332.459380533.1525",
        "CD_73F9CC8D0A2B5107ED79AE2372D78EAA3B2A7A24FD2BD2876517DA1B42CB16AD.1999.335101033.1360",
        "C_EC4C381761F3C10114EE1C99ED28B1BA382832F3C228DAE98DF8FBF4193D38BA",
        "CreationTime",
        "IL_7098BC90F08FB4F9DD6C8351961F1423D74E36F9FFA01C9012DB19053495EECA.1620.2108318268.186",
        "CD_6CE5293A4991040589451CEEA5CB3FB1F0BCB9AC8B0C16A2D34DE39822CD1F34.34.3716583432.508",
        "CD_19FFAD1CD1C77D68E4A2CCD9BB3A232F8053D878E6AE3BE53313E296FE7091C8.1926.3801619118.302",
        "CD_33B0A3C692AD567B6C92E618FD5072156CC98A3BCAA3A93CB3F15A5E87E34AD2.1667.1576782823.353",
        "R_9D477AC3DF7741E8993375CB7B6EC3870626780031363A4F5096C4CACA7F4F5E",
        "CR_3F67FA0166F0C8A24B462CDA43C543F340CD7BDE061E1F57A0BF997BF74531EB",
        "CD_CBA62AA66749A2FDC924242189E9619022D7C9D4C02E2256557AE5388175FE71.2574.2031108769.538",
        "IR_192AEF8A3D6A39061991F2254BC36EF440E5040B4F97A934BB327ECAD687AEF7",
        "IL_304546A1C1E96E9129142E75E297CCEA0DD08492A7C88D17C5C3618E4AA08462.1520.8942720.295",
        "CD_DFC0B10F96FE89477D6E5E3DD30C3B04040D3B499C9AF187BD9C2AEBC6B2C85B.304.1475050947.6298",
        "C_18F346BD214F217E447A1FFE3109B06E13553A39E553F4F4B66A2D5285DF9EF5",
        "CD_A8E00DF275B2FB47AB36B812E4750AD4FD2F723726632F4293D0ED256BF3B071.2442.1027552879.2485",
        "C_E367B12CF12DEB20E317AE3B028692F15635A4C17B759C34D4B8D5D615A27793",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.314.1165541664.180",
        "CD_06F5F6B28C8CF9B7239F51992CED65E9076CB252470411CD4455838A2FF091F7.2615.3197725566.397",
        "IL_4982B06C247AF8CF859E7FC73EA733A255C4A51DCA3F0A2E0CEA56F60FC253CF.2730.2154614090.286",
        "IL_B5810739ECA3FA6E58C813A7E51844E977B2343C263C8642483F55EEB9730A66.1617.1386415659.338",
        "3.2684840011.283",
        "C_D0CFB4BFFA92AD4ADFBB20FF5D5C5D15408396FADD1C0E7F5A74FCED565C9658",
        "5497AA16B16AF0A6344C164CBD027C88BF47D531661219C8D5DD2913FC696E",
        "IL_F96C64619946F851E2F35B91E58551F43BD1370337FB6CD1DB384048DA29E785.2696.3868162098.278",
        "C_A96812E0A2895AED486061635646F9CE6BE6E74163A4F9C4D4D988FEA144F286",
        "I_F6B894C3AD824357AFC6B0E4FF7C81C372E7CB3BF6163E862C6C14322291FA74.1014.2674490485.299",
        "C_800B22335E7C5DA38CC321333C135D97E9AEDC239D54BF4DF5BC03D028B50520",
        "D7B43C66C3052F5D6AAB",
        "C_85E98FCC800C352C83C45C07CFE472D9E1E77EB165E6BF1822711F0EC5CEC32D",
        "CD_92238AD148AC5103CADC28989282F28BCC65BD1B364542DE6EEA1DCD3908F3C7.1958.922367810.599",
        "The name of the primary system owner. The system owner is the primary user of the system.",
        "IL_39E85455A7B17B424D7163FE8072349763088539261D1296FC03044B0F465711.2735.3801655536.273",
        "R_9C6D6FF9B9D03B5113EB79662290652D2C90B044404DF90E5AE9AB4E9323EE10",
        "CD_DBC9D7448979766FC3AA5E546B9F7F37A6E0C06BC06D343F27EAFCD412F13D2A.69.2454709768.1673",
        "CD_E9E6CF14A1D1943FD1D418A78D10A4C9919368334DDA95F2266F7CC99B71B777.311.3285296256.506",
        "C_9E0CE8EFA5382EFCF4A61BAE5C006427367204E75B0194A869F998F4EEE5DBDD",
        "IL_56FE5B970B13F36ED26A6D17BF0D2D39399EAE8A7E20EB72D88B464210DB967A.121.2445847948.336",
        "I_35D0290A1526C7BFDA75159EFA1A15A19A53C6D1A832DE6967F7889F521EFFFD.2677.785593934.279",
        "I_78DDD18E99547DF89EE4A409F622E5F8154E1DF3DBE8FB47972CAD32BF856D43.2701.3599437667.282",
        "IL_F4C1AC0222DB79E3065DDA236A77A4FAF1134A00ACB9F5DEECEE0A5174DE685F.2697.2300640180.279",
        "I_3E2E07ACB0B0FD08C5AC8969B0D25BD27F59A39A880D678674F36A838D31EEED.1014.1975740487.296",
        "CD_0B9091A7705333E08909D2D04FE2D8C67B717AD489BDF891C00D458657EAF4C7.67.1626277579.4313",
        "CD_756ADF3A38037C884D036F3D193150C71CD696CC6C340246CD1DB26B98747BF7.2759.2416823045.296",
        "CD_39E75790979650C120BE778856591D7E59D2F85DDFBB3BFF1733B73153D5DC01.31.2941113497.474",
        "C_3C5AA3CDEAEB585AB43C65A0F5E950F0F3FA0B98B670B232E78B6416314D7405",
        "CD_EA2A17F7F9011AC9DF174FA64700FA87A332EAD70BB23C4338DE684F34E350D6.74.1457848783.600",
        "C_9EB956FB069691A66CD9E5EA74E107D31AEB904391B2340F9557D3A32B77163F",
        "C_4B66FACE2F9688020890084420324926AA3CF21932AD39E8C9ACEA5209F73583",
        "I_614FEB5198DB6356C7D4E70E58F0634936BC6DE530AA5FD952207E56B5A89D3F.1635.3418873694.594",
        "IL_966DC5DCA4DEC2E152FF0DCB95694284C8D14AEEAC2177017344379B05EF9185.2701.3240726791.277",
        "IL_C37E005F0ABC8E952CCA8ED708B9D68408FDCF0879CF855CB11F937CEEB4007E.2687.2894415755.275",
        "CD_521F6F7CA2F4726C35B7C823737370C6ED182E0A59D2942F8C5459B8DDB438A8.1065.1861145114.797",
        "CD_59A8BCB9F6971B321C776BA9F2959B669CA7F5AE7D9DBEF59E2C6406BCC884D3.2080.1.15746",
        "SystemConfig_V2_Network",
        "UserProfileConfigurationProvider",
        "CD_5D8A70064F693F027290F7573CE6C1A3BB6513B39CC41447AC81334C5DC5B8F9.31.3712247612.840",
        "CD_E18DB3EAC6347E2FEA4BE12F740509FF8499D2E40E3CE861C65CC1D7E71BB2BB.2628.2117200344.550",
        "CR_1283D6E2E269ECFAA20DDCA78E5D8B7B8AC13879915B95F38BE4B062F89C6F",
        "CD_25FE04D9255CB27C85849C6AF1510F628FE6A726CD3A80FEA1131E58085890F1.2105.4213462655.1860",
        "C_98233BC0D6E21C2CA3187CB9E2307592DF6D759478E209568F3CA340985F3F72",
        "CD_821FCC238F627B3C78AF6F9EAC85DA5F86FE1B2A0EA8142CAF6057765FD44631.275.1349333988.609",
        "C_216DB76437F8B84D04CA1AE8D4A960CE5436A185FD2383065B11CC5178009ADF",
        "C_30D380391F0C7BBDBEB938061EF85587FF8CAC2EB47D3C2BB31A90F771936E23",
        "IL_496273FF6C78572FC62D28067959EE14FEE37CC433AD552B99EAFBF28E3F3CF8.2708.2878877616.294",
        "ref:Win32_BootConfiguration",
        "CD_2095EEA1CCD8C1CFEEBDA5FC6FC84B8ED7715409578D2FABD172B27E3EA581F9.2543.281258426.595",
        "CI_272E5753DC3EECDD6057038DB6F26170E7D1CD565B954C6C4A406CB1BC2D023E",
        "C_DFBB94A659989B2A127D27F9BECBDC304A8CD959BBFFCD2DBE5D1F68A91B0DB9",
        "I_496273FF6C78572FC62D28067959EE14FEE37CC433AD552B99EAFBF28E3F3CF8.2708.2878877616.294",
        "CD_F071A22EE25478DF80A205153198A6FC12F84A9E6BFE53B8E5DFD1E7E2ED2B8E.1085.3283586506.404",
        "CD_E63F81A503B1CB2B5015A2FAF602FB5EB68917A75279382E682563684E46CBD0.1350.3081468761.512",
        "CD_02B5557CADEF33CFA29F52E782D8C5DEF3C67D29A7C0C3B389FF34D1D0708EC3.123.3021504251.3095",
        "IL_CF644C02727D10D54E429438B58B0A2CE4D47FC2B11BF294FDE4FF8CA0C29003.2720.3324523691.290",
        "IL_AFE0B214715E009EB39E889D6A30648F260CAF9CF7AD6AB6605ECADF2A378251.2717.3424355617.282",
        "D18ACD1F30074C3DFE4AE.2649.3934538968.244",
        "I_AF63A33DD08D45D1B69DD77DFB1C679EC967FCF05E3CDDCE214188739111AC70.2698.3918759181.272",
        "R_D7493649E040D553BBED84D5DEFFD1C1D0F4BFF7A65DCE16962DF6CA422CA379.11.471371226.520",
        "CD_E7ACEB5389BA8C32B04736209B872B130DCE3B94FF3A17F3972AEE3EFE29C3CE.2000.3047146156.584",
        "I_282604F18A2EF3A03BD955224BE275C1C416978D6FF3BF120A0F162901AD6A47.2704.835497857.291",
        "Dismount",
        "CR_A340B5A350335A2F698A9D474151FF7803797C56DD9A727636F061641184011B",
        "CD_90EEF26AEE52AAEAA6C979CD586F5F478789816D2A5901B4B6A52181C962DFEE.32.146955450.479",
        "SyncSignalType",
        "CR_BC9D109850BB5F86324C40247B677E50BD3CFF55E165C6078CA0EA6516A48293",
        "C_244B2D44BCFE4686A8EB1967E3535273855A686C9B62600F3309068E24B5ABB8",
        "CD_A62F9CC5A61A3B5647B63F9D3EF75B6D796465E4641B09EA7A6CA665E878FA9C.2671.2426252506.775",
        "CR_C098D64978468CA957C3D43E75CFA62233296C00D54DABB8ADE5BEA89B9E0A4E",
        "8E5701BA59EA88EDEB1A0117832F20650478858.2706.1051116097.295",
        "IL_A0E4FF4D405D5F6019501D2F297F3A1AD85F35E1C780115CB8498F115E1183E8.2704.1940737881.281",
        "CD_231C34EACA6E9E68FABB7AA3DADD079A379826158D2123254977F7CD79559E18.1081.3364768086.343",
        "IL_4E401735D6FEAF013DDA8A8718DB98D37ECA2BADF952B4E6FAA7A5E76029D5A1.2701.2696172882.282",
        "I_934B7E2B0A8BB27CA535E00C5A2F9D7F9F2397232780704272106F970B087400.2727.3770238606.276",
        "R_6E765102703260DFD7DCA65DAF6D57F3FFA2712944116AB624D4463AB0EF1F00.1499.950332518.566",
        "CD_3E78A37E1DE70357C353A15D6BBB8A17A1D31F8D501ED8F1C3EB8104F5B04F97.293.3101721571.561",
        "I_8EC773A30D743262268B9CFBD0B71E3C936A1AFEFC114A8EBAA4ACBD26C24937.2708.2946204611.287",
        "C_5D0FB39DF250D3E4AEA48267D98EBC817DD59173DF1C6B6286433101D6043A28",
        "C_98B52A08A953316DB082D59EC1D28C173ED16648A244894BFBE6E9E36C229250",
        "CD_E4E3C277AFADB65E535A86CD5AAE23B1AEF585A2BE1A21A282B170B7F4278F9E.25.2531720024.4005",
        "IL_D6891511BC8631D6D7EA867BCB13ED7FDCA6FFE780220289B76EE6569D609F63.2726.376950452.284",
        "R_10FBF338168AFFB186F56F269EDFF1DCA8A6F2924767681636FEAA39A6973BC1.1163.1634434399.556",
        "IL_BED999C9BF7E84BAB50F0A32D016E7D1CAEC2193DF18DA06E4E9B9F14F58F2B8.1751.4220363579.204",
        "IL_3237FD5DA9575F260EEEAF4A891E8B9160B7C9EB62993FCBAA97044D7FDB69A1.2735.2851962043.273",
        "SuspendRoot",
        "I_4F053C55BF94F687587D950205791AF583FFC7915ACC38F3CD7A51F2DB97B327.1776.4266597076.310",
        "IL_BCA765E446D9097DBEA6C9E4DFDE858DC64A1737FEE09A95AB480242FE45EE06.2469.3429856957.289",
        "C_C4745EA3423FBDFB01E969B9658C85F67EC23C1A13C01BC3493AE45ADE3D3F39",
        "CD_297F9CD2C4D90784A706075815B3C6FEB973BBF31843338D7FDBBB5184B8AA72.2536.3040517843.543",
        "AllowOutboundSourceQuench",
        "R_0B8D0CD35EF9C37B2A0F0A7A5A12FCC21F082587427AFAC5F5A4AE61B8034D36",
        "CD_AA08179966355DA227023310A55A3E7595BBA6EE2C2F2E7F371415F2AF045A6F.1382.1535836310.326",
        "C_D23AAFA64D52613F87736011BE31B8C96B9BB059D3D70DEA823EBA275624C0A6",
        "R_7D3C758EE8FB44B72514B3588512147905DB19A0456725381223C5A506626F7A",
        "CD_C8C9B465F9F30A2A1BEB0281C9AB6A7FA52E9AEBFCD84E87083549340BEA987E.220.992511366.970",
        "I_5C8E889EFDCAAB9A824CAD60A6893896BC511EF516AD1D2FC6061C440F917D0B.276.1846351431.318",
        "{ad33fa19-f2d2-46d1-8f4c-e3c3087e45ad}",
        "CD_34FD9E1177E28334594B80DCA69BD741401DD280ADBA44870846F7381632F88D.207.1760381501.760",
        "C_9FAFCCC688F5A73C3B168A2E3CFB29D7012E555844D21034E40221A532E99A1D",
        "CD_7ABDEDE62AF59CDA60BEDBDCA13049242DAF45DCEB3789967B7E6D43C5411ACA.1539.3942335820.621",
        "I_2EFB2E44A08CC0240E5F136E492FD5AAFD33E6E4C30C7415C463523A7D9CD20C.2722.281059034.284",
        "CD_542662E51FDBFBEA6DA0FE85EB364D5F9CA6EF91BBCDB6172E88F1ECB3E9ECA8.2403.3441390962.673",
        "CD_0748DB3A279743A043A27A29652B890BE80A51E24D8B834C6C112DDE493793F3.2655.3853119292.666",
        "CD_AB754770CC19ECF1708863E61B4513A3C8CECABE89D78E5D727A64FE3F1CF111.1937.3401591082.928",
        "CD_4C30D2B0F562E7ECB133EDD52DE8120D85640B338DF07115C2057AA8BFDCC64E.2418.2479478021.675",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.292.3433342998.188",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.292.2112956388.188",
        "CD_5F3A7D47CFF70177272CA0960C1975D28A99D9A71A82E07B0FC43A060E86CD93.1129.775384712.367",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.1756.1997114054.2505",
        "CR_84BD991F6EF99EE3A0301A722C367F9824F244968ABA37A64CDBE6307013A8EC",
        "CD_AEB1302AC843DE3720FDF5243FA6FA29740C3EF6F87994A8A6D26F14FA996B57.2244.2239427983.242",
        "I_A52F0BAEB12B27CF368AFA80F6E068CB06A37904A8B7DD0285DE45F269076401.2704.3647049337.282",
        "CR_25C2E8C327D4AE50AB0B89215561563C42973CDF72E4E8164880862FB1C155CC",
        "C_D4A704CC54B92BC73DA5A42C080CA819D44C09E46E5482AE8726E1C416015730",
        "CD_51F9DAF3CC7D989B6C98735C3A5D88F91E31E2F8AB94B8929062D8B11C53733D.1365.495755051.359",
        "CR_C12F1595FB14302AC3BDABF5969819839654D56DFF22512157B1EA1002807534",
        "CD_98233BC0D6E21C2CA3187CB9E2307592DF6D759478E209568F3CA340985F3F72.1164.3334768065.4217",
        "IL_77E74ED5440E51C61208706C04055712F91B723AA0D26A67B06D8D9D686A208D.2736.916966611.283",
        "R_40D59F896F1B4CD78A547B4E482D63447FD0237E73E28B731E2036C3CEB6A1F6",
        "__MethodProviderRegistration",
        "I_5521BAC18B4B7EB89F0472F31BCC9473062E039C6E6A87DC815B43A5E2BD334D.2712.1825232714.303",
        "C_39E75790979650C120BE778856591D7E59D2F85DDFBB3BFF1733B73153D5DC01",
        "I_1C6A553DF33F649A465BA3DC6148CCD3D895AED36C59B785D940AC6F55611A0F.2718.3848490697.279",
        "CD_3983F17F5C72021A2F47538559532CA9764ABCC7F5CEB4E220AD932FDEC0C98C.2588.1661577105.1706",
        "CD_68BC4728EF0C3D45D60B79F70F4A75292BFAC912BF35592AE5379D2B141C6184.2550.509326757.1754",
        "C_EE6336C6D36FEDDA61F36B02415A0E5B7023058D9F095387002E82678B1D9C02",
        "CD_00CB5505B362BFEF8A78ADC9829BC548EC024B6682159D697B0077E15B2E844C.2580.491790531.314",
        "CR_97447B179623D5781456C076ECF72BF0BA286864647387B5B4CB924FA06A5416",
        "KI_311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        "HeaderName",
        "CD_94F2726A101D2A1E24F4ECAA94319E60322E839528620ABF5ACEF14DF1CEC5F0.2417.938687106.673",
        "IL_227FDB4BBC644BF919A882A6D6A822A0CF6177C421C416CC297E11CDAC01770C.311.1001239533.249",
        "NewTag",
        "CD_199F8BD2C63EA7935AD06C4A530278FE453B1FE80DEFF18B6BDA97081D8B8C0A.2389.4253342158.1054",
        "I_1CAB6CD0CA026391202802389688F029EA197A09B6936787961334A89D4FB25A.2714.1260187424.277",
        "CIM_NetworkPipe",
        "CR_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2",
        "CD_85595B738BE1333389D2F0D432EA1652CCBFD76389AC1442A504C9C8DE6CBD03.2583.2192913841.914",
        "I_6194310FB3143CE749EF6BE51E65232F58E95CEA58F941B34B73C8A9D543D720.2677.3405508569.276",
        "R_AD487B3FC9584EF96D3B725B40AB8D9F6B297B81317936773DEE6E58A169FE11.1489.3513517924.570",
        "CD_24519863E7254E1D9B6A25D977E51817C344771EC7B62C4251FDF1D411B6C533.2542.1325524774.626",
        "CD_17E7C86738B59EB875E05FB8D2106E803DF9A9B0E69B9182F0E97C3BD2B3B709.1463.19435415.857",
        "CR_BB1864ED13E60C22074D25C584FF59AF554CE92715925E31CED372950D2F6DF6",
        "I_84DBB136E33A9D65B07CEAEA34726CC95CE2EDA4327BE7B9EC86367DCA1342F8.2451.4135234177.360",
        "CR_F2984F836656306DFA8E2AE41D08C60DF8CD88A0E6AEAAAF9B747A88F60C0C5B",
        "CD_8A850E2C8F4DFB2AA552BC5AEBACDE4A8D52D7994E741AE80C7E8529557980E5.1564.2920737640.534",
        "IL_FD2C5547FFE1F8AE5543C4178384019AC9604DE68E2D71F4D4CAD1DB441347D3.2664.107295753.283",
        "CD_0A4A77B99E06085632BB6F0B20A342FB9C17A36A3889D5E85FF4837055C41CA3.2098.1073558724.574",
        "CD_0425402C13509DFF88225FEF141C2C3B4560C26951659B04B326D2928241FFF6.1600.516127662.1511",
        " $(,048<@DHLPTX\\`d",
        "I_386D85B50BE3D60DC60B4C867F85C74A8FF08C6659102D9DF5C88A27B2D9E507.2696.2549780244.273",
        "IL_0A9C692AFE67AD32626E68B31C73B073673CF431D0AE38A2B95919B7B7CA46B3.2713.2263682030.281",
        "R_92C92331781DF35B14382C2C18FCF4F9CE2A3F0D9A27B8F847108A01941602A7",
        "C_54D799461F62C50F4E33F56D51A5DAB2D83FEA13CE51DB9E4B33C4043A6D5638",
        "IL_1035B0F62EAAECC9C984E7834D0AB6A9928506852D8C840D14F9BAB2AAE4A68B.1535.3905241281.262",
        "CD_216DB76437F8B84D04CA1AE8D4A960CE5436A185FD2383065B11CC5178009ADF.282.693216599.818",
        "C_0E8AE3127572E18A442A470FD92690849C0B09462B19ABA7B3E6660DEABF9827",
        "CD_12B929733A58D0160C0FDFDB23E8B6DD247E7D1693029B77B484D1BBA4C89AC6.2526.286193948.634",
        "CR_BE7B96C50A5D954A89D26DEB913105A5F4A1453B9058D1ED2B066A1ED47BC2A6",
        "I_42AADC48E8CAE9112EE9681824CCBFE2E91BE5E02C5B39F0A8D63F75CFAF0152.2764.2388448805.284",
        "CD_0ED8829CD55CB10045BE12FF28DC63BFD30CC65BF9376DAA6A5D15ADE3CAC700.158.2662187714.250",
        "CD_6E3B4399FA4EDE750602EAE85FB276C1B64644E78344F6BB3EF3F442D17FE8D8.1171.3503037272.339",
        "CD_830BF8BFA5BF93F39AE2488CCF30ECCF24868D5104B63DE9163FCAF3C26491CA.16.690052606.3111",
        "CD_3C22EE36FF380B4D0BD35CEC3718A5763A272DCD4163EFF8590784BADF9E36CF.1782.2494613822.798",
        "C_FC87001C8A293FEE277D61D93452225F44D005BDB34C116869AD3A6E3FF54998",
        "CD_2C20DADFFEFB0D4F975C63DD75672A978E1E07AB4428454CD70C2EBDF11D6E21.2569.1857266931.286",
        "C_07A4F1F03F4FE5CC2CBB8412BF6A16EDD132FB8AC435D217731A7A09A64C0DE3",
        "CD_B1BDF04F409DA8A1218BDCCDF869651E770462250C203BC00DEB8F3479804AE1.1744.3725372905.492",
        "uK630l-",
        "C_3ED39A09F7C28ED81B80D1B393A95B0BFEDDF76F149562E9E7C25315FAC12EAA",
        "IL_1D427920F21F3DD4BA01BE50F4E02BAB83B4B3097E5011AD7F3E266529D4FDF6.2706.4084289774.291",
        "C_244569773D55238A38208C15D2591921F135D649AF755704CF3FBA521A0F7835",
        "CD_0E57EB3F1A7D6D6BFAD5018903326867777DF9485215366835D9D5F0137A3957.276.1095787422.178",
        "CR_D3CDA97FEF298BE8B5C29382D62A09C47E793CC57029F401B975F6F8DA62C223",
        "C_FD962A7CCACAB88D552FB4EA114CD68ED5194A98AC098089803CCB7DCC90E78C",
        "CD_F9806F1F2B507793E6A71330B14A8A23FB4580D5E9F8AB836C72D241C50417C2.2560.2014813480.767",
        "IL_E95DE8A58F7A0B8BE8199A37DC9F2A4739FC0BDFAABA87D3B8EEB2F9DF7ADC4A.1806.922661647.380",
        "I_EB041A3B8C4000AB0CC2CDFC016E1E9D7CEA420AB2D6A1D6DC1EE63EB5D1E694.2676.1673060838.269",
        "CD_838E13828F10196D3F66F7B92E25AEB70BD0868AFEF218970174CFCF1AE4D54E.316.2641565953.462",
        "RemotePortRanges",
        "IL_2779ADC1050B1FA8CD2E2378B89E40BA7F999263644D0CA9A004420640DFAA86.2725.2641473776.275",
        "C_88F114F729A668FD2C1B85D0992A0E7B8F743B0CB06B7BE867F689C1410526C6",
        "CD_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921.8.1.12701",
        "C_3FCF421D60410804A360FAE7235BE2446D112B7A0A3E80FC873A1B1F4A21DAC6",
        "CR_1A9E3B957294E1E2A3BD1A3F9CA79E41F6CD3130E2786884F3F69878725410E6",
        "C_E38169EAE55316E8907E9126E02D64E6E2282AB67113E662A217703A29FB0416",
        "03r69<",
        "IL_ABA4DAE0EB695E77576BF3A7EA335DDC9FEB1F629AFAAC7C7FAA67E875E659E4.2724.2583323054.288",
        "CR_CE60FD48B8554305653B63F3FF89DE9F487AA367010DE6A864E4D5A7550F953A",
        "IL_479D83150D14FF0C733BA8DD8012D4E2725601DEA4D5DCB8EC39A05FAB4FE0B5.2683.3102955067.277",
        "C_1DC2241284EFF53B894548A43C065A88DE07D18C8E76DF7E050932758E817728",
        "64F507",
        "U6000",
        "C_D4D7929A8312A6DC45326BF70047842109EC7C6FE50B4DFC14E0212EF111A093",
        "lptx|",
        "K*`TE~",
        "IL_159E21DE8EEDD01D21B4AEFE684201F3AB1D9BFE4CC6CEBED02BDCC2E30EFCAF.2692.1185386407.283",
        "CR_3035B16D02866D7EE030442132A18B7ACF25E1EBBE385D31EBEA6DA0AB2F86A6",
        "(804dhl<",
        "MSFT_NetRuleInProfile",
        "CD_B6F5DFB5FF9D262A34F808F6064BE3724B862C376624E6B9C572552907B49F21.1469.4229813137.742",
        "R_2C338646F5C1CAA321EFF2BEDBEB6839F57D9EB755DB455A7F244BA25566E1F5",
        "CR_7791A711A5B5A7519657E417C7257B17DC36A8205BDFFFE1C1C88B07496AA0E5",
        "CD_B59800CFB156A4D66DF19514C7F17F6B187814B22A45C5335652A54E148DEA54.1088.2837398344.233",
        "CD_DB064F6F00AC6B8D3FA5B61DC9E5BA4F856D1F834E95E30D538DC0E3B653D24D.2055.422004350.326",
        "IL_3D96CF7EBAA8465EF07F9D6626CAAC510A9695CFEEB1774A41007A63C1CC4509.2682.777595413.288",
        "CD_8388B68C4DB97845C3C1C2649AA6C6E0CAC0BF4C68420F762A0E16A42522910B.278.2382771809.584",
        "CD_01E49F2BC300B8406F535D199FFE723C66F3CBCD052B872FA9DADCCDBACAAF50.67.430747692.617",
        "CD_7DFB02A8A3DB4C4A23478D6CEE5B5BB46A9FBA5A931A6619DBA69F0BACAE545E.1609.1616696193.1592",
        "IL_F3B112B202A2190E1B5B0BCCE56BB6B60FE7D55DF5AC265F06D09C0F840B92AB.2688.3231167761.274",
        "R_D08323D375F5031C5977F7C831287E1CB6B4B4DF2FE32E858BB25E27E0DA10CB.295.2157567501.538",
        "CD_90E9A4B512231958877A8081A43A190212C66DB13315174B31713DA5090FB2E1.1226.961928474.2455",
        "CR_9ED4C67E3712DE07C86D1861FC69841608A536EC7A7415988B2BEFAFF875D077",
        "CD_6A626287DB2D297B2933F0627963C6CDBB9ED9EDBC6F1EE6B68A428340040D87.148.2879344078.1414",
        "C_8B7F99C264005A257FC33FC5B8BB55F758A76C6761D36338B6FB1E0C0931778A",
        "C_D026E850A950A9D63C34F64A5E38E45C3571A8EBA044220775DEEA311EFAE9B8",
        "C_355DB6CE31803BDDBDD2FF491BD2AAE24F28E7ADF16402B3F3B9C4CF695702EB",
        "I_E4B5BA0B959BDDAC8250BA9F8D8A7FF702B15C5A8E8D139A523CF672F723014B.2736.1946317492.345",
        "Reference to the dial-up connection credentials.",
        "CD_1C07FE540DAA3F27E5D401076DA847989EAF991B378575B5B751936E81935DBF.2568.341343985.327",
        "CD_F22CF0C74A9002156D476F4DBA031C7F3F706A1A94FD4FF91611BCB6BD8FBB7C.142.670242507.587",
        "I_13264DCC489ECDAD5E2F82808472499CA26CA3983AA02FC4B2D2BB93C3215EFA.2688.1091158563.280",
        "IL_C1051F006B768D96E4FCE6F2A8DC0C03012ECC7B68B7C95E31F5861C5B982207.1534.2812249662.333",
        "CD_6AD386ADF7788A35467E769D3EC3DE89211503B8A449E2B53EAB5B8CCD719DFD.1202.4131482504.356",
        "C_174A2AEB54BD548E043873CC69AA038DD6DC3AC5FE2EA12ED542CDBBEFBB3320",
        "C_8EF0A83E2CE3C1D36E6DA951CB64B432165D8447385FAA4B9621140D1ADC2405",
        "CD_FBE6F235041E0E3AE3541BE5BCDC297FFC96D908B951996F32623E2BBA30BD16.1808.264706186.979",
        "CD_4C5A81206183284769D910458D05B5688A17E07BEACF6B75FDB41F487B4FC2AD.1185.640681428.4905",
        "CD_76074162D69587B846FBF4472AE9BC3E5C1AB65E11D4581012E58AE49E30233A.2513.2005468912.1572",
        "I_1AA676A49D2A60A89B79F842EECCF355EAA840887A4724B8578C05B96146D815.2701.3388349169.281",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.287.1440891392.472",
        "I_71149A9D96E4258EB27FA2CB879EFD22F7F2AB97FE4D855030B675DD7C07C99A.2688.1300148109.274",
        "C_84E66371578A693D41C473FC60626C4635EC771C8D69CABCA347D398F845BB0B",
        "IL_125EBD60B5A176CC0CB4DA9D052CF807AF1348E87543C6CB873D5B2571A3FD2D.2728.610653683.291",
        "IL_4ED6DDD5E334C3E7C1F10D522D838999BC5C70AB9504FAC6982D79F19F10D56F.2728.1879650429.297",
        "C_371FE29547194A0030F3A243D08A73EECB0D2D9F84C9D71BDB0741B3A2ECA618",
        "C_33CF99EE359367737EBFC91E6221019D46F7219044317527292271867795E5F8",
        "CD_75279CD6D466662C696F5AF2B95C9CB489791F508A8D94786ABE884A3FCCED15.1565.1936593974.3200",
        "CD_CCEE854B1D930229DF6338E9BA0F93906C83079906FD6A63C0AB3CDE6382DC6B.1600.4064857672.1512",
        "CD_B39F79BEF0550EE7F9E981A83A152A3A4B6173B3A32D2E630E92CBAA2FE60E90.1389.2857269146.2517",
        "\\PT8`",
        "C_ED0FE1836A8A43CE00507F00708D770A7EF86A8D404DA2B6D5FE190709C3FC86",
        "_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1463.2542810793.180",
        "CD_9A2FA4B503D51BA72E7F874AA07B2D2639867C129B89B4AF2230D146C0DBAD9A.1700.1473516820.344",
        "C_B8A367B6799F63452F0D33325AE9B052BBCEE0513101249959EE38B74646590F",
        "CD_6F49E037E6F2BFB72144CC48C974D93CBE7417A8F27ACAB5CA25D34A28C29442.2310.1.141621",
        "IL_CB9407B4065E0F63CAED9A02B73B9B563740059198D9ED7DF28E5923A029E487.2729.298670185.264",
        "C_6645319666642BE1F4631A5D96E8D9936FE5918F64DF61DD73804D6AB3CF6C32",
        "IL_5D112E53A7F1BF6BC06E2F14C41342104F6E4429EDD1AF554DFFF85D3C6F4964.2697.1254321239.280",
        "DE3D8",
        "CD_635497AA16B16AF0A6344C164CBD027C88BF47D531661219C8D5DD2913FC696E.2119.3117294974.2024",
        "IL_E4B5BA0B959BDDAC8250BA9F8D8A7FF702B15C5A8E8D139A523CF672F723014B.2763.1906735264.519",
        "ObTrace",
        "C_755C3664114AA9097DEA3F0332A59D1FE1A4668C8001C4E97937639305CB9174",
        "I_A75BBF5103BA486B77C069B8CA6AC2EFE4159D8262D36992FB48A683A6E970AA.2694.2138979512.274",
        "IL_DCE59F6C7C63334E18A306990C7E3F40935D3C3094BA39D0D325874C32868A3C.2676.2443650219.280",
        "IL_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D.2763.2035422396.255",
        "C_6AFC03E55253E21322FCA663D825D0FB816D6FBD02CA8A1BBA06E585EA971CD4",
        "CD_DAF09917B9CFA8B255E2F8328EEFD54CDCBF643D68C0AC3F94A83078C17C15DB.2120.3395835428.1023",
        "CD_811F21E21E3C947C4246D387AC49BB437180C2FCFD12A53EC0886AAD37BFE4BB.1596.3350841239.433",
        "C_368BD7751F09B23F886CCF1FE4F1DF4386BB04C2EFE8F0B6E31192AA3206706A",
        "CD_6F5E24AC748A29DF918F7CE4EA2B3D8D867FC6A446F47DAA736D335E6FD33CDD.1934.2847843931.260",
        "I_A7E84BB1D3739B54369DFFE44BADD220083DD356D5C5AB46BF570D9C77D7DC19.295.4244090149.306",
        "CD_82389622F0014D1AEBC7CBBD10ECF0B5E66F16E4794C2046DCC791564783DD1D.2533.35068504.6394",
        "C_B2CD8F05013FBEF276E8256873F843ECE3B819C86E4A1470B3F32BF921471F60",
        "SDBUS_DEBUG_DEVCFG",
        "R_2C9E96C7F7E323559ADDB98919DA9CB9D792B77EB6D7DB30E98DE86B6BCDF5FC",
        "CIM_Error",
        "IL_8050E35366EBD2B887BB17B2204A953EDAFE2B0CFA9E51892B8CA854CC0CCE29.2687.4169237803.275",
        "CD_E1A260703C34591BCFE34DB6F56F5F56AD267BE75E7FD5875D186BD564A7F380.2639.3060625646.658",
        "NS_4556CEEB75C5BC1E6A0EAF76BE49CD0BAD23B80B2C5E3727EE2D4B8DA41900B2",
        "For a given ManagedElement and all instances of a SettingData subclass, there shall be at most one instance of ElementSettingData which references the ManagedElement and an instance of the SettingData sub-class where there is a specified non-null, non-key property of the SettingData sub-class, and the IsACSetting property on the referencing ElementSettingData instance has a value of \"Is AC Setting\".",
        "I_58385CE20F50E3CF60B5ED0C6A30FCCEC7D96510EE2507D6CDC84407FB8AEAA1.1475.661856827.233",
        "CD_F7A6177F848735C77C5C4AF5E078107D388009DEFF313E71C836D60D6CA7034D.2485.3801385210.369",
        "IL_0A8531861BAB7D08CB59A5C51FF1F632F24F4373BC1E9CFA3D4917C5D62016F7.2692.1010477656.264",
        "Units",
        "CD_C0C743A36644538406F13B21A67062ECC3AC599CBDDB4F077787EC27F2AC44C6.277.3815962185.598",
        "C_4A9BADBF619D7C360E2E222A1D05EF4C32E9769C9232CA2631F4E74AC78597AC",
        "C_A6DFC31459A93A4A25BF3A54459FE7D8268FC5E8A1ABDBF315A9D272D1046669",
        "I_01AF7823F90DAEC78BAF38771F45D60A37B0917DC6BBE974DF07B97707A15F13.2451.1886448488.295",
        "R_443EA03A729799AF7B722609B218862C5380ED55FDD1C6840B32FD56F51FDFBA",
        "CD_7660C01C2193732D49EB153B60D0FBFC8E4D8FBEFB0292EB549A2C90E8679497.312.1303447197.424",
        "IL_6DA2E915A7D0F1546EFC6CE718DD07232995DED8C409D2D6CB07F6041DAE5E2F.2717.4225387875.272",
        "C_D1786CF1703A5EE88ECCB609DF5C081BC2D647617B6872C7F1D52C9FA2FF8990",
        "CR_2A7832DB3183EDBB66AAA2667E80040F6CA8257F8AE4FF9540273269C8637D7D",
        "CD_D243E66B180D01D8A4F9FFE662112E7920CAE6094EDF1FB3B8BE68097E45823F.2673.2554208139.820",
        "I_07518836069F28661B2BDE63EA95AFE81F3822D4677A49CBAE5F594ED13FEBAF.1147.1898380277.285",
        "CD_D5BE8954257760E2F9A360077B191976128D92D83EB049A6706C73A364DA412E.1084.1259131202.242",
        "CD_7D26F1E16BC9CE86FDDDA09E425A859A3BF87CD94B9004A4B2B575CD1EF41374.2739.991778590.638",
        "IL_643C62C2DB1DA96A4AB1598E9B3EA5327704B17FCA98FC5E2D4F441497103580.2694.2934335121.278",
        "CD_A4DDE6CA06AA3C2825062E5C08D9D51AE25E110F246E7BDEFA87F60CC99DB06D.2656.2997459300.1078",
        "CD_946F4B9CC4FC67CBB30182CFEF8E5287FF27217BE36B1392758F9655E96E5C2F.1103.217478580.596",
        "C_B000D7C01C41DA9F495CA1E95B37B424DFDDCCE8C00003B846B2C7E67953BB12",
        "NumberOfPorts",
        "The share",
        "I_EA3F44F70D2E7ED47A9DED0CFDC16FAA76D816E5859ECC07AA403671E877A57A.2729.3261746862.267",
        "CD_93A56FD79060DE7C5C63B9201FEC3583B30A043D5DCAC083E3F4C84A7931B27C.2758.2191835297.295",
        "GroupIds",
        "C_17926F6B3829E6C995D27F0290E459C649CCD7CB59546F30038E7938C7BF4AD3",
        "Frequency",
        "C_807D424DAFAA138098488034F759F247CABCBBBA4E5F440FD767882727C292DA",
        "R_CE2777A1E2E8F0439A275F7E5E7BEE453C2145F60A592F57CCEA55492EC8B6F1",
        "object",
        "CD_3C9B280FE36066C71935582444208E7A035DCCE4FA30F0C0FD2BD6D3FC96AE2A.1351.3351889271.991",
        "IL_B5845F4417EB0A7AD195B60C8C70005F48FB5E07E5853923BF9CEC00A11B4FA0.311.2565700494.249",
        "CR_54B0E217B287F6F85D4DEAB32DF5A8CE4DFDM",
        "CD_B6F5DFB5FF9D262A34F808F6064BE3724B862C376624E6B9C572552907B49F21.2060.2518766664.872",
        "LPTX\\`dh",
        "IL_0B3D3B201DAF91954F37635E1B0484B26EAF205BF08C64EBC74A53FBDB057BA2.2696.3523574569.282",
        "-Friday",
        "I_D2E45D3626E75100691BE2B74400098FDF837DDED67CE9EEDDE7F125324E2AAB.2676.2477547688.281",
        "CD_A8F32ED73CC909392CBB6D2CFB5C52391FFF3A4DD4AE1EBE1F9D40C03A8C9EA6.2328.1.46856",
        "CD_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D.1082.1603491236.656",
        "I_4D19A9540E339C1F23CA37D014BF087DC3254F2AC903E2C4A3F083319007310D.2725.2805528136.294",
        "CR_B8B1FAB8A4F90C512F053D1AD5C7061AC5CC502A1FC989312218B5B68AB25BBF",
        "I_531AD7252F13C937D05139940B5914F81F6E4E6063DE24DFAB1C3109164C7352.2722.3056209734.277",
        "CD_C77839C5FFDC5036AEAE664C904195DFC3B53888BFB351AAEF0E033BF5CF3DA8.2670.2672253017.2081",
        "I_532D8B7E6990C4CE6AA56764F7998FD3C85D0E0296E30EF8F69051435FB58217.2725.2776454089.276",
        "CD_0329C1D1556F3FE0688DDABAA7029791319A9617145815E21A087B12FCECF5EB.1753.1.23682",
        "I_0438CFD6BAD6781F386E6BCF577C81B564535404C193A2FB26CE77A03144AAFB.2697.2906461808.267",
        "C_5B30FD33F8DF746A0ABFA5683DCA5E00E4D0D5FBE9C94C2B951EAEAEF259A109",
        "C_5CF48B4594AF5A29D8F38D01C51E1EBAB43B90EB9606F532D289B128EB56580D",
        "IL_9AADCFBEBD2729049C83114BED85D30D2725084DFCBD70BFC18E54B91E6865DF.1076.3805284346.338",
        "I_5D112E53A7F1BF6BC06E2F14C41342104F6E4429EDD1AF554DFFF85D3C6F4964.2697.1254321239.280",
        "CD_99150BD9D0963359046E30AE0385F17D4AFD0667F8DA5119FF433CFAA1D95BA6.2196.1110722567.1372",
        "CD_972576376A5F2C5C3EBE5402A0C00A72BB51E33D448C072392A8C26DEF804EC3.2087.1300814291.2771",
        "CD_4F17D6E5233882194F1101B03A9C7FEE8B9841B9DC06F74E752FC74576857314.1542.20863335.570",
        "CI_C20D4B021E0AFFB61E5D90A8AD1A949CBA948B6ED6C506FD3F623477DE2DDF5D",
        "C_486730B0C62C887E945DF074DD24ED6717120317D02115D40420B0BF288FF266",
        "IL_3A223905E9FCEC4800143E4FA3BF6EBE3B648E13262B02F9FE156D1A4C86F538.2707.141074353.314",
        "I_AB4AD3FE4521911441D375273A1BC7BED386BF6D625BAB238E03436FE4742989.1015.2947338353.314",
        "CD_700A223C2BE9D4D6498C555306C3D6D2A20F7ED7C0635EDD45F157ECA54B627F.1389.2298617459.338",
        "2 = \"Do Not Continue\", meaning stop the execution of the job and appropriately update its status ",
        "VerticalBlankingPixels",
        "CD_6745FD83171C912384932B2460F0A939D3A35DD708158F930D2B33D61C719953.275.3423713450.675",
        "C1AD03FCADB98C44B2.2651.4143701268.258",
        "I_5BAF9AEBF8B3A3D905F1192ACE407D663D7920311211B6A94A34DB54B12967AB.2705.701252013.291",
        "C_FB13906D346FD1937AEB762793605AF720F07CC036588017ACD7E44E97A28121",
        "Installable",
        "C_2DD5D2C8F7B69285DFBD211B8783B9D8D8AAF5A927EC709DE65B6AC4223EE339",
        "CD_896B6F9A9E07C666B49D000879A54E67F9CE0EAF2B8B7EF7BCA31E7303EC222A.1650.3665407438.2951",
        "Composite VirtualDisk Member",
        "CD_C62347F459E9E9A6DD2944145D972E253F3D3E7B606F67BA3892A54A2CDCC625.2426.162626403.237",
        "CD_245A60CB3C83282C66619417FDBED882D5813DD3587BF8C3DB855021F3BF28C1.2528.2816538704.549",
        "IL_E61AA5DC6E2C0BD3A80E025E1E087DC745E590F1A37D0E32323F3F0F4D2A1F4C.2679.1358316535.276",
        "CD_8790982EA8A2F676FD9CDA897DA0E6725B2E8BAD006C6504922E2BDCF610DD98.2543.1660186336.768",
        "CR_43D2FF9F27C9DEB49402058FFFFEABC225D67F17C30DC663FA2980525D05DB01",
        "I_C2629265536E4B67B7CF20841D93F9F9BBE1231030610DE7397B02A91673D013.2726.559372530.274",
        "C_2247C2B5B87BC8E4D0B8E118FA62B1FF7CB3D0D671442D7A0C23FC83D94B254B",
        "I_1ADA3D3FE41167FEE211ECFBA441482721793EC4D7E84AD78DA64C64BF16A920.1534.3393465649.187",
        "C_55610B2834CEE9FAD49B0C8226C89FEF7A98C0A18580FA893D81FD8C8B007A30",
        "C_BD82A3E4DAE96B9D019F35F334395312B224B9780EE811EA604360572C2D700F",
        "048<@",
        "CD_E4B9E363341E220C0B9387216D08857F2822C5CEF7B76EE54306D729CC7A27DB.1926.575040015.254",
        "CD_498190A28B0F3E8C8B0AFCFFAE238D6B691B0B57B3836158124AC145A7281391.2020.4036856102.771",
        "C_11DB2545DA5D06D63F49C8AE879C36DC6E19B1AF439CFDC93A32FD7D7D63A18A",
        "CD_1A551646721AA7A2EA278525964261E10C989429101DC80D914D36CBD92BEDBB.1480.3167970506.2006",
        "CD_1E9CB0A4B1D9D15808A86CECADCE036DFA0A4705D4A5AA99713EE38A81604E60.2666.2439815254.775",
        "IL_83845EF2309B741720FF4657440410FD82D34CBF99EA931930FB6ACC3DA7DA92.1465.2710273172.334",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.2169.1.14612",
        "C_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "CD_F9B6A0476E6887A5D60E40E12196773F8286002879AF8BB86E557F0F835DA372.1927.3810963445.304",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2414.2112266181.180",
        "C_7D3C758EE8FB44B72514B3588512147905DB19A0456725381223C5A506626F7A",
        "CD_2457D9C98F2D638D85934862CD265F309B9B1D792C3B2C7F8E2851CC28A53072.313.2932863068.695",
        "C_947A6ECFED1300E5950B4C8196704C2B50E4463864CF2615B27D56E94A95716A",
        "IL_9AB98AB0E736A1AD0C7F0E35ABB99A14009779E12541D6644FF363D825B8CB6A.2707.2144343765.300",
        "C_01E1BC020A762ADC8945816F21D23E994CAF727D5579290522A7B046C6C167F5",
        "C_97E0533A6FD37D7B4F42C138D3F910EF7AFF6D78F1A820A11C33EF12521B5B2B",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2736.2113456816.348",
        "IL_D1EC70FBE41F163737E8EEA318CBECA1FC7FD6AB6FA4794FE4CDC5E47BA99F5D.2723.4232706374.276",
        "\"&*.38<@DHKNQTWxZ]u`cfilor{",
        "CD_BBFCCB444CF66AA09AE6F15967A6865175BB0ED216D19970A7988B72CDF0A3A4.296.4083635304.4422",
        "CD_FC7FFCA0C7A5D89DD371B2F0B241E87A604E23DE48746B1BF4F9C2034FE72A72.1389.2433549545.332",
        "-Thursday",
        "CD_4CFD343F89F816CAAD34AEFE39C410FEBAEC57C4ECEFF6313E9D0F9D93057526.2657.2243307746.241",
        "CD_F33B13E58D7A9AAB64E31B8DEDA19CFF557C834DF5EDDCB1F5F929CFA150BD59.1849.3139714795.352",
        "IL_17DAB2F05DAF278660EF7A9033EDE44A9CD589FBA9EFE2D8306DD6119DEC472F.2736.1313350136.278",
        "I_1B7CD8962EF14C01ABFF5BF5BB68395BECD5C47D2A0E17F4C8EE62CF1FED4DCA.1805.413065435.264",
        "IL_3E4A819BA8CC28DB3EBF2245BDD33C8862E18CC1F006DA28F99A8DE39B4F23CB.1014.1796014734.286",
        "CD_7C45DDC3F0B908F61AA329F5465AEFAE6329C442DE4912860BDE52AD5F8B5167.2545.2811390894.816",
        "C_A38536DC7BCBA3E56B010D4CA8130EE7B550EF925A37CCDCA254F671D413FD08",
        "IL_2D962F6EB59E79D0C6FC1314BB5FD596C3751CC9CB846BD5DD9F15C03FCC7741.2709.1448165507.299",
        "C_B9093598BBFFB548EB3FF6B2B67BC96D6D4830488B1896E4F8B9E8CCA0880EB9",
        "C_920782A19D0C199BDC99CD6BCD549187886CE3AD64D29AEC0D7E3B1ED7356A9A",
        "C_2C755AC62396ABBDA4DF17AA88E448E6599BEF0ABD01ACD402D70497EDC686A8",
        "C_C5063773359C977AE8BCD38A9E0C82B16648D007322D0390A3BA0ED23E18A8CD",
        "CD_6E24E0F3B897790EE4AD7CBEC57A77254DFB861B7DD873ABDD3B8E12E255FD64.306.1.9042",
        "C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "CD_57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA.0.2698991554.1940",
        "IL_F7892AFD6D9BA41C6D80FE1ADB06C631B78639A087981A07715ED269E2F38DAD.2764.3909238880.290",
        "C_79FD2B1944A0E8569231538101AA02032B2AA1FD92C317847D2089CA52F4CD72",
        "18E452130A3BA",
        "CR_2962574DBABC9D74020CE2DACD4F495EE01650AB6A58D69BDFEB23855FE777E7",
        "CIM_Setting",
        "C_C05C95F46166D09617D40B3234DF5D418002473BC054BEFB1B5410F8425E2AFA",
        "FileIo_V2_Create",
        "CD_D5312D2CB1C1201CA5C65DFF999460FF4879179CFEF4C66A96B6BFBDF88AAF0B.2422.685413368.399",
        "CD_1052CCD88A2957470D93AF17CD201F722846ECFECEFE2021E6E5FDFFE35BC5E6.2658.1518633469.699",
        "esOfDriver",
        "CD_5652DF4B99BD8BBF66A57878F7DCA92E59A0F6271A501161B97B1009D0D4EA8A.2401.1345854207.4722",
        "CD_DEA224BBEF40A5F2D4A2CA371BF633744D610A42E8901085FCD10393CC6D8624.1746.3011791680.494",
        "C_48BC67131BFD22F5DA28A903403A15608DD05C18742BBFEFD4FFEEC39F82B3B1",
        "CD_A67F6CA5AD0F3F082B7328E37F2535113EC93F9273483374AD4B41FB5A9EBA2D.2435.2555529523.8043",
        "IL_AF6BF933779CAF2D591175302290127CB7DAED56AB54C5E0695A8418F8CF1A54.2709.3626734935.295",
        "IL_DA69CC6321E02D0F3D5F134617631BCFA371EC60531D22F447951EA5C0B78733.2681.2658208212.270",
        "I_C52295624F06C940B122D80C080F06A7E8A3B72E8DBB8DAB3530E90B3C01E0C8.1500.3783951989.277",
        "CD_BA3D37D044C0551633D73D3A898C87E3F05ED306B67D594AC8B13EE30AE518F4.1187.3210664895.1604",
        "IL_83E79CF7F4D04D18333CAA6D37C201FEB5876774E73CDF5CF61FCA1666B6F661.2508.3480842554.325",
        "CD_7A2306288BB25A962F3F7A0DA1538731F7904679B3CCE7E9A9A9F2638A6325D2.36.3540887931.376",
        "C_E8DCB251351DCD2ACA88B24D719FF7EAAFED25D4F7644A276B6EAA9D145ECB88",
        "C_CDB78955683E4A4FEC301253A65C7F4393788ECFF600BBB16F696704AAF38583",
        "IL_69B780709DA4835635B0B7E8E54790634975F2907F04C0691BF6F48A6FAFC3A6.2689.1697251585.279",
        "3C53E1690A3A36DD370F35BF62AC7197C00161000A38E681F23C",
        "CD_8950808B8A2EB8D5AE895F8D253EC27AA46290C0D9FCF34907198A4AB3C923D1.117.1263327408.367",
        "C_5E23632FA7BB1BF329A2928789D28708FB0B1FB5501D722BFDC5839EEC3CDB56",
        "CD_F8950447585CD6743131FC688F3AC5EE4D2DE57B4CA01C83E91AB8FD7ED70E93.1797.3574490723.339",
        "I_9B98F8669D7BFE6D1E546081833BAAE57F20F24BDFE0EEB328E9AF7526175F40.2693.4151873662.260",
        "CD_76074162D69587B846FBF4472AE9BC3E5C1AB65E11D4581012E58AE49E30233A.2473.3586992480.2790",
        "CD_A7295464CC993A6D391787B800AA99F01A743758501FB7C1EC84FF47700AFE8E.2485.2924618995.1744",
        "I_8ED11B10BC4CF8DCBB5B34DE07D8FB0C32089DBABE4573BB4400D4C77C1BD2BD.2725.3184280915.273",
        "CD_40A24DF0170D3D162FDD7C849B2D46C54DA402D695FB97CA12BAADDBC62C83AA.1073.3220317514.5581",
        "I_488680B9304A8CE240DD3162C60ABEBE0653A1B3DEF56BFB0E7A2CB3DC6AD158.2460.966863555.365",
        "CD_566A3F0A3752D08CE0ADC81B0285E070B30778837B6AE3D337DCE7469AD2C7FD.113.2700359476.364",
        "I_77E74ED5440E51C61208706C04055712F91B723AA0D26A67B06D8D9D686A208D.2762.4048948087.283",
        "I_734CDBB0A96C4D756A7CF7167930A1D2F245EC20E3EC71E3463DDB83E8979E59.2696.1604875047.269",
        "CD_18CF4DFADB65FD9009884647249EF310A7B2E05DDBD0DAD1404A0AE55A5E4EE4.1135.1325045813.1018",
        "CD_9360A998406CA5A9FBE21BE25205239B5C71A89280B329F4858B0132F126E6A5.2652.1953568149.356",
        "SCSI Check Condition reported",
        "C_AF9953288ADAF46B6D6FE0415DB0AD08628D78AD327F2410CE001231635E7CBB",
        "IL_FC703C2B714C1AA83C6B989BB18065B4E83C7BAC31B06914805DF0A8E68C5D86.2698.1647053630.269",
        "CD_AE91D46A333A370D09132417089AF125E776EF57E4B0B159D0C6DE0E14D65D5E.2419.3832380551.397",
        "C_C48F0C590442CE3C69A9849B8A3935A404E7F5CEC09E5AFE1A03E881F81C2AE4",
        "CD_BD60955B2CAC10D52B734218E0C4D92BB3CC99639B2B503B8D221494695B524F.2733.2883239900.381",
        "CD_3C0F796244DFD96C7B5E800FBA3681576ACEE35F389BAAEBD707BBA1A2C07ADE.1530.1588636483.3582",
        "I_1A5A899BF56D251525103D6AF5EB287E924400C4FC43FB3320926C7A84F72E0B.2692.107867486.277",
        "CD_A98E3C9A35EBB8DF63FBC398162D8A41BEC56D5DED2307F1A6E1711FC01974EF.1193.4156141780.607",
        "CD_1319481AE46A12CC16DCD2CF74CC91B9F47EC011AFDF72991BF4AEE0746B16E4.2387.3948016811.692",
        "CD_68988603F70E94DB41A96D6CCAF4C1247D2A19BC8932E751AE8871C31295C890.1219.2120804301.362",
        "CD_2800F9F89075C56302A7CF7269B5300116A62BE579546FA42D0E22E3EA14FE1F.203.3112660245.609",
        "C_36FF9B91B98151142333CB13DA769BB44A2F51FDE32F09FD4FB06D672F7B7CB5",
        "IL_27FAEA5F317A7D777DA2A8EBCBC3C42776D2CE02DCD68C27018D6EFB15E2A7CD.2485.3040547790.263",
        "C_9E5E1C32A05CDB4AF1E31A2A9954312146F5F7F70A8F443E107ACC81D76BED7D",
        "CD_1E479EA43F980E7621076F4BC162A6B6EA5A784E496473A751456B83F866A63B.1872.1.24875",
        "C_9D3103F1FED20F5A89A186A2A5165255DA3A6E898D7F2AF1A34CB11242007EC6",
        "CD_F9B170C89D56233A8A5661042F3B670A16FB55B73910DD19B9F3814C67D2D427.1677.3018233541.278",
        "C_CF019908D018696858253B4DB7E2B0B890C35E62094F820AE236F7B784A381ED",
        "CR_610AB796758AF91BAFAAC5773CA30FA987962CB5B589ABCAD3D6EAA7F97EA9EE",
        "I_AD7D6DBCD9440E36FC7987418BBDAEC267B129E90DAA8862678D90C76E8C8157.2705.3415885812.296",
        "I_886C9F8982A417AFDAA51FF78BB9E9B6EE19BDA8B9BB937D782CF5D5173B6652.1147.1762140494.344",
        "CD_034DC06A7BA24821E2AA8A94509CDB2B6BBA02EFDD0801948AE379D7CD46E5AA.2392.1.11351",
        "CD_BE6093C5139ED6F3240B5CB2E75015E9A86B9CC5A18B658B35FBB879B98498B3.2651.1581795273.674",
        "CD_4F25ACB8ECF47D599E574DD3B686E0F1CC1B9DE6E15EEFAA36DC6403BE5670D4.1350.3579967052.1766",
        "CD_269DB88603C265BCA5F6044C1F072210AFF0C0C241B7570BAB9B5F97E1D62DE9.2639.3159585669.1561",
        "CD_3863CF198183B50B73BF68A52390640EB8E4B2490D653E0A1079EFA26ABECE5A.1219.563655317.1100",
        "CD_0B714A230756027CB9D944F3C101E5485E82B469361846E74358E5EEBA5C05B7.1084.1812673791.607",
        "CD_9AEDC27392ADF6836FDF14F702636E837186EC380D2BECF38CAA9ECF290ACC9F.1068.2255763117.764",
        "R_51447A26417532B0D1E85276A6FCB955003CCAAE5927BD755A45CC87195E9484",
        "IL_614FEB5198DB6356C7D4E70E58F0634936BC6DE530AA5FD952207E56B5A89D3F.1635.1118994179.316",
        "R_850274BC1E936428F062333698AE7D353A4E199CB83F91A5477B194BB0B5210E.264.1225463278.520",
        "I_BECAB6ACE8248E8415C252795A06585542E1A91EBDE67EB39D02A7C78C2398C2.2674.3732393807.272",
        "CD_2CEA3682CC09E7F94D9FBC1BBA63FC6DB39872E53B9187129DFF772A12215DD5.1932.2910998451.257",
        "The requested ELS was rejected by the local adapter",
        "CD_F2BEF717752C099CDF2C7677200AF2332E7D1E48B470B17CCD440B8D710B7A38.117.2857826227.4787",
        "CD_D56193964E51CF773304523DD4D95B2AA6C5D33866F47DB7D43681D0C19210B9.121.751439923.536",
        "CR_FC7FFCA0C7A5D89DD371B2F0B241E87A604E23DE48746B1BF4F9C2034FE72A72",
        "I_8DBB6B81B0ECA779465EF83F2E802D970FA3FA7C66652674903D94982AB335B1.2707.1521999461.285",
        "I_84C50CAE138BE8DBF0961918247F6BEE4A1E2653F7AB56ED2DAD85047B7399C8.76.2268304904.305",
        "C_8804D243AE7A52758E6F83E5472ED92BCF2D0EC1642375FE251024B3FABA24DB",
        "I_7889954D52FF20BF7565571F0FD6333FD169F3543EA69D8115107DCE82865D15.2722.4108895057.289",
        "CD_3935D6345388A245E9FF50F1CD42F69CC8FD444FF90B93C789385D0BD31672F7.17.2007166480.652",
        "I_A2605C4831B27A2CB7042C949259C008D70F63B10E860129D6A8C6957225B09A.2722.2159843468.276",
        "C_0A3410B55194CD497491BCA1230201C3E2461F6D19618DB9AEC90B35F8D933CD",
        "hlptx|",
        "C_1283D6E2E269ECFAA20DDCA78E5D8B7B8AC13879915B95F38BE4B062F89C60F6",
        "The QueryId property holds an identifier of the query which was canceled. This identifier was originally delivered to the provider by the NewQuery method of this interface.",
        "CD_D9A10218F30FA4E428551F3E416442A7D38AB8762B28D40A8E89B4D3006D1DA2.258.2129965356.6375",
        "Maximum transition latency in microseconds",
        "IL_9CFC0980194C6A9C8AB45A36BDF6696661A62D18A171E8D534441323B3F89DC7.1015.1280045618.340",
        "CI_20F26C6236C8252E1FCBB508B5F5781449304BFBC276C5E3DD747A3A26989746",
        "C_DCED63C3DB35CDD25F0739F377553C4490C7489F0B94C0224ED7054DFFB34F3E",
        "C_7C0E6300E0AF006C7C643E31F66D95CE8CCD0F68CEDF272CAF8092BD312FFC2C",
        "CD_08D91009B4ED68E4353E05322783CB69F176F87E9111E33A5121866D19386BA0.155.916743469.861",
        "CR_05FC8C25744A61FCE1B7262C6904EED1191403B85176B40933E4DB3BDE9A1EAF",
        "CD_821FCC238F627B3C78AF6F9EAC85DA5F86FE1B2A0EA8142CAF6057765FD44631.267.2583937229.546",
        "CD_ECD0991E788BDD3F18D05B1734161881A31F5E3936FFF793B7C468C358EFC90B.2555.2531778181.513",
        "SDBUS_DEBUG_SDCMD",
        "CI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "I_396599AF6EA691E2B0721E6891E04A15F73BA67E38E37D8501FF8C43D8AB87DD.2699.1674697541.275",
        "CD_9E95B1EEF71DCD908A163F78ED19D6297E7D9318C5EDCA74AD00C8F6A1597821.1014.2639927803.623",
        "C_403AACAE2825C9BF5B51FF916E370CD0670FC129E1492AE9CD4E8A7515217BBC",
        "CD_12706E8B04FEE8F3D76199B384B2FE632A6036284472947E8464FF115D49DB77.2535.305525617.5334",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2005.3067717124.180",
        "CR_FD437FE09A5F0D1CF8BBE227B2A7EE19B06671F0890E0CBE2EE538D3FF52E3B8",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1463.2542810793.180",
        "C_290F6F8B3B7EAA26E7735FACB33E9185DC97B5AF85F7FE15A4C9FA4C0EBACD95",
        "I_A3BFBEBE234E4658CAF2F881D4107E925EE23BCFF10DB187E30DCBCBC937403E.1088.3700762022.252",
        "C_2A5B35A7EDFDEFF055BB37FDA6DE592042B6B41AB95D0C58AFFCA90EFB735B71",
        "C_44B2B33F232E78585BC06F82C484DB1BDFCFCAAFCAC5D29C12B11CCF8EE5BA88",
        "I_DBBF1914C3D5EF61F0682E5742955C073BFDAADD9D0F3803FBFCD93C9869E589.2694.4029654866.262",
        "C_057DBED191A93075F16FF3FD87CBC67F17C999F14E2DB4CC2AED9F24BB4E2107",
        "R_C21E8ECEFF103DE2D58A051FBB124028D9968F5617844FDA582F260A7956CF1E",
        "CD_F329A9AA0CD7A7CB8F5B766F435284C69A84B4ACBC92612E21AD74FFB8C0C1F1.1594.988265671.411",
        "EventTrace",
        "CD_B0C982D069DF886A21B9C5D6D3E55712FDD589640A126AD308207FF3B01B9DAF.277.1623631806.697",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1607.1989036250.180",
        "IL_33508A40892C02D5DB0767ABEBEE6B3E036751CC19D97582FBBF57F787850E83.2708.3985374220.294",
        "IL_1B7CD8962EF14C01ABFF5BF5BB68395BECD5C47D2A0E17F4C8EE62CF1FED4DCA.1805.413065435.264",
        "IR_35B3BA3D4E3452B9FD358FEC9D1F382046EF61B6EA2F3D32FF2B776BA565D15B",
        "IL_42AE987BCC3394FD03FAED491897A69E75DB821244ED5C3EFECED18696E07708.2727.3238350837.272",
        "CD_44FB8F7C53697A71ADF859AFB9DD2404E5B90641186890162EF047D91E175A8D.2547.1637873527.379",
        "C_B49D54127CB3DDDF22487111FC3067928F0BA3A9AC1665011AEC9D08EE1BCDEC",
        "CD_FDBDC2AD47D9111246F3C36A212EEF164FF61E31A8B334E0CB50FB22BA107100.75.2460139752.1017",
        "IL_1EE528C62E00151A3CEE5C5B7F0A2EE55EFB31E410363C9065E51496B7100EB5.2688.1700718930.272",
        "IL_6B8CCA79D17488359DCE5FFD86F45344F84F53675357FEC2AD164FE8986853AE.2733.1387306287.268",
        "CD_13EC1BE17DC892DCFA7E3A89B2381E177D560D8CC74CCA31E1E844B305EBB081.93.1582140896.677",
        "CD_98B52A08A953316DB082D59EC1D28C173ED16648A244894BFBE6E9E36C229250.1215.1.8413",
        "CD_498190A28B0F3E8C8B0AFCFFAE238D6B691B0B57B3836158124AC145A7281391.1209.898114835.753",
        "C_A91F5860FAF4D61BB59DF2B1BBEB7B81236143770F1F0AA075F34F7FF7BBC1EC",
        "CD_DADA39C9F5808DC66D6E1988FD49B45254900B6EAF0B3330E6A2D8FE43FB40BB.1188.944751880.462",
        "CD_B918DF96A5E2671338B0CC8D372C94DDC6B8A082386425CAE7DFA7AEFF9B8DAC.277.2247204641.754",
        "CD_0E67BB25323DC3EA41359AD7146AF598B2070A0BF4C85FF998893FA100060D77.28.3859950239.3209",
        "I_C4A452EED7EF196AD95D8FC96148D07FF507095EFA65D3A90AF421C2D1053E67.2702.446487375.290",
        "IL_98233BC0D6E21C2CA3187CB9E2307592DF6D759478E209568F3CA340985F3F72.1163.1217761889.326",
        "IL_EBF6936E6C9BCA72F0513569683DC50AAF6985750D21624859069228CB4387EA.2466.1946828672.363",
        "CD_DD1327FC08EE6F810BD5622CD5EFD1804CFB8E69E3B82381F2E13055AC3B4DBB.42.2748646308.648",
        "IL_FF125414713AEFB3BE9B36BF5067B839DE545A44FB053F1F2696CC7ADC1B48DA.2458.1605326835.287",
        "R_6BF9460D70CC3A2E908D4CE4DEB4ACA8A6194354D3CE72F4176DC468EDDC705C.1105.1954120471.524",
        "CD_7C532A587E5CD9F8B86C67CA8FC780B42415C39E5257283976EBC192B278B9ED.1341.1541038922.422",
        "C_3863CF198183B50B73BF68A52390640EB8E4B2490D653E0A1079EFA26ABECE5A",
        "R_84870D549CA44B59AD67F4C0994509F90F4C2166C2AF214E580B660B1839E23E.1489.1254003250.574",
        "CD_99343CBC3477F7F6125FD1666914F7CFF746CB5EAD9718A0BED14E0D6EFE4BA8.206.1350204883.822",
        "CD_9D906F35D6F26F4CDCF3EE0A3920960ABC14087255E63B64FBCA0DA96B913D5D.258.3618352369.763",
        "I_E63DD74F2791290A47E417C87AF578CC7BD50CD128E683B2F5880586934D2DF2.2676.1391065030.277",
        "CD_4C941C9DE20A2632BB21CA3987571DC02CB561982F3A7D0379036161DF189433.2033.3283540761.1420",
        "C_DA2B7733DF2BD3EF26A98D0C67C53F3AE08EF07915BF46D535095C4431D97FF1",
        "OsVersion",
        "CD_F9BAC6F2EAA58B85FB2300B8E75BAC74D38922DCCCF4A9D2678AE07E068E0137.2565.4282542190.85",
        "IR_51C5ECC9391A52C9234FFF83EC435E9F3B07EA72829CDCC46218519D4A4947A9",
        "I_E290038AC529273609B709C9E61AFC8C65BC1EDEA28CE62D6879FA77303E3286.2716.1376619670.284",
        "CD_EACE35DFEFA903EFFF474056F16C7A19A63413AC446BAA0A098904894E200955.2650.1540645784.357",
        "CD_ADECB48EEF41EBFB1D5570217FF2A1BA19BC73CECF67D875589C0486F35636B9.2020.708675263.1700",
        "C_5ACAF83AC17F3EA7F1672F287BF1DD774125A890420CE4F482AACA090A7C6160",
        "C_155D9E7AE6D9F85361D5CC740FA1EFEDE91BCBF995E255746E05290A3497CB99",
        "I_4C7CAC80A6C7C10E23CD2AA8CEA18BCE49B4F0FDED31B65F69AE196208B72AD1.2692.513212959.274",
        "CD_F6E6FB7278461ACDB6C8A1357DE4FC989962054E99B446DDD1C8D6A670D2FA0C.1961.219991403.3597",
        "D851C54E6137B3949DCDABE99F61429DB318AA9014CAA2219DA82996B87.2715.2046477307.275",
        "-, .D",
        "CD_2DAA673000997F2F80951132F7F329F238406732862099A85474AE8120F4176F.1193.1480168656.256",
        "IL_91BCAA00718FEE84EBED3735D23D6F137B07B06186884A8FC4C5DFB9797BF200.2727.657059517.282",
        "CD_A3A917B37289A096C22D65E16A2D843BE7DD92A63211AFA365E0D93B7D8DCC53.2561.917473671.2453",
        "CR_FFEA4821B3229778E02955009800D7C28902CA2F2FADA0207E76D6E1DC9438B2",
        "IL_3E78A37E1DE70357C353A15D6BBB8A17A1D31F8D501ED8F1C3EB8104F5B04F97.299.1936312436.336",
        "CD_6CDFA95C1CD82B67F7CE9D96621CA3D40FBBB6ED3577D6A166218E452130A3BA.2150.2623182410.875",
        "CD_FA518327502159AE84FD3F6F4EC621E64209CEF758E8DC599CB8C2ED467053EB.1059.3302371010.522",
        "CD_1B0301F62502D60F6575CB09308C7A3739069A23886569D046BCB5BF22A5D75E.1951.2478900199.1632",
        "et of versioned constraings by a specification or standard. The value does not identify the name of the document or publishing media, unless it happens to be the same as the name given to the versioned constraints.",
        "C_285CB51B3F84539727C291C35375EA31F52E427EA0210E136DD7CA9D76AF4CE3",
        "IL_E89A7FFCC0B0A06779EA36F241515EEDC0397EE054953EB7D572C69DEFE87E2F.1333.2008981884.322",
        "C_20EDCE2D529E2E6BCE41DEE4170C3E9E6D3DEAF61091F14E5541886CD554DE30",
        "CR_5CC5CF05A7A1041C246328BDD1081AC6C5D60C48F12D405A2F1C3A3CF42897DE",
        "OcpVersion",
        "C_A81E4033C09F5F8E3B3660FFFCB2BDD5A79334D687873FAF6A85B55A7F0A7A5A",
        "IL_B315CA48693DB3A59361FA1040AFB5002B64D950064192E8DFAF6F9F051F7F5A.2680.3931095754.284",
        "CertThumbprint",
        "CD_5D2C2C389F5259E45332A86ADEF5107186DA3990C071FED897FC6FAECC4A4DBE.1999.4234012363.1759",
        "CD_85F4FD558CEB2D53836A59CA16C7897C522A861DD40C1B575F3D3B0B10636B7E.2177.228956535.1075",
        "C_0BEB647503DA8595D54DBA8F17137DE78FF091F7255EBA5AB7ED2C6BFD16F66C",
        "CD_639FF9819F7116977CD3319FE02DC954F7BCABB6A465676C5A5A023955C58EBD.1849.3530313161.564",
        "C_20A36A4D13FFEDA4F3BF68F20D7254C0839ABA34ECA738010C8AC2B49156D61F",
        "IL_6AE3DC7DF7E343BE6C05459A97DD7F3FFD2C5DD77C327113405CBB9D1D012CA0.2696.1970604726.273",
        "R_E67DF64CBE3D01A3E33D2078FC61C5DAF3C494C4A4DFFEC9CB77DA207B5AEF2D",
        "C_7EC6FF58E9EEF4EDC93B5F895A41B1B0DEC2BDC5260802227931619EE6182F7A",
        "CD_1BEC388ED8B3DBC0D0D66BF6CA421BBFADBD5A16B9BFFBD5E8B6E83ED38EB253.1736.10808377.2361",
        "QOSWMI_TRACE_POLICY Flag",
        "CD_E051E777C7E7563456908117F89B298B636645144CE61DF3136AB528CB03746A.2105.2656777898.321",
        "C_8DABC771033D66BFABC743103A93BBF348734BB768C18069B00A756AB4906B64",
        "CD_41695C2AF45A08336AFE1BDB6F027AEAD97E2A04551B2329B3A302DF92AC01FC.2036.1423920343.261",
        "C_10C4E860C968580648DC441565AA0E8E7188A06B6B5DE086FEEF7868F45558D5",
        "CD_39920F6F1D924F168590DC56A9BF302C1B68A841CDE9FD0A958F21A68D6B51FE.1540.3572633611.2924",
        "CR_F74F5C3E1B9BA2367C698800DF2F3BC633C4E02E4FCF6F1DF2A045F2CE914992",
        "IL_3E78A37E1DE70357C353A15D6BBB8A17A1D31F8D501ED8F1C3EB8104F5B04F97.293.3446303942.336",
        "CD_A95A48ADDAA5329765847F8DF03DCF18CBC9E5FA6B59EBCB8E1768298695D7C8.2735.1482392486.1256",
        "C_C787CDD6148B3A1710BABB66FFAAB061F700558EE123742FA9A22BAEF228EE96",
        "!3$-b",
        "CD_444A7A3BAC32F6DC8230C2D59CC5C5F4CF794CBBFE30EF01834E74555D738F83.2472.1349998404.285",
        "CD_0783FC4315F6719B07F6F7780EAC7B73D0B0471C3E21E23BC45CB6B44FFECA8E.2751.1.9646",
        "I_87B518D7597C8A8933F5AB5EA8FE8FD538E0F850F7299C048FF0F3B5D43ED3A0.2709.4053869683.293",
        "I_E7C8D1A4E2346FFDEE37907DDFF48B4344B5DAFEE4B2DF86123B0112A39FA3BD.1929.3453402987.280",
        "IL_F023674AFA828B66F95ECE31F54E284BD33C3FE845D503CD7E6993EC70473BF7.1606.1049670122.283",
        "I_1FACEC4993C31072F3CE475A8DF43696D7CEF8AB05082A0FDE1493735CBF1EDA.2687.992037174.280",
        "I_08E313D6BEB715DCDA53AC878FDC8CA32051886D2F14D1D12E5D2D43CCDB0398.2703.2929144872.290",
        "I_95F4083250754FC3B4307D777B3270660048ABAB373B4F4EB2E60EB9A0ED9C9A.2763.2948914252.284",
        "IL_FD02E7E23CBC32284DE7AE55B2306E3865E8819973EAD7BFAAF47CBD68DCAD7F.2701.3179860626.265",
        "IL_A72F99F3E917EC1BCB2B80582BB8C785D4D2EDA5B62DC19DF7E3D8BC216208B3.2690.1302112498.261",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.137043534.223",
        "CD_A3509A56BD6D0B19F296AC815EC184C9B671F9E47F6007C2EF3F6FC0EC7B2076.2585.2440297022.290",
        "C_FDA51E5A7FEC04F05BA768B870478212830881C45AE5889BF118736487DE2187",
        "CD_051B7EF0B57F06BB066DEE1EB14A94EBB1B34ECC5FC9531E8039481BA53E5BDE.1589.2495699969.1108",
        "ProcessorAcpiCsd",
        "CD_128B2D3C252FFFC5768D285553F59F5171808A8CB495FDE06EFD9BA8DA4D8D8D.1808.1118086676.345",
        "I_27774A386EB7F19A1428718B458A0927E72BE61C2BA034E680D3B1C1DA38CD91.2677.1925379987.282",
        "C_7F311F5FE12DC8FBDC8986B639AA5BA7CD954740905CF54801CF77F8F3C84DD5",
        "windowsdefender://",
        "I_045CFE27C750B20CB09678A5CA4B96A84A5222123992F703B6158216633E7E1C.2697.3129233330.273",
        "CD_80F94DB344488EBD67AC92604B50AD923B5145AED16129FD8EE9CB5A5BECF89F.1978.1.14185",
        "I_7629C5FFF95B27F0CF574FB9DAB9102B371BF6DFA3132EE58FBB84AC5229A6FC.2727.57686035.283",
        "I_E0F2EFD539B7928A3CD461462D4CD79A5C30C390909F42CDB98D7B4B987E4A6E.715.1.265536",
        "Plx$`",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.2236362174.368",
        "CD_27A364644C1B83931E072B22EAC45B45C2531EB36360F82204598576E1DF4301.2461.1164011196.3812",
        "VxWorks",
        "C_DEB8226661849F99E285DB968248A6315D998BF5C70E2B91A71169E0DA8F6A0F",
        "CD_9A1BB0482D33C76729D4E4E83E5DB60EF19255F1B7BD18ACD1F30074C3DFE4AE.2580.3955721363.219",
        "C_06F499F2E4D54A4C7A3A14DB963938B9CE4FF6BC0CFF9EA9D0113E9D4BE3E7C9",
        "CD_D19777074C5B32D9DC9992840BAA8166B47EC1038BA93E9572C45BE663CDE8EC.1849.4048209820.221",
        "C_38C8B45669D476148D44DCBFDA994060B1C93A2142F237D6D0ECBDCE445523B6",
        "IL_0C1FBF427A5E2D280933A244BA462D4597AEFFB299402A972814EB08EEBDEEF0.2704.1137682084.287",
        "DE79FAE86B9B4BB0C343E3E41365C70C4",
        "0x00020000",
        "R_66178B9235033364C8CBA36A75F46829E4599D84824A83D8CC13F5233EFA5DFA.1776.1863671743.562",
        "Vertical sync pulse width",
        "IL_A5BE2A63B34969AA92AD0B732F65A0E2492F9A8C3857336E98ED1B01BE02E107.2693.2686907232.271",
        "IL_BC000CFE04C2A23B745105FB1571CA3D890D9580D1AA6746224E398C7587FD84.1976.1469505768.310",
        "CD_3593792BE66B364C91CB864BB99BBAAA7F25D2BB3385AF25FEAE463E3985026A.215.422957712.507",
        "CD_AB754770CC19ECF1708863E61B4513A3C8CECABE89D78E5D727A64FE3F1CF111.1183.2563062084.4065",
        "IL_57180B2795DF63185637A7BC1CF646845F72A60DFA58ED5BAA078D0B8D0B69D6.2678.75754567.293",
        "CD_43C86C3E5B2B7F1DD0443A6DA4E17AA95D65F56EE0C19CF4FD3B5D9A5F63C522.310.4238891943.417",
        "C_DBBAB694252A8FA02CC578AF6A541FC3E6E5ABF42798173F7194B1B5ACA4AE8A",
        "C_EDEEDD03B46D0F2773A9E663CF6F598AFAC1EA95E84EA985D471B4C52491C8C9",
        "RDUGroup",
        "CD_B72992879F6DC823F6267C256838F35D96B57836E37CB0558435E32B2B16111B.2664.1696220283.935",
        "CD_6819A90E9043FBCB03170E69BCE9776DC51451D8655C4104E86043281CD95CC1.1050.3692993585.460",
        "CD_A23491B3C9DD8481EBD1370ABF1AD298CC29F6DA303209600E83B50112688260.2460.1309280638.3537",
        "CR_286D3AAA59AE00C2CF7EBCC4AB344CD2AFDCE3C2B408154E04E7644656DAE408",
        "IL_CD10ED400BF274EC554781FAA1E90D186E58C982EAEA50DBB502ED8BAEEF5202.2711.1030883813.291",
        "I_5B2FF6892109B8F6F172D6625542DC7633A3301F54DF5C58F0D3FD2969597405.304.739416858.189",
        "IL_6E1804333B4ABF52E3F1AD25E8D291B414C148FC094148237DBE1B129983C786.2717.524990918.271",
        "C_B8353D57A57BDAADE8E1FD8BF3D42DAAD04CAB50536C3870BE8C32D1CA4CBD9D",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.2104251586.243",
        "CD_76A66A93A4AAAAB54C1788714735D6D3CA06D43FDA4D5185F019B0F00C9DB5B7.2577.3085459645.973",
        "CD_7ADB3A758B71404FF95472D98780622B0177ABFE993DE8C448448F3816B71A61.1056.288573878.7029",
        "I_08D7059D9196F1356A9DED2681EB4B426E31F380F9B41BD056E9948F49712DF0.2680.1378718958.304",
        "C_A031CEAC5953C8D3D1F35E1808CFDA9CF75C860B9E43860077ADEB4071235C56",
        "ySettings",
        "IL_E53C33064BBA1FBF2DC083917D92C13CB06D607EF634390B88B3FCA354ED30E3.2713.942242480.280",
        "C_027708FDC4F21C8AE43624362617A067ABEAE7FC96FE6B2F6BAB070555EAA6F0",
        "CD_61340937E5D8C4D3C9D45CD88D4999E65F9C88FB548157F118E02C98B67C9BD8.66.4192157926.636",
        "CR_0FD1FAA819681F2EC44E2931633C629893BC924C7278A0294B94667101A7CC55",
        "I_82D62EACB411F46C88EF11FE5A18F1088AEDA0897AD63F2947178230B7AF5724.1780.1849282648.338",
        "CD_D3D129B5A5245E7A5FD20117812F2819444248EEBD3B61B053B30F632CA2A28F.255.598484934.421",
        "CD_9B76BE6116634D98E523DAF9A0AD948B4D742F1F76F465B3DDA5D1B7EF1C7F0E.1201.2396054252.390",
        "OffsetFirstPort",
        "I_8E007FFE8990861E3AFCCC532252BD06D6D994443EDEC1808297FFAD7302B5D2.1016.2889022391.351",
        "C_978F575657B58CCD4ADDD20377EBE045FC67DB638FC034EF8F9A1689AD6805E5",
        "CD_F33D7C5F62C48A98254F1B0ADED8C5A8E56D1601D517CF44369F4A800E4AA9F6.2763.2515319330.340",
        "CD_8857FE2BCA804CFF26B6264F7992ABC147EA66CE1D853542F2AFDD24CFD1C407.1540.757191909.694",
        "DeviceID is an address or other identifying information to uniquely name the logical device.",
        "The SlotDesignation property contains an SMBIOS string that identifies the system slot designation of the slot on the motherboard.",
        "CD_AC53CE5DA52F8730E6EB207A1453E345675537E4CF8D4D541D7A48167AC26146.2600.3319505467.407",
        "CR_88951EE85045E3B94CBE9BC71EF70777E4B05816F4BF59A02A284DEFD098F378",
        "DebugPrint_Event",
        "IL_11D2E97DDF1CF080928910BF09863669E0E14A4659127F6B001724FBE86FEC93.2697.2945396924.271",
        "I_E1EAB736DF81BC8E670920B2CE9D6569872B38D69DA44CE88EBDB5463BE3F426.2720.3269679880.293",
        "CD_71B9737797902C207AE6EA27F94A2CE1B75787EE1092EC060CEB70575BF68076.1596.23034475.668",
        "C_F39CE8DEA5DC55C1FF10FE9CB8760E6D9F306EBD58660142F016FE93457EC312",
        "R_49077985F3FCF4259B2FE7EFC831F5599CA91F6DC9D11720E6A401A1DE18B2D2",
        "IL_FD49BFCB5A034F2DE40FD1D17E460C511F7594F4FAA424A3C6F9CD6F04FE7AC6.2698.2778012881.274",
        "CD_8E06F8A253AE0A7703F13AD4EB4C65D4E0C2634FF3666E5F2D0DCC0FEBE693BB.2551.4276994828.1524",
        "R_3417EC6F6FDD4AD6ADF59EE04391675B6783F7D8A26A76EDF8D519610D0392D6",
        "CD_3F1F5B0124728EBA6D42EABA879A91BEA7E9F4B131CEFE546919F2735EBA71AE.2610.3653676655.2588",
        "SCO UnixWare",
        "C_0B9091A7705333E08909D2D04FE2D8C67B717AD489BDF891C00D458657EAF4C7",
        "CD_EE8A3B921C808F823B264981D8BBCC23C3D40D2D4B7C54B958C0DD90EDAE3CB9.2633.3652323701.116",
        "R_CA638CFE13399694BAC2F76CEBB7B08DC881413B47D24732FDCE6DA8A0FBB80C",
        "TraceIoctl",
        "C_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937",
        "IL_A2605C4831B27A2CB7042C949259C008D70F63B10E860129D6A8C6957225B09A.2722.2159843468.276",
        "CD_AF2AF60829ACDBE308127B32BFD1BBDF676C4E12F2E511DCE55236AD4CD567EC.2510.308442094.650",
        "CD_2870130F618D37987DA37CAB8C2078BA94B2DC9559790EF971A732DAFCA8D133.1934.4224785213.5842",
        "CD_B209BBC3E9792036932058EAFDFF59DF6B02D2E0E24C683DBB3CFAD2B25B83E4.2744.1954070308.631",
        "C_32BA494AD7426AEBC66A2FD485788F7B931AA8B5D73A66D480AADA613122B7B0",
        "@DHL|PTX",
        "C_3B52DE0976ED7CD9B4784B5C2E3249BB9E7405EB7D80E56153B90FBCA2B2EFDA",
        "2 - Pinned.  Inherited by new files created in pinned directory.",
        "CD_065EB15DF476F783A483B00F674DFF856DF35C72E87B7E414EE69BE5DF4E9372.1067.22914974.1865",
        "CD_848678FEA3E9DEEA8B4E9FB42ED8A13EB705C3DB7C73AB893E320FAEEC87714C.144.3314887212.681",
        "IL_D7AED4ADDC8BF97824D89A0FCAD2D2072CAF10D93AB8E1E5CCF303BA1F937C01.2712.3034257327.276",
        "C_108D5E4ECF642598B0720912427FF7D58266E4483E2C4F3BF418548042567684",
        "MessageDescription",
        "IL_64FAF3B4E87C22CC08CA793A88173C2DEB757548ACDC18193164EA1980998E80.2717.359657752.284",
        "C_815D9E15B2BC14D827AEABF180C134867539F84827FBD5B8AC15C1D40A78B042",
        "CR_E991E45745117956DEAFF1C67CF04DB972E8AC05E236ED8130C434E25D63E63D",
        "C_4B3CC5F49167F6FB69E56B79BCD6431008E7D86DB966C05AB2DF4218DD0EABBE",
        "CD_7F6515E2EBD9049AE896B25B99B1906533354EA0DB3289C03EFADA9D23B196C7.1671.3825878562.235",
        "C_8FC7E2EF8F90B92553B020FE4923ECFD22B98AADF22BDC0FF9332DE6A3457F87",
        "IL_01AF7823F90DAEC78BAF38771F45D60A37B0917DC6BBE974DF07B97707A15F13.2451.1886448488.295",
        "CD_9ED4218811E2E2DC555C6195DF95C97920247EF5A997EEA5E4BE65B094EAD727.290.925628222.90",
        "CD_6603235838D67F0A31998AE108546BB74586B33844F47241F23AECE3061C708F.1714.3548896070.344",
        "I_1F5434A1CF8BCF8A287442EA894870369F7D474E382A3F1E86E688DDB3D61151.2668.405656413.271",
        "CD_D9930090850A792AD37ED6474B3469B6C3C6A3732038528F636EB310FE1097E2.1780.3962492142.296",
        "IL_8D616FBF552F3D3BA75D6013C6C4ABE6161A9130C129F927767BE486D9ED089F.2728.2159775033.295",
        "The maximum number of Quick Mode SA's that may be established with this SA before it must be renegotiated.",
        "C_629122007ACBC01F5C89876FEF5BF24FCF799FAC8975CF22D2EEA155F3C49ACF",
        "I_7E3FC52173BBB0BAC6E789BDD1BE5FCFF346F5F20489B64EB487016A0284A279.2460.839647856.298",
        "I_B3082C3F9799617E93A60B0A5A46A9C812E71430D2C694055B03ADABB08B0D1C.2674.1718239285.262",
        "CD_3DC91A797E626AC72558CF32A344BB47D2E2EC35EEBC7E9ECDD67B034B53206A.1154.368612296.1288",
        "C_AA9C61DD6F708369D775774E2B0242CC044244C6152DD57BFFA159C58FB426FA",
        "R_62C8891E57F68B5018AA739FA2F9A6FA324F5514D7DD621D65681F6B7E0BBD4F",
        "CD_A8E00DF275B2FB47AB36B812E4750AD4FD2F723726632F4293D0ED256BF3B071.2510.170607020.2167",
        "CD_0A3410B55194CD497491BCA1230201C3E2461F6D19618DB9AEC90B35F8D933CD.1333.4227370166.935",
        "C_E42B5C460ADC9151F70DD39FB3C117A9B223F5296D170916F738E34EEF8DC0AD",
        "C_C817DD8C4529B1D43D8C1DAC084B54DB9AB1718E7FD5F201164920A53BE23ADD",
        "R_EDF45E83E6988CAFA837593570863B9540E3B0D59817E2BDC4FBCF063A21C08B.2749.3269073711.628",
        "IL_71005F952FE2FC32CD0FA4A70470333D5C27BEFAA0C76305B3518C03A8932C36.2725.3604684920.294",
        "IL_B1CA4324A757DDD58567627DD36F9B666F172DF97B3B65FE93751C1BF30285F4.2688.3050951499.274",
        "IL_F1D3F07AA8D073A7891441AB62C487810EC5FFFDF0E30C32C3C91AD16D6A4FC2.2672.2173848480.273",
        "C_7B789191591F6BB6418411E2C99653D88E4DAE1F81AB4F61C94D864C91D8A17E",
        "CR_24CFB2B4CEAD5BE9188CC5001933580DC2746C05DE76A8DB6DD098D52E4B25F0",
        "CD_FC4E0F3A799ADFC0F2DF9988A333610A6C5A2427E1901404FD3CB754B0E93B5F.2551.3907345536.1542",
        "I_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.2572492333.360",
        "I_8A7F9AAAE708FCB7DC96A027E88361E2950C2E39D954BA3B56D09F8360E69FD0.2674.409931961.267",
        "IL_F89271732C858BDBAE016F666248FF8D12FD9E283E03A2F4AAD8525E1356EE34.2678.1663028984.281",
        "object:BcdObject",
        "I_2DA6E702D31AB61AC8052BB8775016BA05438F231B3A914B8AE562AF8EB082CC.1016.2013314775.308",
        "IL_1A5A899BF56D251525103D6AF5EB287E924400C4FC43FB3320926C7A84F72E0B.2692.107867486.277",
        " x$(,",
        "CR_DA629F0FADBF1E9D6C65713F31978C9EA30680E880B4ED8EDE3DC7BD5AFDAA23",
        "CD_E8438569A234983E9F3E72114D67C2A8F312591D9F4E7EF448973ABB653C95D9.1071.2879229495.519",
        "C_0BA79F1C0B8BEE05ADEFE070511A71266F9E5457646BBB9137C84F64D7EEEED6",
        "IL_F82DE66F86904503450A050F308CF7B5C1CE488FB6CC8C0C790D6B71ADCD3D1C.2696.1061084780.279",
        "R_C413AF31EBD45FA510AD35ADB1344C580081CB05511196B32B7E7BAB01E4BA71",
        "CD_58C24AFB2A991AA6785137E0BFB334A98FD6BC947AB0904D8F9C5CB0750B421E.2631.2301193650.266",
        "IL_62915EDCFDFB1F4E3D47668B9CAC709984916BCF9C80830D997E5CF56587859D.2727.3193218715.279",
        "RSOP_PolmkrFolderOptionsSetting",
        "C_1FF99FD98547CA076FAA0DD1F2AF44F1BFF4454EC9483F61CC85AF85FC12393D",
        "C_247C34A5C385163FA871F0A6990B7DDCCB192B62FD1FBD92448E50D5003DB294",
        "C_D1F35069AB830308A3D10C95EC411D258E0A9CAA2EE0311B34E2874304803008",
        "I_7376FD33C025FB191993CD2DF559B22E6E156767F95E97941FAFEF237747C4AC.2694.4107065185.271",
        "CD_4C51C80A2BAFAD3102FF110F62EC213D34DD3E23F9AFBD5B7FE6DAFCFBF7A94A.98.1758378749.1908",
        "IL_D4E43E8D6402787246818DB415E351662948AB5FF42C923A78F8B45F7D5279BA.2714.767746018.285",
        "IL_03F5649201FD452B0914A7C2ABB834EB3774DB65ACE24E9A57AE71F5B3E8D405.872.1.88433",
        "Routine",
        "CD_6D294564BCF9623048C8EF258EF84596CA931F72FA8476A8D1B3C2E5E28C03AF.2039.2871156334.1019",
        "IL_86B3BCA296587429BCD61A2968A848617DB93023BC6D3C1858853C5540E12A3E.11.1554124308.245",
        "IL_B3198A98B30688025E52C2CD16BB5339A9E883E8A0B7E69978FF121D065A1006.2681.2291312530.299",
        "C_56FE9CF506AF648A665FC37363A7CB5F1672DC90AFA053448840C6379E5C652A",
        "Reserved Field #2",
        "IL_00F1B9CB59FCE26F2EA8376B2C4CA47CD07713170C440DCF6EEF30CCF5385026.1105.1342748237.332",
        "BFA7DCF9522B5F1767BA6C1E65ABBEDE3D8.304.14933742.980",
        "IL_E7C69A9468F4D8DCDE02B219463CDAABDC2CE50707FE4D1088392C0DAFA0F078.2713.3707429983.298",
        "CD_8DE46DD6446B26621A23E11758AE5CBC62C9F72998CAFB08B9CD58DF66902A20.130.1234231547.633",
        "CD_840035F63794F57A62A5607B53F5A8A9C84296DF659BF9F5C0E61203052FB854.2387.2167257063.762",
        "CD_DE8DE1F6359006F632B83164424286AC021768B2313FD2622030D37E0386BD3D.2730.2095750802.722",
        "CD_D40443FAA4BC832CC8C5119EF318B422387F0E5530C5A9E40FAC797FB6D785CD.1607.1517962223.219",
        "CD_1B44CE641DEBE8226ABC64761E7FF4D2BD61A5ADA9BC945BBC307822FB8B9D29.2660.2265563723.1947",
        "I_D9CA77A28458DAB82032495E4A3515F122C9C091BE22AEAFBAFFC1FCF8603676.2703.2057494158.290",
        "I_3B25CC76866D67D5F7B6BD5B0DBB66CA4797D3D1747ABE957E8AD6E40E8A3571.2728.1637506377.278",
        "CD_F048CF2C454CB8BAA99C1A4118013AD0A4526AC70F8F00D9BC60DB068406C882.1088.790594590.760",
        "I_41CD80BFBD3EF2A7",
        "KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "CD_4FE08F2EC3E3D4E37005F91A110E8BC58CF8DFEAB30497EBBDCA1E4558D45E8E.1560.1167646916.627",
        "C_19013C0D9FB0DBD6A6866F06455DC6D7F3ED27798047559CCAD58D324FA53F0D",
        "IL_72C1496F7784128083E72CEC41F798E9FB123597685B971FB9648A3D450D807E.2735.2792936901.278",
        "C_5F3A7D47CFF70177272CA0960C1975D28A99D9A71A82E07B0FC43A060E86CD93",
        "2-way Interleaved Stereo with Left Image on Even Lines",
        "I_43B7B69F919BB681DCC1079E7BED6BA29BBE6F4DDA8822130874E698F9F22509.1105.634992381.277",
        "Tuesday",
        "CR_576EF4A0CA90F6D8810BFB793D022B2E61E1CD9C1C9EC856ECD04FF80D2D4518",
        "CD_FE3903A8A6E3E4819A9E93424E0AF9D5DF66EE46BB5392D0B1F436145A771C95.1569.3728724716.1960",
        "IL_24C62B829B1D6739544F22B1EB72769CFF61675D80DCCCE0DC8867F8BE5101B6.2705.3269889150.298",
        "CD_3FF84C03B328C80EE72EA722B2C1AB0D0A4549FDEC5EB94A2670D175C0A3657F.155.3824627474.1175",
        "Windows Version",
        "CD_D16A12AECD65E92E54D81BB5A6D4F0A9B8CCE54CFDA3ACCAD58B890172BA2F63.2640.777773435.708",
        "CD_61F33C9DE75CB13B4A6469AE01D1FD6BD56B098ED457BDC27158A62BBACE11D9.2425.937243211.363",
        "CD_05CA5F8E6EDC2C8D11BBB4DA46B36ED992C196304CC24289ACA10C9E37FCC545.2652.240365399.414",
        "IL_8C5CF52C7DD2615E7DAC6A75F75E1D7B6BE4EA46DFAEB33CBF8D0CAF178F9316.2713.380049439.281",
        "CD_51A9C127B9BB2ACA4517A195F0C84D263D63864D76769541B4DDB9FD414D0423.2135.1187538534.1855",
        "C_5EBC0509B184E537F175AB2001B7D3B1122250BA7C4FD6F1A0F9BCCB6CB0EF76",
        "CD_E2929E24A4D3F33074BBFC9EB2E285BE087B76057F553B22FB5CA19B172B3C4A.18.3433884882.471",
        "R_C869A64A264016A40CDC6BE908580A71D42C8A4A557BAE5179CC1536A843969C",
        "C_3B7D8DFBC854CE2D148848B1855225C8EA3E1B3A395DDFC5824D621B522459B0",
        "IL_A111E7F89C1C848588C2514B9F7117AA41CDA991BF49D22CA3C7528AAAD3EBCB.1183.1371394625.273",
        "CD_9C6A7E3E087A5B8DA585FF771A2BB4634D1FA2F66F376E9BF7FD6F960807500B.270.3960578611.2528",
        "C_604DFF7349A51C4BF81E539358140729610864A244120CB2ED2FC9F108D71554",
        "CD_3205C234B2D5F02B734949988492FBCD94159F50911E0F44A000D975CE1C5819.35.3540327104.430",
        "I_920DC192C7DE393EB5A754D63202282F9961647A34E6F2507C168EC780CAF5FD.2715.1721837115.284",
        "Acpi XPSS State",
        "CD_6EDCAD2493CB9C9AE066E77642818C8D9B9BC312C7B4C3A76A07871F0E60FEB1.10.3188376956.1709",
        "C_890BCDA7A71C2F5D3AB573AA4BB373800CDBDD716FA1D90996A9ACA074A722A6",
        "I_618BE348A47753A2409C56D8BA15B824FE864BAE4B7AEC8D5761691B87263426.1500.2729754227.275",
        "C_67B957B7FD1451F4008C60D3B500296D0371242C5A3269FED6DD43B17D84C14E",
        "WMIEvent",
        "I_5AE4C65F88CA296DF22A3A98A9517F0448451B783C721C545F1B3C0ABE106206.2677.2200677351.280",
        "R_25951CCF498736F09F8CDC3085BB276C2817DE47EF5312A0F051C1AC3B67B2CE",
        "R_48394ACFDBF2997914E68DA01913B5FBD80163B4632D972FB942C9D9BEF7EC87.290.3894672325.516",
        "CD_8105231C8A3F2DF94C9C7F6EBD5BD2604617F4A36486778B9E1603208DF83C44.37.798697673.411",
        "CD_9CE28F3097463A7A7B3E8F7210FB0203F0EE1A77010AA6FEBF898B2CA50079D1.2673.799822160.1921",
        "CD_B9D58526785010F225A5B7C3571EBE488D29C0DEC319541C93BE914E77155B6C.2114.1364967262.254",
        "53B45CA5EA7030AC30531ACB3BF91D0DF7BC783E1A4.260.528583635.523",
        "C_2C105F93FAE23EB9C17688A981EC79ED752A3DC9D3543D94DB227DEC42FE7990",
        "MSFT_StorageJobToAffectedStorageObject",
        "C_E368B979EB51ADB10F5BE3CEE15B821029C1FBFE745D7D61E954902FADED7A9D",
        "CD_73859BDECC6E59555AB103C0DF5302F8942C19E249A9E48DB616B611E1AA3893.57.1687363978.653",
        "CD_C1C40E0073DCACCCA9E7EA6B9CBEF196D5433EC3FB0558455A25F8A16CAF151F.1549.2816265073.3046",
        "I_6DD48BA8C9F115A3A96F3B0385E669764D8C4359B2B9BE931749B764D79904FF.2684.2854956640.276",
        "IL_DF997EC39F274D7BC0CBE37723AA168BCDB6FEA427F22782EC7E0536E0171BB3.2699.1076751264.273",
        "CD_B7D88CBAAF2C338213E1E72001B6814092CBE165351937E6CEF7D675A2947B58.1616.3747577739.265",
        "C_C6D84B5CA01F8150DB538B389B0DE75D972173BB6246F791D5F0EBDC55AA7278",
        "CD_9729932C6A230E6D076D16A739C9C55BCFE9B5CECD58C2301470D12143397086.1929.352479938.328",
        "IL_D57F9CC3E89B837A3170B00A7A884464F6A0DDFDCFA2FB9E33A509D63F7AF826.2716.3539551663.284",
        "C_1E9CB0A4B1D9D15808A86CECADCE036DFA0A4705D4A5AA99713EE38A81604E60",
        "I_CF17F65BDE5D27AA83EF3274842254733535B217A340E131A413188964603E19.867.1.35696",
        "I_1D0ACCA9F533DCD510C277D648A62BB8CD3E7F4E8E797DF7E4570B4692D0506B.2674.3598263952.252",
        "IR_74DB269AD97C14528C528C1449F1DD3ED8338C809E68E4848164BBCE7DFE6620",
        "XPSS states",
        "C_B293971E18EBDBA3E18E429E10AEDF13A0739F0E375B42373FB5BD3B45C3B92C",
        "I_0DF7BCC0A06E210BA34D9F2D954CB8E7A01A47390F2DE226658501C2150135EE.2678.762188971.284",
        "CD_829131EDC6839DA24011A54FBEA38B1D13A2BDFBD97A229CCB462F4A95FA5DB7.208.733022338.393",
        "IL_D6DC4C2A426BDB3F0627A0CC3C0B5621CBEE7399F504DBF136850B288C701108.2700.3035886067.279",
        "F5FAFF10A17FF77557F.180.3177779426.1734",
        "CD_7AD87B163E5F080E34E60018A0634DBE95115F38F1BC264D0B548D7507D9109E.1365.1458643283.2803",
        "Warnings such as allocation failure",
        "C_D952138C984CF58C87BDA12F14B85644C3D9BFE8E192BBBA791425FA27B18EDC",
        "CD_C9D9452296EB13E3615C122157CD56E9BB0D20377DF2B13731EB18D5AF7A66B0.36.961103402.347",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1049.1669254382.368",
        "CD_130F1C3C29111AD1E8F485A9C57AAA4AFD7E43ED53D005581436A437F8C3A1B8.1051.3487383612.602",
        "IL_29A56D1E02346B0532A1C4DB24A96746A435E1202E2CF49DA95FC65C6F7BD1DA.2680.4264540441.278",
        "I_876030205185E73325510A86538AC5681B346421B7CE9798544621F4C31CB308.2726.685659278.279",
        "CR_8573F18B680E18D492B49EE8BC7FF79407A6ACDC9E3F5D6FA5A838C0A5D01910",
        "I_FD1DB72EEB157E75D29D462B8D552CFA749E6AEEC91333B95D964E671CD91439.2727.3700189093.285",
        "CR_BCAAEBA95E435CA5300A680BE9BF735F04A93ECECD18F46C56865C6158D43B74",
        "IL_6EA9F2C3FCEE35A10CF321FF135D92BFB9D8BBD96163C1D731E8ED4565828218.2693.97880717.266",
        "CI_5F3A7D47CFF70177272CA0960C1975D28A99D9A71A82E07B0FC43A060E86CD93",
        "C_F875ABEA98E67A9A740EFA2E6386D639CE399E917B70AA67FC167FBE9663EAA3",
        "CD_6BFE6A8B23F958690D3A4BA6B445510B763B0DE30F35AAC145955BE16D3508FE.1565.2481094842.422",
        "Dial-up settings for a given IE internet connection , used for IEAK RSoP.",
        "CD_A6DFC31459A93A4A25BF3A54459FE7D8268FC5E8A1ABDBF315A9D272D1046669.1189.4109917901.596",
        "IL_FE49F3187010A17140FEE6D88E26E9D9D4E2B221F35F75777C8AABD303B2045D.2685.846581176.289",
        "CD_ED34D9141DAAA89570F479B7904D4A54BEE568C398745E94687501AFF6347D73.2188.465724083.275",
        "IL_549610262D899A609746B30777DA484C6B4E815F4E722D4B8F981494715B5A99.2461.388456328.358",
        "A2A8475D45877024A70F3C20E4494FB9EB94FB1.2710.375845903.286",
        "I_8493808F7005A147F054C4D110780BCFD9E3EC20F3312DB0FADE1B7AFAC3A8C3.2764.913621036.274",
        "CD_5842378308FCA74CB08DA5049999AFEBED270A8D2947073DE67DDE6B41DAEDFB.2357.1.91176",
        "IL_66A84D15B2A2DB4932978909375E7B7E078FD44FAD3E1A44F246DC21DAC037D6.2680.2694796933.282",
        "dport",
        "CR_6F6CF7511ECB359E4989B369445873C82419FE289E80DBBC274B4D32EB4F802C",
        "saddr",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62",
        "CD_221B78AB9519C178BD62F6FFDCC6364A1ED7DA15100A300A7AE9167569CF4591.1927.3476297286.1047",
        "CD_F9577C2F184B32F74981B6FE74A751DF70B09D37A1C0992592B3A2A75D5D48AB.1949.3533428056.2467",
        "IL_4F0BC1994D1136D3357DCDA5A9CF33694FD285B2867DFD0EE5E8A215737DADF7.1479.3234706888.193",
        "I_C2EEBA851C346DF34F861C42E7FA8ECBDDB628883251DE37984D2F4DA29D260F.1051.2040547981.306",
        "`!{N$'*-QBK",
        "_7AFC0D42052E9C59679F25978A7C6BB4EBBFFCAAA7E1A1214D251ACD02FCFF67.121.3607088286.637",
        "C_651D061E01CBD32AA7F4244272DDDC49803CB2C80CBD43AB9BAF178BB7D52D97",
        "IL_8F59483D428B08AE2A177FAF77675A77C85F88DE7C8B3EB6EBF49ADE58E241BD.1049.1738361069.332",
        "R_79C2B8878CA0CC7D263478DAA5B22069FB6ABEB9CC6BF0071DCCD3AD247D51A9",
        "CD_446C8E078CCFAA4D5AF15A685216770043F4473E2978CFEC5807CC510810D39D.2538.2654704314.484",
        "CD_1FEDD67AB059C717A3177A11DDCA2AE4F063EC79B0087199B3EA7A6BB2439395.2509.920896579.2422",
        "IL_5044D3C67366B66A8782B6975703C58D4921423BAC267710EBF6DF593F10AAA0.1015.3492468328.321",
        "414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.3725407623.180",
        "CD_09CCBE426DD52D60374145524B2F98C4F709DE617A8D3D97D699BC5E8702A3D1.2555.3691456220.503",
        "I_3AD74DD44942EA2E3D5CBF11BA9CB0A9949A58918994AEC381F1EF94F778BAC9.2696.2978780729.275",
        "CD_81D663AC928C0B0697AB8BF22CA2F6F616E0E395D0307C3DE82D3308015385B2.1556.1709726039.410",
        "C_C6FCF4E8BDB79DD332BC21F4BA68D00DAB00411CDF0A5E259112BA2CED429F90",
        "CD_56BB19692EC0F16AB4670B21CC11FD91410229C5E3EC8B45AF60003DC3CD47A8.1803.1.16144",
        "CD_727AB02E08361F6EF440AC44925D5B278206F12872C50300A3384BEB284B8D55.1922.3812107501.292",
        "$~'*-0369<?BoEH",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.279.3657065439.180",
        "ROOT\\Microsoft\\Windows\\Storage\\MS_409",
        "$4@hPL",
        "CD_1E374C5CBDEECC7830AB4BADC56B9C8330C5C89908E9DD8A429AF2525AF02748.35.2245748507.482",
        "CR_7EB464F197DCBE575080B9282C967BE21B4306F539F2D486C42140F55C5D0FC8",
        "CD_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655.1176.1907666482.6733",
        "I_D12143430C7364F664246587C136FFB74F8C90689FF9A1B0AEB7B9442A0BC274.2736.3113440400.269",
        "I_B0509F7D7E6AC00551287C350BA044C7B587DE4DB669F59CAF4D4140D2D3B67A.2763.532647700.269",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.2659448683.266",
        "CD_81BEE9AF275D13FEF2328C144C0EB35B9DFCBDEE7AFE9AA908B2E35566F15BC9.2548.2099973251.756",
        "CD_9119F0B652DA36ED39E0F720020078B4D648A3C32B50B41FE55A21DEAC3494CE.2564.1423131286.1092",
        "tTX\\`",
        "CD_1463900C5E85009C74D970DC08429284D480248969B543718E853FA68E152A48.130.2995249057.1102",
        "CD_6572B1CC4CD6AC35D80FB14E68E5854FA4FA40953667D1578E6FFD075F930AA0.1185.3197408207.2243",
        "CD_F145A6FDA9DDA8FE3479DACF04486517A38EE43E84A8A1C9E4CED735C9CE24FD.2659.1440659392.1903",
        "CD_D1786CF1703A5EE88ECCB609DF5C081BC2D647617B6872C7F1D52C9FA2FF8990.2624.863836743.417",
        "R_C504B91CF040A007F72C24FC0CC99A78401C1C475112424D0A789E6908FEF373",
        "R_9FABC6ED49D4668A74686151FD54667DC6E81F817923DF0C060E2E18979429AA.2764.933542363.542",
        "Processor extended performance states",
        "MMCSSTrace",
        "CD_C3366DDE9F2F54519CCC578CBF8A7581CEC6A62E8EB4A103001D861C9B636A37.1757.532796426.271",
        "Sunday",
        "C_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251",
        "C_94293EF90A7A22C703D24325A49A6EB7D4CD2936D5E4CA05611608ADEC14586C",
        "IL_7889954D52FF20BF7565571F0FD6333FD169F3543EA69D8115107DCE82865D15.2722.4108895057.289",
        "C_A68B01B18C25C8BFC9B36419B9B64DB698A481D87C42ADCA7EC744307E0456D7",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.1782.1525406600.297",
        "targetName",
        "C_64457EF5CB2213C8C7821D96680776498F2D259D55C9A6F7B9175A130435CF08",
        "CD_2A29901470183D31CD9B227D54FC0AC8AF6B54BF121707B67C0E4CAAE27062AC.1349.586614176.267",
        "_0A4592DF371B0F1C9E35DCF899DDC0B30F2B23CFF106F5805254E0E64E1E04F4",
        "I_C802B3FD1D8F1224D0A710EDCEC6D18AB91874479ABC3E364CA52163437907A6.2690.1813658899.266",
        "I_0AE940523E9149F8DCB37899955FEB1D727C7276BE5EB071A1500D0D93DDE082.2679.2356854199.275",
        "h$|(,pxt",
        "CD_5847C21BC6927B979DCCC7E87CBA9AC34DE69BF0C904AF77E2C0BE3CEEA06FCB.1667.2466246757.404",
        "C_6E3B0B1EAA3CEE6F69030D230938ABFEE442E704D8FB8F3769C2B3DBD83C3284",
        "Other - For integer values other than those listed above, refer to the documentation on error codes returned by the Windows Installer API and the Win32 error codes.",
        "CD_6BA587F6AF181129EF94B57125FFF3ABFF81218B46E9C3323CB782B9288DC94A.58.1532304240.659",
        "CD_B22B427F2794F083D59CAB3CBAECCCBC3A99C22CA4382A86ACBEEBD3E7AEF4E7.2423.1187050677.358",
        "CD_2CEA3682CC09E7F94D9FBC1BBA63FC6DB39872E53B9187129DFF772A12215DD5.1714.2360956410.365",
        "R_5401A055411F9811A09125DE8462BF6A4D708D8C770ADE3D670BFB9DAD21A39A",
        "IL_73B465B61BEE7A212E2CA5D75FFD3AFE147A54A530A57D0EB687B325EF612EB7.2691.3590618101.267",
        "CD_7C4D4C779B8655DD6A7E86DC91922E10770F67B8451A5A7276C3310C51D0FD42.32.1889685185.539",
        "+)$;D",
        "I_E0287A0DF7E0067D3F23A5C135469B8B28232A5D98BB15312397EB6AD2B40F9C.2688.1339615880.279",
        "CD_39986A48BD79716B6060A37DC5740DDD40082DED190FB55EA39601F1955977CD.2596.2072899479.199",
        "CD_9A6F5375A9497C640DD14311C5D352C43D073997E82C517C2CD3321E7C391BFA.1201.1133286525.2775",
        "Windows Defender",
        "C_1E76FBA0D6D4CDF2AF49F47090DD7A0679CCCB0DF5D7E9760575C0D07C29A63A",
        "CD_6DD0D445D2D5443E84DD9BE407CF19114948CA273CCA749C4C24BEDE6CCB0C6A.2595.30871093.798",
        "CR_0F40AC813525BF23B517D1D92CC88BD22739A3C5B59B5537548A36265FEAE58A",
        "5A528110007AFBF25CA",
        "C_1D13F523791F1EB20EAEF6F153AF80EF4F13EE29DAAF24D54E908D208A687279",
        "C_87356D5B7F373B899416425A260CE11B49850CB8F9A3DCA801C9778F10A8C924",
        "CD_EC88E4FB4F47B4EF6C316C25497D3AB140E803FDA6F9CF026ED61A7CB8E343ED.2661.3814995438.699",
        "NdCapabilities",
        "C_54300AC69CD22DF016BB3F2AF97DBCDBD81A1D838D9588007B40A7B95D4F9C12",
        "CD_272E5753DC3EECDD6057038DB6F26170E7D1CD565B954C6C4A406CB1BC2D023E.1991.2957293579.584",
        "IL_01AE29EDF18F0AC5E1759FD5DEB7A44E70C597DB04EB864315CE7CEFDCF23390.2702.3007240258.291",
        "NS_74107FEA5B2CB5DCE695F4D23B55D356A7A7AE87294080036E81FBFF00A5611A",
        "C_26EBDAC8F156752113DE91B4EE3267ABEDBAA0A241ECD93D9A2C887C1566A5A3",
        "CD_7FCF3928CE1A9575028B7746073AE3C5F6F2163882EECBCF60F66F9FAFB60664.1197.2813777628.335",
        "CD_AC891A70DE67F8B532E5CA5EF7F5543B0D61F7E43127B27AC65391BA1CAC72E0.1609.1640833726.3197",
        "C_0887FC386FA8BA2C2DB0458AF0A1764BEC13D490407167F361F1F0B4090E71B4",
        "CD_31B243F60B661B4A8A09FB08C57077A0B3874EE963301B97C84DEB1A7C98605B.2672.2926204740.2254",
        "CD_358B12CC56B70C7D843374B1FB6AC9DD612AA1C2EE5D505F60BDEBE9063C01D1.1059.2810029538.438",
        "CD_725C909F3FE4FF1D4452519DC5E7319F49B4FDA30799FA428AB30E8A93652894.1339.3019825248.2483",
        "CD_211E06180BCB1B723514A6B61A4F9437E8B7FAF07E83A8E52C3887B5E0B0CDFC.138.2963098958.2028",
        "I_E4AE919B2D3A18F0D32F2175979961E4C7AE3C8AAF12DA639885E223AF584E97.2691.3642583955.270",
        "IL_02B739C3EDAEF0D30BF435DDE3398CB6A025C2810BB0F2FF2E60FB58DCEB2C36.1049.637538807.469",
        "CD_93A56FD79060DE7C5C63B9201FEC3583B30A043D5DCAC083E3F4C84A7931B27C.2745.178554948.295",
        "CD_329DCF22CC9EA0788BB9C3FFFB20B99F00D18849EEFBD38BCC78B3640485E3D9.2664.2953761511.694",
        "CD_EF67B600A31F150CE962D694F9CA3072B7F784C6A34776FDD01BE21CE72A06A9.1741.2954918898.516",
        "IL_C1B039C6B15CB1268319C147066B90BAE1F5E0DA59EE23E8DFE59CEDEE8D5513.761.1.144923",
        "CD_5250EC9304AFCED3B4B4C6E595A1730CDF3C33CD4C1A0C35D2E9C70B3EAA91C7.29.1548716327.404",
        "R_617D7E06F42CBC2DAEC5E45480339A72D5A864B659C9F379522A1C7552F9E4E1.313.614257462.524",
        "CD_625E0E6F9E97B18101F4421497CBBF7C66AA039108DBE32EEB6D23DC718983BA.2656.2384563635.221",
        "IL_848E55FD5F4FC523C00864C2E37F5A0ECCC3D19673B52AA68E334B012EECD2F9.1730.684144567.281",
        "SessionId",
        "CD_D5312D2CB1C1201CA5C65DFF999460FF4879179CFEF4C66A96B6BFBDF88AAF0B.2419.2157583529.399",
        "CD_1DC2241284EFF53B894548A43C065A88DE07D18C8E76DF7E050932758E817728.1075.3224876944.1950",
        "IL_4E3C5019E7EDFD66729F1899A6916549F5165AA1E927CDD13C24FD0F056D9269.2735.2496675941.284",
        "CD_C62347F459E9E9A6DD2944145D972E253F3D3E7B606F67BA3892A54A2CDCC625.2420.2533698706.332",
        "\\`T $",
        "C_95574E023341EB22A2734582FCFDC91CD48EEDDE11C3AC240BD47438848D5ECC",
        "C_56F6B3313FFBD38DB1C8A8E4828BD06527B91197C251B3D5F347326EDF37C1E3",
        "CD_D4DE714020C13AB0D412D492BA93C206B924A3D361B84FB3EF8E572392E96180.2662.1669484450.1862",
        "C_27AD50ACF498E4580849CBCD157A81D527ED4CE6ECB87F863A4E83FFC9365AD2",
        "R_7016F99D49FE853B5528528B2DA5E4B67A053BE6D3A5FB0884F25D29A425222E.1596.1297092535.544",
        "CD_6FFBA8B5854E9C5C5C698A9277971D04E447B67166A26CB7D9DD0D9F278C2D8B.104.3852634345.1553",
        "C_6DC34F83B2836B7F4C49DD4CA9153C9A45B781EB43F2F01662DE7C715D9C447A",
        "IL_0691CBC7B6A8F71067EE710A186E15C9F1BAFA0CF84741F937171595C87C8EE5.2722.1345710257.281",
        "Tape Snapped",
        "I_549610262D899A609746B30777DA484C6B4E815F4E722D4B8F981494715B5A99.2461.388456328.358",
        "C_44FB8F7C53697A71ADF859AFB9DD2404E5B90641186890162EF047D91E175A8D",
        "IL_19E57369527D4B1D06F7B62EA4740710580A7EE3221F927586AA3C452A7CD5DA.1020.116025462.277",
        "C_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416",
        "Foreign key to RSOP_PolicySetting.",
        "I_F0869A20E9CA750DED462A6856877F3B941D81878599086B33EDD22902004649.2681.2966676459.283",
        "C_0CD3432EB17462BFB5BD92FE309EBEDE9286A9F3ADCBFE4044D787F3CCDADE24",
        "CD_5991C657AC0F9E2512F72FDD17A5173C60A75B8E36E129493637EEFC667B2A38.100.3734016603.497",
        "!$'*-0369<?BEH~KN{QTWZu]`crfiol",
        "CD_FEE056125BB5C53A639F41DCE7DF075F1ED8C67B4313ACD38915A7DF950C5FC0.2654.282400813.239",
        "C_CDA55B79C9BF42A4F068209AEB65324E0A8D38BCF2A91E94C352F25F1E982009",
        "NdisTransmitsError",
        "CD_3C0F9FF380E6F9A5EF7C4A02EB445487886965C0BFB27D361EBE326C146C0648.2646.4155459259.866",
        "CD_A042D558C8D8C5910DD5298BC5D29889BA5CEA0D1A22A1BD4A1EF145F3C99D41.2003.2862790418.581",
        "IL_367B2B126DAB556D40B8009D4C3779282D22DD8E6BCB2458BF749B9FC0D2765B.2735.2986809290.273",
        "C_8178AA877B333871BA3CD48D786892AB7A32B541EF0156A73BCFDAC6C25B828F",
        "IL_9C256CE37E6F9177BC0EC95344373747E0112D20D664373933986EE480BE67C9.294.648254395.338",
        "CR_AF4BE4279039B330700F9676DFB82FB8AA7B80608BAF978E72E54EFC9915FE11",
        "CD_B4204F4CD845FAF261673483B3D9C407E18AF7773A24D7B43C66C3052F5D6AAB.2739.3534911190.382",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.2673813501.368",
        "IL_42A105F66FD5DFB98393A0C1DFD104879DCD0F8C544759E15310946E5573FDB6.2726.172223000.274",
        "C_38C8BED57EFE2E618C1C274563342ACF29C7BFD00E6CEA9E2BC5936DF8628D00",
        "IL_6E3F794B6CAF44E66A5D9BD610842B886CAAFA95D9F1ED89BA412209C5F72837.2715.3919750851.277",
        "CD_8163F817343339B5E10A75E5D9ECCB7DED2F4F1B41C40C672B95F8BB7CCED36B.1569.4205221564.726",
        "CD_6B1F3311CCA06CAB3284469851FAE24183E4FD9ED26C9E4A5BB23BA42007B2B1.1584.736758672.1057",
        "C_976E9CD39F31ACFAAF8B7B730E468AD5B2E5984554170330FFB447FBCE0ADA0E",
        "Singleton",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.292.3433342998.188",
        "C_4C65AB3247B160952785E8934037647E2EE8A6BB9A835112593E991D11BDF33B",
        "IL_3985A64DD548C159337A855FB2D96B222C50720949C8FDEAE049F7ADFD2826A5.1782.1431924164.280",
        "CD_EE6336C6D36FEDDA61F36B02415A0E5B7023058D9F095387002E82678B1D9C02.2665.4075404790.659",
        "CR_5D8A70064F693F027290F7573CE6C1A3BB6513B39CC41447AC81334C5DC5B8F9",
        "CR_404A8A60F06FF86C891EF2776F930A45A835547F74E3D08788D5D842F92EEA38",
        "CD_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937.1166.3868619072.1088",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.2199171492.266",
        "I_5EB07D2314046EF10B949E19E6473ABDC641AC1157736FE12C9A9521B49E4FE2.2688.1210369147.263",
        "CD_05D3203C0AC8D19D2C308667A810FE5B8035D169B8097B184681B340000218A8.2564.2279732545.1794",
        "I_FDFF3C9B0664E0FAF284BFA12AE8B9782E6E99E4BAEA05AB7851730AFE40F092.1465.2422988892.307",
        "@DHLPTX\\`dhlptx|",
        "C_191877833EBB16E938034A3506BE0709B7FE03ACAA65FB61B2F3088D1DCE72BF",
        "R_6A23F044A3652D7FC71AC14411C94E256DCCF9AC4805A4A211FBC6A5B34872FD",
        "CD_F9D4723921ADF841BA7CC65756244CF775FD9B7C648EEDAFF1E2DDD459957AE2.1135.1365680321.174",
        "CD_5243094142BFF50E230A225F471ECAE0DCF0FC00D9021F08F10118DC4E9AD84C.2001.3703506400.2255",
        "FB6BA6844B84FE0DE69C85BE49AC691754C5A6AA3AE728E45697",
        "AD799C76E19C9",
        "{8C2147A4-FF29-4336-B8A4-227B54CC0966}",
        "CD_D1F789B3E4BEA3C7E499229EDFC8CB7B11AB12DADC59C0292CCA917AC88CEB13.1067.915439590.970",
        "C_D5B792B23BC4AFF33F84619861154DB6F0B75D6C62833CE80A0CA636DA5E664B",
        "CD_53B74CEF924124DA99B2EAB75089B518E86CCFBAB64AA06B4C27A3C83D4C0958.2600.2615949687.1240",
        "CD_BBFCCB444CF66AA09AE6F15967A6865175BB0ED216D19970A7988B72CDF0A3A4.294.3795067395.2068",
        "RestrictedSitesZoneAllowBinaryAndScriptBehaviors",
        "R_DED77797B1689BED6B94AFBF9C743E829865A2A20644965BAF07B0D354CDC951",
        "C_67A6325E4B89A415675C3078139F66B22674A436284739E0AAD968F4582CB8ED",
        "CD_3C7C27E9E69E2100F7687A005817F1CBD7EBEA972CCE25FD772EC69DA58DF296.1314.1.82912",
        "CD_85D421B84B5B7251EBC11B8632E5849431920BE0B65D215F3D35E1300F5D0BE1.2449.3045484826.1089",
        "CD_DBBAB694252A8FA02CC578AF6A541FC3E6E5ABF42798173F7194B1B5ACA4AE8A.1751.1087863695.2109",
        "C_E4EC3642DBAAC119BB7D98363E08333001320E1E613FB7C4977DB452606906F4",
        "CR_16275E16EEED6E74BD48AA48ACA3AF381CEAB3C980CF5112BF5B3053B0589A21",
        "I_484C62416F9109449E6722EA83698F214609F546DF356538332A14AC279B6115.1014.1217742604.297",
        "IL_6952BC8C6187412BA6F7CAEE56328B9DCA8AFF615B18BF7135EB8A91F51729F6.1020.3178572114.244",
        "IL_42AADC48E8CAE9112EE9681824CCBFE2E91BE5E02C5B39F0A8D63F75CFAF0152.2764.2388448805.284",
        "C_6C29EF4ACC836F85EF7659E17930E4D493CC19A2D7E63C6C1051EF8AB7CAEFC7",
        "CR_58578AEE1F0588A6EDF4B7B9F6E4E05918152DF0FF63113A77CE8072FDAE6C92",
        "C_32700D9AB8ED2E7F27434C5CF9D7F71D19430F2B76843943FC63E3F63BC36783",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1938.1704222770.368",
        "C_328F09EA94A11C49CE9879973AEFE371583535ABF3A24603CDCD08371B636C41",
        "CR_59CC62799ED4524121BE28A013B19C8FA8396DA9DB0959637F6F4B761CC22896",
        "R_F1E9AAE7800A10F7BC98325C4E972C96F68F306DB3BACCEEFC0D635A11A01226",
        "CD_9419B1A0DB6A484AFA6622F1DBD50C832E33E81DC79AB571DC2722548BDB7332.2561.1559490077.492",
        "C_8F21C89CAF771FFCC47E28C59A7D76DBF0F63931FC16518B322428129F505FDF",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2484.1653932254.180",
        "CD_E0C7C041EF8A11355189C6C96C368318DB11749FB49518CB2835E8C2CDDDA84F.2531.2170538281.288",
        "CD_FC9E01349E08A98452DDAB16AF1AEDB5BCA867ACBFA422162975D70294A03F4B.1191.3529003064.248",
        "C_F240740A6343B96130E943F35BCF5AADCB883B78ADB87BD0CB95A949CD8BE1DD",
        "21FB37E.2039.1982116638.2148",
        "C_53EB6E498B686B11DD3F721BA7DE3B9821C3BF6A37ED4C0E7215D08454434B80",
        "IL_76EB16D02C3BB02EFA78F2097770B96E54920137B8BB6F785F9C112617CDEA9A.2689.2113585390.271",
        "CD_65AD9D71C7F4EC93858B91DB3439405127306083D38D59BB8579B4F63675934C.314.48741601.1432",
        "I_ED904383A2A43533666ACCEDC6E9518221B479E5DFF52B31AA84795C6B87AA64.2685.4129465440.271",
        "I_DCC0F7993B0691A2DA49E69ABBD62942E6E9C923F3B1D1567211352B0A39AB3C.2695.3857991663.275",
        "CD_8421E7DDE4CD5FB05BCDE6376703734D11E3617323DAFFE1E5EA09D95D7CDCAB.1581.4263356945.877",
        "\\\\.\\root\\default:__Win32Provider.Name=\"ActiveScriptEventConsumer\"",
        "IL_9ADC58CCD24E3BB9175E9B133C194805B02727FC056F35B7DD0BFBC680674DDF.2724.2805545428.285",
        "C_739CBB07290D58D47ABC1C0E69EB7169E128601DAD715F68DF7F5881BC109754",
        "CD_4D8DFA1656A0EF3C4D96AD8437B73A10EFFDDE609C718E95E7BEF8FBACD2A3DF.2665.4051510977.191",
        "IL_B0023A70A70EEABBC6C87E22F2467D5BC260881578FA686940F44BAD0080892D.2724.3530125980.283",
        "I_69A2B3B846B45D5B4E77AFCEB443999E6CC870E6F3C356A4E362BBACD1EC72AC.2708.689532152.290",
        "Extra Standard",
        "C_40D59F896F1B4CD78A547B4E482D63447FD0237E73E28B731E2036C3CEB6A1F6",
        "C_2BCD1B775A7C921CCA4DF4C5E4916A9787D7BF64C3C7B304FDF5584EE4504E73",
        "CD_62D05C4ECF40774F04063E6FDE0B1A6CE4B671271358A09E1596B6EBA1E2DD4A.254.2710789690.559",
        "C_DE1CC8B13EE598B44F246CEABE4DBF6D1E268CE3A67867331876566C40CB4C9A",
        "IL_54BBF40E19FE5F0CE8FD57918CEFA4A1969D570EBD46B32003DB10D6E81927AE.1075.15506189.186",
        "CD_F9577C2F184B32F74981B6FE74A751DF70B09D37A1C0992592B3A2A75D5D48AB.2374.583170488.4908",
        "C_6B8F637EF3630A38CD797596532C058BB5BD87D7D03BC5AC52F6F7A12A311BA2",
        "CD_C20D4B021E0AFFB61E5D90A8AD1A949CBA948B6ED6C506FD3F623477DE2DDF5D.1082.93012823.822",
        "OffloadState",
        "IL_31693429C4F4DAC696FAB29F1B10FB9D329CF192F0DBCAB56B643EE2D3B042E6.2521.2252718637.542",
        "CD_FC764EFFFFC628FB4F4C4E749D35F8CADAE14FFC3FCA171EB5E7EEED097A21DF.2067.3699738311.531",
        "CD_72C3CE359B0837FA824889C4AAB37DF3F56727B4E77D31E2141325C9B24DB989.1757.2085139788.321",
        "I_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.285.2021993801.242",
        "CD_4310F4B6525F39CA804DEC0D13A5CDF1C1FCF37012DD6FF02E0E11B2712E56F7.1596.2181629472.245",
        "CR_A90E76A32C4A193B19FDC863622FA085D4532219E7648490CF033C6770DCAB51",
        "CD_410A129DDF9C5559586E57FD96A9E962121A44EE9BB4B632CAC4A1E45DD8F6B4.109.2601159498.1119",
        "6B9E1946BE8FF2F55F1989E489219A67C731A9E9CC7487E5EC74E5F1",
        "CD_3AE83E61965FB27603BA5CEF6287221F55B7F43E8EF0935F985E7B5963177B6A.2334.3937980669.240",
        "CD_0FD7C978CE5F9F156AC49A8595D5B21E685E253948841F43E73ADBAAEE729F87.1347.3339287851.1217",
        "CD_81CBCA9C0215B59E860943652530299E5FB0DE537CE83929081B409741C1FE81.187.1.24001",
        "IL_D670180134B668ECED001E62B5F3E212E151B0184A9F505F17AA406E7A59EF13.186.2262705224.316",
        "CD_8724BEA2FF9D9B28718AB2DA764FE15C27C309D192B8F3C70C0BADEEA7D258BF.2557.1871528765.509",
        "IL_725C909F3FE4FF1D4452519DC5E7319F49B4FDA30799FA428AB30E8A93652894.828.1.81389",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2041.2715216352.368",
        "IL_0B5EDAA42C9675F8D2021C39B37DD031763091DE8523969BAB52C951879C0978.2722.2990860299.287",
        "CR_896B6F9A9E07C666B49D000879A54E67F9CE0EAF2B8B7EF7BCA31E7303EC222A",
        "CD_C77839C5FFDC5036AEAE664C904195DFC3B53888BFB351AAEF0E033BF5CF3DA8.2600.492070118.1749",
        "C_9F13C5A432B6292E5BCBF6D4FA65154CF0D5CDBEC6C0D20732479F8D80A97555",
        "CD_A9CA40480A6747BA83786E55386C670F9DED141775CDB04CB51D34F54B86DDBD.1915.2631726023.289",
        "CD_8D338BAABD5A4CDE9CD22C60F5FCC1F5326D81FC7BA6D48335E5E3513B7182CB.149.2822912453.643",
        "I_B84AFE946FFBEDD9AB4F5B76F40CEA26AE15B1F186FB20ADDFC622B36987882E.2718.3483910466.278",
        "CD_5F469C3B14C86BD8171AB925DA0880DBBA7A8E1FE64AC6F8F7594251648D1E76.286.2110531906.804",
        "scriptFile",
        "CR_666AB4303990992F36C1E67C5D472114E6703C6735120683CA3C40AFD0A2FBBA",
        "I_0C9560B089ED0BBE537EDBE57097F3C6215297211AEC47A712BBBA735FF3430A.2693.888195114.268",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2070.66865199.188",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1751.1825656034.180",
        "IR_5C670A419305640007AA9AA161CE0975646DEEA64973112E2DE223893C0FA422",
        "IL_F39BE2F2CC7551BDE90E624B5C7301C158A68D618B887A135B21C9CB3CEFD863.1054.3215474501.309",
        "CD_B45E8974D99AEE9CFBA3AAD1257F341531ED5809367CE4B614DF68E300B793CC.272.2852464037.1372",
        "IL_5FE18C6BE812DA3AF51D31EAE94ADD9FD2C645B09D0CEDD9F54349B2D949FE43.1015.3565299583.357",
        "CD_0BEADEF5D3A88C78AC78DA4B138F927C4277A4A7EF33E41BF5355AB5E59743F0.1065.2535477237.1937",
        "CD_1E95EB134BD1F60C54BD011E7F7F0F99F605256CE2A10E758B49368E488FD646.2523.2002146951.4061",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.2108255773.180",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2070.66865199.188",
        "I_AE153DFBF602DFA10CE6A6B855346AE025E257F8D1EF346D5547F01008CCDC3E.2712.3148423235.296",
        "SoftwareElementID",
        "IL_DCCE641EEF694F28665033BDF450BA8C04EB90292543C7AAE501CD3A05C2D8B6.2701.3214588246.281",
        "CD_6C29EF4ACC836F85EF7659E17930E4D493CC19A2D7E63C6C1051EF8AB7CAEFC7.315.315530702.1414",
        "No Contact",
        "C_E58DB6F2713150A46F7C4D8E4C78CFE7E744DC308B2C7F2F5D3E19AF5E925D5A",
        "C_20435E8E6AE6B07C92579F794D715DB6D35677395F702CF6B0B37C21C5C70F22",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2013.2058938227.180",
        "C_1E1CD952E598C3858F01E05DCEB6E0FDDB93A88BD0100C8466601561A5B05EFB",
        "CD_BA7526B37D90714D7B62CC8C0306D68C0FA9CA2FF62FAB9215A612E133C74CD5.1820.1038775686.4580",
        "I_4EC544AF531E13F7ECCEA34174B06787C6B104EB484B1C6173645A633BF7ECB3.2709.1879607412.294",
        "ValueDescriptions",
        "CR_149A27F19116F7BD8DB3767BD20FC5C894B45C207E040B561A2205EF78DC6727",
        "C_E7A77CFEB598AEF3D1193E3884EBB6EE52359457054F97DF1C2F8041CD6E1C7F",
        "CD_2043EC9092C59491FF884418C0893D233612EDF305F1000C5720E3CDDEF86009.1930.1833190523.312",
        "CD_745B48F3D3663775E674F1AC382685A30C5D61F06F3C74BC6E2C4180489D568F.1173.2869032566.280",
        "C_EC87315EA07FEB82B95B6ECC853900B53DFD9FAE520CF4C1FE8CD7F52B679C09",
        "IL_91141BB6466293A25E1F7E2067862BA8A742A4E89CC04E0986697FED67A0F56F.2682.1146603662.283",
        "CD_581FDBF3A3E51D753168374466B7C40E39F607E7397DAAFA13C9AC84F1F3CEA3.2425.2414082761.364",
        "CD_73D523E5D8422D25C3616043387358F30734A705AA52BC4685A9ACF44AAE4050.2195.4258617378.1204",
        "C_B0CABE1A8A062D484B15926B839DD85BE290434AB73617430C4831E218290BC6",
        "In Service",
        "I_1A84077BF4FB1F232DECD798D5154E1CD2AEFFEDE9344CA623848E1E6D64A35B.2763.523023325.350",
        "C_753700D668A51B8B5E7F6080EC2CFCE8CF258A17D33CBA4E34D637C64FD9CCD4",
        "CR_C1EDB2C3B16B75C05D994CBAD887CFED943CA4B2E1180F3891F60984B8988B63",
        "CR_81F5CC7DCEFB1E634599916220181F35C3DB70B94808983CB78C381325F1AAF3",
        "C_F50B9FFBB97AB1D3F380025D32BE93929D2A49CE58672C10FCCE822AE924193F",
        "CR_9E80816304B77C3F7FB69E6FA27E369EEAF4355C2560E5D96A7A1A687778DD04",
        "C_9775D7E59301DC60631DCE98F8981384E13FBB752E9A4E20554B45DDF5046735",
        "CD_85FAFD283C1CBD7F1505470DCB5AE71CB038E283B72DF215B58C5421DD9F4046.1348.1110075085.2132",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_81E1B447115AA495169E968D729B808E6AFAAA8904F1D6ECCF6F17BC5CB9988Cpoin",
        "CD_BE9C3C03699415DC90398309F46D14386ED8803A3E02DAC3C1D2D0F69AA43EE4.1896.1.93451",
        "C_064843E966479C3B4CF71DBA14623DC8C5CF1B385A02FDC292B3B3F5C45F4BAC",
        "CR_C4C4AC3CDD7A9E38A340BB56FE91B2D1BB13CEAA14A840B9C15B1953B57A1EE9",
        "C_7E0816BCB5F44018ABCEB520770DDD7EE174F2DB2071F89833FE5E4D9500CE80",
        "C_D68F73AB1FB8154C504A5507205C927317D2835D17241743599EA4CE5EAFF4CD",
        "CR_ADADA2B2CDD3BACE2485D2B360E811514E03484B4187AE7DDB3778A03ABAD994",
        "C_2CD004338C5F89774E29BF3E641901E611546726ACBFCA38A9243331558230A2",
        "IL_DE005066FEFC9FF24C8817ABB8A5DD45FAD11D751BA11D5A04F7861C2D0B3DAE.2736.2738140148.227",
        "The SuperclassName property, if not NULL or blank, specifies a superclass name. Only classes that are subclasses of this class are returnedIf NULL or blank, and Flags contains WBEM_FLAG_SHALLOW,only top-level classes, that is, those which have noparent class or superclass, are returned. If it isNULL or blank and Flags is WBEM_FLAG_DEEP, all classes within the namespace are returned.",
        "IL_818BF5D5A4B86BD81E9ACB61C5E2EB7433E3092F4BA7D7D3B8EB84A0B71A4A38.2725.3997208432.286",
        "I_C941A83BAA377FBAFF034894B44F1F5F2A08C06F70B4B461B6EF32C4D137250E.297.783654240.311",
        "CD_537302A7E83F131D26638FCBE571E21F594D1701F2B6EC035364D7AE0477F248.313.1304810171.559",
        "CD_8669524660923BEB3DA81E87F326B831E705D4AD2D26F7C6F43EC5D8367BA37C.2153.3786855717.327",
        "R_EBA803BDD10FCD07C6F9C4044F0BD44EFA454D493210D7986731731C785D394D.1784.2042236554.590",
        "CD_D87231A9E7FFCDDF076DE278798260F301CAAE96DDA814464055E4E89E40C9AC.1499.3527657706.722",
        "CD_0B91D9FD5945CFB775F0EBD6F596CF88166602A6156A99CD2B11EC548E5ED28D.1093.1475291799.623",
        "CD_4E05A85C7C9DB6824A0AEFA83C9B26B28AFA6D8D088521A8F0444E981BA3B980.2759.4130897664.292",
        "I_733F4631087A8F2BF57EC213AEFF221568486064B190B110F9AE4B8FB217574C.2689.1687383617.262",
        "I_298D41DD8E2343803FBE0777F09D55740EC92641386C4C2EDDFE4A658D320193.2694.1096984007.279",
        "CD_8DAB1E77A48D33D709C49F126A0E74571C08F353352505AD29F647015F44D9CB.1570.4185883712.1898",
        "I_8CF241F803CB0862FF2769516928293955BEF82DBEAA565EFB3532A22F8FC545.2698.1999019845.262",
        ",4@$8",
        "C_C4DED7ECA25B95F591906DAA16FEE49AAF9419718F2D225EABB3257FC891ABD8",
        "IL_B3CCF51DA7E2E82EF4B967050224C72E8B5296498ACE167E310066C0B48C98F4.1802.3464864859.309",
        "TelemetryReportingFrequency",
        "CR_82899768E5AE4BBBD9569934B91FBC458CFC15B5022DABD88277069C398DDD41",
        "C_D243E66B180D01D8A4F9FFE662112E7920CAE6094EDF1FB3B8BE68097E45823F",
        "MSMCAEvent_SwitchToCPEPolling",
        "CD_61E83C4219F5D6E6B7DD4D1FC3ACC22EFF835D5C2DD848400DBFBC504549FFD1.1338.1050135906.3768",
        "CD_44EA48F1447554EE6A5F1B2B75B3D13F8D9F6E269F5EA85D941FE91968D91A16.1097.124391791.1790",
        "CR_E241A982292C9628611468FB40BE60D4CC1B723333EE25A7584E871FE9DA753E",
        "IL_FD30518B7FF6E67C50A74F8AC892E8C628384E60A02513892229E9C56FF7B2BA.2681.2887717859.298",
        "T`LPp",
        "CD_0E2A8B91A7BA07ADF29E39AEF1F72CF1C889DF8DD426EB9E4E12C6345FE58BA4.1187.797610231.414",
        "I_91BB5F8AFE5873E9BA8EBD1189F17D947DC5BB7E366AF568F25A5BD3FADD34E6.1334.3559712411.305",
        "CD_3A3897CEAE2AC0EF137B024D2062F2FE2AA48E93909CAB79C372EEE12265F8B6.1575.3317300433.543",
        "C_D5BE8954257760E2F9A360077B191976128D92D83EB049A6706C73A364DA412E",
        "CD_90BEFD5DB48494878DB04E68E99BC36C64E916ACEBE36216625D7CE508C8EF7E.143.1881642718.721",
        "WMI_TAPE_MEDIA_PARAMETERS_GUID",
        "23576EACB16C1622C2314",
        "CR_58036643D64E8A1516491471C2E429C56B6A6CFED0C27493BF3ECB5339DF324D",
        "C_024B3EE5711125ED9BB18C4A9AAFF769B862C9895F2BAA403A8960F91ED798DF",
        "CD_674A600DCCAA63BD9D394037EF94415E97BD130F08DC05DC75146875725ECC64.151.24709548.354",
        "C_E66D2A11AD2317154A9C2C61CC140BA5F198CC545A25F24736AE23D74E16B49B",
        "R_97C7D526C4DBEB7083476F235A5653C31F00C78AFD98652230E17D721E353ADD",
        "CD_2A2D6E6AC8E9DC7CFD3B145ECD6507F431971D2D607AF7EC159B3B5EAE53046F.143.2432854566.581",
        "CD_C013BAEF52C1702952D5C4A7F180A34E20C7F843E3022D39040318DA1B2232C2.214.3775844960.822",
        "CD_F262F70EA5BF28D85ABB5E29A2DC0DA2AE6549733C60C20BDC35DE79FAE05821.2634.3416536366.2936",
        "IL_D848EFE87C64F0A15964D91B76357E6B4433ACEDF3FC8804852A3E1F69177ED2.2716.2156018706.274",
        "R_3A1D2B9036996AE4681DD029594209329760282E8301045223F1DC6AF85114EF",
        "CD_DBAFD0363B932C012CC74B45C91F067589F90C7E922E99CF5A5FE27D21332F93.1812.1.17862",
        "IL_75152BCD568DB7845972EA624FB84F5F521850310C2ADC6EE7240F0BDD1AC158.2697.2979308410.284",
        "IL_6D62D7DD45B5ED9F92154C67A2CCCABB9210F15B90BC95A599C735B2EBB140BA.2698.561315256.265",
        "WmiDataId",
        "C_92F79C606CEA0C128DE3EACA21B84DC513661F7F539551F200C91725DE47D5D0",
        "CD_A91F5860FAF4D61BB59DF2B1BBEB7B81236143770F1F0AA075F34F7FF7BBC1EC.2641.3287204894.260",
        "C_4EF9C71BC878CDED855571486DDA10408A556B0E0B2473232D97D8125D3EABD7",
        "CR_8E41820F5D3747F37A9AFB4C6D31D95936F76250DC1731B0B518951FA4D1C211",
        "IL_9634FA8EA8666E17362935E85D317FF216D0E456B4F0F4516AB4F0B62EDB0821.1053.392897305.316",
        "IL_12B7B7D68053B4F79E27B6FA51D3C5955D5B39B70248BABBC3470DF12043572D.2683.1422670703.279",
        "IL_F3A7CF95E8421F67BF28459423C82D21629E16E53EF074D5B75137F6770EAFE9.76.2923548521.349",
        "IL_C28E154433EAFBBEC9AFF6B03CD94FB6D01B32C68CCEA476ACECCD0DB049A6CD.2668.2336484557.283",
        "6877243635B3D92AE3FA1BB77A2C716BB28364.1151.2683006443.759",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2308.676164546.188",
        "I_D7DE59686BCD2B79BDA96BAA2026C9FC64F20126D69A8956A074108FA2266443.1097.3594349353.196",
        "NS_892F8DB69C4EDFBC68165C91087B7A08323F6CE5B5EF342C0F93E02A0590BFC4\\KI_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C\\I_B9EE4A50A67D6134A9B62FB7EC1E9B243A0F3C36ECEF51393A3D740A782225E0",
        "CD_430DF6569120000240D715CFC3D7DFA7990D70C64962E79D5490789E796A3D58.1350.549011728.303",
        "R_5D84A86A9E670C8219DF639957B4D8868501AA04224951D3A5414B644058CEAA.1105.3541494386.568",
        "RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls",
        "CD_BE54B322833AC65DE68786188F013C51591B282969E32D07CEC53664341FD910.2661.1733044325.705",
        "CD_AD19852B659F95D5A51E327D83B06F4CFE38AB7F7821BA9B06B5184C781CDC4D.2069.1695043126.169",
        "CD_55795F81C8422B8993E279C97F35D31AD4DD7851F75BE99F367F8BA09963EB67.2158.1596096425.627",
        "CR_155D9E7AE6D9F85361D5CC740FA1EFEDE91BCBF995E255746E05290A3497CB99",
        "CD_3BBF6D4F66D3DF1398ED81700FAB6C7981988924128EF9F6E933D2D4C1E103E9.2636.1816601474.541",
        "R_293C515626057C49BE9FEBCADE3529905E03FDEE2BB0FB67FF107DAC390E7179",
        "SOMID",
        "C_EB74DE80A4ECAF39B636937B76E6D45F7589467EC770ADEAD91605298392EEDE",
        "CD_2A1EA88566C251C922ABAB65FF63CC8104AAD5E5A141FA41759E87856BC3DD82.2599.1187603469.713",
        "Cluster size is too small",
        "!$a^'d*[-0369<?BEHLPTg",
        "Registration data common to all instances of the Scripting Standard Consumer",
        "C_5B672A9410EA04ECE1B63C383431BE2FB673EE31536F61B279C4962B0C974372",
        "!$'*-03r69<?BEHKNQ~TWZ]`cfu{ilxo",
        "CD_34C7F02584835C9F53DA8B610B74BCACB61B9E0BCE6D8A239F117F5D7E99EE2B.1089.1114140754.515",
        "CD_651D061E01CBD32AA7F4244272DDDC49803CB2C80CBD43AB9BAF178BB7D52D97.1103.2393635129.599",
        "C_72584B474A2F61A94CB1C4A7807C13A654D2F90C5DA8B57E02095EEE5B64E1DB",
        "eventLogName",
        "CD_DC8E72CA352CA269E6DDEE517B876BA7FAA771BCBCF1AFC1EF4BDE4F8BD8E504.2040.124340799.3092",
        "C_D3559258225BBBDD5E2DFDF52DE5A11681B899B436DB12CA240C43C8641B92A8",
        "CD_4FD2270AA7CC321848B51530B7A77A9E39B5486B55CE0C09A2B597A1F1FCE1E6.286.116185637.1333",
        "CD_D628E03D0677752FF789EA97E9BA34C4E2A9B6A38484A7C74F4BA213CAD47E8C.0.2713842881.111",
        "C_12B929733A58D0160C0FDFDB23E8B6DD247E7D1693029B77B484D1BBA4C89AC6",
        "CD_AC9AD25BD40B6722261E256701F4549D4AD6E3CDC6187FFACB6CAF3D4F5CC978.259.2238364020.542",
        "I_70551F84D219A78BFADA6DF7C4026B7FE1B54482FE569A1962CB8B24A6120E36.1015.2482282305.391",
        "CD_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D.2757.1452813185.656",
        "CD_EE6336C6D36FEDDA61F36B02415A0E5B7023058D9F095387002E82678B1D9C02.2595.2293514532.670",
        "IL_3BD30BBD5E5F0A0256E5304240954604220B8912EA00BA63FEA8E61AC5DAFDD4.2689.1384573869.269",
        "CD_193704CD663D13C9E84B3DCFC7B70A6594657C5FA1EF671959A670E734FAB578.2574.1551901235.245",
        "IL_2E31AC6CC351BCC9BFA78493D8B97E49D4E7FFA3928279503F92FE6E22F6067E.2689.3878770108.276",
        "CD_AB1C96FED05D62166C94AAB8AE8E68ADBB7D202B0967CAE80232063AA6F41C6A.271.3761605247.511",
        "VersionCurrentlyRunning",
        "MuiTrace",
        "CD_FD21BC8E1DC58C57FAB927138617C0437B0BFAD6702439A97F4F168631CA48B1.1930.3584784181.1093",
        "IL_FCAFD02952E62CBB14F71D4B805D05241DFEE4F3755643B3119DA4E6AB7DBD41.1073.2089762337.337",
        "CD_3596245B8E5FF0EC67AC5C34C00C2E8649D428468BDD701F6037061347573C91.1925.895111085.300",
        "C_4082A72ACD016CE3E809C18525EF28CAFFEB76B1D6E2F5C00FFCF2C67654A896",
        "CD_A3462FA053AF6E151FDA78404CA3481C64A83DCCBF5748EADF4E7C93603C858B.2731.3059798411.621",
        "CR_E69678D95075FB6BA6844B84FE0DE69C85BE49AC691754C5A6AA3AE728E45697",
        "I_3891F4638541E624805EBA5C0030559C8C34F083FE86FBF417221E93DF20A6F7.1751.1276124379.340",
        "CD_71929A7D074411D8B4A8B4411FE9FC801D8B39609B6D3D65F6EA33D3E21F0336.1555.4232185889.987",
        "CD_930877E805DC4FE95AC6F1E943D1DB43C1561BEDE5B613B8E3A3B85C32FB8071.2587.2640466484.1706",
        "R_15DD3B0DCF2819EDB87C4363412C3F99792BF1AFEF4BDC92585A3BCD2CD95F12",
        "I_E497AD4E10D7242AC9468C259EFB05482031E77720661ECC885284DEBB517B41.2682.1177207384.290",
        "IL_68DDC0CBADF746460BAA2773BA9404108071083714FE79386D5843AA94F942D7.2687.1418894872.274",
        "R_89D253C7F34DE1BDBB149B2A6193A187FAB48CDF693200563636A89559A9C956",
        "CD_F5E490F396B19933B329A25606C9DB239136B855ECEF4EAC26CCB02B99FB61B0.1555.2510179974.803",
        "CD_FCA81D040FC95DE948FEF608A6C792CE7659D295F84C50D931F9A2E52513B2BA.1.3101093403.277",
        "CD_0AFC43F6F954497AA8887334BB937F82532036AD13DD27C64055852F3060BED7.133.688582925.4137",
        "C_F013AA523FB7E1141C46835F3813ED7DA1F035235D72E00C304E0C6683ABF645",
        "C_E5CECE3568E22A8D095DA9D66ACADDD40984DA04C8DFB2D049DE12067ABD39BF",
        "FreqPercentage",
        "CD_DEA224BBEF40A5F2D4A2CA371BF633744D610A42E8901085FCD10393CC6D8624.2111.1546748764.493",
        "IL_867009D1FACF80A1E2C919A8EEB83F6A5BB16EF95BACD064E526589732F91844.1148.214367202.283",
        "CD_1B2F7F9B30B8E3085F6FFF8AD6831B1EC53004667DF11651EE5F82516EC047F3.2625.1266690007.570",
        "C_4B9A5F4131B4DCD11042ADFA6FED4351D5C27774CF36F6AEB30CB03131693AB9",
        "I_00602D32AE7CB2E478AD3E478C2A2E597391F9B6E61223EE0DFE928A50B62836.2689.3937403319.276",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2750.1656231170.180",
        "I_360885C5E46B70800B6EAE78F3641423F332D4218615BE5AFD9061C882DE9F38.2718.2823291432.270",
        "CD_193A1F93E9A6CD7A4161C999356A3002DCBF3CA9FF51ADA6126191BC996D2103.2555.744453959.809",
        "CR_84DC3D5BF4272A04D490B0301A75593E19CE556EF346F7E0E8413D0189B83369",
        "C_EF24FA098DD374D95C101EAF1EFB06042051D9D0523BE6004CF30C75E16A8C5A",
        "CD_E74AE202199C3BCCC455E82ABE0275331EE227666C9BEE443B7082437E29EAF6.1267.1.18049",
        "I_DB3DC047ADFDB9AA95432DAA8C113C49A05B0BE4377EF4AFACA04D37246D6A54.2729.57080638.254",
        "CD_0E67BB25323DC3EA41359AD7146AF598B2070A0BF4C85FF998893FA100060D77.134.830106710.5830",
        "IL_9D360E12E76893327DDD95AD8B4D48DF0DB44A875D92EFA188277285FADA93CA.1016.243194336.305",
        "MSWmi_PnPDeviceId",
        "UmsDirectedSwitchEnd",
        "CD_D5312D2CB1C1201CA5C65DFF999460FF4879179CFEF4C66A96B6BFBDF88AAF0B.2424.3361498448.337",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2014.4126882503.368",
        "CD_A7934FF637F20334EEBDD374FE2444F45A95C5B33E592D4DDD69ABAFD3C46F2E.2540.1223563045.498",
        "R_D0C1D268B211260C5533855A370A305EA61EDD0AFC9B175C92F24AE45B25D0D0.1058.4139615353.518",
        "NS_3579DC951657EA60871CD1E9EBEE6A8D0AD711287837BD9631F6B3FC9EC7141E",
        "ProviderVersion",
        "I_49B18B28C1F2C29137020041C39C3EC733220FC12A9045519972261C8293ED11.2701.3423949710.272",
        "PerformanceState",
        "C_8005FAC3261894B05944F0070A29BE32799EA7111782F3437D1C0F7794E4D4FE",
        "I_CABD896996601881CFE18964A9466DC7EFD1B4BE32C62E388952653075AF8DE9.2682.2283574034.282",
        "CD_B7D694BD6E54C6C257A930A7AC179613D232B4C4655931D3353EFDA5D04618F9.1270.1785998720.240",
        "CD_3C1F1A447EC4276186A6706A3A49D07A2A316ACD6912E09A63348E2481FAEDAD.2744.1680966161.356",
        "CR_A8DDF63277493FA7727FA87F83A98725771DF4DFD8E57B19F776BF46D63FDE5D",
        "C_6FA80CC34C4BD31681946B7211AC65F5C0BC3FAED8972E7F4815E1CC4161ABFC",
        "CD_C19B458CE57692C92F3ACD4536E552D997ADC4C56D2CA218BF4C7284B38BE1C6.1346.889596712.940",
        "CD_8EC91BBAAD68B394F044D0C97A77BC7357F5EEF20861CA716DF79AF75F444F1A.1544.2358764925.491",
        "{E5D8A560-F6C0-11d2-B35E-00105A1F8569}",
        "I_CBB7FC2D702638F2B6EA795EBD56AD5F16262F1969926AC916906FB0DAAA97BB.2682.3415943441.275",
        "IL_409829D4D1713FBB71FD7A81B3A5F25767A05D20057DC65532BEF81AEFEEC704.2699.596837138.281",
        "CD_A4CC62D79FF3BEE16BDA851BF3B4C6100B812B5CCA4229E192A675F8D51A19A1.2657.571896984.1903",
        "I_57180B2795DF63185637A7BC1CF646845F72A60DFA58ED5BAA078D0B8D0B69D6.2678.75754567.293",
        "CD_CF5E27B8D911095CD7FEC61CA4431ABFEE0B23C5631E7FF85508BFA2D107C4E0.1992.1470238044.571",
        "CD_F2C608EA415A514E5DDE0744E350C5D6F7B19EFAF19967D7E934C8B89CA08EE8.2410.2221252790.5370",
        "I_102077698EA904DF5C8F0CFC70F0723E119E347A7F574EFEC1AF2933127E6253.2704.2783475279.287",
        "C_5CFA980432A95F36A376B300F274FA5C69088A21DF553156AB401886C2073035",
        "I_A1CD47E326D593CA413B7682EAA8C8C545B74CC9B1818B0D631EB0BF3B73D638.1015.1519930690.334",
        "C_D20240298678DE7FA3C580B599D2D13C6F4AD796F634F024D78D97ACD858006A",
        "IL_CA7CE6FFAF43B56926F209A331362CC194ADC07878E9BCCA1137E8869300AA67.1934.2755846958.293",
        "CD_3893EDBA1FFE14E31D305F26A8C305A156A91E1EF7F83521E3C67BFA88E1702E.1481.3499840272.711",
        "I_0194D7E956D38B1C947B3250090E0D48410CD052B7BC03F2F1F43DC398A99DC9.276.1010561573.332",
        "R_FD5E964C71CFA4BE1D6A2ED6A1FB118B6F5624D318527B5EB8C3B70EC74B58D4.1938.2195797487.586",
        "C_6BF4074B06004A36C71E7251D583F11D93600EE30099410036224B7AAB597368",
        "C_249E58828B05B219C8BA8313BA785229871D4134A57BDB6BE040EADBBFCCD561",
        "Established",
        "CD_DA3DC1260150EA9B0B2628C0C2AA81125377900B91EB681EA05BC31E6A7900FC.15.1110044606.1542",
        "IL_FE9C9CD46B3A30EA5E4839A24B058F7B22E5E084DA2318B01E16714929725549.2691.2386019595.273",
        "IL_851E2803FCA0ED313BB5CDECFB40BACC4150CF2432EA202122C27A5C46DD69C5.1072.2816137521.332",
        "C_EF51E3569F347717769E97C478C57F24DD4926D555913F5FEE15501F590DCF7D",
        "IL_AA899FD0C3F4EE4BA32282847A8D6EF726723A11F0468E9F2CB0DA8A4C07ADCC.2705.2397306402.291",
        "CD_D8FA39278C1247AB8B1FBB10D8F82DA6DF57FDCA81312F4541EF472290E1F3B0.2102.436903198.530",
        "R_C942A8F8E1BE4E76DBC399ECCEE0BD23B27FF78ECB20D416057B9D24D6D47B1E.2462.1209922039.558",
        "C_6BFE6A8B23F958690D3A4BA6B445510B763B0DE30F35AAC145955BE16D3508FE",
        "CD_5C6828A3364FB35ACCB00567C7BCB4FAA9D96E7DAA4FEE16FD257A946F33EA50.37.2637482829.1035",
        "I_3040C92D4D1C9502DF63374E427875FB5F024B0D5B541BAF38EE58053D345D20.1730.2584463817.338",
        "IL_35D1EA8B8F70A260A4C64A81BC9ECA24D808915AC696C96130F94A725AD5E68B.2685.4173325227.282",
        "C_B415611B7F1F7EF497B171E8534C52AA364C2819C0AC05E70DBF6ECE9861825C",
        "CD_323D5E05836B46F5664F2463C34212E1954E843C0EAA64BAC76FC3916A5923F5.2573.1172993053.220",
        "I_3061B166CFBF6742FECFE7755FF14887EA2F8F0CF5C355B7F23D2CCDCEC46AF3.2679.1696751788.275",
        "I_59543DA79A0A83C48BB9222B5916E17BBA9A5688C362D35DD3F13589A2596294.1164.4075838192.328",
        "CD_31C57C9E263B97D03A756EF80651A37DE79FAE86B9B4BB0C343E3E41365C70C4.2579.1532124020.1053",
        "C_61C9D893E8ECD2FC986480B9F759F7B728716D99642E5BC04B6E6F5E2115CD3B",
        "HNet_FwIcmpSettings",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1049.1669254382.368",
        "C_AA941D6FB7B25E3841E6273F5A7048C9197D07A3AD7B18F91F0EA88E4351CAA4",
        "IL_43D16E20ECFD623339FBE940EF30E5D8E0491605420EC6604AE909D12A90FBB9.1104.3065282225.190",
        "I_8855C751C2BC57C20DBBDF24CDD46E4DDEC1D1CBA77D9AB17AB79C2AE000065E.2694.2635998675.274",
        "KI_C42B40D18695E044F98E85080DC73D0D2D750952C365600DBAFFF12874C6651C",
        "Suspends or un-suspends a directory tree in the Offline Files cache.  A suspended directory tree is always offline but may be synchronized using the Synchronize method or through Windows Sync Center.",
        "IL_6F254FA6E8A44DE3E69CA144FE59E44C280A864F94F3CCA0962F7FD3FFFD0ECB.2690.4007393135.263",
        "KI_9AB53806E88665C047824D5369B271C53B233BBEAC7C15BE3BA9BD214E527500",
        "CD_4DA007FAA59D85678F2228217B51DFDDAA6D35079858ED061C1D1AF77F57DEA0.2589.4037895316.672",
        "CD_52FA3652DE48FD253CE895AA1E0F7F7869B94D77DBBF33883D1DBCF38C65343A.2739.3192076887.998",
        "I_9024A81B4E32874BE77DA64DE72C239CCC0F6B847F4BBE478AC84D2DCF1B7E82.2699.1942572615.274",
        "CD_3E82FB959451C3E35A276AAA1FE1C0F9B93A0726AEE69E99BECBBEB606DABFAD.1149.1822413114.394",
        "R_F27728D32A3636F45280AD3F71C73821FAB17D765ED15BCD09B89B7007E5475A",
        "MDM_DeviceStatus_TPM01",
        "C_D1EF7C1E0812A2A26C6327F2A3B7DD906B634F362ECF030C8FD523C6163A7423",
        "CD_E4F1C8D43CF6961CAD75D4CE9F32B9D90760450C3087C094F4C15FE6A994A33D.1616.1830096799.427",
        "E8E83DBC2736145A9E1FDDBAB7977992014FACBCB21CA209B94E19685EE62",
        "vedSignalStrengthEventTrigger",
        "C_6AC83E7C3405E237BE031334BE2B1588654DC981BE9868FD8B2192931F6350E6",
        "I_727C2D9005519EC05034DFB3D14E540EE6FAE5982A0FDB82192B0F03F27474A2.2704.1189115783.287",
        "C_53DCE9419CDBBAC59B50863124DFEDC7E011A4B01B39B0C102140C30194270E0",
        "Example: System Slot 1",
        "C_FF71E202E2A34447E8E5354267F9FFD470AC6E6D127AAB0563CB37424C6A85DF",
        "IL_13C28897773F6F5A9F386870999C3296188ED475D6EBA22A9A6782D9237F4CE8.1103.2803997363.313",
        "IL_B6CBE99D5652E5093082BE72C71EE2A5178AE30AD7D99571D547D2175730C93C.2720.3997725361.289",
        "IR_E8C60AB3F3BEF4861A060FC90E12A45A6C31AE0A30009ADE3737E65ABF5DC96D",
        "CD_C6F302354CD11663A914DC4001850FBF0A66C16EFA86F9329AFF93A3CB628944.2191.1.27696",
        "CD_6FA80CC34C4BD31681946B7211AC65F5C0BC3FAED8972E7F4815E1CC4161ABFC.158.2762911777.302",
        "IL_2D906EE78B47924EB2DBC2AD7D7119FF21AF13CB3C29778D1DD83CADD73AA684.2697.2457263182.281",
        "I_C57031BF52A2FCEEE38A298F97F91A031385653D8334A9746F7BF0F674DC1476.2693.2144678920.271",
        "CD_C0932D78F140997A49C8B45C94D66A040A7701473EF29BB14AA1C56EBE031CB2.277.298858821.370",
        "CD_1F25AAFC1DFD302234A597D09198F965D3DA468B1863CE8D32B13C0CE151009D.35.2557704513.1124",
        "I_75253219D674CF0117C64521CECCEF8B18A40F301D32F791873AA54E8F1E1537.2687.1294428517.275",
        "EBDB5463BE3F426.2720.3093271709.293",
        "CD_1FF99FD98547CA076FAA0DD1F2AF44F1BFF4454EC9483F61CC85AF85FC12393D.2540.813056520.508",
        "C_6BE9B1C8C5C3B4255DA0665A39E69608A741A6E82E2CE4B5CCEEE025A6A87F82",
        "C_5CA50576C5279E0DDE375D3AEC8ECA8E1927A238C54501EB1C8A33D455D3852E",
        "A power setting.",
        "CD_0C1B95E6D290B66E321C724410DB4355B639D2A083CB9491EF83C50DE14B1E8C.1479.943493605.4236",
        "IL_74C70C3A9E087645E74FFBEF480E44AA7ED90FBA65EE76D8B12F0BCACBA1B6B0.2682.1579051653.276",
        "caption",
        "PolicyAppId",
        "C_F77EA4DCA78917FF5BEAD9815A0440B9CD3C526312D9427341EC66F96C8BAA82",
        "C_07C552EB8842D691C4A22716140805262ED277A06CAB4124C417993F14E689CF",
        "C_EC97D00816B4530E92B0346A6B6B453699A71F2B879F99F794A6FF9189BD53FF",
        "I_96620A5CAD99E99B5F544A83F96C7A7592A14FD27B37CB8CD3039E70B600ED2F.2726.393489239.282",
        "R_703C562B7404A6234AAFEB9B3BB242E3FF62C76339F84C997DCEF89443C2DF65",
        "CD_604DFF7349A51C4BF81E539358140729610864A244120CB2ED2FC9F108D71554.2052.2081710356.159",
        "CD_36D01CEB8615511941615255EBA663CB732C23C4C7195BE6D3932961390218DC.2529.2810949922.3662",
        "I_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.3196256677.360",
        "CD_7DB1E30FC06BBCD83555FCA1DA86A907938086DE88B466575ED4B935DD61EAE7.1083.1474623773.770",
        "CD_B0400FB47F7ECB30AEE49FF4C961C26F6A634538D5E7611AF7AD743AD9F6FD38.1596.3662821844.480",
        "Q!$'*-E0K3q6b[W9=At",
        "C_F0EF832F7E32814D7777DD11888257DC22CAE482B915B9B0977CF796309CDC79",
        "C_4D2B02733931A1414F84FFA98E841B8FB5019C035007B0664BF41E07873DA206",
        "IL_FB67BC9A01546DD2EFB6EFA6D39C716BA78CD1D0734C8AD4475883915EF8412C.297.2959364088.313",
        "IL_9861CF067EDEFA63BB145945CD027555021C06D2F6160C33A61B587C410853D5.2693.1232529987.272",
        "C_19D64438B52BB0867C48D699E88A863202CAB587F93FF7433FDE4846517B3774",
        "I_EBAEEA562CCAE5F44F8DC529A43985A152EC238D3F950BE794ACAB0A20B82979.2458.3154330122.294",
        "CD_E19750357E2A13069554F30160B51C803652B034BFB8C93284F4D3A5B6AB9DA3.1923.4001968279.1053",
        "C_5B820487CA8D19401E093756115B18F0681FC4EF214059E3AFDDA51BC455A8C6",
        "oK9<`E",
        "CD_FF89590C844CBA58D43564BFAF3A9C1E0ACA3DFA20CB42FA7E832F2021AD16C0.29.2732496118.692",
        "C_0F40AC813525BF23B517D1D92CC88BD22739A3C5B59B5537548A36265FEAE58A",
        "CD_322E03EFB160A47DE71A7AC4A5E201730C10AF1089A23A514F137F0DFEF012D7.1049.2169377833.134",
        "IL_F59655E05F6F1554AFB3EFB785C7D0B015933A3381F5BA7C31BC60286CAB4881.2720.3268254473.292",
        "IL_F0A05503969BA9B2920F8F9DF45CCCE8ECF7EE555CF3C100E6B06D005B51BDDF.2703.2978597607.286",
        "C_4D8DFA1656A0EF3C4D96AD8437B73A10EFFDDE609C718E95E7BEF8FBACD2A3DF",
        "CD_462363B61D0D5970B6403061AD625C62E7F77E0DEE1FFE5F4CA69451C82B9D71.1354.166181745.560",
        "5243FA6FA29740C3EF6F87994A8A6D26F14FA996B57",
        "CD_94CE192263A7A4C6C6C5782922D4EB1B11F6B3BEC377FF526822F8431D0FB993.1346.4114553924.948",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.299.2995513597.180",
        "C_591ACC0014CD4A60D997F9409A17B564F416A1D3C15A58EE38955E2DD36A3A7C",
        "C_8E07A2F75E966B98765D0E68961E5A84D43A10AD950CED298EB40220B7B9296C",
        "Composite Volume Member",
        "IL_7CA90AB03272D8712CFB06F7B53C144678AB433CB8CAC2687EB0490FF64EFC82.2689.4068399420.274",
        "CD_F6E6FB7278461ACDB6C8A1357DE4FC989962054E99B446DDD1C8D6A670D2FA0C.2391.3800846428.3171",
        "CD_F9DD6532A9B443155D1071E2F0AB84CB0636D514B871291ECDFA8724B418DFD4.2584.118777040.4151",
        "C_11A7ECD9144579B152069208B2E368C32AC66D74E37C0FB050800C74CDAD8EE0",
        " ~$(,048<@DHLPTX\\`dhlp",
        "RunDay",
        "C_F6868834D76A72165B339E8DD1B562F6008752FFD847CBEC2C03A3131299BC42",
        "C_32F111A45E7594771F4B831EC4C51F536473C63323692A7F6C33516AB1164EDA",
        "CR_F10840352061CD18DB7516F60841E629D131C524C9F2F089E5D2B510560FC583",
        "CD_88F6BCC90DFA936CEB051CC0CC5EBEAC8E426A3D0DFAE58E560CEF1E3E70C3AE.210.2915943955.705",
        "C_70B5C3F445D36D84AF1F9F0E062B6A21EF707E1616BEC072F41A3F1113BAD785",
        "CD_C62347F459E9E9A6DD2944145D972E253F3D3E7B606F67BA3892A54A2CDCC625.2746.4271843525.237",
        "C_E23A8DF513F1C7607D4B78DB0A216DB5EE78D445489B6EC4EB9A64448026BC0B",
        "I_68D1C04B2DB331557E09AE38D2F679808DE9407A5193CB32D2D00DFB9B70E7C3.2711.3785550728.285",
        "IL_F912EB3190FD19582E9490517E0B81548015A8E7F0C08F5CBEE584C8B2A79409.2726.153369943.272",
        "CD_BDACCDF30E4365DB12FF650DE68D87624BA9FF4BAC19F700279002C19BEDBAFF.2654.221817630.679",
        "I_A36F463B29DE1BD71A01D7D06D0C1CF65881EC8DD5451E860EFA8D44DFE5AEA3.2714.2298416373.293",
        "CD_880F8A6DDAF35DED5DB5957A3D536A3E6F1D34B0BE1907B4DC24ED25832006B8.1465.132529422.591",
        "C_0B41DADA7265578085FABE671C02521DB2DADA8BDCAE2897CD4E9C1B5A49A883",
        "CD_1E626C3D32F7EF024573AE985B5FB35B84A93E624F99B15B594BE7E0989B4A14.2623.593840701.809",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.2740.1.16946",
        "I_EFC7BACF0E0ECC6CB7F7742DEBF6C306A9AEEDA277214586B1619FF1151D944E.2697.3078889107.265",
        "IL_02BE0D0F4383EA07C00615531BF67EAFD4EDE92AB28CE4D74EBD94EDB757160D.2702.3253260769.296",
        "CD_15A0574CC6A502D68CCFDC53B1AC5E00FF52C94DF0173E0C428828FB42537813.1603.178671737.2437",
        "CD_A0C4181E36B5BF6BE271221B7FC9D6F392B6369BD0BAB6A546F2790003BEF7B3.2198.3548258565.1830",
        "CD_724155B2CA7FBBC304551F8A171392C3CA07A2D9AD12D47C6D2D987EFBFD727B.1163.2317384271.2775",
        "025F7CF40D004E2BC1C3C9AA54865F4",
        "C_BB925C26F6C4E973C68AC5FC9E68CE66EBB8087D6E05ABF71723D446983422A5",
        "CD_ECB038604F9CFB5C266539C1297002E6A1178A983B1B38CAC375931349F1C5AD.1129.1604534880.851",
        "CD_0EAE68CC023B200DB742BD531339EAC47922CD99846DDB12AC4E1EC38154136F.1569.261168215.3046",
        "C_D81338524AFCA60B0F4075974363E8831DDB3AC972CD263F00EE914E81792460",
        "I_A250203A9552D6E624849E78B7794C5B61FC5501C6701BE9D9218B908C709439.2700.2913281474.273",
        "C_8DEBD963AB0F9B4B0BF30721FCF8B1B7D372A8DA71A85D7B52A1614E38C3B78D",
        "I_B6EC2E4C75784ACBDCC8936A2392C6712F9FED67EA5E7ED2E85750B313A57D6F.2697.1767133674.270",
        "IL_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6.1489.2077961189.321",
        "IL_DAF6B4E03CF354E5F2AA46D8E4E98473E55E90B25796E1CF993693CB2C847039.2469.1061636834.190",
        "C_9A6F5375A9497C640DD14311C5D352C43D073997E82C517C2CD3321E7C391BFA",
        "C_49AC1F5412340A7B3AF318277037F701CE239A6BB2F7176101D1105B89038C98",
        "IL_5B9B58B23EA26C7DCBBA923337E0D9F3DA62D8CF6999903866083C048DB4D581.2691.3070676501.262",
        "CD_B64C8D821AF5C014DA4FE54201CC1F0C673AAC91F5A7E314E6FC584E69EFA44C.1596.645837772.567",
        "CD_B96031C532B0B65B8A381FC99C330B723A6082950CAD96992CF66C16EB037045.2759.3374894777.360",
        "CD_F57973CF3F7C64653DDA6A8742229664CE37027D841F58BB761893FA6B462162.1580.3372814455.1282",
        "C_358EA9FC3ED4190A2370A8EC86B7836AA3C33AB96B1DFE8CADC56BC95FCF2EB3",
        "I_725C909F3FE4FF1D4452519DC5E7319F49B4FDA30799FA428AB30E8A93652894.828.1.81389",
        "R_54C8B2145FBF6DCDCAEFF33B39FBF359799D5087F9B974E853C4A5903604B330",
        "CD_F1347BA1CA828B62CD4725A7646B494D45700B0D8C277BE92E43FB714FB5C9D4.2641.4035691050.1549",
        "IL_A257EFCC363B87C1FEB359036E69B7F334B8ECF32469F03197B83AFA94D2F9FE.2706.902958567.283",
        "CD_EA0396D932FDC5A40D76EE05C8C42408E2A644C1B6540849C7A56ED78D13F40A.2612.3653954905.383",
        "CR_664AF66B21C2039DE71ED4563B6D82F78FB404975A3235A5DEEC63FCFAD8513C",
        "C_D0463C61C5FB59AFB14652F5029984454DBCBB9EA71D7BD37E6D26E78285BA33",
        "CD_7E73D5C93CF19F468CCE98DAD50343B32B26C1D7418728E2E4E53FE1AB834CE2.2666.1664293241.455",
        "CD_9E784A36A3818CCEF710DDD5C36D397926DEF1DD3DBF75F107C211B75FEBAA90.1515.2105838193.6027",
        "CD_6C29EF4ACC836F85EF7659E17930E4D493CC19A2D7E63C6C1051EF8AB7CAEFC7.314.886493230.451",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.2659448683.266",
        "C_9C7BB626DFB7765877323D6D490EAB18763F755F7E391A05F5AE5DDEF62260AF",
        "R_DB6E0EFA4A4955084B9781E96833D815504B83527431DC12DE9BBE2E1823B500",
        "{89497f50-effe-4440-8cf2-ce6b1cdcaca7}",
        "IL_56EAC04DDE2B1A984022797F24ECB9A1DF83FDBBFA6E7FACBEBE5DEF286CD83A.2698.2838412388.275",
        "CD_53B74CEF924124DA99B2EAB75089B518E86CCFBAB64AA06B4C27A3C83D4C0958.2670.547492181.1051",
        "R_698A32B2EFB9AF12EFCD0A0FC46109785288AB2107A556F691113D8AB3DB5783",
        "I_35D1EA8B8F70A260A4C64A81BC9ECA24D808915AC696C96130F94A725AD5E68B.2685.4173325227.282",
        "Association between the security settings of a file/directory and one member of its DACL",
        "I_420FD0BB65D2E0864325827323315EFD82F1B471DA36BAB7E9FD9F20FE3AA31D.2726.816054065.282",
        "C_A5E1AA71C64A6E4F73F07C2B8390FCFA2D21D2EE5253540934D342DF02582845",
        "FrequencyRangeDescriptor",
        "CD_8BF1B53C1F7CA8C4B9A4193DB4F8D9C9B5E53B2A698928B57CB97CFCCD44963C.1930.1978430390.333",
        "CD_7CC43E62129EA8E069413352EDA51322B29638C926449AF4B7513D9FD22855D8.2561.4162653716.1274",
        "C_F27728D32A3636F45280AD3F71C73821FAB17D765ED15BCD09B89B7007E5475A",
        "C_6F579EB254C9699650FB20FA45C0269233B4CAE417867C0B299C1FFD8E72DEE9",
        "IL_C004F31EED0C3389D3663FFEDC2379761F7F253446DFB3E07A859B8D44F5D78E.417.1.15778",
        "IL_352DA062E6CEF4DA2F5F5D5156A0C6A57E2D07D0BD43F09E3B9B31D33B72076E.2462.3117649240.360",
        "DeviceURL",
        "CR_4152F1D73EC0C43079F370FC1851FF50A6678F3120C915B048857D41318389E1",
        "C_D31C26871136E76D97B644481C2364D363562ED495941E1BA19460B457AC762B",
        "C_34D27244C1F99E829B51167C8BDF2F0DB27B59978C3CF277F9D1CBA753030BF3",
        "I_77E74ED5440E51C61208706C04055712F91B723AA0D26A67B06D8D9D686A208D.2736.1967633957.283",
        "C_B16263CC6C59AA3DEF58BA0C86C651F601D7D8872D7821EC2597A2AFC1F04035",
        "IL_49645A7E73D822346D709311ADBAC1C95851F17A85507279169A1C26AD7A76DF.923.1.104721",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2369.1552428084.180",
        "Size of Raw Error Record",
        "CD_D90278F1335965AC0FCA71D26CDCA31711F63D556BDACBB19DE789B7DA17A26F.2596.1217886739.842",
        "CD_C4AF7A2002517673D2274B08C6E80F686F8EDE7083810169B98D9DD007B3DC34.1188.3875712569.446",
        "{890CB943-D715-401b-98B1-CF82DCF36D7C}",
        "C_3D40309243C3189A20FC387CB4CDBF6FB94680381677F00E2028F7CDF8AF65AE",
        "CD_84081326AD6BC57C195B24744D43542EA433B161A3A16E81DF0799C4F41F5311.1057.1424235771.251",
        "C_AC1DE55C5A9AF50A58F5DCABBEE0A68A4BF9B2E40C5A252681785A6229C17029",
        "CD_0454DDDA9AB999B5E05A2F468BA888F0D0794E6BA1EBDCCF2A4463EC03258CC6.1993.4015052119.1610",
        "CD_7A2DC331DC9BD101BCF309899215EC90ECBD62010BA2391515142E2603A06D48.2612.1477450740.377",
        "CD_209458F88A1FA5926D961F906C3EE16D4AEDEBCEDEAA8A4730651B0B0AA2C3DE.2649.2579100171.249",
        "I_17D3176B80B45C225971C0CE7B70EFCE18CD2EC5541C571A6D5DBC17A808DD04.2693.1348626234.273",
        "IL_411115B3E1284DAAD30C6F230383DFFDB3BF55D3090110865C0376393ECEC80C.2686.3783864451.287",
        "IL_733F4631087A8F2BF57EC213AEFF221568486064B190B110F9AE4B8FB217574C.2689.715752721.262",
        "I_C04E6BD499E200B605C3A18D3E56CCDCAD619A76E28AD7C4A7FF92738734D7ED.2708.1092781133.298",
        "CD_0C89E3FE1CDFD790CBD5FEE0B9AE5F8AE27F38181A372EB2194AFCBADEB37DA8.214.2221756288.1321",
        "C_44176E2582D203C4E24AFCA28B3D2E229104AC44AFAB0DE90ED2E93CD38781CD",
        "Number of vertically active pixels",
        "C_8219AE5FDEB0734346FA82CF8304A2DED0377556768BA6A8933AE5DD15664AE0",
        "CD_F8E20627EC0277AD3D6139BDD1CFFCE8B83EB1D53C7352CA749209255434ABB0.133.379163871.662",
        "CD_6207FC985B813296446B1804CB375DB5F534F2ECBDB07E00035AFBECB15FD3A9.266.2278431939.674",
        "AutoBoostEntryExhaustion",
        "C_9AF43985A821E0DAFDFFF503E1B889FE2ECAA20F51010244BA510E3FA76182CC",
        "C_95151EBC7602F93A6E06460EF447E398F547B7CD3033E5B6ADD3848197B31384",
        "LocalSystemHost",
        "IL_BF0361BA762647E2CB9D96E9B6CA1495FDE6071569DF91B2E375C7A552C2EFB9.2681.1758887888.289",
        "CR_422BD4D12469E52722B5F3143C70049EF3049B5B1547DE0B5D622839DE0FF5F1",
        "I_8570503164C3E8F3B9C94BFF6399D93AF931609B17DF6767C04C0756DB0CCAC2.2702.232560908.286",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.293.288254012.188",
        "IL_B8F2F2BF1619AAC712E46ACDC25F9EE9CD9413AE0C42388950720F238FD4DDA1.2465.2260862905.358",
        "R_73859BDECC6E59555AB103C0DF5302F8942C19E249A9E48DB616B611E1AA3893",
        "CD_5E23632FA7BB1BF329A2928789D28708FB0B1FB5501D722BFDC5839EEC3CDB56.1980.2113151754.261",
        "I_D051A5B0181CC0B23ADACB0489301B553AF8A30E93CF61531EDA8B3DC5620040.2707.185173752.294",
        "IL_F504AFA6F9A141BC7801D87FAE2607276EEE57A330DE33914A0D2EC4FF8C2BEE.1480.1412314230.190",
        "I_4DCD1ACF6E58BD1330355B0B3B8243F10A72B1F7E1970F7E01C7080A5B69DC53.2736.320120432.283",
        "R_329C7091D99134315D75F4D3A2328F98C961B173B884F03A89824A063291C3C4",
        "I_C28E154433EAFBBEC9AFF6B03CD94FB6D01B32C68CCEA476ACECCD0DB049A6CD.2668.2336484557.283",
        "CD_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396.2056.1.22193",
        "IL_A061B1FC84C0FDD3E8154A924EF3CE4D547214F368F2C40AD7F2621B09FB3D04.2733.2122303428.283",
        "CD_DC66E0F3D176681A2416409C0012006E14C3071C05E87558AEDFA3E4EDEDF547.1462.3058030409.2858",
        "CD_5608C71543FDDF779F8513E4CC24C4DEA60B46017206C3AB0BF7959308FEA837.94.861878620.252",
        "CD_E58DB6F2713150A46F7C4D8E4C78CFE7E744DC308B2C7F2F5D3E19AF5E925D5A.1199.2035329654.372",
        "CD_636F2930A3A300552721C32DC639647A3A271120464C74988D9ACA2C3BC1310F.1599.3314597078.1376",
        "CD_148D54240A6A5E9E9F6B8C5515555ABD88D15832EE59292175F4480A498E01E8.2546.1182008574.1450",
        ",048<@DHLP",
        "CR_209458F88A1FA5926D961F906C3EE16D4AEDEBCEDEAA8A4730651B0B0AA2C3DE",
        "CD_8519F629D57644187514674C7FCF7F8B0B70EEA799638913C1E17DC7E507CB73.1356.1940313505.1863",
        "IR_9999CE7BE2F7DFF5A650789A4ECB638EE8010B0E955DAF1D73AC5808D527D79C",
        "IcmpSettings",
        "CD_931F785B1FFA664B9927AA05FC992B88625C615A582C37149C7E2EEFAF3D493B.2648.1555214977.1766",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.1610.1419837031.3773",
        "VideoStandardType",
        "CR_7C2448C779B501004A8AC92BAE296EF71C889D4A4797C480FE572242B6C55673",
        "IL_C3AA4ECA53E8236FA0FEF6D6BDB765E023BD604F6EDA4244B1266C941B20FAF0.2685.2097335130.274",
        "CD_5F6A26DF07A5DA70632EF719A83E3D129886AB8FE61A12C90B97B5CED67CAA50.2613.1709163098.377",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1352.1199241364.180",
        "C_863BE16984A9E1F3B73E396EDF2C42F981406DB8DAA1557BAA5A173376882392",
        "C_8105231C8A3F2DF94C9C7F6EBD5BD2604617F4A36486778B9E1603208DF83C44",
        "CD_EC87315EA07FEB82B95B6ECC853900B53DFD9FAE520CF4C1FE8CD7F52B679C09.217.1.11293",
        "IL_B27B9B082435EB0782A13A45AE5831DF41424D0B630A9D154D7A8DB7E1021A0A.2703.2704080646.298",
        "C_6F73B9A2B12D45B24BCB52C42189C1E085234262A13F966817C266286DEC680A",
        "#'+/37;?CGK",
        "C_8E00C05F9C7AF889450AC5E1CAD304CFC7B180A1B25B24C78DB3783F494A027B",
        "C_EC218CCE39B1A69692B8F67C46683B41BCCB3079635712D8AAB3061393D01076",
        "ROOT\\Default",
        "Processor Speed",
        "C2EE4",
        "C_A552F567B8A5F7AFC0DE40BEA66707D69F4D09E38B49B8EFD3AC625219B7FD45",
        "I_952DA8CA3C67BDAB198563E740FB3F1EC6F94F098268FD22E949535B3D464BAE.2701.2430452032.286",
        "The Tag property uniquely identifies the system slot represented by an instance of this class.",
        "R_639A48AE01E60F4C5372BCE94302125223C8DE05464D188B338C60C65E4A5441",
        "IL_E4B5BA0B959BDDAC8250BA9F8D8A7FF702B15C5A8E8D139A523CF672F723014B.2736.1946317492.345",
        "IL_091DDEBD0E937D2CF46C96939CD06E76BE0D80E96886D4C071A63198A86E324B.2675.1041129576.275",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.305.307563796.372",
        "C_71C294F689D8082A855326291989D570A1243A4CED463FF3751B7DB44F45449B",
        "I_E773858FDB61E761D295C92B1686D0E53D4F8C85E9AC1E67DF1F6ABF0192BFA6.2687.3334751371.274",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2450.1770376816.340",
        "C_5823ECA2C5EBED4CF370CED1912091BDB2C7DD9132934B98D68251C157B2664A",
        "CD_C115FD7EBD2AB6801350A281A89F2162617647EA80518CDB3FE4A4DD49B0428E.1231.2276944228.604",
        "IL_A9B3DD9EA49BF66D41F4D4C9CD5CC3BDC374E6A4B1AA37DFD45950011CE94B7E.2696.245599062.277",
        "C_F2BEF717752C099CDF2C7677200AF2332E7D1E48B470B17CCD440B8D710B7A38",
        "CD_815D9E15B2BC14D827AEABF180C134867539F84827FBD5B8AC15C1D40A78B042.1338.2727530105.1669",
        "mFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1480.824454245.180",
        "72CC1D5BCEA2C7C08B97EC32311.2666.1500305717.978",
        "CD_93143C972FD7DCA074E18A4541B6BD293B0E457EB886C806152FA8BC6C79003B.122.971122502.1037",
        "I_CE0710F0EA660D582859363C5EB154DD0DA78A4F4457583AD9EEF5A29AEB704B.2375.2662574153.280",
        "R_054A38929ECC5F2B71B017259D5DF98C968C29C9039A37FA5C286398E463CDBA",
        "CD_E706FF8586C52A7176ACA48D7702EC2A6550564F0E42B0C09AE3FD1CCEA62CD4.2749.2355131736.911",
        "I_94E33301D73E4974FF93CC2E4346E7CF0C60421C92F3402CA23C97C90CC344E2.2686.2919753938.274",
        "CD_CEBD2B5E33353736EB8594168A2AA1BCDFF196AA90419752C30E0B5CE08A9D54.1757.3314778028.537",
        "CD_B8C2F11B417C37C006D14F9AC34AEFC3BE86E0177BCF16E95BE5FE5EA4807416.26.564910046.483",
        "IL_42B2E3A3A6520FF2AA7BA157666764419AB7273E011404BF98FB167E54E43BA9.2460.2198995473.354",
        "I_9A5E68EB7B1FC08A5972606570B350AC17BFB78E6C2A83D63C4AC335775C6071.2702.2422407358.287",
        "CD_DDEDD07282B8324F60B5A48A479C1B42607AE5EA149F90058D5C2368C1337E02.34.1813377521.523",
        "CD_13091E3C3054BC345002416FA26EA86BA000D8B72D69780944E68B3A51252A0B.2750.2646851915.335",
        "C_9C256CE37E6F9177BC0EC95344373747E0112D20D664373933986EE480BE67C9",
        "C3D9531050A687F226B048E1BDC0D3CDBC35A231C063FDD30671825B68A3AF36",
        "CD_0A5DCBDCC4320C6314CD6EB830F4C97344090EC565D71BFEB9D454B9AD1D8788.2553.785386092.1600",
        "CD_C149B0FCA32CABFF7747FC6208AAE6EA9989E86ECD4BDD3CB57B7E59EB1D27CE.2668.3715458785.1106",
        "IR_B5810739ECA3FA6E58C813A7E51844E977B2343C263C8642483F55EEB9730A66",
        "A persistent binding request included a bad local SCSI bus number",
        "C_D53A9412B3B8ECCFFA3767816157FDEF777B7E45473579907CA9B8D821A34EF7",
        "IL_5FCF22E7F83486186670EFA53DB2D1F5A509BD40E34AE4A9BF25979A07DCE04B.2716.2262283759.274",
        "AY%R25O/",
        "R_6B9E4EE8A6954AE9FF49C168C78A9585B0E76CB760D912EE50254A56C984BF8E",
        "C_A3A917B37289A096C22D65E16A2D843BE7DD92A63211AFA365E0D93B7D8DCC53",
        "NS_EC9F2768D2769112CE1EF50D7321735D7B87D36D0F8A1B65990E1538277EB1A0",
        "IL_3202E2187BA7689CF3FAD4EFBEB7B7562AC421E133ADF510F6B92B8E83C62AFB.2683.1225603294.276",
        "I_FFD5182D10C96F3C53E9257F5B142EC4439B6AAEBFBA417E597718215F5C19B0.1520.4118710752.245",
        "CD_1990BA6B868083E5BDD438C1C9438F9F7D36FE1A112C7FDBF6648416023E84DA.277.2640211291.431",
        "432CFDFF602",
        "CR_625E0E6F9E97B18101F4421497CBBF7C66AA039108DBE32EEB6D23DC718983BA",
        "CD_49C003F958AE429B51E409471F01A643359D07DB4A4E6AA865D8578747CC13A3.34.1787134301.577",
        "C_BA4D1700564283EB37D303248DBE2CD56556DF9361D876FD31FF63259F460B95",
        "CD_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396.14.3560472040.4091",
        "C_8573F18B680E18D492B49EE8BC7FF79407A6ACDC9E3F5D6FA5A838C0A5D01910",
        "C_DEF6358C5F0DB3A8C212B6EB5152B0DBA8FDCC511B86D1F1B5A68B1427787DDC",
        "CD_E5CECE3568E22A8D095DA9D66ACADDD40984DA04C8DFB2D049DE12067ABD39BF.1543.3925039947.1538",
        "IL_171DF71ABD7C6A7DF03D4AFA73A2CE1BA658B66016A9DF4DAB148F781BE2851A.1019.286285166.420",
        "C_60AA2D59BD4951256029E6833C70FE73BBB4CFE957159680F2FCA6207FE78961",
        "C_92199A685A3DA52107061077D21DA958767972E7F390E19110D42D30C4F214E8",
        "I_3C46EE4FBAE2382C39C5BFD57BFA0E87EA70DFE71D28BACDC4E07A426EE10E5E.2682.3916761200.289",
        "ph<8d",
        "I_9E442DF105E48B3E8850AAF74B8196762231E538CF4C9B021A23F23806B2B0B5.2676.2238198660.277",
        "tFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "91C0EC1E01C277EE0FBFA7CE4C91884A74444",
        "RouteCacheLimit",
        "IL_2671C73C258D39CEEBE8399DB62EEE11B5B9BDE263220703C7A03C2DDCA3D03F.2735.155197992.277",
        "C_BC057C00247E0EBE8B5C7BBFA7A3835C20ABF511E4136D781B5E3ECDC42459EE",
        "I_CB59A51077CEE6F3DF39136EB5A2E027CEDC6E566587EE247D3766C135916829.2716.1112677935.284",
        "C_4AE2067858965079AFE155261D6F2E477E0BF91D3D1DC9F376CE02F21B16F9F5",
        "CD_D5EBE9D0498F05512866B18A51DBC2343148EF5BF90E72089975D137A1E79133.1527.3954637917.734",
        "R_358B12CC56B70C7D843374B1FB6AC9DD612AA1C2EE5D505F60BDEBE9063C01D1",
        "CD_8F21C89CAF771FFCC47E28C59A7D76DBF0F63931FC16518B322428129F505FDF.2155.3011937589.675",
        "IL_687C973F5689E18D23E76DF9E9019301006B8C4CC5C6A3F3DC3A6A8B646AFA2E.2686.2104969847.295",
        "sint8",
        "CD_8242B0E214D0E59F97469A9B5B2211B7EE2FB9D2E262E35A344F292EDBDEC228.2411.1.19154",
        "CR_9545373C4C410A85043435CEFDB53CA783FCE515B65345546AA266D2B18EC658",
        "IL_1166A5D4022EB9E202226C582A5AEEEE38BD7F8F04083AE3DF2B384336E6928A.1352.2768103902.185",
        "CD_197AC7D184C8FB7AE4353D80B67A53A62AFB8962E788E6E6756C5B11036C7B44.1700.2347061713.514",
        "CD_8E8EC8825EB3580EEA03FDD01E5C469CACC252792E96F681DA3159E2E3F0FF4F.1649.562478809.275",
        "I_4EE85D110211054A9DD8CB215315DF05DAB2D2D335C9845F6E590FDF8F6AF10C.2485.1611265426.327",
        "R_AEB1302AC843DE3720FDF5243FA6FA29740C3EF6F87994A8A6D26F14FA996B57",
        "C_43C86C3E5B2B7F1DD0443A6DA4E17AA95D65F56EE0C19CF4FD3B5D9A5F63C522",
        "I_2CB373A56176C0CE007904157A1B0AD9C3480C6F48BB09E739581507E4E2FA3D.2679.2021229095.275",
        "CD_6DC34F83B2836B7F4C49DD4CA9153C9A45B781EB43F2F01662DE7C715D9C447A.2744.692888063.234",
        "C_F15C23121D56EB64CEDC9D19B9CBACBF5742596C0D8EF3BAB76E325DE01F06D6",
        "I_B1667544AF8E4C19F378158B5E86E2D6FC791BB9FE99815DFDFDB12507793FB4.2725.410076186.281",
        "{0268a8b6-74fd-4302-9dd0-6e8f1795c0cf}",
        "CD_B94BB4D73091E30C77F18255A03323D4E1B3FFB7D916D65C4D8D1A96D0495E7B.2067.2340302018.677",
        "CIM_PolicyActionInPolicyRule",
        "K`ErT0",
        "SPACES_StorageSubsystemToVirtualDisk",
        "I_74CF1EDBEB2A88AE2B7F2B31226DC6989203AD486527D338B157184A36F210BE.981.1.23321",
        "I_40DCBFD933B98253FDE5127D13CA45EE29BB16C6861CC92CAFB3BA52757F44EB.2700.2010604591.274",
        "R_F33D7C5F62C48A98254F1B0ADED8C5A8E56D1601D517CF44369F4A800E4AA9F6",
        "I_08837FBDBD3097471CC2C297165FAF98E393B0957D4C58A3770FE396DE076DF5.2710.1628297984.299",
        "I_3C6E3183A5CA8DB3D3CC199418B0C8DF0600BEDEFA361AFEB5C6A9E973A330A0.1090.3915776663.400",
        "Indicates if the item is sparsely cached.  A sparsely-cached item exists in the Offline Files cache but not all of its contents are cached.  Such items are not available offline.  This property is applicable only to File items.  Server, Share, and Directory items will always report a value of False for this property.  Inspect the ItemType property to determine the type of an item.",
        "C_4A8C48B101586E49CF7BB2FBB8C8F9CE4C850648CB5DF606B94CD22AE6B1E328",
        "CD_A32E78F452946944B493C9750EF53414AB7A288F9EC50AFA095C45B0E5870216.2512.1616380099.439",
        "CD_D875B95E503572905224A8A8F72FE8BB5E4F4F123949FE42D8A350DB69DB1BB2.1565.3117946513.994",
        "CD_5CBA40F57DD1C39C5446D4C1AED98236A1F94F251B54CA16ABB677B02EE7B56B.2135.4285621092.3612",
        "C_AB40328BFFE9E2590F7835EBB83DF3665588C8B52A9107EB25D7DD22EAEB79EF",
        "C_4D409582B9E7F83CB63AE537576DCB0EE80F099F2DB087CD2C4B26E6A30448E2",
        "C_FFCB0C410AEE7D445593F568F39CA2170FF6D60B08D2A845F16225D10B0579AD",
        "C_3DC19EB63130D5D067481058AA0623474C0FB1A27F327D53A9EC2BB38EAE5DC0",
        "R_9670F10EE6DDB8E306101B08B39BD50A63BEE4B7DCABA524C96620EE066E2BC8",
        "CD_540B818981BABE906DEA2779C9B6CD77EA433C87873091262FF7A72CBAF2E503.33.4138199995.249",
        "CD_F7C3FC7B0FE5CB399C100F2AF228B5E443901701ED625E3927914BAA4C7D7971.1602.1674113518.444",
        "CR_BC4F91591102411312342399DC065D3EC257C15FFCA13E42BB6956DC3F1EDBC3",
        "          <objectSet>",
        "CD_2870130F618D37987DA37CAB8C2078BA94B2DC9559790EF971A732DAFCA8D133.1933.2365602390.7270",
        "CD_FC87001C8A293FEE277D61D93452225F44D005BDB34C116869AD3A6E3FF54998.2583.2991769853.404",
        "CD_88EB302CD16E8AAFC6641BEDCC17551C2C447BB8B7A2C0179406C6688EA18D65.149.3782709451.1602",
        "CR_43C86C3E5B2B7F1DD0443A6DA4E17AA95D65F56EE0C19CF4FD3B5D9A5F63C522",
        "CD_027708FDC4F21C8AE43624362617A067ABEAE7FC96FE6B2F6BAB070555EAA6F0.65.3039197314.687",
        "R_9A0DB23B4C5307A117BBF9E162F8E0A10B387D66AA6B5AEFE4F2996B31F1D028",
        "CD_B1B3F51451050560540508AE61C59186CBB46746C5DF2B2C8763635DE336A9D9.1465.1023428698.1478",
        "CD_455876B64E565F4962FC035AF2C8087D1797E42AAA9586F45C5A3E20F37175C3.291.978620278.590",
        "CD_965230E4BEA87F5FD29FAB71D815A8C331F1FE2001B3E492EFEDFCE72E70034B.2164.1079302303.1072",
        "CD_5DEB181FA3808D9D7D9C352C844B65D0C9A0221A91C57777C58BAB412DD30F67.1714.3324092858.323",
        "CD_0F988AA56217E8EB25B7DE4FB153503009567FC06222C017E84DCD1623DC5829.2224.1602747835.801",
        "CD_6DC34F83B2836B7F4C49DD4CA9153C9A45B781EB43F2F01662DE7C715D9C447A.2758.1239884571.234",
        "IL_06D6FB193493B2B3AB18566CA818BD25528D88E2A3D498D0E28DC2460169A56A.2484.2094800135.276",
        "C_B130181D2980461AD5B86C96CD2A0DBB4871D92261D4C26B8D91B344AD4F5F87",
        "PnP Device Id",
        "CD_8E06F8A253AE0A7703F13AD4EB4C65D4E0C2634FF3666E5F2D0DCC0FEBE693BB.2619.1628817560.2044",
        "RSOP_PolmkrStartMenuSetting",
        "CR_0AFA2FC50AC99E903158F6DE8F18BAF5156D729C7A9028FFF4642E3DB96C640A",
        "C_DC3A6A30F007DCD045F5089406AF191C1C019C8CBDB2E14C9BAC58E0B07332D2",
        "C_7DFB02A8A3DB4C4A23478D6CEE5B5BB46A9FBA5A931A6619DBA69F0BACAE545E",
        "CD_236671D190B5A97B69CF698D7EEC94B834EB78003323F67E90BFA3A62F30C576.2119.421946922.2153",
        "ers\\processr.sys[PROCESSORWMI]",
        "CI_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251",
        "I_F7EB100E85BD6D4DCF4A1B62AA504A9F87E25788DCD08802EFF4A1B595945FF0.2723.3175173857.276",
        "C_1B2F7F9B30B8E3085F6FFF8AD6831B1EC53004667DF11651EE5F82516EC047F3",
        "IL_046F9BAB5DB10B91372029F5E1E0C875F6B0CAB137714DB3626682ED1DCFCD07.2715.3384421242.285",
        "CD_68F60BCE5ED1CEFD06D072F2C79847AF4A3C52BA9A8E9F51041AA990EA82C70E.1226.2085859970.359",
        "IR_2C954BC688DA51FBB5260AB5E002A5C395A6540DE89E02F3E5A9E1A1CEE1E69D",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2489.4141094664.180",
        "IL_198CEDBECF355E383EA00C07F341498EAF6FFEAA92AE5A2964D525AD6FF65BE7.1936.3456731293.347",
        "C_C494166FEC78B76B06AE6864E10BB6C47EF436F2498312A79210EB6DD47C6CAE",
        "CD_F50B9FFBB97AB1D3F380025D32BE93929D2A49CE58672C10FCCE822AE924193F.1349.4291540786.2013",
        "CR_10549F8F6A0C1E0A975F931BF6E1962F49CF18068F6079CD179A794A32D030D5",
        "IL_102077698EA904DF5C8F0CFC70F0723E119E347A7F574EFEC1AF2933127E6253.2704.2783475279.287",
        "R_441004818A0D24F844E0F61930FAD052594F7B607CFA55D9DC82975B6EADB56D.1464.2651787920.540",
        "CD_8D438C565310E95809DBB3581FC76968BAB1801A4D1A32B498FF8D19BC26268D.122.3336243981.708",
        "CD_7F4CFA7137A5B2C186DBA6B0E496177D52C742459BBAF910A11B04F91C925590.1542.33922306.491",
        "CD_22E55A76AF91714908793A9D6F196391BDBB704CE7B4C27172941A36699A38A0.1715.1.38967",
        "91B652E82F022449D154F.2590.2820036826.1054",
        "CR_8DE46DD6446B26621A23E11758AE5CBC62C9F72998CAFB08B9CD58DF66902A20",
        "IL_6C1DA6BA9869E9DB42E035636E56048FB84F53484731502D87BF716D0FFE14EA.1090.256707327.498",
        "CD_BCAAEBA95E435CA5300A680BE9BF735F04A93ECECD18F46C56865C6158D43B74.76.350924917.4287",
        "CD_EC62C68E91498FA5250165B7C03BC75644EF8D409182A707B4BBEE31AA415BBE.2558.603151813.483",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2197.1807584343.368",
        "CD_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D.180.3440191626.1522",
        "CD_49C003F958AE429B51E409471F01A643359D07DB4A4E6AA865D8578747CC13A3.144.1675489631.982",
        "I_D341FCEF2DB25B0BD9A420247A558AF86FF883E9F4AB35114C795D1EE77C1047.124.1070091540.301",
        "I_4BD704EFD82E90D58D3C406978C7C044F013A64518E8C54785195D2358D9CFAE.1806.3545598754.276",
        "CD_0266FE61C304EB19A16F927BEA069A8CF03940D65EA14EDA962A2A0ACE0B3505.1556.3195213397.413",
        "C_D0F4E3620A7828AAE5A40AF4D4360C5582C0BA2DCD78FD96FE0C14267800808A",
        "C_880F8A6DDAF35DED5DB5957A3D536A3E6F1D34B0BE1907B4DC24ED25832006B8",
        "<oN'f]!",
        "C_11BDD83D3BDB7F7DD4A04A3CC49869E53E73157A8718941705A791A42E561334",
        "C_32947322653D8EE69B3B501A52A83906C2620426EA39361B67B60542321F696F",
        "IR_DDB91418F3D637554FACB27F0581F4445917CEB1CCA74DD48A7FCFC0D9F39BBE",
        "I_DDB91418F3D637554FACB27F0581F4445917CEB1CCA74DD48A7FCFC0D9F39BBE.280.4158920745.392",
        "CD_C869A64A264016A40CDC6BE908580A71D42C8A4A557BAE5179CC1536A843969C.263.2825546229.721",
        "C_3EB8548389123862A422C2E25B4027357178AFC61EE51C94A0FFC12A2DECD02C",
        "CD_6DECEA152EB68C3B8F3895F0BFE2B8D722298B02602F918D61267E0DFA61213B.2736.963823144.1426",
        "sys.mui[PROCESSORWMI]",
        "IR_1E9EFE85EC956BF8DE3D3A533CC9BD481AE5E8268E151BDBCF68F64CF9515931",
        "IL_EBAEEA562CCAE5F44F8DC529A43985A152EC238D3F950BE794ACAB0A20B82979.2457.4150248673.343",
        "!%)-159=AEIMRW[_cgjmquy}",
        "__EventConsumerProviderRegistration",
        "CD_9EE045C4E2FFD0DF955EEE77C315F6E7AE148A81490C1DE25137DB14C2197D9A.1204.576945284.1453",
        "CD_17431B4BA51D33CDA0A6628CA12FC7DFF5F227BEC60D95CF88873EA792342553.170.2031999682.1287",
        "Reserved for Sparing",
        "I_0B880713D9DDD00F98918C43E596B37E54E0FCC69C63C301BFAD6A21567EB1D1.2749.1149044396.311",
        "C_9A1BB0482D33C76729D4E4E83E5DB60EF19255F1B7BD18ACD1F30074C3DFE4AE",
        "C_4410CB10D8FFBD03CBBEABEE118841024CDFB91D2E8A0E8250FAF26F0AF2D126",
        "I_8A7F9AAAE708FCB7DC96A027E88361E2950C2E39D954BA3B56D09F8360E69FD0.2674.3794195178.267",
        "C_9C6A7E3E087A5B8DA585FF771A2BB4634D1FA2F66F376E9BF7FD6F960807500B",
        "R_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "C_EB253439DF03A5FA4831121FE91AC54603FE3863E8A53093564B49A3926CCAA1",
        "C_A15A00CD5014B43F15BAFD3D0F7CB556BF54FF60085CBA96C47BF4ABDD28D656",
        "CD_C4DED7ECA25B95F591906DAA16FEE49AAF9419718F2D225EABB3257FC891ABD8.2549.2753777667.1438",
        "CD_681F04C717B34C7842AFE82074DEC59FCDB97C166864F9245FF3327284F1AF2E.2387.1229411169.759",
        "IL_DBCD4213014601A293AABE7F4277D0A7FEC9623E379CDC7AA6A9EE60BBE340D3.1782.1966029283.266",
        "NS_384B446250BB5D2F492F1908A5C0DAEA147CA4130DA383C4929CE3B9A73DC35F",
        "NS_7D21B78EAA0B5CBC1D181E478D1F43B86260B16C8A6D7CD39506F3FAB894CD04",
        "C_55AF22A4D3FD212FC3171AADE7109F17F27CA9F86C291AE560CF90E7D047839B",
        "IL_C29A46A6A8E2AEF9ED28D3FD6B34AB52381EE88CCAD6A9E341A0A3B41900CD64.2704.1792034551.289",
        "IL_050953C58E97660582926667045FD157390A1B7EE9E1CDFCB3DD57BDA1E5B26D.1783.3258806950.333",
        "CR_0A78EF6F4A690AF3AED26FB328EB3A054B82E3E4610773D4F174482BCB6B4DB6",
        "CD_9058D572D5B6F75770F806D0DE0C0EE50FEBB3F396FE7FF2CAC02E0CA91E0E2E.2472.2969026127.536",
        "C_2FB97DB3F42FE038D1BE91362CCA4304CD8AE070FC47AB86F5D6A792AAD957A5",
        "C_17E7C86738B59EB875E05FB8D2106E803DF9A9B0E69B9182F0E97C3BD2B3B709",
        "TracePnP Flag",
        "I_F8B249E71AB95DA23EEC66345D79899D60456154F5FCC7474978B15181E19412.2729.3609212121.280",
        "C_9C6D6FF9B9D03B5113EB79662290652D2C90B044404DF90E5AE9AB4E9323EE10",
        "I_D4987B113B08C3865459E47A2D1ADCA49682B6AFDB4DC21088112FF54FBA16D7.893.1.69984",
        "Success",
        "R_02E226BBCB88A35C58DB3E55C3D201306E2FAABE9C83D64654DC4E16660DF61A",
        "CD_A767797A466AD9FDC0F5359973FEDCB08DB02EBA93D9932DECBA6455A686C8BB.1065.456905995.663",
        "IL_A7052B08B09938CCE53BEAD9E47D91E93EAD5FD6F9FCC85F6C2DA7C752981F58.2728.2163401121.294",
        "CD_3A281986D2DC73E5FFAF5C10E516D033611D0B81732C1211B5A9AB1B8BCF2D1D.2106.3613293288.1191",
        "CD_B7CB0F72C5888EFB87CAA914B3258F858F11D8FC7438CC22070822389ABE2635.2001.683535901.2974",
        "R_1E6BA0641631D698EB357E3F18CB994AF56B4C7D1C69D9D102F6CC7E4E5D402B.1607.2115461908.520",
        "Padding",
        "CD_4E41A9ACBA3A28CC69C6A183B9DAA78E0DE0FEC5659A25BFBD89FF102BC593B2.1266.3394823394.611",
        "C_6603235838D67F0A31998AE108546BB74586B33844F47241F23AECE3061C708F",
        "C_09F918FAD220A296DA8B905DD4636D77F7A42233B3E1893192A0FB626A5F6E0D",
        "C_79C2B8878CA0CC7D263478DAA5B22069FB6ABEB9CC6BF0071DCCD3AD247D51A9",
        "C_C3DDD18CC751033F0FE8F2EEDF22DD83C29417A6B61CFEDBABAD6EA11FB00321",
        "I_381C3695761BEB27215621E28950E0A97D51882922550126C26AC14E24BEB3E0.2716.2048160921.283",
        "I_D02D90925472D1FB8327DFEA372E4A36DCE60A11BEDCF9147E6315F61B4ED759.2726.195161938.281",
        "CR_715285D866D9BE4D1096A09BF56F1278A35EAA3564DB030AE4A24F01E076521A",
        "C_8236493D7B4C97328F05E9610B58340A9B36DA2FAD39FFAA641A6E8D9062FAF7",
        "R_DC170DD25A799AE5A3F8BF2D432C3B8F327BC323A4C3F79EC316B49E51200EBD.2450.2922809839.524",
        "R_8105231C8A3F2DF94C9C7F6EBD5BD2604617F4A36486778B9E1603208DF83C44",
        "I_25113E617ECC09EE814F219BEAB83095F0F754B95D43DF3BB32E8A347078D141.2688.2157912072.263",
        "ProcessorBiosCStates",
        "E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "I_756ABC64F7087CDDE280E01A5A1F8FD6563EAF29B113CC49FD1D77475F8FCD85.2692.492949963.267",
        "Full Scan",
        "CR_038FB93272FAE6ABFA86F7DB95C50EABB70457A3A4C501BDC273939A1E6BDB9D",
        "C_B7D694BD6E54C6C257A930A7AC179613D232B4C4655931D3353EFDA5D04618F9",
        "CIM::Network::Pipes",
        "CD_14BE33F6F696D0BE50F856D0D30EA3D3F6599DAEB2DB2FE27EC78B72EE863191.2670.312331745.376",
        "C_18CF4DFADB65FD9009884647249EF310A7B2E05DDBD0DAD1404A0AE55A5E4EE4",
        "CD_0ED8829CD55CB10045BE12FF28DC63BFD30CC65BF9376DAA6A5D15ADE3CAC700.158.650768561.242",
        "CR_F9C1E1A7069B9B36C3E7210F7D307B0A9A014B690546123D4B32550C45DB3C57",
        "C_7B5FDA91F5DD1FFC82E20D5F3963DD7D7657FEDDAFE32D552743090171A78DCF",
        "CD_2A005D230FB555A5235DADB2795F61BC8E5EA1E4A7D7294F45B45D0B7EECC847.2598.3528217282.349",
        "R_F61D3A37372046376CAFA47C2FBD5009ED63EA8C65A1E072429CA32FDA52CF26",
        "CR_DC75EB8D61AF59F2FEB9BAFCC51C26F93B19442C9F5E9F7C071B8627E9152155",
        "I_5430A0963BDFE45F48448BEFE49162AB9A7F5390BEE895620AB94C03956A31E5.805.1.36972",
        "IL_BAC3F6A6A35DD56CC51CAD0BAF325F0D287989C281F534A9DBB76FD59710B3DE.294.843210489.294",
        "CR_1992DF472DE2CF4F69E851A4667C5DB5DC597E55137C5429FEF698AB76A58E58",
        "C_18BBD01AB9B011850ED53F3C153FB85C4D5FA9678EC8589287B293A340368BF6",
        "CD_D1EF7C1E0812A2A26C6327F2A3B7DD906B634F362ECF030C8FD523C6163A7423.2573.1403926900.220",
        "Net Protocols",
        "C_B77F00C0AAB396341AF90E0CBAB7DE2932BB0B2F69B6D24907BE1A641C3162D0",
        "C_52091F489E13F003CE1D9DB6880428EF7D0CB212D1BD0B507916EC93DD72E8CC",
        "Function not supported.",
        "CD_271985CFB8861AAD6656C473A793D3A13C882971BE36E460E9088BE8721E11F4.2485.2131184872.427",
        "CD_D1E324C5A423619BD6E9DEA96389533A053B58031C50F5CD3B933AA32B95E475.2570.2345609904.1826",
        "CD_B02216361D55745EF586077288F3DA27E9F2DEBB352CE46583451DA731CF523D.2624.1196853970.555",
        "I_18139DD2E089A97F8057A3FF2900D5FADB33344A7E208D73A836287EC56658B2.2678.2653422764.286",
        "C_7C25BD6439936A4252A1C4B7A8B8FC81A8215FA3F5561F5E7030947B64B43638",
        "C_931EBC392DC240CC5527C3CA3643FE44E050E39FDDD4B5A76F950F248E19E470",
        "CD_EC54BECB03915F3B8D1B884127688EDC4BEC45436169D86F9940C3622CB3B981.2528.292703446.492",
        "CD_47CBD249A2C567357686E5ED6091D88133AC6ACBBE7BC216472A737EDFCF1867.1056.779446300.327",
        "MSFT_NetBaseIPProtocol",
        "CD_4ED1C1D27F38DE571446B9916C2C7A53CD6AE93A14F053666EE0657DBDDBFB0D.278.3352758981.579",
        "I_B4A2C5E94294CA48EE83444B581B7715F0456C2AE322533C1FC870F4B341BC92.2459.3129702897.334",
        "R_D3EEBB9E3A4C5F3CA348B142AF6727D3A274A152187FB63005FF1EA0DBF75FAE",
        "CD_838E13828F10196D3F66F7B92E25AEB70BD0868AFEF218970174CFCF1AE4D54E.314.3466380270.324",
        "I_F693673C4CEEE255A0773D7A8C79A487F5442508823CBC6EC11DEA6527F363E6.576.1.17537",
        " $(,048=BGKOSW",
        "CD_76407EE9F7ABC06BF43DA4E37433683A23FD8701DCB5AA7E340ACD783180DEC1.1049.719070649.469",
        "C_1CFBA5075C2575EA7735C1AEBF0DCDE2BBE1A5063C546AD01C618D77E2D7C06E",
        "R_1D9C167DBCE9A78A43B43F1489BD8AC706879DE5CF7089023DE2D9860F84D836.1020.3937355954.524",
        "CheckForSignaturesBeforeRunningScan",
        "CR_AB458ED9D1DD4314F88AF5FEEC588DFA53BAF8DC0A56FC3E30B319CA4FCADC37",
        "CD_B89F81602D340760DCBF9C7FA464908E742B64A7C6E08A776FA3C9E7E3DE6507.2012.374739467.2169",
        "D057CD66FCD594011ED5CFE5E6EB3D85FDD99E4D6.2712.1835851554.302",
        "C_345DC260A0AA9254A10F41B477EAF75A4CA2ADB21A42E5338E516260EEB5BD8D",
        "C_666DB799C64D5035B380E839E44A5C50645AD8652D71D99EC2F753E7EB86972B",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1479.2890374834.368",
        "CD_54D799461F62C50F4E33F56D51A5DAB2D83FEA13CE51DB9E4B33C4043A6D5638.1198.3091817334.3315",
        "LPTX\\",
        "VpnClientPSProvider",
        "The Name property indicates the name of the page file.",
        "C_2FCB674CFB1163EE9CD1F17F7A8A5DF128F7FBEF043131A78609E5B34DF65D42",
        "CD_A0A150CA5213FD3CBDE2DB5507EB556997D615915D27644E5F01AB072F205064.1345.1391794336.2064",
        "CD_9A0DB23B4C5307A117BBF9E162F8E0A10B387D66AA6B5AEFE4F2996B31F1D028.2229.2004972511.224",
        "The Result property holds the HRESULT Status code of operation.",
        "B0636D514B871291ECDFA8724B418DFD4.2654.3199115803.3577",
        "C_BFD544BFFEEFF1AD50632026F36408799745C79BFE34289070862E1BDE56BDE0",
        "CR_9D6744533171E0AA4C64E98982376A00322E3135FA3701918441437BEC34C877",
        "CD_73560CA166D1D6DC199E43C7D578F3B7069BB5A584E5CB8D107C4AC9E5EE5ACC.1756.3407558665.2911",
        "R_3184B6ABE34403D0CB2F0498F5E873F5E68F9DEDB09393F85C30E13ED693563D.1187.2634451613.518",
        "R_8FC855D7602E18735159E09D060B2A4579AF2F707E3AC0A6FFCD7B596E0D3182.1148.3344138171.532",
        "CD_AA8DD13710C6232D550EA0B5DE30AF5E61E2B29E47FB806D9004BA3511197EBD.2669.4231116918.120",
        "TraceCreateClose",
        "I_5731383C22189075E459FF27A228E1DB63438C04B30E05FFA90FB5EAFF3F6A2E.2719.2656196346.278",
        "CD_BE3C9A0F3A301859A6C844B2145A4F44B9BD768BEE695F45C60A8F416A0E9077.1740.1219518310.4737",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1976.3172404278.352",
        "Net_Attached",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.1080.4140634058.188",
        "object:AcpiPss",
        "CD_9A1017286536204EE41BC4DBCAEFFB55E2F3765B5ADC8B288415356B63CAD2D3.1560.19257250.1282",
        "CD_C80F6E9FDDA5B4FCB7E91E04A37B343ACE2C1B4C4C7D997B61E1037420FC6413.2747.2279629293.748",
        "I_F6E7F08B31B0C78E8BF9EFF146D032533F3586EC90E61B1DA66A9257751BC9C5.2712.647954723.271",
        "CR_5200A18802E4747264437AC469BB415FA346E34983915EA25009200F37191BB2",
        "CD_F0D0424EC702B17B5367CB152393B7E5322793C4C7DD8F7A83FA112EC516608B.1876.2083749893.3743",
        "C_29E8AA5244375C87F1F5AB9F42A22D9A1B648F420047277D7A92CD564C59256E",
        "I_AE9AC2BC8AFB5D056F36CB7B60980C94F15C74C0D55FBB321F636DEA98CD4F09.2458.85445167.279",
        "~*-03r69{",
        "CD_BB925C26F6C4E973C68AC5FC9E68CE66EBB8087D6E05ABF71723D446983422A5.62.1.16647",
        "I_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.293.3106448493.356",
        "C_EF56264F4C4845F620CE3B4E90CCD69D437FDE05A897842176D1B4A2BABEFADA",
        "R_88AFB8925BED57D785F853EA39F60A2597B7DD047C4BBEFEFD01EFF42AC83C8A",
        "CD_7EDED54BF5B36D8BEF13515E9D3B438A3A9E5E4F640CC2539BC6DFFDF6BB9476.1977.3910277750.2770",
        "C_A6B2FACDEA8F1374576DD3AE295E7922568ECC31E34094F238E85DAF6423D486",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1606.3584255166.312",
        "IL_7E60BB99C9E70FDD76067D08DBA0669228F9B8D665851FE8A00DD2F5355980E2.2727.3980492895.284",
        "CD_2A5B35A7EDFDEFF055BB37FDA6DE592042B6B41AB95D0C58AFFCA90EFB735B71.2668.2742259210.121",
        "C_EF6905E1E68E5622C299FC4473182F96A80B74BF7D2B9318FAB7B6485D6BAB2F",
        "C_65C6883936BD0C78C8E38FB56AABC2614EA93FF45C056006891AF273AC6F4539",
        "CD_B89F81602D340760DCBF9C7FA464908E742B64A7C6E08A776FA3C9E7E3DE6507.2762.4186282536.784",
        "CD_E168D377E3EBDC80567E91D3F17E5FB581443E43A2B4D4956F85A552763C3781.1074.356214441.339",
        "C_59998C21660422211077DE80E05C8A70A59B3233A43120323CA16489848947CD",
        "CD_88C4A951AB74CAB93C6609B0E8AEEAE37E1052602716388B72A1ED8A64671F4E.69.3041693210.3900",
        "IL_F8A1C839C23CCA02136E0714E97B3DC6363F6B3737B7FE9E624ECEE3246D6C6B.2725.2118047416.284",
        "IL_E2E79139FC9083D2187C20D0D8E03EE5547AEEBFC3E082E553651B5526B12A19.2719.3994103753.283",
        "CD_B4ED6CD6BB039C8A40404514D33A068C19B058FAE7508C9C445CEEFE558E436D.1475.3375461920.635",
        "C_AB6B0E99E53700B220CC98E6FA99632EF2E30AA8973E530FB5000EC341F81DBE",
        "CR_1D13F523791F1EB20EAEF6F153AF80EF4F13EE29DAAF24D54E908D208A687279",
        "R_DE2F09E5209C548EB2CA373A925D80847E176AA4A3A4ACC0CB143A779C8154B2",
        "It's time to clean the drive",
        "CD_F8E20627EC0277AD3D6139BDD1CFFCE8B83EB1D53C7352CA749209255434ABB0.30.3343781402.553",
        "CD_3DBA7E264DDA7F8A7A309588967A7B5C3508359FF35613C96FF730C82E46EDC2.1625.1.10958",
        "I_C1F6B5745574887F521DE1DC4BF0F18099539D5C807F9CCDCDF9776258CD4AF4.2677.2108648067.277",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1620.401451610.180",
        "IL_934B7E2B0A8BB27CA535E00C5A2F9D7F9F2397232780704272106F970B087400.2727.3770238606.276",
        "CD_4F7F0582732763A5D116F240A92A642E6E8CDAB4D74513F90120E6F888A85C49.1329.1449332632.2030",
        "CD_4795063CB131EA9A32CAE29CBF73945A201C424BA6E590063C57DDFF25498546.1018.3187674053.1866",
        "HeapTraceProvider",
        "CD_11B7E238469A440C390DEB83C2D70566DE9E0AA13AE1162B1FD2AE946273C542.2482.1673011973.1155",
        "object:FrequencyRangeDescriptor",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.720466710.180",
        "I_0A4A8CC499F46BAAE9FF49E6D68BB631793D5F6FAD2719C0358ED54A87A84829.1607.1290395288.239",
        "IL_D7EA0523CFA04E2FD63E32D7A2C0946EE8968A0E849DD132512B58C222F2D445.2679.785141560.283",
        "C_ECDF6473AEB5680FD494BFD070A3EC2B36A681EE68A62E383213B3D773EF9B61",
        "CD_37D37D45737FC592A80BB2702AE41B63C8B8D014DB6951F1159253366BB2A47C.1780.3781097118.294",
        "R_88A0C7A0E72AE74936AEC0157B4B96E83CEA40238281088709B5DB02867E7CD2",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1209.172504493.235",
        "C_22F378A2DB3FAA5D62FAF5FD5413472AD1B5CCD6D24CF8D271819C462726461F",
        "C_3378669615577B42FE9D7F6AFE5937F8AD52033749937CDC0D7FDB57B33C7738",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.286.1124162071.188",
        "CD_040BB4AE5C8C1563BE4142EBDDB8539C7E5CCE64A27291E9F997DFF018BE9069.1535.3731628756.985",
        "CD_6CEE23AF5AC96CC1D26B44101921AD2362C642D209314F6F8ED16204FD204C66.2543.2646367667.444",
        "CD_8B5A6B942AA5416825152D8055EE6894FDA3E8C591F37D309F86A2C72141DDBF.1748.1887554265.1393",
        "C_D1B9917E4A8DBD1488077B861C17B0A0964FF41A5CC2D87825C4AFF57A0BBAD0",
        "IL_B70EF18C029DBE7F47552E94A90289B0029992C705EF20E551316479A3C5FB03.2721.517069870.272",
        "CD_E0728E680677E2DC755DB0B32FACA9688F4B71D12279046ADFB604C5714997EF.144.4162022781.602",
        "IR_82D62EACB411F46C88EF11FE5A18F1088AEDA0897AD63F2947178230B7AF5724",
        "CD_E6FA42319C7B1B6AA3CE56D2345400C98AA73905B257B46F3B0DAFEC4D0960DE.2614.1321327700.425",
        "I_105E01B8598659D73174417ABB8E6224C280420B442084036848600394E76A76.1016.1029246345.313",
        "NS_11CABC6F7CE1BF85E13680AB940969DD118459BF42D4EE30317399988EB74414",
        "I_791AD4EEB22FCD6897BBFC6379B0E921AA16C1C447CBDBD7E8FD98A37471246D.2712.3522741979.287",
        "IL_4AB8B718BCED40CD13B099C54A6BC7459144DF3AF86EA1B35DB5EB6EBC6C202B.1349.115352558.284",
        "CD_AF3D854FF025C11AE0CB78C559DC0BD55EB8A356EAE34913761A09B3CF6B045E.1502.1275843088.1295",
        "CD_D6F23AC5CCBEB47ECCF7BF129523258879FDED9D282F558043FF80249A7ED596.2762.1475885458.333",
        "I_DBCD4213014601A293AABE7F4277D0A7FEC9623E379CDC7AA6A9EE60BBE340D3.1782.818874433.315",
        "C_F58FFC0FC8B956F0D972BCF0F695E0980C1562E6A9119DDB8C681A1382993AFE",
        "C_85BCCA784055D328056C1C24739AD97E319F99340CA068ADB03810455562DCFF",
        "CD_4956F7377CADF88BAEF29AB167534942D2330E0E6BECB3AE4512BFCC91561A1E.1671.855419236.681",
        "I_05EA98CC46B8FA909AE0E11003EEB8D5C53A6C58A2D73531B76043537D1DC881.2725.1374216233.280",
        "B4304FA3B74BF325E14536AFE24A3A6599D85385A7.2712.4137474706.274",
        "IL_168B94A18A6807F45F044699E37230B4D7BF53C72BA6E7A3D428EA30DB9870D0.2701.461387258.274",
        "CD_DC2C3C4D84AA0ADFA24581041DE99C73785404938653351ED57413D02E966BAD.1927.4154275903.287",
        "NS_55B7453F9A92245078FCB5133CDA2D219EDE36D5B0C242DB457F8DA87C352EDB",
        "CD_76407EE9F7ABC06BF43DA4E37433683A23FD8701DCB5AA7E340ACD783180DEC1.1050.1044426829.442",
        "jnrvz~",
        "CD_81A3B19DAF97A060286E4C71C6B3D0CC78A51FE8093E9D9FADD83D8A9A121EF0.1929.316941728.321",
        "CD_048516085D0CFD11B2F57F36AC760E979F1E172A7E7675BE4EBC8F8315497197.1649.4241766362.1101",
        "This is a special grouping of ManagedSystemElements. The grouping is viewed as a single entity, reflecting that all of its components are administered similarly - either by the same user, group of users or policy. It serves as an aggregation point to associate one or more of the following elements: network devices, such as routers and switches, servers, and other resources that can be accessed by end systems. This grouping of devices plays an essential role in ensuring that the same administrative policy and actions are applied to all of the devices in the grouping. The specific behavior and/or semantics of the AdminDomain can be identified through its aggregated and associated entities.",
        "CD_0685F0E7DE4E9ADE69B83CB6CC4B69291D69C22AD0E71A095A2E4AEBC8EC8B85.33.1837258014.441",
        "CD_110AE6309AE2428224AA19A1DF291C0EC1E01C277EE0FBFA7CE4C91884A74444.1477.2614108137.6929",
        "C_DDB9E5284035E7C991E364E045E2FE8D29BD27906672F0EE3919740EC2221800",
        "CD_9E80816304B77C3F7FB69E6FA27E369EEAF4355C2560E5D96A7A1A687778DD04.1802.506936714.528",
        "ExactDayOfMonth",
        "CD_5B55CC60E350D260A8F85A1D6D077A9EC7EC36F61E7CF7459841A5E66A160FAF.2418.250668707.671",
        "CD_BB85D56CC063D388F160FAD75C503ADCEEA6EC0F0714FF843F3191BD8BC9ED19.1634.584570998.349",
        "IL_C05A3FC584E4C7E77B91779FD601E18B96ADE577875DEFB7E16A4A239857CD17.100.1385632911.325",
        "Reserved for internal use by the WMI provider only.",
        "C_7C38D5FAB4F054CA9F5CEDBC314151C720F14D0E0F70190236B681A725C62BA2",
        "CD_5FEF9CC2240C005D9D1EA2FFCB7EBF7520D253B381EE1C9BA714DF32C3C6DCFD.2582.94258996.773",
        "C_349E3A31D1133135695017907CF38FA6787B7F880BB1D36773A1D88E19A7CE09",
        "C_F29100A757BDE75968386F1F8F50FAF18D4793B63DC12FB4378C18D9CD66C352",
        "IL_96A0EC4FF2CB51790E0414BDB04B92A481C2AAB3B517437D6529A9DE10E4B9FC.2726.2315990446.279",
        "I_6952BC8C6187412BA6F7CAEE56328B9DCA8AFF615B18BF7135EB8A91F51729F6.1020.3178572114.244",
        "CD_A41939E0A9F67F9DF2AD8D69CA074CE0921E39A835026C34A18F8B136AFA5974.2639.1410957243.540",
        "CD_ED39D4C9AFDF516666EC000B45EC192C36CBDFF6D22BC55C21F14EE49F68B755.2624.1760113652.356",
        "IL_2E8D62D402E687172231C21EEE5CB0B79DED3DB642A2C098C8F0E071F555F6DD.1015.3929913654.339",
        "IL_3C2C2907345FD9238E14A72F66B1B84060440D64FBC7FA8518759968C7E4B75B.790.1.49293",
        "I_8493808F7005A147F054C4D110780BCFD9E3EC20F3312DB0FADE1B7AFAC3A8C3.2736.1404794398.274",
        "IL_A76E7ED1AEC373B50A7135080D737DE0E64AFBEC74D1C4A60B135DC3DEBAA48B.2682.1795057351.285",
        "CD_2A112266506173779E6485F94910F63ED293C987DD4727C603E3F53E6471F5B6.2508.257455355.648",
        "CD_632DEB324ADB39E99E029B3D88D503FFEF1874CB755EBE99E55CFDC82CE6D7E4.1544.2431455190.294",
        "I_4DCD1ACF6E58BD1330355B0B3B8243F10A72B1F7E1970F7E01C7080A5B69DC53.2764.3676300688.283",
        "C_49077985F3FCF4259B2FE7EFC831F5599CA91F6DC9D11720E6A401A1DE18B2D2",
        "CD_64F4B56BA62AEA878667E6108D37F2CEACD96FEFA33698E5EA8E29A16F7965CD.2558.1952958863.682",
        "CD_085B7593B1CE40D92007E7E7F4B676333B0F0F7158D072E9115D8F206A3DB6EA.2633.1984697919.1041",
        "IR_A04502EE4601BD859A13FEFB614206FF59E7276D74025F90A456579AC0628EBD",
        "CD_772A091866475C0D90401E2D449ED248747158E72AA5FA334574887C1703B328.29.3357289153.350",
        "CD_62D05C4ECF40774F04063E6FDE0B1A6CE4B671271358A09E1596B6EBA1E2DD4A.2000.1684294870.559",
        "CD_199F8BD2C63EA7935AD06C4A530278FE453B1FE80DEFF18B6BDA97081D8B8C0A.2758.1559855254.703",
        "C_F10840352061CD18DB7516F60841E629D131C524C9F2F089E5D2B510560FC583",
        "CD_D13827DA0ED443FFD82DBB415FC1698F7DC60C2E8774ABDA878946AA14F41C91.2462.3864814976.3209",
        "CD_AC11DDCF9F71868BCCF23A662420DD51F76B4387A8230D6D41F7DBED8D2981ED.1666.858834705.7870",
        "I_D61FCCFF318A68616A63FE7A58278BB77B4206C4B4E7A6AED047BBC246A29BFB.2721.192489140.275",
        "CD_0ED8829CD55CB10045BE12FF28DC63BFD30CC65BF9376DAA6A5D15ADE3CAC700.293.1883591654.213",
        "CD_9E064E4DC0D110210A0F35639C83ED75CA571522B2C951BEF2951DE6D3CADF05.1779.519131259.305",
        "CD_38E384CF26B6969C10E6C877B2EEA6D4595C8CEEE6BA25CFC97F17CE8E8A5DFD.1939.3435651371.425",
        "IL_9731A66D417FDC024A9D93DAD0B38C4D96CBFD2BEC45E5FB4706D56140B553A0.11.3517407419.329",
        "CD_7BC06DFC2CCE54A0D578DEA59EBB1A8ADB06CF1508741E02D2DCC0BB4C755E69.2261.1.41198",
        "CD_E47161AC3705BA90647C0859FC3CEEDE043DA30F37CB0CAB0AB9AEB3B28CF01B.76.2737530864.238",
        "CD_1B21127D666DE7149D38FAE87BB50D5044EE42AA689C0781F72EAFDDA2BF1383.2673.3094505278.3546",
        "I_43D16E20ECFD623339FBE940EF30E5D8E0491605420EC6604AE909D12A90FBB9.1104.3065282225.190",
        "IL_B74366DC34DF4EDB8A08FBFE86093EEDAA888FD62ED6727916BDDD945541B862.2704.386899033.290",
        "CR_C1B039C6B15CB1268319C147066B90BAE1F5E0DA59EE23E8DFE59CEDEE8D5513",
        "CD_62D05C4ECF40774F04063E6FDE0B1A6CE4B671271358A09E1596B6EBA1E2DD4A.148.430798227.302",
        "IL_CBCAA80C85B61EEB89C59D11E82160D510413B50184700B0DC7225BB3530114E.2713.3614247248.297",
        "VersionUsedToCreateDB",
        "CR_52FA3652DE48FD253CE895AA1E0F7F7869B94D77DBBF33883D1DBCF38C65343A",
        "C_6C5C2DAE2C64650DACE1EA520E342735F87D6EF0971D5E51C8AE2D0DB4D8C448",
        "CD_712B73F1329A92FADFBFDFF586AE86DD55A96BF25CBD08473137CA20DEF39F25.1153.2587490680.1026",
        "I_F59655E05F6F1554AFB3EFB785C7D0B015933A3381F5BA7C31BC60286CAB4881.2720.3268254473.292",
        "CD_46224D79234790478799E373715902A3BEF0846D474FEF97E0FCD898A61C06EA.1191.3823289365.296",
        "C_82BFC012D11F72AAE5389CA53908757EE14710A6CCDE0F075889F10711D09D04",
        "CD_ECEE929C1A83BEB7C538D0C37079E984E95BC784BD4C7A36E572CC721AC58FBD.312.12612258.339",
        "CD_0A702609A4E14ED5BB54CDBFF28E5ECE8F1289BD2EE16275B15126AFDC32B85E.1598.3141573133.442",
        "CD_57D40BA37FE8186F3446A32034E557900E56ACCCD48ACC004BB55BAE4E42928A.1191.1555259249.607",
        "813233206.431",
        "C_B8B4905F90700DF9ED4B891C0012569544A0582CBC77B58905D3AC53EF089A50",
        "CR_4382409C2BA25AB891FE25D9946357B2012609A915D0D018CA8A80D2ABEE1CA0",
        "R_0BA79F1C0B8BEE05ADEFE070511A71266F9E5457646BBB9137C84F64D7EEEED6",
        "I_53D75572FCE95F80C91561DC225542041A284A87D7D3C4BC247CCB4A988D11E5.100.3929026545.302",
        "PermissionMask",
        "CD_AE5557242873CF979D93E87FECAB292ACCC2C01318E17F5504ADCAE7A065AF1F.2611.3001251117.470",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2167.898719816.180",
        "CD_D13D81348F7983969C884BA6E5AABC73AE0A128B3CF746A401623C9284F0BB59.1155.450546190.544",
        "C_832531694CC32AEF12EEFA0D2DDA8BF782C32F932BED169759F268D0FEAF39B8",
        "CD_2A27EE71F034CE7CBC6FDE3C0FB6BF6E1520107D009F49F3E604B5623A36597D.1559.1588151945.985",
        "CD_DDFBE2B8C9C0EB71960ADB33E49F91EDA6D2896A8A0783F02D140DCEC2F9FEC6.77.2322781230.485",
        "Transitioning",
        "I_F1030868708E770830FB885073916FF999A80113BEA7E44E92BABC1A74051F56.2718.2773248534.272",
        "08L\\Tx",
        "C_DF35CAA9032B2BC8E9E68BEFAD5091A66EF205D46DBC51F13F62EC987E8BBEAC",
        "I_3D90968CBF38C76EB9C64EC58DF8BAD337C1A48A70D1C9EF256656BDBCD3DFE4.1105.2719360383.297",
        "SourceFileAlias",
        "Signal sync type",
        "IL_1FF407C7C73B47ADB554CCD7AAC85C16074F3CBF452AFA2DE01B23DCB19E63EE.2705.2059709073.292",
        "CD_4081492ECC5429B222FC8969B64FABF570738238CC029A92D9763EE13EADD315.1550.2920494465.1960",
        "CD_54C1AE02684F818103F95A010B7FA41BC4C4A5E1CB26B1EF1D4449E52353C1D3.1585.1.29460",
        "CD_671CD27AD2FF2B26E5AEC1AE8B6131213A781611B2DD0FF1AEABD7796A7A5E7E.1582.718960890.3207",
        "57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "CD_3574CA0F26B4AC51BE1A9D13287FDF35F510716AB14315900C3DD347BA7A0FA0.2188.2864116480.3274",
        "C_A459BA7CCFCB88B641F49560CF44922CCC34D85A3AA65521C8FDAC7F1BCEA69E",
        "MSNdis_NetworkAddress",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1751.3778354227.368",
        "I_B7AB74F9882BDF78202B38ED087C2D749D94DCB49E9443E63C93252324D94824.1053.2878101920.354",
        "C_3D126353F8A45AE958FDB7A794F752470EAF3717B940BF141551AD925649D593",
        "CD_1A56F41D63578C6740DEEE2D125A595986E3783B82D23576EACB16C1622C2314.1186.2709006802.778",
        "CD_FF71E202E2A34447E8E5354267F9FFD470AC6E6D127AAB0563CB37424C6A85DF.2650.3842726453.241",
        "C_36B87E3CF873D5DF59FC956D1C967F5AED26B2528A61DD13A73C206412B51BFB",
        "CD_A66D0E591535F85D5DA7C1BDF3A1DC73BE40E7ED75F810DC35A2C1D0250B7F4C.41.3690810158.523",
        "Allow-List info for a file extension associated with a RemoteApp",
        "Pinned inherit",
        "IL_AAB85F9CFFD1983C63E400300F9D65CC1BFD5574765DD183AD7564152A7C81B2.2723.2441498537.276",
        "IL_C711AE1A185A8206CE43A6B193260E5C46D4B4C1CB3BA19F666F69A96A3D2442.2695.2230254215.266",
        "CD_C7FBAD005972F7843A0300A01B4152A8540EBC9591F80D03685C4491BC0F4E13.1606.814594576.402",
        "IL_25F47D71265847CFE558B579C83F67890E8183744685A4BE4B2FE5DE135F5117.2723.1288667172.275",
        "C_9CD08C33F827418E52A142082B3E53DC14490B507641080CA3D5F25B878664A3",
        "ErrorCode",
        "CD_A7295464CC993A6D391787B800AA99F01A743758501FB7C1EC84FF47700AFE8E.2484.1859609165.2691",
        "I_96BD44C201D86F0DBF6D193C06ED59D7A3A327EF4048CFECAB45DE235BD2A443.2709.2232911713.309",
        "C_F8A40DE76638BC2D6B465FB946B5587EB32CE4928E4F71A985E7A4A1C7848063",
        "CR_008720254C2A979DBD5FF3822840A198E79AD81A362A92EB99483EEC5D47BE05",
        "CD_532D40BC8D2DCAE0B935582EB7E7A966051D83F4E459415CF450B3F76F74D4BE.1570.3343842987.922",
        "CD_A17354395E79A088E63A18457CAA51A441A886387058324A6BE95873BE2C4E38.2757.617180038.313",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2087.759426123.180",
        "IL_0B4B060C1AFE18E95F30F5B12FC33C3FA53B95E1B357494DF4F9FFBECF865BE7.2678.845714409.283",
        "I_96A0EC4FF2CB51790E0414BDB04B92A481C2AAB3B517437D6529A9DE10E4B9FC.2726.2315990446.279",
        "CD_48081560068735282A6891C4199013DB35841D2E49ECBC9E491762D9EC107CC5.1598.157249974.526",
        "NS_37FD5386C028E960C90BC77B9D8DDCA28B24BAE2E315E8D8209BF5E2633575D8",
        "Directory",
        "CD_7E6FBE4200B70FD4C3F5F4E9556E66896E2662AAD9658177CBB7E9E4C038BD05.1780.4229731756.307",
        "CD_43D2FF9F27C9DEB49402058FFFFEABC225D67F17C30DC663FA2980525D05DB01.1809.1111461961.622",
        "I_75152BCD568DB7845972EA624FB84F5F521850310C2ADC6EE7240F0BDD1AC158.2697.2979308410.284",
        "IL_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.3053127222.360",
        "C_A98E3C9A35EBB8DF63FBC398162D8A41BEC56D5DED2307F1A6E1711FC01974EF",
        "CD_D36BA3ECD67E70A681B6A3C59013CFFFBADE74E531546E307816C80C79F820CF.149.3031852784.565",
        "CD_7F6D7AB071C5599637F51EC5AFFAE51440877864BBF7579093A40694E069604E.2422.3700847065.693",
        "dialUpSettings",
        "IL_C211191EA2F7D3DA2417EAFFB824676B8FE72933E0CC7156D270377961B3F138.2694.3795932327.279",
        "CD_4FA7CA8594EE1914553B3C8FFCE3DFD4FC19CF88B46AB33B2D35585049F86D8F.2087.2732099444.806",
        "CD_AA941D6FB7B25E3841E6273F5A7048C9197D07A3AD7B18F91F0EA88E4351CAA4.1342.607461655.630",
        "CD_32BB09C7639B708934A441FBAAAE435ACEBB2D7CACBD541BAD6D4FBD2B149A82.1555.308790063.543",
        "command",
        "C_4C6CD71FCC442DE647DE566A7976E508BB0047F456840F2469A44C2BA062A4A9",
        "I_1557BA1FDFFF4AAC907A3F2DFF8116854D902BFA7E0D3C0840EAD2DB602129AB.2690.4025116298.274",
        "R_1414268BF3C6238A6AD001B5A24A141E87C99B65D66BDC84E11131854913C45C",
        "I_C8A6E52D7AF2A6667E14780CD0005CAC845591B321B522C7AD36CE25A7473B23.2707.139493216.285",
        "IL_058D03EAB4D58BD68178C926B8674C3667FE7B3464201E046707D1197C7413AA.1058.815056437.347",
        "IL_DBB8F50997A5C8FF29EDF6B1B0D18CE7302CDD609B179D2DB99C90FD0F9903DA.2720.2981328344.269",
        "IL_B4A2C5E94294CA48EE83444B581B7715F0456C2AE322533C1FC870F4B341BC92.2459.1269866449.285",
        "CD_EC835FD001719DF0125212FFB95D0470D32F9067FFBFAA346321BD635810CDC2.1346.3740099299.329",
        "CD_629122007ACBC01F5C89876FEF5BF24FCF799FAC8975CF22D2EEA155F3C49ACF.71.4249563231.1080",
        "CD_F501D896223A4824AD7BD67404A8670F77C009FD1A50960728B1DB6EFD108157.2575.2513707889.398",
        "R_E54AC9C8AF2DF17AF3B8C0CB2919B6D7164B0CD443D51BA17AD5F6B6FC0AB970",
        "CD_92EE6C02ED0AA1EF322CF0E3C150FB5F1D97B8751D1560FB8DADC1FA4068EB93.1051.457775385.882",
        "CD_AF09E10A9BF5FEF41024B745AEC70DBF485E6D2506AE3E4A84DA5AC85692076D.1345.1537819079.797",
        "I_B9E934F1EFF572DCF875BC3D3E568C023415A57FE003BC4EDC3E1138647D45B5.2721.173576948.281",
        "IL_C3282AA80DA339EFCA4A6811C7928828B016D54F51939633276BDB2A4B84C760.2683.69782534.280",
        "IL_6F54BA62DA550A229FC046AAFC1C0CFE12E454FE3FD82D56A60CB00A73DE7D0A.2698.2822082259.269",
        "The Query property is a string containing the event query filter, which was registered by a logical consumer.",
        "C_269DB88603C265BCA5F6044C1F072210AFF0C0C241B7570BAB9B5F97E1D62DE9",
        "IL_5B4CB97F3296F541A8C0855751D27A489FAD2B073B0E52456E215DE08C0E49BF.2728.1403484980.289",
        "I_AFB1F2A4391AB360C9692594F916CB837FC1E6CCCCC7C79E1D6F44A2E3986C3C.2449.2850169286.318",
        "CD_F0D12046665BD58D783629F2811EEDBBDDE5A3CBE61CDD42A2203D1BFC5DD00A.2573.3377772396.643",
        "R_214CE1426D6101A6A1828EB7583A1623D82AD7602F044FE3634C76546F0199F7",
        "R_9027205FD7E053DF439410755A9BD704E454F745D87AB219C121424FF63B731D",
        "C_839C8F4AA62547C4FED161D017BA1DEA05BA49350B2617223D4B7D0D89B10A69",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1342.1817223576.368",
        "IL_61642E797CBA7FD308765D422A26458A770AD0BC77553C0534CCCD9FCA1BD187.2417.2773304796.246",
        "72.243002396.245",
        "CD_C85BEC05E1DE78CAC5454E6D33A2BAFD69D28B4057355776F41B00B3DF99855E.2427.3947980781.400",
        "CD_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2.101.1324985010.2384",
        "CD_CE6FCCCBDF3E0139B08C5FFFB4D0F2AF40864CC7B7E000C38C0F3B168FA0E2DD.2474.1.62476",
        "MDM_PassportForWork_Biometrics01",
        "I_1166A5D4022EB9E202226C582A5AEEEE38BD7F8F04083AE3DF2B384336E6928A.1352.2768103902.185",
        "C_20E26719BC549B0C77D8B4DFD99B77B83DDEDCE4C0758F4F0F87734411D6F4B5",
        "163D382B2134D4EBD8.2577.1837061544.1042",
        "R_B7706B28FDE42900BD4C0DBC550087B0F05CF9BC30AB26E796AD48A7E503711E",
        "C_946F4B9CC4FC67CBB30182CFEF8E5287FF27217BE36B1392758F9655E96E5C2F",
        "I_688D8931EE2A8487D9B5A44690AFE9778BD88A1AEC3CF68732A2A8C47B5E2165.2689.4125960521.277",
        "I_B6CBE99D5652E5093082BE72C71EE2A5178AE30AD7D99571D547D2175730C93C.2720.3997725361.289",
        "CD_36D4896E467DE39097850E65446D5E83BB401EDA6D0F2AEAC5EC836BC1B7F0F9.2569.325348869.656",
        "CD_5D3D82E165425301EA97694D98E5FD2162C162CBCCEECEC5C4215C7B648589FC.254.61582902.340",
        "CD_AD28C82889667A5985FA157872F7F42C3CF0F9FD284883BEB8BA71DEFF026FBB.2309.3005234657.238",
        "R_F841B632C0B2584CF30B2004D8CB79959F456B5795456033F557C9A443CA86F0",
        "CD_E4331DF18896E69637CDDB420EDB4490D51A6789B8AD769669991F6030309A42.1057.795129747.730",
        "C_C3366DDE9F2F54519CCC578CBF8A7581CEC6A62E8EB4A103001D861C9B636A37",
        "R_74EC3E16E036713C798F9F1CC163773CF7693F41C4A2ACF1A7DC2B900BA8E73F.1807.3210342868.590",
        "I_CD6B6F5815E24B10063DB26980B56786D2CC20440346CED85A69453A578AEE28.2705.521566262.291",
        "I_75757880EAB8961D1A3C186FDB42A3E5F36F1FCF20B2679D12A2FFFCA63470FF.551.1.33689",
        "IL_14E81FED65CA256A291552D7368076BDF086E65B079868D33E50C9799C909A98.1065.962537403.248",
        "I_820AA6D258E77F336189F18423606FE1C2610B1E172F224DDA0DAFF376C8D78A.2683.2252325565.280",
        "CD_6BE2C209EB4B57270A7D84E582DD2AE1DD184D26B11A84A10BF69A2E4B28421F.1222.3407657566.278",
        "C_AC0E04BCEB92E102AEC34A4105C7658C51A4608468C8FB7D34B6466CE5EDF05E",
        "CD_B209BBC3E9792036932058EAFDFF59DF6B02D2E0E24C683DBB3CFAD2B25B83E4.2758.2197590119.631",
        "AllowOutboundParameterProblem",
        "C_65A504D3A866F8E7ADD367ED74A8C747DE7742D2C08574C6A20A5D6A8C659BFE",
        "CD_A4DDE6CA06AA3C2825062E5C08D9D51AE25E110F246E7BDEFA87F60CC99DB06D.2586.1337651403.1128",
        "I_C004F31EED0C3389D3663FFEDC2379761F7F253446DFB3E07A859B8D44F5D78E.417.1.15778",
        "CD_4956F7377CADF88BAEF29AB167534942D2330E0E6BECB3AE4512BFCC91561A1E.2273.563559444.1201",
        "CR_C94E6AFCDAFCBF5EA00ABE8B2F4F19C81D5C47BF5C093E7C720DBD8884BCAB6A",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.1165.892627244.1603",
        "CR_5C019BBCF7CD2BCBAB2E1080A9EEA832173CDA76E5635A18F883174B94FE0F77",
        "CD_DF85153FB4444BFC904B433D6CDD9675CBBAF1556A07F0E7E082E4B4F8C33E3A.1058.2648172721.541",
        "C_F33D7C5F62C48A98254F1B0ADED8C5A8E56D1601D517CF44369F4A800E4AA9F6",
        "NS_892F8DB69C4EDFBC68165C91087B7A08323F6CE5B5EF342C0F93E02A0590BFC4\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_D980EB9E5642F0999DC4AB724E6D1AB5BD3BF32EB2B6ED1230F2BCEF6E536E10;",
        "Resize",
        "R_988CC64B9858C06D7E29C18EDBED8CE13CF165862E4E03964EAC303F3A8E79F6",
        "R_4594D6C30924C4ED031F78EE8103A8C70830325B9BD2B6144E91FDA4F064B1F6.284.1680801173.520",
        "CD_D00A9CA0B8551E2EA506854DE0AF73821A38223CA203843922AACA9957177697.1345.941050726.342",
        "CR_EB5DF692E5695761F8BB75E5CAB5C2E64C9D570F7A2AE8F24E9823A6FAB0CA95",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1714.1717270635.368",
        "SDBUS_DEBUG_DEVINIT",
        "IL_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.285.2021993801.242",
        "I_3641218BBB4887CC713D0E6D5D803C013DC990DAFD3FF3D0CE1C6648CA737F00.2710.256303480.290",
        "R_46220D63709C3AA26B1F26BFEDBED5BF0C3449D14236275DE54E229C2751EF56",
        "CD_AA89F446191A5311D6195827FCB555530663B59BC79B2415F2F523FE46FD51DC.1074.400523144.2000",
        "C_BDBD703370774239BEBC1E94F2B0692B813E092749792A1A6C53E05A6BEA0158",
        "CI_D6F23AC5CCBEB47ECCF7BF129523258879FDED9D282F558043FF80249A7ED596",
        "I_FC6502D50E95D4180E3FB04EECD433EB33D3321E9B8AB75257B601EC998FA3E2.1016.2858455450.307",
        "C_817907EE3F3F1D281C653B2387D6437098E74E117CFD338A02C0B1790D3818D0",
        "I_C2B597B4206C5FCD8C54154B2AF54218AE68F3F6C7C8C4836A03AF2B8F71E5CE.2710.453867218.289",
        "C_C0932D78F140997A49C8B45C94D66A040A7701473EF29BB14AA1C56EBE031CB2",
        "CD_86D7CCEA6869E457637E2E5CB69E46D8D864161EF56DA1781B622C505BA013E9.2583.1465434716.676",
        "R_F1D630BEF68CF726458C1876C0DE9976B74EB5D695E5BE33FC487E2CEB030F7F.1197.1681292377.564",
        "I_329C0DD224742A8A2F3E1162540E53902DC984F52EC54923592299CB2B958B9C.2683.4047330402.279",
        "R_CE7115C334FCF4CAF18779B5DCE6EE49094B2697F81975FFC890786B7C5BEB22",
        "IL_E1B0B84F789F8D4A723143E6CC1D687E2507C707531AE083C2E8886AFB9011D4.2725.3418306492.280",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1050.1756638890.368",
        "IL_1FACEC4993C31072F3CE475A8DF43696D7CEF8AB05082A0FDE1493735CBF1EDA.2687.992037174.280",
        "CD_E4331DF18896E69637CDDB420EDB4490D51A6789B8AD769669991F6030309A42.1054.1410085197.341",
        "CD_52FA3652DE48FD253CE895AA1E0F7F7869B94D77DBBF33883D1DBCF38C65343A.2015.2438427936.2265",
        "TP_V2_TimerExpiration",
        "CD_A435E1CD6D36EB19C6DA0BA1C7E62224942A59031964EC981FF17A68812E1011.1807.1630028497.417",
        "CR_3B2DEB628DABE7D4AFE58BCCA12E2FE850BD8110A3238C161DF85D5C51FAC297",
        "C_038FB93272FAE6ABFA86F7DB95C50EABB70457A3A4C501BDC273939A1E6BDB9D",
        "IL_27272B779F0757C78AB33083DD3222F3F74A7CE553BACBED32A9A71830BEBBA8.2693.1604006876.261",
        "i}mqu",
        "C_5792E9D1C6933FA6423EE5A5FA8BFB08652AE142B0B622790C9FE3AE890002E6",
        "C_E00F7419D4B48E1A92C27BB2EF8DE2D2C0B5AA67F6D9F7937C1978404CDBA2C6",
        "CD_E52BD2BB65ED90ABABACDFC8937D94C5808CFF6C3FD9A7BEE235CE9F6DF64BCB.74.1554351600.580",
        "C_6D677F300F8EDB57C4344519EFFFC67AD59F24CFC7D2D479945BE7862B950AB4",
        "C_0F2DD3599D613DB74CB1ED2BE9F8DA01F5C4A980B89415432A1F6BEC216D618E",
        "CD_020D216315EBE851D1E95EB38EBC3A47071878BADCF464608068D12F0A2A6B6D.2611.3343727782.336",
        "CR_FD01511EE67712BF18E22D5987177172AC0FC136DA3801B80EDFACBDC4A53CCF",
        "R_94145E2C57E0D4603F8377F5BA5E611EAA5A57D8CBDF073A7F4BA777C46D367E",
        "CD_94FB2DC8F1E30FF47AC0406B2593A62736B6DE3ECB4D5BD65D719C44B3D8578A.1566.1524182749.7023",
        "C_C12F1595FB14302AC3BDABF5969819839654D56DFF22512157B1EA1002807534",
        "CD_6D677F300F8EDB57C4344519EFFFC67AD59F24CFC7D2D479945BE7862B950AB4.1057.2941835202.203",
        "IL_D2B0318BBC25EF83E4553A27DD13636837740C22329726892CC251345D046A16.2712.1753044962.293",
        "BExHKNQTWZ]`c",
        "IL_0869E7F30E2A5BF6BEAEB4AC9D6BA65E60DD3C3396A670DFF5952A5180C69165.902.1.56485",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1797.1859355143.180",
        "R_142623D3E4F607F4C710DC9D110BC19440768FE0613231D265775B5055DD4B5E.1501.2196819660.586",
        "CD_3AE83E61965FB27603BA5CEF6287221F55B7F43E8EF0935F985E7B5963177B6A.1700.259369830.341",
        "IL_0FCD55CFA46AEEB52F53BA4A255EAD5AF6771EA55E53002CAC4E98AE74ADFB9C.2698.1659596386.275",
        "C_58036643D64E8A1516491471C2E429C56B6A6CFED0C27493BF3ECB5339DF324D",
        "Not_Null",
        "IL_41CD80BFBD3EF2A72B1311F93D87AFDE77273A97897B7B012F0BFA851DE8E60A.154.2607592767.297",
        "CD_8ED07F8AE1220DCA0AA67C713F95FF5F2613D1EF04C9C11037C57B91CCCB3B53.51.3064932644.448",
        "MSPower",
        "CD_914943302F06F34FF1632B4D7C73ECFF9AE15DDBDBDA5F8CD8FBC3C0EF473B90.2370.1570389657.560",
        "CR_554B16C9365D83D15EEFD2ED88E19BDB73646FD9C4C1F4781F93EC1BCB3E664E",
        "Invoke",
        "IL_045C9A425E2C0146E5E15C2A8CD5E606A5655DFFAB2AC41A2AA46A35489E43CA.2719.3382053489.269",
        "CR_90D6DB96E4E52DF3FCB751D8C2491313C169EEA2DEA2212CBFE4EFF8C0A5E947",
        "C_8C6449E2DF9D42E8B328C8B95C19DA35BA5DD1B3E90C6134AD1B5E625248E2F0",
        "IL_84B0232F39143ED311317E399D2E2A8930FF5F10FA3DA1D56F1894104002A841.2713.704309705.279",
        "PROCESSORWMI]",
        "IL_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.2532338682.338",
        "IL_6BED86547A30ACCAD1302C7FA283B163848C4E58E936CB646E57DB7DE244D555.1019.1080799391.339",
        "IR_0194D7E956D38B1C947B3250090E0D48410CD052B7BC03F2F1F43DC398A99DC9",
        "CD_AE04C9051F0EB0D5BEF6B71DD5AAC69C1301952192332A53F9A676861E551DB6.1017.874226680.160",
        "IL_BBFCCB444CF66AA09AE6F15967A6865175BB0ED216D19970A7988B72CDF0A3A4.297.1059767373.342",
        "I_7A464473EED377EFBCBB7DB5D2D2E323DB20CA55CAFB1D1A365E79DD41CAE34A.2714.1599386834.277",
        "CD_D5472BB4000403F6D6CDB0F595804CE62C0D292549796526CA9E7773798E5F24.133.2231630649.318",
        "C_A393FEDC8D8439E642FD70414F2815F8C5D6DC216A8FBF3F8BB710BDED38BED7",
        "CD_918165F99F828C6B53BA10EEE3979256F3A73E636E22656D27D129A14FA67468.2736.2129165662.343",
        "CD_39EA2BFBD151895F8DCBD416FDD9E78356607422DBB08BECE9A9C96986D175E8.1966.2269492716.4055",
        "I_5DABE1DD6EA6EC0E8373D4EDC2151C170ECA318A495B080993408D9B2AB923AA.2710.4826648.291",
        "IL_752BF18DDD5A926AECB492CF5F791DAA2495FFD9675699FBDF61554FC1FE5AB6.1938.2712049415.328",
        "CR_4082A72ACD016CE3E809C18525EF28CAFFEB76B1D6E2F5C00FFCF2C67654A896",
        "I_F0A05503969BA9B2920F8F9DF45CCCE8ECF7EE555CF3C100E6B06D005B51BDDF.2703.2978597607.286",
        "CD_7F382DD324E73D1EE29B1DAF82BC1A0F402BD2F7E746EE4F0FBAA0F200B37629.1464.894147348.274",
        "R_A9AE64C03C11270991C8BCE26EBE3DD0FF3F841C3C80D3A28DC949EF9B62D60B",
        "IL_DF1D72ECC9268213FCB43A06A38DBF2A7452DFF83D9A2AF1D89F3CECA76D4AF1.11.2576163929.295",
        "I_E2948D4344EE48B59BD95755614625E807A8E22AFCF13BF844DB4801C2129926.2687.2636800512.260",
        "SystemConfig_V2_TelemetryInfo",
        "CD_7791A711A5B5A7519657E417C7257B17DC36A8205BDFFFE1C1C88B07496AA0E5.183.4241851410.2090",
        "C_0C79684F32FD7D7088A468F0BE92EA35ACEB9FB4BBDF74F4E887F74EA9111458",
        "I_5128FB5846E65E2296350DCD5BEBA87CAEC1AB538CCF7D239F558B6508DD48E4.2712.1534257330.299",
        "CD_6BA401C18489F9562C67B286EE1D519BE8F87AD49C610AD4FF91FE5F1FFFB1E6.2642.749552008.458",
        "Msft_CliAlias.FriendlyName=\"RDPermissions\"",
        "I_46934F314D8C73CF84735F1E3C6EAB14C6702B40FA0BC5B992EC2D6BF398368D.2696.2593577853.273",
        "CD_D3C4DFA37F26EE4C7CA31BA9B8E724B042DE4802517C8F5FAFF10A17FF77557F.180.3177779426.1734",
        "KI_E706FF8586C52A7176ACA48D7702EC2A6550564F0E42B0C09AE3FD1CCEA62CD4",
        "I_0512996E43BF9CC18C2AE4A048B8AED9C76AE8C2CA7091210CFFEC0752609CAA.2764.4120604444.278",
        "I_ACB78AB1C22DE7E2D1D91C09C96C157ED8C7C29196B9534A8A961D540401FACE.2683.220166618.280",
        "R_169484918492FC0AC4886BF1A48556EDC1984793E915C243C1C0A4B8E678F4FD",
        "CD_4D32B2689DCEC5CBC62CE6B930082AE82B9F152AEE6B99F9CDBAC8B0961EFF51.1915.2700036687.283",
        "C_772A091866475C0D90401E2D449ED248747158E72AA5FA334574887C1703B328",
        "CD_745B4133290DD0359B5076BFDD5B002CB270C2B12AA8DACEAEA9E5921822961D.1564.803583389.504",
        "Ndis80211ReceivedSignalStrengthTrigger",
        "?3ZEo",
        "R_2071C998B3CDA216809AE88D7F0C4075E716FBA81DB6617742AF119DA63F83EE.1607.3646029120.516",
        "CD_EF2B7DC0EB341A8F463C94D322352FFC844C71A2889934DEDB50779AC5CCABF5.2541.310320882.520",
        "CD_A9653E9A5DFB9E3492D2E71DB2DC5C8E5D6E1AD64D6D763B4A929A56A96F3F78.1915.1106450604.267",
        "CD_7D26F1E16BC9CE86FDDDA09E425A859A3BF87CD94B9004A4B2B575CD1EF41374.2757.2381403284.638",
        "C_B4442D1051C4005225332D6A3F9917C9EE5F09E38BBE394F5F49F7356CCA2592",
        "CD_51E88707378BBC9C3F0262A228CB3838BB1907FCEEDFA527CFB3A2F422A1118A.2584.3233123323.227",
        "R_518737FCD9736D06CAEE43D2445A32ADF7BA5172ECE7281110883C447A0C8E05",
        "options3",
        "R_E7ACEB5389BA8C32B04736209B872B130DCE3B94FF3A17F3972AEE3EFE29C3CE",
        "CD_B7D757AC18FF2608497B974C70CC80BE5C41C99B984057C2991D1A13D3816E92.99.2395029182.542",
        "C_0FD1FAA819681F2EC44E2931633C629893BC924C7278A0294B94667101A7CC55",
        "CD_7FB7BA0DBA074B35AFC3D4294E020BED8632DC6DA6BFD74D3F6713AC283B7860.2638.1289527071.1548",
        "CD_14FFC489A434D581FBF6E06A9A803439863075160D7DFAE0D83E42734806076A.2748.2728969052.982",
        "C_BBD86C45827BAA3142E8EBB2B4C0577FACECCA56171A99F17B3F06E280A3C32F",
        "C_50194DCCAD6A37F18540D305E4429A178C41F0B3B734D411104A6EE95713559B",
        "CR_FF26EE1E822090646FAD145AA9A6AA2ADDD373CED2E3B2B3D92A588873B3BEC9",
        "IL_2BA08418F861DB94672A8DD5AFD68E12868858A5468279769CC6CD73EBA0759F.2722.274125471.277",
        "CD_FEE056125BB5C53A639F41DCE7DF075F1ED8C67B4313ACD38915A7DF950C5FC0.2584.3837490676.215",
        "QueryId",
        "CD_7EB4A9F63049256E4E34752358BA88B60BE953949D217BBE4528A28A2AEF7097.2016.1794842628.752",
        "I_918565F2AC17124A0B8E78883EB2D7AFA64B7AA2F5E086A6CEA6DF80E0037CDC.2688.2169007999.265",
        "CD_2277447C6063BFBAC05CE459DB8B2E90B2D0D7BB283ED825F0C1EAA1C62A123A.1.1591629636.404",
        "CD_D37C7FDD3090E0A8DE13792C3ACE5861A14731A38436E85C6978D8F1B151C11E.276.982525368.171",
        "CD_B463D489D65702642CB926E52778D8BA86FADF16643D384646C07BE40A7A3338.2615.634055106.402",
        "CD_6733173DBDD8F69CA9013116A1C86DBB32D2314712D9192FE9CAEE8C9CAD7094.2117.1014708722.2072",
        "CR_BE638133AD205E7E82E7EE572C3B8A31E527A6DE4CE929382C29EA547A1E1AF4",
        "CD_563CAEFB32DA9C6DA846FEF0491B998A5AEB53D92D124F8B8C12120BA57E3D17.2744.57041727.359",
        "C_3E11F2867F2D534D95C0593A0AA32ECA612C606596AA91228C49611E4A1C3BBE",
        "C_15A0574CC6A502D68CCFDC53B1AC5E00FF52C94DF0173E0C428828FB42537813",
        "I_BA51ED41265DA7310954BAE161AF50CE2679B701DA6D3DEB06FA741A8D05CD90.909.1.70636",
        "CD_4E50C067D96AD4A977DD1051D7D21FF366555B5B1DF0C0BF0BB16B924A2797EE.1350.1758934942.927",
        "singleton",
        "I_618BE348A47753A2409C56D8BA15B824FE864BAE4B7AEC8D5761691B87263426.1463.2195306647.251",
        "CD_34895944DE541E1BDB606B5CC8E0832E8753C3EC1DF088BA96B2C1F930C39ECB.1154.2620620624.849",
        "CD_1FF3E8B084EF958D6CA51930B35BA398A9AA3DBAED426E535ABE1FF42F771AC3.2426.4280296344.298",
        "CD_A8052E229C4B03577986045187D91A61D438B682AB8EF93919F6B095EF0302BC.1068.702729296.1027",
        "CD_82FA3A19B147BBAB62F558F1C6EC189FD15707390ACB5D1DA80D0238BA7670FF.2610.4070502585.449",
        "CD_0B58988EE51E845FF30CE0AE20CF3552F562FD4E143A317A18BFEE7AE063006D.2504.199971605.3767",
        "CD_8125E110531A89ED8BE4900320A962FACBC3DD4F09BA92855250F1BACABA704B.1054.3801559201.739",
        "I_7DE0494C6D6A0D37A15EFBDC4BC86C298D25E6372DD287889B444A33502007BE.2703.1615104207.287",
        "IL_1381AFED302C67D34DA20CE9AE190A6FF403DD395BB18D45FA87AB2B0CC50B0D.1064.1865296601.347",
        "I_7B1CEA145FD7FDDE85118A874F4CDC2DBDFFEFB5270CF85B4A7E073D01A42C9B.2461.3285604882.291",
        "6C8E2EAF790F087E2F2BDAFDA4AA4BB8DBEDCE204DD4A614",
        "CD_22BF47DA2511AEFC98D47D38321DC32FE145239764E9363773B9B33A8A177498.1922.1905965072.264",
        "ROCESSORWMI]",
        "SystemConfig_Boot",
        "C_04C7F4A052153A1B48405988115DDE17865E47F99CF145973E41882C1B4DF5ED",
        "I_0B80258DB20F78C812419F350CB492491FD1F51CFDE794F94FBCCC1B7768782E.2709.1210721042.295",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.3197818881.368",
        "I_4E4B13D12C6888711CF5B7C4047A53AECE339CD6FBAA6BD0CD288CBBF91C3894.2682.2755604651.288",
        "IL_C6EA9ADB21355CF6DA787E0D8D62E59CF47237122DE78FA8959CE74E2782F2F8.2457.1605555535.286",
        "C_25C2E8C327D4AE50AB0B89215561563C42973CDF72E4E8164880862FB1C155CC",
        "tySettings",
        "Hint to help open documents with this file association",
        "C_40CAB48C933E1E9666D5FABEFF3A33253D381F532056E6A9DD2195EEC2E121B0",
        "If the profile is a roaming profile, this property is a DATETIME value that indicates the last time an attempt was made to download the profile from the server, even if it was unsuccessful. If the profile is a local profile, this property is zero.",
        "IL_F8E5C81CBCB2AD14D06971031183D6E973689447D5B464AE35FD267E34297841.2728.1311576636.280",
        "I_86E8939DBFBF509449855F78C2A0E225F4211C744325A4D2583D7F1EDDA59427.2700.2197186243.278",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2473.3607361720.188",
        "RestrictedSitesZoneAllowMETAREFRESH",
        "IL_8620435B38BE1E99E74C0209777119091A237CDBD9A1C0FEF68B28339128BA61.2521.3181266368.318",
        "I_5A84E47C5BACABCC597E387FCCE7B12E8BBC6AE8F0AF50C47B1CB50E12A62941.2701.632918330.290",
        "IL_C7B4C1B772B0A29FD3EA86C7C106088D66CED85B8901B36556CDACA2CCA2A43E.2695.2520537397.273",
        "IR_77E8F3E5C979A568F3203DE2542233AA744B340EA7CD046A020B3F37D5ECA5F4",
        "CD_C21E8ECEFF103DE2D58A051FBB124028D9968F5617844FDA582F260A7956CF1E.66.3782423700.710",
        "CD_CE7115C334FCF4CAF18779B5DCE6EE49094B2697F81975FFC890786B7C5BEB22.34.3448886685.773",
        "IL_64617594042CA950F4D2B027D9C36FDAA4961C42DD29E69907A0B9AFDD6540A4.2676.3631252620.274",
        "IL_727D084B173373D46F94CB6F64D3468BE5462ECCEF242203910CCA707C262814.2713.4027850681.295",
        "FJNR}VlZ^a",
        "IL_AF15677D860D9794D335112F0E9678DFDEC13579C5E4184FC4C1D282E060AC8C.2426.2865042132.198",
        "CD_5401A055411F9811A09125DE8462BF6A4D708D8C770ADE3D670BFB9DAD21A39A.2284.2783153998.2757",
        "IL_BC5AD3143069BFCB69262A507381A55224EE383E9B759A94AFFCD6368531CB90.2691.3416350184.273",
        "C_5241CFC05A716A77CB0F36844F9A62538AED075865B9C000AF8A5A2832337841",
        "I_6A2B0A9C7B7C0903BB38093EB49798B19D5E84B3AF09045E44E986D4F108D112.2721.265848960.270",
        "CD_7E9D3FC591CA732EEA61C4B739CB4B4C95CC90462692A33742DEEEDCF2ED6366.2369.3801364351.1904",
        "CD_52950D1EFDC3DE67342E2438F8E07B6F40A248B4E32B21A3EBA8DB9797405C1B.1187.3003074883.393",
        "Thu, 28 May 2026 15:30:41 GMT",
        "CD_CC0ACF58FA3646F311BC16A78942AC6DB48973323025BC27052C3593D5CE6061.2762.674572009.779",
        "I_3C06DEFB1CF18662A9EA84BE1BF59A84A61A924381591B87A6C6A5865560E929.2719.1468470279.283",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1751.3104661138.180",
        "I_B4BE796E49BD940EF3233AA1E20E02F74C49D58803EFB7DC7A8BF19657D6854C.291.4294172468.274",
        "C_5F7B17759674B710C4E590B546341D8349CC1E92B0D624CC1B3690C54CF3482F",
        "IL_0405F6BF94233FA7AD22704F8B3A0B81C7FCD79FA3E732DCD4EFC495396F9ADB.1014.1183321281.295",
        "CD_1E73C355FB885E2163DC95C015545482A2598C9FF194EA43A47495D556BA0B0B.1489.1236262607.713",
        "C_17983AF29A2B91B8A9FC70E3C2059D5E3BF314C75E38F4F96A785985A070684A",
        "Run scheduled scans only if system is idle.",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSSESSIONDIRECTORY_Prov\"",
        "C_C0C025C38981E58EE50CB7BB4E4786CBA14FD933E638861EA3A6A2E0C806211E",
        "C:\\Windows\\System32\\drivers\\en-US\\processr.sys.mui[PROCESSORWMI]",
        "IL_6D62D7DD45B5ED9F92154C67A2CCCABB9210F15B90BC95A599C735B2EBB140BA.2698.222331560.265",
        "Error code.",
        "CD_0CFEE70EA76040BBCF59E006C673746B621403E235671233CF5C1C2B3513102A.2756.2032699438.732",
        "CR_199F8BD2C63EA7935AD06C4A530278FE453B1FE80DEFF18B6BDA97081D8B8C0A",
        "CD_C65556E786DF4564CBE8233239F516214163DD07540C77B7EF0400555C330CEA.1924.3436950406.289",
        "CD_C446284C531AD33722FED92B5707E137291BA408988B095293D49122D6D19961.2017.3754845008.1794",
        "IL_0127A7661BBBCD4388742549D522C2574BE39C7911E6AAABA36EFEEDB5CEC716.2706.1804986656.291",
        "CD_1556B1A5E87D4310C75D4BC7292B6D4E10E4ED4FFA6353E1CEFCF645DF12E488.2614.3861396044.546",
        "CD_886435BF24EBB4BE37078A5EB6C7D44E1EEA23CFB6DDE7EE3C70C44A6B800533.2586.4269561825.1307",
        "The current week in the current month (1-6)",
        "CD_B89F81602D340760DCBF9C7FA464908E742B64A7C6E08A776FA3C9E7E3DE6507.1085.3839269546.784",
        "C_7FB3A1D15087A8B0862F6DCD3981161C8E3BF501A2EAFE3B6D31AED8419C27C8",
        "I_952652DF528E210BA7D893A981FC3647340447B0622F76B4DEC06CFB4BBB51E2.1730.4078944413.332",
        "IL_733A172C697202EE1B8F5546C9AFFB7CA8277AB306D960E9F2B3FEE48102206A.2709.3661202878.299",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1050.2010874989.180",
        "C_5125E87B865F9C6DC59486D1BB02124F8523E09293ABB2126C845245277E44EE",
        "C_5849216AA6B9C5A93654C6E712D3CA05EFB53062AFC2D5C516979ED25C05754A",
        "CR_B6A3DCDB97084B5AC4FE4FED6FDDF2AC8904E59EA78E2E887EC614E42011F697",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.100.1563575438.194",
        "I_C74BD3D83B700E69C77B81DDAD3ED0E66B7A9A79BBF6FD9D5150DEDAB809149C.2695.3781963116.277",
        "CD_50194DCCAD6A37F18540D305E4429A178C41F0B3B734D411104A6EE95713559B.1203.1301302202.229",
        "CD_4082A72ACD016CE3E809C18525EF28CAFFEB76B1D6E2F5C00FFCF2C67654A896.1793.918738757.443",
        "I_A4F229D72D127953AFBDFD3FD290AEA94A8F46D87804C1D89B08E702E32AB7DE.2764.4019358166.283",
        "CD_FF56DB01712594ACFC5870C12CAB792EDCC37A5B84E2F39F3A65E6A4D9626E3B.1935.3080712775.1282",
        "I_429B9FC622EC20E0D4F969700C32DAA062617DCF820823CC008648C47EA2B157.2722.3135892395.275",
        "CD_D16A12AECD65E92E54D81BB5A6D4F0A9B8CCE54CFDA3ACCAD58B890172BA2F63.2572.1205350609.567",
        "C_337863EF99B561BCCD899B7AFA2247DE6CE14F0D81601137B3F7CD2CFAE44723",
        "I_83C662E8E967C9A219A412D15D8A7353A8ABB472C0E6A3C888402711D2B4E9AC.2691.1112796968.259",
        "CD_444A7A3BAC32F6DC8230C2D59CC5C5F4CF794CBBFE30EF01834E74555D738F83.2512.1829826526.270",
        "C_2FC084B6C709E5497BDDA7F8C8BE67460C3195953737FB3010EA83F4E8CF8735",
        "CD_3FCA69ED8F3BDFDCD044F14AAF5FF2C2F58AB3BAC2575FC16BF0119A940BCED8.1930.1353290810.310",
        "C_37D37D45737FC592A80BB2702AE41B63C8B8D014DB6951F1159253366BB2A47C",
        "CD_B1B14559B824E121394FE392FF430F8FD008843C4AB8D519479CE971B3AF84D1.2036.2859969842.964",
        "A persistent binding request included a bad FCP Target Port WWN",
        "IL_CDBA52B358B1C869E22F442FBA6E11C62249AA1DAFA2D017FFD6CA73F892D566.2727.3208962149.280",
        "C_9190C801A783168750B3F3627E399D0D348C0E79F09DA78BCBEA5386FF4121DD",
        "CD_4DD1A5A9057BCA223E822F92B883994F78B43967069098EDCB429059D716ACBF.2104.466899115.1218",
        "CD_0454DDDA9AB999B5E05A2F468BA888F0D0794E6BA1EBDCCF2A4463EC03258CC6.1077.2665706907.621",
        "IL_E6BF7C973B75A1F7778872511AB36E41C9381387E2118374DFD3DFDA6CD51238.2704.1194482450.283",
        "CD_5A5E04AE562D806B7A5E96D29CD9D1D3E899DB8D4ACD1E771DFE1EB85514EE22.2060.2952395573.156",
        "C_8ABE67FBD5A1340493A95993FFC9400A05F43F4592B349676E9AEC5CDBCA2F85",
        "I_37E6A27320FB004B91393DABCF4770C9BDD5EE4018E2F208CA18D3EF1C3349DD.2692.4031001905.262",
        "IL_C49F79BDFAD7EE475A1EB6E0C0C70CB5BCCC4C39035FC619BE1A57A531F5B2AF.2449.3977614343.353",
        "CD_3983F17F5C72021A2F47538559532CA9764ABCC7F5CEB4E220AD932FDEC0C98C.2658.3790944996.1822",
        "IR_B0509F7D7E6AC00551287C350BA044C7B587DE4DB669F59CAF4D4140D2D3B67A",
        "CD_4235C3882F55ECC1A6DB4EAD3A34440B234054AB27AEC08E48ED2ADEDF2BCD51.2603.4062657713.963",
        "CD_122152BC995251C3FCF68650245D240F361D06B5F08943C45B791533ECBA25B4.1055.1732970002.5989",
        "CD_581FDBF3A3E51D753168374466B7C40E39F607E7397DAAFA13C9AC84F1F3CEA3.2758.401683794.364",
        "CD_93143C972FD7DCA074E18A4541B6BD293B0E457EB886C806152FA8BC6C79003B.1067.2128655395.2753",
        "CD_B295D8909277E377626B8A67422DBF8A8A8D1D4D62BA23B5F85473AAE33B0377.2584.815912496.602",
        "C_65E1F00386C2C35A54652871CE8B9608ACB5F1178F72744035204429812D0E61",
        "DF18F0AC5E1759FD5DEB7A44E70C597DB04EB864315CE7CEFDCF23390.2702.2773771417.291",
        "I_F8C1B431C8F587C52D9B41B782E92FD5B2DDB16A4315E1CF5FC85497ECFE1EBC.2718.2294920082.273",
        "CD_FFED3214ADBDED8EDC1C230F9F76288FB7BCCC548BBB6399505DF304ECB3A518.1192.1538680227.617",
        "IL_50DA404F07584C747841B17D8D09B3408AAE08C24437A59E85539029DCC00971.2710.2562276374.290",
        "I_8B68560B534A6D3AF089AA733C222DB25352C8528E5767D325B8757B271F3DD1.2508.3011359751.343",
        "CR_4C5229B4915A098FA9E249BF643245728F52EEA4263D760742E82296F3E1B97E",
        "CD_774C74FA0A64054619A74652957611F8C7CFE26091C21F7EA4D686C4D60816A9.1242.1.24576",
        "I_CA4A378DBDF043E141AD6D7F7A088CBA7F26749AAF6E5778EFEE075D65CFCC17.2708.2635769717.285",
        "CD_199B86443F24E0A1E6BF357315CA9CBEAD82F24D15E6EF0C429DB46E1456E291.1977.4192482770.645",
        "IR_7E686F9D61EDF11086E78252FCD41558F7EFA25ADD316FFADF03AEA3869D1C7A",
        "C_F4ABAF574BE7C40EF2484F3F003F0DE1713CC64EFD2AA983D8543B07B49C826C",
        "C_93A56FD79060DE7C5C63B9201FEC3583B30A043D5DCAC083E3F4C84A7931B27C",
        "I_A5BD9A772A5FCF58DD572039DB5832A910BFAB78915D787FCC6C323F8E7F290B.2706.1341576515.283",
        "CR_A82DF9B10154EC9C0F8A403786D7520B52229D45691E2690C3B352DE9F05F32F",
        "IL_96947DF494CDA31137B04A8F8590F126A86F98EC0B0D86FAA9119928A15D809A.2687.633623041.267",
        "CD_5D9E67BE198A8E81AA13F027AA2366ADADB02EF88FD8930F2AA57C80C865222F.285.3068801040.1341",
        "System failure: Try changing the driver for this device. If that doesn't work, see your hardware documentation.",
        "C_B9D962D6F5E4151B919F374E6DA62601E38AAA45193D0F7E78EB4B2AAA85F011",
        "C_1A56F41D63578C6740DEEE2D125A595986E3783B82D23576EACB16C1622C2314",
        "R_79FD2B1944A0E8569231538101AA02032B2AA1FD92C317847D2089CA52F4CD72",
        "SEL_SENSOR_TYPE",
        "I_B40FE5BB7D3AAD0C5E26212696A1B37175024D4725396AA1CD7AE0B640ED7993.1580.325098574.265",
        "I_251DF572EC65B42D6CE95DB4C839FD6728CEC6633EF525F0041081BB60681183.2736.1122084495.284",
        "C_5004C352A375179C0A302A2B62DC334A1826F55A19CBE1D52AE237EFD9FA481C",
        "I_EECC1B53EAFA05C0B6F851CC807603872D0D449596FFABA056F5C4B60A55314E.2677.1393790616.273",
        "CD_E48A4B0B75A5A155A35AFDD8B31D5057F6867CE560F2B48F35D0656B9CFA7C3F.311.2025008565.226",
        "C_A90C06A19A3439094866B57E9C6360E4A1E8ECF44719043BBC7BE817788682AB",
        "CD_9D3CDA0D5B685AB707379FDF37152DE171B3F3E5F32F914F190FD863B176B1B3.2573.3086928807.589",
        "CD_85CB80AC924C13479AAB58CFBF7E3FC997F8734D48478CD2ADF5E53CDFF167FE.2059.2122908328.3139",
        "CR_777DF9CE1D7A4D5EDA5D1AA51A89D7A89F8ED9170D2417F1F28E7E4AEF3AD464",
        "IL_78DDD18E99547DF89EE4A409F622E5F8154E1DF3DBE8FB47972CAD32BF856D43.2701.3599437667.282",
        "IL_DB85956B2CF58EB237C2CD92C5D7F458D16DB53A647E029E514EC2747FBFC093.2684.1425757238.287",
        "CD_3D2C236C15D0F323FB188363066C67D486CC3E23871B0BEF2C84284D4CE5E729.2098.3259834529.428",
        "IL_1A09D3486215F20BDFAA7E56D30F553A48030F870E69001995D1776DC25DF065.2693.2324765641.279",
        "CD_C98173DBB4DD98E37FE4A3871D8E3D099DB9BDC9DB76DC64E72EA0E377545377.1065.666522211.1672",
        "CD_378C3B019BA81FF898F9BF06FF0AC5FC705DA51C0F56DBDDF9AC986BBEE3099E.154.116508817.490",
        "CD_83D7B7362AB73F157F3C52E091E73C081D504CD4CCE7A6A43B8A3249A1C97801.1271.1.118507",
        "CD_35C0F224CC2308A9D8BACDB20F08468AE9D1134753B5808A41A3EA43EE4C047D.38.4213175990.459",
        "Options",
        "Roles",
        "CD_79DBC5D293E4FF409F7544F02B31B26B6155CC6162B0636F647BE9661B9D3F16.2745.277847442.303",
        "C_A783BE4FF3046B33166C1A6F99019CD67D8F2778416BB5227386D1986EA6AA35",
        "IL_6F81082C846AC0017D1A9842210D9B991E25C88C600008415AF922EE372AE131.1067.1029015456.298",
        "CD_BBA26CEBD94E02C63A4812F98BAF8B828E20477373D54CAFB6CE9D30D952E46C.2428.1.48955",
        "CR_37223632162548BF77FB0A39BE56F0914C3079802950CAEA3D1F113F50F15339",
        "ROOT\\cimv2\\TerminalServices",
        "C_6819A90E9043FBCB03170E69BCE9776DC51451D8655C4104E86043281CD95CC1",
        "CD_88951EE85045E3B94CBE9BC71EF70777E4B05816F4BF59A02A284DEFD098F378.1996.771728687.1215",
        "CD_8BB282EC877EF750BA67E21AEFC765F0958A7E18EB5158F15A448065A4876EFB.283.2836732691.757",
        "CD_97E0533A6FD37D7B4F42C138D3F910EF7AFF6D78F1A820A11C33EF12521B5B2B.1252.1.27027",
        "CD_3079E8CD6D46EEF3BB8C478A433B73D0DE2B5FE05E7E7BFC923B4F14ACB286EB.2426.3340997811.290",
        "I_5209325547C4C3DC85433F489AC2215394EE00249CB48AA92AD2B0B6C8014C31.92.3096110434.283",
        "CD_6F6CD8CF6EA45E347E510153C47F4A156F13C2264BE2BC47D09C5D940D064846.1049.3967311970.293",
        "I_31DF4EB9833FE7191FD0F7C979A0B9B475D79DB49D23352A744167E60A34460B.2677.714431772.273",
        "FADT C2 latency in microseconds",
        "object:ProcessorAcpiTss",
        "CD_E02282611F6C18E1D6DF1DA91FB4178F40700A342C1440834524C343B96AC8F8.312.1731513267.414",
        "CD_87704A8EA0D222E3FBFFC1A8755A4B520E874A42E0CCEE43262F1D7B8EA4C38A.2483.3071222347.970",
        "I_B6D3F825E820BC5144FD63DDE116DC93607063EC3EA54E3AF98BEF3D763EADB1.2696.4187176743.283",
        "CD_8D357DFC4C878A0DE5A366543020A4BEF98C2B085CAA548AF24CF3ADFF66C0FF.1153.3615864099.285",
        "CD_B96031C532B0B65B8A381FC99C330B723A6082950CAD96992CF66C16EB037045.2423.4167047794.677",
        "I_7C3E534A07065323D9E854343BB05DB17EE8BC59056ABE62A90059C6FDB8B0CB.2675.1117108057.275",
        "CD_9AB73F8DA60B37A5DAD8EB945BB4F0C79687E3F0DF399D6BD50EEB5E9D647763.2560.418760564.1452",
        "PTX\\`d",
        "CD_5CAD05FDE6C707BBD9F23FD974CE44750D011145A4266B5DE3ACE64BA6710610.1779.1613405807.285",
        "CR_0AFC43F6F954497AA8887334BB937F82532036AD13DD27C64055852F3060BED7",
        "CD_5D33094C3BDDDEFAC95A7B008EBF2F99A268C52B1C3A20519425F7E8B739FDA2.2581.2308247538.873",
        "CR_676E663A52AA5A4BF1581676E7DAD4A65786BE12379551692652B9B04BB4F426",
        "hpxDdHtl|",
        "CD_E2D0A69448BBBA7800B110213F886227CDC660712EF504CAC24C411F80C241E2.2016.1232676550.752",
        "CD_31C57C9E263B97D03A756EF80651A37DE79FAE86B9B4BB0C343E3E41365C70C4.2648.3705390977.1112",
        "!$'*-0369<?BEHKNQTWZ]`cf",
        "C_B6A3DCDB97084B5AC4FE4FED6FDDF2AC8904E59EA78E2E887EC614E42011F697",
        "CD_F2E5B645DF6978E5AB18256B0F51A44E754826A7C900B35CBE3234B8A07F16B9.2113.1219440711.927",
        "CD_9A0E4B10C24AFAE23D25837341C73AF3317EA35AC13D0352F93F4194616EEDFF.2603.2383521564.112",
        "C_DA629F0FADBF1E9D6C65713F31978C9EA30680E880B4ED8EDE3DC7BD5AFDAA23",
        "41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "C_D7E5160C539A0B6F0E4DAC59284A5E27B97E67D93CF88E4C35B4F0FB64E90C36",
        "C_8753AFFD6FF7988B6BD5723778343D3CBE2068B8054CFA332AC07BDAA246DC64",
        "CD_B39E27CA2A0129CAF7998081FB67E78792DE0588A33F7B163B6B3F6E2863377C.2667.4148148153.566",
        "C_08958AE641D88CDE3333B847D49BEA2D42C946BF3924FE9A6259F27FADF6495E",
        "I_911207921CE1BD0CCB38282A896794B901A003C9B3BA6A7BCF0AD4CA2C69EB43.2705.2491796949.290",
        "CD_EFBE1C465A2F3406BAA068078725F0502A25A1F712603161F9A1B1D445463141.1589.2009271668.1053",
        "IL_3727967AE16249212954511AC74C954897073D7ACD8965A73C9EC055B6AD358E.2719.64907602.280",
        "CD_85C6074F6112BC611F9B9BAD9B2B1988190242A8CA85FA687E6954F6DBF6F043.2484.2609335749.285",
        "CD_5B62370FE5E6AF64717CE8FFF4DF7EE9BFEC8C45A936A424E7796E87491BE149.272.941977310.856",
        "CD_14FFC489A434D581FBF6E06A9A803439863075160D7DFAE0D83E42734806076A.1080.2628456160.982",
        "CD_88951EE85045E3B94CBE9BC71EF70777E4B05816F4BF59A02A284DEFD098F378.2012.3675082442.1215",
        "CD_52D2D582CC450E6D07EBF7F5FA5E6D36BE955E5652346A68534B9BBF05E2BB4B.2018.3497154107.847",
        "CR_70E019181198CB42C1737293D79C34B6386D677E681DFCF2E02DF64B188202F0",
        "CD_2F2AE0FB3032782CFC02A53ECB298C92CED59F438DE994CDC658EE55155A3AD8.2666.188482135.458",
        "IL_383E852A9891D5276F4A193447C9C24B8BEE8ED6DC96DA67A3DB4D25BECBD802.2710.1886774568.294",
        "INCITS",
        "C_F3ED82F33431603D84B59AD5C9C4CA59DF4FDC6F04E98BD4826D692A26D5A5C0",
        "C_530FF52ACD14916E0B4C64F2DBF250EDD3D460DAD5F53280FAAB6AD8DB07E372",
        "I_DD169CBA4BF6715007331ACA211ACA813A231B933DCC0D2F47B4270F95EBC882.1049.1151473019.316",
        "CD_79773BD5BEFC486DAAE05E5E8B1D31984FEAADB212CBBA311F38FEF122B52E0A.1958.1741057816.354",
        "SystemConfig_V2_OpticalMedia",
        "IL_0664C43FD98655F0D3C0C0071DB765BA71B132A20B3D33302D97BCA913442236.2680.746798343.281",
        "C_7E33A4E4E69DE9ACDED83C5A5E95E6AADC05B16D4A189A8F046304FEE3958BEF",
        "Larger buffer required ",
        "CD_18A46D7BB56A85A77A8B14FC7C4A83D15E2F885E67C71399BAA10EFBE87C920E.1616.2914073887.319",
        "CD_C0C025C38981E58EE50CB7BB4E4786CBA14FD933E638861EA3A6A2E0C806211E.310.89444417.1059",
        "C_72C3CE359B0837FA824889C4AAB37DF3F56727B4E77D31E2141325C9B24DB989",
        "CD_FF3F8092D51DC6205402036D2FD6093424ECB5C60982335F342BEB529DB60880.1346.1353255664.477",
        "CR_34069A8F0B605CD9C68FBE546D59E0558CACF01AED052259604DFBDF9878FC93",
        "C_7A2E82FAA3D7445BB721477AEF5A828AA728D419801621CF35B28E55DA9D6FA6",
        "I_DAD1BEDE7CEC3A43073D4032C979D6662CB637D3A763340900C2CD81E039219C.2716.646596338.289",
        "CD_29E8AA5244375C87F1F5AB9F42A22D9A1B648F420047277D7A92CD564C59256E.34.2742257452.636",
        "IL_C2B4B00AE6B2BA2D494F2683CDFC200933ECEC9882BC13F579B1AF87F152E9B6.2709.1140711961.304",
        "C_D6F2F12C99D3A516A37E183CEF4661077FFC028EE410AEFC9F86E185408CC7F7",
        "CD_46AA6DB53AC46BAA33853977D7E4DA4D42054013D01A0E1C7E44D0593EAD8697.1982.947412126.1813",
        "IL_DFE6A388A67D9175B8453626489F03C7539BD9B4806EEA13F197BA8A7C0F3501.2705.887989436.295",
        "MSFT_NetConSecRuleFilters",
        "The type of specification.",
        "HeapHandle",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.299.2995513597.180",
        "C_E4389B7DFAC67045496FC6BA0DCBD556D208EB12E13B0F5E46DDC376CFE35456",
        "R_C1CA483C157F02AF7D493E6F9A8A344443A36F04DD678122A8FC29432F5CE01B.1019.3767831667.524",
        "CD_31A0633F8FCEDD0E962DDA1E15C22C2730E3E3CB506260E11EB192F6109C813B.2731.4226085543.707",
        "C_AA429B70C768974D13BFCC6D4D962AE6C7D2E46A2B24E5B0ABDECE10F90FE8E6",
        "Heap Event",
        "C_73DBE827D23692912B7FB3F1364551B060463FC365FED71D77258CE9C6B8DC8E",
        "I_C2E2D7F294A39E950FCB0FE91EB41D6C66630273B2EF4990C97F60DB582F2E17.1480.3999132597.278",
        "IL_66796251E5D0B06708BBA28B2F0C8A38E56DC5083BFF260568BAD57F3AAC7FBA.311.2942916013.249",
        "CD_76A66A93A4AAAAB54C1788714735D6D3CA06D43FDA4D5185F019B0F00C9DB5B7.2646.2721538908.994",
        "R_513CDE95079518F112965AA406F17722C0A89A191927E09A325D3D3202159331",
        "D_7AFC0D42052E9C59679F25978A7C6BB4EBBFFCAAA7E1A1214D251ACD02FCFF67.121.3607088286.637",
        "I_F0FBC16C69AF599D2D58F1CB4D2AEBE096BA8515F4CDDCD6273020AD067D8DA6.266.4157939198.329",
        "CD_9AB53806E88665C047824D5369B271C53B233BBEAC7C15BE3BA9BD214E527500.201.4204543249.413",
        "CD_EAA4CBEB7BB9CF88FDD43FED82BEACA99806984E20E3D7B69232FF5F6CB9EE6E.308.1.14762",
        "CD_B4744AE091F96C1897CB0086813E1AABE89C9AB276818B172EDE2A19A9884429.2015.3890779149.749",
        "I_EBAEEA562CCAE5F44F8DC529A43985A152EC238D3F950BE794ACAB0A20B82979.2457.4150248673.343",
        "CD_52C78D6E955B575AC3A033FD1685CC8CDC0EBD4484E5394917410F9F0A706A02.1481.603498607.1159",
        "SEL_EVENT_DATA2 is valid",
        "IL_26A8A21DF89D1FC7CB08CD7898DEF4B5BF45DA1A28ABDE9B3244E0539D59DEDE.1057.4183458163.344",
        " $(,048<@D",
        "C_D69FC867849192EF796EE1B806DE90914F0120B94B59D00FF9D8DE94BF138B71",
        "R_7C7BE22E26E7943C4C05C0504DB7308CF31E26BAB4083067D2157633692276F0.1094.3451209209.524",
        "CD_BC649CD83C8F14D3E6DEEAA14569857F0C4AE98362B932D81B414999E7D27C7E.2579.1218979060.949",
        "CD_4F0D368317167225ACF46119D014C5D4BCCDAE790A6109A6768873BB8F046D1F.2730.3201527894.474",
        "CD_98BA660AC8B20E674D946E0C26E1AD857F0FAAA173B07BD99EBA86E0CA0F32BE.1603.3424236683.532",
        "CD_9BC3125C48B891C7E277E0D05B1E9C0901D367808E2E9E9F7838AC0E2BC60E79.2569.1418777269.1182",
        "IL_5037D6F4133DAB53C25E8A10B85433D457D537E5B935A718B1A4E5B097F30338.2681.1815089368.289",
        "CR_A197A2E8E346C5375E5D0AF295B78A2E735B718CFC86D2835DC277AE3619AAD8",
        "C_D64B12C2A619E8EC9F45DCE9E49A35E068B0A85B0C1FC30DB6BB343CD56AC3E2",
        "CD_25A225BFD7C0706940B21958E1B4E7879B81C1069B2DA72D3945C2F2A653CB92.27.69741701.381",
        "CD_DA7E5D48CCF57DA0E153FC3004D659CD585527407546236ECDE7F19D7B368F18.1607.2497321510.242",
        "B9D454B9AD1D8788.2553.785386092.1600",
        "I_C1C40713DDC45BF71014CA6D7A2A491ECC3F99EAD27649CD67DE3F71229B3F8A.2682.3066992463.276",
        "MSFT_StorageFaultDomain",
        "C_8FA4173A459EDAB8F1A63B50B888353A7C8DFBD39D8F768991AB822007F927D7",
        "B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D",
        "CD_F29100A757BDE75968386F1F8F50FAF18D4793B63DC12FB4378C18D9CD66C352.150.3653319902.766",
        "CD_8BA1D21E61960B29D0AFE87B07C528E316D314C9CDB4E6E4157971C5502F0ED5.1077.638627969.514",
        "CD_8C387D212D52C17AB84A1800318321139D190C8ACE84173AF79A5939FE8790CA.1930.760267666.1051",
        "CD_BD82A3E4DAE96B9D019F35F334395312B224B9780EE811EA604360572C2D700F.2674.1182941561.1018",
        "IL_1AA676A49D2A60A89B79F842EECCF355EAA840887A4724B8578C05B96146D815.2701.3388349169.281",
        "CD_65C6883936BD0C78C8E38FB56AABC2614EA93FF45C056006891AF273AC6F4539.30.3170496430.557",
        "C_18686E3CD01034A71EAEDBED6317C57C7A9D924BB945F91B623FAD3FEFC4769A",
        "CD_3035B16D02866D7EE030442132A18B7ACF25E1EBBE385D31EBEA6DA0AB2F86A6.185.2079032537.4859",
        "C_3BDBA442E8DE5FD0C97625EBC2E671BAA7CA52B571B7C8E96AB3E76C4549E8EE",
        "CD_0E19745358152D7DD268B75D5DE0D069A29391FEEFDC9B8C9DAEC7711CB61175.2491.1.96488",
        "CD_DD19013C5DC1E320E81019FC349982C55E1E96FA47B8CD4B261815CDCB293CAE.1104.4171623186.511",
        "CR_3E214E33D7A5FDE14F0AA348BFED5EB5C77FBA80E64B04793EFEA1E92F43C436",
        "CD_838E75DF6AB0A59C9F2477F1CA99D3050323945F5A9DCAAC9E77A5F334C030A9.2745.3661409314.355",
        "C_048677B41FA69AF76F1CB4289718568B698E2DCC291B7279BB518C1233867D46",
        "IL_B43F47F27EEE9892C6AC065955336277983793E895D5252CDDBE64FE57879FB6.2719.4261657656.272",
        "I_91BCAA00718FEE84EBED3735D23D6F137B07B06186884A8FC4C5DFB9797BF200.2727.657059517.282",
        "CD_A5405992D9D674E902DFC53B45CA5EA7030AC30531ACB3BF91D0DF7BC783E1A4.260.528583635.523",
        "R_D3D9AD4EEA68F247387A3382CDDB511231B3F0CD42DCD149C21DE4F1C6DA4800.1020.1523007574.528",
        "CD_4E6C5CF7BDDF4BABEF6FBAFC3D47828429231B287510F99ACF0B237A0FB44F50.285.1390337089.1400",
        "CR_81CBCA9C0215B59E860943652530299E5FB0DE537CE83929081B409741C1FE81",
        "0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109",
        "I_0A0B72434FEE1EC47128F3056CC43CD334DD680A327DD193AC78C1B5F164228E.2686.1098937132.270",
        "SDBUS_DEBUG_TRANSFER",
        "CD_BE7B96C50A5D954A89D26DEB913105A5F4A1453B9058D1ED2B066A1ED47BC2A6.215.2425501629.1147",
        "CD_E1EC1F810E645784CE7FF2576513F22655E0F40D5A6228BFA202B5A3E43B82F5.2039.2613036835.1567",
        "CD_C02C41AB4846F97931E5D01FBF12A4A1A5B3CB06D088BD1C51C3165A032FC9C8.271.919455921.639",
        "IL_7B4638F9968ED4EE682DAB9020772C3FDE0994A1C6BB9B4467CEB158F71815EB.2685.3522640684.288",
        "C_7F586BA17943C172DA17564383FF9D3B7933EA9BA65A58BF1162084BFFFFF070",
        "IL_D084275BA14EAAA6BF00AE1A622764D7189EC037B66EE266070541F581D56ECF.2714.1988486237.290",
        "CD_4E6B2407BBFA735CD558FA956E39FDDAEBB739747AD4109DB6B2E67ADBD0148A.36.1502717881.499",
        "CD_EAA85E0EF5AB3ED5507588B38184431B1FB4FB2BA84FC2208EE7F5D77DBBCFE4.1923.1269846062.312",
        "IL_FA0D7695DF410841BA6041B3B0FFB22EB0F08380226BCD65BE4061E39ACFEF56.2713.1781841004.273",
        "I_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258.1164.198150230.271",
        "IL_0512996E43BF9CC18C2AE4A048B8AED9C76AE8C2CA7091210CFFEC0752609CAA.2764.4120604444.278",
        "CD_328F09EA94A11C49CE9879973AEFE371583535ABF3A24603CDCD08371B636C41.41.606759318.932",
        "C_B860282B4A1153A407ECADB9A68A7564DFACE81902C1C29A9243B46F5679275A",
        "I_C711AE1A185A8206CE43A6B193260E5C46D4B4C1CB3BA19F666F69A96A3D2442.2695.2230254215.266",
        "C_636F2930A3A300552721C32DC639647A3A271120464C74988D9ACA2C3BC1310F",
        "CD_C793B9525D878D9706E959E8F468E81449F6D48F127A802D380F8F7D8B8795DB.1517.1.9436",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.61.788629240.218",
        "CD_581FDBF3A3E51D753168374466B7C40E39F607E7397DAAFA13C9AC84F1F3CEA3.2419.2356844115.685",
        "CD_192EEDE3F8F53F2102E9BC3A436EA7C6CFC3029464C4B4AC0F5C2AE05D9A178E.1560.3391053076.433",
        "IL_A4024847100E6E0DB378BF6FF6D5F068F89EA10E15580AF3CCFD8C02632CC6C5.2764.264922140.289",
        "MSRedbook_Performance",
        "I_692322EFC1B6B89205358C4F6AF7F4A2541CFD1AD38DEB3DAD18BED3DF54D064.2707.3446467184.300",
        "C_C32DF9F947B29FF4184A098E1939B4BC6F452D2B88C38983D24946818DE6DD9B",
        "CD_700A223C2BE9D4D6498C555306C3D6D2A20F7ED7C0635EDD45F157ECA54B627F.1667.4070860710.232",
        "C_D6AC1874BCD5D63CA7042355D364CE2F60097897614B47C510C64F3F54102BD1",
        "IL_21E85A20CC15E835CB6487F54DC9B230DDD677D1A3F958EEE3ACBA0DE0846B34.1500.370985859.312",
        "CD_896B6F9A9E07C666B49D000879A54E67F9CE0EAF2B8B7EF7BCA31E7303EC222A.2033.897841472.2646",
        "10.0.19041.1",
        "CD_FA5F0CACE5010B22488E1F75B605E9518F7EAD5CC9CA9A11556B5DD22F5A4687.1562.2471414630.425",
        "CD_18686E3CD01034A71EAEDBED6317C57C7A9D924BB945F91B623FAD3FEFC4769A.2580.3516284724.1041",
        "CD_01938EB24A6B33B65014DBACDE3C7CA2C2E7C61637395768C92D80CCEFF91F8C.1807.4084352590.282",
        "CD_FE4BE07CAB11C06CEFEEBE3FCFBA7662CCA6F6ACE9DF4D17739E2ECA022C4B39.2583.3921296411.501",
        "IL_74D0E3B185A1A6E8396A8FA36679B24960202A5ACE032585B2B78263AAE821ED.2720.3580441557.280",
        "IL_44FC420FF870F1363458948DA0E95607C9F5B20E67E59C08685D763153B1E069.2702.1558396204.287",
        "CD_DA629F0FADBF1E9D6C65713F31978C9EA30680E880B4ED8EDE3DC7BD5AFDAA23.1617.1615492181.356",
        "IL_251DF572EC65B42D6CE95DB4C839FD6728CEC6633EF525F0041081BB60681183.2736.1295513317.284",
        "I_BCDF0AE7DC27FAFED7F3086084877E579AF9D73C546674217B8E86B2518960DB.276.1212514244.319",
        "CD_5842378308FCA74CB08DA5049999AFEBED270A8D2947073DE67DDE6B41DAEDFB.1720.1.77846",
        "C_73560CA166D1D6DC199E43C7D578F3B7069BB5A584E5CB8D107C4AC9E5EE5ACC",
        "PAL I",
        "CIM::IPsecPolicy",
        "C_7E6FBE4200B70FD4C3F5F4E9556E66896E2662AAD9658177CBB7E9E4C038BD05",
        "IL_2FD8DCDD9272028411CDB92D628888781F863A853FD409FF5C59AF68D5452AC6.986.1.101105",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1097.4009903032.180",
        "CD_3863CF198183B50B73BF68A52390640EB8E4B2490D653E0A1079EFA26ABECE5A.1382.4056929723.2222",
        "C_F715F257680073980D57BDC6098766291B8759BE6F3A397C65FC91A1518FCADC",
        "CD_983B4451C80CBF8C28AA7D3AE44B31F386CD9D49DCF52E720114DECC8C984041.2527.534896237.506",
        "CD_3C12FDF66EDCAF83C238DAE5C9D20887F76A735A1575586292CCB828F70A0785.1932.3532348397.888",
        "I_DF1D72ECC9268213FCB43A06A38DBF2A7452DFF83D9A2AF1D89F3CECA76D4AF1.11.3930159484.246",
        "CR_743FCBD526F43633FF2ABB29F490DAD5EEAEDE4C488F8D224708D0DF7EEDE463",
        "CD_610AB796758AF91BAFAAC5773CA30FA987962CB5B589ABCAD3D6EAA7F97EA9EE.1219.3259720150.353",
        "CR_0454DDDA9AB999B5E05A2F468BA888F0D0794E6BA1EBDCCF2A4463EC03258CC6",
        "IL_171DF71ABD7C6A7DF03D4AFA73A2CE1BA658B66016A9DF4DAB148F781BE2851A.1019.1903693435.259",
        "IL_718C99B273A0BA1868DBCE777D9B4FCBFDBFB469BAAF23FD16C99C7AA1407471.2718.2921364966.280",
        "IL_BECAB6ACE8248E8415C252795A06585542E1A91EBDE67EB39D02A7C78C2398C2.2674.3732393807.272",
        "CD_9E9C09D30F7B6C1C4DDFBE795ADB6A836F2310F7AF7CD6B6BA1E05BFB3CEFE19.1151.2445984221.1676",
        "IL_ECBB5DCFAEF649E7871AAF278B7C454993F7F9BC3F459995E3BDF5CAAC6E9EC5.2699.2052189125.278",
        "IL_BCE3F39440A90A37033DB80DD4DDFC3A46F39D1DD801FB0A0EC812E07BE4A62B.2726.3123698903.285",
        "CD_AE9C53160D7B3434C4E52312393F9F5DDEF1A08E93BC409447AB0DDF8F479C75.276.812518391.270",
        "CD_20BDCD5FC76289684890138F1E0F84424ECAE89F8B991F35AE342CA8A7F45BC7.1750.972326840.406",
        "C_AFF439DA68A5DEA8558ACE689A32DD26F12C2D443C918BA2D3EF3B42461D8D30",
        "CD_D77BDD0DD4F6BB62BC92DBF5720E7FCA0369F287A12A85BAA24D4BD2A63029F3.2589.1503577968.1754",
        "C_3BC513ECDB7610139D47A64B522D78B92D64F0325749C638433540275FAC912C",
        "CD_5004C352A375179C0A302A2B62DC334A1826F55A19CBE1D52AE237EFD9FA481C.2426.356044105.314",
        "CD_5B81692050F83AFBC70426A27EC09C2345CAC4183BA0529AB3CFCE0E87409447.216.1655439185.1028",
        "r.sys[PROCESSORWMI]",
        "CD_28B64F0A4A4B406BEF1C2ABA6655968C837E1E9DA0BC417F80E2473D3793AF08.1802.2842316959.348",
        "969FCED14AD9320DB3AC26B18FCC6D3C66F2AAA7AB1D63250287",
        "CD_8236493D7B4C97328F05E9610B58340A9B36DA2FAD39FFAA641A6E8D9062FAF7.1149.984498510.664",
        "CD_05411DB4575F606BDA4BDD0D50A031BA32BBE01F306EE4E3DFF67BDBC2325F30.2653.1172207236.593",
        "C_FFEB2E6E5C2BB60DF1E88218FF16E68C6AFD2FB957B5DD1907DD42EDC6D70FE0",
        "CD_6E829D6C833E13BD25C214813BBF6AF82F4C3B96923B74C3959F33364ED6E372.2613.4268111884.358",
        "New Processor Performance States Event",
        "CD_0D9683B316E22A1A30127D06C57766F844EEB6AAA1805E5281206E24CF5C1BAE.1960.1966522443.3536",
        "CD_3AA9C8A0942F537FDAE95E548CCBAD1AD1FFA8F4AD1AFE2EE57031F74E67B391.1815.1.37727",
        "CD_7450B933028ED3A9668E73BC07A8325B939DC7781D6560E2446E75795DDC2C3E.1534.4252095844.5117",
        "C_AEFF5B2749710AC600DA248017E9FF1C4A4F611F56BA7915B592C48555DDA449",
        "CD_30756419C75AD9071C6B26EFDC29E973F64157E9E9415823E0E0D4E3B981BC76.1019.1161092222.212",
        "CD_2A7832DB3183EDBB66AAA2667E80040F6CA8257F8AE4FF9540273269C8637D7D.1777.3342449824.263",
        "IL_6CEF3B0B6A5FC6034444C855DADDD54742BC48337C8105B7303D4A8127EA5C1C.2707.2639301223.291",
        "C_85CB80AC924C13479AAB58CFBF7E3FC997F8734D48478CD2ADF5E53CDFF167FE",
        "C_566A3F0A3752D08CE0ADC81B0285E070B30778837B6AE3D337DCE7469AD2C7FD",
        "C_4FE92FDF8DB55FE415CF68F8C9E8D6F30FCA3696A2361C3C56C015347302AEB5",
        "OtherEnabledState",
        "R_F38B416C06E01116C4C7FDB33809E7349A9BD3A1DDD8A08F3E2B66387C9FA2E2.1356.1637245121.590",
        "CD_D36EEB4FA019E601112818DDC069B750B95BF09F1ACA992BF14D32259D2DE75F.2750.3798156419.783",
        "CD_5243094142BFF50E230A225F471ECAE0DCF0FC00D9021F08F10118DC4E9AD84C.2757.2566142526.1048",
        "CD_05626F557F4AFBF612C90AF1E2E15959B61A760539882427584EEF68B7C3ED90.1346.2691407796.648",
        "CD_78FAA10AEF4BD66496AC972E3E24B846C0EB9855D0D6515D7EED8628B54F3A1B.1635.1554785228.1077",
        "CD_EFC301AD50CF7400DE3E25D8E0D5A8D1B7C96DA2B66F07663C39FE11E2C00C70.1548.695660703.422",
        "CR_00637C6FCCC93CC75F9D988B459EA167A80BFD4782DA6DB5BC1F63F5A3F73F9B",
        "R_17DAE20D4CEDE5BDBBCB715230E9EAA382646226BBD279BAD1D1846E4BB31986.1806.3205233709.584",
        "C_4548ABC60D8D754BA5CDF5BF3F98D090EE4DF751AB5940B6E9A6298C3D9C3BAA",
        "CD_E241A982292C9628611468FB40BE60D4CC1B723333EE25A7584E871FE9DA753E.2012.1782097772.780",
        "KernelPerfStates",
        "R_5EFA8200B66FDF8412B207A31EF574CC65A46F4D9553F2EEF4A1E7CCC0C6B3A4.1067.1926084219.520",
        "I_74C70C3A9E087645E74FFBEF480E44AA7ED90FBA65EE76D8B12F0BCACBA1B6B0.2682.1579051653.276",
        "C_615767763A5CC6EE32825268D0AB70A3CE397F1DFB8C12D636B388A7C439E3E8",
        "The organization that defines this specification. ",
        "VpnConnectionTrigger",
        "IL_1F5434A1CF8BCF8A287442EA894870369F7D474E382A3F1E86E688DDB3D61151.2668.405656413.271",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.1382.1134244066.188",
        "CD_726C471F495DE5164273B09462E1D1310249850F9D5676CBAAD38DB3AD194E85.1579.3447168597.720",
        "CD_A9AE64C03C11270991C8BCE26EBE3DD0FF3F841C3C80D3A28DC949EF9B62D60B.214.1503244575.262",
        "CD_2A9212E5C5A3E7B6904A9AD5755292499E2868895335A7FB104CA7C39F4970DA.143.4087890659.681",
        "I_03B4753F57CF75C1C468EE3E07EE4FDCDC5B9D81BA690F1B809DC31E0E3BC8A0.1016.2228059653.333",
        " $(,0",
        "I_0A9C692AFE67AD32626E68B31C73B073673CF431D0AE38A2B95919B7B7CA46B3.2713.2263682030.281",
        "CD_C415F4D1DAE81CB1FFC16E6953FF6107B9F915EFA0AC36B2387428914D707A66.2734.3014023666.1448",
        "CR_1B0301F62502D60F6575CB09308C7A3739069A23886569D046BCB5BF22A5D75E",
        "C_CDB4D0999BBE2F5F01BF7E500A934D82190F379CD1604609DAB79E05390DCEF9",
        "9r{f!",
        "CD_7C0E6300E0AF006C7C643E31F66D95CE8CCD0F68CEDF272CAF8092BD312FFC2C.2618.1243497797.529",
        "C_F9BAC6F2EAA58B85FB2300B8E75BAC74D38922DCCCF4A9D2678AE07E068E0137",
        "I_9EAEFDB09214473EA9656E8585880B718CEBABEF51CDA98D5AA27614E2783AFD.2728.975735250.280",
        "CD_5C27039E354082F6D74DB696E9D9D92527C2AD3E6EB6A0FA5A0F25C76E0296BA.1597.965827324.490",
        "NetworkServiceHost",
        "IL_5A00701EFB2324344FA20EE48FE72B8968F93400398750840855A1991E0FC83D.2690.1279969794.271",
        "same System Name Key. The NameFormat property identifies how the System name was generated, using the subclass' heuristic.",
        "CD_E37269864F3637B328FA737B6C8E3288A3E8993FA114D0276C743CCFAFDD80C2.1602.2002470063.498",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1352.1576158592.180",
        "I_867009D1FACF80A1E2C919A8EEB83F6A5BB16EF95BACD064E526589732F91844.1148.214367202.283",
        "CD_86E4864B1CF6600CE4B6DDC1904F1615B807835856FD99C1037F22B392220711.2542.1046128184.534",
        "CD_C5695436582346972D28A3A00D6B225B8193B828EFE5B198E49A8EAC5B05CE91.1341.1504160247.1967",
        "C_3777205E8B20487F970347DB3B54C0C1CE84371ABD4BCBDB57E68DB30949BA61",
        "I_D1857D12098B5C625BCFA751A4B4958D84CC97DD87FF80C7CE3DAB199239E008.2695.1112744236.266",
        "CD_15DD3B0DCF2819EDB87C4363412C3F99792BF1AFEF4BDC92585A3BCD2CD95F12.157.1157294655.574",
        "OfflineFilesTransitionFlagInteractive",
        "KernelPerfState",
        "C_6F71654DC948E1EB11B435B2742F01766B113983E761ED75069E656F44119002",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1479.3551867366.180",
        "C_5AF713ADDAAF9A8D160542D04F058A0B9E06750B837D696EC62B4348799A72F1",
        "I_CA69AE24721720CB3544122DBD7BB4A934D5B4B83971AA6FB9AED80BFA8CEFEA.2706.142519644.289",
        "CD_89B3BC9F91AF19FD95569CEC4AE8264DCAA2B513E756CCAD927560FA5C73CDE5.111.777973093.1108",
        "CR_AA8DD13710C6232D550EA0B5DE30AF5E61E2B29E47FB806D9004BA3511197EBD",
        "I_306695955B1D8DEFE520389976AF6DB13DB98AD144F0B7FA28259D9EBFAD6755.2717.3650780747.291",
        "R_9AA05959F2D6F6E2DA1C86CB49EB3AAEB9B2A949B6BC67BB11D0F5EEA9CBA633",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2088.613972127.368",
        "R_0D7451EEA0088D16D6131132974E7291CE514FD636F5E279488B0F03E91EC12A.295.3273286089.538",
        "C_7DB8FCF5A62EB938976237647188940E46D7DB299B4C92C573081357C1E79365",
        "IL_11D7A97FBDCD50D87E0E138CFF9AA45DE71FE994A925D0CA23980E1BC61DBBFD.1014.433114907.325",
        "CD_950B982CC6F803B6E071200389755F5BC713572EAEDAD6AD08F5A06B9E237444.1148.2518851921.868",
        "C_DCDC57D76E08877538B607842F11A1CC74735617E466D88612A67528A11564CE",
        "CD_7EC6FF58E9EEF4EDC93B5F895A41B1B0DEC2BDC5260802227931619EE6182F7A.2423.4015658206.357",
        "Lost Communication",
        "CI_2C1FABC8728F9E076F6727DBB7BA1358C4F010407356DEB983BF769E41D5848D",
        "WHEAErrorInjectionMethods",
        "I_AC0D055AE7600C2FC6AB7B3493AB0844B90905ABE7702F6A368CE617E7383919.42.4233334980.318",
        "CD_D3CDA97FEF298BE8B5C29382D62A09C47E793CC57029F401B975F6F8DA62C223.2586.508601094.226",
        "CD_5ADA758B11BB1BEBE55E93637EF1E2FD07B1E1906989C07106D282B72DAECDAE.1756.1434647454.865",
        "CD_C4C4AC3CDD7A9E38A340BB56FE91B2D1BB13CEAA14A840B9C15B1953B57A1EE9.111.1166576760.1580",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1131.2861187749.180",
        "C_964F20DA1C400CE151EA8EC979C4A3C348C750A3CA149AFEC7BCCA722B6C159B",
        "CD_DB6D3B84420B8B2E5B0952A4263B4AAE435874E5D752A7B6377F6681799057A9.282.2137173876.806",
        "C_E607285A4ED90FCDEBE9F9ABDFA83D91A50ECBC0733B05602257ABFD57D58CA8",
        "AadDeviceId",
        "CD_9E7A3EDE33ECA9119BCEA76C74DC7F82F81BD50C5633DBA89810B055F180A2DE.55.1.9780",
        "Number of transmitted fragments",
        "CD_00CB5505B362BFEF8A78ADC9829BC548EC024B6682159D697B0077E15B2E844C.2649.1631679823.407",
        "IL_952DA8CA3C67BDAB198563E740FB3F1EC6F94F098268FD22E949535B3D464BAE.2701.2430452032.286",
        "IL_292966F6674F4A3E9EB6641260640C2C721A91045ABE4947920347839B068269.2691.2413738261.273",
        "C_69A1F2516C00D1C2619B3BF158EB32BB01A9128EAFB2BC6528F8EF8668287B67",
        "IR_8B109770B70CC6D7972AE94E395D34EF4AF2D27D834986AE7388EC1225644A3F",
        "C_208AE2247013C3372A171DBD4988D1DBD87A3518363B9A8CB1FE166BE1D06432",
        "CR_5CF48B4594AF5A29D8F38D01C51E1EBAB43B90EB9606F532D289B128EB56580D",
        "C_29DECD57CEAC20C8FBE48C1CEA8F70E0F53A065C3A111386C70723311B9A2585",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2136.1388182681.368",
        "CD_A459BA7CCFCB88B641F49560CF44922CCC34D85A3AA65521C8FDAC7F1BCEA69E.1346.2768826333.300",
        "CD_715ED4FE059236E0D9FC94E624645193F9F27AD440D64189FA0681CA9A717570.2550.3266367992.1519",
        "CD_E66D2A11AD2317154A9C2C61CC140BA5F198CC545A25F24736AE23D74E16B49B.111.1049791741.2095",
        "IL_0AE842411B3B68BDB60FB4610360E1ECD2D583F7968316F79131DB25BF102F63.10.912849262.189",
        "KillTimeout",
        "CD_7BD86541C4D37094DD12C29DFB358834E34ADB28AD42E60E36A946EB5619F833.198.3366738379.761",
        "-Wednesday",
        "C_E2929E24A4D3F33074BBFC9EB2E285BE087B76057F553B22FB5CA19B172B3C4A",
        "CD_D2A9871B8DC5FB594486947C60152A87A3C7A83CB555AD2675BAA5E80330CBB8.2542.794246729.532",
        "C_C35EEF60ECBADD973E5F52F74AA78C6D4DA6ECDB10115F29664F3A01E3A5EF73",
        "CD_50E2EF079B9FBAAF9D94FB8FDAA61134DC1E148B80881B48AAD04236871436C0.1808.760056602.341",
        "OwningEntity",
        "CD_94B88A78767EBA5CE84C8290634E59CF138F89C614389740E3EA6521391C28D8.315.2719446082.217",
        "IR_9C256CE37E6F9177BC0EC95344373747E0112D20D664373933986EE480BE67C9",
        "CD_5CA1CCC1ADD6EDD53D29BD2FBA674BFE0E34491E54014BEBC938A889E571EE4F.1599.3100544173.2817",
        ",0( LHh",
        "I_B4EF83B2170E86900805291C7D4A439621A7B437105B7572FE6C744F6B8E13C7.134.1063702033.191",
        "C_717B9447F64FF1DDD9BE96845CFF451CD699E26415487F373586ABC0F3E7F533",
        "IL_B890A69DD6A6A1793A78448FF5EF434D2AB04D3D34D2D1B12E9A02E877CA8847.2736.3705285418.294",
        "C_DF545E8A447AE67DAD82438E1F3562DF5CD3473F59D562B7C0DB49601F84DD81",
        "CD_755C3664114AA9097DEA3F0332A59D1FE1A4668C8001C4E97937639305CB9174.2041.928460865.228",
        "I_7CA90AB03272D8712CFB06F7B53C144678AB433CB8CAC2687EB0490FF64EFC82.2689.4068399420.274",
        "CD_47CBD249A2C567357686E5ED6091D88133AC6ACBBE7BC216472A737EDFCF1867.2743.4260985341.327",
        "R_708C32C766D9971484B0E64ECC9BA26A9738A3C69831CA885AADB8A4B125BF1A",
        "CD_F071A22EE25478DF80A205153198A6FC12F84A9E6BFE53B8E5DFD1E7E2ED2B8E.190.564140805.688",
        "C_A58CC04E1962AAA1290354C8B0360D7B0924AB99741E39FF4F70A7E4E73660A3",
        "IL_2C3390DA0D8113E7B067C5F12CC8E1742CA924FE4948190A81257D1A9CF5BDEB.2512.3648018610.256",
        "IL_C1441FB12D4A7F475AFE53ECDA8940162CEABEA79A209975A22998A7E3661346.2677.510966157.276",
        "IL_4BA054279923D49F2BDEE3454C6ECB5CE0D731D7C27E30A6E4BE9348CD914BDC.2723.2234867271.287",
        "CD_FCBAF5A1255D45B1176570C0B63AA60199749700C79A11D5811D54A83A1F4EFD.0.1862998048.89",
        "C_9E201978C09DFBC722894D8CAC5CC2344D30A294DD7D8D49AF08F959D13F3919",
        "I_4F1213BC8D143D2FDF9FE58A5222244D36D58B8C40C030A2FC371FF1812DCFEA.2685.3502845615.264",
        "CD_BA4D1700564283EB37D303248DBE2CD56556DF9361D876FD31FF63259F460B95.2639.1151654603.233",
        "value",
        "CD_D769628D5FBDC4BA586DBAD54F9BBC7939E2EAE50970F6EE1F1C2EEC6A00F545.1339.1068024239.655",
        "\"899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6",
        "R_E3C7967C97A946463CB89C85CA1D74F3DAB68F3859ED864589727DCF93BB4954.2458.3139891486.558",
        "CD_ADD63404B54D72293E84E37338B556310E9392076D5D8A2C41D64BECC71833D5.2618.609225266.363",
        "CD_8688B6B3A5AFA46698CC5C2A2A938F01175B6D9F4A0E5E74F0C3AA6D73897983.2033.3138347932.239",
        "R_F29100A757BDE75968386F1F8F50FAF18D4793B63DC12FB4378C18D9CD66C352",
        "I_CA172AD660395B7E8318076D3ABFB2D903E8954CFE0714462B3683ACA1CE8C8B.2699.2873230368.279",
        " a a free-form string providing a description of the specification type if 1, \"Other\" is specified for the SpecificationType.",
        "I_B25C862B29E8B024B3C05FB2CE86F6AD358524C7F69C212F2336553D031C6BEA.2703.1555011938.290",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2469.3679196830.180",
        "I_594B1F2AE7ABF41F7A9A2DFF46DF2A3F493C3DA60820236CE3DD2D380FEC2131.2728.4156462290.298",
        "C_FBB8D0961BEF2086CA175772D30289C94E1C669B3417C75F77ECA2958634DDB1",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2426.34478244.180",
        "C_E6FA42319C7B1B6AA3CE56D2345400C98AA73905B257B46F3B0DAFEC4D0960DE",
        "IL_B36809B464D5F3386AC2DAC9925407E2C31833817AD3999276882F13E1D8EA34.2713.377369837.278",
        "PTX\\`dh",
        "CD_A82DF9B10154EC9C0F8A403786D7520B52229D45691E2690C3B352DE9F05F32F.123.696515258.762",
        "I_9C4A19B9686F4B6815C3B59681E099E6E6E891B5358293A9D7740A3DFD5FA2FD.2722.3119460678.279",
        "CD_BC906ACD0D7D2D84252D25E6E9667F70E36490E80DB20471991B052FEE0CF9C6.2490.1851486125.765",
        "I_3E78A37E1DE70357C353A15D6BBB8A17A1D31F8D501ED8F1C3EB8104F5B04F97.293.3446303942.336",
        "CD_12471D6936B91DC2838F052A66838F273DE5045F0CB1852A0C46455436BAB9A5.2613.3532380003.370",
        "CD_961B71EE3CEF77853FD06FD1FD078D670615B8B606936AC4407F5BADB29E35F4.19.3807297188.2122",
        "IL_27FAEA5F317A7D777DA2A8EBCBC3C42776D2CE02DCD68C27018D6EFB15E2A7CD.2485.3949131150.312",
        "IL_432480F6D45DC2F1B60F7C58CFC2746FD13AA4A9D190175266A50C4EF19AC5AE.2718.3719290733.284",
        "CD_7A2E82FAA3D7445BB721477AEF5A828AA728D419801621CF35B28E55DA9D6FA6.2111.3244341525.523",
        "C_BBE65A7BA5F833323A35A0DEE7CF2A341947D4A0E5929D829D9B5FE016854439",
        "CR_403C7DAFD38411FBB7FFA51AD2D0CC5E3462A61D34EA60E279877DCCDC222D62",
        "CD_79F50ECB454C073E4E5CB137ED1F04F729BBE896F53092F9F794786916DFD292.2120.396358936.197",
        "IL_EF244F687390AAEB7DB2AB5AEE1C214A0915E4E8F5494159E34EEB8CED952484.2676.3183648974.271",
        "40.670",
        "CD_FD4E702E602A432E7AB9CE0A91059DB9571223DB712493258C6527C16FC78E38.2151.745505029.2217",
        "C_FEA174838505F017ED6B4301AAC1DD5D141215A4B6A1F43D4092C1E5AC1A3F37",
        "CD_33D246EB3B57E6928B893AD6FD55D978AB60895C15739A40D6B9E85119ED3D71.271.1827179351.900",
        "CD_8D438C565310E95809DBB3581FC76968BAB1801A4D1A32B498FF8D19BC26268D.1066.634289264.1836",
        "CD_22F378A2DB3FAA5D62FAF5FD5413472AD1B5CCD6D24CF8D271819C462726461F.2541.4063492511.514",
        "IL_FFB3E5C121C009080CCC44132D146B4F5562664D372BA3DECB8C397705D66D57.2708.2176848505.299",
        "C_67CF5F3F28E7ABE836A4461A5D108F9C13EA619FEE56C694C0E215179A21B8BD",
        "I_29423EECC0C80705D26DECEE443B5A95FF519CCF4367CF59F0D98AF49CB87433.314.3567425932.185",
        "IL_94F160F3ED21BB5DCE57AEE09925DD63575475AA7648364FF69B4CD5E3623C1C.2685.2572373870.290",
        "Reserved Field #1",
        "C_0CB02E03FB8893004847A1CD792CD15C9298AEB5220B65C1D3CF55365F8EA8F7",
        "C_76B92FF8B3AA20856691665FB718428ADC2A8F423D381B9A75A40096351B6F0B",
        "CD_5401A055411F9811A09125DE8462BF6A4D708D8C770ADE3D670BFB9DAD21A39A.1671.3232368433.1542",
        "C_1BC80DB435E63BDB0D0BAE6F783293CFD13F829052965F211A74FB5B4AD97A7E",
        "CD_EE7C68BE0AEC70A0D69675F4FA4F9CD050786C34EDA61EA6A298C73F31955579.2586.534561438.582",
        "8<@DHL",
        "IL_5861426DB1898BF735B12294D300CB3D5001409210FEB3C59817A2905E79D070.2719.590350034.274",
        "CD_F21F1D740D9B9C099DB99FAEA668DEB9592F3D05BBF3FF4FE3FFDDCCFCCC136F.1797.2620300029.5729",
        "I_C6EA9ADB21355CF6DA787E0D8D62E59CF47237122DE78FA8959CE74E2782F2F8.2457.1605555535.286",
        "Reserved1",
        "CD_2CD004338C5F89774E29BF3E641901E611546726ACBFCA38A9243331558230A2.2653.817076890.351",
        "CR_8E3D9DE775219AEB41FA7BD5EDBE39725FD15E4E783E70F0941CCE144ABD6BC2",
        "NS_0634BEAAA6D47E6371999AD405E0DDAFDA3BDAB3659C4858F565936A4909981F\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_02E3B8C824FD0B9C15B4D49AB84CF02FA38E02CAF699DC3CBDCBB2D79F3025DF",
        "CD_2432A5ABBE7173FA98223D70B4EDFB312E0AA87F456103A25E4B4191AB55FA02.11.1426726394.429",
        "I_905AC885F74BE789C1EC49BB07D9B2A618272AFEE37A563E2D9BA0F9F4E471A2.2687.1668348355.275",
        "C_F403B2915B550FE9485A23E9B50313A3835CEBAF72BAEF73F6D6D65501009E73",
        "IL_6862AA7F28A1DA0045CFB4B4304FA3B74BF325E14536AFE24A3A6599D85385A7.2712.4137474706.274",
        "C_A41AFD053649038BED9397E93370DEB60FBFF83AF8C35F1EAF8651CFC8534ECC",
        "C_8004469B272AD6E985FD9425D404D1E20848FC64B0B2AD18655B397D61FAF076",
        "I_EBC8DC0D2750AD130E4002896E8811EB34F045DD11ED4983709CA779CA7216A3.2723.1628836079.283",
        "IL_000740EA84D41EC6F17A74DB9EFB14D73ADF4B9BF0ADC426A3AD1A6078CBE8BD.1014.2541166715.305",
        "C_941298FE57B01D7A1E5DB7CD7C2688B06D8CF556A38C47811E3130A1974EF1B2",
        "Write Warning",
        "CD_40CAFB87B847B798AC8F2045737A2A8390AC0416A38406D6F38EE740FBB0A4AC.118.1118109193.3787",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2120.2084505154.188",
        "CD_C20D4B021E0AFFB61E5D90A8AD1A949CBA948B6ED6C506FD3F623477DE2DDF5D.2005.1268988897.1809",
        "CR_E707FBA0E2CA2FF8FDB82241C8B012B9A1B221B3B69ACD6A3EDCF3E478558D31",
        "CD_053DD41219FAA16153F07241CEA1789B6627CF883354607B4109B4BE9101FD9E.259.387126323.218",
        "CD_A396892928B3FF941F2573928A77A9B90AEB4327426B7F78F3019287D0D5B645.1599.92285877.766",
        "C_322EE3E951FDC35EF603CAF3E0A44755B09A37065828E8B8EC325A76AC0E8399",
        "I_6EB0E9583B3959CAC2FCB91416803ECC387F3F7CBB83A3396F0D86C2536E6EDD.2685.92927305.285",
        "I_AE268A6877A99B443D27C599959944691C8E186CFF0A257B12F5EB4755E911AC.1014.1951867759.305",
        "C_99343CBC3477F7F6125FD1666914F7CFF746CB5EAD9718A0BED14E0D6EFE4BA8",
        "I_606461AE021084D79EC5104C6B879E035E0BC9D587CE3054DD396D0BFB41A220.2705.1001851986.291",
        "C_92B16BE3EA162B3DC2D69A2F6CE7F276615FBC3AE9F39D13877A5138357F03C7",
        "CD_2343A770CBD378E144650E17140F5ED4B60707DE8E9E1C4FF188F8883A2D6939.2466.4101242189.3666",
        "IL_B52768CEEA488AEA2A9ABB4A1228A6F91737E2049F5634EF0930693B14A51297.2717.2548925521.281",
        "PowerWmiProvider",
        "CD_9A0B9BE92E150DE97D04DFD1D25F032060FD23B9216A37E30A99CD1239F28BFE.1589.3982180263.411",
        "IL_4724DE891A942155AAD3F330DC136AF2D8AD61CEF085205FE12F5ADBA2427B39.2721.3778320842.278",
        "LocalPort",
        "C_B22DC701EAE1EC02C21FE6DE08DC67F37E32BCF7ACB4DDEC991FF5C8A52ABC75",
        "CD_76B92FF8B3AA20856691665FB718428ADC2A8F423D381B9A75A40096351B6F0B.1677.2015001673.1975",
        "IL_B9E934F1EFF572DCF875BC3D3E568C023415A57FE003BC4EDC3E1138647D45B5.2721.173576948.281",
        "CD_8573F18B680E18D492B49EE8BC7FF79407A6ACDC9E3F5D6FA5A838C0A5D01910.1191.3249247077.242",
        "I_D01BECD5C05784A27AAD3DA067E53F0054A6BCF795FB58C988BBD59A62281818.2687.2938392201.261",
        "C_12C03500A946A0656A43A704AB72A0B3B74537F420F79FAE09D0391B92275663",
        "Run Recovery Job",
        "CR_A5716A1111B0556A1A9C5C3C1CDFD55516DA831BF69A2D30A3293C34FED97FEB",
        "CR_2251F72D94ABB73C502EC482957E003D2DD81CFAA082A8A3F37E0FF9D44026FD",
        "I_0822E33CB82EA9D1AFCF3AD6B8F5AE0C5DCFEEDE9F0834D5028320803F824B9C.2679.4067240306.275",
        "C_5597C27E02FB661B960574B3983CF61BDCACD05B86FE6132CA337B45B00B38D7",
        "CD_698A32B2EFB9AF12EFCD0A0FC46109785288AB2107A556F691113D8AB3DB5783.32.3955290183.471",
        "C_094555A29C724CB99AD80F8257BA7ACBF3FB68F96D97E3E687892E1586B8D179",
        "R_6D1FE252E44FF3546ECC7BED576DC3967B39474BC0CE652BF027660AF117633A",
        "CR_55301A82B2B0B70CEFF12C2EDFE569786052F57B0A795053DBC7F37A225FA709",
        "CD_C670CDA7091E7B9873D41372745CD777C7D70F44F10BAF0BA969D4A23AC00A81.1779.648838927.274",
        "C_6B9E4EE8A6954AE9FF49C168C78A9585B0E76CB760D912EE50254A56C984BF8E",
        "CR_90EEF26AEE52AAEAA6C979CD586F5F478789816D2A5901B4B6A52181C962DFEE",
        "CD_D79D62511A51C80D6036FF60B20805B5B133C69E918F679C69D47C33516A36CA.2638.454845188.556",
        "CR_7F6515E2EBD9049AE896B25B99B1906533354EA0DB3289C03EFADA9D23B196C7",
        "C_1A3FB2187E23B82908958F340DD0F5EA4D8685478FCE0E52ADA73DFC114F95DA",
        "CD_9538FC3E850F71E31007FD8FC3E5ABC5EAB1DBB946651E9F96D53B48A625555B.1779.2531336812.287",
        "C_FB45B8D9320E818405D79801CDC499E87D50956AC9FA6D71D017C76991D657C0",
        "YG_!S$'*-03\\69VP<?Cbf",
        "R_A21DD98AF56DC0A7D21C24764DDA5A5F7A3EA65FE4980FAAB7F2035E4807972C",
        "_\\b5#P",
        "C_3D509F135C704C49652422902B33D6493BA6C4A55FC967E5BDCAA83CA4EBF452",
        "CD_4FD2270AA7CC321848B51530B7A77A9E39B5486B55CE0C09A2B597A1F1FCE1E6.1130.2034941254.1312",
        "IcmpRedirects",
        "I_1035B0F62EAAECC9C984E7834D0AB6A9928506852D8C840D14F9BAB2AAE4A68B.1539.3588731573.286",
        "CD_6198D0F4CDA2AB3092008D3A071FB13B82377D2BD575D673F896ED6BF29502E1.1921.2867367132.251",
        "CD_C1B039C6B15CB1268319C147066B90BAE1F5E0DA59EE23E8DFE59CEDEE8D5513.2570.635277629.218",
        "CD_9C52BC59A122CC7517413B34FA6839E69A7AE3C55A75FE6EBEADED4D113D421E.2624.2491819219.523",
        "CD_DA6435B5A6AFDE1EA49B0F1FA576B2FE264B6CCD6A9F163C86C6173386BDC535.115.1.13581",
        "48EBDD8253035A9F85F9EE08399887E5",
        "C_DEA3C51A2D748D7051B755F876B97982E816BE2DB267FB610562B715E38208B7",
        "SunOS",
        "I_9AADCFBEBD2729049C83114BED85D30D2725084DFCBD70BFC18E54B91E6865DF.1076.3805284346.338",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2426.2699293546.211",
        "locale",
        "IL_45569AA056ADC9524DBBD290145103D4DAFF08E0CDB98D574F6E8F827058279E.2505.3778392268.333",
        "C_103563D59E224884B92C8B7934BDD6592D64C63C0FEB52D1B636E2F48012EA04",
        "R_95C330C17D14564CA1EEB1DC2DFF820B2D8ABC77CEBD942070B5C3589AD8A70D.2461.1898999374.554",
        "CD_8DD4117F0A6CA8322CEA3B2EE2E937FF189016C7342D650B227DA4C96B557695.2031.2460019784.221",
        "The storage pool could not complete the operation because its configuration is read-only.",
        "C_1E95EB134BD1F60C54BD011E7F7F0F99F605256CE2A10E758B49368E488FD646",
        "KI_D6F23AC5CCBEB47ECCF7BF129523258879FDED9D282F558043FF80249A7ED596",
        "C_C36A2987673B0A8A22D355FDD7569B2BF02F15FD2AFC4839AAC98FA88389A98A",
        "CD_3BCF4C02D0A41EB523B8FF2DA4C32F97E022499682A6B17DB192BED984F9E902.2614.1918939527.376",
        "A54865F4",
        "CD_681F04C717B34C7842AFE82074DEC59FCDB97C166864F9245FF3327284F1AF2E.1958.2317676681.601",
        "R_1B1F12E77F513A1F34170D72EBDFB89B7AA666D5ABEE6CC04756D419F4107E74",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1479.2890374834.368",
        "R_01E49F2BC300B8406F535D199FFE723C66F3CBCD052B872FA9DADCCDBACAAF50",
        "CD_DF35CAA9032B2BC8E9E68BEFAD5091A66EF205D46DBC51F13F62EC987E8BBEAC.158.1553932017.283",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1050.2010874989.180",
        "CD_A58578087E737BC8DD57D102F9138F5ADF8AA5D8A71EB3BDCC001417DBE8780F.1193.328624480.302",
        "I_81CCE205BCBF28DB6A27DA778305F4FA002AFF54D936E7A9494AA3D406A360C5.2701.1047663576.288",
        "CD_27641CFCBA4CFC92EF51AA740A76C9C114FDF1C6E8F39BCEC729211A83CFE449.1778.3767071998.221",
        "CD_9670F10EE6DDB8E306101B08B39BD50A63BEE4B7DCABA524C96620EE066E2BC8.206.3410792078.916",
        "DMTF Reserved",
        "9C1C848588C2514B9F7117AA41CDA991BF49D22CA3C7528AAAD3EBCB.1184.2693893620.249",
        "IL_481C5641FC31ECDFEDB9CC27B9B4AC9E3EDA5479D72ABC3676DE78027620D064.1058.1943163685.360",
        "CD_B22B427F2794F083D59CAB3CBAECCCBC3A99C22CA4382A86ACBEEBD3E7AEF4E7.2420.433311959.358",
        "CD_B1BDF04F409DA8A1218BDCCDF869651E770462250C203BC00DEB8F3479804AE1.2109.1886272285.490",
        "Message",
        "CD_C3D9531050A687F226B048E1BDC0D3CDBC35A231C063FDD30671825B68A3AF36.2593.3547899135.220",
        "C_39920F6F1D924F168590DC56A9BF302C1B68A841CDE9FD0A958F21A68D6B51FE",
        "CD_C70A90D22112002F266DD0E93C79943A1F47C8E5E7DABAAEDE5CAE1591EB99E1.71.3559097640.250",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.296.1863209304.368",
        "C_462363B61D0D5970B6403061AD625C62E7F77E0DEE1FFE5F4CA69451C82B9D71",
        "C_F855A6D4334AEF984264ECC01FA41D9E9BBC66D0101436CE6BC0A37CF0955C3F",
        "CD_E44783D75BEF4F0F8614CE9C4168FDBD1FA3135B7D74FF2017BA6E02123BBDC0.1740.4002485430.1223",
        "I_0B880713D9DDD00F98918C43E596B37E54E0FCC69C63C301BFAD6A21567EB1D1.2763.3041098564.311",
        "ition",
        "9AB53806E88665C047824D5369B271C53B233BBEAC7C15BE3BA9BD214E527500",
        "CD_7EB5BFFAD139FAB3A00B44612A64C007723F66DEF2B850A4322740021A1EBE89.2734.3451043473.519",
        "IL_848F29A63901337200804F8E9DA5D75139FFB9B6BEBE17778C2DF932FAFD996E.2699.281711501.277",
        "I_8E5E113F407E760B5B6024C60D7EFAD89D7B8A04204C71AED6C00713A07553A7.2726.3623949685.285",
        "CD_AF9FF42200D7F24F94D2D927172EDE6E75DA70A13982C42099804CFF0709A576.1746.2030129531.1121",
        "C_E63F81A503B1CB2B5015A2FAF602FB5EB68917A75279382E682563684E46CBD0",
        "CD_FA21EBCF6E5D32820AD55E9B2F2B94C75A7711947B6C3050C8DBA3A61357B1E9.1809.2174566673.244",
        "C_F1E353069D97BA94B1909DA892B719B714F54C03563EEF18802F8B2BA8D69179",
        "C_7AA68F24A3819A669E00384CD6D5128FA13DBD361BC7AF482EC99DF104E6488C",
        "CD_2DC5A6B44F3255647A4F9E3D4F932FDB937FF6A6BFC90FAEFA2788D220375335.11.2175824254.329",
        "WARNING : Drive is experiencing write problem.",
        "IL_146EA88EAF8EB77BD08553A3FF5F4A79C53BEBEE03F2C448616917B3A3DC90ED.1016.1334109533.294",
        "CD_D821F8DA4BB17D06861EA625B573DB6B0B2A831564E8C02E1D4046ADA0C2D7FB.253.32854260.4067",
        "CD_6603235838D67F0A31998AE108546BB74586B33844F47241F23AECE3061C708F.1933.1422994590.167",
        "CD_308A38A70C7E63C8B0D223B592F8A2FBAAB2069E8358BFE6F473E432CFDFF602.2760.2586838298.1521",
        "CD_A635E8DA0D5FF95945C6EAE0E19DB71C75D6BBE7E19E0F2335E7F2A4C9C288F7.2649.1202323573.858",
        "C_5CB6A0A003499DF6531A245112372798390EB984E42ACEC32EC128E82F56ADB5",
        "Alias of this file association's RemoteApp",
        "CD_DA2B7733DF2BD3EF26A98D0C67C53F3AE08EF07915BF46D535095C4431D97FF1.77.2814052465.695",
        "C_96C0C62C985812B4BE911B17087624F5F181BC4A34E4B6F778659666F96320E6",
        "CD_D90278F1335965AC0FCA71D26CDCA31711F63D556BDACBB19DE789B7DA17A26F.2666.3309190192.926",
        "C_33D246EB3B57E6928B893AD6FD55D978AB60895C15739A40D6B9E85119ED3D71",
        "CD_88EB302CD16E8AAFC6641BEDCC17551C2C447BB8B7A2C0179406C6688EA18D65.37.3916941310.448",
        "CD_A8D86B382CC27EA5869ED6808E06A1A8C7D37476C8DC9964F86AC7B5FA42F3FB.2552.2600323349.1625",
        "C_D24A5DA2497AED481F5D755CD2B94AB194827FE0A539E58BFFD698924A2E19AC",
        "CD_CD83DD1439D79635F8FA7EF37348ED23261AD574E88661F73F9EFA7A25F6F8F2.122.3017094173.526",
        "I_0C8BA59DF2AB6BF64C722A393783EB9B6DF2F020FB0201D440A75D90A01938B2.1049.1225812266.186",
        "CD_64A1CC7E6457E8BC4843587443BFFBCAE82C80EB9392A83C2E16B0B57C781423.2414.1153088843.3292",
        "CD_DF05054754D9D5B0E7C9F400839266F3883F1311019EC13700475306FA54A6B9.1165.930945851.461",
        "I_FD26F844BBCA0235ED4C6E1628807CC844F9CC678E10AAFA6C284EE9D675C98C.2721.333233622.277",
        "CD_A3898C5255A1EFC888BD4736DA5618029E926F25A2513285DA71F554B0D3C354.2606.2330997736.229",
        "CD_C619EAF0DF6CA8AB0EC64764605BB47166AB4B422807E3FBD9547096D16318E3.1248.3247973354.1208",
        "CD_1C06FA152DAF97258D99D731FF917040529592936586FC456CA74403EF6A2F73.2756.875365035.761",
        "C_524EAE20B913314A702A0EBDD5A10C21EED93FAAED87245845E0CDD9834CDE3F",
        "CD_5E9AFB2824E4C09259A80739D70D94E550D572E8A9E41593DAFDA14D65369AE4.2196.1987613474.308",
        "ref:Win32_Directory",
        "CD_5B2F13ABADCFEECBA198671EFBCD3F1F745DFE5526713E2FD94776960F406207.1966.1021906686.408",
        "ref:Win32_LogicalFileSecuritySetting",
        "C_C0C743A36644538406F13B21A67062ECC3AC599CBDDB4F077787EC27F2AC44C6",
        "CD_83C100BE0F817015BF0575F5A3496A636C9309D7E4EB3062A76F5F113E51D626.2109.4158219599.263",
        "IL_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.2572492333.360",
        "CD_0AFC43F6F954497AA8887334BB937F82532036AD13DD27C64055852F3060BED7.133.2261014951.4129",
        "IL_848E55FD5F4FC523C00864C2E37F5A0ECCC3D19673B52AA68E334B012EECD2F9.1714.865885876.395",
        "C_E44783D75BEF4F0F8614CE9C4168FDBD1FA3135B7D74FF2017BA6E02123BBDC0",
        "C_5423A293D610FF0CC764C8A3CE38BA5BB054D35D92E0A6097D9147F3C3498F59",
        "~H3N]",
        "CD_21C86008A085A72EAA2F54BE2ED0590D75B28F32790405AE99F94878D4C5643C.2667.2913020949.656",
        "CD_4752ADF61D0AD3FC745339A237E83C0674E08E78D184202E33EA183DE0FCD7F1.2553.120650633.1797",
        "CD_15CCADCAF3B14E896FF023CB4F58C808DF0635585DF3790B0E9ACA025DF83D69.2581.567962583.1647",
        "C_1E13B2A6A26C0B91CF44A18D05250BDD9F1542236D3B9606359BA7D34FECE455",
        "ReadFailure",
        "IL_5EBF93E0C149B1B151E338091E85B09A85B53ED88BB6E56FB2EB094E120431E2.2466.3936457751.280",
        "I_EFBC800802FE5FB1E5DD6E54D128F37DDA4B204956F9B762E763A34848093A32.2691.3017536794.270",
        "shortName",
        "I_F3A7CF95E8421F67BF28459423C82D21629E16E53EF074D5B75137F6770EAFE9.76.2923548521.349",
        "IL_1C1B5A356F32BD080D767C3C00A1042C206EC1F272A9AE7761156E4E227A2754.2703.2277945833.280",
        "CD_D627BE392D7F1FDFAF7F353065ADCD27A759659F36B80C18191FB06C996520C5.1601.174094521.589",
        "IL_B84D4A8F309AF2F6984062AB08B3B336381470849C9D00DBE645D458571018B8.1996.391881786.292",
        "C_3A3897CEAE2AC0EF137B024D2062F2FE2AA48E93909CAB79C372EEE12265F8B6",
        "I_DAD6E29B77488F794A2249D639C8F48C004C8883092B213C0AD71E2D58F607E0.2718.1248177557.278",
        "I_E933CB4D8EFFD77961C5320C56284269A85879F173BF61B7E73A46E75A7E7F64.2688.2121592787.271",
        "C_8BA1D21E61960B29D0AFE87B07C528E316D314C9CDB4E6E4157971C5502F0ED5",
        "R_EC4C381761F3C10114EE1C99ED28B1BA382832F3C228DAE98DF8FBF4193D38BA",
        "R71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "CD_9BA1AB7C3163917E292E29E8907497F4785695E458493ACBBC6CCE3EBFDCC92C.2534.3137005187.504",
        "I_0A0D16F2EB06DDD2DB67E8923689AD964E906BA0F69213F241C03BA29909637C.2714.2124578502.274",
        "LocalPortRanges",
        "CD_17983AF29A2B91B8A9FC70E3C2059D5E3BF314C75E38F4F96A785985A070684A.2631.73608091.612",
        "CD_E49207E0C3E41BA550956778A93F67569B375398AA2B0937EEF0E61C098A3BAA.2225.2541211303.3084",
        "I_7B1CEA145FD7FDDE85118A874F4CDC2DBDFFEFB5270CF85B4A7E073D01A42C9B.2461.3033647899.340",
        "I_3237FD5DA9575F260EEEAF4A891E8B9160B7C9EB62993FCBAA97044D7FDB69A1.2735.4102368610.273",
        "IL_77E74ED5440E51C61208706C04055712F91B723AA0D26A67B06D8D9D686A208D.2736.1967633957.283",
        "C_612461B1AECF14916F6F139FD9951F2BD0CB766E0BB9EF5DA8A04D9DEB890739",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.1143516498.368",
        "PTXd h",
        "CD_9877A07ED842BA5F1FB4691948C0CDD95DF656BC3733002FE0D6F9D48056C255.2614.1526007969.368",
        "CD_1C06FA152DAF97258D99D731FF917040529592936586FC456CA74403EF6A2F73.1087.2567165911.761",
        "IL_4DC2BD0670849AD579953A227859E0D99A8E1E5136845D42153632DDE9EBE540.2715.4262521679.283",
        "Vertical image size (mm)",
        "I_F4D8FF98B431C9DE08E30EA0A5DA0DAF034B776838F75E67F5013FB3EFE9B591.2759.2612101772.283",
        "CD_94119F7CE064741EFDFBF431345AF21D6DE41FA57EAD0A70AB2B0FB8D3F14451.170.3574840969.1091",
        "CD_5F5583215800877E78DF32C89A95963A09372E548E11061C174A3C01BAB56758.2104.834132275.5677",
        "TimetoCleanDrive",
        "IL_00602D32AE7CB2E478AD3E478C2A2E597391F9B6E61223EE0DFE928A50B62836.2689.3937403319.276",
        "I_028B8A3522A7C64913B50829FA2EE1ED87541114F62CE3FE0A6BFCECAB708634.2715.1432374786.279",
        "IL_4A5EC507EE2D38FBD32F8B716D161A648F3F58A8D6DDAA85B108A66095CFCC39.2691.4046279288.270",
        "CR_7DB76B3DD456363F496D78BB6E6B5352F812D97AF3EFBED78BEB66F92C943C4B",
        "CD_1C238E1735BD05B8EF9AABB593689748E0D68B3ECED3CA94445FDC58B5AAF1A8.2619.768489710.2169",
        "alesohP]E=HAZLSV",
        "CD_805206C561285684F42D728C26661B4F548F5E54321B06170E013CB108084182.197.1287476118.732",
        "C_6F2EDFBE6222C2212C6DCE17E0A96AB75C4054C34F3E4779AA732E76185E808E",
        "C_161D7B1F7DD552C780B6CD4154D40388F29AC0271BBCB7991C59595342903A38",
        "I_491CB5B77B92CE4970181695D373ABB6B59A7A19F1AC5B4443702F18F64F713A.2707.1591329682.295",
        "CD_DDC1CE722F186F71EBB5E11C2ABCDF911566A3A8729D02AA993562ECD3859FE5.2484.1298665800.431",
        "CI_64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41",
        "59F50911E0F44A000D975CE1C5819",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2414.2112266181.180",
        "CD_54C8B2145FBF6DCDCAEFF33B39FBF359799D5087F9B974E853C4A5903604B330.1677.3409521922.344",
        "IL_C22F3CC14B7FF9F4D80D447AFE68C087DA4445EEF4656FE00DD99580B53D33A3.1606.3932967909.228",
        "C_CA638CFE13399694BAC2F76CEBB7B08DC881413B47D24732FDCE6DA8A0FBB80C",
        "CD_73859BDECC6E59555AB103C0DF5302F8942C19E249A9E48DB616B611E1AA3893.185.2983290951.791",
        "CD_304A06ED898CCB38FDE7CAC4F5A8405E4EB20FA550AF775C3019C149EC097D1C.1547.212083834.405",
        "C_15544B0DAFDF759BD10B745F7A926F46821115EF3BE25FE076FC3A533C317B2D",
        "CD_55795F81C8422B8993E279C97F35D31AD4DD7851F75BE99F367F8BA09963EB67.1533.4017663126.552",
        "IL_E2948D4344EE48B59BD95755614625E807A8E22AFCF13BF844DB4801C2129926.2687.2636800512.260",
        "CD_9775D7E59301DC60631DCE98F8981384E13FBB752E9A4E20554B45DDF5046735.2606.1867047183.209",
        "C_649FF30F9409CF8000973FDC7FB1D031F4107A8688A55A6A51271D73134EC398",
        "Warning",
        "I_B8C33F190EAFB29D36FABE6814AE0585A5A0E54FB864FF9E1C19C9732CC65F5E.1607.2114746688.322",
        "UseBiometrics",
        "Control",
        "R_C943D0F25B0073795B467B1155FEA65E3CB48CA53F5B1BA641095BEAA27A7533.1480.2893675350.566",
        "CD_F655AFC13A5FEA1BDAD15284811AE0F2C45BDE118943F02B6C8952C01605E1C9.1331.3046201239.1576",
        "CR_FE0D80286DB95CCA86096C1B5936668BBB002E04CA87DADDE64E7FE7658CBF0A",
        "CD_C6360CC70BAA2BFD5CC045D8DF9E4E80EB0DF7ADF14FEC0C55CFBD508A2954A4.1928.1623112727.280",
        "CD_CF019908D018696858253B4DB7E2B0B890C35E62094F820AE236F7B784A381ED.2598.1472814036.626",
        "I_3BE5A640A89AD29F589CAC254A6E30F3B039E3494990D439674937EA1CCEFF58.2695.3280171946.266",
        "CD_439AC72FFBC0FB0160120ADECFB39E726F363ECF3E117EEA1EAB024AEB72011B.1054.3374828722.333",
        "I_F09D5F9D0249487F8E1F69CEEEDC11ACE977B752E9987A45F721389AD20D7C8A.2674.491487911.268",
        "DEBCEDEAA8A4730651B0B0AA2C3DE",
        "CR_0D7E23CEBB047A39FE0F0FDDBC486BE449BF7E7B25430AF6F5497FBB0489C386",
        "C_0BF4601159F302B57764FD4C588A6F678FF707082109EFA7B0AFAF7D3839EA35",
        "CD_9596A53E85F3F0D633D696BB9EA3E48E9EAB2B18CDA373E2DEE09E41AF442CA6.101.923395312.115",
        "CD_E7ACEB5389BA8C32B04736209B872B130DCE3B94FF3A17F3972AEE3EFE29C3CE.1083.3069697433.324",
        "CR_FBBE075DD8BF09CF56F5E18528E64829DF169227E061EAB31220ED102922500C",
        "CD_FB13906D346FD1937AEB762793605AF720F07CC036588017ACD7E44E97A28121.1064.1654285443.586",
        "CD_64D49429068BE056D7485C9CA44E655C0EF5D1AE8B845E9E65096D5CE0BAC891.1931.1602941840.260",
        "CR_7010B213179D98B16AF38723EE1D750E86F808F341EE215AD8783D29EA117262",
        "C_896B6F9A9E07C666B49D000879A54E67F9CE0EAF2B8B7EF7BCA31E7303EC222A",
        "CD_52091F489E13F003CE1D9DB6880428EF7D0CB212D1BD0B507916EC93DD72E8CC.1231.3087433657.337",
        "C_563B10B3D43AAC1D29B6576E177E0D67C5C30421BFFD3A02E92B9D8D83067BB5",
        "CD_E14B4F0753556BB90A70563D70F7B34C4B56749AD9FDBAEE6BC20394E4A29614.2656.708087944.283",
        "C_5FC1120B31B4BEF5795347EF4041D413EF6F5EAE539F7093726C935A4F5DAF5A",
        "CD_9ED4218811E2E2DC555C6195DF95C97920247EF5A997EEA5E4BE65B094EAD727.292.2410801782.120",
        "CD_A9FE98FE5C3E9051AEEC71D48BD2011F883E1553AA2DD7968A20C510AD60108F.131.2815713571.847",
        "IR_6A6B9E2BBE3244917A6F8976955E1E6E04DDACCE833988626D557DC094A5D1C2",
        "I_D5015F0F522081FD020EE5B4501E138DF661E57BB72BDD7C27479EFFDC65FAEE.1329.3625107094.215",
        "CD_ED267EE324D3421C9BD582F00F7F4EC3645A8F358122D414EE824EC6E0323BB4.1965.3738632141.7975",
        "Migrating",
        "IL_5DABE1DD6EA6EC0E8373D4EDC2151C170ECA318A495B080993408D9B2AB923AA.2710.4826648.291",
        "I_2DBFA44D42A203A189A583B3C8201C9EB925E498EA2F97A636C432BCAB60EF3A.2722.387715919.273",
        "IL_D055C7DACD8F90B78856388BF2CE8EBA10658B500AE545011AA63A392BB2FD19.1074.2284772691.336",
        "CD_4410CB10D8FFBD03CBBEABEE118841024CDFB91D2E8A0E8250FAF26F0AF2D126.2544.2901315728.2358",
        "CD_FEA174838505F017ED6B4301AAC1DD5D141215A4B6A1F43D4092C1E5AC1A3F37.7.2432166117.735",
        "R_C5E17D61729E7377496CB88367D8A18CD6A24A14E576524968A24894CCE3FA5F",
        "C_2E9E6AAA7475372D74084F9AD01E597F60DE921D1B941DAD896E3A6C57F7C841",
        "CD_35C3DB4E6811B1E772EED05511EEF74635DA11992A8190A2AE28CF34DE0B7D35.2531.3943788674.4684",
        "CD_1E81C3B7838F4D33A0DBCA06EFC99B61816E8507E0CB2D2FE7B2D8431699B9E0.1017.4000650630.193",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.1143516498.368",
        "CD_F855A6D4334AEF984264ECC01FA41D9E9BBC66D0101436CE6BC0A37CF0955C3F.2052.3367046526.160",
        "C_5A7FDF4BD2E1212A8A01E74B4FDC157480285641E8AADC2FDCB8D0A2D1720315",
        "CD_F1112B4617C4E15A42328022C81AE44A37A10A63A4D769F7A4166A768F8AF9CB.2533.3902342483.413",
        "I_34E397CA10A0ECC11845AAB49CF54B3C91179B0B7BBDCCBAA021A6F03BE68A0C.2681.3729945574.285",
        "I_91905791EF422AA05A6F832CC868CF1370A4FF2BEBCBFB91A322D8558F88956B.2717.1105243871.281",
        "CR_8ECE7C7C47CF43406FD76752B14AB6773AC6A469FE0CCF9D82803F9A9B14C786",
        "I_5AD190D6B25479F68194F51DBECDCF63D6CC0D9344607A23A86C810FE23CDF8E.2689.2993149574.272",
        "{3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c}",
        "CD_1C2F941263BDB4D92A351438E56E28591B1250FBFEB226516D6B0C7665E5DC71.2730.2253996702.1173",
        "CD_DC27C286F2A3847C59A7DE34D71C7D711789AC9856A6490D5B105789D8070BD5.1543.3416818442.397",
        "NdisHardwareStatus",
        "CD_C3F7C0409DA0A77A93DAA31B205DA3FD17BB822F308D9326F5F4ADB0332FBC81.1609.1566929167.251",
        "CD_EF6905E1E68E5622C299FC4473182F96A80B74BF7D2B9318FAB7B6485D6BAB2F.1303.1962280124.868",
        "CD_8ECE7C7C47CF43406FD76752B14AB6773AC6A469FE0CCF9D82803F9A9B14C786.2574.3922026585.222",
        "CD_CC816E6ADE44FC6F4846C4350B65FAEE0309337AF136769D6C3E5769ECF590C6.1981.4071829303.6759",
        "C_4A805754DC4920C5CDF55FA12C65FB3FF31068A56F7569D69AC9CEBF6B6C724B",
        "CD_AE91D46A333A370D09132417089AF125E776EF57E4B0B159D0C6DE0E14D65D5E.2422.571512399.397",
        "C_9B01CFBED85021F674652BB25CFFC191CB28785D5E349AE5E91AB199C2788033",
        "I_F5DACA7B3759DDC70FA21DFFEBE969592FB6A43EA2A7FA644A9703AABE2F28D8.2677.226589300.277",
        "I_6F81082C846AC0017D1A9842210D9B991E25C88C600008415AF922EE372AE131.1067.1029015456.298",
        "Reserved as Pool Contributor",
        "IL_278ACDA8111230CF8A3BF0DE3D91EFA1CD600C37AE187140904EFBB7CC210FCA.2675.2609831562.277",
        "CR_6FD9AC26FD9A05EE0C1C596653420C32E2FD09FC50F0C520FC62FF40EABF1948",
        "CD_79FD2B1944A0E8569231538101AA02032B2AA1FD92C317847D2089CA52F4CD72.1151.143847702.869",
        "IL_D341FCEF2DB25B0BD9A420247A558AF86FF883E9F4AB35114C795D1EE77C1047.124.1070091540.301",
        "NS_E0090746586FF2B53E60090572D8F454B1EFCE84D6470FDDC572C5F523A110EF",
        "CD_DC65173170329CBC28153539525DF4928293E66F1C821340853F94ED0B12705C.2370.783304020.3171",
        "CD_75A8E9BDDDA51B5D1D891C00799220E5C1C3A6CF1F951600FBF99252804E2F0C.2420.3515140829.687",
        "CD_6712AFFCD639911A45E9ECF00AE5E5ACB9111263901FCCB409FA48F9C0CF54D4.1921.2207330309.268",
        "IL_CE0710F0EA660D582859363C5EB154DD0DA78A4F4457583AD9EEF5A29AEB704B.2375.2662574153.280",
        "I_7D433C11F117D65356D87621F3C78A695A4B76649EFF95CE7BAA866F2777A5FE.1016.451524509.308",
        "CD_A6B2FACDEA8F1374576DD3AE295E7922568ECC31E34094F238E85DAF6423D486.2541.2618613018.510",
        "C_84BD991F6EF99EE3A0301A722C367F9824F244968ABA37A64CDBE6307013A8EC",
        "C_73D523E5D8422D25C3616043387358F30734A705AA52BC4685A9ACF44AAE4050",
        "C_B449E4C982007699901F8B11448557481BCA2B35C4809156A6C3E1390C860FE7",
        "I_133AE77889577C41679A67ADB2FE6AD9A47EDBC4C9E19AA735345C392697BF03.522.1.61884",
        "CD_09855C27687BDB8520C47679461255159BA91E0E3C4C7686E42D9642ABA23A95.2615.2870684035.369",
        "I_CEAD552E2AE5FCD4C0CBC67C638CC88717910D81178C5CD70B0A399716A9D84C.2680.725799826.290",
        "C_188537EDA39ABDD3901DF3031016E2D37D171396BF2CA8AE3EC736DFC5E4AF5B",
        "ssr.sys.mui[PROCESSORWMI]",
        "I_20A2FCD02AFF243CF774088A45E089FBE5A849A9F82F70950D8BFE6D4323904A.1018.3371477435.326",
        "R_61BD99E07DD9B896C168C32D63CDE78875D8845FB21EAF979A76CC25C89D073F",
        "Severe errors that need logging",
        "I_E4B5BA0B959BDDAC8250BA9F8D8A7FF702B15C5A8E8D139A523CF672F723014B.2763.1906735264.519",
        "CD_BE7387966DF1F18E3CBF77DF02DD0D63D3B38DAF2C46A4C69CFFD4512374A7DE.1535.282384224.2036",
        "R_2A9212E5C5A3E7B6904A9AD5755292499E2868895335A7FB104CA7C39F4970DA",
        "CD_87356D5B7F373B899416425A260CE11B49850CB8F9A3DCA801C9778F10A8C924.1072.3939307617.7469",
        "CD_AB2EDD2D7CEAED1C692FD28230058F639893D9AE1A7C4842A5D14E4381C9103D.2545.3782758329.749",
        "        <merge script=\"MigXmlHelper.SourcePriority()\">",
        "C_62D05C4ECF40774F04063E6FDE0B1A6CE4B671271358A09E1596B6EBA1E2DD4A",
        "CR_E9D1340FA30260FE6DC9A13A7C426F447F5CFE8119285A157042BB8CB324B46E",
        "C_8D313BA715C6E6DAA1BFFDA728F33F642CD2C0D480FDF81C6ED87298338EF1E4",
        "CD_4DA19C7C1345D18991969860D5303884780EF4410093048FC0F1820643E62177.61.1967412473.645",
        "CD_BE7387966DF1F18E3CBF77DF02DD0D63D3B38DAF2C46A4C69CFFD4512374A7DE.2094.3171921596.2937",
        "CD_272E5753DC3EECDD6057038DB6F26170E7D1CD565B954C6C4A406CB1BC2D023E.158.3154141694.584",
        "CD_B45E8974D99AEE9CFBA3AAD1257F341531ED5809367CE4B614DF68E300B793CC.267.3718549515.798",
        "I_7098BC90F08FB4F9DD6C8351961F1423D74E36F9FFA01C9012DB19053495EECA.1620.2108318268.186",
        "IL_911207921CE1BD0CCB38282A896794B901A003C9B3BA6A7BCF0AD4CA2C69EB43.2705.2491796949.290",
        "The Msft_WmiProvider_AccessCheck_Post event class represents an event generated immediately following completion of the provider's implementation of IWbemEventSecurity :: AccessCheck.",
        "IL_B2979C83544972870A2ECB51F3135158FBB5ECEB65EE0B9FDCFBAD64445743A0.2680.2462356620.290",
        "CD_2DFB68CFE58009EA74A39EDB2F6DC802FC0CCD83F32B155F1DDD8EA8DACFCD35.1559.3553962918.638",
        "C_21F1E1F149DFC99965A781A396AF7873962AA365AB6A21C1E301F1804CC089AE",
        "CD_D13827DA0ED443FFD82DBB415FC1698F7DC60C2E8774ABDA878946AA14F41C91.2437.2929810970.4998",
        "CR_18A46D7BB56A85A77A8B14FC7C4A83D15E2F885E67C71399BAA10EFBE87C920E",
        "CD_88951EE85045E3B94CBE9BC71EF70777E4B05816F4BF59A02A284DEFD098F378.2762.4288783759.596",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2065.2755160865.368",
        "CD_7E08DBFF5396CB780182AC2736970878C566F9BF15005E66B9A69F8EE7B0F2BA.1584.383029884.420",
        "IL_6E529D6E9C957D5056C4DD361BD9E3844400F4D1790EF2ADE20A3072754E1CA7.2711.3509616361.290",
        "CD_410A129DDF9C5559586E57FD96A9E962121A44EE9BB4B632CAC4A1E45DD8F6B4.16.1352257118.600",
        "KI_7982F1017538FCA639874841D68FAD4E24866671A5CDE2C6CB4C169C859203D9",
        "CD_7D26F1E16BC9CE86FDDDA09E425A859A3BF87CD94B9004A4B2B575CD1EF41374.1087.4085847825.638",
        "IL_60DC4B9790A660ABA531267958641F6D57300995E74E813A23AC9619EC24BF9A.2719.3380054749.278",
        "C_D79E32EFA738782858549B5180893EA1A5E71401A6BAAE362DAE46E23511E634",
        "R_A67B228170904B01A8D934E9E3EDEC8EFFD199E2573B39FE086BAD775B16AA4A.1520.1891314338.574",
        "VerticalRefreshRateDenominator",
        "I_3BD30BBD5E5F0A0256E5304240954604220B8912EA00BA63FEA8E61AC5DAFDD4.2689.1384573869.269",
        "NT Number",
        "C_BAD9CF65ACAAD76843902B63F6C257FE0199AAA33356AFF3195E24965DA21069",
        "IL_B7B880A93C39F63D4E8650CD4B691C3EA20E6F72F0772B8430D79E1281A08036.2697.4148879673.274",
        "The command line options for the upgrade.  These should be in the form of property=setting",
        "CD_D6B832D04D0FAB582A050E5212201E6DF3C06194D4D96931CCBF8B3053F5A8AF.2267.1.30902",
        "CD_07E19E30C996BE5EB2C069F75B45EC8BE08416240089C28E8823A8AA0508BAE7.1922.1255432145.1010",
        "CD_7A2306288BB25A962F3F7A0DA1538731F7904679B3CCE7E9A9A9F2638A6325D2.147.3837872563.414",
        "C_20F26C6236C8252E1FCBB508B5F5781449304BFBC276C5E3DD747A3A26989746",
        "x8\\<@TDHhLP",
        "C_B18A79A265A485271ADF7583A11B74126B27D0421B9B453C88A99D39E80DF5B2",
        "I_B29690E8C1ACC1A5A2143A5BDCFF8C67E2BB645250492E1EAE03B419B30D089A.2716.3556071350.284",
        "IL_B512D79AFDBDE08901CBD277D2ED31DC4E8212334341476DC8267398518DC4E6.2703.3738088826.285",
        "CD_15AA9E5C08C912088DB12148021E6F808EE6412DBA54846E39AFBD33E4BDE769.2424.1696083838.362",
        "CD_4DD50BF821F6AB9924CBC702AA24BFCC6D9952BFB0AE1C1E0C61030AB779A8D1.2538.637075833.502",
        "CD_EDDF316486234851D86580CFE9B06D5A43E06F671105861787434F12D58AD4EC.1086.465290039.623",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2005.2212459440.188",
        "CD_E6B9BE1A013F3728E0ABC9EB394195E63809D712600D83A9FCECA00B72022168.1929.3744103693.1060",
        "CD_760A5CD37813CDB0802F97A15FFFC44EE06FFB8EC97E61F0CF228A37D3D46FFB.146.815352448.737",
        "IL_BFCF764FA6860E86A3549A14AEDB64BB948BEE447641B9576D3AE38EC7701FE6.2414.193098774.188",
        "C_BC4F91591102411312342399DC065D3EC257C15FFCA13E42BB6956DC3F1EDBC3",
        "C_FC7E4729FBD99558A3DD7F878A1DC4A01CF31A2989C5EA7E0C36CF5077F8D7BD",
        "CD_AE9B26B8983BE299B5F536E4C06DDEBC3F57E793409C1E488B880AEA4E8EB6FB.1344.1791694470.1141",
        "teComponent",
        "PrimaryOwnerName",
        "MofResourceName]",
        "C_7EB4A9F63049256E4E34752358BA88B60BE953949D217BBE4528A28A2AEF7097",
        "creationTime",
        "CD_9CF93B4CC1BA3A3821CB93A70057B3494ED76B95F0DD947CA799629B3F94C395.1266.3420775221.1185",
        "CD_BC68F03B4B8F91EBABF0C9EFED9C57ABF605182A4D8760A0679947CF4F1C5F19.254.2709017876.266",
        "C_2CDA39737D02F62FC720940C6B45607B5E2EA5635D874CC5BABD7C8C6812DDC5",
        "IL_7D726A53C2E109A7102AA0733AF15E0ABEDDFCEA169FD750AACBD377D8D29F56.1476.1859033999.253",
        "CD_C78AC0FF7EE3F58DB7822FB4C033CAB6C42D54AE8C8F1545E75A7C5FC5C2ABDE.1849.1339191877.593",
        "C_032D0BBE36FD51D3CED741D9163A914BF52481E88F0EC17115F81A8ED3B68630",
        "CD_3CFCAB1516C75164A42E3401D0ADF64A4765F50E4818FC30D95B8671DE07D069.2750.2080021950.655",
        "I_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.1156875190.338",
        "CD_DB064F6F00AC6B8D3FA5B61DC9E5BA4F856D1F834E95E30D538DC0E3B653D24D.1784.679634973.301",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1104.3529881253.180",
        "CD_759160644DC63F3466AD1F94F864CCEF928FCBB42CC94A976BE157D734014BE8.2557.3712627961.668",
        "CD_C067A199C1ACCE03298DA4A596E9323C2C865C447DF4449AEE4DAF3E29B9DD32.40.1318750973.560",
        "SplitIo",
        "CD_A32ED3FB3CFDAAEBC2DED4EED7D1FF0A45801F8552173833B24960BDB076B896.2623.1122905285.1934",
        "IL_7BB3B0FAB257FC3717B5B5D99E4893CDE4CE71D21C927238A21732519D106AFF.2690.1173560808.270",
        "C_745B4133290DD0359B5076BFDD5B002CB270C2B12AA8DACEAEA9E5921822961D",
        "CD_11BDD83D3BDB7F7DD4A04A3CC49869E53E73157A8718941705A791A42E561334.1476.2269318373.744",
        "C_5C60915A965EE419D1C4FFAF8E02780CAEA75D9A61BD702293ACA64C5B74DBC2",
        "CD_09AA62D4FA690685039BD35AF8429B94B397ADCC4F469333BE67A53F943C12F1.1188.381640276.474",
        "CR_66B4AAE372CBC10B0496696F6E3E5C00A5D9FE6B85AA03A0FC19CA05435472B7",
        "IL_0BC2DAC7B5A8588E1C6578BCF1FB08DE7C5524D9079B5868CE649654424D07A8.2735.2439523697.274",
        "CD_717B9447F64FF1DDD9BE96845CFF451CD699E26415487F373586ABC0F3E7F533.1070.2236786128.223",
        "CD_CF99E243E670BFA5D310CC92BD4BEC2574C1B9F0154A447A1995180DA519C649.57.499400174.250",
        "MACH Kernel",
        "C_A881933FA9D51D73AE6214A1138DCCB4CB1BEEF83EA181C268577ADB44A0FB56",
        "I_644ECE952C19F6156C203453C53C30C22E6F412E4B6BEFC55C711F68463446A2.2680.3753066083.290",
        "C_49530BF4592B3609DC643FFA39B0065785C88AE336F83147E233862B786488CB",
        "R_EC31DBAC8296A2F597184183FC259C7595AD4BCCFF23FB0BD832DE414BDE578A",
        "R_6FF6CB589253824DE681EA946AEBFF7061F07B8322E36020A90CC770B8046443",
        "CR_9A2FA4B503D51BA72E7F874AA07B2D2639867C129B89B4AF2230D146C0DBAD9A",
        "C_774C74FA0A64054619A74652957611F8C7CFE26091C21F7EA4D686C4D60816A9",
        "C_189326F4F721F3B084F2B9D28FCA49B5C1A7BD8ADE57D16572A5693E864389B6",
        "IL_53A1DC0DDA2E39C523B626FE8ECD05C37BEC420D592C1BC708D9489C28C35DE9.1066.916608438.262",
        "CD_615767763A5CC6EE32825268D0AB70A3CE397F1DFB8C12D636B388A7C439E3E8.1561.2119237747.411",
        "C_EF67B600A31F150CE962D694F9CA3072B7F784C6A34776FDD01BE21CE72A06A9",
        "CD_87EAB6C4850F775DE7E11FA687F93DE9FB590BB1DA4447D688389AE4FE6B68D1.2535.648480523.2358",
        "CD_B4744AE091F96C1897CB0086813E1AABE89C9AB276818B172EDE2A19A9884429.1087.880732526.348",
        "IL_95FCC1852F7D47EDE857E51B1C80EE9C502F62B794354E0C4EDA55E4D70B53C7.2696.2152323564.275",
        "C_1D9A9343F720B6D89833DCA8A7B92F53169B46316C0AEF3756FA68AE0584CC8D",
        "C_52FA3652DE48FD253CE895AA1E0F7F7869B94D77DBBF33883D1DBCF38C65343A",
        "IL_91905791EF422AA05A6F832CC868CF1370A4FF2BEBCBFB91A322D8558F88956B.2717.1105243871.281",
        "CD_B36ED16AEB010B08F8C935CBCDB0109AD02D84C288504D33A7A27916E3A04184.1601.3996132184.822",
        "C_31F8E16503130653E4107DA9CE6CAE19C0C0587F10807E44C03D26ABF0396241",
        "I_B118EE698BE02687058C3362FD08FEA7BFF7E07108E3DD6784657256C3E1834F.2724.3765932508.283",
        "C_C415F4D1DAE81CB1FFC16E6953FF6107B9F915EFA0AC36B2387428914D707A66",
        "R_A9B783D001816C120A5D7EBC7A87AECF9E0EE52068A0CADAE17A8EA3AF1000D9",
        "SlotDesignation",
        "IL_6E14DC5BF582D82643F5DA24C299D59E6027084CD201981E27D848AB75E18610.2692.3903109052.282",
        "IR_2E249A9A7051E55FB5C7B110A81D9F2943FB48A52AA26C08ED30F6DB2402B8F9",
        "Win32_PageFileElementSetting",
        "CD_84DC3D5BF4272A04D490B0301A75593E19CE556EF346F7E0E8413D0189B83369.2575.1943770110.249",
        "CD_2800F9F89075C56302A7CF7269B5300116A62BE579546FA42D0E22E3EA14FE1F.265.2791278548.667",
        "CD_CCDB0F33BA6966E88C9C16D64D85DE69D152BBDDCA55C4187234D7D768C27675.28.2384726426.1117",
        "CD_26F2DFA12DD4E238DF19BAA4547B3B8EF9BC62B9AB940056F71629B35FA95FCC.2066.3130761771.4366",
        "NS_B6791A1CF7802A901B1534CADBB1A0E82FB154100B2BE08AF47386C43CEC462A\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6",
        "CD_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937.104.2728375173.446",
        "C_DA8AC0D78FD1B90698550FC0FF5C609171143A2B0FA32F0B779BC5DC2D3441C8",
        "IL_0BEAD814BC8C7031F80625DB21C5FCDBC4139FBE8FF2DAC665690EFA32BD01F6.2681.3814575362.281",
        "Specifies the ID of a print job to restart.",
        "CD_5D4131D5A516AE8353C44119767CA1EB7600ECED6A11D9400A199065F73B27E1.1557.1.10428",
        "I_F8B808D7A9252DEF065341C8B8313C296ECB08839CCF4A94507BC66DA5D3F382.1478.2587650861.329",
        "CR_430DF6569120000240D715CFC3D7DFA7990D70C64962E79D5490789E796A3D58",
        "WMIProv",
        "BEHKNQTWZ]`cf",
        "`Z3{]<B?T",
        "IL_EFBC800802FE5FB1E5DD6E54D128F37DDA4B204956F9B762E763A34848093A32.2691.3017536794.270",
        "IL_5DF699F99654C2DBF66C5FDB8987B09A99F1CFAA95812890C5421B937233B9AB.432.1.100514",
        "CD_5FB7B77EA5E2C3BFCAE4E2AEE1C523572B9C00CB53A36167EDA3CA812EECDDE0.2625.3488406835.113",
        "CD_32947322653D8EE69B3B501A52A83906C2620426EA39361B67B60542321F696F.2070.2954171538.1115",
        "C_68B1777F67456D5D5877E7FBF4B836A9D3F5815E69514085564EFE06BD03ADB5",
        "CDD6057038DB6F26170E7D1CD565B954C6C4A406CB1BC2D023E",
        "CD_6EA073B72C41358639D5A837A10A1E67FEA90E42764DE7ACC35A8F4BB14543A5.1579.1114915601.428",
        "CD_4863CCD7EA7AAB9B370DC41C90A9C0EAFEA91FBA205A7BBE9446323C4F6EDFAB.263.743118307.219",
        "CD_4E5F0B888397E4532A37F63C9F9EA0A293D8E13FC549C1AB0831AC14D99C4786.2559.3157924918.696",
        "C_0EFF03476F17D85C3F9C99DE6C9A17B9CFA58B1D12889A9DB2009445F591BD9F",
        "CD_13C9E4CEE0DB2A141FCA5D32D5944FEDB123223947948622D17B40B794518D0D.2473.3894726889.2110",
        "<`@|hD",
        "UserProfileProvider",
        "IL_8883E3F099C32C7D51D4FA6B29599D4906922A4FEE1CCF06A960C150C19BDC6E.2672.1603151642.285",
        "CounterType",
        "IL_27BDB5613C2488A72059BBDAD0ED91A11C338E50F62F3996CFC1DA830AD63EEB.2709.801147140.311",
        "CR_6DC34F83B2836B7F4C49DD4CA9153C9A45B781EB43F2F01662DE7C715D9C447A",
        "IL_76DF8F121B35B901DBCADF39EBD6CEAA1050C4BAF7F1C5586332DBB26DB37A7C.2684.1529664530.277",
        "CD_06FC0AE99192039AD3DBC9A60D9D3329CE5644911B9200854CEAD799C76E19C9.1998.3769478654.640",
        "CD_7D60A6BC1BF80C348C255CD9C78A30B16F7F9A390E537387D471354838C57ABA.1983.3584870241.3598",
        "C_476CE3FDB3E7B1BE651492EA8D1B3527492ECA7EB32703BE458BCD6F6B7B15FF",
        "seqnum",
        "CR_410A129DDF9C5559586E57FD96A9E962121A44EE9BB4B632CAC4A1E45DD8F6B4",
        "Version",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1355.2680984201.368",
        "I_D51CFC40A0903188604CC64991F31DD6847EAEF5A7A909FA035EA7CDD8FFC9C7.2725.4258154937.286",
        "AcpiPct",
        "CD_E2C33C7E3A117410A8114CDA2C8E0FBB300821B704E3CE1129E5FF6AEAF52EAC.2588.1182674811.511",
        "Every Day",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.1794.2277000137.442",
        "CR_4CFD343F89F816CAAD34AEFE39C410FEBAEC57C4ECEFF6313E9D0F9D93057526",
        "I_9D24B22BCBB547BB4D2B1463E0C53A00C9EA46E1D8D5F28DBC836E358C515DA9.2711.1327119678.297",
        "BFE Trace Provider",
        "Remote Replica Target",
        "I_6D62D7DD45B5ED9F92154C67A2CCCABB9210F15B90BC95A599C735B2EBB140BA.2698.561315256.265",
        "C_2AC3A3393B211815EE8AD95630A39A04356B9D96C35ABB2AB34E8ED5662118C1",
        "CD_EF449CE69828797E16ABEAB272BB63851199331E1B3809DFFF02FC6CB2F0B417.2173.1.10317",
        "R_D36BA3ECD67E70A681B6A3C59013CFFFBADE74E531546E307816C80C79F820CF",
        "Microsoft-Windows-QoS-WMI-Diag",
        "C_19FFAD1CD1C77D68E4A2CCD9BB3A232F8053D878E6AE3BE53313E296FE7091C8",
        "CD_0D7E23CEBB047A39FE0F0FDDBC486BE449BF7E7B25430AF6F5497FBB0489C386.1193.2870429907.338",
        "CD_941298FE57B01D7A1E5DB7CD7C2688B06D8CF556A38C47811E3130A1974EF1B2.58.1835614530.645",
        "C_E0FC2E4340A084EE9B1101BF52F20C14B78BA7DF0D8E224E8218B82E66190D39",
        "IL_3ED3265D553EFC53E56777424A868C9FC47DC736E8560FD82A076B89B0957CBD.2677.3572240348.281",
        "R_3470902D006FDFD92D462AF44AC0093F1ED2FFD3FB3B2548D209203AD5656472.1333.2440042105.524",
        "CD_E8334B1044E5E9391241F02C3A6477EAC7B1BC964EB7954067F8CB3768E4DDB2.1194.2581998387.754",
        "R_CDE927435CAEB1D62EE8A15E5309F00C6263566F2B069604C803AE5D37D85A14",
        "UdpIp_TypeGroup1",
        "CD_E5A20910252EEA78644C76F168B544D447F632499909956FAE095522E886AD9A.2623.2062142402.406",
        "CD_8C54282921690EF2BC9511BEAED7C3917ACF17676D66B514A1B2415EA6A9EF57.1340.2109145206.472",
        "C_65BDD6212EF53E137C74914F0E8C6D83526505C01E3A3FBAAA47518944B541DD",
        "R_DA60DE4570557569315706E8539F2BA1D42DB73DA9542D7DBEAA586346CFF0D8",
        "C_DEC0FC4E25BE960BC9ABA34186A4EFEF64A55170F52CD37DACB7598B3A49CA31",
        "NotNull",
        "R_520F4A6CD1D22F206E6F5473B669F39AB1310B253B4678DE0F3ED216986A8D0A",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.292.2845272479.188",
        "I_5F304EA31F540B736484842115824C52B8E4A0233626B75C2F34A619427DA021.2694.3687428411.277",
        "CR_71926B9951B4E8AFC04CC2F1AC5B5FEC04E9A08320F8B28164D32D905C0A41AC",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.2329106888.180",
        "CD_AB40328BFFE9E2590F7835EBB83DF3665588C8B52A9107EB25D7DD22EAEB79EF.1475.1995166282.435",
        "CD_BBD86C45827BAA3142E8EBB2B4C0577FACECCA56171A99F17B3F06E280A3C32F.1339.3473151146.665",
        "CD_DFC25D46E8711DD4634FF6390AFD6E0F348F88B4F5FAE966D405DF4EAE83DD54.1714.3886104664.448",
        "CR_710A61940BD7E6F894BB04EC5095168D9BAB6C3B16D20CD7CF6F51DE93A6FCDF",
        "C_86A12745216BAEC8675FE6006C3FB8A4815B9D8D2181A6E71B70A8A8C56E97CE",
        "IR_84E4B76F6444EF39B8B7DC8A81CF89190AD522CD0F68513A037647D5384883D3",
        "R_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C",
        "CD_F6F37666AE13755FCAE2FDAFEECD2EB4BC3DDE98783C006B41BA49C3F5EA37B1.1571.1.29660",
        "IL_0DF7BCC0A06E210BA34D9F2D954CB8E7A01A47390F2DE226658501C2150135EE.2678.762188971.284",
        "IL_799544BD8AC69E449D9844334855CBCBDD303750D1732C4FE3BA6813A642BB1B.2692.1802155178.272",
        "IL_973BA058AC874A3043774A23CD93BB06B023BBBEDB4E0810A8E04C6AD85A11FB.2690.1811454526.269",
        "CD_0E19D9A907E37833D25D914BF07AB07521F19F0DFBA5FF59368C9C56C42B1549.1780.4247527905.282",
        "C_3EC633BF060A39C201FB3365682E90372DE72DDF28B24BE016E2C6A6195F1EFB",
        "R_D93383F051CF2C999A0FC0254121E096274608DFBA24CD421A9ABB46E7A53319",
        "I_7B64BD1A702063FB6768AF5ECC7D55271B9693C43DCC4E726540B6D5A0AD4361.2696.3456982458.278",
        "DnsSuffixSearchList",
        "C_945E0D785EBE9AFA48EF45547D26D1AF268739A26006972196EDF0166C1F7FDE",
        "CD_8ED47D93B378823F8A634B51008797D9C7D2DBC0806250A927801A4F342C2B5C.2591.1404037608.441",
        "R_38522FF056841CE5D155E4CC0CC353966200DA04021E80EE70B3AC6C9663D8EF",
        "C_A3BB95ED0B202A25A7223B16F2A4B7FC5CE2975B203508279C7D21714713609A",
        "IL_71149A9D96E4258EB27FA2CB879EFD22F7F2AB97FE4D855030B675DD7C07C99A.2688.4133366604.274",
        "C_E5A20910252EEA78644C76F168B544D447F632499909956FAE095522E886AD9A",
        "C_27CF2379D55C0D9FB04788B37F03791666FBE227F5B5256A959C5EECD8D8ABE2",
        "I_E05691F288C6C845F6C109251FA16F160C3FB2345B71ECBDDF85E83B275E5B39.1017.1816352371.313",
        "Pinned",
        "C_47942F6B36BA2D84D4007BC0F4010D1D4D9DB566722A9AD5DB3D3436577E6F01",
        "I_7BA06B043DD4F1C4BC3ACB7E4C10A6223E3DA1067522BFF187585B0486BDFDF7.1354.3298274962.380",
        "R_112D5871031FA8548B77FA449AA39B2BB51A4848F5CC93A4CF0AC90CF6249BE0",
        "C_533CBF6479FCC2785E9F95ADF9F8F22751BD25BC1632BE19273DB9579FAC4C83",
        "CD_D7F3D9E12DEEE204449B9CAA8D3A0464D39F0FE9902E503068BD45CB162CC389.1512.1.8220",
        "C_1AEFFB6222622A61AE00A6A8A6B976D42F502B57E04086F26915152E496EAF89",
        "CD_9ED4C67E3712DE07C86D1861FC69841608A536EC7A7415988B2BEFAFF875D077.2425.3680387334.363",
        "CD_DE7D77F89C87D9F9005DF4E9FDF0CF25EF5AAE159C4D26A1FF500F7A7277BA41.1172.1763558642.279",
        "x25PadType",
        "C_847B47B3B9DFABC8A17BC79B345074758B8A3E5B2BEBFAC49A4BE58E4D1CE00A",
        "IL_6F254FA6E8A44DE3E69CA144FE59E44C280A864F94F3CCA0962F7FD3FFFD0ECB.2690.1525512714.263",
        "ref:CIM_LogicalFile",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2197.3686679771.180",
        "IL_17D399E35013E1803B92CFB7F367FC3EDAE2C98EDA1A366A6659C348B931520B.2693.1545574130.260",
        "CD_7C2448C779B501004A8AC92BAE296EF71C889D4A4797C480FE572242B6C55673.1526.3014907320.903",
        "CD_6862B6F533E21D68E1D23D0712A1C13DE999D91F14704477263EFE22A55CE495.2642.812142503.871",
        "CD_9A3419D1BEB3DD772F317128C59554641FCDDB696104EEE43BBF4385A72BA8A9.140.2613645637.3246",
        "CD_B28289D1B5763AD76E9600ED77D5A2567F24D84C53AB89BDDD8D8E52A4812973.2632.3876572035.6106",
        "CD_81CCD9F49463DE42E5F24116205A8C2F9DB6E6D4063663217E282C3E20BE0A3D.149.3396369934.1095",
        "C_CE00F2E7D1FE143547221CDE461E1688B57FA754557F032C9C2CEB24353C9185",
        "C_FD5A09758773146E01CAB43EAC38C6EEFB9A870C8F888B5F24F7E89AF0CC12B8",
        "IL_DE468BF74FB57C16C2FE0AF90126FE83C9B098410A7D38A4977B5C5D80E7C5B5.797.1.60719",
        "<?BEH",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.2197.2023026650.3240",
        "CD_0A4592DF371B0F1C9E35DCF899DDC0B30F2B23CFF106F5805254E0E64E1E04F4.265.2875685431.808",
        "IL_55AABCE3A737B45AAAE548EA36C5A61E7A37B3493091B2AC676F2D7679A51E73.2702.3098572845.286",
        "IL_6211AAB1062F5F857F8CF4D9D50D7DD98604CC50B8D3A755123ED244E2C8142D.2764.3229980831.287",
        "I_A9B77B6FB8EEFAA0386ECE3D9F763120D7E0B46CF98ACF71EF752F98F67AAC11.428.1.32140",
        "C_A6FA651EA245ADD657842B680F4AB592CF67A532F435E181C050F114520982C4",
        "OS Processor Id",
        "I_213DE1C378BA512541ECC0D27A04A76AF22CD969F0BAAA5AF3DC6ED03D9E8F55.1016.3400545868.307",
        "CD_90474CF00D4AF038E01AFFE1D325BE4CFECCFEC8C771DBEF31ED1256C9A59468.2606.3748089147.208",
        "CD_61BD99E07DD9B896C168C32D63CDE78875D8845FB21EAF979A76CC25C89D073F.18.1476196349.464",
        "R_930F0BACB64DBAECA604F64FE1511FAF8ACAD55623FB5C35858B75FA1D3172ED.1501.1250681649.590",
        "CD_EB74DE80A4ECAF39B636937B76E6D45F7589467EC770ADEAD91605298392EEDE.208.2684805094.3518",
        "I_F694DA798D615C7307EE8E46410BDFC31A985B4B4CBD53BAF1E1B0980B91D901.2688.1595738901.268",
        "`dhlpt",
        "CD_CDD91708E1AF6D153701E44760D97DF285964853499CA6DDD22864F53E1EDBD5.1353.856023963.1167",
        "CR_7B2381E53BC461FB5BE5892F6D8B646850BE4B97761D0A77A966BD4E7C587F57",
        "C_428941D3E4DA5D73C4ACFBC21B050EE334D4553F43C52B09A9D3CA1C7657E068",
        "I_4BD704EFD82E90D58D3C406978C7C044F013A64518E8C54785195D2358D9CFAE.1807.561115493.325",
        "CD_533CBF6479FCC2785E9F95ADF9F8F22751BD25BC1632BE19273DB9579FAC4C83.1249.1.22205",
        "CIM_SettingData",
        "IL_8F1D0EEFF09882E0AA524E87B53BDFC6C73AAB5D286B5498249DD4CCD51331DD.2763.1318601741.201",
        "CD_F7113F6F79893405611B3E0C1184CFF87E4747F2432D2CE16AC2FA972D4FCE30.32.3032063208.491",
        "IL_5A84E47C5BACABCC597E387FCCE7B12E8BBC6AE8F0AF50C47B1CB50E12A62941.2701.632918330.290",
        "Msft_WmiProvider_OperationEvent_Post",
        "CR_92C92331781DF35B14382C2C18FCF4F9CE2A3F0D9A27B8F847108A01941602A7",
        "I_D8EB5722B4AE7D0ECC5A4B4C341CCDFADAE06A65B6E6443163CEC33F2AFAE3CE.2684.2770032514.285",
        "CD_0C06A76FA35A78557382D83813D9F6B0545E1F0D74B0BC31A4E1301DDEE276A0.1017.3800736858.694",
        "CD_62B7F57437B06407AB4B39D9915D0BBD1E5003DEA18F986400E85C5F698F8D97.151.1363357162.1346",
        "C_454F94D401CBC66FBA3CF01A7FEBB7AD985BD8046C5115863EFA27C37A7F626A",
        "CD_47CBD249A2C567357686E5ED6091D88133AC6ACBBE7BC216472A737EDFCF1867.2001.3091627064.641",
        "I_B4A2C5E94294CA48EE83444B581B7715F0456C2AE322533C1FC870F4B341BC92.2459.1269866449.285",
        "C_C098D64978468CA957C3D43E75CFA62233296C00D54DABB8ADE5BEA89B9E0A4E",
        "IL_2D90BB9A9E17D0896DEFF9353AC718A455E560A459B99C6F8E59B5C9AF96B6A5.2714.1382068666.281",
        "IL_866A032D6B2FE1717CF10787541C36C6A6484D51105E647FF1A0225D5CEBCD96.1475.1829273927.329",
        "IL_40DCBFD933B98253FDE5127D13CA45EE29BB16C6861CC92CAFB3BA52757F44EB.2700.2010604591.274",
        "EEE39AE9C2C3BC4B007C81CA929319E36EE45F722CDC5",
        "CD_BA9CD7C31B85A636A87F036B890DA5CBCEBBF513C5593559C6820C8201B71405.1539.4109666529.484",
        "IL_D5015F0F522081FD020EE5B4501E138DF661E57BB72BDD7C27479EFFDC65FAEE.1334.1051082552.362",
        "IL_74DB269AD97C14528C528C1449F1DD3ED8338C809E68E4848164BBCE7DFE6620.1053.3517424961.351",
        "C_520C6C258019D67D7AE1EE1496B8D93D4FD98E1A9CA11CE69862665A1CB25D4B",
        "C_65DDAC6706A72751C31AAB0BB7F91380298C39BCFDED1B7FFA9B96AF2A3115FD",
        "CD_7BF9CAEC5E776ACF448F84A63EB51613BFABC1A04749B0DFFD3836F69A0FC40B.2647.3441633395.1094",
        "I_77E8F3E5C979A568F3203DE2542233AA744B340EA7CD046A020B3F37D5ECA5F4.313.3856196657.315",
        "IL_886C9F8982A417AFDAA51FF78BB9E9B6EE19BDA8B9BB937D782CF5D5173B6652.1147.1762140494.344",
        "C_3DFF91AF50FCE1887E36B1997DC21FA068E0AE4638B74BBFAAD315E88692001F",
        "C_5F9C3AB92CA2BEE4365F705F76AB07B9D0B1B5C83E9191E42305414D5BA10EAB",
        "CD_C25AD6A436EAF64345F40DAC491FA65148B33848B9F75EA21BC89509C8ED1C31.305.4198615495.921",
        "CD_2709D604997E4C05B7BF0EC60DA38DBE96EE99877100EEC25D736116E6E41045.2547.2856162644.476",
        "CD_A963FF6A8458E9C4FEA354824C031F4237B8648981577F19FD6854C86994DA8C.2226.1.15641",
        "C_A69E6356161425C607A95D0BEE4B01A3CB60EF906822BEC375F551028A8A52E8",
        "C_59BB151BFB7474042FE846D38FA0CC3A5BA58498F9DD04AAF5BDB993481B126E",
        "AllowWindowsSpotlightOnSettings",
        "uN*3]9`$fc",
        "C_9C52BC59A122CC7517413B34FA6839E69A7AE3C55A75FE6EBEADED4D113D421E",
        "I_A4D743825608F02BFBC68E93F5F3DD81CF79412D3A9ECC64F93FBB77D4727519.2721.4120571421.281",
        "IL_0A0B72434FEE1EC47128F3056CC43CD334DD680A327DD193AC78C1B5F164228E.2686.1098937132.270",
        "0.3583691387.287",
        "CD_38529E11DBEE922C6B8651639B26646929646902C4820BE48AAF7AFED4E23F03.1931.3380278521.1045",
        "C_521F6F7CA2F4726C35B7C823737370C6ED182E0A59D2942F8C5459B8DDB438A8",
        "I_27272B779F0757C78AB33083DD3222F3F74A7CE553BACBED32A9A71830BEBBA8.2693.1604006876.261",
        "C_FEFA247A44DA15F04BB7D182136FFF162D3B44823003F2BD085C2A572B331BDD",
        "C_177D26EEC1A3EEE9C918CE0D02D131303B46FC66DC9D37A73FFD4DC66006CE0E",
        "C_9EA1914F1B3969D0904DC11AB6E8C7BAC75F195080FB4370BDA5C6102822240F",
        "CD_87DD29F7553A736CDD2DA76F2E87018EB0A43C3178746219777AE1FAB39964ED.1548.1502228067.514",
        "IL_C599B38849B93074CBEA1847B2757551E8E5BEBD1E4DECB842C1D6040B473BE0.2675.4145310372.276",
        "I_87FBBD5975CFEEE24A1C3398DD5EAF7BAF9BE214D71EE1C4D91AE8822E452B66.102.565038793.347",
        "C101F70B5D252B.2723.701907449.274",
        "0 - Success.",
        "CD_73FDCA103A6930FD52B50CB857297C58B950838604AAF9FA2A8A8AC7D06D4361.2024.1.11956",
        "R_D6F87EC61B61A3BE74CF6F98796051F97BF5D3FC96E82F69A2F8FE9703C8F224",
        "C_A0E041B4B9BA2D45BCD93AED10DECA3DEEC4B9F73DCEDC4BFA8CABABF351AE00",
        "C_3D908B354A7F66DC7D8262D5E5F0BC191C813424FF188C05C86C05A6827B5F6A",
        "IL_9B7FD3BD75964EDAA2535DCFDD7318D8161266FCC6A8F563295F2A6541F02092.2677.1600973069.276",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.3725407623.180",
        "CD_E626C49C2DBDF1D0BDC38FFC05C85B76B4BE8E69CBFD214D5F89F70F619AD6CD.1389.2247690691.132",
        "fResourceName]",
        "CD_A935D5F4954895BC12501D6B843A3E716216C465E3747FDCDC880A4856CE027D.2603.2630254494.533",
        "CD_BE638133AD205E7E82E7EE572C3B8A31E527A6DE4CE929382C29EA547A1E1AF4.51.3613559374.3166",
        "CD_ABD6FA3701B1B50A73FFE787EE0E777A085EA8F6AD6E40F7F06931702C098EF2.2546.1062893091.400",
        "IL_C7263827DEDABCA264F942BD871EF880F6654F4233FEEEE4101CAB1F7036B0E5.2696.1059613081.278",
        "CD_7F311F5FE12DC8FBDC8986B639AA5BA7CD954740905CF54801CF77F8F3C84DD5.221.1.8339",
        "CD_69C7869757A5F0A0B753F6CBF641632E43C401B354F79939A20946D52BD05C51.2273.3376418588.353",
        "R_8A4037032A1E93595308B4A4BD6D8BFAF65C3C979F3304AFFC616809C573E05E",
        "Override",
        "CD_349957449457FCB3DC5CC416323F05E6E56083B532266B79EAB7F5AB720C36C1.92.3411141240.633",
        "RWMI]",
        "R_B449E4C982007699901F8B11448557481BCA2B35C4809156A6C3E1390C860FE7",
        "CD_CDB424FE67340CCC2621376F2156DC346548CA8F3622EA235EAF7BC515A8CBC2.315.3520142936.876",
        "I_88D2F2C5D39410C5A7BE26450BA5AD61E3C6EA771038DB40F4AF5A55C2EEF5DB.2698.1799121420.280",
        "I_45528D2594C2AB362CC71E010181C243627131BC2359B157DF0B76661CF6C4C2.2689.939180613.274",
        "I_72E8476B7FE01FDDE3B0BA4617F1FE112ED4F621894E1B09F1A32A8206DDFFC3.2716.1986995484.290",
        "CD_DC6801328AD20F0D19416832CF71DA80FF8FDB25194CF233A39A0BBA13B68D4C.1921.866443317.300",
        "IL_7C4F072713D197EE4E568C99AF36F44343FE91E5445124B1E42D22D2719D5DC3.2695.1749776986.270",
        "C_439AC72FFBC0FB0160120ADECFB39E726F363ECF3E117EEA1EAB024AEB72011B",
        "CD_2FCB674CFB1163EE9CD1F17F7A8A5DF128F7FBEF043131A78609E5B34DF65D42.313.1795003586.422",
        "\\Windows\\system32\\en-US\\kernelbase.dll.mui[MofResourceName]",
        "CD_E168D377E3EBDC80567E91D3F17E5FB581443E43A2B4D4956F85A552763C3781.1130.2311902594.699",
        "C_91604F794B64A61196688751D972A0B3626DF7A1827369CDD4AD7A23AC00FD14",
        "CD_7C4D4C779B8655DD6A7E86DC91922E10770F67B8451A5A7276C3310C51D0FD42.141.4114077205.622",
        "R_998F3774EFD99EE364D0E26FD868917690CC4AA071C4ABAB4D58906B9D2FAF38",
        "CD_A5FEEAD1E15B3EE7B0CE8E9E6E153756A0F3D06F30B69489A8B10D8F9457634D.1780.2336313803.298",
        "CD_8BEFE0C3FA9603D25777ADFD7B22B3D62FD05669C5A791CDF5C6C494D608847F.2659.3652607601.1378",
        "C_CDD91708E1AF6D153701E44760D97DF285964853499CA6DDD22864F53E1EDBD5",
        "|x $(,<",
        "CD_2BCD1B775A7C921CCA4DF4C5E4916A9787D7BF64C3C7B304FDF5584EE4504E73.2458.4269438112.226",
        "The policy rule within the profile.",
        "CD_0B41DADA7265578085FABE671C02521DB2DADA8BDCAE2897CD4E9C1B5A49A883.1059.1144230081.543",
        "CD_A6252CAE691CD1E28C026D5CDCC06F6213D81E91E114D969C8F008BE1E621E83.311.207024848.134",
        "CD_73A800D7866C4390667315AF06F93202489C8838112B8D051CF005E872136F01.2099.465073980.4826",
        "R_58EBCE462A5C99EEA826226A8DAA39BB4E44016ACD1726174C7DBA9B5E2879BE",
        "CD_9C249B506244FB7EBFF9753C728C15CC6F408B144591C0ACA30DB0C62A64551F.2604.3853197017.110",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.3332474462.279",
        "EOTWarningZoneSize indicates the size, in bytes, of the area designated as 'end of tape'. Access in this area generates an 'end of tape' warning.",
        "C_9ED4218811E2E2DC555C6195DF95C97920247EF5A997EEA5E4BE65B094EAD727",
        "CR_DFC0B10F96FE89477D6E5E3DD30C3B04040D3B499C9AF187BD9C2AEBC6B2C85B",
        "C_75279CD6D466662C696F5AF2B95C9CB489791F508A8D94786ABE884A3FCCED15",
        "132A93204204F5A3326DCB27DE7954C1D3930FD11",
        "Specify the maximum percentage of CPU utilization during a scan. This policy setting allows you to configure the maximum percentage CPU utilization permitted during a scan. Valid values for this setting are a percentage represented by the integers 5 to 100. A value of 0 indicates that there should be no throttling of CPU utilization.",
        "CD_3AA1CCF33D8CEFD2B415A45A121A40E7E45802CD4F254AAE61989F4AA8DC738A.30.4178802298.502",
        "C_DAF09917B9CFA8B255E2F8328EEFD54CDCBF643D68C0AC3F94A83078C17C15DB",
        "C_0D9683B316E22A1A30127D06C57766F844EEB6AAA1805E5281206E24CF5C1BAE",
        "CD_0ED1C3985408CF8B2B34893CFA150055B29DB00EC2B161251E2022B947EB8ECF.1740.3860538526.493",
        "CD_A8052E229C4B03577986045187D91A61D438B682AB8EF93919F6B095EF0302BC.122.270783683.446",
        "48007",
        "VerticalSyncOffset",
        "CD_1750EE3B65915B0BBCFBE5A295C25749B68FCB3C6C54CCCEE17321E25B3884CA.1065.1409787257.765",
        "C_F2861A4DA5DC3097CDD41BE98AFC0D26991CB4501C7A9352DBC909EEDF0D4BDA",
        "C_DFC25D46E8711DD4634FF6390AFD6E0F348F88B4F5FAE966D405DF4EAE83DD54",
        "CD_A889E6B84E69B458250034D6C637627E7E7AE0CAB6FF06DFF080D7992FFD2372.2038.4097194343.647",
        "C_BE7B96C50A5D954A89D26DEB913105A5F4A1453B9058D1ED2B066A1ED47BC2A6",
        "CD_666DB799C64D5035B380E839E44A5C50645AD8652D71D99EC2F753E7EB86972B.1189.3423369310.631",
        "C_BE3C9A0F3A301859A6C844B2145A4F44B9BD768BEE695F45C60A8F416A0E9077",
        "CD_6B9E4EE8A6954AE9FF49C168C78A9585B0E76CB760D912EE50254A56C984BF8E.183.3512770443.731",
        "R_F9C9BF1D438816A18A92B3E8522F73D7F60F0DD6F678D67DAD4AE3DD5EBC727E",
        "CD_3A1D2B9036996AE4681DD029594209329760282E8301045223F1DC6AF85114EF.1955.3243813362.616",
        "IL_614FEB5198DB6356C7D4E70E58F0634936BC6DE530AA5FD952207E56B5A89D3F.1635.3418873694.594",
        "CD_9E152E3E3D8A2665C8A4533F9A4E67D0D1AAA1D8B83D4A80BEDF2999A2CA16CE.2522.796495922.1654",
        "I_A2C6426E616DDAF3FD6EF9DF2BC6CB0BEE5701377257233AC2989F40C34EF6B2.2705.2251244706.293",
        "CD_6B3C51218B5282812BA607C47ECD43DD87C36C76C979F2D4ECDE4EE8973BCF17.2525.1468751904.7491",
        "CD_CC1F5625E9A0DC3D96F771F5AFC91B1ADDC767D7F724A3FAC9E8A833EC2694A0.1329.572975323.786",
        "C_C37D9971D6153A3A2ED7382F649D1D9C05125BC9AFF86A5588FB70F9C87A751C",
        "I_C7263827DEDABCA264F942BD871EF880F6654F4233FEEEE4101CAB1F7036B0E5.2696.1059613081.278",
        "CD_F071A22EE25478DF80A205153198A6FC12F84A9E6BFE53B8E5DFD1E7E2ED2B8E.1998.2704733905.688",
        "C_98BA660AC8B20E674D946E0C26E1AD857F0FAAA173B07BD99EBA86E0CA0F32BE",
        "IL_88B5971EC8A2769F9118A68A354A2CF85CDDA150669BA79458D69ED38EABA628.2708.1268172054.295",
        "I_AF6887ABF3C2B4A743A4EEEEFAB87EEBCE0C92311CF3924640F5CF4750FD3A90.2677.2921058226.281",
        "$(lh`",
        "CD_530FF52ACD14916E0B4C64F2DBF250EDD3D460DAD5F53280FAAB6AD8DB07E372.2537.2077329485.638",
        "R_26714003925A6AD9D2A86156640EBE7CD09038F054B70A196FB82492A93E3CF9.1150.2163860510.528",
        "I_B87506E9F039474480FAAE10F0E4ECEBBFB5EAECE9FA85469DDBF991E5187227.2704.2565942758.289",
        "C_62E24D2113A63A9168766C2091AEA6BB0D5DCD627F35EF3E18E56D8C5BDF10A1",
        "CD_B449E4C982007699901F8B11448557481BCA2B35C4809156A6C3E1390C860FE7.1820.1146198816.385",
        "C_1E88F907B6AB946BA7ADADEE8E260F06B3FB1525A4BFD9A858EFE9DCEC84BE35",
        "C_60A55C37A891C02E43DCC85CF24FBB0AEC4CE837463192AE3DF9F07B12D58EBF",
        "CR_A9653E9A5DFB9E3492D2E71DB2DC5C8E5D6E1AD64D6D763B4A929A56A96F3F78",
        "C_44199FEB2EA5AA114C34FEFCE15EC340288F3AE7F2F9B159DAE8176076473712",
        "C_193704CD663D13C9E84B3DCFC7B70A6594657C5FA1EF671959A670E734FAB578",
        "C_841D3DD3F3A7F09379A97AB7745347C579CB951819312FE93085B68F6AB63E24",
        "I_0E7E7A28509E7ACE2924505EA5F22B7C7491503A0BC64FD1A201F15D5038BB47.2679.3140839499.279",
        "CD_C650FA6F92E9EB0B31DA6E7EA3E6B8E4A4D8DB1626C2311C8435199755ECDD58.1568.4094360539.490",
        "C_81E923C5F7AE79357104AE6BF842B77A8DC803A5873AE34E77FAE62049CD7FEB",
        "CD_12183719BCD9EB7D22B9308969B6B6DC3137B4D6221089AD2836983383C1EA0E.1566.8089540.1023",
        "CD_DE89CEAF49F8C74091CFA54D65C5205930932DBBEA319F95370A8BB021E5EAFD.1757.3458635635.413",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2070.810431740.180",
        "R_E28D2B7E32C95FD44C0BF23A259EE763485B5B5A1006D97B269F23A69FCF1EFA.2763.2695104493.576",
        "C_32BB09C7639B708934A441FBAAAE435ACEBB2D7CACBD541BAD6D4FBD2B149A82",
        "C_D3C4DFA37F26EE4C7CA31BA9B8E724B042DE4802517C8F5FAFF10A17FF77557F",
        "CD_094CD032BE77E24831D84EE3DE38C46FBDC0C57F2466CC9AAB2CC4B43209B790.1820.3318611982.471",
        "C_4697BA37C7F203503C8202661BE5106E633035DF77AC384B519A1851A6E29E79",
        "I_69022805775A062CC94D57E8561A4967FBB78097CF06B06D79EE411943106C3F.1075.2283585362.190",
        "CD_3AA22630705AFF3975D1F6344798271087D2AF7B509FA6E34ED791616A9DF674.2116.3684016473.3631",
        "CD_4795063CB131EA9A32CAE29CBF73945A201C424BA6E590063C57DDFF25498546.1017.2200468434.701",
        "I_8152FE70FC7FC62B5D4D4A7489CC2E328BD608A8F355E208E9C4AA34398DE48C.2701.2661185673.286",
        "C_931F785B1FFA664B9927AA05FC992B88625C615A582C37149C7E2EEFAF3D493B",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1218.932574012.180",
        "CD_5DAC8FD7A784A5954048F391B433376EC7D25E078473E5A528110007AFBF25CA.2660.3980781838.1017",
        "R_AB1C96FED05D62166C94AAB8AE8E68ADBB7D202B0967CAE80232063AA6F41C6A",
        "R_EAD7B47A72C4A7A6ADA6E436CA7769B3D175775986737A1D4F283DC99D5BA2FA.2457.1973315924.558",
        "CD_4FA45B282A1D3B86520D426489066CF088D4054B5887E8BDB7A6C026C3B8CE60.311.4138431892.423",
        "Shutting Down",
        "CD_D24A5DA2497AED481F5D755CD2B94AB194827FE0A539E58BFFD698924A2E19AC.2591.3082179096.445",
        "R_DCE585FC8090201AD2A481DCDA9678ADBEED6FFAAA2CD50925EF913678001533",
        "WmiExpense",
        "I_8E23EB78FFAC4A759215B5BD6EC35386D5DAFFB04E17A1E0F3F33C9BDCE81E56.1194.2393799953.283",
        "CD_0F00E7B059327B1D3BD2203D577D90DD0AEFBB2429D93A104A20F3A088A7A888.2729.1340677685.301",
        "CR_E7B9C3E697B3581C857A1735569796C21CBE72762137B6602CE35E217F12B5EC",
        "R_688EDFFAE1CD3706709D790A6046157BB8A78E3308174A187E2C588BBB236985",
        "A Windows error object that encapsulates what is in CIM_Error as well as includes error code, errorCategory, errorMessage and errorType.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2197.3686679771.180",
        "C5F52539BBAB4842ED5CA9AA74B8557B4E57EA2.2656.3167788945.1092",
        "xhlpdt$(",
        "IR_8ECE79C824EFDC6E9FFF68EA4E168D115D7DE1CFFC679067A8D896B92A7EFA00",
        "I_69B780709DA4835635B0B7E8E54790634975F2907F04C0691BF6F48A6FAFC3A6.2689.4259655786.279",
        "CD_DE441B498E4159017D84748ACDE9ADF7B1C36301A35BECAC369393D024220578.2621.2327121410.1793",
        "C_E091E6755173CEDA0C35AF424854DECB26CF90627B78F06DB8E87E6ED8C5E2E3",
        "C_4DF972D0AE0EDCDFD3BB253394B1DE692787B6CBFCFAD61D9568CE731F4B1BA4",
        "I_853431EF6C8B798EAA2D111F9739ED97E1865E4FBA8B3A672338E34872D31B73.2708.4102485842.288",
        "CD_7D462EA5E87CA015476942A58BACB3893636973868980DA68AC5EC3B5A1C690A.2390.2364638125.358",
        "I_F98CD8F4EA96B0B77910240E3039FCC377A97641ECA44728EE7350A6200A681A.2462.1414865239.293",
        "4865F4",
        "C_88D44DAE596A9A7ABF169CD599EFF3D9F693DFEA80491C3B4C3E21A1F5B46218",
        "CD_FD3BBD4C42AC2F7FEF264340A9EB78A581FE5C28561CB63EDF780B329EAC2EE4.314.2317161516.637",
        "CD_2504DC1AC3CAB9C6ED112DDC44AEE64529224B292ABC0946F5963E4C35C80939.2104.3674360256.321",
        "C_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2",
        "IL_A2D4B4B82C6269DD07909E5B5DC5E0F6E84A20AE4467E8B3A5796CA9C3D1B809.1016.914295214.287",
        "CD_009DFC3DA14443327C88310F7AB659375A268B5057D937CC75544FD68DBB5B6C.2522.1844574827.1108",
        "C_C3231029EA3655A198378DBAD554A36F17B1E70A6D27BA95F2106CFE9A117AF6",
        "IxWorks",
        "IL_E45C027B16EAF2DF15CD7F551E5D76AB67032F42F3B3C9F37B53C66F456F15A2.2703.3738519472.291",
        "CD_308A38A70C7E63C8B0D223B592F8A2FBAAB2069E8358BFE6F473E432CFDFF602.1083.245337019.1521",
        "CD_45825D5E91CA2C0282764680BAD49693442FDEEE8D15EF9FADD54C4BF9438553.287.3011680134.5949",
        "C_D03948432DCEFB99FB1EBE3230848319D45009B95943838EC079B34AD2F12F73",
        "C_BD27ECB0ABA308B208AA9811DD1A6EF25258EB65F89EC1120D9161B0217F9A7E",
        "I_B1169607B8866983843438F9EA397897C0E954A6BE0361A15C053E12F2A28323.2714.2625135702.303",
        "Profile",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.1130.3648072470.305",
        "I_4A35B9B4278AD0A1F24B1AAF522E8B6CB7A60CAA33583599FC981775EA0C6B12.2714.3182888042.284",
        "C_E706FF8586C52A7176ACA48D7702EC2A6550564F0E42B0C09AE3FD1CCEA62CD4",
        "I_3700AAC1070AD9D4B538ED8C2992FCCE657B6C2DD716241B57A2876AEAEC8B12.2711.362692361.301",
        "IL_EB041A3B8C4000AB0CC2CDFC016E1E9D7CEA420AB2D6A1D6DC1EE63EB5D1E694.2676.1673060838.269",
        "CR_AC11DDCF9F71868BCCF23A662420DD51F76B4387A8230D6D41F7DBED8D2981ED",
        "IL_2671C73C258D39CEEBE8399DB62EEE11B5B9BDE263220703C7A03C2DDCA3D03F.2735.3906584807.277",
        "I_006AA8E57BE8BA283D94ED2034077307A9F16665C71DF3E25108F9CBF63101CC.2685.3162186238.284",
        "I_5861426DB1898BF735B12294D300CB3D5001409210FEB3C59817A2905E79D070.2719.590350034.274",
        "CD_A03C484E06B72F9F42200B57F029B8D46D26D0855AF12E8562CCAF99ADA5E20C.2645.3327710553.878",
        "C_E7B9C3E697B3581C857A1735569796C21CBE72762137B6602CE35E217F12B5EC",
        "0564B79C971B071B8FF493DC4B322C80DEF00E0.2698.3362086251.265",
        "77263EFE22A55CE495.2573.371737832.801",
        "CD_73C8D20F8CA3C376F0CE63F48C27E4D700E969BEE425C758839EF39468252510.2509.3938073032.631",
        "PerfInfo",
        "ConfigureWindowsSpotlightOnLockScreen",
        "0EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "C_8C64C742C17295C471BDDFBB0449A20033FBA45FC5101E58D4755F4826009F5A",
        "I_55BA3B97EE945A5FFAA048F94EB0B1F3BCDC2B26C8F2588BFFB42050A21365DE.337.1.27578",
        "CR_9B3B36A993A462F50891454718B9E94854BEF6CDA6B45E39722B69B985CF4900",
        "R_D191D09F01E11CDE861309DF3A3FD6CFDF2B4DE2CE06D9CD8DA51C330712DAAB.1606.3997140931.596",
        "CD_3D509F135C704C49652422902B33D6493BA6C4A55FC967E5BDCAA83CA4EBF452.2424.473452105.359",
        "I_53C427DB57E8A19A5ACAFC20C0AF8B6240BAD1E45C16357EAC3FA912BE065D83.2729.2968553115.281",
        "CD_AF16997CB3D825CB74BBA4887FFB7A80CD0F11C5EDCCD8A5EFB1A99F07DA008A.1584.3464001776.548",
        "C_3070DBAFEE4F7008DEDA489E6F757902F4A0C6C19A468539B18D22506961ABCA",
        "CD_133926115907D1CAA329A707F5DA6057F1FEF2436D8F8041CFE6E68664D6F252.1650.1668108287.1331",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.2207877211.368",
        "Fibre Channel Worldwide Name",
        "CD_84BBAE9FD8A6E21188B2D0767DBEB321A61D32EF3C67D9E47C565889A9DA260D.2139.1.28036",
        "I_FFB3E5C121C009080CCC44132D146B4F5562664D372BA3DECB8C397705D66D57.2708.2176848505.299",
        "CD_8757FA834BF17A34F40DA9E567F73EB3C0F519BA77B457CB4D641370202A1355.136.2612425163.4347",
        "CD_693EF552E8CAE369E34FCB40434845C8767F2347237F1BB15463E74153D4460A.2580.1701935114.219",
        "IL_CA7CE6FFAF43B56926F209A331362CC194ADC07878E9BCCA1137E8869300AA67.1934.2742554124.269",
        "I_47987CD6E32FE7ED5FB71E452946B1D8462D3AD25FB05E097182677D008F79B1.2701.3567000716.283",
        "I_56FE5B970B13F36ED26A6D17BF0D2D39399EAE8A7E20EB72D88B464210DB967A.121.2445847948.336",
        "CR_021AFE414882C03F97BF442E09455A26212B908FBBC7D7673C42DD465658CAAB",
        "optional",
        "I_E8BD339E775BF7B67E98E8F320BDBE14F99A5C435E7E6A3E02A0986B0E0FD8A1.2723.2988866746.283",
        "CD_68988603F70E94DB41A96D6CCAF4C1247D2A19BC8932E751AE8871C31295C890.2033.4167959155.249",
        "CIM_InstModification",
        "CD_6B75EAE7DA24F2C406780BC48759E37EBF44D76F34B10EF1ACA92766DC0C80B6.1603.2569108253.266",
        "IL_28D48A04944306B5CD569F65525DD5EF6F0B43EA24A0CF8D60E0BE8490DB1D5B.2686.173290860.280",
        "CD_FAB579260306CF6BFF8AA42E9AAC8900DD8AC191A796F9430DC39085EEC7005A.267.189624009.789",
        "(xP,048<",
        "IL_D67FA0E2D6B2C1F4DFDEF7C2BE6EC3EFC58D057198BE2F40A898AF1E61F9C357.2735.1414614919.255",
        "C_1C238E1735BD05B8EF9AABB593689748E0D68B3ECED3CA94445FDC58B5AAF1A8",
        "C_DE00475055EACC7B53BF4B3D912C0AED441AE802F9CCA17A5072BACBD47797C3",
        "KernelThermalConstraintChange",
        "CR_AB6B0E99E53700B220CC98E6FA99632EF2E30AA8973E530FB5000EC341F81DBE",
        "CD_49077985F3FCF4259B2FE7EFC831F5599CA91F6DC9D11720E6A401A1DE18B2D2.270.3138366782.649",
        "48|<@",
        "CIMWin32",
        "CD_BF0F21E266EE238DC4E72C2DCD37785DB8C507564B3E0146DB005B5CB91EFD01.1342.3444562005.656",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1780.1602717935.368",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.2026.1.14291",
        "CD_EC62C68E91498FA5250165B7C03BC75644EF8D409182A707B4BBEE31AA415BBE.2626.1733865114.363",
        "I_65436052C3A80A93FEAE3ED18ACB04B9B787B61D1528496439774EB92FBF6C06.2677.676006112.281",
        "CD_970DC7308218759AD490467E5E7DDEACBB9B35C9AF8457A911A09ACCC5B3AA93.1779.1383867497.284",
        "C_DADA39C9F5808DC66D6E1988FD49B45254900B6EAF0B3330E6A2D8FE43FB40BB",
        "CD_E2FADB78F8CF602A6380BA4884A3104114B6539650C2B9840B980ECDEFA5DFE2.2599.2718591851.1527",
        "I_5C128A75C27B4985F58BF9F60D25F3AD1811C55F8449A91D8301FA08651ED431.297.2524730711.305",
        "I_8ED0EA60D093A2E63D22BB854FBE45BDB48DF080F96CFFD85EA027BE073C5B0F.2704.2679211722.287",
        "C_2E052A2746A43D11BFF3F6205A3F0D292400CF9B8F3DB09F6AD7A671FE848750",
        "CD_1F1EA86E0738F564A4BAE50B2508172878C88623AEBE218CE1455E5B6B0990AB.1330.2254695828.1702",
        "I_9910AEA82606F44A7D6B3D0FF84B5470154C1782A7044B0BBC20DFD85E449BA4.2675.4136205236.274",
        "CD_9C6533291E4DD91EF4ED68CF5DA821C89662F59D10E141F7ECDCD9D24EAE02B2.1343.23889309.1646",
        "CD_E837FA5B478BEDED44320E3A480DE1EA4A5820B99185EB351156356529FE5C28.66.2877317343.675",
        "IL_C9D8708392C35375A49B7EED2C8C85B729536413677A139F9BF0F448A6D4EEA8.2686.1176899886.272",
        "I_F41AAB3CE0418D59CCEE78DC6089E8A71443DF08351201B015241ECCC0AF9C70.1617.2645183154.291",
        "CD_8DE46DD6446B26621A23E11758AE5CBC62C9F72998CAFB08B9CD58DF66902A20.1150.1044209753.111",
        "CD_065D9E98A48D34FE9F1D987AAED57F037C48B1B316F34AE66BEBDA2778004AA0.2585.3834872716.604",
        "IL_3B1F8D14DBF658837F8A27B4FC1CBEF2C9EF4FFDBFBE5223A429267C3BE52B6D.2695.1116355637.263",
        "CD_133926115907D1CAA329A707F5DA6057F1FEF2436D8F8041CFE6E68664D6F252.1365.2744259024.2750",
        "IL_C6E079375627804339117553446740B978F04A91C742C9238653EA9A47C3734D.2726.1232622594.274",
        "R_4AC7D53B353FF907A3871574884AE20E2C77DD82D160B77856929A17F6C699D4",
        "IL_5196BF4BB193F5FD32B65F33245729BAACD84D68DE23317722BE58D06EBE86BD.2719.3575025858.280",
        "CD_1E1566DEC98AD7EEA11B96CAEF5FEB6AE754AB31A01EE8B2B82E97FC4849BD59.1876.3468491122.414",
        "Analog Composite",
        "C_A5134EAE65D9DD02F6CE0E924C84D387C2BC76C9409B3E6C9F586619D35EA1DA",
        "CD_7B789191591F6BB6418411E2C99653D88E4DAE1F81AB4F61C94D864C91D8A17E.1927.2873052378.1039",
        "CD_C4D20EBDDE2AEA19F49E976724D1B5EF2ADE459383EA4FEFD237CCE02FF2D7AF.2402.948880826.4130",
        "IL_0B880713D9DDD00F98918C43E596B37E54E0FCC69C63C301BFAD6A21567EB1D1.2749.1149044396.311",
        "CD_94BCFE87DCC2646309FB0D14E8A88AA9E4F4AA46940EF1448DB7AFC278BFB67A.1198.3011294670.1997",
        "C_639FCCE3DE726C47FF30745340C22FCB819E5E4DFCA7546346272EDDA843022D",
        "CD_B7CFE88CDD4E2F20D43EF63AF2894F6D14A41F54E4CF74F7D9A3F5B4EC2A87C0.93.803000614.302",
        "C_DA60DE4570557569315706E8539F2BA1D42DB73DA9542D7DBEAA586346CFF0D8",
        "IL_2C3E0B2C69ECC1F533E094C6BC0D6FE2FF50B62467F6FB0D4116BA80049303DF.2505.719625217.277",
        "C_60AA0DD1DCF4FA1B905DD3ECBB508AF58D5505CB25A3C465DECDCF71AC8733AC",
        "CD_8138F4ADEC088E4095888DA6FCD94E1E570F42A36E273294FAE982F309E8DBE8.1331.2152803909.1567",
        "C_3D8B3BE74C15E9B9148205F8633C142A46D7E9C2614D82ABE33663AFAF5E91DA",
        "CD_368BD7751F09B23F886CCF1FE4F1DF4386BB04C2EFE8F0B6E31192AA3206706A.1188.3047281282.389",
        "C_3291FB921A7A46D993643033A1F3CE6CCA102D7424F9ECF11FD996085AFA4DAD",
        " $(,048<@DHL",
        "CD_8AAFE17C9D1EC81145315BD7AEF4364750F7DBC256E4CC6ED0176BB03612DF3D.2661.712252557.2213",
        "IR_352DA062E6CEF4DA2F5F5D5156A0C6A57E2D07D0BD43F09E3B9B31D33B72076E",
        "C_37B5E41337BC2DEBE4978DA36B66C355BB5CCC6EACD73D55AE155C2E9032B9DD",
        "R_161D7B1F7DD552C780B6CD4154D40388F29AC0271BBCB7991C59595342903A38",
        "CD_A63432BCF943E97E2C33E4FCFB1880CB0F896835B1EEE341FAE246D77AE1B7A6.2626.893283825.1385",
        "C_149A27F19116F7BD8DB3767BD20FC5C894B45C207E040B561A2205EF78DC6727",
        "CD_BEAC6077B19FEAE9A9DA302629391F9E0FFBBEB033EB1ABEA99A1F0843A415BA.1757.1026585916.219",
        "CD_7515FB6DD2F950E647AF60DF9C8580AA8DEB2180D47175E1411F8A1FEC246F58.2541.3418714729.520",
        "28ED81B80D1B393A95B0BFEDDF76F149562E9E7C25315FAC12EAA",
        "I_D543C25C727D8BA24D15B6C786ED2A97ED948A6BC8D1300B880D38A3D6BDEA76.2710.992717518.295",
        "IL_F90254E7F99DA09977CCA3AFC876E2F69B143A5C7B620A38194806CCC0551447.810.1.92690",
        "IL_8E80D45658E49966FC3BA567F2C75690AE48EBAB9A2568429675180214107ACE.313.2989851214.331",
        "IL_662CB144681343CD914A84B6324D30356940F0E892AC14E72E79452BFD8511B8.675.1.129842",
        "CD_D47B33577EC858000C293FAABE7E384F7739B0EE6B3E7807EA011662225D073A.2542.1735358894.530",
        "WNFNameSubRundown",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1355.2680984201.368",
        "C_D6B832D04D0FAB582A050E5212201E6DF3C06194D4D96931CCBF8B3053F5A8AF",
        "CR_DDC6E09996B73E0FB9A8193017E7B68C6C9B1BCA3521A86A20F4A24B758197AA",
        "CD_85D86CD958DA6FAD92EA55F1468078F0400F29C2B1A327B27C870BF7829AB8FB.2384.1560996453.679",
        "C_A817CD7301A4ABA1F178C5EDA10546A2B3AB52D7C69BA07293F2F74500BB25A5",
        "TX\\`dhlptx",
        "IL_251DF572EC65B42D6CE95DB4C839FD6728CEC6633EF525F0041081BB60681183.2764.3651258659.284",
        "CR_C494166FEC78B76B06AE6864E10BB6C47EF436F2498312A79210EB6DD47C6CAE",
        "C_49844BBFC96404D65D55FCDEE9A5600B03E3ADA7C6190D9FBE82C292C1309911",
        "TargetIPAddress",
        "CD_9611302718E7A15BA3E862472FA9FA8DC245F3CD224631FF3A3E4FA636E2150F.2450.2865795302.3817",
        "CD_612461B1AECF14916F6F139FD9951F2BD0CB766E0BB9EF5DA8A04D9DEB890739.1.4166332249.177",
        "7A54865F4",
        "C_0E57EB3F1A7D6D6BFAD5018903326867777DF9485215366835D9D5F0137A3957",
        "CD_8D99B89B2E26FAE38502F957460FFF2E9E23E0C0D9AA3DEF32147EBB968C38FA.2281.1.14554",
        "C_C1E180B8C4366E981A2C239C795361E39EE450204A5C13220DECE0EED4E40C66",
        "CD_BD82A3E4DAE96B9D019F35F334395312B224B9780EE811EA604360572C2D700F.2603.1422653025.959",
        "R_2B7C33A8279680277817A99329ABE8DC59107022EF9DBDB1B01C276CB7BD1FDC",
        "C_79E3C00FBE813A068B3D4FC2E51AF90DABBF6243E57E6DCF318C4B1FD4AE43E2",
        "C_3ECEC01C420881AB727C5A252F1906D89E4F18FAF1CF2242E43D26D1EBE6804A",
        "CD_520F4A6CD1D22F206E6F5473B669F39AB1310B253B4678DE0F3ED216986A8D0A.264.2906106334.566",
        "CD_1388B74AC4B1A1248035D019490B1CAAA479C4415233A9E50223DD0802BA383C.1086.2621525828.3304",
        "C_5FB7EBFF7E65F2B5A8D86A305D94319B3C99F6846C3536F671E3F448D940CE69",
        "CD_A81B2D0DD0F49E868492A07EADFA106D1177E12B072E8318DC4B7A46173E1B79.1617.3352721354.1528",
        "R_D1F35069AB830308A3D10C95EC411D258E0A9CAA2EE0311B34E2874304803008",
        "I_4A337591F2CF0CF9A6CB36702CB9BA02C480D747C7FE0A4839C187B5572FC7B1.2709.917778799.288",
        "reserved1",
        "agement.",
        "IL_2FABD5DC9514710EE1BF357E3FBF8C8ADD2AF7CB57C8EF370C70B000742EAF75.1015.3553313196.320",
        "ROOT\\CIMV2",
        "C_008720254C2A979DBD5FF3822840A198E79AD81A362A92EB99483EEC5D47BE05",
        "CD_2D6319F4E2ABC488E243ABEE465F201E726C9CD7B9C330B609A5B7513F1D6F64.2654.1359971781.254",
        "I_46DD1BB7F5B8D9BC8ECB86BDF4577C99E7C5B41152D22BD4A0AC4D02CC28DC08.2719.1829428774.280",
        "8B3FCA354ED30E3.2713.942242480.280",
        "lBi!Qu60-o*",
        "Win32_SecuritySettingAccess",
        "I_76DF8F121B35B901DBCADF39EBD6CEAA1050C4BAF7F1C5586332DBB26DB37A7C.2684.2034701232.277",
        "CD_EACE35DFEFA903EFFF474056F16C7A19A63413AC446BAA0A098904894E200955.2580.1227929941.261",
        "C_EE35AEE540BCEDF1393FC978093FBF16399E5CE3BB4E7B096885CF94D130CD38",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2087.1221336150.368",
        "I_8E0EF69C64DA2AF767F8E9EFF0B4FBEDF5E6A6A340A2791504A639221D742674.1017.614505437.297",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1751.3778354227.368",
        "CD_AD5A2EDE3B100968ADB1F1452AE2EC6E58BE68D49F0D944D79D414546C72FD53.1346.4022005083.1255",
        "CR_8125E110531A89ED8BE4900320A962FACBC3DD4F09BA92855250F1BACABA704B",
        "I_9CB9F81BE75BEA11C08735F16305ED1D2CA8BFF8BCC1583B6DB3CB9A58E5D94F.2706.3731697791.290",
        "CD_E0C7C041EF8A11355189C6C96C368318DB11749FB49518CB2835E8C2CDDDA84F.2603.3016147683.246",
        "CD_80AFDCC52F3C92AD7D0F8DD0B12150C7B0CC34A13BF2D3DD52C62A73F9713B79.142.3386108903.629",
        "C_7C97DB83528DB0DCCA024135D74FFAAEB94DE3136E4FAB4F9307AAD2022D7B26",
        "C_2DFD705737CCA1D522B20CA726C52DA2B2D27D5AFDDBDB8AFBAD6D71A22D7026",
        "Inferno",
        "CR_0A6750C7348B537B441FD2B8326BDF41C8B5D59AA69254D1D9F804769C8106B9",
        "IL_D2146A2515BBD75A542FD6AD5B1A96D82E9D9B2E1EFCA80434625FC396EBECA9.2692.3432124425.280",
        "IL_5B0EEFF670B23DA1E99ED32344270F1441B2ED2C35FF6E06A821F3F443893C45.2724.2638166538.287",
        "CD_DC3A6A30F007DCD045F5089406AF191C1C019C8CBDB2E14C9BAC58E0B07332D2.2556.1200091525.589",
        "IL_8D616FBF552F3D3BA75D6013C6C4ABE6161A9130C129F927767BE486D9ED089F.2728.1564545401.295",
        "I_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.1577904231.338",
        "R_A58EC39ED92649A90AED1FFF5AE4D021DDCC83A8D429CDB678D3D29879253FD3",
        "R_D172EFA2080CE350DFDFAE6A5D34FE8BA82BDEA6601BDA4F2D918AA80EBB1C1A.1782.2344064522.540",
        "C_AAF92F4AEB44CCFDCDB6851E9BAFEADAE27700548F383B0D561108FD346E7419",
        "C_44343FA1011CD581BAA71CF6D5100CB65A1326765FF439F0714CFF1B592561AE",
        "D8AF94E43CAA7DC78EEB167F2FCA41288361566745343E55E2730385A1CC51D",
        "NS_3D3E81DCD26451B69577998483A82363FD54E34563AA1BC6E73E4A2DC2212802",
        "C_D3EEBB9E3A4C5F3CA348B142AF6727D3A274A152187FB63005FF1EA0DBF75FAE",
        "vE083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "CD_DE5458D3BFF2A527DD725F3F09E672B546B170976DDC415866356D5387ABFF2B.2592.3986514447.1157",
        "Never",
        "CR_18CF4DFADB65FD9009884647249EF310A7B2E05DDBD0DAD1404A0AE55A5E4EE4",
        "C_D729555B7FEB75947ADD3C4B89D07DE5A4A88893D5891FAC0864D3A7C4363767",
        "CD_1802477891179DF8EC75B73A6EBAB451AF75EE927AFC82B42A82BB6A29F7E4F7.1564.4244368942.428",
        "NS_B6791A1CF7802A901B1534CADBB1A0E82FB154100B2BE08AF47386C43CEC462A",
        "CD_EF67B600A31F150CE962D694F9CA3072B7F784C6A34776FDD01BE21CE72A06A9.2065.326892001.940",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2013.2058938227.180",
        "CD_FBFFFF984DA9B7029EE7078D02385B8FF23DEF8E12B59491A9BDEA2549806FA0.2309.4148426985.252",
        "C_2904A56B86DF2CA3C261BF05D03341C4E0057AA3C11828ECC37BEB4E97435835",
        "C_4DCCEBD0E58C35B09A2D042DE05886080ECEF7D86F9C682EB2F9362B7BB75582",
        "C_5F5583215800877E78DF32C89A95963A09372E548E11061C174A3C01BAB56758",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1797.1859355143.180",
        "C_759160644DC63F3466AD1F94F864CCEF928FCBB42CC94A976BE157D734014BE8",
        "CD_07A0EC78D0058B8682505D47D43629FCC504426EFCBD83A930870EABFD27DA03.2663.2414356778.1525",
        "CD_25C2E8C327D4AE50AB0B89215561563C42973CDF72E4E8164880862FB1C155CC.91.1726103446.4674",
        "CD_9978C56E212E6F386849955B323679D38EE89596C89F4734B0D545F76D348E8C.2561.3322729629.288",
        "CR_A58578087E737BC8DD57D102F9138F5ADF8AA5D8A71EB3BDCC001417DBE8780F",
        "CD_D494E9A85935E059369DBBB5BC793F2672E05B3CE93CFCC0DD52A3144BCDAC07.133.670860093.605",
        "IL_2A150544FBBB76484A8148DF5C6E123C9CD69276BE55D6BEDB1E3BC77F0ABCD3.2603.3134352859.264",
        "I_0FE8DF8C1589996CA7CC6EF89C3E3F94B16EDB28E99D479F30DDCA4CE5D31A8C.2683.2061049043.283",
        ">A}DGJMPSVY\\qz_btehknw",
        "FileIo_V0_Name",
        "C_28DAF7E88E6FDBAA130469111BCF0046D7AA8CFBDF0A7839B0A4F7215AD3B619",
        "ACPI _TSS",
        "I_8B68560B534A6D3AF089AA733C222DB25352C8528E5767D325B8757B271F3DD1.2508.1388436070.319",
        "I_C72044C5359DF7DC4480B7B809AE99A37C9C4FD06BB902C72B46C39D4D671757.1635.1430452203.331",
        "I_09480CC6DEB5AEAC0139332C064B4C7482AADDD84861ECC4B22F0BBA658A69F6.2722.1887683225.284",
        "CD_062E519DF64095D82428626FCC1CAD3361E295AFA643D5462A0FC5A948BBA34A.2576.4135736689.748",
        "IL_8CF241F803CB0862FF2769516928293955BEF82DBEAA565EFB3532A22F8FC545.2698.1545650678.262",
        "IL_0C314DF96E761C034D165A1501D0841DA1AE57BEE9502F0770706CFE7C27A0CD.2681.365970129.295",
        "I_FA8D6584E24C9CB0FFC473667C368081D67B52C5B3009F5AB08ED386E2E200EF.2735.4075645096.269",
        "CD_527E06AE9ED45572524985C48E4812D5807B4FF3D509658D30652F5A852DD578.1958.1149230390.1359",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2012.1282760975.188",
        "{106b464d-8043-46b1-8cb8-e92a0cd7a560}",
        "CD_73AB2C44348A01E13C5063D68EF8BDE94E3E3724E6AEC9BBCAA1E2B765F4DB3C.98.579311882.539",
        "CD_B209BBC3E9792036932058EAFDFF59DF6B02D2E0E24C683DBB3CFAD2B25B83E4.1076.1807381798.631",
        "CD_066880EE966FE7D86CCB39E13B59F3C7EA026EB96DBC471703C7B38EF25FC1D9.2118.314221584.2028",
        "CR_B86ABC4D1EE90D7126458C6EC17A93CCEFECD640B6A53ED0458FE549AF95A57F",
        "Kill (5) terminates the job immediately with no requirement to save data or preserve the state. ",
        "CR_59BB151BFB7474042FE846D38FA0CC3A5BA58498F9DD04AAF5BDB993481B126E",
        "CD_BC9D109850BB5F86324C40247B677E50BD3CFF55E165C6078CA0EA6516A48293.42.748017759.224",
        "I_F55E9786D9F50DBDFB52762DDD65690364DF865004D37F7A0B919F2DED2C5FD1.317.1.19893",
        "SubProcessTagChanged",
        "IL_2EFB2E44A08CC0240E5F136E492FD5AAFD33E6E4C30C7415C463523A7D9CD20C.2722.281059034.284",
        "CD_50988C8CC93A3243BAA0056B1B959C7138E8342783269A1D2B5E4A28855995C8.1226.2919186742.373",
        "CR_59998C21660422211077DE80E05C8A70A59B3233A43120323CA16489848947CD",
        "IL_D22B8D1F5200185CDF4705D911B911B548FAC3BD91A19AE1856E5948EF5C11E0.2721.2675826227.271",
        "I_5037D6F4133DAB53C25E8A10B85433D457D537E5B935A718B1A4E5B097F30338.2681.1815089368.289",
        "R_6B2889479D57435939038FBF287B4AFDC16FF0B74EF9BB25FE6D86160746289D",
        "C_2B7C33A8279680277817A99329ABE8DC59107022EF9DBDB1B01C276CB7BD1FDC",
        "dX HL",
        "CD_048516085D0CFD11B2F57F36AC760E979F1E172A7E7675BE4EBC8F8315497197.2031.164533271.1850",
        "C_B2287B7C7375EAC6C3F512941317C3A57D34B32E4D080470E5E3D04FD567BA70",
        "IL_61E669D3482C420F68FA27C086C8D9EDD1797B7765A7ADEF6912A148755E11FD.2466.101741563.345",
        "C_AC08CDDB7433769D37C6A6528B8CE57C28FD33ED152F2651E59B9F045070D6C8",
        "C_A3D3980C32FA18D3D98369F8A523D2756A2B0B161451E04A631ED0FE459C5FA2",
        "CD_C812FBBA98D80A521E33E1EA4E536C9F826C77210B7D8EBBBF12D800100FF013.1338.1592818059.2378",
        "CD_53E2FD0FFB51ABA71858E426B303DEC34233148AC0EB2A228D00414FEE947F52.1925.1297061448.1054",
        "I_9E4BACCE11F49E9D089586BC1222A0D92425B46D601EBAD2E04BFC3E26B9CE55.2451.518996735.362",
        "I_EFB5B9C1041CCF3E7FA66D1E6B52EA2AE3427BAC920EF4D8C60CA20D6D14F1A0.1015.269104203.318",
        "C_7BA21797020E5EB245196B97A8498B177A1484B45C0A889176D1BFBE8B23C41C",
        "IL_59F51D139436E0D4074EF36B3D938375E75E533F45C88D96B575A1B7A1D8E980.2675.4184411164.276",
        "I_A30FC1F5DC72C77B62FBA6AA763CDA99FAB2150F57E392AD56DB55CCB8C7A0F1.2725.3192501927.277",
        "CD_9D13D81A0232A3B9A054E304F017E99ED70EE31D77185E5048D602C8F68F1D2C.1152.1291903130.313",
        "C_55BF0CC0F072F8672008BA2E217FC98D14173100D32640D32F61CC0295647162",
        "C_DBBD84EF91CECC27B905BD3504998EC3FAFFD6A1F5D11327943B474B842AEACD",
        "C_549FFC4FBA712DE9539E28A7F1F2C8B32CD81A7B8C28FE57471160A51DB75A89",
        "CD_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D.1076.1810676713.656",
        "CR_556307783B179705B33BAA318D7984C3930279E4ADB250162C31F9E9AFE4C3AF",
        "I_F023674AFA828B66F95ECE31F54E284BD33C3FE845D503CD7E6993EC70473BF7.1606.1049670122.283",
        "CD_1A1A53BAD8EC584BD47E87E10AA8670CC6D8419F3C4B73FA6EEAB440322DC0D1.2650.3614681444.340",
        "CD_39EA2BFBD151895F8DCBD416FDD9E78356607422DBB08BECE9A9C96986D175E8.2398.1690085052.4002",
        "C_3D2C236C15D0F323FB188363066C67D486CC3E23871B0BEF2C84284D4CE5E729",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2005.2212459440.188",
        "R_89FE4ECD715508D84EE36BC94DB9C9AB6DC6A560D227442061D4288D96910660",
        "I_51FD9928A924F97AEC47AC385D2242232DEB456712B122ADD342F3AD6F1CD6BE.2707.2926557893.300",
        "CD_95092F78A9C37B9D260D753733F7A0C73EB4F2C2027E3035DD546DE4EA2081AE.31.361357102.471",
        "CD_3F1F5B0124728EBA6D42EABA879A91BEA7E9F4B131CEFE546919F2735EBA71AE.2539.1407097562.4895",
        "CD_964F20DA1C400CE151EA8EC979C4A3C348C750A3CA149AFEC7BCCA722B6C159B.1594.784355997.4231",
        "I_FC2BFFA6927303B4EA6E4BF8BFA5EE1163BF97ADE47296175A18CABC7358E25A.1187.70584318.272",
        "I_81E98ACDC034F2662D7DBA9846C0A8DB94AB1CCCD39C50054DE08EA9F05DE08F.2706.2270185458.290",
        "Minutes",
        "IL_EC4DC3F74F551BD4B8456553EDE829E8215C20D87303943D11958DAE09FE14B4.2700.981983202.285",
        "CR_C17ED95D6E5740D010C5F626BCBA6BA13C3D25FCD60EFCFD20048944A39B3D79",
        "IL_C20E56EB2E65971ED5C22E174345743E7BD76D73CB6254329CB6F50447638312.2684.309361084.284",
        "CD_3079E8CD6D46EEF3BB8C478A433B73D0DE2B5FE05E7E7BFC923B4F14ACB286EB.2424.1254052030.290",
        "C_75B21F448BC6FF62B3ED2CD311F63E496645D7FB9BF098798AFD0623A4CD84C1",
        "<?BEHKN",
        "I_0FE84CB7228184819434E73184A33B5694CEFAED93B282C50B930127F187504C.2437.1645229334.340",
        "I_8B1E3F8EEC98FF9E9A63E350C8B58C9798EC80B84653C13E848134F7D8974F0E.2726.1034906803.278",
        "CD_BE54B322833AC65DE68786188F013C51591B282969E32D07CEC53664341FD910.2591.2096913816.865",
        "CD_DEA3C51A2D748D7051B755F876B97982E816BE2DB267FB610562B715E38208B7.2038.304946625.540",
        "R_BCC51EBEB630858C0B60676634F08D5808792D53B6A2D49F8CF03616958EEB0D.1489.617488568.568",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2483.1844274872.188",
        "C_7006D0335AE3481FF77E834074E3321CA4F5AAE95F4A071E78CEE5CFB4E9C23A",
        "BitWidth",
        "C_63404A53FB7B216EDF22F40A99FFC000AE78ACBAEE2E0500DCF9A7DB75A05D76",
        "CD_EC28E29E31F548462327C3037DF69482A82EBE159236DA81AE2E5AA78F5CFB04.2065.2779075191.4022",
        "Msft_WmiProvider_ProvideEvents_Post",
        "WmiMonitorID",
        "C_B73E13EE752D9B5AF02139CC8E7B9DD86AA46977B13267D0D5F674F26F8C3D67",
        "I_4B9B47F6EDC52230392E08FC2CCAE01B11A54C85D80BFEBBC4538BEB865CB14C.2712.1584944247.296",
        "IL_045CFE27C750B20CB09678A5CA4B96A84A5222123992F703B6158216633E7E1C.2697.3129233330.273",
        "CD_95CE38D55F514EB56E1FD96114137062153D80888E94FE34DB4826CDF9096258.40.259309307.677",
        "CD_B837FF0F19509FD7BD0B7ED8ED2B62529F924B69EF7322F8463864ECBCB01E5E.1150.4219520086.576",
        "IL_406A72FE793A4805DC903FB7024A8085AC2DC3BB8C9083497905DF519E60AED6.2692.2615689736.263",
        "960;D",
        "I_5954B2EE48B0569ED1CF47EC527342448303BF9F4B0D574E1C6226C072A73F74.2683.775160014.282",
        "C_23723A40115126D6A71E3769E290B77D9B1A77AD1C76D6761CA490DE9745C4D1",
        "I_8C5CF52C7DD2615E7DAC6A75F75E1D7B6BE4EA46DFAEB33CBF8D0CAF178F9316.2713.380049439.281",
        "C_4F3E89FFD328D071A7EF820B6542CC8779DD91A8E0E7900B2A3BF4F5F4353427",
        "I_A4E2903A3A34AD45CD7D06F2387E652F3EF1DDFD41BB20E9FD9AC04B664AA48C.2711.2906657682.293",
        "CD_3E78A37E1DE70357C353A15D6BBB8A17A1D31F8D501ED8F1C3EB8104F5B04F97.299.1189181731.561",
        "DiskIo_V2",
        "CD_B89F81602D340760DCBF9C7FA464908E742B64A7C6E08A776FA3C9E7E3DE6507.1996.3495195868.2169",
        "IL_87FBBD5975CFEEE24A1C3398DD5EAF7BAF9BE214D71EE1C4D91AE8822E452B66.102.565038793.347",
        "C_B22B427F2794F083D59CAB3CBAECCCBC3A99C22CA4382A86ACBEEBD3E7AEF4E7",
        "C_EF9D1330272D4FA53F4D27BDEB85692B26627659356689430C4A1C94857C96C4",
        "CD_9FC6DCD975DB936A96BDA112F630B5077DFAC45847E4C4ADA37D138916DD09C7.2614.1907654900.373",
        "IL_87B7817CF998401290480D0C395A2D3099149668173D3F9C54C86527493E4F5E.2689.1144142057.266",
        "CD_73F9CC8D0A2B5107ED79AE2372D78EAA3B2A7A24FD2BD2876517DA1B42CB16AD.1078.897194461.725",
        "C_39F7C38967E34297331D59592931F4CD7BF528ABBF3FC3480C6D46EB20F990B2",
        "CD_D1F944DD008DE5B2A5BBE135D81E17FEFF6E1EBF9F9785C0A44F4A4EE6CA43FD.40.2954464382.249",
        "CR_894D1306345D6B047AD14593D78A9D4FDBD2D6DA5717032BE0FC560EFD5A0FC9",
        "F41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "!%9Xi",
        "IL_6D5553BBC8E6008E05D2006810BB959980D3753508987704FD5C408CE868A644.2729.438901027.277",
        "R_4C5229B4915A098FA9E249BF643245728F52EEA4263D760742E82296F3E1B97E",
        "CD_6C1898742A435BD7596F148E1B69FF49CF55B8A3AC2058CDA5C944CFF7E6FBB0.46.2964021516.355",
        "CD_D8AFD5E52E68EDD2DA6601343E41948E517B386A2A14A3AA86D4EC51725265DB.2561.2303749536.902",
        "I_32A9A9FD17AEDB80DD18DE17F968EB0990C6330E13B17AFF0769D3BE6FA6556E.2669.50604980.273",
        "CD_12C03500A946A0656A43A704AB72A0B3B74537F420F79FAE09D0391B92275663.1350.2045460058.809",
        "I_070CCBA2ECD7496D64C763EDEEE5E45A88B7B870685DCF089BB79B061239EA08.1016.2010810810.301",
        "I_D9EE3A9DC0E49A516CF4075DF7BA887469D51338C0E59A32CF7D20F5FCA82850.2684.1406912225.284",
        "IL_FE01CA94EBFE1E38D4982931DE8E0A94AF72B7EB31FF8CE5134F33F2B9B7B5EE.2728.806641307.283",
        "CD_A57480D0D82DDE51E01CC9C7625981822E2D1C37B70F78DC6E6179505A7BD928.290.3147511692.116",
        "This event class represents events for the provider",
        "IL_E3E98DA8056ADBF1D1154B03CF37CC4CFC75909834CACE9BE0CA65832B107411.2726.1698626000.285",
        "I_743393BD969EA9ACB80141616D25C1F7B86A0E3CA36C03A63CEB0D8F52434E39.2713.2596363464.290",
        "C_E7B3BF5CA85CDF3ABB8EF64431ED7D1A67B9FD70D9D851344D21F9BEA7F92B3E",
        "CD_530FF52ACD14916E0B4C64F2DBF250EDD3D460DAD5F53280FAAB6AD8DB07E372.2611.2322157967.469",
        "IL_E8C60AB3F3BEF4861A060FC90E12A45A6C31AE0A30009ADE3737E65ABF5DC96D.1049.552195166.355",
        "CR_4BBA71B8B969B6626A0E7F60779736282C60AEC40553354F5884C7B9E51AF36A",
        "IL_704BABFF5AFDEFFA3F6BF78265E4E645897FCDC212CC21E1A4FF490E2DA2C1BE.2678.2378673006.280",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.1130.2391290052.1669",
        "IL_4F958E1C8B849F74EC689589112C1E5E0A19C33DEEDF6910CCD740FFA9DA4A12.2724.3881955472.283",
        "I_8F96BD555D2A32DC6BC4E0F3F59606E1BD8488C4B7DB168B1A6CD1CB3AEB6E33.2703.2016533132.284",
        "IL_D9EE3A9DC0E49A516CF4075DF7BA887469D51338C0E59A32CF7D20F5FCA82850.2684.1406912225.284",
        "C_7CC43E62129EA8E069413352EDA51322B29638C926449AF4B7513D9FD22855D8",
        "C_E6165A2C7DA53547A217F4B5D9149125910FEBA09B8BB9B320094C6ECF81FDC5",
        "I_08458146535F252B21240CB785C03373C3730F1AEA87D3E504B3EF91DBA9A72E.2687.3109292735.263",
        "CD_E1EC1F810E645784CE7FF2576513F22655E0F40D5A6228BFA202B5A3E43B82F5.1355.2867547125.1284",
        "CD_87CE846EC002DBA12914102AFF6ED89E0F6DD6CA407A1F7C8C0CBFF801124A9B.2421.1619802417.363",
        "CD_B375528E053EA0FB3757BF45E457E25A87BD55DE51CAC5F0670A466CE3A30962.215.4057078812.1456",
        "CD_2E052A2746A43D11BFF3F6205A3F0D292400CF9B8F3DB09F6AD7A671FE848750.61.3652784598.675",
        "CR_E7845F3041269988C5A1847DE98EF0D88E59CE50ED3A8AA1E310C1A1F393BB81",
        "C_EAA85E0EF5AB3ED5507588B38184431B1FB4FB2BA84FC2208EE7F5D77DBBCFE4",
        "C_934BD1F13253860558310BDF781CA401B2B8CB8F3C3551E85991352E073FA149",
        "CD_0AD4DE64AD6766E900118148CD8470714DBEEA985A4EC80DD4AD11985B5223BF.1981.3993037568.1336",
        "IL_08E313D6BEB715DCDA53AC878FDC8CA32051886D2F14D1D12E5D2D43CCDB0398.2703.2083158827.290",
        "IL_6AB4C26A768DBAD972023075BD61506660628CCA5970C8992F70EF5AA2F932C9.2462.3575936436.290",
        "IL_699FBA37BF7FF52FA94321665FDA8BFDD987C40189FF7416F921A0B31C1643BA.1130.3608135223.207",
        "I_6EC515021E47E1C6933695387E9D1F29129F6BAB7D2893E254DF8EA2208F30B6.2736.1542477286.283",
        "IL_C77EC9EA8B8902E96084BCBBC6CFA3194ED743B2A0B74119D5F06AABA12F9A48.2695.3889254792.265",
        "CD_493669C1CCA456E36A12CE6590E4C5AD1ECD05339BEE6C958085F31C96B6122A.1520.3405479319.548",
        "CD_F07924A860C6EA66C3DF17AE55C191EA3569D370A9FFFB4913667722B2AD2E22.2008.91167850.1226",
        "I_00AC489F58BEB2FAE012EB9EADB94D27B8C0EF1A86F7EF90CCC478E4E29CD982.2703.4084513306.288",
        "CD_CCB9B5084332230EFC94CE865E967C275D0B783CC35AD9963948309EDCCEF116.1700.3490929.356",
        "CD_6950671007C747CA29BE37421723DF7334666E44C868944CF21712604BE6CCBF.2582.1966860136.501",
        "C_583286F85B8F8F1515639919A5A74FB9CA29959320E37E0C7F595D1E986D9C26",
        "IL_E782A16A4E3EA11DAA1962A5D87D0BC523A0F5E92E4E28B1B5192366DE483393.2700.2743456004.288",
        "CD_4B00361A67C5CDF2974099DDAE160DCEF1B6C6E0313747F04CBBD7F11CCBFC71.2559.2671379159.694",
        "R_2B0CB21E4574B83D661A7C62AD7BF3133DF3FBA914EA55D3A45DC4A7214DD006",
        "IL_3268E444486CF41D44EDA29FA5B3DA017B52B119BB59F88408C204F3FC321782.2735.343850939.274",
        "Reserved",
        "C_C6F2B33A9F7EE971E46DC4A05944D1F3ED258A4BBB229A6782F76407411C3AAF",
        "R_88C26A92C49B5D5790C3E39CE2E3D67877AF641A877697A10369432F961B840E.2457.1302123976.558",
        "CI_0454DDDA9AB999B5E05A2F468BA888F0D0794E6BA1EBDCCF2A4463EC03258CC6",
        "C_443EA03A729799AF7B722609B218862C5380ED55FDD1C6840B32FD56F51FDFBA",
        "CD_DAD7DC48BEC7F412021168603D2D9D3CF712E3B9F8DCC4820417979B6C361AE6.2082.1038007791.754",
        "CD_71712F369A8546159D3AE0D8F7E7C5B4D58C20FD7BAFB853CFA7C4E57C03E637.1581.3182261658.932",
        "C_BCA42990FC39B227E073409B792CF09215D06F9DF9B1D54CFEF0BF6A5329A1B8",
        "C_81BC6D4A35C783287D4CB9EC1A6AB30E5FE03B53E0F1DFF036747248C7533221",
        "C_BB8167061523345F8CD6783B9C5021F1F77CD1511AEA7467940486ABC39B70EA",
        "IL_681A7E2374B01837A493DEB33F78FC8E025373807EE70C6BC317B0F6288480DF.2708.1625537498.299",
        "I_45F96938123A6B99EE0732CBD190D9BFF5B82E52695CF7F1322EDEAB82ED9BE5.2687.17063064.275",
        "IL_BC000CFE04C2A23B745105FB1571CA3D890D9580D1AA6746224E398C7587FD84.1976.1222477099.312",
        "I_E04E3B5FFCA1FC032F7C5763F72735E060D12D3EEB56B8C6A435DA9CC911DB0B.2682.2097571257.295",
        "BS2000",
        "C_C70A90D22112002F266DD0E93C79943A1F47C8E5E7DABAAEDE5CAE1591EB99E1",
        "C_88D65C8A4F22A2ABDB6E8A17C6C608ACE5D4FC3E07DE8522268AAE96ED98B9CB",
        "CD_5CEE3E694DB50EA9714886DD418F6CA358B9A4D6FD8DAFD5BAAA13B6529F39A0.1610.3258533973.290",
        "CD_48BC67131BFD22F5DA28A903403A15608DD05C18742BBFEFD4FFEEC39F82B3B1.2308.3911961227.614",
        "CD_0BEADEF5D3A88C78AC78DA4B138F927C4277A4A7EF33E41BF5355AB5E59743F0.123.1437877448.519",
        "CD_E38169EAE55316E8907E9126E02D64E6E2282AB67113E662A217703A29FB0416.2594.1292966647.2825",
        "I_4F958E1C8B849F74EC689589112C1E5E0A19C33DEEDF6910CCD740FFA9DA4A12.2724.3881955472.283",
        "C_CA2DEF883D5A52A8BE2DAE3B94FCBFF61713E77D441FC5DCF3A0EE65D337969E",
        "Setting Value",
        "CR_C413AF31EBD45FA510AD35ADB1344C580081CB05511196B32B7E7BAB01E4BA71",
        "C_4BB7B0DB9385969FCED14AD9320DB3AC26B18FCC6D3C66F2AAA7AB1D63250287",
        "C_F5AE7EBD1A24FC6EF2564B157BD7071D5387FB9F7DDBC55154E64530233BEE38",
        "CD_ED4454436F5D89AB54BFEDBE7EEBD0A50AFC4CD518207832B9D92042E30CAC88.2020.219966832.858",
        "CD_4EC78046D8310B047EC675EFF57AF6CDF0CD910F39829D28C5747F5C66C2A633.1218.2331411674.2630",
        "CD_78FAA10AEF4BD66496AC972E3E24B846C0EB9855D0D6515D7EED8628B54F3A1B.1631.2259267332.1254",
        "CD_A82DF9B10154EC9C0F8A403786D7520B52229D45691E2690C3B352DE9F05F32F.1064.3127915442.1956",
        "I_0A9C692AFE67AD32626E68B31C73B073673CF431D0AE38A2B95919B7B7CA46B3.2713.100574119.281",
        "ASERIES",
        "IL_EC16D1EB706AB19E276DB8DE1108C56D3532ED00627DB2EA05F10FCEA074D6F1.2690.3615138400.281",
        "CD_817E7AD084EFE77D83D93F44E314532D39102CC61BC99316DD0EDCC0B95A5A7B.2589.674629453.863",
        "I_24C62B829B1D6739544F22B1EB72769CFF61675D80DCCCE0DC8867F8BE5101B6.2705.3269889150.298",
        "CD_FC7E4729FBD99558A3DD7F878A1DC4A01CF31A2989C5EA7E0C36CF5077F8D7BD.2642.4144219828.874",
        "IL_5B2FF6892109B8F6F172D6625542DC7633A3301F54DF5C58F0D3FD2969597405.304.739416858.189",
        "C_1B0301F62502D60F6575CB09308C7A3739069A23886569D046BCB5BF22A5D75E",
        "CR_D08FBE660E54A308159ADDC588C79311912D65E76D5871EF0ACC7C841B0E3373",
        "C_1A717E75CBF8D159FBD7D0313AC442D5384DAB57DC1BBAE58D7658C922D9CEA0",
        "C_0E5696839A5AB639CE4CA331881E4EEE21A91F994E8EF5EFC523806BDC11D8EF",
        "C_B0400FB47F7ECB30AEE49FF4C961C26F6A634538D5E7611AF7AD743AD9F6FD38",
        "CD_576EF4A0CA90F6D8810BFB793D022B2E61E1CD9C1C9EC856ECD04FF80D2D4518.7.3512998462.135",
        "IL_A3BFBEBE234E4658CAF2F881D4107E925EE23BCFF10DB187E30DCBCBC937403E.1088.1407077645.276",
        "C_A5FEEAD1E15B3EE7B0CE8E9E6E153756A0F3D06F30B69489A8B10D8F9457634D",
        "CD_27CF2379D55C0D9FB04788B37F03791666FBE227F5B5256A959C5EECD8D8ABE2.280.3403356471.6445",
        "CD_86A12745216BAEC8675FE6006C3FB8A4815B9D8D2181A6E71B70A8A8C56E97CE.1601.4151633577.483",
        "C_50C230A6FEF41E82BA39EF3EAD28922F6475A05DF1FCDFD5DBDDDA1F41B40ABD",
        "C_BBA1346A9C805CEA07BAFA5C355F44C1B2F964A3E4206CF99F830A814FABF801",
        "IL_BE6DD89B6624A4F8EB443F6DA1160EEF98DAB20A1BB9061657B8714AEC3B5448.1017.1852656440.297",
        "C_1A551646721AA7A2EA278525964261E10C989429101DC80D914D36CBD92BEDBB",
        "C_5101B5920BE56811A454DBA3737FE64D06D0BF17EE943A64E7DC910ABDC79B70",
        "CD_18488E32552B12B20AFF109B1C469144409190DFA262326863BED6DDC834F584.1876.1158185576.321",
        "C_9057D65F1A25A157C2ABB405A133D0F21AB61118DC6B4FBB2C013A804086D040",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE",
        "CD_62D05C4ECF40774F04063E6FDE0B1A6CE4B671271358A09E1596B6EBA1E2DD4A.147.1969122796.302",
        "I_653B6A35271DAA7F4D6EDFC2E9E795101F58B4B177E4E4A5A213F1257972A915.1938.3960030189.307",
        "I_3C2C2907345FD9238E14A72F66B1B84060440D64FBC7FA8518759968C7E4B75B.790.1.49293",
        "CD_1FF3E8B084EF958D6CA51930B35BA398A9AA3DBAED426E535ABE1FF42F771AC3.2424.3665072279.298",
        "CD_9FED1DA51C946600828B6C18A833913DCDB8512EEBB3BDC85A5C30FB5675A9AB.1925.1859961480.1039",
        "CD_EF56264F4C4845F620CE3B4E90CCD69D437FDE05A897842176D1B4A2BABEFADA.1187.770688589.414",
        "I_A605678AD1AA7C121212F1D678E5701BA59EA88EDEB1A0117832F20650478858.2706.1051116097.295",
        "C_16DADF7B882F03A24B4CBB8BF019AD75A37563B4BB21A28112B781908EB8D5AF",
        "CD_12471D6936B91DC2838F052A66838F273DE5045F0CB1852A0C46455436BAB9A5.2540.4244663307.510",
        "CD_281CDD03B8C5818D9F90DDBBCC29A216594631B26D65DB48B400C2836A46FB95.1922.1465477873.1003",
        "CD_6DEE17E27A5048051F81C43886E369D7F42F31B01A5FCD6AE03F4F5C668FA219.286.4061000732.1277",
        "Deployable",
        "IL_62D48FDD7770BBB74E46D15695B41D87829BDEC82880F9BA3ACEADBC7C60561A.2705.3460990210.300",
        "IR_735452BBEBEFDAEBC6A68DCD86C8369C33E470B585707BA64EB646095B631099",
        "C_E338E39B0E84E8FFA98B59D43E1BAC3484BC52022387B71E60F1A04832CEA0F8",
        "CD_30F053A8DD9B7523260BC80D91AE8F875CED6A6B53E86E7D5B372B5F5B0FE4CF.1583.3574282211.488",
        "C_00330E7458B5D9A0228F0B77CE0CF834B3F16E931D55E4B84F81D2634A6E0B53",
        "DeviceUUID",
        "IL_C18626E27D5153E5E65B72B574D4E2FD4416299A7B7135AC8C51438B7D94212E.1730.3176561917.307",
        "CD_E6EBC22951212AA0FD20E4F98E4D28A1040E077B7BD57C8A6ED5195CB15000F1.2483.1319692172.820",
        "IL_69981B246FA8987C6F9F8C845E9321B11F907AE846DBF0F464883716EEB0AA0F.2718.1560789236.275",
        "CD_C3C6D8FB3474EE785958EA6FF4182273D2A6254E9DC15AB0F00C01432187E439.2759.1241160893.362",
        "CIM_InstCreation notifies when a new instance is created.",
        "R_D4639B8A3A234C7C421B844825ADE1FE2360CB4CE746D79998FBB9573B4B4A5C",
        "I_AD1AFCF480FFD2E44D92A21C141A07DC0AFEF5AAB3FA466F5736E5569B7E6693.2717.346705904.287",
        "CD_C446284C531AD33722FED92B5707E137291BA408988B095293D49122D6D19961.1087.1340307864.807",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2115.693805320.188",
        "C_AFC2C77E00949B535F20B4C49C402E7EDC81D11016552B9C9324031BE73C36C7",
        "C_916EF6B6122453D1C58D648E96BD869758A18BA38D348DDAE67570192E8AB140",
        "\\Hlx(",
        "CD_1F1219F96576A4588331D02100737379E76B59AFFFE01B2EACFBBB0DBCD4C75C.2334.2542215119.332",
        "R_EDF45E83E6988CAFA837593570863B9540E3B0D59817E2BDC4FBCF063A21C08B.2749.2012141963.636",
        "I_D5015F0F522081FD020EE5B4501E138DF661E57BB72BDD7C27479EFFDC65FAEE.1334.1051082552.362",
        "IL_291659B3341C7316B94618FCB72FC9B61FE3DF51D04FA1C54F4C39AF0003B4FE.2719.617516543.280",
        "C_88526558B4A6D54893233ECDBB85F90A6C9F4F8D077A55806559DE89FB1D9CA8",
        "CD_174ACA96C183E7A885B2AEA41130387489C9F36E88A7A79DC42ABA72ED0E252F.1849.2967237697.605",
        "rceSpecification",
        "C_0ABAFED91AF3160513FD4A097A7FC5F22572733C3EBFF5EDB2C1119EA3585424",
        "B8B0D597082019C2800150A6FEA4D545F9DC80D70FC5EF58AE58F581515BD2.2725.3806191722.291",
        "PerformanceStates",
        "IL_8D9107E4ECAF109CE6D86793D80E0B566CE8692178AEB151294771B38F8935EA.2465.2887004433.291",
        "CD_E706FF8586C52A7176ACA48D7702EC2A6550564F0E42B0C09AE3FD1CCEA62CD4.180.1570549509.2180",
        "I_322791199C7A082A19DC7222A0E9FEC1463B2B6ED4DE631DE0684C7D1C689AFB.2719.436465182.277",
        "CD_8F541140BC904A73C4879061E4B77E208E8BE6E91CFF96ED3F577FBC75D59D12.2733.3468448329.383",
        "FreeBSD",
        "I_11AD18A79EBCEB689369B81E350D3496AC2AF45588A574E361F6358743201A7E.2707.4045560932.288",
        "CD_F9C9BF1D438816A18A92B3E8522F73D7F60F0DD6F678D67DAD4AE3DD5EBC727E.136.4237106522.1177",
        "_PolmkrStartMenuSetting",
        "C_8902E5B6F3915AEE33F9C4DB3E3E29595C0B92D3A49BA074403355A42233E5A8",
        "CD_98772C151E80309DDC5E68EA8FD1FD4D236455E4349502089D504086779DE396.1018.3966031985.473",
        "46C0648",
        "CD_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416.18.2009572591.386",
        "C_9545373C4C410A85043435CEFDB53CA783FCE515B65345546AA266D2B18EC658",
        "CD_F8A40DE76638BC2D6B465FB946B5587EB32CE4928E4F71A985E7A4A1C7848063.2763.3593732082.297",
        "ref:CIM_PolicyRule",
        "CD_93FA26AC21CD81110C300205F91E593B4450632250F10BF0040FB84450AF694F.1356.3365312152.355",
        "CR_A3FF4B5E169562F5D12527C651F2FA9F17677983CAE812428672F30175B2773F",
        "CD_D6B832D04D0FAB582A050E5212201E6DF3C06194D4D96931CCBF8B3053F5A8AF.1386.1.24020",
        "25BB449B1BAC54A21282A4102E2AA23BFD3BD4A5CFCE4F20063B155C.2540.3111997957.593",
        "C_8B2D824B1B1EA753A4826FD6EB54DBE4A6D394AEDFDA04796F002F1017CDCD06",
        "CD_F2BFF6BFCB90EF8E1F9A2F6D9E763484AD0F1C907D1A496729D242E8963BD098.1925.2736026949.305",
        "I_E3E98DA8056ADBF1D1154B03CF37CC4CFC75909834CACE9BE0CA65832B107411.2726.1006087050.285",
        "C_6BC8B317F18D27286388A1D8A6DFBBAE21776749F856791E591914AAD69B0BCF",
        "655.523",
        "CD_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396.1141.1.22820",
        "I_652899BEF964B5756522E7EFC190447664B621FC9B3EBF81262A72C5E4E7FDA7.2724.1386415506.289",
        "CD_8D99B89B2E26FAE38502F957460FFF2E9E23E0C0D9AA3DEF32147EBB968C38FA.1675.1.8529",
        "IL_A3BFBEBE234E4658CAF2F881D4107E925EE23BCFF10DB187E30DCBCBC937403E.1088.3700762022.252",
        "CD_CE1E2946EA75133DF1C863E5B411D4CB200B9A15566E82CC0D10E975E292F2B5.264.371134391.602",
        "C_61340937E5D8C4D3C9D45CD88D4999E65F9C88FB548157F118E02C98B67C9BD8",
        "I_168FBED585D3E8C959366A9D4A80652F01E991BD5E43D3A0B992DA006675CB5E.2728.2627232315.292",
        "CR_6D429FD402093547E603FFEF7F3DCBB64D26C88E650742C35EAA4E9D319AB841",
        "I_2FABD5DC9514710EE1BF357E3FBF8C8ADD2AF7CB57C8EF370C70B000742EAF75.1015.3553313196.320",
        "IL_913204304A08724134A9D5DC4A1AABD6DF33BE96D109BB06756E60F16CD52120.1053.4286564881.312",
        "CD_1B319F1F6B442943CD996FC1C57BB42D7AABA5E18673D64CB4BE3A2D7BB179E8.300.1.27089",
        "I_B3082C3F9799617E93A60B0A5A46A9C812E71430D2C694055B03ADABB08B0D1C.2674.1006866635.262",
        "I_53FF23B7392421DBE751E4A76D391B471B37DEEC35AD7003AFA7AB377BD54B06.2678.2372077223.282",
        "IL_6194310FB3143CE749EF6BE51E65232F58E95CEA58F941B34B73C8A9D543D720.2677.3405508569.276",
        "CD_9C6234A862ECB7785AEE1C8C46C69B53F75E4A1B191D9AE24604A07719AA0D8E.1533.3047527346.549",
        "I_5A83D395085B6B03108F7917D2C4F3D0683B0E479C446703225592BD963CB748.756.1.38386",
        "C_2E4CB0F875356763EA64F3060366993EE0D49772670FDDF29B1CAAF86CE9720B",
        "IL_AF63A33DD08D45D1B69DD77DFB1C679EC967FCF05E3CDDCE214188739111AC70.2698.3918759181.272",
        "IL_46ACA7AC3CBC0F3ED7820D11DE0C916B1AC1A76D2292CABFF82D395CEAF02DF0.2764.2201326577.283",
        "CD_5423A293D610FF0CC764C8A3CE38BA5BB054D35D92E0A6097D9147F3C3498F59.1600.2105461064.494",
        "C_EA0396D932FDC5A40D76EE05C8C42408E2A644C1B6540849C7A56ED78D13F40A",
        "CD_D1B9917E4A8DBD1488077B861C17B0A0964FF41A5CC2D87825C4AFF57A0BBAD0.2589.4038602707.990",
        "C_DA7ED363AC11772E9EB036073A9510EF1E6C1D05C270A6F3BEFB2C129ED6E488",
        "CD_169484918492FC0AC4886BF1A48556EDC1984793E915C243C1C0A4B8E678F4FD.2229.1174744692.228",
        "R_D53926DD08FC0504729C14668CB5F77993A493481CE344FD381209E767534057.2505.965822365.540",
        "EIA861B",
        "CD_4720AF4CA174274F71D8038B37E58001F7A92E2A83E49C05ABD2C15725C10921.2418.2904850698.365",
        "I_BB5421369FBFB52FD92E78B2FF8C771E965FFE9E0A31FACC2F73C07C29BD69C5.2727.512328691.288",
        "C_39986A48BD79716B6060A37DC5740DDD40082DED190FB55EA39601F1955977CD",
        "error_Type",
        "C_F9D6E5641FF66EA233E60BBAC7C675015AAFDD5EA5CE8B2ACA26EEB642AA98C0",
        "R_50077A94108D93CFABF3C0251F0E7BF1ACD36A396D9CC3AC9E9CD8ACEAAB6155.1065.3801320539.524",
        "CD_71C294F689D8082A855326291989D570A1243A4CED463FF3751B7DB44F45449B.2415.1.10437",
        "Wmi Instance Names for the device. This property is useful for mapping from the wmi namespace to the cimv2 namespace classes using the view provider",
        "CD_0ABF3D1589A9B18F0AFA08F69190699B7E9CE95E28F1B4B39B6534E41F4C3C0E.2625.3575338684.597",
        "CD_49844BBFC96404D65D55FCDEE9A5600B03E3ADA7C6190D9FBE82C292C1309911.2599.1866502759.720",
        "CD_C21EED7191192F2ADBCB9708104DAD6A17FD5A43846B186D22E5E8405D0D7A69.1736.1776891584.5007",
        "CD_2FB30DC8F94A0A113AD4A141F719C8A8C70B3119C9037B1814178A55C7A7F2FD.2424.2652133832.363",
        "CR_48B0C9029B67A5C53A5796286B490AC8D6BEC1B48F8B30CB5F54159AC40ECED3",
        "C_621D57D329305AF6C6B4D4C2D624AE4A3F08B9C39A079FD8CE37946946552574",
        "CR_61BD99E07DD9B896C168C32D63CDE78875D8845FB21EAF979A76CC25C89D073F",
        "I_2D90BB9A9E17D0896DEFF9353AC718A455E560A459B99C6F8E59B5C9AF96B6A5.2714.1382068666.281",
        "The security settings of the file/directory object -- CANNOT BE ENUMERATED",
        "I_0D714E05EBB19A5CCEF94D4D2F7F084B8DD3CFF95084F3C011E96E280D177919.2676.740478610.279",
        "R_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D",
        "CD_97BB199CE4D9B053D267D3E21705BC5FEFBBA4BB59B3C0549DB5A62CA7F3BB34.1604.3074032774.2807",
        "Redirected",
        "C_8613F5C7954CE62C88FC8F762439D00AD2C7D41714A9053A0C9F43F4A8F54243",
        "R_F9C105403362A1B751E34E98A48FF5F80223E74C87FC8FCA699A26FA5C230218.1521.3079970201.518",
        "CD_8026A46DAE8D15BDF9E8EF11F43EE077A14B188A857E40F1C5117BE33A9138C3.2656.287860000.471",
        "C_9D89FA2B309F38D240606161FF6D4D1DD686574B6527CC994C80F23BE2267FCF",
        "Control register",
        "R_244F25B960671E51BC08E747FECB292653D067F87ABA759B95C73E305093B12A.1049.2511716051.536",
        "I_66FD63E07CDA0847196FA78021C366E969CEEEADE5775B379E698302297BE344.2685.1094387673.271",
        "CD_DFF73235A7D1E97A73AEFB2323A09D07551BBAF25A9390A9E1C9B7C9B1F0A40A.2633.3165304584.5729",
        "JobData",
        "CD_E44C50E01AA689218378F25B1207310CAB1FDAEB49F9F7888B050672D3D44374.2599.3480407032.741",
        "R_D4A97CD760E9DC657E08D29140B18BCC6B8D0D59DB6745F4739A4443DFD0F72F",
        "I_780FC294564884E07CC416E110992E2942AD9F83AA1D4ECA95F62F161A3A78CD.2708.1261587561.289",
        "C_394B05E1EDE5A9F11AAF607CCCF99471F4149B2A39790CFEF4DEA8C7D9E030B1",
        "R_D25F6977140D68687C8B3B28B24AB8D2A1D7F207F13800D7E3DC961D0C563679.2736.756256526.544",
        "C_3F71F51676E0E4D666CAF1EBCB8834168AA41A1C9D4D74E4D596C66D86A39AA9",
        "IR_B81BBFACEE62DE706A28655A7C08A91C36581107478F8F80312BF365EA8E32EA",
        "C_43B35DA4EAEBC0284206ADBC4132DA71EB8556E731586CFE46B5A658E2C2F498",
        "IL_2D25E7A823A345CC4C30BE115246470F105169F049D267FF05E26B1D0CEF1DDE.2696.1969426336.273",
        "C_D1553F25D903A7D66D6E3513928D0B42C977674C3BC0CB6A4E19EA9B3FD794EA",
        "IL_B5A2659105BB67057D550B9C16DCA23132E513817D7D77164528C443959E6F7D.2690.254751962.269",
        "I_78BB6AFC63E9D106552AD2B6877F9716F49FA2E899AF3B69E2073E4EE335FD0A.2707.2587567292.295",
        "IL_EB8665A808B44B1EC684D558DCE4736DB3B63938754369F4C2483F918071F26C.1051.536184958.339",
        "CD_B715CBD523374FBED801AECAF12284FC6BC34C5D6F6D2476176EDBA2C8EF1A70.1750.654124313.389",
        "C_D971E3FAAA635236F384E1888F166DA3C30F1188DF8FB5F90FFC090DE0EF87E7",
        "CD_011B1BAF67EA69E2DE34409D684C80464FA202C09EB167987497A892748D7728.2595.3960503999.298",
        "CD_EC4C381761F3C10114EE1C99ED28B1BA382832F3C228DAE98DF8FBF4193D38BA.1059.2413728935.438",
        "Autonomous System",
        "CD_1FD7B26C8C4FFE0BF45F5DDC5492AED41895B4A7FEA3E20CF6E8FADC218E797E.155.704085871.984",
        "C_D494E9A85935E059369DBBB5BC793F2672E05B3CE93CFCC0DD52A3144BCDAC07",
        "C_C7AECD2744BC078D929494CBA36C2323E889E91F4B1A9028514BB732B6F153CB",
        "CD_EC0D9BE803395BC39DBCCA5405BADA8B14A82223193D36895536EB3BAC2EA6D7.1192.3633353673.246",
        "C_F3DF3A8473C281626F19596F908669B74CE3CB4720460E1BD9E5A98DA2E125A3",
        "CD_4082A72ACD016CE3E809C18525EF28CAFFEB76B1D6E2F5C00FFCF2C67654A896.1700.2620054311.365",
        "C_4E50C067D96AD4A977DD1051D7D21FF366555B5B1DF0C0BF0BB16B924A2797EE",
        "IL_477F3F63C7E8BFE53EE82AE79FBCD642EA95C3451448E3FDCBE433605BF36F82.2703.3062993540.286",
        "IL_0FDEA6B1EF5C766CB87D84DBF8B39A72DE3796CA0B78D5F22281D9A8B21093AF.1499.3351237689.194",
        "IL_26AA386EE5FE14FD497F2BF115C4FE84BBEB4BAC3827DE5B6E890C4BF37142D5.2701.2563248275.291",
        "CD_91FD3FC418CCFA3F854B7CFFC8C9D234CCEF5C333EE30099C64BF1B8CDFC9468.37.3863242501.245",
        "CD_7D3568009A8212EFE2BFED9D89FF4D8CBC4A83050B48D8214C1E0B27F36119C6.1336.3731563227.2539",
        "CD_E5893386A7B4C018092F4F8B136F60610FB13ED7B0A8A3475C8F55E3E9FBCB90.101.1989133671.3504",
        "CD_8B2D824B1B1EA753A4826FD6EB54DBE4A6D394AEDFDA04796F002F1017CDCD06.2624.3011621350.486",
        "C_259FCFE2A3935A15F180BDB11D2BB86ACCAE71C54E422895B35143097454A85F",
        "CD_14FFC489A434D581FBF6E06A9A803439863075160D7DFAE0D83E42734806076A.1085.2341335124.982",
        "IL_02E3B8C824FD0B9C15B4D49AB84CF02FA38E02CAF699DC3CBDCBB2D79F3025DF.1596.3058000770.287",
        "CD_4DCC7262F58735D0369C2465199BAE7309EC5D65C116FDC51CE48CEED8FD847C.2577.3486718037.956",
        "CD_F02A14F60269536C803E2FDE6118151BD8A40B0303F36B063D46BE78647E36E4.2663.678933481.435",
        "IL_DAE8508C63D00A56782E698B3A32653F48C5A3D5EF1E2118D185BEC5E123B054.2693.1293650204.257",
        " $'*-",
        "CD_3228C3C4A6C3076AB2B5BF5923243297F76E5D04DB6C72B457774CBEAFF090B7.1576.930124003.516",
        "IL_2DBFA44D42A203A189A583B3C8201C9EB925E498EA2F97A636C432BCAB60EF3A.2722.387715919.273",
        "11BB5A87FB7EE2B3D5F7",
        "CD_5DAC8FD7A784A5954048F391B433376EC7D25E078473E5A528110007AFBF25CA.2590.1547672769.1114",
        "CD_F3FE9F8C3A3CF33804F815B29E77D41E1175AE360C63A072F4404033FF71E150.1793.3441743907.382",
        "CD_D7F48DC4425F710DA602FCF6C28C143A9D53D970A26FE8EB312B2FAF7E8F7D93.311.1550761170.337",
        "CD_2FC084B6C709E5497BDDA7F8C8BE67460C3195953737FB3010EA83F4E8CF8735.2553.1839131323.550",
        "I_3AFE8BE80A89C099DD2D8CA7E54198F81DC7136CD8B0B75B6B94F861EECE943B.2692.4106053706.274",
        "CD_700A223C2BE9D4D6498C555306C3D6D2A20F7ED7C0635EDD45F157ECA54B627F.2224.4271713931.351",
        "CD_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D.1165.103062011.3667",
        "C_E25721B8F3713BDE1DA6576F61E5B33C530348FAC408D2449404B7FDA23E173A",
        "CD_C937FF2960366D3679AB8F23C7A6B508B41E35226B8C5FD67AC45163D3C64350.10.1822653930.250",
        "CR_B7CB0F72C5888EFB87CAA914B3258F858F11D8FC7438CC22070822389ABE2635",
        "IL_0F3AB3AAD38DC62E71EC95B3EBCF4B32C73DF010511E88F91EAE962110D82CAA.2678.3560459195.282",
        "CR_783F27E34E5C5D4D60E761148DA5CB8835B5F7C975356BFBACBAB29334321728",
        "CD_82FA3A19B147BBAB62F558F1C6EC189FD15707390ACB5D1DA80D0238BA7670FF.2530.3470673475.619",
        "C_72F6E06014740E33BF77857BA13684FD2DE1B4C686AF87D9EA70874A34A68B7A",
        "C_35A4A634792A55EBEDB114AD891E21CF9F619374AE7B6580824C3DC06F6DA7C8",
        ",048<@",
        "Milliseconds",
        "I_8578BE6993BF2DE81CE627FFE447487EEE109C3A0FC35A58947773C4D5F2AAC9.2694.2757500751.274",
        "CD_838E75DF6AB0A59C9F2477F1CA99D3050323945F5A9DCAAC9E77A5F334C030A9.2420.4157701054.667",
        "IL_1A85A56487B65D86330AF5C1DD98D5192AB7D458D9B49B25E7DC4629A172E960.2676.2098333244.278",
        "ZiK*]'",
        "CD_B2810E6A01F7F8E13C9D53CBD15E68AC21A43268E9F315153FD0564F6B343FDE.2581.3891665575.429",
        "CC32361.2689.3546730086.265",
        "CR_E340FB8EB4DB3A4F1ED0804CB2A3406B4CA2DC92297E79DEEE6E8BA2BD0D28FC",
        "CR_57E5D882D51A73B98D160F0B765B4683E2474C910159548BDA9FB2A8BE2E0941",
        "C_226C4C8FBCABDFAED44112749840FABF85F6E2C085528C8544F78A435A88FC7D",
        "CR_039809E5E8F2D8DFE19D9ECE6F2163A46417107911DAA316E07384C24125AC9C",
        "CD_5243094142BFF50E230A225F471ECAE0DCF0FC00D9021F08F10118DC4E9AD84C.2013.2703295651.2255",
        "R_68B63D85C07431A40103A6BD810D7F59382555974E6EFAD3DDDB4C278A22DFDE.2457.2986948068.558",
        "CD_9C256CE37E6F9177BC0EC95344373747E0112D20D664373933986EE480BE67C9.299.4069006359.1751",
        "`dhTpL\\Xt",
        "IL_CFD52251E6729F0DFBE6A95C79C4571B1272F1504D81EBAE918A2B32F32BB41E.2722.2149332554.288",
        "C_2442933444240B68F1B8232208304D509D6ECF5830E4F4F8E4EDD13186DE1B28",
        "I_5A00701EFB2324344FA20EE48FE72B8968F93400398750840855A1991E0FC83D.2690.1279969794.271",
        "FBD99FA03D75E47107F03F5A9453659.1926.1786841729.256",
        "IL_0FE84CB7228184819434E73184A33B5694CEFAED93B282C50B930127F187504C.2434.2312830320.287",
        "CD_C03F031E8E23282A9A69C271A64FD5AD50EF28B7797076D938A21925DD7926D4.2423.227155813.638",
        "CD_58C24AFB2A991AA6785137E0BFB334A98FD6BC947AB0904D8F9C5CB0750B421E.2566.4185018034.229",
        "CD_55AF22A4D3FD212FC3171AADE7109F17F27CA9F86C291AE560CF90E7D047839B.1466.3083124075.1324",
        "CD_D6F87EC61B61A3BE74CF6F98796051F97BF5D3FC96E82F69A2F8FE9703C8F224.1849.3407307037.326",
        "C_960A016BC71A8D938443FD5B4BD545FA10D9D76A0776A92D75D4E23235CAD0D0",
        "IL_E7C8D1A4E2346FFDEE37907DDFF48B4344B5DAFEE4B2DF86123B0112A39FA3BD.1932.1017258022.256",
        "IL_FFAD67FADDE07A761E74EF31B5AD0B1561C43C37F19E76F6FC994C2C9F5FA6AC.2713.3108291077.294",
        "CD_61F33C9DE75CB13B4A6469AE01D1FD6BD56B098ED457BDC27158A62BBACE11D9.2418.2650808003.363",
        "CD_5C866111FD8D1933EECCE5D44B619D3E64BDDD0B43BC6F39166BF254D48A504F.305.1503074335.498",
        "CD_0B714A230756027CB9D944F3C101E5485E82B469361846E74358E5EEBA5C05B7.104.3230338516.1502",
        "IL_E7DC64A58FCBCA5E53B44BE9843708DC83EEEA00054B3AAD4AFA691469884ABA.2715.531817342.273",
        "1E5485E82B469361846E74358E5EEBA5C05B7",
        "IL_32AEF593787DB2210CC6CBDB30A6BABA049667CF96FFBDD446D7BB5E9B1A82C9.2728.4089252229.288",
        "CD_5605FA03DF8EFC9403913B359A754F865B162883BA4B0BABA988369569243874.1341.1093516111.2578",
        "CD_4548ABC60D8D754BA5CDF5BF3F98D090EE4DF751AB5940B6E9A6298C3D9C3BAA.1480.3576073111.1736",
        "R_25A225BFD7C0706940B21958E1B4E7879B81C1069B2DA72D3945C2F2A653CB92",
        "I_F461AA66D8B7B7D281791B03410E52860C27B31270AE3EE90F1659A118058546.388.1.47882",
        "ref:CIM_PolicyAction",
        "IL_D47C88BDF42D73CB277C4547EDBDB70DA6632EC8E488BBCFA98BE455554FB47F.2687.797206848.274",
        "1 = \"Other\", indicating that the recovery action will be specified in the OtherRecoveryAction property ",
        "C_46FBEF9017E8ACE97E9FA4E87DA4466AB9594D8D5A576C11D8231FA55DACDC4D",
        "IL_5128FB5846E65E2296350DCD5BEBA87CAEC1AB538CCF7D239F558B6508DD48E4.2712.1534257330.299",
        "CD_6645319666642BE1F4631A5D96E8D9936FE5918F64DF61DD73804D6AB3CF6C32.2554.826719485.515",
        "CR_5FB7EBFF7E65F2B5A8D86A305D94319B3C99F6846C3536F671E3F448D940CE69",
        "CD_6C707473A832E8EC791BEE1730A35E787F78F19C8E76CAC82C47C44288E55A89.2099.3274795999.552",
        "`Lhd8<|",
        "R_6C4036050AB6ED93A9D031B2105A40F185AD013D2651A97D543A6AFBE487C544.2504.314421493.540",
        "CD_0F6F4793DA673F1C347C3D8CA2454121EC5D32EA0CAF379FB0C0BF42C511B174.153.651581944.1494",
        "CR_5FC1120B31B4BEF5795347EF4041D413EF6F5EAE539F7093726C935A4F5DAF5A",
        "C_560A954CF1AFD0E34DF6D157DCE8FA7B48ACDEFF72420CA6796A4E93E34C62E0",
        "CD_21A80891DF55F17F9156BBC6AF5DFB17171E94A3610E79FE912FDF2AA405DE37.2585.1487348468.507",
        "IL_A652C2031A398BA1BCC19829AA29BBA940B833717CFD10EB3A678C370F38E883.449.1.60127",
        "R_979D1EA059854DCEDF2345318722F29EF1D55F537C02E38427A8558140AFFFB1",
        "CD_901AC56EC8F00C00FBAC686F0B7E1614E207CC1998593D930358F2BBE88093FF.2013.3563907732.1181",
        "!$'*.26:>BZeFJNoRaVs",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2136.2151069127.188",
        "C_A889E6B84E69B458250034D6C637627E7E7AE0CAB6FF06DFF080D7992FFD2372",
        "RSOP_GPO.id=\"LocalGPO\"",
        "CD_8A3B6432A229F674039F0136B188BB0F847AE08B53B1611977C2FC30461CBDDC.1836.1684430648.532",
        "IL_63C4BF2A64B9BEBC4899D2316524538201330BC6B563C3430D83A395C9BFB361.1017.1259436876.345",
        "I_84DF976B9F987EB5C1681ABAE52C871FD0AB2F6910A3BF51C4EBF06A71550900.2690.3861359295.271",
        "C_99987ACE788FDA6044200C5CAD36E8FBA4C6DFACC2585158E6C31C93918E7DB8",
        "CD_91602FB13599AE049472C23890514C40727DCD8307541465A988B80CE6F539AC.1542.47303344.429",
        "I_FCE386D97BD4F6A3C4D5F94E039D3AB7CC960290258A1383A2314D5C05FF8D10.2691.3819820740.270",
        "I_A8BC9FB28AE536629F0C3F24CCFF3FD727EF91A331918572457F22C8A4B50211.2675.870928241.288",
        "CD_D3EEBB9E3A4C5F3CA348B142AF6727D3A274A152187FB63005FF1EA0DBF75FAE.1149.3984523404.1091",
        "This column contains the server extension that is to be associated with the MIME content, without the dot.",
        "IL_FD31D24AB6D41EE0B1779B8ECFE35583D5BB3EE8072DB7307D484F5572701CDF.2714.3790606445.285",
        "CD_5D0FB39DF250D3E4AEA48267D98EBC817DD59173DF1C6B6286433101D6043A28.2655.1326948171.901",
        "C_B66074B0831FA2823CF6B697A61A3423369B606CDCAF1C630A34F2E146F8EC8E",
        "C_47B8D9FB99659B3546500CA55AB79FFA62B2FC16F96D81F5B390216EEB78A7A9",
        "C_FD4F4D3C59F149D4ECD4F84E3818809F406BCF7E122C03BCFA93C04C2B2F4607",
        "C_E345D54F7B8D7565C8E8A2E752B23F9E5C751735A64D115759AADADE14DF2314",
        "C_EC5C4DC0FE89185F526B955C798149CABA4B33211BEF571147AFFE5014EB1AA6",
        "The TargetOperatingSystem indicates the target operating system of the owning software element.",
        "IL_CA599D6A29EF58E9CC298260942301AFE42CF6FFCEB9502DACD0BAA50DED4DEE.530.1.21465",
        "CD_9E336B8DC1D54B8E5BF3349F6BCF605E1FA4F0F0B475578AA00DF3B9A9FEB127.2037.2548828743.2665",
        "<*!9K6",
        "CD_583286F85B8F8F1515639919A5A74FB9CA29959320E37E0C7F595D1E986D9C26.1155.2493480332.322",
        "C_6A626287DB2D297B2933F0627963C6CDBB9ED9EDBC6F1EE6B68A428340040D87",
        "C_19C500FDB2411645397763142D9A3522EA74E9619B1C45A89DC1DCDB49E04CDD",
        "CD_0DFC323CB20829C5E894EB23D45A1551C36C2D6CBC549C00B9D8952023FE2DC0.2224.4069145873.2768",
        "CD_BE7B96C50A5D954A89D26DEB913105A5F4A1453B9058D1ED2B066A1ED47BC2A6.75.620027496.926",
        "IL_6541BEAED14E5D95B2BB24A4DAC4BD609859B43562532D2B590414032062584F.2713.1978167914.299",
        "I_5209325547C4C3DC85433F489AC2215394EE00249CB48AA92AD2B0B6C8014C31.276.1250366999.259",
        "TracePower",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.314.2772854538.368",
        "C_00DFF747C2B1CBFF3E26EBB6153BD247325C452D8EE6781C31BD31C2A7081073",
        "CD_D494E9A85935E059369DBBB5BC793F2672E05B3CE93CFCC0DD52A3144BCDAC07.28.3147286077.465",
        "CD_DF05054754D9D5B0E7C9F400839266F3883F1311019EC13700475306FA54A6B9.1171.59560864.481",
        "CD_8A4037032A1E93595308B4A4BD6D8BFAF65C3C979F3304AFFC616809C573E05E.39.2394225330.570",
        "IL_978376518E471F1EDC2EA4BBDEEB5D55BFADCB6B5EB71C1895A371B13A6D17A9.2705.3702915233.290",
        "CD_D1553F25D903A7D66D6E3513928D0B42C977674C3BC0CB6A4E19EA9B3FD794EA.1968.3480613493.3992",
        "CD_AF9953288ADAF46B6D6FE0415DB0AD08628D78AD327F2410CE001231635E7CBB.2595.2116497405.775",
        "CD_AD0407846647AF6A2377C94BA8FC90066E9C0297CFF3D89B5F5DD4866C06DC06.2585.4062969188.262",
        "IR_3FD6B33F4FF166B0F7CE61EB62E55B303FF2BF4A74F913CACB488AD245C02047",
        "C_3929A976292C0E92F1EE078CF7C2D3C5371AB7D7BA2E3A5C78D38FD26BACE479",
        "IL_91926B01F898701429B4A3FB9E112890FE6D5368ABB9B85A647A3B12D06A11E3.2678.907125016.282",
        "I_F3AE5537136156EBCA6405210F21B14598CA1F51BADFBCB082B304FD616A73D2.2489.2872381519.185",
        "Caption",
        "I_D793223CDCA6A28528EDAE01B792603C67B80E8371E54C98572BCC6497D93F94.1014.189214118.877",
        "CD_1A9E3B957294E1E2A3BD1A3F9CA79E41F6CD3130E2786884F3F69878725410E6.35.3109101709.310",
        "I_61E669D3482C420F68FA27C086C8D9EDD1797B7765A7ADEF6912A148755E11FD.2469.2518649645.296",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.275.2010649301.188",
        "CD_0B5C44F8259E201E409A59CCC827AEA5F69AAF6BCED724865BCF62AE4F5D48E1.1876.1818755492.321",
        "StorageTierUniqueId",
        "CD_25A571CE538B24F14E9AE9F0F8EBF9CC275EF6FFF33FA86B2918CC9BD3D0BFD4.281.3304979827.1700",
        "CD_EC5C4DC0FE89185F526B955C798149CABA4B33211BEF571147AFFE5014EB1AA6.2113.765339466.517",
        "CD_B39F79BEF0550EE7F9E981A83A152A3A4B6173B3A32D2E630E92CBAA2FE60E90.1649.3486047473.1072",
        "C_BCB08593912195820FC0E1809F361B6089BD604B5033AAC8CBF736B3C9F21996",
        "R_F2A1670452611B171DBD4E5FF5429578943F6D66B18C2769FE1D044818E2B5AB.2460.4189449634.554",
        "IL_D03605E5BD6E14567B3187E00BB6C4B414BFD64A6CC37B3EE753B7431698B0A8.1015.144238205.307",
        "I_E3D6956C9AC5D82845A5B017A22EF25487755E3C3A9322BE0116D0C7010A0C20.569.1.55789",
        "rc6`Ku",
        "C_0E00A89CD9A41AC0AD01E0DA6C3FD34503F8AA86894EAFB2552F2D7711004F1A",
        "KI_2DC5A6B44F3255647A4F9E3D4F932FDB937FF6A6BFC90FAEFA2788D220375335",
        "\"Z&*.R26:>VBFJ^N",
        "C_297B009625C3BEC5F682DA65A87D7971BDE24BF0C5093DE7BD3ABBE18CF35D09",
        "R_47CBD249A2C567357686E5ED6091D88133AC6ACBBE7BC216472A737EDFCF1867",
        "I_33E04994CA4A70429FE677E9D3FD3A84A89CF8D3D2921E1207010996980144D0.311.4076504440.249",
        "IL_F678A751B35F24E73ED997A6F7DA86CAF31A3FD2B20B914F4ADF37FCE38CEF97.2698.1740638920.268",
        "CD_153A90D31DAA2BB98D107166F8216FEE25A312878D4AECBB89966D3EAC52B5F6.2039.1537572267.240",
        "CD_85D86CD958DA6FAD92EA55F1468078F0400F29C2B1A327B27C870BF7829AB8FB.1955.2917687227.620",
        "IL_ED746A3FDF39631AFCFCB83BD5778F1A96B036DFB3E0812414D455C7679E30B3.2708.2164274124.284",
        "AcpiPss",
        "Entry",
        "CD_723EBFFA3225590F92EB3AA29897D263F99A6A39FF7268CD763229669325C42E.1542.2628680249.542",
        "CD_14614F807043038CFEB6FE0C7E3AB6A79783E1690BBEDE1801E1EB78C70D3066.1935.2749092518.317",
        "CI_A5134EAE65D9DD02F6CE0E924C84D387C2BC76C9409B3E6C9F586619D35EA1DA",
        "CR_35B1B65B914DF07FAC7860C3407AEAACB382311D5C7C7979B2E9A007C56D4FA3",
        "IL_EEB2A6DD6B38F795AC77113BA83599068A7E118A282BC39D06B88CFA643E0D04.2722.3038232358.275",
        "CD_4CC99CFC9275918BD831680B062D25E87A34D427349AA13CFBBAC5888CFC907F.1192.677086726.290",
        "CD_69A1F2516C00D1C2619B3BF158EB32BB01A9128EAFB2BC6528F8EF8668287B67.2588.1991780777.1024",
        "C_1E479EA43F980E7621076F4BC162A6B6EA5A784E496473A751456B83F866A63B",
        "C_0B828B775002386EA7D486F856B8AC15F7AACBE2A527B2D34EF30FCC6D53F77D",
        "R_E80ABEF9F2B89F7F7F65B9C5267052D745A292EFA75CA4F2CB385D3318120667.1500.1672323294.588",
        "C_921492ED5760E8DB59B18C393C69FD700B60A29E9CA498982D62B891A4AF6985",
        "C_42EF75732F6EFB96178FF742AAA73EF32DE5B0335EA10065BD30F22EA794CDDB",
        "IL_FFD5182D10C96F3C53E9257F5B142EC4439B6AAEBFBA417E597718215F5C19B0.1520.4118710752.245",
        "IL_86E8939DBFBF509449855F78C2A0E225F4211C744325A4D2583D7F1EDDA59427.2700.2197186243.278",
        "7104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "CD_61F33C9DE75CB13B4A6469AE01D1FD6BD56B098ED457BDC27158A62BBACE11D9.2745.523068386.363",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.2.1.16946",
        "NS_8BF863F3FD8ADE8AE6FB5A27773D0C0B0E7558E3C96E9E01A1EC786D0ECAE077",
        "I_0869E7F30E2A5BF6BEAEB4AC9D6BA65E60DD3C3396A670DFF5952A5180C69165.902.1.56485",
        "CD_CEABB348101F3A162B018E537F4DC218F478C7767318D8F5F024245B19F1BC61.1059.1691275628.443",
        "C_C763B99C7B231A1A6362C713E9C23D51C754DB9ED2FE58B76CDAA4A80DBB18B6",
        "I_27FAEA5F317A7D777DA2A8EBCBC3C42776D2CE02DCD68C27018D6EFB15E2A7CD.2485.3949131150.312",
        "CR_25A225BFD7C0706940B21958E1B4E7879B81C1069B2DA72D3945C2F2A653CB92",
        "I_0FDEA6B1EF5C766CB87D84DBF8B39A72DE3796CA0B78D5F22281D9A8B21093AF.1499.3351237689.194",
        "The specified LUN is not provided by the specified adapter",
        "CD_9D8D293A690FFEF350AE4D7C020869D528F57982A60CEA02D406951DA64B57DC.2615.3657052618.566",
        "B291553C4CBCA712D0343FC3CCA099002D9033C.2654.176141691.346",
        "LocalAddress",
        "CD_9E927C42162CFFA3624D55690B21114853C375D15511354B30627B7E45D7DB02.1148.197013648.306",
        "CD_21C86008A085A72EAA2F54BE2ED0590D75B28F32790405AE99F94878D4C5643C.2596.361145268.593",
        "on on error codes returned by the Windows Installer API and the Win32 error codes.",
        "CD_C512ED5FC2F1197607B14D5DB5ACB87E40AB351866BBAFEF73C3BDEFEF11BE00.2505.1347924275.3659",
        "CD_5A25B87C229EBA73993CBCAA6C98D2ABE024422E1CEED3A8A096904B578EC322.259.3095579182.2768",
        "I_0C314DF96E761C034D165A1501D0841DA1AE57BEE9502F0770706CFE7C27A0CD.2681.365970129.295",
        "LlTD`d",
        "CD_200C90EF1F37F3C6854C8BC7B412F068290AE1652EB71A6D74CD3129536DEEED.121.1024081879.751",
        "IL_F313821D4B5D3C6866BC3AF9C502C5112994830A40FC92E84BFB63A7EF6C01D7.2676.1046517479.279",
        "CD_E02AB7B49575715400AA81D4F29AC25F671C3F156359A5BF4B3C01A096EB8A80.2557.3953591497.686",
        "IL_94CF12D6B59E5FB1D3AB0344EC66ACEEEE807D6CBDE8CF0404B1D31219731882.2693.3225958961.268",
        "CD_20435E8E6AE6B07C92579F794D715DB6D35677395F702CF6B0B37C21C5C70F22.1617.3365262687.365",
        "R_C02C41AB4846F97931E5D01FBF12A4A1A5B3CB06D088BD1C51C3165A032FC9C8",
        "windowsVersion",
        "Count",
        "I_629C5244396AAA6AE24894FA9A4A212739458627A2BB41CE139C1105ABB1FDC0.2723.3809758341.301",
        "PAL B",
        "RSOP_PolmkrEnvironmentSetting",
        "C_A9AE64C03C11270991C8BCE26EBE3DD0FF3F841C3C80D3A28DC949EF9B62D60B",
        "CR_1592BFFCE522F75E708AF00D4ECAEEBA5AFE422B12D1211F8015509DB1FF98D6",
        "IL_C72044C5359DF7DC4480B7B809AE99A37C9C4FD06BB902C72B46C39D4D671757.1635.1430452203.331",
        "CD_259C5FBCDDA2F46A05D031FE1474E0BE7FAD9CC9F46018D9F05C6852D39E0093.1102.738400715.535",
        "C_BF0E7E6384960FEBAFECBC0C4E508C35BD1B9A9D1AB718135E30ECA0E2E30635",
        "C_5DAC8FD7A784A5954048F391B433376EC7D25E078473E5A528110007AFBF25CA",
        "Win32_CurrentTime",
        "CR_A3BB95ED0B202A25A7223B16F2A4B7FC5CE2975B203508279C7D21714713609A",
        "IL_DE3019D63D665816581C3F6C4BB9A8340047D6C3057F9103C4BE1E5369BD0B7C.2750.1570270033.227",
        " $(,048<@DHp",
        "C_E4C1DCFCCD28567D4AA147AE314111F8BAD2049466833D39D09F05CA71256EE6",
        "CR_25FE04D9255CB27C85849C6AF1510F628FE6A726CD3A80FEA1131E58085890F1",
        "CR_88EB302CD16E8AAFC6641BEDCC17551C2C447BB8B7A2C0179406C6688EA18D65",
        "CD_A3898C5255A1EFC888BD4736DA5618029E926F25A2513285DA71F554B0D3C354.2533.2165768171.413",
        "MessageID",
        "CR_94B88A78767EBA5CE84C8290634E59CF138F89C614389740E3EA6521391C28D8",
        "IL_56F845D6409BD980A1AC76C4045B0E569E439E11A2FC0BA3128DFADC978A6218.2714.1216230439.293",
        "CD_161C469CDEBA430DDED22BFEB8E493F5D9ACA6AE468ED0C2839064885A1BFF7B.2511.2585969491.2364",
        "CR_2800F9F89075C56302A7CF7269B5300116A62BE579546FA42D0E22E3EA14FE1F",
        "CR_FC9E01349E08A98452DDAB16AF1AEDB5BCA867ACBFA422162975D70294A03F4B",
        "TraceInit Flag",
        "I_191607D0BB5536D29EB5461AD5FC9EF2DEEA8E0E923A0CD78DB9084C9DFF7DFE.2704.251882722.289",
        "CD_5CF48B4594AF5A29D8F38D01C51E1EBAB43B90EB9606F532D289B128EB56580D.1735.1574734703.7957",
        "C_CB9297368BD3D60B9C9822D5B6B73F15F431BB59E5791B2F4E04F1008BD11D93",
        "I_C03DC5BA2B5585E0F65E3B0FAC80DBD1BF371C488C7B41509D549A777531D174.2718.2813665472.273",
        "CD_D7CCE4E0D73E0B597F5CF042DC8B98CF8D09A5704D22B6F528EDA8D7DA64D4E3.2577.2187628913.977",
        "I_496D4CDADE3D597E361CDE904A6093DE54824B4F71E423D5E867AF1A605A455B.2686.4024881698.269",
        "I_D055C7DACD8F90B78856388BF2CE8EBA10658B500AE545011AA63A392BB2FD19.1074.2284772691.336",
        "The version number of this WMI Provider",
        "C_BC9D109850BB5F86324C40247B677E50BD3CFF55E165C6078CA0EA6516A48293",
        "C_A5405992D9D674E902DFC53B45CA5EA7030AC30531ACB3BF91D0DF7BC783E1A4",
        "CF1E4C1DF7D3A.2668.1467727777.2299",
        "CD_F63E9DDBFEF6B5F00A102DFF31BE7441561DE4396AD9FF89BE26AD8D006CEB79.2198.2816180968.359",
        "NS_43C2C02FBB103B6C99DD6A3C49100E0157200FB50F8CAEF2EC314CAEF9D9E15C",
        "IL_01C76FA468673A0EA1B9609DBFD73E5A3BD638B19A8136374B3D41724E88832E.1782.1125694496.339",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.314.1165541664.180",
        "IL_DC45FBF4973498F885F2C82E6642F5FCD5B512BCFDEB2829F125921B46E2B87D.2682.961561144.287",
        "CE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0",
        "CD_0A78EF6F4A690AF3AED26FB328EB3A054B82E3E4610773D4F174482BCB6B4DB6.2593.3261281448.218",
        "C_ABD7B7F9833F119492F3D4F7A40EE07E387BD9DCD7D3898D26D4AF8C19661B13",
        "IL_258A203CF40D0BB1DCA0464E58BDF32C1FE546C6E10F7B59F5BC4AD6787D2A7C.1053.1905666107.319",
        "CD_BC4F91591102411312342399DC065D3EC257C15FFCA13E42BB6956DC3F1EDBC3.1830.1692455188.416",
        "I_37ECB0FC067D850AC282384258FD54C71F901EB4FE0DA87DE18B8C19E1262A36.587.1.74409",
        "AddressSpaceID",
        "CD_DF9F2FC6FD92145061FBD996E3F615861A2861FB55A5CEE4F16822FB71A07AF1.2654.4179003060.464",
        "CD_C869A64A264016A40CDC6BE908580A71D42C8A4A557BAE5179CC1536A843969C.100.2242599512.500",
        "CD_7CEB103F91AEEF1DB6C084EBDE11E5E0AADB5B9B8244715CE731078F7E98A92C.2653.1686259005.844",
        "C_4720AF4CA174274F71D8038B37E58001F7A92E2A83E49C05ABD2C15725C10921",
        "C_5842378308FCA74CB08DA5049999AFEBED270A8D2947073DE67DDE6B41DAEDFB",
        "IL_F09D5F9D0249487F8E1F69CEEEDC11ACE977B752E9987A45F721389AD20D7C8A.2674.491487911.268",
        "$t\\`px|",
        "IL_E0E6EC4FED3B5C2E3E8EEAA7E3AC8D3D33C253568BBF6F16FF8E5FDBDEB6D4AC.2679.779914690.273",
        "C_DCC2AE997AB356670D27AB6AF0A0DF5B38BE28906D897D91C86FB38CED159D17",
        "83B8A4F15F872069B1769D0052D0A7D6F69174C6CC64702798ABF.2712.1831612025.298",
        "IL_7BA978978EBF3CD1200A10044AC0BD6F4758993016B7F6B6A538255F2BFBBE7A.1714.1923157742.391",
        "The List of Published Applications available on a Terminal Server",
        "C_F63E9DDBFEF6B5F00A102DFF31BE7441561DE4396AD9FF89BE26AD8D006CEB79",
        "CD_EEAD818D8A1842ECEAC3402EA8E1218625133E524B21C247A699A22AC7743B34.2621.488179932.1821",
        "I_66DA71BA28E298AFE44B6F7A671DF042F12441319F66F1B266CB86486B7E2819.2691.3809755125.273",
        "R_E37604830FBE848C9F5F272FA9BC2565190C5D27DA59248C5C2BCD0F9BBAD912.1938.2158087227.536",
        "IL_A52F0BAEB12B27CF368AFA80F6E068CB06A37904A8B7DD0285DE45F269076401.2704.3647049337.282",
        "C_CA5E03B6357EEF3C2F92CFD39219BA6C5D6285B9E53EBC324CA96967ADC89A91",
        "CD_406F546FAB6014271EADE336F5C1DA060EE35CB23E405330559A7A1A746C6CC8.305.3425428412.1083",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.2753.1.16946",
        "CD_A41939E0A9F67F9DF2AD8D69CA074CE0921E39A835026C34A18F8B136AFA5974.2571.3474045217.552",
        "BfeTraceProvider",
        "IL_60E73D270C0AAF405200C83C2004E20ADD441F756EE8A87BD48C1BE17A90AF6E.2713.1788351777.274",
        "6B6F9A9E07C666B49D000879A54E67F9CE0EAF2B8B7EF7BCA31E7303EC222A",
        "CD_082C07D164552D2B77F2EAD04875A64B40DC14D08A8AF625C8BCA071DE48CDE0.1334.3713741467.1720",
        "IL_69B780709DA4835635B0B7E8E54790634975F2907F04C0691BF6F48A6FAFC3A6.2689.4259655786.279",
        " $<(l",
        "C_EA78D27F46C798D1329821D7CEABFD06DD3833EE6512664694DD451E0D988F35",
        "C_529BECC83D26140D1AC72C286E31F3E47F269358AC822318B473E243E5CBE961",
        "Remote Replica Source or Target",
        "IL_AE91F29EF550201BD116F39FD4660111D2D7567B1B027758CC9F7782A63B92BA.1015.4065632248.299",
        "IL_5300381FDD8CA68530BF42F687579F4795E6FAE9D6D60CF7B02015DD6EAA0272.2642.2578764341.263",
        "IL_8ECE79C824EFDC6E9FFF68EA4E168D115D7DE1CFFC679067A8D896B92A7EFA00.1150.989067740.359",
        "IL_290358381D29E05404EC74ACEC8C4140CCD1016B36F6A1B516F4F361DE45F8D7.2697.765963333.267",
        "CD_C69F291BE89C7DCF47D514EEA88ABF7BDEC9B45B40FE7D549762134D0ED90168.314.1000213303.266",
        "CD_9A0DB23B4C5307A117BBF9E162F8E0A10B387D66AA6B5AEFE4F2996B31F1D028.1638.345736028.317",
        "IL_CDE94F817957CEAB99ACBB6A96875812D668C8A1F0207ED777E976D3E4A54281.2720.783066222.287",
        "I_352DA062E6CEF4DA2F5F5D5156A0C6A57E2D07D0BD43F09E3B9B31D33B72076E.2462.3117649240.360",
        "CR_3AA9C8A0942F537FDAE95E548CCBAD1AD1FFA8F4AD1AFE2EE57031F74E67B391",
        "I_0DCED9E1ACE5BCB5BD4659B22A968ACD211DAD28DD1F7F8E29338776357B1C20.1462.4012455625.329",
        "R_2460E8CBAD4976C1EF65909F8B454C3EA4189EE3EFB11690076237B70F3B14A4.1635.3365930065.564",
        "CD_55EDCCF4E5A9ABD76428DEC07ABF127ABAF79D731BF9177B4B1A7951CA86E45C.1210.846990250.284",
        "IL_B6594D10423DB3AD91F7281DECB505C7018BF7C3DF8C8AEB5588F472A97F5870.2680.1562761074.290",
        "C_F060FA1BEB1E1ABE21F8F41E5434AA241BD7259FD83E7DA0D4CBCF6D857A2A7D",
        "R_C6F2B33A9F7EE971E46DC4A05944D1F3ED258A4BBB229A6782F76407411C3AAF",
        "CD_182B278AE17EF436222CF898233A5570CEFA34AE3C899B34E416A06097E828C2.1929.3855367377.1043",
        "R_130F1C3C29111AD1E8F485A9C57AAA4AFD7E43ED53D005581436A437F8C3A1B8",
        "IL_CE15A28990A8AF1557619E69E9D387E8E0E2FDEEA17DD198F8741FEE3581E83B.2681.875278252.278",
        "CD_831AA66AA33E94794A3BE28998D5135FCA9FB48FF5649C034A00E2F57ED4C256.2597.547325437.88",
        "IR_56FE5B970B13F36ED26A6D17BF0D2D39399EAE8A7E20EB72D88B464210DB967A",
        "CD_92F79C606CEA0C128DE3EACA21B84DC513661F7F539551F200C91725DE47D5D0.1303.4150396917.269",
        "I_DBCD4213014601A293AABE7F4277D0A7FEC9623E379CDC7AA6A9EE60BBE340D3.1782.1966029283.266",
        "CD_5792E9D1C6933FA6423EE5A5FA8BFB08652AE142B0B622790C9FE3AE890002E6.2541.3099139856.531",
        "I_7E6A00AAB8467A7129258A087A168DE70442F1968001FDE8C28653B84A0C1849.1783.2922899065.257",
        "IL_EF834228966C1F2CC7874FBBF528776CCCACEA997767675859CB79A3FD180C8A.2726.316239879.279",
        "IL_8F1D0EEFF09882E0AA524E87B53BDFC6C73AAB5D286B5498249DD4CCD51331DD.2749.2953650039.201",
        "CD_3BC513ECDB7610139D47A64B522D78B92D64F0325749C638433540275FAC912C.1923.3031499285.293",
        "CD_F9BE908E6B04D349324914882C01F43FCF82F51D09CD15BB331EF4E9B8630371.2649.108164427.1766",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1534.683258863.180",
        "CR_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45",
        "CD_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2.1172.4196415368.3291",
        "C_DE8DE1F6359006F632B83164424286AC021768B2313FD2622030D37E0386BD3D",
        "CR_6C1898742A435BD7596F148E1B69FF49CF55B8A3AC2058CDA5C944CFF7E6FBB0",
        "CR_D6B832D04D0FAB582A050E5212201E6DF3C06194D4D96931CCBF8B3053F5A8AF",
        "R_7758B30874183320F25F4F9789C477D48C7F6AAB3A386DF09B6FBEBA7488BB28",
        "CD_19C500FDB2411645397763142D9A3522EA74E9619B1C45A89DC1DCDB49E04CDD.0.727902936.203",
        "IL_D1B648BE68EC7094B701AE10865E8710BF3CA0727020E467239EE608D1A161DA.691.1.31519",
        "CD_BE454F6C402AF8C16FC12197B80EB1F7ED1F22A86325293F4C71A4EEFC7BE40B.1332.1920335323.1211",
        "C_D769628D5FBDC4BA586DBAD54F9BBC7939E2EAE50970F6EE1F1C2EEC6A00F545",
        "I_AD6336C175D9F9D2E56D05ECB1A5E2CBA761DB39CD3155C45C4ABCA3DE2AF082.2676.2756531391.275",
        "CD_9927560F406539B360E8823467081055AD1699B2FD33F2E0AE285CAA17CE2D89.1346.1986680860.1255",
        "IL_BD0D9FFD284A3D1434105414B7483C9051A02DBB999FD428F208B174229540C1.2678.2019169671.281",
        "CD_F0B32BE6D192E46E123BE3140979FC2B0A80F593F5ABF50DA89150CD93028881.2620.4057118753.546",
        "CR_DA3DC1260150EA9B0B2628C0C2AA81125377900B91EB681EA05BC31E6A7900FC",
        "C_559E7BBCB66AB99B2C2082F563286257BBCF9A5FEAF75E8EE8F89CCEC43CC26F",
        "CD_6A626287DB2D297B2933F0627963C6CDBB9ED9EDBC6F1EE6B68A428340040D87.36.2909391636.581",
        "R_65C6883936BD0C78C8E38FB56AABC2614EA93FF45C056006891AF273AC6F4539",
        "C_E74AE202199C3BCCC455E82ABE0275331EE227666C9BEE443B7082437E29EAF6",
        "CD_C48EAD99401EDD040FFC4F7D4C7D2EA74DBD383F4E1272208648D0E13C404FB7.1292.3023110199.1428",
        "k8;>AeDhGJMQ]U",
        "C_A03C484E06B72F9F42200B57F029B8D46D26D0855AF12E8562CCAF99ADA5E20C",
        "CD_863BE16984A9E1F3B73E396EDF2C42F981406DB8DAA1557BAA5A173376882392.312.376861700.345",
        "CD_A81E4033C09F5F8E3B3660FFFCB2BDD5A79334D687873FAF6A85B55A7F0A7A5A.1514.1742902484.361",
        "I_A1D5F02E3491B010F201B5073B17B53AFCCD5A0131A765FA4DA05F38783FA482.1777.153436026.329",
        "CD_A21DD98AF56DC0A7D21C24764DDA5A5F7A3EA65FE4980FAAB7F2035E4807972C.35.2172079928.521",
        "I_E7DC64A58FCBCA5E53B44BE9843708DC83EEEA00054B3AAD4AFA691469884ABA.2715.531817342.273",
        "IL_C59E83547F1BC933FE30770D4EDB5077AA988B54FE242F5F66DA214D449E875A.320.1.62809",
        "C_71D279F146E6F78B1626E5D2F11A743CA9A14347FC1E4EBDFB8267FE065E5721",
        "CR_11D484FDE19A8F43D1F07FDCD47FC2D8E23EAFB01FF975179CD32C427E1C3CA4",
        "Virtual Path to the application",
        "IL_50D86B9BD0CCE71A1892428210DE601A0BEB6AA770B120DF7B09578469C813B1.2723.568933622.287",
        "C_73F9CC8D0A2B5107ED79AE2372D78EAA3B2A7A24FD2BD2876517DA1B42CB16AD",
        "I_4ED6DDD5E334C3E7C1F10D522D838999BC5C70AB9504FAC6982D79F19F10D56F.2728.1879650429.297",
        "CR_696458CF2676799CFE15561DC95060B16AFF52FCF4E0D19900C2981C3D512363",
        "CD_ED267EE324D3421C9BD582F00F7F4EC3645A8F358122D414EE824EC6E0323BB4.2396.1.10733",
        "CD_AB6B0E99E53700B220CC98E6FA99632EF2E30AA8973E530FB5000EC341F81DBE.1192.2038652275.308",
        "I_DF76677839457195C9EC2EC31989DE8A15D17173C5ABFE21BC9367C1D44CDD0C.2723.2044538910.274",
        "CD_C84DD871FB7E9CB6D29DCC02EA27D46F8AC10106A4A5F7B1A7A789F07E15462D.270.107384653.562",
        "CD_B7706B28FDE42900BD4C0DBC550087B0F05CF9BC30AB26E796AD48A7E503711E.138.682700594.954",
        "CD_B89F81602D340760DCBF9C7FA464908E742B64A7C6E08A776FA3C9E7E3DE6507.2748.3211458940.784",
        "CD_1506642A134522C9F851E5C23634B06B50C7C4FFFF72ECC0271F5A6147784C88.313.3538706190.430",
        "CD_5E46683FD84F3219E379253BDA01FEC308C95988FDF4807D31199D70DC1E39D4.1677.1699830722.344",
        "CD_99343CBC3477F7F6125FD1666914F7CFF746CB5EAD9718A0BED14E0D6EFE4BA8.69.871188413.642",
        "R_D84C20ADAE7734ADEDD351AA1913B45E77A2D3C73A060D78DCB39E45C0048488.1976.2491820504.550",
        "IL_133AE77889577C41679A67ADB2FE6AD9A47EDBC4C9E19AA735345C392697BF03.522.1.61884",
        "C_D06AFFAC2BC7D4CDADAE168F13A58C11549C401D0988835D77BC4E04A248490D",
        "I_78016DA4421A681836ECD7E5063EA91D97166838075B72A11E2732D08CE3DF2A.2690.3474447830.268",
        "IL_9E442DF105E48B3E8850AAF74B8196762231E538CF4C9B021A23F23806B2B0B5.2676.2238198660.277",
        "CD_4EF9C71BC878CDED855571486DDA10408A556B0E0B2473232D97D8125D3EABD7.17.3842056616.994",
        "CR_FCF416010D567B5041BC82F46732C142DC125B68750168BA980728F3E2F25AEF",
        "CD_6C1898742A435BD7596F148E1B69FF49CF55B8A3AC2058CDA5C944CFF7E6FBB0.170.2059564699.418",
        "CD_6B6D0B828C66AFA5D96ABFFC61FD129B9C2E80C49CA8F276476B6798C33F6D5A.1151.2310207997.322",
        "C_524ED280AB38E3BD86074B4D556A261D98A4E9D85B8A2DCDD6AA2F85E3342805",
        "Dedicated",
        "C_D3E87AC2C5095799D67D44AE7591A2749E7365471471AF9E1AB7656018268D5D",
        "C_D2A706123FEDDDB0E412FDF2001A3E316EB3BAC437EDAC79D66B7AE69CAEFF59",
        "ceName]",
        "CD_3F26840D55F2C9EE3144D0CA0332385E4BFD5335976463476BEFF83F15CBED2A.1541.4226301534.633",
        "CD_C56C7608FF9CFCC8A840FA69CC790774A3CB4E3B2FDC6233899BCC626F12C6E2.2607.2968302572.3034",
        "IL_44036BB171D9AF18031EF01FE0D886C451F6A0525C04F1E6CE83BE3EC9A88806.2710.1513184605.283",
        "I_34F1A82C3B27A30102A63A0F1AB4E9F2DB6C7516B2513A65F0D546795DBD4DD0.2678.3839283995.278",
        "CR_048516085D0CFD11B2F57F36AC760E979F1E172A7E7675BE4EBC8F8315497197",
        "CD_44199FEB2EA5AA114C34FEFCE15EC340288F3AE7F2F9B159DAE8176076473712.2743.900683879.342",
        "C_6F1D850858EF02D0889AD0CA1703D1700194AA8D4FA27667FC3CDD1F09CF1E5F",
        "CI_4890EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "CD_1319481AE46A12CC16DCD2CF74CC91B9F47EC011AFDF72991BF4AEE0746B16E4.1970.3388963974.670",
        "CD_8E00C05F9C7AF889450AC5E1CAD304CFC7B180A1B25B24C78DB3783F494A027B.2731.279900259.912",
        "C_AB1C96FED05D62166C94AAB8AE8E68ADBB7D202B0967CAE80232063AA6F41C6A",
        "CR_AE9C53160D7B3434C4E52312393F9F5DDEF1A08E93BC409447AB0DDF8F479C75",
        "IL_E8BD339E775BF7B67E98E8F320BDBE14F99A5C435E7E6A3E02A0986B0E0FD8A1.2723.2684840011.283",
        "I_5EBF93E0C149B1B151E338091E85B09A85B53ED88BB6E56FB2EB094E120431E2.2466.3936457751.280",
        "CD_8236493D7B4C97328F05E9610B58340A9B36DA2FAD39FFAA641A6E8D9062FAF7.1131.252662121.300",
        "C_07E19E30C996BE5EB2C069F75B45EC8BE08416240089C28E8823A8AA0508BAE7",
        "CD_513CDE95079518F112965AA406F17722C0A89A191927E09A325D3D3202159331.37.3054417447.442",
        "Force",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.297.3516843711.368",
        "R_FDCCE3B8287A28E29DABA3413AA9105F2F7512D7329C1A17D887D616F6D5B8C1",
        "C_488B67E05BD8C144F890DD1628D2D632822D5CE3B99BFDA24BA6CC55C387B3C4",
        "!$T'*E-K03Z69=Acjn",
        "R_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109",
        "IL_5E604AC13A084AE3258A5FB5ECC21F7B434FF6A3C71A7EE33A73627FB9C64E62.2736.26687260.282",
        "HbaPortWWN",
        "CD_FADBE2E77FCF902970F9409C89AA00953D8589FFDED776632A19501236075BDC.1570.1926945154.430",
        "C_6950671007C747CA29BE37421723DF7334666E44C868944CF21712604BE6CCBF",
        "IL_7629C5FFF95B27F0CF574FB9DAB9102B371BF6DFA3132EE58FBB84AC5229A6FC.2727.57686035.283",
        "C_9DA9A42CAE7919197E51305D69CEECAE7B645320A73D6DC468ACB11BA2001D79",
        "I_B5291A6580526AC18DDEF779CC119DE64B0A41F8881BF1D75D1790F4CE044637.2724.364222005.293",
        "IL_F4D3591FBB73B629A7C321C5AD504E9A8359C09FA6F974222EB6494D3100C2D8.2680.3568111899.285",
        "C_EF2B7DC0EB341A8F463C94D322352FFC844C71A2889934DEDB50779AC5CCABF5",
        "CD_DF63DA4731494DE04BDDA4D884913821094DB03ED408823FA36FE78B0159CEB1.1594.701274514.1053",
        "CD_818DB2B3AB26C49A2AEB1D243B555363E794DB6E712436AF8BBB2D25701B24B8.1103.3381062113.597",
        "C_A32E78F452946944B493C9750EF53414AB7A288F9EC50AFA095C45B0E5870216",
        "CD_9B01CFBED85021F674652BB25CFFC191CB28785D5E349AE5E91AB199C2788033.2638.4273029549.1349",
        "HeapSubsegmentReuseThresholdActivated",
        "CD_E79E473D9AFE640F2D96DB2EAF3BE608705DB3CD9E43BB21D75E95C836D378B4.2596.1410818090.172",
        "I_412C48135F0659768A8D638CF71C02128E9CD17B9F30AE8D224F4E868C4B60C7.2682.3464011586.289",
        "CD_13F8CBA3C82C56751066C09B89C76BE6E4E2E2A1DB6E05D411BC404F24CF967F.1936.173499041.530",
        "SECAM L1",
        "I_D13D78A8B49C9009D64F6AF25B0E74411A42F0AEADA9C45D7A99752140A29831.2713.898349626.272",
        "C_3C3DC1FC0A2C3362852034A421CA1C0F5DEFC85E5D2010545B210907E075E4DF",
        "CD_64F3934C77CBCF89E84DA868459634281E17E5BCF13A323142A343FF887F35B5.140.3213914520.740",
        "C_0F988AA56217E8EB25B7DE4FB153503009567FC06222C017E84DCD1623DC5829",
        "CD_3F7D1945899799D2D40207E5AF573ECA3E160556FC8C2123E5A1AEABAFB3BFA1.2575.3701481001.589",
        "IR_F20A17854D196E5F5EAFB2F68B5391393593509411BC3D5F3DE70A824F1D4E22",
        "IL_C0DCD2330B402CCB79ADC9A534E5029F8DDEDEFB826D41905F5E8463B821C3EF.2457.3939950857.361",
        "CD_CC6778A70C199F671CD04BFF86EE613A1E47C11B60BA19CC09AC555F9BA03FEF.94.3268614449.652",
        "CD_2F2D52E78951A71F8A93996784706E5CDAF8CEE0DBC76918027981F3C4C35B5E.1075.1976875637.815",
        "IL_9A8D16DA945B743700B7FF96F3F0DC3A77DDF6AE107EB1A442E8C93AE53FC3DD.2692.1730269088.279",
        "C_17C0C742144CF5FC4AE8EA9E1463C99C7B74A2C4D58756A1E2DF35FD85D11576",
        "I_42349C139613955F5AC3646E664C0BA54BD06D4BF12E7BF8CEBEA1F9CA990DFB.2700.1080190928.287",
        "IL_028B8A3522A7C64913B50829FA2EE1ED87541114F62CE3FE0A6BFCECAB708634.2715.1432374786.279",
        "CD_563CAEFB32DA9C6DA846FEF0491B998A5AEB53D92D124F8B8C12120BA57E3D17.2418.2633807073.675",
        "I_A111E7F89C1C848588C2514B9F7117AA41CDA991BF49D22CA3C7528AAAD3EBCB.1183.1371394625.273",
        "CD_1DE9FB32A31608C0D926707ED4C676D8E34FABC2C5C4559D485897F5E366AF39.2672.3230603687.122",
        "IL_BD93AFD54A2CBC0AAE6AC538B824779A9A1273B2B91BB9D43D9256B804C5A7BC.445.1.30870",
        "C_532C16391BA52367462C4A3723D130160AE1A6A70CD780A9281117753621FA5C",
        "C87585EA55F9481A3817C321080794083AF98F344F8219284F79C17",
        "CD_94167BF91BE19E1C62EEDAB062E1BD60608CAB59EBE8824D966E9FC0913F7356.1103.260938622.488",
        "CD_A05374182360C61F50CB18CDEC015D253C42693E608575287859129E69245893.2620.1459082191.1743",
        "CD_A042D558C8D8C5910DD5298BC5D29889BA5CEA0D1A22A1BD4A1EF145F3C99D41.2739.2873796740.309",
        "{!$'*-0369<~x?BEHKN",
        "I_996350F32E01C57879AA95FD767F8BCD28BE9CA42F3C2027743354B5CB423C14.2690.2334399331.269",
        "IL_4EE85D110211054A9DD8CB215315DF05DAB2D2D335C9845F6E590FDF8F6AF10C.2485.1611265426.327",
        "CD_15A139866A05DA114FEFEDBCDD1A1CE7ECC7161C7A0053EFB8918A0783845D31.1019.658780118.825",
        "CD_D48886C73DD49B540F592803EAFD1F804FC85FA1E036602F910CF8A02AF4AEBA.2585.1681773430.760",
        "CD_A963FF6A8458E9C4FEA354824C031F4237B8648981577F19FD6854C86994DA8C.1798.1.8651",
        "CD_7A167BBDF45B83A696F84C3A949AD0334E4C02429B5F7494290F95DC7940CA17.2667.3303191066.327",
        "C_681F04C717B34C7842AFE82074DEC59FCDB97C166864F9245FF3327284F1AF2E",
        "CD_0321441591402F5AF02BB91D74BEE22B0CD8DD0874929978DA89FBE91F7CA9DF.1189.1349110127.324",
        "CD_503E99E1F76A9D46449F32E9069632CBB392B8A00D8C4838939B6A5881D7193A.1.2896285417.284",
        "C_3E05AD9B0EF48B56D8E66F97FDA74729A6BBB63CA86F70BDA1C963141ABAE854",
        "R_F33B13E58D7A9AAB64E31B8DEDA19CFF557C834DF5EDDCB1F5F929CFA150BD59",
        "C_040EEFB9D32ACFDF35093E1B9FBC87E0DA3C6102445122A04A158078F02AF3C6",
        "CD_BD8329DC9A85A4919F9F60EB4D48B035D2F30D4D189BD4EEBE828F7FED6AA535.1605.2303409370.2698",
        "R_57839BB831B678823813D6DE5621B2492B8DEE2CAA3C37F3643245385D720644",
        "The storage pool could not complete the operation because its health or operational status does not permit it.",
        "C_C21E8ECEFF103DE2D58A051FBB124028D9968F5617844FDA582F260A7956CF1E",
        "(lp,dh",
        "C_1A53C27717254634421006A16C1AA377239E0FDC903C1336CD4C4BD340D2B379",
        "CD_1FD7B26C8C4FFE0BF45F5DDC5492AED41895B4A7FEA3E20CF6E8FADC218E797E.40.981822121.397",
        "Interactive UNIX",
        "(,048",
        "CD_F33D7C5F62C48A98254F1B0ADED8C5A8E56D1601D517CF44369F4A800E4AA9F6.1081.2742091215.340",
        "CD_BD27ECB0ABA308B208AA9811DD1A6EF25258EB65F89EC1120D9161B0217F9A7E.254.2386666917.547",
        "CD_7BD86541C4D37094DD12C29DFB358834E34ADB28AD42E60E36A946EB5619F833.66.3004454479.676",
        "C_B715CBD523374FBED801AECAF12284FC6BC34C5D6F6D2476176EDBA2C8EF1A70",
        "R_E307BE2388F4DD08F0918C82D97E15C14EE0D97137D0C6FB34A30F84A30D07C8.1149.1548500264.516",
        "C_7BD86541C4D37094DD12C29DFB358834E34ADB28AD42E60E36A946EB5619F833",
        "CD_DB6D3B84420B8B2E5B0952A4263B4AAE435874E5D752A7B6377F6681799057A9.277.91817628.370",
        "C_87D008EFB09EBE054B42238F99E961FB1656BB710FB8E0DD5A877F77715BB017",
        "I_CED440B502C087A2C713CD20C5E65F7469FD10802B432CFF618E2EDB760DB7E1.2608.483129935.276",
        "I_2D4822F447C7F0E252E16C28DD4A338F7F4E3A0F623068523A20813A715A5693.2697.407692074.272",
        "C_E5B9DAB25A46409E53C7163FCAB062505567F69B2967779FFA51AE5E30243288",
        "The quota setting",
        " $(|,",
        "I_EFE41996B6528DA71C5D9F71F47A3F33107E49205F01C1A05CFF6C62B645E7F7.2698.354292778.271",
        "CD_D8C4BEE78676847DDA567812087141E2560365728D8010694F2F477EFE65ACF9.266.2933708467.5252",
        "CD_1E88F907B6AB946BA7ADADEE8E260F06B3FB1525A4BFD9A858EFE9DCEC84BE35.2622.3905402544.223",
        "CD_3196586F94E9CFEA6D912774CB2A6C6FDB2471424853F54D4C0F4EE4F94880DF.1644.1.20605",
        "I_59BFAFEBF60E8B2104B07BA7FADAF4FCFEB18999FE92B11F1C00E938CB4B93A6.1018.2627328795.246",
        "I_A061B1FC84C0FDD3E8154A924EF3CE4D547214F368F2C40AD7F2621B09FB3D04.2733.2399235509.283",
        "CD_4B5A98799E9F89299CF2B3F25F26C1BCCD944C8F4FF1171DA43EA42211F0976D.1951.3808377763.628",
        "CD_6A34DEB33A28A5C79FACD308002DEAAFD811689101AD1C977E557E3DB84950D4.1129.1432017691.1760",
        "I_D66C684E9FC811F59DEEE01676A52DEC4EE3ED220BA185CD83762B906B852957.883.1.79329",
        "CD_0D519108D85D82BAB33681414520F8FCB8ADE86295F011C324EC49523D7AD353.275.1542923086.3616",
        "<xQ9'E~",
        "CD_D5312D2CB1C1201CA5C65DFF999460FF4879179CFEF4C66A96B6BFBDF88AAF0B.2425.1293550796.337",
        "object:MS_SMHBA_BINDINGENTRY",
        "I_2448AF929C8B54CCA310FC04802D9C54B721C1204C40A0254AC25202A4CB4113.2692.448524938.277",
        "C_BFC8B938622E2DB869D95C1AAA9015F080331D812139563B91142DFEA46D4FF4",
        "C_DAD7DC48BEC7F412021168603D2D9D3CF712E3B9F8DCC4820417979B6C361AE6",
        "C_F74F5C3E1B9BA2367C698800DF2F3BC633C4E02E4FCF6F1DF2A045F2CE914992",
        "CR_7452F14093AA45A6FA141E92387672987578A9B50AFBD7A89E994756201A5879",
        "sourceName]",
        "\\\\.\\root\\CIMV2:__Win32Provider.Name=\"MSVDS__PROVIDER\"",
        "C_8138F4ADEC088E4095888DA6FCD94E1E570F42A36E273294FAE982F309E8DBE8",
        "C_048516085D0CFD11B2F57F36AC760E979F1E172A7E7675BE4EBC8F8315497197",
        "C_296F9D2499D05F25161C718D677DEB7A19A5724537306D0D3846F8C0EDD51EA2",
        "The name of the volume for which this report is generated.  This property can the the volume drive letter, a mount point or the volume GUID name.",
        "CD_965230E4BEA87F5FD29FAB71D815A8C331F1FE2001B3E492EFEDFCE72E70034B.1195.1021179346.705",
        "CD_05D916B8A6374C4F193D5E08BCB54B1C2461B412F69F755D01428DA36005F49B.2545.2210461905.574",
        "I_DA3A87092C237FFCADC5613E7D4E1F15D3F1C899206626A2E64A51A53F4EA3B6.2711.1025470266.302",
        "I_B475A6628233B4944B81DA3423FAE3BD8F18CC98CAADFF5AF00B029CA10EAC6A.2728.1610181514.280",
        "CD_34865E78DCFE7264A2E20E5113D9C23EC99F3A36B7F917B96D67DE0651659EA5.2538.2244778440.506",
        "C_674E009399067E9F8FCA00BCCBF5E035F85107EC0F73CE72DDBB417BF5D094F1",
        "lW!$xf'u",
        "C_E9A271CDB0AA8DC93908354AF625A7677ECC24A76A0652A26604EE491F530085",
        "R_B993D3DEB5E46C275A88F026AF84776EAF4571D8631295ABECA2B76A62F379E8",
        "CD_974F68602E2292AC89BD27596E610F3132E5D27B95115A1EF4740F8D7EC0ADFD.2660.288938041.1378",
        "C_A6D4B9C5076527980D321B1B5728BFA29A63E8F1E9F53D658A14196F5D25EBAD",
        "CD_6F6CD8CF6EA45E347E510153C47F4A156F13C2264BE2BC47D09C5D940D064846.1050.3342512576.141",
        "IL_2CC7D5D6072B5D4DB964533E1ADBEBB6F25582E0CEA5BD1409F44D8621637942.2716.3209016908.273",
        "R_DFC25D46E8711DD4634FF6390AFD6E0F348F88B4F5FAE966D405DF4EAE83DD54",
        "I_FD31D24AB6D41EE0B1779B8ECFE35583D5BB3EE8072DB7307D484F5572701CDF.2714.3790606445.285",
        "IL_04F29CAEAE5D62F782C498C740EBEB5E9AE73F4CC7EFFFE7894029C92D5CA28E.2686.1009424940.275",
        "CD_9306698C01F89BF0B51534BC38CEB10F9556344574338B9E17B1FD19E593FD78.2637.925033545.268",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.1172.3893623209.1313",
        "IL_FAD079B10FE0633A913D5AE19E9595EC2C3520619632AF5FF0B02D2F47A4F2D9.2715.2426944491.274",
        "C_199B86443F24E0A1E6BF357315CA9CBEAD82F24D15E6EF0C429DB46E1456E291",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2510.556897021.368",
        "      <rules context=\"System\">",
        "CD_5CB6A0A003499DF6531A245112372798390EB984E42ACEC32EC128E82F56ADB5.2007.3426968674.1352",
        "I_94DDA322336F7277C8F91D40563D322E5E4B3B88BF289C791F4F9ADF8AA54AE2.2706.2339987804.292",
        "NtNumber",
        "CD_8105231C8A3F2DF94C9C7F6EBD5BD2604617F4A36486778B9E1603208DF83C44.150.468714071.1218",
        "C_D7F29C6D74222A2F53039DD4BC77A6BF91AEF843F0144C1443D812EF420EA4EF",
        "CR_290F6F8B3B7EAA26E7735FACB33E9185DC97B5AF85F7FE15A4C9FA4C0EBACD95",
        "C_9D49DE5FE7117A424F94DC4AF7045470A4F37083CA49767395F84BEFE3CC8A71",
        "I_02E3B029E91BD2F58BF6CF927BE5C0627DB8324470F3AE50EE9B8F6058666DE9.2704.465252739.289",
        "IL_46AF92B03D94AE91F05F2694DD28503D493A90FC13BE25E09CA603F2D0E99422.2691.1044265535.262",
        "C_567A5780A80E396C0983EB16985C38ECB3908CF71E7B109F7F8365635205A7AB",
        "C_125249D4EFFECBE0173319BB999B626A8F1F8DA26493B11A58923199699B3F45",
        "CD_E626C49C2DBDF1D0BDC38FFC05C85B76B4BE8E69CBFD214D5F89F70F619AD6CD.2273.2575399642.162",
        "File System",
        "Active",
        "R_0B91D9FD5945CFB775F0EBD6F596CF88166602A6156A99CD2B11EC548E5ED28D",
        "I_A9B3DD9EA49BF66D41F4D4C9CD5CC3BDC374E6A4B1AA37DFD45950011CE94B7E.2696.245599062.277",
        "R_241ED574CEA1CE45C178048218C62F092191B3FEDB2EDBBB00DA39363C5BD5B2.1163.2401848248.526",
        "C_2610AE43344CB8A8BEBCBF0C082C8831B2C58FDE9BB071E6F1F013E7085FE453",
        "0x00001000",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.11.2102746553.840",
        "CD_AEF5A70C706EB1C2AF0BC5B36F14C87FA31F991587A5360179E66B8CF9ECD4E1.1677.1264930430.265",
        "I_848E55FD5F4FC523C00864C2E37F5A0ECCC3D19673B52AA68E334B012EECD2F9.1714.865885876.395",
        "CR_9729932C6A230E6D076D16A739C9C55BCFE9B5CECD58C2301470D12143397086",
        "CD_2490985DC8B40E4DC4CB854CE287506A87F77AC2FAFA9F0EAF508AF96FCB945F.2524.465837616.7491",
        "CD_38BD5C5FBE64888D5B30C67C4333B4A6856A6BD1D71F9FA08E4958EA88393E70.2017.1751226290.1351",
        "IL_BED999C9BF7E84BAB50F0A32D016E7D1CAEC2193DF18DA06E4E9B9F14F58F2B8.1752.4202770994.340",
        "C_B61336F486B4EBD99224D810D7A531385DFBF6EBF9CCD5ED509E655926A6E528",
        "CD_25191DCE3358FD8B8C1714272C2D24314EFB64EE716A136F809F4CE188499657.2106.769393907.964",
        "C_FECAA7D881E1936D6E68C32184EED7FA22BD8EE1B1605048DE3B066109121C0B",
        "CD_F34DE71B2CAA78B0B6E197AEC8F7CB5876472AEDE7848CCF66EF8194FE5EA5F3.2667.147631081.196",
        "CD_065D9E98A48D34FE9F1D987AAED57F037C48B1B316F34AE66BEBDA2778004AA0.2655.3389814434.650",
        "CD_DF35CAA9032B2BC8E9E68BEFAD5091A66EF205D46DBC51F13F62EC987E8BBEAC.158.146821272.233",
        "CD_92D90F38218063ED84DEBF091001DAB75383FEA23B31338C700BDB5B69D9A383.1147.1473008673.1810",
        "CD_7A3B231F7857F436EA541134B8B2B23DC95CD36328F957D4EEB31FA93298AA7F.2615.91689049.383",
        "MSTapeDriveParam",
        "CD_64BFF80BB1E6E3B33E8CEA6C6D45DECFDC685BFA89D8A317B5D3C5C82668E6FB.2733.172432255.502",
        "CD_79D204F57ADBFA7AEF3CC804597A60124AA93768D70021572BF2BDB80A7A7D26.1332.3077607667.1598",
        "CR_94D3D66BD2EBA9427DC5E5441BF12C249317CE8B6E74F24C2C5B169DCAA56DA0",
        "AutoBoostClearFloor",
        "CD_642EBC67FF61EFF34AD21679C796E3CB07BEBCB918B03A2FC1E43AD624F651E4.57.3586071633.1219",
        "C_4BB71B6ADFF06C586A8BDF449E468900F2E5FA784A24501C7DD0806A9C51B570",
        "CD_2B7C33A8279680277817A99329ABE8DC59107022EF9DBDB1B01C276CB7BD1FDC.265.1562438638.713",
        "I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D.2763.2035422396.255",
        "C_9D9326DBD5B904F2FA39C7A8BD8707BEB4F5A372DD531987B409839FFAE50966",
        "I_E3D7F95EFC48281E54DB3A2A989097F8A85E22189B283A6B9F1940D3598C3A2C.1778.1872325156.332",
        "CD_9A79CFFC989C9C99D981C62F583AD3436C0315D149ACB31253CF2C9B6F8A1D52.2674.2786943313.472",
        "C_FDFE527398F2ABFB9174C6F115BD3281FC3B3D869047BED0A5719E7F2618C914",
        "R_D3BE10B39550C29DA4ECB4ED6ADD5EC09B160843E405B8520402F382429C8E1D.2451.534044567.558",
        "Association between StorageSubSystem and VirtualDisk",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.279.3657065439.180",
        "*-0369<?B",
        "MSFT_CliAlias.FriendlyName=\"WMISet\"",
        "IL_16CF93341F78E613B28AC0076DFD8DBEBCDEFA56DF53B1C8B0B6855720FD6B80.2675.2928622965.277",
        "This class represents the setting data for a power setting in the system.",
        "C_3F26840D55F2C9EE3144D0CA0332385E4BFD5335976463476BEFF83F15CBED2A",
        "ttlMinutes",
        "C_48A5B17344C48EDAFAA391BF26A48FFF52648D73B54F3E703A672629602CEB4B",
        "IR_2551D3F477A531F4B6B2D48DFA8A62D9175DE8539BC5B3481CB863A2022D75CE",
        "CD_C6E3EE8EF6D56B8775AB86145B48EEB7F23DE79E3696F196FBB9A7C5293D0CA2.1937.1371710679.304",
        "CD_3D99FB3CA80AE1CE212D0927EC12435777EEF4DA6F5F65601554C83DBFCAA5F3.2593.3221629428.753",
        "IL_A2C6426E616DDAF3FD6EF9DF2BC6CB0BEE5701377257233AC2989F40C34EF6B2.2705.2251244706.293",
        "IL_5BD66425ADBBF1EADDC5A640A4D6F8DF52912D9E3B1E43EA3B981F8ADCF90FD4.2690.87331798.270",
        "CD_3F6C612C44C211376C4481665EB6CC40A87E390D09ED14B4A180F9544E1D54B0.1548.2654433357.490",
        "CR_33D246EB3B57E6928B893AD6FD55D978AB60895C15739A40D6B9E85119ED3D71",
        "C_8891BD8DABD7A4972A1F592FEFF5B8637D8A570DD552CBD215E4C520765B2392",
        "IL_43B7B69F919BB681DCC1079E7BED6BA29BBE6F4DDA8822130874E698F9F22509.1105.634992381.277",
        "I_E94566BF504DD530A5B6CDD8332E0677930FBB4322E53A9C53D84633C933B6EF.2736.291461238.288",
        "CD_8388B68C4DB97845C3C1C2649AA6C6E0CAC0BF4C68420F762A0E16A42522910B.284.3166616970.1724",
        "CD_9AA1A1FB909781CFE25B226DC2FEF6367F9967B3CDEB068FA27F1AEC1CAA9E66.1581.3275879356.1108",
        "CD_86E4399BC4DD7BCA81C24CBCF67DD3AC1AB2674904D37AD60CB8F1387993FF14.28.1584213542.680",
        "C_EFF78BA04EDBDB7E269EDE89195BF04BE0D870F944199B1C1854270A94EC8E1D",
        "C_99ECCFA08F1936CA8BEACA1D5B448FCFE9E2EFA426F4813F0AAD60F2EDD7E7BF",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1520.1430031708.180",
        "I_4DC2BD0670849AD579953A227859E0D99A8E1E5136845D42153632DDE9EBE540.2715.4262521679.283",
        "CD_44199FEB2EA5AA114C34FEFCE15EC340288F3AE7F2F9B159DAE8176076473712.1058.3968090618.342",
        "x369<?BEHKNQTWZ]`u",
        "I_46525BAD3099F51458A5D518030526DE848A3DE564DD8816A47DE935CCD3FA82.2457.3971602568.328",
        "C_AA8DD13710C6232D550EA0B5DE30AF5E61E2B29E47FB806D9004BA3511197EBD",
        "I_5B9B58B23EA26C7DCBBA923337E0D9F3DA62D8CF6999903866083C048DB4D581.2691.3070676501.262",
        "CR_4EF9C71BC878CDED855571486DDA10408A556B0E0B2473232D97D8125D3EABD7",
        "RemoteDirtyByteCount",
        "CD_A9DFA8F5D04BEC57E3F9583151851B160E15DF6C81FBFB70856AD90B0968BB53.2655.3123015440.1185",
        "I_7F6ABA44FE1132DCDC9A8108D73718A7249FF04F5FB0B38E68E51501E325A7EB.2718.1200886120.277",
        "C_9C6533291E4DD91EF4ED68CF5DA821C89662F59D10E141F7ECDCD9D24EAE02B2",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.2473563520.180",
        "CD_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D.1131.1214829803.3245",
        "I_4DA55E3DD8053CFD4D113AAEAF6D79C045781B3692CEC102810B69F1854A1A17.2717.3479575693.276",
        "CD_63404A53FB7B216EDF22F40A99FFC000AE78ACBAEE2E0500DCF9A7DB75A05D76.1131.2871327675.238",
        "QUY]aye",
        "CD_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416.1523.2174425652.369",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1049.759024781.368",
        "CD_D75AF298547A60BC5DC28CC5F9BB9F112DC00D9A181668F25979B122809C5257.2490.3162878524.213",
        "CD_308A38A70C7E63C8B0D223B592F8A2FBAAB2069E8358BFE6F473E432CFDFF602.2000.121875979.2914",
        "TraceEntryExit",
        "NS_B9F15E9C0955B84B8B7E840A878C292A9483B55C2BC37006562DC762D466102F",
        "C_6F6CD8CF6EA45E347E510153C47F4A156F13C2264BE2BC47D09C5D940D064846",
        "CD_CF8C5D2298E729B081D1C131BD290A9E84673DFED35C60023220564D66F04E17.138.3919079066.1280",
        "CD_23CB70BE859B8CF3C76816B34CDEFEC8E45DB2E900442318163C4BA94FA5593E.1563.1275697613.438",
        "IL_FDC07BF412EF517BF16CBEA0AD032C8FE94CB2DD73B9CD909C08659DB8C5BC0A.1354.303244126.276",
        "CR_E66D2A11AD2317154A9C2C61CC140BA5F198CC545A25F24736AE23D74E16B49B",
        "I_2CCE85C67BFF4808C698EC1197E7D097220E34B16586EC1AD2A47EDE17D57EDC.2702.2390585957.284",
        "IL_3D90968CBF38C76EB9C64EC58DF8BAD337C1A48A70D1C9EF256656BDBCD3DFE4.1105.3096851571.248",
        "I_6D5553BBC8E6008E05D2006810BB959980D3753508987704FD5C408CE868A644.2729.438901027.277",
        "CD_4B835375C85830D11DAA3F01F5AF9F28573A4521B9279B28C7605832DE3B39C3.2006.310406579.1584",
        "CD_A05B58817295181CBA7B676653ED97C1E23D591F86C20D99BF4C67B62E0E211D.1748.4220100683.485",
        "CD_FD962A7CCACAB88D552FB4EA114CD68ED5194A98AC098089803CCB7DCC90E78C.1538.2489165089.512",
        "IL_FB3F552F9275C4F09DF5D7A6BFF54B8A4B33FD33818817F911188312F8511BE1.2728.435339241.290",
        "CD_6660369DEF6E3B84AAECA382139BF3E985205A68D26143F446612FD594B15147.1583.94819512.504",
        "CD_53EB6E498B686B11DD3F721BA7DE3B9821C3BF6A37ED4C0E7215D08454434B80.1520.816086655.2151",
        "CD_73501BF09C2970508D1FF696B5776EC0C8584B1DB70DECD71711B4417DBDE434.1054.1851085341.395",
        "CD_B5E99B5A644B99616378C5DB13332DF2455BB938020100A5A138AB87040C693B.1349.3866904923.386",
        "CD_E1339E45991CFF28C6A45A0DB3B482D0FFBAEAE0DEF0210F7EB4489B09CB933E.2672.389714615.493",
        "CD_0CD3432EB17462BFB5BD92FE309EBEDE9286A9F3ADCBFE4044D787F3CCDADE24.2118.119567097.911",
        "CD_5A900E37ECD3AD176DF3B2408CEE2A05339FDF5781218575370BC8E3B869737D.199.1108351965.5472",
        "CD_F10840352061CD18DB7516F60841E629D131C524C9F2F089E5D2B510560FC583.111.655535304.1518",
        "CD_9523EA3FC3599ACD240F830E8AF95EA7460902FA81374A4C7BBD754E74F49B88.1581.187403951.239",
        "I_20BDAD65B621F6FB6C1FBD3F357690D0D5284B906329AD158F99F94168FEFF9A.2694.3076597239.269",
        "C_209458F88A1FA5926D961F906C3EE16D4AEDEBCEDEAA8A4730651B0B0AA2C3DE",
        "CR_EE8A3B921C808F823B264981D8BBCC23C3D40D2D4B7C54B958C0DD90EDAE3CB9",
        "CD_C4F59114EF1914FF05B5796404E0ED8DD63799DB51A6E299D0727FBDE6B4E0E1.1172.1985143000.280",
        "CR_12C8B809AE9CE5F53FFB63FC457B4D2DCB7488DD14E84D1D82A5FA5D35BEFF46",
        "IL_70551F84D219A78BFADA6DF7C4026B7FE1B54482FE569A1962CB8B24A6120E36.1015.2482282305.391",
        "CR_3FCA69ED8F3BDFDCD044F14AAF5FF2C2F58AB3BAC2575FC16BF0119A940BCED8",
        "MSMCAInfo",
        "R_B09B2F86C7A55023F82FE86D323CC07C044D718E99AAF895494770C3126344C7",
        "CD_60AA0DD1DCF4FA1B905DD3ECBB508AF58D5505CB25A3C465DECDCF71AC8733AC.1599.1616503110.646",
        "CD_F15DE552171C286D0AEEE0B9E6A1C50C119FA39F1FAF228FBB5F509C5C408C27.2526.3248746304.7329",
        "error_WindowsErrorMessage",
        "C_884D60D0DBFE6460D83079FECA71E009FB88E0ACAA9538FA4A82F908C79947A6",
        "I_D497BD7A02FEEDDA3BFAC81C9103BF5261B59635D4CB02ED4DABB9C044188FE1.2700.1899625607.282",
        "IrpPtr",
        "CD_87CE846EC002DBA12914102AFF6ED89E0F6DD6CA407A1F7C8C0CBFF801124A9B.2425.2709492278.301",
        "C_A81B2D0DD0F49E868492A07EADFA106D1177E12B072E8318DC4B7A46173E1B79",
        "C_174ACA96C183E7A885B2AEA41130387489C9F36E88A7A79DC42ABA72ED0E252F",
        "I_22E42EE14F4CDDB4CDB538C96531FD6BE0BCF4E4E9AC5C535D731AFD6825433B.2707.3091022352.300",
        "CD_972576376A5F2C5C3EBE5402A0C00A72BB51E33D448C072392A8C26DEF804EC3.1750.1722599856.2000",
        "C_06ED746C3D4422DFE7E61C74D4754D1F561EF973D3387C0C0A4EC95471CDFF58",
        "I_2FA9E9C28332D8F7D1BD39E588EA9E1C83D3389E22D9D5B31EE0F3BEFE106AFF.2699.4194412096.273",
        "C_A516091A26C59F0A9A7F2863A1D087539F59C7B40C630ECCC503638C95CC6609",
        "IL_B1642623BA0E939E58ACB54CEC792BDDE78371F427AAD399BCD5EBEE8CA804F0.2700.3703007584.269",
        "R_24CFB2B4CEAD5BE9188CC5001933580DC2746C05DE76A8DB6DD098D52E4B25F0",
        "EmbeddedInstance",
        "Month",
        "I_46B008C4FA1EC92AED42D75BDD19C87A16151364C2745870AF862251E091444D.2717.2145587502.281",
        "C_221B78AB9519C178BD62F6FFDCC6364A1ED7DA15100A300A7AE9167569CF4591",
        "I_681A7E2374B01837A493DEB33F78FC8E025373807EE70C6BC317B0F6288480DF.2708.1625537498.299",
        "CD_F02A14F60269536C803E2FDE6118151BD8A40B0303F36B063D46BE78647E36E4.2593.3157748456.176",
        "CD_98772C151E80309DDC5E68EA8FD1FD4D236455E4349502089D504086779DE396.1017.4138219475.266",
        "CD_0DB6BAAFECF887C41F21A2964B768059B86C21B174F1D609DDE0EDA03CED0234.1540.852968003.1196",
        "CD_715285D866D9BE4D1096A09BF56F1278A35EAA3564DB030AE4A24F01E076521A.1550.986832602.242",
        "NS_1DF6C16A17137F6A0B94BEE4497A3450EBAB7A7BA90A714911FA5D8F44DE73D1",
        "0x00000004",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2374.1927714195.368",
        "R_486709A1BC1AEA1713B7B7854CB54E0BA9471BB018357C834E1DD6BAF7DE7457",
        "CD_92AD02DA674F5290070E761DC90ABBD672C82A5B3BF7579C78C351DA149640B7.2579.3297738779.314",
        "IL_33A51A20D06504B858D5BBA09A85A50D699CE20D21C5B7B62740A95DBE6CAF43.2700.4168634246.270",
        "The Msft_WmiProvider_ProvideEvents_Post event class represents an event generated immediately following completion of the provider's implementation of IWbemEventProvider :: ProvideEvents.",
        "C_8D17C26DD0763A67C7D4D83EC64CB45890D927901B9A9155ED001A8938DA67C3",
        "CD_F32492DA8D1952EDCCAB707AFA3F69E046829AB6D46D4B2279EAC5E6BCBBB3FB.95.1.8483",
        "C_2DA20672D3801440AF6602AECAB57B678829882756EB729F91B85264AE3AD0DD",
        "C_A8D86B382CC27EA5869ED6808E06A1A8C7D37476C8DC9964F86AC7B5FA42F3FB",
        "0/)1D",
        "C_B6D5ABBE2F1027301C23A1CF884681090FD42092F2E95A0F33AA6207C9180DA3",
        "CD_E21660815AC462FFBD7FBEDD97A63305E05561610CCB37ECFFD00C1772D0FF5E.2638.1583133470.260",
        "IL_A0D748524A46CD1D61FEADC4E20415A871E979DC359C66348B7153B21B66469D.2692.121064910.267",
        "IL_EACA596129FE2C089C7087C312BF09A8C2A05AFED1F165809954E05659FE06B7.2694.813928757.263",
        "CR_F071A22EE25478DF80A205153198A6FC12F84A9E6BFE53B8E5DFD1E7E2ED2B8E",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1807.1404907667.368",
        "string",
        "CD_2F2D52E78951A71F8A93996784706E5CDAF8CEE0DBC76918027981F3C4C35B5E.1075.3993090051.373",
        "rasEntryData",
        "CD_01E49F2BC300B8406F535D199FFE723C66F3CBCD052B872FA9DADCCDBACAAF50.200.4029537105.781",
        "CD_B390F1C634902338C5C1550ABA1DCF340D9E88E53F272BDFC30EB49C6392E4E9.2636.1547946631.597",
        "t@HT\\X",
        "CD_DE7D77F89C87D9F9005DF4E9FDF0CF25EF5AAE159C4D26A1FF500F7A7277BA41.74.825988056.236",
        "order",
        "RSOP_RegistryPolicySettingBlocked",
        "82CAC4E6C305F6382CD81E4E2F42654A09F9F1E0967D6CB0B8A7D26.2709.2899149957.291",
        "C_8519F629D57644187514674C7FCF7F8B0B70EEA799638913C1E17DC7E507CB73",
        "IL_14748AC91A286711439C90A88E46F607B6AAABE5929E6129FB506DC60AB27746.2690.4265603012.263",
        "CR_13EC1BE17DC892DCFA7E3A89B2381E177D560D8CC74CCA31E1E844B305EBB081",
        "CD_E2C33C7E3A117410A8114CDA2C8E0FBB300821B704E3CE1129E5FF6AEAF52EAC.2664.4099673130.476",
        "CD_4FBF4E2F4EB997E78BE6A08310475D7F288690ED00FBAA96A0D81E2F361482DF.2601.394017034.113",
        "I_5BB37259D5CC25306A3611D2ED686AFC58E38CCEED024E8AC562ECE33C896DC6.1338.418677725.192",
        "CD_520F4A6CD1D22F206E6F5473B669F39AB1310B253B4678DE0F3ED216986A8D0A.111.867771253.387",
        "CD_3CFDE39E9D28C34AE877E11B2DF9F63280B899B04139F6BF489E37FF8557DDA2.39.2594731857.249",
        "C_CF99E243E670BFA5D310CC92BD4BEC2574C1B9F0154A447A1995180DA519C649",
        "FWPKCLNT Trace Provider",
        "CD_22F378A2DB3FAA5D62FAF5FD5413472AD1B5CCD6D24CF8D271819C462726461F.2614.4011863282.406",
        "C_BC649CD83C8F14D3E6DEEAA14569857F0C4AE98362B932D81B414999E7D27C7E",
        "C_A2755C850FD4A4296440D27117C3EF585344EFDF04FA3835F04E278A98F24DBD",
        "The directory",
        "IL_933045249E1CF3B189DB3BE925E790E32900C98E11E7210C09B17AB3C4AE195D.2700.1351486593.286",
        "CD_E706FF8586C52A7176ACA48D7702EC2A6550564F0E42B0C09AE3FD1CCEA62CD4.2763.3966712109.911",
        "CD_4A9BADBF619D7C360E2E222A1D05EF4C32E9769C9232CA2631F4E74AC78597AC.2410.2864468092.361",
        "I_75E052968B77CE674E5707D73917DCC54A57D06B4EC6BB0C76F03D980241B325.2693.3924284008.268",
        "CD_90A9EF86FF70A029BC2CE69881FE867FC03EE19BB520398B9DE2D02EEBE30B96.1194.82636015.246",
        "I_8C8B08C63C60FA495AD4A37FD159E67F25E9095E1F11C9A3B0D2BE0439540AFC.2711.1229956133.286",
        "R_38E384CF26B6969C10E6C877B2EEA6D4595C8CEEE6BA25CFC97F17CE8E8A5DFD",
        "I_9B38DCF15099C1A98C74CDFB6E689EDD9DF34640CE50DAD92F04D8757A02CF50.2702.2329411449.295",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1352.1576158592.180",
        "CD_F8211248BEE93CB6B22893B4F81F4DBF19818CBE4BDF56935BF40E76E2E3C91A.1776.946510395.281",
        "C_B05CCAA71F3A61FD632B96A8D0CBAC4A42DD424FB85CD76DB922673FA7A32DD9",
        "I_170F6465B2A7A392C41416D3E656CE54DE77B64EECB04DB67B3D2B3999A4A0E1.1015.4259979364.291",
        "C_C7B5EDC184E23DC87E71460BAAE89AB503EB1813107397179B644648906147C9",
        "CD_5250EC9304AFCED3B4B4C6E595A1730CDF3C33CD4C1A0C35D2E9C70B3EAA91C7.135.1098232822.570",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1342.1817223576.368",
        "CD_3196586F94E9CFEA6D912774CB2A6C6FDB2471424853F54D4C0F4EE4F94880DF.2238.1.30730",
        "CD_CFCB33B28A39B81EF633FF01035594C2E36D0526CECA77E54E779ADB28E5A35F.2573.1652925395.910",
        "C_50530290676AC8CF340FAE4BC0BBEEBDE7BE27779D2C4E649BD254FF729B67B1",
        "IL_D9A0209571FD2C5540CDD853A1D5AB1666E9E4A2C7552E51C459E189906FC38F.2718.1607799817.282",
        "CD_962C6E7C58B97BBA37F5179D96ED3E00EE4A4FC20E4C3C3A3312674F9F7C4195.154.3945116785.599",
        "IL_DD169CBA4BF6715007331ACA211ACA813A231B933DCC0D2F47B4270F95EBC882.1049.1151473019.316",
        "I_629FDB613B28B97B89D4476B67AEDA9C8857AA702527EA669F3829F1475A5431.1075.2681718548.186",
        "CD_BDACCDF30E4365DB12FF650DE68D87624BA9FF4BAC19F700279002C19BEDBAFF.2584.1465838171.599",
        "C_19B836CC5C277C06F277CF4D6E071080E3AEFC1E57F6073AF4E11957163EFFD2",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.296.569384195.180",
        "CD_BBCB50A3E35BB9672B8B458A16DD242DDDDEA6BED48E25ABA8EEF2B0E49A9B3E.10.1084986640.504",
        "C_88EB302CD16E8AAFC6641BEDCC17551C2C447BB8B7A2C0179406C6688EA18D65",
        "CD_D439D24286A48779EB1CF85E2093853178A3502A21F1F13F44868D671886BA98.46.4107731403.1468",
        "I_D376AC0BCAB3A978B0A153526D20BA9BF8C690AFD128FFDC2480BEC2DB80AF0F.2712.1738099483.294",
        "CD_CC0ACF58FA3646F311BC16A78942AC6DB48973323025BC27052C3593D5CE6061.2005.2286775068.1752",
        "C_6968F059690BE0A04B4112ABC6C4C57DE63B9F09D85ED5D4E01D06DF70B5CB92",
        "CD_6C45CE5327BFD1794DA2A5C6CE11457F4941795C30AB80AF27DA45757D38802C.2624.1070172769.516",
        "CD_9B76BE6116634D98E523DAF9A0AD948B4D742F1F76F465B3DDA5D1B7EF1C7F0E.1993.1033832022.705",
        "CD_737D301CB8F93905D70C42253781F901EC7FCADD3289B3588BFF04F6F6A13AB1.36.3410381476.1992",
        "Uint32",
        "I_B8F2F2BF1619AAC712E46ACDC25F9EE9CD9413AE0C42388950720F238FD4DDA1.2465.2260862905.358",
        "CD_631F6991291DF744F9E35F63A520D11CED943E46A9F1CCC9FE101C11E3B1E157.1347.1929400840.1423",
        "C_600A73C35ED5D3466F7E30F1C2489F076B5641F666F273A9F923A32E11B6B851",
        "IL_5789BED90F29CAA7CB11F959674E13E771CE99940FBF2CD03CB19B4DA46F7D55.2725.6839705.289",
        "CD_36FFCD7C103F4CB151534CDC404DD1E71C91E39EA5D1DCB2E130739044899EBB.2053.1.13288",
        "IR_51D11BF229FB1D15ABABE5E850C4C70DAC3E3C57CE24C8E314204FC6FEE752FC",
        "C_38CA7FED21B16AE8C42210D10395046AA0C1BC650EF11697FFB6D8AC7EB96050",
        "I_914A2F315AA61257216C9279ED7B59CCDE3F169260EEB98196C7B9B6E52DC13C.2725.1592081159.290",
        "IL_C1F6B5745574887F521DE1DC4BF0F18099539D5C807F9CCDCDF9776258CD4AF4.2677.2108648067.277",
        "ROOT\\Microsoft\\Windows\\Storage\\Providers_v2",
        "C_34FD9E1177E28334594B80DCA69BD741401DD280ADBA44870846F7381632F88D",
        "C_C8AF925AAF65508EDB0CDC4476BDCF15BFD7128CFC50F1E93BC62F64D59AB5C0",
        "EventType",
        "T83FE6007ACA7CBFCFFECDEAF04CC25BAB1807917E74F65A7A46C4B6A4B61A057",
        "C_7531D0F73C9D0FCC20C0C9C036C7F34D7F189FB9D62AC61E8FFDD74B2A07A836",
        "C_1E4F7F64C6FA4C6BFF02774064A8D31BE7BD47D4E667FBBCDE1CCED6C19DEE3C",
        "CD_E1F49EF371430AF3D1B27ED477D994BFDA7C8EF9480CA58344AED470649A8AF1.2574.121072203.692",
        "C_C33D59D510F29FFD2D335B60BBA896FCAB2C0201287454440444F0D3AFD4769A",
        "C_5F8086938F6BF421BA200D039913652FDC167A0FF909755EB1FA584E2EE04F6B",
        "CD_9C7BB626DFB7765877323D6D490EAB18763F755F7E391A05F5AE5DDEF62260AF.1932.3429029937.975",
        "C_25A571CE538B24F14E9AE9F0F8EBF9CC275EF6FFF33FA86B2918CC9BD3D0BFD4",
        "I_5DF699F99654C2DBF66C5FDB8987B09A99F1CFAA95812890C5421B937233B9AB.432.1.100514",
        "MSTapeMediaCapacity",
        "CD_AD7EFADAD1289B4A3FEF0D60EBF19DD1D014EA7A1302D0431E7F57E3F564CBFB.1502.4171025029.694",
        "CD_BBE16080A7EF2F0B1445053D0994143FB21FAF6CBC7F65EF8D2106E74618BE06.2198.2189526918.955",
        "IL_B84AFE946FFBEDD9AB4F5B76F40CEA26AE15B1F186FB20ADDFC622B36987882E.2718.3483910466.278",
        "IL_C45E888B6BE8DD1A0E185195E4FF517002147F20E91741D89E0548831F8A673C.2680.3484735362.304",
        "C_FE4BE07CAB11C06CEFEEBE3FCFBA7662CCA6F6ACE9DF4D17739E2ECA022C4B39",
        "CD_F2BEF717752C099CDF2C7677200AF2332E7D1E48B470B17CCD440B8D710B7A38.21.552539303.2773",
        "SECAM K1",
        "CD_CE0403D1F6C8F032B580CC54FFD1B59326317C97C1A606939745A3B9BE941D11.1649.580960354.236",
        "IL_321148A67F08C76CE816B5AA8968830318FDD971163E19FE03DB272AB60A88E6.2705.901307455.301",
        "BackgroundImagePath",
        "C_DF9ECB8F01904CBCD3018F693DF94DA3A02D29F356223BB0838117D8F2475343",
        "C_A635E8DA0D5FF95945C6EAE0E19DB71C75D6BBE7E19E0F2335E7F2A4C9C288F7",
        "CD_D36EEB4FA019E601112818DDC069B750B95BF09F1ACA992BF14D32259D2DE75F.1.1948329872.783",
        "IL_56F85E4076031976C69E6208BF4F210C3A65B767BAB4D30250D38415F63E615D.2710.1435594326.290",
        "C_FA26B3AB039983C42BFEA6183B0636B462D5A8C2A474808A0AA419D892800FDB",
        "CD_0BFBBC27194F31119DF7EC9CDE40B8D9322865505281E1329BDA61CD53B1D995.1204.2332331029.1698",
        "R_1A3FB2187E23B82908958F340DD0F5EA4D8685478FCE0E52ADA73DFC114F95DA",
        "IL_070CCBA2ECD7496D64C763EDEEE5E45A88B7B870685DCF089BB79B061239EA08.1016.2010810810.301",
        "CR_0427B3D7710F368D831E2478F76F011E2ADE4882C334EE5ECDBD3047B1FDDE39",
        "IL_41B8B0D597082019C2800150A6FEA4D545F9DC80D70FC5EF58AE58F581515BD2.2725.3806191722.291",
        "CD_63CC60C90F4F24B2FCFB7B4FEEC9D511528060A9B51311978A6B312ECEE120CE.278.2846302022.635",
        "CR_2D6319F4E2ABC488E243ABEE465F201E726C9CD7B9C330B609A5B7513F1D6F64",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1936.1115957478.180",
        "CD_F5C834F5C60D3BABC115E6B6BE5546E7D8A66BBAF89B5C7BFA41187C8795D13E.1807.313948410.288",
        "I_BC000CFE04C2A23B745105FB1571CA3D890D9580D1AA6746224E398C7587FD84.1976.1469505768.310",
        "C_EC62C68E91498FA5250165B7C03BC75644EF8D409182A707B4BBEE31AA415BBE",
        "IL_D126CB9ACEB4A89C6350131720BDA85BDF8F63BCFE1166682567EAA1A387E8C8.2677.1242840697.280",
        "CD_240E55CEFBDA1AE8D766AC59B57A246BE8F95FE50F508D9C72C03BF7E80125B6.1059.167757401.457",
        "IL_663060429A6938D1B4C13319904DC9CB4D95E1E1D71EE9B0A8EA8DACAE58E45C.516.1.45904",
        "CR_40D59F896F1B4CD78A547B4E482D63447FD0237E73E28B731E2036C3CEB6A1F6",
        "I_B0FD5A43E8238E668891E8BB0F653D919ADABDF291D5176C0429F475B48952B1.2686.1465248333.264",
        "CD_225D8BFFAB5122ECD9EBBF63275544610A72370C71D0E711186B5FCB573E5A99.1545.1535565288.994",
        "I_EFEB887E59EC8D83C39D53CCF57EF6AD0D608FCDC88B6F50F3452B5EEBD4BF9F.597.1.47802",
        "CD_B5A87FAD6C732883B0396D409E51A4FB7771DF109B9AF9D0EE68052F27B91C91.1757.1043859461.253",
        "CD_7C47B73E5E9A5506254AEC98C6F5B5C4749A5453EF79AF4AD8EFFB7A16B6EBFE.1053.2649245585.494",
        "Dial-up credentials for a given IE internet connection , used for IEAK RSoP.",
        "C_493669C1CCA456E36A12CE6590E4C5AD1ECD05339BEE6C958085F31C96B6122A",
        "CD_1BF30DB26CB9DB35B1AE370E58453AC28553C025227970603A2258585913A130.312.1474476275.337",
        "CR_7E6FBE4200B70FD4C3F5F4E9556E66896E2662AAD9658177CBB7E9E4C038BD05",
        "C_783B56502A9A1736307914BD795CAFEDDCF40975550F2B1F1B9E5C2D8281BABB",
        "IL_F694DA798D615C7307EE8E46410BDFC31A985B4B4CBD53BAF1E1B0980B91D901.2688.1595738901.268",
        "CD_B62E3BC0ED4669CB12D462E1CA25681D5779A9B4C4E1FD95E1263BCD94258894.10.75136911.215",
        "CD_47A47D9B6C73D6463867F73A57E933DD2525E443C9FB15C91CF6A9FC4BA05F96.1793.2262061748.4072",
        "CD_152A8109FBC9BC9F4E7BCE13CE14711A471088C4A0497E45C7C22F28216A40AD.147.1453262106.375",
        "CD_563CAEFB32DA9C6DA846FEF0491B998A5AEB53D92D124F8B8C12120BA57E3D17.2388.33545156.359",
        "CD_2421525B5330978D29177E2F4D577234961B03F32E0C906FA40DC69A623A7166.2384.4016815020.674",
        "I_EF5923099FA488A49F9F1C22B96A5BDBCE874FBAF1D147660F2AD53B972C2027.2719.412037884.277",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2115.693805320.188",
        "CD_FFCB0C410AEE7D445593F568F39CA2170FF6D60B08D2A845F16225D10B0579AD.2309.2033739693.4885",
        "CD_F779B42B004DF7F026E14BA644CC70AD37E9B5D9AC8A5876BD443235D2F16694.2569.2278104602.221",
        "R_A4F5A56059DDF119F4CC303056A7BB3F243745A5AAA1FF57F146D0A87968F7FD",
        "\"4890EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "R_487970C846EAAE83F1C18D91427BE18DFEB32621B7F4638C663D34EA5516710C",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2116.87553775.180",
        "SDBUS_DEBUG_WORKENG",
        "C_B83EDC36E507DD94F76EF80785D352A67A9AA551229CAD025BE35DAFB6624CD2",
        "CR_947907BE0C21868B3B6C1E2B3F2F4D8F4078DF318D2CD738491AC5AC30B4B16C",
        "Configure timeout for detections requiring additional action.",
        "I_C5A1AE4D66D54DE31BD0DB67526AE9F7258CD2800AEF5AF0F2B6F67014B52345.2466.4718231.289",
        "CD_7DB8FCF5A62EB938976237647188940E46D7DB299B4C92C573081357C1E79365.2665.2153767985.466",
        "I_32AEF593787DB2210CC6CBDB30A6BABA049667CF96FFBDD446D7BB5E9B1A82C9.2728.4089252229.288",
        "C_B4204F4CD845FAF261673483B3D9C407E18AF7773A24D7B43C66C3052F5D6AAB",
        "CD_F10840352061CD18DB7516F60841E629D131C524C9F2F089E5D2B510560FC583.18.233466750.476",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.297.1733735090.188",
        "R_255FDEA1692ABE62AFA1108BE7E8544257FCD6E6F7F65C21E46F3775BF4811F9.1535.1100790500.540",
        "C_302D76BF122566F8022CEACDAB3867F54CCB676D4676BBE2D56B8634C3D06EF9",
        "CD_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937.1131.1762488467.974",
        "CD_0840C52E615C811550BFF97BEB503A1141A92EBA04B602E598267A2F773E4BE8.1602.4225399813.447",
        "CR_8322231D4A6F73C0873B20B3D825400E9B44E18CDC9756CF0152A7F3BD39197C",
        "CD_D1B22386C05D6CCE039F3E2E81A633B5C0FFE40FF5DDEB6DE1E49489FD86B241.1201.4085050170.4283",
        "080470E5E3D04FD567BA70",
        "CD_742E9B93637882507F385BA153B7841CA1D9B1C432715D51E29011AA3B0D693C.278.2594026550.301",
        "CD_B6954264FF5C976D13715E002D09B29D1875A7FA2156E8A412284BABE70E33A3.2006.894925007.241",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.2043.1.14612",
        "CR_F8211248BEE93CB6B22893B4F81F4DBF19818CBE4BDF56935BF40E76E2E3C91A",
        "CR_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655",
        "{155689b8-2053-11d4-97eb-00c04f79c403}",
        "I_0BEAD814BC8C7031F80625DB21C5FCDBC4139FBE8FF2DAC665690EFA32BD01F6.2681.3814575362.281",
        "I_ECC07904B8C39F531C7B7164777A27FF298DCBD246363DEE318689DA18BD922C.2710.2996889542.286",
        "CD_EC4C381761F3C10114EE1C99ED28B1BA382832F3C228DAE98DF8FBF4193D38BA.1070.3566390040.621",
        "C_0C004310D6E126351E03912CB21855FBDBC6A2B287BA8DDAD40FE1A2626C6745",
        "C_D79D62511A51C80D6036FF60B20805B5B133C69E918F679C69D47C33516A36CA",
        "CD_97447B179623D5781456C076ECF72BF0BA286864647387B5B4CB924FA06A5416.1091.1.11286",
        "C_6FF6CB589253824DE681EA946AEBFF7061F07B8322E36020A90CC770B8046443",
        "I_E08FBBA6E042339D13F187E0CA81C8ACFCF8DE7F5098B93A7D8812374DEB0F62.2691.419273231.270",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1758.615064782.180",
        "CD_EA78D27F46C798D1329821D7CEABFD06DD3833EE6512664694DD451E0D988F35.74.817017449.601",
        "R_C067A199C1ACCE03298DA4A596E9323C2C865C447DF4449AEE4DAF3E29B9DD32",
        "CD_25D6DE4F10F10C9622833D068798F50E89401E52F3D552BA53470C9A0F55267B.17.3246894690.863",
        "      <supportedComponent>",
        "CD_4152F1D73EC0C43079F370FC1851FF50A6678F3120C915B048857D41318389E1.1779.1155855301.297",
        "CD_91604F794B64A61196688751D972A0B3626DF7A1827369CDD4AD7A23AC00FD14.137.1798741067.3043",
        "CD_2A82469DE4EDED369FA467BEF3E6440FE893BBC1F56ED2AB23AD8D2515E35AC8.153.1079024539.2558",
        "2BE08AF47386C43CEC462A\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6",
        "MSParallel_AllocFreeCounts",
        "I_DE9AF71A2E4B1D02150A7D2BD0501E5D0536591C69AB2B5C8597953089B63892.2678.2345208460.279",
        "C_C21EED7191192F2ADBCB9708104DAD6A17FD5A43846B186D22E5E8405D0D7A69",
        "C_15DF3954917D19E28725C2F53AE379712BC276A2F92080C36C49446645CD4952",
        "C_A0C4181E36B5BF6BE271221B7FC9D6F392B6369BD0BAB6A546F2790003BEF7B3",
        "IL_8493808F7005A147F054C4D110780BCFD9E3EC20F3312DB0FADE1B7AFAC3A8C3.2764.913621036.274",
        "C_A90E76A32C4A193B19FDC863622FA085D4532219E7648490CF033C6770DCAB51",
        "CD_0669091BB70564F4C28F9EBBB95CE7699D1CBEC6909BE49F84E8F214B14C6216.277.2822121361.375",
        "C_A7E164E66BC7BA8FC3752641961C8B1829E354DA32CDE974E0423F3F5730EDE5",
        "CD_C69F291BE89C7DCF47D514EEA88ABF7BDEC9B45B40FE7D549762134D0ED90168.315.1748170177.1035",
        "I_D848EFE87C64F0A15964D91B76357E6B4433ACEDF3FC8804852A3E1F69177ED2.2716.2156018706.274",
        "CD_D6B1F4AAAFDB618A9CCA914AD92E90625471E15F06457F12DC8D813813101B8A.107.2552060928.500",
        "CD_58036643D64E8A1516491471C2E429C56B6A6CFED0C27493BF3ECB5339DF324D.180.901604372.288",
        "CD_ACA27975EE2F3A8821B425F57F3E45975100D0F3FB352FCB31C5B5AE152C7062.2581.667500565.817",
        "ErrorCleared is a boolean property indicating that the error reported in LastErrorCode property is now cleared.",
        "CD_1A3460E595B2CA58A7D95317C6529992777B447C7792560971FCCBE171032990.2655.939732423.586",
        "ConfigManagerUserConfig",
        "C_2B4521AB2FE85B7E58E501B16EC7C21CBF35FC912BB1BB164FCFBA34D7094CB7",
        "I_2AC9D268AD71E14801AE8344243D9A45BDEAFA269C1BE645A564A2D049857CCE.2689.1260473207.274",
        "I_F0237BEF228AEFB7A281AD1D606EE75C69C46CA4F644A06129E1E7450C160230.2695.3809578658.269",
        "itSMF",
        "CD_3A4B092E649E9EDDE3FA5F08BAF4EBD82A1D1063DB19A1DD0454E516CA8119BC.2458.1131341115.5139",
        "IL_FC15237E3EE5D15D1A7FBD1AA39C0F99DE3DF457225294AED82A7FD447F88BA8.2715.4138342168.279",
        "CD_EF449CE69828797E16ABEAB272BB63851199331E1B3809DFFF02FC6CB2F0B417.1940.3881171086.3692",
        "R_1E374C5CBDEECC7830AB4BADC56B9C8330C5C89908E9DD8A429AF2525AF02748",
        "C_7E57299DCB25F674827DCD8D5EFDAD8B17A35DDCBAAE7488D6DA9A5B52476F0E",
        "I_84F7DA8FDA90FAE6187111C2192FDA36DDBDE6FDE609673EA728B3013AF37B7B.650.1.36555",
        "C_817E7AD084EFE77D83D93F44E314532D39102CC61BC99316DD0EDCC0B95A5A7B",
        "C_D91AE55AAC2C2BF7AE9267D8DCCF46D7102A6A518D4310E37C58619F124FC04D",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.43.4088938489.180",
        "R_617D7E06F42CBC2DAEC5E45480339A72D5A864B659C9F379522A1C7552F9E4E1.313.3899316386.528",
        "C_F2CA4DB3C668E6418D579525693A11C910C0B4C82E7E68D52D07432FC8FDACEC",
        "IL_3FD6B33F4FF166B0F7CE61EB62E55B303FF2BF4A74F913CACB488AD245C02047.2461.1289881593.347",
        "CD_C413AF31EBD45FA510AD35ADB1344C580081CB05511196B32B7E7BAB01E4BA71.27.899793789.473",
        "C_05411DB4575F606BDA4BDD0D50A031BA32BBE01F306EE4E3DFF67BDBC2325F30",
        "I_F0E679DAC6E66C90CFEA8749B4C30BE044ECDBBAA7E17FF5A20E0A0F881AD779.2720.395268258.276",
        "53AE586E2D74399EE7F6C1BA988331E5E7982E68E33445A3EC32F0EC6B48917",
        "C_783F27E34E5C5D4D60E761148DA5CB8835B5F7C975356BFBACBAB29334321728",
        "CD_3E723A91647379E7E1D55A0DF4F361499D3E76B67681C256B269430F469E4FFE.2669.2535268070.1494",
        "CD_94145E2C57E0D4603F8377F5BA5E611EAA5A57D8CBDF073A7F4BA777C46D367E.1849.761466420.328",
        "CD_76EDEC3083FF868BB73CC3D9FF8C4C1459B539DB853C36A4B53FDED1A9C389BB.99.2048351943.5950",
        "CD_513CDE95079518F112965AA406F17722C0A89A191927E09A325D3D3202159331.149.207069548.477",
        "\"&\\*/37",
        "C_225D8BFFAB5122ECD9EBBF63275544610A72370C71D0E711186B5FCB573E5A99",
        "CD_E607285A4ED90FCDEBE9F9ABDFA83D91A50ECBC0733B05602257ABFD57D58CA8.2566.3702687208.1174",
        "CD_81CBCA9C0215B59E860943652530299E5FB0DE537CE83929081B409741C1FE81.59.1.13501",
        "CD_1388B74AC4B1A1248035D019490B1CAAA479C4415233A9E50223DD0802BA383C.2756.517489168.3304",
        "MSWmi_PnPInstanceNames",
        "CD_A9756BF34BF29220A7B7ED9624A09410B903D557F574058934882D94F40FC62C.1310.1.28094",
        "CD_000C7A4E24A831A8B57321EC87550EE50B20B429272C7ADD8CFEBC5632299194.1567.3979828623.405",
        "R_50F45F1E0408C3E83DD9ADFFA8E0F9ECC05CAAF4A8BF49AD8D699571203B781D.1617.1332748330.600",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.286.1443573607.368",
        "CD_C78F62EB300A2F46E13E980E55E92EE07DB990928728C002F67074E4CBEC12B7.1570.24430997.420",
        "CD_A81E4033C09F5F8E3B3660FFFCB2BDD5A79334D687873FAF6A85B55A7F0A7A5A.2225.2717791646.470",
        "CD_BC9D109850BB5F86324C40247B677E50BD3CFF55E165C6078CA0EA6516A48293.216.3073497890.296",
        "I_6D1CCF83979E74CF2D079458D9AC04D51207CBBCF8A40959C05C544A41DDA509.2686.3795360380.269",
        "CD_3DC19EB63130D5D067481058AA0623474C0FB1A27F327D53A9EC2BB38EAE5DC0.1292.171326984.1441",
        "C_9596A53E85F3F0D633D696BB9EA3E48E9EAB2B18CDA373E2DEE09E41AF442CA6",
        "I_B509840F0E293759DA8703A7C2AB007CF2CA9C5BD3B15E9D713098835BDBC78C.2689.819947387.277",
        "CD_0FD0888899B6AE2520B6E2DBF0621375C2A450EF8AEE903A752140EFA51EAA5D.2369.2503462697.2719",
        "CD_5AF713ADDAAF9A8D160542D04F058A0B9E06750B837D696EC62B4348799A72F1.191.1.13452",
        "I_E8BD339E775BF7B67E98E8F320BDBE14F99A5C435E7E6A3E02A0986B0E0FD8A1.2723.2684840011.283",
        "R_C4BBE209587E786D9840F80CAA3C59172152D9B227A2A4498FA1DE637F301727.1500.2166152761.528",
        "CR_89B3BC9F91AF19FD95569CEC4AE8264DCAA2B513E756CCAD927560FA5C73CDE5",
        "?BEHKNQ",
        "$(,|04",
        "R_821FCC238F627B3C78AF6F9EAC85DA5F86FE1B2A0EA8142CAF6057765FD44631",
        "C_12C7A5E4BAA4E033E8564BA476003D767025946696E49D1A4603F5AA3B2275BA",
        "C_F17398737D28E7C45998B683DDF3AEF00877214A6F9C64D8C12FF21642BE4411",
        "CD_4720AF4CA174274F71D8038B37E58001F7A92E2A83E49C05ABD2C15725C10921.2759.161855461.302",
        "I_29AFADC3CBF603D7A79F75561E5EDA04275DF12A6E0D26959751169EC02FA7CF.2692.1412653181.267",
        "C_2A1EA88566C251C922ABAB65FF63CC8104AAD5E5A141FA41759E87856BC3DD82",
        "CR_5401A055411F9811A09125DE8462BF6A4D708D8C770ADE3D670BFB9DAD21A39A",
        "CD_6FF9530F5A013B9899083097E643F11387356FB784EC25D80243162D741E08C7.1929.98872715.283",
        "IL_AFCDD0BC10CA71EFD3F3FF0CBBCC80863EF81191642B6BE63B2E7FC60BD5D9F0.2695.443980612.275",
        "C_3FF4ADBFE846023B8A5412007D4350B3CC0DA66B9B5ACC61FC6D1F4DFFE32951",
        "C_DFBBAF5D5F94B4BF228BF95FD0B1E0E77E3B25A375A328BE897C2C1DA70CDBD4",
        "C_B4ED6CD6BB039C8A40404514D33A068C19B058FAE7508C9C445CEEFE558E436D",
        "C_3D99FB3CA80AE1CE212D0927EC12435777EEF4DA6F5F65601554C83DBFCAA5F3",
        "C_753AE586E2D74399EE7F6C1BA988331E5E7982E68E33445A3EC32F0EC6B48917",
        "C_C7B7FFF993314953BE1A6F3ACE26353D36CC0DC4B7DED5F1ED16B7B7499EF72F",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2087.4224475244.188",
        "IR_10B708ED92090289D585E6148CB02ECEF24A35EE3889A3AB808AC5B7D3E69B31",
        "C_0B8D0CD35EF9C37B2A0F0A7A5A12FCC21F082587427AFAC5F5A4AE61B8034D36",
        "I_3ACA7AD06CA4330413E7171DF925C5CA0A5550961C2D7C4B534382253F10C024.2718.2557330558.278",
        "CD_176649CD4E57E4232DDDF6DF456E1D2A1BEC4DED47B202F904E6181846857EAD.2098.1523510017.511",
        "__SystemClass",
        "C_B18E35596C7AC0C7A9B67022489D5864495B96E12E56FDACDF13C1E2D5D12666",
        "C_2277447C6063BFBAC05CE459DB8B2E90B2D0D7BB283ED825F0C1EAA1C62A123A",
        "CD_3221B359A5416B849210C8EDE6CA9A31AE77982A28D76140A2605705EA5F2416.31.3918409667.571",
        "R_40C12CAACA910BDCDC268A44F63FDE93601C53B5B501C80C38FD1FB3930C98D8",
        "C_930877E805DC4FE95AC6F1E943D1DB43C1561BEDE5B613B8E3A3B85C32FB8071",
        "IL_30C8573C75A6AD43602C0DDD39EED1C9A588AC05FC2919403F1829E918061C5B.2701.1398455091.293",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1050.1756638890.368",
        "CD_3C1F1A447EC4276186A6706A3A49D07A2A316ACD6912E09A63348E2481FAEDAD.2758.3798177452.356",
        "CD_DEEF6E11F8EFF79A39C1C076E84D33771696CCAA591C51477D7A5F5A26D53CF5.278.851005604.574",
        "IL_5C1DF294EF7D28EEE66F41030D76BD514F02CC448CB61E4124123E427781AED7.2720.2225744105.284",
        "CD_7269FF3A437308DE8B5DF3B97B35E871B7E243E24C717CDD217432928EA0D1A3.1849.750823178.520",
        "R_500B791BBFEDD0EF6DC1FA9B56C1442D75CF8FCFADAEBCDCA51CF4251B2B1ECD",
        "CD_4DCC7262F58735D0369C2465199BAE7309EC5D65C116FDC51CE48CEED8FD847C.2646.1691211728.971",
        "CD_743FCBD526F43633FF2ABB29F490DAD5EEAEDE4C488F8D224708D0DF7EEDE463.1609.173970070.301",
        "C_FC0B89BABD686A9FC7C4BA7310FB243E4149DD82079E1DA8FB106D19B546215F",
        "CD_08D91009B4ED68E4353E05322783CB69F176F87E9111E33A5121866D19386BA0.40.2651246070.400",
        "Volume does not support the no-automount state",
        "CD_27AD50ACF498E4580849CBCD157A81D527ED4CE6ECB87F863A4E83FFC9365AD2.1783.2339590913.395",
        "Msft_CliAlias.FriendlyName=\"Volume\"",
        "R_AF3DAFA72013C3690171F734765DB1412DBEFDA2A461CB66FFED0CC4B21B88F0",
        "C_B64C8D821AF5C014DA4FE54201CC1F0C673AAC91F5A7E314E6FC584E69EFA44C",
        "CD_9C46A759D30423AAF4F69D77D418152E94C7E20506D0B665994363777B2CCBC6.1671.3212219900.1186",
        "CD_3D509F135C704C49652422902B33D6493BA6C4A55FC967E5BDCAA83CA4EBF452.2420.165840371.675",
        "C_891971E1D392C0FC31A60B00383C2585E66ED0EA615A00EF345A7D468E247CDE",
        "CD_45825D5E91CA2C0282764680BAD49693442FDEEE8D15EF9FADD54C4BF9438553.279.2401677735.2321",
        "CD_3E11F2867F2D534D95C0593A0AA32ECA612C606596AA91228C49611E4A1C3BBE.2251.1.27563",
        "CD_0CFEE70EA76040BBCF59E006C673746B621403E235671233CF5C1C2B3513102A.1087.3754256734.732",
        "The Msft_WmiProvider_CreateClassEnumAsyncEvent_Pre event class represents an event generated immediately prior to calling the provider's implementation of IWbemServices :: CreateClassEnumAsync.",
        "CD_C8D3DE13E6122CBF2D995A000BAAE0C9FE6D4A2CB5F6BDFC3533203D5FD634C8.2651.3421650424.852",
        "I_0964723C753BA4EAE8CBD4D341C1289FC8793710EF111F167C654FA5D5EFC891.2685.4205068524.269",
        "C_BC1364958E3C7F9CA5ABA0C9A15549E0C0B0F96B96EE058473CACD93E1EABD27",
        "I_8883E3F099C32C7D51D4FA6B29599D4906922A4FEE1CCF06A960C150C19BDC6E.2672.1603151642.285",
        "CD_BFC8B938622E2DB869D95C1AAA9015F080331D812139563B91142DFEA46D4FF4.1069.7091470.332",
        "I_A4B65D3934C7A43FBA7365925E7DFCE76B9A6B9EF2042FD3060D17EEA520D0C5.2727.3281150336.283",
        "C_F0D12046665BD58D783629F2811EEDBBDDE5A3CBE61CDD42A2203D1BFC5DD00A",
        ".>*:6\"",
        "C_82125485D5F16E1009D3E6E30832E080E69D894F4C7422BB7A4A96AB3D5314BD",
        "CD_D6F23AC5CCBEB47ECCF7BF129523258879FDED9D282F558043FF80249A7ED596.2747.3289473415.333",
        "C_0685F0E7DE4E9ADE69B83CB6CC4B69291D69C22AD0E71A095A2E4AEBC8EC8B85",
        "C_8B5848CF178AC283A6EA3092920CFF5B15F81499D839D7D7B16301709CE26AE1",
        "IL_0FE84CB7228184819434E73184A33B5694CEFAED93B282C50B930127F187504C.2434.692288446.311",
        "C_A05374182360C61F50CB18CDEC015D253C42693E608575287859129E69245893",
        "CD_931EBC392DC240CC5527C3CA3643FE44E050E39FDDD4B5A76F950F248E19E470.1052.3545132880.6047",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.1163.1796628911.413",
        "I_16AFD614190C0A361437D059E30B718DD18F5611483A917B9ED102EC39154E5D.2683.987516869.281",
        "CD_DAD7DC48BEC7F412021168603D2D9D3CF712E3B9F8DCC4820417979B6C361AE6.1741.1788314267.463",
        "CR_FF71E202E2A34447E8E5354267F9FFD470AC6E6D127AAB0563CB37424C6A85DF",
        "I_46460DDCC6C58F82F604447DF749C6E1C766A6E184552714DEEF450466CD1203.2719.202377602.274",
        "CD_2FC084B6C709E5497BDDA7F8C8BE67460C3195953737FB3010EA83F4E8CF8735.2623.3614460258.270",
        "CD_934BD1F13253860558310BDF781CA401B2B8CB8F3C3551E85991352E073FA149.2542.3536865254.587",
        "C_0E4E110C89487B5FD6AB427D66ED1F8D51CB7738A04B3C4E1D9404F59DFE3267",
        "CD_A773BCD0E0C94C33A6AC49E9BCF9D33930925D924E7E273E7C9279E5B4F0D069.2643.3050211832.757",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2041.2715216352.368",
        "CD_77DBF4A2C876542515BB91822C77D6AAB627C74A2589D8CBC4096845BC539307.2036.3546365723.330",
        "C_3B8665948C758F7D99D7C0547B931220E5029F52E2FA5FBAACE58A619F833743",
        "MDM_Policy_Config01_RemoteDesktop02",
        "I_E3DC31FA375DA42A8150A733A12E22C9CC1FCB3548CB4C211B732B0CBA295D66.2736.1225246608.279",
        "CD_443EA03A729799AF7B722609B218862C5380ED55FDD1C6840B32FD56F51FDFBA.2244.952327053.653",
        "I_D7F1F8A0A56E12A0989E6F9E8115DAD44BAE34B35F7764E69359514270CCC439.2702.4275443495.279",
        "I_4FCFA3F9AE48D205EFCAF39D83C31E8BE1862FF7B8766D68269B4335D9A043F8.2682.3389959600.283",
        "CD_5850C60178A95C175FAC0560CCB4DD2BC76EA8C9D5B62CA39830121A8C9D5762.1595.4085760094.406",
        "CD_7531D0F73C9D0FCC20C0C9C036C7F34D7F189FB9D62AC61E8FFDD74B2A07A836.168.1.8628",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1210.1086012025.236",
        "IL_41AE0E8A27F69BB81713327447DFEB3E4D47E6C961601828958257151B049D62.1617.2932729107.256",
        "CD_B5BC305FDB6B1BA4B82B81FDF0E9F46A4D26DC35C4DA3F1208F7A3E1625B2883.2575.4171784539.448",
        "R_20C8A6E9C8C3655EB467EDC9510AEF389AC4177DA80550B6AF7EC22448883FE7.1088.4062312687.520",
        "R_791A094A21290BCD3BC23A45D20A2DBE2CCF9E25340052512259E20011F2E9EF.1783.4057561520.536",
        "C_21C86008A085A72EAA2F54BE2ED0590D75B28F32790405AE99F94878D4C5643C",
        "CD_B97276FDFEA47C3D68AC826FEBE6AA3D6148807E62AFB5DE5D384AB87EAD0270.1776.1395104248.5615",
        "I_171DF71ABD7C6A7DF03D4AFA73A2CE1BA658B66016A9DF4DAB148F781BE2851A.1019.1903693435.259",
        "R_CC6778A70C199F671CD04BFF86EE613A1E47C11B60BA19CC09AC555F9BA03FEF",
        "CD_0B714A230756027CB9D944F3C101E5485E82B469361846E74358E5EEBA5C05B7.2739.89579947.607",
        "CD_E24FA471FA616F0FEE1A4B19D9469B11315F0ABE663B66CC48A1193183ACBF97.2646.3239673440.524",
        "UdpIp_Fail",
        "C_1C2F941263BDB4D92A351438E56E28591B1250FBFEB226516D6B0C7665E5DC71",
        "C_8AD8BB59AD76539933CA61E487AC9890B90072B3A3E2702B40F21CB1F591E761",
        "CD_556307783B179705B33BAA318D7984C3930279E4ADB250162C31F9E9AFE4C3AF.2582.1106684830.220",
        "CD_E00F912E9047D1A2BF3DA9E198CE534F57C5B76F41F1AAB4887EE2C73627DAB0.1466.1072139335.1197",
        "CD_B6CEC77857253E4D66AFB39AE432C9A262BFEB17666CC3330EEE5CA9EE49D1E9.2580.2104725951.1041",
        "CD_244B2D44BCFE4686A8EB1967E3535273855A686C9B62600F3309068E24B5ABB8.290.1775322603.983",
        "R_4B73D65E2FE4553C66EBB3CAEECF929ED3C6295923490BCF82E45AB15E13C3B2",
        "IL_1571B37F62927FFB7498686AF977ED5A49C694977BC024587F2890D0691A6555.2680.345023975.285",
        "CD_8C9D1B00E81FBD2847B861D222A962DF95BEF97009ABD78ECA20527CECA1CB21.1292.890658416.178",
        "C_FEE056125BB5C53A639F41DCE7DF075F1ED8C67B4313ACD38915A7DF950C5FC0",
        "RDP Port",
        "C_0750888F7DA336796CAD46D09BBCA6EE8FE708CB3E6A5972E9507072892D3743",
        "IL_0BF1F14F0E0C43957D66FE26E430827322F9091C1E5C92D04AB8BA791B9F67E0.2417.3461368136.273",
        "C_AB1A08A0592FD5FED34D7F6FB366B4D30C0F904260E536317AAE6F7C4B1BADEA",
        "CD_0AFC43F6F954497AA8887334BB937F82532036AD13DD27C64055852F3060BED7.28.3901999412.1222",
        "I_A6C9ED46D92F29AC214E96B93934484D3FDC38BA3D568DA0709910225F8C44D5.2687.155383245.275",
        "NS_0634BEAAA6D47E6371999AD405E0DDAFDA3BDAB3659C4858F565936A4909981F\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_1035B0F62EAAECC9C984E7834D0AB6A9928506852D8C840D14F9BAB2AAE4A68B",
        "C_AA89F446191A5311D6195827FCB555530663B59BC79B2415F2F523FE46FD51DC",
        "IL_A4E2903A3A34AD45CD7D06F2387E652F3EF1DDFD41BB20E9FD9AC04B664AA48C.2711.2906657682.293",
        "CD_153A90D31DAA2BB98D107166F8216FEE25A312878D4AECBB89966D3EAC52B5F6.1820.1457706140.411",
        "IL_5A594905C8F81E999D9B9057D3667626B70DB4CAA9232253B2044B135DF40086.786.1.31819",
        "CD_81F5CC7DCEFB1E634599916220181F35C3DB70B94808983CB78C381325F1AAF3.2286.1.142622",
        "IL_FB445B81C0C6D297780B021A8A2FFDCA5D4B3CFC4F9A65422D04EB9A41F45A20.2687.2741445532.264",
        "WorkingDirectory",
        "CD_DA2B7733DF2BD3EF26A98D0C67C53F3AE08EF07915BF46D535095C4431D97FF1.220.3043467037.966",
        "I_4E3C5019E7EDFD66729F1899A6916549F5165AA1E927CDD13C24FD0F056D9269.2735.3290035095.284",
        "I_C88C3F575019A3340E170BFF0FE8D01D1CE6D44E7F8DF686DA8AC6A2D50EF855.2714.3617702342.297",
        "C_43AD532E95E5D238ED8820543872B53F0ECF9646B749AD9BB6E4F2D3E320695E",
        "CD_AC0E04BCEB92E102AEC34A4105C7658C51A4608468C8FB7D34B6466CE5EDF05E.2508.2866248587.1030",
        "IL_DD370C83218E3ACF4ED3E50B021E588714258891A76B1EDBDF23E122A58854C5.2736.248644412.287",
        "CD_0A6750C7348B537B441FD2B8326BDF41C8B5D59AA69254D1D9F804769C8106B9.1733.3079809036.3189",
        "CD_A7934FF637F20334EEBDD374FE2444F45A95C5B33E592D4DDD69ABAFD3C46F2E.2613.305275016.361",
        "WMIBinaryMofResource",
        "CD_FB169B858D615D75D1CBD0091651D06C44C4A6BEF87F764B832ECE1406D95CDE.1928.1512854028.1009",
        "CD_7CFF354FA8F5A8013D770E0F778B943473F6823889CB937AB5AA32217D27B6ED.2120.3097551168.1494",
        "CD_841D3DD3F3A7F09379A97AB7745347C579CB951819312FE93085B68F6AB63E24.277.3739799560.312",
        "CD_69682A3F4E660CE94CF4FDF3F99EE5C0DEEAC14F4AC4474928CFB8FDF1B19380.1355.2889972765.2304",
        "C_9E152E3E3D8A2665C8A4533F9A4E67D0D1AAA1D8B83D4A80BEDF2999A2CA16CE",
        "CD_0ABAFED91AF3160513FD4A097A7FC5F22572733C3EBFF5EDB2C1119EA3585424.2188.1370109640.1371",
        "Remote Desktop connection management on a specific network adapter.",
        "IL_F29B7A2DDA607A820C01A6084774262633A7D7048E9240AF094D62E3ACEE7413.1936.2270089716.202",
        "I_5A668810EFB5F334EC8775C84645CC31F89D3C68DD1A37661095B62EBB956DBB.2693.2821266362.261",
        "CD_8D348295F5C8039788FF0FD535EA84E2DE9FD1810A97F958930762614BE11757.2605.1894320823.221",
        "CD_4DA7E71A9CC400DDCB891860F95A9DA5B5C3BDE919E0221C377225E0CF8C99AE.215.890844607.420",
        "CD_4988CD2D7F85D5C17FF2774D58B894734938D3599DCA6128DBFB2C7CBD3F8289.2643.3737238357.1036",
        "CD_BC8304297DAEA08EF836B71DA253942E5C6B510805DB5280CDD11086EF113EFB.1150.1079007642.329",
        "      </rules>",
        "IL_AAB2361D5BE7402BBEEA8C75F0C67526A834F4857A9BAE731DBD8E4D03F06056.2686.751587766.263",
        "SDBUS_DEBUG_DEVICE",
        "CD_B9145D0C1524AF7987E25CC808ABE0754617F2DD4E8493B212B0FD0151445017.2589.4162470730.449",
        "CR_832531694CC32AEF12EEFA0D2DDA8BF782C32F932BED169759F268D0FEAF39B8",
        "CD_4EF9C71BC878CDED855571486DDA10408A556B0E0B2473232D97D8125D3EABD7.110.4030195079.2729",
        "CD_1D8AF94E43CAA7DC78EEB167F2FCA41288361566745343E55E2730385A1CC51D.2419.2001202682.697",
        "C_901AC56EC8F00C00FBAC686F0B7E1614E207CC1998593D930358F2BBE88093FF",
        "C_E787F19CC95B92FD39FF9311EE9ED6339BAB88C807BFF054C3B0B7D91166FE2E",
        "CR_6147F993AF256833A5576FFB2C6527B32DD0A80720419520043AEAC80AA92F51",
        "714.2298416373.293",
        "CD_C33D59D510F29FFD2D335B60BBA896FCAB2C0201287454440444F0D3AFD4769A.2578.1294947769.1053",
        "Error ",
        "CD_5F8086938F6BF421BA200D039913652FDC167A0FF909755EB1FA584E2EE04F6B.2370.1402244876.1043",
        "CD_38E384CF26B6969C10E6C877B2EEA6D4595C8CEEE6BA25CFC97F17CE8E8A5DFD.2403.3022193625.598",
        "I_E1F2E9E694FC3E6DCEC59C12E874FB421C81C7C8C6E51D83EC06148ECEC44681.2728.3706500288.296",
        "CR_B1B3F51451050560540508AE61C59186CBB46746C5DF2B2C8763635DE336A9D9",
        "C_6EDCAD2493CB9C9AE066E77642818C8D9B9BC312C7B4C3A76A07871F0E60FEB1",
        "CD_28D3480019EDB8568B100B133C2E45279CD6E1AD49C4AEEDB510EEF8207E9610.132.1881790728.629",
        "IL_882898FFF157F1FEDDF4993756BB56988BE43D05EB0E1A07E492DEECFCC2B753.2676.3028000632.279",
        "C_D1E324C5A423619BD6E9DEA96389533A053B58031C50F5CD3B933AA32B95E475",
        "CR_361D98FB17C2BCDC621D6A7CFCE49AF430F4AC02365C7EBFB53223536307BD5A",
        "I_3F3E786C7075F975E58D86DDE7ACC45B3D1379AB5BF26E883087243804162E45.2708.2015097352.284",
        "RSOP_Session",
        "CD_7DB1E30FC06BBCD83555FCA1DA86A907938086DE88B466575ED4B935DD61EAE7.1078.616661358.770",
        "CD_805206C561285684F42D728C26661B4F548F5E54321B06170E013CB108084182.65.3951828876.660",
        "CD_591ACC0014CD4A60D997F9409A17B564F416A1D3C15A58EE38955E2DD36A3A7C.1600.3715092801.476",
        "CD_C955FE3691938CB4E504845F7B7CF5F1DDE17A84F886B06E297A90849911ACC8.1935.753679266.261",
        "IL_66C8A359E47F0D1B39D305A89E658F2EB641AC331B4DBF2447797A4211DB63B9.2688.2063436613.269",
        "CD_FDFE527398F2ABFB9174C6F115BD3281FC3B3D869047BED0A5719E7F2618C914.1548.3490643378.630",
        "C_54C8526E57CA46D1FF3D85AFCE1DEC47D8F3668C4749EC39975178A450C5565E",
        "73F78C5069FA",
        "MSFT_MpWDOScan",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2005.3067717124.180",
        "I_5B4CB97F3296F541A8C0855751D27A489FAD2B073B0E52456E215DE08C0E49BF.2728.1403484980.289",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.959855610.226",
        "C_DDBF2272AD53D1E9DA14E7F99DB9C4644CC139435FA2E500211498B44899C2D9",
        "CD_7C983320414DFF8D2BA0128B25033C8FB169F5189449E13D88BE3724B6F2E9D3.2370.3982086679.776",
        "Xdp4l",
        "CD_3C1F1A447EC4276186A6706A3A49D07A2A316ACD6912E09A63348E2481FAEDAD.2424.3184918214.356",
        "p@.i^",
        "IL_3F3E786C7075F975E58D86DDE7ACC45B3D1379AB5BF26E883087243804162E45.2708.2015097352.284",
        "C_50988C8CC93A3243BAA0056B1B959C7138E8342783269A1D2B5E4A28855995C8",
        "IL_35D0290A1526C7BFDA75159EFA1A15A19A53C6D1A832DE6967F7889F521EFFFD.2677.785593934.279",
        "I_3B1F8D14DBF658837F8A27B4FC1CBEF2C9EF4FFDBFBE5223A429267C3BE52B6D.2695.1116355637.263",
        "CR_0F6F4793DA673F1C347C3D8CA2454121EC5D32EA0CAF379FB0C0BF42C511B174",
        "CI_0DCE749AD0E30C5A74941D6C326877243635B3D92AE3FA1BB77A2C716BB28364",
        "I_8F1D0EEFF09882E0AA524E87B53BDFC6C73AAB5D286B5498249DD4CCD51331DD.2736.1352933053.201",
        "I_990444B5147B385848F6A331FB9B78A4118CD4F34316765DD7E05BFBAFD92E46.918.1.39586",
        "IL_5A7261F5EC1187583C73ACE3A490C4F2686C3F15100D1A96FDE1517C0A5317F1.2729.3782110954.269",
        "PoolSnapshot",
        "CD_331837EF40A0EBEFDA1431B1717E4905FB3596E860268A515E766537AFF172BB.2545.3577727001.945",
        "Unsupported Format",
        "CR_3E93490AD7E19BA9FBA51E3DC8E6582CA6AAC992C61FC9D54D14390E9939C366",
        "CD_921492ED5760E8DB59B18C393C69FD700B60A29E9CA498982D62B891A4AF6985.1340.102976892.1108",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2005.729656931.368",
        "ReportingNonCriticalTimeOut",
        "CD_0A78EF6F4A690AF3AED26FB328EB3A054B82E3E4610773D4F174482BCB6B4DB6.2664.2601029178.255",
        "C_D977258C1F704C33B07D49D2EA09582CDCD7013482F97DE374BA6BECFE6B2F59",
        "Volume Name",
        "The owner of the file/directory object",
        "I_80D5B5FD58BFD9AB1037850509FCE09E53F1B6E15470DAB24486F2CF0F2293EB.2735.2706017557.277",
        "ix93]",
        "C_4FBF4E2F4EB997E78BE6A08310475D7F288690ED00FBAA96A0D81E2F361482DF",
        "I_F5C01B67224A8282D3A2AD3E41AF33CCE9A62FB202D88AB9E1355C99C2951A37.1462.870520363.409",
        "C_200C90EF1F37F3C6854C8BC7B412F068290AE1652EB71A6D74CD3129536DEEED",
        "C_0E2A8B91A7BA07ADF29E39AEF1F72CF1C889DF8DD426EB9E4E12C6345FE58BA4",
        "C_8BB282EC877EF750BA67E21AEFC765F0958A7E18EB5158F15A448065A4876EFB",
        "C_939FCC6B5B4675BB5CEC42A6515416373AC42FCCBCF280E4E5D7805BB730869F",
        "NumberOfBytes",
        "IL_86C28C34394062303FC75F2777443AF2AEFE397FE5F57AE0CC82E3E4BA986771.2724.300483189.285",
        "CD_FD4F4D3C59F149D4ECD4F84E3818809F406BCF7E122C03BCFA93C04C2B2F4607.1733.2608275601.2940",
        "IL_0438CFD6BAD6781F386E6BCF577C81B564535404C193A2FB26CE77A03144AAFB.2697.2906461808.267",
        "CD_500B791BBFEDD0EF6DC1FA9B56C1442D75CF8FCFADAEBCDCA51CF4251B2B1ECD.2387.3757988586.743",
        "C_ED63447AC10EFFD570567110ECFD7E57B65338C366F9DC0975F468A0220F367B",
        "IL_94A9308AC80772269CB5A3765C6C4827A9F1D2247705F97DE024F02F61BB669E.2693.1462610338.265",
        "Header_LastDroppedTimes_TypeGroup",
        "I_AEA9A6C20A5CDE3FE05BB0AD73D3F62C4A3D3F9C9AEA68C518E6B5CD1117BB7E.2679.2770851414.281",
        "CD_69C7869757A5F0A0B753F6CBF641632E43C401B354F79939A20946D52BD05C51.1389.1702174677.345",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.314.1925181483.368",
        "CD_AA41A8343BA1D329E4982E46F903D80197DFB87E55CE7405A84B7AC638E427A0.2183.1.33475",
        "CD_7BF9CAEC5E776ACF448F84A63EB51613BFABC1A04749B0DFFD3836F69A0FC40B.2578.2459284801.1061",
        "IL_391DD484983F84A2EFB89AB2E60BBE9FA89A53D54DDB659CA85F25D965145C14.2715.3499310028.274",
        "7951C406A4FD236FB796E75935821F2729692C49E7.2732.1372383943.274",
        "CD_7E57299DCB25F674827DCD8D5EFDAD8B17A35DDCBAAE7488D6DA9A5B52476F0E.1779.2977606158.306",
        "CD_1435E6F01506FDAE4AA2C842B37209EDA7E3776319E85DC60053661DEFC190B7.273.1.9086",
        "C_556C6D300BDEA99DE8588E2B5D8DB1D5A33F34F7DA1F6E6A0DA0951B22252081",
        "IL_48E0B724F43E37B7676E11AC832EA6DB1EEDEF00985C20F2786731722796D31E.1016.970742308.319",
        "CD_38029140A10BF50588671D614C4E488C9AA41F396EFCAE54B7230B5F12B327C5.1584.560203010.425",
        "C_BD60955B2CAC10D52B734218E0C4D92BB3CC99639B2B503B8D221494695B524F",
        "C_1FEDD67AB059C717A3177A11DDCA2AE4F063EC79B0087199B3EA7A6BB2439395",
        "IR_0DCED9E1ACE5BCB5BD4659B22A968ACD211DAD28DD1F7F8E29338776357B1C20",
        "I_125EBD60B5A176CC0CB4DA9D052CF807AF1348E87543C6CB873D5B2571A3FD2D.2728.610653683.291",
        "I_5F52E98B4905E86733B57BDB8229A4CEC75FA5749D918B5DBC7157473B48B71F.955.1.13002",
        "I_B315CA48693DB3A59361FA1040AFB5002B64D950064192E8DFAF6F9F051F7F5A.2680.3931095754.284",
        "CD_3079E8CD6D46EEF3BB8C478A433B73D0DE2B5FE05E7E7BFC923B4F14ACB286EB.2423.3285130172.350",
        "IR_E0849CDEB189AA76D8525CE1B639DCC35E6FEC1238BA020F29888EDAD9D3FEAF",
        "CD_9A1BB0482D33C76729D4E4E83E5DB60EF19255F1B7BD18ACD1F30074C3DFE4AE.2649.3934538968.244",
        "C_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "I_DDB95E3B8013B1A116C3D5830B7E0BECC772CA8D531002E78073C674C21A5A18.2697.3801693336.267",
        "I_08DCEDFE4B19614167C5D13C99B3EC7CF1E58552D5D908D4C43BCE7CDBC1455E.2719.341435090.283",
        "CD_6EDB414A272FF229BB33606CCC694211C55817ABAE713A5736D1E4CA0295AB08.2745.1845552360.356",
        "4p8<@",
        "CD_656CBCD78DC3BDBCFB58D6DE3DB4D810E2F34DFAE48DDA4A1B5D5CE93FB860E1.13.2444365640.1803",
        "CR_0783FC4315F6719B07F6F7780EAC7B73D0B0471C3E21E23BC45CB6B44FFECA8E",
        "CD_97C7D526C4DBEB7083476F235A5653C31F00C78AFD98652230E17D721E353ADD.58.4006114680.671",
        "I_FDC07BF412EF517BF16CBEA0AD032C8FE94CB2DD73B9CD909C08659DB8C5BC0A.1336.2924169968.467",
        "CD_557539563EFEA085A51C933372B76B0DBDD1D1003F13AE16F6DC6CC216910E08.1154.214729971.277",
        "local-user",
        "CD_6CE5293A4991040589451CEEA5CB3FB1F0BCB9AC8B0C16A2D34DE39822CD1F34.145.2227758636.1021",
        "CD_67EC6840BA73EF4637AE84EDE8859A76BD68C94CAE4BC02D6EA498581967CBB0.1194.2467602281.308",
        "TRACE_LEVEL_FATAL",
        "I_2FDCD537A8B7A50CD1D6083D52F18663AE4AE9EB2AA1DB025B14EA9525C5F389.1014.2592147053.307",
        "CD_9D451FE1048C25B1734C21AA9BF5F52F617BAC50A46B49E962E9AA59BDD63A0E.1190.3098294277.611",
        "CD_7D2D68730949E5EE75E3C50237992854349528E2C6E36831BFC90A236C99C00C.1562.3310706781.887",
        "CD_09416880DC950121CF927099A50B486F189A631C326B4B438123E20ABA622175.270.110672010.216",
        "MDM_DeviceUpdateCenter_DesiredUpdates01",
        "CD_C21EED7191192F2ADBCB9708104DAD6A17FD5A43846B186D22E5E8405D0D7A69.2102.915478675.5064",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1075.2949736959.180",
        "CD_FC64B24C83B6ED14EEC6C8C71996B5B6C6A9B3D7C971730102A87962981FF379.258.2550197831.808",
        "CR_D36EEB4FA019E601112818DDC069B750B95BF09F1ACA992BF14D32259D2DE75F",
        "Association between a StorageJob and objects affected by the job's operation. Instances of this association should only exist once the storage job has been completed, and should remain for a period of time (recommended 24-hours) after.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1164.2707538804.368",
        "RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads",
        "CD_52F5ACBDAE24F4A28C0779E6C390795B2874AE035CBE1817D5BCF3119F482468.1196.2269051745.273",
        "CD_17926F6B3829E6C995D27F0290E459C649CCD7CB59546F30038E7938C7BF4AD3.2546.2707978460.1019",
        "CD_56D8A63CA95E0F8506AA7DC81F76BFBF31CC0706D19B7EC4CB60FC3074D6BC87.2614.4170130817.417",
        "CD_38C8B45669D476148D44DCBFDA994060B1C93A2142F237D6D0ECBDCE445523B6.2631.534394994.3271",
        "R_06FC0AE99192039AD3DBC9A60D9D3329CE5644911B9200854CEAD799C76E19C9",
        "Total Unmovable Files",
        "249AB2463DEE8AF9E6045D6C53614F5DD03A6CDBE2B7EB3990B7FC319F1979",
        "CD_79DBC5D293E4FF409F7544F02B31B26B6155CC6162B0636F647BE9661B9D3F16.2424.3391082568.303",
        "C_49358D38287F930E1B9B4F03B6EAC81CD41EBFE0283F257F89AEA8AE3D4D8465",
        "237F64D00529CD1A7DB924F38B.1194.1014631282.658",
        "CD_D6F23AC5CCBEB47ECCF7BF129523258879FDED9D282F558043FF80249A7ED596.1983.3479471666.781",
        "CD_2251F72D94ABB73C502EC482957E003D2DD81CFAA082A8A3F37E0FF9D44026FD.2579.3991045355.219",
        "I_C52295624F06C940B122D80C080F06A7E8A3B72E8DBB8DAB3530E90B3C01E0C8.1501.1965779237.618",
        "CD_439AC72FFBC0FB0160120ADECFB39E726F363ECF3E117EEA1EAB024AEB72011B.1057.144791431.890",
        "CR_33415365332F60FF3FC53C2730CA458D611DB40E1531E34D8C7BA9D358168B16",
        "CD_61BD99E07DD9B896C168C32D63CDE78875D8845FB21EAF979A76CC25C89D073F.112.485256349.644",
        "C_7BED87BDB52EA7B1358064DBF771E27C411EDD63C82A01FBC7742FD607C32DEE",
        "CD_67B957B7FD1451F4008C60D3B500296D0371242C5A3269FED6DD43B17D84C14E.2541.1496052196.532",
        "IL_2DEC27A59F0C8413638E708B32C945A429F0C032F29B94FF62047030FBADD637.2716.273619759.273",
        "%)!exVptaRNl]",
        "C_249661A8E9CBD86C5E39E274D7BA70EB4D250FBAFDA52F3362ACA1923C54F956",
        "R_044BD4F4AF9E96DD48DDBD1666684018230534EFDE72CF711BC2F8C5D5E9C959",
        "R_755C3664114AA9097DEA3F0332A59D1FE1A4668C8001C4E97937639305CB9174",
        "C_FE3903A8A6E3E4819A9E93424E0AF9D5DF66EE46BB5392D0B1F436145A771C95",
        "CD_0BF4601159F302B57764FD4C588A6F678FF707082109EFA7B0AFAF7D3839EA35.2592.234450610.2311",
        "CR_4C51C80A2BAFAD3102FF110F62EC213D34DD3E23F9AFBD5B7FE6DAFCFBF7A94A",
        "I_1D3AB53BFFC33BAB5A12FF7580A47136EFBE141A5F153D3EE38448C080BE7086.2720.3904078339.279",
        "CD_59CC62799ED4524121BE28A013B19C8FA8396DA9DB0959637F6F4B761CC22896.1190.3562943868.302",
        "C_CF8C5D2298E729B081D1C131BD290A9E84673DFED35C60023220564D66F04E17",
        "C_58578AEE1F0588A6EDF4B7B9F6E4E05918152DF0FF63113A77CE8072FDAE6C92",
        "CR_F2C608EA415A514E5DDE0744E350C5D6F7B19EFAF19967D7E934C8B89CA08EE8",
        "I_41AB94F35F1A9484D598308CC85AC16F1E3D0452456DE3794A2343CCACD11DDD.2626.2391607354.272",
        "Sequence Number",
        "CD_50564F5C06988A1550650BA34CB61DBB736E969C2840EC6EC2C5C6E85EB95D01.1564.3947476980.2432",
        "CD_AC7BB2CE72891CEE5B24D1161F798647F6D5827CC518A0A64C2F1BC7D1BEC738.314.1782960586.197",
        "C_60C5D6136B9E1946BE8FF2F55F1989E489219A67C731A9E9CC7487E5EC74E5F1",
        "CD_53F361C92B689C209884B5B758327060224E1EE2A715868AFD6C828FF0E150D3.33.137836947.468",
        "C_2870C542381ACC297B648158CD3FEA1F43D21FAB563F1F7A7AA10504379136A1",
        "CD_18DF4E7DC43FB5F7943BBAB3261441AF37AC157D8DEB54891BB97D3B897A5305.142.504341329.599",
        "CR_A04AEDF73C419CEF5529A2C6EC9E3BD525C377B8B911A8277E85A9D06A3F81E7",
        "I_FD2C5547FFE1F8AE5543C4178384019AC9604DE68E2D71F4D4CAD1DB441347D3.2664.107295753.283",
        "I_5C7FF4500DBA21E1B00300F60162C17D81CD2BC5202A05F193EF2C7B000FFF89.2705.2672477016.288",
        "CD_24BE268C5603D757BD8CCA53193660D8F104AD29F4F74D327C13832A44E7DF1F.17.3409386182.369",
        "C_ECEE929C1A83BEB7C538D0C37079E984E95BC784BD4C7A36E572CC721AC58FBD",
        "NonRecover",
        "CD_D439D24286A48779EB1CF85E2093853178A3502A21F1F13F44868D671886BA98.170.4215661143.2210",
        "E18DB3EAC6347E2FEA4BE12F740509FF8499D2E40E3CE861C65CC1D7E71BB2BB",
        "CD_73D523E5D8422D25C3616043387358F30734A705AA52BC4685A9ACF44AAE4050.1611.1626641852.769",
        "CD_E69678D95075FB6BA6844B84FE0DE69C85BE49AC691754C5A6AA3AE728E45697.253.1477955994.2839",
        "IL_2381C996A59A0D1EB6DDD79E1C697FECC05884247B858E341AE1AAFDFB086D7B.1196.3074802508.267",
        "CD_EC28DDFBBFD00B2229C9E0AF729FD229D243C353901915B7D576D0B0AD926784.2639.944000665.1317",
        "CD_C169AFB4FE2A5E4B69B441A9ECCF47EAE66EADEAA0A487B5AEF1D497919B36E0.2486.1.18151",
        "I_927DB08761B3FE464A2914E8AB4DBB9E74A1737A91590E3FD3985A126B04D44D.2704.3413318601.289",
        "CD_92C20EF171FF814C89A447738B20EB69EE2E21C1A97F4419FF2142FC840F509C.1844.1.11081",
        "I_5D18D363EF059621321E7E50BB3FEA37F3CB86B483AECFA4BBCBC0EEA9479CB3.2704.3796635195.285",
        "088286.637",
        "IL_EBAEEA562CCAE5F44F8DC529A43985A152EC238D3F950BE794ACAB0A20B82979.2458.3154330122.294",
        "CD_6FFBA8B5854E9C5C5C698A9277971D04E447B67166A26CB7D9DD0D9F278C2D8B.2042.3409808955.1460",
        "CD_54C8526E57CA46D1FF3D85AFCE1DEC47D8F3668C4749EC39975178A450C5565E.1188.3845607048.559",
        "CD_D36EEB4FA019E601112818DDC069B750B95BF09F1ACA992BF14D32259D2DE75F.2739.3778633295.783",
        "CIM_Error.ErrorSourceFormat",
        "CD_BBA26CEBD94E02C63A4812F98BAF8B828E20477373D54CAFB6CE9D30D952E46C.2452.1.38268",
        "C_2FB30DC8F94A0A113AD4A141F719C8A8C70B3119C9037B1814178A55C7A7F2FD",
        "TrustedNetwork",
        "CD_884D60D0DBFE6460D83079FECA71E009FB88E0ACAA9538FA4A82F908C79947A6.1749.2924974041.769",
        "C_F34DE71B2CAA78B0B6E197AEC8F7CB5876472AEDE7848CCF66EF8194FE5EA5F3",
        "IL_036F0F01BF2A6AD8DDA7AD1F3FC951FD32543EA05CF01D5246A94A1782FA9375.2728.257466889.279",
        "C_AEF4BCAFA3CEE844FC32B54865C308E2A65BDF0B3637732FB1712E3C76E4A368",
        "CD_672AC91064DD7727FB109DFF59E95A1F605E4D89A741855158B3D85A026CCD54.2083.4141131704.4819",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1751.3104661138.180",
        "CD_6AC83E7C3405E237BE031334BE2B1588654DC981BE9868FD8B2192931F6350E6.1534.240925494.1218",
        "I_9A759E0CC6C72C9675D952131FA52D1EFC2A9BE8AF16B04CB42468ED3D134C6F.2704.2257322910.282",
        "C_C8016B6B0049BC20107AF6058F0D557305357C2E4A27EC0BC24AF4A11B9B1028",
        "IL_C7F6C86A8A9FCED582321F4B85EDB080E99048AE5D7AF273DAB14F22AC9AE7C0.2712.4008156233.296",
        "BD56B098ED457BDC27158A62BBACE11D9",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.866272930.368",
        "Volume",
        "IL_F98CD8F4EA96B0B77910240E3039FCC377A97641ECA44728EE7350A6200A681A.2462.640519852.342",
        "CD_DFBBAF5D5F94B4BF228BF95FD0B1E0E77E3B25A375A328BE897C2C1DA70CDBD4.1966.3723044135.3599",
        "CD_772F556B04D98F51D070688680FBBEB205D86BB8F4E24F468AE459F92ED94CDD.1876.622425673.321",
        "CD_043F48AD48888B41BD56388FA26ECED8B66FE9C03EB10995414C716325CBFED3.1634.249005024.4118",
        "R_9D906F35D6F26F4CDCF3EE0A3920960ABC14087255E63B64FBCA0DA96B913D5D",
        "IL_EC3B8FD717A738425E0159268883F206D489A3D720198C69718F01AF4B120295.1020.3483875226.298",
        "CD_943386A936885D346F0D61FA24D7BB2533B7B797B4E446178A40D4E6F2C1683A.1794.3028041114.2196",
        "C_9B76BE6116634D98E523DAF9A0AD948B4D742F1F76F465B3DDA5D1B7EF1C7F0E",
        "IL_8F2319CF1CC2137ACBD782D141DAD173E170E80A9034A4B1929599CF48ABA70B.2695.2000470039.277",
        "CD_D0F4E3620A7828AAE5A40AF4D4360C5582C0BA2DCD78FD96FE0C14267800808A.2600.4194225416.913",
        "CR_E92E47C86489DA48917E83D712F4258EEDF7A9FA5063E409A1EAF630ECC0F6DB",
        "LOCALE",
        "ProcessorAcpiXpssState",
        "R_610AB796758AF91BAFAAC5773CA30FA987962CB5B589ABCAD3D6EAA7F97EA9EE",
        "CD_039809E5E8F2D8DFE19D9ECE6F2163A46417107911DAA316E07384C24125AC9C.2394.1.10721",
        "C_FBD11BA7DCC0C416362AC2A1F8EEFD82230A37B2505B7C99363ED198FE2F89CA",
        "C_A107EAA2D6C2A698530A8358D207D9A3B8B427F7073C80586F1820045E4C35C1",
        "IL_0B8BF58309BF9E34389F1C832AE582473CA071ADFAE618E784E2A5B7F73FBBED.2722.126728342.288",
        "C_2DA1DCDDAC5BCABB5D2F3CD09A1396CB44D9E59B2256D18A12D7AC169D134976",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1938.1704222770.368",
        "IL_6F923B697A14EB8F697BEFCA35208012C4B234B1A3DBC07EB24CF401FADA4E60.2700.1548102633.280",
        "CD_E2B2F2A9C4A7BE777C95CFBAC1ADF577ACC960E4E5C2F6E896E757D1BB542084.206.2227259835.554",
        "R_6603235838D67F0A31998AE108546BB74586B33844F47241F23AECE3061C708F",
        "CD_B2CD8F05013FBEF276E8256873F843ECE3B819C86E4A1470B3F32BF921471F60.1967.4232546659.8121",
        "IL_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.3574059521.338",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.2042.3850410451.466",
        "CD_62D05C4ECF40774F04063E6FDE0B1A6CE4B671271358A09E1596B6EBA1E2DD4A.2757.2564117782.302",
        "CD_0053847C9174B114F63255F7E8E42BF75E9B7A4222D19AA84EE0BCCF56E90337.2545.2267548185.695",
        "C_9FF931ABDDA027CB18E2F61D38FD5A4FC1AF5875DF376367CE6BBA8FD924FFC2",
        "CD_15CCADCAF3B14E896FF023CB4F58C808DF0635585DF3790B0E9ACA025DF83D69.2650.2985710659.1673",
        "IL_7F553939F93F367C3B9A038FAC17470D211306E4916E9FE38A48EF980CC21590.2680.3142390935.284",
        "CD_22047DD6AA3D899430A0653518593E646A07EB4284EA1D69CDA2422FA176EAD6.1583.436489347.260",
        "CD_61CADBB506D856243E79740B6392D66E1EE943841FC396F3057262385BFA8229.77.3602919565.4316",
        "I_660E9F9CD49DC2B89A3530BB5D346CD91B5D13ED4B0CD89DBA4EA77A9A199EC9.2688.3099750283.271",
        "CD_BAD9CF65ACAAD76843902B63F6C257FE0199AAA33356AFF3195E24965DA21069.1959.3346567213.623",
        "CD_7B2381E53BC461FB5BE5892F6D8B646850BE4B97761D0A77A966BD4E7C587F57.1060.1961926484.1722",
        "IL_7A779F4330E50C4FC579B3DCF27C60137473DEB41677EE9A1455DEB3F9CBDCDC.2715.3595765299.273",
        "IL_42349C139613955F5AC3646E664C0BA54BD06D4BF12E7BF8CEBEA1F9CA990DFB.2700.1080190928.287",
        "I_3FC486A266D8D37C7B5172B7B9124D167284D5D0B0CE0425D526DE749372C69E.2727.730436107.284",
        "C_3C61ABEFEAF778102D0BD005D591A85A882509AB85CE543323A63CC898834695",
        "CD_7DB76B3DD456363F496D78BB6E6B5352F812D97AF3EFBED78BEB66F92C943C4B.104.321522492.556",
        "KI_47C79E62C2227EDD0FF29BF44D87F2FAF9FEDF60A18D9F82597602BD95E20BD3",
        "IL_79EBD7047AB6731CFFBEB617E3868137D79766DAFF26D466DAE840AD5C0138C0.2691.316001455.262",
        "CI_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "C_B7D757AC18FF2608497B974C70CC80BE5C41C99B984057C2991D1A13D3816E92",
        "E5E1C32A05CDB4AF1E31A2A9954312146F5F7F70A8F443E107ACC81D76BED7D",
        "CD_766206E818648233F1D08F1C00805E3E5967D15F801236FDA71EE3E046A5669A.2559.906585174.688",
        "C_A8B7F475B823CD27197221367DA5046937A001F70FDA319AF654A4CA16237214",
        "CD_BD60955B2CAC10D52B734218E0C4D92BB3CC99639B2B503B8D221494695B524F.2731.3681127666.584",
        "C_6D429FD402093547E603FFEF7F3DCBB64D26C88E650742C35EAA4E9D319AB841",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2483.1844274872.188",
        "IL_5C8E889EFDCAAB9A824CAD60A6893896BC511EF516AD1D2FC6061C440F917D0B.276.1846351431.318",
        "CD_8029010879AF25DBDB2587888A23E76C1BA34EC4177560448F42E3D335BD1B08.1607.2740029113.1582",
        "C_A96A7ECF39CCB33BE4192A33B3DCCF8594AD17A0E017A148DD467E9A270976C4",
        "C_3C7C27E9E69E2100F7687A005817F1CBD7EBEA972CCE25FD772EC69DA58DF296",
        "CD_918165F99F828C6B53BA10EEE3979256F3A73E636E22656D27D129A14FA67468.7.862705035.343",
        "filoru",
        "CR_755C3664114AA9097DEA3F0332A59D1FE1A4668C8001C4E97937639305CB9174",
        "R_1E1566DEC98AD7EEA11B96CAEF5FEB6AE754AB31A01EE8B2B82E97FC4849BD59",
        "CD_BEB5CFC405938CF504C4F022B26457B8BA4AAA062A6E8AB4E49ECA4FF82FF69D.1950.4079216058.519",
        "C_2A53774A21E318A8D939388D5E5CD6D4813CBF57C2CF0451E1B402EE9A87C56F",
        "C_F31884BFB479ECDC8FA0C6525BD2E05B732CCD07D844062B2D8F0B23B81A2F45",
        "ManagedElement",
        "I_B3004F14DFF3478FDC001CFC6308017B340B717CA8EF3510446CA3775B4E50A4.2690.621995481.265",
        "IR_2797AA0512B80E7E1C1A6BA2AC1D2A5EAB929047EBF4944B5812DE3C32DEE06C",
        "C_B6954264FF5C976D13715E002D09B29D1875A7FA2156E8A412284BABE70E33A3",
        "IL_B1169607B8866983843438F9EA397897C0E954A6BE0361A15C053E12F2A28323.2714.2625135702.303",
        "CD_18800683F0AC1EF87B0E6101BC5367F7C19783D4C31994E5DF533A6065E582AD.2510.3576338858.3091",
        "CD_177D26EEC1A3EEE9C918CE0D02D131303B46FC66DC9D37A73FFD4DC66006CE0E.2629.1.10662",
        "IL_C066615344CD76A1C7EBB470B49AC946E3B7FE9ACA9B508F6634ED36BA2001EB.2696.3756020706.280",
        "CD_2B52813C6387932BDFDA0985812CEC314027392B2888A6CAF0E363C856302651.1205.1988356380.1697",
        "I_A265944DE9F9253F1E3F972A06B3B034EF943B6985045F07B528B95C68BF25B9.2728.3714738466.287",
        "pxt$(",
        "WmiMonitorSupportedDisplayFeatures",
        "MissingCounterMask",
        "C_14FFC489A434D581FBF6E06A9A803439863075160D7DFAE0D83E42734806076A",
        "C_0E81B0078BCCCABE83B42D33CA74161EF66C3A92F490501FD2245115FBCE545D",
        "CD_A68B01B18C25C8BFC9B36419B9B64DB698A481D87C42ADCA7EC744307E0456D7.118.88025206.1425",
        "DhcpMediaSense",
        "48Qa<]M",
        "C_3FDA9FF251C6BD5841FB280A37A767A97FBDE0A3950C58F141AF2BCE7A64366D",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1130.1829995367.180",
        "C_A435E1CD6D36EB19C6DA0BA1C7E62224942A59031964EC981FF17A68812E1011",
        "CI_5ECA63A2575A533106A3DA4D4E7D3593AF8C1DBA30A77246287C3734644E9810",
        "CD_5C90AD83ADE4C22FE8FF44C299AD3236C77C12C54C212C5C5502E0B121FDD0A8.1018.1280746052.277",
        "CR_5F5583215800877E78DF32C89A95963A09372E548E11061C174A3C01BAB56758",
        "C_64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41",
        "CD_6F6CF7511ECB359E4989B369445873C82419FE289E80DBBC274B4D32EB4F802C.1921.302148098.295",
        "C_E9E6CF14A1D1943FD1D418A78D10A4C9919368334DDA95F2266F7CC99B71B777",
        "object:ProcessorAcpiCstState",
        "CR_0670B73B6B090142BD85762A0781366FE00115AA7451B9B2750B5D23B1B3C0EE",
        "CR_90A9EF86FF70A029BC2CE69881FE867FC03EE19BB520398B9DE2D02EEBE30B96",
        "CD_85CC7AB11FB940FC1C1F33A4AAAFCBE19B7B68FFDD5AB65EB58169644DF2CC0C.2637.1463583127.1979",
        "qoswmiQOSWMI",
        "CD_0C06A76FA35A78557382D83813D9F6B0545E1F0D74B0BC31A4E1301DDEE276A0.1018.2727808565.984",
        "This method is used to mount a volume to the file system.",
        "I_E1B0B84F789F8D4A723143E6CC1D687E2507C707531AE083C2E8886AFB9011D4.2725.3418306492.280",
        "CD_1D13F523791F1EB20EAEF6F153AF80EF4F13EE29DAAF24D54E908D208A687279.1677.1083281548.329",
        "C_6E829D6C833E13BD25C214813BBF6AF82F4C3B96923B74C3959F33364ED6E372",
        "ProcessorAcpiCstState",
        "CD_5997589696FB2E4597FC4CE1E1612FCF4F0EAE5655998B39A34DFA12CA0BE14A.2229.494115016.2361",
        "I_867009D1FACF80A1E2C919A8EEB83F6A5BB16EF95BACD064E526589732F91844.1148.4075638430.259",
        "C_AD28C82889667A5985FA157872F7F42C3CF0F9FD284883BEB8BA71DEFF026FBB",
        "CD_0A00EAAED5E9520571A49951AF6325C3BC14CED89AD4286E9ED8A3D18057C7FD.2485.3711833437.604",
        "CD_A845C3809E8DF42635819F5D4441FC804E08EFF7CF893C7B960B207ABE392F53.2203.1.86747",
        "CR_8C6DE64ADB30E76FDF169C4158D6C7A5755650401C9DC05B818D0256B4965C17",
        "CD_D91E00BCF74E046025FDC560EFE12C70AA84FF7526DB5DF32B504E8DE7F770F0.1069.678708111.774",
        "R_009060D2904B4B02AF55083DEF7BC672283599AF1BEDA6D3B9EC703CB3D5B011",
        "IL_C3DB5E4C947813DDCE1476AE37F36462D87A057537FC28E893FE938DCC5B0763.2709.718112191.305",
        "CR_AB1C96FED05D62166C94AAB8AE8E68ADBB7D202B0967CAE80232063AA6F41C6A",
        "IL_F082FF5D72F0BB8F007FB38BF6D4C8F99CB6767F9E3431A5F144F3CB796D7427.2710.898369090.286",
        "CD_4EC78046D8310B047EC675EFF57AF6CDF0CD910F39829D28C5747F5C66C2A633.2017.613743496.2403",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2088.613972127.368",
        "R_C84DD871FB7E9CB6D29DCC02EA27D46F8AC10106A4A5F7B1A7A789F07E15462D",
        "IL_FE9ADCFC2CE005FA3B3A503B5523DA4FB1B3B3C059E511711707C0F453085AB9.2689.3938004615.274",
        "0x00000200",
        "I_E20BA24A1A31380214941B26B83C29B8B31C11FAEB588752C8D490C56559FEDC.2723.1997747778.283",
        "CD_21F1E1F149DFC99965A781A396AF7873962AA365AB6A21C1E301F1804CC089AE.2384.3967364008.679",
        "CD_B9145D0C1524AF7987E25CC808ABE0754617F2DD4E8493B212B0FD0151445017.2531.784565838.619",
        "CD_1AB5CEA68F83455554B391B4DDCFE58CDFEE256A79562EE34B38ED037BA0EE30.1183.2909456627.324",
        "CD_9E927C42162CFFA3624D55690B21114853C375D15511354B30627B7E45D7DB02.2308.747130898.794",
        "C_8B9C64D6F0CAE8DF209DA22B283F97ABF536FD5C8E4A2B26F552B4E6C866C08D",
        "C_5E46683FD84F3219E379253BDA01FEC308C95988FDF4807D31199D70DC1E39D4",
        "CI_765084E1887D699089D5053E1B6F8275CB71A33668FD58E6595E74BE3D526F1D",
        "I_C58EB1CAF4873DABE5475DC2FF355A8A9CA893DB04895050BECF955E0E003FEC.1015.3359005028.296",
        "CD_D0463C61C5FB59AFB14652F5029984454DBCBB9EA71D7BD37E6D26E78285BA33.1.1218841027.355",
        "C_5BB891E2FE9829BEB02F7F2E784E8DD7DEE84D71695BCC32B51831C5C8733CB3",
        "CD_A3FF4B5E169562F5D12527C651F2FA9F17677983CAE812428672F30175B2773F.104.48671980.299",
        "CD_B18A79A265A485271ADF7583A11B74126B27D0421B9B453C88A99D39E80DF5B2.1080.569079958.314",
        "IL_65436052C3A80A93FEAE3ED18ACB04B9B787B61D1528496439774EB92FBF6C06.2677.676006112.281",
        "I_B74366DC34DF4EDB8A08FBFE86093EEDAA888FD62ED6727916BDDD945541B862.2704.386899033.290",
        "CD_8724BEA2FF9D9B28718AB2DA764FE15C27C309D192B8F3C70C0BADEEA7D258BF.2624.2350402897.351",
        "slowLink",
        "CD_3E93490AD7E19BA9FBA51E3DC8E6582CA6AAC992C61FC9D54D14390E9939C366.2385.1.13797",
        "CD_D9305F07E7EC33FE79ECC40BFB08CCBEAF8C31795EBDD080A54420FCDE7E017E.151.3977703067.453",
        "I_85C2EE1376D85A8ECCBF997AA5615DA98F17AE86C3C78EA36F84A52EB21D403E.2699.2463021101.281",
        "C_8A3B6432A229F674039F0136B188BB0F847AE08B53B1611977C2FC30461CBDDC",
        "C_FFED3214ADBDED8EDC1C230F9F76288FB7BCCC548BBB6399505DF304ECB3A518",
        "FriendlyName",
        "I_1A85A56487B65D86330AF5C1DD98D5192AB7D458D9B49B25E7DC4629A172E960.2676.2098333244.278",
        "hlptx",
        "KI_0454DDDA9AB999B5E05A2F468BA888F0D0794E6BA1EBDCCF2A4463EC03258CC6",
        "CD_7325C6D5F23D26543C59600AD0F4192BD8EBF069FEB8836805F79D1EC53CA66E.2665.897098411.470",
        "D8AF1424B994565A4F30353F70D9AAA5FA171745944447722281AE60C.2719.4053836459.280",
        "CD_495E98FF7835F373B8F5063729140C2EA897C9F6C524A8AA5A9DD4642E06C61B.2636.1466789261.952",
        "CR_6BC8B317F18D27286388A1D8A6DFBBAE21776749F856791E591914AAD69B0BCF",
        "CD_C78B62B9CA60B3385B0F5901FA6A93711909709FD41A546FE8FFDEA0D95A4D34.1780.3765701998.286",
        "C_272E5753DC3EECDD6057038DB6F26170E7D1CD565B954C6C4A406CB1BC2D023E",
        "CD_189326F4F721F3B084F2B9D28FCA49B5C1A7BD8ADE57D16572A5693E864389B6.1741.2010064619.514",
        "{5ec10354-a61a-11d0-8dd4-00c04fc3358c}",
        "CD_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD.0.882587623.197",
        "CD_C4F661973CD3C0A0D2984AF60EF23047396681C367251D4E47D1DDBCE0BCDFE6.2761.2008888939.2897",
        "CD_2A7649576C810E2039E9EE14A94AD920395C83CBA45A6BC9D33333590A724EDE.1583.3696258900.766",
        "CD_23661D69AF1192D73D2CA18E9EAE4F8747A8AD619CA09B24089CE9CBFB6DC7C2.278.525999577.422",
        "CR_DA8AC0D78FD1B90698550FC0FF5C609171143A2B0FA32F0B779BC5DC2D3441C8",
        "CD_5D0AEF52806F8763B3001E7A769C04ACE567BDBFC936A90209336B42E3069741.2620.3010851435.395",
        "CD_67CF5F3F28E7ABE836A4461A5D108F9C13EA619FEE56C694C0E215179A21B8BD.1576.3997774810.426",
        "IL_C347AC3B2A4F5A130A4DACB00A5BF0B20AB0E474443D2A3992BE252F54C9BFCA.2700.3039249663.268",
        "C_D55F423829DA78B95BAA2BAAAA5D6B94935135291CDBAE66CE6C5E9FBF8E4E77",
        "C_EE2A2542D3194678831FFACE37D0E463A8759EF436C4FDE7C6AEF2F4C0CB8A9F",
        "CD_33EE4C1AC07BE6512CF605AF711CBF96FBE10D768A03C147E56A6E6BCB8CD88D.1563.1612823520.517",
        "IL_A4024847100E6E0DB378BF6FF6D5F068F89EA10E15580AF3CCFD8C02632CC6C5.2736.2980596929.289",
        "R_6A28C9121AC74A9EB361B4BCCF85389D5F225385AD9FDFA10E6FCB506E2CAE2C",
        "IL_51C5ECC9391A52C9234FFF83EC435E9F3B07EA72829CDCC46218519D4A4947A9.1520.303744990.343",
        "C_EA4DF20054CBD87001EE67FE2E62392134ACBA7D580330C315985BC30E5F543E",
        "Servicing",
        "CD_D2A706123FEDDDB0E412FDF2001A3E316EB3BAC437EDAC79D66B7AE69CAEFF59.1950.676884718.363",
        "CD_72584B474A2F61A94CB1C4A7807C13A654D2F90C5DA8B57E02095EEE5B64E1DB.1936.4167766412.1011",
        "ExtensionEventSourceLink",
        "IR_833CF2FC625EF4866EF85E33162234CD5F7B9296EEE62518D56CB29586601709",
        "C_79DBC5D293E4FF409F7544F02B31B26B6155CC6162B0636F647BE9661B9D3F16",
        "IL_8DD6D1DE3815CCFD1C54F9C6C46C4858DB951E475313C281716A5D7F2B0D87CC.292.965239135.206",
        "IL_D09C3A6D674FEFD65CD0D0D64473712A664E77B7E6103663EB5B659F57FA6916.1164.3017632335.190",
        "CR_4F0D52044CEE6BA44A797C21E074FB5F72A44E740DF64604538AC24885525391",
        "IL_34F1A82C3B27A30102A63A0F1AB4E9F2DB6C7516B2513A65F0D546795DBD4DD0.2678.3839283995.278",
        "CD_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2.296.1483793053.566",
        "CD_D3A4E8FE161CC4A1F531817BBE934C433FF20A5861307C6E0D6D08DF319C7AF1.1922.1843454292.1043",
        "CD_BAF75302566D567EA01CB2EED45B5C1B4A6B65E2564A45EE8181990FD5703235.265.2823467237.465",
        "C_2BCE88A8A522AF0C8D0D879BA9706C3E8D9872FC3140E85FD61D2AA097159BDA",
        "CD_639FCCE3DE726C47FF30745340C22FCB819E5E4DFCA7546346272EDDA843022D.1166.3287461374.1069",
        "CD_60B2C39E9389EC16D58497FA8BDBAF35697A8853CDA423F037ECBE4502882230.270.1352396077.509",
        "CD_F4FEF988E7256B64289F1FEF1273A667F21EB83A5DB1731752AF9AC27A4871C8.1595.3580357121.495",
        "ROOT\\CIMV2\\ms_409",
        "C_4EB6D1B0651A9BCB05273D40A94D002733C3A80273FBEF6807ADDE10DBD5A05C",
        "RSOP_SOM.id=\"Local\",reason=1",
        "CR_D1EF7C1E0812A2A26C6327F2A3B7DD906B634F362ECF030C8FD523C6163A7423",
        "CR_5430A0963BDFE45F48448BEFE49162AB9A7F5390BEE895620AB94C03956A31E5",
        "CD_247C34A5C385163FA871F0A6990B7DDCCB192B62FD1FBD92448E50D5003DB294.1932.228067366.1784",
        "I_5089A252B68513295810B5C02EC2C4E8CBEFDFD9DA0B2D18D2C78BE706324484.2705.3628745793.297",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.3885814277.180",
        "CD_A3BB95ED0B202A25A7223B16F2A4B7FC5CE2975B203508279C7D21714713609A.19.3321036644.1749",
        "CD_0CEA2BFA85C402C6870520D8882306321579F18BD47E8E598ED675B423931597.1829.3422592884.451",
        "F492F1908A5C0DAEA147CA4130DA383C4929CE3B9A73DC35F",
        "C_EC0D9BE803395BC39DBCCA5405BADA8B14A82223193D36895536EB3BAC2EA6D7",
        "C_90BEFD5DB48494878DB04E68E99BC36C64E916ACEBE36216625D7CE508C8EF7E",
        "C_D1448E1E08523D621DD678836B336A7287BB557D1F1B5D247B55051BE70A76E6",
        "C_80F2A8BB68908972D2F32AF3261534B465EDA63A51C25EED6DC37566B11B9550",
        "This class supplies additional information about a data provider. Querying this class with an instance name returned from another class query will return additional information about the instance",
        "CD_155D9E7AE6D9F85361D5CC740FA1EFEDE91BCBF995E255746E05290A3497CB99.1800.1.16018",
        "4\\8xd<Ll@T",
        "C_6DEE17E27A5048051F81C43886E369D7F42F31B01A5FCD6AE03F4F5C668FA219",
        "CD_3088866DF50426CCC6D9D3B32AAD3B6CF7FC73EC115545308C15A220D5B5FA14.1192.1784710186.296",
        "IL_618BE348A47753A2409C56D8BA15B824FE864BAE4B7AEC8D5761691B87263426.1500.2729754227.275",
        "!T6$'H*-0Q3Bo",
        "CD_C3C6D8FB3474EE785958EA6FF4182273D2A6254E9DC15AB0F00C01432187E439.2423.764161776.362",
        "IL_302159DD437DF31C3447740E0D66617756BB40FBE840878868510D22B9CA0618.1195.840868639.263",
        "CD_5001D415C6B6A7F33344EC2166974BCA3ED1A6D95B9DFF048A69B10233E39F47.1205.3623000426.3790",
        "CD_089084A9F2C065B07097839183786A1564DECA9FE2E250A27CB3C47E8FE89ED6.2604.1241200472.334",
        "I_C18626E27D5153E5E65B72B574D4E2FD4416299A7B7135AC8C51438B7D94212E.1730.2534232684.258",
        "I_5E0E8E7803DB2F764A6104E2C32B45BDF47FECFD3784D2A5057716E1F61E849D.2710.3652694361.300",
        "CD_47CBD249A2C567357686E5ED6091D88133AC6ACBBE7BC216472A737EDFCF1867.2013.1748545377.641",
        "CR_FF3F8092D51DC6205402036D2FD6093424ECB5C60982335F342BEB529DB60880",
        "CD_C4045A14FE292F5DCE118CBE7A18E1997339F3CB7C3124B21C33A6E18EE0C114.2635.95625311.253",
        "CR_3088866DF50426CCC6D9D3B32AAD3B6CF7FC73EC115545308C15A220D5B5FA14",
        "C_DBAFD0363B932C012CC74B45C91F067589F90C7E922E99CF5A5FE27D21332F93",
        "I_06D6FB193493B2B3AB18566CA818BD25528D88E2A3D498D0E28DC2460169A56A.2485.3224131757.325",
        "CD_66374619E9C0979063D25924688BF0A633AF40A0F101EDE7778BD7EAEEF33E32.2546.705258058.720",
        "CD_0442F426186B770F6D9CA208711E127C2744CDB9E3F8C6CA1D92279D302D64EC.2656.3206015763.755",
        "I_206943529E73516C08F2559AB493655B6ACB01529144AFC5101166B2736BF0DF.2717.1074509884.284",
        "CD_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251.296.1183955356.2267",
        "IL_F6B894C3AD824357AFC6B0E4FF7C81C372E7CB3BF6163E862C6C14322291FA74.1014.2674490485.299",
        "SizeT",
        "WmiMonitorDigitalVideoInputParams",
        "IL_4E4B13D12C6888711CF5B7C4047A53AECE339CD6FBAA6BD0CD288CBBF91C3894.2682.2755604651.288",
        "R_62E24D2113A63A9168766C2091AEA6BB0D5DCD627F35EF3E18E56D8C5BDF10A1",
        "IL_399F43CD829D8014C714862D8902032390C068BF435F49666A7BE599A3401910.2707.4127460834.285",
        "C_955E009A78C91FAD360B439EA408CFF48F11DEE9AF7E212F013EAC8F62A69A82",
        "CD_7B578A2256D7105EDC7F31C853BECFD075DC8E0C980179EF401FA89F93C8C5F5.263.4115699845.336",
        "CD_9CD624FA4DF4296810E97A9B08FFF2EFB77A0D2A782F9FE4CFB022882BF35378.1607.121267748.427",
        "I_7EE99333FBD94B5D83ABC3479B07F4FF06B39DC76C5C6C8157BE0AB1185F4296.2721.2082884549.276",
        "IL_0838E195DF995C3567F7B9E54B2A6E8213E8784D0269832960FB0B161AADD820.2719.1643290395.272",
        "CD_2365A721345A40AF88F4EB253BCBBADA79A55446181A3DBD55DBB6ACAD9C7FD4.2639.1950920048.553",
        "CD_DEA3C51A2D748D7051B755F876B97982E816BE2DB267FB610562B715E38208B7.1353.791398148.275",
        "CD_62D705EEE1342BED8EAA270755244DE39EAF602D11698E63DBE2E645EB742AFE.148.3156382708.861",
        "IL_E45B01D5BC86C668EA1E3AEA6C308E1DB3C69FC7DF942BD06E83B7A46F7DAC24.2672.1086392761.276",
        "IL_DF76677839457195C9EC2EC31989DE8A15D17173C5ABFE21BC9367C1D44CDD0C.2723.2044538910.274",
        "CD_8D338BAABD5A4CDE9CD22C60F5FCC1F5326D81FC7BA6D48335E5E3513B7182CB.37.3632132477.256",
        "C_41C5F66D28A54B11831E9923AC9C75B6E565CD4B23788137E12DA876D6CFE78C",
        "C_EAB9370E6F0303E816A75B33B853238E66F81872D99E818B001BE572FCD0B89A",
        "CD_50C230A6FEF41E82BA39EF3EAD28922F6475A05DF1FCDFD5DBDDDA1F41B40ABD.1757.1088304769.1497",
        "CD_1DE9FB32A31608C0D926707ED4C676D8E34FABC2C5C4559D485897F5E366AF39.2601.4073324912.92",
        "CD_39D7EFFDA11AE4B0AF9356A4C33FF1047BBDB65DB33A2E97D55D112810C928E7.1190.2562165177.621",
        "CD_322EE3E951FDC35EF603CAF3E0A44755B09A37065828E8B8EC325A76AC0E8399.1730.1545215041.584",
        "C_1DB22C932495AA30067925EEDE764934B81E45E244C0C04ADCBD0150277FF930",
        "R_01938EB24A6B33B65014DBACDE3C7CA2C2E7C61637395768C92D80CCEFF91F8C",
        "C_1463900C5E85009C74D970DC08429284D480248969B543718E853FA68E152A48",
        "CD_95A9ADB2045BD99C8214F501BE25CE3247A7F55B6BF14CC069CB47314F289D9D.1757.3803421048.265",
        "IL_1557BA1FDFFF4AAC907A3F2DFF8116854D902BFA7E0D3C0840EAD2DB602129AB.2690.4025116298.274",
        "CD_18C99EAE3E173ED0B31AC919DF58868EF1E98C5CFA9C2E4C63224AF978397526.1580.3310892564.429",
        "CD_3E723A91647379E7E1D55A0DF4F361499D3E76B67681C256B269430F469E4FFE.2598.268463989.1215",
        "C_51F3F9CABF21479B5E00904A33BC282B6528414D4B4FFFAC999E337071761517",
        "CD_0085D9877CA4455C14CC08522BE2A35BD6BDD5C767F64875E5726A387A0D9FAD.1203.395343047.1218",
        "IL_05FA5A24B927560FAA308F2A4BF789BACE444CBC3F38799885A3E9AF7E5D0637.2717.2317096783.275",
        "I_C6E079375627804339117553446740B978F04A91C742C9238653EA9A47C3734D.2726.1232622594.274",
        "C_52950D1EFDC3DE67342E2438F8E07B6F40A248B4E32B21A3EBA8DB9797405C1B",
        "CR_C28A33C3EE15539FED60F709568673A3B8236EB3328C61F785107F8EA0BD78C2",
        "R_48BC67131BFD22F5DA28A903403A15608DD05C18742BBFEFD4FFEEC39F82B3B1",
        "CD_0B48320BC1A528B3C1FD27BF622CF9AB5E3E6560AA1B8D7B4BB227712F4B7CA3.2283.2614274260.714",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2087.4224475244.188",
        "C_049BB6B86464EB31BA1C68CF94C5AF1885FD1AC3516017A8738B6BC559DA272B",
        "IR_FCAFD02952E62CBB14F71D4B805D05241DFEE4F3755643B3119DA4E6AB7DBD41",
        "C_970DC7308218759AD490467E5E7DDEACBB9B35C9AF8457A911A09ACCC5B3AA93",
        "Use a Certificate to Sign the RDP Files",
        "C_5B3B46A0474CE5B901A724DB872ECFD6D25FD9AD2154C87989375CFB1A21DCFB",
        "IL_8493808F7005A147F054C4D110780BCFD9E3EC20F3312DB0FADE1B7AFAC3A8C3.2736.1266966154.274",
        "IL_2C3E0B2C69ECC1F533E094C6BC0D6FE2FF50B62467F6FB0D4116BA80049303DF.2505.1781271333.301",
        "CD_FDCCE3B8287A28E29DABA3413AA9105F2F7512D7329C1A17D887D616F6D5B8C1.1070.3466861383.736",
        "CD_FF9B90BE4979DE749F8B505502B345E073E79C3A6AE6091B78D5A7C395006660.2577.2783206385.1034",
        "CD_5B65E7078766FF07A6904B792E37F0CB98C934FE8F6E820DD0987C16E5C48B56.2568.4034721370.221",
        "CD_AC11DDCF9F71868BCCF23A662420DD51F76B4387A8230D6D41F7DBED8D2981ED.2271.1.13249",
        "CD_06E53B1FABE9E20DE66B403CD7C002DABD1DF053CCB4800AF7F6DF3343C6A73E.1598.2653476022.618",
        "I_B6D033477C6B8B5D60D031921790B770C7EF4153C0783CF661BC4BFF95C235B6.2715.1917873520.270",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1780.1602717935.368",
        "I_FD94C9E615EF769B20309C92B0C66BB91C4FD32496ED9205E31EF72709ED573F.2708.627267147.293",
        "I_F693A7033BB33D7405BFB98C5A3415923CC9F4EC8AC330AFF545CF21BB41905F.1751.3881507600.272",
        "IL_B0FD5A43E8238E668891E8BB0F653D919ADABDF291D5176C0429F475B48952B1.2686.1465248333.264",
        "C_BFCEF2D66584BF747A114A08DAF60453831A724BA6BD651F14D05255B74D1E37",
        "44574338B9E17B1FD19E593FD78",
        "I_B498B69E308CCD72907DFE63279C92042927888BB64E0D473D3C48463EEABEA9.1074.2136562927.301",
        "CD_20BDCD5FC76289684890138F1E0F84424ECAE89F8B991F35AE342CA8A7F45BC7.2113.1299760912.180",
        "CD_1B0301F62502D60F6575CB09308C7A3739069A23886569D046BCB5BF22A5D75E.2379.1083403841.5272",
        "CD_F6868834D76A72165B339E8DD1B562F6008752FFD847CBEC2C03A3131299BC42.1779.2990744261.278",
        "IL_4BD704EFD82E90D58D3C406978C7C044F013A64518E8C54785195D2358D9CFAE.1807.561115493.325",
        "CD_7857FC1888FD538485A47D972780448CD733BE76C6B908A47AD01147FD85AA69.2461.3271526141.630",
        "CD_8E41820F5D3747F37A9AFB4C6D31D95936F76250DC1731B0B518951FA4D1C211.1360.1.11982",
        "I_3985A64DD548C159337A855FB2D96B222C50720949C8FDEAE049F7ADFD2826A5.1784.1476947504.329",
        "The current minute (0-59)",
        "R_D06B3F1802B79F2B6A9EFCAB81EC72ACEFE151A62CB6B68EFB702290BD7BA485.2466.1703999170.558",
        "WMI_TAPE_MEDIA_PARAMETERS",
        ",0<xd ",
        "DECNT",
        "I_A47CF01093F5B762B2CFDD0B42F06E7675B568A2001A437DE365190DA8EA1F5D.2701.4149328767.273",
        "IL_E4AE919B2D3A18F0D32F2175979961E4C7AE3C8AAF12DA639885E223AF584E97.2691.3642583955.270",
        "R_7919703C0E1636112B92BAE65990693AAE58CB0547C94A29F816770693C6D72E.1292.2311638966.524",
        "I_8BF49677C4E4143B2BB256C6F253414E9CFC4061F2706AEB8C8E966D04CCB2F1.2684.3250922380.290",
        "I_ECBB5DCFAEF649E7871AAF278B7C454993F7F9BC3F459995E3BDF5CAAC6E9EC5.2699.2052189125.278",
        "C_4504210513F67AAF0E0DA4CD3DF8D84725B21CB68C87194D9A008B88A53ACC71",
        "The current matching year (4 digits)",
        "C_C5695436582346972D28A3A00D6B225B8193B828EFE5B198E49A8EAC5B05CE91",
        "Indicates whether the property Disabled is configured by Server (0),Group Policy (1), Default (2) ",
        "CD_E033D3ABC25C8BF24BC1E395815C5B2733193623692C6C6E0A75F0544F970EA4.1350.3043797268.513",
        "C_7EB5BFFAD139FAB3A00B44612A64C007723F66DEF2B850A4322740021A1EBE89",
        "IL_8B1547E29C4669664E5C74CF6C63C0DCB167707EDB55532CBAA32AF8A1CDDE88.291.1379513984.373",
        "CD_4A8C48B101586E49CF7BB2FBB8C8F9CE4C850648CB5DF606B94CD22AE6B1E328.1065.1151925295.782",
        "CD_07C552EB8842D691C4A22716140805262ED277A06CAB4124C417993F14E689CF.2463.1.12456",
        "subEntries",
        "6ED61A7CB8E343ED.2661.3814995438.699",
        "C_8E0600AB901E2A841EAD9A6A75312301196DE7B868F4D3249E5BE0E21E42EBB5",
        "CR_D6EC41525ABC21864A19F0FDAF8BF6677886C4CAC1281F55DE47919C07EC9C67",
        "C_10BA8F34398164EB825D029D658F9DC9D3E8CF0E22F699C41582D155EB085087",
        "IL_DBBF1914C3D5EF61F0682E5742955C073BFDAADD9D0F3803FBFCD93C9869E589.2694.4029654866.262",
        "CD_A17354395E79A088E63A18457CAA51A441A886387058324A6BE95873BE2C4E38.1078.3254713780.313",
        "(,048<@DHLPTX",
        "CD_39E75790979650C120BE778856591D7E59D2F85DDFBB3BFF1733B73153D5DC01.140.3319147503.698",
        "CD_1463900C5E85009C74D970DC08429284D480248969B543718E853FA68E152A48.2442.4289663217.267",
        "CD_048677B41FA69AF76F1CB4289718568B698E2DCC291B7279BB518C1233867D46.1341.113449723.946",
        "CD_745B48F3D3663775E674F1AC382685A30C5D61F06F3C74BC6E2C4180489D568F.260.4229136136.235",
        "CD_BFBD12F134C7DB901B18D849B849ED12FCC6F3E36BEB84C9B828E11FC2FB6D7C.312.658714645.350",
        "CD_64BFF80BB1E6E3B33E8CEA6C6D45DECFDC685BFA89D8A317B5D3C5C82668E6FB.2730.1971912579.394",
        "IL_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251.295.2733276401.333",
        "I_9409424F123243DFEE034A650B5F1B88CC5A0A68CEA71FA74FE30ED6706A7CE3.2717.3347280366.286",
        "CD_B28289D1B5763AD76E9600ED77D5A2567F24D84C53AB89BDDD8D8E52A4812973.2564.2372636727.3389",
        "R_BB96A81844E17AF34515D51E193BE6DFC96069B2015B91724722C5DA336F7C07.1076.4088975471.518",
        "CD_F071A22EE25478DF80A205153198A6FC12F84A9E6BFE53B8E5DFD1E7E2ED2B8E.2762.2256492471.404",
        "CD_1264B24DE1BE75E3F3EC343E410405743BED271CC6F6A49DF7ED18F73A72F2ED.2641.4165235208.1800",
        "C_05D916B8A6374C4F193D5E08BCB54B1C2461B412F69F755D01428DA36005F49B",
        "I_8A5316EB1BF9CB1B232B12A3128C065F838B4C59AC9656AFA33AAF95E93A4787.2717.1785394700.283",
        "IL_8C89D9CEC189566E141E85A927C3DA0B298794808D1847A9E9D4884B89EDB55E.2689.2934701902.281",
        "C_656CBCD78DC3BDBCFB58D6DE3DB4D810E2F34DFAE48DDA4A1B5D5CE93FB860E1",
        "CR_F9D4723921ADF841BA7CC65756244CF775FD9B7C648EEDAFF1E2DDD459957AE2",
        "CD_45999BE1E716B224CDC60BBAEC2E4A9422A7548870411AB5310F9D9DCF7A8F92.113.3771736997.1224",
        "CD_64F3934C77CBCF89E84DA868459634281E17E5BCF13A323142A343FF887F35B5.32.1420269072.486",
        "CD_6DECEA152EB68C3B8F3895F0BFE2B8D722298B02602F918D61267E0DFA61213B.7.3789139454.1426",
        "CD_8F541140BC904A73C4879061E4B77E208E8BE6E91CFF96ED3F577FBC75D59D12.2730.491684606.583",
        "CR_C37D9971D6153A3A2ED7382F649D1D9C05125BC9AFF86A5588FB70F9C87A751C",
        "C_1E81C3B7838F4D33A0DBCA06EFC99B61816E8507E0CB2D2FE7B2D8431699B9E0",
        "CD_0748DB3A279743A043A27A29652B890BE80A51E24D8B834C6C112DDE493793F3.2585.2308823639.611",
        "CD_455876B64E565F4962FC035AF2C8087D1797E42AAA9586F45C5A3E20F37175C3.291.705755656.598",
        "R_259E31225D2B6C63D298F728016E396EDE675F06074A5C200D122EC80C87B83D.1783.573792895.540",
        "CD_416849D23E50D51AF922BCE109C1035E8C25EFABBB264CE6D309BE7E40EF85CD.2512.3285082111.813",
        "I_6862AA7F28A1DA0045CFB4B4304FA3B74BF325E14536AFE24A3A6599D85385A7.2712.4137474706.274",
        "C_6762A6236B4D2CB4C3C4CAFCF2156B752A35D34287DC36F6247727EF542AA084",
        "CD_C8C4D941E3D754218CD879478817458E5800188A44CBBE5B0BBF1CFE323B08C1.2731.2174096501.454",
        "CD_B7BCFF3BD4E96F7233C3DB7B6D678F32D754777FD131B4A0A3799E101E4F57D0.1153.1551546205.923",
        "CD_EC97D00816B4530E92B0346A6B6B453699A71F2B879F99F794A6FF9189BD53FF.76.3986834222.502",
        "IL_0B880713D9DDD00F98918C43E596B37E54E0FCC69C63C301BFAD6A21567EB1D1.2763.3041098564.311",
        "IL_8EE1599FF8FC85A746344F0326B3C05ADF3156BD2ADF38D44A17BAF8DE774923.2723.1395661552.276",
        "I_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.2532338682.338",
        "\\hLPXHT`",
        "IL_FC6502D50E95D4180E3FB04EECD433EB33D3321E9B8AB75257B601EC998FA3E2.1016.2858455450.307",
        "R_597D151DB991C7E12F8334FF42966FD0AE0C0626270E7DE6F6AB8FD3ECEB0687.1500.1807282480.584",
        "C_C42B40D18695E044F98E85080DC73D0D2D750952C365600DBAFFF12874C6651C",
        "IL_4CD34998191B7D33C77F03D776D618320C603FD3921842E1B0BD47475C056851.999.1.51109",
        "CD_DF379D8F76A55619B723A06EB9700DDD2DAB1DA5884458BF3B892BC18330CC62.282.3590683821.462",
        "CR_88057F4853FAFFBCAA324F022CBE7B7579DAEAEA64628A39AFC4B91F61CE7752",
        "Specify the day of the week to run a scheduled scan.",
        "CIM_RecordLog",
        "IR_45569AA056ADC9524DBBD290145103D4DAFF08E0CDB98D574F6E8F827058279E",
        "CD_31380B1CBE2DE48F4953061E943634793359C618E73F753682430004D4E36FB0.2309.2504342368.248",
        "C_9A79CFFC989C9C99D981C62F583AD3436C0315D149ACB31253CF2C9B6F8A1D52",
        "C_ED39D4C9AFDF516666EC000B45EC192C36CBDFF6D22BC55C21F14EE49F68B755",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2736.2113456816.348",
        "R_207498871E200FE19B80A37FD57A8B20D82116AF990DF407F103C68BE65C497F.2508.1567139531.536",
        "CD_5B55CC60E350D260A8F85A1D6D077A9EC7EC36F61E7CF7459841A5E66A160FAF.2425.3181654666.357",
        "IL_07C0F1F3C37EBF65E6F83EFB70F6AD730277C54ED63555AFCBE9AEC0BA5C2057.1017.3719469808.329",
        "CR_E4FC7CCBE036059F139218E837508435F1EEA217B72843BBC84B1DD56DF78DB9",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.1809.3642330189.3773",
        "C_4C5AFD1736EE75F7E2D418D0A789735634156C5EFC9350C3086D52271573E8C4",
        "CD_F8950447585CD6743131FC688F3AC5EE4D2DE57B4CA01C83E91AB8FD7ED70E93.2224.3925991394.369",
        "I_7073556028E92CD2F0726CA88D5184752BD93537DDDCC28701C9302D24B13171.2716.1603367613.282",
        "C_0DFC323CB20829C5E894EB23D45A1551C36C2D6CBC549C00B9D8952023FE2DC0",
        "IL_6EC515021E47E1C6933695387E9D1F29129F6BAB7D2893E254DF8EA2208F30B6.2764.1905775655.283",
        "CR_B25DA333436380B14065F5CAF15967BBB759113E2ED71069E1E95253766795D5",
        "IL_76EE988FFB3620C1454517ACB416C23DC74264F3DAF163C2045A6A0579E07810.2676.524249005.279",
        "CD_B429188FA54704573DAD15C5B0E5FF08520FADF30A37A2EE248A1753BAE26638.1603.1964097421.1613",
        "C_74BDAD13EFC25BDDDA03231B2D3B39ABD8B91202277E5C78F927E74B85FE75B7",
        "C_67EC6840BA73EF4637AE84EDE8859A76BD68C94CAE4BC02D6EA498581967CBB0",
        "Hrx~0]",
        "C_66B4AAE372CBC10B0496696F6E3E5C00A5D9FE6B85AA03A0FC19CA05435472B7",
        "I_FB52F61C39953FAEA0ACCA4932E2590E915B262C69C4DA601E92505938BCA778.2677.692521110.272",
        "I_E3C662E70B54DE090495B5AB6B06A3C347DF1A4C721F2DCB6E173C9CA1591DAB.2699.2147945317.266",
        "CD_EF6F51F7BFDE90F62A4189D6AF41831500374FCB981FB80A207B392E1EDF6997.1631.2511058569.849",
        "CD_75A8E9BDDDA51B5D1D891C00799220E5C1C3A6CF1F951600FBF99252804E2F0C.2759.3246240485.365",
        "IL_B4BE796E49BD940EF3233AA1E20E02F74C49D58803EFB7DC7A8BF19657D6854C.291.4294172468.274",
        "C_C8C4D941E3D754218CD879478817458E5800188A44CBBE5B0BBF1CFE323B08C1",
        "C_0BFBBC27194F31119DF7EC9CDE40B8D9322865505281E1329BDA61CD53B1D995",
        "CD_F8A40DE76638BC2D6B465FB946B5587EB32CE4928E4F71A985E7A4A1C7848063.1082.1981631436.297",
        "R_9E75389C0792124C1DF0E93856EFBE7DD2DBB60D509A695E77FDE0138B272CC3.1198.1479017878.516",
        "C_61F33C9DE75CB13B4A6469AE01D1FD6BD56B098ED457BDC27158A62BBACE11D9",
        "I_E303FFAE6F81C647089D83B9136B2447FE6B9BCA2CFE24CC936B4992876D8F67.2042.3749529865.254",
        "CD_6FFBA8B5854E9C5C5C698A9277971D04E447B67166A26CB7D9DD0D9F278C2D8B.13.1308828709.944",
        "Command Line Arguments required for this application",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.1153235212.368",
        "C_59A8BCB9F6971B321C776BA9F2959B669CA7F5AE7D9DBEF59E2C6406BCC884D3",
        "I_1021E42F9A3BCB8DFB967F0F8A2041A7E229AA6B902C8FDF48E58953EF28CB39.2729.1815682319.254",
        "C_625E0E6F9E97B18101F4421497CBBF7C66AA039108DBE32EEB6D23DC718983BA",
        "I_28ED281B94DD458CF13AE557A2E074E5845B460E71ADC792A8CE8BDE8E5F1A21.2714.2724209430.274",
        "IL_10B389476894FB316640638E08A9C99AA36EB29A3A9801B1C82481AD256F36B8.2723.172693944.288",
        "C_0EF25E0655446505590EC36F9A653AEDF70F0B9D192667BF1343EE94F4B529F2",
        "C_34865E78DCFE7264A2E20E5113D9C23EC99F3A36B7F917B96D67DE0651659EA5",
        "IL_E00AA51439CFEF2CB1C8968598F9EDCB88E110D118FD610991FA2919E478D23F.2503.593264483.265",
        "I_407A036207054EA2DC280B8D7D438EE813AFB85B25BE52B374C7564A1D003604.2721.177209809.271",
        "C_28D3480019EDB8568B100B133C2E45279CD6E1AD49C4AEEDB510EEF8207E9610",
        "MDM_WindowsAdvancedThreatProtection_Configuration01",
        "CI_C42B40D18695E044F98E85080DC73D0D2D750952C365600DBAFFF12874C6651C",
        " $(,048<@DHLPTX\\`dhlptx",
        "CD_F1347BA1CA828B62CD4725A7646B494D45700B0D8C277BE92E43FB714FB5C9D4.2572.4139047074.1412",
        "IL_D561A989983561316EA3A55A87DAD22914BB56B565B33FF158F19E157541DF20.2721.1520236733.279",
        "IL_E14960055650ADAC2C06C29022467C3EF58831F50C9AFF42B1D1C7B072FAC7F1.668.1.53493",
        "R_DA290273C5C5246EBD4AD92A0C51323EC9F3405D662C9D949CD09183391AA1F8.1164.1513370804.530",
        "IL_1ADA3D3FE41167FEE211ECFBA441482721793EC4D7E84AD78DA64C64BF16A920.1534.3393465649.187",
        "C_EAE5B1C89A2290F48FE46A2FB023BC9468786275F5D6D2BA670FAAA8F37D0170",
        "R_03E318994DE320A2B2B6A80EC1700D149A451607E607421E61E8F027E9429B85",
        "C_BEEEB6B78BFA29F6F9A10B9A1DE6F2C01EFC08D1BB19CFC65419A1BB0BC83594",
        "CD_F3ED82F33431603D84B59AD5C9C4CA59DF4FDC6F04E98BD4826D692A26D5A5C0.255.1250064816.983",
        "CD_4C388CE7AE5DC6521AA42C4856C6B40FD20A765CE0A1AB00E36A2A499F181279.1734.64657427.656",
        "CD_2D613B3FE870BA3F1517153C24257C4A37BDB33C8933EEF948458580B93ED05B.2576.3351815197.927",
        "C_9FED1DA51C946600828B6C18A833913DCDB8512EEBB3BDC85A5C30FB5675A9AB",
        "policySetting",
        "CD_72B9EBDA753C736D01652E3A64B55ABADDF5DF6176D787338F799F912E7173EB.2552.1355988547.1374",
        "66356D5387ABFF2B.2662.3768361459.1004",
        "I_9A1B596721539D9615A6900B0F6364E9823374D126BDDBDF36FABAC428F02B9B.560.1.66330",
        "CR_ADE497F7ADB52466B3BE933E20B36A79941262ED3793380A63DDC578ACBA1413",
        "Service (6) puts the job into a vendor-specific service state. It might be possible to restart the job.",
        "CD_DFCE5B8EEFC1AF231A170E8413130AF6AA4A71FD22AC6E352C7DBF46462589FC.2242.1.10170",
        "CD_28DAF7E88E6FDBAA130469111BCF0046D7AA8CFBDF0A7839B0A4F7215AD3B619.2066.3023075295.1166",
        "CD_600A73C35ED5D3466F7E30F1C2489F076B5641F666F273A9F923A32E11B6B851.2122.1.99332",
        "C_D4A97CD760E9DC657E08D29140B18BCC6B8D0D59DB6745F4739A4443DFD0F72F",
        "C_EEA03BCBA3B96A242B9DF0CF75DAE7464E37C83E292EC97AF81E8D15CE5623E3",
        "CD_0ED8829CD55CB10045BE12FF28DC63BFD30CC65BF9376DAA6A5D15ADE3CAC700.158.4236348900.192",
        "Signal",
        "-Tuesday",
        "C_A042D558C8D8C5910DD5298BC5D29889BA5CEA0D1A22A1BD4A1EF145F3C99D41",
        "C_3E5BFB8894CF4160E98325D2EB8EBC4A2FB4A38C35600D811CAF7E871FB488EB",
        "IL_756ABC64F7087CDDE280E01A5A1F8FD6563EAF29B113CC49FD1D77475F8FCD85.2692.492949963.267",
        "CD_B0F597559529D7C32A6DA0B8B453B541A0761153CE325066DB6B3B967B993FD6.122.365843188.581",
        "In Test",
        "IL_BBFCCB444CF66AA09AE6F15967A6865175BB0ED216D19970A7988B72CDF0A3A4.295.1443689286.342",
        "I_06EB11CA476EB54DA99CC756F9E21054F41FDDA8614931EDBCAC5316883D1EE2.2718.299715860.280",
        "C_CC6778A70C199F671CD04BFF86EE613A1E47C11B60BA19CC09AC555F9BA03FEF",
        "C_8857FE2BCA804CFF26B6264F7992ABC147EA66CE1D853542F2AFDD24CFD1C407",
        "IL_C04E6BD499E200B605C3A18D3E56CCDCAD619A76E28AD7C4A7FF92738734D7ED.2708.1092781133.298",
        "CD_F0D12046665BD58D783629F2811EEDBBDDE5A3CBE61CDD42A2203D1BFC5DD00A.2641.1478819613.771",
        "I_58F8973372F3501A9EC11539D15E25FC4FCFC2D0AB8D64BD3D0FD5BE87B740C6.42.56100039.269",
        "IL_317D1F2687177AFA27CB8EA6F6A360902286E215810936DE250861D000157F69.2460.1550424754.287",
        "I_23B629B288A83FCC0F15BE515DE39061DD36D91D61904EFB9FB59278732E2FE5.2703.2905731873.290",
        "C_144D4C797025D5F745BEEBFD67F23C11AD0A3E44B8F25CC1AE6529A8725D0FDE",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.147.668787003.368",
        "R_717B9447F64FF1DDD9BE96845CFF451CD699E26415487F373586ABC0F3E7F533",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2503.1363774787.368",
        "IL_C703850D8088BC7E92C8B76F33736593E8B0F068BF10C40F90FA96B3B8BC304B.2698.3640958228.269",
        "I_59D0AEE642D9709B39F50D5304D4D67486F582F790451EA1C7FE83A67D66195C.1097.2986375514.197",
        "CD_B706BC14333E9F557E01BE09BE8FFA1FC0DEE90584F33ADE84BE299A35433F7C.1130.3630253340.1232",
        "CD_F22CAC1390F7E25096EEDDC9A22578C183AAC4BC2920068C5646D2049B964F6C.2568.384853289.221",
        "C_D2ACF3A15366C591C175442AA1C3A391925DA701286688C53A9845211C124C25",
        "I_87B615951C5EF4740194260A227C2AAC18D53D4033D34D4C81C4809F73346DA3.1014.1059189660.291",
        "IL_37CB291E96206B811B242E1B2E99A15E443B14749AA28D9EF51C66CFB85086A0.1608.992405960.282",
        "C_3653C174656650D4A02A47BA68627F0FB4B224B6A036E2091CB484BE8F8933BE",
        "C_377FD1BAFBD775CA7636A24292F42121EFAE15173C984BF06800276388A542F8",
        "CD_7C47B73E5E9A5506254AEC98C6F5B5C4749A5453EF79AF4AD8EFFB7A16B6EBFE.1055.1535204711.822",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1131.784967978.368",
        "C_57AEB8EB3ACEEDCB27355600EEB6AD6765F2FC2B92CF0E0C11051BD1E8F4D1D2",
        "IL_92BAE843B96C58CEB795EC53CA0AB680149C4C2ECA5B0702E2A72C3100799E3C.2710.1022496498.284",
        "CD_72B01590ACC4500D6C998802BAE78A511F68CE1F2E189F92A27741ABED85403B.2572.838856899.1412",
        "I_46ACA7AC3CBC0F3ED7820D11DE0C916B1AC1A76D2292CABFF82D395CEAF02DF0.2736.2470088108.283",
        "I_F82211380E0CCF1066DD987F62514447882809387880AC1E17BCD7E30E48DC8B.2719.3443638465.283",
        "C_7D26F1E16BC9CE86FDDDA09E425A859A3BF87CD94B9004A4B2B575CD1EF41374",
        "IL_F4D8FF98B431C9DE08E30EA0A5DA0DAF034B776838F75E67F5013FB3EFE9B591.2759.2612101772.283",
        "CD_4D801D24EB7B11E677EAD4F9CF2C38B141666B7557B0420D554E864D72C8EE9E.2109.3516040784.3397",
        "CR_6DECEA152EB68C3B8F3895F0BFE2B8D722298B02602F918D61267E0DFA61213B",
        "C_87704A8EA0D222E3FBFFC1A8755A4B520E874A42E0CCEE43262F1D7B8EA4C38A",
        "IR_83845EF2309B741720FF4657440410FD82D34CBF99EA931930FB6ACC3DA7DA92",
        "CD_832531694CC32AEF12EEFA0D2DDA8BF782C32F932BED169759F268D0FEAF39B8.2033.2519391083.203",
        "C_F7420DA6533A2C562AF06F1F87B007C0FB6BFFD5F71653722CBFC32EEC340ED0",
        "IL_234E3B55C32D3CB84A4434C593B607E653755C64849684A95C97E70DC7E9A19E.2682.683545558.283",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2088.499941908.188",
        "IL_21E85A20CC15E835CB6487F54DC9B230DDD677D1A3F958EEE3ACBA0DE0846B34.1499.2500204981.288",
        "C_1F3197D7C6521D74E6D1E769091B4B54E59448DC4E720E9578B42FD15142C60A",
        "DMWmiBridgeProv",
        "C_C527CB85E112E06185369842FEF25648DB16EA606F53278BEF7B670AE4C92B6F",
        "8<@DHLP",
        "WmiMonitorColorXYZinCIE",
        "$(,16:",
        "C_FD01511EE67712BF18E22D5987177172AC0FC136DA3801B80EDFACBDC4A53CCF",
        "Uninitialized",
        "CD_D1F35069AB830308A3D10C95EC411D258E0A9CAA2EE0311B34E2874304803008.2762.1611313187.332",
        "NS_FFCDDDB138CCE842C0BBD0D2866863A23437EAE09282C04519C244557B1817C4",
        "CD_EAE5B1C89A2290F48FE46A2FB023BC9468786275F5D6D2BA670FAAA8F37D0170.2593.4005487553.710",
        "IL_0B5AC83FB2725D33B41CFF3B51EF33467B960FD4E7B54F055ED580C64C086270.100.119368880.244",
        "CD_E091E6755173CEDA0C35AF424854DECB26CF90627B78F06DB8E87E6ED8C5E2E3.2379.3586133747.509",
        "CR_40A24DF0170D3D162FDD7C849B2D46C54DA402D695FB97CA12BAADDBC62C83AA",
        "R_7F0C45BECF0AE38ABEC381EFAA7EA36E4140C97C5F097E86E0524E666D767CEA.1480.1515072698.562",
        "ref:RSOP_IEConnectionSettings",
        "I_7CC396005702488E62877B16F092BE8F892E05DC6CBF2A11E46ED5643F6FE16E.2713.3776123079.284",
        "I_67EEB4216546A0AC61A61CEE75D726E089D1B95D7BCBF112553DC52FEF639C59.2704.4022689501.283",
        "Profiles",
        "CR_E79E473D9AFE640F2D96DB2EAF3BE608705DB3CD9E43BB21D75E95C836D378B4",
        "CD_DF597A1A2BAD4809466E7A636A80CAB8A01D7F4907CEA5AC6B1078FB23BB559B.1609.3466538633.550",
        "l\\Txtp",
        "926707ED4C676D8E34FABC2C5C4559D485897F5E366AF39.2601.4073324912.92",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1758.2637058705.368",
        "IL_F7A16C27DB2C18FB3C22599C6F665CF9B9A16181556B584740B482C60B55F16E.2692.3001110296.283",
        "sint64",
        "CR_E00F912E9047D1A2BF3DA9E198CE534F57C5B76F41F1AAB4887EE2C73627DAB0",
        "IL_4775AAAEAE639C0B6E3968AB9A4757BCCBC9B6A2FC6E0D4E812C06B53296D420.2686.930273639.280",
        "CD_18D8719A943B4599747ADA74EA7D32C69D833172BB0F49178849B0570759A4F9.18.4106385290.1156",
        "KI_83FE6007ACA7CBFCFFECDEAF04CC25BAB1807917E74F65A7A46C4B6A4B61A057",
        "C_D1B2F4E6056A69A2D8AF80AAE4B443CB0029F3E62BFF8D77A98B6230DF9AE6C1",
        "   </xsd:schema>",
        "Rhapsody",
        "C_C1EDB2C3B16B75C05D994CBAD887CFED943CA4B2E1180F3891F60984B8988B63",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2088.2805259893.368",
        "I_0B2F54DC248571B756F7BF8B112CC00CF7EC2CD6588E2E36744B13AA0012BCBD.2706.982681186.285",
        "CD_95574E023341EB22A2734582FCFDC91CD48EEDDE11C3AC240BD47438848D5ECC.2655.158384898.485",
        "RemotePort",
        "C_DEAAA05DB0E75460BE1047C5B84914B1289AD29D36D5088DA38B7120128DD367",
        "CD_566A3F0A3752D08CE0ADC81B0285E070B30778837B6AE3D337DCE7469AD2C7FD.286.2896607351.918",
        "C_4F0DC2D766DE63D22C2118312C7C8A4306FD995CC443322263FCAFC5C5AE9AB8",
        "I_F39BE2F2CC7551BDE90E624B5C7301C158A68D618B887A135B21C9CB3CEFD863.1054.3215474501.309",
        "IL_61F2AD851C54E6137B3949DCDABE99F61429DB318AA9014CAA2219DA82996B87.2715.2046477307.275",
        "|p`XP\\H<",
        "CR_040EEFB9D32ACFDF35093E1B9FBC87E0DA3C6102445122A04A158078F02AF3C6",
        "CD_EE2A2542D3194678831FFACE37D0E463A8759EF436C4FDE7C6AEF2F4C0CB8A9F.2613.1768623437.429",
        "I_BFAF292FDF3BB4699612E434CFDB6011697001AA1134E7A67145F6C39967B2F5.2715.2452640255.284",
        "CD_C763B99C7B231A1A6362C713E9C23D51C754DB9ED2FE58B76CDAA4A80DBB18B6.1601.2977699657.1771",
        "CD_B25FE038DDDD2F923EF8124D01B661F160859D6C423BA1EAA2E76E8F1675384A.1248.1892493768.1050",
        "CD_08763D9228F09400573FC24C5D922DB07FAC1451AF56200F470342585B439D39.2733.1788422531.1261",
        "NS_3FBDCB08ECD33FBEF028D2DB3EF058F8CE959779B943F43AB3DB3EC34ACA147D",
        "CR_E483DF7E28B72B64DDC8E69D7B9D7A194DAA49C1FD6E07E079F14E12C3A828EF",
        "C_94B70633FE66960EDC7B9B01078D8EECCDA0CE9932A491D21AA838CFC540C35F",
        "C_5850C60178A95C175FAC0560CCB4DD2BC76EA8C9D5B62CA39830121A8C9D5762",
        "CD_56F6B3313FFBD38DB1C8A8E4828BD06527B91197C251B3D5F347326EDF37C1E3.1057.2555596864.785",
        "CD_0C89E3FE1CDFD790CBD5FEE0B9AE5F8AE27F38181A372EB2194AFCBADEB37DA8.214.2684592090.1313",
        "CD_DA60DE4570557569315706E8539F2BA1D42DB73DA9542D7DBEAA586346CFF0D8.34.628973768.510",
        "I_4EC0CF94B55D67AC58ADF54403ADDC6DAE3BBA72E5931DD481E10557259093CD.2691.1875675021.270",
        "IL_322791199C7A082A19DC7222A0E9FEC1463B2B6ED4DE631DE0684C7D1C689AFB.2719.436465182.277",
        "IL_BC000CFE04C2A23B745105FB1571CA3D890D9580D1AA6746224E398C7587FD84.1976.1227997592.261",
        "Reserved2",
        "CD_35002FCC142049858649CB1BCD62043BE23AE98B3CC34288C266F1C2B8C4A3A3.131.673584727.807",
        "DeletedOffline",
        "TargetOperatingSystem",
        "CD_2F0634D04E52DD449D6BEF9EE9BFD39904ACD67C5891849A29277B7E6AC73EB4.2669.3533231554.426",
        "I_A72F99F3E917EC1BCB2B80582BB8C785D4D2EDA5B62DC19DF7E3D8BC216208B3.2690.1302112498.261",
        "B9B1E966CA8396563.2727.2243417145.284",
        "CR_12A251E4688047981D607B15F79436DB837E075ADA0B6AC78025F676ADBF2AD7",
        "I_5AAC9CF551F1189618983DDB66187DA5670A80864209911CA30E6690E675C330.2639.2511674085.276",
        "CD_75B21F448BC6FF62B3ED2CD311F63E496645D7FB9BF098798AFD0623A4CD84C1.2375.4129338610.1760",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1606.3584255166.312",
        "CD_9B47552D4116308DF54B1B8BABEB3824E2EAF0C2CFA9CF24D51A58C19C8849E8.2437.2180387242.2639",
        "object:AcpiControlStatus",
        "CD_E73791EBD8A2A4E4F92906978CDB7151C51B74DF4CCCD1257A0E79377B27F049.2621.103744519.1817",
        "I_9152F0887551FEEA5C649C88B4272A238FA101CC1F6E131824694DCFCE0EAA8F.2688.2972253913.274",
        "TandemNSK",
        "I_1E28BD5B5EC9698EF3EF715EFDD1FE4C5EF5FE3E26E02CD0A9EE265CC7C2D50D.2725.1420763722.293",
        "MediaWriteProtected",
        "leShare",
        "I_61642E797CBA7FD308765D422A26458A770AD0BC77553C0534CCCD9FCA1BD187.2417.2773304796.246",
        "Directed",
        "RSOP_PolmkrFolderOptionSetting",
        "R_9212E0D756DE59946D687462B752A6AF5A16EC3A329D47D13E039D19732A1344",
        "C_CF5E27B8D911095CD7FEC61CA4431ABFEE0B23C5631E7FF85508BFA2D107C4E0",
        "CR_C4D20EBDDE2AEA19F49E976724D1B5EF2ADE459383EA4FEFD237CCE02FF2D7AF",
        "C_95FB3FABFA971E67BBC725545D4CD1F75233F0599BB8B29A944361BD82FEDE56",
        "CD_9C46A759D30423AAF4F69D77D418152E94C7E20506D0B665994363777B2CCBC6.1828.3324881164.2235",
        "CR_6BE2C209EB4B57270A7D84E582DD2AE1DD184D26B11A84A10BF69A2E4B28421F",
        "I_07A418411914F2D221BFADD7617A282083154373B42BD48DCA9C0A95AA3F2E8C.2686.251441978.272",
        "CD_3E05AD9B0EF48B56D8E66F97FDA74729A6BBB63CA86F70BDA1C963141ABAE854.1546.4118112780.7023",
        "I_5196BF4BB193F5FD32B65F33245729BAACD84D68DE23317722BE58D06EBE86BD.2719.288418102.280",
        "I_EF7C691A31BC411EA8C4487B4FEAB2B287B462EFB21257431F0C9E82A58ACA34.2695.2527911997.278",
        "IL_F4F9EA28A64973336AEAD4A8792C142319343CECF6795004E4B58475244E2DE1.2680.1043981989.288",
        "SystemName",
        "I_51C5ECC9391A52C9234FFF83EC435E9F3B07EA72829CDCC46218519D4A4947A9.1520.303744990.343",
        "CD_353ED06D06D3F543C1F82745622C061EF12A64D07607F4A41BBE9C01357C9257.7.642428225.824",
        "CD_05A2F7DA01784E24AEC74AE25AC1E45FCCF48AC863629F5475D0E862F884FF9F.2574.3414228296.710",
        "I_8849EFC452EA2D0F6C3A7A0190564B79C971B071B8FF493DC4B322C80DEF00E0.2698.49099057.265",
        "CD_3ED39A09F7C28ED81B80D1B393A95B0BFEDDF76F149562E9E7C25315FAC12EAA.2593.2282264463.606",
        "CD_B293971E18EBDBA3E18E429E10AEDF13A0739F0E375B42373FB5BD3B45C3B92C.1521.1131644399.415",
        "C_F501D896223A4824AD7BD67404A8670F77C009FD1A50960728B1DB6EFD108157",
        "C_1319481AE46A12CC16DCD2CF74CC91B9F47EC011AFDF72991BF4AEE0746B16E4",
        "C_FC636783BFDB1A64DBDDC9D0C2A0FF3C8D482E7053A4FDFBCC7ACD0C12601125",
        "CD_4EB6D1B0651A9BCB05273D40A94D002733C3A80273FBEF6807ADDE10DBD5A05C.1191.1123943498.302",
        "ValueType",
        "4DFCA7546346272EDDA843022D",
        "C_84E4DC9ADD84591845DDE4D56A48ED16102383DDBEA596D81378CA24FC85D652",
        "CD_7D462EA5E87CA015476942A58BACB3893636973868980DA68AC5EC3B5A1C690A.2745.2971917169.358",
        "CD_A45E0068C31ECE71DB8386F48AAC28A201C918A54BA7B6C803A07E1B151C3D4D.2733.619585629.482",
        "CD_41D84F93E168026991704896B6AB8BD6B7DB82CBC17BBAA1442A047D10A853E1.1070.3642742931.264",
        "IL_CE252AA91A6FFA46FEA2B838786203E2F0BE4357376AC351FF7B23B65B99BE4B.2698.4138931889.265",
        "IL_D01BECD5C05784A27AAD3DA067E53F0054A6BCF795FB58C988BBD59A62281818.2687.2938392201.261",
        "I_3BF0ED88A4A3B50849FB14D362B499D7F456C13105F674E9CFB83E87773B49A7.1103.2720485810.273",
        "NS_3CE8582EE8FFA928E42F84B5CDF7241A25C3C463C6F6E68C9EFB47A560BAD872",
        "C_752C67D757A6F2589FDF45E2D269397D4C432586AD444D4E1B04E468FF08F446",
        "C_5E19A5BEC74DDC9E86727DBA63BC4327AF72CEDD016ADAE3EE720DF35FE1ADDE",
        "C_9AA1A1FB909781CFE25B226DC2FEF6367F9967B3CDEB068FA27F1AEC1CAA9E66",
        "CD_8DD4117F0A6CA8322CEA3B2EE2E937FF189016C7342D650B227DA4C96B557695.1793.1820391695.268",
        "IR_61D4B20454D9364143E7FCDD696A05EA880F3DCC132A499B1EBCE94AEC8918AE",
        "March",
        "TWZ]`c",
        "C_4152F1D73EC0C43079F370FC1851FF50A6678F3120C915B048857D41318389E1",
        "I_AD65C0F527437B95541E8E8CF03DBA86454FFC8E0914CB92D3DC1E8F116A668A.2721.3996512111.271",
        "CD_6B8F637EF3630A38CD797596532C058BB5BD87D7D03BC5AC52F6F7A12A311BA2.2653.2305154295.353",
        "CD_D441AD3F69852AA912E7DB88FCCCC4374628FEB4888BBCF4D0B24CAE723208E2.33.2889348078.534",
        "CD_403C7DAFD38411FBB7FFA51AD2D0CC5E3462A61D34EA60E279877DCCDC222D62.39.3901164362.452",
        "CD_2435F543C14D77EBC0F0A1B12249B8DC7F253A838F1A9C04985BEFFC4FAC101B.2612.177673659.344",
        "IL_27C627FD56BB3D8776C1AF52C47B613EA485722488C995889338ECEB8F7D5C1B.2688.2788549545.278",
        "260.2718.2810907187.272",
        "R_AAD0D760D72ECB11742773406575974B851067AEA4863E381AADAD2897C3D328",
        "CD_832531694CC32AEF12EEFA0D2DDA8BF782C32F932BED169759F268D0FEAF39B8.1197.4285440418.494",
        "CD_8AC77D4657C341EA62F010DBBCE9C60C34967B183584E34A69DC6BB5BF0070D6.1983.52540720.707",
        "CD_E444CD7B23739F9E179DAD07B13CB31D8D111ED6AEEFD52B89FB204BF93A5A2C.155.116671582.1901",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.2889952617.180",
        "IL_0512996E43BF9CC18C2AE4A048B8AED9C76AE8C2CA7091210CFFEC0752609CAA.2736.3752318035.278",
        "CD_79BE4703D74D1AEA9541FA58F2B00142CCE440AAF1482F39D9D52E228ACD0FC2.1069.3471762533.1186",
        "ThreadId",
        "NS_ECC38DB72CDA9C35493A5511A56C487389544B60BB7D455E01A7B574EF71B32D",
        "CD_BA885398BE174F1F7801A16318AAD62AEB981E3F5EEB2272CF873A91B96E49E3.58.3470517256.2402",
        "CD_A856DF8087E1CBAC4060F307F9FBA2B5667CAC9AA4310847E3CD2F374CD83580.2504.3066385557.2975",
        "I_E1EAB736DF81BC8E670920B2CE9D6569872B38D69DA44CE88EBDB5463BE3F426.2720.3093271709.293",
        "CD_600A73C35ED5D3466F7E30F1C2489F076B5641F666F273A9F923A32E11B6B851.1491.1.53004",
        "CD_7531D0F73C9D0FCC20C0C9C036C7F34D7F189FB9D62AC61E8FFDD74B2A07A836.46.580685053.4562",
        "C_BE877C282D9825219493E084CDD445329E228296939B67B04EBDEC0F45BCCB11",
        "CD_518737FCD9736D06CAEE43D2445A32ADF7BA5172ECE7281110883C447A0C8E05.197.3028851823.759",
        "CR_33B0A3C692AD567B6C92E618FD5072156CC98A3BCAA3A93CB3F15A5E87E34AD2",
        "CD_935B071362B928DF8D6A74C10986C5790CCB0ED5E141E88F1610752926D4F6DB.2555.3844825052.496",
        "C_8CBE6A0EFA02AB4F93C3A1CC477E795A624A7AD23C5328A0447BAE721BD99CA0",
        "CR_1E1CD952E598C3858F01E05DCEB6E0FDDB93A88BD0100C8466601561A5B05EFB",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_C5A1AE4D66D54DE31BD0DB67526AE9F7258CD2800AEF5AF0F2B6F67014B52345",
        "I_311D9C3ACD968247C11E436B1E6C36C4259B24FD47C4F84011E04989B2594644.2702.437244233.288",
        "C_A935D5F4954895BC12501D6B843A3E716216C465E3747FDCDC880A4856CE027D",
        "CD_C32DF9F947B29FF4184A098E1939B4BC6F452D2B88C38983D24946818DE6DD9B.1835.3822779343.315",
        "CD_649FF30F9409CF8000973FDC7FB1D031F4107A8688A55A6A51271D73134EC398.2568.350256572.878",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1333.1020230547.336",
        "C_C2B48D57E7FB92EB84394A622E8976ABCFC0A72689795DFBF3816E1F26EC5623",
        "CD_10733E6D3C722406D792B3FE235AEEB733EA7659B833A33F18A708085238B2B0.26.315105898.1800",
        "CD_D48886C73DD49B540F592803EAFD1F804FC85FA1E036602F910CF8A02AF4AEBA.2655.3331991015.797",
        "CD_A935D5F4954895BC12501D6B843A3E716216C465E3747FDCDC880A4856CE027D.1581.861771010.534",
        "ReportSetmarks",
        "C_D353A723558494456907934904E2EEA7D4159B1627D44F40729031ACBDED0D25",
        "CR_C7B7FFF993314953BE1A6F3ACE26353D36CC0DC4B7DED5F1ED16B7B7499EF72F",
        "IL_692322EFC1B6B89205358C4F6AF7F4A2541CFD1AD38DEB3DAD18BED3DF54D064.2707.3446467184.300",
        "IL_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.293.3106448493.356",
        "I_5EBF93E0C149B1B151E338091E85B09A85B53ED88BB6E56FB2EB094E120431E2.2461.1736558589.329",
        "I_BA6B32FC71B1CA0F3C377906D1D8B14A8D56A7C468F97B08687CA1A6CE72F4AF.2719.2739097969.277",
        "OtherGroupId",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1480.2002022883.180",
        "CD_80675749A482112913F21FDBD7D7D7162BF42E8F9D4DFDC3F2A040FA1BE63D51.2121.916511886.6226",
        "I_BBFCCB444CF66AA09AE6F15967A6865175BB0ED216D19970A7988B72CDF0A3A4.295.1443689286.342",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.3789313510.368",
        "IL_FEF2D16C9D1A08F59AC4F1BC15FD57E47ACC59CFD01B94FAD32433FB5AF03B91.2699.442624348.281",
        "CD_EC346D4B55B7A3D064DA670AC46B8BE53932F3BCFC8908523A9CE445AF651CD8.2384.4283045471.581",
        "RedirectionOptions",
        "BE32799EA7111782F3437D1C0F7794E4D4FE",
        "CIM_LogRecord",
        "CD_F39CE8DEA5DC55C1FF10FE9CB8760E6D9F306EBD58660142F016FE93457EC312.2374.2131452254.2849",
        "CD_A026C2EC35B3A4AF24593EC09BC3F9A24F374F1087E00B13F499CB6268CBD64E.1059.4068359210.462",
        "C_EAF3B59209A6FD8D082F3B655183ECFA165075910E5DEE9A2A2382671ABC6D42",
        "I_C38BCBD59C8501680BC5A14D1BE86945712BE5E122F4BDED1BBFA68576C2B1BB.2706.65642243.296",
        "I_F3D41943E36B5E476DE07681CB51D0F3220555F0C26200540E34E145F358089F.2695.3945938787.266",
        "I_51F1B3F79A7B4ED97B0674EB43E08DA91CFECC8C7DD36FB67E79BB9CCC86EA15.2708.3836478760.288",
        "IL_6B4187392529ACC8AE266FF8A91482AC207285C338478E3710A134C0B31782AD.2683.2420775145.282",
        "I_171DF71ABD7C6A7DF03D4AFA73A2CE1BA658B66016A9DF4DAB148F781BE2851A.1019.286285166.420",
        "C_51447A26417532B0D1E85276A6FCB955003CCAAE5927BD755A45CC87195E9484",
        "CD_9398EE9389657B6A830EB223CFE8021EDA6EBF0AE7CE6FA1ECC3991C40D9983D.74.2461010758.1072",
        "I_6D22E6765B24082487DC01F79A0CBFCBC29DD914668BD112A684AC2DADA054F2.2688.1604652562.265",
        "I_340CBE78ECDC147CC0D8E08D25E28D5812DD352A6020A7847860B23A3D747C84.266.1304879836.245",
        "C_8242218A573BE42A46B3811AB82133E6A6A1C7B93BF914F87FA34E77B2BCA513",
        "I_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2.297.668444964.338",
        "IL_61135FD5141F35DCD46306456F3CDB5AEBDAE18836EED0F93BFC45AAFAF7E45F.2711.1750736373.295",
        "R_B9D58526785010F225A5B7C3571EBE488D29C0DEC319541C93BE914E77155B6C",
        "CD_BC68F03B4B8F91EBABF0C9EFED9C57ABF605182A4D8760A0679947CF4F1C5F19.1829.2435593048.463",
        "C_B918DF96A5E2671338B0CC8D372C94DDC6B8A082386425CAE7DFA7AEFF9B8DAC",
        "R_800B22335E7C5DA38CC321333C135D97E9AEDC239D54BF4DF5BC03D028B50520",
        "I_CF644C02727D10D54E429438B58B0A2CE4D47FC2B11BF294FDE4FF8CA0C29003.2720.3324523691.290",
        "CD_12706E8B04FEE8F3D76199B384B2FE632A6036284472947E8464FF115D49DB77.2609.1563168971.3438",
        "CR_920782A19D0C199BDC99CD6BCD549187886CE3AD64D29AEC0D7E3B1ED7356A9A",
        "CD_A2392D279E55559D3F1D33DB8F42981C4F8134A3716602C2005C822A63CFED06.197.2645405782.797",
        "C_9F3571C46BDFE273D99A799A2A4BCF3BFE2F06FC194D43AB6E29A0547376022B",
        "CD_B0796CE9F628CF73E17A3427BE2460F8DA001FAD27D1712ECBCBDAAC25C4954C.1019.802346803.507",
        "IL_1275BE448083C5AAB33DAF19956853ED9EA842E05F94D0AD39A63BA94DDA43EA.1020.2953315732.330",
        "CD_33D246EB3B57E6928B893AD6FD55D978AB60895C15739A40D6B9E85119ED3D71.265.4268454207.573",
        "CD_F1E353069D97BA94B1909DA892B719B714F54C03563EEF18802F8B2BA8D69179.2644.3919861246.451",
        "Bus master latency",
        "IL_EA3F44F70D2E7ED47A9DED0CFDC16FAA76D816E5859ECC07AA403671E877A57A.2729.3261746862.267",
        "CD_B02216361D55745EF586077288F3DA27E9F2DEBB352CE46583451DA731CF523D.2558.345728031.688",
        "C_D1F944DD008DE5B2A5BBE135D81E17FEFF6E1EBF9F9785C0A44F4A4EE6CA43FD",
        "CD_2AC62F8FBDE5396DE0E714628FC5276EAD8299E75B3476107B0361922E630658.1196.3333194408.3096",
        "CD_4B76EDDC0A97BB29191FFF0343FE28556E1B96E4EEC76B915F488D62FBD633FF.1545.278485891.3200",
        "CD_2DCBBFE173C5C78D37B1B0F8D0233E2C025177C64405C72A9D90467BA13EAFC5.2560.1778641953.736",
        "C_31682C5C22F201C41AC25516223A172B2BE8829C78A0BC224059702D9FA339D4",
        "Other",
        "CD_1C871A69AE42FDAE2404C626ED2A6EE58970B1ADBD41309118A0347F713B188E.255.3468655560.5709",
        "I_0E6718385BE4F7D115B0201EBE2B1152F73CC48825709B67CAF8E71171FECCEE.2681.93249695.283",
        "CD_62999B86D7FB03CF7A5DB6EFC7D4930E35E2F23BB83D0F4261B4003B746A0A79.2617.292473620.348",
        "CD_DF35CAA9032B2BC8E9E68BEFAD5091A66EF205D46DBC51F13F62EC987E8BBEAC.293.1435625100.652",
        "C_D56193964E51CF773304523DD4D95B2AA6C5D33866F47DB7D43681D0C19210B9",
        "CD_B0F8BF006A881EDD5F1AB7C6C5C658BE31F57C66C14090343C8399CE5BC043A8.1915.2215354337.259",
        "C_EB9E795F43B762D3D38837138F4AB68D1F6C9489A93A8726D25010DC91A8FC39",
        "C_CE7D63CC7C1BAB7611CA21A73577CE89CE851959DA14BBE073B0286801C57456",
        "IL_A25A9C1575C39A69ABB3AE94BCAB886A687888320036DB32E341222C291C7B0D.2680.251073678.278",
        "CD_6B9AC560D28F493249132555B3E41644DBAE7E183CD96D6C4A88332FF1D8E0DC.2472.634667484.911",
        "CD_DA922784A2271FBA6F7ACE36F0F9DB023914E59E18D78414D91406A5D3145AC4.1601.3303722028.564",
        "IL_2794C24A33206B514450E2AD3A586863360805BAC3DD8B70881AA9199FB2E840.2677.1614396168.271",
        "I_A7052B08B09938CCE53BEAD9E47D91E93EAD5FD6F9FCC85F6C2DA7C752981F58.2728.2163401121.294",
        "C_D720DF0F82C4481621F1A25D4C9D49761B2F3F169F534AD1E42A08FF995B85FD",
        "CD_E14B4F0753556BB90A70563D70F7B34C4B56749AD9FDBAEE6BC20394E4A29614.2586.3596628253.159",
        "IL_644ECE952C19F6156C203453C53C30C22E6F412E4B6BEFC55C711F68463446A2.2680.3753066083.290",
        "R_D4EE14E9B8DC621A0E06EC7E7B7FF7A062EBF6FD9A03F97DD9FA99C22506F07E",
        "CD_7F0BCCF0F309353695E66B6692B97AD29C859CFB167DE9C2C1DAEAD8ECD0C810.2604.325950589.307",
        "IL_0D45312EE5438D98BA36805CCA7462514E338F3C3D0377BF7732E42B59651E70.2686.2817361374.276",
        "BW9*fN",
        "C_AC53CE5DA52F8730E6EB207A1453E345675537E4CF8D4D541D7A48167AC26146",
        "C_44329BB2A5F5C66C32C4999A22AB6E9D5D2A6621ADF626B020D00BCABAC51F7F",
        "R_BC5B09A692305D87F8505A395B8D5AC44131CB17A54A3AE3C8323ED42268724E.1714.680501378.570",
        "C_1750EE3B65915B0BBCFBE5A295C25749B68FCB3C6C54CCCEE17321E25B3884CA",
        "CreationClassName",
        "C_31A0633F8FCEDD0E962DDA1E15C22C2730E3E3CB506260E11EB192F6109C813B",
        "CD_D1F35069AB830308A3D10C95EC411D258E0A9CAA2EE0311B34E2874304803008.2747.279344214.332",
        "C_64F3934C77CBCF89E84DA868459634281E17E5BCF13A323142A343FF887F35B5",
        "ConnectionName",
        "IL_A6C9ED46D92F29AC214E96B93934484D3FDC38BA3D568DA0709910225F8C44D5.2687.155383245.275",
        "IPAddrV4",
        "CD_72B01590ACC4500D6C998802BAE78A511F68CE1F2E189F92A27741ABED85403B.2641.2288392246.1549",
        "RSOP_IEConnectionWinINetSettingsLink",
        "CD_B83EDC36E507DD94F76EF80785D352A67A9AA551229CAD025BE35DAFB6624CD2.2543.1131300478.498",
        "VolumeName",
        "R_CCB9B5084332230EFC94CE865E967C275D0B783CC35AD9963948309EDCCEF116",
        "I_BD7CE80B1C8614AEEE4CD25ED6E700DFB7C5DC7A88D4397F35661627B7565F4F.2701.225141615.282",
        "CD_76FC0B4AFF84404E9F25DF4AA97D3CC2B42B3C84934BDB4647AA8D3D31FF5644.1921.2031977455.287",
        "839FD6728CEC6633EF525F0041081BB60681183.2764.4022667224.284",
        "C_688EDFFAE1CD3706709D790A6046157BB8A78E3308174A187E2C588BBB236985",
        "8CADC56BC95FCF2EB3",
        "CD_E6323222C9A136F6C273CAA11042C26BCC58281688835481ECD05350F4040D8A.1105.963217625.1111",
        "NetWare",
        "I_EED29279036F2DE32DCEC9B0B83E02E56C40B6DD4AB0C1698F2AC62B58F66CE6.313.1817249689.352",
        "C_B035CFCE41CEF1FE5604243CAA5700B13BB8AD4D69A92424A83B7D202927FA55",
        "C_B25DA333436380B14065F5CAF15967BBB759113E2ED71069E1E95253766795D5",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.2441.4227466495.779",
        "CD_EA9A1A204A0FA59819F57AD1F744E0CAB4BE1F06A46B3D439B85E87A7B3A09A6.2033.1803082927.243",
        "R_D353A723558494456907934904E2EEA7D4159B1627D44F40729031ACBDED0D25",
        "C_46220D63709C3AA26B1F26BFEDBED5BF0C3449D14236275DE54E229C2751EF56",
        "CD_6F0AE2681972D35A5F9DC1D57740875F1F03F7B6D986B3D66007EA5984B706F3.1569.3596767140.666",
        "CD_5FB7EBFF7E65F2B5A8D86A305D94319B3C99F6846C3536F671E3F448D940CE69.2052.1349692417.2313",
        "R_0C9AB5617BA8A9B7C3F74C1EB3942161CC46D714C581CA50C949594A28711EC7",
        "SystemConfig_V3_MobilePlatform",
        "I_A1B94F29555478DF2A151FC10F5194363770C853F4EC8F7C43DAD378AEC8FE7A.2700.1339617719.273",
        "CD_8BC061EB0082E96D5DC5828FD96C3FC2A01095E7E42C720BCD36F363CA556A85.1135.3982854592.309",
        "CD_3919809C02000DE9BA7B34CB7C0A2B9234444AEF5A6D4DF7DEE7C1379D7EE3B4.1959.1838417858.3233",
        "I_C00914885257A59D087BF17CF6D92E3E0CE6FF4AA6EA44EB35243AB7C1D41EFE.1931.2798519993.320",
        "R_FAB579260306CF6BFF8AA42E9AAC8900DD8AC191A796F9430DC39085EEC7005A",
        "CD_1388B74AC4B1A1248035D019490B1CAAA479C4415233A9E50223DD0802BA383C.2014.342527158.6968",
        "4p(h<Ldl",
        "CR_3D10A0A77CAA5B54D6D0F826577C9C9001B09013C6D023D93A420AB24027FBBB",
        "I_E717376E0197231BE2AD92A323433AF4DD3F15484BA36CB4FA93BE2B61936B08.2694.1393669518.269",
        "CR_772A091866475C0D90401E2D449ED248747158E72AA5FA334574887C1703B328",
        "I_76EB16D02C3BB02EFA78F2097770B96E54920137B8BB6F785F9C112617CDEA9A.2689.159389361.271",
        "CD_1A3FB2187E23B82908958F340DD0F5EA4D8685478FCE0E52ADA73DFC114F95DA.1747.2039434243.483",
        "CD_10C4E860C968580648DC441565AA0E8E7188A06B6B5DE086FEEF7868F45558D5.2509.2565682389.524",
        "CD_8FC7E2EF8F90B92553B020FE4923ECFD22B98AADF22BDC0FF9332DE6A3457F87.1153.1288734221.275",
        "I_91AE913EAB0F01F87A80F388B4ECD61A926DD279DDE0012432E352183426D536.2735.3091921762.283",
        "CD_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB.0.1436577077.762",
        "CD_4C65AB3247B160952785E8934037647E2EE8A6BB9A835112593E991D11BDF33B.1339.1106244251.2806",
        "AllowWindowsSpotlightOnActionCenter",
        "Module Index",
        "IoTimerEvent",
        "CD_CC0ACF58FA3646F311BC16A78942AC6DB48973323025BC27052C3593D5CE6061.1083.864610972.779",
        "C_BF0F21E266EE238DC4E72C2DCD37785DB8C507564B3E0146DB005B5CB91EFD01",
        "CD_8D313BA715C6E6DAA1BFFDA728F33F642CD2C0D480FDF81C6ED87298338EF1E4.2641.1056074410.876",
        "Status bitmask",
        "IL_92BD2D526811612049DEE66A4882EE4D3EC5839785BFED4D6537BC916B3CAFCA.2690.236457105.265",
        "CD_61A3C0D6CB2A10AE4FD5F19276429EF7E249D991E911A200F124BE12E4F8F8C2.19.2730689284.2021",
        "State",
        "CD_D86C15BF99128D54E1C4E3F5A93A0197771C9165545EFA09266BDF39527B7972.2094.2143985553.1560",
        "Configure",
        "ref:MSFT_StorageSubSystem",
        "CD_236671D190B5A97B69CF698D7EEC94B834EB78003323F67E90BFA3A62F30C576.1604.2429067582.2565",
        "C_FCF416010D567B5041BC82F46732C142DC125B68750168BA980728F3E2F25AEF",
        "IL_629D5C466CEBA04BA20C9B0FF5E1065CEFAF88EEC0DCF7E7926225BCB6FD50FA.1150.952521520.281",
        "CD_BE877C282D9825219493E084CDD445329E228296939B67B04EBDEC0F45BCCB11.1354.702779527.1292",
        "CD_DBBD84EF91CECC27B905BD3504998EC3FAFFD6A1F5D11327943B474B842AEACD.2196.396470833.184",
        "R_5D2BB5E72A2F48A448D0C78E4EF523FCA37E91EFD1ED92B23F38B836649C78DA",
        "R_E41E48E2BF64C1A666E7CBC625AC850A59C1BE3659E8CDC260BCA0FBA7BD8895.1094.3009283618.520",
        "CD_9E0BBFD642722F22A3DE9294E48CA8E34C291ACC893F65DEE82C20A071D99D86.2612.509151384.475",
        "CD_40C12CAACA910BDCDC268A44F63FDE93601C53B5B501C80C38FD1FB3930C98D8.1499.503131722.276",
        "RestartJobByPrinterObject",
        "CD_C6877D93883C0A287546253E157907791BC6A0C92D8F12064B0617A40E589308.2158.3103727565.7337",
        "IL_0E771EED7AE4F2FD86B4EE591BCEAAB2658DA14859A78258313CD4E9C7B177B7.2679.1891015008.281",
        "I_DA8D9A0F02B9BFA0387A8A87ACC1B3C4B7907445D07ABF7DFCC4E162C7130191.2704.2555391629.290",
        "I_BC34C97269AB6EF5003806A19ACDE60C62BD631E90DE362CB7EE385F411B9178.2717.1073654883.273",
        "CD_6DD0D445D2D5443E84DD9BE407CF19114948CA273CCA749C4C24BEDE6CCB0C6A.2665.1898389265.760",
        "CD_B644DBBE73F79FB0842E1C171405F67338509DC40A93651BAD6519043B41B89B.1610.375035899.3180",
        "CD_3D908B354A7F66DC7D8262D5E5F0BC191C813424FF188C05C86C05A6827B5F6A.2640.2457375026.459",
        "R_F9AF0ECA8E2274802F97DF13DD03E7A7D5BA0B314DBA756E75194EDCD9ED7493.74.726247842.518",
        "C_284916CD952AAE32B075C2CF9D6353A3004441F29529D83865782726D8CFD589",
        "CR_3D126353F8A45AE958FDB7A794F752470EAF3717B940BF141551AD925649D593",
        "C_3A2370D9C6889B9467796DA6A6976384304863021FC49BC99B9E42776EC37B08",
        "C_4C5A81206183284769D910458D05B5688A17E07BEACF6B75FDB41F487B4FC2AD",
        "CR_AD421F11CEFDE45C82C30BA4C4CE4B25170DC00E4DA588502ABA946455B19C47",
        "I_BBFCCB444CF66AA09AE6F15967A6865175BB0ED216D19970A7988B72CDF0A3A4.297.1059767373.342",
        "CD_FCA9F76AC6C239B0B01B1672252F6805168C019918C672ED3A9DA5B69DB47E2C.1876.1611716995.316",
        "R_4D32B2689DCEC5CBC62CE6B930082AE82B9F152AEE6B99F9CDBAC8B0961EFF51",
        "C_86E4399BC4DD7BCA81C24CBCF67DD3AC1AB2674904D37AD60CB8F1387993FF14",
        "CD_6EDB414A272FF229BB33606CCC694211C55817ABAE713A5736D1E4CA0295AB08.2419.3961628350.669",
        "CD_5953574AD268C37F4681AD557CF3BEA3442C419F9086A8F65CC3774027E8952E.1150.284901049.548",
        "R_35FE0F2AF2D5B86CBC794195519170432F5D5323DD65B59310A1399B7795BD77",
        "I_38845CC739FF8D351B32E8B9938B0D492105A79D1A88D99796877E995506C5C1.1015.1130069211.351",
        "B756F7BF8B112CC00CF7EC2CD6588E2E36744B13AA0012BCBD.2706.982681186.285",
        "MSVDS__PROVIDER",
        "CD_7AD87B163E5F080E34E60018A0634DBE95115F38F1BC264D0B548D7507D9109E.1638.267618327.1344",
        "C_9ED4C67E3712DE07C86D1861FC69841608A536EC7A7415988B2BEFAFF875D077",
        "]`cfi~lor",
        "I_C5A1AE4D66D54DE31BD0DB67526AE9F7258CD2800AEF5AF0F2B6F67014B52345.2466.3756530922.338",
        "C_4BBA71B8B969B6626A0E7F60779736282C60AEC40553354F5884C7B9E51AF36A",
        "CD_95151EBC7602F93A6E06460EF447E398F547B7CD3033E5B6ADD3848197B31384.18.2771448574.545",
        "CR_A68B01B18C25C8BFC9B36419B9B64DB698A481D87C42ADCA7EC744307E0456D7",
        "I_F6CBF8594F37DC5079FAD1D9AAAA8AEC8D264532DF220B23DB57B2AE7A791572.2694.185684583.262",
        "CD_5A5E04AE562D806B7A5E96D29CD9D1D3E899DB8D4ACD1E771DFE1EB85514EE22.1529.3475286506.7725",
        "IL_7C20621C04548080C1EE521AE245952B5749C3FB727288FDD27EDA07E39B175A.2505.1748417304.294",
        "R_1B55B55FA6B082DE82471ED3376542A1505C8C97D1118986FF01EC622C5CF23B",
        "CD_20B4E701C3271ED94785243972C16A9A8FA123A78EDAC768D9A7B370EC4A42D1.170.1460800655.747",
        "CD_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416.1520.1390676603.369",
        "C_13F8CBA3C82C56751066C09B89C76BE6E4E2E2A1DB6E05D411BC404F24CF967F",
        "C_1BEC388ED8B3DBC0D0D66BF6CA421BBFADBD5A16B9BFFBD5E8B6E83ED38EB253",
        "C_E593BEDE8ABB842DB1631394ECD41A318019F9AEA2160EF1EB883CEF54FF1974",
        "C_8005D3B4D5C33976D476C37A3ADF1FDDC2AEED60D44FABDB17B96E9525EA9F87",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2489.4141094664.180",
        "R_AAEDA1FD61325BC0D86B140D66A91281FE871D9B4FBF60BD8537F2A662C67E1B",
        "CD_1E1CD952E598C3858F01E05DCEB6E0FDDB93A88BD0100C8466601561A5B05EFB.1464.3066276588.1163",
        "Cluster size is beyond 32 bits",
        "Number of ACPI processor idle states",
        "CD_5D6BC382B6560C1A0A110793527B8159D7A0FA27CB962A1A5197752864C1F0AA.1189.637203542.498",
        "CD_A7E164E66BC7BA8FC3752641961C8B1829E354DA32CDE974E0423F3F5730EDE5.41.1053461887.474",
        "C_760A5CD37813CDB0802F97A15FFFC44EE06FFB8EC97E61F0CF228A37D3D46FFB",
        "CD_34904804988920D5ADDD4699E89CCA3704B43C3E300E615C1194ACA851BF70B5.14.3181674069.370",
        "IL_F1030868708E770830FB885073916FF999A80113BEA7E44E92BABC1A74051F56.2718.2773248534.272",
        "Not enough available capacity",
        "CD_57AEB8EB3ACEEDCB27355600EEB6AD6765F2FC2B92CF0E0C11051BD1E8F4D1D2.1349.805332360.468",
        "CD_36998BBD1F34ACF15B900E670E327F028E4B196C8A6E911E23965EC2D63ED47F.2759.1879423778.318",
        "CD_B9D962D6F5E4151B919F374E6DA62601E38AAA45193D0F7E78EB4B2AAA85F011.1018.2160233656.643",
        "IR_36045C1EB878565670F72F3D1E7587983677C025BCAD734E43E3B9A93BA9EFD8",
        "ScriptingStandardConsumerSetting",
        "IL_7593C450FC9EE4AB50EF0BDF18F203AF1150B81528543D16ADDAEEC31A973BE4.2678.272004945.285",
        "CD_DD1327FC08EE6F810BD5622CD5EFD1804CFB8E69E3B82381F2E13055AC3B4DBB.157.931170476.809",
        "CD_79F50ECB454C073E4E5CB137ED1F04F729BBE896F53092F9F794786916DFD292.1480.38410236.86",
        "1F7466DD4B.1351.1483765389.713",
        "C_079F9962DB5B1A2D677708297D13FA6915104F278CBC0CB12F0C6471470862EC",
        "IL_22CBC607A88D05CEDF5DDFEB1058C59E56ED6CB98A2E6914C41D8556F9A3C48A.2728.1643980105.276",
        "IL_88DF7CABF5BD1981831821654FEAF820A29780F13EEE1AF86755DD96BDDE9FDF.2414.1957521491.329",
        "NS_DE4296A4F2DECFF74299F885179666947996A5B3ADAB4EB526CEC3C884F90B50",
        "IR_BED999C9BF7E84BAB50F0A32D016E7D1CAEC2193DF18DA06E4E9B9F14F58F2B8",
        "C_03CFFCC6C1542E35804D1F6A5B36702D2553306CC4D7F61D8BAD38DB9237934A",
        "CR_831AA66AA33E94794A3BE28998D5135FCA9FB48FF5649C034A00E2F57ED4C256",
        "CD_B7D757AC18FF2608497B974C70CC80BE5C41C99B984057C2991D1A13D3816E92.263.2737603752.2832",
        "IL_0BAE40148725A8BAC63C3127905070C22A7EA0559C443FE82181719B5F9296DA.2721.768645154.270",
        "R_BFFEDA03FDD0EDDDBE7B9391DA27C88AE2463D26F7B40B37D530B4319B353DCE.1635.583430141.560",
        "CD_8AD8BB59AD76539933CA61E487AC9890B90072B3A3E2702B40F21CB1F591E761.130.3017283992.1030",
        "C_44DEF9F59661637DE2A93E3776876E3A1438B9BE8089F1C0465114ED219CA8E8",
        "CD_56F6B3313FFBD38DB1C8A8E4828BD06527B91197C251B3D5F347326EDF37C1E3.1054.1358962522.354",
        "CD_49AC1F5412340A7B3AF318277037F701CE239A6BB2F7176101D1105B89038C98.2642.564350357.455",
        "854865F4",
        "R_DA629F0FADBF1E9D6C65713F31978C9EA30680E880B4ED8EDE3DC7BD5AFDAA23",
        "CD_EDDF316486234851D86580CFE9B06D5A43E06F671105861787434F12D58AD4EC.2749.400778002.623",
        "CD_B209BBC3E9792036932058EAFDFF59DF6B02D2E0E24C683DBB3CFAD2B25B83E4.2006.2913375098.1951",
        "IL_4680976D74568AAE04FB2D5BBCD585E7393EEA815176A5E2B34B0927C0600509.2691.4247015367.267",
        "CD_77DBF4A2C876542515BB91822C77D6AAB627C74A2589D8CBC4096845BC539307.1382.558768135.512",
        "C_9AA05959F2D6F6E2DA1C86CB49EB3AAEB9B2A949B6BC67BB11D0F5EEA9CBA633",
        "R_6085B444947FA3E7C230652FD99CBB906B632E940B47AE5A69AE429059D20E32.1053.604866309.524",
        "CD_92EE6C02ED0AA1EF322CF0E3C150FB5F1D97B8751D1560FB8DADC1FA4068EB93.1050.3203519664.330",
        "CD_22E55A76AF91714908793A9D6F196391BDBB704CE7B4C27172941A36699A38A0.2350.1.52763",
        "Indicates if any of the file's attributes were modified while working offline.",
        "KI_7010B213179D98B16AF38723EE1D750E86F808F341EE215AD8783D29EA117262",
        "I_833F6FDA2E00DF413E2723623764AB9B5B7213E964FAA6A9CAC0BF6627681AF4.2717.2093948589.287",
        "CD_336E7A880175CEC7983BFE0692AA78604916DE79A3400288DC3CA68EB96A07CD.33.438976270.521",
        "IL_8AD2C3841741429DE3C06C6390BC0586472D4410DF073F6209738B3E27E69D1C.2679.1199244044.283",
        "dnsConfig",
        "CD_269DB88603C265BCA5F6044C1F072210AFF0C0C241B7570BAB9B5F97E1D62DE9.2571.926570722.1418",
        "CD_A53803A976BCA3FFB16063ACA85E663ADBA78B63EC0DAF8A23C68DAD672A3EF9.37.3988981590.441",
        "IL_BA2B64DEBCEAD4B5E79E8DFCDA9F0F1222A0566FE820AF52659088247BFF8F7C.311.1988916545.249",
        "R_5B06BA99B995A26835345408CC4A1631130D138D6ED440C35741DE9489A8E845.1465.3173781706.536",
        "ZfoQc]xr$<",
        "UdpIp_TypeGroup2",
        "C_B9D58526785010F225A5B7C3571EBE488D29C0DEC319541C93BE914E77155B6C",
        "HLPTX\\",
        "C_A2F0F731789B8BD6294886FFBA95B74CEA7B86072988F101ACF53FD6E840B35A",
        "CD_0A88143E1C3CA6AAD532712FF8639D26F391192D06CCAD53461A69205DC057F1.278.1514684214.420",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2117.2415033528.368",
        "CD_B66074B0831FA2823CF6B697A61A3423369B606CDCAF1C630A34F2E146F8EC8E.277.3708426987.234",
        "CD_2CD004338C5F89774E29BF3E641901E611546726ACBFCA38A9243331558230A2.2583.3689771117.240",
        "emented",
        "MSFT_StoragePool",
        "I_A67B9FFFA0CFDC97B3FC55A15A9D50F12D2051478D153EB76E83F279C120D408.2728.1819149996.289",
        "IR_9E152E3E3D8A2665C8A4533F9A4E67D0D1AAA1D8B83D4A80BEDF2999A2CA16CE",
        "C_841F1DC98C3FA6D8D114A873F8BBB48736A8E2FDF60D6C1F08DF493438718909",
        "IL_B367E985EDB528B3721C3A2E5B698AD0AB2D2773B0F6A709BEB4291CCE88048A.2707.1183791968.296",
        "IL_9C54580862E5AD35A14C077F042D2C7C4B664A845389A5F93D7B8CF790C05E69.2685.3213845486.292",
        "I_B5A2659105BB67057D550B9C16DCA23132E513817D7D77164528C443959E6F7D.2690.254751962.269",
        "CD_73B76905DE8D62EEFC35FDC779F0748B6AA4421D4B0EB21785C52189DE44B66F.2557.2603456819.512",
        "CD_199CFC4A1FC7A648AECC1FFEF43CFCD6FD4BBDB0667CA99257540823E6C76661.151.235649183.351",
        "C_D5761D323211BB16C55E16614F63113A292B3522B59675D05934B2A4AD11001F",
        "OtherCipherAlgorithm",
        "CD_90D6DB96E4E52DF3FCB751D8C2491313C169EEA2DEA2212CBFE4EFF8C0A5E947.1536.1.9757",
        "NS_FE3EA006C3292950A76C2B5A0185D7DF99ADD6FD6502E0AC079E3A8650E76E3A",
        "CD_E707FBA0E2CA2FF8FDB82241C8B012B9A1B221B3B69ACD6A3EDCF3E478558D31.29.3018176920.433",
        "IL_4DA8960F71AFDAD53FF434DA8B4C754558DB76E9770FFFE7A355A95C8B4C2308.2708.2460764943.293",
        "CD_901AC56EC8F00C00FBAC686F0B7E1614E207CC1998593D930358F2BBE88093FF.2757.1858514465.503",
        "CD_DF35CAA9032B2BC8E9E68BEFAD5091A66EF205D46DBC51F13F62EC987E8BBEAC.42.2198918788.652",
        "IL_BAD408305F753688BFA8B66E22F6182EF70E94516291BE0D848E863D5C6B2DAB.2710.1387692298.286",
        "I_17DAB2F05DAF278660EF7A9033EDE44A9CD589FBA9EFE2D8306DD6119DEC472F.2736.1313350136.278",
        "CD_FF74CDAE39923232968131488C628881C63A5FB177CC4E0E28EB62D76E9B7164.1596.586302973.468",
        "CD_0DCE749AD0E30C5A74941D6C326877243635B3D92AE3FA1BB77A2C716BB28364.1151.2683006443.759",
        "IR_84DBB136E33A9D65B07CEAEA34726CC95CE2EDA4327BE7B9EC86367DCA1342F8",
        "C_2DFB68CFE58009EA74A39EDB2F6DC802FC0CCD83F32B155F1DDD8EA8DACFCD35",
        "CD_46220D63709C3AA26B1F26BFEDBED5BF0C3449D14236275DE54E229C2751EF56.275.1175802616.571",
        "KI_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB",
        "CD_5E4C61B5F4870A86C87C8D3A31C679CD8547F13761DF48FEE0C77BF5C516F817.1171.3213947430.361",
        "CD_E241A982292C9628611468FB40BE60D4CC1B723333EE25A7584E871FE9DA753E.1080.2882072815.428",
        "CD_B4204F4CD845FAF261673483B3D9C407E18AF7773A24D7B43C66C3052F5D6AAB.2020.2652331080.346",
        "CD_48A8B413DD01FD4E2902F07984087CB61CF9EEDF75071E3262DDCA296E4FFEDB.1093.682531736.4331",
        "CD_E1339E45991CFF28C6A45A0DB3B482D0FFBAEAE0DEF0210F7EB4489B09CB933E.2598.2217511853.678",
        "CD_D7CCE4E0D73E0B597F5CF042DC8B98CF8D09A5704D22B6F528EDA8D7DA64D4E3.2646.2614149325.956",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1218.932574012.180",
        "CD_F071A22EE25478DF80A205153198A6FC12F84A9E6BFE53B8E5DFD1E7E2ED2B8E.2749.3188798682.404",
        "CD_41B7AA8AC52906BD0F9EB940AD635202AF89B38F24F2BF12D2C0A98B1014B8D9.1757.3062344381.126",
        "CR_8D338BAABD5A4CDE9CD22C60F5FCC1F5326D81FC7BA6D48335E5E3513B7182CB",
        "Image_V0_Load",
        "R_6AD386ADF7788A35467E769D3EC3DE89211503B8A449E2B53EAB5B8CCD719DFD",
        "I_FE9ADCFC2CE005FA3B3A503B5523DA4FB1B3B3C059E511711707C0F453085AB9.2689.3938004615.274",
        "C_0D7E23CEBB047A39FE0F0FDDBC486BE449BF7E7B25430AF6F5497FBB0489C386",
        "C1C3C9AA54865F4",
        "C_DCD0D619EF8A182EED9A67E50FF805F66843D183EA6353EF5D3D8CF6F3EB1769",
        "CD_59998C21660422211077DE80E05C8A70A59B3233A43120323CA16489848947CD.1222.1826280871.432",
        "showOnToolbarByDefault",
        "C_D0FCA61461F580F5651E9E9219AB1FF74BEE4671D57E3148B30C5A652AC89945",
        "CD_563CAEFB32DA9C6DA846FEF0491B998A5AEB53D92D124F8B8C12120BA57E3D17.2425.2009551787.359",
        "R_176649CD4E57E4232DDDF6DF456E1D2A1BEC4DED47B202F904E6181846857EAD",
        "I_D7EA0523CFA04E2FD63E32D7A2C0946EE8968A0E849DD132512B58C222F2D445.2679.785141560.283",
        "CD_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937.15.1193426859.294",
        "CD_886435BF24EBB4BE37078A5EB6C7D44E1EEA23CFB6DDE7EE3C70C44A6B800533.2656.2106827809.1282",
        "C_52C78D6E955B575AC3A033FD1685CC8CDC0EBD4484E5394917410F9F0A706A02",
        "CIM_AdminDomain",
        "IL_BCA765E446D9097DBEA6C9E4DFDE858DC64A1737FEE09A95AB480242FE45EE06.2469.4192749857.338",
        "CD_2488FEDA0086E3CFE455C054B5411BD75907C4F387D842CC57B9DFCAEBC8AF2B.1581.2130386766.379",
        "CSV\\GJYM_P",
        "CD_08A5326D25CFED909AB0A296563DCFC521D59CAF145159CF516E0E2D49E487D7.2531.3425816616.633",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2088.672349805.180",
        "C_6DD0D445D2D5443E84DD9BE407CF19114948CA273CCA749C4C24BEDE6CCB0C6A",
        "C_601DEF79F7AA8603C2C98382F775A0B90F77F76016FA8C6D63B31705D050EB9C",
        "CD_9B85FF5CF1326F4370A0D245830AD60317CB312C53E60E05480454CFB6E5D2C1.1610.1716559465.256",
        "CD_B09B2F86C7A55023F82FE86D323CC07C044D718E99AAF895494770C3126344C7.270.1276216408.649",
        "CR_378C3B019BA81FF898F9BF06FF0AC5FC705DA51C0F56DBDDF9AC986BBEE3099E",
        "CD_55AF22A4D3FD212FC3171AADE7109F17F27CA9F86C291AE560CF90E7D047839B.2055.4272185905.2427",
        "CD_1FDDC576FF86C33E163A5B8EC72A7DCCE9CA8CCFD4AC8A6A8CCC18A08EC869D4.2635.2094746543.280",
        "Required",
        "C_98555ECC0A03254E6955B33BEB7A0BEA8E21E72A2C28A45377D63C309FFD4864",
        "CD_7450B933028ED3A9668E73BC07A8325B939DC7781D6560E2446E75795DDC2C3E.2159.3505213954.5425",
        "IL_E94566BF504DD530A5B6CDD8332E0677930FBB4322E53A9C53D84633C933B6EF.2736.291461238.288",
        "IL_9D5066CBE93080A416F70AD224E5BB9B1523CD0C99270F07373B154D073094DE.2721.2257828783.275",
        "CR_79F50ECB454C073E4E5CB137ED1F04F729BBE896F53092F9F794786916DFD292",
        "MSNdis_FddiLctFailures",
        "C_712B73F1329A92FADFBFDFF586AE86DD55A96BF25CBD08473137CA20DEF39F25",
        "I_A2D4B4B82C6269DD07909E5B5DC5E0F6E84A20AE4467E8B3A5796CA9C3D1B809.1016.914295214.287",
        "IL_853431EF6C8B798EAA2D111F9739ED97E1865E4FBA8B3A672338E34872D31B73.2708.4102485842.288",
        "CD_4981A3BB969F4ED9382A86F274047A36B2A04D2A53526DFA477217266B033E1E.30.1193437684.1237",
        "IL_05EA98CC46B8FA909AE0E11003EEB8D5C53A6C58A2D73531B76043537D1DC881.2725.1374216233.280",
        "I_4BA054279923D49F2BDEE3454C6ECB5CE0D731D7C27E30A6E4BE9348CD914BDC.2723.2234867271.287",
        "R_C17EBBF86D4537DC1A3044DCC316F63FF8183E01B0197617CF6F88A826A1D730",
        "I_E21083758A128727DEF6FF7FB30AAB8529BDD6F7C5C936DBCA6F06226211C86C.853.1.52579",
        "CD_807D424DAFAA138098488034F759F247CABCBBBA4E5F440FD767882727C292DA.1539.2689034185.1001",
        "C_63CC60C90F4F24B2FCFB7B4FEEC9D511528060A9B51311978A6B312ECEE120CE",
        "I_B0A591E0FA79B0A35E33827E8EE7FAA02C773C7B9DC2117EFC5619AA882D49AD.2678.1215784558.287",
        "CR_E626C49C2DBDF1D0BDC38FFC05C85B76B4BE8E69CBFD214D5F89F70F619AD6CD",
        "CD_5C60915A965EE419D1C4FFAF8E02780CAEA75D9A61BD702293ACA64C5B74DBC2.1548.454610005.421",
        "The setting value for a power setting. This value is writable. The InstanceID of this class will encode whether this setting is for AC or DC power setting. Important: setting saving a power setting value does not automatically make the power setting value take effect on the system. Win32_PowerPlan.Activate() needs to be executed.",
        "C_93D683378335762C284317F9836C36B73320C30A8A815437365079222449D208",
        "CD_07A0EC78D0058B8682505D47D43629FCC504426EFCBD83A930870EABFD27DA03.2593.2079737457.1973",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.304.2883904097.180",
        "IL_07E80007465B0B13E7DB9681B8444A9A1BA14B4F1EDCA79293ABE759C7E9A390.2684.1701017078.293",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.2804936995.180",
        "IR_851E2803FCA0ED313BB5CDECFB40BACC4150CF2432EA202122C27A5C46DD69C5",
        "CD_006AB7DFED58A8FB352581D21227922FA9FD887AC08F63A547BAEA9722B5F62B.255.4005509153.904",
        "CD_62C8891E57F68B5018AA739FA2F9A6FA324F5514D7DD621D65681F6B7E0BBD4F.220.612064997.773",
        "I_FECFBCC25BED015E01BE0019A5C5C82CB134ACE25D9191E3D91D53B7327D42D3.2690.4146926068.272",
        "I_5361F0B5BCF344E5F8BAFF7D3C773CFDA995B3843B674DB9DB34AC35EA55A657.748.1.63404",
        "CD_87FC3FB8BB46E54395D1465C589976A9AA29C410A5423CB9E87537B93EB847AD.1970.4217778563.624",
        "IL_8F96BD555D2A32DC6BC4E0F3F59606E1BD8488C4B7DB168B1A6CD1CB3AEB6E33.2703.2016533132.284",
        "CD_B77DB97387F7D955F5A8C046A7F1204A742C057FDAB7B793E00BDB10416B4D6C.215.3736021936.611",
        "CD_AD62CEAF5404095E0C59FDC3960F04E8AD9E8341B0B9252CE4B8968D02FBF29D.1609.1303948042.213",
        "WWN not recognized ",
        "CD_8EF0A83E2CE3C1D36E6DA951CB64B432165D8447385FAA4B9621140D1ADC2405.1634.1403908089.1250",
        "IL_74B55E6F9F6C41FD46CB45A5E24EA7BB337888BBB65724CC1519C36DDCAEC15A.2691.4082651549.259",
        "I_8C89D9CEC189566E141E85A927C3DA0B298794808D1847A9E9D4884B89EDB55E.2689.2934701902.281",
        "CD_9CF59D58FAC9A98A4A3EA953B45548B5589438D2DAFC7788C3503F11F40E4CA5.2658.3770590853.979",
        "CD_03E318994DE320A2B2B6A80EC1700D149A451607E607421E61E8F027E9429B85.1836.2229367394.291",
        "C_99150BD9D0963359046E30AE0385F17D4AFD0667F8DA5119FF433CFAA1D95BA6",
        "C_6CF03ABA0A6CA2F854B8C58954D7188DD4D4BBEA9CB1269949BBB74D50A3F4A4",
        "IL_AB83450D2C362894742984071630B17B68677FB118022A7E22EAA68EDF64D1E8.1150.3715020661.357",
        "R_B4352AE5BAF16E9168697F87BE74E2D35A37557397C95E650D63E6588187DC82",
        "C_71D1ED134C3945D531E64E4EED1102B93E591CAF758F7BDE265F8C737B6383A6",
        "CD_EDE577A8A15423BBFE9C00990ED0C7E143C04BE0A74BB383E3DB27D47D587D26.2528.1277861738.528",
        "C_64A1CC7E6457E8BC4843587443BFFBCAE82C80EB9392A83C2E16B0B57C781423",
        "CC975ED}",
        "C_A3CFA2EA2CF7EBAE83315F59909BFC6F8978ACBDBD24E7ACA6B979B7B86A9975",
        "I_BC7C5EB197B5616538EF4A2537CF0ACB8ADFCD77134622191BFAD44A946A34F0.1352.2211812683.194",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.314.699093998.180",
        "IL_46934F314D8C73CF84735F1E3C6EAB14C6702B40FA0BC5B992EC2D6BF398368D.2696.4110744200.273",
        "CD_34FAD62383244E37DE87E761987190C0E223C1AA97503DF98FC7B3BF572DAA9B.1477.1307233476.690",
        "CD_51595DEF0C6434555023E0ADB826EA4506ADBD6A5EA1D2C77F5165F2833FAC33.2613.2992549540.364",
        "k\"nt;>",
        "CD_58F7FDBEE520602801F9D69F9D9FF6E34217ECFA7A2D83A25ED10730D304E1A4.1489.277148320.620",
        "|l4(8,dtx",
        "CopyObject",
        "I_B295448335625AE4F30B1C13C498CDDD136CBDFE27D0ECE17CA7AAD4E56199B6.1938.1342239621.200",
        "IL_5398E9F94B1D144B2F6A96EE385DE9E650D41947DABDF2010FBE447001C9413D.2689.2709401020.271",
        "C_AF073815367B438138F1E5B4B3B3699ACF3DE3D6AC4291FED26D085AC83489E2",
        "C_E87C6D1DF020D21117D566D92C9BF8737A877FA32E48AC715BE7C467C0845954",
        "C_E8B3CF9E7D4D054B2D1D38A67EC16137D2A01F187F2016735DA7DDF287167C16",
        "C_F9DD6532A9B443155D1071E2F0AB84CB0636D514B871291ECDFA8724B418DFD4",
        "C_B72992879F6DC823F6267C256838F35D96B57836E37CB0558435E32B2B16111B",
        "C_36D01CEB8615511941615255EBA663CB732C23C4C7195BE6D3932961390218DC",
        "C_C48EAD99401EDD040FFC4F7D4C7D2EA74DBD383F4E1272208648D0E13C404FB7",
        "C_1DEA755185614A62FD396F35928F08FE00740978A177E14154E9A8873389BB1E",
        "CD_2E4CB0F875356763EA64F3060366993EE0D49772670FDDF29B1CAAF86CE9720B.140.465787812.676",
        "C_4714D9B900765C427A8C3A4D74360B2C569F951B888844030608A447B457F27B",
        "IL_FD1DB72EEB157E75D29D462B8D552CFA749E6AEEC91333B95D964E671CD91439.2727.3700189093.285",
        "I_2494DBE63389867B7E3D34AE21BF0B12CEED89B4B68AC838CC7D80AD6A059758.2724.155699716.288",
        "R_99343CBC3477F7F6125FD1666914F7CFF746CB5EAD9718A0BED14E0D6EFE4BA8",
        "IL_780FC294564884E07CC416E110992E2942AD9F83AA1D4ECA95F62F161A3A78CD.2708.1261587561.289",
        "CD_76B6B178A02236EDB6A8F36A0CE71BC97D59F8FEDFEABD15CAA3569E6D4DFE0E.2610.1187323113.2436",
        "CI_355DB6CE31803BDDBDD2FF491BD2AAE24F28E7ADF16402B3F3B9C4CF695702EB",
        "C_7DEC494410AEDA2786DDD83D50276A4BDEBEA914182D2E98EE18B4B9B0A60840",
        "CD_0C89E3FE1CDFD790CBD5FEE0B9AE5F8AE27F38181A372EB2194AFCBADEB37DA8.75.4642343.874",
        "I_48E0B724F43E37B7676E11AC832EA6DB1EEDEF00985C20F2786731722796D31E.1016.970742308.319",
        "IL_33BC2BEA66F6645C36425FE53101C96DAE9DDAC259ACCCEE668442448E6B9A36.2681.980888045.277",
        "IL_848E55FD5F4FC523C00864C2E37F5A0ECCC3D19673B52AA68E334B012EECD2F9.1730.4088707950.330",
        "C_051B7EF0B57F06BB066DEE1EB14A94EBB1B34ECC5FC9531E8039481BA53E5BDE",
        "R_C5880817200055BEAC2960FB445BC2D020CC591287865C13DEFE804B5B532048.1050.4195655019.542",
        "I_5398E9F94B1D144B2F6A96EE385DE9E650D41947DABDF2010FBE447001C9413D.2689.2709401020.271",
        "CD_8688B6B3A5AFA46698CC5C2A2A938F01175B6D9F4A0E5E74F0C3AA6D73897983.1203.1031135213.347",
        "I_511F4789E4422A6FBC095B24CEA0FC371975762D13382D739A2A7ED6638FF240.1217.1768452693.322",
        "IL_6AA0C48B0CDF9C82612CFBBA27DEB8DABBFC99934CA4104DB63E6888ACF8E5FC.2686.3306713336.293",
        "CD_FBE6F235041E0E3AE3541BE5BCDC297FFC96D908B951996F32623E2BBA30BD16.2371.3738564414.2603",
        "IL_7123B60FE0B72F1C57F72E3EAB013337D11B665291CA2F49685F4750EAD74F42.2698.3609420604.268",
        "C_58E6EEFCD70C52E85CEB673B88C899F843EA51E56249367D7B9F51D1947371CE",
        "options",
        "CD_753AE586E2D74399EE7F6C1BA988331E5E7982E68E33445A3EC32F0EC6B48917.2648.119045416.1234",
        "CD_124B2D8A86058DD102C833379996E9AF4D90CC4B792958ACD8E55DB72860976E.141.1110155483.651",
        "I_3D0B7056A5D4BB4D473A244C8ABDD62013BF15EBFA88FBC57C1EA570F061BBA6.2724.1392814756.292",
        "MSMCAEvent_Header",
        "-US\\kernelbase.dll.mui[MofResourceName]",
        "CD_549DC252C669D007BF4D8B198347293ACC33C289963BCA05C61A46DBFC8CA4BF.147.689394777.500",
        "CD_C711C8BB002D8E9EB1110FD878EE6D746D43AA84016338F03543498D8359252E.2610.3077788897.388",
        "CD_0954B67BE64513B4D9B9F714CAF4BD4F81866B122780FFA4FF13B48AEC697DF0.153.3285988885.325",
        "CD_C494166FEC78B76B06AE6864E10BB6C47EF436F2498312A79210EB6DD47C6CAE.2107.1.12116",
        "IL_2812552543ADCC60124A2384E03DFBC107A218DC98DC83C5D8FC1F19406A3887.2691.3012358119.268",
        "C_988CC64B9858C06D7E29C18EDBED8CE13CF165862E4E03964EAC303F3A8E79F6",
        "I_2C3390DA0D8113E7B067C5F12CC8E1742CA924FE4948190A81257D1A9CF5BDEB.2512.1267080331.280",
        "CD_E6B31A90E686795D9E916C75179C5E297CC54460E452CC51EA148281AD5C6D23.19.253058552.173",
        "CD_8DE46DD6446B26621A23E11758AE5CBC62C9F72998CAFB08B9CD58DF66902A20.2244.530208642.680",
        "CD_7BF884F7361F0D677A40C5CD7F9E2139AF67CB14ACDB2E9D39E3D5ADFB888E91.1831.1.26313",
        "R_CE1E2946EA75133DF1C863E5B411D4CB200B9A15566E82CC0D10E975E292F2B5",
        "CD_F7E10C2E2B48C52ACA99548FFAFB6BFFFF056CE9E9128CD48CB817FDF7995302.250.2281101382.788",
        "CD_337863EF99B561BCCD899B7AFA2247DE6CE14F0D81601137B3F7CD2CFAE44723.2106.2078279658.930",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.1504080944.180",
        "CD_1DC2241284EFF53B894548A43C065A88DE07D18C8E76DF7E050932758E817728.1074.1853273299.823",
        "CD_B49D54127CB3DDDF22487111FC3067928F0BA3A9AC1665011AEC9D08EE1BCDEC.73.3096868042.2377",
        "504E2BC1C3C9AA54865F4",
        "R_DDB9E5284035E7C991E364E045E2FE8D29BD27906672F0EE3919740EC2221800",
        "C_4DD1A5A9057BCA223E822F92B883994F78B43967069098EDCB429059D716ACBF",
        "IL_BC99FBB8543AB15A7C93ED5E5C2175864DD1023BAD5200EB323FA7FE87DF1BF0.2694.2580138976.263",
        "C_D36EEB4FA019E601112818DDC069B750B95BF09F1ACA992BF14D32259D2DE75F",
        "CD_B7CFE88CDD4E2F20D43EF63AF2894F6D14A41F54E4CF74F7D9A3F5B4EC2A87C0.36.1612113394.295",
        "IL_61E669D3482C420F68FA27C086C8D9EDD1797B7765A7ADEF6912A148755E11FD.2469.2518649645.296",
        "CD_7D26F1E16BC9CE86FDDDA09E425A859A3BF87CD94B9004A4B2B575CD1EF41374.2004.421582024.1979",
        "C_F542449B0CBD50CC1A71BFA6B7B20474C5DA76B95F621A678DD36C9156526568",
        "I_CB0EDA837B0FE5DA8B4FB99828EF038E0A52B79D351F37BF7E32A6211C3B3E4C.2715.3971088746.274",
        "CD_43D2FF9F27C9DEB49402058FFFFEABC225D67F17C30DC663FA2980525D05DB01.190.3215695119.439",
        "I_0B79DF81265C4E4334F986E1F5EE4C514A766A77488653BBCEDB07910F87405A.2715.2871099502.285",
        "CD_D1E324C5A423619BD6E9DEA96389533A053B58031C50F5CD3B933AA32B95E475.2638.3298496568.1597",
        "NdAdapterInfo",
        "CD_5D2BB5E72A2F48A448D0C78E4EF523FCA37E91EFD1ED92B23F38B836649C78DA.94.1243981570.697",
        "IL_4DCD7C303EF2C3A1FFF493AAC5237EFABE760C9594A5BFBE56EC9C3A9BB95285.2727.2458310269.279",
        "CD_A70AED88FABBE3115886EEFD655DA2D884AE8E474FEA14C9253CABCA6FD98254.2522.3498275371.948",
        "IL_213DE1C378BA512541ECC0D27A04A76AF22CD969F0BAAA5AF3DC6ED03D9E8F55.1016.3400545868.307",
        "C_6B3C51218B5282812BA607C47ECD43DD87C36C76C979F2D4ECDE4EE8973BCF17",
        "NS_8B6812A49FF95A56BD1A2DF47F355C035587BE9FBA56C9E3DC5C16762C0879F9",
        "977F7CD79559E18",
        "I_491BBAE1E8A19D67FBD48872DBABBE98D057B96DDDA33D840338CFB5CDF418B5.2677.1554458431.282",
        "IL_CFDD604C12736088F97C89BBC5FBF36ED46E389716803C97FA884CC1AC9F7E21.2687.2592553765.263",
        "CD_A141772EC0B77A30BCBC6079750E6103AFDC743C3C219E99DA8B5DB99F02CB9D.1344.1461308898.2425",
        "AFE1BDB6F027AEAD97E2A04551B2329B3A302DF92AC01FC",
        "CD_DFBB94A659989B2A127D27F9BECBDC304A8CD959BBFFCD2DBE5D1F68A91B0DB9.2555.3590966202.529",
        "IL_286FCA41CF8EE63C715C5BB44EDAD1BEBFEA2B5170AD4E8387888C020A3A6A4B.2682.2915352232.283",
        "I_EC4DC3F74F551BD4B8456553EDE829E8215C20D87303943D11958DAE09FE14B4.2700.981983202.285",
        "C_11727D0817B89F7123E6B6DD53CF1B739F2A79E64D7B5FD98F4BEC8A77C74EE0",
        "CD_9D9326DBD5B904F2FA39C7A8BD8707BEB4F5A372DD531987B409839FFAE50966.197.3155199072.220",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2482.476375418.368",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1714.560668657.368",
        "R_349957449457FCB3DC5CC416323F05E6E56083B532266B79EAB7F5AB720C36C1",
        "FAF3D493B",
        "CD_48C8FF9D3F57E7744A3D1C2C52E57FC97BA717E184730EB1BDE77718DB3C9C93.183.4171233498.1024",
        "C_0669091BB70564F4C28F9EBBB95CE7699D1CBEC6909BE49F84E8F214B14C6216",
        "R_A44408E1DD38D6545C617326A4354A58277DE2EC9DC5930CD9DADCDCF31C706D",
        "CD_752C67D757A6F2589FDF45E2D269397D4C432586AD444D4E1B04E468FF08F446.1054.209873109.1299",
        "I_35F1BB1E50C3B37C02C5010AD042D8764EFA2D498301E39787D5F1821C27812F.2699.1151528514.275",
        "C_AEA9B4362FEF814E5A639416B40C271356C8C37CBFBAA86E579964C85F8B871C",
        "C_D6AB8C1C24557CA6DE44D819F0432B2802C5E7B6285091EE8E19F537397B3A04",
        "CD_3CFCAB1516C75164A42E3401D0ADF64A4765F50E4818FC30D95B8671DE07D069.7.931245301.655",
        "CD_938698B0DF6D498AC9977F56BC06022F271BD32FB79DBFC9EF3962F022C26E04.2615.2676342091.552",
        "C_0A70694BBDE45FE716DBDD82139D079800EE031CE266D9AC5DACE5E061A86710",
        "IR_E75CBCE90B4C0E20DAFFEEAAA1EC804BF8BA7DF9DDF2A9FB208487F0BEA7C47D",
        "C_CE7115C334FCF4CAF18779B5DCE6EE49094B2697F81975FFC890786B7C5BEB22",
        "CD_037F73558996BA2785098F824A14DE2797E69E82C9ABBC6D1677D799C2469137.1806.4187180193.376",
        "CR_AEB1302AC843DE3720FDF5243FA6FA29740C3EF6F87994A8A6D26F14FA996B57",
        "CR_8FBFA6B18AAB7B589FCD4C8B4ABD0E58545EB816B5459111B04088F74A1FA745",
        "C_3596245B8E5FF0EC67AC5C34C00C2E8649D428468BDD701F6037061347573C91",
        "C_4918F636CE6C9B5C75F87478AB3EFCC73FE606FE12C4815A0162B548617F58D0",
        "C_044C6F3044E48C22993C2C07FFE6E4308713F44D28305AEAA2DE9289AE1E867E",
        "kosw{",
        "IL_370D362D24157E77A6D437A1B6E44D31636578C65BA57AE250B7372F533440DE.2457.1240054415.346",
        "CD_0AD8A0F3F46F174E51800DE07BDC378F9D501A3B9BD6CBD74CF3DDC169D713AE.2552.1721869099.1572",
        "Emigrating",
        "CD_563CAEFB32DA9C6DA846FEF0491B998A5AEB53D92D124F8B8C12120BA57E3D17.2421.3841250082.675",
        "CR_2B4521AB2FE85B7E58E501B16EC7C21CBF35FC912BB1BB164FCFBA34D7094CB7",
        "CD_729C810203CC3BEFA1C055392DFA457C6E7FCBABF87C7B3F5286CDF28B07E2DD.2561.2106955326.84",
        "CD_FAA87DA9696C5DDA8779735D0CDD82F772B3863DFCBC34954A3E6021F405A249.2641.2639552925.248",
        "CD_CE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0.1014.1936183842.431",
        "C_06E53B1FABE9E20DE66B403CD7C002DABD1DF053CCB4800AF7F6DF3343C6A73E",
        "IL_E2A1C17D64AC2484E915F0EF57EF0F27CD8B66CF0E3757C335DF40A2CDB774FF.2735.202504523.272",
        "IL_CEBA609A3E6B20C46344175362232618360311BEF67386392A43EC25E09871F9.2681.2293963344.286",
        "C_E9E54EEA82B8A799BAB440BC9A0D51FEA49FF0156E4DB012B3AF1E723AA4EFD5",
        "IL_88BAFDAAB1775EC92264DC013C04AEE63F8417FE6B4B0301EFA0FB0087DBEB76.2678.2779009724.285",
        "CD_A4F5A56059DDF119F4CC303056A7BB3F243745A5AAA1FF57F146D0A87968F7FD.1700.1507292722.395",
        "C_620890A69B80D6D0D8B61CEA61FC6B42048D649BC6C1CA981E37A0A2496AF4AC",
        "R_2A4F98E46770D35357CEB6ADA3489C9F0FD306040FCD6B065CED71BECBE5700A",
        "IL_2235FD99C9DCA9E2C8E02E48675E6EFD99187C58BD8B7D62E52AB935B685C575.2721.2770612800.278",
        "CD_D2A9871B8DC5FB594486947C60152A87A3C7A83CB555AD2675BAA5E80330CBB8.2615.1139468173.391",
        "CD_E8438569A234983E9F3E72114D67C2A8F312591D9F4E7EF448973ABB653C95D9.1074.1169068753.650",
        "CD_93864AC72C045144B9543F656A7A5DDAC273FC07B857F897DAC274D9C967D3A0.1348.3028437413.4328",
        "CD_95487A06B6D41CBAC8C790C1E5D3A7A9702ECA29D2D457476B3523514626C542.1757.2658674815.415",
        "CD_75C9956E7779838B54824FF45E13C905411B41652E6FFADA64041E0E4ECBDBAF.2447.1.11338",
        "CD_E630E2A029E4FDA59B5EE4D96DE915A5BAC16FFA2DD9BD47541BCA0DD720D334.1218.2452364175.1634",
        "C_736DA1BE1383B0FEB2F66F7268F46979989C22B45120DC2F7115B633EBF80496",
        "C_53B74CEF924124DA99B2EAB75089B518E86CCFBAB64AA06B4C27A3C83D4C0958",
        "CD_3FCF421D60410804A360FAE7235BE2446D112B7A0A3E80FC873A1B1F4A21DAC6.2643.3437495545.563",
        "CD_F841B632C0B2584CF30B2004D8CB79959F456B5795456033F557C9A443CA86F0.1070.1651630625.361",
        "I_E45B01D5BC86C668EA1E3AEA6C308E1DB3C69FC7DF942BD06E83B7A46F7DAC24.2672.1086392761.276",
        "C_745B48F3D3663775E674F1AC382685A30C5D61F06F3C74BC6E2C4180489D568F",
        "CR_04614BDB14C273E807C3A761E5E7A888794C56D16B624B2E80A3A0F6D5F3C288",
        "RunMonth",
        "R_AC9AD25BD40B6722261E256701F4549D4AD6E3CDC6187FFACB6CAF3D4F5CC978",
        "020E025F7CF40D004E2BC1C3C9AA54865F4",
        "IL_D691C8444DBCBEA84E492FB8073A93526E27F7AA6DC63C74821F4959311828AA.2721.4087027590.272",
        "I_C2B4B00AE6B2BA2D494F2683CDFC200933ECEC9882BC13F579B1AF87F152E9B6.2709.1140711961.304",
        "C_30AF15919E81B988983A5B979DE55F3F2889A968ADB0D35777060C9D66C4FFDD",
        "IL_C2629265536E4B67B7CF20841D93F9F9BBE1231030610DE7397B02A91673D013.2726.559372530.274",
        "IR_BAE2729FB2A4F61D06933B050C473303CCE7911F610104E1004CA977C52C3E87",
        "Group",
        "CD_4B66FACE2F9688020890084420324926AA3CF21932AD39E8C9ACEA5209F73583.158.1322685382.374",
        "CD_4918F636CE6C9B5C75F87478AB3EFCC73FE606FE12C4815A0162B548617F58D0.1836.1208931703.309",
        "CD_3221B359A5416B849210C8EDE6CA9A31AE77982A28D76140A2605705EA5F2416.139.521622295.1332",
        "CD_C502D67664F16B0C26C80BA30AFBE91ABD4375BB24F8697FCA1AF3070D29CC71.2656.2042732615.256",
        "I_C564EC44991B06EFA52E4258369D8DC85EF34970063BC38CA76DECA10C7EB99B.2726.4244474160.275",
        "CD_94F2726A101D2A1E24F4ECAA94319E60322E839528620ABF5ACEF14DF1CEC5F0.2745.2247079954.358",
        "IL_AF25D8805F3B512CE077E12B9EC07A7664A32A328B0F1BF77828BC5BA1C8AEBC.1187.3049439660.376",
        "CD_234C00C48C3A9C34F82AAA3B652AA3E2A181F3A939430AAEB85DD9A80A3A5915.2621.2950549508.430",
        "CD_9057D65F1A25A157C2ABB405A133D0F21AB61118DC6B4FBB2C013A804086D040.2508.460450649.739",
        "I_8958A856065A7A56EF90AD2CC58B8059F887AA0E946AAC92A0F66322FE07C030.1016.3176728252.324",
        "C_3A281986D2DC73E5FFAF5C10E516D033611D0B81732C1211B5A9AB1B8BCF2D1D",
        "IL_9D15CA27C42BBEC156CF0F243AF08B68DD4A573441ED0FBE81E8CC9CF011567D.2707.2808223030.280",
        "I_4A65EC1EECC64BDE7BFEA0AC1E8C55F72377D3333AD8F6D8D8D37A9EEAD5CD61.2675.3886341657.276",
        "CR_1DE9FB32A31608C0D926707ED4C676D8E34FABC2C5C4559D485897F5E366AF39",
        "CR_E5893386A7B4C018092F4F8B136F60610FB13ED7B0A8A3475C8F55E3E9FBCB90",
        "CD_D91AE55AAC2C2BF7AE9267D8DCCF46D7102A6A518D4310E37C58619F124FC04D.1331.328881226.1536",
        "CD_A3462FA053AF6E151FDA78404CA3481C64A83DCCBF5748EADF4E7C93603C858B.2733.1978160227.783",
        "I_65940DC6219C0A2A56E49507886828639D862B915C2E790ECF4494E290735A03.2714.917675366.290",
        "CD_FAADE44B531DE024B0353D8C1E63935B3A7FF9CC1113545A747C5176FA0E7352.2729.1121561273.201",
        "CD_5CEE3E694DB50EA9714886DD418F6CA358B9A4D6FD8DAFD5BAAA13B6529F39A0.2094.1704387521.535",
        "CD_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396.1132.1.8512",
        "I_FA0D7695DF410841BA6041B3B0FFB22EB0F08380226BCD65BE4061E39ACFEF56.2713.1781841004.273",
        "CD_04C7F4A052153A1B48405988115DDE17865E47F99CF145973E41882C1B4DF5ED.2559.4086414092.81",
        "CD_8BEFE0C3FA9603D25777ADFD7B22B3D62FD05669C5A791CDF5C6C494D608847F.2589.2683005367.1359",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1714.3857813361.211",
        "L. This property is deprecated because page file fragmentation is no longer available. The value returned for this property will always be zero.",
        "WmiMonitorListedFrequencyRanges",
        "UserToSignIn",
        "CD_08958AE641D88CDE3333B847D49BEA2D42C946BF3924FE9A6259F27FADF6495E.1616.3992314593.262",
        "CD_16DADF7B882F03A24B4CBB8BF019AD75A37563B4BB21A28112B781908EB8D5AF.1094.120915773.632",
        "CD_3A2CDBFEB4934B51CE22A85244B85409ECAA6229E2209BA4B6A3962C08B81077.2390.151549696.5376",
        "CD_7F637DAE12A5C57B84338EBF2100C5D2953335CDC28294203995748012501B4E.146.1237694413.619",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1520.23086391.368",
        "Indicates if the item was changed while working offline.  If True, one or more of the remaining properties is also True.",
        "CD_52950D1EFDC3DE67342E2438F8E07B6F40A248B4E32B21A3EBA8DB9797405C1B.2037.43876781.755",
        "CD_0C641AF43E24BC384C9291373FBBEE013FBB02E71DB5BE5F4A078ACA9D6EB46E.33.3994791708.577",
        "CD_C3DDD18CC751033F0FE8F2EEDF22DD83C29417A6B61CFEDBABAD6EA11FB00321.2418.3827117057.234",
        "CR_034DC06A7BA24821E2AA8A94509CDB2B6BBA02EFDD0801948AE379D7CD46E5AA",
        "C_6B75EAE7DA24F2C406780BC48759E37EBF44D76F34B10EF1ACA92766DC0C80B6",
        "C_6B9AC560D28F493249132555B3E41644DBAE7E183CD96D6C4A88332FF1D8E0DC",
        "C_19F23F01E81DD69D7577258538EBF1C8D0852EF9E76BBF75714E72C8A413982D",
        "IL_49B18B28C1F2C29137020041C39C3EC733220FC12A9045519972261C8293ED11.2701.3423949710.272",
        "CD_89FE4ECD715508D84EE36BC94DB9C9AB6DC6A560D227442061D4288D96910660.34.77163695.650",
        "CD_2593546F7F7FAC2B60CA22440D930CA43315D905BCE5BBEB889FEE3F3AF27006.2052.2822248120.152",
        "CD_E17F919984F15CCF479B609DDBC6B5B04373B6814E3C2310098E997AC3827DDD.1583.3528162792.740",
        "I_A86E4FE82D68DC639C18ADBD851C146386472289AADBFBB0866B1EEBE2A6C9CD.2688.4024393650.264",
        "CD_7C0E6300E0AF006C7C643E31F66D95CE8CCD0F68CEDF272CAF8092BD312FFC2C.2554.1937994972.677",
        "ref:Win32_PowerSetting",
        "CD_9F5713D830B7304EAD001C42C4E00347E4DE2BD02D139BF16533BAD8D089A9AC.1604.1494271697.223",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.132.977748666.188",
        "CD_5872AF16FB59CA1F21F2D919AFAC7561AC0FBDAA19BFF7FE9364C3663EA2969D.148.320226209.374",
        "IL_206943529E73516C08F2559AB493655B6ACB01529144AFC5101166B2736BF0DF.2717.1074509884.284",
        "CR_82B5DE0B52236FBA718C6012FF3A7FD447F711EA1896FB5FD863DEC9F4CC1877",
        "CD_DFF237252232921ADE7987E5391E4968B2F362CE0BB4B63D377328B49C8CC5FA.40.4153110936.486",
        "CD_BABA8B3CC6A6141F442ED3F0892F94D169E27C609E94AB277DE73957AD024C83.2583.2915004899.269",
        "CD_0783FC4315F6719B07F6F7780EAC7B73D0B0471C3E21E23BC45CB6B44FFECA8E.5.1.9646",
        "CD_CC6586F4D65EF9450E803F2203B7C9A68B0B78EF2F31FFBE2672214EE70C46CF.1849.2340765007.1243",
        "CD_1E99B42A14C8BDFFB63BA2F8D428227D04A8E5DF131E69A53A073AA04FCE464F.2554.1383827449.1790",
        "18BB43F9FD19B5E02B121082F63046F918F76002425E185ED85C61F",
        "IL_888FEC1136F06804A795537477644171A7A242EA68494828CE09F5182E2929FD.2678.2353104153.284",
        "Vertical polarity type",
        "IL_232A204ED3674E4DD8A1AC408942109BECA0D2D609D1D4D8CDDFAB9386CF0BF3.2710.98987292.298",
        "C_7EFEE45D678860640270CDCB1BC2BD0BB42491B76E477555F802FD273AF27EB2",
        "C_1A1A53BAD8EC584BD47E87E10AA8670CC6D8419F3C4B73FA6EEAB440322DC0D1",
        "ValueMap",
        "CD_A883D58443A0276690606F149210FB8EEC2F26A746B711BB5A87FB7EE2B3D5F7.2644.2891925891.245",
        "CD_034DC06A7BA24821E2AA8A94509CDB2B6BBA02EFDD0801948AE379D7CD46E5AA.1962.1.8201",
        "CD_FA26B3AB039983C42BFEA6183B0636B462D5A8C2A474808A0AA419D892800FDB.1197.1782621102.431",
        "U - The update (e.g. errata, patch, ..., in numeric form).",
        "C_5E38482AA73EA29B759E8DA322C89333B6EB11675AB299997E04B67232DA3442",
        "CD_D3C9044B159C496421A96D1C29415B1FCCE8B1F381A6F6000E544FCF3C9C536C.94.1021800008.641",
        "Scsi Interface Error",
        "IR_FD64A52CC0B7981195F173477472F4CA7515294815503FA15EE5A180A24C6DE8",
        "CD_3A2CDBFEB4934B51CE22A85244B85409ECAA6229E2209BA4B6A3962C08B81077.1960.3169922884.4480",
        "CR_A91F5860FAF4D61BB59DF2B1BBEB7B81236143770F1F0AA075F34F7FF7BBC1EC",
        "I_6CB44413DE06159E1A76930DECB884456218DBEAAF79A37FABA402E7EDEE6F05.2712.173192057.285",
        "RemoteAddressRanges",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1751.3522617866.368",
        "CD_57449ACD70FEFA4A9244BC6602923E1E3724196FF8E92DE84A20334BA2CBF157.1757.3964023862.211",
        "C_8AAFE17C9D1EC81145315BD7AEF4364750F7DBC256E4CC6ED0176BB03612DF3D",
        "IL_B1667544AF8E4C19F378158B5E86E2D6FC791BB9FE99815DFDFDB12507793FB4.2725.410076186.281",
        "I_1288A9F7AA57049E9963E48CE6150F40D8080204ED4013CE91E0269EB74BD0EA.2721.1397381558.271",
        "C_81F5CC7DCEFB1E634599916220181F35C3DB70B94808983CB78C381325F1AAF3",
        "CD_486709A1BC1AEA1713B7B7854CB54E0BA9471BB018357C834E1DD6BAF7DE7457.37.1828699760.365",
        "CD_CAC510593AC97614DC7DA1F7D9C423B2F603C46FDE077301A4FCF1E4C1DF7D3A.2598.453660771.1714",
        "CD_9E80816304B77C3F7FB69E6FA27E369EEAF4355C2560E5D96A7A1A687778DD04.1667.2123992988.398",
        "CD_DE5458D3BFF2A527DD725F3F09E672B546B170976DDC415866356D5387ABFF2B.2662.3768361459.1004",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1973.2882004949.180",
        "Terminate (4) stops the job cleanly, saving data, preserving the state, and shutting down all underlying processes in an orderly manner. ",
        "I_993D150D0C9C8AECC30617FB0FF207B447C72B60CB9837CA152ECAA0421F80ED.533.1.143317",
        "CD_57839BB831B678823813D6DE5621B2492B8DEE2CAA3C37F3643245385D720644.146.1052046154.744",
        "IL_61D4B20454D9364143E7FCDD696A05EA880F3DCC132A499B1EBCE94AEC8918AE.1192.2086484367.345",
        "CD_529BECC83D26140D1AC72C286E31F3E47F269358AC822318B473E243E5CBE961.312.1722743268.225",
        "C_0A88143E1C3CA6AAD532712FF8639D26F391192D06CCAD53461A69205DC057F1",
        "R_FC8B41EB78B371A9156F12694B821F06ED5FAA1A372B17839CA0FE6258178DAA",
        "CD_0F6F4793DA673F1C347C3D8CA2454121EC5D32EA0CAF379FB0C0BF42C511B174.38.3368124563.483",
        "C_8125E110531A89ED8BE4900320A962FACBC3DD4F09BA92855250F1BACABA704B",
        "IL_19F19EBDE3623ACE5D56C39A41365A30232EF811B7476015E216C83EE09FF62E.2695.2399593920.273",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1520.23086391.368",
        "I_D06E059A85457A6E717907422F19AC6395529A2FEB736C01CF15AA098D540570.2709.2645312123.301",
        "CD_5EA07488A9CBC676B6ADCCAF378807D330C6A6A97786CF041307B3FDB3A6030B.1980.1726229958.6268",
        "CD_4C642D2B89C402F98BEF8001509F1DE3617255E018BCFA335461429EC035DEF2.1188.2206778927.463",
        "CD_8D99B89B2E26FAE38502F957460FFF2E9E23E0C0D9AA3DEF32147EBB968C38FA.1390.1.15242",
        "IL_E21083758A128727DEF6FF7FB30AAB8529BDD6F7C5C936DBCA6F06226211C86C.853.1.52579",
        "I_3202E2187BA7689CF3FAD4EFBEB7B7562AC421E133ADF510F6B92B8E83C62AFB.2683.1225603294.276",
        "CD_B4744AE091F96C1897CB0086813E1AABE89C9AB276818B172EDE2A19A9884429.2762.2406404756.348",
        "MSFT_NetConSecRuleFilterByProtocolPort",
        "SECAM L",
        "C_70E019181198CB42C1737293D79C34B6386D677E681DFCF2E02DF64B188202F0",
        "Access Denied",
        "CD_D3EEBB9E3A4C5F3CA348B142AF6727D3A274A152187FB63005FF1EA0DBF75FAE.1150.743300544.535",
        "Detailed traces from intermediate steps",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1936.209648323.368",
        "C_115C2C7C875DAA2D80858EAB217D4BA6077F4CCDF9EB9B75A301CD68389427E6",
        "IL_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6.1489.842082542.306",
        "C_6F0D8E2F04D5D3DCE1350E4B57DB0FA341A8C158D4643133343B2B466D133233",
        "IL_18B6D4EB7C4A1ECD9E8ACA9EE4BB46AFABE66672A92365FB5A8AEA913BD3EDDC.1751.21967571.185",
        "I_33BC2BEA66F6645C36425FE53101C96DAE9DDAC259ACCCEE668442448E6B9A36.2681.980888045.277",
        "C_CC8A06D68AE379FE41054DF5884BDC711740AAD2D1E5857EA8F880E09E3E9053",
        "CD_D853AB6209D8A11783FB9991FAFED1455C3BE9CAE115768B2C2CE0E0FB306714.31.194136400.588",
        "R_8153493099CF20330B6936E25C7342871A006692E7810F7E6C13835235C006F4.2469.3349329370.554",
        "C_EC28E29E31F548462327C3037DF69482A82EBE159236DA81AE2E5AA78F5CFB04",
        "{3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c}",
        "CD_15AA9E5C08C912088DB12148021E6F808EE6412DBA54846E39AFBD33E4BDE769.2420.2586693228.681",
        "CD_CE6FCCCBDF3E0139B08C5FFFB4D0F2AF40864CC7B7E000C38C0F3B168FA0E2DD.2514.1.47479",
        "C_94B88A78767EBA5CE84C8290634E59CF138F89C614389740E3EA6521391C28D8",
        "C_989A756437E7CA88FBC7B02B2174A854DCAA4C2FAD8748FBC3EE0CBE0831C536",
        "IR_D12143430C7364F664246587C136FFB74F8C90689FF9A1B0AEB7B9442A0BC274",
        "AllowInboundRouterRequest",
        "R_D25F6977140D68687C8B3B28B24AB8D2A1D7F207F13800D7E3DC961D0C563679.2736.1055817878.552",
        "CD_829131EDC6839DA24011A54FBEA38B1D13A2BDFBD97A229CCB462F4A95FA5DB7.36.3470487138.366",
        "CD_F048CF2C454CB8BAA99C1A4118013AD0A4526AC70F8F00D9BC60DB068406C882.1955.2865402409.391",
        "CD_AF2AF60829ACDBE308127B32BFD1BBDF676C4E12F2E511DCE55236AD4CD567EC.2442.4239096811.742",
        "IL_16AFD614190C0A361437D059E30B718DD18F5611483A917B9ED102EC39154E5D.2683.987516869.281",
        "IL_66E6CB76E1CBB5C5C14CAA8D90DA0CEC84C6EFA9E1FDA743B2C669976130E260.1490.58942205.328",
        "IL_667EA58A0484423AFFEC003062277643E0261EC15CCFCFA44CCDE83A07A16ACF.2705.225742283.289",
        "C_EDDF316486234851D86580CFE9B06D5A43E06F671105861787434F12D58AD4EC",
        "bject's Description property.",
        "I_64FAF3B4E87C22CC08CA793A88173C2DEB757548ACDC18193164EA1980998E80.2717.359657752.284",
        "IL_C6695DB36E1BFC2634FC6EE947808674BAE92D29FC531433E45B528F1E959472.2699.2174159664.281",
        "CR_2E01D6AE66069E61FE9FBEB254EE45B257107A95EB7A55FBD179811B508038C6",
        "CD_F060FA1BEB1E1ABE21F8F41E5434AA241BD7259FD83E7DA0D4CBCF6D857A2A7D.2555.1203436740.523",
        "IL_192AEF8A3D6A39061991F2254BC36EF440E5040B4F97A934BB327ECAD687AEF7.2503.3307781390.330",
        "FileSystem",
        "IL_E40C545DE280620436CE0030551EE24EC29A8152771DF27B4A4E1073B1DE4DEC.297.3171292242.191",
        "]90EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "C_3F67FA0166F0C8A24B462CDA43C543F340CD7BDE061E1F57A0BF997BF74531EB",
        "IL_DCCDA299E3D2E513C9259A1F5517188FED6274DFF5B45EB28FAAFF66B3DE8928.2725.1727203039.283",
        "CR_E7B3BF5CA85CDF3ABB8EF64431ED7D1A67B9FD70D9D851344D21F9BEA7F92B3E",
        "__InstanceProviderRegistration",
        "C_8D36CA25014FC3D1E225A7C28F608753348B2A8115F75C792A0330884C670CDB",
        "CD_98B52A08A953316DB082D59EC1D28C173ED16648A244894BFBE6E9E36C229250.2018.1508314758.5069",
        "I_8A5AD65B06F7A25401CBAA52F8D2CEFD2985704A647EAE4C6FDF828C68BAA46F.2702.361491930.271",
        "CD_8005FAC3261894B05944F0070A29BE32799EA7111782F3437D1C0F7794E4D4FE.2583.4141731541.601",
        "CD_174A2AEB54BD548E043873CC69AA038DD6DC3AC5FE2EA12ED542CDBBEFBB3320.1700.2284182261.344",
        "R_097B2F9E0FE36EC7F3877350AB1E8E8E0879DBC3C32560F4916D3C7C564BDDF7.290.3208422924.514",
        "CD_B05CCAA71F3A61FD632B96A8D0CBAC4A42DD424FB85CD76DB922673FA7A32DD9.185.1512338425.855",
        "IL_C74BD3D83B700E69C77B81DDAD3ED0E66B7A9A79BBF6FD9D5150DEDAB809149C.2695.3781963116.277",
        "VerticalRefreshRateNumerator",
        "RSOP_GPO",
        "IL_282604F18A2EF3A03BD955224BE275C1C416978D6FF3BF120A0F162901AD6A47.2704.835497857.291",
        "CD_3F67FA0166F0C8A24B462CDA43C543F340CD7BDE061E1F57A0BF997BF74531EB.108.3807617789.2323",
        "CR_C1AE8E83DBC2736145A9E1FDDBAB7977992014FACBCB21CA209B94E19685EE62",
        "CD_115C2C7C875DAA2D80858EAB217D4BA6077F4CCDF9EB9B75A301CD68389427E6.158.1623843520.263",
        "CR_752C67D757A6F2589FDF45E2D269397D4C432586AD444D4E1B04E468FF08F446",
        "IL_1E59813E7045B8656EFFCBCD5C1862D995CA0F602D3213FEC6EFBA0ED3F2AD29.311.697620915.249",
        "R_BC68F03B4B8F91EBABF0C9EFED9C57ABF605182A4D8760A0679947CF4F1C5F19",
        "IL_76EE988FFB3620C1454517ACB416C23DC74264F3DAF163C2045A6A0579E07810.2676.2380974560.279",
        "IL_F63CF3E14D74019559889A52EAECDC75281D7CB9F2BF83BB9B1E966CA8396563.2727.2243417145.284",
        "IL_8493808F7005A147F054C4D110780BCFD9E3EC20F3312DB0FADE1B7AFAC3A8C3.2736.1404794398.274",
        "C_664AF66B21C2039DE71ED4563B6D82F78FB404975A3235A5DEEC63FCFAD8513C",
        "CD_29E8AA5244375C87F1F5AB9F42A22D9A1B648F420047277D7A92CD564C59256E.144.625988606.891",
        "C_ACE6286BD25F0AA2207D2355DA74065D91E7CE838C5E66A6FF0F8AF0C177656D",
        "C_F2BF551D2C47E413C4BD58FCB0E48E0B3211C53383EC4051E655BB8319ADD47D",
        "I_DBD7AF9DEFC2C1F32F15A7484FAC66DB64514443ECC9249299A66A38ECA5BAFA.2711.745061077.290",
        "NQTWZ]",
        "C_2D5BE2B23BA8B748FE728A0E39B335CC2B3500262599CB2529C98BB713577B01",
        "CR_3934CBC8B9BF633BD2177FD587E49EB900491D088D14CD34FD22E79571DFC824",
        "DefaultScale",
        "I_5E23D07DF89AAE013A4888DE155DEF770B5023A4803B58A3746F93A4462C2343.2536.1527542584.281",
        "CD_87CE846EC002DBA12914102AFF6ED89E0F6DD6CA407A1F7C8C0CBFF801124A9B.2418.2433346185.363",
        "C_2435F543C14D77EBC0F0A1B12249B8DC7F253A838F1A9C04985BEFFC4FAC101B",
        "CR_BA7526B37D90714D7B62CC8C0306D68C0FA9CA2FF62FAB9215A612E133C74CD5",
        "C_EAB06445AE40CB0AB3321BBA04962C98586E49396B67AFD5B74F4985163D9EC2",
        "C_CC0ACF58FA3646F311BC16A78942AC6DB48973323025BC27052C3593D5CE6061",
        "I_4CF85043460E3B2B5B63DC6AAD0A6E2078DE7199CCF0E11FCF9B933447CE9C1D.2681.2634585345.280",
        "I_1A09D3486215F20BDFAA7E56D30F553A48030F870E69001995D1776DC25DF065.2693.2324765641.279",
        "IL_5CA6226339CDEC0181D588BAE34D46FD8F5E18E93D5ED51ED2B3875AC5F5414E.2724.3655576709.283",
        "CD_8D36CA25014FC3D1E225A7C28F608753348B2A8115F75C792A0330884C670CDB.1196.4253719610.446",
        "IL_D3A9CAB2761DC804371F8FDABC0EB9F3FEAD0DB8101BDE0C5FDA41AA96374B24.2713.2559073085.279",
        "CD_FAE2ECC09FED2EB4B7A4EC8980CE634E75CF805CEDF86064A82170B68F9B5074.1526.3860091587.357",
        "HP MPE",
        "CD_8C8DB0E3672C93BCFCB76BF699D523B44C6A3F2E7E6E6A3EE64DFD7FDA4D0554.1579.1397533682.985",
        "CD_7D26F1E16BC9CE86FDDDA09E425A859A3BF87CD94B9004A4B2B575CD1EF41374.1082.3936774337.638",
        "CD_9775D7E59301DC60631DCE98F8981384E13FBB752E9A4E20554B45DDF5046735.2528.3323910669.1959",
        "C_FF3F8092D51DC6205402036D2FD6093424ECB5C60982335F342BEB529DB60880",
        "C_06D136F7B0ADFCDC593CD2915E41E046885B6FE2B8DA0198F3B2B133CE772261",
        "CD_E7ACEB5389BA8C32B04736209B872B130DCE3B94FF3A17F3972AEE3EFE29C3CE.2763.2940913420.324",
        "IL_100109F264418A8891B8DA48D69393178E571025D114D35005EB8841D88FAEA5.1163.3162972686.263",
        "CD_2870C542381ACC297B648158CD3FEA1F43D21FAB563F1F7A7AA10504379136A1.2634.1766002601.280",
        "IL_C57031BF52A2FCEEE38A298F97F91A031385653D8334A9746F7BF0F674DC1476.2693.2144678920.271",
        "CD_6C756EB273723D495E0077DD8DF32546A295F700D41FDDFEE417E7E6BD757CE9.2574.1263200516.222",
        "CD_9FC6DCD975DB936A96BDA112F630B5077DFAC45847E4C4ADA37D138916DD09C7.2542.4127870025.506",
        "OSW[_cfilorux{",
        "ROOT\\cimv2\\ms_409",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.1131.166110832.188",
        "I_197A2679B3DF75CD3636EE6A0849CE2AD5E7A139F32B6804AC870131AD5DCD94.1151.2791834078.604",
        "CR_5F2E90A9A61A21E31A81AEB905C87625CB9816F843D7A0D3E82978F41D9AF6B3",
        "CD_8E41820F5D3747F37A9AFB4C6D31D95936F76250DC1731B0B518951FA4D1C211.2028.1.18314",
        "Thread_V2",
        "I_1035B0F62EAAECC9C984E7834D0AB6A9928506852D8C840D14F9BAB2AAE4A68B.1535.3905241281.262",
        "I_663060429A6938D1B4C13319904DC9CB4D95E1E1D71EE9B0A8EA8DACAE58E45C.516.1.45904",
        "C_7F8BC20174A1A32E04A841C793C95C7E0241B308E1D3B8DC5972DC5E979D02C3",
        "C_9D4D42EF4D46EC567E6840F10CFA556BDE7CBE6C48D995FDA290957FB3CB6CCF",
        "CD_DA8AC0D78FD1B90698550FC0FF5C609171143A2B0FA32F0B779BC5DC2D3441C8.37.124095850.961",
        "Number of the sensor that generated the event",
        "IL_BC7C5EB197B5616538EF4A2537CF0ACB8ADFCD77134622191BFAD44A946A34F0.1352.2211812683.194",
        "Identifies the GPO that contains this Policy Object",
        "IL_60FE62CC590A046D73FF6995A02E1BEE389B879032494DEF607C4D24A9672B79.2714.1880317712.285",
        "C_39937D1A990EDB6E14CA46EA323A9EE91A51DB10D306E4059B3A249A61F356A4",
        "I_5CC34176421F47CAC35062197F8A17036171A98B1F40EBC1A2860E5AB784E21A.2696.2884669679.269",
        "f`?ZBEHKoN",
        "R_C21BFFFCE15B0AC36B6B41107E5EBBFA7DCF9522B5F1767BA6C1E65ABBEDE3D8",
        "CR_41DBF5B1870AF9F0B77D7680767E231A2460610113F21236505A5E4A30EFFCA6",
        "CD_90474CF00D4AF038E01AFFE1D325BE4CFECCFEC8C771DBEF31ED1256C9A59468.2528.371700746.656",
        "CD_6CF03ABA0A6CA2F854B8C58954D7188DD4D4BBEA9CB1269949BBB74D50A3F4A4.1192.1999427008.617",
        "C_78FA9D111B7CF0DEE8224D3C3786A340C11D0822D9189C4C7744F02CD1A1D627",
        "C_D00A9CA0B8551E2EA506854DE0AF73821A38223CA203843922AACA9957177697",
        "CD_C1EDB2C3B16B75C05D994CBAD887CFED943CA4B2E1180F3891F60984B8988B63.113.264762296.4732",
        "C_3CFCAB1516C75164A42E3401D0ADF64A4765F50E4818FC30D95B8671DE07D069",
        "C_6D294564BCF9623048C8EF258EF84596CA931F72FA8476A8D1B3C2E5E28C03AF",
        "C_A04AEDF73C419CEF5529A2C6EC9E3BD525C377B8B911A8277E85A9D06A3F81E7",
        "CR_EA2F4ED6B8AA0BEEE14A7235028BAD0C1DDD97703732E8317B8FE1581E43A3CF",
        "IL_2514C9BB750D6214ACD0788B5C2CF2B1F3C6214009885421A2A43B7121A35A21.2676.828162062.293",
        "R_E0728E680677E2DC755DB0B32FACA9688F4B71D12279046ADFB604C5714997EF",
        "CD_F78D535F784AB5BF2A7DF53DE5ACAAF1C73DACC48189425DF45543879C147259.21.3889884863.562",
        "CD_A65407F850C2BCA806A67DD48A46ADD12B41F479B7F5CB65FF34B01AEAFD8220.1464.633503662.839",
        "CD_BB8321A9CF60C9B6CCADFE1AAF2E8175C07048B64700ED07EA66CFC1D4F44BD6.1924.639728162.280",
        "C_B3F4A5E799165E5BA2CB97AE575C11DCA4F6D7931E6C7C903A686A45D038C618",
        "CD_CC18C1970080B4FFF58C595866822F3DA823CFBA977008C1C68DD95950E96D07.1152.4088546668.569",
        "CD_33CF99EE359367737EBFC91E6221019D46F7219044317527292271867795E5F8.1086.2690151117.349",
        "CD_0CBFFE574FB1083943BF455D0289FB753DE3C367B01850F06C12D786A0419EFE.2534.4098292280.5680",
        "CD_35FE0F2AF2D5B86CBC794195519170432F5D5323DD65B59310A1399B7795BD77.131.2492497416.615",
        "CD_E5A20910252EEA78644C76F168B544D447F632499909956FAE095522E886AD9A.2555.4137072902.525",
        "C_F942F52D9B767F4E0AC3367636949CF0E5E8CC570A3A6EB594B1DD3DD8DE68E0",
        "CD_1BEC388ED8B3DBC0D0D66BF6CA421BBFADBD5A16B9BFFBD5E8B6E83ED38EB253.2113.1859148367.4249",
        "CD_8E07A2F75E966B98765D0E68961E5A84D43A10AD950CED298EB40220B7B9296C.295.3702337040.790",
        "CD_F240740A6343B96130E943F35BCF5AADCB883B78ADB87BD0CB95A949CD8BE1DD.1991.388265185.554",
        "CR_CEDA967BE18BB6CFCE80E11488429372F9B550100D4D99059A8B8A740BD83EBB",
        "I_274125530D008215D8CB18263720C7219B09FB41743DBD5128545D1A7CE5A3B8.2685.986932993.278",
        "IL_5168D0B4A17AF61C869189B9ECADC0C8A5A38A6081627D231985143C518DC742.1090.3344568924.377",
        "CD_5F3A7D47CFF70177272CA0960C1975D28A99D9A71A82E07B0FC43A060E86CD93.1150.2020073622.269",
        "CD_FDBDC2AD47D9111246F3C36A212EEF164FF61E31A8B334E0CB50FB22BA107100.215.2415549140.1298",
        "I_72E5F0C9F48847EEEA80E82BD31EA5BC305F1CAE8D63359057BA1052627E5C1B.2726.1399690332.279",
        "CD_AD0407846647AF6A2377C94BA8FC90066E9C0297CFF3D89B5F5DD4866C06DC06.2655.3248228710.396",
        "CD_617078A282C296F16FDA4FC3665269447941CDEC40E1BB6751C41F90923B5D50.1849.1225856342.293",
        "IL_8306F1354864AE1F5B32872474B76EB97820FBB1C9EEF8B036946CB0ED5E531E.1051.4223633249.299",
        "C_1333CB41C7BFD90D640EF18568976AC9246A93F3945F32BDDD813256745C7061",
        "I_978376518E471F1EDC2EA4BBDEEB5D55BFADCB6B5EB71C1895A371B13A6D17A9.2705.3702915233.290",
        "CD_A188848719F320C94F375EEE54D40059ABF083373A9064154047735B8379D3A2.2613.351945358.407",
        "IL_758767A138065C58C7C2FD020F199EF93645B9F6B698FF67697C3888260DED30.2687.3715777110.264",
        "CD_D32DA41D9017CF8A14ADDF68399E82398D01887534F91B652E82F022449D154F.2590.2820036826.1054",
        "I_42D7FC2A9817D6233DE6EAC6B89E74C23962D01ED8F714F51DAAE0E7D144D752.2675.31539601.286",
        "CD_88A0C7A0E72AE74936AEC0157B4B96E83CEA40238281088709B5DB02867E7CD2.43.3847284496.621",
        "IL_774C0D3FB90D8C3708FCA060B0FD40C7A62E78F386D82A25E0A3213CB29DF03B.2697.2198964765.284",
        "C_0A6750C7348B537B441FD2B8326BDF41C8B5D59AA69254D1D9F804769C8106B9",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2088.499941908.188",
        "CD_4956F7377CADF88BAEF29AB167534942D2330E0E6BECB3AE4512BFCC91561A1E.1784.511022727.1321",
        "7EA867BCB13ED7FDCA6FFE780220289B76EE6569D609F63.2726.376950452.284",
        "CD_DD5FB0C236A2C7E56EED8B73266A6183C862797CCE8508CAC667A1549566FB77.2628.4039475570.569",
        "CR_80F2A8BB68908972D2F32AF3261534B465EDA63A51C25EED6DC37566B11B9550",
        "CD_D8BEC467EA6717066477C35FFA771DC325A01CAD232BDD75CF5D7DED469A2442.1582.3978865073.425",
        "C_1E374C5CBDEECC7830AB4BADC56B9C8330C5C89908E9DD8A429AF2525AF02748",
        "CD_29DECD57CEAC20C8FBE48C1CEA8F70E0F53A065C3A111386C70723311B9A2585.2163.497980368.326",
        "I_036F0F01BF2A6AD8DDA7AD1F3FC951FD32543EA05CF01D5246A94A1782FA9375.2728.257466889.279",
        "CD_6280E46A87C75596CAACC83CECF9B9CEB7D9AE5CA38D3447D92B685A2CE32926.1936.197350748.1160",
        "CD_D38B3C9A7ADBDFA86718C75F06DD0E52B783C225D8399E8BFAE7D86BC2E5E7A1.2548.1160872547.1555",
        "CD_756ADF3A38037C884D036F3D193150C71CD696CC6C340246CD1DB26B98747BF7.2745.2510820613.296",
        "CD_C48F0C590442CE3C69A9849B8A3935A404E7F5CEC09E5AFE1A03E881F81C2AE4.1606.2539621312.216",
        "IR_D5015F0F522081FD020EE5B4501E138DF661E57BB72BDD7C27479EFFDC65FAEE",
        "CD_C17EBBF86D4537DC1A3044DCC316F63FF8183E01B0197617CF6F88A826A1D730.1734.1122796058.527",
        "CD_485DE6FD5B7FABB57148D51FF4971D53D237B9A8E1B6DF50C62BD5AB1731516A.312.433634526.407",
        "IL_05F9DE9C62C7626142F8FA4D6504D398EBE27021BEEB74B678C8DC359DBA5A85.2728.932839526.300",
        "C_EDE577A8A15423BBFE9C00990ED0C7E143C04BE0A74BB383E3DB27D47D587D26",
        "R_F7081F5A6CF52C9F216602AC246801E052220B10F614083361A2E39F71967154.2458.1636221751.554",
        "IL_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.3705192055.338",
        "C_5D9E67BE198A8E81AA13F027AA2366ADADB02EF88FD8930F2AA57C80C865222F",
        "CD_20EA07CEE9CA490CA033FB2C117DB216DD2382445258C0099435360113084CE8.1188.3082289951.314",
        "CR_D16B91CE54438C2B0BC70CA30F18A1D01B64E1D3178977285B1DE67A30CFD3CE",
        "C_DC16628F9EDFDD2FE0E1ED0CAF96040BF2D9449BF945A01E471B0FA0F63C4399",
        "PAL N",
        "IL_4E4095F9EC17EB909E41364F64990241F2B4AFF71A980DDB6074D12F3A7CFA73.2684.3820619885.292",
        "C_B29A98A457D552021C22397B9BC80DAB495B9438E1192734D106326447E57C79",
        "I_A1510C6BB269195E4C4132E154A1A13BA6F6D857198BE9112475CFA673DCB04C.2727.1503818861.278",
        "I_82F0AA04B23AF43855F7FB541B789F7C0718B3109E5194397CDB06469139838F.2680.204457605.278",
        "CD_A8D7D05E30C15984C36B978D9865EFFD857B3D0BF5D2F0230858282BB5082506.1784.447223338.447",
        "MDM_ClientCertificateInstall_SCEP01_01",
        "004A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "CR_31380B1CBE2DE48F4953061E943634793359C618E73F753682430004D4E36FB0",
        "C_2962574DBABC9D74020CE2DACD4F495EE01650AB6A58D69BDFEB23855FE777E7",
        "C_E6693E875674598B86E9046055C21F06E3880E36F7B4D4AB3B0150ED979EA8CB",
        "C_754E5946CBB29D1190B8A84A81859EECBF1905D53963E568FAE53B4A9E6590F4",
        "C_6C756EB273723D495E0077DD8DF32546A295F700D41FDDFEE417E7E6BD757CE9",
        "CR_04C7B00B843DD535EEFF8ADBC90D1E1778B3D8338A06E37E21692258CCC50FA9",
        "I_466F1E826D19323DB7FFE80040B5ADD211A417F90EF997C2716C16E499FAECE7.2695.2286163046.273",
        "CD_76F06702E66816F9A4EE931DBEF795220B2BBD5798222D30A793AAB4882409B7.43.1938987298.902",
        "CD_7B5ADFA4ED7A8BAEBEA3D33835D773079137AF910C6A6BB79C44E772F2B6859D.2595.2552622185.389",
        "IL_016734F04B55BB34A8311F1A033796CC5BC120FBAF936F8F31D014C66F4C2EEA.2686.2374076731.283",
        "INTAP",
        "IL_B6D033477C6B8B5D60D031921790B770C7EF4153C0783CF661BC4BFF95C235B6.2715.1917873520.270",
        "CD_A340B5A350335A2F698A9D474151FF7803797C56DD9A727636F061641184011B.1090.2855886365.205",
        "CR_60A55C37A891C02E43DCC85CF24FBB0AEC4CE837463192AE3DF9F07B12D58EBF",
        "IL_7B158C54C75004C9A039B513F2FF968C8300241BB4250EACC8C8B214487EF6CB.2677.1803306854.280",
        "I_3E04E6F3254C134840BF0F056A5058B1EB252D06E163C8A8100B91C97A8B0786.2713.3602186287.300",
        "C_318C41B790C73AD23330721F5FA83CE8CB8B0D762F5F83DFC686FAFD74664F53",
        "I_2CC7D5D6072B5D4DB964533E1ADBEBB6F25582E0CEA5BD1409F44D8621637942.2716.3209016908.273",
        "CD_C80F6E9FDDA5B4FCB7E91E04A37B343ACE2C1B4C4C7D997B61E1037420FC6413.2011.3937245462.1403",
        "I_0B880713D9DDD00F98918C43E596B37E54E0FCC69C63C301BFAD6A21567EB1D1.2736.1618109958.314",
        "CD_2E1AFD899A7DF39A097EBCA4A5DC0A90DC9AF124AFF6ACFDEB2EDD704346E50D.2585.3144351522.474",
        "C_1FACEC34E49F2E9F065E133CA4A862C83EC2D73C36F189500659A6F90DEF8727",
        "C_631F6991291DF744F9E35F63A520D11CED943E46A9F1CCC9FE101C11E3B1E157",
        "CD_04C7B00B843DD535EEFF8ADBC90D1E1778B3D8338A06E37E21692258CCC50FA9.2606.3384628047.115",
        "I_1B14156D758E46F2F22649270CADAEC43C61384D4942A6355DA7E6DC097F026A.2685.1971146625.259",
        "    <supportedComponents>",
        "TRACE_LEVEL_WARNINGTRACE_LEVEL_INFORMATION",
        "I_E7C8D1A4E2346FFDEE37907DDFF48B4344B5DAFEE4B2DF86123B0112A39FA3BD.1932.1017258022.256",
        "CD_43D2FF9F27C9DEB49402058FFFFEABC225D67F17C30DC663FA2980525D05DB01.1671.1261015942.363",
        "CD_803E283D75B31FC987B7EC08347BA9088A22475CEE4377C7AE84C9F0F1991181.1667.1254924834.995",
        "C_3977327DA4A684093CBB0BF33A8E056D65F56091BF9001EAC76FCC8E0072BCF0",
        "C_5CEE3E694DB50EA9714886DD418F6CA358B9A4D6FD8DAFD5BAAA13B6529F39A0",
        "CD_A7FECC21424DD62A9349C934969747482C567805103F48A0D0D942C0F6B52DD7.1206.1.18279",
        "CD_7BC06DFC2CCE54A0D578DEA59EBB1A8ADB06CF1508741E02D2DCC0BB4C755E69.1383.1.23108",
        "C_1487B33C97E71F69AA0345641EFEF13BD7DA6F4C2559FDB4EC81D5B8CAB2B199",
        "IL_F0E87F1679DB786B033D4F291294C732A80A8DE66D6ECA32F416D6AA364D7B99.2683.148135701.273",
        "IL_A1E612644DE674C3CD876D5F509A24C64EA8F50E32BA1758ABE393BE3AD21743.2679.2669350209.276",
        "C_F4CCDC8609D32257535E7A999BF7C9477C973FD53B9B19B85FFD5EEE88F83086",
        "CD_0670B73B6B090142BD85762A0781366FE00115AA7451B9B2750B5D23B1B3C0EE.124.2632803513.4701",
        "C_6F5E24AC748A29DF918F7CE4EA2B3D8D867FC6A446F47DAA736D335E6FD33CDD",
        "IL_88D2F2C5D39410C5A7BE26450BA5AD61E3C6EA771038DB40F4AF5A55C2EEF5DB.2698.1799121420.280",
        "CD_5F07E9A66A14C03CEA70F14BB69F6D6A77D54ED7E0162E55A1871003B04B5B0D.151.3833733109.3472",
        "C_C115FD7EBD2AB6801350A281A89F2162617647EA80518CDB3FE4A4DD49B0428E",
        "CD_9D6744533171E0AA4C64E98982376A00322E3135FA3701918441437BEC34C877.1090.2481674859.179",
        "CD_065EB15DF476F783A483B00F674DFF856DF35C72E87B7E414EE69BE5DF4E9372.1067.1973168921.1857",
        "C_5B55CC60E350D260A8F85A1D6D077A9EC7EC36F61E7CF7459841A5E66A160FAF",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.1756.887394704.297",
        "CD_E4C1DCFCCD28567D4AA147AE314111F8BAD2049466833D39D09F05CA71256EE6.2554.3928509688.520",
        "CD_7452F14093AA45A6FA141E92387672987578A9B50AFBD7A89E994756201A5879.2666.2872487075.240",
        "CD_620890A69B80D6D0D8B61CEA61FC6B42048D649BC6C1CA981E37A0A2496AF4AC.2582.2228259088.629",
        "MSNdis",
        "C_9B47552D4116308DF54B1B8BABEB3824E2EAF0C2CFA9CF24D51A58C19C8849E8",
        "CD_B7706B28FDE42900BD4C0DBC550087B0F05CF9BC30AB26E796AD48A7E503711E.30.2327182197.513",
        "C_B993D3DEB5E46C275A88F026AF84776EAF4571D8631295ABECA2B76A62F379E8",
        "C_7B80BB9B980E08807703E2208510514F434259D517AD9393FAE73145E633CF1C",
        "I_D749D16038907A301AC2259F4763797B1FCD436A2D79078ED372DB0A4964A693.2721.2325676323.267",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2489.121641068.180",
        "IL_F0D7D27CA58F49F3CE8F17BA3D8E77591279CB75F59D8A3D3291E84A28AA6CE9.2677.2063022300.277",
        "CD_D821F8DA4BB17D06861EA625B573DB6B0B2A831564E8C02E1D4046ADA0C2D7FB.92.1539259650.1167",
        "C_EEBD2BE4BA10C80A9A5F5BEB9204D5ECE3D09C35A05EAE250976FE5992E25678",
        "IL_03EDBEA0B26E95DAF602708173A280941CE4510066EAE0F07753492A3AA559B9.1049.2066504159.367",
        "KI_43C86C3E5B2B7F1DD0443A6DA4E17AA95D65F56EE0C19CF4FD3B5D9A5F63C522",
        "CD_592AD4245F5967C5343D00E56AE24D1F0F5CE094EF04D954AC81ECB94104BFA6.270.675895771.538",
        "CD_DDCE0EEC8025DB3F389EB360CE7C50BBC0E131D334E8FAB08585F4C0CA2A98A2.2114.2680711418.526",
        "C_DACB9CF054C4E86C828A247EC8DC850FA3036240686D11B03BDFBEB866D387C6",
        "CD_27470116CCECB22A5C95C6629B51C5286889D16DB6D6BE89E89D3658B40E9BB0.1922.1601857184.279",
        "CD_F288534564F7CEA5A7BE0115B4FF5B20B967ADA096D3CA8E077825C980B49E14.1741.2768674400.355",
        "CD_88D65C8A4F22A2ABDB6E8A17C6C608ACE5D4FC3E07DE8522268AAE96ED98B9CB.2520.1493036161.1386",
        "CD_C0B311FB88D088E1FF41B26AAA753EA711EA8CEB4414671F02FC20238411A83D.2632.2198550609.1536",
        "C_182B278AE17EF436222CF898233A5570CEFA34AE3C899B34E416A06097E828C2",
        "C_F2BFF6BFCB90EF8E1F9A2F6D9E763484AD0F1C907D1A496729D242E8963BD098",
        "CD_73F9CC8D0A2B5107ED79AE2372D78EAA3B2A7A24FD2BD2876517DA1B42CB16AD.2760.432548369.725",
        "C_48FFFAD3E6EE9C5FA0BA1D7594467C96859ABECB0A53743F5B16DC6E6794B305",
        "CD_DCC2AE997AB356670D27AB6AF0A0DF5B38BE28906D897D91C86FB38CED159D17.1784.665781554.612",
        "CD_8804D243AE7A52758E6F83E5472ED92BCF2D0EC1642375FE251024B3FABA24DB.2036.1197416727.1750",
        "I_032BF74126BD906A94AA7C5F9E67F926ADB60BB06DCAD8F4480D345668D8EAA7.2485.425231346.357",
        "IL_CFA0B1B6160A70ECE951031F3670527FBE802E17A9872F45C34E57CB7BE2954F.2466.2515631069.356",
        "C_3A4B092E649E9EDDE3FA5F08BAF4EBD82A1D1063DB19A1DD0454E516CA8119BC",
        "C_84A63FB7A3FB9450516F5A71E160284AF2F9D586FAEECFC8F7755F2A2FBD437B",
        "UMLPackagePath",
        "C_A65407F850C2BCA806A67DD48A46ADD12B41F479B7F5CB65FF34B01AEAFD8220",
        "CD_361D98FB17C2BCDC621D6A7CFCE49AF430F4AC02365C7EBFB53223536307BD5A.42.2665567394.320",
        "CD_DC39EB125CD5896A582C9CCFCFEF5267AF9611EEF285D00CC4FF5DF7F8AE6FFC.156.3091357591.684",
        "CD_931F785B1FFA664B9927AA05FC992B88625C615A582C37149C7E2EEFAF3D493B.2579.2875369913.1694",
        "CR_9A36BB4E390B7DD04D76CD832679A7EB96B353EDC2C276A7C316493A7FCF4652",
        "CR_493669C1CCA456E36A12CE6590E4C5AD1ECD05339BEE6C958085F31C96B6122A",
        "C_A5716A1111B0556A1A9C5C3C1CDFD55516DA831BF69A2D30A3293C34FED97FEB",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2426.3987616337.404",
        "I_0DD857EB2ADC5DFB72E5F5A4333BAD2BACF09A4F6529BCC15F86720371E4A7C6.2723.2802498854.283",
        "CD_A3CFA2EA2CF7EBAE83315F59909BFC6F8978ACBDBD24E7ACA6B979B7B86A9975.1226.341122162.4158",
        "I_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6.1489.3736534883.282",
        "C_BC68F03B4B8F91EBABF0C9EFED9C57ABF605182A4D8760A0679947CF4F1C5F19",
        "CD_09249AB2463DEE8AF9E6045D6C53614F5DD03A6CDBE2B7EB3990B7FC319F1979.2472.4116724347.359",
        "C_4C11DEAF7A8558F3989E0E42F67497A3DF8A0B97EC73A206C1E9955B630EFD68",
        "CD_4B835375C85830D11DAA3F01F5AF9F28573A4521B9279B28C7605832DE3B39C3.2757.2842290756.681",
        "CD_F15F4B9679DC3EE9219935A1860F66EBEDC9C855BCC8543E73404F5D7C0853C2.1991.3575143565.1955",
        "I_3268E444486CF41D44EDA29FA5B3DA017B52B119BB59F88408C204F3FC321782.2735.1804944086.274",
        "CD_ADADA2B2CDD3BACE2485D2B360E811514E03484B4187AE7DDB3778A03ABAD994.1835.1220856166.3652",
        "CR_EC87315EA07FEB82B95B6ECC853900B53DFD9FAE520CF4C1FE8CD7F52B679C09",
        "CD_55610B2834CEE9FAD49B0C8226C89FEF7A98C0A18580FA893D81FD8C8B007A30.2645.4035891393.472",
        "C_2A316CC1223891DE7327AA9CFCA1669E1132B0C7566D401B6202B91D25DDA95F",
        "C_A9CA40480A6747BA83786E55386C670F9DED141775CDB04CB51D34F54B86DDBD",
        "R_4DF33D006E5CAF355721008999323C4928310D7E86A56BB401FD17D98672CE1E.77.2109803237.518",
        "C_2DAA673000997F2F80951132F7F329F238406732862099A85474AE8120F4176F",
        "I_62E9925AF0ACD35ADEB3FCAE17A195288152F5ACB12DC9E33DCDA5CE463C18C4.2686.2000434413.264",
        "R_19C500FDB2411645397763142D9A3522EA74E9619B1C45A89DC1DCDB49E04CDD",
        "CD_CA638CFE13399694BAC2F76CEBB7B08DC881413B47D24732FDCE6DA8A0FBB80C.310.3386896044.285",
        "IL_135166566E800EB190505E3C7FF772C1A4A90F934CC4DA71A9874466D85A98FF.2677.1690590847.279",
        "I_146EA88EAF8EB77BD08553A3FF5F4A79C53BEBEE03F2C448616917B3A3DC90ED.1016.1334109533.294",
        "C_FADBE2E77FCF902970F9409C89AA00953D8589FFDED776632A19501236075BDC",
        "I_BCA765E446D9097DBEA6C9E4DFDE858DC64A1737FEE09A95AB480242FE45EE06.2469.4192749857.338",
        "CD_28A74361A668148487322B05FAD3758AA471FC05BFA3377023FEB3DB1A9716D5.1355.1056204766.300",
        "CD_5953574AD268C37F4681AD557CF3BEA3442C419F9086A8F65CC3774027E8952E.1149.1308959200.466",
        "CR_931EBC392DC240CC5527C3CA3643FE44E050E39FDDD4B5A76F950F248E19E470",
        "{3CACB2F3-A6AB-4DCB-8CA7-3BF4D75BEDA8}",
        "IL_9E20357DC6D5C061E0B89A7E65B974A12E2731D028E769172D464A3AD38B0664.2707.3401987120.281",
        "This device does not have valid log configuration.",
        "C_9D6DAF01BF9FEB3EF2C9DA9CCCD42495EF0FF0EB48CFEA8E496981FAD2449D94",
        "CD_E6555E0E3A2A0EB36147D0BA2B88FF99C450AC95610E6A4CA8EA619881318FDC.1154.2581004933.341",
        "R_921492ED5760E8DB59B18C393C69FD700B60A29E9CA498982D62B891A4AF6985",
        "C_5F469C3B14C86BD8171AB925DA0880DBBA7A8E1FE64AC6F8F7594251648D1E76",
        "C2 latency",
        "IL_735C7FF3641C965F1EB5776D9F87024B30C59AF8D79743303DCFB2E5F4C7ECA7.2702.692532791.286",
        "CD_CE00F2E7D1FE143547221CDE461E1688B57FA754557F032C9C2CEB24353C9185.2530.2148377999.502",
        "C_9F8D978C4969B38F6B12BD156ED032890417BE936A9EE501730FE38AEB7DC52B",
        "C_1049D5E6018CB5BAEEEFD8D443D433D445F89F6711D57A1BCF5F2CDBFE578ED8",
        "C_9A376F6E77D1E893429991208782EDA1E1B82E08D8048C53AFF147F9753BF1B3",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.1165.1252411979.318",
        "R_F7113F6F79893405611B3E0C1184CFF87E4747F2432D2CE16AC2FA972D4FCE30",
        "C_7DB1E30FC06BBCD83555FCA1DA86A907938086DE88B466575ED4B935DD61EAE7",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2014.4126882503.368",
        "#'+/37;?BEHKNQTWZ]`",
        "Hxf*B$rW96K-",
        "A persistent binding request included an FCP Logical Unit Number not defined by the identified Target",
        "I_524D8014A2F8B82E7E182DFCFB31165E09D82EBD11E7B9899B8F3E970A2BBC60.2710.4141668719.287",
        "IL_39E85455A7B17B424D7163FE8072349763088539261D1296FC03044B0F465711.2735.698560119.273",
        "I_440D803EA4D2D6EA54DF96FC35ABE408DF3F784C63D6E36B9876465535513619.2702.4050137494.292",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1097.2755930373.480",
        "C_153A90D31DAA2BB98D107166F8216FEE25A312878D4AECBB89966D3EAC52B5F6",
        "I_C5A8223F6D36AA1368FAEBD76276346720D377BD884723F6A1347565DBCA9C35.2699.2043729628.276",
        "C_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45",
        "R_7C47B73E5E9A5506254AEC98C6F5B5C4749A5453EF79AF4AD8EFFB7A16B6EBFE",
        "IL_91AE913EAB0F01F87A80F388B4ECD61A926DD279DDE0012432E352183426D536.2735.1006137262.283",
        "I_DB85956B2CF58EB237C2CD92C5D7F458D16DB53A647E029E514EC2747FBFC093.2684.1425757238.287",
        "E012EB9EADB94D27B8C0EF1A86F7EF90CCC478E4E29CD982.2703.1518068467.288",
        "CD_C2F98821FCB494ECEFFA5BF85ADD681DD9F374F97F468AE953F8115CC121DA2C.1071.3266937152.690",
        "IL_AF686E0250184E59C8224EE6DB6A18B07AFF9644B10E666A16E16683312717E5.2681.3084215322.285",
        "IL_6456463FE04288A1885C6F7DFFFA4040E415617C14B667F2C51BCDF537F3D501.864.1.21995",
        "I_5E94DA09A144573A82F81610B3CF5A67CFC779709E041C4BF14CF4C648F2CACF.2712.1906993237.297",
        "I_E20BA24A1A31380214941B26B83C29B8B31C11FAEB588752C8D490C56559FEDC.2723.4053017955.283",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.2175.1.14291",
        "MSFT_StorageExtendedStatus",
        "CD_1C07FE540DAA3F27E5D401076DA847989EAF991B378575B5B751936E81935DBF.2636.135376567.383",
        "C_03B5275A0D380627593F835B4AD2B03749EDE19E5B92F5526106699F68C22F4B",
        "CD_B47F156CE22E5A2752D5E542D2A77EC08E0BE3C5145CCE8F3E46DCC3D35C3613.1565.2442223842.1675",
        "__ExtrinsicEvent",
        "IL_C4113CAEE9CDD8FC4B6576F92FA026068CAAA9E54C89D27F3FF44B206279FA78.2675.523712438.280",
        "TapeSnapped",
        "CD_AF8EF437987396E623AD20A5D6E988F723A5D1D3D167C9E711D2D495849F12B5.2022.1.14552",
        "IL_6124F773E528AE06BE26B7FF99E0DD4F607A04D894A09640A54BC3A4D4D08D5A.1015.1697436836.313",
        "Association between the security settings of a file/directory and its owner",
        "NS_A2A98E75472B9249D4EF445DC9D4C380289067BF73931A828AFBC7CD7964FEBB",
        "R_ED2E871CAA85DB91DA82D43856C298DADCDDAA2D7C9D06C8655F1779E6509A4E",
        "CD_2E98DAAFDC2E0486524C1D822E6475C52FB539347AD8EA11CE593C8CB744EA9A.1155.1323861485.454",
        "If TRUE, this method will make use of the CreatedStorageJob out parameter when the request is taking a long time to service. If a storage job has been created to track the operation, this method will return 4096 - 'Method Parameters Checked - Job Started'. Note, even if RunAsJob is TRUE, the method can still return a result if it has finished in sufficient time. ",
        "CD_65C6883936BD0C78C8E38FB56AABC2614EA93FF45C056006891AF273AC6F4539.137.2715615970.1042",
        "IL_F41AAB3CE0418D59CCEE78DC6089E8A71443DF08351201B015241ECCC0AF9C70.1617.2645183154.291",
        "MDM_DevDetail",
        "CD_F3B6C9CF81B87870F765FA553DDC4C6E7DCF74DC71874D055E1623595FEAD0A7.1932.2947830808.963",
        "I_74D6957A2807BE355D99943728005C3B31EAB1ABEF112E8AA77ED527A633CE24.2681.2354543613.284",
        "CD_EC28DDFBBFD00B2229C9E0AF729FD229D243C353901915B7D576D0B0AD926784.2571.2046326748.1369",
        "Extension",
        "C_772F556B04D98F51D070688680FBBEB205D86BB8F4E24F468AE459F92ED94CDD",
        "C_C3F7C0409DA0A77A93DAA31B205DA3FD17BB822F308D9326F5F4ADB0332FBC81",
        "I_C599B38849B93074CBEA1847B2757551E8E5BEBD1E4DECB842C1D6040B473BE0.2675.4145310372.276",
        "RegisteredVersion",
        "CD_BAF75302566D567EA01CB2EED45B5C1B4A6B65E2564A45EE8181990FD5703235.271.685969722.540",
        "C_635497AA16B16AF0A6344C164CBD027C88BF47D531661219C8D5DD2913FC696E",
        "CD_A8F083634F7BEB2D8EFE48AF75FCBDCB76893C654FD99D7F0E74A43B54E530E2.1339.973898851.534",
        "IL_169086FFC5948BF288441EB6014F6117BB5043832C0B387A437BC6A134C7C2CD.2718.3715306196.279",
        "CD_8E8BBE32398A61BB41BAE9F60F150534B4CF02BF80975023BEB14B7EC8CB91E5.2638.1736816533.260",
        "I_692596727A249B1A3EFAB222D026A12F1773B5DA1F8DB7A7F844A0179E73C0B9.1936.4131941892.320",
        "IL_EE4BF864E92FBE1337A72D07C758BAEF29F255DDB24AA03101ABCF07C22EDF2C.2599.3421760806.272",
        "C_715285D866D9BE4D1096A09BF56F1278A35EAA3564DB030AE4A24F01E076521A",
        "C_CAEED6243C47285827AC6434674ED523459EB8C970204592D2B83B0408FC431D",
        "C_B96031C532B0B65B8A381FC99C330B723A6082950CAD96992CF66C16EB037045",
        "IL_9B38DCF15099C1A98C74CDFB6E689EDD9DF34640CE50DAD92F04D8757A02CF50.2702.2329411449.295",
        "CD_6FF828EC04080EC9C73773961C6786394920BC16665D53EC22DE1788D6AD154D.2581.2462825584.621",
        "CD_E6695722F42AFD2A38B87A3A03743A182D780F4AE622B7E7DF87DC65E7D101EB.215.3587625141.579",
        "!$'+/37;?CGKOSW[_dhl",
        "C_2A2D6E6AC8E9DC7CFD3B145ECD6507F431971D2D607AF7EC159B3B5EAE53046F",
        "CR_61CADBB506D856243E79740B6392D66E1EE943841FC396F3057262385BFA8229",
        "C_8BF1B53C1F7CA8C4B9A4193DB4F8D9C9B5E53B2A698928B57CB97CFCCD44963C",
        "SpecificationType",
        "C_038AC7DC2B3B3FE18119C0922FD190491410A00C8C9DE6AF3AED2E4BB066C596",
        "CD_6660369DEF6E3B84AAECA382139BF3E985205A68D26143F446612FD594B15147.2612.4046868408.348",
        "I_AF25D8805F3B512CE077E12B9EC07A7664A32A328B0F1BF77828BC5BA1C8AEBC.1187.4049391707.376",
        "winINetSettings",
        "R_44EA48F1447554EE6A5F1B2B75B3D13F8D9F6E269F5EA85D941FE91968D91A16",
        "CR_8F55F9DEF3426989FE817E17CEEF2E31FFED7183978F9BC99857EF3CAE702C82",
        "2745.1175156545.301",
        "CD_AA9C35FD43405602C3CB92A608E9261205300DEA694427FCF98EBA8499E2378F.265.3927322868.2275",
        "IL_D526A21FD5D0FFB11FC248B0999BF183F70ECCC2D12B67966E7DFAEC1F8B21CB.2688.1109235405.273",
        "IL_A36F463B29DE1BD71A01D7D06D0C1CF65881EC8DD5451E860EFA8D44DFE5AEA3.2714.2298416373.293",
        "CD_BB8167061523345F8CD6783B9C5021F1F77CD1511AEA7467940486ABC39B70EA.1951.2016062751.3996",
        "CD_24CFB2B4CEAD5BE9188CC5001933580DC2746C05DE76A8DB6DD098D52E4B25F0.1671.922454185.1189",
        "ProcessorBiosInfo",
        "I_65817EB2862C41EC490943B09C6AFD2B5DD8D011A8B044E96ABCDB4223361118.2721.1933200316.283",
        "IL_DAD8C8D4FCAA87D69D3F943F3F1660E3777E7C27DE2F3028372C840EEF63075C.2686.2819588879.280",
        "I_C0406F771E2762D51D71E72E6570A0AE6C617FB931ABE8CC68B7711AA6A0E7F1.311.3044912591.229",
        "C_19BC29932E779E4ECDCA3D2FD99CD32E93FC4AD3FBD8BAF371CFBE02B8675037",
        "Disabled",
        "IL_9BB9675B824FB6DC4AF17BFE099F991C6FF77A49F1162FE9115B457A336C69AA.1016.4118110844.356",
        "CD_25A571CE538B24F14E9AE9F0F8EBF9CC275EF6FFF33FA86B2918CC9BD3D0BFD4.277.2060025413.627",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.1357.1.16908",
        "CD_F942F52D9B767F4E0AC3367636949CF0E5E8CC570A3A6EB594B1DD3DD8DE68E0.1635.471769905.465",
        "R_DD1327FC08EE6F810BD5622CD5EFD1804CFB8E69E3B82381F2E13055AC3B4DBB",
        "C_8242B0E214D0E59F97469A9B5B2211B7EE2FB9D2E262E35A344F292EDBDEC228",
        "I_302159DD437DF31C3447740E0D66617756BB40FBE840878868510D22B9CA0618.1195.1737952742.287",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.1087.3052917301.442",
        "CD_0CB02E03FB8893004847A1CD792CD15C9298AEB5220B65C1D3CF55365F8EA8F7.1839.1.36212",
        "CD_A8D86B382CC27EA5869ED6808E06A1A8C7D37476C8DC9964F86AC7B5FA42F3FB.2620.1552047265.1825",
        "CD_10E742B9ECC86ED440568BF61B0442BA9BC3AB32EBAC793C867FE3DDEE6FBA5B.1198.3423287868.1924",
        "CD_939BDE950037625234CD85F8C6B1EA2B080202B0F17AF76D4D121C0816452127.2052.3057883997.159",
        "CD_961B71EE3CEF77853FD06FD1FD078D670615B8B606936AC4407F5BADB29E35F4.1131.3659820733.2530",
        "CD_7F637DAE12A5C57B84338EBF2100C5D2953335CDC28294203995748012501B4E.35.3602678721.475",
        "CD_2E2ADCBD19607186F27031CE141175DAAF2CD1B603A1D58D1343B81BBA815149.2528.3909051468.380",
        "CD_68708B0D28964CD8F016516FC22BA5B964B21C85D4D8AED50B2A4BBA811EE32C.2628.1875566765.828",
        "R_F08FCE87204BA565CC8D5019202DC93CAE2C1D89D6CA6369E7617C4B178BC16E",
        "066C596",
        "VerticalActivePixels",
        "I_C3441EF025DDAB67A95E6F8DF64F84E62694229740C8511E0AB3A43CFD7A1883.2685.1355955933.260",
        "CD_B4744AE091F96C1897CB0086813E1AABE89C9AB276818B172EDE2A19A9884429.1082.1297009758.348",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1130.1829995367.180",
        "CD_13C28897773F6F5A9F386870999C3296188ED475D6EBA22A9A6782D9237F4CE8.1104.1493911275.1214",
        "CD_4A8C48B101586E49CF7BB2FBB8C8F9CE4C850648CB5DF606B94CD22AE6B1E328.100.3812959440.621",
        "IR_8B1547E29C4669664E5C74CF6C63C0DCB167707EDB55532CBAA32AF8A1CDDE88",
        "CD_E6211D2EE9E3D772F3F5092CE86BF256E8A0ACC7D6C04BC5100CBFDD67DEE026.1751.2476835904.725",
        "C_44C02ACC063704A2344ECAA147FEDE938201F9F44B847689E5F61F32FD9001A8",
        "C_05D4D8FA77ED969866E398C6023AE274A4FE95E964B8F30EBE0E3225DB2EC75B",
        "CD_6F0D8E2F04D5D3DCE1350E4B57DB0FA341A8C158D4643133343B2B466D133233.1925.145492773.299",
        "rsopPrecedence",
        "I_9F7237E671047A16BCB745405AAC599AB8579344F0C8B92C754DB789C65D353A.2715.2041322341.278",
        "LocalGPO",
        "I_FE19C9DDAC04ED4249E80EBD5050641EA1081DDF5329EB1A51379B4777705FDD.2417.1583772651.332",
        "CD_A3EABD4D2E9029AB4017D33BB0D0CA4B663683B46BF99E6712A276C0CD3CD0D7.282.2205414127.596",
        "CD_32700D9AB8ED2E7F27434C5CF9D7F71D19430F2B76843943FC63E3F63BC36783.1603.251078964.531",
        "I_30B8EC6BB224B03221F74013E30D043476C841FF505E2B10A5CBA7529AF31DFD.2679.1639779357.279",
        "I_6BA55C286FC67261D43C0FCEC56FCFCE8D1515AB864772B1E0B2EDD213BE3F11.2700.3282323892.281",
        "IR_83E79CF7F4D04D18333CAA6D37C201FEB5876774E73CDF5CF61FCA1666B6F661",
        "CD_EE738305AB82E79FC2AEBEF9FDB7EECD7D8F38AC9E39EAC6C3CF28317D50C03D.1931.1980089126.2897",
        "#(-27;?CGKOSW[_cgkosw",
        "CD_D24A5DA2497AED481F5D755CD2B94AB194827FE0A539E58BFFD698924A2E19AC.2661.306814833.477",
        "RunAsJob",
        "IL_96F63FF73FB6C3F76805DEDAE09B904491E34633C330A7073457181E138CD54B.2715.1050821582.284",
        "C_3AE83E61965FB27603BA5CEF6287221F55B7F43E8EF0935F985E7B5963177B6A",
        "R_754E5946CBB29D1190B8A84A81859EECBF1905D53963E568FAE53B4A9E6590F4",
        "CR_7D26F1E16BC9CE86FDDDA09E425A859A3BF87CD94B9004A4B2B575CD1EF41374",
        "I_AAB2361D5BE7402BBEEA8C75F0C67526A834F4857A9BAE731DBD8E4D03F06056.2686.751587766.263",
        "C_FCB8F5186AFCE657559BD1E3B7945F03AFA3222D1F02A94B0C21BFF34C6501B2",
        "C_91602FB13599AE049472C23890514C40727DCD8307541465A988B80CE6F539AC",
        "IL_DD44E43FD34027D8B85FA79C40C442BE85E2DAB1FB04E68BDB0E719221B44751.2728.3761737128.283",
        "~0369<?B",
        "R_A9FC981B29A04D7C489A76A4D6067E60A703CA82B66CD307F429F1FAE4C0FB2F.2417.604995782.522",
        "C_8D348295F5C8039788FF0FD535EA84E2DE9FD1810A97F958930762614BE11757",
        "I_973BA058AC874A3043774A23CD93BB06B023BBBEDB4E0810A8E04C6AD85A11FB.2690.1811454526.269",
        "CD_60A55C37A891C02E43DCC85CF24FBB0AEC4CE837463192AE3DF9F07B12D58EBF.2061.1.8698",
        "I_F4CD7BB7762CAB958C999CDBB22A7A9239D971F6E35AAA4808E4BDD00E4FA4C7.2708.4260800985.280",
        "I_230AC387DA340D197D79CEA2196083E5A762BC858EB3F88A76F1C0DD2AF0F22D.1014.3400401078.306",
        "IL_7CF7DA788CB633591FE5B31F4F2207A3A629FD098D55AD1913CE2E46186B87B6.295.1901134170.300",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1997.1433866239.368",
        "IL_952652DF528E210BA7D893A981FC3647340447B0622F76B4DEC06CFB4BBB51E2.1730.4078944413.332",
        "I_E48354CF9994B34400EA4AA38B99080638833EC0EDA154851BDD5AEA6DCF15DD.2684.717480104.264",
        "CD_20B4E701C3271ED94785243972C16A9A8FA123A78EDAC768D9A7B370EC4A42D1.1083.1195708328.348",
        "C_82414A82DE748ED7C01A47DBB75CAADB5925E61647EC20B05CA201FD29ACD980",
        "CD_20699BECD68BB2E715DB1990E4FEC1EF2DAF88A1D4AFC17A800FD50774598318.1925.2210335379.317",
        "DeleteExistingObject",
        "Failed to enable compression after format completed",
        "CD_362D6A29547775E750DA92891446A0CA4101CA2DDBB5289355E858D0775A2D0A.1977.657345573.2230",
        "IL_A905E989052353FA9D8F60E873BC56BF35837561C775D74EDFE4D77EF4FED58C.1500.283983751.381",
        "IL_47987CD6E32FE7ED5FB71E452946B1D8462D3AD25FB05E097182677D008F79B1.2701.3567000716.283",
        "CD_A97591AB6200CED26E3FB14B24594C24502E3ED2ECD1D03B90CDA66E21B32DA6.1636.1.11186",
        "CD_920782A19D0C199BDC99CD6BCD549187886CE3AD64D29AEC0D7E3B1ED7356A9A.1805.3583110941.293",
        "The day in the month on which the Job should be processed. There are two different interpretations for this property, depending on the value of DayOfWeek. In one case, RunDay defines the day-in-month on which the Job is processed. This interpretation is used when the DayOfWeek is 0. A positive or negative integer indicates whether the RunDay should be calculated from the beginning or end of the month. For example, 5 indicates the fifth day in the RunMonth and -1 indicates the last day in the RunMonth. ",
        "IL_77209C176E432268EDBEA05FF7F5FA70285AC2C7EA0E17CC6D5F76BD0E5BFE29.2706.1906570416.293",
        "{39524FB7-028F-4035-8C2B-8E65D2B17E67}",
        "CD_28F6660752A3E238081EC79F7E80AD5E5E36888805DCE1EAC485A69CD87C1816.284.2124582516.1568",
        "CD_112D5871031FA8548B77FA449AA39B2BB51A4848F5CC93A4CF0AC90CF6249BE0.31.2688203778.566",
        "C_94FB2DC8F1E30FF47AC0406B2593A62736B6DE3ECB4D5BD65D719C44B3D8578A",
        "IL_ED904383A2A43533666ACCEDC6E9518221B479E5DFF52B31AA84795C6B87AA64.2685.4129465440.271",
        "C_5F36D1944A2418B5A351C20BD9C1B5E3BF64E7FA512D227A09AA6978A5B805AC",
        "CD_5BCD9A67EE590078151A9450C722B28508AB766468EA531EBD2FB50F343D4760.2543.630882665.582",
        "C_DDEDD07282B8324F60B5A48A479C1B42607AE5EA149F90058D5C2368C1337E02",
        "I_E3294EE78EA1097FB8CAABABD4B3B8C600ECC722ADC76CCFD651BCF2BCFC05E0.2716.3840841294.279",
        "R_DA73568A33421108A6DACFCC11E7E041F3E9C8CE8D59EB3EF5250A5065604FCD",
        "Describes if an item in the Offline Files cache has unsynchronized changes and, if so, the type of changes.",
        "CD_C17EBBF86D4537DC1A3044DCC316F63FF8183E01B0197617CF6F88A826A1D730.2021.857760628.589",
        "IL_DBCD4213014601A293AABE7F4277D0A7FEC9623E379CDC7AA6A9EE60BBE340D3.1782.818874433.315",
        "IL_ABAE4DDADDE7FD5F6D6A268ABAD969793E698B14B353A234DD235503893B7A63.2702.3279429860.291",
        "C_84ED32E7ED04F469B11E1DF74E7E118AFE5E1CC1C17891C6425CB1D7BE20096D",
        "CD_B02DDA61DB0037C986F5337E33ABDD70E15678DC49B7560A8C701C26B9D13251.2608.877970043.3060",
        "R_555CCC84470F70F2FC20F0644F1052980A071F16595D7E58EA0A3ED5BA0D5F14.2460.301507587.558",
        "CD_A9F981525532E646F72434C14F966C77C49EF61288E4F47A9687569A454053D6.2671.3075508363.5723",
        "C_152A8109FBC9BC9F4E7BCE13CE14711A471088C4A0497E45C7C22F28216A40AD",
        "I_AB7A98ABE03850B8E06CED9E1508EB71E180F9AB6F2B87339FE7B79B061E268B.2719.2679953722.272",
        "This device is disabled.",
        "CR_F3ED82F33431603D84B59AD5C9C4CA59DF4FDC6F04E98BD4826D692A26D5A5C0",
        "CD_413A1FFCE28F9D6A57637B88B18B096968AA0ACC15633B9D32B2B3D4D91D8280.1922.4052180154.250",
        "CD_65E1F00386C2C35A54652871CE8B9608ACB5F1178F72744035204429812D0E61.1577.1.10428",
        "CD_9ED4C67E3712DE07C86D1861FC69841608A536EC7A7415988B2BEFAFF875D077.2419.1823961925.363",
        "R_406F546FAB6014271EADE336F5C1DA060EE35CB23E405330559A7A1A746C6CC8",
        "CD_532C16391BA52367462C4A3723D130160AE1A6A70CD780A9281117753621FA5C.1603.4257535212.431",
        "I_E73032100A8717054DA4CAD8F2E8A4496B3487F6C1516D43ABC8FE61F125689A.2707.2937429472.294",
        "sport",
        "IL_3B25CC76866D67D5F7B6BD5B0DBB66CA4797D3D1747ABE957E8AD6E40E8A3571.2728.1637506377.278",
        "UWPLaunchOnBoot",
        "Default",
        "mui[MofResourceName]",
        "Bipolar Analog Composite",
        "CD_9190C801A783168750B3F3627E399D0D348C0E79F09DA78BCBEA5386FF4121DD.1923.3103462957.1059",
        "SpinLock",
        "CD_D77BDD0DD4F6BB62BC92DBF5720E7FCA0369F287A12A85BAA24D4BD2A63029F3.2660.3026315264.1822",
        "MulticastForwarding",
        "CD_76391C5F827BE50BAD62D3F132AB199D19DD265648929C5B938B0F42F0FC59BA.2625.1669129193.116",
        "IL_A463F46E3F13722E26A5B52AAA3F819E820EDC2228754A7CFC8924C226A44BAF.2723.1032476379.285",
        "R_6BA587F6AF181129EF94B57125FFF3ABFF81218B46E9C3323CB782B9288DC94A",
        "C_F2F304BEF42556C432C5A7D1B6A2CB5F5A5034C33F73E5E8567E46282BF32B4E",
        "CD_A0108CE261D6CD70D350F5B72F2E9874AE6E004D3029015B0919B1BD326BB649.310.1983335159.618",
        "SystemConfig_Virtualization",
        "I_22CBC607A88D05CEDF5DDFEB1058C59E56ED6CB98A2E6914C41D8556F9A3C48A.2728.1643980105.276",
        "CR_C0A77ED799B7351F2E397137E839919102D123FCD7350D8EF328ED8645D917E5",
        "HlKr<`-",
        "IL_5089A252B68513295810B5C02EC2C4E8CBEFDFD9DA0B2D18D2C78BE706324484.2705.3628745793.297",
        "CD_9A2FA4B503D51BA72E7F874AA07B2D2639867C129B89B4AF2230D146C0DBAD9A.1928.1848874134.242",
        "64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41",
        "C_9538FC3E850F71E31007FD8FC3E5ABC5EAB1DBB946651E9F96D53B48A625555B",
        "IL_C8A6E52D7AF2A6667E14780CD0005CAC845591B321B522C7AD36CE25A7473B23.2707.139493216.285",
        "CD_F39CE8DEA5DC55C1FF10FE9CB8760E6D9F306EBD58660142F016FE93457EC312.1949.1524392632.1017",
        "R_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.2168.4217829536.466",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.3636123003.368",
        "IL_E3E2B6EEBC1656538FEBF1B9BD4F13C2A969A385947E32794681C4401F7CDEE8.2685.1285217656.288",
        "IR_B9EA4E4294BFAD4BF680A19D237326A3AB39882D24932A1112CF7A54CF8BA248",
        "I_6EC515021E47E1C6933695387E9D1F29129F6BAB7D2893E254DF8EA2208F30B6.2764.1905775655.283",
        "C_CF7E5037F6563CE949872FEF4BA72C8CE3F9C68DD9A3E9BD325E8B9ECC946118",
        "RSOP_AdministrativeTemplateFile",
        "C_F61D3A37372046376CAFA47C2FBD5009ED63EA8C65A1E072429CA32FDA52CF26",
        "CD_C414F6F9E5383DC717CF413A8534BAA7170F0D0BD81767423A9D7B9FA1F44AD8.1783.775617835.523",
        "CD_D3F24716BAA23615BF51040AFEC8FC7E21FFC31388E8FE17AF94A465BAFD43A9.2540.479038304.506",
        "C_D1F789B3E4BEA3C7E499229EDFC8CB7B11AB12DADC59C0292CCA917AC88CEB13",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2469.4106410547.368",
        "C_CB6B90E148B7501330EA5426A8C41474C0B4E4C65433E6AB6CB9902BEB3F1744",
        "I_879532207E28E768BDD5908D5100596B02A35B94443E4A1FC5BC4D082E286B5E.2725.2916004656.277",
        "CR_F78D535F784AB5BF2A7DF53DE5ACAAF1C73DACC48189425DF45543879C147259",
        "I_D691C8444DBCBEA84E492FB8073A93526E27F7AA6DC63C74821F4959311828AA.2721.4087027590.272",
        "IL_915E73DF0A80232C73E3857239829936A2600A117DE2E6656BD93A27B02F5FFE.2703.4237052265.303",
        "CD_4F5A769ED4733707603FC6A22AF6C35EEE4440568BF344DEBABF96DA0E5DDBCB.2537.1754222320.500",
        "CR_FA21EBCF6E5D32820AD55E9B2F2B94C75A7711947B6C3050C8DBA3A61357B1E9",
        "RSOP_PolmkrIniFileSetting",
        "CD_A80C313AAEE717B506BC8A2C7E0BE7B667151873E69D754F677D37CD02E85826.1583.2909120363.532",
        "IL_35F1BB1E50C3B37C02C5010AD042D8764EFA2D498301E39787D5F1821C27812F.2699.1151528514.275",
        "CD_6A87D660F0F6A66279CF024432941A2BC16A9043D5A3CF26ADC36D1DFFEBF2B9.2033.1612043649.234",
        "C_27470116CCECB22A5C95C6629B51C5286889D16DB6D6BE89E89D3658B40E9BB0",
        "CD_03B5275A0D380627593F835B4AD2B03749EDE19E5B92F5526106699F68C22F4B.2036.550510246.1415",
        "C_53F361C92B689C209884B5B758327060224E1EE2A715868AFD6C828FF0E150D3",
        "CD_BC906ACD0D7D2D84252D25E6E9667F70E36490E80DB20471991B052FEE0CF9C6.2482.585622631.396",
        "SoftwareElementState",
        "CD_A6E4C6A48C4E3DE2EFC53C308E095CF2E1895E3989736D6F733AF610DA0807FE.1597.3329293682.483",
        "IL_61642E797CBA7FD308765D422A26458A770AD0BC77553C0534CCCD9FCA1BD187.2417.2810255257.295",
        "MSNdis_NetworkDirectCapabilities",
        "IL_60A5765510C92FD1A23D35B17166095EC19CB0AF39A2470CE764AD667451BF6A.2717.2616565661.281",
        "rceName]",
        "I_9201624D17A4BE3655D1047FE2810DAA712529F35916C8FAC2518C5B06EBF16B.2710.3485559487.293",
        "IL_4C7CAC80A6C7C10E23CD2AA8CEA18BCE49B4F0FDED31B65F69AE196208B72AD1.2692.513212959.274",
        "IL_35371A55732F12EB4ECE315E06A158239376594E1F363F248148056862333CA5.2711.4260000552.287",
        "IL_1E3EF9F69BD917FEEE3E15B1CBC366C928E4D79278CEBA74D060109ABAB3F406.11.1163568866.208",
        "CD_914943302F06F34FF1632B4D7C73ECFF9AE15DDBDBDA5F8CD8FBC3C0EF473B90.1164.1700002067.1429",
        "IL_51FD9928A924F97AEC47AC385D2242232DEB456712B122ADD342F3AD6F1CD6BE.2707.2926557893.300",
        "The connection security rule being filtered.",
        "CR_9DA9A42CAE7919197E51305D69CEECAE7B645320A73D6DC468ACB11BA2001D79",
        "C_A61EC5F6C4AA87644BB2D88C4FF2995A030DA38FC8A704A16AEACEBE64D6DAEE",
        "C_B087905D10C7A0BA64B4093C95085AD27ECD7163E26FBDC94BA64545BE9DF66C",
        "R_174A2AEB54BD548E043873CC69AA038DD6DC3AC5FE2EA12ED542CDBBEFBB3320",
        "E44-DA132C1ACF46}",
        "C_C9D9452296EB13E3615C122157CD56E9BB0D20377DF2B13731EB18D5AF7A66B0",
        "7EB4489B09CB933E.2598.2217511853.678",
        "R_D3559258225BBBDD5E2DFDF52DE5A11681B899B436DB12CA240C43C8641B92A8",
        "I_4CD34998191B7D33C77F03D776D618320C603FD3921842E1B0BD47475C056851.999.1.51109",
        "CD_3A1E8C6ABCBF6CE8E93D082CCC274F6AA9174C864DC045530449FD4EA27D4BCC.1153.1251773880.870",
        "C_D18B021DE887D56CED90F13460DE767FA0BA3077FF010C862ECF83FC393D6F1F",
        "IL_B14D0FD3D5A8CFC6EB06319633CCC6B11EAB364BE3A00E6ABC259B60FA974330.2690.1663296439.268",
        "rKNQTWZ]`cfi",
        "CD_4504210513F67AAF0E0DA4CD3DF8D84725B21CB68C87194D9A008B88A53ACC71.2040.3224265108.2476",
        "C_F9D55EB8FBF99520489EF8EEB245E36FED839C469984DF496D191A630243753F",
        "CD_37223632162548BF77FB0A39BE56F0914C3079802950CAEA3D1F113F50F15339.1923.4284194985.299",
        "C_EB7FB88AC460423B2EF1D915F61B6413B02B51C59DB82123DFBBED2259259B89",
        "CD_E4FC7CCBE036059F139218E837508435F1EEA217B72843BBC84B1DD56DF78DB9.1102.3621389813.212",
        "C_3AA22630705AFF3975D1F6344798271087D2AF7B509FA6E34ED791616A9DF674",
        "A timeout period that specifies the maximum amount of time that the client expects the transition to the new state to take. The interval format must be used to specify the TimeoutPeriod. A value of 0 or a null parameter indicates that the client has no time requirements for the transition. ",
        "CreatedOffline",
        "CIM_InstDeletion notifies when an existing instance is deleted.",
        "CD_9378929BCE127447D66F1472F6CC39E5CC7C4B21AB66617AED19F5689DC55677.2623.3191355456.359",
        "CD_6E7226B042F9E10708887BD9806A544872A6CE45EC018C548A61885557568A89.2647.2137995782.320",
        "C_38522FF056841CE5D155E4CC0CC353966200DA04021E80EE70B3AC6C9663D8EF",
        "CR_4FD2270AA7CC321848B51530B7A77A9E39B5486B55CE0C09A2B597A1F1FCE1E6",
        "IL_66834ECAF8F556D28A19655C0EB4FC65BB6E8CB3E4BF5B77E618C62A9EE55F7C.2699.1600847271.262",
        "WDMClassesOfDriver",
        "I_42AB81B65FA4E086AFC4A3EB16172A80110BD85D376347070E6B566FD87606AD.1016.2375720780.308",
        "C_8ED47D93B378823F8A634B51008797D9C7D2DBC0806250A927801A4F342C2B5C",
        "C_DE2F09E5209C548EB2CA373A925D80847E176AA4A3A4ACC0CB143A779C8154B2",
        "Time the administrative template file was last written",
        "IL_9198D744566952E9D937A9D8D71A6CC17D1A1D6B2B12D5542FD7AFC9BDA275B1.2734.1317171737.350",
        "I_DB657578748F36ADA2E7ECC2B787DFF0402D153B54ADDEEB72E0DE2A3B27152E.2709.1459812872.295",
        "CR_2442933444240B68F1B8232208304D509D6ECF5830E4F4F8E4EDD13186DE1B28",
        "MicrosoftTpm",
        "I_A8BCD93BC22EF320B7622844E22888B089CB41B56213C006B8F310211D4DA771.2700.1877727267.284",
        "C_696458CF2676799CFE15561DC95060B16AFF52FCF4E0D19900C2981C3D512363",
        "C_32D454A462735D9F0A52FCE5591CA2A13A2526DC13869FABC5CDFB370DFF9CD3",
        "I_58812B0C8158CC0AE51D6566E64E3CE23A47167CDF7D7D817D519E5FCD8AC979.2692.2699475577.266",
        "CD_62999B86D7FB03CF7A5DB6EFC7D4930E35E2F23BB83D0F4261B4003B746A0A79.2556.3125554238.640",
        "C_BDE5107C5341475AE649B7075E5FB1B219CF6D2FF755D735AA60A09AE0ED6BD6",
        "C:\\Windows\\System32\\drivers\\processr.sys[PROCESSORWMI]",
        "IL_62E9925AF0ACD35ADEB3FCAE17A195288152F5ACB12DC9E33DCDA5CE463C18C4.2686.2000434413.264",
        "CD_D6D14A967FE76867E0613EC607774F87ECD794228F246D5534936182A6F4EF9B.201.443948020.2728",
        "CD_E6F405501CF9EB51604EF826550E0336D9FF9DAB805C48FA3ECE279D5B21648A.1807.3515981708.431",
        "I_3D90968CBF38C76EB9C64EC58DF8BAD337C1A48A70D1C9EF256656BDBCD3DFE4.1105.3096851571.248",
        "C_4F0D368317167225ACF46119D014C5D4BCCDAE790A6109A6768873BB8F046D1F",
        "R_FC64B24C83B6ED14EEC6C8C71996B5B6C6A9B3D7C971730102A87962981FF379",
        "CD_B0CABE1A8A062D484B15926B839DD85BE290434AB73617430C4831E218290BC6.2198.3724556103.902",
        "IL_B2096C9AA0F29B706796B428CA579EC2F42C2DFA6F8F47B76A11C7F44194A8B8.2690.2399552005.263",
        "T0ZQfr",
        "CD_532671ED26AC2835681FE0B122A526862616ED33CAB2C220F171DB7BD5AD8B02.1093.2670870092.461",
        "CD_DCED63C3DB35CDD25F0739F377553C4490C7489F0B94C0224ED7054DFFB34F3E.1582.3844714335.3083",
        "R_A44291686EEE07EF9D8E0D67D761FE07329503F95F8137BDF2C38F8956E7EE60.1019.123831791.522",
        "CD_471398BB3B8692315637EDCB5ADCF0C2D1A9A53F4C29EB6AA1D710BBC247EF58.1054.2729511055.310",
        "C_8DD78BF674D4620E5CE2BF96A17EDA8C9FC0C81974896480F1045B5C1405CB1A",
        "IL_2434375DAB41148BCD1913876890073C2F819094944EC6E0EE4282858B24539D.2686.2080766437.271",
        "C_0DCE749AD0E30C5A74941D6C326877243635B3D92AE3FA1BB77A2C716BB28364",
        "CD_38C8BED57EFE2E618C1C274563342ACF29C7BFD00E6CEA9E2BC5936DF8628D00.2543.2874666359.780",
        "CD_4ED1C1D27F38DE571446B9916C2C7A53CD6AE93A14F053666EE0657DBDDBFB0D.285.4066782310.1398",
        "3AA1D4ECA95F62F161A3A78CD.2708.1261587561.289",
        "CD_FEA174838505F017ED6B4301AAC1DD5D141215A4B6A1F43D4092C1E5AC1A3F37.2736.152348581.735",
        "CD_35B1B65B914DF07FAC7860C3407AEAACB382311D5C7C7979B2E9A007C56D4FA3.2443.142238151.274",
        "The value of this property shall correspond to the name given to the set of versioned constraings by a specification or standard. The value does not identify the name of the document or publishing media, unless it happens to be the same as the name given to the versioned constraints.",
        "CR_EA4DF20054CBD87001EE67FE2E62392134ACBA7D580330C315985BC30E5F543E",
        "IL_5C7FF4500DBA21E1B00300F60162C17D81CD2BC5202A05F193EF2C7B000FFF89.2705.2672477016.288",
        "C_0442F426186B770F6D9CA208711E127C2744CDB9E3F8C6CA1D92279D302D64EC",
        "IL_EF5923099FA488A49F9F1C22B96A5BDBCE874FBAF1D147660F2AD53B972C2027.2719.412037884.277",
        "369<?BEH",
        "NS_945DCC5B649BA9BD80D7373019A699C26DE93F09F11292BCFCCCD2685C53CAEE",
        "09.2726.153369943.272",
        "C_B6F5DFB5FF9D262A34F808F6064BE3724B862C376624E6B9C572552907B49F21",
        "C_EEAD818D8A1842ECEAC3402EA8E1218625133E524B21C247A699A22AC7743B34",
        "CD_87D008EFB09EBE054B42238F99E961FB1656BB710FB8E0DD5A877F77715BB017.1195.229756428.1499",
        "C_DFF237252232921ADE7987E5391E4968B2F362CE0BB4B63D377328B49C8CC5FA",
        "I_3FD6B33F4FF166B0F7CE61EB62E55B303FF2BF4A74F913CACB488AD245C02047.2461.1289881593.347",
        "IL_FB52F61C39953FAEA0ACCA4932E2590E915B262C69C4DA601E92505938BCA778.2677.692521110.272",
        "CR_D6B1F4AAAFDB618A9CCA914AD92E90625471E15F06457F12DC8D813813101B8A",
        "I_BE6DD89B6624A4F8EB443F6DA1160EEF98DAB20A1BB9061657B8714AEC3B5448.1017.1852656440.297",
        "CD_B39F79BEF0550EE7F9E981A83A152A3A4B6173B3A32D2E630E92CBAA2FE60E90.2031.1741070231.1880",
        "C_CEBD5AFF150E289B2E920216373574680CB25CAA74EAD2603C3C9CC18E57F0F4",
        "7F8DB1521F3B378B0B3CD05788894E8D2D.2680.4274746755.289",
        "I_1B3FDE59AC204104D29ACCAEF13F59CFF205D9B942DB13AE987877EF90664BF5.2692.68808850.269",
        "CD_3DD0A80AF9236F4E7013A6DDB559EA7A2E607D76F58E1CF3D6ABF9F875179634.2595.2477584081.784",
        "IL_770150D5233DAA58436EF46CC2E3E8FDD5F419BD214CE214C0E13A73B28F9096.2593.1410923079.277",
        "E!?Q*K",
        "CD_25951CCF498736F09F8CDC3085BB276C2817DE47EF5312A0F051C1AC3B67B2CE.1526.2645395420.488",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1489.2360746573.368",
        "CD_9E184B0D1F692A8FC81688E709FDB961CA1DFCCD6CB6126E1E7994D280B1E898.2450.2529795396.542",
        "CD_85595B738BE1333389D2F0D432EA1652CCBFD76389AC1442A504C9C8DE6CBD03.2653.1000737832.1008",
        "CD_82B5DE0B52236FBA718C6012FF3A7FD447F711EA1896FB5FD863DEC9F4CC1877.265.1235184888.403",
        "CD_F29100A757BDE75968386F1F8F50FAF18D4793B63DC12FB4378C18D9CD66C352.37.2335960961.445",
        "CD_DA3DC1260150EA9B0B2628C0C2AA81125377900B91EB681EA05BC31E6A7900FC.1144.1.16473",
        "C_379B4D9DAE90D396D3C5FB3179406DE41BED42150703F8F56EEB2ADABFFEFCF5",
        "CD_1F1219F96576A4588331D02100737379E76B59AFFFE01B2EACFBBB0DBCD4C75C.1356.2770563058.504",
        "IR_6BED86547A30ACCAD1302C7FA283B163848C4E58E936CB646E57DB7DE244D555",
        "C_610AB796758AF91BAFAAC5773CA30FA987962CB5B589ABCAD3D6EAA7F97EA9EE",
        "CD_67116DECC851701AEE92E8219560CF2CCD164F49129870A0C72AA75DD00ADA3F.1164.3967052366.236",
        "I_2235FD99C9DCA9E2C8E02E48675E6EFD99187C58BD8B7D62E52AB935B685C575.2721.2770612800.278",
        "`pdxh4",
        "C_6CDFA95C1CD82B67F7CE9D96621CA3D40FBBB6ED3577D6A166218E452130A3BA",
        "I_DBB8F50997A5C8FF29EDF6B1B0D18CE7302CDD609B179D2DB99C90FD0F9903DA.2720.2981328344.269",
        "CD_33B0A3C692AD567B6C92E618FD5072156CC98A3BCAA3A93CB3F15A5E87E34AD2.1829.2146628934.427",
        "IL_DAE0374F24463B80CDA41223BD2E462F343BE615A06FED1AFBC968627247E440.2688.115923237.263",
        "I_336D9D1CB371782D5EA557B5BD4674C6EC73652F6BDE91FBA1DD6910F1449D93.2684.3891439813.261",
        "C_727AB02E08361F6EF440AC44925D5B278206F12872C50300A3384BEB284B8D55",
        "C_37F745714D456922ABC6A6C3392453CACBCC48856287D98BA28B9B6BD50EA75C",
        "IL_35DB2638EF5F5F36340C7BB56F42EABC1B719C0A20CF4927927B74B39BB16F19.2706.1955090926.293",
        "Indicates that a rule applies to a particular firewall profile.",
        "CD_DCC2AE997AB356670D27AB6AF0A0DF5B38BE28906D897D91C86FB38CED159D17.2219.1034494517.537",
        "R_A726CC10C860A315296DCD93520657C7C068B6652EE5FFD6550B3E0DAB8CACAE",
        "C_53E2FD0FFB51ABA71858E426B303DEC34233148AC0EB2A228D00414FEE947F52",
        "C_8390A92B686E2E10DEC51624CF7D9A9B36CA99C04138C2088DBC0519EB26D47A",
        "CD_81E923C5F7AE79357104AE6BF842B77A8DC803A5873AE34E77FAE62049CD7FEB.2015.3408019337.846",
        "C_8F55F9DEF3426989FE817E17CEEF2E31FFED7183978F9BC99857EF3CAE702C82",
        "CD_6BA401C18489F9562C67B286EE1D519BE8F87AD49C610AD4FF91FE5F1FFFB1E6.2573.3842617017.366",
        "CD_7E0816BCB5F44018ABCEB520770DDD7EE174F2DB2071F89833FE5E4D9500CE80.17.3218328761.2616",
        "!%(,048<@DINRVZ^adgj",
        "IL_BC34C97269AB6EF5003806A19ACDE60C62BD631E90DE362CB7EE385F411B9178.2717.1073654883.273",
        "IL_17002779E918028C664AEFEFB3915EFD6510BCE6D2AFBDEEE2D0F84B8564E0FE.2726.2057968997.274",
        "C_02B5557CADEF33CFA29F52E782D8C5DEF3C67D29A7C0C3B389FF34D1D0708EC3",
        "5D5156A0C6A57E2D07D0BD43F09E3B9B31D33B72076E.2462.3117649240.360",
        "CD_F1112B4617C4E15A42328022C81AE44A37A10A63A4D769F7A4166A768F8AF9CB.2607.1689597468.229",
        "CD_989A756437E7CA88FBC7B02B2174A854DCAA4C2FAD8748FBC3EE0CBE0831C536.2571.231625112.564",
        "CR_A726CC10C860A315296DCD93520657C7C068B6652EE5FFD6550B3E0DAB8CACAE",
        "CD_A03A0B9B0FDC488FC2A108014B7B7F05E69F51726268CB0321B939811F003F3D.2557.1114540745.510",
        "I_1E59813E7045B8656EFFCBCD5C1862D995CA0F602D3213FEC6EFBA0ED3F2AD29.311.697620915.249",
        "SystemConfig_V2_ProcGroup",
        "CR_E78B24A63ACB40A253226DA76298C783683B9FFCFE28CF1078C510D46CEF2248",
        "C_24BE268C5603D757BD8CCA53193660D8F104AD29F4F74D327C13832A44E7DF1F",
        "C_4B5C64D8720ACDCE7736DECDDA8FED0DA8228DCA5109D852E16DC3C5EFE24A0E",
        "C_0DD571F45F5EA085CD790DA753EBE3871D02FDCBFA3623CC2C0D5E1F7466DD4B",
        "CD_CBEA5DB8929D16C32E514213A77F18E006AC31CC4E0E1C4D84A95AE510CAC230.2568.1703882423.156",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.493323525.180",
        "CD_E4EC3642DBAAC119BB7D98363E08333001320E1E613FB7C4977DB452606906F4.2335.1.114874",
        "CD_C4D20EBDDE2AEA19F49E976724D1B5EF2ADE459383EA4FEFD237CCE02FF2D7AF.1968.823967453.3941",
        "C_9226DE8FE74359C1BFD228B1593D6C5E10185F550FF2997587B5AB69BBBB9891",
        "C_C670CDA7091E7B9873D41372745CD777C7D70F44F10BAF0BA969D4A23AC00A81",
        "R_E180FA56BE25537B4EDBF25A70C610DD0A17358432E8B0D7F517AF0A54245AFC",
        "CR_45999BE1E716B224CDC60BBAEC2E4A9422A7548870411AB5310F9D9DCF7A8F92",
        "C_7E470595B07CCACED12AF52AF9B26E1DC367DE0F25EDA25E0FC74FECC24A888A",
        "CD_4C5229B4915A098FA9E249BF643245728F52EEA4263D760742E82296F3E1B97E.74.4237442598.603",
        "R_B8C74E67C39B608082AB2CF31CA5066A5D2AB9D167B8974B8B36B9FDA8E10D1E",
        "]KNQ`ZcTW",
        "I_6F254FA6E8A44DE3E69CA144FE59E44C280A864F94F3CCA0962F7FD3FFFD0ECB.2690.1525512714.263",
        "CD_E44783D75BEF4F0F8614CE9C4168FDBD1FA3135B7D74FF2017BA6E02123BBDC0.2113.367406975.2153",
        "CD_88951EE85045E3B94CBE9BC71EF70777E4B05816F4BF59A02A284DEFD098F378.2749.3650746743.596",
        "I_E8C60AB3F3BEF4861A060FC90E12A45A6C31AE0A30009ADE3737E65ABF5DC96D.1049.552195166.355",
        "CD_84DC3D5BF4272A04D490B0301A75593E19CE556EF346F7E0E8413D0189B83369.2644.3069493447.249",
        "C_3451F9DD4139B1FBD33D4308F2E5CFA926B897AE835CF84F8952E3D2EE3E6005",
        "I_A9DD53B8A4AF153CD2230F21D7DB308923F1EE51C00FF2E7974ABB9DAFC52676.2728.301383558.285",
        "C_D5D74C06622314233E53DDBA8B2858E9C39F19EA4E9C34576583CC8C5481468C",
        "SEL_EVENT_DIR_TYPE",
        "I_A14A3F5EDAC480CDB21EBFF1B9071CC0B406AE902E376339893434CA66EFCB2E.2680.3645629319.286",
        "I_6F923B697A14EB8F697BEFCA35208012C4B234B1A3DBC07EB24CF401FADA4E60.2700.1548102633.280",
        "CD_94119F7CE064741EFDFBF431345AF21D6DE41FA57EAD0A70AB2B0FB8D3F14451.46.2808150393.727",
        "CR_DDEDD07282B8324F60B5A48A479C1B42607AE5EA149F90058D5C2368C1337E02",
        "CD_404A8A60F06FF86C891EF2776F930A45A835547F74E3D08788D5D842F92EEA38.69.2705932747.519",
        "Timing type",
        "object:MSFT_Printer",
        "01819FC50FC0ACC66BC3",
        "CD_84E4DC9ADD84591845DDE4D56A48ED16102383DDBEA596D81378CA24FC85D652.58.2963870708.613",
        "IL_F7EB100E85BD6D4DCF4A1B62AA504A9F87E25788DCD08802EFF4A1B595945FF0.2723.3175173857.276",
        "CD_47CBD249A2C567357686E5ED6091D88133AC6ACBBE7BC216472A737EDFCF1867.2757.395224880.327",
        "error_Code",
        "CD_E241A982292C9628611468FB40BE60D4CC1B723333EE25A7584E871FE9DA753E.2748.695515421.428",
        "CD_1792F692B1B901CE5F142D9BC7B1C3E488E25543B8B8E05EAF3F3EDFDAFC9B5C.1579.2643163432.1689",
        "CD_E60EF1B207B541A3969FE52605168C53DE4EA7E5A1D37600D0478D235286E6BE.1489.2483849169.725",
        "CR_9FFC730BEA787E28FF305A66FE71BC4BDA5863470D337AF3119C48B654F08702",
        "HardError",
        "CD_45D7E6F87ACB8E8D445CCFB669888583D94123CEF1D8C0B902BDB864D192ADA3.1150.4263538307.540",
        "8sop\\User\\S_1_5_21_3968686040_3210279463_847977608_1001",
        "IL_D9C86DC0F45F973F029DE27EEFF1E3A5AC9CC13763E27F3DD24700713261FBE1.2678.3959160948.283",
        "CD_55BF0CC0F072F8672008BA2E217FC98D14173100D32640D32F61CC0295647162.1700.2703408897.359",
        "CD_85BCCA784055D328056C1C24739AD97E319F99340CA068ADB03810455562DCFF.2571.2585787240.783",
        "CD_E00F7419D4B48E1A92C27BB2EF8DE2D2C0B5AA67F6D9F7937C1978404CDBA2C6.2019.3436794812.1621",
        "ref:Win32_ComputerSystem",
        "C_065D9E98A48D34FE9F1D987AAED57F037C48B1B316F34AE66BEBDA2778004AA0",
        "SDBUS_DEBUG_EVENT",
        "C_4D801D24EB7B11E677EAD4F9CF2C38B141666B7557B0420D554E864D72C8EE9E",
        "IL_CBE171D83880D49249106D75217277BE676413B7C78EF4BD206FD6590EA860A7.2694.3741844336.271",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1714.560668657.368",
        "R_F8E20627EC0277AD3D6139BDD1CFFCE8B83EB1D53C7352CA749209255434ABB0",
        "CD_EEAD818D8A1842ECEAC3402EA8E1218625133E524B21C247A699A22AC7743B34.2552.3986542687.1777",
        "C_0755C98F98A88832CE4AF388D7FD0A485984E8C8093D5B69AF797BCD21D684DE",
        "CR_0A58F1099E1858890A23C17CEB7DF497DF64C99BE6E6E018304675E56C7BEE40",
        "I_69490364A6EFEA6EF0EBC265D6A8B5F7913FC5A09CDCE3B1468EA54EF695B0A4.2727.2638936822.276",
        "I_35B3BA3D4E3452B9FD358FEC9D1F382046EF61B6EA2F3D32FF2B776BA565D15B.2763.289847794.306",
        "1m59e",
        "C_6A28C9121AC74A9EB361B4BCCF85389D5F225385AD9FDFA10E6FCB506E2CAE2C",
        "R_B2287B7C7375EAC6C3F512941317C3A57D34B32E4D080470E5E3D04FD567BA70",
        "CD_629122007ACBC01F5C89876FEF5BF24FCF799FAC8975CF22D2EEA155F3C49ACF.201.3838758585.1358",
        "C_513CDE95079518F112965AA406F17722C0A89A191927E09A325D3D3202159331",
        "I_ABD504D4660345C0768AAE3A45E3240E43BCCA6F6D9D29FA0B7677D9B247603A.2675.378557046.271",
        "CD_86E4399BC4DD7BCA81C24CBCF67DD3AC1AB2674904D37AD60CB8F1387993FF14.134.3325609285.954",
        "D8AF1424B994565A4F30353F70D9AAA5FA171745944447722281AE60C.2719.2281240530.280",
        "CD_8A299070719A67E2118FDC95A71E8BEC0CD6176770B7F252C94DA895AFA7A82D.2387.457213496.553",
        "CD_57839BB831B678823813D6DE5621B2492B8DEE2CAA3C37F3643245385D720644.35.272921344.452",
        "NS_100A7A51F7094EC728650BC55B66180782FAFDEA7E105C255FEDCD115248C0E3",
        "IL_8EC773A30D743262268B9CFBD0B71E3C936A1AFEFC114A8EBAA4ACBD26C24937.2708.2946204611.287",
        "I_851E2803FCA0ED313BB5CDECFB40BACC4150CF2432EA202122C27A5C46DD69C5.1072.2816137521.332",
        "C_D3F24716BAA23615BF51040AFEC8FC7E21FFC31388E8FE17AF94A465BAFD43A9",
        "CD_B1A1651DDC605A98CB61526F4FA9D18C6AEA8D3F609CF92D2D881D05F26BFED8.2626.607322264.348",
        "C_E0728E680677E2DC755DB0B32FACA9688F4B71D12279046ADFB604C5714997EF",
        "R_00DF7A47830858F23144255CF1187C256ED7DEF5815A0D59214EE29ECE512284.1609.3123379440.596",
        "KI_E8E72C534ABA427E69CE6B883E8FFA9701DE1CDD9E04D7D1815F4420292F16DC",
        "CD_23A50366135FBF364F350BC34F639BE141A61D21A478BB4C1230D838F1296A4E.2042.1160634697.2700",
        "I_04F29CAEAE5D62F782C498C740EBEB5E9AE73F4CC7EFFFE7894029C92D5CA28E.2686.1009424940.275",
        "x25UserData",
        "I_E4B5BA0B959BDDAC8250BA9F8D8A7FF702B15C5A8E8D139A523CF672F723014B.2749.7684156.526",
        "I_01C76FA468673A0EA1B9609DBFD73E5A3BD638B19A8136374B3D41724E88832E.1782.1125694496.339",
        "CD_61AD70324F8E2B3494420EEDDA5029E5D1AF2B0083C1CC1767F12EF889E146D1.2151.1745393114.1191",
        "CD_EA9A1A204A0FA59819F57AD1F744E0CAB4BE1F06A46B3D439B85E87A7B3A09A6.1219.3661581209.353",
        "CD_7F6D7AB071C5599637F51EC5AFFAE51440877864BBF7579093A40694E069604E.2419.3850714565.693",
        "SEL_RECORD_TYPE is valid",
        "57686E5ED6091D88133AC6ACBBE7BC216472A737EDFCF1867",
        "C_9E5B3D45F8CAE1C4CFE56075A9FB448C0393D1604515DCC51D7A6ED3FDECC308",
        "CD_C1960DB9FEC904EB68F599B564BB073D8CE89748EBA088D682E8904C932EBFE9.2619.3529899102.332",
        "CD_5997589696FB2E4597FC4CE1E1612FCF4F0EAE5655998B39A34DFA12CA0BE14A.1356.1055001447.2439",
        "C_9A36BB4E390B7DD04D76CD832679A7EB96B353EDC2C276A7C316493A7FCF4652",
        "IR_2C6B4FBDC9F6B702033F6D5FF8ACC5D0A736F2D87EC55CFB39B53EB8345F27D0",
        "C_8D338BAABD5A4CDE9CD22C60F5FCC1F5326D81FC7BA6D48335E5E3513B7182CB",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1076.3303974372.180",
        "CD_0992284CF6AEAC48C1F5BDF0973A6119AD14B4C683C698E5BA85ECEAF0A68CE1.2626.1794138547.874",
        "R_495B87AA34C9E0E7DDEE5E1AAC0073251E8F5537064D25DDFD667FC9A2504DA8.1462.814390251.570",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.2108255773.180",
        "C_30F053A8DD9B7523260BC80D91AE8F875CED6A6B53E86E7D5B372B5F5B0FE4CF",
        "I_39E85455A7B17B424D7163FE8072349763088539261D1296FC03044B0F465711.2735.3801655536.273",
        "IL_D749D16038907A301AC2259F4763797B1FCD436A2D79078ED372DB0A4964A693.2721.2325676323.267",
        "I_D2B0318BBC25EF83E4553A27DD13636837740C22329726892CC251345D046A16.2712.1753044962.293",
        "I_F88E7CF9028DBFAC8093CB3D15BA0737E0C18A1E08272A03F1A65B4CEDFD4736.2697.3058017659.282",
        "I_ABAE4DDADDE7FD5F6D6A268ABAD969793E698B14B353A234DD235503893B7A63.2702.3279429860.291",
        "CD_6FF6CB589253824DE681EA946AEBFF7061F07B8322E36020A90CC770B8046443.77.1541279288.656",
        "C_0F7A430DEF253394F97964E584980B0C9B20898A34602A4FF7CD0E3D7511EDB6",
        "IL_D9C890A34BBB77EE74D7D32AAD32B90A78248186522A99459E30407AC8D00521.2717.1969802484.275",
        "I_13C28897773F6F5A9F386870999C3296188ED475D6EBA22A9A6782D9237F4CE8.1103.2803997363.313",
        "C_8CFEA92C5E4C9F8DC3D0C728FF03B8DD4C940C51F3D7E77FB19C8CA135C2FE6F",
        "CD_445022CE506EAAB770F5E88F3AA9A3B3BB9043E1D2F57842DF958AC9BF261EF1.1521.9200820.549",
        "I_F725542BCC5EE818BB3268E2A39F3A53C7872F274EFAD1FD935D8C2ED42D5A80.1076.2672245562.263",
        "CD_61C9D893E8ECD2FC986480B9F759F7B728716D99642E5BC04B6E6F5E2115CD3B.2485.3478987489.1297",
        "C_B4CEAF94B822AD611E7B2E59F1B57C548C02F9BE67DEEAAF6627B43E4D72BFE9",
        "IR_76BBC96B178A1C054AB319522EC35C13427283C8227727BACFAF1E007CEB0AB9",
        "CD_D0BD75AC3D8DE4C152208F12EDDCF12218F074D81D44606C9B3E833C29C2790D.1850.1.8433",
        "RSOP_AuditPolicy",
        "CD_7C2448C779B501004A8AC92BAE296EF71C889D4A4797C480FE572242B6C55673.2154.1376950963.3457",
        "CD_B496E3C91F33B99F414E0CF911598E2EF9133E94328E67220F22C24A7531B226.107.95975008.314",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1049.4028024937.180",
        "I_6A2D64311EC014F2420B69AC5E273EC9C43FF2001567839D1EEC32310C28B27F.2699.3027441984.281",
        "KI_5ECA63A2575A533106A3DA4D4E7D3593AF8C1DBA30A77246287C3734644E9810",
        "C_FCA81D040FC95DE948FEF608A6C792CE7659D295F84C50D931F9A2E52513B2BA",
        "CD_3F71F51676E0E4D666CAF1EBCB8834168AA41A1C9D4D74E4D596C66D86A39AA9.67.1065059953.587",
        "CD_A4EB4EC52D8DA9648AD8CEB515F7B48D8AD3CB4BAA5E5FDD062CC77087B6C136.2596.1663392819.166",
        "IL_25C266AA5180FB124465D525B63255DF24162F5B3AE71784F6BB25B65D0957D8.2683.250917281.282",
        "C_8FB4AE7FB95F6C0BE8AB8888FDB9CFEBD55177E913A0E356746707635DBAF008",
        "CD_B4204F4CD845FAF261673483B3D9C407E18AF7773A24D7B43C66C3052F5D6AAB.1.2860218090.382",
        "I_0B5AC83FB2725D33B41CFF3B51EF33467B960FD4E7B54F055ED580C64C086270.100.119368880.244",
        "C_12706E8B04FEE8F3D76199B384B2FE632A6036284472947E8464FF115D49DB77",
        "I_8505A887128C69538DDCBB65A648BA3193C1E1C9CFAAAD31B4C65C5A95A76282.2675.674742379.282",
        "I_8B1547E29C4669664E5C74CF6C63C0DCB167707EDB55532CBAA32AF8A1CDDE88.291.1379513984.373",
        "RegisteredOrganization",
        "CD_F4AD89F24C5E59F704DEBE5DF4920F1D71930B871988589A8D9D698640C4E7BA.68.1122748136.4858",
        "Media Life",
        "R_9EBA3A64353F235FA676D5A579FE650C8E0A1DAF053F4A2C836DEFA15E9FEE38",
        "IL_0A99BE060E23FF6761359B992B74BD229BF1DDB4BA0B1CEB20D3B086485592FC.2702.3688904766.285",
        "CR_5B65E7078766FF07A6904B792E37F0CB98C934FE8F6E820DD0987C16E5C48B56",
        "IL_92E1DBDCE6516BC92F45DBF6030F33CA5CAAC7B75ED438085BC53B614D44EC74.2676.1369275722.271",
        "ActiveScriptEventConsumer",
        "C_1DE9FB32A31608C0D926707ED4C676D8E34FABC2C5C4559D485897F5E366AF39",
        "IL_9AD67B066E360AC663AE2A69F8D96641C9C6E666E44B5E5426C493004D269540.2719.1635019920.272",
        "I_0DE793052A989728A13BB43C65CE1D88790BBBCE06B85EE4E1CA97BBFE608E08.2714.3440397671.290",
        "SuspendInfo",
        "CR_B89F81602D340760DCBF9C7FA464908E742B64A7C6E08A776FA3C9E7E3DE6507",
        "MSFT_StorageChassis",
        "IL_BA3B700F7CCD60EB3A5AC441EEEBB48F4C6C8FCD722C0CF10445CA229B9746BC.2702.1721748005.286",
        "CD_D977258C1F704C33B07D49D2EA09582CDCD7013482F97DE374BA6BECFE6B2F59.1598.2123606548.454",
        "CD_0B714A230756027CB9D944F3C101E5485E82B469361846E74358E5EEBA5C05B7.1079.2194856595.607",
        "CD_9E0BBFD642722F22A3DE9294E48CA8E34C291ACC893F65DEE82C20A071D99D86.2525.2912366455.642",
        "CR_85F4FD558CEB2D53836A59CA16C7897C522A861DD40C1B575F3D3B0B10636B7E",
        "C_671CD27AD2FF2B26E5AEC1AE8B6131213A781611B2DD0FF1AEABD7796A7A5E7E",
        "-Sunday",
        "I_197DAC10B68BFC0E35416353F8180CDED2EE347023C8746DDED2416EF90BA443.2698.3060721616.273",
        "CD_651E1CF574F41D7ADB83E2088A2BE31E56053138D6E9D2570D7714EEE6709D8A.2625.1913293841.572",
        "R_1D13F523791F1EB20EAEF6F153AF80EF4F13EE29DAAF24D54E908D208A687279",
        "C_D821F8DA4BB17D06861EA625B573DB6B0B2A831564E8C02E1D4046ADA0C2D7FB",
        "CD_976460FC508BD53D3838566D8C58041C0F122103C6C680E64E3D0EE074E4E90C.1924.2083649903.1049",
        "R_D238844491F219A439909CBB356394D52635FEA013945BC8353564ED9A4C6CFD.1055.4292254534.524",
        "CD_95574E023341EB22A2734582FCFDC91CD48EEDDE11C3AC240BD47438848D5ECC.2585.3029481417.400",
        "IL_1B066F67BE7C3D043C9D435B904B7CCE47C5C71E980B50D6D44A5AC11DFA185E.2687.1884177331.269",
        "RSOP_PolmkrProSetting",
        "CD_AD7A55DBCE4A8D8485FDA925323C27900C64AA391BDA086258F10BE24098BF8F.2650.1663343687.737",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.2426.1729662260.194",
        "C_CCF174B484763861274B422B027A53D668C2557EB827A557AB0E7FF6CCAC8EF5",
        "C_8B69999466A9B0AA953868559581679FA4866B51DCA8E619279463BF323E73B7",
        "IL_CA3C3ED9EF301B6D5C3DCFAE47B846A91B2221D3C52CD175A447CF9C1571B5A8.2680.2618608820.274",
        "CR_7C0DAD954AC25381334594520D92B90371AC70B4659009B0C3C215C466688D07",
        "IR_B172B57AB4090106752242BE8F0DADF40014B35B6FAB79F108D12C9ECBAE4D1D",
        "C_86ED431FCE21CAA67833F50E8CEB80C11FAD7D40366CDE16E2C8794094F18925",
        "C_F4663152AE3837F467703D43AFBBB6630C1BA3529FA8A88B46C0496F26CBAAD5",
        "CD_DF545E8A447AE67DAD82438E1F3562DF5CD3473F59D562B7C0DB49601F84DD81.1606.2102443640.2485",
        "IR_4EE85D110211054A9DD8CB215315DF05DAB2D2D335C9845F6E590FDF8F6AF10C",
        "R_9F2C8728656BD03C35DD704E67342E1CE48E0B661EEBE259A5EA9C171C77DCFF.2457.1498661043.554",
        "IL_4083A194FEE632277CF24422F7DC3664252D8CC5F4D51DEEC6BFEF9D1B6B29B3.2695.1562081930.274",
        "I_4353D053338FE1B3BEAE97366DC623CC7ED5BEFDC1DE4ED2F848E1393A65BC4A.2689.1336821473.275",
        "CD_C5E17D61729E7377496CB88367D8A18CD6A24A14E576524968A24894CCE3FA5F.157.2657323805.610",
        "IL_3976F9C940649B19FA49610296C5FE509FA915DE07C17201C52676F0D9E3C4A7.2693.2706457429.261",
        "C_76074162D69587B846FBF4472AE9BC3E5C1AB65E11D4581012E58AE49E30233A",
        "C_697DA7CFBF1A5367B42159FA584B6D6C58403D44C1543977ACD7BED9F2898E8B",
        "WeekInMonth",
        "IL_24BCCF7B591DB29195248BF2B6CDDE6A24176027E52D64A8FD348C9CCB414627.2699.433477300.274",
        "C_D91E00BCF74E046025FDC560EFE12C70AA84FF7526DB5DF32B504E8DE7F770F0",
        "C_7F37FED1C026EDCE926CB499855DB24934E3ECD34B906BCF0F300E633AFADD55",
        "I_058D03EAB4D58BD68178C926B8674C3667FE7B3464201E046707D1197C7413AA.1058.815056437.347",
        "ROOT\\Rsop\\User\\S_1_5_21_3968686040_3210279463_847977608_1000",
        "CD_C21E8ECEFF103DE2D58A051FBB124028D9968F5617844FDA582F260A7956CF1E.201.1792625521.829",
        "CD_0B91D9FD5945CFB775F0EBD6F596CF88166602A6156A99CD2B11EC548E5ED28D.1087.1491143659.529",
        "KI_765084E1887D699089D5053E1B6F8275CB71A33668FD58E6595E74BE3D526F1D",
        "H9!$f-",
        "4\\8xd<",
        "I_674D91721DBB80B993698A04EB424D75B547784E615A0FE3D6B08FC38B4729DA.2726.1607930134.290",
        "IL_E20BA24A1A31380214941B26B83C29B8B31C11FAEB588752C8D490C56559FEDC.2723.4053017955.283",
        "CD_5B55CC60E350D260A8F85A1D6D077A9EC7EC36F61E7CF7459841A5E66A160FAF.2758.3416979679.357",
        "CD_B4744AE091F96C1897CB0086813E1AABE89C9AB276818B172EDE2A19A9884429.2748.1984495122.348",
        "I_228EBD5F3D358C3CF86C30734E7259A9B51A3D5346E336635FEDC15F32D3D97D.1017.3288142190.302",
        "K$i-E'uZ<9N0",
        "CD_94F2726A101D2A1E24F4ECAA94319E60322E839528620ABF5ACEF14DF1CEC5F0.2423.3711818409.358",
        "C_55B845C86C086EF59EB551FD3F61CC9B2BD4FD4446A9927FE5E4BCA04CC4B0FD",
        "R_C5761C3070F8524ADE05668572E4FDB40ECD5928A4711EFE630E999B3BD9F768.2465.1206482617.554",
        "SEL_EVENT_DIR is valid",
        "C_DE441B498E4159017D84748ACDE9ADF7B1C36301A35BECAC369393D024220578",
        "IR_00A3D44FFAF8698AE63571084DAA6CF90AC720DEC2AEF17232DB655787BF4EA0",
        "E49094B2697F81975FFC890786B7C5BEB22",
        "SDBUS_DEBUG_DEVCMD",
        "IL_DE350DEA48CCE31EF2397589D4B6C59DB89980CFD862DBF3B2A5DB92C3A0BC63.1017.1613574852.298",
        "A293D8E13FC549C1AB0831AC14D99C4786.2559.3157924918.696",
        "C_3A1D2B9036996AE4681DD029594209329760282E8301045223F1DC6AF85114EF",
        "CD_69F693B09761D259F9E36F2E07509E240E77C62CCA21F57F463D23C41F558900.314.1352278839.435",
        "I_4E3B41D96D254BD0B13085F280B90AFE76F4F8979DEC43BFA37559C60F741AFE.2681.3426386463.285",
        "IL_311D9C3ACD968247C11E436B1E6C36C4259B24FD47C4F84011E04989B2594644.2702.437244233.288",
        "CD_2A9212E5C5A3E7B6904A9AD5755292499E2868895335A7FB104CA7C39F4970DA.33.4059063771.472",
        "CD_E0728E680677E2DC755DB0B32FACA9688F4B71D12279046ADFB604C5714997EF.35.4240126380.467",
        "CR_09A5E19B62E24065CFCA8EE94EA9E5C149E6CB498581E688EF627C4525368332",
        "R_1CB9E7DC27B4A89E576CF24BDA3B45DCE8B5B969797A00622E9D1746514F3E59",
        "CD_592AD4245F5967C5343D00E56AE24D1F0F5CE094EF04D954AC81ECB94104BFA6.275.2766428305.670",
        "I_770150D5233DAA58436EF46CC2E3E8FDD5F419BD214CE214C0E13A73B28F9096.2593.1410923079.277",
        "IL_21E45FDE4FD81E3C9B401C7B696843DB04065057FB24A6308E103589C2E553D0.2720.2343512210.283",
        " L$(,04P8<@DH",
        "DisplayName",
        "I_83E79CF7F4D04D18333CAA6D37C201FEB5876774E73CDF5CF61FCA1666B6F661.2508.3480842554.325",
        "CD_20EDCE2D529E2E6BCE41DEE4170C3E9E6D3DEAF61091F14E5541886CD554DE30.1667.2913789371.362",
        "RAS Entry Data Size",
        "CD_4C51C80A2BAFAD3102FF110F62EC213D34DD3E23F9AFBD5B7FE6DAFCFBF7A94A.259.3048785938.2452",
        "Array of ACPI processor idle states (C-states)",
        "CD_F07924A860C6EA66C3DF17AE55C191EA3569D370A9FFFB4913667722B2AD2E22.1209.1815842516.978",
        "LastAttemptedProfileDownloadTime",
        "If the profile is a roaming profile, this property is a DATETIME value that indicates the last time an attempt was made to upload the profile to the server, even if it was unsuccessful.",
        "48<@DHLPTX\\",
        "TStateVersionInUse",
        "N!?W$(,0B4a",
        "CD_20A36A4D13FFEDA4F3BF68F20D7254C0839ABA34ECA738010C8AC2B49156D61F.1617.4065007010.651",
        "C_22E55A76AF91714908793A9D6F196391BDBB704CE7B4C27172941A36699A38A0",
        "C_92F96D470C0B7C61CA6FF1288FC335BCE4A6A5FC50FC3D3E646C17CCD603F881",
        "CD_5C019BBCF7CD2BCBAB2E1080A9EEA832173CDA76E5635A18F883174B94FE0F77.163.1.36415",
        "CD_12A251E4688047981D607B15F79436DB837E075ADA0B6AC78025F676ADBF2AD7.1018.1522518857.1117",
        "C_868ACDF7C673B81A9B86641640BBAD191E1BD447F658CE37AD4CAFBF6FB97C0E",
        "CD_9398EE9389657B6A830EB223CFE8021EDA6EBF0AE7CE6FA1ECC3991C40D9983D.206.1536074848.1218",
        "CR_CEBD2B5E33353736EB8594168A2AA1BCDFF196AA90419752C30E0B5CE08A9D54",
        "HLPTX\\`dhlptx|",
        "CD_BA1712135E2C9766CB6DFE0CCDDC8590C3F7AF3B44B9DAE601D4E1FEFD0E276A.1616.1181456213.446",
        "28350F8E74BCFB3DE8581F255129511C5057DD024CD5C7C6.2703.2921927041.289",
        "C_6F05292856843DE1986A7572C460F004B84C2B39DEA688CD0E42BC7443F40340",
        "C_85D86CD958DA6FAD92EA55F1468078F0400F29C2B1A327B27C870BF7829AB8FB",
        "ProbableCause",
        "CR_EE926C10D8DB2362A084C286637A937C23BD1B08558667C32893A01C572D0682",
        "C_C414F6F9E5383DC717CF413A8534BAA7170F0D0BD81767423A9D7B9FA1F44AD8",
        "CD_C793B9525D878D9706E959E8F468E81449F6D48F127A802D380F8F7D8B8795DB.2220.1.13418",
        "C_259A5E159C9BC70687CA1D3524FF3E5AFC0180D51D46E1351D0D2A9510F67A46",
        "CD_9AA05959F2D6F6E2DA1C86CB49EB3AAEB9B2A949B6BC67BB11D0F5EEA9CBA633.1074.2159299689.1769",
        "Request timed out, retry may be effective",
        "I_687C973F5689E18D23E76DF9E9019301006B8C4CC5C6A3F3DC3A6A8B646AFA2E.2686.4284999006.295",
        "C_3EA73D2E00ED14D42FAC9F0BEBFB30940E80D92636BD2423331E14FAA19796EF",
        "C_D6EC41525ABC21864A19F0FDAF8BF6677886C4CAC1281F55DE47919C07EC9C67",
        "CD_600A73C35ED5D3466F7E30F1C2489F076B5641F666F273A9F923A32E11B6B851.1482.1.52980",
        "C_BFFBB3D86E600A82D520DD30A8659721378043D33095F0E858A6F28BF4593D34",
        "CD_58C99E497FC42770D05B9C20CF9DCC0E695351111634B1C709600F377B5052D2.2591.2709335255.358",
        "CD_C5B405B6E0B6808F8C21D9ECCACCEA423774925D78B35437176C3B1A93D8C59B.2624.3215284010.555",
        "CR_6EB3291DAFAF5E4121A6DBB7E0E41C22E85218F8922D3C0FEDA4960BE686F47A",
        "IL_D95290D211FD2009C8136F6F0284F367384C72F689BDE191C0684C8714DEA096.2700.353544369.270",
        "C_47DA5E0552419DC8335CC62E42730675F46D97E851C5D17093E25A5F5DC94EE2",
        "31B5343B424DE2E9A05745595440D163D382B2134D4EBD8.2577.1837061544.1042",
        "3D5FD634C8.2581.1078115782.935",
        "CD_7D462EA5E87CA015476942A58BACB3893636973868980DA68AC5EC3B5A1C690A.2425.3916703454.358",
        " To Clean Drive",
        "CD_8B70439EE46FAD5A5F853DC982F916AC93055BC01548CCFAD507BBFC83ABA779.2560.2303982421.515",
        "C_B5621FFEC1C8B1219D99E9EA2FFA370611A11F7916B9B95C226F3B8DBE0160A4",
        "The Type property indicates the type of SAP such as 'attached' or 'Redirected'.",
        "I_8072BBCEF949AD08C3FD6035377954D54186B39AE522E1CEA1EF61B2FB3A1593.2698.632374131.269",
        "CD_FFCB0C410AEE7D445593F568F39CA2170FF6D60B08D2A845F16225D10B0579AD.1689.3020026846.3414",
        "I_8D9107E4ECAF109CE6D86793D80E0B566CE8692178AEB151294771B38F8935EA.2465.2887004433.291",
        "CD_20CFEAED94ACDCC3A138A72CB986A84D9FCBF45A8FD6E58CA8EE0387379B9D44.2612.2894527643.415",
        "IL_F55E9786D9F50DBDFB52762DDD65690364DF865004D37F7A0B919F2DED2C5FD1.317.1.19893",
        "IL_1CC77E4B68C0492002D6075D5E9D30A925817AE7BA5C5A105F1D5F3FCC115BE3.2692.183424811.271",
        "C_323A428F42246FBEB526509F757EED1F4F82E82540AB3A2C0A824F6B79F837EE",
        "C_18800683F0AC1EF87B0E6101BC5367F7C19783D4C31994E5DF533A6065E582AD",
        "IR_A1D5F02E3491B010F201B5073B17B53AFCCD5A0131A765FA4DA05F38783FA482",
        "IL_9DE14B7E9F2BD68AFDB33C7AB12FBA084F48B20BC2ED1EEB96FF5377EC30AA04.2675.1428109939.276",
        "d|hlp",
        "IL_DDA7D9196CC1FA44E5F7847951C406A4FD236FB796E75935821F2729692C49E7.2732.1372383943.274",
        "CD_E4F1C8D43CF6961CAD75D4CE9F32B9D90760450C3087C094F4C15FE6A994A33D.2136.55714116.604",
        "Running",
        "Whether the Terminal Server restricts remote applications to those on the list.",
        "C_A4CC62D79FF3BEE16BDA851BF3B4C6100B812B5CCA4229E192A675F8D51A19A1",
        "R_06F709A163637DA41871EC661878543C4C8F0288DCF32B1331F472D89C57FA5E",
        "CD_AE04C9051F0EB0D5BEF6B71DD5AAC69C1301952192332A53F9A676861E551DB6.1018.3301495383.357",
        "C_E78B24A63ACB40A253226DA76298C783683B9FFCFE28CF1078C510D46CEF2248",
        "IL_DBCFCBC22EEC426EE5798CBD5AADB02EA04474BB9D6D7248938C46C668E4F016.957.1.126857",
        "I_FB67BC9A01546DD2EFB6EFA6D39C716BA78CD1D0734C8AD4475883915EF8412C.297.2959364088.313",
        "I_C8C94034D2C193E2E0F766CF47324B6E56080059FFD7BB85570F023A93607A43.2678.1870396225.291",
        "CD_35A718313A1D788647FBE70E3BDCD7DD0916025FCA299E4EDF879E32418A1A55.181.1.13516",
        "I_9F3D1A1D5ACB3061E1F2CD23DC3307A4E7EE3D96E3DF2B5944C23C0FF69F8893.2675.1250944241.281",
        "C_D8C4BEE78676847DDA567812087141E2560365728D8010694F2F477EFE65ACF9",
        "865B9C000AF8A5A2832337841.2309.2939564058.338",
        "CD_7CFCAFA29BBD6FFB02C23645FB002DEAD6DAB071342C21E927EFA6EAFC277EDC.2450.2589863820.2048",
        "            <pattern type=\"Registry\">HKLM\\System\\CurrentControlSet\\Control\\Network\\NetworkLocationWizard [HideWizard]</pattern>",
        "CD_6603235838D67F0A31998AE108546BB74586B33844F47241F23AECE3061C708F.1836.3527522039.340",
        "C13CB06D607EF634390B88B3FCA354ED30E3.2713.942242480.280",
        "CD_810BF28A7C26F6878E189604887AB1090DF3478356CCB47422DB03C98B71BD38.1714.2462774168.244",
        "IL_50B704588B5DBB37D3D3B305CCCEFB65D916215B57ADE78B58DAF84095AFD528.2678.3166942860.280",
        "C_12FF1403706247189D78D34D4BF5A52AD6B7A216ACBCD5F201B98855D7C7F8E4",
        "IL_AD976713564515C89D00D2943EE72DCA758E7457CC3E706223AFC489A6C21922.2717.1007688508.289",
        "C_54C8B2145FBF6DCDCAEFF33B39FBF359799D5087F9B974E853C4A5903604B330",
        "C_AF2AF60829ACDBE308127B32BFD1BBDF676C4E12F2E511DCE55236AD4CD567EC",
        "C_3C22EE36FF380B4D0BD35CEC3718A5763A272DCD4163EFF8590784BADF9E36CF",
        " $(,05:>BFJMPTX\\`dhlpty}",
        "CD_CB9297368BD3D60B9C9822D5B6B73F15F431BB59E5791B2F4E04F1008BD11D93.2533.1979694569.528",
        "C_4F7F0582732763A5D116F240A92A642E6E8CDAB4D74513F90120E6F888A85C49",
        "IL_66834ECAF8F556D28A19655C0EB4FC65BB6E8CB3E4BF5B77E618C62A9EE55F7C.2699.1821232910.262",
        "C_9C8D7CB31C84BA37EB783B79D06AB5B7B22F9EBCB2A38F6EBA686DD609042FD6",
        "CD_C231F504E2F0694DB5EE26E89F896D184F3E353B388345FC3E332D3F432F31D0.310.617504159.506",
        "MessageArguments",
        "CD_830BF8BFA5BF93F39AE2488CCF30ECCF24868D5104B63DE9163FCAF3C26491CA.1060.1548614542.2064",
        "I_897EACA2347FBC71DC0E8FBFE21FA1F13FC9EAEDDE7A34C1DE772DFD6AAE17B6.984.1.15604",
        "Hardware error. Check drive",
        "CD_EE926C10D8DB2362A084C286637A937C23BD1B08558667C32893A01C572D0682.2626.3235149107.112",
        "SECURITY",
        "CD_31F8E16503130653E4107DA9CE6CAE19C0C0587F10807E44C03D26ABF0396241.1579.3987398576.1925",
        "CD_DCE2026ED26CB0FBF10B78E8B97608E5F27A055E0A11B1BC99B2DBD53F24F7F0.1199.3904583931.2173",
        "C_84DC3D5BF4272A04D490B0301A75593E19CE556EF346F7E0E8413D0189B83369",
        "R_6AE72BDD0B919DBFC69F59E9377DA38DCBBAC21329EE0949152EC064204ABDC2.11.696898079.524",
        "CD_1052CCD88A2957470D93AF17CD201F722846ECFECEFE2021E6E5FDFFE35BC5E6.2586.1551517978.672",
        "C_CBA62AA66749A2FDC924242189E9619022D7C9D4C02E2256557AE5388175FE71",
        "lE706FF8586C52A7176ACA48D7702EC2A6550564F0E42B0C09AE3FD1CCEA62CD4",
        "I_F39D12EE0E6F5AEA8B55C6487123AD8BB413A2652EA1549D0EF304D72048373C.1090.1701490716.362",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1104.4052977024.368",
        "8513295810B5C02EC2C4E8CBEFDFD9DA0B2D18D2C78BE706324484.2705.3628745793.297",
        "IL_241D9EDB5F67806D5261A757B5DC41BAD706546D3F8979AEF6762CCEB52FD683.286.296581747.317",
        "C_E00F912E9047D1A2BF3DA9E198CE534F57C5B76F41F1AAB4887EE2C73627DAB0",
        "CD_4B3CC5F49167F6FB69E56B79BCD6431008E7D86DB966C05AB2DF4218DD0EABBE.1490.1222519961.625",
        "CD_ADECB48EEF41EBFB1D5570217FF2A1BA19BC73CECF67D875589C0486F35636B9.1210.3203630919.1373",
        "CD_F9D55EB8FBF99520489EF8EEB245E36FED839C469984DF496D191A630243753F.1343.3570476227.497",
        "C_76391C5F827BE50BAD62D3F132AB199D19DD265648929C5B938B0F42F0FC59BA",
        "CD_00677180F57FE40C90A823DF9297D042CBC58C7AF83C3FAD79D7AB4D3438298D.2591.4190390301.397",
        "CD_1B41530915D00EFEECAB1BCE1CD251E643FC0379379396A0C1F1177FB152BBA9.1567.3553558272.520",
        "I_8ECE79C824EFDC6E9FFF68EA4E168D115D7DE1CFFC679067A8D896B92A7EFA00.1150.989067740.359",
        "C:\\Windows\\System32\\GroupPolicy\\User",
        "IL_CE596AFB16970382BA7E02CFF19096D995B70D4F2F08CBEF36E9F7736ACD0903.2469.41159217.356",
        "IL_BA51ED41265DA7310954BAE161AF50CE2679B701DA6D3DEB06FA741A8D05CD90.909.1.70636",
        "I_FF0C2845C4EF55842E7A462698504FA4F42C4D5F4754C93590380753911815ED.2701.296537462.273",
        "C_D47B33577EC858000C293FAABE7E384F7739B0EE6B3E7807EA011662225D073A",
        "IL_F64CBB6502987426C70B3559DBDC49D7508E36CCA9EC2C17804EE9C4A5287859.1781.1862597321.384",
        "C_7C532A587E5CD9F8B86C67CA8FC780B42415C39E5257283976EBC192B278B9ED",
        "R_9E80816304B77C3F7FB69E6FA27E369EEAF4355C2560E5D96A7A1A687778DD04",
        "CD_8CBE6A0EFA02AB4F93C3A1CC477E795A624A7AD23C5328A0447BAE721BD99CA0.2105.3068338540.556",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1475.418471363.292",
        "C_D9B62293E0CF7F70397FCDCA72F7D1BB2ED8B6BE7CED434B3198B6A43C6930B1",
        "C_81D5EE0C466348FCC52EA98D98F1F7728E445AA3EF3AA91ABDE468F68D150D57",
        "C_C867B637B25E413A5893A8DF403F24B113B36FB9DA058811D901C232D15C4E60",
        "C_E2D0A69448BBBA7800B110213F886227CDC660712EF504CAC24C411F80C241E2",
        "C_C3D9531050A687F226B048E1BDC0D3CDBC35A231C063FDD30671825B68A3AF36",
        "IL_6CE79943F6ABBB9DF682A55D8B4D22AEC9D2E4EA593752762B78D600DF092301.2701.2774636790.293",
        "R_11BDD83D3BDB7F7DD4A04A3CC49869E53E73157A8718941705A791A42E561334",
        "IL_7E3FC52173BBB0BAC6E789BDD1BE5FCFF346F5F20489B64EB487016A0284A279.2460.4151036418.347",
        "I_0BAE40148725A8BAC63C3127905070C22A7EA0559C443FE82181719B5F9296DA.2721.768645154.270",
        "IL_BFAF292FDF3BB4699612E434CFDB6011697001AA1134E7A67145F6C39967B2F5.2715.2452640255.284",
        "IL_0F33828E8CD7660C131A9B819C3D5A577748424BC8568964D9428FE644F6572B.2707.3821872533.284",
        "IL_230AC387DA340D197D79CEA2196083E5A762BC858EB3F88A76F1C0DD2AF0F22D.1014.3400401078.306",
        "IL_A6AE5821B60484A06D0AC9D7E0B3DFA474C1237C520458835B314783E8E1D54E.2678.3200760396.279",
        "CD_5D0AEF52806F8763B3001E7A769C04ACE567BDBFC936A90209336B42E3069741.2554.3220275655.523",
        "CD_85CC7AB11FB940FC1C1F33A4AAAFCBE19B7B68FFDD5AB65EB58169644DF2CC0C.2569.2368245199.2088",
        "!cKW$'T*-E0o36i9u",
        "I_BD0D9FFD284A3D1434105414B7483C9051A02DBB999FD428F208B174229540C1.2678.2019169671.281",
        "I_7F42A39E0A7CE0598AE24D3F823542C5383686655886C30E2A56BBCFEE4C9BA4.2708.1562184897.294",
        "CD_B1D75A909E6CF2DABA2DE9D5B0D2A805DDF2E38027D332B19EBFB8BA7F770899.207.3276850136.4672",
        "CD_9ED4C67E3712DE07C86D1861FC69841608A536EC7A7415988B2BEFAFF875D077.2419.1820755881.683",
        "C_E0E4C1D1D6DC9C06253CC569DB312A50A778443F11175AF9AD65FA40713C0F4E",
        "C_FDCCE3B8287A28E29DABA3413AA9105F2F7512D7329C1A17D887D616F6D5B8C1",
        "CD_C31EA868CB014D678DA84B98337697F37382F9A1219F5545B8C0F63812A2B18A.2589.1728648149.619",
        "CD_38529E11DBEE922C6B8651639B26646929646902C4820BE48AAF7AFED4E23F03.2112.1125907344.558",
        "Indicates whether the device is using a user-defined configuration.",
        "CD_D90316B018BEEB2B1E88D6840D4570916FDF527A1A6CAAC9F2E7E462B55B6534.2612.64266314.366",
        "IL_0FE8DF8C1589996CA7CC6EF89C3E3F94B16EDB28E99D479F30DDCA4CE5D31A8C.2683.2061049043.283",
        "C_ECB038604F9CFB5C266539C1297002E6A1178A983B1B38CAC375931349F1C5AD",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1049.759024781.368",
        "C_A8D7D05E30C15984C36B978D9865EFFD857B3D0BF5D2F0230858282BB5082506",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2469.4106410547.368",
        "CD_B6CEC77857253E4D66AFB39AE432C9A262BFEB17666CC3330EEE5CA9EE49D1E9.2649.3744842064.1055",
        "CR_39937D1A990EDB6E14CA46EA323A9EE91A51DB10D306E4059B3A249A61F356A4",
        "CIM_ServiceAccessPoint represents the ability to utilize or invoke a service.  Access points represent that a service is made available to other entities for use.",
        "CD_7AC6B537C17B7A0CE625AFA6380E4FC98418E800AD64DF240D5A7AD2482283AD.1741.1528103963.3269",
        "I_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.281.3674678782.266",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2285.2199995986.368",
        "IL_AD7D6DBCD9440E36FC7987418BBDAEC267B129E90DAA8862678D90C76E8C8157.2705.3415885812.296",
        "R_4082A72ACD016CE3E809C18525EF28CAFFEB76B1D6E2F5C00FFCF2C67654A896",
        "CD_08D881D450D0615D55EC2939B63E533A7629C39B5BF81A337BC629700DA3A69D.2561.942203896.81",
        "CD_15544B0DAFDF759BD10B745F7A926F46821115EF3BE25FE076FC3A533C317B2D.2041.3185762786.421",
        "CD_B2810E6A01F7F8E13C9D53CBD15E68AC21A43268E9F315153FD0564F6B343FDE.2651.885745768.586",
        "Acpi C-state type (1=C1, 2=C2, ...",
        "CD_FB45B8D9320E818405D79801CDC499E87D50956AC9FA6D71D017C76991D657C0.1835.3709208497.246",
        "IR_01C76FA468673A0EA1B9609DBFD73E5A3BD638B19A8136374B3D41724E88832E",
        "CD_CE0AD3258F9165F0C84072E7215F2F147CE8BF8C8EBFE1F2993D6D33A7ACF17F.1330.633588388.1559",
        "CD_DA629F0FADBF1E9D6C65713F31978C9EA30680E880B4ED8EDE3DC7BD5AFDAA23.1829.1813233206.431",
        "QOSWMI_TRACE_CALL",
        "IL_3ACA7AD06CA4330413E7171DF925C5CA0A5550961C2D7C4B534382253F10C024.2718.2557330558.278",
        "SystemConfig_V2_FlightIds",
        "9507886828639D862B915C2E790ECF4494E290735A03.2714.917675366.290",
        "ScriptText",
        "CD_144D4C797025D5F745BEEBFD67F23C11AD0A3E44B8F25CC1AE6529A8725D0FDE.1923.2421061327.299",
        "CD_09CCBE426DD52D60374145524B2F98C4F709DE617A8D3D97D699BC5E8702A3D1.2623.3454393096.395",
        "I_129AB6E1DAC83B8A4F15F872069B1769D0052D0A7D6F69174C6CC64702798ABF.2712.1831612025.298",
        "1DFCA6D8DCD7E0F84BC79C2E33C9B",
        "CD_55BF0CC0F072F8672008BA2E217FC98D14173100D32640D32F61CC0295647162.1836.2624725017.435",
        "C_838E75DF6AB0A59C9F2477F1CA99D3050323945F5A9DCAAC9E77A5F334C030A9",
        "Total size of the volume.",
        "Record ID used for System Event Log access",
        "CD_1C06FA152DAF97258D99D731FF917040529592936586FC456CA74403EF6A2F73.2015.3809618351.1624",
        "I_4DA31228536D7EEA690AF1212C94A5B0009BA569104FC10E91F24C9DB87D5B7F.2682.3206376737.279",
        "CR_A65407F850C2BCA806A67DD48A46ADD12B41F479B7F5CB65FF34B01AEAFD8220",
        "C_72022A8BDF25089F605FC84A81EE8AE05C8F18AE100EE84E0479148488E12E1B",
        "C_79773BD5BEFC486DAAE05E5E8B1D31984FEAADB212CBBA311F38FEF122B52E0A",
        "8.956016752.293",
        "IL_6A2B0A9C7B7C0903BB38093EB49798B19D5E84B3AF09045E44E986D4F108D112.2721.265848960.270",
        "IL_2C954BC688DA51FBB5260AB5E002A5C395A6540DE89E02F3E5A9E1A1CEE1E69D.76.2693172746.336",
        "IL_B400BC134029C70AB9435E8EA5C14EE52388FDD5D13ADAEBA0DBE4BE7FD1DD38.2686.3172438685.289",
        "IL_C5572CA331FF7D2319DF129C6A25B45D02F06377BAC9A5BA382198B38AC256E6.2711.1789631824.288",
        "I_8DFA6F8BDA2FE04DF7169D42580A4C901605542A1ED260C3FE90F949BA4A5619.2690.3392676957.268",
        "I_0ED380DCCE5F8BBB4D1AC97ADFE47418E9E71153132861C7AA0B46AF1DD6829F.2723.2755789728.283",
        "C_13C28897773F6F5A9F386870999C3296188ED475D6EBA22A9A6782D9237F4CE8",
        "CD_0454DDDA9AB999B5E05A2F468BA888F0D0794E6BA1EBDCCF2A4463EC03258CC6.2756.446692965.621",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.2168.772470297.3240",
        "RSOP_IELinkItemLink",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.2329106888.180",
        "CD_37D6265F83F0B4A807334DDDEAC8A1C96BFA3B726A45400FF628A9564B8A2E7A.1153.722392494.308",
        "IL_E4B5BA0B959BDDAC8250BA9F8D8A7FF702B15C5A8E8D139A523CF672F723014B.2749.7684156.526",
        "CD_F275C6D7762007AACAC2F7FFC21BE64DB98987C474F6928DE4850F09C68CB078.2527.1761386746.488",
        "IL_F3AE5537136156EBCA6405210F21B14598CA1F51BADFBCB082B304FD616A73D2.2489.2872381519.185",
        "CD_1992DF472DE2CF4F69E851A4667C5DB5DC597E55137C5429FEF698AB76A58E58.1189.2376811829.248",
        "CD_5F192F4806ED9253ACBA1FFAD785D4714394819D725BEB5E03EB10475B8DEC95.2735.3668877947.521",
        "I_979EE137B7C11A7F0F75CEC1E27403E614C52F360419B7A48D6C0A49CFA16637.2684.1921070963.286",
        "C_8BDD9C2AE81784F0CFF79A8F035B6CA9B5C2EC0B45383CE33CDD57DF061981E6",
        "IL_F63BDEB78036B11EFA70B819F8A3B678563B9243432B6919B10FDAB9FBC3416D.2689.4267110888.274",
        "C_7CEB103F91AEEF1DB6C084EBDE11E5E0AADB5B9B8244715CE731078F7E98A92C",
        "C_9419B1A0DB6A484AFA6622F1DBD50C832E33E81DC79AB571DC2722548BDB7332",
        "C_F69D8029CE443505782739E5EA30F705BD18A050DBF4E379EF0B690D5B10D87B",
        "IL_7376FD33C025FB191993CD2DF559B22E6E156767F95E97941FAFEF237747C4AC.2694.4107065185.271",
        "CD_B3F4A5E799165E5BA2CB97AE575C11DCA4F6D7931E6C7C903A686A45D038C618.2540.2432599420.516",
        "C_1FF3E8B084EF958D6CA51930B35BA398A9AA3DBAED426E535ABE1FF42F771AC3",
        "CD_1E6F678E6BCE749DF0153368FB664AFDF910F4DA39F359B6718D12E67F50AF65.2512.3371997660.418",
        "!$'*-036r9<?BEHKNQTWZ]`uxcfilo{",
        "104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "Association",
        "CD_4FF6A0D7C7A873EB07C9F2EA16C1C5FF4B6E7F5EC9C729192D48026A285849C5.154.1040325263.299",
        "CD_04614BDB14C273E807C3A761E5E7A888794C56D16B624B2E80A3A0F6D5F3C288.1609.1110600081.252",
        "R_7CBBFC903B769BFE526D96D753E16AD7ABA21D8A6B6B1A1612CBB8FF7201B692",
        "IL_B9E7F5EAD53159E6185ADF58A8D8B61C5EDF296789DC3A067A12BE700E01BFC0.2684.4187390490.283",
        "I_3A223905E9FCEC4800143E4FA3BF6EBE3B648E13262B02F9FE156D1A4C86F538.2707.141074353.314",
        "IL_DE7D9A2881E8380EC27DBC38B315B2ABB6571F52BCA72FBC807D288D40DA3B91.2716.2772376066.273",
        "CD_9670F10EE6DDB8E306101B08B39BD50A63BEE4B7DCABA524C96620EE066E2BC8.69.24359775.705",
        "CD_1E76FBA0D6D4CDF2AF49F47090DD7A0679CCCB0DF5D7E9760575C0D07C29A63A.1329.446986317.1691",
        "C_CFA7490FC441CDBFE3AC487F4E7E6794E550150460C43DF35BA636FBEF5C66C5",
        "CD_8125E110531A89ED8BE4900320A962FACBC3DD4F09BA92855250F1BACABA704B.1057.3369276777.2652",
        "CD_81BE9C63EB8A3405D994E7603DC3ADF9A42254FF17D1981C7FC4E773D0EE7D7F.1205.1197180263.1420",
        "I_F20A17854D196E5F5EAFB2F68B5391393593509411BC3D5F3DE70A824F1D4E22.2504.998400869.326",
        "CD_4F5A769ED4733707603FC6A22AF6C35EEE4440568BF344DEBABF96DA0E5DDBCB.2611.3657645165.388",
        "IL_B93E6686A3652ED68A2C315C7A4538886FE8CF7FE0CACBC7828D45201F16DD39.1976.1820495434.185",
        "I_3866531668703809C4B6A09D929C49C7B7AD945C5864C9ADBC91554E3BB2F687.2716.2325602390.292",
        "CR_960A016BC71A8D938443FD5B4BD545FA10D9D76A0776A92D75D4E23235CAD0D0",
        "I_DD370C83218E3ACF4ED3E50B021E588714258891A76B1EDBDF23E122A58854C5.2736.248644412.287",
        "C_BBFCCB444CF66AA09AE6F15967A6865175BB0ED216D19970A7988B72CDF0A3A4",
        "CR_A1FA642616E07036085EF84F710036D00B5AABB5B7AF69C0A4DCF1DE76D3E553",
        "IL_522DAF94893EC0B668BD3D2A7622F536E2CEAF247323F83CBE0BA6A66D2E9051.2713.214133369.298",
        "I_E57D75B361243F2E2B78DA73BE942446A5860B3B577BC2450A98F33FBEEDA2E0.2725.935686389.283",
        "IL_66FFF9930E5CCC0D760D3BBAE923EAA766D470F40F422E860FC653AA3204A9F2.838.1.60167",
        "NS_010BA7C521D77A58F4FCB91B289C9241E169732EABA949BB5DD5F6C3F77D62FB",
        "CD_B96031C532B0B65B8A381FC99C330B723A6082950CAD96992CF66C16EB037045.2426.2850915709.360",
        "CD_8C6DE64ADB30E76FDF169C4158D6C7A5755650401C9DC05B818D0256B4965C17.2560.1951280333.91",
        "CD_4382409C2BA25AB891FE25D9946357B2012609A915D0D018CA8A80D2ABEE1CA0.2196.2268194202.308",
        "CD_A1FDEDE7CEDFE5C8E19FD85650C6CE61DEFE385164ECD849CB5636A26A1B8561.1992.805500736.472",
        "C_4DCC7262F58735D0369C2465199BAE7309EC5D65C116FDC51CE48CEED8FD847C",
        "CD_B5A3125475EC1999F845D9B1427844DB11B8F89FA6DCA7DE9440334DF7CE477E.1355.2662511476.317",
        "I_A67B9FFFA0CFDC97B3FC55A15A9D50F12D2051478D153EB76E83F279C120D408.2728.577311948.289",
        "C_74D18ED7931F151194726AA4F80A7BDBA270A650F2D515B15EE9B3FBACF2AE3A",
        "CD_CC3EE48409603DEE1E986C935018AEA6ED00D5C887B2B6A22814F97B2FCF9344.1538.782474007.266",
        "IL_54D90EBF2630D0BC11C6B6DBE98653E97CA23BD481DBF30E14637141C7BBD987.2725.4011659211.284",
        "I_30CD5A959B1EBD8FB6B1B4230D23AB6DE8D97B42F3AA6F60BFC23575AD53C499.2729.2831769606.290",
        "CD_4B9A5F4131B4DCD11042ADFA6FED4351D5C27774CF36F6AEB30CB03131693AB9.2597.3374554747.675",
        " $).26:~>",
        "CD_124B2D8A86058DD102C833379996E9AF4D90CC4B792958ACD8E55DB72860976E.32.301280484.505",
        "IL_77E8F3E5C979A568F3203DE2542233AA744B340EA7CD046A020B3F37D5ECA5F4.313.3856196657.315",
        "C_48DCF233795F6A034546761490780DEDB258CDB8D1B0B692AC380ED7FB5F5C97",
        "CD_7010B213179D98B16AF38723EE1D750E86F808F341EE215AD8783D29EA117262.0.2693613263.200",
        "IL_45528D2594C2AB362CC71E010181C243627131BC2359B157DF0B76661CF6C4C2.2689.939180613.274",
        "CD_040BB4AE5C8C1563BE4142EBDDB8539C7E5CCE64A27291E9F997DFF018BE9069.2160.3768636244.1712",
        "I_F96C64619946F851E2F35B91E58551F43BD1370337FB6CD1DB384048DA29E785.2696.3868162098.278",
        "C_9306698C01F89BF0B51534BC38CEB10F9556344574338B9E17B1FD19E593FD78",
        "2615B27D56E94A95716A",
        "CD_57AD49AAA93A9DB4C747A5522BD17E886017CE9B2B40450392A8012CE5FE8334.7.328390149.341",
        "IL_772A8F3C1A879F6F522DB41802413FB92A41FCC7ABC89F8B927D3553A3CDD265.2677.2040318047.280",
        "C_83FE6007ACA7CBFCFFECDEAF04CC25BAB1807917E74F65A7A46C4B6A4B61A057",
        "IL_726DB399168CD81D137829E7E423593BC5984A9976A11F757044F530613326D6.2680.2747942734.271",
        "CD_5B81692050F83AFBC70426A27EC09C2345CAC4183BA0529AB3CFCE0E87409447.76.3816077903.529",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.1939.2383100844.2505",
        "C_E73791EBD8A2A4E4F92906978CDB7151C51B74DF4CCCD1257A0E79377B27F049",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.1968.2898736535.188",
        "CR_4FBF4E2F4EB997E78BE6A08310475D7F288690ED00FBAA96A0D81E2F361482DF",
        "I_C59E83547F1BC933FE30770D4EDB5077AA988B54FE242F5F66DA214D449E875A.320.1.62809",
        "version",
        "C_5CA1CCC1ADD6EDD53D29BD2FBA674BFE0E34491E54014BEBC938A889E571EE4F",
        "C_4BEF3BA1297A2B3BF1D8FE4388786F7AA6C98624D3E280A958E01D4D621BABF0",
        "LogRecord",
        "R_B40D3520BE405FC4657163F736BABFC4C621DFE31B785DB86EA40E1DB23F5C09.1155.1802257897.520",
        "CD_2337B9B06F01E50F06D083E14CD407858889BA1306F3231FBD80D8DA1B8F42E1.2116.4090782352.1564",
        "CD_D06FF5A6CE3076476D1F40A765F73FF8BA96747E87381434E3700375D9AC8EB6.1915.784093796.263",
        "lbase.dll[MofResourceName]",
        "C_0AD8A0F3F46F174E51800DE07BDC378F9D501A3B9BD6CBD74CF3DDC169D713AE",
        "IR_058A5B1FB7DC952F689B612BDA615642767025FE637F2552CD2356FE70E70C3F",
        "IL_B475A6628233B4944B81DA3423FAE3BD8F18CC98CAADFF5AF00B029CA10EAC6A.2728.1610181514.280",
        "9344F0C8B92C754DB789C65D353A.2715.2041322341.278",
        "I_F7892AFD6D9BA41C6D80FE1ADB06C631B78639A087981A07715ED269E2F38DAD.2764.4249442355.290",
        "CD_B73E13EE752D9B5AF02139CC8E7B9DD86AA46977B13267D0D5F674F26F8C3D67.14.536656149.1597",
        "CD_7564DE160753682806BFBB9AE3DC7D3E1BBEA72CC1D5BCEA2C7C08B97EC32311.2596.3187811705.951",
        "`lPT\\LXd",
        "CD_8B16F5C9D08DC38A0015EC6EC9F81FE1D24CB08BFC118E051784D65CFEF9FC94.1849.1757004875.312",
        "CD_9A36BB4E390B7DD04D76CD832679A7EB96B353EDC2C276A7C316493A7FCF4652.2034.1.11863",
        "IL_80B4FB12F93F8F9E46B7B3D88D1D395B44E63D1E42C4BBD5690A8433C69C16A0.2729.3200228428.280",
        "R_AD28C82889667A5985FA157872F7F42C3CF0F9FD284883BEB8BA71DEFF026FBB",
        "CD_C35EEF60ECBADD973E5F52F74AA78C6D4DA6ECDB10115F29664F3A01E3A5EF73.1607.2822175510.277",
        "IR_C00914885257A59D087BF17CF6D92E3E0CE6FF4AA6EA44EB35243AB7C1D41EFE",
        "C_358B12CC56B70C7D843374B1FB6AC9DD612AA1C2EE5D505F60BDEBE9063C01D1",
        "CD_1E374C5CBDEECC7830AB4BADC56B9C8330C5C89908E9DD8A429AF2525AF02748.143.1590274229.579",
        "CD_99150BD9D0963359046E30AE0385F17D4AFD0667F8DA5119FF433CFAA1D95BA6.1616.2470776709.760",
        "I_8F59483D428B08AE2A177FAF77675A77C85F88DE7C8B3EB6EBF49ADE58E241BD.1049.1738361069.332",
        "CD_5B30FD33F8DF746A0ABFA5683DCA5E00E4D0D5FBE9C94C2B951EAEAEF259A109.313.114733133.498",
        "I_78283776885EA759117348CBB543092B110599BD69E23802546CE3181B6A1660.2728.4223727328.279",
        "I_286FCA41CF8EE63C715C5BB44EDAD1BEBFEA2B5170AD4E8387888C020A3A6A4B.2682.2915352232.283",
        "CD_2B83AA8F75CFC714C0F50F640CCF8FA5668E9F3C1EC370E4CB154F1F7A1D7265.1929.2678484380.315",
        "CD_322909C324E622DDD863C72515146E16B95F7BFB1C53D81AF6A8766C2DAF9100.2665.1379388889.564",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSSESSIONDIRECTORYSETTING_Prov\"",
        "CD_31444EBA8BB43DA8DBD0D24395E48CF844E079E62BF930386D9B66970A85DC88.2538.610681753.502",
        "CD_A3FF4B5E169562F5D12527C651F2FA9F17677983CAE812428672F30175B2773F.13.762807350.284",
        "SystemConfig_V2_Video",
        "The scoping system's name.",
        "CD_5B55CC60E350D260A8F85A1D6D077A9EC7EC36F61E7CF7459841A5E66A160FAF.2417.1351650076.357",
        "R_0B5C44F8259E201E409A59CCC827AEA5F69AAF6BCED724865BCF62AE4F5D48E1",
        "CD_73AB2C44348A01E13C5063D68EF8BDE94E3E3724E6AEC9BBCAA1E2B765F4DB3C.254.858492149.742",
        "C_A9DA9643F1490B7487AB9112B0D41C52A94CDBB53E7BA51793EDF555168DBDEE",
        "CD_F9DD6532A9B443155D1071E2F0AB84CB0636D514B871291ECDFA8724B418DFD4.2654.3199115803.3577",
        "{C7BF35D0-AADB-11d1-BF4A-00A0C9062910}",
        "CD_48A8B413DD01FD4E2902F07984087CB61CF9EEDF75071E3262DDCA296E4FFEDB.1089.2165483628.2182",
        "CD_7DB1E30FC06BBCD83555FCA1DA86A907938086DE88B466575ED4B935DD61EAE7.2747.1894812071.770",
        "CR_DFC25D46E8711DD4634FF6390AFD6E0F348F88B4F5FAE966D405DF4EAE83DD54",
        "C_037F73558996BA2785098F824A14DE2797E69E82C9ABBC6D1677D799C2469137",
        "I_BC5AD3143069BFCB69262A507381A55224EE383E9B759A94AFFCD6368531CB90.2691.3416350184.273",
        "C_DD3FB1A6B8FC9755CFB7A3BD7A61E1F24E5C869D8697CB909E277ECC11293496",
        "IL_652899BEF964B5756522E7EFC190447664B621FC9B3EBF81262A72C5E4E7FDA7.2724.1386415506.289",
        "R_07175BBA4C96099E611E7C4DB8EA7DEC92B3AEAE5EC6DF957DB2495087F658D2",
        "CD_766206E818648233F1D08F1C00805E3E5967D15F801236FDA71EE3E046A5669A.2625.3804231864.567",
        "CD_D368279AC7611DFF322A93B0CD77B818394B5868D25FB187B8F5084FDA0E03D9.2644.3742202263.762",
        "CD_4F0D52044CEE6BA44A797C21E074FB5F72A44E740DF64604538AC24885525391.92.1697486634.4727",
        "CD_90D6DB96E4E52DF3FCB751D8C2491313C169EEA2DEA2212CBFE4EFF8C0A5E947.2199.1.9836",
        "R_E284DDF7F9BBC191C804CE3AADDF197ECFC83C10E016C1AED712528DDDFB1F1C",
        "I_2E32DD3C4304AB7C0A3A6A35FE2D5283221F256440C1893B09E3BF79A85CFB96.1352.520578658.333",
        "CD_2648AFE05B7E0F21678E759462EA0EABBE7924AFC35D246F32D9D0F1F494FCA9.1152.1808496283.1335",
        "CD_3D908B354A7F66DC7D8262D5E5F0BC191C813424FF188C05C86C05A6827B5F6A.2569.2130770256.384",
        "C_6E75D4C819749F5E9722A83F3C343A6D80EF23A64BAA743C46005810D5648AA0",
        "CD_EE738305AB82E79FC2AEBEF9FDB7EECD7D8F38AC9E39EAC6C3CF28317D50C03D.2164.802479030.6178",
        "C_BCFFCC5A22D2740C320A7FDB3EAAC4A750026811E61430ADA48FBA2937496A0E",
        "CD_2B88F31612D07208335917632CBA42B5144EFFDFF3C42A0D46D364832769C7A2.1210.2765336719.1611",
        "CD_632DEB324ADB39E99E029B3D88D503FFEF1874CB755EBE99E55CFDC82CE6D7E4.2120.607612604.325",
        "C_C65556E786DF4564CBE8233239F516214163DD07540C77B7EF0400555C330CEA",
        "IL_8A5AD65B06F7A25401CBAA52F8D2CEFD2985704A647EAE4C6FDF828C68BAA46F.2702.361491930.271",
        "C_B7BCFF3BD4E96F7233C3DB7B6D678F32D754777FD131B4A0A3799E101E4F57D0",
        "I_61D4B20454D9364143E7FCDD696A05EA880F3DCC132A499B1EBCE94AEC8918AE.1192.2086484367.345",
        "CR_4EFE28EFCD0C2B5177C06210204A407FCEB7434631D258DE8A983EFF1957B86E",
        "IL_66D0911D2E593F3A030F739B357141769143C63FBFE86B3D6089E24DE4662608.2709.2019070949.308",
        "26E03A9CD28DCA2B27D411BB6E709A37FE1343F5951BDA6FD8A5625ED37BA0A9.2724.3503486538.288",
        "R_77DBF4A2C876542515BB91822C77D6AAB627C74A2589D8CBC4096845BC539307",
        "CD_6C5C2DAE2C64650DACE1EA520E342735F87D6EF0971D5E51C8AE2D0DB4D8C448.32.1013777851.245",
        "CD_A197A2E8E346C5375E5D0AF295B78A2E735B718CFC86D2835DC277AE3619AAD8.1936.3041377580.322",
        "I_CFDD604C12736088F97C89BBC5FBF36ED46E389716803C97FA884CC1AC9F7E21.2687.2592553765.263",
        "I_E40B350B9BB81074A88A01DF558BE6E740B757A79BA5DDB554D0F7289A193F17.2490.3040695989.257",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.286.175755000.180",
        "I_64FBE9828EDC5352EE7ED640E40EF41D5C38B6F407714D921DCE3E3C939987CB.2729.3355516801.279",
        "PAL H",
        "C_BF2E32F34A5F7D261B7E7910E52DB1F5079B7B7A7D2B77621CB4C50273B0FED9",
        "CD_51447A26417532B0D1E85276A6FCB955003CCAAE5927BD755A45CC87195E9484.31.3579466317.527",
        "I_9BCEBFBD099FD1DBA49B8E7BCF49EE9762FC2EFF302F652F7F56BF3EDE25D1FA.74.3024936235.324",
        "IL_5F304EA31F540B736484842115824C52B8E4A0233626B75C2F34A619427DA021.2694.3687428411.277",
        "IL_C18626E27D5153E5E65B72B574D4E2FD4416299A7B7135AC8C51438B7D94212E.1730.2534232684.258",
        "C_C55A7470B8332BF850F6A1BB899F44CC31C22E85ECE7FEB3F9DFE496B3C9D7D6",
        "C_8A4037032A1E93595308B4A4BD6D8BFAF65C3C979F3304AFFC616809C573E05E",
        "IL_BF9D9C18AB1A6E18A896CC939C82B68B48ACFFF2BF3B071F74FFEAF1FAE680D6.1475.3660458206.288",
        "object:ProcessorAcpiXpssState",
        "IL_6D22E6765B24082487DC01F79A0CBFCBC29DD914668BD112A684AC2DADA054F2.2688.1604652562.265",
        "37CF40D004E2BC1C3C9AA54865F4",
        "CD_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2.295.428008690.1172",
        "CD_40BEEFCD86669714A96D09FC1ADF38E568E0B01D634EF8F9AD700B7740B2B19A.36.2230701201.646",
        "CIM_PolicySetComponent",
        "I_59BC0068B038A4089ED5626B5D1D159529697F84C38788359E6DFBE8EF8E26DC.2706.1103561493.286",
        "CD_14DF306943DC1B0E8585D5896D6D7F13ED3ADFC7A98396E8DD2C249991A63F81.2731.3989980375.472",
        "CD_CB81A33FA900BE00E042E159DE6F8039F1548250D14E30B70BBB9CFC0A6BEA1A.1927.1879129171.279",
        "CD_F7E10C2E2B48C52ACA99548FFAFB6BFFFF056CE9E9128CD48CB817FDF7995302.92.1610037842.637",
        "IL_F29747F1B42309B32693FE58FBF3044CD0D70EBD90B65C0FCD3114E1F2EB0B4C.2693.2785841877.266",
        "CD_CAC510593AC97614DC7DA1F7D9C423B2F603C46FDE077301A4FCF1E4C1DF7D3A.2668.1467727777.2299",
        "IL_C2F4B2EA758C7AC5101B04C6A132B43B64560A5E41B7E83EECFDD2AEB1A0B8E9.2675.1453024317.281",
        "I_9025C44479FF81CC37552E9E15484B67725972910FD071DCA563F8E23E7E64A1.2713.2287922391.269",
        "I_6B8CCA79D17488359DCE5FFD86F45344F84F53675357FEC2AD164FE8986853AE.2733.1387306287.268",
        "'Q0iN",
        "IL_7BA978978EBF3CD1200A10044AC0BD6F4758993016B7F6B6A538255F2BFBBE7A.1714.1663788667.326",
        "Power",
        "CD_752C67D757A6F2589FDF45E2D269397D4C432586AD444D4E1B04E468FF08F446.1053.2836220632.481",
        "I_7E6A00AAB8467A7129258A087A168DE70442F1968001FDE8C28653B84A0C1849.1783.2181022474.281",
        "C_17431B4BA51D33CDA0A6628CA12FC7DFF5F227BEC60D95CF88873EA792342553",
        "CR_5241CFC05A716A77CB0F36844F9A62538AED075865B9C000AF8A5A2832337841",
        "CD_947907BE0C21868B3B6C1E2B3F2F4D8F4078DF318D2CD738491AC5AC30B4B16C.1749.3031933529.4088",
        "IL_BCDF0AE7DC27FAFED7F3086084877E579AF9D73C546674217B8E86B2518960DB.276.1212514244.319",
        "CD_ED34D9141DAAA89570F479B7904D4A54BEE568C398745E94687501AFF6347D73.1616.175170767.250",
        "I_F0042948ECBA803A94D8CA796F6D4DD68A4F72206CCABA1D98BD986A7FEB68F0.2695.217060527.264",
        "CD_316028CB4766215C2B0D3643DCC0FC70FE66BE560FA2335CAFFF2477CB4C6F30.2155.3724963980.602",
        "R_5E33BA8BB8301B0D571DB35AB12D7C91B7A0EB2F54B87081058135E8F4EE33DF",
        "I_833CF2FC625EF4866EF85E33162234CD5F7B9296EEE62518D56CB29586601709.1049.2046614358.358",
        "I_D126CB9ACEB4A89C6350131720BDA85BDF8F63BCFE1166682567EAA1A387E8C8.2677.1242840697.280",
        "CD_ECA4BCE942A7519C8BD48784B00775961389BBC39B370F76AE4A3294CBE6E51C.1130.3735372922.572",
        "CD_5D2C2C389F5259E45332A86ADEF5107186DA3990C071FED897FC6FAECC4A4DBE.2747.23143372.938",
        "CD_4B5C64D8720ACDCE7736DECDDA8FED0DA8228DCA5109D852E16DC3C5EFE24A0E.1779.258580025.289",
        "IL_4DCD1ACF6E58BD1330355B0B3B8243F10A72B1F7E1970F7E01C7080A5B69DC53.2764.3676300688.283",
        "IL_081DE5F9EB43C01864947DA4AF882FB1863E1DA519AB3901734A76A173C64485.2709.2397577002.291",
        "ScsiInterfaceError",
        "Connection",
        "CR_1283D6E2E269ECFAA20DDCA78E5D8B7B8AC13879915B95F38BE4B062F89C60F6",
        "__PARAMETERS",
        "C_D266306FE2E96A3EE8770CE67DBE546B0BF71F7E68572A79B961704C44143357",
        "CD_0B714A230756027CB9D944F3C101E5485E82B469361846E74358E5EEBA5C05B7.1982.4189401759.1502",
        "I_5B104B1A1FD8AAD2B44F01BF67722EFFACB6D9A71C19AE761C0348FB376BA4C3.2706.2938299320.292",
        "CD_0359987C58272876B4E70E901F284C82B892B0C1E02B693AD3548D264D28EC8A.26.3767636659.483",
        "CD_CE377FF1DC98C60D09A1A5EEDDC831ADEF0BE67608F841B05BCEBC22F775AF5E.1924.3429957555.287",
        "LPTX\\`dhlp",
        "CR_18844B622E692B354A4D328535B8F3AF7181D02C445E691E16C25BD8BD83D1D1",
        "CD_0CFEE70EA76040BBCF59E006C673746B621403E235671233CF5C1C2B3513102A.2004.3074798521.1549",
        "BB03612DF3D",
        "CD_79FD2B1944A0E8569231538101AA02032B2AA1FD92C317847D2089CA52F4CD72.1151.1786882101.627",
        "R_BC4F91591102411312342399DC065D3EC257C15FFCA13E42BB6956DC3F1EDBC3",
        "C_0427B3D7710F368D831E2478F76F011E2ADE4882C334EE5ECDBD3047B1FDDE39",
        "CR_264DACE30DFDF75A51B9E979ABD65B07E47DD7DF3824D1BD7D92A8F6E964F507",
        "I_88BAFDAAB1775EC92264DC013C04AEE63F8417FE6B4B0301EFA0FB0087DBEB76.2678.2779009724.285",
        "CD_6D1FE252E44FF3546ECC7BED576DC3967B39474BC0CE652BF027660AF117633A.34.4126378243.490",
        "IL_AC0D055AE7600C2FC6AB7B3493AB0844B90905ABE7702F6A368CE617E7383919.42.4233334980.318",
        "I_30511FEF4D7229EDD9F61828DA461D3542432F60B6FAD9B220078B9E544898DC.2724.2965865318.288",
        "CD_71926B9951B4E8AFC04CC2F1AC5B5FEC04E9A08320F8B28164D32D905C0A41AC.39.230330083.342",
        "R_118A1F47CDEBC2925C5ABD33020B702449ED5C741A93FD969EB4A5E3F92C27C3",
        "CD_A8D7D05E30C15984C36B978D9865EFFD857B3D0BF5D2F0230858282BB5082506.2055.4090916021.575",
        "o?[k_wKWC;SOsG",
        "IL_BB8A83D677A9FC08DA3FCD78BEA677C8D8861EE1068A03174636F3EC2BDAAFE0.2700.2551233292.283",
        "CD_0E67BB25323DC3EA41359AD7146AF598B2070A0BF4C85FF998893FA100060D77.134.2071192141.5838",
        "CD_3BDC2F0A0A90E9AC9B64A580B95D437559985136A7FD8C2487C72223A8541D52.121.2126112667.277",
        "CD_DEB8226661849F99E285DB968248A6315D998BF5C70E2B91A71169E0DA8F6A0F.1730.2229849429.1606",
        "I_CB9407B4065E0F63CAED9A02B73B9B563740059198D9ED7DF28E5923A029E487.2729.298670185.264",
        "C_484456E3E724C112AF20813C7339BF5577C8FC1EC72751890A0F458FF4330C9D",
        "CD_747F5E7C0B1BAF697DD9EBC1AF5BAEFED7039E2B0FA9DB258BB8C709D82F4D62.1152.3090003867.850",
        "CD_358EA9FC3ED4190A2370A8EC86B7836AA3C33AB96B1DFE8CADC56BC95FCF2EB3.2615.3712905063.412",
        "Trustee",
        "C_006AB7DFED58A8FB352581D21227922FA9FD887AC08F63A547BAEA9722B5F62B",
        "IL_BC62D2F1A8964BE05CE3C8E4A92D6196F3ABA9FF68221E9970F3291305AD53F0.419.1.28222",
        "EB53D92D124F8B8C12120BA57E3D17.2425.2009551787.359",
        "CD_48639F22C84BFCDA5B7656A21504677ED77A6D8810250F31ACE17701DB0416EB.1567.924561169.884",
        "86F3D44587BC7BAFF4CF40",
        "Process_V4",
        "CD_7D6C83B23F09AE427F0F210CAC35450338EA73FBCC7D3A2335FBB72CF5113C2A.1344.957835421.1010",
        "Number of XPSS states",
        "CD_8390A92B686E2E10DEC51624CF7D9A9B36CA99C04138C2088DBC0519EB26D47A.1090.1646392810.1357",
        "CD_85616F703BB41919B48C4869294417D5BDA27AE8BF1EBBCC58D3F39A497E2550.2559.3304238733.660",
        "X25 User Data",
        "C_09855C27687BDB8520C47679461255159BA91E0E3C4C7686E42D9642ABA23A95",
        "CD_4BC6C3BC5AEBAD208F4642F30DD04DB828A3549F04DD643E263C528D3DF80720.2600.151931724.1063",
        "CD_E79E473D9AFE640F2D96DB2EAF3BE608705DB3CD9E43BB21D75E95C836D378B4.2666.417543465.219",
        "CD_6DC34F83B2836B7F4C49DD4CA9153C9A45B781EB43F2F01662DE7C715D9C447A.2425.877880317.234",
        "C_2E1AFD899A7DF39A097EBCA4A5DC0A90DC9AF124AFF6ACFDEB2EDD704346E50D",
        "CR_D853AB6209D8A11783FB9991FAFED1455C3BE9CAE115768B2C2CE0E0FB306714",
        "C_54659981D2A7D25BA2BC70E6D9F1B1BBCB5F9112DFE994824ED0B159271B07C5",
        "Cluster size is too large",
        "CD_B8353D57A57BDAADE8E1FD8BF3D42DAAD04CAB50536C3870BE8C32D1CA4CBD9D.2195.4286869377.4819",
        "CD_639A48AE01E60F4C5372BCE94302125223C8DE05464D188B338C60C65E4A5441.2103.2130381399.548",
        "Xt`lhpdx",
        "CD_559E7BBCB66AB99B2C2082F563286257BBCF9A5FEAF75E8EE8F89CCEC43CC26F.2036.4281323272.907",
        "2\\en-US\\kernelbase.dll.mui[MofResourceName]",
        "CD_243302F4ED326C4625A4CBD70133A669B2EF782BDD805336E89C6CF9975728E8.1780.4212697875.357",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1607.2158628475.312",
        "A986771.2724.300483189.285",
        "CD_5B57890445E7E878D7B64EF956A3DDEA36F2F14256CAA768F99F8B4F9C5E8DE8.1339.876827658.589",
        "CR_725C909F3FE4FF1D4452519DC5E7319F49B4FDA30799FA428AB30E8A93652894",
        "he scoping System.",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2426.1804810359.188",
        "C_E306E17928F5CE290021F4389D925B031C7FC2C7179F9BCEC2F74EEFB178968D",
        "CD_79C2B8878CA0CC7D263478DAA5B22069FB6ABEB9CC6BF0071DCCD3AD247D51A9.28.1850633609.464",
        "C_6E42F619B70AE9A2B05F70FCE3E0B6857CF973C6024DBCB714BC2386FB5CDB64",
        "IL_904CD6392C08F11BA2B08870A539A15F063CDD650EA887A8A66909ECF9C03466.2699.1298145196.272",
        "C_C02C41AB4846F97931E5D01FBF12A4A1A5B3CB06D088BD1C51C3165A032FC9C8",
        "CD_DAA0835D90559AB1BED3F4706FE66DA711EF5A48A581A0339267CD41A8EB5EF9.109.1905789022.2115",
        "CD_C4F59114EF1914FF05B5796404E0ED8DD63799DB51A6E299D0727FBDE6B4E0E1.1172.1416357816.288",
        "X\\`dth",
        "IL_7B64BD1A702063FB6768AF5ECC7D55271B9693C43DCC4E726540B6D5A0AD4361.2696.3456982458.278",
        "CD_848678FEA3E9DEEA8B4E9FB42ED8A13EB705C3DB7C73AB893E320FAEEC87714C.34.2255023300.501",
        "CD_30C53A78E5A4B68CCA584E17EF756F46F9A296CE6092725A408D68B59BB13207.143.3218025619.632",
        "IL_78016DA4421A681836ECD7E5063EA91D97166838075B72A11E2732D08CE3DF2A.2690.3474447830.268",
        "IL_990444B5147B385848F6A331FB9B78A4118CD4F34316765DD7E05BFBAFD92E46.918.1.39586",
        "I_71005F952FE2FC32CD0FA4A70470333D5C27BEFAA0C76305B3518C03A8932C36.2725.3604684920.294",
        "CD_878D5D30666EBFE440F941E45E7884E8AFCA7A1478E4D09AB57DC26571C8B7A6.1166.3704247041.272",
        "CD_1AAD15D0EB29FC4E49A68DD6B88432FE2B29874A40629B9F43B85BE2528F2B3D.1059.352354253.533",
        "CR_95151EBC7602F93A6E06460EF447E398F547B7CD3033E5B6ADD3848197B31384",
        "C_1414268BF3C6238A6AD001B5A24A141E87C99B65D66BDC84E11131854913C45C",
        "TimeoutPeriod",
        "CD_47C79E62C2227EDD0FF29BF44D87F2FAF9FEDF60A18D9F82597602BD95E20BD3.1.3107675964.545",
        "CD_8771AE8CEBB5614A0203ECA1F5690F7C9DE50BB712DED367D1D2978F0B190194.145.3413369464.1108",
        "CD_F875ABEA98E67A9A740EFA2E6386D639CE399E917B70AA67FC167FBE9663EAA3.1104.1073571879.514",
        "CD_3BCF4C02D0A41EB523B8FF2DA4C32F97E022499682A6B17DB192BED984F9E902.2540.2285454122.508",
        "I_14E81FED65CA256A291552D7368076BDF086E65B079868D33E50C9799C909A98.1065.962537403.248",
        "C_3C0F796244DFD96C7B5E800FBA3681576ACEE35F389BAAEBD707BBA1A2C07ADE",
        "CD_16B53E03546E9EFF1F249075B4FA58DB5F9FC819CCD55304DDB4EF78A2D0DC79.2583.2496145743.268",
        "C_2C1FABC8728F9E076F6727DBB7BA1358C4F010407356DEB983BF769E41D5848D",
        "CR_0BEB647503DA8595D54DBA8F17137DE78FF091F7255EBA5AB7ED2C6BFD16F66C",
        "C_446C8E078CCFAA4D5AF15A685216770043F4473E2978CFEC5807CC510810D39D",
        "CR_D3E87AC2C5095799D67D44AE7591A2749E7365471471AF9E1AB7656018268D5D",
        "I_D65AF43B13CF274F605DEEE8C21428A9C103C93F1ADAAE99C3F86725574C22CB.2692.765496254.276",
        "CD_DE8DE1F6359006F632B83164424286AC021768B2313FD2622030D37E0386BD3D.2732.1217101763.1046",
        "D6D3CA06D43FDA4D5185F019B0F00C9DB5B7",
        "IR_886C9F8982A417AFDAA51FF78BB9E9B6EE19BDA8B9BB937D782CF5D5173B6652",
        "C_794585FDD06377DA31EE3D3B03C0A57FC0568A677B53360CA94891C058706420",
        "I_35A96137ECF8FE993CA96CC4FEC248539FEFAB4B9016B0BFD028E0D8CC517A98.1014.2811396759.539",
        "CD_0454DDDA9AB999B5E05A2F468BA888F0D0794E6BA1EBDCCF2A4463EC03258CC6.1082.535376705.621",
        "IL_BF6901C41BC3F70A2E12B9E6997F8D7E348AE9FF5E0B8ED060D61681E2CAE2EA.1758.3676325466.196",
        "CD_EDDF316486234851D86580CFE9B06D5A43E06F671105861787434F12D58AD4EC.2003.3137869100.1368",
        " pHLT",
        "IL_1302BC33D2CC0B7398266EFA48293A54977795ADEE83F81DC208486EEB94307D.2689.3630002167.263",
        "8076D3ABFB2D903E8954CFE0714462B3683ACA1CE8C8B.2699.2873230368.279",
        "CD_3E82FB959451C3E35A276AAA1FE1C0F9B93A0726AEE69E99BECBBEB606DABFAD.1150.1586891667.501",
        "R_0180FDA42F646D19EEC85216A140C231868F43DCE0B8FA45078244BA438B18B4.2466.2980322375.558",
        "CD_3977327DA4A684093CBB0BF33A8E056D65F56091BF9001EAC76FCC8E0072BCF0.1991.127202954.549",
        "CD_0992284CF6AEAC48C1F5BDF0973A6119AD14B4C683C698E5BA85ECEAF0A68CE1.2560.1670629687.987",
        "I_78B6F38D069EF7E1419A54226868D93B0F8715683284BA9C0F9C5AE33B7A0F47.1015.2915752813.282",
        "I_D2EC1BEEEF8BD7E6DF62521A5DC7CD9E1F4B90D3ABCE3B2115D7BDE3450B5DF5.2685.3078453749.277",
        "CD_A58EC39ED92649A90AED1FFF5AE4D021DDCC83A8D429CDB678D3D29879253FD3.76.1072882690.631",
        "C_5D2BB5E72A2F48A448D0C78E4EF523FCA37E91EFD1ED92B23F38B836649C78DA",
        "]`cfilo",
        "R_55B08F04DD9C9E70D75C4B658179B532987689BBEEDED345CB4FF8B1FD93B221.1049.3908331562.542",
        "CD_8C9782D73659C517B4402B8048CDD3A9B1023D31F875B4A3CD21F41348734569.1929.3994637946.1057",
        "I_904CD6392C08F11BA2B08870A539A15F063CDD650EA887A8A66909ECF9C03466.2699.1298145196.272",
        "I_A313F7C19EA7804AB752D70F4DBA974D94B583B64D2531ACBE701244463E736D.2680.2266213277.284",
        "CD_4504210513F67AAF0E0DA4CD3DF8D84725B21CB68C87194D9A008B88A53ACC71.1354.2368266938.998",
        "Implemented",
        "CF368AFA80F6E068CB06A37904A8B7DD0285DE45F269076401.2704.3647049337.282",
        "IL_6FAD6F5A3EAE1935829EF4FC6A99FC807CB5D8AD89CE9BF67AB558DA70C47AAE.2682.3062810708.301",
        "CD_3ED39A09F7C28ED81B80D1B393A95B0BFEDDF76F149562E9E7C25315FAC12EAA.2664.1613595490.660",
        "R_9671316BE0648F7C1D73FD6CDDBB29A6CD7F8E1A0572BD920BA61DD15D49A12F.2466.322490298.554",
        "IL_86D4D641344D1FF9B432D8BB30C393CFB16A1FDF7722D84D9DAFDF0DCEDB49B4.1016.4187163215.307",
        "CD_F22CAC1390F7E25096EEDDC9A22578C183AAC4BC2920068C5646D2049B964F6C.1543.3687658765.263",
        "C_9CD624FA4DF4296810E97A9B08FFF2EFB77A0D2A782F9FE4CFB022882BF35378",
        "Association between the security settings of a file/directory one member of its SACL.",
        "CD_034D78523931C983BAECE5A02A4B6934DD8AF2673197544B9922FB153D366359.2575.27281383.522",
        "CR_9D13D81A0232A3B9A054E304F017E99ED70EE31D77185E5048D602C8F68F1D2C",
        "CD_84A63FB7A3FB9450516F5A71E160284AF2F9D586FAEECFC8F7755F2A2FBD437B.1090.3546333786.1668",
        "C_700A223C2BE9D4D6498C555306C3D6D2A20F7ED7C0635EDD45F157ECA54B627F",
        "CD_CE52514EB297DA97E5DF5727E753E855973F6ECB94C0DC5B3C12AB6889CF9DDC.2606.2357424901.5133",
        "B.2723.701907449.274",
        "CD_FA21EBCF6E5D32820AD55E9B2F2B94C75A7711947B6C3050C8DBA3A61357B1E9.2371.4092627101.993",
        "CD_16275E16EEED6E74BD48AA48ACA3AF381CEAB3C980CF5112BF5B3053B0589A21.151.3056136412.728",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.15.3694202428.180",
        "IL_2D0C01B191AA42E37D3700F82901BB11F68C84D0E59E61C6344C7FCE29F0993B.2709.2040667514.296",
        "CD_D63B2E428B324CE42216B4AC30F80D2A5C018A79E096B20541D71F81E50F1ADF.1777.3846948287.5948",
        "C_D301EB050FFFFB91F3BF1F6274877F7EFD35FC266AF4AC45A7968B005C4EBA69",
        "I_C5572CA331FF7D2319DF129C6A25B45D02F06377BAC9A5BA382198B38AC256E6.2711.1789631824.288",
        "TP_V2_TimerExpirationGroup",
        "C_93BED21E4403FE1925B49EFFDF6A432C635492492790F985993F805DBF244D7D",
        "IL_A86E4FE82D68DC639C18ADBD851C146386472289AADBFBB0866B1EEBE2A6C9CD.2688.4024393650.264",
        "C_D86C15BF99128D54E1C4E3F5A93A0197771C9165545EFA09266BDF39527B7972",
        "C_811F21E21E3C947C4246D387AC49BB437180C2FCFD12A53EC0886AAD37BFE4BB",
        "der://",
        "C_CE2777A1E2E8F0439A275F7E5E7BEE453C2145F60A592F57CCEA55492EC8B6F1",
        "R_CE7115C334FCF4CAF18774",
        "CD_783B56502A9A1736307914BD795CAFEDDCF40975550F2B1F1B9E5C2D8281BABB.1927.317018726.1037",
        "C_B39F79BEF0550EE7F9E981A83A152A3A4B6173B3A32D2E630E92CBAA2FE60E90",
        "C_4B835375C85830D11DAA3F01F5AF9F28573A4521B9279B28C7605832DE3B39C3",
        "C_BC87BA25BB1436D8750E91A07B8979FA977826D3814CE58B45979E745F750C02",
        "CD_955E009A78C91FAD360B439EA408CFF48F11DEE9AF7E212F013EAC8F62A69A82.1270.889666411.284",
        "CD_E02AB7B49575715400AA81D4F29AC25F671C3F156359A5BF4B3C01A096EB8A80.2624.3211972762.544",
        "C_AE9C53160D7B3434C4E52312393F9F5DDEF1A08E93BC409447AB0DDF8F479C75",
        "CD_1CE82144EE1299C77E9BD021B10420F34770A35F06A428C70CB37484054DF692.2582.3843143199.222",
        "IL_A35DBAB35C3CF07CDCCC0AE2BB6E98B9C172137A4FFB5A56D4B303A1BD6835F1.2682.1936251055.276",
        "I_B400BC134029C70AB9435E8EA5C14EE52388FDD5D13ADAEBA0DBE4BE7FD1DD38.2686.3172438685.289",
        "IL_E90825420A03A355401BABC7E9C1571C91D779F20F00B90170365DD4BA89FFB7.2675.2670735586.281",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.100.2474730606.188",
        "C_E52BD2BB65ED90ABABACDFC8937D94C5808CFF6C3FD9A7BEE235CE9F6DF64BCB",
        "CD_56FE9CF506AF648A665FC37363A7CB5F1672DC90AFA053448840C6379E5C652A.2547.545857258.1388",
        "CD_3C255F930DD72FA8F7F77864CA85297EDF04F5CB14F89518C69CF8B38A9E1152.1597.4009386445.4507",
        "MSProcessorClass",
        "C_0E19745358152D7DD268B75D5DE0D069A29391FEEFDC9B8C9DAEC7711CB61175",
        "C_ED68C5D9F6B69094D35F0FE61D30082A4B839307A54E9EAB1C21A62829FFFE84",
        "C_D494E492A3A0BF7E3C7D842F7DFC0957D5D8EFA61B08674E106F0CEEA4957122",
        "WmiMonitorBasicDisplayParams",
        "I_F58EA9A4248FB79DDBF112DB65B98127C9A78FF4DF9FC34835E8B50C808C985B.1740.2918443704.280",
        "C_EF5859518AF699EADFEF83344B1EC83C53B162AAFC3675188AE399275DA07521",
        "IL_ACB78AB1C22DE7E2D1D91C09C96C157ED8C7C29196B9534A8A961D540401FACE.2683.220166618.280",
        "C_EE738305AB82E79FC2AEBEF9FDB7EECD7D8F38AC9E39EAC6C3CF28317D50C03D",
        "R_E6165A2C7DA53547A217F4B5D9149125910FEBA09B8BB9B320094C6ECF81FDC5",
        "CD_D353A723558494456907934904E2EEA7D4159B1627D44F40729031ACBDED0D25.1058.2135715552.530",
        "CD_FFEA4821B3229778E02955009800D7C28902CA2F2FADA0207E76D6E1DC9438B2.1192.1459908907.308",
        "I_4083A194FEE632277CF24422F7DC3664252D8CC5F4D51DEEC6BFEF9D1B6B29B3.2695.1715529161.274",
        "I_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.3574059521.338",
        "CD_E18DB3EAC6347E2FEA4BE12F740509FF8499D2E40E3CE861C65CC1D7E71BB2BB.2572.458458135.478",
        "IL_1DA4E180531B401F40077208B50BBADCB6F447B0318A02A094D8CA2E1EE53845.1734.3927880155.318",
        "CD_EF9D1330272D4FA53F4D27BDEB85692B26627659356689430C4A1C94857C96C4.1555.3899432424.1140",
        "VRsla<{",
        "CD_E87C6D1DF020D21117D566D92C9BF8737A877FA32E48AC715BE7C467C0845954.2650.165718883.1479",
        "C_2703A8E21C310CB49F8D78606E1171ECCEEAFC54D7874D34C41113E240A97A5D",
        "CD_F3DF3A8473C281626F19596F908669B74CE3CB4720460E1BD9E5A98DA2E125A3.2606.1456075406.851",
        "CD_53EB6E498B686B11DD3F721BA7DE3B9821C3BF6A37ED4C0E7215D08454434B80.2167.3561191357.934",
        "registryKey",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1085.615373410.180",
        "IL_2F614DE7B96AEF9D65EBC8096C0533998A03001F7BDBC16F17AC0691C0EF61B2.2694.881534551.266",
        "C_C8D0F277D7F7D59AF0E214825AC68160FC59DD15097C20883A4D4AAFF0736D39",
        "CD_5792E9D1C6933FA6423EE5A5FA8BFB08652AE142B0B622790C9FE3AE890002E6.2614.4169530838.394",
        "IL_4C7C518953A43F5F3E93A11F1F14A943E39130CF4EDDBF37461B4007D9EAABDF.2694.2842347919.265",
        "CD_7D462EA5E87CA015476942A58BACB3893636973868980DA68AC5EC3B5A1C690A.2421.1345333124.673",
        "BucketIndex",
        "C_592AD4245F5967C5343D00E56AE24D1F0F5CE094EF04D954AC81ECB94104BFA6",
        "IL_4EC544AF531E13F7ECCEA34174B06787C6B104EB484B1C6173645A633BF7ECB3.2709.1879607412.294",
        "CD_82389622F0014D1AEBC7CBBD10ECF0B5E66F16E4794C2046DCC791564783DD1D.2608.2119575430.4775",
        "`dhlp",
        "CR_F868F055868CB444BDD76D275762DD6CA91787A71E8E2E82BE9CC7E971E6EDDE",
        "I_128E3497A7B9585C582706F0CB14E662A033FEADFABF19FD1304E460A1023EBB.2707.3225679955.279",
        "SX\\`dhlp|",
        "CD_DDF41F712058E6FEF4B65E9EE58420E8EC3BE99BA2F5F0ECA951B626FF28D64A.1937.377268835.2454",
        "CD_E6B31A90E686795D9E916C75179C5E297CC54460E452CC51EA148281AD5C6D23.22.1.22615",
        "C_43D2FF9F27C9DEB49402058FFFFEABC225D67F17C30DC663FA2980525D05DB01",
        "I_60E5E385E51F7170564DC3A25AAA1E35C0C27B9240E9CAF9E2086D795B396162.973.1.8675",
        "I_3FB1CC987258F8087BD78386B8DDA093F7A2030F966FAF6199D43EFA0F6275CC.1530.2477947574.253",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1714.1717270635.368",
        "R_65670528C2EA14FD937CA1B1B964391453F7ED6B34E2124125BF4158BFB9B491.2469.3756611127.558",
        "CD_976E9CD39F31ACFAAF8B7B730E468AD5B2E5984554170330FFB447FBCE0ADA0E.2052.1423395418.151",
        "I_6EA9F2C3FCEE35A10CF321FF135D92BFB9D8BBD96163C1D731E8ED4565828218.2693.97880717.266",
        "Z]`cfiu",
        "C_ED4454436F5D89AB54BFEDBE7EEBD0A50AFC4CD518207832B9D92042E30CAC88",
        "CD_B96031C532B0B65B8A381FC99C330B723A6082950CAD96992CF66C16EB037045.2424.100236262.360",
        "CD_B9093598BBFFB548EB3FF6B2B67BC96D6D4830488B1896E4F8B9E8CCA0880EB9.1598.1471313958.2650",
        "CD_81E923C5F7AE79357104AE6BF842B77A8DC803A5873AE34E77FAE62049CD7FEB.1210.2148069860.733",
        "        </merge>",
        "CStateVersionInUse",
        "FCID passed into HBA_SendRNIDV2 violates access control rules",
        "I_E94566BF504DD530A5B6CDD8332E0677930FBB4322E53A9C53D84633C933B6EF.2764.312650886.288",
        "CD_B9D58526785010F225A5B7C3571EBE488D29C0DEC319541C93BE914E77155B6C.1820.3877890581.439",
        "CD_F74F5C3E1B9BA2367C698800DF2F3BC633C4E02E4FCF6F1DF2A045F2CE914992.11.170559490.556",
        "CD_ED8BE0EA146608759C0E924287397948057A0F5F3DAE6E95080F8788429EB473.1539.2250730984.589",
        "I_03FC7356696B81A172A3FFFEF4518C34DB3C12FFC7871897C20171F501F26D8B.2711.1966896471.289",
        "{447956fc-a61b-11d0-8dd4-00c04fc3358c}",
        "CR_AB754770CC19ECF1708863E61B4513A3C8CECABE89D78E5D727A64FE3F1CF111",
        "I_227FDB4BBC644BF919A882A6D6A822A0CF6177C421C416CC297E11CDAC01770C.311.1001239533.249",
        "CD_AA9C35FD43405602C3CB92A608E9261205300DEA694427FCF98EBA8499E2378F.271.3738206259.2416",
        "CD_9AA05959F2D6F6E2DA1C86CB49EB3AAEB9B2A949B6BC67BB11D0F5EEA9CBA633.1069.2161339289.937",
        "CD_A5716A1111B0556A1A9C5C3C1CDFD55516DA831BF69A2D30A3293C34FED97FEB.1341.3575152204.90",
        "CD_E42B5C460ADC9151F70DD39FB3C117A9B223F5296D170916F738E34EEF8DC0AD.2451.494377928.247",
        "C_7F0BCCF0F309353695E66B6692B97AD29C859CFB167DE9C2C1DAEAD8ECD0C810",
        "C_73AB8511F9014E512E85EF3A99D2DD6FF770222649518B384919441776FD3714",
        "!$i'*-0369<?BEHKNQTWZ]`cfl",
        "C_BFE9186C8BADCB7FB42B3434B982F9192C73CCAE78C6F51F4DAAC7017A7F6310",
        "CD_955E009A78C91FAD360B439EA408CFF48F11DEE9AF7E212F013EAC8F62A69A82.1231.4250234883.425",
        "CD_264DACE30DFDF75A51B9E979ABD65B07E47DD7DF3824D1BD7D92A8F6E964F507.1689.88608955.3806",
        "I_F14E50983E78473C89DDF4F0506F026D6084E8093E3DBFD59B47FB67D5F2E570.2706.4086162953.294",
        "TP_V2_WTNodeSwitch",
        "CD_B7CB0F72C5888EFB87CAA914B3258F858F11D8FC7438CC22070822389ABE2635.1079.590439044.953",
        "ref:RSOP_IELinkItem",
        "CD_B7C7EBA056B6878B96913AC0866EB26FE6BD64B4655DF4094E2D5C0299905F93.2472.4086593895.378",
        "C_E6323222C9A136F6C273CAA11042C26BCC58281688835481ECD05350F4040D8A",
        "CD_9257E4A3C9993B750EBCB6C34C9BA11105FABAD75B9C0DE005A64417B00B58B0.102.123742570.2050",
        "!$'*-0369<?BEHKNQTWZ]",
        "C_0A78EF6F4A690AF3AED26FB328EB3A054B82E3E4610773D4F174482BCB6B4DB6",
        "904B578EC322.98.2438259581.1112",
        "IL_6BED86547A30ACCAD1302C7FA283B163848C4E58E936CB646E57DB7DE244D555.1020.2824652200.339",
        "IL_F0FBC16C69AF599D2D58F1CB4D2AEBE096BA8515F4CDDCD6273020AD067D8DA6.266.4157939198.329",
        "When set, Microsoft Defender Antivirus will check for new signatures before running a scan.  If new signatures are found they will be downloaded and installed before the scan begins.  If no new signatures are found, the scan will start based on the existing signatures.",
        "CD_6207FC985B813296446B1804CB375DB5F534F2ECBDB07E00035AFBECB15FD3A9.259.2489553391.553",
        "object:AcpiPct",
        "I_6C11749CF1AE1583453B87DD92AA1C40BE952C725430FE95A9BD0EC19A79EF17.2722.2063478766.289",
        "IL_48470CE86E49C23DA181F2E7738F61C8EB4E4B1D716A16F59BD2BEACE63CBB20.1355.3038214724.327",
        "CD_ACA27975EE2F3A8821B425F57F3E45975100D0F3FB352FCB31C5B5AE152C7062.2650.2043429670.810",
        "Associates a connection security rule with its filters.  Instances of this class can be traversed and the values in the associated filters can be modified, but instances of this class may not be created or deleted.",
        "C_39F968F5764B7E9DDB73F6EC4A846D4BDC3E681F93642FB5FC3C2F16314D065C",
        "C_51219B2D884EF21668EB59BA30463FA5A52EEBFAFF61E950DA5A48E013805D47",
        "C_AA4B70EA5255AA64C74A83CD5BA0B9857A87B20B85485E53E4E0251E0DBD36A9",
        "CD_F9D38D348FC17C2197F17E4023229520C6A842B2796EB1118A92108A9751F1D0.2151.2655286028.3290",
        "C_498190A28B0F3E8C8B0AFCFFAE238D6B691B0B57B3836158124AC145A7281391",
        "C_AC74BA8CCBB8B7653E84CC3AAB6F43C1B7147F57F54B0A2F4FF0A55FCB7892BB",
        "CD_693EF552E8CAE369E34FCB40434845C8767F2347237F1BB15463E74153D4460A.2645.1800817825.244",
        "CD_9212E0D756DE59946D687462B752A6AF5A16EC3A329D47D13E039D19732A1344.1650.177051227.341",
        "IL_77923D2173C879B95D49292840E68EC311AACF0FF2F7A2622A9190F156CB8302.2689.2775617555.284",
        "CD_D86C15BF99128D54E1C4E3F5A93A0197771C9165545EFA09266BDF39527B7972.1501.1885213678.936",
        "CD_284916CD952AAE32B075C2CF9D6353A3004441F29529D83865782726D8CFD589.2117.2767610903.5514",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1104.4052977024.368",
        "CD_169484918492FC0AC4886BF1A48556EDC1984793E915C243C1C0A4B8E678F4FD.1638.175585457.323",
        "C_C4F661973CD3C0A0D2984AF60EF23047396681C367251D4E47D1DDBCE0BCDFE6",
        " B$V^(n",
        "CD_5DEF9BFE66A655CBE7B777B455F104DBA2D630B76C5936DA5A18E1A0D8E40195.2540.820253238.506",
        "I_5FC21C0FDB0998D61B649D1F2C9B01A173119F7C8A74F086917BB9A0BDE8B623.2698.503221653.266",
        "I_DF1D72ECC9268213FCB43A06A38DBF2A7452DFF83D9A2AF1D89F3CECA76D4AF1.11.2576163929.295",
        "I_F4C1AC0222DB79E3065DDA236A77A4FAF1134A00ACB9F5DEECEE0A5174DE685F.2697.2300640180.279",
        "CD_3D509F135C704C49652422902B33D6493BA6C4A55FC967E5BDCAA83CA4EBF452.2758.2701255511.359",
        "C_9C89CD12D6BC26922A4DCAAA9B4707FCF99911A5CC1919F958629CE9DE116F55",
        "IL_13264DCC489ECDAD5E2F82808472499CA26CA3983AA02FC4B2D2BB93C3215EFA.2688.1091158563.280",
        "CD_3929A976292C0E92F1EE078CF7C2D3C5371AB7D7BA2E3A5C78D38FD26BACE479.12.927762452.1617",
        "CD_EDDF316486234851D86580CFE9B06D5A43E06F671105861787434F12D58AD4EC.2015.4267966272.1368",
        "CD_9A376F6E77D1E893429991208782EDA1E1B82E08D8048C53AFF147F9753BF1B3.1809.1751631352.862",
        "C_043F48AD48888B41BD56388FA26ECED8B66FE9C03EB10995414C716325CBFED3",
        "CD_8421E7DDE4CD5FB05BCDE6376703734D11E3617323DAFFE1E5EA09D95D7CDCAB.2603.2026284665.903",
        "CD_C40F396205A3C460159757C7C4372462627467759E48BE4FA913571C84ED93B6.1915.3140039325.1019",
        "DX$Lt",
        "CD_8AAFE17C9D1EC81145315BD7AEF4364750F7DBC256E4CC6ED0176BB03612DF3D.2591.1000420494.2290",
        "C_05D3203C0AC8D19D2C308667A810FE5B8035D169B8097B184681B340000218A8",
        "CD_A1FA642616E07036085EF84F710036D00B5AABB5B7AF69C0A4DCF1DE76D3E553.1187.1305377553.283",
        "C_831AA66AA33E94794A3BE28998D5135FCA9FB48FF5649C034A00E2F57ED4C256",
        "C_88F6BCC90DFA936CEB051CC0CC5EBEAC8E426A3D0DFAE58E560CEF1E3E70C3AE",
        "CD_B5B4B91D054FAED56EC1E175175350AFC61C5B836E4315DE267B9DF851E58184.1176.1984847396.621",
        "IR_AB83450D2C362894742984071630B17B68677FB118022A7E22EAA68EDF64D1E8",
        "CD_58E6EEFCD70C52E85CEB673B88C899F843EA51E56249367D7B9F51D1947371CE.2611.642328149.381",
        "CD_05D86307E67356113E9CFAD910D75E9BFE23BB951797AF2481B14C2508E361D6.1561.8255365.1050",
        "C_7AD87B163E5F080E34E60018A0634DBE95115F38F1BC264D0B548D7507D9109E",
        "I_848F29A63901337200804F8E9DA5D75139FFB9B6BEBE17778C2DF932FAFD996E.2699.281711501.277",
        "R_390D5ED0BE7821A9A41296EE6280A1479152221DCE5D93BE2F8AC7791409FDC4",
        "C_4FD2270AA7CC321848B51530B7A77A9E39B5486B55CE0C09A2B597A1F1FCE1E6",
        "IL_743393BD969EA9ACB80141616D25C1F7B86A0E3CA36C03A63CEB0D8F52434E39.2713.2596363464.290",
        "Image_V1",
        "CR_4EDB0C2EDCD30D554E7C383941B8594EDB5845D9DCDB0D98A92A091B1D481759",
        "IL_1C2F9731FFAAB2895AA06A9C178A0DCE7180DC3DF07E11BA8DCE057DD43980A8.2687.306420108.275",
        "CD_94B70633FE66960EDC7B9B01078D8EECCDA0CE9932A491D21AA838CFC540C35F.2666.2875493470.596",
        "CR_73D523E5D8422D25C3616043387358F30734A705AA52BC4685A9ACF44AAE4050",
        "CD_D7A5A6FDE7193A09C153CBD1A0ED6D9E1BE99552FF2A49A452AEED9CDE64FAD5.216.2233760374.656",
        "C_21A80891DF55F17F9156BBC6AF5DFB17171E94A3610E79FE912FDF2AA405DE37",
        "CD_978F575657B58CCD4ADDD20377EBE045FC67DB638FC034EF8F9A1689AD6805E5.1605.3997361857.2558",
        "C_46782F06EC58C8C916C062A5E79D6F4E68F6E57049485ED56043B6013534D92E",
        "CD_A97591AB6200CED26E3FB14B24594C24502E3ED2ECD1D03B90CDA66E21B32DA6.1632.1.14401",
        "A persistent binding set request included a local SCSI ID that was already bound",
        "I_406A72FE793A4805DC903FB7024A8085AC2DC3BB8C9083497905DF519E60AED6.2692.2615689736.263",
        "__thisNAMESPACE",
        "C_AE52A362AB5B79D830C3D5CD0FC2F47EC119DEA073DF82CDDFBD53D1F7495A1A",
        "R_3ECB043C95F0C9AAB7C16383D55D2891C8AE6907321F09C2CBFD38E505562934.2460.2926819268.558",
        "I_E78023862D0C9AFEE5C7F1734B04FE646B55364A8E140EC762B374A970539BDA.2697.3390752642.270",
        "CD_4C651BEF9F64ADBC535D5D50D8B78E30EE7720ACDE0BCE9B84F7D66AF315E962.2612.3371270760.370",
        "CD_0A4592DF371B0F1C9E35DCF899DDC0B30F2B23CFF106F5805254E0E64E1E04F4.265.4178884127.816",
        "CD_6C789C13A4D61164E88FEB10C276C4AFC909A00FF2D9876B44EE4E6CCB8A9546.2587.1696179741.619",
        "CD_B8B1FAB8A4F90C512F053D1AD5C7061AC5CC502A1FC989312218B5B68AB25BBF.0.1980148045.98",
        "CD_85779E8BAFE3789E38C6257CF29ACDF9D244A27016D22CDF8620CFDEE1A226EE.2376.2002998648.3807",
        "I_B43F47F27EEE9892C6AC065955336277983793E895D5252CDDBE64FE57879FB6.2719.4261657656.272",
        "C_6733173DBDD8F69CA9013116A1C86DBB32D2314712D9192FE9CAEE8C9CAD7094",
        "C_FA5F0CACE5010B22488E1F75B605E9518F7EAD5CC9CA9A11556B5DD22F5A4687",
        "C_4BE589ACCA6072A68F165F37DA3FAF78551449C5735F577FB914BFF88C4DFF8B",
        "CD_ACE6286BD25F0AA2207D2355DA74065D91E7CE838C5E66A6FF0F8AF0C177656D.1154.747436739.336",
        "CD_07158AC46AB23011D10296EB63960CC939E2922A1ADF31B09CD4B8579AFB85A4.2655.1694872352.496",
        "C_C4EC6F9C19CC609C72168963F8BBE9E684E852B0E979641A1AE73D82D9DEE88F",
        "C_D5EBE9D0498F05512866B18A51DBC2343148EF5BF90E72089975D137A1E79133",
        "CD_B993D3DEB5E46C275A88F026AF84776EAF4571D8631295ABECA2B76A62F379E8.1806.1232242906.374",
        "IR_C05A3FC584E4C7E77B91779FD601E18B96ADE577875DEFB7E16A4A239857CD17",
        "C_BB619AE3C8D0F42D2AF727F154ED7AA95E3218758A94B90834E9DD4C130B6BE8",
        "CD_4F0D52044CEE6BA44A797C21E074FB5F72A44E740DF64604538AC24885525391.251.1.9663",
        "CD_4C5AFD1736EE75F7E2D418D0A789735634156C5EFC9350C3086D52271573E8C4.1922.3339182801.284",
        "CD_C84DD871FB7E9CB6D29DCC02EA27D46F8AC10106A4A5F7B1A7A789F07E15462D.270.2882040911.630",
        "I_C211191EA2F7D3DA2417EAFFB824676B8FE72933E0CC7156D270377961B3F138.2694.3795932327.279",
        "CD_B61336F486B4EBD99224D810D7A531385DFBF6EBF9CCD5ED509E655926A6E528.2553.1240106757.658",
        "Cannot connect to the storage provider.",
        "CD_8F55F9DEF3426989FE817E17CEEF2E31FFED7183978F9BC99857EF3CAE702C82.138.3805690457.861",
        "CR_8BC061EB0082E96D5DC5828FD96C3FC2A01095E7E42C720BCD36F363CA556A85",
        "I_1C1B5A356F32BD080D767C3C00A1042C206EC1F272A9AE7761156E4E227A2754.2703.2277945833.280",
        "I_B1408702D2B30EC167AA87A1FAADDFA618008A2B6D0F24737CFCEDEBC77D3EF7.2718.1065147274.276",
        "InstanceNameList",
        "IL_220C48173AEFCF83CE8603A9A9BFCE7A8CDC4D50C0929429223D9E2CF6DCDD96.1015.3271743896.303",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1607.1989036250.180",
        "CD_A188848719F320C94F375EEE54D40059ABF083373A9064154047735B8379D3A2.2540.1031484943.522",
        "C_DA73568A33421108A6DACFCC11E7E041F3E9C8CE8D59EB3EF5250A5065604FCD",
        "EAA5A57D8CBDF073A7F4BA777C46D367E",
        "IL_20BDAD65B621F6FB6C1FBD3F357690D0D5284B906329AD158F99F94168FEFF9A.2694.3076597239.269",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.15.3694202428.180",
        "CD_965094A9801CDE7688007D8DC8207F7F647D8A711F384671B42F954898C8A20A.2640.138948319.868",
        "CD_4890EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4.292.2766552311.172",
        "C_DD1327FC08EE6F810BD5622CD5EFD1804CFB8E69E3B82381F2E13055AC3B4DBB",
        "CD_234C00C48C3A9C34F82AAA3B652AA3E2A181F3A939430AAEB85DD9A80A3A5915.2556.507841381.541",
        "CD_C867B637B25E413A5893A8DF403F24B113B36FB9DA058811D901C232D15C4E60.34.107941735.730",
        "C_EA6FA9B6E7FE95E0A564580CFC4C3385DFDC08BB1FEF82112672242536B4FE3A",
        "CD_3593792BE66B364C91CB864BB99BBAAA7F25D2BB3385AF25FEAE463E3985026A.75.4172547056.443",
        "CD_244B2D44BCFE4686A8EB1967E3535273855A686C9B62600F3309068E24B5ABB8.158.959154529.1018",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.2189.1.14291",
        "C_942CF06D69278E969506DEFD551223FD0C23BC45394E9D8ADDB78467847321D7",
        "CD_EE95DA75DAF58996DD64AF173044F543D1582822947D33302AD4D1498AE0C965.1627.1.25082",
        "CD_5CB6A0A003499DF6531A245112372798390EB984E42ACEC32EC128E82F56ADB5.1078.3633031504.722",
        "CD_F9D6E5641FF66EA233E60BBAC7C675015AAFDD5EA5CE8B2ACA26EEB642AA98C0.1203.771278975.1523",
        "R_923F1B58596F021FF934B29DA1A6C96516794CD28704EAEC3F058F888A1C6702.1523.3939382467.536",
        "IL_5619F5F895C3D573343163A85231441998067CF9B7F0925D97380D29EEA3F575.423.1.33645",
        "CD_52FA3652DE48FD253CE895AA1E0F7F7869B94D77DBBF33883D1DBCF38C65343A.2757.392550512.998",
        "CR_5DEB181FA3808D9D7D9C352C844B65D0C9A0221A91C57777C58BAB412DD30F67",
        "C_F12BB6A8762B92EA13BD3144715EC52F49D837CF063468EE94A48A0A79B412B0",
        "CD_3DF6C8A32B6DFD5082D03F7D9A331784CABA023B138F82AD0F1AF437E7F59DF0.2616.2417397011.671",
        "CD_5AF713ADDAAF9A8D160542D04F058A0B9E06750B837D696EC62B4348799A72F1.61.928923395.2827",
        "OpenVMS",
        "C_D93383F051CF2C999A0FC0254121E096274608DFBA24CD421A9ABB46E7A53319",
        "C_040BB4AE5C8C1563BE4142EBDDB8539C7E5CCE64A27291E9F997DFF018BE9069",
        "C_EE95DA75DAF58996DD64AF173044F543D1582822947D33302AD4D1498AE0C965",
        "CD_3DBA7E264DDA7F8A7A309588967A7B5C3508359FF35613C96FF730C82E46EDC2.2143.1.14635",
        "I_36225EFA14E145C3219DDFACA9268CF7EA21D2A45E69B26776839674D64261E7.2726.1300248525.275",
        "CD_AF3DAFA72013C3690171F734765DB1412DBEFDA2A461CB66FFED0CC4B21B88F0.143.4251493503.450",
        "CD_A17354395E79A088E63A18457CAA51A441A886387058324A6BE95873BE2C4E38.2008.3941172298.649",
        "I_13770FB29B535A976ABDF141714ADA919FC9C51EFC37EDB5C1E955ACE56BE9DB.1940.2396701346.301",
        "R_C83C97F95AE18CCCD713B8B6E1B28BD164B92A6652EBBDC1459159BAE92CF8FA.1782.3618261567.536",
        "CR_3FDA482EEA11D105F777BB4C0E86194FDFA63901845D94A245BC2172A88E5638",
        "CD_0887FC386FA8BA2C2DB0458AF0A1764BEC13D490407167F361F1F0B4090E71B4.1070.2057150230.364",
        "C3 latency",
        "ScanOnlyIfIdleEnabled",
        "C_F4AD89F24C5E59F704DEBE5DF4920F1D71930B871988589A8D9D698640C4E7BA",
        "C_DD0471D542F51C9EA0B9D431D1C99AEBFD6E3F5C7A54107E961A136C056FBC71",
        "I_EA4ACC1C83A3FACD216DD4D4AE09BD81AEC8CE31C188BC51B0CBE5ACC0B6F6A4.1778.208163282.311",
        "I_BAC3F6A6A35DD56CC51CAD0BAF325F0D287989C281F534A9DBB76FD59710B3DE.294.843210489.294",
        "ErrorCleared",
        "C_7EB464F197DCBE575080B9282C967BE21B4306F539F2D486C42140F55C5D0FC8",
        "IL_3A7C55E6777C3BCB7E0B6B05BB1865AC10BA79BED9BB8C73A5D401038F51D834.2729.1199845375.275",
        "CD_04C7F4A052153A1B48405988115DDE17865E47F99CF145973E41882C1B4DF5ED.2626.592078095.111",
        "I_E66BB9E894A4ED0016C47ADEA36918C495E7C0B6F2CB1E5BBE051145718DDF9C.2720.3881536490.281",
        "Is Not AC Setting",
        "X25 Pad Type",
        ".2708.4260800985.280",
        "CD_4E41A9ACBA3A28CC69C6A183B9DAA78E0DE0FEC5659A25BFBD89FF102BC593B2.1303.2791291506.423",
        "IL_2448AF929C8B54CCA310FC04802D9C54B721C1204C40A0254AC25202A4CB4113.2692.448524938.277",
        "IL_A75BBF5103BA486B77C069B8CA6AC2EFE4159D8262D36992FB48A683A6E970AA.2694.2138979512.274",
        "IL_F65757B9154C5EBDDAE70D4285BD74985CCB42751F841E9E56AE020776DD15BB.579.1.61471",
        "Dt08P4",
        "C_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D",
        "CD_8026A46DAE8D15BDF9E8EF11F43EE077A14B188A857E40F1C5117BE33A9138C3.2586.510679556.380",
        "C_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "KI_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396",
        "CD_4C26D2BE83497715CCF0A765E00CDE590BAFFBAC1830AA3DBCBEFFDF01BCDBCF.1474.3192837920.2264",
        "IL_0C8BA59DF2AB6BF64C722A393783EB9B6DF2F020FB0201D440A75D90A01938B2.1049.1225812266.186",
        "CD_B2CD8F05013FBEF276E8256873F843ECE3B819C86E4A1470B3F32BF921471F60.2399.1.11046",
        "CD_AC11DDCF9F71868BCCF23A662420DD51F76B4387A8230D6D41F7DBED8D2981ED.1821.1.17744",
        "CD_161D7B1F7DD552C780B6CD4154D40388F29AC0271BBCB7991C59595342903A38.149.3378089023.258",
        "CR_71EAB4D274B62BE0548BF7FDDBAA028C0F0BB11297C86BCB4512412235E01F04",
        "CD_A1DF2352D44EE2A7A518D708DCD1479E935C9B8906C0915308DC02E74A1C6BEE.2610.3275161281.426",
        "CD_4B9A5F4131B4DCD11042ADFA6FED4351D5C27774CF36F6AEB30CB03131693AB9.2667.834068038.784",
        "HighestState",
        "IL_7EE99333FBD94B5D83ABC3479B07F4FF06B39DC76C5C6C8157BE0AB1185F4296.2721.2082884549.276",
        "CD_021AFE414882C03F97BF442E09455A26212B908FBBC7D7673C42DD465658CAAB.276.2720137495.206",
        "CD_C811BCFC8FA021E0ED24EAF2AB4D586D8740EFE02D81CF2A5551BE06CCCF53EA.2409.3957048985.667",
        "C_ABD6FA3701B1B50A73FFE787EE0E777A085EA8F6AD6E40F7F06931702C098EF2",
        "C_5C1EBB1EFDECB60A5B91BA9F722DAB3A0E05202BA30E0AD646FC630B197BF855",
        "CD_1463900C5E85009C74D970DC08429284D480248969B543718E853FA68E152A48.26.1918717068.429",
        "CD_9A36BB4E390B7DD04D76CD832679A7EB96B353EDC2C276A7C316493A7FCF4652.1649.1620314628.2164",
        "CD_B18A79A265A485271ADF7583A11B74126B27D0421B9B453C88A99D39E80DF5B2.215.2664669812.604",
        "C_C20D4B021E0AFFB61E5D90A8AD1A949CBA948B6ED6C506FD3F623477DE2DDF5D",
        "IKEEXT Trace Provider",
        "IL_77E74ED5440E51C61208706C04055712F91B723AA0D26A67B06D8D9D686A208D.2762.4048948087.283",
        "Owner",
        "C_4C941C9DE20A2632BB21CA3987571DC02CB561982F3A7D0379036161DF189433",
        "I_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6.1489.2077961189.321",
        "CD_DFC25D46E8711DD4634FF6390AFD6E0F348F88B4F5FAE966D405DF4EAE83DD54.2002.2433868766.354",
        "I_B8EE61BA0014D46C757C730412BF9CECF1DB43E7B29AB92088ABA2A97A58F27B.2701.547806292.278",
        "C_B6FE190DA3DA92C5835085980A5F0844A541BB53B1038C06EB63E0231624C2B9",
        "IL_0EFC8EAE4856D0D22317B6B52E4D7E08F0AE9225C6A090F83945AA47F9AECD26.2568.3597818075.278",
        "CD_841F1DC98C3FA6D8D114A873F8BBB48736A8E2FDF60D6C1F08DF493438718909.61.185623737.863",
        "CD_298A82190EB25998365528AB4442CD971C3CCE3115D859EA184ABC77CF5A033E.2583.811680625.264",
        "This device is not present, is not working properly, or does not have all its drivers installed.",
        "I_474E613746AE2D2AD109651C07E7C49F4D69DCE82C4FD9E0A81215457FF1DCAE.2726.3771037851.275",
        "NS_8AB6DA69CB6627FB081BC37E8D617B6783D655C47A60290F754524183A5A27DA",
        "CD_BFCEF2D66584BF747A114A08DAF60453831A724BA6BD651F14D05255B74D1E37.1189.2915589755.584",
        "CD_8A3B6432A229F674039F0136B188BB0F847AE08B53B1611977C2FC30461CBDDC.2334.2131734200.357",
        "CD_A9B783D001816C120A5D7EBC7A87AECF9E0EE52068A0CADAE17A8EA3AF1000D9.1340.716279356.3677",
        "IR_092A55272DD5776D1F8B56BC2DC2767240A3BAAE69BF8801B96D23CE4A45B158",
        "C_E6695722F42AFD2A38B87A3A03743A182D780F4AE622B7E7DF87DC65E7D101EB",
        "`\\XTP",
        "CD_878D5D30666EBFE440F941E45E7884E8AFCA7A1478E4D09AB57DC26571C8B7A6.1176.400227334.362",
        "I_0AE842411B3B68BDB60FB4610360E1ECD2D583F7968316F79131DB25BF102F63.10.912849262.189",
        "CD_33E9F891CC90BF32E6669A30E5EBE2196EAD69F35378260B9252DB174DDF3026.1763.1.104865",
        "CD_D266306FE2E96A3EE8770CE67DBE546B0BF71F7E68572A79B961704C44143357.284.2724182035.1376",
        "I_D00FFED55F65DE783594EAD7DBC0B2AFA1FD10D2673E2E04CD821800708CDE15.1210.3370094205.364",
        "C_AF4BE4279039B330700F9676DFB82FB8AA7B80608BAF978E72E54EFC9915FE11",
        "Lost Comm",
        "CD_0ED8829CD55CB10045BE12FF28DC63BFD30CC65BF9376DAA6A5D15ADE3CAC700.42.762842289.213",
        "I_FF125414713AEFB3BE9B36BF5067B839DE545A44FB053F1F2696CC7ADC1B48DA.2458.1833003234.336",
        "CD_1A9E3B957294E1E2A3BD1A3F9CA79E41F6CD3130E2786884F3F69878725410E6.147.1299896922.694",
        "CD_D3C4DFA37F26EE4C7CA31BA9B8E724B042DE4802517C8F5FAFF10A17FF77557F.41.4249168827.1092",
        "CD_07EB437F0AE27464845667363470C3C266A764B68056A1F9C1D3B1EEB778B9BF.311.3111767972.135",
        "CD_2E4619832D87866ADCA097DAEB4AD1F340C2EEE23DC720838DA96CCF55B2CA54.65.1113003628.868",
        "IL_3985A64DD548C159337A855FB2D96B222C50720949C8FDEAE049F7ADFD2826A5.1784.1476947504.329",
        "I_0EFC8EAE4856D0D22317B6B52E4D7E08F0AE9225C6A090F83945AA47F9AECD26.2568.3597818075.278",
        "IL_A1B94F29555478DF2A151FC10F5194363770C853F4EC8F7C43DAD378AEC8FE7A.2700.1339617719.273",
        "CD_A299EE85058E283CBAFC4B7374A0444D373E45244817F91F31D618B68CB69E72.208.328333249.2432",
        "CD_BA3D37D044C0551633D73D3A898C87E3F05ED306B67D594AC8B13EE30AE518F4.2037.3023407612.3722",
        "CR_A9AE64C03C11270991C8BCE26EBE3DD0FF3F841C3C80D3A28DC949EF9B62D60B",
        "C_8ED07F8AE1220DCA0AA67C713F95FF5F2613D1EF04C9C11037C57B91CCCB3B53",
        "IR_C0DCD2330B402CCB79ADC9A534E5029F8DDEDEFB826D41905F5E8463B821C3EF",
        "I_B93E6686A3652ED68A2C315C7A4538886FE8CF7FE0CACBC7828D45201F16DD39.1976.1820495434.185",
        "I_BAD408305F753688BFA8B66E22F6182EF70E94516291BE0D848E863D5C6B2DAB.2710.1387692298.286",
        "Msft_CliAlias.FriendlyName=\"VolumeUserQuota\"",
        "VirtualDiskOffset",
        "w!z$'",
        "IL_4FCEEE0FC91DDAA3FFCBF86FCC6A36BE25C6B2A714B925F63A0F691C86AC0C6B.2676.3733151675.286",
        " DX$Lt",
        "C_23DDB252CC4D2FD4A1F4DD3D5C1D39DC829D566848D6F27132AE759E1E502D48",
        "I_4EC3C8945D6E1741F6797BF1361EFB60D235E79FC77C7CE48A373BFCE972AA49.2683.456667102.279",
        "FC0DE40BEA66707D69F4D09E38B49B8EFD3AC625219B7FD45",
        "CD_0750888F7DA336796CAD46D09BBCA6EE8FE708CB3E6A5972E9507072892D3743.2556.1203256604.408",
        "IL_2C2EB703985F00180EFBF0C98AE7F454B6DD892D95C4064D8B340B3889135685.2720.1883434224.286",
        "CD_C3231029EA3655A198378DBAD554A36F17B1E70A6D27BA95F2106CFE9A117AF6.2731.553324253.1283",
        "I_906FA8E82C03F1556A8EE9CB8FA33DD2AAAA84C37B806DF136A6D1DA4FAEC26C.2727.574477994.280",
        "C_161C469CDEBA430DDED22BFEB8E493F5D9ACA6AE468ED0C2839064885A1BFF7B",
        "IR_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251",
        "SystemManifestVersion",
        "February",
        "CD_272E5753DC3EECDD6057038DB6F26170E7D1CD565B954C6C4A406CB1BC2D023E.1084.1397741632.323",
        "IL_FF125414713AEFB3BE9B36BF5067B839DE545A44FB053F1F2696CC7ADC1B48DA.2458.1833003234.336",
        "IL_302159DD437DF31C3447740E0D66617756BB40FBE840878868510D22B9CA0618.1195.1737952742.287",
        "I_3BB2F25840E05D325FAFACABBB276A102D49D79CD3C3CCD8CF11A4F77E826041.2505.2359748797.326",
        "9<?BEH",
        "C_C793B9525D878D9706E959E8F468E81449F6D48F127A802D380F8F7D8B8795DB",
        "CD_DFBBAF5D5F94B4BF228BF95FD0B1E0E77E3B25A375A328BE897C2C1DA70CDBD4.2398.1453178994.3148",
        "IL_2EF70A7A8FC35B2317CB4F2E5BE4FD3B09C488A93C0FF76285A63C3566BC3E29.2723.1065399887.279",
        "NS_2EEEF6086B5AA3148DE8DC3E7A7263A417EE849A276BDB357874FDEB8ADED318",
        "CD_B4204F4CD845FAF261673483B3D9C407E18AF7773A24D7B43C66C3052F5D6AAB.2756.2240683367.382",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1330.2476940105.211",
        "C_9C6234A862ECB7785AEE1C8C46C69B53F75E4A1B191D9AE24604A07719AA0D8E",
        "Result",
        "CR_F779B42B004DF7F026E14BA644CC70AD37E9B5D9AC8A5876BD443235D2F16694",
        "CD_849BB872FA48C9D9F0979EF051B133EED262AD47FF263C164F3A538EED0B65F3.1.1304466958.230",
        "I_4541EF6DA75086109217AB42690AE9604EFAE942DA3C6C14A41ACDA0B39E4BC2.2696.3214635058.269",
        "IL_0255C72DE857C2548B152EEC30DB6E16802B631CB06DED8AAADBC49C9509FDEB.616.1.272838",
        "SEL_TIME_STAMP",
        "C_55301A82B2B0B70CEFF12C2EDFE569786052F57B0A795053DBC7F37A225FA709",
        "I_109BD1A95093AEF0A632244BD18A876529B9EE47C13A28C3FB4CAC19C751D964.2697.41031290.273",
        "CD_17983AF29A2B91B8A9FC70E3C2059D5E3BF314C75E38F4F96A785985A070684A.2561.2154457669.626",
        "ScanScheduleQuickScanTime",
        "IL_320EA2B9CFAC2AC8DA8920958C45DD96FC615BD6279A0DDB2CEE450982A4E8ED.2722.294487866.282",
        "CD_BE8F1260CC7D3D8D65E679E452849F43342AC07EE5E67F79C0602AEF0D925B48.2747.2415504891.867",
        "I_B9E7F5EAD53159E6185ADF58A8D8B61C5EDF296789DC3A067A12BE700E01BFC0.2684.4187390490.283",
        "SystemConfig_V2_Platform",
        "IL_9409424F123243DFEE034A650B5F1B88CC5A0A68CEA71FA74FE30ED6706A7CE3.2717.3347280366.286",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805",
        "C_EACE35DFEFA903EFFF474056F16C7A19A63413AC446BAA0A098904894E200955",
        "IL_FD94C9E615EF769B20309C92B0C66BB91C4FD32496ED9205E31EF72709ED573F.2708.627267147.293",
        "CD_943386A936885D346F0D61FA24D7BB2533B7B797B4E446178A40D4E6F2C1683A.2273.1038514550.2041",
        "C_D2A9871B8DC5FB594486947C60152A87A3C7A83CB555AD2675BAA5E80330CBB8",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1480.2002022883.180",
        "C_9E927C42162CFFA3624D55690B21114853C375D15511354B30627B7E45D7DB02",
        "CD_916EF6B6122453D1C58D648E96BD869758A18BA38D348DDAE67570192E8AB140.2216.3632298505.6819",
        "IL_9F80F910AC148AB66C6A0BF6827B05CD5CB15FE857614CAE5256A3E2FB1A94E5.2692.241722655.276",
        "C_965230E4BEA87F5FD29FAB71D815A8C331F1FE2001B3E492EFEDFCE72E70034B",
        "CD_73A800D7866C4390667315AF06F93202489C8838112B8D051CF005E872136F01.1734.560543502.2776",
        "CD_70B5C3F445D36D84AF1F9F0E062B6A21EF707E1616BEC072F41A3F1113BAD785.2427.1496682488.524",
        "Win32_OfflineFilesDirtyInfo",
        "ACPI _PTC",
        "R_4BE1C75712DE0122ACD81B4DFC016FD19AF0464BF14E558301569B3CCF875054.297.4258757522.548",
        "IL_BCF5D4FFA95493F49502260F4C40EA5B4501BF1BA80B2E34F667F39D273CBA23.2692.1219757758.269",
        "C_28B64F0A4A4B406BEF1C2ABA6655968C837E1E9DA0BC417F80E2473D3793AF08",
        "IL_65817EB2862C41EC490943B09C6AFD2B5DD8D011A8B044E96ABCDB4223361118.2721.1933200316.283",
        "R_28D3480019EDB8568B100B133C2E45279CD6E1AD49C4AEEDB510EEF8207E9610",
        "IL_E773858FDB61E761D295C92B1686D0E53D4F8C85E9AC1E67DF1F6ABF0192BFA6.2687.3334751371.274",
        "CR_7A72389BB1759518065C4AF4001515EC91E03811075FE8C84FE22087E293F0F4",
        "CD_8DE46DD6446B26621A23E11758AE5CBC62C9F72998CAFB08B9CD58DF66902A20.26.114877883.439",
        "'*-03",
        "I_AAB85F9CFFD1983C63E400300F9D65CC1BFD5574765DD183AD7564152A7C81B2.2723.2441498537.276",
        "CD_E28AA1D8B52A95E7D7669D7E7E560FC2B4623233BBA77035C999EFF1330E4AEA.2537.2284506638.486",
        "C_224B5CC2DC8F3AC1441E2D19046B5D0473DC87327FB7FEADFB35C0CF4DD98702",
        "R_B5FEE8AB03DB704090FD143B404DCEA213E85B74D1A528C27658382D03C1148F.1195.2825387271.524",
        "C_C77839C5FFDC5036AEAE664C904195DFC3B53888BFB351AAEF0E033BF5CF3DA8",
        "description",
        "CR_4127FA39B422F35902681B4234322A2B744157E2EB563F7D2450799A62E71C22",
        "IL_59BC0068B038A4089ED5626B5D1D159529697F84C38788359E6DFBE8EF8E26DC.2706.1103561493.286",
        "I_4B7D752CB83417BCE5B98B98FA3963CE38E7BC33B4EC847B3276FEE9ECB7A8DC.1104.4206601426.194",
        "MediaSenseEventLog",
        "I_20A2FCD02AFF243CF774088A45E089FBE5A849A9F82F70950D8BFE6D4323904A.1020.1571433115.326",
        "CD_532671ED26AC2835681FE0B122A526862616ED33CAB2C220F171DB7BD5AD8B02.1135.880766653.173",
        "I_D4BED9B6DD6FC82BA566BF8C092FFED4F8C7024BA1CFE6E985D9D0D485FBFD9D.2688.1560624429.282",
        "IL_5361F0B5BCF344E5F8BAFF7D3C773CFDA995B3843B674DB9DB34AC35EA55A657.748.1.63404",
        "CD_6848AE51A98A2B17FB898D6D0191CAAF3F4DD71444D2EA05FC34F19E3A2898C8.2582.3770020996.222",
        "R_65DDAC6706A72751C31AAB0BB7F91380298C39BCFDED1B7FFA9B96AF2A3115FD",
        "CD_9E80816304B77C3F7FB69E6FA27E369EEAF4355C2560E5D96A7A1A687778DD04.2273.1237571637.315",
        "C_C72F36D31EC66AE00A609EFA447A347F9B21FABEE95556729E0D5E50FFFD7A13",
        "CD_DCE585FC8090201AD2A481DCDA9678ADBEED6FFAAA2CD50925EF913678001533.1501.4286346385.682",
        "I_CDE94F817957CEAB99ACBB6A96875812D668C8A1F0207ED777E976D3E4A54281.2720.783066222.287",
        "IR_FE19C9DDAC04ED4249E80EBD5050641EA1081DDF5329EB1A51379B4777705FDD",
        "R_15AE024858DC5A5F23D53D8A359A112CB2590B6A0D5290B6D8FEA07A99FCD6FF.2484.182480328.524",
        "C_1F1219F96576A4588331D02100737379E76B59AFFFE01B2EACFBBB0DBCD4C75C",
        "LoadAadCredKeyFromProfile",
        "CD_BAD9CF65ACAAD76843902B63F6C257FE0199AAA33356AFF3195E24965DA21069.2401.3711263706.951",
        "IL_0818CC83DEB978B7B8752F2310EEAABC322DC2BDA1B9720BFC816D57CF461D84.2706.812545990.285",
        "IL_6ECAE7FD338DDFA47A9F6250AD53107E4876130C4CA23D90DCE96E053D46E318.2721.2070514180.267",
        "IL_00AC489F58BEB2FAE012EB9EADB94D27B8C0EF1A86F7EF90CCC478E4E29CD982.2703.4084513306.288",
        "IL_7FF87840EC71051C0B44624DD4387D011C70E334C57569D0DB2110560F18F3BF.2684.2970974831.275",
        "2531694CC32AEF12EEFA0D2DDA8BF782C32F932BED169759F268D0FEAF39B8",
        "daddr",
        "C_B5E99B5A644B99616378C5DB13332DF2455BB938020100A5A138AB87040C693B",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.4071434985.226",
        "0|4Tx",
        "CD_9B3B36A993A462F50891454718B9E94854BEF6CDA6B45E39722B69B985CF4900.184.1147489105.5035",
        "I_915E73DF0A80232C73E3857239829936A2600A117DE2E6656BD93A27B02F5FFE.2703.4237052265.303",
        "465F4",
        "C_2648AFE05B7E0F21678E759462EA0EABBE7924AFC35D246F32D9D0F1F494FCA9",
        "IL_D58E32C3D220BE041A516D1C8C5394D760C39CE1122D84E0A71CB104954E163D.2717.1184386440.286",
        "C_65C33823125A389998EE918715634996D26443DD7799EEDA88DD0650D03B9936",
        "CR_AC63429FE4716555DE1C78C4ABC52C6F5128C0FC3C7A7BBC67A237A382D5F3E5",
        "C_090E16074BB67F3962D2476389965FF428C90DFE4808D1C0AFCA9634C068662A",
        "CD_69A1F2516C00D1C2619B3BF158EB32BB01A9128EAFB2BC6528F8EF8668287B67.2658.2979074857.1106",
        "CD_B7DE90614B809707C62F39E568E71EA3DEDE3DFB6D354F3F89A2373F1EC83BE6.1550.1038672344.821",
        "CIM_IKEProposal",
        "R_E78B24A63ACB40A253226DA76298C783683B9FFCFE28CF1078C510D46CEF2248",
        "Text of the script, expressed in a language known to the scripting engine.",
        "C_F31EBD8BA35B453CF95737829E224A0B8C314F43C824C500D5EB4164B9823141",
        "IL_0FE84CB7228184819434E73184A33B5694CEFAED93B282C50B930127F187504C.2437.1645229334.340",
        "I_13E25AE2C96A9177E22357CE69C87FE08E744F1C7AB74BF7C1052D390BC421D9.2727.4151845273.280",
        "I_D670180134B668ECED001E62B5F3E212E151B0184A9F505F17AA406E7A59EF13.186.2262705224.316",
        "C_3A7BE4B3F6EFC36E6A675BAC27AF47DFE5A6066A6F0570FCEAED80BDAC023D04",
        "CD_FBB8D0961BEF2086CA175772D30289C94E1C669B3417C75F77ECA2958634DDB1.2545.3411875329.693",
        "C_3934CBC8B9BF633BD2177FD587E49EB900491D088D14CD34FD22E79571DFC824",
        "I_07E80007465B0B13E7DB9681B8444A9A1BA14B4F1EDCA79293ABE759C7E9A390.2684.1701017078.293",
        "EESCSecurityZoneSettings",
        "IL_BC924067C3E1B3909A3F48E989D12366F2431FCABD30DE7CB3142DFAFC8754F8.2717.807539801.287",
        "invalid handle ",
        "IL_CE1AB475306539B9E244C98908B04E7D335C952B0802573B7D36EFEB15743AA7.695.1.29172",
        "CD_AEA9B4362FEF814E5A639416B40C271356C8C37CBFBAA86E579964C85F8B871C.1759.1.28390",
        "C_B8C2F11B417C37C006D14F9AC34AEFC3BE86E0177BCF16E95BE5FE5EA4807416",
        "CD_9212E0D756DE59946D687462B752A6AF5A16EC3A329D47D13E039D19732A1344.1820.4009808438.411",
        "RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles",
        "CD_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2.295.4087736782.1172",
        "IL_A111E7F89C1C848588C2514B9F7117AA41CDA991BF49D22CA3C7528AAAD3EBCB.1184.2693893620.249",
        "CD_0B91D9FD5945CFB775F0EBD6F596CF88166602A6156A99CD2B11EC548E5ED28D.1093.420525828.631",
        "C_9E9C09D30F7B6C1C4DDFBE795ADB6A836F2310F7AF7CD6B6BA1E05BFB3CEFE19",
        "{313e88df-a4fd-11d8-b301-505054503030}",
        "C_49FB736F05F6E9A78F87E84FC5279EF60B08777EF5A714391B9E97553F332914",
        "C_5A900E37ECD3AD176DF3B2408CEE2A05339FDF5781218575370BC8E3B869737D",
        "CD_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396.1178.1.22161",
        "C_81D663AC928C0B0697AB8BF22CA2F6F616E0E395D0307C3DE82D3308015385B2",
        "!$'*-0369<?BEHKNQTWZ]`cfilox",
        "C_13A0E5F9AA254675F3D05231BD456443292E04A663554FB864E708C72EAB70D4",
        "NS_88591E56F7DF51C96BBDD94E4112A5C7AADAE3154C1ACB64E20A2CB89B0D6F02",
        "I_6E529D6E9C957D5056C4DD361BD9E3844400F4D1790EF2ADE20A3072754E1CA7.2711.3509616361.290",
        "RegisteredName",
        "IL_30485B836AA5A6FD10A8644930D90B38AA35B211E21BF4839647DE43EFA8F751.1355.773241841.275",
        "CD_0FD0888899B6AE2520B6E2DBF0621375C2A450EF8AEE903A752140EFA51EAA5D.1783.711591315.1773",
        "I_D099474E77F3772C193355FE7953C462D92336F4B1BC91BA279D0AE067B86FB9.2704.1768010563.290",
        "CD_1B565D8B02DDE679557F2CBAB41916CA553B573D803E48E8137768E2235FAAF0.1746.2534157638.299",
        "IL_B229F3756293E7BE4FCCE0D5C09774AA63F22421B02BCEF0E5C0437AA673141D.2708.963332799.292",
        "CR_2A5B35A7EDFDEFF055BB37FDA6DE592042B6B41AB95D0C58AFFCA90EFB735B71",
        "IL_2DA6E702D31AB61AC8052BB8775016BA05438F231B3A914B8AE562AF8EB082CC.1016.2013314775.308",
        "ROOT\\CIMV2\\Security\\MicrosoftVolumeEncryption",
        "C_BC381B81B90336F98B1808B59D5F1A4026258C030F7F90F1CC12FB4A44D72477",
        "CR_0CD3432EB17462BFB5BD92FE309EBEDE9286A9F3ADCBFE4044D787F3CCDADE24",
        "R_CF7E5037F6563CE949872FEF4BA72C8CE3F9C68DD9A3E9BD325E8B9ECC946118",
        "CD_EA6FA9B6E7FE95E0A564580CFC4C3385DFDC08BB1FEF82112672242536B4FE3A.2575.431281892.959",
        "I_B70EF18C029DBE7F47552E94A90289B0029992C705EF20E551316479A3C5FB03.2721.517069870.272",
        "R_7C4D4C779B8655DD6A7E86DC91922E10770F67B8451A5A7276C3310C51D0FD42",
        "CD_199F8BD2C63EA7935AD06C4A530278FE453B1FE80DEFF18B6BDA97081D8B8C0A.2423.1864311158.703",
        "CD_B6D5ABBE2F1027301C23A1CF884681090FD42092F2E95A0F33AA6207C9180DA3.1474.2338126691.606",
        "CD_2D6319F4E2ABC488E243ABEE465F201E726C9CD7B9C330B609A5B7513F1D6F64.2584.1140000138.220",
        "CD_5D9E67BE198A8E81AA13F027AA2366ADADB02EF88FD8930F2AA57C80C865222F.278.2973932649.486",
        "CD_CDE927435CAEB1D62EE8A15E5309F00C6263566F2B069604C803AE5D37D85A14.155.3836747368.1851",
        "NS_1A89B57DFA926FAB28EFD5C7FC82B078C2A123A46004BC299B214EFEC424D2B0",
        "IL_E94566BF504DD530A5B6CDD8332E0677930FBB4322E53A9C53D84633C933B6EF.2764.2387448604.288",
        "R_B6F5DFB5FF9D262A34F808F6064BE3724B862C376624E6B9C572552907B49F21",
        "I_6AA0C48B0CDF9C82612CFBBA27DEB8DABBFC99934CA4104DB63E6888ACF8E5FC.2686.1176486659.293",
        "I_82D62EACB411F46C88EF11FE5A18F1088AEDA0897AD63F2947178230B7AF5724.1780.3306664901.199",
        "C_6280E46A87C75596CAACC83CECF9B9CEB7D9AE5CA38D3447D92B685A2CE32926",
        "CD_60A55C37A891C02E43DCC85CF24FBB0AEC4CE837463192AE3DF9F07B12D58EBF.1470.1.8869",
        "CD_C446284C531AD33722FED92B5707E137291BA408988B095293D49122D6D19961.2005.135578718.1794",
        "January",
        "CD_D9C1A31E38D8ED408C173A996AAB7388592772DBA1A90C224E58684940B6635C.2730.3355678135.401",
        "IL_758767A138065C58C7C2FD020F199EF93645B9F6B698FF67697C3888260DED30.2687.1765201650.264",
        "CD_FD5A09758773146E01CAB43EAC38C6EEFB9A870C8F888B5F24F7E89AF0CC12B8.183.3045153901.803",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.287.3308430128.180",
        "C_4F5A769ED4733707603FC6A22AF6C35EEE4440568BF344DEBABF96DA0E5DDBCB",
        "I_E4A35312C830CE9926C27E04A2917C3A7B7DA9FF912B8915FD022768BFB91934.2718.1814732759.278",
        "CD_D2ACF3A15366C591C175442AA1C3A391925DA701286688C53A9845211C124C25.2512.1475696355.1206",
        "IL_C5A8223F6D36AA1368FAEBD76276346720D377BD884723F6A1347565DBCA9C35.2699.2043729628.276",
        "CD_ADE497F7ADB52466B3BE933E20B36A79941262ED3793380A63DDC578ACBA1413.103.851244781.6749",
        "R_467772CB18EAA3F13C51F04C786A2ABE2A466B136B1DC268697632464F9B0A31.1734.3898902057.590",
        "C_5C5600928D4B93C76DBBB24FC0A97811ACE9C8DF588CD0E628437C53F9478BA9",
        "C_23FA83E3222C7EFE1031ABE23D791DA7F1E9CA7E34FD0BC9CB4C05EDD16CEA7C",
        "ref:HNet_Connection",
        "I_03FC7356696B81A172A3FFFEF4518C34DB3C12FFC7871897C20171F501F26D8B.2711.4176058167.289",
        "C_B0D2109EB44421C900FA5B72C26E7A0C5F67A5578AD9D78EE2099AE90CC32E3A",
        "IL_F1AE9B23970D5C43D2977F5D1DCCE4BEF595D5D1E15445BF8E2522BA6CDBA4F6.2688.1050422235.269",
        "CD_FA518327502159AE84FD3F6F4EC621E64209CEF758E8DC599CB8C2ED467053EB.1070.2004360608.325",
        "C_F779B42B004DF7F026E14BA644CC70AD37E9B5D9AC8A5876BD443235D2F16694",
        "CD_DC8E72CA352CA269E6DDEE517B876BA7FAA771BCBCF1AFC1EF4BDE4F8BD8E504.1354.2878576068.2736",
        "IL_13E25AE2C96A9177E22357CE69C87FE08E744F1C7AB74BF7C1052D390BC421D9.2727.4151845273.280",
        "C_846AF3F141469D77A127A122DDB398C21332E67D66215C7CF3BE5449460CCA3C",
        "NS_05AF7137D710B4DD69629818893397542700695CD759396B44A708AE6493C356",
        "CR_4D4CE956D39D51456603D4ED1BF7ABAD64E72F02B0D569299B434D13F41AD4C4",
        "I_18ECD510993DF8BF1F6A34699939DEE7022919820F36821E1157C8304CD58135.2714.1828514654.274",
        "C_8950808B8A2EB8D5AE895F8D253EC27AA46290C0D9FCF34907198A4AB3C923D1",
        "CI_47C79E62C2227EDD0FF29BF44D87F2FAF9FEDF60A18D9F82597602BD95E20BD3",
        "C_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D",
        "CD_5D2C2C389F5259E45332A86ADEF5107186DA3990C071FED897FC6FAECC4A4DBE.1078.2385859930.938",
        "CD_C3B06A748C5CA18E21F932127722CCF781DEF129D3EAFCCF9594055AB3377559.2647.1796455453.1079",
        "KI_5DCEADFA575A67B8870603880BD491602DCD3BD7BDE6B9896E3244EBC7BD1866",
        "IL_76BBC96B178A1C054AB319522EC35C13427283C8227727BACFAF1E007CEB0AB9.1533.2682743591.332",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.286.1443573607.368",
        "IL_3BD30BBD5E5F0A0256E5304240954604220B8912EA00BA63FEA8E61AC5DAFDD4.2689.2449392308.269",
        "CD_5D2C2C389F5259E45332A86ADEF5107186DA3990C071FED897FC6FAECC4A4DBE.2760.3838692906.938",
        "IL_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.533201076.338",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.136.2525514145.180",
        "IL_AD8A41A11757A955B842BF5D3088E2B483ECD1357A92C5ED54EFCFC30D69D599.2735.3331639432.280",
        "CD_78648B4777563867EAC1D3203AA282334AD332B4AED362C60F895FFE37CD52AD.1199.3803356200.1927",
        "Time in minutes for a detection in the 'critically failed' state to move to either 'additional action' or 'cleared' state.",
        "[|pgs",
        "R_9A2FA4B503D51BA72E7F874AA07B2D2639867C129B89B4AF2230D146C0DBAD9A",
        "The file system format to use for the volume.",
        "Solaris",
        "CD_C5063773359C977AE8BCD38A9E0C82B16648D007322D0390A3BA0ED23E18A8CD.2573.3043067830.275",
        "C_2BC387469A73A6E2FEEBDCB57FA6912C972B25CBB9B9CF8437AE02367C44AD20",
        "IL_A41A2A506F07DE19FA26EBBA5A53B62D2C62BAF775EC8BEA2B152B5D21A711E3.1489.2658302389.339",
        "IL_7546229425D80B6C5F5E9411306AB27472AA8DECA01F7891A6CA483FF68A1955.2683.3263157587.278",
        "I_F4F9EA28A64973336AEAD4A8792C142319343CECF6795004E4B58475244E2DE1.2680.1043981989.288",
        "C_BBA26CEBD94E02C63A4812F98BAF8B828E20477373D54CAFB6CE9D30D952E46C",
        "CD_2B0CB21E4574B83D661A7C62AD7BF3133DF3FBA914EA55D3A45DC4A7214DD006.1596.3406673715.252",
        "IL_5F08666368CD5A38FA1690B9B7D8CD03F1DE7CEAA3CE254AEFD1FD576E8D3717.2725.668640269.271",
        "CD_56ACCF81C026D704BF64439555ED0FE36A1018BEC0E78E085DF8A96CFE6A37EE.2427.183473358.1250",
        "C_9257E4A3C9993B750EBCB6C34C9BA11105FABAD75B9C0DE005A64417B00B58B0",
        "C_240E55CEFBDA1AE8D766AC59B57A246BE8F95FE50F508D9C72C03BF7E80125B6",
        "IL_7314B37EE7A9CD5E94179CFEF93B73A543402E7B7C41960FE84DD1621D330BCB.2679.3147255445.283",
        "CD_58F7FDBEE520602801F9D69F9D9FF6E34217ECFA7A2D83A25ED10730D304E1A4.125.320385387.222",
        "C_3FF84C03B328C80EE72EA722B2C1AB0D0A4549FDEC5EB94A2670D175C0A3657F",
        "CD_D08FBE660E54A308159ADDC588C79311912D65E76D5871EF0ACC7C841B0E3373.158.3148737436.579",
        "C_04C7B00B843DD535EEFF8ADBC90D1E1778B3D8338A06E37E21692258CCC50FA9",
        "CD_3AA22630705AFF3975D1F6344798271087D2AF7B509FA6E34ED791616A9DF674.1749.3138720245.1668",
        "R_C3FB1F495FA0C200CBA2FCD826C44F1125283BC2ABA0A1C5D266AED649B4F4A5.294.1231043195.548",
        "CD_FB02245EE2505E5D90FC704D39CDAE9BCF7C7408D392BD5B8D624E7B60A6BBD8.1607.3812342587.2497",
        "C_D373AE5F38B7FBC99F3F2A938B5B2F41F6670B434E5300D35C9C175381801CD6",
        "I_0051C5DF1ECF71C50620AD90C854C2D1EFEE09CCFFEDDC4FD5FB6A7E4EA2A505.2764.4257718908.288",
        "IL_71149A9D96E4258EB27FA2CB879EFD22F7F2AB97FE4D855030B675DD7C07C99A.2688.1300148109.274",
        "IR_9731A66D417FDC024A9D93DAD0B38C4D96CBFD2BEC45E5FB4706D56140B553A0",
        "IL_173DA5A6BBA120BFA1F003499F1CA5518076940AFB7C35F9074818D37BC225BF.2764.88580085.274",
        "CD_7C256082C028FC113E44225862F56FE496A6FB4D4EE2AD50DD39EB6DF6A574DF.2155.1089045040.3476",
        "R_18488E32552B12B20AFF109B1C469144409190DFA262326863BED6DDC834F584",
        "C_3F6C612C44C211376C4481665EB6CC40A87E390D09ED14B4A180F9544E1D54B0",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.1050.250850705.188",
        "CD_93A56FD79060DE7C5C63B9201FEC3583B30A043D5DCAC083E3F4C84A7931B27C.2419.4290561422.357",
        "I_058A5B1FB7DC952F689B612BDA615642767025FE637F2552CD2356FE70E70C3F.1714.871754287.345",
        "C_6572B1CC4CD6AC35D80FB14E68E5854FA4FA40953667D1578E6FFD075F930AA0",
        "CD_9AAF3BC6AD36F8829CC6FBD50259D024EA00D998ADB66289BB6A5295426711D6.2747.2739354984.1809",
        "CD_676E663A52AA5A4BF1581676E7DAD4A65786BE12379551692652B9B04BB4F426.1969.1617874225.8055",
        "CD_E444CD7B23739F9E179DAD07B13CB31D8D111ED6AEEFD52B89FB204BF93A5A2C.40.925121659.580",
        "C_559C5EF519C1325645DA42E84C00BB0A8E3127E1C2CAD3C6D3C28A084C0B62C1",
        "Example: C:\\PAGEFILE.SYS  ",
        "CD_1AEFFB6222622A61AE00A6A8A6B976D42F502B57E04086F26915152E496EAF89.1292.3206024161.180",
        "I_FEF2D16C9D1A08F59AC4F1BC15FD57E47ACC59CFD01B94FAD32433FB5AF03B91.2699.442624348.281",
        "Mapping",
        "C_CD83DD1439D79635F8FA7EF37348ED23261AD574E88661F73F9EFA7A25F6F8F2",
        "C_ACF0B804376D585D7EDE7E3EA155CDE37431968EEF0F64B0DC56C5E9BC27FBC3",
        "C_3935D6345388A245E9FF50F1CD42F69CC8FD444FF90B93C789385D0BD31672F7",
        "I_09B333378C3BE140D20CD6DC42C1A3869F1B4D2B48CB060E0972243B2BCF6DA6.2675.65167912.274",
        "CD_B9D962D6F5E4151B919F374E6DA62601E38AAA45193D0F7E78EB4B2AAA85F011.1017.3754278027.308",
        "C_66A7D145690935995138FF204A5FABB1D06987DACAF9285631224F38F72D3572",
        "CD_A889E6B84E69B458250034D6C637627E7E7AE0CAB6FF06DFF080D7992FFD2372.1353.281163484.346",
        "CD_DED77797B1689BED6B94AFBF9C743E829865A2A20644965BAF07B0D354CDC951.65.3220177655.647",
        "{8E7F70E8-C856-11D2-B364-00105A1F77A1}",
        "cfilo",
        "PJ&} ",
        "UMPass Driver Trace",
        "IL_10B708ED92090289D585E6148CB02ECEF24A35EE3889A3AB808AC5B7D3E69B31.2756.3322440922.244",
        "IL_879532207E28E768BDD5908D5100596B02A35B94443E4A1FC5BC4D082E286B5E.2725.2916004656.277",
        "CD_5FEE9FE17604B3B0B11393D9C308B561F2BCE1205661C541AA8565F8DC13A7A4.276.3561919894.178",
        "ATTUNIX",
        "C_537302A7E83F131D26638FCBE571E21F594D1701F2B6EC035364D7AE0477F248",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1463.2542810793.180",
        "CD_DF35CAA9032B2BC8E9E68BEFAD5091A66EF205D46DBC51F13F62EC987E8BBEAC.290.2651380872.270",
        "IL_3872556827A1EB92143B517B7FCE405B2E5038D21521FA92710E64C6980CBC1E.1090.1749376374.358",
        "CD_EBD10294D9026876E835673F3CA0BB526578638585FDB3FD6B9DE34EBA8FE9B8.284.4133346662.1379",
        "I_0FDDA11AC916ED71F32FEE36D469E077FADCD247C9F70B38F6B7F22F5EFD8737.2700.3092675816.270",
        "IL_C2EEBA851C346DF34F861C42E7FA8ECBDDB628883251DE37984D2F4DA29D260F.1051.2040547981.306",
        "CD_0CD3432EB17462BFB5BD92FE309EBEDE9286A9F3ADCBFE4044D787F3CCDADE24.41.1235163419.481",
        "September",
        "C_D44A4A9B6EB12262C34473FD933C61624EB28DF04EEE947CFBDC46BC16EC2BA3",
        "C_554B16C9365D83D15EEFD2ED88E19BDB73646FD9C4C1F4781F93EC1BCB3E664E",
        "C_7C82262F50CE3724AC8434FD0FE0E31A40C9A7B353ABD3DEF2E6DE0816F201C4",
        "CD_2C1FABC8728F9E076F6727DBB7BA1358C4F010407356DEB983BF769E41D5848D.1758.269931641.638",
        "CR_B2CD8F05013FBEF276E8256873F843ECE3B819C86E4A1470B3F32BF921471F60",
        "IL_402C1A988E3C967CD44E0B98E94A4F14DD8D1F076372A97F42DC7DF9350DEB1C.1014.540356429.299",
        "C_BE33124BC1BB955CCA1EEC51098C47FBB8718E2518FBBB201E17211CF6CDE1DA",
        "CD_EB9E795F43B762D3D38837138F4AB68D1F6C9489A93A8726D25010DC91A8FC39.2224.3211388680.3262",
        "CD_B27DA316981A9435E5F33C2E09D6D47737795150F8F8764872B71DDD4662D813.2520.80056556.2327",
        "CD_5241CFC05A716A77CB0F36844F9A62538AED075865B9C000AF8A5A2832337841.1829.3898570177.523",
        "C_A9999FA3D79D07678BABB3F0902F35B2DDD280D3A8A7FFFDEC625AE416BB28D3",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.292.2871125761.188",
        "C_F0B32BE6D192E46E123BE3140979FC2B0A80F593F5ABF50DA89150CD93028881",
        "I_95CB120F7297824918CEA5A1263DB00A65E3AF757627DD3A88751B475FC39D92.2504.1665161030.294",
        "IL_DAD6E29B77488F794A2249D639C8F48C004C8883092B213C0AD71E2D58F607E0.2718.1248177557.278",
        "C_6745FD83171C912384932B2460F0A939D3A35DD708158F930D2B33D61C719953",
        "I_4724DE891A942155AAD3F330DC136AF2D8AD61CEF085205FE12F5ADBA2427B39.2721.3778320842.278",
        "CD_40A02E8FDAC46B2551275BE49F53DF91F9AAFECFF566E59007B7BE16747B091A.2611.2668199603.418",
        "CD_D4A704CC54B92BC73DA5A42C080CA819D44C09E46E5482AE8726E1C416015730.2619.3394553218.449",
        "I_7D726A53C2E109A7102AA0733AF15E0ABEDDFCEA169FD750AACBD377D8D29F56.1476.2555114093.305",
        "IL_058A5B1FB7DC952F689B612BDA615642767025FE637F2552CD2356FE70E70C3F.1714.871754287.345",
        "C_4C651BEF9F64ADBC535D5D50D8B78E30EE7720ACDE0BCE9B84F7D66AF315E962",
        "R_17C21168C5E514027DD75C637F4D75183D2E48A771A4F45B6A2DAB3AEF57FEB8.1352.2467780617.528",
        "I_A963FF6A8458E9C4FEA354824C031F4237B8648981577F19FD6854C86994DA8C.1797.2375707628.192",
        "CD_1D6ECBE40B5437F7025E3AB3D98C93AE3CD05163ABA83C03E800D8940B38572F.1982.1158178195.1945",
        "DefineValues",
        "CD_A38B1C74206B5E91F5CDEC753D09CB9C1F5841B8BFC4BEAAE7C08A9A46E04356.2509.1749472621.3440",
        "C_F9BE908E6B04D349324914882C01F43FCF82F51D09CD15BB331EF4E9B8630371",
        "CD_75A8E9BDDDA51B5D1D891C00799220E5C1C3A6CF1F951600FBF99252804E2F0C.2426.2182209330.365",
        "CD_EEEC9C53357AA474163EF7B420A745739C413E8DF61FA9B4FEF91F245EDBD4F9.1521.675739200.633",
        "IL_7B1CEA145FD7FDDE85118A874F4CDC2DBDFFEFB5270CF85B4A7E073D01A42C9B.2461.3033647899.340",
        "MS_409",
        "C_D847B696615F74276F510B61C4D4B2E1A80D45A53AB93D7AC103F7CEBC54D09F",
        "CD_06FC0AE99192039AD3DBC9A60D9D3329CE5644911B9200854CEAD799C76E19C9.2739.4020872397.317",
        "CD_3079E8CD6D46EEF3BB8C478A433B73D0DE2B5FE05E7E7BFC923B4F14ACB286EB.2759.2306480615.290",
        "I_169086FFC5948BF288441EB6014F6117BB5043832C0B387A437BC6A134C7C2CD.2718.3715306196.279",
        "C_A80C313AAEE717B506BC8A2C7E0BE7B667151873E69D754F677D37CD02E85826",
        "C_6CE5293A4991040589451CEEA5CB3FB1F0BCB9AC8B0C16A2D34DE39822CD1F34",
        "CR_9E824F6E13B5FC1DD52C0D8CBEEE39BA48EBDD8253035A9F85F9EE08399887E5",
        "R_E65115781D9743A298B958BBF9911272DC116A3F948081B817B6389CBD9AD4B9.2490.1570448192.550",
        "CD_59998C21660422211077DE80E05C8A70A59B3233A43120323CA16489848947CD.2032.1235839788.834",
        "IL_8DBF49FAC5DA01936A7327AB48425AFF0626B68B8CD04EA91F8AE6F72AAF271F.2720.2036729576.275",
        "CD_86063DABE8CE896A69DCD5B43BD505C1E3B2A298B4207DEC8AA9B679D5A8639E.42.3671217056.182",
        "R_2F2D52E78951A71F8A93996784706E5CDAF8CEE0DBC76918027981F3C4C35B5E",
        "IR_952652DF528E210BA7D893A981FC3647340447B0622F76B4DEC06CFB4BBB51E2",
        "CD_7362E8F68732AA5E821EC10EE1BECFA5EBEB33CEDC9F406248A6EF25071BCC2C.98.418206037.390",
        "I_10B389476894FB316640638E08A9C99AA36EB29A3A9801B1C82481AD256F36B8.2723.172693944.288",
        "CR_15A139866A05DA114FEFEDBCDD1A1CE7ECC7161C7A0053EFB8918A0783845D31",
        "C_EC346D4B55B7A3D064DA670AC46B8BE53932F3BCFC8908523A9CE445AF651CD8",
        "IL_9E152E3E3D8A2665C8A4533F9A4E67D0D1AAA1D8B83D4A80BEDF2999A2CA16CE.1479.3109614267.338",
        "R_9F8D978C4969B38F6B12BD156ED032890417BE936A9EE501730FE38AEB7DC52B",
        "CD_DA2CC882B6BCEAC9BF31E89756B8510C103D6DA8CC0721E36AB1395322663D45.2472.3008370616.398",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2065.1796729260.188",
        "C_570AC14B603ED67798F9B0D128B6E9968954B5548539020B86BDF4DFF952FCF6",
        "MSFT_AdaptivePrinterPort",
        "IL_197A2679B3DF75CD3636EE6A0849CE2AD5E7A139F32B6804AC870131AD5DCD94.1151.2791834078.604",
        "C_4F17D6E5233882194F1101B03A9C7FEE8B9841B9DC06F74E752FC74576857314",
        "CD_09A1CD34FC28B461D4B117DD4689EFC08E3B06527FEBB7251285DFC403031764.37.2241583001.348",
        "CD_40D59F896F1B4CD78A547B4E482D63447FD0237E73E28B731E2036C3CEB6A1F6.1805.4271377502.490",
        "CD_2D600EDEB86FB22AC5475ED284E8022AA05DCE0A01ED5CD478BD3E89B6038610.2245.1.42218",
        "CD_A042D558C8D8C5910DD5298BC5D29889BA5CEA0D1A22A1BD4A1EF145F3C99D41.1086.1507763335.309",
        "C_D826BFB6FDABB9CC29F695FF022B29E4C2F93F5EF932282086C4F08488D01B2D",
        "IL_D61FCCFF318A68616A63FE7A58278BB77B4206C4B4E7A6AED047BBC246A29BFB.2721.192489140.275",
        "CD_BA3FC4E8301B193C5A48BFCA7961F2A1447DB65DBFCEF017938E455E2B82923A.98.706013389.626",
        "R_76B92FF8B3AA20856691665FB718428ADC2A8F423D381B9A75A40096351B6F0B",
        "C_DC66E0F3D176681A2416409C0012006E14C3071C05E87558AEDFA3E4EDEDF547",
        "IL_E00A8EF4F74D23B882355F3A0D21293BA28C6F1C8A1BC8F9B30030B2F4330712.655.1.32485",
        "145973E41882C1B4DF5ED.2626.592078095.111",
        "CD_C811BCFC8FA021E0ED24EAF2AB4D586D8740EFE02D81CF2A5551BE06CCCF53EA.2421.246462926.667",
        "E2240DC19B0464EB.2510.556897021.368",
        "C_12C8B809AE9CE5F53FFB63FC457B4D2DCB7488DD14E84D1D82A5FA5D35BEFF46",
        "CD_CE727832ACA71A76A7C4BA18B784DCE93A436565AC691EE960FF2B3DBDFA7C74.2545.2407286112.400",
        "I_479D83150D14FF0C733BA8DD8012D4E2725601DEA4D5DCB8EC39A05FAB4FE0B5.2683.3102955067.277",
        "I_92E1DBDCE6516BC92F45DBF6030F33CA5CAAC7B75ED438085BC53B614D44EC74.2676.1369275722.271",
        "CD_68BC4728EF0C3D45D60B79F70F4A75292BFAC912BF35592AE5379D2B141C6184.2618.962402948.1801",
        "CD_4E05A85C7C9DB6824A0AEFA83C9B26B28AFA6D8D088521A8F0444E981BA3B980.2424.1118239723.292",
        "IL_34547F30EC4DFF60BD1EDC05B32BD2A1400337CE4BEDDD2715FC2C2B689008D5.2695.867217882.275",
        "CD_621D57D329305AF6C6B4D4C2D624AE4A3F08B9C39A079FD8CE37946946552574.2554.2618343119.317",
        "CD_AEB1302AC843DE3720FDF5243FA6FA29740C3EF6F87994A8A6D26F14FA996B57.1649.715370947.344",
        "CD_538A3603089712831C1855A9CC2037235C860D74ADD987C30A48B83B513E1244.1921.2593947250.1025",
        "CD_226C4C8FBCABDFAED44112749840FABF85F6E2C085528C8544F78A435A88FC7D.1166.1594560708.242",
        "The file or directory",
        "DeadGatewayDetection",
        "C_AE1E409B63FFA5CA9526C32D0BC23BBDDF2BD385B696CA68BF7BE5AF59847B4C",
        "CR_5A25B87C229EBA73993CBCAA6C98D2ABE024422E1CEED3A8A096904B578EC322",
        "IL_84ED151E5BDBC6C2B652BFFA4E3E7932A71A51E8FF4F53D598C9469CF82C24ED.2718.587289002.283",
        "C_92EE6C02ED0AA1EF322CF0E3C150FB5F1D97B8751D1560FB8DADC1FA4068EB93",
        "C_0BEADEF5D3A88C78AC78DA4B138F927C4277A4A7EF33E41BF5355AB5E59743F0",
        "C_3218B9989B938326A5858B34E6B5229D688B0E45C61F57E86A18678454B9C8C1",
        "C_62B7F57437B06407AB4B39D9915D0BBD1E5003DEA18F986400E85C5F698F8D97",
        "Set to True to suspend, False to un-suspend.",
        "CD_88AFB8925BED57D785F853EA39F60A2597B7DD047C4BBEFEFD01EFF42AC83C8A.150.1045480968.691",
        "C_C3B04A66ADDA484D1EC25E5B8140908CDCA4706F41ABDA4957CCA378FEB9EE6C",
        "I_A41A2A506F07DE19FA26EBBA5A53B62D2C62BAF775EC8BEA2B152B5D21A711E3.1480.2117662673.339",
        "C_5967C66DE43EAAFFC361A239E261C584AE151D5B580641425F8CB979F59DD32F",
        "CD_F46834254F05C21D05F1FCBE7DDBF6422B6F64465143171291F6775670622C8B.1077.2447533354.6085",
        "CD_A66D0E591535F85D5DA7C1BDF3A1DC73BE40E7ED75F810DC35A2C1D0250B7F4C.157.2675365779.1151",
        "C_E626C49C2DBDF1D0BDC38FFC05C85B76B4BE8E69CBFD214D5F89F70F619AD6CD",
        "CD_36998BBD1F34ACF15B900E670E327F028E4B196C8A6E911E23965EC2D63ED47F.2420.472566580.382",
        "IL_FC9CDC4116DEA0D604B5B2F0BBCDBD3F1D6D526C260DFA9BD8E557B3AD574899.1015.2391886511.307",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1780.3650505445.180",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.304.2883904097.180",
        "C_18844B622E692B354A4D328535B8F3AF7181D02C445E691E16C25BD8BD83D1D1",
        "CD_3D509F135C704C49652422902B33D6493BA6C4A55FC967E5BDCAA83CA4EBF452.2744.2260091820.359",
        "Win32_TSPublishedApplication_Prov",
        "C_B209BBC3E9792036932058EAFDFF59DF6B02D2E0E24C683DBB3CFAD2B25B83E4",
        "IL_918565F2AC17124A0B8E78883EB2D7AFA64B7AA2F5E086A6CEA6DF80E0037CDC.2688.2169007999.265",
        "StatusMask",
        "__NAMESPACE",
        "CD_BE504B709BC667DAE2240ADC0A88BDB48E5089FE47F6786E5F5AEB39C66F90BB.2573.2400077311.220",
        "CD_1A3460E595B2CA58A7D95317C6529992777B447C7792560971FCCBE171032990.2585.1281875977.491",
        "I_94837FE507FD3B20A1DD984F030C2757F59BCE309D22B5FB4CCFFB1555BCB45F.2694.653034401.258",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1475.3487665334.180",
        "CD_9D49DE5FE7117A424F94DC4AF7045470A4F37083CA49767395F84BEFE3CC8A71.1539.2117590869.487",
        "CD_66B4AAE372CBC10B0496696F6E3E5C00A5D9FE6B85AA03A0FC19CA05435472B7.1189.2963701391.284",
        "I_159E21DE8EEDD01D21B4AEFE684201F3AB1D9BFE4CC6CEBED02BDCC2E30EFCAF.2692.1185386407.283",
        "I_01AE29EDF18F0AC5E1759FD5DEB7A44E70C597DB04EB864315CE7CEFDCF23390.2702.3007240258.291",
        "C_A0108CE261D6CD70D350F5B72F2E9874AE6E004D3029015B0919B1BD326BB649",
        "CD_653235DE591AE3093EA451E38F82B04EDE8940053285CA905BDBC1B15FE08288.2544.330016219.814",
        "C_F0D0424EC702B17B5367CB152393B7E5322793C4C7DD8F7A83FA112EC516608B",
        "C_672AC91064DD7727FB109DFF59E95A1F605E4D89A741855158B3D85A026CCD54",
        "CD_E78B24A63ACB40A253226DA76298C783683B9FFCFE28CF1078C510D46CEF2248.1135.4026673404.974",
        "Policy Repository",
        "R_EE114F4FE01FE67CCBF527389950B274E9DD0C5E065983568D81FE81D7764DE7.1805.2455997294.540",
        "CD_A41AFD053649038BED9397E93370DEB60FBFF83AF8C35F1EAF8651CFC8534ECC.2557.2492832046.684",
        "CD_6733173DBDD8F69CA9013116A1C86DBB32D2314712D9192FE9CAEE8C9CAD7094.1750.4037169654.1198",
        "CD_59998C21660422211077DE80E05C8A70A59B3233A43120323CA16489848947CD.1356.1038812945.933",
        "CD_BE33124BC1BB955CCA1EEC51098C47FBB8718E2518FBBB201E17211CF6CDE1DA.312.333455836.433",
        "I_26A8A21DF89D1FC7CB08CD7898DEF4B5BF45DA1A28ABDE9B3244E0539D59DEDE.1057.4183458163.344",
        "I_0D0C408DA61D1D81B5295D02AF7B7B37B653E3A9A8C3EC1985E8DB9FFB9B3ECA.2709.2499305137.305",
        "CD_3935D6345388A245E9FF50F1CD42F69CC8FD444FF90B93C789385D0BD31672F7.110.581696749.982",
        "C_7982F1017538FCA639874841D68FAD4E24866671A5CDE2C6CB4C169C859203D9",
        "CD_35C3DB4E6811B1E772EED05511EEF74635DA11992A8190A2AE28CF34DE0B7D35.2607.4083684624.1445",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2088.2805259893.368",
        "I_411115B3E1284DAAD30C6F230383DFFDB3BF55D3090110865C0376393ECEC80C.2686.3783864451.287",
        "I_E0849CDEB189AA76D8525CE1B639DCC35E6FEC1238BA020F29888EDAD9D3FEAF.2462.1487720740.353",
        "CD_C3C6D8FB3474EE785958EA6FF4182273D2A6254E9DC15AB0F00C01432187E439.2421.1322111008.681",
        "CD_D9ACC786040BEB03B0BFA580026B159E4F14D3F3DA042378A3F7A6904DFD7A2B.2550.74996258.1521",
        "C_CC816E6ADE44FC6F4846C4350B65FAEE0309337AF136769D6C3E5769ECF590C6",
        "CR_A09DF16E80CB8250C7E8F768EDC2F0DB283873E2BF1AF5FB3DCD5C1A024C9766",
        "CR_76F06702E66816F9A4EE931DBEF795220B2BBD5798222D30A793AAB4882409B7",
        "E2BC1C3C9AA54865F4",
        "Write",
        "CD_736DA1BE1383B0FEB2F66F7268F46979989C22B45120DC2F7115B633EBF80496.1190.916351619.302",
        "C_2043EC9092C59491FF884418C0893D233612EDF305F1000C5720E3CDDEF86009",
        "CD_187F2BF471DE99AF2B82ABD56932A57142BB77EFF56B5C132EE3CBBDDE7852FE.1594.2759361377.516",
        "CD_F888AA6AC586756C18E219B06406D7BCD62E2EB0C94B51FB48F127652DA7E3EB.157.1547883813.287",
        "CD_3B8665948C758F7D99D7C0547B931220E5029F52E2FA5FBAACE58A619F833743.1365.372972719.347",
        " Represents a storage chassis in a data center.",
        "CD_F361CD902D6FB5B5BC72726163E8257DF5E310350EACFCB5758995876F4EB4D6.1559.1111469157.1689",
        "I_9B07AEDFA0297C3D0ADDCC9EF3319D27BBED68231233AEB11FC9E3B82B9AE1F7.2699.2757768313.279",
        "CD_8124978EC1B10AEACA2D165201147DA1CBABB9C526A77FFC04D016C0C64A5CE3.2645.3523578805.242",
        "Quick Scan",
        "R_F62E0666212AC3F3422A2CD244B01C66D5C5B4C6B82C02CAED0A73F78C5069FA",
        "CD_B1DD166515EFBE9CA9A9BC05F545A35C45C3F834A45BC50D492ACD05C6CBB96D.1017.275867632.175",
        "cxR[pJNt_*",
        "I_EC794B3467A52CCDF1B174E691E806AC5F2BE51FBBD02FD9D19305BDFD36C8D8.1017.657475596.341",
        "I_A600B813C3AEE4D495996259138D2BE996C368532199D64507DCA6E373C2D027.779.1.56137",
        "ScanScheduleDay",
        "I_6AE3DC7DF7E343BE6C05459A97DD7F3FFD2C5DD77C327113405CBB9D1D012CA0.2696.1970604726.273",
        "CD_8242218A573BE42A46B3811AB82133E6A6A1C7B93BF914F87FA34E77B2BCA513.1564.2797914697.1147",
        "0x00000001",
        "CD_11D484FDE19A8F43D1F07FDCD47FC2D8E23EAFB01FF975179CD32C427E1C3CA4.94.3780565045.258",
        "Win32_SecuritySettingOfLogicalShare",
        "CR_3929A976292C0E92F1EE078CF7C2D3C5371AB7D7BA2E3A5C78D38FD26BACE479",
        "I_FD744AD30395F2B30DC2B5A4EA76B3CF1BC3EC0C9398E32D8B8DE1267FE97260.2718.2810907187.272",
        "CD_2533047DA81AFE646CE1AAEB501DC87C867F285A11A41EC0D6C4A1E4EB1B7D0E.2521.1695488358.1588",
        "C_07158AC46AB23011D10296EB63960CC939E2922A1ADF31B09CD4B8579AFB85A4",
        "R_7362E8F68732AA5E821EC10EE1BECFA5EBEB33CEDC9F406248A6EF25071BCC2C",
        "C_852580057F8E6155822579BE3A47822371F2A72F79BA24784B9CC5E5F79678B5",
        "R_A031CEAC5953C8D3D1F35E1808CFDA9CF75C860B9E43860077ADEB4071235C56",
        "R_A0108CE261D6CD70D350F5B72F2E9874AE6E004D3029015B0919B1BD326BB649",
        "I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D.2736.4044228206.255",
        "IL_675C8C02435D74D2BF9FB2F1ACC8A427A072276AD5C19F68D5A3EC506D13F5D8.118.2343476280.299",
        "PAL D",
        "rCFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C",
        "C_2C912D30C6F2C9872585F2917A9F51466121BD73DCC0AA6A9A6D8C6362427472",
        "This device is disabled because the firmware of the device did not give it the required resources.",
        "IL_F41AAB3CE0418D59CCEE78DC6089E8A71443DF08351201B015241ECCC0AF9C70.1617.460483849.315",
        "IL_095213B9C0D61229559381AB15B808F9B97CDDAAEAE8B87714A71305321F2FCD.2764.2386093868.287",
        "R_240E55CEFBDA1AE8D766AC59B57A246BE8F95FE50F508D9C72C03BF7E80125B6",
        "I_2D906EE78B47924EB2DBC2AD7D7119FF21AF13CB3C29778D1DD83CADD73AA684.2697.2457263182.281",
        "CD_9C6A7E3E087A5B8DA585FF771A2BB4634D1FA2F66F376E9BF7FD6F960807500B.272.3930462186.3432",
        "BF6D193C06ED59D7A3A327EF4048CFECAB45DE235BD2A443.2709.2232911713.309",
        " The SoftwareElementID is an identifier for this software element.",
        "C_E924940DBDA6BB136C3383CD29AB2546ADB5364C986CB6EE98CB12EA6F955309",
        "CD_1EAA623E5E2107E59DEB71245C575469EF4587B65CD6A524FC65E9E8A98BAC62.2542.649325084.516",
        "CD_27BD06140C1A1F8932E87156F8647090C9F195504BF06BA40A70C3770B3F31D8.1836.1467636049.608",
        "CD_47942F6B36BA2D84D4007BC0F4010D1D4D9DB566722A9AD5DB3D3436577E6F01.2473.2904945368.2187",
        "CD_55B845C86C086EF59EB551FD3F61CC9B2BD4FD4446A9927FE5E4BCA04CC4B0FD.1937.367925114.257",
        "C_4D02D2507121F4F9419B3B4E42345F52E9719162092A87545BBD14771DBD18F7",
        "R_8AF99DA1F06B229D9D44D9F592B61752EA41E8D0051B9900D37AF99E19CDDBD8.2521.3929420989.518",
        "C_9E80816304B77C3F7FB69E6FA27E369EEAF4355C2560E5D96A7A1A687778DD04",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.275.2010649301.188",
        "CD_285CB51B3F84539727C291C35375EA31F52E427EA0210E136DD7CA9D76AF4CE3.2624.1983375653.510",
        "CD_18844B622E692B354A4D328535B8F3AF7181D02C445E691E16C25BD8BD83D1D1.20.980016361.864",
        "CR_337863EF99B561BCCD899B7AFA2247DE6CE14F0D81601137B3F7CD2CFAE44723",
        "C_3E2769185393DADAF821E1723DCF561EDDF22F73B1FF1BC035D1A9B87F916628",
        "C_1C07FE540DAA3F27E5D401076DA847989EAF991B378575B5B751936E81935DBF",
        "C_A58578087E737BC8DD57D102F9138F5ADF8AA5D8A71EB3BDCC001417DBE8780F",
        "CD_B449E4C982007699901F8B11448557481BCA2B35C4809156A6C3E1390C860FE7.2244.1204772027.182",
        "CD_A91F5860FAF4D61BB59DF2B1BBEB7B81236143770F1F0AA075F34F7FF7BBC1EC.2572.1957656436.220",
        "IL_5E23D07DF89AAE013A4888DE155DEF770B5023A4803B58A3746F93A4462C2343.2536.1527542584.281",
        "IL_2494DBE63389867B7E3D34AE21BF0B12CEED89B4B68AC838CC7D80AD6A059758.2724.155699716.288",
        "IL_F467BE741A1A7EDE9980540A8C7DCBDB65D8FCC5102E04F5144A877288384776.2711.928093711.286",
        "CD_947A6ECFED1300E5950B4C8196704C2B50E4463864CF2615B27D56E94A95716A.2593.2302519588.1789",
        "C_5CBA40F57DD1C39C5446D4C1AED98236A1F94F251B54CA16ABB677B02EE7B56B",
        "CD_961B71EE3CEF77853FD06FD1FD078D670615B8B606936AC4407F5BADB29E35F4.114.1122080057.3554",
        "IL_F82211380E0CCF1066DD987F62514447882809387880AC1E17BCD7E30E48DC8B.2719.3443638465.283",
        "MSKernelPpmClass",
        "CD_817907EE3F3F1D281C653B2387D6437098E74E117CFD338A02C0B1790D3818D0.2618.678947081.1727",
        "CD_1DEA755185614A62FD396F35928F08FE00740978A177E14154E9A8873389BB1E.1602.4031061193.441",
        "C_AB754770CC19ECF1708863E61B4513A3C8CECABE89D78E5D727A64FE3F1CF111",
        "C_9E0BBFD642722F22A3DE9294E48CA8E34C291ACC893F65DEE82C20A071D99D86",
        "Degraded",
        "CD_AB1A08A0592FD5FED34D7F6FB366B4D30C0F904260E536317AAE6F7C4B1BADEA.71.2534939811.217",
        "CR_4F1C732DE8891B6735DABB456D12844B78FD522910A121B420BCDDEB9B10CF13",
        "CD_D7A5A6FDE7193A09C153CBD1A0ED6D9E1BE99552FF2A49A452AEED9CDE64FAD5.76.1974817337.318",
        "CD_9D89FA2B309F38D240606161FF6D4D1DD686574B6527CC994C80F23BE2267FCF.2111.167449512.5076",
        "CD_0FD1FAA819681F2EC44E2931633C629893BC924C7278A0294B94667101A7CC55.2371.72617338.955",
        "C_651E1CF574F41D7ADB83E2088A2BE31E56053138D6E9D2570D7714EEE6709D8A",
        "CD_4B0679EF2CCA448145114D6A472865C92C4C9C07F908BEEF43360F54325B5BA0.2568.2329572491.1292",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2020.336309311.180",
        "CR_962C6E7C58B97BBA37F5179D96ED3E00EE4A4FC20E4C3C3A3312674F9F7C4195",
        "`dhlptx|",
        "CD_EF449CE69828797E16ABEAB272BB63851199331E1B3809DFFF02FC6CB2F0B417.1807.272499810.3623",
        "CD_5872AF16FB59CA1F21F2D919AFAC7561AC0FBDAA19BFF7FE9364C3663EA2969D.1479.2137037125.313",
        "C_2CA439D710E0A0B65B98B6AC9F38FE01A2B22B06C769C1CEA38D591EF238CF9F",
        "CD_7D462EA5E87CA015476942A58BACB3893636973868980DA68AC5EC3B5A1C690A.2418.1299956342.673",
        "C_6CEE23AF5AC96CC1D26B44101921AD2362C642D209314F6F8ED16204FD204C66",
        "RAS Entry Data",
        "IL_EECC1B53EAFA05C0B6F851CC807603872D0D449596FFABA056F5C4B60A55314E.2677.1393790616.273",
        "CD_947A6ECFED1300E5950B4C8196704C2B50E4463864CF2615B27D56E94A95716A.2662.2676656261.1323",
        "AllowInboundMaskRequest",
        "CD_18D8719A943B4599747ADA74EA7D32C69D833172BB0F49178849B0570759A4F9.111.2196663484.1200",
        "CD_40A24DF0170D3D162FDD7C849B2D46C54DA402D695FB97CA12BAADDBC62C83AA.1071.903032662.2790",
        "C_94D3D66BD2EBA9427DC5E5441BF12C249317CE8B6E74F24C2C5B169DCAA56DA0",
        "CD_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170.1.2190771445.725",
        "I_7BEB918E7FAA67D6D742244360485A978EF25007530E0D04055CC08887CA2263.2698.1879792984.264",
        "NumOfMonitorFreqRanges",
        "C_8950872A12F7D2C94B8C7D080DB29BDCF4FDD3AE62780BA9D92B3DD00B3F7D6D",
        "C_81CCD9F49463DE42E5F24116205A8C2F9DB6E6D4063663217E282C3E20BE0A3D",
        "CR_A57480D0D82DDE51E01CC9C7625981822E2D1C37B70F78DC6E6179505A7BD928",
        "I_CCDE22A24DAF1146276832D41859B46072EC704602C22BA3DCE8075CB85E0857.2687.4195108845.275",
        "IL_DE17C9D5088F4B642733CF8AEA90F5A7AFA5A9B0892FB2650254AF86F16B343D.2451.1722177901.342",
        "CR_20C8A4313A9882D64219A6814548B8CA23AA20618BD06EA1320CC257373FA4D3",
        "C_0FB727CBD11D8AA74B3B2793A1C7EA749C62FCE60E8F20DACD959B04FA118436",
        "CD_CC42CE8E16DE25C1D91BA16E865F3AC012D22CBD5E4C5B16BAA9C58BB1B02618.2573.1478899891.368",
        "C_62999B86D7FB03CF7A5DB6EFC7D4930E35E2F23BB83D0F4261B4003B746A0A79",
        "CD_7E470595B07CCACED12AF52AF9B26E1DC367DE0F25EDA25E0FC74FECC24A888A.1171.762809217.745",
        "CD_103563D59E224884B92C8B7934BDD6592D64C63C0FEB52D1B636E2F48012EA04.1533.2142665151.1028",
        "I_CBE171D83880D49249106D75217277BE676413B7C78EF4BD206FD6590EA860A7.2694.3741844336.271",
        "I_F5FDDA4F96E1012532E65A365C05BE661ED9E25ED5B65DE83713A92BAC59E2AC.1333.3647789585.354",
        "CD_F542449B0CBD50CC1A71BFA6B7B20474C5DA76B95F621A678DD36C9156526568.1544.3398123194.751",
        "C_58C99E497FC42770D05B9C20CF9DCC0E695351111634B1C709600F377B5052D2",
        "CD_AE01E14A20F57BFD98D6AD94A76C705104070514D24AEA318BE6A6A137F33F5A.1598.1540223492.600",
        "IL_C6352ABAE174F7A78D26568406CA8EF6E55D5717757CE4CB6B02F0297EA5EE44.2684.324927230.276",
        "Shadow copy management.",
        "CD_1A717E75CBF8D159FBD7D0313AC442D5384DAB57DC1BBAE58D7658C922D9CEA0.1980.805715187.1508",
        "CD_C494166FEC78B76B06AE6864E10BB6C47EF436F2498312A79210EB6DD47C6CAE.1742.1.10471",
        "IL_29AFADC3CBF603D7A79F75561E5EDA04275DF12A6E0D26959751169EC02FA7CF.2692.1412653181.267",
        "CD_D336428E5FE02B93C4413230D0BA8394C3D8D327B0A951AB98E34E7C718B63E6.1058.4050129506.3262",
        "CD_C149B0FCA32CABFF7747FC6208AAE6EA9989E86ECD4BDD3CB57B7E59EB1D27CE.2597.2430667580.1011",
        "CD_390A7265D9FEAD6AA3D52AB61B20BCCA9E6B67E5811FC8A0748502D100C63214.1346.3767140809.679",
        "CD_99526796DD78031C7C2FAD6BF8D8F64825A2F3F58DED87A8E35BA27BB08D1659.1226.3167956345.326",
        "C_EB6AD886198E6F65EE0C752A5FF5E8A8CEAC439C9AF6E57BB6318A547969C13C",
        "CD_DDCE0EEC8025DB3F389EB360CE7C50BBC0E131D334E8FAB08585F4C0CA2A98A2.1748.2544688577.475",
        "CD_D9A10218F30FA4E428551F3E416442A7D38AB8762B28D40A8E89B4D3006D1DA2.97.3010035400.4889",
        "C_322E03EFB160A47DE71A7AC4A5E201730C10AF1089A23A514F137F0DFEF012D7",
        "IL_7BB6BDBD053B0345C959F5F092B8F75BB256CAD418217440829B48B36676E853.2711.450403225.285",
        "C_D37C7FDD3090E0A8DE13792C3ACE5861A14731A38436E85C6978D8F1B151C11E",
        "CD_9B85FF5CF1326F4370A0D245830AD60317CB312C53E60E05480454CFB6E5D2C1.2098.3268881053.228",
        "IL_4353D053338FE1B3BEAE97366DC623CC7ED5BEFDC1DE4ED2F848E1393A65BC4A.2689.1336821473.275",
        "CD_F9BE908E6B04D349324914882C01F43FCF82F51D09CD15BB331EF4E9B8630371.2579.322157861.1694",
        "CD_E78B24A63ACB40A253226DA76298C783683B9FFCFE28CF1078C510D46CEF2248.1090.2163812171.396",
        "I_A2D6D5AD8E257108C2B31DAFB7683989E6057DD0B17DF9AB813C42DEDDE1FA4D.2693.1593862869.280",
        "CR_25951CCF498736F09F8CDC3085BB276C2817DE47EF5312A0F051C1AC3B67B2CE",
        "CR_76B92FF8B3AA20856691665FB718428ADC2A8F423D381B9A75A40096351B6F0B",
        "I_364BBD5A8139AAABF6ABFCD0BC11369EDAD78856E35184B469FD18AE3CC9E67D.2702.1453602151.270",
        "CD_6D294564BCF9623048C8EF258EF84596CA931F72FA8476A8D1B3C2E5E28C03AF.1354.848333310.474",
        "CD_0C9AB5617BA8A9B7C3F74C1EB3942161CC46D714C581CA50C949594A28711EC7.1465.268796350.585",
        "ROOT\\wmi\\ms_409",
        "CD_454F94D401CBC66FBA3CF01A7FEBB7AD985BD8046C5115863EFA27C37A7F626A.2600.4121855938.538",
        "C_523C638C908DDE7662F7522F26AE86EDDEE32DBFE4A87A273D23892766373D37",
        "R_3FE01F381F5BCCC88268B37C2B314A2D521AE6DB7BA30597F005D1DA4B99A772.1020.1306476002.528",
        "CD_18BBD01AB9B011850ED53F3C153FB85C4D5FA9678EC8589287B293A340368BF6.1795.1.8872",
        "8087D6E05ABF71723D446983422A5.193.1.30059",
        "CD_00637C6FCCC93CC75F9D988B459EA167A80BFD4782DA6DB5BC1F63F5A3F73F9B.1501.1835236531.361",
        "FF999460FF4879179CFEF4C66A96B6BFBDF88AAF0B",
        "C_3893EDBA1FFE14E31D305F26A8C305A156A91E1EF7F83521E3C67BFA88E1702E",
        "CD_AEB1302AC843DE3720FDF5243FA6FA29740C3EF6F87994A8A6D26F14FA996B57.1820.195472217.415",
        "IL_CE85ABBB45D3C6F53CC78DA2989B42346ECE19173973203EF6178923B888B1B2.2696.199672103.273",
        "CD_1C871A69AE42FDAE2404C626ED2A6EE58970B1ADBD41309118A0347F713B188E.94.1055675622.3286",
        "IL_D4FD800D0A25F157107C13256D2BFE54332F45A818D512630ECA7AD5DE4E6124.2679.961345351.285",
        "CD_BB643341D226A49E491A828FD60D1BF2BD90CDEABA005283886D93DE233001D8.2055.3137936088.1589",
        "CD_34865E78DCFE7264A2E20E5113D9C23EC99F3A36B7F917B96D67DE0651659EA5.2611.3096806643.396",
        "IL_69A2B3B846B45D5B4E77AFCEB443999E6CC870E6F3C356A4E362BBACD1EC72AC.2708.689532152.290",
        "IL_306695955B1D8DEFE520389976AF6DB13DB98AD144F0B7FA28259D9EBFAD6755.2717.3650780747.291",
        "CD_A0C4181E36B5BF6BE271221B7FC9D6F392B6369BD0BAB6A546F2790003BEF7B3.1501.2941965304.1520",
        "Filename of a script file to be run, note that this is intended as an alternative to specifying the text of the script in ScriptText.  Results are undefined if both properties are assigned values.",
        "CD_55BF0CC0F072F8672008BA2E217FC98D14173100D32640D32F61CC0295647162.1602.1155760891.252",
        "C_148D54240A6A5E9E9F6B8C5515555ABD88D15832EE59292175F4480A498E01E8",
        "CD_9CD08C33F827418E52A142082B3E53DC14490B507641080CA3D5F25B878664A3.1248.2138283909.1021",
        "IL_84F7DA8FDA90FAE6187111C2192FDA36DDBDE6FDE609673EA728B3013AF37B7B.650.1.36555",
        "I_E6B542B82EDCE391F6452F63ED46CA719A3C6012BB70E83C717203A53EDE5178.2685.4244524058.271",
        "CD_7B2381E53BC461FB5BE5892F6D8B646850BE4B97761D0A77A966BD4E7C587F57.123.1410201865.663",
        "CD_EEBD2BE4BA10C80A9A5F5BEB9204D5ECE3D09C35A05EAE250976FE5992E25678.1932.2437922272.1124",
        "CD_1CB9E7DC27B4A89E576CF24BDA3B45DCE8B5B969797A00622E9D1746514F3E59.1958.3273781461.605",
        "C_2533047DA81AFE646CE1AAEB501DC87C867F285A11A41EC0D6C4A1E4EB1B7D0E",
        "CD_2A7649576C810E2039E9EE14A94AD920395C83CBA45A6BC9D33333590A724EDE.2604.26463170.1589",
        "ACPI version of idle states in use",
        "NS_2B689AF3F38A341BB9044301A8A9039A9FAB11D0506D58B53A8B271288AD4404",
        "I_7CF7DA788CB633591FE5B31F4F2207A3A629FD098D55AD1913CE2E46186B87B6.295.1901134170.300",
        "IL_B88E1F7ACDC8EC9FCDAB0EC7AF8C88A72F415618920EFDEF98AD2039CA54B80F.2675.3175571880.289",
        "CD_094555A29C724CB99AD80F8257BA7ACBF3FB68F96D97E3E687892E1586B8D179.31.1455975067.518",
        "I_00F1B9CB59FCE26F2EA8376B2C4CA47CD07713170C440DCF6EEF30CCF5385026.1105.1342748237.332",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1809.2193856756.368",
        "IL_8DBB6B81B0ECA779465EF83F2E802D970FA3FA7C66652674903D94982AB335B1.2707.1521999461.285",
        "IL_61B3997837DE0DF0F6FF5DBC11754E14EA66A54917FB7566A35ECA579231067B.1017.1684801006.323",
        "CD_8BC061EB0082E96D5DC5828FD96C3FC2A01095E7E42C720BCD36F363CA556A85.1136.2199924786.217",
        "CD_A05B58817295181CBA7B676653ED97C1E23D591F86C20D99BF4C67B62E0E211D.2114.3381669943.532",
        "IR_11DC9B6A513916A4D323430E59B223090625B5769C0F700CDF56011654E2084D",
        "CD_AF381E654B1D4D615B1590FE7663989B45D5E01B0E914F360B9D5BE7CAE77340.2653.3351662663.484",
        "IL_221B15A46AC13C7AD27BC4E20FAF2340A7392D01F17942AD13DF1D7C71524ABC.2720.1812539822.280",
        "IR_032BF74126BD906A94AA7C5F9E67F926ADB60BB06DCAD8F4480D345668D8EAA7",
        "7201C52676F0D9E3C4A7.2693.1545599403.261",
        "CD_73F9CC8D0A2B5107ED79AE2372D78EAA3B2A7A24FD2BD2876517DA1B42CB16AD.2747.2590873395.725",
        "IL_CEB3FF80EEC7AA76CD64001645DDEA4365629F46859570FE28955766B800A444.2726.3322423495.279",
        "C_A9FE98FE5C3E9051AEEC71D48BD2011F883E1553AA2DD7968A20C510AD60108F",
        "IL_5D2BB87B71BEBE7EB749C15D63AE0A1DF7CB60A6E0BE0CCFD5DA7FC64070C522.2689.911660780.271",
        "Register",
        "IL_07DB30DAB1AA681F3306873C7D2E2D1AD1EBEA092A587DBEA82803E65EE6A511.2722.2144799345.289",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.1500.17407651.442",
        "CD_3FDA482EEA11D105F777BB4C0E86194FDFA63901845D94A245BC2172A88E5638.2229.71780315.2531",
        "C_57AD49AAA93A9DB4C747A5522BD17E886017CE9B2B40450392A8012CE5FE8334",
        "CD_F15C23121D56EB64CEDC9D19B9CBACBF5742596C0D8EF3BAB76E325DE01F06D6.1051.3553797966.787",
        "C_24DDD679D1882479B2F8FF4AF859BE0088ACDCC7691D1F75049F173178F9EE5B",
        "C_1DE1D06D7EB25E718A8B4717CC2834F5D199085AFABE977E92B5CC3DCFD8A932",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2070.2825033132.188",
        "I_F9B72CA76EC1D3B52109C1244A7F2F0FD89252855F69B97F985B666E29D5ECD0.2716.3515488736.288",
        "CD_9C6D6FF9B9D03B5113EB79662290652D2C90B044404DF90E5AE9AB4E9323EE10.254.822835140.820",
        "C_CB8902267994B97206E0B7D2D48E5A733ABE6C5272CD230F09306A7AC1595890",
        "CD_2432A5ABBE7173FA98223D70B4EDFB312E0AA87F456103A25E4B4191AB55FA02.10.4112310246.443",
        "C_EC28DDFBBFD00B2229C9E0AF729FD229D243C353901915B7D576D0B0AD926784",
        "Invalid Parameter",
        "IL_85C2EE1376D85A8ECCBF997AA5615DA98F17AE86C3C78EA36F84A52EB21D403E.2699.2463021101.281",
        "C_01485C56AD31BD1C7B9875265E909545C1FD016E19345A12E2E00973CE0EF1CF",
        "CD_AB754770CC19ECF1708863E61B4513A3C8CECABE89D78E5D727A64FE3F1CF111.1166.3555509487.1295",
        "CD_0FB0A8E86C1430EE0BB7D412F66362E6E788646DB733ACDB85AE2E440B7F37A4.1171.219885359.269",
        "CD_A726CC10C860A315296DCD93520657C7C068B6652EE5FFD6550B3E0DAB8CACAE.112.2149063907.1647",
        "CR_6572B1CC4CD6AC35D80FB14E68E5854FA4FA40953667D1578E6FFD075F930AA0",
        "CD_AA429B70C768974D13BFCC6D4D962AE6C7D2E46A2B24E5B0ABDECE10F90FE8E6.1976.1119904844.3936",
        "C_EDF405E5A8AED1408B4231A69625FA74DED38312558073DAEE4924A3AAB425BD",
        "IL_906FA8E82C03F1556A8EE9CB8FA33DD2AAAA84C37B806DF136A6D1DA4FAEC26C.2727.574477994.280",
        "MajorFunction",
        "IL_FF0C2845C4EF55842E7A462698504FA4F42C4D5F4754C93590380753911815ED.2701.296537462.273",
        "CD_44329BB2A5F5C66C32C4999A22AB6E9D5D2A6621ADF626B020D00BCABAC51F7F.1780.2416224388.1624",
        "CD_4A9BADBF619D7C360E2E222A1D05EF4C32E9769C9232CA2631F4E74AC78597AC.2425.3324168148.361",
        "CD_73FDCA103A6930FD52B50CB857297C58B950838604AAF9FA2A8A8AC7D06D4361.1213.1.10004",
        "CD_7CEB103F91AEEF1DB6C084EBDE11E5E0AADB5B9B8244715CE731078F7E98A92C.2583.1270970552.769",
        "CD_DB6E0EFA4A4955084B9781E96833D815504B83527431DC12DE9BBE2E1823B500.1463.521817074.323",
        "CD_5608C71543FDDF779F8513E4CC24C4DEA60B46017206C3AB0BF7959308FEA837.215.1519247097.295",
        "I_9986681953458125C97FD5A2EE1F0693C18B98DA74E92FEA54D0571D21BF0CA6.2700.542454938.269",
        "$ PLD@",
        "CD_CA28E6386CB43A066BE2561E182A1EEE9C70BBC65B5975ED1D17667F17262B9A.2616.1686274153.1771",
        "CD_31380B1CBE2DE48F4953061E943634793359C618E73F753682430004D4E36FB0.1671.453072388.359",
        "CD_CC3EE48409603DEE1E986C935018AEA6ED00D5C887B2B6A22814F97B2FCF9344.2566.3386784911.229",
        "CD_75562CFBB77C496AC5F7654A2A8412CA6C73A2BA8CBA12AD5B61673913C280C9.2549.29141234.1505",
        "I_FDC07BF412EF517BF16CBEA0AD032C8FE94CB2DD73B9CD909C08659DB8C5BC0A.1356.1547423517.325",
        "I_42A105F66FD5DFB98393A0C1DFD104879DCD0F8C544759E15310946E5573FDB6.2726.172223000.274",
        "ModifiedData",
        "CD_75DCC5501459F92CDB3FEB632F97BB7C31AAA71AE0E5B660A7C1DBFC51ECAF25.1938.3459193722.2653",
        "I_8E23EB78FFAC4A759215B5BD6EC35386D5DAFFB04E17A1E0F3F33C9BDCE81E56.1197.3581331220.259",
        "CR_B9D962D6F5E4151B919F374E6DA62601E38AAA45193D0F7E78EB4B2AAA85F011",
        "R_542662E51FDBFBEA6DA0FE85EB364D5F9CA6EF91BBCDB6172E88F1ECB3E9ECA8",
        "I_C066615344CD76A1C7EBB470B49AC946E3B7FE9ACA9B508F6634ED36BA2001EB.2696.3756020706.280",
        "CD_B977125944CA8326977A414325742B1EF12C40157E5C5D20B7B02407CD6122F8.1610.704689201.300",
        "KI_C20D4B021E0AFFB61E5D90A8AD1A949CBA948B6ED6C506FD3F623477DE2DDF5D",
        "C_C85BEC05E1DE78CAC5454E6D33A2BAFD69D28B4057355776F41B00B3DF99855E",
        "C_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC",
        "IL_7CCBF1F84CDA4650F5493AEBF4F4A6D684B7FB6015AC4D79B389A8EE87ABFAC8.2687.2663642713.264",
        "NextStep",
        "CD_7DB1E30FC06BBCD83555FCA1DA86A907938086DE88B466575ED4B935DD61EAE7.2761.309343884.770",
        "CD_43B35DA4EAEBC0284206ADBC4132DA71EB8556E731586CFE46B5A658E2C2F498.183.2059775575.751",
        "C_C78AC0FF7EE3F58DB7822FB4C033CAB6C42D54AE8C8F1545E75A7C5FC5C2ABDE",
        "CD_23934BAB3D64E6FBBA2D103113B7071EEDD4C5897E664D2380D00F90496625D2.2615.3374453671.421",
        "QueueType",
        "C_3C7F00744A118738B0F07DC8C0576BC0E9D6C8254424A8F90C2292912ED03907",
        "C_C512ED5FC2F1197607B14D5DB5ACB87E40AB351866BBAFEF73C3BDEFEF11BE00",
        "`dhlptx",
        "CD_845E1029436FB5CEAE897C4994B71C71B5FA45055CD8AFB3EF1896587669D285.13.1864492567.245",
        "C_05CA5F8E6EDC2C8D11BBB4DA46B36ED992C196304CC24289ACA10C9E37FCC545",
        "C_C502D67664F16B0C26C80BA30AFBE91ABD4375BB24F8697FCA1AF3070D29CC71",
        "R_AC74BA8CCBB8B7653E84CC3AAB6F43C1B7147F57F54B0A2F4FF0A55FCB7892BB",
        "CD_0FD1FAA819681F2EC44E2931633C629893BC924C7278A0294B94667101A7CC55.1808.4176319455.236",
        "PrinterObject",
        "CD_E241A982292C9628611468FB40BE60D4CC1B723333EE25A7584E871FE9DA753E.1085.2671234804.428",
        "C_1BA3904BE59BF13076F67B68478754255F37AB77B70CB1F11C34B96A27231EAE",
        "I_A4024847100E6E0DB378BF6FF6D5F068F89EA10E15580AF3CCFD8C02632CC6C5.2764.264922140.289",
        "IL_A0B6CBCB3E1468ED64AF9F60ECE1EB9BE6B074D1A7044C3A5A7AF233BBE8C92D.2691.1667993838.262",
        "QTWZ]`c~",
        "CD_AEF5A70C706EB1C2AF0BC5B36F14C87FA31F991587A5360179E66B8CF9ECD4E1.2228.557448448.362",
        "C_31C57C9E263B97D03A756EF80651A37DE79FAE86B9B4BB0C343E3E41365C70C4",
        "CD_15A0574CC6A502D68CCFDC53B1AC5E00FF52C94DF0173E0C428828FB42537813.2118.2684230107.2076",
        "C_9D8D293A690FFEF350AE4D7C020869D528F57982A60CEA02D406951DA64B57DC",
        "C_674A600DCCAA63BD9D394037EF94415E97BD130F08DC05DC75146875725ECC64",
        "CD_E483DF7E28B72B64DDC8E69D7B9D7A194DAA49C1FD6E07E079F14E12C3A828EF.1700.670490228.2645",
        "I_445507205DF7D1E1BEE19C348E5F25938E56B8183FCE82C7881903791C62087E.2686.4059942594.274",
        "CD_81C106E09E02CD8E9F92751CDD19E5532DF222FFFFF38E1A22F4010E1CF8B4EB.286.319838727.1735",
        "CD_664AF66B21C2039DE71ED4563B6D82F78FB404975A3235A5DEEC63FCFAD8513C.0.2996532711.140",
        "CR_76FC0B4AFF84404E9F25DF4AA97D3CC2B42B3C84934BDB4647AA8D3D31FF5644",
        "C_000FA1AD23A342CC5409A97F904028C08F562A8841D024941D8FC5EF860D44AA",
        "CD_5B820487CA8D19401E093756115B18F0681FC4EF214059E3AFDDA51BC455A8C6.1548.2305664475.520",
        "CD_0834413373BFA65FA8219E678F81DD2C215A5FF7D7CBAA4CCA4B0C24350A6C82.1154.3254216087.1622",
        "CD_44B2B33F232E78585BC06F82C484DB1BDFCFCAAFCAC5D29C12B11CCF8EE5BA88.46.3477544344.357",
        "IL_09C45AB8C781309B93C73C5BE3D195880FF32FC6BC84DA7866B56DBA470D7032.2689.1731236705.277",
        "C_EE7C68BE0AEC70A0D69675F4FA4F9CD050786C34EDA61EA6A298C73F31955579",
        "IL_00C5C7DC8B420D1822F26248BE36B9B14263BB425C7E8B7E1182A13ED64E21A6.2716.28893167.275",
        "CD_B3C81C13898C78829E8DEF02131D7FE87DA6C4CF126C25D1E3FED7A0F888E25A.33.1891594135.493",
        "OEMVersion",
        "C_3C255F930DD72FA8F7F77864CA85297EDF04F5CB14F89518C69CF8B38A9E1152",
        "CR_AE04C9051F0EB0D5BEF6B71DD5AAC69C1301952192332A53F9A676861E551DB6",
        "OS400",
        "CR_700A223C2BE9D4D6498C555306C3D6D2A20F7ED7C0635EDD45F157ECA54B627F",
        "Usage",
        "I_26F9ADBB3734E9D9EC9D1C19AF1038CE2DD007058FD83095A02DA602BD4D8E81.2683.2270467983.290",
        "C_DA7E5D48CCF57DA0E153FC3004D659CD585527407546236ECDE7F19D7B368F18",
        "I_A6CE1EF1E794162BC8CBC26FE1AC4E7CA717DE3E44BF2C4B173BCCA10F4CBDEF.2710.2445353677.292",
        "C_403C7DAFD38411FBB7FFA51AD2D0CC5E3462A61D34EA60E279877DCCDC222D62",
        "CR_02B5557CADEF33CFA29F52E782D8C5DEF3C67D29A7C0C3B389FF34D1D0708EC3",
        "I_799544BD8AC69E449D9844334855CBCBDD303750D1732C4FE3BA6813A642BB1B.2692.1802155178.272",
        "R_2D90B53AFEDAC38F205868B82186058053FCD6F0D96B50F0ECC14BE9C7C97C9F.1498.880465683.536",
        "I_91AE913EAB0F01F87A80F388B4ECD61A926DD279DDE0012432E352183426D536.2735.1006137262.283",
        "IL_0529A4964A85F839306A13F8B1C9A58AA6A8FEEDD877A9E4A1D8D8612B0062A7.2680.1795030748.288",
        "IL_83E2267005A1F43AB3FA4E99A215A72F7958A58CFED30D986C823441CB0084ED.2676.2430761422.280",
        "CD_F779B42B004DF7F026E14BA644CC70AD37E9B5D9AC8A5876BD443235D2F16694.2637.3205444540.263",
        "C_06F5F6B28C8CF9B7239F51992CED65E9076CB252470411CD4455838A2FF091F7",
        "IL_3BC2F8500BF0B350211417D603E90F2E8505B9EDAEA12BFB811ED872C95390A2.2719.3491136097.277",
        "C_20B4E701C3271ED94785243972C16A9A8FA123A78EDAC768D9A7B370EC4A42D1",
        "Immigrating",
        "I_C5A2F70461183E1D5A31AA11A355422FC0105D25F9A65821D9FEDEB7DBB0136F.2713.4193208116.294",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1097.439896620.480",
        "IL_4C121C5FE3F1DEBEDBB2C51AB322AC0BEAC008E974ABD671ED635E46D37493C6.2718.4274374562.283",
        "CR_40BEEFCD86669714A96D09FC1ADF38E568E0B01D634EF8F9AD700B7740B2B19A",
        "C_48D4F256702BE1E23719E035364C5226D32D66BD4161C39CF31B8494F0ADE28B",
        "CD_B6FE190DA3DA92C5835085980A5F0844A541BB53B1038C06EB63E0231624C2B9.1634.4199196117.858",
        "CD_D243E66B180D01D8A4F9FFE662112E7920CAE6094EDF1FB3B8BE68097E45823F.2602.2947282970.950",
        "I_A6E5FA940D738F7DF2A306209FD839869FBE09960339784A8B593361232D3D86.2675.2386162767.280",
        "CR_CC3EE48409603DEE1E986C935018AEA6ED00D5C887B2B6A22814F97B2FCF9344",
        "CD_708C32C766D9971484B0E64ECC9BA26A9738A3C69831CA885AADB8A4B125BF1A.1849.3085769712.411",
        "C_61CADBB506D856243E79740B6392D66E1EE943841FC396F3057262385BFA8229",
        "IR_AA41A8343BA1D329E4982E46F903D80197DFB87E55CE7405A84B7AC638E427A0",
        "CD_14FFC489A434D581FBF6E06A9A803439863075160D7DFAE0D83E42734806076A.2762.2503440820.982",
        "CD_57711AB71326AC7AC810A538890F0BEE67A7DF25C7DE219237D14AFA4CFC51AC.108.1945208146.349",
        "CD_DA8922F8F22B603DB41EB2C976F36D49B18986E028948A4E7141F588D46CF157.2599.653739825.821",
        "CD_E338E39B0E84E8FFA98B59D43E1BAC3484BC52022387B71E60F1A04832CEA0F8.2228.3853875653.5587",
        "ProcessorAcpiXpss",
        "I_43B7B69F919BB681DCC1079E7BED6BA29BBE6F4DDA8822130874E698F9F22509.1105.2387327780.301",
        "IR_2E857E8085C23F260E4A5714870E085AF1A5EB43D390A00657752F8ABAC8FA75",
        "CD_FFF2AE454B5EBA423321420C962DDADA7E00808CE9D4E5B4FF81481A2E9CA1B6.37.1248595431.465",
        "C_8DAB1E77A48D33D709C49F126A0E74571C08F353352505AD29F647015F44D9CB",
        "C_0EAE68CC023B200DB742BD531339EAC47922CD99846DDB12AC4E1EC38154136F",
        "I_B12347D80039C3E56A7EDB88568AF3350AFD706FD8488DA92633AB52A06ADA3B.1051.3867603773.339",
        "I_D4FD800D0A25F157107C13256D2BFE54332F45A818D512630ECA7AD5DE4E6124.2679.961345351.285",
        "C_57D40BA37FE8186F3446A32034E557900E56ACCCD48ACC004BB55BAE4E42928A",
        "I_272BF13D8B8FD82DEE112F290564C1A0506076042BF403D11208536F22D26508.2687.804018355.264",
        "6DBA6B0E496177D52C742459BBAF910A11B04F91C925590",
        "CD_58578AEE1F0588A6EDF4B7B9F6E4E05918152DF0FF63113A77CE8072FDAE6C92.1779.4206320702.300",
        "IL_B12347D80039C3E56A7EDB88568AF3350AFD706FD8488DA92633AB52A06ADA3B.1051.3867603773.339",
        "C_8C387D212D52C17AB84A1800318321139D190C8ACE84173AF79A5939FE8790CA",
        "I_E7674BC4E2BEB76BC5C9730C20206782A359CF0805BC42546BAC2D0ABE525D71.2705.1710781757.299",
        "NS_9E247BC9FB7055BE3C26FD39D07D3C2C6F5D269AB14F2AF4075376C4F53C0205",
        "CD_4EDB0C2EDCD30D554E7C383941B8594EDB5845D9DCDB0D98A92A091B1D481759.1779.2102937337.303",
        "IL_C3D1F8AB47C19F1553213DD848B61EB76D307277D65DF730BEE3C10028352E40.2685.1313580569.294",
        "I_A0D748524A46CD1D61FEADC4E20415A871E979DC359C66348B7153B21B66469D.2692.121064910.267",
        "C_F8E20627EC0277AD3D6139BDD1CFFCE8B83EB1D53C7352CA749209255434ABB0",
        "C_CBEA5DB8929D16C32E514213A77F18E006AC31CC4E0E1C4D84A95AE510CAC230",
        "CD_6BE9B1C8C5C3B4255DA0665A39E69608A741A6E82E2CE4B5CCEEE025A6A87F82.2449.3066330889.2058",
        "BEHKNQTWZ]`cfilorx",
        "CD_4B66FACE2F9688020890084420324926AA3CF21932AD39E8C9ACEA5209F73583.43.3564511159.262",
        "IL_C7196BA272BDBBF1E0981626A5DF813B76374942580B9B119EA757B4CEE06E84.2716.3348403050.288",
        "C_E8E72C534ABA427E69CE6B883E8FFA9701DE1CDD9E04D7D1815F4420292F16DC",
        "CD_8C6449E2DF9D42E8B328C8B95C19DA35BA5DD1B3E90C6134AD1B5E625248E2F0.1998.4038399004.3491",
        "CD_DD5FB0C236A2C7E56EED8B73266A6183C862797CCE8508CAC667A1549566FB77.2561.3337951792.745",
        "CD_48D4F256702BE1E23719E035364C5226D32D66BD4161C39CF31B8494F0ADE28B.2009.1.12916",
        "CD_D6F23AC5CCBEB47ECCF7BF129523258879FDED9D282F558043FF80249A7ED596.1084.1987484121.333",
        "R_047A99119274A40492679B3B544E38CE355502E2EAB9697E723DFB904A0AB1E2.1105.602436211.520",
        "I_9FEB8C7FB68A967F3AC52B4C2CD64DBE4D1E17EA9C3590D162C3D62C6B7FDA21.2678.2974643458.284",
        "CD_468BE71EAD96390F4DBADDFAC08A97896E0369987CA06ED6C3FE7833E35AE219.254.4128374142.218",
        "QOSWMI_TRACE_POLICY",
        "CD_D2A706123FEDDDB0E412FDF2001A3E316EB3BAC437EDAC79D66B7AE69CAEFF59.2371.3625413582.1428",
        "CR_3E2F13A021D0850DA50BCD140A9F1AEF8BFEE1F533F4B83B67156601A0B1C84E",
        "NS_1A8E82799C1533DB9FBAB0C0F04C00F4B58AD9F63A6874474DB57A9DDEF264A6",
        "CD_CE2777A1E2E8F0439A275F7E5E7BEE453C2145F60A592F57CCEA55492EC8B6F1.142.3625955744.589",
        "IL_09B333378C3BE140D20CD6DC42C1A3869F1B4D2B48CB060E0972243B2BCF6DA6.2675.65167912.274",
        "CD_80B699E54B84239FD1066E5A81EB19D570A7344B7D65738ED8C91406D3A0502D.2160.1977348235.850",
        "CR_C2F98821FCB494ECEFFA5BF85ADD681DD9F374F97F468AE953F8115CC121DA2C",
        "R_B429BF87F7F0A497C5B7AE20F4439409307BAF462AA12B16BC819F2237482591.1350.1565589985.586",
        "CD_290F6F8B3B7EAA26E7735FACB33E9185DC97B5AF85F7FE15A4C9FA4C0EBACD95.220.295885596.314",
        "I_AF6BF933779CAF2D591175302290127CB7DAED56AB54C5E0695A8418F8CF1A54.2709.3626734935.295",
        "CD_16090B1DCEF7F16A5E9DEBED60D9476077271C26AA679352AC98DA64B800088B.2658.1504824490.1857",
        "IL_DDB95E3B8013B1A116C3D5830B7E0BECC772CA8D531002E78073C674C21A5A18.2697.3801693336.267",
        "IL_6542ADDBF701A825E7688F7B39144898AF264C03328F8804F4006C9467FD8A05.2687.2705387759.264",
        "R_9C6234A862ECB7785AEE1C8C46C69B53F75E4A1B191D9AE24604A07719AA0D8E",
        "C_F7A6177F848735C77C5C4AF5E078107D388009DEFF313E71C836D60D6CA7034D",
        "C_0840C52E615C811550BFF97BEB503A1141A92EBA04B602E598267A2F773E4BE8",
        "IL_F59986F3689323F08DF6C9D489E4E84D39B594030E0F1A502EBF98179EFF06DC.2727.2358231412.291",
        "IL_5521BAC18B4B7EB89F0472F31BCC9473062E039C6E6A87DC815B43A5E2BD334D.2712.1825232714.303",
        "CR_A393FEDC8D8439E642FD70414F2815F8C5D6DC216A8FBF3F8BB710BDED38BED7",
        "xW0iu",
        "CD_ECE4D023CCE2A8DA3585E072533CD9C2FABE638E31BF9A9356E6B337DBCD49AE.123.3439217493.512",
        "C_E180FA56BE25537B4EDBF25A70C610DD0A17358432E8B0D7F517AF0A54245AFC",
        "R_44179BB601F070AC8C34C5B9994988FDFF5DD1A2C985178B6D48CCB665B74AD6",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.292.2871125761.188",
        "C_B0796CE9F628CF73E17A3427BE2460F8DA001FAD27D1712ECBCBDAAC25C4954C",
        "CD_0427B3D7710F368D831E2478F76F011E2ADE4882C334EE5ECDBD3047B1FDDE39.101.309084633.1551",
        "C_33415365332F60FF3FC53C2730CA458D611DB40E1531E34D8C7BA9D358168B16",
        "CD_353ED06D06D3F543C1F82745622C061EF12A64D07607F4A41BBE9C01357C9257.2750.3805583994.824",
        "C_E991E45745117956DEAFF1C67CF04DB972E8AC05E236ED8130C434E25D63E63D",
        "CD_A883D58443A0276690606F149210FB8EEC2F26A746B711BB5A87FB7EE2B3D5F7.2575.3746220427.220",
        "CD_49530BF4592B3609DC643FFA39B0065785C88AE336F83147E233862B786488CB.2636.2690797458.707",
        "ref:MSFT_NetFirewallProfile",
        "CD_58C7114452DEAD938A8EF4255730EF055ED47CABE4C0DD5F512430F5448F1DEF.1189.2635452482.1312",
        "CD_3D48C23EFF67A2389D2D6B76CFDE53ED48EE3978CE73F111DBA847C2A8B63248.2387.4220785067.749",
        "RSOP_PolmkrOpenWithSetting",
        "Windows error message.",
        "I_D60AF79B9589ED18D416653DADBFA1520AD2BE7E2AAEFAD60E13B3048C5B4F73.1195.1701226726.268",
        "I_3A751240BEA2ED6AE7E0CAAA6B75ECB2D9728AED48C387B6EC2F36843C0085E2.2683.3489281204.279",
        "C_5E33BA8BB8301B0D571DB35AB12D7C91B7A0EB2F54B87081058135E8F4EE33DF",
        "C_A53803A976BCA3FFB16063ACA85E663ADBA78B63EC0DAF8A23C68DAD672A3EF9",
        "IL_9024A81B4E32874BE77DA64DE72C239CCC0F6B847F4BBE478AC84D2DCF1B7E82.2699.1942572615.274",
        "C_C6E3EE8EF6D56B8775AB86145B48EEB7F23DE79E3696F196FBB9A7C5293D0CA2",
        "I_AF40BBBDE0B04254A7DB7168AD8BD4619F792348A29FDE87570C9FC2F908731C.290.1157322922.282",
        "C_48A8B413DD01FD4E2902F07984087CB61CF9EEDF75071E3262DDCA296E4FFEDB",
        "CD_2DD5D2C8F7B69285DFBD211B8783B9D8D8AAF5A927EC709DE65B6AC4223EE339.1781.2689695414.443",
        "C_FC8B41EB78B371A9156F12694B821F06ED5FAA1A372B17839CA0FE6258178DAA",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2308.676164546.188",
        "R_E9CB69343A8854DBAB615578BA965E0DD1EA3E708040F0B46434BCE490569C46.1938.772150612.582",
        "CD_71EAB4D274B62BE0548BF7FDDBAA028C0F0BB11297C86BCB4512412235E01F04.12.2032010112.256",
        "IL_6AB7FF86877A69A2199854B3220F74AB68A2E4627C6AF2DAEF65D55543EC0952.2736.530085162.293",
        "C_3F1F5B0124728EBA6D42EABA879A91BEA7E9F4B131CEFE546919F2735EBA71AE",
        "CD_9D4D42EF4D46EC567E6840F10CFA556BDE7CBE6C48D995FDA290957FB3CB6CCF.2422.2216832673.677",
        "CD_7DB1E30FC06BBCD83555FCA1DA86A907938086DE88B466575ED4B935DD61EAE7.2008.118967556.1742",
        " property indicates whether a particular   CIM_Action object is part of a sequence of actions to transition the   current software element to its next state, such as \"Install\" or to  remove the current software element, such as \"Uninstall\".",
        "CR_197AC7D184C8FB7AE4353D80B67A53A62AFB8962E788E6E6756C5B11036C7B44",
        "C_00637C6FCCC93CC75F9D988B459EA167A80BFD4782DA6DB5BC1F63F5A3F73F9B",
        "CD_12C7A5E4BAA4E033E8564BA476003D767025946696E49D1A4603F5AA3B2275BA.123.653262482.389",
        "CD_8A4CE91E2CD3F00CCBC42B48A0F1A77FDADBC577D201010EEF9328E68E880837.1793.3766238527.464",
        "I_0B3ACE4B1539B95DC7096541D9EF45153B9996E5F763DE3A3235C63B9A58EDBF.2728.2013752038.285",
        "CD_521F6F7CA2F4726C35B7C823737370C6ED182E0A59D2942F8C5459B8DDB438A8.125.2998883645.605",
        "CD_E4EBFEE191211D0CB9EEC30A93A853003343DA9E1479B64383841F499755E77A.2663.489891542.390",
        "C_542662E51FDBFBEA6DA0FE85EB364D5F9CA6EF91BBCDB6172E88F1ECB3E9ECA8",
        "C_1A9E3B957294E1E2A3BD1A3F9CA79E41F6CD3130E2786884F3F69878725410E6",
        "IL_A1697C739EB29B9A112166D5680806E521E7FFCBA1D595E9355394F49F125C42.1076.3634103281.187",
        "C_D24E2EBBCB5BF5B1D3AED870FA2B420D231828139B5704014F72023D34FA89F6",
        "C_30030CB54ABE2607519AFE5F5B291553C4CBCA712D0343FC3CCA099002D9033C",
        "IL_1B14156D758E46F2F22649270CADAEC43C61384D4942A6355DA7E6DC097F026A.2685.1971146625.259",
        "CD_C8F7A5859F79B8ED7AD17FC43E28674030C00AA63548BDB0C070C1D925C4A986.1594.374992.422",
        "IL_58385CE20F50E3CF60B5ED0C6A30FCCEC7D96510EE2507D6CDC84407FB8AEAA1.1475.661856827.233",
        "IL_5E604AC13A084AE3258A5FB5ECC21F7B434FF6A3C71A7EE33A73627FB9C64E62.2764.3345697170.282",
        "CD_5EBF5C53D7C8D0D262B25B6FAB388FB8F7A1F2DD89675D93810B1C0121FE11D1.1193.2473458255.622",
        "CD_1D169410B8B805F1ECD27322AB7A731FC553836A8F92AC0D372B6B972CA98337.2098.863020646.495",
        "C_F1E9AAE7800A10F7BC98325C4E972C96F68F306DB3BACCEEFC0D635A11A01226",
        "CD_D6B832D04D0FAB582A050E5212201E6DF3C06194D4D96931CCBF8B3053F5A8AF.1662.1.25340",
        "C_5BCEC8C970B710AE4D6EA0AEE105386763F11854C3DF460A38EF1FFF51743FE0",
        "Thursday",
        "C_5D07EFD0154EDE42BE53FB8CF6E91224DB5D0700E20DD6C51DC04AF1C039C10A",
        "C_F2984F836656306DFA8E2AE41D08C60DF8CD88A0E6AEAAAF9B747A88F60C0C5B",
        "CD_753700D668A51B8B5E7F6080EC2CFCE8CF258A17D33CBA4E34D637C64FD9CCD4.2652.1834186355.553",
        "NS_D4581E17E3199AC79108B8BD03BF787A097AA575A5B733AED04E457900022501",
        "CD_F8A40DE76638BC2D6B465FB946B5587EB32CE4928E4F71A985E7A4A1C7848063.1087.2407184905.297",
        "R_DF61E2E703B95DA06BF609CD133A7633BD48AC00F64BE05F3624D6C217840DA9.1088.530942309.524",
        "CD_80675749A482112913F21FDBD7D7D7162BF42E8F9D4DFDC3F2A040FA1BE63D51.1481.3545281014.3233",
        "I_C20E56EB2E65971ED5C22E174345743E7BD76D73CB6254329CB6F50447638312.2684.309361084.284",
        "April",
        "CR_D900AA79F2E09113EB5CF87ED36150207AAB2E0DBF0F9D43086B26B7638809AF",
        "CD_9360C938996737B01D7C471CB4A9F0436B9152B50CA0648BF04AB0AA48F29C80.2597.284401205.709",
        "CD_5823ECA2C5EBED4CF370CED1912091BDB2C7DD9132934B98D68251C157B2664A.1599.66087518.401",
        "C_777DF9CE1D7A4D5EDA5D1AA51A89D7A89F8ED9170D2417F1F28E7E4AEF3AD464",
        "CD_488B67E05BD8C144F890DD1628D2D632822D5CE3B99BFDA24BA6CC55C387B3C4.137.1938549567.1491",
        "CD_9BA1AB7C3163917E292E29E8907497F4785695E458493ACBBC6CCE3EBFDCC92C.2613.1820648802.399",
        "HNet_ConnectionPortMapping2",
        "C_97BC75F32D55E19412F779268A66FCC6A5BD410C650CA3D0DF71CCC46B370F28",
        "CD_8D17C26DD0763A67C7D4D83EC64CB45890D927901B9A9155ED001A8938DA67C3.2554.1015457195.536",
        "CD_A21DD98AF56DC0A7D21C24764DDA5A5F7A3EA65FE4980FAAB7F2035E4807972C.146.2758611379.747",
        "I_1F2E6BCA4EEBACB6509E1D1DFA1DABFCDA2BD7E41B2B3D970CA09564AC197F68.2718.3912969687.281",
        "IL_496D4CDADE3D597E361CDE904A6093DE54824B4F71E423D5E867AF1A605A455B.2686.4024881698.269",
        "C_2488FEDA0086E3CFE455C054B5411BD75907C4F387D842CC57B9DFCAEBC8AF2B",
        "CD_1B55B55FA6B082DE82471ED3376542A1505C8C97D1118986FF01EC622C5CF23B.142.1133257497.740",
        "C_23CB70BE859B8CF3C76816B34CDEFEC8E45DB2E900442318163C4BA94FA5593E",
        "I_4DCD1ACF6E58BD1330355B0B3B8243F10A72B1F7E1970F7E01C7080A5B69DC53.2736.444402178.283",
        "CD_28032A6B7E6EDCB80B7F1C84A717A5D112C2DB53E7F05B8BCA499ED0AA11C2D2.1540.110156599.2393",
        "C_9F25211DB7D04527A2718EFAB934C1664FA38400093282D5A337A37681C23242",
        "IL_B3CCF51DA7E2E82EF4B967050224C72E8B5296498ACE167E310066C0B48C98F4.1802.3932315074.260",
        "IL_7B1CEA145FD7FDDE85118A874F4CDC2DBDFFEFB5270CF85B4A7E073D01A42C9B.2461.3285604882.291",
        "IL_17E3B25660DF0E83C14987F66FA161A3FC7CA5227F82DA840EE11463022499D8.2691.2883425063.268",
        "C_57449ACD70FEFA4A9244BC6602923E1E3724196FF8E92DE84A20334BA2CBF157",
        "CR_E2929E24A4D3F33074BBFC9EB2E285BE087B76057F553B22FB5CA19B172B3C4A",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1606.690108275.180",
        "595D54DBA8F17137DE78FF091F7255EBA5AB7ED2C6BFD16F66C",
        "QOSWMI_TRACE_CALL Flag",
        "CD_83DE1B746C28092F6432A88AA76D0759ECF002B2851A36CEC64C72AE248F616D.2611.1938616390.388",
        "rasEntryDataSize",
        "C_B94BB4D73091E30C77F18255A03323D4E1B3FFB7D916D65C4D8D1A96D0495E7B",
        "CD_C56C7608FF9CFCC8A840FA69CC790774A3CB4E3B2FDC6233899BCC626F12C6E2.2536.4078095191.5255",
        "45DC2F1B60F7C58CFC2746FD13AA4A9D190175266A50C4EF19AC5AE.2718.3719290733.284",
        "C_2E5C9EFCA8013F27F4977A5542D1BC15FE63F4BC6496BEF9898CE4423F2732FD",
        "R_8BA1D21E61960B29D0AFE87B07C528E316D314C9CDB4E6E4157971C5502F0ED5",
        "I_08658952F2A9B8243A38D0892FAC67F5178667823A2DC6A1BAF3EE69F80C3292.2682.1889598731.289",
        "CR_0954B67BE64513B4D9B9F714CAF4BD4F81866B122780FFA4FF13B48AEC697DF0",
        "IL_38845CC739FF8D351B32E8B9938B0D492105A79D1A88D99796877E995506C5C1.1015.1130069211.351",
        "CD_532671ED26AC2835681FE0B122A526862616ED33CAB2C220F171DB7BD5AD8B02.2059.300284064.448",
        "CD_23723A40115126D6A71E3769E290B77D9B1A77AD1C76D6761CA490DE9745C4D1.293.2840089987.718",
        "An entry on the object's DACL",
        "R_CBA693A36F1779AD102D6A3CF19041B477E5F724C9F6C61DE0522D19C9BCAADE.1053.952065830.524",
        "CD_AB40328BFFE9E2590F7835EBB83DF3665588C8B52A9107EB25D7DD22EAEB79EF.1135.3501268833.383",
        "CD_6C789C13A4D61164E88FEB10C276C4AFC909A00FF2D9876B44EE4E6CCB8A9546.2657.4210735200.681",
        "R_EB6AD886198E6F65EE0C752A5FF5E8A8CEAC439C9AF6E57BB6318A547969C13C",
        "'*-0r36u",
        "IL_0DCED9E1ACE5BCB5BD4659B22A968ACD211DAD28DD1F7F8E29338776357B1C20.1462.4012455625.329",
        "IL_59C0D279AC4D00AA33C5DAB5CDF28150F681AA6C3210CD3E34E5D560A87ADB96.311.1142537083.249",
        "ParentID",
        "C_C1AE8E83DBC2736145A9E1FDDBAB7977992014FACBCB21CA209B94E19685EE62",
        "IL_8387A2597CE908C8ABE53DCE7802689A012D3F66939EB1AD78399DA988F28FF4.2690.2921107562.267",
        "CD_D08FBE660E54A308159ADDC588C79311912D65E76D5871EF0ACC7C841B0E3373.42.2738846391.427",
        "CD_E0E4C1D1D6DC9C06253CC569DB312A50A778443F11175AF9AD65FA40713C0F4E.122.2024101715.531",
        "sint32",
        "CD_7D3C758EE8FB44B72514B3588512147905DB19A0456725381223C5A506626F7A.91.668750105.660",
        "C_234C00C48C3A9C34F82AAA3B652AA3E2A181F3A939430AAEB85DD9A80A3A5915",
        "CD_88CE5A07CD2F69DBBB73BA9DE9D43614B1ABE5A1326A7EBD8D82AB018DF39B74.2616.3549370181.1622",
        "I_B9EE4A50A67D6134A9B62FB7EC1E9B243A0F3C36ECEF51393A3D740A782225E0.293.1582197474.310",
        "CD_6BC8B317F18D27286388A1D8A6DFBBAE21776749F856791E591914AAD69B0BCF.2649.511260604.252",
        "I_F7892AFD6D9BA41C6D80FE1ADB06C631B78639A087981A07715ED269E2F38DAD.2764.3909238880.290",
        "CD_776C7B251A3644C357F700DC6453A035C7DE2B39B88FC78EB15D96AB23A5C2DE.1582.2336742341.887",
        "C_A8DDF63277493FA7727FA87F83A98725771DF4DFD8E57B19F776BF46D63FDE5D",
        "CR_79C2B8878CA0CC7D263478DAA5B22069FB6ABEB9CC6BF0071DCCD3AD247D51A9",
        "CD_E92E47C86489DA48917E83D712F4258EEDF7A9FA5063E409A1EAF630ECC0F6DB.2586.1457925462.203",
        "CD_F60E7BE4D352BCA9A29DCD30B4F9C506C835C329C5B379CF00206B2A6C799F2E.2577.1947094604.424",
        "CD_9AAF3BC6AD36F8829CC6FBD50259D024EA00D998ADB66289BB6A5295426711D6.1088.1523519975.1809",
        "IL_9DEA7549BAB965E89BB6290C902CBDD05ACCB5AFE3A883020FD0E124E00C7CDC.2720.648861910.290",
        "CD_00C6462083FD672A44B8025327FBF19254FE0D419FBB67AA8CABB84936A16323.1937.2560690063.583",
        "IL_0FDDA11AC916ED71F32FEE36D469E077FADCD247C9F70B38F6B7F22F5EFD8737.2700.3092675816.270",
        "CD_B130181D2980461AD5B86C96CD2A0DBB4871D92261D4C26B8D91B344AD4F5F87.2612.2805302426.387",
        "IR_F5C01B67224A8282D3A2AD3E41AF33CCE9A62FB202D88AB9E1355C99C2951A37",
        "I_6AB4C26A768DBAD972023075BD61506660628CCA5970C8992F70EF5AA2F932C9.2462.3575936436.290",
        "C_39AC0100AEED67043710A65F5DEC2D0CE31D07895E6DF01491EEBF7E2088F387",
        "R_0C641AF43E24BC384C9291373FBBEE013FBB02E71DB5BE5F4A078ACA9D6EB46E",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1104.3529881253.180",
        "CD_2247C2B5B87BC8E4D0B8E118FA62B1FF7CB3D0D671442D7A0C23FC83D94B254B.2556.3581099896.569",
        "CD_9D4D42EF4D46EC567E6840F10CFA556BDE7CBE6C48D995FDA290957FB3CB6CCF.2759.2767630608.360",
        "I_DAE88C6BA42241C7878269BBE6B05B24AAA3AEFFEE6E9DC25B51935689FBED87.2715.992261019.284",
        "CD_717B9447F64FF1DDD9BE96845CFF451CD699E26415487F373586ABC0F3E7F533.1059.2327846111.407",
        "I_7BA978978EBF3CD1200A10044AC0BD6F4758993016B7F6B6A538255F2BFBBE7A.1714.1923157742.391",
        "CD_F12BB6A8762B92EA13BD3144715EC52F49D837CF063468EE94A48A0A79B412B0.1331.3765716234.1574",
        "C_CC2460B137D2455D9F0C67827356166977724AD7178162AC44CD4490C453391F",
        "options2",
        "CD_4B0B895503E2FC2B96590F7FC492EFBE7327B376D3B4FEDF8FE7EC36373A4C97.1351.1402722285.298",
        "The name property has been deprecated in favor of the corresponding property contained in the Win32_PageFileUsage and the Win32_PageFileSetting.",
        "C_316028CB4766215C2B0D3643DCC0FC70FE66BE560FA2335CAFFF2477CB4C6F30",
        "CD_25191DCE3358FD8B8C1714272C2D24314EFB64EE716A136F809F4CE188499657.1741.1155191571.530",
        "CR_9B85FF5CF1326F4370A0D245830AD60317CB312C53E60E05480454CFB6E5D2C1",
        "CD_32F111A45E7594771F4B831EC4C51F536473C63323692A7F6C33516AB1164EDA.1949.4252033066.482",
        "C_6564FB1CD2D5988AEDE725ED2C882BA239A76008840A51609EAC2AD369BF9E1E",
        "CR_B18E35596C7AC0C7A9B67022489D5864495B96E12E56FDACDF13C1E2D5D12666",
        "C_49164C7AB89E7FE6DA81BECB881C8C4D65839FBBD034989674E74CAE234E85F7",
        "R_8688B6B3A5AFA46698CC5C2A2A938F01175B6D9F4A0E5E74F0C3AA6D73897983",
        "I_DE17C9D5088F4B642733CF8AEA90F5A7AFA5A9B0892FB2650254AF86F16B343D.2451.991331626.293",
        "I_2DEC27A59F0C8413638E708B32C945A429F0C032F29B94FF62047030FBADD637.2716.273619759.273",
        "CD_B94BB4D73091E30C77F18255A03323D4E1B3FFB7D916D65C4D8D1A96D0495E7B.1528.2969829800.406",
        "I_33FDC4282BB58B439A7D511CDEC9A74D10A9DF009B2C0A85C15B468717622CEC.2684.2162424456.293",
        "C_20B0679F4041BCD18BAFEF5241293E767B7FC4EFCD8AEF294475A29500B652D3",
        "CD_D7E5160C539A0B6F0E4DAC59284A5E27B97E67D93CF88E4C35B4F0FB64E90C36.1095.1.15534",
        "CD_D63BC7563E6D81203297654B46F4C100817863DC21DB2D7C0F010EBB549665E0.1747.203272719.4290",
        "CD_2FB97DB3F42FE038D1BE91362CCA4304CD8AE070FC47AB86F5D6A792AAD957A5.1926.2243861005.1032",
        "I_F873769011EFBA2EB27E7FB7C8F33A5AE3DD8BA891CF4EF1AAD6DD61692F6BFF.2710.1964444288.289",
        "CD_5FC1120B31B4BEF5795347EF4041D413EF6F5EAE539F7093726C935A4F5DAF5A.110.1164754309.1176",
        "CD_38522FF056841CE5D155E4CC0CC353966200DA04021E80EE70B3AC6C9663D8EF.93.3732652140.556",
        "CD_EF51E3569F347717769E97C478C57F24DD4926D555913F5FEE15501F590DCF7D.1926.4196432983.272",
        "SDBUS_DEBUG_PNP",
        "C_F46834254F05C21D05F1FCBE7DDBF6422B6F64465143171291F6775670622C8B",
        "CD_31682C5C22F201C41AC25516223A172B2BE8829C78A0BC224059702D9FA339D4.1059.978425907.214",
        "IL_07279D2FCEE6456AC33C3657A7BEE3196789CF4EC826448DF732B46A6335B0E2.2689.1128467637.271",
        "cu<0K",
        "IL_AD37F4C915F4A35C464D56C640CEE52171476D7BA48275B71B2FFDFD6CA9F8E8.2714.612732418.285",
        "CD_1750EE3B65915B0BBCFBE5A295C25749B68FCB3C6C54CCCEE17321E25B3884CA.125.4205713535.597",
        "IL_3AFE8BE80A89C099DD2D8CA7E54198F81DC7136CD8B0B75B6B94F861EECE943B.2692.4106053706.274",
        "IL_FBF50E9B05799DA2F07A79202B0E7B53E9C07349CE7F1C414483261C33333909.2508.2601338466.269",
        "I_4C10C5441FCE04BC41DDEC512892264D846021BB7D560E4EBF1E528C17B43826.1006.1.31956",
        "CD_69F693B09761D259F9E36F2E07509E240E77C62CCA21F57F463D23C41F558900.316.643335809.3428",
        "CD_59BB151BFB7474042FE846D38FA0CC3A5BA58498F9DD04AAF5BDB993481B126E.1733.3151333082.618",
        "CD_2337B9B06F01E50F06D083E14CD407858889BA1306F3231FBD80D8DA1B8F42E1.1745.3523097209.1075",
        "S\\processr.sys.mui[PROCESSORWMI]",
        "CR_BBA26CEBD94E02C63A4812F98BAF8B828E20477373D54CAFB6CE9D30D952E46C",
        "IL_27A5F55969F399258DABEC66185273B3A79C6F5B28D419172D1B5DBF7E05F091.2703.3713488866.295",
        "CD_9212E0D756DE59946D687462B752A6AF5A16EC3A329D47D13E039D19732A1344.2033.2838613873.240",
        "I_F8A1C839C23CCA02136E0714E97B3DC6363F6B3737B7FE9E624ECEE3246D6C6B.2725.2118047416.284",
        "CD_4DD50BF821F6AB9924CBC702AA24BFCC6D9952BFB0AE1C1E0C61030AB779A8D1.2611.4160918206.411",
        "CD_33C83E24335F11B7A27CFBC9072CAE158BC16D1658846AACE3355B54CBA9989F.2523.4092048586.500",
        "IL_81CCE205BCBF28DB6A27DA778305F4FA002AFF54D936E7A9494AA3D406A360C5.2701.1047663576.288",
        "I_F52FF028F122A3870C04654561C41B03F5A3FFB42D2C77B0DDAB42958CC39674.2489.867074521.186",
        "C_ED34D9141DAAA89570F479B7904D4A54BEE568C398745E94687501AFF6347D73",
        "CD_08A5326D25CFED909AB0A296563DCFC521D59CAF145159CF516E0E2D49E487D7.2600.2154290377.478",
        "I_B1642623BA0E939E58ACB54CEC792BDDE78371F427AAD399BCD5EBEE8CA804F0.2700.3703007584.269",
        "I_AFCDD0BC10CA71EFD3F3FF0CBBCC80863EF81191642B6BE63B2E7FC60BD5D9F0.2695.443980612.275",
        "CD_931EBC392DC240CC5527C3CA3643FE44E050E39FDDD4B5A76F950F248E19E470.1051.2110575803.1702",
        "IL_688D8931EE2A8487D9B5A44690AFE9778BD88A1AEC3CF68732A2A8C47B5E2165.2689.4125960521.277",
        "ShowInPortal",
        "I_38432675AF2E211B94C26E2D3C2F893124B46B984988E2EA9FB022AE375353A0.2720.137845199.282",
        "CD_7BED87BDB52EA7B1358064DBF771E27C411EDD63C82A01FBC7742FD607C32DEE.2532.3754677109.513",
        "I_CFD52251E6729F0DFBE6A95C79C4571B1272F1504D81EBAE918A2B32F32BB41E.2722.2149332554.288",
        "CD_DA8E15B78CFB4F9B2BE10A65957A921FD8C6894DA0C2CF425B855C7658787703.2589.2610684119.226",
        "Registry_HiveDirty",
        "I_AF2EE8E683555398DF627134B08091B08BDE2EF7FE2BD2B79AB2B13385CF2064.2725.609690594.283",
        "VerticalBorder",
        "C_FF89590C844CBA58D43564BFAF3A9C1E0ACA3DFA20CB42FA7E832F2021AD16C0",
        "CD_9D4D42EF4D46EC567E6840F10CFA556BDE7CBE6C48D995FDA290957FB3CB6CCF.2745.2175869538.360",
        "I_0F942249317BEBCCE2E53B2549FC597828D5AA6569444A28BADB2A9391E3E070.2677.143490917.275",
        "CD_C36A2987673B0A8A22D355FDD7569B2BF02F15FD2AFC4839AAC98FA88389A98A.1779.2757737535.269",
        "Association between StorageSubSystem and StoragePool",
        "CD_33C83E24335F11B7A27CFBC9072CAE158BC16D1658846AACE3355B54CBA9989F.2612.1218693502.351",
        "IR_050953C58E97660582926667045FD157390A1B7EE9E1CDFCB3DD57BDA1E5B26D",
        "CD_32BA494AD7426AEBC66A2FD485788F7B931AA8B5D73A66D480AADA613122B7B0.2567.554236993.1174",
        "I_724155B2CA7FBBC304551F8A171392C3CA07A2D9AD12D47C6D2D987EFBFD727B.1163.872217503.187",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1807.1404907667.368",
        "CD_73501BF09C2970508D1FF696B5776EC0C8584B1DB70DECD71711B4417DBDE434.1057.125125950.759",
        "C_A3CDC244A79A815521A8D6C0B832C3F9285789277B7E7D570DD27AC360EEA44B",
        "C_1506642A134522C9F851E5C23634B06B50C7C4FFFF72ECC0271F5A6147784C88",
        "CD_F87E378B75AF3F6BDC043610EC09B06E61B8E3291FCBCED338BE9D76C99D19BC.1598.2502865502.503",
        "CD_BA66F6FB1EA83037593F1D7C182F6E90BF7F08862C9B6D8B2B85562F54962932.1561.333503107.1693",
        "I_4083A194FEE632277CF24422F7DC3664252D8CC5F4D51DEEC6BFEF9D1B6B29B3.2695.1562081930.274",
        "CD_51595DEF0C6434555023E0ADB826EA4506ADBD6A5EA1D2C77F5165F2833FAC33.2540.4012386790.508",
        "CR_484456E3E724C112AF20813C7339BF5577C8FC1EC72751890A0F458FF4330C9D",
        "R_DB6E1ADD60BCFBD74FE22E3F1E6B369F784D5130B2625B864533316DFC13198C.294.2780258659.538",
        "I_3B1F8D14DBF658837F8A27B4FC1CBEF2C9EF4FFDBFBE5223A429267C3BE52B6D.2695.3254118851.263",
        "C_4795063CB131EA9A32CAE29CBF73945A201C424BA6E590063C57DDFF25498546",
        "IL_F18C96C07373BD64C8D30038B7433A922DD71E29E16B629A59A06CFCBBB31241.2684.3831919520.287",
        "CD_E7B9C3E697B3581C857A1735569796C21CBE72762137B6602CE35E217F12B5EC.2577.2312078288.219",
        "CD_125249D4EFFECBE0173319BB999B626A8F1F8DA26493B11A58923199699B3F45.1218.769096679.1761",
        "IL_8DFA6F8BDA2FE04DF7169D42580A4C901605542A1ED260C3FE90F949BA4A5619.2690.3392676957.268",
        "CI_2DC5A6B44F3255647A4F9E3D4F932FDB937FF6A6BFC90FAEFA2788D220375335",
        "C_F3D2C3C803E42F5C002431583B973181E378451C989945D642E593BB0D9101A2",
        "NS_24009E79A8830410BABE69F74A7ABF9756C611C811955A8868586424FB867CF2",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2136.1388182681.368",
        "CD_5DEB181FA3808D9D7D9C352C844B65D0C9A0221A91C57777C58BAB412DD30F67.2004.3035267271.236",
        "C_10DF5666D33CAB7B9847BCB7DE779D4D05ACC6BB9BE7D314C4C1F73F38A78383",
        "R_880F8A6DDAF35DED5DB5957A3D536A3E6F1D34B0BE1907B4DC24ED25832006B8",
        "CD_D7F3D9E12DEEE204449B9CAA8D3A0464D39F0FE9902E503068BD45CB162CC389.2214.1.12124",
        "C_F5E490F396B19933B329A25606C9DB239136B855ECEF4EAC26CCB02B99FB61B0",
        "CD_A09DF16E80CB8250C7E8F768EDC2F0DB283873E2BF1AF5FB3DCD5C1A024C9766.2119.24614279.1014",
        "CD_639A48AE01E60F4C5372BCE94302125223C8DE05464D188B338C60C65E4A5441.1737.337666014.497",
        "CD_A7642BB5BD25E38C8455D7FA5B5711E5CBB864E5CBFEC400B5BACCE7267F35B4.1376.1.43822",
        "CD_77DBF4A2C876542515BB91822C77D6AAB627C74A2589D8CBC4096845BC539307.1635.18204115.585",
        "BoostBitmap",
        "WmiMonitorRawEEdidV1Block",
        "C_37223632162548BF77FB0A39BE56F0914C3079802950CAEA3D1F113F50F15339",
        "CD_FEDCA171A0F0221C9CCCA432160431D72B4C8C69357C96E8F7681B02FBE88410.1915.2491106801.293",
        "C_0359987C58272876B4E70E901F284C82B892B0C1E02B693AD3548D264D28EC8A",
        "CD_6DC34F83B2836B7F4C49DD4CA9153C9A45B781EB43F2F01662DE7C715D9C447A.2421.2619882045.326",
        "I_BAA18A0F308B3C04BE1332D9A501751138A2195D06A6840A073C72573A13B4BC.2698.2192740371.265",
        "1.269",
        "I_0C1FBF427A5E2D280933A244BA462D4597AEFFB299402A972814EB08EEBDEEF0.2704.1137682084.287",
        "CD_CDE4A8C7C0B03EC0C311F78F07CE34C050F510D55C1F5373A349277F064EB193.2103.3657516314.6856",
        "C_6EDB414A272FF229BB33606CCC694211C55817ABAE713A5736D1E4CA0295AB08",
        "CD_416849D23E50D51AF922BCE109C1035E8C25EFABBB264CE6D309BE7E40EF85CD.2451.1389799553.986",
        "CD_70ED15AE36076B03FB84A9185347E7ABB659938D476877C2CE101581262809EB.2612.3130172695.336",
        "CD_FCAC53DC2C47541DAAB9B1F4539C71054470BDF9F6D1F13BCA735A181FCAF971.1070.1416139942.236",
        "IL_8ED0EA60D093A2E63D22BB854FBE45BDB48DF080F96CFFD85EA027BE073C5B0F.2704.2679211722.287",
        "I_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2.295.4095909741.338",
        "C_E8CE06DB509B0590994561E0942576B49C1468E2ADAE12E9135A0B28175DA679",
        "CD_EAF3B59209A6FD8D082F3B655183ECFA165075910E5DEE9A2A2382671ABC6D42.1545.2675260131.666",
        "C_D7A5A6FDE7193A09C153CBD1A0ED6D9E1BE99552FF2A49A452AEED9CDE64FAD5",
        "I_8A409626F61C04968CC249318B0841B44FC037D8139615AD01F11767D7ECEDFF.2723.470324367.279",
        "I_DC929B1288558AAD28038FDD84EC14EA0E5B882F6B557679F005D20EABEACEF2.2701.2981207781.262",
        "CD_3C1F1A447EC4276186A6706A3A49D07A2A316ACD6912E09A63348E2481FAEDAD.2420.2975258434.669",
        "AF2673197544B9922FB153D366359",
        "PT\\hdtX|xl`",
        "SourceStoreFile",
        "$7'*U=I^-",
        "CR_3EA73D2E00ED14D42FAC9F0BEBFB30940E80D92636BD2423331E14FAA19796EF",
        "CD_6FA80CC34C4BD31681946B7211AC65F5C0BC3FAED8972E7F4815E1CC4161ABFC.264.379677214.464",
        "I_5AA0DA1F3D5ACBA8390343C5E77B89B934DCE84E526231BD6CAA528E261305AC.2715.2935446292.285",
        "CD_D03948432DCEFB99FB1EBE3230848319D45009B95943838EC079B34AD2F12F73.2136.645240087.883",
        "CD_486C78842972E048EB3AF4A98B44D84B41374C16F30B7064983012EA8F4D33E4.310.612662584.122",
        "CD_9D6DAF01BF9FEB3EF2C9DA9CCCD42495EF0FF0EB48CFEA8E496981FAD2449D94.1744.2477445674.3959",
        "x25Address",
        "IL_C941A83BAA377FBAFF034894B44F1F5F2A08C06F70B4B461B6EF32C4D137250E.297.783654240.311",
        "CD_4CA056ECD90B64BBABE15360B8C9B299FCBE735F03E37CAC28415171B65F6E4A.2733.2155096607.554",
        "I_7101840CDBD8A2C28A69F557F021EA4C7CCE5B09F94A283D6A3FE07275FBE392.2714.692590169.292",
        "CR_9A376F6E77D1E893429991208782EDA1E1B82E08D8048C53AFF147F9753BF1B3",
        "CD_11A2CA51A1AEA58DC6BA3C29CD192B9F104E6EF336DA23A05EA0E2B4FE23CB4C.1548.3312403257.1675",
        "C_0CFEE70EA76040BBCF59E006C673746B621403E235671233CF5C1C2B3513102A",
        "UmsDisassociate",
        "TraceInfo",
        "CD_4D02D2507121F4F9419B3B4E42345F52E9719162092A87545BBD14771DBD18F7.2110.3043817396.534",
        "C_EA7B174AAF169E6296FA31F66096C0BF7F129196C07418E99F525C3B53222A01",
        "I_EC3B8FD717A738425E0159268883F206D489A3D720198C69718F01AF4B120295.1020.3483875226.298",
        "CD_E8E72C534ABA427E69CE6B883E8FFA9701DE1CDD9E04D7D1815F4420292F16DC.294.1757658393.810",
        "C_D441AD3F69852AA912E7DB88FCCCC4374628FEB4888BBCF4D0B24CAE723208E2",
        "CD_918165F99F828C6B53BA10EEE3979256F3A73E636E22656D27D129A14FA67468.2750.880432436.343",
        "ent will be the same. Invoking the RequestStateChange method multiple times could r",
        "CD_A4B7E1219FA76BD23A588641B4F3CEC1D9A3585F7F85B74432295927C547BE69.72.3485476764.4012",
        "CD_89763DA48A17F7EBC9034F6876B7F745366D3C9AA4A9DE3C3C0001E38241AE71.1337.4271914109.2541",
        "CD_249E58828B05B219C8BA8313BA785229871D4134A57BDB6BE040EADBBFCCD561.2283.2078835328.825",
        "Win32_VolumeQuota",
        "C_9212E0D756DE59946D687462B752A6AF5A16EC3A329D47D13E039D19732A1344",
        "`WZN<",
        "CD_2365A721345A40AF88F4EB253BCBBADA79A55446181A3DBD55DBB6ACAD9C7FD4.2571.3324748444.483",
        "CD_FC7FFCA0C7A5D89DD371B2F0B241E87A604E23DE48746B1BF4F9C2034FE72A72.2224.2992038920.345",
        "CD_703C562B7404A6234AAFEB9B3BB242E3FF62C76339F84C997DCEF89443C2DF65.1650.1756201996.430",
        "79104DAE8BCF03213836A9B50A7DFDB15",
        "IL_E63DD74F2791290A47E417C87AF578CC7BD50CD128E683B2F5880586934D2DF2.2676.1391065030.277",
        "C_F93FF2A96C50D14227C3B5A46C71238AD8A9CB5A39DA885445A37353F42C6EE7",
        "IL_0822E33CB82EA9D1AFCF3AD6B8F5AE0C5DCFEEDE9F0834D5028320803F824B9C.2679.4067240306.275",
        "I_5A594905C8F81E999D9B9057D3667626B70DB4CAA9232253B2044B135DF40086.786.1.31819",
        "CD_BDE5107C5341475AE649B7075E5FB1B219CF6D2FF755D735AA60A09AE0ED6BD6.185.1246011638.854",
        "ProtectionManagement",
        "C_883826ABD14D23FF1A9047BE3D0351B0DE42808C003FF03170B08842AAABBB6D",
        "A Win32_FolderRedirectionHealth object that represents the health of the user's redirected AppData\\Roaming folder.",
        "CD_70B5C3F445D36D84AF1F9F0E062B6A21EF707E1616BEC072F41A3F1113BAD785.2457.4077745899.522",
        "CD_F942F52D9B767F4E0AC3367636949CF0E5E8CC570A3A6EB594B1DD3DD8DE68E0.1634.2382735172.871",
        "914805DF0A8E68C5D86.2698.1647053630.269",
        "C_BE08AD186AFCF3A3FD391638F6ACA602500A13B82D80FEEA8F3E35668C9545E9",
        "IL_72E5F0C9F48847EEEA80E82BD31EA5BC305F1CAE8D63359057BA1052627E5C1B.2726.1399690332.279",
        "IL_E717376E0197231BE2AD92A323433AF4DD3F15484BA36CB4FA93BE2B61936B08.2694.1393669518.269",
        "IL_BBA9D96E0F38BFCB6795F87F429E3FCAE741B083CE80ED2ED851A1D82E5F3717.313.1586896896.295",
        "CD_94167BF91BE19E1C62EEDAB062E1BD60608CAB59EBE8824D966E9FC0913F7356.2011.913133417.356",
        "CD_FD4F4D3C59F149D4ECD4F84E3818809F406BCF7E122C03BCFA93C04C2B2F4607.2097.1178191866.5590",
        "CD_BD2E1382E86FE7DC3FDD841FB021E9B63AE65FF929B53BB8499204A9A85529D9.1930.3895367858.1048",
        "FAT32",
        "C_5D3D82E165425301EA97694D98E5FD2162C162CBCCEECEC5C4215C7B648589FC",
        "C_0321441591402F5AF02BB91D74BEE22B0CD8DD0874929978DA89FBE91F7CA9DF",
        "C_A026C2EC35B3A4AF24593EC09BC3F9A24F374F1087E00B13F499CB6268CBD64E",
        "1F4B85EDB080E99048AE5D7AF273DAB14F22AC9AE7C0.2712.4008156233.296",
        "CD_454F94D401CBC66FBA3CF01A7FEBB7AD985BD8046C5115863EFA27C37A7F626A.2670.4073733467.381",
        "CD_4DF972D0AE0EDCDFD3BB253394B1DE692787B6CBFCFAD61D9568CE731F4B1BA4.114.2057930221.202",
        "C_CF2FBF293DD7221E4D59FC656C884E2F1D90ACD7290D16379DD028C135AFE7FC",
        "IL_4DDD1B2F52671B9809054476CBF492325A0EE02E3E73A2798DAC9BAFCAD7212C.2674.1797238991.276",
        "C_9A2FA4B503D51BA72E7F874AA07B2D2639867C129B89B4AF2230D146C0DBAD9A",
        "CD_8ED07F8AE1220DCA0AA67C713F95FF5F2613D1EF04C9C11037C57B91CCCB3B53.180.1975582154.773",
        "C_4C642D2B89C402F98BEF8001509F1DE3617255E018BCFA335461429EC035DEF2",
        "Do Not Continue",
        "D0@4l<x",
        "43,7D",
        "C_684131B90FCFA4E2B8AEC19D8AF6C3AAE1B3CB476764A35745FC299F2105E41E",
        "Monday",
        "C_38529E11DBEE922C6B8651639B26646929646902C4820BE48AAF7AFED4E23F03",
        "IL_7D726A53C2E109A7102AA0733AF15E0ABEDDFCEA169FD750AACBD377D8D29F56.1476.2555114093.305",
        "I_662CB144681343CD914A84B6324D30356940F0E892AC14E72E79452BFD8511B8.675.1.129842",
        "CD_EF449CE69828797E16ABEAB272BB63851199331E1B3809DFFF02FC6CB2F0B417.2047.1.10248",
        "IL_491BBAE1E8A19D67FBD48872DBABBE98D057B96DDDA33D840338CFB5CDF418B5.2677.1554458431.282",
        "CD_4E05A85C7C9DB6824A0AEFA83C9B26B28AFA6D8D088521A8F0444E981BA3B980.2745.2891171172.292",
        "R_124B2D8A86058DD102C833379996E9AF4D90CC4B792958ACD8E55DB72860976E",
        "I_0AB5FE8B82025AB1311A722ADBCABA39548BD06B6E3EE3FDC272C88EEDCF65DC.1053.2060809386.304",
        "CD_CC8D8F676137BCD5D5531414C0F461E5894D404FA15D384607EF32C9D2D87E32.1.88698497.237",
        "CD_6F5E24AC748A29DF918F7CE4EA2B3D8D867FC6A446F47DAA736D335E6FD33CDD.312.416147182.211",
        "I_BED999C9BF7E84BAB50F0A32D016E7D1CAEC2193DF18DA06E4E9B9F14F58F2B8.1752.4202770994.340",
        "IL_F873769011EFBA2EB27E7FB7C8F33A5AE3DD8BA891CF4EF1AAD6DD61692F6BFF.2710.1964444288.289",
        "CD_3196586F94E9CFEA6D912774CB2A6C6FDB2471424853F54D4C0F4EE4F94880DF.1362.1.22595",
        "CD_C28A33C3EE15539FED60F709568673A3B8236EB3328C61F785107F8EA0BD78C2.104.344745074.2705",
        "C_F8950447585CD6743131FC688F3AC5EE4D2DE57B4CA01C83E91AB8FD7ED70E93",
        "CD_4BEF3BA1297A2B3BF1D8FE4388786F7AA6C98624D3E280A958E01D4D621BABF0.2528.2989751438.656",
        "TRACE_LEVEL_ERROR",
        "C_30C53A78E5A4B68CCA584E17EF756F46F9A296CE6092725A408D68B59BB13207",
        "IR_A905E989052353FA9D8F60E873BC56BF35837561C775D74EDFE4D77EF4FED58C",
        "I_27FAEA5F317A7D777DA2A8EBCBC3C42776D2CE02DCD68C27018D6EFB15E2A7CD.2485.3040547790.263",
        "CD_9D4D42EF4D46EC567E6840F10CFA556BDE7CBE6C48D995FDA290957FB3CB6CCF.2424.2183282587.360",
        "object:AcpiGenAddr",
        "CD_361D98FB17C2BCDC621D6A7CFCE49AF430F4AC02365C7EBFB53223536307BD5A.158.1217671844.828",
        "CR_5FB7B77EA5E2C3BFCAE4E2AEE1C523572B9C00CB53A36167EDA3CA812EECDDE0",
        "CI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109",
        "CD_4BD0F8A6C8D9EC0678D50228DC3CB44B9F26CFF9B291F8B882B0AD7C252B23A9.293.2240452953.219",
        "CD_E607285A4ED90FCDEBE9F9ABDFA83D91A50ECBC0733B05602257ABFD57D58CA8.2633.890926088.1131",
        "C5582C0BA2DCD78FD96FE0C14267800808A",
        "IL_9152F0887551FEEA5C649C88B4272A238FA101CC1F6E131824694DCFCE0EAA8F.2688.2972253913.274",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2469.3679196830.180",
        "C_EE8C4640FD60905905B00B1CDD578E162950539A8911836499849B2BDE6B0C53",
        "CD_147F0D132856028790BD82BB481BC269758A25AA87CD8C1E0071C39359DE0C51.1104.3184148248.1775",
        "IL_0194D7E956D38B1C947B3250090E0D48410CD052B7BC03F2F1F43DC398A99DC9.276.1010561573.332",
        "CD_0887FC386FA8BA2C2DB0458AF0A1764BEC13D490407167F361F1F0B4090E71B4.121.1418340952.518",
        "IL_C2E2D7F294A39E950FCB0FE91EB41D6C66630273B2EF4990C97F60DB582F2E17.1480.3999132597.278",
        "CD_D9B62293E0CF7F70397FCDCA72F7D1BB2ED8B6BE7CED434B3198B6A43C6930B1.2611.1214503589.1597",
        "CD_0F7A430DEF253394F97964E584980B0C9B20898A34602A4FF7CD0E3D7511EDB6.2614.3235184402.391",
        "CD_0C641AF43E24BC384C9291373FBBEE013FBB02E71DB5BE5F4A078ACA9D6EB46E.144.2077117651.986",
        "IL_996350F32E01C57879AA95FD767F8BCD28BE9CA42F3C2027743354B5CB423C14.2690.2334399331.269",
        "R_8F21C89CAF771FFCC47E28C59A7D76DBF0F63931FC16518B322428129F505FDF",
        "6.992",
        "\"&*.26:>BFJNRVZ^bglptx|",
        "C_C2F98821FCB494ECEFFA5BF85ADD681DD9F374F97F468AE953F8115CC121DA2C",
        "CD_4A9BADBF619D7C360E2E222A1D05EF4C32E9769C9232CA2631F4E74AC78597AC.2421.30707675.679",
        "I_6541BEAED14E5D95B2BB24A4DAC4BD609859B43562532D2B590414032062584F.2713.1978167914.299",
        "I_A8A118A61D6E0F00428AD40772289034BE1DDD6223ED962285264493D8B7C6F3.2720.33354805.284",
        "IL_AE268A6877A99B443D27C599959944691C8E186CFF0A257B12F5EB4755E911AC.1014.1951867759.305",
        "IL_51010F092CD100BF450F7C43D4F6F3EE7655FAC447254142FDCAF5FBF9A72443.2705.2123693397.289",
        "IL_F5E021D5620DF76DB11A714354730BFDB3845D5ACC1D57EAF3889D51C85AA6FB.1498.3566981496.257",
        "C_5BCD9A67EE590078151A9450C722B28508AB766468EA531EBD2FB50F343D4760",
        "CD_FF70EA848D8A2CED13D60639BCB9255AF55EB37BFFEA39ABBA5DBDB0C764B466.2626.1069376818.1498",
        "CD_ED1FC035EB371A90C41246D116BA4A660CBEBB27C216B9B1947EA219BC5F06E7.1349.1807525757.462",
        "C_7ADB3A758B71404FF95472D98780622B0177ABFE993DE8C448448F3816B71A61",
        "C_098B523DA132211D101F3D49A0D984806B2D95BFF2B2CB9EDE28A96AF5AFC31D",
        "A persistent binding request included an undefined or otherwise in accessible Logical Unit Unique Identifier",
        "CD_73447B89194EA500995C2E5AA4E3BE7AE297170CB5846782DDA43B3F2BA77D09.1876.489604729.221",
        "I_E89A7FFCC0B0A06779EA36F241515EEDC0397EE054953EB7D572C69DEFE87E2F.1333.2008981884.322",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1075.2949736959.180",
        "CD_B5A3125475EC1999F845D9B1427844DB11B8F89FA6DCA7DE9440334DF7CE477E.2041.579572786.488",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.1745.3288393706.442",
        "R_4B5A98799E9F89299CF2B3F25F26C1BCCD944C8F4FF1171DA43EA42211F0976D",
        "IL_2FEB110D9B2D8B964448231D62D228EB77833D966ACDE6C751FBBBE880E8D6B9.1520.1495436781.329",
        "CD_9C46A759D30423AAF4F69D77D418152E94C7E20506D0B665994363777B2CCBC6.2283.4000903665.1705",
        "I_935992100C96CCE9E7F8C32707E97F3DCBAE769FC0944CF97DEFDE6E4DCA1792.2702.445089956.285",
        "Initiative Wrapper",
        "DC5.2587.1958331533.1359",
        "CD_B8353D57A57BDAADE8E1FD8BF3D42DAAD04CAB50536C3870BE8C32D1CA4CBD9D.1611.3632779034.3014",
        "C_286D3AAA59AE00C2CF7EBCC4AB344CD2AFDCE3C2B408154E04E7644656DAE408",
        "IL_D7F1F8A0A56E12A0989E6F9E8115DAD44BAE34B35F7764E69359514270CCC439.2702.4275443495.279",
        "C_0D519108D85D82BAB33681414520F8FCB8ADE86295F011C324EC49523D7AD353",
        "CD_05FC8C25744A61FCE1B7262C6904EED1191403B85176B40933E4DB3BDE9A1EAF.2652.3686864196.254",
        "CR_4D409582B9E7F83CB63AE537576DCB0EE80F099F2DB087CD2C4B26E6A30448E2",
        "C_92C92331781DF35B14382C2C18FCF4F9CE2A3F0D9A27B8F847108A01941602A7",
        "R_68F60BCE5ED1CEFD06D072F2C79847AF4A3C52BA9A8E9F51041AA990EA82C70E",
        "I_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258.1164.378460097.247",
        "CD_AD421F11CEFDE45C82C30BA4C4CE4B25170DC00E4DA588502ABA946455B19C47.1923.1073769736.305",
        "CD_5CBA40F57DD1C39C5446D4C1AED98236A1F94F251B54CA16ABB677B02EE7B56B.1489.3031434071.2034",
        "CD_3A7BE4B3F6EFC36E6A675BAC27AF47DFE5A6066A6F0570FCEAED80BDAC023D04.1596.1424882817.498",
        "C_9360A998406CA5A9FBE21BE25205239B5C71A89280B329F4858B0132F126E6A5",
        "CD_5FC1120B31B4BEF5795347EF4041D413EF6F5EAE539F7093726C935A4F5DAF5A.17.3362556714.584",
        "C_23A50366135FBF364F350BC34F639BE141A61D21A478BB4C1230D838F1296A4E",
        "R_C503EAB1BFC7A8B559E7B2B0B8F0BD0848369C732C0B709C34F13819BA9916BA.2505.220159996.536",
        "C_05C8462B4A570021DD79117F0A18597CFCABA57FA3361AE21ECBD780B8BC0A9B",
        "C_A70AED88FABBE3115886EEFD655DA2D884AE8E474FEA14C9253CABCA6FD98254",
        "CD_25FE04D9255CB27C85849C6AF1510F628FE6A726CD3A80FEA1131E58085890F1.1745.77408890.1165",
        "R_016B72D1247F074A851C27539072ADF3DBC46A26D22B2C6C7D2EFEEDA848626B.1758.2833828936.562",
        "CD_F855A6D4334AEF984264ECC01FA41D9E9BBC66D0101436CE6BC0A37CF0955C3F.1522.563017658.4192",
        "TPD\\<tx",
        "C_B7DE90614B809707C62F39E568E71EA3DEDE3DFB6D354F3F89A2373F1EC83BE6",
        "R_BC8304297DAEA08EF836B71DA253942E5C6B510805DB5280CDD11086EF113EFB",
        "CD_5F5583215800877E78DF32C89A95963A09372E548E11061C174A3C01BAB56758.1738.1.8469",
        "C_38029140A10BF50588671D614C4E488C9AA41F396EFCAE54B7230B5F12B327C5",
        "CD_F715F257680073980D57BDC6098766291B8759BE6F3A397C65FC91A1518FCADC.2548.1838334260.1453",
        "I_808149E7750A151FD7D49B0C0AFB094E68745E543DF52A3CC5BBCC1AB8B6D1E7.2686.3772337448.283",
        "C_3B2DEB628DABE7D4AFE58BCCA12E2FE850BD8110A3238C161DF85D5C51FAC297",
        "CR_0A4592DF371B0F1C9E35DCF899DDC0B30F2B23CFF106F5805254E0E64E1E04F4",
        "C_D3CDA97FEF298BE8B5C29382D62A09C47E793CC57029F401B975F6F8DA62C223",
        "C_112D5871031FA8548B77FA449AA39B2BB51A4848F5CC93A4CF0AC90CF6249BE0",
        "CD_3AA9C8A0942F537FDAE95E548CCBAD1AD1FFA8F4AD1AFE2EE57031F74E67B391.1639.1.33271",
        "CD_92199A685A3DA52107061077D21DA958767972E7F390E19110D42D30C4F214E8.2556.1438443655.444",
        "CD_0AA4B25606ACE1B27A769310C3690CE6F8881D4D211004373368B13CED6A08FA.1758.2891681285.712",
        "ms_409",
        "IL_74D6957A2807BE355D99943728005C3B31EAB1ABEF112E8AA77ED527A633CE24.2681.2354543613.284",
        "CD_94F2726A101D2A1E24F4ECAA94319E60322E839528620ABF5ACEF14DF1CEC5F0.2759.1282228759.358",
        "I_C7241074A1DC4067965AA287DA4D86D47DFCC8023807757F575559735BC60E98.2725.3404076049.272",
        "CD_E6FA42319C7B1B6AA3CE56D2345400C98AA73905B257B46F3B0DAFEC4D0960DE.2541.4144767105.528",
        "IL_AF1EC31F9D52CED588A2CF637F321B04B95D0B076BF99F2FD31094917A943784.2681.251723435.275",
        "C_DEA8D123D2837564BA4B047464487F2B0A38E0732ED982DAB6FC5F0842A72630",
        "C_A136C649DDD401EABFD58B82CC5F52539BBAB4842ED5CA9AA74B8557B4E57EA2",
        "CD_81C106E09E02CD8E9F92751CDD19E5532DF222FFFFF38E1A22F4010E1CF8B4EB.292.769091106.5752",
        "C_F9AF1E0E64A5F88E91652C8C44C8A5E0B35B46F211646049A589ADDFD182AD4B",
        "I_D57F9CC3E89B837A3170B00A7A884464F6A0DDFDCFA2FB9E33A509D63F7AF826.2716.3539551663.284",
        "Transition latency",
        "CD_E7ACEB5389BA8C32B04736209B872B130DCE3B94FF3A17F3972AEE3EFE29C3CE.2749.1323521898.324",
        "I_095213B9C0D61229559381AB15B808F9B97CDDAAEAE8B87714A71305321F2FCD.2736.1642815611.287",
        "CD_3D40309243C3189A20FC387CB4CDBF6FB94680381677F00E2028F7CDF8AF65AE.2540.3458618898.506",
        "CD_39AC0100AEED67043710A65F5DEC2D0CE31D07895E6DF01491EEBF7E2088F387.1836.1940454305.320",
        "C_A4F5A56059DDF119F4CC303056A7BB3F243745A5AAA1FF57F146D0A87968F7FD",
        "C_6A421289EBE2DF884AB995C52B4329037FEA70E4E000530BA3A801B38989E59F",
        "C_5716C70CEABD7700D5C5EB7506E45B47E45DC14D92F979C8251DF16C83BF2C0F",
        "CD_ED8B429C0C6338550E0A0839881523DDE7B3F918D56816FE1DA9ACD95BEB7295.1069.2520320040.670",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1489.2481664846.180",
        "C_1E7637AE86BE9B7FCC266B24B2671ECCB9515C8B3A1845306C8B4FE9C0197220",
        "CR_211E06180BCB1B723514A6B61A4F9437E8B7FAF07E83A8E52C3887B5E0B0CDFC",
        "CI_E706FF8586C52A7176ACA48D7702EC2A6550564F0E42B0C09AE3FD1CCEA62CD4",
        "R_E4B290C7DB99D07B92F8395AE965198D75D28DF1017CFFDB292F69630D8B4E4B.1195.145565174.524",
        "I_F80CB1528F4B30CEB103FDF154D34B5F1984F7E262A0C0A37A44CF3DA43BC6D3.2680.3667181496.285",
        "CD_D4A97CD760E9DC657E08D29140B18BCC6B8D0D59DB6745F4739A4443DFD0F72F.2114.3307676268.509",
        "C_94CE192263A7A4C6C6C5782922D4EB1B11F6B3BEC377FF526822F8431D0FB993",
        "I_B512D79AFDBDE08901CBD277D2ED31DC4E8212334341476DC8267398518DC4E6.2703.3738088826.285",
        "CD_50194DCCAD6A37F18540D305E4429A178C41F0B3B734D411104A6EE95713559B.2654.1954975924.343",
        "I_09C45AB8C781309B93C73C5BE3D195880FF32FC6BC84DA7866B56DBA470D7032.2689.1731236705.277",
        "CD_E4FC7CCBE036059F139218E837508435F1EEA217B72843BBC84B1DD56DF78DB9.1135.1733268215.314",
        "Adapter busy or reserved, retry may be effective",
        "IL_9A1B596721539D9615A6900B0F6364E9823374D126BDDBDF36FABAC428F02B9B.560.1.66330",
        "I_715A8576DE8CF6D78CE0AE7D8041141A05B4A1E1DF7BF401DDFF5E4E706ADB4B.2675.2911843842.275",
        "I_4541EF6DA75086109217AB42690AE9604EFAE942DA3C6C14A41ACDA0B39E4BC2.2696.4155169305.269",
        "IL_66FD63E07CDA0847196FA78021C366E969CEEEADE5775B379E698302297BE344.2685.3939417003.271",
        "R_3EC633BF060A39C201FB3365682E90372DE72DDF28B24BE016E2C6A6195F1EFB",
        "IL_A313F7C19EA7804AB752D70F4DBA974D94B583B64D2531ACBE701244463E736D.2680.2266213277.284",
        "IL_B34D01FAE8E857E6D601CC1CA05B14330947EDCE328035ED2CD1266239D0FA45.2678.2663095456.286",
        "C_6BE2C209EB4B57270A7D84E582DD2AE1DD184D26B11A84A10BF69A2E4B28421F",
        "IL_FA358256CFC1417A3F83D2A8D16731070A567599CF742519595BE9AD65D0A198.2697.591705588.266",
        "IL_F6D0732D84B4487CB2B86FBC272209B06C6AB389367C037D292654234B7C0CB0.2714.4085526807.274",
        "C_BDB1FB83B60E9BD18231450213923BBA0EC1BFB3618EC2AD0ABF9ED38791F05A",
        "Xl|p(\\<TxDH`",
        "C_DDFBE2B8C9C0EB71960ADB33E49F91EDA6D2896A8A0783F02D140DCEC2F9FEC6",
        "CD_9E178FA2A34645B8FAC228D88E7D08922CA628703FFC498A6C1FBFD97A3CB433.1248.3302948071.605",
        "IL_4541EF6DA75086109217AB42690AE9604EFAE942DA3C6C14A41ACDA0B39E4BC2.2696.3214635058.269",
        "CD_224B5CC2DC8F3AC1441E2D19046B5D0473DC87327FB7FEADFB35C0CF4DD98702.2625.2897893762.557",
        "C_E11F69BEF07331FBCA401012B573BF0C27782CC80A65353DC598333FB7469F8E",
        "__CIMOMIdentification",
        "CD_D06AFFAC2BC7D4CDADAE168F13A58C11549C401D0988835D77BC4E04A248490D.1565.1845746864.630",
        "ref:MSFT_FileShare",
        "I_BCE3F39440A90A37033DB80DD4DDFC3A46F39D1DD801FB0A0EC812E07BE4A62B.2726.3123698903.285",
        "R_EF8B6B11AAC8EE9F72EAE7D9FAA5CC060F54795479E21B3561AA671E2CEF2B71.1737.2433435032.594",
        "IL_8E007FFE8990861E3AFCCC532252BD06D6D994443EDEC1808297FFAD7302B5D2.1016.2889022391.351",
        "I_E782A16A4E3EA11DAA1962A5D87D0BC523A0F5E92E4E28B1B5192366DE483393.2700.2743456004.288",
        "CD_297F9CD2C4D90784A706075815B3C6FEB973BBF31843338D7FDBBB5184B8AA72.2611.1654407799.232",
        "I_0127A7661BBBCD4388742549D522C2574BE39C7911E6AAABA36EFEEDB5CEC716.2706.1328598686.291",
        "CD_F01107CB054F8A386963F327634C557818A4B4AC71917F4F3A17F67A816EEA4B.1545.1023871706.413",
        "CD_CE7D63CC7C1BAB7611CA21A73577CE89CE851959DA14BBE073B0286801C57456.2671.2277147292.708",
        "CD_DE762D4F54CA8D4A72A933CCB954C233CBA0EFE5ACE7AC56E99804B37A313953.2664.4078340066.526",
        "IL_8958A856065A7A56EF90AD2CC58B8059F887AA0E946AAC92A0F66322FE07C030.1016.3176728252.324",
        "KI_355DB6CE31803BDDBDD2FF491BD2AAE24F28E7ADF16402B3F3B9C4CF695702EB",
        "C_0954B67BE64513B4D9B9F714CAF4BD4F81866B122780FFA4FF13B48AEC697DF0",
        "CD_A6D4B9C5076527980D321B1B5728BFA29A63E8F1E9F53D658A14196F5D25EBAD.1779.18942431.273",
        "CD_9C249B506244FB7EBFF9753C728C15CC6F408B144591C0ACA30DB0C62A64551F.1583.4257925954.80",
        "R_98EA0A670D6389997E9783969F4DEC84E9FC2CA3BC30C21C3E4EDAC886CFE30D.1478.2835079812.536",
        "CD_9F3571C46BDFE273D99A799A2A4BCF3BFE2F06FC194D43AB6E29A0547376022B.2600.1803669081.1021",
        "IL_A04502EE4601BD859A13FEFB614206FF59E7276D74025F90A456579AC0628EBD.2503.2662653416.321",
        "C_41CA8C613150E784C004C908CB24132353B7EC2401C8DD6755B2ABBEB98C39B0",
        "CD_135FEFCCBE59BF421E79A3B9F572052648A0ED4C004AD4F8F01A7059366646C2.1757.3016616847.190",
        "IL_20A2FCD02AFF243CF774088A45E089FBE5A849A9F82F70950D8BFE6D4323904A.1020.1571433115.326",
        "IL_474E613746AE2D2AD109651C07E7C49F4D69DCE82C4FD9E0A81215457FF1DCAE.2726.3771037851.275",
        "I_0818CC83DEB978B7B8752F2310EEAABC322DC2BDA1B9720BFC816D57CF461D84.2706.812545990.285",
        "CD_A3509A56BD6D0B19F296AC815EC184C9B671F9E47F6007C2EF3F6FC0EC7B2076.2655.1762361659.396",
        "C_410A129DDF9C5559586E57FD96A9E962121A44EE9BB4B632CAC4A1E45DD8F6B4",
        "CD_1D8AF94E43CAA7DC78EEB167F2FCA41288361566745343E55E2730385A1CC51D.2744.1067942139.370",
        "CD_883826ABD14D23FF1A9047BE3D0351B0DE42808C003FF03170B08842AAABBB6D.1836.1629696486.332",
        "I_E53C33064BBA1FBF2DC083917D92C13CB06D607EF634390B88B3FCA354ED30E3.2713.942242480.280",
        "CD_20FFE90491DD6EB0496111131EA1C7328480BC1065468AD9C6801937D3CF87A4.2427.3841791666.648",
        "CD_35B1B65B914DF07FAC7860C3407AEAACB382311D5C7C7979B2E9A007C56D4FA3.130.398292659.885",
        "CD_9419B1A0DB6A484AFA6622F1DBD50C832E33E81DC79AB571DC2722548BDB7332.2631.2195480912.384",
        "IL_33D2D0FAA61EA917D75180BEBF7BA2086B1F142C34CC9F16504D75FB6B1E5F10.2727.1935833115.291",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.61.788629240.218",
        "CD_8ADA84493988CB13166A203AA8DF1C3ED4B8B45C03D981328C27F806EBB92047.1014.302429328.541",
        "CD_0792906C6B2175266FA3DA3DC7DC45CE70FB2A8D4E5BEDDBD9A0CF39498E3F6F.1584.2161776436.545",
        "CD_9978C56E212E6F386849955B323679D38EE89596C89F4734B0D545F76D348E8C.2640.1146882569.390",
        "CD_698A32B2EFB9AF12EFCD0A0FC46109785288AB2107A556F691113D8AB3DB5783.142.3444688440.722",
        "CR_1D8AF94E43CAA7DC78EEB167F2FCA41288361566745343E55E2730385A1CC51D",
        "C_DF05054754D9D5B0E7C9F400839266F3883F1311019EC13700475306FA54A6B9",
        "I_77AA21E117B27175491ED8F5119E7B5E6B5FBBA733549F12E2357A163363B480.2718.231678321.279",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.2673813501.368",
        "CD_5967C66DE43EAAFFC361A239E261C584AE151D5B580641425F8CB979F59DD32F.2655.3697933143.758",
        "C_5997589696FB2E4597FC4CE1E1612FCF4F0EAE5655998B39A34DFA12CA0BE14A",
        "R_8AD8BB59AD76539933CA61E487AC9890B90072B3A3E2702B40F21CB1F591E761",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2167.1045814340.188",
        "IL_E4D6DCBC40AB91F779A7879BF4FB500EBD6FCA6C65C56B4262A5C24C24D31070.2703.4183864785.288",
        "ROOT\\microsoft\\protectionManagement",
        "C_C812FBBA98D80A521E33E1EA4E536C9F826C77210B7D8EBBBF12D800100FF013",
        "28.283",
        "IL_DAD1BEDE7CEC3A43073D4032C979D6662CB637D3A763340900C2CD81E039219C.2716.646596338.289",
        "I_E490D798737ABCDB6E5D228B467E1AF69440A4031B6956BCA530D036FE6913FD.2697.1612407047.266",
        "I_F082FF5D72F0BB8F007FB38BF6D4C8F99CB6767F9E3431A5F144F3CB796D7427.2710.898369090.286",
        "CD_23FA83E3222C7EFE1031ABE23D791DA7F1E9CA7E34FD0BC9CB4C05EDD16CEA7C.1937.1270763979.1265",
        "C_F4127176F1A46570141C18E1E1865CF6B68B9CF63BEEBB46409414612F2C6395",
        "CD_FE0D80286DB95CCA86096C1B5936668BBB002E04CA87DADDE64E7FE7658CBF0A.1923.1445028259.319",
        "C_DF597A1A2BAD4809466E7A636A80CAB8A01D7F4907CEA5AC6B1078FB23BB559B",
        "CD_2DCBBFE173C5C78D37B1B0F8D0233E2C025177C64405C72A9D90467BA13EAFC5.2627.1967712035.575",
        ".mui[MofResourceName]",
        "46000",
        "C_ED6C3A2F6CC04DF3DD2F991B72C978A94559E5D3850ACCDF521D9DB88CF8E809",
        "CI_BBCB50A3E35BB9672B8B458A16DD242DDDDEA6BED48E25ABA8EEF2B0E49A9B3E",
        "IL_5AA0DA1F3D5ACBA8390343C5E77B89B934DCE84E526231BD6CAA528E261305AC.2715.2935446292.285",
        "GatewayUseCachedCreds",
        "C_88AFB8925BED57D785F853EA39F60A2597B7DD047C4BBEFEFD01EFF42AC83C8A",
        "CR_9212E0D756DE59946D687462B752A6AF5A16EC3A329D47D13E039D19732A1344",
        "CD_FBC71D3D1DD9772ECC7466D75E7CA5C00F778C7F0EA2DC410B71690DEDB23FFB.1596.3093081225.833",
        "CD_44199FEB2EA5AA114C34FEFCE15EC340288F3AE7F2F9B159DAE8176076473712.1998.4063895195.743",
        "CD_D720DF0F82C4481621F1A25D4C9D49761B2F3F169F534AD1E42A08FF995B85FD.1565.700184227.951",
        "C_7A72389BB1759518065C4AF4001515EC91E03811075FE8C84FE22087E293F0F4",
        "CD_A67F6CA5AD0F3F082B7328E37F2535113EC93F9273483374AD4B41FB5A9EBA2D.2459.3161263480.5820",
        "Level",
        "BitOffset",
        "CD_25D6DE4F10F10C9622833D068798F50E89401E52F3D552BA53470C9A0F55267B.109.2839752053.1088",
        "CD_E38169EAE55316E8907E9126E02D64E6E2282AB67113E662A217703A29FB0416.2664.2695329474.1994",
        "C_7A2306288BB25A962F3F7A0DA1538731F7904679B3CCE7E9A9A9F2638A6325D2",
        "          </objectSet>",
        "~:mXG",
        "IL_DE0C410F96DB3D27018AAEFF93300898D7630D40AA22335FB1CE264ACE5042E5.2714.1250223084.282",
        "IL_5BAF9AEBF8B3A3D905F1192ACE407D663D7920311211B6A94A34DB54B12967AB.2705.701252013.291",
        "C_E60EF1B207B541A3969FE52605168C53DE4EA7E5A1D37600D0478D235286E6BE",
        "CD_7E9D3FC591CA732EEA61C4B739CB4B4C95CC90462692A33742DEEEDCF2ED6366.1782.1730004135.920",
        "IL_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.1670575241.360",
        "CD_0BA79F1C0B8BEE05ADEFE070511A71266F9E5457646BBB9137C84F64D7EEEED6.276.187912206.284",
        "IL_E560A59442F101954529EE01E3B9F5CB19588A6B8C15959161D4C6BEF9912836.2677.3423024556.280",
        "IL_69022805775A062CC94D57E8561A4967FBB78097CF06B06D79EE411943106C3F.1075.2283585362.190",
        "C_1EBAFD575878C70CE2D0C173ADE6E91E3E2B346C0148ED7DBBE48D6EBAD5CDDB",
        "IL_428F05E4B03853C84BBEFA8A1D4314B3CF989D06DEC7F7D2BA2DB4C3CA876FF9.2714.1202561926.299",
        "StateType",
        "CD_03B5275A0D380627593F835B4AD2B03749EDE19E5B92F5526106699F68C22F4B.1382.4004286682.1503",
        "Start",
        "CD_555A091927E7FAC684A8DDEE0153C9DA5F1053862A462BC7EFEFDF4A7B356E0E.1595.2284377482.412",
        "TraceInit",
        "I_86B3BCA296587429BCD61A2968A848617DB93023BC6D3C1858853C5540E12A3E.11.2927719112.294",
        "IL_1AC1FF9846D54F9F0147D2DB85F9B6094C79EC82E32CB9B2EA521A35465B977B.2710.1224757709.295",
        "CD_642EBC67FF61EFF34AD21679C796E3CB07BEBCB918B03A2FC1E43AD624F651E4.184.1577373988.1537",
        "I_A1C1D10CC78BE7A5C3AB54515C19F31277BB3701F61C98AD4F3CEB32242F741C.860.1.30027",
        "CD_40CAB48C933E1E9666D5FABEFF3A33253D381F532056E6A9DD2195EEC2E121B0.2653.2557958640.251",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2020.3288993474.188",
        "CD_EA4DF20054CBD87001EE67FE2E62392134ACBA7D580330C315985BC30E5F543E.1191.1488079049.244",
        "IL_FDC07BF412EF517BF16CBEA0AD032C8FE94CB2DD73B9CD909C08659DB8C5BC0A.1356.1547423517.325",
        "CD_2C338646F5C1CAA321EFF2BEDBEB6839F57D9EB755DB455A7F244BA25566E1F5.75.35897089.605",
        "40%89",
        "IR_549610262D899A609746B30777DA484C6B4E815F4E722D4B8F981494715B5A99",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_C5A1AE4D66D54DE31BD0DB67526AE9F7258CD2800AEF5AF0F2B6F67014B52345E2",
        "CD_19F23F01E81DD69D7577258538EBF1C8D0852EF9E76BBF75714E72C8A413982D.2569.1718991222.485",
        "IL_935992100C96CCE9E7F8C32707E97F3DCBAE769FC0944CF97DEFDE6E4DCA1792.2702.445089956.285",
        "C_0748DB3A279743A043A27A29652B890BE80A51E24D8B834C6C112DDE493793F3",
        "C_B3CF2C36A1D52D539D1072349C9C5912060B70BD7C865FC1912BDB78F2BE1EF4",
        "CD_8698DDE120477B743B835F81DD007E72825FE6E7CB8483AC9D930CC8206DC723.312.1903898467.413",
        "C_BEB5CFC405938CF504C4F022B26457B8BA4AAA062A6E8AB4E49ECA4FF82FF69D",
        "CD_D1B9917E4A8DBD1488077B861C17B0A0964FF41A5CC2D87825C4AFF57A0BBAD0.2659.3548010037.909",
        "I_2E249A9A7051E55FB5C7B110A81D9F2943FB48A52AA26C08ED30F6DB2402B8F9.1776.1880114746.331",
        "CD_5CC5CF05A7A1041C246328BDD1081AC6C5D60C48F12D405A2F1C3A3CF42897DE.1150.3386837879.257",
        "*-0i36s",
        "CD_52FCD2E5BE7CE0007B4E896F37512A3F9F16709231D802A1F0878D02E5765394.1191.2692173128.611",
        "CD_6D6161E9DE1D589E6E575938236E83C58350CD080E8757AE76F262610E96B3E2.1190.4285592769.302",
        "CD_2CDA39737D02F62FC720940C6B45607B5E2EA5635D874CC5BABD7C8C6812DDC5.1526.2602889833.264",
        "CD_87CE846EC002DBA12914102AFF6ED89E0F6DD6CA407A1F7C8C0CBFF801124A9B.2403.2932658578.301",
        "C_9E43C134D778B6B917DF493A1156A24AD7B4B0BDFC30D8396FE004F3FDA32D3E",
        "C_4C388CE7AE5DC6521AA42C4856C6B40FD20A765CE0A1AB00E36A2A499F181279",
        "CD_7A16CB145A4311D526736B897DD968162F4158895AE48A1FD97D7728640B7509.2576.4150847499.906",
        "CD_038AC7DC2B3B3FE18119C0922FD190491410A00C8C9DE6AF3AED2E4BB066C596.1930.2037324493.1048",
        "6]<ifQ",
        "CD_09A5E19B62E24065CFCA8EE94EA9E5C149E6CB498581E688EF627C4525368332.1809.886112924.426",
        "CD_62C9F140909076218EE5278EA8A962B5322866C7B9FEC741FAFB594868A887A9.1923.3272934670.311",
        "8310B047EC675EFF57AF6CDF0CD910F39829D28C5747F5C66C2A633.1218.2331411674.2630",
        "IL_9545D47CB7940C8EE8FE2C049EAD79559EF469E4974E863E6E51191453619675.2726.1708912885.280",
        "IL_6EB0E9583B3959CAC2FCB91416803ECC387F3F7CBB83A3396F0D86C2536E6EDD.2685.92927305.285",
        "CR_046B79FF8FEA26EEFB72057DF7A67A7CB75727CCDA1025821CA0170FD33BCD6E",
        "IL_D1857D12098B5C625BCFA751A4B4958D84CC97DD87FF80C7CE3DAB199239E008.2695.1112744236.266",
        "CD_2E052A2746A43D11BFF3F6205A3F0D292400CF9B8F3DB09F6AD7A671FE848750.1060.3309662898.1127",
        "CD_6F71654DC948E1EB11B435B2742F01766B113983E761ED75069E656F44119002.278.4190220963.503",
        "0x00000400",
        "CD_F888AA6AC586756C18E219B06406D7BCD62E2EB0C94B51FB48F127652DA7E3EB.41.2959931563.278",
        "TargetPort",
        "CD_920782A19D0C199BDC99CD6BCD549187886CE3AD64D29AEC0D7E3B1ED7356A9A.2390.4050231373.321",
        "CD_3035B16D02866D7EE030442132A18B7ACF25E1EBBE385D31EBEA6DA0AB2F86A6.57.345690657.3394",
        "CD_9BCC8ECA3532BADE5AA73BEC8D82CD8868D955BD3F2FBCC16B8A5B3B30F8CCD3.1568.3116528939.821",
        "I_081DE5F9EB43C01864947DA4AF882FB1863E1DA519AB3901734A76A173C64485.2709.2273293940.291",
        "CD_9288F1883D88E26CE36C018E5C8D526DCB0F72E9D8B2A41E65BBC15B92D92821.1192.1725029889.616",
        "KI_A5134EAE65D9DD02F6CE0E924C84D387C2BC76C9409B3E6C9F586619D35EA1DA",
        "I_BF9D9C18AB1A6E18A896CC939C82B68B48ACFFF2BF3B071F74FFEAF1FAE680D6.1475.3660458206.288",
        "CD_61F33C9DE75CB13B4A6469AE01D1FD6BD56B098ED457BDC27158A62BBACE11D9.2419.2946446352.683",
        "9E09F2C9349B6153167CE1B6A78ECD8672C0087F368CF21C8C2",
        "CD_E6CDEC66D704E11F45B0F0D82E7A048CB93CA008B57E83A2372C128C06C6ABCD.1950.1703765246.5553",
        "CD_1388B74AC4B1A1248035D019490B1CAAA479C4415233A9E50223DD0802BA383C.1081.123980368.3304",
        "C_62D705EEE1342BED8EAA270755244DE39EAF602D11698E63DBE2E645EB742AFE",
        "I_C22F3CC14B7FF9F4D80D447AFE68C087DA4445EEF4656FE00DD99580B53D33A3.1606.3932967909.228",
        "CD_BF1E5E829A1544FF8B694A6E8073DFF9D1CD4B2724FDB9291959D5493401980F.1153.1659267347.292",
        "38DE994CDC658EE55155A3AD8.2666.188482135.458",
        "IL_3AA9DADD55B999E70B7D98B725AD93D51EC7F4E8E0BBA4322C1971480F73A8CF.2690.3536088366.263",
        "R_4F0DC2D766DE63D22C2118312C7C8A4306FD995CC443322263FCAFC5C5AE9AB8",
        "CD_E6323222C9A136F6C273CAA11042C26BCC58281688835481ECD05350F4040D8A.1105.1107758707.1976",
        "CD_09A1CD34FC28B461D4B117DD4689EFC08E3B06527FEBB7251285DFC403031764.149.3650630298.765",
        "CR_54300AC69CD22DF016BB3F2AF97DBCDBD81A1D838D9588007B40A7B95D4F9C12",
        "CD_02B5557CADEF33CFA29F52E782D8C5DEF3C67D29A7C0C3B389FF34D1D0708EC3.1992.134747559.5232",
        "CD_F6F676B6527CD98B77439BE3F1B79580E1B2ABA32BC12680DDB49F3F5AF69B70.1349.1498575594.908",
        "IL_B0509F7D7E6AC00551287C350BA044C7B587DE4DB669F59CAF4D4140D2D3B67A.2763.532647700.269",
        "I_DD8055C1F282549114EA42F9E9C43B0EAFEB97C566499DA3B9764E61B5C7AA7F.2698.418076095.266",
        "I_05871F7367735F5F486B28150ED59EA0C3553ADBEDC56F11017BA47141A37867.2708.1156921452.285",
        "CD_621D57D329305AF6C6B4D4C2D624AE4A3F08B9C39A079FD8CE37946946552574.2617.1053351229.341",
        "CD_4AD29349B1757D9DE5B7D27395671493BF42FB1B4E0DC3C5CE33AC8A31C3C3D3.2567.2216791761.226",
        "R_9E6BE90DCA6B96CBA3BF12EFB579708613DA0A405A49EA5E6B87A7FDB2747D9E",
        "IL_305B49C12B1B31A5FC4646DFD185B86544D457A66153B72C296A254EFCEEADAC.2698.587046638.265",
        "CD_445022CE506EAAB770F5E88F3AA9A3B3BB9043E1D2F57842DF958AC9BF261EF1.2052.214163066.144",
        "IL_491CB5B77B92CE4970181695D373ABB6B59A7A19F1AC5B4443702F18F64F713A.2707.1591329682.295",
        "R_4FC7350D0697D65B1585376855E9596964780B95A8CAA540BF3CC2CD97C19696",
        "CD_EE2A2542D3194678831FFACE37D0E463A8759EF436C4FDE7C6AEF2F4C0CB8A9F.2528.3423083255.510",
        "C_187F2BF471DE99AF2B82ABD56932A57142BB77EFF56B5C132EE3CBBDDE7852FE",
        "CD_28F6660752A3E238081EC79F7E80AD5E5E36888805DCE1EAC485A69CD87C1816.278.1525697407.580",
        "IL_F98CD8F4EA96B0B77910240E3039FCC377A97641ECA44728EE7350A6200A681A.2462.1414865239.293",
        "CD_AEFF5B2749710AC600DA248017E9FF1C4A4F611F56BA7915B592C48555DDA449.1389.3017260921.278",
        "CD_B1A1651DDC605A98CB61526F4FA9D18C6AEA8D3F609CF92D2D881D05F26BFED8.2541.3305779546.471",
        "CD_85E98FCC800C352C83C45C07CFE472D9E1E77EB165E6BF1822711F0EC5CEC32D.1600.2747105406.649",
        "CD_F275C6D7762007AACAC2F7FFC21BE64DB98987C474F6928DE4850F09C68CB078.2612.3940431597.403",
        "C_06B95516C170444CC895270E847F3B76BA4712C919901870D883B631ED78C408",
        "CD_2E5C9EFCA8013F27F4977A5542D1BC15FE63F4BC6496BEF9898CE4423F2732FD.1589.2504297702.703",
        "RSOP_IEConnectionDialUpSettingsLink",
        "IL_86C4D3FB4A59FED5EF3DBD11F9592F88D1682B7D71F55FD807DD3283918426E4.2717.746418418.285",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1076.3303974372.180",
        "CD_2A53774A21E318A8D939388D5E5CD6D4813CBF57C2CF0451E1B402EE9A87C56F.1549.867730366.511",
        "Win32_SecuritySettingOwner",
        "C_563CAEFB32DA9C6DA846FEF0491B998A5AEB53D92D124F8B8C12120BA57E3D17",
        "I_4BEF46BD8AF1424B994565A4F30353F70D9AAA5FA171745944447722281AE60C.2719.2281240530.280",
        "R_5DEB181FA3808D9D7D9C352C844B65D0C9A0221A91C57777C58BAB412DD30F67",
        "CD_D3559258225BBBDD5E2DFDF52DE5A11681B899B436DB12CA240C43C8641B92A8.1248.4048035429.338",
        "C_27C5DB26AE68508026F2941BF0889CA12BF5D10E1510169C1D865712E77233F4",
        "CI_A2F0F731789B8BD6294886FFBA95B74CEA7B86072988F101ACF53FD6E840B35A",
        "I_BED999C9BF7E84BAB50F0A32D016E7D1CAEC2193DF18DA06E4E9B9F14F58F2B8.1751.4220363579.204",
        "CD_73F9CC8D0A2B5107ED79AE2372D78EAA3B2A7A24FD2BD2876517DA1B42CB16AD.2007.622330005.1360",
        "CD_FECAA7D881E1936D6E68C32184EED7FA22BD8EE1B1605048DE3B066109121C0B.1190.2582525999.611",
        "i-9f~QcKl",
        "WHEAPolicyManagementMethods",
        "CD_25C2E8C327D4AE50AB0B89215561563C42973CDF72E4E8164880862FB1C155CC.249.1858275673.7697",
        "CD_A96812E0A2895AED486061635646F9CE6BE6E74163A4F9C4D4D988FEA144F286.72.2260663625.257",
        "vpnStrategy",
        "C_8388B68C4DB97845C3C1C2649AA6C6E0CAC0BF4C68420F762A0E16A42522910B",
        "CR_0D519108D85D82BAB33681414520F8FCB8ADE86295F011C324EC49523D7AD353",
        "I_8A7831F1CA17EF8E61D09BB610C0C7C9D4C021FCF2E3BBA1310CC9DE1ACD0955.1976.2802323208.329",
        "I_EACA596129FE2C089C7087C312BF09A8C2A05AFED1F165809954E05659FE06B7.2694.813928757.263",
        "x{~!$'*r-0369<?BEHKNQTWZ]`cfilo",
        "CD_161D7B1F7DD552C780B6CD4154D40388F29AC0271BBCB7991C59595342903A38.1700.3703283181.374",
        "IL_2653AD5506DB997EDD160C597615CED8DC5051430F34D01AFC27AEAC56407DB4.2707.638319484.289",
        "MSParallel_DeviceBytesTransferred",
        "CD_1D13F523791F1EB20EAEF6F153AF80EF4F13EE29DAAF24D54E908D208A687279.1355.2025009894.396",
        "CD_30B3E5C532DACA525204F16B462DDA94D5DC56C6EFFECC42EEFFB60D96905260.1921.2001931205.1029",
        "CD_2095EEA1CCD8C1CFEEBDA5FC6FC84B8ED7715409578D2FABD172B27E3EA581F9.2615.729392336.641",
        "IL_A23B96312E14EA0EFD42870A76FECE4606704453FC2DB3858B1AD85FB870BA26.2676.3372359704.277",
        "CD_04C7B00B843DD535EEFF8ADBC90D1E1778B3D8338A06E37E21692258CCC50FA9.2528.1905850821.85",
        "IL_90E068D44393D7BB2A2DCBF3BD9EE2F9187E027BFC63E373D546D08CCCB3E5C3.2469.135763270.332",
        "R_27C25655C194DAA0EDECAE6CEA8E68AE8F12E7FAE4E6415B29F8DFE22BE372FB.2503.4245430991.536",
        "C_2BBDC6530C208169E005CD28108E36BCD72310DD490D1F6D9817675EE3291874",
        "CR_0DCE749AD0E30C5A74941D6C326877243635B3D92AE3FA1BB77A2C716BB28364",
        "CD_4F3E89FFD328D071A7EF820B6542CC8779DD91A8E0E7900B2A3BF4F5F4353427.1531.1.8392",
        "C_7C0DAD954AC25381334594520D92B90371AC70B4659009B0C3C215C466688D07",
        "IL_098D2BC6F12E73776192C2458399FA507AEC03E53B212D94397DDD13D12328E0.1538.2152314052.334",
        "ref:RSOP_IEConnectionDialUpSettings",
        "C_F9C9BF1D438816A18A92B3E8522F73D7F60F0DD6F678D67DAD4AE3DD5EBC727E",
        "IL_A13DC08F44A6FF8FA90B0CB647BC3B13CDA21BF9F159BE57037059909A7B6D41.2712.2162134753.291",
        "CD_F071A22EE25478DF80A205153198A6FC12F84A9E6BFE53B8E5DFD1E7E2ED2B8E.1080.568022456.404",
        "A call was made to HBA_FreeLibrary when no library was loaded",
        "C_3919809C02000DE9BA7B34CB7C0A2B9234444AEF5A6D4DF7DEE7C1379D7EE3B4",
        "R_4DA19C7C1345D18991969860D5303884780EF4410093048FC0F1820643E62177",
        "CD_91BBCE5BC61E1DC47C4EBF730A35B9AF4C8A68FE40C45D7F1899EA3F67F6B400.2596.3141539033.762",
        "I_BA3932A3E8902A1C64D2E5C26C52275EC8733108168083325E5CAA3C29C1BAA4.2704.4120406804.292",
        "C_5605FA03DF8EFC9403913B359A754F865B162883BA4B0BABA988369569243874",
        "CD_C57C6716602210E296D08761CF099FF3D53F3575D46207228D76ABBFAB23CBE4.1340.3633598221.849",
        "C_AD547D8BC0F447772171D34927B4E8F9F5F0EE2793A91997022D273EBA01574A",
        "IL_4618452784E7B8853E82D22335B98B9DC784FA7D4846E290E282BAA5A4637C31.2721.3811421753.276",
        "IL_08837FBDBD3097471CC2C297165FAF98E393B0957D4C58A3770FE396DE076DF5.2710.1230526157.299",
        "I_D48DE779C78A7D61786E058F05FF12CF5E40B5F68B176C335E92B74F567A4027.2717.3952586855.276",
        "CD_296F9D2499D05F25161C718D677DEB7A19A5724537306D0D3846F8C0EDD51EA2.2521.2836263819.1812",
        "IL_9999CE7BE2F7DFF5A650789A4ECB638EE8010B0E955DAF1D73AC5808D527D79C.1498.3046117437.333",
        "IL_920DC192C7DE393EB5A754D63202282F9961647A34E6F2507C168EC780CAF5FD.2715.1721837115.284",
        "IL_92A7D456EF5B430C328FDC54E4DDFB623DA8EB3D625FAC2D624125916B534CC3.2718.1437127008.280",
        "I_F59986F3689323F08DF6C9D489E4E84D39B594030E0F1A502EBF98179EFF06DC.2727.2358231412.291",
        "IL_310E6C3804674023A3AAB349BAF2AD2EDE32ADCA1138B7A047A2B6D35C645F8C.2688.1783800665.263",
        "C_7B5ADFA4ED7A8BAEBEA3D33835D773079137AF910C6A6BB79C44E772F2B6859D",
        "C_A726CC10C860A315296DCD93520657C7C068B6652EE5FFD6550B3E0DAB8CACAE",
        "I_CFA0B1B6160A70ECE951031F3670527FBE802E17A9872F45C34E57CB7BE2954F.2466.2515631069.356",
        "CD_39DCEF2AB20FDF7CAFAA304F91E99DB86E3E37A5DC94A931621C7269DB8703BF.40.90087890.1182",
        "I_C7FAF3297282F70934EFB9BEC76E5FE9D6AD962E9B7753F4B0E6709AD86A9E11.2677.714626156.276",
        "I_092A55272DD5776D1F8B56BC2DC2767240A3BAAE69BF8801B96D23CE4A45B158.1089.1901740824.308",
        "CD_EFF78BA04EDBDB7E269EDE89195BF04BE0D870F944199B1C1854270A94EC8E1D.2667.1434651255.689",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1078.185050652.368",
        "IL_BE23A6336F257D5D38EE27A885DD47EC96FDAAA56D32DD4A418B58725224E953.2735.2570573003.278",
        "CD_A44408E1DD38D6545C617326A4354A58277DE2EC9DC5930CD9DADCDCF31C706D.1933.2818542627.581",
        "__SystemSecurity",
        "IL_C61169F2236F99670F39649A88C651828DAFAA21726C58E53F190DDE5CD62B06.2676.954324443.275",
        "CR_61C9D893E8ECD2FC986480B9F759F7B728716D99642E5BC04B6E6F5E2115CD3B",
        "ResumeJobByObject",
        "I_8D7DA88B4E8F335198B657798880A2A343176F0A305363A8B9B4A76DC3F936BE.2720.3583691387.287",
        "C_59890B66D97A7EBBAFAE0E2B038286FC98213E10C2CCB5067C6CAFF2E8027655",
        "CD_86ED431FCE21CAA67833F50E8CEB80C11FAD7D40366CDE16E2C8794094F18925.2098.2053724725.1304",
        "C_CC42CE8E16DE25C1D91BA16E865F3AC012D22CBD5E4C5B16BAA9C58BB1B02618",
        "CD_E25721B8F3713BDE1DA6576F61E5B33C530348FAC408D2449404B7FDA23E173A.2483.3970339243.822",
        "C_9F6D9AEF44C6D6D731582B47CFA9BC650A236C1F46BF8FBD13E2443B7BC5F904",
        "R_8782DF593D87E15E70F328199782FA2AE53123A672514C1F3FA22CA1BDA7212E.11.656213792.520",
        "I_340CBE78ECDC147CC0D8E08D25E28D5812DD352A6020A7847860B23A3D747C84.266.2545556400.294",
        "IL_B3004F14DFF3478FDC001CFC6308017B340B717CA8EF3510446CA3775B4E50A4.2690.621995481.265",
        "C_FE21788C436CFF985E8FC1B783A31A0C4A2BDB769702ED6630B901A6864AF8E8",
        "ref:MSFT_NetProtocolPortFilter",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1097.1025352478.180",
        "C_24CFB2B4CEAD5BE9188CC5001933580DC2746C05DE76A8DB6DD098D52E4B25F0",
        "CD_9E184B0D1F692A8FC81688E709FDB961CA1DFCCD6CB6126E1E7994D280B1E898.2426.1670939131.812",
        "tx,(X",
        "CD_934BD1F13253860558310BDF781CA401B2B8CB8F3C3551E85991352E073FA149.2614.2404219487.585",
        "CD_A5134EAE65D9DD02F6CE0E924C84D387C2BC76C9409B3E6C9F586619D35EA1DA.0.2249453560.325",
        "C_90EEF26AEE52AAEAA6C979CD586F5F478789816D2A5901B4B6A52181C962DFEE",
        "IL_E3DC31FA375DA42A8150A733A12E22C9CC1FCB3548CB4C211B732B0CBA295D66.2736.1225246608.279",
        "Whether this application should be shown in the TS Web Access",
        "C_3FBCA1A3C3FCA0AC79E7FABF0F46FDFB9715CD8A6F985241378B13573652A0B4",
        "CI_C937FF2960366D3679AB8F23C7A6B508B41E35226B8C5FD67AC45163D3C64350",
        "CD_575BF2A48D80B1DDD390E6D0D7DA5FFF82B3780F7B654DA3812C485F78F42F88.1922.2753122740.1024",
        "IL_B4B9C0E0A1B1EF66210125EBFD6621F5B74551232E8C2B141C88B28F365EC8D6.2707.4274338110.288",
        "IL_3CA6A8A46045BF954508B3340CD11FE30993A59816D6AA3EB1B345A8EEDF8A01.1608.3979994243.332",
        "extension",
        "CR_AC891A70DE67F8B532E5CA5EF7F5543B0D61F7E43127B27AC65391BA1CAC72E0",
        "I_5C6D202D981427613B47C1E03984ACC90FBD40670239E12927F76BE931924787.2695.4058198364.264",
        "R_C867B637B25E413A5893A8DF403F24B113B36FB9DA058811D901C232D15C4E60",
        "__EventConsumer",
        "L38MD",
        "C_D14B35935271CE0CFC0B73FF55CDF115EA5E7A2716F3A5C2E409A53B3653FB6B",
        "I_44FC420FF870F1363458948DA0E95607C9F5B20E67E59C08685D763153B1E069.2702.1558396204.287",
        "IR_CFA0B1B6160A70ECE951031F3670527FBE802E17A9872F45C34E57CB7BE2954F",
        "CR_486C78842972E048EB3AF4A98B44D84B41374C16F30B7064983012EA8F4D33E4",
        "I_0FE84CB7228184819434E73184A33B5694CEFAED93B282C50B930127F187504C.2434.692288446.311",
        "C_DF9F2FC6FD92145061FBD996E3F615861A2861FB55A5CEE4F16822FB71A07AF1",
        "C_7BF884F7361F0D677A40C5CD7F9E2139AF67CB14ACDB2E9D39E3D5ADFB888E91",
        "C_BA482156053C9C0750D79B8792FC85053C434CAD589DE87E1E6A57C269C49064",
        "object:MSNdis_ObjectHeader",
        "CR_F0FFD49170849459EF1E56EC96E25B839FBB919B41D88FE54D6EA0BA45C84F18",
        "C_C4F59114EF1914FF05B5796404E0ED8DD63799DB51A6E299D0727FBDE6B4E0E1",
        "CD_422BD4D12469E52722B5F3143C70049EF3049B5B1547DE0B5D622839DE0FF5F1.2577.3490223921.219",
        "CD_F28C8DEA5C25BE79A5199D7DD956384256552838A3590739F763A55FCCA51801.2582.3136796973.506",
        "IL_509D2BD728FA4DC13323DE1A2C0546EA7AA2A78582D9A89051462F1268BEE54E.2706.2682599584.296",
        "CI_C0C025C38981E58EE50CB7BB4E4786CBA14FD933E638861EA3A6A2E0C806211E",
        "IL_687B15A6814DFBC44BD24E7676CFA5FF5818E5BC0ABD402D52CDCCCDDF974C90.2696.3859527666.273",
        "IL_F2EE10607F13DDC2BBEA7C095910DBF7A4196F542C5CB491FE93F3A880351E16.2703.2206139252.287",
        "CD_E630E2A029E4FDA59B5EE4D96DE915A5BAC16FFA2DD9BD47541BCA0DD720D334.2018.3736179284.1339",
        "I_02BE0D0F4383EA07C00615531BF67EAFD4EDE92AB28CE4D74EBD94EDB757160D.2702.4104989389.296",
        "I_B95BDF87E92ACD247E62430960464230E718B561AAAF0432E23253C0393E32FB.2703.693216090.281",
        "IL_9F7237E671047A16BCB745405AAC599AB8579344F0C8B92C754DB789C65D353A.2715.2041322341.278",
        "I_60DC4B9790A660ABA531267958641F6D57300995E74E813A23AC9619EC24BF9A.2719.3380054749.278",
        "R_E96AF09BF4B103B57336276D0E068EEFFFE04050FCA35E95752BFAC46EC8C374.1053.3468940070.524",
        "C_E033D3ABC25C8BF24BC1E395815C5B2733193623692C6C6E0A75F0544F970EA4",
        "CD_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655.102.3850198833.1907",
        "I_33283F629BC457D453E27AADE5FB75ED4ED011FB899DE00B9C2DF3390CD41B7B.2703.1316371457.281",
        "C_15DD3B0DCF2819EDB87C4363412C3F99792BF1AFEF4BDC92585A3BCD2CD95F12",
        "CD_59BB151BFB7474042FE846D38FA0CC3A5BA58498F9DD04AAF5BDB993481B126E.2086.3222164500.1264",
        "CD_3B52DE0976ED7CD9B4784B5C2E3249BB9E7405EB7D80E56153B90FBCA2B2EFDA.1977.2452644867.1127",
        "CD_7CFF354FA8F5A8013D770E0F778B943473F6823889CB937AB5AA32217D27B6ED.1606.1681176419.1568",
        "CD_5101B5920BE56811A454DBA3737FE64D06D0BF17EE943A64E7DC910ABDC79B70.2575.2588508534.622",
        "C_E1EC1F810E645784CE7FF2576513F22655E0F40D5A6228BFA202B5A3E43B82F5",
        "C_B36ED16AEB010B08F8C935CBCDB0109AD02D84C288504D33A7A27916E3A04184",
        "CD_A8DDF63277493FA7727FA87F83A98725771DF4DFD8E57B19F776BF46D63FDE5D.1193.1582344576.314",
        "CR_FBD11BA7DCC0C416362AC2A1F8EEFD82230A37B2505B7C99363ED198FE2F89CA",
        "AD56DB55CCB8C7A0F1.2725.3192501927.277",
        "IL_0B880713D9DDD00F98918C43E596B37E54E0FCC69C63C301BFAD6A21567EB1D1.2736.1618109958.314",
        "C_C95F3DFCE1D4AA3558DE11BE7F4A4D14A06E95D50BB19EA639F8B6302D753409",
        "CD_5BB891E2FE9829BEB02F7F2E784E8DD7DEE84D71695BCC32B51831C5C8733CB3.2625.1852514566.602",
        "R_2E4CB0F875356763EA64F3060366993EE0D49772670FDDF29B1CAAF86CE9720B",
        "I_8B35381ED83DB47F46C61CD8235D6D15216F01EA35CD603D7EE5B88A0B8DE5BB.2687.660355522.264",
        "R_E8438569A234983E9F3E72114D67C2A8F312591D9F4E7EF448973ABB653C95D9",
        "C_1052CCD88A2957470D93AF17CD201F722846ECFECEFE2021E6E5FDFFE35BC5E6",
        "C_BA7526B37D90714D7B62CC8C0306D68C0FA9CA2FF62FAB9215A612E133C74CD5",
        "File name, including path, of administrative template file",
        "CD_0F00E7B059327B1D3BD2203D577D90DD0AEFBB2429D93A104A20F3A088A7A888.2729.2115210462.387",
        "I_5C670A419305640007AA9AA161CE0975646DEEA64973112E2DE223893C0FA422.1499.570302633.340",
        "CD_B187F2F8544C169FCEFF538082B4E8108913C60277D7DAD56180B4C1641F57A5.1581.4137407147.423",
        "CD_A58EC39ED92649A90AED1FFF5AE4D021DDCC83A8D429CDB678D3D29879253FD3.216.1878623581.783",
        "C_C92F2D60ECAE92569E6C922BE7396D0A84A93FC7A3AB3FDAF76E038B26F8FF18",
        "CD_8FBFA6B18AAB7B589FCD4C8B4ABD0E58545EB816B5459111B04088F74A1FA745.1924.1823883400.306",
        "I_E3CC77148E0B39520C5C44F2222ED6255D3DE8DFDC6AAD0E80078105F56CA20B.2674.728605399.271",
        "CD_E483DF7E28B72B64DDC8E69D7B9D7A194DAA49C1FD6E07E079F14E12C3A828EF.2334.3084208571.5551",
        "KernelIdleStates",
        "CD_3DD0A80AF9236F4E7013A6DDB559EA7A2E607D76F58E1CF3D6ABF9F875179634.2666.3069920718.851",
        "C_0C89E3FE1CDFD790CBD5FEE0B9AE5F8AE27F38181A372EB2194AFCBADEB37DA8",
        "C_AF09E10A9BF5FEF41024B745AEC70DBF485E6D2506AE3E4A84DA5AC85692076D",
        "CD_39DCEF2AB20FDF7CAFAA304F91E99DB86E3E37A5DC94A931621C7269DB8703BF.156.1112377255.2856",
        "C_48B0C9029B67A5C53A5796286B490AC8D6BEC1B48F8B30CB5F54159AC40ECED3",
        "PL(tp",
        "CD_2BC387469A73A6E2FEEBDCB57FA6912C972B25CBB9B9CF8437AE02367C44AD20.1231.3553409249.567",
        "C_9BA1AB7C3163917E292E29E8907497F4785695E458493ACBBC6CCE3EBFDCC92C",
        "Priority",
        "index",
        "CD_A8F32ED73CC909392CBB6D2CFB5C52391FFF3A4DD4AE1EBE1F9D40C03A8C9EA6.1431.1.41886",
        "C_E6555E0E3A2A0EB36147D0BA2B88FF99C450AC95610E6A4CA8EA619881318FDC",
        "IL_4DA55E3DD8053CFD4D113AAEAF6D79C045781B3692CEC102810B69F1854A1A17.2717.3479575693.276",
        "C_93FA26AC21CD81110C300205F91E593B4450632250F10BF0040FB84450AF694F",
        "CD_00637C6FCCC93CC75F9D988B459EA167A80BFD4782DA6DB5BC1F63F5A3F73F9B.1638.2297301218.365",
        "QrTWZ]u`cfilo",
        "TL;>A",
        "CD_A4B7E1219FA76BD23A588641B4F3CEC1D9A3585F7F85B74432295927C547BE69.209.3560999378.7403",
        "A representation of the access points of a clustering service.",
        "(,048<",
        "CD_1A826788D5CB396EF46883163CDFF0FAFFB8ED9B8BC20D60D3B7762CBFBD2C44.199.2954096789.781",
        "I_168B94A18A6807F45F044699E37230B4D7BF53C72BA6E7A3D428EA30DB9870D0.2701.461387258.274",
        "IL_6D1CCF83979E74CF2D079458D9AC04D51207CBBCF8A40959C05C544A41DDA509.2686.1189406469.269",
        "CD_DD3FB1A6B8FC9755CFB7A3BD7A61E1F24E5C869D8697CB909E277ECC11293496.2391.2028723941.3394",
        "CD_FFFB2CAA212EDE7C934B4B2BAED8A37394A19E638FDF46D5CB25D07EF0827F51.2522.3504336942.1095",
        "C_5759507746BAB79045AE2A46B326813A2A0F0097AA7AA167503FFCBD4304189D",
        "C_830BF8BFA5BF93F39AE2488CCF30ECCF24868D5104B63DE9163FCAF3C26491CA",
        "CD_87E1C2F47BC6AFE40A0BA43A6B695BEEF3A012F8171DEAE2BA90DB3F65BDBED9.2582.2140169975.281",
        "VpnConnectionTriggerDnsConfiguration",
        "C_D9B796CEAE627F28520411AB7A9608FE05EC97E01551AA9F1CC3C532A4540954",
        "C_F1BA28E60C6EFF4420FC6CB551CF2C0DAE65353DC7A28CA753F3AFD5F33221C9",
        "I_258D18D5BD59864635A4A499346D3159140CFC98629C83EA57F498F1873B7A84.2681.2119877503.295",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1809.2193856756.368",
        "C_8DB9CA143932A4C51E260C5D1072E9BD7AE7C19F1FFEC91457E2AFF9C2F82DDE",
        "Drive hardware problem",
        "`f!r$'K*-N",
        "R_D8FA39278C1247AB8B1FBB10D8F82DA6DF57FDCA81312F4541EF472290E1F3B0",
        "CD_51A4A09354423C467E946EF4050F2DF0E13DE3BBAD00C291A488D4E05F085A24.2017.1828941513.1886",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.1005103121.368",
        "IL_B4EB07FA921CA26FDA5DD37286ADFAB5A10E29C92C79A7666A196E633C150C77.2696.3303322735.275",
        "CD_5CB6A0A003499DF6531A245112372798390EB984E42ACEC32EC128E82F56ADB5.1999.3847220884.1352",
        "CD_191877833EBB16E938034A3506BE0709B7FE03ACAA65FB61B2F3088D1DCE72BF.2059.342061585.562",
        "I_AD906288475AAB63F712FADC05A4E8E261D8CCC590F69AE4BB2795A9C8DA63B0.2724.4199111456.283",
        "CD_6E7226B042F9E10708887BD9806A544872A6CE45EC018C548A61885557568A89.2578.905930623.231",
        "IL_58C040DD5012452AB107F852079062EA9811E3F1CADD1541BC9B20706E492EFB.2729.4011188058.275",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.292.2845272479.188",
        "I_66796251E5D0B06708BBA28B2F0C8A38E56DC5083BFF260568BAD57F3AAC7FBA.311.2942916013.249",
        "CD_962C6E7C58B97BBA37F5179D96ED3E00EE4A4FC20E4C3C3A3312674F9F7C4195.39.268383370.494",
        "ref:HNet_FwIcmpSettings",
        "CD_1E9CB0A4B1D9D15808A86CECADCE036DFA0A4705D4A5AA99713EE38A81604E60.2596.3893804031.695",
        "C_A44408E1DD38D6545C617326A4354A58277DE2EC9DC5930CD9DADCDCF31C706D",
        "C_2A29901470183D31CD9B227D54FC0AC8AF6B54BF121707B67C0E4CAAE27062AC",
        "CD_23DDB252CC4D2FD4A1F4DD3D5C1D39DC829D566848D6F27132AE759E1E502D48.1356.766948135.313",
        "HBA Status result for the query operation",
        "IL_03FC7356696B81A172A3FFFEF4518C34DB3C12FFC7871897C20171F501F26D8B.2711.4176058167.289",
        "CD_E54AC9C8AF2DF17AF3B8C0CB2919B6D7164B0CD443D51BA17AD5F6B6FC0AB970.99.411546285.614",
        "Current power consumption in milliwatts",
        "CD_1D5B7D85296C726B09C241F1DBAB33DFBAC888F063F0064418C3F95F3FA642F8.2651.3892858276.831",
        "I_B349FC6BA4DEF0776629ED5A22F39B90C80E92CEB34E80EB1FE61834E30B650C.2728.3404309503.291",
        "IL_87B615951C5EF4740194260A227C2AAC18D53D4033D34D4C81C4809F73346DA3.1014.1059189660.291",
        "C_549DC252C669D007BF4D8B198347293ACC33C289963BCA05C61A46DBFC8CA4BF",
        "5AA54865F4",
        "CD_9EBA3A64353F235FA676D5A579FE650C8E0A1DAF053F4A2C836DEFA15E9FEE38.1059.198000322.512",
        "CD_73F9CC8D0A2B5107ED79AE2372D78EAA3B2A7A24FD2BD2876517DA1B42CB16AD.1083.1648334912.725",
        "CD_C6C7322634E5ED35EBCD1F5D0E8BFEDB63442E280DFDFC57940A99EEB54D8018.2569.2085208933.391",
        "CD_08D881D450D0615D55EC2939B63E533A7629C39B5BF81A337BC629700DA3A69D.2631.421328404.111",
        "R_D3C9044B159C496421A96D1C29415B1FCCE8B1F381A6F6000E544FCF3C9C536C",
        "CR_6AFC03E55253E21322FCA663D825D0FB816D6FBD02CA8A1BBA06E585EA971CD4",
        "CD_D6AC1874BCD5D63CA7042355D364CE2F60097897614B47C510C64F3F54102BD1.2647.477027181.1765",
        "C_F9B6A0476E6887A5D60E40E12196773F8286002879AF8BB86E557F0F835DA372",
        "C_D6A6EA1A8D221E89FC673A3598514D55CB598FA3553640D9F77DC1AF20825ECC",
        "C_0E67BB25323DC3EA41359AD7146AF598B2070A0BF4C85FF998893FA100060D77",
        "IL_1652B601D82CAC4E6C305F6382CD81E4E2F42654A09F9F1E0967D6CB0B8A7D26.2709.497786935.291",
        "<H?loB!'",
        "IL_3FC486A266D8D37C7B5172B7B9124D167284D5D0B0CE0425D526DE749372C69E.2727.730436107.284",
        "I_098D2BC6F12E73776192C2458399FA507AEC03E53B212D94397DDD13D12328E0.1538.2152314052.334",
        "I_C6FB0B64E322669245193F1A21E2E91C5D29169A465DB01989DF56A2F069FA5E.2688.590336605.272",
        "CD_403C7DAFD38411FBB7FFA51AD2D0CC5E3462A61D34EA60E279877DCCDC222D62.154.3697064680.620",
        "C_7096A8BBCE5A5666E62F2BE756A73BAC04170E823C4A640FC67EFFB3A1E93458",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2167.1101948841.368",
        "KernelIdleStateChange",
        "CR_524EAE20B913314A702A0EBDD5A10C21EED93FAAED87245845E0CDD9834CDE3F",
        "CD_EB7FB88AC460423B2EF1D915F61B6413B02B51C59DB82123DFBBED2259259B89.2613.2771293115.356",
        "IR_866A032D6B2FE1717CF10787541C36C6A6484D51105E647FF1A0225D5CEBCD96",
        "C_9F5713D830B7304EAD001C42C4E00347E4DE2BD02D139BF16533BAD8D089A9AC",
        "IL_17D3176B80B45C225971C0CE7B70EFCE18CD2EC5541C571A6D5DBC17A808DD04.2693.1348626234.273",
        "CD_901AC56EC8F00C00FBAC686F0B7E1614E207CC1998593D930358F2BBE88093FF.1086.3471727922.503",
        "CR_D2A706123FEDDDB0E412FDF2001A3E316EB3BAC437EDAC79D66B7AE69CAEFF59",
        "CD_F76773412E97B049DE12EF0A4B3FEE352558F541338523F30899C82C78D5CB29.1193.1543984297.611",
        "ROOT\\default#",
        "CD_6F579EB254C9699650FB20FA45C0269233B4CAE417867C0B299C1FFD8E72DEE9.1561.3074149665.1734",
        "CD_E4C1DCFCCD28567D4AA147AE314111F8BAD2049466833D39D09F05CA71256EE6.2617.4112224932.461",
        "I_0A4A8CC499F46BAAE9FF49E6D68BB631793D5F6FAD2719C0358ED54A87A84829.1607.1929139302.263",
        "C_8F541140BC904A73C4879061E4B77E208E8BE6E91CFF96ED3F577FBC75D59D12",
        "IL_AF8C4C517F0723ACC162532458D1167F9378C0599A2476CC4B8A03045BE91BB2.2713.853600938.285",
        "NTSC J",
        "I_E8964CDFA7DE69635727AA89185FD9748094B7B63F743FF416D9E1793F3D43CB.2699.1065667183.269",
        "CD_BF0E7E6384960FEBAFECBC0C4E508C35BD1B9A9D1AB718135E30ECA0E2E30635.2612.4251893689.395",
        "CD_604DFF7349A51C4BF81E539358140729610864A244120CB2ED2FC9F108D71554.1527.3186321320.6493",
        "C_CC1F5625E9A0DC3D96F771F5AFC91B1ADDC767D7F724A3FAC9E8A833EC2694A0",
        "CD_8B9C64D6F0CAE8DF209DA22B283F97ABF536FD5C8E4A2B26F552B4E6C866C08D.1190.2947691819.302",
        "CD_09F918FAD220A296DA8B905DD4636D77F7A42233B3E1893192A0FB626A5F6E0D.2627.379707855.397",
        "CD_EA6FA9B6E7FE95E0A564580CFC4C3385DFDC08BB1FEF82112672242536B4FE3A.2643.591221182.935",
        "EOTWarningZoneSize",
        "CR_C089BE570AD24F592E44F1AB17521DCC9203176DB1FE73F89D8F1D13C2998CF4",
        "CR_335C9D1C30BF96E7BC1FFA98ECADFD675A3EA69829813F59062A99C13DC71866",
        "CD_8844ED1C40CA4036CEF6C65352A66AFC804D998655B7EF864AD1A292AE8AE43C.2610.1696848900.444",
        "C_2365A721345A40AF88F4EB253BCBBADA79A55446181A3DBD55DBB6ACAD9C7FD4",
        "CD_BFE9186C8BADCB7FB42B3434B982F9192C73CCAE78C6F51F4DAAC7017A7F6310.2582.3982654710.537",
        "IR_CE596AFB16970382BA7E02CFF19096D995B70D4F2F08CBEF36E9F7736ACD0903",
        "CD_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416.2007.3118260697.654",
        "CD_B23B95CC62B7FE1710548CD8E1F8EA0575C88F97DB71C9F2CD52A08E2E5CF281.1667.4031264349.594",
        "CD_CB1ECEE1216579C9BA8D257FFFF8A9D0A3ABD699A8CDB2EE7F4BE7CBACBA142C.1555.3197827533.430",
        "CD_0D9683B316E22A1A30127D06C57766F844EEB6AAA1805E5281206E24CF5C1BAE.2389.192565331.3121",
        "C_97BB199CE4D9B053D267D3E21705BC5FEFBBA4BB59B3C0549DB5A62CA7F3BB34",
        "IL_4DA31228536D7EEA690AF1212C94A5B0009BA569104FC10E91F24C9DB87D5B7F.2682.3206376737.279",
        "CR_9226DE8FE74359C1BFD228B1593D6C5E10185F550FF2997587B5AB69BBBB9891",
        "CR_5F07E9A66A14C03CEA70F14BB69F6D6A77D54ED7E0162E55A1871003B04B5B0D",
        "C_72E10357AFA80C4709DA78E39ADBCD46611EBF6A98AE76E1460089057D38D498",
        "CD_1592BFFCE522F75E708AF00D4ECAEEBA5AFE422B12D1211F8015509DB1FF98D6.25.1893769785.776",
        "I_A4B65D3934C7A43FBA7365925E7DFCE76B9A6B9EF2042FD3060D17EEA520D0C5.2727.3776716380.283",
        "CD_79DBC5D293E4FF409F7544F02B31B26B6155CC6162B0636F647BE9661B9D3F16.2759.59138463.303",
        "IL_86613FEBF331CFC4D4E554D201BF08C798863AD94FBE8224B5699C0130B69D40.2689.2886932224.265",
        "CD_BC649CD83C8F14D3E6DEEAA14569857F0C4AE98362B932D81B414999E7D27C7E.2649.1305053175.977",
        "IL_9C4A19B9686F4B6815C3B59681E099E6E6E891B5358293A9D7740A3DFD5FA2FD.2722.3119460678.279",
        "CD_838E75DF6AB0A59C9F2477F1CA99D3050323945F5A9DCAAC9E77A5F334C030A9.2423.121723770.667",
        "CD_08958AE641D88CDE3333B847D49BEA2D42C946BF3924FE9A6259F27FADF6495E.2196.2937824940.353",
        "CD_07175BBA4C96099E611E7C4DB8EA7DEC92B3AEAE5EC6DF957DB2495087F658D2.34.1801291789.491",
        "IL_168FBED585D3E8C959366A9D4A80652F01E991BD5E43D3A0B992DA006675CB5E.2728.2627232315.292",
        "CD_0A3ED80DFF0A7A8EACA9D802C83A2110C6D7BDAB1EFDEE73E88F2ECF8116F7E1.271.931505522.413",
        "CD_B77DB97387F7D955F5A8C046A7F1204A742C057FDAB7B793E00BDB10416B4D6C.75.3320283678.551",
        "IR_8A7831F1CA17EF8E61D09BB610C0C7C9D4C021FCF2E3BBA1310CC9DE1ACD0955",
        "[kKoc",
        "Reference to the RSOP_IEAKPolicySetting.",
        "C_A773BCD0E0C94C33A6AC49E9BCF9D33930925D924E7E273E7C9279E5B4F0D069",
        "CD_86E8A5569DCAE5B400BCD0BC7C48FFAE53C06283B9698944273225E1996E11CF.46.3351232450.496",
        "I_27C627FD56BB3D8776C1AF52C47B613EA485722488C995889338ECEB8F7D5C1B.2688.2788549545.278",
        "C_9AEDC27392ADF6836FDF14F702636E837186EC380D2BECF38CAA9ECF290ACC9F",
        "CR_A7642BB5BD25E38C8455D7FA5B5711E5CBB864E5CBFEC400B5BACCE7267F35B4",
        "C_73A88FDC213676C2ED05DA8525CA5B5530F043E01D7A1BFB77B7406A3243BFEC",
        "KI_4477CA66979EB36A4812EB84064B57FCF10A17595E6D43320B7012BE2EEBF12B",
        "C_08763D9228F09400573FC24C5D922DB07FAC1451AF56200F470342585B439D39",
        "C_C76A2357C563F8327629F6520FC6E0C137736C8DB9CC9339D6CB051EC3BF777F",
        "I_F65757B9154C5EBDDAE70D4285BD74985CCB42751F841E9E56AE020776DD15BB.579.1.61471",
        "SDBUS_DEBUG_INACTIVITY",
        "CD_BF0E7E6384960FEBAFECBC0C4E508C35BD1B9A9D1AB718135E30ECA0E2E30635.2539.4117053823.500",
        "C_C1C40E0073DCACCCA9E7EA6B9CBEF196D5433EC3FB0558455A25F8A16CAF151F",
        "CD_2984FA06B08FEFDAC105BD3D893B7E605A4C10A9504DD67FBC13D12F8FFFF9AF.1079.1684213729.238",
        "I_90F33D88D8C922AB1DE48A3EC751DCAC9FCED8E53BCC7B3B50D78A88A7BBF41C.2676.1575665633.285",
        "CD_EDEEDD03B46D0F2773A9E663CF6F598AFAC1EA95E84EA985D471B4C52491C8C9.1165.3765260470.238",
        "CD_490405DFECEDBAF0721E3F7C59E6937997D0E58587EF6B9AA2763981C1499E86.1616.770281889.255",
        "0x00000001 - Interactive.  OK to interact with user if necessary (i.e. alternate credential requests). ",
        "SystemConfig_V2_Services",
        "Includes non-error cases",
        "CD_92238AD148AC5103CADC28989282F28BCC65BD1B364542DE6EEA1DCD3908F3C7.2387.1436971511.755",
        "CD_7456FDAA562B6B522C0F5D4979880E459C60E9269739279EBBF720AA7C155265.2575.2523711546.717",
        "C_2A9212E5C5A3E7B6904A9AD5755292499E2868895335A7FB104CA7C39F4970DA",
        "a)-BO1",
        "Software ID if event was generated by software",
        "CD_5B62370FE5E6AF64717CE8FFF4DF7EE9BFEC8C45A936A424E7796E87491BE149.267.3345654631.977",
        "C_4081492ECC5429B222FC8969B64FABF570738238CC029A92D9763EE13EADD315",
        "precedence",
        "IL_9B73601771FFF5F56A68732489AF8DFEF9B2C9EDEA5585B99914E3F53FD217A0.2691.2553896704.264",
        "CD_658E0C4B130E8BEBC5BC986586FAD070B6FB394D894B19E03574720111A1BDB5.41.1395592648.282",
        "CD_EEEC9C53357AA474163EF7B420A745739C413E8DF61FA9B4FEF91F245EDBD4F9.2052.1739775655.151",
        "C_82B5DE0B52236FBA718C6012FF3A7FD447F711EA1896FB5FD863DEC9F4CC1877",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2167.2887667098.188",
        "CD_ED2E871CAA85DB91DA82D43856C298DADCDDAA2D7C9D06C8655F1779E6509A4E.34.2696675514.522",
        "CD_B1C946E1263303C29E3017D392A1F8F4869D847328AB0898DACC0D0C3324DDEB.1929.1482486058.330",
        "C_A09DF16E80CB8250C7E8F768EDC2F0DB283873E2BF1AF5FB3DCD5C1A024C9766",
        "I_51D11BF229FB1D15ABABE5E850C4C70DAC3E3C57CE24C8E314204FC6FEE752FC.2387.3502113657.322",
        "C_A4EC63AB97A7B2E5BE0CA4F94F437234A9A9409211D7024967367333BFD09ED9",
        "I_07DB30DAB1AA681F3306873C7D2E2D1AD1EBEA092A587DBEA82803E65EE6A511.2722.2144799345.289",
        "R_E0068A669A82F8C2F714C6C4A97E7D76641D2A61061D9F5753AD2A31EAF1F777.2457.746639331.554",
        "I_69981B246FA8987C6F9F8C845E9321B11F907AE846DBF0F464883716EEB0AA0F.2718.1560789236.275",
        "I_4C7C518953A43F5F3E93A11F1F14A943E39130CF4EDDBF37461B4007D9EAABDF.2694.2363677907.265",
        "C_D7CCE4E0D73E0B597F5CF042DC8B98CF8D09A5704D22B6F528EDA8D7DA64D4E3",
        "C_EC88E4FB4F47B4EF6C316C25497D3AB140E803FDA6F9CF026ED61A7CB8E343ED",
        "C_99526796DD78031C7C2FAD6BF8D8F64825A2F3F58DED87A8E35BA27BB08D1659",
        "CD_20CFEAED94ACDCC3A138A72CB986A84D9FCBF45A8FD6E58CA8EE0387379B9D44.2527.3581920772.514",
        "CD_CFCB33B28A39B81EF633FF01035594C2E36D0526CECA77E54E779ADB28E5A35F.2642.2388573271.1003",
        "CD_3F67FA0166F0C8A24B462CDA43C543F340CD7BDE061E1F57A0BF997BF74531EB.15.236894778.3175",
        "C_D3D129B5A5245E7A5FD20117812F2819444248EEBD3B61B053B30F632CA2A28F",
        "CD_BF60071AF2C3DDF2AED3F8F1BE212D887152724D7DDF24F313DABC672EFA8F5F.1836.856278439.255",
        "CD_B6A3DCDB97084B5AC4FE4FED6FDDF2AC8904E59EA78E2E887EC614E42011F697.2059.2506730865.3406",
        "CD_41C5F66D28A54B11831E9923AC9C75B6E565CD4B23788137E12DA876D6CFE78C.1616.124990215.430",
        "IL_E3D6956C9AC5D82845A5B017A22EF25487755E3C3A9322BE0116D0C7010A0C20.569.1.55789",
        "C_236671D190B5A97B69CF698D7EEC94B834EB78003323F67E90BFA3A62F30C576",
        "C_13091E3C3054BC345002416FA26EA86BA000D8B72D69780944E68B3A51252A0B",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1480.824454245.180",
        "IL_C7241074A1DC4067965AA287DA4D86D47DFCC8023807757F575559735BC60E98.2725.3404076049.272",
        "IL_DE50088336F875798BFB15108F4718270A4C3C350B7499FF903E170E79D0FF76.1015.560389850.303",
        "9549570A64500839E307835DEDF8D3.2728.2331044833.293",
        "C_F6F37666AE13755FCAE2FDAFEECD2EB4BC3DDE98783C006B41BA49C3F5EA37B1",
        "I_C347AC3B2A4F5A130A4DACB00A5BF0B20AB0E474443D2A3992BE252F54C9BFCA.2700.3039249663.268",
        "DayOfWeek",
        " $(,/258;",
        "C_30B3E5C532DACA525204F16B462DDA94D5DC56C6EFFECC42EEFFB60D96905260",
        "CR_BC68F03B4B8F91EBABF0C9EFED9C57ABF605182A4D8760A0679947CF4F1C5F19",
        "CR_04C7F4A052153A1B48405988115DDE17865E47F99CF145973E41882C1B4DF5ED",
        "CD_16D6E45D9DC3C2448BBB5DF12E5A17B75BBAD53607DFAC1CCE27C411AB0AEA61.2045.1.11747",
        "CD_0AD8A0F3F46F174E51800DE07BDC378F9D501A3B9BD6CBD74CF3DDC169D713AE.2620.196209531.1753",
        "CD_312E8FB918C9314F7ECE1D0AEFF3C991EA6CFCEA7AC0F22C8AD00B63FD2877F8.1937.334094036.2013",
        "CD_94F2726A101D2A1E24F4ECAA94319E60322E839528620ABF5ACEF14DF1CEC5F0.2421.2689421973.673",
        "C_1BF30DB26CB9DB35B1AE370E58453AC28553C025227970603A2258585913A130",
        "C_EF6F51F7BFDE90F62A4189D6AF41831500374FCB981FB80A207B392E1EDF6997",
        "I_A0A879B80714A066CA97E84A040B2B5B3C39948C3CB7E7A0FD7AE12BA2EC4DB3.2693.1554327079.266",
        "IL_6DD48BA8C9F115A3A96F3B0385E669764D8C4359B2B9BE931749B764D79904FF.2684.2854956640.276",
        "CD_570AC14B603ED67798F9B0D128B6E9968954B5548539020B86BDF4DFF952FCF6.2569.2206406853.1308",
        "I_9D5066CBE93080A416F70AD224E5BB9B1523CD0C99270F07373B154D073094DE.2721.2257828783.275",
        "C_E8DA4E4A5B4172ED75EC2B701107D8BF6AB896481F2534AE694C3BB5BC84D1F2",
        "CD_5E4C61B5F4870A86C87C8D3A31C679CD8547F13761DF48FEE0C77BF5C516F817.1186.1620012873.352",
        "CD_1A3FB2187E23B82908958F340DD0F5EA4D8685478FCE0E52ADA73DFC114F95DA.2112.4162611070.504",
        "CR_1E7637AE86BE9B7FCC266B24B2671ECCB9515C8B3A1845306C8B4FE9C0197220",
        "CD_F4663152AE3837F467703D43AFBBB6630C1BA3529FA8A88B46C0496F26CBAAD5.67.2097169677.705",
        "C_8A850E2C8F4DFB2AA552BC5AEBACDE4A8D52D7994E741AE80C7E8529557980E5",
        "CD_EAAD7B12E42E8FD5A718C58D486924CE945F2F9D6534A799FEB67D3ED29E5A5B.1783.3509764794.707",
        "I_C25BC9F19751AB676A49B9296B3EE5F1034D441C962E8D7EE188A1914A35404A.2721.266673930.276",
        "SystemCreationClassName",
        "964D91B76357E6B4433ACEDF3FC8804852A3E1F69177ED2.2716.2156018706.274",
        "CR_8B5A6B942AA5416825152D8055EE6894FDA3E8C591F37D309F86A2C72141DDBF",
        "R_61340937E5D8C4D3C9D45CD88D4999E65F9C88FB548157F118E02C98B67C9BD8",
        "I_F313821D4B5D3C6866BC3AF9C502C5112994830A40FC92E84BFB63A7EF6C01D7.2676.1046517479.279",
        "CD_471398BB3B8692315637EDCB5ADCF0C2D1A9A53F4C29EB6AA1D710BBC247EF58.1057.3217802866.792",
        "IL_75152BCD568DB7845972EA624FB84F5F521850310C2ADC6EE7240F0BDD1AC158.2697.1341037536.284",
        "CD_6A23F044A3652D7FC71AC14411C94E256DCCF9AC4805A4A211FBC6A5B34872FD.2379.122026388.709",
        "IL_41CD80BFBD3EF2A72B1311F93D87AFDE77273A97897B7B012F0BFA851DE8E60A.154.1130414801.297",
        "A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "I_0530F08DEA4C0DF8DC605902BB5943B3307E6584BBD662E8DEC5A4AB1806BE05.2696.118254578.277",
        "CD_A6FA651EA245ADD657842B680F4AB592CF67A532F435E181C050F114520982C4.2574.2756504074.1117",
        "I_FF125414713AEFB3BE9B36BF5067B839DE545A44FB053F1F2696CC7ADC1B48DA.2458.1605326835.287",
        "IL_7B708F0EBAA300F444DB0951BD36383EFB8EE1ADB2E2E601E975D6BD67C66815.1051.2348060723.334",
        "C_A41939E0A9F67F9DF2AD8D69CA074CE0921E39A835026C34A18F8B136AFA5974",
        "CD_0C79684F32FD7D7088A468F0BE92EA35ACEB9FB4BBDF74F4E887F74EA9111458.1999.1614619920.424",
        "CD_7F6D7AB071C5599637F51EC5AFFAE51440877864BBF7579093A40694E069604E.2759.2352458638.368",
        "CD_7CFCAFA29BBD6FFB02C23645FB002DEAD6DAB071342C21E927EFA6EAFC277EDC.2511.601179292.1959",
        "C_118A1F47CDEBC2925C5ABD33020B702449ED5C741A93FD969EB4A5E3F92C27C3",
        "IL_CF17F65BDE5D27AA83EF3274842254733535B217A340E131A413188964603E19.867.1.35696",
        "CR_8B9C64D6F0CAE8DF209DA22B283F97ABF536FD5C8E4A2B26F552B4E6C866C08D",
        "I_6A62672AACEA57C9A845CABCFD1E4FE73986B8CD9A6F66FFAA553BA275F4C58E.2699.2089849673.270",
        "CD_729C810203CC3BEFA1C055392DFA457C6E7FCBABF87C7B3F5286CDF28B07E2DD.2631.1227116637.114",
        "CD_841D3DD3F3A7F09379A97AB7745347C579CB951819312FE93085B68F6AB63E24.282.2221907057.880",
        "CR_7B77AAF8CFE9D64F5F55603B6550445F8297D32FDCD8C233B865DA54D2599C12",
        "CD_0E8AE3127572E18A442A470FD92690849C0B09462B19ABA7B3E6660DEABF9827.2744.1680630117.358",
        "CD_EB78AA3AB0AAD297911A31C4BE3F414FA271AE65201757FD6A0D70088B508E8E.1541.3876614604.490",
        "CD_FB60C1AF4D6C46482A1812E45C6387D7979085C05A1408B5980C3DA6770C2B4A.1595.4220938855.785",
        "I_35371A55732F12EB4ECE315E06A158239376594E1F363F248148056862333CA5.2711.4260000552.287",
        "CD_518737FCD9736D06CAEE43D2445A32ADF7BA5172ECE7281110883C447A0C8E05.65.2750755367.608",
        "IL_5731383C22189075E459FF27A228E1DB63438C04B30E05FFA90FB5EAFF3F6A2E.2719.2656196346.278",
        "I_F6D0732D84B4487CB2B86FBC272209B06C6AB389367C037D292654234B7C0CB0.2714.4085526807.274",
        "C_77180C0DD5EEAD25C8B37709B95F5C0C1CEF9AAD0FBF890C140A18A25D2F2525",
        "IR_F8B808D7A9252DEF065341C8B8313C296ECB08839CCF4A94507BC66DA5D3F382",
        "CD_556307783B179705B33BAA318D7984C3930279E4ADB250162C31F9E9AFE4C3AF.2648.1232519371.255",
        "CD_84E66371578A693D41C473FC60626C4635EC771C8D69CABCA347D398F845BB0B.1891.1.40053",
        "R_0359987C58272876B4E70E901F284C82B892B0C1E02B693AD3548D264D28EC8A",
        "CD_D68F73AB1FB8154C504A5507205C927317D2835D17241743599EA4CE5EAFF4CD.1982.2599422448.2735",
        "CD_3AA1CCF33D8CEFD2B415A45A121A40E7E45802CD4F254AAE61989F4AA8DC738A.131.70366155.657",
        "CD_9D9326DBD5B904F2FA39C7A8BD8707BEB4F5A372DD531987B409839FFAE50966.2640.1610253265.260",
        "L`X\\THdP|h@x<Dtpl",
        "C_8C9782D73659C517B4402B8048CDD3A9B1023D31F875B4A3CD21F41348734569",
        "CD_1B410CA2C4AD84A438C361AB2935A45E1487677A7411DBBFAE5D52EC6FB1AD7F.47.1.28772",
        "CD_B6954264FF5C976D13715E002D09B29D1875A7FA2156E8A412284BABE70E33A3.2729.685150804.202",
        "CD_D952138C984CF58C87BDA12F14B85644C3D9BFE8E192BBBA791425FA27B18EDC.2660.1750581991.979",
        "/>eDS",
        "I_E75E1C1A39AEC12A657774CE994C00870C76D5FC4F060E2032E4C98997ABC062.2714.2162800867.284",
        "CD_B18A79A265A485271ADF7583A11B74126B27D0421B9B453C88A99D39E80DF5B2.1085.3907737265.314",
        "IL_F186D6CA8322FBA3B99E9C2D5C4CE6C5528C66DC81653F30BD1D9D7C9DE15402.2675.1646906588.280",
        "CR_2C912D30C6F2C9872585F2917A9F51466121BD73DCC0AA6A9A6D8C6362427472",
        "CD_70E019181198CB42C1737293D79C34B6386D677E681DFCF2E02DF64B188202F0.2375.920144954.4481",
        "IL_109FF4DB06F1B7E43B4FFA991E46E1AC64566587215453FAD438A316C11699CC.936.1.74580",
        "CD_C02C41AB4846F97931E5D01FBF12A4A1A5B3CB06D088BD1C51C3165A032FC9C8.270.356590742.570",
        "CR_31682C5C22F201C41AC25516223A172B2BE8829C78A0BC224059702D9FA339D4",
        "C_7CFCAFA29BBD6FFB02C23645FB002DEAD6DAB071342C21E927EFA6EAFC277EDC",
        "CD_31B243F60B661B4A8A09FB08C57077A0B3874EE963301B97C84DEB1A7C98605B.2601.3530912341.1546",
        "CD_567A5780A80E396C0983EB16985C38ECB3908CF71E7B109F7F8365635205A7AB.186.4017702073.1901",
        "WIN98",
        "IL_41AE0E8A27F69BB81713327447DFEB3E4D47E6C961601828958257151B049D62.1617.2728978779.280",
        "SuperclassName",
        "CD_BE8F1260CC7D3D8D65E679E452849F43342AC07EE5E67F79C0602AEF0D925B48.1087.2912648247.867",
        "CIM_Error.MessageArguments",
        "C_747F5E7C0B1BAF697DD9EBC1AF5BAEFED7039E2B0FA9DB258BB8C709D82F4D62",
        "IL_3268E444486CF41D44EDA29FA5B3DA017B52B119BB59F88408C204F3FC321782.2735.1804944086.274",
        "I_2E857E8085C23F260E4A5714870E085AF1A5EB43D390A00657752F8ABAC8FA75.2459.2781981217.352",
        "C_FDBDC2AD47D9111246F3C36A212EEF164FF61E31A8B334E0CB50FB22BA107100",
        "IL_F085035129E8BD20AA503C90B65BF6D8CC18D4928F9D39B5A51D3A8636249864.2689.68401602.260",
        "CD_AE52A362AB5B79D830C3D5CD0FC2F47EC119DEA073DF82CDDFBD53D1F7495A1A.1936.823757874.231",
        "IL_8578BE6993BF2DE81CE627FFE447487EEE109C3A0FC35A58947773C4D5F2AAC9.2694.2757500751.274",
        "C_25D6DE4F10F10C9622833D068798F50E89401E52F3D552BA53470C9A0F55267B",
        "C_B6CEC77857253E4D66AFB39AE432C9A262BFEB17666CC3330EEE5CA9EE49D1E9",
        "CD_4C30D2B0F562E7ECB133EDD52DE8120D85640B338DF07115C2057AA8BFDCC64E.2744.3994945207.359",
        "IL_FF67FEDFFD38F312B71A830870D553566D5CDB2EA2F987B7CC74F73DE042F18C.2700.1341341340.290",
        "PackageLocation",
        "object:MSNdis_PortChar",
        "IL_07A418411914F2D221BFADD7617A282083154373B42BD48DCA9C0A95AA3F2E8C.2686.251441978.272",
        "CD_4720AF4CA174274F71D8038B37E58001F7A92E2A83E49C05ABD2C15725C10921.2421.1244802582.365",
        "T-36!N",
        "CD_490405DFECEDBAF0721E3F7C59E6937997D0E58587EF6B9AA2763981C1499E86.2196.3295525614.372",
        "IL_FBBA66A2A301552819D7971E09B8EE04666A792BCCAF9A2CFBE49A64DE51F4E2.2727.2699555294.287",
        "R_92238AD148AC5103CADC28989282F28BCC65BD1B364542DE6EEA1DCD3908F3C7",
        "CD_983B4451C80CBF8C28AA7D3AE44B31F386CD9D49DCF52E720114DECC8C984041.2612.2979031550.356",
        "CD_68B50ADFA4EADE3DE4E3425660F192D734ACA76704D8243D430424BFC5680E0C.1560.4197036034.413",
        "C_777909665755481973F85E4F05948A22C8B9B138E770DF765F9B0B2561A71FAB",
        "IL_7DE0494C6D6A0D37A15EFBDC4BC86C298D25E6372DD287889B444A33502007BE.2703.1615104207.287",
        "IL_89F00A61FD174515DDC1800FF69D136D37611FA6ABE1227CD28EC2795014ECD8.2704.413117232.286",
        "IL_33686629586F15213BEEDADAA933E939DE78BC842BA4B13C6CF85A4366271550.2720.4049715834.273",
        "-3'o]WfH0`i*K",
        "IL_E04E3B5FFCA1FC032F7C5763F72735E060D12D3EEB56B8C6A435DA9CC911DB0B.2682.2097571257.295",
        "I_192AEF8A3D6A39061991F2254BC36EF440E5040B4F97A934BB327ECAD687AEF7.2503.3307781390.330",
        "CD_3DFF91AF50FCE1887E36B1997DC21FA068E0AE4638B74BBFAAD315E88692001F.2666.1810723317.882",
        "IL_F58EA9A4248FB79DDBF112DB65B98127C9A78FF4DF9FC34835E8B50C808C985B.1740.2918443704.280",
        "IL_22311D477D8BB476DB364B8EFB13C2770461078F73D1937E1045CAAA7594A1F4.1016.76579939.322",
        "C_25951CCF498736F09F8CDC3085BB276C2817DE47EF5312A0F051C1AC3B67B2CE",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.304.1222916123.368",
        "CD_64457EF5CB2213C8C7821D96680776498F2D259D55C9A6F7B9175A130435CF08.2639.779490251.1460",
        "IL_19E57369527D4B1D06F7B62EA4740710580A7EE3221F927586AA3C452A7CD5DA.1478.1775475337.253",
        "R_93D683378335762C284317F9836C36B73320C30A8A815437365079222449D208",
        "CR_BCFFCC5A22D2740C320A7FDB3EAAC4A750026811E61430ADA48FBA2937496A0E",
        "IL_B890A69DD6A6A1793A78448FF5EF434D2AB04D3D34D2D1B12E9A02E877CA8847.2764.830831791.294",
        "CD_0454DDDA9AB999B5E05A2F468BA888F0D0794E6BA1EBDCCF2A4463EC03258CC6.2005.1569115060.1610",
        "CD_A107EAA2D6C2A698530A8358D207D9A3B8B427F7073C80586F1820045E4C35C1.154.577888407.579",
        "I_C6695DB36E1BFC2634FC6EE947808674BAE92D29FC531433E45B528F1E959472.2699.2174159664.281",
        "CR_4D801D24EB7B11E677EAD4F9CF2C38B141666B7557B0420D554E864D72C8EE9E",
        "CD_A552F567B8A5F7AFC0DE40BEA66707D69F4D09E38B49B8EFD3AC625219B7FD45.2648.1097678059.1234",
        "CD_5804C21BF439D9B2A4A434019B49CA7642F87CD45917B950E9BCC9A16634FB55.2547.478129839.1015",
        "CD_75A8E9BDDDA51B5D1D891C00799220E5C1C3A6CF1F951600FBF99252804E2F0C.2423.361559547.687",
        "I_621C1D2820FEF6D532F75DA12683DDC0C2FB03AF4DFE46D049135A28268B973A.137.3164472942.302",
        "I_7FBDDBAE6CB96D89200C669496CB007AB6F15C0DD26E01372172898D662E64E9.2684.1332104763.288",
        "CD_A96812E0A2895AED486061635646F9CE6BE6E74163A4F9C4D4D988FEA144F286.216.4212096183.815",
        "CD_89EF5B0E6A39F2A2970E3E102F92EF0C67087374518D87E3376022DE86BFE766.131.2287292347.699",
        "IL_6542ADDBF701A825E7688F7B39144898AF264C03328F8804F4006C9467FD8A05.2687.469798121.264",
        "CD_8C6449E2DF9D42E8B328C8B95C19DA35BA5DD1B3E90C6134AD1B5E625248E2F0.2747.1354201944.1477",
        "Used Space",
        "CD_9E7A3EDE33ECA9119BCEA76C74DC7F82F81BD50C5633DBA89810B055F180A2DE.183.359834601.451",
        "C_557539563EFEA085A51C933372B76B0DBDD1D1003F13AE16F6DC6CC216910E08",
        "C_A20285D23E76CAA1A5AA4BB56A34542AD06AD62940A11046E81BFE8B238005B3",
        "I_AF25D8805F3B512CE077E12B9EC07A7664A32A328B0F1BF77828BC5BA1C8AEBC.1187.3049439660.376",
        "C_ADECB48EEF41EBFB1D5570217FF2A1BA19BC73CECF67D875589C0486F35636B9",
        " $(,04",
        "C_B6BF4F280E8F41D5C682A73285BD377F4F1516D4792C5D8362BF30684045009A",
        "DriverCompletionRoutine",
        "CD_8891BD8DABD7A4972A1F592FEFF5B8637D8A570DD552CBD215E4C520765B2392.1187.1843926204.386",
        "CR_F2BFF6BFCB90EF8E1F9A2F6D9E763484AD0F1C907D1A496729D242E8963BD098",
        "C_33C83E24335F11B7A27CFBC9072CAE158BC16D1658846AACE3355B54CBA9989F",
        "CD_65E8E46531523AFACBCA9F72515F99ABBC1E45654E781033384C13AD4219C6E3.1930.3063021624.337",
        "I_B7B880A93C39F63D4E8650CD4B691C3EA20E6F72F0772B8430D79E1281A08036.2697.4148879673.274",
        "CD_AD28C82889667A5985FA157872F7F42C3CF0F9FD284883BEB8BA71DEFF026FBB.1829.2311947344.407",
        "R_C8D0F277D7F7D59AF0E214825AC68160FC59DD15097C20883A4D4AAFF0736D39",
        "CD_366404C6BBC789A7EE3D5ACCDE9C5AB09583CC8BC05AB7F7F7498213BA102D4C.1014.1086641567.537",
        "ProgIdHint",
        "CD_E041C52D2D9760641E834D8EFDCA76888D007C61B5E01BBAA13A8494549AD77A.1852.1.162326",
        "Service",
        "Volume has mount points",
        "CR_727AB02E08361F6EF440AC44925D5B278206F12872C50300A3384BEB284B8D55",
        "CD_19D64438B52BB0867C48D699E88A863202CAB587F93FF7433FDE4846517B3774.1382.3887824583.2116",
        "I_A29447EA71172AC3A9DDA9695F8B16EF405755D65D78306F6C7FC851412AC682.2699.3516663761.274",
        "CD_8B69999466A9B0AA953868559581679FA4866B51DCA8E619279463BF323E73B7.1153.2810256203.1235",
        "C_9398EE9389657B6A830EB223CFE8021EDA6EBF0AE7CE6FA1ECC3991C40D9983D",
        "I_7F553939F93F367C3B9A038FAC17470D211306E4916E9FE38A48EF980CC21590.2680.3142390935.284",
        "I_D339E7A7C30AEB42A22E941152524A541BA85E4B5350F12989EDD8AD7C9C7DB3.2720.1499037169.289",
        "R_5E26522E72CD626FE622D6939EEBC8B063B5698BADD88171A20ABE64FE2C3B02",
        "IL_F5C01B67224A8282D3A2AD3E41AF33CCE9A62FB202D88AB9E1355C99C2951A37.1462.870520363.409",
        "CD_15DD3B0DCF2819EDB87C4363412C3F99792BF1AFEF4BDC92585A3BCD2CD95F12.41.1826676533.493",
        "I_667EA58A0484423AFFEC003062277643E0261EC15CCFCFA44CCDE83A07A16ACF.2705.225742283.289",
        "CD_C0C743A36644538406F13B21A67062ECC3AC599CBDDB4F077787EC27F2AC44C6.279.2734411151.2451",
        "<@DHLPTX\\`",
        "I_2D8418235BCBF259EC91563363DBFB6FB3EE7397239BA3B0C0CE50575372C840.2705.1694209106.294",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1049.4028024937.180",
        "CR_E367B12CF12DEB20E317AE3B028692F15635A4C17B759C34D4B8D5D615A27793",
        "I_309FE57B0AB30723A7D25C630AEA84325DAEDA17B9713727A9184623284A496F.2718.443886145.273",
        "CD_5D07EFD0154EDE42BE53FB8CF6E91224DB5D0700E20DD6C51DC04AF1C039C10A.1129.465986986.1679",
        "IL_6EC515021E47E1C6933695387E9D1F29129F6BAB7D2893E254DF8EA2208F30B6.2736.1542477286.283",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1164.2705033010.180",
        "CD_F27728D32A3636F45280AD3F71C73821FAB17D765ED15BCD09B89B7007E5475A.214.3762346128.1154",
        "CD_0427B3D7710F368D831E2478F76F011E2ADE4882C334EE5ECDBD3047B1FDDE39.101.3186514016.1543",
        "IL_8855C751C2BC57C20DBBDF24CDD46E4DDEC1D1CBA77D9AB17AB79C2AE000065E.2694.2635998675.274",
        "CD_C811BCFC8FA021E0ED24EAF2AB4D586D8740EFE02D81CF2A5551BE06CCCF53EA.2423.1096978807.355",
        "Executable",
        "CD_8A00FF3E28E2491BD7475BE0DBBFA1E38AE556F30FA37A400006A8673FBC26B8.1154.2730603220.311",
        "IL_0CEC83697CE6AC69E736870BE9FFA3A870F550BEB17321CAB1A64AF57014B2E6.2683.266920652.281",
        "IL_692596727A249B1A3EFAB222D026A12F1773B5DA1F8DB7A7F844A0179E73C0B9.1936.4131941892.320",
        "C_C11E0B2968F07899C3C15A08181C55EA86BBBF2FCDF1D89855EC8855E08BA914",
        "CD_A810B8BCB28B4593289F5B14287BCC8F9F33A8E5A5BE4903C9226502B53FB3AA.154.2831144309.1273",
        "ReturnValue",
        "C_BBCB50A3E35BB9672B8B458A16DD242DDDDEA6BED48E25ABA8EEF2B0E49A9B3E",
        "C_3079E8CD6D46EEF3BB8C478A433B73D0DE2B5FE05E7E7BFC923B4F14ACB286EB",
        "CD_7D3C758EE8FB44B72514B3588512147905DB19A0456725381223C5A506626F7A.250.2423466259.868",
        "0804CB2A3406B4CA2DC92297E79DEEE6E8BA2BD0D28FC",
        "C1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855",
        "C_0F823E129BF22EE50D23DA52951787D623D48F86E765838C92011DD9DC1A6F31",
        "I_0B4B060C1AFE18E95F30F5B12FC33C3FA53B95E1B357494DF4F9FFBECF865BE7.2678.845714409.283",
        "CD_9360A998406CA5A9FBE21BE25205239B5C71A89280B329F4858B0132F126E6A5.2583.4033471826.268",
        "Win32_LocalTime",
        "CD_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937.1135.771122698.3540",
        "CD_33B5610D2FA7FFB4F03D69D80739EE47F91550643A1F839B5E730B9BC59F3A9F.1973.717142389.1340",
        "C_693EF552E8CAE369E34FCB40434845C8767F2347237F1BB15463E74153D4460A",
        "CD_48D4F256702BE1E23719E035364C5226D32D66BD4161C39CF31B8494F0ADE28B.1994.1.12916",
        "CD_20C200D9E838157679E42B001B4147A35D03B45050CB643ED29839B5C1F1E6F1.153.1470894424.3567",
        "C_039809E5E8F2D8DFE19D9ECE6F2163A46417107911DAA316E07384C24125AC9C",
        "CD_34069A8F0B605CD9C68FBE546D59E0558CACF01AED052259604DFBDF9878FC93.2388.1122944659.296",
        "CD_7096A8BBCE5A5666E62F2BE756A73BAC04170E823C4A640FC67EFFB3A1E93458.1606.2912025461.424",
        "|h`\\PtH8TX",
        "UdpIp_V1_TypeGroup1",
        "CD_C6289081C8AB688F844FF931CF917B4DD7080FB5ABF4C1BADA0FD2591FE183FD.1.117710330.173",
        "C_64BFF80BB1E6E3B33E8CEA6C6D45DECFDC685BFA89D8A317B5D3C5C82668E6FB",
        "Sub-Entries",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2117.2415033528.368",
        "CreateNewId",
        "CD_A08E07C4C18BB43F9FD19B5E02B121082F63046F918F76002425E185ED85C61F.2584.3106171528.406",
        "IL_DA3A87092C237FFCADC5613E7D4E1F15D3F1C899206626A2E64A51A53F4EA3B6.2711.1025470266.302",
        "I_7314B37EE7A9CD5E94179CFEF93B73A543402E7B7C41960FE84DD1621D330BCB.2679.3147255445.283",
        "CD_3D2C236C15D0F323FB188363066C67D486CC3E23871B0BEF2C84284D4CE5E729.1734.3377841290.349",
        "CR_0685F0E7DE4E9ADE69B83CB6CC4B69291D69C22AD0E71A095A2E4AEBC8EC8B85",
        "CD_7CC43E62129EA8E069413352EDA51322B29638C926449AF4B7513D9FD22855D8.2631.527672668.2233",
        "I_5AA238D8067F4EA12DEFEDB4E026F4DA107DFD5E36EDA87F4AFD56D7A92521D9.2689.4128263844.271",
        "I_2E8D62D402E687172231C21EEE5CB0B79DED3DB642A2C098C8F0E071F555F6DD.1015.3929913654.339",
        "IL_3FAA432CDA0ECDBF5B5BA3CE21BF40A1D5AF8CB51D13C56F7E679CE547CCFCAE.2727.2657653726.291",
        "CD_30030CB54ABE2607519AFE5F5B291553C4CBCA712D0343FC3CCA099002D9033C.211.3394300234.230",
        "Win32_OfflineFilesChangeInfo",
        "CD_6968F059690BE0A04B4112ABC6C4C57DE63B9F09D85ED5D4E01D06DF70B5CB92.1336.1390996348.2538",
        "KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D",
        "Information",
        "IL_C37EDF4D99838173F025C5008B0F6CFC7E5A06EA0D6BBF7D98A5134BB48D14F0.2729.3534511313.284",
        "CR_74BDAD13EFC25BDDDA03231B2D3B39ABD8B91202277E5C78F927E74B85FE75B7",
        "CD_E340FB8EB4DB3A4F1ED0804CB2A3406B4CA2DC92297E79DEEE6E8BA2BD0D28FC.1807.3798262489.428",
        "CD_2DFD705737CCA1D522B20CA726C52DA2B2D27D5AFDDBDB8AFBAD6D71A22D7026.1466.1386221683.2026",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.100.1101669734.180",
        "CD_115C2C7C875DAA2D80858EAB217D4BA6077F4CCDF9EB9B75A301CD68389427E6.2003.615912051.545",
        "IL_02E3B8C824FD0B9C15B4D49AB84CF02FA38E02CAF699DC3CBDCBB2D79F3025DF.1596.3726577277.263",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1620.401451610.180",
        "CD_79DBC5D293E4FF409F7544F02B31B26B6155CC6162B0636F647BE9661B9D3F16.2420.1140646861.367",
        "RSOP_IELinkItem",
        "I_C56E076607DA66CC2D5BF703B6E28AE59B1F022415C3A0A94DBA13B643B4EDA5.2722.3765280269.272",
        "NS_BC80BE7D5DB1D6AEE04CDD659B5E42DADD34C5AFCCF4DD54190EDD6620FD1AEE",
        "CD_0A8460FC46C2746BD21F545AC61155DB7CAC54BE761314A2A7E02864EFA1BFE6.1523.1718622983.1774",
        "I_ED746A3FDF39631AFCFCB83BD5778F1A96B036DFB3E0812414D455C7679E30B3.2708.2164274124.284",
        "IR_548C7B8CAA43CC9635C7EFD11A316C9E16085EF464E2F7DF7BF493D60EC389A2",
        "IL_197DAC10B68BFC0E35416353F8180CDED2EE347023C8746DDED2416EF90BA443.2698.3060721616.273",
        "MSFC_EventBuffer",
        "CD_E284DDF7F9BBC191C804CE3AADDF197ECFC83C10E016C1AED712528DDDFB1F1C.2055.3303187038.596",
        "C_4C26D2BE83497715CCF0A765E00CDE590BAFFBAC1830AA3DBCBEFFDF01BCDBCF",
        "IL_993D150D0C9C8AECC30617FB0FF207B447C72B60CB9837CA152ECAA0421F80ED.533.1.143317",
        "CD_60B2C39E9389EC16D58497FA8BDBAF35697A8853CDA423F037ECBE4502882230.275.1761010208.639",
        "IL_7BA06B043DD4F1C4BC3ACB7E4C10A6223E3DA1067522BFF187585B0486BDFDF7.1354.3298274962.380",
        "Win32_TSSystemInfo",
        "I_90E068D44393D7BB2A2DCBF3BD9EE2F9187E027BFC63E373D546D08CCCB3E5C3.2469.135763270.332",
        "IL_B8A661C1D622FBC77353C6283693E0067AFF965D515809B24B4E9FF26EFC7D7E.603.1.105338",
        "IR_F8FCE999F676B97138370A6A20A4D583B46736B2574244A4CB6BE68177264A64",
        "LrgObj",
        "I_D8AFD32452F445AFB78E038E1748BAC7F8865646D1D4329C8A673315241ED6B6.2677.875791444.288",
        "CD_1B2F7F9B30B8E3085F6FFF8AD6831B1EC53004667DF11651EE5F82516EC047F3.2559.1625771698.688",
        "@DHLPTX\\",
        "CD_DC75EB8D61AF59F2FEB9BAFCC51C26F93B19442C9F5E9F7C071B8627E9152155.264.2233918616.546",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2195.4214280841.368",
        "C_8DD4117F0A6CA8322CEA3B2EE2E937FF189016C7342D650B227DA4C96B557695",
        "IL_EFB5B9C1041CCF3E7FA66D1E6B52EA2AE3427BAC920EF4D8C60CA20D6D14F1A0.1015.269104203.318",
        "I_888C6EE3954559B72290471372E0D995703D38B5D600D88F2D8BC8ECF4213530.2690.24045274.260",
        "IR_C49F79BDFAD7EE475A1EB6E0C0C70CB5BCCC4C39035FC619BE1A57A531F5B2AF",
        "D4BE880FD273F587.2708.1262655379.292",
        "IL_B47895D31D7B0DD3EF96F56CFE7BE3730B8DACBDD6D2AD770D7F62C1CB93C6A9.2699.2723658078.270",
        "uint16",
        "I_A64FF6D9485FD6D15DE809633A07C392AB1849ADDA1776BFA328E8E410267A1C.1017.1488334423.320",
        "CD_9306698C01F89BF0B51534BC38CEB10F9556344574338B9E17B1FD19E593FD78.1241.728260564.226",
        "CD_3D48C23EFF67A2389D2D6B76CFDE53ED48EE3978CE73F111DBA847C2A8B63248.1958.4214887485.595",
        "R_805206C561285684F42D728C26661B4F548F5E54321B06170E013CB108084182",
        "FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "CD_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937.100.563465288.454",
        "CD_FC64B24C83B6ED14EEC6C8C71996B5B6C6A9B3D7C971730102A87962981FF379.97.1564467915.689",
        "MSNdis_TransmitsOk",
        "C_15BEF6DF5E996A00A5E54D9D43780EA4F3A24C6AA9148C8B53886E72522A6FAF",
        "MSNT_CKCLTraceProvider",
        "CD_30AF15919E81B988983A5B979DE55F3F2889A968ADB0D35777060C9D66C4FFDD.2586.2706529589.1024",
        "C_0F0246B85DFB21465F504A8F9FDE4CE80FA27F918FC6B2E414038FC937B02771",
        "IL_EA4ACC1C83A3FACD216DD4D4AE09BD81AEC8CE31C188BC51B0CBE5ACC0B6F6A4.1778.208163282.311",
        "R_962C6E7C58B97BBA37F5179D96ED3E00EE4A4FC20E4C3C3A3312674F9F7C4195",
        "u{`fW",
        "90EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "R_6BBD8D6683BACFE6BAE34F5296AECDA83652862AACA62B34C9896E064E0A6263.1352.2833798796.532",
        "C_BB21B74C59017FA9490DAC0AC5AD9CF6A59C120618360720FB0ED08A9D1125FE",
        "BSDUNIX",
        "C_73447B89194EA500995C2E5AA4E3BE7AE297170CB5846782DDA43B3F2BA77D09",
        "IL_E48354CF9994B34400EA4AA38B99080638833EC0EDA154851BDD5AEA6DCF15DD.2684.717480104.264",
        "OldTag",
        "IL_A17BA0E1DCC388EA3B476E531DCE09878B9549570A64500839E307835DEDF8D3.2728.956016752.293",
        "CR_050953C58E97660582926667045FD157390A1B7EE9E1CDFCB3DD57BDA1E5B26D",
        "I_2F761594CAC3F9266B7DD197C02B2EDC3C5FF865D303A754EEB0D076FDE2A3EA.2704.842580535.281",
        "Multiple adapters have a matching WWN",
        "CD_F9D4723921ADF841BA7CC65756244CF775FD9B7C648EEDAFF1E2DDD459957AE2.1136.2801602703.466",
        "CR_DA6435B5A6AFDE1EA49B0F1FA576B2FE264B6CCD6A9F163C86C6173386BDC535",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.3885814277.180",
        "I_D9A0209571FD2C5540CDD853A1D5AB1666E9E4A2C7552E51C459E189906FC38F.2718.1607799817.282",
        "IL_49314AB51FE3B6A500373EC6B50D9C3B86481EAAEF87D2760A740165310CD37F.313.2500316528.332",
        "C_10549F8F6A0C1E0A975F931BF6E1962F49CF18068F6079CD179A794A32D030D5",
        "I_05F9DE9C62C7626142F8FA4D6504D398EBE27021BEEB74B678C8DC359DBA5A85.2728.932839526.300",
        "CR_642EBC67FF61EFF34AD21679C796E3CB07BEBCB918B03A2FC1E43AD624F651E4",
        "CD_0FB0A8E86C1430EE0BB7D412F66362E6E788646DB733ACDB85AE2E440B7F37A4.1172.243002396.245",
        "IL_0964723C753BA4EAE8CBD4D341C1289FC8793710EF111F167C654FA5D5EFC891.2685.4205068524.269",
        "I_3FAA432CDA0ECDBF5B5BA3CE21BF40A1D5AF8CB51D13C56F7E679CE547CCFCAE.2727.2657653726.291",
        "73BF61B7E73A46E75A7E7F64.2688.2121592787.271",
        "D654416B8121FB37E.2039.1982116638.2148",
        "CD_A107EAA2D6C2A698530A8358D207D9A3B8B427F7073C80586F1820045E4C35C1.31.1059774604.414",
        "IL_2167ABD6DFE6B00EE53C057BA8DBCC8AFF1F809C1466D5A109DAD9E407A9E430.2701.2076800301.268",
        "CR_6848AE51A98A2B17FB898D6D0191CAAF3F4DD71444D2EA05FC34F19E3A2898C8",
        "CD_8771AE8CEBB5614A0203ECA1F5690F7C9DE50BB712DED367D1D2978F0B190194.34.3868143647.476",
        "Win32_LogicalFileGroup",
        "I_54275311190E6AF40C7E1ECA677C26F666E21555D2DB9537A0D6F20293E6715D.2749.3296711995.350",
        "I_0F1BBB21A228CE82C5C2058AE50D21F55892BDF5343CF705176C26EA1F33161F.2720.2632064215.277",
        "CD_16D6E45D9DC3C2448BBB5DF12E5A17B75BBAD53607DFAC1CCE27C411AB0AEA61.1939.2609311141.4506",
        "I_A3BFBEBE234E4658CAF2F881D4107E925EE23BCFF10DB187E30DCBCBC937403E.1088.1407077645.276",
        "r036{",
        "CD_54300AC69CD22DF016BB3F2AF97DBCDBD81A1D838D9588007B40A7B95D4F9C12.2658.889478225.268",
        "C_6207FC985B813296446B1804CB375DB5F534F2ECBDB07E00035AFBECB15FD3A9",
        "IL_06D6FB193493B2B3AB18566CA818BD25528D88E2A3D498D0E28DC2460169A56A.2485.3224131757.325",
        "CD_4FD2270AA7CC321848B51530B7A77A9E39B5486B55CE0C09A2B597A1F1FCE1E6.291.1515930314.5654",
        "CD_57999785729C617E0940F08A69B76DE9550166D43EEA37880AE2D6FC23FB5859.1074.2128954821.363",
        "C_034DC06A7BA24821E2AA8A94509CDB2B6BBA02EFDD0801948AE379D7CD46E5AA",
        "IL_FC305F967E3051E61DF9E8F5A82345688238612521C583A1D5362428669BB908.129.2974503829.288",
        "C_DF85153FB4444BFC904B433D6CDD9675CBBAF1556A07F0E7E082E4B4F8C33E3A",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.4071434985.226",
        "ScanPurgeItemsAfterDelay",
        "IL_7D433C11F117D65356D87621F3C78A695A4B76649EFF95CE7BAA866F2777A5FE.1016.451524509.308",
        "CD_A20285D23E76CAA1A5AA4BB56A34542AD06AD62940A11046E81BFE8B238005B3.2106.2619742455.325",
        "C_DA8E15B78CFB4F9B2BE10A65957A921FD8C6894DA0C2CF425B855C7658787703",
        "FileIo_V0",
        "CD_74BDAD13EFC25BDDDA03231B2D3B39ABD8B91202277E5C78F927E74B85FE75B7.1.3322736739.186",
        "CD_B918DF96A5E2671338B0CC8D372C94DDC6B8A082386425CAE7DFA7AEFF9B8DAC.281.2860873234.2837",
        "I_5BD66425ADBBF1EADDC5A640A4D6F8DF52912D9E3B1E43EA3B981F8ADCF90FD4.2690.87331798.270",
        "R_3B027024E6516FD39D8604E00D744989BABF68DA1CBC61E705E35A6F821879DA.2512.952812338.536",
        "C_E2C33C7E3A117410A8114CDA2C8E0FBB300821B704E3CE1129E5FF6AEAF52EAC",
        "C_F1347BA1CA828B62CD4725A7646B494D45700B0D8C277BE92E43FB714FB5C9D4",
        "I_C9899EE7C88136CAE5CC186EA23048D146978219B477D0F9D6FAF94E760ED324.2724.1834318119.287",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.297.3516843711.368",
        "CD_A1DF2352D44EE2A7A518D708DCD1479E935C9B8906C0915308DC02E74A1C6BEE.2530.3635604453.396",
        "C_1802477891179DF8EC75B73A6EBAB451AF75EE927AFC82B42A82BB6A29F7E4F7",
        "R_69877F5A87CC7FBB985F74996FECF28AE22D3519976A9A7BA6E0601524FF4CAC.1617.2259789950.528",
        "CD_40D59F896F1B4CD78A547B4E482D63447FD0237E73E28B731E2036C3CEB6A1F6.2369.4172407426.1537",
        "C_B375528E053EA0FB3757BF45E457E25A87BD55DE51CAC5F0670A466CE3A30962",
        "PnP Device Id for the device. This property is useful for mapping from the wmi namespace to the cimv2 namespace classes using the view provider",
        "CD_8DEE23D90020D3105727A34AEE73EEC049EBD7BD948439E6E245580A6ADC8236.1594.3530176905.702",
        "C_6EA073B72C41358639D5A837A10A1E67FEA90E42764DE7ACC35A8F4BB14543A5",
        "R_33AFC5533FEF2AB8957C705077D2CB2428067503BF4A8D79697DC98C53B8A138",
        "CD_7679A6A4DB35275227614187F15B694A07842EA06C2B8D3D34850D990649BC73.1580.925689753.1486",
        "IL_2E80276538AA4A00A260C41CEC3C415479FEE58B25FBF5430F9809C7471D7E0F.2690.1128273457.266",
        "TX\\|`dhl",
        "CD_4477CA66979EB36A4812EB84064B57FCF10A17595E6D43320B7012BE2EEBF12B.10.519290734.246",
        "CR_EC97D00816B4530E92B0346A6B6B453699A71F2B879F99F794A6FF9189BD53FF",
        "CD_039809E5E8F2D8DFE19D9ECE6F2163A46417107911DAA316E07384C24125AC9C.1964.2217380107.7975",
        "I_6E14D2561FA1BFB1620E2B19A2DDB814D3F1CA805CC531AAB6D243D461E64EB4.2685.2599420907.281",
        "CD_2A005D230FB555A5235DADB2795F61BC8E5EA1E4A7D7294F45B45D0B7EECC847.2556.55597243.498",
        "CD_E241A982292C9628611468FB40BE60D4CC1B723333EE25A7584E871FE9DA753E.2762.695672020.428",
        "CD_B9845544951A3B035DE4DE7FD4E415EC9B667E42A6D89461752D201AF24E4FC6.1984.1.22234",
        "CD_49164C7AB89E7FE6DA81BECB881C8C4D65839FBBD034989674E74CAE234E85F7.75.1724504165.535",
        "CD_046B79FF8FEA26EEFB72057DF7A67A7CB75727CCDA1025821CA0170FD33BCD6E.2575.1223606434.220",
        "CD_30A8BABCE38054F1FCE6452E0F348F3D9BA89959F67A425751C931560042A8E5.1516.1370099213.241",
        "IL_8ECEB18F5D5956ADBB92C60B6BBF657386F0BE596CEC9435AABD185EAE1B6B42.1352.3758887347.256",
        "I_5300381FDD8CA68530BF42F687579F4795E6FAE9D6D60CF7B02015DD6EAA0272.2642.2578764341.263",
        "R_4274C87DD763EAFD68CB5D56AC30576722978B71BAE02D4F3CA2BD53BD6A6928.2451.2779238806.554",
        "<`@|hDPpHX",
        "CD_BFBF08D260C8FECEBAF19607A00A35F41F33A4C2C6DC4305BB89B11A0D600AB6.1581.566524340.411",
        "CD_0B828B775002386EA7D486F856B8AC15F7AACBE2A527B2D34EF30FCC6D53F77D.1570.356552677.752",
        "IL_AF97512AAF88C1E490EA8C8CF424A8C0BF908E966E533AC4E05645CBCE51FD64.1015.3880470037.299",
        "CD_F9AF1E0E64A5F88E91652C8C44C8A5E0B35B46F211646049A589ADDFD182AD4B.1740.1209414626.744",
        "CD_DBBAB694252A8FA02CC578AF6A541FC3E6E5ABF42798173F7194B1B5ACA4AE8A.2083.3452098432.3282",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2426.34478244.180",
        "CD_E7A77CFEB598AEF3D1193E3884EBB6EE52359457054F97DF1C2F8041CD6E1C7F.2674.2512240708.1382",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1188.4208850230.211",
        "CD_6D1FE252E44FF3546ECC7BED576DC3967B39474BC0CE652BF027660AF117633A.144.1533296638.576",
        "C_B5C20DFC0112AE561EF6233E9F943AE819AAD596DC3786CFC0B88DA112FDEA2D",
        "CR_161D7B1F7DD552C780B6CD4154D40388F29AC0271BBCB7991C59595342903A38",
        "`48t<@DHLPTX\\|",
        "CD_4981A3BB969F4ED9382A86F274047A36B2A04D2A53526DFA477217266B033E1E.137.3193516159.2114",
        "CD_62D05C4ECF40774F04063E6FDE0B1A6CE4B671271358A09E1596B6EBA1E2DD4A.2739.2037561792.302",
        "C_8CB3FFD7A1A650625018591E5EB6DCDAB3ED214411C673CFC9AAA91D2D57C51F",
        "CD_7A2DC331DC9BD101BCF309899215EC90ECBD62010BA2391515142E2603A06D48.1600.3146502250.492",
        "IR_98233BC0D6E21C2CA3187CB9E2307592DF6D759478E209568F3CA340985F3F72",
        "CD_D55F423829DA78B95BAA2BAAAA5D6B94935135291CDBAE66CE6C5E9FBF8E4E77.2613.745059527.364",
        "C_666AB4303990992F36C1E67C5D472114E6703C6735120683CA3C40AFD0A2FBBA",
        "IL_0BE16089DDC1582CDB25043DB42CD7AE12C51808071C234ECBB1734648B1CD8B.659.1.73443",
        "CD_CF8C5D2298E729B081D1C131BD290A9E84673DFED35C60023220564D66F04E17.29.4012043745.568",
        "CD_34069A8F0B605CD9C68FBE546D59E0558CACF01AED052259604DFBDF9878FC93.1959.799525606.291",
        "CD_476CE3FDB3E7B1BE651492EA8D1B3527492ECA7EB32703BE458BCD6F6B7B15FF.2582.4242966205.705",
        "CD_6EB3291DAFAF5E4121A6DBB7E0E41C22E85218F8922D3C0FEDA4960BE686F47A.290.3242783989.130",
        "R_4C11DEAF7A8558F3989E0E42F67497A3DF8A0B97EC73A206C1E9955B630EFD68",
        "IL_CCDE22A24DAF1146276832D41859B46072EC704602C22BA3DCE8075CB85E0857.2687.4195108845.275",
        "CD_19D64438B52BB0867C48D699E88A863202CAB587F93FF7433FDE4846517B3774.1219.846690734.1182",
        "C_271985CFB8861AAD6656C473A793D3A13C882971BE36E460E9088BE8721E11F4",
        "CD_D47B33577EC858000C293FAABE7E384F7739B0EE6B3E7807EA011662225D073A.2615.729421156.434",
        "CD_EC28E29E31F548462327C3037DF69482A82EBE159236DA81AE2E5AA78F5CFB04.1474.3575000767.3672",
        "C_581FDBF3A3E51D753168374466B7C40E39F607E7397DAAFA13C9AC84F1F3CEA3",
        "IL_E93AFE85A5CB2F75A782AC45A54303D3ADA8FE8604B71C92C5A4E1716E8A8BA9.2706.265711707.295",
        "IL_407A036207054EA2DC280B8D7D438EE813AFB85B25BE52B374C7564A1D003604.2721.177209809.271",
        "IL_C5A1AE4D66D54DE31BD0DB67526AE9F7258CD2800AEF5AF0F2B6F67014B52345.2466.4718231.289",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.314.699093998.180",
        "C_085B7593B1CE40D92007E7E7F4B676333B0F0F7158D072E9115D8F206A3DB6EA",
        "I_F84E62E806DA3B389C18B7B45E8D2FC0FBFAE4B1DBA14F53EE15ABAEF0C58920.2679.559934440.269",
        "CD_3079E8CD6D46EEF3BB8C478A433B73D0DE2B5FE05E7E7BFC923B4F14ACB286EB.2745.388335826.290",
        "CD_C42B40D18695E044F98E85080DC73D0D2D750952C365600DBAFFF12874C6651C.1209.1008468738.314",
        "CD_09A0BD3FA42FC22051D80101735E2603C2C685F3E4BE5F21BEA3DDC5EBA5AA79.1671.3882546781.414",
        "CD_AC74BA8CCBB8B7653E84CC3AAB6F43C1B7147F57F54B0A2F4FF0A55FCB7892BB.2033.748077032.257",
        "CD_1D5B7D85296C726B09C241F1DBAB33DFBAC888F063F0064418C3F95F3FA642F8.2581.2497996945.812",
        "CD_A9AE64C03C11270991C8BCE26EBE3DD0FF3F841C3C80D3A28DC949EF9B62D60B.1829.3179625842.455",
        "C_47A47D9B6C73D6463867F73A57E933DD2525E443C9FB15C91CF6A9FC4BA05F96",
        "C_9D906F35D6F26F4CDCF3EE0A3920960ABC14087255E63B64FBCA0DA96B913D5D",
        "CD_A393FEDC8D8439E642FD70414F2815F8C5D6DC216A8FBF3F8BB710BDED38BED7.190.2514495355.333",
        "CD_3D8B3BE74C15E9B9148205F8633C142A46D7E9C2614D82ABE33663AFAF5E91DA.2642.4094542791.1095",
        "C_13EC1BE17DC892DCFA7E3A89B2381E177D560D8CC74CCA31E1E844B305EBB081",
        "CD_81D5EE0C466348FCC52EA98D98F1F7728E445AA3EF3AA91ABDE468F68D150D57.1189.3679475249.526",
        "CD_74D18ED7931F151194726AA4F80A7BDBA270A650F2D515B15EE9B3FBACF2AE3A.1925.3510100652.1006",
        "ACPI _TPC",
        "CD_16D6E45D9DC3C2448BBB5DF12E5A17B75BBAD53607DFAC1CCE27C411AB0AEA61.25.1819843938.837",
        "I_8306F1354864AE1F5B32872474B76EB97820FBB1C9EEF8B036946CB0ED5E531E.1051.4223633249.299",
        "IL_D051A5B0181CC0B23ADACB0489301B553AF8A30E93CF61531EDA8B3DC5620040.2707.185173752.294",
        "mispace",
        "C_36998BBD1F34ACF15B900E670E327F028E4B196C8A6E911E23965EC2D63ED47F",
        "CD_285CB51B3F84539727C291C35375EA31F52E427EA0210E136DD7CA9D76AF4CE3.2558.4273237547.668",
        "CD_1E99B42A14C8BDFFB63BA2F8D428227D04A8E5DF131E69A53A073AA04FCE464F.2622.161908990.1821",
        "IL_4C51D994F56A9CBB2BEC23EE88AAF4CD5448E1130361F2595B8AB9BDE9C47372.2685.924171561.259",
        "CD_FD3BBD4C42AC2F7FEF264340A9EB78A581FE5C28561CB63EDF780B329EAC2EE4.316.4095898974.3420",
        "C_5ADA758B11BB1BEBE55E93637EF1E2FD07B1E1906989C07106D282B72DAECDAE",
        "CD_D6F2F12C99D3A516A37E183CEF4661077FFC028EE410AEFC9F86E185408CC7F7.1567.2388826073.461",
        "IL_C52295624F06C940B122D80C080F06A7E8A3B72E8DBB8DAB3530E90B3C01E0C8.1500.3783951989.277",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.2207877211.368",
        "I_A5BE2A63B34969AA92AD0B732F65A0E2492F9A8C3857336E98ED1B01BE02E107.2693.2686907232.271",
        "CD_27AD50ACF498E4580849CBCD157A81D527ED4CE6ECB87F863A4E83FFC9365AD2.2370.3334514134.410",
        "CD_F1835778B5902B32FE03208266D52230255459BA290386430668E3E8C11C68A7.1231.3345460088.1023",
        "C_2D613B3FE870BA3F1517153C24257C4A37BDB33C8933EEF948458580B93ED05B",
        "I_73B465B61BEE7A212E2CA5D75FFD3AFE147A54A530A57D0EB687B325EF612EB7.2691.3590618101.267",
        "Win32_PowerSettingDataIndex",
        "CD_B5621FFEC1C8B1219D99E9EA2FFA370611A11F7916B9B95C226F3B8DBE0160A4.1075.1962304069.1659",
        "C_8EC91BBAAD68B394F044D0C97A77BC7357F5EEF20861CA716DF79AF75F444F1A",
        "-Monday",
        "C_4CA056ECD90B64BBABE15360B8C9B299FCBE735F03E37CAC28415171B65F6E4A",
        "CD_2421525B5330978D29177E2F4D577234961B03F32E0C906FA40DC69A623A7166.1955.2946216995.624",
        "I_C248C547DC15B784B3A402BBD30D036FD929AD807FC5B87D093257C8615FE4B2.279.3409176461.312",
        "I_3509E993E1B22CC95823C713A9E632AD3EB56594C59C0A073AB0FDF7765D776C.2686.1920747093.281",
        "CR_67EC6840BA73EF4637AE84EDE8859A76BD68C94CAE4BC02D6EA498581967CBB0",
        "]A0108CE261D6CD70D350F5B72F2E9874AE6E004D3029015B0919B1BD326BB649",
        "C_7A16CB145A4311D526736B897DD968162F4158895AE48A1FD97D7728640B7509",
        "C_BE504B709BC667DAE2240ADC0A88BDB48E5089FE47F6786E5F5AEB39C66F90BB",
        "C_4EFE28EFCD0C2B5177C06210204A407FCEB7434631D258DE8A983EFF1957B86E",
        "_INFO",
        "C_261DE8310EEFAF922E2BD8E73AAF0133E58FC007ECF50D7BD09C9D3D538CF4BD",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.132.977748666.188",
        "CD_6819A90E9043FBCB03170E69BCE9776DC51451D8655C4104E86043281CD95CC1.1049.2299359281.211",
        "CD_5CF48B4594AF5A29D8F38D01C51E1EBAB43B90EB9606F532D289B128EB56580D.2100.1.8216",
        "CD_554B16C9365D83D15EEFD2ED88E19BDB73646FD9C4C1F4781F93EC1BCB3E664E.27.482802408.1830",
        "CD_0EFF03476F17D85C3F9C99DE6C9A17B9CFA58B1D12889A9DB2009445F591BD9F.1544.1190917376.1734",
        "AppliedSetting",
        "I_733A172C697202EE1B8F5546C9AFFB7CA8277AB306D960E9F2B3FEE48102206A.2709.3661202878.299",
        "October",
        "CD_DDC6E09996B73E0FB9A8193017E7B68C6C9B1BCA3521A86A20F4A24B758197AA.1049.3833353048.178",
        "IL_216A204E83A179FD2824A7345124F94B7379D951C92D195DD87ACF85108CF332.2677.314985929.286",
        "C_F1835778B5902B32FE03208266D52230255459BA290386430668E3E8C11C68A7",
        "I_016734F04B55BB34A8311F1A033796CC5BC120FBAF936F8F31D014C66F4C2EEA.2686.2374076731.283",
        "CD_337863EF99B561BCCD899B7AFA2247DE6CE14F0D81601137B3F7CD2CFAE44723.1741.1422671123.488",
        "CD_8219AE5FDEB0734346FA82CF8304A2DED0377556768BA6A8933AE5DD15664AE0.2657.1672506364.1857",
        "CD_EA7B174AAF169E6296FA31F66096C0BF7F129196C07418E99F525C3B53222A01.2484.335993163.1967",
        "CD_AE91D46A333A370D09132417089AF125E776EF57E4B0B159D0C6DE0E14D65D5E.2425.2461130684.336",
        "C_8124978EC1B10AEACA2D165201147DA1CBABB9C526A77FFC04D016C0C64A5CE3",
        "C_ED2E871CAA85DB91DA82D43856C298DADCDDAA2D7C9D06C8655F1779E6509A4E",
        "VPN Strategy",
        "CD_20F26C6236C8252E1FCBB508B5F5781449304BFBC276C5E3DD747A3A26989746.10.4133511531.258",
        "NS_E1DD43413ED9FD9C458D2051F082D1D739399B29035B455F09073926E5ED9870",
        "R_E837FA5B478BEDED44320E3A480DE1EA4A5820B99185EB351156356529FE5C28",
        "C_A3FF4B5E169562F5D12527C651F2FA9F17677983CAE812428672F30175B2773F",
        "CR_7F586BA17943C172DA17564383FF9D3B7933EA9BA65A58BF1162084BFFFFF070",
        "CD_DA8E15B78CFB4F9B2BE10A65957A921FD8C6894DA0C2CF425B855C7658787703.2659.2185186712.268",
        "CD_14FFC489A434D581FBF6E06A9A803439863075160D7DFAE0D83E42734806076A.2012.2398751371.2984",
        "Processor Frequency in Megahertz",
        "C_5B65E7078766FF07A6904B792E37F0CB98C934FE8F6E820DD0987C16E5C48B56",
        "C_2B83AA8F75CFC714C0F50F640CCF8FA5668E9F3C1EC370E4CB154F1F7A1D7265",
        "CD_0F59D6E36EE91F95CBBA9055883AE888A75516D346E877D86D746008B369F28D.1191.3017751550.606",
        "power",
        "CD_97447B179623D5781456C076ECF72BF0BA286864647387B5B4CB924FA06A5416.1089.3034033491.4532",
        "C_3A2CDBFEB4934B51CE22A85244B85409ECAA6229E2209BA4B6A3962C08B81077",
        "C_C3A11869D2470DF86CB2D202694B5F3EF52AC8341AC1C59FF5ED618B2C1231E8",
        "CD_92FBAE457B17EE6F876EEE39AE9C2C3BC4B007C81CA929319E36EE45F722CDC5.2657.3582272682.1378",
        "C27658382D03C1148F.1195.2825387271.524",
        "R_D18B021DE887D56CED90F13460DE767FA0BA3077FF010C862ECF83FC393D6F1F",
        "I_8E6ADCB37CDB5B795C8D442B8237BF594378B36DC8C5928AF8258F9EA99B7276.2696.1766629956.273",
        "X25 Address",
        "C_40BEEFCD86669714A96D09FC1ADF38E568E0B01D634EF8F9AD700B7740B2B19A",
        "C_094CD032BE77E24831D84EE3DE38C46FBDC0C57F2466CC9AAB2CC4B43209B790",
        "I_871CF60B6790A91BE6A295359CD1421781487F5067A3513CC71EB8B1029EBEE5.2719.1177181942.280",
        "I_A76E7ED1AEC373B50A7135080D737DE0E64AFBEC74D1C4A60B135DC3DEBAA48B.2682.1795057351.285",
        "IL_F52FF028F122A3870C04654561C41B03F5A3FFB42D2C77B0DDAB42958CC39674.2489.867074521.186",
        "IL_A8BCD93BC22EF320B7622844E22888B089CB41B56213C006B8F310211D4DA771.2700.1877727267.284",
        "I_7C4F072713D197EE4E568C99AF36F44343FE91E5445124B1E42D22D2719D5DC3.2695.1749776986.270",
        "I_01AAE8C1ED007492BED23F4B58BD059DDE728603531BCDDB63F008450139C6D7.2696.2556155962.273",
        "CD_C3440650E548BFF63B5539FA293CA94632CF3A6097074784DC3E6A84D3E44079.315.783948814.1278",
        "IR_F3A7CF95E8421F67BF28459423C82D21629E16E53EF074D5B75137F6770EAFE9",
        "CD_8C9D1B00E81FBD2847B861D222A962DF95BEF97009ABD78ECA20527CECA1CB21.1241.1507672842.1362",
        "CD_7EB4A9F63049256E4E34752358BA88B60BE953949D217BBE4528A28A2AEF7097.1352.3611913625.480",
        "C_A05B58817295181CBA7B676653ED97C1E23D591F86C20D99BF4C67B62E0E211D",
        "CD_51A9C127B9BB2ACA4517A195F0C84D263D63864D76769541B4DDB9FD414D0423.1498.1027212437.1066",
        "CD_4DD1A5A9057BCA223E822F92B883994F78B43967069098EDCB429059D716ACBF.1737.612369042.737",
        "CD_00677180F57FE40C90A823DF9297D042CBC58C7AF83C3FAD79D7AB4D3438298D.2661.1071549670.466",
        "CD_FDCCE3B8287A28E29DABA3413AA9105F2F7512D7329C1A17D887D616F6D5B8C1.1059.3937138148.612",
        "C_F15F4B9679DC3EE9219935A1860F66EBEDC9C855BCC8543E73404F5D7C0853C2",
        "CD_A299EE85058E283CBAFC4B7374A0444D373E45244817F91F31D618B68CB69E72.74.1535810362.1249",
        "ROOT\\cimv2\\mdm",
        "@PTL\\HDX",
        "CD_846C560B82577D9FF88EE61507FEFE652D765E2149E65AD69717E4D9BBA459B8.1303.3769916128.1429",
        "6.2557549276.294",
        "R_4455530D790C6A107153E4E0AEE1E7EE6D9C30EDA76C55D7338F9CCA63A2DE7F.293.299892994.538",
        "CD_F9C9BF1D438816A18A92B3E8522F73D7F60F0DD6F678D67DAD4AE3DD5EBC727E.30.397307748.586",
        "reserved2",
        "CD_55B845C86C086EF59EB551FD3F61CC9B2BD4FD4446A9927FE5E4BCA04CC4B0FD.315.99215459.205",
        "CD_5DEF9BFE66A655CBE7B777B455F104DBA2D630B76C5936DA5A18E1A0D8E40195.2613.3325941143.389",
        "CD_E8B3CF9E7D4D054B2D1D38A67EC16137D2A01F187F2016735DA7DDF287167C16.1584.3597900165.2432",
        "Your registry might be corrupted.",
        "IL_F8FCE999F676B97138370A6A20A4D583B46736B2574244A4CB6BE68177264A64.2508.1003636062.544",
        "CR_A4F5A56059DDF119F4CC303056A7BB3F243745A5AAA1FF57F146D0A87968F7FD",
        "CD_9BD335E67BAE50C9848BEA0828D53089414BA43D5342FE18815FB3521F2F4CC6.2369.386333148.551",
        "CD_00330E7458B5D9A0228F0B77CE0CF834B3F16E931D55E4B84F81D2634A6E0B53.2528.3116218708.496",
        "IL_78BB6AFC63E9D106552AD2B6877F9716F49FA2E899AF3B69E2073E4EE335FD0A.2707.2587567292.295",
        "CR_2A82469DE4EDED369FA467BEF3E6440FE893BBC1F56ED2AB23AD8D2515E35AC8",
        "CD_92B16BE3EA162B3DC2D69A2F6CE7F276615FBC3AE9F39D13877A5138357F03C7.1595.1240770861.866",
        "CD_BDB1FB83B60E9BD18231450213923BBA0EC1BFB3618EC2AD0ABF9ED38791F05A.2441.596887300.5279",
        "PartComponent",
        "CD_6F1D850858EF02D0889AD0CA1703D1700194AA8D4FA27667FC3CDD1F09CF1E5F.2635.2969600747.2924",
        "IL_5C6D202D981427613B47C1E03984ACC90FBD40670239E12927F76BE931924787.2695.4058198364.264",
        "I_0255C72DE857C2548B152EEC30DB6E16802B631CB06DED8AAADBC49C9509FDEB.616.1.272838",
        "I_2C3390DA0D8113E7B067C5F12CC8E1742CA924FE4948190A81257D1A9CF5BDEB.2512.3648018610.256",
        "IL_9614B78CF30C3CB0EDFFC58EA6133B7978B5080C82FCAC5A058ABDD270FB0A10.2669.1092426451.273",
        "CD_4127FA39B422F35902681B4234322A2B744157E2EB563F7D2450799A62E71C22.1924.3421559428.311",
        "C_8E3D9DE775219AEB41FA7BD5EDBE39725FD15E4E783E70F0941CCE144ABD6BC2",
        "C_9D3CDA0D5B685AB707379FDF37152DE171B3F3E5F32F914F190FD863B176B1B3",
        "IL_27234A891DE14CDE5C320713C8C4AA047B5F469BA126B978EDED130A37F10417.2712.1031906111.269",
        "CD_011B1BAF67EA69E2DE34409D684C80464FA202C09EB167987497A892748D7728.2665.860561198.401",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2041.562880835.188",
        "CR_83C100BE0F817015BF0575F5A3496A636C9309D7E4EB3062A76F5F113E51D626",
        "CD_0BB30ECFE96792174DE6C88157E151B103283BC5FCF35E650468C2280E66AA49.2556.784069840.462",
        "CD_7515FB6DD2F950E647AF60DF9C8580AA8DEB2180D47175E1411F8A1FEC246F58.2614.4080450494.403",
        "System failure: Try changing the driver for this device. If that does not work, see your hardware documentation. Windows is removing this device.",
        "CD_152A8109FBC9BC9F4E7BCE13CE14711A471088C4A0497E45C7C22F28216A40AD.36.1517753552.310",
        "IL_95836D7E2E497A1F78FB3DE04D6CC7B1E86FB113E1FC2C16F2960FB52159CE1E.556.1.28406",
        "C_BF1E5E829A1544FF8B694A6E8073DFF9D1CD4B2724FDB9291959D5493401980F",
        "C_FA518327502159AE84FD3F6F4EC621E64209CEF758E8DC599CB8C2ED467053EB",
        "CR_EAA4CBEB7BB9CF88FDD43FED82BEACA99806984E20E3D7B69232FF5F6CB9EE6E",
        "CD_888F2D9B25BB449B1BAC54A21282A4102E2AA23BFD3BD4A5CFCE4F20063B155C.2613.700291933.452",
        "IL_883EDC6C7B36CA3E03BFFB70A247BBFF29C5F38FD45C0A261F753AFCAF2855EC.2700.3252129823.277",
        "CR_E091E6755173CEDA0C35AF424854DECB26CF90627B78F06DB8E87E6ED8C5E2E3",
        "IL_7D195790BD4C419F05DBAF92E7A7A810E7672BE3763E9D07715D999176F339D8.2697.1769784366.276",
        "I_B5845F4417EB0A7AD195B60C8C70005F48FB5E07E5853923BF9CEC00A11B4FA0.311.2565700494.249",
        "CD_9437CDD252D8899EB7AD00D86C43831F2CC65E71AFA52343D401A7ED5367A82A.1876.3048987149.410",
        "CD_C43EFC04AA57188F81F06E127B541FCB4E02CC3940B347504A70CE9D5B7DABA3.2424.1561587336.354",
        "7A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "CD_5FB7EBFF7E65F2B5A8D86A305D94319B3C99F6846C3536F671E3F448D940CE69.1949.63039409.546",
        "I_61E669D3482C420F68FA27C086C8D9EDD1797B7765A7ADEF6912A148755E11FD.2466.101741563.345",
        "CD_90EEF26AEE52AAEAA6C979CD586F5F478789816D2A5901B4B6A52181C962DFEE.141.3473673423.754",
        "C_83ACFB9DF8992B7F1C829EDFDD3CC466D5B1C6F85CDE2432D230F14C7C9F56F5",
        "IL_22E27286708E339CD1F553AA968411C46237D9161F7CBE5E9E422DB51E772F46.2533.44794429.276",
        "C_D615AD06B2950BCF3011017989F72253D49A49EB12D1AA036862EA83AA76C88D",
        "CD_8E0600AB901E2A841EAD9A6A75312301196DE7B868F4D3249E5BE0E21E42EBB5.1921.181196037.269",
        "Note that instrumentation's view of a System's 'roles' is defined by instantiating a specific subclass of System and/ or by properties in a subclass. For example, a ComputerSystem's purpose is defined using the Dedicated and OtherDedicatedDescription properties.",
        "IL_60C0138448B18454795E1F1C4FE300BAB09D220E9E0406F27853FA165D081DA2.2727.3114976785.285",
        "CD_329DCF22CC9EA0788BB9C3FFFB20B99F00D18849EEFBD38BCC78B3640485E3D9.2592.1637004043.556",
        "CR_4C5AFD1736EE75F7E2D418D0A789735634156C5EFC9350C3086D52271573E8C4",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2136.3952311231.180",
        "CD_78FEC0D7E1A17013B9740AADA5441902D49D66AA1FE3CD04A987FABED928092A.1155.3860190932.447",
        "CD_756ADF3A38037C884D036F3D193150C71CD696CC6C340246CD1DB26B98747BF7.2426.531911003.296",
        "R_634B30FB22F1D70096907315BFD1CDA9A5B8C1951A6230BEA453E3558126BD76.1498.3202121625.540",
        "I_BC000CFE04C2A23B745105FB1571CA3D890D9580D1AA6746224E398C7587FD84.1976.1222477099.312",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2167.1101948841.368",
        "C_CE0AD3258F9165F0C84072E7215F2F147CE8BF8C8EBFE1F2993D6D33A7ACF17F",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2065.4189954886.180",
        "CD_F33D7C5F62C48A98254F1B0ADED8C5A8E56D1601D517CF44369F4A800E4AA9F6.2749.810858295.340",
        "CD_7325C6D5F23D26543C59600AD0F4192BD8EBF069FEB8836805F79D1EC53CA66E.2595.3168086277.378",
        "C_C6F302354CD11663A914DC4001850FBF0A66C16EFA86F9329AFF93A3CB628944",
        "0x00200000",
        "CD_09A0BD3FA42FC22051D80101735E2603C2C685F3E4BE5F21BEA3DDC5EBA5AA79.1794.1371047147.446",
        "CR_09249AB2463DEE8AF9E6045D6C53614F5DD03A6CDBE2B7EB3990B7FC319F1979",
        "I_F90254E7F99DA09977CCA3AFC876E2F69B143A5C7B620A38194806CCC0551447.810.1.92690",
        "AcpiControlStatus",
        "CD_4C30D2B0F562E7ECB133EDD52DE8120D85640B338DF07115C2057AA8BFDCC64E.2425.3644363027.359",
        "CD_4890EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4.279.1113330032.433",
        "CD_559E7BBCB66AB99B2C2082F563286257BBCF9A5FEAF75E8EE8F89CCEC43CC26F.1667.3263195232.614",
        "C_DC75EB8D61AF59F2FEB9BAFCC51C26F93B19442C9F5E9F7C071B8627E9152155",
        "C_ACA27975EE2F3A8821B425F57F3E45975100D0F3FB352FCB31C5B5AE152C7062",
        "CD_80F2A8BB68908972D2F32AF3261534B465EDA63A51C25EED6DC37566B11B9550.1923.1296708231.309",
        "C_CB81A33FA900BE00E042E159DE6F8039F1548250D14E30B70BBB9CFC0A6BEA1A",
        "CD_48B29E9AE4FFC8EF806EFE0B21B81E1AD49B510512EB4535634C1F796E081ABA.203.2028673846.1379",
        "CR_8AD8BB59AD76539933CA61E487AC9890B90072B3A3E2702B40F21CB1F591E761",
        "CD_7DEC494410AEDA2786DDD83D50276A4BDEBEA914182D2E98EE18B4B9B0A60840.1599.3294250627.392",
        "I_CE92B89E1C7F23AE2FE567D929CC5B9B811C8871F68DC601BC14263F301C4A75.2688.1420790750.278",
        "UnsupportedFormat",
        "C_A8F32ED73CC909392CBB6D2CFB5C52391FFF3A4DD4AE1EBE1F9D40C03A8C9EA6",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1534.683258863.180",
        "C_FCAC53DC2C47541DAAB9B1F4539C71054470BDF9F6D1F13BCA735A181FCAF971",
        "I_6542ADDBF701A825E7688F7B39144898AF264C03328F8804F4006C9467FD8A05.2687.2705387759.264",
        "IL_648EFF9F0AA2DC717DF307694D985212C57CB5DFD08154D93E1723BF3749F62B.2726.408613654.275",
        "C_D90316B018BEEB2B1E88D6840D4570916FDF527A1A6CAAC9F2E7E462B55B6534",
        "IL_70069B655F2B9DD4EA309DC34E9C4D2ECCBAA9F60D4FCD1424290223A7872F59.2716.3574595889.284",
        "I_3A7C55E6777C3BCB7E0B6B05BB1865AC10BA79BED9BB8C73A5D401038F51D834.2729.1199845375.275",
        "IR_5C8E889EFDCAAB9A824CAD60A6893896BC511EF516AD1D2FC6061C440F917D0B",
        "IL_44409F3234E2E4E4F256651DA16CA2AB76816DE3447386A9E3D72AB56C8419AC.2682.1234320660.280",
        "{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}",
        "!H$xW'*-iT03u6]",
        "CD_52091F489E13F003CE1D9DB6880428EF7D0CB212D1BD0B507916EC93DD72E8CC.1270.872685869.142",
        "CD_61F33C9DE75CB13B4A6469AE01D1FD6BD56B098ED457BDC27158A62BBACE11D9.2422.1502757851.683",
        "IL_DEB3483995C458731139A4CE82083934DD30E2ADD62D3031814AC6B04852F167.2706.2086234859.293",
        "CD_6A28C9121AC74A9EB361B4BCCF85389D5F225385AD9FDFA10E6FCB506E2CAE2C.211.2160192374.846",
        "IL_17DC93F83304BA95BAD1E83CF1A534B5F2E493B534BE48F87B588F229F5FF956.2681.2430488508.282",
        "IL_6958F049D8AE3BF88427AEF88FD43358D91B32EE71F581203C3F847A84813901.2681.3155126044.284",
        "CD_B0796CE9F628CF73E17A3427BE2460F8DA001FAD27D1712ECBCBDAAC25C4954C.1019.3248472472.214",
        "CD_8AC77D4657C341EA62F010DBBCE9C60C34967B183584E34A69DC6BB5BF0070D6.2094.2059300344.187",
        "IL_03769CE641C73CF36AB93ECE6D86E2079B4A86260E33B16409F6C222A26182F2.2701.1660410404.287",
        "The scoping system's creation class name.",
        "I_1652B601D82CAC4E6C305F6382CD81E4E2F42654A09F9F1E0967D6CB0B8A7D26.2709.497786935.291",
        "C_5736C87A30783FE64957593D8F34FF03FFA145529E369A853C7692EB2B1E8349",
        "CD_53F361C92B689C209884B5B758327060224E1EE2A715868AFD6C828FF0E150D3.143.2709175301.641",
        "Vertical border",
        "0tpD|@4hL",
        "CR_3FF4ADBFE846023B8A5412007D4350B3CC0DA66B9B5ACC61FC6D1F4DFFE32951",
        "C_79BE4703D74D1AEA9541FA58F2B00142CCE440AAF1482F39D9D52E228ACD0FC2",
        "IL_8790F85C1CD081BD2820B504DDE9C4A3D2C829380C534160DCA15AEF0CD7087D.2712.168188565.281",
        "CD_B912E80CAD3BE113409EFB3E8B7938FC1D6B94652ABA9A1C88A43589782E998B.316.2975513520.461",
        "IL_735452BBEBEFDAEBC6A68DCD86C8369C33E470B585707BA64EB646095B631099.1196.495475129.331",
        "CD_92E9B87B5FFD4717696FF7754EDB672E42B94057E3EC937D7C6251C5B0F98476.1597.627119736.1219",
        "CD_ED39D4C9AFDF516666EC000B45EC192C36CBDFF6D22BC55C21F14EE49F68B755.2557.1868981278.511",
        "CD_C237CAECD8C698DFDFBD2478B07E83E6365C4D353C8CE8D43C5B6C6DE2C2F702.2544.2105077142.505",
        "C_D342013599855A865E248E2771354D6599E6CC7C20CFBF4356520ECD87A126D7",
        "IL_C1C40713DDC45BF71014CA6D7A2A491ECC3F99EAD27649CD67DE3F71229B3F8A.2682.3066992463.276",
        "CD_84F8BABB6CA8331C4E9169FA40BA6E129D7FC9914E1CFF1EF6A24C2F4E5BC1E2.2112.3374214635.537",
        "I_FD30518B7FF6E67C50A74F8AC892E8C628384E60A02513892229E9C56FF7B2BA.2681.2887717859.298",
        "CD_C787CDD6148B3A1710BABB66FFAAB061F700558EE123742FA9A22BAEF228EE96.2152.2327743050.1338",
        "CD_3FBCA1A3C3FCA0AC79E7FABF0F46FDFB9715CD8A6F985241378B13573652A0B4.1542.502078920.684",
        "CD_5759507746BAB79045AE2A46B326813A2A0F0097AA7AA167503FFCBD4304189D.276.927118264.141",
        "CD_ADE497F7ADB52466B3BE933E20B36A79941262ED3793380A63DDC578ACBA1413.13.3993973209.2334",
        "CD_1FF3E8B084EF958D6CA51930B35BA398A9AA3DBAED426E535ABE1FF42F771AC3.2422.1532097738.363",
        "CD_33B5610D2FA7FFB4F03D69D80739EE47F91550643A1F839B5E730B9BC59F3A9F.2410.2600297410.1799",
        "MonitorFreqRanges",
        "CD_4FBF4E2F4EB997E78BE6A08310475D7F288690ED00FBAA96A0D81E2F361482DF.2531.3723703690.83",
        "The group of the file/directory object",
        "CD_8CFD3BDCF459E28A190CCF46FF43F533DE3394389F988133FD28EA5A0AEA1616.0.1669354959.382",
        "C_D8AFD5E52E68EDD2DA6601343E41948E517B386A2A14A3AA86D4EC51725265DB",
        "CR_527E06AE9ED45572524985C48E4812D5807B4FF3D509658D30652F5A852DD578",
        "CD_00330E7458B5D9A0228F0B77CE0CF834B3F16E931D55E4B84F81D2634A6E0B53.2612.1007249741.342",
        "R_988F45C7D3827182CC9E311CB986FEA0532897BB2CDEED83739CF2F82341462E",
        "C_95A9ADB2045BD99C8214F501BE25CE3247A7F55B6BF14CC069CB47314F289D9D",
        "C_B9B054F1BAAB1FF0776814C579C68A970C8AA6821C311B5425B204D4F9CB60E9",
        "R_92EE6C02ED0AA1EF322CF0E3C150FB5F1D97B8751D1560FB8DADC1FA4068EB93",
        "CD_C502D67664F16B0C26C80BA30AFBE91ABD4375BB24F8697FCA1AF3070D29CC71.2586.3358758865.221",
        "CD_9FF931ABDDA027CB18E2F61D38FD5A4FC1AF5875DF376367CE6BBA8FD924FFC2.1757.2191200501.482",
        "ption",
        "IL_E73032100A8717054DA4CAD8F2E8A4496B3487F6C1516D43ABC8FE61F125689A.2707.2937429472.294",
        "CD_06B95516C170444CC895270E847F3B76BA4712C919901870D883B631ED78C408.1231.1041340688.2146",
        "IL_DBD7AF9DEFC2C1F32F15A7484FAC66DB64514443ECC9249299A66A38ECA5BAFA.2711.745061077.290",
        "CD_D7E5160C539A0B6F0E4DAC59284A5E27B97E67D93CF88E4C35B4F0FB64E90C36.1098.1.31848",
        "E8D139A523CF672F723014B.2736.1946317492.345",
        "<x9r*$",
        "CD_B977125944CA8326977A414325742B1EF12C40157E5C5D20B7B02407CD6122F8.2102.1418651565.321",
        "CR_40CAB48C933E1E9666D5FABEFF3A33253D381F532056E6A9DD2195EEC2E121B0",
        "C_130F1C3C29111AD1E8F485A9C57AAA4AFD7E43ED53D005581436A437F8C3A1B8",
        "CD_A5FD9006F591ED5732AB7421A9D1052D320909DC0E83261366D216CD47F25E4C.1921.1804508423.265",
        "CD_1FACEC34E49F2E9F065E133CA4A862C83EC2D73C36F189500659A6F90DEF8727.1928.3790067438.249",
        "CD_0F40AC813525BF23B517D1D92CC88BD22739A3C5B59B5537548A36265FEAE58A.1809.1718261025.926",
        "IL_04FEBEF6008A339891E2CFC2903FEE331B5735302797216DF8B0F8019B79AAB1.2695.4269635019.273",
        "CD_6FF6CB589253824DE681EA946AEBFF7061F07B8322E36020A90CC770B8046443.216.1014940460.718",
        "IL_B6EC2E4C75784ACBDCC8936A2392C6712F9FED67EA5E7ED2E85750B313A57D6F.2697.1767133674.270",
        "NS_6802DE5CFCF7BA416C8E2EAF790F087E2F2BDAFDA4AA4BB8DBEDCE204DD4A614",
        "FC9BDA275B1.2734.1317171737.350",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1209.172504493.235",
        "CD_B7CB0F72C5888EFB87CAA914B3258F858F11D8FC7438CC22070822389ABE2635.2762.1446238811.953",
        "Status",
        "CR_878D5D30666EBFE440F941E45E7884E8AFCA7A1478E4D09AB57DC26571C8B7A6",
        "I_F58EA9A4248FB79DDBF112DB65B98127C9A78FF4DF9FC34835E8B50C808C985B.1747.168804341.304",
        "CD_CDE4A8C7C0B03EC0C311F78F07CE34C050F510D55C1F5373A349277F064EB193.1737.169116800.3849",
        "CR_25D6DE4F10F10C9622833D068798F50E89401E52F3D552BA53470C9A0F55267B",
        "C_86063DABE8CE896A69DCD5B43BD505C1E3B2A298B4207DEC8AA9B679D5A8639E",
        "NS_97538B94254A1F03A908077DA62DF25991A1DFCA6D8DCD7E0F84BC79C2E33C9B",
        "CD_1BC80DB435E63BDB0D0BAE6F783293CFD13F829052965F211A74FB5B4AD97A7E.1200.1671319871.7729",
        "I_33508A40892C02D5DB0767ABEBEE6B3E036751CC19D97582FBBF57F787850E83.2708.3985374220.294",
        "CD_1A56F41D63578C6740DEEE2D125A595986E3783B82D23576EACB16C1622C2314.1171.145165859.205",
        "CD_A5405992D9D674E902DFC53B45CA5EA7030AC30531ACB3BF91D0DF7BC783E1A4.99.1564225651.256",
        "R_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D",
        "I_2812552543ADCC60124A2384E03DFBC107A218DC98DC83C5D8FC1F19406A3887.2691.3012358119.268",
        "CD_D5312D2CB1C1201CA5C65DFF999460FF4879179CFEF4C66A96B6BFBDF88AAF0B.2744.3633220055.337",
        "IL_CFB4FE5D80C9161EF88C36BBDBFD45F14E6B150C82D875A7CA6E75C97BB79D11.2702.3399681683.283",
        "CD_A17354395E79A088E63A18457CAA51A441A886387058324A6BE95873BE2C4E38.1083.2095546704.313",
        "CR_FE21788C436CFF985E8FC1B783A31A0C4A2BDB769702ED6630B901A6864AF8E8",
        "CD_39937D1A990EDB6E14CA46EA323A9EE91A51DB10D306E4059B3A249A61F356A4.2578.437874541.219",
        "C_9B3B36A993A462F50891454718B9E94854BEF6CDA6B45E39722B69B985CF4900",
        "C_D336428E5FE02B93C4413230D0BA8394C3D8D327B0A951AB98E34E7C718B63E6",
        "I_CD10ED400BF274EC554781FAA1E90D186E58C982EAEA50DBB502ED8BAEEF5202.2711.1030883813.291",
        "R_52950D1EFDC3DE67342E2438F8E07B6F40A248B4E32B21A3EBA8DB9797405C1B",
        "R_8DEBD963AB0F9B4B0BF30721FCF8B1B7D372A8DA71A85D7B52A1614E38C3B78D",
        "DATA_PROVIDER_PNPID_INSTANCE_NAMES_GUID",
        "P(@t,l",
        "CR_55AF22A4D3FD212FC3171AADE7109F17F27CA9F86C291AE560CF90E7D047839B",
        "IL_5E7DEBBF962531F01D86A0E0059F80ED5DC1F33DBB7C0F296C0786E73BB7FA43.2724.2829331782.285",
        "I_F41AAB3CE0418D59CCEE78DC6089E8A71443DF08351201B015241ECCC0AF9C70.1617.460483849.315",
        "CD_3E2F13A021D0850DA50BCD140A9F1AEF8BFEE1F533F4B83B67156601A0B1C84E.1927.3953507185.303",
        "I_FCAFD02952E62CBB14F71D4B805D05241DFEE4F3755643B3119DA4E6AB7DBD41.1073.2089762337.337",
        "CD_9EEEA1652B076E9BDEC87667C9754CDF2B2DE5F2891C36893BB67F67716CC28C.2669.259074828.2569",
        "IR_48470CE86E49C23DA181F2E7738F61C8EB4E4B1D716A16F59BD2BEACE63CBB20",
        "CD_44EA48F1447554EE6A5F1B2B75B3D13F8D9F6E269F5EA85D941FE91968D91A16.1097.2211931744.875",
        "C_B89F81602D340760DCBF9C7FA464908E742B64A7C6E08A776FA3C9E7E3DE6507",
        "R_BB27EFE66C80515ACDA70B8D93AC3E041408A503B4091461E3CAAE9E0BE7A5DB.1480.2327063209.560",
        "I_CDBA52B358B1C869E22F442FBA6E11C62249AA1DAFA2D017FFD6CA73F892D566.2727.3208962149.280",
        "CR_AE52A362AB5B79D830C3D5CD0FC2F47EC119DEA073DF82CDDFBD53D1F7495A1A",
        "IL_A41A2A506F07DE19FA26EBBA5A53B62D2C62BAF775EC8BEA2B152B5D21A711E3.1489.1494767708.202",
        "CD_FD5A09758773146E01CAB43EAC38C6EEFB9A870C8F888B5F24F7E89AF0CC12B8.61.2048206993.668",
        "CD_C0A77ED799B7351F2E397137E839919102D123FCD7350D8EF328ED8645D917E5.1600.3384179271.265",
        "untedString",
        "C_6C1898742A435BD7596F148E1B69FF49CF55B8A3AC2058CDA5C944CFF7E6FBB0",
        "{*xu-0369<?",
        "C_7AFC0D42052E9C59679F25978A7C6BB4EBBFFCAAA7E1A1214D251ACD02FCFF67",
        "CR_18D8719A943B4599747ADA74EA7D32C69D833172BB0F49178849B0570759A4F9",
        "C_9119F0B652DA36ED39E0F720020078B4D648A3C32B50B41FE55A21DEAC3494CE",
        "C_90E9A4B512231958877A8081A43A190212C66DB13315174B31713DA5090FB2E1",
        "CD_176649CD4E57E4232DDDF6DF456E1D2A1BEC4DED47B202F904E6181846857EAD.1737.3878023982.475",
        "IL_8AE63FB9425B2EBA4A6772703A9318CEC3AF151F134C1C916D46F252C1D7D2CE.2724.1770552678.290",
        "IL_F14E50983E78473C89DDF4F0506F026D6084E8093E3DBFD59B47FB67D5F2E570.2706.4086162953.294",
        "9E9377DA38DCBBAC21329EE0949152EC064204ABDC2.11.696898079.524",
        "CR_2DAA673000997F2F80951132F7F329F238406732862099A85474AE8120F4176F",
        "Name is used to identify this software element",
        "I_9C54580862E5AD35A14C077F042D2C7C4B664A845389A5F93D7B8CF790C05E69.2685.3213845486.292",
        "IL_322324354F59741CA8AD761C1C7D9D501FB03485CEE7F196C5A3BF4DD90D727C.2680.1655469952.274",
        "CD_5E38482AA73EA29B759E8DA322C89333B6EB11675AB299997E04B67232DA3442.1757.2379743297.192",
        "IL_8A7831F1CA17EF8E61D09BB610C0C7C9D4C021FCF2E3BBA1310CC9DE1ACD0955.1976.2802323208.329",
        "CD_189326F4F721F3B084F2B9D28FCA49B5C1A7BD8ADE57D16572A5693E864389B6.2106.1015868107.795",
        "CD_2FB689BFC688A3A0586C592289E873F5F6C7F913F961214869D359C9A9727DD6.1152.3682045972.347",
        "C_C94E6AFCDAFCBF5EA00ABE8B2F4F19C81D5C47BF5C093E7C720DBD8884BCAB6A",
        "CD_9D3103F1FED20F5A89A186A2A5165255DA3A6E898D7F2AF1A34CB11242007EC6.2099.597977299.1319",
        "19197E51305D69CEECAE7B645320A73D6DC468ACB11BA2001D79",
        "C_044BD4F4AF9E96DD48DDBD1666684018230534EFDE72CF711BC2F8C5D5E9C959",
        "Verbose",
        "CD_9D3103F1FED20F5A89A186A2A5165255DA3A6E898D7F2AF1A34CB11242007EC6.1733.3746481792.628",
        "CD_CDB78955683E4A4FEC301253A65C7F4393788ECFF600BBB16F696704AAF38583.2597.2829791641.766",
        "CD_2435F543C14D77EBC0F0A1B12249B8DC7F253A838F1A9C04985BEFFC4FAC101B.1600.487458572.496",
        "CD_9BCC36936A7CD2114CBD6BB3117D20BDC217533B6143F306B044A23AE20B32DC.1477.3331139944.294",
        "KernelIdleState",
        "uint32",
        "CD_37F745714D456922ABC6A6C3392453CACBCC48856287D98BA28B9B6BD50EA75C.7.2136893206.341",
        "CD_CCDB0F33BA6966E88C9C16D64D85DE69D152BBDDCA55C4187234D7D768C27675.133.3306708567.1714",
        "CD_BAB7BCFBF35C64FF2F6C4FF32538BACB0A2D69B14B109975FD801C994E89CBB5.1155.1494372749.420",
        "I_E61AA5DC6E2C0BD3A80E025E1E087DC745E590F1A37D0E32323F3F0F4D2A1F4C.2679.1358316535.276",
        "CD_C85BEC05E1DE78CAC5454E6D33A2BAFD69D28B4057355776F41B00B3DF99855E.2457.3806472261.234",
        " $(,048<@DHLPTX\\`dlxhtp|",
        "CR_0C89E3FE1CDFD790CBD5FEE0B9AE5F8AE27F38181A372EB2194AFCBADEB37DA8",
        "I_35DB2638EF5F5F36340C7BB56F42EABC1B719C0A20CF4927927B74B39BB16F19.2706.1955090926.293",
        "I_2C2EB703985F00180EFBF0C98AE7F454B6DD892D95C4064D8B340B3889135685.2720.1883434224.286",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.287.3308430128.180",
        "CR_E706FF8586C52A7176ACA48D7702EC2A6550564F0E42B0C09AE3FD1CCEA62CD4",
        "{FF9E2BDD-0E24-437c-84BE-7CFCAE635808}",
        "I_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6.1489.842082542.306",
        "C_5A5E04AE562D806B7A5E96D29CD9D1D3E899DB8D4ACD1E771DFE1EB85514EE22",
        "CD_F60E7BE4D352BCA9A29DCD30B4F9C506C835C329C5B379CF00206B2A6C799F2E.2667.4277849854.543",
        "CD_A042D558C8D8C5910DD5298BC5D29889BA5CEA0D1A22A1BD4A1EF145F3C99D41.2015.2847145407.581",
        "C_0783FC4315F6719B07F6F7780EAC7B73D0B0471C3E21E23BC45CB6B44FFECA8E",
        "A persistent binding request included a bad FCP Target Node WWN",
        "CD_E8DA4E4A5B4172ED75EC2B701107D8BF6AB896481F2534AE694C3BB5BC84D1F2.1561.2319829827.1303",
        "I_5453CAF0E153D7C7D67C94E8E35E49CD263F8820F4C34458E7C9770C060786BB.2711.1345780210.294",
        "IL_2BC4B96F539BE0CF3C85A05639F9F1B7EAD4BA5F4047BD74245015D575E495CB.1015.665898166.341",
        "C_7B24EBDBB87970F4FDD2609D6CC7B0940BAF49BE0590A3A7456A0B343987BCA8",
        "IL_D099474E77F3772C193355FE7953C462D92336F4B1BC91BA279D0AE067B86FB9.2704.1768010563.290",
        "Reliant UNIX",
        "CR_4B73D65E2FE4553C66EBB3CAEECF929ED3C6295923490BCF82E45AB15E13C3B2",
        "CD_936D541CD85969DF0CC7874005A3CA167B065E798E6CB9B3817781424E973EAA.1230.2908132383.3040",
        "CD_D301EB050FFFFB91F3BF1F6274877F7EFD35FC266AF4AC45A7968B005C4EBA69.2732.2885860860.1125",
        "C_24519863E7254E1D9B6A25D977E51817C344771EC7B62C4251FDF1D411B6C533",
        "This method is used to dismount a volume from the file system.",
        "CD_E24FA471FA616F0FEE1A4B19D9469B11315F0ABE663B66CC48A1193183ACBF97.2577.2675992112.458",
        "ref:Win32_PowerSettingDataIndex",
        "IL_E69A15A73E68094F3BAFF3B57112997F0097D6B8B0EE4D5DA4252A3EF3040265.2698.3843099332.264",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2736.2831676613.180",
        "C_EFBE1C465A2F3406BAA068078725F0502A25A1F712603161F9A1B1D445463141",
        "IL_3237FD5DA9575F260EEEAF4A891E8B9160B7C9EB62993FCBAA97044D7FDB69A1.2735.4102368610.273",
        "CD_DAA0835D90559AB1BED3F4706FE66DA711EF5A48A581A0339267CD41A8EB5EF9.15.3478891741.1086",
        "C_33DCEF5A25E042E234D6018C36A73BB8BD2E0A0D570AA0A57D43D363A2232E3B",
        "C_A141772EC0B77A30BCBC6079750E6103AFDC743C3C219E99DA8B5DB99F02CB9D",
        "I_62915EDCFDFB1F4E3D47668B9CAC709984916BCF9C80830D997E5CF56587859D.2727.3193218715.279",
        "IR_3BB2F25840E05D325FAFACABBB276A102D49D79CD3C3CCD8CF11A4F77E826041",
        "CR_FEE056125BB5C53A639F41DCE7DF075F1ED8C67B4313ACD38915A7DF950C5FC0",
        "CD_1B1F12E77F513A1F34170D72EBDFB89B7AA666D5ABEE6CC04756D419F4107E74.1955.4028263591.591",
        "C_E2B2F2A9C4A7BE777C95CFBAC1ADF577ACC960E4E5C2F6E896E757D1BB542084",
        "CD_1AEFFB6222622A61AE00A6A8A6B976D42F502B57E04086F26915152E496EAF89.1248.65295245.753",
        "CD_244569773D55238A38208C15D2591921F135D649AF755704CF3FBA521A0F7835.1568.1040323606.521",
        "CD_BBE65A7BA5F833323A35A0DEE7CF2A341947D4A0E5929D829D9B5FE016854439.1190.2844980631.612",
        "IL_18ECD510993DF8BF1F6A34699939DEE7022919820F36821E1157C8304CD58135.2714.1828514654.274",
        "C_CE73BC7D26AAF30679FF45CD07C91081A8FDCC9A1636CE37493179FB839EB641",
        "IL_01C03DFC0B62C3B09F74501F0C80260AE479ED5CA24F033FE6FF5F8BE8E1A046.2764.1395928415.284",
        "CD_C446284C531AD33722FED92B5707E137291BA408988B095293D49122D6D19961.1082.825741007.807",
        "CD_88526558B4A6D54893233ECDBB85F90A6C9F4F8D077A55806559DE89FB1D9CA8.2546.1665100624.923",
        "CD_635497AA16B16AF0A6344C164CBD027C88BF47D531661219C8D5DD2913FC696E.1605.1914590680.2315",
        "C_5EBF5C53D7C8D0D262B25B6FAB388FB8F7A1F2DD89675D93810B1C0121FE11D1",
        "CD_5F8086938F6BF421BA200D039913652FDC167A0FF909755EB1FA584E2EE04F6B.1783.143354355.728",
        "CD_188537EDA39ABDD3901DF3031016E2D37D171396BF2CA8AE3EC736DFC5E4AF5B.2051.1858794920.2788",
        "CIM_Error.OtherErrorType",
        "C_B77DB97387F7D955F5A8C046A7F1204A742C057FDAB7B793E00BDB10416B4D6C",
        "IL_3AD74DD44942EA2E3D5CBF11BA9CB0A9949A58918994AEC381F1EF94F778BAC9.2696.2133637917.275",
        "CD_C8D0F277D7F7D59AF0E214825AC68160FC59DD15097C20883A4D4AAFF0736D39.2097.306624221.509",
        "I_BEFCECEA527C413259A957D2007FED39F5382D0FC8793C297AD4FE052AFC7953.2708.1152756824.288",
        "IL_C71EA4E99AF3E77E47D6352CF7D2A252CBF2D9A64C752881757DE215D5C75F50.2683.3585954419.281",
        "I_6A6B9E2BBE3244917A6F8976955E1E6E04DDACCE833988626D557DC094A5D1C2.2469.2992845625.349",
        "C_AD65270397043F902D9F90C1B5BD4DFD9541ED0218BD51B3C4F8E8DBE71A2624",
        "C_E54AC9C8AF2DF17AF3B8C0CB2919B6D7164B0CD443D51BA17AD5F6B6FC0AB970",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1068.2673901424.340",
        "C_7FCF3928CE1A9575028B7746073AE3C5F6F2163882EECBCF60F66F9FAFB60664",
        "R_FCA9F76AC6C239B0B01B1672252F6805168C019918C672ED3A9DA5B69DB47E2C",
        "C_EDC552B835EFC5DE821208E3F9AEA0AA9771EB8639D25966017B5229C652D1DE",
        "CR_27470116CCECB22A5C95C6629B51C5286889D16DB6D6BE89E89D3658B40E9BB0",
        "NS_93222BF82F7ED3C9F50890B91B7CDA9A6E48A3EFBC7BEE0C8A4F913101034177",
        "IL_8BE4BA3DE2B97EDDD0002D9F480917D3167A50A92DE14A850BF8ABE1988C169F.2691.3528449310.262",
        "A19CC09AC555F9BA03FEF",
        "C_A8052E229C4B03577986045187D91A61D438B682AB8EF93919F6B095EF0302BC",
        "IL_CB59A51077CEE6F3DF39136EB5A2E027CEDC6E566587EE247D3766C135916829.2716.1112677935.284",
        "CD_3A4B092E649E9EDDE3FA5F08BAF4EBD82A1D1063DB19A1DD0454E516CA8119BC.2434.3984468180.6348",
        "Name of the extension (e.g. .txt)",
        "RSOP_ExtensionEventSource",
        "C_BA885398BE174F1F7801A16318AAD62AEB981E3F5EEB2272CF873A91B96E49E3",
        "CD_6EDB414A272FF229BB33606CCC694211C55817ABAE713A5736D1E4CA0295AB08.2758.1708240615.356",
        "provider",
        "Query",
        "CR_87FC3FB8BB46E54395D1465C589976A9AA29C410A5423CB9E87537B93EB847AD",
        "C_AF381E654B1D4D615B1590FE7663989B45D5E01B0E914F360B9D5BE7CAE77340",
        "CD_5F7B17759674B710C4E590B546341D8349CC1E92B0D624CC1B3690C54CF3482F.1921.1542290345.1025",
        "R_FBFFFF984DA9B7029EE7078D02385B8FF23DEF8E12B59491A9BDEA2549806FA0",
        "CD_59543DA79A0A83C48BB9222B5916E17BBA9A5688C362D35DD3F13589A2596294.1177.1836706946.698",
        "C_7E9D3FC591CA732EEA61C4B739CB4B4C95CC90462692A33742DEEEDCF2ED6366",
        "IR_2FEB110D9B2D8B964448231D62D228EB77833D966ACDE6C751FBBBE880E8D6B9",
        "IL_F4F0968BC6AFE37C8556275F636D92E4CAF670F9E788AB351B57421255A519DA.2722.3093518558.279",
        "C_939BDE950037625234CD85F8C6B1EA2B080202B0F17AF76D4D121C0816452127",
        "CD_161D7B1F7DD552C780B6CD4154D40388F29AC0271BBCB7991C59595342903A38.1343.504479055.451",
        "CD_AD28C82889667A5985FA157872F7F42C3CF0F9FD284883BEB8BA71DEFF026FBB.1689.4230965754.338",
        "C_A63432BCF943E97E2C33E4FCFB1880CB0F896835B1EEE341FAE246D77AE1B7A6",
        "CD_E4389B7DFAC67045496FC6BA0DCBD556D208EB12E13B0F5E46DDC376CFE35456.183.1118247171.346",
        "C_3DD0A80AF9236F4E7013A6DDB559EA7A2E607D76F58E1CF3D6ABF9F875179634",
        "eQEM9Y",
        "C_F0FFD49170849459EF1E56EC96E25B839FBB919B41D88FE54D6EA0BA45C84F18",
        "CD_B09B2F86C7A55023F82FE86D323CC07C044D718E99AAF895494770C3126344C7.276.2831685374.733",
        "C_410D7099EDD88BE50D962D5B670D3AC5CA5FD46428D3FEEB55DA5CF9C0146EC2",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.1973968525.368",
        "CD_32D454A462735D9F0A52FCE5591CA2A13A2526DC13869FABC5CDFB370DFF9CD3.2549.3617232489.1530",
        "9AD3DBC9A60D9D3329CE5644911B9200854CEAD799C76E19C9",
        "IL_A0C7E06B49DCED80A3BEF7A40C85A5869C293D4E559E80C1A5DBCB8DF3F1149C.2702.3535107535.283",
        "TW]`gZjq",
        "CD_4B835375C85830D11DAA3F01F5AF9F28573A4521B9279B28C7605832DE3B39C3.2743.2042272514.681",
        "CD_71C294F689D8082A855326291989D570A1243A4CED463FF3751B7DB44F45449B.1618.1.8199",
        "CD_39F968F5764B7E9DDB73F6EC4A846D4BDC3E681F93642FB5FC3C2F16314D065C.1600.2416564990.409",
        "CR_DF35CAA9032B2BC8E9E68BEFAD5091A66EF205D46DBC51F13F62EC987E8BBEAC",
        "I_05871F7367735F5F486B28150ED59EA0C3553ADBEDC56F11017BA47141A37867.2708.3908838371.285",
        "I_E93AFE85A5CB2F75A782AC45A54303D3ADA8FE8604B71C92C5A4E1716E8A8BA9.2706.265711707.295",
        "NS_672B1C63DF3BC8FC0F985D9772FF55342409C37C8E42A500C21CA4CAFCE9228B",
        "8558.279",
        "CD_DF9ECB8F01904CBCD3018F693DF94DA3A02D29F356223BB0838117D8F2475343.2409.2155937615.6226",
        "CD_9545373C4C410A85043435CEFDB53CA783FCE515B65345546AA266D2B18EC658.28.261872843.452",
        "IL_07E51FC5F002907AC12804ADBAE55FB3C232E5B8D79BD95786870994CF65BFA2.2695.2780911729.291",
        "CD_F2E5B645DF6978E5AB18256B0F51A44E754826A7C900B35CBE3234B8A07F16B9.1750.828384169.478",
        "IL_4AD8D98679E6E28B46B07F55A69C6B16DADF843DE33DB92B8F144193F2945614.2713.1603373305.274",
        "CD_75840B9867302C265945D054719AA22E26645943E0473183701AB28A355B5161.2649.2174622313.537",
        "CD_EE8A3B921C808F823B264981D8BBCC23C3D40D2D4B7C54B958C0DD90EDAE3CB9.2565.2490285041.86",
        "CD_358B12CC56B70C7D843374B1FB6AC9DD612AA1C2EE5D505F60BDEBE9063C01D1.1070.3915235521.298",
        "CD_8B70439EE46FAD5A5F853DC982F916AC93055BC01548CCFAD507BBFC83ABA779.2640.1681450604.559",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.293.3263075446.368",
        "CD_7EC6FF58E9EEF4EDC93B5F895A41B1B0DEC2BDC5260802227931619EE6182F7A.2421.290172011.671",
        "CD_DA3DC1260150EA9B0B2628C0C2AA81125377900B91EB681EA05BC31E6A7900FC.1181.1.15591",
        "CD_80675749A482112913F21FDBD7D7D7162BF42E8F9D4DFDC3F2A040FA1BE63D51.1490.3827769967.3233",
        "I_A77C02181CC284367AD1A27A90CE77AA5449C9F185067C5BA714142FB0E8B007.2691.66709390.270",
        "C_AD7EFADAD1289B4A3FEF0D60EBF19DD1D014EA7A1302D0431E7F57E3F564CBFB",
        "C_A21DD98AF56DC0A7D21C24764DDA5A5F7A3EA65FE4980FAAB7F2035E4807972C",
        "I_B0D346C46B9FB4AC80F0B10779D27F152046C18A7D474120D250279643DB5AB0.2685.2533309537.275",
        "35.268",
        "I_FBBA66A2A301552819D7971E09B8EE04666A792BCCAF9A2CFBE49A64DE51F4E2.2727.2699555294.287",
        "C_3C21EBC7E003A635BAE21770A6D11C40E030D2F9610573370AF54F36021D4013",
        "I_B890A69DD6A6A1793A78448FF5EF434D2AB04D3D34D2D1B12E9A02E877CA8847.2736.3705285418.294",
        "IR_B12347D80039C3E56A7EDB88568AF3350AFD706FD8488DA92633AB52A06ADA3B",
        "SystemConfig_V3_PnP",
        "C_495E98FF7835F373B8F5063729140C2EA897C9F6C524A8AA5A9DD4642E06C61B",
        "CD_323D5E05836B46F5664F2463C34212E1954E843C0EAA64BAC76FC3916A5923F5.2641.712437440.256",
        "C_BAE4D0378172682CEAC6406ED31D2D2F5E52DE844C38D6EC0AAF1CC23B81D9DF",
        "CD_B22DC701EAE1EC02C21FE6DE08DC67F37E32BCF7ACB4DDEC991FF5C8A52ABC75.1928.2233449371.1019",
        "CD_A9BB7C5A93904236731B5343B424DE2E9A05745595440D163D382B2134D4EBD8.2646.773050204.1018",
        "CD_82899768E5AE4BBBD9569934B91FBC458CFC15B5022DABD88277069C398DDD41.1780.1740436555.312",
        "IL_787A200B25B0F5C6729D1D578C8F78CD412BA6F80EDCC079C80146CB69F7319B.1105.1363291257.319",
        "CD_527E06AE9ED45572524985C48E4812D5807B4FF3D509658D30652F5A852DD578.2389.1418596414.3673",
        "CR_FAE2ECC09FED2EB4B7A4EC8980CE634E75CF805CEDF86064A82170B68F9B5074",
        "CD_D18B021DE887D56CED90F13460DE767FA0BA3077FF010C862ECF83FC393D6F1F.1836.2989187561.281",
        "I_26E03A9CD28DCA2B27D411BB6E709A37FE1343F5951BDA6FD8A5625ED37BA0A9.2724.3503486538.288",
        "CD_C7753872127F972FAB5A4ECF3A59238F36736CDCAD139F5290039065976DB9ED.121.2809043260.526",
        "C_4FA7CA8594EE1914553B3C8FFCE3DFD4FC19CF88B46AB33B2D35585049F86D8F",
        "CD_755C3664114AA9097DEA3F0332A59D1FE1A4668C8001C4E97937639305CB9174.1650.2711726867.323",
        "CD_29DECD57CEAC20C8FBE48C1CEA8F70E0F53A065C3A111386C70723311B9A2585.1569.708274825.330",
        "Fatal",
        "IL_51D55482B7AF4894C57C3464572BF16B3F50568D4C97132E3EE18E297A796DF9.299.653620820.315",
        "CD_87D008EFB09EBE054B42238F99E961FB1656BB710FB8E0DD5A877F77715BB017.2177.111328199.2290",
        "CD_C415F4D1DAE81CB1FFC16E6953FF6107B9F915EFA0AC36B2387428914D707A66.2732.2106293223.971",
        "C_C067A199C1ACCE03298DA4A596E9323C2C865C447DF4449AEE4DAF3E29B9DD32",
        "CD_87E1C2F47BC6AFE40A0BA43A6B695BEEF3A012F8171DEAE2BA90DB3F65BDBED9.2651.814173329.371",
        "IL_8D7DA88B4E8F335198B657798880A2A343176F0A305363A8B9B4A76DC3F936BE.2720.3583691387.287",
        "C_84081326AD6BC57C195B24744D43542EA433B161A3A16E81DF0799C4F41F5311",
        "C_658E0C4B130E8BEBC5BC986586FAD070B6FB394D894B19E03574720111A1BDB5",
        "IL_6410C0A37918C7B8F4A9286D7CA70C520DA5E83691A1C812FA90C1384352799E.2697.2881464094.263",
        "0PH\\`8D4X@<T,L",
        "I_C52295624F06C940B122D80C080F06A7E8A3B72E8DBB8DAB3530E90B3C01E0C8.1501.2805401284.326",
        "NS_C8FAC0B9742DA2229C2ECF37FBD0ED6687D27F243CFB10F824B862A83467DDCF",
        "CR_0321441591402F5AF02BB91D74BEE22B0CD8DD0874929978DA89FBE91F7CA9DF",
        "IL_28ECFDBBAC6F104030F183D6897E140EAA90F92C3DE03CAA6143ECC7A5E12353.2705.2306488271.296",
        "CD_8BDD9C2AE81784F0CFF79A8F035B6CA9B5C2EC0B45383CE33CDD57DF061981E6.272.1574348742.1139",
        "CR_DAA0835D90559AB1BED3F4706FE66DA711EF5A48A581A0339267CD41A8EB5EF9",
        "C_F9577C2F184B32F74981B6FE74A751DF70B09D37A1C0992592B3A2A75D5D48AB",
        "C_ADD63404B54D72293E84E37338B556310E9392076D5D8A2C41D64BECC71833D5",
        "I_3F104FE97BEE6A604062E0B22B90BB6D1AD32C83C24982F7C5E9FB90D43955F1.2715.972230385.272",
        "RSOP_IEFavoriteOrLinkItem",
        "C_45825D5E91CA2C0282764680BAD49693442FDEEE8D15EF9FADD54C4BF9438553",
        " $(,048<@DHLPTX\\`dhlptx|",
        "C_BFADFC7C01226A013315DA8D6A490777F3088D0548B91B44B7B3C64DD75485EE",
        "CD_38CA7FED21B16AE8C42210D10395046AA0C1BC650EF11697FFB6D8AC7EB96050.67.2370432329.250",
        "C20E0D4F969700C32DAA062617DCF820823CC008648C47EA2B157.2722.3135892395.275",
        "C_848678FEA3E9DEEA8B4E9FB42ED8A13EB705C3DB7C73AB893E320FAEEC87714C",
        "CD_B49D54127CB3DDDF22487111FC3067928F0BA3A9AC1665011AEC9D08EE1BCDEC.211.641839046.6251",
        "CD_5200A18802E4747264437AC469BB415FA346E34983915EA25009200F37191BB2.1153.2434341686.304",
        "CD_7F6D7AB071C5599637F51EC5AFFAE51440877864BBF7579093A40694E069604E.2425.156409205.368",
        "I_14021AAC6E970C807FAF1CF19FE5C780A789D3D4663E5F6B3BA731B749E2DA16.2676.595283944.278",
        "IL_E3294EE78EA1097FB8CAABABD4B3B8C600ECC722ADC76CCFD651BCF2BCFC05E0.2716.3840841294.279",
        "CR_5991C657AC0F9E2512F72FDD17A5173C60A75B8E36E129493637EEFC667B2A38",
        "!$'x*-0r369<?BuEHKN{QTWZ]`cfilo~",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2374.1927714195.368",
        "C_B94A787F77AF023D219A0EE0DAC66FC04A9B36B8A75CF39D1E1673DD4839FE01",
        "CR_961B71EE3CEF77853FD06FD1FD078D670615B8B606936AC4407F5BADB29E35F4",
        "CD_B8A367B6799F63452F0D33325AE9B052BBCEE0513101249959EE38B74646590F.2650.2198261037.515",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2041.1860447720.180",
        "CD_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109.0.2598205579.263",
        "CD_0CFEE70EA76040BBCF59E006C673746B621403E235671233CF5C1C2B3513102A.1082.620768623.732",
        "48006",
        "C_2C6F54CB3676514A8A4DB7A3E8B5DDBBC5E0E9B8160B66CADCBE260B9BBFA994",
        "R_B569F67C5968D82AD8749D09D16B9687BC374DFAA2D9DA7AC1714E00DB58CCB7.1747.1609055723.576",
        "IL_A0A879B80714A066CA97E84A040B2B5B3C39948C3CB7E7A0FD7AE12BA2EC4DB3.2693.1554327079.266",
        "C_0A58F1099E1858890A23C17CEB7DF497DF64C99BE6E6E018304675E56C7BEE40",
        "CD_563CAEFB32DA9C6DA846FEF0491B998A5AEB53D92D124F8B8C12120BA57E3D17.2758.1659557821.359",
        "YFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "C_7C45DDC3F0B908F61AA329F5465AEFAE6329C442DE4912860BDE52AD5F8B5167",
        "(,048<@DHL\\`ptx",
        "SEL_EVM_REV is valid",
        "IL_30CD5A959B1EBD8FB6B1B4230D23AB6DE8D97B42F3AA6F60BFC23575AD53C499.2729.2831769606.290",
        "CD_89FE4ECD715508D84EE36BC94DB9C9AB6DC6A560D227442061D4288D96910660.144.1929646832.1257",
        "CD_3E152FC2D094C0BFE09B842BEF965DEEDFBD99FA03D75E47107F03F5A9453659.1926.1786841729.256",
        "C_B92891CBB65AEAF607479A16326D383AB07D2531A1DEE0FE9CA0B9E07C092BBA",
        "\"%(+.y1qu}",
        "IL_37E6A27320FB004B91393DABCF4770C9BDD5EE4018E2F208CA18D3EF1C3349DD.2692.4031001905.262",
        "C_C413AF31EBD45FA510AD35ADB1344C580081CB05511196B32B7E7BAB01E4BA71",
        "IL_DD854F125F4A576538958B8314C80A91D5959CF82AFC62D4FADEC9BEF94A83CC.2680.3520144132.286",
        "I_7BB6BDBD053B0345C959F5F092B8F75BB256CAD418217440829B48B36676E853.2711.450403225.285",
        "C_FC4E0F3A799ADFC0F2DF9988A333610A6C5A2427E1901404FD3CB754B0E93B5F",
        "|ld`hXH",
        "CI_0B714A230756027CB9D944F3C101E5485E82B469361846E74358E5EEBA5C05B7",
        "C_4E5F0B888397E4532A37F63C9F9EA0A293D8E13FC549C1AB0831AC14D99C4786",
        "C_3E578EE07841672D662C242E733DB5203704061876BB0F37E75B8DD60B9864DA",
        "I_1E3EF9F69BD917FEEE3E15B1CBC366C928E4D79278CEBA74D060109ABAB3F406.11.1163568866.208",
        "IL_F80CB1528F4B30CEB103FDF154D34B5F1984F7E262A0C0A37A44CF3DA43BC6D3.2680.3667181496.285",
        "C_C10127CB37EFA86B80555A592A878FAB68964568F8B1F59089071948353A3BF3",
        "I_109FF4DB06F1B7E43B4FFA991E46E1AC64566587215453FAD438A316C11699CC.936.1.74580",
        "CD_E180FA56BE25537B4EDBF25A70C610DD0A17358432E8B0D7F517AF0A54245AFC.2106.3555644599.609",
        "I_E7C69A9468F4D8DCDE02B219463CDAABDC2CE50707FE4D1088392C0DAFA0F078.2713.3707429983.298",
        "Not applicable (signal sync type must be digital separate)",
        "I_D7AED4ADDC8BF97824D89A0FCAD2D2072CAF10D93AB8E1E5CCF303BA1F937C01.2712.3034257327.276",
        "IL_2D4822F447C7F0E252E16C28DD4A338F7F4E3A0F623068523A20813A715A5693.2697.407692074.272",
        "CD_EC77747DFA1A56E57865C924EFFC4FF3B343A32F0410A14B86E627A721399A15.1958.3486374247.591",
        "C_1CB9E7DC27B4A89E576CF24BDA3B45DCE8B5B969797A00622E9D1746514F3E59",
        "!%)-159=AEIMQUY]ae",
        "SecurityGroups",
        "I_522DAF94893EC0B668BD3D2A7622F536E2CEAF247323F83CBE0BA6A66D2E9051.2713.214133369.298",
        "IL_E6B542B82EDCE391F6452F63ED46CA719A3C6012BB70E83C717203A53EDE5178.2685.4244524058.271",
        "C_D36BA3ECD67E70A681B6A3C59013CFFFBADE74E531546E307816C80C79F820CF",
        "I_06D6FB193493B2B3AB18566CA818BD25528D88E2A3D498D0E28DC2460169A56A.2484.2094800135.276",
        "IL_95F4083250754FC3B4307D777B3270660048ABAB373B4F4EB2E60EB9A0ED9C9A.2736.1868931986.284",
        "IL_B349FC6BA4DEF0776629ED5A22F39B90C80E92CEB34E80EB1FE61834E30B650C.2728.3404309503.291",
        "C_43A96857609592D2C0CCDC633A9E2BFC7303D634E1F8D71CB3C5A3DAC25BC112",
        "IL_833CF2FC625EF4866EF85E33162234CD5F7B9296EEE62518D56CB29586601709.1049.2046614358.358",
        "CD_4E3D5CCD808B0F3A82A4648CCBC5888F1991C867B5C5012B61DFDD621BEB3D91.1991.314065497.874",
        "CD_91882C4E4700146BC908AC03DB139338C0844AE5A877163990AFB47483D7264C.199.1882675649.1754",
        "I_E3E2B6EEBC1656538FEBF1B9BD4F13C2A969A385947E32794681C4401F7CDEE8.2685.1285217656.288",
        "CD_D878682017FDFE3FFC3BE47E7AA8B69EA18CE5000B41D11FA815F1FE13934384.1231.3066208370.1072",
        "CD_C6E3EE8EF6D56B8775AB86145B48EEB7F23DE79E3696F196FBB9A7C5293D0CA2.2177.3387365483.936",
        "CD_3B46459D96BAF6024CC69D0B547D339FA3140A99F61C6D7F2039EDDAAF55977A.1788.1.19730",
        "C_98772C151E80309DDC5E68EA8FD1FD4D236455E4349502089D504086779DE396",
        "CD_58036643D64E8A1516491471C2E429C56B6A6CFED0C27493BF3ECB5339DF324D.1183.1142095179.1950",
        "CR_8757FA834BF17A34F40DA9E567F73EB3C0F519BA77B457CB4D641370202A1355",
        "CD_3E214E33D7A5FDE14F0AA348BFED5EB5C77FBA80E64B04793EFEA1E92F43C436.1190.103934137.244",
        "C_2DCBBFE173C5C78D37B1B0F8D0233E2C025177C64405C72A9D90467BA13EAFC5",
        "CD_73A88FDC213676C2ED05DA8525CA5B5530F043E01D7A1BFB77B7406A3243BFEC.313.2273449297.512",
        "C_AA1DD3640D7B2D57CFE7C2BEFC6486AE9A0D1C4F244663B25B67A3D81A74611F",
        "I_E2A1C17D64AC2484E915F0EF57EF0F27CD8B66CF0E3757C335DF40A2CDB774FF.2735.3011151588.272",
        "I_735C7FF3641C965F1EB5776D9F87024B30C59AF8D79743303DCFB2E5F4C7ECA7.2702.692532791.286",
        "CD_BB8167061523345F8CD6783B9C5021F1F77CD1511AEA7467940486ABC39B70EA.2376.3465396226.4270",
        "C_8DEE23D90020D3105727A34AEE73EEC049EBD7BD948439E6E245580A6ADC8236",
        "The security settings of the file or directory",
        "CR_C48F0C590442CE3C69A9849B8A3935A404E7F5CEC09E5AFE1A03E881F81C2AE4",
        "EXFAT",
        "C_2457D9C98F2D638D85934862CD265F309B9B1D792C3B2C7F8E2851CC28A53072",
        "NCR3000",
        "PoolAllocFree",
        "CD_73AB8511F9014E512E85EF3A99D2DD6FF770222649518B384919441776FD3714.1540.488983950.778",
        "IL_0A0D16F2EB06DDD2DB67E8923689AD964E906BA0F69213F241C03BA29909637C.2714.2124578502.274",
        "CD_92C92331781DF35B14382C2C18FCF4F9CE2A3F0D9A27B8F847108A01941602A7.1829.2573084589.451",
        "CD_F21F1D740D9B9C099DB99FAEA668DEB9592F3D05BBF3FF4FE3FFDDCCFCCC136F.2086.2618490313.6850",
        "C_7325C6D5F23D26543C59600AD0F4192BD8EBF069FEB8836805F79D1EC53CA66E",
        "C_D3AFCBAF22653374F26FE8337CBE6005C90DBCA84C064E5B13CA4595121B7209",
        "Hard Error",
        "I_8D9107E4ECAF109CE6D86793D80E0B566CE8692178AEB151294771B38F8935EA.2465.3858079449.340",
        "I_41AE0E8A27F69BB81713327447DFEB3E4D47E6C961601828958257151B049D62.1617.2728978779.280",
        "I_DD854F125F4A576538958B8314C80A91D5959CF82AFC62D4FADEC9BEF94A83CC.2680.3520144132.286",
        "C_6F8403455290EA575F6453F1C90F840BA153FCE689B6409A610006D1F81CC7FF",
        "SetUsage",
        "C_95EC7A4EFEC83ABBDDA5099FF99F34F3F0A26217E92C58663611DD1463FB39C5",
        "CD_286D3AAA59AE00C2CF7EBCC4AB344CD2AFDCE3C2B408154E04E7644656DAE408.1476.2706488538.4987",
        "C_A2392D279E55559D3F1D33DB8F42981C4F8134A3716602C2005C822A63CFED06",
        "CD_947907BE0C21868B3B6C1E2B3F2F4D8F4078DF318D2CD738491AC5AC30B4B16C.2115.1047513203.5320",
        "CD_23661D69AF1192D73D2CA18E9EAE4F8747A8AD619CA09B24089CE9CBFB6DC7C2.283.305647535.1181",
        "56BBCFEE4C9BA4.2708.1562184897.294",
        "IL_BEFCECEA527C413259A957D2007FED39F5382D0FC8793C297AD4FE052AFC7953.2708.1152756824.288",
        "C_5120F8DED242719988A9B53EE954218632D3A896BD93867D072F4224AC3F8FBA",
        "IL_C8C94034D2C193E2E0F766CF47324B6E56080059FFD7BB85570F023A93607A43.2678.1870396225.291",
        "I_386D85B50BE3D60DC60B4C867F85C74A8FF08C6659102D9DF5C88A27B2D9E507.2696.562378574.273",
        "CD_C55A7470B8332BF850F6A1BB899F44CC31C22E85ECE7FEB3F9DFE496B3C9D7D6.1342.3221650181.949",
        "CD_6C756EB273723D495E0077DD8DF32546A295F700D41FDDFEE417E7E6BD757CE9.2643.328505271.248",
        "C_73AB2C44348A01E13C5063D68EF8BDE94E3E3724E6AEC9BBCAA1E2B765F4DB3C",
        "I_178E3CFAAD67F68051F62C30058B044ABE2CFC21508B4939B040A353BA0CEBCB.1195.1404862867.376",
        "C_F62E0666212AC3F3422A2CD244B01C66D5C5B4C6B82C02CAED0A73F78C5069FA",
        "CD_E340FB8EB4DB3A4F1ED0804CB2A3406B4CA2DC92297E79DEEE6E8BA2BD0D28FC.2309.2375105055.249",
        "R_8C64C742C17295C471BDDFBB0449A20033FBA45FC5101E58D4755F4826009F5A",
        "I_53CE600361D9DC049AB7920A4B0095959C43531AA0DA3E5EEA49EBF699C0A9D2.457.1.47278",
        "C_92D90F38218063ED84DEBF091001DAB75383FEA23B31338C700BDB5B69D9A383",
        "I_D78E65D43C587EB37A9E43FCF3F4E7363727C5F50EEB63C8CEDB36F05164AC6D.2489.3834681307.328",
        "C_F28C8DEA5C25BE79A5199D7DD956384256552838A3590739F763A55FCCA51801",
        "lement",
        "C_60B2C39E9389EC16D58497FA8BDBAF35697A8853CDA423F037ECBE4502882230",
        "CD_3EB8548389123862A422C2E25B4027357178AFC61EE51C94A0FFC12A2DECD02C.2607.352149992.1710",
        "C_FC64B24C83B6ED14EEC6C8C71996B5B6C6A9B3D7C971730102A87962981FF379",
        "C_9CF59D58FAC9A98A4A3EA953B45548B5589438D2DAFC7788C3503F11F40E4CA5",
        "IL_67B7F1F441134A8C6F8A678F0D7E2C3F20906AB6C6AA040D4F6397D5971C3457.2722.697770390.281",
        "C_0ECE64D6C9FD8163FE5818A7F4BD3EDC3F5EB7904EF83EFF72449ECBEB02CA99",
        "CD_115C2C7C875DAA2D80858EAB217D4BA6077F4CCDF9EB9B75A301CD68389427E6.2749.3642086547.263",
        "CD_4B981929893A87977235CA1430A7AF681FBD9AFD465710F40972F6208B5EF455.1915.500705504.1016",
        "C_EAB61DD44B853A5368E6DEF80BB5C6272003255B9203C275FD85B8806E87A024",
        "CD_D373AE5F38B7FBC99F3F2A938B5B2F41F6670B434E5300D35C9C175381801CD6.2569.944479862.399",
        "C_166E9EA255BB08C445A06F8AB910D4091FF468572C57F60EA885C78873FD91FA",
        "IL_C9323E261C8577542F978545E924307FDE0B29889C1A9D51F66630696142C9C5.2693.3124001651.265",
        "dhlptx|",
        "I_0A99BE060E23FF6761359B992B74BD229BF1DDB4BA0B1CEB20D3B086485592FC.2702.3688904766.285",
        "IdleStateAccounting",
        "CR_C05C95F46166D09617D40B3234DF5D418002473BC054BEFB1B5410F8425E2AFA",
        "I_7B158C54C75004C9A039B513F2FF968C8300241BB4250EACC8C8B214487EF6CB.2677.1803306854.280",
        "C_E4F1C8D43CF6961CAD75D4CE9F32B9D90760450C3087C094F4C15FE6A994A33D",
        " $(,048<@DHLPT",
        "CD_563B10B3D43AAC1D29B6576E177E0D67C5C30421BFFD3A02E92B9D8D83067BB5.2644.1708422777.427",
        "CR_75B21F448BC6FF62B3ED2CD311F63E496645D7FB9BF098798AFD0623A4CD84C1",
        "CD_79FD2B1944A0E8569231538101AA02032B2AA1FD92C317847D2089CA52F4CD72.1150.1594577589.633",
        "C_6634D213315E8C29DABB7CFB305DD30D72DDD830AAFC4CDA9EBF4BD88079EDFA",
        "CD_06B95516C170444CC895270E847F3B76BA4712C919901870D883B631ED78C408.1270.2030129958.1028",
        "CD_E9CDE95B78A19AEE2B087772DB9EB45B8857BFE7606062680ECCF0441F1E7AB7.1758.4025113417.345",
        "IL_0CF2AC6255B121D622EC45FE14E7E9D07C0760E987A0964A8A827D2FF5BA64BD.2686.2855216389.267",
        "CD_1333CB41C7BFD90D640EF18568976AC9246A93F3945F32BDDD813256745C7061.2196.2536636285.614",
        "CD_249661A8E9CBD86C5E39E274D7BA70EB4D250FBAFDA52F3362ACA1923C54F956.263.2653274812.212",
        "CD_2343A770CBD378E144650E17140F5ED4B60707DE8E9E1C4FF188F8883A2D6939.2443.322567268.7340",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.314.1731029449.188",
        "I_50D24FCB691FEC565B060B5A0A3BDFF05F60CD093BE85253F2969984B4D2665B.2719.1589407007.272",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1075.2139482593.332",
        "C_A188848719F320C94F375EEE54D40059ABF083373A9064154047735B8379D3A2",
        "CR_1463900C5E85009C74D970DC08429284D480248969B543718E853FA68E152A48",
        "CD_B60435CE818644D9A1F2567E6140BE72B7D5B428518C568542A8DA95A34DD30F.1500.3588399656.2798",
        "CD_88C4A951AB74CAB93C6609B0E8AEEAE37E1052602716388B72A1ED8A64671F4E.203.4089036609.5976",
        "CD_8526133117576DD793C5FBE12D825D346FCC6B0DCB7DCB25789FC2082421D4B2.1059.3496139836.464",
        "CD_62B7F57437B06407AB4B39D9915D0BBD1E5003DEA18F986400E85C5F698F8D97.38.69533572.464",
        "IL_F693673C4CEEE255A0773D7A8C79A487F5442508823CBC6EC11DEA6527F363E6.576.1.17537",
        "CR_BF1E5E829A1544FF8B694A6E8073DFF9D1CD4B2724FDB9291959D5493401980F",
        "I_4C121C5FE3F1DEBEDBB2C51AB322AC0BEAC008E974ABD671ED635E46D37493C6.2718.4274374562.283",
        "C_390A7265D9FEAD6AA3D52AB61B20BCCA9E6B67E5811FC8A0748502D100C63214",
        "CD_D1F35069AB830308A3D10C95EC411D258E0A9CAA2EE0311B34E2874304803008.2012.2304532161.631",
        "CD_000FA1AD23A342CC5409A97F904028C08F562A8841D024941D8FC5EF860D44AA.2603.2445115712.934",
        "I_282534304FA1FEB8D9B54895719DA12FC0DC5D04D5D0B3ADA0BECCCB4FE5D211.2554.249282375.272",
        "IL_62E666132809A0B2045A7CED77F69F241DF685F7B744FE5ABA82B2F09AC381F3.1015.4071010401.338",
        "CD_7B24EBDBB87970F4FDD2609D6CC7B0940BAF49BE0590A3A7456A0B343987BCA8.1780.3720163516.304",
        "C_4890EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "C_12471D6936B91DC2838F052A66838F273DE5045F0CB1852A0C46455436BAB9A5",
        "SDBUS_DEBUG_RECOVERY",
        "C_9360C938996737B01D7C471CB4A9F0436B9152B50CA0648BF04AB0AA48F29C80",
        "IL_9B07AEDFA0297C3D0ADDCC9EF3319D27BBED68231233AEB11FC9E3B82B9AE1F7.2699.2757768313.279",
        "C_F1112B4617C4E15A42328022C81AE44A37A10A63A4D769F7A4166A768F8AF9CB",
        "CD_52D2D582CC450E6D07EBF7F5FA5E6D36BE955E5652346A68534B9BBF05E2BB4B.1734.2078368004.533",
        "MMCSSWakeup",
        "Northwest Energy Efficiency Alliance",
        "R_1AAD15D0EB29FC4E49A68DD6B88432FE2B29874A40629B9F43B85BE2528F2B3D",
        "I_77209C176E432268EDBEA05FF7F5FA70285AC2C7EA0E17CC6D5F76BD0E5BFE29.2706.1906570416.293",
        "CI_6EDCAD2493CB9C9AE066E77642818C8D9B9BC312C7B4C3A76A07871F0E60FEB1",
        "C_2870130F618D37987DA37CAB8C2078BA94B2DC9559790EF971A732DAFCA8D133",
        "C_1B565D8B02DDE679557F2CBAB41916CA553B573D803E48E8137768E2235FAAF0",
        "u?<W6",
        "IL_D5015F0F522081FD020EE5B4501E138DF661E57BB72BDD7C27479EFFDC65FAEE.1329.3625107094.215",
        "IL_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2.295.4095909741.338",
        "C_28A74361A668148487322B05FAD3758AA471FC05BFA3377023FEB3DB1A9716D5",
        "I_5789BED90F29CAA7CB11F959674E13E771CE99940FBF2CD03CB19B4DA46F7D55.2725.6839705.289",
        "C_AEF5A70C706EB1C2AF0BC5B36F14C87FA31F991587A5360179E66B8CF9ECD4E1",
        "C_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D",
        "C_AF16997CB3D825CB74BBA4887FFB7A80CD0F11C5EDCCD8A5EFB1A99F07DA008A",
        "CD_F6A5511071B6ADA7B69A807654FC692011B1BDF2F229A77550F5BAF2AAD135DE.1778.2179121829.5369",
        "CD_0DB45CACA25E882906575B2D36934F555FC5B0E4AC7554F46788D84D3F95C547.2667.708807276.354",
        "19338495C90DCAFE2FD4308C53.2677.5690151.273",
        "CD_CD980EADF185372EE242A5AB60E992FCF69D3939F9209EEA837A4F7EE8E1AE0A.1560.1657277733.3041",
        "R_41695C2AF45A08336AFE1BDB6F027AEAD97E2A04551B2329B3A302DF92AC01FC",
        "CD_297B009625C3BEC5F682DA65A87D7971BDE24BF0C5093DE7BD3ABBE18CF35D09.2032.4291846294.6773",
        "C_00FB20AFF0BCCA524ABD6DAB177F9751027934D1490C8FF1272B32FE7B6C4631",
        "CD_9057D65F1A25A157C2ABB405A133D0F21AB61118DC6B4FBB2C013A804086D040.2513.1867426209.739",
        "IL_BB5421369FBFB52FD92E78B2FF8C771E965FFE9E0A31FACC2F73C07C29BD69C5.2727.512328691.288",
        "DevTyp",
        "C_06F709A163637DA41871EC661878543C4C8F0288DCF32B1331F472D89C57FA5E",
        "I_8DBF49FAC5DA01936A7327AB48425AFF0626B68B8CD04EA91F8AE6F72AAF271F.2720.2036729576.275",
        "C_336E7A880175CEC7983BFE0692AA78604916DE79A3400288DC3CA68EB96A07CD",
        "C_85779E8BAFE3789E38C6257CF29ACDF9D244A27016D22CDF8620CFDEE1A226EE",
        "I_D9C890A34BBB77EE74D7D32AAD32B90A78248186522A99459E30407AC8D00521.2717.1969802484.275",
        "R_0F2B55A9A6A8CB8DD00B7F98F9B81FF48318AB497BAD45770354B89260F057C4.2450.2486678799.520",
        "CD_353ED06D06D3F543C1F82745622C061EF12A64D07607F4A41BBE9C01357C9257.2736.2546672451.824",
        "IL_E08D4981872FD3B2AFA0F1FB57EC86FC31C078350F35DB4223FAD426E315F43A.2735.2611756509.264",
        "C_818DB2B3AB26C49A2AEB1D243B555363E794DB6E712436AF8BBB2D25701B24B8",
        "CD_610AB796758AF91BAFAAC5773CA30FA987962CB5B589ABCAD3D6EAA7F97EA9EE.2036.1550397215.248",
        "CD_48B0C9029B67A5C53A5796286B490AC8D6BEC1B48F8B30CB5F54159AC40ECED3.1016.4056784705.246",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1075.2208756393.180",
        "CR_CB8902267994B97206E0B7D2D48E5A733ABE6C5272CD230F09306A7AC1595890",
        "R_FEDCA171A0F0221C9CCCA432160431D72B4C8C69357C96E8F7681B02FBE88410",
        "C_CB1ECEE1216579C9BA8D257FFFF8A9D0A3ABD699A8CDB2EE7F4BE7CBACBA142C",
        "R_D2727518A24B8D49F98861033C52CD96D244407FDD577E19FC82159124F4C651.299.2348505747.548",
        "KI_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "CR_4C5A81206183284769D910458D05B5688A17E07BEACF6B75FDB41F487B4FC2AD",
        "4F40D004E2BC1C3C9AA54865F4",
        "Debugger",
        "C_CE0403D1F6C8F032B580CC54FFD1B59326317C97C1A606939745A3B9BE941D11",
        "CD_B23B95CC62B7FE1710548CD8E1F8EA0575C88F97DB71C9F2CD52A08E2E5CF281.2216.684429079.795",
        "CD_DDEDD07282B8324F60B5A48A479C1B42607AE5EA149F90058D5C2368C1337E02.145.4152655182.905",
        "CD_36B87E3CF873D5DF59FC956D1C967F5AED26B2528A61DD13A73C206412B51BFB.1188.497838894.417",
        "I_E40C545DE280620436CE0030551EE24EC29A8152771DF27B4A4E1073B1DE4DEC.297.3171292242.191",
        "C_6DECEA152EB68C3B8F3895F0BFE2B8D722298B02602F918D61267E0DFA61213B",
        "I_000740EA84D41EC6F17A74DB9EFB14D73ADF4B9BF0ADC426A3AD1A6078CBE8BD.1014.2541166715.305",
        "CD_8F55F9DEF3426989FE817E17CEEF2E31FFED7183978F9BC99857EF3CAE702C82.15.92338698.374",
        "CD_F0B32BE6D192E46E123BE3140979FC2B0A80F593F5ABF50DA89150CD93028881.2548.237464392.542",
        "CR_FBE6F235041E0E3AE3541BE5BCDC297FFC96D908B951996F32623E2BBA30BD16",
        "C_4127FA39B422F35902681B4234322A2B744157E2EB563F7D2450799A62E71C22",
        "CD_783F27E34E5C5D4D60E761148DA5CB8835B5F7C975356BFBACBAB29334321728.35.38381625.1890",
        "CD_5E26522E72CD626FE622D6939EEBC8B063B5698BADD88171A20ABE64FE2C3B02.1060.1634731778.539",
        "CD_C527CB85E112E06185369842FEF25648DB16EA606F53278BEF7B670AE4C92B6F.2544.2631647526.1221",
        "CD_05C8462B4A570021DD79117F0A18597CFCABA57FA3361AE21ECBD780B8BC0A9B.2602.209308543.274",
        "ScanParameters",
        "C_3277B54ADD63DD9DAF9212009ACC4BB7EE33B9AEB2FD840D7E82EEE595AC86D7",
        "R_D44FC3A3D65B734A03695B43A5B8D840A531C99703846276525370A3AA163980.2460.600190466.554",
        "CD_122152BC995251C3FCF68650245D240F361D06B5F08943C45B791533ECBA25B4.1053.2498328764.1800",
        "C_DEA224BBEF40A5F2D4A2CA371BF633744D610A42E8901085FCD10393CC6D8624",
        "CD_AE1DADDBDD55CD086B091C2242170CB95C526932518425242374F8EF9564F554.1332.522693180.1502",
        "IL_A8BC320193F17EF43DBFB8064798B055E444198E0FB3244B7B58B6A168E6F068.1620.642525323.924",
        "R_90BEFD5DB48494878DB04E68E99BC36C64E916ACEBE36216625D7CE508C8EF7E",
        "I_A1697C739EB29B9A112166D5680806E521E7FFCBA1D595E9355394F49F125C42.1076.3634103281.187",
        "IL_A77C02181CC284367AD1A27A90CE77AA5449C9F185067C5BA714142FB0E8B007.2691.66709390.270",
        "CD_B4442D1051C4005225332D6A3F9917C9EE5F09E38BBE394F5F49F7356CCA2592.2650.2840758981.910",
        "@DcLn[qH_jRfV",
        "I_727D084B173373D46F94CB6F64D3468BE5462ECCEF242203910CCA707C262814.2713.4027850681.295",
        "CD_2A5B35A7EDFDEFF055BB37FDA6DE592042B6B41AB95D0C58AFFCA90EFB735B71.2598.3939736724.91",
        "CR_A6252CAE691CD1E28C026D5CDCC06F6213D81E91E114D969C8F008BE1E621E83",
        "R_AEE220688CA851A98A0293BCE4278EA23AD913D6E712A1893C9ADE7944490D28.1932.2098806945.524",
        "C_E44C50E01AA689218378F25B1207310CAB1FDAEB49F9F7888B050672D3D44374",
        "C_4AC1D3A26D87995319BF08535EEE6BAC00658FC9706A2D0A430BCE00D546062C",
        "C_3E214E33D7A5FDE14F0AA348BFED5EB5C77FBA80E64B04793EFEA1E92F43C436",
        "I_2797AA0512B80E7E1C1A6BA2AC1D2A5EAB929047EBF4944B5812DE3C32DEE06C.313.3654328068.299",
        "IL_EAEF166D07823DD8DA7D2576AC47944178108FF5F11E6F92829261BEA2612408.1462.2027518379.283",
        "C_9E6BE90DCA6B96CBA3BF12EFB579708613DA0A405A49EA5E6B87A7FDB2747D9E",
        "R_A5134EAE65D9DD02F6CE0E924C84D387C2BC76C9409B3E6C9F586619D35EA1DA",
        "C_D6B1F4AAAFDB618A9CCA914AD92E90625471E15F06457F12DC8D813813101B8A",
        "CD_057DBED191A93075F16FF3FD87CBC67F17C999F14E2DB4CC2AED9F24BB4E2107.250.808685159.964",
        "CR_14FFC489A434D581FBF6E06A9A803439863075160D7DFAE0D83E42734806076A",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2167.2889658748.180",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.1083.172539582.188",
        "CD_CE2777A1E2E8F0439A275F7E5E7BEE453C2145F60A592F57CCEA55492EC8B6F1.33.1877352263.526",
        "C_2F12799EC4705459E9FD61FC6C601B5A8AAE36085966AD27E0D7247EDCA6524B",
        "I_D3A9CAB2761DC804371F8FDABC0EB9F3FEAD0DB8101BDE0C5FDA41AA96374B24.2713.2559073085.279",
        "IL_A296A9CC0AFFC1768D20EFF20840A5D541CD491A2C4CA1610DBF3765126B14EB.2702.4105135079.284",
        "CR_CA74733E8EBB65936479983FDEF15889A858264274FC3538A37DA4671D61B564",
        "CD_06FC0AE99192039AD3DBC9A60D9D3329CE5644911B9200854CEAD799C76E19C9.1085.2744969581.317",
        "CD_916EF6B6122453D1C58D648E96BD869758A18BA38D348DDAE67570192E8AB140.1514.2929700575.4421",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2484.660329875.368",
        "I_CEBA609A3E6B20C46344175362232618360311BEF67386392A43EC25E09871F9.2681.2293963344.286",
        "CD_16E4C6600488A67F5E78E0D62B8A55FAC557656B73401CA2A254EBCDF6B54549.2671.3918647536.733",
        "CD_CEBD5AFF150E289B2E920216373574680CB25CAA74EAD2603C3C9CC18E57F0F4.185.836986184.668",
        "Forced dismount failed because the volume is locked.",
        "C_9670F10EE6DDB8E306101B08B39BD50A63BEE4B7DCABA524C96620EE066E2BC8",
        "CD_35A4A634792A55EBEDB114AD891E21CF9F619374AE7B6580824C3DC06F6DA7C8.2538.3558226807.475",
        "I_84E4B76F6444EF39B8B7DC8A81CF89190AD522CD0F68513A037647D5384883D3.1183.1231291022.333",
        "CD_5A035696BFDB01B863F15BBC9811886914BA410145C8C25C215A241B7ED90BBF.1550.780732781.1898",
        "CD_A09DF16E80CB8250C7E8F768EDC2F0DB283873E2BF1AF5FB3DCD5C1A024C9766.1526.2413246909.459",
        "CD_066880EE966FE7D86CCB39E13B59F3C7EA026EB96DBC471703C7B38EF25FC1D9.1604.1009104264.2323",
        "CD_293C515626057C49BE9FEBCADE3529905E03FDEE2BB0FB67FF107DAC390E7179.65.4227194348.685",
        "CD_9BD335E67BAE50C9848BEA0828D53089414BA43D5342FE18815FB3521F2F4CC6.1783.4106200137.600",
        "C_C78B62B9CA60B3385B0F5901FA6A93711909709FD41A546FE8FFDEA0D95A4D34",
        "C_5B63DA83F2DA3F034A69D17BB71318BD33D3644232536A8D873D1D51AA8420C7",
        "CD_168D1FBC4F92BFD424550E619A823212CA28C3AA57199386A543480216F80081.1921.918196523.1011",
        "CD_9C89CD12D6BC26922A4DCAAA9B4707FCF99911A5CC1919F958629CE9DE116F55.2532.500907766.5049",
        "CR_2F12799EC4705459E9FD61FC6C601B5A8AAE36085966AD27E0D7247EDCA6524B",
        "CD_4E6B2407BBFA735CD558FA956E39FDDAEBB739747AD4109DB6B2E67ADBD0148A.148.2177560843.1197",
        "CD_DCDC57D76E08877538B607842F11A1CC74735617E466D88612A67528A11564CE.1916.1.34503",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2136.3952311231.180",
        "CD_D916D4BE44BE6B03E2126E7308417D188AFACB2B602CF21C6B06A3D6A4DB852B.1093.2358959714.621",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2473.3607361720.188",
        "I_C4113CAEE9CDD8FC4B6576F92FA026068CAAA9E54C89D27F3FF44B206279FA78.2675.523712438.280",
        "CD_3277B54ADD63DD9DAF9212009ACC4BB7EE33B9AEB2FD840D7E82EEE595AC86D7.1365.3189314456.307",
        "CD_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396.105.1.14169",
        "C_BEAC6077B19FEAE9A9DA302629391F9E0FFBBEB033EB1ABEA99A1F0843A415BA",
        "CD_6EDB414A272FF229BB33606CCC694211C55817ABAE713A5736D1E4CA0295AB08.2422.1395323340.669",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1520.1430031708.180",
        "0x00000020",
        "Enable Multi-Monitor for desktop (not RAIL)",
        "CD_A042D558C8D8C5910DD5298BC5D29889BA5CEA0D1A22A1BD4A1EF145F3C99D41.2757.1406427272.309",
        "CD_78AB2C692DAA3A4CDADED46AFA07DE51142E7138D313F37FE748C3A17F36D445.33.2392148025.509",
        "C_2B52813C6387932BDFDA0985812CEC314027392B2888A6CAF0E363C856302651",
        "I_56EAC04DDE2B1A984022797F24ECB9A1DF83FDBBFA6E7FACBEBE5DEF286CD83A.2698.2838412388.275",
        "r+dO@F17[a%=^RgL:CX(4\".IU",
        "R_CC44E4C8521843950DBAB094AA1CA21616B6CFB6968300B398266E06E2751CA9.1931.86193117.540",
        "C_48B29E9AE4FFC8EF806EFE0B21B81E1AD49B510512EB4535634C1F796E081ABA",
        "I_02E3B8C824FD0B9C15B4D49AB84CF02FA38E02CAF699DC3CBDCBB2D79F3025DF.1596.3726577277.263",
        "I_DE1319F884ADBC5D67568BE5807174256941679CF79B9EA2CE82ED095CDE14F5.2679.2643554633.274",
        "CR_3E11F2867F2D534D95C0593A0AA32ECA612C606596AA91228C49611E4A1C3BBE",
        "CD_AF3D854FF025C11AE0CB78C559DC0BD55EB8A356EAE34913761A09B3CF6B045E.2153.928844790.7616",
        "C_33B0A3C692AD567B6C92E618FD5072156CC98A3BCAA3A93CB3F15A5E87E34AD2",
        "I_B498B69E308CCD72907DFE63279C92042927888BB64E0D473D3C48463EEABEA9.1074.1643993770.252",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1479.3551867366.180",
        "Regional Network Provider",
        "CD_D3EDA6D3072598111F4D360786284F18068B3C68DDCCA5982ABB599E92A62555.2020.2897631827.319",
        "CD_8CB4A8C4AE0DA8CEB0CFD6BB61EF3B4F6166FD0C6E711E54D6688A14B9EB8CF6.2625.90034906.598",
        "R_DDCE0EEC8025DB3F389EB360CE7C50BBC0E131D334E8FAB08585F4C0CA2A98A2",
        "IL_DD84D7A95D8663E91CEEA7C1377D485BB4EB7E8581AA601BDF8CBC2691B3EEBE.2692.2041793919.270",
        "R_1D169410B8B805F1ECD27322AB7A731FC553836A8F92AC0D372B6B972CA98337",
        "CD_5ACAF83AC17F3EA7F1672F287BF1DD774125A890420CE4F482AACA090A7C6160.1950.452336394.1353",
        "CR_4AD29349B1757D9DE5B7D27395671493BF42FB1B4E0DC3C5CE33AC8A31C3C3D3",
        "CR_153A90D31DAA2BB98D107166F8216FEE25A312878D4AECBB89966D3EAC52B5F6",
        "IL_33CEC8A7CFB94CF359B1D8DB7A78A905613ABB782C6D679A36760A2F9C1F36B3.2723.2940010785.283",
        "C_C21BFFFCE15B0AC36B6B41107E5EBBFA7DCF9522B5F1767BA6C1E65ABBEDE3D8",
        "WMI|Win32_PageFileSetting",
        "CD_04992E5C7CE2295E6031900D8FF9DBAC52E8ECD5C3C6E6D474AD88FAEE2D3163.2614.3253056039.391",
        "FADT C3 latency in microseconds",
        "{C7BF35D2-AADB-11d1-BF4A-00A0C9062910}",
        "IL_0B79DF81265C4E4334F986E1F5EE4C514A766A77488653BBCEDB07910F87405A.2715.2871099502.285",
        "CD_51A9C127B9BB2ACA4517A195F0C84D263D63864D76769541B4DDB9FD414D0423.1469.111604844.1066",
        "CD_191877833EBB16E938034A3506BE0709B7FE03ACAA65FB61B2F3088D1DCE72BF.1730.1894649716.516",
        "CD_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655.1166.1475828249.3715",
        "I_DAE0374F24463B80CDA41223BD2E462F343BE615A06FED1AFBC968627247E440.2688.115923237.263",
        "I_44B4FBAF7064AC4A9A0CE5BD362866AD87208DD2F228C69E237210C814370453.2727.3403419544.276",
        "CD_C8016B6B0049BC20107AF6058F0D557305357C2E4A27EC0BC24AF4A11B9B1028.108.3844429678.215",
        "CD_CEBD5AFF150E289B2E920216373574680CB25CAA74EAD2603C3C9CC18E57F0F4.51.2715071939.390",
        "CR_054A38929ECC5F2B71B017259D5DF98C968C29C9039A37FA5C286398E463CDBA",
        "IL_F1FB40D6875967280A04902873AD3B2FD9C801AD289E9C6345A726CBFB99DEBC.2684.254880008.292",
        "C_75562CFBB77C496AC5F7654A2A8412CA6C73A2BA8CBA12AD5B61673913C280C9",
        "CD_4FC7350D0697D65B1585376855E9596964780B95A8CAA540BF3CC2CD97C19696.2032.397457388.241",
        "R_B25DA333436380B14065F5CAF15967BBB759113E2ED71069E1E95253766795D5",
        "IL_905AC885F74BE789C1EC49BB07D9B2A618272AFEE37A563E2D9BA0F9F4E471A2.2687.1668348355.275",
        "I_CE596AFB16970382BA7E02CFF19096D995B70D4F2F08CBEF36E9F7736ACD0903.2469.41159217.356",
        "IL_084C69706203FE83DA8AC777CB426125B247348B780CAB92A1374AB474E9D189.2698.2974897117.269",
        "CD_EBD10294D9026876E835673F3CA0BB526578638585FDB3FD6B9DE34EBA8FE9B8.278.1122162883.574",
        "C_2A7832DB3183EDBB66AAA2667E80040F6CA8257F8AE4FF9540273269C8637D7D",
        "I_1257F088005C68EC5FA4DFBBA0AEB198E19233AC30C02CB7FD214AAB22B161AE.2712.2013013897.288",
        "IL_3BB2F25840E05D325FAFACABBB276A102D49D79CD3C3CCD8CF11A4F77E826041.2505.2359748797.326",
        "IL_2CCE85C67BFF4808C698EC1197E7D097220E34B16586EC1AD2A47EDE17D57EDC.2702.2390585957.284",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1751.1825656034.180",
        "C_AB2EDD2D7CEAED1C692FD28230058F639893D9AE1A7C4842A5D14E4381C9103D",
        "CD_43A96857609592D2C0CCDC633A9E2BFC7303D634E1F8D71CB3C5A3DAC25BC112.123.2730810482.380",
        "CR_0225910331B79FEA7A0ECC2E4C8BDD189B002B524044FF48F864D7BDEF12F05B",
        "C_AAF98D409E1E163FD1524923D9043946E210EC98C51D718F7EAA521044F5D1C0",
        "R_7269FF3A437308DE8B5DF3B97B35E871B7E243E24C717CDD217432928EA0D1A3",
        "IL_6E14D2561FA1BFB1620E2B19A2DDB814D3F1CA805CC531AAB6D243D461E64EB4.2685.3063845918.281",
        "IL_D66C684E9FC811F59DEEE01676A52DEC4EE3ED220BA185CD83762B906B852957.883.1.79329",
        "IL_7101840CDBD8A2C28A69F557F021EA4C7CCE5B09F94A283D6A3FE07275FBE392.2714.692590169.292",
        "I_1759FA689EF85045FCF1654275E53C4D9455D7E6C9FCAB0FA67AACCEADBB9360.1195.622011599.325",
        "MDM_DeviceStatus_OS01",
        "CD_2870C542381ACC297B648158CD3FEA1F43D21FAB563F1F7A7AA10504379136A1.2566.2316093722.168",
        "IL_8E0EF69C64DA2AF767F8E9EFF0B4FBEDF5E6A6A340A2791504A639221D742674.1017.614505437.297",
        "Category",
        "C_28E04ED4579402BA90E254EFFBE2F4B62A2F444F99D6E873BA6A10FA5706B34A",
        "CD_E787F19CC95B92FD39FF9311EE9ED6339BAB88C807BFF054C3B0B7D91166FE2E.2594.2438427365.353",
        "OwningProcess",
        "I_83845EF2309B741720FF4657440410FD82D34CBF99EA931930FB6ACC3DA7DA92.1465.2710273172.334",
        "CD_361E83FEF391365986E94F2BBF4BD6326369726C0BCD78D3A3D70680E3E3C24D.1610.104712720.279",
        "I_CE14254D96A0A6FD6498C780FB0F68231706541B91EDEFC57A0A5543057F10EA.2557.2165690296.271",
        "I_31B4D11C0951560ECDDBB097ADF07A700E42A371ED5F0946FE50F3092ED7A136.2697.2294315214.274",
        "C_4CC99CFC9275918BD831680B062D25E87A34D427349AA13CFBBAC5888CFC907F",
        "I_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.3550909931.360",
        "C_1CE82144EE1299C77E9BD021B10420F34770A35F06A428C70CB37484054DF692",
        "I_EAEF166D07823DD8DA7D2576AC47944178108FF5F11E6F92829261BEA2612408.1462.2027518379.283",
        "The mount point associates a volume to the directory at which it is mounted.",
        "SDBUS_DEBUG_SDRESP",
        "CR_DCC2AE997AB356670D27AB6AF0A0DF5B38BE28906D897D91C86FB38CED159D17",
        "C_0C06A76FA35A78557382D83813D9F6B0545E1F0D74B0BC31A4E1301DDEE276A0",
        "CD_68708B0D28964CD8F016516FC22BA5B964B21C85D4D8AED50B2A4BBA811EE32C.2566.4208570413.1717",
        "IL_DDB91418F3D637554FACB27F0581F4445917CEB1CCA74DD48A7FCFC0D9F39BBE.280.4158920745.392",
        "I_1F1B5C0356632FD18DAD38522A30D771E9348D9DA0CB01364E9975CE6521FB32.2693.1828944787.269",
        "CD_16E4C6600488A67F5E78E0D62B8A55FAC557656B73401CA2A254EBCDF6B54549.2602.299375315.873",
        "IL_F3D736CB863DF514A8C1737F82725E91286393D6F6918E8129ABD7BB13872F02.2724.83674566.285",
        "IL_A605678AD1AA7C121212F1D678E5701BA59EA88EDEB1A0117832F20650478858.2706.1051116097.295",
        "C_1FDDC576FF86C33E163A5B8EC72A7DCCE9CA8CCFD4AC8A6A8CCC18A08EC869D4",
        "CD_FC07F6E0375A047ACC1C9CE89E72A2C841B5C2CB6633B35D7C8A7F576CB2B31D.1192.796727945.617",
        "{66A9B302-F9DB-4864-B0F1-843905E8080F}",
        "SEL_SENSOR_NUM is valid",
        "C_C03F031E8E23282A9A69C271A64FD5AD50EF28B7797076D938A21925DD7926D4",
        "C_AF2CB7F709A3B2125D54C811191A235B443ADD096957C31507D844B4031F02AD",
        "IL_CAFA38A118ACA7FEAEE665A17302EDA7C82713E31C17500432EAD21D9F02D6D7.2693.3479118069.267",
        "I_C3AA4ECA53E8236FA0FEF6D6BDB765E023BD604F6EDA4244B1266C941B20FAF0.2685.2097335130.274",
        "6.2560.2939838905.88",
        "CD_CC6778A70C199F671CD04BFF86EE613A1E47C11B60BA19CC09AC555F9BA03FEF.202.1347221215.732",
        "C_8C8DB0E3672C93BCFCB76BF699D523B44C6A3F2E7E6E6A3EE64DFD7FDA4D0554",
        "C_28F6660752A3E238081EC79F7E80AD5E5E36888805DCE1EAC485A69CD87C1816",
        "IL_C6AF1792603C0685641118698C891DADF409FEF593264B2F7959F4CCD4EF45C6.2693.970187483.265",
        "C_20C8A4313A9882D64219A6814548B8CA23AA20618BD06EA1320CC257373FA4D3",
        "C_F7113F6F79893405611B3E0C1184CFF87E4747F2432D2CE16AC2FA972D4FCE30",
        "I_EB8665A808B44B1EC684D558DCE4736DB3B63938754369F4C2483F918071F26C.1051.536184958.339",
        "CD_35A4A634792A55EBEDB114AD891E21CF9F619374AE7B6580824C3DC06F6DA7C8.2611.362518394.408",
        "C_C955FE3691938CB4E504845F7B7CF5F1DDE17A84F886B06E297A90849911ACC8",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2489.121641068.180",
        "CD_A23491B3C9DD8481EBD1370ABF1AD298CC29F6DA303209600E83B50112688260.2427.3681100524.4843",
        "R_A2CD0464AF4F2B1E0431DD88E47C3EFCAE8BCCEBF409F48BBE01A3C39B53BE55.1465.3771030155.540",
        "CD_D63BC7563E6D81203297654B46F4C100817863DC21DB2D7C0F010EBB549665E0.2112.1831077353.4965",
        "C_902EBF22FB4493016C59437C05B915816E83C21CD09DC66922A850F179A8B844",
        "Driver Completion Routine",
        "IL_FD744AD30395F2B30DC2B5A4EA76B3CF1BC3EC0C9398E32D8B8DE1267FE97260.2718.2810907187.272",
        "C_5B2F13ABADCFEECBA198671EFBCD3F1F745DFE5526713E2FD94776960F406207",
        "I_D6DC4C2A426BDB3F0627A0CC3C0B5621CBEE7399F504DBF136850B288C701108.2700.3035886067.279",
        "C_FE0D80286DB95CCA86096C1B5936668BBB002E04CA87DADDE64E7FE7658CBF0A",
        "C_6E24E0F3B897790EE4AD7CBEC57A77254DFB861B7DD873ABDD3B8E12E255FD64",
        "IL_599A4BF3C070876275E2C4422D03BBD1DF1CA8F60576047EC71123766AC455EE.2676.451817874.270",
        "R_48A8B413DD01FD4E2902F07984087CB61CF9EEDF75071E3262DDCA296E4FFEDB",
        "C_92E9B87B5FFD4717696FF7754EDB672E42B94057E3EC937D7C6251C5B0F98476",
        "IL_14E81FED65CA256A291552D7368076BDF086E65B079868D33E50C9799C909A98.1072.3778842915.297",
        "I_D864ADF7E1A72B2185F425204EF595F1DCFA97AB1004E11ACE503C4721AAD51A.2683.1496429000.277",
        "CD_B25DA333436380B14065F5CAF15967BBB759113E2ED71069E1E95253766795D5.1949.3058675585.454",
        "CD_342DEDE6724A2088F8EDA5FEA74D5D57EECA3280205948035F7C62E40A5BBEBD.1923.1332416597.1043",
        "IL_DFDB823EC9AE7ABF8CA75F563F09D9CEDD7C9370D62FC361D5927DE17A82FCE5.2713.2434541595.287",
        "C_BC0FC27106A767FEC0851E8860A023F04DDFD5CE172A9F5CC2B8EE5C7AD4FF73",
        "C_7F4CFA7137A5B2C186DBA6B0E496177D52C742459BBAF910A11B04F91C925590",
        "R_259FCFE2A3935A15F180BDB11D2BB86ACCAE71C54E422895B35143097454A85F",
        "cfil{ou",
        "I_6ECAE7FD338DDFA47A9F6250AD53107E4876130C4CA23D90DCE96E053D46E318.2721.2070514180.267",
        "CD_4AE2067858965079AFE155261D6F2E477E0BF91D3D1DC9F376CE02F21B16F9F5.1541.356130840.399",
        "CD_65A504D3A866F8E7ADD367ED74A8C747DE7742D2C08574C6A20A5D6A8C659BFE.1541.902542673.855",
        "CD_A03C484E06B72F9F42200B57F029B8D46D26D0855AF12E8562CCAF99ADA5E20C.2576.2726568525.840",
        "CD_47B8D9FB99659B3546500CA55AB79FFA62B2FC16F96D81F5B390216EEB78A7A9.152.1474717736.4592",
        "IL_5209325547C4C3DC85433F489AC2215394EE00249CB48AA92AD2B0B6C8014C31.276.1250366999.259",
        "CD_9E5E1C32A05CDB4AF1E31A2A9954312146F5F7F70A8F443E107ACC81D76BED7D.1349.1112713125.1943",
        "C_0AFC43F6F954497AA8887334BB937F82532036AD13DD27C64055852F3060BED7",
        "C_4AC7D53B353FF907A3871574884AE20E2C77DD82D160B77856929A17F6C699D4",
        "IL_032BF74126BD906A94AA7C5F9E67F926ADB60BB06DCAD8F4480D345668D8EAA7.2485.425231346.357",
        "CD_4BB7B0DB9385969FCED14AD9320DB3AC26B18FCC6D3C66F2AAA7AB1D63250287.2648.1653833599.729",
        "CD_7F8BC20174A1A32E04A841C793C95C7E0241B308E1D3B8DC5972DC5E979D02C3.1601.4101585927.676",
        "MSNdis_FddiLConnectionState",
        "I_0DCB38B872FB59592D18B80943B89BEC42F008EB48C9E96443375D95C2BE138E.2724.1332542786.290",
        "Security settings of a file or directory object",
        "C_BA3D37D044C0551633D73D3A898C87E3F05ED306B67D594AC8B13EE30AE518F4",
        "CD_E5893386A7B4C018092F4F8B136F60610FB13ED7B0A8A3475C8F55E3E9FBCB90.12.3814985754.2627",
        "The current matching day (1-31)",
        "I_8ECEB18F5D5956ADBB92C60B6BBF657386F0BE596CEC9435AABD185EAE1B6B42.1352.1842879048.280",
        "C_7269FF3A437308DE8B5DF3B97B35E871B7E243E24C717CDD217432928EA0D1A3",
        "CD_FD27ECDAAA7D6C49E1565C286F03227F09CFD14146B494ADDE67CAC27EC54A8B.1457.1.39407",
        "C_0E6C55C9C7B1DED264825C6DA4BE33EA0277742BA342353CC7962223251ACDCD",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1097.4009903032.180",
        "CR_EA78D27F46C798D1329821D7CEABFD06DD3833EE6512664694DD451E0D988F35",
        "CD_8C6DE64ADB30E76FDF169C4158D6C7A5755650401C9DC05B818D0256B4965C17.2627.3659280706.121",
        "C_68988603F70E94DB41A96D6CCAF4C1247D2A19BC8932E751AE8871C31295C890",
        "IL_9FEE5F109177A11961D03E9415C6B3223CDAF24650E561C999695318D53B71AC.2709.1901861931.297",
        "CD_52FA3652DE48FD253CE895AA1E0F7F7869B94D77DBBF33883D1DBCF38C65343A.1086.1410593267.998",
        "localeid",
        "C_02E158B45830B6D4377ECD1CD643B18552229BB1DFCB48A9FF9F91F3ACA3AD62",
        "C_E79E473D9AFE640F2D96DB2EAF3BE608705DB3CD9E43BB21D75E95C836D378B4",
        "IL_1B1382F4123F74B3898AE98A89FF49C4FE1953A2A9D44449CB4E3A8519119132.2694.2286880099.267",
        "CD_D2E1F5EB4F84E0C0B2E61F3513674DF2B7151098EA22604925123769286041D2.1150.2252792054.164",
        "C_B5B4B91D054FAED56EC1E175175350AFC61C5B836E4315DE267B9DF851E58184",
        "CD_E345D54F7B8D7565C8E8A2E752B23F9E5C751735A64D115759AADADE14DF2314.1347.3488546867.1566",
        "CD_79BFFA82A64715EF01503A4F07A073E2813081ED91CE09901D87790E269BEACF.1334.44325809.1502",
        "I_FA941F6BA65E82F5FC942292D3C38D98B8FE7DBD08C5AB6746FE263DF2D61E74.2683.2129912645.276",
        "CD_FDF44B7A491FBFF7D82AA60088512F5C196339142429AA6E3D11133F28C6759F.2644.3945478976.432",
        "C_DA2CC882B6BCEAC9BF31E89756B8510C103D6DA8CC0721E36AB1395322663D45",
        "IL_C52295624F06C940B122D80C080F06A7E8A3B72E8DBB8DAB3530E90B3C01E0C8.1501.2805401284.326",
        " $(,0|48",
        "CD_032899FDDB4113F09C2927CFF27D91F643A853996B6D3CD2E896FC0EB3B90344.1849.1966338540.287",
        "0x00008000",
        "CD_F08FCE87204BA565CC8D5019202DC93CAE2C1D89D6CA6369E7617C4B178BC16E.197.4102730563.748",
        "IL_9986681953458125C97FD5A2EE1F0693C18B98DA74E92FEA54D0571D21BF0CA6.2700.542454938.269",
        "IL_0F1BBB21A228CE82C5C2058AE50D21F55892BDF5343CF705176C26EA1F33161F.2720.2632064215.277",
        "CR_AEF5A70C706EB1C2AF0BC5B36F14C87FA31F991587A5360179E66B8CF9ECD4E1",
        "CD_57DAE5D6F0455ADEAD486789BD3D641999E687462388031EF82C523529E0E36F.2505.3802435599.646",
        "4075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "C_70C90949E0D1D36557D4029047A128AB1B87AC928C46ECB81EB8625954A4B495",
        "CD_A41AFD053649038BED9397E93370DEB60FBFF83AF8C35F1EAF8651CFC8534ECC.2624.1807748504.543",
        "I_AB83450D2C362894742984071630B17B68677FB118022A7E22EAA68EDF64D1E8.1150.3715020661.357",
        "CD_4C5A81206183284769D910458D05B5688A17E07BEACF6B75FDB41F487B4FC2AD.1171.3093306476.1470",
        "C_7CFF354FA8F5A8013D770E0F778B943473F6823889CB937AB5AA32217D27B6ED",
        "CR_D628E03D0677752FF789EA97E9BA34C4E2A9B6A38484A7C74F4BA213CAD47E8C",
        "C_A7295464CC993A6D391787B800AA99F01A743758501FB7C1EC84FF47700AFE8E",
        "CD_A393FEDC8D8439E642FD70414F2815F8C5D6DC216A8FBF3F8BB710BDED38BED7.16.3148826422.293",
        "sop\\User\\S_1_5_21_3968686040_3210279463_847977608_1001",
        "C_2F2D52E78951A71F8A93996784706E5CDAF8CEE0DBC76918027981F3C4C35B5E",
        "CD_0B0DFDFBE2DEFF0C27AC9F8D5B6614399810850DF41A123329B91B91C5AB60B2.312.1329618192.342",
        "CD_54C8B2145FBF6DCDCAEFF33B39FBF359799D5087F9B974E853C4A5903604B330.2116.1590662496.167",
        "CD_7034F2AB3C1C7C569B6070FE8B60A5FAB08FEAEECD9AA784DCD8B0D2B23C7F99.2548.1788719509.1750",
        "CD_6B9E4EE8A6954AE9FF49C168C78A9585B0E76CB760D912EE50254A56C984BF8E.51.2856095127.514",
        "I_B367E985EDB528B3721C3A2E5B698AD0AB2D2773B0F6A709BEB4291CCE88048A.2707.1183791968.296",
        "CD_563A4355A2BAD2D5AAD235A8862EEFFD144A0CCCFFEF1AD7B721B7B6BA3DB30D.1576.2483082544.1140",
        "CD_336E7A880175CEC7983BFE0692AA78604916DE79A3400288DC3CA68EB96A07CD.142.1771275871.538",
        "C_798C4124D7D90A7F5EA5F56915A8B09A351FDAAAE449D9E1AAD82D024C9D7528",
        "CD_FD4E702E602A432E7AB9CE0A91059DB9571223DB712493258C6527C16FC78E38.1465.2015971689.874",
        "CD_9FAFCCC688F5A73C3B168A2E3CFB29D7012E555844D21034E40221A532E99A1D.81.1.75519",
        "Dial Up Settings",
        "I_3872556827A1EB92143B517B7FCE405B2E5038D21521FA92710E64C6980CBC1E.1090.1749376374.358",
        "QTWZ]`",
        "C_11966DA6B788C09A209299D797026F84E9D25CFA758BE1C1AD03FCADB98C44B2",
        "C_737D301CB8F93905D70C42253781F901EC7FCADD3289B3588BFF04F6F6A13AB1",
        "C_C98173DBB4DD98E37FE4A3871D8E3D099DB9BDC9DB76DC64E72EA0E377545377",
        "CD_48C8FF9D3F57E7744A3D1C2C52E57FC97BA717E184730EB1BDE77718DB3C9C93.51.3268578348.772",
        "I_0F3AB3AAD38DC62E71EC95B3EBCF4B32C73DF010511E88F91EAE962110D82CAA.2678.3560459195.282",
        "C_8421E7DDE4CD5FB05BCDE6376703734D11E3617323DAFFE1E5EA09D95D7CDCAB",
        "C_725C909F3FE4FF1D4452519DC5E7319F49B4FDA30799FA428AB30E8A93652894",
        "C_CE377FF1DC98C60D09A1A5EEDDC831ADEF0BE67608F841B05BCEBC22F775AF5E",
        "I_5D2BB87B71BEBE7EB749C15D63AE0A1DF7CB60A6E0BE0CCFD5DA7FC64070C522.2689.911660780.271",
        "t\\hld@0",
        "IL_0AD70865B8C5ABD34158C033C44041C6C28843001310CFE6E77DE3CEDC03B163.2715.215896994.273",
        "CD_20B0679F4041BCD18BAFEF5241293E767B7FC4EFCD8AEF294475A29500B652D3.11.901651859.136",
        "C_838E13828F10196D3F66F7B92E25AEB70BD0868AFEF218970174CFCF1AE4D54E",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.2136.1100920273.3240",
        "RestrictedSitesZoneAllowFileDownloads",
        "I_4E401735D6FEAF013DDA8A8718DB98D37ECA2BADF952B4E6FAA7A5E76029D5A1.2701.2696172882.282",
        "IL_1BE7A8EAF80595A94866C463E26A35793B97AB42111AD0780ED607902E172C4F.2715.3905684465.274",
        "IL_5D1CB9943635DDFFF5060D9D4FC471D7E4AF1FACF942A52D742A41C8A853246D.2728.2241789360.264",
        "R_D494E9A85935E059369DBBB5BC793F2672E05B3CE93CFCC0DD52A3144BCDAC07",
        "CD_A646895EAC509EB3B2094674B90663C9DFA1CACB6E96F7A0CFC675420DC35FF7.170.3196934588.328",
        "CD_AAF92F4AEB44CCFDCDB6851E9BAFEADAE27700548F383B0D561108FD346E7419.1343.2531978239.488",
        "I_71D1BC07380B4FE4C5EDCC0F02E934EE8E495942B17AB007E3FEF57F0329043C.2457.2936753202.343",
        "C_2C9E96C7F7E323559ADDB98919DA9CB9D792B77EB6D7DB30E98DE86B6BCDF5FC",
        "I_805B941F9D4C36C4537FF593D07075399E2D32F7AA49BFCC5322B779E6E9EE9B.2709.1690070654.304",
        "Local Port",
        "CR_C1E180B8C4366E981A2C239C795361E39EE450204A5C13220DECE0EED4E40C66",
        "CD_755C3664114AA9097DEA3F0332A59D1FE1A4668C8001C4E97937639305CB9174.1820.3006053520.387",
        "IL_614FEB5198DB6356C7D4E70E58F0634936BC6DE530AA5FD952207E56B5A89D3F.1635.1115446966.267",
        "CD_9E152E3E3D8A2665C8A4533F9A4E67D0D1AAA1D8B83D4A80BEDF2999A2CA16CE.1563.2171469281.2850",
        "C_51A9C127B9BB2ACA4517A195F0C84D263D63864D76769541B4DDB9FD414D0423",
        "4C6100B812B5CCA4229E192A675F8D51A19A1.2657.571896984.1903",
        "DeleteObject",
        "IL_A2F5B899DB2752A3E856C76966BA13B0BDEA92AF49BD315895482F20FD67DF4A.2683.2268626235.275",
        "(currently not used)",
        "c9B]{*",
        "Values",
        "C_8029010879AF25DBDB2587888A23E76C1BA34EC4177560448F42E3D335BD1B08",
        "CD_D826BFB6FDABB9CC29F695FF022B29E4C2F93F5EF932282086C4F08488D01B2D.1547.742028185.5799",
        "I_AF1545E3E9473774D45C765A92E2BEDC8713636EBF919390866E42659E2E4E71.2718.2764728285.275",
        "C_AAD0D760D72ECB11742773406575974B851067AEA4863E381AADAD2897C3D328",
        "CD_6777C29C6FFBFED630ED248E6134785671202A133177438787EF8C19819E0737.38.2440264266.245",
        "C_BFBF08D260C8FECEBAF19607A00A35F41F33A4C2C6DC4305BB89B11A0D600AB6",
        "ModifiedTime",
        "I_19E57369527D4B1D06F7B62EA4740710580A7EE3221F927586AA3C452A7CD5DA.1478.1775475337.253",
        "CR_D4D7929A8312A6DC45326BF70047842109EC7C6FE50B4DFC14E0212EF111A093",
        "NS_B06C94A1999C50A4BA9F355A310A906609B4FF5B1D6C81129F1D2B7C655C55A6",
        "CIM_Error.Message",
        "I_234E3B55C32D3CB84A4434C593B607E653755C64849684A95C97E70DC7E9A19E.2682.683545558.283",
        "CD_3777205E8B20487F970347DB3B54C0C1CE84371ABD4BCBDB57E68DB30949BA61.1076.870414287.3769",
        "I_DAE8508C63D00A56782E698B3A32653F48C5A3D5EF1E2118D185BEC5E123B054.2693.1293650204.257",
        "IL_0DD857EB2ADC5DFB72E5F5A4333BAD2BACF09A4F6529BCC15F86720371E4A7C6.2723.2802498854.283",
        "C_11A2CA51A1AEA58DC6BA3C29CD192B9F104E6EF336DA23A05EA0E2B4FE23CB4C",
        "CD_199CFC4A1FC7A648AECC1FFEF43CFCD6FD4BBDB0667CA99257540823E6C76661.39.37850779.281",
        "IL_2331F35620F64382C23A766044CE4900AFD2E35F365E3D83D01B80A0B81790C1.2710.1480883202.289",
        "C_E37269864F3637B328FA737B6C8E3288A3E8993FA114D0276C743CCFAFDD80C2",
        "CD_10549F8F6A0C1E0A975F931BF6E1962F49CF18068F6079CD179A794A32D030D5.93.705537194.1585",
        "CD_83D7B7362AB73F157F3C52E091E73C081D504CD4CCE7A6A43B8A3249A1C97801.1232.1.66015",
        "C_7E73D5C93CF19F468CCE98DAD50343B32B26C1D7418728E2E4E53FE1AB834CE2",
        "CD_33CF99EE359367737EBFC91E6221019D46F7219044317527292271867795E5F8.2743.640561156.349",
        "IL_3D096813E2EDB450D08B33432EB128E3CBE44A3FBCE6E2307B21EB677701178C.2697.533441832.264",
        "CD_988F45C7D3827182CC9E311CB986FEA0532897BB2CDEED83739CF2F82341462E.310.180576553.308",
        "o'T<{x",
        "CD_91272CCB786B80704637F2DA5FEC31804C0D45A10039A155AE9DF9B9224919E1.1106.1.50448",
        "C_4F646AAD57F3432C253520E0CA1B158B33F1559C208E36C6F6CACB8CCADE3139",
        "Terminate",
        "I_5E389F5D18C38EEFF5C365746A65203C9D9A928EAFC421BCE5234023F35E2F45.2704.2682359898.286",
        "83F2E802D970FA3FA7C66652674903D94982AB335B1.2707.1521999461.285",
        "R_31380B1CBE2DE48F4953061E943634793359C618E73F753682430004D4E36FB0",
        "CD_DB82B7491F87C54932ED0B7927014B81BA5EBB7963CC0FF12599DC8D11B6A951.1924.1019778742.1030",
        "CD_C6D84B5CA01F8150DB538B389B0DE75D972173BB6246F791D5F0EBDC55AA7278.1155.386720723.367",
        "I_2779ADC1050B1FA8CD2E2378B89E40BA7F999263644D0CA9A004420640DFAA86.2725.2641473776.275",
        "CD_14EA8D1B614BC6D260E31F428D1651D98B6F7F8F49C7964016B24597B70B73AE.103.2610972272.776",
        "I_250B10A4688437DB106B3B64811B1BC2AE66E2DEDF740DBADD26DD3B3CDCC498.2696.1684836628.277",
        "CD_26EBDAC8F156752113DE91B4EE3267ABEDBAA0A241ECD93D9A2C887C1566A5A3.1836.3721577231.296",
        "CD_33B0A3C692AD567B6C92E618FD5072156CC98A3BCAA3A93CB3F15A5E87E34AD2.2309.3672245708.248",
        "IL_DA8D9A0F02B9BFA0387A8A87ACC1B3C4B7907445D07ABF7DFCC4E162C7130191.2704.2555391629.290",
        "I_6F54BA62DA550A229FC046AAFC1C0CFE12E454FE3FD82D56A60CB00A73DE7D0A.2698.2822082259.269",
        "I_9A8D16DA945B743700B7FF96F3F0DC3A77DDF6AE107EB1A442E8C93AE53FC3DD.2692.1730269088.279",
        "C_A4EFDDEDDCE2AE550D296107D6D386ED594FA4146A7AE71A7D9821F0681D3985",
        "CD_D7F29C6D74222A2F53039DD4BC77A6BF91AEF843F0144C1443D812EF420EA4EF.2605.4138203257.221",
        "CD_6DC34F83B2836B7F4C49DD4CA9153C9A45B781EB43F2F01662DE7C715D9C447A.2423.1591348476.234",
        "I_273916CA2B58B48A229EEB4DAA16569C8F2085E4B982DC10A4A95B25D2F7C556.2699.3366413135.268",
        "C_0FB0A8E86C1430EE0BB7D412F66362E6E788646DB733ACDB85AE2E440B7F37A4",
        "CD_0E00A89CD9A41AC0AD01E0DA6C3FD34503F8AA86894EAFB2552F2D7711004F1A.2541.1731144769.526",
        "I_3CA6A8A46045BF954508B3340CD11FE30993A59816D6AA3EB1B345A8EEDF8A01.1608.3979994243.332",
        "CD_040EEFB9D32ACFDF35093E1B9FBC87E0DA3C6102445122A04A158078F02AF3C6.1932.997009678.721",
        "DATETIME",
        "CD_8124978EC1B10AEACA2D165201147DA1CBABB9C526A77FFC04D016C0C64A5CE3.2576.673429540.217",
        "CD_4AD29349B1757D9DE5B7D27395671493BF42FB1B4E0DC3C5CE33AC8A31C3C3D3.2635.210337439.263",
        "SCO OpenServer",
        "R_7C983320414DFF8D2BA0128B25033C8FB169F5189449E13D88BE3724B6F2E9D3",
        "I_D8040591183E936831471022D3E2CE1E38C9AD624DA88DD5B28B59CD2A04D198.2679.3981737199.274",
        "CD_CC0ACF58FA3646F311BC16A78942AC6DB48973323025BC27052C3593D5CE6061.2748.919599781.779",
        "IL_A85EB91570422B050DB7748E0E8B03DED2263BB8BCFA7BAB1D3902444584ECDA.2681.2810793203.284",
        "C_78FEC0D7E1A17013B9740AADA5441902D49D66AA1FE3CD04A987FABED928092A",
        "C_3F821AD6ECD189962128C4700637490830A0FFF6630C63DB1A008457C9E0A4AF",
        "Example: PCI-1",
        "C_9E95B1EEF71DCD908A163F78ED19D6297E7D9318C5EDCA74AD00C8F6A1597821",
        "CD_63CC60C90F4F24B2FCFB7B4FEEC9D511528060A9B51311978A6B312ECEE120CE.285.519827003.1570",
        "IL_C118F2758DE872E67CC7F957EEC75E4D1322D45AE193AF4A33FBB1AB37DDF2C8.2681.1727853428.281",
        "F47C7C5EDE1255249E372E90C4D8EAB77757D572A8E1F6E22B79B0FD3819343",
        "CD_47CBD249A2C567357686E5ED6091D88133AC6ACBBE7BC216472A737EDFCF1867.208.3218837464.327",
        "Indicates if the file's contents were modified while working offline.",
        "CD_6DC34F83B2836B7F4C49DD4CA9153C9A45B781EB43F2F01662DE7C715D9C447A.2390.151141694.326",
        "CD_024B3EE5711125ED9BB18C4A9AAFF769B862C9895F2BAA403A8960F91ED798DF.1194.2348036494.642",
        "CD_16C3460778AD17C374A21EA3EAA4769942B4820B8F8AA76B353EDCE060C07C55.7.1929910517.578",
        "CD_5991C657AC0F9E2512F72FDD17A5173C60A75B8E36E129493637EEFC667B2A38.17.1211015753.410",
        "CD_91604F794B64A61196688751D972A0B3626DF7A1827369CDD4AD7A23AC00FD14.30.2152691351.1485",
        "nterfaceError",
        "CD_5F2E90A9A61A21E31A81AEB905C87625CB9816F843D7A0D3E82978F41D9AF6B3.138.1059950254.2586",
        "I_B47895D31D7B0DD3EF96F56CFE7BE3730B8DACBDD6D2AD770D7F62C1CB93C6A9.2699.2723658078.270",
        "IL_E497AD4E10D7242AC9468C259EFB05482031E77720661ECC885284DEBB517B41.2682.1177207384.290",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2736.2831676613.180",
        "IL_5048D981A8918290C35B6F3CFD74A1A8AB3DF57DA776309B4775A5049506044F.2678.3507054416.290",
        "CD_E66D2A11AD2317154A9C2C61CC140BA5F198CC545A25F24736AE23D74E16B49B.14.2746877542.840",
        "C_A4DDE6CA06AA3C2825062E5C08D9D51AE25E110F246E7BDEFA87F60CC99DB06D",
        "I_F8E5C81CBCB2AD14D06971031183D6E973689447D5B464AE35FD267E34297841.2728.1311576636.280",
        "IL_6E3B4399FA4EDE750602EAE85FB276C1B64644E78344F6BB3EF3F442D17FE8D8.352.1.287457",
        "CD_6CDFA95C1CD82B67F7CE9D96621CA3D40FBBB6ED3577D6A166218E452130A3BA.1463.2076710543.663",
        "The total number of unmovable files on the volume.",
        "C_31444EBA8BB43DA8DBD0D24395E48CF844E079E62BF930386D9B66970A85DC88",
        "I_614FEB5198DB6356C7D4E70E58F0634936BC6DE530AA5FD952207E56B5A89D3F.1635.1115446966.267",
        "CD_8BCD1158FA55A97ECB80A8A0C49F60B30BE674F3AC52C77B04DD60E3D775D71A.1924.3720434400.259",
        "CD_4AC1D3A26D87995319BF08535EEE6BAC00658FC9706A2D0A430BCE00D546062C.97.1913818272.655",
        "Object",
        "C_9B5F61295CB5EF58512B95264F50C53A1EAB89490A47953F5E027131D60A14DF",
        "When RunDayOfWeek is not 0, RunDay is the day-in-month on which the Job is processed, defined in conjunction with RunDayOfWeek. For example, if RunDay is 15 and RunDayOfWeek is Saturday, then the Job is processed on the first Saturday on or after the 15th day in the RunMonth (for example, the third Saturday in the month). If RunDay is 20 and RunDayOfWeek is -Saturday, then this indicates the first Saturday on or before the 20th day in the RunMonth. If RunDay is -1 and RunDayOfWeek is -Sunday, then this indicates the last Sunday in the RunMonth.",
        "IL_7593C450FC9EE4AB50EF0BDF18F203AF1150B81528543D16ADDAEEC31A973BE4.2678.1329579257.285",
        "IL_C3441EF025DDAB67A95E6F8DF64F84E62694229740C8511E0AB3A43CFD7A1883.2685.1355955933.260",
        "I_2CD761BE49E7EC8EF1DD4C23DCFB4BB2F4200B0920FB8C88552A739511C1DB30.2711.1911607274.293",
        "CD_D03948432DCEFB99FB1EBE3230848319D45009B95943838EC079B34AD2F12F73.1617.2188337604.602",
        "RSOP_ExtensionStatus.extensionGuid=\"{00000000-0000-0000-0000-000000000000}\"",
        "CD_DF254158609170F3BC50217B19B4567D41F9A680BDF34EBE27C6CD7C6462E17F.1777.2876027482.247",
        "CD_AC0E04BCEB92E102AEC34A4105C7658C51A4608468C8FB7D34B6466CE5EDF05E.2441.883099127.1112",
        "t|x(,",
        "I_FB3F552F9275C4F09DF5D7A6BFF54B8A4B33FD33818817F911188312F8511BE1.2728.435339241.290",
        "C_4BAA21648FDB845BC99AC457B05278DDADF6666FEF0E8ACFB4E6AF8CB185DBE3",
        "9AA54865F4",
        "CD_D9C1A31E38D8ED408C173A996AAB7388592772DBA1A90C224E58684940B6635C.2733.1350935219.490",
        "C_2504DC1AC3CAB9C6ED112DDC44AEE64529224B292ABC0946F5963E4C35C80939",
        "IL_B4A2C5E94294CA48EE83444B581B7715F0456C2AE322533C1FC870F4B341BC92.2459.3129702897.334",
        "IL_A944F785A51BBDA87CAE1C427827906080841BCF187F56E21654E9005CF78E7A.2694.3756079693.273",
        "IL_0D714E05EBB19A5CCEF94D4D2F7F084B8DD3CFF95084F3C011E96E280D177919.2676.740478610.279",
        "@DHLP",
        "CD_D4639B8A3A234C7C421B844825ADE1FE2360CB4CE746D79998FBB9573B4B4A5C.1955.3755485.666",
        "C_1EAA623E5E2107E59DEB71245C575469EF4587B65CD6A524FC65E9E8A98BAC62",
        "I_8387112FA3E19914BFCEC9696AF4D624B29A433BB94295DD4D4C59F2B49E5641.2692.2118308811.270",
        "CD_9D906F35D6F26F4CDCF3EE0A3920960ABC14087255E63B64FBCA0DA96B913D5D.97.3718653332.666",
        "CD_9EB956FB069691A66CD9E5EA74E107D31AEB904391B2340F9557D3A32B77163F.1129.294067944.873",
        "CD_A2E68741BBB2869A917DDFD8C9DA73647EFA8AC0B63D90B82F4EE838A6078824.1337.1253437522.2435",
        "IL_914A2F315AA61257216C9279ED7B59CCDE3F169260EEB98196C7B9B6E52DC13C.2725.1592081159.290",
        "CD_4725B2A55879D0E15B24B42E1D8F36FD060F6802356C013408946754222CF4DB.2595.182650784.503",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2750.1656231170.180",
        "CD_D6B1F4AAAFDB618A9CCA914AD92E90625471E15F06457F12DC8D813813101B8A.14.374741798.377",
        "CD_8BDD9C2AE81784F0CFF79A8F035B6CA9B5C2EC0B45383CE33CDD57DF061981E6.267.825798134.1161",
        "CD_5F24F19683720FD1EB4928C01BE6B72971BB4F46F372476DC9706705301704D6.186.2379202817.975",
        "x#&l^ru)i-1oea59<?CGKOSWZ",
        "IL_C7BED1CCC8E3279B70E4846D9154BA63003D9E227AE14E0590492F865356BD94.1499.2854629194.270",
        "CD_115C2C7C875DAA2D80858EAB217D4BA6077F4CCDF9EB9B75A301CD68389427E6.2763.3807281938.263",
        "D74027E586B2E97BEF112C2070090FD\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "CD_4C30D2B0F562E7ECB133EDD52DE8120D85640B338DF07115C2057AA8BFDCC64E.2758.2375597888.359",
        "CD_CCB9B5084332230EFC94CE865E967C275D0B783CC35AD9963948309EDCCEF116.1621.3758981322.250",
        "CD_A9BB7C5A93904236731B5343B424DE2E9A05745595440D163D382B2134D4EBD8.2577.1837061544.1042",
        "I_A17BA0E1DCC388EA3B476E531DCE09878B9549570A64500839E307835DEDF8D3.2728.2331044833.293",
        "SystemConfig_V2_MobilePlatform",
        "CD_B5BC305FDB6B1BA4B82B81FDF0E9F46A4D26DC35C4DA3F1208F7A3E1625B2883.2637.3484803090.484",
        "C_A9653E9A5DFB9E3492D2E71DB2DC5C8E5D6E1AD64D6D763B4A929A56A96F3F78",
        "CD_3541C5A84659CAC98F91C5637C1C9F472B091ECDBCFBE8002BA8E0AC93E4496A.2622.1887611196.468",
        "CD_15AA9E5C08C912088DB12148021E6F808EE6412DBA54846E39AFBD33E4BDE769.2744.1075834179.362",
        "CR_D3EEBB9E3A4C5F3CA348B142AF6727D3A274A152187FB63005FF1EA0DBF75FAE",
        "CD_115C2C7C875DAA2D80858EAB217D4BA6077F4CCDF9EB9B75A301CD68389427E6.104.3208448542.263",
        "I_DD44E43FD34027D8B85FA79C40C442BE85E2DAB1FB04E68BDB0E719221B44751.2728.3761737128.283",
        "CD_A3D3980C32FA18D3D98369F8A523D2756A2B0B161451E04A631ED0FE459C5FA2.2121.2249975679.1879",
        "CD_86ED431FCE21CAA67833F50E8CEB80C11FAD7D40366CDE16E2C8794094F18925.1737.3861103065.744",
        "CD_2C9E96C7F7E323559ADDB98919DA9CB9D792B77EB6D7DB30E98DE86B6BCDF5FC.38.3854489050.466",
        "5B48F3D3663775E674F1AC382685A30C5D61F06F3C74BC6E2C4180489D568F.1173.2869032566.280",
        "Security settings of a share object",
        "C_2A82469DE4EDED369FA467BEF3E6440FE893BBC1F56ED2AB23AD8D2515E35AC8",
        "CD_40CAFB87B847B798AC8F2045737A2A8390AC0416A38406D6F38EE740FBB0A4AC.21.2336647194.1508",
        "CD_379B4D9DAE90D396D3C5FB3179406DE41BED42150703F8F56EEB2ADABFFEFCF5.2638.3309493275.454",
        "IL_78283776885EA759117348CBB543092B110599BD69E23802546CE3181B6A1660.2728.4223727328.279",
        "C_93143C972FD7DCA074E18A4541B6BD293B0E457EB886C806152FA8BC6C79003B",
        "CD_84EB81C2116679BDB056AE954BCB9E5BA3DA9160877A6B49D3E308FEE490EBFC.25.1607568600.249",
        "CD_B860282B4A1153A407ECADB9A68A7564DFACE81902C1C29A9243B46F5679275A.149.3775854210.673",
        "CD_2B9B02800ABE42641C8BCC50415FCA86F11FB9ADC08A648EB89569C471775E68.1580.2141270207.3041",
        "CD_12A251E4688047981D607B15F79436DB837E075ADA0B6AC78025F676ADBF2AD7.1017.3526303440.531",
        "CD_CC42CE8E16DE25C1D91BA16E865F3AC012D22CBD5E4C5B16BAA9C58BB1B02618.2642.3708469136.472",
        "CD_73D24DCA2A6CC59ABEA47FD1392F5F97FE83683983A1A509120D038B5A332AAD.1544.1753968595.428",
        "CD_15BB74500CCB05CD5AC2C91DC16CB85AAAE5FB06E9A05F8A5AA7D6BCB68E38B6.2097.1148474094.1913",
        "4 = \"Re-run Job\", indicating that the job should be re-run ",
        "CD_58C99E497FC42770D05B9C20CF9DCC0E695351111634B1C709600F377B5052D2.2661.1493166405.458",
        "IL_8E6ADCB37CDB5B795C8D442B8237BF594378B36DC8C5928AF8258F9EA99B7276.2696.1766629956.273",
        "R_D916D4BE44BE6B03E2126E7308417D188AFACB2B602CF21C6B06A3D6A4DB852B",
        "I_50D86B9BD0CCE71A1892428210DE601A0BEB6AA770B120DF7B09578469C813B1.2723.568933622.287",
        "CD_EFF78BA04EDBDB7E269EDE89195BF04BE0D870F944199B1C1854270A94EC8E1D.2597.386747097.648",
        "I_E08D4981872FD3B2AFA0F1FB57EC86FC31C078350F35DB4223FAD426E315F43A.2735.2611756509.264",
        "CD_D3E87AC2C5095799D67D44AE7591A2749E7365471471AF9E1AB7656018268D5D.2114.2709423467.4108",
        "CD_050953C58E97660582926667045FD157390A1B7EE9E1CDFCB3DD57BDA1E5B26D.2071.1.39448",
        "C_34C7F02584835C9F53DA8B610B74BCACB61B9E0BCE6D8A239F117F5D7E99EE2B",
        "C_F22CF0C74A9002156D476F4DBA031C7F3F706A1A94FD4FF91611BCB6BD8FBB7C",
        "I_4618452784E7B8853E82D22335B98B9DC784FA7D4846E290E282BAA5A4637C31.2721.3811421753.276",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2285.2199995986.368",
        "IL_109BD1A95093AEF0A632244BD18A876529B9EE47C13A28C3FB4CAC19C751D964.2697.41031290.273",
        "CD_5241CFC05A716A77CB0F36844F9A62538AED075865B9C000AF8A5A2832337841.2309.2939564058.338",
        "IL_A7BBC3A122BC0B00376D72E453158C9EA78057DC91EE1CE66E3F2AB64BE29689.2675.3043558374.277",
        "CD_0B48320BC1A528B3C1FD27BF622CF9AB5E3E6560AA1B8D7B4BB227712F4B7CA3.1782.461721185.541",
        "GPOID",
        "R_9B332D6068778FD394AFB87B3E8A9A8D003553BEC896FFEDDB4483F62939F6E7.1802.1431932322.536",
        "IL_0152BE1E4A994A7C0D8D41959FFB458DA1D806B79A7FC07EFB5457858BA9AD43.2714.1143836868.279",
        "IL_35A96137ECF8FE993CA96CC4FEC248539FEFAB4B9016B0BFD028E0D8CC517A98.1014.2811396759.539",
        "I_599A4BF3C070876275E2C4422D03BBD1DF1CA8F60576047EC71123766AC455EE.2676.451817874.270",
        "ly be accessed sequentially.",
        "IL_8081B8C91C1BB9B5B5AFEC1FB4FCDDCF11F2ED723DD22BAE1818E20E5CD22E04.2716.3969617142.281",
        "C_9027205FD7E053DF439410755A9BD704E454F745D87AB219C121424FF63B731D",
        "C_B2C9C24AF9AD18C51D1616B107CC0D5F87B040D09EC9AC43F2721AC9F9AEA790",
        "InEntryCount",
        "CD_0E8AE3127572E18A442A470FD92690849C0B09462B19ABA7B3E6660DEABF9827.2424.959072001.358",
        "CD_C20D4B021E0AFFB61E5D90A8AD1A949CBA948B6ED6C506FD3F623477DE2DDF5D.2762.4182423900.822",
        "CD_DC65173170329CBC28153539525DF4928293E66F1C821340853F94ED0B12705C.1783.332066254.1249",
        "Z]`xcf",
        "C_E49207E0C3E41BA550956778A93F67569B375398AA2B0937EEF0E61C098A3BAA",
        "FadtC3Latency",
        "Enable Flags",
        "CR_1C871A69AE42FDAE2404C626ED2A6EE58970B1ADBD41309118A0347F713B188E",
        "C_48081560068735282A6891C4199013DB35841D2E49ECBC9E491762D9EC107CC5",
        "SourceId",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.185318268.231",
        "I_2B425BF8CE8732BEB182F0BC728E928FFB0498DF8A9FBACA0C514518961A5460.1020.2464951227.256",
        "CD_3E11F2867F2D534D95C0593A0AA32ECA612C606596AA91228C49611E4A1C3BBE.1223.1.19560",
        "C_64F94F3450D7629325CA5169EB2D437E79C378BC4227DD614FBE4F965CC6B706",
        "C_592D05C8B6862C9EBAB101DFDFC8706B44232EC87D176AEAC787159631899DED",
        "C_3433832E25334061F01C0641448819BF2A3230BFACAEB03FAC6E5BFD4E772DA0",
        "C_455876B64E565F4962FC035AF2C8087D1797E42AAA9586F45C5A3E20F37175C3",
        "R_3221B359A5416B849210C8EDE6CA9A31AE77982A28D76140A2605705EA5F2416",
        "I_AA1B5BB8A762366D711DCFE877B29E175333778C99FBCFF14D33452DE7A9A746.463.1.297697",
        "CD_C89886846383BAB3B77E286B6A3E121ECB55A8E5DB54282753AECD4AE5DE4AA0.1931.1912424924.1085",
        "IR_42B2E3A3A6520FF2AA7BA157666764419AB7273E011404BF98FB167E54E43BA9",
        "CD_C20D4B021E0AFFB61E5D90A8AD1A949CBA948B6ED6C506FD3F623477DE2DDF5D.1077.3376666582.822",
        "CD_8DDAFEF7C9DC68CC1C82BFED03D0FB0A632319FACD23827BADAB05BE80A11447.2638.2951737408.489",
        "IL_3BF0ED88A4A3B50849FB14D362B499D7F456C13105F674E9CFB83E87773B49A7.1103.2720485810.273",
        "{5a1600d2-68e5-4de7-bcf4-1c2d215fe0fe}",
        "CD_34FD9E1177E28334594B80DCA69BD741401DD280ADBA44870846F7381632F88D.71.1187103344.441",
        "C_2E2ADCBD19607186F27031CE141175DAAF2CD1B603A1D58D1343B81BBA815149",
        "IL_0305BD7D37B6EF21E3131FBE87D389E0841DA741288006F67BE43AEDEDAC5F5D.296.1087772027.194",
        "IL_43D16E20ECFD623339FBE940EF30E5D8E0491605420EC6604AE909D12A90FBB9.10.1628568312.190",
        "C_430DF6569120000240D715CFC3D7DFA7990D70C64962E79D5490789E796A3D58",
        "CD_66A7D145690935995138FF204A5FABB1D06987DACAF9285631224F38F72D3572.1608.2407538537.5756",
        "I_7BA978978EBF3CD1200A10044AC0BD6F4758993016B7F6B6A538255F2BFBBE7A.1714.1663788667.326",
        "C_76407EE9F7ABC06BF43DA4E37433683A23FD8701DCB5AA7E340ACD783180DEC1",
        "The Remote Desktop Users group, in SDDL format",
        "C_3D10A0A77CAA5B54D6D0F826577C9C9001B09013C6D023D93A420AB24027FBBB",
        "C_7362E8F68732AA5E821EC10EE1BECFA5EBEB33CEDC9F406248A6EF25071BCC2C",
        "CD_BEEEB6B78BFA29F6F9A10B9A1DE6F2C01EFC08D1BB19CFC65419A1BB0BC83594.1345.816466137.4040",
        "CD_C089BE570AD24F592E44F1AB17521DCC9203176DB1FE73F89D8F1D13C2998CF4.135.4158170135.4060",
        "CD_ED710A61D9AC2E438DB06651517829A340B6E4F36DF7F8B4400C0B4598195DEC.2729.70639713.1903",
        "C_D916D4BE44BE6B03E2126E7308417D188AFACB2B602CF21C6B06A3D6A4DB852B",
        "C_8B17286CE20B53B60A53F0F3419E02C6D6F55BAEB70C0211CE95ACABF0B90BC4",
        "IL_F88E7CF9028DBFAC8093CB3D15BA0737E0C18A1E08272A03F1A65B4CEDFD4736.2697.3058017659.282",
        "C_C3C6D8FB3474EE785958EA6FF4182273D2A6254E9DC15AB0F00C01432187E439",
        "CD_272E5753DC3EECDD6057038DB6F26170E7D1CD565B954C6C4A406CB1BC2D023E.2743.3024378795.323",
        "CR_323D5E05836B46F5664F2463C34212E1954E843C0EAA64BAC76FC3916A5923F5",
        "Local Replica Source",
        "IL_EAEF166D07823DD8DA7D2576AC47944178108FF5F11E6F92829261BEA2612408.1462.805379125.307",
        "ExceptionPrefix",
        "IL_CC18B7AB606AD9D10B8810BCCC8DA26ED9F1CFB9F3C552928EF6CA039EDB8F40.2695.2549826986.269",
        "KI_64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41",
        "CD_93B4EC179BEC4D03F2FFE439720FFEF4C1271764B5DC6411F6BC0C453ED58B71.312.334750832.512",
        "CD_A3BB95ED0B202A25A7223B16F2A4B7FC5CE2975B203508279C7D21714713609A.129.1888265103.4341",
        "NS_06C64A5D5CC2B70F480C01BE42CE16E263E5D3E09BDD56035567D83AA44841C9",
        "CD_0D519108D85D82BAB33681414520F8FCB8ADE86295F011C324EC49523D7AD353.267.2426171721.2606",
        "CD_A435E1CD6D36EB19C6DA0BA1C7E62224942A59031964EC981FF17A68812E1011.2032.1922277993.256",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1534.585318014.292",
        "R_B3C81C13898C78829E8DEF02131D7FE87DA6C4CF126C25D1E3FED7A0F888E25A",
        "The current matching month (1-12)",
        "CD_345DC260A0AA9254A10F41B477EAF75A4CA2ADB21A42E5338E516260EEB5BD8D.1603.3464568282.1301",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.1137.1.15465",
        "R_90EEF26AEE52AAEAA6C979CD586F5F478789816D2A5901B4B6A52181C962DFEE",
        "I_3F56798EC1082F3DBA19B1704559BE52E6D08564BDBD24CCEDC4608E836DCB27.2719.3169657888.277",
        "Power Mode",
        "R_6EE8C512E2961059E7AB6CBEBFDCF73FD13BB979A0778DB5B86226412CA5E876.1806.390483330.586",
        "CD_23A50366135FBF364F350BC34F639BE141A61D21A478BB4C1230D838F1296A4E.1135.4192851798.449",
        "CD_F060FA1BEB1E1ABE21F8F41E5434AA241BD7259FD83E7DA0D4CBCF6D857A2A7D.2623.825469764.410",
        "C_BE9C3C03699415DC90398309F46D14386ED8803A3E02DAC3C1D2D0F69AA43EE4",
        "CD_B55C81E6C68BC4C439BC0ABBC4E8C0BD3216FAB41830394E3FAC0034894B6231.1152.3046061894.664",
        "I_17002779E918028C664AEFEFB3915EFD6510BCE6D2AFBDEEE2D0F84B8564E0FE.2726.2057968997.274",
        "I_3953E3CA3EB29D2A15D48E7E3BD0EB54821E7CEE225D0663D482C1D82B63D2F3.2715.2113446044.285",
        "C_B5A87FAD6C732883B0396D409E51A4FB7771DF109B9AF9D0EE68052F27B91C91",
        "C_DC27C286F2A3847C59A7DE34D71C7D711789AC9856A6490D5B105789D8070BD5",
        "I_F467BE741A1A7EDE9980540A8C7DCBDB65D8FCC5102E04F5144A877288384776.2711.928093711.286",
        ".3380054749.278",
        "I_6183C880C0E210C01CB868355D3DEA1ECFDC3AC47320C74339B61B9F92D3D561.2727.1022412374.283",
        "I_41CD80BFBD3EF2A72B1311F93D87AFDE77273A97897B7B012F0BFA851DE8E60A.154.1130414801.297",
        "CD_F4663152AE3837F467703D43AFBBB6630C1BA3529FA8A88B46C0496F26CBAAD5.201.2774699357.848",
        "CD_FFBBEEB41878AC75CD38671CF9A4CECEB2F673622833FAA9EA04376FB4297330.39.3774916501.346",
        "C_86D7CCEA6869E457637E2E5CB69E46D8D864161EF56DA1781B622C505BA013E9",
        "I_4C7C518953A43F5F3E93A11F1F14A943E39130CF4EDDBF37461B4007D9EAABDF.2694.2842347919.265",
        "$@H(8",
        "C_E6B9BE1A013F3728E0ABC9EB394195E63809D712600D83A9FCECA00B72022168",
        "C_C4AF7A2002517673D2274B08C6E80F686F8EDE7083810169B98D9DD007B3DC34",
        "CR_D494E9A85935E059369DBBB5BC793F2672E05B3CE93CFCC0DD52A3144BCDAC07",
        "C_C6322B6314CFF4E509A8264F41852433F9D38AD4057623ECC6D130FA2261F1CD",
        "CD_8BB282EC877EF750BA67E21AEFC765F0958A7E18EB5158F15A448065A4876EFB.278.1989579687.301",
        "CD_D7860DB1594CB37DCB237A6AE7D8C1717E5D55CF386BCF7514E74D4C578E100D.1836.725535529.306",
        "CD_5C019BBCF7CD2BCBAB2E1080A9EEA832173CDA76E5635A18F883174B94FE0F77.44.1.14104",
        "CD_87CE846EC002DBA12914102AFF6ED89E0F6DD6CA407A1F7C8C0CBFF801124A9B.2759.2736980642.301",
        "CD_082C07D164552D2B77F2EAD04875A64B40DC14D08A8AF625C8BCA071DE48CDE0.2109.2182285855.574",
        "C_5D33094C3BDDDEFAC95A7B008EBF2F99A268C52B1C3A20519425F7E8B739FDA2",
        "CD_5FDD5C517B158FA6F136FDA5163883910AF54452C20644A4B22DCE61A6AAF3A7.1793.4012012966.261",
        "C_8526133117576DD793C5FBE12D825D346FCC6B0DCB7DCB25789FC2082421D4B2",
        "C_14EA8D1B614BC6D260E31F428D1651D98B6F7F8F49C7964016B24597B70B73AE",
        "I_757F5C630DCED3753F8E1E30E85653C98EA7F0D2F00764B048366DB24E4AE08E.2683.3887394605.275",
        "C_16E4C6600488A67F5E78E0D62B8A55FAC557656B73401CA2A254EBCDF6B54549",
        "The Element reference represents the computer system using the boot configuration.",
        "C_5C27039E354082F6D74DB696E9D9D92527C2AD3E6EB6A0FA5A0F25C76E0296BA",
        "IL_D8040591183E936831471022D3E2CE1E38C9AD624DA88DD5B28B59CD2A04D198.2679.3981737199.274",
        "ExtendedStatus allows the storage provider to return extended (implementation specific) error information.",
        "CR_7C256082C028FC113E44225862F56FE496A6FB4D4EE2AD50DD39EB6DF6A574DF",
        "C_C1AADA81CC90204D247CE9C64F57DC565C182F4956EBCAA2C9288DCAB7FDB656",
        "CD_09416880DC950121CF927099A50B486F189A631C326B4B438123E20ABA622175.1176.925901703.260",
        "C_7A3B231F7857F436EA541134B8B2B23DC95CD36328F957D4EEB31FA93298AA7F",
        "I_FF67FEDFFD38F312B71A830870D553566D5CDB2EA2F987B7CC74F73DE042F18C.2700.1341341340.290",
        "C_05FC8C25744A61FCE1B7262C6904EED1191403B85176B40933E4DB3BDE9A1EAF",
        "C_A50F2C71334A2A338CC6F1C013DEEB31B3684F92B727656C378E98BCCF3ADD1F",
        "CD_ADADA2B2CDD3BACE2485D2B360E811514E03484B4187AE7DDB3778A03ABAD994.1677.1753009658.2311",
        "CD_E21BA0963ADD9F282F163368EA328AFD0A42D3ED5A163FFA12C0C1B41FB686E9.2652.1656957417.625",
        "C_00CB5505B362BFEF8A78ADC9829BC548EC024B6682159D697B0077E15B2E844C",
        "C_6DEF0D7E940B545B1F815DB3466E2E096310F0994D59451D4A228F863D49F32D",
        "I_B81BBFACEE62DE706A28655A7C08A91C36581107478F8F80312BF365EA8E32EA.2749.3578762850.269",
        "CD_965094A9801CDE7688007D8DC8207F7F647D8A711F384671B42F954898C8A20A.2567.1170810510.769",
        "*{W-x",
        "6A388A67D9175B8453626489F03C7539BD9B4806EEA13F197BA8A7C0F3501.2705.887989436.295",
        "SDBUS_DEBUG_WORKENG2",
        "I_515C448C1AF0D374B3695BA4F5CE55F31FE3F875EC3BA0C7CA15C5E886B46E5E.2711.2941309986.292",
        "CD_C33D59D510F29FFD2D335B60BBA896FCAB2C0201287454440444F0D3AFD4769A.2648.1744860108.1112",
        "CD_3447964AD4B51A40682639E2C45B8A122022C3FEC3E3B3FE7276444680D9A4BB.1650.772429234.338",
        "CR_81CCD9F49463DE42E5F24116205A8C2F9DB6E6D4063663217E282C3E20BE0A3D",
        "C_1556B1A5E87D4310C75D4BC7292B6D4E10E4ED4FFA6353E1CEFCF645DF12E488",
        "CD_D1F35069AB830308A3D10C95EC411D258E0A9CAA2EE0311B34E2874304803008.1085.1492037734.332",
        "CD_E8DCB251351DCD2ACA88B24D719FF7EAAFED25D4F7644A276B6EAA9D145ECB88.1564.2472948608.545",
        "CD_0427B3D7710F368D831E2478F76F011E2ADE4882C334EE5ECDBD3047B1FDDE39.12.593978504.1053",
        "CD_4FD2270AA7CC321848B51530B7A77A9E39B5486B55CE0C09A2B597A1F1FCE1E6.1136.1574526417.5669",
        "CD_B02DDA61DB0037C986F5337E33ABDD70E15678DC49B7560A8C701C26B9D13251.2537.251954138.5241",
        "CD_B7CB0F72C5888EFB87CAA914B3258F858F11D8FC7438CC22070822389ABE2635.2748.3852700779.953",
        "808.963",
        "IL_91572A941C754998E2E40E6D09323D7020C1641D86272396AE2BF71B7A9BCC68.2707.2117245439.298",
        "R_840035F63794F57A62A5607B53F5A8A9C84296DF659BF9F5C0E61203052FB854",
        "CD_6DECEA152EB68C3B8F3895F0BFE2B8D722298B02602F918D61267E0DFA61213B.2750.2149183577.1426",
        "CD_61AD70324F8E2B3494420EEDDA5029E5D1AF2B0083C1CC1767F12EF889E146D1.40.2912853439.483",
        "C_4C30D2B0F562E7ECB133EDD52DE8120D85640B338DF07115C2057AA8BFDCC64E",
        "C_4477CA66979EB36A4812EB84064B57FCF10A17595E6D43320B7012BE2EEBF12B",
        "EF34970063BC38CA76DECA10C7EB99B.2726.4244474160.275",
        "C_59543DA79A0A83C48BB9222B5916E17BBA9A5688C362D35DD3F13589A2596294",
        "I_4775AAAEAE639C0B6E3968AB9A4757BCCBC9B6A2FC6E0D4E812C06B53296D420.2686.930273639.280",
        "CD_A5E1AA71C64A6E4F73F07C2B8390FCFA2D21D2EE5253540934D342DF02582845.2662.403718460.889",
        "CD_2A316CC1223891DE7327AA9CFCA1669E1132B0C7566D401B6202B91D25DDA95F.1594.2741802122.272",
        "CD_02E226BBCB88A35C58DB3E55C3D201306E2FAABE9C83D64654DC4E16660DF61A.214.1607399945.897",
        "CD_446C8E078CCFAA4D5AF15A685216770043F4473E2978CFEC5807CC510810D39D.2611.2333608764.397",
        "I_FC305F967E3051E61DF9E8F5A82345688238612521C583A1D5362428669BB908.129.2974503829.288",
        "I_DFE6A388A67D9175B8453626489F03C7539BD9B4806EEA13F197BA8A7C0F3501.2705.887989436.295",
        "CD_E338E39B0E84E8FFA98B59D43E1BAC3484BC52022387B71E60F1A04832CEA0F8.1620.2052698450.6189",
        "C_6D6161E9DE1D589E6E575938236E83C58350CD080E8757AE76F262610E96B3E2",
        "CD_610AB796758AF91BAFAAC5773CA30FA987962CB5B589ABCAD3D6EAA7F97EA9EE.1382.1322187562.406",
        "SourceRoutingBehavior",
        "CD_D729555B7FEB75947ADD3C4B89D07DE5A4A88893D5891FAC0864D3A7C4363767.1915.3583448660.1023",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2041.562880835.188",
        "I_5DDBF2CDD6543FCB86DF3357AC66F2164A031E7F1DD6567B28D373330EC9BDA2.2682.984040182.291",
        "Use the same user credentials for TS Gateway and TS Server when possible",
        "C_AA08179966355DA227023310A55A3E7595BBA6EE2C2F2E7F371415F2AF045A6F",
        "CR_0359987C58272876B4E70E901F284C82B892B0C1E02B693AD3548D264D28EC8A",
        "CD_A3D3980C32FA18D3D98369F8A523D2756A2B0B161451E04A631ED0FE459C5FA2.1481.4001471767.1033",
        "C_2C338646F5C1CAA321EFF2BEDBEB6839F57D9EB755DB455A7F244BA25566E1F5",
        "CD_079F9962DB5B1A2D677708297D13FA6915104F278CBC0CB12F0C6471470862EC.2482.3883800749.2015",
        "I_CAFA38A118ACA7FEAEE665A17302EDA7C82713E31C17500432EAD21D9F02D6D7.2693.3479118069.267",
        "CD_A2755C850FD4A4296440D27117C3EF585344EFDF04FA3835F04E278A98F24DBD.1580.404225252.433",
        "CD_8AD8BB59AD76539933CA61E487AC9890B90072B3A3E2702B40F21CB1F591E761.26.3527223756.695",
        "R_0D73E3780A7CEA082AA4AC4E209E3DDAE49A1C0F578B12485C630172BE1B9522.42.1108691486.524",
        "CD_7AD87B163E5F080E34E60018A0634DBE95115F38F1BC264D0B548D7507D9109E.2031.1597227840.2752",
        "R_EAB06445AE40CB0AB3321BBA04962C98586E49396B67AFD5B74F4985163D9EC2",
        "Write Failure",
        "IL_B87506E9F039474480FAAE10F0E4ECEBBFB5EAECE9FA85469DDBF991E5187227.2704.2565942758.289",
        "CD_E17F919984F15CCF479B609DDBC6B5B04373B6814E3C2310098E997AC3827DDD.2604.2481299106.732",
        "CD_950B982CC6F803B6E071200389755F5BC713572EAEDAD6AD08F5A06B9E237444.1147.1481279900.494",
        "WINNT",
        "I_D146EF793EFA8D39AD579F3524C7184A9F992483F9FEF9F4D1BCDFDD20ECB4BD.2691.2589322182.273",
        "I_77A9A19F9CA0E466966766C9A77200AECD2A762D960D5E97AB1D526824AE69EF.2757.2501718590.265",
        "IL_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.3550909931.360",
        "IL_1725976AA79975B78DC13B98486DFB84C86A24E36784407E69AB1DAF8F54E432.2691.3362428702.264",
        "CD_FCB8F5186AFCE657559BD1E3B7945F03AFA3222D1F02A94B0C21BFF34C6501B2.31.1850576567.494",
        "C_C8F7A5859F79B8ED7AD17FC43E28674030C00AA63548BDB0C070C1D925C4A986",
        "CD_956218CB3B130B9E0F4C99989C08F085EB3D3D40CE439ED3E9C6DD8BE7E440E8.1.3632825112.161",
        "CD_F7420DA6533A2C562AF06F1F87B007C0FB6BFFD5F71653722CBFC32EEC340ED0.1794.2104170577.523",
        "CR_4E6B2407BBFA735CD558FA956E39FDDAEBB739747AD4109DB6B2E67ADBD0148A",
        "IL_C199E3EDAA2732EA998817EE4E25986E194C5F1A34740C8F193110B7B426B361.2721.3229312945.282",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1164.2705033010.180",
        "395E21E8C383D6C44CC41",
        "CD_5D0FB39DF250D3E4AEA48267D98EBC817DD59173DF1C6B6286433101D6043A28.2585.2693849941.867",
        "IL_C88C3F575019A3340E170BFF0FE8D01D1CE6D44E7F8DF686DA8AC6A2D50EF855.2714.3617702342.297",
        "IL_AD906288475AAB63F712FADC05A4E8E261D8CCC590F69AE4BB2795A9C8DA63B0.2724.4199111456.283",
        "CR_A9B783D001816C120A5D7EBC7A87AECF9E0EE52068A0CADAE17A8EA3AF1000D9",
        "s.mui[PROCESSORWMI]",
        "I_A4F229D72D127953AFBDFD3FD290AEA94A8F46D87804C1D89B08E702E32AB7DE.2764.219798882.283",
        "CD_23934BAB3D64E6FBBA2D103113B7071EEDD4C5897E664D2380D00F90496625D2.2543.4123424070.498",
        "IL_3CAECC7DDABB2C6E1511184232D03450EC2EEEF0C1F9E9ECC841148029751BFA.2682.3999801118.294",
        "IL_4D19A9540E339C1F23CA37D014BF087DC3254F2AC903E2C4A3F083319007310D.2725.2805528136.294",
        "C_AB458ED9D1DD4314F88AF5FEEC588DFA53BAF8DC0A56FC3E30B319CA4FCADC37",
        "RunDayOfWeek",
        "CD_D916D4BE44BE6B03E2126E7308417D188AFACB2B602CF21C6B06A3D6A4DB852B.1089.3711767789.522",
        "CD_C619EAF0DF6CA8AB0EC64764605BB47166AB4B422807E3FBD9547096D16318E3.1303.2961282898.2418",
        "C_D0D38706741BF33F799152A05A2F8D04FFE2013A793BDC2D1977DD231C1FEDEE",
        "C_0B91D9FD5945CFB775F0EBD6F596CF88166602A6156A99CD2B11EC548E5ED28D",
        "C_03BA14961F0EFCDB8006A9DD42AD2411E53376D22F7B3DE79F555B7592D5B560",
        "CD_3079E8CD6D46EEF3BB8C478A433B73D0DE2B5FE05E7E7BFC923B4F14ACB286EB.2420.187329935.350",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.3197818881.368",
        "C_603BDAA9A25265B21A3A0DB9BB762CEC6EF64A9203EDED426B28B86FE3E71633",
        "R_DC39EB125CD5896A582C9CCFCFEF5267AF9611EEF285D00CC4FF5DF7F8AE6FFC",
        "CD_0225910331B79FEA7A0ECC2E4C8BDD189B002B524044FF48F864D7BDEF12F05B.1183.1949557361.212",
        "I_F0F20B7BC2BB8AE98761C771B26D8094AEEA9127BF8A7250DF1972ED91260F7A.1016.1267790705.298",
        "IL_AA1B5BB8A762366D711DCFE877B29E175333778C99FBCFF14D33452DE7A9A746.463.1.297697",
        "*NQ-Z'",
        "CD_592D05C8B6862C9EBAB101DFDFC8706B44232EC87D176AEAC787159631899DED.2422.3013450741.359",
        "IL_E1E7CF334D3BE8410218B00EACD988F6C3A86B3D0F743679BFCC3E63F13FB8FC.2680.501871841.284",
        "CD_16275E16EEED6E74BD48AA48ACA3AF381CEAB3C980CF5112BF5B3053B0589A21.38.2237218042.311",
        "CD_377FD1BAFBD775CA7636A24292F42121EFAE15173C984BF06800276388A542F8.1689.1851562077.246",
        "D61A338E909E5F70C55C",
        "CD_18686E3CD01034A71EAEDBED6317C57C7A9D924BB945F91B623FAD3FEFC4769A.2649.277977353.1055",
        "I_1FBD6E3E8AAC9A5E67D7B33B5E6D55396EACF61AD9387460D6D6F48EAF33EBB8.2735.1845839956.264",
        "IL_9CB9F81BE75BEA11C08735F16305ED1D2CA8BFF8BCC1583B6DB3CB9A58E5D94F.2706.3731697791.290",
        "CD_06ED746C3D4422DFE7E61C74D4754D1F561EF973D3387C0C0A4EC95471CDFF58.1192.3965442029.601",
        "C_F87E378B75AF3F6BDC043610EC09B06E61B8E3291FCBCED338BE9D76C99D19BC",
        "C_AD0407846647AF6A2377C94BA8FC90066E9C0297CFF3D89B5F5DD4866C06DC06",
        "CD_F2BF551D2C47E413C4BD58FCB0E48E0B3211C53383EC4051E655BB8319ADD47D.142.1081633034.867",
        "IL_401972D598FE435424FC85222E24B658B2468C69FDB79469C0A547B9281FB823.2726.2664927104.275",
        "C_09A5E19B62E24065CFCA8EE94EA9E5C149E6CB498581E688EF627C4525368332",
        "CD_45F5A698FE1F369FCC9E35170EFC43E4DFBC18F38DA62C3D1FEF22A7B3B706DD.183.482949530.1682",
        "ProcessorAcpiTssState",
        " take ",
        "CD_979D1EA059854DCEDF2345318722F29EF1D55F537C02E38427A8558140AFFFB1.1365.3725216772.337",
        "R_DAF09917B9CFA8B255E2F8328EEFD54CDCBF643D68C0AC3F94A83078C17C15DB",
        "CR_F8950447585CD6743131FC688F3AC5EE4D2DE57B4CA01C83E91AB8FD7ED70E93",
        "CD_B4ED6CD6BB039C8A40404514D33A068C19B058FAE7508C9C445CEEFE558E436D.2066.3702445882.639",
        "CD_2DA20672D3801440AF6602AECAB57B678829882756EB729F91B85264AE3AD0DD.1474.3508003816.1440",
        "C_57999785729C617E0940F08A69B76DE9550166D43EEA37880AE2D6FC23FB5859",
        "C_D976921998798468D8EFB51691DF5718F6940847EED18DB5BE23F1BC9D2E5D09",
        "I_A944F785A51BBDA87CAE1C427827906080841BCF187F56E21654E9005CF78E7A.2694.3756079693.273",
        "C_4ED1C1D27F38DE571446B9916C2C7A53CD6AE93A14F053666EE0657DBDDBFB0D",
        "CD_00B170B62C2F3CE0CF652E9172FD442FD4ED6E6431FA0C941DE48C4F06E373D1.1193.1190638193.622",
        "CD_F501D896223A4824AD7BD67404A8670F77C009FD1A50960728B1DB6EFD108157.2644.3221953764.418",
        "C_5FEC17D2A692E21EEC8DB94637D5BF52B054EFD1DC032078BF1B5DD5BA812C6F",
        "CD_0499414692D783CDA863FDC3CD3ACD2DB8AE713F8A8DDED3EFB28B37782E127C.1155.2302194735.387",
        "C_08E96148610DE84CC1420D120ED4D38B898FA6EBF747C730998CBE3730E00048",
        "CD_B7C7EBA056B6878B96913AC0866EB26FE6BD64B4655DF4094E2D5C0299905F93.2512.4144573604.411",
        "IL_4126A51B0004A6738763B66773B573F7D2C76A5D7B33543BAA7A2F2CE3E83806.2675.4101126257.269",
        "CR_3378669615577B42FE9D7F6AFE5937F8AD52033749937CDC0D7FDB57B33C7738",
        "Critical error: Media life expired.",
        "R_191877833EBB16E938034A3506BE0709B7FE03ACAA65FB61B2F3088D1DCE72BF",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1104.1598114626.211",
        "IL_06DFAB71A3D8DBB356E2B69812AA4BD05249772CB8E5CA24F5D2BBA6FF1926AF.2469.3633344261.331",
        "CD_CDE927435CAEB1D62EE8A15E5309F00C6263566F2B069604C803AE5D37D85A14.40.339386445.424",
        "Stopping",
        "PBlkLen",
        "SEL_RECORD_ID is valid",
        "I_0B80258DB20F78C812419F350CB492491FD1F51CFDE794F94FBCCC1B7768782E.2709.293911390.295",
        "IL_DE5DED6D07DECF0472341E41FE3D169DEEC3429C779AFE73487ED140FBB6B7C7.2714.2909007524.305",
        "CD_290F6F8B3B7EAA26E7735FACB33E9185DC97B5AF85F7FE15A4C9FA4C0EBACD95.77.1973118065.308",
        "IL_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D.2736.4044228206.255",
        "74B8557B4E57EA2.2586.2644218558.1134",
        "I_C6352ABAE174F7A78D26568406CA8EF6E55D5717757CE4CB6B02F0297EA5EE44.2684.324927230.276",
        "NS_E1578D36E8972985C3607CB2490418C572C190C71151F301302674342C5C885D",
        "C_639A48AE01E60F4C5372BCE94302125223C8DE05464D188B338C60C65E4A5441",
        "`hDL|x",
        "SDBUS_DEBUG_POWER",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.866272930.368",
        "I_DC022C56ADDC30CC3E115551AF0C2E3A0D951D2FE3A0143EA391171B0F62E529.946.1.67353",
        "CD_B4204F4CD845FAF261673483B3D9C407E18AF7773A24D7B43C66C3052F5D6AAB.1219.1384606852.295",
        "C_5A035696BFDB01B863F15BBC9811886914BA410145C8C25C215A241B7ED90BBF",
        "I_D22B8D1F5200185CDF4705D911B911B548FAC3BD91A19AE1856E5948EF5C11E0.2721.2675826227.271",
        "CD_88951EE85045E3B94CBE9BC71EF70777E4B05816F4BF59A02A284DEFD098F378.1085.3274136832.596",
        "RequestedState",
        "CD_00637C6FCCC93CC75F9D988B459EA167A80BFD4782DA6DB5BC1F63F5A3F73F9B.2229.3822629263.174",
        "C_28032A6B7E6EDCB80B7F1C84A717A5D112C2DB53E7F05B8BCA499ED0AA11C2D2",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.2051.494843785.3240",
        "C_B1C946E1263303C29E3017D392A1F8F4869D847328AB0898DACC0D0C3324DDEB",
        "I_6E1804333B4ABF52E3F1AD25E8D291B414C148FC094148237DBE1B129983C786.2717.524990918.271",
        "IL_FDC07BF412EF517BF16CBEA0AD032C8FE94CB2DD73B9CD909C08659DB8C5BC0A.1336.2924169968.467",
        "IL_2381C996A59A0D1EB6DDD79E1C697FECC05884247B858E341AE1AAFDFB086D7B.1197.2250181767.316",
        "C_7034F2AB3C1C7C569B6070FE8B60A5FAB08FEAEECD9AA784DCD8B0D2B23C7F99",
        "C_4EDB0C2EDCD30D554E7C383941B8594EDB5845D9DCDB0D98A92A091B1D481759",
        "November",
        "CR_8029010879AF25DBDB2587888A23E76C1BA34EC4177560448F42E3D335BD1B08",
        "IL_01AF7823F90DAEC78BAF38771F45D60A37B0917DC6BBE974DF07B97707A15F13.2451.111154847.344",
        "CD_8B3C017D4428136AA9032BCF9FC656670ACA0B318BBA4C22D2ED590B175FAAB4.1189.3798786043.597",
        "CD_40930BE1E8F934F03344F1FE602D3CE9551B1517303C4D41B014924DEACD3746.1231.3721186197.613",
        "R_F7A86A3787E9C97DEDE790732FDCD3FB5583FC6332B8554299CB95F1CCD6648D.1020.3267929144.520",
        "IL_1E7121C3035B2E8CB03E36FFF346E4250C4BFE2056BDF98F351061EFB1BEB770.2707.3640251121.284",
        "CD_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251.298.1204916311.2267",
        "C_1E73C355FB885E2163DC95C015545482A2598C9FF194EA43A47495D556BA0B0B",
        "EHKrNQTW",
        "CD_998F3774EFD99EE364D0E26FD868917690CC4AA071C4ABAB4D58906B9D2FAF38.124.3613602823.611",
        "CD_6A1E1209B7AC078571FC6D261612887A1DE93BA434C982E140EC3C17F637D3FF.1938.4081123107.788",
        "C_5991C657AC0F9E2512F72FDD17A5173C60A75B8E36E129493637EEFC667B2A38",
        "CD_D961660AAEF0556B521437C09527B25BC63FA793558ADDCC51A8B8293B5EACDF.1556.1176905871.539",
        "Number of seconds that the script is allowed to run, if zero script will not be terminated.",
        "CR_EF67B600A31F150CE962D694F9CA3072B7F784C6A34776FDD01BE21CE72A06A9",
        "CD_F3DF3A8473C281626F19596F908669B74CE3CB4720460E1BD9E5A98DA2E125A3.2527.4278269418.1002",
        "CD_C098D64978468CA957C3D43E75CFA62233296C00D54DABB8ADE5BEA89B9E0A4E.1193.3599672242.244",
        "C_B97276FDFEA47C3D68AC826FEBE6AA3D6148807E62AFB5DE5D384AB87EAD0270",
        "I_9E152E3E3D8A2665C8A4533F9A4E67D0D1AAA1D8B83D4A80BEDF2999A2CA16CE.1479.3109614267.338",
        "IL_FA8D6584E24C9CB0FFC473667C368081D67B52C5B3009F5AB08ED386E2E200EF.2735.4075645096.269",
        "CD_E2D0A69448BBBA7800B110213F886227CDC660712EF504CAC24C411F80C241E2.1352.2190001358.396",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1333.1020230547.336",
        "C_7F6515E2EBD9049AE896B25B99B1906533354EA0DB3289C03EFADA9D23B196C7",
        "lh@DHL",
        "IL_E098463CCEDA2B7BB0AFBA90C9CE4685015E15BA48F56829DB08584C5452610B.2695.2165260353.277",
        "CD_8FA4173A459EDAB8F1A63B50B888353A7C8DFBD39D8F768991AB822007F927D7.1333.1948760486.3202",
        "Multicast",
        "C_F71363625297B341F74A07A3245FC4F57BC952A1603833C9D340BD8DDA150C05",
        "I_43D16E20ECFD623339FBE940EF30E5D8E0491605420EC6604AE909D12A90FBB9.10.1628568312.190",
        "CD_2BBDC6530C208169E005CD28108E36BCD72310DD490D1F6D9817675EE3291874.42.2120809981.3395",
        "CD_B3CF2C36A1D52D539D1072349C9C5912060B70BD7C865FC1912BDB78F2BE1EF4.2613.256459464.403",
        "CD_F61D3A37372046376CAFA47C2FBD5009ED63EA8C65A1E072429CA32FDA52CF26.186.1271916954.822",
        "I_2EF70A7A8FC35B2317CB4F2E5BE4FD3B09C488A93C0FF76285A63C3566BC3E29.2723.1065399887.279",
        "TX\\`dhlptx|",
        "This parameter indicates whether the volume should be dismounted to a no-automount (offline) state. The volume may be returned to the automount state by explicitly calling the Mount method or creating a mount point for the volume.",
        "CD_BEB5CFC405938CF504C4F022B26457B8BA4AAA062A6E8AB4E49ECA4FF82FF69D.2371.2823641816.1657",
        "CD_BFD544BFFEEFF1AD50632026F36408799745C79BFE34289070862E1BDE56BDE0.2640.4123788920.1708",
        "makeAvailableOffline",
        "IL_59543DA79A0A83C48BB9222B5916E17BBA9A5688C362D35DD3F13589A2596294.1164.4075838192.328",
        "CR_16D6E45D9DC3C2448BBB5DF12E5A17B75BBAD53607DFAC1CCE27C411AB0AEA61",
        "NS_390EB45D32F689282408ADA520CE6393A41EC4618EE204AA0FBC32CF2D7469E3",
        "C_B1B14559B824E121394FE392FF430F8FD008843C4AB8D519479CE971B3AF84D1",
        "R_094CD032BE77E24831D84EE3DE38C46FBDC0C57F2466CC9AAB2CC4B43209B790",
        "IL_1ADD61D0238A16AF5CE6407A8ACCC4C916D3C88A9642586BAE68479CCC65167C.2679.520627990.290",
        "CD_58C7114452DEAD938A8EF4255730EF055ED47CABE4C0DD5F512430F5448F1DEF.1189.662145302.548",
        "CD_EDDF316486234851D86580CFE9B06D5A43E06F671105861787434F12D58AD4EC.1081.3192522987.623",
        "C_EE8A3B921C808F823B264981D8BBCC23C3D40D2D4B7C54B958C0DD90EDAE3CB9",
        "CD_CE0403D1F6C8F032B580CC54FFD1B59326317C97C1A606939745A3B9BE941D11.2031.832877186.221",
        "CD_C80F6E9FDDA5B4FCB7E91E04A37B343ACE2C1B4C4C7D997B61E1037420FC6413.1085.539581349.748",
        "CD_18800683F0AC1EF87B0E6101BC5367F7C19783D4C31994E5DF533A6065E582AD.2449.2543904920.3546",
        "IL_3F104FE97BEE6A604062E0B22B90BB6D1AD32C83C24982F7C5E9FB90D43955F1.2715.972230385.272",
        "CD_85616F703BB41919B48C4869294417D5BDA27AE8BF1EBBCC58D3F39A497E2550.2626.3009441827.696",
        "*.147",
        "I_BF707F0F3DD9935101FE132494CCDEA4AB6EBB6DE9AFE90709432956AC994BF9.2693.1227632236.261",
        "CD_046B79FF8FEA26EEFB72057DF7A67A7CB75727CCDA1025821CA0170FD33BCD6E.2644.3411773539.245",
        "CD_E051E777C7E7563456908117F89B298B636645144CE61DF3136AB528CB03746A.1521.844302516.265",
        "IL_DFB34F2FAB356183A61FE449255A9F1DE356AB019153A75462A7F67F3FBE235E.2690.1675144367.268",
        "CD_E2E2A81BA6531CCB646BB356AEB482B936F76C45C7E84F89581E39873BFB299D.1923.2491059670.1063",
        "I_EF2F28F2F14BBA41E2857F9632ADB94061523DF033662871BF2E867FE6BCE483.2706.4157848954.286",
        "CR_81E71CD6BF54F730FEDC98CAF91AFC2B597F2C22AEB0626A38F278436A564F49",
        "CD_31444EBA8BB43DA8DBD0D24395E48CF844E079E62BF930386D9B66970A85DC88.2611.1630097051.350",
        "CD_065EB15DF476F783A483B00F674DFF856DF35C72E87B7E414EE69BE5DF4E9372.122.2658536417.758",
        "IL_F8F3342AAC8E8514CE664171B4E2B5243B4D670C3C962B7E219C1726BEC43087.2684.2079467062.280",
        "I_E90825420A03A355401BABC7E9C1571C91D779F20F00B90170365DD4BA89FFB7.2675.2670735586.281",
        "CD_08F544E69EA05A815B974A37DB4AEA943B8DDCD4A90A8DEB8F8B62D690EA1619.2602.2315985179.767",
        "C_86E4864B1CF6600CE4B6DDC1904F1615B807835856FD99C1037F22B392220711",
        "IL_17DAB2F05DAF278660EF7A9033EDE44A9CD589FBA9EFE2D8306DD6119DEC472F.2764.866969792.278",
        "C_D75AF298547A60BC5DC28CC5F9BB9F112DC00D9A181668F25979B122809C5257",
        "            <pattern type=\"Registry\">HKCU\\System\\CurrentControlSet\\Control\\Network\\NetworkLocationWizard [ShowCount]</pattern>",
        "CD_20B4E701C3271ED94785243972C16A9A8FA123A78EDAC768D9A7B370EC4A42D1.1999.2046402642.747",
        "IL_A8C08024CBBA3AB7F7414387F341D4297567CE71AA49081987E0F0528989B49E.2398.1817146816.258",
        "CD_DB6E0EFA4A4955084B9781E96833D815504B83527431DC12DE9BBE2E1823B500.2334.838997468.228",
        "I_D47C88BDF42D73CB277C4547EDBDB70DA6632EC8E488BBCFA98BE455554FB47F.2687.797206848.274",
        "ref:RSOP_IEConnectionWinINetSettings",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2195.4214280841.368",
        "IL_C46A8C2DAA6CE63BCB801F840965A26508A6BA3B315EAC5AF8FFA709D21935E7.2702.3706164383.292",
        "May be one or more of the following: ",
        "__Win32Provider",
        "CD_049BB6B86464EB31BA1C68CF94C5AF1885FD1AC3516017A8738B6BC559DA272B.2733.1608718523.860",
        "CD_9596A53E85F3F0D633D696BB9EA3E48E9EAB2B18CDA373E2DEE09E41AF442CA6.1195.360179294.93",
        "Unrestricted",
        "I_1CC77E4B68C0492002D6075D5E9D30A925817AE7BA5C5A105F1D5F3FCC115BE3.2692.183424811.271",
        "CD_15D17602950F6C84D799561B467DD6E41D14A7C8F3BB2D223F118DC47EBDE909.2177.2763240402.1195",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.2522.483042530.2505",
        "CD_4BE589ACCA6072A68F165F37DA3FAF78551449C5735F577FB914BFF88C4DFF8B.1635.2872277628.619",
        "CD_DA8AC0D78FD1B90698550FC0FF5C609171143A2B0FA32F0B779BC5DC2D3441C8.150.3883635350.1526",
        "8FEA7BFF7E07108E3DD6784657256C3E1834F.2724.3765932508.283",
        "I_095213B9C0D61229559381AB15B808F9B97CDDAAEAE8B87714A71305321F2FCD.2764.2386093868.287",
        "I_F5C662EAE9A620A1D133F40BC3C0372E943189A09967E87D330334B2F916ACBD.2697.124149596.270",
        "C_A45E0068C31ECE71DB8386F48AAC28A201C918A54BA7B6C803A07E1B151C3D4D",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1607.2158628475.312",
        "CD_44DEF9F59661637DE2A93E3776876E3A1438B9BE8089F1C0465114ED219CA8E8.2601.523801353.718",
        "C_617078A282C296F16FDA4FC3665269447941CDEC40E1BB6751C41F90923B5D50",
        "IL_E8964CDFA7DE69635727AA89185FD9748094B7B63F743FF416D9E1793F3D43CB.2699.1065667183.269",
        "CD_4F0DC2D766DE63D22C2118312C7C8A4306FD995CC443322263FCAFC5C5AE9AB8.146.1639043512.441",
        "CD_DC16628F9EDFDD2FE0E1ED0CAF96040BF2D9449BF945A01E471B0FA0F63C4399.2544.650822997.721",
        "CD_9F25211DB7D04527A2718EFAB934C1664FA38400093282D5A337A37681C23242.2274.1.31279",
        "IL_251DF572EC65B42D6CE95DB4C839FD6728CEC6633EF525F0041081BB60681183.2736.1122084495.284",
        "CD_C72F36D31EC66AE00A609EFA447A347F9B21FABEE95556729E0D5E50FFFD7A13.1597.2632313564.430",
        " $(,048",
        "IL_F6CBF8594F37DC5079FAD1D9AAAA8AEC8D264532DF220B23DB57B2AE7A791572.2694.185684583.262",
        "C_C25AD6A436EAF64345F40DAC491FA65148B33848B9F75EA21BC89509C8ED1C31",
        "CD_B8C2F11B417C37C006D14F9AC34AEFC3BE86E0177BCF16E95BE5FE5EA4807416.112.1499057679.669",
        "C_F655AFC13A5FEA1BDAD15284811AE0F2C45BDE118943F02B6C8952C01605E1C9",
        "IL_E91F0F943EC52AD54AE098D029DD21BDDCDC72D558689BCCADE99FA90F74F3C9.2678.367834356.283",
        "CD_286D3AAA59AE00C2CF7EBCC4AB344CD2AFDCE3C2B408154E04E7644656DAE408.2067.3151996187.5824",
        "C_DBA99A7D488C87C166C15C9F1723F214A2817799E8F4CB02CBB2C24C78077720",
        "C_C6877D93883C0A287546253E157907791BC6A0C92D8F12064B0617A40E589308",
        "CR_58C24AFB2A991AA6785137E0BFB334A98FD6BC947AB0904D8F9C5CB0750B421E",
        "IL_7D43B258AFC12540DD3B37A3B2F8FC37FBCB4B47387E536CBA21B91542F05928.2725.1052535551.292",
        "CD_B295D8909277E377626B8A67422DBF8A8A8D1D4D62BA23B5F85473AAE33B0377.2654.1110265300.797",
        "TotalPercentFragmentation",
        "C_DFF73235A7D1E97A73AEFB2323A09D07551BBAF25A9390A9E1C9B7C9B1F0A40A",
        "I_C28E154433EAFBBEC9AFF6B03CD94FB6D01B32C68CCEA476ACECCD0DB049A6CD.2668.2340397220.283",
        "C_4F25ACB8ECF47D599E574DD3B686E0F1CC1B9DE6E15EEFAA36DC6403BE5670D4",
        "WriteWarning",
        "Completed",
        "I_0A8531861BAB7D08CB59A5C51FF1F632F24F4373BC1E9CFA3D4917C5D62016F7.2692.1010477656.264",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1104.1598114626.211",
        "IL_3D0B7056A5D4BB4D473A244C8ABDD62013BF15EBFA88FBC57C1EA570F061BBA6.2724.1392814756.292",
        "I_A8BC320193F17EF43DBFB8064798B055E444198E0FB3244B7B58B6A168E6F068.1620.642525323.924",
        "CD_A4F5A56059DDF119F4CC303056A7BB3F243745A5AAA1FF57F146D0A87968F7FD.1389.3303458307.479",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1489.2481664846.180",
        "IL_1D3AB53BFFC33BAB5A12FF7580A47136EFBE141A5F153D3EE38448C080BE7086.2720.3904078339.279",
        "IL_82D62EACB411F46C88EF11FE5A18F1088AEDA0897AD63F2947178230B7AF5724.1780.1849282648.338",
        "C_25191DCE3358FD8B8C1714272C2D24314EFB64EE716A136F809F4CE188499657",
        "I_F82DE66F86904503450A050F308CF7B5C1CE488FB6CC8C0C790D6B71ADCD3D1C.2696.1061084780.279",
        "IL_26F9ADBB3734E9D9EC9D1C19AF1038CE2DD007058FD83095A02DA602BD4D8E81.2683.2270467983.290",
        "R_AC7EC84784030B7EC2880E1528B63236B5205F5A6EF25A33EE43FC66886DC8B0.100.3106904428.524",
        "CD_25951CCF498736F09F8CDC3085BB276C2817DE47EF5312A0F051C1AC3B67B2CE.2154.2705728445.888",
        "CD_A04AEDF73C419CEF5529A2C6EC9E3BD525C377B8B911A8277E85A9D06A3F81E7.1341.1526235608.238",
        "CR_3935D6345388A245E9FF50F1CD42F69CC8FD444FF90B93C789385D0BD31672F7",
        "8<@DpH`L",
        "AI5Um",
        "$(,04",
        "CD_AA6C5D908B8566786B88A70F7AF714B635801A6132689DE308CB55CF16910BA9.1019.2287733536.254",
        "!$'*-03",
        "I_33CEC8A7CFB94CF359B1D8DB7A78A905613ABB782C6D679A36760A2F9C1F36B3.2723.2940010785.283",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.1173.3496082835.7263",
        "C_4B981929893A87977235CA1430A7AF681FBD9AFD465710F40972F6208B5EF455",
        "CD_0E6C55C9C7B1DED264825C6DA4BE33EA0277742BA342353CC7962223251ACDCD.2521.77558616.1513",
        "CR_A9CA40480A6747BA83786E55386C670F9DED141775CDB04CB51D34F54B86DDBD",
        "C_A7FECC21424DD62A9349C934969747482C567805103F48A0D0D942C0F6B52DD7",
        "AE9B052BBCEE0513101249959EE38B74646590F.2650.2198261037.515",
        "C_85CC7AB11FB940FC1C1F33A4AAAFCBE19B7B68FFDD5AB65EB58169644DF2CC0C",
        "CD_57999785729C617E0940F08A69B76DE9550166D43EEA37880AE2D6FC23FB5859.1075.694792156.749",
        "CD_8B2D824B1B1EA753A4826FD6EB54DBE4A6D394AEDFDA04796F002F1017CDCD06.2558.462700889.578",
        "Permanent",
        "JavaVM",
        "CD_44343FA1011CD581BAA71CF6D5100CB65A1326765FF439F0714CFF1B592561AE.2644.2791483437.1336",
        "I_C7B4C1B772B0A29FD3EA86C7C106088D66CED85B8901B36556CDACA2CCA2A43E.2695.2520537397.273",
        "R_78AB2C692DAA3A4CDADED46AFA07DE51142E7138D313F37FE748C3A17F36D445",
        "CR_DAF09917B9CFA8B255E2F8328EEFD54CDCBF643D68C0AC3F94A83078C17C15DB",
        "C_57839BB831B678823813D6DE5621B2492B8DEE2CAA3C37F3643245385D720644",
        "CR_7D462EA5E87CA015476942A58BACB3893636973868980DA68AC5EC3B5A1C690A",
        "CD_EAB61DD44B853A5368E6DEF80BB5C6272003255B9203C275FD85B8806E87A024.1057.2417070498.575",
        "C_1A3460E595B2CA58A7D95317C6529992777B447C7792560971FCCBE171032990",
        "CD_41695C2AF45A08336AFE1BDB6F027AEAD97E2A04551B2329B3A302DF92AC01FC.1382.2312224543.444",
        "I_8050E35366EBD2B887BB17B2204A953EDAFE2B0CFA9E51892B8CA854CC0CCE29.2687.4169237803.275",
        "CD_DF05054754D9D5B0E7C9F400839266F3883F1311019EC13700475306FA54A6B9.1165.1004524011.469",
        "CD_4CFD343F89F816CAAD34AEFE39C410FEBAEC57C4ECEFF6313E9D0F9D93057526.2596.3140390291.221",
        "IR_1381AFED302C67D34DA20CE9AE190A6FF403DD395BB18D45FA87AB2B0CC50B0D",
        "CD_E7ACEB5389BA8C32B04736209B872B130DCE3B94FF3A17F3972AEE3EFE29C3CE.2006.1848129861.584",
        "This class associates a power setting with a plan.",
        "I_DD370C83218E3ACF4ED3E50B021E588714258891A76B1EDBDF23E122A58854C5.2736.2863875803.287",
        "CR_6603235838D67F0A31998AE108546BB74586B33844F47241F23AECE3061C708F",
        "SecurityDescriptor",
        "This parameter indicates whether the volume should be forced to dismount if open handles exist.",
        "CD_6F93E3C20E769A2E31A47F868595D90BB20911F83ED119FD74983B46CBD844BA.2624.3276318622.346",
        "C_1B41530915D00EFEECAB1BCE1CD251E643FC0379379396A0C1F1177FB152BBA9",
        "CD_1A551646721AA7A2EA278525964261E10C989429101DC80D914D36CBD92BEDBB.1498.2100296206.2010",
        "CD_47D67180E30861ACEA3AF23A6DE84A4F96CD6019DCC0A0301E4F92DE3ADCED2A.2508.3693379254.1492",
        "CD_90D6DB96E4E52DF3FCB751D8C2491313C169EEA2DEA2212CBFE4EFF8C0A5E947.2161.1.10550",
        "I_07E51FC5F002907AC12804ADBAE55FB3C232E5B8D79BD95786870994CF65BFA2.2695.2780911729.291",
        "CD_CB9DA8F818847880A98243AA481C84850316FD89209321940EA2299F955A3CBE.1292.1289621705.1008",
        "CD_2C105F93FAE23EB9C17688A981EC79ED752A3DC9D3543D94DB227DEC42FE7990.2484.3026809310.590",
        "C_88951EE85045E3B94CBE9BC71EF70777E4B05816F4BF59A02A284DEFD098F378",
        "\\\\.\\root\\microsoft\\protectionManagement:__Win32Provider.Name=\"ProtectionManagement\"",
        "C_5DEF9BFE66A655CBE7B777B455F104DBA2D630B76C5936DA5A18E1A0D8E40195",
        "I_5044D3C67366B66A8782B6975703C58D4921423BAC267710EBF6DF593F10AAA0.1015.3492468328.321",
        "CD_EB74DE80A4ECAF39B636937B76E6D45F7589467EC770ADEAD91605298392EEDE.71.6847208.2074",
        "R_C6A58238B2D52C6D3379638DCD2CA314F0199706EB38629389BCEB5D0D36CE14.2441.3993179634.552",
        "I_0512996E43BF9CC18C2AE4A048B8AED9C76AE8C2CA7091210CFFEC0752609CAA.2736.3752318035.278",
        "C_0E19D9A907E37833D25D914BF07AB07521F19F0DFBA5FF59368C9C56C42B1549",
        "C_9729932C6A230E6D076D16A739C9C55BCFE9B5CECD58C2301470D12143397086",
        "CD_7A6AA51FA3C366E6824EA7F4B97566E3B04D858CCC46A0E172408E22570C1F7E.2610.2981613140.1216",
        "IL_C2E2D7F294A39E950FCB0FE91EB41D6C66630273B2EF4990C97F60DB582F2E17.1480.1186044840.302",
        "I_6952BC8C6187412BA6F7CAEE56328B9DCA8AFF615B18BF7135EB8A91F51729F6.1020.2968348805.268",
        "C_878D5D30666EBFE440F941E45E7884E8AFCA7A1478E4D09AB57DC26571C8B7A6",
        "IL_CED440B502C087A2C713CD20C5E65F7469FD10802B432CFF618E2EDB760DB7E1.2608.483129935.276",
        "R_00637C6FCCC93CC75F9D988B459EA167A80BFD4782DA6DB5BC1F63F5A3F73F9B",
        "Reserved by Replication Services",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1097.439896620.480",
        "CD_C1E785065FF2200D3B3B1E2B57CCCD85E5FF27AD2E1A1DDD0FF7C216FAC54966.1347.1389949604.2014",
        "CD_CE73BC7D26AAF30679FF45CD07C91081A8FDCC9A1636CE37493179FB839EB641.2664.2593693293.251",
        "I_D9FE81E716F5E3BFD74DDE4B3B9C48E53CE2DFEE205E7693A59C68A6AE4488C2.2679.4054352080.273",
        "CR_38E384CF26B6969C10E6C877B2EEA6D4595C8CEEE6BA25CFC97F17CE8E8A5DFD",
        "I_6211AAB1062F5F857F8CF4D9D50D7DD98604CC50B8D3A755123ED244E2C8142D.2764.3229980831.287",
        "CD_93D683378335762C284317F9836C36B73320C30A8A815437365079222449D208.129.624047335.634",
        "IL_D7933B909E6971472A6EDD596BA80A56F62FDBD317E77A5694F7D4529E39B358.2692.3187968237.273",
        "C_BA591BD8B27F441C811869BE1DF44DAE00F08BE9A7051676EA2B61A487918FB4",
        "CD_1333CB41C7BFD90D640EF18568976AC9246A93F3945F32BDDD813256745C7061.1616.1235232375.425",
        "CD_20FFE90491DD6EB0496111131EA1C7328480BC1065468AD9C6801937D3CF87A4.2469.1974558454.518",
        "-Saturday",
        "C_9C249B506244FB7EBFF9753C728C15CC6F408B144591C0ACA30DB0C62A64551F",
        "CD_F013AA523FB7E1141C46835F3813ED7DA1F035235D72E00C304E0C6683ABF645.1542.3756247903.1218",
        "required",
        "CD_ABD7B7F9833F119492F3D4F7A40EE07E387BD9DCD7D3898D26D4AF8C19661B13.1331.3567733574.242",
        "CD_ED2E871CAA85DB91DA82D43856C298DADCDDAA2D7C9D06C8655F1779E6509A4E.145.2500822621.854",
        "I_AA41A8343BA1D329E4982E46F903D80197DFB87E55CE7405A84B7AC638E427A0.1938.3012639979.336",
        "IL_31B67F22EFB46B12ECC674B40474C42146C85B10B72D3B0D6656EA2E5D0F6100.2720.3071751668.274",
        "C_51F9DAF3CC7D989B6C98735C3A5D88F91E31E2F8AB94B8929062D8B11C53733D",
        "IL_3E2032ABD75380BE66AE394FD0DE94789EEBF9D4FE0C600ED99854F4C29A29EF.2706.4286516945.293",
        "CD_1E13B2A6A26C0B91CF44A18D05250BDD9F1542236D3B9606359BA7D34FECE455.2576.2787783053.1074",
        "NoGateway",
        "IL_9A759E0CC6C72C9675D952131FA52D1EFC2A9BE8AF16B04CB42468ED3D134C6F.2704.2257322910.282",
        "IL_6A556E4A28DC410707EB1F351CEBF32DAFA6D249CBF15DE2882253AA39F209B0.2676.1194764269.277",
        "C_02E226BBCB88A35C58DB3E55C3D201306E2FAABE9C83D64654DC4E16660DF61A",
        "IL_9A5E68EB7B1FC08A5972606570B350AC17BFB78E6C2A83D63C4AC335775C6071.2702.2422407358.287",
        "IR_0B880713D9DDD00F98918C43E596B37E54E0FCC69C63C301BFAD6A21567EB1D1",
        "C_F60E7BE4D352BCA9A29DCD30B4F9C506C835C329C5B379CF00206B2A6C799F2E",
        "A request was made concerning an unsupported FC-4 protocol",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.2104251586.243",
        "C_8790982EA8A2F676FD9CDA897DA0E6725B2E8BAD006C6504922E2BDCF610DD98",
        "CD_82414A82DE748ED7C01A47DBB75CAADB5925E61647EC20B05CA201FD29ACD980.2612.3378919018.446",
        "CD_B22B427F2794F083D59CAB3CBAECCCBC3A99C22CA4382A86ACBEEBD3E7AEF4E7.2426.3691930601.294",
        "CD_9DD2597311C29BD08E085D0347CF2A159A6DBD82B7A0B5D91EAAC81FF9077FEA.2623.1487065201.412",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.2199171492.266",
        "{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}",
        "IR_03EDBEA0B26E95DAF602708173A280941CE4510066EAE0F07753492A3AA559B9",
        "CD_30756419C75AD9071C6B26EFDC29E973F64157E9E9415823E0E0D4E3B981BC76.1019.2535155189.501",
        "8E209568F3CA340985F3F72",
        "This parameter returns a reference to the storage job used to track the long running operation. When the operation has completed, an association should exist between the storage job and the created objects.",
        "CD_A03A0B9B0FDC488FC2A108014B7B7F05E69F51726268CB0321B939811F003F3D.2624.1613869695.353",
        "UmsScheduledPark",
        "CD_7758B30874183320F25F4F9789C477D48C7F6AAB3A386DF09B6FBEBA7488BB28.1102.1651600532.608",
        "CI_CE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0",
        "I_51010F092CD100BF450F7C43D4F6F3EE7655FAC447254142FDCAF5FBF9A72443.2705.2123693397.289",
        "C_C650FA6F92E9EB0B31DA6E7EA3E6B8E4A4D8DB1626C2311C8435199755ECDD58",
        "CD_7CBBFC903B769BFE526D96D753E16AD7ABA21D8A6B6B1A1612CBB8FF7201B692.1808.2410553347.312",
        "CR_B8C2F11B417C37C006D14F9AC34AEFC3BE86E0177BCF16E95BE5FE5EA4807416",
        "CD_79FD2B1944A0E8569231538101AA02032B2AA1FD92C317847D2089CA52F4CD72.1151.1394247389.869",
        "CD_F1E353069D97BA94B1909DA892B719B714F54C03563EEF18802F8B2BA8D69179.2575.4267514430.440",
        "C_8322231D4A6F73C0873B20B3D825400E9B44E18CDC9756CF0152A7F3BD39197C",
        "C_F7C3FC7B0FE5CB399C100F2AF228B5E443901701ED625E3927914BAA4C7D7971",
        "C_710A61940BD7E6F894BB04EC5095168D9BAB6C3B16D20CD7CF6F51DE93A6FCDF",
        "IL_F7892AFD6D9BA41C6D80FE1ADB06C631B78639A087981A07715ED269E2F38DAD.2736.3446001294.290",
        "(+.s14|7y",
        "C_72B01590ACC4500D6C998802BAE78A511F68CE1F2E189F92A27741ABED85403B",
        "CD_88951EE85045E3B94CBE9BC71EF70777E4B05816F4BF59A02A284DEFD098F378.1080.1287079023.596",
        "IL_A1BF3344CE9B08129717794169613E8A42C2192EB099D08C7E4ED3F87584A370.2687.3878438740.282",
        "CD_58E6EEFCD70C52E85CEB673B88C899F843EA51E56249367D7B9F51D1947371CE.2538.4275453589.504",
        "IR_9AADCFBEBD2729049C83114BED85D30D2725084DFCBD70BFC18E54B91E6865DF",
        "C_7BC06DFC2CCE54A0D578DEA59EBB1A8ADB06CF1508741E02D2DCC0BB4C755E69",
        "CD_FE8C3873BDAD1853EA9CE4F9A8CC51817A3AA40D4095EE7168936C23511B49CF.18.3075561145.479",
        "I_62D48FDD7770BBB74E46D15695B41D87829BDEC82880F9BA3ACEADBC7C60561A.2705.3460990210.300",
        "IL_CA4A378DBDF043E141AD6D7F7A088CBA7F26749AAF6E5778EFEE075D65CFCC17.2708.2635769717.285",
        "IL_A421F30BC3A95D5495EEB88D6FE95F8C3FB03B32347A190BF39FC7B7BB5983C2.2694.2594547402.269",
        "CD_D070CB0D31C7B0D15CD21428F609EAF8F3D6DC5BFAE4B42064D802D13848BA8A.1188.533681289.410",
        "CD_4A805754DC4920C5CDF55FA12C65FB3FF31068A56F7569D69AC9CEBF6B6C724B.26.2454400919.533",
        "C_0F6F4793DA673F1C347C3D8CA2454121EC5D32EA0CAF379FB0C0BF42C511B174",
        "C_950B982CC6F803B6E071200389755F5BC713572EAEDAD6AD08F5A06B9E237444",
        "CD_891971E1D392C0FC31A60B00383C2585E66ED0EA615A00EF345A7D468E247CDE.1183.1682237722.328",
        "CD_D8E4FDD0D26D90B6E6471AE5FDE8707D903FE6C0E0DDBCAFDF5D70483F378798.285.1496571431.2013",
        "CD_0A58F1099E1858890A23C17CEB7DF497DF64C99BE6E6E018304675E56C7BEE40.135.114763631.1002",
        "IL_7E3FC52173BBB0BAC6E789BDD1BE5FCFF346F5F20489B64EB487016A0284A279.2460.839647856.298",
        "CD_7857FC1888FD538485A47D972780448CD733BE76C6B908A47AD01147FD85AA69.2442.2217117987.759",
        "C_CCB9B5084332230EFC94CE865E967C275D0B783CC35AD9963948309EDCCEF116",
        "C_9058D572D5B6F75770F806D0DE0C0EE50FEBB3F396FE7FF2CAC02E0CA91E0E2E",
        "CD_9E201978C09DFBC722894D8CAC5CC2344D30A294DD7D8D49AF08F959D13F3919.2658.2962392174.909",
        "CD_0CFEE70EA76040BBCF59E006C673746B621403E235671233CF5C1C2B3513102A.2739.2279688497.732",
        "CD_07175BBA4C96099E611E7C4DB8EA7DEC92B3AEAE5EC6DF957DB2495087F658D2.145.1125641566.861",
        "CD_4B73D65E2FE4553C66EBB3CAEECF929ED3C6295923490BCF82E45AB15E13C3B2.33.3124051792.546",
        "RecommendedActions",
        "I_E3E98DA8056ADBF1D1154B03CF37CC4CFC75909834CACE9BE0CA65832B107411.2726.1698626000.285",
        "0025F7CF40D004E2BC1C3C9AA54865F4",
        "IL_0F7F13DE43E9D814455F803EB91230753AE96BA9DA56B4E4422BA553F2EB4174.2693.3174317615.257",
        "C_FE3818270093A67B72B546EA3ACF6E4265D33BD8A3B28562DCE0CFA8C720DE41",
        "I_DCCDA299E3D2E513C9259A1F5517188FED6274DFF5B45EB28FAAFF66B3DE8928.2725.1727203039.283",
        "I_9CD19EF47CD0FC5109D45EEC67CA09F42C58923400F61C074C9EE2D38F7F689F.2724.833967666.283",
        ":>BF~",
        "I_58740AA495A98FBE8EBE67D95D511D3E45798D275BCA46DE213B96377FA857D9.2720.2647125338.286",
        "CD_674E009399067E9F8FCA00BCCBF5E035F85107EC0F73CE72DDBB417BF5D094F1.2546.1267513355.630",
        "C_BEDCE10B1E31B78D9DE85D53323668D23ECBF447CB87EDE5B44EC2D1406B528F",
        "C_D16B91CE54438C2B0BC70CA30F18A1D01B64E1D3178977285B1DE67A30CFD3CE",
        "IL_D12143430C7364F664246587C136FFB74F8C90689FF9A1B0AEB7B9442A0BC274.2736.3113440400.269",
        "I_9ADC58CCD24E3BB9175E9B133C194805B02727FC056F35B7DD0BFBC680674DDF.2724.2805545428.285",
        "I_718C99B273A0BA1868DBCE777D9B4FCBFDBFB469BAAF23FD16C99C7AA1407471.2718.2921364966.280",
        "I_7B708F0EBAA300F444DB0951BD36383EFB8EE1ADB2E2E601E975D6BD67C66815.1051.2348060723.334",
        "I_0B8BF58309BF9E34389F1C832AE582473CA071ADFAE618E784E2A5B7F73FBBED.2722.126728342.288",
        "IL_43E62AB0AD3F0F54666953AC95C414EE36B3A6541513F8BFD8A755EEC9A7E6E5.328.1.65559",
        "CD_D75AF298547A60BC5DC28CC5F9BB9F112DC00D9A181668F25979B122809C5257.2371.3311210591.277",
        "CD_1FF3E8B084EF958D6CA51930B35BA398A9AA3DBAED426E535ABE1FF42F771AC3.2419.1833977022.363",
        "CR_009060D2904B4B02AF55083DEF7BC672283599AF1BEDA6D3B9EC703CB3D5B011",
        "IL_90EAEB9E7832AE37A430296BF8D528423F4A2B78383FC56899F558FF340CB602.2690.2797858148.268",
        "I_36045C1EB878565670F72F3D1E7587983677C025BCAD734E43E3B9A93BA9EFD8.80.1846795204.310",
        "I_189735F4993F268A682C32E1E892E3D4E5789484B02A377D7442D5A54CCE596A.2729.2857199671.285",
        "C_840035F63794F57A62A5607B53F5A8A9C84296DF659BF9F5C0E61203052FB854",
        "IR_370D362D24157E77A6D437A1B6E44D31636578C65BA57AE250B7372F533440DE",
        "Digital Composite",
        "{725BA9B3-C1F3-4518-AF1B-C8D669191E15}",
        "IL_EC794B3467A52CCDF1B174E691E806AC5F2BE51FBBD02FD9D19305BDFD36C8D8.1017.657475596.341",
        "C_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655",
        "CD_965B6EB1A6811B0551711D38F83F3DB9DE7C53AD875355FDC9866616CBDAD695.1556.2566372356.6710",
        "CD_C3B04A66ADDA484D1EC25E5B8140908CDCA4706F41ABDA4957CCA378FEB9EE6C.1922.2937710206.283",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1714.2666996016.368",
        "R_BC0FC27106A767FEC0851E8860A023F04DDFD5CE172A9F5CC2B8EE5C7AD4FF73",
        "CD_D32DA41D9017CF8A14ADDF68399E82398D01887534F91B652E82F022449D154F.2660.66190857.893",
        "I_9571D0AB746041975C847A333AD27B56C8C3DB0FC60C7F37837770A120246D3E.2727.997820874.291",
        "CD_0670B73B6B090142BD85762A0781366FE00115AA7451B9B2750B5D23B1B3C0EE.1058.3967403014.1601",
        "C_9C93CDD5D73BA485572281BADA11A2A3674A64CD9F400FDD1797E1E153C6A4D7",
        "I_94F160F3ED21BB5DCE57AEE09925DD63575475AA7648364FF69B4CD5E3623C1C.2685.2572373870.290",
        "CD_9E0C8790D6EC22D495C0683C2874C55C68F20E49180E09C4510CBF9601E9CF64.2521.3689097642.831",
        "C_88CE5A07CD2F69DBBB73BA9DE9D43614B1ABE5A1326A7EBD8D82AB018DF39B74",
        "CD_AF2CB7F709A3B2125D54C811191A235B443ADD096957C31507D844B4031F02AD.1545.1336726105.432",
        "R_EC5C4DC0FE89185F526B955C798149CABA4B33211BEF571147AFFE5014EB1AA6",
        "502D67664F16B0C26C80BA30AFBE91ABD4375BB24F8697FCA1AF3070D29CC71.2656.2042732615.256",
        "CD_841F1DC98C3FA6D8D114A873F8BBB48736A8E2FDF60D6C1F08DF493438718909.190.1391608832.1059",
        "CD_D79E32EFA738782858549B5180893EA1A5E71401A6BAAE362DAE46E23511E634.2037.1683214565.915",
        "Registry_ChangeNotification",
        "C_7452F14093AA45A6FA141E92387672987578A9B50AFBD7A89E994756201A5879",
        "IL_715A8576DE8CF6D78CE0AE7D8041141A05B4A1E1DF7BF401DDFF5E4E706ADB4B.2675.2911843842.275",
        "0x00100000",
        "Process_V2_TypeGroup3",
        "Win32_UTCTime",
        "I_966DC5DCA4DEC2E152FF0DCB95694284C8D14AEEAC2177017344379B05EF9185.2701.3240726791.277",
        "CD_6147F993AF256833A5576FFB2C6527B32DD0A80720419520043AEAC80AA92F51.1926.4221483522.286",
        "CD_1C06FA152DAF97258D99D731FF917040529592936586FC456CA74403EF6A2F73.1082.4209177697.761",
        "R_4B1C8C02D0E33766F3C6017DF0EBDD90ADF884DA4C3130F2712132D3D3462315.2512.4807612.540",
        "CD_E6693E875674598B86E9046055C21F06E3880E36F7B4D4AB3B0150ED979EA8CB.1563.405885921.488",
        "AllowWindowsSpotlightWindowsWelcomeExperience",
        "I_1EE528C62E00151A3CEE5C5B7F0A2EE55EFB31E410363C9065E51496B7100EB5.2688.1700718930.272",
        "HNet_Connection.Guid=\"{4C572733-2FBA-4346-9601-F86DBA666EF2}\"",
        "CD_64871D54F6D14BAF727492950051A7415055C7E730517B11F0B0AC9AABD72A57.1606.709123897.238",
        "CD_94B70633FE66960EDC7B9B01078D8EECCDA0CE9932A491D21AA838CFC540C35F.2596.291788635.489",
        "CD_D1F35069AB830308A3D10C95EC411D258E0A9CAA2EE0311B34E2874304803008.1996.3769540154.631",
        "IL_42D7FC2A9817D6233DE6EAC6B89E74C23962D01ED8F714F51DAAE0E7D144D752.2675.31539601.286",
        "CD_E1A260703C34591BCFE34DB6F56F5F56AD267BE75E7FD5875D186BD564A7F380.2571.237319144.552",
        "CD_9F3571C46BDFE273D99A799A2A4BCF3BFE2F06FC194D43AB6E29A0547376022B.2670.3141714743.991",
        "        <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>",
        "CD_4B835375C85830D11DAA3F01F5AF9F28573A4521B9279B28C7605832DE3B39C3.2000.2198605639.1584",
        "CD_0CD3432EB17462BFB5BD92FE309EBEDE9286A9F3ADCBFE4044D787F3CCDADE24.1526.1592160283.452",
        "CD_A9F981525532E646F72434C14F966C77C49EF61288E4F47A9687569A454053D6.2601.3141132607.3126",
        "C_FAA87DA9696C5DDA8779735D0CDD82F772B3863DFCBC34954A3E6021F405A249",
        "CD_098B523DA132211D101F3D49A0D984806B2D95BFF2B2CB9EDE28A96AF5AFC31D.1560.1663116278.416",
        "iDataId",
        "C_B390F1C634902338C5C1550ABA1DCF340D9E88E53F272BDFC30EB49C6392E4E9",
        "C_A0EE46252458600B3D11AD46CF5C24AF0B828C60CEE54B5A3DDF79ECBEEE1419",
        "IL_CA69AE24721720CB3544122DBD7BB4A934D5B4B83971AA6FB9AED80BFA8CEFEA.2706.142519644.289",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.139.1256933423.180",
        "IR_E95DE8A58F7A0B8BE8199A37DC9F2A4739FC0BDFAABA87D3B8EEB2F9DF7ADC4A",
        "I_A1E612644DE674C3CD876D5F509A24C64EA8F50E32BA1758ABE393BE3AD21743.2679.2669350209.276",
        "CD_155D9E7AE6D9F85361D5CC740FA1EFEDE91BCBF995E255746E05290A3497CB99.1672.1.16925",
        "CD_230EA8264BAA6C50B01C67268E97AB7EA0B455AC7B2538115EE2F298AB497196.1203.2333377647.1538",
        "IL_381C3695761BEB27215621E28950E0A97D51882922550126C26AC14E24BEB3E0.2716.2048160921.283",
        "CR_0B9091A7705333E08909D2D04FE2D8C67B717AD489BDF891C00D458657EAF4C7",
        "IL_2CB373A56176C0CE007904157A1B0AD9C3480C6F48BB09E739581507E4E2FA3D.2679.2021229095.275",
        "I_317D1F2687177AFA27CB8EA6F6A360902286E215810936DE250861D000157F69.2460.749615048.336",
        "C_E14B4F0753556BB90A70563D70F7B34C4B56749AD9FDBAEE6BC20394E4A29614",
        "{313e88e0-a4fd-11d8-b301-505054503030}",
        "C_A57480D0D82DDE51E01CC9C7625981822E2D1C37B70F78DC6E6179505A7BD928",
        "A Win32_FolderRedirectionHealth object that represents the health of the user's redirected Desktop folder.",
        "The NameFormat property identifies how the Name of the AdminDomain is generated, using the heuristic specified in the CIM V2 System Model spec. It assumes that the documented rules are traversed in order, to determine and assign a Name. The NameFormat Values list defines the precedence order for assigning the Name of the AdminDomain. ",
        "C_A9F981525532E646F72434C14F966C77C49EF61288E4F47A9687569A454053D6",
        "IL_E73BC8E8ACC0C61B2F330C62D6B1120D9501D75C332FCECCD9A6E057C4EECFF3.2686.2962906850.280",
        "CD_4BC6C3BC5AEBAD208F4642F30DD04DB828A3549F04DD643E263C528D3DF80720.2670.1928993406.1872",
        "CD_EEA03BCBA3B96A242B9DF0CF75DAE7464E37C83E292EC97AF81E8D15CE5623E3.1594.2626109873.432",
        "CD_01F6508C1866E0E79B21585B0217BD595D533D4A180A35479737402276CAE352.99.3430469742.309",
        "9<?BE",
        "I_F75DB8B281A6C85DC52EEDE82A2A8475D45877024A70F3C20E4494FB9EB94FB1.2710.375845903.286",
        "C_A656B709CF7506FA0ED9A4A22CF1CA6B0C1E6E71BC032CAF75FC1489092E677F",
        "C_7450B933028ED3A9668E73BC07A8325B939DC7781D6560E2446E75795DDC2C3E",
        "I_F63BDEB78036B11EFA70B819F8A3B678563B9243432B6919B10FDAB9FBC3416D.2689.4267110888.274",
        "IL_82F0AA04B23AF43855F7FB541B789F7C0718B3109E5194397CDB06469139838F.2680.204457605.278",
        "CD_064843E966479C3B4CF71DBA14623DC8C5CF1B385A02FDC292B3B3F5C45F4BAC.1522.2467262012.3455",
        "I_BC62D2F1A8964BE05CE3C8E4A92D6196F3ABA9FF68221E9970F3291305AD53F0.419.1.28222",
        "CD_51447A26417532B0D1E85276A6FCB955003CCAAE5927BD755A45CC87195E9484.142.103485199.565",
        "CD_97BB199CE4D9B053D267D3E21705BC5FEFBBA4BB59B3C0549DB5A62CA7F3BB34.2118.206791641.2280",
        "IL_1D0ACCA9F533DCD510C277D648A62BB8CD3E7F4E8E797DF7E4570B4692D0506B.2674.3598263952.252",
        "R_C048801BD5D3FA6AC71997C20307BC2294AA0650B75F6BCDC38FC1AE7FFD834D.1462.2398215406.540",
        "CD_5120F8DED242719988A9B53EE954218632D3A896BD93867D072F4224AC3F8FBA.34.1797272423.466",
        "CD_CC8A06D68AE379FE41054DF5884BDC711740AAD2D1E5857EA8F880E09E3E9053.2560.298201370.1137",
        "CD_08802E8C03811ED7B07D82942CD9F025CE302A278EC5904A6CDEA63BFA636223.2661.237913324.909",
        "Msft_WmiProvider_OperationEvent_Pre",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.2889952617.180",
        "CR_503E99E1F76A9D46449F32E9069632CBB392B8A00D8C4838939B6A5881D7193A",
        "CD_4548ABC60D8D754BA5CDF5BF3F98D090EE4DF751AB5940B6E9A6298C3D9C3BAA.2390.806942015.1641",
        "I_D4C5B1295D7F3E08DA22C2967F502C8285AD006AF203438BF38B8290DF3B43EA.2727.1242757079.274",
        "C_BC906ACD0D7D2D84252D25E6E9667F70E36490E80DB20471991B052FEE0CF9C6",
        "CD_4A9BADBF619D7C360E2E222A1D05EF4C32E9769C9232CA2631F4E74AC78597AC.2758.1670521524.361",
        "C_A9B783D001816C120A5D7EBC7A87AECF9E0EE52068A0CADAE17A8EA3AF1000D9",
        "Levels",
        "CR_54B0E217B287F6F85D4DEAB32DF5A8CE4DFDF560D8AC01819FC50FC0ACC66BC3",
        "I_EBF137594178DB67DCA5EE0984DE75D9883C9F6751FD15D2E218A5EDE6DB3161.2703.3237929555.289",
        "IL_F995CE4CC76FB75C234072D4A96D01ED6A4BC17C2608DB401D59ED3E24F70E86.2700.2412514758.271",
        "C_0DB45CACA25E882906575B2D36934F555FC5B0E4AC7554F46788D84D3F95C547",
        "I_6DD34E7238542990DA569D84FA721E85E6B9B1018BD449122353F55EEA401EAF.2704.3077023596.281",
        "CIM_ElementSettingData",
        "CD_B22B427F2794F083D59CAB3CBAECCCBC3A99C22CA4382A86ACBEEBD3E7AEF4E7.2759.1560035489.294",
        "IL_FA941F6BA65E82F5FC942292D3C38D98B8FE7DBD08C5AB6746FE263DF2D61E74.2683.2129912645.276",
        "unknown",
        "CD_D91E00BCF74E046025FDC560EFE12C70AA84FF7526DB5DF32B504E8DE7F770F0.121.1855966373.477",
        "I_9B73601771FFF5F56A68732489AF8DFEF9B2C9EDEA5585B99914E3F53FD217A0.2691.2553896704.264",
        "R_E28D2B7E32C95FD44C0BF23A259EE763485B5B5A1006D97B269F23A69FCF1EFA.2763.2547112821.576",
        "SystemConfig_V2_Power",
        "C_36FFCD7C103F4CB151534CDC404DD1E71C91E39EA5D1DCB2E130739044899EBB",
        "IL_5C128A75C27B4985F58BF9F60D25F3AD1811C55F8449A91D8301FA08651ED431.297.2524730711.305",
        "CD_5E9AFB2824E4C09259A80739D70D94E550D572E8A9E41593DAFDA14D65369AE4.1616.2180337422.265",
        "C_4BC6C3BC5AEBAD208F4642F30DD04DB828A3549F04DD643E263C528D3DF80720",
        "CD_F2CA4DB3C668E6418D579525693A11C910C0B4C82E7E68D52D07432FC8FDACEC.277.2125783853.378",
        "IL_96BF81795E1D8A3228350F8E74BCFB3DE8581F255129511C5057DD024CD5C7C6.2703.2921927041.289",
        "ProcessorAcpiTsdDependency",
        "IL_8B68560B534A6D3AF089AA733C222DB25352C8528E5767D325B8757B271F3DD1.2508.1388436070.319",
        "__namespace",
        "CD_3FCF421D60410804A360FAE7235BE2446D112B7A0A3E80FC873A1B1F4A21DAC6.2574.2561994653.378",
        "CD_9E336B8DC1D54B8E5BF3349F6BCF605E1FA4F0F0B475578AA00DF3B9A9FEB127.1352.2131232981.1430",
        "ngs such as allocation failure",
        "CD_A6B2FACDEA8F1374576DD3AE295E7922568ECC31E34094F238E85DAF6423D486.2614.1177738108.388",
        "CD_92D90F38218063ED84DEBF091001DAB75383FEA23B31338C700BDB5B69D9A383.1148.4107397820.4385",
        "IL_6BA55C286FC67261D43C0FCEC56FCFCE8D1515AB864772B1E0B2EDD213BE3F11.2700.3282323892.281",
        "CD_1A5D106CEFB4CEA257AA3A4714757C2AC76A0800E27895E553FD11D6C31800B8.1596.184391545.965",
        "C_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11",
        "C_5FDD5C517B158FA6F136FDA5163883910AF54452C20644A4B22DCE61A6AAF3A7",
        "C_80FC29E4245D9040B48B4CD2FA8E17BBE43284D1E036BE8B06A9EF2961F74550",
        "C_556BED9C5C7B0EE930A3BB6724BD19CEA9521081CDD971D1A19DD19DC37599CE",
        "IL_2E32DD3C4304AB7C0A3A6A35FE2D5283221F256440C1893B09E3BF79A85CFB96.1352.520578658.333",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1352.459577058.332",
        "IL_08458146535F252B21240CB785C03373C3730F1AEA87D3E504B3EF91DBA9A72E.2687.3109292735.263",
        "I_91BB5F8AFE5873E9BA8EBD1189F17D947DC5BB7E366AF568F25A5BD3FADD34E6.1335.816371373.256",
        "CD_2C1FABC8728F9E076F6727DBB7BA1358C4F010407356DEB983BF769E41D5848D.2489.1037758642.640",
        "I_8790F85C1CD081BD2820B504DDE9C4A3D2C829380C534160DCA15AEF0CD7087D.2712.168188565.281",
        "IL_43B7B69F919BB681DCC1079E7BED6BA29BBE6F4DDA8822130874E698F9F22509.1105.2387327780.301",
        "IL_681927C62E79E8B0A6FD008BA8315BC81525548D98471AA54E87E66CA8F6ADED.2722.2801581974.287",
        "IL_61B8E29430AF5705BE72508950BAB53CE99B64B7A12659E83BBC3DD21EE55F3B.1017.25161823.325",
        "C_80F94DB344488EBD67AC92604B50AD923B5145AED16129FD8EE9CB5A5BECF89F",
        "CD_3863CF198183B50B73BF68A52390640EB8E4B2490D653E0A1079EFA26ABECE5A.2036.2815675517.1911",
        "CD_D1F789B3E4BEA3C7E499229EDFC8CB7B11AB12DADC59C0292CCA917AC88CEB13.122.2988301391.438",
        "CD_BC4F91591102411312342399DC065D3EC257C15FFCA13E42BB6956DC3F1EDBC3.1677.1558427614.344",
        "I_E0E6EC4FED3B5C2E3E8EEAA7E3AC8D3D33C253568BBF6F16FF8E5FDBDEB6D4AC.2679.779914690.273",
        "PointerType",
        "CD_D6F23AC5CCBEB47ECCF7BF129523258879FDED9D282F558043FF80249A7ED596.1079.1176155200.333",
        "Msft_CliAlias.FriendlyName=\"ShadowCopy\"",
        "I_C45E888B6BE8DD1A0E185195E4FF517002147F20E91741D89E0548831F8A673C.2680.3484735362.304",
        "CD_9E6BE90DCA6B96CBA3BF12EFB579708613DA0A405A49EA5E6B87A7FDB2747D9E.2033.2624884185.251",
        "CD_AC63429FE4716555DE1C78C4ABC52C6F5128C0FC3C7A7BBC67A237A382D5F3E5.2512.3247570852.459",
        "IL_8A4FF225C58B64E39A926E51167D666A4A5D759E2FC49A48C146A965531D964F.1355.1469271766.195",
        "CD_62C8891E57F68B5018AA739FA2F9A6FA324F5514D7DD621D65681F6B7E0BBD4F.77.1506552992.657",
        "C_ED570D21D0D7F1575600CF30D60A5C9A675A42E8F301530AECD595FF166AFB26",
        "error_Category",
        "CD_974F68602E2292AC89BD27596E610F3132E5D27B95115A1EF4740F8D7EC0ADFD.2590.3059448571.1479",
        "B580641425F8CB979F59DD32F.2585.1548441746.670",
        "C_92238AD148AC5103CADC28989282F28BCC65BD1B364542DE6EEA1DCD3908F3C7",
        "48<@DH",
        "IL_7073556028E92CD2F0726CA88D5184752BD93537DDDCC28701C9302D24B13171.2716.1603367613.282",
        "I_CA599D6A29EF58E9CC298260942301AFE42CF6FFCEB9502DACD0BAA50DED4DEE.530.1.21465",
        "CD_18F346BD214F217E447A1FFE3109B06E13553A39E553F4F4B66A2D5285DF9EF5.1752.785806377.5279",
        "CD_DA3DC1260150EA9B0B2628C0C2AA81125377900B91EB681EA05BC31E6A7900FC.108.2618087872.5223",
        "C_6F49E037E6F2BFB72144CC48C974D93CBE7417A8F27ACAB5CA25D34A28C29442",
        "7791.290",
        "CIM_ServicD",
        "6488CB.2568.4281629629.679",
        "p|`dl\\ht,048",
        "IL_420FD0BB65D2E0864325827323315EFD82F1B471DA36BAB7E9FD9F20FE3AA31D.2726.816054065.282",
        "C_2F0634D04E52DD449D6BEF9EE9BFD39904ACD67C5891849A29277B7E6AC73EB4",
        "CD_058481E893AB7D6D39E59758162E9CF10FB7EFFA94CB9FA8DDD3A0DB231178EC.1589.3112895704.932",
        "IR_D055C7DACD8F90B78856388BF2CE8EBA10658B500AE545011AA63A392BB2FD19",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.297.1733735090.188",
        "C_743FCBD526F43633FF2ABB29F490DAD5EEAEDE4C488F8D224708D0DF7EEDE463",
        "CD_3F47C7C5EDE1255249E372E90C4D8EAB77757D572A8E1F6E22B79B0FD3819343.1230.4050707384.1270",
        "KernelPerfStateDomainChange",
        "Win32_MountPoint",
        "C_A9756BF34BF29220A7B7ED9624A09410B903D557F574058934882D94F40FC62C",
        "C_F22CAC1390F7E25096EEDDC9A22578C183AAC4BC2920068C5646D2049B964F6C",
        "CD_11A7ECD9144579B152069208B2E368C32AC66D74E37C0FB050800C74CDAD8EE0.2620.321279545.1803",
        "CR_DBC9D7448979766FC3AA5E546B9F7F37A6E0C06BC06D343F27EAFCD412F13D2A",
        "CD_6B6E099E11689A83F0DC500069A409572F5633F1702D3669455D70159BB2B714.1068.793568131.1428",
        "CD_41695C2AF45A08336AFE1BDB6F027AEAD97E2A04551B2329B3A302DF92AC01FC.1638.1157803630.359",
        "C_FBFFFF984DA9B7029EE7078D02385B8FF23DEF8E12B59491A9BDEA2549806FA0",
        "IL_62A60E2741DCAC062AD3EF4B8A219DF408DCF3C859AE6CE6D95D23F4E56AD8E3.1016.3900931076.301",
        "WmiProv",
        "QOSWMI_TRACE_UTILS",
        "C_6119709D50505721012C3E070D3A27B989925B6DA18791E194C0502824847725",
        "CD_554B16C9365D83D15EEFD2ED88E19BDB73646FD9C4C1F4781F93EC1BCB3E664E.131.2773437382.2014",
        "QN93T",
        "C_ED32C790EDC45FEA848CEF5DF0CB83F1E1D371237F64D00529CD1A7DB924F38B",
        "95c0cf}",
        "I_371222E66C491D1F94B87454FAA287DED8F59F65D5D82CC6472E895719D07D19.2735.1564604075.268",
        "CD_DE00475055EACC7B53BF4B3D912C0AED441AE802F9CCA17A5072BACBD47797C3.123.972500251.719",
        "CD_A773BCD0E0C94C33A6AC49E9BCF9D33930925D924E7E273E7C9279E5B4F0D069.2574.884357847.738",
        "C_F888AA6AC586756C18E219B06406D7BCD62E2EB0C94B51FB48F127652DA7E3EB",
        "CD_2C338646F5C1CAA321EFF2BEDBEB6839F57D9EB755DB455A7F244BA25566E1F5.214.3646359275.791",
        "I_19E57369527D4B1D06F7B62EA4740710580A7EE3221F927586AA3C452A7CD5DA.1020.116025462.277",
        "Second",
        "I_4E8B4EB6A9B16006AB3200684161B678F30DF885EB15C30D7CE2EEE255AC35BC.1088.72614020.336",
        "I_221B15A46AC13C7AD27BC4E20FAF2340A7392D01F17942AD13DF1D7C71524ABC.2720.1812539822.280",
        "SEL_GENERATOR_ID",
        "CD_26F2DFA12DD4E238DF19BAA4547B3B8EF9BC62B9AB940056F71629B35FA95FCC.1475.2398875989.4422",
        "C_3088866DF50426CCC6D9D3B32AAD3B6CF7FC73EC115545308C15A220D5B5FA14",
        "CD_3BDBA442E8DE5FD0C97625EBC2E671BAA7CA52B571B7C8E96AB3E76C4549E8EE.1246.1.14512",
        "CD_CE52514EB297DA97E5DF5727E753E855973F6ECB94C0DC5B3C12AB6889CF9DDC.2527.3903053406.5087",
        "CD_4FE92FDF8DB55FE415CF68F8C9E8D6F30FCA3696A2361C3C56C015347302AEB5.1350.806450645.603",
        "CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified.",
        "IL_AF2EE8E683555398DF627134B08091B08BDE2EF7FE2BD2B79AB2B13385CF2064.2725.609690594.283",
        "1167F9378C0599A2476CC4B8A03045BE91BB2.2713.853600938.285",
        "CD_D16B91CE54438C2B0BC70CA30F18A1D01B64E1D3178977285B1DE67A30CFD3CE.1171.378612626.541",
        "I_C312DE87ECDA41B4BA349E56094AF7BF97D35C035BC82923118A777854760462.2712.3168035425.290",
        "CD_EE8C4640FD60905905B00B1CDD578E162950539A8911836499849B2BDE6B0C53.1559.3765131599.428",
        "CD_73B76905DE8D62EEFC35FDC779F0748B6AA4421D4B0EB21785C52189DE44B66F.2624.1501093188.352",
        "CD_F17398737D28E7C45998B683DDF3AEF00877214A6F9C64D8C12FF21642BE4411.1561.763888067.415",
        "C_FA52CB5E7D6BA7133233B22EA252FFA4A8C664E7F86ACC00B362A212DA58071C",
        "CD_3F223B3BCE2BEEB6E263559A80A1DB72691DAB2FEA0A10FAFD7FCB4B0275A0E4.2556.3623184563.996",
        "CD_9FFC730BEA787E28FF305A66FE71BC4BDA5863470D337AF3119C48B654F08702.2112.646779241.1488",
        "Remote Replica Source",
        "C_5847C21BC6927B979DCCC7E87CBA9AC34DE69BF0C904AF77E2C0BE3CEEA06FCB",
        "The current matching day of the current week (0-6, Sunday being 0)",
        "CD_7D26F1E16BC9CE86FDDDA09E425A859A3BF87CD94B9004A4B2B575CD1EF41374.2016.3057145932.1979",
        "C_B1FA91D7E357A98D1F2A81E3A4C3A1F016D6EE080633A0348AB241030664D0FD",
        "I_8620435B38BE1E99E74C0209777119091A237CDBD9A1C0FEF68B28339128BA61.2521.606677117.342",
        "C_8C9D1B00E81FBD2847B861D222A962DF95BEF97009ABD78ECA20527CECA1CB21",
        "    <migXml xmlns=\"\">",
        "CD_52FA3652DE48FD253CE895AA1E0F7F7869B94D77DBBF33883D1DBCF38C65343A.2003.3054799859.2265",
        "IL_A9DD53B8A4AF153CD2230F21D7DB308923F1EE51C00FF2E7974ABB9DAFC52676.2728.301383558.285",
        "CD_311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C.310.4114126513.476",
        "R_6B1E65887D1DF86D30099D3E4D63A8BF6C87972E91E1C9133CF16C8761639115.1934.2382037536.520",
        "C_84EB81C2116679BDB056AE954BCB9E5BA3DA9160877A6B49D3E308FEE490EBFC",
        "PreviousInstance",
        "0x00002000",
        "CD_24CFB2B4CEAD5BE9188CC5001933580DC2746C05DE76A8DB6DD098D52E4B25F0.1828.721789189.5493",
        "I_5A7261F5EC1187583C73ACE3A490C4F2686C3F15100D1A96FDE1517C0A5317F1.2729.3782110954.269",
        "C_D19777074C5B32D9DC9992840BAA8166B47EC1038BA93E9572C45BE663CDE8EC",
        "CD_F33D7C5F62C48A98254F1B0ADED8C5A8E56D1601D517CF44369F4A800E4AA9F6.1086.3222844646.340",
        "C_ECD0991E788BDD3F18D05B1734161881A31F5E3936FFF793B7C468C358EFC90B",
        "C_3C0F9FF380E6F9A5EF7C4A02EB445487886965C0BFB27D361EBE326C146C0648",
        "CD_9F036BA68CA921AFF06984BDB9CEE80E8A2696D8DB098A0C679A6507C62F4DAD.130.1839224356.625",
        "C_D16A12AECD65E92E54D81BB5A6D4F0A9B8CCE54CFDA3ACCAD58B890172BA2F63",
        "CD_81F5CC7DCEFB1E634599916220181F35C3DB70B94808983CB78C381325F1AAF3.1678.1.70946",
        "CD_D446C28F44A94776D61EB3F1162CC22D32990679FFC3B5C6CE4863712E69A92D.1971.1.13645",
        "CD_1283D6E2E269ECFAA20DDCA78E5D8B7B8AC13879915B95F38BE4B062F89C60F6.316.3815105169.251",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1188.4208850230.211",
        "I_56F85E4076031976C69E6208BF4F210C3A65B767BAB4D30250D38415F63E615D.2710.1435594326.290",
        "CD_5D2C2C389F5259E45332A86ADEF5107186DA3990C071FED897FC6FAECC4A4DBE.2007.3493028223.1759",
        "C_698A32B2EFB9AF12EFCD0A0FC46109785288AB2107A556F691113D8AB3DB5783",
        "CD_2FB4A6ACDC87585EA55F9481A3817C321080794083AF98F344F8219284F79C17.1926.1725710643.1029",
        "C_175CBCDF1FE1A3D1006BEE5BB1EEB6A6DED276EE5BB03CA516D694240172D5A8",
        "R_D2E1F5EB4F84E0C0B2E61F3513674DF2B7151098EA22604925123769286041D2",
        "CD_ECDF6473AEB5680FD494BFD070A3EC2B36A681EE68A62E383213B3D773EF9B61.142.1436578391.1138",
        "C_95CE38D55F514EB56E1FD96114137062153D80888E94FE34DB4826CDF9096258",
        "CD_838E75DF6AB0A59C9F2477F1CA99D3050323945F5A9DCAAC9E77A5F334C030A9.2424.1890290970.355",
        "CD_050953C58E97660582926667045FD157390A1B7EE9E1CDFCB3DD57BDA1E5B26D.1785.1.23402",
        "IL_371222E66C491D1F94B87454FAA287DED8F59F65D5D82CC6472E895719D07D19.2735.1564604075.268",
        "Number of bytes needing synchronization from the client to the server.",
        "R_271985CFB8861AAD6656C473A793D3A13C882971BE36E460E9088BE8721E11F4",
        "R_23A50366135FBF364F350BC34F639BE141A61D21A478BB4C1230D838F1296A4E",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.1939.2072208055.297",
        "I_583D0850A5AD2D84358ADD515D9FB3F1E44AC880C2728DDC36BC8284D193FE6C.2675.1536231097.260",
        "IL_134911488F4C46FE96CA8686428124AE0F9EF6012135FA66D10B14874FC8CC09.2720.2171605859.279",
        "CD_A76FA854887A9BBAD49C12D899F57D5ACA788AD06725AAE7A65B4BDA71ED1B54.277.2804010493.824",
        "IL_7314B37EE7A9CD5E94179CFEF93B73A543402E7B7C41960FE84DD1621D330BCB.2679.133308684.283",
        "CD_16D6E45D9DC3C2448BBB5DF12E5A17B75BBAD53607DFAC1CCE27C411AB0AEA61.2171.1.11793",
        "C_C0A77ED799B7351F2E397137E839919102D123FCD7350D8EF328ED8645D917E5",
        "KI_272E5753DC3EECDD6057038DB6F26170E7D1CD565B954C6C4A406CB1BC2D023E",
        "[MofResourceName]",
        "CD_3D126353F8A45AE958FDB7A794F752470EAF3717B940BF141551AD925649D593.2444.1.18760",
        "C_C62347F459E9E9A6DD2944145D972E253F3D3E7B606F67BA3892A54A2CDCC625",
        "IL_C2C5753C4F598CFD8A5AF2A2886F3FE064A2E73E367C27FAD1E6F688492B7CA1.2681.2469525010.278",
        "I_A3EAD9474AF49011D7761EBFC6FF3E823718261785C28E5099B3B72B6959BB30.2729.387522730.265",
        "CD_9119F0B652DA36ED39E0F720020078B4D648A3C32B50B41FE55A21DEAC3494CE.2627.2896430468.1783",
        "CD_B293971E18EBDBA3E18E429E10AEDF13A0739F0E375B42373FB5BD3B45C3B92C.2052.1097742806.152",
        "CD_C5A9EEE4A4647089107EE2012B78461F48968B72655A54C15964BF9945E54FF0.1466.958424451.1662",
        "IR_20A2FCD02AFF243CF774088A45E089FBE5A849A9F82F70950D8BFE6D4323904A",
        "X\\@Dd`",
        "CD_E6644D36102EFA829C6305E663F5FA4D4ECF1E8C5D01081F3BF42BC0A113E3B5.1780.2458164672.292",
        "CD_989A756437E7CA88FBC7B02B2174A854DCAA4C2FAD8748FBC3EE0CBE0831C536.2639.4218313680.630",
        "CD_008720254C2A979DBD5FF3822840A198E79AD81A362A92EB99483EEC5D47BE05.1928.4065419693.306",
        "IL_5306A39AE8099BE250137B7B473C6C6DC916A35E8018A185B5C9A31EB97EDE85.706.1.27844",
        "IL_147D4AC53AF6A8CF6A38367007145E6227FA7EAA89729F8BF52CDAD51A73A7D3.2722.3655789032.279",
        "CD_2593546F7F7FAC2B60CA22440D930CA43315D905BCE5BBEB889FEE3F3AF27006.1523.949078746.1947",
        "CD_3F7D1945899799D2D40207E5AF573ECA3E160556FC8C2123E5A1AEABAFB3BFA1.2644.3760316200.544",
        "C_FC7FFCA0C7A5D89DD371B2F0B241E87A604E23DE48746B1BF4F9C2034FE72A72",
        "I_6456463FE04288A1885C6F7DFFFA4040E415617C14B667F2C51BCDF537F3D501.864.1.21995",
        "R_80AFDCC52F3C92AD7D0F8DD0B12150C7B0CC34A13BF2D3DD52C62A73F9713B79",
        "CD_F61D3A37372046376CAFA47C2FBD5009ED63EA8C65A1E072429CA32FDA52CF26.61.588964556.629",
        "I_76EE988FFB3620C1454517ACB416C23DC74264F3DAF163C2045A6A0579E07810.2676.2380974560.279",
        "R_6DC3E270C710F842652B84A8A32FBA808CE5138A68A074ABC88D5C6A3FAF3EBA.2457.1162379856.554",
        "The current hour of the current day (0-23)",
        "CR_8A00FF3E28E2491BD7475BE0DBBFA1E38AE556F30FA37A400006A8673FBC26B8",
        "CD_0F823E129BF22EE50D23DA52951787D623D48F86E765838C92011DD9DC1A6F31.2567.1985714394.2774",
        "CD_EDE577A8A15423BBFE9C00990ED0C7E143C04BE0A74BB383E3DB27D47D587D26.2613.1877798569.394",
        "{222962ab-6180-4b88-a825-346b75f2a24a}",
        "CD_5997589696FB2E4597FC4CE1E1612FCF4F0EAE5655998B39A34DFA12CA0BE14A.1638.2675219912.637",
        "Tape is snapped. Replace media",
        "IL_D5FAA70AF9F9BAE40FA47833C07D0CC366DB83E0973CD8E9E5C121D4195039B0.1530.4145922506.329",
        "CIM_ClusteringSAP",
        "CD_4E6C5CF7BDDF4BABEF6FBAFC3D47828429231B287510F99ACF0B237A0FB44F50.278.2685099893.582",
        "IL_515C448C1AF0D374B3695BA4F5CE55F31FE3F875EC3BA0C7CA15C5E886B46E5E.2711.2941309986.292",
        "CD_E7B9C3E697B3581C857A1735569796C21CBE72762137B6602CE35E217F12B5EC.2646.3412193137.252",
        "IL_A29447EA71172AC3A9DDA9695F8B16EF405755D65D78306F6C7FC851412AC682.2699.3516663761.274",
        "CD_A62F9CC5A61A3B5647B63F9D3EF75B6D796465E4641B09EA7A6CA665E878FA9C.2597.1100977910.904",
        "CD_0669091BB70564F4C28F9EBBB95CE7699D1CBEC6909BE49F84E8F214B14C6216.283.210044788.838",
        "CD_BA482156053C9C0750D79B8792FC85053C434CAD589DE87E1E6A57C269C49064.1125.1.26387",
        "C_1B1F12E77F513A1F34170D72EBDFB89B7AA666D5ABEE6CC04756D419F4107E74",
        "CD_F78D535F784AB5BF2A7DF53DE5ACAAF1C73DACC48189425DF45543879C147259.170.3621274553.161",
        "I_3E5C71F597B81038891F6DBE304274708E2BB2389008548AA6B8A0CCE07BBFD8.500.1.38483",
        "CD_FA26B3AB039983C42BFEA6183B0636B462D5A8C2A474808A0AA419D892800FDB.2017.3530848204.533",
        "I_A35DBAB35C3CF07CDCCC0AE2BB6E98B9C172137A4FFB5A56D4B303A1BD6835F1.2682.1936251055.276",
        "MldVersion",
        "CD_D971E3FAAA635236F384E1888F166DA3C30F1188DF8FB5F90FFC090DE0EF87E7.1151.1082317143.1033",
        "CD_D31C26871136E76D97B644481C2364D363562ED495941E1BA19460B457AC762B.1928.1223620711.1042",
        "CD_2F0634D04E52DD449D6BEF9EE9BFD39904ACD67C5891849A29277B7E6AC73EB4.2598.431400608.577",
        "CD_777909665755481973F85E4F05948A22C8B9B138E770DF765F9B0B2561A71FAB.1185.1909437578.281",
        "CD_1C96B6C34750BD86CC328EA53C2113F6AC8A17F76AC8E9BA281ECC75C09F19FB.1602.1630400319.418",
        "TraceParameter",
        "CR_5997589696FB2E4597FC4CE1E1612FCF4F0EAE5655998B39A34DFA12CA0BE14A",
        "R_85A01D7D6C9DF68F7787610C74A37CFEC117AB39E6D0A9A34BE214A8EA71FDF4.1501.3386170996.532",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1164.2707538804.368",
        "CD_3351358FBBEDAF8C7F9F2E844C4D143C5C07E38C7FCE1FD88842DE1283A57796.1748.461741117.277",
        "CR_97BC75F32D55E19412F779268A66FCC6A5BD410C650CA3D0DF71CCC46B370F28",
        "I_0818CC83DEB978B7B8752F2310EEAABC322DC2BDA1B9720BFC816D57CF461D84.2706.2862974922.285",
        "CD_3EB8548389123862A422C2E25B4027357178AFC61EE51C94A0FFC12A2DECD02C.2530.1016132590.5366",
        "C_94119F7CE064741EFDFBF431345AF21D6DE41FA57EAD0A70AB2B0FB8D3F14451",
        "CD_A635E8DA0D5FF95945C6EAE0E19DB71C75D6BBE7E19E0F2335E7F2A4C9C288F7.2580.4179750415.836",
        "R_760A5CD37813CDB0802F97A15FFFC44EE06FFB8EC97E61F0CF228A37D3D46FFB",
        "I_D3325D789A6AB0006C7E6456F0D073F619C36BC61261CD262027F7CE6C7B3120.2713.1391020292.302",
        "CD_9611302718E7A15BA3E862472FA9FA8DC245F3CD224631FF3A3E4FA636E2150F.2511.129482650.3699",
        "I_DFB34F2FAB356183A61FE449255A9F1DE356AB019153A75462A7F67F3FBE235E.2690.1675144367.268",
        "I_7123B60FE0B72F1C57F72E3EAB013337D11B665291CA2F49685F4750EAD74F42.2698.3609420604.268",
        "C_5FEF9CC2240C005D9D1EA2FFCB7EBF7520D253B381EE1C9BA714DF32C3C6DCFD",
        "C_7BF9CAEC5E776ACF448F84A63EB51613BFABC1A04749B0DFFD3836F69A0FC40B",
        "deleted",
        "CD_FE8C3873BDAD1853EA9CE4F9A8CC51817A3AA40D4095EE7168936C23511B49CF.113.379264205.1064",
        "SubSegment",
        "CD_D6D14A967FE76867E0613EC607774F87ECD794228F246D5534936182A6F4EF9B.68.4138908797.1867",
        "CD_B035CFCE41CEF1FE5604243CAA5700B13BB8AD4D69A92424A83B7D202927FA55.119.1.11637",
        "C_9E7A3EDE33ECA9119BCEA76C74DC7F82F81BD50C5633DBA89810B055F180A2DE",
        "CD_EA78D27F46C798D1329821D7CEABFD06DD3833EE6512664694DD451E0D988F35.210.1331831148.815",
        "I_6BED86547A30ACCAD1302C7FA283B163848C4E58E936CB646E57DB7DE244D555.1019.1080799391.339",
        "C_A3EABD4D2E9029AB4017D33BB0D0CA4B663683B46BF99E6712A276C0CD3CD0D7",
        "C_09A0BD3FA42FC22051D80101735E2603C2C685F3E4BE5F21BEA3DDC5EBA5AA79",
        "C_4D32B2689DCEC5CBC62CE6B930082AE82B9F152AEE6B99F9CDBAC8B0961EFF51",
        "C_053DD41219FAA16153F07241CEA1789B6627CF883354607B4109B4BE9101FD9E",
        "C95988FDF4807D31199D70DC1E39D4",
        "CD_FFBBC80B52BA6E5CEFFFFEE397E621C41EE37D878B66C5EB73F2E53B9F10084A.2539.1783440814.504",
        "IL_75253219D674CF0117C64521CECCEF8B18A40F301D32F791873AA54E8F1E1537.2687.2765781215.275",
        "CD_C787CDD6148B3A1710BABB66FFAAB061F700558EE123742FA9A22BAEF228EE96.1538.560674016.910",
        "CD_DF80435D3E5FC16DFFC6C486D3AEA3D7EEA4CC923E5206FCF82ADE2C4977A73D.1547.1998858766.884",
        "IL_0051C5DF1ECF71C50620AD90C854C2D1EFEE09CCFFEDDC4FD5FB6A7E4EA2A505.2764.4257718908.288",
        "C_41C0D0E89FF0DAE8E6A4A279F27B261407C89E7ED8943F6FEDE9D0A4CD8F2131",
        "I_CF84B7AE1C70A4C46731A07D676018CA2827AFD30745BBECAD484168EA147839.2699.36478885.270",
        "CD_0783FC4315F6719B07F6F7780EAC7B73D0B0471C3E21E23BC45CB6B44FFECA8E.2737.1.9646",
        "CD_8DDAFEF7C9DC68CC1C82BFED03D0FB0A632319FACD23827BADAB05BE80A11447.2570.4087854876.410",
        "CR_D6F23AC5CCBEB47ECCF7BF129523258879FDED9D282F558043FF80249A7ED596",
        "I_1275BE448083C5AAB33DAF19956853ED9EA842E05F94D0AD39A63BA94DDA43EA.1020.2953315732.330",
        "CD_FA683FDF6D6B9D2FD9455FE7A9C71C1392512648AE2DE3FBFDEF09A26764DEFD.1335.3724290781.524",
        "CD_41618FAF81D0E53A7763CE9C298451077D86596F7351D97EBBBC77A817526A99.2576.1509633637.470",
        "IL_71D1BC07380B4FE4C5EDCC0F02E934EE8E495942B17AB007E3FEF57F0329043C.2457.2936753202.343",
        "C_9378929BCE127447D66F1472F6CC39E5CC7C4B21AB66617AED19F5689DC55677",
        "Stopped",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.3970565038.219",
        "IL_C2B597B4206C5FCD8C54154B2AF54218AE68F3F6C7C8C4836A03AF2B8F71E5CE.2710.453867218.289",
        "R_5EA1F84E0651D5FDE833CBE5A59837FABBB4428524C058736835BFBF47BBF01A.2434.3042830361.558",
        "C_742E9B93637882507F385BA153B7841CA1D9B1C432715D51E29011AA3B0D693C",
        "CD_CE1E2946EA75133DF1C863E5B411D4CB200B9A15566E82CC0D10E975E292F2B5.145.1976256673.406",
        "IL_AE9AC2BC8AFB5D056F36CB7B60980C94F15C74C0D55FBB321F636DEA98CD4F09.2458.85445167.279",
        "CD_A4EFDDEDDCE2AE550D296107D6D386ED594FA4146A7AE71A7D9821F0681D3985.1230.4060957498.1033",
        "IL_EFEB887E59EC8D83C39D53CCF57EF6AD0D608FCDC88B6F50F3452B5EEBD4BF9F.597.1.47802",
        "IL_4283255CE7FC8EA518E054AB2C9C5BD69D5B8479B2DCD08EEC220C266DFF5E12.2489.1841604712.333",
        "IL_3866531668703809C4B6A09D929C49C7B7AD945C5864C9ADBC91554E3BB2F687.2716.2325602390.292",
        "CD_F288534564F7CEA5A7BE0115B4FF5B20B967ADA096D3CA8E077825C980B49E14.2082.1735254149.448",
        "CD_5A7FDF4BD2E1212A8A01E74B4FDC157480285641E8AADC2FDCB8D0A2D1720315.1088.779121350.1852",
        "CR_CCF174B484763861274B422B027A53D668C2557EB827A557AB0E7FF6CCAC8EF5",
        "CD_054A38929ECC5F2B71B017259D5DF98C968C29C9039A37FA5C286398E463CDBA.156.3682654902.370",
        "CD_1EECFBC333FB318D97035F424A15E988A239C9452A1ECDBD654416B8121FB37E.2039.1982116638.2148",
        "C_88C4A951AB74CAB93C6609B0E8AEEAE37E1052602716388B72A1ED8A64671F4E",
        "I_63C4BF2A64B9BEBC4899D2316524538201330BC6B563C3430D83A395C9BFB361.1017.1259436876.345",
        "I_8620435B38BE1E99E74C0209777119091A237CDBD9A1C0FEF68B28339128BA61.2521.3181266368.318",
        "IL_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258.1164.378460097.247",
        "CD_BAE4D0378172682CEAC6406ED31D2D2F5E52DE844C38D6EC0AAF1CC23B81D9DF.1193.630485876.641",
        "CD_A7E164E66BC7BA8FC3752641961C8B1829E354DA32CDE974E0423F3F5730EDE5.157.81419298.765",
        "IL_D9FE81E716F5E3BFD74DDE4B3B9C48E53CE2DFEE205E7693A59C68A6AE4488C2.2679.4054352080.273",
        "CD_4E05A85C7C9DB6824A0AEFA83C9B26B28AFA6D8D088521A8F0444E981BA3B980.2426.2802700229.292",
        "C_62D2D3D876D49666DAC947AA6AD4CEC5448D7F82C5F2A5DFBFEE7B1BE68D4817",
        "CD_BE638133AD205E7E82E7EE572C3B8A31E527A6DE4CE929382C29EA547A1E1AF4.1993.106425896.5630",
        "CD_810BF28A7C26F6878E189604887AB1090DF3478356CCB47422DB03C98B71BD38.1836.1725436862.255",
        "CD_1EECFBC333FB318D97035F424A15E988A239C9452A1ECDBD654416B8121FB37E.1353.1582801692.1501",
        "C_5ECA63A2575A533106A3DA4D4E7D3593AF8C1DBA30A77246287C3734644E9810",
        "rKx*E]f",
        "CD_A76FA854887A9BBAD49C12D899F57D5ACA788AD06725AAE7A65B4BDA71ED1B54.282.1909730080.2820",
        "I_0AD70865B8C5ABD34158C033C44041C6C28843001310CFE6E77DE3CEDC03B163.2715.215896994.273",
        "IL_DE17C9D5088F4B642733CF8AEA90F5A7AFA5A9B0892FB2650254AF86F16B343D.2451.991331626.293",
        "I_933045249E1CF3B189DB3BE925E790E32900C98E11E7210C09B17AB3C4AE195D.2700.1351486593.286",
        "CD_3E11F2867F2D534D95C0593A0AA32ECA612C606596AA91228C49611E4A1C3BBE.1371.1.22077",
        "The UNC path of the directory to be suspended.  The path must exist in the Offline Files cache.",
        "IL_66DA71BA28E298AFE44B6F7A671DF042F12441319F66F1B266CB86486B7E2819.2691.3809755125.273",
        "CD_34904804988920D5ADDD4699E89CCA3704B43C3E300E615C1194ACA851BF70B5.107.525087733.402",
        "I_1C2F9731FFAAB2895AA06A9C178A0DCE7180DC3DF07E11BA8DCE057DD43980A8.2687.306420108.275",
        "C_AD7A55DBCE4A8D8485FDA925323C27900C64AA391BDA086258F10BE24098BF8F",
        "I_DE17C9D5088F4B642733CF8AEA90F5A7AFA5A9B0892FB2650254AF86F16B343D.2451.1722177901.342",
        "NS_20077C61AE959B1A631CA3A64493D24CBF9AADB0D615F63F619D6D619F5BB495",
        "CD_E49207E0C3E41BA550956778A93F67569B375398AA2B0937EEF0E61C098A3BAA.1464.116659500.1858",
        "CD_C6C7322634E5ED35EBCD1F5D0E8BFEDB63442E280DFDFC57940A99EEB54D8018.2640.2687861890.484",
        "CD_0CFEE70EA76040BBCF59E006C673746B621403E235671233CF5C1C2B3513102A.2016.1862099318.1549",
        "EIA861",
        "ExtendedStatus",
        "C_D9A10218F30FA4E428551F3E416442A7D38AB8762B28D40A8E89B4D3006D1DA2",
        "I_61B3997837DE0DF0F6FF5DBC11754E14EA66A54917FB7566A35ECA579231067B.1017.1684801006.323",
        "I_4030128FEAADED7B8FEE761F2E9F017FE75DD0D5CCF76B2F9C5095CB796A0190.2673.3329456953.282",
        "lastWriteTime",
        "I_E560A59442F101954529EE01E3B9F5CB19588A6B8C15959161D4C6BEF9912836.2677.3423024556.280",
        "IL_897EACA2347FBC71DC0E8FBFE21FA1F13FC9EAEDDE7A34C1DE772DFD6AAE17B6.984.1.15604",
        "IL_DE57F7AE8FB501996807E146319066676112A55DF9DC0135A1A8C6E4EBECC8B8.341.1.89245",
        "C_68BC4728EF0C3D45D60B79F70F4A75292BFAC912BF35592AE5379D2B141C6184",
        "R_98CFB264B18982CAA18E29B4AE1DF9D0DC42EB937BAF9F273C04B61E921E1D61.1147.61871898.530",
        "C_BBE16080A7EF2F0B1445053D0994143FB21FAF6CBC7F65EF8D2106E74618BE06",
        "C_E483DF7E28B72B64DDC8E69D7B9D7A194DAA49C1FD6E07E079F14E12C3A828EF",
        "TimingType",
        "NS_876145C71900245306A149A8A7DAC3FB0D74027E586B2E97BEF112C2070090FD\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "CD_B77F00C0AAB396341AF90E0CBAB7DE2932BB0B2F69B6D24907BE1A641C3162D0.1519.3553934792.8091",
        "CD_D9B62293E0CF7F70397FCDCA72F7D1BB2ED8B6BE7CED434B3198B6A43C6930B1.2536.1903439117.1388",
        "CD_C811BCFC8FA021E0ED24EAF2AB4D586D8740EFE02D81CF2A5551BE06CCCF53EA.2746.524193467.355",
        "IL_A4D743825608F02BFBC68E93F5F3DD81CF79412D3A9ECC64F93FBB77D4727519.2721.4120571421.281",
        "SM_SetPersistentBinding",
        "CD_BC381B81B90336F98B1808B59D5F1A4026258C030F7F90F1CC12FB4A44D72477.2561.1192501527.660",
        "IL_4B9B47F6EDC52230392E08FC2CCAE01B11A54C85D80BFEBBC4538BEB865CB14C.2712.1584944247.296",
        "I_AB918DE70BD4F4D14A04227982C11B4D62C0D0FB3AAE79AA85D87600D071A687.1163.2072875178.189",
        "implemented",
        "IR_87FBBD5975CFEEE24A1C3398DD5EAF7BAF9BE214D71EE1C4D91AE8822E452B66",
        "C_64F4B56BA62AEA878667E6108D37F2CEACD96FEFA33698E5EA8E29A16F7965CD",
        "CD_4A805754DC4920C5CDF55FA12C65FB3FF31068A56F7569D69AC9CEBF6B6C724B.130.2489678700.616",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.1219.1946315906.3773",
        "CR_85779E8BAFE3789E38C6257CF29ACDF9D244A27016D22CDF8620CFDEE1A226EE",
        "C_14DF306943DC1B0E8585D5896D6D7F13ED3ADFC7A98396E8DD2C249991A63F81",
        "Win32_WIN32_TSSESSIONDIRECTORYSETTING_Prov",
        "C_BAF75302566D567EA01CB2EED45B5C1B4A6B65E2564A45EE8181990FD5703235",
        "C_C1960DB9FEC904EB68F599B564BB073D8CE89748EBA088D682E8904C932EBFE9",
        "CD_1D169410B8B805F1ECD27322AB7A731FC553836A8F92AC0D372B6B972CA98337.1734.564809371.475",
        "C_50478FEF0FA679E50347C8BAB55834F418A1E60E2411E2B1CF088F78A1275598",
        "R_39111DE6643E0CE135E3218054CABDAE5D22F63BCDD71E8E8F760C46C7306F9F",
        "C_25FE04D9255CB27C85849C6AF1510F628FE6A726CD3A80FEA1131E58085890F1",
        "CD_7BF884F7361F0D677A40C5CD7F9E2139AF67CB14ACDB2E9D39E3D5ADFB888E91.1687.1.15243",
        "8400093282D5A337A37681C23242",
        "C_BBB921103ACFB8CF67BE65ECAC36017334C498210BA85E0325F23ED68B750E59",
        "C_F8211248BEE93CB6B22893B4F81F4DBF19818CBE4BDF56935BF40E76E2E3C91A",
        "CD_734554B436D696983B7A89C30AB69B4CBFDD31A6E31EAB13C0DA848C2163A36D.276.395826302.204",
        "I_BC99FBB8543AB15A7C93ED5E5C2175864DD1023BAD5200EB323FA7FE87DF1BF0.2694.2580138976.263",
        "C_396FD3CB54728B5B7E193E8232D1A7853585BB3CAD758E58A36AD470D80A78E2",
        "CD_512A49E5E77AB2EF2262ECFFC535BC2D9589F81384D38E23194DFCE306ABF068.276.2126532537.385",
        "CD_D1F35069AB830308A3D10C95EC411D258E0A9CAA2EE0311B34E2874304803008.1080.1166877692.332",
        "I_5B0EEFF670B23DA1E99ED32344270F1441B2ED2C35FF6E06A821F3F443893C45.2724.2638166538.287",
        "MappingStrings",
        "C_CE52514EB297DA97E5DF5727E753E855973F6ECB94C0DC5B3C12AB6889CF9DDC",
        "C_90474CF00D4AF038E01AFFE1D325BE4CFECCFEC8C771DBEF31ED1256C9A59468",
        "C_7C983320414DFF8D2BA0128B25033C8FB169F5189449E13D88BE3724B6F2E9D3",
        "CIM_InstDeletion",
        "IL_E510D6A65DDB547829D88F3B6ED3A42F378FC95E94BA49A45FC6C413EDB510B2.2684.938546622.284",
        "24E2BC1C3C9AA54865F4",
        "I_3CD2DBCB6E1FE8937C7A78E928272F66CBB9872E3B999158006A3D5BBA4FCBB7.2725.4189518982.276",
        "C_5594A51ADFFCCA3EC367A4CE2DFCF20E3EBFDE91FB6ADD84404CCEBF1B0FF2E1",
        "89BBC39B370F76AE4A3294CBE6E51C.1149.1165349225.1350",
        "2.10.0",
        "CD_5597C27E02FB661B960574B3983CF61BDCACD05B86FE6132CA337B45B00B38D7.1927.482272701.264",
        "C_6BA401C18489F9562C67B286EE1D519BE8F87AD49C610AD4FF91FE5F1FFFB1E6",
        "I_77923D2173C879B95D49292840E68EC311AACF0FF2F7A2622A9190F156CB8302.2689.2775617555.284",
        "MSNdis_RSSEnabled",
        "CD_231C34EACA6E9E68FABB7AA3DADD079A379826158D2123254977F7CD79559E18.2743.2467929195.343",
        "704E2BC1C3C9AA54865F4",
        "CD_F4CCDC8609D32257535E7A999BF7C9477C973FD53B9B19B85FFD5EEE88F83086.1923.2950912890.319",
        "C_B187F2F8544C169FCEFF538082B4E8108913C60277D7DAD56180B4C1641F57A5",
        "CD_DC75EB8D61AF59F2FEB9BAFCC51C26F93B19442C9F5E9F7C071B8627E9152155.148.1453791392.333",
        "C_2F3BB7CF6B8E51A35C88F6CA3C55F4F164B1DD98C6F6BDCFFEEB67E81F67996A",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2484.660329875.368",
        "IL_422AC5740BC441E2FD05B199E0B4354FD92D7E874808CED04A499C3B7F800910.2720.3875001459.293",
        " $(,048<",
        "R_4A805754DC4920C5CDF55FA12C65FB3FF31068A56F7569D69AC9CEBF6B6C724B",
        "real32",
        "I_2148C5CCDAE3A05729A65B7635B15A13E90C53DE7125676C47659A15E6F19191.1520.4031734246.187",
        "CD_20C8A4313A9882D64219A6814548B8CA23AA20618BD06EA1320CC257373FA4D3.118.2690508606.1310",
        "CD_E25721B8F3713BDE1DA6576F61E5B33C530348FAC408D2449404B7FDA23E173A.2482.3133707011.1246",
        "!$'`*]-036c9<?BEHKNQfTWZi",
        "CD_23A50366135FBF364F350BC34F639BE141A61D21A478BB4C1230D838F1296A4E.1464.1880525890.684",
        "CD_EB5DF692E5695761F8BB75E5CAB5C2E64C9D570F7A2AE8F24E9823A6FAB0CA95.279.1353598711.435",
        "IL_FAE94FD79301135A232A3FB9B04423B61DF3B13B672B5017E2D69DB06590444E.2687.2440482473.274",
        "CD_FFF2AE454B5EBA423321420C962DDADA7E00808CE9D4E5B4FF81481A2E9CA1B6.150.575899349.639",
        "R_FD5A09758773146E01CAB43EAC38C6EEFB9A870C8F888B5F24F7E89AF0CC12B8",
        "CR_B5621FFEC1C8B1219D99E9EA2FFA370611A11F7916B9B95C226F3B8DBE0160A4",
        "CD_F34DE71B2CAA78B0B6E197AEC8F7CB5876472AEDE7848CCF66EF8194FE5EA5F3.2596.1874144368.200",
        "CD_6AD386ADF7788A35467E769D3EC3DE89211503B8A449E2B53EAB5B8CCD719DFD.2033.3606027292.245",
        "CD_05CA5F8E6EDC2C8D11BBB4DA46B36ED992C196304CC24289ACA10C9E37FCC545.2582.2699027757.397",
        "C_20A86FF9BCE2704D3211C5DF2F6EE611B397EFC650CD0CC8097C4D642C5980FF",
        " The SoftwareElementState indicates the state of a software element ",
        "CD_A08E07C4C18BB43F9FD19B5E02B121082F63046F918F76002425E185ED85C61F.2654.583714553.475",
        "CD_64F94F3450D7629325CA5169EB2D437E79C378BC4227DD614FBE4F965CC6B706.1193.1658827426.621",
        "C_3C1F1A447EC4276186A6706A3A49D07A2A316ACD6912E09A63348E2481FAEDAD",
        "CR_A4B7E1219FA76BD23A588641B4F3CEC1D9A3585F7F85B74432295927C547BE69",
        "C_C4D20EBDDE2AEA19F49E976724D1B5EF2ADE459383EA4FEFD237CCE02FF2D7AF",
        "I_095213B9C0D61229559381AB15B808F9B97CDDAAEAE8B87714A71305321F2FCD.2736.3968250487.287",
        "IL_8ED11B10BC4CF8DCBB5B34DE07D8FB0C32089DBABE4573BB4400D4C77C1BD2BD.2725.3184280915.273",
        "C_ADE497F7ADB52466B3BE933E20B36A79941262ED3793380A63DDC578ACBA1413",
        "CD_93A56FD79060DE7C5C63B9201FEC3583B30A043D5DCAC083E3F4C84A7931B27C.2426.1015895613.295",
        "jLXIUOvgday^m",
        "RestrictedSitesZoneAllowLoadingOfXAMLFiles",
        "I_A25A9C1575C39A69ABB3AE94BCAB886A687888320036DB32E341222C291C7B0D.2680.251073678.278",
        "C_7A6AA51FA3C366E6824EA7F4B97566E3B04D858CCC46A0E172408E22570C1F7E",
        "I_C7196BA272BDBBF1E0981626A5DF813B76374942580B9B119EA757B4CEE06E84.2716.3348403050.288",
        "0|@t8d",
        "I_6F56C35F680A05850333701C0F0A9B7F8DB1521F3B378B0B3CD05788894E8D2D.2680.4274746755.289",
        "IL_F99CAFBFD1BEA9376C1ACAF25C7EB7A1DDD763523D5909A4E05974DFF2B28CAC.2723.3895327857.284",
        "CD_33CF99EE359367737EBFC91E6221019D46F7219044317527292271867795E5F8.2001.305454039.681",
        "C_DF254158609170F3BC50217B19B4567D41F9A680BDF34EBE27C6CD7C6462E17F",
        "I_CA3C3ED9EF301B6D5C3DCFAE47B846A91B2221D3C52CD175A447CF9C1571B5A8.2680.2618608820.274",
        "I_D95290D211FD2009C8136F6F0284F367384C72F689BDE191C0684C8714DEA096.2700.353544369.270",
        "C_3AA1CCF33D8CEFD2B415A45A121A40E7E45802CD4F254AAE61989F4AA8DC738A",
        "RPC Server Fault Error",
        "C_0D4A09511C06326D5D345B08A0B467BA70A695848B2E0A8AE92A1F33516CC3D6",
        "CD_3B2DEB628DABE7D4AFE58BCCA12E2FE850BD8110A3238C161DF85D5C51FAC297.2596.387130656.198",
        "CD_090E16074BB67F3962D2476389965FF428C90DFE4808D1C0AFCA9634C068662A.32.3252408006.468",
        "CD_9FFC730BEA787E28FF305A66FE71BC4BDA5863470D337AF3119C48B654F08702.1747.2468415157.948",
        "CD_5652DF4B99BD8BBF66A57878F7DCA92E59A0F6271A501161B97B1009D0D4EA8A.1959.3579446649.2568",
        "C_8266AF202DDED4D8ACC1F156FF4A630B98F3A46071CCA388BE5FB0D13AB20A5A",
        "CD_A9FE98FE5C3E9051AEEC71D48BD2011F883E1553AA2DD7968A20C510AD60108F.290.1643593462.202",
        "C_E168D377E3EBDC80567E91D3F17E5FB581443E43A2B4D4956F85A552763C3781",
        "CD_FB13906D346FD1937AEB762793605AF720F07CC036588017ACD7E44E97A28121.123.2750121858.429",
        "CD_33DCEF5A25E042E234D6018C36A73BB8BD2E0A0D570AA0A57D43D363A2232E3B.2201.1.15005",
        "I_84DAE394D72EEC44948504C5752A6FB488C2F34AF0DDE614A4D6BA8E4EF41579.1105.3603858765.242",
        "Descri",
        "CD_31682C5C22F201C41AC25516223A172B2BE8829C78A0BC224059702D9FA339D4.1070.1740563288.258",
        "I_27A5F55969F399258DABEC66185273B3A79C6F5B28D419172D1B5DBF7E05F091.2703.3713488866.295",
        "I_33D2D0FAA61EA917D75180BEBF7BA2086B1F142C34CC9F16504D75FB6B1E5F10.2727.1935833115.291",
        "I_F687A4A66325C494A9BA0BAE662823BF35F4127E843231479C4041FB2F369BB4.2673.4270551484.276",
        "AvailableCapacity",
        "I_BEBE3BE0B1AF43DDE4D65ED028A12909D01BD89CA2B3EB8E387C308BA66E0111.2704.2511378584.286",
        "C_1992DF472DE2CF4F69E851A4667C5DB5DC597E55137C5429FEF698AB76A58E58",
        "IR_1759FA689EF85045FCF1654275E53C4D9455D7E6C9FCAB0FA67AACCEADBB9360",
        "I_C77EC9EA8B8902E96084BCBBC6CFA3194ED743B2A0B74119D5F06AABA12F9A48.2695.3889254792.265",
        "CR_77DBF4A2C876542515BB91822C77D6AAB627C74A2589D8CBC4096845BC539307",
        "I_14430B95AE3D7796FD7FACB42945EA90FDDDAC2E5B8D63361516A1B086DAF03E.2692.3693569604.279",
        "CD_1FF3E8B084EF958D6CA51930B35BA398A9AA3DBAED426E535ABE1FF42F771AC3.2758.3603963425.298",
        "C_E540585DCA2960F60394B8EF9EDC432CF6F41DA95FE565F23D6AD3E1AFE40536",
        "CD_B2C9C24AF9AD18C51D1616B107CC0D5F87B040D09EC9AC43F2721AC9F9AEA790.1195.577858564.1856",
        "CR_55BF0CC0F072F8672008BA2E217FC98D14173100D32640D32F61CC0295647162",
        "IL_3BE5A640A89AD29F589CAC254A6E30F3B039E3494990D439674937EA1CCEFF58.2695.1512814887.266",
        "I_7E60BB99C9E70FDD76067D08DBA0669228F9B8D665851FE8A00DD2F5355980E2.2727.3980492895.284",
        "CD_A95A48ADDAA5329765847F8DF03DCF18CBC9E5FA6B59EBCB8E1768298695D7C8.2732.1197879799.921",
        "C_0A8460FC46C2746BD21F545AC61155DB7CAC54BE761314A2A7E02864EFA1BFE6",
        "I_D03605E5BD6E14567B3187E00BB6C4B414BFD64A6CC37B3EE753B7431698B0A8.1015.144238205.307",
        "638861EA3A6A2E0C806211E",
        "TP_V2_TimerSetNtTimer",
        "!$'*-0369<?BEHKNQTWZ]`cfilo",
        "CD_12C8B809AE9CE5F53FFB63FC457B4D2DCB7488DD14E84D1D82A5FA5D35BEFF46.2626.4073583792.118",
        "C_BB1864ED13E60C22074D25C584FF59AF554CE92715925E31CED372950D2F6DF6",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.454126105.368",
        "C_75840B9867302C265945D054719AA22E26645943E0473183701AB28A355B5161",
        "CD_DCC2AE997AB356670D27AB6AF0A0DF5B38BE28906D897D91C86FB38CED159D17.1667.2814445947.376",
        "I_B4EB07FA921CA26FDA5DD37286ADFAB5A10E29C92C79A7666A196E633C150C77.2696.3303322735.275",
        "C_9B6218EFA94C067C7A0C80C5056C3D58C66F39DA9385FB7012B7F51EB8C27ACA",
        "I_F4C141EF54CBABD5685CF26F77105864507DE5B5D5FD07984D472381A8A94C0C.2709.3388265455.286",
        "C_BB643341D226A49E491A828FD60D1BF2BD90CDEABA005283886D93DE233001D8",
        "InterfaceTypes",
        "CD_99ECCFA08F1936CA8BEACA1D5B448FCFE9E2EFA426F4813F0AAD60F2EDD7E7BF.122.1132787691.448",
        "Consortium for Service Innovation",
        "I_4DA8960F71AFDAD53FF434DA8B4C754558DB76E9770FFFE7A355A95C8B4C2308.2708.2460764943.293",
        "ref:Win32_Volume",
        "RSOP Precedence",
        "CD_1E73C355FB885E2163DC95C015545482A2598C9FF194EA43A47495D556BA0B0B.2225.2440627297.1213",
        "R_8A3B6432A229F674039F0136B188BB0F847AE08B53B1611977C2FC30461CBDDC",
        "CD_E9D1340FA30260FE6DC9A13A7C426F447F5CFE8119285A157042BB8CB324B46E.2095.1.15659",
        "$(,048<@",
        "C_0F59D6E36EE91F95CBBA9055883AE888A75516D346E877D86D746008B369F28D",
        "CD_358EA9FC3ED4190A2370A8EC86B7836AA3C33AB96B1DFE8CADC56BC95FCF2EB3.2542.501061575.506",
        "R_1F1219F96576A4588331D02100737379E76B59AFFFE01B2EACFBBB0DBCD4C75C",
        "C_05D86307E67356113E9CFAD910D75E9BFE23BB951797AF2481B14C2508E361D6",
        "CD_D0FCA61461F580F5651E9E9219AB1FF74BEE4671D57E3148B30C5A652AC89945.2387.2595096870.668",
        "CD_1B55B55FA6B082DE82471ED3376542A1505C8C97D1118986FF01EC622C5CF23B.32.537794177.502",
        "R_60B2C39E9389EC16D58497FA8BDBAF35697A8853CDA423F037ECBE4502882230",
        "CD_7362E8F68732AA5E821EC10EE1BECFA5EBEB33CEDC9F406248A6EF25071BCC2C.263.2228090370.677",
        "IL_C564EC44991B06EFA52E4258369D8DC85EF34970063BC38CA76DECA10C7EB99B.2726.4244474160.275",
        "I_9F80F910AC148AB66C6A0BF6827B05CD5CB15FE857614CAE5256A3E2FB1A94E5.2692.241722655.276",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.286.1124162071.188",
        "C_75A8E9BDDDA51B5D1D891C00799220E5C1C3A6CF1F951600FBF99252804E2F0C",
        "CD_48D4F256702BE1E23719E035364C5226D32D66BD4161C39CF31B8494F0ADE28B.1079.3489055264.4110",
        "IL_888C6EE3954559B72290471372E0D995703D38B5D600D88F2D8BC8ECF4213530.2690.24045274.260",
        "R_E42EBC36C8E0E69F5D595CF49B1FA7DFB171F62B143A7107D5F7ABB6378134D6.1462.1667434359.566",
        "Win32_PowerSettingDataIndexInPlan",
        "CD_378C3B019BA81FF898F9BF06FF0AC5FC705DA51C0F56DBDDF9AC986BBEE3099E.39.473180146.509",
        "CD_BB619AE3C8D0F42D2AF727F154ED7AA95E3218758A94B90834E9DD4C130B6BE8.1231.3472786680.626",
        "I_241D9EDB5F67806D5261A757B5DC41BAD706546D3F8979AEF6762CCEB52FD683.286.296581747.317",
        "I_8ECEB18F5D5956ADBB92C60B6BBF657386F0BE596CEC9435AABD185EAE1B6B42.1352.3758887347.256",
        "I_0A99BE060E23FF6761359B992B74BD229BF1DDB4BA0B1CEB20D3B086485592FC.2702.4240166095.285",
        "CD_AA9C61DD6F708369D775774E2B0242CC044244C6152DD57BFFA159C58FB426FA.2553.661680779.1605",
        "C_9523EA3FC3599ACD240F830E8AF95EA7460902FA81374A4C7BBD754E74F49B88",
        "C_E6F405501CF9EB51604EF826550E0336D9FF9DAB805C48FA3ECE279D5B21648A",
        "C_849BB872FA48C9D9F0979EF051B133EED262AD47FF263C164F3A538EED0B65F3",
        "CD_5C5600928D4B93C76DBBB24FC0A97811ACE9C8DF588CD0E628437C53F9478BA9.1930.2142137593.288",
        "CD_67A6325E4B89A415675C3078139F66B22674A436284739E0AAD968F4582CB8ED.2557.3000467630.508",
        "IL_20B6439E3DEC4CEB76B09FEBCD3B770F8B7A551B618CF8502C758D605929F000.2706.3670207048.294",
        "C_C3440650E548BFF63B5539FA293CA94632CF3A6097074784DC3E6A84D3E44079",
        "CD_4BB71B6ADFF06C586A8BDF449E468900F2E5FA784A24501C7DD0806A9C51B570.1464.3207785886.441",
        "I_BA7745C2ED7DA83CB930E3AEFF818AD8286EDF65355759102555F063E18D13B8.1714.3776607028.185",
        "C_20BDCD5FC76289684890138F1E0F84424ECAE89F8B991F35AE342CA8A7F45BC7",
        "C_95487A06B6D41CBAC8C790C1E5D3A7A9702ECA29D2D457476B3523514626C542",
        "I_85B4AD3F0FD1698C2E245E49DBEAFE6FD440BA2E76BA5385AFD33DC433920AAA.2703.2731508834.279",
        "CD_DA27E09378E35C0833E59996C9DD5DEC44383839BF113C4A0095F73202238CD7.1163.356763914.832",
        "CR_1DC2241284EFF53B894548A43C065A88DE07D18C8E76DF7E050932758E817728",
        "CD_8390A92B686E2E10DEC51624CF7D9A9B36CA99C04138C2088DBC0519EB26D47A.1094.4129810410.1102",
        "C_8BF7316094E8A80DC0D7725F4A2CC6D98B4E58683C02D8C287671872E3109F47",
        " permission management.",
        "I_BE23A6336F257D5D38EE27A885DD47EC96FDAAA56D32DD4A418B58725224E953.2735.2570573003.278",
        "I_C88CFE3EC418CD56F628ABCC68CD4E30B918C0167CDDC43AC92FC5222BBFA7FE.2715.101330324.282",
        "The protocol/port filter applied to the rule.",
        "IL_26E03A9CD28DCA2B27D411BB6E709A37FE1343F5951BDA6FD8A5625ED37BA0A9.2724.3503486538.288",
        "I_943FB043D19DF8236449807C77494980CD7C694AC533B5FE86CB655A23D50A9E.2696.1929810549.273",
        "CD_60C5D6136B9E1946BE8FF2F55F1989E489219A67C731A9E9CC7487E5EC74E5F1.2543.3777591395.496",
        "CD_F31884BFB479ECDC8FA0C6525BD2E05B732CCD07D844062B2D8F0B23B81A2F45.1.4164975150.161",
        "CD_EAB06445AE40CB0AB3321BBA04962C98586E49396B67AFD5B74F4985163D9EC2.37.168300490.464",
        "C_DA27E09378E35C0833E59996C9DD5DEC44383839BF113C4A0095F73202238CD7",
        "C_4FC7350D0697D65B1585376855E9596964780B95A8CAA540BF3CC2CD97C19696",
        "CD_C10127CB37EFA86B80555A592A878FAB68964568F8B1F59089071948353A3BF3.2051.2293644449.1203",
        "C_9D13D81A0232A3B9A054E304F017E99ED70EE31D77185E5048D602C8F68F1D2C",
        "X\\Hlptx(",
        "C_8C54282921690EF2BC9511BEAED7C3917ACF17676D66B514A1B2415EA6A9EF57",
        "CD_2E01D6AE66069E61FE9FBEB254EE45B257107A95EB7A55FBD179811B508038C6.1955.292812547.2015",
        "I_251DF572EC65B42D6CE95DB4C839FD6728CEC6633EF525F0041081BB60681183.2764.3651258659.284",
        "CR_3C7F00744A118738B0F07DC8C0576BC0E9D6C8254424A8F90C2292912ED03907",
        "IL_A8BC9FB28AE536629F0C3F24CCFF3FD727EF91A331918572457F22C8A4B50211.2675.870928241.288",
        "IL_298D41DD8E2343803FBE0777F09D55740EC92641386C4C2EDDFE4A658D320193.2694.1096984007.279",
        "The error message format version",
        "CD_F145A6FDA9DDA8FE3479DACF04486517A38EE43E84A8A1C9E4CED735C9CE24FD.2588.2168346593.1772",
        "A persistent binding request included a bad or unlocatable FCP Target FCID",
        "C_08D881D450D0615D55EC2939B63E533A7629C39B5BF81A337BC629700DA3A69D",
        "CD_559C5EF519C1325645DA42E84C00BB0A8E3127E1C2CAD3C6D3C28A084C0B62C1.2115.1156813172.516",
        "IL_6BDE383A2AC83049E53DFC50229634C12F4CF7DD75008C8EA0EBE3B11A53311A.2722.1704207287.273",
        "CD_C32DF9F947B29FF4184A098E1939B4BC6F452D2B88C38983D24946818DE6DD9B.1689.1389694788.265",
        "I_B5810739ECA3FA6E58C813A7E51844E977B2343C263C8642483F55EEB9730A66.1617.1386415659.338",
        "CD_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251.297.580066819.1247",
        "C_66987DC488F04E3DC6BA6B1845D5EB313904DDD6D9EA97184EA6AED23E5B39CA",
        "IL_7BEB918E7FAA67D6D742244360485A978EF25007530E0D04055CC08887CA2263.2698.1879792984.264",
        "TraceCreateClose Flag",
        "C_65AD9D71C7F4EC93858B91DB3439405127306083D38D59BB8579B4F63675934C",
        "CD_ED63447AC10EFFD570567110ECFD7E57B65338C366F9DC0975F468A0220F367B.71.1079732042.287",
        "C_B621516DFDE9B6E0B0023289F774341B5AB73BBA9615079DB6C60B9EDFB63DE9",
        "I_A17BA0E1DCC388EA3B476E531DCE09878B9549570A64500839E307835DEDF8D3.2728.956016752.293",
        "C_48C8FF9D3F57E7744A3D1C2C52E57FC97BA717E184730EB1BDE77718DB3C9C93",
        "C_3205C234B2D5F02B734949988492FBCD94159F50911E0F44A000D975CE1C5819",
        "C_41B7AA8AC52906BD0F9EB940AD635202AF89B38F24F2BF12D2C0A98B1014B8D9",
        "IL_9B6ED9BA5FA5C4E077E105FA66727DEDD18446BA6FFD49E7BA14D0E3188DEC86.2693.2140003252.269",
        "IL_E290038AC529273609B709C9E61AFC8C65BC1EDEA28CE62D6879FA77303E3286.2716.1376619670.284",
        "IL_756ABC64F7087CDDE280E01A5A1F8FD6563EAF29B113CC49FD1D77475F8FCD85.2692.375602145.267",
        "IL_0C2827B0B19FF43CDB1184DD854CE1642571144637667019B118E6D6C5135F76.2700.3324796765.275",
        "CD_41C5F66D28A54B11831E9923AC9C75B6E565CD4B23788137E12DA876D6CFE78C.2196.2793323259.676",
        "CD_B8B4905F90700DF9ED4B891C0012569544A0582CBC77B58905D3AC53EF089A50.1779.678596781.306",
        "CD_7452F14093AA45A6FA141E92387672987578A9B50AFBD7A89E994756201A5879.2596.2801983433.203",
        "CD_166E9EA255BB08C445A06F8AB910D4091FF468572C57F60EA885C78873FD91FA.1667.1961730104.247",
        "coQ`BKT",
        "CR_CDE4A8C7C0B03EC0C311F78F07CE34C050F510D55C1F5373A349277F064EB193",
        "CD_BFD544BFFEEFF1AD50632026F36408799745C79BFE34289070862E1BDE56BDE0.2572.1681809930.1750",
        "R_6F8534BE9358761BE9892FA6E80551515D0315909094BA1E820F03CED7A974E1.76.1926248702.518",
        "CD_0A70694BBDE45FE716DBDD82139D079800EE031CE266D9AC5DACE5E061A86710.1961.1457498487.262",
        "NetBSD",
        "CD_2A4F98E46770D35357CEB6ADA3489C9F0FD306040FCD6B065CED71BECBE5700A.27.3354561968.395",
        "344BB47D2E2EC35EEBC7E9ECDD67B034B53206A.1154.368612296.1288",
        "I_CA7CE6FFAF43B56926F209A331362CC194ADC07878E9BCCA1137E8869300AA67.1934.2742554124.269",
        "C_A32ED3FB3CFDAAEBC2DED4EED7D1FF0A45801F8552173833B24960BDB076B896",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2426.3987616337.404",
        "CD_BFE9186C8BADCB7FB42B3434B982F9192C73CCAE78C6F51F4DAAC7017A7F6310.2651.2263512116.580",
        "I_E69A15A73E68094F3BAFF3B57112997F0097D6B8B0EE4D5DA4252A3EF3040265.2698.3843099332.264",
        "IL_903CD9CC70691CBCE7B3CD663E4D38DA3D203A8C74FE018A97CF9FDC9B12BA21.2712.1932332857.270",
        "C_5B2556AB9E26BA57F6C3EDFE9DDB3CD3C905F536AEA737972265B4CB89473B27",
        "CD_5F6A26DF07A5DA70632EF719A83E3D129886AB8FE61A12C90B97B5CED67CAA50.2540.3281563829.508",
        "CD_5BB891E2FE9829BEB02F7F2E784E8DD7DEE84D71695BCC32B51831C5C8733CB3.2558.3009196814.702",
        "CD_3C21EBC7E003A635BAE21770A6D11C40E030D2F9610573370AF54F36021D4013.2661.1822792197.832",
        "RestrictedSitesZoneAllowNETFrameworkReliantComponents",
        "IL_734CDBB0A96C4D756A7CF7167930A1D2F245EC20E3EC71E3463DDB83E8979E59.2696.1604875047.269",
        "CD_FBD11BA7DCC0C416362AC2A1F8EEFD82230A37B2505B7C99363ED198FE2F89CA.25.772787412.2139",
        "SDBUS_DEBUG_EVT_HANDLING",
        "CIMV2",
        "CD_9C256CE37E6F9177BC0EC95344373747E0112D20D664373933986EE480BE67C9.298.1385547623.1046",
        "CD_9FF3B8277CB0A08E39C226B2DFED0B409E028660D30214AD93EC8C84BCD48618.1912.1.16444",
        "CD_1414268BF3C6238A6AD001B5A24A141E87C99B65D66BDC84E11131854913C45C.1049.377039684.380",
        "IL_B8C33F190EAFB29D36FABE6814AE0585A5A0E54FB864FF9E1C19C9732CC65F5E.1607.2114746688.322",
        "CD_70ED15AE36076B03FB84A9185347E7ABB659938D476877C2CE101581262809EB.1583.2540985915.499",
        "CD_8E8BBE32398A61BB41BAE9F60F150534B4CF02BF80975023BEB14B7EC8CB91E5.2570.139215979.220",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.1050.250850705.188",
        "CR_9FAFCCC688F5A73C3B168A2E3CFB29D7012E555844D21034E40221A532E99A1D",
        "I_B88E1F7ACDC8EC9FCDAB0EC7AF8C88A72F415618920EFDEF98AD2039CA54B80F.2675.3175571880.289",
        "I_2E80276538AA4A00A260C41CEC3C415479FEE58B25FBF5430F9809C7471D7E0F.2690.1128273457.266",
        "CD_A7B0349AD657C1DDCBB62F9F53A71C1F57831A151408243EEAC27D9D9F039F6E.1983.1632230123.474",
        "CD_CE727832ACA71A76A7C4BA18B784DCE93A436565AC691EE960FF2B3DBDFA7C74.2666.2625109676.474",
        "X@8$4",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1196.579707988.368",
        "CD_B28F765A30E9887FBA98C50D7C3C3EF6B7654C644B95A8EBD4DFB2D6B05FD21F.1598.486238363.421",
        "C_A878A140713AE6F3DAF726328634813CF09F03A9B90CAB552852A00359F1A8C3",
        "C_C5A9EEE4A4647089107EE2012B78461F48968B72655A54C15964BF9945E54FF0",
        "C_D87231A9E7FFCDDF076DE278798260F301CAAE96DDA814464055E4E89E40C9AC",
        "CD_3EA73D2E00ED14D42FAC9F0BEBFB30940E80D92636BD2423331E14FAA19796EF.1340.439589627.1976",
        "Locale",
        "InstallState",
        "IR_AC0D055AE7600C2FC6AB7B3493AB0844B90905ABE7702F6A368CE617E7383919",
        "CD_4E05A85C7C9DB6824A0AEFA83C9B26B28AFA6D8D088521A8F0444E981BA3B980.2420.3584027284.354",
        "CD_512BD8C9F96EB955A49B938966FD525EE21A051EF82DE0FACC89259643B42F44.2512.1489323579.843",
        "C_4C5229B4915A098FA9E249BF643245728F52EEA4263D760742E82296F3E1B97E",
        "CI_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170",
        "C_7F6D7AB071C5599637F51EC5AFFAE51440877864BBF7579093A40694E069604E",
        "A persistent binding remove request included a binding which did not match a binding established by the specified port",
        "IL_9571D0AB746041975C847A333AD27B56C8C3DB0FC60C7F37837770A120246D3E.2727.997820874.291",
        "IL_A0645C5482C6C0990FF3D834DE810EE73DD1C560AC29409CF0FE88CEBDDB1D73.311.2804001211.249",
        "R_20FFE90491DD6EB0496111131EA1C7328480BC1065468AD9C6801937D3CF87A4",
        "CD_6848AE51A98A2B17FB898D6D0191CAAF3F4DD71444D2EA05FC34F19E3A2898C8.2652.988530805.254",
        "C_2A112266506173779E6485F94910F63ED293C987DD4727C603E3F53E6471F5B6",
        "R_8BF7316094E8A80DC0D7725F4A2CC6D98B4E58683C02D8C287671872E3109F47",
        "I_818BF5D5A4B86BD81E9ACB61C5E2EB7433E3092F4BA7D7D3B8EB84A0B71A4A38.2725.3997208432.286",
        "I_03F5649201FD452B0914A7C2ABB834EB3774DB65ACE24E9A57AE71F5B3E8D405.872.1.88433",
        "IL_AF9342E98D42AF93D6B6DE01168D36238A3AA5B6BE6AF5714A68580A93B2B964.2695.3085137077.273",
        "The storage provider cannot connect to the storage subsystem.",
        "SetOrExpireKTimer2",
        "IL_31DF4EB9833FE7191FD0F7C979A0B9B475D79DB49D23352A744167E60A34460B.2677.714431772.273",
        "CD_2B88F31612D07208335917632CBA42B5144EFFDFF3C42A0D46D364832769C7A2.2020.205189008.213",
        "IL_59D0AEE642D9709B39F50D5304D4D67486F582F790451EA1C7FE83A67D66195C.1097.2986375514.197",
        "I_56F845D6409BD980A1AC76C4045B0E569E439E11A2FC0BA3128DFADC978A6218.2714.1216230439.293",
        "IL_46460DDCC6C58F82F604447DF749C6E1C766A6E184552714DEEF450466CD1203.2719.202377602.274",
        "CD_36D01CEB8615511941615255EBA663CB732C23C4C7195BE6D3932961390218DC.2604.1635538661.951",
        "C_147F0D132856028790BD82BB481BC269758A25AA87CD8C1E0071C39359DE0C51",
        "C_5C8731DFA7B62375F729E30B13DBD95B5FB295782D16E78D50C89099570DA8EC",
        "IL_853B8DF86013EF9E50A10116D68422B73AC0D9586E4DD5313DA8D6A7948E320C.2716.1901174011.284",
        ";H+3@",
        "I_49314AB51FE3B6A500373EC6B50D9C3B86481EAAEF87D2760A740165310CD37F.313.2500316528.332",
        "CD_8844ED1C40CA4036CEF6C65352A66AFC804D998655B7EF864AD1A292AE8AE43C.2530.1179018702.608",
        "I_DC45FBF4973498F885F2C82E6642F5FCD5B512BCFDEB2829F125921B46E2B87D.2682.961561144.287",
        "CR_BA3D37D044C0551633D73D3A898C87E3F05ED306B67D594AC8B13EE30AE518F4",
        "TP_V2_TimerSet",
        "CD_30C53A78E5A4B68CCA584E17EF756F46F9A296CE6092725A408D68B59BB13207.33.1522971017.538",
        "IL_CB9763CADFAE461DFE976536B62DC6599EB9A4BFDCF34872007002B0B9896A3A.295.73609405.308",
        "C_245A60CB3C83282C66619417FDBED882D5813DD3587BF8C3DB855021F3BF28C1",
        "CD_B4CEAF94B822AD611E7B2E59F1B57C548C02F9BE67DEEAAF6627B43E4D72BFE9.1563.66945715.432",
        "CR_8950808B8A2EB8D5AE895F8D253EC27AA46290C0D9FCF34907198A4AB3C923D1",
        "C_6A23F044A3652D7FC71AC14411C94E256DCCF9AC4805A4A211FBC6A5B34872FD",
        "C_57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "IL_1275BE448083C5AAB33DAF19956853ED9EA842E05F94D0AD39A63BA94DDA43EA.1020.3298090352.330",
        "CD_18F346BD214F217E447A1FFE3109B06E13553A39E553F4F4B66A2D5285DF9EF5.2088.3958427728.7338",
        "CD_656CBCD78DC3BDBCFB58D6DE3DB4D810E2F34DFAE48DDA4A1B5D5CE93FB860E1.102.1872648435.3723",
        "C_1E9D769216F5F64948BC57944D9242020C6E241FF162F83F13C4D2C6777D0477",
        "CD_3CFCAB1516C75164A42E3401D0ADF64A4765F50E4818FC30D95B8671DE07D069.2739.2601756001.655",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.2426.1486326943.122",
        "CD_009060D2904B4B02AF55083DEF7BC672283599AF1BEDA6D3B9EC703CB3D5B011.38.1728723065.472",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2005.3626810818.188",
        "CD_50530290676AC8CF340FAE4BC0BBEEBDE7BE27779D2C4E649BD254FF729B67B1.1600.490815657.1329",
        "CR_E6555E0E3A2A0EB36147D0BA2B88FF99C450AC95610E6A4CA8EA619881318FDC",
        "CD_C80F6E9FDDA5B4FCB7E91E04A37B343ACE2C1B4C4C7D997B61E1037420FC6413.1997.3508410832.1403",
        "IL_AF6887ABF3C2B4A743A4EEEEFAB87EEBCE0C92311CF3924640F5CF4750FD3A90.2677.2921058226.281",
        "CD_03CFFCC6C1542E35804D1F6A5B36702D2553306CC4D7F61D8BAD38DB9237934A.2731.4031275355.1014",
        "I_291659B3341C7316B94618FCB72FC9B61FE3DF51D04FA1C54F4C39AF0003B4FE.2719.617516543.280",
        "CD_B34654FD886C899A98B32211E3BFE4436030D29559C7BED49C8FA0B0A67FE9A5.2560.2532601051.1477",
        "CD_B000D7C01C41DA9F495CA1E95B37B424DFDDCCE8C00003B846B2C7E67953BB12.1104.3565194292.1773",
        "5EA8F6AD6E40F7F06931702C098EF2.2546.1062893091.400",
        "I_A149399DE5D286F444C4B111636DFBC68048E4FDC5152AA24ED98EA642F0ABAF.2457.373749567.361",
        "CD_18844B622E692B354A4D328535B8F3AF7181D02C445E691E16C25BD8BD83D1D1.136.4129636970.2234",
        "B7FB42B3434B982F9192C73CCAE78C6F51F4DAAC7017A7F6310.2582.3982654710.537",
        "CD_8FC06777C7644BB6E532C5BFB40D2341249BD9B41054098B6ABCBB54057FFC4F.1499.3446965827.1894",
        "CR_BE504B709BC667DAE2240ADC0A88BDB48E5089FE47F6786E5F5AEB39C66F90BB",
        "CD_CB9DA8F818847880A98243AA481C84850316FD89209321940EA2299F955A3CBE.1248.1130243630.1072",
        "CD_31380B1CBE2DE48F4953061E943634793359C618E73F753682430004D4E36FB0.1389.4027667490.431",
        "C_5A62B2FBBE8E692A74ACE78F45E81589D0CCE75FDCFF3F82D5F7A55D83974573",
        "CD_9C6234A862ECB7785AEE1C8C46C69B53F75E4A1B191D9AE24604A07719AA0D8E.2151.892709955.598",
        " $(,048<@DHLPTX\\`dhlpt",
        "CR_6D6161E9DE1D589E6E575938236E83C58350CD080E8757AE76F262610E96B3E2",
        "R_8BC6339FCF5E7E877887AF33D8907FEF60BF3232B42D18741672CB93E5378C2F.1134.4208802927.536",
        "C_3F7D1945899799D2D40207E5AF573ECA3E160556FC8C2123E5A1AEABAFB3BFA1",
        "0x00000010",
        "CD_BEDF72E134298660523B4E81EF8162ADF7F5779BAA2B7F5A24367EC1E150C6BC.147.466564551.1141",
        "R_0B41DADA7265578085FABE671C02521DB2DADA8BDCAE2897CD4E9C1B5A49A883",
        "CD_52FA3652DE48FD253CE895AA1E0F7F7869B94D77DBBF33883D1DBCF38C65343A.1081.3769047163.998",
        "CD_794585FDD06377DA31EE3D3B03C0A57FC0568A677B53360CA94891C058706420.1335.2706625333.527",
        "I_D58E32C3D220BE041A516D1C8C5394D760C39CE1122D84E0A71CB104954E163D.2717.1184386440.286",
        "C_FF26EE1E822090646FAD145AA9A6AA2ADDD373CED2E3B2B3D92A588873B3BEC9",
        "CD_4B73D56414C32450B76C83F50259BEF1BF1973367F51A9AA685F527A570A98B1.1185.248449445.290",
        "CR_A2E68741BBB2869A917DDFD8C9DA73647EFA8AC0B63D90B82F4EE838A6078824",
        "000:000",
        "August",
        "I_4DCD7C303EF2C3A1FFF493AAC5237EFABE760C9594A5BFBE56EC9C3A9BB95285.2727.2458310269.279",
        "CD_BC1364958E3C7F9CA5ABA0C9A15549E0C0B0F96B96EE058473CACD93E1EABD27.1088.1259441278.1454",
        "IL_BA3932A3E8902A1C64D2E5C26C52275EC8733108168083325E5CAA3C29C1BAA4.2704.4120406804.292",
        "C_AC11DDCF9F71868BCCF23A662420DD51F76B4387A8230D6D41F7DBED8D2981ED",
        "CR_C0C025C38981E58EE50CB7BB4E4786CBA14FD933E638861EA3A6A2E0C806211E",
        "IL_660E9F9CD49DC2B89A3530BB5D346CD91B5D13ED4B0CD89DBA4EA77A9A199EC9.2688.1512115569.271",
        "CD_86E8A5569DCAE5B400BCD0BC7C48FFAE53C06283B9698944273225E1996E11CF.156.3578284779.460",
        "CD_F69D8029CE443505782739E5EA30F705BD18A050DBF4E379EF0B690D5B10D87B.2087.966010337.3142",
        "I_8BE4BA3DE2B97EDDD0002D9F480917D3167A50A92DE14A850BF8ABE1988C169F.2691.3528449310.262",
        "I_C1B039C6B15CB1268319C147066B90BAE1F5E0DA59EE23E8DFE59CEDEE8D5513.761.1.144923",
        "{0 = none, 1 = ACPI 1.0, 2 = ACPI 2.0",
        "C_A3898C5255A1EFC888BD4736DA5618029E926F25A2513285DA71F554B0D3C354",
        "CR_24BE268C5603D757BD8CCA53193660D8F104AD29F4F74D327C13832A44E7DF1F",
        "\"%(+.147:=@CFILORUX[^adgjmpw",
        "CR_39E75790979650C120BE778856591D7E59D2F85DDFBB3BFF1733B73153D5DC01",
        "CD_CA2DEF883D5A52A8BE2DAE3B94FCBFF61713E77D441FC5DCF3A0EE65D337969E.1924.630874189.270",
        "CD_020D216315EBE851D1E95EB38EBC3A47071878BADCF464608068D12F0A2A6B6D.2539.2528994836.492",
        "IL_1FBD6E3E8AAC9A5E67D7B33B5E6D55396EACF61AD9387460D6D6F48EAF33EBB8.2735.1845839956.264",
        "R_73AB2C44348A01E13C5063D68EF8BDE94E3E3724E6AEC9BBCAA1E2B765F4DB3C",
        "I_66C8A359E47F0D1B39D305A89E658F2EB641AC331B4DBF2447797A4211DB63B9.2688.59886864.269",
        "C_9927560F406539B360E8823467081055AD1699B2FD33F2E0AE285CAA17CE2D89",
        "X@D`tH",
        "I_BD8FF3D8C60C28F38413C5FBB301596E9B180C9779802E934B182C0749890D02.2684.3655826469.291",
        "CR_A53803A976BCA3FFB16063ACA85E663ADBA78B63EC0DAF8A23C68DAD672A3EF9",
        "CD_05C8462B4A570021DD79117F0A18597CFCABA57FA3361AE21ECBD780B8BC0A9B.2531.148590190.473",
        "CR_A0A150CA5213FD3CBDE2DB5507EB556997D615915D27644E5F01AB072F205064",
        "CR_D64B12C2A619E8EC9F45DCE9E49A35E068B0A85B0C1FC30DB6BB343CD56AC3E2",
        "IL_AACBAD46B3B003AE6D7031961E9FBBCD51DB26638F2E8966437CDE247F25A712.2697.3626520709.261",
        "IL_1A671C0E762995F8E9061178C1591B318A37CF6147DE1AD7F5C9591F6F8F3EAC.2490.2381767898.326",
        "CD_54659981D2A7D25BA2BC70E6D9F1B1BBCB5F9112DFE994824ED0B159271B07C5.1544.2448021625.1048",
        "I_92BAE843B96C58CEB795EC53CA0AB680149C4C2ECA5B0702E2A72C3100799E3C.2710.1022496498.284",
        "CD_98DDD343F1A3CCFCF53110E519D29143FCD35034C8FA337D26D77DD90382C3DC.2590.4270370255.584",
        "CD_CC0ACF58FA3646F311BC16A78942AC6DB48973323025BC27052C3593D5CE6061.1999.3122297759.1752",
        "C_B28F765A30E9887FBA98C50D7C3C3EF6B7654C644B95A8EBD4DFB2D6B05FD21F",
        "VolumeSize",
        "CD_48FFFAD3E6EE9C5FA0BA1D7594467C96859ABECB0A53743F5B16DC6E6794B305.1155.3328284428.319",
        "CD_35B1B65B914DF07FAC7860C3407AEAACB382311D5C7C7979B2E9A007C56D4FA3.73.3266986208.194",
        "I_CE6BAA8732DFD450A2519BBF2ABA9D35BC651D3178155CEE3AC5A90E699CE145.2710.138949027.299",
        "CD_B9B054F1BAAB1FF0776814C579C68A970C8AA6821C311B5425B204D4F9CB60E9.1921.157380962.265",
        "I_795FCF98959EEE649BCA1F7DF2A1D1BDC8F33065B05D9D940F64EABCEC875307.2721.1107037709.289",
        "I_A421F30BC3A95D5495EEB88D6FE95F8C3FB03B32347A190BF39FC7B7BB5983C2.2694.2594547402.269",
        "|,048<@",
        "I_E75CBCE90B4C0E20DAFFEEAAA1EC804BF8BA7DF9DDF2A9FB208487F0BEA7C47D.1501.1235489992.338",
        "I_7B322E154F0D9F7063787FDD12C121769CEBEE6D30BDB444B1AC6E6205CA882F.2685.2010765622.284",
        "C_4E6C5CF7BDDF4BABEF6FBAFC3D47828429231B287510F99ACF0B237A0FB44F50",
        "IL_90F33D88D8C922AB1DE48A3EC751DCAC9FCED8E53BCC7B3B50D78A88A7BBF41C.2676.1575665633.285",
        "I_64617594042CA950F4D2B027D9C36FDAA4961C42DD29E69907A0B9AFDD6540A4.2676.3631252620.274",
        "C_63A1FE81FBEC96DF829C5431EBEA9F1CBB9A0D22D4B1BBC01BCA21BBDA82E9B0",
        "CD_B18A79A265A485271ADF7583A11B74126B27D0421B9B453C88A99D39E80DF5B2.2744.642094114.314",
        "R_CEABB348101F3A162B018E537F4DC218F478C7767318D8F5F024245B19F1BC61",
        "C_3185D5C87B795C19200377606F945624F3779B631EE5626D7BE05E1CE6DB71A9",
        "VRNrz",
        "NS_5456CA76306BB18057C7C64D8BB2414E19DC9CF4F51E2760534CB23439D79B06",
        "CR_7362E8F68732AA5E821EC10EE1BECFA5EBEB33CEDC9F406248A6EF25071BCC2C",
        "CD_07158AC46AB23011D10296EB63960CC939E2922A1ADF31B09CD4B8579AFB85A4.2585.1260699617.383",
        "CD_0454DDDA9AB999B5E05A2F468BA888F0D0794E6BA1EBDCCF2A4463EC03258CC6.2739.1437315272.621",
        "NS_3D98EC37D63EBFB9210DB658120A818078461369A71EFFA3DDE47412F528D55E",
        "C_058481E893AB7D6D39E59758162E9CF10FB7EFFA94CB9FA8DDD3A0DB231178EC",
        "0x00000002",
        "TransitionOffline",
        "CD_F33D7C5F62C48A98254F1B0ADED8C5A8E56D1601D517CF44369F4A800E4AA9F6.2002.1107220837.666",
        "C_80675749A482112913F21FDBD7D7D7162BF42E8F9D4DFDC3F2A040FA1BE63D51",
        "C_8D853E1BDB26604596D79BD889DC19104FDC79558D9E85FED9A1E91AE19F5837",
        "DisableKTimer2",
        "C_FCA23D7E7FB2A6133938DE6DCBC133A13C9DBA9E399EC6CE05160880408CAB52",
        "CD_043F48AD48888B41BD56388FA26ECED8B66FE9C03EB10995414C716325CBFED3.1631.4242940539.4920",
        "CD_92D27F5AD057C6845E59D20A0204BA27D930223DAAF414F66CE86D4BED468D66.1188.937099601.490",
        "CD_C31EA868CB014D678DA84B98337697F37382F9A1219F5545B8C0F63812A2B18A.2659.3492638175.681",
        "CD_38BD5C5FBE64888D5B30C67C4333B4A6856A6BD1D71F9FA08E4958EA88393E70.1197.3934020250.953",
        "C_707EE99B189F38B22A202668F97D1506AB3E7D7110120E38ADE31DBAE193C07E",
        "C_CEABB348101F3A162B018E537F4DC218F478C7767318D8F5F024245B19F1BC61",
        "CD_5DCEADFA575A67B8870603880BD491602DCD3BD7BDE6B9896E3244EBC7BD1866.314.3758602078.230",
        "I_4CA07DFA9C307922F271E8FD10821CAD444F0C43296FA9D2FFF97657FB680115.2685.1793870385.283",
        "C_79CE5C3FFCFDB2E387AFB15F738C96DF562D23EEC0B9CE854EFF2796A5403198",
        "This is ETW schema root class",
        "CD_0359987C58272876B4E70E901F284C82B892B0C1E02B693AD3548D264D28EC8A.130.1306541213.684",
        "C_C28A33C3EE15539FED60F709568673A3B8236EB3328C61F785107F8EA0BD78C2",
        "CD_4A9BADBF619D7C360E2E222A1D05EF4C32E9769C9232CA2631F4E74AC78597AC.2418.1359966946.679",
        "I_0127A7661BBBCD4388742549D522C2574BE39C7911E6AAABA36EFEEDB5CEC716.2706.1804986656.291",
        "CD_E091E6755173CEDA0C35AF424854DECB26CF90627B78F06DB8E87E6ED8C5E2E3.1951.990157689.498",
        "CD_4BAA21648FDB845BC99AC457B05278DDADF6666FEF0E8ACFB4E6AF8CB185DBE3.1152.1914177049.589",
        "CD_2E2ADCBD19607186F27031CE141175DAAF2CD1B603A1D58D1343B81BBA815149.2606.318319731.260",
        "CD_DCD7C1FCC05FDA8882A741091C884485FA94218566ED7A15A2356A202938112C.2582.1494929043.498",
        "C_ED710A61D9AC2E438DB06651517829A340B6E4F36DF7F8B4400C0B4598195DEC",
        "CD_B61336F486B4EBD99224D810D7A531385DFBF6EBF9CCD5ED509E655926A6E528.2623.2019694393.585",
        "R_090E16074BB67F3962D2476389965FF428C90DFE4808D1C0AFCA9634C068662A",
        "C_353ED06D06D3F543C1F82745622C061EF12A64D07607F4A41BBE9C01357C9257",
        "IL_50D24FCB691FEC565B060B5A0A3BDFF05F60CD093BE85253F2969984B4D2665B.2719.1589407007.272",
        "Power consumption",
        "CD_3C21EBC7E003A635BAE21770A6D11C40E030D2F9610573370AF54F36021D4013.2591.566378622.808",
        "952138C984CF58C87BDA12F14B85644C3D9BFE8E192BBBA791425FA27B18EDC.2590.190305557.863",
        "CD_8242B0E214D0E59F97469A9B5B2211B7EE2FB9D2E262E35A344F292EDBDEC228.1974.1.13798",
        "C_C40F396205A3C460159757C7C4372462627467759E48BE4FA913571C84ED93B6",
        "CD_DE5401B6E43B578E2EFB53DA6E566DA26347625121707C9D1C476F9131518ABE.2163.1651406874.883",
        "CD_6F93E3C20E769A2E31A47F868595D90BB20911F83ED119FD74983B46CBD844BA.2557.1522698186.510",
        "C_18C99EAE3E173ED0B31AC919DF58868EF1E98C5CFA9C2E4C63224AF978397526",
        "C_965094A9801CDE7688007D8DC8207F7F647D8A711F384671B42F954898C8A20A",
        "CD_2F161E4DB37A4CE0D5920746A9A882B489818A0778EB5940DDB59903217A60CC.1935.1186507803.4519",
        "\\$0`Lt",
        "I_DAF6B4E03CF354E5F2AA46D8E4E98473E55E90B25796E1CF993693CB2C847039.2469.1061636834.190",
        " I$E(,0",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.287.2897653058.368",
        "CD_224B5CC2DC8F3AC1441E2D19046B5D0473DC87327FB7FEADFB35C0CF4DD98702.2558.2479422108.684",
        "CD_D8FA39278C1247AB8B1FBB10D8F82DA6DF57FDCA81312F4541EF472290E1F3B0.1736.77039531.508",
        "CD_186915C028DB302F51311CBCC5A8139806C4A3DD8133E0744A122DF58FD5C571.2602.4198066975.281",
        "IL_27774A386EB7F19A1428718B458A0927E72BE61C2BA034E680D3B1C1DA38CD91.2677.1925379987.282",
        "C_13D55C842CDBA0C119A52B652E2B026F106F2E9BE68DD61A338E909E5F70C55C",
        "CR_311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        "C_F18B3A507112161BF62B88964CB56177DEDC15DBCF23B36584CEE511D5EC710F",
        "CD_18A46D7BB56A85A77A8B14FC7C4A83D15E2F885E67C71399BAA10EFBE87C920E.2196.3257783360.211",
        "CD_774C74FA0A64054619A74652957611F8C7CFE26091C21F7EA4D686C4D60816A9.1286.1.42963",
        "CD_BDBD703370774239BEBC1E94F2B0692B813E092749792A1A6C53E05A6BEA0158.1575.560602642.410",
        "Options 3",
        "C_B4C1D5CA2F445738E1D1E9A535B6C314D6AD1127F6B87994EA756B275A939A08",
        "IL_8BF49677C4E4143B2BB256C6F253414E9CFC4061F2706AEB8C8E966D04CCB2F1.2684.3250922380.290",
        "CD_D44A4A9B6EB12262C34473FD933C61624EB28DF04EEE947CFBDC46BC16EC2BA3.1602.2767128589.540",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1075.2139482593.332",
        "C_62C9F140909076218EE5278EA8A962B5322866C7B9FEC741FAFB594868A887A9",
        "C_B7D88CBAAF2C338213E1E72001B6814092CBE165351937E6CEF7D675A2947B58",
        "NS_A795D8845709332607DFFBB7F002DE04E0997E409BE31D5BA9FF05A1F3FC9068",
        "CR_444A7A3BAC32F6DC8230C2D59CC5C5F4CF794CBBFE30EF01834E74555D738F83",
        "04FCD.1465.3232810636.587",
        "CD_1AF8551C42A0C4EC8EE76C1BB09B2DA1F658691D78A8F23A9542567B67EB474A.1983.32061222.738",
        "CR_3C9B280FE36066C71935582444208E7A035DCCE4FA30F0C0FD2BD6D3FC96AE2A",
        "IL_0CB77DC4DB404FFC73A7D7CD309C63B25B8D493261A429B347895BCF6C673A7E.2694.3060068880.272",
        "I_13D5F130BD0D16DA955C40F466B88954326103C38F814171A7C2E77C674795B3.2716.2557549276.294",
        "I_882898FFF157F1FEDDF4993756BB56988BE43D05EB0E1A07E492DEECFCC2B753.2676.3028000632.279",
        "I_48470CE86E49C23DA181F2E7738F61C8EB4E4B1D716A16F59BD2BEACE63CBB20.1355.3038214724.327",
        "C_C869A64A264016A40CDC6BE908580A71D42C8A4A557BAE5179CC1536A843969C",
        "SplitIo_Info",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2120.966352701.180",
        "R_C141B27FB03E05D55E17A9874FA2A68F510744160FBEA162FA44EE3DFFED753E.1936.615257931.590",
        "CD_4BD0F8A6C8D9EC0678D50228DC3CB44B9F26CFF9B291F8B882B0AD7C252B23A9.290.3048860299.261",
        "I_C3D1F8AB47C19F1553213DD848B61EB76D307277D65DF730BEE3C10028352E40.2685.1313580569.294",
        "CD_B73E13EE752D9B5AF02139CC8E7B9DD86AA46977B13267D0D5F674F26F8C3D67.107.559426711.4006",
        "I_3BC2F8500BF0B350211417D603E90F2E8505B9EDAEA12BFB811ED872C95390A2.2719.3491136097.277",
        "CD_4D02D2507121F4F9419B3B4E42345F52E9719162092A87545BBD14771DBD18F7.1498.1930752775.332",
        "I_BA2B64DEBCEAD4B5E79E8DFCDA9F0F1222A0566FE820AF52659088247BFF8F7C.311.1988916545.249",
        "C_9877A07ED842BA5F1FB4691948C0CDD95DF656BC3733002FE0D6F9D48056C255",
        "t`0d\\4",
        "CD_871F96B8C8A803F6E7D793A0854F07290B5BF0DAFF7F0657002709AEE1E2A5F2.1347.2752416030.1817",
        "IL_CCF501838BA5AAD510BEFDD6841658FBDAC10C710F64CE578E0D6771544E3581.2693.4242826120.265",
        "CR_CE73BC7D26AAF30679FF45CD07C91081A8FDCC9A1636CE37493179FB839EB641",
        "IR_7BA06B043DD4F1C4BC3ACB7E4C10A6223E3DA1067522BFF187585B0486BDFDF7",
        "CD_F2861A4DA5DC3097CDD41BE98AFC0D26991CB4501C7A9352DBC909EEDF0D4BDA.1601.485000663.488",
        "I_614FEB5198DB6356C7D4E70E58F0634936BC6DE530AA5FD952207E56B5A89D3F.1635.1118994179.316",
        "CD_E3F89A001DA5EE91F79A2D2864297FFA57BD7325C564BED3508D999C7C7D3F84.1342.1431011687.521",
        "C_20C200D9E838157679E42B001B4147A35D03B45050CB643ED29839B5C1F1E6F1",
        "I_2FEB110D9B2D8B964448231D62D228EB77833D966ACDE6C751FBBBE880E8D6B9.1520.1495436781.329",
        "CD_87356D5B7F373B899416425A260CE11B49850CB8F9A3DCA801C9778F10A8C924.1071.3970396747.2528",
        "CD_A85D741861673C53E1690A3A36DD370F35BF62AC7197C00161000A38E681F23C.1521.1296178362.234",
        "CD_A1FDEDE7CEDFE5C8E19FD85650C6CE61DEFE385164ECD849CB5636A26A1B8561.1200.2297851335.259",
        "StorageSubSystem",
        "CD_A57480D0D82DDE51E01CC9C7625981822E2D1C37B70F78DC6E6179505A7BD928.293.2789522887.86",
        "69<?BEHKN",
        "CD_95151EBC7602F93A6E06460EF447E398F547B7CD3033E5B6ADD3848197B31384.112.4254528352.1549",
        "CD_35A718313A1D788647FBE70E3BDCD7DD0916025FCA299E4EDF879E32418A1A55.52.751762984.8061",
        "IL_B46F59D2177FA4C49B49B1317E86B699A21B1CF58E8CBE9D2926621968CD50DD.2698.1780840674.262",
        "  </asmv3:configuration>",
        "C_135FEFCCBE59BF421E79A3B9F572052648A0ED4C004AD4F8F01A7059366646C2",
        "CD_45F5A698FE1F369FCC9E35170EFC43E4DFBC18F38DA62C3D1FEF22A7B3B706DD.58.4271515548.1313",
        "actionPath",
        "!EZ?x6",
        "CD_CBA62AA66749A2FDC924242189E9619022D7C9D4C02E2256557AE5388175FE71.2651.1892110525.584",
        "IL_F1CDDC8C4AAB83AFB4CEF129DBCDCFBFD3CFD4B7B0A3E038792E733F73599196.2697.1975835424.262",
        "CD_D56193964E51CF773304523DD4D95B2AA6C5D33866F47DB7D43681D0C19210B9.1070.2740715235.626",
        "{313e88de-a4fd-11d8-b301-505054503030}",
        "I_2050789B46CC098B900D800809F5F0D52680B20919159115539A03D30EA63839.2678.1980922697.287",
        "CD_03B5275A0D380627593F835B4AD2B03749EDE19E5B92F5526106699F68C22F4B.1650.1222124241.638",
        "CD_5125E87B865F9C6DC59486D1BB02124F8523E09293ABB2126C845245277E44EE.1515.1806780080.1867",
        "C_FB25BAB4ADE9A8788CC5262D13341BE83D9579F1AFAE9D6BA6F8DF76F6595862",
        "IL_DD2942074655A21144123D6AD874D5EC38DF214ACF36130D29366D18D7E749D6.2689.850189356.273",
        "Win32_LogicalFileAuditing",
        "I_883EDC6C7B36CA3E03BFFB70A247BBFF29C5F38FD45C0A261F753AFCAF2855EC.2700.3252129823.277",
        "IL_9FD082137700729C3A00983D83A072D395DC7E5AA5061738FF9BBDA92779EC8F.110.3090168130.317",
        "The resum",
        "CIM_System",
        "<?BEHK",
        "I_C2C5753C4F598CFD8A5AF2A2886F3FE064A2E73E367C27FAD1E6F688492B7CA1.2681.2469525010.278",
        "IL_DCC0F7993B0691A2DA49E69ABBD62942E6E9C923F3B1D1567211352B0A39AB3C.2695.3857991663.275",
        "IL_B2F4DEE709884EF7002D621C6ED2EFE2E258CB0DC2AE58BA3FB06EF994CEAC78.2702.1922028325.287",
        "IL_5E0E8E7803DB2F764A6104E2C32B45BDF47FECFD3784D2A5057716E1F61E849D.2710.3652694361.300",
        "I_4283255CE7FC8EA518E054AB2C9C5BD69D5B8479B2DCD08EEC220C266DFF5E12.2489.1841604712.333",
        "CD_5CFA980432A95F36A376B300F274FA5C69088A21DF553156AB401886C2073035.1808.2241779261.333",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1131.784967978.368",
        "CD_BC4F91591102411312342399DC065D3EC257C15FFCA13E42BB6956DC3F1EDBC3.2285.2072659959.243",
        "C_71929A7D074411D8B4A8B4411FE9FC801D8B39609B6D3D65F6EA33D3E21F0336",
        "CR_9D3103F1FED20F5A89A186A2A5165255DA3A6E898D7F2AF1A34CB11242007EC6",
        "CD_0FB727CBD11D8AA74B3B2793A1C7EA749C62FCE60E8F20DACD959B04FA118436.1192.4073818988.308",
        "C_F57973CF3F7C64653DDA6A8742229664CE37027D841F58BB761893FA6B462162",
        "R_3218B9989B938326A5858B34E6B5229D688B0E45C61F57E86A18678454B9C8C1",
        "CD_B621516DFDE9B6E0B0023289F774341B5AB73BBA9615079DB6C60B9EDFB63DE9.1922.1449459578.305",
        "C_FFEA4821B3229778E02955009800D7C28902CA2F2FADA0207E76D6E1DC9438B2",
        "CD_5613BC9F25CE44203106B76227B25ADA3DADE5F777054D3D589CEC059E3BEFAD.27.4140468464.240",
        "C_6198D0F4CDA2AB3092008D3A071FB13B82377D2BD575D673F896ED6BF29502E1",
        "CIM_Chip",
        "IL_25E364819A71426ED5E19DF77CD3F52F56BEBD4EC6ED9A7E80FD26BFFF23148E.99.1016060622.358",
        "IL_4F053C55BF94F687587D950205791AF583FFC7915ACC38F3CD7A51F2DB97B327.1776.4266597076.310",
        "I_FFAD67FADDE07A761E74EF31B5AD0B1561C43C37F19E76F6FC994C2C9F5FA6AC.2713.3108291077.294",
        "CD_8ED47D93B378823F8A634B51008797D9C7D2DBC0806250A927801A4F342C2B5C.2661.889913505.501",
        "CD_C413AF31EBD45FA510AD35ADB1344C580081CB05511196B32B7E7BAB01E4BA71.131.3444399069.590",
        "R_FCB8F5186AFCE657559BD1E3B7945F03AFA3222D1F02A94B0C21BFF34C6501B2",
        "R_B18A79A265A485271ADF7583A11B74126B27D0421B9B453C88A99D39E80DF5B2",
        "77A2C716BB28364.1151.2683006443.759",
        "CD_625E0E6F9E97B18101F4421497CBBF7C66AA039108DBE32EEB6D23DC718983BA.2586.262479963.181",
        "C_770B3A5818E49BF3F1927189A99E4669C2D51FD19867E9AB54F70E7A425CD1E4",
        "0Q369<",
        "CD_9F036BA68CA921AFF06984BDB9CEE80E8A2696D8DB098A0C679A6507C62F4DAD.26.3839336441.544",
        "IL_C25BC9F19751AB676A49B9296B3EE5F1034D441C962E8D7EE188A1914A35404A.2721.266673930.276",
        "CD_06BAA5D4669A9FF5B5FD35414B6353315AC4BB24F6507E6658FAA9831018BDC5.1539.113299172.412",
        "2-way Interleaved Stereo with Right Image on Even Lines",
        "C_0425402C13509DFF88225FEF141C2C3B4560C26951659B04B326D2928241FFF6",
        "eventLogSource",
        "2D05C4ECF40774F04063E6FDE0B1A6CE4B671271358A09E1596B6EBA1E2DD4A",
        "CD_A906A7709427F12DDE6D6641BDCB16CA4F2938A2A88AC6967D518CEE727A69AC.1.2819455716.231",
        "IL_11E7CFD2E458F6C890E351AC0A37FC5E0C06A7839AF030746D343DE6FF14B8AB.2705.3686318298.303",
        "CR_DDFBE2B8C9C0EB71960ADB33E49F91EDA6D2896A8A0783F02D140DCEC2F9FEC6",
        "05464D188B338C60C65E4A5441",
        "CD_F8A40DE76638BC2D6B465FB946B5587EB32CE4928E4F71A985E7A4A1C7848063.2004.428050329.766",
        "CD_F7420DA6533A2C562AF06F1F87B007C0FB6BFFD5F71653722CBFC32EEC340ED0.1671.1368105297.239",
        "C6FBD50259D024EA00D998ADB66289BB6A5295426711D6.1088.1523519975.1809",
        "Critical Error : Too many write errors.",
        "C_176649CD4E57E4232DDDF6DF456E1D2A1BEC4DED47B202F904E6181846857EAD",
        "B84F789F8D4A723143E6CC1D687E2507C707531AE083C2E8886AFB9011D4.2725.3418306492.280",
        "C_62C8891E57F68B5018AA739FA2F9A6FA324F5514D7DD621D65681F6B7E0BBD4F",
        "C_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109",
        "C_555A091927E7FAC684A8DDEE0153C9DA5F1053862A462BC7EFEFDF4A7B356E0E",
        "CD_4B00361A67C5CDF2974099DDAE160DCEF1B6C6E0313747F04CBBD7F11CCBFC71.2625.134172350.582",
        "C_D9930090850A792AD37ED6474B3469B6C3C6A3732038528F636EB310FE1097E2",
        "R_272E5753DC3EECDD6057038DB6F26170E7D1CD565B954C6C4A406CB1BC2D023E",
        "CD_C4F661973CD3C0A0D2984AF60EF23047396681C367251D4E47D1DDBCE0BCDFE6.1080.3147571646.2897",
        "XENIX",
        "C_38E384CF26B6969C10E6C877B2EEA6D4595C8CEEE6BA25CFC97F17CE8E8A5DFD",
        "CD_649A96A7525C03C672BD4CABDF65BD579104DAE8BCF03213836A9B50A7DFDB15.1343.210172114.1162",
        "CD_CB6B90E148B7501330EA5426A8C41474C0B4E4C65433E6AB6CB9902BEB3F1744.1595.3230634120.489",
        "CD_089084A9F2C065B07097839183786A1564DECA9FE2E250A27CB3C47E8FE89ED6.2532.2539787423.513",
        "CD_2904A56B86DF2CA3C261BF05D03341C4E0057AA3C11828ECC37BEB4E97435835.276.911035533.206",
        "CD_5849216AA6B9C5A93654C6E712D3CA05EFB53062AFC2D5C516979ED25C05754A.1544.709817053.717",
        "C_259C5FBCDDA2F46A05D031FE1474E0BE7FAD9CC9F46018D9F05C6852D39E0093",
        "B8F637EF3630A38CD797596532C058BB5BD87D7D03BC5AC52F6F7A12A311BA2.2653.2305154295.353",
        "datetime",
        "CR_FFBBEEB41878AC75CD38671CF9A4CECEB2F673622833FAA9EA04376FB4297330",
        "C_169484918492FC0AC4886BF1A48556EDC1984793E915C243C1C0A4B8E678F4FD",
        "CD_E7ACEB5389BA8C32B04736209B872B130DCE3B94FF3A17F3972AEE3EFE29C3CE.1078.4280470179.324",
        "CD_2D5BE2B23BA8B748FE728A0E39B335CC2B3500262599CB2529C98BB713577B01.2069.207744560.7061",
        "IL_A9B77B6FB8EEFAA0386ECE3D9F763120D7E0B46CF98ACF71EF752F98F67AAC11.428.1.32140",
        "IL_3A751240BEA2ED6AE7E0CAAA6B75ECB2D9728AED48C387B6EC2F36843C0085E2.2683.3489281204.279",
        "IL_E0849CDEB189AA76D8525CE1B639DCC35E6FEC1238BA020F29888EDAD9D3FEAF.2462.1487720740.353",
        "CD_5E33BA8BB8301B0D571DB35AB12D7C91B7A0EB2F54B87081058135E8F4EE33DF.2384.1709756464.696",
        "I_0664C43FD98655F0D3C0C0071DB765BA71B132A20B3D33302D97BCA913442236.2680.746798343.281",
        "{FAF76B7A-798C-11D2-AAD1-006008C78BC7}",
        "CD_ACF0B804376D585D7EDE7E3EA155CDE37431968EEF0F64B0DC56C5E9BC27FBC3.1248.1796390340.737",
        "CD_7C97DB83528DB0DCCA024135D74FFAAEB94DE3136E4FAB4F9307AAD2022D7B26.2672.50080226.2037",
        "firQ6o!",
        "CD_E340FB8EB4DB3A4F1ED0804CB2A3406B4CA2DC92297E79DEEE6E8BA2BD0D28FC.1600.967725931.353",
        "CD_13091E3C3054BC345002416FA26EA86BA000D8B72D69780944E68B3A51252A0B.2739.1318947084.335",
        "R_592AD4245F5967C5343D00E56AE24D1F0F5CE094EF04D954AC81ECB94104BFA6",
        "IL_9D24B22BCBB547BB4D2B1463E0C53A00C9EA46E1D8D5F28DBC836E358C515DA9.2711.1327119678.297",
        "I_91401F2B7C98797EE0E4F6F89184179F6B71019B9C198D9A0006AC6A265AA2AF.2700.1962823044.270",
        "CD_2AC3A3393B211815EE8AD95630A39A04356B9D96C35ABB2AB34E8ED5662118C1.1808.1220455797.606",
        "C_2FB689BFC688A3A0586C592289E873F5F6C7F913F961214869D359C9A9727DD6",
        "C_9FFC730BEA787E28FF305A66FE71BC4BDA5863470D337AF3119C48B654F08702",
        "IL_0A4A8CC499F46BAAE9FF49E6D68BB631793D5F6FAD2719C0358ED54A87A84829.1607.1929139302.263",
        "CD_12C7A5E4BAA4E033E8564BA476003D767025946696E49D1A4603F5AA3B2275BA.1064.1637072331.585",
        "CR_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D",
        "C_0C1B95E6D290B66E321C724410DB4355B639D2A083CB9491EF83C50DE14B1E8C",
        "C_79D204F57ADBFA7AEF3CC804597A60124AA93768D70021572BF2BDB80A7A7D26",
        "IL_7F42A39E0A7CE0598AE24D3F823542C5383686655886C30E2A56BBCFEE4C9BA4.2708.1562184897.294",
        "CD_A05374182360C61F50CB18CDEC015D253C42693E608575287859129E69245893.2551.2390134708.1555",
        "CD_4714D9B900765C427A8C3A4D74360B2C569F951B888844030608A447B457F27B.1611.849212612.698",
        "I_A8C08024CBBA3AB7F7414387F341D4297567CE71AA49081987E0F0528989B49E.2398.1817146816.258",
        "I_5386CC6AC469C7F08CD169C28544D1F527C5084ADD70DCC11E9F92885E748C22.26.2765184564.195",
        "CD_950B982CC6F803B6E071200389755F5BC713572EAEDAD6AD08F5A06B9E237444.1148.1386551513.860",
        "CR_FD4E702E602A432E7AB9CE0A91059DB9571223DB712493258C6527C16FC78E38",
        "FileShare",
        "CD_130F1C3C29111AD1E8F485A9C57AAA4AFD7E43ED53D005581436A437F8C3A1B8.1051.860392546.663",
        "GroupForwardedFragments",
        "IL_4EC0CF94B55D67AC58ADF54403ADDC6DAE3BBA72E5931DD481E10557259093CD.2691.1875675021.270",
        "C_E69678D95075FB6BA6844B84FE0DE69C85BE49AC691754C5A6AA3AE728E45697",
        "CD_CF99DDC70B35132A88C7557FE89C5077A71D226B5E14B62E751EA68760F6B4E5.287.286271955.404",
        "I_422AC5740BC441E2FD05B199E0B4354FD92D7E874808CED04A499C3B7F800910.2720.3875001459.293",
        "R_60F176EC0AF17AB7C6FC2843157E8D086806E5F0522F8004584440762F45B2A7",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1976.548237129.368",
        "CD_739CBB07290D58D47ABC1C0E69EB7169E128601DAD715F68DF7F5881BC109754.2597.3169889245.586",
        "CD_A90E76A32C4A193B19FDC863622FA085D4532219E7648490CF033C6770DCAB51.1193.1274473703.314",
        "CD_8B7BE16E7251A1D8A537B09E04EB4085D2030EAE15ED1B2F980976175F47B5C6.1335.2631360272.518",
        "C_F071A22EE25478DF80A205153198A6FC12F84A9E6BFE53B8E5DFD1E7E2ED2B8E",
        "CD_5ECA63A2575A533106A3DA4D4E7D3593AF8C1DBA30A77246287C3734644E9810.1210.2190881990.315",
        "CD_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416.2103.164194604.654",
        "CD_28E04ED4579402BA90E254EFFBE2F4B62A2F444F99D6E873BA6A10FA5706B34A.1580.1772282232.416",
        "I_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251.297.1719363822.333",
        "R_0BA2D3A6276BD0691BD1FA84BC30C40A1A60950570B8DAAB976A2AD1FB8F10C0.2521.290653588.522",
        "MSNT_SystemTrace",
        "I_21E45FDE4FD81E3C9B401C7B696843DB04065057FB24A6308E103589C2E553D0.2720.2343512210.283",
        "CD_2BCE88A8A522AF0C8D0D879BA9706C3E8D9872FC3140E85FD61D2AA097159BDA.1541.856787262.408",
        "Critical Error : Too many read errors.",
        "CD_1264B24DE1BE75E3F3EC343E410405743BED271CC6F6A49DF7ED18F73A72F2ED.2572.2061245358.1917",
        "I_399F43CD829D8014C714862D8902032390C068BF435F49666A7BE599A3401910.2707.4127460834.285",
        "CD_7EFEE45D678860640270CDCB1BC2BD0BB42491B76E477555F802FD273AF27EB2.1227.150928092.246",
        "IL_4B7D752CB83417BCE5B98B98FA3963CE38E7BC33B4EC847B3276FEE9ECB7A8DC.1104.4206601426.194",
        "Side-by-Side Interleaved Stereo",
        "CD_443EA03A729799AF7B722609B218862C5380ED55FDD1C6840B32FD56F51FDFBA.1782.1584821135.638",
        "I_5E604AC13A084AE3258A5FB5ECC21F7B434FF6A3C71A7EE33A73627FB9C64E62.2736.26687260.282",
        "I_76BBC96B178A1C054AB319522EC35C13427283C8227727BACFAF1E007CEB0AB9.1533.2682743591.332",
        "CR_C85BEC05E1DE78CAC5454E6D33A2BAFD69D28B4057355776F41B00B3DF99855E",
        "CD_82414A82DE748ED7C01A47DBB75CAADB5925E61647EC20B05CA201FD29ACD980.2539.3805823228.545",
        "IL_68DDC0CBADF746460BAA2773BA9404108071083714FE79386D5843AA94F942D7.2687.1753578804.274",
        "CD_79BFFA82A64715EF01503A4F07A073E2813081ED91CE09901D87790E269BEACF.2104.2874720875.751",
        "C_22BF47DA2511AEFC98D47D38321DC32FE145239764E9363773B9B33A8A177498",
        "CD_C3C6D8FB3474EE785958EA6FF4182273D2A6254E9DC15AB0F00C01432187E439.2398.2096867290.681",
        "I_F8FCE999F676B97138370A6A20A4D583B46736B2574244A4CB6BE68177264A64.2508.1003636062.544",
        "IL_8A7F9AAAE708FCB7DC96A027E88361E2950C2E39D954BA3B56D09F8360E69FD0.2674.3794195178.267",
        "I_53AF8608C104F86655F42A8871E5F73225A8D681F66B8151B7C200C46C518C50.1462.1061050821.302",
        "CD_38522FF056841CE5D155E4CC0CC353966200DA04021E80EE70B3AC6C9663D8EF.254.3297365091.686",
        "A persistent binding request included",
        "C_676E663A52AA5A4BF1581676E7DAD4A65786BE12379551692652B9B04BB4F426",
        "IL_9566D31591AFEBE89E462D729CD961E8565B18C89CA9B093CA338027ED8836FC.1016.99382667.314",
        "I_84131F9A32B4874C0583828C0E1077E64824915D221A9E51CEF50EEB612107B8.2699.739019603.266",
        "Abstract",
        "CR_3E578EE07841672D662C242E733DB5203704061876BB0F37E75B8DD60B9864DA",
        "C_13C9E4CEE0DB2A141FCA5D32D5944FEDB123223947948622D17B40B794518D0D",
        "CD_1C238E1735BD05B8EF9AABB593689748E0D68B3ECED3CA94445FDC58B5AAF1A8.2551.2796250949.1544",
        "H$BT-N",
        "I_3ED0B3FD4FC7DB80F64E8348D4A42B4EA6BA5C19338495C90DCAFE2FD4308C53.2677.5690151.273",
        "CD_D14B35935271CE0CFC0B73FF55CDF115EA5E7A2716F3A5C2E409A53B3653FB6B.2625.281073826.577",
        "CR_703C562B7404A6234AAFEB9B3BB242E3FF62C76339F84C997DCEF89443C2DF65",
        "CD_3FF84C03B328C80EE72EA722B2C1AB0D0A4549FDEC5EB94A2670D175C0A3657F.40.3014044045.666",
        "IL_1EBA270562C682B81F29698E50E9ED769AC9519D3C2F8B287BD70B9609EE21D6.2679.2817958383.278",
        "ProcessorPerfStateEvent",
        "CD_FA52CB5E7D6BA7133233B22EA252FFA4A8C664E7F86ACC00B362A212DA58071C.2152.3041832081.3545",
        "CD_19BBB29094E342ADE6943287FA27AB5704DB7461B952CA2D3D236B915D80FF5B.2646.1570108482.911",
        "I_DBB260705AB56469925C2269D5CF4DEA13534B8B63D09847F69148EC698640DF.2722.1666425238.284",
        "520E025F7CF40D004E2BC1C3C9AA54865F4",
        "C_81C106E09E02CD8E9F92751CDD19E5532DF222FFFFF38E1A22F4010E1CF8B4EB",
        "C_25DB973753814296778CE91619DACD1D75BADC5FEADDBE8C05CED0CE57CC8084",
        "IL_A4F229D72D127953AFBDFD3FD290AEA94A8F46D87804C1D89B08E702E32AB7DE.2736.4082832536.283",
        "C_988F45C7D3827182CC9E311CB986FEA0532897BB2CDEED83739CF2F82341462E",
        "CIM_LogicalElement",
        "C_89D253C7F34DE1BDBB149B2A6193A187FAB48CDF693200563636A89559A9C956",
        "I_8A4FF225C58B64E39A926E51167D666A4A5D759E2FC49A48C146A965531D964F.1355.1469271766.195",
        "CD_9F25211DB7D04527A2718EFAB934C1664FA38400093282D5A337A37681C23242.1824.1.25376",
        "CD_18DF4E7DC43FB5F7943BBAB3261441AF37AC157D8DEB54891BB97D3B897A5305.21.1906864971.525",
        "IL_5A668810EFB5F334EC8775C84645CC31F89D3C68DD1A37661095B62EBB956DBB.2693.2821266362.261",
        "IR_488680B9304A8CE240DD3162C60ABEBE0653A1B3DEF56BFB0E7A2CB3DC6AD158",
        "CD_5B2556AB9E26BA57F6C3EDFE9DDB3CD3C905F536AEA737972265B4CB89473B27.1155.3225839875.372",
        "C_965B6EB1A6811B0551711D38F83F3DB9DE7C53AD875355FDC9866616CBDAD695",
        "R_3277B54ADD63DD9DAF9212009ACC4BB7EE33B9AEB2FD840D7E82EEE595AC86D7",
        "CD_C43EFC04AA57188F81F06E127B541FCB4E02CC3940B347504A70CE9D5B7DABA3.2746.502617358.354",
        "CD_878D5D30666EBFE440F941E45E7884E8AFCA7A1478E4D09AB57DC26571C8B7A6.1176.3360590187.370",
        "R_0954B67BE64513B4D9B9F714CAF4BD4F81866B122780FFA4FF13B48AEC697DF0",
        "C_41DBF5B1870AF9F0B77D7680767E231A2460610113F21236505A5E4A30EFFCA6",
        "C_FAB579260306CF6BFF8AA42E9AAC8900DD8AC191A796F9430DC39085EEC7005A",
        "R_B6BF4F280E8F41D5C682A73285BD377F4F1516D4792C5D8362BF30684045009A",
        "I_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.3007692339.360",
        "I_28ECFDBBAC6F104030F183D6897E140EAA90F92C3DE03CAA6143ECC7A5E12353.2705.2306488271.296",
        "R_43EC260286926B23812C194A4DA05B5AEF805D24E1C46BE4CC6C20F84F2EB128.1797.2845197311.544",
        "C_B1A1651DDC605A98CB61526F4FA9D18C6AEA8D3F609CF92D2D881D05F26BFED8",
        "IL_AD65C0F527437B95541E8E8CF03DBA86454FFC8E0914CB92D3DC1E8F116A668A.2721.3996512111.271",
        "R_9E0CE8EFA5382EFCF4A61BAE5C006427367204E75B0194A869F998F4EEE5DBDD",
        "ass supplies the PnPDeviceId for a specific device",
        "IR_9E8B26DC09F8BC8981ED0BE484716F2638BD5B08766978ADCDE0FC3354AE393C",
        "CD_CFA7490FC441CDBFE3AC487F4E7E6794E550150460C43DF35BA636FBEF5C66C5.157.3748139846.1608",
        "C_EB78AA3AB0AAD297911A31C4BE3F414FA271AE65201757FD6A0D70088B508E8E",
        "OF;T[",
        "I_70069B655F2B9DD4EA309DC34E9C4D2ECCBAA9F60D4FCD1424290223A7872F59.2716.3574595889.284",
        "CD_6EB3291DAFAF5E4121A6DBB7E0E41C22E85218F8922D3C0FEDA4960BE686F47A.292.2601083065.181",
        "C_778AD787830FB6503DBDA7CAA392EFCA8ACEC01E4CC5031286B5843857FF9554",
        "MACOS",
        "IL_6AB7FF86877A69A2199854B3220F74AB68A2E4627C6AF2DAEF65D55543EC0952.2764.127612870.293",
        "IL_5FC21C0FDB0998D61B649D1F2C9B01A173119F7C8A74F086917BB9A0BDE8B623.2698.503221653.266",
        "I_8DD6D1DE3815CCFD1C54F9C6C46C4858DB951E475313C281716A5D7F2B0D87CC.292.965239135.206",
        "CD_D4639B8A3A234C7C421B844825ADE1FE2360CB4CE746D79998FBB9573B4B4A5C.2384.2067345699.710",
        "I_1BE7A8EAF80595A94866C463E26A35793B97AB42111AD0780ED607902E172C4F.2715.3905684465.274",
        "IL_7376FD33C025FB191993CD2DF559B22E6E156767F95E97941FAFEF237747C4AC.2694.230267917.271",
        "C_50564F5C06988A1550650BA34CB61DBB736E969C2840EC6EC2C5C6E85EB95D01",
        "CI_818DB2B3AB26C49A2AEB1D243B555363E794DB6E712436AF8BBB2D25701B24B8",
        "C_16C3460778AD17C374A21EA3EAA4769942B4820B8F8AA76B353EDCE060C07C55",
        "C_8844ED1C40CA4036CEF6C65352A66AFC804D998655B7EF864AD1A292AE8AE43C",
        "C_14614F807043038CFEB6FE0C7E3AB6A79783E1690BBEDE1801E1EB78C70D3066",
        "C_BEB09ED4AE60EA02D0906C72210DE0A889B4969BA537FC2684A64B66607CC566",
        "I_EAEF166D07823DD8DA7D2576AC47944178108FF5F11E6F92829261BEA2612408.1462.805379125.307",
        "C_FF9B90BE4979DE749F8B505502B345E073E79C3A6AE6091B78D5A7C395006660",
        "I_9BB9675B824FB6DC4AF17BFE099F991C6FF77A49F1162FE9115B457A336C69AA.1016.4118110844.356",
        "R_D817F92A995CD8CEB7B9B6D66DFC820B92D445855F800F0DCEB0A8FBBC324D78.2763.978259890.636",
        "IL_7ACAFB87635355B17C12000045BC83DC17FCA98944EFE99F5659D0D85614FAF0.2686.3684627172.267",
        "0x00000080",
        "IL_C109EAE1C13F3F3A6A73CF2442EEA104952B0608551FB7CBA0C21D6A0605B001.2711.91096168.291",
        "Standard",
        "e64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41",
        "IL_58740AA495A98FBE8EBE67D95D511D3E45798D275BCA46DE213B96377FA857D9.2720.2647125338.286",
        "C_E241A982292C9628611468FB40BE60D4CC1B723333EE25A7584E871FE9DA753E",
        "R_1B54475C543F72E44D84CE48B5FE8E0F3BEAF4CD6AA92F59038472CEC3242827.1747.1798552576.572",
        "CD_4082A72ACD016CE3E809C18525EF28CAFFEB76B1D6E2F5C00FFCF2C67654A896.1219.601251292.256",
        "C_1CAC18FCDD389660F406EB5935DF9224FBFB7E21ED4BBB2D0F1CD467E7026A90",
        "IL_03B4753F57CF75C1C468EE3E07EE4FDCDC5B9D81BA690F1B809DC31E0E3BC8A0.1016.2228059653.333",
        "X\\`dhlptx|",
        "R_0A3ED80DFF0A7A8EACA9D802C83A2110C6D7BDAB1EFDEE73E88F2ECF8116F7E1",
        "WARNING : Drive is experiencing read problem.",
        "SDBUS_DEBUG_INTERFACE",
        "IL_B40FE5BB7D3AAD0C5E26212696A1B37175024D4725396AA1CD7AE0B640ED7993.1580.325098574.265",
        "I_DCCE641EEF694F28665033BDF450BA8C04EB90292543C7AAE501CD3A05C2D8B6.2701.3214588246.281",
        "CD_9BBFA8C910BEB6D0D53CEEB430D18F841848C699BA0FF9BC9D7BC0530FBF0559.1570.3404360225.417",
        "CD_C817DD8C4529B1D43D8C1DAC084B54DB9AB1718E7FD5F201164920A53BE23ADD.2225.52052427.819",
        "I_134911488F4C46FE96CA8686428124AE0F9EF6012135FA66D10B14874FC8CC09.2720.2171605859.279",
        "CD_0442F426186B770F6D9CA208711E127C2744CDB9E3F8C6CA1D92279D302D64EC.2586.2481527885.748",
        "I_0305BD7D37B6EF21E3131FBE87D389E0841DA741288006F67BE43AEDEDAC5F5D.296.1087772027.194",
        "C_846C560B82577D9FF88EE61507FEFE652D765E2149E65AD69717E4D9BBA459B8",
        "IL_217F68307E9576428FECF7D9B86DB33478B7ED46B1F8E90B85E7D09D0E5455A7.2684.271337700.283",
        "CD_5D2C2C389F5259E45332A86ADEF5107186DA3990C071FED897FC6FAECC4A4DBE.1083.3826275309.938",
        "CR_17431B4BA51D33CDA0A6628CA12FC7DFF5F227BEC60D95CF88873EA792342553",
        "C_91882C4E4700146BC908AC03DB139338C0844AE5A877163990AFB47483D7264C",
        "C_2D6319F4E2ABC488E243ABEE465F201E726C9CD7B9C330B609A5B7513F1D6F64",
        "RequireServerAuth",
        "IL_A8A118A61D6E0F00428AD40772289034BE1DDD6223ED962285264493D8B7C6F3.2720.33354805.284",
        "C_416849D23E50D51AF922BCE109C1035E8C25EFABBB264CE6D309BE7E40EF85CD",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1714.2666996016.368",
        "IL_2E249A9A7051E55FB5C7B110A81D9F2943FB48A52AA26C08ED30F6DB2402B8F9.1776.1880114746.331",
        "The Name property uniquely identifies the service access point and provides an indication of the functionality that is managed.  This functionality is described in more detail ",
        "I_F3CBEFF98C5308451720C0F4181C6A2ABE764CEC30B208CE682B8F0079180C08.2725.1045098373.288",
        "C_2F43B8EB8E14762A257D84DCB10913E4CD9E8069D8AEA3384120BB143668FB2E",
        "l'cK]9",
        "CD_EC97D00816B4530E92B0346A6B6B453699A71F2B879F99F794A6FF9189BD53FF.216.3269097356.881",
        "IL_09480CC6DEB5AEAC0139332C064B4C7482AADDD84861ECC4B22F0BBA658A69F6.2722.1887683225.284",
        "25238.284",
        "I_F5E021D5620DF76DB11A714354730BFDB3845D5ACC1D57EAF3889D51C85AA6FB.1498.3566981496.257",
        "CD_5ACAF83AC17F3EA7F1672F287BF1DD774125A890420CE4F482AACA090A7C6160.2377.107271462.7287",
        "IL_1A84077BF4FB1F232DECD798D5154E1CD2AEFFEDE9344CA623848E1E6D64A35B.2763.523023325.350",
        "C_349957449457FCB3DC5CC416323F05E6E56083B532266B79EAB7F5AB720C36C1",
        "KI_C937FF2960366D3679AB8F23C7A6B508B41E35226B8C5FD67AC45163D3C64350",
        "C_0B48320BC1A528B3C1FD27BF622CF9AB5E3E6560AA1B8D7B4BB227712F4B7CA3",
        "CD_6EA20F94EB6B47BA2F6B0363088D421DA9B65293B80BB1FFCC1B564E4ED04B0E.1344.2662182549.1473",
        "CD_302D76BF122566F8022CEACDAB3867F54CCB676D4676BBE2D56B8634C3D06EF9.1757.268142860.153",
        "CR_A8F32ED73CC909392CBB6D2CFB5C52391FFF3A4DD4AE1EBE1F9D40C03A8C9EA6",
        "WmiMonitorDescriptorMethods",
        "I_434C67A3E3C6A58262C4FE45F3128F8CC7E0BF15C9B24B8E0102EAE7EAB66665.2705.637143694.292",
        "C_85EB5C1F7ED82992828A8C9B34BB659D93173335D569D676E001DE6284BAA924",
        "CD_60FCE805C6071BE87E9CBEDA37820FB36CF37AE4223143B61E8F29860F4C3E57.1555.3383720539.2649",
        "C_6C9B6879A26D36FA804084B2409422299600D124FA7251CA869851652B58B90D",
        "CD_27CF2379D55C0D9FB04788B37F03791666FBE227F5B5256A959C5EECD8D8ABE2.",
        "R_91F50D2862F71528CE8ADD5DA789B79DF6B5B0054A4603D0ADF36E42EB1CD08C.1020.3075478322.518",
        "C_B0F597559529D7C32A6DA0B8B453B541A0761153CE325066DB6B3B967B993FD6",
        "CR_B860282B4A1153A407ECADB9A68A7564DFACE81902C1C29A9243B46F5679275A",
        "CD_AB5494CB2548839F327060B92E88F6B76451ECBACC24686132764AE0175E9434.1350.1910113729.680",
        "\"&*.26:>BFJOSWv[r_cfilo~",
        "IL_C58EB1CAF4873DABE5475DC2FF355A8A9CA893DB04895050BECF955E0E003FEC.1015.3359005028.296",
        "I_D78E65D43C587EB37A9E43FCF3F4E7363727C5F50EEB63C8CEDB36F05164AC6D.2489.2498381217.304",
        "C_E17F919984F15CCF479B609DDBC6B5B04373B6814E3C2310098E997AC3827DDD",
        "C_E051E777C7E7563456908117F89B298B636645144CE61DF3136AB528CB03746A",
        "IL_53AF8608C104F86655F42A8871E5F73225A8D681F66B8151B7C200C46C518C50.1462.1061050821.302",
        "The Green Grid",
        "I_F4F0968BC6AFE37C8556275F636D92E4CAF670F9E788AB351B57421255A519DA.2722.3093518558.279",
        "CD_D1553F25D903A7D66D6E3513928D0B42C977674C3BC0CB6A4E19EA9B3FD794EA.2403.484880516.4186",
        "The volume",
        "C_342DEDE6724A2088F8EDA5FEA74D5D57EECA3280205948035F7C62E40A5BBEBD",
        "ErrorDescription is a free-form string supplying more information about the error recorded in LastErrorCode property, and information on any corrective actions that may be taken.",
        "CD_CBFB019273A83D799DE0D6429AFEC221C503DD9A65F54D080290A928F614273D.1351.2201736933.1253",
        "CR_A435E1CD6D36EB19C6DA0BA1C7E62224942A59031964EC981FF17A68812E1011",
        "I_21E85A20CC15E835CB6487F54DC9B230DDD677D1A3F958EEE3ACBA0DE0846B34.1499.2500204981.288",
        "Win32_PowerSettingElementSettingDataIndex",
        "CD_201FE927724BFBB52451599DF95A1C7B68005C00C3BD7C951DA4C557AD4DA9BB.1602.1602685848.944",
        "FinalizeKTimer2",
        "CD_25245316A9D3FA38DB37C9B83D3D9B2E2A5C8AB3690AC27BD6B5746485DD433D.2003.1714931024.905",
        "CD_C446284C531AD33722FED92B5707E137291BA408988B095293D49122D6D19961.2757.748383793.807",
        "CD_95CE38D55F514EB56E1FD96114137062153D80888E94FE34DB4826CDF9096258.154.121197998.1542",
        "R_1ACA219D12A6C5634794493722A67DBF9212088902EA559B31EB3223BD391D37.1183.231068810.524",
        "C_230EA8264BAA6C50B01C67268E97AB7EA0B455AC7B2538115EE2F298AB497196",
        "CD_7819F9BD391801AE3CE3F3C4B0B744CBFCC71ADDEA13DECCFEDE9307D2BCF35F.1780.4021989064.287",
        "I_12DB2590D5AF370254A4FA02A2D08AC6D9EBEF98D6101C4F6B2628A2617B04AE.2714.1463200892.285",
        "J^VZRFbN~f>v:Brnj",
        "I_0D45312EE5438D98BA36805CCA7462514E338F3C3D0377BF7732E42B59651E70.2686.2817361374.276",
        "1140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "C_B496E3C91F33B99F414E0CF911598E2EF9133E94328E67220F22C24A7531B226",
        "C_8698DDE120477B743B835F81DD007E72825FE6E7CB8483AC9D930CC8206DC723",
        "C_95092F78A9C37B9D260D753733F7A0C73EB4F2C2027E3035DD546DE4EA2081AE",
        "SECAM K",
        "CD_B76FC809524DDD6408CB4666DBDFB0898FA0540BCB633CA73A3A65B466115BF3.1590.1.29460",
        "I_CEB3FF80EEC7AA76CD64001645DDEA4365629F46859570FE28955766B800A444.2726.3322423495.279",
        "C_2490985DC8B40E4DC4CB854CE287506A87F77AC2FAFA9F0EAF508AF96FCB945F",
        "R_9D6C206BD45CB880974789F4931A2F78CDAE201EFF7E32B71E8E7698AD1EB3A8",
        "R_E92F7F6859DA3540BD4772DC997C69CDE333458F416E1FC00383C239893539BD",
        "R_A97D8E3A56A53B2D4CADC8129B89F0FB2C2165B47CFAF4A34E3AE69B94AF3324.1635.1587423163.558",
        "CD_BE877C282D9825219493E084CDD445329E228296939B67B04EBDEC0F45BCCB11.2039.2472272846.3054",
        "CD_1DC5050B83682C310993D0E23C7DB3EBF7DFCB3434893B4CCE67A03B9E83366B.2150.1541672612.7058",
        "IL_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.1577904231.338",
        "MSWmi_Guid",
        "I_752BF18DDD5A926AECB492CF5F791DAA2495FFD9675699FBDF61554FC1FE5AB6.1938.2712049415.328",
        "C_C4045A14FE292F5DCE118CBE7A18E1997339F3CB7C3124B21C33A6E18EE0C114",
        "CD_9C93CDD5D73BA485572281BADA11A2A3674A64CD9F400FDD1797E1E153C6A4D7.2038.3477650478.4011",
        "WmiSizeIs",
        "C_D3EDA6D3072598111F4D360786284F18068B3C68DDCCA5982ABB599E92A62555",
        "Unspecified Error",
        "I_D9C86DC0F45F973F029DE27EEFF1E3A5AC9CC13763E27F3DD24700713261FBE1.2678.3959160948.283",
        "I_74D0E3B185A1A6E8396A8FA36679B24960202A5ACE032585B2B78263AAE821ED.2720.3580441557.280",
        "DE6AF3AED2E4BB066C596",
        "CD_B449E4C982007699901F8B11448557481BCA2B35C4809156A6C3E1390C860FE7.1650.3932095509.389",
        "IL_3619B79CA84B4EDC2BDDAF5D553664FC92A5DB1056D7E513184732652E964BB2.2681.1729456372.294",
        "CR_8D99B89B2E26FAE38502F957460FFF2E9E23E0C0D9AA3DEF32147EBB968C38FA",
        "t0d|T",
        "CD_C504B91CF040A007F72C24FC0CC99A78401C1C475112424D0A789E6908FEF373.154.3947416858.226",
        "Start (2) changes the state to \\'Running\\'. ",
        "C_54C1AE02684F818103F95A010B7FA41BC4C4A5E1CB26B1EF1D4449E52353C1D3",
        "CD_73D3522E76EF49E09F2C9349B6153167CE1B6A78ECD8672C0087F368CF21C8C2.1925.122266511.294",
        "MS_SmBios",
        "I_2BA08418F861DB94672A8DD5AFD68E12868858A5468279769CC6CD73EBA0759F.2722.274125471.277",
        "IR_4283255CE7FC8EA518E054AB2C9C5BD69D5B8479B2DCD08EEC220C266DFF5E12",
        "iconPath",
        "C_B8C74E67C39B608082AB2CF31CA5066A5D2AB9D167B8974B8B36B9FDA8E10D1E",
        "IL_6A45106079E6F226EAB7745F737D012FE89627A4DE0B29EA2DB4253105999FDE.2709.1124548777.298",
        "CD_9E5B3D45F8CAE1C4CFE56075A9FB448C0393D1604515DCC51D7A6ED3FDECC308.1345.1724140242.795",
        "IL_ECC07904B8C39F531C7B7164777A27FF298DCBD246363DEE318689DA18BD922C.2710.2996889542.286",
        "I_6BDE383A2AC83049E53DFC50229634C12F4CF7DD75008C8EA0EBE3B11A53311A.2722.1704207287.273",
        "C_0ABF3D1589A9B18F0AFA08F69190699B7E9CE95E28F1B4B39B6534E41F4C3C0E",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.1131.166110832.188",
        "R_848678FEA3E9DEEA8B4E9FB42ED8A13EB705C3DB7C73AB893E320FAEEC87714C",
        "HeapSubSegmentActivated",
        "CD_5B2F13ABADCFEECBA198671EFBCD3F1F745DFE5526713E2FD94776960F406207.1782.528443901.676",
        "IL_F8B249E71AB95DA23EEC66345D79899D60456154F5FCC7474978B15181E19412.2729.3609212121.280",
        "I_37CB291E96206B811B242E1B2E99A15E443B14749AA28D9EF51C66CFB85086A0.1608.992405960.282",
        "IL_189735F4993F268A682C32E1E892E3D4E5789484B02A377D7442D5A54CCE596A.2729.2857199671.285",
        "IL_F8C1B431C8F587C52D9B41B782E92FD5B2DDB16A4315E1CF5FC85497ECFE1EBC.2718.2294920082.273",
        "CD_8DE46DD6446B26621A23E11758AE5CBC62C9F72998CAFB08B9CD58DF66902A20.1794.2865433884.422",
        "I_D425B22626A38B1A8ACA71A62D647C7A7B5249DA5A372A8146B11E6EBB227ED6.2735.4248770693.273",
        "C_D7CE34A38EC480B367D84FE3F007BA659A4FACF5ECBD204D1511C653FC730B26",
        "Desktop",
        "I_322324354F59741CA8AD761C1C7D9D501FB03485CEE7F196C5A3BF4DD90D727C.2680.1655469952.274",
        "CD_D8AFD5E52E68EDD2DA6601343E41948E517B386A2A14A3AA86D4EC51725265DB.2634.1443623754.1406",
        "IL_E57D75B361243F2E2B78DA73BE942446A5860B3B577BC2450A98F33FBEEDA2E0.2725.935686389.283",
        "Timeout",
        "C_B2810E6A01F7F8E13C9D53CBD15E68AC21A43268E9F315153FD0564F6B343FDE",
        "CD_803E283D75B31FC987B7EC08347BA9088A22475CEE4377C7AE84C9F0F1991181.2273.3533969798.2454",
        "C_413A1FFCE28F9D6A57637B88B18B096968AA0ACC15633B9D32B2B3D4D91D8280",
        "C_538A3603089712831C1855A9CC2037235C860D74ADD987C30A48B83B513E1244",
        "CD_09A5E19B62E24065CFCA8EE94EA9E5C149E6CB498581E688EF627C4525368332.2052.1961258099.633",
        "CD_2F3BB7CF6B8E51A35C88F6CA3C55F4F164B1DD98C6F6BDCFFEEB67E81F67996A.1987.1.26978",
        "CD_6D429FD402093547E603FFEF7F3DCBB64D26C88E650742C35EAA4E9D319AB841.107.3894714808.305",
        "CD_08E96148610DE84CC1420D120ED4D38B898FA6EBF747C730998CBE3730E00048.1596.1148784303.472",
        "68B100B133C2E45279CD6E1AD49C4AEEDB510EEF8207E9610.132.1881790728.629",
        "OfflineFilesTransitionFlagConsole",
        "I_44036BB171D9AF18031EF01FE0D886C451F6A0525C04F1E6CE83BE3EC9A88806.2710.1513184605.283",
        "CD_A9DA9643F1490B7487AB9112B0D41C52A94CDBB53E7BA51793EDF555168DBDEE.2506.1.13414",
        "C_805206C561285684F42D728C26661B4F548F5E54321B06170E013CB108084182",
        "CD_803E283D75B31FC987B7EC08347BA9088A22475CEE4377C7AE84C9F0F1991181.1389.2871503779.2547",
        "C_503E99E1F76A9D46449F32E9069632CBB392B8A00D8C4838939B6A5881D7193A",
        "I_304546A1C1E96E9129142E75E297CCEA0DD08492A7C88D17C5C3618E4AA08462.1520.8942720.295",
        "CD_6702CEABA78A84027D665EA8C6C2850EB8DACDCBEB5FE80B4513169BAD18B590.1809.30742411.524",
        "R_861C013CE84B5CD46D556387E582D9AD3B2B632DACC4C2AABA8E7E10277A0509.2489.1966021957.594",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2041.1860447720.180",
        "I_AF84A75EB301BFDAD9D850AE7DB9A8A21071085DBF56B1A75FE90C7F0D1A63A5.2687.3073945273.263",
        "CD_A136C649DDD401EABFD58B82CC5F52539BBAB4842ED5CA9AA74B8557B4E57EA2.2586.2644218558.1134",
        "C_2709D604997E4C05B7BF0EC60DA38DBE96EE99877100EEC25D736116E6E41045",
        "I_214E18D38F4C809C2A0D7F73B5150FCBD7795379A1148AB93B4ED4B8C529C167.1015.3485321847.324",
        "CD_9E0CE8EFA5382EFCF4A61BAE5C006427367204E75B0194A869F998F4EEE5DBDD.94.3557262713.644",
        "CD_32F111A45E7594771F4B831EC4C51F536473C63323692A7F6C33516AB1164EDA.2375.2222493617.790",
        "CD_64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41.0.1574635466.180",
        "CD_C2F98821FCB494ECEFFA5BF85ADD681DD9F374F97F468AE953F8115CC121DA2C.1073.3529180686.1294",
        "CD_F69D8029CE443505782739E5EA30F705BD18A050DBF4E379EF0B690D5B10D87B.1752.2584798739.2055",
        "Edition",
        "xZ]`{",
        "C_BB85D56CC063D388F160FAD75C503ADCEEA6EC0F0714FF843F3191BD8BC9ED19",
        "I_46AF92B03D94AE91F05F2694DD28503D493A90FC13BE25E09CA603F2D0E99422.2691.1044265535.262",
        "CD_4C30D2B0F562E7ECB133EDD52DE8120D85640B338DF07115C2057AA8BFDCC64E.2409.3604284586.359",
        "CD_CCF174B484763861274B422B027A53D668C2557EB827A557AB0E7FF6CCAC8EF5.1784.203986476.652",
        "CD_BBFCCB444CF66AA09AE6F15967A6865175BB0ED216D19970A7988B72CDF0A3A4.298.567152848.4422",
        "CD_E4346FA7675883A4AC1E72B73F27717F3DF9FAD2FE9003A5A4DA0ECE1E363C29.2606.3331361592.260",
        "C_B706BC14333E9F557E01BE09BE8FFA1FC0DEE90584F33ADE84BE299A35433F7C",
        "IL_7FBDDBAE6CB96D89200C669496CB007AB6F15C0DD26E01372172898D662E64E9.2684.1332104763.288",
        "I_AF97512AAF88C1E490EA8C8CF424A8C0BF908E966E533AC4E05645CBCE51FD64.1015.3880470037.299",
        "R_95092F78A9C37B9D260D753733F7A0C73EB4F2C2027E3035DD546DE4EA2081AE",
        "C_CC3EE48409603DEE1E986C935018AEA6ED00D5C887B2B6A22814F97B2FCF9344",
        "R_E2B2F2A9C4A7BE777C95CFBAC1ADF577ACC960E4E5C2F6E896E757D1BB542084",
        "CD_B18E35596C7AC0C7A9B67022489D5864495B96E12E56FDACDF13C1E2D5D12666.2060.753767182.4658",
        "Specifies the printer that will be used.",
        "CD_5401A055411F9811A09125DE8462BF6A4D708D8C770ADE3D670BFB9DAD21A39A.1829.182174224.3326",
        "An entry on the object's SACL",
        "IL_13770FB29B535A976ABDF141714ADA919FC9C51EFC37EDB5C1E955ACE56BE9DB.1940.2396701346.301",
        "R_0CEA2BFA85C402C6870520D8882306321579F18BD47E8E598ED675B423931597",
        "R_75718F4326DA5F211EA5E599736AEB4B062053726FB954E7CB56C0359501D763.1520.42189104.520",
        "SEL_EVENT_DATA1 is valid",
        "{0fee8708-df65-456e-b4ca-fa623266a12a}",
        "CR_68708B0D28964CD8F016516FC22BA5B964B21C85D4D8AED50B2A4BBA811EE32C",
        "CD_9B5F61295CB5EF58512B95264F50C53A1EAB89490A47953F5E027131D60A14DF.1758.3838567022.727",
        "C_7EF96F2C01A6F5A405F830ABE0BE0746C626D817FEEEB605AD8817C16046D746",
        "I_B02C06EE12AE984BF1BF93B0C21BB33BCCA2B3DCDC5165F334E449E4631052B4.2718.2086711136.276",
        "R_455876B64E565F4962FC035AF2C8087D1797E42AAA9586F45C5A3E20F37175C3",
        "I_88DF7CABF5BD1981831821654FEAF820A29780F13EEE1AF86755DD96BDDE9FDF.2414.1957521491.329",
        "IL_D7DE59686BCD2B79BDA96BAA2026C9FC64F20126D69A8956A074108FA2266443.1097.3594349353.196",
        "I_25E364819A71426ED5E19DF77CD3F52F56BEBD4EC6ED9A7E80FD26BFFF23148E.99.1016060622.358",
        "C_E6CDEC66D704E11F45B0F0D82E7A048CB93CA008B57E83A2372C128C06C6ABCD",
        "R_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416",
        "R_5B81692050F83AFBC70426A27EC09C2345CAC4183BA0529AB3CFCE0E87409447",
        "CD_23A50366135FBF364F350BC34F639BE141A61D21A478BB4C1230D838F1296A4E.1136.2346883401.533",
        "IL_9E27032EA77C22C71E928D6C54089CE950FF131DD8D26C429BA0946E9CA36A19.2711.2801621187.290",
        "I_AEBBB507A29E8F338269B9CA27CFB703530BD08BC38B11D5941903CA1890F254.2544.2937017609.263",
        "MSChangerDriver",
        "CD_211E06180BCB1B723514A6B61A4F9437E8B7FAF07E83A8E52C3887B5E0B0CDFC.29.1615907457.524",
        "CD_ED4454436F5D89AB54BFEDBE7EEBD0A50AFC4CD518207832B9D92042E30CAC88.1205.3750355881.541",
        "4D004E2BC1C3C9AA54865F4",
        ",04@8",
        "IL_5F52E98B4905E86733B57BDB8229A4CEC75FA5749D918B5DBC7157473B48B71F.955.1.13002",
        "C_D760BC36A4E7F2EC138BE2205EECF2AA17893C6B9D8DB739718A0ED0B078D4B0",
        "R_B6D5ABBE2F1027301C23A1CF884681090FD42092F2E95A0F33AA6207C9180DA3",
        "I_1D427920F21F3DD4BA01BE50F4E02BAB83B4B3097E5011AD7F3E266529D4FDF6.2706.4084289774.291",
        "CD_D20240298678DE7FA3C580B599D2D13C6F4AD796F634F024D78D97ACD858006A.1120.1.33012",
        "CD_DD0471D542F51C9EA0B9D431D1C99AEBFD6E3F5C7A54107E961A136C056FBC71.1560.1209585044.1486",
        "F9D9DCF7A8F92",
        "x8pD$l",
        "I_B6594D10423DB3AD91F7281DECB505C7018BF7C3DF8C8AEB5588F472A97F5870.2680.1562761074.290",
        "C_CCEE854B1D930229DF6338E9BA0F93906C83079906FD6A63C0AB3CDE6382DC6B",
        "CD_B16263CC6C59AA3DEF58BA0C86C651F601D7D8872D7821EC2597A2AFC1F04035.1153.2282918380.263",
        "C_09249AB2463DEE8AF9E6045D6C53614F5DD03A6CDBE2B7EB3990B7FC319F1979",
        "I_66834ECAF8F556D28A19655C0EB4FC65BB6E8CB3E4BF5B77E618C62A9EE55F7C.2699.1600847271.262",
        "CD_96C0C62C985812B4BE911B17087624F5F181BC4A34E4B6F778659666F96320E6.210.2878211262.6426",
        "IL_8B1E3F8EEC98FF9E9A63E350C8B58C9798EC80B84653C13E848134F7D8974F0E.2726.1034906803.278",
        "C_0225910331B79FEA7A0ECC2E4C8BDD189B002B524044FF48F864D7BDEF12F05B",
        "C_81BEE9AF275D13FEF2328C144C0EB35B9DFCBDEE7AFE9AA908B2E35566F15BC9",
        "I_BD93AFD54A2CBC0AAE6AC538B824779A9A1273B2B91BB9D43D9256B804C5A7BC.445.1.30870",
        "IL_01C03DFC0B62C3B09F74501F0C80260AE479ED5CA24F033FE6FF5F8BE8E1A046.2736.1864099098.284",
        "C_0C9AB5617BA8A9B7C3F74C1EB3942161CC46D714C581CA50C949594A28711EC7",
        "Unique identifier for the port. This idenitifer must be unique among all ports on all adapters. The same value for the identifier must be used for the same port in other classes that expose port information",
        "1C3C9AA54865F4",
        "C_0A4592DF371B0F1C9E35DCF899DDC0B30F2B23CFF106F5805254E0E64E1E04F4",
        "CD_17F8BC3833237B1EA834BBEC43AD4224D002BECFAA4FFA94A67748C23C3FA2BD.2614.2100074799.398",
        "!T$f'*0-",
        "CD_8757FA834BF17A34F40DA9E567F73EB3C0F519BA77B457CB4D641370202A1355.30.3835615438.1748",
        "CD_0BEB647503DA8595D54DBA8F17137DE78FF091F7255EBA5AB7ED2C6BFD16F66C.1776.3520103933.698",
        "CD_78AB2C692DAA3A4CDADED46AFA07DE51142E7138D313F37FE748C3A17F36D445.143.2365530000.488",
        "CD_5CA50576C5279E0DDE375D3AEC8ECA8E1927A238C54501EB1C8A33D455D3852E.2647.1884794954.915",
        "CD_2F43B8EB8E14762A257D84DCB10913E4CD9E8069D8AEA3384120BB143668FB2E.91.3074961256.667",
        "CR_4956F7377CADF88BAEF29AB167534942D2330E0E6BECB3AE4512BFCC91561A1E",
        "IL_AF84A75EB301BFDAD9D850AE7DB9A8A21071085DBF56B1A75FE90C7F0D1A63A5.2687.3073945273.263",
        "CD_7E73D5C93CF19F468CCE98DAD50343B32B26C1D7418728E2E4E53FE1AB834CE2.2596.1797100381.354",
        "IL_5A83D395085B6B03108F7917D2C4F3D0683B0E479C446703225592BD963CB748.756.1.38386",
        "KI_FD3BBD4C42AC2F7FEF264340A9EB78A581FE5C28561CB63EDF780B329EAC2EE4",
        "IL_6A62672AACEA57C9A845CABCFD1E4FE73986B8CD9A6F66FFAA553BA275F4C58E.2699.2089849673.270",
        "CD_C21BFFFCE15B0AC36B6B41107E5EBBFA7DCF9522B5F1767BA6C1E65ABBEDE3D8.304.14933742.980",
        "07915BF46D535095C4431D97FF1",
        "IL_F3D41943E36B5E476DE07681CB51D0F3220555F0C26200540E34E145F358089F.2695.3945938787.266",
        "I_91141BB6466293A25E1F7E2067862BA8A742A4E89CC04E0986697FED67A0F56F.2682.1146603662.283",
        "IL_5D18D363EF059621321E7E50BB3FEA37F3CB86B483AECFA4BBCBC0EEA9479CB3.2704.3796635195.285",
        "CD_B22B427F2794F083D59CAB3CBAECCCBC3A99C22CA4382A86ACBEEBD3E7AEF4E7.2424.1729190805.294",
        "CD_0755C98F98A88832CE4AF388D7FD0A485984E8C8093D5B69AF797BCD21D684DE.1528.745101946.5361",
        "-03Z{W6H",
        "Fastest Available Processor Throttle State",
        "C_E3F89A001DA5EE91F79A2D2864297FFA57BD7325C564BED3508D999C7C7D3F84",
        "I_14E81FED65CA256A291552D7368076BDF086E65B079868D33E50C9799C909A98.1072.3778842915.297",
        "CD_174A2AEB54BD548E043873CC69AA038DD6DC3AC5FE2EA12ED542CDBBEFBB3320.2334.81476941.242",
        "IL_B7AB74F9882BDF78202B38ED087C2D749D94DCB49E9443E63C93252324D94824.1053.2878101920.354",
        "Source",
        "IL_CD6B6F5815E24B10063DB26980B56786D2CC20440346CED85A69453A578AEE28.2705.521566262.291",
        "The MaxPartitionCount property indicates the maximum part count for the tape drive.",
        "R_35002FCC142049858649CB1BCD62043BE23AE98B3CC34288C266F1C2B8C4A3A3",
        "CR_3C22EE36FF380B4D0BD35CEC3718A5763A272DCD4163EFF8590784BADF9E36CF",
        "CreatedStorageJob",
        "CD_33415365332F60FF3FC53C2730CA458D611DB40E1531E34D8C7BA9D358168B16.1780.2705667263.302",
        "CD_651D061E01CBD32AA7F4244272DDDC49803CB2C80CBD43AB9BAF178BB7D52D97.1103.2828722665.832",
        "I_9FD082137700729C3A00983D83A072D395DC7E5AA5061738FF9BBDA92779EC8F.110.3090168130.317",
        "R_A02E4DE807A967071F3CCC0BB7E11A05D1B737BF35623B994B44E1AE311CDB17.1730.836115015.536",
        "C_938698B0DF6D498AC9977F56BC06022F271BD32FB79DBFC9EF3962F022C26E04",
        "C_BA2C021F642EFC72B5ED5FC31813540F5BA649D97F9C2021662B9F43F49C356E",
        "C_C237CAECD8C698DFDFBD2478B07E83E6365C4D353C8CE8D43C5B6C6DE2C2F702",
        "I_62E666132809A0B2045A7CED77F69F241DF685F7B744FE5ABA82B2F09AC381F3.1015.4071010401.338",
        "CD_3B7D8DFBC854CE2D148848B1855225C8EA3E1B3A395DDFC5824D621B522459B0.299.2136335891.3085",
        "CD_F71CEDE68D110C46E631A74BD74BB02467459B066EB8F2E32432A8044C4EFD32.1355.4141067860.213",
        "R_336E7A880175CEC7983BFE0692AA78604916DE79A3400288DC3CA68EB96A07CD",
        "CD_C4EC6F9C19CC609C72168963F8BBE9E684E852B0E979641A1AE73D82D9DEE88F.1349.2466332719.537",
        "4908E742B64A7C6E08A776FA3C9E7E3DE6507.2762.4186282536.784",
        "CD_209458F88A1FA5926D961F906C3EE16D4AEDEBCEDEAA8A4730651B0B0AA2C3DE.2580.3587605349.216",
        "QueueName",
        "I_1725976AA79975B78DC13B98486DFB84C86A24E36784407E69AB1DAF8F54E432.2691.3362428702.264",
        "CD_EF24FA098DD374D95C101EAF1EFB06042051D9D0523BE6004CF30C75E16A8C5A.2665.3048734528.1019",
        "C_30A8BABCE38054F1FCE6452E0F348F3D9BA89959F67A425751C931560042A8E5",
        "CD_057DBED191A93075F16FF3FD87CBC67F17C999F14E2DB4CC2AED9F24BB4E2107.250.1126536881.972",
        "R_7BD86541C4D37094DD12C29DFB358834E34ADB28AD42E60E36A946EB5619F833",
        "I_7C20621C04548080C1EE521AE245952B5749C3FB727288FDD27EDA07E39B175A.2505.1748417304.294",
        "CD_96C0C62C985812B4BE911B17087624F5F181BC4A34E4B6F778659666F96320E6.72.1010787992.2831",
        "I_D67FA0E2D6B2C1F4DFDEF7C2BE6EC3EFC58D057198BE2F40A898AF1E61F9C357.2735.1414614919.255",
        "IL_092A55272DD5776D1F8B56BC2DC2767240A3BAAE69BF8801B96D23CE4A45B158.1089.1901740824.308",
        "C_B912E80CAD3BE113409EFB3E8B7938FC1D6B94652ABA9A1C88A43589782E998B",
        "InPartition",
        "R_30C53A78E5A4B68CCA584E17EF756F46F9A296CE6092725A408D68B59BB13207",
        "IL_833F6FDA2E00DF413E2723623764AB9B5B7213E964FAA6A9CAC0BF6627681AF4.2717.2093948589.287",
        "C_1E99B42A14C8BDFFB63BA2F8D428227D04A8E5DF131E69A53A073AA04FCE464F",
        "C_EA6D636347E78DD7F5DE266FFACD22FFC73A50A7A4638C0F1C2AE320AE6BA10C",
        "NS_5456CA76306BB18057C7C64D8BB2414E19DC9CF4F51E2760534CB23439D79B06\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "I_AF7867B9AE5D20E558CB91D2040C206D22A53D2E9E3016E0BA32C334607A2EEC.2712.1177730705.288",
        "ACPI processor idle states (C-states)",
        "IL_A2D6D5AD8E257108C2B31DAFB7683989E6057DD0B17DF9AB813C42DEDDE1FA4D.2693.1593862869.280",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1075.3252102185.312",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2450.1770376816.340",
        "CR_6F6CD8CF6EA45E347E510153C47F4A156F13C2264BE2BC47D09C5D940D064846",
        "CD_D3AFCBAF22653374F26FE8337CBE6005C90DBCA84C064E5B13CA4595121B7209.1.3839519982.246",
        "C_AE91D46A333A370D09132417089AF125E776EF57E4B0B159D0C6DE0E14D65D5E",
        "CD_9B3B36A993A462F50891454718B9E94854BEF6CDA6B45E39722B69B985CF4900.57.4033440126.2518",
        "CD_3C61ABEFEAF778102D0BD005D591A85A882509AB85CE543323A63CC898834695.1156.1.17929",
        "Friday",
        "CD_BA591BD8B27F441C811869BE1DF44DAE00F08BE9A7051676EA2B61A487918FB4.1209.4235352743.5690",
        "IL_81E1B447115AA495169E968D729B808E6AFAAA8904F1D6ECCF6F17BC5CB9988C.1094.3764814740.252",
        "C_765084E1887D699089D5053E1B6F8275CB71A33668FD58E6595E74BE3D526F1D",
        "units",
        "CD_CF7E5037F6563CE949872FEF4BA72C8CE3F9C68DD9A3E9BD325E8B9ECC946118.2110.2076643787.548",
        "IL_962F2DB2AD265FABD532DE3B6561BE5585796B679B4BDA8879404E300FD7A445.2750.3196256677.360",
        "IL_ABAFF26A954D1C98B7369DD9DD561E63B101887A4E8D958C085057A4F843012F.2676.2286314530.275",
        "CD_901AC56EC8F00C00FBAC686F0B7E1614E207CC1998593D930358F2BBE88093FF.2744.2829061612.503",
        "KI_BBCB50A3E35BB9672B8B458A16DD242DDDDEA6BED48E25ABA8EEF2B0E49A9B3E",
        "IL_D425B22626A38B1A8ACA71A62D647C7A7B5249DA5A372A8146B11E6EBB227ED6.2735.4248770693.273",
        "C_79C99D491B31E838D4F4A34A56F06848BE2DB0B4DAEDE7B1D57503CDA3A8ABD2",
        "IL_F07C79FD8AD4B3975D680E2786F5C47BA9D65B6E33188A32492BB28A79D1D025.2682.2763645577.285",
        "5EFD82F1B471DA36BAB7E9FD9F20FE3AA31D.2726.816054065.282",
        "UdpIp",
        " the method is not supported.    - Any other value indicates the condition is not satisfied. ",
        "CD_47B8D9FB99659B3546500CA55AB79FFA62B2FC16F96D81F5B390216EEB78A7A9.38.1750957004.1932",
        "CD_EB7FB88AC460423B2EF1D915F61B6413B02B51C59DB82123DFBBED2259259B89.2528.106078903.504",
        "CD_92C92331781DF35B14382C2C18FCF4F9CE2A3F0D9A27B8F847108A01941602A7.1677.2625940685.329",
        "CD_C6877D93883C0A287546253E157907791BC6A0C92D8F12064B0617A40E589308.1533.1280164115.3922",
        "IL_98D9637DFF75E87222F5EE1D6ECAC855AD744FED98F1A3D93FDD69C3F245A650.1617.588610527.341",
        "C_A5FD9006F591ED5732AB7421A9D1052D320909DC0E83261366D216CD47F25E4C",
        "I_34547F30EC4DFF60BD1EDC05B32BD2A1400337CE4BEDDD2715FC2C2B689008D5.2695.867217882.275",
        "C_E837FA5B478BEDED44320E3A480DE1EA4A5820B99185EB351156356529FE5C28",
        "CD_329C7091D99134315D75F4D3A2328F98C961B173B884F03A89824A063291C3C4.133.2590023805.536",
        "CD_649FF30F9409CF8000973FDC7FB1D031F4107A8688A55A6A51271D73134EC398.2636.3873998933.945",
        "WMI service operational parameters management. ",
        "DriveRequiresCleaning",
        "C_2C20DADFFEFB0D4F975C63DD75672A978E1E07AB4428454CD70C2EBDF11D6E21",
        "I_F7A16C27DB2C18FB3C22599C6F665CF9B9A16181556B584740B482C60B55F16E.2692.3001110296.283",
        "CD_4F3E89FFD328D071A7EF820B6542CC8779DD91A8E0E7900B2A3BF4F5F4353427.2156.1.9195",
        "IL_A6CE1EF1E794162BC8CBC26FE1AC4E7CA717DE3E44BF2C4B173BCCA10F4CBDEF.2710.2445353677.292",
        "CD_DD3FB1A6B8FC9755CFB7A3BD7A61E1F24E5C869D8697CB909E277ECC11293496.1961.2495398770.3519",
        "IR_A963FF6A8458E9C4FEA354824C031F4237B8648981577F19FD6854C86994DA8C",
        "C_8ADA84493988CB13166A203AA8DF1C3ED4B8B45C03D981328C27F806EBB92047",
        "I_73743B4EB2A5F909581B64D1890DF2596BB60EC0F50E374FFE9EEF7294F21EC7.1607.4124435553.206",
        "CD_5378B299266A56152DC649F543170D9E07DF4C60543C8B9C2F666A461A2F0442.170.3063182996.558",
        "IL_1DD976C2C1EC41AE2C2E9AE437798C835C95C683651B2DFFD6DE00EF8BD37B9B.77.4005104059.331",
        "CD_390D5ED0BE7821A9A41296EE6280A1479152221DCE5D93BE2F8AC7791409FDC4.7.3968487185.261",
        "I_305B49C12B1B31A5FC4646DFD185B86544D457A66153B72C296A254EFCEEADAC.2698.587046638.265",
        "CD_379B4D9DAE90D396D3C5FB3179406DE41BED42150703F8F56EEB2ADABFFEFCF5.2570.3688459858.398",
        "C_936BC108002D796CB3D4C11DD4392A4B48E3CD97B36DACA42B975D9D84CC7463",
        "C_5BCEB01D612DAC6C83C541730DF52A080662FD232D15DBFC020834AFD4253865",
        "C_596EF184AF75145FD253B916034B629E5E36C13CEB7B67258E544A06633F43E1",
        "CD_D64B12C2A619E8EC9F45DCE9E49A35E068B0A85B0C1FC30DB6BB343CD56AC3E2.1193.4120340269.248",
        "04F2FA39C7A8BD8707BEB4F5A372DD531987B409839FFAE50966",
        "C_C446284C531AD33722FED92B5707E137291BA408988B095293D49122D6D19961",
        "IL_E7C8D1A4E2346FFDEE37907DDFF48B4344B5DAFEE4B2DF86123B0112A39FA3BD.1929.3453402987.280",
        "IL_66C8A359E47F0D1B39D305A89E658F2EB641AC331B4DBF2447797A4211DB63B9.2688.59886864.269",
        "I_B2979C83544972870A2ECB51F3135158FBB5ECEB65EE0B9FDCFBAD64445743A0.2680.2462356620.290",
        "1.0.0",
        "I_760CEE7D587790884F861B014304A0C2F694A3595D60743DF14B6842269A95F6.2695.2208648517.264",
        "CD_5125E87B865F9C6DC59486D1BB02124F8523E09293ABB2126C845245277E44EE.2197.3343646218.2001",
        "C_A38B1C74206B5E91F5CDEC753D09CB9C1F5841B8BFC4BEAAE7C08A9A46E04356",
        "IR_D00FFED55F65DE783594EAD7DBC0B2AFA1FD10D2673E2E04CD821800708CDE15",
        "CD_772A091866475C0D90401E2D449ED248747158E72AA5FA334574887C1703B328.132.211556165.948",
        "CD_80AFDCC52F3C92AD7D0F8DD0B12150C7B0CC34A13BF2D3DD52C62A73F9713B79.33.3510950853.502",
        "CD_FD4BFDCF85609A332980A19BB1E61752A72B4581A198C993B54596D7CA3B05E9.1190.1099608737.611",
        "I_217F68307E9576428FECF7D9B86DB33478B7ED46B1F8E90B85E7D09D0E5455A7.2684.271337700.283",
        "CR_6CE5293A4991040589451CEEA5CB3FB1F0BCB9AC8B0C16A2D34DE39822CD1F34",
        "CD_FE094C1FB84B65B5783A09EE15B884BF95BBD94173D9D96178608B50F8C0ACDD.2538.478180821.506",
        "CD_E0E4C1D1D6DC9C06253CC569DB312A50A778443F11175AF9AD65FA40713C0F4E.1068.187184230.1281",
        "C_D900AA79F2E09113EB5CF87ED36150207AAB2E0DBF0F9D43086B26B7638809AF",
        "I_12F9C45C633D9A35EAD4B21831269F92F066A3C04FA000604BBFDB67F87BF6AC.2503.2850609599.298",
        "C_AC9AD25BD40B6722261E256701F4549D4AD6E3CDC6187FFACB6CAF3D4F5CC978",
        "Last Write Time",
        "IR_D5FAA70AF9F9BAE40FA47833C07D0CC366DB83E0973CD8E9E5C121D4195039B0",
        "CD_0225910331B79FEA7A0ECC2E4C8BDD189B002B524044FF48F864D7BDEF12F05B.2490.482081186.181",
        "IL_8A284882505EBA2BE9CAC311031BB8A28F97386D488AD21523C9CCEDAE5F876B.2702.4008995715.299",
        "ReportingAdditionalActionTimeOut",
        "CD_231C34EACA6E9E68FABB7AA3DADD079A379826158D2123254977F7CD79559E18.1086.1968721544.343",
        "R_50988C8CC93A3243BAA0056B1B959C7138E8342783269A1D2B5E4A28855995C8",
        "C_6F6CF7511ECB359E4989B369445873C82419FE289E80DBBC274B4D32EB4F802C",
        "C_A2D35C5C5ED7C049EF3C2376FA4E7B1FAE108AF8E6C6E786BA37F66F3B83AE4D",
        "CD_93A56FD79060DE7C5C63B9201FEC3583B30A043D5DCAC083E3F4C84A7931B27C.2422.3334472612.357",
        "IL_1035B0F62EAAECC9C984E7834D0AB6A9928506852D8C840D14F9BAB2AAE4A68B.1539.3588731573.286",
        "IL_7C3E534A07065323D9E854343BB05DB17EE8BC59056ABE62A90059C6FDB8B0CB.2675.1117108057.275",
        "tartWhenAvailable>",
        "OperatingStatus",
        "C_3593792BE66B364C91CB864BB99BBAAA7F25D2BB3385AF25FEAE463E3985026A",
        "R_3EE174B01792C3896222E757E49B9B60C68E15C93D8D9614EF55A8EF89C4DA61.1475.259980034.606",
        "C_A8E00DF275B2FB47AB36B812E4750AD4FD2F723726632F4293D0ED256BF3B071",
        "CD_58F7FDBEE520602801F9D69F9D9FF6E34217ECFA7A2D83A25ED10730D304E1A4.1498.4084800669.624",
        "I_046F9BAB5DB10B91372029F5E1E0C875F6B0CAB137714DB3626682ED1DCFCD07.2715.3384421242.285",
        "~THu'",
        "C_886435BF24EBB4BE37078A5EB6C7D44E1EEA23CFB6DDE7EE3C70C44A6B800533",
        "X25 Facilities",
        "IL_8496088B206D2FC48938FB34421304CD43C910D9F8120D7DB88587BA11A0380B.1090.450606569.339",
        "C_5D6BC382B6560C1A0A110793527B8159D7A0FA27CB962A1A5197752864C1F0AA",
        "CD_818DB2B3AB26C49A2AEB1D243B555363E794DB6E712436AF8BBB2D25701B24B8.1103.2528045833.839",
        "IL_8570503164C3E8F3B9C94BFF6399D93AF931609B17DF6767C04C0756DB0CCAC2.2702.232560908.286",
        "I_6AB7FF86877A69A2199854B3220F74AB68A2E4627C6AF2DAEF65D55543EC0952.2736.2890772573.293",
        "CD_E7845F3041269988C5A1847DE98EF0D88E59CE50ED3A8AA1E310C1A1F393BB81.39.79970766.239",
        "I_6EACF9EBFCA10986AA504ECF943BEA549FB8DE4850FBADD0F165D6E5FD0E4DBB.1010.1.30190",
        "I_7D726A53C2E109A7102AA0733AF15E0ABEDDFCEA169FD750AACBD377D8D29F56.1476.1899862249.277",
        "CD_5736C87A30783FE64957593D8F34FF03FFA145529E369A853C7692EB2B1E8349.1187.3981689095.290",
        "IL_AFE17534F0CF175B4EA4D4B8523895715CE1CEC713492499E62E4A42AE93383D.2705.3360731278.290",
        "The unique id of the storage tier associated with this extent.",
        "IL_8849EFC452EA2D0F6C3A7A0190564B79C971B071B8FF493DC4B322C80DEF00E0.2698.49099057.265",
        "CD_4BB71B6ADFF06C586A8BDF449E468900F2E5FA784A24501C7DD0806A9C51B570.2041.1898443703.574",
        "C_888F2D9B25BB449B1BAC54A21282A4102E2AA23BFD3BD4A5CFCE4F20063B155C",
        "IL_35B3BA3D4E3452B9FD358FEC9D1F382046EF61B6EA2F3D32FF2B776BA565D15B.2749.851527284.306",
        "CD_1414268BF3C6238A6AD001B5A24A141E87C99B65D66BDC84E11131854913C45C.1050.3950922578.520",
        "CD_942CF06D69278E969506DEFD551223FD0C23BC45394E9D8ADDB78467847321D7.2418.4088662771.2756",
        "C_943386A936885D346F0D61FA24D7BB2533B7B797B4E446178A40D4E6F2C1683A",
        "C_5D0AEF52806F8763B3001E7A769C04ACE567BDBFC936A90209336B42E3069741",
        "CD_6F73B9A2B12D45B24BCB52C42189C1E085234262A13F966817C266286DEC680A.263.3285925022.333",
        "KernelPerfStateChange",
        "CD_B209BBC3E9792036932058EAFDFF59DF6B02D2E0E24C683DBB3CFAD2B25B83E4.1083.980680094.631",
        "CD_009060D2904B4B02AF55083DEF7BC672283599AF1BEDA6D3B9EC703CB3D5B011.154.1949465910.785",
        "X<x`@l",
        "IL_01AAE8C1ED007492BED23F4B58BD059DDE728603531BCDDB63F008450139C6D7.2696.2556155962.273",
        "The drivers for this device are not installed.",
        "I_3985A64DD548C159337A855FB2D96B222C50720949C8FDEAE049F7ADFD2826A5.1782.1431924164.280",
        "CD_59A8BCB9F6971B321C776BA9F2959B669CA7F5AE7D9DBEF59E2C6406BCC884D3.1791.1.11296",
        "RestrictedSitesZoneAllowLessPrivilegedSites",
        "C_5255B80468290401F7B5537740678AC23F37D96AADA8BC3C2DB81FD63548D25E",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.100.1101669734.180",
        "IL_5209325547C4C3DC85433F489AC2215394EE00249CB48AA92AD2B0B6C8014C31.92.3096110434.283",
        "C_B28289D1B5763AD76E9600ED77D5A2567F24D84C53AB89BDDD8D8E52A4812973",
        "CD_D1B2F4E6056A69A2D8AF80AAE4B443CB0029F3E62BFF8D77A98B6230DF9AE6C1.2178.1.35418",
        "IL_D376AC0BCAB3A978B0A153526D20BA9BF8C690AFD128FFDC2480BEC2DB80AF0F.2712.1738099483.294",
        "CD_F17398737D28E7C45998B683DDF3AEF00877214A6F9C64D8C12FF21642BE4411.1515.767219292.233",
        "CD_65C33823125A389998EE918715634996D26443DD7799EEDA88DD0650D03B9936.1475.2534798520.582",
        "IL_B5291A6580526AC18DDEF779CC119DE64B0A41F8881BF1D75D1790F4CE044637.2724.364222005.293",
        "WDM Provider Internal class.",
        "C_563A4355A2BAD2D5AAD235A8862EEFFD144A0CCCFFEF1AD7B721B7B6BA3DB30D",
        "A string that provides information on how the primary system owner can be reached (e.g. phone number, email address, ...).",
        "VirtualDiskUniqueId",
        "IL_73B465B61BEE7A212E2CA5D75FFD3AFE147A54A530A57D0EB687B325EF612EB7.2691.796199948.267",
        "IL_9941D4A730650AA796EDC14E5504D4BFC2FBCE2F80390D817AE03973C308A837.2719.1003903223.283",
        "C_1C06FA152DAF97258D99D731FF917040529592936586FC456CA74403EF6A2F73",
        "IL_820AA6D258E77F336189F18423606FE1C2610B1E172F224DDA0DAFF376C8D78A.2683.2252325565.280",
        "CR_F9577C2F184B32F74981B6FE74A751DF70B09D37A1C0992592B3A2A75D5D48AB",
        "IL_5CC34176421F47CAC35062197F8A17036171A98B1F40EBC1A2860E5AB784E21A.2696.2884669679.269",
        "I_4F5BFD54BFDCB120C9338CACEF0C2FAD83DD681A4080EF183BC2952802410422.2684.2561231253.280",
        "linkItem",
        "C_968609C9F28B0E2C5D6734E1BB18A4C16D987F2BF5ECFE9A272B7D3D95B9C7AE",
        "R_479C79EBC313F0C9885D7ED035558984DE29F129D7D42110CF8E24E5D81264DF.2750.2629594489.576",
        "The version describing the creation or last modificationof the specification. The string representing the version shall be in the form: ",
        "CD_559C5EF519C1325645DA42E84C00BB0A8E3127E1C2CAD3C6D3C28A084C0B62C1.1749.3680759863.345",
        "I_058A5B1FB7DC952F689B612BDA615642767025FE637F2552CD2356FE70E70C3F.1714.1529246066.345",
        "IL_9201624D17A4BE3655D1047FE2810DAA712529F35916C8FAC2518C5B06EBF16B.2710.3485559487.293",
        "IL_82D62EACB411F46C88EF11FE5A18F1088AEDA0897AD63F2947178230B7AF5724.1780.3306664901.199",
        "CD_EAB9370E6F0303E816A75B33B853238E66F81872D99E818B001BE572FCD0B89A.2042.1746916102.1916",
        "CD_54B484B8C5179A454100ECDF2DB8FC85525379AF704F06F9B2379CAF47C81134.2631.1717605202.846",
        "CD_E180FA56BE25537B4EDBF25A70C610DD0A17358432E8B0D7F517AF0A54245AFC.1741.2380761687.514",
        "The current quarter of the current year (1-4)",
        "CD_1E626C3D32F7EF024573AE985B5FB35B84A93E624F99B15B594BE7E0989B4A14.2550.2616091821.650",
        "CD_68B1777F67456D5D5877E7FBF4B836A9D3F5815E69514085564EFE06BD03ADB5.1191.1582829780.612",
        "R_2F43B8EB8E14762A257D84DCB10913E4CD9E8069D8AEA3384120BB143668FB2E",
        "I_2C3E0B2C69ECC1F533E094C6BC0D6FE2FF50B62467F6FB0D4116BA80049303DF.2505.719625217.277",
        "868D25FB187B8F5084FDA0E03D9.2575.531492545.792",
        "C_5C5AB2F5F8F966BB634B5BDAD222EA2AE9371E40D37C49EF5B43EA71CE83231D",
        "C_4922BF9FCF270243FFD4F9D426E064C4BF15B5F3EDE04C2DF03239BF6E262DE2",
        "CD_765084E1887D699089D5053E1B6F8275CB71A33668FD58E6595E74BE3D526F1D.1620.1508532397.436",
        "CD_4F0DC2D766DE63D22C2118312C7C8A4306FD995CC443322263FCAFC5C5AE9AB8.35.198594476.421",
        "I_E1F2E9E694FC3E6DCEC59C12E874FB421C81C7C8C6E51D83EC06148ECEC44681.2728.3038766463.296",
        "RSOP_SOM",
        "C_E284DDF7F9BBC191C804CE3AADDF197ECFC83C10E016C1AED712528DDDFB1F1C",
        "26:>B",
        "C_B8E7124F48C023C11FAE803E1FFF7A22F4E8805CA5CAC5D71AB511201DC2D4E6",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1714.3433306020.180",
        "CD_5F24F19683720FD1EB4928C01BE6B72971BB4F46F372476DC9706705301704D6.58.816080401.651",
        "C_8415A398133EAE0716C73F02F5C279072A12B0ED56A7172F6985A7EBD9376FCE",
        "CD_703C562B7404A6234AAFEB9B3BB242E3FF62C76339F84C997DCEF89443C2DF65.1365.696672421.474",
        "The Sid property is a Byte Array representing the SID of the client creating the subscription, NULL if subscription is temporary.",
        "NS_1D70990137E7397FED436F11C0EF3FAAE00714CEC2B803AD7499863F985BD191",
        "CD_4B835375C85830D11DAA3F01F5AF9F28573A4521B9279B28C7605832DE3B39C3.1078.2801850289.681",
        "I_DBCFCBC22EEC426EE5798CBD5AADB02EA04474BB9D6D7248938C46C668E4F016.957.1.126857",
        "I_41B8B0D597082019C2800150A6FEA4D545F9DC80D70FC5EF58AE58F581515BD2.2725.3806191722.291",
        "CR_86063DABE8CE896A69DCD5B43BD505C1E3B2A298B4207DEC8AA9B679D5A8639E",
        "CD_C1960DB9FEC904EB68F599B564BB073D8CE89748EBA088D682E8904C932EBFE9.2556.2953269507.689",
        "CD_006AB7DFED58A8FB352581D21227922FA9FD887AC08F63A547BAEA9722B5F62B.255.1356877544.912",
        "I_3E78A37E1DE70357C353A15D6BBB8A17A1D31F8D501ED8F1C3EB8104F5B04F97.299.1936312436.336",
        "CD_E7A77CFEB598AEF3D1193E3884EBB6EE52359457054F97DF1C2F8041CD6E1C7F.2603.1566149192.1083",
        "I_B229F3756293E7BE4FCCE0D5C09774AA63F22421B02BCEF0E5C0437AA673141D.2708.963332799.292",
        "8052.2723.16826116.287",
        "CD_1E256BD8DCA98CF585AFBCD17E60B7F15C576695CFE9FBD18524E23BC8C6128D.1589.1622623040.532",
        "SystemConfig_V3_Services",
        "I_F2E3FEB3970C3254AB28CCCAFA698A79FE77936CF6DCCDA4CC054208AFF26367.1014.1518610667.301",
        "CD_737D301CB8F93905D70C42253781F901EC7FCADD3289B3588BFF04F6F6A13AB1.148.3209522073.2229",
        "C_4ADAB88E88FA3365EF115F04B0CA33E4C812E19F7552260C1DECF170F7399B0F",
        "CD_770B3A5818E49BF3F1927189A99E4669C2D51FD19867E9AB54F70E7A425CD1E4.1544.3068662244.504",
        "C_7EDED54BF5B36D8BEF13515E9D3B438A3A9E5E4F640CC2539BC6DFFDF6BB9476",
        "$(,048<@DHLP",
        "CD_E67DF64CBE3D01A3E33D2078FC61C5DAF3C494C4A4DFFEC9CB77DA207B5AEF2D.1533.130657779.557",
        "CI_E8E72C534ABA427E69CE6B883E8FFA9701DE1CDD9E04D7D1815F4420292F16DC",
        "C_C3B06A748C5CA18E21F932127722CCF781DEF129D3EAFCCF9594055AB3377559",
        "C_A23491B3C9DD8481EBD1370ABF1AD298CC29F6DA303209600E83B50112688260",
        "I_97E6172E74E893520E1CEAC14F93BBC3873069D2B734C94CAF9ED72724C5FB40.2733.4177148411.273",
        "I_F07C79FD8AD4B3975D680E2786F5C47BA9D65B6E33188A32492BB28A79D1D025.2682.2763645577.285",
        "IL_AF1545E3E9473774D45C765A92E2BEDC8713636EBF919390866E42659E2E4E71.2718.2764728285.275",
        "CD_027708FDC4F21C8AE43624362617A067ABEAE7FC96FE6B2F6BAB070555EAA6F0.197.2789269034.819",
        "NS_1BBA01731E96C19D0D6219D5469AEAB5B51946F70955812074A8F272593746D4",
        "CD_A3EABD4D2E9029AB4017D33BB0D0CA4B663683B46BF99E6712A276C0CD3CD0D7.277.2028116053.242",
        "IL_CE6BAA8732DFD450A2519BBF2ABA9D35BC651D3178155CEE3AC5A90E699CE145.2710.138949027.299",
        "CI_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C",
        "CD_20A86FF9BCE2704D3211C5DF2F6EE611B397EFC650CD0CC8097C4D642C5980FF.1616.1677216620.673",
        "I_787A200B25B0F5C6729D1D578C8F78CD412BA6F80EDCC079C80146CB69F7319B.1105.1363291257.319",
        "CD_99987ACE788FDA6044200C5CAD36E8FBA4C6DFACC2585158E6C31C93918E7DB8.2116.1514180294.987",
        "CR_3196586F94E9CFEA6D912774CB2A6C6FDB2471424853F54D4C0F4EE4F94880DF",
        "C_39D7EFFDA11AE4B0AF9356A4C33FF1047BBDB65DB33A2E97D55D112810C928E7",
        "CD_79BE4703D74D1AEA9541FA58F2B00142CCE440AAF1482F39D9D52E228ACD0FC2.121.893329218.693",
        "CD_63879166E36DD9652B2DA0F13B468273E5FE81CA1F80A337E45AE51370AD3FBA.2565.4232534233.1496",
        "IPProtocol",
        "I_1FF407C7C73B47ADB554CCD7AAC85C16074F3CBF452AFA2DE01B23DCB19E63EE.2705.2059709073.292",
        "!$'*r-0",
        "_18CF4DFADB65FD9009884647249EF310A7B2E05DDBD0DAD1404A0AE55A5E4EE4.1135.1325045813.1018",
        "CD_46C4D7624EF726AE82EECFECC7D2FAFCB46460D191B35F158A7EEAE469E508E2.1152.4110002636.301",
        "IL_94DDA322336F7277C8F91D40563D322E5E4B3B88BF289C791F4F9ADF8AA54AE2.2706.2339987804.292",
        "I_E351839041D42B9806641F1E00EEDB7E4B172C8FDA07E122AD66C5B9F9ECDC02.2702.1960752244.291",
        "I_081DE5F9EB43C01864947DA4AF882FB1863E1DA519AB3901734A76A173C64485.2709.2397577002.291",
        "BExHKNQTWZ]`cf",
        "IL_E2D5D373C81DF022ABFAB7E3F3EC3983441E62E990CB761F5ED83B7AE7156B5C.2699.2824830913.269",
        "CD_FBBE075DD8BF09CF56F5E18528E64829DF169227E061EAB31220ED102922500C.2033.2124504769.219",
        "IL_96620A5CAD99E99B5F544A83F96C7A7592A14FD27B37CB8CD3039E70B600ED2F.2726.393489239.282",
        "C_39111DE6643E0CE135E3218054CABDAE5D22F63BCDD71E8E8F760C46C7306F9F",
        "C_0B2F1E4D65E20B886626EA752F67851C929ED510CEF4614AF076326308ED89AF",
        "CD_33CF99EE359367737EBFC91E6221019D46F7219044317527292271867795E5F8.2757.3051549428.349",
        "RestrictedSitesZoneAllowFontDownloads",
        "CD_5F2E90A9A61A21E31A81AEB905C87625CB9816F843D7A0D3E82978F41D9AF6B3.31.2675413555.1565",
        "<?BFJNRVZ^bfjnrv",
        "CD_E763711E2F865B0BD95274A728A183E97B0FFE938A90F67174325F503A036106.1598.2892012292.681",
        "CD_10549F8F6A0C1E0A975F931BF6E1962F49CF18068F6079CD179A794A32D030D5.250.3048047345.2584",
        "I_84A175A026D7855D7565477E8B9562FE04D5057189DA1A94988C809A141ED73C.2705.2188819442.286",
        "CD_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D.2006.714854499.1522",
        "IL_882A4EB1638524A596E9B8BEA150E50E37DE5B2011A8962449531201C84A2243.2730.4051854582.276",
        "IL_13770FB29B535A976ABDF141714ADA919FC9C51EFC37EDB5C1E955ACE56BE9DB.1938.551476840.252",
        "CD_18CF4DFADB65FD9009884647249EF310A7B2E05DDBD0DAD1404A0AE55A5E4EE4.1136.3462929138.704",
        "C_B45E8974D99AEE9CFBA3AAD1257F341531ED5809367CE4B614DF68E300B793CC",
        " $(,048<AEI",
        "CD_B29A98A457D552021C22397B9BC80DAB495B9438E1192734D106326447E57C79.1351.1341338602.722",
        "CD_07C552EB8842D691C4A22716140805262ED277A06CAB4124C417993F14E689CF.2438.1.19933",
        "CD_2E1AFD899A7DF39A097EBCA4A5DC0A90DC9AF124AFF6ACFDEB2EDD704346E50D.2655.867848186.532",
        "C_B25FE038DDDD2F923EF8124D01B661F160859D6C423BA1EAA2E76E8F1675384A",
        "IL_D980EB9E5642F0999DC4AB724E6D1AB5BD3BF32EB2B6ED1230F2BCEF6E536E10.1019.3058486171.300",
        "I_2167ABD6DFE6B00EE53C057BA8DBCC8AFF1F809C1466D5A109DAD9E407A9E430.2701.2076800301.268",
        "CD_D6AB8C1C24557CA6DE44D819F0432B2802C5E7B6285091EE8E19F537397B3A04.1154.1106182551.1445",
        "CD_118A1F47CDEBC2925C5ABD33020B702449ED5C741A93FD969EB4A5E3F92C27C3.1915.3880370587.308",
        "IL_84DBB136E33A9D65B07CEAEA34726CC95CE2EDA4327BE7B9EC86367DCA1342F8.2451.4135234177.360",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.100.1034273056.188",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2070.2825033132.188",
        "C_304A06ED898CCB38FDE7CAC4F5A8405E4EB20FA550AF775C3019C149EC097D1C",
        "CR_9A3419D1BEB3DD772F317128C59554641FCDDB696104EEE43BBF4385A72BA8A9",
        "I_509D2BD728FA4DC13323DE1A2C0546EA7AA2A78582D9A89051462F1268BEE54E.2706.2682599584.296",
        "50002",
        "Index not recognized ",
        "CD_6C45CE5327BFD1794DA2A5C6CE11457F4941795C30AB80AF27DA45757D38802C.2557.3094215136.670",
        "CD_F28C8DEA5C25BE79A5199D7DD956384256552838A3590739F763A55FCCA51801.2640.23448249.562",
        "9529D83865782726D8CFD589",
        "CD_2B7C33A8279680277817A99329ABE8DC59107022EF9DBDB1B01C276CB7BD1FDC.254.2778786854.551",
        "CD_AF9953288ADAF46B6D6FE0415DB0AD08628D78AD327F2410CE001231635E7CBB.2665.1709823310.822",
        "IL_E490D798737ABCDB6E5D228B467E1AF69440A4031B6956BCA530D036FE6913FD.2697.1612407047.266",
        "IL_5AAC9CF551F1189618983DDB66187DA5670A80864209911CA30E6690E675C330.2639.2511674085.276",
        "CD_24519863E7254E1D9B6A25D977E51817C344771EC7B62C4251FDF1D411B6C533.2615.700272829.699",
        "C_4752ADF61D0AD3FC745339A237E83C0674E08E78D184202E33EA183DE0FCD7F1",
        "CD_DA60DE4570557569315706E8539F2BA1D42DB73DA9542D7DBEAA586346CFF0D8.144.1574662485.623",
        "I_9198D744566952E9D937A9D8D71A6CC17D1A1D6B2B12D5542FD7AFC9BDA275B1.2734.1317171737.350",
        "C_DD5FB0C236A2C7E56EED8B73266A6183C862797CCE8508CAC667A1549566FB77",
        "CD_F868F055868CB444BDD76D275762DD6CA91787A71E8E2E82BE9CC7E971E6EDDE.1928.1555089344.300",
        "CD_30D380391F0C7BBDBEB938061EF85587FF8CAC2EB47D3C2BB31A90F771936E23.1836.401924110.291",
        "C_9E784A36A3818CCEF710DDD5C36D397926DEF1DD3DBF75F107C211B75FEBAA90",
        "CR_6EDB414A272FF229BB33606CCC694211C55817ABAE713A5736D1E4CA0295AB08",
        "I_C2E2D7F294A39E950FCB0FE91EB41D6C66630273B2EF4990C97F60DB582F2E17.1480.2071170959.317",
        "IL_2CE2D948F35CFA1BDBD91B796D298F0DCA6C5748C75623B3BBB11F195C1EDA61.2715.1170116677.271",
        "C_8771AE8CEBB5614A0203ECA1F5690F7C9DE50BB712DED367D1D2978F0B190194",
        "C_98DDD343F1A3CCFCF53110E519D29143FCD35034C8FA337D26D77DD90382C3DC",
        "CD_4AC1D3A26D87995319BF08535EEE6BAC00658FC9706A2D0A430BCE00D546062C.254.1770750835.885",
        "DMClassesOfDriver",
        "CD_1CB9E7DC27B4A89E576CF24BDA3B45DCE8B5B969797A00622E9D1746514F3E59.2387.2190182367.758",
        "I_66FFF9930E5CCC0D760D3BBAE923EAA766D470F40F422E860FC653AA3204A9F2.838.1.60167",
        "rsopID",
        "C_B4744AE091F96C1897CB0086813E1AABE89C9AB276818B172EDE2A19A9884429",
        "I_258A203CF40D0BB1DCA0464E58BDF32C1FE546C6E10F7B59F5BC4AD6787D2A7C.1053.1905666107.319",
        "I_33686629586F15213BEEDADAA933E939DE78BC842BA4B13C6CF85A4366271550.2720.4049715834.273",
        "CD_4714D9B900765C427A8C3A4D74360B2C569F951B888844030608A447B457F27B.2197.2224409893.2022",
        "CR_0FD0888899B6AE2520B6E2DBF0621375C2A450EF8AEE903A752140EFA51EAA5D",
        "lx!$'c~N*",
        "IL_799587A38265D8F759455FE0390B3A3F4BE7CB087B942FC471F97281FA3E5A55.2722.3221678492.283",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.137043534.223",
        "CD_A845C3809E8DF42635819F5D4441FC804E08EFF7CF893C7B960B207ABE392F53.1507.1.37693",
        "CD_4D801D24EB7B11E677EAD4F9CF2C38B141666B7557B0420D554E864D72C8EE9E.1746.375606618.6081",
        "CD_A8B7F475B823CD27197221367DA5046937A001F70FDA319AF654A4CA16237214.2116.705128811.196",
        "escription",
        "SEL_SENSOR_TYPE is valid",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.1136.2198884049.412",
        "IL_C9899EE7C88136CAE5CC186EA23048D146978219B477D0F9D6FAF94E760ED324.2724.1834318119.287",
        "C_962C6E7C58B97BBA37F5179D96ED3E00EE4A4FC20E4C3C3A3312674F9F7C4195",
        "C_4B0679EF2CCA448145114D6A472865C92C4C9C07F908BEEF43360F54325B5BA0",
        "CD_3185D5C87B795C19200377606F945624F3779B631EE5626D7BE05E1CE6DB71A9.2052.148130068.161",
        "CR_6B87A2FD09C6892F4F975A26E2D24DFF27E8D9BD67B9DB050A7E8D7BE4DA7F6F",
        "CD_21F45FDE5CB0D8A9E63EE52BCBC43E2AAAE1308BD552214731725278E86346E6.2599.1813537075.572",
        "I_DD84D7A95D8663E91CEEA7C1377D485BB4EB7E8581AA601BDF8CBC2691B3EEBE.2692.2041793919.270",
        "C_AE9B26B8983BE299B5F536E4C06DDEBC3F57E793409C1E488B880AEA4E8EB6FB",
        "CD_094CD032BE77E24831D84EE3DE38C46FBDC0C57F2466CC9AAB2CC4B43209B790.2164.103543259.298",
        "{106b464a-8043-46b1-8cb8-e92a0cd7a560}",
        "I_00AC489F58BEB2FAE012EB9EADB94D27B8C0EF1A86F7EF90CCC478E4E29CD982.2703.1518068467.288",
        "CD_0ED8829CD55CB10045BE12FF28DC63BFD30CC65BF9376DAA6A5D15ADE3CAC700.290.424262069.229",
        "CD_1435E6F01506FDAE4AA2C842B37209EDA7E3776319E85DC60053661DEFC190B7.268.1.8269",
        "C_2EC862E8ABFC3F69DF7F74BFE3B8996E77E047384E8DAFDDBCC63083E39C999D",
        "IL_97C7369A0CC3DAF8A65D93A71284BDDC3938384061D8AD2ED5B2DF9E638CB6AB.1016.4100651551.295",
        "I_1DF0C5371D8CF34F87386FCF024CF70DB077C88A753A26CB852461A42DA0147E.2721.3680098612.275",
        "CD_0A5DCBDCC4320C6314CD6EB830F4C97344090EC565D71BFEB9D454B9AD1D8788.2622.3551777992.1785",
        "CD_3FDA9FF251C6BD5841FB280A37A767A97FBDE0A3950C58F141AF2BCE7A64366D.7.3473838766.288",
        "]4890EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "C_653235DE591AE3093EA451E38F82B04EDE8940053285CA905BDBC1B15FE08288",
        "CD_EE7C68BE0AEC70A0D69675F4FA4F9CD050786C34EDA61EA6A298C73F31955579.2656.353726079.680",
        "The PMESignal property indicates whether the PCI bus Power Management Enabled signal is supported by this slot. PMESignal will be FALSE for non-PCI slots. If TRUE, then the Power Management Enabled signal is supported.",
        "R_D08FBE660E54A308159ADDC588C79311912D65E76D5871EF0ACC7C841B0E3373",
        "I_FDFF3C9B0664E0FAF284BFA12AE8B9782E6E99E4BAEA05AB7851730AFE40F092.1465.3666155629.258",
        "I_0CEC83697CE6AC69E736870BE9FFA3A870F550BEB17321CAB1A64AF57014B2E6.2683.266920652.281",
        "CD_AE91D46A333A370D09132417089AF125E776EF57E4B0B159D0C6DE0E14D65D5E.2228.1520152801.336",
        "IL_660E9F9CD49DC2B89A3530BB5D346CD91B5D13ED4B0CD89DBA4EA77A9A199EC9.2688.3099750283.271",
        "C_7515FB6DD2F950E647AF60DF9C8580AA8DEB2180D47175E1411F8A1FEC246F58",
        "SettingData",
        "Instance Name List",
        "I_9C256CE37E6F9177BC0EC95344373747E0112D20D664373933986EE480BE67C9.294.648254395.338",
        "IL_A963FF6A8458E9C4FEA354824C031F4237B8648981577F19FD6854C86994DA8C.1499.2362602321.331",
        "CD_4BEF3BA1297A2B3BF1D8FE4388786F7AA6C98624D3E280A958E01D4D621BABF0.2606.2338814032.208",
        "C_05A2F7DA01784E24AEC74AE25AC1E45FCCF48AC863629F5475D0E862F884FF9F",
        "R_B8C2F11B417C37C006D14F9AC34AEFC3BE86E0177BCF16E95BE5FE5EA4807416",
        "QOSWMI_TRACE_UTILS Flag",
        "CD_E6211D2EE9E3D772F3F5092CE86BF256E8A0ACC7D6C04BC5100CBFDD67DEE026.2065.1886946718.938",
        "R_92DB14183145FECB25D8F810D51EB91465DF70CF55ECB1D5FEEDBFFC4B20AADD",
        "CD_8753AFFD6FF7988B6BD5723778343D3CBE2068B8054CFA332AC07BDAA246DC64.314.1181163815.530",
        "CR_28A74361A668148487322B05FAD3758AA471FC05BFA3377023FEB3DB1A9716D5",
        "CD_5BCEB01D612DAC6C83C541730DF52A080662FD232D15DBFC020834AFD4253865.312.3850532968.341",
        "IL_BD7CE80B1C8614AEEE4CD25ED6E700DFB7C5DC7A88D4397F35661627B7565F4F.2701.225141615.282",
        "C_95968214F8D6C069EDA24D437119F94157AEA55BA5600F38F33105E2DA2858D4",
        "IL_42AADC48E8CAE9112EE9681824CCBFE2E91BE5E02C5B39F0A8D63F75CFAF0152.2736.1893140457.284",
        "CR_524ED280AB38E3BD86074B4D556A261D98A4E9D85B8A2DCDD6AA2F85E3342805",
        "CR_7AD87B163E5F080E34E60018A0634DBE95115F38F1BC264D0B548D7507D9109E",
        "IL_1257F088005C68EC5FA4DFBBA0AEB198E19233AC30C02CB7FD214AAB22B161AE.2712.2013013897.288",
        "C_BB8321A9CF60C9B6CCADFE1AAF2E8175C07048B64700ED07EA66CFC1D4F44BD6",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2426.1804810359.188",
        "CD_2E4CB0F875356763EA64F3060366993EE0D49772670FDDF29B1CAAF86CE9720B.32.2134886676.514",
        "I_A9C3BEBD1DBF5DF12D9143DC928A9442BE5735B93F335C7F86430C6319E8FA73.2716.3991818438.281",
        "IL_16ED3DFDA841F48FBB2366794307D1860617F98AC7034CEC38D34566447D33DE.2678.3699017877.289",
        "CD_09249AB2463DEE8AF9E6045D6C53614F5DD03A6CDBE2B7EB3990B7FC319F1979.2512.2318202157.371",
        "CD_A20285D23E76CAA1A5AA4BB56A34542AD06AD62940A11046E81BFE8B238005B3.1542.3920809618.394",
        "CD_A85D741861673C53E1690A3A36DD370F35BF62AC7197C00161000A38E681F23C.2052.252246837.160",
        "IL_2F761594CAC3F9266B7DD197C02B2EDC3C5FF865D303A754EEB0D076FDE2A3EA.2704.842580535.281",
        "CD_B159926F0CC27D6492317BDFB79C85235741AEFF3D5B427CD61D2FFD2C6EA2BB.2195.2375249936.309",
        "CD_48DCF233795F6A034546761490780DEDB258CDB8D1B0B692AC380ED7FB5F5C97.1567.2892372641.5799",
        "C_B9145D0C1524AF7987E25CC808ABE0754617F2DD4E8493B212B0FD0151445017",
        "IL_3D90968CBF38C76EB9C64EC58DF8BAD337C1A48A70D1C9EF256656BDBCD3DFE4.1105.2719360383.297",
        "ecedent.",
        "CD_E78B24A63ACB40A253226DA76298C783683B9FFCFE28CF1078C510D46CEF2248.290.1109800784.974",
        "C_ADADA2B2CDD3BACE2485D2B360E811514E03484B4187AE7DDB3778A03ABAD994",
        "IL_A061B1FC84C0FDD3E8154A924EF3CE4D547214F368F2C40AD7F2621B09FB3D04.2733.2399235509.283",
        "C_35C3DB4E6811B1E772EED05511EEF74635DA11992A8190A2AE28CF34DE0B7D35",
        "IL_F5DACA7B3759DDC70FA21DFFEBE969592FB6A43EA2A7FA644A9703AABE2F28D8.2677.226589300.277",
        "CD_563B10B3D43AAC1D29B6576E177E0D67C5C30421BFFD3A02E92B9D8D83067BB5.2575.3422003768.428",
        "CD_2F3BB7CF6B8E51A35C88F6CA3C55F4F164B1DD98C6F6BDCFFEEB67E81F67996A.2094.2637790854.148",
        "895E6DF01491EEBF7E2088F387",
        "This field is ignored.",
        "CD_3D10A0A77CAA5B54D6D0F826577C9C9001B09013C6D023D93A420AB24027FBBB.1177.719445767.2389",
        "IL_250B10A4688437DB106B3B64811B1BC2AE66E2DEDF740DBADD26DD3B3CDCC498.2696.1684836628.277",
        "CR_0DFC323CB20829C5E894EB23D45A1551C36C2D6CBC549C00B9D8952023FE2DC0",
        "I_B34D01FAE8E857E6D601CC1CA05B14330947EDCE328035ED2CD1266239D0FA45.2678.2663095456.286",
        "IL_8B35381ED83DB47F46C61CD8235D6D15216F01EA35CD603D7EE5B88A0B8DE5BB.2687.660355522.264",
        "C_0AFA2FC50AC99E903158F6DE8F18BAF5156D729C7A9028FFF4642E3DB96C640A",
        "CD_556BED9C5C7B0EE930A3BB6724BD19CEA9521081CDD971D1A19DD19DC37599CE.2457.2547680710.405",
        "CD_049BB6B86464EB31BA1C68CF94C5AF1885FD1AC3516017A8738B6BC559DA272B.2730.1272110764.666",
        "CD_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937.1177.2461339220.2996",
        "C_20FFE90491DD6EB0496111131EA1C7328480BC1065468AD9C6801937D3CF87A4",
        "IL_191607D0BB5536D29EB5461AD5FC9EF2DEEA8E0E923A0CD78DB9084C9DFF7DFE.2704.251882722.289",
        "\"&*.147:=@CFILOSW[_cgkosw{",
        "A70D1C9EF256656BDBCD3DFE4.1105.3096851571.248",
        "R_A3DE603EB585D665E0741A26DA307FD07CC6AEB392E1341EB41104E5D0C37FD5.1019.4138466744.518",
        "CD_1463900C5E85009C74D970DC08429284D480248969B543718E853FA68E152A48.2426.1149355407.187",
        "CD_94D3D66BD2EBA9427DC5E5441BF12C249317CE8B6E74F24C2C5B169DCAA56DA0.1779.1190232201.318",
        "CD_C57A3A3856FF5576ECAC058357B4B09A4EE30B72779C888B7BB26DA2B6FB5F77.1598.4049457028.401",
        "CD_48A5B17344C48EDAFAA391BF26A48FFF52648D73B54F3E703A672629602CEB4B.1153.2302081578.341",
        "C_192EEDE3F8F53F2102E9BC3A436EA7C6CFC3029464C4B4AC0F5C2AE05D9A178E",
        "C_DA8922F8F22B603DB41EB2C976F36D49B18986E028948A4E7141F588D46CF157",
        "Local storage volume management.",
        "CD_3218B9989B938326A5858B34E6B5229D688B0E45C61F57E86A18678454B9C8C1.1060.907704298.602",
        "R_563528C5C7C8ACDED224FDA1A8F591B57337D0B1E35B0B5D7D46CF3662F9DB5B.2417.2179563484.526",
        "C_DE1BB7427464FC34126231A7118D222B6BA6A62C9FD1A924C2E5B131CD85E987",
        "C_6E3B4399FA4EDE750602EAE85FB276C1B64644E78344F6BB3EF3F442D17FE8D8",
        "CD_02DC84977BFAC25D2607DA688E449D49BEED11590A7432CD1B14DBD119D15C97.1348.3906412834.503",
        "C_6660369DEF6E3B84AAECA382139BF3E985205A68D26143F446612FD594B15147",
        "ExtName",
        "CD_C48EAD99401EDD040FFC4F7D4C7D2EA74DBD383F4E1272208648D0E13C404FB7.1241.1294405530.991",
        "I_08E313D6BEB715DCDA53AC878FDC8CA32051886D2F14D1D12E5D2D43CCDB0398.2703.2083158827.290",
        "CD_14EA8D1B614BC6D260E31F428D1651D98B6F7F8F49C7964016B24597B70B73AE.16.1702573910.366",
        "I_8DD5B4325D414AEB9A2E89B2A9012972DB466402E099F6F23B86F048D798271C.505.1.85098",
        "I_98D9637DFF75E87222F5EE1D6ECAC855AD744FED98F1A3D93FDD69C3F245A650.1617.588610527.341",
        "UniqMatchId",
        " $(,048<@DHLPTX\\`",
        "CD_7E33A4E4E69DE9ACDED83C5A5E95E6AADC05B16D4A189A8F046304FEE3958BEF.2052.2335363404.161",
        "C_9EE045C4E2FFD0DF955EEE77C315F6E7AE148A81490C1DE25137DB14C2197D9A",
        "CD_149A27F19116F7BD8DB3767BD20FC5C894B45C207E040B561A2205EF78DC6727.123.4262857927.206",
        "CD_01485C56AD31BD1C7B9875265E909545C1FD016E19345A12E2E00973CE0EF1CF.1192.3547101315.616",
        "3 = \"Continue With Next Job\", meaning continue with the next job in the queue ",
        "R_0BE2D770E1C6713BC08289BEC275FEF959A2FD8AA97ACC94B170742B77AEAA60.1476.126207939.536",
        "I_1DA4E180531B401F40077208B50BBADCB6F447B0318A02A094D8CA2E1EE53845.1734.3927880155.318",
        "CR_F2BEF717752C099CDF2C7677200AF2332E7D1E48B470B17CCD440B8D710B7A38",
        "{2cb15d1d-5fc1-11d2-abe1-00a0c911f518}",
        "R_06737B1EAEE18EFBD834C9A8FE809CFE802C9E3420B35101293DA220DAE88ACD.1195.2796516585.520",
        "valueName",
        "CD_49530BF4592B3609DC643FFA39B0065785C88AE336F83147E233862B786488CB.2568.4281629629.679",
        "CD_C6F2B33A9F7EE971E46DC4A05944D1F3ED258A4BBB229A6782F76407411C3AAF.41.1723235603.530",
        ".1011",
        "CD_157A266214F731F02CD911D15EDD9F64398FCF66562D529CFE3E0B93A5F5F029.1355.4173067695.743",
        "I_46ACA7AC3CBC0F3ED7820D11DE0C916B1AC1A76D2292CABFF82D395CEAF02DF0.2736.1915623372.283",
        "CD_0AD525E3425E2C8CE42AB7D5E0BAF525C78B2BFF44C9B8186D684A5F7DEC44AE.2667.1340515415.1694",
        "CD_293C515626057C49BE9FEBCADE3529905E03FDEE2BB0FB67FF107DAC390E7179.197.1909608502.783",
        "CD_495E98FF7835F373B8F5063729140C2EA897C9F6C524A8AA5A9DD4642E06C61B.2568.3320308373.964",
        "C_20699BECD68BB2E715DB1990E4FEC1EF2DAF88A1D4AFC17A800FD50774598318",
        "CD_A136C649DDD401EABFD58B82CC5F52539BBAB4842ED5CA9AA74B8557B4E57EA2.2656.3167788945.1092",
        "I_AF686E0250184E59C8224EE6DB6A18B07AFF9644B10E666A16E16683312717E5.2681.3084215322.285",
        "ProcessorId",
        "C_4EC78046D8310B047EC675EFF57AF6CDF0CD910F39829D28C5747F5C66C2A633",
        "CD_41CA8C613150E784C004C908CB24132353B7EC2401C8DD6755B2ABBEB98C39B0.1.31945829.303",
        "I_E2E79139FC9083D2187C20D0D8E03EE5547AEEBFC3E082E553651B5526B12A19.2719.3994103753.283",
        "Win32_COMSetting",
        "C_4C6C03582703FDD60332B03ADAEA6F879DFEE5D9E8B3E7C908FFE36555EEEBC9",
        "CD_C10127CB37EFA86B80555A592A878FAB68964568F8B1F59089071948353A3BF3.1351.2871212621.1048",
        "IL_B914AE6481C0B1CC51CCE33DF86A64969A0B4A7510F6F35CCDFECF2B06D09350.2716.3872195865.284",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1936.209648323.368",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2120.2905763984.368",
        "CD_22047DD6AA3D899430A0653518593E646A07EB4284EA1D69CDA2422FA176EAD6.152.3938320584.220",
        "C_C8C9B465F9F30A2A1BEB0281C9AB6A7FA52E9AEBFCD84E87083549340BEA987E",
        "R_39E75790979650C120BE778856591D7E59D2F85DDFBB3BFF1733B73153D5DC01",
        "{20E25881-F081-448e-85C9-4707A9400593}",
        "C_EEEC9C53357AA474163EF7B420A745739C413E8DF61FA9B4FEF91F245EDBD4F9",
        "CD_63C984F6A28C9F19A7CCE6D9F6AC06148224451FDC94B8A24EF9D1E0C2887EAE.1931.3796612620.264",
        "C_8E8BBE32398A61BB41BAE9F60F150534B4CF02BF80975023BEB14B7EC8CB91E5",
        "MSNdis_FddiLemRejects",
        "IL_4A65EC1EECC64BDE7BFEA0AC1E8C55F72377D3333AD8F6D8D8D37A9EEAD5CD61.2675.3886341657.276",
        "R_89EF5B0E6A39F2A2970E3E102F92EF0C67087374518D87E3376022DE86BFE766",
        "C_556307783B179705B33BAA318D7984C3930279E4ADB250162C31F9E9AFE4C3AF",
        "CR_54C8B2145FBF6DCDCAEFF33B39FBF359799D5087F9B974E853C4A5903604B330",
        "R_CBA9EB33EE1BC25EFACE06DB1F10569606293FE4A3E43C86A81D2EA19CDF0FE3.2469.816339834.558",
        "C_88A0C7A0E72AE74936AEC0157B4B96E83CEA40238281088709B5DB02867E7CD2",
        "C_76A570B33AD5E980266DA88075A5C8D352CFF0581C8C28B18A7DED74969E7051",
        "CD_D5EBE9D0498F05512866B18A51DBC2343148EF5BF90E72089975D137A1E79133.2066.2596383894.1116",
        "Win32_LogicalFileOwner",
        "IL_D339E7A7C30AEB42A22E941152524A541BA85E4B5350F12989EDD8AD7C9C7DB3.2720.1499037169.289",
        "C_2FB4A6ACDC87585EA55F9481A3817C321080794083AF98F344F8219284F79C17",
        "CD_7A72389BB1759518065C4AF4001515EC91E03811075FE8C84FE22087E293F0F4.7.1385977942.687",
        "I_FAD079B10FE0633A913D5AE19E9595EC2C3520619632AF5FF0B02D2F47A4F2D9.2715.2426944491.274",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2020.3288993474.188",
        "C_D439D24286A48779EB1CF85E2093853178A3502A21F1F13F44868D671886BA98",
        "SystemConfig_V2_Defrag",
        "I_01AF7823F90DAEC78BAF38771F45D60A37B0917DC6BBE974DF07B97707A15F13.2451.111154847.344",
        "CR_B73E13EE752D9B5AF02139CC8E7B9DD86AA46977B13267D0D5F674F26F8C3D67",
        "CR_E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.1173.3057283712.416",
        "CR_6FFBA8B5854E9C5C5C698A9277971D04E447B67166A26CB7D9DD0D9F278C2D8B",
        "CD_CE7115C334FCF4CAF18779B5DCE6EE49094B2697F81975FFC890786B7C5BEB22.145.2760373853.1282",
        "I_888FEC1136F06804A795537477644171A7A242EA68494828CE09F5182E2929FD.2678.2353104153.284",
        "C_16275E16EEED6E74BD48AA48ACA3AF381CEAB3C980CF5112BF5B3053B0589A21",
        "TraceInfo Flag",
        "IL_3FE61113A54972D39C7E5615E7D63812829629BCC43F572ED878A906F5EFD883.2710.564751029.289",
        "ROOT\\StandardCimv2",
        "IL_63AD87026C4198465666C0137FD7F5BA63E3619137A942C6B415985E5F63E2FB.2680.1049819951.283",
        "C_B1DD166515EFBE9CA9A9BC05F545A35C45C3F834A45BC50D492ACD05C6CBB96D",
        "IL_EDC35BAB08C17A232132A1674585BA48F6A693D93FC9029866D5AFAC23E66440.2389.434244371.264",
        "C_312E8FB918C9314F7ECE1D0AEFF3C991EA6CFCEA7AC0F22C8AD00B63FD2877F8",
        "CD_A90C06A19A3439094866B57E9C6360E4A1E8ECF44719043BBC7BE817788682AB.1589.2603159029.548",
        "IL_D7A152250C610C2970CE9A6D93F6F33B21F6B08678E777DDE0EFCA493D2DB396.2679.2174348878.275",
        "CR_FAADE44B531DE024B0353D8C1E63935B3A7FF9CC1113545A747C5176FA0E7352",
        "I_2CE2D948F35CFA1BDBD91B796D298F0DCA6C5748C75623B3BBB11F195C1EDA61.2715.1170116677.271",
        "I_06DFAB71A3D8DBB356E2B69812AA4BD05249772CB8E5CA24F5D2BBA6FF1926AF.2469.3067110696.282",
        "CD_8A4037032A1E93595308B4A4BD6D8BFAF65C3C979F3304AFFC616809C573E05E.154.966456175.818",
        "CI_D5472BB4000403F6D6CDB0F595804CE62C0D292549796526CA9E7773798E5F24",
        "R_B59B61CC7D9A09771322E31CC4E05FF1DCA2EFD4C76A82AC0B86177C3096E55B",
        "IL_727C2D9005519EC05034DFB3D14E540EE6FAE5982A0FDB82192B0F03F27474A2.2704.1189115783.287",
        "CD_8005D3B4D5C33976D476C37A3ADF1FDDC2AEED60D44FABDB17B96E9525EA9F87.1292.2461356590.2741",
        "C_DC6801328AD20F0D19416832CF71DA80FF8FDB25194CF233A39A0BBA13B68D4C",
        "R_21F1E1F149DFC99965A781A396AF7873962AA365AB6A21C1E301F1804CC089AE",
        "CR_097A52F05DC16AD6657CED4065B1B398CDB1D2CE8FFD05363E002CCDC2980FAB",
        "CR_693EF552E8CAE369E34FCB40434845C8767F2347237F1BB15463E74153D4460A",
        "C_2593546F7F7FAC2B60CA22440D930CA43315D905BCE5BBEB889FEE3F3AF27006",
        "LocalUserAuthorizationList",
        "R_72CE255A513997878296D59B226FF6EE1ECACB0D9393C9190FE27B84F4A71669.2451.822704615.558",
        "D203A8C74FE018A97CF9FDC9B12BA21.2712.1932332857.270",
        "C_F32492DA8D1952EDCCAB707AFA3F69E046829AB6D46D4B2279EAC5E6BCBBB3FB",
        "CD_71D279F146E6F78B1626E5D2F11A743CA9A14347FC1E4EBDFB8267FE065E5721.1576.1566409741.413",
        "I_9AB98AB0E736A1AD0C7F0E35ABB99A14009779E12541D6644FF363D825B8CB6A.2707.2144343765.300",
        "CD_C43EFC04AA57188F81F06E127B541FCB4E02CC3940B347504A70CE9D5B7DABA3.2420.992301556.670",
        "Location",
        " $,04",
        "IR_F0FBC16C69AF599D2D58F1CB4D2AEBE096BA8515F4CDDCD6273020AD067D8DA6",
        "8<@DHLPTX\\`dhlptx",
        "CD_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2.1165.2468385363.1049",
        "R_ECDF6473AEB5680FD494BFD070A3EC2B36A681EE68A62E383213B3D773EF9B61",
        "IL_58812B0C8158CC0AE51D6566E64E3CE23A47167CDF7D7D817D519E5FCD8AC979.2692.2699475577.266",
        "CD_2962574DBABC9D74020CE2DACD4F495EE01650AB6A58D69BDFEB23855FE777E7.1066.333635097.4311",
        "CD_DA3DC1260150EA9B0B2628C0C2AA81125377900B91EB681EA05BC31E6A7900FC.1134.2358326847.7559",
        "C_A340B5A350335A2F698A9D474151FF7803797C56DD9A727636F061641184011B",
        "M + \".\" + N + \".\" + U ",
        "CD_639FCCE3DE726C47FF30745340C22FCB819E5E4DFCA7546346272EDDA843022D.1177.2457745758.1863",
        "I_9614B78CF30C3CB0EDFFC58EA6133B7978B5080C82FCAC5A058ABDD270FB0A10.2669.1092426451.273",
        "abstract",
        "CD_5423A293D610FF0CC764C8A3CE38BA5BB054D35D92E0A6097D9147F3C3498F59.2612.1923657698.342",
        "CD_5C90AD83ADE4C22FE8FF44C299AD3236C77C12C54C212C5C5502E0B121FDD0A8.1017.4081619239.163",
        "CR_BB8167061523345F8CD6783B9C5021F1F77CD1511AEA7467940486ABC39B70EA",
        "CR_7BF884F7361F0D677A40C5CD7F9E2139AF67CB14ACDB2E9D39E3D5ADFB888E91",
        "InstallLevel",
        "IL_C7FAF3297282F70934EFB9BEC76E5FE9D6AD962E9B7753F4B0E6709AD86A9E11.2677.714626156.276",
        "CD_EC31DBAC8296A2F597184183FC259C7595AD4BCCFF23FB0BD832DE414BDE578A.156.159931168.634",
        "I_FDC07BF412EF517BF16CBEA0AD032C8FE94CB2DD73B9CD909C08659DB8C5BC0A.1354.303244126.276",
        "CD_FC20EE275CBDBB5DCCFF390F786A4E446220959FE7B3B5319E000553B67DC64F.1541.306207219.414",
        "CD_0165CAB89BDC44E6A103BBB55829CE27E96FFC1FBC965B1148A99781C10E7A7B.2060.634247663.1091",
        "AddressMaskReply",
        "CD_C0B311FB88D088E1FF41B26AAA753EA711EA8CEB4414671F02FC20238411A83D.2564.2833716897.1190",
        "@0 8$",
        "CD_3EC633BF060A39C201FB3365682E90372DE72DDF28B24BE016E2C6A6195F1EFB.2410.3276219089.580",
        "IL_F39D12EE0E6F5AEA8B55C6487123AD8BB413A2652EA1549D0EF304D72048373C.1090.1701490716.362",
        "C_CCD3AA66883B977C4564194B988642D386C6A68CC8CD0C50E860BF4069F1B799",
        "C_73A800D7866C4390667315AF06F93202489C8838112B8D051CF005E872136F01",
        "CD_4C11DEAF7A8558F3989E0E42F67497A3DF8A0B97EC73A206C1E9955B630EFD68.1533.1277046256.559",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1938.1399279803.180",
        "I_7CCBF1F84CDA4650F5493AEBF4F4A6D684B7FB6015AC4D79B389A8EE87ABFAC8.2687.2663642713.264",
        "C_1AF8551C42A0C4EC8EE76C1BB09B2DA1F658691D78A8F23A9542567B67EB474A",
        "I_209504AC1F48FE9F9D4D387BACABE2CE7B4E17C0EC9B21BCD006B465D4B1D555.202.3912646404.297",
        "CD_36FF9B91B98151142333CB13DA769BB44A2F51FDE32F09FD4FB06D672F7B7CB5.1190.2886804735.612",
        "IL_51D11BF229FB1D15ABABE5E850C4C70DAC3E3C57CE24C8E314204FC6FEE752FC.2387.3502113657.322",
        "I_B3CCF51DA7E2E82EF4B967050224C72E8B5296498ACE167E310066C0B48C98F4.1802.3464864859.309",
        "I_42B2E3A3A6520FF2AA7BA157666764419AB7273E011404BF98FB167E54E43BA9.2460.2198995473.354",
        "R_F8D966DBC75C36DE24C6AE0CA01C7166DA8E0B452C7F65F006B93014DFBB9A08.1782.3962954863.586",
        "SEL_RECORD_ID",
        "CD_A516091A26C59F0A9A7F2863A1D087539F59C7B40C630ECCC503638C95CC6609.1583.2931262796.429",
        "C_186915C028DB302F51311CBCC5A8139806C4A3DD8133E0744A122DF58FD5C571",
        "CD_493669C1CCA456E36A12CE6590E4C5AD1ECD05339BEE6C958085F31C96B6122A.2136.2422195580.858",
        "Source File Name",
        "C_83DE1B746C28092F6432A88AA76D0759ECF002B2851A36CEC64C72AE248F616D",
        "C_AD5A2EDE3B100968ADB1F1452AE2EC6E58BE68D49F0D944D79D414546C72FD53",
        "CD_7BF884F7361F0D677A40C5CD7F9E2139AF67CB14ACDB2E9D39E3D5ADFB888E91.2304.1.24732",
        "54865F4",
        "CD_BA11A442C4B6BACB0B77A87AAEC21B7292F7F1A01CCD5A6A6D27CE9E1D19DF7A.1595.2618744624.1172",
        "DiscoveryMethod",
        "C_0DB6BAAFECF887C41F21A2964B768059B86C21B174F1D609DDE0EDA03CED0234",
        "Unknown error",
        "IL_75AD4008D50FCE8D6BD04E3DA2A5288455288A8B985CA51E4483E037E4416DFD.2717.1530343366.291",
        "CD_C8AF925AAF65508EDB0CDC4476BDCF15BFD7128CFC50F1E93BC62F64D59AB5C0.1155.668158775.731",
        "IL_E2B1773F5498E7CFED96AE2740F08CD38CBE2FD8B5129A90F38F90CA675CAD67.1017.3909181872.320",
        "CD_AAF98D409E1E163FD1524923D9043946E210EC98C51D718F7EAA521044F5D1C0.1926.475637112.320",
        "IL_CEEB04238836B14B55751D5FC8F0C378A54AF1942F10226666FDE7520B51B7EC.699.1.57184",
        "I_4126A51B0004A6738763B66773B573F7D2C76A5D7B33543BAA7A2F2CE3E83806.2675.4101126257.269",
        "C_40930BE1E8F934F03344F1FE602D3CE9551B1517303C4D41B014924DEACD3746",
        "R_35B1B65B914DF07FAC7860C3407AEAACB382311D5C7C7979B2E9A007C56D4FA3",
        "IR_3891F4638541E624805EBA5C0030559C8C34F083FE86FBF417221E93DF20A6F7",
        "IL_D65AF43B13CF274F605DEEE8C21428A9C103C93F1ADAAE99C3F86725574C22CB.2692.765496254.276",
        "I_913204304A08724134A9D5DC4A1AABD6DF33BE96D109BB06756E60F16CD52120.1053.4286564881.312",
        "CD_5B672A9410EA04ECE1B63C383431BE2FB673EE31536F61B279C4962B0C974372.1191.1693449889.606",
        "C_16B53E03546E9EFF1F249075B4FA58DB5F9FC819CCD55304DDB4EF78A2D0DC79",
        "CD_60C5D6136B9E1946BE8FF2F55F1989E489219A67C731A9E9CC7487E5EC74E5F1.2615.3358104602.409",
        "CD_C446284C531AD33722FED92B5707E137291BA408988B095293D49122D6D19961.2739.2876832819.807",
        "CD_72F6E06014740E33BF77857BA13684FD2DE1B4C686AF87D9EA70874A34A68B7A.2583.2938883098.272",
        "8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "I_51D55482B7AF4894C57C3464572BF16B3F50568D4C97132E3EE18E297A796DF9.299.653620820.315",
        "CD_A4366444DE6E953D2C93A1247381154B05C29C6FDD363835660F5F90BFCDEB05.1877.1.114286",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.959855610.226",
        "R_A435E1CD6D36EB19C6DA0BA1C7E62224942A59031964EC981FF17A68812E1011",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2020.2776175683.368",
        "I_B2126DF89CF1DE3913FAC3B998A658DE3E47D87D0A73369A702B132DBA49F337.2681.463787080.279",
        "CD_3417EC6F6FDD4AD6ADF59EE04391675B6783F7D8A26A76EDF8D519610D0392D6.1530.4156637012.269",
        "CD_3919809C02000DE9BA7B34CB7C0A2B9234444AEF5A6D4DF7DEE7C1379D7EE3B4.2388.3251716346.3687",
        "I_E119939FF7AD69A2E7790AF70FAA1FF64503A28E9040F5A58FA54DBF42E56214.2686.3512473346.262",
        "CD_E593BEDE8ABB842DB1631394ECD41A318019F9AEA2160EF1EB883CEF54FF1974.2669.2381700125.604",
        "CD_E4E3C277AFADB65E535A86CD5AAE23B1AEF585A2BE1A21A282B170B7F4278F9E.127.1.9312",
        "CD_840035F63794F57A62A5607B53F5A8A9C84296DF659BF9F5C0E61203052FB854.1958.847467624.603",
        "C_5D42E4DF5B7B899925957BE4D19450E2FFF69AB58BCABDBDE9133A0AD51A2BC3",
        "R_EA9A1A204A0FA59819F57AD1F744E0CAB4BE1F06A46B3D439B85E87A7B3A09A6",
        "C_BE8F1260CC7D3D8D65E679E452849F43342AC07EE5E67F79C0602AEF0D925B48",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.314.2772854538.368",
        "CD_EFD628FF86806AF6B75E95FDA0EBECCB53F0013E3C801AD54DA913AA26319D53.1463.2464331866.325",
        "Msft_WmiProvider_CreateClassEnumAsyncEvent_Pre",
        "IL_0E6718385BE4F7D115B0201EBE2B1152F73CC48825709B67CAF8E71171FECCEE.2681.93249695.283",
        "I_1E83286B2C3777C538780A179DBE46EE910AB840D4D58E97D94D9CC9A38397AF.2684.867651186.286",
        "VESA CVT",
        "CD_61A3C0D6CB2A10AE4FD5F19276429EF7E249D991E911A200F124BE12E4F8F8C2.114.1869884640.4370",
        "C_F184832B4631E42C2D983F7EFCE295CB4A79F3A6CBFB4FAACF42325448D6184A",
        "CD_25DB973753814296778CE91619DACD1D75BADC5FEADDBE8C05CED0CE57CC8084.2052.2189780882.151",
        "4B619D3E64BDDD0B43BC6F39166BF254D48A504F",
        "C_A9BB7C5A93904236731B5343B424DE2E9A05745595440D163D382B2134D4EBD8",
        "IL_E78023862D0C9AFEE5C7F1734B04FE646B55364A8E140EC762B374A970539BDA.2697.3390752642.270",
        "CD_20EDCE2D529E2E6BCE41DEE4170C3E9E6D3DEAF61091F14E5541886CD554DE30.2273.1798722872.254",
        "I_F57AF3E0321AFA8606FF67444CCBCDB6E5D7C9CDE02AF718489B68BEB2A8EF91.2694.1014581604.278",
        "Point of Presence",
        "IR_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2",
        "561.2303749536.902",
        "I_B172B57AB4090106752242BE8F0DADF40014B35B6FAB79F108D12C9ECBAE4D1D.1094.3712133186.336",
        "C_5CAD05FDE6C707BBD9F23FD974CE44750D011145A4266B5DE3ACE64BA6710610",
        "C_11D484FDE19A8F43D1F07FDCD47FC2D8E23EAFB01FF975179CD32C427E1C3CA4",
        "C_36D4896E467DE39097850E65446D5E83BB401EDA6D0F2AEAC5EC836BC1B7F0F9",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2087.759426123.180",
        "I_86D4D641344D1FF9B432D8BB30C393CFB16A1FDF7722D84D9DAFDF0DCEDB49B4.1016.4187163215.307",
        "I_6CEF3B0B6A5FC6034444C855DADDD54742BC48337C8105B7303D4A8127EA5C1C.2707.2639301223.291",
        ".2735.1173873169.268",
        "IL_E39CFA925B8402D1FA59EEEFA52F1D0908ABF272AE68B00BB3566ED134F7626B.1499.2202787247.188",
        "IL_3891F4638541E624805EBA5C0030559C8C34F083FE86FBF417221E93DF20A6F7.1751.1276124379.340",
        "C_901F44D3DA0774EA1CD96ACECDAE8DE6806E0673AF788724704275292D2A4E60",
        "Latency",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2070.1590554102.368",
        "The space currently used on the volume.",
        "Referenced HBA has been removed or deactivated",
        "CD_13D55C842CDBA0C119A52B652E2B026F106F2E9BE68DD61A338E909E5F70C55C.1150.1814074717.1463",
        "CD_7BA21797020E5EB245196B97A8498B177A1484B45C0A889176D1BFBE8B23C41C.1579.1694952517.953",
        "CD_A53803A976BCA3FFB16063ACA85E663ADBA78B63EC0DAF8A23C68DAD672A3EF9.149.3400086468.586",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.296.1863209304.368",
        "C_518737FCD9736D06CAEE43D2445A32ADF7BA5172ECE7281110883C447A0C8E05",
        "Local Group Policy",
        "CD_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416.286.1471483488.399",
        "{13976d09-a327-438c-950b-7f03192815c7}",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1976.548237129.368",
        "I_DD2942074655A21144123D6AD874D5EC38DF214ACF36130D29366D18D7E749D6.2689.850189356.273",
        "IL_1B3FDE59AC204104D29ACCAEF13F59CFF205D9B942DB13AE987877EF90664BF5.2692.68808850.269",
        "R_A50F2C71334A2A338CC6F1C013DEEB31B3684F92B727656C378E98BCCF3ADD1F",
        "C_D08FBE660E54A308159ADDC588C79311912D65E76D5871EF0ACC7C841B0E3373",
        "CI_311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        "CD_090E16074BB67F3962D2476389965FF428C90DFE4808D1C0AFCA9634C068662A.141.947596684.1694",
        "CR_1DCEB1693B085B2991E1748C5527FE1000E59774A81597D782C7656FA24FA810",
        "R_DF85153FB4444BFC904B433D6CDD9675CBBAF1556A07F0E7E082E4B4F8C33E3A",
        "C_0AD525E3425E2C8CE42AB7D5E0BAF525C78B2BFF44C9B8186D684A5F7DEC44AE",
        "C_04614BDB14C273E807C3A761E5E7A888794C56D16B624B2E80A3A0F6D5F3C288",
        "@DHLPTXl\\",
        "CD_16D6E45D9DC3C2448BBB5DF12E5A17B75BBAD53607DFAC1CCE27C411AB0AEA61.1806.4040773423.4460",
        "CD_7F311F5FE12DC8FBDC8986B639AA5BA7CD954740905CF54801CF77F8F3C84DD5.80.474506103.4137",
        "I_5FE18C6BE812DA3AF51D31EAE94ADD9FD2C645B09D0CEDD9F54349B2D949FE43.1015.3565299583.357",
        "CD_15A139866A05DA114FEFEDBCDD1A1CE7ECC7161C7A0053EFB8918A0783845D31.1019.2447634893.1383",
        "The command line options for configure. The",
        "MinimumBlockSize",
        "IL_53FF23B7392421DBE751E4A76D391B471B37DEEC35AD7003AFA7AB377BD54B06.2678.2372077223.282",
        "IL_EBF137594178DB67DCA5EE0984DE75D9883C9F6751FD15D2E218A5EDE6DB3161.2703.3237929555.289",
        "CD_3070DBAFEE4F7008DEDA489E6F757902F4A0C6C19A468539B18D22506961ABCA.2550.3985605631.524",
        "CD_A6FA651EA245ADD657842B680F4AB592CF67A532F435E181C050F114520982C4.2643.4126692779.1229",
        "CR_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396",
        "I_C703850D8088BC7E92C8B76F33736593E8B0F068BF10C40F90FA96B3B8BC304B.2698.3640958228.269",
        "C_B8B1FAB8A4F90C512F053D1AD5C7061AC5CC502A1FC989312218B5B68AB25BBF",
        "Network Access Provider",
        "CD_0E8AE3127572E18A442A470FD92690849C0B09462B19ABA7B3E6660DEABF9827.2758.653753066.358",
        "I_8771F6EE1926E505F2C5A2E187598C5CF7AB7DF75BB546648E19414531518528.2705.1256167159.292",
        "C_2AC62F8FBDE5396DE0E714628FC5276EAD8299E75B3476107B0361922E630658",
        "I_E4D6DCBC40AB91F779A7879BF4FB500EBD6FCA6C65C56B4262A5C24C24D31070.2703.4183864785.288",
        "A3990C071FED897FC6FAECC4A4DBE.2747.23143372.938",
        "I_100109F264418A8891B8DA48D69393178E571025D114D35005EB8841D88FAEA5.1163.3162972686.263",
        "I_B8A661C1D622FBC77353C6283693E0067AFF965D515809B24B4E9FF26EFC7D7E.603.1.105338",
        "CD_C1E180B8C4366E981A2C239C795361E39EE450204A5C13220DECE0EED4E40C66.1927.2065756000.303",
        "CD_868ACDF7C673B81A9B86641640BBAD191E1BD447F658CE37AD4CAFBF6FB97C0E.2594.377457714.471",
        "CD_10DF5666D33CAB7B9847BCB7DE779D4D05ACC6BB9BE7D314C4C1F73F38A78383.2387.2075129538.629",
        "I_7D43B258AFC12540DD3B37A3B2F8FC37FBCB4B47387E536CBA21B91542F05928.2725.1052535551.292",
        "R_5E46683FD84F3219E379253BDA01FEC308C95988FDF4807D31199D70DC1E39D4",
        "IL_FDFF3C9B0664E0FAF284BFA12AE8B9782E6E99E4BAEA05AB7851730AFE40F092.1465.3666155629.258",
        "C_914943302F06F34FF1632B4D7C73ECFF9AE15DDBDBDA5F8CD8FBC3C0EF473B90",
        "CD_92AD02DA674F5290070E761DC90ABBD672C82A5B3BF7579C78C351DA149640B7.2648.565393948.407",
        "785B1FFA664B9927AA05FC992B88625C615A582C37149C7E2EEFAF3D493B.2648.1555214977.1766",
        "BC1C3C9AA54865F4",
        "CD_4B835375C85830D11DAA3F01F5AF9F28573A4521B9279B28C7605832DE3B39C3.1083.3649943124.681",
        "C_8757FA834BF17A34F40DA9E567F73EB3C0F519BA77B457CB4D641370202A1355",
        "R_AA08179966355DA227023310A55A3E7595BBA6EE2C2F2E7F371415F2AF045A6F",
        "CD_44B2B33F232E78585BC06F82C484DB1BDFCFCAAFCAC5D29C12B11CCF8EE5BA88.170.2711367289.347",
        "CD_5D42E4DF5B7B899925957BE4D19450E2FFF69AB58BCABDBDE9133A0AD51A2BC3.1199.243355169.3620",
        "C_2F161E4DB37A4CE0D5920746A9A882B489818A0778EB5940DDB59903217A60CC",
        "CR_C32DF9F947B29FF4184A098E1939B4BC6F452D2B88C38983D24946818DE6DD9B",
        "C_5200A18802E4747264437AC469BB415FA346E34983915EA25009200F37191BB2",
        "Average power consumption in milliwatts",
        "C_B23B95CC62B7FE1710548CD8E1F8EA0575C88F97DB71C9F2CD52A08E2E5CF281",
        "C_2E4619832D87866ADCA097DAEB4AD1F340C2EEE23DC720838DA96CCF55B2CA54",
        "CD_C80F6E9FDDA5B4FCB7E91E04A37B343ACE2C1B4C4C7D997B61E1037420FC6413.2762.2133357534.748",
        "C_E707FBA0E2CA2FF8FDB82241C8B012B9A1B221B3B69ACD6A3EDCF3E478558D31",
        "Status value",
        "CD_B715CBD523374FBED801AECAF12284FC6BC34C5D6F6D2476176EDBA2C8EF1A70.2115.2165207628.559",
        "C_87EAB6C4850F775DE7E11FA687F93DE9FB590BB1DA4447D688389AE4FE6B68D1",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.720466710.180",
        "IL_14430B95AE3D7796FD7FACB42945EA90FDDDAC2E5B8D63361516A1B086DAF03E.2692.3693569604.279",
        "CD_B375528E053EA0FB3757BF45E457E25A87BD55DE51CAC5F0670A466CE3A30962.75.1015208308.864",
        "IL_1CBEC35B21C3A3C066BCEB7783C4F3098F803D3B771BBAEC00A00E09EB5A43BB.2719.721753376.269",
        "CD_838E75DF6AB0A59C9F2477F1CA99D3050323945F5A9DCAAC9E77A5F334C030A9.2759.2920192160.355",
        "The unique id of the virtual disk associated with this extent.",
        "CD_549DC252C669D007BF4D8B198347293ACC33C289963BCA05C61A46DBFC8CA4BF.36.941529108.303",
        "I_2D962F6EB59E79D0C6FC1314BB5FD596C3751CC9CB846BD5DD9F15C03FCC7741.2709.1448165507.299",
        "CD_1C06FA152DAF97258D99D731FF917040529592936586FC456CA74403EF6A2F73.2003.4134727028.1624",
        "IL_0F942249317BEBCCE2E53B2549FC597828D5AA6569444A28BADB2A9391E3E070.2677.143490917.275",
        "IL_83D5E6F80CF85C411B5ECAF0B1D72053419B8C2E555CC28C05F9EB41C64B647A.2722.4176674305.268",
        "I_A13DC08F44A6FF8FA90B0CB647BC3B13CDA21BF9F159BE57037059909A7B6D41.2712.2162134753.291",
        "Indicates if the item was deleted while working offline.",
        "CD_00DFF747C2B1CBFF3E26EBB6153BD247325C452D8EE6781C31BD31C2A7081073.1747.820743395.281",
        "CD_7FB7BA0DBA074B35AFC3D4294E020BED8632DC6DA6BFD74D3F6713AC283B7860.2570.1759255126.1745",
        "2.6.0",
        "CD_9D6744533171E0AA4C64E98982376A00322E3135FA3701918441437BEC34C877.299.3191061437.200",
        "Wednesday",
        "I_DD370C83218E3ACF4ED3E50B021E588714258891A76B1EDBDF23E122A58854C5.2764.1475232320.287",
        "I_EC16D1EB706AB19E276DB8DE1108C56D3532ED00627DB2EA05F10FCEA074D6F1.2690.3615138400.281",
        "CD_16090B1DCEF7F16A5E9DEBED60D9476077271C26AA679352AC98DA64B800088B.2588.1095777177.1722",
        "CIM::Core::CoreElements",
        "CD_97BC75F32D55E19412F779268A66FCC6A5BD410C650CA3D0DF71CCC46B370F28.1.1096848179.602",
        "CR_F39CE8DEA5DC55C1FF10FE9CB8760E6D9F306EBD58660142F016FE93457EC312",
        "IL_D543C25C727D8BA24D15B6C786ED2A97ED948A6BC8D1300B880D38A3D6BDEA76.2710.992717518.295",
        "CD_6F8403455290EA575F6453F1C90F840BA153FCE689B6409A610006D1F81CC7FF.1602.2448446360.494",
        "CD_44199FEB2EA5AA114C34FEFCE15EC340288F3AE7F2F9B159DAE8176076473712.2757.3666692245.342",
        "CD_3D126353F8A45AE958FDB7A794F752470EAF3717B940BF141551AD925649D593.2467.1.15280",
        "NS_42E4E0D295908E5E61369FD892A1F8D55E4601E6F286F3D44587BC7BAFF4CF40",
        "IL_8B135916A7D126EE8FCD7F8E7AB4C2A214B51FEBE767392567D6060C207CFAA1.2717.2492328047.281",
        "CD_AE91D46A333A370D09132417089AF125E776EF57E4B0B159D0C6DE0E14D65D5E.2744.137641569.336",
        "C_F08FCE87204BA565CC8D5019202DC93CAE2C1D89D6CA6369E7617C4B178BC16E",
        "IL_F687A4A66325C494A9BA0BAE662823BF35F4127E843231479C4041FB2F369BB4.2673.4270551484.276",
        "R_F7E10C2E2B48C52ACA99548FFAFB6BFFFF056CE9E9128CD48CB817FDF7995302",
        "KI_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170",
        "IL_B9557E5168CF69F86FDA734B7317AF9E8703192DBF228D0CD9F5CF9BD6DC7E17.2694.595477196.277",
        "C_73C8D20F8CA3C376F0CE63F48C27E4D700E969BEE425C758839EF39468252510",
        "IL_105E01B8598659D73174417ABB8E6224C280420B442084036848600394E76A76.1016.1029246345.313",
        "I_848E55FD5F4FC523C00864C2E37F5A0ECCC3D19673B52AA68E334B012EECD2F9.1730.4088707950.330",
        "C_4E05A85C7C9DB6824A0AEFA83C9B26B28AFA6D8D088521A8F0444E981BA3B980",
        "CD_EF6F51F7BFDE90F62A4189D6AF41831500374FCB981FB80A207B392E1EDF6997.1634.2007623155.601",
        "8AD327F2410CE001231635E7CBB",
        "ControlMask",
        "CR_3596245B8E5FF0EC67AC5C34C00C2E8649D428468BDD701F6037061347573C91",
        "CD_9C89CD12D6BC26922A4DCAAA9B4707FCF99911A5CC1919F958629CE9DE116F55.2607.604716361.1579",
        "I_21E85A20CC15E835CB6487F54DC9B230DDD677D1A3F958EEE3ACBA0DE0846B34.1500.370985859.312",
        "Thread_V3",
        "CD_40A02E8FDAC46B2551275BE49F53DF91F9AAFECFF566E59007B7BE16747B091A.2539.1621088381.500",
        "C_1E626C3D32F7EF024573AE985B5FB35B84A93E624F99B15B594BE7E0989B4A14",
        "NS_3F2E8022E512721B56515EF3BC51FB34E6E540D0FD898B8F849D2B28C15BFF55",
        "CC0DC4B7DED5F1ED16B7B7499EF72F",
        "ys.mui[PROCESSORWMI]",
        "C_3CB16F7658F55687F79DE5BB04EB14BC84CDE14351D95F09AF20D745287445F8",
        "CD_DDBF2272AD53D1E9DA14E7F99DB9C4644CC139435FA2E500211498B44899C2D9.1292.3435172419.492",
        "IL_A41A2A506F07DE19FA26EBBA5A53B62D2C62BAF775EC8BEA2B152B5D21A711E3.1480.2117662673.339",
        "IL_B295448335625AE4F30B1C13C498CDDD136CBDFE27D0ECE17CA7AAD4E56199B6.1938.1342239621.200",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.1083.172539582.188",
        "CD_F8DBCCC9EC3564253249A34557C34EC79D44268E23A36532F093DF4A918D7FBA.58.3344631149.248",
        "IR_98D9637DFF75E87222F5EE1D6ECAC855AD744FED98F1A3D93FDD69C3F245A650",
        "CD_85779E8BAFE3789E38C6257CF29ACDF9D244A27016D22CDF8620CFDEE1A226EE.1806.2733612538.563",
        "IL_2D8418235BCBF259EC91563363DBFB6FB3EE7397239BA3B0C0CE50575372C840.2705.1694209106.294",
        "CD_8CFEA92C5E4C9F8DC3D0C728FF03B8DD4C940C51F3D7E77FB19C8CA135C2FE6F.1191.4121961905.296",
        "NullTerminated",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2482.476375418.368",
        "IL_68D1C04B2DB331557E09AE38D2F679808DE9407A5193CB32D2D00DFB9B70E7C3.2711.3785550728.285",
        "CD_0A88143E1C3CA6AAD532712FF8639D26F391192D06CCAD53461A69205DC057F1.283.2803379203.1120",
        "CD_ED8B429C0C6338550E0A0839881523DDE7B3F918D56816FE1DA9ACD95BEB7295.121.1247845941.536",
        "CD_D6F23AC5CCBEB47ECCF7BF129523258879FDED9D282F558043FF80249A7ED596.126.1478235199.781",
        "ScriptingEngine",
        "IL_42AB81B65FA4E086AFC4A3EB16172A80110BD85D376347070E6B566FD87606AD.1016.2375720780.308",
        "IL_60155E7D43FA190B76DCF5E57C2AAB745B6D4E34248AFC988DBC5F55FF8C5124.2709.3872195848.294",
        "CD_C6322B6314CFF4E509A8264F41852433F9D38AD4057623ECC6D130FA2261F1CD.2575.1146004944.220",
        "CD_AD65270397043F902D9F90C1B5BD4DFD9541ED0218BD51B3C4F8E8DBE71A2624.1069.1657960218.527",
        "C_C69021AD1257EACAD7939BF557F7345378A0D2A133C46981184D4659B6575E49",
        "I_F18C96C07373BD64C8D30038B7433A922DD71E29E16B629A59A06CFCBBB31241.2684.3831919520.287",
        "This class supplies the Instance names associated with a PnP Device Instance Id",
        "C_A9DFA8F5D04BEC57E3F9583151851B160E15DF6C81FBFB70856AD90B0968BB53",
        "C_D8E4FDD0D26D90B6E6471AE5FDE8707D903FE6C0E0DDBCAFDF5D70483F378798",
        "MldLevel",
        "IR_0B8645AAE8365A921E6AB402A97682BB4F516F905DBB8B814BF3EA695FB9FFF7",
        "C_58F7FDBEE520602801F9D69F9D9FF6E34217ECFA7A2D83A25ED10730D304E1A4",
        "I_B3198A98B30688025E52C2CD16BB5339A9E883E8A0B7E69978FF121D065A1006.2681.2291312530.299",
        "IL_45F96938123A6B99EE0732CBD190D9BFF5B82E52695CF7F1322EDEAB82ED9BE5.2687.17063064.275",
        "CD_D4A97CD760E9DC657E08D29140B18BCC6B8D0D59DB6745F4739A4443DFD0F72F.1748.3865379420.479",
        "IL_33A7BFA2025BA7F7DB0CEEE1B24DBF7556E415894EBBCB30BC86C2A1966AD8CB.1480.2036682156.194",
        "I_30485B836AA5A6FD10A8644930D90B38AA35B211E21BF4839647DE43EFA8F751.1355.773241841.275",
        "CD_24CFB2B4CEAD5BE9188CC5001933580DC2746C05DE76A8DB6DD098D52E4B25F0.2283.1609514614.4729",
        "CD_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396.1167.1.9739",
        "IL_3040C92D4D1C9502DF63374E427875FB5F024B0D5B541BAF38EE58053D345D20.1730.2584463817.338",
        "CR_D2E1F5EB4F84E0C0B2E61F3513674DF2B7151098EA22604925123769286041D2",
        "I_391DD484983F84A2EFB89AB2E60BBE9FA89A53D54DDB659CA85F25D965145C14.2715.3499310028.274",
        "CD_1D8AF94E43CAA7DC78EEB167F2FCA41288361566745343E55E2730385A1CC51D.2425.2492248421.370",
        "CD_09A0BD3FA42FC22051D80101735E2603C2C685F3E4BE5F21BEA3DDC5EBA5AA79.2273.3137950316.682",
        "MaximumScripts",
        "C_76782355937384EA09D0B0554B1178EFBBA438E86E7F7385EC42DBEC33B0A109",
        "C_C17EBBF86D4537DC1A3044DCC316F63FF8183E01B0197617CF6F88A826A1D730",
        "MSFT_WmiError",
        "CD_88CE5A07CD2F69DBBB73BA9DE9D43614B1ABE5A1326A7EBD8D82AB018DF39B74.2548.2453717393.1500",
        "UseGatewayBypassLocal",
        "C_362D6A29547775E750DA92891446A0CA4101CA2DDBB5289355E858D0775A2D0A",
        "RSOP_IEFavoriteItem",
        "I_2218A888681E05BE558ED0089F8BE1E6283F776B83B7B244846A29B8640508D0.2708.1622730899.300",
        "C_BFBD12F134C7DB901B18D849B849ED12FCC6F3E36BEB84C9B828E11FC2FB6D7C",
        "-US\\processr.sys.mui[PROCESSORWMI]",
        "CD_7EC6FF58E9EEF4EDC93B5F895A41B1B0DEC2BDC5260802227931619EE6182F7A.2759.731012720.357",
        "CR_4FC7350D0697D65B1585376855E9596964780B95A8CAA540BF3CC2CD97C19696",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1339.3242186287.180",
        "CD_846AF3F141469D77A127A122DDB398C21332E67D66215C7CF3BE5449460CCA3C.1564.1757790929.1057",
        "CIM_LogicalFile",
        "IL_A7EBF4EA5D57361BA1D3AADD4406AD2D7B8227BB6CEC99F9510484BF112085A8.2725.2150583155.277",
        "figuration01",
        "CR_2421525B5330978D29177E2F4D577234961B03F32E0C906FA40DC69A623A7166",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.296.569384195.180",
        "R_9BD335E67BAE50C9848BEA0828D53089414BA43D5342FE18815FB3521F2F4CC6",
        "CD_44C02ACC063704A2344ECAA147FEDE938201F9F44B847689E5F61F32FD9001A8.1931.3024810126.264",
        "I_7593C450FC9EE4AB50EF0BDF18F203AF1150B81528543D16ADDAEEC31A973BE4.2678.272004945.285",
        "CD_FF159D71CBDBE76CD3A5D20DD10524A5A1A348C9E7D67EDF646E6CECE8CFB385.1539.1747564666.492",
        "CD_7BC06DFC2CCE54A0D578DEA59EBB1A8ADB06CF1508741E02D2DCC0BB4C755E69.1659.1.22229",
        "C_B39E27CA2A0129CAF7998081FB67E78792DE0588A33F7B163B6B3F6E2863377C",
        "I_9DEA7549BAB965E89BB6290C902CBDD05ACCB5AFE3A883020FD0E124E00C7CDC.2720.648861910.290",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1714.3857813361.211",
        "818DB2B3AB26C49A2AEB1D243B555363E794DB6E712436AF8BBB2D25701B24B8",
        "Windows is still setting up this device.",
        "C_A17354395E79A088E63A18457CAA51A441A886387058324A6BE95873BE2C4E38",
        "C_133926115907D1CAA329A707F5DA6057F1FEF2436D8F8041CFE6E68664D6F252",
        "CD_20C200D9E838157679E42B001B4147A35D03B45050CB643ED29839B5C1F1E6F1.39.4028008967.1933",
        "C_703C562B7404A6234AAFEB9B3BB242E3FF62C76339F84C997DCEF89443C2DF65",
        "C_E1A260703C34591BCFE34DB6F56F5F56AD267BE75E7FD5875D186BD564A7F380",
        "R_0CD3432EB17462BFB5BD92FE309EBEDE9286A9F3ADCBFE4044D787F3CCDADE24",
        "Version should be in the form <major>.<minor>.<revision> or <major>.<minor><letter><revision>.",
        "CD_14D51D24DB66114873799E12B4A2E6FCF763C91E008A265EA02571ED5A0087CD.2523.1855382268.3139",
        "IL_F5FDDA4F96E1012532E65A365C05BE661ED9E25ED5B65DE83713A92BAC59E2AC.1333.3647789585.354",
        "I_DE3019D63D665816581C3F6C4BB9A8340047D6C3057F9103C4BE1E5369BD0B7C.2750.1570270033.227",
        "NS_876145C71900245306A149A8A7DAC3FB0D74027E586B2E97BEF112C2070090FD",
        "This device is not working properly because Windows cannot load the drivers required for this device.",
        "C_92AD02DA674F5290070E761DC90ABBD672C82A5B3BF7579C78C351DA149640B7",
        "IL_3E04E6F3254C134840BF0F056A5058B1EB252D06E163C8A8100B91C97A8B0786.2713.3602186287.300",
        "CD_7AC6B537C17B7A0CE625AFA6380E4FC98418E800AD64DF240D5A7AD2482283AD.2106.595497892.3223",
        "CD_16DADF7B882F03A24B4CBB8BF019AD75A37563B4BB21A28112B781908EB8D5AF.1094.4224881534.227",
        "CD_9360C938996737B01D7C471CB4A9F0436B9152B50CA0648BF04AB0AA48F29C80.2668.4243404156.595",
        "C_89763DA48A17F7EBC9034F6876B7F745366D3C9AA4A9DE3C3C0001E38241AE71",
        "IL_429B9FC622EC20E0D4F969700C32DAA062617DCF820823CC008648C47EA2B157.2722.3135892395.275",
        "IL_99CCAE1040A6F30415BC5EAC84D071356A8461C5B06669DF71A62A91A8F3D6B4.2735.3208427087.273",
        "C_A7B0349AD657C1DDCBB62F9F53A71C1F57831A151408243EEAC27D9D9F039F6E",
        "CD_B0F597559529D7C32A6DA0B8B453B541A0761153CE325066DB6B3B967B993FD6.1066.799093225.1071",
        "CD_7C0DAD954AC25381334594520D92B90371AC70B4659009B0C3C215C466688D07.1926.3150542535.288",
        "C_9E336B8DC1D54B8E5BF3349F6BCF605E1FA4F0F0B475578AA00DF3B9A9FEB127",
        "C_CFCB33B28A39B81EF633FF01035594C2E36D0526CECA77E54E779ADB28E5A35F",
        "PTX\\|`d",
        "C_2421525B5330978D29177E2F4D577234961B03F32E0C906FA40DC69A623A7166",
        "CD_B05CCAA71F3A61FD632B96A8D0CBAC4A42DD424FB85CD76DB922673FA7A32DD9.43.112302891.624",
        "CD_9DD2597311C29BD08E085D0347CF2A159A6DBD82B7A0B5D91EAAC81FF9077FEA.2555.181478980.523",
        "CD_BDE5107C5341475AE649B7075E5FB1B219CF6D2FF755D735AA60A09AE0ED6BD6.51.2934071680.672",
        "CR_B8FE5FFFD9F56B516894A4BDA66D0309DC9561575F8C5722578410589488B53F",
        "I_AFE17534F0CF175B4EA4D4B8523895715CE1CEC713492499E62E4A42AE93383D.2705.3360731278.290",
        "PolicySourceDisabled",
        "CD_88A0C7A0E72AE74936AEC0157B4B96E83CEA40238281088709B5DB02867E7CD2.158.130652700.826",
        "        <supportedComponentIdentity language=\"neutral\" name=\"Microsoft-Windows-Pnidui\" processorArchitecture=\"*\" settingsVersionRan",
        "CR_5C6828A3364FB35ACCB00567C7BCB4FAA9D96E7DAA4FEE16FD257A946F33EA50",
        "IL_A14A3F5EDAC480CDB21EBFF1B9071CC0B406AE902E376339893434CA66EFCB2E.2680.3645629319.286",
        "C_15BB74500CCB05CD5AC2C91DC16CB85AAAE5FB06E9A05F8A5AA7D6BCB68E38B6",
        "IL_46525BAD3099F51458A5D518030526DE848A3DE564DD8816A47DE935CCD3FA82.2457.3971602568.328",
        "CR_B6954264FF5C976D13715E002D09B29D1875A7FA2156E8A412284BABE70E33A3",
        "IL_A2792B4AEC31F728576B7EAF18441C9644ED89D63F2FF60CB2EFFED7BCFB3544.2682.1515821774.278",
        "IL_D4987B113B08C3865459E47A2D1ADCA49682B6AFDB4DC21088112FF54FBA16D7.893.1.69984",
        "R_372686CB9BC0D1A64A2B8D671FA688CE1E4A43CAB6497566184229271D55C9A0.1018.915719419.518",
        "CR_4981A3BB969F4ED9382A86F274047A36B2A04D2A53526DFA477217266B033E1E",
        "Drive Hardware Error",
        "I_A296A9CC0AFFC1768D20EFF20840A5D541CD491A2C4CA1610DBF3765126B14EB.2702.4105135079.284",
        "CD_592D05C8B6862C9EBAB101DFDFC8706B44232EC87D176AEAC787159631899DED.2758.3882205317.296",
        "CD_DFF237252232921ADE7987E5391E4968B2F362CE0BB4B63D377328B49C8CC5FA.156.1046838165.1116",
        "CD_4FA7CA8594EE1914553B3C8FFCE3DFD4FC19CF88B46AB33B2D35585049F86D8F.1751.1741080068.2253",
        "IL_F67BA2643C083BC2C71F2EAC8AD93A45D125B25536C3711F02F77F0F1EE24091.2703.316025743.287",
        "CD_901AC56EC8F00C00FBAC686F0B7E1614E207CC1998593D930358F2BBE88093FF.1081.4183350443.503",
        "C_BA9CD7C31B85A636A87F036B890DA5CBCEBBF513C5593559C6820C8201B71405",
        "CD_83ACFB9DF8992B7F1C829EDFDD3CC466D5B1C6F85CDE2432D230F14C7C9F56F5.1876.2328769145.297",
        "CD_F22CF0C74A9002156D476F4DBA031C7F3F706A1A94FD4FF91611BCB6BD8FBB7C.28.2534231134.415",
        "I_234D3B5E7DA30BB242CD2CD5646EFA6370957F4EE8B2FCD6837525B88E4D1F84.2696.3502714492.278",
        "C_C169AFB4FE2A5E4B69B441A9ECCF47EAE66EADEAA0A487B5AEF1D497919B36E0",
        "R_CCD3AA66883B977C4564194B988642D386C6A68CC8CD0C50E860BF4069F1B799",
        "C_F048CF2C454CB8BAA99C1A4118013AD0A4526AC70F8F00D9BC60DB068406C882",
        "CD_8950808B8A2EB8D5AE895F8D253EC27AA46290C0D9FCF34907198A4AB3C923D1.19.1103258310.346",
        "CR_9D6DAF01BF9FEB3EF2C9DA9CCCD42495EF0FF0EB48CFEA8E496981FAD2449D94",
        "CD_46220D63709C3AA26B1F26BFEDBED5BF0C3449D14236275DE54E229C2751EF56.270.761933767.566",
        "CD_BE504B709BC667DAE2240ADC0A88BDB48E5089FE47F6786E5F5AEB39C66F90BB.2641.3344546942.256",
        "C_09A1CD34FC28B461D4B117DD4689EFC08E3B06527FEBB7251285DFC403031764",
        "CD_C414F6F9E5383DC717CF413A8534BAA7170F0D0BD81767423A9D7B9FA1F44AD8.2370.3367259002.879",
        "IL_7B322E154F0D9F7063787FDD12C121769CEBEE6D30BDB444B1AC6E6205CA882F.2685.2010765622.284",
        "C_AA41A8343BA1D329E4982E46F903D80197DFB87E55CE7405A84B7AC638E427A0",
        "I_46934F314D8C73CF84735F1E3C6EAB14C6702B40FA0BC5B992EC2D6BF398368D.2696.4110744200.273",
        "I_6CCA910ED692A20FC05D2E2F3F038996446CB86CE2DBA190B79D021048C8880C.1150.3511467665.296",
        "IL_7A464473EED377EFBCBB7DB5D2D2E323DB20CA55CAFB1D1A365E79DD41CAE34A.2714.1599386834.277",
        "CD_AA429B70C768974D13BFCC6D4D962AE6C7D2E46A2B24E5B0ABDECE10F90FE8E6.2414.4098185948.4094",
        "IL_4C10C5441FCE04BC41DDEC512892264D846021BB7D560E4EBF1E528C17B43826.1006.1.31956",
        "R_960A016BC71A8D938443FD5B4BD545FA10D9D76A0776A92D75D4E23235CAD0D0",
        "R_D0FCA61461F580F5651E9E9219AB1FF74BEE4671D57E3148B30C5A652AC89945",
        "I_B0023A70A70EEABBC6C87E22F2467D5BC260881578FA686940F44BAD0080892D.2724.3530125980.283",
        "CD_2251F72D94ABB73C502EC482957E003D2DD81CFAA082A8A3F37E0FF9D44026FD.2649.611755959.252",
        "CD_D878682017FDFE3FFC3BE47E7AA8B69EA18CE5000B41D11FA815F1FE13934384.1270.3993052010.2772",
        "CD_284916CD952AAE32B075C2CF9D6353A3004441F29529D83865782726D8CFD589.1750.1795449462.2574",
        "CR_6F49E037E6F2BFB72144CC48C974D93CBE7417A8F27ACAB5CA25D34A28C29442",
        "CD_A817CD7301A4ABA1F178C5EDA10546A2B3AB52D7C69BA07293F2F74500BB25A5.1187.537428099.415",
        "C_A85D741861673C53E1690A3A36DD370F35BF62AC7197C00161000A38E681F23C",
        "C_C6289081C8AB688F844FF931CF917B4DD7080FB5ABF4C1BADA0FD2591FE183FD",
        "The QueryLanguage property holds the language of the following query filter. For this version of WMI, it will always be 'WQL'.",
        "CR_AA89F446191A5311D6195827FCB555530663B59BC79B2415F2F523FE46FD51DC",
        "CD_D20240298678DE7FA3C580B599D2D13C6F4AD796F634F024D78D97ACD858006A.1113.1.26460",
        "I_AB995CDC4EF208FA9B882B68B87F5FCFEAFD232BBD8A1EF148EE45BF3D99A6EB.1218.3692575739.189",
        "CR_81A3B19DAF97A060286E4C71C6B3D0CC78A51FE8093E9D9FADD83D8A9A121EF0",
        "CD_EAE5B1C89A2290F48FE46A2FB023BC9468786275F5D6D2BA670FAAA8F37D0170.2663.3990227718.788",
        "Snapshotting",
        "CD_06FC0AE99192039AD3DBC9A60D9D3329CE5644911B9200854CEAD799C76E19C9.1080.3050839416.317",
        "I_1381AFED302C67D34DA20CE9AE190A6FF403DD395BB18D45FA87AB2B0CC50B0D.1064.1865296601.347",
        "I_3619B79CA84B4EDC2BDDAF5D553664FC92A5DB1056D7E513184732652E964BB2.2681.1729456372.294",
        "IL_583D0850A5AD2D84358ADD515D9FB3F1E44AC880C2728DDC36BC8284D193FE6C.2675.1536231097.260",
        "Fibre Channel",
        "CD_4FD2270AA7CC321848B51530B7A77A9E39B5486B55CE0C09A2B597A1F1FCE1E6.1171.2088938685.1472",
        "I_9C256CE37E6F9177BC0EC95344373747E0112D20D664373933986EE480BE67C9.298.3005903279.338",
        "IL_CD1415C46A3C7C50B6A1D0B8589B081CCA7C0DFD775A4144839DF5B0AF21165E.2707.1102675543.284",
        "IL_D00FFED55F65DE783594EAD7DBC0B2AFA1FD10D2673E2E04CD821800708CDE15.1210.3370094205.364",
        "IL_FD7092A4531E1D5420328B4DF5F17D0BB4CCBF2A132542C00A61B45BBF11451C.394.1.26559",
        "CD_5241CFC05A716A77CB0F36844F9A62538AED075865B9C000AF8A5A2832337841.1671.2536784597.362",
        "IL_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258.1164.198150230.271",
        "I_1B066F67BE7C3D043C9D435B904B7CCE47C5C71E980B50D6D44A5AC11DFA185E.2687.1884177331.269",
        "IL_67EEB4216546A0AC61A61CEE75D726E089D1B95D7BCBF112553DC52FEF639C59.2704.4022689501.283",
        "!`$'+X/3EcMIT;g\\7n",
        "QueueId",
        "CD_8E41820F5D3747F37A9AFB4C6D31D95936F76250DC1731B0B518951FA4D1C211.1220.1.11545",
        "R_950B982CC6F803B6E071200389755F5BC713572EAEDAD6AD08F5A06B9E237444",
        "DriverMajorFunctionReturn",
        "CR_46C4D7624EF726AE82EECFECC7D2FAFCB46460D191B35F158A7EEAE469E508E2",
        "TFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "I_CB9763CADFAE461DFE976536B62DC6599EB9A4BFDCF34872007002B0B9896A3A.295.73609405.308",
        "R_7A2E82FAA3D7445BB721477AEF5A828AA728D419801621CF35B28E55DA9D6FA6",
        "ProcessorAcpiTsd",
        "CD_BCFFCC5A22D2740C320A7FDB3EAAC4A750026811E61430ADA48FBA2937496A0E.107.1976987766.2107",
        "I_EFBA8DA1DE1CEACD1DA7078787494D65198245F93477A8E8A3F8D46A6673CFEF.2701.1291922020.286",
        "CD_38C8B45669D476148D44DCBFDA994060B1C93A2142F237D6D0ECBDCE445523B6.2565.4060120150.2307",
        "C_8CB4A8C4AE0DA8CEB0CFD6BB61EF3B4F6166FD0C6E711E54D6688A14B9EB8CF6",
        "I_96947DF494CDA31137B04A8F8590F126A86F98EC0B0D86FAA9119928A15D809A.2687.633623041.267",
        "ScanAvgCPULoadFactor",
        "CD_E924940DBDA6BB136C3383CD29AB2546ADB5364C986CB6EE98CB12EA6F955309.2598.3927057742.1946",
        "MSFT_NetIKECryptoProposal",
        "UmPass",
        "Shared",
        "CD_05D4D8FA77ED969866E398C6023AE274A4FE95E964B8F30EBE0E3225DB2EC75B.1104.196801466.519",
        "CD_6F05292856843DE1986A7572C460F004B84C2B39DEA688CD0E42BC7443F40340.1597.1891004792.407",
        "C_0C641AF43E24BC384C9291373FBBEE013FBB02E71DB5BE5F4A078ACA9D6EB46E",
        "C_A3509A56BD6D0B19F296AC815EC184C9B671F9E47F6007C2EF3F6FC0EC7B2076",
        "R_6D121D3EDB5D89CA7CA6D8551DFC968AAA296B4827B690ADD9D3BB6EF063E2C1.2465.209982398.558",
        "Dormant",
        "I_1E7121C3035B2E8CB03E36FFF346E4250C4BFE2056BDF98F351061EFB1BEB770.2707.3640251121.284",
        "SlotIndex",
        "C_DE686E0AFFF23370D2FDECB51DA77DCAC9E9B16339038E833B1D60474ACECEBC",
        "I_C347ACE19BBBAD723C40AC19E2DFEEB31D6F13664EB3609CDE5B098C6EFDC816.2711.3442957805.303",
        "I_8CE053786A98C3C000A91B52D5CF238BAFB1E2187AE12E6EBA530A8FD33204A7.1016.540443460.309",
        "CD_7006D0335AE3481FF77E834074E3321CA4F5AAE95F4A071E78CEE5CFB4E9C23A.2583.1265433780.462",
        "Name of the scripting engine, ex: VBScript",
        "CD_A2F0F731789B8BD6294886FFBA95B74CEA7B86072988F101ACF53FD6E840B35A.10.291387191.253",
        "9478E209568F3CA340985F3F72",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2750.2844578257.348",
        "CD_1CAC18FCDD389660F406EB5935DF9224FBFB7E21ED4BBB2D0F1CD467E7026A90.2665.960273732.395",
        "CD_EC88E4FB4F47B4EF6C316C25497D3AB140E803FDA6F9CF026ED61A7CB8E343ED.2591.1289796896.672",
        "CD_5A62B2FBBE8E692A74ACE78F45E81589D0CCE75FDCFF3F82D5F7A55D83974573.1609.2203832433.365",
        "CD_D0CFB4BFFA92AD4ADFBB20FF5D5C5D15408396FADD1C0E7F5A74FCED565C9658.1194.1283999471.617",
        "CD_C98173DBB4DD98E37FE4A3871D8E3D099DB9BDC9DB76DC64E72EA0E377545377.124.4135609850.608",
        "C_4981A3BB969F4ED9382A86F274047A36B2A04D2A53526DFA477217266B033E1E",
        "C_02DC84977BFAC25D2607DA688E449D49BEED11590A7432CD1B14DBD119D15C97",
        "C_7A2DC331DC9BD101BCF309899215EC90ECBD62010BA2391515142E2603A06D48",
        "IL_6D1CCF83979E74CF2D079458D9AC04D51207CBBCF8A40959C05C544A41DDA509.2686.3795360380.269",
        "CD_094CD032BE77E24831D84EE3DE38C46FBDC0C57F2466CC9AAB2CC4B43209B790.1677.1952888209.344",
        "MSFT_NetTransportConnection",
        "CD_D441AD3F69852AA912E7DB88FCCCC4374628FEB4888BBCF4D0B24CAE723208E2.143.3837907646.623",
        "CD_AF4BE4279039B330700F9676DFB82FB8AA7B80608BAF978E72E54EFC9915FE11.70.3828011168.7374",
        "SystemConfig_PnP",
        "late file",
        "C_6702CEABA78A84027D665EA8C6C2850EB8DACDCBEB5FE80B4513169BAD18B590",
        "CD_E92E47C86489DA48917E83D712F4258EEDF7A9FA5063E409A1EAF630ECC0F6DB.2656.739688501.269",
        "LastAttemptedProfileUploadTime",
        "I_67B7F1F441134A8C6F8A678F0D7E2C3F20906AB6C6AA040D4F6397D5971C3457.2722.697770390.281",
        "6.287",
        "C_5604D87ACA5767C7A56A3D5E3948E3BC37CB66F37B666A666269A63E689DEE06",
        "CD_0C004310D6E126351E03912CB21855FBDBC6A2B287BA8DDAD40FE1A2626C6745.1922.2302630490.250",
        "IL_8EAA7A72AD83AACE2BF0F766050BAE26274F7689DA939B1BF7D6C7DB68799326.2685.2660112009.266",
        "CD_F9C1E1A7069B9B36C3E7210F7D307B0A9A014B690546123D4B32550C45DB3C57.1192.2943717339.240",
        "IL_AEBBB507A29E8F338269B9CA27CFB703530BD08BC38B11D5941903CA1890F254.2544.2937017609.263",
        "CD_4C6C03582703FDD60332B03ADAEA6F879DFEE5D9E8B3E7C908FFE36555EEEBC9.1154.263832478.292",
        "CD_A878A140713AE6F3DAF726328634813CF09F03A9B90CAB552852A00359F1A8C3.2546.1512619921.1405",
        "R_AA0B4A55EEE4C1E476A0BDD0D3A0653497872B02CC12BE52258AE7DCEF46F38E",
        "CD_3AA9C8A0942F537FDAE95E548CCBAD1AD1FFA8F4AD1AFE2EE57031F74E67B391.2230.1.63562",
        "C_D0BD75AC3D8DE4C152208F12EDDCF12218F074D81D44606C9B3E833C29C2790D",
        "I_B46F59D2177FA4C49B49B1317E86B699A21B1CF58E8CBE9D2926621968CD50DD.2698.1780840674.262",
        "IL_5453CAF0E153D7C7D67C94E8E35E49CD263F8820F4C34458E7C9770C060786BB.2711.1345780210.294",
        "CD_E626C49C2DBDF1D0BDC38FFC05C85B76B4BE8E69CBFD214D5F89F70F619AD6CD.1671.1669102301.121",
        "CD_707EE99B189F38B22A202668F97D1506AB3E7D7110120E38ADE31DBAE193C07E.2669.3078288164.116",
        "CD_C504B91CF040A007F72C24FC0CC99A78401C1C475112424D0A789E6908FEF373.39.1029556504.506",
        "CD_75840B9867302C265945D054719AA22E26645943E0473183701AB28A355B5161.2580.3082540845.528",
        "I_2C6B4FBDC9F6B702033F6D5FF8ACC5D0A736F2D87EC55CFB39B53EB8345F27D0.1187.1133654144.357",
        "C_BCAAEBA95E435CA5300A680BE9BF735F04A93ECECD18F46C56865C6158D43B74",
        "I_50DA404F07584C747841B17D8D09B3408AAE08C24437A59E85539029DCC00971.2710.2562276374.290",
        "I_3ED3265D553EFC53E56777424A868C9FC47DC736E8560FD82A076B89B0957CBD.2677.3572240348.281",
        "ReportingCriticalFailureTimeOut",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1097.1025352478.180",
        "C_DC65173170329CBC28153539525DF4928293E66F1C821340853F94ED0B12705C",
        "CR_23A50366135FBF364F350BC34F639BE141A61D21A478BB4C1230D838F1296A4E",
        "I_4982B06C247AF8CF859E7FC73EA733A255C4A51DCA3F0A2E0CEA56F60FC253CF.2730.2154614090.286",
        "PalmPilot",
        "CR_FD3BBD4C42AC2F7FEF264340A9EB78A581FE5C28561CB63EDF780B329EAC2EE4",
        "Flags",
        "CD_62E24D2113A63A9168766C2091AEA6BB0D5DCD627F35EF3E18E56D8C5BDF10A1.1055.1669283977.740",
        "9?6N!",
        "IL_606461AE021084D79EC5104C6B879E035E0BC9D587CE3054DD396D0BFB41A220.2705.1001851986.291",
        "#(-27",
        "CD_A7642BB5BD25E38C8455D7FA5B5711E5CBB864E5CBFEC400B5BACCE7267F35B4.1655.1.27001",
        "I_240BF642EEB2D24F74A6C1C5D0983A9FEE0C7193926FAC8056ED582EFB04FB00.2700.584287826.275",
        "IL_3C06DEFB1CF18662A9EA84BE1BF59A84A61A924381591B87A6C6A5865560E929.2719.1468470279.283",
        "CD_43AD532E95E5D238ED8820543872B53F0ECF9646B749AD9BB6E4F2D3E320695E.1069.1878642111.772",
        "CD_BA4D1700564283EB37D303248DBE2CD56556DF9361D876FD31FF63259F460B95.2571.2018215346.134",
        "CD_C03F031E8E23282A9A69C271A64FD5AD50EF28B7797076D938A21925DD7926D4.2426.3820534302.368",
        "C_FD3BBD4C42AC2F7FEF264340A9EB78A581FE5C28561CB63EDF780B329EAC2EE4",
        "C_96A5470A9748A5F228C216657A9DE5F01BB3D899482629507545192083B50D88",
        "CD_A7642BB5BD25E38C8455D7FA5B5711E5CBB864E5CBFEC400B5BACCE7267F35B4.2255.1.44477",
        "object:MSFT_StorageExtendedStatus",
        "C_C57C6716602210E296D08761CF099FF3D53F3575D46207228D76ABBFAB23CBE4",
        "IL_FEEC37D9CECBE7C8F44A44A75478B44EA9D3711241A3E088771761D61532C907.2703.2774269613.285",
        "IL_4A35B9B4278AD0A1F24B1AAF522E8B6CB7A60CAA33583599FC981775EA0C6B12.2714.3182888042.284",
        "CD_8D17C26DD0763A67C7D4D83EC64CB45890D927901B9A9155ED001A8938DA67C3.2619.904210388.479",
        "C_5B57890445E7E878D7B64EF956A3DDEA36F2F14256CAA768F99F8B4F9C5E8DE8",
        "CR_1F1219F96576A4588331D02100737379E76B59AFFFE01B2EACFBBB0DBCD4C75C",
        "C_51595DEF0C6434555023E0ADB826EA4506ADBD6A5EA1D2C77F5165F2833FAC33",
        " The invoke method is to take a particular action. The  details of how the method performs the action is implementation  specific.  The results of the method are based on the return value.    - A 0 (zero) is returned if the condition is satisfied.   - A 1 (one) is returned if the method is not supported.    - Any other value indicates the condition is not satisfied. ",
        "CD_DDFBE2B8C9C0EB71960ADB33E49F91EDA6D2896A8A0783F02D140DCEC2F9FEC6.220.2159461236.574",
        "C_C5B405B6E0B6808F8C21D9ECCACCEA423774925D78B35437176C3B1A93D8C59B",
        "CR_F15C23121D56EB64CEDC9D19B9CBACBF5742596C0D8EF3BAB76E325DE01F06D6",
        "CD_2EC862E8ABFC3F69DF7F74BFE3B8996E77E047384E8DAFDDBCC63083E39C999D.1757.3024982591.535",
        "CD_47A1D2A8BCF5F91E1526321DD0154B4FC3C4CAC8A7D6DF2C21F3DBE6A8700273.0.750296520.154",
        "CD_1EBAFD575878C70CE2D0C173ADE6E91E3E2B346C0148ED7DBBE48D6EBAD5CDDB.1153.770567269.1457",
        "CD_7564DE160753682806BFBB9AE3DC7D3E1BBEA72CC1D5BCEA2C7C08B97EC32311.2666.1500305717.978",
        "IL_4E3B41D96D254BD0B13085F280B90AFE76F4F8979DEC43BFA37559C60F741AFE.2681.3426386463.285",
        "CD_715285D866D9BE4D1096A09BF56F1278A35EAA3564DB030AE4A24F01E076521A.2585.2306259427.218",
        "C_DDC6E09996B73E0FB9A8193017E7B68C6C9B1BCA3521A86A20F4A24B758197AA",
        "ModifiedAttributes",
        "CD_FC764EFFFFC628FB4F4C4E749D35F8CADAE14FFC3FCA171EB5E7EEED097A21DF.1529.1816913815.351",
        "CD_79CE5C3FFCFDB2E387AFB15F738C96DF562D23EEC0B9CE854EFF2796A5403198.7.4131982720.135",
        "C_0B351C69AB78CF07883C6DB3BB0F07ADEEDCAA9674115111D7DA21E852ACC0DC",
        "IL_8CE053786A98C3C000A91B52D5CF238BAFB1E2187AE12E6EBA530A8FD33204A7.1016.540443460.309",
        "CR_C9D9452296EB13E3615C122157CD56E9BB0D20377DF2B13731EB18D5AF7A66B0",
        "CD_CC8A06D68AE379FE41054DF5884BDC711740AAD2D1E5857EA8F880E09E3E9053.2627.2081851856.1629",
        "C_97447B179623D5781456C076ECF72BF0BA286864647387B5B4CB924FA06A5416",
        "CD_839C8F4AA62547C4FED161D017BA1DEA05BA49350B2617223D4B7D0D89B10A69.1548.4205898972.922",
        "C_447DB725B00964FE6AC3F949F305AFD597B2128B6EE19CC95CB28870926BA091",
        "CD_A32ED3FB3CFDAAEBC2DED4EED7D1FF0A45801F8552173833B24960BDB076B896.2555.129333211.1821",
        "C_E6644D36102EFA829C6305E663F5FA4D4ECF1E8C5D01081F3BF42BC0A113E3B5",
        "CD_901AC56EC8F00C00FBAC686F0B7E1614E207CC1998593D930358F2BBE88093FF.2001.4020680681.1181",
        "IL_3C259524726051D7603A4BD17307563E6BEB326182791CA695BB2B6FEF3A682F.311.293400504.249",
        "CD_2D600EDEB86FB22AC5475ED284E8022AA05DCE0A01ED5CD478BD3E89B6038610.1651.1.25735",
        "CD_5AE4D9A96CCED4ACA315569D7534DE1BE24FE40210ABFFCED132F6A8ABA68F50.2576.1277116911.808",
        "CR_A5405992D9D674E902DFC53B45CA5EA7030AC30531ACB3BF91D0DF7BC783E1A4",
        "CD_BF863113FECC488583C3B24A38578EF328A998D46C0973BC43C2DBE34CE5AD58.1541.541993272.492",
        "CD_14BE33F6F696D0BE50F856D0D30EA3D3F6599DAEB2DB2FE27EC78B72EE863191.2600.2888909989.536",
        "C_AF8EF437987396E623AD20A5D6E988F723A5D1D3D167C9E711D2D495849F12B5",
        "CR_1BEC388ED8B3DBC0D0D66BF6CA421BBFADBD5A16B9BFFBD5E8B6E83ED38EB253",
        "ProbableCauseDescription",
        "CD_67A6325E4B89A415675C3078139F66B22674A436284739E0AAD968F4582CB8ED.2624.1302922235.348",
        "IL_488680B9304A8CE240DD3162C60ABEBE0653A1B3DEF56BFB0E7A2CB3DC6AD158.2460.966863555.365",
        "C_58E2E57AE3257AAF7BD068A3244169CADFB546C1CB34AF28AA5179754528E358",
        "C_C5E17D61729E7377496CB88367D8A18CD6A24A14E576524968A24894CCE3FA5F",
        "MSDOS",
        "I_E3ED1C0C53B3A12F5B72002368F8F9A20828885FF309DAEA09AC4B7573352F81.2686.1334017341.287",
        "A749C62FCE60E8F20DACD959B04FA118436.1192.4073818988.308",
        "I_2E0D8F8A398E657175BD6FC8CDC3751C5169A8D1DCF2BBE70883B5A71F80CD16.2692.1197285522.276",
        "C_76A66A93A4AAAAB54C1788714735D6D3CA06D43FDA4D5185F019B0F00C9DB5B7",
        "FWPUCLNT Trace Provider",
        "CD_08763D9228F09400573FC24C5D922DB07FAC1451AF56200F470342585B439D39.2730.473953086.1100",
        "I_61B8E29430AF5705BE72508950BAB53CE99B64B7A12659E83BBC3DD21EE55F3B.1017.25161823.325",
        "!$'f*`i-03l6<9Q]r",
        "CD_F2CA4DB3C668E6418D579525693A11C910C0B4C82E7E68D52D07432FC8FDACEC.283.2775096510.867",
        "IL_C5A1AE4D66D54DE31BD0DB67526AE9F7258CD2800AEF5AF0F2B6F67014B52345.2466.3756530922.338",
        "C_F07924A860C6EA66C3DF17AE55C191EA3569D370A9FFFB4913667722B2AD2E22",
        "C_726C471F495DE5164273B09462E1D1310249850F9D5676CBAAD38DB3AD194E85",
        "CD_6EE562F9CE34E3BB818812CE4284F5CF1EB787E76D4B158EA1D7F5687A628C0F.2442.4275905618.3083",
        "CD_5D2BB5E72A2F48A448D0C78E4EF523FCA37E91EFD1ED92B23F38B836649C78DA.207.29567101.803",
        "SCSI target is busy",
        "CD_3D8B3BE74C15E9B9148205F8633C142A46D7E9C2614D82ABE33663AFAF5E91DA.2573.3502876911.1018",
        "I_B9557E5168CF69F86FDA734B7317AF9E8703192DBF228D0CD9F5CF9BD6DC7E17.2694.595477196.277",
        "C_E5D4D776B7B585D555547688115A6F8AC1380E1C8D52767A06A9776972F7BC0E",
        "CD_6B33047A2BDF2BAB0CD0739A0FA079F659110147A353A1D7656288F585E7D3FB.1973.3096802888.1538",
        "C_9BCC36936A7CD2114CBD6BB3117D20BDC217533B6143F306B044A23AE20B32DC",
        "IL_46DD1BB7F5B8D9BC8ECB86BDF4577C99E7C5B41152D22BD4A0AC4D02CC28DC08.2719.1829428774.280",
        "CD_13091E3C3054BC345002416FA26EA86BA000D8B72D69780944E68B3A51252A0B.7.3179056786.335",
        "CD_9D3CDA0D5B685AB707379FDF37152DE171B3F3E5F32F914F190FD863B176B1B3.2642.1721370419.678",
        "<@DHL",
        "R_5120F8DED242719988A9B53EE954218632D3A896BD93867D072F4224AC3F8FBA",
        "C_6712AFFCD639911A45E9ECF00AE5E5ACB9111263901FCCB409FA48F9C0CF54D4",
        "0x00000040",
        "IL_B1408702D2B30EC167AA87A1FAADDFA618008A2B6D0F24737CFCEDEBC77D3EF7.2718.1065147274.276",
        "WmiMonitorConnectionParams",
        "I_BBA9D96E0F38BFCB6795F87F429E3FCAE741B083CE80ED2ED851A1D82E5F3717.313.1586896896.295",
        "IL_A64FF6D9485FD6D15DE809633A07C392AB1849ADDA1776BFA328E8E410267A1C.1017.1488334423.320",
        "C_9BD335E67BAE50C9848BEA0828D53089414BA43D5342FE18815FB3521F2F4CC6",
        "IL_23B629B288A83FCC0F15BE515DE39061DD36D91D61904EFB9FB59278732E2FE5.2703.2905731873.290",
        "IL_C720FF9CC8690827A29417243CBBF0FD4D669B06F1180EF063E385072CF079C1.2713.3133862721.286",
        "I_F67BA2643C083BC2C71F2EAC8AD93A45D125B25536C3711F02F77F0F1EE24091.2703.316025743.287",
        "CD_D3C9044B159C496421A96D1C29415B1FCCE8B1F381A6F6000E544FCF3C9C536C.206.3395015568.782",
        "I_05FA5A24B927560FAA308F2A4BF789BACE444CBC3F38799885A3E9AF7E5D0637.2717.2317096783.275",
        "CR_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC",
        "SystemConfig_V2_Processors",
        "KI_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C",
        "CD_3DD77965331D6A3ED843F982AA9DE8CE1497BA7CE8488A02DC4AF69E8AEB7A94.1188.3474122529.664",
        "I_F39BE2F2CC7551BDE90E624B5C7301C158A68D618B887A135B21C9CB3CEFD863.138.843589863.260",
        "C_0792906C6B2175266FA3DA3DC7DC45CE70FB2A8D4E5BEDDBD9A0CF39498E3F6F",
        "CD_61CADBB506D856243E79740B6392D66E1EE943841FC396F3057262385BFA8229.219.3257345573.7177",
        "C_85F4FD558CEB2D53836A59CA16C7897C522A861DD40C1B575F3D3B0B10636B7E",
        "I_AACBAD46B3B003AE6D7031961E9FBBCD51DB26638F2E8966437CDE247F25A712.2697.3626520709.261",
        "CD_8C6449E2DF9D42E8B328C8B95C19DA35BA5DD1B3E90C6134AD1B5E625248E2F0.2761.3838697578.1477",
        "I_6325C5C96DFD6B51FE5D97621FD65EC8FE5EA211AEF50ECB08E778B30E57BCAC.1018.3247761884.484",
        "Information has changed since the last call to HBA_RefreshInformation ",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1758.615064782.180",
        "-0x369<",
        "CD_0BF4601159F302B57764FD4C588A6F678FF707082109EFA7B0AFAF7D3839EA35.2662.1903782777.1683",
        "CD_FAE72FC32B483E3ABA437AEAC24AF6CB9EE1B66A400EC68CDEA30069E7A8A2A0.2489.800044535.763",
        "CD_2E9E6AAA7475372D74084F9AD01E597F60DE921D1B941DAD896E3A6C57F7C841.1187.828980084.386",
        "CD_D24E2EBBCB5BF5B1D3AED870FA2B420D231828139B5704014F72023D34FA89F6.2650.2599075674.490",
        "P]E=HAZLSV",
        "SegmentGroupNumber",
        "CR_A3CFA2EA2CF7EBAE83315F59909BFC6F8978ACBDBD24E7ACA6B979B7B86A9975",
        "IL_A47CF01093F5B762B2CFDD0B42F06E7675B568A2001A437DE365190DA8EA1F5D.2701.4149328767.273",
        "CD_817907EE3F3F1D281C653B2387D6437098E74E117CFD338A02C0B1790D3818D0.2550.3821524686.1557",
        "I_29A56D1E02346B0532A1C4DB24A96746A435E1202E2CF49DA95FC65C6F7BD1DA.2680.4264540441.278",
        "C_E340FB8EB4DB3A4F1ED0804CB2A3406B4CA2DC92297E79DEEE6E8BA2BD0D28FC",
        "C_E5C7C1FE3E6D7A2A16D7E74AFFD769F1A6084374257017AE4D85D9B4B8AA55D8",
        "CD_941298FE57B01D7A1E5DB7CD7C2688B06D8CF556A38C47811E3130A1974EF1B2.186.2051045606.820",
        "CD_BB643341D226A49E491A828FD60D1BF2BD90CDEABA005283886D93DE233001D8.1797.1633207607.1038",
        "C_2A27EE71F034CE7CBC6FDE3C0FB6BF6E1520107D009F49F3E604B5623A36597D",
        "C_1C02230D43C9B8D44FC222151EB58484D52368F85F771DFBA9F0D7FDEF76885A",
        "CD_9DA9A42CAE7919197E51305D69CEECAE7B645320A73D6DC468ACB11BA2001D79.186.2909808495.1222",
        "CR_65E8E46531523AFACBCA9F72515F99ABBC1E45654E781033384C13AD4219C6E3",
        "CD_0ECE64D6C9FD8163FE5818A7F4BD3EDC3F5EB7904EF83EFF72449ECBEB02CA99.312.3673608266.342",
        "ref:Win32_PageFileSetting",
        "IL_2050789B46CC098B900D800809F5F0D52680B20919159115539A03D30EA63839.2678.1980922697.287",
        "C_29496EE13A50FC208C78C52B2E38D7EBB9517F3108A323CCB520DE03AFA2EB81",
        "C_EFD628FF86806AF6B75E95FDA0EBECCB53F0013E3C801AD54DA913AA26319D53",
        "$).26:",
        "CD_403AACAE2825C9BF5B51FF916E370CD0670FC129E1492AE9CD4E8A7515217BBC.2229.1204270575.313",
        "CD_CBEA5DB8929D16C32E514213A77F18E006AC31CC4E0E1C4D84A95AE510CAC230.2636.28841472.268",
        "C_EC54BECB03915F3B8D1B884127688EDC4BEC45436169D86F9940C3622CB3B981",
        "CD_739CBB07290D58D47ABC1C0E69EB7169E128601DAD715F68DF7F5881BC109754.2668.1136388102.429",
        "CD_968609C9F28B0E2C5D6734E1BB18A4C16D987F2BF5ECFE9A272B7D3D95B9C7AE.1544.2123066619.603",
        "WmiMonitorBrightnessEvent",
        "C_4DA7E71A9CC400DDCB891860F95A9DA5B5C3BDE919E0221C377225E0CF8C99AE",
        "C_46224D79234790478799E373715902A3BEF0846D474FEF97E0FCD898A61C06EA",
        "C_23934BAB3D64E6FBBA2D103113B7071EEDD4C5897E664D2380D00F90496625D2",
        "CD_DCE585FC8090201AD2A481DCDA9678ADBEED6FFAAA2CD50925EF913678001533.2020.2053751910.507",
        "C_009060D2904B4B02AF55083DEF7BC672283599AF1BEDA6D3B9EC703CB3D5B011",
        "R_3205C234B2D5F02B734949988492FBCD94159F50911E0F44A000D975CE1C5819",
        "C_78648B4777563867EAC1D3203AA282334AD332B4AED362C60F895FFE37CD52AD",
        "CD_8C6449E2DF9D42E8B328C8B95C19DA35BA5DD1B3E90C6134AD1B5E625248E2F0.1079.948189314.1477",
        "IL_234D3B5E7DA30BB242CD2CD5646EFA6370957F4EE8B2FCD6837525B88E4D1F84.2696.3502714492.278",
        "R_0549C3F3F6F6454D55B38B35B24384CDC5A1B39FFDD2A994433A2E79BB609738.1976.94671035.556",
        "CD_FAB579260306CF6BFF8AA42E9AAC8900DD8AC191A796F9430DC39085EEC7005A.271.534713725.1357",
        "IL_B2126DF89CF1DE3913FAC3B998A658DE3E47D87D0A73369A702B132DBA49F337.2681.463787080.279",
        "CR_EC346D4B55B7A3D064DA670AC46B8BE53932F3BCFC8908523A9CE445AF651CD8",
        "5.268",
        "IL_60E5E385E51F7170564DC3A25AAA1E35C0C27B9240E9CAF9E2086D795B396162.973.1.8675",
        "IL_95F4083250754FC3B4307D777B3270660048ABAB373B4F4EB2E60EB9A0ED9C9A.2763.2948914252.284",
        "IL_4EC3C8945D6E1741F6797BF1361EFB60D235E79FC77C7CE48A373BFCE972AA49.2683.456667102.279",
        "C_49C003F958AE429B51E409471F01A643359D07DB4A4E6AA865D8578747CC13A3",
        "I_C2F4B2EA758C7AC5101B04C6A132B43B64560A5E41B7E83EECFDD2AEB1A0B8E9.2675.1453024317.281",
        "Saturday",
        "IL_EFC7BACF0E0ECC6CB7F7742DEBF6C306A9AEEDA277214586B1619FF1151D944E.2697.3078889107.265",
        "C_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170",
        "I_0BC2DAC7B5A8588E1C6578BCF1FB08DE7C5524D9079B5868CE649654424D07A8.2735.2439523697.274",
        "The name of this registered specification. Since multiple versions can exist for the same RegisteredName, the combination of RegisteredName, RegisteredOrganization, and RegisteredVersion shall uniquely identify the registered specification within the scope of the organization. ",
        "C_73D3522E76EF49E09F2C9349B6153167CE1B6A78ECD8672C0087F368CF21C8C2",
        "IL_A1CD47E326D593CA413B7682EAA8C8C545B74CC9B1818B0D631EB0BF3B73D638.1015.1519930690.334",
        "CD_C11E0B2968F07899C3C15A08181C55EA86BBBF2FCDF1D89855EC8855E08BA914.1750.1455055579.992",
        "CD_B92891CBB65AEAF607479A16326D383AB07D2531A1DEE0FE9CA0B9E07C092BBA.2604.1492723873.3578",
        "C_27545EF9AF30016456878C73334927CEF42796F61B60EF109A3D4C4944732250",
        "C_936D541CD85969DF0CC7874005A3CA167B065E798E6CB9B3817781424E973EAA",
        "IL_8A409626F61C04968CC249318B0841B44FC037D8139615AD01F11767D7ECEDFF.2723.470324367.279",
        "NE`BQc",
        "CD_756ADF3A38037C884D036F3D193150C71CD696CC6C340246CD1DB26B98747BF7.2420.2029836514.362",
        "IL_8072BBCEF949AD08C3FD6035377954D54186B39AE522E1CEA1EF61B2FB3A1593.2698.3035793405.269",
        "C_7010B213179D98B16AF38723EE1D750E86F808F341EE215AD8783D29EA117262",
        "I_F186D6CA8322FBA3B99E9C2D5C4CE6C5528C66DC81653F30BD1D9D7C9DE15402.2675.1646906588.280",
        "I_A4E92491184161E36C68A11A49A32C76538C1D204ECB0E49FC3950D462C793F1.2704.135469033.285",
        "CD_B92891CBB65AEAF607479A16326D383AB07D2531A1DEE0FE9CA0B9E07C092BBA.1583.3159391060.3675",
        "I_5196BF4BB193F5FD32B65F33245729BAACD84D68DE23317722BE58D06EBE86BD.2719.3575025858.280",
        "IL_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2.297.668444964.338",
        "CR_F9B170C89D56233A8A5661042F3B670A16FB55B73910DD19B9F3814C67D2D427",
        "CI_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "C_1990BA6B868083E5BDD438C1C9438F9F7D36FE1A112C7FDBF6648416023E84DA",
        "Video standard type",
        "CD_FDA51E5A7FEC04F05BA768B870478212830881C45AE5889BF118736487DE2187.2052.3777710889.148",
        "C_C89886846383BAB3B77E286B6A3E121ECB55A8E5DB54282753AECD4AE5DE4AA0",
        "CD_E54AC9C8AF2DF17AF3B8C0CB2919B6D7164B0CD443D51BA17AD5F6B6FC0AB970.260.531283129.715",
        "78E209568F3CA340985F3F72",
        "CD_E7B3BF5CA85CDF3ABB8EF64431ED7D1A67B9FD70D9D851344D21F9BEA7F92B3E.2379.184969600.679",
        "CD_5F469C3B14C86BD8171AB925DA0880DBBA7A8E1FE64AC6F8F7594251648D1E76.279.3989874534.364",
        "CD_F7420DA6533A2C562AF06F1F87B007C0FB6BFFD5F71653722CBFC32EEC340ED0.2273.1107893678.531",
        "CR_C78AC0FF7EE3F58DB7822FB4C033CAB6C42D54AE8C8F1545E75A7C5FC5C2ABDE",
        "CD_C4F661973CD3C0A0D2984AF60EF23047396681C367251D4E47D1DDBCE0BCDFE6.1997.1943467998.6307",
        "C_CE60FD48B8554305653B63F3FF89DE9F487AA367010DE6A864E4D5A7550F953A",
        "CD_9226DE8FE74359C1BFD228B1593D6C5E10185F550FF2997587B5AB69BBBB9891.2649.745309661.244",
        "lh6:>}W",
        "C_E8A8D6B4FC24D90ADB5A9D008E4FC2860257836A2DC3482FE5576FCC1546870D",
        "CD_8005FAC3261894B05944F0070A29BE32799EA7111782F3437D1C0F7794E4D4FE.2653.2420176792.676",
        "C_0B0DFDFBE2DEFF0C27AC9F8D5B6614399810850DF41A123329B91B91C5AB60B2",
        "CD_2C9E96C7F7E323559ADDB98919DA9CB9D792B77EB6D7DB30E98DE86B6BCDF5FC.151.174347943.783",
        "CD_AA8DD13710C6232D550EA0B5DE30AF5E61E2B29E47FB806D9004BA3511197EBD.2599.3223222782.90",
        "I_477F3F63C7E8BFE53EE82AE79FBCD642EA95C3451448E3FDCBE433605BF36F82.2703.3062993540.286",
        "R_316028CB4766215C2B0D3643DCC0FC70FE66BE560FA2335CAFFF2477CB4C6F30",
        "IL_64FBE9828EDC5352EE7ED640E40EF41D5C38B6F407714D921DCE3E3C939987CB.2729.3355516801.279",
        "CD_259A5E159C9BC70687CA1D3524FF3E5AFC0180D51D46E1351D0D2A9510F67A46.43.4152961205.550",
        "MSTapeDriver",
        "(\\tdPlXThxpLH`840",
        "CD_97C7D526C4DBEB7083476F235A5653C31F00C78AFD98652230E17D721E353ADD.186.2679246819.883",
        "CD_02E226BBCB88A35C58DB3E55C3D201306E2FAABE9C83D64654DC4E16660DF61A.70.2831678191.629",
        "Describes an instance in time as returned by Win32ClockProvider.  When a query is submitted to the Win32UTCClockProvider, the results are returned as Win32_UTCTime objects with times matching the query.  These are returned as part of __InstanceModificationEvents",
        "C_211E06180BCB1B723514A6B61A4F9437E8B7FAF07E83A8E52C3887B5E0B0CDFC",
        "I_B2096C9AA0F29B706796B428CA579EC2F42C2DFA6F8F47B76A11C7F44194A8B8.2690.2399552005.263",
        "CD_3378669615577B42FE9D7F6AFE5937F8AD52033749937CDC0D7FDB57B33C7738.2665.3939175621.243",
        "CD_33AFC5533FEF2AB8957C705077D2CB2428067503BF4A8D79697DC98C53B8A138.35.1209153609.438",
        "C_486C78842972E048EB3AF4A98B44D84B41374C16F30B7064983012EA8F4D33E4",
        "Enabled",
        "I_1DD976C2C1EC41AE2C2E9AE437798C835C95C683651B2DFFD6DE00EF8BD37B9B.77.4005104059.331",
        "CD_41DBF5B1870AF9F0B77D7680767E231A2460610113F21236505A5E4A30EFFCA6.1155.3640459074.813",
        "CD_D3E87AC2C5095799D67D44AE7591A2749E7365471471AF9E1AB7656018268D5D.1748.2980534113.4304",
        "CR_6702CEABA78A84027D665EA8C6C2850EB8DACDCBEB5FE80B4513169BAD18B590",
        "R_3AE6AE4FC05317EACD52C3BD668C58CE614118C1241AE4CE2FC6907C9BF86C84.1020.4186970821.524",
        "IL_795FCF98959EEE649BCA1F7DF2A1D1BDC8F33065B05D9D940F64EABCEC875307.2721.1107037709.289",
        "C_3E93490AD7E19BA9FBA51E3DC8E6582CA6AAC992C61FC9D54D14390E9939C366",
        "C_6B6E099E11689A83F0DC500069A409572F5633F1702D3669455D70159BB2B714",
        "C_9611302718E7A15BA3E862472FA9FA8DC245F3CD224631FF3A3E4FA636E2150F",
        "CD_D6AC1874BCD5D63CA7042355D364CE2F60097897614B47C510C64F3F54102BD1.2578.2254261100.1702",
        "Image_V0",
        "CD_8F783D220B8A0BD04FC50E7EA1E40E37A1439DBF5972B30B3D51392105E018F5.1741.3662403705.242",
        "CD_0329C1D1556F3FE0688DDABAA7029791319A9617145815E21A087B12FCECF5EB.2089.1.36809",
        "I_91926B01F898701429B4A3FB9E112890FE6D5368ABB9B85A647A3B12D06A11E3.2678.907125016.282",
        "CD_153A90D31DAA2BB98D107166F8216FEE25A312878D4AECBB89966D3EAC52B5F6.1650.824956909.341",
        "R_64F3934C77CBCF89E84DA868459634281E17E5BCF13A323142A343FF887F35B5",
        "C_27641CFCBA4CFC92EF51AA740A76C9C114FDF1C6E8F39BCEC729211A83CFE449",
        "I_16CF93341F78E613B28AC0076DFD8DBEBCDEFA56DF53B1C8B0B6855720FD6B80.2675.2928622965.277",
        "HNet_ConnectionIcmpSetting",
        "ROOT\\StandardCimV2\\MS_409",
        "CD_115C2C7C875DAA2D80858EAB217D4BA6077F4CCDF9EB9B75A301CD68389427E6.2015.3247647938.545",
        "IL_0530F08DEA4C0DF8DC605902BB5943B3307E6584BBD662E8DEC5A4AB1806BE05.2696.118254578.277",
        "VPath",
        "CD_1FDDC576FF86C33E163A5B8EC72A7DCCE9CA8CCFD4AC8A6A8CCC18A08EC869D4.2567.823780702.168",
        "CD_41618FAF81D0E53A7763CE9C298451077D86596F7351D97EBBBC77A817526A99.2645.1006920783.536",
        "R_E2929E24A4D3F33074BBFC9EB2E285BE087B76057F553B22FB5CA19B172B3C4A",
        "CR_4B66FACE2F9688020890084420324926AA3CF21932AD39E8C9ACEA5209F73583",
        "IL_69490364A6EFEA6EF0EBC265D6A8B5F7913FC5A09CDCE3B1468EA54EF695B0A4.2727.2638936822.276",
        "I_50B704588B5DBB37D3D3B305CCCEFB65D916215B57ADE78B58DAF84095AFD528.2678.3166942860.280",
        "CD_AFC2C77E00949B535F20B4C49C402E7EDC81D11016552B9C9324031BE73C36C7.2617.1750843665.1791",
        "CD_71926B9951B4E8AFC04CC2F1AC5B5FEC04E9A08320F8B28164D32D905C0A41AC.149.2348166780.593",
        "The Win32_VolumeQuota association relates a volume to the per volume quota settings.",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.3789313510.368",
        "CD_945E0D785EBE9AFA48EF45547D26D1AF268739A26006972196EDF0166C1F7FDE.2625.1667234341.564",
        "CD_36998BBD1F34ACF15B900E670E327F028E4B196C8A6E911E23965EC2D63ED47F.2424.613121373.318",
        "CD_D9B796CEAE627F28520411AB7A9608FE05EC97E01551AA9F1CC3C532A4540954.2547.518448467.953",
        "C_ED8BE0EA146608759C0E924287397948057A0F5F3DAE6E95080F8788429EB473",
        "CD_7E470595B07CCACED12AF52AF9B26E1DC367DE0F25EDA25E0FC74FECC24A888A.1172.3962771221.271",
        "I_A23B96312E14EA0EFD42870A76FECE4606704453FC2DB3858B1AD85FB870BA26.2676.3372359704.277",
        "CD_394B05E1EDE5A9F11AAF607CCCF99471F4149B2A39790CFEF4DEA8C7D9E030B1.1929.1705181453.300",
        "C_18D8719A943B4599747ADA74EA7D32C69D833172BB0F49178849B0570759A4F9",
        "R_B62B59E86E07741341079FA1421457C8D2F2E61FE1E29EC64686B7A4663C4D75.2459.1414166320.554",
        "I_FE9C9CD46B3A30EA5E4839A24B058F7B22E5E084DA2318B01E16714929725549.2691.2386019595.273",
        "C_EC77747DFA1A56E57865C924EFFC4FF3B343A32F0410A14B86E627A721399A15",
        "I_402C1A988E3C967CD44E0B98E94A4F14DD8D1F076372A97F42DC7DF9350DEB1C.1014.540356429.299",
        "CD_65BDD6212EF53E137C74914F0E8C6D83526505C01E3A3FBAAA47518944B541DD.1650.2232982439.281",
        "CD_4BBA71B8B969B6626A0E7F60779736282C60AEC40553354F5884C7B9E51AF36A.110.797082069.333",
        "CD_FEA174838505F017ED6B4301AAC1DD5D141215A4B6A1F43D4092C1E5AC1A3F37.2750.4003497268.735",
        "R_BBD86C45827BAA3142E8EBB2B4C0577FACECCA56171A99F17B3F06E280A3C32F",
        "CD_E9D1340FA30260FE6DC9A13A7C426F447F5CFE8119285A157042BB8CB324B46E.1731.1.11991",
        "R_96E71800D80C056C3BF400D4F2719AA1632DADB646DC656E6C57790EC2BBFD37.1076.2648486392.518",
        "CD_99987ACE788FDA6044200C5CAD36E8FBA4C6DFACC2585158E6C31C93918E7DB8.1749.457719459.622",
        "CD_11DB2545DA5D06D63F49C8AE879C36DC6E19B1AF439CFDC93A32FD7D7D63A18A.1575.1669607494.432",
        "C_1C96B6C34750BD86CC328EA53C2113F6AC8A17F76AC8E9BA281ECC75C09F19FB",
        "CR_8CFD3BDCF459E28A190CCF46FF43F533DE3394389F988133FD28EA5A0AEA1616",
        "C_DFCE5B8EEFC1AF231A170E8413130AF6AA4A71FD22AC6E352C7DBF46462589FC",
        "R_CF8FDBB8C50EA6F07E9534765AE8F402553A990211E70BCC0755623188D0291B.295.434026281.538",
        "C_CAC510593AC97614DC7DA1F7D9C423B2F603C46FDE077301A4FCF1E4C1DF7D3A",
        "CD_49358D38287F930E1B9B4F03B6EAC81CD41EBFE0283F257F89AEA8AE3D4D8465.1190.2780080177.612",
        "R_5F4AA329CE28ACB351FC6ED10B24538C59741D24DCE7E4F79448CF1ED4DE3BED.276.754342863.520",
        "CD_F8A40DE76638BC2D6B465FB946B5587EB32CE4928E4F71A985E7A4A1C7848063.2749.3579121183.297",
        "7oolTrace",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.2042.3015033162.558",
        "IL_733F4631087A8F2BF57EC213AEFF221568486064B190B110F9AE4B8FB217574C.2689.1687383617.262",
        "I_17DAB2F05DAF278660EF7A9033EDE44A9CD589FBA9EFE2D8306DD6119DEC472F.2764.866969792.278",
        "IsConnected",
        "C_71926B9951B4E8AFC04CC2F1AC5B5FEC04E9A08320F8B28164D32D905C0A41AC",
        "CD_9DC0A5652B71803D627A0DEBBA10D1832C8C71C7B53C3FDE13C8544A09726631.1538.3265819325.2941",
        "IL_C56E076607DA66CC2D5BF703B6E28AE59B1F022415C3A0A94DBA13B643B4EDA5.2722.3765280269.272",
        "C_715ED4FE059236E0D9FC94E624645193F9F27AD440D64189FA0681CA9A717570",
        "2AEE1C523572B9C00CB53A36167EDA3CA812EECDDE0",
        "CD_ED68C5D9F6B69094D35F0FE61D30082A4B839307A54E9EAB1C21A62829FFFE84.1543.3943487010.525",
        "IL_7CC396005702488E62877B16F092BE8F892E05DC6CBF2A11E46ED5643F6FE16E.2713.3776123079.284",
        "IL_2443123D93EE5A3B000A2E3E2B1C5A3E9397ADE0764C1EB9B2E8ADFB8AD23D17.2712.744782486.293",
        "I_DEF1BF075B261799D0512C40440084B446EB057FD2BB0DE92129B3BC752F69F5.2685.3590575534.278",
        "KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "CD_D4D7929A8312A6DC45326BF70047842109EC7C6FE50B4DFC14E0212EF111A093.1757.3912881443.597",
        "CD_8F21C89CAF771FFCC47E28C59A7D76DBF0F63931FC16518B322428129F505FDF.1465.1744315508.465",
        "CD_CD83DD1439D79635F8FA7EF37348ED23261AD574E88661F73F9EFA7A25F6F8F2.1067.3619997755.1103",
        "IR_E3D7F95EFC48281E54DB3A2A989097F8A85E22189B283A6B9F1940D3598C3A2C",
        "IL_2797AA0512B80E7E1C1A6BA2AC1D2A5EAB929047EBF4944B5812DE3C32DEE06C.313.3654328068.299",
        "C_021AFE414882C03F97BF442E09455A26212B908FBBC7D7673C42DD465658CAAB",
        "CD_E991E45745117956DEAFF1C67CF04DB972E8AC05E236ED8130C434E25D63E63D.1836.716013129.435",
        "CR_4D8DFA1656A0EF3C4D96AD8437B73A10EFFDDE609C718E95E7BEF8FBACD2A3DF",
        "IL_9F3D1A1D5ACB3061E1F2CD23DC3307A4E7EE3D96E3DF2B5944C23C0FF69F8893.2675.1250944241.281",
        "CD_9E784A36A3818CCEF710DDD5C36D397926DEF1DD3DBF75F107C211B75FEBAA90.2217.1.8451",
        "C_B1D75A909E6CF2DABA2DE9D5B0D2A805DDF2E38027D332B19EBFB8BA7F770899",
        "C:\\Windows\\system32\\en-US\\kernelbase.dll.mui[MofResourceName]",
        "C_6B1F3311CCA06CAB3284469851FAE24183E4FD9ED26C9E4A5BB23BA42007B2B1",
        "C_A67F6CA5AD0F3F082B7328E37F2535113EC93F9273483374AD4B41FB5A9EBA2D",
        "If FALSE or NULL, this method",
        "I_D763806FB9ABAAA8606A4E9202FB1CCCE4F5FF33FAF2B45072F3B3347E8AC485.2708.4010078342.296",
        "IL_2148C5CCDAE3A05729A65B7635B15A13E90C53DE7125676C47659A15E6F19191.1520.4031734246.187",
        "CD_48B29E9AE4FFC8EF806EFE0B21B81E1AD49B510512EB4535634C1F796E081ABA.72.1024667953.915",
        "CD_60F176EC0AF17AB7C6FC2843157E8D086806E5F0522F8004584440762F45B2A7.1961.173996645.660",
        "32\"4D",
        "R_62B7F57437B06407AB4B39D9915D0BBD1E5003DEA18F986400E85C5F698F8D97",
        "ft Image on Stereo Sync = 1",
        "C_A7934FF637F20334EEBDD374FE2444F45A95C5B33E592D4DDD69ABAFD3C46F2E",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2136.2151069127.188",
        "R_78A09B4153AC1B1D76FECD8F9E9B6B489EFB9544677B543263F14A7346D23F5D.1065.1173667247.524",
        "CD_884D60D0DBFE6460D83079FECA71E009FB88E0ACAA9538FA4A82F908C79947A6.2116.3749599012.1207",
        "CD_E241A982292C9628611468FB40BE60D4CC1B723333EE25A7584E871FE9DA753E.1996.3980297564.780",
        "I_7BB3B0FAB257FC3717B5B5D99E4893CDE4CE71D21C927238A21732519D106AFF.2690.1173560808.270",
        "CR_4A8C48B101586E49CF7BB2FBB8C8F9CE4C850648CB5DF606B94CD22AE6B1E328",
        "C_9AB53806E88665C047824D5369B271C53B233BBEAC7C15BE3BA9BD214E527500",
        "B3CF1BC3EC0C9398E32D8B8DE1267FE97260.2718.2810907187.272",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2369.1552428084.180",
        "C_0A702609A4E14ED5BB54CDBFF28E5ECE8F1289BD2EE16275B15126AFDC32B85E",
        "CD_C92F2D60ECAE92569E6C922BE7396D0A84A93FC7A3AB3FDAF76E038B26F8FF18.312.1108765993.654",
        "I_8F2319CF1CC2137ACBD782D141DAD173E170E80A9034A4B1929599CF48ABA70B.2695.2000470039.277",
        "IL_2218A888681E05BE558ED0089F8BE1E6283F776B83B7B244846A29B8640508D0.2708.1622730899.300",
        "CD_DA629F0FADBF1E9D6C65713F31978C9EA30680E880B4ED8EDE3DC7BD5AFDAA23.2309.2370190172.250",
        "IL_AF40BBBDE0B04254A7DB7168AD8BD4619F792348A29FDE87570C9FC2F908731C.290.1157322922.282",
        "CD_D8E4FDD0D26D90B6E6471AE5FDE8707D903FE6C0E0DDBCAFDF5D70483F378798.278.1023852159.706",
        "CD_3378669615577B42FE9D7F6AFE5937F8AD52033749937CDC0D7FDB57B33C7738.2595.3884454676.206",
        "IL_D48DE779C78A7D61786E058F05FF12CF5E40B5F68B176C335E92B74F567A4027.2717.3952586855.276",
        "IL_DC8C2893B74808E659A3694AE409588A118969D352C3E87A4B7F9C102C99E793.2679.815139356.286",
        "C_B02216361D55745EF586077288F3DA27E9F2DEBB352CE46583451DA731CF523D",
        "IL_F57AF3E0321AFA8606FF67444CCBCDB6E5D7C9CDE02AF718489B68BEB2A8EF91.2694.1014581604.278",
        "CD_06D136F7B0ADFCDC593CD2915E41E046885B6FE2B8DA0198F3B2B133CE772261.2606.846716848.195",
        "C_3CFDE39E9D28C34AE877E11B2DF9F63280B899B04139F6BF489E37FF8557DDA2",
        "C_A03A0B9B0FDC488FC2A108014B7B7F05E69F51726268CB0321B939811F003F3D",
        "u?TWKr3io",
        "CD_02E158B45830B6D4377ECD1CD643B18552229BB1DFCB48A9FF9F91F3ACA3AD62.312.138204832.340",
        "I_AD8A41A11757A955B842BF5D3088E2B483ECD1357A92C5ED54EFCFC30D69D599.2735.1404057876.280",
        "C_2251F72D94ABB73C502EC482957E003D2DD81CFAA082A8A3F37E0FF9D44026FD",
        "I_699FBA37BF7FF52FA94321665FDA8BFDD987C40189FF7416F921A0B31C1643BA.1130.3608135223.207",
        "CD_27545EF9AF30016456878C73334927CEF42796F61B60EF109A3D4C4944732250.1217.3437164480.5524",
        "Maximum",
        "CD_62523CD9347FEC90C4D769CB3F74810C750EEB7D6102ABE0F8A3924C1484C14F.1129.1750661613.843",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.304.1222916123.368",
        "C_8C6DE64ADB30E76FDF169C4158D6C7A5755650401C9DC05B818D0256B4965C17",
        "I_1BAC7DD50DA631222A930BD41DEFDA0562F12F4F44A515385572C56D60AF68ED.2710.1647950498.285",
        "C_FD27ECDAAA7D6C49E1565C286F03227F09CFD14146B494ADDE67CAC27EC54A8B",
        "CD_B7D88CBAAF2C338213E1E72001B6814092CBE165351937E6CEF7D675A2947B58.2196.1728840111.360",
        "0x00010000",
        "CR_C62347F459E9E9A6DD2944145D972E253F3D3E7B606F67BA3892A54A2CDCC625",
        "CD_09A1CD34FC28B461D4B117DD4689EFC08E3B06527FEBB7251285DFC403031764.149.3941529312.757",
        "CD_335C9D1C30BF96E7BC1FFA98ECADFD675A3EA69829813F59062A99C13DC71866.1193.3041454891.248",
        "CD_567A5780A80E396C0983EB16985C38ECB3908CF71E7B109F7F8365635205A7AB.61.1044439522.1243",
        "CD_AA0B4A55EEE4C1E476A0BDD0D3A0653497872B02CC12BE52258AE7DCEF46F38E.1219.1069400742.350",
        "The UNC path of the cache item.",
        "C_FE094C1FB84B65B5783A09EE15B884BF95BBD94173D9D96178608B50F8C0ACDD",
        "Reserved for ComputerSystem (the block server)",
        "IR_1A671C0E762995F8E9061178C1591B318A37CF6147DE1AD7F5C9591F6F8F3EAC",
        "CD_00B3AB9882FAFE5C6152ADC249422592DD6C82405F70D062289FE869D61E0C9F.1538.2598300408.1384",
        "\"FC\" has been deprecated and replaced by \"WWN\" to be consistent with the other ValueMaps.",
        "IL_CEFA1B411BC11C0243320DB385ADED0A22B006769FDA616F37991785CE2BB305.2713.3481169658.291",
        "IL_653B6A35271DAA7F4D6EDFC2E9E795101F58B4B177E4E4A5A213F1257972A915.1938.3960030189.307",
        "IL_6043BE6E12C20875172CA555985196ECF8D1C6C066B65DAF470B3DB6ADD62B11.2701.3253654736.274",
        "CD_4D4CE956D39D51456603D4ED1BF7ABAD64E72F02B0D569299B434D13F41AD4C4.32.708442167.1664",
        "Administrative Template File",
        "IR_EC794B3467A52CCDF1B174E691E806AC5F2BE51FBBD02FD9D19305BDFD36C8D8",
        "CD_7C82262F50CE3724AC8434FD0FE0E31A40C9A7B353ABD3DEF2E6DE0816F201C4.197.2469973948.713",
        "CD_C62347F459E9E9A6DD2944145D972E253F3D3E7B606F67BA3892A54A2CDCC625.2759.720555757.237",
        "CD_5F36D1944A2418B5A351C20BD9C1B5E3BF64E7FA512D227A09AA6978A5B805AC.0.3390574330.287",
        "CR_9A0E4B10C24AFAE23D25837341C73AF3317EA35AC13D0352F93F4194616EEDFF",
        "CD_FAE72FC32B483E3ABA437AEAC24AF6CB9EE1B66A400EC68CDEA30069E7A8A2A0.2483.3116965.394",
        "C_829131EDC6839DA24011A54FBEA38B1D13A2BDFBD97A229CCB462F4A95FA5DB7",
        "C_94167BF91BE19E1C62EEDAB062E1BD60608CAB59EBE8824D966E9FC0913F7356"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 4344
    },
    {
      "name": [
        "MediaSetupUIMgr.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/a2679d717db07f43d81f895e508520e01cd0262f1be5870333d12ce71fe02db4",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll"
      ],
      "size": 15634744,
      "crc32": "1A2609D3",
      "md5": "bdbd14f60fc78edca16a022c9801cf70",
      "sha1": "e24ce3852cc9d42296c3fd550735069b86d7518a",
      "sha256": "a2679d717db07f43d81f895e508520e01cd0262f1be5870333d12ce71fe02db4",
      "sha512": "6d6aa6aa8108d49347b4d5b40c632e568d44805d6352b517363262a408f7e04cafb3a66d1cb121bf920df080c7119401c454f90ba9a47ffe593ce9cb11da78b8",
      "rh_hash": null,
      "ssdeep": "12288:mzKrn9w8KDsQ/z20NoJDZVm4z0VdwmTRjnaQbjAKz7h8n5Ou:AK+8KQ820aXVdz0VdwmTRjamPh8n5L",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1B8F6951162E9812CF1BF6B33B8B552D2096EBC519934C53EDA20754D9B38AF0CA78737",
      "sha3_384": "6088a3f2666de8c3d042a9bbecf54584294e6a4cde8b77cd2049fcb3061488541b847af18d265e97cab30cfdbe79baff",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x0005b6f0",
        "ep_bytes": "8bff558bec837d0c017505e805090000",
        "peid_signatures": null,
        "reported_checksum": "0x00ef251a",
        "actual_checksum": "0x00ef251a",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "MediaSetupUIMgr.pdb",
        "imports": {
          "MFC42u": {
            "dll": "MFC42u.dll",
            "imports": []
          },
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x100686ec",
                "name": "memmove"
              },
              {
                "address": "0x100686f0",
                "name": "memcmp"
              },
              {
                "address": "0x100686f4",
                "name": "_ftol2_sse"
              },
              {
                "address": "0x100686f8",
                "name": "_ftol2"
              },
              {
                "address": "0x100686fc",
                "name": "__RTDynamicCast"
              },
              {
                "address": "0x10068700",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x10068704",
                "name": "bsearch"
              },
              {
                "address": "0x10068708",
                "name": "_wcsicmp"
              },
              {
                "address": "0x1006870c",
                "name": "wcschr"
              },
              {
                "address": "0x10068710",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x10068714",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x10068718",
                "name": "memmove_s"
              },
              {
                "address": "0x1006871c",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x10068720",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x10068724",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x10068728",
                "name": "_onexit"
              },
              {
                "address": "0x1006872c",
                "name": "__dllonexit"
              },
              {
                "address": "0x10068730",
                "name": "_unlock"
              },
              {
                "address": "0x10068734",
                "name": "_lock"
              },
              {
                "address": "0x10068738",
                "name": "_initterm"
              },
              {
                "address": "0x1006873c",
                "name": "_amsg_exit"
              },
              {
                "address": "0x10068740",
                "name": "_XcptFilter"
              },
              {
                "address": "0x10068744",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x10068748",
                "name": "_callnewh"
              },
              {
                "address": "0x1006874c",
                "name": "malloc"
              },
              {
                "address": "0x10068750",
                "name": "free"
              },
              {
                "address": "0x10068754",
                "name": "wcsncmp"
              },
              {
                "address": "0x10068758",
                "name": "memcpy"
              },
              {
                "address": "0x1006875c",
                "name": "toupper"
              },
              {
                "address": "0x10068760",
                "name": "iswdigit"
              },
              {
                "address": "0x10068764",
                "name": "_wtoi"
              },
              {
                "address": "0x10068768",
                "name": "??0exception@@QAE@ABV0@@Z"
              },
              {
                "address": "0x1006876c",
                "name": "??0exception@@QAE@ABQBD@Z"
              },
              {
                "address": "0x10068770",
                "name": "??0exception@@QAE@XZ"
              },
              {
                "address": "0x10068774",
                "name": "??1exception@@UAE@XZ"
              },
              {
                "address": "0x10068778",
                "name": "?what@exception@@UBEPBDXZ"
              },
              {
                "address": "0x1006877c",
                "name": "_purecall"
              },
              {
                "address": "0x10068780",
                "name": "_vsnprintf_s"
              },
              {
                "address": "0x10068784",
                "name": "memset"
              },
              {
                "address": "0x10068788",
                "name": "memcpy_s"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x10068790",
                "name": "RtlGetVersion"
              },
              {
                "address": "0x10068794",
                "name": "RtlAllocateHeap"
              },
              {
                "address": "0x10068798",
                "name": "RtlFreeHeap"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x10068098",
                "name": "LoadLibraryW"
              },
              {
                "address": "0x1006809c",
                "name": "FindResourceW"
              },
              {
                "address": "0x100680a0",
                "name": "MulDiv"
              },
              {
                "address": "0x100680a4",
                "name": "GlobalLock"
              },
              {
                "address": "0x100680a8",
                "name": "GetVersionExW"
              },
              {
                "address": "0x100680ac",
                "name": "SetErrorMode"
              },
              {
                "address": "0x100680b0",
                "name": "WakeAllConditionVariable"
              },
              {
                "address": "0x100680b4",
                "name": "SleepConditionVariableSRW"
              },
              {
                "address": "0x100680b8",
                "name": "SearchPathW"
              },
              {
                "address": "0x100680bc",
                "name": "GetUserDefaultUILanguage"
              },
              {
                "address": "0x100680c0",
                "name": "UnmapViewOfFile"
              },
              {
                "address": "0x100680c4",
                "name": "CreateFileMappingW"
              },
              {
                "address": "0x100680c8",
                "name": "MapViewOfFile"
              },
              {
                "address": "0x100680cc",
                "name": "VerSetConditionMask"
              },
              {
                "address": "0x100680d0",
                "name": "SetCurrentDirectoryW"
              },
              {
                "address": "0x100680d4",
                "name": "GetCurrentDirectoryW"
              },
              {
                "address": "0x100680d8",
                "name": "GetFullPathNameW"
              },
              {
                "address": "0x100680dc",
                "name": "CreateFileW"
              },
              {
                "address": "0x100680e0",
                "name": "GlobalUnlock"
              },
              {
                "address": "0x100680e4",
                "name": "DeviceIoControl"
              },
              {
                "address": "0x100680e8",
                "name": "GetTickCount"
              },
              {
                "address": "0x100680ec",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x100680f0",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x100680f4",
                "name": "TerminateProcess"
              },
              {
                "address": "0x100680f8",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x100680fc",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x10068100",
                "name": "OutputDebugStringA"
              },
              {
                "address": "0x10068104",
                "name": "Sleep"
              },
              {
                "address": "0x10068108",
                "name": "IsDebuggerPresent"
              },
              {
                "address": "0x1006810c",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x10068110",
                "name": "VirtualQuery"
              },
              {
                "address": "0x10068114",
                "name": "GetSystemWindowsDirectoryW"
              },
              {
                "address": "0x10068118",
                "name": "DebugBreak"
              },
              {
                "address": "0x1006811c",
                "name": "GetSystemTime"
              },
              {
                "address": "0x10068120",
                "name": "SystemTimeToTzSpecificLocalTime"
              },
              {
                "address": "0x10068124",
                "name": "FreeLibrary"
              },
              {
                "address": "0x10068128",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x1006812c",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x10068130",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x10068134",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x10068138",
                "name": "AcquireSRWLockShared"
              },
              {
                "address": "0x1006813c",
                "name": "LocalFree"
              },
              {
                "address": "0x10068140",
                "name": "CreateMutexExW"
              },
              {
                "address": "0x10068144",
                "name": "GetProcAddress"
              },
              {
                "address": "0x10068148",
                "name": "HeapAlloc"
              },
              {
                "address": "0x1006814c",
                "name": "LoadResource"
              },
              {
                "address": "0x10068150",
                "name": "ResetEvent"
              },
              {
                "address": "0x10068154",
                "name": "FindResourceExW"
              },
              {
                "address": "0x10068158",
                "name": "CreateThread"
              },
              {
                "address": "0x1006815c",
                "name": "CreateThreadpoolTimer"
              },
              {
                "address": "0x10068160",
                "name": "ReleaseSRWLockShared"
              },
              {
                "address": "0x10068164",
                "name": "SetThreadpoolTimer"
              },
              {
                "address": "0x10068168",
                "name": "CloseHandle"
              },
              {
                "address": "0x1006816c",
                "name": "OpenSemaphoreW"
              },
              {
                "address": "0x10068170",
                "name": "LockResource"
              },
              {
                "address": "0x10068174",
                "name": "WaitForSingleObjectEx"
              },
              {
                "address": "0x10068178",
                "name": "AcquireSRWLockExclusive"
              },
              {
                "address": "0x1006817c",
                "name": "GetDiskFreeSpaceExW"
              },
              {
                "address": "0x10068180",
                "name": "CloseThreadpoolTimer"
              },
              {
                "address": "0x10068184",
                "name": "SetEvent"
              },
              {
                "address": "0x10068188",
                "name": "OutputDebugStringW"
              },
              {
                "address": "0x1006818c",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x10068190",
                "name": "GetLastError"
              },
              {
                "address": "0x10068194",
                "name": "GetTimeZoneInformation"
              },
              {
                "address": "0x10068198",
                "name": "FormatMessageW"
              },
              {
                "address": "0x1006819c",
                "name": "CreateEventW"
              },
              {
                "address": "0x100681a0",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x100681a4",
                "name": "VerifyVersionInfoW"
              },
              {
                "address": "0x100681a8",
                "name": "IsValidLocale"
              },
              {
                "address": "0x100681ac",
                "name": "IsValidCodePage"
              },
              {
                "address": "0x100681b0",
                "name": "IsWow64Process"
              },
              {
                "address": "0x100681b4",
                "name": "GetNativeSystemInfo"
              },
              {
                "address": "0x100681b8",
                "name": "GlobalFree"
              },
              {
                "address": "0x100681bc",
                "name": "GetSystemInfo"
              },
              {
                "address": "0x100681c0",
                "name": "GetPrivateProfileIntW"
              },
              {
                "address": "0x100681c4",
                "name": "GetLocaleInfoW"
              },
              {
                "address": "0x100681c8",
                "name": "SetThreadPreferredUILanguages"
              },
              {
                "address": "0x100681cc",
                "name": "GetPrivateProfileSectionW"
              },
              {
                "address": "0x100681d0",
                "name": "GetModuleFileNameA"
              },
              {
                "address": "0x100681d4",
                "name": "SizeofResource"
              },
              {
                "address": "0x100681d8",
                "name": "GetVolumeInformationW"
              },
              {
                "address": "0x100681dc",
                "name": "CompareStringW"
              },
              {
                "address": "0x100681e0",
                "name": "CreateSemaphoreExW"
              },
              {
                "address": "0x100681e4",
                "name": "HeapFree"
              },
              {
                "address": "0x100681e8",
                "name": "SetLastError"
              },
              {
                "address": "0x100681ec",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x100681f0",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x100681f4",
                "name": "ReleaseSemaphore"
              },
              {
                "address": "0x100681f8",
                "name": "GetModuleHandleExW"
              },
              {
                "address": "0x100681fc",
                "name": "ExpandEnvironmentStringsW"
              },
              {
                "address": "0x10068200",
                "name": "GetSystemDefaultUILanguage"
              },
              {
                "address": "0x10068204",
                "name": "GetModuleFileNameW"
              },
              {
                "address": "0x10068208",
                "name": "WaitForMultipleObjects"
              },
              {
                "address": "0x1006820c",
                "name": "GetLocaleInfoEx"
              },
              {
                "address": "0x10068210",
                "name": "InitializeCriticalSectionAndSpinCount"
              },
              {
                "address": "0x10068214",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x10068218",
                "name": "InitializeCriticalSectionEx"
              },
              {
                "address": "0x1006821c",
                "name": "WaitForThreadpoolTimerCallbacks"
              },
              {
                "address": "0x10068220",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x10068224",
                "name": "LocalAlloc"
              },
              {
                "address": "0x10068228",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x1006822c",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x10068230",
                "name": "ReleaseMutex"
              },
              {
                "address": "0x10068234",
                "name": "ResumeThread"
              },
              {
                "address": "0x10068238",
                "name": "DuplicateHandle"
              },
              {
                "address": "0x1006823c",
                "name": "GetLogicalDriveStringsW"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x10068000",
                "name": "GetTraceLoggerHandle"
              },
              {
                "address": "0x10068004",
                "name": "GetTraceEnableFlags"
              },
              {
                "address": "0x10068008",
                "name": "GetTraceEnableLevel"
              },
              {
                "address": "0x1006800c",
                "name": "RegisterTraceGuidsW"
              },
              {
                "address": "0x10068010",
                "name": "UnregisterTraceGuids"
              },
              {
                "address": "0x10068014",
                "name": "RegCloseKey"
              },
              {
                "address": "0x10068018",
                "name": "RegQueryValueExW"
              },
              {
                "address": "0x1006801c",
                "name": "RegEnumValueW"
              },
              {
                "address": "0x10068020",
                "name": "RegOpenKeyExW"
              }
            ]
          },
          "USER32": {
            "dll": "USER32.dll",
            "imports": [
              {
                "address": "0x10068610",
                "name": "AdjustWindowRectEx"
              },
              {
                "address": "0x10068614",
                "name": "FillRect"
              },
              {
                "address": "0x10068618",
                "name": "LoadBitmapW"
              },
              {
                "address": "0x1006861c",
                "name": "TrackMouseEvent"
              },
              {
                "address": "0x10068620",
                "name": "DrawFocusRect"
              },
              {
                "address": "0x10068624",
                "name": "RedrawWindow"
              },
              {
                "address": "0x10068628",
                "name": "GetWindowLongW"
              },
              {
                "address": "0x1006862c",
                "name": "GetNextDlgTabItem"
              },
              {
                "address": "0x10068630",
                "name": "IsChild"
              },
              {
                "address": "0x10068634",
                "name": "GetFocus"
              },
              {
                "address": "0x10068638",
                "name": "EnableMenuItem"
              },
              {
                "address": "0x1006863c",
                "name": "SetWindowLongW"
              },
              {
                "address": "0x10068640",
                "name": "IsWindowVisible"
              },
              {
                "address": "0x10068644",
                "name": "GetSysColorBrush"
              },
              {
                "address": "0x10068648",
                "name": "GetKeyState"
              },
              {
                "address": "0x1006864c",
                "name": "SystemParametersInfoW"
              },
              {
                "address": "0x10068650",
                "name": "DrawTextW"
              },
              {
                "address": "0x10068654",
                "name": "LoadStringW"
              },
              {
                "address": "0x10068658",
                "name": "PostMessageW"
              },
              {
                "address": "0x1006865c",
                "name": "GetWindowRect"
              },
              {
                "address": "0x10068660",
                "name": "GetDC"
              },
              {
                "address": "0x10068664",
                "name": "MessageBoxW"
              },
              {
                "address": "0x10068668",
                "name": "UnionRect"
              },
              {
                "address": "0x1006866c",
                "name": "ScreenToClient"
              },
              {
                "address": "0x10068670",
                "name": "SendMessageW"
              },
              {
                "address": "0x10068674",
                "name": "GetSystemMetrics"
              },
              {
                "address": "0x10068678",
                "name": "NotifyWinEvent"
              },
              {
                "address": "0x1006867c",
                "name": "SetTimer"
              },
              {
                "address": "0x10068680",
                "name": "CopyRect"
              },
              {
                "address": "0x10068684",
                "name": "ClientToScreen"
              },
              {
                "address": "0x10068688",
                "name": "MapWindowPoints"
              },
              {
                "address": "0x1006868c",
                "name": "GetSysColor"
              },
              {
                "address": "0x10068690",
                "name": "LoadCursorW"
              },
              {
                "address": "0x10068694",
                "name": "SetCursor"
              },
              {
                "address": "0x10068698",
                "name": "SetRectEmpty"
              },
              {
                "address": "0x1006869c",
                "name": "MapDialogRect"
              },
              {
                "address": "0x100686a0",
                "name": "GetClientRect"
              },
              {
                "address": "0x100686a4",
                "name": "GetDlgItem"
              },
              {
                "address": "0x100686a8",
                "name": "SetRect"
              },
              {
                "address": "0x100686ac",
                "name": "KillTimer"
              },
              {
                "address": "0x100686b0",
                "name": "GetParent"
              },
              {
                "address": "0x100686b4",
                "name": "UpdateWindow"
              },
              {
                "address": "0x100686b8",
                "name": "LoadImageW"
              },
              {
                "address": "0x100686bc",
                "name": "InvalidateRect"
              },
              {
                "address": "0x100686c0",
                "name": "EnableWindow"
              },
              {
                "address": "0x100686c4",
                "name": "GetSystemMenu"
              }
            ]
          },
          "ole32": {
            "dll": "ole32.dll",
            "imports": [
              {
                "address": "0x100687a0",
                "name": "CoCreateInstance"
              },
              {
                "address": "0x100687a4",
                "name": "StringFromGUID2"
              },
              {
                "address": "0x100687a8",
                "name": "CoInitializeEx"
              },
              {
                "address": "0x100687ac",
                "name": "CoTaskMemAlloc"
              },
              {
                "address": "0x100687b0",
                "name": "CoAllowSetForegroundWindow"
              },
              {
                "address": "0x100687b4",
                "name": "CoUninitialize"
              }
            ]
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x100685d0",
                "name": "VariantClear"
              },
              {
                "address": "0x100685d4",
                "name": "VariantChangeType"
              },
              {
                "address": "0x100685d8",
                "name": "SysAllocString"
              },
              {
                "address": "0x100685dc",
                "name": "SysFreeString"
              },
              {
                "address": "0x100685e0",
                "name": "VariantInit"
              }
            ]
          },
          "RPCRT4": {
            "dll": "RPCRT4.dll",
            "imports": [
              {
                "address": "0x100685e8",
                "name": "UuidToStringW"
              },
              {
                "address": "0x100685ec",
                "name": "I_RpcMapWin32Status"
              },
              {
                "address": "0x100685f0",
                "name": "RpcStringFreeW"
              }
            ]
          },
          "COMCTL32": {
            "dll": "COMCTL32.dll",
            "imports": [
              {
                "address": "0x10068028",
                "name": "InitCommonControlsEx"
              }
            ]
          },
          "GDI32": {
            "dll": "GDI32.dll",
            "imports": [
              {
                "address": "0x10068038",
                "name": "SetBkMode"
              },
              {
                "address": "0x1006803c",
                "name": "SetTextColor"
              },
              {
                "address": "0x10068040",
                "name": "CreateICW"
              },
              {
                "address": "0x10068044",
                "name": "CreateSolidBrush"
              },
              {
                "address": "0x10068048",
                "name": "StretchBlt"
              },
              {
                "address": "0x1006804c",
                "name": "CreateCompatibleDC"
              },
              {
                "address": "0x10068050",
                "name": "GetObjectW"
              },
              {
                "address": "0x10068054",
                "name": "SetBrushOrgEx"
              },
              {
                "address": "0x10068058",
                "name": "RemoveFontMemResourceEx"
              },
              {
                "address": "0x1006805c",
                "name": "CreateFontW"
              },
              {
                "address": "0x10068060",
                "name": "CreateDIBSection"
              },
              {
                "address": "0x10068064",
                "name": "TranslateCharsetInfo"
              },
              {
                "address": "0x10068068",
                "name": "CreateDCW"
              },
              {
                "address": "0x1006806c",
                "name": "EnumFontFamiliesExW"
              },
              {
                "address": "0x10068070",
                "name": "CreateFontIndirectW"
              },
              {
                "address": "0x10068074",
                "name": "BitBlt"
              },
              {
                "address": "0x10068078",
                "name": "DeleteObject"
              },
              {
                "address": "0x1006807c",
                "name": "DeleteDC"
              },
              {
                "address": "0x10068080",
                "name": "GetDeviceCaps"
              },
              {
                "address": "0x10068084",
                "name": "GetStockObject"
              },
              {
                "address": "0x10068088",
                "name": "AddFontMemResourceEx"
              }
            ]
          },
          "COMDLG32": {
            "dll": "COMDLG32.dll",
            "imports": [
              {
                "address": "0x10068030",
                "name": "GetSaveFileNameW"
              }
            ]
          },
          "WMsgAPI": {
            "dll": "WMsgAPI.dll",
            "imports": [
              {
                "address": "0x100686e4",
                "name": "WmsgPostNotifyMessage"
              }
            ]
          },
          "WDSCORE": {
            "dll": "WDSCORE.dll",
            "imports": [
              {
                "address": "0x100686d4",
                "name": "WdsSetupLogMessageW"
              },
              {
                "address": "0x100686d8",
                "name": "ConstructPartialMsgVW"
              },
              {
                "address": "0x100686dc",
                "name": "CurrentIP"
              }
            ]
          },
          "SETUPAPI": {
            "dll": "SETUPAPI.dll",
            "imports": [
              {
                "address": "0x100685f8",
                "name": "SetupDiGetDeviceInterfaceDetailW"
              },
              {
                "address": "0x100685fc",
                "name": "SetupDiGetClassDevsW"
              },
              {
                "address": "0x10068600",
                "name": "SetupDiEnumDeviceInterfaces"
              },
              {
                "address": "0x10068604",
                "name": "SetupDiGetDeviceInterfacePropertyW"
              },
              {
                "address": "0x10068608",
                "name": "SetupDiGetDeviceRegistryPropertyW"
              }
            ]
          },
          "IMM32": {
            "dll": "IMM32.dll",
            "imports": [
              {
                "address": "0x10068090",
                "name": "ImmAssociateContext"
              }
            ]
          },
          "UxTheme": {
            "dll": "UxTheme.dll",
            "imports": [
              {
                "address": "0x100686cc",
                "name": "IsAppThemed"
              }
            ]
          }
        },
        "exported_dll_name": "MediaSetupUIMgr.DLL",
        "exports": [
          {
            "address": "0x1003f4a0",
            "name": "CreateSetupObject",
            "ordinal": 1
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x00062650",
            "size": "0x00000058"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x000687c0",
            "size": "0x00000168"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x0006b000",
            "size": "0x00e7894c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x00ee7000",
            "size": "0x00002138"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x00ee4000",
            "size": "0x00007fb8"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x0001e200",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x0000871c",
            "size": "0x00000018"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x00008670",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x00068000",
            "size": "0x000007bc"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x000616a8",
            "size_of_data": "0x00061800",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.18"
          },
          {
            "name": ".data",
            "raw_address": "0x00061c00",
            "virtual_address": "0x00063000",
            "virtual_size": "0x00004b74",
            "size_of_data": "0x00002600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "4.86"
          },
          {
            "name": ".idata",
            "raw_address": "0x00064200",
            "virtual_address": "0x00068000",
            "virtual_size": "0x00002394",
            "size_of_data": "0x00002400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.80"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x00066600",
            "virtual_address": "0x0006b000",
            "virtual_size": "0x00e79000",
            "size_of_data": "0x00e78a00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "2.56"
          },
          {
            "name": ".reloc",
            "raw_address": "0x00edf000",
            "virtual_address": "0x00ee4000",
            "virtual_size": "0x00007fb8",
            "size_of_data": "0x00008000",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.59"
          }
        ],
        "overlay": {
          "offset": "0x00ee7000",
          "size": "0x00002138"
        },
        "resources": [
          {
            "name": "IMAGE",
            "offset": "0x0007a490",
            "size": "0x000002eb",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.78"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007a77c",
            "size": "0x00000111",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.76"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007a890",
            "size": "0x00000135",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.94"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007a9c8",
            "size": "0x00000148",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.90"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007ab10",
            "size": "0x00000163",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.01"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007ac74",
            "size": "0x000001bc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.94"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007ae30",
            "size": "0x0000023f",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.79"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007b070",
            "size": "0x000002f9",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.73"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007b36c",
            "size": "0x00000100",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.77"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007b46c",
            "size": "0x0000011b",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.06"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007b588",
            "size": "0x00000127",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.88"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007b6b0",
            "size": "0x0000013f",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.98"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007b7f0",
            "size": "0x00000185",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.86"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007b978",
            "size": "0x00000246",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.90"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007bbc0",
            "size": "0x000007bb",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.51"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007c37c",
            "size": "0x000000e5",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.62"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007c464",
            "size": "0x000000f6",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.56"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007c55c",
            "size": "0x0000010e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.69"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007c66c",
            "size": "0x0000012d",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.72"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007c79c",
            "size": "0x00000172",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.80"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007c910",
            "size": "0x000001f3",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.25"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007cb04",
            "size": "0x000002b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.21"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007cdb8",
            "size": "0x000000d1",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.37"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007ce8c",
            "size": "0x000000e1",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.75"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007cf70",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.65"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007d064",
            "size": "0x00000120",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.69"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007d184",
            "size": "0x00000154",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.50"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007d2d8",
            "size": "0x000001e3",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.24"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007d4bc",
            "size": "0x0000084a",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.72"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007dd08",
            "size": "0x0000021e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.44"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007df28",
            "size": "0x000002c2",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.58"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007e1ec",
            "size": "0x00000305",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.59"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007e4f4",
            "size": "0x0000037e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.61"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007e874",
            "size": "0x00000413",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.67"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007ec88",
            "size": "0x00000605",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.75"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007f290",
            "size": "0x000008eb",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.71"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007fb7c",
            "size": "0x0000022e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.41"
          },
          {
            "name": "IMAGE",
            "offset": "0x0007fdac",
            "size": "0x000002e7",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.53"
          },
          {
            "name": "IMAGE",
            "offset": "0x00080094",
            "size": "0x00000323",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.59"
          },
          {
            "name": "IMAGE",
            "offset": "0x000803b8",
            "size": "0x000003bb",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.59"
          },
          {
            "name": "IMAGE",
            "offset": "0x00080774",
            "size": "0x0000046c",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.59"
          },
          {
            "name": "IMAGE",
            "offset": "0x00080be0",
            "size": "0x00000622",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.74"
          },
          {
            "name": "IMAGE",
            "offset": "0x00081204",
            "size": "0x0000037e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.08"
          },
          {
            "name": "IMAGE",
            "offset": "0x00081584",
            "size": "0x0000016d",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.16"
          },
          {
            "name": "IMAGE",
            "offset": "0x000816f4",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.18"
          },
          {
            "name": "IMAGE",
            "offset": "0x00081868",
            "size": "0x000001a1",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.29"
          },
          {
            "name": "IMAGE",
            "offset": "0x00081a0c",
            "size": "0x000001ee",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.30"
          },
          {
            "name": "IMAGE",
            "offset": "0x00081bfc",
            "size": "0x00000257",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.38"
          },
          {
            "name": "IMAGE",
            "offset": "0x00081e54",
            "size": "0x000002ce",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.26"
          },
          {
            "name": "IMAGE",
            "offset": "0x00082124",
            "size": "0x00000382",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.26"
          },
          {
            "name": "IMAGE",
            "offset": "0x000824a8",
            "size": "0x00000160",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.05"
          },
          {
            "name": "IMAGE",
            "offset": "0x00082608",
            "size": "0x00000166",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.21"
          },
          {
            "name": "IMAGE",
            "offset": "0x00082770",
            "size": "0x0000018f",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.17"
          },
          {
            "name": "IMAGE",
            "offset": "0x00082900",
            "size": "0x000001e2",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.41"
          },
          {
            "name": "IMAGE",
            "offset": "0x00082ae4",
            "size": "0x0000022a",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.39"
          },
          {
            "name": "IMAGE",
            "offset": "0x00082d10",
            "size": "0x000002cc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.25"
          },
          {
            "name": "IMAGE",
            "offset": "0x00082fdc",
            "size": "0x000007e5",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.33"
          },
          {
            "name": "IMAGE",
            "offset": "0x000837c4",
            "size": "0x0000078b",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.29"
          },
          {
            "name": "IMAGE",
            "offset": "0x00083f50",
            "size": "0x000007bd",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.29"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x00084710",
            "size": "0x00300c28",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "1.59"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x00385338",
            "size": "0x000211d8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.84"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x003a6510",
            "size": "0x000211d8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.37"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x003c76e8",
            "size": "0x000211d8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.64"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x003e88c0",
            "size": "0x000211d8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.31"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x00409a98",
            "size": "0x000211d8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.60"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x0042ac70",
            "size": "0x000211d8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.29"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x0044be48",
            "size": "0x00097428",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.69"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x004e3270",
            "size": "0x00097428",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.20"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x0057a698",
            "size": "0x000da8b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.63"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x00654f4c",
            "size": "0x000da8b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.17"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x0072f800",
            "size": "0x00097428",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.77"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x007c6c28",
            "size": "0x00097428",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.17"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x0085e050",
            "size": "0x000da8b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.65"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x00938904",
            "size": "0x000da8b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.15"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x00a131b8",
            "size": "0x00097428",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.51"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x00aaa5e0",
            "size": "0x00097428",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.15"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x00b41a08",
            "size": "0x000da8b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.44"
          },
          {
            "name": "RT_BITMAP",
            "offset": "0x00c1c2bc",
            "size": "0x000da8b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.13"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00cf6b70",
            "size": "0x00000668",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.80"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00cf71d8",
            "size": "0x000002e8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.88"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00cf74c0",
            "size": "0x000001e8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.61"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00cf76a8",
            "size": "0x00000128",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.60"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00cf77d0",
            "size": "0x00000ea8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.35"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00cf8678",
            "size": "0x000008a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.11"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00cf8f20",
            "size": "0x000006c8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.49"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00cf95e8",
            "size": "0x00000568",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.49"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00cf9b50",
            "size": "0x0000424f",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.91"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00cfdda0",
            "size": "0x000025a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.43"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d00348",
            "size": "0x000010a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.60"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d013f0",
            "size": "0x000009e8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.62"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d01dd8",
            "size": "0x00000468",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.98"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d02240",
            "size": "0x00000a68",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.43"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d02ca8",
            "size": "0x00000668",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.03"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d03310",
            "size": "0x000002e8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.38"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d035f8",
            "size": "0x00000128",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.60"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d03720",
            "size": "0x00001628",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.86"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d04d48",
            "size": "0x00000ea8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "5.89"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d05bf0",
            "size": "0x000008a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "6.44"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d06498",
            "size": "0x00000568",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.37"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d06a00",
            "size": "0x0000f970",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.98"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d16370",
            "size": "0x00004228",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "4.62"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d1a598",
            "size": "0x000025a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "5.77"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d1cb40",
            "size": "0x000010a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "5.98"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d1dbe8",
            "size": "0x00000468",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "5.59"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00d1e050",
            "size": "0x00000c28",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "1.26"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1ec78",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.47"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1ed54",
            "size": "0x000000f8",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.58"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1ee4c",
            "size": "0x000000d6",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.55"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1ef24",
            "size": "0x000000ec",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1f010",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.95"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1f104",
            "size": "0x000000da",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "2.92"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1f1e0",
            "size": "0x00000104",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.63"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1f2e4",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1f3d8",
            "size": "0x000000f8",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1f4d0",
            "size": "0x00000110",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1f5e0",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.49"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1f6bc",
            "size": "0x000000e2",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.95"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1f7a0",
            "size": "0x00000114",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1f8b4",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.71"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1f990",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.56"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1fa5c",
            "size": "0x000000fa",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "2.94"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1fb58",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1fc4c",
            "size": "0x0000010a",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1fd58",
            "size": "0x00000108",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1fe60",
            "size": "0x000000f6",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d1ff58",
            "size": "0x000000f0",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.56"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d20048",
            "size": "0x000000ea",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.92"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d20134",
            "size": "0x000000fe",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d20234",
            "size": "0x000000ea",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.95"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d20320",
            "size": "0x00000118",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.63"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d20438",
            "size": "0x00000102",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.10"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2053c",
            "size": "0x000000fe",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.63"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2063c",
            "size": "0x000000fa",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.94"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d20738",
            "size": "0x00000108",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.92"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d20840",
            "size": "0x00000104",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d20944",
            "size": "0x000000e2",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d20a28",
            "size": "0x000000d2",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.70"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d20afc",
            "size": "0x00000120",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d20c1c",
            "size": "0x00000110",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d20d2c",
            "size": "0x00000130",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d20e5c",
            "size": "0x0000011a",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d20f78",
            "size": "0x000000f2",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.95"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2106c",
            "size": "0x000000fc",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.60"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d21168",
            "size": "0x000000f8",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.63"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d21260",
            "size": "0x000000d0",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.52"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d21330",
            "size": "0x00000138",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.23"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d21468",
            "size": "0x000000fc",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d21564",
            "size": "0x0000010c",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d21670",
            "size": "0x00000110",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.70"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d21780",
            "size": "0x0000010a",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2188c",
            "size": "0x000000de",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.94"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2196c",
            "size": "0x00000106",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d21a74",
            "size": "0x000000d6",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.47"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d21b4c",
            "size": "0x00000104",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d21c50",
            "size": "0x000000f0",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d21d40",
            "size": "0x000000c8",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.57"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d21e08",
            "size": "0x000000d0",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d21ed8",
            "size": "0x00000120",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.02"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d21ff8",
            "size": "0x0000010a",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d22104",
            "size": "0x00000110",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d22214",
            "size": "0x000000f8",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2230c",
            "size": "0x000000f8",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d22404",
            "size": "0x000000ec",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.55"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d224f0",
            "size": "0x000000e6",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d225d8",
            "size": "0x000000fa",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d226d4",
            "size": "0x000000ec",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d227c0",
            "size": "0x000000fe",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.65"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d228c0",
            "size": "0x000000e0",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d229a0",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d22a94",
            "size": "0x000000ec",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d22b80",
            "size": "0x000000f2",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d22c74",
            "size": "0x00000110",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d22d84",
            "size": "0x00000104",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.10"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d22e88",
            "size": "0x000000c4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.41"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d22f4c",
            "size": "0x0000010c",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d23058",
            "size": "0x00000104",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2315c",
            "size": "0x00000106",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d23264",
            "size": "0x00000106",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.02"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2336c",
            "size": "0x00000132",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d234a0",
            "size": "0x000000f0",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d23590",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "2.45"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d23644",
            "size": "0x000000d4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "2.73"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d23718",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "2.41"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d237cc",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.43"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d23880",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.47"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d23934",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.55"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d239f0",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "2.64"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d23aa4",
            "size": "0x000000c4",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.53"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d23b68",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "2.70"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d23c34",
            "size": "0x00000168",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.70"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d23d9c",
            "size": "0x00000178",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.66"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d23f14",
            "size": "0x00000148",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.75"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2405c",
            "size": "0x0000016a",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.36"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d241c8",
            "size": "0x00000176",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.27"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d24340",
            "size": "0x0000016e",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.27"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d244b0",
            "size": "0x000001a4",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.92"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d24654",
            "size": "0x00000178",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.31"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d247cc",
            "size": "0x00000172",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.26"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d24940",
            "size": "0x000001a0",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.33"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d24ae0",
            "size": "0x0000014e",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.67"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d24c30",
            "size": "0x00000164",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.31"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d24d94",
            "size": "0x00000178",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.28"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d24f0c",
            "size": "0x00000136",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.62"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d25044",
            "size": "0x0000013c",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d25180",
            "size": "0x00000166",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d252e8",
            "size": "0x0000015a",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.23"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d25444",
            "size": "0x00000194",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.44"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d255d8",
            "size": "0x00000160",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d25738",
            "size": "0x0000018c",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.40"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d258c4",
            "size": "0x0000019a",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.77"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d25a60",
            "size": "0x0000018e",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d25bf0",
            "size": "0x0000017e",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.38"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d25d70",
            "size": "0x00000152",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.24"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d25ec4",
            "size": "0x00000196",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.85"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2605c",
            "size": "0x0000017c",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.38"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d261d8",
            "size": "0x00000162",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.62"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2633c",
            "size": "0x00000188",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d264c4",
            "size": "0x00000180",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.28"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d26644",
            "size": "0x0000017e",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.38"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d267c4",
            "size": "0x0000017c",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.33"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d26940",
            "size": "0x0000014c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d26a8c",
            "size": "0x00000178",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.30"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d26c04",
            "size": "0x0000017e",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.32"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d26d84",
            "size": "0x00000188",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.23"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d26f0c",
            "size": "0x0000017e",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2708c",
            "size": "0x000001a0",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.33"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2722c",
            "size": "0x0000018e",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.31"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d273bc",
            "size": "0x000000b0",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2746c",
            "size": "0x000000c4",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.35"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d27530",
            "size": "0x000000c4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.30"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d275f4",
            "size": "0x000000c8",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d276bc",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d27778",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "2.82"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d27834",
            "size": "0x000000c8",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.37"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d278fc",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.81"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d279b0",
            "size": "0x000000c8",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.77"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d27a78",
            "size": "0x000000c4",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d27b3c",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.21"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d27bf4",
            "size": "0x000000c4",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d27cb8",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d27d6c",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.11"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d27e24",
            "size": "0x000000a4",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "2.95"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d27ec8",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d27f80",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.71"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d28038",
            "size": "0x000000c0",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d280f8",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d281b0",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d28268",
            "size": "0x000000c8",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.38"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d28330",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.76"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d283ec",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.81"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d284a4",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.77"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d28560",
            "size": "0x000000d0",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d28630",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2870c",
            "size": "0x000000ac",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d287b8",
            "size": "0x000000d4",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.92"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2888c",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d28948",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.75"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d289fc",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.89"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d28ac8",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.30"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d28b84",
            "size": "0x000000c0",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d28c44",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "2.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d28d00",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "2.77"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d28db8",
            "size": "0x000000c4",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d28e7c",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.75"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d28f30",
            "size": "0x000001a0",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.39"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d290d0",
            "size": "0x000001b0",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.47"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d29280",
            "size": "0x0000017c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.29"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d293fc",
            "size": "0x000001b0",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d295ac",
            "size": "0x0000018c",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.94"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d29738",
            "size": "0x0000019c",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "2.93"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d298d4",
            "size": "0x000001c4",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.63"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d29a98",
            "size": "0x00000198",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.90"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d29c30",
            "size": "0x0000018c",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.89"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d29dbc",
            "size": "0x000001a0",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d29f5c",
            "size": "0x00000190",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.35"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2a0ec",
            "size": "0x000001a0",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2a28c",
            "size": "0x000001bc",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2a448",
            "size": "0x000001a4",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.50"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2a5ec",
            "size": "0x00000160",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.18"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2a74c",
            "size": "0x00000198",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "2.89"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2a8e4",
            "size": "0x000001a4",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.92"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2aa88",
            "size": "0x000001a8",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2ac30",
            "size": "0x000001e0",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2ae10",
            "size": "0x000001b0",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.02"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2afc0",
            "size": "0x000001a0",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.41"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2b160",
            "size": "0x000001b0",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.02"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2b310",
            "size": "0x000001b0",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2b4c0",
            "size": "0x0000019c",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.92"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2b65c",
            "size": "0x000001b0",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2b80c",
            "size": "0x00000194",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.90"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2b9a0",
            "size": "0x000001a4",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.42"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2bb44",
            "size": "0x000001a8",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2bcec",
            "size": "0x00000194",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.88"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2be80",
            "size": "0x000001a8",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.97"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2c028",
            "size": "0x000001a4",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2c1cc",
            "size": "0x00000170",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.26"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2c33c",
            "size": "0x000001b8",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2c4f4",
            "size": "0x000001c8",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2c6bc",
            "size": "0x000001bc",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "2.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2c878",
            "size": "0x000001a0",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.97"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2ca18",
            "size": "0x000001ac",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2cbc4",
            "size": "0x000001ea",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2cdb0",
            "size": "0x00000212",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2cfc4",
            "size": "0x00000166",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.77"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2d12c",
            "size": "0x0000022e",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.36"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2d35c",
            "size": "0x0000022a",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.25"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2d588",
            "size": "0x0000023a",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.18"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2d7c4",
            "size": "0x0000024c",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2da10",
            "size": "0x000001fe",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2dc10",
            "size": "0x000001fa",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2de0c",
            "size": "0x0000022e",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.21"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2e03c",
            "size": "0x000001bc",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.77"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2e1f8",
            "size": "0x00000232",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.32"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2e42c",
            "size": "0x00000232",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2e660",
            "size": "0x00000178",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.02"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2e7d8",
            "size": "0x00000182",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "4.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2e95c",
            "size": "0x000001f6",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2eb54",
            "size": "0x000001fa",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2ed50",
            "size": "0x00000244",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.31"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2ef94",
            "size": "0x00000210",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2f1a4",
            "size": "0x0000026c",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2f410",
            "size": "0x00000222",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2f634",
            "size": "0x00000210",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.22"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2f844",
            "size": "0x00000240",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.36"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2fa84",
            "size": "0x000001fa",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.22"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2fc80",
            "size": "0x00000250",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.02"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d2fed0",
            "size": "0x00000210",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.26"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d300e0",
            "size": "0x00000220",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.89"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d30300",
            "size": "0x0000020e",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.22"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d30510",
            "size": "0x000001f6",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d30708",
            "size": "0x0000023a",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.32"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d30944",
            "size": "0x00000230",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.28"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d30b74",
            "size": "0x00000160",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.89"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d30cd4",
            "size": "0x00000206",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.21"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d30edc",
            "size": "0x0000022a",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.22"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d31108",
            "size": "0x00000214",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3131c",
            "size": "0x0000020a",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d31528",
            "size": "0x0000021a",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d31744",
            "size": "0x00000208",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.23"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3194c",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "2.52"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d31ac0",
            "size": "0x00000194",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "2.68"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d31c54",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.51"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d31dc8",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.53"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d31f3c",
            "size": "0x0000017c",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.58"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d320b8",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "2.61"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3222c",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "2.51"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d323a0",
            "size": "0x00000184",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.57"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d32524",
            "size": "0x0000018c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "2.67"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d326b0",
            "size": "0x00000112",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.48"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d327c4",
            "size": "0x00000126",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.49"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d328ec",
            "size": "0x000000ea",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.27"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d329d8",
            "size": "0x00000140",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d32b18",
            "size": "0x0000012e",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.94"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d32c48",
            "size": "0x0000013a",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d32d84",
            "size": "0x00000118",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.54"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d32e9c",
            "size": "0x00000112",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.92"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d32fb0",
            "size": "0x0000010a",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d330bc",
            "size": "0x0000013c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d331f8",
            "size": "0x000000ee",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.28"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d332e8",
            "size": "0x00000100",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.87"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d333e8",
            "size": "0x00000136",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.02"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d33520",
            "size": "0x000000f2",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.61"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d33614",
            "size": "0x000000e2",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.48"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d336f8",
            "size": "0x0000011a",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "2.93"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d33814",
            "size": "0x0000011e",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.90"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d33934",
            "size": "0x0000011c",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d33a50",
            "size": "0x0000011a",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d33b6c",
            "size": "0x00000116",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d33c84",
            "size": "0x0000010e",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.41"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d33d94",
            "size": "0x00000120",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d33eb4",
            "size": "0x0000011c",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d33fd0",
            "size": "0x00000116",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.92"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d340e8",
            "size": "0x00000140",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.64"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d34228",
            "size": "0x0000011e",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d34348",
            "size": "0x0000011a",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.51"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d34464",
            "size": "0x0000011a",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.92"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d34580",
            "size": "0x0000011c",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.90"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3469c",
            "size": "0x00000128",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d347c4",
            "size": "0x0000010e",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.90"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d348d4",
            "size": "0x000000ee",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.49"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d349c4",
            "size": "0x00000110",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.92"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d34ad4",
            "size": "0x00000142",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d34c18",
            "size": "0x00000114",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "2.90"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d34d2c",
            "size": "0x0000013c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d34e68",
            "size": "0x0000010a",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.92"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d34f74",
            "size": "0x0000013a",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.50"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d350b0",
            "size": "0x00000146",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.51"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d351f8",
            "size": "0x0000012e",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.44"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d35328",
            "size": "0x0000013a",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.17"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d35464",
            "size": "0x0000011e",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.11"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d35584",
            "size": "0x0000013a",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.22"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d356c0",
            "size": "0x0000013a",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.59"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d357fc",
            "size": "0x00000132",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d35930",
            "size": "0x0000014a",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.17"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d35a7c",
            "size": "0x0000014e",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.23"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d35bcc",
            "size": "0x00000126",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.46"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d35cf4",
            "size": "0x00000112",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d35e08",
            "size": "0x0000013a",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d35f44",
            "size": "0x0000011a",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.33"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d36060",
            "size": "0x00000112",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.43"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d36174",
            "size": "0x0000013e",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d362b4",
            "size": "0x00000132",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.11"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d363e8",
            "size": "0x0000013e",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.23"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d36528",
            "size": "0x00000136",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d36660",
            "size": "0x00000146",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.25"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d367a8",
            "size": "0x00000122",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.29"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d368cc",
            "size": "0x0000013e",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.18"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d36a0c",
            "size": "0x00000142",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.25"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d36b50",
            "size": "0x0000012e",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d36c80",
            "size": "0x00000136",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.45"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d36db8",
            "size": "0x0000012e",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d36ee8",
            "size": "0x0000012e",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.39"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d37018",
            "size": "0x0000012e",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d37148",
            "size": "0x00000142",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.18"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3728c",
            "size": "0x0000012a",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d373b8",
            "size": "0x0000013a",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.25"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d374f4",
            "size": "0x00000126",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.45"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3761c",
            "size": "0x00000136",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.17"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d37754",
            "size": "0x0000013e",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.21"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d37894",
            "size": "0x00000136",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d379cc",
            "size": "0x0000014e",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.21"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d37b1c",
            "size": "0x0000012e",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.17"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d37c4c",
            "size": "0x00000100",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.65"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d37d4c",
            "size": "0x0000015c",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d37ea8",
            "size": "0x000000ec",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d37f94",
            "size": "0x00000130",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.29"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d380c4",
            "size": "0x00000134",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d381f8",
            "size": "0x0000015c",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d38354",
            "size": "0x00000138",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3848c",
            "size": "0x00000118",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d385a4",
            "size": "0x0000013c",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d386e0",
            "size": "0x00000180",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d38860",
            "size": "0x0000012c",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.70"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3898c",
            "size": "0x00000138",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d38ac4",
            "size": "0x000001a4",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d38c68",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.88"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d38d5c",
            "size": "0x000000f8",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "4.10"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d38e54",
            "size": "0x0000014c",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d38fa0",
            "size": "0x00000128",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d390c8",
            "size": "0x00000138",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d39200",
            "size": "0x0000013c",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3933c",
            "size": "0x0000013c",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d39478",
            "size": "0x00000150",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.75"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d395c8",
            "size": "0x0000015c",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d39724",
            "size": "0x0000012c",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d39850",
            "size": "0x00000134",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d39984",
            "size": "0x00000148",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.75"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d39acc",
            "size": "0x00000120",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.11"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d39bec",
            "size": "0x00000150",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d39d3c",
            "size": "0x00000138",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.11"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d39e74",
            "size": "0x00000124",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d39f98",
            "size": "0x0000013c",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3a0d4",
            "size": "0x00000118",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3a1ec",
            "size": "0x000000ec",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "4.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3a2d8",
            "size": "0x00000158",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3a430",
            "size": "0x00000154",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3a584",
            "size": "0x0000014c",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3a6d0",
            "size": "0x00000180",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3a850",
            "size": "0x00000134",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.11"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3a984",
            "size": "0x00000094",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "2.49"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3aa18",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "2.81"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3aacc",
            "size": "0x00000094",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.46"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3ab60",
            "size": "0x00000094",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.44"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3abf4",
            "size": "0x00000094",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.44"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3ac88",
            "size": "0x00000094",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.50"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3ad1c",
            "size": "0x0000009c",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.58"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3adb8",
            "size": "0x00000094",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "2.70"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3ae4c",
            "size": "0x00000094",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.44"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3aee0",
            "size": "0x00000094",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.44"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3af74",
            "size": "0x000000a4",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.56"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3b018",
            "size": "0x000000ac",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3b0c4",
            "size": "0x00000094",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.44"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3b158",
            "size": "0x00000164",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.27"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3b2bc",
            "size": "0x00000186",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.39"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3b444",
            "size": "0x0000014c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3b590",
            "size": "0x00000172",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3b704",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.87"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3b878",
            "size": "0x00000190",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "2.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3ba08",
            "size": "0x00000192",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.49"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3bb9c",
            "size": "0x0000015a",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3bcf8",
            "size": "0x00000180",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.88"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3be78",
            "size": "0x00000186",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3c000",
            "size": "0x0000015c",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.23"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3c15c",
            "size": "0x0000016e",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.88"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3c2cc",
            "size": "0x00000180",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.85"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3c44c",
            "size": "0x00000142",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3c590",
            "size": "0x00000136",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3c6c8",
            "size": "0x0000017c",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "2.89"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3c844",
            "size": "0x00000176",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3c9bc",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.89"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3cb30",
            "size": "0x00000178",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.85"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3cca8",
            "size": "0x00000180",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "2.94"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3ce28",
            "size": "0x00000190",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.49"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3cfb8",
            "size": "0x00000186",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.93"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3d140",
            "size": "0x00000176",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3d2b8",
            "size": "0x0000016c",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.82"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3d424",
            "size": "0x00000178",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.33"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3d59c",
            "size": "0x00000162",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3d700",
            "size": "0x0000017e",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.42"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3d880",
            "size": "0x00000182",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.93"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3da04",
            "size": "0x00000172",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3db78",
            "size": "0x00000160",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3dcd8",
            "size": "0x0000016a",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3de44",
            "size": "0x00000150",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.26"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3df94",
            "size": "0x0000017c",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3e110",
            "size": "0x0000016e",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "2.82"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3e280",
            "size": "0x00000194",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "2.89"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3e414",
            "size": "0x00000186",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3e59c",
            "size": "0x00000198",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3e734",
            "size": "0x00000296",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.89"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3e9cc",
            "size": "0x0000034a",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3ed18",
            "size": "0x000001ee",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "4.22"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3ef08",
            "size": "0x0000030a",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.40"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3f214",
            "size": "0x0000033c",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.26"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3f550",
            "size": "0x000002ee",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.29"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3f840",
            "size": "0x00000348",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3fb88",
            "size": "0x000002ba",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.23"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d3fe44",
            "size": "0x000002b8",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d400fc",
            "size": "0x00000374",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.29"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d40470",
            "size": "0x0000027c",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.87"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d406ec",
            "size": "0x00000316",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d40a04",
            "size": "0x0000033a",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.22"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d40d40",
            "size": "0x00000238",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.31"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d40f78",
            "size": "0x00000212",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "4.30"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4118c",
            "size": "0x000002ee",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.24"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4147c",
            "size": "0x0000031a",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.27"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d41798",
            "size": "0x00000324",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d41abc",
            "size": "0x000002fa",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.24"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d41db8",
            "size": "0x0000032a",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.40"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d420e4",
            "size": "0x000002d8",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.97"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d423bc",
            "size": "0x00000350",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.30"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4270c",
            "size": "0x0000030a",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.42"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d42a18",
            "size": "0x0000031e",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.28"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d42d38",
            "size": "0x000002e8",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d43020",
            "size": "0x00000310",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.35"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d43330",
            "size": "0x00000312",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d43644",
            "size": "0x000002fa",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.27"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d43940",
            "size": "0x0000030a",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.21"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d43c4c",
            "size": "0x000002f0",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.40"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d43f3c",
            "size": "0x000002fa",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d44238",
            "size": "0x000001dc",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "4.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d44414",
            "size": "0x000002be",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.23"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d446d4",
            "size": "0x00000356",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.23"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d44a2c",
            "size": "0x00000336",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.26"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d44d64",
            "size": "0x0000034e",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.23"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d450b4",
            "size": "0x00000368",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.29"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4541c",
            "size": "0x00000354",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.29"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d45770",
            "size": "0x000000be",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d45830",
            "size": "0x000000de",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d45910",
            "size": "0x000000be",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d459d0",
            "size": "0x000000be",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d45a90",
            "size": "0x000000be",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.02"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d45b50",
            "size": "0x000000c6",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d45c18",
            "size": "0x000000be",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d45cd8",
            "size": "0x000000be",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d45d98",
            "size": "0x000000be",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d45e58",
            "size": "0x000000ce",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d45f28",
            "size": "0x000000d6",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46000",
            "size": "0x000000be",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d460c0",
            "size": "0x000000a0",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.29"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46160",
            "size": "0x000000a4",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.32"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46204",
            "size": "0x000000a4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.25"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d462a8",
            "size": "0x000000a0",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.85"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46348",
            "size": "0x000000a4",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d463ec",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "2.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d464a8",
            "size": "0x000000ac",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.38"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46554",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46608",
            "size": "0x000000a8",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.70"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d466b0",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.88"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46768",
            "size": "0x000000a0",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.32"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46808",
            "size": "0x00000090",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.69"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46898",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4694c",
            "size": "0x0000008c",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d469d8",
            "size": "0x0000009c",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.49"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46a74",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "2.81"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46b28",
            "size": "0x000000a4",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46bcc",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.97"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46c80",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46d38",
            "size": "0x000000a4",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46ddc",
            "size": "0x000000a8",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.38"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46e84",
            "size": "0x000000a0",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.76"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46f24",
            "size": "0x000000a4",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d46fc8",
            "size": "0x00000098",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.70"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47060",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.51"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4712c",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d471e4",
            "size": "0x000000ac",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.38"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47290",
            "size": "0x000000a8",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47338",
            "size": "0x000000ac",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.76"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d473e4",
            "size": "0x000000a4",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47488",
            "size": "0x000000a0",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47528",
            "size": "0x000000a0",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.43"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d475c8",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4767c",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "2.87"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47738",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "2.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d477ec",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.88"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d478a4",
            "size": "0x000000a8",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.81"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4794c",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "2.44"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d479c0",
            "size": "0x00000094",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "2.77"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47a54",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.42"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47ac8",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.39"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47b3c",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.47"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47bb0",
            "size": "0x0000007c",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.52"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47c2c",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "2.65"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47ca0",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.39"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47d14",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.39"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47d88",
            "size": "0x00000084",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.53"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47e0c",
            "size": "0x0000008c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47e98",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.39"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d47f0c",
            "size": "0x00000160",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.70"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4806c",
            "size": "0x00000184",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.75"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d481f0",
            "size": "0x0000012c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4831c",
            "size": "0x0000015e",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.17"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4847c",
            "size": "0x00000152",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d485d0",
            "size": "0x00000160",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d48730",
            "size": "0x00000170",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d488a0",
            "size": "0x0000015a",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d489fc",
            "size": "0x00000184",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.11"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d48b80",
            "size": "0x0000019c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.10"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d48d1c",
            "size": "0x00000154",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d48e70",
            "size": "0x00000184",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.24"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d48ff4",
            "size": "0x0000016c",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d49160",
            "size": "0x0000011e",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.51"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d49280",
            "size": "0x00000148",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d493c8",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4953c",
            "size": "0x00000156",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d49694",
            "size": "0x00000176",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.22"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4980c",
            "size": "0x00000166",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.10"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d49974",
            "size": "0x0000015c",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.10"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d49ad0",
            "size": "0x00000182",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.75"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d49c54",
            "size": "0x00000166",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d49dbc",
            "size": "0x0000014a",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.18"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d49f08",
            "size": "0x0000016a",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4a074",
            "size": "0x00000182",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4a1f8",
            "size": "0x00000190",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.25"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4a388",
            "size": "0x00000170",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.75"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4a4f8",
            "size": "0x00000176",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4a670",
            "size": "0x00000148",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4a7b8",
            "size": "0x00000162",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.10"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4a91c",
            "size": "0x00000182",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4aaa0",
            "size": "0x00000120",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.72"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4abc0",
            "size": "0x0000015e",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4ad20",
            "size": "0x00000186",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4aea8",
            "size": "0x0000015e",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4b008",
            "size": "0x0000019c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.10"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4b1a4",
            "size": "0x00000166",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4b30c",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "2.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4b3c4",
            "size": "0x000000d0",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.24"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4b494",
            "size": "0x000000ce",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.21"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4b564",
            "size": "0x000000d4",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.89"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4b638",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4b704",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "2.81"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4b7d0",
            "size": "0x000000d0",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.27"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4b8a0",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.70"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4b95c",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.73"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4ba28",
            "size": "0x000000d8",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4bb00",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.97"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4bbb8",
            "size": "0x000000ce",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4bc88",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.85"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4bd64",
            "size": "0x000000c2",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.21"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4be28",
            "size": "0x000000ac",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "2.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4bed4",
            "size": "0x000000c2",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "2.76"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4bf98",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4c064",
            "size": "0x000000d2",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4c138",
            "size": "0x000000c8",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.75"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4c200",
            "size": "0x000000ce",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "2.85"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4c2d0",
            "size": "0x000000da",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.33"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4c3ac",
            "size": "0x000000c6",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.75"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4c474",
            "size": "0x000000ce",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4c544",
            "size": "0x000000ce",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4c614",
            "size": "0x000000d8",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4c6ec",
            "size": "0x000000c6",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4c7b4",
            "size": "0x000000ce",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.21"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4c884",
            "size": "0x000000ce",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4c954",
            "size": "0x000000d8",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4ca2c",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.94"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4cb08",
            "size": "0x000000be",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.73"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4cbc8",
            "size": "0x000000c6",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4cc90",
            "size": "0x000000e8",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.88"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4cd78",
            "size": "0x000000d0",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "2.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4ce48",
            "size": "0x000000e8",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "2.88"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4cf30",
            "size": "0x000000d6",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4d008",
            "size": "0x000000c6",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.75"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4d0d0",
            "size": "0x00000110",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.76"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4d1e0",
            "size": "0x00000118",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.73"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4d2f8",
            "size": "0x000000e8",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.63"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4d3e0",
            "size": "0x00000118",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.18"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4d4f8",
            "size": "0x00000118",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4d610",
            "size": "0x0000014c",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4d75c",
            "size": "0x00000134",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4d890",
            "size": "0x00000134",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4d9c4",
            "size": "0x00000100",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4dac4",
            "size": "0x00000148",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.18"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4dc0c",
            "size": "0x00000100",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.72"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4dd0c",
            "size": "0x00000144",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.21"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4de50",
            "size": "0x00000124",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4df74",
            "size": "0x000000f8",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.76"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4e06c",
            "size": "0x000000d8",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4e144",
            "size": "0x0000011c",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4e260",
            "size": "0x0000010c",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4e36c",
            "size": "0x00000130",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.27"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4e49c",
            "size": "0x00000128",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4e5c4",
            "size": "0x00000120",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.18"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4e6e4",
            "size": "0x0000011c",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4e800",
            "size": "0x00000124",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4e924",
            "size": "0x00000128",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.24"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4ea4c",
            "size": "0x0000011c",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4eb68",
            "size": "0x00000128",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4ec90",
            "size": "0x00000114",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.22"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4eda4",
            "size": "0x00000118",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.82"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4eebc",
            "size": "0x00000128",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.17"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4efe4",
            "size": "0x00000118",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.10"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4f0fc",
            "size": "0x00000128",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.28"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4f224",
            "size": "0x00000120",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4f344",
            "size": "0x000000e4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4f428",
            "size": "0x00000130",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4f558",
            "size": "0x00000130",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4f688",
            "size": "0x00000128",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4f7b0",
            "size": "0x00000130",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4f8e0",
            "size": "0x00000158",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.18"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4fa38",
            "size": "0x0000012c",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4fb64",
            "size": "0x000000f0",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.36"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4fc54",
            "size": "0x00000102",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.38"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4fd58",
            "size": "0x000000e0",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.10"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4fe38",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4ff14",
            "size": "0x000000da",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.77"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d4fff0",
            "size": "0x000000ea",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d500dc",
            "size": "0x000000fa",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.49"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d501d8",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d502b4",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d50390",
            "size": "0x000000de",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d50470",
            "size": "0x000000d6",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d50548",
            "size": "0x000000e2",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.82"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5062c",
            "size": "0x0000010c",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.94"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d50738",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d50814",
            "size": "0x000000c2",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "2.97"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d508d8",
            "size": "0x000000ea",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "2.82"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d509c4",
            "size": "0x000000d2",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.70"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d50a98",
            "size": "0x0000010a",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d50ba4",
            "size": "0x000000ee",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d50c94",
            "size": "0x000000e2",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "2.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d50d78",
            "size": "0x000000f0",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.32"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d50e68",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.89"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d50f5c",
            "size": "0x000000e8",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d51044",
            "size": "0x000000d2",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d51118",
            "size": "0x000000ee",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.22"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d51208",
            "size": "0x000000e0",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d512e8",
            "size": "0x00000102",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.42"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d513ec",
            "size": "0x000000ec",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.88"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d514d8",
            "size": "0x000000e2",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.85"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d515bc",
            "size": "0x000000e8",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.87"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d516a4",
            "size": "0x000000f0",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.87"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d51794",
            "size": "0x000000d8",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5186c",
            "size": "0x000000fc",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d51968",
            "size": "0x000000fe",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "2.90"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d51a68",
            "size": "0x00000104",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "2.93"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d51b6c",
            "size": "0x000000de",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d51c4c",
            "size": "0x000000ec",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d51d38",
            "size": "0x00000130",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.69"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d51e68",
            "size": "0x0000015c",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.71"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d51fc4",
            "size": "0x00000108",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.48"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d520cc",
            "size": "0x00000158",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d52224",
            "size": "0x0000012c",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d52350",
            "size": "0x0000015c",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d524ac",
            "size": "0x0000014c",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d525f8",
            "size": "0x0000013c",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d52734",
            "size": "0x00000154",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d52888",
            "size": "0x0000013c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d529c4",
            "size": "0x0000011c",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d52ae0",
            "size": "0x0000014c",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d52c2c",
            "size": "0x0000013c",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d52d68",
            "size": "0x00000110",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d52e78",
            "size": "0x000000f8",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.71"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d52f70",
            "size": "0x00000170",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d530e0",
            "size": "0x0000011c",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d531fc",
            "size": "0x00000144",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d53340",
            "size": "0x00000140",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.10"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d53480",
            "size": "0x00000154",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.17"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d535d4",
            "size": "0x0000014c",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.71"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d53720",
            "size": "0x00000134",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d53854",
            "size": "0x0000013c",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d53990",
            "size": "0x00000144",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d53ad4",
            "size": "0x0000012c",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.66"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d53c00",
            "size": "0x00000134",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.17"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d53d34",
            "size": "0x00000140",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d53e74",
            "size": "0x00000140",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d53fb4",
            "size": "0x00000138",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d540ec",
            "size": "0x00000138",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.18"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d54224",
            "size": "0x00000144",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d54368",
            "size": "0x00000104",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.56"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5446c",
            "size": "0x00000144",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d545b0",
            "size": "0x00000144",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.11"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d546f4",
            "size": "0x00000144",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d54838",
            "size": "0x00000150",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d54988",
            "size": "0x0000013c",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d54ac4",
            "size": "0x0000017e",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.67"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d54c44",
            "size": "0x000001a0",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.71"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d54de4",
            "size": "0x0000010c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.76"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d54ef0",
            "size": "0x0000019c",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5508c",
            "size": "0x000001d2",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d55260",
            "size": "0x0000021e",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d55480",
            "size": "0x000001d0",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d55650",
            "size": "0x000001b2",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d55804",
            "size": "0x00000196",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5599c",
            "size": "0x000001e4",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d55b80",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.65"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d55cf4",
            "size": "0x000001c6",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.10"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d55ebc",
            "size": "0x000001c4",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d56080",
            "size": "0x00000122",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.92"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d561a4",
            "size": "0x0000013c",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "4.18"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d562e0",
            "size": "0x000001bc",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5649c",
            "size": "0x000001aa",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d56648",
            "size": "0x000001c0",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.27"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d56808",
            "size": "0x000001ac",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d569b4",
            "size": "0x000001bc",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.17"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d56b70",
            "size": "0x000001a8",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d56d18",
            "size": "0x000001ba",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d56ed4",
            "size": "0x000001a2",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.26"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d57078",
            "size": "0x000001ae",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d57228",
            "size": "0x00000198",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d573c0",
            "size": "0x0000017a",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5753c",
            "size": "0x00000188",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.76"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d576c4",
            "size": "0x00000196",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5785c",
            "size": "0x00000176",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d579d4",
            "size": "0x0000018a",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.17"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d57b60",
            "size": "0x0000017e",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d57ce0",
            "size": "0x00000112",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d57df4",
            "size": "0x000001a2",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d57f98",
            "size": "0x000001ca",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d58164",
            "size": "0x000001ba",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d58320",
            "size": "0x000001e8",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d58508",
            "size": "0x000001ac",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d586b4",
            "size": "0x000002e0",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "2.63"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d58994",
            "size": "0x000002c0",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.50"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d58c54",
            "size": "0x000002cc",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.58"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d58f20",
            "size": "0x000002d0",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "2.57"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d591f0",
            "size": "0x000002d8",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "2.62"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d594c8",
            "size": "0x0000016a",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.48"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d59634",
            "size": "0x00000172",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.51"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d597a8",
            "size": "0x0000015e",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.36"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d59908",
            "size": "0x00000190",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d59a98",
            "size": "0x0000015c",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d59bf4",
            "size": "0x0000017a",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d59d70",
            "size": "0x0000017c",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.65"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d59eec",
            "size": "0x0000015e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5a04c",
            "size": "0x00000160",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5a1ac",
            "size": "0x0000015e",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5a30c",
            "size": "0x00000158",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.45"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5a464",
            "size": "0x00000170",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.10"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5a5d4",
            "size": "0x00000178",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5a74c",
            "size": "0x00000152",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.33"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5a8a0",
            "size": "0x0000013c",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.29"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5a9dc",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5ab50",
            "size": "0x0000015e",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5acb0",
            "size": "0x0000018c",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5ae3c",
            "size": "0x00000170",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5afac",
            "size": "0x00000170",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5b11c",
            "size": "0x00000164",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.50"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5b280",
            "size": "0x00000176",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5b3f8",
            "size": "0x0000019c",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5b594",
            "size": "0x00000166",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5b6fc",
            "size": "0x00000168",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.45"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5b864",
            "size": "0x0000016a",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5b9d0",
            "size": "0x00000162",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.49"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5bb34",
            "size": "0x00000176",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5bcac",
            "size": "0x0000016c",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5be18",
            "size": "0x0000016a",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5bf84",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5c0f8",
            "size": "0x00000154",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.32"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5c24c",
            "size": "0x0000017c",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5c3c8",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5c53c",
            "size": "0x0000017c",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5c6b8",
            "size": "0x0000015e",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5c818",
            "size": "0x0000016c",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5c984",
            "size": "0x000001fc",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.52"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5cb80",
            "size": "0x00000230",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.61"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5cdb0",
            "size": "0x000001aa",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.42"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5cf5c",
            "size": "0x00000224",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5d180",
            "size": "0x0000021a",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5d39c",
            "size": "0x00000236",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.10"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5d5d4",
            "size": "0x00000252",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.72"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5d828",
            "size": "0x0000022e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5da58",
            "size": "0x00000234",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5dc8c",
            "size": "0x00000248",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5ded4",
            "size": "0x000001fa",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5e0d0",
            "size": "0x0000023a",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5e30c",
            "size": "0x00000230",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5e53c",
            "size": "0x000001cc",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.53"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5e708",
            "size": "0x000001a4",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.46"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5e8ac",
            "size": "0x00000222",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5ead0",
            "size": "0x0000021e",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5ecf0",
            "size": "0x0000021c",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5ef0c",
            "size": "0x0000023c",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5f148",
            "size": "0x0000022e",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5f378",
            "size": "0x00000236",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.69"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5f5b0",
            "size": "0x00000226",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5f7d8",
            "size": "0x0000021c",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5f9f4",
            "size": "0x00000224",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.11"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5fc18",
            "size": "0x00000216",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.64"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d5fe30",
            "size": "0x00000204",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d60034",
            "size": "0x0000023c",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.68"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d60270",
            "size": "0x0000022e",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d604a0",
            "size": "0x00000242",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d606e4",
            "size": "0x00000226",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.11"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6090c",
            "size": "0x00000248",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d60b54",
            "size": "0x000001ac",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.54"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d60d00",
            "size": "0x0000022e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d60f30",
            "size": "0x00000250",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.11"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d61180",
            "size": "0x00000232",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d613b4",
            "size": "0x00000248",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d615fc",
            "size": "0x00000248",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d61844",
            "size": "0x00000224",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d61a68",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "2.52"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d61b5c",
            "size": "0x00000114",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "2.75"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d61c70",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.51"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d61d64",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.53"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d61e58",
            "size": "0x000000fc",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.58"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d61f54",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "2.66"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d62048",
            "size": "0x00000104",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.58"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6214c",
            "size": "0x0000010c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "2.73"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d62258",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "2.76"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d62324",
            "size": "0x000000ec",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d62410",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d624dc",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "2.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d625a8",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d62674",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.73"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d62740",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.77"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6280c",
            "size": "0x000000d4",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d628e0",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "2.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d629bc",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d62a88",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "2.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d62b54",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d62c20",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d62cfc",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d62dc8",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d62e94",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d62f60",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6302c",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d630f8",
            "size": "0x000000e4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "2.94"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d631dc",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d632a8",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "2.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d63374",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "2.47"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d63428",
            "size": "0x000000d4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "2.75"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d634fc",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.45"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d635b0",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.48"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d63664",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.53"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d63720",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "2.63"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d637d4",
            "size": "0x000000c4",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.54"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d63898",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "2.72"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d63964",
            "size": "0x0000019c",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.95"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d63b00",
            "size": "0x000001a2",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.92"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d63ca4",
            "size": "0x0000011a",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "4.27"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d63dc0",
            "size": "0x00000194",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.42"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d63f54",
            "size": "0x000001a0",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.25"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d640f4",
            "size": "0x000001c8",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.32"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d642bc",
            "size": "0x000001c4",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d64480",
            "size": "0x00000184",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.25"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d64604",
            "size": "0x000001a0",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.25"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d647a4",
            "size": "0x000001a0",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.32"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d64944",
            "size": "0x0000016c",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.93"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d64ab0",
            "size": "0x000001bc",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.39"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d64c6c",
            "size": "0x000001a0",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.28"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d64e0c",
            "size": "0x00000156",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.23"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d64f64",
            "size": "0x0000013c",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "4.33"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d650a0",
            "size": "0x0000016e",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.29"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d65210",
            "size": "0x00000188",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.30"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d65398",
            "size": "0x000001a2",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.39"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6553c",
            "size": "0x000001a2",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.29"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d656e0",
            "size": "0x000001a2",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.36"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d65884",
            "size": "0x000001cc",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "4.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d65a50",
            "size": "0x000001a6",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.33"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d65bf8",
            "size": "0x00000178",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.43"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d65d70",
            "size": "0x0000018e",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.28"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d65f00",
            "size": "0x00000182",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.02"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d66084",
            "size": "0x000001b0",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.42"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d66234",
            "size": "0x00000182",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d663b8",
            "size": "0x0000019a",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.31"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d66554",
            "size": "0x000001a4",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.30"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d666f8",
            "size": "0x0000019c",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.41"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d66894",
            "size": "0x000001ba",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.37"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d66a50",
            "size": "0x0000010c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "4.24"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d66b5c",
            "size": "0x00000182",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.24"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d66ce0",
            "size": "0x00000198",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.30"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d66e78",
            "size": "0x00000192",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.25"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6700c",
            "size": "0x0000018c",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.29"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d67198",
            "size": "0x0000019c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.33"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d67334",
            "size": "0x000001a6",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d674dc",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d675a8",
            "size": "0x000000e8",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.49"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d67690",
            "size": "0x000000d0",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.17"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d67760",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6783c",
            "size": "0x000000e0",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.97"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6791c",
            "size": "0x000000e8",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.02"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d67a04",
            "size": "0x000000e8",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d67aec",
            "size": "0x000000e0",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.97"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d67bcc",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.90"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d67c98",
            "size": "0x000000e8",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d67d80",
            "size": "0x000000e4",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d67e64",
            "size": "0x000000e4",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d67f48",
            "size": "0x000000e8",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d68030",
            "size": "0x000000d0",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.40"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d68100",
            "size": "0x000000c8",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.31"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d681c8",
            "size": "0x000000e8",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "2.95"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d682b0",
            "size": "0x000000e4",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.95"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d68394",
            "size": "0x000000e4",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d68478",
            "size": "0x000000d8",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.94"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d68550",
            "size": "0x000000f0",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d68640",
            "size": "0x000000d8",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.45"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d68718",
            "size": "0x000000ec",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d68804",
            "size": "0x000000e0",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d688e4",
            "size": "0x000000e8",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.92"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d689cc",
            "size": "0x000000e4",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.47"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d68ab0",
            "size": "0x000000d4",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.94"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d68b84",
            "size": "0x000000d8",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.44"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d68c5c",
            "size": "0x000000f0",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d68d4c",
            "size": "0x000000e4",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d68e30",
            "size": "0x000000e0",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d68f10",
            "size": "0x000000e8",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.02"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d68ff8",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d690c4",
            "size": "0x000000ec",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d691b0",
            "size": "0x000000ec",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6929c",
            "size": "0x000000e0",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "2.97"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6937c",
            "size": "0x000000f0",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6946c",
            "size": "0x00000104",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d69570",
            "size": "0x0000012e",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.66"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d696a0",
            "size": "0x0000013a",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.67"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d697dc",
            "size": "0x0000011e",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.73"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d698fc",
            "size": "0x0000012a",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d69a28",
            "size": "0x00000136",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.28"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d69b60",
            "size": "0x00000122",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.25"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d69c84",
            "size": "0x0000015e",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d69de4",
            "size": "0x00000142",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d69f28",
            "size": "0x0000013a",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.28"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6a064",
            "size": "0x00000162",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6a1c8",
            "size": "0x0000011e",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.68"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6a2e8",
            "size": "0x0000011e",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.26"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6a408",
            "size": "0x0000012a",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.24"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6a534",
            "size": "0x0000010e",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.62"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6a644",
            "size": "0x0000011e",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6a764",
            "size": "0x00000126",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.20"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6a88c",
            "size": "0x0000012a",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.26"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6a9b8",
            "size": "0x0000014e",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.43"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6ab08",
            "size": "0x0000012a",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.22"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6ac34",
            "size": "0x0000014a",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.39"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6ad80",
            "size": "0x0000017e",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6af00",
            "size": "0x00000146",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.33"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6b048",
            "size": "0x0000013a",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6b184",
            "size": "0x00000122",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.26"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6b2a8",
            "size": "0x00000146",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6b3f0",
            "size": "0x0000013a",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.39"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6b52c",
            "size": "0x0000011e",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.57"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6b64c",
            "size": "0x0000014a",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.33"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6b798",
            "size": "0x0000011e",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.25"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6b8b8",
            "size": "0x0000012e",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.29"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6b9e8",
            "size": "0x00000136",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.31"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6bb20",
            "size": "0x0000011e",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6bc40",
            "size": "0x00000142",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.32"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6bd84",
            "size": "0x00000142",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.30"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6bec8",
            "size": "0x00000152",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.26"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6c01c",
            "size": "0x0000015e",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6c17c",
            "size": "0x00000162",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6c2e0",
            "size": "0x00000152",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.32"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6c434",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.21"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6c4e8",
            "size": "0x000000c0",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.27"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6c5a8",
            "size": "0x000000c4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.30"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6c66c",
            "size": "0x000000c8",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.01"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6c734",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6c7f0",
            "size": "0x000000c0",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "2.85"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6c8b0",
            "size": "0x000000c8",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.37"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6c978",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.81"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6ca2c",
            "size": "0x000000c0",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6caec",
            "size": "0x000000c4",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6cbb0",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.28"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6cc6c",
            "size": "0x000000c4",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6cd30",
            "size": "0x000000c4",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.88"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6cdf4",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.21"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6ceb0",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6cf64",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6d01c",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.81"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6d0d4",
            "size": "0x000000c0",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6d194",
            "size": "0x000000c4",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.89"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6d258",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6d310",
            "size": "0x000000c8",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.38"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6d3d8",
            "size": "0x000000b0",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.73"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6d488",
            "size": "0x000000c8",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6d550",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.77"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6d60c",
            "size": "0x000000d0",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6d6dc",
            "size": "0x000000dc",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6d7b8",
            "size": "0x000000ac",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6d864",
            "size": "0x000000c8",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.87"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6d92c",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6d9e8",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.75"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6da9c",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.89"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6db68",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.30"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6dc24",
            "size": "0x000000b0",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.74"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6dcd4",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "2.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6dd90",
            "size": "0x000000c0",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6de50",
            "size": "0x000000c4",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.91"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6df14",
            "size": "0x000000b4",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.75"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6dfc8",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.42"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6e03c",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.44"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6e1b0",
            "size": "0x00000188",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.54"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6e338",
            "size": "0x00000178",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.37"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6e4b0",
            "size": "0x00000182",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.11"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6e634",
            "size": "0x00000176",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.12"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6e7ac",
            "size": "0x00000198",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.15"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6e944",
            "size": "0x00000188",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.67"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6eacc",
            "size": "0x0000016a",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6ec38",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6edac",
            "size": "0x0000017c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6ef28",
            "size": "0x00000160",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.39"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6f088",
            "size": "0x0000018c",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6f214",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.05"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6f388",
            "size": "0x0000016a",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.53"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6f4f4",
            "size": "0x00000168",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.46"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6f65c",
            "size": "0x00000194",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6f7f0",
            "size": "0x0000016e",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.11"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6f960",
            "size": "0x00000196",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6faf8",
            "size": "0x0000017a",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6fc74",
            "size": "0x00000184",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6fdf8",
            "size": "0x0000018e",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.62"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d6ff88",
            "size": "0x00000186",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d70110",
            "size": "0x00000186",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.14"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d70298",
            "size": "0x00000192",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.21"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d7042c",
            "size": "0x000001a2",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d705d0",
            "size": "0x0000015c",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d7072c",
            "size": "0x00000190",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d708bc",
            "size": "0x0000018e",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d70a4c",
            "size": "0x0000016c",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.99"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d70bb8",
            "size": "0x0000018e",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.19"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d70d48",
            "size": "0x00000192",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.13"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d70edc",
            "size": "0x00000170",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.35"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d7104c",
            "size": "0x0000016a",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d711b8",
            "size": "0x0000019a",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.18"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d71354",
            "size": "0x00000182",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.04"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d714d8",
            "size": "0x0000017a",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.11"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d71654",
            "size": "0x0000017c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d717d0",
            "size": "0x0000017e",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.06"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d71950",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.17"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d719c8",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.00"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d71a3c",
            "size": "0x0000006c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "2.98"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d71aa8",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.90"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d71b20",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.82"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d71b94",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "2.80"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d71c08",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.16"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d71c80",
            "size": "0x00000070",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d71cf0",
            "size": "0x00000070",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.81"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d71d60",
            "size": "0x00000070",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d71dd0",
            "size": "0x00000070",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d71e40",
            "size": "0x00000070",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.83"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d71eb0",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.76"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d71f24",
            "size": "0x00000070",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.95"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d71f94",
            "size": "0x00000070",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d72004",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d72078",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.73"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d720ec",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d72160",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d721d4",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.03"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d7224c",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d722c0",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d72338",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.82"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d723ac",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.18"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d72424",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.86"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d72498",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.09"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d72510",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d72584",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.84"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d725fc",
            "size": "0x0000007c",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.90"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d72678",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.85"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d726f0",
            "size": "0x0000006c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "2.96"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d7275c",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d727d0",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d72844",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "2.78"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d728b8",
            "size": "0x00000070",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.79"
          },
          {
            "name": "RT_DIALOG",
            "offset": "0x00d72928",
            "size": "0x00000074",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.78"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7299c",
            "size": "0x00000460",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.91"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d72dfc",
            "size": "0x0000054a",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.80"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d73348",
            "size": "0x000001e2",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.94"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7352c",
            "size": "0x00000504",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d73a30",
            "size": "0x0000047e",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d73eb0",
            "size": "0x000005b0",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d74460",
            "size": "0x000005cc",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.89"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d74a2c",
            "size": "0x00000418",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d74e44",
            "size": "0x00000476",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d752bc",
            "size": "0x00000588",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d75844",
            "size": "0x000003aa",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.94"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d75bf0",
            "size": "0x0000050c",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.50"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d760fc",
            "size": "0x00000500",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d765fc",
            "size": "0x000002f6",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.74"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d768f4",
            "size": "0x000002b8",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d76bac",
            "size": "0x0000047c",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d77028",
            "size": "0x000004d0",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d774f8",
            "size": "0x00000520",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d77a18",
            "size": "0x0000052c",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d77f44",
            "size": "0x000004b4",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d783f8",
            "size": "0x000004b4",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.88"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d788ac",
            "size": "0x0000053a",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.39"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d78de8",
            "size": "0x000004f8",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d792e0",
            "size": "0x000004c0",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d797a0",
            "size": "0x00000452",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.02"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d79bf4",
            "size": "0x000004de",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7a0d4",
            "size": "0x000004b0",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7a584",
            "size": "0x00000538",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.39"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7aabc",
            "size": "0x000004e2",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7afa0",
            "size": "0x000004d6",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7b478",
            "size": "0x000004b8",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.50"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7b930",
            "size": "0x000001e8",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.90"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7bb18",
            "size": "0x0000041a",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7bf34",
            "size": "0x000004d0",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7c404",
            "size": "0x00000536",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7c93c",
            "size": "0x00000540",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7ce7c",
            "size": "0x00000606",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7d484",
            "size": "0x000004fe",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7d984",
            "size": "0x0000035e",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.79"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7dce4",
            "size": "0x0000041e",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.74"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7e104",
            "size": "0x0000017a",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "6.10"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7e280",
            "size": "0x00000436",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.50"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7e6b8",
            "size": "0x000003f8",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7eab0",
            "size": "0x000004be",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7ef70",
            "size": "0x000004ce",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.86"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7f440",
            "size": "0x00000388",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7f7c8",
            "size": "0x0000041e",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.17"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d7fbe8",
            "size": "0x00000512",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d800fc",
            "size": "0x0000030e",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.82"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8040c",
            "size": "0x000003da",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.50"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d807e8",
            "size": "0x000004c2",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.17"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d80cac",
            "size": "0x00000250",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.97"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d80efc",
            "size": "0x0000022a",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d81128",
            "size": "0x000003d4",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d814fc",
            "size": "0x00000406",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d81904",
            "size": "0x00000444",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d81d48",
            "size": "0x0000040e",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d82158",
            "size": "0x0000043e",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.39"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d82598",
            "size": "0x000003f0",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.81"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d82988",
            "size": "0x00000448",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d82dd0",
            "size": "0x00000422",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d831f4",
            "size": "0x00000420",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d83614",
            "size": "0x000003a2",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.93"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d839b8",
            "size": "0x000003ca",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.57"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d83d84",
            "size": "0x00000416",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.88"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8419c",
            "size": "0x000003f4",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d84590",
            "size": "0x000003d6",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d84968",
            "size": "0x0000048c",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.51"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d84df4",
            "size": "0x0000039a",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d85190",
            "size": "0x00000176",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.95"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d85308",
            "size": "0x00000380",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d85688",
            "size": "0x00000474",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d85afc",
            "size": "0x0000045c",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d85f58",
            "size": "0x00000474",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d863cc",
            "size": "0x00000516",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d868e4",
            "size": "0x00000424",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d86d08",
            "size": "0x0000057a",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.72"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d87284",
            "size": "0x00000818",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.57"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d87a9c",
            "size": "0x00000222",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "6.00"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d87cc0",
            "size": "0x00000840",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.44"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d88500",
            "size": "0x000007f4",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d88cf4",
            "size": "0x000007a8",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8949c",
            "size": "0x00000948",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.66"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d89de4",
            "size": "0x00000614",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.20"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8a3f8",
            "size": "0x000006c2",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.11"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8aabc",
            "size": "0x0000095c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8b418",
            "size": "0x0000059c",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.65"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8b9b4",
            "size": "0x00000752",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8c108",
            "size": "0x000008fc",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.09"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8ca04",
            "size": "0x000003c6",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.76"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8cdcc",
            "size": "0x00000366",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8d134",
            "size": "0x000006ee",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8d824",
            "size": "0x00000694",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.20"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8deb8",
            "size": "0x000007a4",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8e65c",
            "size": "0x00000796",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8edf4",
            "size": "0x000006e4",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8f4d8",
            "size": "0x00000776",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.69"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d8fc50",
            "size": "0x0000085e",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d904b0",
            "size": "0x0000072c",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.45"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d90bdc",
            "size": "0x000006fc",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.17"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d912d8",
            "size": "0x000005f6",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.79"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d918d0",
            "size": "0x000006c8",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d91f98",
            "size": "0x0000077e",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.70"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d92718",
            "size": "0x00000840",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d92f58",
            "size": "0x0000071a",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.17"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d93674",
            "size": "0x0000084e",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d93ec4",
            "size": "0x00000690",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d94554",
            "size": "0x0000022c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "6.03"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d94780",
            "size": "0x0000064a",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d94dcc",
            "size": "0x00000814",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.15"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d955e0",
            "size": "0x000007c6",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d95da8",
            "size": "0x0000081e",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.15"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d965c8",
            "size": "0x0000093c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.20"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d96f04",
            "size": "0x0000079c",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d976a0",
            "size": "0x0000034a",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.89"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d979ec",
            "size": "0x00000426",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.80"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d97e14",
            "size": "0x0000016e",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.83"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d97f84",
            "size": "0x000003aa",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.53"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d98330",
            "size": "0x000003a0",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d986d0",
            "size": "0x0000045c",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d98b2c",
            "size": "0x0000047e",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.91"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d98fac",
            "size": "0x00000384",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d99330",
            "size": "0x000003a8",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d996d8",
            "size": "0x00000496",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d99b70",
            "size": "0x000002fa",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.86"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d99e6c",
            "size": "0x000003a8",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9a214",
            "size": "0x0000040c",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9a620",
            "size": "0x0000020a",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "5.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9a82c",
            "size": "0x000001d2",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9aa00",
            "size": "0x0000041e",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9ae20",
            "size": "0x000003a4",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9b1c4",
            "size": "0x00000406",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.58"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9b5cc",
            "size": "0x00000444",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9ba10",
            "size": "0x000003fe",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9be10",
            "size": "0x000003be",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.90"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9c1d0",
            "size": "0x000003e8",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9c5b8",
            "size": "0x000003a8",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9c960",
            "size": "0x000003a4",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9cd04",
            "size": "0x0000036a",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.10"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9d070",
            "size": "0x000003c0",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9d430",
            "size": "0x00000396",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.97"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9d7c8",
            "size": "0x000003b6",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.39"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9db80",
            "size": "0x000003bc",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9df3c",
            "size": "0x000003fe",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.49"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9e33c",
            "size": "0x000003b2",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.49"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9e6f0",
            "size": "0x0000016c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.80"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9e85c",
            "size": "0x00000384",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9ebe0",
            "size": "0x00000442",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9f024",
            "size": "0x00000448",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9f46c",
            "size": "0x00000444",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9f8b0",
            "size": "0x00000496",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00d9fd48",
            "size": "0x000003f2",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da013c",
            "size": "0x000005ea",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.78"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da0728",
            "size": "0x000006ee",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.71"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da0e18",
            "size": "0x00000242",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "6.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da105c",
            "size": "0x00000622",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da1680",
            "size": "0x000005e0",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da1c60",
            "size": "0x00000770",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da23d0",
            "size": "0x000007aa",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.77"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da2b7c",
            "size": "0x000005d0",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da314c",
            "size": "0x0000067e",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.17"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da37cc",
            "size": "0x000007ac",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da3f78",
            "size": "0x000004d8",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.81"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da4450",
            "size": "0x00000690",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.44"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da4ae0",
            "size": "0x000006d8",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da51b8",
            "size": "0x00000388",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da5540",
            "size": "0x0000038e",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da58d0",
            "size": "0x00000670",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.15"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da5f40",
            "size": "0x000005e0",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da6520",
            "size": "0x00000696",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.49"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da6bb8",
            "size": "0x0000066c",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da7224",
            "size": "0x00000716",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.39"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da793c",
            "size": "0x00000624",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.78"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da7f60",
            "size": "0x000006c8",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da8628",
            "size": "0x0000061a",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.54"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da8c44",
            "size": "0x0000067a",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da92c0",
            "size": "0x000005b4",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.94"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da9874",
            "size": "0x000006a8",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.44"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00da9f1c",
            "size": "0x00000644",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.87"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00daa560",
            "size": "0x00000670",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00daabd0",
            "size": "0x000005dc",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dab1ac",
            "size": "0x000006fe",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.44"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dab8ac",
            "size": "0x00000646",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dabef4",
            "size": "0x00000238",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "6.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dac12c",
            "size": "0x000005ca",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dac6f8",
            "size": "0x000006ba",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dacdb4",
            "size": "0x000006f8",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dad4ac",
            "size": "0x000006a0",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dadb4c",
            "size": "0x000007cc",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dae318",
            "size": "0x000006e0",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dae9f8",
            "size": "0x0000061e",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.83"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00daf018",
            "size": "0x000007bc",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.73"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00daf7d4",
            "size": "0x00000268",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "6.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dafa3c",
            "size": "0x00000730",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.62"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db016c",
            "size": "0x000006ce",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db083c",
            "size": "0x00000776",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db0fb4",
            "size": "0x00000868",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.85"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db181c",
            "size": "0x0000064e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db1e6c",
            "size": "0x00000724",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db2590",
            "size": "0x0000087e",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db2e10",
            "size": "0x00000564",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.83"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db3374",
            "size": "0x00000776",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.51"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db3aec",
            "size": "0x0000082a",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db4318",
            "size": "0x000003f6",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "5.06"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db4710",
            "size": "0x000003ea",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db4afc",
            "size": "0x00000732",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db5230",
            "size": "0x00000730",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db5960",
            "size": "0x00000732",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db6094",
            "size": "0x00000710",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db67a4",
            "size": "0x00000746",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db6eec",
            "size": "0x00000720",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.82"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db760c",
            "size": "0x000007fe",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.39"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db7e0c",
            "size": "0x00000734",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.62"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db8540",
            "size": "0x000006ca",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db8c0c",
            "size": "0x00000690",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.98"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db929c",
            "size": "0x000007c4",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.51"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00db9a60",
            "size": "0x00000712",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.88"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dba174",
            "size": "0x00000764",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dba8d8",
            "size": "0x000006da",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dbafb4",
            "size": "0x00000702",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.49"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dbb6b8",
            "size": "0x00000682",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.45"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dbbd3c",
            "size": "0x00000256",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "6.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dbbf94",
            "size": "0x00000640",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dbc5d4",
            "size": "0x000007a6",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dbcd7c",
            "size": "0x0000075c",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dbd4d8",
            "size": "0x000007cc",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dbdca4",
            "size": "0x00000828",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dbe4cc",
            "size": "0x00000836",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dbed04",
            "size": "0x00000814",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dbf518",
            "size": "0x0000092c",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.87"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dbfe44",
            "size": "0x000003c0",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.99"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc0204",
            "size": "0x000009e0",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.61"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc0be4",
            "size": "0x0000085c",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc1440",
            "size": "0x00000b02",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc1f44",
            "size": "0x00000b0e",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.95"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc2a54",
            "size": "0x00000896",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc32ec",
            "size": "0x0000097c",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc3c68",
            "size": "0x00000a56",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc46c0",
            "size": "0x0000075e",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.01"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc4e20",
            "size": "0x00000930",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.53"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc5750",
            "size": "0x00000afe",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc6250",
            "size": "0x00000504",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "5.06"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc6754",
            "size": "0x00000542",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc6c98",
            "size": "0x0000098a",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc7624",
            "size": "0x0000093c",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc7f60",
            "size": "0x00000b04",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc8a64",
            "size": "0x0000091a",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc9380",
            "size": "0x00000936",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dc9cb8",
            "size": "0x00000918",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dca5d0",
            "size": "0x0000099e",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dcaf70",
            "size": "0x00000946",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.62"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dcb8b8",
            "size": "0x000008f0",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dcc1a8",
            "size": "0x000008e6",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.07"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dcca90",
            "size": "0x0000093e",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.63"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dcd3d0",
            "size": "0x00000930",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.99"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dcdd00",
            "size": "0x0000097a",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dce67c",
            "size": "0x000008ec",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dcef68",
            "size": "0x0000094c",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.53"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dcf8b4",
            "size": "0x00000936",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd01ec",
            "size": "0x000003ca",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd05b8",
            "size": "0x0000088e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd0e48",
            "size": "0x00000a4a",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd1894",
            "size": "0x000009b4",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd2248",
            "size": "0x00000a14",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd2c5c",
            "size": "0x00000aea",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd3748",
            "size": "0x0000099a",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd40e4",
            "size": "0x00000360",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.97"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd4444",
            "size": "0x000004ba",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.81"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd4900",
            "size": "0x00000192",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.89"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd4a94",
            "size": "0x00000466",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.69"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd4efc",
            "size": "0x0000041e",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd531c",
            "size": "0x000004d8",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd57f4",
            "size": "0x000004a4",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.94"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd5c98",
            "size": "0x000003c4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd605c",
            "size": "0x00000412",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd6470",
            "size": "0x000004fe",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd6970",
            "size": "0x00000334",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.94"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd6ca4",
            "size": "0x00000430",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.54"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd70d4",
            "size": "0x000004d8",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd75ac",
            "size": "0x0000025a",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "5.07"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd7808",
            "size": "0x0000022e",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd7a38",
            "size": "0x00000476",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd7eb0",
            "size": "0x000003d0",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd8280",
            "size": "0x00000436",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.58"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd86b8",
            "size": "0x0000043e",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd8af8",
            "size": "0x0000041a",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd8f14",
            "size": "0x00000426",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.89"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd933c",
            "size": "0x0000042c",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd9768",
            "size": "0x00000408",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.61"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd9b70",
            "size": "0x000003de",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dd9f50",
            "size": "0x00000406",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.00"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dda358",
            "size": "0x00000406",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.64"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dda760",
            "size": "0x00000450",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ddabb0",
            "size": "0x0000043e",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ddaff0",
            "size": "0x000003e2",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ddb3d4",
            "size": "0x00000476",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.61"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ddb84c",
            "size": "0x000003f2",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ddbc40",
            "size": "0x000001a4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "6.13"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ddbde4",
            "size": "0x000003c6",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ddc1ac",
            "size": "0x00000440",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ddc5ec",
            "size": "0x0000045e",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ddca4c",
            "size": "0x0000043c",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ddce88",
            "size": "0x0000052e",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ddd3b8",
            "size": "0x00000428",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.44"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ddd7e0",
            "size": "0x0000063c",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "4.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ddde1c",
            "size": "0x00000686",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.99"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dde4a4",
            "size": "0x000002f6",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dde79c",
            "size": "0x000006d4",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.62"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ddee70",
            "size": "0x0000061e",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ddf490",
            "size": "0x0000075c",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.47"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ddfbec",
            "size": "0x00000770",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.09"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de035c",
            "size": "0x0000060e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de096c",
            "size": "0x0000062e",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de0f9c",
            "size": "0x00000750",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de16ec",
            "size": "0x000004e4",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.15"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de1bd0",
            "size": "0x000006a8",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de2278",
            "size": "0x00000744",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de29bc",
            "size": "0x000003a8",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.92"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de2d64",
            "size": "0x000003ba",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.06"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de3120",
            "size": "0x000006c6",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de37e8",
            "size": "0x00000610",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.39"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de3df8",
            "size": "0x000006c8",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de44c0",
            "size": "0x00000684",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de4b44",
            "size": "0x0000068c",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.50"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de51d0",
            "size": "0x0000060e",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "4.07"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de57e0",
            "size": "0x000006f4",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.47"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de5ed4",
            "size": "0x00000660",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.66"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de6534",
            "size": "0x0000062e",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de6b64",
            "size": "0x000005e0",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de7144",
            "size": "0x0000069c",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.59"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de77e0",
            "size": "0x00000622",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.11"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de7e04",
            "size": "0x00000660",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de8464",
            "size": "0x00000620",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.45"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de8a84",
            "size": "0x00000672",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de90f8",
            "size": "0x00000622",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.58"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de971c",
            "size": "0x000002ee",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00de9a0c",
            "size": "0x00000608",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dea014",
            "size": "0x000006fe",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dea714",
            "size": "0x00000702",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00deae18",
            "size": "0x000006f8",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00deb510",
            "size": "0x0000071a",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00debc2c",
            "size": "0x0000064c",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dec278",
            "size": "0x00000422",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.91"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dec69c",
            "size": "0x00000484",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.81"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00decb20",
            "size": "0x000001be",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "6.07"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00decce0",
            "size": "0x0000045c",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.67"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ded13c",
            "size": "0x000003f6",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ded534",
            "size": "0x000004b8",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ded9ec",
            "size": "0x00000504",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.99"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dedef0",
            "size": "0x000003ca",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dee2bc",
            "size": "0x0000042e",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dee6ec",
            "size": "0x000004e4",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00deebd0",
            "size": "0x00000340",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.02"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00deef10",
            "size": "0x0000049c",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.59"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00def3ac",
            "size": "0x00000444",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00def7f0",
            "size": "0x000002ba",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.87"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00defaac",
            "size": "0x00000244",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00defcf0",
            "size": "0x00000440",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df0130",
            "size": "0x00000426",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df0558",
            "size": "0x0000042c",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df0984",
            "size": "0x0000047c",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df0e00",
            "size": "0x0000045c",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.54"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df125c",
            "size": "0x00000404",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.93"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df1660",
            "size": "0x00000442",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df1aa4",
            "size": "0x000003f2",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.67"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df1e98",
            "size": "0x000003ee",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.39"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df2288",
            "size": "0x000003dc",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.10"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df2664",
            "size": "0x0000042c",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df2a90",
            "size": "0x000003c0",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.99"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df2e50",
            "size": "0x0000040c",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.44"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df325c",
            "size": "0x00000410",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df366c",
            "size": "0x00000470",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df3adc",
            "size": "0x00000462",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df3f40",
            "size": "0x0000019a",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "6.07"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df40dc",
            "size": "0x000003dc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df44b8",
            "size": "0x000004ae",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df4968",
            "size": "0x00000460",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df4dc8",
            "size": "0x000004c2",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df528c",
            "size": "0x000004a4",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df5730",
            "size": "0x0000045a",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.45"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df5b8c",
            "size": "0x00000430",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.95"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df5fbc",
            "size": "0x000004c2",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.90"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df6480",
            "size": "0x000001fc",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.61"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df667c",
            "size": "0x00000462",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.65"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df6ae0",
            "size": "0x00000448",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df6f28",
            "size": "0x000004c0",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df73e8",
            "size": "0x00000572",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.01"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df795c",
            "size": "0x0000044e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df7dac",
            "size": "0x00000464",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df8210",
            "size": "0x000004d2",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df86e4",
            "size": "0x000003b6",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.05"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df8a9c",
            "size": "0x00000480",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.61"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df8f1c",
            "size": "0x000004c6",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df93e4",
            "size": "0x000002d8",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.97"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df96bc",
            "size": "0x0000027e",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.18"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df993c",
            "size": "0x0000048e",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00df9dcc",
            "size": "0x00000462",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfa230",
            "size": "0x000004f0",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.63"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfa720",
            "size": "0x00000482",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfaba4",
            "size": "0x000004d0",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfb074",
            "size": "0x0000050a",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.94"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfb580",
            "size": "0x00000446",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.45"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfb9c8",
            "size": "0x0000047c",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.62"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfbe44",
            "size": "0x00000450",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfc294",
            "size": "0x000003fa",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.15"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfc690",
            "size": "0x0000044a",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.57"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfcadc",
            "size": "0x00000420",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.07"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfcefc",
            "size": "0x00000444",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfd340",
            "size": "0x0000043e",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfd780",
            "size": "0x0000044a",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfdbcc",
            "size": "0x00000494",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.61"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfe060",
            "size": "0x00000204",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.57"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfe264",
            "size": "0x0000044c",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfe6b0",
            "size": "0x0000049e",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfeb50",
            "size": "0x0000048e",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dfefe0",
            "size": "0x000004c6",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dff4a8",
            "size": "0x00000530",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dff9d8",
            "size": "0x00000438",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00dffe10",
            "size": "0x000007ea",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.82"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e005fc",
            "size": "0x000009fc",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.72"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e00ff8",
            "size": "0x0000038e",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "6.12"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e01388",
            "size": "0x000008cc",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.53"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e01c54",
            "size": "0x0000090a",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e02560",
            "size": "0x00000b4c",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e030ac",
            "size": "0x00000adc",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.81"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e03b88",
            "size": "0x00000886",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e04410",
            "size": "0x0000096c",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.20"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e04d7c",
            "size": "0x00000a6a",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e057e8",
            "size": "0x00000762",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.87"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e05f4c",
            "size": "0x0000092a",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e06878",
            "size": "0x00000944",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e071bc",
            "size": "0x00000530",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "5.04"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e076ec",
            "size": "0x0000048e",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e07b7c",
            "size": "0x0000096a",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e084e8",
            "size": "0x000008d8",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e08dc0",
            "size": "0x0000095c",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.58"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e0971c",
            "size": "0x00000950",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e0a06c",
            "size": "0x00000964",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.47"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e0a9d0",
            "size": "0x00000880",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.85"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e0b250",
            "size": "0x00000946",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e0bb98",
            "size": "0x00000870",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e0c408",
            "size": "0x00000964",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e0cd6c",
            "size": "0x000007a4",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.98"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e0d510",
            "size": "0x00000984",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e0de94",
            "size": "0x000008d6",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.90"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e0e76c",
            "size": "0x00000954",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e0f0c0",
            "size": "0x00000896",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e0f958",
            "size": "0x00000888",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e101e0",
            "size": "0x000007d8",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e109b8",
            "size": "0x0000036a",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "6.15"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e10d24",
            "size": "0x00000892",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e115b8",
            "size": "0x00000956",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e11f10",
            "size": "0x0000093e",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e12850",
            "size": "0x000009b2",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e13204",
            "size": "0x000009fe",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e13c04",
            "size": "0x000009bc",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e145c0",
            "size": "0x0000096e",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "4.03"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e14f30",
            "size": "0x00000aac",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.92"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e159dc",
            "size": "0x00000484",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.86"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e15e60",
            "size": "0x00000a38",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e16898",
            "size": "0x000009ce",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e17268",
            "size": "0x00000bd6",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e17e40",
            "size": "0x00000c9a",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.01"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e18adc",
            "size": "0x0000092a",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e19408",
            "size": "0x00000a26",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e19e30",
            "size": "0x00000b3c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.39"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e1a96c",
            "size": "0x00000822",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.08"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e1b190",
            "size": "0x000009da",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.57"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e1bb6c",
            "size": "0x00000b66",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e1c6d4",
            "size": "0x00000664",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "5.00"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e1cd38",
            "size": "0x0000062e",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e1d368",
            "size": "0x00000a80",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e1dde8",
            "size": "0x00000a44",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e1e82c",
            "size": "0x00000bae",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.59"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e1f3dc",
            "size": "0x00000b1c",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e1fef8",
            "size": "0x00000a40",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.53"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e20938",
            "size": "0x00000aa4",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "4.00"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e213dc",
            "size": "0x00000a5c",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.44"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e21e38",
            "size": "0x000009ec",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.65"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e22824",
            "size": "0x00000a66",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e2328c",
            "size": "0x000008f2",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.18"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e23b80",
            "size": "0x00000a54",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.57"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e245d4",
            "size": "0x00000a30",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.07"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e25004",
            "size": "0x00000a08",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e25a0c",
            "size": "0x00000a40",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e2644c",
            "size": "0x00000a9c",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.59"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e26ee8",
            "size": "0x000009e6",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.59"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e278d0",
            "size": "0x0000047e",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.87"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e27d50",
            "size": "0x00000926",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e28678",
            "size": "0x00000ad8",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e29150",
            "size": "0x00000ae6",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e29c38",
            "size": "0x00000ada",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e2a714",
            "size": "0x00000b2a",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e2b240",
            "size": "0x00000af6",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e2bd38",
            "size": "0x000007bc",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "4.01"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e2c4f4",
            "size": "0x00000986",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.88"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e2ce7c",
            "size": "0x0000040c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.58"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e2d288",
            "size": "0x000009ae",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.53"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e2dc38",
            "size": "0x000008be",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e2e4f8",
            "size": "0x00000a42",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e2ef3c",
            "size": "0x00000af2",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.97"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e2fa30",
            "size": "0x000007d4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e30204",
            "size": "0x00000888",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e30a8c",
            "size": "0x00000a4c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e314d8",
            "size": "0x000006b8",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.03"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e31b90",
            "size": "0x00000954",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e324e4",
            "size": "0x000009aa",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e32e90",
            "size": "0x0000057e",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.83"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e33410",
            "size": "0x00000520",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.08"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e33930",
            "size": "0x000008e4",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e34214",
            "size": "0x000008d0",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e34ae4",
            "size": "0x00000a16",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.50"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e354fc",
            "size": "0x00000900",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e35dfc",
            "size": "0x000008cc",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.47"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e366c8",
            "size": "0x000009c4",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.93"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e3708c",
            "size": "0x00000906",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e37994",
            "size": "0x000008bc",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.50"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e38250",
            "size": "0x00000894",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e38ae4",
            "size": "0x0000085c",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.17"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e39340",
            "size": "0x0000090e",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.57"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e39c50",
            "size": "0x000008dc",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.03"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e3a52c",
            "size": "0x000009ac",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e3aed8",
            "size": "0x00000908",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e3b7e0",
            "size": "0x0000090a",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e3c0ec",
            "size": "0x000008b8",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.51"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e3c9a4",
            "size": "0x000003d2",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.53"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e3cd78",
            "size": "0x000007cc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e3d544",
            "size": "0x00000932",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e3de78",
            "size": "0x00000904",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e3e77c",
            "size": "0x00000974",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e3f0f0",
            "size": "0x00000ae8",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e3fbd8",
            "size": "0x000009a2",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e4057c",
            "size": "0x00000980",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "4.10"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e40efc",
            "size": "0x00000c30",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.02"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e41b2c",
            "size": "0x000004ec",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.68"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e42018",
            "size": "0x00000b4c",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.64"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e42b64",
            "size": "0x00000aea",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e43650",
            "size": "0x00000c32",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e44284",
            "size": "0x00000da4",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.10"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e45028",
            "size": "0x00000a26",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e45a50",
            "size": "0x00000ab6",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e46508",
            "size": "0x00000c70",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e47178",
            "size": "0x000008ca",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.12"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e47a44",
            "size": "0x00000b92",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.58"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e485d8",
            "size": "0x00000bc4",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e4919c",
            "size": "0x000006f6",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "5.17"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e49894",
            "size": "0x0000068e",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e49f24",
            "size": "0x00000af0",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e4aa14",
            "size": "0x00000ad0",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e4b4e4",
            "size": "0x00000d14",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e4c1f8",
            "size": "0x00000b54",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e4cd4c",
            "size": "0x00000ba0",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.51"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e4d8ec",
            "size": "0x00000c18",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "4.06"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e4e504",
            "size": "0x00000b38",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e4f03c",
            "size": "0x00000b8c",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.61"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e4fbc8",
            "size": "0x00000ab0",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e50678",
            "size": "0x00000a82",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e510fc",
            "size": "0x00000bae",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.59"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e51cac",
            "size": "0x00000af0",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.17"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5279c",
            "size": "0x00000b7e",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5331c",
            "size": "0x00000b4c",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e53e68",
            "size": "0x00000b72",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.62"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e549dc",
            "size": "0x00000b16",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.63"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e554f4",
            "size": "0x000004d8",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.70"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e559cc",
            "size": "0x00000a36",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e56404",
            "size": "0x00000bb6",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e56fbc",
            "size": "0x00000b60",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e57b1c",
            "size": "0x00000c28",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e58744",
            "size": "0x00000c58",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5939c",
            "size": "0x00000ba8",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.45"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e59f44",
            "size": "0x0000008a",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.76"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e59fd0",
            "size": "0x0000015c",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.09"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5a12c",
            "size": "0x000001da",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5a308",
            "size": "0x0000019c",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.79"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5a4a4",
            "size": "0x000001ae",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.85"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5a654",
            "size": "0x0000013a",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5a790",
            "size": "0x00000194",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.47"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5a924",
            "size": "0x00000190",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5aab4",
            "size": "0x000001ac",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5ac60",
            "size": "0x000001ac",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.98"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5ae0c",
            "size": "0x0000017e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5af8c",
            "size": "0x000001c6",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.47"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5b154",
            "size": "0x000001d0",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5b324",
            "size": "0x0000017e",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.81"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5b4a4",
            "size": "0x000001ba",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.47"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5b660",
            "size": "0x00000196",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5b7f8",
            "size": "0x00000152",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.76"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5b94c",
            "size": "0x00000150",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.74"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5ba9c",
            "size": "0x000001b0",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.44"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5bc4c",
            "size": "0x0000018e",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.39"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5bddc",
            "size": "0x00000196",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.44"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5bf74",
            "size": "0x000001a2",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5c118",
            "size": "0x000001b8",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.57"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5c2d0",
            "size": "0x0000019e",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.82"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5c470",
            "size": "0x00000192",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5c604",
            "size": "0x0000018e",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5c794",
            "size": "0x00000190",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5c924",
            "size": "0x00000172",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.78"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5ca98",
            "size": "0x000001a2",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5cc3c",
            "size": "0x00000198",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.82"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5cdd4",
            "size": "0x00000190",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5cf64",
            "size": "0x000001aa",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5d110",
            "size": "0x000001b8",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.51"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5d2c8",
            "size": "0x000001a4",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5d46c",
            "size": "0x00000136",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5d5a4",
            "size": "0x000001c0",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5d764",
            "size": "0x000001a2",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5d908",
            "size": "0x000001c2",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5dacc",
            "size": "0x000001d0",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5dc9c",
            "size": "0x0000018e",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.51"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5de2c",
            "size": "0x00000540",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.87"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5e36c",
            "size": "0x0000061c",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.78"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5e988",
            "size": "0x00000232",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.87"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5ebbc",
            "size": "0x000004e8",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.61"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5f0a4",
            "size": "0x0000053c",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5f5e0",
            "size": "0x000005a2",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.39"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e5fb84",
            "size": "0x0000064e",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.92"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e601d4",
            "size": "0x000004c8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e6069c",
            "size": "0x00000542",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e60be0",
            "size": "0x000005ee",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e611d0",
            "size": "0x000003f4",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.01"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e615c4",
            "size": "0x000004da",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e61aa0",
            "size": "0x00000528",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e61fc8",
            "size": "0x000002f6",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "5.11"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e622c0",
            "size": "0x000002e2",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e625a4",
            "size": "0x0000059c",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e62b40",
            "size": "0x00000532",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e63074",
            "size": "0x0000058a",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.57"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e63600",
            "size": "0x00000544",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e63b44",
            "size": "0x00000540",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e64084",
            "size": "0x00000574",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.88"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e645f8",
            "size": "0x00000558",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.47"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e64b50",
            "size": "0x00000548",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e65098",
            "size": "0x000004e0",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.39"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e65578",
            "size": "0x00000490",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.03"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e65a08",
            "size": "0x000004fe",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e65f08",
            "size": "0x00000524",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.94"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e6642c",
            "size": "0x000005ae",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e669dc",
            "size": "0x000004c4",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e66ea0",
            "size": "0x0000053c",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.57"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e673dc",
            "size": "0x000004f2",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e678d0",
            "size": "0x000001ea",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e67abc",
            "size": "0x000004d8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e67f94",
            "size": "0x000005c2",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e68558",
            "size": "0x0000056a",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e68ac4",
            "size": "0x000005aa",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e69070",
            "size": "0x000005e4",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e69654",
            "size": "0x00000572",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.45"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e69bc8",
            "size": "0x000007e6",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.84"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e6a3b0",
            "size": "0x0000098a",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.72"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e6ad3c",
            "size": "0x00000330",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "6.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e6b06c",
            "size": "0x000008e4",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e6b950",
            "size": "0x0000093c",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e6c28c",
            "size": "0x00000a18",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e6cca4",
            "size": "0x00000b4e",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.87"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e6d7f4",
            "size": "0x000008aa",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e6e0a0",
            "size": "0x0000091c",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e6e9bc",
            "size": "0x00000a0a",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e6f3c8",
            "size": "0x000006ca",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.84"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e6fa94",
            "size": "0x000008b4",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.45"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e70348",
            "size": "0x00000a46",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e70d90",
            "size": "0x0000050a",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "5.08"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7129c",
            "size": "0x0000047c",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.47"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e71718",
            "size": "0x00000a58",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.20"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e72170",
            "size": "0x0000091a",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e72a8c",
            "size": "0x00000998",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.54"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e73424",
            "size": "0x000009f8",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e73e1c",
            "size": "0x00000a4e",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7486c",
            "size": "0x00000944",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.80"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e751b0",
            "size": "0x0000093e",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e75af0",
            "size": "0x000008ea",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.51"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e763dc",
            "size": "0x0000089e",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e76c7c",
            "size": "0x000007e4",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.92"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e77460",
            "size": "0x000008c0",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.54"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e77d20",
            "size": "0x000008c4",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.85"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e785e4",
            "size": "0x0000090e",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e78ef4",
            "size": "0x000008e2",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e797d8",
            "size": "0x000008e6",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.49"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7a0c0",
            "size": "0x000008a2",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.50"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7a964",
            "size": "0x00000308",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "6.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7ac6c",
            "size": "0x000008ae",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7b51c",
            "size": "0x000009c2",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7bee0",
            "size": "0x000009d0",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7c8b0",
            "size": "0x000009fa",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7d2ac",
            "size": "0x00000ac8",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7dd74",
            "size": "0x00000942",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7e6b8",
            "size": "0x00000166",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.76"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7e820",
            "size": "0x00000180",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.73"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7e9a0",
            "size": "0x000000b8",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.18"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7ea58",
            "size": "0x00000182",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7ebdc",
            "size": "0x00000186",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.11"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7ed64",
            "size": "0x00000192",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.17"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7eef8",
            "size": "0x00000212",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.76"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7f10c",
            "size": "0x0000015a",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.12"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7f268",
            "size": "0x0000019a",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7f404",
            "size": "0x0000018e",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7f594",
            "size": "0x0000013c",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.76"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7f6d0",
            "size": "0x00000158",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7f828",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.06"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7f99c",
            "size": "0x000000ea",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7fa88",
            "size": "0x000000d2",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "4.60"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7fb5c",
            "size": "0x000001b2",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.10"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7fd10",
            "size": "0x0000016c",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.13"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7fe7c",
            "size": "0x00000162",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e7ffe0",
            "size": "0x000001a4",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.08"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e80184",
            "size": "0x00000188",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.17"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8030c",
            "size": "0x00000178",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.73"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e80484",
            "size": "0x00000196",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8061c",
            "size": "0x00000164",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e80780",
            "size": "0x0000017c",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.17"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e808fc",
            "size": "0x00000180",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.92"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e80a7c",
            "size": "0x0000019a",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e80c18",
            "size": "0x00000164",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.79"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e80d7c",
            "size": "0x00000162",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e80ee0",
            "size": "0x0000016e",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e81050",
            "size": "0x0000018c",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e811dc",
            "size": "0x0000017e",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8135c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "4.94"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e81408",
            "size": "0x000001c4",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.04"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e815cc",
            "size": "0x00000188",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.05"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e81754",
            "size": "0x000001c2",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.03"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e81918",
            "size": "0x00000174",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.08"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e81a8c",
            "size": "0x000001aa",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e81c38",
            "size": "0x00000616",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.74"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e82250",
            "size": "0x00000736",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.72"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e82988",
            "size": "0x00000264",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "6.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e82bec",
            "size": "0x0000069e",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.63"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8328c",
            "size": "0x00000612",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e838a0",
            "size": "0x0000084a",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e840ec",
            "size": "0x0000086c",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.81"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e84958",
            "size": "0x000005ce",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e84f28",
            "size": "0x00000672",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8559c",
            "size": "0x00000806",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e85da4",
            "size": "0x00000530",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.79"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e862d4",
            "size": "0x0000076a",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e86a40",
            "size": "0x00000728",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e87168",
            "size": "0x00000358",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "5.44"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e874c0",
            "size": "0x00000356",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e87818",
            "size": "0x000006f2",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e87f0c",
            "size": "0x00000634",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e88540",
            "size": "0x0000075a",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.59"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e88c9c",
            "size": "0x00000728",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e893c4",
            "size": "0x00000758",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e89b1c",
            "size": "0x0000075a",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.75"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8a278",
            "size": "0x00000700",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8a978",
            "size": "0x00000696",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.58"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8b010",
            "size": "0x00000692",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8b6a4",
            "size": "0x0000068a",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.89"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8bd30",
            "size": "0x000006bc",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8c3ec",
            "size": "0x0000076e",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.81"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8cb5c",
            "size": "0x0000074e",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8d2ac",
            "size": "0x0000063c",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8d8e8",
            "size": "0x00000644",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8df2c",
            "size": "0x00000708",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.44"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8e634",
            "size": "0x0000023e",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "6.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8e874",
            "size": "0x000005d4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8ee48",
            "size": "0x000007ce",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8f618",
            "size": "0x000007d0",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e8fde8",
            "size": "0x000007f8",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.20"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e905e0",
            "size": "0x0000080c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e90dec",
            "size": "0x00000718",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e91504",
            "size": "0x000002d4",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.68"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e917d8",
            "size": "0x000003c2",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.63"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e91b9c",
            "size": "0x00000126",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.85"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e91cc4",
            "size": "0x00000342",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.54"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e92008",
            "size": "0x00000322",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9232c",
            "size": "0x000003ca",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e926f8",
            "size": "0x00000408",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.74"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e92b00",
            "size": "0x0000032c",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e92e2c",
            "size": "0x0000030c",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e93138",
            "size": "0x000003ec",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e93524",
            "size": "0x00000298",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.69"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e937bc",
            "size": "0x000003ae",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e93b6c",
            "size": "0x000003ee",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e93f5c",
            "size": "0x000001a4",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "5.05"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e94100",
            "size": "0x0000019e",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e942a0",
            "size": "0x00000378",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e94618",
            "size": "0x00000342",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.15"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9495c",
            "size": "0x000003c6",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e94d24",
            "size": "0x000003ea",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e95110",
            "size": "0x000003ba",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e954cc",
            "size": "0x000003a0",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.74"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9586c",
            "size": "0x0000033a",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e95ba8",
            "size": "0x00000354",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e95efc",
            "size": "0x00000342",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e96240",
            "size": "0x00000302",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.86"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e96544",
            "size": "0x0000036e",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e968b4",
            "size": "0x00000388",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.75"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e96c3c",
            "size": "0x0000036e",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e96fac",
            "size": "0x0000032a",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.17"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e972d8",
            "size": "0x00000344",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9761c",
            "size": "0x00000352",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e97970",
            "size": "0x00000126",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.91"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e97a98",
            "size": "0x00000328",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.18"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e97dc0",
            "size": "0x000003dc",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9819c",
            "size": "0x000003dc",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e98578",
            "size": "0x000003d6",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e98950",
            "size": "0x000003ee",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.18"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e98d40",
            "size": "0x000003a8",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e990e8",
            "size": "0x000002b2",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.72"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9939c",
            "size": "0x00000398",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.72"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e99734",
            "size": "0x00000156",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "5.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9988c",
            "size": "0x00000342",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.45"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e99bd0",
            "size": "0x00000348",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e99f18",
            "size": "0x000003c6",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9a2e0",
            "size": "0x0000040c",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.83"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9a6ec",
            "size": "0x000002cc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9a9b8",
            "size": "0x0000032e",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.10"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9ace8",
            "size": "0x000003ea",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.20"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9b0d4",
            "size": "0x0000030c",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.75"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9b3e0",
            "size": "0x0000031a",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9b6fc",
            "size": "0x0000037e",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.10"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9ba7c",
            "size": "0x000001ec",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.61"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9bc68",
            "size": "0x00000194",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "4.95"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9bdfc",
            "size": "0x00000382",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.09"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9c180",
            "size": "0x00000340",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.13"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9c4c0",
            "size": "0x0000038e",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9c850",
            "size": "0x0000036e",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9cbc0",
            "size": "0x000003b0",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9cf70",
            "size": "0x00000390",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.80"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9d300",
            "size": "0x00000340",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9d640",
            "size": "0x00000312",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9d954",
            "size": "0x0000032c",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.15"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9dc80",
            "size": "0x000002ac",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.95"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9df2c",
            "size": "0x0000031e",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9e24c",
            "size": "0x00000334",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.82"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9e580",
            "size": "0x0000036a",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9e8ec",
            "size": "0x00000322",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9ec10",
            "size": "0x0000032a",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9ef3c",
            "size": "0x00000312",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.32"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9f250",
            "size": "0x0000014e",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "5.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9f3a0",
            "size": "0x000002e8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.13"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9f688",
            "size": "0x000003b6",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.13"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9fa40",
            "size": "0x0000037e",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00e9fdc0",
            "size": "0x000003b8",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.11"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea0178",
            "size": "0x000003bc",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea0534",
            "size": "0x000003b0",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea08e4",
            "size": "0x00000682",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.90"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea0f68",
            "size": "0x0000084c",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.76"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea17b4",
            "size": "0x000002c2",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "6.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea1a78",
            "size": "0x00000748",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea21c0",
            "size": "0x00000792",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea2954",
            "size": "0x000008e0",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea3234",
            "size": "0x000008ec",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.87"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea3b20",
            "size": "0x00000708",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea4228",
            "size": "0x000007c8",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea49f0",
            "size": "0x0000094a",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea533c",
            "size": "0x00000642",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.93"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea5980",
            "size": "0x00000830",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea61b0",
            "size": "0x000008dc",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.18"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea6a8c",
            "size": "0x0000048c",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "5.13"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea6f18",
            "size": "0x00000410",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea7328",
            "size": "0x0000084a",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea7b74",
            "size": "0x000007ea",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea8360",
            "size": "0x000007d6",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.49"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea8b38",
            "size": "0x000007f2",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea932c",
            "size": "0x00000870",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.38"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ea9b9c",
            "size": "0x00000816",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.82"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eaa3b4",
            "size": "0x000007ec",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eaaba0",
            "size": "0x00000772",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.51"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eab314",
            "size": "0x00000734",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eaba48",
            "size": "0x000006c8",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.03"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eac110",
            "size": "0x000007c0",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.49"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eac8d0",
            "size": "0x0000077a",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.89"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ead04c",
            "size": "0x000007a4",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ead7f0",
            "size": "0x00000776",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eadf68",
            "size": "0x00000794",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.45"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eae6fc",
            "size": "0x0000076e",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eaee6c",
            "size": "0x000002c8",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "6.04"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eaf134",
            "size": "0x0000070a",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eaf840",
            "size": "0x00000854",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb0094",
            "size": "0x00000826",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb08bc",
            "size": "0x000008a8",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.20"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb1164",
            "size": "0x0000093e",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb1aa4",
            "size": "0x00000832",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb22d8",
            "size": "0x000004a0",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.75"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb2778",
            "size": "0x0000062c",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.71"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb2da4",
            "size": "0x00000226",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "6.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb2fcc",
            "size": "0x00000576",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.61"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb3544",
            "size": "0x00000558",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb3a9c",
            "size": "0x0000069a",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb4138",
            "size": "0x000006d6",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.78"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb4810",
            "size": "0x0000050e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb4d20",
            "size": "0x000005d2",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.17"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb52f4",
            "size": "0x000006f8",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb59ec",
            "size": "0x0000044e",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.75"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb5e3c",
            "size": "0x000005e2",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb6420",
            "size": "0x00000616",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.20"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb6a38",
            "size": "0x000002ae",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "5.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb6ce8",
            "size": "0x000002e4",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "5.44"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb6fcc",
            "size": "0x000005e0",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb75ac",
            "size": "0x00000500",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb7aac",
            "size": "0x000005e6",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.54"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb8094",
            "size": "0x00000570",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb8604",
            "size": "0x0000063e",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.39"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb8c44",
            "size": "0x000005e0",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.74"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb9224",
            "size": "0x00000586",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb97ac",
            "size": "0x000005a8",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eb9d54",
            "size": "0x00000524",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eba278",
            "size": "0x000005a6",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.83"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00eba820",
            "size": "0x000005ae",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebadd0",
            "size": "0x000005be",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.77"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebb390",
            "size": "0x00000614",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.35"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebb9a4",
            "size": "0x0000056c",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebbf10",
            "size": "0x00000562",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.47"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebc474",
            "size": "0x0000057c",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebc9f0",
            "size": "0x0000020c",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "6.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebcbfc",
            "size": "0x00000672",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebd270",
            "size": "0x000005fc",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebd86c",
            "size": "0x000005e6",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebde54",
            "size": "0x000006f2",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebe548",
            "size": "0x000005a8",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebeaf0",
            "size": "0x0000012c",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.50"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebec1c",
            "size": "0x000001a4",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.65"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebedc0",
            "size": "0x000000ae",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "4.54"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebee70",
            "size": "0x00000180",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebeff0",
            "size": "0x00000154",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebf144",
            "size": "0x000001ba",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.07"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebf300",
            "size": "0x000001d0",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.74"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebf4d0",
            "size": "0x00000166",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.02"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebf638",
            "size": "0x000001d6",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.02"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebf810",
            "size": "0x000001c2",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.10"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebf9d4",
            "size": "0x00000156",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebfb2c",
            "size": "0x00000194",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.20"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebfcc0",
            "size": "0x00000190",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.02"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebfe50",
            "size": "0x0000010e",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.18"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ebff60",
            "size": "0x000000da",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "4.61"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec003c",
            "size": "0x00000184",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.01"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec01c0",
            "size": "0x0000015c",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.01"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec031c",
            "size": "0x00000176",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec0494",
            "size": "0x0000015c",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.99"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec05f0",
            "size": "0x000001ae",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec07a0",
            "size": "0x00000172",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.75"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec0914",
            "size": "0x0000015e",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec0a74",
            "size": "0x00000178",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec0bec",
            "size": "0x0000016c",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.04"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec0d58",
            "size": "0x00000170",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.66"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec0ec8",
            "size": "0x0000017a",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec1044",
            "size": "0x0000015a",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.73"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec11a0",
            "size": "0x0000016a",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.17"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec130c",
            "size": "0x00000184",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.04"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec1490",
            "size": "0x00000172",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec1604",
            "size": "0x00000194",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec1798",
            "size": "0x000000a8",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "4.46"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec1840",
            "size": "0x00000170",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.99"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec19b0",
            "size": "0x0000017e",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.05"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec1b30",
            "size": "0x0000017c",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "2.98"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec1cac",
            "size": "0x000001e6",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.09"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec1e94",
            "size": "0x0000017e",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2014",
            "size": "0x0000002c",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "1.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2040",
            "size": "0x00000042",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.47"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2084",
            "size": "0x00000024",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "0.90"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec20a8",
            "size": "0x0000002c",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.33"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec20d4",
            "size": "0x0000002c",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "0.99"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2100",
            "size": "0x0000002c",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "1.03"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec212c",
            "size": "0x0000002e",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.71"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec215c",
            "size": "0x00000030",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "1.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec218c",
            "size": "0x0000002e",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec21bc",
            "size": "0x00000036",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "1.45"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec21f4",
            "size": "0x0000002e",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.71"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2224",
            "size": "0x0000002e",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2254",
            "size": "0x0000002a",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "0.91"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2280",
            "size": "0x00000028",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec22a8",
            "size": "0x00000026",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "1.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec22d0",
            "size": "0x00000032",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "1.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2304",
            "size": "0x00000032",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "1.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2338",
            "size": "0x0000002c",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.18"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2364",
            "size": "0x00000032",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "1.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2398",
            "size": "0x0000002e",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "1.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec23c8",
            "size": "0x0000003c",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "2.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2404",
            "size": "0x0000002a",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "0.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2430",
            "size": "0x0000002e",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2460",
            "size": "0x0000002e",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "1.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2490",
            "size": "0x00000036",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.13"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec24c8",
            "size": "0x0000003e",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.61"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2508",
            "size": "0x0000002e",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.71"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2538",
            "size": "0x0000002a",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "0.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2564",
            "size": "0x00000032",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2598",
            "size": "0x00000034",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.53"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec25cc",
            "size": "0x00000028",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "0.83"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec25f4",
            "size": "0x00000024",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "0.90"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2618",
            "size": "0x00000030",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "1.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2648",
            "size": "0x00000032",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "1.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec267c",
            "size": "0x00000030",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "1.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec26ac",
            "size": "0x00000036",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "1.45"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec26e4",
            "size": "0x00000026",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "0.70"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec270c",
            "size": "0x0000005c",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "2.94"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2768",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.67"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec27b8",
            "size": "0x00000044",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "2.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec27fc",
            "size": "0x0000005e",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.56"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec285c",
            "size": "0x00000048",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec28a4",
            "size": "0x0000007e",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "2.57"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2924",
            "size": "0x00000056",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.95"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec297c",
            "size": "0x00000056",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec29d4",
            "size": "0x0000005c",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2a30",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2a80",
            "size": "0x00000052",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.76"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2ad4",
            "size": "0x0000007a",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.69"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2b50",
            "size": "0x0000004a",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.11"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2b9c",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.14"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2bec",
            "size": "0x00000050",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.00"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2c3c",
            "size": "0x0000004c",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "2.18"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2c88",
            "size": "0x0000004a",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.15"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2cd4",
            "size": "0x0000004c",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.30"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2d20",
            "size": "0x00000052",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2d74",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "2.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2dc4",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "2.71"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2e14",
            "size": "0x00000050",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2e64",
            "size": "0x00000054",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.31"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2eb8",
            "size": "0x00000048",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.11"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2f00",
            "size": "0x00000050",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.80"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2f50",
            "size": "0x00000078",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.67"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec2fc8",
            "size": "0x00000052",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.84"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec301c",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.37"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec306c",
            "size": "0x00000050",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec30bc",
            "size": "0x00000062",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.68"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3120",
            "size": "0x00000058",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.34"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3178",
            "size": "0x00000044",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "2.36"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec31bc",
            "size": "0x0000004a",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.11"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3208",
            "size": "0x0000004a",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "2.08"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3254",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "2.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec32a4",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec32f4",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3344",
            "size": "0x00000092",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.50"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec33d8",
            "size": "0x0000007e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.06"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3458",
            "size": "0x0000008e",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.07"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec34e8",
            "size": "0x00000076",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.22"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3560",
            "size": "0x00000092",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.08"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec35f4",
            "size": "0x0000007e",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3674",
            "size": "0x00000110",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.52"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3784",
            "size": "0x000000cc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.16"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3850",
            "size": "0x000000c0",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.28"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3910",
            "size": "0x000000e4",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec39f4",
            "size": "0x000000d8",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.18"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3acc",
            "size": "0x000000f4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3bc0",
            "size": "0x00000044",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "2.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3c04",
            "size": "0x00000064",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.98"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3c68",
            "size": "0x0000003e",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "2.24"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3ca8",
            "size": "0x00000048",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.04"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3cf0",
            "size": "0x0000004e",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.06"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3d40",
            "size": "0x00000054",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.82"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3d94",
            "size": "0x00000040",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "1.89"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3dd4",
            "size": "0x00000048",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.95"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3e1c",
            "size": "0x00000054",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "2.15"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3e70",
            "size": "0x0000005e",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.01"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3ed0",
            "size": "0x00000046",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.11"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3f18",
            "size": "0x00000056",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "2.19"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3f70",
            "size": "0x00000042",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3fb4",
            "size": "0x00000044",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "2.59"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec3ff8",
            "size": "0x00000066",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "2.40"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec4060",
            "size": "0x0000005a",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.29"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec40bc",
            "size": "0x00000050",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "2.13"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec410c",
            "size": "0x00000048",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "2.04"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec4154",
            "size": "0x0000005c",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "2.97"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec41b0",
            "size": "0x00000072",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.50"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec4224",
            "size": "0x0000005a",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec4280",
            "size": "0x00000066",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "2.42"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec42e8",
            "size": "0x00000044",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec432c",
            "size": "0x00000046",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.96"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec4374",
            "size": "0x0000005c",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.97"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec43d0",
            "size": "0x00000064",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.41"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec4434",
            "size": "0x00000056",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.23"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec448c",
            "size": "0x0000004c",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "2.26"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec44d8",
            "size": "0x00000048",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "2.25"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec4520",
            "size": "0x0000003e",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "2.27"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec4560",
            "size": "0x0000006a",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "2.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec45cc",
            "size": "0x00000054",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "2.21"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec4620",
            "size": "0x0000006a",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "2.43"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec468c",
            "size": "0x0000006c",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "2.48"
          },
          {
            "name": "RT_STRING",
            "offset": "0x00ec46f8",
            "size": "0x0000005c",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "2.24"
          },
          {
            "name": "RT_RCDATA",
            "offset": "0x00ec4754",
            "size": "0x0000ded0",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "5.13"
          },
          {
            "name": "RT_RCDATA",
            "offset": "0x00ed2624",
            "size": "0x00003273",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.47"
          },
          {
            "name": "RT_GROUP_ICON",
            "offset": "0x00ed5898",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.08"
          },
          {
            "name": "RT_GROUP_ICON",
            "offset": "0x00ed5954",
            "size": "0x000000bc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.16"
          },
          {
            "name": "RT_GROUP_ICON",
            "offset": "0x00ed5a10",
            "size": "0x00000014",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.08"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed5a24",
            "size": "0x000003a8",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "3.59"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed5dcc",
            "size": "0x000003d4",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.87"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed61a0",
            "size": "0x000003a4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "3.59"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed6544",
            "size": "0x000003b4",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.58"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed68f8",
            "size": "0x000003c4",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.53"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed6cbc",
            "size": "0x000003ac",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "3.54"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed7068",
            "size": "0x000003e4",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "4.03"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed744c",
            "size": "0x000003b0",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.51"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed77fc",
            "size": "0x000003c4",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed7bc0",
            "size": "0x000003cc",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "3.55"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed7f8c",
            "size": "0x000003c4",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.73"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed8350",
            "size": "0x000003b4",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed8704",
            "size": "0x000003c8",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "3.51"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed8acc",
            "size": "0x000003a8",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.60"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed8e74",
            "size": "0x000003ac",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "3.62"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed9220",
            "size": "0x000003b4",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "3.55"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed95d4",
            "size": "0x000003bc",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "3.52"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed9990",
            "size": "0x000003d0",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.54"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ed9d60",
            "size": "0x000003d0",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "3.51"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00eda130",
            "size": "0x000003c0",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "3.51"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00eda4f0",
            "size": "0x000003cc",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "3.95"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00eda8bc",
            "size": "0x000003dc",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00edac98",
            "size": "0x000003c8",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.56"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00edb060",
            "size": "0x000003c0",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "3.53"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00edb420",
            "size": "0x00000398",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.81"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00edb7b8",
            "size": "0x000003ac",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.57"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00edbb64",
            "size": "0x000003f8",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.92"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00edbf5c",
            "size": "0x000003d4",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.53"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00edc330",
            "size": "0x000003c4",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.55"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00edc6f4",
            "size": "0x000003bc",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "3.59"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00edcab0",
            "size": "0x000003bc",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "3.60"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00edce6c",
            "size": "0x000003a4",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "3.60"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00edd210",
            "size": "0x000003e4",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "3.52"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00edd5f4",
            "size": "0x000003d0",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "3.52"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00edd9c4",
            "size": "0x000003e4",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "3.52"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00eddda8",
            "size": "0x000003e4",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "3.54"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00ede18c",
            "size": "0x000003c4",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "3.55"
          },
          {
            "name": "None",
            "offset": "0x00ede550",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00ede5fc",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ede6a8",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00ede754",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ede800",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ede8ac",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ede958",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edea04",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edeab0",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edeb5c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edec08",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00edecb4",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00eded60",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edee0c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edeeb8",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00edef64",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edf010",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edf0bc",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edf168",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edf214",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edf2c0",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00edf36c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edf418",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00edf4c4",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edf570",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edf61c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edf6c8",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00edf774",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edf820",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edf8cc",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00edf978",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edfa24",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edfad0",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edfb7c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edfc28",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edfcd4",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edfd80",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edfe2c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edfed8",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00edff84",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee0030",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00ee00dc",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee0188",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00ee0234",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00ee02e0",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee038c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee0438",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee04e4",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee0590",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00ee063c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee06e8",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee0794",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00ee0840",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00ee08ec",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee0998",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee0a44",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee0af0",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee0b9c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee0c48",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee0cf4",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee0da0",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee0e4c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee0ef8",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee0fa4",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee1050",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee10fc",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee11a8",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee1254",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee1300",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee13ac",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee1458",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee1504",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee15b0",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee165c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee1708",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee17b4",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00ee1860",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee190c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee19b8",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee1a64",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00ee1b10",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00ee1bbc",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00ee1c68",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee1d14",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee1dc0",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee1e6c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "1.66"
          },
          {
            "name": "None",
            "offset": "0x00ee1f18",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee1fc4",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ARABIC",
            "sublanguage": "SUBLANG_ARABIC_SAUDI_ARABIA",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee2070",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_BULGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee211c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_TRADITIONAL",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee21c8",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_CZECH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee2274",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_DANISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee2320",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_GERMAN",
            "sublanguage": "SUBLANG_GERMAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee23cc",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_GREEK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee2478",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee2524",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_FINNISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee25d0",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee267c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_HEBREW",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee2728",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_HUNGARIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee27d4",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ITALIAN",
            "sublanguage": "SUBLANG_ITALIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee2880",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_JAPANESE",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee292c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_KOREAN",
            "sublanguage": "SUBLANG_KOREAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee29d8",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_DUTCH",
            "sublanguage": "SUBLANG_DUTCH",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee2a84",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_NORWEGIAN",
            "sublanguage": "SUBLANG_NORWEGIAN_BOKMAL",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee2b30",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_POLISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee2bdc",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE_BRAZILIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee2c88",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ROMANIAN",
            "sublanguage": "SUBLANG_ROMANIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee2d34",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_RUSSIAN",
            "sublanguage": "SUBLANG_RUSSIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee2de0",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee2e8c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SLOVAK",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee2f38",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SWEDISH",
            "sublanguage": "SUBLANG_SWEDISH",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee2fe4",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_THAI",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee3090",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_TURKISH",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee313c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_UKRAINIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee31e8",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SLOVENIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee3294",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ESTONIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee3340",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_LATVIAN",
            "sublanguage": "SUBLANG_DEFAULT",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee33ec",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_LITHUANIAN",
            "sublanguage": "SUBLANG_LITHUANIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee3498",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_CHINESE",
            "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee3544",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_UK",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee35f0",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MEXICAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee369c",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_PORTUGUESE",
            "sublanguage": "SUBLANG_PORTUGUESE",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee3748",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SPANISH",
            "sublanguage": "SUBLANG_SPANISH_MODERN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee37f4",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_FRENCH",
            "sublanguage": "SUBLANG_FRENCH_CANADIAN",
            "entropy": "1.67"
          },
          {
            "name": "None",
            "offset": "0x00ee38a0",
            "size": "0x000000aa",
            "filetype": null,
            "language": "LANG_SERBIAN",
            "sublanguage": "SUBLANG_ARABIC_YEMEN",
            "entropy": "1.67"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "إعداد Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0401 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Инсталираща програма на Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Всички права запазени."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Операционна система Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0402 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 安裝程式"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0404 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Instalace Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Všechna práva vyhrazena."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Operační systém Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0405 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 Installation"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Alle rettigheder forbeholdes."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operativsystem"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0406 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 Setup"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Alle Rechte vorbehalten."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Betriebssystem Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0407 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Εγκατάσταση των Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Με επιφύλαξη κάθε νόμιμου δικαιώματος."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Λειτουργικό σύστημα Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0408 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 Setup"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10:n asennus"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Kaikki oikeudet pidätetään."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® -käyttöjärjestelmä"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x040b 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Installation de Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Tous droits réservés."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Système d’exploitation Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x040c 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "‏‏‎‎תוכנית ההתקנה של Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x040d 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 telepítő"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Minden jog fenntartva."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® operációs rendszer"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x040e 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Installazione di Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Tutti i diritti riservati."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Sistema operativo Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0410 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 セットアップ"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0411 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 설치 프로그램"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0412 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 Setup"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Alle rechten voorbehouden."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows®-besturingssysteem"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0413 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Installasjonsprogram for Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Med enerett."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Operativsystemet Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0414 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Instalator systemu Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Wszelkie prawa zastrzeżone."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "System operacyjny Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0415 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Instalação do Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Todos os direitos reservados."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Sistema Operacional Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0416 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Instalare Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Toate drepturile rezervate."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Sistem de operare Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0418 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Программа установки Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Корпорация Майкрософт. Все права защищены."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Операционная система Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0419 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Program za instalaciju sustava Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Sva prava pridržana."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Operacijski sustav Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x041a 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Inštalátor systému Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Všetky práva vyhradené."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x041b 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Installationsprogram för Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Med ensamrätt."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Operativsystemet Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x041d 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "ตั้งค่า Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation สงวนลิขสิทธิ์"
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "ระบบปฏิบัติการ Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x041e 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 Kurulumu"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Tüm hakları saklıdır."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® İşletim Sistemi"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x041f 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Програма інсталяції Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Корпорація Майкрософт (Microsoft Corporation). Усі права захищені."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Операційна система Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0422 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Namestitveni program za Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Vse pravice pridržane."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Operacijski sistem Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0424 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 installiprogramm"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Kõik õigused kaitstud."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Operatsioonisüsteem Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0425 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 uzstādīšana"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Visas tiesības paturētas."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Operētājsistēma Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0426 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "„Windows 10“ sąranka"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© „Microsoft Corporation“. Visos teisės ginamos."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Operacinė sistema „Microsoft® Windows®“"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0427 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows 10 安装程序"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0804 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Programa de instalación de Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Todos los derechos reservados."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Sistema operativo Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x080a 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Configuração do Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Todos os direitos reservados."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Sistema operativo Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0816 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Programa de instalación de Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Todos los derechos reservados."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Sistema operativo Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0c0a 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Programme d'installation de Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Tous droits réservés."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Système d’exploitation Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0c0c 0x04b0"
          },
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Instalacija izdanja Windows 10"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. Sva prava zadržana."
          },
          {
            "name": "OriginalFilename",
            "value": "MediaSetupUIMgr.dll"
          },
          {
            "name": "ProductName",
            "value": "Operativni sistem Microsoft® Windows®"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x241a 0x04b0"
          }
        ],
        "imphash": "e8a41baf993bbf46785c65d4d773c84a",
        "timestamp": "2041-08-16 04:45:33",
        "icon": "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAHWUlEQVR4nO2YWWwdVxnHf+fMzF1tX+9xYqfOWieOs7goTVpKKTRKA6qgEAgg9QGE1IJ4QEjwgEBVQJHgDd7KS5/Y1JKoKUFUKk1YwhZKA01j4pSgJk0c3zhNvNxt7sxZeLj32jderh3HYZH8l0ajq/HM+f3Pd77vfMewrGXdkcR/cjClVGU8UXXZqgvXde3tfFMuJeBcUkoJpZQEHCACRMtX5KkffTG19Vv9KxbLctcjUAaXgAt4vzr3avzrL35z85XRK525Yr6jsalttVvvxZ0xdfDCocFrtxsB965QM7lcRHkM79iZX6S+cfSZnZfGh3Z3PrTlPTv6PrK2Y013R/qdi5dO/eDosace+GyGqSW1YN2VCJThK7Me3f3dh3a+MXT2ka599z+y64Pv22liNtrlrlSv/vAnR66cPv+znhU9fz35tV8PAfp2I7DkBqbBx3sPbvvARCzc1/e5xz6ZaK1rinoea1gd/PK5517I/evG4QuHBk8ARUAB9n9hCVWWTWzLwe17/DY+9uDnP3MgiBdcZRT9Yqt+4dnv/1ikiy9dODT4WyAE9GLgYYmrUHn2HSCy7dv3vd9fIZ547xeePODH867RPuvcbv5w6pXfi3Tx5TPPnP4d4JcNmMXAwxIaqFo63p7v7ds2osce3fX0J/ZPREZdUKz0ulFhfmjg8Imf/vxLL55cCnhY2ggIwAMSg+nzO/q//NH9oadixoRoAe10cPzZ51/etfb+gTUt3VmWAL4y6Jx6/cyZMaVNSmk9y9PSuLY8vBAgpeTc9UFOqFOEH+7gph3GxSMiEnQHLaSOZNm7fi/KaLQxWAvWWrBgqfqNQEqBHwSkb9wYevpTB7rmYqyZxEWlUtb1ePPsmwR+sUQrxCS1rdyxuI6LF4nwm6vH8b7aQ54MHlEytsBK0c7bJwbovdHJXyZOEyqFVgZjbfkbt8LH43GaWppJNqS4OjSUqsVY04DSmn8MDHD0rY2zPhcChJA4nqQuHsGLTnAh1cp9TophO4JAcN2Oso5NXB7uIFj1JFecNnxlMAassVhrMMZijMEajTEGozV63PBg+EeK+XwtxPlzQCs18yUBUoLnusRiLnXxCA3JKHnzNo27GxhnHM96jOssaXWDKBGcCUOqrpmIA54UeNIihQEsTIfXpXtjfR3SrV3paz4VgBSzeBQl+GjUJR5xSCYipOqiXB15l7beFBmuEaiAa2qUTJijGA2I4pCKRXAxSCyBAmEFRmusnQlvtCIWjSIdZ/EGJl1U/xQgpQNOnpHCWUYnBvE8F8+RuK5kk7eDN8LLZMIco8VRtAoICfCV5shr38FYizYWYywdqe20JPsRtg47DV4rjRBiMs8Wb2C6HyFxXMl4eB65d4Q9ux+gmQQxPASSi1yEQDHmj5MvZsAPeD32N9Z8pYvAL1Io+gS+TxAEvPXaTdanJe3J3TPgjdZY7NIaEFIiHYmUDu112xk/KRisv0Rsi+JdP02DiSM0hIFPpjCGKgRQDDn/zz9z3tdQVBCGOM1rWXdlMz3XHqY52YdSM+FVqKqOOXOrZhJbqup8Bd5xkI5DJJKiI9WPc7wNddGjIdZMNshhghC/WCCfz2JzBcgWIRtAzod8AKl7WD98L73DD9Oe3IqwSbTW6GnwKgzLY9d2UNtAeQYq8I7j4Lgu0nWx0iHitbKisZ9rz9/EvBPFTSTJ5ifw8xmKmSzkgpKBfAi+hlQn3SMbaBpop62uD0EjKtRoNRNehyEWOzWDizFQ8m9vgXe8kgEhHTQOkUgnO1Z/mvHDOcxQBD/mkcmOYbJ+adb9AAoB1HfSNbaBjsFOtqzaD6YVP1CEYYiaBV6FIVg7H/98BkpJVA1fuQvXBemgrCAW66av8+P4L4G+HmPCjaNyBcirUhQaVrIidw+dg91saX8CR3RQCBRhMDe8DlXV7rxIA5UPTIev3HEcrJCEBhLxjfR2PE7klQSpfAu6vrU0+w0raSp0s+bcRja3PY4jOyn4Jdha8KUN1M57vqxZhay1WOys8KVkliAkGkFRGerjvWxq1+g/HSOzbYJ0XZ561cWGwR42tX6IiNNNvlBaNmFYG14rhUXOa2GeMlrqFOeCl1KCFBgLaCgaTUO8l41NRcLTmsKqkPWXe7i35TGi7noKvl4wvNGahZzx54lA6fVa8BWf2loMBqMtqdg2+lrraBn5O+2tfcScLgq+JgiCBcMbYya/vfgIlF+eD97aqa5SWwNW48ouVjeuQmlDwQ9RSt02/HwVaF4DlQqwEHhb1RJbY27pbbRW8ybsjJmvSNT+x0ntCAiIJ5JIvXD42brK2TaphcA7Ut7ZRiaFoLm1+b8CXxnfmDtIYj8MiSeSPNpwivpEgojnTRmoOgaWkr3Ud1QmrFKCbbmhstXPytUN62BxYNq7Ukq01lzPZCnkcos3MJwezqXT6WQhl8f1PISQ5TVZDV85lNvyGRewZsoAUz3V5N+Xd/ipuZ3ZMmil8AsFlNbFmg6WtaxlLWtZy1rWspb1/6t/Ay5Oahn19l3HAAAAAElFTkSuQmCC",
        "icon_hash": "60608a07d112ace9d7a180ee9deaa3d4",
        "icon_fuzzy": "bc85df9c7cdf2d8ba0f53a0f681e6f31",
        "icon_dhash": "6060f0d8ecfc4000",
        "imported_dll_count": 17
      },
      "data": null,
      "strings": [
        "ldre version af Windows.ZDer er ikke nok plads p",
        "2 20242L2\\2`2d2|2",
        " Microsoft Corporation. Med ensamr",
        " nytt.-Kj",
        " ne deluje. Poskusite z drugim klju",
        "Tra poco riavvier",
        "Tenemos que hacer unas cosas m",
        "rki on veel j",
        " en DVD",
        ", kuriame norite diegti ",
        " defa yeniden ba",
        "dvendige filer. S",
        "Videti je tako: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "ar-MA",
        "Guida",
        " wyst",
        "3&3/3X3h3x3",
        "ml-IN",
        "<glyf",
        "tit.6Teie BitLockeri v",
        "en. Det betyder, at du skal angive Windows 10-produktn",
        "hem instalace aktualizac",
        "CSetupResponseTemplate<class IDiskSpaceActionResponse>::OnBack",
        "i o alt",
        "CInstallUI::OpenSiteLink",
        " verzi Windows",
        "zTXTUPUP1",
        " Windows.:",
        "Esto puede tardar un poco.^Configurando la actualizaci",
        "ISO failas!Pasirinkite USB ",
        "n administra la configuraci",
        "t stikket i din pc for at sikre, at du ikke l",
        "az-Cyrl-AZ",
        "Nepavyko ",
        " un problemaOPer installare Windows 10, fai clic su Setup.exe nel supporto di installazione.",
        "Ayuda",
        "(%1!c!:) - %2!s! livres",
        "Windowsia ei ole aktivoitu t",
        "Ci sono ancora alcune operazioni da eseguire prima di procedere con l'aggiornamento. Verrai avvisato al termine, con indicazioni su come procedere. Questa finestra si chiuder",
        " stato possibile eseguire questo strumento nel tuo PC. Se il problema persiste, fai riferimento al codice di errore quando contatti il supporto tecnico.",
        "ti ei sobi Windowsi selle v",
        "; ;$;(;,;4;L;\\;`;d;|;",
        ".*Windows ",
        "ConX::Setup::Common::COSInfoHelper::GetHostOSVersion",
        "$Microsoft-Software-Lizenzbedingungen",
        "l vypadat n",
        "essayez.3Ex",
        " desc",
        "09B9+j",
        "Si Windows 10 ya se instal",
        "On-Screen &Keyboard",
        "dzenia magazynuj",
        ". Windows aktivoidaan, kun muodostat Internet-yhteyden.",
        "dis, lai p",
        "ta u postavkama da biste uklonili druge velike stavke.(Izaberite spoljni ure",
        "&Noraid",
        "Nepovedlo se naj",
        "r kan ta en stund.\\Konfigurerar uppdatering f",
        ">eeQ ",
        "Valitse k",
        "anas programma ir j",
        " disku. Potom to zkuste znovu.1P",
        "ranka internetu gaus naujinimus, tvarkykles ir pasirinktines funkcijas. ",
        " tam, kde sme skon",
        "3$303P3\\3|3",
        "YY0S0h0L0g0M0~0Y0",
        "cie %2!s!",
        "Preuzimanje ispravki",
        "marrer dans quelques instants.",
        "t, ko patur",
        "Aktuelle Version herunterladen",
        "cessaires. Assurez-vous que vous ",
        "e restartovat po",
        "s volvi",
        "s instalando Windows 10 en este equipo por primera vez, deber",
        " tilap",
        "cuter Windows 10. Fermez le programme d",
        "emo ondje gdje smo stali.2Ovo ra",
        "pertoire non pris en charge ou vous essayez d'installer une ancienne version de Windows.",
        "NotifyWinEvent",
        ",Aceast",
        "installation ",
        "0?4$A0",
        "%1!d!%% valmisSTuoteavain olikin v",
        "CSetupResponsePageBitLockerKeyValidate: OnSetActive",
        "rskendusPSalvestusruumi kasutuse avamine nurjus. Avage oma salvestusruum s",
        " za identifikatora: %Windows zahteva prostor za a",
        "anje, morate urediti spodnje stvari.ZKlju",
        "n de Windows Server 2019",
        "Udgave",
        "ams vair",
        "[[VV[VVMMOEc`",
        "iul de stocare, ",
        "HomePremiumN",
        "n y vuelve a intentarlo.+Error de instalaci",
        "er et ex",
        "<F=X=j=|=",
        "Keisti saugomus elementus",
        "es de Armazenamento",
        "za yard",
        "Preuzimanja",
        "k igen.%Windows har inte aktiverats p",
        "rsel af dette v",
        " listo para seguir instalando Windows Server 2019. Intenta reiniciar el programa de instalaci",
        "Pabeigts: %1!d!%%_",
        " ist ung",
        "jo cieto disku, lai ",
        "sok megnyit",
        "?/?G?L?^?v?",
        "[Felkod: 0x%x]8Ett ov",
        "ppp@@@@@@@@@@@@@@@@@@@@@",
        "No encontramos la informaci",
        "j*Yj4",
        "sait.IAz al",
        "o mais antiga do Windows.|A unidade que voc",
        "rama j",
        "Refresh drive list!It needs to be at least %1!d! GB.",
        "ni vr",
        "c aplikacji %1!s!.",
        "EntrambiaLa chiave BitLocker non ha funzionato. Controllala e ritenta oppure prova con una chiave diversa.*La chiave di BitLocker ",
        "Jokin est",
        " nytt, og pr",
        "m nain",
        " nytt.",
        "uvamo informacije o instalaciji potrebne za nastavak instalacije operativnog sistema Windows tamo gde ste stali. ",
        "en Sie Setup, und wiederholen Sie den Vorgang.4Fehler bei der Installation von Windows Server 2019.$Windows Server 2019 wird installiert",
        " ID dialogu$Nepovedlo se naj",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::GetState",
        "unalnik lahko izvaja sistem Windows Server 2019. Zaprite namestitveni program in poskusite znova.0Namestitev sistema Windows Server 2019 ni uspela&Name",
        "ff-Latn-SN",
        "n modul S.]Unitatea flash USB trebuie s",
        " '%c'",
        "!Windows ",
        "hem t",
        "&Fechar)Seu PC ser",
        "0W0f0K0",
        "d Product Key by m",
        "fi-FI",
        "iniz i",
        " Windows Server 2019.A",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::Deserialize",
        "$Er du sikker p",
        "rskendus operatsioonis",
        " elibera",
        "i %1!s! pe PC (Unitatea %2!c!:)ZSelecta",
        "Ilmainen Windows 10 -p",
        "g G~3",
        " ligado ",
        "bory, ktor",
        "Me ei leidnud Windowsi installimise j",
        " tego narz",
        "in bir USB anahtar",
        " chyb",
        "ar-DZ",
        " lengviau diegti ",
        "Choose what to keep",
        "at.!Jakie s",
        "Izmenljivi pogoni",
        "zzel. A Windows telep",
        "i Windows 10, nu trebuie s",
        "ibb-NG",
        "Error launching site link (GLE = 0x%x)",
        "&IDATX",
        "m Windows koupili. Windows v",
        "jratelep",
        "i gata.",
        "Please wait3There was a problem running preinstall.cmd scripts.2There was a problem running precommit.cmd scripts.",
        "dz tiks pabeigta ",
        " bisogno o usa Pulizia disco per liberare spazio e riprova.>Si ",
        "lectionner un dispositif de stockage externe",
        "n tamam",
        " ve uygulamalar",
        "cie ho m",
        "e od 4GB (ovisi) i mogu",
        "Es kann nun ein paar Minuten dauern.",
        "jabb szolg",
        "tiski.",
        "em.;Klju",
        "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5",
        "n Windows 10:n version, tietokone m",
        "ger efter opdateringer: %1!d!%%",
        "Die Windows-Installationsdateien wurden nicht gefunden. Legen Sie das Windows-Installationsmedium ein, und f",
        " kapat",
        "Namestitveni program za Windows 10",
        "r att skapa media",
        "@@AFTTU|]]^",
        "rias para continuar a instala",
        "PrepararFJ",
        "Dette m",
        "senia..Windows Server 2019 sa nepodarilo nain",
        "mu roz",
        "041B04B0",
        "n de BitLocker se suspender",
        "`.data",
        " BitLocker zostanie wstrzymana na czas tej aktualizacji i zostanie wznowiona, gdy zalogujesz si",
        "%1!s! %2!s!&Izveidojot datu nes",
        "n %1!s! ja tallenna ISO-tiedosto DVD-levylle manuaalisesti.",
        "ciju, kas nepiecie",
        "uW0~0W0_0U",
        "vMR@b",
        "Estamos preparando algunas cosas",
        "616O6m6",
        " v %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml a spus",
        "Daha fazla bilgi",
        "ve[]0",
        ",Windows 10 installiprogrammi taask",
        "Emme ole varmoja siit",
        "Windows 10 y",
        "iile nu se potrivesc",
        "Le programme d'installation de Windows va se connecter pour obtenir des mises ",
        "=X>r>~>",
        "vel determinar se o PC est",
        " Windows Server 2019,",
        "10 a d",
        "pnie wybierz pozycj",
        " ancora pronto per questo PC",
        "&Atmesti>Jei nesutiksite su licencijos s",
        "Betriebssystem Microsoft",
        "JDenne produktn",
        "e da zavisi od ure",
        "el nepovedlo odstranit automaticky. Aktualizujte seznam a zkuste to znovu.",
        "ine doar 25 de caractere.",
        " paleisti ",
        "ndan Yenile'yi se",
        "ments.",
        ">l;s4",
        ". Spus",
        "210303183039Z0p1",
        "CSetupDialogSplash",
        "n de Windows 10 necesita reiniciar para que funcionen. Tras el reinicio, continuaremos donde lo dejamos.)Este equipo no puede ejecutar Windows 10.",
        "Anahtar ",
        "Dvd-brander openen",
        "diegta ir suaktyvinta ",
        "chargements.q",
        "System operacyjny:",
        "pen. Z",
        "ranie m",
        " system Windows Server 2019. Zamknij Instalatora i spr",
        "-Tento n",
        "1$1,141L1P1\\1|1",
        "Nismo sigurni ",
        " po zako",
        "IMM32.dll",
        "chten, mit Windows 10 kompatibel sind.nDieser Product Key eignet sich nur zum Hinzuf",
        "Alterar o modo como a Instala",
        "Downloads ",
        " magazynu zewn",
        "lja, hogy a megtartani k",
        "t1uo0",
        " oraz dodatkowe pliki, kt",
        "%1!ld! %% effectu",
        "Pokud se chyst",
        "dition de Windows 10 va configurer votre PC pour qu'il s'ex",
        "ao nam je, imamo problema da utvrdimo da li je Windows 10 ve",
        "cie sa pou",
        "Error reporting telemetry for bOnLearnMoreLinkClicked: [0x%X]",
        " Microsoft Corporation. Tutti i diritti riservati.",
        " poursuivre l'installation de Windows Server",
        "Download the latest versiondA newer version of this tool is available. You must download and run the latest version to continue.(Download the updated Media Creation Tool",
        "lddd6",
        "?$?)?2?9?>?G?N?S?]?a?g?",
        "CInstallUI::ShowPage: Posted MSG_INSTALLUI_SWITCH_TO_RESPONSE_PAGE",
        "Aktualizacje zastosowane",
        " dar neparengtas ",
        "233?3K3Y4q4",
        "ncias!Abrir Defini",
        "jra.\"Hiba t",
        "Windows 10 UpdateQFailed to open your storage usage. Please manually open your Storage in Settings.GFailed to open your Recycle Bin. Please manually open your Recycle Bin.RFailed to open your storage usage. Please manually run %1!s! to open Disk Cleanup.",
        "dzu, apmekl",
        ".iNepoda",
        "kkel.",
        "niej b",
        " sa skripty nasadenia preinstall.cmd+Sp",
        "O Windows n",
        " dosyas",
        "me est survenu.NPour installer Windows 10, cliquez sur Setup.exe dans le m",
        "4(4b4",
        "mu programu se nepovedlo na",
        "l, kontaktujte z",
        "Neu beginnen",
        "Promijenite ono ",
        ".?AV?$CZeroInit@VCSetupResponsePageSelectImage@@$00@@",
        "uriranja, a nastavit ",
        "igused kaitstud.",
        "s atv",
        "Kontrollerar om installationen kan p",
        "ete podle n",
        "nnen und Ihre",
        "e se izbrisati, uklju",
        "-Scarica la versione pi",
        "ProductKey",
        "lj endast den h",
        "keztet",
        "n de preinstall.cmd5Ejecutando scripts de implementaci",
        "s instrukcijas.&Atbr",
        ", %2!c!: ",
        "a izv",
        "0S0h0L0g0M0",
        "sime jums atlaisvinti %1!s! %2!c!: loginiame diske.*",
        "Ouvrir la Corbeille",
        "r: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXJDu m",
        "ao nam je, morate ponovo da unesete informacije kasnije.6Instalacija nije uspela da primeni podatke o migraciji7Instalacija nije uspela da obri",
        " diegimo pasirinkim",
        "m, co je pot",
        "rliecinieties, vai ir izveidots savienojums ar internetu, un m",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::SerializeRoutine",
        "o ter",
        "te-IN",
        "i prv",
        "informations, voir l",
        "d Product Key funguje! Jestli jste p",
        "1 carattere rimasto",
        "Acquista",
        " pa ponovno pokrenite instalaciju.",
        "yo-NG",
        "ar-KW",
        "Available UI Languages",
        "te odstr",
        "97HGGGG98%'",
        "ver veta innan du b",
        "XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX.:La cl",
        "n no puede detectar qu",
        "skat aktualizace, ovlada",
        "aW0j0D04X",
        " face",
        "te ze seznamu.`Tento probl",
        ", utw",
        "Primenljive napomene i uslovi licenciranja",
        " zachovat",
        " Windows Update.o",
        "K`PWVj",
        "d\\O-Nk0",
        " oppdatere",
        " yeniden deneyin.'Bu arac",
        "%s GBx",
        "ger at installere en ",
        "lo k probl",
        "1Jeg installerer Windows 10 p",
        "s: %d%%",
        "lpen f",
        "bb %1!s! szabad hely van",
        "Tikrinamas ",
        "RegQueryValueExW",
        " ce que vous ouvriez une nouvelle session.3En r",
        "ky-KG",
        "i instala",
        "ifrovania BitLocker. Vyberte in",
        "rca cele mai noi fi",
        "g0M0~0[0",
        " na pocz",
        "hEr kan niet worden bepaald of Windows 10 al gereed is voor uw pc. Sluit Setup af en probeer het opnieuw.*Windows 10 is nog niet gereed voor deze pc'Controleren of de installatie gereed is",
        "%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz",
        "2019.Cette op",
        "GetProcessHeap",
        "charger la batterie pendant l",
        "s administrar la configuraci",
        "Empfohlene Optionen f",
        "7(8`8x8",
        "nu uti",
        "9=9N9q9",
        "dia na jeho in",
        " danych do pobrania to oko",
        "u pour s",
        "Windows 10 Kurulumu",
        "sNem siker",
        "sVi har problemer med at fastsl",
        "ho programu.EInstala",
        ";Ftu;",
        "seDA Windows most ",
        "D=x[e",
        "t licen",
        "gt, um die Installation von Windows 10 fortzusetzen. Starten Sie Setup erneut.KStellen Sie sicher, dass auf Ihrem PC gen",
        " a odeberte dal",
        "s intentando instalar una versi",
        "hjustest:",
        "&Zatvori$Nismo uspjeli instalirati Windows 10YVratili smo PC u stanje u kojem je bio tik prije po",
        "tit ja proovige siis uuesti v",
        "jlt) k",
        "i caracteristici op",
        "es para resolu",
        "tfen y",
        "tteid.",
        "Eski y",
        " bruke, har ikke nok tilgjengelig diskplass. Velg en annen stasjon, og pr",
        " program Windows Server 2019. A",
        "PrzygotujOTa sprawa jest ju",
        "CSetupResponsePageCompat",
        "saugoti, suderinama su ",
        "o sa stalo, ale nepodarilo sa n",
        "Mettre ce PC ",
        "m>Ak s licen",
        "tre avant de commencer",
        "||ldl",
        "!Nem tal",
        "A arquitetura n",
        "y dzia",
        "ordinateur. Fermez tous les programmes ouverts, puis red",
        "mto v",
        "bsearch",
        "bb mint 4 GB is lehet (a m",
        "Disque m",
        "CSetupResponseTemplate<class IDiskSpaceActionResponse>::OnNext",
        "Hvis du skal oppgradere fra Windows 7 eller Windows 8.1 eller installere Windows 10 p",
        " brenne ISO-filen til en DVD senere.",
        " Internet, nous activerons Windows pour vous. ",
        " problem i uruchom ponownie Instalatora.",
        ">)>?>U>k>",
        "n8'$8",
        " %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml ",
        "&Zavrie",
        "Lees deze overeenkomst goed door.",
        "0o0!kn0",
        "r nyckeln fungerar inte. Prova med en annan nyckel.",
        "s, DVD arba ISO failo) k",
        "ttede installationsmuligheder7Installationsprogrammet kan ikke validere produktn",
        "0c0f0puj0",
        "Wenn Sie diese Edition von Windows 10 installieren, wird Ihr PC f",
        "`cmap",
        "rt kr",
        "Actualizare Windows 10kNu s-a reu",
        "roljon ",
        "rjarmNedladdningen ",
        "digo de error: 0x%1!lX! - 0x%2!lX!",
        "anu, ir j",
        "171>1D1I1T1_1s1",
        "Senza etichetta",
        "ka bir ",
        "@@@@@@@@@@@@@@@@@@@@@@@@",
        "lja selline: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXMEnne j",
        "Descargar",
        "0L0zv",
        "noton komentosarjoja3Suoritetaan failure.cmd-k",
        "etky potrebn",
        "041D04B0",
        "Continuar desde donde lo dej",
        "t Sh,",
        "ret installeret og aktiveret p",
        "Nicht jetzt",
        "Sugerencias de soluci",
        "etka spremite i zatvorite datoteke..Pri",
        " kilka minut.yPodczas instalacji systemu Windows nie b",
        " 350 MB ",
        "bHr,g ",
        "Dil, mimari ve s",
        " Vytv",
        "ndert oder entfernt; Windows 10 wird im Supportzeitraum automatisch aktualisiert; der Support kann je nach Ger",
        "nje skladi",
        "~~{w{ok",
        "ppp@@@@@@@@@PPP",
        "et: .Windows skal bruge plads for at kunne opdatere",
        "pia Windowsu 7 alebo Windowsu 8.1. Aktivujte aktu",
        "mesine bas",
        " denne PC-en,Jeg m",
        ")Upotrijebi starije instalacijske datoteke",
        " Microsoft Corporation. Visas ties",
        "anja sistema Windows Server 2019. Poskusite znova zagnati namestitveni program.",
        " organizacija tvarko j",
        "Windows bu bilgisayarda etkinle",
        "NW0~0W0_0",
        ">0?H?Y?r?",
        "tietoja saat asennusohjelman ohjeesta tai suorittamalla komennon setup.exe /? komentokehotteessa asennustietov",
        "0?O$A0",
        "Reikia daugiau vietos,%1!d!GB laisvos vietos diske, reikia (%2!s!)lPa",
        "0$0(0,0004080<0@0H0`0d0x0|0",
        "n anterior de Windows.kLa unidad que intentas usar no tiene suficiente espacio disponible. Elige otra unidad e int",
        "dajov vo Windowse",
        "Jatka siit",
        "e da potraje.ZKonfigurisanje ispravke za Windows 10",
        "=?=P=",
        "nstalleerd of omdat u probeert een oudere versie van Windows te installeren.",
        "Pridobi",
        "GetSystemMetrics",
        ",Det g",
        "9**6, r",
        ".?AVCSetupResponsePageRecoveryReq@@",
        "li, s ",
        "Iets verhindert de voortgang van de installatie. Lees de informatie in %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml om het probleem op te lossen en voer Setup opnieuw uit.fGa voor meer informatie over het upgraden van Windows Server naar: https://aka.ms/windowsserverupgradeqEr kan niet worden bepaald of Windows Server 2019 al gereed is voor uw pc. Sluit Setup af en probeer het opnieuw.&Windows is niet geactiveerd op deze pc",
        "EventRegister",
        " leidimo j",
        " nekoliko stvari. Obavesti",
        "ticamente en %1!d! minutos.0Algunas cosas que hay que saber antes de empezar",
        "fiTXtXML:com.adobe.xmp",
        "ISO fails",
        "tu Windows 10, instal",
        "unalnik konfiguriral za delovanje v na",
        "re having trouble determining if your PC can run Windows Server 2019. Please close Setup and try again.+Windows Server 2019 installation has failed",
        "kkulcs csak 25 karakterb",
        ":{bcc",
        " aktu",
        "ll Windows-inst",
        "elite da zadr",
        "aduje aspo",
        ".Windows 10:n asennusta k",
        "emo automatski aktivirati",
        " bitlocker fonctionne. Continuez quand vous ",
        "n admitidas?El programa de instalaci",
        "e boste nadgradili sistem Windows 7 ali Windows 8.1. oziroma boste znova namestili Windows 10, vam klju",
        "s uzst",
        "Geen updates beschikbaar",
        "Napredak: %1!d!%%7Da biste nastavili, izaberite neku od dostupnih opcija._",
        "[Fejlkode: 0x%x]1Windows-installationen st",
        "ntalo de nuevo o prueba una distinta.=",
        "HQP}_g",
        "e funkcionisati sa ovim izdanjem operativnog sistema Windows. Isprobajte neku drugu ",
        "e preoblikovati vanjski ure",
        "k0)R(uY0",
        "0n07_",
        "La langue ou l",
        "es dispon",
        "weug0M0~0Y0",
        "ilita isiklikud failid ja rakendused+S",
        " nytt.yBeklager, men vi har problemer med ",
        "emo vam pomo",
        "n antiguos",
        "cuter en mode S.ZLa cl",
        " flash USB",
        "rebilir.",
        "Instaliranje sustava Windows 10@PC ",
        "no pou",
        "c %1!d! min",
        "6_7f7\"8",
        "ttelep",
        "emo instalirati najnovije zna",
        " du produit par le programme d",
        "rgige alltoodud juhiseid.)Arvutis %1!s! vabastamine (%2!c!: kettal)HValige v",
        "CSetupResponseTemplate<class IDlpResponse>::ExecuteRoutine",
        "vs,%1!d! GB ledigt diskutrymme kr",
        "4!4-494M4",
        "glicherweise nicht richtig, und Sie m",
        "nt fel uppstod och det gick inte att k",
        "tta installera Windows Server 2019. Prova att starta om installationsprogrammet.",
        "Fvk__",
        "./Windows Server 2019 jo",
        ": 0x%x]:",
        "10 pour activer Windows",
        ", musisz pobra",
        "s nyelvet.(Usa i file di installazione meno recenti",
        "lem biraz zaman alabilir.",
        "9C u&",
        "n care Instalare Windows desc",
        "anju instalacije sustava Windows",
        "Een pad selecteren",
        "|}}?i",
        " se pou",
        "o precommit.cmd-Executando scripts de implanta",
        "InitializeCriticalSectionEx",
        " din pc, har et sprog eller en udgave, som dette v",
        "ib varieeruda) ja rakendada v",
        "2019 dans Windows Update.",
        "anas skriptu precommit.cmd izpilde(Izvieto",
        "g hely a g",
        "9D9i9{9",
        " volte. L'operazione richiede alcuni minuti.",
        "rsel V",
        "itamisel ilmnes probleem.3Precommit.cmd skriptide k",
        "0$PL0!q",
        "%c:DDevo riavviare il PC pi",
        " asennusohjelma uudelleen.<Varmistetaan, onko tietokoneessasi riitt",
        "st-ZA",
        "Partizione disco",
        "CSetupResponsePageDiskSpaceReq::RecalculateRequirements",
        "%s Gt",
        "r programvara fr",
        "Nn0zzM0L0B0",
        "tter utan att aktivera din version av Windows m",
        "ete d",
        "Unidad flash USB",
        "CreateDIBSection",
        " z dost",
        "&Recusar=Se recusar os termos de licenciamento, sair",
        "ne hetke p",
        "o failure.cmd!Isto pode demorar alguns minutos.",
        "is produkto raktas gali b",
        "ilitada?",
        "tson fel helyet a Lemezkarbantart",
        "installation de Windows.",
        " recente di Windows 10",
        " wybranego rozwi",
        "Nie sme si ist",
        "0zzM0",
        "ba-RU",
        "lne pomocou aplik",
        ".?AVCSetupResponsSelectMediaFormat@@",
        ": %2!s!",
        "(Windows 10 Kurulumu yeniden ba",
        "sti, pasirinkite vien",
        " dakika s",
        "Cheia de produs",
        "ta. Tas noz",
        " tiver uma c",
        "Huomasimme, ett",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::Deserialize",
        "o e tente novamente.2Ocorreu um problema ao transferir alguns ficheiros",
        "rat manu",
        "GetVersionExW",
        " Windows Server 2019. Lai pal",
        "tres Windows.QVos applications et param",
        "se: %d%%",
        ",I trattini verranno aggiunti automaticamenteOIl programma di installazione non ",
        ".LWindows ",
        "g van a friss",
        "vanie funkci",
        " de confidentialit",
        "$Microsoft Ireland Operations Limited1",
        "nik instalacyjny systemu Windows, a nast",
        " para descargar las actualizaciones, los controladores y las caracter",
        ";5<w<",
        "Potrebujemo ve",
        "A kulcs XXXXX-XXXXX-XXXXX-XXXXX-XXXXX form",
        " i mog",
        "rankos fail",
        "sd-Deva-IN",
        "%Koristi starije instalacione datoteke",
        "kova.#Koje su druge opcije za a",
        "Negalime ",
        "toupper",
        "r Windows Server 2019 m",
        "S(uzz",
        "Underst",
        "210121231921Z0",
        "k, ja v",
        "i: %1!s!",
        " facoltative. Questi aggiornamenti consentiranno di eseguire l'installazione in modo corretto e possono includere correzioni importanti, driver di dispositivo aggiornati e file aggiuntivi non presenti nel supporto di installazione. ",
        "Installer %sGDatamaskinen startes p",
        "GH9_ t_",
        "s reciente de Windows 10!Esto puede tardar varios minutos.uNo pudimos descargar todos los archivos necesarios. Aseg",
        "Lizenzbedingungen",
        " automaticky'K",
        "6(8t8{8",
        "S0n0OUL",
        "&Klawiatura ekranowa",
        "Disko pasirinkimas0S",
        "klendi ancak ",
        "ne resurseAInstalacijski program nije uspio inicijalizirati radni direktorij'Parametri naredbenog retka nisu valjani",
        "Mer information",
        "Ponecha",
        "n de Windows se conectar",
        "vel instalar o Windows Server 2019_O PC foi reposto para o estado em que estava antes de come",
        " Windows.;Nastaven",
        "RtlUnregisterFeatureConfigurationChangeNotification",
        "8,8<8L8\\8l8|8",
        " riuscita$Installazione di Windows Server 2019",
        "anas aktiviz",
        "dzie do tworzenia no",
        "iai ir gali apimti svarbius pataisymus, atnaujintas ",
        "*NW[&{J",
        "Estamos realizando algunos preparativos",
        "nglig f",
        "305.1i",
        " Windows 10<PC-ul va reporni de c",
        " fungere problemfritt og kan inkludere viktige hurtigreparasjoner, oppdaterte enhetsdrivere og andre filer som ikke finnes p",
        "o em disco. Libere algum espa",
        "Ob namestitvi te izdaje sistema Windows 10 se bo va",
        "6=7c7",
        " som administratorZHvis du vil bruke dette verkt",
        "Windows Update",
        " (USB-",
        "lp af en produktn",
        "izgiler otomatik olarak eklenir%",
        "n daha yeni bir s",
        " utiliza",
        "AttendiMSi ",
        "unuz i",
        ";[;u;",
        "tfen bekleyin>preinstall.cmd komut dosyalar",
        "ta Windows instal",
        ".:Sinun on tallennettava ISO-tiedosto DVD-levylle my",
        "i koristiti PC. Prije po",
        " installer.",
        "Este processo pode levar alguns minutos.",
        "Nepovedlo se ulo",
        "/Jag installerar om Windows 10 p",
        "'%%MOO",
        "gbaren Optionen aus, um den Vorgang fortzusetzen.",
        "astis.",
        "yorum?",
        "lgende grunner:",
        " program syst",
        " tiver sido instalado e ativado neste PC e estiver a reinstal",
        "ajki u sustav Windows. Nije ga mogu",
        "sterebilir.",
        "Please read this so that you know what you",
        "V:N`O",
        "iile vor fi ",
        "EnableMenuItem",
        "ho na fungovanie v re",
        "PripremiDTo ste ve",
        "lni.%Nem szeretn",
        "Lo sentimos, estamos teniendo problemas para determinar si Windows 10 ya est",
        "tteid hallata.ATeie s",
        "vne a mo",
        " BitLocker ",
        ", ka jums b",
        ".?AVCSetupUIManager@@",
        "o consegue executar o Windows 10$O Windows 10 j",
        "ajke sustava Windows 10 potreban je napredan hardver, neke su postoje",
        "se\"Ez hosszabb id",
        " essere usato solo per aggiungere funzionalit",
        "t run Windows 10\"You are already running Windows 10",
        "9#:=:^:",
        "cution de cet outil",
        "Puudub#Saate oma Windowsi s",
        "InstallDiskSpaceReq",
        "Flyttar dina inst",
        ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:",
        "jumi un lietojumprogrammas tiks dz",
        "$Kod b",
        "? ?:?F?d?x?",
        "rgmistele asjadele.JInstallimise j",
        "cpn0Wg",
        "enja podr",
        "ovat.$Zvolte jin",
        "Instalator systemu Windows przejdzie do trybu online, aby pobra",
        "Leelawadee UI",
        " 4 GB+ (",
        ";.;8;M;W;",
        " usar o PC durante a instala",
        "MVVVVMM@%%%\"\"  9",
        "tta aega.",
        "nger. Det h",
        "l'architecture est incompatible.",
        "Installazione di Windows passer",
        "o inicializou o diret",
        " la riformattazione del dispositivo di archiviazione esterno, che potr",
        "ft.KDieser Schl",
        "7C7Q7",
        "n'Farkl",
        "chec de la d",
        "glltld",
        "Behold bare personlige filer",
        "r krypterad med BitLocker. V",
        "shez a Windows 10 telep",
        "emo u usluzi Windows Update.\\Konfigurisanje ispravke za Windows 10",
        "Actualizar este equipo ahora",
        "iek tiek vietos ir bandykite dar kart",
        "mes$Defises tiks pievienotas autom",
        "Vent litt",
        "owa; wprowad",
        "n anterior de Windows.mLa unidad que intentas usar no tiene suficiente espacio disponible. Elige otra unidad e int",
        " ezen a sz",
        "ivitada. P",
        "s csak akkor ",
        "enite ra",
        "e teh posodobitev ne boste namestili zdaj, va",
        " quer manter",
        "tirmeler y",
        "&Accepter",
        " nytt",
        " nem tudta megkezdeni a Windows telep",
        "ifra proizvoda.",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::GetError",
        " di circa 3 GB. Se usi una connessione a consumo, controlla se il download causer",
        "pet friss",
        "041504B0",
        "0!0)010=0",
        "\\\\?\\UNC",
        "Moving your settings %d%%",
        "353U3u3",
        "yor-failure.cmd da",
        "See below if you",
        "iu pentru a rula instalarea. Elibera",
        "Seg&uinte",
        "es porque optou por instalar o  %1!s! com um idioma diferente do que est",
        " la poursuite de l",
        "k igen.2Installationen av Windows Server 2019 misslyckades",
        "iau, kad jie veikt",
        "ivitage installiprogramm uuesti.]Windows Serveri t",
        "n tietokoneeseen)Minun on ostettava Windows 10 -tuoteavain",
        "0@+$A0",
        "ky. Vybra",
        "es-PR",
        "scEzen a m",
        "asno prekinjena in bo znova vzpostavljena, ko se boste vpisali v Windows 10. ",
        "es de instala",
        "pnie ponownie uruchom instalacj",
        "Apri cestino",
        "! Poursuivez quand vous le souhaitez.",
        "0Budete m",
        "tes.lLai nodro",
        "z, uygulamalar",
        "nerilen)",
        "'FC=P",
        "eHr,gMb",
        "Tiek veikta sagatavo",
        " atsisiuntim",
        "rtya vagy k",
        "%hs: Not updating report control because report path is empty.",
        "base\\ntsetup\\conx\\mosetup\\mediasetupuimgr\\src\\SetupResponsePageCompatSysReqImpl.h",
        "kai atnaujinama; palaikymas gali skirtis, atsi",
        "une cl",
        "9N9^9",
        "ca-ES",
        "0'1o1",
        "tartuje. M",
        "A Windows 10 telep",
        " saugojimo ",
        "nek ellen",
        "ktan sonra cihaz",
        "m kroku v",
        "mogat",
        ": %1!d!%%A",
        "ko min",
        "t work. Please check it and try again, or try a different key.5Your bitlocker key works! Continue when you",
        "nstalleerd. Activeer uw huidige versie van Windows met een productcode en selecteer Vernieuwen.",
        "installation de Windows Server",
        "nda BitLocker korumas",
        "0f0D0",
        "6'6-626;6H6m6",
        "turma Arac",
        "ljaande installimisel) l",
        "Windows is niet op deze pc geactiveerd. Dit betekent dat u de productcode van Windows 10 hieronder moet invoeren, of Setup afsluiten, Windows activeren en Setup opnieuw uitvoeren.",
        "si friss",
        " laikmen",
        "emo vam Windows. ",
        "en-NZ",
        "memcmp",
        "Zachowaj tylko pliki osobiste",
        "jjk%jjk`",
        "li chcesz zainstalowa",
        " pentru a extinde temporar unitatea de hard disk ",
        " manuel olarak a",
        "Der opstod en uventet fejl under installationen af Windows. Kontroll",
        "n.[DVD yaz",
        " za namestitveni program ali pa v korenskem imeniku namestitvenega medija za",
        "ve chosen to:",
        "O(uW0f0 ",
        " de produit.'Votre disque m",
        " precommit.cmd ",
        "talujete Windows do PC navrhnut",
        " at du vil avslutte?",
        "cution des scripts precommit.cmd.",
        "Pode continuar a usar o PC.",
        "anja. Preglejte informacije v datoteki %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml in odpravite te",
        "ani namestitvi odstranite.-Zahteve so izpolnjene. Pritisnite ",
        "Geen label",
        "[Code d",
        "rile Windows, fi",
        "CSetupResponsePageSysReq::PreTranslateMessage",
        "hlen Sie ein anderes Laufwerk aus.",
        "gido enquanto as atualiza",
        "Tarkistetaan avainta'Avain ei toimi. Kokeile toista avainta.",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::Suspend",
        "t atjaunin",
        " systemu Windows, u",
        "s reciente de esta herramienta. Para continuar, tienes que descargar y ejecutar la versi",
        "%2!s!9Din organisation hanterar dina uppdateringsinst",
        "Tipps zur Problembehandlung",
        "sek let",
        "latmay",
        "N: Algunas caracter",
        "n ald",
        "o de que precisamos para continuar a instala",
        "iile ",
        "un support pour Windows 10*Vous pouvez continuer ",
        "iame kompiuteryje nesuaktyvinta",
        "Tam olarak haz",
        "rt pc",
        "kkulcshoz ill",
        " fie de cel pu",
        "n, voiko Windows Server 2019:",
        "marrez le programme d",
        "i un alt dispozitiv de stocare extern",
        " qx<)PlY`",
        "6/646L6Z6m6",
        ": Windows 10'un baz",
        "s listo para instalar",
        "CloseThreadpoolTimer",
        "s de la actualizaci",
        "ntalo de nuevo.&Problema al descargar algunos archivos",
        "OLEAUT32.dll",
        "ujte ra",
        "ojiet atkritni, lai no sist",
        "tes connect",
        "o.nPara obter mais informa",
        "fego limitado, verifique se a transfer",
        "'v?qW",
        "0 0$0<0L0P0h0x0|0",
        " pentru a v",
        ", tylko je",
        "6 6,686D6P6\\6h6t6",
        "0K0i0F0K0",
        "o de Caixa de Di",
        "%1!s!%2!s!%3!s!",
        "~Odeberte pros",
        "Dil e",
        "Il faut au moins %1!d! Go",
        "unalniku nismo mogli zagnati. ",
        "This might take a while.ZConfiguring update for Windows 10",
        "i cheia de produs",
        "mpliga meddelanden och licensvillkor",
        "ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp",
        "BothVThis bitlocker key didn",
        "pna tylko w sytuacji, gdy na Twoim komputerze zosta",
        "Status: %1!d!%%3V",
        "~~~~~yyyyxxxxxx",
        "8.1 est install",
        "k un p",
        "A instala",
        ", at du vil afslutte?",
        " attivato in questo PC. Ci",
        "r du startede installationen af Windows Server 2019.EVi forts",
        "&Schermtoetsenbord",
        "\"Creaci",
        "Der er nogle f",
        "F5XG]",
        " deneyin.",
        "mu %s3Windows restart",
        "3%@>88888>",
        "Usa un dispositivo externo, como una llave USB, una tarjeta SD o un disco duro externo, para ampliar temporalmente el disco duro mientras se instalan las actualizaciones. Windows no volver",
        "uriranja pomo",
        ", tento n",
        "me jist",
        "l vienos i",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::GetResponseName",
        "unar spreman da nastavi instalaciju izdanja Windows 10. Probajte ponovo da pokrenete instalaciju.oNije mogu",
        "%1!d!%% completeSThis product key didn",
        "sr-SP-Cyrl",
        "Arvuti taask",
        "s nepiecie",
        ".rsrc$02",
        "Windows 10 indiriliyor",
        "nliche Dateien behalten",
        " za BitLocker je videti tako: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX/Klju",
        " %2!c!:)TSeleziona o connetti un dispositivo di archiviazione esterno con almeno %1!s! liberi",
        "(ug0M0~0[0",
        " tai Windows 8.1:st",
        "Kasuta vanemaid installifaile",
        "`03*:",
        "e da sadr",
        "unalnik. Zaprite Windows Setup in poskusite znova.-Windows 10 ",
        "l.5A Windows 10 m",
        "dzu, atlasiet instal",
        "e nadaljujete brez aktivacije trenutne razli",
        "identificateur",
        "marre l",
        "lectionnez l'image ",
        "CSetupResponseTemplate<class IActivationActionResponse>::OnCancel",
        "Det h",
        "Valmistelemme paria asiaa",
        " izdelka ni deloval. Preverite ga in poskusite znova ali uporabite drugega.6Klju",
        "n timpul opera",
        "$U8De",
        "ttes, n",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::Restart",
        "Aktualizovat seznam jednotek!Velikost mus",
        "-Ponovo instaliram",
        "Windows v tomto PC nie je aktivovan",
        "Fremdrift: %1!d!%%;Velg ett av de tilgjengelige alternativene for ",
        "```_\\ZRR",
        "pre jelenleg telep",
        "o.#Configura",
        "nliche Dateien beibehalten",
        " aflarea motivului.",
        "ffneten Programme, und starten Sie den Computer dann neu. Die Windows-Installation wird automatisch fortgesetzt.",
        "lreiz.9Uzst",
        " jednotku a kliknut",
        " %2!c!:pWindows 10",
        "INFORMATIE OVER DE INSTALLATIE: Sommige onderdelen van Windows 10 vereisen geavanceerde hardware; sommige bestaande onderdelen zijn gewijzigd of verwijderd; Windows 10 wordt automatisch bijgewerkt gedurende de ondersteuningsperiode; ondersteuning kan per apparaat verschillen.",
        "040204B0",
        "lteni az ",
        "Tahoma",
        "0.0T0",
        " pomoc",
        "ifrovana je tehnologijom BitLocker. Odaberite drugu disk jedinicu i poku",
        " na tomto po",
        "[o0D}T~k0",
        "sokat4A telep",
        "e yaramad",
        "i vannak.$V",
        "klemeden sonra bilgisayar",
        "040704B0",
        "du.gNepavyko atidaryti saugyklos naudojimo. Paleiskite %1!s! rankiniu b",
        " We can",
        "ano: %1!d!%%STa klju",
        "qMums nepavyko atsisi",
        "shell:RecycleBinFolder",
        "CSetupResponsePageBitLockerKeyValidate::GetResultsFromPage",
        "9V:`:",
        "ajazIzdanje sustava Windows koje odgovara unesenom klju",
        " estiver instalando o Windows 10 neste computador pela primeira vez, insira uma chave do produto (Product Key) v",
        " laste ned alle de n",
        "zh-SG",
        "r installasjonsprogrammet lukkes",
        " sakla,Windows ayarlar",
        " ulkoinen tallennuslaite, jossa on vapaata tilaa v",
        "2Kurulum program",
        "lj en annan enhet och f",
        "m Windows.",
        "1 teken resterend",
        "Er is in Windows een onverwachte installatiefout opgetreden. Verifieer of de installatiebronnen toegankelijk zijn en start de installatie opnieuw op.",
        "Select language, architecture and edition",
        "&Edellinen",
        "ppp@@@@@@@@@```",
        "tement lors de l",
        "n de Windows y tus archivos personales y aplicaciones.TLos puntos siguientes requieren tu atenci",
        "Archivo ISO",
        "Provjeravamo jeste li spremni za instalaciju",
        "stroje BitLocker vypad",
        "lDet kan tage nogle f",
        "hrend dieses Updates unterbrochen und erst fortgesetzt, wenn Sie sich bei Windows 10 anmelden. Zum Schutz Ihrer Daten sollten Sie den PC bis zur erneuten Anmeldung nicht unbeaufsichtigt lassen.7Zur Erinnerung sehen Sie hier noch einmal Ihre Auswahl:",
        "teni egy m",
        "mu Windows pou",
        "kalu ei tue tietokoneessasi asennettuna olevan Windowsin kielt",
        "dni fog. Ha meg szeretn",
        "n toimimaan S mode -tilassa. Valitse t",
        ".?AVIActivationActionResponse@@",
        "CSetupResponsePageBitLockerKeyValidate: InitializeResponsePageRoutine",
        "o e tente novamente.5Windows Server 2019 nu este ",
        "pertoire racine de votre m",
        "ierele se vor p",
        "L$(+L$ +D$",
        "cZ[D3-++",
        "QQSV3",
        "=(=4=@=L=X=d=p=|=",
        "1B1s1",
        "a organiz",
        "_2QX[zz",
        "4Windows Server 2019 ",
        "brig'Der Product Key umfasst nur 48 Zeichen.VDer Schl",
        "8(8H8T8t8|8",
        "0!070F0\\0k0",
        "o conseguimos encontrar o Contrato de Licen",
        "sra tervezett PC-n telep",
        "erreur",
        "2 2$2(2,2024282<2@2T2X2h2l2p2t2x2|2",
        "<!<'<.<5<<<C<J<Q<X<^<j<u<z<",
        "0?\\$@0",
        "CInstallUI::ExitInstance",
        "installation lors de la phase %1!s!. Erreur lors de l",
        " o versiune mai nou",
        "De productcode ziet er als volgt uit: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXLKijk nog even naar de volgende punten voordat u doorgaat met de installatie.",
        "ttelse",
        "i ca aplica",
        "Preverjanje osebnega ra",
        "darykite vykdomas programas, tada i",
        "eme zisti",
        "pen a Windows 10-et, ",
        " 4 GB ",
        "Visitez",
        "?Preparando para descargar la versi",
        "On izgleda ovako: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "t!H&\\",
        "ioneaz",
        "anu no Windows 7 vai Windows 8.1. vai ja Windows 10 instal",
        "ime, kai u",
        " norite i",
        "UnregisterTraceGuids",
        "jezici se ne podudaraju",
        "CInstallUI::CanCancelSetup",
        "mn-Mong-MN",
        ", na kt",
        " ve Windows",
        " arba bandykite naudoti kit",
        "Sprawdzanie tego klucza1Ten klucz nie dzia",
        " Windows Server 2019%",
        "unu do",
        "n Windows Server 2019",
        "Installa Windows 108Scarica aggiornamenti, driver e funzionalit",
        "elim uporabiti zunanjo napravo za shranjevanje5Ne ",
        "GetStockObject",
        "ifru proizvoda za",
        "re i S-modus.MUSB-flash-enheten m",
        "Idioma:",
        "Wir bereiten gerade einige Dinge vor",
        ". Pasirinkite kit",
        "Tieto aktualiz",
        "R{veQ",
        "elim da ipak koristim spolja",
        "ugiwanych opcji instalacji0Instalator nie mo",
        "bb a Windows 10 term",
        "u_tUAj",
        "zda, sizin i",
        "charger Windows 10$V",
        " produkto kodas veikia! T",
        "czono: %1!ld!%%",
        "363W3",
        "Criar suporte de dados de instala",
        "(S@1d",
        "iuo pasirinkimu?zNegalite pasilikti fail",
        "H Kp'",
        " proizvoda morao bi se nalaziti na kutiji DVD-a ili u potvrdi koju ste primili e-po",
        "r dal",
        "OMLvjWcElu",
        " se u v",
        "Ak in",
        " reintroduce",
        "iu pentru a continua instalarea Windows Server 2019. ",
        "Protec",
        "are disc pentru a elibera spa",
        "r kan ta en stund.,V",
        "tit.PSee tootev",
        " aceast",
        "USB flash drive",
        "o poder",
        " pe suportul de instalare. Dac",
        "DVD yaz",
        " preinstall.cmd)",
        "Unknown",
        " fazendo a limpeza antes de fechar",
        "diu na Setup.exe.}Nedok",
        "1::&*a`",
        "sit licences noteikumus, iestat",
        " usuni",
        "K$EEE...",
        "Gl0yA",
        "1 karakter kald",
        "n ard",
        ">$?[?",
        "tte.\\En BitLocker-n",
        "Aguarde?Houve um problema durante a execu",
        "stiet atjaunin",
        "%s: Entering Response Execute Method",
        "unaru imate instaliranu aktiviranu kopiju operativnog sistema Windows 7 ili Windows 8.1. Aktivirajte trenutnu verziju operativnog sistema Windows pomo",
        "in birka",
        "iame kompiuteryje naudokite rekomenduojamas parinktis",
        "}Q0f0O0`0U0D0",
        "s az alkalmaz",
        "s pal",
        "4/4K4d4",
        "ajki. Ta ",
        "movou in",
        "ta neatbalst",
        "Tippek hibaelh",
        "9Hvis du avsl",
        "tuves lietojumu iestat",
        "kkelen kan bare brukes til ",
        "Sign in as an administratorRTo use this tool, you must be signed in to Windows using an administrator account.0You",
        "<#=^=",
        "&Uporabi starej",
        "r noget plads nedenfor, og v",
        " Windows via un compte d",
        "en-MY",
        "Osvje",
        "rgmise v",
        " fortsette installasjonen av Windows.",
        "unuzda devam edin.",
        "1 carattere rimasto1Il codice Product Key contiene solo 48 caratteri.MIl valore della chiave del gruppo %d non ",
        "De bestanden op het USB-station worden verwijderd. Als u deze bestanden wilt behouden, maakt u er nu een back-up van op een andere opslaglocatie.",
        " effectuer avant que vous puissiez proc",
        "%hs: Dialog initializing - SysReq Unknown",
        "6@>>@DDDDDDJDDDI?I",
        "gus labojumus, atjaunin",
        "ndan devam edemiyor. A",
        "tdldldlVw|v|~",
        "n y es posible que debas volver a instalar algunos idiomas y caracter",
        "8'8v8",
        "e en ligne.!%s n",
        "%d caratteri mancanti,I trattini verranno aggiunti automaticamente1Il codice Product Key contiene solo 25 caratteri.",
        "1#232V2o2~2",
        "ck(WW",
        "\"Windows Server 2019 ",
        "jlban tal",
        "c tam j",
        "Brez oznake",
        "logget Internett, og pr",
        "sticas opcionales",
        " %1!d! GB ",
        "vJos haluat asentaa Windows 10:n toiseen osioon, sinun on luotava tietov",
        "sa<A failure.cmd k",
        "Restarting Windows 10 Setup",
        "su PC datoram. Aizveriet uzst",
        ">.>h>",
        "accepte pas les arguments de ligne de commande. Pour plus d",
        "Allalaaditava faili maht on umbes 3 GB. Kui kasutate mahup",
        "Vous ex",
        " s kontom spr",
        "?/?M?a?g?",
        "lt let",
        "0^1}1",
        "id-ID",
        "Ako nadogra",
        "Kontrollerer PC-en",
        "ga, l",
        "DISABLE_FEATURE",
        "in di",
        "kovi pre In",
        "hrung im S Modus konfiguriert. W",
        "sikkal.EEz a term",
        "9-969Y9;:B:",
        "sticas existentes se modificaron o quitaron; Windows 10 se actualiza autom",
        "i clic pe Re",
        " dalej. To okno zostanie automatycznie zamkni",
        "acheter une cl",
        "wo-SN",
        " stato ripristinato lo stato del PC precedente all'installazione di Windows Server 2019.JVerr",
        "ne verzije sustava Windows, morate kupiti klju",
        " riuscita",
        "Oblas",
        "PPP@@@@@@@@@ppp",
        "ndern der zu behaltenden Elemente",
        "n de Windows, los archivos personales y las aplicaciones.LLas siguientes acciones requieren tu atenci",
        "%hs: Dialog Initializing - Gated",
        "Ajutor",
        "in set",
        "o do Windows que voc",
        "Odabir pogona=Instalacijski program malo posprema za sobom prije zatvaranja&To bi moglo potrajati nekoliko minuta.XPriklju",
        "@@@PPP",
        "@wiQT",
        "ete mo",
        " dane, nie oddalaj si",
        "urirane upravlja",
        "cm]]]",
        "Viss ir iestat",
        "Oppdateringene er installert, men installasjonsprogrammet for Windows Server 2019 m",
        "PPP@@@@@@@@@@@@@@@```",
        "Windows 10'u y",
        "GetUpdateReserveManager",
        "CSetupResponsePageBitLockerKeyValidate::LaunchOnScreenKeyboard",
        "ene, vendar se mora namestitveni program za Windows Server 2019 za njihovo delovanje znova zagnati. Po ponovnem zagonu bomo nadaljevali, kjer smo ostali.:Ta ra",
        "ti, kad b",
        "Hvis du installerer Windows 10 p",
        "1'1B1Y1l1",
        ": %d%%\"",
        "Velg en USB-flash-enhetxFilene p",
        "h0W0f0",
        "Ne moremo ugotoviti, ali je v ra",
        "pen (%2!c!: meghajt",
        "r Windows Server 2019",
        "ega ra",
        " funkce Windows 10 vy",
        "e pre nego ",
        "WaitForMultipleObjects",
        "hren bereits Windows 10 aus. Dies kann einige Minuten dauern.",
        "dzu, atveriet mapi Lejupiel",
        "e nastavitve in aplikacije bodo izbrisane, va",
        "ajte ponovo ili probajte sa drugom ",
        "Vi klarte ikke ",
        "Izbrisa",
        "a aplic",
        "nyoznak a Windows telep",
        "Ambos^Esta clave de Bitlocker no funcion",
        "C==\"\" \"  \"!",
        "s reinstalando Windows 10, no necesitas escribir una clave de producto.",
        "o SD ou uma unidade de disco r",
        "ava jezik ili izdanje verzije operativnog sistema Windows trenutno instalirano na ra",
        "uriranja i nastavi",
        "   @@@000",
        "Ogiltiga kommandoradsparametrar",
        "sr-Cyrl-RS",
        "Den gratis opdatering til Windows 10 er kun tilg",
        "e biti izbrisane, dok ",
        "xIrrota seuraava ulkoinen asema ja viimeistele Windowsin asennus k",
        "rkekood: 0x%1!lX! - 0x%2!lX!",
        "Uporabite zunanjo napravo, kot je klju",
        "s iel",
        "nemi s",
        " alebo nepou",
        "kkulcs megfelel",
        "Dine filer, apps og indstillinger kan ikke bevares, fordi du har valgt at installere %1!s! ved hj",
        "ati datoteke, aplikacije i postavke jer je va",
        "Ingenting7Du kommer att kunna hantera dina Windows-inst",
        ". Entrez de nouveau la cl",
        "1 tegn tilbage",
        "es-BO",
        "malloc",
        "5+6@6",
        "DMappen Overf",
        "ljaanne ",
        "lper med at udf",
        "2JLNNNpp0",
        " techniczn",
        "P}Y|~",
        "BSee tootev",
        "Ustvariti namestitveni medij (pogon USB, DVD ali datoteka ISO) za drug ra",
        "9]\\WIFS",
        "ifra proizvoda ne",
        "Ab&lehnen<Wenn Sie die Lizenzbedingungen ablehnen, wird Setup beendet.",
        " do %1!s! miejsca na dysku %2!c!:.uSe desejar instalar o Windows 10 em outra parti",
        "una benzer: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "VPQjB",
        "Une erreur inattendue s",
        "n timpul perioadei de acordare a asisten",
        "p~T~U~UUUVUUUH$$HU}HGH%p",
        "!Asjad, mis vajavad teie sekkumist",
        "Actualiz",
        "r uppfyllda! Tryck p",
        " parancsot a telep",
        "sime nuo ten, kur sustojome.:",
        "Kontroluje se tento k",
        "m zjistit, jestli na va",
        "lle tietokoneelle suositeltuja asetuksia",
        "Ochrana n",
        "@8>>>>>>>;>;?;8?#q",
        "Something is preventing the installation from continuing. Review the information in %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml to resolve the problem and run Setup again.\\For more information on upgrading Windows Server, visit: https://aka.ms/windowsserverupgrade~Sorry, but we're having trouble determining if Windows Server 2019 is ready for your PC yet. Please close Setup and try again.\"Windows isn",
        "Sistema Operacional Microsoft",
        "tenka vietos toliau diegti ",
        "ndose de que la instalaci",
        "charge les mises ",
        "es sobre como atualizar o Windows Server, visite: https://aka.ms/windowsserverupgrade",
        "Insira a chave do produto (Product Key)",
        "Bevar kun mine personlige filer",
        "Friss",
        "mu Windows. Sk",
        "HeapFree",
        "Valige t",
        "=R=q=}=",
        "hren.",
        " ste pokrenuli Windows 10!Ovo ",
        "Instalarea cur",
        "ej znajduj",
        " wszystko b",
        " un carattere valido",
        ",Licensvillkor f",
        "(%1!c!:) - %2!s! ledig",
        "ole32.dll",
        "tk0pe",
        "s, nous avons de la difficult",
        " a mo",
        "Getting a few things ready",
        "r installationsmediet.",
        ";';J;X;a;",
        "m Windows pot",
        " reddederseniz, kurma i",
        ". Lukk installasjonsprogrammet og pr",
        "2QX[&N",
        "tett eszk",
        "tajam.",
        "re. Dette vinduet lukkes automatisk om %1!d! minutter.",
        "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9x9",
        "kilo problemaj",
        "jsist",
        " 1 znak",
        "sti diegim",
        "lne v po",
        "A&ceitar",
        ".?AV?$CZeroInit@VCSetupResponsePageMediaCreationSuccess@@$00@@",
        "ur-PK",
        "GetClientRect",
        "i cele mai recente fi",
        "Microsoft Corporation1",
        "At&svaidzin",
        ".6Windows Server 2019 ",
        "Pasirinkite, k",
        "tirdikten sonra kurulumu yeniden ba",
        " jour#Recherche de mises ",
        "r du starterwNedlastingen er ca. 3 GB. Hvis du bruker en forbruksm",
        "enekleri kullan",
        "Keep nothing",
        "rer de l",
        "mu Windows.",
        "%2!s!<Twoja organizacja zarz",
        "5%6,6;6Z6|6",
        " palaikymo laikotarpiu automati",
        "o do Windows encontrou um erro inesperado. Verifique se as origens de instala",
        "atna aktualizacja do systemu Windows 10 jest dost",
        "Avaa Tallennustilan asetukset",
        " Quest",
        "iu-Latn",
        "Der Product Key befindet sich gew",
        "is produkto kodas netinkamas. Bandykite kit",
        "li chcesz kontynuowa",
        "i ce suport fizic s",
        ", pvz., USB rakt",
        "ka-GE",
        "zldkOUL",
        "k haszn",
        "Consulta la siguiente informaci",
        " Internet podem ser cobradas. Clique em Avan",
        ")Uvjeti licenciranja Microsoftova softvera.Izjava o za",
        "i Windows Server 2019 pob",
        "PxeW[W[CQ",
        "d Product Key nefunguje. Zkontrolujte ho a zkuste to znovu, nebo vyzkou",
        "8A8u8",
        "ra Windows 10. St",
        "  &Soovin aidata Windowsi installimist paremaks muuta",
        " olet hyv",
        "i un valodas. Naudoti senesnius diegimo failus",
        "Es konnte nicht festgestellt werden, ob Windows Server 2019 auf Ihrem PC ausgef",
        "mentaires qui ne se trouvent pas sur le support d'installation.",
        " %c\"Weet u zeker dat u wilt afsluiten?",
        "3Windows 10 ",
        "ffnen Sie Ihren Papierkorb manuell.{Ihre Speichernutzung konnte nicht ge",
        " nytt, trenger du ikke angi en produktn",
        "ppna DVD-br",
        ". Ak chcete probl",
        "s actuelles ont ",
        "&Continue",
        "0IDATx",
        "]ZkYd",
        "DfY[x",
        "jat atk",
        "anas programma nevar",
        "o logu, un m",
        " installasjonsmediet.}Vi vet ikke om PCen er klar til at installasjonen av Windows 10 kan fortsette. Pr",
        "emtu citus lielus vienumus.",
        "rstas, sazinieties ar klientu atbalsta dienestu un nor",
        "a z njim.",
        "s reciente de Windows 10.",
        "&Cancelar",
        "i activat anterior pe acest PC ",
        "CSetupLangIniLoader::Initialize:     Language pack file: %s",
        "asno raz",
        "Dette kan tage et par minutter.",
        "cii je nov",
        "No Label",
        "ncia ",
        " se va ",
        "n, sonra bilgisayar",
        "ta0Mo",
        "re noen f",
        "ig-NG",
        "des apjoms ir aptuveni 3 GB. Ja izmantojat m",
        "d Product Key",
        ":Q|Q|RSRSRQQM1",
        "diu. Ak si tieto aktualiz",
        " Windows.`",
        " possibile determinare se lo spazio nel tuo PC ",
        "t0WVhP",
        "CInstallUI::OpenShellLink",
        " asennusohjelma uudelleen.yEmme pysty selvitt",
        "ver du inte ange n",
        "https://go.microsoft.com/fwlink/?LinkId=530045",
        "i nevoie sau utiliza",
        " joitakin minuutteja.",
        "si lehet",
        "ka bir anahtar deneyin.",
        "Filene, appene og innstillingene kan ikke beholdes fordi den gjeldende versjonen av Windows kan bli installert i en katalog som ikke st",
        " al iniciar sesi",
        "Provjera ima li a",
        "Alterar a forma como a Configura",
        "%c:ARa",
        "%2!s!?Tu organizaci",
        "rste gang (eller hvis du installerer en annen utgave), trenger du en Windows 10-produktn",
        "n se lleve a cabo sin problemas y pueden incluir correcciones importantes, controladores de dispositivo actualizados y archivos adicionales que no se encuentren en el medio de instalaci",
        "tem a g",
        " to narz",
        "NW0~0Y0",
        "4 4@4L4l4t4|4",
        "k, hogy r",
        "elite ",
        " ne ocup",
        "ci wolnego miejsca. Wybierz inny dysk i spr",
        "va vyhrazena.",
        "li trvat.\\Konfiguruje se aktualizace pro Windows 10.",
        "est produit, mais nous avons ",
        "ra installationen av Windows.",
        "er un support d'installation (cl",
        "re de",
        " elemek m",
        "sit p",
        "anas j",
        "Otvori preuzimanja",
        "DigitalProductId4",
        ", aby se otev",
        "ie funkcie a vylep",
        "o atual do Windows usando uma chave do produto e selecione Atualizar.",
        "0'YM0D0",
        "rgmisega: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-Bitlockeri v",
        "%2!s!6Votre organisation g",
        " compat",
        "ration peut prendre un certain temps.DVeuillez patienter pendant la fermeture du programme d",
        "x}N_s",
        "[[[V[MMVMO@@>%\"\"\"=",
        "|Emme pysty selvitt",
        "CSpinningProgress",
        "/@$$?/",
        "Windows 10 na ovom ra",
        "8R8z8",
        "ioneze. Dup",
        "6366666/636636#2",
        "s recientes de Windows 10 en el equipo debido a que el espacio en disco es insuficiente. Sigue las instrucciones a continuaci",
        "Provjera preuzimanja&Odaberite medije koje ",
        " Twojej uwagi przed kontynuowaniem instalacji.fKlucz funkcji BitLocker ma nast",
        "t nem fogjuk tudni onnan folytatni, ahol abbahagytuk, ",
        " Windows 10>",
        "re connected to the Internet and try running the tool again.%There was a problem running this tool",
        "be Windows Update.",
        "%4!s!",
        ", negal",
        " gata pentru acest PC%Se verific",
        "tus ier",
        " hardware avansat; unele caracteristici existente au fost modificate sau eliminate; Windows 10 este actualizat ",
        "nite miesto a potom to sk",
        ".?AV?$CZeroInit@V?$CDlpAutoDelayLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@$00@@",
        "iului-disc redus. Urma",
        " nav aktiviz",
        "%2!s!+Organisaatiosi hallinnoi p",
        "laitteistoa, ja joitakin aiempia ominaisuuksia on muokattu tai poistettu. Windows 10 p",
        "ne muu v",
        " pe suportul de instalare.",
        "uNPPV",
        "CheckHotPluggableDriveEx: Drive %c SetupDiGetClassDevs Error: 0x%X",
        "bnes. ",
        "te spu",
        "IDATu",
        "Die Informationen, die zum Fortsetzen der Windows-Installation erforderlich sind, wurden nicht gefunden. Starten Sie Setup neu, um es noch mal zu versuchen.lSetup konnte die Installation von Windows nicht starten. Starten Sie Setup neu, um es noch mal zu versuchen.",
        "Isso pode levar algum tempo.bConfigurando a atualiza",
        "Pen USB",
        " bir Windows 7 veya Windows 8.1 kopyas",
        ">W@H;",
        "ra om datorn kan k",
        "i din nou instrumentul.1A ap",
        "no snimite ISO datoteku na DVD koriste",
        ", morate vnesti veljaven klju",
        ":+:?:Q:a:q:y:",
        "traukti ",
        "anje in obdr",
        "nek tov",
        "unlar",
        "n set",
        "OH0O0`0U0D0",
        "kolik minut trvat.^B",
        "kernel32.dll",
        "psake installikandjal faili Setup.exe.yMe ei saa kindlaks teha, kas teie arvuti on Windows 10 installimiseks valmis. Proovige installiprogramm uuesti k",
        "o do Windows e execute o comando ",
        "Liko 1 simbolis4Produkto kod",
        "re Windows 10. Lukk installasjonsprogrammet, og pr",
        "dzu, atveriet atkritni manu",
        " grunn av for lite diskplass. F",
        "te de la ",
        "ra preinstall.cmd-skript.2Det var problem med att k",
        "SetTextColor",
        "Pokra",
        "iunii %2!s!",
        "|\"$5'o",
        "tfen Geri D",
        "nner.",
        "zdeki b",
        "CSetupResponseTemplate<class IDlpResponse>::GetResultsRoutine",
        "ou se ",
        "o inform",
        "tetreiber und zus",
        "ete na internet, aktivira",
        "strez fi",
        " spos",
        "Uyumlulu",
        "Unable to get Volume Information for Drive %c",
        "vel em seu idioma e sua arquitetura atuais.",
        "Ako nastavite i pored toga ",
        " PC-ul poate rula Windows Server 2019. ",
        "emo da utvrdimo da li je ra",
        "ReleaseMutex",
        ": XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX",
        "By|||",
        ".#Windows ",
        "$Ohrani osebne datoteke in aplikacije",
        "-e ezen a sz",
        "Setup wird vorbereitet ",
        "o mais recente para continuar.2Baixar a Ferramenta de Cria",
        "titi podataka, PC trebate dr",
        ".tls$ZZZ",
        "=/=h=z=",
        "metros de linha de comando inv",
        "5(5-5X5r5",
        "n porque Windows no puede reiniciar el equipo. Cierra cualquier programa que se est",
        "chten, m",
        " cifrada con BitLocker. Elige otra unidad e int",
        "unalo i dovr",
        "k 3 GB boyutundad",
        ".?AVCHtmlEventSink@CSetupResponsePageCompat@@",
        " soubory a aplikace, budete se muset pod",
        " plusieurs reprises. Cette op",
        "unalnik smo povrnili v stanje, kot je bilo pred name",
        "m Kutusu'nu A",
        "lreiz ievadiet produkta atsl",
        "elda, kas teie arvuti on Windows Server 2019 installi j",
        "anas pabeig",
        " zasob",
        " verze Windows je mo",
        "rende versjonen av Windows, m",
        "i asisten",
        "4Z4`4g4m4",
        "ppna mappen H",
        "hendab, et peate sisestama allolevale v",
        "IDR_SETUP_FONT",
        "lupulka, SD-kaarti v",
        "r att h",
        " dosyalar indirilirken sorun olu",
        "CSetupLangIniLoader::Initialize: Cannot set current directory to '%s'. (hr = 0x%x)",
        "iS[WWWO]",
        " sa nena",
        " se vor genera costuri suplimentare.+Care sunt celelalte op",
        ".?AVCSetupDialogSplash@@",
        "CSetupResponsePageBase",
        " da biste nastavili instalaciju.",
        "Poder",
        " hardv",
        "Pobieranie aktualizacji Za chwil",
        "vZGWg",
        " je pripraven",
        "CInstallUI::SwitchToResponsePage",
        " se conectar ",
        "Az USB-meghajt",
        "%hs: Failed to generate compat report. HRESULT = 0x%08x",
        "Windows Server 2019 Setup$Restarting Windows Server 2019 Setup",
        "H0f0J0O0",
        " aus, um die Installation fortzusetzen.",
        "4(444@4L4X4d4p4|4",
        "ivitykset on asennettu, mutta Windows 10:n asennus on k",
        "&Sule*Teie arvuti taask",
        "=Klargj",
        "z bu s",
        "Din pc genstartes flere gange. Det kan tage lidt tid.",
        " tiettyj",
        "&Teclado Virtual",
        "o), precisar",
        ", USB-",
        "0h0M0k0S0n0",
        "ku, rad",
        " indiremedik. ",
        "ici olarak geni",
        "hakemistossa.",
        "A obter atualiza",
        "P@O@O@=83",
        ".7Windows Server 2019 ",
        "ovat, proto",
        "i kaudu.",
        "Lee esto para que sepas lo que est",
        "tina atsisi",
        "Suggerimenti per la risoluzione dei problemi",
        "3/3J3",
        "rias vezes. Isso pode demorar um pouco.)Aguarde enquanto a instala",
        "Naozaj chcete skon",
        "re going to upgrade from Windows 7 or Windows 8.1 or you",
        "ice sistema Windows 10",
        "o do Windows. Reinicie a Configura",
        "e instalirati Windows 10aNa ra",
        "ed upgradem mus",
        "vel. Voc",
        "Why am I seeing this?",
        "<,<0<4<8<<<@<D<H<L<P<T<X<\\<`<d<l<",
        "Uklonjivi pogoni",
        ">Download der neuesten Version von Windows",
        "rze neu gestartet.",
        "ra van sz",
        " criar e, depois, executar a m",
        "strojem BitLocker. Zvolte jinou jednotku a zkuste to znova.",
        "BitLocker ",
        "r Windows laddar ned uppdateringar",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::InitializeRoutine",
        "Oppgrader denne PCen n",
        "ldre installationsfilerna",
        "kkulcsot megadni.",
        "gle, eller k",
        "ams(i) %1!d!",
        "1W2e2n2w2",
        "cia sa ukon",
        "llningar.>Dina inst",
        "yyyooo@@@",
        " system Windows 10 po aktualizacji.",
        "tirilmemi",
        "terek",
        "ita s funkcijo BitLocker bo med tem posodabljanjem za",
        "%hs!%p: ",
        "Se verific",
        "50545L5P5h5x5|5",
        "}?&ml",
        "Quasi pronto",
        "g 1 karakter maradt&A term",
        " semelhante a: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX6A chave do bitlocker s",
        "m aktivujeme syst",
        "yor. Ba",
        "jabb telep",
        "$hmtxO",
        ", om Windows Server 2019 er klar til din pc endnu. Luk installationsprogrammet, og pr",
        "*$$$$$$))",
        "ConX::Setup::Common::COSInfoHelper::GetHostOSSKUInfo",
        "installation.#Cela peut prendre quelques minutes.~Vous ne pourrez pas utiliser votre PC durant l",
        "mKdT]",
        "tNu reu",
        "GetObjectW",
        "en er fjernet.",
        "nda muud v",
        " intereseaz",
        "&Refresh",
        "ga nedarbojas. M",
        "rtus ei sobi, sisestage ",
        "CInstallUI::ShowProgress: Ignoring since error page is shown",
        "0 0/0<0V0e0",
        "6'7y7",
        "Segoe UI Bold",
        " ajut la perfec",
        "mies, vai instal",
        "mas Windows 10 instal",
        " att installationen kan forts",
        ".?AVbad_alloc@std@@",
        "ilo se otev",
        "kkelenNInstallasjonsprogrammet kan ikke fastsl",
        "got hindrar installationen fr",
        "Kaut kas noticisNLai instal",
        "n en el medio de instalaci",
        "+;8`R",
        "lis karakterb",
        "pM`|S|||||Q|S|Q",
        "Kontrollerer denne n",
        "ili./Na tomto po",
        " de produit ne peut ",
        "tu Windows",
        "s\"Mantieni i file personali e le app6Mantieni le impostazioni di Windows e i file personali",
        ";3;B;I;O;T;`;k;",
        "%c:JTietokone k",
        "[M:^Z",
        "Installing this edition of Windows 10 will configure your PC to run in S mode. Choose this edition only if you are installing Windows on a PC designed to run in S mode.UThe USB flash drive must be at least %1!d! GB or larger. Please select another drive.",
        " proizvoda nije ispravan. Poku",
        "t install the latest Windows 10 features and security improvements on your PC due to low disk space. Follow the instructions below to complete the update.'Free up %1!s! on your PC (%2!c!: drive)ESelect or connect an external storage device with at least %1!s! free",
        " nejsou na instala",
        "na go u",
        " sitten uudelleen.;Joidenkin tiedostojen lataamisessa palvelimesta oli ongelma",
        "n.(No pudimos instalar Windows Server 2019.fRevertimos tu equipo al estado en el que estaba justo antes de empezar a instalar Windows Server 2019.@Vamos a seguir instalando Windows Server 2019 en Windows Update.",
        "no odprite ko",
        "2!2)2x2",
        "trehoz",
        "iTXtXML:com.adobe.xmp",
        "fremdrift",
        "netir.",
        " produkta atsl",
        "tres %d%%",
        "jes automatisk%Produktn",
        "delmet, az akkor lesz ism",
        "Errore imprevisto dell'installazione di Windows. Verifica che le origini di installazione siano accessibili, quindi riavvia l'installazione.",
        " jour et reprendra quand vous vous connecterez ",
        "%d tegn tilbage Bindestreger tilf",
        "omu by ste mali venova",
        "oare f",
        "po aktualizaci pak Windows",
        "k sedan installera igen.",
        "es#Estamos a fazer alguns preparativos",
        "tor cu aceasta: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "i vanjski pogon pa kliknite \"U redu\" da biste ponovno pokrenuli ra",
        "Windows 10 installeren",
        "Tikrinti suderinamum",
        "??1type_info@@UAE@XZ",
        "rgmise identifikaatoriga: #Windows vajab v",
        "i instalarea.",
        ">:>R>j>",
        "e to chv",
        "jo disku un noklik",
        "Mai multe informa",
        "it. Inscrip",
        "t)Windows 10 se n",
        "s seguro de que quieres salir?",
        "i cheia de produs Windows 10 mai jos sau s",
        "ljer att inte acceptera licensvillkoren avslutas installationen.gMinst 350 MB ledigt utrymme kr",
        "a sa odstr",
        "SYSPREP_SPECIALIZE",
        "o mais recente{Uma vers",
        "737L7a7~7",
        ") olu",
        "3\"3*30363B3Z3_3x3",
        "eMediaFormat",
        " jour&Se connecter en tant qu",
        ". %1!s!",
        "CInstallUI::OnActionChanged: Exit is requested. Ignoring OnActionChanged",
        "Schalten Sie den Computer nicht aus.",
        "Otvori DVD snima",
        " denne PC-en for f",
        "e funkcije su izmenjene ili uklonjene; Windows 10 se automatski a",
        "Weiter",
        "rankai nepavyko patikrinti produkto kodo;S",
        "nda daha fazla bilgi i",
        "=4=H=Q=a=j=",
        "as %d rakstz",
        "Prenos",
        "te, su kuo sutinkate.",
        "1UwL-\"",
        "SelectImage: Available Image index [ %ld ] -> [ %ld ]",
        "Installasjonsprogrammet for Windows vil koble til for ",
        " online per recuperare aggiornamenti, driver e funzionalit",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
        "Preveri zdru",
        "s izmantojat. Windows 10 instal",
        "?'?5?S?d?",
        "Avaa1Haluan k",
        "jumus, draiverus un papildu l",
        "ekajte:Do",
        "pte online, p",
        "m jste u",
        "KZZYYYYUYob~",
        "i dost m",
        "Continuar de onde eu parei",
        "Instalando o Windows 10@Seu PC ser",
        "Abrir Downloads$Abrir Configura",
        " parametruose, kad pa",
        "<1<@<Q<e<u<",
        "dv-MV",
        "nainte de a actualiza. V",
        "3IDATx",
        "PJ1>6",
        "kleFWindows y",
        "ene pre po",
        "<5H$?",
        "PPPPPPPPh",
        " stato installato e attivato in precedenza in questo PC e lo stai reinstallando, puoi ignorare questo passaggio. Windows verr",
        "2==ed2",
        "L'operazione potrebbe richiedere alcuni minuti.",
        "tat de pr",
        "N!@|V",
        "teva momente pentru a verifica dac",
        "nea de comandos. Para obtener m",
        "Updates werden abgerufen$Wir bereiten gerade einige Dinge vor",
        "r Windows 10 fut",
        "m9Pri sp",
        " sa vr",
        "a:Kja/ h`:KjaRich;Kja",
        "buj ponownie.<System Windows 10 nie jest jeszcze gotowy dla tego komputera'Sprawdzanie, czy instalacja jest gotowa",
        " futtat",
        "rio reiniciar a Configura",
        "0 0$0(0,0004080<0@0D0H0\\0`0x0",
        "i conectat la internet ",
        "dvendige filene. Kontroller at du er tilkoblet Internett, og pr",
        "%1!s! %2!s!'",
        "llningarna om du vill ta bort andra stora objekt.",
        "Co chcesz zrobi",
        "anom direktorijumu, ili poku",
        "Sfaturi pentru depanare",
        "Kontrola pripravenosti na in",
        "m na z",
        "i ocupat deja de acesta. Face",
        "ti, bet, lai tie darbotos, Windows Server 2019 iestat",
        " Windows 10z",
        "ili. Kliknite na dugme ",
        "lection du lecteurDLe programme d",
        "i folderul Desc",
        "= =$=(=,=0=4=8=<=@=D=H=P=T=X=\\=`=d=h=l=p=t=x=",
        " joitakin minuutteja.rEt voi k",
        "{:gv^",
        "installation de Windows",
        " naujo paleiskite kompiuter",
        "in kullan",
        "lo je do problema pri preuzimanju nekih datoteka",
        "t uzst",
        "9>:H:",
        "unalniku name",
        " naujo nuo prad",
        "re i S-modus. Velg denne utgaven bare hvis du installerer Windows p",
        ", je ",
        " un arhitekt",
        "cuter Windows Server",
        " i podaj ten kod b",
        " program Windows Servera 2019",
        " recente di Windows 10/L'operazione potrebbe richiedere alcuni minuti.iNon ",
        " opera",
        "lerleme durumu: %%%1!d!BDevam etmek i",
        "Kalba:",
        "Provera spremnosti za instalaciju",
        "o de continuar. Leia as informa",
        "Unesite ",
        "unar spreman da nastavi instalaciju izdanja Windows Server 2019. Poku",
        "Windows 10 Installation",
        "e potrajati nekoliko minuta.^Priklju",
        "ne popravke, a",
        "kkelen inneholder bare 48 digitale tegn.",
        "installation.|Nous avons besoin d",
        "r att de ska fungera. Efter omstarten forts",
        "UFalha ao abrir a pasta de transfer",
        "GetLanguageMediaNumber: LANG.INI not found. Path = '%s'. (hr = 0x%x)",
        "i je po",
        "Bu bilgisayara Windows 10'u ilk kez y",
        "%1!d!%% dovr",
        "ciou e",
        "t need to enter a product key.",
        "(-4CFIOOPZZNNYNNnb_",
        " mere at vide",
        "Prihl",
        "Elegir qu",
        "imdi ba",
        "n mod automat ",
        "co se staloQPokud chcete nainstalovat Windows 10, klikn",
        "Gaunami naujinimai",
        "8l9{9",
        "luseadme valiminexUSB-kettal olevad failid kustutatakse. Nende failide s",
        " anteriormente en este equipo y lo est",
        ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpResponse@@@@@@",
        " je syst",
        "kog okvira nije valjan\"Ne mo",
        " de cea pe care o utiliza",
        "Architekt",
        "n a Windows r",
        "Als u doorgaat zonder uw huidige versie van Windows te activeren, moet u een Windows 10-productcode of -licentie kopen om Windows 10 na de update te activeren.",
        " pomocou t",
        " helyet, am",
        "kselt",
        " do systemu Windows przy u",
        "ppp@@@ppp",
        "SvQ-N",
        "tson fel lemezter",
        "#%%%c",
        "yti ISO fail",
        "Falls Sie Windows 10 erstmalig auf diesem PC installieren, m",
        " votre PC ",
        "+Codice di errore: 0x%1!lX! - 0x%2!lX!",
        "n func",
        "ovat v instalaci Windows Serveru 2019. Zkuste restartovat instala",
        "REGISTER_SYNC_PROCESS",
        "ber eine getaktete Verbindung erfolgt, ",
        "ahovania aktualiz",
        "hlen Sie diese Edition nur, wenn Sie Windows auf einem PC installieren, der f",
        "FFFGlw",
        " se desf",
        "cznie plik ISO na dysku DVD, u",
        "kinkite, ar reik",
        "lacak.",
        "Grabe el archivo ISO en un DVD",
        "d9{ uy",
        "Ne zdaj",
        "ne takto: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX1K",
        " kurulum dosyalar",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::SerializeRoutine",
        "~||xp",
        "o conseguimos guardar as informa",
        "tu sist",
        "tre d",
        "unaru ima dovoljno prostora za nastavak instaliranja izdanja Windows 10. Poku",
        "e se koristiti za instaliranje operativnog sistema Windows.",
        "%c:HRa",
        "ete ISO datoteku na DVD.",
        "ete morati ponovno instalirati neke dodatne zna",
        "do, incluindo arquivos, aplicativos e configura",
        "FveOpenVolumeW",
        "uded on t",
        "ck(WM",
        "nda Setup.exe",
        "z haz",
        " acorda",
        "Opdateringerne er installeret, men Windows Server 2019 Installation skal genstartes, for at de virker. N",
        "o de armazenamento nas defini",
        "{nsZ#cS",
        "CInstallUI::ShowProgress",
        "Spremni steCInstalaciju izdanja Windows 10 nastavi",
        "gle\"Angiv BitLocker-n",
        "tilanne",
        "El idioma no coincide",
        "6(666Y6u6",
        "CSetupResponsePageEula",
        "llningar.",
        "Instalarea Windows a ",
        "ke: 0x%x]APri instalaciji sustava Windows pojavila se neo",
        "Detta kan ta n",
        "ration peut prendre quelques minutes.wNous n",
        " +++a",
        "no otvorite Ko",
        "W0f0O0`0U0D0",
        "Verificando se h",
        "nky odm",
        "8+9r9",
        "Product key",
        "Updates ",
        "i set",
        "cia zlyhala vo f",
        "e. Appuyez sur continuer1Choisir un autre p",
        "inizden emin olman",
        "wiadczenia pomocy technicznej. Pomoc techniczna mo",
        "tartujte In",
        "To lahko traja nekaj minut.}Vseh potrebnih datotek ni bilo mogo",
        "Oc0f0 ",
        ", jotta tied",
        "Kettasektsioon",
        "hr wie folgt aus: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXYK",
        "3$3(3<3L3P3`3d3h3",
        " pronto para o seu PC. Feche a Configura",
        "i putea gestiona set",
        "iniet citu atsl",
        "Opdatering til Windows 10GLagerforbruget kunne ikke ",
        "CSetupResponseTemplate<class IActivationActionResponse>::OnBack",
        "owym znakiem",
        "Ako vas zanima obja",
        "v derefter igen.",
        "0W0f0D0~0Y0-",
        "cznie przejrzyj u",
        "iu suficient)Continua",
        "sta om du vill ladda ned de senaste installationsfilerna.",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::GetState",
        "Infelizmente, estamos com problemas para determinar se o Windows 10 est",
        "w licencji, instalacja zostanie przerwana.wDo uruchomienia Instalatora potrzeba co najmniej 350 MB wolnego miejsca. Zwolnij miejsce, a nast",
        "to se dogodilo, ali ne mo",
        "t.qNepodarilo sa n",
        ", kad b",
        ". Tarkista se ja yrit",
        "Wybieranie obrazu",
        "n no pudo cargar los recursos de idiomaGEl programa de instalaci",
        " jour votre PC|La langue ou l",
        "\"ID de bo",
        "6`6{6",
        " suorittaa tietokoneessasi. Sulje asennusohjelma ja yrit",
        ".?AVCSetupDlpResponseFactory@@",
        "INSTALL_RECOVERY_IMAGE",
        "n den punkt d",
        "Fazendo alguns preparativos1Essa ferramenta n",
        "Sleep",
        "RegEnumValueW",
        "GetTraceEnableLevel",
        "CSetupResponsePageDiskSpaceReq::OnCleanMgrLinkClicked",
        ", mihin se sinulta j",
        "te probl",
        "0(181K1^1n1",
        "uvi internetam. Noklik",
        "10. Para ayudar a proteger tus datos, conserva el equipo contigo hasta que vuelvas a iniciar sesi",
        " luettelo ja yrit",
        "iimis.HUSB-m",
        " on teht",
        "Wszystko jest gotoweLInstalacja systemu Windows 10 b",
        "are disc.",
        "ga-IE",
        "paration",
        "jjk`jjk",
        "Henter opdateringer",
        "zda %1!s! bo",
        "s turpin",
        ">YYYKKKp",
        "fen Sie ihn, und versuchen Sie es erneut, oder verwenden Sie einen anderen Schl",
        " prawid",
        "Jetzt Upgrade f",
        ": https://aka.ms/windowsserverupgrade<",
        "rste gang, skal du angive en gyldig produktn",
        "zh-CN",
        "tfen Windows y",
        " den h",
        " nytt, fortsetter vi der vi avsluttet.$Denne PCen kan ikke kj",
        "z), bir Windows 10 ",
        "ver mer utrymme f",
        " en pc, der er designet til at k",
        "ditions sont incompatibles ;",
        "n Windows 10",
        ".text$di",
        "Priprema %d%%",
        "m seama dac",
        " et activ",
        " activado en el equipo. Esto quiere decir que necesitar",
        "tendre temporairement votre disque dur pendant l'installation des mises ",
        "t vesz ig",
        "=1=O=l=",
        " ir tikai 48 rakstz",
        "m polo",
        "SetBrushOrgEx",
        "o6%1!d!GB de espa",
        "v igen.%Windows er ikke aktiveret p",
        "z var. Biraz yer a",
        "vien kohteiden Windows 10 -yhteensopivuuden tarkistaminen voi kest",
        "000;0O0X0c0q0{0",
        " zgodno",
        "Turpin",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::InitializeRoutine",
        "DataOnlyChecked",
        "buj uruchomi",
        ": %1!d!%% ",
        "CSetupResponsePageDiskPartition",
        "O@Pj Z",
        " @H!BXo",
        "avo, nato pa znova za",
        "0@ $A0",
        "installation",
        "prava: %d %%.$P",
        " Windows Server 2019e",
        "ru-MD",
        "ie faili tiks izdz",
        " Neste for ",
        "paration de l",
        " riuscito a determinare le scelte di installazione supportatePIl programma di installazione non ",
        "i cheia Bit Locker pentru identificator: *Windows necesit",
        "essayez, ou essayez une autre cl",
        "Getting ready %d%%",
        "t&Izv",
        ".?AV?$CZeroInit@VCSetupResponsePageRecoveryReq@@$00@@",
        "zyk nie jest zgodny",
        "riista k",
        "Izbor putanje",
        "7&717",
        "Se caut",
        "u pri bezprobl",
        "Wprowad",
        "liwe korzystanie z komputera. Zapisz i zamknij pliki przed rozpocz",
        "hZkV/f",
        "ita resurse jezika5Instalacija nije uspela da pokrene radni direktorijum\"Neva",
        "ge, nyissa meg a telep",
        "ramazu",
        ".idata$2",
        "ovat.",
        "Pt<h%P",
        "s escribir la clave de producto de Windows 10 o que deber",
        " estoy viendo esto?",
        "teva ori. Procesul poate dura un timp.",
        "Pasirinkti vaizd",
        "ie in",
        "du.bNepavyko atidaryti DVD ",
        "elite odpreti ",
        "stup k internetu. Kliknut",
        "bbi teend",
        "-lo a obter os ficheiros mais recentes, de forma a garantir que instala a vers",
        "u adresi ziyaret edin: https://aka.ms/windowsserverupgrade",
        "ky Sta",
        "0g0W0_0",
        "1(111",
        "ckligt med utrymme f",
        " ter de reinstalar alguns idiomas e funcionalidades opcionais.",
        " %2!c!:",
        " utilizare, verifica",
        "i Windows 109Ob",
        "m Windows 10TPo",
        "ivati ra",
        "ilitamiseks tehke nendest m",
        "]Windows ",
        "i da je potrebno da u nastavku unesete ",
        "z.kKurulumu ",
        "Opdater liste over drev!Den skal v",
        "Valami megakad",
        "mpiedic",
        "ite spolja",
        "Niet akkoor&dKAls u niet akkoord gaat met de licentievoorwaarden, wordt Setup afgesloten.",
        "!Voit jatkaa tietokoneesi k",
        "r einen anderen PC erstellen",
        "Spazio insufficiente.Servono %1!d! GB di spazio su disco in (%2!s!)\\Rimuovi i file di cui non hai pi",
        "ivityksen ajaksi ja sit",
        "cutez le programme ",
        " veya kald",
        "ssen Sie die aktuelle Version herunterladen und ausf",
        "O0M0K",
        "gle kan kun bruges til at tilf",
        "ljale Windows 10 tootev",
        "ica sistema Windows morda name",
        "ra installationen av Windows b",
        "Lisans ko",
        "Mise ",
        "$$$0d~~>**",
        "0g0W0_0\"",
        "0!kn0Kb",
        "Installationen kan ikke forts",
        " kupi",
        " PC-en din, st",
        "erreur.",
        "su atjaunin",
        "sti vis",
        "BEGIN_FIRST_BOOT",
        ". XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX",
        "klemeye ",
        "s7Ha elutas",
        " danych migracji2Instalator nie mo",
        " Windows 10G",
        " systemu Windows 10.",
        "Bu arka plan indirmesi 4GB+ (de",
        "Por qu",
        " desea hacer?",
        "anai notikt raiti; tajos var b",
        "SiteLink",
        "Select a USB flash drivelThe files on your USB drive will be deleted. To keep these files, back them up now to another save location.",
        " non sono riuscito a riavviare il computer. Chiudi tutti i programmi aperti, quindi riavvia il computer. Riprender",
        "outil de cr",
        "Bu bilgisayar i",
        " a utilizar.",
        " podm",
        "Preuzmi\"Ponecha",
        "o foi poss",
        "progres",
        "installation et r",
        "ifrovania BitLocker funguje! Ke",
        "Ouvrir les T",
        "D$`+D$X",
        "elerin Windows 10 ile uyumlu olup olmad",
        "laikyti asmeninius failus ir program",
        "curit",
        ": %1!d!%%",
        "talujete teraz, v",
        "kas min",
        "lg sprog, arkitektur og udgave",
        "z de los medios de instalaci",
        "installation effectue un nettoyage avant sa fermeture.Cette op",
        "k igen.4Kontrollerar att datorn har tillr",
        "es, ne quittez pas votre PC tant que vous ne vous ",
        "darykite savo failus.(Palaukite, kol program",
        "Operacijski sustav Microsoft",
        "%hs(%d) tid(%x) %08X %ws",
        " dodato",
        "Izjava o zasebnosti za Windows",
        "i limba, arhitectura ",
        " Windows Server 2019`",
        ")Sto reinstallando Windows 10 in questo PC3Devo acquistare un codice Product Key di Windows 10",
        "rkeotsingu n",
        " https://aka.ms/windowsserverupgrade9",
        "ti-ER",
        "&Sule4Operatsioonis",
        "6>6y6",
        " cheie produs nu a func",
        "d pogre",
        "ntalo de nuevo.6Ejecutando scripts de implementaci",
        "elite instalirati Windows.",
        "ovanie in",
        "CSetupResponseTemplate<class IDiskSpaceActionResponse>::OnCancel",
        "owe parametry wiersza polecenia",
        "en-SG",
        "Izberite pogon USBfDatoteke na pogonu USB bodo izbrisane. ",
        "e datoteke, da boste lahko namestili najnovej",
        "inokite daugiau",
        ")(3CTq",
        "ane izbore instalacije<Instalacija nije uspela da proveri valjanost ",
        "Er is meer ruimte nodig,Er is %1!d! GB schijfruimte nodig op (%2!s!){Verwijder bestanden die u niet langer nodig hebt of gebruik Schijfopruiming om ruimte vrij te maken en probeer het opnieuw.IEr is een probleem opgetreden bij het downloaden van een aantal bestanden",
        "daryti0J",
        "SW0~0Y0",
        "TranslateCharsetInfo",
        "nliche Dateien behalten Nur pers",
        "unaru ima dovoljno prostora za nastavak instaliranja izdanja Windows Server 2019. Poku",
        "iri de securitate Windows 10 pe acest PC din cauza spa",
        "\\\\.\\Z:",
        "&Naujinti",
        "AcquireSRWLockExclusive",
        "5 5(50585<5D5H5P5T5X5`5d5h5p5x5",
        "pne DVD-brenner",
        "Een ogenblik geduldNEr is een probleem opgetreden bij het uitvoeren van scripts in preinstall.cmd.MEr is een probleem opgetreden bij het uitvoeren van scripts in precommit.cmd.",
        "ta zahteva va",
        "ordinateur pour continuer l",
        " Windows 10 ",
        "@@@```@@@   ",
        "e namestitvene datoteke. Lahko vam pomagamo pridobiti najnovej",
        "https://go.microsoft.com/fwlink/?LinkId=532930",
        "Za&mknij,Nie mogli",
        "JaaZ92-,+",
        "%s GBqNo sabemos si tu PC tiene espacio suficiente para seguir instalando Windows 10. Intenta reiniciar la instalaci",
        "Pri namestitvi sistema Windows je pri",
        "PreuzimanjaCUklanjanje velikih ili neiskori",
        " on osoitteessa https://aka.ms/windowsserverupgrade",
        "Kriipsud lisatakse automaatselt#Tootev",
        "ll bara personliga filer",
        "0r (`l",
        "*No podemos encontrar una unidad flash USB.",
        "teni fogjuk a tov",
        "r vi slutade.0Den h",
        "P&rija",
        "ilitada, sest valisite %1!s! installimise m",
        "ste vara inloggad i Windows med ett administrat",
        "2019 n'est pas encore pr",
        "no otvorite skladi",
        " pronto per il PC. Chiudi il programma di installazione e riprova.#Windows non ",
        " de introduzir a chave de produto do Windows 10 indicada abaixo ou sair da configura",
        "bs-BA-Cyrl",
        "ktan sonra kald",
        "ISO-fil",
        ".?AVCSetupPageProgress@@",
        "N~0g0",
        "ra ett medium f",
        "10.0.19041.572 (WinBuild.160101.0800)",
        "vHr,gMb",
        "https://go.microsoft.com/fwlink/?LinkId=521839&clcid=0x%x",
        "0Estou reinstalando o Windows 10 neste computador@Preciso comprar uma chave do produto (Product Key) do Windows 10",
        "rebilir.hGerekli olan dosyalar",
        "y zmodyfikowane lub usuni",
        " Windows Update.",
        "hPlease remove the following external drive, and click OK to reboot and complete installing Windows.",
        "emo prona",
        "Windows 10 wordt al uitgevoerd",
        "Download",
        "Algo aconteceuRPara instalar o Windows 10, clique em Setup.exe no suporte de dados de instala",
        " nytt.!Windows er ikke aktivert p",
        "idetud! Vajutage nuppu J",
        "i kasutamata failid oma allalaadimiste kaustast.",
        "Alterar o que deve manter",
        "dCSetupResponsePageBitLockerKeyValidate::OnMaxLengthExceeded",
        "es e aplicativos ser",
        "z ve ",
        "Setup.exe",
        "r inte att beh",
        "to to vidim?",
        "ini denetleyin..G",
        "Soporte",
        " Windows!",
        "Avaa tallentava DVD-asema",
        "o e, em seguida, selecione Atualizar.",
        "CInstallUI::ShowHelp",
        "=)=2=",
        "veis e reinicie a instala",
        " Setup.exe",
        "Velg partisjonen du vil installere Windows p",
        "i da upravljate i kasnije.LVa",
        "jra a g",
        "445<5T5\\5t5",
        "ma Windows 10 v",
        "Ulteriori informazioni",
        "===%_",
        " nem tudta ",
        "SetEvent",
        "@@@@@@```",
        "Dette kan ta en stund.\\Konfigurerer oppdatering for Windows 10",
        "gebbi telep",
        "tkate oma praegust Windowsi versiooni aktiveerimata, peate p",
        "g/%1!d! GB szabad helyre van sz",
        ".?AV?$CUnknownImpl@VICompatActionResponse@@@@",
        "imdi y",
        "&Odustani",
        "e da potraje. Sa",
        "n en Windows Server 2019. Para ayudar a proteger tus datos, mantente cerca del equipo hasta que tengas que volver a iniciar sesi",
        "Izbor jezika, arhitekture i izdanja",
        ";0;@;P;T;X;l;p;",
        "it deschiderea utiliz",
        "RRRBR.H",
        "Mums neizdev",
        "CSbR0",
        "Sg0M0~0[0",
        " ir instal",
        " en az %1!d! GB veya daha b",
        "Deze code controleren4Deze sleutel werkt niet. Probeer een andere sleutel.",
        "ksnes juhul, kui teie arvutisse on installitud Windows 7 v",
        " jour maintenant, votre PC risque de ne pas fonctionner correctement apr",
        "Checking for updates",
        "i doar fi",
        "t star",
        "2 2$2(2,20282<2@2D2H2L2P2T2X2\\2`2h2|2",
        "USB-Speicherstick ausw",
        "cii, mus",
        " var tikt piem",
        "0@J$A0",
        " Windows Server 2019. Zatvorte in",
        "mauWindows izdevums, kas atbilst j",
        "zellik eklemek i",
        "=!=)=r=",
        "alej, obr",
        "Installationsprogrammet rensar upp innan det st",
        "ny adatot.8A telep",
        "lla dina filer, appar och inst",
        "unuzdan emin olun ve yeniden deneyin.0preinstall.cmd da",
        "ojums par konfidencialit",
        "Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11CF-8B85-00AA005B4383}",
        "r klar et par ting(Dette verkt",
        "Gizlilik bildirimi",
        "rification de l",
        "RvPqX",
        "pne papirkurv",
        " verzi Windows.dNa jednotce, kterou chcete pou",
        "ppp@@@@@@@@@",
        "relmet",
        "UIt may take a few moments to check if you want to keep is compatible with Windows 10.bThis product key can only be used to add features to Windows. It can",
        "m acest instrument pe PC-ul dvs. Dac",
        "vas vietas. Atbr",
        " verificato un problema durante la creazione del supporto}L'edizione di Windows corrispondente al codice Product Key immesso non ",
        "2/2?2b2",
        "diegtum",
        "Inget",
        "nd ISO-filen til en dvd",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::GetResults",
        "dium, kter",
        "Si vas a actualizar Windows 7 o Windows 8.1 o si vas a reinstalar Windows 10, no necesitar",
        " Windows Server 2019. For at beskytte dine data b",
        "Se voc",
        "m reinstalling Windows 10 on this PC&I need to buy a Windows 10 product key",
        "re installasjonen av Windows bedre",
        "ili instalaciju sustava Windows.",
        "tter installationen av Windows Server 2019 i Windows Update.",
        "rt.&Kravene er fullf",
        "m Windows restartuje po",
        "vW[CQ",
        "dan ud: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX.",
        "lni a telep",
        "rliecin",
        "IIDATx",
        "CSetupLangIniLoader::Initialize: Failed to get the language media number: index = %d. (hr = 0x%x)",
        "n como las aplicaciones, pero se conservar",
        "s abajo si quieres averiguar por qu",
        "\\vQ Rd",
        "as ier",
        "na posodobitev na Windows 10 je na voljo le v primeru, da imate v ra",
        "Dysk flash USB",
        "Unable to add Drive for selection [ %c ]",
        "Vl4Xp",
        "Schijfpartitie",
        "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        \"> <rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"> <rdf:Description rdf:about=\"\" xmlns:xmpMM=\"http://ns.adobe.com/xap/1.0/mm/\" xmlns:stRef=\"http://ns.adobe.com/xap/1.0/sType/ResourceRef#\" xmlns:xmp=\"http://ns.adobe.com/xap/1.0/\" xmpMM:OriginalDocumentID=\"xmp.did:D90530087960E411BA60B7344D705471\" xmpMM:DocumentID=\"xmp.did:3BD55BE8700111E490F3D68815013C20\" xmpMM:InstanceID=\"xmp.iid:3BD55BE7700111E490F3D68815013C20\" xmp:CreatorTool=\"Adobe Photoshop CS6 (Windows)\"> <xmpMM:DerivedFrom stRef:instanceID=\"xmp.iid:977B7B345161E4118595B3E1319A734E\" stRef:documentID=\"xmp.did:D90530087960E411BA60B7344D705471\"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end=\"r\"?>",
        "dzie konieczne.",
        "De installatie van Windows kan niet worden voortgezet, omdat de benodigde installatiegegevens niet zijn gevonden. Start Setup opnieuw om het opnieuw te proberen._De installatie van Windows kan niet worden gestart. Start Setup opnieuw en probeer het opnieuw.",
        "unalnika. Preden za",
        "Windows 10 installeren9Updates, stuurprogramma's en optionele onderdelen ophalen",
        ".oCette cl",
        ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskSpaceActionResponse@@@@@@",
        "o suficiente para continuar a instalar o Windows Server 2019. Experimente reiniciar a Configura",
        "se sprogressourcerne;Installationsprogrammet kan ikke initialisere arbejdsmappen",
        "sim atbr",
        "vate pripojenie ",
        " poursuivre l",
        "enje preinstall.cmd+Izvo",
        "jljai megmaradnak.LMinden t",
        " fjerne andre store elementer.",
        "000:0",
        "8==???//3",
        "MapWindowPoints",
        "%2!s!/Your organisation manages your update settings.",
        "z dilden farkl",
        "te si stiahnu",
        "SystemParametersInfoW",
        "&Zapri(Sistema Windows 10 nismo mogli namestiti_Va",
        "memset",
        "Acc&eptera inteHOm du v",
        "CoInitializeEx",
        "Lo que requiere tu atenci",
        ";&;-;4;;;B;I;P;X;`;h;t;};",
        ";2;G;c;v;",
        ", na kter",
        "`Y=.+",
        "sRimuovi l'unit",
        " criptografada com o BitLocker. Escolha uma unidade diferente e tente novamente.",
        " atualiza",
        "0?0N0W0v0",
        "Abrir Lixeira",
        " tomuto.",
        "tovat poplatky za p",
        "Apri Download\"Apri Impostazioni di archiviazione",
        "nju pre nastavka instalacije. Odaberite ",
        "tnete, instalace se ukon",
        "zdw^@l",
        "unar+Proveravamo da li je instalacija je spremna",
        ".zUporabe prostora za shranjevanje ni bilo mogo",
        "$bSr6'QF78S9",
        "une des options disponibles pour continuer.)Kreiranje medijuma sa izdanjem Windows 10(Slobodno nastavite da koristite ra",
        "i.0Windows 10:t",
        " naujo.",
        "#Windows 10 ",
        "gra saker att t",
        "laties dar",
        "Instaliraj Windows Server 2019",
        "+j*))!",
        "rXBGW",
        "jra a k",
        " probleme ",
        "Se pretende instalar o Windows 10 no PC pela primeira vez (ou instalar uma edi",
        "ndan Yenile se",
        "line (USB-muistitikku, DVD-levy tai ISO tiedosto) toiseen tietokoneeseen",
        "Izbiranje jezika, arhitekture in izdaje",
        "o instaladas, mas ",
        "PrepararQYa has solucionado el problema. Haz clic en Actualizar para quitarlo de la lista.fNos encontramos con un problema al intentar solucionarlo por ti. Actualiza la lista y prueba otra vez.",
        "Riprendi l'installazione",
        " Microsoft Corporation. All rights reserved.",
        "CSetupLangIniLoader::Initialize:     IsDefault         : %d",
        "tevajte spodnja navodila, da dokon",
        " preinstall.cmd se objevil probl",
        "ordinateur aura red",
        "Endre hva som skal beholdes",
        "t run down during the installation.",
        " lehet",
        "alinkite didelius arba nepanaudotus failus i",
        "te raz, skontrolujte inform",
        "n0eQKb",
        "{4cXx5",
        " installationsmediet. Hvis du ikke installerer disse opdateringer nu, vil computeren muligvis ikke fungere korrekt efter installationen, og du skal muligvis geninstallere nogle valgfrie funktioner og sprog.",
        "i ISO-fail) m",
        " dever",
        "dtexv",
        "Verificando o computador,Verificando se voc",
        "NW0~0W0_01",
        "Baixar atualiza",
        " mali ma",
        "Vous ",
        "jas kapcsolat haszn",
        "tfen bekleyin.",
        "0L0ckW0O0B0",
        " limpiando antes de cerrar!Esto puede tardar varios minutos.WConecte su equipo para asegurarse de que la bater",
        "Wijzigen wat u wilt behouden",
        "ivitykset tulevat voimaan. Uudelleenk",
        "ke: 0x%x]HInstalacija operativnog sistema Windows je nai",
        "ierele de pe unitatea USB se vor ",
        "%2!s!<J",
        ", kad pa",
        "oSi quieres instalar Windows 10 en otra partici",
        "reportgen.dll",
        "glen b",
        "Dette vil ta noen minutter.",
        " en PC som er utformet for ",
        "Nous avons restaur",
        "o, preste aten",
        ".?AVCInstallUIMessageWindow@CInstallUI@@",
        "dia do Windows 105Fique ",
        "|v||||",
        "eno: %1!ld! %%",
        "797U7d7s7",
        "dzie.4Wyst",
        "2019.JNous allons continuer ",
        "\"+6BUj",
        "glenQInstallationsprogrammet kan ikke registrere, hvilken version af Windows du k",
        "Open Recycle Bin",
        "installation termin",
        "cAo/6n",
        " system Windows 10 na komputerze po raz pierwszy (lub zainstalowa",
        "CompatInstallReq",
        "Se for atualizar do Windows 7 ou do Windows 8.1, ou reinstalar o Windows 10, n",
        "ll need to buy a Windows 10 product key or license to activate Windows 10 after the update.",
        "bujesz u",
        "CSetupResponsePageActivation",
        "rat a rendszermeghajt",
        "]_U(uHr,g",
        "ja saknes direktorij",
        "2019. Veuillez fermer le programme d",
        "i la internet, vom activa Windows pentru dvs.",
        "808E8",
        "SelectImage: Selected Image Index [ %ld ]",
        " aktualizace.",
        "ldre installationsfiler til Windows 10. Vi kan hj",
        "r redo f",
        "inynas",
        " Windows 10. For at beskytte dine data b",
        "te ni",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::Execute",
        "Noe hindrer installasjonsprosessen. G",
        "e se kada se prijavite u Windows Server 2019. Da biste lak",
        "Prijavite se kao administrator\\Da biste koristili ovu alatku, morate se prijaviti u Windows preko administratorskog naloga.1Mora",
        "`{veQ ",
        " naujinimas",
        "::........:40",
        "4&454t4",
        "ja izveide",
        "is kodas0",
        "o.3Verificando se seu computador tem espa",
        "Select language, architecture, and edition",
        "ti vai no",
        "&{}K~[",
        "r notiek izie",
        "ClientToScreen",
        "'Persoonlijke bestanden en apps behouden7Windows-instellingen en persoonlijke bestanden behouden&Alleen persoonlijke bestanden behouden",
        " funkcie (odpor",
        "FoQTT",
        "vesti nereik",
        "rios. Certifique-se de que est",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::Deserialize",
        "n de Windows Server 2019.?Continuaremos instalando Windows Server 2019 en Windows Update.",
        "t=Ja noraid",
        "<$<,<4<<<H<h<p<|<",
        "oDu skal fjerne f",
        "%1!d! %% fullf",
        "%c:@Dators tiks vair",
        "jies:",
        "rent votre attention. Choisir les ",
        "Deze updates zorgen ervoor dat de installatie soepel verloopt en kunnen belangrijke correcties, bijgewerkte apparaatstuurprogramma's en aanvullende bestanden bevatten die zich niet op het installatiemedium bevinden. Als u de updates nu niet installeert, werkt uw pc mogelijk niet goed na de installatie en moet u bepaalde optionele onderdelen en talen mogelijk opnieuw installeren.",
        "_ck(W2",
        "NHr,g)",
        "le6Uzst",
        "M^AWW",
        ".070x0",
        "akajte",
        "k valamelyike miatt:",
        "393c3",
        "n de unidad@El programa de instalaci",
        "kkulcs be",
        "%c:@Seu PC ser",
        "Tvarkome kelis dalykus",
        " necessario masterizzare il file ISO su un DVD pi",
        "kkelen fungerte ikke. Kontroller den og pr",
        "ordinateur",
        "9'9:9",
        "ivitysten, ohjainten ja valinnaisten ominaisuuksien hakemista varten. N",
        "&Accetta",
        "Megnyit",
        "lla 48 tecken.7Nyckelv",
        "es-MX",
        "ssen Sie keinen Product Key eingeben.!Der USB-Speicherstick ist bereit.",
        "lWY(u",
        "n y pueden incluir correcciones importantes, controladores de dispositivo actualizados y archivos adicionales que no est",
        "656T6s6",
        "Podpora",
        "bitlocker",
        "NWindows ",
        "em ra",
        "+Chcem namiesto toho pou",
        "Namigi za odpravljanje te",
        "anas norisei, un tie var ietvert svar",
        "to aktualizace pozastav",
        "Ikke behold noe",
        "ania w trybie S mode. Wybierz t",
        "o do Windows 10. Tente reiniciar a Instala",
        "[Codice di errore: 0x%x]HSi ",
        "essayez.4Windows Server 2019 jo",
        "> >$>(>,>0>@>H>L>P>T>X>h>",
        "%1!ld!%% baigta",
        " Windows 10h",
        "ajte ponovno pokrenuti postavljanje.~Na",
        "emami diski",
        "agZ USB k",
        "Ei nyt",
        "ra om datorn har tillr",
        "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a",
        "to se zatvori#Ovo mo",
        "nchidere",
        "lg et andet drev, og pr",
        "We are unable to continue due to one of the following:",
        "zu-ZA",
        "v igen.",
        "na verzija sustava Windows vjerojatno instalirana u nepodr",
        "m na tla",
        "bban m",
        ", DVD veya ISO dosyas",
        "Instalando Windows 10<Tu PC se reiniciar",
        " pro tento po",
        "R\"\"I9",
        "t personiskos failus un lietojumprogrammas2Patur",
        "Rxe!k",
        "i imaginea pe care dori",
        "emtu dz",
        "m nepoda",
        " neust",
        " ponownie klucz produktu kupiony w trybie online.",
        "inu rada.TUSB izmjenjivi pogon mora biti velik barem %1!d! GB ili vi",
        "r du ha PC-en med deg til du logger p",
        "PCen startes p",
        "mu Windows 10. Ke",
        "e.bOtvaranje kori",
        " Windows, izmantojot administratora kontu.",
        "si adatokat2A telep",
        "O0`0U0D0",
        "3Conserva los archivos personales y las aplicaciones\"Conservar solo archivos personales",
        "iile&P",
        "Server Core",
        "8,81878>8P8Z8",
        "Espere",
        " (%2!s!)c",
        "A&ceptar",
        "(%1!c!:) - %2!s! free",
        "e.<La configuration requise est termin",
        "ploiement failure.cmd en cours d",
        ">9>D>U>b>p>",
        "m: %1!s!",
        "dami pad",
        "?\"?M?U?b?x?",
        "emy pom",
        "t take command line arguments. For more information, see Setup Help or run \"setup.exe /?\" in the root directory of your installation media.",
        "=B>O>y>",
        "Flytbare drev",
        ")UCsatlakoztasson egy olyan k",
        "1,1;1^1",
        "valo duomenis",
        "O(uY0",
        ", Windows 10",
        " Internet e tente novamente.0Executando scripts de implanta",
        "CInstallUI::ShowRollbackMsg: Posted MSG_INSTALLUI_SHOW_ROLLBACK_PAGE",
        "Prijavite se kao administratorWDa biste koristili alat, morate se u Windows prijaviti pomo",
        "a$Kontrola pripravenosti na in",
        " beskytte dataene dine b",
        "ssen Sie zur Installation das Medium erstellen und anschlie",
        "elite prekinuti?",
        "Obtendo atualiza",
        "CSetupResponseTemplate<class IDlpResponse>::OnSuspend",
        "%3!s!=Riavvio del programma di installazione di Windows 10 in corso",
        "Nav eti",
        "Prima di chiudere il programma di installazione, viene eseguita un'operazione di pulizia",
        "9^Ht(",
        "Summary",
        "nn-NO",
        " len osobn",
        "te.|Va",
        "si be",
        "labilir. Windows",
        ",Windows Server 2019 ",
        "paration de certains ",
        "tani, hogy van-e el",
        "in Geri D",
        ".?AVCRtfHelpDialog@UX@Common@ConX@@",
        " Elementy wymagaj",
        " preinstall.cmd$",
        " stato possibile scaricare tutti i file necessari. Verifica di essere connesso a Internet e riprova.7Esecuzione degli script di distribuzione preinstall.cmd6Esecuzione degli script di distribuzione precommit.cmd4Esecuzione degli script di distribuzione failure.cmd*L'operazione pu",
        "s..Ce PC ne peut pas ex",
        "Ne rien conserver",
        "ivati va",
        "DeleteCriticalSection",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::DeserializeRoutine",
        "GLeoe",
        "rt! Trykk p",
        ", turite atkreipti d",
        "Termos de licenciamento",
        "re fois Windows 10 sur ce PC, vous devez entrer une cl",
        ", co se stalo, ale tento n",
        "chten.",
        "SetupDiGetDeviceInterfacePropertyW",
        "pa-Arab",
        "ku, kas atsitiko, ta",
        "rni&A term",
        "GB podatkov. ",
        " diegimo laikmenos ",
        "Odpri mapo Ko",
        "ce elementy.HPoni",
        "Andamento: %1!d!%%4Selecione uma das op",
        "jo Windows versiju, izmantojot produkta atsl",
        "A mover as suas defini",
        "1 caract",
        "Puede continuar usando su PC.",
        "ssel ein.4Geben Sie einen BitLocker-Schl",
        "d, ktor",
        "Sprache, Architektur und Edition ausw",
        "Nismo mogli najti informacij o namestitvi, ki jih potrebujemo za nadaljevanje namestitve sistema Windows. ",
        "VirtualQuery",
        "CSetupResponsePageBitLockerKeyValidate: DoDataExchange",
        "Voulez-vous vraiment quitter?",
        "ebovat k",
        " la execu",
        "tottak. A Windows 10 a t",
        "&Seuraava",
        "as tejto aktualiz",
        "3b2+b",
        "metros de l",
        "tted ja isiklikud failid$S",
        ")IgCMxC",
        "se eset",
        "\\\\\\[\\[[QQx8",
        "rvald",
        "t DVD vypalova",
        "sait ",
        "enite mo",
        "sd-Arab",
        ".Man ir j",
        " asennusohjelma uudelleen ja yrit",
        "am znova(Kupiti moram klju",
        ": certaines fonctionnalit",
        "USB-Speicherstick",
        "rge ilmnes toimingu \"%2!s!\" k",
        "```@@@@@@@@@@@@@@@",
        " yeniden bi",
        "!ID finestra di dialogo non valido-Non riesco a trovare il contratto di licenza.!Completamento operazione: %1!d!%%ZQuesto codice Product Key non funziona. Verificalo e riprova oppure immettine uno diverso.$Codice Product Key valido. Continua.",
        "km-KH",
        "cThe drive you",
        "Opret installationsmedier (USB-flashdrev, dvd eller ISO fil) til en anden computer",
        "\\\\.\\%c:",
        "&Nastavi",
        ">0>a>j>>?",
        ".?AVCSimpleWizardPage@UX@Common@ConX@@",
        "757B7X7e7",
        "DQyqGjH",
        " %1!s!",
        " poni",
        "o datoru t",
        "avancement : %1!d!%%6S",
        "000@@@",
        "buj ponownie.",
        "en Windows s",
        "re minst %1!d! GB eller st",
        " rije",
        "   ```   ",
        " jour Nous pr",
        "0g0n0",
        " disponibile una versione pi",
        " pod uwag",
        " nainstalovan",
        "pet. Z",
        "tu.=precommit.cmd komut dosyalar",
        "Ovo mo",
        "ju (USB zibatmi",
        ".?AV?$CZeroInit@VCSetupResponsePageInstallChoice@@$00@@",
        "i deja Windows 10)Aceast",
        "GZ+Ik\\",
        "!7La@+!",
        "re currently using.",
        " v in",
        "rz no",
        " PC-en for f",
        "N@b:y:",
        "s dette, s",
        "e se nastaviti.",
        "fen Sie, ob zus",
        "Preuzima se Windows 10",
        "0@0h0",
        "r Windows 10. Wir stellen Ihnen gerne die neuesten Dateien zur Verf",
        "\"Bindestreker legges til automatisk\"Kan ikke laste inn spr",
        "250701214655Z0|1",
        "t+VW3",
        "vat jenom k p",
        "te za %1!d! min.(Rzeczy, kt",
        "dajov",
        "Kontrollerar datorn",
        "liorer l'installation. elles incluent ",
        "kus Windows 10 instal",
        "i conectat la Windows cu un cont de administrator.>Va trebui s",
        " func",
        "tirmeler, s",
        "040404B0",
        "vofflps.rtf",
        "i actualiz",
        "ste du f",
        ", so syst",
        "boru na stiahnutie je pribli",
        "9@:h:",
        "k og din arkitektur.",
        "rengini",
        "j dysk twardy na czas instalowania aktualizacji. System Windows nie b",
        "cie syst",
        "li, izmantojot %1!s!.",
        "Votre PC va red",
        "installationK",
        "tfen Disk Temizleme'yi a",
        "Download the latest version of Windows",
        "vel encontrar as informa",
        "r produktnyckeln fungerade inte. F",
        "&Pabeigt",
        "chec du chargement des ressources linguistiques par le programme d",
        "anu, nepiecie",
        "s programmas atinstal",
        "re plass, og pr",
        "aja i dodatne datoteke koje nisu u instalacijskim medijima. Ako ne instalirate ta a",
        "o do Windows e execute ",
        "tzm-Arab-MA",
        "tres, car vous avez choisi d",
        "stroje BitLocker funguje! Jestli jste p",
        "rtraukta. Atvainojiet, bet inform",
        "es apresentadas abaixo para concluir a atualiza",
        "ISO-Datei",
        "r klara",
        " preparado para continuar a instala",
        "ieraksta DVD.",
        "o mais recente para poder continuar.ATransferir a Ferramenta de Cria",
        " perdavimo mokes",
        ",aCg^w",
        "nt a precommit.cmd parancsprogramok futtat",
        "fr-MC",
        "ntalo de nuevo.'Windows no est",
        "e se li",
        "enite namestitveni program.k",
        "i din nou, sau ",
        "s pedig eszk",
        "iune poate dura c",
        "eW[g0Y0d",
        "Apri masterizzatore DVD",
        " cheie4Aceast",
        "installationeLe programme d",
        "&Priimti",
        "ti azt, kihagyhatja ezt a l",
        "ovat na webu Windows Update.",
        ",Naujausios ",
        ";);0;G;v;",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::SetResponseName",
        "CSetupPageProgress",
        "ynnistet",
        "unar.",
        "5+5D5S5l5u5",
        " denne pc, og du geninstallerer det, kan du springe dette trin over. Vi aktiverer automatisk Windows, n",
        "ramad",
        "Odwied",
        " bent %1!s! laisvos vietos",
        " tem arquivos de instala",
        "cution des scripts preinstall.cmd.HUn probl",
        "< <,<8<D<P<\\<h<t<",
        "rja be a f",
        "avanje, aktivirate Windows, a zatim ponovo zapo",
        "Nous ne savons pas ce qui s",
        "unalo da bi nastavio s instalacijom.",
        "nce a",
        "Business",
        "0~0g0 ",
        "lpe dig med at f",
        "o o atual.",
        " Windows 8.1",
        "Checking this key+This key doesn",
        "%1!s! %2!s!!Kandja loomisega ilmnes probleem.jTeie sisestatud tootev",
        "%2!s!@Die Updateeinstellungen werden von Ihrer Organisation verwaltet.",
        "GetFocus",
        "Valmistumine (%d%%)",
        "Go (variable) et l'acc",
        "#Q.//",
        "r %1!s! f",
        " PC-en din. Hvis problemet vedvarer, b",
        "dz-BT",
        "Rg0Y0",
        "te vykona",
        "A(z) %s ",
        "Wenn Sie ein Upgrade von Windows 7 oder Windows 8.1 ausf",
        "%d.%d.%d.%d",
        "restart",
        " konieczne ponowne zainstalowanie pewnych opcjonalnych funkcji i j",
        "cii Windows 10. Sk",
        "Downloads9Remova arquivos grandes ou n",
        "etka instalacije sustava Windows Server 2019.PNastavit ",
        " nainstalovat nejnov",
        "i din nou instalarea.",
        "d acest lucru?",
        "lasztotta:",
        "i: https://aka.ms/windowsserverupgrade}Nu reu",
        "m.qEdice Windows odpov",
        " flash USB devono essere pari ad almeno %1!d! GB. Seleziona un'altra unit",
        " de produit fonctionne",
        "w<ubt",
        "A&fvis=Hvis du afviser licensvilk",
        "Pomoc",
        ",446666,,$",
        "Visite: %1!s!",
        "hnete nejnov",
        "kkulcsot.",
        " do Windows Servera 2019. Na ochranu svojich ",
        "D$4PS",
        " aktualizova",
        "SAFE_OS",
        "   @@@   ",
        " o tem",
        "rebilir.nBu ",
        "rnia n",
        "..Izberite drugo zunanjo napravo za shranjevanje",
        " prost",
        "yorsan",
        "Comprobando tu PC",
        "Arkitekturerne stemmer ikke overens",
        "tenih datoteka iz mape Preuzimanja.",
        "elite nadaljevati name",
        "Me ei saa kahjuks kindlaks teha, kas operatsioonis",
        "Papelera de reciclaje\\Vac",
        "dakilerle ilgilenmeniz gerekiyor.",
        ": 0x%1!lX! ",
        "dzianTo narz",
        "AD`fd",
        "91:D:",
        " bateria nu se epuizeaz",
        "kkulccsal csak szolg",
        "hA%^>",
        "V instalaci se ned",
        ", naudodami ",
        "t data migrace.JInstala",
        "Conseils de d",
        ", nei naudojate dabar.nNegalite pasilikti fail",
        "i din nou.P",
        "gLadattujen tiedostojen kansion avaaminen ep",
        "Die Downloaddatei ist etwa 3 GB gro",
        " privatumo patvirtinimas",
        "La descarga tiene un tama",
        "Nim`A",
        "Diese Updates helfen bei der reibungslosen Installation und k",
        "1D1x1",
        "bbi tennival",
        "Me ei leia USB-m",
        " proizvoda sastoji se od samo 25 znakova.",
        "riista teie arvutis k",
        "administrateur[Pour utiliser cet outil, vous devez ",
        "Co chcete ud",
        "212A2T2",
        "lamad",
        "se eszk",
        "rez de l",
        "RtlAllocateHeap",
        "te pros",
        "5Nous ne parvenons pas ",
        "r die Ausf",
        "n de Windows detect",
        "Os arquivos em sua unidade USB ser",
        "line tietokoneeseen ja jatka asennusta suorittamalla setup.exe.",
        "veleten m",
        " co najmniej %1!d! GB. Wybierz inny dysk.",
        "ierele personale ",
        "%OHHHG99G%$",
        "o produkta atsl",
        " jste koupili na internetu.",
        "jiet instal",
        "Empezar desde el principio",
        "kt sist",
        "Obtener",
        "o conseguiu iniciar a instala",
        "o novamente.nPara obter mais informa",
        "7*7L7~7",
        " crea",
        "%s nije valjan znak",
        "urirati va",
        "teni a Windows 10-etPA g",
        "Varmistetaan, oletko valmis asentamaan",
        "%d caracteres restantes",
        "wA telep",
        "n'Kontrollerar att installationen ",
        " i wersj",
        "Si vous effectuez une mise ",
        "tenjem PC-ja.BInstalacija nije uspjela u fazi %1!s! s pogre",
        "vW0f0O0`0U0D0",
        "r det lukkes",
        " e riprova.<In seguito, ti aiuteremo a liberare %1!s! nell'unit",
        "cnico y proporci",
        "ustu, v",
        "nd %1!s!.",
        "n de Windows Server, visita: https://aka.ms/windowsserverupgrade",
        "ation du m",
        " denne pc",
        "i listu disk jedinica",
        "anu, jums j",
        "tat dans lequel il se trouvait juste avant que vous ne d",
        "CheckHotPluggableDriveEx: Drive %c SetupDiGetDeviceInterfaceProperty Error: 0x%X",
        "<R<q<",
        "sentement install",
        "Den h",
        "Visita: %1!s!",
        "as sin activar tu versi",
        "WDSCORE.dll",
        "theti a merevlemez",
        "Aktualisieren",
        " de produit",
        "ti cu ce sunte",
        "cie o in",
        "<$<0<<<H<T<`<l<x<",
        "sidarydama",
        ".:Zadejte pros",
        "7FF+!",
        "v deretter p",
        "dzu, p",
        "sst[{{|",
        "bas ir pabeigtas! Nospiediet turpin",
        "%1!d!%% k",
        "s sur votre lecteur USB seront supprim",
        "iniz ",
        "sd-Arab-PK",
        "vel com o Windows 10.",
        "&Kapat",
        "k: %1!s!",
        "strojom sa ned",
        "ar-LY",
        " Windows 10v",
        "uW0~0W0_08",
        "Otvori+",
        "+LLLP",
        "tor ne mer",
        " que vous disposez d'anciens fichiers d",
        "o podemos determinar se seu computador tem espa",
        "#Fejlkode: 0x%1!lX! - 0x%2!lX!",
        "di: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXILai var",
        "rique de stockage externe",
        "mu programu, p",
        "_wcsnicmp",
        "setup.exe /?",
        "Sajnos nem lehetett meg",
        "hjaks.",
        "o instaladas. O Windows n",
        "Siirrett",
        " automaticky.",
        "scht, z. B. Dateien, Apps und Einstellungen.",
        "SetTimer",
        "Voulez-vous vraiment fermer",
        "<m]W+",
        " verificato un errore imprevisto durante l'installazione di Windows.",
        " el, ha a sz",
        "bory ulo",
        "eQcknx",
        "anas programmas!Tas var aiz",
        "se1Megn",
        "$Tikrinama, ar yra naujinim",
        "si forr",
        "Utilize as op",
        "m instalace Windows",
        "Windowsin asennustiedostoja ei l",
        " Nain",
        "@@@@@@@@@@@@ppp",
        "mmert. Klicken Sie auf ",
        "is logs tiks autom",
        "Pripravljeni na namestitev",
        "lkeen.",
        "Den ser ut ungef",
        "D$0+D$(",
        "Introduza a chave do Bitlocker",
        "s de votre dossier de t",
        "Tas var aiz",
        ";,;D;\\;t;",
        "sta na disku (%2!s!).uOdeberte soubory, kter",
        "vel instalar as mais recentes funcionalidades e melhoramentos de seguran",
        "strez doar fi",
        ".?AVCSetupResponsePageGated@@",
        "Bitlockeri v",
        "Valige sektsioon, kuhu soovite Windowsi installida.",
        "Tc0f0D0~0[0",
        "CSetupResponsePageBitLockerKeyValidate: LaunchOnScreenKeyboard",
        "p nem alkalmas a Windows 10 futtat",
        "Selezione immagine",
        "Silti pole",
        "te.&Zopakujme si, pro co jste se rozhodli:",
        "FIRST_BOOT",
        "5Jeg er ved at installere Windows 10 p",
        "EditionId",
        "base\\ntsetup\\conx\\mosetup\\mediasetupuimgr\\src\\SetupResponsePageBitLockerKeyValidateImpl.h",
        "CSetupResponsePageBitLockerKeyValidate: GetResultsFromPage",
        "cente de cet outil. Pour continuer, vous devez t",
        "Nekaj se je zgodiloV",
        "Posjetite: %1!s!",
        "espace pour continuer l",
        "kia, kad turite ",
        "ke: 0x%1!lX! ",
        "CreateFileW",
        "122b^`XaF",
        "lata ezen a g",
        "ete upravljati postavkama sustava Windows.PVa",
        "%c:4Arvuti taask",
        "No podemos continuar debido a lo siguiente:",
        "es ou n",
        ".?AV?$CDlpAutoDelayLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@",
        "tfen bekleyin",
        "i iz postavljanja.iDa biste pokrenuli instalaciju, treba nam najmanje 350 MB. Oslobodite malo prostora pa poku",
        "m BitLocker bude po",
        "o terminar.",
        "dzenia zewn",
        "Trebuie s",
        "Use older installation files",
        "Aktualizace Windows 10SNepoda",
        " necess",
        "ras i S-l",
        "kalusta on saatavilla uudempi versio. Sinun on ladattava ja suoritettava uusin versio, jotta voit jatkaa.,Lataa p",
        "je, hogy elt",
        "o funcionou. Verifique-a e tente de novo ou experimente uma diferente.BA sua chave do Bitlocker funciona! Continue quando estiver pronto.",
        "lla installationsval som st",
        "rieurement.O",
        ".?AVlength_error@std@@",
        "iune va dura c",
        "i, pute",
        " u osnovnom direktorijumu medijuma sa instalacijom.",
        "6Starter installasjonsprogrammet for Windows 10 p",
        "ena. Je n",
        "ration peut prendre quelques minutes.",
        "}Er kan niet worden bepaald of de pc voldoende ruimte heeft om Windows Server 2019 verder te installeren. Start Setup opnieuw.",
        "nemli d",
        "9Z9|9",
        "0OS/2L",
        "unar mo",
        "%3!s! ",
        "n de privacidad de Windows",
        "tuves lietojumsWManu",
        "Utilizza un dispositivo esterno, ad esempio una chiave USB, una scheda SD o un'unit",
        "emo da prona",
        "1T1o1",
        ". Pabandykite i",
        "ey(Windows ayarlar",
        " de Windows folosind o cheie de produs ",
        "88888886",
        "d.LTento k",
        "Tento k",
        "bW0f0",
        "echny nezbytn",
        "Kriipsud lisatakse automaatselt4Installiprogrammil nurjus keeleressursside laadimine0Installiprogrammil nurjus t",
        "i aceste actualiz",
        "vel baixar todos os arquivos necess",
        "xxxxxp",
        "Casi hemos finalizado",
        "Jos asennat t",
        "Dth_YS",
        "x0n0!q",
        "m adres",
        "bi za korisni",
        "cutez d",
        "0@$$@0",
        "$Ohrani osebne datoteke in aplikacije4Ohrani nastavitve sistema Windows in osebne datoteke",
        "Se finalizeaz",
        "m aktivujeme hned, jak se p",
        "o0S0n0",
        "10 sur votre PC en raison d'un espace disque insuffisant. Lib",
        " chcete Windows nainstalovat.",
        "3\"32373M3c3w3",
        "%3!s!",
        "A %s telep",
        "Versie",
        " Windowsin asentamiseen.",
        " budete pokra",
        "ti-ET",
        "tartujte in",
        " sa skripty nasadenia precommit.cmd)Sp",
        "hrt4Failure.cmd-Bereitstellungsskripts werden ausgef",
        "jumi.<Neizdev",
        "n automaattisesti$Tuoteavain sis",
        "Bitlocker key",
        "O(ug0M0j0D0",
        "me ud",
        "%1!s! %2!s!/Se produjo un problema en la creaci",
        "Nous ne pouvons continuer en raison d'une des op",
        ".text$yd",
        "tu instal",
        "Hvorfor ser jeg dette?",
        "i putea utiliza PC-ul ",
        "s to instal",
        "n, deber",
        "NQ0~0W0_0",
        "ej i wybierz pozycj",
        "llts precis som den var innan du b",
        ".?AV?$CZeroInit@VCSetupPageMessage@@$00@@",
        "wwwwwp",
        "Notiek atjaunin",
        " grund av n",
        "jlokatHA telep",
        "=$=(=,=0=4=8=<=@=H=\\=`=d=h=l=p=t=|=",
        "s et am",
        "gai j",
        " aktivere den n",
        "Nous ne pouvons pas dire si votre PC a suffisamment d",
        "gi telep",
        "No pudimos descargar todos los archivos necesarios. Comprueba que est",
        "s existantes ont ",
        "jas Windows",
        " entrar no Windows Server 2019. Para ajudar a proteger seus dados, mantenha seu computador com voc",
        "PWWRh",
        "Pirms atjaunin",
        "515A5I5k5|5",
        ">C?V?o?",
        "te. Aby je zachowa",
        "iuos veiksmus. Spustel",
        "st, ha felk",
        ")Code d",
        "n de Windows descarga actualizaciones",
        "Flere oplysninger",
        "asemasta poistetut tiedostot pysyv",
        "llningar eftersom din aktuella version av Windows eventuellt installeras i en katalog som inte st",
        "o.oPrecisamos de pelo menos 350 MB de espa",
        "mas.!Acest PC nu poate rula Windows 10",
        "hlen Sie ein anderes externes Speicherger",
        "i nen",
        "bad allocation",
        "O ID do Di",
        " Windows 10 medyas",
        "nnen nicht beibehalten werden, da Sie ausgew",
        "5!5)5|5",
        "ds*Det gick inte att verifiera produktnyckeln9Det g",
        "Pentru a recapitula, a",
        "ri utilizarea spa",
        "t-f9>t(Vh",
        "zelebb csatlakozik az internethez, a Windows aktiv",
        "%s(%d): Result = 0x%X",
        "vX[>e",
        "@@@@@@",
        "i computerul. Instalarea Windows va continua automat.",
        " continuar tendo problemas, mencione o c",
        "ks saadaolevatest suvanditest.",
        "CreateThreadpoolTimer",
        "%1!ld!%% valmiina",
        " di aggiornamenti6Verifica della disponibilit",
        "c tam restart",
        "$Windows ",
        "i osobne datoteke i aplikacije1Zadr",
        "Ne sada",
        "r a g",
        " %1!s! dans une langue diff",
        "2788kppqPPPnib]",
        "jies.&Nevar",
        "lls.8Allt tas bort, inklusive filer, appar och inst",
        "Siin on m",
        "o do Windows 10 para funcionarem corretamente. Depois de esta ser reiniciada, retomamos a partir do ponto onde t",
        "r online for at hente opdateringer, drivere og valgfrie funktioner. Disse opdateringer hj",
        "est pas prise en charge par cet outil.",
        "PW0f0D0~0Y0 ",
        "'_B%!",
        "ta oper",
        "s rendszergazdak",
        "$+.CC|",
        "Olvassa el a szerz",
        "Aktion an der zuvor erreichten Stelle fortsetzen",
        ". Visos teis",
        "s ginamos.",
        "tta aega.$Oodake, kuni installiprogramm sulgub",
        "6]6d6",
        "nnen wichtige Fixes, aktualisierte Ger",
        "vHr,g",
        "Als u Windows 10 voor het eerst op deze pc wilt installeren, moet u een geldige productcode van Windows 10 invoeren.",
        "Reprendre d",
        "ti6Sisestage BitLockeri v",
        "n, onko Windows 10 viel",
        "0g0W0_0-",
        "anjem posodobitev. Windows ne bo znova oblikoval zunanje naprave za shranjevanje, zato jo lahko po dokon",
        "da no ",
        "cution7Scripts de d",
        "Speichereinstellungen ",
        "cken Sie ",
        "Instalacija operativnog sistema Windows 10",
        "ieb z",
        "lectionnez l'image que vous voulez installer.",
        "rengin",
        "These updates will help the installation go smoothly, and can include important fixes, updated device drivers and additional files which are not on the installation media. If you don't install these updates now, your PC might not function properly after the installation and you might need to re-install some optional features and languages.",
        "jumi. Sist",
        ")CCCDDEIEFFFnDDF_",
        "ration %2!s!",
        " girmeniz gerekiyor.",
        "lida do Windows 10.",
        " prostora@Potrebno je %1!d!GB slobodnog protora na disku za resurs (%2!s!)",
        "Nu am g",
        " asigura c",
        "anja sistema Windows 10. Poskusite znova zagnati namestitveni program.",
        "CSetupLangIniLoader::Initialize: %d languages found.",
        "o resultar",
        "0[0W0~0Y0",
        "nud#Tootev",
        "ajte ponovo.+Windows 10 jo",
        " jazykov",
        "dz atkal esat pierakst",
        "e name",
        "0@$$?/",
        "%s nu este un caracter valid",
        "Licencne odredbe",
        "elite instalirati.",
        " datorn (enhet %2!c!:)HV",
        " automaticamente.",
        "Arhitektura se ne podudara",
        "%2!s!;Sua organiza",
        "! Devam d",
        "g`O/f,{",
        "kkelen fungerer! Fortsett n",
        " haluat tehd",
        " necessario hardware avanzato. Alcune funzionalit",
        "tes pas reconnect",
        "den y",
        "Descargar actualizaciones, controladores y caracter",
        "Windows Setup will go online to get updates, drivers, and optional features. These updates will help the installation go smoothly, and can include important fixes, updated device drivers, and additional files which are not on the installation media.",
        "94989P9T9X9\\9`9d9h9l9p9t9x9|9",
        ":6;e;",
        " pour reprendre l",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::Initialize",
        "p tov",
        "ra vilken version av Windows du k",
        "ani, da ",
        "ban legyen vele, mit fogad el.",
        "elite uporabljati to orodje, morate biti v sistem Windows vpisani s skrbni",
        "%hs: couldn't get host product name",
        ";v<8v",
        "lL7Ki\"0",
        "ite upotrebu skladi",
        "sa6A Windows-be",
        "s facultatives. Ces mises ",
        " Windows 8.1, ",
        " gjort nogle f",
        "ny percig.lNem siker",
        "ine t",
        "Kohaldatavad teated ja litsentsitingimused",
        " Windows\" ",
        "%WINDOWS_LONG%",
        "Sistema Operacional:",
        "2:2W2r2",
        ";#;6;D;Q;u;",
        "CreateSolidBrush",
        "Vorbereitung",
        "lasszon az el",
        " chcete nain",
        "ine actualiz",
        "CSetupResponsSelectMediaFormat",
        "1R1g1",
        "s restart",
        "rer til ekstra utgifter.-Hvilke andre oppdateringsalternativer finnes?",
        "teva ori. Procesul poate dura un timp.(A",
        "o da instala",
        "echno m",
        "Verwisselbare stations",
        " deve baixar e executar a vers",
        "base\\ntsetup\\conx\\mosetup\\mediasetupuimgr\\src\\SetupResponsePageSelectImageImpl.h",
        "Ihre Dateien, Apps und Einstellungen k",
        "dos. Para manter esses arquivos, fa",
        ": 0x%x]8",
        "k igen.&K",
        "taVRu",
        " %2!s! wolne",
        "<$<@<F<d<",
        "d: 0x%1!lX! - 0x%2!lX!",
        "Potrv",
        "De pc controleren",
        "UNINSTALL",
        "base\\ntsetup\\conx\\mosetup\\mediasetupuimgr\\src\\SetupResponsePageCompatGatedImpl.h",
        "%Inscrip",
        "Program za instalaciju sustava Windows 10",
        ".CRT$XCL",
        "r din nuv",
        "Mamy problemy z ustaleniem, czy system Windows 10 jest ju",
        "e dans un r",
        "Gereed voor installatie",
        ".$Neplatn",
        "te %d%%",
        "tres, fichiers personnels et applications Windows.VLes ",
        "akovane napake.",
        "iu pentru actualizare",
        "1)2F2",
        "Da biste nastavili instalaciju i zadr",
        "installation. Lib",
        "mesine yard",
        " asennus on valmis",
        "vel. Escolha uma unidade diferente e tente novamente.9Em seguida, ajudaremos a liberar %1!s! na unidade %2!c!:.zDac",
        "Installera Windows 10",
        "anje sistema Windows 10 ni uspelo",
        " %1!d!GB",
        "9~(s+j",
        "p a Windows Server 2019 telep",
        "vel continuar devido a um destes motivos:",
        "dzie mo",
        "jumu, kur",
        "1Faf!",
        "et et problem under k",
        "e organizace.",
        "i postavke sustava Windows i osobne datoteke",
        "%hs: Dialog initializing - SysReq",
        "VS_VERSION_INFO",
        "in Kurulum Yard",
        "rias vezes. Isso pode demorar um pouco.",
        "#?JPd",
        "uz-Cyrl-UZ",
        "ZZqlu",
        "CThis product key didn",
        "10 configurera votre PC de mani",
        "i Windows Server 2019 nepob",
        "=Es atk",
        "D$0+D$@P",
        "ma Windows Server 2019 v",
        "tta installationen av Windows Server 2019. Prova att starta om installationsprogrammet.iVi kan inte avg",
        "ce funkcje zosta",
        "trznego",
        "iendavaid faile, mida pole installikandjal.",
        "~~~UVVVUUUUPO7p",
        "Er is iets gebeurdOAls u Windows 10 wilt installeren, klikt u op de installatiemedia op Setup.exe.cWe kunnen niet bepalen of de pc gereed is om Windows 10 verder te installeren. Start Setup opnieuw.`We kunnen niet bepalen of uw pc Windows 10 kan uitvoeren. Sluit Setup af en probeer het opnieuw.",
        "Chcete v",
        "CSetupResponseTemplate<class IDlpResponse>::IsBackEnabled",
        " de produit que vous avez saisie n",
        "<%<C<_<",
        "solution de ce point. Actualisez la liste, puis r",
        "dia qui permet de l",
        "ckversetzt, in dem er sich befand, bevor Sie die Installation von Windows Server 2019 gestartet haben.KWir setzen die Installation von Windows Server 2019 in Windows Update fort.",
        "ha-Latn",
        "ivitama.",
        " disse tingene f",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::Serialize",
        "enie probl",
        "rlopp: %1!d!%%6Forts",
        "n de si las cosas que quieres conservar son compatibles con Windows 10 puede tardar algo de tiempo.yEsta clave de producto solo se puede usar para agregar caracter",
        "Pomoc techniczna",
        "0Bunun yerine harici depolama kullanmak istiyorum%Harici depolama kullanmak istemiyorum",
        "<)<7<K<",
        "_unlock",
        "Tarkistetaan tietokonetta",
        "kc0f0D0~0Y0^",
        "GetLastError",
        "i za instalaciju ili pokrenite datoteku ",
        "Consulta m",
        "etkawSadr",
        "titi privatnosti u sustavu Windows",
        "jieties jaunu atsl",
        " ripristinata dopo che avrai eseguito l'accesso a Windows 10. Per garantire la protezione dei dati, ",
        "n de disco",
        "<H<X<h<x<",
        "YPPPh\\",
        " tietokonetta uudelleen, jotta asennusta voidaan jatkaa.",
        ": XXXXX-XXXXX-XXXXX-XXXXX-XXXXXM",
        "amos failus. P",
        "Extern lagringsenhet",
        "Nevaram pateikt, vai j",
        " girin5Tan",
        " 1 znak'Klucz produktu zawiera tylko 48 znak",
        "3$3)343>3Q3c3",
        " kullanamayacaks",
        "r Windows 10 nedan, eller avsluta installationen, aktivera Windows och starta installationen igen.",
        "t pour ce PC/Nous nous assurons que l",
        "93:S:`:z:",
        "mtar uppdateringar",
        "ben tartsa mag",
        "5g5t5",
        "ServerHPC",
        "n solo si vas a instalar Windows en un equipo dise",
        " recenti.",
        "s de Windows 10 n",
        "Promenite na",
        "r datorn,Jag beh",
        "68<$?JJJ````KKKKK|KK|<[",
        "llet0Jag vill inte anv",
        "Sto preparando: %d%%",
        "sitsi.",
        "z saklan",
        "ssel funktioniert! Setzen Sie den Vorgang fort, sobald Sie soweit sind.",
        "Arkitekturen matchar inte",
        "ve already dealt with this. Click Refresh to remove it from the list.cWe ran into a problem while trying to sort this out for you. Please refresh the list and try again.",
        " bir harici depolama cihaz",
        "%1!d!%% baigtae",
        "ado; alguns recursos existentes foram modificados ou removidos; o Windows 10 ",
        "tani, hogy k",
        "iti podprtih mo",
        "toarele motive:",
        "VU5Hi",
        "Opgrader denne computer nu",
        "0Ik wil Windows 10 opnieuw installeren op deze pc3Ik moet een productcode voor Windows 10 aanschaffen",
        "Oba`Ten klucz funkcji BitLocker nie dzia",
        "Os ficheiros na pen USB ser",
        "De pc wordt verschillende keren opnieuw opgestart. Dit kan even duren.",
        "o para atualizar",
        "essayez.EUn probl",
        "Neder",
        "%s no es un car",
        "cej miejsca2Potrzeba %1!d! GB wolnego miejsca na dysku (%2!s!)rUsu",
        "iu-Latn-CA",
        "unalnik na viri napajanja, da se baterija med name",
        "5a5h5n5s5",
        " a Windows Server 2019.",
        "+Unesite BitLocker klju",
        "L$,_^[3",
        "o da Unidade",
        "- ISO ",
        "jHhBf|v",
        "7$7,747<7D7L7T7\\7d7l7t7|7",
        "ati datoteke, aplikacije i postavke jer instalirate izdanje sustava WIndows koje se razlikuje od onoga koje trenuta",
        "tCela peut prendre quelques instants pour v",
        "a pas pu d",
        "CSetupResponseTemplate<class IDiskSpaceActionResponse>::ExecuteRoutine",
        " gravar o arquivo ISO em um DVD mais tarde.",
        "R EX[",
        "Prenesi posodobitve, gonilnike in izbirne funkcije (priporo",
        "Install Windows 10",
        "t, jo esat izv",
        "]..%Fo",
        "rskendatakse tugiteenuste pakkumise perioodil automaatselt. Tugiteenused v",
        ": XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX)",
        " Windows 10#",
        "\\ddld|hx",
        "Installerer Windows 105Din pc genstartes flere gange. Det kan tage lidt tid.#Vens, mens installationen afsluttes",
        "SI INFORM",
        " 4GB ",
        "x_jPA",
        "IDATh",
        "s reinicia la instalaci",
        "_wcsicmp",
        "Espera7Hubo un problema al ejecutar scripts de preinstall.cmd.6Hubo un problema al ejecutar scripts de precommit.cmd.",
        "Avaa Lataukset",
        "o eliminadas, mas os seus ficheiros ser",
        ";!;@;_;~;",
        "pQw]}]\"",
        "7!7&717;7@7T7b7j7q7w7|7",
        "ivityksen Windows 7:st",
        "rankai nepavyko i",
        "Ne zadr",
        "ll personliga filer och appar1Beh",
        "es A procurar atualiza",
        ".((%2!s!)",
        "Selecionar uma pen USB",
        "e se odstran",
        ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIActivationActionResponse@@@@@@@@",
        "owe wyja",
        "5 6p6",
        "imalusi on v",
        ":-;Y;m;",
        "CInstallUI::FormatResourceString",
        "CSetupResponseTemplate<class IActivationActionResponse>::OnSuspend",
        "o estamos a conseguir determinar se o seu PC consegue executar o Windows Server 2019. Feche a Configura",
        "Laufwerkauswahl5Setup f",
        "vel kapcsolatos tov",
        "Den udgave af Windows, der matcher den angivne produktn",
        "i.\"Pute",
        "Tas var ilgt vair",
        "LoadStringW",
        "?Klju",
        " kter",
        "Nedok",
        "eni! Pritisnite Nastavak)Odaberite drugi vanjski ure",
        "Instalar o Windows 10",
        "ialit",
        ";&<v<",
        "juma konfigur",
        "r inget giltigt tecken",
        "A chave de produto (Product Key) dever",
        " consigliabile sorvegliare il PC fino al prossimo accesso..Non ",
        "gW0j0D0",
        " nevar darboties Windows 10+J",
        " si budete muset znovu nainstalovat n",
        "Si sigues sin activar tu versi",
        "kleme s",
        "Checking your PC#Making sure you",
        "rskendusi praegu ei installi, ei pruugi teie arvuti p",
        "anu. M",
        "tter.",
        "s to nebude st",
        "ff-Latn",
        "m zjistit, jestli u",
        ", DVD alebo s",
        "Valitse USB-muistitikkurUSB-aseman tiedostot poistetaan. Jos haluat s",
        "Voorbereiden (%d%%)",
        "s recientes.",
        " de produit ne contient que 25",
        "steemi Windows Server 2019 ei saanud installidaQSeadsime teie arvuti olekusse, mis sel oli enne Windows Server 2019 installimist.@J",
        "placement de vos param",
        "Installatiekopie selecteren",
        "in en az 350 MB alana ihtiyac",
        "k min",
        "ned asjad, mis tuleks arvesse v",
        "en#Ihr PC wird in K",
        "ivitada.",
        " kompiuteriob",
        "k, arkitektur og utgave",
        "e Windows instalujete na po",
        "O(uW0f0",
        "OOOagg'",
        " Windows. ",
        "heb teil vaja Windows 10 tootev",
        "ypenc",
        "im PC datoram",
        " suportada por esta ferramenta.",
        "8fIND",
        "CSetupResponsePageSysReq::OnInitDialog",
        " naliczane op",
        "Por que vejo isto?",
        " Windows Server 2019. For ",
        "%3!s!=Ponovno pokretanje programa za instalaciju sustava Windows 10",
        "na otworzy",
        "ke podr",
        "r Windows 10 wird konfiguriert.",
        " naujo",
        "a pokynov uveden",
        "Windows uzst",
        " gata pentru acest PC",
        "rken bir sorun olu",
        " Kk5?v",
        "kleyin",
        " %2!c!: ",
        "a tvrtka ili ustanova upravlja va",
        "G2-?lCz",
        "e./Programme d",
        "Arhitektura",
        "et znak",
        "ujte.",
        "hren dieses Tools",
        " pro b",
        "Ibit locker ",
        "Pronto para instalar",
        "Installasjonsprogrammet godtar ikke kommandolinjeargumenter. Hvis du vil ha mer informasjon, kan du se hjelpen for installasjonsprogrammet eller kj",
        "5/5C5S5p5",
        "zyk, architektur",
        "Cheie BitLocker",
        "inotum",
        "dDTento k",
        "Descargar la versi",
        "ivitage installiprogramm ja proovige uuesti.",
        "(%1!c!:) ",
        "Mida soovite teha?",
        "9 9$989<9L9\\9`9p9",
        "tete, isiklike failide ja rakenduste s",
        "iuos failus, dabar sukurkite atsargin",
        " atlayabilirsiniz. Y",
        "Privatumo patvirtinimas",
        "Spremni ste.RNastavit ",
        "WMsgAPI.dll",
        " informacija",
        " inserir a chave do produto (Product Key) do Windows 10 informada abaixo, ou saia da instala",
        ".+Atsisi",
        "r Windows Server 2019:Startar om installationsprogrammet f",
        "Pripremamo neke stvari",
        "ISO-f",
        " partir du r",
        "La taille du t",
        "FKs3[",
        "ncias.",
        "anas iestat",
        "o dispon",
        "e. Ovaj prozor ",
        "Atlikusi 1 rakstz",
        "0W0p0",
        "dte p",
        "vesti galiojant",
        "n de Windows que est",
        "o. Libere algum espa",
        "as oper",
        " verificato un problema durante l'esecuzione degli script preinstall.cmd.LSi ",
        ")Windows 10 v ta ra",
        "4#404=4d4k4q4v4",
        "Emme pysty selvitt",
        "iu pentru a continua instalarea Windows 10. ",
        "iere, crea",
        "l2QX[",
        "3*393T3f3",
        "No guardar nada",
        ":3:O:",
        "Kompiuteris bus paleistas i",
        "lectionner un disque m",
        "enia Windowsu 10. Aktualiz",
        "ma dizinini ba",
        "Verwenden Sie ein externes Ger",
        " sunte",
        "XaQ-,%",
        "lck8^K",
        "Operacin",
        "?&?U?r?",
        "chargement est d'environ 3 Go. Si vous disposez d'une connexion limit",
        "0?h$@0",
        "z ve ayarlar",
        " instalada em seu computador.",
        "Worum Sie sich k",
        "272N2j2q2",
        "Cette op",
        "Licence terms",
        " aggiornare il tuo PChLa lingua o l'edizione della versione di Windows installata nel tuo PC non ",
        " significa che dovrai immettere il codice Product Key di Windows 10 di seguito oppure uscire dall'installazione, attivare Windows e quindi avviare di nuovo il programma di installazione.",
        " le p",
        "gre.%M",
        " aceptando.",
        "na odnale",
        ". Zkontrolujte, jestli m",
        "o como administradorkPara utilizar esta ferramenta, tem de ter sess",
        "5+5K5l5",
        " Windows 10]",
        "a tiks restart",
        "_\\\\,tr",
        "rminos de licencia",
        " demorar alguns momentos a verificar se o que deseja manter ",
        "u6AN)",
        "ifruotas naudojant ",
        "n porque est",
        "NTzGq",
        " Setup ",
        "No podemos instalar las caracter",
        "CSimpleDialog",
        "a. Sprawd",
        "%s\\%s",
        "n de Windows.TSe eliminar",
        "Waarom krijg ik dit te zien?",
        "Creating Windows 10 media Feel free to keep using your PC.",
        "Cancela&r",
        " program a zkuste ho spustit znova.",
        "rio de trabalho)Par",
        "Wersje nie s",
        "L0ckW0O0B0",
        "rification de votre PC",
        "Den kan se slik ut: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        ">$??+",
        " executando o Windows 10",
        "%hs: Dialog initializing - DownloadReq.",
        "jet igen.7Der er opst",
        "ppp000",
        "ete pokra",
        "&Godta",
        " ominaisuuksia Windowsiin. Sit",
        "  &Seg",
        "Ladda ned uppdateringar, drivrutiner och valfria funktioner (rekommenderas)",
        "tse a list",
        "PREPARE_FIRST_BOOT",
        "!This program cannot be run in DOS mode.",
        "rinstal",
        "eHeW[&{8",
        ">PUUOHHHHGE9$",
        "Kan niet doorgaan met de installatie omdat de computer niet opnieuw kan worden opgestart. Sluit alle actieve programma",
        "ku-Arab-IQ",
        "939C9Q9k9z9",
        "vate.%In",
        "DIEGIMO INFORMACIJA: daliai ",
        "Dieser Hintergrunddownload kann ",
        "N9Y-N Rd",
        "pokra",
        "Instaliranje sustava Windows 10",
        "trukti.",
        "kai u",
        "10 wird vorbereitet. Dies kann einige Minuten dauern.",
        "iunile de instalare acceptate'Instalarea nu a validat cheia de produsGInstalarea nu poate determina versiunea de Windows pe care o executa",
        "sti. Lai patur",
        "PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD",
        "vyko netik",
        "te v PC dostatok miesta na pokra",
        "Oppdatering for Windows 10IKan ikke ",
        "W~~~~V~VUU",
        "l vagy Windows 8.1-r",
        "Supporto",
        "geket2A telep",
        "CREATE_FILE",
        "Unidades extra",
        "o nestes itens.",
        "as mantener el equipo contigo hasta que vuelvas a iniciar sesi",
        "la#6k0",
        "charger les fichiers d'installation les plus r",
        "onnistui. Avaa tallennustila manuaalisesti asetuksista.?Roskakorin avaaminen ep",
        "unalnik name",
        "ionale (recomandat)",
        "&Abbrechen",
        "6!6,666I6e6p6",
        "Atsvaidzin",
        " atkursime, kai prisijungsite prie Windows Server 2019",
        "oc-FR",
        "ch ni",
        "inot par ",
        "%2!s!2Nastavitve posodobitve upravlja va",
        "ncepe instalarea Windows 10.",
        "wt$\"evu",
        ">#?:?L?a?q?y?",
        "Oprettelse af Windows 10-medie0Du kan stadig forts",
        "o do Windows encontrou um erro inesperado.",
        "hlen Sie \"Aktualisieren\" aus.",
        "%Rn0 ",
        "t datus, turiet PC datoru tuvum",
        "t. Nyissa meg manu",
        "ptitud. Valige m",
        "sticas y las mejoras de seguridad m",
        "t egy term",
        "n. Esta ventana se cerrar",
        "Uppdateringarna har installerats, men installationsprogrammet f",
        "This background download can be 4 GB+ (may vary) and Internet access fees may apply. Click Next to download the latest installation files.",
        "USB izbrisivi memorijski pogon",
        "rile ",
        "sa. A Windows Server 2019 telep",
        "555uuu588",
        "Si est",
        "Windows Setup ",
        "i programul DVD-writer",
        "i kasutage ruumi vabastamiseks kettapuhastust, seej",
        "Nainstalovat Windows 10/Z",
        "UnmapViewOfFile",
        "s a be",
        "essayez.\"Windows n'est pas activ",
        "Izbor slike",
        "der inte kommandoradsargument. Mer information finns i hj",
        "de-CH",
        "sr-Latn",
        " nekoliko napomena:",
        "FveIsRecoveryPasswordGroupValidW",
        "nak aktiv",
        "e izbrisane, ali va",
        ")R(ug0M0",
        "Keele, arhitektuuri ja v",
        "sik sz",
        "kkulcs nem m",
        " reiniciado em alguns momentos",
        "-Aktuelle Version von Windows",
        "bory.",
        "1 caractere restante",
        "zania?",
        "&Nastavi(Instaliranje sustava Windows Server 2019",
        "Preuzimanje najnovije verzijetDostupna je novija verzija ove alatke. Da biste nastavili, morate da preuzmete i pokrenete najnoviju verziju alatke.,Preuzmi a",
        "lieties citu ",
        " preinstall.cmd1",
        "tn-BW",
        "initi. Ovaj ",
        " samo malo",
        "to spre",
        "CSetupPageBase",
        "|_RIQ",
        "ama Windows 10 produkta atsl",
        "Nepavyko rasti diegimo informacijos, reikalingos norint toliau diegti ",
        ":*:6:M:V:j:q:",
        "GetSaveFileNameW",
        "sw-KE",
        "SetRectEmpty",
        " ativado neste computador",
        "OF:{n",
        "CreateDCW",
        "ete ho pros",
        "nstalleerdUUw pc is weer helemaal zoals deze was voordat Windows Server 2019 werd ge",
        "eni namestitveni program za Windows Server 2019",
        "Unerwarteter Fehler bei der Windows-Installation. Stellen Sie sicher, dass auf die Installationsquellen zugegriffen werden kann, und starten Sie die Installation erneut.",
        "!D$DVf",
        "CSetupResponseTemplate<class IDiskSpaceActionResponse>::GetResultsRoutine",
        "%d caratteri mancanti",
        "&Installi",
        "te k internetu. ",
        "jiet: %1!s!",
        "%WinDir%",
        "1$1+10191@1E1N1U1Z1d1h1n1u1|1",
        " olan Windows yaz",
        "ts darb",
        "kmak istedi",
        "elite prekiniti?",
        "dia Windows 10*Vous pouvez continuer ",
        "cii Windows Servera 2019 v slu",
        "Atnaujinti ",
        ",+&#0",
        "windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel",
        "e koristiti samo za dodavanje zna",
        ": XXXXX-XXXXX-XXXXX-XXXXX-XXXXXR",
        "x!qHe",
        " %2!c!.mJei ",
        "n tus archivos.OSe eliminar",
        "GlobalUnlock",
        "r-e.)Milyen egy",
        "Verifica la compatibilit",
        " to, ",
        "Ezek a friss",
        " Microsoft Corporation. ",
        " dit USB-drev bliver slettet. Hvis du vil bevare filerne, skal du sikkerhedskopiere dem nu p",
        "nl^w!",
        ". Otev",
        "n no puede decirte qu",
        "rge l",
        "Preostao je jedan znak",
        "n, voiko Windows 10:t",
        " dostupn",
        "hrte Windows-Version nicht ermitteln.*Fehler bei der Installation von Windows 10",
        "#Zachowaj pliki osobiste i aplikacje",
        "Particija na disku",
        "emo nastaviti zbog jednog od sljede",
        "r~akow",
        "ma Windows nav aktiviz",
        "cDet kan ta en liten stund att kontrollera om det som du vill beh",
        "iendamise kohta leiate lisateavet siit: https://aka.ms/windowsserverupgrade",
        "241A04B0",
        "lj vilka media du vill anv",
        "Instalar %sEWindows est",
        "du laiku.XWindows 10 atjaunin",
        "Storage UseLManually explore your storage usage in settings to remove other large items.!Select an External Storage Device",
        "[Koda napake: 0x%x]APri namestitvi sistema Windows je pri",
        "sze elementy wymagaj",
        "gt, um die Installation von Windows Server 2019 fortzusetzen. Starten Sie Setup erneut.",
        "0W0j0D04X",
        " nejde zachovat, proto",
        ", voici ce que vous avez choisi de faire",
        "CSetupLangIniLoader::Initialize:     Language name     : %s",
        "r Windows 10. Vi kan hj",
        "Instalacijski program ne prihva",
        "ni minut.kK",
        "Sigur ie",
        " Windows avec un compte administrateur.;Par la suite, vous devrez graver le fichier ISO sur un DVD.",
        "i modul ",
        "latamad",
        "nost %1!s!.",
        "ajte ponovno.",
        "ckh_YS",
        "tigen mindestens 350 MB Speicherplatz zum Ausf",
        "Tai gali trukti kelias minutes.mKol diegiama ",
        "re Windows Server 2019",
        ";&<N<",
        "diegtos ",
        "D$@SVW",
        "n termina de desinstalarse.",
        "nytelen p",
        "tartuje sa in",
        "*Cu1p",
        " funkcioni",
        "Sistema Operativo:",
        "nstret st",
        "0eQKbY0",
        "rre. Velg en annen stasjon.",
        "espace disque disponible requis sur (%2!s!)",
        "ho riadka. ",
        "Privaatsusavaldus",
        "o mais antiga do Windows.rA unidade que est",
        "Controllo della chiave in corso=La chiave immessa non funziona. Prova con una chiave diversa.",
        ">R>X>_>",
        "Immettere la chiave BitLocker",
        "unalnik",
        "[Cod de eroare: 0x%x]5Instalarea Windows a ",
        ":0L0v0",
        "rer.'Installation af Windows 10 er mislykket",
        "i apoi s",
        " stato interrotto.0Non ",
        "Sprawdzamy, czy wszystko gotowe do instalacji",
        " Windows 10R",
        "sWindows",
        "a0R`O",
        " informacji dotycz",
        "FveCheckSuspendBitLockerOnUpgrade",
        "1 1$1(1,1014181<1@1D1H1L1`1d1t1x1",
        "lathoz, ",
        "Sistem Windows v tem ra",
        "nika systemu Windows 10(Mo",
        "i continua f",
        " versi",
        "_ftol2_sse",
        " spreman za va",
        "ra. Ind",
        "e informacija o nadogradnji operativnog sistema Windows Server posetite: https://aka.ms/windowsserverupgrade",
        "installation et essayez ",
        "vel no seu idioma e arquitetura atuais.",
        "li byste m",
        "0f0O0`0U0D0",
        "es em %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml para resolver o problema e execute a Instala",
        "hlen Sie ein externes Speicherger",
        "Deze download wordt op de achtergrond uitgevoerd en kan meer dan 4 GB zijn (dit kan vari",
        "r; Windows 10 destekleme d",
        "gle virker ikke. Pr",
        "*())-\\t",
        " sudaro tik 48 skaitmeniniai simboliai.",
        "unaru , a vi obavljate ponovnu instalaciju, mo",
        "n, consulta la Ayuda del programa de instalaci",
        "CreateSetupObject",
        "nosti za posodobitev?",
        "3Introduce",
        "lat je",
        "O idioma n",
        "r datorn. Det inneb",
        " bandote naudoti, u",
        "Produkta atsl",
        ".?AVIDlpAction@@",
        "uhkmAKK",
        "Selleks v",
        ": XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX:",
        "Nesten klar",
        "ste du s",
        "Ei ole varmaa, onko tietokoneessa riitt",
        "LIDATx",
        "dku. Dal",
        "unalniku (pogon: %2!c!)_Izberite ali priklju",
        "gebbi verzi",
        " olabilir veya Windows'un eski bir s",
        "u!j-Xf",
        " recenti di Windows 10 nel PC. Spazio su disco insufficiente. Libera spazio e seleziona Aggiorna.",
        "ngere har brug for, eller brug Diskoprydning til at frig",
        "iam kompiuteriui",
        "najte po",
        "e nastaven",
        "kkelig plads p",
        "re version de Windows 10",
        "6(6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6",
        "mu Windows 10 budeme pokra",
        "gra minuter.`Anslut datorns n",
        " informace",
        "tirme bulunamad",
        ".8DVD ",
        "CoUninitialize",
        "u alatke ",
        "Ha Windows 7-r",
        "t find the installation info we need to continue installing Windows. Restart Setup to try again.ESetup couldn",
        "0g0M0",
        "Als u Windows 10 (of een andere editie) voor de eerste keer op uw pc installeert, hebt u een Windows 10-productcode nodig.",
        "Przygotowywanie (%d%%)",
        "Neatbilst valoda",
        "enoZTento k",
        "ivitysten asentamisen ajaksi ulkoisella laitteella, kuten USB-avaimella, SD-kortilla tai ulkoisella kiintolevyll",
        "kleyemiyoruz. G",
        "5Zadajte k",
        "ConstructPartialMsgVW",
        "se2A meghajt",
        "Windows 10 installimine?V",
        "Jezik se ne podudara",
        "ge.?USB-flashminnet m",
        "APostanowienia licencyjne dotycz",
        "ordinateur pour qu",
        "o na fase %1!s! com um erro durante a opera",
        " vous avez d",
        "mas.*Acest PC nu poate rula Windows Server 2019r",
        ", kol diegiami naujinimai, naudokite i",
        "Provera ove ",
        "=0=@=Z=v=",
        "&Schlie",
        ".CRT$XLZ",
        "kenleri almaz. Daha fazla bilgi i",
        "rt atkritni. L",
        "et et problem under download af nogle filer",
        "des apliecin",
        " %s<Windows ",
        "linett",
        "A verificar a sua transfer",
        "0!0'0,080C0W0t0{0",
        "Aktualiz",
        "Es konnte nicht festgestellt werden, ob Ihr PC ",
        " anteriormente en este equipo y est",
        "n %d avaimen arvo ei kelpaa ",
        "rsler:Fjern store eller ubenyttede filer fra mappen Overf",
        "tteid ei saa s",
        " po in",
        "PtMhd",
        "t tento n",
        "MIGRATE_DATA",
        "r att tillf",
        "k med en annan produktnyckel eller k",
        "w` F)",
        "Tuoteavain",
        "Napredek: %1!d! %%8Za nadaljevanje izberite eno od razpolo",
        "ordinateur. L",
        "mate o pr",
        "kleme dosyalar",
        "jumi.",
        "CSetupResponsePageGated::PreTranslateMessage",
        "gle)Denne n",
        "2Na tomto po",
        "en+Windows 10 konnte nicht installiert werden.",
        " preinstall.cmd.=",
        "iska v nastaveniach a odstr",
        ". Stla",
        "o de Disco",
        "eyi haz",
        "hrend Setup beendet wird.$Es kann nun ein paar Minuten dauern.",
        "r, at der er adgang til installationskilderne, og genstart installationen.",
        "ka bir s",
        "palai",
        "re dette v",
        "t visus nepiecie",
        ":+:J:i:",
        "+@ZO*!",
        "Open&I want to use external storage instead$I don",
        ", mais nous n",
        "i da koristite ra",
        " de underst",
        "ve chosen to install %1!s! using a different language than the one you",
        "WNu s-a reu",
        "tdtglwf",
        "Selecciona la imagen que quieras instalar.",
        "es e defini",
        "}P0k0o0",
        "Windows 10-UpdatejIhre Speichernutzung konnte nicht ge",
        "&Vorige",
        "#$$! ",
        "Yasal",
        "nce dosyalar",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::Cancel",
        "ck(W8h",
        " pripraven",
        "Naprej",
        "Die Architektur stimmt nicht ",
        "n.tLa clave de Bitlocker tiene un formato similar al siguiente: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX<La clave de Bitlocker solo contiene 48 caracteres digitales.",
        "Als u een upgrade van Windows 7 of Windows 8.1 uitvoert, of als u Windows 10 opnieuw installeert, hoeft u geen productcode in te voeren.",
        "Compatibiliteit controleren",
        "r dysku",
        "o do Windows Server 2019.DContinuaremos a instala",
        "Alusta algusest",
        "3.3<3E3c3q3z3",
        "l matau tai?",
        "It est similaire ",
        "DKan ikke ",
        "AdjustWindowRectEx",
        "Atualizar agora este PC",
        "z (veya farkl",
        "n de almacenamiento",
        "VWj43",
        "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        \"> <rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"> <rdf:Description rdf:about=\"\" xmlns:xmpMM=\"http://ns.adobe.com/xap/1.0/mm/\" xmlns:stRef=\"http://ns.adobe.com/xap/1.0/sType/ResourceRef#\" xmlns:xmp=\"http://ns.adobe.com/xap/1.0/\" xmpMM:OriginalDocumentID=\"xmp.did:D90530087960E411BA60B7344D705471\" xmpMM:DocumentID=\"xmp.did:44B314C4700111E48C41F3D2216F3807\" xmpMM:InstanceID=\"xmp.iid:44B314C3700111E48C41F3D2216F3807\" xmp:CreatorTool=\"Adobe Photoshop CS6 (Windows)\"> <xmpMM:DerivedFrom stRef:instanceID=\"xmp.iid:977B7B345161E4118595B3E1319A734E\" stRef:documentID=\"xmp.did:D90530087960E411BA60B7344D705471\"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end=\"r\"?>",
        "J30_,",
        " tuettuja asennusvaihtoehtoja(Asennus ei voinut vahvistaa tuoteavaintaCAsennus ei tunnista tietokoneessa k",
        "ISO datoteka",
        "is produkto kodas neveikia. Patikrinkite j",
        " %1!ld!%%",
        "karmak i",
        "030J0g0",
        ".#Windows 10 ",
        "Zadat k",
        "ldre installationsfiler",
        "_ftol2",
        "lassza ki a part",
        "Introducir clave de BitLocker",
        ".?AV?$CDlpResponseImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpResponse@@@@@@@@@@",
        "asa.bKonfiguriranje posodobitve za Windows 10",
        "xh-ZA",
        " cheieSAceast",
        " pronto per continuare l'installazione di Windows 10. Prova a riavviare il programma di installazione.qNon ",
        "```@@@@@@```",
        "3+3M3",
        "Partici",
        "~Nismo mogli prenesti vseh potrebnih datotek. Preverite, ali ste povezani z internetom, nato pa znova poskusite zagnati orodje.*Pri zagonu tega orodja je pri",
        "jlra a telep",
        "buj ponownie.6System Windows nie zosta",
        "FindResourceW",
        " funkcionira! Nastavite kada budete spremni.",
        "Bude to n",
        "rvieto",
        "vetelm",
        "du Product Key nen",
        "(Estou a reinstalar o Windows 10 neste PC5Preciso de comprar uma chave de produto do Windows 10",
        "n systemenheten.",
        "enje diska.",
        "Declaraci",
        " Internet",
        "Perskaitykite ",
        "uriranja su instalirana, ali se program za instalaciju sustava Windows 10 mora ponovno pokrenuti da bi postala funkcionalna. Kada se ponovno pokrene, nastavit ",
        "d Product Key pre Windows 10 alebo ukon",
        "issue de la mise ",
        "Uscire?",
        "in %1!s!",
        "PripravaKZa to ste ",
        " jonkin aikaa.jT",
        "CInstallUI::SwitchToErrorPage",
        "chargement\"S",
        "6&7?7",
        "Patientez",
        "D$`#N",
        " nebo nepou",
        "Wybierz no",
        "&Zatvori;Va",
        "#Preinstall.cmd ",
        "ppna papperskorgen. ",
        "\\[[[Z[VMMMMMJ@=%\"\"D",
        "uab l",
        "EventUnregister",
        "= =2=s=",
        "Sv5X2?",
        " polo",
        "unalnik.",
        " pietiek vietas, lai turpin",
        "=$=<=T=l=",
        "re felf",
        "re Windows 10. Luk Installation, og pr",
        "sszes sz",
        "Tip til fejlfinding",
        "installation, puis r",
        "iona ",
        " zabezpe",
        "^^_<oop",
        "r %d %%",
        "%1!ld!%% je dovr",
        "%1!s!. %2!s!",
        "O&dbijam;Ako odbijete licencne uvjete, morate iza",
        "%1!s! %2!s!=Si ",
        "n para continuar con la instalaci",
        "o nos itens a seguir.?Para continuar a instala",
        "m Windows 10 ",
        " encerrada",
        "tani, hogy ezen a g",
        "7/787N7U7l7|7",
        "ditions ne correspondent pas",
        "berspringen. Nach Ende der Installation wird Windows automatisch aktiviert.",
        "kalua ei voi suorittaa tietokoneessasi. Jos sinulla on edelleen ongelmia, kerro virhekoodi, kun otat yhteytt",
        " soubory, abyste m",
        " soubory.",
        "%2!s!5Organiza",
        "Provera preuzimanja%Izbor ",
        "szak sor",
        "mta uppdateringar, drivrutiner och valfria funktioner. De h",
        "rmak i",
        "*90=;",
        "Lataa uusin versiorT",
        "enekler nelerdir?",
        "7!747f7",
        "tirmeler denetleniyor'G",
        "707B7h7",
        "4+4f4",
        "terupptas n",
        "l.-Creazione del supporto di Windows 10 in corso\"Puoi continuare a usare il tuo PC.",
        "lection du lecteur",
        "van om du installerar Windows p",
        "i Instalarea pentru a ",
        "ti ei toiminud. Sisestage uuesti see v",
        ".SOFTWARE\\Microsoft\\Sysprep",
        "ievada Windows 10 produkta atsl",
        "ipojen",
        " indirmek i",
        "d\\OFO",
        "Force ending Message pump",
        "s espacio:Hacen falta %1!d!GB de espacio disponible en disco (%2!s!)}Quita los archivos que ya no necesitas o usa Liberador de espacio en disco para liberar espacio y, luego, int",
        "@@@```R",
        "a pas suffisamment d",
        "&ptal",
        "Please select the image you want to install.",
        "ey olduEWindows 10",
        "Ceva ",
        "Preuzmite najnoviju verziju sustava Windows",
        "%hs(%u)\\%hs!%p: ",
        "Mida soovite s",
        "rhelybe",
        "kelti kalbos i",
        "ppna Lagringsinst",
        "aj za pohranu s najmanje %1!s! slobodnog prostora",
        "teni szeretn",
        " a Windows, non per installare Windows.",
        ", mert a Windows nem tudta ",
        "Ne isklju",
        " (Edition)",
        "ouverture de votre corbeille. Ouvrez manuellement votre corbeille.o",
        " Windows 10.",
        ".^Konfiguruje sa aktualiz",
        ".?AVCAtlException@ATL@@",
        "\\1yn._D",
        " program.w",
        "4Conservar los archivos personales y las aplicaciones\"Conservar solo archivos personales",
        "Se intendi eseguire l'aggiornamento da Windows 7 o Windows 8.1 oppure reinstallare Windows 10, non avrai bisogno di immettere un codice Product Key.",
        "tujete a po dokon",
        "t. preostalih znakov: %d Pomi",
        "00080D0d0l0t0",
        "Nevaram turpin",
        " #-7@[p",
        "|~||g",
        "Brug de anbefalede indstillinger til denne pc",
        "Taal:",
        "9^Dtg",
        "dziesz potrzebowa",
        "avanja skripti preinstall.cmd.@Do",
        "%1!d! %% har slutf",
        "installationN",
        "<P!qHe",
        "ntalo nuevamente.BA continuaci",
        "misest",
        "080A04B0",
        " toimia. Saat ilmoituksen, kun n",
        " ne fonctionne pas. Essayez une autre cl",
        " deneyin.1Bilgisayar",
        "jljai. A telep",
        "ania w trybie S mode.ADysk flash USB musi mie",
        "ycie magazynu w ustawieniach, aby usun",
        "kos instal",
        ".data$brc",
        "10 je k",
        " sur ce PC",
        "Ingenting6Du vil kunne administrere Windows-innstillingene dine.IInnstillingene og appene dine blir slettet, men filene dine blir beholdt.9Alt blir slettet, herunder filer, apper og innstillinger.",
        "Wybierz ",
        "D$(PQ",
        "ilytett",
        "Invalid command line parametersjWe couldn",
        "dvendige filene. Kontroller at du er p",
        " asiakastukeen.",
        "te naujausi",
        "Mises ",
        "Ak sa chyst",
        "ciu Windowsu. Re",
        " a tentar instalar uma vers",
        " preinstall.cmd4",
        "elite da uradite?",
        "rste gang, du installerer Windows 10 p",
        "jies. Kopsavilkumam ",
        " disco rigido esterna, per estendere temporaneamente l'unit",
        "t.dNem siker",
        "zywania problem",
        "\\W0g0Y0K",
        " kompiuteryje, nes nepakanka vietos diske. Vadovaukit",
        ".?AVCSetupDialogDownlevelInstall@@",
        "ana lejupiel",
        " PC dator",
        "lido; insira a chave correta2Insira a chave do bitlocker para o identificador: *O Windows precisa de espa",
        "jljait.)Az elt",
        "Windows installation encountered an unexpected error. Verify that the installation sources are accessible, and restart the installation.",
        "Keep personal files only",
        "mentaires qui ne se trouvent pas sur le support d'installation. Si vous n'installez pas ces mises ",
        "moo/..~j",
        "me su problema bandydami atlikti ",
        "5*6A6[6n6s6y6",
        "ana p",
        "re installing an edition of Windows that",
        "e okre",
        " z dostupn",
        "enje u S na",
        "si oleva kieli.",
        "%s ei ole kelvollinen merkki",
        "es do Windows.WAs suas defini",
        "{<nLL",
        "|l~xd",
        "C|PhY",
        "n e int",
        " jour de Windows 10p",
        "i reporni",
        "n continuare, v",
        " naujo diegiu ",
        "e vas zanima, zakaj, si oglejte spodnje informacije.",
        "0%141f1",
        "8$8,888B8H8T8^8d8p8z8",
        " joitakin minuutteja.oKaikkia tarvittavia tiedostoja ei voitu ladata. Varmista, ett",
        "turuluyor/Bilgisayar",
        "paration du t",
        " pribli",
        ", a zatim poku",
        "Klar til at installere",
        ". Zavrite v",
        "yoruz(Bu ara",
        " niveau maintenant",
        "r die Installation ausreicht.",
        "rer vos param",
        "vel instalar o Windows 10VO computador foi definido com o estado anterior ao in",
        "l minden f",
        "%c:=Po",
        "No pudimos guardar la informaci",
        "ujte v",
        "Wat wilt u doen?",
        "seit nem lehet telep",
        "i a v",
        "Vi ved ikke helt, hvad der er sket, men vi kan ikke k",
        "kkulcsot vagy -licencet ahhoz, hogy a friss",
        "8cZ00",
        "]l{9$",
        "10.0.19041.572",
        "SetErrorMode",
        "Gravar o ficheiro ISO num DVD",
        "o suportado ou porque est",
        "Avisos legales",
        "bHr,g",
        "gikastKT",
        " denne computer7Jeg har brug for at k",
        " vydanie), budete potrebova",
        "nta medan installationsprogrammet avslutas",
        "A instalar o Windows 10OO seu PC vai ser reiniciado v",
        "s)Ink",
        "ma Windows",
        "nost ",
        "k a Windows telep",
        "/Prenesite klju",
        "i sunt compatibile cu Windows 10.",
        ", um den PC neu zu starten und die Installation von Windows abzuschlie",
        "\"Dashes will be added automatically/Setup has failed to load the language resources4Setup has failed to initialise the working directory",
        "`\\\\\\RRR9B/(",
        "unaru zbog nedostatka prostora na disku. Oslobodite deo prostora ispod, a zatim izaberite ",
        "Externe Speichervorrichtung",
        "ds eller s",
        " pradedantuReik",
        "Descargando Windows 10",
        " gerekiyor, ",
        " correcte.;Entrez la cl",
        "em.XTaj klju",
        "te in",
        "tfen %1!s! kullanarak ISO dosyas",
        "Seleccione el idioma, la arquitectura y la edici",
        "o. Atualize a lista e volte a tentar.",
        " l'addebito di costi aggiuntivi.*Quali sono le altre opzioni da aggiornare?",
        ".3Windows Server 2019 is nog niet gereed voor deze pc",
        "Tasuta v",
        "Een ogenblik geduld",
        "rankos, aktyvinti ",
        ".?AVCWinThread@@",
        "j tilg",
        "_vsnprintf_s",
        "digo de erro ao falar com o atendimento ao cliente.",
        "dition que si vous installez Windows sur un PC con",
        "ti diegti ",
        "= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=",
        "Escribe la clave de producto",
        " hvilke installasjonsvalg som st",
        "Comprobar compatibilidad",
        "n de Windows.",
        "yciu funkcji BitLocker. Wybierz inny dysk i spr",
        "t izmantot datoru.GInstal",
        "5&6C6",
        "Nk0eQ",
        " systemu Windows. Spr",
        "ceQ`O",
        "8![@Du",
        "%1!s! %2!s!+Ett problem uppstod n",
        "zponti telep",
        "&Baigti",
        "OF0S0h0L0g0M0~0[0",
        ".?AVlogic_error@std@@",
        "? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\\?`?p?x?|?",
        "o e poder",
        "sticas existentes se han modificado o quitado; Windows 10 se actualiza autom",
        " %d%% ",
        "(%1!c!:) - %2!s! beschikbaar",
        "anja sistema Windows 10. Poskusite znova zagnati namestitveni program.1Preverjanje, ali je v ra",
        "toarea unitate extern",
        "er se",
        "Behold ingenting",
        "ver din opm",
        "me persiste, contactez le service client et indiquez le code d",
        "A verificar esta chaveLEsta chave n",
        "o do Windows Server 2019/Reiniciar a Configura",
        "000@@@ppp",
        "Cance&l",
        "Sin etiqueta",
        "glich), und es k",
        "v en anden.",
        "ivih mogu",
        "2.242G2u2",
        "N(W/e",
        "Estamos a verificar se tem tudo pronto para a instala",
        "Lataukset?Poista suuret tai k",
        "cia nem",
        "Zkontrolovat kompatibilitu",
        "tani a t",
        " %1!d!%%_",
        "'A Windows 10 telep",
        "li instalujesz system Windows na komputerze zaprojektowanym do dzia",
        "lva. Csak akkor v",
        " uniemo",
        "tres Windows, les fichiers personnels et les applications.PLes actions suivantes n",
        "0S0h0L0B0",
        "fQ.W4",
        "l reinstala",
        "&Decline6If you decline the license terms, you will exit setup.UWe need at least 350 MB of space to run setup. Free up some space and then try again.CWindows Server 2019 ei ole viel",
        "ugiwanym katalogu lub pr",
        "tter installationen af Windows Server 2019 i Windows Update.",
        " ir j",
        "Windows jaun",
        "0D1J1Z1w1",
        "n en %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml para resolver el problema y vuelve a ejecutar el programa de instalaci",
        ".?AV?$CSetupResponseTemplate@VIDiskSpaceActionResponse@@@@",
        " lielumam ir j",
        "_a0O0`0U0D0",
        "5$5(5,5054585<5@5D5H5L5P5d5t5",
        "letek",
        "y spe",
        "ljivo s sistemom Windows 10.eS tem klju",
        "!Tallenna ISO-tiedosto DVD-levylle",
        "i o cheie de produs.",
        "=@=Z=|=",
        " Windows Update.Y",
        " %2!c!:)c",
        "taluje sa Windows 104PC sa nieko",
        "e.=Les conditions requises sont termin",
        ".?AVCSetupResponsePageDiskPartition@@",
        "SetRect",
        "rate de que est",
        "rts p",
        "%d %% fullf",
        "dorEsta chave de produto (Product Key) n",
        "akajte, da se aplikacija do konca odstrani.",
        "  &Noriu pad",
        "8!8:8@8M8a8q8",
        "m, ka izmantojat vec",
        " programy a re",
        "&Ne mo",
        "O que pretende fazer?",
        "RemoveFontMemResourceEx",
        "PW[CQR",
        ", nes diegiate skirting",
        "r att l",
        "Minden megvan, ami kell9A Windows 10 telep",
        "Progresso: %1!d!%%4Selecione uma das op",
        "8#868C8o8",
        "ras licences nosac",
        " in the root directory of your installation media.",
        " pentru ca acestea s",
        "DownloadKRimuovi i file di grandi dimensioni o inutilizzati dalla cartella Download.",
        "d2G_e",
        "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7",
        "AKurulum program",
        " var darboties Windows Server 2019. Aizveriet iestat",
        "&Jatka",
        "lreiz vai izm",
        "pre a Windows 10-et(Windows 10-term",
        "ntalo de nuevo.uEl programa de instalaci",
        "eno je %1!d!%%bOva ",
        "sek mapp",
        " pirm",
        "&Zavr",
        "caract",
        "nij Kosz, aby trwale usun",
        "2#2,22272H2Q2]2e2t2",
        "sr-Cyrl-CS",
        "GetCurrentProcessId",
        "rskendamise j",
        "ksnes juhul, kui installite Windowsi arvutisse, mis on loodud t",
        "0L0+T~0",
        "Noriu naudoti i",
        "m jazyku, ne",
        "l. Ezek a friss",
        "mler e",
        "o no Windows 10. Para ajudar a proteger os seus dados, deve manter o PC consigo at",
        "s. Pour conserver ces fichiers, sauvegardez-les maintenant ",
        "turman",
        "vww_A2",
        "gi papla",
        "su pa",
        "nenie miesta a potom to sk",
        "t vismaz %1!d!",
        "sait, szem",
        "s quitarlo luego de que se complete la instalaci",
        "Patientez.",
        "stroje BitLocker pro identifik",
        "Progress: %1!d!%%<Please select from one of the available options to continue.",
        "ne ispravke, a",
        "rbereds ",
        "'IDATX",
        " um car",
        "#Zadr",
        " funkce",
        " klucz funkcji BitLocker",
        "ve igen.rInstallationsprogrammet kan ikke starte installationen af Windows. Genstart installationsprogrammet, og pr",
        "tach.&",
        "040y0",
        "0&1J1s1",
        " flere oplysninger om opgradering af Windows Server ved at bes",
        "stroje BitLocker",
        ";9;P;m;",
        "mu Windows 10 zlyhala",
        "Aggiorna il PC ora",
        "Den ser s",
        "o do Windows.",
        "n (unidad flash USB, DVD o archivo ISO) para otro PC",
        "ti ezeket a friss",
        ".?AV?$CZeroInit@VCSetupPageRollback@@$00@@",
        "445:5J5g5w5",
        "ParengtiRJau atlikote ",
        "hnlich in der DVD-Verpackung oder in einer Kaufbest",
        ".aNa spustenie in",
        "!kn0S0h0",
        "latvAz egy",
        "ar-LB",
        "m instala",
        "c tam m",
        "si-LK",
        "#Installasjonsprogram for Windows 10",
        " dessverre angi informasjonen p",
        "rselsdata<Installationsprogrammet kan ikke slette installationsfilerneQInstallationsprogrammet kan ikke fastsl",
        "o do Windows a partir do ponto onde ficou. Vai ter de reintroduzir as informa",
        "Nous avons remarqu",
        "2;Kja;Kja;Kja/ i`=Kja/ n`-Kja/ k`",
        "Aloita alusta",
        "&Tilbage",
        "ani namestitvi bomo sistem Windows aktivirali samodejno.+Namestitveni program za Windows Server 2019:Ponovno za",
        "pne papirkurven. ",
        "ializat directorul de lucru&Parametri nevalizi ",
        " desteklenen y",
        "e isprazniti tokom instalacije.",
        " elementele pe care dori",
        "nij przycisk Kontynuuj./Wybierz inne zewn",
        " informacji o instalacji potrzebnych do kontynuowania instalacji systemu Windows od miejsca, w kt",
        "o mais recente desta ferramenta est",
        "zykowej ni",
        "p$GG88888",
        "ge: https://aka.ms/windowsserverupgrade|Vi har problemer med at fastsl",
        "y,<===IH==D9",
        " Windows 107",
        "logo ",
        "0g0W0_0&",
        "te.%Windows 10 se nepovedlo nainstalovat.",
        "r bara att anv",
        "lgende eksterne stasjon, og klikk OK for ",
        "<3===u=",
        "Tem um aspeto semelhante ao seguinte: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "838g8",
        "s facultatives",
        " negali i",
        "tt. Ellen",
        "r du logger p",
        "cej: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXWPoni",
        "- Windows 10. ",
        " jour",
        "Litsentsitingimused",
        "-lo da lista.QProblema ao tentarmos cuidar disso para voc",
        "e dostopati do virov namestitve, in znova za",
        ": XXXXX-XXXXX-XXXXX-XXXXX-XXXXX?",
        " de Windows",
        " indirjBu arac",
        "veskite produkto kod",
        "anu. Restart",
        "ver ange produktnyckeln f",
        "en-ZA",
        "n. Windows y",
        "sst*sst]sst",
        "sim oper",
        "&Terminare",
        "ES DE INSTALA",
        "ivitub m",
        "CSetupResponseSelectUsbDrive",
        "s usar el equipo mientras se instala Windows. Guarda y cierra tus archivos antes de empezar.7Espera mientras la aplicaci",
        "s idej",
        "Vi kan ikke gemme de installationsoplysninger, der skal bruges for at forts",
        "hlas.",
        "Los archivos de la unidad USB se eliminar",
        " Windows Server 2019.K",
        "r du startet installasjonen av Windows 10.",
        "CE INSTALACJI: niekt",
        " (%2!s!);",
        ";!;&;:;s;",
        "080404B0",
        "Tennival",
        "Izdanje",
        "n ott folytatjuk, ahol abbahagytuk.5Ez a sz",
        "040E04B0",
        "tre connect",
        " ce qu'il s",
        "ntalo de nuevo.4Windows Server 2019 n",
        "lassza ki, milyen adathordoz",
        "ploiement precommit.cmd0Ex",
        "c klucza produktu, a nast",
        "rden %2!s!",
        "Ekstern lagerenhed",
        "494X4",
        "rile nu pot fi p",
        "ene opcije za ovaj ra",
        "'@<!^^^",
        "&Jeg vil hjelpe til med ",
        "o adicionados automaticamente4A instala",
        "ra leistinas simbolis",
        " yeniden ba",
        "Sto verificando il download",
        "klemeye devam edece",
        "ite ra",
        ". Anahtar",
        "ce Twojej uwagi przed kontynuowaniem instalacji.",
        ", ali s ",
        "ticamente en %1!d! minutos.#Lo que debes saber antes de empezarpLa descarga ocupa unos 3",
        " verzi Windows 10",
        "tka%Valige m",
        "ie.-Uvo",
        "ScreenToClient",
        "Lltltt",
        "*.iso",
        "rskendadaeSee t",
        "rifiez si ce t",
        ";3<v=",
        "HomeBasic",
        " ovlada",
        "? ?$?(?,?0?D?H?L?d?h?",
        "ddkHr,g",
        "Instalar Windows Server 2019",
        "GetKeyState",
        "atwiania tej sprawy znale",
        "Verificando o computador",
        "odo de asistencia t",
        "hendus Internetiga, ning proovige t",
        ", Instalator systemu Windows 10 musi zosta",
        "mn-Mong",
        "%d%% voltooid",
        "sai t",
        "base\\ntsetup\\conx\\mosetup\\mediasetupuimgr\\src\\SetupResponsePageCompatImpl.h",
        "rdige, og fort",
        "i instalarea, s",
        "DEBUG",
        "avate koristiti nema dovoljno raspolo",
        ".[Nije uspelo otvaranje pisa",
        "dza Twoimi ustawieniami aktualizacji.",
        "i instalarea.|Ne pare r",
        "9':^:",
        "Jatkaminen ei onnistu. Syy t",
        "s, nous ne parvenons pas ",
        "e li va",
        " vain 25 merkki",
        "Atualiza",
        "Birka",
        "Non posso continuare l'installazione perch",
        "0g0o0J0",
        "va av Windows som skiljer sig fr",
        "dium (USB k",
        "https://go.microsoft.com/fwlink/?LinkID=798592",
        " instalado. Salve e feche seus arquivos antes de come",
        " disk",
        "ului de reciclare. Deschide",
        "cich pr",
        "Jogi tudnival",
        ">$>0>P>\\>|>",
        " a impedir a instala",
        "Dlaczego to widz",
        "8(808@8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8",
        "dzenia.",
        "Installa %s:Sto riavviando il computer per continuare l'installazione.",
        "Atlasiet valodu, arhitekt",
        "da-DK",
        "Brug ",
        "ProblemaGPara instalar o Windows 10, clique em Setup.exe na m",
        "n ve yeniden deneyin.0Windows 10, bu bilgisayar i",
        "o estamos a conseguir determinar se o Windows Server 2019 j",
        "Sprog:",
        "e naprej lahko uporabljate ra",
        "Hva vil du gj",
        "021R1[1p1",
        "o suficiente para continuar a instalar o Windows 10. Tente reiniciar a Configura",
        "tko OK restartuje po",
        "Select Image",
        "Open DVD burner",
        "cie nevybila.",
        "Loo installikandja (USB-m",
        "jlok megtart",
        "der comme suit :",
        "i su tro",
        "FEdldlx",
        " instalowanie systemu Windows Server 2019 w us",
        "Mora da bude najmanje %1!d! GB.",
        "i (ieteicams)",
        ", SD ",
        "Neatbilst izdevumi",
        " Setup.exe p",
        "3>DI\\+",
        "ll ingenting",
        "Preparando %d%%",
        "r bakgrundsnedladdningen kan ",
        "0o0B}",
        " souboryBOdeberte velk",
        " zmluvu.",
        "anjem sistema Windows ne boste mogli uporabljati ra",
        "kkel og velg deretter Oppdater.",
        "tan ba",
        "n ve yeniden deneyin.*Windows bu bilgisayarda etkinle",
        " sucedi",
        "shoz le kell t",
        "Nous pr",
        "re installasjonen av Windows.",
        "@ ;F uZ",
        "7 7,7L7T7\\7h7",
        " dabartine kalba, atitinkan",
        " vanhempia asennustiedostoja",
        " exclu",
        "Unidades amov",
        "Please input bit locker key for the identifier: ",
        "tkame Windows Server 2019 installimist Windows Update",
        ". Zadejte pros",
        " meghajt",
        "i Windows 10",
        "r tiek instal",
        "l, hogy a let",
        "EDenne produktn",
        "rformat",
        "fo-FO",
        "kleme i",
        "H~U~UUUUUUUHUHHHHEGG88",
        "\\[[cNn",
        "rskendused aitavad installimisel ladusamalt sujuda ning v",
        "%1!s! %2!s!*Wyst",
        "dpanel-azonos",
        "Atlas",
        "0n0_j",
        ".idata",
        "%1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml ",
        " o instala",
        "r du loggar in i Windows Server 2019. Skydda dina data genom att ha datorn i n",
        "dos da unidade do sistema.",
        "Meiryo",
        ".?AVCSetupResponsePageSelectImage@@",
        "ver g",
        "o. Se n",
        " voi k",
        "F0Vh0",
        " toimi asennuksen j",
        "es-NI",
        "zda tutmal",
        "ilita isiklikud failid ja rakendused$S",
        "-Nn0 ",
        "r die Installation",
        "Tuoteavaimen pit",
        ">eW0f0O0`0U0D0 ",
        " ponownie instalatora.",
        "5;6h6",
        "Az aj",
        "%1!s! %2!s!8Er is een probleem opgetreden bij het maken van de media{De editie van Windows die overeenkomt met de ingevoerde productcode is niet beschikbaar in uw huidige taal en architectuur.",
        "ar-AE",
        "stroja. Ak chcete pokra",
        "?Nastavitve sistema Windows boste lahko upravljali tudi pozneje.RVa",
        "MFC42u.dll",
        "yK{{[c:",
        "t, vagy ",
        "FillRect",
        "Weryfikowanie pobranych danych",
        "n de Windows Server 2019;Reiniciar el programa de instalaci",
        "g: %1!s!",
        "n actual de Windows mediante una clave de producto y luego selecciona Actualizar.",
        "Flytter dine indstillinger %d%%",
        "POST_OOBE",
        "0#0W0w0",
        "cznie obszar Magazyn w aplikacji Ustawienia..Nie mo",
        " l'installazione di Windows automaticamente.",
        "labilir s",
        "6$6R6",
        "s de reiniciar, seguiremos desde donde lo dejamos..Este PC no puede ejecutar Windows Server 2019.",
        "#'6'6'66'666'#*",
        "va 1 znak'K",
        "o est",
        "ga nedarbojas. Izmantojiet citu atsl",
        "imai ir licencijos s",
        ", aby bylo mo",
        "Kontroll",
        "vcu.+ISO s",
        "ak sa chyst",
        "c!8w,",
        "laties sist",
        "?4?C?Y?h?~?",
        " naujo paleiskite s",
        "fil-PH",
        " at batteriet ikke brukes opp under installasjonen.",
        "2019K",
        "ana tiks aizv",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::CheckUserInterrupt",
        " system Windows.",
        ": 0x%x]6",
        "Soubor ke sta",
        "chten, ist mit BitLocker verschl",
        "se folyamatban van. A Windows nem form",
        " sa zhoduje so zadan",
        " bio instaliran i aktiviran na ovom ra",
        "ywane pliki z folderu Pobrane.",
        "\\j0O0h0",
        "dzie kontynuowana w witrynie Windows Update.^Konfigurowanie aktualizacji dla systemu Windows 10",
        "$Defises tiks pievienotas autom",
        "kih programa i opcijskih zna",
        ".2Windows Server 2019 ",
        "Sunte",
        " na %1!ld!%%",
        ", jo %2!s! oper",
        "~_NzM",
        "zellikleri almak i",
        "#Nie mo",
        "ete v",
        "o necessita ou utilize a Limpeza do Disco para libertar espa",
        " PC-ul",
        "Ingen",
        "Na disk jedinici koju poku",
        "IsWindowVisible",
        " Windows, ",
        "glen for gruppen %d er forkert. Angiv en korrekt n",
        "njenje, potra",
        "vel se tiver uma c",
        "gas v",
        " dost",
        "Lejupiel",
        "Uklonite ovaj spoljni disk i kliknite na dugme ",
        "sit se jako spr",
        "ranka ",
        "Invalid command line parametersqWe couldn",
        " ukladacie zariadenie",
        "BitLocker protection will be suspended during this update, and will resume when you sign in to Windows Server 2019. To help protect your data, you should keep your PC with you until you sign in again.'We couldn",
        "es, vous devriez conserver votre ordinateur avec vous jusqu",
        "te na instala",
        "li system Windows 10 zosta",
        " prostora<Na pogonu (%2!s!) potrebujemo %1!d! GB nezasedenega prostoraqOdstranite datoteke, ki jih ne potrebujete ve",
        ": XXXXX-XXXXX-XXXXX-XXXXX-XXXXX@",
        "in en son y",
        "6)7G7S7u7",
        "jjk`jjk%xxy",
        "o em que pretende instalar o Windows.",
        "6 676D6Z6g6u6|6",
        "s este rein",
        "tnout<Pokud tyto licen",
        "alinta; ",
        "sah-RU",
        "ADD_DRIVER",
        "application se termine.",
        "tte.\"Windows 10-Medien werden erstellt.(Sie k",
        "mYhok",
        "CSetupResponsePageSummary",
        "&Atcelt",
        "nt elemek kompatibilisek-e a Windows 10-zel. Ez eltarthat n",
        ", koska nykyinen Windows-versiosi saattaa olla asennettu hakemistoon, jota ei tueta, tai yrit",
        "gi fejleszt",
        "Ir3sy",
        " USB, une carte SD ou un disque dur externe, pour ",
        "ri in",
        "ge. V",
        "sakor",
        "tt az al",
        "lacak. Bu i",
        "r beskjed n",
        "&Seuraavat asiat tarvitsevat huomiotasi",
        "lpa till att g",
        "minen manuaalisesti suorittamalla %1!s!.",
        "n5w'I",
        "tAPPPh\\",
        "5!61696",
        "ei pentru software Microsoft7Angajamentul de respectare a confiden",
        "Die Dateien auf Ihrem USB-Laufwerk werden gel",
        " Windows 10. Zavrite in",
        "l, ha minden k",
        "Saznajte vi",
        "_g0Y0:",
        "Nepodarilo sa ulo",
        "Die Sprache stimmt nicht ",
        "Leidimai nesutampa",
        "rankos ",
        "%c:CDatorn kommer att startas om flera g",
        ", program",
        "lgende indstillinger for at forts",
        "<(<8<<<@<D<H<L<P<T<X<\\<`<d<l<",
        "aukti",
        " systemu Windows 10\"System Windows 10 jest ju",
        "dition uniquement si vous installez Windows sur un PC con",
        "ISO file",
        " %d%%!",
        "Flttte",
        "to vidim ovo?",
        "lectionner l",
        "llningar eftersom du installerar en utg",
        "s kiad",
        "ami vismaz 350 MB br",
        "ebovat.",
        ";$;0;<;H;T;`;l;x;",
        "[UUUUHUHHHHHHG9%",
        ">3>F>V>l>{>",
        "Keel ei sobi",
        "es, controladores e funcionalidades opcionais. Estas atualiza",
        " de uma chave do produto (Product Key) do Windows 10.",
        "0~0W0_0",
        "w precommit.cmd.",
        "  &Haluan auttaa kehitt",
        " izdelka ni deloval. Vnesite drug klju",
        ".?AV?$__func@V<lambda_4b29d149b8821cfbae4eba16ce6a2849>@@$$A6G_NPAXI0II@Z@__function@wistd@@",
        "%3!s!4Reiniciando el programa de instalaci",
        "Vypad",
        "A Windows telep",
        "Valoda",
        "ke, podr",
        "GetTickCount",
        "lg en af f",
        "(%1!c!:) - %2!s! bo",
        "Veuillez s",
        "Selectare unitate",
        " do nast",
        "r Windows ansluter till Internet f",
        "CSetupResponseTemplate<class IDlpResponse>::ExecuteRoutine: Next button clicked.",
        "ekajte da zavr",
        "3M4^4",
        "nTa bort f",
        "t1uk0d0D0f0o0",
        "installation de Windows 10 dans Windows Update.`Configuration de mise ",
        "lectionner Image",
        "n ott folytatjuk, ahol abbahagytuk.2Ezen a g",
        "n de Windows Server 2019 debe reiniciarse para que funcionen. Despu",
        "dzu, uzgaidiet, l",
        "CSetupResponseTemplate<class IActivationActionResponse>::ExecuteRoutine",
        "Atjaunin",
        "imu.CUSB flash disk mus",
        "&Prihvati",
        "ZKontrola kompatibility toho, ",
        "&Concluir",
        "djon arr",
        " utilizez stocare extern",
        "es recomendadas para este PC",
        " starsz",
        "CSetupResponsePageDiskSpaceReq::OnLearnMoreLinkClicked",
        "Ein Problem ist aufgetreten.XKlicken Sie zum Installieren von Windows 10 auf dem Installationsmedium auf ",
        "hren des Befehls ",
        "CSetupResponsePageBitLockerKeyValidate::CSetupResponsePageBitLockerKeyValidate",
        "_a>OD",
        "Language",
        " ve ki",
        "i ce s",
        "<9=p=w=~=",
        "o pode usar seu computador enquanto o Windows ",
        "TargetISO",
        "S0n0 ",
        "s reciente de Windows 10",
        "emt vair",
        "ta nije uspelo. Ru",
        "t.;Az Adathordoz",
        " hardware. N",
        "GetPrivateProfileSectionW",
        "Escribe la clave de Bitlocker",
        "Instalac",
        "0j0D0g0O0`0U0D0",
        "Server",
        "Seleziona la partizione in cui vuoi installare Windows.",
        " obecnie u",
        ", nes dabartin",
        "Tato akce m",
        "Wenn Windows 10 zuvor auf diesem PC installiert und aktiviert war und Sie eine Neuinstallation durchf",
        "s versijas lejupiel",
        "gesini manuel olarak ",
        "ajte ponovo.'Windows nije aktiviran na ovom ra",
        "1(2;2",
        "4=5i5",
        "%s installerenGDe computer wordt opnieuw opgestart om door te gaan met de installatie.",
        "Fichier ISO!S",
        " valida. Continua.",
        "eddef",
        "rateur %2!s!",
        ". Paleiskite s",
        "r att installationen g",
        "Nie mamy pewno",
        " izdelka za Windows 10.",
        "n a que la instalaci",
        "zyka lub wydania wersji systemu Windows zainstalowanej obecnie na tym komputerze.",
        ": %1!s!",
        " DVD ",
        ".?AVCWebBrowser@UX@Common@ConX@@",
        "installation n",
        "trukti.xDiegiant ",
        "o porque o Windows n",
        "c restart",
        "to sledi.ZBitlocker izgleda otprilike ovako: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX2BitLocker klju",
        " przerwano.ANa tym komputerze nie mo",
        " potrebn",
        " funkcie a jazyky.",
        "cuter la version la plus r",
        ".?AV?$CZeroInit@VCSetupDialogDownlevelInstall@@$00@@",
        " z tego narz",
        "m apenas 48 caracteres.?O valor de chave %d de grupo ",
        "re om Windows Server 2019 er klar for PC-en din n",
        "ynnistyksen j",
        "ouverture de votre dossier T",
        "Partycja dysku",
        "[1N39",
        "0`0Q0k0",
        "ku. Nap",
        "ib olla installitud toetuseta kataloogi v",
        " soubory",
        " instalace. Vy",
        "k igen.3Windows Server 2019 ",
        "Pre nedostatok miesta na disku nem",
        " narz",
        "Downloads8Remove large or unused files from your Downloads folder.",
        "=+>F>y>",
        ". Folytassa a telep",
        "Pasirinkite skaidin",
        "=\\=c=j=v=",
        "e ni pripravljen za ta ra",
        "La protezione BitLocker verr",
        "o atual do Windows, voc",
        "gle.HProduktn",
        "te desc",
        "rifiez-la et r",
        " naujo..S",
        "Windows 10 kandja loomine(V",
        "PreuzimanjaCUklonite velike ili nekori",
        "eCette cl",
        "Leelawadee UI Bold",
        "anai ",
        "ku Windows versiju.fDisk",
        "ktu instal",
        "Declara",
        "ISO-tiedosto",
        "ji si zjist",
        "cija v",
        "s varam pal",
        " ne funkcionira. Provjerite ga i poku",
        "ntr-un director neacceptat sau ",
        " tento po",
        "e se povezati sa mre",
        "pet vissza",
        "gumu.",
        "&Osve",
        "Architektura",
        "Elija que medio usar",
        "Kui j",
        "DuplicateHandle",
        "n. St",
        "%2!s!=Din organisation administrerer dine opdateringsindstillinger.",
        " komputer i uko",
        "tuves iestat",
        "nnen es nach Abschluss der Installation entfernen.:Die Anforderungen sind abgeschlossen! Dr",
        "i nebo zkou",
        "installation.ULa cl",
        "o para tentar novamente._A Instala",
        "anas izv",
        "rieure de Windows.zLe lecteur que vous essayez d",
        "NWindows Server ",
        "jat pirmo reizi, ir j",
        "n de almacenamiento.",
        "Veja abaixo se quiser saber o motivo.",
        "installation.#Cela peut prendre quelques minutes.",
        "Arhitektuur ei sobi",
        "nd de ",
        "A&nnuler",
        "ts-ZA",
        "irties.",
        "%hs: Dialog Initializing - Gated Unknown",
        "X,VgYV",
        "e da potraje nekoliko minuta.",
        "dia se objevil probl",
        "e obejmowa",
        "zerindeki bilgileri g",
        "ploiement precommit.cmd en cours d",
        ".idata$5",
        "ServerStandard",
        "s, mais vos fichiers le seront.NTout sera supprim",
        "lkeen oikein ja sinun on mahdollisesti asennettava jotkin valinnaiset ominaisuudet ja kielet uudelleen.,Utiliser les anciens fichiers d'installation",
        "iadavky boli splnen",
        "[Hibak",
        "2,3l3",
        "ExpandEnvironmentStringsW",
        "ndirmeniz do",
        "(Tento k",
        "emo tamo gdje smo stali.-Na ovom se PC-ju ne mo",
        "rifiez-la, puis r",
        "NtQueryWnfStateData",
        "nk a feladat elv",
        "040904B0",
        "Microsoft Time-Stamp Service0",
        "elite namestiti Windows 10, kliknite datoteko ",
        " de produit Windows 10 valide.",
        "Redmond1",
        "VoorbereidenQDit hebt u al gedaan. Klik op Vernieuwen om het item uit de lijst te verwijderen.UEr is een probleem met deze bewerking. Vernieuw de lijst en probeer het nog een keer.",
        "tirme, yaln",
        "p kijel",
        "s\"A Windows adatv",
        "), reikia tur",
        "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8",
        "s biztons",
        ">*>@>N>d>",
        "2'242=2M2d2p2{2",
        "ete da ga uklonite po zavr",
        "l operacijos %2!s! klaidos",
        "Vor dem Update sind einige weitere Schritte erforderlich. Sobald der Vorgang abgeschlossen ist, werden Sie benachrichtigt und ",
        "rankio j",
        " listo7Vamos a seguir instalando Windows 10 en Windows Update.VConfigurando la actualizaci",
        "Niets behouden",
        "tom. Kad se pove",
        " instalacji, poniewa",
        "Asenna Windows 10",
        "9$909T9\\9d9l9t9|9",
        "nicu da se tijekom instalacije ne bi potro",
        "CurrentIP",
        "eno je %d%%",
        "v igen.*Windows 10 er ikke klar til denne pc endnu'Kontrollerer, at installationen er klar",
        "Kirjaudu j",
        "r%E~&B",
        " rula",
        " il tuo PC1Sto verificando la disponibilit",
        " nebeidzas akumulatora ener",
        "ywana wersja.",
        "#USB ",
        "0~0Y0)",
        "o.*Requisitos Conclu",
        "9`9t9",
        " najnowsz",
        "bs-BA-Latn",
        "Ja veiksit jaunin",
        "o sa toto zobrazuje?",
        "Odaberite put",
        "teva minute.",
        " din pc pga. manglende diskplads. Frig",
        " cheie.",
        "354w4",
        "n tietokonettasiUT",
        "a e avisos aplic",
        "6<6D6",
        "reiz j",
        " entrar nele novamente. Para recapitular, voc",
        " pronto para continuar a instalar o Windows 10. Tente reiniciar a Configura",
        "-Ladda ned den senaste versionen av Windows 10",
        "rKak0;b",
        "v at genstarte Installation.",
        "ajte ponovo da pokrenete alatku..Do",
        "s a Windows 10 leg",
        "6$6V6",
        "Installatiemedia (USB-stick, dvd of ISO-bestand) voor een andere pc maken",
        "emo da utvrdimo da li na ra",
        "n vagy a v",
        "laszt",
        "Koristite vanjski ure",
        "lt, ez",
        "cia Windows Servera 2019 zlyhala In",
        " o seu PC para ser executado no modo S. Escolha esta edi",
        "WaitForThreadpoolTimerCallbacks",
        " bitlocker ",
        "iama ",
        " sa stiahnut",
        "ll.BA(z) %d. csoport kulcs",
        "CSetupResponseTemplate<class ICompatActionResponse>::OnCancel",
        " ISO ",
        "Windows-privacyverklaring",
        "s;Ezzel az eszk",
        "velet k",
        " USB-",
        "ke: 0x%1!lX! - 0x%2!lX!",
        "Papirkurv>T",
        "elite ohraniti, jih varnostno kopirajte na varno mesto.",
        "V[VVMMMMM>%%\"%\"\"?",
        " kullanmaya devam edebilirsiniz.",
        "unalniku dovolj prostora*Ali ",
        "000PPP",
        "cution.Cette op",
        "ticamente1La clave de producto solo contiene 25 caracteres.",
        "Segoe UI Semibold",
        "Jh~bVf-P",
        "To recap, you",
        "m~Vydanie Windowsu, ktor",
        "505X5{5",
        "n priz",
        "kkel for Windows 10",
        "ne Windows 10 funktsiooni kasutamiseks on vaja lisav",
        "stroje. Abyste mohli pokra",
        ": :D:L:T:\\:d:l:t:|:",
        "nderen kunne ikke ",
        "ku DVD diskov",
        "8'8;8E8L8R8W8c8s8",
        "tta. Granska informationen i %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml f",
        "o existem?",
        "s nevar",
        "0A$$@/",
        "2x(uiR(",
        "quc-Latn",
        "memmove_s",
        "FreeLibrary",
        "vU_-N",
        "080@0H0P0\\0|0",
        "<!<1<9<",
        "Installation de Windows 10",
        "s automatiquement.P",
        "n. Si no instalas las actualizaciones ahora, el equipo podr",
        "cia Windowsu 103Z",
        "i ID dijaloga-Ne mo",
        "rskenda",
        "L[PhP5CT",
        " zaawansowanego sprz",
        "e nastaviti jer sustav Windows ne mo",
        "talujete kliknut",
        "tartuje, budeme pokra",
        "Ambos`Esta chave do Bitlocker n",
        "iile1Se men",
        "Puede continuar usando su PC.MError de instalaci",
        "iile.H",
        "dik, bele",
        "skat nejnov",
        "Mamy problemy z okre",
        "RegisterTraceGuidsW",
        "t activated on this PC",
        "tu, ka instal",
        "  &Deseo ayudar a mejorar la instalaci",
        " tengas que volver a instalar algunas caracter",
        "W~~~VV~UP",
        " olabiliriz.",
        " gerir as suas defini",
        " Windows 8.1. ",
        "n automatikusan friss",
        "gido externo para expandir temporariamente o seu disco r",
        "Stasjonsvalg-Rydder opp f",
        " spusti",
        "uje se, jestli je instalace p",
        "EnumFontFamiliesExW",
        "n vannak.",
        "czeniu instalacji.&Instalator systemu Windows Server 2019<Ponowne uruchamianie Instalatora systemu Windows Server 2019",
        "ljivih mo",
        "$Microsoft Ireland Operations Limited1&0$",
        "Tuoteavain n",
        "o abaixo e, em seguida, selecione Atualizar.",
        ": XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "ykite ISO fail",
        "&Installieren",
        " disku",
        ")Program za instalaciju sustava Windows 10",
        "cii Windows Servera n",
        "0+0^0",
        "Pripraven",
        "ldre version av Windows.pDen enhet som du f",
        "no otvorite Pohranu u Postavkama.BOtvaranje Ko",
        " telep",
        "kkulccsal, majd v",
        "anas saglab",
        "d Product Key nefunguje. Vyzkou",
        "installation de l",
        "nl-BE",
        "4::zdd",
        " vom ajuta s",
        "tr-TR",
        "o. Informaremos quando terminarmos e o que fazer em seguida. Esta janela ser",
        "Velg bilde",
        ".#{[p",
        "memcpy",
        "r du kontakter kundesupport.",
        "%3!s!5Red",
        "Install Windows Server 2019",
        "ration peut prendre un certain temps.iConfiguration de la mise ",
        "Movendo suas configura",
        "baigsime, ir pasakysime, k",
        "ncerca",
        "Nada2Voc",
        " precommit.cmd.",
        "&Atsvaidzin",
        "fedin.",
        "8!8N8",
        " http://www.microsoft.com/windows0",
        "ndolo a instalar, puedes omitir este paso. Windows se activar",
        " Internet, ",
        "TrackMouseEvent",
        "AtkritneCIztuk",
        "Pro instala",
        "I~c4&",
        "ticamente cuando se complete la instalaci",
        "z var3%1!d!GB bo",
        "ico sistema Windows 10.",
        "+Ponovno instaliram Windows 10 na ovom PC-ju/Moram kupiti klju",
        " failure.cmd!",
        "No es posible determinar si el equipo dispone de espacio suficiente para continuar instalando Windows 10. Prueba a reiniciar la configuraci",
        "i ir modific",
        "Langue :",
        "```@@@   ",
        "ntalo de nuevo.BA continuaci",
        "o de 3",
        "7 vai Windows",
        "Instalar Windows 10CObtener actualizaciones, controladores y caracter",
        " soubory a aplikace",
        "0E1j1",
        "s saugyklos ",
        "e nastaviti zbog jednog od slede",
        "O&svje",
        "PW[CQ",
        "eUIspraznite ko",
        "cutez ",
        "kleniyor",
        " ceci : XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX:La cl",
        "II DESPRE INSTALARE: unele caracteristici Windows 10 necesit",
        "%1!ld!%% ir pabeigta",
        "Spustit instalaci znovu od za",
        "r litt plass under og velg deretter Oppdater.",
        ".?AVCWebbrowserClientSite@@",
        "o (pen USB, DVD ou ficheiro ISO) para outro PC",
        "Sistema operativo:",
        "0F0k0",
        "ber die weiteren Schritte informiert. Dieses Fenster wird in %1!d! Minuten automatisch geschlossen.$Was Sie vor dem Start wissen sollten",
        "=CI^D~M",
        "tre d'une taille sup",
        " znova.",
        " pentru a relua instalarea.",
        " bruke PCen.",
        "li nie zainstalujesz teraz tych aktualizacji, Tw",
        "n de Windows que es diferente a la que estas usando ahora.",
        " na aktiv",
        ", ale aby fungovaly, mus",
        "Updates applied",
        "A atualiza",
        "tkamist. Probleemi lahendamiseks vaadake teave ",
        "o coincide",
        "cie sa odstr",
        "wcschr",
        "Si vas a instalar Windows 10 en tu PC por primera vez (o instalar una edici",
        ".,Windows ",
        "jra be kell majd ",
        "rankai nepavyko prad",
        "n los archivos de tu unidad USB. Para conservar estos archivos, realiza una copia de seguridad de ellos ahora en otra ubicaci",
        "ounknown",
        " nije spreman za ovaj ra",
        "st a Lemezkarbantart",
        " a fazer uma limpeza antes de fechar(Este processo pode levar alguns minutos.PLigue o PC ",
        "Ako po prvi put instalirate Windows 10 na ra",
        "Tenemos problemas para determinar si el equipo puede ejecutar Windows Server 2019. Cierra el programa de instalaci",
        "Legale",
        "CSetupResponseTemplate<class ICompatActionResponse>::IsBackEnabled",
        "Verifiserer nedlastingen Velg hvilket medium du vil bruke",
        "Eiga: %1!d!%%6Nor",
        " jour ?!Pourquoi ce message appara",
        "rtu diska t",
        "ments suivants n",
        " \"\"-@6-\" ",
        "sentait avant le d",
        "Me ei saanud salvestada installimisteavet, mida on vaja Windowsi installimise j",
        "u pievieno",
        "cia pripraven",
        " kapsayabilir.",
        "neet asennustietoja, joita tarvitsemme Windowsin asennuksen jatkamista varten. K",
        " da dove ",
        "bory, aby ste mohli nain",
        "t k instalaci Windows.",
        "Nous devons effectuer d",
        "Most nem",
        "n necesaria para seguir instalado Windows desde donde lo dejaste. Tendr",
        "mes, signalez le code d",
        ".?Votre cl",
        "BEGIN_SECOND_BOOT",
        "l az eszk",
        "stroje BitLocker m",
        "r att ta bort det fr",
        "pule viidud",
        "ivitage oma installikandja juurkaustast fail ",
        "digo de erro quando contactar o suporte ao cliente.",
        "i o versiune mai veche de Windows.zUnitatea pe care ",
        "pa en Windows 10-produktnyckel",
        "Pozosta",
        "ifru pogre",
        "n no pudo empezar a instalar Windows. Reinicia el programa de instalaci",
        "Posodobitve so name",
        "Jau naudojate ",
        "nju na ovo ",
        "outil.:Un probl",
        "rifiez que vous ",
        "Der BitLocker-Schutz wird w",
        "juVh(",
        "If you continue without activating your current version of Windows, you",
        "No se encuentran los archivos de instalaci",
        "n automaattisesti(Asennus ei voinut ladata kieliresursseja'Asennus ei voinut alustaa ty",
        "es Manter apenas ficheiros pessoais",
        " verzi.2St",
        "tirmeden sonra Windows 10'u etkinle",
        "o e tente novamente.#O Windows n",
        "u yeniden ba",
        "\"Microsoft Window",
        " dzia",
        "/~=sd",
        "lle sisse logite.=Operatsioonis",
        ">)>A>Q>g>u>",
        "\\:N`O",
        "kustannuksia.#Mit",
        " z listy.UPodczas za",
        "ico.3Prenesite posodobljeno orodje za ustvarjanje medija",
        "%1!d!%% abgeschlossen",
        "6;6H6V6]6c6h6s6~6",
        "o ou execute ",
        "lja meg ",
        " PC-en. Aktiver den n",
        "ouverture du graveur de DVD. Veuillez graver manuellement le fichier ISO sur un DVD ",
        "Ett tegn igjen(Produktn",
        "ADVAPI32.dll",
        "Pole kindel, mis juhtus, kuid me ei saa seda t",
        "rankai nepavyko inicijuoti darbinio katalogo%Neleistini komand",
        ". Daugiau informacijos rasite s",
        "nosti Microsoft0Vyhl",
        "Ar tikrai norite baigti?",
        "ierele necesare. Asigura",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::GetResults",
        "Melkein valmista",
        "no pokrenite %1!s! da biste otvorili alatku ",
        ": %1!d!%%6",
        "WARNING",
        "rheten tills du loggar in igen.0Det gick inte att installera Windows Server 2019ZDatorn har ",
        " problem podczas tworzenia no",
        "ilo se n",
        "sr-Latn-CS",
        "SO toto ste sa u",
        "tik a telep",
        " %1!s! (%2!c!: ",
        "iului de stocare. Rula",
        "zca ki",
        "ujete sa sustava Windows 7 na Windows 8.1, ili ponovno instalirate Windows 10, ne",
        "[hQ'`9e",
        " tyto aktualizace nenainstalujete, nemus",
        "0~0_0o0 ",
        "rolnia egy Windows 10-term",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::CheckUninitialized",
        ".?AVIDlpResponseFactory@@",
        "'?DD````S|STRR\"",
        "Ja Windows 10 dator",
        "CSetupDialogBase",
        "rer %1!s! sur le lecteur %2!c!:.",
        "rjar./V",
        " do zainstalowania systemu Windows.",
        "zVi kan ikke sige, om pc",
        "   ```",
        "r att aktivera Windows 10 efter uppdateringen.",
        "Zainstalowanie tej wersji systemu Windows 10 spowoduje skonfigurowanie komputera do dzia",
        " navr",
        " jednotku a sk",
        " ir spustel",
        "l elt",
        "1Ponovno pokretanje instalacije izdanja Windows 10",
        "ne hetke.uSeda tootev",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::Initialize",
        " zainstalowane, ale aby zacz",
        "Semmi/Lehet",
        "i o edi",
        "lj vad du vill beh",
        "Instalacijski program malo posprema za sobom prije zatvaranja",
        "lg et andet drev.",
        "cente version de Windows",
        "aurez pas besoin de cl",
        "itajte ovo da biste znali na ",
        "tani a telep",
        "rsniegt 4 GB (var at",
        "&Turpin",
        "Media Creation Tool",
        "Sprawdzanie komputera",
        "6,6D6\\6x6|6",
        "lineell",
        "Failed to get free space for drive [%c]. Error: [0x%X]",
        "IOtvaranje mape Preuzimanja nije uspjelo. Ru",
        "Aby se dalo v instalaci pokra",
        " Vai tie",
        "y}gg2i",
        "&Fermer.Votre PC va red",
        "chten, sollten Sie sie jetzt an einem sicheren Ort speichern.",
        "t Windows iestat",
        " precisa estar conectado ao Windows usando uma conta de administrador.9Voc",
        "i mai t",
        "mogatott telep",
        "n de Windows 10.",
        ".idata$3",
        "Forbereder installation ",
        "unalnik ne more izvajati sistema Windows Server 2019cDraiv, mida proovite kasutada, on BitLockeriga kr",
        "iti jezikovnih sredstev>Namestitveni program ni uspel inicializirati delovnega imenika#Neveljavni parametri ukazne vrstice",
        "Preverjanje tega klju",
        "ller bara 25 tecken.",
        "des manu",
        "it instala",
        "ri.pDeschiderea inscriptorului de DVD-uri nu a reu",
        "j-X9E",
        "paration en cours",
        "CInstallUI::ShowExitingSetup",
        "787?7O7Y7x7",
        "daki harici s",
        "0De koppelstreepjes worden automatisch toegevoegd'Het laden van de taalbronnen is mislukt+Het initialiseren van de werkmap is mislukt!Ongeldige opdrachtregelparameters",
        "o somente se voc",
        "rbaud",
        "&Chiudi%Non ",
        "cia Windows Servera 2019. Pok",
        "daki y",
        "no si budete musie",
        "ydy. Aseta Windowsin asennustietov",
        "re reinstalling Windows 10, you won",
        ">YDlC",
        ". Windows ",
        " aktivovan",
        " doar dac",
        " Windows 10c",
        "V redu",
        "toru sa nepodarilo pou",
        " obtenir les derniers fichiers afin de garantir que vous installez la version la plus r",
        "lieties ",
        "En son s",
        ">.>;>Q>^>p>}>",
        "es-EC",
        "pade, ",
        " kopij",
        "Idioma",
        "Overuj",
        " attivato automaticamente al termine dell'installazione.$Installazione di Windows Server 2019=Riavvio del programma di installazione di Windows Server 2019",
        "Download updates, drivers and optional features (recommended)",
        "Na re",
        " avec BitLocker. Choisissez un autre lecteur et essayez de nouveau.",
        "iunile de mai jos pentru a termina actualizarea.'Elibera",
        "dakilere dikkat edilmesi gerekir.@Y",
        "emtu no saraksta.]M",
        "\\W0J0",
        "iame kompiuteryje anks",
        " un error no esperado.",
        "Comprobaci",
        "Odaberite particiju na koju ",
        " partir de Windows 7 ou Windows 8.1 ou que vous r",
        "ek0o0zzM0",
        "est produit lors du t",
        "2&3J3n3",
        "ploiement preinstall.cmd2Ex",
        "m Windows toto extern",
        "pa en Windows 10-produktnyckel eller -licens f",
        "0n0k0",
        "tL0B}",
        "iniet citu.<J",
        "PathToIso",
        "`YqT0VttgHBjY`",
        "Dette kan ta en liten stund.[Du kan ikke bruke PCen mens Windows installeres. Lagre og lukk filene dine f",
        "&Sluiten Uw pc wordt zo opnieuw opgestart",
        "teva minute.ZPune",
        "z. Ba",
        "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22        \"> <rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"> <rdf:Description rdf:about=\"\" xmlns:xmp=\"http://ns.adobe.com/xap/1.0/\" xmlns:dc=\"http://purl.org/dc/elements/1.1/\" xmlns:photoshop=\"http://ns.adobe.com/photoshop/1.0/\" xmlns:xmpMM=\"http://ns.adobe.com/xap/1.0/mm/\" xmlns:stEvt=\"http://ns.adobe.com/xap/1.0/sType/ResourceEvent#\" xmp:CreatorTool=\"Adobe Photoshop CC 2019 (Windows)\" xmp:CreateDate=\"2019-01-11T07:40:19-08:00\" xmp:ModifyDate=\"2019-01-11T07:44:07-08:00\" xmp:MetadataDate=\"2019-01-11T07:44:07-08:00\" dc:format=\"image/png\" photoshop:ColorMode=\"3\" photoshop:ICCProfile=\"sRGB IEC61966-2.1\" xmpMM:InstanceID=\"xmp.iid:0794f13b-4b14-6c41-b274-f4df3fe26d3b\" xmpMM:DocumentID=\"xmp.did:0794f13b-4b14-6c41-b274-f4df3fe26d3b\" xmpMM:OriginalDocumentID=\"xmp.did:0794f13b-4b14-6c41-b274-f4df3fe26d3b\"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action=\"created\" stEvt:instanceID=\"xmp.iid:0794f13b-4b14-6c41-b274-f4df3fe26d3b\" stEvt:when=\"2019-01-11T07:40:19-08:00\" stEvt:softwareAgent=\"Adobe Photoshop CC 2019 (Windows)\"/> </rdf:Seq> </xmpMM:History> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end=\"r\"?>",
        "Windows Server 2019 Setup)Windows Server 2019 Setup opnieuw starten",
        " medio se usar",
        "as diska kr",
        "lectionner la partition sur laquelle vous voulez installer Windows.",
        "noton komentosarjoja5Suoritetaan precommit.cmd-k",
        "0@$$>/",
        "Ikke sl",
        "|T|R|RRRRRM1",
        "Nyckeln kontrollerasYDen h",
        "jak takto: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX6Kl",
        "ltima vers",
        "ajke sustava Windows 10 ni sigurnosna pobolj",
        "ng alla ",
        "tkamiseks valige ",
        "No drives found",
        "SysListView32",
        "F|Pje",
        ", om Windows 10 er klar til din pc endnu. Luk installationsprogrammet, og pr",
        "alej pou",
        "&Hylk",
        " kullanarak ge",
        "kove.$Koje su druge mogu",
        ": %d#Br",
        "   @@@@@@",
        "N.FR?",
        "9*:8:Y:c:",
        "z pabeigts",
        "r telep",
        "# y4TJ",
        "ete nain",
        "etku instalacije.9Zahtevi su dovr",
        "rej chcesz zainstalowa",
        "%s installierenCWindows startet den Computer neu, um die Installation fortzusetzen.",
        "This background download can be 4GB+ (may vary) and internet access fees may apply. Click Next to download the latest installation files.",
        "Levyosio",
        " soubor",
        "i Windows 10 pe acest PC pentru prima dat",
        "iului-disc redus. Elibera",
        "z anahtar",
        "DWindows ",
        "de-LU",
        "dokon",
        " klucz produktu",
        "z gerekir.7ISO dosyas",
        "te si pros",
        "cii br",
        "?%p!Gn",
        "ncia\"Escolher o suporte de dados a usar",
        ".?AV?$CZeroInit@VCSetupDiskSpaceDlpResponseFactory@@$00@@",
        "Ouvrir les t",
        "s sat",
        "avons pas pu installer Windows Server 2019",
        "uriranja",
        "?8?S?c?}?",
        " prie",
        "Microsoft YaHei Bold",
        "Privacyverklaring",
        " se aktualizace. Zji",
        "Ekran &Klavyesi",
        "en-PH",
        "oAA instala",
        "ia versiunii de Windows care este instalat",
        "unara",
        ";3;[;",
        "ierele de instalare Windows. Introduce",
        "en (eller installerer en anden version), har du brug for en produktn",
        "unaru,Moram da kupim ",
        "i operaci %2!s! do",
        "a pentru clien",
        "ne datoteke i aplikacije(Zadr",
        "|=9t$",
        "A procurar atualiza",
        " de groupe %d n",
        " possibile determinare se Windows 10 ",
        "Sprogene stemmer ikke overens",
        "e masz po",
        "ngre beh",
        "?/?L?R?[?g?",
        "(DFIIIOOppppOOOka",
        "t vyu",
        "No mantener nada",
        " k internetu, a zkuste to znovu.+Spou",
        "A preparar a configura",
        "izmanto",
        "000@@@PPP",
        "rednio sprzed rozpocz",
        "lja n",
        "o do Windows Server 2019. Tente reiniciar a Instala",
        ")Es wurde kein USB-Speicherstick gefunden.",
        "tkata?~Teie faile, rakendusi ja s",
        " budete pripraven",
        "tions arr",
        "ar-JO",
        "SelectedDUOptIn",
        "dHm0o",
        "Windows 10 installiprogramm",
        ". Jo negalima naudoti diegiant ",
        "Windows 7",
        ";:<@<M<v<",
        "pne Nedlastinger-mappen. ",
        ":Preuzmite najnoviju verziju operativnog sistema Windows 10",
        "gbar ist. Befolgen Sie die Anweisungen unten, um das Update abzuschlie",
        "ReserveManager.dll",
        "alej. Toto okno sa automaticky zavrie po %1!d! min",
        "tuje extern",
        "CreateEventW",
        "de-DE",
        "s fontos jav",
        "lne.fNepodarilo sa otvori",
        "o do Windows Server 2019",
        " Windows.T",
        "es-419",
        "sa-IN",
        "lgende eksterne drev og klikke p",
        ">.>t>",
        "kalu uudelleen.*T",
        "laszthat",
        "X~xhpp",
        "i anlam",
        "Produktnyckeln ser ut ungef",
        "%1!ld!%% dovr",
        "cia instalacji systemu Windows Server 2019.WB",
        "7*7P7",
        "o.`Susid",
        " disk, a do",
        "Cette cl",
        "owy identyfikator okna dialogowego%Nie mo",
        "\"Dashes will be added automatically/Setup has failed to load the language resources4Setup has failed to initialize the working directory",
        "winbrand.dll",
        "tenje sa najmanje %1!s! slobodnog prostora",
        "tottak vagy elt",
        "iame kompiuteyje gali b",
        "Actualizaci",
        "no ho pou",
        "NEz a term",
        "Vous ne pourrez pas utiliser votre ordinateur pendant l",
        "Windows 10 installieren",
        " la mise ",
        "Ange BitLocker-nyckeln",
        "Installer Windows Server 2019.Cette op",
        "&Weiter",
        " diegiate pirm",
        "CSetupResponsePageBitLockerKeyValidate: OnOSKBtnClicked",
        "es que precisa de analisar",
        "Ninguna etiqueta",
        "diegti senesn",
        "ti.CTiks dz",
        " BitLocker ile ",
        "ivitab Windows arvuti.",
        "&Geri",
        "6D6J6Q6",
        "echny pot",
        "j-Xf9",
        "CSetupUIManager::~CSetupUIManager",
        "tekli",
        "Papildinform",
        "/#<,v@WH",
        "ia naujinimus",
        "chte stattdessen externen Speicher verwenden.-Ich m",
        "LagringsbrukRUtforsk lagringsbruken manuelt i Innstillinger for ",
        " Even kijken wat er moet gebeuren",
        "|Q|SRRRRRN",
        "jljait, alkalmaz",
        "r endast tillg",
        "Prenesite najnovej",
        "v/fHr,g",
        "Installationsprogrammet rydder op, f",
        "nico. Cuando te conectes a Internet, activaremos Windows por ti.",
        "&Bildschirmtastatur",
        " soubory a aplikace+Zachovat nastaven",
        "lamadan ",
        " Windows 100",
        "?(?8?K?^?q?",
        "ngen beh",
        "rt! Tryk p",
        "n en Windows 10. Para ayudar a proteger tus datos, deber",
        "ller dig, hvad du s",
        "onnistui. Ota k",
        "anje sistema Windows 10 bomo nadaljevali v storitvi Windows Update.[Konfiguriranje posodobitve za Windows 10",
        "OpslaggebruikYBekijk het opslaggebruik handmatig via Instellingen om andere grote items te verwijderen. Extern opslagapparaat selecteren",
        "Vytvo",
        "&Fertig stellen",
        "Velg ekstern lagringsenhet",
        "bory. Ak chcete tieto s",
        "unalo za nekoliko trenutaka ponovno pokrenuti",
        "hoz helyezze be a Windows telep",
        "re oppdateringen.)Frigj",
        "x5:$*",
        "i ales s",
        "hemalt 350 MB kettaruumi. Vabastage kettal ruumi ja proovige siis uuesti.AOper",
        "555(433",
        "g nem telep",
        " system Windows nie mo",
        "es-AR",
        "dhat.",
        "t cit",
        "nimo.",
        "gP}_g",
        "i se va relua c",
        "Elle ressemble ",
        "Entfernen Sie bitte das folgende externe Laufwerk, und klicken Sie auf ",
        "3(4@4",
        "sik part",
        "Za&instaluj",
        "na bak",
        "s parametrai",
        "Atsisiun",
        "BitLocker-skyddet pausas under uppdateringen och ",
        "no odprite mapo ",
        " katalogu roboczego)Nieprawid",
        "kkelen ser slik ut: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX4Bitlocker-n",
        " podczas instalowania.",
        ":a5L.Y",
        ": %d%%\"D",
        "zh-Hans",
        "RW0f0O0`0U0D0:",
        "ff-Latn-NG",
        "essayez.ENous allons ensuite vous aider ",
        "8aX`^i/-JR;M",
        "7;7^7",
        "cii Windows Servera 2019. Sk",
        "IsValidCodePage",
        "94:::J:Z:j:z:",
        "jumi ir instal",
        ">$>D>P>p>|>",
        "ke. Provjerite je li pristup instalacijskim resursima mogu",
        "- PC ",
        " BitLocker ne contient que 48 caract",
        " nem kezel parancssori argumentumokat. Ha b",
        "avons pas pu ex",
        "kat tapasztal, forduljon az ",
        "ovat a aby se mohlo zachovat va",
        "let. K",
        "zt.#Hiba t",
        "Sag>k",
        " podporovan",
        "ane.CSve ",
        "re fois (ou une autre ",
        "Licences nosac",
        "r diesen PC noch nicht bereit./Sicherstellen, dass die Installation bereit ist",
        "6/6;6T6^6w6",
        "n ve ard",
        "tter vi der, hvor vi kom til.!Denne pc kan ikke k",
        "teva aspecte de care trebuie s",
        "|l|Vx",
        ".?AVAFX_MODULE_STATE@@",
        "tani a g",
        " produkto kod",
        "7C7e7",
        "Rg\"x:y%O;V",
        "M@VMM@OE4~",
        "hr-BA",
        "i.9Windows Server 2019:",
        "6'''''''''''",
        "Complete",
        "Selecionar Imagem",
        " Microsoft Corporation. Vse pravice pridr",
        "?#?(?<?U?z?",
        "lit ISO soubor na DVD",
        "10 atbalsta perioda laik",
        "FNepodarilo sa otvori",
        "bn(Jeg vil i stedet bruge et eksternt lager$Jeg vil ikke bruge et eksternt lager",
        "czenie odinstalowywania aplikacji.",
        "Izaberite particiju na kojoj ",
        "Utiliza",
        "dzu, uzgaidiet7Preinstall.cmd skriptu palai",
        "ali jo",
        ".\\USB-",
        "_U(u ",
        "111019184142Z",
        ":(;L;",
        "iendavaid faile, mida pole installikandjal. Kui te neid v",
        "BitLocker protection will be suspended during this update, and will resume when you sign in to Windows 10. To help protect your data, you should keep your PC with you until you sign in again.",
        "O(uW0~0[0",
        "tzliche Dateien enthalten, die sich nicht auf dem Installationsmedium befinden.",
        " tietokone uudelleen. Windowsin asennus jatkuu sitten automaattisesti.",
        "r. toliau, jei norite su",
        "Lemezpart",
        "tka sealt, kus mul pooleli j",
        "ado para ejecutarse en modo S.TLa unidad flash USB debe tener al menos %1!d! GB o superior. Selecciona otra unidad.!Descargar la versi",
        "vNismo mogli preuzeti sve nu",
        " potrwa",
        "Du er klar.9Installasjonen av Windows 10 fortsetter i Windows Update.XKonfigurerer oppdatering for Windows 10",
        "s a v",
        "o suficiente)Deseja continuar a utilizar esta sele",
        "e da po",
        "h v tomto re",
        "*Kontroluje sa, ",
        "zca 48 karakter bulunur.AGrup %d anahtar de",
        "iVi kan inte avg",
        "s paman",
        "Vi kunde inte spara installationsinformationen som vi beh",
        "l.&A Windows nincs aktiv",
        "in bir Windows 10 ",
        "t able to download all the necessary files. Check to make sure that you",
        ". Atualize a lista e tente novamente.",
        " termine instalarea.",
        "? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\\?`?d?h?l?p?t?x?|?",
        "r megnyit",
        "e. Isprobajte drugu ",
        "9=:Z:",
        " suaktyvinti.",
        "nainte de a ",
        "D$h%N",
        "Error reporting telemetry for bOpenRecycleBinClicked: [0x%X]",
        "000c0",
        "Izdaje se ne ujemajo",
        "va installera om vissa valfria funktioner och spr",
        "0f0D0j0D0",
        "La mise ",
        "tres, car vous installez une ",
        " jour gratuite vers Windows 10 est disponible uniquement si vous disposez d",
        "Disk jedinica koju poku",
        "n.QGeri D",
        "6Gaukite naujinimus, tvarkykles ir papildomas funkcijas",
        "%3!s!3Ponovni zagon namestitvenega programa za Windows 10",
        "dik majd megfelel",
        "sim instal",
        ".?AVCSetupResponsePageBitLockerKeyValidate@@",
        "0[0Z0",
        "ny percig is eltarthat.",
        "m liet",
        "o pode demorar alguns minutos.zN",
        "rddisk, f",
        "V[[M[MMMOM@>%\"\"\"!x",
        "chr-Cher-US",
        "cu extern",
        "nda pilinizin bitmeyece",
        "tfen ba",
        "ta5Windows postavkama ",
        "'Neplatn",
        "rtslDen h",
        " Iestat",
        "t tell if your PC has enough space to continue installing Windows 10. Try restarting Setup.$Making sure your PC has enough space-Do you want to continue using this selection?",
        "p]]]$",
        "Selecteer de partitie waarop u Windows wilt installen.",
        "Vi kan ikke afg",
        "Aggio&rna",
        "Keep personal files and apps(Keep Windows settings and personal files",
        "rskendage loend ja proovige uuesti.",
        " poder",
        ";$;7;f;",
        "tirme yap",
        " identifik",
        "oikeus, jotta voit aktivoida Windows 10:n p",
        " kullan",
        "avons pas pu installer Windows 10.}Nous avons remis votre ordinateur dans le m",
        "o livre",
        "e enkrat poskusiti, znova za",
        ":,:4:8:T:l:",
        " Windows 8.1 ",
        "ete.1Nismo mogli namestiti sistema Windows Server 2019[Ra",
        "s, nous ne pouvons pas d",
        "chargement de Windows 10",
        "re den seneste version for at forts",
        " necessario il tuo intervento per completare queste operazioni.`Per continuare l'installazione, ",
        "Adatv",
        "Asenna Windows Server 2019",
        "Gatavs instal",
        " nytt. Installasjonen av Windows vil fortsette automatisk.",
        "Dette kan tage flere minutter.YS",
        " Kosza. Otw",
        "GetVolumeInformationW",
        "Nismo prona",
        "pne lagringsbruken. Du m",
        "ra om datorn ",
        "t izmantot ",
        "a/Ta klju",
        "CSetupUIManager::OnActionChanged",
        "Produkto kodas",
        "%1!s! %2!s!8Pojavio se problem prilikom stvaranja medijskih sadr",
        ">99yaa",
        " introduce",
        " saattaa kest",
        "6'6/6A6l6z6",
        "en-ID",
        " internet. ",
        " pronta",
        "Windows 7 veya Windows 8.1.",
        "in, tekrar oturum a",
        "LocalAlloc",
        "USB-flashstation",
        "s le red",
        " scripturile de implementare preinstall.cmd4Se execut",
        "tt genom att v",
        "$99898886#t",
        "veic v",
        "pen, mert kev",
        "8 8$8<8@8X8h8l8|8",
        "ru un izdevumu",
        "bi, et teaksite, millega te n",
        "n Windowsin asennusta",
        "tanje postavki (%d%%)",
        "s papildomai mok",
        "kkulcsra lesz sz",
        ":5:C:q:",
        "DeviceIoControl",
        "Tarkistetaan p",
        "e je bil sistem Windows 10 v tem ra",
        "?$?,?4?<?D?L?T?\\?d?p?",
        "elite ve",
        " Microsoft Corporation. Todos os direitos reservados.",
        "s, ejecutar el medio para instalarlo.",
        "qps-Latn-x-sh",
        "s que volver a escribir la informaci",
        "es, controladores e funcionalidades opcionais (recomendadas)",
        "O(uW0f0D0",
        "Windows.iso",
        "0S0n0",
        ": 0x%x]+",
        "%1!s! %2!s!8Un probl",
        " necessario riavviare il programma di installazione di Windows 10. Dopo il riavvio, il programma di installazione riprender",
        "installation de Windows. Enregistrez et fermez vos fichiers avant de commencer.APatientez pendant que l",
        "Selezionare lingua, architettura ed edizione",
        " sadr",
        "sv-FI",
        "Aktualizace jsou nainstalovan",
        "su failus, programmas un iestat",
        "inok Stiahnut",
        "*NpeW[W[&{",
        "iuos dalykus.=Norint t",
        "ete kasnije da nare",
        "RW0f0O0`0U0D0",
        "re nem haszn",
        "ej przedstawiono elementy wymagaj",
        " disk, DVD ili ISO datoteku) za drugi ra",
        ".?AUIDocHostUIHandler@@",
        " de reciclareUGoli",
        "ite seznam in poskusite znova.",
        "o, mas ser",
        " systemu Windows Server 2019",
        " avec BitLocker. Choisissez un autre lecteur et r",
        "m. Obnovte zoznam a sk",
        "memcpy_s",
        "&Instalar",
        "o robi",
        "t no vietas, kur tika p",
        "Lue lis",
        ")Chcem prein",
        "D$@+D$0P",
        " cu BitLocker. Alege",
        " DVD. ",
        "T*!W, ",
        "n de Windows y archivos personales\"Conservar solo archivos personales",
        " programy a restartujte po",
        "w. Sprawd",
        " program a zkuste to znovu.oInstala",
        "e se kada se prijavite u Windows 10. Da biste za",
        " aktualizovan",
        "cuter cette version pour continuer.6T",
        "Agora n",
        "dia (USB flash disk, DVD nebo soubor ISO) pro jin",
        "!(@|rr",
        "lida. Volte a introduzir a que comprou online.",
        "re om PCen kan kj",
        "li zamierzasz zainstalowa",
        "i face",
        "eno: %1!ld!%%",
        "bPasirod",
        "Operazioni preliminari in corso-Questo strumento non pu",
        "rHDu har allerede gjort dette. Klikk Oppdater for ",
        "SYSPREP_RESPECIALIZE",
        " Internetiin, ja yrit",
        " miejsca do kontynuowania instalacji systemu Windows 10. Spr",
        " Microsoft Corporation. Sva prava zadr",
        "iti je li va",
        "invalid string position",
        "@Windows 10 ",
        "r med p",
        "base\\ntsetup\\conx\\common\\setuplib\\src\\language.cpp",
        " %2!s! vaba",
        "r o cheie de produs Windows 10",
        "s automatiquement.0La cl",
        "O: Algumas das funcionalidades do Windows 10 necessitam de hardware avan",
        "es necessitam da sua aten",
        "ben addig tartsa mag",
        "Dit kan een paar minuten duren.",
        "kajte, pros",
        "ckversetzt, in dem er sich befand, bevor Sie die Installation von Windows 10 gestartet haben.",
        "gai, nav pieejams j",
        "avate da iskoristite nema dovoljno dostupnog prostora. Odaberite neki drugi disk i poku",
        "041A1X1l1",
        "5?5F5\\5J7u8",
        " jeszcze raz.rInstalator nie mo",
        "tiski aizv",
        "Vi bem",
        " system Windows 10 na tym komputerze,Chc",
        " Windows Server 2019lJednotka, kterou chcete pou",
        ";[<n<",
        "CSetupResponseTemplate<class IDiskSpaceActionResponse>::IsBackEnabled",
        "   @@@ppp",
        "ib kuluda m",
        "uriranje",
        "i-l pute",
        "uga automat-Cheia de produs con",
        "dami apsaugoti savo duomenis, tur",
        " possibile trovare un'unit",
        "<5><>",
        "kleyemiyoruz. A",
        "Arkkitehtuuri",
        "nun yeniden ba",
        "n ya da yer a",
        "Otvori stavke za preuzimanje",
        "fy-NL",
        "No se pudo instalar Windows 10YSe ha establecido el equipo al estado anterior al inicio de la instalaci",
        " para retomar a instala",
        ".|Jei reikia daugiau informacijos apie ",
        " de %1!d! Go ou sup",
        "mu Windows. Nemo",
        "om-ET",
        " pronto para seu computador. Feche a Instala",
        "jra fog indulni. Ez a folyamat hosszabb ideig is eltarthat.",
        "o gerencia suas configura",
        " k internetu a zkuste n",
        " riuscito a pulire i file di installazione`Il programma di installazione non ",
        "n de failure.cmd!Esto puede tardar varios minutos.",
        "Yg0M0~0[0",
        " baigs ",
        "rification de la cl",
        "QSVW3",
        "as in",
        "rliecinieties, vai ier",
        " jenom 48 digit",
        "8(8C8N8i8t8",
        "Download opdateringer, drivere og valgfrie funktioner (anbefales)",
        "lb-LU",
        "ivitys noudattamalla alla olevia ohjeita.*Vapauta %1!s! tietokoneessa (%2!c!:-asema)QValitse tai liit",
        "marrage de l",
        "e bude nutn",
        "[-NKb",
        "Instalacija operativnog sistema Windows ",
        "Nincs",
        "l/^94",
        "te instalarea ",
        " ting, vi er n",
        "n timp ce am ",
        " (se razlikuje) in morda bo treba pla",
        "mentaires.0Quelles sont les autres options de mise ",
        "hist Interneti-",
        ".?AVCSetupResponsePageUpdateMedia@@",
        ". Ukon",
        ", kuriuose reikia atsiminti:",
        "/@-$A0",
        "ntalo de nuevo.8Ejecuci",
        "rio raiz da m",
        " sur cet ordinateur. Ceci signifie que vous devez saisir la cl",
        "eni! Kliknite na dugme da biste nastavili1Odaberite drugi spolja",
        "ete instalaciju.rZa pokretanje instalacije je potrebno najmanje 350 MB prostora. Oslobodite deo prostora, a zatim poku",
        "rile: %1!d!%%,Aceast",
        "Izbor disk jedinice",
        "6L7R7j7v7",
        "lectionner un chemin",
        "Error reporting telemetry for bToggledtoExternalStoragePage = %d: [0x%X]",
        "marrer l",
        "gle fungerer ikke. Pr",
        "62xmm",
        "Nekaj prepre",
        "ke programe i dodatne zna",
        "iek tiek u",
        "W0f0K0",
        "nstalleerd op uw pc wordt niet ondersteund door dit hulpprogramma.",
        " do za",
        "re installationsprogrammet. Frig",
        "et til. Du skal angive oplysningerne igen senere.8Installationsprogrammet kan ikke anvende overf",
        "NKNMR-N",
        "ver eller anv",
        "Pobierz najnowsz",
        "PPP   ",
        "ka bir anahtar girin.?Bitlocker anahtar",
        "Uporabi priporo",
        "&Folytat",
        "hDost",
        "rt DVD rakst",
        "CheckHotPluggableDrive: Drive %c SetupDiGetDeviceInterfaceDetail-1 Error: 0x%X",
        "tkame sealt, kus me pooleli j",
        "SET_PRODUCT_KEY",
        "ciu Windowsu 10 zak",
        "vojiet dator",
        "es-VE",
        "Recapitulando, optou por:",
        " jour, les pilotes et les fonctionnalit",
        "te na po",
        ".\"Zvolte m",
        "cijai rad",
        "ste to znova.",
        "INSTALL_RECOVERY_ENVIRONMENT",
        " bilmiyoruz. Kurulum'u yeniden ba",
        "t work. Please check it and try again or try a different key.3Your product key works! Continue when you",
        "hr-HR",
        "digo de erro: 0x%1!lX! - 0x%2!lX!",
        "tireXV-a",
        "Dette kan tage et par minutter.bDu vil ikke kunne bruge pc'en, mens Windows installeres. Gem og luk dine filer, f",
        "gle fungerer ikke med denne udgave af Windows. Pr",
        "?'?]?n?",
        "anas programma pirms aizv",
        "243n3",
        "Tarkistetaan tietokonetta&Varmistetaan, oletko valmis asentamaan",
        "ticamente durante el per",
        " verificato un errore durante la risoluzione del problema. Aggiorna l'elenco e riprova.",
        "as diska atlas",
        "gon produktnyckel.",
        "ej klucz produktu systemu Windows 10 lub zako",
        "\"Vi finner ikke en USB-flash-enhet.",
        "en-US",
        "Dla bie",
        "ajte ponovno.<Dalje, pomo",
        "n y conservar tu configuraci",
        "n. Libera espacio y despu",
        "T`OMb",
        "InstallNow",
        "%d%% ",
        "installation effectue un nettoyage avant de s",
        "/@c$@0",
        "eme zjistit, jestli je na va",
        "cie spravuje va",
        "leri se",
        "es ajudar",
        "SVWj@",
        "es'Verificando se h",
        "%1!s! %2!s! Kuriant laikmen",
        "rskonto om du vill anv",
        "re installeringen igjen.wHvis du vil ha mer informasjon om hvordan du oppgraderer Windows Server, kan du se: https://aka.ms/windowsserverupgrade",
        "be Windows Update.XKonfiguruje sa aktualiz",
        "The updates are installed, but Windows 10 Setup needs to restart for them to work. After it restarts, we",
        "i mai jos, dac",
        "r csak annyi a teend",
        "veskite ",
        "Se o Windows 10 foi instalado e ativado anteriormente neste computador e estiver reinstalando-o, voc",
        "pet.&Eml",
        "4F5P5",
        "Installationsprogram f",
        "ra Windows 10 p",
        "Jos Windows 10 on asennettu ja aktivoitu aiemmin t",
        "%1!s! %2!s!0Det oppsto et problem under oppretting av medier{Versjonen av Windows som samsvarer med produktn",
        "s iestat",
        "<D<~<",
        "P{(G}",
        "ppp@@@```",
        "s A Windows Server 2019 telep",
        "%d tegn igjen\"Bindestreker legges til automatisk(Produktn",
        "e se dalje javljati problemi, prilikom obra",
        "~~~v|gf",
        "emo s instaliranjem sustava Windows 10 u sklopu zna",
        "jat Windows izdevumu, kas at",
        "rique de stockage externe avec au moins %1!s! libre(s)",
        "#sG{1a",
        "ar-OM",
        "peggwv",
        "mu Windows stahuje aktualizace",
        "ljell",
        "Something happenedATo install Windows 10, click Setup.exe on the installation media.ZWe can",
        "ndan Windows'u otomatik olarak etkinle",
        "tirin ve ard",
        "4*5r5",
        "8.1. Aktivujte si aktu",
        "letim Sistemi",
        " %2!c!:)J",
        "d Product Key mo",
        "RSDS\\",
        "z.<Windows Update i",
        "ifre proizvodaQInstalacija ne mo",
        "SetWindowLongW",
        "&Lukk",
        "c tas ir redzams?",
        " reiniciado v",
        "10 instal",
        "gle ser ud som denne: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX1BitLocker-n",
        "es. Appuyez sur continuer1Choisir un autre p",
        "jams, ka j",
        "&Zatvori4Ra",
        ";.;[;",
        "Removable drives",
        " riuscito a convalidare il codice Product KeyZIl programma di installazione non ",
        "se a Windows Update-ben folytat",
        "pia de seguran",
        " (arba ",
        "w: %d#Kreski zostan",
        "cretleri uygulanabilir. En son y",
        " actualiz",
        "lj avbildning",
        "ersiz komut sat",
        "Ne yapmak istiyorsunuz?",
        "napoi la modul ",
        "asti Windowsu 10 vy",
        "Se instaleaz",
        "Odaberite ",
        "la-001",
        " Internet e tente novamente.2A executar scripts de implementa",
        "Du har valgt f",
        "e pokrenuti Windows 10",
        " Windows Server 2019O",
        "File ISO",
        "ite ovaj korak. Automatski ",
        "Pribavljanje a",
        "z. Listeden ",
        "sitikinkite, kad diegimas parengtas",
        "lpe med at forbedre installationen af Windows",
        "!050B0K0T0^0i0~0",
        "dzie kontynuowana automatycznie.",
        "122E2l2",
        "U kunt aan de slagCWe gaan verder met de installatie van Windows 10 in Windows Update._De update voor Windows 10 wordt geconfigureerd",
        "eeC\"!",
        "CInstallUI::Quit: Did not post MSG_INSTALLUI_FORCE_QUIT",
        "imaluse:",
        " osobn",
        " dori",
        "nt az adathordoz",
        "lkozzon egy m",
        "s sist",
        " jonkin aikaa.",
        "!Kan geen USB-flashstation vinden.",
        "DescargasDQuita los archivos grandes o que no se usen de la carpeta Descargas.",
        " et annet spr",
        "P_XxGyKw=",
        "SetCurrentDirectoryW",
        "Primetili smo da imate starije instalacione datoteke za Windows 10. Mo",
        "utiliser n",
        "es do Windows.QSuas configura",
        "i spa",
        "t kapacitu aspo",
        "e utvrditi da li ra",
        "Entfernen Sie nicht mehr ben",
        "Vent et ",
        "Modifier les ",
        " \"%2!s!\" (",
        "%3!s! Estamos preparando algunas cosas.Esta herramienta no puede actualizar el equipoyEsta herramienta no es compatible con el idioma o la edici",
        "Windowsi privaatsusavaldus",
        "sta. Uvoln",
        "i arhitectura pe care le ave",
        "Nyelv:",
        "om da biste dobili ispravke, upravlja",
        "u draiverus un papildu failus, kas nav pieejami instal",
        "H0YM O",
        "tme abil ja valige seej",
        "n. Pid",
        "o.!A instala",
        "%s nav der",
        "p0`V7=U",
        "c0_04X",
        "Vizita",
        "ro-MD",
        " funkce. Tyto aktualizace p",
        "jrakezd",
        "Izdanje operativnog sistema Windows podudarno sa unetom ",
        " nytt.#Sjekker at PCen har nok ledig plass&Vil du fortsette ",
        ".?AV?$CZeroInit@VCMoReserveManager@@$00@@",
        "vajte extern",
        "e, nous activerons Windows automatiquement./Programme d",
        "e jih ",
        "ploiement preinstall.cmd en cours d",
        "qMorda bo trajalo nekaj trenutkov, da preverimo, ali je to, kar ",
        "cessaire sur (%2!s!)",
        "ana*Notiek j",
        "imalik, et peate uuesti installima m",
        "to sprje",
        "si adathordoz",
        "Le programme d",
        "nb-NO",
        "nico. Quando se ligar ",
        "nik instalacyjny (dysk flash USB, dysk DVD lub plik ISO) dla innego komputera",
        "ste to znova alebo sk",
        "borov sa vyskytol probl",
        "nete, ulo",
        "rsta g",
        "ifru.POva ",
        "ra om Windows Server 2019 ",
        " Microsoft software license terms",
        "cter restante",
        "ta klaida. Patikrinkite, ar diegimo ",
        "vate.tS",
        "voortgang",
        " tak i de siste filene, slik at du er sikret ",
        "elite Windows 10 namestiti na drugo particijo, morate ustvariti namestitveni medij in ga zagnati.'",
        " tietojesi suojaamiseksi tietokonetta mukanasi, kunnes kirjaudut j",
        "i Windows 8.1 aktiveeritud eksemplar. Aktiveerige oma praegune Windowsi versioon tootev",
        "vrstog diska tokom instaliranja ispravki. Windows ne",
        "rile sunt instalate, dar instalarea Windows Server 2019 trebuie s",
        "rizni ezeket a f",
        "yciu konta administratora.+Musisz p",
        "ca wersja systemu Windows mo",
        "ifru ili kupite novu.",
        " pevn",
        "Productcode",
        " S mode.t",
        "Nedenini ",
        "hnout",
        " bitlocker n",
        " %d. ",
        "Limba nu se potrive",
        "Unitatea flash USB este gata",
        "odo de suporte; o suporte pode variar por dispositivo.",
        "sti nuo ten, kur sustojau",
        "r det er startet p",
        "lgilenmeniz gerekenler",
        " ativado neste PC",
        "du Product Key a",
        "0?T$@0",
        "Operativsystemet Microsoft",
        " sa a",
        "202E2",
        "imu online a z",
        " precommit.cmd+",
        "d Product Key pre Windows 10.",
        " el az ",
        " du v",
        "tenje",
        "co br",
        "jjk\"|||",
        " ietverti tikai 48 digit",
        "ny percig.rEzzel a term",
        "es-CL",
        "CSetupResponsePageDiskSpaceReq::OnOpenRecycleBinClicked",
        "7t7{7",
        "bory, aplik",
        "TTZfbO30$",
        "/^Wu#",
        "x_j'Y",
        "; certaines fonctionnalit",
        "moire flash USB est pr",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::UpdateState",
        "rjon be minden fut",
        "2L2g2",
        "CoTaskMemAlloc",
        " Bitlocker ",
        "De taal of editie van de versie van Windows die momenteel is ge",
        "ie disc",
        "se. A Windows Server 2019 telep",
        "10 requi",
        " klucz produktu lub licencj",
        ". To znamen",
        " de BitLocker n",
        ": 1\"K",
        "Chiave BitLocker",
        "Ins&talar",
        "Ava(Soovin kasutada hoopis v",
        ", aplikac",
        "BitLocker-suojaus keskeytet",
        "Se ob",
        "it!Se instaleaz",
        "qtYzt",
        " el equipo para ejecutarse en modo S. Elige esta edici",
        "Deschidere6Doresc s",
        "t cea pe care o utiliza",
        "dzu, palaidiet %1!s! manu",
        "unalnik pripravljen za nadaljevanje name",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::UpdateState",
        ".?AVCSpinningProgress@UX@Common@ConX@@",
        "nce temizleniyor!Bu i",
        "4 4$4(4,4044484<4@4D4H4L4P4T4X4h4p4t4x4|4",
        "0@P$A0",
        "e da prelazi 4GB+ (",
        ".?AV?$CZeroInit@VCSetupCompatDlpResponseFactory@@$00@@",
        "%1!s! %2!s!)Do",
        "=4>\\>",
        "ar-EG",
        "lassza ki, mit szeretne megtartani",
        " a tentar utilizar n",
        "fr-SN",
        "klemenin sorunsuz ",
        " Windowsin asetuksesi, henkil",
        "ku, jums ir j",
        "/?$$@/",
        "informations",
        "toru sa nepodarilo inicializova",
        "rjestelm",
        "sait, mert a %1!s! telep",
        "Impossible de conserver vos param",
        "bn papirkurven manuelt.MLagerforbruget kunne ikke ",
        "line ja suoritettava asennus sit",
        "CSetupResponsePageCompat::InitializeDownloadResponsePageRoutine",
        "tte, og dine Windows-indstillinger, personlige filer og apps kan bevares.KF",
        " naudojate.",
        "luseade on valmis",
        "unalo. Zatvorite sve pokrenute programe pa ponovno pokrenite ra",
        " nytt.1Her er et sammendrag av hva du har valgt ",
        " pe PC. Activa",
        "SNo se pudo abrir la carpeta de descargas. Abre la carpeta de descargas manualmente.[No se pudo abrir la grabadora de DVD. Graba el archivo ISO manualmente en un DVD con %1!s!.",
        " prep",
        "veis para continuar.",
        "zi %1!s!. P",
        "i v PC m",
        "Esta transfer",
        "m haklar",
        " laste ned og kj",
        "%s ni veljaven znak",
        "Er wordt eerst netjes opgeruimd voordat Setup wordt gesloten",
        "iti ima li na PC-ju dovoljno prostora za nastavak instalacije sustava Windows Server 2019. Poku",
        ", do ktorej chcete nain",
        "tfen ",
        "s a atualiza",
        "n avaaminen ep",
        ".2Windows 10 ",
        "sto n",
        "o, ativar o Windows e, em seguida, iniciar a configura",
        " na %1!d! %%\\Tento k",
        ".?AVCCriticalSection@@",
        "ni muu v",
        "+>@@@>",
        "Ona izgleda otprilike ovako: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "&Manter aplicativos e arquivos pessoais;Mantenha as configura",
        "ams br",
        "jo iki pradedant diegti ",
        "rojamie pazi",
        "Arhitektura se ne ujema",
        "1(141@1L1X1d1p1|1",
        ".BToliau diegsime ",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::CheckUninitialized",
        " za sme",
        "0F0k0-",
        ".\\%s.mui",
        "Forts",
        "uje nadaljevanje name",
        "k a BitLocker-v",
        "n &JB",
        "em.;Bitlocker klju",
        "ncia n",
        " informacji instalacyjnych potrzebnych do kontynuowania instalacji systemu Windows. Uruchom ponownie Instalatora, aby spr",
        "+|'T*",
        "9C:U:s:",
        "z gerekir.",
        " seu dispositivo de armazenamento externo e voc",
        "g0n0 ",
        "ifrelenmi",
        "m|z{LV",
        " saglab",
        "iniet citu.",
        "ani, kaj se je zgodilo, a tega orodja v va",
        "D$@WP3",
        "in bilgisayar",
        " leidim",
        "Hr,g ",
        "i aten",
        ".Installin Windows 10 sellesse arvutisse uuesti%Mul on vaja osta Windows 10 tootev",
        "i cheia BitLocker",
        " miksi.",
        "CSetupResponsePageGated",
        "7$747D7T7d7t7",
        ", kad ",
        "sa2Tov",
        "marrage du programme d",
        ";!;.;;;H;U;s;",
        "w.CWarto",
        "s futtatnia kell a leg",
        "jiet: https://aka.ms/windowsserverupgrade",
        "gbar ist.*M",
        "unar. Zatvorite instalaciju i poku",
        "tica de privacidade do Windows",
        "t tiedostot Lataukset-kansiosta.",
        "ia scripturilor precommit.cmd.",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::CheckUninitialized",
        "inde ne yapt",
        "Vyberte odd",
        "Folyamat: %1!d!%%7A folytat",
        " possibile determinare se lo spazio nel PC ",
        "<Priprema se preuzimanje najnovije verzije sustava Windows 10 To mo",
        "a objemu ",
        "0(un0",
        "es: %1!d!%%",
        "Obtener actualizaciones Estamos preparando algunas cosas",
        "Nincs c",
        "Windows 10",
        "rel valige V",
        "Installera Windows Server 2019",
        "Oficio",
        "anu. P",
        "idakse Interneti-",
        "kaz setup.exe /? v ko",
        "Ce&rrar",
        "su dator",
        "lreiz.)Windows Server 2019 instal",
        ":.:L:j:",
        "tme valideerimineNInstalliprogramm ei saa kindlaks teha, millist Windowsi versiooni te kasutate.",
        "6?6F6h6",
        ";0uF9E",
        "%2!s!/",
        "i ostke uus.",
        "vat extern",
        " precommit.cmd se objevil probl",
        "e povzamemo, ste izbrali to:",
        "CheckHotPluggableDrive: Drive %c Unable to query device number for %s Error: 0x%X",
        " k Windows pomoc",
        "e lorsque vous ouvrirez une session dans Windows",
        " se aktualizace",
        "Microsoft Corporation1.0,",
        "DwwW[&",
        "^{->}",
        "<'<5<M<`<",
        "Pridobivanje posodobitev",
        "o novamente./N",
        " bir DVD",
        " Windows 10, ",
        " eilut",
        "OF04X",
        "ti ier",
        "&Manter ficheiros pessoais e aplica",
        "Hay disponible una versi",
        ":D:_:",
        "&Doorgaan",
        "n contin",
        "application des donn",
        " system Windows 10 na innej partycji, musisz utworzy",
        "Isso pode levar alguns minutos.",
        "Prejdite na: %1!s!",
        "kleme medyas",
        "cie a nastavenia sa nedaj",
        "GetSystemInfo",
        "s veic t",
        "ra utrymme och f",
        "v derefter igen.7Det er opst",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::GetResponseName",
        "ed zah",
        "unalo",
        "El programa de instalaci",
        " ancora pronto per questo PC$Verifica dell'installazione in corso",
        "che la poursuite de l",
        "Az ISO-f",
        "%hs: Dialog initializing - InstallReq.",
        "o consegue reiniciar o computador. Feche todos os programas abertos e reinicie o computador. A instala",
        "Dators tiks vair",
        "mu Windows. Re",
        " encriptada com o BitLocker. Selecione uma unidade diferente e tente novamente.",
        "6D6Y6",
        " jour, ainsi que des fichiers suppl",
        ", nie je dostatok miesta. Vyberte in",
        "Stiahnut",
        "mu Windows sa vyskytla neo",
        "}W0f0O0`0U0D0",
        "Bruk en ekstern enhet, for eksempel USB-n",
        "Tai gali ",
        "kilo problema vykdant precommit.cmd scenarijus.",
        "n tietokoneeseen$Varmistetaan, ett",
        "Saveti za re",
        "ili.,Windows 10 sa v tomto po",
        "i instalovali a aktivovali u",
        "vesti ",
        "Namestitev sistema Windows 104Pridobite posodobitve, gonilnike in izbirne funkcije",
        "ssel wird ",
        "r det er genstartet, forts",
        "Liko simboli",
        "Devo riavviare il PC pi",
        "r din dator ",
        "Kui kavatsete ",
        "BitLocker korumas",
        " trouver un lecteur flash USB. Actualiser la liste des lecteurs(Sa taille doit ",
        "a nije uspjelo. Ru",
        "%d Zeichen ",
        "se sikertelen",
        "Co&ncluir",
        "re dette verkt",
        "&Finish",
        "t disku sarakstu%T",
        " Windows Server 2019",
        "z.\"Windows Server 2019",
        "Quase pronto",
        "zda bulundurun:",
        "o limpou os ficheiros de configura",
        "1 character left",
        "Pt+h,",
        "niku instalacyjnym.",
        "e ispravno funkcionirati nakon instalacije i mo",
        "diegti kai kurias pasirinktines funkcijas ir kalbas.",
        " proizvoda za Windows 10 ili iza",
        "ajte ponovno.5Instaliranje sustava Windows Server 2019 nije uspjelo(Instaliranje sustava Windows Server 2019",
        "s atsl",
        "anas m",
        " disk po",
        "9Felk",
        "Preparing setup ",
        ".?AVCEdit@@",
        "Ako Windows 10 na PC namjeravate instalirati prvi put (ili instalirati drugo izdanje), trebat ",
        "Ange produktnyckel",
        "es agora, o seu PC poder",
        "les1Palikti ",
        ".?AVCDialogEx@UX@Common@ConX@@",
        " w innej lokalizacji.",
        "sa el",
        "yorum(Windows 10 ",
        "e uruchomi",
        "{|||{{qokg_[S",
        "USB flash disk",
        "mplat, dar nu am reu",
        "ploiement failure.cmd.Cette op",
        "sta, aby se dalo pokra",
        "taluje sa Windows Server 2019",
        "^(uck(W",
        "amd64",
        "[Kod b",
        "k ki Windows 10'un bilgisayar",
        "istit soubory instala",
        "o do Windows Server 2019-Reiniciando Instala",
        "ti. Ko vzpostavite povezavo z internetom, bomo aktivirali Windows.",
        " v nepodporovanom adres",
        "w wdra",
        " valido. Immetti la chiave corretta2Immetti la chiave BitLocker per l'identificatore: (Spazio necessario per aggiornare Windows",
        "?1?V?{?",
        "%d merkki",
        "Quedan %d caracteres(Los guiones se agregar",
        "tte installationen af Windows 10. Pr",
        "CInstallUI::Quit",
        "20201008074426.155Z0",
        "Nismo prepri",
        " jour : %1!d!%%.Cette op",
        "ite selle etapi vajele j",
        " program a zkuste to znovu.:Syst",
        "[\\\\\\[\\[[[MJ@VM@MJ@O",
        " Microsoft Corporation. T",
        "enia. ",
        "hnout v",
        "o do Windows transfere as atualiza",
        "nd en extern enhet, t.ex. en USB-nyckel, ett SD-kort eller en extern h",
        "nda filer fr",
        "&Slutf",
        "Apsilankykite: %1!s!",
        "&Dalje",
        ", a znova spustite in",
        " varias veces. Esto puede tardar un poco.",
        "000ppp   ",
        "Geri D",
        "l|vWw",
        "o. Clique em Atualizar para a remover da lista.hFoi detetado um problema enquanto tent",
        "n listan._Vi st",
        "DynamicUpdate",
        "Failed to determine source edition type!  Error: [0x%X]",
        " nu func",
        "WdsSetupLogMessageW",
        "ves. Adja meg ",
        "m papirkurven for at fjerne slettede filer fra systemdrevet.",
        "fr-RE",
        "unuz s",
        "e internetu za dobivanje a",
        "K6746",
        "rz teraz ich kopi",
        "gerbereinigung frei, und versuchen Sie es erneut.*Problem beim Herunterladen einiger Dateien",
        "Prawie gotowe",
        " (%2!s!)~",
        "ft*Die Installationsbereitschaft wird gepr",
        "1/0-0",
        " diegim",
        "st jazykov",
        " unos minutos.",
        "om po",
        "j{J70",
        "hren.2Aktualisiertes Medienerstellungstool herunterladen",
        "lo do nepri",
        "Termes du contrat de licence",
        "t4y=\\G",
        "ni funktsioon on eemaldatud. Operatsioonis",
        "hjendage pr",
        "Det tager et par minutter.",
        "_onexit",
        " zariadenie, napr",
        "ete morati da ponovo instalirate neke opcionalne funkcije i jezike.",
        "vMRn0",
        "tfen Depolama'n",
        "genes de la instalaci",
        "iska. Otvorte ",
        "See n",
        ". Patikrinkite interneto ry",
        "0'0H0q0",
        "Making sure you",
        "zben t",
        "progression",
        "BitLocker-beskyttelse deaktiveres under denne oppdateringen og aktiveres p",
        ", DVD ",
        "steemi Windows Server 2019 sisse logite. Andmete kaitsmiseks hoidke arvuti enda l",
        "Last ned den nyeste versjonen av Windows",
        "lreiz.2P",
        "in Disk Temizleme",
        "ti naudojama ",
        "e jste se rozhodli nainstalovat %1!s! v jin",
        "tab Windows 10",
        "}M0OUL",
        "sents sur le support d'installation.",
        "installation de Windows. V",
        " izpildiet komandu setup.exe /?.",
        "7Licen",
        "- Windows Server 2019. ",
        "M0K0I",
        "De ce v",
        "kkel, SD-kort eller ekstern harddisk, til ",
        "to po",
        "n recomendado para este equipo",
        " var darboties Windows 10. L",
        "2e8hj",
        "o e volte a tentar.",
        "o do Windows Server 2019. Experimente reiniciar a Configura",
        "<!<?<",
        "r: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX+BitLocker-nyckeln ska inneh",
        "Kontroluje sa v",
        "ifra proizvoda bi trebalo da se nalazi na kutiji u kojoj ste dobili DVD ili u primljenoj e-poruci. Kada se pove",
        "Maalesef bilgisayar",
        " starte p",
        "n en Windows con una cuenta de administrador.5Necesitar",
        "sti ma",
        " nebo si kupte nov",
        "klemesini tamamlamak i",
        " koru",
        "ltend",
        ".edata",
        "st aktualizace, ovlada",
        "jumus tagad, iesp",
        " tapahtui, mutta t",
        " aktualiz",
        "Les actions suivantes n",
        "vate.",
        "n de Windows 10 en Windows Update.VConfigurando la actualizaci",
        "GNepoda",
        "rende version af Windows, skal du k",
        ".00cfg",
        "s ejecutando.%Error en la instalaci",
        ". Essayez une autre cl",
        "dium s Windows a potom pokra",
        "he-IL",
        "o do Windows de onde voc",
        "jeblik",
        "ipojte extern",
        "lyozza a telep",
        "Valmistellaan: %d%%",
        "7(7E7i7",
        "ar-QA",
        "v at genstarte Installation.pVi har desv",
        " kompiuteryje gali veikti ",
        "vorna matchar inte",
        "ta ste odabrali da uradite:",
        " fullf",
        "pna jest nowsza wersja tego narz",
        "nek konfigur",
        "s pabeigta, un ko dar",
        "5\"5;5R5}5",
        "Change what to keep",
        "rz nagrywark",
        "li jistotu, ",
        " nekoliko stvari. Javit ",
        "Exception",
        "COMDLG32.dll",
        "<4=Q=X=f=p=",
        "hsb-DE",
        "Leia isto com aten",
        "Nem egyezik a nyelv",
        "8(80888@8P8t8|8",
        "CestinoGSvuota il cestino per rimuovere i file eliminati dall'unit",
        "maksuja. Lataa uusimmat asennustiedostot valitsemalla Seuraava.",
        "ati Windows 10.",
        "bergehend zu erweitern, w",
        "re i S-tilstand. V",
        " nem tudta bet",
        "n valinnan k",
        "tta installera Windows 10. Starta om installationsprogrammet och f",
        "esz w dalszym ci",
        " platn",
        "arn-CL",
        "e trajati nekoliko minuta.mNismo uspjeli preuzeti sve potrebne datoteke. Provjerite jeste li povezani s internetom pa poku",
        "Sizde Windows 10",
        "iem Windows",
        "esini ",
        "Abrir Reciclagem",
        "SelectedDrive",
        "in %1!d! GB sau mai mult. Selecta",
        "l elind",
        "ul de reciclare",
        ".CRT$XIZ",
        "l, az al",
        "n, onko Windows Server 2019 viel",
        "eno %d%%",
        "Sluk ikke computeren",
        "Vyberte oblas",
        "nnen nicht auf Ihrem PC installiert werden, weil nicht gen",
        " La dimensione minima ",
        " Windows Server 2019.CWindows Server 2019 ",
        "anju nekaterih datotek je pri",
        "Kaufen",
        "Recommencer depuis le d",
        "jlokat vagy szabad",
        "See v",
        "zca 48 dijital karakter bulunur.",
        "RENSEIGNEMENTS SUR L'INSTALLATION : Certaines fonctionnalit",
        "e a volite",
        "e biti potrebno nekoliko trenutaka da se proveri da li je ono ",
        "henduse tasu. Uusimate installifailide hankimiseks kl",
        "xBSShG",
        " precommit.cmd.(Spou",
        "Einen Moment Geduld bitte",
        "7 nebo Windows",
        "ver minst vara %1!d! GB.",
        "met: https://aka.ms/windowsserverupgrade",
        "klemezseniz, y",
        " edice.",
        " donan",
        "altiniai pasiekiami, ir paleiskite diegim",
        "ivityksen j",
        "xWXXXXTXTt",
        "A kulcs form",
        "Arquitetura",
        "hrt Dies kann einige Minuten dauern.",
        "PapperskorgHT",
        "&Refuser[Vous quitterez la configuration si vous refusez les conditions d",
        "bW0~0Y0",
        "etky spusten",
        " instalujete Windows 10 poprv",
        "Verifica del PC in corso",
        "0?$$?/",
        "ate izdajo sistema Windows, ki se razlikuje od tiste, ki jo trenutno uporabljate.",
        "ti atjaunin",
        "wiadczona w r",
        "cD4n v",
        " girin: 8Windows'un g",
        "Muuta sit",
        "nyek teljes",
        "uguje j",
        "rt$Dators p",
        "T* *?^v@ ",
        "e,Tento kl",
        "urirani alat za stvaranje medija",
        "GQm*p2",
        "Kui soovite teada, miks, lugege allpool olevat teavet.",
        ".]Det drev, du fors",
        " instalacji systemu Windows. Uruchom ponownie Instalatora, aby spr",
        "(caller: %p) ",
        " en annen partisjon, m",
        "je0A Windows Server 2019 telep",
        "cPUC<",
        "Go. Si vous utilisez une connexion limit",
        "ifrom proizvoda nije dostupno na trenutnom jeziku i izabranoj arhitekturi.",
        "ni minut.dTe ei saa arvutit Windowsi installimise ajal kasutada. Salvestage ja sulgege failid enne alustamist.:Palun oodake, kuni rakenduse desinstallimine j",
        "nost Nastavitve prostora za shranjevanje",
        "Rydder opp f",
        "e actuellement sur votre PC n",
        "GetUserDefaultUILanguage",
        "rt keresse fel a k",
        "Verificando se voc",
        "%d%% k",
        "Enter Bitlocker key",
        "nosti in",
        "TZggvc+'",
        ": 2Windows ",
        "; la prise en charge peut varier en fonction des appareils.",
        "ta autom",
        "A let",
        "me est survenu lors de la cr",
        "n0zzM0",
        "unalnik, ker je na disku premalo prostora. Upo",
        "tu spr",
        "p{{+u",
        "lni a g",
        "!R'uD",
        "5-6?6N6",
        "4R5_5f5l5q5y5",
        "Lingua",
        "d Product Key.JInstala",
        ".?AVCStaticEx@UX@Common@ConX@@",
        "hem instalace nevybije baterie.",
        "?terminate@@YAXXZ",
        "5 5(545T5`5",
        " tentando usar est",
        "i %s;Windows reporne",
        "ma.6Precommit.cmd skriptu palai",
        "o aceita argumentos de linha de comando. Para saber mais, veja a Ajuda da Instala",
        "^omxK",
        " %2!s! bez maksas",
        " etkinle",
        "ati, zdru",
        "ISO s",
        "0@v$A0",
        "lttt.",
        "itajte ovo kako biste znali sa ",
        "urira tokom perioda va",
        "installation de Windows t",
        "gle virker ikke. Kontroll",
        "MKompiuteris bus paleistas i",
        "ledF\\v|v",
        " Microsoft Corporation. Alle rettigheder forbeholdes.",
        "CInstallUI::PostShutdownMessage",
        " Windows Server 2019z",
        "gas p",
        "cii potrebn",
        " niveau ",
        "unalnikaoTo orodje ne podpira jezika ali izdaje razli",
        "laties turpin",
        "toru sa nepodarilo na",
        "iustusi. V",
        "rss}||",
        " na %d %%",
        "999D9f9q9",
        "ifrovania BitLocker nefungoval. Skontrolujte ho a sk",
        " DVD disk",
        "ga rakstz",
        " USBV",
        "ServerComputeCluster",
        " Windows",
        "Wybierz j",
        "Posodobitev sistema Windows 10wUporabe prostora za shranjevanje ni bilo mogo",
        "ica tega orodja. ",
        "me est survenu lors de l'ex",
        "Ongeldige dialoogvenster-id)De licentieovereenkomst is niet gevonden.",
        "ili in vam povedali, kako naprej. To okno se bo samodejno zaprlo ",
        "ties. Noklik",
        "CSetupUIManager::Initialize",
        "ncia em segundo plano pode ter mais de 4 GB (pode variar) e podem aplicar-se taxas de acesso ",
        "t, majd futtatnia kell.2Tov",
        "Plik ISO",
        "lreiz. Darbinot ",
        "Otvori6Umjesto toga ",
        "r smidigare, och de kan inneh",
        "Beskyttelse af oplysninger",
        "nder nu.",
        " USB.",
        "v|tN>",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::Restart",
        " odstranili. Kliknut",
        "o falhou na fase %1!s! com um erro durante a opera",
        "o. Reveja as informa",
        "ivanjem mo",
        "r %1!s! manuelt for at ",
        "8&9C9K9",
        "Stiahnite si najnov",
        "in prenosa posodobitev v programu Windows Setup",
        "n en la que quieres instalar Windows.",
        "tiute ",
        " %2!c!:.qAko Windows 10 ",
        "t work. Please check it and try again, or try a different key.3Your product key works! Continue when you",
        "pertoire racine de votre support d",
        " unitate.#Desc",
        "cia syst",
        "Logige sisse administraatorinaZSelle t",
        "e da se nastavi jer Windows ne mo",
        "ate nain",
        "ti ma",
        "o a instala",
        "t sist",
        ". Po pripojen",
        "dition) sur votre PC, vous avez besoin d",
        "ConX::Setup::Common::CSetupLangIniLoader::GetLanguageMediaNumber",
        " informace o upgradu Windows Serveru najdete na webu https://aka.ms/windowsserverupgrade.",
        "bn-BD",
        " volte. L'operazione richiede alcuni minuti.0Chiusura del programma di installazione in corso/L'operazione potrebbe richiedere alcuni minuti.cDurante l'installazione di Windows non potrai usare il PC. Prima di iniziare salva e chiudi i file.0Attendi la fine della disinstallazione dell'app.",
        "Windows 10 esmakordsel installimisel arvutisse (v",
        "hese kettaruumi t",
        "Ninguno",
        "9<:g;",
        "t data chr",
        ": :(:0:8:D:d:p:",
        "rt`Denne produktn",
        "Installimise ettevalmistamine ",
        "b~0_0o0",
        "- Windows 10",
        "o livre em disco na (%2!s!)rElimine os ficheiros de que j",
        "7 7$7(7@7D7L7d7t7x7",
        "%d%% abgeschlossen",
        "S&chlie",
        " jenom 25 znak",
        "4;4u4",
        "ssen Sie einen Windows 10-Product Key eingeben.",
        "des. L",
        "lineen luomisessa oli ongelmarAntamaasi tuoteavainta vastaavaa Windowsin versiota ei ole saatavilla nykyiselle kielellesi ja arkkitehtuurillesi.",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::CheckInitialized",
        "in, y",
        "e se nekoliko puta ponovno pokretati. To bi moglo potrajati..Pri",
        " nepotrebujete, alebo pou",
        "ii de Windows 10 va configura PC-ul s",
        "000```",
        "8\"8O8",
        "6.6h6",
        "|ldvG",
        "ltek! Kattintson a Folytat",
        "dzu, atsvaidziniet sarakstu un m",
        "se-FI",
        "s l'installation et vous devrez peut-",
        "D$8PVS",
        "terst",
        "ntalo nuevamente.",
        "Noget forhindrer installationen i at forts",
        "butiez l",
        "USB-flash-enheten er klar",
        "li.`Neizdev",
        "moh-CA",
        "ku Media Creation Tool Pierakstieties k",
        ".?AV?$CZeroInit@VCSetupResponsePageGated@@$00@@",
        " tento n",
        "i manual Co",
        "cution des scripts preinstall.cmd.FUn probl",
        "tirme s",
        "i apoi ",
        "%c:RA sz",
        "##'####&##",
        "Vi kan inte avg",
        "rskendused on installitud, kuid Windows Server 2019 installiprogramm tuleb taask",
        "s par to jau par",
        "Overf",
        "te nasleduj",
        " Kullan",
        "Uusima versiooni allalaadiminehSelle t",
        "eKNMR",
        "ttes, eller du pr",
        "Inovova",
        " informado quando estiverem conclu",
        "t tikai personiskos failus",
        "aj, poput USB klju",
        "kolik minut trvat.tNepoda",
        "Windows 10:t",
        "]wQBf|v",
        "o funciona. Tente usar outra chave.",
        "La causa non ",
        "s futtassa ",
        "GB br",
        "Aseman valinta",
        ",Ir'Kn",
        "Ser etter oppdateringer Ser etter oppdateringer: %1!d!%%",
        "ImmAssociateContext",
        "&Anulare",
        "r installationen ",
        "lieties datu nes",
        "rios mais alguns passos antes de poder efetuar a atualiza",
        "Ga naar: %1!s!",
        "&)-.CFDA86ANXYYUUUNna",
        "Lisateavet",
        "Neplatn",
        "ljande externa enhet och klicka p",
        "ge a friss",
        "e de Windows 7 ou Windows 8.1 install",
        "a izdelkaUNamestitveni program ne more ugotoviti, katero razli",
        "A|M`.",
        "Pronto per l'installazione",
        "jumus, personiskos failus un programmas, ir j",
        "pak vyberte Aktualizovat.",
        "o sa m",
        "Ma on nast",
        "tres, fichiers et applications, car votre version actuelle de Windows est install",
        "%d karakter kald",
        "s aptuveni ",
        "zina, pirms s",
        " nemus",
        "External Storage Device",
        "n y prueba otra vez.",
        "ajte ponovno pokrenuti postavljanje.",
        "ProductVersion",
        "ima.PKapacitet USB fle",
        "gi labojumi, atjaunin",
        "Langue ne correspond pas",
        " iepriek",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2",
        " de Windows 10 sur votre PC en raison d'un espace disque insuffisant. Lib",
        "talova",
        "n porque Windows no puede reiniciar el equipo. Cierra los programas que se est",
        "7F7_7e7q7",
        "e soubory, aplikace a nastaven",
        "PCen startes straks p",
        "9K t~3",
        "avanja skripti precommit.cmd.",
        "r%Neplatn",
        " ten krok. Automatycznie aktywujemy system Windows po zako",
        "ekajte izlazak iz instalacije#Ovo mo",
        "o do Windows Server 2019 falhou",
        "Abrir Quero usar armazenamento externo$N",
        "ciu spusti",
        " jonkin aikaa.|Windows-asennuksessa tapahtui odottamaton virhe. Tarkista, ett",
        "elite li zaista da odustanete?",
        "s recientes de Windows 10 en tu PC debido a que el espacio en disco es insuficiente. Sigue las instrucciones que aparecen a continuaci",
        "iama s",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::CheckUninitialized",
        "ndan ",
        "Drive Letter = %c: is Read Only",
        "*Licentiebepalingen voor Microsoft-software",
        "go{{|||~H",
        "rulan",
        "mn-MN",
        "hemmin.AAsetukset ja sovellukset poistetaan, mutta tiedostot s",
        "IMAGE",
        "te, ale pliki zostan",
        "@@@ppp",
        "USB-m",
        "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4",
        " ta en titt p",
        "s escribir una clave de producto v",
        " fereastr",
        "ltenie ",
        "idlo Pokra",
        "tor: /Syst",
        "niej zainstalowany oraz aktywowany na tym komputerze i chcesz go ponownie zainstalowa",
        "ssal?",
        "t$4hx",
        ":6:Q:l:",
        "ku podr",
        " tai versiota.",
        "cWindows 10 m",
        "Downloading Windows 10",
        "vaketast), et ajutiselt laiendada k",
        "n (%2!c!: s",
        "it. Po dokon",
        "enia.",
        "t nastaven",
        "bne Diskoprydning.",
        "Er worden geen opdrachtregelargumenten geaccepteerd. Zie Setup Help voor meer informatie of voer setup.exe /? uit in de hoofdmap van het installatiemedium.",
        "ovat v instalaci Windows 10. Zkuste spustit instala",
        "OX[W0f0",
        "lg et USB-flashdrev{Filerne p",
        "+Tarkistetaan p",
        "o nos suportes de dados instala",
        " Levyn uudelleenj",
        "r media skulle skapas}Windows-utg",
        "ajte jo",
        " **$**$*$)0",
        "; ;8;<;T;X;p;t;x;|;",
        ", tada pasirinkite Atnaujinti.",
        "pta&l",
        " od komputera do czasu ponownego zalogowania.!Oto podsumowanie wybranych opcji:",
        "i Windows 10 pe PC pentru prima dat",
        " plik",
        "ll continue installing Windows Server 2019 in Windows Update.",
        "585T5X5\\5`5d5h5l5p5t5x5|5",
        "es porque a sua vers",
        "mas-Cheia de produs con",
        "se-SE",
        "dKullanmaya ",
        "dfveapi.dll",
        " Windows.j",
        "Kasutage selle arvuti jaoks soovitatavaid suvandeid",
        "tsladd f",
        "SelectedSqmOptIn",
        "n actual de Windows est",
        "\"Nenoriu naudoti i",
        "nt a preinstall.cmd parancsprogramok futtat",
        "ltere Installationsdateien f",
        "Snimanje ISO datoteke na DVD",
        "Die Installationsinfos, die zum Fortsetzen der abgebrochenen Windows-Installation ben",
        "puleviimiseks nuppu OK.",
        "Windows needs space to update",
        "unaru. To zna",
        "Brak dost",
        "The free update to Windows 10 is only available if you have an activated copy of Windows 7 or Windows 8.1 installed on your PC. Activate your current version of Windows using a product key and then select Refresh.",
        ".?AVISetupObject@@",
        " stato possibile scaricare tutti i file necessari. Controlla per assicurarti di essere connesso a Internet e riprova a eseguire lo strumento.DSi ",
        "Dit kan een paar minuten duren.|Steek de stekker van uw pc in het stopcontact om er zeker van te zijn dat de batterij niet leegraakt tijdens de installatie.",
        "klemenin tamamlanmas",
        "t vagy futtassa a ",
        "ra szeretn",
        " Windows Server 2019 este gata pentru acest PC. ",
        "ie), ave",
        "cio, retomaremos a partir do ponto onde t",
        "cutez le programme d'installation.tPour plus d",
        " voi kest",
        ".?AV?$CDlpResponseImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VICompatActionResponse@@@@@@@@@@",
        " naujo ir bandykite dar kart",
        "%sGB?PC",
        "ppna Lagring i Inst",
        "Esto puede tardar varios minutos.",
        "Selecteer een USB-flashstation",
        "Obter",
        "%1!ld!%% terminat",
        "m svoje s",
        "ste to znova.3Windows 10 e",
        "Korpa za otpatke\\Ispraznite korpu za otpatke da biste uklonili izbrisane datoteke sa sistemske disk jedinice.",
        "tres de stockage",
        "ti sobib. J",
        "iant ",
        "hendus Internetiga, ja proovige uuesti.*Preinstall.cmd juurutusskriptide k",
        "ujejo pomembne popravke, posodobljene gonilnike naprav in dodatne datoteke, ki niso del namestitvenega medija. ",
        "iama %d%%",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::GetResultsRoutine",
        "g0S0n0",
        " Windows 7 ",
        "cej wersji j",
        "es-PA",
        "iame kompiuteryje ",
        "APoteka priprava na prenos najnovej",
        "na zapisa",
        "cych u",
        "Windows Setup gaat online om updates, stuurprogramma's en optionele functies te ontvangen. Deze updates zullen helpen de installatie vlot te laten verlopen en kunnen belangrijke fixes, bijgewerkte apparaatstuurprogramma's en extra bestanden omvatten die niet beschikbaar zijn op het installatiemedium.",
        " failure.cmd#",
        " po vytvoren",
        "Hilfe",
        " esat izv",
        "tes pr",
        " facoltative",
        "dos, mas os arquivos ser",
        "ebujeme v",
        "jlt k",
        "%c: (%s)",
        "Windows-installationsfilerne blev ikke fundet. Inds",
        "tu, kam piekr",
        "hendage arvuti vooluv",
        "re ready to install",
        "i kasutage m",
        "xuSShG",
        "cijas failus. M",
        "re Windows Server 2019tDysk, kt",
        "Instala",
        "vMRHr,g",
        "te Pokra",
        " alman",
        "-:5/=",
        "iniet uz T",
        "4D5i5",
        "[%hs(%hs)]",
        " innego klucza.",
        "Kontrola po",
        "Promijenite na",
        "re oppmerksom p",
        "ch za",
        ": :0:4:8:P:`:d:t:",
        "i ales:",
        "Reprendre depuis le d",
        "ngelig. Du skal downloade og k",
        "Pobierz",
        "in na koji program za instalaciju sustava Windows preuzima a",
        " %2!s!",
        "%1!s! %2!s!$Hubo un problema al crear los medios",
        "9s t\\",
        "vat na n",
        "- DVD ",
        " program, aktivovat Windows a spustit instala",
        "R_U(u ",
        "miyor",
        "%s er ikke et gyldigt tegn",
        "installation.0V",
        "M0~0W0_0",
        " Windows autom",
        "m prov",
        "Hvis Windows 10 tidligere har v",
        " nieko",
        "ErrorCode",
        "o de armazenamento. Abra manualmente o armazenamento nas defini",
        "n a agilizar la instalaci",
        "cccsKK",
        "o do Windows 10^Falha ao abrir a utiliza",
        "? ?`?",
        "w wiersza polecenia. Aby uzyska",
        " aten",
        "517I7_7",
        ".?AV?$CZeroInit@VCSetupActivationDlpResponseFactory@@$00@@",
        "Este download em segundo plano pode ter mais de 4 GB (pode variar) e taxas de acesso ",
        "<$<3<^<",
        "%d %% valmis",
        "8.1 kopija. Aktiviz",
        "tirmeleri ",
        ".?AVIDlpError@@",
        "t install the latest Windows 10 features and security improvements on your PC due to low disk space. Free up some space below and then select Refresh.",
        " nytt.ESystem Windows Server 2019 nie jest jeszcze gotowy dla tego komputera",
        ".?AV?$CZeroInit@V?$CDlpAutoLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@$00@@",
        "Namestitveni program ne sprejema argumentov ukazne vrstice. ",
        "lnej verzie Windowsu, po aktualiz",
        "ie numai dac",
        "9(9,90949H9L9P9h9l9",
        "Denne bakgrunnsnedlastingen kan v",
        "chargement est d'environ 3",
        "tkamiseks ning Windowsi s",
        " datorn st",
        ", kan det hende at PC-en ikke fungerer som den skal etter installasjonen, og det kan hende du m",
        "1 merkki j",
        "Lisateave",
        "syr-SY",
        "DefaultOfferIndex",
        "ljute installiprogrammist.qInstalliprogrammi k",
        "= =,=8=D=P=\\=h=t=",
        "s de que inicies sesi",
        " 4 GB+ (st",
        "Installa Windows Server 2019/L'operazione potrebbe richiedere alcuni minuti.oConfigurazione dell'aggiornamento per Windows 10 in corso",
        " igjennom informasjonen i %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml for ",
        "kkel.5BitLocker-n",
        " naujo paleisti ",
        "1 car",
        "n diferente), necesitar",
        "iu, apoi ",
        "3<4X4v4",
        "%2!s!3J",
        " BitLocker ressemble ",
        "Det finns inga uppdateringar",
        "%d caracteres restantes(Tra",
        "z yerden devam etmemiz i",
        "anjem sistema Windows Server 2019 v storitvi Windows Update",
        "ini se",
        "installation a ",
        " 25 simboli",
        "rente de celle que vous utilisez actuellement.",
        " chyba.",
        "0k0o0 ",
        "o funcionar corretamente ap",
        " instalada en un directorio no admitido o porque est",
        " ne funkcionira s ovim izdanjem sustava Windows. Poku",
        "%s nie jest prawid",
        "nika instalacyjnego.",
        ", tento krok m",
        " escolheu instalar o %1!s! usando outro idioma que n",
        "lem birka",
        "ico sistema Windows.oNa pogonu, ki bi ga radi uporabili, ni dovolj razpolo",
        "Learn more",
        "im: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX9Bitlocker atsl",
        "&Installer",
        "cie: %1!d!%%",
        "\\Ez a BitLocker-kulcs t",
        "i m0s",
        ", ki ste ga kupili v spletu.",
        "Atsisi",
        "Failure.cmd ",
        ".?AVCSetupPageBase@@",
        "ovat v instalaci.",
        "Izbor USB fle",
        "itati jezi",
        "luseadet*Ma ei soovi kasutada v",
        "installez, vous pouvez ignorer cette ",
        "lj enhet3Installationsprogrammet rensar upp innan det st",
        "Nainstalovat Windows 10",
        "ite: https://aka.ms/windowsserverupgrade",
        "Prenosi",
        "Lingua:",
        " program Windows Servera 20195Re",
        "\"ZNGy",
        "jlokat",
        "CreateICW",
        "Vianm",
        "n de Windows Server 2019. Intenta reiniciar el programa de instalaci",
        "te naujausius diegimo failus.",
        "A&vanti",
        "itamine'Failure.cmd juurutusskriptide k",
        "7 ou de Windows",
        "pne, a nast",
        " jour de Windows 10y",
        "j~{f_+;h",
        "\"Nu putem g",
        "041E04B0",
        "gon extern lagringsenhet",
        "23456789BCDFGHJKMNPQRTVWXYbcdfghjkmnpqrtvwxy",
        "Palaukite, kol baigiama s",
        "du laiku.zWindows instal",
        "0i1t1",
        "sticas opcionales.-Utilizar ficheiros de instala",
        "t Windows Server 2019 instal",
        " urmeaz",
        "nosti aktualiz",
        " citi",
        "charger tous les fichiers n",
        "%1!s! ",
        "V6eR{]",
        "ite pod",
        " podle objemu dat, rad",
        ".?AV?$CUnknownImpl@UIUnknown@@@@",
        "Przygotowywanie instalacji ",
        "Logga in som administrat",
        "tta. Aktiveerime Windowsi p",
        "elim uporabiti zunanjega prostora za shranjevanje",
        "Det g",
        ", kompiuteris bus sukonfig",
        "ppna H",
        "EventWrite",
        " retenir :",
        "sik k",
        "gt.2Die Sprachressourcen konnten nicht geladen werden.9Das Arbeitsverzeichnis konnte nicht initialisiert werden.!Ung",
        "/x84\\`",
        "m KutusuTSilinen dosyalar",
        "n Windows 7 eller Windows 8.1, eller om du installerar om Windows 10, beh",
        "='\"RJ}I",
        "zben nem fogja tudni haszn",
        "installation de Windows, puis ex",
        " systemu Windows 10VKomputer zosta",
        "Wenn Sie Windows 10 erstmalig auf Ihrem PC installieren (oder eine andere Edition installieren), ben",
        "essayez..",
        "o consegue executar o Windows Server 2019",
        "3F4k4t5",
        "co nav",
        "akniniame kataloge.",
        "lata eset",
        " ativado neste computador. Isso significa que voc",
        "eiti i",
        "mogatja a g",
        "te ISO s",
        "LI`+*",
        "in.YUSB flash s",
        "n %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml pentru a rezolva problema ",
        "Cit[ PsA;",
        "i ned",
        "Om Windows 10 tidigare var installerat och aktiverat p",
        "[Fehlercode: 0x%x]1Unerwarteter Fehler bei der Windows-Installation.",
        "}D0g0D0~0Y0 ",
        "p en ny.",
        "Keel:",
        "ll personliga filer och appar",
        ".?AVCWizardPage@UX@Common@ConX@@",
        " uruchomiony",
        "To lahko traja nekaj minut.~Med name",
        "ii Windows",
        " Operativsystem",
        "lt a Windows Server 2019 telep",
        "i USB uklonjivi pogon.",
        "s folytat",
        "sakorkA megadott term",
        "Rm}Pi",
        "Rediger, hvordan Windows Installation downloader opdateringer",
        "Sxzl;",
        "n de Windows Server 2019 debe reiniciarse para que funcionen. Una vez que se reinicie, continuaremos desde donde lo dejamos.2Este equipo no puede ejecutar Windows Server 2019.xA unidade que est",
        "tajte si to, aby ste vedeli, s ",
        "Izbiranje pogona",
        "gle, et SD-kort eller en ekstern harddisk til midlertidigt at udvide din harddisk, mens opdateringerne installeres. Windows vil ikke omformatere den eksterne lagerenhed, og du kan fjerne den, n",
        "installation pour Windows 10. Nous pouvons vous aider ",
        "7@7`7",
        " denne computer for f",
        "ivitykset on asennettu, mutta Windows Server 2019:n asennus on k",
        "dzie gotowe",
        "n.5Asegurarse de que su PC dispone de espacio suficiente)",
        "rt.,Installasjonsprogram for Windows Server 2019?Starter installasjonsprogrammet for Windows Server 2019 p",
        " kompiuteryje gali b",
        "%d%% on l",
        "264u4",
        " instalace ho budete moct odebrat.-Po",
        "rio de trabalho(Par",
        ": 0x%x]EUne erreur inattendue est survenue lors de l",
        "in Windows Server 2019 Kurulumu",
        "mni-IN",
        "l lentebb t",
        "a para software Microsoft\"Pol",
        "Alege",
        "ifrom.?Va",
        " sufficiente per continuare l'installazione di Windows 10. Prova a riavviare il programma di installazione.@Sto verificando che lo spazio disponibile nel PC sia sufficiente)Vuoi continuare a usare questa selezione?",
        "e que pour ajouter des fonctionnalit",
        "FileVersion",
        "Bez ozna",
        "&Zavrni>",
        "o funciona com esta edi",
        "n uudelleen",
        "rqsppnmmTP84211h",
        "bai S re",
        "a %d skupiny je neplatn",
        " Windows 10 a fost instalat ",
        "jdete v Pomocn",
        "rda f",
        "Den kostnadsfria uppdateringen till Windows 10 ",
        "nPPqqZq",
        "Odaberite jezik, arhitekturu i izdanje",
        "avanje skripti za primenu precommit.cmd*Izvr",
        "CSetupResponsePageBitLockerKeyValidate: SerializePage",
        "re installing Windows 10 on this PC for the first time, you need to enter a valid Windows 10 product key.",
        " poistetaan, mukaan lukien tiedostot, sovellukset ja asetukset.",
        "stra aceste fi",
        "iona cu aceast",
        "r vi slutade.2Det g",
        "tme v",
        "Installationen f",
        "imini de",
        "2T2q2",
        "Pravne informacije",
        " ne funkcioni",
        "m apenas 25 caracteres.",
        " jatketaan, kun kirjaudut sis",
        "i %1!s! utiliz",
        "z nem t",
        "n av f",
        "lo je do te",
        "UxTheme.dll",
        "m Kutunuz a",
        "lI!0>SF",
        "https://go.microsoft.com/fwlink/?LinkId=724295",
        "t Windows 10. M",
        "e se nekoliko puta ponovno pokretati. To bi moglo potrajati.",
        "bn dvd-br",
        "kkelen nedenfor eller avslutte installasjonen, aktivere Windows og deretter starte installasjonen p",
        "Spremenite na",
        "BitLocker-avain",
        " jour.+Lib",
        "z gerekti",
        "n Windows-version kanssa. Kokeile toista avainta.ITuoteavain olikin v",
        " jour sont install",
        "$,Aah?@",
        " tietokonetta uudelleen. Sulje avoimina olevat ohjelmat ja k",
        "installation est pr",
        "INSTALLASJONSINFORMASJON: Noen Windows 10-funksjoner krever avansert programvare. Noen eksisterende funksjoner er endret eller fjernet. Windows 10 oppdateres automatisk i st",
        "rent votre attention",
        "Pripremamo neke stvari\"Ovaj alat ne mo",
        "<Windows Server 2019 zat",
        "r utrymme nedan och v",
        "ilita Windowsi s",
        "RtlRegisterFeatureConfigurationChangeNotification",
        "cessaires. V",
        "lo je do problema pri pokretanju ove alatke",
        "me est survenu.OPour installer Windows 10, cliquez sur Setup.exe sur le support d",
        "dzu, atveriet kr",
        ".}Am ",
        "Neredeyse haz",
        " parametrus.BJ",
        "@>>>>:@DDDDD??D?I",
        "Meghajt",
        "Esta descarga en segundo plano puede ser de m",
        "lg ekstern lagerenhed",
        " v Nastaven",
        "ite datoteko ISO na DVD",
        "buj ponownie.?Nast",
        "rz folder Pobrane",
        " entrar nele novamente./N",
        "DrawFocusRect",
        "r jag slutade",
        "Hvad vil du foretage dig?",
        "s ind",
        "i programul de instalare.*Asigura",
        "fr-029",
        ": :,:8:D:P:\\:h:t:",
        "Creando el medio de Windows 10$Sigue usando tu PC con tranquilidad.",
        ":5:d:k:q:v:",
        "o, tem de resolver as quest",
        ".?AVCObject@@",
        "o ocorrer sem problemas e podem incluir corre",
        "urira ra",
        "hi-IN",
        "re mediet for at installere det.+Du kan stadig forts",
        " funkcji i zabezpiecze",
        "Die Installation kann aufgrund eines Problems nicht fortgesetzt werden. Lesen Sie die Informationen in \"%1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml\", um das Problem zu beheben, und f",
        "o e tente novamente.7O Windows 10 ainda n",
        " du finne ut om dette f",
        "prava instalace. ",
        "TI_}Mj",
        "Nous avons constat",
        "Comunicazioni e condizioni di licenza applicabili",
        "LixeiraKEsvazie a Lixeira para remover os arquivos exclu",
        "cy-GB",
        "Arkitektur",
        " 0x%2!lX!",
        "am-ET",
        "rankai nepavyko pritaikyti perk",
        "administrateur.<Vous devrez graver le fichier ISO sur un DVD ult",
        "6-6?6Y6",
        "WWW===333",
        "iz..Bu bilgisayar Windows Server 2019 ",
        ":&:0:7:a:h:o:",
        "unu fark ettik. Windows 10",
        "Beklager, men vi har problemer med ",
        "stroj spusti",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::Restart",
        "vod najdete dole.",
        "o.)A verificar se o PC tem espa",
        "_Allalaaditavate failide kausta avamine nurjus. Avage oma allalaaditavate failide kaust k",
        "ierele mele personale",
        "iimis. Valige see v",
        "!kx0]",
        " Twojego komputera za pomoc",
        "9995=",
        " desteklenmeyen bir dizinde y",
        "Clave de Bitlocker",
        "senie o pou",
        "re reinstalling it, you can skip this step. We",
        "eti namestitve sistema Windows. Znova za",
        "ngs automatiskt om %1!d! minuter.%Saker du beh",
        " przywr",
        "e nadaljevati, ker Windows ne more znova zagnati ra",
        "i parametri komandne linije",
        "seGFriss",
        "s!X&'",
        "me et r",
        ": 0x%x]",
        "rminos de licencia del software de Microsoft$Declaraci",
        "te tla",
        "CSetupResponseTemplate<class IActivationActionResponse>::ExecuteRoutine: Cancel button clicked.",
        "&Akcept",
        "n.{Tenemos problemas para determinar si tu PC puede ejecutar Windows 10. Sal del programa de instalaci",
        "rLanguage",
        "7F7v7",
        "=8=M=T=Z=_=j=t=y=",
        ".OKonfig",
        "kom u toku operacije %2!s!",
        "DThis product key didn",
        "CSetupResponsePageBitLockerKeyValidate: CSetupResponsePageBitLockerKeyValidate",
        "ft werden.=Setup konnte die ausgef",
        "Notez les informations suivantes :",
        "stroj Media Creation Tool",
        "&Elfogad",
        "essayez.:Scripts de d",
        "nn ISO-filen p",
        "%Microsoft Windows Production PCA 2011",
        ". Galime pad",
        "rst skapa och sedan k",
        "Kurulumun devam etmesini engelleyen bir ",
        "rification de l'",
        "8$808<8H8T8`8l8x8",
        "ch mo",
        ".?AVCSetupDlpResponse@@",
        "2019. Essayez de red",
        "Instaliranje ovog izdanja operativnog sistema Windows 10 ",
        "tzm-Tfng",
        "tiniz:",
        "%2!s!=",
        "ticamente@El programa de instalaci",
        "Your files, apps, and settings can't be kept because you've chosen to install  %1!s! using a different language than you're currently using.",
        "Uaktualnij ten komputer teraz",
        "rbereder nedladdning av den senaste versionen av Windows 10",
        "Selectare unitate'Instalarea cur",
        "We can",
        "Installationsprogrammet f",
        "EHet downloaden van de nieuwste versie van Windows 10 wordt voorbereid",
        "WoU.L~",
        "Ficheiro ISO",
        "i Instrumentul de creare a suporturilor fizice actualizat",
        "iustusi. Vabastage allpool ruumi ja seej",
        "Dette kan tage flere minutter.",
        "Zaloguj si",
        "tten og oppgi feilkoden.",
        "ava nastavak instalacije. Da biste rije",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::SetResponseName",
        " Windows Update ",
        ", SD kortel",
        "Windows 10 allalaadimine Allalaaditud faili kontrollimine",
        "zben.?Hiba t",
        "tu aizsarg",
        " disponibile per la lingua e l'architettura correnti.",
        "quz-PE",
        "Uso de almacenamientofExplora manualmente el uso del almacenamiento en la configuraci",
        "o e tente novamente.+Houve um problema ao baixar alguns arquivos",
        "en kom i, eller i din mailkvittering. N",
        "hrend die Updates installiert werden. Das externe Speicherger",
        "m stiahnu",
        "%1!s! %2!s!",
        " o computador para ser executado no modo S. Escolha esta edi",
        "riist ei saa teie arvutit v",
        ", aby se odstran",
        "n az S m",
        "lja umbes j",
        "mtade filer manuellt.TDet gick inte att ",
        " %s;Windows ",
        "ier ISO) pentru alt PC",
        "il, l",
        "gsw-FR",
        ")Stiahnite si najnov",
        "Installer Windows",
        "to se zatvori",
        "Izmantojiet ",
        "mas diska no",
        " verze tohoto n",
        "ll need to burn the ISO file to a DVD later.",
        "s et langues facultatives.",
        "inome, ar kompiuteris parengtas t",
        "[Moderator Suggested Translation] - Nous avons restaur",
        "i4Chcete pokra",
        "0?{$A0",
        "strojem BitLocker se b",
        "CheckHotPluggableDriveEx: Drive %c SetupDiGetDeviceInterfaceDetail-2 Error: 0x%X",
        "8!989K9m9",
        "elles fonctionnent. Une fois le red",
        "utilisation du stockage. Ouvrez manuellement votre espace de stockage dans Param",
        " nem tudta alkalmazni az ",
        " ir tada v",
        ".3Saisissez la cl",
        ".?AVCSetupResponsePageCompat@@",
        "1Startar om installationsprogrammet f",
        "me emp",
        "lectionnez une autre cl",
        "0n0\\O",
        " Windows.",
        " vontade para continuar usando seu computador.",
        "w instalacyjnych",
        "}L0j0D0",
        "o miejsca. Post",
        "Tiene un aspecto similar a este: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXPAntes de seguir con la instalaci",
        ">G>M>X>l>q>}>",
        "veletet ezzel a be",
        "t Windows Server 2019.>Turpin",
        ".CRT$XCA",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::CheckUserInterrupt",
        "1;Wls",
        "n. Libera espacio y luego int",
        "\"Namestitveni program za Windows 10",
        "Vi kan ikke downloade alle de n",
        "nd contacta",
        "Atpa&ka",
        ".?AVCSetupCompatDlpResponseFactory@@",
        "steem:",
        "%3!s!$Windows 10 Setup wird neu gestartet.",
        "b5_Y0",
        " tuoteavainta ja valitse sitten P",
        "Isto pode levar alguns minutos.oVoc",
        "2E2[2y2",
        "No en este momento",
        ".lNepoda",
        "jakou dobu trvat.0Po",
        "i folosi ",
        "inome, ar kompiuteryje u",
        "site nesuaktyvin",
        "rimas kitam kompiuteriui",
        "es %d%%",
        "O&drzu",
        "FOOOqqZqZoZoZqmb",
        "je funktioner til Windows. Den kan ikke bruges til at installere Windows.",
        " versiunea curent",
        "Instalar Windows 10",
        "no otvorite korpu za otpatke.pOtvaranje iskori",
        "Fast geschafft!",
        "%s nije va",
        " jazyk a architekturu.",
        "u stiahnu",
        "Seleziona un percorso",
        ", kad t",
        "nete pode",
        "=&>L>i>",
        " jazyk.",
        "hrt werden.",
        "O(u}T",
        ">&>6>_>t>y>",
        "puleviimist automaatselt.",
        "4$4D4r4{4",
        "m probl",
        "es, drivers e recursos opcionais",
        "mu Windows",
        ": 7Windows a besoin d'espace pour effectuer la mise ",
        "Ei mit",
        "ments",
        "e sur votre PC n",
        "elim pri izbolj",
        "sto pomoc",
        "diegsite ",
        "INSTALL_DRIVERS",
        "e uporabljate povezavo z omejenim prenosom podatkov, preverite, ali lahko nastanejo dodatni stro",
        "&Namesti",
        "Your PC will restart several times. This might take a while.",
        "Zasady zachowania poufno",
        "Altre informazioni",
        "< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\\<`<d<h<l<p<",
        "ci, piem",
        "9+9S9u9",
        "Prije a",
        ", kol v",
        "pertinents et conditions du contrat de licence",
        "itada. Sulgege installiprogramm ja proovige uuesti.",
        "Gli aggiornamenti sono stati installati, ma per farli funzionare ",
        "installation de Windows 10. Essayez de red",
        "Nic+Budete si moct spravovat nastaven",
        " automaticamente tra %1!d! minuti.$Informazioni utili prima di iniziare",
        "ite a",
        "alej stiahnete najnov",
        "@@@@@@@@@@@@@@@@@@ppp",
        "nciasPRemova ficheiros de grandes dimens",
        "ke programe i opcionalne funkcije",
        "F|||RQRRRN! y",
        " instalarea este gata",
        "Kopen",
        "rente de celle que vous utilisez actuellement. ",
        "Se preg",
        "w99=9<9+-0",
        "i clic pe Setup.exe de pe suportul fizic de instalare.pNu ne d",
        ".4Nepoda",
        "bn Lager manuelt under Indstillinger.6Papirkurven kunne ikke ",
        "CInstallUI::ShowErrorMessage: Ignoring since error page is shown",
        "Not right now",
        "c tam atlasiet Atsvaidzin",
        "czono %1!d!%%UTen klucz produktu nie dzia",
        "o suficiente para continuar a instalar o Windows 10. Tente reiniciar a Instala",
        "ahuje sa Windows 10",
        "bujesz zainstalowa",
        " jeszcze kilka rzeczy, aby mo",
        "&Cerrar",
        "n e-mailul de confirmare a comenzii. C",
        "lreiz.*Sist",
        "Ikke lige nu",
        "GlobalFree",
        "im biste stvarima trebai posvetiti ne",
        ".idata$6",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::GetResponseId",
        "rizze az internetkapcsolatot, ",
        "tta med installationen och beh",
        "na by",
        "ramayaca",
        "n de problemas",
        "GetPrivateProfileIntW",
        "i ce dori",
        "elite instalirati na drugoj particiji, morate stvoriti pa pokrenuti medij za njegovu instalaciju.'Slobodno nastavite s kori",
        "ju oper",
        "n de Windows.]Se eliminar",
        "tirmesiUDepolama kullan",
        "asT@w`O",
        "Aqui est",
        "Updates, stuurprogramma's en optionele onderdelen downloaden (aanbevolen)",
        "Preparazione dell'installazione ",
        " informacij o nadgradnji sistema Windows Server, obi",
        "Kies wat u wilt behouden",
        "cuter l'installation.jPour plus d'informations sur la mise ",
        "Opera",
        ". Kurulum program",
        "liwia kontynuowanie instalacji. Zajrzyj do informacji w %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml aby rozwi",
        "hoz rendszergazdai fi",
        "rym j",
        "a do Windows 10 no seu PC devido a espa",
        " veiksm",
        "tme kontrolliminePSee tootev",
        "Installimiseks valmis",
        "r. Niektor",
        "s ejecutando Windows 10",
        "2(282<2@2D2H2L2P2T2X2l2p2",
        "tirmeler al",
        "Pripravuje sa in",
        "050<0e0",
        "cute en mode S. Choisissez cette ",
        " versiune",
        " iniciar sess",
        " zlep",
        "su datoruXPa",
        "rota maksa par piek",
        " ceci : XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "p\"Vhmd",
        "768=8C8H8S8^8r8|8",
        "kleme se",
        " con la instalaci",
        "ite datoteke, aplikacije i postavke jer ste izabrali da instalirate %1!s! na jeziku koji trenutno ne koristite.",
        "im Kutusu Kimli",
        "&Devam",
        "rt pc'en til den tilstand, den havde, lige f",
        "ta diegti automati",
        "t datus, turiet datoru sav",
        "est produit lors de l",
        "7O7j7",
        "ite kori",
        "e a voliteln",
        "unara&Proveramo da li spremni za instalaciju",
        "hlen Sie eine der verf",
        "*Identifica",
        "tta anv",
        "Windows pole selles arvutis aktiveeritud. See t",
        "FullUpgChecked",
        "my-MM",
        "iu disponibil. Alege",
        "Me ei oska ",
        "CSetupResponseTemplate<class IDlpResponse>::OnNext",
        "CSetupResponseTemplate<class IActivationActionResponse>::IsBackEnabled",
        "Mora imati najmanje %1!d! GB.",
        "INFORMACIJE O NAMESTITVI: nekatere funkcije sistema Windows 10 zahtevajo napredno strojno opremo; nekatere obstoje",
        "ekivane gre",
        "n para completar la actualizaci",
        "dition de la version de Windows qui est pr",
        "ine ba",
        "040<0D0P0p0|0",
        "Immetti il codice Product Key",
        "yti diegimo informacijos, kuri reikalinga norint toliau diegti ",
        "i samo 25 znakova.",
        "nn ISO-filen manuellt p",
        "tit sisestada.",
        ".9Ryhm",
        "Abrir9Como alternativa, pretendo utilizar armazenamento externo+N",
        "8L9V9q9",
        "/Pobieranie najnowszej wersji systemu Windows 10",
        "ierele de care nu mai ave",
        "iere de instalare mai vechi pentru Windows 10.  V",
        "7 7:7P7c7s7",
        "o aceita argumentos de linha de comandos. Para mais informa",
        "r Windows 10 wird konfiguriert",
        "Change how Windows Setup downloads updates",
        "zca etkinle",
        "s a(z) %1!s! f",
        "ipraveno k instalaci",
        "In&staller",
        "&?:DDDDDJDJJJJ`JJJ9)",
        "KqZZZZZZXZqmf",
        "Vyberte cestu",
        "rrelsen kan variere), og Internett-kostnader kan p",
        "termination des choix d",
        ", da element odstranite s seznama.iKo smo posku",
        "ments,Cet outil ne peut pas mettre ",
        "CInstallUI::ConfirmEulaDecline: Eula decline confirmed",
        " niveau ce PC maintenant",
        ". Windows ei alusta ulkoista tallennuslaitetta, ja voit poistaa sen asennuksen p",
        ".?AVCSetupResponsePageInstallNowOrLater@@",
        "t, mus",
        "Unten sind die Gr",
        "Progression : %1!d!%%CVeuillez s",
        "+Je r",
        "ivityst",
        "Din pc genstarter om et ",
        "Hvis du installerer denne udgave af Windows 10, konfigureres din pc til at k",
        "Rj0zzM0",
        "xx|lH",
        " na DVD disk.",
        "Leelawadee UI Light",
        "o do Windows 10 falhou",
        " prie interneto, ir bandykite dar kart",
        "s meg",
        "ekajte da se zavr",
        "Digite a chave do Bitlocker",
        "l nevaram noteikt, vai oper",
        " Windows 10E",
        "04080<0@0H0L0T0`0",
        "GDI32.dll",
        "Sprawd",
        "?%'**",
        "rba van telep",
        "te instala",
        " izdelka deluje! Ko ste pripravljeni, nadaljujte.",
        "jeblikket.",
        "be en Windows 10-produktn",
        "ajke BitLocker. Odaberite neki drugi pogon i poku",
        "ana kadar bilgisayar",
        "ra den senaste versionen f",
        ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskSpaceActionResponse@@@@@@@@",
        "'#%'6'6''6",
        "Priebeh: %1!d! %%3Pokra",
        " attivato in questo PC",
        "r verktyget igen.!Ett problem uppstod med verktyget",
        "7Windows 10 ",
        "line salvestusseade",
        "n no pudo validar la clave de productoUEl programa de instalaci",
        " enhet %2!c!:.]",
        " solicit",
        "o#6=Hm",
        "ano: %d%%",
        " Windows Server 2019B",
        "A preparar algumas coisas+Esta ferramenta n",
        "seRA sz",
        " jour facilitent l'installation et peuvent inclure des correctifs importants, des pilotes de p",
        "rende version af Windows ved hj",
        "te vyrie",
        "jiet un darbiniet jaun",
        "Angajament de respectare a confiden",
        "\"Hibak",
        "pnych opcji, aby kontynuowa",
        "&Sulje",
        "n, te ayudaremos a liberar %1!s! en la unidad %2!c!:.",
        "&Fortsett",
        "Aceste actualiz",
        "unaru.",
        " program..Zji",
        "tte med at bruge pc",
        "ama papildu aparat",
        "Prostor za shranjevanje",
        ">A>J>S>\\>e>n>",
        "jumu ieg",
        " jour et elle sera r",
        "&Ekraaniklaviatuur",
        "ierul ISO pe un DVD.",
        "kkelen",
        "jra kell telep",
        "installationR",
        "USB-muistitikkua ei l",
        "base\\ntsetup\\conx\\mosetup\\mediasetupuimgr\\src\\SetupResponsePageDiskPartitionImpl.h",
        "nternet'e ba",
        " do syst",
        "BrandingFormatString",
        ">M?y?",
        "Kontynuuj od miejsca, w kt",
        " PC-ul are spa",
        " yetersiz oldu",
        "n y quiz",
        "ber jednotky-Pred zavret",
        "INSTALLATIONSINFORMATION: F",
        "xhzxxx'l",
        "im postavkama a",
        "CSetupResponsePageGated::UpdateView",
        "ntat fel uppstod. Kontrollera att installationsk",
        "trzny dysk twardy, aby tymczasowo rozszerzy",
        "itamine",
        "Tiene un aspecto similar a este: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX.",
        "Velik mora biti vsaj %1!d! GB.",
        "Dine filer, apps og indstillinger kan ikke bevares, fordi du installerer en udgave af Windows, der er anderledes end den, du bruger i ",
        "o funcionou. Tente uma chave diferente ou compre uma nova.",
        "installation est en attente, car les ",
        "dn%s^\\$ ",
        "cii syst",
        "bI0|:",
        "chte keinen externen Speicher verwenden",
        "em PC-ju dovoljno prostora#",
        "Instalarea nu poate continua, deoarece Windows nu poate reporni computerul. ",
        " kompiuteris$Tikrinama, ar esate pasireng",
        "4!uhM",
        "i textul, pentru a ",
        ";7EP:EP:EP:EP:EP:",
        "3O3w3",
        "USB flash s",
        "CInstallUI::CreateDownlevelInstallUI",
        "Installer Windows 10IObtenir des mises ",
        "6(6H6P6X6`6p6",
        "N!k(Wdk",
        " jste za",
        " se aktualizace: %1!d!%%",
        "Dit kan een paar minuten duren.cNiet alle benodigde bestanden zijn gedownload. Maak verbinding met internet en probeer het opnieuw.1Implementatiescripts van preinstall.cmd uitvoeren0Implementatiescripts van precommit.cmd uitvoeren.Implementatiescripts van failure.cmd uitvoeren",
        "teignez pas votre ordinateur.",
        "D$@+D$8",
        "onnistui",
        "PPP000",
        "Takmer hotov",
        "Impossibile continuare l'installazione. Per risolvere il problema, esamina le informazioni in %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml ed esegui di nuovo il programma di installazione.lPer ulteriori informazioni sull'aggiornamento di Windows Server, visita: https://aka.ms/windowsserverupgrade}Non ",
        "n.hSizin i",
        " DVD-",
        "ar do in",
        "Causa del messaggio",
        "bW0_0_0",
        "tirece",
        "n de Windows que coincide con la clave de producto que has escrito no est",
        ".5Windows Server 2019 ",
        "eme uvo",
        "rminos de licencia aplicables",
        "sit informa",
        "t work with this edition of Windows. Try a different key.FThis product key didn",
        "6R6\\6h6",
        "Starter",
        " su administratoriaus paskyra..Tur",
        "su PC dator",
        "inden emin olmak i",
        " parti",
        "ch pokyn",
        "Tootev",
        "n de medios actualizada!Iniciar sesi",
        "s abajo si quieres conocer las razones.",
        "lerini ve y",
        "ti sisaldab ainult 25 m",
        "USB flash disk nejde naj",
        " almam gerekiyor",
        "rt, de az ",
        "191023231921Z",
        "$Hata kodu: 0x%1!lX! - 0x%2!lX!",
        "Preostalo znakova: %d",
        "tigt werden, konnten nicht gespeichert werden. Daher m",
        "a backup deles agora em outro local de salvamento.",
        "2019. Afin de prot",
        "OX[4X@bk0",
        "rtoti, varat izlaist ",
        "gu identifikatoram: 7Sist",
        "ivitada. Sulgege k",
        "Er zijn een paar dingen die nog moeten gebeuren voordat u een update kunt uitvoeren. U krijgt bericht als het zover is en wat u daarna moet doen. Dit venster sluit automatisch over %1!d! minuten.!Wat u moet weten voordat u begint",
        "040C0L0U0j0",
        "n y vuelve a intentarlo.-Windows 10 a",
        "% k|I ",
        "?2?9???D?P?`?t?~?",
        " di sistema.",
        "pi asetusten avulla manuaalisesti ja poista muita suuria kohteita.",
        "ivitage installimine.",
        "Geef de BitLocker-sleutel op",
        "ali s instalac",
        "1(1g1{1|2",
        "d chyby.",
        "installation de Windows se poursuivra automatiquement.",
        "8<\\D6",
        "re trying to use is encrypted with BitLocker. Choose a different drive and try again.",
        "9Windows 10 ",
        " Prenosi",
        "s aceptando.",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::Cancel",
        "lni a munkak",
        "PL0~0`0g0M0f0D0~0[0",
        "t install Windows 10WWe",
        "Sprawdzanie komputera-Sprawdzamy, czy wszystko gotowe do instalacji",
        "Installer Windows Server",
        "nceki h",
        "rskenduse konfigureerimine",
        "s elemet.",
        " a aplikace se odstran",
        "Windows Server 2019 Kurulumu1Windows Server 2019 Kurulumu yeniden ba",
        "0W0f0D0~0Y0:",
        " funkc",
        "Licen",
        "Vi har lagt merke til at du har gamle installasjonsfiler for Windows 10. Vi kan hjelpe deg ",
        "r vi er ferdig, samt instruksjoner om hva du skal gj",
        "Lisensvilk",
        "n de preinstall.cmd7Ejecuci",
        "anas s",
        "re trying to use doesn",
        "tta p",
        "SSSSht",
        "kalun suorittamisessa oli ongelma",
        "TL0B0",
        "rcarea celei mai recente versiuni de Windows 10,Aceast",
        "jlok ",
        "ni toiming. Kui toimingud on tehtud, anname teile teada, mida edasi teha. See aken sulgub automaatselt %1!d! minuti p",
        " OK f",
        "6 6$64686<6T6X6l6p6",
        ". Suaktyvinkite dabartin",
        "vs avancerad maskinvara; vissa befintliga funktioner har ",
        ".\\Lang.ini",
        "installation.1V",
        "GetDeviceNumberFromPath: Drive %s CDeviceIoControl returned Error: 0x%X",
        "sIJ@=\"\"\"\"\"  $!",
        "Instalacija ne mo",
        "10 est pr",
        " tarvitse, tai vapauta levytilaa k",
        "%Ne mo",
        "&Tilbake",
        "ObefTento k",
        "Wird vorbereitet (%d%%).Benutzereinstellungen werden verschoben (%d%%)",
        "o estamos a conseguir determinar se o Windows 10 j",
        "Keep personal files and apps",
        "letet manu",
        "rja be a Telep",
        ". Obnov",
        " limpiando antes de que se cierre!Esto puede tardar varios minutos.SEnchufa tu PC para asegurarte de que la bater",
        "ny fontos szempont:",
        ".?AVCWebbrowserUIHandler@@",
        "tfen Kurulumu kapat",
        "e se kada se prijavite u sustav Windows Server 2019. Da biste pridonijeli za",
        "*Instalacija operativnog sistema Windows 10;Nabavi ispravke, upravlja",
        "anje sistema Windows 10",
        "z silinir, ancak dosyalar",
        "Ne nyn",
        "cych przyczyn:",
        "L'installation de cette ",
        "N_U(u",
        "renin.",
        "Instalowanie systemu Windows 10JKomputer zostanie uruchomiony ponownie kilka razy. Mo",
        "jlokat a Let",
        "Valitse osio, johon haluat asentaa Windowsin.",
        " nameV",
        "o do Windows. Guarde e feche os ficheiros antes de come",
        " program znova.",
        "Se estiver a instalar pela primeira vez o Windows 10 neste PC, precisa de introduzir uma chave de produto do Windows 10 v",
        "sokat ",
        "Den Windows-version, der i ",
        "r du godk",
        "|||S||Q|Q|QS",
        "1+161E1",
        " dodane automatycznie0Instalator nie mo",
        "tijZP",
        "t Windows 108Ieg",
        "+Ocaw",
        "to edice Windows 10 nakonfigurujete po",
        "m komut dosyalar",
        "Nadogradite odmah ovaj ra",
        "r du starter",
        "klemeye devam edebilmeniz i",
        "(W`O6e0R",
        " et vous indiquerons ce que vous devrez faire. Cette fen",
        "d Product Key nefunguje. Znova zadajte k",
        "rast installimist ",
        "ite listu i poku",
        "rast.%Mida peaksite enne alustamist teadma?",
        "r utrymme och f",
        "O(udk",
        "imi$Kurulum kapanmadan ",
        "tigen Sie einen Windows 10-Product Key.",
        "e konfigurisati ra",
        "Microsoft Corporation1&0$",
        ";3;^;m;~;",
        " proizvoda ili licencu za Windows 10 da biste aktivirali sustav nakon a",
        "em ili kupite novi.",
        "lvfgH",
        " pode ser usada para adicionar recursos ao Windows. Ela n",
        "A~vbbS",
        "\"Bindestreck l",
        "ties, rad",
        "o validou a chave de produto (Product Key)PA Configura",
        "cijas datu nes",
        "~w~zz",
        "Vyberte jazyk, architekturu a edici",
        "#Licensvilk",
        "Hangi",
        " incapables d",
        "n. Si no instalas estas actualizaciones ahora, es posible que el equipo no funcione correctamente despu",
        "Sprache",
        "=$=-=6=h=",
        "rz9Chc",
        "kite Atnaujinti, kad pa",
        "ajte ponovno.&Windows 10 jo",
        " di download degli aggiornamenti di Installazione di Windows ",
        "kohtaiset tiedostot ja sovellukset'S",
        "installer Windows Server",
        "h: %1!d!%%6Pokra",
        "Ces mises ",
        " ustawienia systemu Windows, pliki osobiste i aplikacje, sprawd",
        "re Windows Server 2019. Lukk installasjonsprogrammet og pr",
        "ciu. Po",
        "nstalleerd.JDe installatie van Windows Server 2019 wordt voortgezet in Windows Update.",
        "k, lai lejupiel",
        "Su PC se reiniciar",
        "stup na internet. Kliknut",
        "}Q0~0Y0",
        "Bitlocker ",
        "Questi aggiornamenti consentiranno di eseguire l'installazione in modo corretto e possono includere correzioni importanti, driver di dispositivo aggiornati e file aggiuntivi non presenti nel supporto di installazione. Se non si installano gli aggiornamenti ora, il PC potrebbe non funzionare correttamente dopo l'installazione e potrebbe essere necessario reinstallare alcune funzionalit",
        "re having trouble determining if your PC can run Windows 10. Please close Setup and try again.",
        "klemeye devam etmek i",
        "%s ge",
        "Arhitekt",
        "Utilizarea spa",
        ": XXXXX-XXXXX-XXXXX-XXXXX-XXXXX/",
        "nstalleerdLUw pc is weer helemaal zoals deze was voordat Windows 10 werd ge",
        "Izjava o privatnosti",
        "iku, kdy byla instalace p",
        "teni.^A haszn",
        "Preparando instala",
        "BusinessN",
        " la desc",
        "Zainstaluj system Windows 105Pobierz aktualizacje, sterowniki i funkcje opcjonalne",
        "m Windows Server 2019",
        "sigyti ",
        "t mit mindestens %1!s! freiem Speicherplatz aus oder schlie",
        "Storage UseLManually explore your storage usage in settings to remove other large items.",
        "enim podatkovnim prometom, provjerite ho",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack",
        "Se Windows 10 ",
        "ljande saker f",
        "4 4$4(4@4D4\\4l4p4t4x4|4",
        "hoz sz",
        "CSetupUIManager::Register",
        "ISO dosyas",
        "; Windows",
        "[7b/e",
        "nce y",
        "es.5Falha ao abrir a Lixeira. Abra manualmente a Lixeira._Falha ao abrir o uso do armazenamento. Execute manualmente %1!s! para abrir a Limpeza de Disco.",
        ".LWindows Server ",
        "te nejd",
        "r kan du kontakta kundsupport och ange felkoden som referens.",
        ">?>U>",
        "tdeFGE",
        "2)31373D3",
        "=vldvnf",
        "Un probl",
        "ll. Ez az ablak %1!d! percen bel",
        "b nagym",
        "o da Unidade3A instala",
        "Ako Windows 10 na ovom PC-ju instalirate prvi put, morate unijeti valjani klju",
        "emiet ",
        "is kodas neveiks su ",
        "o atual do Windows, tem de comprar uma chave de produto ou uma licen",
        " pracovn",
        "Es konnten nicht alle erforderlichen Dateien heruntergeladen werden. Vergewissern Sie sich, dass eine Internetverbindung besteht, und versuchen Sie es noch einmal.7Preinstall.cmd-Bereitstellungsskripts werden ausgef",
        "CSetupResponseTemplate<class IActivationActionResponse>::InitializeRoutine",
        ", kokia buvo iki pradedant diegti ",
        "s befejez",
        "sok haszn",
        "&Aktualizovat",
        ": XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX3",
        "nnen Ihren PC weiterhin verwenden.",
        "Windows 10 bu bilgisayara daha ",
        "- Windows 10.X",
        "m toto, abyste v",
        "i edi",
        " nije spreman za ovaj PC",
        "L0eQc0f0D0_0",
        "izveido un p",
        " naujo paleisti s",
        " diska mora biti %1!d! GB ili ve",
        " kontrol edip yeniden deneyin veya ba",
        "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7",
        "a %d nije valjana, unesite to",
        "hem chvilky restartuje.",
        "ssel f",
        "Af;:u",
        "sticas opcionales. Estas actualizaciones ayudar",
        "tkamiseks valmis. Proovige installiprogramm uuesti k",
        "2$202<2H2T2`2l2x2",
        "A Windows nincs aktiv",
        "u Denetle",
        "CSetupResponsePageSysReq",
        "GetParent",
        "ruojame ",
        "e je v po",
        "($.:4?/CC?C??.41",
        "Leia este texto para saber com o que est",
        " Windows 10f",
        "ivog prostora. Odaberite neki drugi pogon i poku",
        "We need to do a few more things before you can update. We",
        "i instalarea ",
        "dzu, atlasiet nodal",
        "es do Windows.[As seguintes a",
        "rile Windows.CSet",
        "INFORM",
        "@@@@@@   ",
        "e uporabljati sistema Windows 10 Sistem Windows 10 ",
        "echno p",
        "anu un patur",
        "pet a telep",
        "wnym no",
        "ievada der",
        "chargements. Ouvrez manuellement votre dossier T",
        " Uppdatera f",
        " podmienky",
        " sufficiente per continuare l'installazione di Windows Server 2019. Prova a riavviare il programma di installazione.",
        "(Los guiones se agregar",
        " informacij, preberite pomo",
        "&Install",
        " Masterizza il file ISO su un DVD",
        "Pogon USB je pripravljen",
        "Microsoft ",
        ", pero no podemos ejecutar esta herramienta en tu PC. Si sigues teniendo problemas, haz referencia al c",
        "r den Internetzugriff anfallen. Klicken Sie auf \"Weiter\", um die neuesten Installationsdateien herunterzuladen.",
        "tkamiseks piisavalt ruumi. Proovige installiprogramm uuesti k",
        "Legal",
        "The bit locker key only contains 48 digital characters.",
        " nouveau.",
        " pro tuto edici Windows. Vyzkou",
        "#Microsoft yaz",
        "rja be a Bitlocker-kulcsot ehhez az azonos",
        "ments(Cet outil ne peut mettre ",
        "ionat. Reintroduce",
        "0F0j0",
        "Probl",
        " din pc. Aktiv",
        "&Tastatura na ekranu",
        "(%1!c!:)",
        "+_A]]",
        "ma Windows un p",
        "Trebamo jo",
        " saklamak i",
        "prs-AF",
        "nosti",
        ": XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX8",
        "cie sa vy",
        "utujeme, ale m",
        "t.RAz eszk",
        "tta installationen av Windows. Starta om installationsprogrammet och f",
        "The installation cannot continue because Windows cannot restart the computer. Close any open programs, then restart the computer. Windows installation will continue automatically.",
        "n de esta edici",
        " y activ",
        "o par",
        "Here are some things to keep in mind:",
        "Folgende Punkte sollten Sie beachten:",
        "it deschiderea Co",
        "rminos de licencia y avisos aplicables",
        "Ove ispravke ",
        "re getting a few things ready",
        "e musisz wprowadzi",
        "nosti a",
        "no otvorite mapu Preuzimanja.VOtvaranje DVD snima",
        "tiski:Uzst",
        "Wij kunnen niet verder vanwege het volgende probleem:",
        "No pudimos descargar todos los archivos necesarios. Aseg",
        "avali da ovo re",
        "ProductKeyValidate",
        "a a dokon",
        "uriranja instaliraju. Windows ne",
        " olet tekem",
        "n de Windows encontr",
        " nytt p",
        " instalowana wersja systemu Windows jest inna ni",
        "o adicionados automaticamente1A configura",
        "hren Sie %1!s! manuell aus, um die Datentr",
        " postarali. Kliknut",
        "Windows 10'un bu s",
        " fona lejupiel",
        "yor!Bu i",
        "3.4E4_4p4",
        "CSetupUIManager: Showing exiting Setup",
        "ujejo pomembne popravke, posodobljene gonilnike naprav in dodatne datoteke, ki niso del namestitvenega medija.",
        " dakika i",
        "x]WUU",
        "zilleszt",
        "Niestety, mamy problem z okre",
        "es novamente mais tarde./A instala",
        "ivityksi",
        "uriranje.3Oslobodite %1!s! na ra",
        " daha sonra bir DVD",
        "n %2!s!",
        "Une erreur inattendue est survenue lors de l",
        "i este posibil s",
        "lpe dig med at frigive %1!s! p",
        "Uslovi licenciranja",
        "tare.",
        "Skoro hotovo",
        "Seleccionar una ruta de acceso",
        " ja muita tiedostoja, joita ei ole asennustietov",
        "terminer si votre PC est pr",
        "kseltme hakk",
        "Vad vill du g",
        "UnionRect",
        "HomeBasicN",
        "ba, un t",
        "i litsentsi.",
        "Percebemos que voc",
        "ges term",
        "Leggi attentamente per sapere le condizioni che accetti.",
        "unaru koji je dizajniran za kori",
        "gle fungerer ikke. Kontroll",
        " PC-en",
        "3!3@3_3~3",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::SerializeRoutine",
        "Se continui senza attivare la tua versione corrente di Windows, dovrai acquistare un codice Product Key o una licenza di Windows 10 per attivare Windows 10 dopo l'aggiornamento.",
        "Am observat c",
        "ie, trebuie s",
        "La clave de BitLocker funciona! Contin",
        "ring av skript for precommit.cmd.",
        "pne programmer, og start deretter datamaskinen p",
        "bory Windowsu 10. M",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::CheckInitialized",
        "%d%% complete",
        " autom",
        "DiskPartition",
        "CSetupResponsePageDU",
        " parametre pr",
        "s nevaram dator",
        "Ija/ o`0Kja/ j`:Kja/ c`^Kja/ ",
        "3UHHHHHHGG%",
        "Megtartand",
        "Seleziona un'unit",
        "D$D+D$<P",
        "lt telep",
        "6Kontrolujeme, jestli je v",
        " Windows 10`",
        " instalace v",
        "itamiseks on vaja v",
        "8)8I8",
        "Adobe ImageReadyq",
        "ana: %d%%",
        "2[3u3",
        "o do Windows ficar",
        "INSTALL_UPDATES",
        "ASENNUSTIEDOT: Jotkin Windows 10:n ominaisuudet edellytt",
        " do systemu Windows Server 2019. Aby chroni",
        "Lataa1Conserver les fichiers personnels et applications;Conserver les param",
        "w preinstall.cmd.=Wyst",
        "installation de Windows va se connecter pour obtenir les mises ",
        "se (aj",
        " eseguire Windows Server 2019. Chiudi il programma di installazione e riprova.5L'installazione di Windows Server 2019 non ",
        "Setup wird vorbereitet. ",
        "- BitLocker ",
        " Windows Update.Q",
        "GetNativeSystemInfo",
        "o instalar essas atualiza",
        "Nem tudjuk pontosan, hogy mi",
        "tartujte po",
        "b`V5C",
        "tllll|",
        "ia pe care dori",
        "   @@@```R",
        "[Foutcode: 0x%x]FTijdens de installatie van Windows is een onverwachte fout opgetreden.",
        "es-GT",
        "es e aplica",
        "Nekoliko napomena:",
        "u, va trebui s",
        "InstallChoiceDefault",
        "dkHr,g",
        "s adelante.AEl programa de instalaci",
        " zada",
        "Keisti, kaip ",
        "lo je do problema prilikom izvr",
        "i executa",
        "6<6D6L6T6\\6d6l6t6|6",
        " kald",
        " nustatant, ar ",
        ".4En r",
        "7&737H7a7",
        "ivitamist j",
        "itamisel ilmnes probleem.",
        "nhamos parado.3Este PC n",
        "amaya devam ederseniz, m",
        "enje precommit.cmd)Izvo",
        "tor a sk",
        "uriranje sustava Windows 10OOtvaranje kori",
        "!%s n",
        "i din nou./A ap",
        "GetFullPathNameW",
        "Kieli:",
        "&Installera",
        "000000",
        "7&8D8_8z8",
        "w DVD. Nagraj r",
        "ste for at downloade de nyeste installationsfiler.",
        "istiti namestitvenih datotekCNamestitveni program ni uspel dolo",
        "bn Indstillinger for lager",
        "s vietas.&",
        "6hhea",
        " innego klucza lub kup nowy.",
        "n para quitar otros elementos de gran tama",
        "Windows Setup bo s spleta prenesel posodobitve, gonilnike in izbirne funkcije. Te posodobitve bodo omogo",
        "vel manter os seus ficheiros, aplica",
        "\\*g:Ndk5u",
        "Instalare Windows 10",
        "rjade installera Windows Server 2019.EVi forts",
        " Windows Update",
        "as obdobia poskytovania podpory. Dostupn",
        "hendust, kontrollige, kas allalaadimisega kaasnevad teie jaoks lisatasud.,Milliseid v",
        "WaitForSingleObject",
        "k. Yeniden denemek i",
        ", SD kartu alebo extern",
        "is foninis atsisiuntimas gali siekti 4GB+ (gali skirtis), be to, gali b",
        "`1Xk0",
        ". Pentru mai multe informa",
        ", vous avez choisi de proc",
        "hr so aus: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "Verificar Compatibilidade",
        "luseade",
        "0!kk0L",
        "cie o inov",
        "&Akkoord",
        "Utilize um dispositivo externo como, por exemplo, uma chave USB, cart",
        "Dit kan een paar minuten duren.sU kunt de pc niet gebruiken tijdens de installatie van Windows. Sla uw bestanden op en sluit deze voordat u begint.+Wacht totdat de app volledig is verwijderd.",
        "%s isn",
        "sr-BA-Cyrl",
        "nchide",
        "      ",
        "du, kad atidarytum",
        ";-;K;W;a;~;",
        "m miestom aspo",
        "veskite teising",
        "ovat z m",
        "J=CBitLockerKeyEdit",
        "ra neleistinas simbolis",
        " poplatky za pr",
        " aplank",
        "ket samsvarer ikke",
        " enhet.",
        "r%04d-%02d-%02d %02d:%02d:%02d",
        " possibile determinare se il tuo PC pu",
        "tit v",
        "li podatke o instalaciji potrebne za nastavak instalacije sustava Windows. Ponovno pokrenite instalacijski program da biste poku",
        "869H9Z9l9",
        " size bildiririz. Bu pencere %1!d! dakika sonra otomatik olarak kapanacakt",
        "6Valmistellaan Windows 10:n uusimman version lataamista$T",
        " semelhante a esta: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "Windows Server 2019 install,Windows Server 2019 installi taask",
        " Windows.r",
        "o precommit.cmd/A executar scripts de implementa",
        "o carregou os recursos de l",
        ", architekt",
        "k igen, eller prova med en annan nyckel.8Din BitLocker-nyckeln fungerar! Forts",
        "e nastavenia a aplik",
        "flash",
        "Windows Sekretesspolicy",
        "p pillanatokon bel",
        "bir g",
        " BitLocker correspondant ",
        "su organiz",
        "Windows n",
        "Emme l",
        "ekilde ge",
        " para seguir con la instalaci",
        "l a Windows 10 telep",
        "Selezionare l'immagine da installare.",
        "D$\\0N",
        "r.$Ba",
        "e se izbrisati. Da biste ih zadr",
        "lygos",
        " diegimo laikmen",
        "ite pomo",
        "bb gombra a leg",
        "gLocal\\SM0:%d:%d:%hs",
        "ey var. Sorunu gidermek i",
        " program.z",
        "ter restante",
        "9$:J:e:",
        "AmbasYEsta chave do bitlocker n",
        "no pokrenite %1!s! da biste otvorili ",
        " a fazer uma limpeza antes de fechar",
        " riuscito ad avviare l'installazione di Windows. Per riprovare, riavvia il programma di installazione.",
        " Windows Server, ",
        " na spustenie v re",
        "!NCi[[",
        "n no pudo inicializar el directorio de trabajo*Par",
        "sik meghajt",
        "wCSetupResponsePageGated::OnInitDialog",
        "919S9w9",
        "i Windows 8.1 pealt v",
        ". Gdy sko",
        "o atlasi?",
        " nevar darboties Windows Server 2019oDiskas, kur",
        "QQSVW",
        "Windows po zavr",
        "ll need a Windows 10 product key.",
        "e;._C",
        "ovat v instalaci Windows od okam",
        "pen a Windows melyik verzi",
        "z, bilgisayar",
        "cie aktu",
        "lisan a G",
        " naujo._S",
        "&Vissza",
        "Produkto kodas tur",
        "1 1$1(1,1014181T1l1",
        "ome, kilo problem",
        "ga neb",
        " argumente ",
        "Beide",
        "O que voc",
        "is langas automati",
        "ffnet werden. Brennen Sie die ISO-Datei manuell mithilfe von %1!s! auf eine DVD.",
        "Su unidad flash USB est",
        "?H?S?g?t?",
        "Continuer ",
        "sti naujinimus, tvarkykles ir papildomas funkcijas (rekomenduojama)",
        "hren Sie das Tool erneut aus.#Problem beim Ausf",
        "rym jest co najmniej %1!s! wolnego miejsca",
        "Es konnte nicht festgestellt werden, ob Windows 10 auf Ihrem PC ausgef",
        "espace, puis r",
        "Evo jo",
        "rskenduste otsimine",
        "su dators ir gatavs turpin",
        " computeren Vil du forts",
        "CSetupLangIniLoader::Initialize: Didn't find any language listed in LANG.INI.",
        "ma Windows 10 ir gatava j",
        "o livre em disco necess",
        "mu nov",
        "0~0[0",
        "teni a term",
        "iul de mai jos, apoi selecta",
        "GetLanguageMediaNumber: Language not found under language pack section.",
        "Zaslons&ka tipkovnica",
        "e jste p",
        "te instalaci znovu.^Dal",
        "r noget plads, og pr",
        "Realizando algunos preparativos*Esta herramienta no puede actualizar tu PC~El idioma o la edici",
        "Setup",
        "scht, aber Ihre Dateien werden beibehalten.;Alles wird gel",
        "i proovite installida Windowsi vanemat versiooni.eDraivil, mida proovite kasutada, pole piisavalt vaba ruumi. Valige m",
        "Aproape gata",
        "SetLastError",
        "Checking for updates: %1!d!%%",
        " denne PC-en, og du installerer den, kan du hoppe over dette trinnet. Vi aktiverer Windows automatisk n",
        "INFORMA",
        "ilytet",
        "avons pas pu enregistrer les informations d",
        "?&?F?T?`?",
        "it-IT",
        "\\RRRRBB/(",
        "m var at",
        " odinstaluje.",
        "nnen.(W",
        ".?AVResultException@wil@@",
        "w. Upewnij si",
        " para obtener actualizaciones, controladores y caracter",
        "a uma c",
        "n, activar Windows y, a continuaci",
        "Nu putem instala cele mai recente caracteristici ",
        "rbaude)P",
        "&NJT4",
        "041F04B0",
        "e zainicjowa",
        "i la Windows 10. Pentru a v",
        "erli diliniz ve sistem mimariniz i",
        "YDen h",
        "Windows 8.1",
        " denne PCen. Dette betyr at du m",
        "CheckHotPluggableDrive: Drive %c SetupDiGetDeviceRegistryProperty Error: 0x%X",
        "bory?In",
        "Les mises ",
        "Vi vet ikke om PC-en har nok ledig plass til at installasjonen av Windows Server 2019 kan fortsette. Pr",
        " iemesli.",
        "cter v",
        "0C0A04B0",
        "@@@@@@@@@",
        "ste du k",
        "fr-CM",
        "e se dodati automatski.Klju",
        "TlP0X",
        " %1!d! GB. Vyberte in",
        "%3!s!)I",
        "eisite i",
        "0O0`0U0D0",
        "o e tente novamente.*A instala",
        "Se necesita m",
        "&PWSV",
        "ipravitTTento probl",
        "kl-GL",
        "tottuk a g",
        "ta un aktiviz",
        "yi kullan",
        "%s Go",
        " riuscita nella fase %1!s! con un errore durante l'operazione %2!s!",
        "WV~~~U~UUPO",
        " naudodami produkto kod",
        "XPrima di chiudere il programma di installazione, viene eseguita un'operazione di pulizia/L'operazione potrebbe richiedere alcuni minuti.dCollega il PC alla presa elettrica per evitare che la batteria si esaurisca durante l'installazione.",
        "les son algunas otras opciones para actualizar?",
        "r diesen PC ausf",
        ";$;`;",
        "ajte ponovo, ili poku",
        "lg den partition, hvor du vil installere Windows.",
        "SagatavotWJ",
        "ivitamisel ilmnes probleem.",
        "0%Rn0",
        "J)H)AD",
        "ia dvs. gestioneaz",
        " informacij",
        "ze %1!s! s chybou po",
        "jakou dobu trvat.",
        "This may take a few minutes.dYou won",
        "Recome",
        "||l||",
        "Verifierar nedladdningen V",
        "r inte att avg",
        "o do Windows Server 2019 para que funcionem. Ap",
        "Datoteka ISO",
        " la cl",
        ".?AVCSetupActivationDlpResponseFactory@@",
        " tentando usar n",
        "CButtonEx",
        "klad flash disk USB, kartu SD nebo extern",
        "t want to use external storage",
        "nda teise salvestuskohta varukoopiad.",
        "nd sunte",
        "#6?IFSS=M ",
        "elite obdr",
        "r for Microsoft-programvare",
        "van av Windows-versionen som ",
        " ste k",
        "vel uma vers",
        "CSetupDialogDownlevelInstall",
        "I0G1-0+",
        "tta installationen av Windows fr",
        "my komputer do stanu bezpo",
        "De download is ongeveer 3 GB. Als u een internetverbinding met een datalimiet hebt, controleert u of hiervoor mogelijk extra kosten in rekening worden gebracht.6Zijn er meer mogelijkheden om de update uit te voeren?",
        "USB k",
        "cuter Windows 10.",
        "i samo 48 znakova.<Vrednost klju",
        "ra om Windows 10 ",
        "ste znova.4Pri s",
        "tre interrompue au cours de cette mise ",
        "o mantidos.BTudo ser",
        "o pode executar o Windows Server 2019rUnitatea pe care ",
        "sti atnaujint",
        " a Windows rendszert.",
        "(Ali ste prepri",
        "nak legal",
        " USB verranno eliminati. Se vuoi mantenere i file, crea una copia di backup e salvali in un altro percorso.",
        "Vi trenger mer plass)%1!d!GB ledig diskplass kreves p",
        "cuter le support pour l",
        ".?AVCSimpleDialog@UX@Common@ConX@@",
        "ama, lai turpin",
        "Czy na pewno chcesz wyj",
        " stron",
        "sek megnyit",
        "Ting du m",
        "inizi ",
        " Windows 10+Cette op",
        "CloseHandle",
        "va 1 znak",
        " e-mailben tal",
        "unalo ne mo",
        "tter installationen af Windows 10 i Windows Update.OKonfigurerer opdatering til Windows 10",
        "tovne in",
        "&KapatAKi",
        "lohujte ich v inom mieste ulo",
        "ne pogodbe.",
        "es do Windows e os arquivos pessoais%Manter somente meus arquivos pessoais",
        " variare) e potrebbero essere applicati costi aggiuntivi per l'accesso a Internet. Clicca su Avanti per scaricare i file di installazione pi",
        "ljande:",
        " essere rimosso al termine dell'installazione%Requisiti completati. Scegli Continua4Scegli un altro dispositivo di archiviazione esterno",
        "n se muestran varias cosas que debes tener en cuenta:",
        "</jgJKj0",
        ";8<U<",
        "e. Revisa la informaci",
        "rz ustawienia magazynu",
        ", diegimo laikmenoje spustel",
        "0f0D0~0Y0L0",
        "i parti",
        "si on Windows 10:n vanhat asennustiedostot. Voimme auttaa sinua hankkimaan uusimmat tiedostot ja siten varmistamaan, ett",
        "To bo trajalo nekaj minut.",
        ", om pc",
        "sti tilaa Windows 10:n asentamisen jatkamiseksi. Yrit",
        "rja be a telep",
        "ate posodobitev.,Sprostite %1!s! v ra",
        "Elige lo que quieres conservar",
        "e. Ponovo unesite onu koju ste kupili na mre",
        "n Windows Update.ZSe configureaz",
        "llningar eftersom du valt att installera %1!s! med ett annat spr",
        " pronto per continuare l'installazione di Windows Server 2019. Prova a riavviare il programma di installazione.zNon ",
        ">,>K>X>`>",
        " to odstr",
        "i seznam pogonov",
        "e ispravno funkcionisati nakon instalacije i mo",
        "ter auf eine DVD brennen.",
        "707@7D7\\7l7p7t7",
        "'Windows ",
        "Palun oodake",
        "recek.",
        "itie ",
        "ries tie",
        "Wybierz obraz, kt",
        ">C>_>",
        "Lai turpin",
        "Architektura nie jest zgodna",
        "RBB1/",
        "StretchBlt",
        "m, a restartujte instalaci.",
        "&Instalare",
        "es, drivers e recursos opcionais (recomendado)",
        " cheie.;Cheia Bitlocker func",
        "Sans ",
        "^ck(W",
        ".?AV?$CDlpResponseImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIActivationActionResponse@@@@@@@@@@",
        "nosti.",
        "rcarea unor fi",
        "d Product Key nefunguje. Sk",
        "Verifying your download",
        " verzi Windows pomoc",
        ".?AV?$CZeroInit@VCSetupResponsSelectMediaFormat@@$00@@",
        "undan bilgisayar",
        "emo u usluzi Windows Update.",
        "Asennus ei hyv",
        "pEr kan niet worden bepaald of de pc gereed is om Windows Server 2019 verder te installeren. Start Setup opnieuw.mEr kan niet worden bepaald of uw pc Windows Server 2019 kan uitvoeren. Sluit Setup af en probeer het opnieuw.1De installatie van Windows Server 2019 is mislukt",
        "_purecall",
        "tter installationen.",
        "200304183039Z",
        "vel encontrar uma pen USB.",
        "Windows 10-updatePUw opslaggebruik kan niet worden geopend. Open Opslag handmatig in Instellingen.>Prullenbak kan niet worden geopend. Open Prullenbak handmatig.`Uw opslaggebruik kan niet worden geopend. Voer %1!s! handmatig uit om Schijfopruiming te openen.",
        "END_SECOND_BOOT",
        "ku navedite tu ",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::GetResultsRoutine",
        " se n",
        " bir dil kullanarak y",
        "1(2K2",
        "acak ",
        " (Edition) ",
        " cheie.;Cheia de produs func",
        "MigChoice",
        "wGerekli olan t",
        "555O5`5",
        "Lecteur flash USB",
        "s ejecutando.\"Error de instalaci",
        "Tu unidad flash USB est",
        " versiune de Windows 10.",
        " (sau s",
        "cej informacji dotycz",
        "Ann&ulla",
        "Criando a m",
        "lp af et andet sprog end det, du bruger i ",
        "sim no vietas, kur p",
        " PC-ul este gata pentru a continua instalarea Windows Server 2019. ",
        "Quieres continuar usando esta selecci",
        ":#;];",
        "{Kahjuks ilmnes probleem Windows 10 valmiduse kontrollimisel teie arvuti jaoks. Sulgege installiprogramm ja proovige uuesti..Windows 10 pole veel selle arvuti jaoks valmis%Veendumine, et installimine on valmis",
        "SizeofResource",
        "ovat%Instalovat syst",
        "n.lDepolama kullan",
        "CInstallUI::GetDefaultLanguage",
        "senia.&Zhrnutie toho, pre ",
        " dabar",
        " Windows 10n",
        "rken l",
        "buj ponownie..Uruchamianie skrypt",
        "zvetlen",
        "ami, vai izmantojiet r",
        "r./In",
        "CheckHotPluggableDriveEx: Drive %c SetupDiEnumDeviceInterfaces Error: 0x%X",
        "%d verbleibende Zeichen,Bindestriche werden automatisch hinzugef",
        "nybe vehet.^A Windows 10 friss",
        "dzu, ierakstiet ISO failu DVD manu",
        "ine doar 48 de caractere digitale.",
        "~0_0o0 ",
        "pne Diskopprydding.",
        "mto vydan",
        "Download den nyeste version af Windows",
        "em PC-ju dovoljno prostora za daljnju instalaciju sustava Windows 10. Poku",
        "Kontrollerer din pc",
        "Finner ikke installasjonsinformasjonen som kreves for ",
        "}P0PA",
        " yapmay",
        "&Avbryt",
        " inform",
        "m souboru setup.exe.",
        "Me ei saa j",
        "eck8^",
        "Ondersteuning",
        ".PBitLocker",
        "Datorn kommer att startas om flera g",
        " instalarea.",
        "mi podmienkami nes",
        "ai besoin d",
        "Usa las opciones recomendadas para este equipo",
        "CSetupResponsePageDiskSpaceReq",
        " Internet ",
        "%d tekens resterend0De koppelstreepjes worden automatisch toegevoegd'De productcode bevat slechts 25 tekens.",
        "z gerekiyor. ",
        "e nie dzia",
        "unalo mo",
        " nastavenie syst",
        "lg en anden ekstern lagerenhed",
        "  &Quero ajudar a melhorar o processo de instala",
        ", nous ne pouvons pas d",
        " tik tuo atveju, jeigu diegiate ",
        "vW[CQ:",
        " ting klar&Dette v",
        "lla dina Windows-inst",
        "zda yeterli alan oldu",
        "ste to znova.`In",
        "X,\"2l",
        "%2!s!%",
        "_rWW'",
        " kilka minut.sNie mogli",
        " ei voitu asentaahTietokone on palautettu tilaan, jossa se oli juuri ennen Windows Server 2019:n asentamisen aloittamista.>Windows Server 2019:n asentamista jatketaan Windows Updatessa.",
        "architecture actuelles.",
        "Installerar Windows Server 2019",
        "%c:<Tu PC se reiniciar",
        " za BitLocker",
        "tte, da Windows ikke kan genstarte computeren. Luk ",
        "=$=0=P=X=d=",
        "n no pudo determinar las opciones de instalaci",
        "hnout nejnov",
        "Protecci",
        "lisan a Let",
        "unalnik. Zaprite Windows Setup in poskusite znova.-Sistem Windows v tem ra",
        "n on jokin seuraavista:",
        "gerpartition",
        " igen.",
        "CII: Niektor",
        "Language:",
        "<(<V<f<t<{<",
        " USB. ",
        "{qzzz",
        "%d caractere r",
        "What do you want to do?",
        "Fichier ISO(S",
        "CSetupResponsePageBitLockerKeyValidate: OnInitDialog",
        "k-e, ",
        "Kas soovite kindlasti v",
        "Updates downloaden We bereiden een paar dingen voor",
        "e zweryfikowa",
        "Valitse, mit",
        "350 MB ",
        "nin verildi",
        " anna kelvollinen avain!Anna tunnisteen BitLocker-avain: )Windows tarvitsee tilaa p",
        "sticas opcionales (recomendado)",
        "ivitysZTallennustilan k",
        "Even kijken wat er moet gebeuren",
        "sta. Zvolte jinou jednotku a zkuste to znova.=V dal",
        "1$2`2x2",
        " ISO) ",
        " cirka 3 GB. Om du anv",
        " se va",
        "ke tokom instalacije operativnog sistema Windows. Proverite da li su instalacioni izvori dostupni i ponovo pokrenite instalaciju.",
        "Sprawdzanie aktualizacji!Sprawdzanie aktualizacji: %1!d!%%",
        "terminer si votre PC peut ex",
        "rsler.",
        "un en son s",
        "einstalaci Windows 102Pot",
        "sma-NO",
        "Windows nu este activat pe acest PC. Aceasta ",
        "nk a friss",
        "o e tente novamente./O Windows 10 ainda n",
        "Nemojte da isklju",
        "cie uveden",
        "ti a g",
        "in in %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml ",
        "Wskaz",
        "@@@PPP@@@",
        "Kaikki on valmista5Windows 10:n asentamista jatketaan Windows Updatessa.ZWindows 10:n p",
        ".%2!s! ",
        "to je USB klju",
        "cia pre Windows 10",
        " alguns minutos.",
        "2)2Y2`2i2",
        "Der Vorgang kann aus einem der folgenden Gr",
        "Segui&nte",
        "fr-MA",
        "n y selecciona Actualizar.",
        "tva. V",
        "or-IN",
        "CSetupResponsePageCompat::UpdateView",
        " sa o chv",
        "ipravujeme p",
        "tani, hogy a sz",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "vat na p",
        "ey daha yapmam",
        "s interes",
        " kullanarak oturum a",
        "}5QM2",
        "BitLockeri kaitse on v",
        "}Q0f0 ",
        "2QX[zz",
        "d gre",
        "s rendszer",
        "0S0n0 ",
        " online para obter atualiza",
        " verziu syst",
        "cie.'In",
        "ReleaseSRWLockShared",
        "Disko skaidinys",
        "tzliche Geb",
        "Mettre ",
        "installation pris en charge par le programme d",
        "ndir#",
        "o0]0n0~0~0J0",
        "=f=u=",
        "d Product Key nefunguje. Skontrolujte ho a sk",
        " pokra",
        "TC@KP",
        "$**/7ddd4FIIOOppQqqqqqpk^",
        " possibile installare Windows 10P",
        "? ?1?A?Q?]?",
        " de Windows 10 sur votre PC en raison d'un espace disque insuffisant. Suivez les instructions ci-dessous pour terminer la mise ",
        "s raitai instal",
        " al elementului media de instalare.",
        " listo para seguir con la instalaci",
        ";J)H)Q",
        "n kald",
        "tta installationen eftersom det inte gick att starta om datorn. St",
        "Komputer zostanie uruchomiony ponownie kilka razy. Mo",
        " possibile eseguire Windows 10 in questo PC",
        "luseade, DVD v",
        "&N_U(u ",
        "USB atmintin",
        "Windows ",
        "BeideoDeze BitLocker-sleutel werkt niet. Controleer de sleutel en probeer het opnieuw, of probeer een andere sleutel.?Uw BitLocker-sleutel werkt! Ga verder als u er klaar voor bent.",
        "CSimpleWizardPage",
        "gl-ES",
        "-lo, pode ignorar este passo. Ativaremos o Windows automaticamente ap",
        "n de nuevo.rPara obtener m",
        " dator",
        "&Finalizar",
        "vel automatikusan megt",
        "@Windows ",
        "unaru (disk jedinica %2!c!:)`Izaberite ili priklju",
        "ave pri ugotavljanju, ali je v va",
        "est pas un caract",
        "imu.NUSB atmintin",
        "uriranje..Oslobodite %1!s! na va",
        "<8<J<[<l<",
        " przerwano. Niestety, p",
        "Dieser BitLocker-Schl",
        "8$8,848@8`8h8p8x8",
        " fortsette installasjonen av Windows. Start installasjonsprogrammet p",
        "wki dotycz",
        "Preostao je 1 znak",
        "l be nem jelentkezik.1Nem siker",
        "CSetupPageMessage",
        "lectionner ou connecter un p",
        " naujo nesuformatuos i",
        "en a telep",
        "HEBREW",
        "yMM@@@@@%%\"\"\"\"!!z",
        "1 Zeichen ",
        "rym przerwano",
        "ncias.ZFalha ao abrir gravador de DVD. Grave manualmente o ficheiro ISO num DVD utilizando %1!s!.",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::ExecuteRoutine",
        "actionString",
        "ku Obnovi",
        " installata una copia attivata di Windows 7 o Windows 8.1. Attiva la tua versione corrente di Windows usando un codice Product Key, quindi seleziona Aggiorna.",
        "s a szabad lemezter",
        "cie pozastaven",
        "ste to znova.,Sp",
        "ifra proizvoda se mo",
        " 'setup.exe'",
        "Nadaljuj tam, kjer sem ostal",
        " &klaviat",
        "INSTALLIMISTEAVE. M",
        "gsQGS",
        "Ayarlar",
        "ncepe.-A",
        "o necess",
        "%d tegn tilbage",
        ".?AVCSizableControl@UX@Common@ConX@@",
        "Aseman valinta/Asennus puhdistaa tietoja ennen sulkeutumistaan$T",
        "GetLocaleInfoEx",
        "tfen Windows",
        "Pokud na tento po",
        "2$2)242?2S2n2",
        "cie pr",
        "erli de",
        "&Reddet>Lisans ko",
        "e bez problema, a mo",
        "Il codice Product Key ha questo formato: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "u mapi",
        "i o cale",
        "Windows 10 u",
        "re opdateringen.$Frig",
        "a4Ovaj klju",
        "%VF;+",
        "Tu PC se reiniciar",
        "o ficar",
        "ivad seadmeti erineda.",
        "1,UEd",
        "re mindst %1!d! GB. V",
        "glicherweise in einem nicht unterst",
        "INFORMACIJE O INSTALACIJI: Neke Windows 10 funkcije zahtevaju napredni hardver; neke postoje",
        "vas vietas disk",
        "urira tijekom razdoblja podr",
        "elite narediti?",
        " nytt, fortsetter vi der vi avsluttet..Denne PC-en kan ikke kj",
        "t instala",
        ".?AV?$CUnknownImpl@VIDlpResponseFactory@@@@",
        "o corresponde",
        "$AAA<",
        "OX[g0M0~0[0",
        " legge til funksjoner i Windows. Den kan ikke brukes til ",
        " naujo t",
        "zt. Ha tov",
        "status",
        "Mamy problemTAby zainstalowa",
        "lit soubor ISO na DVD pozd",
        "charger l",
        "Necesitamos m",
        "owy klucz produktu systemu Windows 10.",
        "k dizininde ",
        "o\\#P\\",
        "rios ou use a Limpeza de Disco para liberar espa",
        "s detta s",
        "v vytvo",
        "mt-MT",
        "Langue",
        "asne zv",
        "@4199795",
        " komentoriviparametreja",
        "A term",
        "m soubor ISO na disk DVD ru",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::GetResultsRoutine",
        "Her er noen ting du m",
        "5-5=5_5t5",
        "n S mode. Alege",
        "unaru. Ako se problem bude i dalje javljao, zatra",
        "Kasutage m",
        "itelja Windows Server posjetite: https://aka.ms/windowsserverupgrade",
        " pre v",
        " versijos atsiuntimas",
        "Disse opdateringer hj",
        "ltiger Befehlszeilenparameter",
        "Besturingssysteem:",
        "cia Windowsu 10RNepodarilo sa otvori",
        "ersiz ",
        "Quest",
        "e li vam to izazvati dodatne tro",
        "Vydanie",
        "Atidaryti",
        "jiet atjaunin",
        "Programme d'installation de Windows 10",
        "|C9t$",
        "onnistui vaiheessa %1!s!, koska toiminnon %2!s! aikana tapahtui virhe",
        "=<=D=P=t=|=",
        "n vaiheen. Windows aktivoidaan automaattisesti, kun asennus on valmis.",
        "\\[\\[\\[[[[[[MQODv",
        "Pode continuar a usar o PC.ROcorreu uma falha na instala",
        "bbra is nyugodtan haszn",
        "~0_0o0%Rn0",
        "niej nagra",
        "ver du ange en Windows 10-produktnyckel.",
        "kas reizes restart",
        "Architectuur komt niet overeen",
        "mi zadan",
        "<I```KKKK|K|KKKKS",
        "koo?;44",
        "g 1 karakter maradt",
        "o do Windows diferente da sua atual.",
        "gle fungerer! Forts",
        ".?AVCProductKeyEdit@UX@Common@ConX@@",
        "t update your PCnThe language or edition of the version of Windows currently installed on your PC isn",
        "my pobra",
        "tta installationen av Windows 10. Prova att starta om installationsprogrammet.`Vi kan inte avg",
        "e ponovo formatirati va",
        "ramaz$Zaten Windows 10",
        "Download3Conserva los archivos personales y las aplicaciones8Conservar configuraci",
        "/@;$@0",
        "ajte s nekim drugim.",
        "ssel.",
        "tai keletas dalyk",
        "exploitation",
        "Unitate flash USB",
        "Supprimez les fichiers dont vous n'avez plus besoin ou lancez l'outil Nettoyage de disque pour lib",
        "ar.:Espere um pouco at",
        "rziu fi",
        "lp af %1!s!.",
        "diegus mes automati",
        " instalacj",
        "Sem Etiqueta",
        "da. P",
        "ete morati unijeti klju",
        "ste to znova.*Windows nie je v tomto po",
        "9AduE",
        "l, aktiv",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::SetResponseName",
        "nliche Dateien und Apps beibehalten#Nur pers",
        "kt no s",
        "Installation de Windows 10[Votre PC va red",
        "Uklonite sljede",
        "ve already taken care of this. Click Refresh to remove it from the list.gWe ran into a problem while trying to take care of this for you. Please refresh the list and try again.",
        ", co zrobi",
        "ynnistyy uudelleen useita kertoja, ja t",
        "etka instaliranja izdanja Windows Server 2019.LInstalaciju izdanja Windows Server 2019 nastavi",
        " Behold personlige filer og apper",
        " olur ve ",
        "8S9`9",
        "list m",
        "pte nov",
        "ni muu draiv ja proovige uuesti.",
        "SystemTimeToTzSpecificLocalTime",
        " Internet, puis r",
        "ltere Version von Windows zu installieren.",
        "tres ne seront pas conserv",
        "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "iadne",
        ".?AV_com_error@@",
        "lectionnez la partition dans laquelle vous voulez installer Windows.",
        "tor nedok",
        "kresurserna*Det gick inte att initiera arbetskatalogen",
        "gbar. Um den Vorgang fortzusetzen, m",
        " actualizare.",
        "installation pourra reprendre..Ce PC ne peut pas ex",
        "o do Windows 10.",
        "Installa Windows 10",
        "i upgrade de la Windows 7 sau Windows 8.1. sau reinstala",
        "Windows no est",
        "qps-plocm",
        " %2!s! voln",
        " tietokoneessa Tietokoneessasi on jo Windows 10",
        "Host OS version: %u.%u.%u.%u %s (%hu.%hu) Platform 0x%X, SuiteMask 0x%hX, ProdType 0x%hX",
        " prozkoumejte sv",
        "  &Chcem pom",
        "tenja alata",
        "cii vo va",
        "##'638",
        "t$<WP",
        "nosti za ovaj PC",
        "e utvrditi koju verziju sustava Windows koristite.+Instalacija sustava Windows 10 nije uspjela",
        "\\(W`O{vU_0R ",
        ", tarkasta, aiheuttaako t",
        " informace najdete v n",
        "Sekretesspolicy",
        "/Os travess",
        "\"Mantieni i file personali e le app",
        " naujo paleisti kompiuterio. U",
        "Jei ketinate naujinti versij",
        "e li PC pokrenuti Windows Server 2019. Zatvorite postavljanje i poku",
        "RegOpenKeyExW",
        "re i S-tilstand.>USB-flashdrevet skal v",
        "rations suivantes :",
        "arm64",
        " utiliser votre PC.",
        "Datora p",
        "  &Jag vill hj",
        "lg, hvad du vil bevare",
        "dhasson.bA Bitlocker-kulcs form",
        "ana, un t",
        "10 produkta atsl",
        "e biti potrebno nekoliko trenutaka da provjerimo je li ono ",
        "rende versjonen av Windows med en produktn",
        "Termenii licen",
        ">,>0>H>X>h>x>|>",
        "Liko 1 simbolis",
        "i je Windows 10 pripraven",
        "000   ",
        "t Windows",
        "ffnen Sie Ihren Downloads-Ordner manuell.pDer DVD-Brenner konnte nicht ge",
        "m se bohu",
        "ja val",
        "Microsoft Time-Stamp PCA 2010",
        " kompiuterio b",
        "Nije mogu",
        "ni minut.",
        "t, mit",
        "sleduj",
        "<%===c=",
        "n. Para conservar estos archivos, realice una copia de seguridad en estos momentos en otra ubicaci",
        "hren anfallen.3Welche anderen Updateoptionen stehen zur Verf",
        "Koristite spoljni ure",
        "pa-IN",
        "Ei otsikkoa",
        "du: 0x%1!lX! ",
        "Espere um pouco",
        "n de Windows 10 se configurar",
        "%s non ",
        ":M:S:o:y:~:",
        "skajte aktualiz",
        "Valitse kieli, arkkitehtuuri ja versio",
        "emiet lielus vai neizmantotus failus no mapes Lejupiel",
        "lygomis, i",
        "CBitmapDialog",
        "Instalar o Windows 100Obter atualiza",
        "!Reinstalez Windows 10 pe acest PC.Trebuie s",
        "S%&_7",
        "ilo nainstalovatkNastavili jsme v",
        "mogatott k",
        " proizvoda",
        "tkame Windows 10 installimist Windows Update",
        " impedindo a instala",
        "LoadLibraryW",
        "SetUnhandledExceptionFilter",
        ". Izberite drug pogon.",
        "~A[[;mmm5",
        "klemeye haz",
        "jo ier",
        "7(828",
        "ile nemoteno namestitev in lahko vklju",
        "r du er klar.",
        "tartovan",
        " forneceu n",
        "Vi kan ikke installere de nyeste funktioner og sikkerhedsforbedringer i Windows 10 p",
        "du per",
        "o de ArmazenamentocExplore manualmente a utiliza",
        " kertaa, sinun on annettava kelvollinen Windows 10 -tuoteavain.",
        "t able to download all the necessary files. Make sure that you",
        "Om du installerar Windows 10 p",
        "=,=X=",
        "lp til Installation, eller du kan k",
        "5kVcv",
        " reiniciando el equipo para continuar con la instalaci",
        "Link de site",
        "Ne kapcsolja ki a sz",
        "ali ove datoteke, odmah napravite njihove rezervne kopije na drugoj lokaciji za ",
        "t install Windows Server 2019aWe",
        "BWindows ",
        "unaru nije mogu",
        "ges f",
        "Saugyklos naudojimashRankiniu b",
        "6Windows 10",
        "X0~0Y0",
        "o manter nada",
        "ncerca din nou.UInstalare nu a ini",
        "Last ned oppdateringer, drivere og valgfrie funksjoner (anbefales)",
        "ky. Vybrat extern",
        "es mais tarde./A configura",
        "Espere7Hubo un problema al ejecutar scripts de preinstall.cmd.6Hubo un problema al ejecutar scripts de precommit.cmd.",
        "m~/1{`",
        "O(ug0M0~0[0",
        ".'Preinstall.cmd ",
        ":Notiek gatavo",
        "2 2x2",
        " k instala",
        ".text",
        "Windows Server 2019",
        "6Preparing to download the latest version of Windows 10",
        "o;mS_MR",
        "n de Windows 10",
        "etka instaliranja sustava Windows 10.",
        "en eine Bereinigung durch.)Der Vorgang kann ein paar Minuten dauern.`Schlie",
        "o do Windows atualmente instalada no seu PC n",
        "Comprobando esta clave(Esta clave no funciona. Prueba con otra.",
        "vesse az al",
        ", introduce",
        "IsWow64Process",
        "installation ne peut pas continuer, car Windows ne peut pas red",
        "y wzi",
        "dition de Windows que vous installez est diff",
        "bW0f0O0`0U0D0",
        "hoz.=Szabad",
        "moire flash est pr",
        "lmayan dosyalar",
        "Nk0TS",
        " PC. Zatvorite Postavljanje i poku",
        "&Instaliraj",
        "ber toho, ",
        "ia scripturilor preinstall.cmd.;A ap",
        "iniet uz Setup.exe.sNevaram noteikt, vai j",
        "s recientes para asegurarte de que se instale la versi",
        "ra diegimo laikmenoje.",
        "Computer",
        "Microsoft Corporation1200",
        "erli bir Windows 10 ",
        " Behold personlige filer og apper0Behold Windows-innstillinger og personlige filer",
        "nak telep",
        "Ambos\\Esta clave de BitLocker no funcion",
        "si o unitate flash USB.",
        "rskenduste toomine",
        "uriranje?",
        "acWKKkW}",
        "&Lukk Windows 10 kan ikke installeres.WPCen er tilbakestilt til slik den var like f",
        "lni k",
        "= =8=",
        "Beveik parengta",
        "sms-FI",
        "ierele, aplica",
        "n de Windows que es diferente de la que usas actualmente.",
        "re, om computeren har nok plads til at forts",
        "0F0k0j0",
        "Disk B",
        "cS_MR",
        "wCU+Gg",
        "e aplikacije i postavke bit ",
        "r du startet installasjonen av Windows Server 2019.BInstallasjonen av Windows Server 2019 fortsetter i Windows Update.",
        "cia pre Windows 10 ,",
        "ErrorState",
        "j komputer po instalacji mo",
        "Hjelp",
        "Spikker",
        "klemeye devam etmemiz i",
        "Lisez attentivement ceci avant de l",
        "Preostao je jedan znak.Klju",
        " prostriedky8In",
        "ajte ponovo da pokrenete instalaciju.",
        " reinstala",
        "<W<]=",
        "ERROR",
        "rkekood: 0x%x]-Windowsi installimisel ilmnes ootamatu t",
        "q$x8c`",
        "Instaliranje sustava Windows 10=Preuzmite a",
        ": %d%%",
        "2%242:2A2",
        "GetTimeZoneInformation",
        "***++++++,0",
        "aLa unidad que intentas usar est",
        "nta medan avinstallationen av appen slutf",
        "ar-YE",
        "%s GBN",
        "anakUSB disk",
        "rgu kaudu.",
        "tkuvad, andke klienditoele teada t",
        "Tikrinamas j",
        ",Nepodarilo sa nain",
        "- Windows Update.>",
        "dition de Windows",
        "vel instalar os aprimoramentos de seguran",
        "Ingen etikett",
        " pochi minuti.",
        "teignez pas votre ordinateur",
        "ndas f",
        " esistenti sono state modificate o rimosse. Windows 10 viene aggiornato automaticamente durante il periodo di supporto, che pu",
        "8,9j9",
        "lj ett USB-flashminne|Filerna p",
        " Nechci pou",
        "Operativsystem:",
        "trznego, takiego jak pami",
        "RtlSubscribeWnfStateChangeNotification",
        "es agora, seu computador poder",
        "I&nstalla",
        "RegCloseKey",
        " do inej oblasti a",
        "r jednotky0Instala",
        "ljuma installiprogrammist, Windowsi aktiveerima ja seej",
        " verificato un problema durante il download di alcuni file",
        " atkreipti d",
        "WWWWW~UUL",
        "%d%% conclu",
        "ju. L",
        "%3!s!$Reiniciando Instala",
        "%d tekens resterend",
        " cheie Bitlocker nu a func",
        "s inform",
        "aide du programme d",
        "Du kj",
        "CSetupResponsePageBitLockerKeyValidate: OnSetCursor",
        "Kontroluje sa k",
        "*Utiliza",
        "3*4:4[4p4",
        "tuma ehhez hasonl",
        "2019#Installation de Windows Server",
        "Vent littBDet oppstod et problem under kj",
        " suunnilleen t",
        "rskenduste otsimine: %1!d!%%",
        "1 tecken kvar",
        "r nap",
        "rification du t",
        "CSetupResponseTemplate<class ICompatActionResponse>::GetResultsRoutine",
        "Vyberte USB flash diskeSoubory, kter",
        "te du DVD ou dans le courriel que vous avez re",
        "%1!s! %2!s!*Pri ustvarjanju medija je pri",
        "anas, j",
        "q%07~=",
        "zh-Hant",
        "La clave de producto debe estar en la caja que inclu",
        "Estamos preparando algumas coisas",
        "Lietas, kas j",
        "si ja sulje sovellukset ennen asentamista.6Odota, kunnes sovelluksen asennuksen poisto on valmis.",
        "gd-GB",
        "1 character left.",
        " proizvoda sastoji se od samo 48 znakova.=Grupna vrijednost klju",
        "Der Product Key sieht ungef",
        "Verificando seu download",
        "mu programu se nepovedlo ur",
        "unalnik (ali boste namestili drugo izdajo), boste potrebovali klju",
        "e sa l",
        "nea de comandos no v",
        "Ouvrir le graveur de DVD",
        "<,<6<L<i<}<",
        "Zadajte k",
        "o suficiente dispon",
        "llapot",
        "emo da vam pomognemo da preuzmete najnovije datoteke kako biste bili uvereni da ste instalirali najnoviju verziju operativnog sistema Windows 10.",
        "10 jaun",
        "2QX[@S]",
        "@@@@@@@@@@@@000",
        "lj spr",
        "Il programma di installazione non ",
        "s hivatkozzon a hibak",
        "Baixar a vers",
        "dami ",
        "Operacijski sustav:",
        " failure.cmd.",
        " disco rigido durante l'installazione degli aggiornamenti. Windows non eseguir",
        "o e manter suas configura",
        "isi olla DVD-levyn kotelossa tai saamassasi vahvistusviestiss",
        "v igen, eller pr",
        "~Vi kan inte avg",
        "tkata, sest arvutit ei saa taask",
        "adavky byly spln",
        " izdelka ima le 25 znakov.",
        "n porque la versi",
        "i stahov",
        " di aggiornamenti: %1!d!%%/L'operazione potrebbe richiedere alcuni minuti.",
        "en.KInstallationen mislykkedes i fasen %1!s! med en fejl under handlingen %2!s!",
        "Neveljaven ID pogovornega okna#Nismo mogli najti licen",
        " cuando inicies sesi",
        " systemu Windows Server 2019hPrzywr",
        "Izveidot instal",
        "te u postavkama.HOtvaranje korpe za otpatke nije uspelo. Ru",
        "Latauksen koko on noin kolme gigatavua. Jos k",
        "3 3$3,3D3H3`3p3t3",
        "steemi Windows 10 ei saanud installidaHSeadsime teie arvuti olekusse, mis sel oli enne Windows 10 installimist.",
        "st, amikor k",
        " ejecutando y reinicia el equipo. Se continuar",
        " kest",
        "Nem egyeznek a kiad",
        "SpeichernutzungzInformieren Sie sich in den Einstellungen manuell ",
        "Pas maintenant",
        " nain",
        "emiet failus, kas vairs nav nepiecie",
        " diegimas",
        "NLL`ff",
        "hrt vor dem Schlie",
        "8B8n8",
        "Ne tagad",
        "ajke Windows Update.YKonfiguriranje a",
        "Tienes que tener en cuenta lo siguiente:",
        "ks-Arab",
        "to valja obratiti pozornost",
        ": %1!s!)",
        " program znovu.",
        ".idata$4",
        "est pas encore pr",
        "%hs: IOleInPlaceActiveObject::TranslateAccelerator failed. HRESULT = 0x%08x",
        "en-GB",
        "lne pou",
        " precommit.cmd%",
        "Izdaja",
        "glen for id",
        "rxSU33S",
        "Cance&lar",
        " \"%c\".",
        "<S<v<",
        "el-GR",
        " Bitlocker ne contient que 48 caract",
        "D$8h(",
        "To lahko traja nekaj minut.",
        "=yE$-",
        "re vos param",
        "re setup.exe /? i rotkatalogen p",
        "ko-KR",
        "Ase&nna",
        "?what@exception@@UBEPBDXZ",
        "es-PE",
        "4.474I4P4Y4c4x4",
        "A configura",
        " Microsoft Corporation. Kaikki oikeudet pid",
        " zachowane.JWszystko zostanie usuni",
        "cretsiz g",
        "s listo.",
        "vny k",
        "9(9D9\\9t9",
        "i nimic",
        "0Termes du contrat de licence logiciel Microsoft",
        "88638/>>6>68666",
        "Entrer la cl",
        "Client",
        ":b'^^!",
        "o as outras op",
        "$$$*8",
        "installation de Windows 10.",
        "Use an external device such as a USB key, SD card, or external hard drive to temporarily extend your hard drive while the updates are being installed. Windows will not reformat your external storage device, and you can remove it after installation is complete.%Requirements Complete! Press Continue*Choose a different external storage device",
        "ber Ihre Speichernutzung, um andere umfangreiche Elemente zu entfernen.%Externe Speichervorrichtung ausw",
        "Windows 10 installieren/Updates, Treiber und optionale Features abrufen",
        "_CxxThrowException",
        "verstiga 4 GB (kan variera) och Internetavgifter kan tillkomma. Klicka p",
        " ou achetez-en une autre.",
        "$$$$$$$$'",
        "i introdus-o nu este disponibil",
        " system Windows 10, kliknij plik Setup.exe na no",
        "nales el c",
        "undan emin olunuyor",
        " %2!c!:-stasjonen.",
        " %1!d! ",
        "%1!d!%% dokon",
        "anas programmu.pLai ieg",
        "onnistui. Avaa ladattujen tiedostojen kansio manuaalisesti.tTallentavan DVD-aseman avaaminen ep",
        "bor ISO) pre in",
        "%hs: Failed to open 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion'. Error = %d",
        " reporni",
        "n+Voit muuttaa Windowsin asetuksia my",
        "mmis, mille soovite installida.",
        "b-Nk0OUL",
        "ste n",
        "fr-ML",
        ", na co wyra",
        "NW0f0",
        "Licencszerz",
        " kullanmak i",
        "7$7<7@7X7h7l7|7",
        "lreiz.8Oper",
        "-Nn0Y0y0f0n0",
        "X{[go",
        "Dette kan ta en liten stund.VKoble til PCen for ",
        ". %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml",
        "OD0W0~0Y0",
        "lemi s",
        "pen a Windows Server 2019 telep",
        ">4?u?",
        "0?B$@0",
        "rias vezes. Este processo pode levar algum tempo.",
        "&Tastatur",
        "Irdkandjad",
        "lo do te",
        "MolemmatOBitLocker-avain ei toimi. Tarkista se ja yrit",
        "lida. Verifique-a e volte a tentar ou experimente uma chave diferente.QA sua chave de produto (Product Key) ",
        "#Windows Server 2019 ",
        "e zavrnete licen",
        "-Nk0OUL",
        ";[<t<F=x=",
        "bck(Wdk",
        "ete da instalirate najnovije Windows 10 funkcije i pobolj",
        ".?AV?$CZeroInit@VCSetupResponsePageDU@@$00@@",
        "o do Windows ainda melhor",
        "gbar ist. Geben Sie unten Speicherplatz frei, und w",
        " verziuK dispozici je nov",
        ".?AVCFont@@",
        "en0MRk0",
        "t sader",
        " todo, incluidos los archivos, las aplicaciones y la configuraci",
        "tte. Gennemse oplysningerne i %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml for at l",
        "chten",
        "ImageName",
        "kausta l",
        "i din nou instalarea.rPentru mai multe informa",
        "ljaji bodo dodani samodejno:Namestitveni program ni uspel nalo",
        ".rdata$T$brc",
        "CWebBrowser",
        "Imposs",
        " reiniciando o computador para continuar a instala",
        "o pode executar o Windows 10$Voc",
        "yorsunuz",
        "m Windows nem",
        "~~vkkg",
        "s de 4",
        "o0]0n0",
        "ijmout",
        " girmeniz gerekmez.",
        "ra setup.exe /? i rotkatalogen f",
        "ltere Installationsdateien verwenden",
        "nosti Microsoft!Ochrana osobn",
        "rankai nepavyko nustatyti palaikom",
        "v a te",
        "ndningen. ",
        "OutputDebugStringW",
        " na namestitvenem mediju.",
        "Ne dabar",
        "Ekstern lagringsenhet",
        "Updates werden gesucht%Es wird nach Updates gesucht: %1!d!%%'Der Vorgang kann einige Minuten dauern.",
        "Kehtetu dialoogi ID Me ei leidnud litsentsilepingut.",
        " podobn",
        "&KeeldunDKui te litsentsitingimustega ei n",
        "Selecione um caminho",
        "uvajte i zatvorite datoteke pre nego ",
        "e se nekoliko puta ponovo pokrenuti. To mo",
        ", notamment les fichiers, applications et param",
        "Llededxw",
        "rio reinstalar alguns recursos e idiomas opcionais.",
        ".@Windows 10 ",
        "cych uaktualniania systemu Windows Server, odwied",
        "eQ`O(W",
        "De productcode ziet er als volgt uit: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "lkozzon ",
        "o mais recente do Windows 10.",
        "0ckW0D0",
        "ljaanne pole praegusele keelele ja arhitektuurile saadaval.",
        "Asennus puhdistaa tietoja ennen sulkeutumistaan",
        "Naujinimai pritaikyti",
        "&Befejez",
        "t Windows 10 jaun",
        " hai scelto di installare %1!s! in una lingua diversa da quella in uso.|Non puoi mantenere i file, le app e le impostazioni perch",
        "anja na PC-ju zbog nedostatka prostora na disku. Oslobodite prostor u nastavku, a zatim odaberite gumb Osvje",
        "sa br",
        "Provjeravanje PC-ja",
        " Microsoft",
        "ilita ainult minu isiklikud failid",
        "4Reiniciando el programa de instalaci",
        "ger at bruge. V",
        "so-SO",
        "rez %1!s! sur votre PC (lecteur %2!c!:)XS",
        " nytt for ",
        " pronto para este computador",
        "3=3sh",
        "CheckHotPluggableDriveEx: Drive %c Unable to query device number for %s Error: 0x%X",
        "r inte att hitta n",
        "tme kontrollimine,See v",
        " ceci",
        " de produit Windows",
        "na zachowa",
        "ndrats eller tagits bort; Windows 10 uppdateras automatiskt under supportperioden; supporten kan variera beroende p",
        " tietokonettasi varten. Sulje asennusohjelma ja yrit",
        "ico sistema Windows",
        ": 0x%x]&",
        "r %1!s! manuelt for ",
        "o mantidos.DTudo ser",
        " kitoje vietoje.",
        "EVypr",
        " soubory, kter",
        "   PPP",
        "Upgradovat tento po",
        "tfen kontrol edip yeniden deneyin veya farkl",
        "0@1M1p1",
        ".\"Nejsou dostupn",
        "r produktnyckeln f",
        "llaiselta: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX4BitLocker-avaimessa on vain 48 digitaalista merkki",
        "PPP@@@@@@@@@PPP",
        "system32\\cleanmgr.exe",
        "iu liber pe disc necesar pe (%2!s!)|Elimina",
        "n linia de comand",
        "041004B0",
        "stos failus.",
        "StarterN",
        "jlok elt",
        "Bitlocker",
        ">T>o>",
        " k internetu, a sk",
        "o para saber o que est",
        "ga nedarbojas. P",
        "!kn0\\OmiL0",
        "ih varnostnih izbolj",
        "Your files, apps, and settings can't be kept because you're installing an edition of Windows that's different than the one you're currently using.",
        "ga vai licence, lai p",
        " Medya Olu",
        " cheie de produs se poate utiliza numai pentru a ad",
        "Ava DVD-kirjuti",
        "Jei ketinate ",
        "rifier si ce que vous souhaitez conserver est compatible avec Windows 10.",
        "Udgaverne stemmer ikke overens",
        "tes.tWindows instal",
        "ber t",
        "kr-Latn-NG",
        "Filene, appene og innstillingene kan ikke beholdes fordi du har valgt ",
        "rgmine: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "installez Windows 10, vous ne devez pas entrer de cl",
        "n nuevamente.",
        "istiedosto",
        "elite zadr",
        "igi failide allalaadimiseks Internetiga ",
        "rifier et essayer ",
        "k, arkitektur och utg",
        " rzeczy, kt",
        "chargement de la derni",
        " vom spune c",
        "Algo est",
        "1+252f2",
        "i versiunea curent",
        " ukladacie zariadenie s vo",
        "4'5x5",
        "%s GB/",
        ", pokra",
        ")Microsoft Root Certificate Authority 20100",
        "Csak a szem",
        "Lo que requiere su atenci",
        "ID dialog nevalid",
        "sq-AL",
        "Bu anahtar denetleniyor1Bu anahtar ",
        "=A=o=}=",
        "ho miesta v po",
        "bn Papirkurv",
        "il pr",
        "ajte s drugim klju",
        " att du f",
        "SelectedDriveLetter",
        "Es konnten nicht alle erforderlichen Dateien heruntergeladen werden. Stellen Sie sicher, dass eine Internetverbindung besteht, und f",
        "van av Windows. F",
        "su faili tiks saglab",
        "diegta ir suaktyvinta sistema ",
        " stato ripristinato lo stato del PC precedente all'installazione di Windows 10.",
        "```@@@@@@@@@@@@@@@@@@",
        "ana neizdev",
        "pnie spr",
        "n mukaan laskutettavaa yhteytt",
        "ni pogoji za Microsoftovo programsko opremo",
        "psake nuppu Edasi.",
        "atwiona. Kliknij przycisk Od",
        "kkulcs csak 48 karakterb",
        "Ievadiet Bitlocker atsl",
        "enodTaj klju",
        " vil vi hjelpe deg med ",
        "r plass, og pr",
        " Internet peut engendrer des frais. Cliquez sur Suivant pour t",
        "latman",
        " galima tik tuomet, jei kompiuteryje yra ",
        " poprawny klucz5Wprowad",
        "elite da instalirate Windows 10 na drugoj particiji, potrebno je da kreirate medijum, a zatim da ga pokrenete kako biste obavili instalaciju.(Slobodno nastavite da koristite ra",
        "r vi f",
        "n care a fost livrat DVD-ul Windows sau ",
        "%1!d!%% voltooidcDeze productcode is onjuist. Controleer de code en probeer het opnieuw, of probeer een andere code.7De productcode werkt. U kunt doorgaan als u zover bent.",
        "labilir se",
        ". Instalace Windows bude automaticky pokra",
        "sEi ole varmaa, voiko tietokone jatkaa Windows Server 2019:n asentamista. Yrit",
        "edenemine",
        "Nu am reu",
        "glen indeholder kun 25 tegn.8N",
        "Almost ready",
        "CInstallUI::CreateResponsePage",
        " utiliser",
        "lida.",
        "v2j X",
        " Windows a potom in",
        "n de scripts de implementaci",
        "n.rPara obtener m",
        "Etiket Yok",
        "henduse, aktiveerime Windowsi teie eest. ",
        "Det skal du g",
        "CInstallUI::CInstallUIMessageWindow::SwitchToProgressPage",
        "o de armazenamento. Execute manualmente %1!s! para abrir a limpeza do disco.",
        "sitsi uurida.",
        "Pogon USB",
        "~Nepodarilo sa n",
        " yer a",
        "un eski y",
        "re having trouble determining if Windows Server 2019 is ready for your PC yet. Please close Setup and try again.\"Windows isn",
        "Ready to install",
        "888#ZZ[kggh",
        "8J<gj",
        "6 6$6(6,60686P6T6l6|6",
        "ajte ponovno pokrenuti instalacijski program.0Provjera ima li na va",
        "mu Windows 10",
        ".PAVCException@@",
        " na dysku jest za ma",
        "Comenzar desde el principio",
        "Avem nevoie de mai mult spa",
        "espace disponible. Choisissez un autre lecteur et r",
        "Atnaujinti disk",
        "Recherche de mises ",
        ", Instalator systemu Windows Server 2019 musi zosta",
        " ei ole saatavilla",
        "lt futtatni az eszk",
        "sait, mert a Windows m",
        "eibU\\lx",
        "[OK] ",
        "i manual %1!s! pentru a deschide Cur",
        ".Conditions de la licence de logiciel Microsoft$",
        "lgende krever tilsyn for at installasjonen skal fortsette, og for at du skal kunne beholde Windows-innstillingene, personlige filer og programmer.<F",
        "gle.5Din bitlockern",
        "e to n",
        "kom a uve",
        "Taal, architectuur en versie selecteren",
        " quase",
        "ry chcesz zainstalowa",
        "n no pudo validar la clave de productoTEl programa de instalaci",
        "delmi nyilatkozata",
        "RpcStringFreeW",
        "kos failus, lai j",
        "Fortsett gjerne ",
        "AcquireSRWLockShared",
        "*)rb3",
        "rbaude@Atsl",
        "A Windows 10-re t",
        "040D04B0",
        "MessageBoxW",
        "a do Windows 10 para ativar o Windows 10 ap",
        "rel uuesti installiprogrammi k",
        "r kompatibilitet",
        " asemaluettelo+Vapaata tilaa tarvitaan v",
        "ti ei sobi. Proovige m",
        "Ne mo",
        "Utilisation du stockagetExplorez manuellement votre utilisation du stockage dans les param",
        "||~^|vv",
        "emo da utvrdimo da li ra",
        "We couldn",
        "6$646D6H6X6h6x6|6",
        "Ricomincia dall'inizio",
        "ajte ponovno.6Pojavio se problem prilikom preuzimanja nekih datoteka",
        "The product key only contains 48 characters.9",
        "is kodasA",
        ", incluant les fichiers, les applications et les param",
        "zda devam edecek. Verilerinizi korumak i",
        "GetCurrentProcess",
        "no:DDD ",
        "Entrar como administradorePara usar essa ferramenta, voc",
        "P.W099",
        "r inte att forts",
        "(%1!c!:) - %2!s! ledigt",
        "ite datoteke, aplikacije i postavke jer ne instalirate isto izdanje operativnog sistema Windows koje trenutno koristite.",
        " tas bija, pirms s",
        "guJUzst",
        "tani, hogy a g",
        "6#727",
        " prad",
        "0)R(ug0M0~0Y0",
        "ei, ve",
        "r vi er f",
        "imist",
        "Pripravujeme v",
        "steemi Windows 10 saab teie arvutis k",
        "Arhitectur",
        "Z_hn{}Q",
        "i termenii licen",
        "as min",
        "nnen._Der BitLocker sieht etwa wie folgt aus: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX8Der BitLocker-Schl",
        "ao nam je, imamo problema da utvrdimo da li je Windows Server 2019 ve",
        "ar|O download tem quase 3 GB. Se voc",
        "es, consulte a Ajuda da Configura",
        "CallContext:[%hs] ",
        " sa va",
        "czaj komputera{Aby kontynuowa",
        "n de Windows",
        "<?xpacket begin=\"",
        "elite nastaviti s instalacijom i zadr",
        "WA`hh",
        "s lehet",
        "z.9Wv",
        "bala e int",
        "ji zadat znovu.7Instala",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::Execute",
        "klemek istiyorsan",
        ".?AVCBrush@@",
        "#Windows 10",
        "strate, pentru c",
        "marrer pour qu",
        "e trajati nekoliko minuta.",
        "Hbg&~",
        "%1!ld!%% fuldf",
        "n.'Windows Server 2019:",
        "o e tente novamente.+O Windows n",
        "Voortgang: %1!d!%%8Selecteer een van de beschikbare opties om door te gaan.",
        "rbaudiet, vai tas nerad",
        "l v re",
        "e Windows name",
        "kleyemedikXBilgisayar",
        " estar instalada num diret",
        "&6o9{!-",
        ". Upozorn",
        "unar (ili instalirate neko drugo izdanje), potrebna vam je ",
        "lectionner la langue, l'architecture et l'",
        "rt a Windows telep",
        "lemez",
        "s de la instalaci",
        "\"\", ,',\"!",
        "re chcesz zachowa",
        "bbi probl",
        "rer scripts til udrulning af precommit.cmd*K",
        ".rdata$sxdata",
        "tti tudnival",
        "\"/@T)",
        " Windows 109",
        "anai Windows. To nevar izmantot sist",
        " gerekiyor. Yeniden ba",
        "bbi k",
        "netici hesab",
        " er du klar.<Vi forts",
        "PapierkorbPLeeren Sie den Papierkorb, um gel",
        "ekivana pogre",
        "cia Windowsu 10",
        "Jos suoritat versiop",
        " chave de produto que introduziu n",
        " USB-enheten kommer att tas bort. Om du vill beh",
        ".?AVCLinkButton@UX@Common@ConX@@",
        "UE~n]",
        " resolveu esta quest",
        "Instalacija je spremna",
        "dkek_",
        "ie mo",
        "Ugyldigt dialogboks-id\"Vi kunne ikke finde licensaftalen.",
        "unar da bi se nastavila instalacija.",
        "Mer utrymme beh",
        "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6",
        "tirme yapmak i",
        "0j0O0 ",
        " compatibilitatea",
        "buj ponownie.7Instalacja systemu Windows Server 2019 nie powiod",
        " Internet e tente executar a ferramenta novamente./Ocorreu um problema ao executar esta ferramenta",
        "o do Windows. Reinicie a Instala",
        "Semmit sem sz",
        "t abweichen.",
        "%Microsoft Windows Production PCA 20110",
        "ib veidi aega v",
        "tkamiseks kohast, kus see pooleli j",
        "liau ",
        "rast installimise l",
        "e zastosowa",
        "t produkta atsl",
        "anas programma nevar noteikt, k",
        "EtwEventUnregister",
        "0O0J0",
        "Preparing %d%%",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::Suspend",
        "LOOW<",
        "D$ SV3",
        "i u besprijekornom odvijanju instaliranja, a mogu uklju",
        " komputera.PInstalacja nie powiod",
        "CreateMutexExW",
        "nite zo zoznamu.hPo",
        "0,0u0",
        "Do not turn off your computer~The following things need your attention to continue the installation and keep your Windows settings, personal files and apps.FThe following things need your attention to continue the installation.]The bit locker looks similar to this: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX7The bit locker key only contains 48 digital characters.",
        "ENABLE_FEATURE",
        "97G998989",
        "_La unidad que intentas usar est",
        ".1Nous n",
        "o da aplica",
        "0S0h0",
        "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0",
        "g. Szabad",
        "hoz k",
        "s. Atidarykite ",
        "ste vara minst %1!d! GB. V",
        "Malgun Gothic",
        "re ready7We",
        "ny spos",
        "L0ck8^k0_j",
        "ciu, aktivova",
        "nder en anslutning med datapriser kan det leda till extra avgifter.)Vilka andra uppdateringsalternativ finns?",
        "enite namestitveni program.|Namestitveni program ni mogel za",
        "istenie disku na uvo",
        "zA unidade que voc",
        "sob s",
        "i gata de instalare",
        "tta med installationen.",
        "CSetupResponsePageDiskPartition::OnInitDialog",
        ")CEn az %1!s! bo",
        "kas neleid",
        "jabb verzi",
        "[Error Code: 0x%x]5Windows installation encountered an unexpected error.",
        "sitsi.SDVD-kirjuti avamine nurjus. Kirjutage ISO-fail k",
        "ShouldSuspendBitlocker",
        "i kutuda veya e-posta al",
        "n0]0p0",
        "ivitama.EInstallikandja loomise t",
        " ting f",
        " jour disponible",
        " programoje ",
        " na internet v",
        "r vissa Windows 10-funktioner kr",
        ")TufdddF|",
        "ne so druge mo",
        "n no est",
        "V3[:SG^&",
        "s atsisi",
        "<<=C=",
        " angi Windows 10-produktn",
        "o podem ser mantidos porque voc",
        "ciju, skatiet uzst",
        "[%hs]",
        "ajte ponovo.3Instalacija izdanja Windows Server 2019 nije uspela(Instaliranje izdanja Windows Server 2019",
        "Namesti %s>Windows znova zaganja ra",
        "0\"1F1P1]1j1",
        "r verktyget.",
        "dition de Windows qui correspond ",
        " nem tudta inicializ",
        "9%909E9P9i9s90:C:V:i:",
        "s az elej",
        "Nous ne pouvons pas pour l'instant d",
        " aktualizac",
        "&Fine",
        "CRtfHelpDialog",
        "N,g!k",
        "3 3,383D3P3\\3h3t3",
        "6IXYYXXAFC=:",
        "Bitte warten",
        "tteperioden. St",
        "O_U(u ",
        "GetSystemMenu",
        "g a friss",
        "ekajte da se instalacijski program zatvori&To bi moglo potrajati nekoliko minuta.jTijekom instalacije sustava Windows ne",
        "anje sistema Windows Server 2019",
        "Er is een nieuwere versie van dit hulpprogramma beschikbaar. U moet de meest recente versie downloaden en uitvoeren om door te gaan.?Download het bijgewerkte hulpprogramma voor het maken van media",
        "kingstips",
        ", DVD",
        "n y vuelve a intentarlo.%Error al instalar Windows Server 2019\"Instalaci",
        "du laiku.BL",
        "bu. Kad instal",
        "BitLockerKeyValidate",
        "in gereken y",
        "Your USB flash drive is ready",
        "lo je do neo",
        " kapsayabilir. Bu g",
        "s tov",
        "041604B0",
        "+Last ned den nyeste versjonen av Windows 10",
        "zca Windows",
        "t), Windows 10-es term",
        "0W0f0",
        "Klar att installera",
        "Otvori postavke skladi",
        "nde nicht fortgesetzt werden:",
        ".data$r$brc",
        "7(747@7L7X7d7p7|7",
        "avez plus besoin ou utilisez le nettoyage de disque pour lib",
        "ch. Pokud si te",
        "utujeme, ale nedok",
        "ujete ra",
        "Elementy wymagaj",
        "ratlan hib",
        "Prihv&a",
        "iras no pa",
        "Kuriama ",
        " fechada automaticamente em %1!d! minutos.&O que voc",
        " problemy, skontaktuj si",
        " eseguire Windows 10. Chiudi il programma di installazione e riprova.",
        " arba pakartotinai ",
        "t izmantot, nav pietiekami daudz vietas. Izv",
        " ripristinata dopo che avrai eseguito l'accesso a Windows Server 2019. Per garantire la protezione dei dati, ",
        "yi-001",
        " a dokon",
        "im Windows izdevumam. M",
        "gung?",
        "g a telep",
        "MapViewOfFile",
        "t. Ellen",
        "Czekaj",
        "u&QQhG",
        ">?>F>L>Q>\\>f>k>",
        "Supprimez les fichiers dont vous n",
        "ve set your PC back to the way it was right before you started installing Windows 10.",
        "VerSetConditionMask",
        "re version de Windows 10#Cela peut prendre quelques minutes.{Nous n",
        "hren, k",
        "<%<6<C<T<d<w<",
        "ttynyt$T",
        ".*Windows 10 ",
        "ljaannet, mis erineb praegu kasutatavast.",
        " som administratorcHvis du vil bruge dette v",
        "Esto puede tardar un poco.]Configurando la actualizaci",
        "!J.*0",
        "   @@@",
        "nhamos parado.*Este PC n",
        "ri vor face ca instalarea s",
        "en-AE",
        "latot. Futtassa manu",
        "ll keep going from where we left off.",
        "chargement",
        "ana, lai atbr",
        "StringFileInfo",
        "NPreparazione in corso per il download della versione pi",
        "marrage, nous reprendrons l",
        "i PC-ul cu dvs. p",
        " listo para continuar instalando Windows 10. Prueba a reiniciar la configuraci",
        "anas konfigur",
        "terminer si Windows Server",
        "glen virker ikke. Angiv den n",
        " 3 GB",
        "r du begynner.+Vent mens appen fullf",
        "OX[MOn",
        "Filene, appene og innstillingene kan ikke beholdes fordi du installerer en annen utgave av Windows-versjon som er forskjellig fra den du bruker n",
        "Nincs el",
        "Begge\\Denne bitlockern",
        "gle, er ikke tilg",
        "xxxxh",
        "i omite acest pas. Vom activa automat Windows dup",
        "chargements. Veuillez ouvrir manuellement votre dossier T",
        "Windows",
        "u, lai tie darbotos, j",
        "iau kad jie veikt",
        "Aggiornamento di Windows 10yImpossibile aprire l'utilizzo dello spazio di archiviazione. Apri manualmente lo spazio di archiviazione in Impostazioni.;Impossibile aprire il Cestino. Apri il Cestino manualmente.oImpossibile aprire l'utilizzo dello spazio di archiviazione. Esegui manualmente %1!s! per aprire Pulizia disco.",
        "A Windows 10 let",
        "eljenog medijuma za kori",
        "ajte ponovno.$Windows nije aktiviran na ovom PC-ju",
        "re precommit.cmd-scripts.",
        "r du forts",
        "s int",
        "cijas failus.",
        " aktivere Windows 10 etter oppdateringen.",
        "ifru proizvoda za Windows 10.",
        "2(20282D2d2l2t2|2",
        "n de nuevo.",
        "Windows 10 wird installiert.;Ihr PC startet einige Male neu, was eine Weile dauern kann.'Warten Sie, w",
        "itom k",
        "GetLocaleInfoW",
        "GetNextDlgTabItem",
        "n %d%%",
        "ri vor ajuta instalarea s",
        "llningar manuellt.DDet gick inte att ",
        " du kj",
        "mayabilir ve iste",
        "?7?<?",
        "se: %1!d!%%",
        "Opdateringer er anvendt&Der er ingen tilg",
        "i je Windows Server 2019 pripraven",
        "n en Windows Server 2019. Para ayudar a proteger tus datos, qu",
        "`/=nR",
        "Zaslonska tip&kovnica",
        "?4?G?`?u?z?",
        "o do Windows encontrou um erro inesperado. Verifique se as origens da instala",
        "Posetite: %1!s!",
        "installation.",
        "re ready.",
        "2$2,242<2H2h2p2x2",
        "tetes k",
        "lligt ut",
        "s alatt.",
        "s %d rakto reik",
        "d Product Key m",
        " olan bir harici depolama cihaz",
        "rs+Kan inte uppdatera datorn med detta verktygjSpr",
        " USB doit avoir une capacit",
        "e{vU_:Nbk",
        "%1!s! %2!s!'P",
        "m nepovedlo nainstalovat.nNastavili jsme v",
        "lla 48 siffror.",
        "etka instalacije izdanja Windows 10.",
        "k. Sorun ya",
        "site tvarkyti savo ",
        "0g0M0~0[0",
        "hez online ",
        "torul pentru a desc",
        "o coincidem",
        "es-SV",
        "eyi saklama",
        "toru sa nepodarilo spusti",
        " Windows 108",
        "pne Nedlastinger-mappen manuelt.ZKan ikke ",
        "hlen Sie dann ",
        "rt. Windows Server 2019 Installation+Genstarter Windows Server 2019 Installation",
        "r att vara s",
        "i una dintre op",
        "i codul de eroare c",
        "o0!kn0",
        ".?AVIDlpRestartable@@",
        "te nie je pre tento po",
        "Nu putem determina dac",
        "nk felszabad",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::Suspend",
        "ranka negali nurodyti, koki",
        "iem nepiecie",
        "e pokrenuti Windows Server 2019qJednotka, ktor",
        "sticas de Windows 10 requieren hardware avanzado; algunas caracter",
        "Uusimpia Windows 10:n ominaisuuksia ja suojausparannuksia ei voi asentaa tietokoneeseen, koska levytila on v",
        "9+:a:",
        "Negalime t",
        "ljande",
        "t doporu",
        "To bi moglo potrajati nekoliko minuta.",
        "jra ezzel vagy egy m",
        "y osoitteessa: %1!s!",
        "rdet f",
        "ation de support mis ",
        ", czy Tw",
        "i cheia corect",
        "/Windows Server 2019 isn",
        "Neko nepatur",
        "e za %1!d!",
        "gra minuter.dDet gick inte att ladda ned alla n",
        "avons pu trouver les informations n",
        "cret kesilip kesilmeyece",
        "toarelor aspecte.dCheia BitLocker arat",
        "(%2!s!) ",
        "utilisation du stockage. Veuillez ex",
        "t save the installation info we need to continue installing Windows from where you left off. Sorry, you",
        "jumus.SJ",
        "ahovan",
        "Hvis du skal opgradere til Windows 7 eller Windows 8.1, eller du geninstallerer Windows 10, skal du angive en produktn",
        "i pob",
        "ci, kur",
        "veskite identifikatoriaus ",
        "te zada",
        "mta uppdateringar, drivrutiner och valfria funktioner",
        "ho okna$Nepodarilo sa n",
        "dzenie magazynuj",
        "USB flash disk je p",
        "progress",
        "Dokon",
        " sur ce PC et que vous le r",
        "e informacija potra",
        "X0f0K0",
        "%2!s!1Va",
        "%2!s!&",
        "t haszn",
        "n schimb spa",
        " nous nous ",
        "Datorn startas strax om",
        "klediyseniz kullan",
        "n ejecutando y reinicia el equipo. Se continuar",
        "terminer si Windows",
        "Het is niet gelukt om alle benodigde bestanden te downloaden. Controleer of u verbinding hebt met internet en probeer het hulpprogramma opnieuw uit te voeren.:Er is een probleem met het uitvoeren van dit hulpprogramma",
        "InternalName",
        "kkelen du skrev inn, er ikke tilgjengelig for ditt spr",
        "gu.&Notiek sist",
        "Kaikkia tarvittavia tiedostoja ei voitu ladata palvelimesta. Varmista, ett",
        "%% completado",
        " av datamaskinen",
        " supportata dallo strumento.",
        " poss",
        "hnout 4 GB (m",
        "u, nu reu",
        "8$8T8l8",
        " w zamian u",
        "v igen.ADerefter kan vi hj",
        "ajte ponovno.,Izvo",
        "v7 4\\",
        "QQSW3",
        "rXjKz",
        "ljaanded ei kattu",
        "rente.BVotre cl",
        "96:@:y:",
        "e odpreti. ",
        "junkite kompiuterio",
        "e odpreti. Mo",
        "ve-ZA",
        "-Unesite klju",
        "unalnik, da bo nadaljeval namestitev.",
        "mr-IN",
        "%3!s! Pr",
        "AddFontMemResourceEx",
        "^##P#",
        "k programlar",
        "e yarad",
        "Sto ottenendo gli aggiornamenti",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::InitializeRoutine",
        ",Estoy reinstalando Windows 10 en este equipo4Necesito comprar una clave de producto de Windows 10",
        " indirmeye haz",
        "u administratorskog ra",
        "Bitlocker-kulcs be",
        "tape. Nous activerons automatiquement Windows une fois l'installation termin",
        "r du kontakte kundest",
        "Licensvillkor",
        " a teraz ho chcete prein",
        "06>)j",
        "!Felkod: 0x%1!lX! - 0x%2!lX!",
        "Meiryo UI",
        " fjerne det fra listen.[Det oppstod et problem da vi pr",
        "bs-Cyrl",
        "IDATr",
        "Installing Windows Server 2019",
        "0f0D0~0[0",
        "We need more space-%1!d! GB of free disk space needed on (%2!s!)YRemove files that you no longer need or use Disk Cleanup to create space, then try again.*There was a problem downloading some files",
        "o pode continuar porque o Windows n",
        "anu no t",
        "Escolha a m",
        "si id",
        "tietoja alta, jos haluat tiet",
        "t ready for this PC yet%Making sure the installation is ready",
        "terge. Pentru a p",
        "kte fixa det h",
        "Tips voor probleemoplossing",
        "m saglab",
        "zh-CHT",
        " gerenciar as configura",
        "boru setup.exe /? v kore",
        "Klucz produktu powinien znajdowa",
        " installere %1!s! p",
        "Introduce",
        "ti naudojamas tik funkcijoms ",
        "Vorbereitung6Ihr PC kann mit diesem Tool nicht aktualisiert werden.xDie Sprache oder Edition der momentan auf Ihrem PC installierten Windows-Version wird von diesem Tool nicht unterst",
        "my.iK",
        "This may take a few minutes.qWe weren",
        "ste ladda ned och k",
        "pen a Windows 7 vagy a Windows 8.1 aktiv",
        "This may take a few minutes.XPlug in your PC to make sure that your battery doesn",
        "digo de error.",
        " jour? Pourquoi ce message appara",
        " izdelka ali licenco za Windows 10 in Windows 10 aktivirati po posodobitvi.",
        "as pokusu o vykonanie tejto akcie namiesto v",
        "Lagringsanv",
        "zatra, hogy az akkumul",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::UpdateState",
        "i mai departe. Aceast",
        "st visszaigazol",
        "n bejelentkezik a Windows",
        "imli jsme si, ",
        "t. Ind",
        "tres, fichiers et applications, car l'",
        "ti ei toiminud. Kontrollige tootev",
        "OpenSemaphoreW",
        "Sprawdzanie tego kluczaMTen klucz nie dzia",
        "unarnOva alatka ne podr",
        "Odpri mapo Prenosi1Odpri mo",
        "Fortsett fra der jeg avsluttet",
        "ti atsisi",
        "o izdevumu tikai tad, ja instal",
        "z gerekecek.",
        "Den har dette format: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX8Du skal g",
        "R='^gM?",
        " Windows 10 uzst",
        "hrt werden. Wenn weiterhin Probleme auftreten, wenden Sie sich unter Angabe des Fehlercodes an den Kundendienst.",
        "Oppdateringene er installert, men installasjonsprogrammet for Windows 10 m",
        "ar a instalar o Windows 10.",
        "Finner ikke lisensavtalen.",
        "(%1!c!:) - %2!s! ",
        "ajte ponovo.BZatim ",
        "EIDATx",
        "tten kan variere etter enhet.",
        "unalnik in dokon",
        "Meiryo Bold",
        "Selecione a imagem que deseja instalar.",
        " k instalaci",
        "e da pokrene Windows Server 2019. Zatvorite instalaciju, a zatim poku",
        "klenirken sabit s",
        "tu cieto disku, kam",
        "potek",
        "sidarys po %1!d! min..Dalykai, kuriuos reikia ",
        "tigte Dateien, oder geben Sie Speicherplatz mithilfe der Datentr",
        "Windows 10 v",
        "W0f0D0~0Y0",
        "Atidaryti DVD ",
        "l automatikusan bez",
        "anas avoti, un restart",
        "%s GBc",
        "anciens fichiers d",
        "e! Nastavite kada budete spremni.",
        "Please select the partition that you want to install Windows on.",
        "k vai j",
        "LoadLibraryExW",
        "re on a metered connection, check to see if this will result in extra charges.&What are some other options to update?",
        "unalnik se bo nekajkrat znova zagnal. To bo morda trajalo nekaj ",
        "Continue from where I left off",
        "ndiga filer. Kontrollera Internetanslutningen och f",
        "c w ulepszeniu instalacji systemu Windows",
        " https://aka.ms/windowsserverupgrade.",
        "ndirme yakla",
        "daug taip: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX.",
        " necessario il tuo intervento per completare queste operazioni.`BitLocker ",
        "Kalba nesutampa",
        "Odpri zapisovalnik za DVD-je",
        "Veja mais abaixo se estiver interessado em saber a raz",
        "Daugiau informacijos",
        "ci e-mail z potwierdzeniem. Kiedy po",
        "  &Jeg vil gerne hj",
        "ti sisaldab ainult 48 arvum",
        "ete na",
        "stato",
        "ger vos donn",
        "t dig. Uppdatera listan och f",
        ">,><>@>D>X>\\>t>x>",
        "i o conexiune tarifat",
        "ani, ali je va",
        "^Pode levar algum tempo para verificar se o que voc",
        " installationsmediet.}Vi kan inte avg",
        "es abaixo para concluir a atualiza",
        "IsChild",
        " BitLocker",
        "nd ISO-filen til en dvd manuelt ved hj",
        "ivitada.-Selle t",
        "Tietosuojatiedot",
        " Windows 10",
        "A prote",
        " disk.",
        "&Akzeptieren",
        "stroj vo va",
        "SetupDiGetDeviceInterfaceDetailW",
        "CSetupResponseTemplate<class IDlpResponse>::ExecuteRoutine: Cancel button clicked.",
        "ments qui requi",
        "su PC dators p",
        "installation. Passez en revue les informations dans %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml pour r",
        "s valid",
        "MDeze productcode werkt niet. Probeer een andere code of koop een nieuwe code.",
        "ebujeme %1!d! GB m",
        "/,`|r",
        "o, ative o Windows e, em seguida, inicie a instala",
        " Windows Server 2019i",
        "r: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "PC sa nieko",
        "t. preostalih znakov: 1",
        "asa.+Po",
        "Preverjamo, ali je vse nared za namestitev",
        "o apenas se estiver a instalar o Windows num PC concebido para ser executado no modo S.DA pen USB tem de ter, pelo menos, %1!d! GB. Selecione outra unidade. Transferir a vers",
        "Check Compatibility",
        "r jednotky",
        "Windows-Datenschutzbestimmungen",
        " u sebe, dokud se znovu nep",
        "DeleteDC",
        " niepotrzebne pliki albo zwolnij miejsce za pomoc",
        "Windows 10 selle v",
        "Aktuelle Version von Windows herunterladen",
        "rizze a(z) %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml f",
        "ddgmx",
        "OD0n0 ",
        "&Continuare",
        "Dette kan tage flere minutter.nVi kan ikke downloade alle de n",
        "a aktu",
        "o pode ser usada para instalar o Windows.",
        "re installationen af Windows.",
        "LfVFVLlx",
        "tkata ",
        "l prisijungsite.&Nepavyko ",
        "ta-LK",
        "e potrajati nekoliko minuta.",
        "* $+*999=IIOOOqqqqqqqZopdu",
        "n de Windows que coincide con la clave de producto indicada no est",
        "ovat v instalaci Windows 10. Zkuste restartovat instala",
        "0W0~0Y0",
        "<O=v=",
        "DTUPNNN2",
        "No se pueden conservar los archivos, las aplicaciones ni la configuraci",
        "anja bezbednosti na va",
        "ngelige opdateringer",
        "ches avant de vous laisser effectuer cette mise ",
        " pronto para continuar a instala",
        "i ste pripojen",
        "ber gen",
        "Asennus ei voi jatkua, koska Windows ei voi k",
        " kompiuteryje, kuris skirtas veikti S re",
        ".Notiek sist",
        "rgmistele asjadele.VBitlocker sarnaneb j",
        "Forbereder %d%%",
        "tter sedan automatiskt.",
        "Nous nous pr",
        " pre niektor",
        "InitializeCriticalSectionAndSpinCount",
        "eu-ES",
        "n!Esto puede tardar varios minutos.`No podr",
        "a z t",
        ".?AVCWnd@@",
        " install",
        "Lo sentimos, tenemos problemas para determinar si Windows 10 est",
        "s recientes de Windows 10 en tu PC debido a que el espacio en disco es insuficiente. Libera un poco de espacio a continuaci",
        "rt atkritni",
        "Vi beklager, men vi har problemer med ",
        "w instalacyjnych;Instalator nie mo",
        "Tipy na rie",
        "dzia, nale",
        "pili online.",
        "Skapa installationsmedia (USB-flashminne, DVD eller ISO-fil) f",
        "o e tente novamente.*Falha na instala",
        "rile de stocare",
        "as disku, DVD vai ISO failu) citam datoram.",
        " kiad",
        ". Pred za",
        "oo{|||{{wjkk_YS",
        " bol Windows 10 v tomto po",
        " ulkoista tallennustilaa",
        "&Fermer(Nous n",
        "&Avan",
        "```@@@ppp",
        "Nedlastinger8Fjern store eller ubrukte filer fra Nedlastinger-mappen.",
        "iniet restart",
        "o do Windows 10 mais antigos. Podemos ajud",
        "sti naujausius failus, kad ",
        "%3!s!&",
        "5#5T5[5b5",
        "t update your PCvThe language or edition of the version of Windows that is currently installed on your PC isn",
        "u s bezprobl",
        "v||v|lG",
        " %2!s! ledig",
        "Die Installation kann nicht fortgesetzt werden, da der Computer nicht neu gestartet werden kann. Schlie",
        "plne odin",
        "d Product Key obsahuje len 48 znakov.:Hodnota k",
        "sst7vvw",
        "8+9S9",
        "ll-e a sz",
        "s lietot migr",
        "yor olabilirsiniz.jKullanmaya ",
        "rg for, at du har forbindelse til internettet, og pr",
        "Allalaadimine1Saglab",
        "in haz",
        "tkamiseks taask",
        " nytt.(Windows Server 2019 kan ikke installeresaPC-en er tilbakestilt til slik den var like f",
        " podpora sa m",
        "steemile Windows 10 on saadaval ",
        "??0exception@@QAE@ABQBD@Z",
        "GetLogicalDriveStringsW",
        "essayez.,Windows Server 2019 ",
        "avanju skripti preinstall.cmd.:Do",
        "r klar et par ting",
        ".?AV?$CUnknownImplT@VCWebbrowserUIHandler@@$0A@@@",
        "yDeja, kyla problem",
        "%1!ld! %% valmiina",
        "Te posodobitve bodo omogo",
        "Valitse ulkoinen tallennuslaite",
        "Izbiranje slike",
        "lhf@G53",
        "ffnet werden. ",
        "VIETNAMESE",
        " izskat",
        "rskendamise ajal keelatud, kuid kaitse taastatakse siis, kui te operatsioonis",
        "Ta prenos v ozadju je lahko velik 4 GB ali ve",
        "Casi est",
        "vel transferir todos os ficheiros necess",
        "in Windows 10 Kurulumu",
        " Instalatora ponownie.0Sprawdzanie ilo",
        "EFalha ao abrir a pasta Downloads. Abra manualmente a pasta Downloads.YFalha ao abrir o gravador de DVD. Grave manualmente o arquivo ISO em um DVD usando %1!s!.",
        "Drive %c is hot pluggable",
        ", aby wznowi",
        "Tipy k ",
        " tietokoneessa",
        " %2!s! ",
        "ivitysasetuksia.",
        ": XXXXX-XXXXX-XXXXX-XXXXX-XXXXX=",
        " Windows Server 20198",
        "thelyez",
        "erreur : 0x%1!lX! - 0x%2!lX!",
        "ma Windows 10",
        "Jaunin",
        "Instalacija se bri",
        " norite daryti?",
        "r att slutf",
        "Si vous installez Windows",
        " atmi",
        "C&oncluir",
        "bbi inform",
        "iu verziu Windowsu",
        " inne du",
        "bbi tudnival",
        "uriranja.",
        "Meer informatie",
        "uriranje na Windows 10 je dostupno samo ako na ra",
        "Installer Windows Server 2019",
        " (USB flash s",
        "%s Mo",
        "Seleccionar idioma, arquitectura y edici",
        "CompanyName",
        "yor. L",
        "dban val",
        " %1!d!%%",
        " jednom.",
        "Atualiza&r",
        "Descarga de Windows 10",
        "5Pripravuje sa stiahnutie najnov",
        "D$hSV",
        "%c:9PCen startes p",
        "ry a vydania",
        "6,7T7",
        "Wyjmij podany dysk zewn",
        "hakemistoa#Virheellisi",
        "DISPLAY",
        "%1!s!, %2!s!",
        "res.JLa valeur de la cl",
        ".?AVCSetupActivationDlpResponse@@",
        "Mindkett",
        "metros de linha de comandos inv",
        "cija ir gatava",
        "ky se p",
        "st, ha S m",
        "9 979@9R9a9q9y9",
        "m nen",
        "y a pas assez d",
        "Microsoft Corporation1-0+",
        "7(70787@7",
        "est pas activ",
        ".PAVCMemoryException@@",
        "Por que estou vendo isso?",
        "ter.Cette op",
        "tve. Aktiv",
        "Windows 10 -p",
        "elite prenesti najnovej",
        "ffnen",
        "s Windows versijas valodu vai izdevumu ",
        "iPogon, ki bi ga radi uporabili, je ",
        " nytt, og du kan fjerne den etter at installasjonen er fullf",
        "Status: %1!d!%%JW",
        "ijas avotam.",
        " aplanko. Atidarykite atsisiuntim",
        "re utiliser l",
        "klemekte oldu",
        "Esto tardar",
        " inne opcje aktualizacji?",
        "utilisation de la licence.jUn espace d",
        "te nainstalovat star",
        "dia atualizada",
        "t>jPSV",
        "diegti.",
        "Per sapere il motivo, vedi qui sotto.",
        "A continuaci",
        "tuvi manu",
        "n actual de Windows puede estar instalada en un directorio no compatible o es posible que est",
        "o na qual deseja instalar o Windows.",
        ">(>,><>L>\\>`>d>|>",
        ".?AV?$CZeroInit@VCSetupResponsePageActivation@@$00@@",
        "isesti p",
        "nacak ve Windows Server 2019'da oturum a",
        "OX[v^sQ",
        " sursele de instalare sunt accesibile ",
        "button",
        "Preostao je 1 znak'",
        "Oppdateringer implementert!Ingen tilgjengelige oppdateringer",
        "QueryPerformanceCounter",
        "lSprawdzenie, czy elementy, kt",
        " anlamakta sorun ya",
        "ug-CN",
        "i Windows, apoi s",
        "SiteLink'Rufen Sie die folgende Seite auf: %1!s!",
        "RAceast",
        "ipraven",
        " \"%c\"",
        " spoljnji ure",
        "3!4T4^4",
        " jour pendant la p",
        "@eT0@",
        "0h0puj0",
        "i manual ",
        " activado en este PC. Esto significa que deber",
        "0W0f0O0`0U0D0",
        "i Windows.",
        "k[1zup",
        "Installer Windows 101Hent opdateringer, drivere og valgfrie funktioner",
        " Windows-kiad",
        "NMRn0",
        "Nyelv",
        "kkelen fungerte ikke. Angi den du kj",
        "echna pr",
        "n de Windows descarga las actualizaciones",
        "rQuita la siguiente unidad externa y haz clic en Aceptar para reiniciar y completar la instalaci",
        " pro v",
        "%1!s!: %2!s!",
        "es ajudam a facilitar a instala",
        "rankai nepavyko ",
        "0-Nk0",
        "vel se voc",
        "[06xm*.",
        "tre suspendue au cours de cette mise ",
        "Descarga la ",
        "CSetupUIManager: Showing Compat resolve message",
        "nda en extern lagringsenhet i st",
        "chargement des mises ",
        "e si nainstalujete nejnov",
        "anas to var",
        ", turite b",
        ".?AVCSimpleWizard@UX@Common@ConX@@",
        "nite miesto a potom kliknite na polo",
        "r identifieraren: -Windows beh",
        "d Product Key pro Windows 10",
        "8 8.8G8R8s8",
        "InitializeCriticalSection",
        "W0~0Y0",
        ", mihin j",
        "<4<<<D<P<p<x<",
        "es, ficheiros pessoais e aplica",
        ">)>z>",
        " a dal",
        "ico sistema Windows in nato izberite ",
        "333]3}3",
        "ete instalaci Windows.",
        "i spou",
        "DLPLOG: [0x%X] [%s] [%s]",
        "rgmised asjad, mis vajavad teie sekkumist.",
        "unalniku ni aktiviran",
        "akajte:Pri",
        "tres.V",
        " jour de Windows 10.",
        "T$0QQV",
        "O(ug0M0",
        "te star",
        "alost, imamo pote",
        "%1!ld!%% completado",
        "%2!s!",
        "r die ID ein: 1Windows ben",
        "sta.\"Chcete pokra",
        "##''#",
        "zeltmeleri, g",
        "emy okre",
        " concordando.",
        " de produit.'Votre cl",
        "hendage v",
        " nem tudta meg",
        "Bruk de anbefalte alternativene for denne PC-en",
        "essayer.+Windows 10 n",
        " wszystkich potrzebnych plik",
        "l. Toto okno se automaticky zav",
        "tfen bekleyin!Bu i",
        "Uppgradera den h",
        "Instalovat %sISyst",
        "einstalaci, m",
        " poplatky.$Ak",
        "Instalator nie akceptuje argument",
        " sa nenach",
        "wcsncmp",
        "installation de Windows introuvables. Ins",
        "Create installation media (USB flash drive, DVD, or ISO file) for another PC",
        "ajte ponovno pokrenuti program za instalaciju.",
        "h%EGG9%",
        "No updates available",
        "jumu/Notiek p",
        "es ser",
        "&Diegti",
        "te sa do Windowsu prihl",
        " USB-stasjonen slettes. Hvis du vil beholde disse filene, sikkerhetskopierer du dem til en annen plassering n",
        "0L0B}",
        "(%1!c!:) - %2!s! disponibile",
        "Instalacija izdanja Windows 10",
        "lo je do problema pa ne mo",
        "l, mus",
        "emti; sist",
        "skite, kai b",
        "Station selecteren<Er wordt eerst netjes opgeruimd voordat Setup wordt gesloten",
        "Tiene un aspecto similar a este: XXXXX-XXXXX-XXXXX-XXXXX-XXXX.",
        "t$pVQ",
        "Gratis oppdatering til Windows 10 er bare tilgjengelig hvis du har et aktivert eksemplar av Windows 7 eller Windows 8.1 installert p",
        "7o>{hhe",
        "tirme yapabilmeniz i",
        "dFEdeh",
        "ru-RU",
        "n de precommit.cmd3Ejecutando scripts de implementaci",
        "jeblikke at kontrollere, om det, du gerne vil beholde, er kompatibelt med Windows 10.wDenne produktn",
        ">9s0t",
        "k ki Windows Server 2019'un bilgisayar",
        "; ;4;D;T;X;\\;t;",
        " merevlemez haszn",
        "tter vi d",
        "ifru proizvoda za Windows 10 ili licencu za aktiviranje operativnog sistema Windows 10 nakon a",
        "s instalando una edici",
        " syst",
        ".?AV?$CZeroInit@VCSetupDlpResponseFactory@@$00@@",
        "cutez manuellement %1!s! pour ouvrir Nettoyage de disque.",
        "9&9I9U9",
        "tartova",
        "m spusti",
        "lhetnek fel. Kattintson a Tov",
        "Invalid parameter passed to C runtime function.",
        " friss",
        "Tee valimine",
        "BitLocker-nyckel",
        "Versies komen niet overeen",
        "8\"8>8M8\\8k8z8",
        "unalniku dovolj prostora za nadaljevanje name",
        "Error reporting telemetry for bOpenDownloadsClicked: [0x%X]",
        "n alman",
        "cie4In",
        "kkelen for IDen: %Windows trenger plass for ",
        "n etapa %1!s!, cu o eroare ",
        "chargements.h",
        "elite namestiti Windows.",
        "essayez d",
        "ivitysvaihtoehtoja on?",
        "kkulcsot kell v",
        "ckt att du har gamla installationsfiler f",
        "i %1!s!.",
        "Open&I want to use external storage instead$I don't want to use external storage",
        "CSetupResponseTemplate<class IActivationActionResponse>::GetResultsRoutine",
        "gu vai ieg",
        "quz-EC",
        ".TTento k",
        "veskite t",
        "ket matchar inte",
        " uudelleen.4Windows Server",
        "?Q?X?b?g?s?",
        " kalb",
        "&Wstecz",
        "a. Wprowad",
        " e lingue facoltative.",
        "%2!c!: ",
        "es ou supprim",
        "Lo&obu",
        "n a ciertas cosas.",
        "e datoteke biti zadr",
        "ni muu draiv.",
        "lp af en administratorkonto.+Du skal br",
        " i spr",
        "n oldu",
        "ovat v instalaci syst",
        "s a conclus",
        ". Aktualizaci dokon",
        "sben seg",
        "st, hogy tiszt",
        "d.8Tento k",
        "n prezent pe PC nu este acceptat",
        "surea argumendid",
        "bernommen Es sind keine Updates verf",
        "USB fle",
        "Lugege altpoolt, miks seda teha.",
        "tFtv||~",
        "2019 a ",
        "enje S re",
        "394G4P4Y4o4}4",
        "Aktualizacja systemu Windows 10pNie mo",
        "in 350 MB de spa",
        "l neprisijungsite.",
        "tenje pohraneVRu",
        "RtlUnsubscribeWnfNotificationWaitForCompletion",
        " jour pour Windows 10",
        "d Product Key se d",
        " problem podczas pobierania niekt",
        "nda n",
        "Pogledajte dolenavedene informacije ako vas zanima razlog.",
        "This tool can",
        "tietoja",
        "sl-SI",
        "i je in",
        "CSetupLangIniLoader::Initialize: LANG.INI Directory = %s",
        " tamamlan",
        "MediaSetupUIMgr.DLL",
        "Kasutatava kandja valimine",
        "Mitte praegu",
        "utujeme, m",
        "nik a Windows aktiv",
        "Hvis du vil installere Windows 10 p",
        " en DVD med %1!s!.",
        "%1!ld!%% complete",
        "Verificar a Compatibilidade",
        "initi jo",
        ".EWindows ",
        "Se o Windows 10 j",
        "CSetupResponseTemplate<class IDlpResponse>::OnCancel",
        "unu, ki ste ga dobili po e-po",
        ".?AVCSetupDialogBase@@",
        "n.(No se pudo instalar Windows Server 2019.lHemos vuelto a configurar el PC a como estaba justo antes de comenzar la instalaci",
        "isel dosyalar",
        "re funkcje systemu Windows 10 wymagaj",
        " saklayamazs",
        "in mevcut de",
        " %d%%",
        "2019 doit red",
        "_a0O0`0U0D0#",
        "l paleisti s",
        "oSe vuoi installare Windows 10 in un'altra partizione, devi creare il supporto per l'installazione ed eseguirlo.\"Puoi continuare a usare il tuo PC.XL'installazione non ",
        "%1!s!",
        "m dosyalar",
        "terse, dar fi",
        "ycie magazynuPR",
        "Savjeti za otklanjanje pote",
        "installation et la conservation de vos param",
        ")Download den nyeste version af Windows 10",
        "m bud",
        "e elementy.*Wybierz zewn",
        "li smo na problem prilikom poku",
        "tane s",
        "e potrajati nekoliko minuta.mNismo uspeli da preuzmemo sve potrebne datoteke. Uverite se da ste povezani sa internetom i poku",
        "Bezplatn",
        "Start p",
        "The bit locker looks similar to this: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX9",
        "n y se reanudar",
        "ilerleme durumu",
        "5)5V5k5",
        " installationsmediet. Om du inte installerar uppdateringarna nu kanske datorn inte fungerar korrekt efter installationen och du kan beh",
        "sma-SE",
        "838O8e8",
        "Biztosan kil",
        "-P3}G",
        "O\\U^.",
        "diegta nepalaikomame kataloge, arba bandote ",
        "Windows har inte aktiverats p",
        ". Uporaba prostora za shranjevanjeoV nastavitvah ro",
        "inizden emin misiniz?",
        "e nisu potrebne ili se poslu",
        "VorbereitensDarum haben Sie sich bereits gek",
        " z Internetem, system Windows zostanie aktywowany automatycznie.",
        "Det gick inte att hitta den installationsinfo som vi beh",
        "k, hogy minden k",
        "s toliau pateiktomis instrukcijomis, kad u",
        "delmi nyilatkozat",
        " a obter os arquivos mais recentes para ter certeza de que instalar",
        ">,?T?",
        " possibile determinare se il tuo PC ",
        "Esta chave de produto (Product Key) s",
        "Les dette, slik at du vet hva du g",
        "Actuali&zar",
        " du angi en gyldig produktn",
        "ou obsahovat d",
        "got h",
        "Taal komt niet overeen",
        "sek keres",
        "Media voor Windows 10 maken&U kunt de pc gewoon blijven gebruiken.",
        "CSetupResponsePageDiskSpaceReq::RefreshDriveList",
        "CSetupResponseTemplate<class IActivationActionResponse>::OnNext",
        "%d caract",
        "A transfer",
        " to bude hotov",
        "3F4L4^5d5y5",
        "a__\\\\\\\\\\R0}",
        "<'<;<b<h<w<~<",
        "rli a felesleges f",
        "cm4t5",
        "ju, kur",
        "en eine Bereinigung durchgef",
        "czenie dzia",
        "Nie teraz",
        "Scarica aggiornamenti, driver e funzionalit",
        "iu-Cans",
        ".gfids",
        "sr-Cyrl-ME",
        " instalarea s",
        "parons certains ",
        "Produktn",
        "tres pour supprimer d'autres ",
        "vesnica na obrazovke",
        "renmek istiyorsan",
        "`W^avva^W`",
        "su datoru iepriek",
        "Open Storage Settings",
        "2%2X2",
        "Your files, apps, and settings can",
        "m neda",
        "en-BZ",
        "Il existe une version plus r",
        "CSetupResponsePageBitLockerKeyValidate::DeserializePage",
        "es importantes, drivers de dispositivo atualizados e arquivos adicionais que n",
        "Getting updates We",
        ":N:_:",
        "ngelig p",
        " nastavenia ",
        " Windows Server 2019bDen enhet som du f",
        "d Product Key pro Windows 10, nebo ukon",
        " o ochran",
        "lt megnyitni a t",
        "%2!s!.A szervezet kezeli a friss",
        " %1!s! ",
        ": -Windows ",
        "Plus d",
        "Pasirinkite keli",
        "d|ef|G",
        "en er klar til at forts",
        "o chcete ponecha",
        "__dllonexit",
        " nyt, tietokoneesi ei ehk",
        "bas patur",
        "chargements!Ouvrir les param",
        "10 bezmaksas atjaunin",
        "}Q0~0Y0K0?",
        " B`ff",
        "rieure. S",
        "e to potrwa",
        "e se b",
        "  Windows",
        " Setup.exe ",
        " gerekir.",
        "tf.359",
        "KHTMLELEMENTEVENTS2_ONCLICK",
        "tuiGirdi",
        "ring av skript for preinstall.cmd.ADet oppstod et problem under kj",
        "de var p",
        "tre la raison.",
        "lyes f",
        ":%:5:E:U:e:",
        "r verktyget./Du beh",
        ".giats",
        "kningstips",
        "E&dasi",
        "de aplicar dados de migra",
        "&Continua",
        " automaticky>Instala",
        " online.",
        "i aplica",
        "e to trva",
        "9~ltbSWW",
        "tu papildinform",
        "a zainstalowana i aktywowana kopia systemu Windows 7 lub Windows 8.1. Aktywuj aktualn",
        "boryEOdstr",
        "lgende ting kr",
        "irin ve Kurulumu yeniden ",
        "inka Stiahnut",
        "o suficiente. Selecione uma unidade diferente e tente novamente.8Em seguida, ajudamos a libertar %1!s! da unidade %2!c!:.",
        "pnie uruchom polecenie ",
        " alebo nebud",
        " fortsette installasjonen av Windows fra der du avsluttet sist. Du m",
        "ivitamiseks ja Windowsi installimise l",
        " variare in base al dispositivo.",
        "Auf dem Laufwerk, das Sie verwenden m",
        "gBitLocker ",
        "zdnite K",
        "Q\\XBgg",
        "stup ke zdrojov",
        "Dowiedz si",
        ", aby usun",
        " pode ser usada para adicionar funcionalidades ao Windows. N",
        " la reprise de l",
        "Non ora",
        "inome, ar j",
        "ivitada.2Kontrollimine, kas teie arvutis on piisavalt ruumi,Kas soovite selle valiku kasutamist j",
        "kleme bilgisini kaydedemedik. ",
        "SgqW0f0O0`0U0D0",
        "nda bulunmayan ek dosyalar",
        "Za kaj morate poskrbeti",
        "jiet tos cit",
        "Unidades remov",
        "SelectedDUChoiceVisible",
        "&Skjermtastatur",
        "leri ve iste",
        "u proizvoda nije dostupno na trenutno odabranom jeziku ni arhitekturi.",
        "Y2{#z",
        " kullanmaya devam edebilirsiniz.JY",
        " para executar o Windows 10 no seu PC. Feche a Configura",
        " systemu Windows.qDysk, kt",
        "a proizvoda pa odaberite Osvje",
        ": (Norint naujinti, ",
        "i apoi selecta",
        "nk let",
        "i meilikviitungis. Kui loote Interneti-",
        "ritet",
        "%2!s!>Va",
        "Bitlocker atsl",
        "n si quieres averiguar por qu",
        "ber 4 GB enthalten (Abweichungen m",
        "Valmiina asennusta varten",
        "i sa v",
        "#Installation de Windows Server",
        "urada: (%2!s!)tArt",
        "- Windows. ",
        "Hvis du skal installere Windows 10 p",
        "USER32.dll",
        " Windows 10P",
        "chargement en arri",
        "Windows 10 downloaden",
        "QSVWj",
        "p: %1!d!%%2Wybierz jedn",
        "tta m",
        "ber jazyka, architekt",
        " belirlemede sorun ya",
        "CSetupUIManager::OnSetupFail",
        "Teisin",
        ".?AVCSetupResponsePageActivation@@",
        "tani, hogy a Windows Server 2019 telep",
        "nyoznak Windows telep",
        "unalnika",
        "&Close%Your PC will restart in a few moments",
        "inde Windows 10",
        "o pode determinar a vers",
        "te zadat platn",
        "sa>A precommit.cmd k",
        "6!7i8p8",
        "dition de Windows diff",
        "[[6oi\\",
        "0.1<1R1",
        " installere enkelte valgfrie funksjoner og spr",
        " aplikace %1!s!.",
        "rcat resursele lingvistice/Instalarea nu a ini",
        "e posodobiti va",
        "Destek",
        "2Jos hylk",
        "smj-NO",
        "GetDeviceCaps",
        "iu verziurK dispoz",
        "s dydis turi b",
        "sit fi",
        "aja rje",
        "e obavijesti i licencne odredbe",
        "s licencfelt",
        "en0_j",
        "e zainstalowano najnowsz",
        "dajov by ste po",
        "ka versija. Lai turpin",
        "k9U)d",
        "lectionnez le support ",
        "nia s",
        "Izjava o zasebnosti",
        "Microsoft JhengHei UI",
        "CSetupResponsePageBitLockerKeyValidate: OnBitLockerKeyEditUpdated",
        ":K:V:m:x:",
        "k olmal",
        "; ;E;q;",
        "SiteLink$L",
        "Thales TSS ESN:FC41-4BD4-D2201%0#",
        " reiniciado dentro de momentos",
        "anju namestitve sistema Windows",
        "ties, jo Windows nevar restart",
        "1#1;1J1S1j1",
        "lido0N",
        "Sto verificando il codiceWIl codice immesso non funziona con questa edizione di Windows. Immetti un altro codice.RQuesto codice Product Key non funziona. Immetti di nuovo quello acquistato online.",
        "lja a Windowst, majd ind",
        "das ir citas atjaunin",
        "ime.1Windows Server 2019 pole selles arvutis kasutatavbDisks, kuru m",
        "i. Joudut valitettavasti antamaan tietosi my",
        "es-CR",
        "s volviendo a instalar, puedes omitir este paso. Se activar",
        "iere de instalare.",
        "sr-Latn-RS",
        "t szeretne haszn",
        "dium a pak z n",
        "h(hch",
        "gikast",
        "a la Papelera de reciclaje para quitar los archivos eliminados de la unidad del sistema.",
        "Ha kor",
        "tytty",
        "nstalleerd, maar werken pas nadat Windows Server 2019 Setup opnieuw is opgestart. Hierna wordt de installatie van de updates voltooid.9Windows Server 2019 kan niet op deze pc worden uitgevoerd_Stasjonen du pr",
        "CSimpleWizard",
        "Algo pas",
        " Pomi",
        "1$1(1,1@1D1H1L1P1T1X1\\1`1d1h1p1",
        "Preparando el programa de instalaci",
        "s rendszer:",
        "lise m",
        "tkame sealt, kus pooleli j",
        "emo da sa",
        "1 tecken kvar'Produktnyckeln ska inneh",
        "se el",
        " proizvoda sustava Windows 10",
        "riista v",
        "Abrir la papelera de reciclaje",
        "me toki",
        "CompatDownloadReq",
        "nejte po",
        "os atjaunin",
        "}>87;",
        "my objevovat i d",
        " deve saber antes de come",
        "da ne",
        "est produit lors de la cr",
        "n de Windows 10_No se pudo abrir el uso de almacenamiento. Abre manualmente tu Almacenamiento en Configuraci",
        "nchide instalarea,Aceast",
        " gastos adicionales.3",
        "ite: %1!s!",
        "enu vezu, proverite da li ",
        "in alana ihtiyac",
        "i instalarea.sNe pare r",
        "laties patur",
        "sureaargumente. Lisateabe saamiseks lugege installispikrit v",
        "===p=",
        "CInstallUI::OnActionChanged: Cancel is requested. Returning ERROR_REQUEST_ABORTED",
        "Jazyk:",
        "de kullan",
        "SetupDiEnumDeviceInterfaces",
        " funkce Windows 10 a vylep",
        "374D4R4Y4_4d4o4",
        "W0f0zzM0",
        "rja om fr",
        "3?9\"\"\"! ",
        "s administrar tu configuraci",
        "ie naujinimai pad",
        ".?AV?$CUnknownImpl@VIDiskSpaceActionResponse@@@@",
        "re valide",
        "2\"2(222B2R2b2r2",
        "Chave do produto (Product Key)",
        "s par gatav",
        " architektura.",
        "ite ISO datoteku na DVD koriste",
        "https://go.microsoft.com/fwlink/?linkid=2041981",
        "State",
        " da biste uklonili stavku sa liste.ZNai",
        "U redu",
        "elite da instalirate Windows.",
        "^7b{vU_0R ",
        "Dette kan ta noen minutter.lVi kunne ikke laste ned alle de n",
        "nnen nicht beibehalten werden, weil Sie eine andere als die gerade verwendete Windows-Edition installieren.",
        "Promenite izbor onoga ",
        "pe en produktn",
        " na internet, a sk",
        "s reciente.:Descargar la Herramienta de creaci",
        " demorar algum tempo.bA configurar a atualiza",
        "Qa6R0",
        ".?AVCGdiObject@@",
        "N&on accettoTSe non accetti le condizioni di licenza, il programma di installazione verr",
        " uudelleen tai kokeile toista avainta.9Annoit oikean tuoteavaimen. Voit jatkaa, kun olet valmis.",
        "hren oder Windows 10 erneut installieren, m",
        ", mus",
        "nceput",
        "It looks similar to this: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXRThe following things need your attention before you can continue the installation.",
        "kai(S",
        "ste pou",
        "puleviimiseks j",
        "Jei t",
        "Selecione o idioma, a arquitetura e a edi",
        " odpor",
        "Arvuti kontrollimine'Uurime, kas olete installimiseks valmis",
        "t-il?",
        "Diegiama ",
        "Potrzebujemy wi",
        "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4",
        "O@7Cm",
        "Izgleda ovako: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXWDa biste mogli nastaviti instalaciju, najprije se morate pozabaviti sljede",
        "Windows isn",
        "anas iesp",
        "ret v",
        "Clave de producto",
        "jumu p",
        "pen m",
        "espace5%1!d!Go d",
        " de produit, puis s",
        "sselt. W",
        "r redan Windows 10",
        ", jest zaszyfrowany przy u",
        "r redo",
        " zgodne",
        " arba licencij",
        "end ausf",
        "%systemdrive%",
        "iu verziu Windowsu.aNa jednotke, ktor",
        "AtsisiuntimaiFPa",
        "kolikr",
        "uJ0}f",
        "ti pateiktas su DVD pakuote arba gautame el. lai",
        "hemmin uudelleen.'Asennus ei voinut asentaa siirtotietoja-Asennus ei voinut puhdistaa asennustiedostoja8Asennus ei voinut selvitt",
        "PREPARE_SAFE_OS",
        "lg instruktionerne nedenfor for at fuldf",
        "pnie pomo",
        "Premje",
        "bory. Skontrolujte, ",
        "te.2Windows Server 2019 se n",
        " uudelleen.:Windows 10 ei ole viel",
        "Drive Selection",
        "Vi kan ikke installere de nyeste Windows 10-funksjonene og -sikkerhetsforbedringene p",
        "r ein Upgrade von Windows Server finden Sie unter: https://aka.ms/windowsserverupgrade",
        " nytt flere ganger. Dette kan ta litt tid.",
        "Als u Windows 10 op een andere partitie wilt installeren, moet u eerst de media maken en deze vervolgens uitvoeren om het systeem te installeren.&U kunt de pc gewoon blijven gebruiken.RDe installatie is mislukt in de fase %1!s! met een fout tijdens de %2!s!-bewerking",
        "%s GB.",
        "LagerforbrugZGennemse dit lagerforbrug manuelt under indstillinger for at fjerne andre store elementer.",
        "ren!Kies welk medium u wilt gebruiken",
        "i manual spa",
        "tenja pohrane nije uspjelo. Ru",
        ";0;L;[;j;",
        "cessitent du mat",
        "i din nou.5Se execut",
        "inyne arba paleid",
        "zellikler al",
        " nytt, eller pr",
        "v5uP[",
        "iu liber de cel pu",
        "mn-Mong-CN",
        "Tiedostojasi, sovelluksiasi ja asetuksiasi ei voi s",
        "n continuare PC-ul.NInstalarea nu a reu",
        "Naujausios ",
        "%3!s! We bereiden een paar dingen voor*Dit hulpprogramma kan uw pc niet bijwerken",
        "Tietokoneen tarkistus",
        "w, aplikacji i ustawie",
        "GB. Si usas una conexi",
        "installation de cette ",
        ".?AVIPageHost@@",
        "n de Windows 10. Podemos ayudarte a obtener los archivos m",
        "ngen (eller installera en annan utg",
        " szolg",
        "CSetupResponsePageBitLockerKeyValidate::InitializeResponsePageRoutine",
        "0n0zzM0",
        "li instalujesz system Windows 10 na tym komputerze po raz pierwszy, musisz wprowadzi",
        " varten",
        "To mo",
        "my problem. Od",
        "tres Windows.TVos applications et param",
        "jumus",
        " saugykl",
        " %2!c!:.",
        " hente oppdateringer, drivere og valgfrie funksjoner p",
        " il PC per l'esecuzione in modalit",
        ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VICompatActionResponse@@@@@@",
        "Mantieni solo i file personali",
        "mk-MK",
        " for at forts",
        "liwia tylko dodawanie funkcji do systemu Windows. Nie mo",
        "se a g",
        ", da znova za",
        ".?AV?$CZeroInit@VCSetupResponsePageEula@@$00@@",
        ".CRT$XLA",
        "rxmV6",
        "tottuk a k",
        "mi-NZ",
        "sit Acordul de licen",
        " tai asennat Windows 10:n uudelleen, et tarvitse tuoteavainta.",
        "unar.KOvo instaliranje je otkazano u fazi %1!s! sa gre",
        "ljaande jaoks. Proovige m",
        " girin",
        "ranka nepaiso komand",
        ".?AV?$CZeroInit@VCSetupResponsePageDiskSpaceReq@@$00@@",
        "lo-LA",
        " PC spreman za nastavak instalacije sustava Windows 10. Poku",
        "mas Windows instal",
        "n de precommit.cmd5Ejecuci",
        "GB (puede variar) y es posible que se apliquen tarifas de acceso a Internet. Haz clic en Siguiente para descargar los archivos de instalaci",
        "GetDeviceNumberFromPath: Drive %s CreateFile returned Error: 0x%X",
        "sokat lehet hozz",
        "bb %1!d! GB-osnak kell lennie.",
        "s de Windows",
        "darym",
        "PREPARE_ROLLBACK",
        ">,>;>Q>b>s>",
        "Uurime, kas olete installimiseks valmis",
        "SetThreadPreferredUILanguages",
        "ma Windows ",
        "Fertig &stellen",
        "No estamos seguros de qu",
        " atrodo pana",
        "cii iba v pr",
        " installere Windows.",
        "Pripravljanje nekaterih stvari5S tem orodjem ni mogo",
        "Zauwa",
        "ho disku b",
        "9\"9B9b9",
        "nlott be",
        "&Refuz9Dac",
        "ngua6A configura",
        "Z\"<,!",
        "tt nyckel+Ange BitLocker-nyckeln f",
        "pen van-e el",
        "o atual do Windows utilizando uma chave de produto e selecione Atualizar.",
        "nstalleerd vanwege onvoldoende schijfruimte. Maak hieronder ruimte vrij en selecteer vervolgens Vernieuwen.",
        "u. Lorsque vous vous connectez ",
        " podpory aktualizuje automaticky. Podpora se m",
        " %1!s! na va",
        "962:Z",
        "fr-CA",
        "icooNa voljo je nova razli",
        "8B8b8",
        "ul USB-kulcs, SD-k",
        "r. Tarifeli ba",
        "0U0q0",
        "OF0S0h0L0g0M0~0Y0",
        "CSetupResponsePageProductKeyValidate",
        "1\"121B1R1b1r1",
        "e namestitvene datoteke, kliknite ",
        "d Product Key obsahuje len 25 znakov.",
        "%c:FDe pc wordt verschillende keren opnieuw opgestart. Dit kan even duren.",
        "D$ VP",
        " det drev, du fors",
        "1#131L1_1h1x1",
        " flash USB, DVD o file ISO) per un altro PC",
        "Archivo ISO Seleccionar una unidad flash USB",
        " toliau t",
        "m na s",
        "ko vec",
        "saugoti.AViskas bus panaikinta, ",
        "bb, meg kell v",
        "#########",
        "imiz bitti",
        "e, ce t",
        " %s@Windows ",
        "ebuji si koupit k",
        "jraind",
        "e pokrenuti ovu alatku na ra",
        " de acest instrument.",
        "i un dispozitiv extern, precum o unitate USB, un card SD sau o unitate de hard disk extern",
        " nie s",
        " zgodne z systemem Windows 10, mo",
        "s reciente de Windows",
        "galement d'importants correctifs et des pilotes de p",
        "s az OK gombra kattintva ",
        "6/6X6k6~6",
        "n..Programa de instalaci",
        "anja slu",
        "As seguintes a",
        " fazendo a limpeza antes de fechar!Isso pode demorar alguns minutos.[Conecte seu computador para ter certeza de que n",
        "aty za dost",
        "Valoda:",
        "ytetty. Valitse Jatka)Valitse jokin muu ulkoinen tallennuslaite",
        " bruke, er kryptert med BitLocker. Velg en annen stasjon, og pr",
        "imalustega riistvara. M",
        "La protection BitLocker sera interrompue pendant cette mise ",
        "nnen, muss Windows 10 Setup jedoch neu gestartet werden. Nach dem Neustart wird die Aktion an der Stelle fortgesetzt, an der sie unterbrochen wurde.6Windows 10 kann auf diesem PC nicht ausgef",
        " precommit.cmd2",
        "bX0Cu0L",
        "adnik",
        "MS UI Gothic",
        "r mer",
        "Operacijski sistem:",
        "nde aufgef",
        "OImpossibile aprire la cartella Download. Apri la cartella Download manualmente.iImpossibile aprire il masterizzatore DVD. Masterizza manualmente il file ISO su un DVD utilizzando %1!s!.",
        "Cambia elementi da mantenere",
        " w katalogu g",
        " nodal",
        " Windows.C",
        "Avisos e termos de licen",
        "Updates zoeken: %1!d!%%",
        "WaitForSingleObjectEx",
        "o desligue o computador",
        "sik kulccsal.EA BitLocker-kulcs m",
        "Windows 10-friss",
        " podczas operacji wyst",
        "o para que se possa prosseguir com a instala",
        "&Oppdater",
        "ujte pros",
        "CInstallUI::CInstallUIMessageWindow::SwitchToResponsePage",
        " quieres hacer?",
        " belirleyemiyor.#Windows 10 y",
        " BitLocker ne deluje. Preverite ga in poskusite znova ali pa poskusite z drugim klju",
        "s mer",
        "Preden se program za namestitev zapre, izvaja ",
        "ration peut prendre un certain temps.lConfiguration de la mise ",
        ".?AVICompatActionResponse@@",
        "installez, vous pouvez sauter cette ",
        "Oc0f0",
        "ilitatavate ",
        "LoadImageW",
        "re agreeing to.",
        "nosti instalacijeFInstalacijski program nije uspio provjeriti valjanost klju",
        "ia kompiuter",
        "z denetleniyor",
        "chargement de la plus r",
        "Rechtshinweise",
        "n de actualizaciones.",
        ", kuriame b",
        "i pou",
        "CheckHotPluggableDrive: Drive %c SetupDiGetClassDevs Error: 0x%X",
        "kleme bilgisini bulamad",
        "installation par le programme d",
        "DOWNLOAD_UPDATES",
        "lle sisse logite.!Olete valinud j",
        "nainte de a continua instalarea, acorda",
        "lreiz vai izmantojiet citu atsl",
        "laik lietot",
        "uvanje.",
        " (%2!s!)pFjern filer, du ikke l",
        "Sajnos nem tudjuk meg",
        "saugoti ",
        "9%9*959@9E9Y9v9",
        "ci informacji",
        "i o cheie de produs Windows 10 valid",
        "GB. Atlasiet citu disku.",
        "re. Dette vindue lukkes automatisk om %1!d! minutter. Det skal du vide, f",
        "tta med installationen.`BitLocker-nyckeln ser ut ungef",
        " opravy, aktualizovan",
        "CloudE",
        "Atsipra",
        " napa",
        "%1!ld!%% termin",
        "t.gA telep",
        " Windows 10 este gata pentru acest PC. ",
        "=6=C=O=h=m=",
        "Za chwil",
        ", czy komputer jest gotowy do dalszej instalacji systemu Windows 10. Spr",
        " jour par le programme d'installation de Windows",
        "Du kan ikke angive kommandolinjeargumenter til installationsprogrammet. Du kan finde flere oplysninger i Hj",
        "i Ajutor instalare sau executa",
        "@@@   ",
        "n, tienes que crear y luego ejecutar los medios para instalarlo.$Sigue usando tu PC con tranquilidad.PError en la instalaci",
        "Es konnte nicht ermittelt werden, ob Windows 10 auf Ihrem Computer ausgef",
        "tter installationen av Windows 10 i Windows Update.UKonfigurerar uppdatering f",
        "r lite diskutrymme. Frig",
        "im datoram ieteicam",
        "n no pudo aplicar los datos de migraci",
        "wBNie mo",
        " utvide harddisken midlertidig mens oppdateringene installeres. Windows vil ikke formatere den eksterne lagringsenheten p",
        "&Zapri&Ra",
        "G@9_ t\\",
        "r derefter ",
        "2]2r2}2",
        "unar ",
        "ionale.&",
        "|l|||",
        "10 aktivovat.",
        "L$@WQ",
        " pronto per l'installazione",
        "040804B0",
        "Quer mesmo sair?",
        "hez m",
        " versij",
        "dzia na Twoim komputerze. Je",
        "cter restante1La clave de producto solo contiene 48 caracteres.JEl valor de la clave %d del grupo no es v",
        "czymy, powiadomimy Ci",
        "ta je potrebno da znate pre po",
        "Se pretende atualizar do Windows 7 ou Windows 8.1. ou se estiver a reinstalar o Windows 10, n",
        "ne pogoje, se bo namestitveni program zaprl.tZa zagon namestitvenega programa potrebujemo vsaj 350 MB prostora. Sprostite nekaj prostora in nato poskusite znova.7Windows Server 2019 pole veel selle arvuti jaoks valmis",
        "Provjera ovog klju",
        "ajte sa drugim klju",
        "Priprema nekoliko stvari%Ova alatka ne mo",
        "gle eller -licens for at aktivere Windows 10 efter opdateringen.",
        "Grabar el archivo ISO en un DVD",
        "i prov",
        "o quero usar armazenamento externo",
        "m papirkurven for ",
        " kompiuteris nutrukus bus paleistas i",
        "GetDC",
        ".&Precommit.cmd ",
        "nosti za ta ra",
        " palikti",
        "RDet gick inte att ",
        "= =$=<=X=h=p=t=x=|=",
        "><>p>",
        "lida. Experimente uma chave diferente ou compre uma nova.",
        "i da oslobodite %1!s! na disk jedinici %2!c!:.a",
        ".BHodnota kl",
        "izgiler otomatik olarak eklenir$Kurulum dil kaynaklar",
        "t aspo",
        "o podem ser mantidos porque sua vers",
        " znak.",
        "sti nezin",
        " PC pokrenuti Windows 10. Zatvorite program za instalaciju i poku",
        "jeleket nem kell be",
        ".?AV?$CUnknownImpl@VIDlpResponse@@@@",
        "mpa migreringsdata0Det gick inte att rensa upp installationsfilerna7Det gick inte att fastst",
        "e morate unijeti klju",
        "SelectUsbDrive",
        "7+7>7b7i7t7",
        "Odstranite spodnji zunanji pogon in kliknite ",
        "Le edizioni non corrispondono",
        "eW0D0",
        " Fortsett#Velg en annen ekstern lagringsenhet",
        " proizvoda nije ispravan. Ponovno unesite onaj koji ste kupili putem interneta.",
        "Las ediciones no coinciden",
        "charger l'outil de cr",
        "tzm-Latn",
        "installation ne peut d",
        "3Cette cl",
        "g0o0 ",
        "ke programe ure",
        ", uygulamalar",
        ",Estoy reinstalando Windows 10 en este equipo5Tengo que comprar una clave de producto de Windows 10",
        "in na koji Windows instalacioni program preuzima ispravke",
        "n att forts",
        "202;2K2`2r2|2",
        "Nichts0Sie k",
        " se, a",
        " conserver avec Windows 10 peut prendre un certain temps.",
        "n en la fase %1!s! con un error durante la operaci",
        "site naudotis kompiuteriu. Prie",
        "1C2P2y2",
        " informac",
        "Tas ilgs da",
        "ekivane pogre",
        "Windows Server 2019 y",
        "InstallNowOrLater",
        "Przenoszenie ustawie",
        "ja. A folytat",
        "in Windows",
        ".?AVCMoReserveManager@@",
        "WakeAllConditionVariable",
        "su PC datoru iepriek",
        "rkekood.",
        "ifrovania BitLocker",
        " dodane automatycznie'Klucz produktu zawiera tylko 25 znak",
        "rskendused, draiverid ja valikulised funktsioonid (soovitatav)",
        "Odabir slike",
        "rskenduste installimise ajal. Windows ei vorminda teie v",
        "Cambiar lo que se debe conservar",
        "s l'installation et que vous deviez r",
        "w: %d",
        "Error reporting telemetry for bHasSysSpace: [0x%X]",
        "&Terminer",
        " im Stammverzeichnis des Installationsmediums.",
        "ati kod sebe do ponovne prijave.-Nismo uspjeli instalirati Windows Server 2019NPC smo vratili na na",
        "Valg af drev1Installationsprogrammet rydder op, f",
        "5(5L5T5\\5d5l5t5|5",
        "Schalten Sie den Computer nicht aus",
        "Are you sure you want to quit?",
        "unar. Instalacija operativnog sistema Windows automatski ",
        "_XcptFilter",
        " Microsoft Corporation. Toate drepturile rezervate.",
        "CInstallUI::CInstallUIMessageWindow::ForceQuit",
        "c instal",
        "vHr,g)",
        "$Se creeaz",
        "rlaFBunu zaten dikkate ald",
        " poprv",
        "Les deux[Cette cl",
        "  &I want to help make the installation of Windows better",
        "teptat",
        "|k\"<B",
        ".?AVCInstallUI@@",
        " preinstall.cmd.:",
        ".aZapisovalnika DVD-jev ni bilo mogo",
        "avanju skripti preinstall.cmd.",
        "BitLocker-sleutel",
        "Segoe UI Symbol",
        "eSkipPkeySelected",
        "000ppp",
        " S mode. ",
        "aj za pohranu",
        "iniet darbin",
        "ms-MY",
        "3.3B3Z3o3",
        "c tam palaidiet setup.exe, lai ats",
        " esterna seguente, quindi fai clic su OK per riavviare e completare l'installazione di Windows.",
        "-lo.5Fique ",
        "'@DD`JJ````KKKKKKKK",
        " aspo",
        "DMape ",
        "mu Windows bude pokra",
        "Asenna %sJWindows k",
        "emo vam kada budemo gotovi i ",
        "A Windows Server friss",
        "Rengiame kelis dalykus.",
        " partir de Windows 7 ou Windows 8.1 ou si vous r",
        "CInstallUI::Initialize",
        "%d tecken kvar\"Bindestreck l",
        "0n0eQ",
        "CInstallUI::ShowCompatResolvedMessage: Posted MSG_INSTALLUI_SWITCH_TO_ERROR_PAGE",
        "kUTUUUUHUHHHHHHG9%$",
        "D$HPj",
        "ciu z Windowsu 7 alebo Windowsu 8.1., alebo ak op",
        "uW0~0W0_0",
        "zellikleri, geli",
        "Gravar o arquivo ISO em um DVD",
        "La actualizaci",
        " podmienky pre softv",
        " \"Setup.exe\" ",
        "Use um dispositivo externo, como um pen drive, um cart",
        "luseadet.",
        "1&1W1f1",
        " automaticky6In",
        "e en funci",
        "Arkitekturen samsvarer ikke",
        "Gebruik een extern apparaat zoals een USB-sleutel, SD-kaart of externe harde schijf om de harde schijf tijdelijk uit te breiden terwijl de updates worden ge",
        "s aktiv",
        "ckligt med utrymme\"Vill du forts",
        "Non sono riuscito a trovare le info necessarie per continuare l'installazione di Windows. Per riprovare, riavvia il programma di installazione.",
        "Algo impide que la instalaci",
        "lohujte.",
        "1/1b1}1",
        "iunile disponibile pentru a continua.",
        "ISO-bestand",
        "ana DVD disk",
        " Microsoft Corporation. Alle rechten voorbehouden.",
        " kart",
        "4%4,42474?4I4\\4",
        "Odpri/",
        "hrt werden.\"Sie f",
        "i suportul fizic de instalare ",
        "  %1!s! ",
        "Skriv inn produktn",
        " vain 48 merkki",
        "o limitada, verifique se isso resultar",
        "0*0S0k0",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::UpdateState",
        "%s er ikke et gyldig tegn",
        "adni a Windowshoz, a Windows telep",
        "Nothing1You will be able to manage your Windows settings.DYour settings and apps will be deleted, but your files will be kept.@Everything will be deleted, including files, apps, and settings.",
        "zca S modunda ",
        "Choose which media to use",
        "Seuraavat seikat kaipaavat huomiotasi, jotta voit jatkaa asennusta ja s",
        ";?;K;",
        "&Tastiera su schermo",
        "Kieli ei t",
        " palaikymo tarnyba ir nurodykite klaidos kod",
        "nak let",
        "^?42B`^GE@)q",
        "rez de l'espace ci-dessous, puis s",
        "glicherweise einige optionale Features und Sprachen neu installieren.&",
        "Checking this keyHThis key doesn",
        "n. Windows, harici depolama cihaz",
        "o preinstall.cmd1A executar scripts de implementa",
        "e se automatski zatvoriti za %1!d! min.$",
        "DDVD ",
        "\\!p@'2",
        "060O0",
        " rimovibili",
        "te nie",
        " rankiniu b",
        "0CQk0",
        "ver du en Windows 10-produktnyckel.",
        "MBitlocker ",
        "%3!s!4",
        ": A Windows 10 bizonyos funkci",
        "Windows privacy statement",
        "es para remover outros itens grandes./Selecionar Dispositivo de Armazenamento Externo",
        "cter restante1La clave de producto solo contiene 48 caracteres.LEl valor de la clave %d de grupo no es v",
        "\" )S6636i",
        " nei dabar naudojate ",
        "Vi beh",
        "InvalidateRect",
        "installation. Sinon, ex",
        "dzu, izlasiet ",
        "tIDATX",
        "dition de la version de Windows install",
        ".?AV?$CSetupResponseTemplate@VICompatActionResponse@@@@",
        "&Loobu",
        "uriranja: %1!d!%%&To bi moglo potrajati nekoliko minuta.",
        "-     ",
        "etka instalacije.(Postavljanje sustava Windows Server 2019:Ponovno pokrenite postavljanje sustava Windows Server 2019",
        "d nefunguje s t",
        "n timpul acestei actualiz",
        "Spremno za instalaciju",
        "lida com esta edi",
        "hrend des Vorgangs %2!s! ein Fehler aufgetreten.",
        "Tietokone k",
        "Odpowiednie uwagi i postanowienia licencyjne",
        "Server Workstation",
        "talujete Windows 10, zadanie k",
        "CSetupLangIniLoader::Initialize: Failed to get the language name: index = %d.",
        "bL'unit",
        "Client Workstation",
        "terminer si votre ordinateur est pr",
        ",Bindestriche werden automatisch hinzugef",
        "e koristiti samo za dodavanje funkcija u Windows. Ne mo",
        "klemesi beklenmeyen bir hatayla kar",
        "No pueden conservarse tus archivos, las aplicaciones y configuraci",
        "em PC-ju. Ako ",
        "re connected to the internet and try running the tool again.%There was a problem running this tool",
        "041804B0",
        "tor syst",
        "ete da presko",
        " ir maz vietas. Lai pabeigtu atjaunin",
        "202l2",
        "esar ne ohrani",
        "tt i Windows-installationsmediet och k",
        "henduse v",
        "N!k(W5u",
        ".?AVIDiskSpaceActionResponse@@",
        "sticas a Windows. No se puede usar para instalar Windows.",
        "gikast, et eemaldada kustutatud failid oma s",
        "ra; da",
        "Izberite pot",
        "re not sure what happened, but we",
        "lido. Introduza a chave correta6Introduza a chave do bit locker para o identificador: ,O Windows necessita de espa",
        "eEsta chave de produto (Product key) n",
        "e nekaj stvari. Ko bomo kon",
        "n Windows 10 -p",
        "s reinicia a instalaci",
        "enje failure.cmd+Ovaj postupak mo",
        "Impossible de continuer pour l'une des raisons suivantes :",
        "%\"rww'",
        "RtlDisownModuleHeapAllocation",
        "4 4$4,40484<4D4H4P4T4\\4`4",
        "dia d",
        "Mamy problemy z ustaleniem, czy system Windows Server 2019 jest ju",
        "lj extern lagringsenhet",
        "QQQQQj",
        "$`2X`F",
        "0g0Y0:",
        "313@3Z3h3",
        " arba nusipirkite nauj",
        "imo. Osve",
        "tja a licencszerz",
        "eQW0_0",
        "%1!s! %2!s!$Tietov",
        "ncias. Abra manualmente a pasta de transfer",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::GetError",
        "A transferir o Windows 10",
        "kos Windows 10 l",
        "n care era chiar ",
        "Please wait",
        "n de Windows. Prueba con una clave distinta.VEsta clave de producto no funciona. Vuelve a escribir la clave que compraste en l",
        "Den m",
        "@<88x",
        "lja a jelenlegi Windows-verzi",
        "%,,-N",
        "Ihr PC startet einige Male neu, was eine Weile dauern kann.",
        "n y vuelve a intentarlo.'Windows no est",
        "t able to download all of the necessary files. Make sure you",
        "unalnik, ki je zasnovan za delovanje v na",
        "k a g",
        "installation pourra reprendre.%Ce PC ne peut pas ex",
        "Kahjuks ei saa me kindlaks teha, kas teie arvuti sobib Windows Server 2019 k",
        " %2!c!:-drevet.",
        "o na m",
        "343P3T3X3\\3`3d3h3l3p3t3x3|3",
        "r en annan dator",
        "Architettura",
        "sokat.",
        ";J<c<",
        "hemalt %1!d! GB. Valige m",
        "Vyberte bitovou kopii, kterou chcete nainstalovat.",
        " vizual",
        "rio em (%2!s!)bRemova os arquivos desnecess",
        " 350 ",
        "iere pentru a v",
        "Operacijski sistem Microsoft",
        ". Atlaisvinkite ",
        "(BHLm",
        " recente~",
        "tte installationen.",
        " a licen",
        ".?AVCSetupCompatDlpResponse@@",
        "llapotba ker",
        "d chyby: 0x%x]0P",
        "WilError_03",
        "Pripravljanje ",
        "o e tente novamente.",
        "OD0D0_0`0Q0~0Y0",
        ">)>8>G>V>e>t>",
        "rifier la compatibilit",
        "Preden lahko izvedete posodobitev, moramo opraviti ",
        "rer.&Installasjonen av Windows 10 mislyktes",
        "ruotas veikti S re",
        "%2!s!0G",
        "daug 3 GB. Jei naudojate apskai",
        "NNeizdev",
        "yg{{k",
        "cznie polecenie %1!s!, aby otworzy",
        "6&6W6",
        "Instalar o Windows Server 2019",
        "sta na disku nem",
        " Opdater for at fjerne det fra listen.YDer opstod et problem, da vi fors",
        "kite ",
        "Kompatibilit",
        "r grupp %d ",
        "0~0g0",
        "i mai jos.",
        "%2!s!/Your organization manages your update settings.",
        "OWindows ",
        " bilgisayar",
        "emt.*Pras",
        ": %1!d! ",
        " (nebo si nainstalovat jinou edici), budete pot",
        " conecta",
        "Vonatkoz",
        "ker anv",
        "Operativni sistem Microsoft",
        " program se ukon",
        "Intet navn",
        "_c0f0",
        "Algo impide que contin",
        "_R=u_",
        "ivitykset on otettu k",
        "PW0f0D0~0Y0",
        "Windows 10-uppdateringTDet gick inte att visa lagringsanv",
        "me est survenu lors du t",
        "O(uW0f0D0j0D0",
        " naujinim",
        "i aktivovan",
        "DrawTextW",
        "Finn ut mer",
        "imli sme si, ",
        "ilitada, sest installite Windowsi v",
        "Unstaged Image",
        "o Windows 10 izdevumu, j",
        " bir DVD'ye manuel olarak yaz",
        "`_U(u ",
        "0g0W0_06",
        "4$4@4\\4`4d4p4t4|4",
        "r dileriz, bilgilerinizi daha sonra yeniden girmeniz gerekecek..Kurulum program",
        " list",
        "in %1!s! ",
        "  &Quero ajudar a tornar a instala",
        " disk. Syst",
        "&Telep",
        "@@@000@@@",
        "t lis",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::InitializeRoutine",
        " de unde am r",
        "vojiet vietu zem",
        "e obustavljena tijekom ovog a",
        "jak mer",
        "cessaire pour ex",
        "O(udkx",
        "Windows 10 installerenFDe pc wordt verschillende keren opnieuw opgestart. Dit kan even duren.+Setup wordt afgesloten, een ogenblik geduld",
        "Kontrollerer PCen",
        " tika p",
        "Mit dem Product Key stimmt etwas nicht. Bitte ",
        "diegus kompiuteris gali neveikti tinkamai, o jums gali reik",
        "Lo sentimos, tenemos problemas para determinar si Windows Server 2019 est",
        "mu Windows 10.",
        "uNon ",
        "=I=N=f=",
        "ny percig is eltarthat.lA Windows telep",
        ",p,..",
        "eoMD8_!",
        " moment",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::GetResults",
        "en aktiviran izvod sistema Windows 7 ali Windows 8.1. S klju",
        "SleepConditionVariableSRW",
        "ane mogu",
        " \"setup.exe\", ",
        "909@9P9T9l9p9t9x9|9",
        "%1!s! %2!s!,",
        "Actualise&r",
        "nchide instalarea.oAvem nevoie de cel pu",
        "jra kell indulnia. Az ",
        "r.)Installationen av Windows 10 misslyckades",
        "vat. Ne",
        "t, jo radusies k",
        "ynnist",
        "anu. Lai m",
        "FM&3ll",
        "aja za pohranu",
        "ar-SY",
        "sti ne",
        "ssen Sie die Infos sp",
        ".?AV?$CZeroInit@VCSetupResponsePageSysReq@@$00@@",
        "na kontynuowa",
        "me est survenu lors de la tentative de r",
        "Windows 10 wird heruntergeladen",
        "imu. Odaberite ovo izdanje samo ako Windows instalirate na ra",
        " le re",
        "ene postavke koje su bile pode",
        "&Recusar:Se voc",
        "PPP@@@",
        "g_U(u",
        "Prehl",
        "Ogiltigt dialogrute-ID&Det gick inte att hitta licensavtalet.",
        "Nezabudnite na nasledovn",
        "base\\ntsetup\\conx\\common\\setuplib\\src\\osinfo.cpp",
        "ajte ponovno pokrenuti alat.,Pojavio se problem prilikom kori",
        "n (unidad flash USB, DVD o archivo ISO) para otro equipo",
        "Als Administrator anmeldenaUm dieses Tool zu verwenden, m",
        "8M8]8i8",
        "ke programe i opcionalne funkcije. Ove ispravke ",
        "#Tn! {[",
        "re, f",
        "Niets'U kunt uw Windows-instellingen beheren.NUw instellingen en apps worden verwijderd, maar uw bestanden blijven behouden.BAlles wordt verwijderd, inclusief bestanden, apps en instellingen.",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::GetResponseId",
        "iska. Ak chcete otvori",
        "en-AU",
        "&Dalej",
        "te instalarea Windows Server 2019",
        "tlZ^+",
        "&Sulje.Tietokone k",
        "0MRk0",
        ">:>]>",
        "unuz y",
        "hnout aktualizace, ovlada",
        "5?6j6",
        "Si vous installez pour la premi",
        "teva lucruri)Acest instrument nu poate actualiza PC-ulqLimba sau edi",
        "r i gang.",
        " Windows.S",
        "ifra proizvoda",
        "ak za",
        "o.cPrecisamos de pelo menos 350 MB de espa",
        "uriranu alatku za kreiranje medija",
        "tsa el a nagym",
        "o utilizados da pasta Transfer",
        "ni od za",
        "\"Microsoft szoftverlicenc-szerz",
        "@@@@@@@@@@@@@@@@@@@@@",
        "r Windows 10 m",
        "edldGDlVwg",
        "kkel.HDenne produktn",
        "kat m",
        "ste znova.1Windows Server 2019 ",
        "Valami baj t",
        " ponad 4 GB danych (ilo",
        "9++++++++++0",
        "NW0_0",
        "est produit lors de la tentative de r",
        "ppp@@@@@@@@@@@@@@@",
        "l a Windows Server 2019 telep",
        "lectionnez ou connectez un p",
        "Nastavi tamo gdje sam stao",
        " Windows Server",
        "au moins 350 Mo est n",
        ".?AVCDialog@@",
        ";/<K<W<Z=a=",
        ", czy na Twoim komputerze mo",
        "i o cheie de produs sau o licen",
        "xNu putem spune dac",
        "ti apsaugoti savo duomenis, tur",
        "Abrir gravador de DVD",
        "-IDATX",
        "Verificando esta chaveNEsta chave n",
        "aj za skladi",
        "i instalacijske datoteke za Windows. Umetnite instalacijski medij za Windows, a zatim pokrenite \"setup.exe\" da biste nastavili instalaciju.",
        "m Windows 10 zat",
        " sur cet ordinateur et si vous le r",
        "Pobrane1Usu",
        "s a szem",
        "ga Windows",
        "COPY_PAYLOAD",
        ".UUSB zibatmi",
        "t be kept because you",
        "rangos licencijos s",
        "Czekaj>Wyst",
        " crittografata con BitLocker. Scegli un'altra unit",
        "rsler manuelt.VDvd-br",
        "Aktualizacje s",
        "%%%d tamamland",
        "?\"?1?@?V?",
        "70o0}0",
        "o do Windows 10 configurar",
        "N!k(W",
        " un autre emplacement.",
        "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8|8",
        " Windows 10H",
        ">s?x?",
        "%c:@PC ",
        "%c:<Your PC will restart several times. This might take a while.",
        "Juridisk information",
        ". Bu durum, Windows 10 ",
        "ljivega prostora. Izberite drug pogon in poskusite znova.7Nato vam bomo pomagali sprostiti %1!s! na pogon: %2!c!.wKui soovite installida Windows 10 m",
        "gle til Windows 10.",
        "liorations de s",
        "Pokud chcete pokra",
        "Transferir3Conserva los archivos personales y las aplicaciones8Conservar configuraci",
        "```@@@",
        ".?AVCSetupResponseSelectUsbDrive@@",
        "LW~U~UUUUHUUHOHUHHGGEH%p",
        " a activa versiunea curent",
        " kompiuteryje. Jei problemos kartosis, susisiekite su klient",
        "trzne urz",
        "gi komandrindas parametri",
        "INFORMACI",
        "br-FR",
        "Die neuesten Features und Sicherheitsverbesserungen von Windows 10 k",
        "isel bilgisayar",
        "Sorun giderme ipu",
        "to oper",
        "%1!ld!%% ",
        "BitLocker-beskyttelse suspenderes under denne opdatering og forts",
        ":,:<:L:P:T:X:\\:`:d:x:|:",
        "charger la derni",
        "installation de Windows 10 doit red",
        "Soutien",
        ", SD kartica ili vanjski tvrdi disk da biste privremeno pro",
        " Windows ",
        "Posodobitve so uveljavljene",
        "karabilirsiniz./Gereksinimler tamamland",
        "ne 3 GB. Ak pou",
        "cuter le m",
        "diegti kitame skaidinyje, turite sukurti ir tada paleisti laikmen",
        "USB-flashminnet ",
        " volite",
        "i je mo",
        "z futtat",
        "i da instaliranje pro",
        "464L4Z4g4v4",
        "ou. Pokud je chcete zachovat, n",
        "li nadal b",
        "charger les mises ",
        "dition diff",
        "Sisestage tootev",
        "r et par ting klar",
        "+Windows Update ",
        ".?AVCSetupResponsePageEula@@",
        "\"zCGg",
        "Precisamos fazer mais algumas coisas antes da atualiza",
        "Windowsi installifaile ei leita. Sisestage oma Windowsi installikandja ja seej",
        "Wir ben",
        "Que voulez-vous faire?",
        " toliau nurodytus dalykus.",
        "ili#Nie s",
        "Brug en ekstern enhed, f.eks. en USB-n",
        "Kontrola kl",
        "hilduvuse kontrollimine v",
        "pl-PL",
        " tieto probl",
        " inserir suas informa",
        "Kan ikke lagre installasjonsinformasjonen som kreves for ",
        "tita bit ",
        "utiliser. Choisissez un autre lecteur et essayez de nouveau.HNous allons maintenant vous aider ",
        "ajte ponovo da pokrenete instalaciju.3Utvr",
        "ajte in",
        "ti, mille ostsite v",
        "renginio. ",
        "(Instalowanie systemu Windows Server 2019",
        "MulDiv",
        "Kontrollerer om du er klar for installasjon",
        "pe. Klikk p",
        "i nainstalovanou aktivovanou kopii syst",
        " simile all'esempio seguente: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX8La chiave BitLocker contiene solo 48 caratteri digitali.",
        "tsa el ",
        "88882200..",
        "czaj komputera",
        "Operatsioonis",
        " BitLocker. ",
        "Az USB flash meghajt",
        "k iestat",
        "unar dok se operativni sistem Windows instalira. Sa",
        "tn-ZA",
        "installation de Windows. Red",
        "stan klart",
        "Si vous installez Windows 10 sur votre PC pour la premi",
        "nytelen karakter",
        "jumos, lai no",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::GetState",
        "az-Latn-AZ",
        "rile. Windows nu va reformata dispozitivul de stocare extern ",
        " Graver le fichier ISO sur un DVD",
        "\\D~bx",
        "&Kabul Et",
        " skriptov preinstall.cmd sa vyskytol probl",
        "iuo metu j",
        "ri acum, este posibil ca PC-ul s",
        "installation de Windows 10 dans Windows Update.aConfiguration de la mise ",
        "Aktualizace jsou aplikovan",
        "r datorn nu",
        "CStaticEx",
        "Windows Server 2019:n asennus7Windows Server 2019:n asennusta k",
        "a pas fonctionn",
        "ntat fel uppstod under installationen av Windows.",
        ";%;V;",
        "Deja, kyla problem",
        ".(PC ",
        "jumi tiek lietoti\"Nav pieejams neviens atjaunin",
        " izdelka za Windows 10",
        "999s9",
        " BitLockerrel van titkos",
        " jour maintenant, il se peut que votre PC ne fonctionne pas correctement apr",
        "nnnjL",
        "vTTTJJ",
        "Buscando actualizaciones!Buscando actualizaciones: %1!d!%%!Esto puede tardar varios minutos.",
        "t have enough space available. Choose a different drive and try again.9Next, we will help you free up %1!s! on the %2!c!: drive.",
        "yla e",
        "tiski; atbalsts da",
        "t, jo j",
        "r du ",
        "rieurement.",
        "Ne asigur",
        "O0S0h0L0g0M0~0[0",
        " jau parengta j",
        "installer.*Vous pouvez continuer ",
        "rification de votre PC:V",
        "ykite ir u",
        "u sa ",
        "lnit o eroare nea",
        "Aby uzyska",
        "angios aparat",
        " svoje nastavenia Windowsu.BVa",
        "sek, illeszt",
        "hnout a spustit nejnov",
        "\"'DaX",
        "nt lemezk",
        "CSetupResponsePageGated::OnInitDialog",
        "setup.exe",
        "ye yaz",
        "%1!d!%% terminatdAceast",
        "Nenhuma atualiza",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::GetError",
        "jEVh(",
        "Nagraj plik ISO na dysk DVD",
        "(%1!c!:) - %2!s! gratuit",
        " aktualizace na Windows",
        "Ladda ned den senaste versionen av Windows",
        "s(Wn0 ",
        "tartuje",
        "ija, pievienojiet datoru ener",
        "ppp@@@@@@@@@@@@@@@@@@",
        "<5<G<l<",
        "Saiba mais",
        "schte Dateien vom Systemlaufwerk zu entfernen.",
        "ppna2Jag vill anv",
        "Langpacks",
        "De installatie wordt voorbereid",
        " na pozad",
        "-lo ap",
        "iame kompiuteryje negalima paleisti ",
        "hoz: 7A Windowsnak szabad helyre van sz",
        " nustatant, ar j",
        "(A reiniciar a Configura",
        "=&=m=",
        "Teie faile, rakendusi ja s",
        "na) i mog",
        "nt meghajt",
        "una benzer: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXLY",
        " tiedostot, varmuuskopioi ne nyt toiseen tallennussijaintiin.",
        "bb %1!d! GB-osnak kell lennie. V",
        "la langue est incompatible ;",
        "ifra proizvoda funkcioni",
        "Izjava o za",
        "9^,uq",
        "Bevar personlige filer og apps/Bevar Windows-indstillinger og personlige filer",
        "riista uuem versioon on saadaval. J",
        "dition",
        "e vam pomo",
        "Que voulez-vous faire",
        "RadioButtonClicked",
        "Voici quelques instructions ",
        "Operativni sistem:",
        "Izberite posnetek, ki ga ",
        "Bitlocker anahtar",
        "Nema dostupnih a",
        "c w pobraniu najnowszych plik",
        "atlikta %d%%",
        "t:SSSj",
        "&Annuler",
        "tre supprim",
        " plik ISO na dysk DVD.",
        "> >&>+>6>A>U>",
        "``\\\\\\R",
        "installation (cl",
        "pet.SA telep",
        "pertoire non pris en charge ou vous tentez d",
        "iile despre instalare de care avem nevoie pentru a continua instalarea Windows. Reporni",
        "n.+Requisitos completados. Presiona Continuar.0Elige otro dispositivo de almacenamiento externo",
        " cont",
        "8(8S8c8p8}8",
        "Wybierz elementy do zachowania",
        "istenie",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::Serialize",
        "tor neakceptuje argumenty pr",
        "Source OS: Host SKU Info: Edition = '%s', Edition Type = '%s', Installation Type = '%s', Product Name = '%s', Arch = %s, StationType = %s, Stage type = %s",
        "495a5",
        "dia para instal",
        "3O3{3",
        "%2!s!7Nastaven",
        "%hs: Generating compat report.",
        "uk-UA",
        "talujete in",
        "r inte att hitta installationsfilerna f",
        "Dyski wymienne",
        "t tell if your PC has enough space to continue installing Windows Server 2019. Try restarting Setup.",
        "%s: Leaving Response Execute Method",
        "%s\\%s\\%s.mui",
        "e la instalaci",
        "s conectado a Internet e intenta ejecutar la herramienta de nuevo.-Hubo un problema al ejecutar esta herramienta",
        "At&naujinti",
        " nepot",
        "{LAbPkk",
        "pna edycja systemu Windows zgodna z wprowadzonym kluczem produktu.",
        "lastage: %1!s!",
        " kodas veikia! T",
        "avanje problema",
        "vel encontrar os ficheiros de instala",
        "i osobne datoteke i aplikacije",
        "k. Ind",
        "nnen Ihren PC weiterhin verwenden.qDie Installation war nicht erfolgreich. In der Phase %1!s! ist w",
        "*=@-\" \"",
        "042204B0",
        "ation de supports mis ",
        " tohto n",
        "cy format: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX.Klucz funkcji BitLocker zawiera tylko 48 cyfr.",
        "PREPARE_SECOND_BOOT",
        "n de Windows actual usando una clave de producto y despu",
        ".?AV?$CUnknownImpl@V?$CUnknownImpl@UIUnknown@@@@@@",
        "eQKN\"u",
        "o determinou as op",
        "kkelen inneholder bare 25 tegn.",
        "Ne oldu",
        "&Uppdatera",
        "rymmy",
        "T3^6b{veQ ",
        "mto n",
        "Consulta: %1!s!",
        ": %1!d!%%(",
        "&Kontynuuj%Zainstaluj system Windows Server 2019",
        ". Znamen",
        "lg billede",
        "Ohrani le osebne datoteke",
        "re fois (ou si vous installez une ",
        "iu-CA-Latn",
        "nEEl programa de instalaci",
        "9@==??<42",
        ": XXXXX-XXXXX-XXXXX-XXXXX-XXXXXTL",
        "ili a",
        "Si vas a instalar Windows 10 en tu equipo por primera vez (o si vas a instalar una versi",
        "ppp@@@@@@ppp",
        "A Windows 10 ezen kiad",
        "+++qP",
        "n aktiv",
        "un &daha iyi y",
        "szymi instrukcjami, aby zako",
        "8 8%818x8",
        "%1!s! %2!s!-",
        "rtve a f",
        "lja. Amikor legk",
        "ties tie",
        "ilor%Trebuie s",
        "map/set<T> too long",
        "Mimari e",
        "z gerekir.0G",
        "lj den avbildning som du vill installera.",
        "smn-FI",
        "6!7^7f7l7",
        "7T8o8{8",
        "@Qm6t",
        "Tenemos que hacer algunas cosas m",
        "uriranja odmah, va",
        "0J0Kb",
        "ie inform",
        "tLVVVW",
        "ena v va",
        "zda Windows Server 2019",
        "istenie disku, manu",
        " cuidou disso. Clique em Atualizar para remov",
        "505E5J5c5y5",
        " proizvoda sustava Windows 10.",
        "&Sluiten(Windows 10 kan niet worden ge",
        " megjegyz",
        "me se, ale neda",
        " jour. Nous vous aviserons lorsque ce sera termin",
        "ge lesz megadni a Windows be",
        "cio da instala",
        "t activated on this PC. This means you",
        "Vi vet ikke om PCen har nok ledig plass til at installasjonen av Windows 10 kan fortsette. Pr",
        "ati kompatibilno sa sustavom Windows 10.",
        ".?AVCSetupResponsSelectWebDownloadImage@@",
        " Bitlocker pour l",
        "n de %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml para solucionar el problema y ejecuta el programa de instalaci",
        "marrage effectu",
        "$Dispositivo di archiviazione esterno",
        "&Acceptera",
        "Radusies probl",
        ":O:Z:",
        "ll need to enter the Windows 10 product key below or exit setup, activate Windows, and then start setup again.",
        "Licentievoorwaarden",
        ">k?r?",
        "no z datotekami, aplikacijami in nastavitvami.",
        "Presque termin",
        ":N:l:>;S;p;",
        "pt online igen.",
        "k ihtiyac",
        "ts&Tiek p",
        " girmeniz gerekir.",
        "6 6(60686@6H6P6X6`6h6",
        "Install Windows 10*Get updates, drivers and optional features",
        "es em %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml para resolver o problema e execute novamente a Configura",
        "%c:4PC sa nieko",
        "o antigos",
        "marrer le programme d",
        ".?AVIDlpResponse@@",
        "Utgave",
        "bnes. K",
        "unom.+Datoteko ISO boste na DVD zapisali pozneje.",
        "(Pers",
        "kalu ei pysty p",
        " asennat Windows 10:n uusimman version.",
        "inde Windows Server 2019",
        "re version de Windows",
        "lista friss",
        "  Windows ",
        "hlen Sie die Partition aus, auf der Sie Windows installieren m",
        "Disk alan",
        ";&;<;S;c;w;",
        "m sa ukon",
        "Esto puede tardar unos minutos.",
        "z denetleniyor&Y",
        ".2Uvoln",
        "ierul ISO pe un DVD",
        "ndirmeler klas",
        "Need v",
        "ine doar 48 de caractere.BValoarea cheii de grup %d este nevalid",
        "<0<L<d<",
        " vain omat tiedostot",
        "z}}MM",
        "a no se agote durante la instalaci",
        "0@O$A0",
        "lt megnyitni a DVD-",
        "Programa de instalaci",
        "8/8S8",
        "Setup360",
        "Naujinant, BitLocker",
        "lv|vx",
        ";#;C;P;j;",
        "Wechseldatentr",
        "hem instalace Windows nebudete moct po",
        "iki vajalikke faile ei saanud alla laadida. Veenduge, et teil on ",
        "e da a",
        " velk",
        " verificato un problema durante l'esecuzione degli script precommit.cmd.",
        "Start over from the beginning",
        "lasszon m",
        "SetupDiGetClassDevsW",
        "Obtention des mises ",
        "_initterm",
        "cej informacji, zobacz Pomoc Instalatora lub uruchom polecenie ",
        "odo suportado; o suporte pode variar consoante o dispositivo.",
        "FFLdl|h",
        "talujete Windows 10 na tomto po",
        "sik kulccsal.?A term",
        "z saklanam",
        "6Ponownie instaluj",
        " verze Windows 10",
        ".rdata$brc",
        "r dysku6Instalator przeprowadza oczyszczanie przed zamkni",
        "?8?@?H?P?X?h?",
        "ma Microsoft",
        "iz.`Windows 10 i",
        "ni muu draiv ja proovige uuesti.5J",
        "bbit v",
        "n de su PC(Comprobando que est",
        " 350MB",
        "luk biztons",
        "in prije po",
        "jjk%jjk`jjk",
        "t (USB flash drive-ot, DVD-t vagy ISO-f",
        "te a zav",
        "~~~~U~U~UUUO",
        "0g0o0",
        "jra elind",
        "tirmeler uyguland",
        "-billenty",
        "%1!s! %2!s!/Der opstod et problem under oprettelse af medie",
        "inoti prie",
        " disku.",
        "te problem",
        "vrstog diska, za privremeno pro",
        ".?AVCSetupResponsePageInstallChoice@@",
        "o ste sa rozhodli:",
        ".?AVCStatic@@",
        "%1!d!%% conclu",
        "ivitub mitu korda. See v",
        "r %1!s! p",
        " bu g",
        "s onnan, ahol abbahagytam",
        " indirmeniz ve ",
        "avons trouv",
        "Inform",
        "Condizioni di licenza",
        "ustute.",
        "<$<4<8<H<L<P<X<p<t<",
        "kkelenKDenne n",
        "i scoate dup",
        "tfen do",
        "304\\4",
        " cump",
        "&Koda napake: 0x%1!lX! ",
        "9)9B9",
        "&Friss",
        "&t_Dz",
        "Termes de la licence",
        "n de medios",
        "Il programma di installazione non accetta gli argomenti della riga di comando. Per ulteriori informazioni, consulta la Guida del programma di installazione o esegui il comando \"setup.exe /?\" nella directory radice del supporto di installazione.",
        "Az al",
        "ArEhje4+BLT",
        "PPP@@@ppp",
        "kkel, eller kj",
        "^Yo[?67EdoY^",
        " pronto para come",
        "ntalo de nuevo.",
        "r9dQk",
        "dami kartoti, pasirinkote:",
        "Instaliraj %s>Windows ponovo pokre",
        " na no",
        "|||R|RSQ|QSM\\",
        "initi?",
        " Windows Server 2019.J",
        " nejnov",
        "Zas&lonska tipkovnica",
        "b lehet",
        "n tanto la configuraci",
        "r att forts",
        ".)Tikrinama, ar kompiuteryje u",
        "e koristiti za instalaciju sustava Windows.",
        "riques mis ",
        "iRYO ",
        "t be able to use your PC while Windows installs. Save and close your files before you begin.0Please wait while the app finishes uninstalling.",
        "C&lose",
        "Something is preventing the installation to continue. Review the information in %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml to resolve the problem and run Setup again.\\For more information on upgrading Windows Server, visit: https://aka.ms/windowsserverupgradezSorry, we",
        "u ilk kez y",
        "leg nem t",
        "0~0Y0L0",
        "e ponovno pokrenuti ra",
        "System Windows nie zosta",
        "kejte pros",
        " reikia pa",
        "1K1d1y1",
        ".?AVCSetupResponsePageSysReq@@",
        "initialisation du r",
        ", czy ",
        " la versione corrente di Windows potrebbe essere installata in una directory non supportata o stai tentando di installare una versione precedente di Windows.cLo spazio nell'unit",
        "En savoir plus",
        "~!IN ",
        "lassza a Friss",
        "tu atjaunin",
        "ena v nepodprtem imeniku ali pa posku",
        "sbNem siker",
        "Draivi valimine(Installiprogramm puhastab enne sulgemist",
        "CSetupResponseTemplate<class ICompatActionResponse>::ExecuteRoutine: Cancel button clicked.",
        "ivitada. Kui probleemid j",
        "ste in",
        " PC-ul dvs. are suficient spa",
        "te moment",
        "te treba vykona",
        "&Peruuta",
        "c pierakst",
        "V8_^j",
        "cution9Scripts de d",
        "&Fullf",
        ".(De oudere installatiebestanden gebruiken",
        "VNem siker",
        ", DVD-",
        "s de iniciar sesi",
        "a do Windows 10 para ativar o Windows 10 depois da atualiza",
        "jmm}yy",
        "ti taikomi duomen",
        "Angiv, hvad du vil beholde",
        " mevcut. Devam etmek i",
        "n nem siker",
        "CSetupResponseTemplate<class ICompatActionResponse>::InitializeRoutine",
        "CSetupUIManager::OnSetupPostReboot",
        "  &Doresc s",
        "Lea atentamente esta informaci",
        "nda muud tootev",
        "o de privacidade do Windows",
        "KN9m(i",
        " tvarkykles ir papildomus failus, kuri",
        "unalnik do ponovnega vpisa pri sebi.",
        "ane.ASve ",
        "lreiz, restart",
        "im ste se strinjali.",
        "Zunanja naprava za shranjevanje",
        "8@9N9W9`9i9",
        "o pretendo utilizar armazenamento externo",
        "Progreso: %1!d!%%:Selecciona una de las opciones disponibles para continuar.",
        "4Licen",
        "ra om datorn kan forts",
        "my.BAk chcete pokra",
        "kalua, sinun on oltava kirjautuneena Windowsin j",
        "dOJJ@=%\"\"\" \"!  *",
        "re connected to the Internet and try again.)Running preinstall.cmd deployment scripts(Running precommit.cmd deployment scripts&Running failure.cmd deployment scripts",
        "&Manter ficheiros e aplica",
        "Nieko,Gal",
        "ll let you know when we",
        "kkulcs",
        "te si st",
        "Nekas-Var",
        " se skripty nasazen",
        "Ovo preuzimanje u pozadini mo",
        "te a zatvorte.-Po",
        "aPTa klju",
        "n y prueba otra vez.uEl programa de instalaci",
        "kkel'Skriv inn Bitlocker-n",
        "bory Windowsu. Na pokra",
        " disponible si tienes una copia activada de Windows 7 o Windows 8.1 instalada en tu equipo. Activa tu versi",
        "rizhesse Windows-be",
        "in yeterli alan olup olmad",
        "berom niektorej z dostupn",
        "!{(g%k",
        "jumus nevar saglab",
        "j til medieoprettelse",
        "tinkite ",
        "zben. Friss",
        " BitLocker deluje. Nadaljujte, ko boste pripravljeni.",
        "Als Windows 10 ooit eerder is ge",
        "t pro",
        "ts ar BitLocker. Izv",
        "BNie mo",
        " installasjonsmediet. Hvis du ikke installerer disse oppdateringene n",
        ", pero no pudimos ejecutar esta herramienta en el equipo. Si sigues teniendo problemas, ponte en contacto con el soporte t",
        "cej informacji",
        "anas skriptu failure.cmd izpilde",
        "Pokud jste Windows 10 na tomto po",
        "rwwokk",
        "Palaukite2I",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::DeserializeRoutine",
        "ana-Windows Server 2019 iestat",
        "sok megtart",
        "EnableWindow",
        "818@8",
        " nous nous sommes arr",
        "kkelen virker ikke med denne Windows-utgaven. Pr",
        "ValmisteleZOlet jo ratkaissut t",
        ", tada bandykite dar kart",
        "Betriebssystem:",
        "__RTDynamicCast",
        "Saklamak istediklerinizi se",
        "Eine neuere Version dieses Tools ist verf",
        "Pre toto PC pou",
        " v slu",
        " nu instala",
        ", turime atlikti dar kelet",
        "%MB=:4",
        ": XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX2",
        ". Nor",
        "rskenda.",
        "!kx0(",
        "es importantes, controladores de dispositivo atualizados e ficheiros adicionais que n",
        " dabartin",
        " jednotky",
        " lehet.",
        "tu turpin",
        "Se continuar sem ativar sua vers",
        "es do Windows e ficheiros pessoais",
        "1J2o2",
        "Tikrinama, ar esate pasireng",
        "This may take a few minutes.",
        "i popis pogona",
        " limpiando antes de que se cierre",
        "o do Windows baixa atualiza",
        "mentaires qui ne sont pas pr",
        "onnistui. Avaa levyn uudelleenj",
        " jour&Se connecter en tant qu'administrateur]Afin d'utiliser cet outil, vous devez vous connecter ",
        "Du beh",
        "eW0_0h0S0",
        "alinti.*Reikalavimai patenkinti! Paspauskite T",
        "ier ISO",
        "CSetupResponseTemplate<class IDiskSpaceActionResponse>::OnSuspend",
        "ja-JP",
        "cie n",
        "i samo li",
        "WmsgPostNotifyMessage",
        "kerhetsf",
        "kam si je zaz",
        "XBu arac",
        "gra minuter.",
        " Bitlocker",
        "CB[[5",
        ", poniewa",
        "&I want to help make the installation of Windows better",
        "dik. Adjon meg m",
        "s aktiviz",
        "Introduzir Chave de Produto",
        "=5>Q>s>",
        ">->F>^>",
        "Niente5Potrai gestire le impostazioni di Windows in seguito.JLe impostazioni e le app verranno eliminate, ma i file verranno mantenuti.8Verr",
        " atmintin",
        ", reikia i",
        "Log p",
        "uW0~0W0_07",
        " flash USB.",
        "&Suivant",
        "tk-TM",
        "De Windows-installatiebestanden zijn niet gevonden. Plaats het Windows-installatiemedium en voer setup.exe uit om de installatie te hervatten.",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::ExecuteRoutine",
        "sO?599y",
        "va) beh",
        "CSetupLangIniLoader::Initialize: Adding language: index: %d",
        "ce, na kt",
        "yeSSS",
        "Espace insuffisant/%1!d! Go d",
        "iniz resmi se",
        "Izbiranje pogona9Namestitveni program izvaja ",
        "9;:B:H:M:Y:e:y:",
        "rification que vous ",
        "n directorul r",
        "Ay,SO",
        "akovane napake. Preverite, ali je mogo",
        " Internet et r",
        "uW0_0_0",
        "1dbbB",
        "sek telep",
        "ter v",
        " di Windows 10 ",
        "j kan ikke opdatere din pc",
        " skriptov precommit.cmd sa vyskytol probl",
        "Ett ok",
        "zda bulundurman",
        "sticas e idiomas opcionales.,Utiliser les anciens fichiers d",
        "borov, aplik",
        "1 character left,The product key only contains 48 characters.7Group %d key value is invalid, please input correct key0Please input bit locker key for the identifier: ",
        "jams, ir instal",
        "elite odstraniti izbrisane datoteke s sistemskega pogona, izpraznite ko",
        "nom m",
        "Windows Server 2019 installeren",
        "l kell gondoskodnia ahhoz, hogy a telep",
        "u trva",
        "[V[[MVMMMOJO>O",
        "UNKNOWN",
        "Asenna Windows 108Hanki p",
        "kledi",
        "tier du DVD ou dans votre courrier ",
        " OK, ",
        "to se dogodiloMDa biste instalirali Windows 10, kliknite Setup.exe na instalacijskom mediju.",
        ".EVotre cl",
        "r du g",
        "INSTALLATIONSOPLYSNINGER: Visse Windows 10-funktioner kr",
        " vos fichiers.JTout va ",
        "Takoj nadgraditi ta ra",
        "#Vi kan ikke finde et USB-flashdrev.",
        " za BitLocker ime le 48 digitalnih znakov.",
        "y zalogowa",
        "u zna",
        "nnare",
        "in Yenile",
        "i %1!s! pe unitatea %2!c!:.d",
        "Anscheinend verwenden Sie ",
        "got USB-flashminne.",
        "Accedi come amministratorebPer usare questo strumento, devi avere eseguito l'accesso a Windows con un account amministratore.=Sar",
        "Versjonene samsvarer ikke",
        "est pass",
        "tirmelerini y",
        "na zaktualizowa",
        "Draivi valimine",
        "%Programa de instalaci",
        "iului de stocare. Deschide",
        "ne faili allalaadimisel ilmnes probleem",
        "Najnovej",
        "os failus, tagad dubl",
        "vel instalar o Windows Server 2019_O computador foi definido com o estado anterior ao in",
        "A preparar %d%%",
        "Aguarde7Ocorreu um problema ao executar scripts preinstall.cmd.6Ocorreu um problema ao executar scripts precommit.cmd.",
        "anas viet",
        " Umowy licencyjnej.",
        "Musimy zrobi",
        "CreateCompatibleDC",
        "Informacje prawne",
        " stato interrotto.9Non ",
        " nytt for at de skal fungere. N",
        "o guarde nada",
        "e biti obustavljena tokom ovog a",
        "uriranja, ali nastavit ",
        "stra set",
        "What needs your attention",
        "om aktu",
        "0P1`1m1z1",
        "uSorry, but we're having trouble determining if Windows 10 is ready for your PC yet. Please close Setup and try again.&Windows 10 isn't ready for this PC yet*Making sure that the installation is ready",
        "Mais informa",
        "rstu probl",
        "%d%% completado",
        "Ye&nile",
        " tutmak i",
        "Ako je",
        "a poate varia ",
        "vel continuar devido a uma das seguintes situa",
        "sst8{{|",
        "Sto preparando %d%%(Sto trasferendo le tue impostazioni %d%%",
        "nd Diskrensning f",
        ": %d ",
        " Microsoft Corporation. Todos los derechos reservados.",
        "tre r",
        "aj kao ",
        "tirmeler, y",
        " gotowy dla Twojego komputera. Zamknij Instalatora i spr",
        "Rozpocznij od pocz",
        "pne Lagring manuelt i Innstillinger.4Kan ikke ",
        ".~*N,",
        "%2!s!2",
        "Ho applicato gli aggiornamenti\"Non sono disponibili aggiornamenti",
        "}}#^80",
        "bs-Latn",
        "ne poprawki, zaktualizowane sterowniki urz",
        "Windows 10. Pokud chcete m",
        "o de problemas",
        "va vyhraden",
        "n PC-j",
        "Configurazione completataAVerr",
        "jums ir pieejams tikai tad, ja j",
        "to niste aktivirali trenutnu verziju operativnog sistema Windows, mora",
        "j komputer ma wystarczaj",
        "$).:z",
        "0j0D0g0O0`0U0D06",
        "gend Speicherplatz vorhanden. W",
        "Niet nu",
        " Windows uzst",
        " valod",
        "Ne najdemo klju",
        "sitsi.YSalvestusruumi kasutuse avamine nurjus. Kettapuhastuse avamiseks k",
        "o estar conclu",
        "Der Key wird ",
        "iatku",
        "Install %s<Windows is restarting the computer to continue installation.",
        "klemenizi devam ettirmek i",
        "yet for oppretting av medier",
        "R^;}H",
        "n elt",
        "n de su PC",
        "bnes. Br",
        "FveRemoveTrustedWimData",
        "ciu syst",
        " kohteita",
        "m na Dal",
        "rio sem suporte ou voc",
        "[/f&T",
        "i PC-ul ",
        "%s GBpWe kunnen niet bepalen of de pc voldoende ruimte heeft om Windows 10 verder te installeren. Start Setup opnieuw.9Controleren of de pc over voldoende vrije ruimte beschikt\"Wilt u doorgaan met deze selectie?",
        "ServerDatacenter",
        "rbaudiet to un m",
        "tres, car vous avez peut-",
        "<$<?<e<",
        "votu vietu, un p",
        "bb DVD-re kell ",
        "As edi",
        "i. Kahjuks peate teabe hiljem uuesti sisestama.8Installiprogrammil nurjus migreerimisandmete rakendamine5Installiprogrammil nurjus installifailide puhastamineCInstalliprogrammil nurjus toetatud installimisvalikute m",
        "skavaj",
        "^BitLocker ",
        "ya girmeniz veya kurulumdan ",
        "Herunterladen*",
        "a ni bilo mogo",
        "pne,Jeg vil bruke ekstern lagringsplass i stedet\"Jeg vil ikke bruke ekstern lagring",
        "#Foutcode: 0x%1!lX! - 0x%2!lX!",
        "elite koristiti",
        "CProductKeyEdit",
        "dkHr,g ",
        "hu instalace a m",
        ">&>6>d>}>",
        "#Feilkode: 0x%1!lX! ",
        "D$(f;",
        "rberedelser g",
        "Wijzigen hoe updates worden gedownload met Windows Setup",
        "rolt kulcsot.",
        "QFailed to open your Downloads folder. Please manually open your Downloads folder.RFailed to open DVD burner. Please manually burn the ISO file to a DVD using %1!s!.",
        ">H>\\>i>p>}>",
        "< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\\<`<d<h<l<p<t<x<|<",
        "ISO-faili kirjutamine DVD-le",
        " program Windows 10.",
        "iuni de actualizare?",
        "7tl9V~",
        "rni5A telep",
        "Jazyk sa nezhoduje",
        " a acestui instrument. Trebuie s",
        "Velg det du vil beholde",
        "ul de reciclare.oNu s-a reu",
        "t Windows 10",
        "lgende krever tilsyn for at installasjonen skal fortsette.WBitlocker-n",
        "eba v",
        "ter leider noch mal neu eingeben.4Die Migrationsdaten konnten nicht angewendet werden.0Die Setupdateien konnten nicht bereinigt werden.GDie unterst",
        " ir leidim",
        "Instalace Windows Serveru 20195Restartuje se instala",
        "ver avanceret hardware. Nogle eksisterende funktioner er blevet ",
        ":,:0:4:L:\\:`:d:|:",
        "ii, consulta",
        " inov",
        "jumus.",
        "m Windows re",
        "ierele de instalare mai vechi",
        " uudelleen, jotta p",
        "ivitykset sujuvoittavat asennusta, ja niihin voi sis",
        "Provera ovog klju",
        "ber m",
        "%c:;Ihr PC startet einige Male neu, was eine Weile dauern kann.",
        "Microsoft Corporation",
        "gle til Windows 10",
        "XUP3k",
        "(KPK~~",
        "i cea mai recent",
        "Installera Windows 107H",
        "[0Z0k0",
        "n de actualizaci",
        "ie urm",
        "nytelen, ",
        ".?AVIProductKeyAction@@",
        "re going to upgrade from Windows 7 or Windows 8.1. or you",
        "pia ativada do Windows 7 ou Windows 8.1 instalada no seu computador. Ative sua vers",
        "tfen bunu okuyun ve neyi kabul etti",
        "Det oppstod et problemOHvis du vil installere Windows 10, klikker du Setup.exe p",
        "jYVh(",
        "i una nou",
        "helepanu p",
        "{{|||{xqokg_YS",
        " S.cLe dimensioni dell'unit",
        "gu, ko ieg",
        "Klucz funkcji BitLocker",
        "is kodas neveikia. Bandykite naudoti kit",
        "z ve uygulamalar",
        " tak, aby se spou",
        "dami t",
        "dEsta clave de producto no ha funcionado. Int",
        "Palaikymas",
        "=#=2=A=",
        "manoma, nes ",
        "anai.",
        "ete spustit p",
        "Diska nodal",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::Serialize",
        "emtu papildinform",
        " PC-ul este gata pentru a continua instalarea Windows 10. ",
        "pne lagringsinnstillinger",
        "Henter oppdateringer",
        "tGVWj",
        "EtwEventEnabled",
        "j-Xf;",
        "1G2R2",
        " od komputera do czasu ponownego zalogowania.5Nie mogli",
        "Professional",
        "??1exception@@UAE@XZ",
        " installere programvaren.",
        "lineen luontity",
        "4*43484@4F4K4S4Y4^4f4l4q4w4",
        "nnen, muss Windows Server 2019-Setup jedoch neu gestartet werden. Nach dem Neustart wird die Aktion an der Stelle fortgesetzt, an der sie unterbrochen wurde.?Windows Server 2019 kann auf diesem PC nicht ausgef",
        "se*Ez a kulcs nem m",
        "CSetupResponseTemplate<class IDiskSpaceActionResponse>::ExecuteRoutine: Back button clicked.",
        "4$4,444<4D4P4p4x4",
        " %c#Er du sikker p",
        " sa m",
        "erreur lorsque vous communiquerez avec le soutien ",
        "n.}Necesitamos al menos 350 MB de espacio para ejecutar el programa de instalaci",
        "t work. Try a different key, or buy a new one.",
        "lni tudja a Windows 10-et.",
        "Windows 10 installimine",
        "lkeen prosessia jatketaan siit",
        "vel localizar uma unidade flash USB.",
        "tenje i mo",
        "k nor",
        "&Programme d",
        "93:D:`:h:s:",
        "Recomendaciones de soluci",
        "ce znaky: %d",
        "Windows ei saa installimist j",
        "niai bus ",
        "r setup.exe f",
        "o pode reiniciar o computador. Feche todos os programas e reinicie o computador. A instala",
        "ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp",
        " de aproximadamente 3 GB. Se est",
        "bn mappen Overf",
        "rt.$Kravene er fuldf",
        " uudelleen.oAsennusohjelma ei voinut aloittaa Windowsin asentamista. K",
        "%1!ld!%% voltooid",
        "elo Vy",
        "zh-CHS",
        "tkamist on vaja teha veel m",
        "n0S0n0",
        " ei voitu asentaa_Tietokone on palautettu tilaan, jossa se oli juuri ennen Windows 10:n asentamisen aloittamista.",
        "e oder nicht verwendete Dateien aus dem Ordner \"Downloads\".",
        "ajte ponovno ili poku",
        "041904B0",
        "%1!d!%% effectu",
        "los izmantot ",
        "QQSj,",
        "psake nuppu V",
        "CSetupResponsePageBitLockerKeyValidate::OnSetActive",
        "tamiseks tuleb Windows 10 installiprogramm taask",
        "2SVhX",
        ";&;2;8;U;l;",
        "}W0f0D0",
        "bor Setup.exe na in",
        "Priprava %d%%",
        "iOipi",
        " da biste preuzeli najnovije instalacione datoteke.",
        "tuves lielumam ir j",
        "1f1p1",
        " Available Drive [ %c ]",
        "em.?Va",
        " %2!s! slobodno",
        "%c:5Din pc genstartes flere gange. Det kan tage lidt tid.",
        "CInstallUI::InitInstance",
        "Tijek: %1!d!%%7Za nastavak odaberite jednu od raspolo",
        "Seu PC ser",
        " chcete pou",
        "jlt. Ellen",
        "ve igjen.bKan ikke starte installasjonen av Windows. Start installasjonsprogrammet p",
        "iant kai kuriuos failus kilo problema",
        "ber jednotky",
        "505x5",
        "<$<,<4<<<D<L<T<\\<h<",
        "nosti pro tento po",
        "Microsoft YaHei",
        "Comprobando que est",
        "ti ei sobinud. Kontrollige seda ja proovige uuesti v",
        "Odaberite sliku koju ",
        "sok beszerz",
        "gu, SD karti vai ",
        "thatja azt.@A k",
        "lg derefter Opdater.",
        "e preuzeti sve potrebne datoteke. Proverite da li ste povezani na internet, a zatim poku",
        "CInstallUI::ConfirmCanceled: User cancel confirmed",
        "mu programu se nepovedlo vy",
        "nainte s",
        "|79t$ |1",
        "/f`O,{",
        "movom priebehu in",
        "o do Windows",
        "ifrovania BitLocker vyzer",
        ".51&I",
        "avaj ni",
        "o miejsca. Zwolnij troch",
        " kompiuteris",
        "anu, izpildiet t",
        "s opcijas",
        "ETento k",
        "Tai truks kelias minutes.",
        "Izdaja sistema Windows, ki se ujema s klju",
        "a argumente naredbenog retka. Dodatne informacije potra",
        "o de Suporte de Dados atualizada!Iniciar sess",
        "Escribir la clave del producto",
        "steemi draivilt.",
        "}P0S0h0o0g0M0~0[0",
        " naudojant kit",
        "s. Pour les conserver, sauvegardez-les ",
        "tted).",
        "ng'Det gick inte att installera Windows 10QDatorn har ",
        "i. Izaberite neki drugi disk.",
        " listo para tu PC. Cierra el programa de instalaci",
        "Necesita %1!d! GB como m",
        "kyviin?",
        " ruleze ",
        ", ohjaimia ja valinnaisia ominaisuuksia (suositus)",
        "o insuficiente no disco. Siga as instru",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::CheckInitialized",
        "Error selecting %c drive: [0x%X]",
        "ievada v",
        "rat. Nyissa meg a Lomt",
        " datorn f",
        "Windows Serveru 2019. Pokud chcete m",
        "ti bent %1!d! GB.",
        "0j0i0n0",
        "L'architettura non corrisponde",
        "n en Windows",
        "cnico",
        "Non riesco a trovare i file di installazione di Windows. Inserisci il supporto di installazione di Windows e avvia il file 'setup.exe' per riprendere l'installazione.",
        "ver br",
        "SkipUpdateMediaSelected",
        "Windows er ikke aktiveret p",
        " a instalar uma edi",
        "Provera kompatibilnosti",
        "Une erreur bloque l'installation. Passez en revue les renseignements fournis dans %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml pour r",
        "ta zadr",
        " ratkaista ongelma tarkistamalla tiedot seuraavasta sijainnista: %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml ja suorita sitten asennusohjelma uudelleen._Lis",
        "IDD_WIZPAGE_RESUME",
        "Dieses Tool konnte aus irgendeinem Grund nicht auf Ihrem PC ausgef",
        ".?AVCTreeCtrl@@",
        "re Windows Server 2019. Luk Installation, og pr",
        "su iestat",
        "LoadBitmapW",
        "A pen USB est",
        "uz-Latn-UZ",
        "*Windows 10 ",
        ">$>,>4><>D>L>T>\\>d>l>t>|>",
        "fg0Y0L0",
        "0~0Y0:",
        "SelectImage",
        " v nastaven",
        " versijos, tur",
        "s especificar la clave de producto.",
        "r inte tillg",
        "La instalaci",
        "r. Klicka p",
        "n de Windows instalada actualmente en el equipo.",
        ".PNaudojamame diske tr",
        "j-Xf9E",
        "Comprobando la descarga",
        "es do Windows, seus arquivos pessoais e seus aplicativos, preste aten",
        "040104B0",
        " muutaman minuutin.",
        "ra precommit.cmd-skript.",
        ".?AV?$CZeroInit@VCSetupResponsePageSummary@@$00@@",
        " %2!c!:./",
        " ne deluje s to izdajo sistema Windows, zato poskusite z drugim klju",
        "kDet gick inte att ladda ned alla n",
        "&Installeren",
        "h0puj0",
        "ie de dispozitiv.",
        "ck(W-",
        "vne inform",
        "Ongi valmis!7J",
        "installationa",
        " Microsoft Corporation. K",
        "i clic pe OK pentru a reporni sistemul ",
        "o mais recente do Windows",
        "Si Windows 10 se instal",
        "lamaz.",
        "ifrovan",
        "mFjern f",
        "pabeigt",
        "us un dro",
        "Il download ",
        "Vytvori",
        "Updates toegepast",
        "1@I5jQ7N",
        ".?AV?$CZeroInit@VCSetupDlpResponse@@$00@@",
        "t valodas resursus?Uzst",
        " klucza produktu systemu Windows 10.",
        " jazyk, ne",
        "diegti naujausi",
        " BitLocker atsl",
        ":Preparando para baixar a vers",
        "cuter cet outil sur votre PC. Si ce probl",
        "lper vi dig frig",
        "an klju",
        "r lite diskutrymme. F",
        "l nav gatava ",
        "mpinat o problem",
        "s una clave de producto de Windows 10.",
        "dacBitLocker-nyckeln fungerade inte. Kontrollera den och f",
        "r du opretter forbindelse til internettet, aktiverer vi Windows for dig. ",
        "re preinstall.cmd-scripts.7Der opstod problemer med at k",
        " inscrip",
        "&Atgal",
        "La lingua non corrisponde",
        "elles fonctionnent. Une fois que l",
        "o do Windows continuar",
        "1%2@2[2v2",
        "SysTreeView32",
        " S. Scegli questa edizione solo se stai installando Windows su un PC progettato per l'esecuzione in modalit",
        "%c:OO seu PC vai ser reiniciado v",
        "!kn0D0Z0",
        "llningar och personliga filer",
        "t extern",
        "rio criar e, em seguida, executar o suporte de dados para o instalar.",
        "anas turpin",
        "Si vous continuez sans activer votre version actuelle de Windows, vous devrez acheter une cl",
        "a je u toku7Ovaj klju",
        "v en anden n",
        "emo zaklju",
        "Program za instalaciju sustava Windows pristupat ",
        "ynnistyy uudelleen monta kertaa. T",
        "en.,%1!s! auf dem PC freigeben (%2!c!:-Laufwerk)uW",
        "The installation cannot continue because Windows cannot restart the computer. Close any open programs, and then restart the computer. Windows installation will continue automatically.",
        "To bo morda trajalo nekaj ",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::Restart",
        "p nem m",
        "INFORMATIONEN ZUR INSTALLATION: Einige Features von Windows 10 erfordern modernere Hardware; einige vorhandene Features wurden ge",
        "th-TH",
        "rios pelo menos %1!d! GB.",
        "t izmantot datoru.",
        "t, vagy l",
        "CreateFontIndirectW",
        "zellikleri indir (",
        "t Sta",
        " conserver",
        ".CRT$XCZ",
        "sz, de a m",
        "be-BY",
        "ano: %1!ld! %%",
        "n, activar Windows e iniciar la instalaci",
        " galima paleisti s",
        "s nedan om du vill veta varf",
        "nchidere'Computerul va reporni ",
        "ioneze corect dup",
        "4)7E7",
        "stroj se n",
        "e pripravljen za va",
        " reikia vietos",
        "Datenschutzbestimmungen",
        "ksuste Windows 10-ga ",
        " uudelleen.)Windows Server 2019:n asennus ep",
        "emo aktivirati Windows nakon dovr",
        "lhatja a sz",
        "ck(Wnx",
        "laties beigt darbu?",
        "Nu am putut instala Windows 10[Am setat PC-ul ",
        "me s'est produit lors de l'ex",
        "CInstallUI::ShowProgress: Posted MSG_INSTALLUI_SWITCH_TO_PROGRESS_PAGE",
        "installer une version ant",
        "ne takto: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "ndningen. K",
        ".CRT$XIAA",
        "o. Liberte algum espa",
        "'6>>DD`L||||SQSRRN\"",
        " uudelleen.6Suoritetaan preinstall.cmd-k",
        "Dit kan enige tijd duren.fDe update voor Windows 10 wordt geconfigureerd",
        " najnov",
        "j\\Zf;Ty",
        "lja meg ism",
        "nCzz:",
        "0@y$@0",
        "a, unesite ispravan klju",
        "idlo Obnovi",
        "i kaudu.\\Windows 10 v",
        ":1;I;S;q;",
        "list salvestusruumi",
        "Instalare Windows Server 2019,Se reporne",
        "d chyby: 0x%1!lX! ",
        "5%535",
        "unalnika. Zaprite vse odprte programe in znova za",
        "tter vi der, hvor vi kom til.*Denne pc kan ikke k",
        " necessario il tuo intervento per completare queste operazioni. Scegli gli elementi da mantenere",
        "lida1N",
        "Uso archiviazione}Esplora manualmente l'uso dello spazio di archiviazione nelle impostazioni per rimuovere altri elementi di grandi dimensioni..Seleziona dispositivo di archiviazione esterno",
        "eneklerini belirleyemedi.Kurulum program",
        "\"Nevar atrast USB zibatmi",
        "n de Windows 10 necesita reiniciarse para que funcionen. Despu",
        " Microsoft\"",
        "ttes!Kan ikke validere produktn",
        "REGISTER_ASYNC_PROCESS",
        "CInstallUI::OnProgressChanged: Exit is requested. Ignoring OnProgressChanged",
        "Segoe UI Light",
        "st. A telep",
        "r installationsprogrammet igen.oDu kan f",
        "pet, am",
        "t be used to install Windows.",
        "baigtum",
        "vY0K0",
        "ljande saker innan du kan forts",
        "ng inte av datorn",
        " nesuaktyvinta ",
        "9 :':-:2:=:G:L:`:",
        "Windows Server 2019 iestat",
        " kapatmay",
        "jdete na lokalite https://aka.ms/windowsserverupgrade",
        "Nemojte isklju",
        "Tai gali trukti kelias minutes.",
        "e ste na in",
        "1,171w1",
        "Midagi juhtusCWindows 10 installimiseks kl",
        "k sedan igen.'Det gick inte att ladda ned vissa filer",
        "oikeussopimusta ei l",
        "t, lai to iz",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::Execute",
        "t take command line arguments. For more information, see Setup Help or run ",
        "Para continuar a instala",
        "Ulkoinen tallennuslaite",
        "de validar a chave do produto (Product Key)NA instala",
        "StringFromGUID2",
        "e se prozor automatski zatvoriti za %1!d! min.2Stvari koje biste trebali znati prije zapo",
        "cnica var",
        "i za instalacijski program ili pokrenite \"setup.exe /?\" u korijenskom direktoriju instalacijskog medija.",
        " veya lisans",
        "ti, ta",
        "es-US",
        "De gratis update naar Windows 10 is alleen beschikbaar als er een geactiveerd exemplaar van Windows 7 of Windows 8.1 op uw pc is ge",
        "0o0B0",
        " niektor",
        "n de almacenamiento.UNo se pudo abrir la papelera de reciclaje. Abre manualmente la papelera de reciclaje.qNo se pudo abrir el uso de almacenamiento. Ejecuta %1!s! manualmente para abrir el liberador de espacio en disco.",
        " raktas",
        " chiuso.]Sono necessari almeno 350 MB di spazio per eseguire l'installazione. Libera spazio e riprova.",
        "ifre proizvoda, a zatim izaberite opciju ",
        " Script ",
        " de produit ne contient que 48",
        "rw-RW",
        "rziu.)Instalarea nu a aplicat datele de migrare.Instalarea nu a cur",
        "%s Mt",
        "Uw download verifi",
        "The product key should be with the box the DVD came in or on your email receipt. When you connect to the Internet, we",
        "j, skal du v",
        "https://aka.ms/windowsserverupgrade ",
        "373T3k3",
        "noton komentosarjoja$T",
        "&Prekli",
        "Vybrat bitovou kopii",
        "fqFW5",
        "v466~",
        "kleyemedik.OBilgisayar",
        ")Usar los archivos de instalaci",
        ".?AVCBitmapDialog@UX@Common@ConX@@",
        " de produit ou une licence de Windows",
        "Abrir Transfer",
        "8$9<9h9",
        "em komandrindas argumentus. Lai sa",
        "hoz legal",
        "o suportadas;A configura",
        " facoltative (scelta consigliata)",
        "vS_MR",
        "ne muu arvuti jaoks",
        "iny, pozrite sa ni",
        "ajke i jezike. Pou",
        "r kan ta en stund.hEtt ov",
        "se-NO",
        " suspensa durante esta atualiza",
        "Premikanje nastavitev %d%%",
        "hren.(Sie k",
        "vcaQAk chcete pou",
        "Om du t",
        "ks-Deva-IN",
        "Edice",
        " kompiuter",
        " ulkoista tallennustilaa sen sijaan(En halua k",
        "lt megnyitni a Lomt",
        "d vyzer",
        "ku Sta",
        " a Windows ezen kiad",
        "pap-029",
        "buj ponownie uruchomi",
        "lineen p",
        "anas laik",
        "Oap`@3",
        "e zariaden",
        "tora syst",
        "vetkez",
        "Prullenbak\\Maak de Prullenbak leeg om verwijderde bestanden op het systeemstation definitief te wissen.",
        "Se nedenfor hvis du vil vite hvorfor.",
        "ene mogu",
        "20201008101141Z",
        "t run Windows Server 2019",
        "re valide.",
        "?\"?2?B?R?b?r?",
        "jo Windows versiju, jums b",
        "n.uWindows Server'",
        "Adding Drive Letter = %c",
        "te naujinim",
        "i clic pe Urm",
        "o do Windows. Insira o seu suporte de dados de instala",
        "dnek, de a f",
        "t aus.",
        "OriginalFilename",
        "Prena",
        "Notiek lejupiel",
        "f~0_0o0JRd",
        "ite PC u elektri",
        " necessario riavviare il programma di installazione di Windows Server 2019. Dopo il riavvio, il programma di installazione riprender",
        " jour de Windows Server, visitez https://aka.ms/windowsserverupgrade",
        "@.reloc",
        "Peaaegu valmis",
        "bb percig is tarthat.",
        "gte at ordne det for dig. Opdater listen, og pr",
        "G%b\"i",
        "LogHr",
        " estar na caixa do DVD ou no recibo de correio eletr",
        "Abrir grabadora de DVD",
        "Datentr",
        "Szabad hely keres",
        "CSetupResponsePageRecoveryReq",
        "ll-e a telep",
        "o do Windows que corresponde ",
        "ene datoteke iz fascikle ",
        "z friss verzi",
        "bn-IN",
        "rheten tills du loggar in igen.\"Sammanfattning av vad du har valt:",
        "i Windows Server 2019",
        "llningar, personliga filer och appar.KDu m",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        " programin",
        " a ser executado'Este processo vai levar alguns minutos.",
        "marriez l",
        "cie3Ponecha",
        " nytt./Installasjonen av Windows Server 2019 mislyktes",
        "kajte, k",
        "n Windows Update.",
        "lnom jazyku a architekt",
        "dik.WA Windows 10 friss",
        "i elementul de instalare Windows, apoi executa",
        "Microsoft Time-Stamp PCA 20100",
        "Bitte lesen Sie die Bedingungen, bevor Sie ihnen zustimmen.",
        " de fazer a seguir. Esta janela fecha-se automaticamente em %1!d! minutos.!O que deve saber antes de come",
        "Zadat kl",
        "@@@   @@@",
        "%2!s!=Tu organizaci",
        "li zamierzasz uaktualni",
        ":$:5:I:",
        "ka jaun",
        " szczeg",
        "gkALbi",
        "lectionnez un lecteur flash USB|Les fichiers enregistr",
        " nytt senere.",
        "rskenduss",
        ">0?c?v?",
        "ggs till automatiskt)Produktnyckeln inneh",
        " dar neparengta ",
        "SETUPAPI.dll",
        "(&R)]",
        "base\\ntsetup\\conx\\mosetup\\mediasetupuimgr\\src\\SetupResponsePageDiskSpaceReqImpl.h",
        "sts viss, tostarp faili, lietojumprogrammas un iestat",
        " izdelka ni deloval. Znova vnesite klju",
        "alinti.",
        "t, ne",
        "#Usar arquivos de instala",
        "ime S..USB k",
        "Nada/Podr",
        "465<5Z5s5",
        "ke; trajanje podr",
        "Preinstall.cmd ",
        "eho, co chcete zachovat, zkontroluje kompatibilita s Windows 10, m",
        "y tallennustilan k",
        "s reciente.<Descarga de la Herramienta de creaci",
        "rique mis ",
        " reik",
        "nda har inte tillr",
        "CIJA PAR INSTAL",
        "Ya est",
        "psake arvuti taask",
        "pertoire de travail par le programme d",
        "dCSDBuildNumber",
        "PPP```",
        "=4333",
        "m.8Pri sp",
        "Windows 10 Update/",
        "nu verziju sustava Windows pomo",
        " mieless",
        " cheie sau cump",
        "kai suaktyvinsime ",
        "%2!s!9A sua organiza",
        "e bez problema i one mogu da sadr",
        "Na co se budete muset pod",
        "1#171V1l1x1",
        "t utiliser un stockage externe+Je ne veux pas utiliser de stockage externe",
        "Kosz;Opr",
        "m je voln",
        "Nevaram noteikt, vai j",
        "teni most",
        "Postanowienia licencyjne",
        " du slutade. Du m",
        "ajte ponovo.-Izvr",
        "t darba direktoriju",
        "CopyRect",
        "Preuzmite najnovije izdanje operativnog sistema Windows",
        "ISO-Datei auf eine DVD brennen",
        "&A criar suporte de dados do Windows 10",
        "sitsi DVD-le rakenduse %1!s! abil.",
        ", apsilankykite: https://aka.ms/windowsserverupgrade",
        "s escribir una clave de producto de Windows 10 v",
        "ifra pogre",
        "nliche Dateien und Apps behalten6Windows-Einstellungen und pers",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::GetState",
        "aj za pohranu i mo",
        "CInstallUI::WaitForInitUIEvent",
        "klenmesi, bilgisayar",
        ". Paleidus i",
        "VIDATh",
        "as disks",
        ";(;4;T;\\;h;",
        "Installer %s6Computeren genstartes for at forts",
        "CSetupResponsePageSelectImage",
        "ete pros",
        "n.UNo se pudo abrir la Papelera de reciclaje. Abre manualmente la Papelera de reciclaje.qNo se pudo abrir el uso de almacenamiento. Ejecuta manualmente %1!s! para abrir el Liberador de espacio en disco.",
        "e masz starsze pliki instalacyjne systemu Windows 10. Mo",
        "z, bu ad",
        "Nema dostupnih ispravki",
        "UWindows ",
        "8B8I8P8",
        "|Potrebbero essere necessari alcuni minuti per verificare se gli elementi che vuoi mantenere sono compatibili con Windows 10.rQuesto codice Product Key pu",
        "r ligge i den boks, som dvd",
        ".<>I(",
        "Instalace Windows 10",
        " diff",
        "ntdll.dll",
        "sokat a friss",
        "zisban meghi",
        "- Windows Update.",
        "}W0~0Y0",
        " jeszcze raz.",
        "site ",
        "~~v~v",
        "nytelen parancssori param",
        "Hemos detectado que tienes archivos antiguos de instalaci",
        "r redo att forts",
        "de inicializar o diret",
        "[__CU",
        "ku-Arab",
        "3\"333F3R3o3",
        "&Continuar",
        "t be kept because your current version of Windows might be installed in an unsupported directory, or you",
        "zden kald",
        "czono %1!ld!%%",
        "avons pas pu t",
        " et vous dirons ce que vous devez faire par la suite. Cette fen",
        "o do Windows que est",
        "e odpreti. Ro",
        "&Avsl",
        "charger la version la plus r",
        "1/161",
        "O que precisa de sua aten",
        "o iniciada no Windows utilizando uma conta de administrador.1Ter",
        "&Continuer",
        " %2!s! ingyenes",
        "e nije uspjelo. Ru",
        "hkkEoo7",
        " hacer a continuaci",
        "yet er tilgjengelig. Du m",
        " proteja datele, ar trebui s",
        "hez kattintson a Setup.exe f",
        "ado; algumas das funcionalidades existentes foram modificadas ou eliminadas; o Windows 10 ",
        "ttringarna p",
        "0!kn0",
        "a s utvr",
        "INSTALLATION INFORMATION: Some Windows 10 features require advanced hardware; some existing features have been modified or removed; Windows 10 is automatically updated during the support period; support may vary by device.",
        "Skoraj pripravljeno",
        "CSetupResponsePageBitLockerKeyValidate::SerializePage",
        "it deschiderea folderului Desc",
        "ico sistema Windows uporabljate.'Name",
        " nije spreman za ovaj PC'Provjeravamo je li instaliranje spremno",
        " (USB ",
        "lszolg",
        "n y despu",
        " %1!d!%%O",
        "s %1!s! f",
        ".::;?0_",
        "r for batteri under installationen.",
        "&Obnovi",
        ">::255",
        "Language Pack Location",
        " oldu",
        " ir vismaz %1!s! br",
        "o@A configura",
        "[[[[[V[ZVMVMMMO@>%\"",
        "ga izskat",
        "cWe can",
        "dami naudoti ",
        "rizze, ",
        "Hent%Pers",
        "Bitlocker-n",
        "e lorsque vous vous connecterez dans Windows Server",
        "esz pomin",
        "A Configura",
        ";N<U<e<l<{<",
        "est pas valide. Entrez la cl",
        "Se pretender instalar o Windows 10 noutra parti",
        " diska",
        "~Pot fi necesare c",
        "Jezik ne ujema",
        "kleniyorWKi",
        "ILT8;",
        "re om PC-en kan kj",
        "ana nevar turpin",
        "rile sunt instalate, dar instalarea Windows 10 trebuie s",
        "c atjaunin",
        "iniet uz Atsvaidzin",
        "cution.%",
        " tas bija pirms s",
        "=,=;=C=h=|=",
        "ll a telep",
        "Er is onvoldoende ruimte beschikbaar op het station dat u probeert te gebruiken. Kies een ander station en probeer het opnieuw.;Wij helpen u bij het vrijmaken van %1!s! op station %2!c!:.",
        "^jy+/",
        "emy stwierdzi",
        "ite zunanjo napravo za shranjevanje z vsaj toliko prostega prostora: %1!s!",
        "rbaudiet, vai ir pieejami instal",
        " pokro",
        "%hs: Regenerating compat report.",
        "ppna program och starta om datorn. Installationsprogrammet forts",
        "ma Windows nep",
        "berein.",
        "$IDATx",
        "bn Overf",
        "n, pero se conservar",
        "/?$$?0",
        "relmet!@Hiba t",
        " miejsca poni",
        "da.%Requisitos Cumpridos! Prima Continuar:Escolher um dispositivo de armazenamento externo diferente",
        "Installer Windows 100F",
        "r installerad p",
        ".6Windows",
        "n como administradorcPara usar esta herramienta, debes haber iniciado sesi",
        ".PAsennus ep",
        "m instal",
        "2[~TM",
        "anas programmas pal",
        "i. Ak sa bud",
        "n ve yeniden deneyin.,Windows Server 2019 y",
        " laikmena2Nesivar",
        "isko manu",
        "re going to install Windows 10 on your PC for the first time (or install a different edition), you",
        "ifra proizvoda sadr",
        "<8<B<",
        " za BitLocker za identifikator: /Sistem Windows potrebuje prostor za posodobitev",
        "iuos dalykus.Y",
        "1<2H2T2`2l2",
        " Windows Server 2019 ",
        " 3 GB. ",
        "n para quitar otros elementos grandes.1Seleccionar dispositivo de almacenamiento externo",
        "tiski aktiviz",
        "t Windows 10.",
        "ilitatakse.4K",
        " bruke PCen.HInstallasjonen mislyktes i %1!s!-fasen med en feil under %2!s!-operasjon",
        ".text$mn",
        "L$4^3",
        "n..En resumen, esto es lo que has decidido hacer:",
        "katli, v kateri je bil DVD, ali v ra",
        "s papildu izmaksas.'K",
        "kEr wordt gecontroleerd of de items die u wilt behouden, compatibel zijn met Windows 10. Dit kan even duren.zU kunt deze productcode alleen gebruiken om onderdelen toe te voegen aan Windows. U kunt hiermee niet Windows installeren.",
        "r klar.,Installationsprogram f",
        "Usar el punto de restauraci",
        " bilmiyoruz. Kurulum",
        "l norm",
        "Denne download i baggrunden kan v",
        "hel j",
        "rbereder %d %%",
        "Ne yaz",
        "^Uj3j",
        "Kijk nog even naar de volgende punten als u wilt doorgaan met de installatie en uw Windows-instellingen, persoonlijke bestanden en apps wilt behouden.MKijk nog even naar de volgende punten als u wilt doorgaan met de installatie.dDe BitLocker ziet er ongeveer als volgt uit: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX@De BitLocker-sleutel bestaat alleen maar uit 48 digitale tekens.",
        "ki.(Kak",
        "llapotba.",
        "e biti izbrisano, uklju",
        "si inform",
        "H ;N t",
        "ullar",
        "eme v",
        "Dicas de solu",
        " program se nedaj",
        "Tijekom instalacije sustava Windows do",
        "Pomocn",
        "d. Sprawd",
        "F ;C t2",
        "nna ISO-filen till en DVD senare.",
        " tietov",
        "%Virhekoodi: 0x%1!lX! ",
        "V&ernieuwen",
        "As atualiza",
        "Staged Image",
        "tete teisaldamine (%d%%)",
        "r Gruppe ",
        "_lock",
        "ri, pr",
        " %1!s!, ",
        "Kontrollerer, om du er klar til at installere",
        " se b",
        " kertaa (tai asennat eri tuoteversion), tarvitset Windows 10 -tuoteavaimen.",
        "3)333:3@3E3Q3\\3p3",
        "res num",
        " izdelka bi moral biti na ",
        "Lo sentimos, estamos teniendo problemas para determinar si Windows Server 2019 ya est",
        "n como administrador\\Para usar esta herramienta, debes iniciar sesi",
        "0}k0d0D0f0o0",
        "etku instalacije.'Instalacija izdanja Windows Server 2019:Ponovno pokretanje instalacije izdanja Windows Server 2019",
        "PrepareIYou",
        "te nepaleisti kompiuterio i",
        " Windows 10O",
        "Feils",
        "sitsi.7Pr",
        "r klart och vad du beh",
        "i deinstaliranje aplikacije.p",
        "u tekrar y",
        "teva lucruri pe care trebuie s",
        "<)<<<",
        "ForberedIDet har du allerede ordnet. Klik p",
        "n a telep",
        "installation.[La cl",
        "unar. Zatvorite sve otvorene programe, a zatim ponovo pokrenite ra",
        "Intet0Du vil kunne administrere Windows-indstillinger.BDine indstillinger og apps bliver slettet, men dine filer bevares.:Alt bliver slettet, herunder filer, apps og indstillinger.",
        " na opakowaniu dostarczonego dysku DVD lub w wiadomo",
        "nnen nicht beibehalten werden, weil die aktuelle Version von Windows m",
        "Edizione",
        "a instalacji s",
        "r oldu",
        "@Przygotowywanie do pobrania najnowszej wersji systemu Windows 10",
        "Suporte",
        "su PC dators tiks konfigur",
        "%1!ld! %% er fullf",
        " nytt fra begynnelsen",
        " kontrollere om det du vil beholde er kompatibelt med Windows 10.yDenne produktn",
        "r att installera det.,Du kan forts",
        "ku. Vypalte pros",
        " em execu",
        "o com suporte>A instala",
        "m gerektirir; var olan baz",
        " recenti per essere certo di installare l'ultima versione di Windows 10.",
        "tigt Speicherplatz zum Aktualisieren.",
        "ranka valo prie",
        "Folytat",
        "aja i dodatne datoteke koje nisu na instalacijskim medijima.",
        " v nepodporovan",
        "Ava Allalaaditavad failid",
        "%2!s!;L'organizzazione gestisce le impostazioni di aggiornamento.",
        "base\\ntsetup\\conx\\mosetup\\mediasetupuimgr\\src\\SetupResponseImpl.h",
        "avate da iskoristite ",
        "&Yenile",
        "^dlmmlba]",
        " %1!d!GB ",
        "? ?8?<?@?D?H?\\?l?p?t?",
        " Windows Setup",
        "DY\"eI",
        "r uppdateringarna g",
        "Abrir!Deseo usar almacenamiento externo%No quiero usar almacenamiento externo",
        "jra.5Windows Server 2019 non ",
        "chargement pourrait entra",
        "La protecci",
        "sigijote internetu.",
        "re installationen problemfrit, og de kan indeholde vigtige rettelser, opdaterede enhedsdrivere og andre filer, som ikke findes p",
        "s'Nem siker",
        "tita ",
        "_wtoi",
        "asno prekinjena in se bo nadaljevala, ko se vpi",
        " vain, jos tietokoneeseen on asennettuna aktivoitu Windows 7- tai Windows 8.1 -kopio. Aktivoi nykyinen Windows-versiosi k",
        "ati, ker ste se odlo",
        "t szeretn",
        "; Windows 10 ",
        "Jezik",
        "7/PDwp",
        "Die Installationsbereitschaft wird gepr",
        "0<1|1",
        "rification que votre PC a suffisamment d",
        "CWW;L",
        " naujo kelis kartus. Tai gali ",
        "See below if you're interested in finding out why.",
        "tEXtSoftware",
        "Klucz produktu",
        "ajte da ponovo pokrenete instalaciju.",
        "0H0q0",
        "dium pre Windows 10 Po",
        "Spr&ejmi",
        "tirilmi",
        " listo para instalar",
        " soubory. Zkontrolujte, ",
        " kterou moment",
        "emo da instaliramo Windows Server 2019kNa ra",
        "i dac",
        "Atliku",
        "li smo na problem dok smo poku",
        "czeniu instalacji.9Wymagania zosta",
        "anas padomi",
        "d Product Key by mal by",
        "Disk Partition",
        "GetProductInfo",
        " che stai tentando di usare non ",
        "Actualizar la lista de unidades%Necesita ocupar %1!d! GB como m",
        " system Windows i uruchomi",
        "Der PC wird ",
        "Teeme m",
        "Kieli",
        "Tapahtui virheJAsenna Windows 10 napsauttamalla asennustietov",
        "CInstallUI::ShowCompatResolvedMessage",
        "Det gick inte att forts",
        "PrepareLYou",
        " estar",
        " Windows DVD",
        "Hvorfor vises dette?",
        "0 0,080D0P0\\0h0t0",
        "042404B0",
        "IDD_WIZPAGE_HANG_ON",
        "<x =>>",
        "lla filerna m",
        "CompareStringW",
        " PC spreman za nastavak instalacije sustava Windows Server 2019. Poku",
        "1Desc",
        "ppna Diskrensning.",
        "r redo.",
        "ci.cKl",
        "CSetupLangIniLoader::Initialize: Cannot save current directory",
        "se automatikusan folytat",
        "tre utilis",
        " nytt og fullf",
        "Klucz produktu ma posta",
        "Microsoft Time-Stamp Service",
        " 6%lff&",
        "7 707L7d7",
        "ie acestor aspecte.",
        "Vi kan inte installera de senaste Windows 10-funktionerna och s",
        "d alebo k",
        "r.7Dosyalar, uygulamalar ve ayarlar dahil her ",
        " de utilizar uma chave de produto do Windows 10.",
        "ste startas om f",
        "tson fel %1!s! helyet a sz",
        "rtraukta darb",
        "1 1$1<1@1X1\\1t1x1|1",
        " til: %1!s!",
        "cie a m",
        "nd de rekommenderade alternativen f",
        "iile despre instalare de care avem nevoie pentru a continua instalarea Windows de unde a",
        "%1!s!.%2!s!",
        "<)=C=]=w=",
        "te)Ne ",
        "oikeusehdot",
        "END_FIRST_BOOT",
        "Encontrar",
        "Nobena posodobitev ni na voljo",
        "jljai vannak a Windows 10-hez. Seg",
        "-l rula",
        "IsDebuggerPresent",
        "ra. Z",
        "nstalleerd. Het externe opslagapparaat wordt niet opnieuw geformatteerd en u kunt het weer verwijderen nadat de installatie is voltooid.'Voldaan aan vereisten! Klik op Doorgaan&Een ander extern opslagapparaat kiezen",
        "ber USB k",
        " a utilizar uma liga",
        "Det kan tage et par minutter.",
        "Clave de BitLocker",
        "/9**'",
        "Atnaujinimai ",
        "bas uzlabojumus, jo disk",
        "ar para baixar os arquivos de instala",
        "im se sla",
        " '%c'y",
        "[Hata Kodu: 0x%x]5Windows y",
        "ritysvihjeit",
        "senie o ochrane osobn",
        "8,8T8[8m8x8}8",
        "d Product Key pot",
        "Miski takistab installimise j",
        "ava ponavlja, pri stiku s podporo za stranke navedite kodo napake.",
        "r ezen a sz",
        "Selecione a imagem que pretende instalar.",
        "Si vous mettez ",
        "o failure.cmd!Isso pode demorar alguns minutos.",
        "VDet kan ta litt tid ",
        "&Fechar(O seu PC ",
        "tit saab kasutada ainult Windowsi funktsioonide lisamiseks. Windowsi installimiseks ei saa seda kasutada.",
        " de produit ou une licence Windows 10 pour activer Windows 10 ",
        " (Version) ",
        "606D6S6W6[6_6c6g6k6o6s6w6{6",
        "tre install",
        "CSetupResponseTemplate<class IDiskSpaceActionResponse>::InitializeRoutine",
        "ajte ponovo.3Do",
        " bir anahtar deneyin.9",
        "g hely. V",
        " USB, ",
        " megvizsg",
        "installation pour recommencer.",
        "&3,e=",
        "n %1!s!",
        "lg instruksjonene nedenfor for ",
        "dzu, ievietojiet Windows instal",
        "Inte just nu",
        "+8`^r",
        "r nyckeln fungerar inte med den h",
        "CSetupResponsePageBitLockerKeyValidate",
        "mas netiek nov",
        "040C04B0",
        "rki.2R",
        "Es konnte nicht festgestellt werden, ob Ihr PC bereit ist, um die Installation von Windows 10 fortzusetzen. Starten Sie Setup erneut.",
        "+`Cu_",
        "ko versijuaIr pieejama ",
        "Msg:[%ws] ",
        "Selezione unit",
        "GetDlgItem",
        ".?AV?$CZeroInit@VCSetupDialogSplash@@$00@@",
        "dium Windows 10.%Po",
        "uje se da li na ra",
        "D$p+D$h",
        "Avis et conditions du contrat de licence applicables",
        "nyelnek. Lehet, hogy egyes funkci",
        "Jazyk",
        "ndeplinite! Ap",
        " klucz funkcji BitLocker dla identyfikatora: ;System Windows potrzebuje miejsca do wykonania aktualizacji",
        "t is ig",
        "@@@@@@@@@@@@@@@@@@",
        "rta.rLai palaistu uzst",
        "kleme, Windows bilgisayar",
        "CreateSemaphoreExW",
        "Windows 10 atjaunin",
        "tfen kullan",
        "za en son Windows 10 ",
        "Vse je pripravljenoIName",
        "Arquitectura",
        "n porque es posible que la versi",
        "tter uden at aktivere din nuv",
        "9GUUr",
        "t iestat",
        "Sistema operativo Microsoft",
        "i un suport fizic de instalare (unitate flash USB, DVD sau fi",
        "tres de ligne de commande non valide",
        " %2!s! nemokamai",
        "mu %1!s! vybrali in",
        " Microsoft Corporation ",
        "unalnik pri sebi dokler se znova ne vpi",
        "r lisensvilk",
        "ds inte av det h",
        "o.+Libere %1!s! no computador (unidade %2!c!:)aSelecione ou conecte um dispositivo de armazenamento externo com pelo menos %1!s! de espa",
        "a sa)",
        "aja i dodatne datoteke koje se ne nalaze na instalacionom medijumu.",
        "onecore\\internal\\sdk\\inc\\wil\\opensource\\wil\\resource.h",
        "ite. Po dokon",
        "e. Proverite je i poku",
        " bez aktiv",
        "r utg",
        "Los puntos siguientes requieren tu atenci",
        "lgende, f",
        "Seus arquivos, aplicativos e configura",
        "uriranja?",
        "g %d karakter maradt",
        "tiski(Produkta atsl",
        "teni k",
        "Edici",
        "to se desiloQDa biste instalirali Windows 10, kliknite na Setup.exe na instalacionom medijumu.",
        "cego i b",
        "bory. Otvorte ho manu",
        "cija, kas j",
        "ovat s t",
        "yoruz. L",
        "THr,g",
        "Telep",
        "Windows 7 ",
        "nete, shranite datoteke in zaprite programe..Po",
        "s que comprar una licencia o clave de producto de Windows 10 para activar Windows 10 despu",
        "kleme medyan",
        "r du startede installationen af Windows 10.",
        " olmak istiyorum",
        "stroje Vy",
        "nnen Geb",
        "e se ponovo pokrenuti za nekoliko trenutaka Proverava da li postoje ispravke,Proverava se da li postoje ispravke: %1!d!%%$Ovo mo",
        " namestili v ra",
        "3SG0}_",
        "ana turpin",
        "unaru",
        "su ievad",
        "Atbalsts",
        "r Sie.",
        "Ouvrir0Je pr",
        "es-HN",
        "inu S. To izdajo izberite le, ",
        "8Windows Server 2019 bu bilgisayar i",
        " verificato un problema durante l'esecuzione di questo strumento",
        "ite datoteke, aplikacije i postavke jer je trenutna verzija operativnog sistema Windows instalirana u nepodr",
        " ce que vous vous connectiez.*Impossible d",
        "mu Windows 10. Sk",
        "000@@@@@@@@@@@@",
        "n ve y",
        "marrer et terminer l",
        "ite kompatibilno sa izdanjem Windows 10.",
        "tLe lecteur que vous tentez d",
        "\"Precommit.cmd ",
        "CSetupResponsePageBitLockerKeyValidate: UpdateView",
        "ye yazman",
        "le vaatama j",
        "kkelen virker! Fortsett n",
        " kilka minut.SPod",
        " nagrywarki dysk",
        " en annan partition m",
        "e aktualizovat v",
        ".\\%s\\%s.mui",
        "Nismo uspjeli spremili podatke o instalaciji potrebne za nastavak instalacije sustava Windows od mjesta na kojem ste stali. Na",
        "rer distribusjonsskript for preinstall.cmd,Kj",
        "lido-No pudimos encontrar el contrato de licencia.",
        "Pred aktualiz",
        "unalnik*Preverjamo, ali je vse nared za namestitev",
        "si oleva versio.",
        "Neizsl",
        "dami laikinai i",
        "CSetupPageRollback",
        "ffnen Sie Ihren Speicher in den Einstellungen manuell.QIhr Papierkorb konnte nicht ge",
        "Attendi",
        " prize tak",
        ".!%d ",
        "Klar til ",
        " en uventet fejl.",
        "em po",
        "P}YBf|~",
        "lection ?",
        "msvcrt.dll",
        "mu Windows a osobn",
        "*0E0x0",
        "rez votre support d",
        "r deretter setup.exe for ",
        " ir bijusi instal",
        "Si Windows 10 a d",
        "ReturnHr",
        "au moins %1!d! Go.",
        "s megkezd",
        "ivitage installiprogramm.mInstalliprogramm ei saanud Windowsi installimist alustada. Taask",
        "\"Prisijunkite kaip administratorius_Nor",
        "<><`<i<o<",
        "\\\\[B0BBB/~",
        "r diesen PC verwenden",
        "lasszon nyelvet, architekt",
        " activa",
        "ete tento krok p",
        "lj instruktionerna nedan f",
        "2+3E3o3",
        "/Termos de licenciamento para software Microsoft$Declara",
        "SVj<3",
        "a proizvodaNInstalacijski program ne mo",
        "Stationslijst vernieuwen#Deze moet ten minste %1!d! GB zijn.",
        "rankos programa prie",
        "t Windows 10 vietn",
        "progreso",
        "ssen die ISO-Datei sp",
        "Windows-Einstellungen, pers",
        "rt lejupiel",
        " %1!s! asennetaan kielell",
        "+A Windows 10 leg",
        "Mit szeretne tenni?",
        "tta med det du valt?",
        "uHet station dat u probeert te gebruiken, is versleuteld met BitLocker. Kies een ander station en probeer het opnieuw.",
        "0'0A0Q0Y0",
        "Keine Bezeichnung",
        "rskendused on rakendatud",
        "CSetupResponsePageBitLockerKeyValidate::OnInitDialog",
        "ili problem, pregledajte informacije u datoteci %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml i ponovno pokrenite instalaciju.lZa vi",
        "8 8$8(8,8@8D8H8L8P8T8X8\\8`8d8h8p8t8x8|8",
        " aplanko.",
        "rz Kosz",
        "no istra",
        "tt-RU",
        "ftaDieser Key funktioniert nicht mit dieser Windows-Edition. Versuchen Sie es mit einem anderen Key.nMit dem Product Key stimmt etwas nicht. Geben Sie noch mal den Product Key ein, den Sie online erworben haben.",
        " kurulu",
        "iniet v",
        "ta treba da uradite slede",
        "o exclu",
        "Gotowy do instalacji",
        "*|&Q%",
        "n saattaa kulua jonkin verran aikaa.\"Odota, kunnes asennus on p",
        "ReciclagemMEsvazie a Reciclagem para remover ficheiros eliminados da unidade do sistema.",
        "  &Ik wil helpen om de installatie van Windows te verbeteren",
        " do Windowsu 10. Na ochranu svojich ",
        ", um den Eintrag aus der Liste zu entfernen.hFehler beim Versuch, das Problem zu beheben. Aktualisieren Sie die Liste, und versuchen Sie es noch mal.",
        " pc'en. Hvis du fortsat har problemer, skal du henvise til fejlkoden, n",
        "marrer ",
        "ppp@@@   ",
        "Bereit f",
        "PValittu asema on salattu BitLockerilla. Valitse toinen asema ja yrit",
        "tson fel n",
        "Laadige alla v",
        "Uklonite datoteke koje vam vi",
        "Seleccione una ruta",
        " a spusten",
        "ker p",
        "p=CPuc",
        "A kulcs ellen",
        "inde yeniden ba",
        "vel continuar a instala",
        "CSetupResponseTemplate<class IDlpResponse>::OnBack",
        "li trvat.mTento k",
        "%s GB",
        "%d%% pabeigti",
        "O5u`l5u",
        "n.,En resumen, has decidido hacer lo siguiente:",
        "Velikost ke sta",
        "cute en mode S. Ne choisissez cette ",
        "installation*Param",
        "iame kompiuteryje(Noriu ",
        "n!Esto puede tardar varios minutos.dNo podr",
        "lj en annan extern lagringsenhet",
        "elite nadaljevati, morate prenesti in zagnati najnovej",
        "ifriran s funkcijo BitLocker. Izberite drug pogon in poskusite znova.",
        "rile de actualizare.",
        "Dette kan ta noen minutter.",
        " USB, karta SD lub zewn",
        ": 0x%x] Windows ",
        "szlelt",
        "ration peut prendre quelques minutes.sBranchez votre ordinateur pour vous assurer que la batterie ne se d",
        " de %1!d! Go ou plus. Veuillez choisir un autre lecteur.&T",
        "rku, et aku ei saaks installimise ajal t",
        "te panaikintus failus i",
        "_peo0",
        "&Siguiente",
        "ijte extern",
        "&Back",
        "Toepasselijke kennisgevingen en licentievoorwaarden",
        " jour'V",
        "De gegevens die nodig zijn om de installatie van Windows te voort te zetten, kunnen niet worden opgeslagen. U moet deze later nog een keer invoeren.-Het toepassen van migratiegegevens is mislukt4Het opschonen van de installatiebestanden is mislukt=Het vaststellen van ondersteunde installatieopties is mislukt+Het valideren van de productcode is mislukt?Er kan niet worden bepaald welke versie van Windows u uitvoert.(De installatie van Windows 10 is mislukt",
        "traukti automati",
        "o 3 GB. Je",
        "ez %1!d! min.,Stvari, ki jih morate vedeti, preden za",
        "daryti",
        "-painiketta.`Tapahtui virhe, kun yritimme ratkaista ongelman puolestasi. P",
        "n.cNo sabemos si tu PC est",
        " se p",
        "0A$$@0",
        "utilisation du stockage. Ex",
        "111WWWddd",
        "cijas inform",
        "i unele limbi ",
        " Windows'un kullanmakta oldu",
        " uzman",
        "tu, vai vienumi, ko v",
        "tte med at installere Windows fra det sted, du var n",
        "r du kan oppdatere. Du f",
        "est pas disponible dans la langue et l",
        "onnistui. Avaa roskakori manuaalisesti.qTallennustilan k",
        "bor setup.exe.",
        "talovan",
        "818D8Q8X8t8",
        "V6eR{",
        "unalniku ",
        "i gata6Vom continua s",
        "etky pr",
        " tietokoneessa. Sinun on annettava Windows 10:n tuoteavain alla tai poistuttava asennuksesta, aktivoitava Windows ja aloitettava asennus sitten uudelleen.",
        " de Windows ar putea fi instalat",
        " (%d%%)",
        "n.0Asegurarse de que tu PC tiene espacio suficiente(",
        " en unos segundos",
        "dsb-DE",
        "ObafTento kl",
        "tama S-re",
        "Pasteb",
        "onecore\\internal\\sdk\\inc\\wil\\Staging.h",
        "eform",
        "ber obr",
        "s oper",
        "|No sabemos si tu equipo est",
        "nosti namestitveBNamestitveni program ni uspel preveriti veljavnosti klju",
        "Keiner",
        "ete poslije snimiti ISO datoteku na DVD.",
        "dik.\"A Windows 10 telep",
        "e se dodati automatski8Instalacijski program nije uspio u",
        " naujinimas]Nepavyko atidaryti saugyklos naudojimo. Dalyje Parametrai atidarykite saugykl",
        " jau parengtas j",
        "tzten Verzeichnis installiert wurde oder Sie versuchen, eine ",
        "Ovaj se klju",
        "A friss",
        "''.66",
        "sit lietot datoru. Pirms instal",
        "EtwEventRegister",
        "Chave do BitLocker",
        "CInstallUI::SwitchToProgressPage",
        "s de 4 GB (puede variar) y es posible que se apliquen tarifas de acceso a Internet. Haz clic en Siguiente para descargar los archivos de instalaci",
        "digo de error: 0x%x]8La instalaci",
        "Instalacja: %sYTrwa ponowne uruchamianie komputera przez system Windows w celu kontynuowania instalacji.",
        "Dit kan enkele minuten duren.",
        "ili instalaciju operativnog sistema Windows.",
        "a, SD kartice ili spoljnog ",
        ": %1!d!%%3",
        "dzie konieczne ponowne wprowadzenie informacji..Instalator nie mo",
        "INDIAN",
        "pule j",
        " a odstr",
        "<*=n=",
        " nouveau, ou essayer une cl",
        "o da vers",
        "ivitykset",
        "V&olgende",
        "ivitamine",
        "su BitLocker atsl",
        "o BitLocker ser",
        "nek csomagol",
        "Das kostenlose Update auf Windows 10 ist nur verf",
        "enosti skladi",
        ".,Windows 10 ",
        "3#4+4",
        "ne datoteke",
        ".?AVCSyncObject@@",
        " na in",
        "es-ES_tradnl",
        "e poskrbeli. Kliknite ",
        "Tarkistetaan avaintaNT",
        "o para a instala",
        "pen nem futtathat",
        "es est",
        "du laiku.",
        "=6=Q=",
        "3 3$3<3@3X3h3l3t3|3",
        "k, ja j",
        "\"Ponecha",
        "U kunt uw bestanden, apps en instellingen niet behouden omdat u %1!s! wilt installeren in een andere taal dan de taal die u nu gebruikt.",
        "jumi pal",
        "kite Toliau, kad atsisi",
        "NW0f0O0`0U0D0",
        " norite ",
        ".?AV?$CZeroInit@VCSetupResponsePageUpdateMedia@@$00@@",
        ")Download the latest version of Windows 10",
        ">*>O>~>",
        "&Ekranin",
        " uv>$+PoW",
        "ll-e a Windows 10 telep",
        "kolik minut trvat.UZapojte po",
        "kkelen finner du i esken som DVDen kom i, eller i e-postkvitteringen. N",
        "Lataa Windows 10:n uusin versio",
        "glen indeholder kun 25 tegn.",
        "ni iz po",
        "e namestitvene datoteke",
        "ava jezik ili izdanje verzije sustava Windows trenutno instaliranog na PC-ju.",
        "$Dispositivo de Armazenamento Externo",
        "got av f",
        "Kis t",
        "8hQgZ",
        ".~Nepavyksta rasti ",
        "da:$xD",
        "CInstallUI",
        "darykite s",
        "/Descargar la versi",
        "Error reporting telemetry for bOnFreeUpSpaceButtonClicked: [0x%X]",
        " riuscito a inizializzare la directory di lavoro*Parametri della riga di comando non validi",
        ".?AUIOleClientSite@@",
        "ana@Dators tiks vair",
        "n porque has decidido instalar %1!s! con un idioma diferente al que estas usando ahora.",
        "Arvuti kontrollimine",
        "BitLockerKey",
        "nete.1Sa",
        "inu rada. Odaberite ovo izdanje samo ako instalirate Windows na PC-ju dizajniranom za izvo",
        "(%2!c!: ",
        "'Microsoft-ohjelmiston k",
        " uudelleen, voit ohittaa t",
        "Nismo mogli shraniti informacij o namestitvi, ki jih potrebujemo, da lahko nadaljujemo namestitev sistema Windows, kjer ste kon",
        "yj urz",
        "emo ugovor o licenciranju.",
        "t personiskos failus un lietojumprogrammas Patur",
        "RtlGetVersion",
        "g itt: (%2!s!)oT",
        "anas programmai neizdev",
        "m Windows 10 se b",
        "Ann&uleren",
        "avons pu enregistrer les informations d",
        "\"Het ISO-bestand branden op een dvd",
        "o, ale nie uda",
        " bulunam",
        "rpackningen som DVD:n levererades i eller i din e-postbekr",
        "Es konnte nicht festgestellt werden, ob Ihr PC bereit ist, die Installation von Windows Server 2019 fortzusetzen. Starten Sie Setup erneut.",
        "..Atsisiun",
        "?L?h?",
        "CheckHotPluggableDriveEx: Drive %c SetupDiGetDeviceInterfaceDetail-1 Error: 0x%X",
        ".?AV?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIActivationActionResponse@@@@@@",
        "Bijna klaar",
        "t work. Try a different key or buy a new one.",
        "charger et ex",
        " du ta en titt p",
        "solu. Cliquez sur Actualiser pour le supprimer de la liste.lUn probl",
        "5%5,5]5",
        " oppdateringer, drivere og valgfrie funksjoner",
        " toimet ovat valmiit. Saat my",
        " executando.!Falha na instala",
        "n le a telep",
        "Y__^[",
        ".:<@^",
        "041A04B0",
        "v at genstarte Installation.gVi har desv",
        "Stvori instalacijski medij (USB izbrisivi memorijski pogon, DVD ili ISO datoteku) za drugi PC",
        "Otvori ko",
        " po instalaci fungovat spr",
        "setav, ja taask",
        "Recycle BinFEmpty your Recycle Bin to remove deleted files from your system drive.",
        "lne si prezrite vyu",
        "espace pour ex",
        "u obsahova",
        " klju",
        "|hK,_",
        "Diskov",
        "re versionrUne nouvelle version de cet outil est disponible. Vous devez t",
        "uz-Latn",
        "r ogiltigt, ange r",
        "skaitant failus, programas ir parametrus.",
        "OH0~0[0",
        "rtoti instal",
        "Non conservare nulla",
        "A edi",
        ", preto",
        " comprou online.",
        "7=7|7",
        "ave pri izvajanju skriptov precommit.cmd.",
        "tajai produkta atsl",
        "n Set",
        " datoru, lai turpin",
        "Please select the partition on which you want to install Windows.",
        "4(484<4@4H4L4P4d4h4l4p4x4",
        "t find a USB flash drive.",
        "luseadme valimine",
        "0M1T1`1x1",
        "u anda y",
        " preinstall.cmd+",
        " verze Windows, budete si muset koupit Product Key nebo licenci pro Windows",
        "#Se reporne",
        "ime.=Selles arvutis ei saa operatsioonis",
        "dni fog.",
        "0K0L0",
        "t savus Windows iestat",
        "5 585H5X5\\5l5|5",
        "e u jednotliv",
        "sr-Cyrl",
        " hetken aikaa.VM",
        "CInstallUI::OnActionChanged",
        "Pripravljamo nekaj stvari",
        "u an kulland",
        "Provjera PC-ja",
        "ejde do re",
        " att du vet vad det ",
        "1$1,141<1D1P1p1|1",
        "accepter.",
        " Internet.!",
        "~h_^]",
        "t telep",
        "s del reinicio, continuaremos desde el punto en que est",
        ":(:4:@:L:X:d:p:|:",
        " fie pe cutia ",
        "im PC datoram)P",
        " Microsoft software licence terms",
        " instala",
        "tkub automaatselt.",
        ",Nieprawid",
        "su produkta atsl",
        "klad USB k",
        " reikia atkreipti d",
        "Start forfra",
        "al imamo te",
        "kite saugyklos naudojim",
        "ve set your PC back to the way it was just before you started installing Windows 10.",
        "advapi32.dll",
        "r preinstall.cmd-distributionsskript%K",
        "CSetupResponsePageBitLockerKeyValidate: DeserializePage",
        "tirme i",
        "val, majd pr",
        "Download den seneste versionuDer er en nyere version af dette v",
        "van som ",
        "Clavier &visuel",
        "ni z prie",
        "Veljavna obvestila in licen",
        "ete presko",
        "Pobierz aktualizacje, sterowniki i funkcje opcjonalne (zalecane)",
        "rskenduste allalaadimise viisi",
        "uW0~0W0_0PA",
        "~0_0o0",
        "CWizardPage",
        "bbi utas",
        "in Tamam",
        "r for Microsoft-software",
        "Non posso continuare per uno dei motivi seguenti:",
        "Muuda Windowsi installiprogrammi v",
        "MediaType",
        "ENeGGGlllAA",
        "ovanie v in",
        "ifrovania BitLocker pre identifik",
        "Modifica la modalit",
        "Sto verificando se il sistema ",
        "te diegti ",
        "3+4T4q4",
        ";*;8;\\;",
        " parametreleri",
        "Product Key",
        " eliminado, incluindo ficheiros, aplica",
        "rtoti un pabeigtu Windows instal",
        "ltig. Geben Sie den richtigen Schl",
        "l~||l||g",
        " Windows 10 vo svojom po",
        " listo",
        "mtade filer",
        "CoAllowSetForegroundWindow",
        " bus prad",
        "cente.5T",
        "s espacio para la actualizaci",
        "ynnistyy uudelleen hetken kuluttua",
        "gle, og v",
        " USB. Rafra",
        "Abu`J",
        "BitLocker za",
        "kkelen fungerer ikke. Pr",
        "unaru su vra",
        " funkcie",
        ". XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "NMRn0 ",
        ">A preparar para transferir a vers",
        " naudoti",
        "n Microsoft",
        "d Product Key nefunguje. Zadejte znovu ten, kter",
        "rification de votre t",
        "tFSWW",
        "mu Windows v mieste jej preru",
        " Windows 10.  ",
        "HeapAlloc",
        "iu verziu.2Stiahnu",
        "charger la plus r",
        "Las siguientes acciones requieren tu atenci",
        "Von Setup wird vor dem Schlie",
        "Videti je tako: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX:Preden nadaljujete z namestitvijo, poskrbite za te stvari.",
        ", czy nie spowoduje to naliczenia dodatkowych op",
        "ene mo",
        "0o0JRd",
        "Dit USB-flashdrev er klar",
        "o suficiente%Deseja continuar usando esta sele",
        "t vagy kiad",
        "activ",
        "kolik minut trvat.",
        "sjQPh",
        "em izdelka, ki ste ga navedli, ni na voljo v va",
        "Nepodarilo sa n",
        "lne.cNepodarilo sa otvori",
        "CInstallUI::LoadResourceString",
        "ekilde yap",
        "CSetupResponseTemplate<class ICompatActionResponse>::ExecuteRoutine: Back button clicked.",
        "Al instalar esta edici",
        "n Windows 10:een. Pid",
        "m pom",
        "AmbelegAceast",
        "Updates, Treiber und optionale Funktionen herunterladen (empfohlen)",
        "tor cu aceasta: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX7Cheia Bit Locker con",
        " soubory. Otev",
        "rsler",
        "SXYYXXIFB=:",
        "ana v",
        " ne funkcionira. Poku",
        "k ISO fails j",
        "APPLY_IMAGE",
        "Miks ma seda n",
        "#$5'?",
        "ra verktyget p",
        "Windowsin asennus siirtyy online-tilaan p",
        "*m@e~",
        "rskendused on installitud, kuid nende t",
        "jamo att",
        "jlt egy DVD-re a(z) %1!s! haszn",
        "une copie activ",
        "ma. L",
        "%s\\%s.mui",
        "Il nous est impossible de d",
        " la Windows 10 este disponibil",
        "o.eO bit locker tem um aspeto semelhante a este: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX;A chave do bit locker apenas cont",
        ": https://aka.ms/windowsserverupgraded",
        "%s MB",
        "+ _(X",
        " architekt",
        "_<sNc",
        "unara dok se ponovo ne prijavite na njega.,Ne mo",
        " cheie nu func",
        " Windows 10C",
        " Windows 10.+Cette op",
        " de produit devrait se trouver dans la bo",
        "nd o alt",
        "041204B0",
        "tani, hogy a Windows 10 telep",
        ";$;0;P;\\;|;",
        "t'DDDD`D`````IKIII`",
        "valyti s",
        "Luo asennustietov",
        "&Atualizar",
        "Verificando esta chave0Esta chave n",
        "n no acepta argumentos de l",
        "Q!k_U",
        " se restartovat instala",
        "Sistem de operare:",
        "re %1!s! p",
        "rankos programa atsisiun",
        "GckQ]W",
        "bory a aplik",
        "teni a Windows Server 2019-et.YVissza",
        "ves p",
        "czenia taryfowego, sprawd",
        "rcare ",
        "ZZZvww",
        "ali. Pozneje boste morali informacije vnesti znova.;Namestitveni program ni uspel uveljaviti podatkov o selitvi=Namestitveni program ni uspel po",
        "saist",
        "Presque pr",
        "n necesaria para seguir instalando Windows. Reinicia el programa de instalaci",
        "t start installing Windows. Restart Setup and try again.",
        "ovat z jednoho z n",
        "Koristi preporu",
        ".data",
        " consigliabile sorvegliare il PC fino al prossimo accesso./Ecco un riepilogo delle opzioni che hai scelto:",
        "ches ",
        " reikia paleisti i",
        "ra9X4",
        "t uz DVD diska iepakojuma vai ieg",
        "lt megnyitni a Let",
        " recenti di Windows 10 nel PC. Spazio su disco insufficiente. Segui le istruzioni qui sotto per completare l'aggiornamento.&Libera %1!s! sul tuo PC (unit",
        "exploitation Microsoft",
        "Diskpartition",
        "na zarz",
        "ll need to buy a Windows 10 product key or licence to activate Windows 10 after the update.",
        " ir bandykite dar kart",
        "  &Je veux aider ",
        "4&4M4^4",
        ".(Vyberte in",
        "z birka",
        "z varsa, fazladan ",
        "mjIdk",
        "InstallationType",
        " voliteln",
        "hu-HU",
        "ncepe",
        " %1!d!",
        "e zna",
        "eme uvolnit %1!s! na jednotce %2!c!:.wHvis du vil installere Windows 10 p",
        "COMCTL32.dll",
        "ifra proizvoda ne funkcioni",
        "az-Cyrl",
        "e boste Windows 10 prvi",
        "Dine filer, apps og indstillinger kan ikke gemmes, fordi din aktuelle version af Windows muligvis er installeret i en mappe, der ikke underst",
        "CreateFileMappingW",
        "ma Windows Server 2019 ir gatava j",
        "k-N|v",
        " da configura",
        "Ce inten",
        "gt.'Der Product Key umfasst nur 25 Zeichen.",
        " olevista vaihtoehdoista.",
        "X0f0O0`0U0D0",
        "Rg0M0j0D0_0",
        "CIE O IN",
        "i<A ap",
        "yoruz.",
        "ters, inclusiv fi",
        "tenie n",
        "s lejupiel",
        "iul de stocare extern%Nu doresc s",
        "CSetupResponsePageBitLockerKeyValidate::ValidateBitLockerKey",
        "t tell if your PC is ready to continue installing Windows 10. Try restarting Setup.hSorry, we",
        ".?AV?$CZeroInit@VCSetupPageProgress@@$00@@",
        "To potrwa kilka minut.",
        "kleme %1!s! a",
        "sokat, friss",
        " na %1!ld! %%",
        " Windows.k",
        "o adicionados automaticamente<A chave de produto (Product Key) cont",
        "CInstallUI::UpdateProgress",
        " jour pour Windows",
        "lectionner un chemin d",
        "buj ponownie lub wypr",
        "rskendamiseks ruumi",
        " %2!c!:)y",
        ":::bcc",
        "Download di Windows 10 in corso",
        "t^9_`tY",
        "&Nadaljuj&Namestitev sistema Windows Server 2019",
        " sa aktualiz",
        "GetCurrentDirectoryW",
        "no koristite.",
        "0\"020B0R0b0r0",
        "de-AT",
        "ltozhat) ",
        " atsisiuntimas#Pasirinkite, kuri",
        "n de failure.cmd",
        "anas restart",
        ". Vapauta tilaa alla ja valitse sitten P",
        "SgqY0",
        " effectuer l",
        "de carregar os recursos de idioma9A instala",
        "emo da utvrdimo da li na va",
        "l a telep",
        "ny percig.",
        "v at k",
        "tres, fichiers et applications, car vous avez install",
        "Nichts beibehalten",
        "smj-SE",
        "s a instala",
        "as disku.",
        "ksta vietos. Pasirinkite kit",
        "o insuficiente no disco. Liberte algum espa",
        "e! Nastavite kad budete spremni.",
        "! Haz",
        "Do&kon",
        "2 3C3r3",
        "Instalacija ne prihvata argumente komandne linije. Vi",
        "dia, ktor",
        "saugoti tik asmeninius failus",
        "ur-IN",
        "%h$ qp",
        " Window 10 ",
        "vjfY=",
        "Juridic",
        "&Decline6If you decline the licence terms, you will exit setup.QWe need at least 350 MB of space to run setup. Create some space, then try again.6Windows Server 2019 a",
        "Pazljivo preberite, da boste vedeli, s ",
        "t akt",
        "Utilisez un appareil externe, tel qu'une cl",
        "pnych aktualizacji",
        "U0S0Q",
        "@@@@@@@@@@@@@@@@@@   ",
        "tkamiseks fail setup.exe.",
        "ANU: da",
        "ssen Sie mit einem Administratorkonto bei Windows angemeldet sein.5Sie m",
        "FveAddTrustedWimData",
        "cia m",
        "nico. Cuando te conectes a Internet, se activar",
        "{vgss",
        ".?AV?$CDlpObjectInternalImpl@VIDlpObjectInternal@@@@",
        "ConX::Setup::Common::CSetupLangIniLoader::LoadLangIni",
        "0@>$@0",
        "m.WBitlocker izskat",
        " yeniden girin.",
        "k igen.(Windows 10 ",
        "lne spustite %1!s!.",
        "bory zo syst",
        "rification de la compatibilit",
        "j instalaci spustit.%Po",
        "```   ",
        "i alt",
        "ltima versi",
        "``````",
        "'Persoonlijke bestanden en apps behouden&Alleen persoonlijke bestanden behouden",
        "gung, um sicherzustellen, dass Sie die aktuelle Version von Windows 10 installieren.",
        "i urm",
        "Det kan tage et stykke tid.VKonfigurerer opdatering til Windows 10",
        "Opazili smo, da imate za sistem Windows 10 starej",
        "sult, a hiba egy %2!s! m",
        "du Product Key a potom vyberte polo",
        " tuvum",
        " ne d",
        "Er is ten minste 350 MB opslagruimte nodig om de installatie uit te voeren. Maak ruimte vrij en probeer het vervolgens opnieuw.5Windows Server 2019 er ikke klar for denne PC-en enn",
        " 2019 est pr",
        "FGG1==",
        "Selecta",
        "jeblik8Der opstod problemer med at k",
        "avanje skripti za primenu preinstall.cmd,Izvr",
        "PQQSVW",
        "ta Windows",
        "Comprobando esta clave1Esta clave no funciona. Prueba con una diferente.",
        " diegimo fail",
        "lj eller anslut en extern lagringsenhet med minst %1!s! ledigt utrymme",
        "eme pokra",
        "9$9,949<9D9L9T9\\9d9l9x9",
        "e vam klju",
        "nit zp",
        "jat Windows PC dator",
        "###  q",
        " verilerini uygulayamad",
        "Essas atualiza",
        "JUw map Downloads kan niet worden geopend. Open de map Downloads handmatig.hDe dvd-brander kan niet worden geopend. Brand het ISO-bestand handmatig op een dvd met behulp van %1!s!.",
        "ivitysten saatavuus: %1!d!%%$T",
        "sto o velikosti minim",
        "unalniku ni mogo",
        "r kompatibelt med Windows 10.",
        "Windows ist auf diesem PC nicht aktiviert. Das bedeutet, dass Sie den Windows 10-Product Key unten eingeben oder Setup beenden, Windows aktivieren und Setup erneut starten m",
        " recenti.  Puoi ottenere i file pi",
        "emo koristiti alat na va",
        " soubory ze slo",
        "n para saber qu",
        "klemek istedi",
        "Neatbilst arhitekt",
        "sit, neaktiviz",
        " DVD.",
        "Completamento operazione: %d%%",
        "o alguns itens a ter em considera",
        "lTento n",
        ".Preuzmite najnoviju verziju sustava Windows 10",
        ">\">@>X>v>",
        "0f0K0",
        "avons pas pu trouver les informations n",
        " tienes que hacer despu",
        "Notiek ",
        "kovi za pristup internetu. Kliknite na dugme ",
        "Dalje",
        "a za sme",
        ".rdata$r$brc",
        "rification de votre PC+Assurez-vous que vous ",
        " installationsmediet.",
        "?;?f?x?",
        "ne valikulise funktsiooni ja keele.",
        " naujinimo parametrus.",
        "041304B0",
        "duaaa",
        "0@w$A0",
        "Bevar personlige filer og apps",
        ". Verifica",
        "[g0Y0n0g0",
        "4&4P4p4",
        "niteln",
        "i o unitate flash USB",
        "&Zatvori\"Nije mogu",
        " soubory odebraly ze syst",
        "U kunt uw bestanden, apps en instellingen niet behouden omdat u een editie van Windows installeert die verschilt van de editie die u nu gebruikt.",
        " se restartuje, budeme pokra",
        "Den ser slik ut: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXFDu m",
        " ativado neste PC. Isto significa que ter",
        "No pudimos instalar Windows 10[Hemos revertido tu PC al estado en que estaba justo antes de empezar a instalar Windows 10.",
        "Installerer Windows 109PCen startes p",
        "nda det h",
        " produktu %1!s! w innej wersji j",
        "lna verzia Windowsu je pravdepodobne nain",
        "nily nebo odebraly. Syst",
        "ie de Windows. ",
        "logo Inv",
        "jlok haszn",
        " megnyit",
        "Odabir pogona",
        ". Viimeistele p",
        "t, nen",
        "o wykona",
        "Nous ne sommes pas certains de ce qui s",
        "Uppdateringarna ",
        "ments suivants requi",
        "i pot include remedieri importante, drivere de dispozitiv actualizate ",
        "cie0In",
        "636Q6q6~6",
        "%%%1!d! tamamland",
        "Nada+Poder",
        "Detta tar n",
        " (5~:",
        "Tilanne: %1!d!%%?Jatka valitsemalla jokin k",
        "n de Windows autom",
        "o.{Estamos com dificuldade para determinar se seu computador pode executar o Windows 10. Feche a Instala",
        "ne datoteke i aplikacije",
        "zden ge",
        ", abyste m",
        "vel determinar se o seu PC est",
        "lineen Setup.exe-tiedostoa.jEi ole varmaa, voiko tietokone jatkaa Windows 10:n asentamista. Yrit",
        "Arhitectura nu se potrive",
        "Kontrollera kompatibilitet",
        "10IObtenir des mises ",
        "e-No0\\PbkW0~0Y0L0",
        "en-TT",
        "i znak",
        "ISO File (*.iso)",
        "e skupiny %d je neplatn",
        "em izdelka aktivirajte trenutno razli",
        "cuter cet outil sur votre PC. Si vous rencontrez toujours des probl",
        "Entrez la cl",
        " Internet, ativaremos o Windows automaticamente.",
        "Palaukite",
        "anas datu nes",
        " %1!d! GB",
        " vai j",
        "vururken hata kodunu bildirin.",
        " przerwano.8Na tym komputerze nie mo",
        "tkake.",
        "I4P!I",
        "Otvorite DVD pisa",
        " DVD napa",
        " de produit doit se trouver dans le bo",
        "t fra det punkt, hvor jeg stoppede",
        "avons pas pu installer Windows 10",
        "Id. de di",
        " vydanie Windowsu, ne",
        "v/f&T",
        "\"Zadr",
        "000@@@@@@",
        ";1;7;<;Q;f;",
        "SECOND_BOOT",
        "If Windows 10 was previously installed and activated on this PC and you",
        ".?AVCSetupResponsePageMediaCreationSuccess@@",
        "s veicam sagatavo",
        "chir la liste des lecteurs",
        "l a sz",
        "Baixar a ",
        "en-IE",
        " sa skripty nasadenia failure.cmd",
        "es importantes, controladores de dispositivos atualizados e ficheiros adicionais que n",
        "ntOAz eszk",
        "Ne moremo ugotoviti, ali je va",
        "espace disponible sur votre PC",
        "Installing Windows 10<Your PC will restart several times. This might take a while.\"Please wait while setup is exiting",
        "digo de error: 0x%x]<La instalaci",
        "kernelbase.dll",
        "We bereiden een paar dingen voor",
        "OutputDebugStringA",
        "D$(PP",
        "KOva ",
        "ivad sisaldada olulisi parandusi, v",
        "d Product Key alebo licenciu na Windows 10.",
        "31373",
        " de produit Windows 10 ci-dessous ou quitter l",
        "lleen sis",
        "me(Produkta atsl",
        " nytt n",
        "m pomoct z",
        "mber ja saate selle p",
        "CSetupResponseTemplate<class IActivationActionResponse>::ExecuteRoutine: Back button clicked.",
        "los pal",
        "GetFileAttributesW",
        "0D0O0d0K0n0",
        "v at genstarte Installation.9Kontrollerer, om der er tilstr",
        " naujo, t",
        "tres.M",
        " preinstall.cmd./",
        "Voglio usare la memoria esterna#Non voglio usare la memoria esterna",
        "unalnik se bo vsak hip znova zagnal(Preverjanje, ali so na voljo posodobitve2Preverjanje, ali so na voljo posodobitve: %1!d! %%",
        "chargement peut occasionner des frais suppl",
        "lj sedan Uppdatera.",
        "o sem problemas e podem incluir corre",
        "Potrebujeme viac miesta4Vy",
        "hrend der Windows-Installation k",
        " sem bateria durante a instala",
        "9%9+9G9R9Y9",
        "le asukohas %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml ja k",
        "jjk%xxy",
        " listo para este equipo(Comprobando si la instalaci",
        "CSetupResponsePageInstallNowOrLater",
        "n.|Se necesitan al menos 350 MB de espacio para ejecutar el programa de instalaci",
        "=%=2=G=[=",
        " %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml, ",
        "Tarkista yhteensopivuus",
        "(jAet",
        "Setup akzeptiert keine Befehlszeilenargumente. Weitere Informationen finden Sie in der Setup-Hilfe oder durch Ausf",
        "n tietokoneeseen ensimm",
        "Open Downloads",
        "0!kn0\\Omi",
        "niku instalacyjnym. Je",
        "8O Windows Server 2019 ainda n",
        "k ment",
        ":TUPNNL2",
        "Enne v",
        "gu-IN",
        " ponownie uruchomiony. Po ponownym uruchomieniu b",
        "mos que tem ficheiros de instala",
        "Opnieuw beginnen vanaf het begin",
        "4Q4z4",
        " S.[USB ",
        "BitBlt",
        "en Sie Setup, und wiederholen Sie den Vorgang.*Windows ist auf diesem PC nicht aktiviert.",
        "ljaji bodo dodani samodejno",
        "^YofSKKMcmY^",
        "r sedan installationen igen.aMer information om hur du uppgraderar Windows Server finns i: https://aka.ms/windowsserverupgraderVi kan inte avg",
        "[g0M0~0[0",
        "cia dial",
        "Seuraavat asiat on hyv",
        "(%1!c!:) - %2!s! libre",
        "w w celu zagwarantowania, ",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::GetResponseName",
        "Obnovi",
        ")Windows 10 uusima versiooni allalaadimine",
        " aktywowany na tym komputerze",
        "ker efter uppdateringar: %1!d!%%",
        "ih razloga:",
        "chte helfen, die Installation von Windows zu verbessern",
        " de produit Windows 10 ci-dessous, ou quitter le programme d",
        "%s GBwVi kan ikke sige, om pc'en har nok plads til at forts",
        ", ja k",
        " a vers",
        ".?AVCSetupResponsePageBase@@",
        " versio vain silloin, jos asennat Windowsin S mode -tilaa tukevaan tietokoneeseen.NUSB-muistitikun koon on oltava v",
        ".?AVIDlpObject@@",
        "ste to znova alebo vysk",
        "PL0g0M0~0W0_0",
        "t save the installation information that we need to continue installing Windows from where you left off. Sorry, you",
        "tta aega.zWindowsi installimisel ilmnes ootamatu t",
        "i acum copii backup ale acestora pe o alt",
        "'Microsofti tarkvara litsentsitingimused",
        "le pri sebe a",
        "D$HSV",
        "(CD9I",
        "Potrajat ",
        " ir i",
        "Uppdatera enhetslistan Det beh",
        "rX\"dP4H",
        "o do Windows Server 2019 Instalando o Windows Server 2019",
        "stroj nepodporuje.",
        "s abajo si quiere averiguar por qu",
        "ili instalirati %1!s! uz jezik koji se razlikuje od onoga koji trenuta",
        "n las aplicaciones y la configuraci",
        "t able to download all of the necessary files. Check to make sure you",
        "7 8'8-828>8H8[8g8",
        "RPCRT4.dll",
        ".:Nepavyko diegimo etapas %1!s! d",
        "Na&zaj",
        "CSetupResponsePageInstallChoice",
        "dik. Pr",
        "Scegli il supporto da usare",
        "o de scripts precommit.cmd.",
        " vietas, kur t",
        " program Windows 10. A",
        "tit./See tootev",
        " USB, DVD ou fichier ISO) pour un autre PC",
        "es; Windows 10 est automatiquement mis ",
        "se problemet og kj",
        "installation ne peut continuer, car Windows ne peut  red",
        "Selecci",
        "r du loggar in i Windows 10. Skydda dina data genom att ha datorn i n",
        "trzny i kliknij przycisk OK, aby ponownie uruchomi",
        "ycia magazynu. Uruchom r",
        "Om du installerar den h",
        "ra sa nezhoduje",
        "rer de l'espace. Puis, essayez de nouveau.CUn probl",
        " conectado ",
        "%h.vvZu",
        "lck8^",
        "in actualiz",
        "ma ar instal",
        "nPPPP",
        "Installiprogramm puhastab enne sulgemist",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "qps-ploca",
        "Namestitvenih datotek za Windows ni mogo",
        ": %d %%.",
        " vain henkil",
        " Windows med en administratorkonto.)Du m",
        "trukti, kol bus patikrinta, ar tai, k",
        "e nastavenia pre %d%%",
        "a. Je",
        "ir) olabilir ve internet eri",
        " rakt",
        "ga nedarbojas. V",
        "r od spolo",
        " jednotku a kliknite na tla",
        " ISO-",
        "m apenas 25 carateres.",
        "ga darbojas! Turpiniet, kad esat gatavs to dar",
        "=$=4=8=<=T=X=\\=`=h=",
        "i nu are suficient spa",
        "cia na Windows 10 je k dispoz",
        "s que comprar una clave de producto o una licencia de Windows 10 para activarlo tras la actualizaci",
        "klenmi",
        "gerbereinigung auszuf",
        "0@d$A0",
        "j-Yf;",
        "dzie ponownie formatowa",
        "rkeit",
        " Windows 10. For ",
        "s sa vyskytol probl",
        "Brenn ISO-filen til en DVD",
        "anas programmu.",
        "Usa le opzioni consigliate per questo PC",
        "pGetHostCSDBuildNumber",
        "040B04B0",
        "3Windows 10",
        " pronto para este PC",
        " Internet. Clique em transferir para obter os ficheiros de instala",
        "vi-VN",
        "r installasjonen er fullf",
        "iam kompiuteriui$",
        "Ako prvi put instalirate",
        " chyba. Overte, ",
        "[6b/e",
        "sti+Pasirinkite kit",
        "r produktnyckeln fungerade inte. Kontrollera att den st",
        " haluat s",
        "Transferir a vers",
        " jour appliqu",
        "Die Windows-Edition, die dem von Ihnen eingegebenen Product Key entspricht, ist in Ihrer aktuellen Sprache und Architektur nicht verf",
        "m apenas 48 carateres.BO valor da chave %d do grupo ",
        "ii despre upgrade-ul pentru Windows Server, vizita",
        "seket, lehet, hogy a sz",
        "r kopplad till produktnyckeln du angav ",
        " vontade para continuar usando seu computador.FA instala",
        " parametrus, asmeninius failus ir programas reikia atkreipti d",
        "elim koristiti vanjski ure",
        "Eemaldage j",
        "ta klaida.",
        "0(080H0L0\\0l0p0",
        "tartuje po",
        "i spustit. Pokud se budou probl",
        " datorn. Om problemen kvarst",
        "m vyrie",
        "re plads, og pr",
        "lgende:",
        "i un dispozitiv de stocare extern cu spa",
        "Dosyalar",
        "&Kontrollerer at installasjonen er klar",
        "CreateFontW",
        "Noudetaan p",
        ":8;P;",
        "ssel funktioniert nicht. ",
        "`1Xn0",
        "@ ;A u",
        " proizvoda.)USB izbrisivi memorijski pogon je spreman",
        "Vii see arvuti kohe uuemale versioonile ",
        "(WvQ-N",
        "rmtangentbordet",
        "Preverjamo va",
        "dia de instala",
        "iile mai t",
        "n 350 Mt tilaa. Vapauta tilaa ja yrit",
        "r kan ta en stund.",
        "n ve yeniden deneyin.",
        "chec de l",
        "ciem.3Poczekaj na zako",
        "ie de salvare.",
        "sti su ",
        "rcarea are aproximativ 3 GB. Dac",
        "nak l",
        "Instalar o Windows 10=Obter atualiza",
        "t available in your current language and architecture.",
        "itada#Teie arvutis juba t",
        "rk on veel j",
        "0#070H0q0",
        "SendMessageW",
        "Stato: %1!d!%%7Seleziona una delle opzioni disponibili per continuare.",
        " problem podczas uruchamiania tego narz",
        "dzu, uzgaidiet",
        "p ard",
        "gbar.",
        "ionarea instal",
        "n de unidad9El programa de instalaci",
        ", nie ma wystarczaj",
        "vce./Budete muset vyp",
        "\\\\\\\\[",
        "|||v|xp",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::ExecuteRoutine",
        "Valitse n",
        "j0\\Omi",
        "p alkalmas-e a Windows 10 futtat",
        " systemu Windows 10 na Twoim komputerze, poniewa",
        "iek tiek vietos ir pasirinkite Atnaujinti.",
        "o preinstall.cmd/Executando scripts de implanta",
        " fail",
        "Vymenite",
        "Instal",
        "Kurulum komut sat",
        "Ja turpin",
        ".*%2!s! ",
        "De nieuwste onderdelen en beveiligingsverbeteringen voor Windows 10 kunnen niet op uw pc worden ge",
        "P(bnvN0",
        "kite Setup.exe.cNe",
        " possibile installare Windows Server 2019Y",
        "nceki haline geri getirdik.",
        "  C&hci pomoct s vylep",
        "puj zgodnie z poni",
        "Pred zavret",
        "N`OS_MR",
        " Microsoft Corporation. Minden jog fenntartva.",
        "cz komputer do zasilania, aby bateria nie wyczerpa",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::Cancel",
        "rel k",
        "ch soubor",
        "bb 350 MB szabad helyre van sz",
        "3 3<3T3l3",
        ".?AVCBitLockerKeyEdit@UX@Common@ConX@@",
        "Weitere Informationen",
        "yt48<<",
        ", joka ei ole sama kuin t",
        "eme na v",
        "==E===?5",
        "CSetupResponseTemplate<class ICompatActionResponse>::OnNext",
        "rer distribusjonsskript for failure.cmd",
        "Na pozad",
        "CreateThread",
        "\\\\\\[[RRRBB/(",
        "CInstallUI::ConfirmEulaDecline: Eula decline aborted",
        "Windows 10 Setup",
        "CInstallUI::OnProgressChanged: Cancel is requested. Returning ERROR_REQUEST_ABORTED",
        "Atidaryti ",
        "Provera ra",
        " (%2!c!: ",
        "ed zav",
        "kkelen3Denne n",
        "Pasirinkite atvaizd",
        "t(,,,,",
        "tu, lejupiel",
        "velgiant ",
        "iu3%1!d! GB de spa",
        "RtlNtStatusToDosError",
        "Listo para instalar",
        "Tai gali u",
        "ncercat s",
        "bMMMw\\y",
        "ice sistema Windows, ki je trenutno name",
        " setup.exe ",
        "iA haszn",
        "aja i dodatne datoteke koje se ne nalaze na instalacionom medijumu. Ako ne instalirate ove ispravke sada, ra",
        " jsou pot",
        "&Neste",
        "(d(e`",
        "No sabemos si el equipo tiene espacio suficiente para seguir con la instalaci",
        "%d tegn igjen",
        "n den du anv",
        "jiet uzst",
        "bory ponecha",
        "Neodpov",
        "mmern Sie sich bitte um die folgenden Punkte, um die Installation fortsetzen zu k",
        "Jos olet asentamassa Windows 10:n t",
        "Me ei saa kindlaks teha, kas teie arvutis on Windows 10 installimisega j",
        "Imposibil de g",
        "Les fichiers de votre disque USB vont ",
        "ppna papperskorgen manuellt.RDet gick inte att visa lagringsanv",
        "Nevar atrast Windows instal",
        "-|L\"ht",
        "0k0o0",
        "tzten Installationsoptionen konnten nicht ermittelt werden..Der Product Key konnte nicht ",
        "GetSystemTime",
        "to sledi.PDa biste nastavili instalaciju, potrebno je da obratite pa",
        "i datoteke, aplikacije i postavke.",
        "7!8(8/8f8",
        " avgj",
        "tor: 1Windows potrebuje na aktualiz",
        "5:6c6",
        "Det oppstod en uventet feil under installasjonen av Windows. Kontroller at installasjonskildene er tilgjengelige, og start installasjonen p",
        "Sisestage Bitlockeri v",
        "Q!k{veQ",
        "stas, bet j",
        "~P7\"HUUHHHHH7%",
        ", Windows ",
        "4Windows Update ",
        "sek, az illeszt",
        "e naprej uporabljati ta izbor?",
        "nda datorn som vanligt.",
        "@@@000",
        "tenka vietos+Ar tikrai norite t",
        "n de Windows. Inserta tu medio de instalaci",
        "N DE INSTALACI",
        "aj za pohranu,Ne ",
        " program a sk",
        "o.1Seleccionar dispositivo de almacenamiento externo",
        "m Kutunuzu bo",
        "installation pour recommencer.}Le programme d",
        "aj za preuzimanje ima oko 3 GB. Ako koristite ograni",
        "o do Windows. Tente uma chave diferente.dEsta chave do produto (Product Key) n",
        "sten klar",
        "kkelen inneholder bare 48 tegn.?N",
        "o suficiente para continuar a instalar o Windows Server 2019. Tente reiniciar a Instala",
        "alost, poslije ",
        "CInstallUI::ShowMessageBox: Showing MessageBox",
        "anas programma. P",
        " versiune de Windows 10",
        "{IDATx",
        "p do Internetu. Kliknij przycisk Dalej, aby pobra",
        "ments volumineux..S",
        " ayarlar b",
        "n.iKurulum program",
        "i eso",
        "Za&vrie",
        "bW0f0D0~0Y0",
        "tirmeden devam ederseniz, g",
        "uriranja moramo u",
        "(&R)E",
        "Kontrollerar nyckeln9Den h",
        "2.2H2O2h2",
        "ite u pomo",
        "Windows Kurulumu'nun g",
        "High Contrast White",
        "t svar",
        "%1!d!%% ",
        "installe Windows",
        "v[wwgK:",
        "PL0g0M0_0",
        "N0L0J",
        "i fejlett hardvert ig",
        "llningar och appar tas bort, men dina filer beh",
        "EtwEventWrite",
        "lida. Escribe la clave correcta.5Escribe la clave de Bitlocker para el identificador: *Windows necesita espacio para actualizarse",
        "b&TY0",
        " i uruchomi",
        "rbaude",
        "CSetupResponseTemplate<class ICompatActionResponse>::ExecuteRoutine: Next button clicked.",
        "A verificar o seu PC",
        "Kontroluje se v",
        ";RU_:g",
        "toru sa nepodarilo ur",
        "iamieji diskai",
        "m soubor",
        " jour et reprendra lorsque vous vous connecterez ",
        "?!?F?h?u?",
        "rjade installera Windows 10.",
        "cej ilo",
        "seTEz a term",
        "L$t_^[3",
        "gikast k",
        "lectionner une image",
        "rer scripts til udrulning af preinstall.cmd,K",
        "313Y3g3",
        "Dodatne informacije",
        "installation sont accessibles, puis relancez l",
        " retomada quando voc",
        "i este criptat",
        ": 0x%x]A",
        "m toate fi",
        "rre problemer med at fastsl",
        "%hs: Failed to read 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber'. Error = %d",
        "kleme tamamland",
        "lemini yeniden ba",
        "Jos asennat Windows 10:n tietokoneeseen ensimm",
        "re mediet for ",
        "o pudemos salvar as informa",
        "7$7(787<7T7X7\\7`7d7h7l7p7t7x7|7",
        "Deseas continuar usando esta selecci",
        "Die Editionen stimmen nicht ",
        "jjk@uuv",
        "2-2?2g2t2",
        " dokon",
        "luseadet ",
        "sst*wwx",
        "(Windows",
        "%KzQ*U0<|",
        "bg-BG",
        "unalo. Instalacija sustava Windows automatski ",
        " leidimu. Bandykite kit",
        "HZo6m|",
        "e informacija",
        "memmove",
        "inu S.EPogon USB mora biti velik vsaj %1!d! GB ali ve",
        "ete zadr",
        "rste gang, m",
        "eri ge",
        "outil ",
        "nda v",
        "u. Lorsque vous vous connecterez ",
        "Asjad, mis vajavad teie sekkumist",
        "scht. Wenn Sie die Dateien beibehalten m",
        "es estiverem sendo instaladas. O Windows n",
        "N4h_N",
        "ivitage arvuti. Windowsi install j",
        "chec du nettoyage des fichiers d",
        "2F5g5",
        "ll have to re-enter your information later.(Setup has failed to apply migration data,Setup has failed to clean up the setup files7Setup has failed to determine supported install choices,Setup has failed to validate the product key9Setup can",
        "I&nstaller",
        "latarak Windows y",
        "s ellen",
        "7]9d9z9",
        "ceho prihl",
        "pulej",
        "4Z4d4",
        "fr-CD",
        "teni az ",
        "r installationen er fuldf",
        "jeblikket er installeret p",
        "ntalo de nuevo.-Windows 10 a",
        "ra uppdateringen.%Frig",
        "lreiz.+Lejupiel",
        " do elektrickej siete, aby sa bat",
        "ate v ra",
        "AllalaadimisedDEemaldage mahukad v",
        "yet kan ikke oppdatere PC-enxSpr",
        "\"***d",
        "e oczy",
        "te computerul pentru a continua instalarea.",
        "ny dolgot m",
        "Informativa sulla privacy",
        "tte.3Download det opdaterede v",
        "Sugest",
        "iame kompiuteryje. Tai rei",
        "tenje pohrane u postavkama da biste uklonili druge velike stavke.\"Odabir vanjskog ure",
        "o mais recente do Windows 10",
        "hemalt %1!d! GB.",
        "sait, mert a Windows jelenlegi verzi",
        "riode de soutien; le soutien peut varier selon les appareils.",
        "o com tr",
        " Internet et essayez d",
        " program.",
        "dakilerden biri nedeniyle devam edilemiyor:",
        "nnj:}",
        " de introduzir uma chave de produto.",
        "ring om beskyttelse af personlige oplysninger",
        "INFORMAZIONI SULL'INSTALLAZIONE: per alcune funzionalit",
        "hlt haben, dass %1!s! mit einer anderen als der gerade verwendeten Sprache installiert werden soll.",
        "Cambia la forma en que el programa de instalaci",
        "Nous ne pouvons pas installer les derni",
        "ste skriva in den igen senare.)Det gick inte att till",
        "ga nedarboj",
        " tietokoneessa ja asennat sit",
        "Do not turn off your computer",
        "CSetupResponsePageBitLockerKeyValidate::OnSetCursor",
        "_U2QX[",
        "Prullenbak openen",
        ". Windows",
        "ppp@@@@@@@@@ppp",
        "tsa el a sz",
        "ha-Latn-NG",
        "ciju par jaunin",
        "bbiakr",
        "N0RvQ",
        "sst]sst*",
        ". Jos et asenna n",
        "Atlasiet ",
        "cz zewn",
        "rbeli let",
        "hRemova a seguinte unidade externa e clique em OK para reiniciar e concluir a instala",
        "enite ",
        "6!6-6c6",
        " pietiek vietas)Vai v",
        "NY0P0",
        ".?AV?$CDlpResponseImpl@V?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDiskSpaceActionResponse@@@@@@@@@@",
        "ierele personale Windows%P",
        "%s is geen geldig teken",
        " Windows Update.VNotiek Windows 10 atjaunin",
        "A Instala",
        ".?AVCSetupPageMessage@@",
        ".?AVCBitmap@@",
        "HotovoJV in",
        "Leidimas",
        "I jedno i drugocOvaj Bitlocker klju",
        "10. Afin de prot",
        "nik do u",
        "kc0f0D0~0Y0",
        "k och den arkitektur du anv",
        " listo para este equipo-Asegur",
        "ionale",
        "t supported by this tool.",
        "til do stavu, v akom bol pred spusten",
        "Esta chave do produto (Product Key) s",
        "das kods: 0x%x]-Rad",
        "Translation",
        "This will take a few minutes.",
        "Descargar1Conserver les fichiers personnels et applications;Conserver les param",
        " %s n",
        "Preuzmi ispravke, upravlja",
        "te nastaven",
        " jau darbojas sist",
        "al ne moremo ugotoviti, ali je Windows Server 2019 ",
        "CSetupResponsePageUpdateMedia",
        "8+828Q8",
        " a in",
        "r Windows 10",
        "ania preinstall.cmd-Uruchamianie skrypt",
        " muita p",
        "ch pozn",
        "cie$Vyh",
        "Stahov",
        "lisan.}Nem siker",
        " parametrus ir asmeninius failus",
        "Kontrollerer din pc-Kontrollerer, om du er klar til at installere",
        "est pas disponible dans votre langue et votre architecture actuelles.",
        "kojiet kr",
        "2J2g2",
        "dzie nie obs",
        "V:N`OS_MR",
        "innUSB s",
        ".&Paleid",
        ".?AVCSetupResponsePageSummary@@",
        "al ne moremo ugotoviti, ali je Windows 10 ",
        " wersj",
        "Atuali&zar",
        "bory ve",
        "ali Windows postavke, li",
        "lla viktiga korrigeringar, uppdaterade enhetsdrivrutiner samt ytterligare filer som inte finns p",
        "ania instalatora",
        ": :$:*:.:4:8:A:Q:b:f:l:p:v:z:",
        "ProfessionalN",
        "BeggedDenne BitLocker-n",
        "GetModuleHandleExW",
        "0>q5m",
        "0A$$?0",
        "chten Sie die Aktion wirklich beenden?",
        "m souhlas",
        "t pour l",
        "Se eliminar",
        " program a zkuste ho spustit znova..Windows Server 2019 se nepovedlo nainstalovat. Instaluje se Windows Server 2019",
        "Windows 10 UpdateVOtvaranje iskori",
        "ljaande installimisel konfigureeritakse teie arvuti t",
        "asti sa upravili alebo odstr",
        "rjest",
        " parink",
        "c>o1o;",
        "BODY {background-color:rgb(%d,%d,%d);}",
        "? ?$?(?,?0?8?P?T?l?p?t?",
        "Comprobando PC",
        "dzu, atlasiet vienu no pieejamaj",
        "$#bnVf",
        " go i spr",
        "Przygotowywanie sk",
        "Zie hieronder voor meer informatie.",
        ". Zav",
        "Pripravljanje namestitve ",
        "gga till funktioner i Windows. Den kan inte anv",
        "kleme kaynaklar",
        "installationiLe programme d",
        " uruchomiony ponownie. Po ponownym uruchomieniu b",
        "jlokat, k",
        "Zachovat jenom osobn",
        "5c5~5",
        "Ouvrir la corbeille",
        "vesnice na obrazovce",
        "Windows Server",
        "os ser",
        "sti tilaa Windows Server 2019:n asentamisen jatkamiseksi. Yrit",
        "Vyzer",
        "li nie zaakceptujesz warunk",
        "t Windows 10_M",
        "A Windows 10 leg",
        "m yerden devam et",
        "0:FDI8IIIIOIIIFIcu",
        "est pas valide, saisissez la bonne cl",
        "t&hh{",
        "is produkto kodas neveikia. I",
        "siamas diegimas.",
        " za bitlocker sadr",
        "m Windows 10 p",
        "yor! Haz",
        "n tus archivos.PSe eliminar",
        "`Ock(W",
        "ciou tohto vydania Windowsu 10 nakonfigurujete po",
        " daryti toliau. ",
        " %1!s! na jednotke %2!c!:.}Om du vill installera Windows 10 p",
        "i amovibile",
        "saca ",
        "5OHHHHHG9$",
        "zda olmal",
        "xBf|v",
        " tuoteavaimella voi vain lis",
        "Flyttbara enheter",
        "espace libre sur le lecteur que vous tentez d",
        "%2!s!7Va",
        "0f0D0~0Y0",
        " tudo pronto;Continuaremos a instala",
        "chto vybrat",
        "nda olemasolevat funktsiooni on muudetud ja m",
        "ar-SA",
        "e uporabljati Windows 10. Zaprite namestitveni program in poskusite znova.",
        "mi helyet, majd v",
        " izdelka",
        "~bvvv",
        "tse ki a Lomt",
        "a zariadenia.",
        ", lai ieg",
        "ri.UNu s-a reu",
        "sim, kad t",
        "pjen ki a telep",
        " Windows Server ",
        " precommit.cmd",
        "n eri",
        "n autom",
        "ta aktiviz",
        "Provjeravanje PC-ja,Provjeravamo jeste li spremni za instalaciju",
        "tirmek i",
        " proizvoda je ispravan! Nastavite kada budete spremni.",
        "tg-Cyrl",
        "(sf*SHU0",
        "lacak medyay",
        "dakilere dikkat etmeniz gerekir.QBit kilidi ",
        "Brez&(%1!c!:) ",
        "Izaberite sliku koju ",
        " a formatear el dispositivo de almacenamiento externo, y podr",
        "lo k chyb",
        " jako administratorjAby skorzysta",
        "pa-Arab-PK",
        "yor!Birka",
        "r uppdateringen",
        "040504B0",
        " jis tur",
        "ka bir b",
        "dos, assim como do que ter",
        "L'unit",
        "We weren",
        "hnout aktualizovan",
        "%1!s! %2!s!\"Houve um problema ao criar a m",
        "%3!s!'",
        "Burn the ISO file to a DVD",
        "ra installationsprogrammet. Frig",
        " se mi to tu objevilo?",
        "yor %%%d",
        "QQSVW3",
        "Vi kan ikke fortsette av ",
        "emo procijeniti ima li na va",
        "3,3<3T3l3",
        "ndning i inst",
        "ete da kupite ",
        " %1!s! (disks %2!c!)RAtlasiet vai pievienojiet ",
        "LP.CAB",
        "bbfejleszt",
        "Pildi valimine",
        "ndan yeniden deneyin.",
        " da chave do produto.!Sua unidade flash USB est",
        "Activation",
        "e lub nieu",
        "rskenda draiviloendit*Sellel peab olema ruumi v",
        "CInstallUI::ShowCompatResolvedMessage: Ignoring since error page is shown",
        "ke programe i opcionalne funkcije (preporu",
        "o do Windows 10 no Windows Update.WConfigurando a atualiza",
        "TargetUsbDrive",
        " pronto para este computador'Verificando se a instala",
        ", produkto kodo ",
        "G,PSWhp",
        "10.Cette op",
        "ka se mo",
        "Windows 10 ",
        "chec de la validation de la cl",
        "{6?>1",
        " gjenoppta installasjonen.",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::GetResults",
        "CInstallUI::OnProgressChanged",
        "i nain",
        "t %1!s!, izmantojot valodu, kas at",
        "CorbeillePVidez la Corbeille pour effacer les fichiers supprim",
        "ivitage %1!s! k",
        "Download wird ",
        "s egy kis id",
        " Internet e tente executar a ferramenta novamente.7Ocorreu um problema durante a execu",
        "liorations de la s",
        " parametrai ir programos bus panaikinti, bet failai i",
        "Atualizar a lista de unidades$S",
        "r det spr",
        "t, ir sader",
        "CInstallUI::ShowRollbackPage",
        "lemadbSee BitLockeri v",
        "e informacija o nadogradnji poslu",
        "n gratuita a Windows 10 solo est",
        " estiver instalando o Windows 10 no PC pela primeira vez (ou instalando outra edi",
        " 4GB+ (",
        " ne fonctionne pas avec cette ",
        "USB-flashdrev",
        "rer avinstallasjonen.",
        "/?$$@0",
        "zda Windows 10",
        "1'1-13191B1R1b1r1",
        "&Nainstalovat",
        "3N3,4y5",
        " la rularea acestui instrument",
        "D$Tfff",
        "o gere as suas defini",
        "anas programmu.+Noskaidroju, vai j",
        "Nie mogli",
        "hren von Setup. Geben Sie Speicherplatz frei, und wiederholen Sie den Vorgang.",
        " Windows 10%",
        "rios. Verifique se voc",
        "RedrawWindow",
        "ssel umfasst nur 48 digitale Zeichen.",
        "nnen Ihre Windows-Einstellungen verwalten.RIhre Einstellungen und Apps werden gel",
        ". Windows v",
        "o podemos determinar se seu computador est",
        "sikraus.",
        "o de Unidade7A configura",
        "Bunu neden g",
        " Windows.%",
        "bamos.(Este equipo no puede ejecutar Windows 10",
        "rskenduste, draiverite ja valikuliste funktsioonide hankimiseks. Need v",
        "hlen Sie ein anderes Laufwerk aus, und versuchen Sie es erneut.",
        "a. Spr",
        "nso-ZA",
        "unar i dovr",
        "emy Ci zwolni",
        ".?AVCButtonEx@UX@Common@ConX@@",
        " Windows-versiotasi, sinun on ostettava Windows 10 -tuoteavain tai -k",
        "0C0C04B0",
        "ekneme v",
        " korjauksia, laiteohjainten p",
        "w+Wymagany jest rozmiar co najmniej %1!d! GB.",
        "nchide automat peste %1!d! minute./Lucruri care trebuie ",
        "DOWNLEVEL",
        " instalada actualmente en tu PC no es compatible con esta herramienta.",
        "Pripravuje sa %d%%",
        " mindst %1!d! GB.",
        "lectionnez la langue, l'architecture et l'",
        "liorer l'installation. Elles incluent ",
        "2019>Red",
        "0Y0y0f0L0JRd",
        " klucza grupy %d jest nieprawid",
        "yet, m",
        " ca administratorcPentru a utiliza acest instrument, trebuie s",
        "Nemokamai atnaujinti ",
        " adres",
        "3$3,343<3D3L3T3\\3d3l3t3|3",
        "v igen.-K",
        "s, ke",
        "[o0!kn0h0J0",
        "anu!Tas var aiz",
        "ko versiju.1Lejupiel",
        "echny otev",
        "< <$<(<,<0<4<<<T<X<p<t<x<|<",
        "r avsedd att k",
        " jour, des pilotes et des fonctionnalit",
        ".?AV?$CZeroInit@VCSetupUIManager@@$00@@",
        "tape. Une fois l",
        "ete ga izbrisati nakon dovr",
        "~9s0t",
        "(%1!c!:) - %2!s! vapaana",
        "%c:MKompiuteris bus paleistas i",
        "ierele ",
        "zzel nem lehet friss",
        "Haluatko varmasti lopettaa?",
        "qu?Dh",
        " si st",
        "Seleccionar imagen",
        "Vi har brug for mere plads*%1!d! GB ledig diskplads kr",
        "mu Windows p",
        "dispozici jedin",
        "767_7n7",
        "JBitLocker ",
        "```@@@@@@",
        "Se mut",
        "dzia Oczyszczanie dysku, a nast",
        "bu instal",
        " versiune de Windows",
        "D$4+D$,P",
        "saugoti asmeninius failus ir programas",
        "Aguarde",
        "m de acesta pentru dvs. Re",
        "zellikler de",
        "i Windows 10 pe o alt",
        " sistema ",
        "Nevyp",
        "riAElimina",
        "=4=<=D=P=p=x=",
        "Non sono riuscito a salvare le info di installazione necessarie per riprendere l'installazione di Windows. Purtroppo dovrai immetterle di nuovo in seguito.QIl programma di installazione non ",
        "USB-muistitikkusi on valmis",
        "rile %d%%",
        " precommit.cmd\"",
        "anas skriptu preinstall.cmd izpilde*Izvieto",
        "o em disco. Siga as instru",
        "ite ovaj korak. Mi ",
        " en dator som ",
        "sst]sst",
        "fr-CI",
        "Updates zoeken",
        "ffnen3Ich m",
        "CSetupLangIniLoader::Initialize: Language %s is not supported on this OS",
        ".?AVCSetupDiskSpaceDlpResponseFactory@@",
        "re restant0La cl",
        "es porque est",
        "RecoveryReq",
        "lenie ISO s",
        "Criar m",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "Ladataan Windows 10:t",
        "o funciona. Experimente uma diferente.",
        "Flyttbare stasjoner",
        "m atrast licences l",
        "CheckHotPluggableDrive: Drive %c SetupDiEnumDeviceInterfaces Error: 0x%X",
        "iZXYYUUSNobs",
        "o atual do Windows pode estar instalada em um diret",
        "tat d",
        "at fi",
        " pentru limba ",
        "imcXo>",
        ":*;4;R;v;",
        "Entrer une cl",
        "9~ltN9",
        "installer certaines fonctionnalit",
        "Ekranin",
        "sa problemet. K",
        "I file presenti nell'unit",
        "kohtaiset tiedostosi ja sovelluksesi.CSeuraavat seikat kaipaavat huomiotasi, jotta voit jatkaa asennusta.\\BitLocker-avain n",
        "U kunt uw bestanden, apps en instellingen niet behouden omdat uw huidige versie van Windows mogelijk in een niet-ondersteunde map is ge",
        "1$14181H1L1P1T1X1\\1p1t1x1|1",
        "9)9<9U9j9",
        "x+>~u;\\",
        "du Windows versiju j",
        "es de migration par le programme d",
        " possibile eseguire Windows Server 2019 in questo PC",
        "NdkHr,g",
        "nka p",
        "nde ISO-filen til en dvd senere.",
        "%2!s!.Uw organisatie beheert de update-instellingen.",
        ";T;Z;j;z;",
        "2!3D3g3",
        " parou. Voc",
        "pt-BR",
        "to pristajete.",
        "sok el",
        "Co je t",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::Serialize",
        "ne-IN",
        "cessaires ",
        "i (jednotka %2!c!:)dVyberte nebo p",
        " din pc (%2!c!:-drev)?V",
        "ajke (preporu",
        "Tyto aktualizace p",
        "Aucun",
        " reporneasc",
        "@@@@@@@@@@@@@@@@@@PPP",
        "Ha most fogja el",
        "aUTaj klju",
        "=FB~G",
        "cents.",
        "rankos.lReikia bent 350 MB, kad b",
        " lub spr",
        "AuthUsesFlags",
        " pode ignorar esta etapa. Vamos ativar o Windows automaticamente depois que a instala",
        "Pabeigti %1!ld!%%",
        "f94Au",
        "unalnik po namestitvi morda ne bo deloval pravilno, in morda boste morali znova namestiti nekatere izbirne funkcije in jezike.",
        "CSetupUIManager::OnSetupExiting",
        " od miejsca, w kt",
        " sistemos disko.",
        "Things to know before you startqThe download is about 3 GB. If you",
        ".?AVCListCtrl@@",
        "hrt6Precommit.cmd-Bereitstellungsskripts werden ausgef",
        "te disko valym",
        "CSetupLangIniLoader::Initialize: Language Pack Root = %s",
        "tter automatisk.",
        "z haszn",
        "QCette cl",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::GetResultsRoutine",
        " conna",
        "GetTraceEnableFlags",
        "&Cerrar$Tu PC se reiniciar",
        "s gombra kattintva nyugodtan elt",
        " Windows.I",
        "evrimi",
        "turulurken bir sorun olu",
        ", nous reprendrons o",
        "Espera",
        "rtoti, produkta atsl",
        "FveGetAuthMethodGuids",
        "ssen Sie eine(n) Windows 10-Produkt Key oder -Lizenz erwerben, um Windows 10 nach dem Update zu aktivieren.",
        ". Izv",
        "%hs: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber' does not exist. Assume 0",
        "Diegimo t",
        "Mindj",
        "ticamente.",
        "nda bir hatayla ba",
        "ci.PAby se dalo v instalaci pokra",
        "Juriidika",
        "Laster ned Windows 10",
        "&Accept",
        " sakl",
        "Zmeni",
        " sammuta tietokonetta",
        "GetSystemDefaultUILanguage",
        "Soporte t",
        "Installera %s6Datorn startas om s",
        ".CRT$XCU",
        "eme v po",
        "ave pri ugotavljanju, ali va",
        "FveApi is not present/installed",
        "- (%2!s!)V",
        "z olmayan dosyalar",
        " simile all'esempio seguente: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXdPrima di continuare l'installazione ",
        "SIDATh",
        "toru sa nepodarilo overi",
        "Sto eseguendo alcune operazioni",
        "stroj, mus",
        "3Asennan Windows 10:n uudelleen t",
        "solu. Cliquez sur Actualiser pour le supprimer de la liste.nUn probl",
        "m instalace Windows Serveru 2019.JV instalaci Windows Serveru 2019 budeme pokra",
        "es recomendadas para este computador",
        "te de dialogue non valide2Nous n",
        "n tietokoneeseen",
        " um caractere inv",
        "Znak %s nie je platn",
        "szen ",
        "Uygulanabilir bildirimler ve lisans ko",
        "Windows y",
        "a organizacija upravlja postavkama a",
        " reikiam",
        "Windows 10 G",
        "line draiv lahti ja kl",
        "t, amelyre telep",
        "Warum wird mir das angezeigt?",
        "#9~pt",
        "no odprite v nastavitvah./Ko",
        "installation et conserver vos param",
        ".!USB-",
        "tanje postavki za %d%%",
        " un error inesperado. Comprueba si se tienes acceso a los or",
        "j@Xf;A",
        ": XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX/A Bitlocker-kulcs 48 digit",
        "e. Odaberite drugi pogon.",
        "&Instal",
        "Stai gi",
        "titili podatke, trebalo bi da budete blizu ra",
        "o for conclu",
        "tte p",
        "te.2Nesivar",
        "string too long",
        "steem Microsoft",
        "xMMO@O>%\"\"\"\"$ $!",
        "ges a folytat",
        " programot, ",
        "PPP@@@```",
        "J@J=E=D42",
        "elite da instalirate.",
        "%1!d! ",
        "i predt",
        "riode de prise en charge",
        "> >.>8>P>l>",
        "hren der precommit.cmd-Skripts ist ein Problem aufgetreten.",
        "W0f0OUL",
        "#Kreski zostan",
        " znova./Pri sp",
        "#Je r",
        ": 0x%x]GUne erreur inattendue s",
        "tg-Cyrl-TJ",
        "gek k",
        "sim Windows.",
        "ya al",
        "av in funkcij sistema Windows 10 ne moremo namestiti v ra",
        ": %1!d!%%7",
        "trznego urz",
        "ny percig is eltarthat.eCsatlakoztassa a g",
        "n mappen H",
        "&Windows Server 2019 ",
        "RW0f0D0~0Y0V",
        "m sa aplik",
        "CSetupResponsSelectWebDownloadImage",
        "lv-LV",
        "Status",
        "je esantys failai bus panaikinti. Jei norite palikti ",
        "e ponovo da pokrene ra",
        ";(;4;@;L;X;d;p;|;",
        "Operazioni preliminari in corso",
        "n de Windows 10_No se pudo abrir el uso de almacenamiento. Abre manualmente tu configuraci",
        " GB 3. ",
        "Estamos a fazer alguns preparativos",
        "m Kutusu'nu manuel olarak a",
        "===Z=",
        " sistema:",
        "riel avanc",
        "&Fermer)Nous n",
        "_gov{~~Q",
        "m zjistit, jestli Windows 10 na va",
        "rente), vous aurez besoin d",
        "Transfer",
        "U[KMA",
        "&Annulla",
        "perny",
        "chr-Cher",
        "dt til at g",
        "to, ale budete muset svoje informace pozd",
        ".2USB ",
        "n distinta), necesitar",
        "ite vanjski ure",
        "rskenduse l",
        "Lemezk",
        "Ava pr",
        " tiks aiztur",
        ".rdata",
        "tte installationen af Windows. Genstart installationsprogrammet for at pr",
        " online para baixar atualiza",
        "N2QX[MOn",
        " do nasleduj",
        "]\\*!_\\D:",
        "[~ss3_X",
        "Applicable notices and licence terms",
        "Yu Gothic UI",
        "eHomeEdition",
        "lem biraz zaman alabilir./Kurulum program",
        "sim no iepriek",
        "Licensbetingelser",
        "rios %1!d! GB de espa",
        "cie vlo",
        "Not at the moment",
        "ppp@@@000",
        "Hvis Windows 10 allerede er installert og aktivert p",
        "R`f<<<@)",
        "dik! Folytassa a telep",
        "Continu",
        "De nieuwste versie van Windows downloaden",
        "e nastavenia aktualiz",
        "01SF&",
        " versiune pentru a continua.BDesc",
        "ujete Windows 7 ili Windows 8.1. ili ponovo instalirate Windows 10, nije vam potrebna ",
        "ywasz po",
        "Kreni ispo",
        "pet k",
        "Przygotowywanie %d%%",
        "cuter l",
        "RtlFreeHeap",
        "erli bir karakter de",
        "ouverture du graveur de DVD. Gravez manuellement le fichier ISO sur un DVD ",
        "CInstallUI::ShowPage: Cancel is requested. Returning ERROR_REQUEST_ABORTED",
        "Gata de instalare",
        "ite da biste uklonili tu stavku s popisa.iNai",
        "Das Laufwerk, das Sie verwenden m",
        "1D1d1|1",
        "+***,",
        "s ativaremos o Windows.",
        " diegimas nepavyko",
        "#Elementele care v",
        "5'6.64696E6V6j6",
        "paration de l'installation ",
        "eW[g0Y0",
        "0L0B0",
        "ievada.",
        "es, drivers e recursos opcionais. Essas atualiza",
        ", da nadaljujete namestitev.",
        " BitLocker fonctionne! Continuez lorsque vous serez pr",
        "fr-BE",
        "site v",
        ", paleiskite s",
        "mmer och f",
        " tietokone uudelleen valitsemalla OK.",
        "ga nedarbojas ",
        "Crea supporti di installazione (unit",
        "\\j0D0_0",
        "hren Sie ",
        "Sprog",
        " da biste ponovo pokrenuli ra",
        "s(Wn0",
        " USB, kartica SD ali zunanji trdi disk, da za",
        "l, a t",
        "my zainstalowa",
        "kta p",
        "n actual de Windows, tendr",
        "%d%% er fuldf",
        "en Sie alle ge",
        "3\"4z4",
        "ct, jestli je v",
        "Selecciona la partici",
        ": %1!d!%%>",
        "-N Rd",
        "Unesite klju",
        "digo de Erro: 0x%x]5A instala",
        "rer scripts til udrulning af failure.cmd",
        "jak takto: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXGNe",
        "pne DVD-brenneren. Du kan brenne ISO-filen til en DVD manuelt ved ",
        "ratlemine2Installiprogrammil nurjus tootev",
        " lista",
        "rskendamist ostma Windows 10 aktiveerimiseks Windows 10 tootev",
        "o conseguimos localizar as informa",
        "ciu dokon",
        "za Windows 10",
        "uriranje, moramo da uradimo jo",
        "s nem folytathat",
        "S&torno",
        " za Bitlocker",
        "kkelverdien for gruppe %d er ugyldig. Skriv inn riktig n",
        "%c:[Votre PC va red",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::CheckUserInterrupt",
        ", mit",
        "r du have pc'en hos dig, indtil du logger p",
        "izdanja se ne podudaraju",
        "o mais antigos do Windows 10. Podemos ajudar voc",
        "727O7l7",
        "o aplicou os dados de migra",
        "Selecciona la imagen que quieres instalar.",
        "Installazione di Windows 10",
        "buj inny klucz.=Klucz produktu dzia",
        "nD\"a;",
        "v2QX[@SAm",
        " v e-mailovom potvrden",
        "i licencni ugovor.",
        ";0;k;r;x;",
        "344p4",
        "%1!ld!%%",
        "i Continuare,Alege",
        ", a d",
        "Wird vorbereitet (%d%%)",
        "sta,Pot",
        "ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp(",
        "ra %1!s! p",
        "re having trouble determining if Windows 10 is ready for your PC yet. Please close Setup and try again.&Windows 10 isn",
        "ation d",
        "Cheia de produs ar trebui s",
        "yor/precommit.cmd da",
        "<J``|||Q|||||Q|=0",
        "Downloaden",
        "t find the installation information we need to continue installing Windows. Restart Setup to try again.ESetup couldn",
        " skript",
        " preinstall.cmd.*Spou",
        "El&utas",
        "Stasjonsvalg",
        "Prenosivi diskovi",
        ".?AVout_of_range@std@@",
        " wybrano instalacj",
        "avons pas pu trouver le Contrat de licence.",
        " sufficiente. Scegli un'altra unit",
        "rskenda, et eemaldada see loendist.OSelle toimingu tegemisel ilmnes probleem. V",
        "Bejelentkez",
        "s.+Cet ordinateur ne peut ex",
        "RtlDllShutdownInProgress",
        "il(Kurulumun haz",
        "en-JM",
        "Aktualisiere&n",
        "TELEP",
        " Windows 10-",
        "llorna kan n",
        " aktualizacje, sterowniki i funkcje opcjonalne. Te aktualizacje usprawni",
        "unalniku mogo",
        "rych plik",
        "p ellen",
        "No se puede continuar con la instalaci",
        "_amsg_exit",
        "im biste stvarima trebali posvetiti malo pozornosti ako ",
        "&Fechar&N",
        "PL0g0M0",
        "diegti kit",
        "L {II>zk",
        "\"A'Y0",
        "Tai gali trukti kelias minutes.QPrijungdami kompiuter",
        "10J0b0",
        "<1<A<Q<Y<i<v<|<",
        " star",
        "ho riadka",
        "ania precommit.cmd+Uruchamianie skrypt",
        "Microsoft",
        "rent un mat",
        "FailFast",
        "CSetupLangIniLoader::Initialize:     IsInstallInImage  : %d",
        "3?3z3",
        "UnhandledExceptionFilter",
        "ll activate Windows for you. ",
        ".?AV?$CMoSetupUnknownImpl@VCSetupUIManager@@@@",
        "It looks similar to this: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        " Windows 10 (",
        "em PC-ju (%2!c!: pogon)TOdaberite ili pove",
        " risolto questo problema. Fai clic su Aggiorna per rimuovere l'elemento dall'elenco.[Si ",
        "  Voglio &contribuire a migliorare l'installazione di Windows",
        "te pr",
        ", koska olet valinnut, ett",
        "nnen Sie diesen Schritt ",
        "&Nazad",
        "License terms",
        "&Teclado no Ecr",
        "mu programu se nepovedlo zjistit, jakou verzi Windows pou",
        "r Windows. S",
        "9Q9|9",
        ", om pc'en kan k",
        "La edici",
        "racakt",
        "%1!d!%% fuldf",
        "jome, kad turite senesni",
        " ir izveidots savienojums ar internetu, un m",
        "sto na disku a potom to zkuste znova.",
        " program a zkuste to znovu.",
        "041104B0",
        "Il codice Product Key si trova sulla confezione del DVD del prodotto oppure nell'e-mail di ricevuta dell'acquisto. Quando ti connetti a Internet, Windows verr",
        " richiedere alcuni minuti.",
        "Asennetaan Windows 10]Tietokoneesi k",
        "5%5;5F5X5d5|5",
        "rmtastatur",
        "0~0_0o0",
        " prein",
        "-0p0{0",
        "i&vit",
        "Fichiers d",
        "e pour installer Windows.",
        "%hs: Failed to query IOleInPlaceActiveObject interface from web browser control. HRESULT = 0x%08x",
        " estiver instalando o Windows em um computador projetado para ser executado no modo S.RA unidade flash USB deve ter pelo menos %1!d! GB ou mais. Selecione outra unidade.",
        " Windows Server 2019!",
        "t tell if your PC is ready to continue installing Windows Server 2019. Try restarting Setup.qSorry, we",
        "klendi, ancak ",
        "Arhitektuur",
        ".?AVISetupUIManager@@",
        "en-IN",
        "re-plan peut ",
        "hren der preinstall.cmd-Skripts ist ein Problem aufgetreten.EBeim Ausf",
        "Consultez les informations ci-dessous pour en conna",
        "n.MKaikki sis",
        "Norint t",
        "r. Windows'u yaln",
        "vat nic",
        "unara dok se ponovo ne prijavite na njega.1Da se podsetimo, evo ",
        "rem jedn",
        " Windows 10g",
        " koristite Windows 10",
        "ke. Kai prisijungsite prie interneto, jums suaktyvinsime ",
        "vel com o idioma ou a edi",
        "re running.\"Windows 10 installation has failed",
        "kclll`wwW",
        " z powodu jednej z nast",
        "9 :8:P:",
        " ISO faila ierakst",
        "es pessoais1Manter defini",
        "Prenese se pribli",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::Cancel",
        "Vanjski ure",
        "rulay",
        ".?AVCSetupResponsePageDU@@",
        "l.ZProbl",
        ". Compru",
        "ko versiju.",
        " nytt.1Det oppsto et problem med ",
        "t install the latest Windows 10 features and security improvements on your PC due to low disk space. Follow the instructions below to complete the update.'Free up %1!s! on your PC (%2!c!: drive)ESelect or connect an external storage device with at least %1!s! free%Dispositivo de almacenamiento externo",
        "nda datorn som vanligt.JInstallationen misslyckades i fasen %1!s! med ett fel under ",
        "8&9<9C9L9V9f9q9",
        "M5%Cy",
        "de-LI",
        "nstalleerd en geactiveerd op deze pc, en u voert de installatie opnieuw uit, dan kunt u deze stap overslaan. Windows zal automatisch worden geactiveerd nadat de installatie is voltooid.",
        "emo instalacione datoteke za Windows. Ubacite medijum sa instalacijom operativnog sistema Windows i pokrenite datoteku ",
        "Za&mknij'Komputer zostanie za chwil",
        "A telep",
        "hma %d v",
        "t dit Windows-installationsmedie, og k",
        "installation de Windows Server 2019. - Better accuracy or clarityLNous poursuivrons l",
        ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VIDlpResponse@@@@@@@@",
        "%1!s! %2!s!4Un probl",
        " %2!c!:.pIf you want to install Windows 10 on another partition, you need to create and then run the media to install it. Feel free to keep using your PC.OThe installation failed in the %1!s! phase with an error during %2!s! operation",
        "Nezachov",
        "ChhH\"",
        "imu online, aby mohl na",
        "rm-CH",
        ";cq1od-K3",
        "Finner ikke Windows-installasjonsfiler. Sett inn Windows-installasjonsmediet og kj",
        " katkaise virtaa tietokoneesta",
        "u adresi ziyaret edin: %1!s!",
        "%1!ld! %% fullf",
        "elim da koristim spolja",
        "lem biraz zaman alabilir.gWindows 10 i",
        "uga automat.Instalarea nu a ",
        "KERNEL32.dll",
        "li naj",
        ".!0*Y",
        "o de privacidade",
        "ili.&Na tomto po",
        "i Cur",
        " komputera.",
        "t (alebo in",
        " possibile installare i miglioramenti di sicurezza e le funzionalit",
        "i toate programele deschise, apoi reporni",
        ":#:,:5:K:g:v:",
        "Provjera kompatibilnosti",
        "klemeniz gerekebilir.&",
        "Estas atualiza",
        "N;RU_0R ",
        "s grabar el archivo ISO en un DVD m",
        " remov",
        " jour et des fichiers suppl",
        "m Windows nen",
        "Il codice Product Key ",
        "sents sur le support d'installation. Si vous n'installez pas ces mises ",
        "s argument",
        "hrung im S Modus ausgelegt ist.^Der USB-Speicherstick muss mindestens %1!d! GB aufweisen. W",
        "t Windows Server 2019 vietn",
        "b, w zale",
        "ra Windows Server 2019",
        "5$5e5o5",
        "m aktivujeme automaticky po dokon",
        "sstZsst",
        " aj na",
        "renginys",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::SetResponseName",
        "Valmistellaan asennusta ",
        "ili. Osvje",
        "o sabemos o que aconteceu, mas n",
        "te instalarea Windows 10",
        "M>B~1",
        "9A9H9O9",
        "o. Se voc",
        "Privacy statement",
        "ynnistyy uudelleen useita kertoja. T",
        "hendust luua. Veenduge, et teil on ",
        "Ta operacja pobierania w tle mo",
        " Microsoft Corporation. Med enerett.",
        "mu Windows 10 instal",
        " dysk",
        "_ck(WP}_g",
        "o no Windows Server 2019. Para ajudar a proteger os seus dados, deve manter o PC consigo at",
        "n.2Seuraavassa on kertaus siit",
        "sv-SE",
        "Vent, indtil app",
        "CreateReportFromFile",
        "unaru, potrebno je da unesete va",
        "s different from the one you",
        ". Ustvarjanje medija za Windows 10'",
        "*g(Wdk5u",
        "i papildu l",
        "FveDetectTelemetry",
        "Vol&tooien",
        "s la clave de producto en la caja en la que ven",
        "szXEz a term",
        "t find the Licence Agreement.",
        "'`L0B0",
        "pen. Adja meg al",
        "rbereder %d%%",
        "r de senaste filerna och kan installera den senaste versionen av Windows 10.",
        "hi{m!w",
        "T$(+T$ +D$",
        "Actualizar la lista de unidades",
        "Preuzimanje izdanja Windows 10",
        "3g4n4",
        "cie v",
        "-besturingssysteem",
        "tte med dette valg?",
        "ipravuje se %d%%.",
        " vite f",
        "IsValidLocale",
        "Instalarea Windows va trece online pentru a ob",
        "tJa v",
        "k igen.",
        "diet k",
        "Extern opslagapparaat",
        "eno %1!ld!%%",
        "installation et activer Windows, puis red",
        "FFdlVFV",
        "- DVD",
        "lne s",
        "vel encontrar o Contrato de Licen",
        "anas programmas restart",
        "z, ge",
        "a, sair",
        "ifriran je pomo",
        "teni a Windows 10-et, el",
        "lD!(Jw",
        "Architectuur",
        "chargementsSSupprimez les fichiers volumineux ou inutilis",
        "Scegliere l'operazione da effettuare",
        "ci, co si",
        " riuscito ad applicare i dati della migrazione<Il programma non ",
        "Po&kra",
        "P}_g?",
        "INSTALLATION",
        "%hs: Updating report control.",
        "ytett",
        "Izmantot ",
        "unuzu kontrol edin ve arac",
        ">K>W>_>w>",
        ". Windows 10",
        "LockResource",
        "0?Y$A0",
        "Exist",
        ">->V>o>{>",
        "jes automatisk:Installationsprogrammet kan ikke indl",
        "? ?$?<?@?X?h?l?|?",
        "ssel.ZIhr BitLocker-Schl",
        " de seneste filer for at sikre, at du installerer den seneste version af Windows 10.",
        "tta.7Ladda ned det uppdaterade verktyget f",
        "Crear medios de instalaci",
        "Nenhum R",
        " smlouvu.",
        "o. Ser",
        "{8856F961-340A-11D0-A96B-00C04FD705A2}",
        "n sobre la actualizaci",
        "tte med at bruge computeren.",
        "sr-Latn-BA",
        "cija p",
        "rksomhed, for at installationen kan forts",
        "diegti, ta",
        "Emme voineet tallentaa asennustietoja, joten Windowsin asennusta on jatkettava siit",
        "e nisu potrebne ili oslobodite prostor pomo",
        "_except_handler4_common",
        " eszk",
        "]wQ!q",
        "4 4(4,40444<4P4T4X4\\4`4d4h4l4p4t4x4|4",
        "tirmeleri, s",
        "jumu: %1!d!%%",
        "rankis negali atnaujinti j",
        " jsou dal",
        "tiquette",
        "tigungs-E-Mail. Wenn Sie eine Verbindung mit dem Internet herstellen, aktivieren wir Windows f",
        " gibi harici bir cihaz kullan",
        "n en Windows con una cuenta de administrador.6Necesitar",
        "as adicionais.*Quais s",
        "GetSysColor",
        " automaticamente atualizado durante o per",
        "rt mapi Lejupiel",
        "k med en annan nyckel.TDen h",
        " todo, incluyendo los archivos, las aplicaciones y la configuraci",
        " %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml, kad i",
        "ajke sustava Windows 10 i sigurnosna pobolj",
        "Primijetili smo da imate starije instalacijske datoteke za Windows 10. Mo",
        "u)WWhG",
        "rtXDenne produktn",
        "terminer si Windows 10 est d",
        "SWindows ",
        "unalnik. Namestitev sistema Windows se bo nadaljevala samodejno.",
        "k0J0Y0Y0",
        "bb helyre van sz",
        "wuummm",
        "em lahko le dodate funkcije v sistem Windows. Namestitev sistema Windows ni mogo",
        "6USB ",
        "E2ZkC",
        ", nap",
        "kom u postupku %2!s!",
        "ber cesty",
        "lt-LT",
        "Repar",
        " kompiuteris yra parengtas toliau diegti ",
        "%d.%d",
        "Abrir?Deseo usar un dispositivo de almacenamiento externo en su lugar%No quiero usar almacenamiento externo",
        "n.7Uygulaman",
        "CSetupResponsePageSelectImage::OnWizardNext",
        " continuata l'installazione di Windows 10 in Windows Update.hConfigurazione dell'aggiornamento per Windows 10 in corso",
        "tdFDlVV",
        "kohtaiset tiedostot",
        "rja be a helyes kulcsot3",
        "?]?d?",
        "a e os recursos mais recentes do Windows 10 no computador devido a pouco espa",
        "t Windows Server 2019hIestat",
        "rieure ",
        ".?AVCRichEditCtrlEx@UX@Common@ConX@@",
        "ltige Dialogfeld-ID'Der Lizenzvertrag wurde nicht gefunden.",
        "D0f0O0`0U0D0",
        "ker du installera en ",
        "t Windows Server 2019",
        "j---.7",
        "sr-SP-Latn",
        " pe PC poate rula Windows 10. ",
        "Reporne",
        "e postavke i aplikacije ",
        " ir tikai 25 rakstz",
        " najnowszych ulepsze",
        " installationsmediet.qVi kan ikke sige, om pc'en er klar til at forts",
        "mpina",
        "bor na DVD disk manu",
        " instalowanie systemu Windows Server 2019. Spr",
        "m Windows Server 2019 ",
        "czono %d%%",
        "Izdevums",
        "des>No",
        "shoz v",
        "czysz si",
        "nyes Windows 10-term",
        "i upgrade acum acestui PC",
        " extern",
        "Odmah nadogradi ovaj PC",
        "CInstallUI::GetHelpResourcesLocation",
        "Depolama Ayarlar",
        "cijas k",
        "enje skripti za uvo",
        " automaticky\"K",
        "Manter s",
        "C0^0v0",
        "ng dina filer innan du b",
        "n para poder continuar con la instalaci",
        ", nes pasirinkote diegti ",
        " scripturile de implementare failure.cmd,Aceast",
        "Se stai installando per la prima volta Windows 10 in questo PC, devi immettere un codice Product Key valido di Windows 10.",
        "229879+4583620",
        "emo informacije o instalaciji potrebne za nastavak instalacije operativnog sistema Windows. Ponovo pokrenite instalaciju da biste probali ponovo.kInstalacioni program ne mo",
        "torom syst",
        " versijos naujinim",
        ".?AV?$CZeroInit@VCSetupResponsePageCompat@@$00@@",
        "yj zalecanych opcji dla tego komputera",
        "Endre hvordan installasjonsprogrammet for Windows laster ned oppdateringer",
        "Ennen p",
        "avate da instalirate stariju verziju operativnog sistema Windows.",
        "grehajt",
        "(Condizioni di Licenza software Microsoft$Informativa sulla privacy di Windows",
        "nden kendiniz ke",
        "&Annuller",
        "RhVPA",
        "cie %1!s!.",
        "ia BitLocker va fi suspendat",
        "]WY(u",
        "cie sa vykon",
        "ati.FVse bo izbrisano, vklju",
        ". Windows nepreform",
        "jo kr",
        ": %1!d!%%!Ceci peut durer quelques minutes.",
        "/Windows Server 2019 isn't ready for this PC yet",
        "Mimari",
        "Actualizaciones aplicadas\"No hay actualizaciones disponibles",
        "lne v Nastaveniach./Nepodarilo sa otvori",
        "4#454A4Q4h4",
        "o e manter as suas defini",
        "lieties citu disku un m",
        "rgmisena aitame teil vabastada %1!s! %2!c!: kettal.",
        "ojumi un licences nosac",
        " to nieko",
        "ppp@@@",
        "aide de %1!s!.",
        "nt az eszk",
        "mai Windows ir nepiecie",
        "Ak chcete pokra",
        "01080M0W0u0",
        "ksuste eemaldamiseks s",
        "nybe.",
        "Vi kan ikke finde de installationsoplysninger, der skal bruges for at forts",
        "r S-l",
        "kok-IN",
        " 4 GB eller mere (kan variere), og du skal muligvis betale gebyr for internetadgangen. Klik p",
        "CInstallUI::Quit: Posted MSG_INSTALLUI_FORCE_QUIT",
        "zdeki dosyalar silinecek. Bu dosyalar",
        " a nastaven",
        "$Baixar a ",
        "i Windows pe un PC proiectat pentru a se func",
        "Der gik noget galtVHvis du vil installere Windows 10, skal du klikke p",
        " igen.*Vi kan ikke installere Windows Server 2019qVi har tilbagef",
        "erli Windows s",
        "tfen Kurulum",
        " problem podczas uruchamiania skrypt",
        "1 1-161D1O1a1l1u1",
        "Cambiar los elementos que se van a conservar",
        "rskatiet inform",
        "r det ",
        "im kullanmaya devam etmek istiyor musunuz?",
        "nchid",
        "20201009101141Z0w0=",
        "kkelen virket ikke. Pr",
        "ru anahtar",
        "2)2H2g2",
        " systemu Windows.",
        "ned ettevalmistused,See t",
        " em cobran",
        "Utilisez les options recommand",
        "ver f",
        " od korisni",
        " e riprova.",
        "en-ZW",
        "sst]vvw",
        "i kui installite Windows 10 uuesti, pole teil vaja tootev",
        "Select a path",
        "CInstallUI::CreateWizardUI",
        "in, depolama alan",
        " bruke dette valget?",
        "SetupDiGetDeviceRegistryPropertyW",
        "CSetupResponsePageDiskSpaceReq::OnToggleViewLinkClicked",
        "rii spa",
        "Windows 10 installimine nurjus",
        "This may take a few minutes.VPlug in your PC to be sure that your battery doesn't run down during the installation.",
        "Las actualizaciones se instalaron, pero el programa de instalaci",
        "tkake, kui olete valmis.",
        "W0j0O0j0",
        " in grado di determinare la versione di Windows in uso.,L'installazione di Windows 10 non ",
        "sikat.",
        "t Windows Server 2019. M",
        "i sa v PC d",
        "t, z. B. einen USB-Stick, eine SD-Karte oder eine externe Festplatte, um die Festplatte vor",
        "?)?/?H?P?U?_?w?",
        "prava na sta",
        "tzm-Tfng-MA",
        "eHeW[&{",
        "9<:H:T:]:e:w:",
        "chten Sie vorgehen?",
        " %2!s! livre(s)",
        "Microsoft JhengHei",
        "mprosp",
        " modifikuota arba pa",
        "No apagues el equipo",
        "zP~UUUUUUUHUHHHHGHG%%$",
        "imu S. Tuto edici zvolte jen v p",
        "cs-CZ",
        "=G[QLKC",
        "O(u\"u",
        "&Otka",
        "ljivost",
        "kilo problema vykdant preinstall.cmd scenarijus.1I",
        "YRRRB/",
        "`f03b",
        "8Windows 10 uusima versiooni allalaadimiseks valmistumine",
        ".-Poczekaj na zako",
        "ekilde tasarlanm",
        "Otvori postavke pohrane",
        "4:5S5",
        "We noticed you have older installation files for Windows 10.  We can help you get the latest files to make sure you install the most recent version of Windows 10.",
        "o desta edi",
        "F!NL=",
        " joitakin minuutteja.XKytke tietokone verkkovirtaan, jotta varmistat, ettei akun virta lopu asennuksen aikana.",
        "ll continue installing Windows 10 in Windows Update.SConfiguring update for Windows 10",
        "5DQty",
        "<la@ ",
        "Skontrolova",
        "gYftwj",
        " proizvoda nije ispravan. Provjerite ga i poku",
        "D$T+N",
        "ndra hur installationsprogrammet f",
        "Angi Bitlocker-n",
        ".?AVCNoTrackObject@@",
        "ati, ker name",
        "nlichen Dateien und Apps zu behalten.YK",
        "ts, vai nav atjaunin",
        "igesti t",
        "ggesztj",
        "ste sa re",
        "charger",
        " se m",
        "%1!d!%% completeTThis product key didn",
        " Windows 10. Lai pal",
        "2@2Q2s2",
        "gu var lietot tikai l",
        "z oldu",
        "pppPPP",
        "utiliser une autre cl",
        "o do Windows 10 precisa ser reiniciada para que elas funcionem. Depois de reiniciar, vamos continuar de onde paramos..Este computador n",
        "0 0$0(0,000@0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "ali, odmah ih sigurnosno kopirajte na neko drugo mjesto.",
        "1 teken resterend'De productcode bevat slechts 48 tekens.EDe sleutelwaarde voor groep %d is ongeldig. Geef de juiste sleutel op)Geef de BitLocker-sleutel op voor de id: .Windows heeft meer ruimte nodig voor de update",
        "cNL}y",
        "ti a Windowst.XAz USB flash meghajt",
        "uriranja su primijenjena",
        "8 8$8(8,848L8\\8`8x8|8",
        "GetCurrentThreadId",
        "System32\\mshtml.dll",
        "ho programu Windows Servera 2019. Ke",
        "Naujinant versij",
        "installez Windows 10, vous n",
        "cony do stanu sprzed rozpocz",
        "t find the License Agreement.",
        "%1!ld!%% completato",
        "&Storno",
        ".?AVCCmdTarget@@",
        "netici olarak oturum a",
        " Windows Server 2019. ",
        " Windows 10 Setup opnieuw starten",
        "1Licen",
        "&Next",
        "3)323O3",
        "A0sP3",
        "a trenuta",
        "\"Zachovat osobn",
        "Falls Sie Windows 10 auf einer anderen Partition installieren m",
        " fjerne slettede filer fra systemstasjonen.",
        "ci informacji systemu Windows",
        "ko versiju!Tas var aiz",
        "+Termenii licen",
        "jo atmi",
        "%1!ld!%% l",
        "&napoi",
        "ivitetty tietov",
        "FveGetAuthMethodInformation",
        "Papirkurv@T",
        "Modifier le mode de t",
        "udze Windows Update.",
        "3\"3*3K3`3n3z3",
        "i samo 48 digitalnih znakova.",
        "r datorn kan inte k",
        "ranka",
        " zachova",
        "daje migr",
        "ces draiveri un papildu faili, kas nav instal",
        "r for nedlasting av den nyeste versjonen av Windows 10",
        ".?AUIUnknown@@",
        "no zapi",
        "em.LTa klju",
        "sta, kde byla instalace p",
        "DeleteObject",
        "s futtassa a setup.exe f",
        "se nem siker",
        "i vytv",
        "Tiene un aspecto similar al siguiente: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXPAntes de seguir con la instalaci",
        "sr-Cyrl-BA",
        "Negalite pasilikti fail",
        "llningar %d%%",
        "re istniej",
        "<9<`<q<",
        " zainstalowana w nieobs",
        "bbra is probl",
        " neleistina, ",
        "&Luk!Vi kan ikke installere Windows 10hVi har tilbagef",
        "Valitse polku",
        "Namestitev sistema Windows 10",
        "kazov",
        "6R7i7",
        "RtlNotifyFeatureUsage",
        " stand",
        "Angiv BitLocker-n",
        "vas vietas",
        "v2QX[",
        "%2!s!8",
        "hrt werden kann. Beenden Sie Setup, und wiederholen Sie den Vorgang.",
        "i manual folderul Desc",
        "t na krabici, ve kter",
        "oMit dem Product Key stimmt etwas nicht. Verwenden Sie einen anderen Product Key, oder erwerben Sie einen neuen.",
        "FormatMessageW",
        "?-S]k_'@m",
        "GetModuleHandleW",
        "Modifier la fa",
        "OYu*N",
        " ve ayarlar",
        "iu verziu Windowsu 10",
        "tirmeler denetleniyor: %%%1!d!!Bu i",
        "l||lw",
        "Valmista etteLOlete seda juba teinud. Kl",
        " zapasow",
        "Partition de disque",
        "r att kunna forts",
        "s spravuje va",
        "espace disponible sur votre PC est suffisant pour poursuivre l",
        "ioneze f",
        " oper",
        " naujo. Paleidus j",
        "hlen Sie das Image aus, das Sie installieren m",
        "te na upgrade z Windows 7 nebo Windows 8.1 nebo na p",
        "t pour ce PC",
        " wcze",
        "3)444",
        "Wybierz partycj",
        "SiteLink%Keresse fel a k",
        " licen",
        "qSorry, we",
        " atsl",
        "&Acceptare",
        "unaru ima dovoljno prostora*",
        "Vi kan ikke forts",
        "hlen Sie aus, was Sie behalten m",
        ":uzs}}",
        "S0n0x",
        " do s",
        "FileDescription",
        " terminarea instal",
        " (%2!s!)mFjern filer du ikke trenger lenger, eller bruk Diskopprydding til ",
        "&Dokon",
        " tardi.",
        "ebujete, nebo uvoln",
        " swoje po",
        "litage arvutit v",
        " arba ",
        "RW0f0D0~0Y0_",
        " listo para seguir instalando Windows 10. Intenta reiniciar la instalaci",
        "m.>Lai turpin",
        "e najti. Vstavite namestitveni medij za Windows in za",
        ", miten Windowsin asennus lataa p",
        "rvalda j",
        "ovat tam, kde jsme skon",
        "tmele vastav Windowsi v",
        "Se continuar sem ativar a sua vers",
        "0S0h0L0",
        "Opdateringerne er installeret, men Windows 10 Installation skal genstartes, for at de virker. N",
        "Parti",
        "Upgrade this PC now",
        "taluje.",
        " zainstalowanej wersji systemu Windows..Instalacja systemu Windows 10 nie powiod",
        "ywany",
        "ria po",
        "o do Windows. Experimente outra chave.ZEsta chave de produto (Product Key) n",
        "Perkeliami parametrai %d%%",
        ";?<d<",
        "no otvorite fasciklu ",
        "Kalba",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::GetResponseName",
        " administratorseLai izmantotu ",
        "D$d$N",
        "&RechazarBSi no aceptas los t",
        "rio n",
        "ci od urz",
        " pronto;Continuaremos a instala",
        "Buh_[S",
        "Deze code controlerenKDeze code werkt niet voor deze editie van Windows. Probeer een andere code.ODeze productcode werkt niet. Voer de code opnieuw in die u online hebt gekocht.",
        "5\\VJ;",
        "line geri getirdik.EWindows Update i",
        "@t VW",
        "GlobalLock",
        "Dispositif de stockage externe",
        "7*d(5",
        "`/f,{",
        "ration peut prendre plusieurs minutes.",
        "&Indietro",
        " ir saugos patobulinim",
        ", kuri",
        "re trying to install an older version of Windows.kThe drive you",
        "WPPPPj",
        " durante esta actualizaci",
        " du opprette og deretter kj",
        " recente di questo strumento. Devi scaricare ed eseguire la versione pi",
        "Arkkitehtuuri ei t",
        "Moving your settings (%d%%)",
        "le minna Windows 7 v",
        "Velg bildet du vil installere.",
        "o funcionou. Insira novamente a chave que voc",
        "j0^9u",
        "anje sistema Windows 10HRa",
        "s diegti skland",
        "ico sistema Windows 10",
        " folderu Pobrane. Otw",
        "sto pro aktualizaci.",
        "einstalaci Windows 10, nebudete k",
        "Preverjanje prenosa'Izberite, kateri medij ",
        "let. Szabad",
        "Nem egyezik az architekt",
        " tulee n",
        "! Continua",
        "Brak etykiety",
        "t asiat",
        "i la Windows Server 2019. Pentru a v",
        "Kurulum kapanmadan ",
        "R!s4Z",
        "ke za k",
        "SetCursor",
        "val ideiglenesen kib",
        "Nu putem continua din cauza unuia din urm",
        "USB-flash-enhet",
        "rias vezes. Este processo pode levar algum tempo.:Espere um pouco enquanto a configura",
        "hren f",
        "list k",
        "CLinkButton",
        "et-EE",
        "o desta ferramenta",
        "zykowej lub architektury nie jest dost",
        ".9Atlaisvinkite %1!s! kompiuteryje (%2!c!: loginiame diske)^Pasirinkite arba prijunkite i",
        "bo-CN",
        " ficheiros pessoais",
        "D$hSVW",
        " jour. Windows ne reformatera pas votre dispositif de stockage externe et vous pourrez le retirer une fois l'installation termin",
        "Aktualisie&ren",
        "i Windows 10 nepob",
        "s architekt",
        "GetWindowLongW",
        "re dette for deg. Oppdater listen og pr",
        "668888383#&",
        "ka bir kaydetme konumuna yedekleyin.",
        " ikkuna sulkeutuu automaattisesti %1!d! minuutin kuluttua.$Ennen aloittamista tiedett",
        "Otvori",
        "let-haszn",
        "n vannak. Ha most nem telep",
        "tevajte to:",
        "te v po",
        " possibile determinare ancora se Windows Server 2019 ",
        "Windows non ",
        "Tilaa tarvitaan lis",
        "%d characters left\"Dashes will be added automatically,The product key only contains 25 characters.",
        "PPPPV",
        "esouvaj",
        " demorar alguns minutos.",
        "Group %d key value is invalid, please input correct key2",
        "n o ejecuta ",
        "$Izmantot vec",
        "lj enhet",
        "oJazyk alebo vydanie verzie Windowsu, ktor",
        "0k0o0pe",
        "Taikomi prane",
        "pne nedlastinger",
        "N{vU_",
        "dPlease remove the following external drive, click OK to reboot and complete installing Windows.",
        "CInstallUI::ShowRollbackMsg",
        " continuata l'installazione di Windows Server 2019 in Windows Update.",
        "PL0g0M0f0D0",
        "r datorn och du installerar om det kan du hoppa ",
        "es pour ce PC",
        "slaic",
        "mu programu se nepovedlo ov",
        " nem tudta t",
        "Uso de Armazenamento`Explore manualmente seu uso de armazenamento em configura",
        "SgqW0f0O0`0U0D0:",
        "cuter Windows 10",
        "e Windows 10 v ta ra",
        "UuidToStringW",
        "o diferente), ter",
        "n ve yeniden ba",
        "dR)$\\",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::CheckInitialized",
        "espace de stockage externe+Je ne veux pas utiliser le stockage externe",
        "Consulte m",
        "hemalt %1!s! vaba ruumi",
        "kkulcs t",
        "wwwwwwwwwwwwwwwwp",
        "RhV-N",
        " installer Windows Server",
        "La protection BitLocker va ",
        "r du ansluter till Internet aktiverar vi Windows ",
        "h2;Q/",
        "lja telep",
        "n de la versi",
        " soubory Windows. Vlo",
        "Dette kan ta en liten stund.",
        "es de atualiza",
        " parametry p",
        "torul",
        "Chci pou",
        " zariadenie",
        "bs-Cyrl-BA",
        " continue. Revizui",
        "o e retomada quando iniciar sess",
        "gs dialoga ID%M",
        "%s, DLPLOG: [0x%X] [%s] [%s]",
        "tzm-Latn-DZ",
        "da.!Instala",
        "En az %1!d! GB olmas",
        "kat, ",
        "e utvrditi da li je ra",
        "Nessuno",
        "j ikke underst",
        "Lue t",
        "uZSW3",
        "2019 est d",
        "p Windows",
        "iului de stocare`Explora",
        "Mer informasjon",
        "939N9g9}9",
        "Please read this so you know what you",
        " Windows Server 2019[",
        " nota, ma non ",
        "6(7d7",
        "YKNMR",
        "tovan",
        "emy kontynuowa",
        " sa re",
        "i mai multe",
        "o pode atualizar seu computadorjEsta ferramenta n",
        "ete s internetom, aktivirat ",
        "rii Windows",
        "RtlNtStatusToDosErrorNoTeb",
        "rio de raiz do seu suporte de dados de instala",
        "w~~xp",
        "No se puede continuar por uno de los motivos siguientes:",
        "Unesite Bitlocker klju",
        "Selecteer de installatiekopie die u wilt installeren.",
        "]Ihr Downloads-Ordner konnte nicht ge",
        "labilir. Bir ",
        " Windows Server 2019*",
        "0~0Y0",
        "`1XL0",
        "''63>DD6",
        "jlokat tartalmaznak, amelyek nem a telep",
        "klemesi otomatik olarak devam edecek.",
        "logo no v",
        "ra sa m",
        "nnen Sie Ihren PC nicht verwenden. Speichern und schlie",
        "st hj",
        " Microsoft Corporation. Tous droits r",
        " zariadenie a po dokon",
        "Nous n",
        "e potrwa",
        "elite u",
        "alintum",
        "%s GBiNe",
        " nefunguje. Vyzkou",
        " bitlocker klju",
        "s4A telep",
        "&Weiter Windows Server 2019 installieren'Dieser Vorgang kann einige Zeit dauern.oDas Update f",
        "@k\\\"E",
        "nt a f",
        "ar-TN",
        "nl-NL",
        "ttu ei saa teie arvutisse installida Windows 10 uusimaid funktsioone ja turbet",
        "enite namestitveni program in ",
        "ngelig, hvis du har aktiveret en kopi af Windows 7 eller Windows 8.1, der er installeret p",
        "u klju",
        "GetSysColorBrush",
        " Windows Server 20192",
        "i lista ",
        "ifru proizvoda za Windows 10 ili da napustite pode",
        "Dispozitiv de stocare extern",
        "3%3;3",
        "Az okokr",
        "ta diegti",
        "tiremezeBu ara",
        "Installerer Windows Server 2019",
        "o gratuita para o Windows 10 s",
        "Chave de produto (Product Key)",
        ",gS_k0B}",
        "essayer..L",
        "iniet uz Labi, lai palaistu atk",
        "5$505<5H5T5`5l5x5",
        "L$T_^[3",
        "te, jestli v",
        " jste si koupili DVD s Windows, nebo v e-mailu potvrzuj",
        " disponibile solo se nel tuo PC ",
        "-Nous n",
        " Microsoft2",
        "n fundal poate avea peste 4 GB (dimensiunea poate varia) ",
        "iu-Cans-CA",
        " Windows 10 pentru a activa Windows 10 dup",
        "Voorbereiden %d%% Uw instellingen verplaatsen %d%%",
        " omat tiedostot ja sovellukset-S",
        "rique de stockage externe avec au moins %1!s! libres",
        "dzu, ievadiet Bitlocker atsl",
        "rii.'Cerin",
        "gldelld",
        "o mais recente",
        "ovat v instalaci, budete se muset pod",
        "hteit",
        "rankio versija. Norint t",
        "ce Twojej uwagi",
        "stroje Bitlocker",
        "en til den tilstand, den havde, lige f",
        "o novamente.",
        " quer manter ",
        "na uruchomi",
        "SF)Cg",
        " iba na prid",
        "buj ponownie.6Wyst",
        "sk-SK",
        " program.'Kontrola dostato",
        "ilebilir oldu",
        "HPriprema za preuzimanje najnovije verzije operativnog sistema Windows 10#Ovo mo",
        ")X&2c",
        "Schakel de computer niet uit",
        " attivato automaticamente.",
        "iau mums nepavyko paleisti ",
        "es-CO",
        " va trebui s",
        "hrt werden kann. Schlie",
        "nda teise sektsiooni, tuleb selle installimiseks luua kandja ja siis see k",
        "io kompiuterio versij",
        "i a finaliza instalarea Windows.",
        "ren). Mogelijk brengt uw internetprovider kosten in rekening. Klik op Volgende om de nieuwste installatiebestanden te downloaden.",
        "5?5d5y5",
        "Miksi t",
        " %2!s! frei",
        "e enkrat poskusite.",
        "ate namestitev sistema Windows.",
        "n jelenlegi nyelv",
        "o, voc",
        "$Iprr",
        " parengta",
        "be en produktn",
        "Kontroller kompatibilitet",
        "N SOBRE LA INSTALACI",
        " Windows. Elle ne peut pas ",
        "7(7H7X7|7",
        "ltse le a leg",
        ".?AV?$CSetupObject@VCSetupUIManager@@VISetupUIManager@@@@",
        "ft Zu verwendendes Medium ausw",
        "unalnik, ker je na disku premalo prostora. Spodaj sprostite nekaj prostora in nato izberite ",
        " k dispozici pro v",
        "_vsnwprintf",
        "i manual fi",
        " nam uruchomi",
        "&Zako",
        ":.;>;N;^;p;",
        "vel determinar se o PC tem espa",
        "PostMessageW",
        " recente di Windows",
        "De updates worden ge",
        " tu %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml.d",
        "%Fehlercode: 0x%1!lX! - 0x%2!lX!",
        "Depolama Alan",
        "tica de privacidade",
        "n automaattisesti tukijakson aikana. Tuki saattaa vaihdella laitteittain.",
        "hem obdob",
        "s saugyklos",
        "mu programu se nepovedlo pou",
        " Windows, osobn",
        ",Microsoft programmat",
        "essayez.5Windows 10 n'est pas encore pr",
        "A=6S0J",
        "\"\"cLt",
        "en-029",
        "ste to znova.'In",
        "mplat cevaXPentru a instala Windows 10, face",
        " funkce (doporu",
        "kkal kell bejelentkeznie a Windowsba.%Az ISO-f",
        "m na polo",
        "CH_Uz",
        " preinstall.cmd0",
        " chave do produto (Product Key) que voc",
        "r olup olmad",
        " preinstall.cmd-",
        "CheckHotPluggableDrive: Drive %c SetupDiGetDeviceInterfaceDetail-2 Error: 0x%X",
        "ovom adres",
        "Aucune mise ",
        "Error reporting telemetry for bHasExtSpace: [0x%X]",
        "d Product Key funguje. Ke",
        "tilo do stavu, v akom bolo pred spusten",
        "Hr,g(W`O",
        "hrend dieses Updates angehalten und erst fortgesetzt, wenn Sie sich bei Windows Server 2019 anmelden. Zum Schutz Ihrer Daten sollten Sie den PC bis zur erneuten Anmeldung nicht unbeaufsichtigt lassen.4Windows Server 2019 konnte nicht installiert werden.",
        "nda datorn medan Windows installeras. Spara och st",
        "i samo osobne datoteke",
        "tkamiseks peate uusima versiooni alla laadima ja k",
        "nione. Naci",
        "Ezt a g",
        "quc-Latn-GT",
        "riist ei toeta teie praegusesse arvutisse installitud Windowsi versiooni keelt v",
        "%c:<PC-ul va reporni de c",
        ":(:0:8:@:L:l:t:|:",
        "ekajte",
        " naujo ",
        "8#8+8",
        " Forts",
        "te pre tento po",
        "Schimba",
        "ia de Windows care corespunde cheii de produs pe care a",
        " Bitlocker ressemble ",
        "|lllth",
        "MNo se pudo abrir la carpeta Descargas. Abre manualmente la carpeta Descargas.[No se pudo abrir la grabadora de DVD. Graba manualmente el archivo ISO en un DVD con %1!s!.",
        "0Y0y0f0",
        "r att du beh",
        "irivanje ",
        "sti b",
        "em trenutnem jeziku ali za trenutno arhitekturo.",
        " Windows ved hj",
        "chstes werden wir Ihnen dabei helfen, %1!s! auf dem %2!c!-Laufwerk freizugeben.",
        "r att frig",
        "es aplicadas",
        "+L$HCSQ",
        "enie in",
        "z gerekiyor. K",
        " em custos extra.)Que outras op",
        "CSetupResponseSelectUsbDrive::OnInitDialog",
        "7I7W7",
        "tkamist peate ",
        "@O Windows Server 2019 ainda n",
        "Taustalatauksen koko voi olla yli 4 Gt (koko saattaa vaihdella), ja latauksesta voi aiheutua Internetin k",
        "n porque elegiste instalar %1!s! usando un idioma diferente del que usas actualmente.",
        "GetProcAddress",
        "ana no uzst",
        " de produit Windows 10.",
        "jGS9x*:S",
        "lygos!",
        "CDialogEx",
        "o adicionados automaticamente=A chave do produto (Product Key) cont",
        " installere",
        "tijek",
        " arba i",
        "<7=S=f=s=",
        "\"fS ;",
        "ku Diska t",
        "Nie mo",
        "udnudmSee tootev",
        "e. Proverite i poku",
        "kseltiyorsan",
        "tEWWh",
        "ierele de instalare;Instalarea nu a determinat op",
        "%hs: couldn't get host edition id",
        "t restartuje. M",
        "CInstallUI::ShowExitingSetup: Posted MSG_INSTALLUI_SWITCH_TO_PROGRESS_PAGE",
        "exploitation :",
        "BitLocker-n",
        "li.[Neizdev",
        "Nie zachowuj niczego",
        "dik.xA telep",
        "ciu dostatok miesta",
        "CSetupResponsePageBitLockerKeyValidate::DoDataExchange",
        "Hvis du fortsetter uten ",
        "Teraz nie",
        "e. Poku",
        "vD}T~",
        "ler ve iste",
        "unuz do",
        "lassza ki a telep",
        " utiliser cette s",
        " indir",
        "ftelse. N",
        "Windowsi uusima versiooni allalaadimine",
        "unar da biste se bili sigurni da se baterija ne",
        " en anden partition, skal du oprette og derefter k",
        " failure.cmd ",
        "PPPppp",
        "0@5$@0",
        " escolheu:",
        "o6A configura",
        " po re",
        "pne lagringsbruken. Kj",
        " program Windows Serveru 2019",
        " Instalatora.",
        "r du kan opdatere. Vi giver besked, n",
        "m Instala",
        "Disko pasirinkimas",
        "pule.",
        "RhVI{",
        ".?AV?$__base@$$A6G_NPAXI0II@Z@__function@wistd@@",
        "s usar tu PC mientras se instala Windows. Guarda y cierra tus archivos antes de empezar.7Espera mientras la aplicaci",
        "n dilini ya da s",
        "ch znak",
        "Atidaryti saugyklos parametrus",
        "rskema versiooni.",
        "Denne download fylder ca. 3 GB. Hvis du bruger en forbrugsbaseret forbindelse, skal du kontrollere, om dette vil give ekstra gebyrer.5Hvilke forskellige muligheder er der for at opdatere?",
        "4JJJ&''",
        "Neleistinas dialogo lango ID&Nepavyksta rasti licencijos sutarties.",
        " verzi Windows 10.",
        "More information",
        "sekor",
        "r du kan fortsette installasjonen.",
        ". Zavrite In",
        "%Cod eroare: 0x%1!lX! - 0x%2!lX!",
        "rel proovige uuesti.)M",
        " kodas neveikia. Patikrinkite j",
        "r{{{zzzww",
        "SVjp3",
        " jour.",
        "Ne izklapljajte ra",
        "e razli",
        "s conectado a Internet e intenta ejecutar la herramienta de nuevo.4Se produjo un problema al ejecutar esta herramienta.",
        ".!Voit jatkaa tietokoneesi k",
        " USB %1!d! ",
        "r att ",
        " ancora pronto per il PC. Chiudi il programma di installazione e riprova. ,Windows 10 non ",
        "dhasson, ",
        "ya bak",
        "itamine)Precommit.cmd juurutusskriptide k",
        "WWWTPPOOOOOUUUUHUHHU79",
        "gra minuter.aDu kan inte anv",
        "kleyin<G",
        ".CRT$XIA",
        "gra saker till innan du kan uppdatera. Vi meddelar dig n",
        "O(u5u",
        " atjaunin",
        "eg0M0~0[0",
        "Omlouv",
        "Architecture ne correspond pas ",
        ".?AVIDiskPartitionGetBKeyAction@@",
        "es-PY",
        "tetes saate salvestusruumide kasutamist k",
        "es: %1!d!%%#Isto poder",
        " za bitlocker za identifikator: 1Sustavu Windows potreban je prostor za a",
        "nda otomatik olarak g",
        ".Bu bilgisayara Windows 10'u yeniden y",
        " att batteriet inte laddas ur under installationen.",
        "pre a Windows 10-et, be kell ",
        " asem",
        "cente",
        "Soubor ISO",
        "Unidade flash USB",
        " nastavenie, osobn",
        "tu jaun",
        "mu Windows, mus",
        "s atmi",
        "az-Latn",
        "0M1v1",
        "r failure.cmd-distributionsskript",
        "%1!s! %2!s!%Medya olu",
        ".?AVCSetupResponsePageProductKeyValidate@@",
        "est pas prise en charge par cet outil.'Nous avons besoin de davantage d",
        "***xLII",
        "o ou execute o comando ",
        "date cerca del equipo hasta que vuelvas a iniciar sesi",
        "Gjeldende varselmeldinger og lisensvilk",
        "i sat",
        "(%d%%)",
        "HomePremium",
        "Me ei saanud k",
        "ivati i va",
        "s reciente",
        " necessario il tuo intervento",
        "o mais recente do Windows 10&Esta a",
        "   @@@```",
        ", zadajte spr",
        "sNevieme zisti",
        " PC_Ovaj alat ne podr",
        "_callnewh",
        "nternete ba",
        " tentando instalar uma vers",
        "0k0j0",
        "z9E????/40",
        "anas programmu.{Uzst",
        "li instalujesz ponownie system Windows 10, podawanie klucza produktu nie b",
        " od miesta preru",
        " putem ajuta s",
        "Seleccionar unidad flash USB",
        "n anahtar",
        "o mais antigos",
        "Da biste mogli da izvr",
        "ku %1!s! ru",
        " ir parametr",
        "progresso",
        "ration peut prendre un certain temps.",
        "ation du support",
        "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        \"> <rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"> <rdf:Description rdf:about=\"\" xmlns:xmpMM=\"http://ns.adobe.com/xap/1.0/mm/\" xmlns:stRef=\"http://ns.adobe.com/xap/1.0/sType/ResourceRef#\" xmlns:xmp=\"http://ns.adobe.com/xap/1.0/\" xmpMM:OriginalDocumentID=\"xmp.did:D90530087960E411BA60B7344D705471\" xmpMM:DocumentID=\"xmp.did:4AD21886700111E49021E51E50F2AB93\" xmpMM:InstanceID=\"xmp.iid:4AD21885700111E49021E51E50F2AB93\" xmp:CreatorTool=\"Adobe Photoshop CS6 (Windows)\"> <xmpMM:DerivedFrom stRef:instanceID=\"xmp.iid:977B7B345161E4118595B3E1319A734E\" stRef:documentID=\"xmp.did:D90530087960E411BA60B7344D705471\"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end=\"r\"?>ku",
        "CRichEditCtrlEx",
        "CSetupResponsePageCompat::OnInitDialog",
        "f(Wdk",
        "Velg spr",
        "%2!s!8Organisasjonen administrerer oppdateringsinnstillingene.",
        "rile.",
        "Nadaljuj",
        "Lataa p",
        " na pokra",
        " tu PC para que se ejecute en modo S. Elige esta edici",
        "Este disponibil",
        " %2!c!:)X",
        "Kui installite Windows 10 sellesse arvutisse esimest korda, peate sisestama kehtiva Windows 10 tootev",
        "ej verzie Windowsu 10",
        " i zachowa",
        "0zzk0W0f0",
        "Nimic%Ve",
        "kite Gerai, kad paleistum",
        "ati datoteke, aplikacije i postavke jer ste odlu",
        " instalare ",
        "0MRn0",
        " preciso reiniciar a Configura",
        "mu programu se nepovedlo spustit instalaci Windows. Restartujte instala",
        "Ak budete pokra",
        "re nie znajduj",
        "ul de reciclare pentru a elimina fi",
        "hoz. Pr",
        "e mus",
        "  &Ich m",
        "Ha most el",
        " Windows Server 2019$T",
        "d Product Key byste m",
        "lectionnez Actualiser.",
        "jas:Uzst",
        "ie de Windows diferit",
        "mas. Ne pare r",
        "to je potrebno sljede",
        "ana b",
        "bne programmer, og genstart derefter computeren. Installationen af Windows forts",
        "Siirret",
        "jWZa`",
        " na va",
        " grunn av for lite diskplass. Frigj",
        "t SSSj",
        "res restants",
        " ni bilo mogo",
        "af-ZA",
        "s inicializ",
        "paration : %d%%",
        "Windows Setup wird Updates, Treiber und optionale Features online abrufen. Diese Updates helfen bei der reibungslosen Installation und k",
        "t datoru. Aizveriet visas atv",
        " a spusti",
        "ssen m",
        "1Saglab",
        ";>;;;",
        "&ustu",
        " listesini yenile",
        " din dator p",
        "Diskpartisjon",
        " cihaz s",
        "ju un p",
        " je aktu",
        "jlokat, az alkalmaz",
        "Sans nom",
        "autres t",
        "Ng0B0",
        "nta3Det var problem med att k",
        "Besplatno a",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        "n. Revisa la informaci",
        "49^pt",
        " program a zkuste to znovu.0Syst",
        "tes-vous certain?",
        " bez aktywowania aktualnej wersji systemu Windows, musisz kupi",
        "041404B0",
        "elim pridonijeti pobolj",
        "c.%Jak",
        "/@8$A0",
        "KLEME B",
        ">(>4>@>L>X>d>p>|>",
        "essayez ou tentez d",
        "Vyskytla sa chybaKWindows 10 nain",
        "espace et r",
        "K%tww!",
        "eX[n0_j",
        "Arquivo ISO",
        "s az al",
        "Lamentablemente, estamos teniendo problemas para determinar si el equipo puede ejecutar Windows 10. Cierra el programa de instalaci",
        ".rsrc$01",
        "dos! Pressione Continuar9Escolha um dispositivo de armazenamento externo diferente",
        "0,0I0P0V0[0i0s0x0",
        "Der Schl",
        "installer %1!s! qui utilise une langue diff",
        "emo utvrditi je li va",
        " o utiliza",
        "fr-CH",
        "bor treba nesk",
        " riuscito a caricare le risorse della linguaSIl programma di installazione non ",
        "Kahjuks ilmnes probleem Windows Server 2019 valmiduse kontrollimisel teie arvuti jaoks. Sulgege installiprogramm ja proovige uuesti.(Windows pole selles arvutis aktiveeritud",
        "Nenhum",
        "s autom",
        "Downloader Windows 10",
        "Ochrana ",
        "KV@=1d",
        "Nn0'YM0j0",
        "rki on j",
        "ATento k",
        "tirilecek; destek cihaza g",
        "m spr",
        "Invalid Dialogue ID'We couldn",
        "vaketast v",
        "cie by ste mali venova",
        "enje, nato pa se bo zaprl",
        "Act&ualiser",
        "(%1!c!:) - %2!s! liber",
        " noklik",
        "e biti dodate automatski'",
        "hedal, kuni j",
        "es-CU",
        ": %1!d!%%&",
        "mtade filer.",
        ".?AV_AFX_DLL_MODULE_STATE@@",
        "ta-IN",
        "uriranja, upravlja",
        "ti.%Kokios yra kitos naujinimo parinktys?",
        "i instruc",
        "Vyberte, co chcete zachovat",
        "Instalar %sDO Windows est",
        "anie instalatora, aktywowa",
        "marrer le programme d'installation.",
        "Comprobando el equipo",
        " ir paleiskite ",
        "DownloadsMEntfernen Sie gro",
        "#QR(+",
        ") a m",
        "una./Morat ",
        "Sprache:",
        "Tady je p",
        "ADD_PROVISIONING_PACKAGE",
        "sti d",
        "ng installationsprogrammet och f",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::CheckUserInterrupt",
        "Productcode invoeren",
        "uz-Cyrl",
        " 2012 Microsoft Corporation. All Rights Reserved.SetupRegularVersion 1.06http://www.microsoft.com/typography/fonts/You may use this font as permitted by the EULA for the product in which this font is included to display and print content. You may only (i) embed this font in content as permitted by the embedding restrictions included in this font; and (ii) temporarily download this font to a printer or other output device to help print content.",
        "bbletk",
        "Installi %s5Installimise j",
        "ite popis i poku",
        "Oba`Ta klju",
        "Microsoft JhengHei Bold",
        " Windowsin asetukset ja omat tiedostot",
        "(&R)c",
        "050N0k0",
        "`ck(W",
        "ta BitLocker aiztur",
        "x1iYk",
        "101`1",
        "Preuzimanje",
        " PC-ul(Ne asigur",
        "Nu momentan",
        "tfen a",
        "Wir haben Ihren PC in den Zustand zur",
        "qLa comprobaci",
        "klemeye devam etmek ve Windows ayarlar",
        "o reformatar",
        "jumsXNeizdev",
        "%1!s! %2!s!\"There was a problem creating mediazThe edition of Windows that matches the product key you entered isn",
        "L$ ;C8",
        "69-=IImWImWHWh",
        "ttes ikke av dette verkt",
        "(Fpy_",
        ":F;y;",
        "z veya Windows 10",
        "n veya y",
        "sa DVD-re",
        "?:?S?o?",
        "0g0W0_0$",
        "ovat bez aktivace aktu",
        "klemesi ba",
        "rgmistest p",
        "Juridisk",
        "re done and what to do next. This window will automatically close in %1!d! minutes.",
        "patur",
        "Kurulum haz",
        "040604B0",
        "ntalo con otra clave distinta o compra una clave nueva.",
        "ili, da %1!s! namestite v jeziku, ki ni enak temu, ki ga uporabljate sedaj.",
        "o do Windows 10",
        "Verwijder het volgende externe station en klik op OK om de pc opnieuw op te starten en de installatie van Windows te voltooien.",
        "Codice Product Key",
        " actualizarea pentru Windows 10",
        "s, contrairement ",
        "l||||",
        "261019185142Z0",
        "Laufwerkauswahl",
        "o temos a certeza do que aconteceu, mas n",
        " ce se termin",
        "n solo si instalas Windows en un equipo dise",
        "PripremaQOvo ste ve",
        "#Tem certeza de que deseja encerrar?",
        "@Meiryo UI",
        "kai,Produkto kodas sudarytas tik i",
        "lisseadet (nt USB-m",
        "=E=U=",
        "CSetupResponsePageBitLockerKeyValidate::OnOSKBtnClicked",
        "ani direktorij ili poku",
        "l.?A preinstall.cmd k",
        "zykowych2Instalator nie mo",
        "i din nou.,Windows 10 nu este ",
        "o precisar",
        "n de privacidad",
        "W0j0D0",
        "nce bilinmesi gerekenlerr",
        " datorn",
        "ave pri izvajanju skriptov preinstall.cmd.9Pri",
        "t work. Try a different key.",
        "toarelor aspecte pentru a continua instalarea ",
        " zdroje in",
        "s pabeigta, m",
        "Ladda ned den senaste versionensDet finns en nyare version av verktyget. Du m",
        "to varira) i mogu",
        "zSi vous souhaitez installer Windows 10 sur une autre partition, vous devrez cr",
        "lpa dig s",
        "eCSetupResponsePageBitLockerKeyValidate::OnBitLockerKeyEditUpdated",
        "ige v",
        "Hvis du installerer denne utgaven av Windows 10, konfigureres PC-en din til ",
        ".rdata$zETW2",
        "iniz b",
        "nit, co se m",
        "liorer l",
        "Architektur",
        "Cambiar la forma en que el programa de instalaci",
        "jjk`jjk%",
        "RW0~0Y0",
        "l4a2M ",
        "lg, hvilket medie du vil bruge",
        ".?AV?$CZeroInit@VCSetupResponsePageDiskPartition@@$00@@",
        "Palun oodake4Preinstall.cmd skriptide k",
        ".6Pobierz zaktualizowane Narz",
        ".?AV?$CZeroInit@VCSetupResponsePageProductKeyValidate@@$00@@",
        "Diegimo laikmenos (USB ",
        "o pripravujeme",
        "s probl",
        "i Windows postavke i li",
        " disk je spreman",
        "idlo OK.",
        "tta.cWindows 10 v",
        "uga caracteristici la Windows. Nu se poate utiliza pentru a instala Windows.",
        " tietokone nyt",
        "Kontrollerar datorn+Kontrollerar om installationen kan p",
        "velkite informacij",
        "Installerar Windows 10CDatorn kommer att startas om flera g",
        " ir maz vietas. Atbr",
        "Saklanacaklar",
        "jot pa",
        "&Nepavyko rasti USB ",
        "Sto controllando il PC:Sto verificando se il sistema ",
        "Stvaranje medija za Windows 10'Slobodno nastavite s kori",
        "n instaladas, pero el programa de instalaci",
        " %c:JKomputer zostanie uruchomiony ponownie kilka razy. Mo",
        "Sljede",
        "ti peaks asuma DVD karbil v",
        " comprar uma chave do produto ou licen",
        "gekkel j",
        "yQ^?%?",
        "FDelf",
        "s conectado a Internet e int",
        "s programmas un p",
        "oK0D$\"<",
        "anjem sistema Windows Server 2019.TNadaljevali bomo z name",
        "2019. Fermez le programme d",
        " despu",
        "eGali ",
        " dans la phase %1!s! avec une erreur lors de l",
        "%1!ld!%% conclu",
        "n para continuar la instalaci",
        " nuo ten, kur sustojome. Deja, tur",
        "UpdateWindow",
        " ja yrit",
        "jYWh(",
        "cijas failus",
        "Anwendbare Rechtshinweise und Lizenzbedingungen",
        "MediaCreationSuccess",
        "Ouvrir/Je souhaite plut",
        "=!=1=>=s=",
        "ovat na webu Windows Update.UKonfiguruje se aktualizace pro Windows 10.",
        "o tem espa",
        "RK0K0",
        " naujo ir baigtum",
        ",De nieuwste versie van Windows 10 downloaden",
        "rebilir.kWindows y",
        "CSetupResponsePageBitLockerKeyValidate::UpdateView",
        "ps-AF",
        "> >4>8><>@>H>\\>`>d>|>",
        " spravova",
        "Odota",
        "ndirmelerF",
        " -NKb",
        "obH\\`",
        ", ohjaimia ja valinnaisia ominaisuuksia",
        "BitLocker",
        "j verzi",
        "i.!Instalarea Windows 10 nu a reu",
        " de gravar o ficheiro ISO num DVD mais tarde.",
        " sur ce PC. Cela signifie que vous allez devoir entrer la cl",
        "0g01YWeW0~0W0_0",
        "anjem ne izprazni.",
        "pne papirkurven manuelt.KKan ikke ",
        " recusar os termos de licen",
        "GetSystemTimeAsFileTime",
        "rskendamiseks veel?",
        "teri deste",
        "ite praegu oma arvutit edasi kasutada.HInstallimine nurjus etapis \"%1!s!\"; t",
        "tzliche Dateien enthalten, die sich nicht auf dem Installationsmedium befinden. Wenn Sie diese Updates jetzt nicht installieren, funktioniert Ihr PC nach der Installation m",
        "4IKXY\\+",
        "tve, vagy ",
        "les iesp",
        "&Aizv",
        "nstalleerd vanwege onvoldoende schijfruimte. Volg de onderstaande instructies om de update te voltooien.)Maak %1!s! vrij op uw pc (station %2!c!:)PSelecteer of verbind een extern opslagapparaat met ten minste %1!s! vrije ruimte",
        "lj en annan enhet.",
        "ringsdata(Kan ikke rydde opp i installasjonsfilene5Kan ikke fastsl",
        "k/nj_",
        "0D1g1u1",
        "Image ausw",
        "e da biste uklonili izbrisane datoteke iz operacijskog sustava.",
        "tirmeleri indirme bi",
        " %1!d! GB.",
        "ado para funcionar en modo S.OLa unidad flash USB debe tener al menos %1!d! GB o m",
        "lva ezen a g",
        "kkel.0Produktn",
        "vamos solucionar esta quest",
        "lj en s",
        "t vec",
        "rut o problem",
        " asennusl",
        "Nu sunt disponibile actualiz",
        " asennusohjelma uudelleen.",
        "aduje sa %1!d! GB vo",
        " tuoteavain ei toimi. Kokeile toista avainta tai osta uusi avain.",
        " cheie nu va func",
        "s)A sz",
        "Pfad ausw",
        " deneyin veya yeni bir anahtar sat",
        "Configura",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::Initialize",
        "=,>D>`>d>h>x>",
        "3?3H3c3",
        "i din nou.",
        "1FL&S",
        "4 4$4(4,4044484<4@4H4L4P4T4X4\\4`4d4h4l4p4",
        "re Windows 10",
        " %s?Syst",
        "Personvernerkl",
        "tare pentru a-l elimina din list",
        "claration de confidentialit",
        "pannage",
        "6)606>6E6X6",
        "Spoljni ure",
        "Doorgaan vanaf waar ik ben opgehouden",
        "O: alguns recursos do Windows 10 requerem hardware avan",
        "rgmine v",
        "nIDATx",
        "rcare",
        " estiver usando uma conex",
        ". Ja probl",
        " installere en eldre versjon av Windows.iStasjonen du pr",
        "=B=S=",
        "Hvis du forts",
        "0W0f0D0~0Y0",
        "Disse oppdateringene hjelper installasjonsprogrammet med ",
        "Pripremamo nekoliko stvari",
        "1Prenesite najnovej",
        "zh-MO",
        "ite datoteko ISO na DVD z orodjem %1!s!.",
        "&Opdater",
        "'bitlocker ",
        "stra.?Totul va fi ",
        "Spusti",
        " Microsoft Corporation. Sva prava pridr",
        ". Patikrinkite, ar esate prisijung",
        "a izdelka ne bo treba vnesti.",
        "CSetupLangIniLoader::Initialize: Set default install language = %s.",
        "installation de Windows. Sauvegardez et fermez vos fichiers avant de commencer.APatientez pendant que l",
        "mom Windows 10 m",
        "GetDiskFreeSpaceExW",
        "rene, afslutter du installationen.yVi har brug for mindst 350 MB plads for at kunne k",
        "lido. Introduzca una clave correcta8Introduzca la clave de BitLocker para el identificador: 2Windows necesita m",
        "cznie z plikami, aplikacjami i ustawieniami.",
        "|cY(d",
        "teva lucruri",
        " diegti",
        "Chave do Bitlocker",
        " usando Windows 10%L'operazione richieder",
        "ifra proizvoda za Windows 10.",
        " un error inesperado. Comprueba si tienes acceso a los or",
        "lisan a(z) %1!s! alkalmaz",
        "en Sie den PC an, um sicherzustellen, dass die Akkuladung f",
        "Si Windows",
        "elda, kas teie arvutis on Windows Server 2019 installi j",
        "i da ni",
        "luseadme maht peab olema v",
        "i computerul",
        "llapotba.BA Windows Server 2019 telep",
        " USB, SD ",
        ".?AV?$CZeroInit@VCSetupResponsePageBitLockerKeyValidate@@$00@@",
        "ri\"Se verific",
        "Lg ;M@c",
        "Varat turpin",
        "u kapat",
        "rbaude, vai nav atjaunin",
        "er un support d",
        "xCSetupResponsePageCompat::UpdateView",
        "1$?/CCCCCDDDCDC81",
        "klemek i",
        "Bu, birka",
        "Prohl",
        "a organizacija.",
        "WW~~~VVU~UUUUUO7G",
        "CInstallUI::ConfirmCanceled: User cancel aborted",
        "Sistem de operare Microsoft",
        "r du kobler til Internett, aktiverer vi Windows for deg. ",
        ".?AV?$CMoReserveManagerT@V?$CUnknownImpl@UIUnknown@@@@@@",
        " que vous avez achet",
        "Kullan",
        "Wanneer u deze Windows 10-editie installeert, wordt uw pc zodanig geconfigureerd dat deze wordt uitgevoerd in de S-modus. Kies deze editie alleen als u Windows installeert op een pc die is ontworpen om te worden uitgevoerd in de S-modus.NHet USB-flashstation moet minimaal %1!d! GB zijn. Selecteer een ander station.!Download de meeste recente versie",
        "gen von Features zu Windows, nicht zum Installieren von Windows.",
        "ycia magazynu. Otw",
        "4#5@5X5v5",
        "kerhetskopiera dem till en annan plats nu.",
        " prov",
        "%WINDIR%\\System32\\OSK.EXE",
        "u pour fonctionner en mode S.YLa cl",
        "iausiai %1!d! GB. Pasirinkite kit",
        "dzie Oczyszczanie dysku.",
        "re all set7We",
        "z9P$j",
        "nSEl programa de instalaci",
        "o by ste mali vedie",
        "eli name",
        "Diegiamas ",
        "SelectDownloadImage",
        "ar desde o in",
        "dzia. Aby kontynuowa",
        "z gerekir./Bilgisayar",
        "0F0j0b_",
        "Veuillez patienterIUn probl",
        "tja a sz",
        " asennusohjelma uudelleen.pEmme pysty selvitt",
        "rifiez que les sources d",
        "dami bandyti dar kart",
        "g hely a Windows 10 telep",
        "n de Windows est",
        "Valmistellaan paria asiaa1T",
        "Unable to add selection for system drive",
        "2,2D2\\2t2",
        "Instaluje se Windows 10.=Po",
        " k hladk",
        " innego klucza.FKlucz funkcji BitLocker dzia",
        " %2!c!:.HWindows 10 ",
        " USB flash meghajt",
        "jot da",
        "rqr rqr",
        "pen+Folytatja a m",
        "Versio",
        "Avisos y t",
        "b pobierania aktualizacji przez Instalatora systemu Windows",
        "%4!s!'Sie sind jetzt zur Installation bereit.BWir setzen die Installation von Windows 10 in Windows Update fort.jDas Update f",
        "vel encontrar arquivos de instala",
        "unalnik pripravljen na nadaljevanje name",
        "Crte ",
        "tigt.6%1!d! GB freier Speicherplatz auf (%2!s!) erforderlich",
        "nker uppgradera fr",
        "netebileceksiniz.DAyarlar",
        "i o copie activat",
        "dia sa vyskytol probl",
        "ar a instalar o Windows Server 2019.DContinuaremos a instala",
        "https://go.microsoft.com/fwlink/?LinkId=530046",
        "Use an external device such as a USB key, SD card or external hard drive to temporarily extend your hard drive while the updates are being installed. Windows will not reformat your external storage device and you can remove it after installation is complete.%Requirements Complete! Press Continue*Choose a different external storage device",
        "e se te",
        "lreiz.",
        "Nastavi od mesta gde sam stao",
        "o eliminados. Para manter estes ficheiros, fa",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::Initialize",
        "nstalleerd, maar werken pas nadat Windows 10 Setup opnieuw is gestart. Hierna wordt de installatie van de updates voltooid.0Windows 10 kan niet worden uitgevoerd op deze pc",
        "%1!s! %2!s!/A ap",
        "de determinar op",
        "Av&bryt",
        "WRjUZ",
        "CSetupResponseTemplate<class IDlpResponse>::InitializeRoutine",
        "nd se termin",
        "7%777@7I7S7a7}7",
        "de iniciar a instala",
        "s tarde.",
        " a desinstala",
        "hy-AM",
        "n prezent.",
        "s7mB$A",
        "$Tworzenie no",
        " %2!s! nezasedenega prostora",
        "re restant",
        " Windows Server 2019+",
        "ykite ir toliau naudokite savo kompiuter",
        "s atjaunin",
        "as lietas. Aizveriet ",
        "ati nastavitve, osebne datoteke ter aplikacije sistema Windows, morate urediti spodnje stvari.@",
        ",RMq1P/LFRSmEa4/CmRWv27h3qZgyBg9RgXKRVUGhFmQ=0Z",
        "O&sve",
        " naujo paleid",
        ".xdata$x",
        "Nieko nepalikti",
        "tkamiseks peaksite t",
        "t asemat",
        "These updates will help the installation go smoothly, and can include important fixes, updated device drivers, and additional files which are not on the installation media. If you don't install these updates now, your PC might not function properly after the installation, and you might need to reinstall some optional features and languages.!K",
        "s antes de actualizar. Te avisaremos cuando finalicemos y te indicaremos qu",
        "du Product Key nebude nutn",
        "ne datoteke i aplikacije, potrebno je da obratite pa",
        "Nevieme zisti",
        "181@1H1P1X1d1",
        "Lugege see l",
        "%1!s! %2!s!.Ocorreu um problema ao criar suportes de dados}A edi",
        "- Windows ",
        "lat d",
        "Instalator systemu Windows 10",
        "USB-muistitikku",
        "tietoja Windows Serverin p",
        " je Windows Server 2019 p",
        "elite li nastaviti s tim odabirom?",
        " sakla",
        "La arquitectura no coincide",
        "t a valid character",
        " dit aktuelle sprog og i den aktuelle arkitektur.",
        "Operating System:",
        "Selle taustal toimuva allalaadimise maht on umbes 4 GB (v",
        "10 pour la premi",
        ": https://aka.ms/windowsserverupgrade",
        " entrar no Windows 10. Para ajudar a proteger seus dados, mantenha seu computador com voc",
        ")A Windows 10 adathordoz",
        "USB zibatmi",
        ".text$x",
        "elite ohraniti",
        "&Lisensvilk",
        "4*4:4?4Y4",
        "Preuzmi a",
        "PRE_OOBE",
        "eHr,g",
        "sti stand",
        "VarFileInfo",
        " de Windows 10  sur votre PC en raison d'un espace disque insuffisant. Suivez les instructions ci-dessous pour terminer la mise ",
        "RoskakoriXTyhjent",
        "(%1!c!:): %2!s! libres",
        "enje diska",
        "cy format: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "IDATx",
        "ilitamiseks peaksite t",
        "a je naplata naknada za internetski pristup. Kliknite dalje da biste preuzeli najnovije instalacijske datoteke.",
        "o mais recente desta ferramenta. Tem de transferir e executar a vers",
        "ca-ES-valencia",
        "CSetupResponsePageBitLockerKeyValidate: OnMaxLengthExceeded",
        "re installasjonsprogrammet. Frigj",
        "jHhPA",
        "owo, a ponadto mo",
        "tat qu",
        ";USB ",
        "z yerden devam edece",
        "Iz nepoznatog razloga nije mogu",
        "B~s>w",
        "lt meg",
        "jiet datoru. Windows instal",
        "8&8Z8d8",
        "https://go.microsoft.com/fwlink/p/?LinkId=827166",
        "l(W`O",
        "s noteikt atbalst",
        "A Windows leg",
        "Viskas nustatyta.9Toliau diegiame ",
        "n, tienes que prestar atenci",
        " elementy do zachowania",
        " 350 MB voln",
        "nda 25 karakter bulunur.",
        "etko potrebn",
        "nergeleri izleyin.1Bilgisayar",
        "ni pogoji",
        "The following things need your attention to continue the installation and keep your Windows settings, personal files, and apps.FThe following things need your attention to continue the installation.]The bit locker looks similar to this: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX7The bit locker key only contains 48 digital characters.",
        "ZIt may take a few moments to check if what you want to keep is compatible with Windows 10.bThis product key can only be used to add features to Windows. It can",
        "042604B0",
        "ati svoje postavke sustava Windows, osobne datoteke i aplikacije.\\Sljede",
        "cie, ovl",
        "<5555",
        ", Windows Server 2019",
        "Use the recommended options for this PC",
        "2#3?3",
        "ndeKInstallera Windows 10 genom att klicka p",
        "en-HK",
        "nda den h",
        "CSetupResponseTemplate<class IDiskSpaceActionResponse>::ExecuteRoutine: Next button clicked.",
        "pppppp",
        "ranka2I",
        "ri, drivere ",
        "##########",
        " ett problem n",
        "s informaci",
        " innego klucza.XTen klucz produktu nie dzia",
        "SelectedImageIndex",
        "lacak yeterli alan yok. Ba",
        "6-6=6M6]6m6}6",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::Suspend",
        "jra az interneten v",
        "n.%Libera %1!s! en tu PC (unidad %2!c!:)fSelecciona o conecta un dispositivo de almacenamiento externo con al menos %1!s! de espacio disponible",
        ":':8:>:P:W:d:j:~:",
        "@;&pj",
        "Anna BitLocker-avain",
        "te diegim",
        "O(uW0",
        "mu Windows prejde do re",
        "Abrir Descargas%Abrir Configuraci",
        "tu, l",
        "e chv",
        "paration au t",
        "i da instalacija pro",
        "Drive Selection%Setup is cleaning up before it closes",
        "te. System Windows 10 jest aktualizowany automatycznie w okresie ",
        "riist uuesti k",
        "vesti informacij",
        " ingyenes friss",
        " %1!d! GB. Vyberte jin",
        "%Error code: 0x%1!lX! - 0x%2!lX!",
        "9~ltFSWW",
        "BitLocker-beveiliging wordt onderbroken tijdens deze update en wordt hervat als u zich aanmeldt bij Windows 10. Houd de pc bij u totdat u zich weer aanmeldt, als u uw gegevens beter wilt beveiligen.'Hier volgt een overzicht van uw keuzes:",
        " pomocou ",
        " de Windows, va trebui s",
        "Conecta",
        "anas failusSUzst",
        "tirmeyi tamamlamak i",
        "rt jelenik meg ez?",
        "A&ggiorna",
        "o nos itens a seguir.SO bitlocker ",
        "e nekoliko minuta.",
        "RaiseFailFastException",
        " utiliser votre PC.UL",
        "o, e talvez seja necess",
        "0g0O0`0U0D0;",
        " Windows Server 2019.3",
        " repornire, vom continua de unde am r",
        "GTen klucz produktu nie dzia",
        " duomen",
        "ste to znova.=V ",
        "vceWPokud chcete pou",
        "fr-HT",
        "dajov, skontrolujte, ",
        "Deze pc nu bijwerken",
        ",%1!d! Gt vapaata levytilaa tarvitaan (%2!s!)",
        "au moins 350 Mo d",
        "ssen.",
        "tted ja rakendused kustutatakse, kuid failid s",
        "Select External Storage Device",
        "Precommit.cmd ",
        "anas datus=Uzst",
        "Skoro smo spremni",
        "tsen r",
        "t dig. ",
        "nker installera Windows 10 p",
        "s nem ",
        "042504B0",
        "GetTraceLoggerHandle",
        " bruke %1!s!.",
        "ebujeme aspo",
        "VFFD|vh",
        "MediaSetupUIMgr.dll",
        "Crtice ",
        "Washington1",
        "o ficar sem energia na bateria durante a instala",
        "lva ezen a PC-n.",
        "Setup doesn",
        "n bejelentkezik a Windows Server 2019-be. Az adatai biztons",
        "ldende meddelelser og licensvilk",
        " najnowsze pliki instalacyjne.",
        " kilka minut.",
        "ra diegimo laikmenoje. Jei dabar ne",
        "ite svoj pevn",
        ". Bandykite i",
        "titi privatnosti",
        "r%llu",
        "unalnik2Preverjamo, ali je vse pripravljeno za namestitev.",
        "Ecco alcuni elementi da tenere presente:",
        "Flytter innstillingene %d %%",
        "NTaj klju",
        " z nasleduj",
        " (%2!s!)g",
        "tani %1!s! helyet a(z) %2!c!: meghajt",
        "ljaannet.",
        "ket i eller utg",
        "%c:WKi",
        "alinkite ",
        "ey silinir.",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        " Internet, n",
        "_Puede tardar unos minutos en comprobar si lo que quieres mantener es compatible con Windows 10.yEsta clave de producto solo se puede usar para agregar caracter",
        "e funkcije so bile spremenjene ali odstranjene; sistem Windows 10 se v obdobju podpore samodejno posodablja; podpora se lahko razlikuje glede na napravo.",
        "Sign in as an administratorRTo use this tool, you must be signed in to Windows using an administrator account.0You'll need to burn the ISO file to a DVD later.",
        "Priprema instalacije ",
        "rnia egy ",
        "Skapar Windows 10-media,Du kan forts",
        "RW0_0",
        "ouverture de votre corbeille. Veuillez ouvrir manuellement votre corbeille.x",
        "g el kell int",
        "Muuta s",
        " sospesa durante questo aggiornamento e sar",
        "ilita midagi",
        "nlott)",
        "We noticed that you have older installation files for Windows 10.  We can help you to get the latest files to make sure that you install the most recent version of Windows 10.",
        "installation de Windows. Vous devrez entrer ",
        "System operacyjny Microsoft",
        "elite za",
        "czenie internetowe i spr",
        "pIf you want to install Windows 10 on another partition, you need to create and then run the media to install it. Feel free to keep using your PC.OThe installation failed in the %1!s! phase with an error during %2!s! operation",
        "Diskdzi",
        "SVWj?[j",
        ", SD kart veya harici sabit s",
        "0?k$A0",
        "e obdr",
        "Windows Installation g",
        "se problemet, og k",
        "Notiek %d%% sagatavo",
        "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;",
        "5#5h5",
        "o estamos a conseguir determinar se d",
        "ra. Det h",
        "CInstallUI::CInstallUIMessageWindow::SwitchToErrorPage",
        "vebb inform",
        " izdelka za Windows 10 ali zapreti namestitveni program, aktivirati Windows, nato pa znova zagnati namestitveni program.",
        "Baixando Windows 10",
        "lLe lecteur que vous essayez d",
        "SearchPathW",
        "&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz",
        "]w=;11",
        "tfen listeyi yenileyin ve yeniden deneyin.",
        " kompatibilitu",
        "Atidaryti atsisiuntimus",
        "n timpul instal",
        " uudelleen tai anna toinen avain.5BitLocker-avain toimii! Voit jatkaa, kun olet valmis.",
        "121H1^1",
        "Ugyldig dialogboks-ID",
        " fortsette.:Last ned det oppdaterte verkt",
        "tada ning on v",
        "o (pen drive, DVD ou arquivo ISO) para outro computador",
        "m Microsoft",
        "Progreso: %1!d!%%:Seleccione una de las opciones disponibles para continuar.",
        "0&0-0E0g0",
        "Kontrollerer n",
        " i rodmappen p",
        "sa in spr",
        "0\\Omi-Nn0",
        "cia instalacji systemu Windows 10.",
        "ene ili uklonjene. Windows 10 automatski se a",
        "t%jZW",
        "%3!s!3Ponowne uruchamianie Instalatora systemu Windows 10",
        " instal",
        "unalnik.LName",
        " a aceitar.",
        "ama vieta, lai atjaunin",
        "Hvis det er f",
        "s internetel",
        "ar.6Aguarde enquanto o aplicativo termina a desinstala",
        "steemi Windows 10 v",
        "yj starszych plik",
        "Extern",
        "i din nou.B",
        "PC-ul va reporni de c",
        "Windows 10 ve",
        "jies instal",
        "d nen",
        " Windows. Salva",
        "Opprett installasjonsmedium (USB-flash-enhet, DVD eller ISO-fil) for en annen PC",
        "gle..Produktn",
        "ILLNadd",
        "kih programa ure",
        "sti naujausi",
        "l nevaram noteikt, vai j",
        "fKorumak istedi",
        "Bez oznake",
        "IsSecureBootBound",
        "2'272",
        "i dostatok miesta na pokra",
        "&Anuluj",
        "di: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX.",
        "&alej",
        "a no funcionar correctamente despu",
        "m vyjadrujete s",
        "ges megtartani",
        "cessitent votre attention pour la poursuite de l",
        "v igen.0Installation af Windows Server 2019 er mislykket#Installation af Windows Server 2019",
        "aide d",
        "Locale",
        "=$=4=8=@=X=h=x=|=",
        ">(>.>?>W>j>~>",
        "ments ",
        "s och f",
        "mu savienojumu, p",
        "Ovo bi moglo potrajati.ZKonfiguriranje a",
        " installer",
        "Comprobando la clave\\La clave de producto no funciona con esta edici",
        "t instal",
        "10. Nous pouvons vous aider ",
        "%1!d!%% on l",
        "Ladda ned",
        " Media Creation Tool",
        " z systemu Windows 7 lub Windows 8.1 lub je",
        "3:f,f-",
        "it) a m",
        "CSetupLangIniLoader::Initialize: Set default UI language = %s.",
        "(USB ",
        "https://go.microsoft.com/fwlink/?LinkId=620074",
        ".?AVIDlpObjectInternal@@",
        "&Teclado en pantalla",
        "INFORMACIJE O INSTALACIJI: za neke zna",
        "re fois sur cet ordinateur, vous devez saisir une cl",
        " je me suis arr",
        "chargement de certains fichiers",
        "czenie z Internetem i spr",
        "te ko",
        "(Klaidos kodas: 0x%1!lX! - 0x%2!lX!",
        "Notiek Windows 10 lejupiel",
        " klucza produktuCInstalator nie mo",
        "Estamos com dificuldade para determinar se o Windows Server 2019 est",
        "te kitus didelius elementus.&Pasirinkite i",
        "2019. Pour prot",
        " volby instalace.:Instala",
        "tzt.$Es wird mehr Speicherplatz ben",
        "da biraz yer a",
        "Se descarc",
        "n antiguos de Windows 10.  Podemos ayudarte a obtener los archivos m",
        "Wenn Sie den Vorgang fortsetzen, ohne Ihre aktuelle Windows-Version zu aktivieren, m",
        "Klargj",
        "htestamine",
        "iai. Spustel",
        " en el directorio ra",
        "te, in",
        "Odota>Preinstall.cmd-komentosarjojen suorittamisessa tapahtui virhe.=Precommit.cmd-komentosarjojen suorittamisessa tapahtui virhe.",
        "Oppretter medium for Windows 10",
        "Please visit: %1!s!",
        " unitate ",
        "irite trdi disk med name",
        "quz-BO",
        "Tarkistetaan latausta",
        "ts. Tas var ilgt k",
        "CSetupResponsePageMediaCreationSuccess",
        "lg eller tilslut en ekstern lagerenhed med mindst %1!s! ledig",
        "1&121>1U1^1q1",
        " kompiuteriui. U",
        "6F6X6m6",
        " zoznam jednotiek",
        "es!Estamos preparando algumas coisas",
        "k veya kullan",
        "REPLICATE_OC",
        "u etkinle",
        "Asennetaan Windows Server 2019",
        "%1!d! GB ",
        "&elim da pomognem da instalacija operativnog sistema Windows bude bolja",
        " tiek atjaunin",
        "%s GBbWe can",
        "Her ikisigBu bitlocker anahtar",
        "ene, vendar se mora za njihovo delovanje namestitveni program za Windows 10 znova zagnati. Po ponovnem zagonu bomo nadaljevali, kjer smo ostali.:V tem ra",
        "d#\"oyG",
        "no za",
        "Avaa roskakori",
        " temizleyemedi@Kurulum program",
        " nytt. Lukk eventuelle ",
        "nyzik a licencszerz",
        "Ha a Windows jelenlegi verzi",
        "ljaanne",
        "%3!s!6Notiek Windows 10 uzst",
        "Instaliranjem ovog izdanja sustava Windows 10 va",
        "n de Windows ha visto un error que no esperaba.",
        "ti sobib! Kui olete valmis, j",
        "Windows Server 2019-Setup,Windows Server 2019-Setup wird neu gestartet",
        "Nie wy",
        "ivitada.(V",
        "n det du anv",
        ". Prane",
        "installation et recommencez.",
        "nerilen se",
        "i dohvatiti najnovije datoteke da biste instalirali najnoviju verziju sustava Windows 10.",
        " aucun lecteur de cl",
        "Potreban je dodatan prostor8Potrebno je %1!d! GB slobodnog prostora na disku (%2!s!)~Uklonite datoteke koje vam vi",
        " aktywowany na tym komputerze. Oznacza to, ",
        "a cuando est",
        " suportul fizic Windows 10\"Pute",
        " la client",
        " ID dijalo",
        "ania failure.cmd",
        "Ath_[S",
        "es que se seguem.",
        "t pour votre PC. Quittez le programme d'installation, puis r",
        "se majdnem k",
        "n de su descarga",
        "kressursene#Kan ikke initialisere arbeidsmappen Ugyldige kommandolinjeparametere",
        " do Windows. Ned",
        ". Kad izveidosit savienojumu ar internetu, m",
        "Ne moremo nadaljevati zaradi enega od spodnjih razlogov:",
        "=#=,=E=c=",
        "ne datoteke. Provjerite jeste li povezani s internetom i poku",
        "__CxxFrameHandler3",
        "rete mintegy 3 GB. Forgalmi d",
        "&Tagasi",
        " a reiniciar o computador para continuar a instala",
        "jra.PA k",
        "diegti ",
        "gleKDenne n",
        " refuza",
        "SupportedInstallChoicesBeforeCheck",
        "CInstallUI::CInstallUIMessageWindow::ShowRollbackPage",
        "rulayamad",
        "FveCloseVolume",
        "1(0&0",
        "Non spegnere il computer",
        "FLdegx",
        "ete morati ponovno unijeti podatke.AInstalacijski program nije uspio primijeniti podatke za migraciju@Instalacijski program nije uspio o",
        " limb",
        "st telep",
        "cijas failus. L",
        "Downloads openen",
        "?$?0?<?H?T?`?l?x?",
        "tja az al",
        "Alterar o que deve ser mantido",
        "xxwwx",
        "sti vapaata tilaa+Haluatko jatkaa t",
        ":m;z;",
        "Instalacijski program nije pokrenuo instalaciju sustava Windows. Ponovno pokrenite instalacijski program i poku",
        "Pobieranie systemu Windows 10",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::GetResponseId",
        "altmaya yard",
        "NW0~0Y0K0?",
        " cargos adicionales.(",
        "r att starta om och slutf",
        "WNustat",
        "e besprijekorno i mogu uklju",
        "Instalaci",
        "ka USB.",
        "Installer %s=Windows red",
        "jumi(Windows pazi",
        "Impossible de d",
        "en Sie ein solches an",
        "10-be. Adatai biztons",
        "cie s",
        "Installiprogramm ei kasuta k",
        "stroja sa vyskytol probl",
        "s. Selecciona otra unidad.!Descargar la versi",
        ": 0x%1!lX! - 0x%2!lX!",
        "$Tuoteavain sis",
        "rqrFrqr",
        "s de votre lecteur syst",
        "nvalvojan tilill",
        "Poista tiedostot, joita et en",
        "juma e-pasta zi",
        "ks neatbalsta.",
        " preinstall.cmd'",
        "m Windows v tomto po",
        "qdbegs",
        " ir nustatym",
        " otras opciones hay para actualizar?",
        "nder.",
        "Support",
        " listo para este equipo",
        "   000",
        "%1!ld!%% har slutf",
        "nes muus keeles peale praegu kasutatava.wTeie faile, rakendusi ja s",
        "nili. Windows 10 sa aktualizuje automaticky po",
        "n %1!d! Gt.",
        "\"6:91AXTPNLKl",
        "vel instalar o Windows 10VO PC foi reposto para o estado em que estava antes de come",
        " velikost asi 3 GB. Pokud pou",
        "s. Esta ventana se cerrar",
        "ete v Windows Server 2019. ",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "rskenduste, draiverite ja valikuliste funktsioonide hankimine",
        "ierele mari sau neutilizate din folderul Desc",
        "hren Sie Setup erneut aus.nWeitere Informationen f",
        ")Termos de licen",
        ">->E>J>j>",
        "s neparedz",
        "est produite lors de l",
        ".>A Windows Server 2019 m",
        "Product Key eingeben",
        "s selecciona Actualizar.",
        "pet a k",
        "ssel funktioniert nicht. Verwenden Sie einen anderen Schl",
        "pierakst",
        "IsAppThemed",
        "ie zada",
        "re interested in finding out why.",
        "o se encontram no suporte de dados de instala",
        "00S0{0",
        "o.(Liberte %1!s! no seu PC (unidade %2!c!:)YSelecionar ou ligar um dispositivo de armazenamento externo com, pelo menos, %1!s! livres%Dispositivo de almacenamiento externo",
        "digo de error cuando te pongas en contacto con el soporte t",
        " asi takto: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXBPred pokra",
        " vagy nem haszn",
        " denetlemek birka",
        "e a potom vyberte Aktualizovat.",
        "tait avant le d",
        "sselwert f",
        "%RP[n0 ",
        "455>5J5",
        " modifi",
        "ite se kot skrbnik[",
        "o mais recentes.",
        "as trva",
        "lntdll.dll",
        "e se datoteke sa USB diska. Da biste zadr",
        "zellikleri ve g",
        "jlok let",
        " atualizado automaticamente durante o per",
        "ve set your PC back to the way it was right before you started installing Windows Server 2019.@We",
        "sr-Latn-ME",
        " installere den nyeste versjonen av Windows 10.",
        "889[9",
        " bulam",
        "r att installera Windows.",
        " viac ako 4 GB (m",
        "unalniku.",
        "```ppp",
        "}oH9E",
        " jour votre PC",
        " la crearea suportului fizic",
        "t izmantot, ir ",
        "rast v",
        "zt, amelyen legal",
        "Allt ",
        "ejte jin",
        "Kodas atrodo ma",
        "Windows 10 uzst",
        "Pri in",
        "ntastat",
        "??0exception@@QAE@XZ",
        "sti iri paleisti naujausi",
        "0g0o0)R(ug0M0~0[0",
        "o %2!s!",
        "te sa na oddelenie slu",
        ". Otvorte ho manu",
        "ntalo de nuevo, o prueba con una clave distinta.;La clave de producto funciona. Contin",
        "CSetupCompatDlpResponse::OnCompatResultsChanged",
        "ali, vam bomo to sporo",
        "Instalacija se ne mo",
        "SetBkMode",
        "This PC can",
        "Vi gj",
        "Diegiant ",
        " asennus uudelleen.",
        "e rozpocz",
        "emy zainstalowa",
        "Priprema se %d%%",
        "etko sa odstr",
        "n de Windows 10<Tu PC se reiniciar",
        "tor alebo sa zobrazia po spusten",
        "4$4,4;4",
        "tfen bit kilidi anahtar",
        "ReleaseSemaphore",
        "9Q9a9q9",
        "CSetupResponseTemplate<class ICompatActionResponse>::OnSuspend",
        "D6}XA",
        "enite namestitev.",
        "espace disque n",
        "ych znak",
        "ii-CN",
        "2!242t2",
        "ro-RO",
        " nytt.,Windows 10 er ikke klar for denne PC-en enn",
        "lidos",
        "asz zgod",
        "Salvestusruumi kasutamine\\Muude suurte ",
        "ResetEvent",
        "na je usun",
        "qps-ploc",
        "Windows Server 2019 ",
        "cie aktualiz",
        "iunile recomandate pentru acest PC",
        "ReleaseSRWLockExclusive",
        "Software\\Microsoft\\Windows NT\\CurrentVersion",
        "nda ask",
        "lectionnez une des options suivantes pour continuer.",
        "bs-Latn-BA",
        "0-Nk0OUL",
        "v, amikor ",
        "Edenemine: %1!d!%%2J",
        "O(uW0f0O0`0U0D0",
        "e aktu",
        "(Les tirets sont ajout",
        "su PC dators ir gatavs turpin",
        "3%323?3L3Y3f3s3",
        "Vi har uppt",
        "Installasjonen kan ikke fortsette fordi datamaskinen ikke kan startes p",
        " 350 MB miesta. Uvo",
        "BSe preg",
        "Kan ikke bruke overf",
        "(Uslovi licenciranja za Microsoft softver0Izjava o privatnosti operativnog sistema Windows",
        "en Sie Ihre Dateien, bevor Sie starten.CBitte warten Sie, bis die Deinstallation der App abgeschlossen ist.",
        "9i;u;",
        "000@@@@@@@@@   ",
        "Ikke akkurat n",
        "Enter Product key",
        "Oppdater stasjonsliste",
        ">4>L>d>|>",
        "Vi vet ikke helt hva som skjedde, men vi kunne ikke kj",
        "Euh_YS",
        "o funcionou. Verifique-a e tente novamente, ou use outra chave.?A chave do bitlocker funcionou! Continue quando estiver pronto.",
        "ger at bruge, er krypteret med BitLocker. V",
        "klemeye ba",
        " klaviat",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::Execute",
        "XX,abr",
        "Namestitve ni mogo",
        "en in aktiviran, lahko ta korak presko",
        "iliz ama bu arac",
        "Sc0_0",
        "U}U0'",
        ";\"<6<@<O<",
        "soudre le probl",
        "o consegue determinar a vers",
        "una benziyor: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX<Bit kilidi anahtar",
        " fall Windows automatiskt n",
        "0Ich installiere Windows 10 erneut auf diesem PC./Ich muss einen Windows 10-Product Key erwerben.",
        "<:=A=M=`=k=z=",
        "a za skupino %d ni veljavna, vnesite pravi klju",
        "r til download af den nyeste version af Windows 10",
        "- Windows 7 ",
        "ynnistett",
        "ivitet",
        "SelectMediaFormat",
        "Verificando seu PC",
        "|~sss",
        "nacak ve Windows 10'da oturum a",
        "lj den partition som du vill installera Windows p",
        ", fungova",
        "4$5@5`5",
        "CREATE_REGISTRY",
        "o acess",
        "teva momente",
        "s ohjeet seuraavia toimia varten. T",
        "e datoteke pa bo mogo",
        "zh-HK",
        "&Forts",
        "cente de Windows 10.",
        "0h0M0k0OUL",
        "yor0Bu se",
        "a el DVD o en el recibo enviado por correo electr",
        "LoadCursorW",
        "gu, p",
        "thatja a list",
        "ete ji pros",
        " %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml, lai nov",
        "Zainstaluj system Windows 10",
        "de limpar os arquivos de instala",
        "gtelen f",
        "m opcij",
        " Microsoft Corporation. Wszelkie prawa zastrze",
        "sst&wwx",
        " soubory pro Windows 10. M",
        "Licencijos s",
        "letim Sistemi:",
        "pia ativada do Windows 7 ou do Windows 8.1 instalada no PC. Ative a sua vers",
        "ny! Stiskn",
        " diagnostikos patarimai",
        "Ava Salvestuss",
        " jour de Windows Server, visitez le site",
        "Last ned#Zachowaj pliki osobiste i aplikacje4Zachowaj ustawienia systemu Windows i pliki osobiste",
        "unalnik smo povrnili v stanje, v katerem je bil, preden ste za",
        "ovat, mus",
        "rsager:",
        "%1!ld!%% abgeschlossen",
        "4C4~4",
        "ivitage installimise j",
        "nji ure",
        "?*?7?Z?g?",
        "ResumeThread",
        "Lecteurs amovibles",
        "91:S:f:|:",
        "li, lai atv",
        " olevaa Windows-versiota. Windows 10:n asennus ep",
        "a dos mesmos agora e guarde noutra localiza",
        " sa ako spr",
        " do systemu Windows 10. Aby chroni",
        "o do Windows 10 no Windows Update.YA configurar atualiza",
        "s escribir la clave de producto de Windows 10 o salir del programa de instalaci",
        "e stvari zahtevaju va",
        " fortsette.",
        "I9/.]",
        "bNXYYUUUSnbt",
        " https://aka.ms/windowsserverupgradey",
        " instalando uma edi",
        "o instaladas, mas a Instala",
        "Nem lehets",
        "t wird nicht neu formatiert, und Sie k",
        "r visas detta?",
        "steemi Windows 10 k",
        "des p",
        "essayer.\"Windows n'est pas activ",
        "k vietas7Ir nepiecie",
        "Logg p",
        ".4Vykdomi preinstall.cmd visuotinio diegimo scenarijai3Vykdomi precommit.cmd visuotinio diegimo scenarijai1Vykdomi failure.cmd visuotinio diegimo scenarijai",
        "ti a Windows 10-et, akkor nem sz",
        "GetWindowRect",
        "\"Otvori",
        "Installi Windows Server 2019",
        "TOtvaranje fascikle ",
        "lreiz palaidiet iestat",
        "bin-NG",
        " failure.cmd",
        "n Windows Server 2019:",
        "ky sa pridaj",
        "Atualizar este computador agora",
        "kas atsitikoINor",
        "Termos de licen",
        "imlendirmez ve y",
        "cnico.",
        "ram, USB atsl",
        "Bruk gamle installasjonsfiler",
        "ei care se aplic",
        " direktorij",
        " utilizez ",
        "BZZZYXXYNZqe",
        "' Mx9$",
        "hRemova a unidade externa seguinte e clique em OK para reiniciar e terminar a instala",
        "en kan k",
        " no diret",
        "om kroku v",
        "@.rsrc",
        "koma naujinim",
        "mu Windows Server 2019. Zkuste spustit instala",
        "lt tilkobling, m",
        "boru na DVD disk",
        "ndret eller fjernet. Windows 10 opdateres automatisk i supportperioden. Support kan variere alt efter enhed.",
        "Skatiet zem",
        "Selecione uma unidade flash USB",
        "stupn",
        "La cl",
        "rja manu",
        "yNepovedlo se n",
        "Neponecha",
        "venlik iyile",
        "menia a licen",
        "ajke preina",
        "Windows Setup will go online to get updates, drivers and optional features. These updates will help the installation go smoothly, and can include important fixes, updated device drivers and additional files which are not on the installation media.",
        "Preme",
        ".!Windows ",
        "adowa",
        "o instalar estas atualiza",
        "yor: %%%d",
        "ite program ",
        " %1!s!.",
        "&Kesik ",
        "movej jednotky.",
        " informace, kter",
        "re sikker p",
        "&Natrag",
        "%% termin",
        "ObakVa",
        "Segoe UI",
        "=A=j=y=",
        "1 caracter r",
        "page=SettingsPageStorageSenseStorageOverview&target=SystemSettings_StorageSense_SystemDrive&invoke=true",
        "kn-IN",
        "gikasti avamine nurjus. Avage oma pr",
        "A`Ph(N",
        "tivte pros",
        "ati dostop do interneta. ",
        "e da potraje.",
        "n del dispositivo.",
        "ifra izgleda sli",
        "cuter le programme d",
        "CSetupUIManager: Showing error message",
        "tre se fermera automatiquement dans %1!d! minutes.+Informations ",
        "This may take a few minutes.sWe weren",
        "Vill du avsluta?",
        "tuves lietojumu. L",
        ". Wenn der Download ",
        "m na Aktualizovat ho odstra",
        "toru sa nepodarilo vy",
        "tre kell hoznia a telep",
        "t install Windows 10XWe",
        "0N0c0",
        " chcete skon",
        " (%2!s!)qTa bort filer som du inte l",
        " %d du groupe n",
        "iului de stocare, pentru a elimina alte elemente mari.&Selectare dispozitiv de stocare extern",
        "vojiet vietu un p",
        "vGdvegG",
        "n. Poista vaihtoehto luettelosta napsauttamalla P",
        "k0j0c0_0",
        "rene, avsluttes installasjonen.kVi trenger minst 350 MB plass for ",
        " Windows Update.L",
        "Bu bilgisayar",
        "eba ud",
        "1 1Y1c1",
        "d Product Key@In",
        " flash USB ",
        "Juridisch",
        " uudelleen.",
        "e instalujete jinou edici Windows, ne",
        "ring for Windows",
        "GetModuleFileNameA",
        "Aceasta poate dura ceva timp.aSe configureaz",
        "Instalarea nu accept",
        " pronto para o computador. Feche a Instala",
        "ionat. ",
        "Seuraavat asiat tarvitsevat huomiotasi",
        " versijos kalbos arba leidimo.",
        "DebugBreak",
        "kkel for Windows 10.",
        "terminer quelle est la version de Windows en cours d",
        "c'`n0",
        "Nck(W",
        "Instaliranje izdanja Windows 10ARa",
        " Windows 10. Pour prot",
        "m Windows zaktivujeme automaticky.",
        " funkcij",
        "iskaWManu",
        "gido externa, para estender temporariamente seu disco r",
        "renginio ir baigus diegti galite j",
        "zh-TW",
        "lisan az ISO-f",
        " Windows.P",
        "BitLocker-beveiliging wordt onderbroken tijdens deze update en wordt hervat wanneer u zich aanmeldt bij Windows Server 2019. Voor optimale beveiliging van uw gegevens kunt u het beste bij de pc blijven totdat u zich weer aanmeldt.)Windows Server 2019 is niet ge",
        " henkil",
        "Progres: %1!d!%%=Selecta",
        "res fonctionnalit",
        "n timp ce se instaleaz",
        " systemu Windows",
        "nda yaln",
        " Windows 10'",
        " komutunu ",
        "G89 PJ",
        "li sada",
        "fgQ.3",
        ".?AV?$CZeroInit@VCSetupResponsSelectWebDownloadImage@@$00@@",
        "m, kas notika, bet nevaram palaist ",
        "GdKh4)",
        "o do Windows Server 2019 no Windows Update.",
        "Ispravke su primenjene",
        "avate koristiti ",
        "2$2>2L2",
        "re den nyeste versjonen for ",
        "%s nen",
        "OOOrM&",
        "ADD_UNATTEND",
        ".?AV?$CZeroInit@VCSetupDiskSpaceDlpResponse@@$00@@",
        "o consegue atualizar o PCkO idioma ou edi",
        "Ako nastavite bez aktivacije trenuta",
        "tenjem PC-ja.",
        "ivitt",
        "%d tecken kvar",
        "i instalaci Windows do",
        ": XXXXX-XXXXX-XXXXX-XXXXX-XXXXX:",
        "Epn&}",
        "ks nevar atjaunin",
        "No se pueden instalar las caracter",
        "es, controladores e funcionalidades opcionais",
        "zben.",
        "sok let",
        "essayez.",
        "Vnesite klju",
        "terse de pe unitatea de sistem.",
        "%d karakter maradt",
        "Izberite particijo, na katero ",
        "%1!d!%%",
        "  &Chc",
        "Controllo del PC",
        "emt k",
        "ar-BH",
        "kkulcsot a Windows DVD-j",
        "i de acord.",
        "lectronique de re",
        "%s GB~Nevaram noteikt, vai j",
        "ka utrymmet medan uppdateringarna installeras. Windows kommer inte att formatera om din externa lagringsenhet och du kan ta ut den n",
        "van av Windows 10 konfigureras din dator f",
        "hemmin.",
        "Izbor disk jedinice,Instalacija se bri",
        "3!303F3U3q3x3",
        "ISO datoteka(Odaberite USB izbrisivi memorijski pogonpDatoteke s USB pogona ",
        " program p",
        "stroj na vytv",
        "Palikti tik asmeninius failus",
        "Velg en bane",
        "|Pokud chcete nainstalovat Windows 10 na jin",
        "n de uso medido, comprueba si esto provocar",
        "\\*g(Wdk",
        "ra neatitinka",
        "Laajenna kiintolevy",
        " oldalt: %1!s!",
        "e da utvrdi koju verziju operativnog sistema Windows koristite.",
        "Se nedenfor, hvis du gerne vil vide hvorfor.",
        "ter restante.A chave de produto cont",
        "InitCommonControlsEx",
        "lasztott, mint amelyet jelenleg haszn",
        "GB, aproximadamente. Si usas una conexi",
        " pliki z dysku systemowego.",
        "CInstallUI::ShowErrorMessage: Posted MSG_INSTALLUI_SWITCH_TO_ERROR_PAGE",
        "{#S]]}yyYYY)+",
        "Cannot find Windows installation files. Please insert your Windows installation media and then run ",
        " precommit.cmd/",
        "~VWV~PPHn",
        "&Chiudi",
        "Invalid Dialog ID'We couldn",
        "0j0W0",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "JVypr",
        "lg det billede, du vil installere.",
        "shez a Windows Server 2019 telep",
        "Escolha o que voc",
        "Per continuare l'installazione e mantenere le impostazioni di Windows, i file personali e le app, ",
        "it-CH",
        "fr-LU",
        "sit pirmo reizi (vai instal",
        "lida! Continue quando estiver preparado.",
        "ytynyt.",
        "0!0(0C0w0",
        "*==}zz",
        "Forbereder installasjon ",
        "nda %2!s! i",
        "Edition",
        "n y mantener la configuraci",
        "es-ES",
        "on dont le programme d",
        "3 34383P3T3X3\\3`3d3h3l3p3",
        "n %1!d! Gt. Valitse toinen muistitikku.",
        "Vous ne pouvez pas conserver vos fichiers, applications et param",
        "o6A instala",
        "FindResourceExW",
        "tt mentse ",
        ".9Windows 10 ",
        "3\"323B3R3b3r3",
        "sait.@Be",
        "limo duomen",
        " asennuksen jatkamisen. Yrit",
        "<r=y=",
        "t vismaz %1!d! GB.",
        "kaznickou podporu a uve",
        "r att k",
        "n est",
        "0A szem",
        "Sigurno ",
        "t.fPo",
        " a ser fechada(Este processo pode levar alguns minutos.cN",
        "Aggiorna elenco di unit",
        "%1!ld!",
        "?P?k?",
        " laste ned de siste installasjonsfilene.",
        "lteni a nyelvi er",
        " essere di oltre 4 GB (pu",
        " Windows 106",
        "ce rozwi",
        "tavad programmid ja taask",
        " dispon",
        "priebeh",
        "o atual do Windows poder",
        "T*PRG",
        "Stiahnu",
        "CSetupResponseTemplate<class ICompatActionResponse>::ExecuteRoutine",
        " a tentar utilizar est",
        " limpiando antes de cerrar",
        "in hen",
        "emo vas kada budemo gotovi i ",
        "3Windows Server 2019 er ikke klar til denne pc endnu",
        "s salir de la instalaci",
        "tim c",
        "Gauti",
        "ke mo",
        "495j5q5x5",
        "cessaires. Assurez-vous d",
        "ifru proizvoda",
        " flash USB, DVD, ",
        "e pokra",
        "nia, ale s",
        "re warto wiedzie",
        "3uW03",
        "tirildiyse ve yeniden y",
        "Veuillez patienter",
        "lg kun denne udgave, hvis du installerer Windows p",
        "rskendusi pole saadaval",
        "Tallennustilan k",
        "ka bir bilgisayar i",
        "anja na PC-ju zbog pomanjkanja prostora na disku. Slijedite upute u nastavku da biste dovr",
        "lat r",
        "&Pokra",
        "181C1",
        "cnica; es posible que la asistencia t",
        "ei, asisten",
        "r diesen PC noch nicht bereit.",
        "a pu d",
        "1 tegn tilbage%Produktn",
        "Usar as op",
        " de Windows 7 sau Windows 8.1 instalat",
        "<0=?=r=",
        "Las actualizaciones est",
        "lo je do problema u izvr",
        "ndirmeleri A",
        "ljande alternativ.",
        "Preuzmite najnoviju verzijujDostupna je i novija verzija tog alata. Da biste nastavili, morate preuzeti i pokrenuti najnoviju verziju.,Preuzmite a",
        "10 est automatiquement mis ",
        " Windows Server 20193",
        "Estas actualizaciones ayudar",
        " dysku flash USB.",
        "anas programma nepie",
        "Ugyldige kommandolinjeparametre",
        "mtade filer=Ta bort stora eller oanv",
        "o do Windows 10[Falha ao abrir o uso do armazenamento. Abra manualmente seu Armazenamento em Configura",
        "Installer Windows 10",
        "Instaliraj %s?Windows ponovno pokre",
        "0c0f0",
        "d chyby: 0x%x]=Pri in",
        "cie nenain",
        "nce temizleniyor",
        "rz Kosz r",
        " loca",
        "cznie folder Pobrane.iNie mo",
        "141B1T1",
        " Microsoft'",
        "Pasirinkite kalb",
        "#Installationsprogram f",
        "cii, ktor",
        "in bu konuyla ilgilenirken bir sorunla kar",
        "mden farkl",
        "in ve yeniden deneyin.JDaha sonra, %2!c!: s",
        "padne sa pok",
        "iadne aktualiz",
        "%d%% klart",
        "zda devam edecek. Bilgilerinizi korumak i",
        "- Windows 8.1. ",
        "rbaude'Izv",
        "oikeusehdot, asennus lopetetaan.]Asennuksen suorittamiseen tarvitaan v",
        " %1!d!%%H",
        "ServerEnterprise",
        "t. preostalih znakov: %d",
        " https://aka.ms/windowsserverupgrade",
        "o a efetuar uma instala",
        "ppp```PPP",
        "Kontrollerer PCen+Kontrollerer om du er klar for installasjon",
        "No estamos seguros de lo que sucedi",
        "invalid map/set<T> iterator",
        "ZNustat",
        "ti sisaldab ainult 48 m",
        "8Klarg",
        "jraindul",
        "Wersja",
        "tGNous allons continuer l",
        " uudelleen.=Seuraavaksi autamme sinua vapauttamaan %1!s! %2!c!:-asemassa.~Si vous voulez installer Windows 10 dans une autre partition, vous devez cr",
        "ServerWeb",
        "rlopp",
        "i ceea ce vre",
        "mu programu se nepovedlo inicializovat pracovn",
        "Kontrollerer din overf",
        "dzu, aizveriet uzst",
        "a grupe %d nije va",
        "Asisten",
        " kaydedin ve kapat",
        "t tell which version of Windows you",
        "Kui Windows 10 on sellesse arvutisse varem juba installitud ja siin aktiveeritud ning te installite seda uuesti, v",
        " Windows Server 2019)",
        "ne-NP",
        "en&de",
        "L'aggiornamento gratuito a Windows 10 ",
        " w fazie %1!s! ",
        " hvilken versjon av Windows du kj",
        "=\\>c>",
        "nya van telep",
        "n no pudo borrar los archivos de instalaci",
        "Instalator przeprowadza oczyszczanie przed zamkni",
        "ciju.",
        "CSetupResponsePageDiskSpaceReq::OnOpenDownloadsClicked",
        " jedanput.",
        " z pomoc",
        "t ieg",
        "nky pro software spole",
        "A verificar esta chave3Esta chave n",
        "diu.zNevieme ur",
        "ProductName",
        ".?AVCSetupDiskSpaceDlpResponse@@",
        "k igen eller prova med en annan.1Produktnyckeln fungerar! Forts",
        "rbaude%",
        "Microsoft YaHei UI",
        "i poate fi necesar s",
        "ket for eller versjonen av Windows-operativsystemet som er installert p",
        "Ela se parece com: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX9Para continuar a instala",
        "fa-IR",
        " stai installando un'edizione di Windows diversa da quella in uso.",
        "Estamos fazendo alguns preparativos",
        "KPara instalar Windows 10, haz clic en Setup.exe en el medio de instalaci",
        "i iz postavljanja, aktivirati Windows i tada ponovno pokrenuti postavljanje. ",
        "CSetupResponsePageSysReq::UpdateView",
        "Turi b",
        "(&R)?",
        "vPogon koji poku",
        "ffnet werden. F",
        "WQuesto codice Product Key non funziona. Prova un codice diverso o acquistane uno nuovo.$Installazione di Windows 10 in corsoDDevo riavviare il PC pi",
        "identificateur : 7Windows a besoin d'espace pour effectuer la mise ",
        "s antes de que puedas actualizar. Te avisaremos cuando hayamos finalizado y te diremos qu",
        "re nale",
        "Estamos teniendo problemas para determinar si tu equipo puede ejecutar Windows Server 2019. Cierra el programa de instalaci",
        " %2!c!:)Q",
        "IDATX",
        "\"ZG{*oK",
        "installer certaines fonctions et langues facultatives.",
        "r klart<Vi forts",
        "%d carateres restantes/Os travess",
        "66<<6:::91e",
        " preinstall.cmd.L",
        "m papperskorgen om du vill ta bort borttagna filer fr",
        "injanja",
        "line m",
        "la na neo",
        "rego pr",
        "Meil on vaja rohkem ruumi$%1!d!GB vaba kettaruumi vaja (%2!s!)rEemaldage failid, mida te enam ei vaja, v",
        "installation, activer Windows puis recommencer l",
        "Bitlocker-kulcs",
        " ustawieniami systemu Windows.EUstawienia i aplikacje zostan",
        "chten, ist nicht gen",
        "d: 0x%x].A Windows telep",
        "Atualizar lista de unidades!Tem de ter, pelo menos, %1!d! GB.",
        "s ejecutando Windows 10.",
        " system Windows 10. Zamknij Instalatora i pon",
        "Vi vet ikke om PC-en er klar til at installasjonen av Windows Server 2019 kan fortsette. Pr",
        "Windowsi installiprogramm loob v",
        "%3!s!,Restartuje se instala",
        "stroj spustit znovu./P",
        "WilStaging_02",
        "iziet no iestat",
        " datorn. Aktivera din version av Windows med en produktnyckel och v",
        "0$0@0P0X0\\0`0d0h0l0p0t0x0|0",
        "Last ned den nyeste versjonensEn nyere versjon av dette verkt",
        "bt online.",
        "vel executar esta ferramenta em seu computador. Se voc",
        "o para executar a configura",
        "Windows 10 telep",
        ">5>D>T>a>n>{>",
        "De productcode staat op de verpakking van de dvd of in een ontvangstbevestiging per e-mail. Wanneer uw pc met internet is verbonden, wordt Windows voor u geactiveerd. ",
        "kW0f0J0O0k0o0",
        "10 suite ",
        " nytt.7Det oppsto et problem under nedlasting av enkelte filer",
        "rankis nepalaiko ",
        "ksy komentoriviargumentteja. Lis",
        "paration de l'installation",
        "sst/xxy",
        "es-DO",
        " Microsoft Corporation. Alle Rechte vorbehalten.",
        "~Es kann etwas dauern, bis festgestellt wurde, ob die Komponenten, die Sie beibehalten m",
        " pronto para este PC%Garantir que a instala",
        "Create installation media (USB flash drive, DVD or ISO file) for another PC",
        ", SD-",
        "lassza ezt a kiad",
        "nosti aktualizace?",
        "ujte v instalaci spu",
        "tu. Niekt",
        "charge pas compl",
        " Windows a osobn",
        "ba nav der",
        " jednotky.",
        "Ajuda",
        " Windows Server 2019#",
        "ava nastavak instalacije. Pregledajte informacije o tome u datoteci %1!s!\\$windows.~bt\\sources\\panther\\ScanResult.xml i ponovo pokrenite instalacioni program.rZa vi",
        "tfMegjelent az eszk",
        "]:N`O",
        "0? $A0",
        " de produit (Product Key) entr",
        "cuter Windows 10. Veuillez fermer le programme d",
        "Angiv produktn",
        "veskite kit",
        "parationQCe point a d",
        "RvQ-N",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::ExecuteRoutine",
        "i din spa",
        "Si vas a actualizar desde Windows 7 o Windows 8.1., o est",
        "gend Speicherplatz verf",
        "ms-settings:storagesense",
        "=R=c=",
        "dom Product Key, nie je k dispoz",
        " Microsoft Corporation. V",
        "k igen.5H",
        "letmek i",
        "Notiek gatavo",
        " S modunda ",
        "n.{No es posible determinar si el equipo est",
        "en-CA",
        "it podporovan",
        "- USB ",
        "cii a zachova",
        "o do Windows Server 2019 precisa ser reiniciada para que elas funcionem. Depois de reiniciar, vamos continuar de onde paramos.7Este computador n",
        "Windows nije aktiviran na ovome PC-ju. To zna",
        "lo je do problema pri kreiranju medija",
        "GFFF|x",
        "TerminateProcess",
        "tirme ayarlar",
        "Kontrolujeme, jestli je v",
        "2-2F2O2",
        "r installationsprogrammet. Du kan ocks",
        "gu.DJ",
        "ajte ponovo.",
        "teni a Windows 10-et (vagy a kor",
        "ros; dalis esam",
        "ltiges Zeichen.",
        "10 herunterladen",
        "isko!Nechcem pou",
        "To lahko traja nekaj minut.UPriklju",
        "dzu, ievadiet pareizo atsl",
        " se aplice tarife de acces internet. Face",
        "Produktnyckel",
        "Questo download in background pu",
        "r steget. Vi aktiverar i s",
        "9-:H:c:q:",
        "rjon, am",
        "CSetupResponseTemplate<class IDiskSpaceActionResponse>::ExecuteRoutine: Cancel button clicked.",
        "Il nous reste quelques t",
        "uriranja#Provjera ima li a",
        "Er sieht ungef",
        " aflarea motivului, vede",
        "Ochrona funkcj",
        " frigj",
        "uje se, jestli je na po",
        "Jis atrodo ma",
        "du: 0x%x]8Instalacja systemu Windows napotka",
        "RichEdit20W",
        "Het USB-flashstation is klaar",
        " galim",
        "chargement.",
        "n de Windows y ejecuta ",
        "terminer si l",
        "nik, aby przeprowadzi",
        "gn-PY",
        "ver k",
        "ntalo de nuevo.5Se produjo un problema al descargar algunos archivos.",
        " utiliser votre PC.P",
        "We need more space,%1!d!GB of free disk space needed on (%2!s!)YRemove files you no longer need or use Disk Cleanup to free up space, and then try again.*There was a problem downloading some files",
        ". Ja neinstal",
        "kleyemedi$Kurulum ",
        "9 9,989D9P9\\9h9t9",
        "Diegti ",
        "es.;Falha ao abrir a reciclagem. Abra manualmente a reciclagem.fFalha ao abrir a utiliza",
        "Przeczytaj ten tekst, aby wiedzie",
        "I file di installazione di Windows 10 che stai usando non sono i pi",
        "PPP@@@@@@@@@@@@@@@PPP",
        " pradedant naujinim",
        "Windows Kurulumu; g",
        "o para voltar a tentar.gA Configura",
        "m syst",
        "t jaun",
        " sincope ",
        ".Lang.ini",
        "Zakaj je to prikazano?",
        "r produktnyckeln fungerade inte. Skriv in nyckeln som du har k",
        "n continuare PC-ul.",
        "terminer si votre ordinateur peut ex",
        " recente per continuare.<Scarica lo strumento per la creazione di supporti aggiornato",
        "Ez eltarthat n",
        "ska aktualiz",
        "Windows 10'a ",
        "\\.znR",
        "dziet datoru",
        "site pasireng",
        "Obteniendo actualizaciones Estamos preparando algunas cosas",
        "n nincs el",
        "Deschide",
        "Abrir Descargas(Abrir la configuraci",
        "Selle v",
        " zadat argumenty p",
        "PrepararNYa solucionaste el problema. Haz clic en Actualizar para quitarlo de la lista.lNos encontramos con un problema al intentar solucionarlo por usted. Actualiza la lista e int",
        "Actualiza&r",
        "2$2>2d2",
        "i informa",
        "n de unidad",
        "installe Windows 10 sur ce PC..Je dois acheter une cl",
        "~/VVhG",
        "A chave do produto (Product Key) deve estar na caixa do DVD ou no email de recebimento. Quando voc",
        "Die Updates wurden installiert. Damit sie verwendet werden k",
        "ite ga u nastavku.",
        " kompiuteryje ",
        "o do Windows diferente da que est",
        "@'*'%#",
        "s instal",
        " tietokonettasi Windowsin asentamisen aikana. Tallenna ty",
        "0k0o0Bf",
        " login",
        " se aplikace ",
        " precommit.cmd)",
        "o do Windows. Insira a m",
        "emo vam Windows.",
        "m lisans s",
        "lanacak. Bu g",
        "n, iniciar el programa de instalaci",
        "ia verzia tohto n",
        "seinek m",
        "%d%% terminat",
        "Isso levar",
        "MapDialogRect",
        "anas programmu un m",
        "e syst",
        "emiau arba i",
        "&Cancel",
        "vat.FInstalace se nepovedla ve f",
        " grund av f",
        " izdelka ima le 48 znakov.>Vrednost klju",
        "%2!s!+",
        "tor cu aceasta: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXC",
        ".Transferir a vers",
        "ita s funkcijo BitLocker bo med posodabljanjem za",
        " bit locker ",
        "Ako je Windows 10 bio ranije instaliran i aktiviran na ovom PC-ju i ponovno ga instalirate, presko",
        "pet. A kezd",
        "irili tvrdi disk dok se a",
        "ljuda?",
        "rbDu m",
        "ra. Pr",
        "ciou a m",
        "a DVD diska. Ru",
        " aktualizacj",
        "###'#",
        "0S0h0L0g0M0~0[0",
        "%hs: Registry value 'CSDBuildNumber' is not the correct type (REG_SZ).",
        "im stavkama.",
        "rtrauc",
        "0F0h0W0f0D0",
        "Rien*Vous pourrez g",
        "NW0~0W0_0+",
        "jljait ",
        "ll automatically activate Windows after installation is complete.",
        " PC-en p",
        "ni v pokra",
        "uriranje na Windows 10 dostupno je samo ako na PC-ju imate instaliran aktiviran primjerak sustava Windows 7 ili Windows 8.1. Aktivirajte trenuta",
        "ISO-fail",
        " DVD naudodami %1!s! rankiniu b",
        "unalniku ni aktiviran. To pomeni, da morate spodaj vnesti klju",
        " du ved, hvad du accepterer.",
        "cie budete musie",
        "solatot egy mapp",
        "rskendatud versiooni allalaadimine",
        "nglig om du har en aktiverad version av Windows 7 eller Windows 8.1 installerad p",
        "Aanmelden als beheerderdAls u dit hulpprogramma wilt gebruiken, moet u zich aanmelden bij Windows met een beheerdersaccount.0U moet het ISO-bestand later op een dvd branden.",
        "I_RpcMapWin32Status",
        "nvalvojanagJotta voit k",
        "ie atjaunin",
        " olet yhteydess",
        "Het is niet duidelijk wat er is gebeurd, maar dit hulpprogramma kan niet op uw pc worden uitgevoerd. Als u problemen blijft ondervinden, geeft u de foutcode door aan de klantondersteuning.",
        "Checking your PC",
        ".<Tada pad",
        "Nevieme ur",
        " etichet",
        "r precommit.cmd-distributionsskript#K",
        "avate instalirati stariju verziju sustava Windows.xNa pogonu koji poku",
        "CSetupResponsePageSelectImage::PopulateImageSelectionListItems",
        "anas nedarbosies pareizi, un b",
        "%s ist kein g",
        "2U3e3x3",
        "stroje se objevil probl",
        " hetkell",
        " funkce a jazyky.",
        "4:5K5q5x5L6",
        ";*;<;",
        "Instalacja systemu Windows napotka",
        "Harici Depolama Cihaz",
        "ka bir anahtar deneyin.MBu ",
        "Your files, apps, and settings can't be kept because your current version of Windows might be installed in an unsupported directory or you're trying to install an older version of Windows.kThe drive you",
        "enete ra",
        "obtention de mises ",
        "ra Windows Server 2019. St",
        " probl",
        "m atrast instal",
        "leniem, czy na Twoim komputerze mo",
        ": %1!d!%%!",
        "CSetupResponseTemplate<class ICompatActionResponse>::OnBack",
        "N(Wnx",
        "lg en sti",
        " (Microsoft Corporation). ",
        ">,?>?E?W?^?o?}?",
        "SPC sa vr",
        ":#;^;d;",
        "in ve yeniden deneyin.",
        "Si contin",
        "tte af en af f",
        "ho programu pot",
        ": %1!d!%%#",
        "8.1. ",
        " nouveau vos informations ult",
        "ration peut prendre quelques minutes.KBranchez votre PC pour ne pas d",
        "iamasi atsi",
        " nije uspelo. Ru",
        "li nedostatku m",
        " na v",
        "en Sie Setup, und wiederholen Sie den Vorgang./Windows 10 ist f",
        "ntalo de nuevo o prueba con otra clave.<La clave de Bitlocker funciona. Contin",
        "ierul ISO pe un DVD utiliz",
        "&Annuleren",
        " datamaskinen av",
        " tuoteavain ei toimi t",
        "2u-S}!",
        "Yol se",
        "081604B0",
        "o razli",
        "fr-FR",
        "utilisation du stockage. Veuillez ouvrir manuellement votre espace de stockage dans Param",
        "Malgun Gothic Bold",
        ".tls$",
        "ttes, eller du fors",
        "10 sur cet ordinateur3J",
        "cente de Windows",
        "sRetirez le lecteur externe suivant, puis cliquez sur OK pour red",
        "LoadResource",
        "t, je za",
        ". Windows Server 2019",
        ".?AV?$CZeroInit@VCSetupResponseSelectUsbDrive@@$00@@",
        "Ak sa zauj",
        "t.OZapojte po",
        "lreiz.+Izvieto",
        " buvo ",
        " Bindestreger tilf",
        "ncelle",
        "e to troch",
        " kompiuteryje, nes nepakanka vietos diske. Atlaisvinkite ",
        "ndningWGranska din lagringsanv",
        ".?AVCButton@@",
        "0S0h0L0g0M0~0Y0",
        "mak i",
        "ivanjem je li Windows 10 spreman za va",
        "s facultatives (recommand",
        "535f5",
        "steemi Windows 10 sisse logite. Andmete kaitsmiseks hoidke arvuti enda l",
        "6 6@6L6l6x6",
        "installation ne peut pas d",
        "Continuar a partir do ponto em fiquei",
        " reformatar o seu dispositivo de armazenamento externo e poder",
        "Uso de almacenamientonExplora de forma manual el uso del almacenamiento en configuraci",
        "U hebt oudere installatiebestanden voor Windows 10. U kunt de nieuwste bestanden downloaden, zodat u zeker weet dat u de meest recente versie van Windows 10 installeert.",
        "%0P'!",
        "l vagyunk. A Friss",
        "zellikleri ve dilleri yeniden y",
        "te na USB flash disku, se sma",
        "ekajteADo",
        "iere suplimentare care nu se afl",
        "SetThreadpoolTimer",
        "&Odbijam:Ako odbijete uslove licenciranja, napusti",
        "}9[*-",
        "i programul de instalare.",
        "Gated",
        "0?ceQW0f0K0",
        "[Klaidos kodas: 0x%x])Diegiant ",
        "1 caractere restante=A chave do produto (Product Key) cont",
        "gbar, wenn eine aktivierte Version von Windows 7 oder Windows 8.1 auf dem PC installiert ist. Aktivieren Sie Ihre aktuelle Windows-Version mit einem Product Key, und w",
        "GetSystemWindowsDirectoryW",
        "3\\3n3u3",
        "Se intendi installare Windows 10 nel tuo PC per la prima volta (o installare un'edizione diversa), dovrai avere un codice Product Key di Windows 10.",
        "ite praegu oma arvutit edasi kasutada.",
        "tartovanie po",
        "Liczba pozosta",
        " nauja ",
        "ll need to enter the Windows 10 product key below or exit set-up, activate Windows, then start set-up again.",
        "o usados da pasta Downloads.",
        "Teie USB-m",
        ";(;0;8;@;P;t;|;",
        "d|l|lvVx",
        "is-IS",
        " installasjonsmediet.",
        "avanje.",
        "Pripravuje sa %d%%(Premiest",
        "   ppp",
        " nesk",
        "97:_:",
        "r inte att k",
        "kkel eller lisens for Windows 10 for ",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::GetError",
        "%1!s! %2!s!!Problem beim Erstellen von Medien",
        " klucz produktu systemu Windows 10",
        "tepta",
        ", trebuie s",
        ".?AV?$CUnknownImplT@VCWebbrowserClientSite@@$0A@@@",
        "Nem tarthatja meg f",
        "F`Y6>~",
        "%sCore",
        "Start again from the beginning",
        ".text$mn$00",
        "?4?O?",
        "enjem diska sprostite prostor, nato pa poskusite znova.4Pri prena",
        "pt-PT",
        "das kodu.",
        "rizze, hogy a telep",
        "4D4X4h4o4y4",
        "klemeyi se",
        "20282E2R2W2]2d2r2",
        "m. Instala",
        " preinstall.cmd.1",
        "zzel keresse meg ezeket az elemeket a G",
        "kilo problema",
        "cie pom",
        "n.(Liberar %1!s! del equipo (unidad %2!c!:)]Selecciona o conecta un dispositivo de almacenamiento externo que tenga al menos %1!s! libres",
        " jour. Nous vous indiquerons lorsque nous aurons termin",
        "klendiyse ve etkinle",
        "te nainstalovat si Windows 10 na po",
        "titi podataka, ostanite uz PC do ponovne prijave.#Rezimirajmo, odabrali ste sljede",
        "[9HHGEE8$",
        "Valg af drev",
        "rer distribusjonsskript for precommit.cmd*Kj",
        "e se PC konfigurirati za izvo",
        "jra a telep",
        " go i pon",
        "Liniile se vor ad",
        "kim ra",
        "cZxUR\\",
        "z Windows s",
        "VQPWV",
        " a obnov",
        "zsSGS",
        "Bu anahtar denetleniyorFBu anahtar bu Windows s",
        "Windows installation encountered an unexpected error. Verify that the installation sources are accessible and restart the installation.",
        "\\__C)",
        "enia Windowsu 10. Uvo",
        "r klar.&Kraven ",
        "CSetupUIManager: Rollback Error [0x%X] - Showing rollback message",
        "imu. Pasirinkite ",
        "%s on lubamatu m",
        "ned ettevalmistused",
        "D$X/N",
        " grabar el archivo ISO en un DVD m",
        "Descargas:Quita archivos grandes o sin usar de la carpeta Descargas.",
        "233E3R3",
        "mes.FGrupas %d atsl",
        " varias veces. Esto puede tardar un poco.4Espera mientras se cierra el programa de instalaci",
        "CInstallUI::SetErrorMessageText",
        "&Anterior",
        "glen herunder eller afslutte installationen, aktivere Windows og derefter starte installationen igen.",
        "utujeme, inform",
        "cHIIIYY",
        "mtade filer. ",
        "EnterCriticalSection",
        " prie ",
        "s most ",
        "o de scripts preinstall.cmd.>Houve um problema durante a execu",
        "K6mZP(",
        " ponecha",
        "Windows 10 nije instaliran",
        " PC-en (%2!c!:-stasjonen)CVelg eller koble til en ekstern lagringsenhet med minst %1!s! ledig\"Zewn",
        "Gandr",
        "Lataa Windowsin uusin versio",
        ", kas ir paredz",
        " to resume your installation.",
        "vel executar esta ferramenta no seu PC. Caso continue a sentir problemas, indique o c",
        ". Uvoln",
        "7)707h7o7}7",
        "z kiv",
        "Ievadiet produkta atsl",
        " desteklemiyor. Daha fazla alana ihtiyac",
        "t tell what version of Windows you",
        "CInstallUI::GetCaption",
        "10 un j",
        "in dosyalar",
        "s recientes de Windows 10 en el equipo debido a que el espacio en disco es insuficiente. Libera un poco de espacio a continuaci",
        "%1!d!%% completadofEsta clave de producto no funciona. Compru",
        "klemeye kald",
        "Ne mogu se prona",
        "3+3f3",
        "NtUpdateWnfStateData",
        "Installasjonsprogram for Windows 10",
        "iat instalarea Windows. Reporni",
        "eneklerden birini se",
        "i nevoie de o cheie de produs Windows 10.",
        "jiet pa",
        ".?AVCComboBox@@",
        ":(:,:0:H:L:`:d:h:",
        " activado en este equipo",
        "Nu#3e",
        " scripturile de implementare precommit.cmd2Se execut",
        "lida de Windows 10.",
        "`Poder",
        "==>]>}>",
        "cii fungova",
        "klemeyi ba",
        " bir bilgisayara y",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::SerializeRoutine",
        "No sabemos si tu equipo tiene espacio suficiente para seguir instalando Windows Server 2019. Intenta reiniciar el programa de instalaci",
        "ciju, lai zin",
        "Windows er ikke aktivert p",
        "s lesz konfigur",
        " (%2!s!)",
        "Fkg_[",
        "ker efter uppdateringar\"S",
        "rolnom",
        "&Voltar",
        "ivitys on k",
        " jenom 48 znak",
        "Naujinim",
        "Wybierz dysk flash USBjPliki na dysku USB zostan",
        " en anden placering.",
        "sies autom",
        "LegalCopyright",
        " Windows 10. ",
        "Error launching shell link (GLE = 0x%x)",
        "Nic4B",
        "riista kasutamiseks peate olema Windowsi sisse logitud administraatorikonto abil..ISO-faili peate hiljem DVD-plaadile kirjutama.",
        " Windows Server 2019M",
        "&Manter aplicativos e arquivos pessoais Manter somente arquivos pessoais",
        " deseja fazer?",
        "ilytt",
        "t pour cet ordinateur.7V",
        "r inte redo f",
        "A verificar o seu PC8Estamos a verificar se tem tudo pronto para a instala",
        "ime S. Toto vydanie vyberte len vtedy, ak in",
        "ll keep going from where we left off.%This PC can",
        "jak takto: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX",
        "o de Unidade",
        "The updates are installed, but Windows Server 2019 Setup needs to restart for them to work. After it restarts, we",
        "Particija diska",
        "Baixar-S",
        "6(6,606@6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6",
        ".rdata$zETW1",
        "Descarregar atualiza",
        "8Windows Server 2019 ist f",
        ".?AVCSetupPageRollback@@",
        "Sobimatud k",
        "gghXvvw",
        "Checking this keyFThis key won",
        "N0R|~",
        "ilitatava sisu valimine",
        "Upotreba skladi",
        "re unable to run this tool on your PC. If you continue experiencing problems, reference the error code when contacting customer support.",
        "lteni a legfrissebbeket, hogy biztosan a Windows 10 leg",
        "WWWh\\",
        "Izdanja se ne podudaraju",
        "dziemy kontynuowa",
        " popisek",
        " yaln",
        " Windows.G",
        "0IDATh",
        "[Feilkode: 0x%x]>Det ble oppdaget en uventet feil under Windows-installasjonen.",
        "t work. Re-enter the one that you bought online.",
        " apsauga bus laikinai sustabdyta. J",
        " la version actuelle de Windows sur un r",
        ";^/[?",
        "ni bulamad",
        "2q2x2~2",
        "e biti dodate automatski/Instalacija nije uspela da u",
        "imdi de",
        "CoCreateInstance",
        "leminden ",
        "vot %1!s! disk",
        "espace2Voulez-vous continuer ",
        "v\\Omi",
        " partir de l'endroit o",
        "ppna Papperskorgen",
        "\"Luodaan Windows 10 -tietov",
        "Legal_Policy_Statement",
        "chten Sie mit dieser Auswahl fortfahren?",
        ";3;>;s;",
        "Her nogle ting, du skal huske p",
        "s nyelvet v",
        "\"Virheellinen valintaikkunan tunnus\"K",
        "Comprobando el equipo(Comprobando que est",
        "]shell:Downloads",
        "elite li i dalje da koristite ovaj izbor?",
        "o algumas dicas:",
        "Actualizarea gratuit",
        "m ier",
        "zlOUL",
        "Windows Server 2019 instal",
        "no ovome: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX>Slede",
        "k enn det du bruker n",
        "stroje BitLocker nefunguje. Zkontrolujte ho a zkuste to znovu nebo vyzkou",
        ".?AV?$CZeroInit@VCSetupCompatDlpResponse@@$00@@",
        "Ispravke su instalirane, ali da bi funkcionisale, neophodno je ponovo pokrenuti instalaciju izdanja Windows 10. Nakon toga nastavljamo tamo gde smo stali.1Na ovom ra",
        "0g0\\Omi",
        "8)9X9h9x9",
        "@V instalaci Windows 10 budeme pokra",
        "5TUHUUHHHHHH9%$",
        "Aceast",
        " alte c",
        "lnu verziu Windowsu pomocou k",
        "telek",
        ".'Windows ",
        "Prepara[Hai gi",
        "%d characters left",
        "ila baterija.",
        "ani, ali je v ra",
        " uudelleen..Windowsia ei ole aktivoitu t",
        "cznie.",
        "nnaren. Br",
        "ik kustutatakse (sh failid, rakendused ja s",
        ", turite ",
        " precisar",
        "CInstallUI::ShowPage: Exit is requested. Ignoring ShowPage",
        "ifreqOva ",
        "n.SBitLocker se parece a esto: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX<La clave de BitLocker solo contiene 48 caracteres digitales.",
        "enjem diska da biste oslobodili prostor pa poku",
        "prava",
        "ll have to re-enter your info later.(Setup has failed to apply migration data,Setup has failed to clean up the setup files7Setup has failed to determine supported install choices,Setup has failed to validate the product key8Setup can",
        "344P4_4n4}4",
        " zase tak, jak byl nastaven",
        ": XXXXX-XXXXX-XXXXX-XXXXX-XXXXXHSeuraavat seikat kaipaavat huomiotasi, ennen kuin voit jatkaa asennusta.",
        "%1!s! %2!s!!",
        "t pour votre PC. Veuillez fermer le programme d",
        "Moviendo tu configuraci",
        "Lisans S",
        "lu atlas",
        "re om Windows 10 er klar for PC-en enn",
        "ti, mint amelyet jelenleg haszn",
        "4.5a5o5",
        "istiedosto, jonka haluat asentaa.",
        " v po",
        "marrage du programme d'installation de Windows Server",
        "ie ve",
        "ionale. Aceste actualiz",
        "kkulcs nem megfelel",
        "rification des mises ",
        "my vyskytova",
        "BitLocker-Schl",
        "t asentaa Windowsin vanhemman version.[Valitussa asemassa ei ole tarpeeksi vapaata tilaa. Valitse toinen asema ja yrit",
        " versija gali b",
        "ZksJ)",
        ", bilgisayar",
        "anu uz Windows Server, apmekl",
        "rast taask",
        "Instalar o %sDO Windows est",
        "ti prisijung",
        "elite uporabiti",
        "1;1Y1w1",
        " Ayarlar'dan manuel olarak a",
        ";.;G;",
        "ges telep",
        "CInstallUI::ShowErrorMessage",
        "W0O0`0U0D0",
        "co-FR",
        "iswdigit",
        "o mais recente do Windows 10!Isso pode demorar alguns minutos.uN",
        "riques.",
        "hagwww",
        "kLa v",
        "ruojamas ",
        "Svojih datotek, aplikacij in nastavitev ne morete obdr",
        "sz. M",
        "8'8-82898P8z8",
        "Otvori korpu za otpatke",
        "uvvf:",
        "ice sistema Windows, boste morali kupiti klju",
        "Pravne napomene",
        "lo k neo",
        "nite %1!s! vo svojom PC (jednotka %2!c!:)PVyberte alebo pripojte extern",
        "e uporabljate",
        "Jezik:",
        "odo de soporte; el soporte puede variar en funci",
        "%1!s! %2!s!*Hiba t",
        "Vyberte obraz, ktor",
        " nouveau.8Un probl",
        ".,Windows 10",
        "trukti kelias minutes.",
        "D(SSS",
        " skal g",
        "ver det h",
        "50HkP",
        "sek megk",
        "Instalando Windows Server 2019",
        " roskakorin voit poistaa j",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IActivationActionResponse> > > >::GetResponseId",
        " preinstall.cmd ",
        "1Conserver les fichiers personnels et applications,Conserver uniquement les fichiers personnels",
        " ali kupite novega.",
        "Windows 10:n asennus",
        "mu Windows odstr",
        "daug taip: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXQKad gal",
        "e biti ve",
        "ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp",
        "s alkalmaz",
        " che stai tentando di usare ",
        "USB-flashminne",
        ". Veuillez la v",
        "CInstallUI::CreateSplashUI",
        "<%<A<z<",
        " Windows 10 v tomto PC1Potrebujem zak",
        "marrez l",
        "rer %1!s! sur votre PC (lecteur %2!c!:)ZS",
        "sit citu izdevumu), b",
        "ti ei sobinud. Proovige m",
        "iau ir j",
        "no preglejte, kako je uporabljen prostor za shranjevanje, da odstranite druge velike elemente.(Izberite zunanjo napravo za shranjevanje",
        "<Windows Server 2019 nie je e",
        "irties), k",
        "Modifica",
        "0x%1!lX! - 0x%2!lX!",
        "d %2!s!",
        "Setup voorbereiden ",
        "> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>",
        "ili..V tomto PC sa ned",
        "O seu PC vai ser reiniciado v",
        " nytt flere ganger. Dette kan ta litt tid.+Vent mens installasjonsprogrammet avsluttes",
        "FVFVF",
        "??0exception@@QAE@ABV0@@Z",
        ".fKonfigurowanie aktualizacji dla systemu Windows 10",
        "nnen wichtige Korrekturen, aktualisierte Ger",
        "Jos jatkat aktivoimatta nykyist",
        "Produktnyckeln ska finnas i f",
        "ete soubory.2Po",
        "rile s-au aplicat",
        "d Product Key pre Windows 10",
        "@@@```",
        "0?c$@0",
        "bit locker ",
        " jour gratuite vers Windows",
        "rge. Veenduge, et installiallikas on ligip",
        " sistem s",
        "0!kk02",
        "kkulcsotXA telep",
        "trukti.XKonfig",
        "gi ar Windows 10.u",
        "\\(W/e",
        "GetModuleFileNameW",
        "udmist eemaldada.(N",
        "Laufwerkliste aktualisieren)Es sind mindestens %1!d! GB erforderlich.",
        "L'installazione di questa edizione di Windows 10 configurer",
        " tohoto n",
        "n continuare probleme, men",
        "n de Windows 10 configurar",
        "CSetupResponseTemplate<class IActivationActionResponse>::ExecuteRoutine: Next button clicked.",
        " nast",
        "tres de mise ",
        "re verkt",
        "sre k",
        "enia zabezpe",
        "0?&$@0",
        "VerifyVersionInfoW",
        ";$;0;@;u;",
        "sekKT",
        "si parancsprogramok futtat",
        "DownloadDiskSpaceReq",
        "ilitada, sest teie Windowsi praegune versioon v",
        "Ten?.7",
        "CInstallUI::ShowPage",
        "ce oprogramowania firmy Microsoft6Zasady zachowania poufno",
        ".?AVexception@@",
        "s crear y, despu",
        "s rakstz",
        "lgende ",
        "shez.",
        "buj u",
        "&Naprej",
        "171T1o1",
        "na geliyor.",
        "l friss",
        "Nem siker",
        "z-N`O",
        "s en start de computer opnieuw op. De installatie van Windows wordt dan automatisch voortgezet.",
        "rebilir.XY",
        "nienia przyczyny.",
        "iu verziu Windowsu 10.",
        " miejsca do kontynuowania instalacji systemu Windows Server 2019. Spr",
        "liviivat lis",
        "' \"$ $ *$'",
        "WfrXq",
        "teva minute.vNu am reu",
        ", nous avons des difficult",
        "6U7v7",
        "(%1!c!:): ",
        "cuter manuellement %1!s! pour ouvrir Nettoyage de disque.",
        ", mihin se j",
        " zewn",
        "*NW[&{",
        "GzzzhhhWW",
        "rket, at du har ",
        "haw-US",
        "line salvesti, millel on v",
        "i proovige m",
        "das kods: 0x%1!lX! - 0x%2!lX!",
        "7'7,7",
        " Windows Update[",
        "latot. Nyissa meg a t",
        "in Kurulum program",
        "nek folytat",
        "Kam j",
        "6E7`7g7m7r7~7",
        "elles fonctionnent. Apr",
        "jumus un personiskos failus Patur",
        "o e podem incluir corre",
        "Narezivanje ISO datoteke na DVD",
        "Windows nije aktiviran na ovom ra",
        "C>_D}]",
        "dition de Windows. Essayez une autre cl",
        "laties uzzin",
        " starte installasjonsprogrammet p",
        "Dledddh",
        "o e tente novamente.6Windows Server 2019 a",
        "eleri kald",
        "Bilgisayar",
        "edky.BInstala",
        "7e7y7",
        "?<?H?h?p?|?",
        "t uzlabot Windows instal",
        "Choisir le m",
        "%%%1!ld! tamamland",
        "0~0g0J0",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpResponse> > > >::DeserializeRoutine",
        "ga darbojas. Turpiniet, kad esat gatavs.",
        "042704B0",
        "cution des scripts de d",
        "&Valmis",
        "Troubleshooting tips",
        "ali za to poskrbeti namesto vas, smo naleteli na te",
        "tres vont ",
        "sitikinkite, kad akumuliatorius diegimo metu nei",
        "PrepararBVoc",
        "SupportedInstallChoices",
        "k igen.wInstallationsprogrammet kunde inte starta installationen av Windows. Starta om installationsprogrammet och f",
        "sr-BA-Latn",
        "in medyay",
        "!-@L7+",
        "letet, ",
        "ekivanu gre",
        "i din nou.*Instalarea Windows Server 2019 nu a reu",
        "Dit zijn een paar dingen waar u rekening mee moet houden:",
        "000h0u0",
        "n o ejecute ",
        "A chave tem este aspeto: XXXXX-XXXXX-XXXXX-XXXXX-XXXXXMPara poder continuar a instala",
        "UpdateMedia",
        "ppp   ",
        ", kur",
        "ovat v instalaci Windows. Restartujte instala",
        "a nieoczekiwany b",
        " funkcie. Tieto aktualiz",
        "e da pokrene Windows 10. Zatvorite instalaciju, a zatim poku",
        "Instalarea acestei edi",
        "ouverture de l",
        " na system Windows 10, aby aktywowa",
        "ifrovania BitLocker obsahuje len 48 ",
        "Setup is cleaning up before it closes",
        "mmern sollten",
        ", ale soubory se zachovaj",
        "W}}=ATT",
        "cego%Nie chc",
        "0g0O0`0U0D0",
        "Izberite, kaj ",
        "le&ri",
        "e sur votre PC. Activez votre version actuelle de Windows ",
        "Windows 10 installimine4Arvuti taask",
        "ciju fail",
        ".?AV?$CDlpErrorImpl@V?$CDlpObjectInternalImpl@V?$CUnknownImpl@VICompatActionResponse@@@@@@@@",
        " continuer l",
        "rkasime, et teil on Windows 10 jaoks vanemad installifailid. Saame aidata teil hankida uusimad failid, et saaksite installida Windows 10 k",
        "ete odpoji",
        "Vydania sa nezhoduj",
        "=G=z=",
        "o chcete urobi",
        "m vedie",
        "hilduvuse kontroll",
        "bu vai, izmantojot komandu uzvedni, instal",
        "l, na kter",
        "vate Windows 10",
        "tkamiseks vajalikku installimisteavet. Uuesti proovimiseks taask",
        "nt elt",
        "060I0T0f0q0",
        "dium Windowsu a spustite s",
        "&Refuser]Si vous refusez les termes du contrat de licence, vous quitterez le programme d",
        "o funcionou. Verifique-a e tente novamente ou experimente uma chave diferente.>Sua chave do produto funciona! Continue quando estiver pronto.",
        "Prenosi?Odstranite velike ali neuporabljene datoteke iz mape",
        " ei voi k",
        "%1!s! %2!s!'Pri vytv",
        " OK for genstarte og fuldf",
        ".?AVCSetupResponsePageDiskSpaceReq@@",
        "0@e$@0",
        "INFORMATIONS SUR L",
        "dia a ser usada",
        "ivanjem je li Windows Server 2019 spreman za va",
        "OYu`O",
        " des ",
        "ju, rad",
        "ARABIC",
        "ate prvi",
        "uriranja su instalirana, ali postavljanje sustava Windows Server 2019 mora se ponovno pokrenuti da bi funkcionirali. Nakon ponovnog pokretanja, nastavit ",
        "5#6{6",
        "d-N~b0R\"u",
        "Scarica la versione pi",
        "pet az elektromos h",
        "https://go.microsoft.com/fwlink/?LinkID=528892",
        "elite namestiti.",
        " bir s",
        "T3Mcg",
        "Pasiruo",
        "cie Windowsu sa po",
        "t ready for this PC yet",
        "CSetupUIManager::OnProgressChanged",
        ".zKe spu",
        "LeaveCriticalSection",
        "rberedPDu har redan fixat det h",
        "nSi quieres instalar Windows 10 en otra partici",
        " kompiuteryje yra pakankamai vietos toliau diegti ",
        "i instalarea Windows Server 2019.?Vom continua s",
        "glen virker! Forts",
        "as disks ir gatavs",
        "e se kad se prijavite u Windows 10. Da biste pridonijeli za",
        "s var",
        "mpinat o eroare nea",
        "Nemoj ni",
        "e razlikovati ovisno o ure",
        "Escolher itens a manter",
        "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9",
        "llningar",
        "ajte s nekim drugim klju",
        "te si nejnov",
        "[Virhekoodi: 0x%x]2Windowsin asennuksessa tapahtui odottamaton virhe.",
        " Windows 10F",
        "ms-BN",
        "ar-IQ",
        "Gebruik de aanbevolen opties voor deze pc",
        ".?AVCRichEditCtrl@@",
        "ppp@@@@@@@@@@@@@@@@@@@@@```",
        "e jste si syst",
        "etka instalacije.(Preduvjeti dovr",
        "Windowsin tietosuojatiedot",
        "m, ne",
        "nstalleerd.",
        "mu, un v",
        "li wszystko jest gotowe, kontynuuj.",
        "teva minute.qNu ve",
        ".,Zwolnij do %1!s! na komputerze (dysk %2!c!:)hWybierz lub pod",
        "l..Nem siker",
        "e zadat k",
        "ves. Ellen",
        " selec",
        " nytt.>N",
        "Les deuxtCette cl",
        "sikkal, vagy v",
        "IsOsPreRS1",
        "in en son s",
        "Selecione a parti",
        "berpr",
        "r datorn",
        "aktiviz",
        "du.CNepavyko atidaryti ",
        "stroj nepodporuje jazyk nebo edici verze Windows, kter",
        "cessitent votre attention pour continuer l",
        "0W0j0D0",
        "t slo",
        "657E7Q7",
        "+hkkCww;",
        "ebuje m",
        "em.>Va",
        " zawiera",
        "8 8$8,8D8H8P8h8x8|8",
        "Notific",
        "hlen Sie ein anderes Laufwerk aus, und versuchen Sie es erneut.UAls n",
        "Nepiecie",
        "CleanInstallChecked",
        "unaru zbog nedostatka prostora na disku. Sledite uputstva u nastavku da biste dovr",
        "Norise: %1!d!%%<Lai turpin",
        "emo vam da oslobodite %1!s! na %2!c!: pogonu.",
        " diegiate pakartotinai, galite praleisti ",
        ".?AV?$CSetupResponseTemplate@VIDlpResponse@@@@",
        "Station selecteren",
        "&Pirmyn",
        "nternet",
        "tres Windows et les fichiers personnels,Conserver uniquement les fichiers personnels",
        "emo instalacijom sustava Windows Server 2019 u servisu Windows Update.",
        "Pripravi",
        "/>$$@0",
        "anje je bilo v fazi %1!s! prekinjeno zaradi napake med operacijo %2!s!",
        "i din nou.#Windows nu este activat pe acest PC",
        "uriranja za Windows 10",
        "jiet un aizveriet failus.BL",
        "stroj nem",
        "Bitlocker klju",
        "Applicable notices and license terms",
        "%2!s!*Teie asutus haldab teie v",
        "moire flash USB",
        "Your files, apps and settings can",
        "tte installationen af Windows Server 2019. Pr",
        "dotEsta chave do produto (Product Key) n",
        "j]Wh(",
        "KillTimer",
        "kWe can",
        " obtenir les derniers fichiers afin que vous ayez la version la plus r",
        "Instalar esta edi",
        " pozornos",
        "Versiot eiv",
        "######'##''",
        "o para o Windows 10",
        "avanje skripti za primenu failure.cmd#Ovo mo",
        "pen.%A telep",
        " kilka minut.}Ten klucz produktu umo",
        "CSetupUIManager: Uninstall requested - No rollback message shown",
        "est disponible que si une version activ",
        "W0O0o0",
        "tuvi!Es nev",
        "ndiga filer. Kontrollera Internetanslutningen och k",
        "uje se sta",
        "CSetupLangIniLoader::Initialize: Failed to get the language information: index = %d.",
        "MediaSetupUIMgr.pdb",
        " disponible en tu idioma y arquitectura actuales.",
        "e de Windows",
        "res restants(Les tirets sont ajout",
        "alinkite nereikalingus failus arba atlaisvinkite vietos naudodami disko valym",
        "Ispravke su instalirane, ali da bi funkcionisale, neophodno je ponovo pokrenuti instalaciju izdanja Windows Server 2019. Nakon toga nastavljamo tamo gde smo stali.:Na ovom ra",
        "SysReq",
        "v en annen n",
        "programok ",
        "es, mais le programme d",
        " 3 GB ",
        "parons quelques ",
        "%SYSTEMDRIVE%\\windows\\system32\\isoburn.exe",
        "Kja;Kka",
        "sime nuo tos vietos, kurioje sustojome.2",
        "100701213655Z",
        " eliminato tutto, inclusi file, app e impostazioni.",
        ".?AV?$CZeroInit@VCSetupResponsePageInstallNowOrLater@@$00@@",
        "ri. Deschide",
        "o SD ou disco r",
        "No pueden conservarse tus archivos, aplicaciones y configuraci",
        "Installimise j",
        "w instalacyjnych systemu Windows. W",
        ">)?A?Q?Y?i?y?",
        "lieties, kas j",
        "Preuzimanje ima oko 3 GB. Ako ste na vezi s ograni",
        "in bir Windows'a y",
        "Ett tegn igjen",
        "d Product Key pro Windows 10.",
        "rsler kunne ikke ",
        "tett Windows nyelv",
        "t timp se ",
        "&:=I?IIHHWD9",
        "  &Pomagati ",
        "re kommandoen ",
        "5%555B5O5\\5i5v5",
        "se ut",
        "api-ms-win-eventing-provider-l1-1-0.dll",
        "Architecture",
        "e prenesti. Preverite, ali imate vzpostavljeno povezavo z internetom, in poskusite znova.*Izvajanje skriptov uvajanja preinstall.cmd)Izvajanje skriptov uvajanja precommit.cmd'Izvajanje skriptov uvajanja failure.cmd",
        "Installationsmedien (USB-Speicherstick, DVD oder ISO-Datei) f",
        "Architecture does not match",
        " USB ",
        "5;5h5",
        " da instala",
        " de produit (Product Key) n",
        "ta BitLocker aizsardz",
        "tuma: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX9A telep",
        " atkursime, kai prisijungsite prie ",
        "dlelf",
        "ni minut.F",
        "e to dovesti do dodatnih tro",
        "klenirken bilgisayar",
        "cie Windows Servera 2019.LBudeme pokra",
        "CInstallUI::OnActionChanged: Posted MSG_INSTALLUI_UPDATE_PROGRESS",
        "Laddar ned Windows 10",
        "i sau conecta",
        "ggs till automatiskt)Det gick inte att l",
        "Hemos detectado que tienes archivos de instalaci",
        "akajte, da se namestitveni program zapre",
        "je a friss",
        "eba, aby se dalo pokra",
        " soubory. Zkontrolujte si p",
        " disponible si tienes una copia activada de Windows 7 o Windows 8.1 instalada en tu PC. Activa tu versi",
        "ou balenia disku DVD alebo ste ho mali z",
        "j dysk flash USB jest gotowy",
        "vCette cl",
        "ration va durer plusieurs minutes.",
        "RW0f0",
        ". Kirjoita verkosta ostamasi tuoteavain uudelleen.",
        "Kreirajte instalacioni medijum (USB fle",
        "%1!ld!%% k",
        "ckligt med ledigt utrymme. V",
        "<'<P<m<",
        "cijas laik",
        " Instalatora ponownie.",
        "Language does not match",
        " nebude da",
        "1#202Y2d2",
        "Non puoi mantenere i file, le app e le impostazioni perch",
        "re telep",
        "Om du forts",
        "{{{}1113\"\"\"$",
        ".?AV?$CSetupResponseTemplate@VIActivationActionResponse@@@@",
        "undan emin de",
        "10 valide.",
        "unar tako da radi u S re",
        "i pe cea cump",
        "iz.'Bu bilgisayar Windows 10",
        "ne da instalira Windows. Ponovo pokrenite instalaciju i probajte ponovo.",
        "PPPPP",
        "yet p",
        "o darb",
        "If you",
        " bilmiyoruz. Kurulumu yeniden ba",
        "n asetuksia: %d %%",
        "%3!s!\"Genstarter Windows 10 Installation",
        "tres.",
        "mas Windows 10 datu nes",
        "bbi f",
        "Elle devrait ressembler ",
        "b en ny.",
        "m 48 caracteres digitais.",
        "Papierkorb ",
        " energia para n",
        "No sabemos si el equipo est",
        "L0K0K0",
        "glen indeholder kun 48 digitale tegn.",
        "rminos de licencia, saldr",
        "ovat, budete se muset pod",
        "Elementele care v",
        "es-UY",
        "0-No0 ",
        "sob, jak",
        "Tk0n0",
        "tu savus Windows iestat",
        "iklik g",
        " Windows versija, iesp",
        "ste re",
        "e se ra",
        "mentaires./Quelles sont les autres options de mise ",
        "CSetupLangIniLoader::Initialize:     Media number      : %d",
        "Nu am salvat informa",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class ICompatActionResponse> > > >::Deserialize",
        "to pozorosti da biste nastavili s instalacijom.ZBitlocker izgleda otprilike ovako: XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX5Klju",
        "XNepavyko atidaryti atsisiuntim",
        "Bitte wartenFBeim Ausf",
        "&Zaakceptuj",
        "`Esta chave do produto (Product Key) n",
        "informations sur la mise ",
        "n, sonra yeniden deneyin.'Baz",
        "Microsoft Windows0",
        "avo. Osve",
        "cii bude potrebn",
        "SqPq*p",
        " minst %1!d! GB.",
        "nseamn",
        "itamiseks. Sulgege installiprogramm ja proovige uuesti.,Windows Server 2019 installimine on nurjunud Windows Server 2019 installimine",
        "st, a telep",
        "sa\"Csak a szem",
        "me est survenu lors de l",
        "rez votre m",
        "n de un medio de Windows 10",
        "e instalacione datoteke=Instalacija nije uspela da odredi podr",
        "ntSA Windows 10 telep",
        " Operating System",
        "rcarea$Alege",
        "m s ur",
        " Windows 10:",
        "o de M",
        "avanja toga umjesto vas. Osvje",
        "teignez pas l",
        "ci, un p",
        "```PPP",
        "Wie m",
        "CSetupResponseTemplate<class IDlpResponse>::ExecuteRoutine: Back button clicked.",
        "Anna tuoteavain",
        "kkelen fungerer ikke. Kontroller den, og pr",
        "uA)E:",
        ", kuru m",
        "CDlpResponseImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDiskSpaceActionResponse> > > >::DeserializeRoutine",
        ".&Vaatimukset on t",
        "yScoate",
        "0L01YWeW0~0W0_0",
        ". Atnaujinkite s",
        "s espacio7%1!d! GB de espacio en disco libre necesario en (%2!s!)oQuita los archivos que ya no necesites o usa Limpieza de disco para liberar espacio y luego int",
        "slic.",
        "252Y2f2",
        "Todo listo>Seguiremos con la instalaci",
        "arhitektura nije odgovaraju",
        "ete da zadr",
        "ppp@@@@@@@@@@@@@@@```",
        "ljaande valimine",
        "bory sa ponechaj",
        "r den, og pr",
        "Selectare imagine",
        "rskendatud seadmedraivereid ja t",
        " sudaro tik 48 skaitmeniniai simboliai.;Grup",
        "fen Sie ihn, und versuchen Sie es noch mal, oder verwenden Sie einen anderen Key.KDieser Product Key funktioniert. Machen Sie weiter, sobald Sie bereit sind.",
        "ci wolnego miejsca na komputerze.Czy chcesz nadal u",
        " dost voln",
        "Mums nepavyko atsi",
        "- Windows 10 ",
        "ionat. Verifica",
        "!nnndG",
        "i Instalarea ",
        "wvVGGw",
        "Nu suntem siguri ce s-a ",
        "USB flash meghajt",
        " funkce se zm",
        " po prihl",
        "V:N`O(W",
        "Downloads>Verwijder grote of ongebruikte bestanden uit de map Downloads.",
        "ho miesta na disku (%2!s!){Odstr",
        " suorittaa ty",
        "vHr,g ",
        "us failus, rad",
        "utiliser est chiffr",
        "``agppq",
        "i aceast",
        " din pga. manglende diskplads. F",
        "4!4'4e4",
        "<;<Q<j<",
        " Windows 10<",
        "ititi svoje podatke, imejte ra",
        "mn-Cyrl",
        "i din nou.'Nu am putut instala Windows Server 2019`Am resetat PC-ul la starea ",
        " tiks ats",
        "Openen1Ik wil in plaats daarvan externe opslag gebruiken$Ik wil geen externe opslag gebruiken",
        "Editions do not match",
        "LocalFree",
        "Si vous installez Windows 10 pour la premi",
        "zerinde %1!s! bo",
        "me probl",
        "INFORMACJE DOTYCZ",
        "ger efter opdateringer!S",
        "Windows gizlilik bildirimi",
        "+Non ",
        "Opslaginstellingen openen",
        "Download%S",
        "Te aktualizacje usprawni",
        ".?AV?$CDlpAutoLockT@V?$CDlpAutoExclusiveAcquireLockT@VCEmptyType@@@@@@",
        "Nabavite",
        "Nothing1You will be able to manage your Windows settings.DYour settings and apps will be deleted, but your files will be kept.?Everything will be deleted, including files, apps and settings.",
        "ate namestiti starej",
        "emo USB fle",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1",
        "installation de Windows 10",
        "i deinstalacija aplikacije.",
        "zban.DNem siker",
        "GH9_ t]",
        "in veya ba",
        "ssel eingeben",
        "2M2i2",
        "istiti instalacijske datotekeQInstalacijski program nije uspio utvrditi koje su podr",
        "=B=j=",
        "i lista unit",
        " \"setup.exe /?\" ",
        "kk-KZ",
        "Nous ne pouvons pas dire si votre PC est pr",
        "re logget p",
        "in %1!d! GB.",
        "1vwwA",
        ":u~6E",
        " cheie.LAceast",
        ".?AV?$CUnknownImpl@VIActivationActionResponse@@@@",
        "INFORMACE O INSTALACI: N",
        "qO=:M",
        " jour permettent d'am",
        "ner des frais suppl",
        "LLLLLK",
        "t megad",
        "ndern, wie Windows Setup Updates herunterl",
        "ati, ker je trenutna razli",
        "Sovellettavat ilmoitukset ja k",
        "Installationsprogrammet st",
        "Brezpla",
        "katuLejupiel",
        "klenmesine yard",
        "rbesz",
        "rer allerede Windows 10",
        "dzu, uzgaidiet, kam",
        "as-IN",
        "e pokrenuti Windows Server 2019",
        " cel pu",
        "Veuillez patienterGUn probl",
        "Daha fazla bilgi edinin",
        ", koska olet asentamassa Windows-versiota, joka ei ole sama kuin t",
        "k:;sn",
        "gle igen, som du har k",
        "bpenc",
        " proizvoda mo",
        "DVD-Brenner ",
        "43484=4B4Q4W4b4f4k4",
        "Precisamos de mais espa",
        "No pudimos encontrar la informaci",
        " disponible en el idioma ni en la arquitectura actual.",
        "Estamos com dificuldade para determinar se seu computador pode executar o Windows Server 2019. Feche a Instala",
        ".rdata$zzzdbg",
        "4U4h4",
        "sti diegimo. Per",
        "do(s)",
        "teni a sz",
        " nettet. Disse oppdateringene hjelper installasjonsprogrammet med ",
        " ponownie komputera. Zamknij wszystkie uruchomione programy i uruchom ponownie komputer. Instalacja systemu Windows b",
        "L}9=,",
        " nefunguje. Sk"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "3327c87cb93ad602943ed461e91bcc42e1727a2b653b70de7dab681a2dda8e11",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/3327c87cb93ad602943ed461e91bcc42e1727a2b653b70de7dab681a2dda8e11",
              "guest_paths": [
                "overlay"
              ],
              "size": 8504,
              "crc32": "C10A1FE9",
              "md5": "ef7a4e6f8af7ced31811b2a92b396b37",
              "sha1": "1a90e2438ee20a271df4db8b52a95aa5e2b39e44",
              "sha256": "3327c87cb93ad602943ed461e91bcc42e1727a2b653b70de7dab681a2dda8e11",
              "sha512": "6ce73feeaaf9b0f4926e232f18d69f3b73f95a52585235e917a18fe629017aacf663fca71e67d8cf7cfe1b3c4a96bdc343be7c6958f2735b29dbd993ad17d078",
              "rh_hash": null,
              "ssdeep": "96:fKMDXvDbzC0cr8OAlpVHKzDmowDD0pBDXiebs/Am2grWXGuGDX6+1Hd7DmE+DfBc:wr8VHwDDBQABJG05qAAqnajBCWp",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T1D3021AD1CB682043EA667D40635DE9873D3D53CB2D6048A6119EF9A82CD73C6EF044AF",
              "sha3_384": "74a55824963ee9536edd9d070d78856f3c3f1f41b27ce0115986c6238cabf04bca60a2a146c5b73af64e849655d1f064",
              "data": null
            }
          ],
          "extracted_files_time": 0.0005618340001092292,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "pidgenx.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/40a97484ce8e06658ea02af3e3b0077c47ba8d71c2d991eb69b94f221c78478f",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\pidgenx.dll"
      ],
      "size": 888632,
      "crc32": "D8D7ED2D",
      "md5": "a54f45a9013251f0ddd91c6b3ab18449",
      "sha1": "d2af46eedbf3e5024f54d81cd062f8aa4c9b77d8",
      "sha256": "40a97484ce8e06658ea02af3e3b0077c47ba8d71c2d991eb69b94f221c78478f",
      "sha512": "02c4784f02537247134ea17b508cbd3e5b0c6cea943ef0143ec9708652c85c255e115a603eb337e515ab00fe6526cd5d83d560d987ffe7d1ba612a6f125ad62d",
      "rh_hash": null,
      "ssdeep": "24576:snR+vEwcJsaaiaYZC1vLDQf8vdJy+X1LQpOd+:4zw7aaiaYZCj5vdJy+XhUOd+",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1C9152852FACC53D9E1A624316919B376D29E9E211F6314CB02F0EE8EF02D7D3573426A",
      "sha3_384": "7bce069ea1c9dacd780bd1667548ab7d5d05ada77056922741686973b1ebe33e51e7563f46bf383b32f92a273e0b4305",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x0003b450",
        "ep_bytes": "8bff558bec568b3500e40c1081c60000",
        "peid_signatures": null,
        "reported_checksum": "0x000db5d3",
        "actual_checksum": "0x000db5d3",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "pidgenx.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x100d0174",
                "name": "_wtoi"
              },
              {
                "address": "0x100d0178",
                "name": "_itow_s"
              },
              {
                "address": "0x100d017c",
                "name": "_onexit"
              },
              {
                "address": "0x100d0180",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x100d0184",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x100d0188",
                "name": "_itow"
              },
              {
                "address": "0x100d018c",
                "name": "_ui64tow_s"
              },
              {
                "address": "0x100d0190",
                "name": "memmove"
              },
              {
                "address": "0x100d0194",
                "name": "wcsncmp"
              },
              {
                "address": "0x100d0198",
                "name": "__dllonexit"
              },
              {
                "address": "0x100d019c",
                "name": "_unlock"
              },
              {
                "address": "0x100d01a0",
                "name": "_lock"
              },
              {
                "address": "0x100d01a4",
                "name": "_initterm"
              },
              {
                "address": "0x100d01a8",
                "name": "malloc"
              },
              {
                "address": "0x100d01ac",
                "name": "free"
              },
              {
                "address": "0x100d01b0",
                "name": "_amsg_exit"
              },
              {
                "address": "0x100d01b4",
                "name": "_XcptFilter"
              },
              {
                "address": "0x100d01b8",
                "name": "_purecall"
              },
              {
                "address": "0x100d01bc",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x100d01c0",
                "name": "wcschr"
              },
              {
                "address": "0x100d01c4",
                "name": "_wcsicmp"
              },
              {
                "address": "0x100d01c8",
                "name": "wcsstr"
              },
              {
                "address": "0x100d01cc",
                "name": "_CIlog10"
              },
              {
                "address": "0x100d01d0",
                "name": "_ftol2"
              },
              {
                "address": "0x100d01d4",
                "name": "memcmp"
              },
              {
                "address": "0x100d01d8",
                "name": "memcpy"
              },
              {
                "address": "0x100d01dc",
                "name": "memset"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x100d0044",
                "name": "HeapAlloc"
              },
              {
                "address": "0x100d0048",
                "name": "GetProcAddress"
              },
              {
                "address": "0x100d004c",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x100d0050",
                "name": "SetLastError"
              },
              {
                "address": "0x100d0054",
                "name": "GetVersionExA"
              },
              {
                "address": "0x100d0058",
                "name": "GetLastError"
              },
              {
                "address": "0x100d005c",
                "name": "LocalAlloc"
              },
              {
                "address": "0x100d0060",
                "name": "LocalFree"
              },
              {
                "address": "0x100d0064",
                "name": "CloseHandle"
              },
              {
                "address": "0x100d0068",
                "name": "CreateFileW"
              },
              {
                "address": "0x100d006c",
                "name": "GetFileSize"
              },
              {
                "address": "0x100d0070",
                "name": "ReadFile"
              },
              {
                "address": "0x100d0074",
                "name": "SetFilePointer"
              },
              {
                "address": "0x100d0078",
                "name": "MultiByteToWideChar"
              },
              {
                "address": "0x100d007c",
                "name": "WideCharToMultiByte"
              },
              {
                "address": "0x100d0080",
                "name": "ExpandEnvironmentStringsW"
              },
              {
                "address": "0x100d0084",
                "name": "VirtualProtect"
              },
              {
                "address": "0x100d0088",
                "name": "RtlCaptureContext"
              },
              {
                "address": "0x100d008c",
                "name": "VirtualFree"
              },
              {
                "address": "0x100d0090",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x100d0094",
                "name": "VirtualAlloc"
              },
              {
                "address": "0x100d0098",
                "name": "TerminateProcess"
              },
              {
                "address": "0x100d009c",
                "name": "GetModuleFileNameW"
              },
              {
                "address": "0x100d00a0",
                "name": "GetCurrentThread"
              },
              {
                "address": "0x100d00a4",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x100d00a8",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x100d00ac",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x100d00b0",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x100d00b4",
                "name": "Sleep"
              },
              {
                "address": "0x100d00b8",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x100d00bc",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x100d00c0",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x100d00c4",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x100d00c8",
                "name": "GetTickCount"
              },
              {
                "address": "0x100d00cc",
                "name": "IsProcessorFeaturePresent"
              },
              {
                "address": "0x100d00d0",
                "name": "HeapFree"
              },
              {
                "address": "0x100d00d4",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x100d00d8",
                "name": "SleepConditionVariableSRW"
              },
              {
                "address": "0x100d00dc",
                "name": "WakeAllConditionVariable"
              },
              {
                "address": "0x100d00e0",
                "name": "AcquireSRWLockExclusive"
              },
              {
                "address": "0x100d00e4",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x100d00e8",
                "name": "SystemTimeToFileTime"
              },
              {
                "address": "0x100d00ec",
                "name": "GetLocalTime"
              },
              {
                "address": "0x100d00f0",
                "name": "GetVersionExW"
              },
              {
                "address": "0x100d00f4",
                "name": "GetSystemDefaultLangID"
              },
              {
                "address": "0x100d00f8",
                "name": "FileTimeToSystemTime"
              },
              {
                "address": "0x100d00fc",
                "name": "FreeLibrary"
              },
              {
                "address": "0x100d0100",
                "name": "SetThreadPriority"
              },
              {
                "address": "0x100d0104",
                "name": "FreeLibraryAndExitThread"
              },
              {
                "address": "0x100d0108",
                "name": "VirtualQuery"
              },
              {
                "address": "0x100d010c",
                "name": "CreateThread"
              },
              {
                "address": "0x100d0110",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x100d0114",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x100d0118",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x100d011c",
                "name": "CreateEventW"
              },
              {
                "address": "0x100d0120",
                "name": "CreateSemaphoreW"
              },
              {
                "address": "0x100d0124",
                "name": "InitializeCriticalSectionAndSpinCount"
              },
              {
                "address": "0x100d0128",
                "name": "CreateFileMappingW"
              },
              {
                "address": "0x100d012c",
                "name": "MapViewOfFile"
              },
              {
                "address": "0x100d0130",
                "name": "UnmapViewOfFile"
              },
              {
                "address": "0x100d0134",
                "name": "RaiseException"
              },
              {
                "address": "0x100d0138",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x100d013c",
                "name": "ReleaseSemaphore"
              },
              {
                "address": "0x100d0140",
                "name": "SetEvent"
              },
              {
                "address": "0x100d0144",
                "name": "WaitForMultipleObjects"
              },
              {
                "address": "0x100d0148",
                "name": "GetThreadPriority"
              },
              {
                "address": "0x100d014c",
                "name": "GetProcessAffinityMask"
              },
              {
                "address": "0x100d0150",
                "name": "GetModuleHandleExW"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x100d0000",
                "name": "TraceMessage"
              },
              {
                "address": "0x100d0004",
                "name": "CryptExportKey"
              },
              {
                "address": "0x100d0008",
                "name": "CryptVerifySignatureA"
              },
              {
                "address": "0x100d000c",
                "name": "CryptSignHashA"
              },
              {
                "address": "0x100d0010",
                "name": "CryptDecrypt"
              },
              {
                "address": "0x100d0014",
                "name": "CryptEncrypt"
              },
              {
                "address": "0x100d0018",
                "name": "CryptGenKey"
              },
              {
                "address": "0x100d001c",
                "name": "CryptImportKey"
              },
              {
                "address": "0x100d0020",
                "name": "CryptDestroyKey"
              },
              {
                "address": "0x100d0024",
                "name": "CryptDestroyHash"
              },
              {
                "address": "0x100d0028",
                "name": "CryptHashData"
              },
              {
                "address": "0x100d002c",
                "name": "CryptCreateHash"
              },
              {
                "address": "0x100d0030",
                "name": "CryptGetHashParam"
              },
              {
                "address": "0x100d0034",
                "name": "CryptAcquireContextW"
              },
              {
                "address": "0x100d0038",
                "name": "CryptReleaseContext"
              },
              {
                "address": "0x100d003c",
                "name": "CryptGenRandom"
              }
            ]
          },
          "RPCRT4": {
            "dll": "RPCRT4.dll",
            "imports": [
              {
                "address": "0x100d0158",
                "name": "RpcStringFreeW"
              },
              {
                "address": "0x100d015c",
                "name": "I_RpcMapWin32Status"
              },
              {
                "address": "0x100d0160",
                "name": "UuidToStringW"
              },
              {
                "address": "0x100d0164",
                "name": "UuidFromStringW"
              }
            ]
          },
          "bcrypt": {
            "dll": "bcrypt.dll",
            "imports": [
              {
                "address": "0x100d016c",
                "name": "BCryptGenRandom"
              }
            ]
          }
        },
        "exported_dll_name": "pidgenx.dll",
        "exports": [
          {
            "address": "0x10039bb0",
            "name": "GetPKeyData",
            "ordinal": 118
          },
          {
            "address": "0x10038cb0",
            "name": "PidGenX",
            "ordinal": 120
          },
          {
            "address": "0x10038860",
            "name": "PidGenX2",
            "ordinal": 119
          },
          {
            "address": "0x10038d00",
            "name": "",
            "ordinal": 117
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x000cdc70",
            "size": "0x00000073"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x000d01e8",
            "size": "0x00000078"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x000d1000",
            "size": "0x000003f0"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x000d6e00",
            "size": "0x00002138"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x000d2000",
            "size": "0x00007968"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x00008c10",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x0000350c",
            "size": "0x00000018"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x00003460",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x000d0000",
            "size": "0x000001e4"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x000ccce3",
            "size_of_data": "0x000cce00",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.81"
          },
          {
            "name": ".data",
            "raw_address": "0x000cd200",
            "virtual_address": "0x000ce000",
            "virtual_size": "0x00001398",
            "size_of_data": "0x00001000",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "5.33"
          },
          {
            "name": ".idata",
            "raw_address": "0x000ce200",
            "virtual_address": "0x000d0000",
            "virtual_size": "0x00000c9e",
            "size_of_data": "0x00000e00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.17"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x000cf000",
            "virtual_address": "0x000d1000",
            "virtual_size": "0x000003f0",
            "size_of_data": "0x00000400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "3.33"
          },
          {
            "name": ".reloc",
            "raw_address": "0x000cf400",
            "virtual_address": "0x000d2000",
            "virtual_size": "0x00007968",
            "size_of_data": "0x00007a00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.79"
          }
        ],
        "overlay": {
          "offset": "0x000d6e00",
          "size": "0x00002138"
        },
        "resources": [
          {
            "name": "RT_VERSION",
            "offset": "0x000d1060",
            "size": "0x0000038c",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.49"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Pid Generation"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "pidgenx.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "pidgenx.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "509c84143f8074a1302282582955eeae",
        "timestamp": "2098-06-02 12:24:23",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 5
      },
      "data": null,
      "strings": [
        "5 5@5g5n5",
        "0-060T0u0",
        "!t$ W3",
        "5!5&5@5E5c5",
        "6G7U7",
        ".CRT$XLA",
        "778E8",
        "9#9t9",
        "PartNumber",
        "Microsoft Time-Stamp Service",
        "8.9F9d9",
        "certificationPrincipals",
        "SystemTimeToFileTime",
        "@LvT2",
        "!0Y0`0",
        ")\\MmQ4",
        ";A u.",
        "1(1/1M1",
        "7?7_7w7~7",
        "313>3E3P3W3b3i3",
        "050:0\\0",
        "3'3N3U3p3",
        "8L9x9",
        "t$4;M",
        "5b5j5",
        "394R4q4",
        "1(191@1^1",
        "L$4VP",
        "L$ PR",
        "malloc",
        "061M1",
        "5*6=6",
        "3!4H4O4m4",
        "g,n#L",
        "/0F0a0|0",
        "Af<8m",
        "QQVW3",
        "5%5\\5",
        "229879+4583620",
        "Trusted by:",
        "UnmapViewOfFile",
        "?U?v?",
        "J:QLx",
        "9!979",
        "L$(QW",
        "CI%'Q",
        "Squared Tate Q",
        ">!?Q?v?",
        "ZHM:c|",
        "1,1:1Z1",
        "WVj,3",
        "=/=m=",
        "VirtualProtect",
        "=8=?=^=i=w=",
        "HD_LQ",
        "wcsstr",
        "D$HPS",
        "uWjLP",
        "utf-16be",
        "D$09}",
        "uCjTS",
        ">E?\\?c?",
        "5-5T5[5z5",
        "7#8<8S8",
        "emailName",
        "5.5a5",
        "D$XPS",
        "010I0`0{0",
        "tYW9u",
        "20201008072501.689Z0",
        "9{(t0",
        "7I7b7{7",
        " !\"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@",
        "N,:o,|",
        "TerminateProcess",
        ">?>F>K>Q>f>m>",
        "D$(34",
        "9(:>:E:",
        "<6<]<d<",
        "7a7f7",
        ".idata$5",
        "? ?(?L?U?",
        "ntWh(o",
        ";e;n;",
        "6>7w7",
        "210211214039Z0",
        "2!3S3Z3",
        "authorizedPropertyPossessorCollection",
        "9 :f:W;",
        "0(1_1p1y1A2X2",
        "=A>H>]>v>",
        "http://www.w3.org/2001/04/xmlenc#aes128-cbc",
        ">)>D>X>",
        "ExpandEnvironmentStringsW",
        "1O1f1",
        ":`;g;",
        "u0a6=A",
        "3*3?3Z3s3",
        "bindingPrincipals",
        "cR>yH?",
        ">?>|>",
        "G;{ r",
        "t|N{Q",
        "8f;9u",
        "8a9h9",
        "_purecall",
        ":,;7;x;",
        "?+?1?@?x?",
        "040904B0",
        "<J=~=",
        "Microsoft Time-Stamp Service0",
        "/vXRh2",
        "lwg9YH",
        "8$8,838C8T8",
        ">)?0?g?w?",
        "HeapFree",
        "AlgorithmId",
        ">(>A>",
        "6Y7r7",
        "GetVersionExA",
        ")-#0\"",
        "Ch2KX,G",
        "\"i=7:",
        "200304183039Z",
        "p7^(\"",
        "D$T1D$$",
        ":$;C;f;t;",
        "162Z2s2",
        "708i8w8",
        "819\\9",
        "p05-msgrec wanted2",
        ":\":z:",
        "5$5F5",
        "-U=mV",
        ";%<S<n<",
        "081?1T1",
        "Redmond1",
        "forAll",
        ";D<K<",
        "5Q6X6",
        "9C9}9",
        "3/3T3",
        "\\Phl~",
        "3=3D3b3",
        "='>>>O>V>a>h>",
        "1 1%1/141I1N1_1q1v1",
        "2[2b2",
        ";:;?;K;P;`;e;v;{;",
        "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8",
        ":Y;a;~;",
        "1N+QaYteSIjGmRMzTkxCE+5oiPoLk2Fq+RA9GLnl+dHOcyxt2a/0HvUdagaL/NwDquzOef4JOMMuVavd4PtWQiO/aBLvxVv7yIhUhhB6PEsw59mhbVlT/Z5OGkp6gfzH9ezZ+qHHFHo0cloAAu5QGUeuYCPLheVK7X3+syHE1qXagfRa5m0xG+770FyPeMKazK+keeQ/goW+nt2wTM9Pofj4yTGCbn6Fc6EpKdyHmzrzQDc5FjZemXP2PbGjS6iPC7l3+Ut5JPL66ZUZzCs5qRc+/wRODknUWAcqURJWP79knfPhf3/dvbytHpr64wFfpBNDSbNVubol0E8oTa/NYw==",
        "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
        "CPI>f",
        ">&?w?~?",
        "?4?S?x?",
        "Configurations",
        ">\"?=?`?{?",
        "PSWhPg",
        "l>30kP",
        "RO;=7",
        ">Ntej",
        "~_~/^",
        "7!797F7\\7i7",
        "jZs>z ",
        "<G=e=",
        ":!:+:2:G:^:x:",
        "y;J'P",
        "MapViewOfFile",
        "4;4@4v4",
        "GetPKeyData",
        "uQhXZ",
        "5*5X5p5",
        "9K9~9",
        ":$:m:t:",
        "4:5U5\\5",
        "ruyj Xf9DY",
        "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a",
        "PidGenX",
        ";b<i<",
        "4)404y4",
        "j1QQj",
        "3U4~4",
        "    r:",
        "6&7-7B7i7p7",
        "8H8Q8r8",
        "8 828",
        "9C9k9",
        "4$4d4",
        "PC3o^Qy",
        ",SVW3",
        ";.<z<",
        ".xdata$x",
        "uCj@S",
        "1!1;1B1~1",
        "1T2>3",
        "=)=Z=",
        "0-1>1I1f1",
        "<1<8<?<s<",
        ":N;V;`;",
        "Microsoft Corporation1",
        "versionedBinaryData",
        "9%989",
        ";J;a;h;",
        "6;6C6I6S6",
        "}h'_Tp",
        "<+===D=",
        "767g7n7",
        "msft:rm/algorithm/pkey/986",
        "1 282b2",
        "[9\\$,",
        "7)8I8m8",
        "667=7",
        "1\"1\\1u1",
        "StringFileInfo",
        "90u9h",
        "? ?H?Z?",
        "N0L0J",
        "r~akow",
        "principal",
        "3A3F3~3",
        "encryptedLicense",
        "!0(060=0l0s0",
        "7Gt4Y",
        "4/4C4Z4z4",
        "D$T1D$,",
        "L$0+D$$",
        ":7:V:f:o:",
        "5A5i5",
        "CryptDecrypt",
        "t3h\\N",
        "646R6,7m7",
        "EtwEventWrite",
        ":J:O:`:e:o:t:",
        "717J7Q7Y7`7h7o7y7",
        ":-:4:L:o:v:",
        "6/7E7",
        "digitalResource",
        "jno8C",
        "U|85F",
        "HL91t/",
        "6)7T7g7 8H8",
        "0#1f1",
        "Hp9q$tX",
        ":A:W:",
        "5$6+6f6p6",
        "2@>]iWT",
        ":D;T;c;s;",
        "888?8Q8X8_8",
        "465h5o5",
        "F(Ph\\~",
        "<S<b<i<",
        "=\"=4=",
        "u{j0S",
        "737j7q7",
        "7*8G8j8",
        "5@5k5",
        "msft2009:",
        ",irG(",
        "<#<E<\\<q<",
        "@#v6zvO9atU",
        "|LJAT",
        "G$90u2h",
        "3{4oY4E",
        "F9dgQ",
        "3*/P-",
        "u$C;]",
        "jK%2om",
        "5X6_6d6i6y6~6",
        "duration",
        "@Ec5U6",
        "v$0yw?",
        "3T4[4p4",
        "NTscA#",
        "License Authorization Succeeded.",
        "0%1C1f1r1y1",
        ":-:4:V:t:",
        "RtlCaptureContext",
        "=+=D=c=",
        "%Microsoft Windows Production PCA 2011",
        "T$81D$8",
        "G Pj@V",
        "uoj,P",
        "%05.5lu-%01.1lu%04.4lu-%05.5lu-%c%cOEM",
        "=@=l=",
        ":0:9:\\:d:",
        ";-;4;L;",
        "=E>x>",
        "060P0U0o0v0",
        "5B5Z5{5",
        "YIUiI",
        "6(6C6^6y6",
        "api-ms-win-core-localregistry-l1-1-0.dll",
        "0;0@0J0O0e0j0y0",
        "6/7K7^7",
        "<8=D=K=~=",
        "count",
        "xfH2VD",
        "F$+F(;",
        "4%4G4k4",
        "receivePrivateKey",
        "4 4'4A4h4o4",
        "Iqzcz",
        "0f;1u",
        "@z.kT",
        "ProductDescription",
        "62797H7S7i7p7",
        "_:!q1",
        "p05ByteArrayToParams::temps",
        "oAxWC",
        ";(;H;g;p;",
        "1f;2u",
        "7O8V8`8g8q8x8",
        "w$WSP",
        "=6>|>",
        " ?NMZ^L2p",
        ";$>.>Z>w>",
        "0=0p0",
        "te9s(tY9s",
        "6)6>6E6u6|6",
        "VarFileInfo",
        ">(?1?U?",
        "')vx6=",
        "sdaym",
        "R@+A]0)",
        "f30r3",
        "=N=X=",
        "> >,>3>H>e>l>",
        "718n8",
        "98t\"P",
        "9},t~",
        "2\"2\\2x2",
        "\"O3`M",
        "DeleteCriticalSection",
        "7\"8C8i8",
        "1K1o1",
        "HZo6m|",
        "<SVW3",
        "attributes",
        ">*>5>w>",
        "memmove",
        "1%2)2-2125292=2A2E2I2M2Q244#9g9",
        "6%6k6r6",
        "tr9;un",
        "9\"9'9-979?9E9N9Y9`9h9n9v9",
        "7$7:7R7j7",
        ";R<[<t<{<",
        "encoding",
        "license",
        "1'1@1`1j1",
        ".,\\\\CK.",
        ";=;S;",
        "Grant:",
        ";O<V<]<s<z<",
        "2\"3B3I3S3",
        "3C3k3r3}3",
        "6 6,636f6",
        "6Ka\"x",
        "475^5i5p5",
        "/VEaR",
        "6$6l6",
        "9=:D:u:",
        "7f8~8",
        "1'1A1h1o1",
        ">5>X>{>",
        "9F@v)",
        "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5",
        "allPrincipals",
        ":,:3:K:s:z:",
        "2\\2c2",
        "VirtualQuery",
        "2.3:3A3n3",
        "XNDs7",
        "303?3F3P3W3a3h3",
        "VVVV+",
        "(SVW3",
        "Exponent",
        ">+>O>v>}>",
        "\\$d3T$<",
        "Q9fFoFmo",
        "4/484e4q4",
        "PVVVj",
        "msvcrt.dll",
        "?456789:;<=",
        "MmS p",
        "0.0I0d0",
        "4C9W9",
        "GetCurrentThreadId",
        "2$3I3]3h3",
        "!|QMS\\",
        "wTz:;I",
        "4t;;7",
        "http://www.w3.org/2001/04/xmlenc#aes256-cbc",
        "3$3*353;3G3W3`3q3w3}3",
        "9(:/:B:I:|:",
        "D$4;D$8",
        ";|$Pt5",
        "=<=V=s=",
        "11282G2R2h2o2",
        "222M2h2",
        "FreeLibrary",
        "8?9Z9x9",
        "`.data",
        "D$(h$M",
        "i9s t",
        "=9=`=g=",
        "555Q5",
        ";/;`;q;x;",
        "^u&h@",
        "353I3",
        "I_RpcMapWin32Status",
        ">!>>>E>p>",
        "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3",
        "<(<5<N<i<",
        "P/RDR7?",
        "?#qN~",
        "?2?M?h?",
        "=+>G>j>{>",
        "propertyUri",
        "6@6p6",
        "9XA!F!",
        "bcrypt.dll",
        "ns%Yv",
        "uCjPS",
        "=B=[=|=",
        "Authorization Succeeded.",
        "propertyPossessor",
        "pkeyConfigData",
        "DR<X$",
        ">B>^>g>",
        "444B4I4T4[4",
        "1H2O2e2w2",
        "s$GSj",
        "6$6`6",
        "?.?9?O?V?y?",
        "=B=M=[=",
        "F~YYPgu",
        "UuidFromStringW",
        "< <D<b<",
        "=\"=;=T=p=",
        ";E;L;3<M<m<",
        ":9:t:",
        ".CRT$XCA",
        "020Q0b0m0",
        "yruQV",
        ": :.:E:W:s:",
        ":?:]:|:",
        ";\";/;6;;;O;W;g;m;w;~;",
        "210303183039Z0p1",
        ":Q:n:",
        ">+>?>F>^>",
        "SetFilePointer",
        ":m>t>",
        "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p",
        "CipherValue",
        "798E8w8",
        "t\"9\\$ t",
        "748=8}8",
        "Ly4xr",
        "\"'/cc",
        "tBC;]",
        "YoY=(",
        "8 8H8`8",
        ";G;N;",
        "9\":):M:",
        "Verifying Property Possessor Patterns.",
        "D$T1D$4",
        "D$09\\$H",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "A*%*d",
        "?\\?c?w?",
        "=[>s>",
        "<3<:<O<v<}<",
        "4 5P5",
        "ujh0g",
        "282P2W2p2w2",
        "7M7T7",
        "3$3/3x3",
        ":l;s;",
        "KQ7s!",
        "707R7^7",
        "owLS53(",
        "0I1P1",
        "7<7U7o7",
        "6!6W6a6",
        "D$8PS",
        "Z`c}~9",
        ">1>8>j>",
        "7L8}8",
        ">#>*>5><>G>N>",
        "4 4(40484@4H4P4X4",
        ":\":-:4:<:C:N:U:",
        "1'1]1|1",
        "=@=g=n=",
        "Pid Generation",
        "=(>A>n>u>",
        "InternalName",
        "5@5a5|5",
        "Patterns Successfully Matched.",
        "Microsoft Corporation1.0,",
        "29q`u",
        "0(1/1A1H1q1",
        "0/1h1",
        "q !A$",
        "H xv~",
        "T$`+L$",
        "=%>\\>u>",
        "250701214655Z0|1",
        "2?3x3",
        "KeyName",
        "R29oiQq",
        "=?>n>",
        "<N<v<",
        "1o2v2",
        "2I2i2",
        "u#Sjd3",
        "393[3",
        "ULXrC9",
        "<&<L<",
        "FreeLibraryAndExitThread",
        "747K7f7",
        "1#2/262g2",
        "infoInt",
        ";3;:;U;k;",
        ";i<p<",
        "3/3T3t3",
        "cBHHuT",
        "6!7&7S7X7@9f9",
        "<Ph`~",
        "?5?h?",
        "1!1?1D1s1",
        "Translation",
        "4%4+40464;4@4E4K4P4V4[4`4f4n4u4{4",
        "uCjpS",
        "3=4a4",
        ".tls$",
        "='>U>{>",
        "6C6_6",
        "D$ PS",
        "qP!AT",
        "9':1:g:n:",
        "!$ v3",
        "<&<I<e<",
        "<V<r<y<",
        "0_vK&",
        "O,_^[",
        "u2MN/",
        ">.>C>|>",
        "memcpy",
        "121S1}1",
        "SVh0M",
        "GetModuleHandleW",
        "Algorithm",
        "l?t]R",
        "=%=E=g=n=",
        "anXmlPatternAbstract",
        "x v+|]",
        "u+j$W",
        "<[<b<",
        ".CRT$XLZ",
        "3,333?3",
        "CK;^$so",
        "3:3V3y3",
        "#][G/",
        "3C4r4",
        "|$T1|$<",
        "j/Xf9DY",
        "626R6",
        "Smp0D",
        ":C?p?~?",
        " http://www.microsoft.com/windows0",
        "tm:infoTables/tm:infoList/*",
        ":B;I;",
        "6(616Y6v6",
        "=JnN'",
        "8\"8(8-83898A8F8K8Q8Z8_8e8l8q8w8{8",
        "202W2^2~2",
        "version",
        "4&4-444h4o4",
        ";D$ s",
        "0/0Y0",
        "w1woq",
        " SVW3",
        "cw'~u",
        "*toYX",
        "677b7i7",
        "v SWPQ",
        "5'5J5R5",
        ">)?B?[?t?",
        "t]91uY",
        "0A0M0T0",
        "5/5W5x5",
        "Washington1",
        "WakeAllConditionVariable",
        "656v6",
        "2%3r4",
        "7-8U:\\:r<",
        "6E7N7j7",
        "L$$VQ",
        "L$43\\$T",
        "space",
        "?8???U?g?",
        "uvj$P",
        "<+<6<V<z<",
        "6*7h7",
        "!0@0I0i0",
        "preserve",
        "UO/Gu",
        "D$@;L$",
        "=-=3=",
        "pubKey->deallocateDigit",
        "`}&wB",
        "?C?p?w?",
        "%{I*(",
        "GetModuleHandleExW",
        ".tls$ZZZ",
        "Authorizing License:",
        "4I5k5",
        ":B:\\:",
        "sidPrincipal",
        "Hl91t/",
        "uCh0g",
        ">#>*>",
        "4*4C4q4",
        ":,;9;V;\\;",
        "2%3,3Q3i3p3",
        "Rw~Og[",
        "8&8b8",
        "222=2K2",
        "9I:l:",
        "yzAm*",
        "j{Zf;",
        "D$0+t$H",
        "2Y2l2s2",
        "808I8h8o8",
        "5*6E6",
        "5D5j5",
        "Cf;:u",
        "1&1d1",
        "FileDescription",
        "HPWWj",
        "!_0^_",
        "878Q8k8",
        "_XcptFilter",
        "j0X+E",
        "5/oO'",
        "7,7?7",
        "    p:",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "0\"0;0T0p0",
        "Q9t$<t",
        "u}jAXf9E",
        "rightUri",
        "9K9R9",
        ".idata$6",
        "=F=\\=",
        "< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\\<`<d<h<l<p<t<x<|<",
        ":):A:Y:r:",
        "545A5H5S5Z5p5",
        "4&5-5B5i5p5",
        "Y[\\7P0",
        "4&4F4",
        "<H=O=a=h=",
        "wcschr",
        "1/1A1",
        "<==K=",
        "=J=}=",
        "cYzy<6",
        "CryptImportKey",
        "D$0PS",
        "=5=g=",
        "Matching Grant:",
        "=5i5w5",
        "0$0c0",
        "PwY8e",
        "}\\b`4",
        "0:0x0",
        "7A7H7q7{7",
        "L$$W3",
        "validityInterval",
        "5M7\\7",
        "9+:2:",
        ": :k:",
        "IM^<1",
        "t$x3L$0",
        "w$SWj",
        "gYDa\\",
        "7\"7'797>7K7P7U7c7h7m7w7|7",
        "?1?B?I?R?Y?",
        "8,8F8`8w8",
        "+T$0+T$",
        "9V0tQ",
        "7'7.7A7I7O7U7[7d7z7",
        "?3?N?i?",
        "http://www.w3.org/2000/09/xmldsig#",
        "C#V_h",
        "2E3m3",
        "RefGroupId",
        "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;",
        "2:2t2-4",
        "2M2c2}2",
        "_CIlog10",
        "6!6<6j6",
        "Microsoft Corporation",
        "+t$,3",
        "GroupId",
        "0!0C0j0q0",
        "/]_X,ok",
        "=(>O>V>v>",
        "9,:?:F:T:[:b:",
        "RoGetActivationFactory",
        "Ty[w*",
        "`jB{%",
        "CoCreateInstanceFromApp",
        " _^[]",
        "==>{>",
        "t^9{ tY9}",
        "T$03t$,",
        "\\$(taQ",
        "<%=Z=",
        "1X1_1",
        "?B?k?r?",
        ";/<F<M<",
        "4G4N4Y4`4",
        "9':.:",
        "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512",
        "J|)7-",
        "GetProcessHeap",
        "7?7r7",
        "@name",
        "#wRtEj",
        ">>?Y?v?",
        "626=6K6",
        "5&555@5V5]5",
        "_ftol2",
        "LoadLibraryExW",
        "4d5C7[8",
        "policyInt",
        "authorizedPrerequisiteRight",
        "!D$,9D$",
        "8+808K8Y8c8",
        ".text$mn$00",
        "=)=X=_=z=",
        "PSWQh",
        "J;]Lx",
        "d>grj4f",
        "808k8",
        "EtwEventRegister",
        "to@f;",
        "5m5w5",
        "7;7[7",
        "?3?I?P?b?i?",
        "60?0{0",
        "?)?O?V?]?",
        "api-ms-win-core-processthreads-l1-1-3.dll",
        "9t~E_{w",
        "priority",
        "P!pe,",
        ";H;O;a;h;o;",
        "cpi5v",
        "9=:F:j:",
        "=0>`>",
        "t_VVRPVh",
        "5\"6p6",
        "<3=:=P=x=",
        ":3pj?p",
        "EtwEventEnabled",
        "T$(1D$(",
        ",MjfQ0B0v13jSLNlGWDK001SokII+h+dNiFl1wiJNWXI=0Z",
        "3+3E3",
        "()/xk",
        "PA<mS",
        "2D2K2r2",
        "R!s4Z",
        "1@1i1",
        "D$4PS",
        "varName",
        "=I=b=~=",
        "4/5M5v5",
        "[$j0Zf",
        ";W<^<h<o<y<",
        "~*@I7gw",
        "8'919g9q9",
        "account",
        "3*313x3",
        "D$434",
        "uhj S",
        "4[4b4n4",
        ">8>Y>",
        "8%9A9H9^9",
        "Software\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform",
        "WideCharToMultiByte",
        "\"Microsoft Window",
        "9.:A:Q:",
        "p05-msgrec betanow",
        "9t$(u",
        ":?;x;",
        "?+?2?R?]?k?",
        "8+878B8*9>9r9",
        "DSVWh",
        "515n5",
        "p j@Z",
        "=2=I=d={=",
        "http://www.microsoft.com/DRM/XrML2/SL/v2",
        "productPolicies",
        "5.555P5",
        "DE:~[",
        "6!7T7{7",
        "T$,VPSW",
        ":!:(:Z:u:",
        "EncryptedKey",
        "5,515T5Y5",
        "allConditions",
        "Jh3pq",
        "879Z9q9",
        "1&2:2S2o2",
        "u&f90t",
        "Authorizing Grant Issuance.",
        "7+7j7q7",
        "9)929K9",
        "urn:mpeg:mpeg21:2003:01-REL-SX-NS",
        "6)6M6T6s6~6",
        "8B8`8",
        "K.[h[",
        "00000",
        "# zwB",
        ":D:]:",
        "+T$$3",
        ">+>6>Q>v>",
        "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@",
        "='>0>C>L>c>l>z>",
        "ADVAPI32.dll",
        "kM=JA",
        "uGC;]",
        "2h3o3",
        "819:9`9",
        "EnterCriticalSection",
        ">L?p?",
        "5)5w5",
        "485|5",
        "1J1Q1l1",
        "8&;8!'",
        ">2>V>",
        "3$4<4]4",
        "4O4V4}4",
        "`[$H-",
        "8,8F8",
        ">\"?I?P?x?",
        "D$8B3",
        "uRjhS",
        "zZT1oH<",
        "Volume",
        "_&P#>d!!m",
        "SVWPPj",
        "timeOfIssue",
        "VVRQj",
        "485?5Q5X5_5",
        "u(h0g",
        "1J2x2",
        "NjB{%",
        "*nK'D@*",
        "6E6S6",
        "CipherData",
        ":E:f:",
        "8?8J8X8",
        "9!9G9Z9",
        "<;\\$ s",
        "515I5`5",
        ":o;~;",
        "7b7x7",
        "4.434I4N4X4]4",
        "4)444",
        ":0;7;g;",
        ":Z;s;x;};",
        "30353X3",
        "QSPVhPq",
        "OXU}5>",
        "QQSVW3",
        "4#4.4D4K4R4x4",
        "j$QQj",
        "1/0-0",
        "qyW)4",
        "172Z2q2x2",
        "575R5",
        "0.1M1a1",
        "4%5,5X5_5",
        "du>j Xf9DY",
        "041B1^1e1",
        "29q0u",
        ">!>M>T>s>",
        "<%<G<]<",
        "91:g:q:",
        "0%0f0",
        "details",
        "2;2Z2~2",
        ".\"sm'",
        "H?<;{",
        "Transforms",
        "191113214039Z",
        "UuidToStringW",
        "false",
        ";7<t<",
        "9D9W9m9",
        "`o}NV",
        "_onexit",
        "5#5'5,51585A5R5\\5a5k5p5z5",
        "KeyRange",
        "R{m(%",
        "F9[I?",
        "8)9B9[9w9",
        "414X4_4",
        ">+>3>M>o>u>",
        "CryptSignHashA",
        "9u$tv",
        "0S1u1|1",
        "value",
        ">)>0>;>B>X>k>",
        "CryptHashData",
        "203G3f3",
        "373N3[3b3}3",
        "http://www.w3.org/2001/04/xmlenc#sha256",
        "D$<1D$",
        "7M7Z7w7}7",
        "\"$D#v",
        "4,+J|",
        "1$2;2R2f2",
        "PSVWQ",
        "4/464<4H4X4^4",
        "msft:rm/algorithm/pkey/985",
        "=(>?>W>",
        "tEhtQ",
        "utf-16",
        "InitializeCriticalSectionAndSpinCount",
        "=@>G>e>j>",
        "929X9t9",
        "6\"7V7g7r7",
        "\\:Hef",
        ":N:h:",
        "4$4:4f4~4",
        "uIjdS",
        "LegalCopyright",
        "=0>K>",
        "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "7M8T8v8}8",
        "Y__^[",
        "vN'5n?Lb",
        ".idata$3",
        "<+<k<",
        "qW81J",
        "2!2Q2q2",
        ";'<.<T<[<",
        "8[9b9",
        " >!?S",
        "4D4b4",
        "252:2b2",
        "2'2E2y2",
        "Ynl,+",
        "6L6Y6",
        "J+da@",
        "D$PPS",
        "F-b<5",
        "6!6[6",
        "shortsig: external_key_to_internal",
        "privateKey",
        "$`2X`F",
        "4<5a5",
        "FS7RA",
        "M0K0I",
        "Value",
        ">&>I>",
        "q`WNX",
        ">~L[Z",
        "Bxo*1",
        "<1<:<W<d<k<v<}<",
        "_t{ZB=",
        ":8:E:L:W:^:",
        "infoTables",
        "252}2",
        "9X:s:",
        " /OV`;",
        "|hK,_",
        "!0j0XPV",
        "4W4^4",
        "_ui64tow_s",
        "4M4[4t4{4",
        "111a1",
        "1=2l2",
        ";+;D;];",
        ".<w@&",
        "RegGetValueW",
        "PSWh0r",
        "}\\Y,5",
        "B'tGK(+",
        "j+Xf;",
        ".050>0E0r0",
        ".edata",
        "?6?=?m?",
        ">9~ t",
        "9XLt=",
        "6:6X6",
        "9>9M9T9",
        "0@0W0",
        "[*!4@L ",
        "Oim|o$XV$",
        "T$$3|$H",
        "9=:{:",
        "959G9R9",
        ";*;L;[;`;~;",
        "0\"0R0r0",
        "=(>e>",
        "4&5b5}5",
        "5,636",
        "3%3,3X3c3",
        "]kA~@",
        "7=8o8|8",
        "?K btV",
        ".00cfg",
        "tD9s,t?",
        "9 989=9W9a9{9",
        "=+=9=D=n=y=",
        "1%1/1@1L1",
        "9 :):::A:",
        "r4o[AR4",
        "WVhhR",
        "j;XPW",
        "@IG`g}a",
        "productIdRange",
        "`jB~}",
        "T#*fn",
        "4!4(414w4~4",
        ">P>W>v>",
        "+T$$3T$",
        "L$ QW",
        "626Y6`6",
        "1NwUw",
        "QVPSh",
        "GetCurrentThread",
        "InverseQ",
        "http://www.microsoft.com/xrml/lwc14n",
        "313h3o3",
        "+T$03",
        "D$$PS",
        ":2:S:h:u:",
        "99:R:k:",
        ".data$brc",
        "0/0W0^0",
        "VWjVX",
        "IsProcessorFeaturePresent",
        "Microsoft Time-Stamp PCA 2010",
        "uCjLW",
        "4+5_5p5{5",
        "N)yD=ej",
        "6G6e6",
        "D$(PQ",
        "=0S0_0",
        "encryptedGrant",
        "5X6h6m6}6",
        ";1;8;?;i;",
        ":N:s:",
        "3i3r3",
        "; ;6;k;",
        "Legal_Policy_Statement",
        "1o1[4}4",
        "8@9G9p9",
        "03612",
        "ProductKeyConfiguration",
        ";%;,;4;;;P;j;",
        "_wcsnicmp",
        "T$$3|$D",
        "http://www.microsoft.com/DRM/PKEY/Configuration/2.0",
        "L$4+t$",
        "License Authorization Failed.",
        ";2;Y;`;",
        "8,939",
        "ProductKeyType",
        "=T>t>",
        "1(0&0",
        "y~0kA",
        "pidgenx.pdb",
        "; ;+;2;",
        "1:1S1v1",
        "010J0c0",
        "~}ed1nU[",
        "1,131X1_1q1x1",
        ":(:o:",
        "0(1-1O1",
        "[!Hv(lq",
        "7!7W7a7",
        "!F4!F8",
        "tAiI2",
        ":$;+;_;",
        "<!=*=\\=c=",
        "929K9d9",
        "application",
        "externalValidator",
        "SetUnhandledExceptionFilter",
        "uL[ O4",
        "!<2d ",
        "=>>E>Z>a>",
        "vhX ?",
        ">&>x>",
        "?!?`?g?",
        "u0j8S",
        ">+>Z>a>|>",
        ":7:<:^:",
        "c0xc>",
        "7A7H7l7s7",
        ";$;K;R;t;",
        "9)919Y9",
        "F0K0]0b0t0y0",
        "5!5(535:5",
        "2+2N2_2j2",
        "0/0W0",
        "L$494",
        "1%212L2s2",
        "SignatureMethod",
        "1M1Y1`1g1|1",
        "|$ !D$",
        "2:2b2m2",
        "gR|n=",
        "<0=d=u=",
        "9,9C9M9~9",
        "<#<*<d<",
        "Uz_\"4",
        "uoj(S",
        "?HY0z",
        "1*2]2",
        ":9:y:",
        "2/3|3",
        ".CRT$XIZ",
        "`jB{%1",
        ">!>m>t>",
        "=<>G>",
        "6(7/7A7H7O7",
        "3$4?4Z4u4",
        "CompanyName",
        "? ?e?",
        ">Y>{>",
        "3H4\\4i4p4",
        "EditionId",
        "0<0T0k0",
        "?!?*?I?h?",
        "uMj@S",
        "aA*qL",
        ":$:M:",
        "9H9Q9r9",
        "D$(PVS",
        "[Kp\\e",
        "identity",
        ";1<c<",
        "< <;<E<",
        "6H6Y6d6",
        "http://www.w3.org/2001/04/xmlenc#",
        "8=8v8",
        "9A9x9",
        "Satisfying Condition:",
        "CreateFileW",
        "binding",
        "<*</<D<I<b<g<s<x<",
        ">;^;3",
        ">1?c?j?",
        "3(3-3O3}3",
        "1W2e2",
        ";&<Q<i<",
        ";\";L;b;",
        "5/5I5",
        "o&-EOw",
        ".text",
        "<U<u<",
        "D$$;D$(t",
        "?(?/?",
        "FG;hu",
        "4-4I4R4k4t4",
        "L__cc",
        "s0^LmW\\",
        "SignedInfo",
        "354L4c4|4",
        "CryptDestroyKey",
        "aiO\\f",
        "<'</<9<b<i<",
        ">+>S>Z>w>",
        "p05ExternServerContextInit::ctx->internal->temps0",
        "8!8B8K8|8",
        "=?Tpx",
        "4/4K4t4",
        ":%;<;W;r;",
        "9.:?:M:",
        "8\"8^8",
        "7#7)7/74797>7C7L7S7Z7a7h7o7v7}7",
        "!D$$3",
        "infoList",
        "9{Dv.V",
        ";G;i;p;",
        ">e[)H",
        "O[pU<",
        "u8cH%",
        "PRhXZ",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "v QPP",
        "0]1d1",
        "10.0.19041.572",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "7$767A7S7^7",
        "20201009141603Z0w0=",
        "9'9|9",
        "=h=q=",
        "WV!p<",
        ":0;P;",
        "GJ/wd",
        "\\$x3t$D",
        "Matching",
        ">!>]>d>s>~>",
        "2P2n2x2",
        ":::A:c:",
        "D$T1D$",
        "N$+N(",
        "fJ\"0#/rg",
        "4%4,4f4m4",
        "<&<+<A<H<",
        "=+=S=Z={=",
        "7Q<{<",
        "PWShp",
        "s$SWP",
        "_vsnwprintf",
        "4 4%4T4",
        ":4;M;q;",
        ":3:V:",
        "%SystemRoot%\\System32\\spp\\tokens\\pkeyconfig\\pkeyconfig.xrm-ms",
        "GjjOD",
        "?>?E?d?o?}?",
        "{\\BAKm,~",
        "?\\?|?",
        "6\"6'6,62676=6B6H6N6T6Z6`6f6l6r6w6|6",
        "9H:Q:u:",
        "82898v8",
        "GetVersionExW",
        "0?0F0[0",
        "varRef",
        ":$:5:<:G:N:f:",
        "?'?P?v?",
        "@;F@r",
        "UO^|e",
        "uQ9D$",
        "8&8;8^8e8",
        "msft:rm/algorithm/pkey/980",
        "{X\"V|",
        "=K=V=d=",
        "7#787^7i7p7",
        "Microsoft Corporation1200",
        "f94Wt",
        "3(4/4A4H4",
        "081x1",
        "r$SRj",
        "+t$ 3T$<",
        "5<5V5n5",
        "71888M8f8",
        "t$ht$",
        "505;5O5v5",
        "HeapAlloc",
        "<5<<<Z<",
        "2W2j2q2",
        "<s9w5;",
        "_,87f",
        "4SVW3",
        "6v6}6",
        "QueryPerformanceCounter",
        "3-4B4X4e4y4",
        "849;9T9[9",
        "tgVhLP",
        "SleepConditionVariableSRW",
        "$Microsoft Ireland Operations Limited1",
        "<&=e=",
        "uIf9M",
        "%05.5lu-%01.1lu%04.4lu-%05.5lu-%c%c%03.3lu",
        "\"l`0<",
        ";-;8;~;",
        "GetLocalTime",
        "2%3-3O3V3",
        "636C6",
        "0C0J0b0",
        "variableSubstitutionTable",
        ":&:4:h:",
        ">1>L>g>",
        "PublicKeyValue",
        ".CRT$XCZ",
        "Gp9P$tU",
        "4N4k4",
        "2I2P2k2",
        "&quot;",
        "595@5b5",
        "CryptReleaseContext",
        "5G5{5",
        "6\"62696u6",
        "0h0o0",
        "Y3yhP",
        "3!3G3n3u3",
        "2C2_2",
        "CreateEventW",
        "7%7<7_7",
        ";&;-;7;>;H;O;Y;`;u;",
        "Microsoft Enhanced RSA and AES Cryptographic Provider",
        "=0=X=_=",
        "5(6,606A8",
        "uCj<S",
        ",<U7b*",
        "373R3",
        ">9?R?k?",
        "= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=",
        "CryptGenRandom",
        "7'818g8q8",
        "4@4G4\\4",
        "3)3C3N3o3z3",
        ">&>A>",
        "Q8#0P",
        "7yMS\"l",
        "notAfter",
        "2\"ng?",
        "iZS.2",
        "9c9j9",
        "productId",
        "8E9j9~9",
        ";;;I;",
        "<-=X=",
        "QSVWh",
        "s`!Cd",
        "7S7i7p7y7",
        ".text$yd",
        "D$41D$",
        ";5<{<",
        "policySum",
        "8 8?8X8j8",
        ".CRT$XIAA",
        "'0.0W0b0p0",
        "=*>1>F>K>a>h>",
        "4B4f4v4",
        "2y>Oz@#",
        "ry@wh",
        "4#5d5",
        "J`'Ec",
        "8$8)8;8@8J8O8`8e8q8v8",
        "<.<5<Z<p<w<",
        ";\\$$s",
        "2h2q2",
        "?FNFI",
        "40474",
        "8+929P9",
        ";B;I;X;c;y;",
        "4\"4E4^4",
        "=+>:>f>",
        "+0vSN",
        "1%1f1m1",
        "W93t[",
        "retrievalString",
        "T$89\\",
        "8\"8)8",
        ";5<C<",
        "?'?E?|?",
        "AESKeyValue",
        "> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>",
        "kXJ\\C",
        "0#0S0",
        "9\":;:B:",
        "Authorized Grant Verification Succeeded.",
        ":$;?;Z;v;",
        "ReleaseSemaphore",
        "B\"5_xf",
        "=1>8>C>J>",
        "JE2rj",
        "N021Z",
        "w#V,N",
        ".S_P4f",
        "?H?g?",
        "Microsoft America Operations1&0$",
        "6\"6:6",
        "aGKDI",
        ">0?]?",
        "v),KZbW",
        ";9;[;",
        ">!?B?X?_?",
        "!#&dI",
        "GetThreadPriority",
        "runSoftware",
        "j0Yf;",
        "484S4n4",
        "3#4i4",
        "<+<p<",
        "w ;s ",
        "IsValid",
        "GetProcAddress",
        ";8;W;^;",
        "3!4W4a4",
        "j-Xf9",
        "_QQB(",
        ";m=}>",
        "4j5q5",
        "6z9y+E",
        "InitializeCriticalSection",
        "anXmlExpression",
        "RAL1z-",
        "2,232@2G2]2u2}2",
        "u3j@V",
        "proxyExecutionKey",
        "Microsoft Corporation1&0$",
        "GetModuleFileNameW",
        "8L8f8",
        "-TT*2",
        "2'3h3q3",
        "8!878B8a8",
        ":):.:@:E:O:U:\\:a:t:y:",
        ":):0:7:h:o:",
        "EV6CSqC",
        ":6:N:",
        "sU)Fb~hc`",
        "AuFO=",
        ":8:K:",
        "GetFileSize",
        "=0=X=_=u=",
        "Modulus",
        "!LK!(",
        "ReleaseSRWLockExclusive",
        "4/5i5",
        "7&7z7",
        "2V2w2",
        ".CRT$XCU",
        "QPj@j",
        " !\"#$%&'()*+,-./0123",
        "?&?+?=?B?T?Y?|?",
        ";Y;r;",
        "C;_0r",
        "bv#mE]",
        "0Q0x0",
        "2%2i2v2",
        "KeyInfo",
        "<#<*<8<l<",
        "2$2/2D2O2",
        "oxl)!",
        "standalone",
        "3 3>3m3",
        "=?=F=\\=",
        "tNj,V",
        "t4h$g",
        "+0O0s0",
        "Wmh^1KY",
        "9!:^:v:",
        "!e%!u",
        "2h2o2",
        "2>2U2\\2",
        "8\"8;8W8p8",
        "0?0w0",
        "9E9[9e9",
        "api-ms-win-core-com-l1-1-1.dll",
        "9I9P9t9{9",
        "1#1_1",
        ";!;,;3;};",
        "uCj8S",
        "41565n5s5",
        "2@2O2",
        "encryptedContent",
        "$\"wJ&",
        "7W8l8",
        "7I7P7Z7",
        "506G6f6",
        "=8>_>",
        "PWSQhPg",
        "000Y0",
        "ActConfigId",
        ".data",
        "Thales TSS ESN:3BBD-E338-E9A11%0#",
        "7'7.797@7K7R7]7d7m7t7",
        "msft2009:%s&%s",
        "@@@@@@",
        "t Cg1H",
        "tGj0SV",
        "686U6x6",
        ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:",
        "+t$(3",
        "UIt(;",
        "C@Phli",
        " Windows",
        "3=8`8r8U9",
        "5S5u5",
        "D8#!?",
        "3\"4U4|4",
        "5'5O5y5",
        "161=1n1s1",
        "/-j>Bv",
        "papi-ms-win-core-winrt-l1-1-0.dll",
        "_sz&m",
        ">!>,>b>",
        "?1?8?p?w?",
        "8&9c9",
        "<+<2<T<x<",
        ":-:3:<:m:s:|:",
        "uPj@S",
        "262x2",
        "CanonicalizationMethod",
        "=w>F?i?",
        "=!>r>",
        "7\"797q7",
        "(Pln5",
        ">6?Q?q?",
        "j9Xf;",
        "wcsncmp",
        "@6JxC",
        "536R6w6",
        "030:0W0",
        "N^B/8Z",
        "s7vh\\g|N5",
        "?X?_?q?x?",
        "7:7\\7",
        ">`?g?",
        "2<2E2P2W2i2o2u2{2",
        "keyHolder",
        "90:r:",
        ";=;h;",
        "L$XG@",
        "=0>N>S>",
        "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7",
        "6H7O7d7",
        "%3333",
        "3 4B4I4_4",
        "L$ 3D$,3",
        "8S9Z9p9",
        "7K7U7",
        "<U=s=x=",
        "L$@QW",
        "U}ihL",
        "[u%A;",
        "j.Xf9DY",
        "CreateFileMappingW",
        ";A<s<z<",
        ";<<p<",
        "authorizedPropertyPossessor",
        "8$878|8",
        "9F9W9w9",
        "Zeaxu",
        "_itow_s",
        "5I5g5",
        "7e7z7",
        "7J7s7",
        "policyStr",
        "Sleep",
        "5!5W5a5",
        "    Trust:",
        "90:7:k:",
        "0:1A1e1",
        "j+Xf9",
        ">2>9>Q>x>",
        "GetCurrentProcessId",
        "<0<S<Z<",
        "<$</<R<",
        "<\"<L<W<k<",
        "-49M%",
        "5*5C5_5p5w5",
        ";F;|;",
        "1N1U1l1",
        "> ?&?S?Z?x?~?",
        "3.3D3|3",
        ">U?^?",
        ";-;F;b;~;",
        "Yw]es",
        "===t=",
        "SumPSQR3",
        "Verifying Remaining Patterns.",
        "51565X5|5",
        "999J9U9",
        "'z}B ",
        "7G8]8h8",
        "T$01D$0",
        ":\":_:",
        ":jqZb",
        ".idata$4",
        "414X4_4}4",
        "|$@3T$<",
        ">9?@?h?s?z?",
        "SVWj3^",
        "a_dv?M",
        "> ~\"1i",
        "0:0k0",
        "PVShPq",
        "?4?O?j?",
        "Authorized Grant Verification Failed.",
        "2A2H2h2",
        "8>9U9",
        "2$3\\3w3",
        "=!=a=n=u=",
        " 4V+283",
        "6:7L7u8",
        "5D6R6",
        "issue",
        "9g9I:P:",
        "9^`IH",
        "2P7c7",
        "t9htQ",
        ".CRT$XIA",
        "4(4/4h4o4",
        "=3`3r3H4",
        "?5?D?I?j?o?",
        "=2=T=",
        "D$(3<03",
        "4#515?5",
        "111019184142Z",
        "m~ZdtXR",
        "oi,J6Q",
        "0k'-%8",
        "1C1j1",
        "VirtualFree",
        "?H?O?e?w?",
        "8!8[8",
        ";6;U;n;",
        "wildcard",
        ".rdata",
        "585z5",
        "1-141G1n1u1",
        "D$89E",
        "http://www.w3.org/2001/04/xmlenc#sha512",
        "L$P9D$|v.",
        "<`<t<{<",
        "uCjhS",
        ":;:V:",
        ".text$di",
        "9u(ug",
        "LwAwd",
        "0\"0)0X0l0",
        "7#8B8\\8a8",
        "3+3A3H3T3]3c3i3o3u3~3",
        "889?9{9",
        "DswqS",
        "4&5-5",
        "PublicKey",
        "PWShPg",
        "8<]*Ti",
        "323Y3u3",
        ">D?V?n?",
        "?X?_?t?",
        "9{ v)V",
        "F]:/[",
        "OriginalFilename",
        "0\"1)1T1[1",
        "default",
        "3$3+3@3[3s3",
        "x8@1sI",
        "707H7O7d7",
        "right",
        "SetThreadPriority",
        "Microsoft Corporation1%0#",
        "eN?T.",
        "msft2005:",
        "9n:{:",
        "lL7Ki\"0",
        ";F<sP",
        "@.reloc",
        "5(5,5054585<5@5D5H5L5P5\\5",
        "4)4a4{4",
        "IsRandomized",
        "6%6a6",
        "720nc",
        "qFJte",
        "W38:|+",
        "CreateSemaphoreW",
        "floatingPeriod",
        "{{b'3v",
        "9D$dv",
        "? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\\?`?d?h?l?p?t?x?|?",
        "L$@Qj",
        "=6>n>u>",
        "80A0Z0a0j0q0",
        "2k3~3",
        "5f<m=Y^",
        "U0S0Q",
        ":f;>u",
        ">1?g?",
        "555F5Q5",
        "renderer",
        "tOhDg",
        "5'6>6R6",
        "^YkSu_",
        "4(4@4^4{4",
        "0123456789",
        "CryptGetHashParam",
        "1H1`1",
        "^}-$rb",
        "}x@'5",
        "?Y?s?",
        "5_2G#",
        "252Q2~2",
        "8)8n8",
        "6*6T6",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        ";(</<<<C<y<",
        "L$ QHP",
        "+>/.e",
        "http://www.w3.org/2001/04/xmlenc#aes192-cbc",
        "4'4-43494D4K4Q4[4j4r4~4",
        "586?6T6g6",
        "444K4f4w4~4",
        "~[#XzN",
        "1E1O1",
        "0:0}0",
        "7$8C8Z8a8",
        "1O1V1u1",
        "L$ QP",
        "<\"===F=d=",
        "r3>.L",
        "<,<A<",
        "LPhd~",
        "001X1_1q1x1Y2r2",
        "3&3-3",
        "o`&D{N1",
        "MultiByteToWideChar",
        "?$?=?b?",
        "CPQ9E",
        ";8;P;W;l;",
        "http://www.w3.org/2002/03/xkms#",
        "@.rsrc",
        "memcmp",
        "5G6U6",
        "p05-msgrec wanted1",
        "t)f;E",
        "0\"0<0C0|0",
        "2 2?2V2",
        "Microsoft Time-Stamp PCA 20100",
        "PidGenX2",
        "u/f90t&f",
        "%05.5s-%03.3lu-%07.7lu-%05.5lu",
        "3W3q3",
        "9I:b:{:",
        "9 9K9c9",
        "<&<p<{<",
        ">n0p7",
        "[wZtP",
        ".idata$2",
        "D$,;D$",
        "|$09|$",
        "<\"<8<",
        "='=.=I=t={=",
        "v0`zLQ,",
        "O4_^[",
        "1q2z2",
        "051I1R1{1",
        "4+4D4]4",
        "=,=S=Z=",
        "u.f;U",
        "UjO13",
        "r.Fj0Xf9",
        "<2<N<w<",
        "5%5)5/53585>5C5H5N5U5\\5c5j5q5x5",
        "9\\$ t",
        "3g4{4+5,6",
        "LeaveCriticalSection",
        "5V6n6u6",
        "T$ 1D$ ",
        "303[3b3}3",
        "UI\\k-",
        "w<;Si",
        "3=3W3",
        "5W5c5",
        ".rdata$T$brc",
        "AcgApi",
        "?6?H?",
        "3P3W3f3q3",
        "5\"6F6",
        "4,5f5m5",
        "ProductVersion",
        "424S4}4",
        "tmE'u]",
        "2(2E2b2x2",
        "PVSQh",
        "authorizedPrerequisiteRightCollection",
        "RSAKeyValue",
        "!D$<!D$49D$8",
        "<8=[={=",
        ">#>->2>B>G>Q>[>n>s>",
        "TSVW3",
        "= =:=T=",
        "oN\"8L",
        ">%c!i",
        "1!2@2M2",
        "=<>[>",
        "VirtualAlloc",
        "SVRQhX",
        "s$WSj",
        "273T3v3",
        "|$03t$,",
        "0J0d0m0",
        "Z%.Tg",
        "7'7A7H7R7Y7",
        "4,575J5",
        "$SVW3",
        "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9",
        "4>5e5l5",
        "j-Xf9F",
        ":G:e:",
        "?&?b?",
        "decryptWithPrivateKey",
        "?(?H?",
        "2G2`2y2",
        "ov+`Uv",
        "9_0v'",
        "O@_^[",
        ":#:N:i:",
        "definition",
        "{6V#;s",
        "A4jXj",
        "L$x3t$8",
        "7#797",
        "?.?T?[?h?",
        "GetProcessMitigationPolicy",
        "VS_VERSION_INFO",
        "GetSystemDefaultLangID",
        "T$$G3",
        ";\"<:<[<",
        "6'7h7",
        "<7=A=K=",
        "rl1]zuc",
        "LocalAlloc",
        "WindowsDeleteString",
        "pidgenx.dll",
        "    t:",
        "q1I>w",
        "?RAjT",
        ";D$$w",
        "8N8m8",
        "prerequisiteRight",
        "?2?J?g?",
        "3b6@s",
        "CryptGenKey",
        "[<aQ ",
        "\"_m`KK",
        "9_0v,",
        "O0M0K",
        ":e;-<",
        "<N=[=",
        "^w89_",
        "8A8H8l8",
        "*rvb2",
        "Patterns Not Matched.",
        "0`0o0v0",
        "api-ms-win-core-winrt-string-l1-1-0.dll",
        "lK dK",
        "454@4h4",
        "licenseId",
        "EncryptionMethod",
        "x&,02",
        "h,B'8",
        "?3?`?",
        "8U8r8",
        "949;9Z9{9",
        "utf-8",
        " sMR]",
        "RRRhd",
        "8C8J8Y8`8~8",
        "313U3t3",
        "L$,+L$0",
        "wyuq5a3",
        ".!#>f",
        "PSWQhPg",
        "ijLXPWS",
        "+R^ic",
        ":3:x:",
        "1.2J2",
        ">L>e>",
        "???g?n?",
        "PWSQh",
        "tFQRP",
        ";+;>;C;I;];b;n;",
        "=%>,>W>",
        "dC8`D*i",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        "<+<2<k<",
        "PublicKeys",
        "<T<[<",
        "}<mK:",
        ")3W,T",
        ";1;8;b;",
        "3A4H4",
        "2*3{3",
        "697R7k7",
        "RSA1j",
        "576Q6",
        "y^i5O",
        ">A?H?r?",
        "=%=0=Q=]=d=",
        "S8g{)",
        "j:Xf9F",
        "</<b<y<",
        "cQIEf",
        "grant",
        "DigestMethod",
        "6%7g7n7",
        "2w|#j",
        "]2T(R:",
        "j^^LJ",
        "7#747?7_7",
        "GetThreadInformation",
        "89ul*",
        ".rsrc$01",
        "4)40494E4L4W4^4i4p4",
        "Start",
        "3j5x5",
        "urn:mpeg:mpeg21:2003:01-REL-R-NS:licenseTransform",
        ",Ph\\~",
        ">#>*>5><>",
        "PWVRh",
        "_unlock",
        "3*3t3",
        " P%K`,",
        "1,131U1",
        "O Qj@j",
        "7:7C7[7h7~7",
        "3m'SK'pr",
        "q$Ggl",
        ":F:M:",
        "<C<e<",
        ".gfids",
        "@$;A(",
        "8(9=9D9[9b9",
        "!0.0n0",
        "848;8Z8q8",
        "767=7e7",
        "4F5\\5g5",
        ".rsrc$02",
        "GetLastError",
        "030S0m0x0",
        "xmlns:",
        "@SV@c",
        "5%5]5d5",
        "4 5N5i5",
        "404T4b4m4",
        "uCjDS",
        "CryptEncrypt",
        ";(;H;",
        "RWb-_Z",
        "$XyM~",
        "F7I5I",
        "ucs-2",
        "791t'",
        "`##?\\${",
        "lPht~",
        "L$,3t$",
        "@9^$v/9^0t",
        "YKbyl",
        "? ?3?r?",
        "ntdll.dll",
        ":!:V:a:o:",
        "%05.5s-OEM-%07.7lu-%05.5lu",
        "7G7N7",
        "trustedSecurityProcessor",
        "9!9&9+90969<9@9F9L9R9X9^9c9h9n9",
        "CryptDestroyHash",
        "B^bC~",
        "\\UxO_",
        "_amsg_exit",
        "020=0K0",
        "t?8^0u",
        "u2j@P",
        "5,535V5p5",
        "091{9",
        "6=6X6v6",
        ":9:@:X:",
        "2'3.3K3",
        "jOe7KZ",
        "ZVj,3",
        "=,=S=Z=z=",
        "0f;2u",
        "4\"4)434:4D4K4",
        "3-3D3[3v3",
        "infoBin",
        "KeyRanges",
        "D$ 34",
        "9|$ t5",
        "}\"!q+",
        "SignatureValue",
        "Microsoft",
        "Tiqv!",
        "S/ydB",
        "5B5b5",
        "4:4U4f4m4",
        "CryptExportKey",
        "9%:d:",
        "UnhandledExceptionFilter",
        "__dllonexit",
        "LE+|J",
        "5M5k5",
        ":(:z:",
        "'eR=aN6",
        "u~j4S",
        "t>j Xf;",
        ":9Lmj",
        "uCj\\S",
        "SquaredTatePairing Pmul",
        "8.959Z9{9",
        "858C8h8",
        "7_8#9",
        "181W1",
        "u=C;]",
        "s$HSP",
        ">:>C>a>",
        "-WnjI",
        "j\"Xf;G",
        "FHPhd~",
        "3w1]_",
        "[O2^'",
        "aM7b]",
        ";.;G;N;p;",
        "73888Y8^8l8s8x8}8",
        "DA4z{",
        ".giats",
        "<3<:<b<",
        "3H3O3a3h3o3",
        "PWVVj",
        "yAH\"y",
        "9#9(969?9X9]9",
        "9<:9=_=E>",
        "=9~0u8S",
        "securityProcessor",
        ",0G0P0o0",
        "7m7{7",
        "k(aK`",
        "SV]qG",
        "4P9s9",
        "575_5",
        ">->H>c>~>",
        "-+-SW",
        "holdsPrivateKey",
        ")Microsoft Root Certificate Authority 20100",
        "536:6k6",
        "90:K:c:z:",
        "PWSRhPg",
        "=/=4=V=",
        ">6>x>",
        "noBinding",
        ">K?|?",
        "AcquireSRWLockExclusive",
        "7;7F7T7",
        ";$;K;Z;a;",
        "100701213655Z",
        "0/0M0a0g0",
        "636|6",
        "Retail",
        "msft:rm/algorithm/pkey/2005",
        "WaitForSingleObject",
        "H?|`7IoJ",
        "172v2I7]7",
        "2H2u2",
        "<7<Q<s<",
        "7L7s7z7",
        "::;A;",
        "t$(9u",
        "KeyValue",
        "inventory",
        "appId",
        "8!8(8",
        "possessProperty",
        "343M3r3",
        "3#3P3W3",
        "Conditions Satisfied Successfully.",
        "GZ0*F",
        ")F:Xn",
        "DigestValue",
        "N4Q+wF",
        "7T7f7",
        "t&9\\$",
        "8B8I8X8c8y8",
        "9_9i9",
        "RaiseException",
        "3(4\\4x4",
        "<!=*=P=w=~=",
        "Autri",
        "ce<(GCu",
        ";=<D<Q<X<",
        "191u1",
        "=,=7=",
        "8*8:8A8",
        "otherInfo",
        "Transform",
        "R?Z@E",
        "2<4;:\\G",
        "1F1M1w1H2O2a2h2o2",
        "7(818B8t8z8",
        "0;0K0V0q0",
        "jLYf;",
        "authorizedGrantCollection",
        "</<6<U<q<x<",
        "778^8e8",
        "2.2?2J2",
        "5!6N6{6",
        ";;;f;",
        "!T$$@",
        "pkeyHash",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "D$ Pj",
        "_wcsicmp",
        "6T6y6",
        "8SVW3",
        "QQSV3",
        "3)3D3_3z3",
        "W_jmN",
        "313f3",
        ".idata",
        "@(;G(u",
        "Q<w<6#4",
        "A4Cd>",
        "858<8g8",
        ">/?6?",
        "7,878W8",
        "=T=k=t=",
        "tzje[",
        "5Q6X6c6j6",
        "8L8h8o8",
        ";+<<<`<i<",
        "10.0.19041.572 (WinBuild.160101.0800)",
        "030N0i0",
        "PVWQhPq",
        "WQhPg",
        "4*4A4\\4s4",
        "7h7~7",
        "3G4Q4f4k4",
        ":\";);N;o;",
        "C\\T2;",
        "<$<C<",
        "I/vA{",
        "727;7f7p7",
        "QSVW3",
        "k^BD/",
        "9-989F9~9",
        "8=8C8w8",
        "<&<?<",
        "6!6(636;6C6I6Q6V6[6c6g6l6q6x6",
        "=H>S>i>",
        "XSVW3",
        "=,=3=;=B=J=Q=",
        "261019185142Z0",
        "CryptCreateHash",
        "6&6S6",
        "959B9I9a9q9",
        "6f7m7|8",
        "90:7:",
        "='=2=M=",
        "575`5",
        "5M6f6m6",
        "ReadFile",
        "1}[0d",
        "UsR|#p",
        "9%92999J9^9",
        "#D$@+",
        "4$4W4|4",
        "7<7]7w7",
        "6Y6r6",
        "8%9g9n9",
        "<A<s<",
        "354^4i4p4",
        "8K8U8",
        "s'SQW",
        "_itow",
        "lrl,1",
        "<)<J<t<b=i=",
        "0!1(171B1X1_1f1",
        "182?2L2S2",
        "PC3o^",
        ":4:O:V:",
        "0'0I0",
        "{m!1hE",
        "1'1?1L1S1;2v2",
        "< <;<",
        "!_4^_",
        "0Z1t1",
        "8X8a8",
        "=5=<=",
        "2%2>2W2p2",
        "u/9D$$u",
        "7!8B8i8",
        "1>1E1O1V1`1g1|1",
        "2-343",
        "FileTimeToSystemTime",
        "2&282?2T2{2",
        "qp!At",
        "8$9+9v9}9",
        "keyUsage",
        "H(u(/",
        "VSWRQj",
        "9)909J9r9y9",
        "KERNEL32.dll",
        "3%3@3[3r3",
        "8 ;';",
        "|X4)#o",
        "= =;=V=",
        "9~$vG9F4u",
        "Signature",
        "898T8_8",
        "?;?x?",
        "5(6/6A6x6",
        "0J0f0m0",
        "SetEvent",
        "6'6:6~6",
        ":::A:f:",
        "1'1=1y1",
        "4o[AR4",
        "=3=k=",
        "u-jAXf9E",
        "2 2;2",
        "\"$9a%k$",
        "`\\}3g}",
        "2,2G2b2}2",
        "393@3K3R3f3",
        ">(?/?A?H?",
        "variableSubstitution",
        "YxC%T2&",
        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
        "validityIntervalFloating",
        "QQSVW",
        "V9_$v,",
        "2e6t6",
        "696S6m6",
        "MdDy,S?",
        "= >F>",
        "<.=r=",
        "82898D8K8V8]8h8o8",
        "$(>1vpc",
        ">i?p?",
        "0-1T1[1}1",
        "292@2h2",
        "tk9pDufW",
        ".text$mn",
        "YQVO4",
        "RpcStringFreeW",
        "7(7F7q7",
        "u?jPS",
        "2U3l3",
        "propertyAbstract",
        "(5XO4&S$}",
        "323K3d3",
        "5G6i6",
        "rxy(p",
        "signWithPrivateKey",
        ";Q0s#",
        ">+?K?",
        " ,-z6",
        ">9>`>g>",
        ";P<w<~<",
        "819h9o9",
        "<&</<6<",
        "D?Us|E",
        "141C1L1U1j1",
        "policyBin",
        "7#7H7h7",
        "9#999",
        "C3o^Qy",
        "@$f9TX",
        "_t_^[",
        "9!:H:O:q:",
        ";\";B;",
        "4e5z5",
        "RPCRT4.dll",
        "2!2K2o2",
        "L$$Qh",
        "?1?8?P?g?",
        "9B>Fr",
        "jE[f;",
        "GetCurrentProcess",
        ">$?}?",
        "trustedRootIssuers",
        ">w eP+p",
        "<'=Y=s=",
        "7d7m7x7",
        "3\"4B4d4",
        ">K>W>^>",
        "utf-16le",
        ";=;H;V;",
        "TraceMessage",
        "businessRules",
        "8B8N8",
        "Microsoft Windows0",
        "=?=k=r=|=",
        "=0=7=\\=|=",
        "4Rich",
        "29q8u",
        ">K>f>",
        ";Yz0B",
        "Configuration",
        "msft2005:%s&%s",
        "2(4`4L7",
        ";9<i<",
        "yp_|9",
        "9;9{9",
        "CryptAcquireContextW",
        ":&:F:",
        "k_wJ'",
        "1%1;1B1e1p1~1",
        "4'4J4X4c4",
        "ZOR9#|",
        "RefActConfigId",
        " Operating System",
        "0(0K0",
        "}KFRj",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "_initterm",
        ">\\>{>",
        "9K:R:g:",
        "tiS;y",
        "2W3\\3~3",
        "29q<u",
        "8$8>8U8o8",
        "6*6F6i6w6",
        "licensePartIdRef",
        "xrml:auth",
        "SetLastError",
        "0(0K0\\0g0",
        "7@8L8X8",
        "<D=K=V=]=o=",
        "urn:mpeg:mpeg21:2003:01-REL-MX-NS",
        ":*:;:F:",
        "oK0D$\"<",
        "F8Ph`~",
        "_lock",
        "jAXf;",
        ".rdata$brc",
        " ymqs",
        "_P_^3",
        "u(f9DY",
        "bi@2h",
        "PSVQh",
        "%UUUU+",
        "t$PWj",
        "SetThreadInformation",
        "z.9Wv",
        "p~s}5",
        "ux-kH",
        ":B;I;m;",
        "http://www.w3.org/2000/09/xmldsig#sha1",
        "US]CQ",
        ";(<\\<}<",
        "1\"1)181=1`1",
        "5X6i6w6",
        "Microsoft Strong Cryptographic Provider",
        "0%1g1n1",
        "9(:B:W:d:",
        "infoStr",
        "<#<Y<`<",
        "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
        "2!2,232>2E2",
        "SVWh(",
        "O8[_^",
        ":(;C;L;j;",
        "GetProcessAffinityMask",
        ";$;,;6;D;P;^;f;l;",
        "3p3y3",
        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",
        "6 6K6u6",
        "='=B=^=p=x=",
        "2X4p4",
        "3R3l3",
        "=&=K=Q=a=}=",
        "9A9i9",
        "Hbg&~",
        "r4o[AR4;",
        "9':.:b:",
        "9(949;9l9",
        "W;n~F7}M=;ZP",
        "768u8|8&9/9Q9x9",
        ":$:(:,:0:4:8:<:@:D:H:L:",
        "5.5O5p5",
        "lV! Uy:c9",
        "2l2s2",
        "6!6/646E6J6[6`6n6s6",
        "=)=0=F=m=t=",
        "7$8y8%9",
        "KCf'4",
        "authorizedGrant",
        "4'4?4p4",
        "141<1C1l1",
        "symmetricKey",
        ":\":,:^:v:",
        "=/=V=",
        "=?>F>",
        "8g9v9}9",
        "uPPj@Z",
        "\\?AIY",
        "10E0T0Y0",
        "8 8:8",
        "9/9C9\\9x9",
        "7k7v7",
        "C_k6'",
        "uIjPS",
        "u4C;]",
        "TlP0X",
        "909K9f9",
        "1V6l6",
        "&amp;",
        "j>Xf;G",
        "licensePartId",
        "$l-?`",
        "1I1b1i1",
        ";U;v;",
        "u$f98t$f",
        "070>0V0}0",
        "uwj0W",
        "Reference",
        "=5>w>~>",
        "<2<P<f<q<",
        "L$83L$0",
        "<.=5=",
        "C/IK!",
        "resource",
        "9*9V9]9u9",
        "CryptVerifySignatureA",
        ".rdata$sxdata",
        "8,9E9h9",
        "`jB{%/",
        "8L8S8",
        "4!5U5",
        "http://www.microsoft.com/DRM/XrML2/TM/v2",
        "JE2r ",
        "Authorization Failed.",
        ";!;(;/;i;",
        "GetSystemTimeAsFileTime",
        "memset",
        "161;1]1",
        "GetTickCount",
        "<\"=)=S=",
        "Wrd#j",
        "4^5e5",
        ")IK't",
        "363_3i3",
        "L7v_C",
        "WindowsCreateString",
        "=Y=`=",
        "privateBitsSPC",
        "uX9D$",
        "jFXf;",
        "< <@<\\<`<",
        "JJs~M",
        "0)0H0`0",
        "-_q`x>",
        "LocalFree",
        "<-<V<",
        "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4",
        "%05.5s-%05.5u-%03.3u-%06.6u-%02.2u-%04.4u-%04.4u.%04.4u-%03.3u%04.4u",
        "=4=;=O=|=",
        "O$;K$",
        "ProductName",
        ">V>i>p>z>",
        "3%4H4O4r4",
        "; ;';C;`;",
        "3*383C3x3",
        "assurance",
        ">'>@>",
        "O,Wh]",
        "O VSRj",
        "GSQ^z",
        "FXPhl~",
        "8C8J8j8",
        "3[3l3z3",
        "_except_handler4_common",
        "condition",
        "9 969=9i9t9",
        "2$2)2@2E2S2X2g2|2",
        ";|$@t(",
        "7(7H7S7p7",
        "=b=k=",
        "96:n:u:",
        "6'6h6",
        "EulaType",
        "Verifying Trust for Authorized Grants.",
        "uhhPg",
        "gWindows.Internal.SecurityMitigationsBroker",
        "_wtoi",
        "57m4'",
        "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6",
        "2Y2x2",
        "182h2o2",
        "as4s-",
        "2(3/3B3I3",
        "xmlns",
        "93B**",
        "555@5N5",
        "&]Iv ~,#",
        "6R7[7",
        "9<9u9",
        ";!;\\;t;",
        "notBefore",
        "qnnC<",
        "9.959U9j9",
        "%Microsoft Windows Production PCA 20110",
        "20201008141603Z",
        "030W0",
        "BCryptGenRandom",
        "4\"4s4",
        "666U6",
        "7<7C7h7o7",
        "C;\\$,",
        "uuj0P",
        "issuer",
        "OT_^[",
        "<L=~=",
        "1G2U2",
        "I0G1-0+",
        "%I_lI",
        "6\"6D6",
        "909I9h9",
        "1S1`1g1",
        "licenseGroup",
        "1H1Q1r1",
        "K9V<u",
        ";\";A;Z;v;",
        " Microsoft Corporation. All rights reserved.",
        "w/Rr8N",
        "91t-Q",
        "EtwEventUnregister",
        ".t(f;M",
        "=%=I=k=r=",
        "7K8a8l8",
        "!This program cannot be run in DOS mode.",
        "|$0;|$",
        "Gw=RL",
        ">)?B?g?",
        ";5;`;g;",
        " xmlns",
        "j Xf;",
        "urn:mpeg:mpeg21:2003:01-REL-R-NS",
        ";8<?<Q<X<_<",
        "6#6M6h6",
        "5S5m5",
        "f4o:-P",
        "%x+`C:_",
        "=$=F=j=",
        "D$@PQ",
        "?$?C?h?",
        "/F#[R#",
        "exerciseLimit",
        "<$<n<",
        "D$T;C",
        ";7<B<X<",
        "9!9<9G9U9",
        "<3<P<Y<",
        "8$9V9",
        "5P5g5",
        "0!0(0y0",
        "productData",
        "CloseHandle",
        "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0",
        "decryptContent",
        "232:2",
        "8+8_8",
        "21282t2",
        "9%9c9",
        "OtherInfo",
        "GW0E,",
        "888M8",
        "WShhP",
        "7&7=7",
        "474P4p4",
        ";-;8;w;",
        "trustedRootGrants",
        "9N9i9",
        "K^tmo#",
        "M(&pN",
        "WaitForMultipleObjects",
        "2L3Q3s3",
        "FileVersion",
        "838E8",
        "T$<;T$",
        "6%6,6W6|6",
        "/?0(cc",
        "<#<E<x<",
        "title",
        ".rdata$zzzdbg",
        "=X=_=l=s=",
        "1S1\\1t1}1",
        "($R>n",
        ":8;u;",
        "=(=O=V=t=",
        "3L4u4",
        "JC&|x2",
        "XPs00R",
        "rVjl3",
        "FhPht~",
        "/-/)4,S",
        "trustedLicensor",
        ":%:g:r:",
        "3:3?3i3n3",
        "i*yV+?J",
        ">>?m?",
        ";1;X;_;~;",
        "msft:rm/algorithm/pkey/2009",
        "CreateThread",
        "0$0I0p0"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "8284b15c3cf3271ecd4625904fba003f48bfe9c9b84a954880512dee095e32e6",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/8284b15c3cf3271ecd4625904fba003f48bfe9c9b84a954880512dee095e32e6",
              "guest_paths": [
                "overlay"
              ],
              "size": 8504,
              "crc32": "41953157",
              "md5": "e985c058f40a725c39db9ab2886246d5",
              "sha1": "3345ba049ef1b2557226fa80b8c54a7a08f3d2c2",
              "sha256": "8284b15c3cf3271ecd4625904fba003f48bfe9c9b84a954880512dee095e32e6",
              "sha512": "cf4287bbfbd02a55640d5e9fd7f2da7b40b068fdd0e077ea9bd0a161b35d338b8973536930cdbb67797f0de3707a4d9371d8ce3e29fa62b1eadb2b478d743599",
              "rh_hash": null,
              "ssdeep": "96:f9MDXvDbzC0cr8OAlpVHKzDmowDD0pBDXiebs/Am2grWXGuGDXsd8ZaDuTgDf/DV:Vr8VHwDDBQABJT+wCNxXeRqnajIhNKB",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T1970219C18F681443EAA7BD5013A8F9D77D3C93CB2820446665AAF9A82CC77C6EF0456D",
              "sha3_384": "eb0feff3dc4b941f71e8e78f49a9fd049e93685bba1e0c20e9cfca72fbd1e93573d54624992dc5971ab8d4f34b6b01a8",
              "data": null
            }
          ],
          "extracted_files_time": 0.0005017949988541659,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "pkeyconfig.xrm-ms"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/a3471eb8dc2c3045e33eb48abaef4046eeebbe30161a52f7056f68e479400823",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms"
      ],
      "size": 582696,
      "crc32": "EA161349",
      "md5": "7d72243366184b4048a90af77d63f21c",
      "sha1": "4d1a0cb9cc75b1ac7dbec285da7b90fbc85b3892",
      "sha256": "a3471eb8dc2c3045e33eb48abaef4046eeebbe30161a52f7056f68e479400823",
      "sha512": "a223abbd4c3d3cdc6c1fe345e68613e0225b583d7c8705a89b3a9f91dec96ec20428066830147642816b6b6628c7def368e89cc91d2378aa001cab9e3bee71f3",
      "rh_hash": null,
      "ssdeep": "6144:GeUJmDlHwVeCx2qTMTTnaP/d5/NbyBNiX4OOqd:GfARHwVeCx2qTMTTnaP/d5/NfJ",
      "type": "XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (65533), with no line terminators",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T124C4C54267A30874E2FA2CCC2E74D8DF95B1ABBF6AD36DD4A33C47414C61142DEA3919",
      "sha3_384": "26ea4d860dbcac286a52694d651da026e744e902a79a77847f9116c5bfb8787826b858435880bc55243f225c9f5e2d4c",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": "\\xfeff<?xml version=\"1.0\" encoding=\"utf-8\"?><rg:licenseGroup xmlns:rg=\"urn:mpeg:mpeg21:2003:01-REL-R-NS\"><r:license xmlns:r=\"urn:mpeg:mpeg21:2003:01-REL-R-NS\" licenseId=\"{06a4dd30-84b7-4fd2-b859-f1eddb0858f5}\" xmlns:sx=\"urn:mpeg:mpeg21:2003:01-REL-SX-NS\" xmlns:mx=\"urn:mpeg:mpeg21:2003:01-REL-MX-NS\" xmlns:sl=\"http://www.microsoft.com/DRM/XrML2/SL/v2\" xmlns:tm=\"http://www.microsoft.com/DRM/XrML2/TM/v2\"><r:title>XrML 2.1 License - Product Key Configuration</r:title><r:issuer><Signature xmlns=\"http://www.w3.org/2000/09/xmldsig#\"><SignedInfo><CanonicalizationMethod Algorithm=\"http://www.microsoft.com/xrml/lwc14n\"/><SignatureMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\"/><Reference><Transforms><Transform Algorithm=\"urn:mpeg:mpeg21:2003:01-REL-R-NS:licenseTransform\"/><Transform Algorithm=\"http://www.microsoft.com/xrml/lwc14n\"/></Transforms><DigestMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#sha1\"/><DigestValue>AM88tJM/7qpuE9kzeYjkyRVvHkQ=</DigestValue></Reference></SignedInfo><SignatureValue>PWzqO0CQ/zvdWvsWvvzedwuiQkUffzy6lObE9lyuXs51deJdVX04mcG5sNs3IagG33I3yMRU6PwopbfsX2r7WYPsokvjr4O0ZjLeR/L9RuiZj143SfppVbPmG2hBmDaLBM6cTbvvtnjnE/Z8UErHYSUdbxqK8EudVX3/iQwQQhLbCbXGB/FtLGNSV/hopcYAh+H7qNgRxwgWgER/yMguzpA1izELdxIM2BGbDF8zWoJeKLG0qsa9W3ePKOhXeh6bqyCMB7lRdsDE+9bgkf8uQq1DYQe02y91jZ4+PmoXlHjaxAA7TGSJIxWAQr8m2qeBZHO8Depzx4VQx/561780aA==</SignatureValue><KeyInfo><KeyValue><RSAKeyValue><Modulus>1N+QaYteSIjGmRMzTkxCE+5oiPoLk2Fq+RA9GLnl+dHOcyxt2a/0HvUdagaL/NwDquzOef4JOMMuVavd4PtWQiO/aBLvxVv7yIhUhhB6PEsw59mhbVlT/Z5OGkp6gfzH9ezZ+qHHFHo0cloAAu5QGUeuYCPLheVK7X3+syHE1qXagfRa5m0xG+770FyPeMKazK+keeQ/goW+nt2wTM9Pofj4yTGCbn6Fc6EpKdyHmzrzQDc5FjZemXP2PbGjS6iPC7l3+Ut5JPL66ZUZzCs5qRc+/wRODknUWAcqURJWP79knfPhf3/dvbytHpr64wFfpBNDSbNVubol0E8oTa/NYw==</Modulus><Exponent>AQAB</Exponent></RSAKeyValue></KeyValue></KeyInfo></Signature><r:details><r:timeOfIssue>2016-01-01T00:00:00Z</r:timeOfIssue></r:details></r:issuer><r:otherInfo xmlns:r=\"urn:mpeg:mpeg21:2003:01-REL-R-NS\"><tm:infoTables xmlns:tm=\"http://www.microsoft.com/DRM/XrML2/TM/v2\"><tm:infoList tag=\"#global\"><tm:infoStr name=\"licenseType\">msft:sl/PKEYCONFIG/SIGNED</tm:infoStr><tm:infoStr name=\"licenseCategory\">msft:sl/PKEYCONFIG/SIGNED</tm:infoStr><tm:infoStr name=\"licenseVersion\">2.0</tm:infoStr><tm:infoBin name=\"pkeyConfigData\">PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4NCjxQcm9kdWN0S2V5Q29uZmlndXJhdGlvbiB4bWxucz0iaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL0RSTS9QS0VZL0NvbmZpZ3VyYXRpb24vMi4wIj4NCjxDb25maWd1cmF0aW9ucz4NCjxDb25maWd1cmF0aW9uPg0KPEFjdENvbmZpZ0lkPns5Mjk3Nzk2Yi0zOTcyLTQzNDctOTA2ZS03ODkwNWRhNTQ3ZTJ9PC9BY3RDb25maWdJZD4NCjxSZWZHcm91cElkPjM3ODg8L1JlZkdyb3VwSWQ+DQo8RWRpdGlvbklkPlNlcnZlckF6dXJlTmFubzwvRWRpdGlvbklkPg0KPFByb2R1Y3REZXNjcmlwdGlvbj5XaW5kb3dzIFNlcnZlciAyMDE2IFJUTSBTZXJ2ZXJBenVyZU5hbm8gUmV0YWlsPC9Qcm9kdWN0RGVzY3JpcHRpb24+DQo8UHJvZHVjdEtleVR5cGU+UmV0YWlsPC9Qcm9kdWN0S2V5VHlwZT4NCjxJc1JhbmRvbWl6ZWQ+ZmFsc2U8L0lzUmFuZG9taXplZD4NCjwvQ29uZmlndXJhdGlvbj4NCjxDb25maWd1cmF0aW9uPg0KPEFjdENvbmZpZ0lkPns5MjExNDMxOS0xMmVhLTRiY2EtOWQ2My04NzQwZGU5ZmVmZjN9PC9BY3RDb25maWdJZD4NCjxSZWZHcm91cElkPjQyOTA8L1JlZkdyb3VwSWQ+DQo8RWRpdGlvbklkPlNlcnZlclN0YW5kYXJkPC9FZGl0aW9uSWQ+DQo8UHJvZHVjdERlc2NyaXB0aW9uPldpbmRvd3MgU2VydmVyIDIwMTkgUlRNIFNlcnZlclN0YW5kYXJkIFJldGFpbDwvUHJvZHVjdERlc2NyaXB0aW9uPg0KPFByb2R1Y3RLZXlUeXBlPlJldGFpbDwvUHJvZHVjdEtleVR5cGU+DQo8SXNSYW5kb21pemVkPmZhbHNlPC9Jc1JhbmRvbWl6ZWQ+DQo8L0NvbmZpZ3VyYXRpb24+DQo8Q29uZmlndXJhdGlvbj4NCjxBY3RDb25maWdJZD57YzJkMjNlMWYtZWUzZS00NTMzLTkwOTQtZTZkYzBiOGFhMDQ5fTwvQWN0Q29uZmlnSWQ+DQo8UmVmR3JvdXBJZD40MjkxPC9SZWZHcm91cElkPg0KPEVkaXRpb25JZD5TZXJ2ZXJTdGFuZGFyZDwvRWRpdGlvbklkPg0KPFByb2R1Y3REZXNjcmlwdGlvbj5XaW5kb3dzIFNlcnZlciAyMDE5IFJUTSBTZXJ2ZXJTdGFuZGFyZCBPRU06Tk9OU0xQPC9Qcm9kdWN0RGVzY3JpcHRpb24+DQo8UHJvZHVjdEtleVR5cGU+T0VNOk5PTlNMUDwvUHJvZHVjdEtleVR5cGU+DQo8SXNSYW5kb21pemVkPmZhbHNlPC9Jc1JhbmRvbWl6ZWQ+DQo8L0NvbmZpZ3VyYXRpb24+DQo8Q29uZmlndXJhdGlvbj4NCjxBY3RDb25maWdJZD57ZmQ5NDY1OTQtNmYwZC00YzVjLTliZjctZjVmNjI4ZWNkMGI5fTwvQWN0Q29uZmlnSWQ+DQo8UmVmR3JvdXBJZD40MjkyPC9SZWZHcm91cElkPg0KPEVkaXRpb25JZD5TZXJ2ZXJTdGFuZGFyZDwvRWRpdGlvbklkPg0KPFByb2R1Y3REZXNjcmlwdGlvbj5XaW5kb3dzIFNlcnZlciAyMDE5IFJUTSBTZXJ2ZXJTdGFuZGFyZCBPRU06Tk9OU0xQIChNVUkgbG9ja2VkIHRvIHpoLUNOKTwvUHJvZHVjdERlc2NyaXB0aW9uPg0KPFByb2R1Y3RLZXlUeXBlPk9FTTpOT05TTFA8L1Byb2R1Y3RLZXlUeXBlPg0KPElzUmFuZG9taXplZD5mYWxzZTwvSXNSYW5kb21pemVkPg0KPC9Db25maWd1cmF0aW9uPg0KPENvbmZpZ3VyYXRpb24+DQo8QWN0Q29uZmlnSWQ+e2QwN2VkYmQ4LTAyY2ItNDliMS04MzU4LWYyZGU3YWZkOGE0ZH08L0FjdENvbmZpZ0lkPg0KPFJlZkdyb3VwSWQ+NDI5MzwvUmVmR3JvdXBJZD4NCjxFZGl0aW9uSWQ+U2VydmVyU3RhbmRhcmQ8L0VkaXRpb25JZD4NCjxQcm9kdWN0RGVzY3JpcHRpb24+V2luZG93cyBTZXJ2ZXIgMjAxOSBSVE0gU2VydmVyU3RhbmRhcmQgT0VNOlNMUDwvUHJvZHVjdERlc2NyaXB0aW9uPg0KPFByb2R1Y3RLZXlUeXBlPk9FTTpTTFA8L1Byb2R1Y3RLZXlUeXBlPg0KPElzUmFuZG9taXplZD5mYWxzZTwvSXNSYW5kb21pemVkPg0KPC9Db25maWd1cmF0aW9uPg0KPENvbmZpZ3VyYXRpb24+DQo8QWN0Q29uZmlnSWQ+ezQyODViYmRhLTYyMTktNGMxYS05OGU5LTg1OWU2MGQ2NjlmYn08L0FjdENvbmZpZ0lkPg0KPFJlZkdyb3VwSWQ+NDI5NDwvUmVmR3JvdXBJZD4NCjxFZGl0aW9uSWQ+U2VydmVyU3RhbmRhcmQ8L0VkaXRpb25JZD4NCjxQcm9kdWN0RGVzY3JpcHRpb24+V2luZG93cyBTZXJ2ZXIgMjAxOSBSVE0gU2VydmVyU3RhbmRhcmQgT0VNOlNMUCAoTVVJIGxvY2tlZCB0byB6aC1DTik8L1Byb2R1Y3REZXNjcmlwdGlvbj4NCjxQcm9kdWN0S2V5VHlwZT5PRU06U0xQPC9Qcm9kdWN0S2V5VHlwZT4NCjxJc1JhbmRvbWl6ZWQ+ZmFsc2U8L0lzUmFuZG9taXplZD4NCjwvQ29uZmlndXJhdGlvbj4NCjxDb25maWd1cmF0aW9uPg0KPEFjdENvbmZpZ0lkPnsyODFjMjE2YS01OTU3LTQzOWItYWRmMi1hZmY0MDk4YTJiZGR9PC9BY3RDb25maWdJZD4NCjxSZWZHcm91cElkPjQyOTU8L1JlZkdyb3VwSWQ+DQo8RWRpdGlvbklkPlNlcnZlclN0YW5kYXJkPC9FZGl0aW9uSWQ+DQo8UHJvZHVjdERlc2NyaXB0aW9uPldpbmRvd3MgU2VydmVyIDIwMTkgUlRNIFNlcnZlclN0YW5kYXJkIE9FTTpETTwvUHJvZHVjdERlc2NyaXB0aW9uPg0KPFByb2R1Y3RLZXlUeXBlPk9FTTpETTwvUHJvZHVjdEtleVR5cGU+DQo8SXNSYW5kb21pemVkPmZhbHNlPC9Jc1JhbmRvbWl6ZWQ+DQo8L0NvbmZpZ3VyYXRpb24+DQo8Q29uZmlndXJhdGlvbj4NCjxBY3RDb25maWdJZD57OGVhNTZjMzEtZmU2ZS00ZDU2LTlkMTctOGRjMWFiMzVkZDhifTwvQWN0Q29uZmlnSWQ+DQo8UmVmR3JvdXBJZD40Mjk2PC9SZWZHcm91cElkPg0KPEVkaXRpb25JZD5TZXJ2ZXJTdGFuZGFyZDwvRWRpdGlvbklkPg0KPFByb2R1Y3REZXNjcmlwdGlvbj5XaW5kb3dzIFNlcnZlciAyMDE5IFJUTSBTZXJ2ZXJTdGFuZGFyZCBPRU06RE0gKE1VSSBsb2NrZWQgdG8gemgtQ04pPC9Qcm9kdWN0RGVzY3JpcHRpb24+DQo8UHJvZHVjdEtleVR5cGU+T0VNOkRNPC9Qcm9kdWN0S2V5VHlwZT4NCjxJc1JhbmRvbWl6ZWQ+ZmFsc2U8L0lzUmFuZG9taXplZD4NCjwvQ29uZmlndXJhdGlvbj4NCjxDb25maWd1cmF0aW9uPg0KPEFjdENvbmZpZ0lkPntkZTMyZWFmZC1hYWVlLTQ2NjItOTQ0NC1jMWJlZmI0MWJkZTJ9PC9BY3RDb25maWdJZD4NCjxSZWZHcm91cElkPjQyOTc8L1JlZkdyb3VwSWQ+DQo8RWRpdGlvbklkPlNlcnZlclN0YW5kYXJkPC9FZGl0aW9uSWQ+DQo8UHJvZHVjdERlc2NyaXB0aW9uPldpbmRvd3MgU2VydmVyIDIwMTkgUlRNIFNlcnZlclN0YW5kYXJkIFZvbHVtZTpHVkxLPC9Qcm9kdWN0RGVzY3JpcHRpb24+DQo8UHJvZHVjdEtleVR5cGU+Vm9sdW1lOkdWTEs8L1Byb2R1Y3RLZXlUeXBlPg0KPElzUmFuZG9taXplZD5mYWxzZTwvSXNSYW5kb21pemVkPg0KPC9Db25maWd1cmF0aW9uPg0KPENvbmZpZ3VyYXRpb24+DQo8QWN0Q29uZmlnSWQ+ezQ0YTViNGMzLWU0YjEtNDgzYi04MWU4LTBmNzhmNGQ5ODI4M308L0FjdENvbmZpZ0lkPg0KPFJlZkdyb3VwSWQ+NDI5ODwvUmVmR3JvdXBJZD4NCjxFZGl0aW9uSWQ+U2VydmVyU3RhbmRhcmQ7U2VydmVyU3RhbmRhcmRBQ29yPC9FZGl0aW9uSWQ+DQo8UHJvZHVjdERlc2NyaXB0aW9uPldpbmRvd3MgU2VydmVyIDIwMTkgUlRNIFNlcnZlclN0YW5kYXJkO1NlcnZlclN0YW5kYXJkQUNvciBWb2x1bWU6TUFLPC9Qcm9kdWN0RGVzY3JpcHRpb24+DQo8UHJvZHVjdEtleVR5cGU+Vm9sdW1lOk1BSzwvUHJvZHVjdEtleVR5cGU+DQo8SXNSYW5kb21pemVkPmZhbHNlPC9Jc1JhbmRvbWl6ZWQ+DQo8L0NvbmZpZ3VyYXRpb24+DQo8Q29uZmlndXJhdGlvbj4NCjxBY3RDb25maWdJZD57ZTkzNmY2MzAtNTEyNS00YTM5LWIxZGUtNTQ0ZDZjMDM2NDkxfTwvQWN0Q29uZmlnSWQ+DQo8UmVmR3JvdXBJZD40Mjk5PC9SZWZHcm91cElkPg0KPEVkaXRpb25JZD5TZXJ2ZXJTdGFuZGFyZDtTZXJ2ZXJTdGFuZGFyZEFDb3I8L0VkaXRpb25JZD4NCjxQcm9kdWN0RGVzY3JpcHRpb24+V2luZG93cyBTZXJ2ZXIgMjAxOSBSVE0gU2VydmVyU3RhbmRhcmQgVlQ6SUE8L1Byb2R1Y3REZXNjcmlwdGlvbj4NCjxQcm9kdWN0S2V5VHlwZT5WVDpJQTwvUHJvZHVjdEtleVR5cGU+DQo8SXNSYW5kb21pemVkPmZhbHNlPC9Jc1JhbmRvbWl6ZWQ+DQo8L0NvbmZpZ3VyYXRpb24+DQo8Q29uZmlndXJhdGlvbj4NCjxBY3RDb25maWdJZD57MzRlMWFlNTUtMjdmOC00OTUwLTg4NzctN2EwM2JlNWZiMTgxfTwvQWN0Q29uZmlnSWQ+DQo8UmVmR3JvdXBJZD40MzAwPC9SZWZHcm91cElkPg0KPEVkaXRpb25JZD5TZXJ2ZXJEYXRhY2VudGVyPC9FZGl0aW9uSWQ+DQo8UHJvZHVjdERlc2NyaXB0aW9uPldpbmRvd3MgU2VydmVyIDIwMTkgUlRNIFNlcnZlckRhdGFjZW50ZXIgVm9sdW1lOkdWTEs8L1Byb2R1Y3REZXNjcmlwdGlvbj4NCjxQcm9kdWN0S2V5VHlwZT5Wb2x1bWU6R1ZMSzwvUHJvZHVjdEtleVR5cGU+DQo8SXNSYW5kb21pemVkPmZhbHNlPC9Jc1JhbmRvbWl6ZWQ+DQo8L0NvbmZpZ3VyYXRpb24+DQo8Q29uZmlndXJhdGlvbj4NCjxBY3RDb25maWdJZD57Y2VhZTYyNjYtODAzNC00OGRiL <trunc",
      "strings": [],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "OBJECTS.DATA"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/0461d993fb0c8f4a5379828a8e4c98e646ab4de6f498409e0faef53f231f5a73",
      "guest_paths": [
        "C:\\Windows\\System32\\wbem\\repository\\OBJECTS.DATA"
      ],
      "size": 22913024,
      "crc32": "FCEBC0B5",
      "md5": "a19a4d808f3ec11935757e83871affd7",
      "sha1": "9f002dbca9409e6a167de2d369795ccd9946ba81",
      "sha256": "0461d993fb0c8f4a5379828a8e4c98e646ab4de6f498409e0faef53f231f5a73",
      "sha512": "a9a4aeae847b195a56fc9881f510c7dd3d4619618bb196563c005446f48609586f419af975ab07d48d7fe552e315e30174f0414886c6cba1bce6b7342656bd7c",
      "rh_hash": null,
      "ssdeep": "49152:6YSnn4sJ05ojPY6uvq+iUWu1l7FioXB5WFtvM/gGPtGP95eqYQgNqUwYq11OJqu0:4n15gQgJbAabc",
      "type": "data",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T17E37C5017AD59722C8BF13751893CE759734FE6022A9936737E87E8D38B36A10F12399",
      "sha3_384": "6f0e176eb6373149eccec884d6614673468ac96e901f503d9052d53b06d72d13291fc8d5f4ec8a649682d5ae69378a07",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": null,
      "strings": [
        "CD_9191719F2DF63C7538995F259914C03A19424624970470BC4FF958A554AE5D5C.2532.2109469681.391",
        "CD_E00F912E9047D1A2BF3DA9E198CE534F57C5B76F41F1AAB4887EE2C73627DAB0.2055.1045486451.2516",
        "SamGetDomPwdInfo_Start",
        "ProviderBinaryPath",
        "C_DB064F6F00AC6B8D3FA5B61DC9E5BA4F856D1F834E95E30D538DC0E3B653D24D",
        "FD WSDAPI Trace",
        "CD_F3FE9F8C3A3CF33804F815B29E77D41E1175AE360C63A072F4404033FF71E150.2082.2637756748.624",
        "Win32_WIN32_TSVIRTUALIP_Prov",
        "Array of XPSS States",
        "VOLUME_DISMOUNT",
        "Disable BidTrace for all applications.",
        "TimeStamp Option",
        "Win32_PerfFormattedData",
        "{64C1726E-DB21-11d2-85FC-0000F8102E5F}",
        "This class encapsulates an ETW provider on a computer for the event capture",
        "Network adapter management. ",
        "Active - The specified computer is to be made the active machine.",
        "The name and path of the file to copy from.",
        "C_D5472BB4000403F6D6CDB0F595804CE62C0D292549796526CA9E7773798E5F24",
        "SupportedDisplayFeatures",
        "Win32_TSEnvironmentSetting",
        "Since this format is only a recommendation, CIM clients shall treat the value as an opaque identifier for the sequence ",
        "5.25,  1.23MB, 1024 bytes/sector",
        "C_C4C4AC3CDD7A9E38A340BB56FE91B2D1BB13CEAA14A840B9C15B1953B57A1EE9",
        "AuthenticatedBytesSent",
        "System library directory",
        "CR_47C79E62C2227EDD0FF29BF44D87F2FAF9FEDF60A18D9F82597602BD95E20BD3",
        "C_DCE585FC8090201AD2A481DCDA9678ADBEED6FFAAA2CD50925EF913678001533",
        "EnumerateTrustedDomains",
        "SM_SetRNIDMgmtInfo",
        "GetVendorData",
        "NS_267C220794F508648239FA7778B7AB861354859A3A3BC7CD92CDCFF5E2286F1D\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_B40FE5BB7D3AAD0C5E26212696A1B37175024D4725396AA1CD7AE0B640ED7993",
        "// TCP/IP configuration class, implement one instance for each IP address on",
        "PolicySourceEnableRemoteDesktopMSI indicates whether the property EnableRemoteDesktopMSI is configured by Server(0) or Group Policy (1).",
        "TriggerType",
        "UserAccountControl_DetectApplicationInstallationsAndPromptForElevation",
        "CIM_PhysicalFrame.SerialNumber",
        "AllowVirtualGPU",
        "MS_SM_AdapterEvent",
        "object:MSNdis_PortAuthParameters",
        "LUAInstall: error 0x00000005 setting flags [{734AC5AE-68E1-4FB5-B8DA-1D92F7FC6661}]",
        "Custom Authentication Key",
        "StartingAddress",
        "SetByAbortSet",
        "DSCDSE",
        "The DelayedAutoStart property specifies if the service is started after other auto-start services are started plus a short delay. ",
        "OtherCannotPoolReasonDescription",
        "TEST_TRACE_RESERVED_06",
        "Disables the ODBC Connection Pooling PerfMon counters for ODBC Connection Pooling feature.",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|SpeakerVolume_High",
        "\"Stopped\" and \"Aborted\" are similar, although the former implies a clean and orderly stop, while the latter implies an abrupt stop where the element's state and configuration may need to be updated. ",
        "CD_ED6C3A2F6CC04DF3DD2F991B72C978A94559E5D3850ACCDF521D9DB88CF8E809.1165.1610215079.698",
        "SEL_EVM_REV",
        "LUAInstall: error 0x00000005 setting flags [{9301E380-1F22-11D3-8226-D2FA76255D47}]",
        "CIM_ClassCreation notifies when a new class is defined in the schema.",
        "AntiVirusStatus",
        "Working",
        "This parameter denotes the minimum supported size that a tier created in this pool can be.",
        "CD_F08FCE87204BA565CC8D5019202DC93CAE2C1D89D6CA6369E7617C4B178BC16E.65.1327697793.656",
        "ModifiedDate",
        "Number of failures",
        "C_59CC62799ED4524121BE28A013B19C8FA8396DA9DB0959637F6F4B761CC22896",
        "InteractionType",
        "Specifies the number of underlying physical disks across which data should be striped.",
        "CodeIntegrityPolicyEnforcementStatus",
        "object:MSNdis_HDSplitParameters",
        "Number of Request To Send failures",
        "Bad Route",
        "AllowInternetExplorer7PolicyList",
        "%Argument%",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2473.1344709254.368",
        "The Drive property is a string representing the drive letter (including colon) of the file. Example: c:",
        "DOT11_COMMON Flag",
        "CD_DE2F09E5209C548EB2CA373A925D80847E176AA4A3A4ACC0CB143A779C8154B2.311.1435931471.190",
        "FilePassphrase",
        " Example: 31",
        "Namespaces",
        "MSFT_CliAlias.FriendlyName=\"SysDriver\"",
        "LPCDRVR_TRACE_RESERVED_17",
        "MSFT_SmbMapping",
        "The WriteDebugInfo property has been deprecated in favor of the DebugInfoType property in the same class.  All future work should use this new property.  /nThe WriteDebugInfo property indicates whether or not debugging information is to be written to a log file./nValues: TRUE or FALSE. If TRUE, debug information is written to a file.",
        "Ndis80211NetworkInfrastructure",
        "LUAInstall: error 0x00000005 setting flags [{947812B3-2AE1-4644-BA86-9E90DED7EC91}]",
        "object:MSFT_NetAdapterEncapsulatedPacketTaskOffloadCapabilities",
        "RSOP_PushPrinterConnectionsPolicySetting",
        "Systems Preferred Power Profile",
        "NDIS 6 Status Media Specific Status Indication",
        "Interval",
        "TStateContext",
        "Certificate used to sign RDP files",
        "The average size of files on the volume.",
        "This class exposes operations that can be performed on a Fibre Channel port. There should be one instance of this class for each port.",
        "PciDeviceProperty",
        "CIM_PortImplementsEndpoint",
        "Win32API|Printing and Print Spooler Structures|JOB_INFO_4|JobId",
        "CD_857A93520BEDC9F703DB461D5CC8192FB10A25C77E5665D06DE039388F19CB72.1621.2325709263.7893",
        "The Win32_VolumeChangeEvent class represents a local drive event resulting from the addition of a drive letter or mounted drive on the computer system (e.g. CDROM). Network drives are not currently supported.",
        "MDM_eUICCs_01",
        "FwpuclntTraceProvider",
        "Type of eventlog message",
        "This is the root class of all device data types.",
        "Eigrp",
        "{49a2db5a-ca82-4263-a16c-dcae87f43507}",
        "ResourceModuleSource",
        "Select * from Win32_TapeDrive",
        "tc 3Z",
        "The Setting class represents configuration-related and operational parameters for one or more ManagedSystemElement(s). A ManagedSystemElement may have multiple Setting objects associated with it. The current operational values for an Element's parameters are reflected by properties in the Element itself or by properties in its associations. These properties do not have to be the same values present in the Setting object. For example, a modem may have a Setting baud rate of 56Kb/sec but be operating at 19.2Kb/sec.",
        "Ensure",
        "TouchKeyboardEmojiButtonAvailability",
        "ModuleInstance represents the Win32 instance handle.The ModuleInstance property has been deprecated.  There is no replacement value and this property is now considered obsolete.",
        "CreateRestorePoint",
        "CD_D760BC36A4E7F2EC138BE2205EECF2AA17893C6B9D8DB739718A0ED0B078D4B0.1734.3127800020.756",
        "ValidationCriteria",
        "CurrentClientMode",
        "Required field of replication settings is missing from input.",
        "FaultDomainAwareness",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2197.1807584343.368",
        "T-state dependencies",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.286.175755000.180",
        "IL_AEA9A6C20A5CDE3FE05BB0AD73D3F62C4A3D3F9C9AEA68C518E6B5CD1117BB7E.2679.413178062.281",
        "PassThroughIds",
        "BaseReachableTime",
        "object:VpnConnectionTriggerApplication",
        "Number of doors in the changer",
        "{FAF76B6C-798C-11D2-AAD1-006008C78BC7}",
        "The Win32_LUID abstract class represents a locally unique identifier (LUID), an identifier unique only on the local computer. Instances of the Win32_LUID class identify a process or thread so that they can be associated with security token privileges represented by instances of the Win32_LUIDandAttributes class. For more information about the role of LUIDs in security, see LUID.",
        "MSiSCSI_SecurityCapabilities",
        "Default Gateway",
        "NS_CAB27DE1BAB7670ABD52803B0A42E2A423F561EE80F3363FD5AA3CE6C352CAC6",
        "FileCount",
        "MCA Bus Error Event",
        "LEDBAT",
        "The Group class is used to collect ManagedElements into groups. This class is defined so as to incorporate commonly-used LDAP attributes to permit implementations to easily derive this information from LDAP-accessible directories. This class's properties are a subset of a related class, OtherGroupInformation, which defines all the group properties and in array form for directory compatibility.",
        "MIF.DMTF|General Information|001.6",
        "The type of access specified for the trustee",
        "02321.331",
        "EnvironmentVariables",
        "CtlGuidWpdBusEnum",
        "CD_9A36BB4E390B7DD04D76CD832679A7EB96B353EDC2C276A7C316493A7FCF4652.1374.1.13010",
        "R_76BB6040C0A675FA423A6CA22509EC4DE76B9BA03A8395D93A841C89C7021729.2462.1807262749.554",
        "ei'M3",
        "InstallOptions",
        "iSCSITarget",
        "CD_F31EBD8BA35B453CF95737829E224A0B8C314F43C824C500D5EB4164B9823141.1602.3636520061.593",
        "Add HTTP SSL certificate",
        "Retrieves a structural representation of the service's security descriptor.",
        "The CIM_DeviceSoftware relationship identifies any software that is associated with a device - such as drivers, configuration or application software, or firmware.",
        "ProcessorAcpiTss",
        "WSP_StoragePoolToVolume",
        "This is the Value component of the tuple",
        "A numeric sensor is capable of returning numeric readings and optionally supports thresholds settings.",
        "WPD ClassExtension Trace",
        "A power plan.",
        "CIM_VideoBIOSFeature.Characteristics",
        "SMBIOS|Type 8|Internal/External Connector Type",
        "CD_B6BF4F280E8F41D5C682A73285BD377F4F1516D4792C5D8362BF30684045009A.18.2268232416.637",
        "The number of frames successfully transmitted after more than one collision.",
        "Whether the cert criteria (CertName, EKUs, Thumbprint) should be used for validating the certificates presented.",
        "StartDiagnosticLog",
        "The OSAutoDiscovered property distinguishes the instances of this class that were automatically discovered by the operating system. If, for example, hardware was added through the Control Panel, the operating system finds instances of this class by querying hardware from the instances of this class. A value of TRUE indicates that the instance was automatically discovered.",
        "The Terminate method terminates a process and all of its threads. The method returns an integer value that can be interpretted as follows: ",
        "C_DA3DC1260150EA9B0B2628C0C2AA81125377900B91EB681EA05BC31E6A7900FC",
        "Uninstalls a product key for the current product.",
        "Number of outbound RDMA connections established successfully",
        "Represents a partition on a disk.",
        "Limit Working Set",
        "43026",
        "RDMAOutOctetsPerformanceCounterMissing",
        "This parameter indicates what should be done to errors found on the disk. If true, then errors are fixed.",
        "RunStartInterval",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|SearchList",
        "The ParentProcessID property identifies of the process that actuallycaused the event to happen.",
        "FX_TRACE_USB_IOTARGET Flag",
        "PASSWORDSTEALER",
        "This method is used exclude disks from the chkdsk operation to be run at the next reboot. If not excluded, chkdsk is performed on the disk if the dirty bit has been set for the disk. Note that the calls to exclude disks are not cumulative. That is, if a c",
        "Specifies the event category. This is source-specific information.",
        "ogical",
        "SetTargetResource",
        "Object Type Events",
        "PeerObjectName",
        "If false, content ratings settings are not customized.",
        "AllowFullScanOnMappedNetworkDrives",
        "55003",
        "TRACE_CLASS_SESSION Flag",
        "The SupportsParityCheck property indicates whether parity checking is supported on this serial port.",
        "Settings name value pairs in formt : <name1>,<value1>;<name2>,<value2>;...",
        "Enable Desktop Channel Bar By Default",
        "51001",
        "The Description property provides a textual description. ",
        "Disables PacketDirect on the network adapter.",
        "EngineVersion",
        "{9E77A308-6B82-4fc1-AB41-0A55867C35C2}",
        "Event Identifier",
        "C_89B3BC9F91AF19FD95569CEC4AE8264DCAA2B513E756CCAD927560FA5C73CDE5",
        "MCA add-on card",
        "The value for this environment as a formatted string.",
        "The volume specified does not originate from an iSCSI disk.",
        "The state change of the alert.",
        "NDIS Dot11 Link Quality Status Indication",
        "CD_6B87A2FD09C6892F4F975A26E2D24DFF27E8D9BD67B9DB050A7E8D7BE4DA7F6F.0.2028764097.902",
        "LargestFreeExtent",
        "WMI|Win32_NetworkAdapterConfiguration|IPFilterSecurityEnabled",
        "C_B15F1C934A00B71F41A13FBABA86A8403DDA67EC134BBA1DA3DF829F95422809",
        "Specifies an array of LUIDs and attributes.",
        "CIM_DiskDrive",
        "Hello",
        "ExcludeFromAutoChk",
        "Number of colors supported at the current resolutions.",
        "LPCDRVR_TRACE_RESERVED_0e",
        "The Column number of the memory error location",
        "NdisMediaStateDisconnected",
        "UnjoinDomainOrWorkgroup",
        "Bid2Etw_RowsetHelper_1_Trace_TextA",
        "session.",
        "SupportsIntTimeouts",
        "MIF.DMTF|Redundancy Group|001.2",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1480.269741312.368",
        "ATA-2",
        "Maximum block size, in bytes, for media accessed by this device.",
        "object:ISCSI_LUNList",
        "File Operation End",
        "StandardSecond",
        "NormalMax",
        "Microsoft Windows Server 2008",
        "S_1_5_21_3968686040_3210279463_847977608_1000",
        "MSFT_TaskIdleSettings",
        "A copy of the 'previous' class definition whose change generated the Indication. PreviousClassDefinition contains an 'older' copy of the class' information, as compared to what is found in the ClassDefinition property (inherited from ClassIndication).",
        "This class extends LogicalElement to abstract the concept of an element that is enabled and disabled, such as a LogicalDevice or a ServiceAccessPoint.",
        "AllowInstallationOfMatchingDeviceIDs",
        "Describes an instance in time as returned by Win32ClockProvider.  When a query is submitted to the Win32LocalClockProvider, the results are returned as Win32_LocalTime objects with times matching the query.  These are returned as part of __InstanceModificationEvents",
        "The SAP(s) that are hosted on this system.",
        "Win2k",
        "Loss of Frame",
        "C_490405DFECEDBAF0721E3F7C59E6937997D0E58587EF6B9AA2763981C1499E86",
        "Lock Control",
        "Version Mismatch",
        "RSOP_PolmkrFolderOptionSettingVista",
        "Cache DRAM",
        "MSNdis_WmiHDSplitCurrentConfig",
        "The NoWriters property indicates whether the shadow copy was created with the involvement of shadow copy writer components.",
        "Values: TRUE or FALSE. If TRUE, the partition is active.",
        "CD_DFC25D46E8711DD4634FF6390AFD6E0F348F88B4F5FAE966D405DF4EAE83DD54.1837.1.12858",
        "MessageEncodingBindingElement ",
        "52000",
        "Invalid",
        "Mobile",
        "RestrictAppDataToSystemVolume",
        "4 - LocalTalk",
        "Medium / Client Compatible",
        "ContinuouslyAvailable",
        "ShowCmd",
        "Values: TRUE or FALSE. A value of TRUE indicates this instance represents an address alias.",
        "I_F29B7A2DDA607A820C01A6084774262633A7D7048E9240AF094D62E3ACEE7413.1936.2270089716.202",
        "object:MSFT_HealthRecord",
        "IsUnicode",
        "obsolete.",
        "SamQueryInfoDom_End",
        "Self-test execution status byte",
        "Example: \\\\Device\\Harddisk0.",
        "UnoptimizedSize",
        "Example: A single piece of hardware containing a processor, bus, memory, and basic system interfaces",
        "The GroupComponent reference represents the computer system containing the user account.",
        "ConfigurationItem",
        "object:MSNdis_TcpOffloadParameters",
        "PdbName",
        "External Modem",
        "WMI|Win32_VideoController",
        "Serial Port 16450 Compatible",
        "cyclic integrity checksums that can be negotiated for the header digests",
        "ApprovedTime",
        "DisableInboundNotifications",
        "MSFT_LocalizablePropertyValue",
        "SrkADThumbprint",
        "30BF42F687579F4795E6FAE9D6D60CF7B02015DD6EAA0272.2642.837909254.263",
        "{B2CF76E3-B3AE-4394-A01F-338C9870E939}",
        "An array of free-form strings providing more detailed explanations for any of the printer features indicated in the Capabilities array. ",
        "ACPI control and status",
        "RefreshFrequencyMins",
        "This method allows a user to perform certain maintenance tasks on the physical disk. ",
        "Specifies the printer to encode on the NFC tag, by NfcTag object (as returned from read-printernfctag)",
        "The method\\'s return code should indicate the success or failure of the quiesce. It should return 0 if successful, 1 if the request is not supported at all, 2 if the request is not supported due to the current state of the Device, and some other value if any other error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are \\'translated\\' may also be specified in the subclass as a Values array qualifier.",
        "Device URL for directed discovery used for a WSD port, this parameter can not be specified at the same time with IppUrl",
        "PreventInstallationOfMatchingDeviceIDs",
        "Initiator-defined portion of the iSCSI Session ID",
        "Sint32",
        "SupportsBroadcasting",
        "ExpectedLife",
        "Specifies if result  of the cmdlet should be displayed",
        "Currency",
        "An array of integers specifying the registry keyword values used to represent a parameter of the \"enum\" type.",
        "Setting Definition Value",
        "Win32_CDROMDrive",
        "Note:  The SE_LOAD_DRIVER_PRIVILEGE privilege is required on this class.",
        "detail",
        "DNSHostName",
        "IL_37ECB0FC067D850AC282384258FD54C71F901EB4FE0DA87DE18B8C19E1262A36.587.1.74409",
        "TunnelMachinesEmpty",
        "PromptForPassword",
        "Bid2Etw_MSDASQL_1_Trace_TextA",
        "CIM_DataFile",
        "ProtectionFromZoneElevationInternetExplorerProcesses",
        "Period in seconds to poll for failure prediction status",
        "Win32_LogicalFileAccess",
        "CIM_IKESAEndpoint.GroupId",
        "1 - 'Thin' means that the storage for the disk is allocated on-demand. ",
        "MSFT_WmiRegisterNotificationSink",
        "Internet Explorer Enterprise Mode Reporting Xml Site List",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_340CBE78ECDC147CC0D8E08D25E28D5812DD352A6020A7847860B23A3D747C84",
        "The WarningExceedNotification property indicates whether or not events will be written to the event log when warnings are exceeded.",
        "object:MSiSCSIInitiator_IKEPresharedKeyAuthenticationInfo",
        "Magneto-Optical Rewriteable (LIMDOW)",
        "Provider can create local target group",
        "Processor Frequency is the frequency of the current processor in megahertz. Some processors are capable of regulating their frequency outside of the control of Windows. Processor Frequency will not accurately reflect actual processor frequency on these systems. Use Processor Information\\% Processor Performance instead.",
        "WLANHC_FATMSM",
        "Registry override of the monitor descriptor",
        "Serial number ID",
        "LicenseCategory",
        "OplocksDisabled",
        "802.5",
        "TeamingMode",
        "The QoS capabilities currently enabled on the network adapter.",
        "KeepAliveTim",
        "ADOMD.1 formatted output (A)",
        "New Load Balance policy to be set",
        "The StandardBias property specifies a bias value to be used when daylight savings time is not in effect. This member is ignored if a value for the StandardDay member is not supplied. The value of this member is added to the Bias member to form the bias during standard time.",
        "RS-232",
        "R_A05B58817295181CBA7B676653ED97C1E23D591F86C20D99BF4C67B62E0E211D",
        "LUAInstall: error 0x00000005 setting flags [{944D4C00-DD52-11CE-BF0E-00AA0055595A}]",
        "NETIO_TRACE_INTERFACE Flag",
        "RSOP_IEToolbarButtonLink",
        "OperationalStatusDownInterfacePaused",
        "Thermal Sensitive",
        "object:MSFT_FileShareAccessControlEntry",
        "TR_WSD Flag",
        "ProxyServer",
        "MIF.DMTF|Temperature Probe|002.15",
        "DisableFeedsBackgroundSync",
        "CR_A810B8BCB28B4593289F5B14287BCC8F9F33A8E5A5BE4903C9226502B53FB3AA",
        "StagingPath",
        "LogHeaderFormat",
        "LUAInstall: error 0x00000005 setting flags [{71f3a4a2-dc3f-4ad1-a1ad-81e2109d4414}]",
        "TRACINGAPI",
        "Odd parity",
        "               ",
        "LPCDRVR_TRACE_RESERVED_0e Flag",
        "UmsDirectedSwitchStart",
        "The Tag property is a string that uniquely identifies the system enclosure.",
        "Pentium(R) 4",
        "The DeviceID property contains information that uniquely identifies the sound device.",
        "Is Blocking",
        "ProviderOperation_PutInstanceAsync",
        "AccountRealm",
        "BlockType",
        "DisallowNegotiateAuthenticationService",
        "PLATFORM_TRACE_RESERVED_10 Flag",
        "The resolution of the reading.",
        "AllowAutoConnectToWiFiSenseHotspots",
        "DebugMode",
        "I_E00A8EF4F74D23B882355F3A0D21293BA28C6F1C8A1BC8F9B30030B2F4330712.655.1.32485",
        "The NumberOfIndicators property indicates the number of indicator leds on the keyboard.",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmICMMethod ",
        "NetConnectionStatus",
        "object:Win32_SIDandAttributes",
        "The amount of time that the Job is retained after it has finished executing, regardless of whether it failed during execution. The job must remain in existence for some period of time regardless of the value of the DeleteOnCompletion property. ",
        "0x20a",
        "{c8eb5e5c-899c-11d2-819e-0000f875a064}",
        "Redirection Flags",
        "PNP_RESOURCE_WARNING_LEVEL Flag",
        "Indicates if the appdomain is the default appdomain.",
        "The Win32_SystemProgramGroups class represents an association between a computer system and a logical program group.",
        "BiDiScsiCommands",
        "ROOT\\cimv2\\TerminalServices\\ms_409",
        "Mask of processors in the same domain",
        "TRACINGCONTEXT Flag",
        "The StartName parameter passes the account name the service runs under. Depending on the service type, the account name may be in the form of \"DomainName\\Username\".The service process will be logged using one of these two forms when it runs.  If the account belongs to the built-in domain, \".\\Username\" can be specified. If NULL is specified, the service will be logged on as the LocalSystem account. For a kernel or system-level drivers, StartName contains the driver object name (that is, \\FileSystem\\Rdr or \\Driver\\Xns) which the input and output (I/O) system uses to load the device driver. If NULL is specified, the driver runs with a default object name created by the I/O system based on the service name.",
        "C_45F5A698FE1F369FCC9E35170EFC43E4DFBC18F38DA62C3D1FEF22A7B3B706DD",
        "SignatureUpdateFallbackOrder",
        "The members of the Collection.",
        "LS_CONNECTABLE_FEATURE_NOT_SUPPORTED",
        "This indicates the time in seconds before stale data will be moved off of this physical disk.",
        "The LocalDateTime parameter is the time to set.  This property may not be NULL.",
        "{8F22970F-2910-4baf-9B34-396F18318C17}",
        "Index of the icon",
        "The OldVersion reference represents the COM component with interfaces that can be emulated by the new version of the component.",
        "This enables WMI traces",
        "DESKTOP-HGH2VBT",
        "I_8DA716445EA26247BDCD502C872559133B29770F7B55AFBFF871D80915CA3DBD.710.1.40746",
        "Msft_WmiProvider_GetObjectAsyncEvent_Post",
        "CIM_OSProcess",
        "MEM_ERROR_STATUS",
        "WRITEABLE",
        "MDM_Policy_Config01_Update02",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2065.2755160865.368",
        "ImportOwnerAuth",
        "Although a System may be viewed as a Collection, this is not the correct model. A Collection is simply a 'bag' that 'holds' its members. A System is a higher level abstraction, built out of its individual components. It is more than a sum of its parts. Note that System is a subclass of EnabledLogicalElement which allows the entire abstraction to be functionally enabled/disabled - at a higher level than enabling/disabling its component parts.",
        "C_FF70EA848D8A2CED13D60639BCB9255AF55EB37BFFEA39ABBA5DBDB0C764B466",
        "AllowIPsecThroughNAT",
        "Number of multicast addresses enabled on the NIC.",
        "   /* Port Level Events */",
        "NDIS Status Link State Change",
        "NT image checksum (usually set at link time), as listed in the NT image header; it is a hash used to verify the image was not changed or it's the same.  Note: This is not a cryptographic hash, therefore it's weak.",
        "CD_244B2D44BCFE4686A8EB1967E3535273855A686C9B62600F3309068E24B5ABB8.249.1187248378.396",
        "C_B59B61CC7D9A09771322E31CC4E05FF1DCA2EFD4C76A82AC0B86177C3096E55B",
        "microSPARC II",
        "0xEFFF0041",
        "The platform architecture of the WDAC BidTrace setting. Possible values are '32-bit', '64-bit' or 'All'. The default is 'All'. This is the platform architecture on the remote machine if this command is executed on a remote CIM session.",
        "Example: A print document created by an Office 97 application",
        "The expiration date of this product's application.  After this date, the LicenseStatus will be Unlicensed, and cannot be Activated.",
        "MI_ERRORCATEGORY_INVALID_TYPE",
        "TS_TRACE_LEVEL_ASSERT Flag",
        "An HRESULT returned from the Issuance License (IL) authorization. ",
        "TM_APPSRV Flag",
        "MpsIpsecClient",
        "BiosCharacteristics",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\InprocHandler32[Default]",
        "User Offline",
        "The ProviderOperation_SetRegistrationObject property is currently not set.",
        "hotIconPath",
        "Recovery Point Objective indicates the maximum interval in which data might be lost. For synchronous copy operations, RPO is 0. For asynchronous copy operations RPO represents the interval since the most recent transmission of data to the target element.",
        "C_FC9E01349E08A98452DDAB16AF1AEDB5BCA867ACBFA422162975D70294A03F4B",
        "The DeviceName property is the name of the device",
        "CD_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396.1467.1.8981",
        " The OtherTargetOS property records the manufacturer and  operating system type for a software element when  the TargetOperatingSystem property has a value of  1 (\"Other\").  Therefore, when the TargetOperatingSystem property has a value of \"Other\", the OtherTargetOS  property must have a non-null value.  For all other values  of TargetOperatingSystem, the OtherTargetOS property is to be NULL. ",
        "I_FD7092A4531E1D5420328B4DF5F17D0BB4CCBF2A132542C00A61B45BBF11451C.394.1.26559",
        "SessionLimitType is an enumeration of the properties: 0 = ActiveSessionLimit, 1 = DisconnectedSessionLimit and 2 = IdleSessionLimitwhich specify the Maximum allowed time for Active Session, Disconnected Session NEVER for all three and Idle session limits and Value specifies the time in milliseconds. The call returns 0 for success in case of Server-Override mode and an error if the policy was set to Group policy.",
        "object:MSFT_NetAdapter_RdmaAdapterInfo",
        "EnclosureAwareDefault",
        "KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109",
        "ImpersonateCallerForAllOperations",
        "The sensor's threshold values specify the ranges (min and max values) for determining whether the sensor is operating under normal, non-critical, critical or fatal conditions.",
        "CD_AC74BA8CCBB8B7653E84CC3AAB6F43C1B7147F57F54B0A2F4FF0A55FCB7892BB.1201.1954791070.374",
        "This method returns all mount points and drive letters that can be used to access the partition.",
        "RSOP_PolmkrIE7Setting",
        "PartitionSize",
        "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
        "CR_5FDD5C517B158FA6F136FDA5163883910AF54452C20644A4B22DCE61A6AAF3A7",
        "The WINSScopeID property provides a way to isolate a group of computer systems that communicate with each other only.",
        "The SerialNumber property indicatesthe operating system product serial identification number.",
        "C_81E71CD6BF54F730FEDC98CAF91AFC2B597F2C22AEB0626A38F278436A564F49",
        "Limit Process Memory",
        "RecoveryAction",
        "I_5619F5F895C3D573343163A85231441998067CF9B7F0925D97380D29EEA3F575.423.1.33645",
        "Web report manager class inheriting from OMI_ReportManager class",
        "An integer enumeration indicating whether or not the SCSI controller provides redundancy or protection against device failures.",
        "C_532671ED26AC2835681FE0B122A526862616ED33CAB2C220F171DB7BD5AD8B02",
        "PreventCriticalErrorDisplay",
        "This field is a string representation of the physical disk's firmware version.",
        "MSiSCSI_ManagementOperations",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1475.418471363.292",
        "There is not storage element specified in input.",
        "Maximum number of outgoing outstanding read requests supported by the adapter If this field is 0, there's no adapter-wide limit. There is still a limit per queue pair, which is indicated by the NetworkDirectAdapterInfo.MaxOutboundReadLimit field.",
        "LocalName",
        "Invalid network number",
        "The list of desired data rates, in units of 0.5 Mbps",
        "R_E6F405501CF9EB51604EF826550E0336D9FF9DAB805C48FA3ECE279D5B21648A",
        "CIM_ConcreteCollection",
        "TargetGoal shall not be supplied",
        "CR_3863CF198183B50B73BF68A52390640EB8E4B2490D653E0A1079EFA26ABECE5A",
        "{6ACB028E-48C0-4A44-964C-E14567C578BA}",
        "ConnectionCountPerRssNetworkInterface",
        "The AdapterType property reflects the network medium in use. This property may not be applicable to all types of network adapters listed within this class. ",
        "D1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "RegisteredGuids",
        "PS_DnsClientNrptGlobal",
        "FADT DUTY_OFFSET",
        "P7&BZ",
        "C_0834413373BFA65FA8219E678F81DD2C215A5FF7D7CBAA4CCA4B0C24350A6C82",
        "DisableSecuritySettingsCheck",
        "Boolean indicating that the computer system, with its running operating system, support power management. This boolean does not indicate that power management features are currently enabled, only that the system is capable of power management.",
        "InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows",
        "LetAppsSyncWithDevices_UserInControlOfTheseApps",
        "Node WWN",
        "Custom Favorites",
        "{FC049DCE-DB29-11d2-85FC-0000F8102E5F}",
        "Killed (9) indicates that the job has been stopped by a \\'Kill\\' state change request. Underlying processes might have been left running, and cleanup might be required to free up resources. ",
        "IL_5430A0963BDFE45F48448BEFE49162AB9A7F5390BEE895620AB94C03956A31E5.805.1.36972",
        "MSFT_NetAddressFilter",
        "Failover operation requires subsequent failback",
        "Kernel Idle State Bucket Extended",
        "CreateGroupReplica only accepts empty groups",
        "MaxQueueGroups",
        "Is composite sync supported",
        "R_5F24F19683720FD1EB4928C01BE6B72971BB4F46F372476DC9706705301704D6",
        "mickeys",
        "{b809f4ff-3023-473c-971b-ab594429ea57}",
        "Proxy settings for VPN connection",
        "ListenBacklog",
        "Out of Hours Activity",
        "CIM_IKEAction.VendorID",
        "Invalid SendTargets response text was encountered",
        "An array of Supported group Operations.",
        "Microsoft iSCSI Initiator: LUN List",
        "{1008CCEC-7BFF-11D2-AAD2-006008C78BC7}",
        "NetworkPorts are often numbered relative to either a logical module or a network element.",
        "{0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9c}",
        "VirtualPorts",
        "IsOwnerClearDisabled",
        "PinnedForComputer",
        "Accesses",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_A111E7F89C1C848588C2514B9F7117AA41CDA991BF49D22CA3C7528AAAD3EBCBc121",
        "Example: field value for a processor voltage of 1.8 volts would be 92h = 80h + (1.8 x 10) = 80h + 18 = 80h + 12h.",
        "Example: 1255.",
        "VersionNumberLo",
        "object:MSNdis_NetworkShortAddress",
        "NdisStatusDot11LinkQualityIndication",
        "Dll directory path",
        "Win32API|Printing and Print Spooler Structures|JOB_INFO_4|pDatatype",
        "The VariableValue property contains the placeholder variable of a Win32 environment variable. Information like the file system directory can change from machine to machine. The operating system substitutes placeholders for these./nExample: %SystemRoot%.",
        "MDM_Policy_Config01_Start02",
        "HostedCacheServerList",
        "ForcedCommit",
        " The CIM_DirectoryAction is an abstract class that is used for directories to be managed. Creation of directories is handled by CIM_CreateDirectoryAction and removal is handled by CIM_RemoveDirectoryAction. ",
        "ModuleIndex",
        "CIM_IKESAEndpoint.VendorID",
        "PSLDebug Flag",
        "C_8966DB6657BC4B4A3A46AC2810F4B56EFAFFFCB04543E6C12475FF36464179F4",
        "SMBIOS_EVENT_TYPE is valid",
        "Paradyne EtherLoop 1",
        "Example: \\SystemRoot\\System32\\drivers\\afd.sys",
        "TM_PNP Flag",
        "WMI_TAPE_PROBLEM_DEVICE_ERROR",
        "CIM_RegisteredSpecification.RegisteredOrganization",
        "MGR_TRACE_SERVICE_KEY Flag",
        "ClientNetworkAddress",
        "The JobId parameter indicates the identifier number of the job.  This parameter is a handle to the job being scheduled on this computer.",
        "DisableDeletingUserVisitedWebsites",
        "CR_57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "RootPath",
        "Account for IPMI",
        "This field describes the supported usages of this physical disk.",
        "SCSI Controller management.  ",
        "SMBIOS|Type 9|Function Number",
        "CIM_MonitorResolution",
        "Resultant Path",
        "Msft_WmiProvider_CancelQuery_Post",
        "EnableByFolder",
        "Status register",
        "1FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "LoaderLockTriedAndFailed",
        "Example: <cr>",
        "UniqueProcessKey",
        "Select * from Win32_OperatingSystem",
        "Win32_DirectorySpecification",
        "Specifies a FQDN used to automatically select the current DA site.",
        "CD_125249D4EFFECBE0173319BB999B626A8F1F8DA26493B11A58923199699B3F45.2004.403303968.1334",
        "IPPortSecurityEnabled",
        "This method disables High Availability and Scale Out features of this disk. No data will be lost, however acces to the disk may be interrupted as part of this operation.",
        "NS_E1DD43413ED9FD9C458D2051F082D1D739399B29035B455F09073926E5ED9870\\KI_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C\\I_FB67BC9A01546DD2EFB6EFA6D39C716BA78CD1D0734C8AD4475883915EF8412Ca\\1057E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "The WakeUpType property indicates the event that caused the system to power up.",
        "The SetStringValue method sets the data value for a named value whose data type is REG_MULTI_SZ.",
        "Time Out Value",
        "MIF.DMTF|UPS Battery|001.1",
        "IL_6952BC8C6187412BA6F7CAEE56328B9DCA8AFF615B18BF7135EB8A91F51729F6.1020.2968348805.268",
        "LoginOtherFailRsps",
        "MSFT_iSCSITarget",
        "On Board Sound Connector",
        "MSFT_NetAdapterPowerManagement_WakePattern_TcpSyn defines settings for a TCP SYN wake pattern.",
        "AllowEmbeddedMode",
        "EnableStatic",
        "{C5BFFE2F-9D87-D568-A09E-08FC83D0C7C2}",
        "IPVersions",
        "Select * from Win32_DiskQuota",
        "0xC005006B",
        "The Win32_PortableBattery class contains the  the population of the DMTF|Portable Battery group, as defined in the DMTF Mobile Supplement to Standard Groups, v1.0 (section 3.3.23 of the SMBIOS spec) and describes the attributes of the portable battery(s) for the system.  The class contains the static attributes for the group and describes a single battery pack",
        "NdisStatusDot11ScanConfirmIndication",
        "CD_55301A82B2B0B70CEFF12C2EDFE569786052F57B0A795053DBC7F37A225FA709.1190.886250882.244",
        "CD_25245316A9D3FA38DB37C9B83D3D9B2E2A5C8AB3690AC27BD6B5746485DD433D.1202.189581785.564",
        "ApiSetResolving",
        "Memory Mismatch",
        "RemoteName",
        "The Hysteresis of the reading.",
        "IL_46525BAD3099F51458A5D518030526DE848A3DE564DD8816A47DE935CCD3FA82.2457.398566487.279",
        "CD_BE3C9A0F3A301859A6C844B2145A4F44B9BD768BEE695F45C60A8F416A0E9077.2105.3693214232.4674",
        "{899e7782-035b-43f9-8bb6-2b58971612e5}",
        "Suspend (3) stops the job temporarily. The intention is to subsequently restart the job with \\'Start\\'. It might be possible to enter the \\'Service\\' state while suspended. (This is job-specific.) ",
        "PhyIdentifier",
        "The latest time at which the printer will print a job, expressed as minutes elapsed since 12:00 AM GMT (Greenwich Mean Time).",
        "DOT11_MSM_SCAN",
        "RetransmitTime",
        "Controls whether Automatic template chooses between custom templates. - Disabled: Automatic chooses between Datacenter and Internet. - Enabled: Automatic chooses between DatacenterCustom and InternetCustom.",
        "MIF.DMTF|Temperature Probe|001.11",
        "NumberElements",
        "Minimum size of write cache for virtual disk creation",
        "PolicySourceBrokenConnectionAction",
        "IntranetZoneSecurityLevel",
        "The SID of the trustee",
        "The DHCPEnabled property indicates whether the dynamic host configuration protocol  (DHCP) server automatically assigns an IP address to the computer system when establishing a network connection.",
        "BusyAdjThreshold",
        "VpnCommonConfig",
        "The situation that triggered the installation of the application:  ",
        "object:MSFC_VirtualFibrePortAttributes",
        "Creates a storage tier template on the storage pool. This method is available only when the SupportsStorageTierCreation property on the storage subsystem is set to TRUE. If it is set to FALSE, this method will fail with MI_RESULT_NOT_SUPPORTED. This method is also not supported for primordial pools.",
        "{44795703-a61b-11d0-8dd4-00c04fc3358c}",
        "WMI Self-Instrumentation Event Provider",
        "Initiator Specific ID",
        "FragmentedSpace",
        "Specifies the name of the print driver to be associated with the printer.",
        "SetByCustomPolicy",
        "ref:MSFT_StorageObject",
        "LPC_TRACE_TIMER Flag",
        "RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows",
        "the event source that can report an event when this CSE is applying policy",
        "TRC_DETAIL Flag",
        "// This class exposes the boot configuration if the adapter is configured to",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSLOGONSETTING_Prov\"",
        "RDPSecurityLayer",
        "LS_CONNECTABLE_VALID_LS",
        "StageHint",
        "Indicates the default printer language. A language that is used as a default by the Printer should also be listed in LanguagesSupported.",
        "Stressed",
        "IsHeaderDigest",
        "#define SendRLS_OUT_RspBuffer_SIZE_HINT 28",
        "Localized version of RSOP_PolmkrApplicationSetting for American English",
        "last state request. Invoking the OnlineDevice method should set the RequestedState property appropriately.",
        "Number of rings before the modem answers an incoming call.",
        "ref:CIM_Chassis",
        "The DependentFiles property contains a list of dependent files for this printer driver.",
        "Association between a subsystem and replication capabilities",
        "0x2ff",
        "MSFT_NetIPHttpsConfiguration",
        "InboundInterface",
        "EVENT_TRACE_FLAG_VIRTUAL_ALLOC",
        "DataFormat",
        "Count of Session connection timeout error",
        "R_84F8BABB6CA8331C4E9169FA40BA6E129D7FC9914E1CFF1EF6A24C2F4E5BC1E2",
        "Win32_SecuritySettingGroup",
        "MsftDiscFormat2Tao_DebugDestructor Flag",
        "Pump Failure",
        "The Product property indicates the base board part number defined by the manufacturer.",
        "ValueQueries",
        "System board or motherboard",
        "This class provides the ability to detect a framework application and inventory of frameworks",
        "CcLine",
        "WSP_Volume",
        "CreatedMapping",
        "OctetString",
        "DistributedCache",
        "ADActivationCsvlkPid",
        "C_AA0B4A55EEE4C1E476A0BDD0D3A0653497872B02CC12BE52258AE7DCEF46F38E",
        "QueryDomainInformationPolicy",
        "ProcessorThrottleStateEvent",
        "ifHCInMulticastOctets",
        "MSNdis_FddiUpstreamNodeLong",
        "RemovePersistentEntry",
        "Win32Registry|System\\CurrentControlSet\\Services\\Class\\Defaule|drv",
        "TcpIp IPV4 Generic",
        "ProcessorAcpiCsdDependency",
        "C_9D6744533171E0AA4C64E98982376A00322E3135FA3701918441437BEC34C877",
        "DeCommitAddress",
        "MSFT_NetAdapterRscElementSetting",
        "tagDefault",
        "R_AD487B3FC9584EF96D3B725B40AB8D9F6B297B81317936773DEE6E58A169FE11.1489.184881139.570",
        "MDM_VPNv2_TrafficFilterList02_01",
        "ReadOnly",
        "DirtyReason",
        "{FAEE1471-5149-4a68-AC2C-BF96EC09F004}",
        "ReceiveSideScaling",
        "Win32Registry|System\\CurrentControlSet\\Services\\Class\\AdapterDescription|DriverDate",
        "Enforced",
        "Defines whether this is for instruction caching (value=3), data caching (value=4) or both (value=5, \"Unified\"). Also, \"Other\" (1) and \"Unknown\" (2) can be defined.",
        "Object size",
        "C_FBE6F235041E0E3AE3541BE5BCDC297FFC96D908B951996F32623E2BBA30BD16",
        "AccountManagement_AuditComputerAccountManagement",
        "extensionStatus",
        "{8502C572-5FBB-11D2-AAC1-006008C78BC7}",
        "Requests that the state of the job be changed to the value specified in the RequestedState parameter. Invoking the RequestStateChange method multiple times could result in earlier requests being overwritten or lost.",
        "TRACE_CLASS_HELLO",
        "ProductKey",
        "Select * from Win32_NTEventlogFile",
        "NDIS FDDI Long Permanent Address",
        "CD_45999BE1E716B224CDC60BBAEC2E4A9422A7548870411AB5310F9D9DCF7A8F92.18.2064360059.505",
        "HostedCacheHttpUrlReservationEnabled",
        "Example: 59",
        "User accounts to remove from the deny access list for the file share.",
        "EnableStatefulFtp",
        "RemoteAddress",
        "CachedInstanceExpiration",
        "Remaining number of times the sku can be rearmed successfully.",
        "Ndis802_11WEPEnabled",
        "Represents a disk image on the system.",
        "The Attributes property indicates the attributes of the Win32 printing device. These attributes are represented through a combination of flags. Attributes of the printer include:/nQueued  - Print jobs are buffered and queued./n Direct  - Specifies that the document should be sent directly to the printer.  This is used if print job are not being properly queued./nDefault - The printer is the default printer on the computer./nShared - Available as a shared network resource./nNetwork - Attached to the network./nHidden - Hidden from some users on the network./nLocal - Directly connected to this computer./nEnableDevQ - Enable the queue on the printer if available./nKeepPrintedJobs - Specifies that the spooler should not delete documents after they are printed./nDoCompleteFirst - Start jobs that are finished spooling first./nWorkOffline - Queue print jobs when printer is not available./nEnableBIDI - Enable bi-directional printing./nRawOnly - Allow only raw data type jobs to be spooled./nPublished - Indicates whether the printer is published in the network directory service./n",
        "FinWait2",
        "ref:MSFT_NetFirewallRule",
        "RS232",
        "NEC PC-98",
        "Heap Allocate",
        "Synchronous DRAM",
        "SessionDirectoryActive",
        "Win32_WIN32_TSLOGONSETTING_Prov",
        "DeviceHardwareData",
        "Win32API|Network Management Structures|USER_INFO_2|UF_DONT_EXPIRE_PASSWD",
        "An array of addresses, subnets, ranges, or some of the following tokens: Any, LocalSubnet, DefaultGateway, DHCP, WINS, DNS, Internet, Intranet, IntranetRemoteAccess, PlayToTargets.  The 'Any' keyword may only be used by itself.",
        "CurrencyArray",
        "Message to be inserted into the log file",
        "OtherIdentifyingInfo captures additional data, beyond asset tag information, that could be used to identify a physical element. One example is bar code data associated with an element that also has an asset tag. Note that if only bar code data is available and is unique/able to be used as an element key, this property would be NULL and the bar code data used as the class key, in the tag property.",
        "Total Percent Fragmentation",
        "GetOperationCounterInstanceName",
        "AGP8X",
        "000005",
        "The Sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If the CurrentReading is between UpperThresholdCritical and Upper ThresholdFatal, then the CurrentState is Critical.",
        "Sets the ambient light sensor brightness value",
        "SMART capability",
        "APPLE",
        "CD_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C.0.745213410.239",
        "This field describes the intended usage of this physical disk within a concrete pool. Storage pools are required to follow the assigned policy for a physical disk. ",
        "C_91272CCB786B80704637F2DA5FEC31804C0D45A10039A155AE9DF9B9224919E1",
        "80-956A",
        "ClusterNodeName",
        "Win32_AssociatedProcessorMemory",
        "CR_5736C87A30783FE64957593D8F34FF03FFA145529E369A853C7692EB2B1E8349",
        "Win32API|Device Input and Output Structures|DISK_GEOMETRY",
        "SupportsSnapshotLocal",
        "ALLOW",
        "CR_ED0FE1836A8A43CE00507F00708D770A7EF86A8D404DA2B6D5FE190709C3FC86",
        "BoundedEcpWriteCount",
        "Msft_CliAlias.FriendlyName=\"RDAccount\"",
        "This is the time threshold, in hours, after which the profile health is reported as Caution when the profile has not been downloaded yet",
        "Win32_DiskDrive",
        "Specifies the file or folder to be hashed",
        "WMI_CHANGER_PROBLEM_WARNING",
        "RoutineAddr",
        "SizeHigh",
        "Qualified",
        "UMDF - Driver Manager Trace",
        "Win32_DeviceMemoryAddress",
        "TSClientTrace",
        "Brightness",
        "4      This device is not working properly. One of its drivers or your registry might be corrupted. ",
        "NdisAtmMaxAal0PacketSize",
        "AutomaticMetric",
        "S4uErr",
        "Name of the Session Layer protocol. Example: Microsoft RDP 6.0.",
        "ConfigurationStatus",
        "LocalAccount",
        "The SpecificationVersion property indicates the version number of the initialization data for the Win32 display device.  ",
        "{93545055-ab4c-4e80-84ae-6a86a2dc4b84}",
        "SECRCW32",
        "4477CA66979EB36A4812EB84064B57FCF10A17595E6D43320B7012BE2EEBF12B",
        "SM_RemovePersistentBinding",
        "Callback Number",
        "NS_822BF93DF9C3C1C79665F622BFB88ADE1B36A57966014C1ECF6C9DBE68DBADA5",
        "FileIo_PathOperation",
        "0xD00C - 'Not Reported' ",
        "CostedNetworkBehaviorForegroundPriority",
        "DefaultTime2Wait",
        "InstallLocation",
        "Excessive Error Rate",
        "UCS-2",
        "EnableSecuritySignature",
        "Win32Registry|HardwareInformation.DACType",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightDate|wMinute",
        "PolicySourceStartIn indicates whether the property StartIn is configured by Server (0),Group Policy (1), Default (2).",
        "Dynamic",
        "The Name property indicates the name of the system account on the domain .",
        "The maximum transfer unit (MTU) size the network adapter supports. This value does not include the size of the link-layer header.",
        "Glide Point",
        "Before Delta",
        "Dissolve",
        "Number of kilobytes of virtual memory. For example, this may be calculated by adding the amount of total RAM to the amount of paging space (i.e., adding the amount of memory in/aggregated by the computer system to the property, SizeStoredInPagingFiles.",
        "ConfigurationParameters",
        "A free-form string that provides implementation-specific status of the action.",
        "ref:MSFT_StorageJob",
        "CIM_PhysicalElementLocation",
        "IL_A600B813C3AEE4D495996259138D2BE996C368532199D64507DCA6E373C2D027.779.1.56137",
        "NetworkName",
        "MIPS Family",
        "SamOpenDomain_Start",
        "Synchronization method",
        "Fluid Ounces",
        "3 - Server",
        "C_0A4A77B99E06085632BB6F0B20A342FB9C17A36A3889D5E85FF4837055C41CA3",
        "EnabledKeyingModules",
        "The ProcessId property contains the global process identifier that can be used to identify a process. ",
        "27 - CIM_ERR_SERVER_LIMITS_EXCEEDED. The WBEM Server limits have been exceeded (e.g. memory, connections, ...).",
        "IgnoreMOAppDownloadLimit",
        "CIM_StorageError defines blocks of media or memory space that are mapped 'out of use' due to errors. The Key of the class is the StartingAddress property of the bytes in error.",
        "Supporting Entity in Error",
        "__ClassDeletionEvent",
        "The VoiceSwitchFeature property contains the command strings used to activate the voice capabilities of a voice modem.",
        "ISCSI_ERR_TDI_CONNECT_FAILED",
        "NS_3FBDCB08ECD33FBEF028D2DB3EF058F8CE959779B943F43AB3DB3EC34ACA147D\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_B4BE796E49BD940EF3233AA1E20E02F74C49D58803EFB7DC7A8BF19657D6854C",
        "P$m;P$m;",
        "NdisReceiveBlockSize",
        "The alarm device for the package. ",
        "MsftDiscMaster2_DebugGeneral Flag",
        "WSManAutoFlow Flag",
        "IP-HTTPs tunnel interface",
        "RowsetHelper.1 formatted output (A)",
        "FadtC2Latency",
        "The URI at which the privacy notice is located.",
        "LPCDRVR_TRACE_RESERVED_1b Flag",
        "NumAllocatedVFs",
        "The Win32_HeatPipe class represents the properties of a heat pipe cooling device.",
        "{f8f10121-b617-4a56-868b-9df1b27fe32c}",
        "The SelfRegModules action processes all the modules in the SelfReg to register the modules, if installed.",
        "Indicates the USB protocol code.",
        "Vendor defined device ID",
        "_PROVIDERS_",
        "\\\\.\\root\\Microsoft\\Windows\\DesiredStateConfiguration:__Win32Provider.Name=\"dsctimer\"",
        "Creates a shadow copy for a volume using a named context. Supported contexts are 'ClientAccessible' and 'NASRollback'. Example: SHADOWCOPY call create 'ClientAccessible', 'd:'",
        "This property provides the status of antivirus",
        "Wudfx02000_KmdfTraceGuid",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.2804936995.180",
        "PowerManagementCapabilities",
        "Travan",
        "Public",
        "0xEFFF004B",
        "PaperTypesAvailable",
        " Adaptec",
        "11050",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|Modulation_Bell",
        "IL_E0F2EFD539B7928A3CD461462D4CD79A5C30C390909F42CDB98D7B4B987E4A6E.715.1.265536",
        "Process_V0",
        "Digital Audio Filter Driver Information (redbook)",
        "SDBUS_DEBUG_DEVINIT Flag",
        "SessionIdentifier",
        "AutoCacheSizeInMB",
        "The type of PolicyStore where this dynamic keyword address originally came from.",
        "Material Supply Exhausted",
        "The ICMMethod (Image Color Matching Method) property specifies how ICM is handled.  For a non-ICM application, this property determines if ICM is enabled or disabled.  For ICM applications, the system examines this property to determine which part of the computer system handles ICM support. ",
        "tm_mday",
        "Win32_TimeZone",
        "CIM_EnabledLogicalElementCapabilities.RequestedStatesSupported",
        "Failing back",
        "RSOP_PolmkrPowerSchemeSetting",
        "The RouteRecordResolved property holds the resolved address corresponding to the RouteRecord entry.",
        "S-1-2-0",
        "TraceIoctl Flag",
        "Searches",
        "RemoveIntent",
        "LastRunPercentFragmentation",
        "Example: 0",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|EnableDNS",
        "Reverse Roles",
        "{17087075-EB55-4FCC-ADAB-79B04E16ED04}",
        "An ordered list of storage objects that are to be a part of the target Replication Group.",
        "DirectConnectLicenseServers",
        "WMI|Win32_NTDomain",
        "HBAStatus",
        "TransactionFlow",
        "The effective setting of auto-tuning level. This can be one of the following value:  - Local: the effective auto-tuning level is from the local setting  - GroupPolicy: the effective auto-tuning level is from the group policy setting",
        "This relationship associates a CIM_Dependency with one or more CIM_Configuration objects. For example, a computer system's dependencies could change based on the site/network to which the system is attached.",
        "The SIDType property contains enumerated values that specify the type of security identifier (SID). ",
        "CPU that reported the error",
        "LpcMore",
        "AbsolutePathToPackage",
        "Engine Failure",
        "ServiceMetadataBehavior",
        "The LogRecord object can describe the definitional format for entries in a MessageLog, or can be used to instantiate the actual records in the Log. The latter approach provides a great deal more semantic definition and management control over the individual entries in a MessageLog, than do the record manipulation methods of the Log class. It is recommended that the data in individual Log entries be modeled using subclasses of LogRecord, to avoid the creation of LogRecords with one property (such as RecordData) without semantics. ",
        "CR_D3C4DFA37F26EE4C7CA31BA9B8E724B042DE4802517C8F5FAFF10A17FF77557F",
        "MSNdis_NotifyVcArrival",
        "C_642EBC67FF61EFF34AD21679C796E3CB07BEBCB918B03A2FC1E43AD624F651E4",
        "The StandardHour property specifies the hour of the day when the transition from daylight savings time to standard time occurs on this operating system.",
        "RemovalType",
        "WSP_StorageHealthStatusChangeEvent",
        "RoutingDomain",
        "Registration Key with which to register with the Pull Server",
        "Disk IO",
        "AWE64PNP",
        "Image_Load",
        "205-28",
        "ROOT\\StandardCimv2\\MS_409",
        "AccountLogon_AuditKerberosServiceTicketOperations",
        "Retrieves RDS Server Version",
        "NUMA Scaling Static",
        "SPACES_StorageScaleUnit",
        "RedirectionType",
        "R_3E0A397671AEE86972BB6BD15E62EEDC01E7A1AE56914FF674DADFD530B32274.2469.4236235804.558",
        "Win32_OfflineFilesAssociatedItems",
        "FragmentedDirectories",
        "IL_33E04994CA4A70429FE677E9D3FD3A84A89CF8D3D2921E1207010996980144D0.311.4076504440.249",
        "ErrorDescription is a free-form string supplying more information about the error recorded in LastErrorCode, and information on any corrective actions that may be taken.",
        "typedef enum {",
        "object:MSFT_Rule",
        "13 - 'Lost Communication': The storage provider has knowledge of the volume and has contacted it successfully in the past, but the volume is currently unreachable.",
        "EnabledState is an integer enumeration that indicates the enabled/disabled states of an element. It can also indicate the transitions between these requested states. For example, shutting down (value = 4) and starting (value=10) are transient states between enabled and disabled. The following text briefly summarizes the various enabled/disabled states: ",
        "SpecifyShellTimeout",
        "C_9DC0A5652B71803D627A0DEBBA10D1832C8C71C7B53C3FDE13C8544A09726631",
        "MSNdis_MaximumLookahead",
        "RootObject",
        "This method for a given ReplicationType returns the supported Operations on a GroupSynchronized association that can be supplied to the ModifyReplicaSynchronization method.",
        "Logging disabled for a specific event type. Too many errors of the same type received in a short amount of time",
        "NumericSensorBaseUnits",
        "CD_F4ABAF574BE7C40EF2484F3F003F0DE1713CC64EFD2AA983D8543B07B49C826C.1805.2702794983.426",
        "MIF.DMTF|System Cache|003.13",
        "iScsiDebug26 Flag",
        "CD_103563D59E224884B92C8B7934BDD6592D64C63C0FEB52D1B636E2F48012EA04.2154.1311828558.1813",
        "Above_Normal",
        "Indicates if only one session is allowed per user.",
        "WerTelemetryOptIn",
        "select * from SPACES_HealthActionEvent",
        "Hypercall Page Address",
        "Detached_Process",
        "64-bit Alpha PC",
        " 0 - 'Healthy': TBD.",
        "0xD01D",
        "List of template schemas supported",
        "MinPerfState",
        "_PARAM",
        "Storage alert event",
        "If the UserName parameter specifies an account name, the Password parameter must point to the password to use when connecting to the domain controller. Otherwise, this parameter must be NULL. /nPassword and Username must use a high authentication level (i.",
        "EnableByPath",
        "Import Current Connection Settings",
        "WSP_ReplicationGroupStorageArrivalEvent",
        "The name of NT Eventlog logfile.",
        "An ordered list of storage objects that are to be a part of the source Replication Group.",
        "PublishUserActivities",
        "C_3417EC6F6FDD4AD6ADF59EE04391675B6783F7D8A26A76EDF8D519610D0392D6",
        "A8871E5F73225A8D681F66B8151B7C200C46C518C50.1462.1027896524.253",
        "Injection",
        "C_18A46D7BB56A85A77A8B14FC7C4A83D15E2F885E67C71399BAA10EFBE87C920E",
        "FileId",
        "ContextBindingElement",
        "// information about the security expectations of a target portal and",
        "Set iSCSI IKE Information",
        "LoggerName",
        "_[EUn",
        "Ndis80211NetworkTypeInUse",
        "Threshold",
        "NDIS Media Connect Status",
        "WeeksOfMonth",
        "The type of the behavior.",
        "SearchProviderList",
        "General",
        "UpperThresholdFatal",
        "Extended Mode target SPN",
        "I_1652B601D82CAC4E6C305F6382CD81E4E2F42654A09F9F1E0967D6CB0B8A7D26.2709.2899149957.291",
        "DisableRestorePoint",
        "R_C013BAEF52C1702952D5C4A7F180A34E20C7F843E3022D39040318DA1B2232C2",
        "CIM_HostedFileSystem",
        "PLATFORM_TRACE_RESERVED_15",
        "PathOrFolder",
        "{5ec1035a-a61a-11d0-8dd4-00c04fc3358c}",
        "MSNdis_80211_NetworkType",
        "NS_2EEEF6086B5AA3148DE8DC3E7A7263A417EE849A276BDB357874FDEB8ADED318\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_614FEB5198DB6356C7D4E70E58F0634936BC6DE530AA5FD952207E56B5A89D3F",
        "Heap Expand",
        "SystemConfig_V2_LogDisk",
        "NetBIOS name of node at time of configuration.",
        "Synchronous Snapshot Local",
        "Enhanced Security Settings",
        "Volume lock failed",
        "Specifies a bitmask indicating the capabilities offered by the provider. This member can be one of the following values",
        "CD_A50F2C71334A2A338CC6F1C013DEEB31B3684F92B727656C378E98BCCF3ADD1F.2060.128139322.590",
        "ref:HNet_PortMappingProtocol",
        "EVENT_TRACE_FLAG_QUERYSECURITY",
        "{FAF76B5D-798C-11D2-AAD1-006008C78BC7}",
        "This property has been deprecated in favor of a corresponding property(s) contained in the Win32_VideoController, Win32_DesktopMonitor and//or CIM_VideoControllerResolution",
        "MSFT_VirtualDisk",
        "BinaryModeEnabled",
        "defaultDialUpConnection",
        "MS_NT_EVENTLOG_EVENT_PROVIDER",
        "User Context",
        "Specifies the key that contains the named value to be set. ",
        "AllowInboundEchoRequest",
        "VideoModeDescriptor",
        "C_361D98FB17C2BCDC621D6A7CFCE49AF430F4AC02365C7EBFB53223536307BD5A",
        "MSFT_TargetPortal",
        "S4U Trace Flag",
        "B5-Envelope",
        "CQError performance counter missing",
        "TR_CACHE",
        "original_error",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_comment",
        "PolicyRuleName",
        "VESA DPMS Standby support",
        "TraceListenerArguments",
        "Example: atapi",
        "73 - Invalid domain name",
        "Describes the action the operating system will take when a new disk is discovered on the system. When a disk is offline, the disk layout can be read, but no volume devices are surfaced through Plug and Play (PnP). This means that no file system can be mounted on the disk. When a disk is online, one or more volume devices are installed for the disk. ",
        "The BitsPerPel property contains the number of bits per pixel for the output device printer.  This member is used by display drivers and not by printer drivers.",
        "ref:MSFT_Volume",
        "Msft_CliAlias.FriendlyName=\"RDToggle\"",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|AutostartWin9X",
        "object:MSFT_FileShare",
        "tenths of revolutions per minute",
        "ThreadSetName",
        "SettableDataBits",
        "No policy",
        "Win32API|File System Functions|SetVolumeMountPoint",
        "SINT32",
        "JIS B0",
        "DeadGWDetectEnabled",
        "The security settings of an object",
        "jAIqa2U",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1131.2861187749.180",
        "Path of the .JS, .JVS, or .PAC file used for auto-configuration.",
        "The Caption property is a short textual description (one- line string) of the object.",
        "certIndex",
        "This method allows the physical disk's attributes to be updated.",
        "There is no connection available in the iSCSI session to process the request.",
        "RSOP_IEConnectionDialUpCredentialsLink",
        "LaunchProviderHost",
        "If this object is retrieved from the ActiveStore, with the TracePolicyStoreSource option set, describes the type of PolicyStore where this rule originally came from.",
        "This class encapsulates a VM Network Adapter, that corresponds to a port on a virtual switch, on which the traffic is to be captured.",
        "SamUserPwdSet",
        "56005",
        "IsNumericalPasswordValid",
        "The address of the peer custom resolver.",
        "Frame Relay Service",
        "Spooling",
        "Rename",
        "The SupportsGuaranteedBandwidth property indicates whether the protocol has a mechanism to establish and maintain a guaranteed bandwidth.",
        "Percent",
        "SampledProfileInterval_V2",
        "I_0BE16089DDC1582CDB25043DB42CD7AE12C51808071C234ECBB1734648B1CD8B.659.1.73443",
        "Processor Performance Information",
        "Voice DID",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_317D1F2687177AFA27CB8EA6F6A360902286E215810936DE250861D000157F69aed571140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "MDM_Policy_User_Config01_Education02",
        "C_8688B6B3A5AFA46698CC5C2A2A938F01175B6D9F4A0E5E74F0C3AA6D73897983",
        "AddDirectConnectLicenseServer",
        "IPv4 Default Gateway of the target PCSV device",
        "PciDeviceLabelID",
        "ref:MSFT_NetConSecRule",
        "CreateVirtualPort",
        "wsp_fs",
        "{0381564e-d5cb-4e48-ab35-be24389b0f59}",
        "FileIo_Create",
        "WD_LOG_FLAG_RPC Flag",
        "Selects the best local IP address and best route to reach the specified remote address.",
        "Count of instance names associated with this PnPId",
        "CD_B4352AE5BAF16E9168697F87BE74E2D35A37557397C95E650D63E6588187DC82.1802.3432748852.326",
        "Leaks",
        "Trace information from the constructors",
        "DOT11_MSM_SECURITY_PKT Flag",
        "CDDA Supported",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|ConfigDialog",
        "CategoryId",
        "information",
        "FILE_DELETE_CHILD (directory)",
        "46009",
        "LastBackgroundRegistryUploadTime",
        "154433EAFBBEC9AFF6B03CD94FB6D01B32C68CCEA476ACECCD0DB049A6CD.2668.2340397220.283",
        "WebHttpBehavior",
        "SMBIOS|Type 7|Maximum Cache Size",
        "Non-Recoverable Error",
        "MsftMultisessionSequential_DebugGeneral Flag",
        "I_DE468BF74FB57C16C2FE0AF90126FE83C9B098410A7D38A4977B5C5D80E7C5B5.797.1.60719",
        "PeakVirtualSize",
        "SAM Password Change",
        "BytesToLanPeers",
        "Megabytes",
        "The CIM_PhysicalMedia class represents any type of documentation or storage medium, such as tapes, CD ROMs, etc. This class is typically used to locate and manage removable media (versus media sealed with the media access device, as a single package, as is the case with hard disks). However, 'sealed' media can also be modeled using this class, where the media would then be associated with the physical package using the CIM_PackagedComponent relationship.",
        "Starting",
        "CD_0A6750C7348B537B441FD2B8326BDF41C8B5D59AA69254D1D9F804769C8106B9.2098.643799999.3372",
        "MGR_TRACE_RESERVED_19",
        "Windows Winlogon Trace",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmOrientation",
        "Windows Server 2003, Small Business Edition Restricted",
        "CR_22E55A76AF91714908793A9D6F196391BDBB704CE7B4C27172941A36699A38A0",
        "RDMA statistics supported by a network adapter",
        "This method retrieves the extended status information for an unsuccessful job.",
        "Kernel Processor Performance States",
        "MDM_Policy_Result01_Security02",
        "R_CF8C5D2298E729B081D1C131BD290A9E84673DFED35C60023220564D66F04E17",
        "Windows 2000",
        "MsftDiscFormat2StreamConcatenate",
        "(vendor specific)",
        "UserConfigurationProvider",
        "Capabilities and management of NV Storage. Non-volatile memory natively includes flash and ROM storage. In addition, NV memory can be BasedOn VolatileStorage, if the volatile memory is backed by a Battery. This scenario would be completely described by an instance of the AssociatedBattery relationship, referencing the NonVolatileStorage as the Dependent and the Battery as the Antecedent, and an instance of the BasedOn relationship, referencing the NonVolatileStorage as the Dependent and the VolatileStorage as the Antecedent.",
        "F6B75FDB41F487B4FC2AD.1185.640681428.4905",
        "FailureTime",
        "Pending reboot due to threat action",
        "iScsiFlagQueue",
        "ExecutionStatus",
        "The XSize property specifies the width, in pixels, of the window if a new window is created. For GUI processes, this is used only the first time the new process calls CreateWindow to create an overlapped window if the nWidth parameter of CreateWindow is CW_USEDEFAULT.  Note, XSize and YSize cannot be specified independently.",
        "    MachineCertificateIssuerFilter (X509Certificate2) Specifies the Certificate Issuer filter for machine certificate selection",
        "Disable Context",
        "File Kernel Trace; Operation Set 1",
        "// Miniports can fire this event to cause eventlog entries to be",
        "ref:RSOP_GPO",
        "TRACE_LEVEL_CRITICAL",
        "Directory Service (DS) flag indicating that the domain controller is running the Windows Time service for the domain.",
        "ProcessorRevision",
        "ReTrim",
        "{FAF76B5A-798C-11D2-AAD1-006008C78BC7}",
        "{B58D172E-DB31-11d2-85FC-0000F8102E5F}",
        "TargetName specifies the iSCSI target name on which the boot device resides.",
        "This property is a reference to an instance of a collection of managed system elements.",
        "The Element reference represents the properties of a computer system where this setting can be applied.",
        "3 = Removed by admin, ",
        "The DeviceSpecificPens property indicates the current number of device-specific pens. A value of 0xFFFFFFFF means the device does not support pens. Pens are logical properties that can be assigned by the display controller to display devices, and are used to draw lines, borders of polygons, and text.",
        "Disables the UDP Segmentation Offload (USO) properties on the network adapter.",
        "ForceTouchKeyboardDockedState",
        "EapolRequestIdMessage",
        "{8BB5B3EC-E1F7-4b39-942A-605D5F55789A}",
        "ThreatStatusErrorCode",
        "WMI|Win32_Desktop",
        "USBVersion",
        "Target element can be removed from group",
        "ref:CIM_SupportAccess",
        "CD_06BAA5D4669A9FF5B5FD35414B6353315AC4BB24F6507E6658FAA9831018BDC5.1332.1049198791.227",
        "QuotaRetryWaitInterval",
        "Boolean indicating that the power supply is a switching (vs. linear) supply.",
        "PciCurrentSpeedAndMode",
        "CD_04992E5C7CE2295E6031900D8FF9DBAC52E8ECD5C3C6E6D474AD88FAEE2D3163.2541.2674541117.530",
        "TRACE_CLASS_PACKET",
        "RemoteChangeTime",
        "ApiMore",
        "Persist",
        "This field indicates the logical sector size of the storage pool, in bytes. This value is derived from the backing physical disks, as well as the preference specified at the time this storage pool was created.",
        "MobilityCenterTrace",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_481C5641FC31ECDFEDB9CC27B9B4AC9E3EDA5479D72ABC3676DE78027620D064",
        "MCA_ERROR_PCI_BUS_TIMEOUT_NO_INFO",
        "This class is used to report RSC capabilities on a network adapter.",
        "DormantFileLimit",
        "Requires full discovery of target ComputerSystem",
        "FRU ordering information.",
        "GuaranteesDelivery",
        "IPv4HashEnabled",
        "#define ISCSI_LOGIN_OPTIONS_HEADER_DIGEST               0x00000001",
        "Setting value",
        "DB-36",
        "Path Not Found",
        "C_3447964AD4B51A40682639E2C45B8A122022C3FEC3E3B3FE7276444680D9A4BB",
        "C_F495BAA939384D98D2E8F4D62F1C4774C029EAB6F5263F63DE034CE1A8FB2CB7",
        "OLEDB.1",
        "Always dial my default connection",
        "RemovableDrivesRequireEncryption",
        "PanelDefaultModeDocked",
        "Retransmit",
        "Restricted",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.493323525.180",
        "A string that uniquely identifies the type of fault.",
        "Removing From Pool",
        "Context Switch Event",
        "LUAInstall: error 0x00000005 setting flags [{73C037E7-E5D9-4954-876A-6DA81D6E5768}]",
        "HttpsGetUrl",
        "The physical package whose environment is cooled.",
        "rasDialParamsDataSize",
        "The weight of the physical package in pounds.",
        "Describes which policy the server uses in order to retrieve the connection settings.",
        "object:MSNdis_PMAdminConfigState",
        "Win32Registry|HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\MultifunctionAdapter|Identifier",
        "This class provides security health metrics on the device",
        "Drive Requires Cleaning",
        "The BaudRate property indicates the baud (bits per second) rate at which the communications device operates. ",
        "MapViewEnd",
        "Bid2Etw_ODBCBCP_1_Trace_TextW",
        "IntranetSecurityZoneEnabled",
        "Indicates if the Adapter supports segmentation of a packet containing TCP options.",
        "ExportStore",
        "Volume write protected",
        "OldCpuPriority",
        "The number of clusters exceeds 32 bits",
        "Servers",
        "No_Open_File_Error_Box - If this flag is set, the operating system does not display a message box when it fails to find a file.  Instead, the error is returned to the calling process.  Note, this flag is currently ignored.",
        "{8502C591-5FBB-11D2-AAC1-006008C78BC7}",
        "CIM_Location",
        "MIF.DMTF|Physical Extent|001.4",
        "MCA PCI Platform Component Error Event",
        "PortMaxFrameSize",
        "CD_3D10A0A77CAA5B54D6D0F826577C9C9001B09013C6D023D93A420AB24027FBBB.1166.445254643.348",
        "Property to tunnel DNS queries over IPsec channel",
        "RevokeAccess",
        "Notebook",
        "DisableIntrusionPreventionSystem",
        "The Category reference represents the component category being used by the COM class.",
        "A Sensor is an entity capable of measuring or reporting the characteristics of some physical property - for example, the temperature or voltage characteristics of a Computer System.",
        "RSOP_IEConnectionWinINetSettings",
        "Indicates if time zone redirection is enabled or disabled.",
        "MDM_Policy_Config01_AppRuntime02",
        "MSFT_NetFirewallRuleFilterByService",
        "CR_E8CE06DB509B0590994561E0942576B49C1468E2ADAE12E9135A0B28175DA679",
        "MSiSCSI_LB_Operations",
        "// This class fires an event when a node failure occurs.",
        "CR_5F36D1944A2418B5A351C20BD9C1B5E3BF64E7FA512D227A09AA6978A5B805AC",
        "A Fully-Qualified Domain Name that resolves to a list of allowed Remote Endpoints.  If present, the value in RemoteEndpoint will be used initially, but will be replaced with all the IP addresses that this name resolves to.",
        "R_BDE5107C5341475AE649B7075E5FB1B219CF6D2FF755D735AA60A09AE0ED6BD6",
        "Name of registry value",
        "ProviderOperation_CreateClassEnumAsync",
        "CD_29496EE13A50FC208C78C52B2E38D7EBB9517F3108A323CCB520DE03AFA2EB81.2219.1520024917.7330",
        "MIF.DMTF|Portable Battery|002.9",
        "The given Load Balance policy is not supported.",
        "The DaysOfMonth parameter indicates the days of the month when the job is scheduled to run, and is used only when the RunRepeatedly parameter is TRUE.",
        "Data breakpoint register",
        "DeleteGroup",
        "GetPersistentBinding2",
        "CD_1D9D9F860D11A9D4B55F4C6910A7BB99E4046682A588042085A8C0D379BB6068.1102.3508104237.213",
        "Example: 102367",
        "noOverride",
        "The storage provider does not support a required association.",
        "TcpipNetbiosOptions",
        "If TRUE, this storage pool supports data deduplication.",
        "TraceParameter Flag",
        "HARDWARE_ENCRYPTION",
        "EcsSyncUrl",
        "MDM_Policy_User_Config01_EnterpriseCloudPrint02",
        "Buffers",
        "Block Size",
        "CD_11BDD83D3BDB7F7DD4A04A3CC49869E53E73157A8718941705A791A42E561334.2067.3342357913.858",
        "IntranetZoneAllowLessPrivilegedSites",
        "Storage",
        "C_76C38B6783FAEB293B78B22E0D0E1B6074F7C0D71F3859FC7FCD18DDF5F5203F",
        "Creating remote elements requires TargetPool",
        "C_5DCEADFA575A67B8870603880BD491602DCD3BD7BDE6B9896E3244EBC7BD1866",
        "A string value that describes LinkTechnology when it is set to 1, \"Other\".",
        "The OSLanguage property indicates which language version of the operating system is installed./nExample: 0x0807 (German, Switzerland)",
        "355DB6CE31803BDDBDD2FF491BD2AAE24F28E7ADF16402B3F3B9C4CF695702EB",
        "_DH_WMHTML",
        "The UncompressEx method uncompresses the logical file (or directory) specified in the object path. UncompressEx returns an integer value of 0 if the file was successfully decompressed, and any other number to indicate an error. UncompressEx is an extended",
        "WPDShServiceObj_f2",
        "Clears product key from the registry.",
        "01B09013C6D023D93A420AB24027FBBB.1177.4260128444.2397",
        "No resiliency setting with that name exists.",
        "A bitmap that specifies the CPU that the queue has affinity with. For example, setting bit 0 indicates CPU 0 is used, setting bit 1 indicates CPU 1 is used, and so on.",
        "The Location class specifies the position and address of a physical element.",
        "SubnetMask",
        "CR_FE8C3873BDAD1853EA9CE4F9A8CC51817A3AA40D4095EE7168936C23511B49CF",
        "CurrentThreatExecutionStatusID",
        "NicSwitchHardwareCapabilities",
        "CR_EA2A17F7F9011AC9DF174FA64700FA87A332EAD70BB23C4338DE684F34E350D6",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2473.3028845912.180",
        "12 - A dependency for which this service relies on has been removed from the system.",
        "The Destination property contains the destination IP address for this route.",
        "parentPath",
        "SDDL string describing Remote Users that are allowed by this rule.  If this is empty, all users are allowed.  If LocalUsers/RemoteUsers/RemoteMachines are specified, then they apply conjunctively, and this is an ''Allow-Bypass'' rule and ProtectionLevel must be set above None (so that authentication is required).",
        "PolicySourceSessionDirectoryClusterName",
        "1E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "Bid2Etw_ODBC_1_Trace",
        "ExcludeJapaneseIMEExceptJIS0208",
        "Return Value",
        "A string representation of the Adapter's serial number.",
        "UseLargeFRS",
        "NDIS Maximum Lookahead Supported",
        "40017",
        "//        #include <hbapiwmi.h>",
        "ExcludeJapaneseIMEExceptJIS0208andEUDC",
        "C_35A718313A1D788647FBE70E3BDCD7DD0916025FCA299E4EDF879E32418A1A55",
        "The ProposedSize property indicates the proposed size of the registry. It is the only registry setting that can be modified, and its proposal is attempted the next time the system boots.",
        "Sound Device management.",
        "A locale indicates a particular geographical, political, or cultural region. The Locale specifies the language used in creating the RecordForLog data. If the Locale property is empty, it is assumed that the default locale is en_US (English). ",
        "Vendor Reserved",
        "Alpha-based PC",
        "CIM_BinarySensor",
        "{791ad19e-e35c-11d0-9692-00c04fc3358c}",
        "Determines the fault domain type by which each column in this virtual disk should be isolated.",
        "MSFT_NetAdapter_RssProcessor",
        "C_81BE9C63EB8A3405D994E7603DC3ADF9A42254FF17D1981C7FC4E773D0EE7D7F",
        "13 - 1394",
        "OMI_ConfigurationDownloadManager",
        "The ConnectionID property indicates a unique ID for the connection.",
        "ConfigureOpenMicrosoftEdgeWith",
        "Maximum supported size for AAL0 packets.",
        "OrganizationName",
        "Dns Suffix search list for the auto-triggered VPN connection",
        "R_152B27DC0EF520A28DC6E7B6AECD7C476DEBCF0E080964D51299B263308AD0D4.2457.2502726923.558",
        "SavedGames",
        "MSNdis_StatusMediaSpecificIndicationEx",
        "#define HBA_EVENT_PORT_BROADCAST_D29_7  0x20c",
        "IpPort",
        "{D157AAFD-D42F-45cd-B30B-F67CF152C9F9}",
        "The language of the product.",
        "Socket 423",
        " 1 - None ",
        "R_1F2A1950CEC7D0AF21DF3763DDEA32BEDEE3070A1108B8C27D89F991559DD349.1611.497439556.554",
        "String containing the name of the class for which instances are desired.",
        "{db80dd1c-59ae-48e7-b7ec-f9be2c4b8cb0}",
        "CR_EDDF316486234851D86580CFE9B06D5A43E06F671105861787434F12D58AD4EC",
        "MSFT_WebReportManager",
        "MIF.DMTF|Power Supply|002.15",
        "PathWithFileName",
        "NS_E1DD43413ED9FD9C458D2051F082D1D739399B29035B455F09073926E5ED9870\\KI_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C\\I_51D55482B7AF4894C57C3464572BF16B3F50568D4C97132E3EE18E297A796DF9a\\10",
        "CIM_Processor.OtherFamilyDescription",
        "ref:__EventConsumer",
        "Localized version of RSOP_PolmkrFileSetting for American English",
        "XoffXmitThreshold",
        "CD_D1B2F4E6056A69A2D8AF80AAE4B443CB0029F3E62BFF8D77A98B6230DF9AE6C1.1941.1.37301",
        "This is the array of integer values of the element.",
        "Array of _PSS States",
        "The Rename() allows for the renaming of the user account name; a key in this class. The functionality to change the key property \"Name\" is implemented as a method to provide a separate context for the new name distinguishable from the key name associated with the instance to be modified in this class.",
        "The installation date.  The InstallDate property has been deprecated in favor of the InstallDate2 property which is of type DateTime rather than String. New implementations should use the InstallDate2 property.",
        "Speed",
        "CR_2CEA3682CC09E7F94D9FBC1BBA63FC6DB39872E53B9187129DFF772A12215DD5",
        "The Flags property contains the flags associated with the call.",
        "This method will attempt to create a new partition on the disk. By default, it creates a data partition using the largest available free extent. On MBR disks, CreatePartition will automatically create an extended partition when needed.",
        "Win32Registry|System\\CurrentControlSet\\control\\MediaResources\\icm|Description",
        "A storage pool on the target to be used as the source for creating the TargetVirtualDisk. This parameter is ignored if a target virtual disk is specified.",
        "Name of the entry to be checked",
        "The WriteDebugInfo property indicates whether or not debugging information is to be written to a log file.  Values: TRUE or FALSE. If TRUE, debug information is written to a file.",
        "CD_95968214F8D6C069EDA24D437119F94157AEA55BA5600F38F33105E2DA2858D4.2520.2618760581.1853",
        "CIM_PhysicalPackage",
        "Number of received fragments",
        "Fatal/NonRecoverable",
        "The end of the remote port number.",
        "The EnableAnonWin9xConnections indicates whether remote access without security checking is permitted. This property only applies to Windows 95 and Windows 98 systems.",
        "serverName",
        "A unique identifier of the object that triggered the action.",
        "Win32|WINNT.H|QUOTA_LIMITS|MaximumWorkingSetSize",
        "NS_E9B749FAC938A42C5A021B8195BC99015D3E509222ADA5BB98A53C9CF3ADF3A4",
        "FailureCode",
        "Win32_ProgramGroupOrItem",
        "object:MSiSCSIInitiator_ConnectionInformation",
        "select * from MSFT_StorageAlertEvent",
        "NPIV_SUCCESS",
        "Values: TRUE or FALSE. A value of TRUE indicates the parallel port was automatically discovered by the operating system.",
        "AllowPrepairing",
        "Reserved 1",
        "  Hexadecimal ",
        "The DNSHostName property indicates the DNS host name of the local computer.",
        "The Enable method enables the network adapter on the target computer. ",
        "Power Line",
        "Detailed Computer Notifications.",
        "ALPC Event",
        "C_9D477AC3DF7741E8993375CB7B6EC3870626780031363A4F5096C4CACA7F4F5E",
        "Local Node Transmission Error",
        "Create, enumerate, and delete named values ",
        "SendMetaConfigurationApply",
        "Name is a human-readable string used to identify a storage node.",
        "NetLogon Server Authentication",
        "{8502C52A-5FBB-11D2-AAC1-006008C78BC7}",
        "The process Id of the process that hosts the endpoint.",
        "Indicates whether this printer has been published to the Active Directory.",
        "This method deletes file server. If the file server contains any file shares, these shares must be removed first.",
        "ProcessorBiosTStates",
        "S-1-5-21-3968686040-3210279463-847977608-513",
        "Unhealthy",
        "proxyOverride",
        "IL_B0FD5A43E8238E668891E8BB0F653D919ADABDF291D5176C0429F475B48952B1.2686.67418499.264",
        "ExposedLocally",
        "Enables or disables SessionDirectory according as whether Value is set to 0 or 1 respectively. The call returns 0 for success and an error if the policy was set to Group policy.",
        "CD_ECA4BCE942A7519C8BD48784B00775961389BBC39B370F76AE4A3294CBE6E51C.1149.1848621945.1358",
        "Number of Kernel Idle States",
        "CIM_ProtectedSpaceExtent define addressable logical block addresses, treated as a single storage extent, located on a single physical extent.  Protected space extents exclude any logical blocks mapped as check data and contain user data stripe depth mapping information. An alternate possibility, if automatic configuration is used, is to instantiate or extend the CIM_AggregatePSExtent class.",
        "Power Save - Standby",
        "Temporary",
        "PreferredMonitorSourceModeIndex",
        "This is the parent device of this file device.",
        "CD_7FCF3928CE1A9575028B7746073AE3C5F6F2163882EECBCF60F66F9FAFB60664.2033.3251075099.231",
        "Order of the item in a list.",
        "{C127C1A8-6CEB-11DA-8BDE-F66BAD1E3F3A}",
        "The Index property indicates the index number of the partition.",
        "Instrumentation",
        "NDISWMI_TRACE_NETCFG Flag",
        "{A7A5AEBA-E3D2-11d2-8601-0000F8102E5F}",
        "EvictNode",
        "Cannot assign multiple drive letters to a partition.",
        "The metric of the route's interface.",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|DriverDate",
        "Win32API|Device Input and Output Structures|SCSI_ADDRESS|PortNumber",
        "WriteTotalCorrectedErrors",
        "ImportModule",
        "System calls",
        "SupportIntervalTimeouts",
        "58003",
        "HOSTPROC_TRACE_DRVMGR",
        "{7EFCC186-DB37-11d2-85FC-0000F8102E5F}",
        "Require authorization for endpoints.  The authorization list is part of the IPsec Globals.",
        "// perform target discovery. An adapter needs to support target discovery",
        "LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents",
        "Current number of color planes.  If this value is not applicable for the current video configuration, enter 0.",
        "R_35485A3627935FD5B9811EC1FF659B28F480DAAE3470BA831CF2A89F085B6179.1337.350504848.534",
        "WmiQueryHDSplitCurrentConfig",
        "BAUD_115200",
        "R_472E59D95C6C98C94622E4AD82DADA0687549064441307EEB295733E6DD86F4B.293.3983489529.514",
        "ScsiReadCapacity",
        "The Command parameter contains the name of the command, batch program, or binary file (along with command line parameters) that the schedule service will use to invoke the job.",
        "PrintProcessor",
        "DisconnectedSessionLimit",
        "The TCP setting associated with the filter",
        "Writable",
        "ifHCOutUcastPkts",
        "StringList",
        "Disabled (3) indicates that the element will not execute commands and will drop any new requests. ",
        "13 - 'Lost Communication': The storage provider has knowledge of the disk and has contacted it successfully in the past, but the disk is currently unreachable.",
        "Integers",
        "Type B",
        "ResultLength",
        "CD_896B6F9A9E07C666B49D000879A54E67F9CE0EAF2B8B7EF7BCA31E7303EC222A.2033.572601750.2476",
        "File Path Name",
        "PAEEnabled",
        "This property returns whether the Enterprise Client Sync product will be auto provisioned",
        "DiskIo_TypeGroup2",
        "KeyEntropyMode",
        "MSFT_LprPrinterPort",
        "Session Format Errors",
        "ROOT\\cimv2\\power",
        "BitValues",
        "Status Service Exists",
        "The driver for this device needs a resource that Windows cannot manage.",
        "This class provides configuration to modify browser security settings on the device",
        "PermanentAddress defines the network address hard coded into an adapter.  This 'hard coded' address may be changed via firmware upgrade or software configuration. If so, this field should be updated when the change is made.  PermanentAddress should be left blank if no 'hard coded' address exists for the network adapter.",
        "In Use/Not Available",
        "#define ISCSI_SECURITY_FLAG_IKE_IPSEC_ENABLED        0x00000002",
        "ARCNET (878.2)",
        "ReinstallMode",
        "Localized version of RSOP_PolmkrPowerOptionsV2Setting for American English",
        "ConfigurationType",
        "dots per inch",
        "// The total number of successful SAs created during quick mode negotiations",
        "MCA_ERROR_PCI_BUS_PARITY_NO_INFO",
        "The DeviceLocator property indicates the label of the socket or circuit board that holds this memory.",
        "DiskSpaceUsed",
        "Example: C:\\WINDOWS\\SYSTEM32",
        "CoalescedPackets",
        "CD_B2287B7C7375EAC6C3F512941317C3A57D34B32E4D080470E5E3D04FD567BA70.1198.2527762791.313",
        "C_A66D0E591535F85D5DA7C1BDF3A1DC73BE40E7ED75F810DC35A2C1D0250B7F4C",
        "Example: mydomain\\myname.",
        "C5-Envelope",
        "PolicySourceActiveSessionLimit",
        "Number of Kernel Performance States",
        "HSSDC (6 pins)",
        "C_9B85FF5CF1326F4370A0D245830AD60317CB312C53E60E05480454CFB6E5D2C1",
        "CIM_OwningJobElement",
        "BranchOffice",
        "Missing Parameter",
        "R_46782F06EC58C8C916C062A5E79D6F4E68F6E57049485ED56043B6013534D92E",
        "The EndingAddress property contains the ending address of memory mapped I/O",
        "TRACINGPNP Flag",
        "DoNotAllowUsersToChangePolicies",
        "WmiQueryReceiveScaleCapabilities",
        "If the provider registration specifies per locale initialization, then the Locale property defines the client locale associated with specific instantiation of a provider.",
        "ModelCorrespondence",
        "Rotated Parity",
        "10GBase-LR",
        "LprQueueName",
        "MediaDescription",
        "object:ISCSI_SessionStaticInfo",
        "File Simple Operation",
        "    <registryKey keyName=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\InstallService\\Parameters\">",
        "The source name must be a subkey of a logfile entry under the EventLog key in the registry.",
        "DebugId",
        "ReportingTimerValue",
        "RD_TRACE_CONTROL Flag",
        "Win32Registry|Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards|ServiceName",
        "The routing mechanism via which this route was learned.",
        "NTLM (machine as principal)",
        "ExecutionStrategy defines the strategy to be used in executing the sequenced actions aggregated by this PolicyRule. There are three execution strategies: ",
        "CD_4C6CD71FCC442DE647DE566A7976E508BB0047F456840F2469A44C2BA062A4A9.61.1889457469.250",
        "C_A845C3809E8DF42635819F5D4441FC804E08EFF7CF893C7B960B207ABE392F53",
        "NdisEthernetMacOptions",
        "The DatabaseDirectory property specifies the directory path containing the WMI repository.",
        "D_60A55C37A891C02E43DCC85CF24FBB0AEC4CE837463192AE3DF9F07B12D58EBF.2061.1.8698",
        "Toxic Leak Detected",
        "Publish",
        "Horizontal refresh rate numerator (Hz)",
        "MSFT_NetServiceStartFailedGroup",
        "PrimitiveSeqProtocolErrCount",
        "Full Copy",
        "Acct Create",
        "uRequired",
        "SPACES_StorageRack",
        "EventTypeName",
        "OperatingSystemSKU",
        "0x8003",
        "Supports Sparse Files",
        "PCI-X Mode1 ECC 66MHz",
        "AppleTalk",
        "EnablePerProcessDpiForApps",
        "Associates a network port with its Rdma data.",
        "Indicates the cache should be defragmented",
        "Profile Source Name",
        "Sw Epp Write Count",
        "BuildString",
        "CIM_BIOSFeature",
        "GUID_REDBOOK_WMI_STD_DATA",
        "UserID",
        "SetDedupMode",
        "ComputerSystem for IPMI",
        "ConfigError Flag",
        "IPv4ReceiveTcpChecksumSupported",
        "Zone Mappings",
        "FX_TRACE_RESERVED_14",
        "UseTempFolders",
        "MDMSettingsProv",
        "PoolPagedPeak",
        "The current session Id, if any.",
        "keywordalias",
        "Monitor's basic display parameters/features",
        "The SpoolEnabled property has been deprecated.  There is no replacementvalue and this property is now considered obsolete.",
        "The DriverVersion property indicates the version number of the video driver.",
        "ProductId",
        "NS_3FBDCB08ECD33FBEF028D2DB3EF058F8CE959779B943F43AB3DB3EC34ACA147D\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_8E23EB78FFAC4A759215B5BD6EC35386D5DAFFB04E17A1E0F3F33C9BDCE81E56c31171140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "NDISWMI_TRACE_ENCAP",
        "CD_A8B7F475B823CD27197221367DA5046937A001F70FDA319AF654A4CA16237214.1749.3339730608.332",
        "KerbAcceptSecurityContext_End",
        "Example: C:\\WINNT\\SYSTEM32\\DRIVERS",
        "IPAddressV6",
        "MSNdis_GroupAffinity",
        "CacheValid",
        "Current Template Level",
        "SourceVolume",
        "    2. Operation API Prefetching Functionality",
        "{8CF4C7EB-A286-409d-9EB9-29D7E0E9F4FA}",
        "By Policy",
        "CoWan",
        "IR_9E4BACCE11F49E9D089586BC1222A0D92425B46D601EBAD2E04BFC3E26B9CE55",
        "MSFT_TaskSessionStateChangeTrigger",
        "PLATFORM_TRACE_RESERVED_10",
        "The Win32_Printer antecedent reference indicates the Win32_Printer representing the local printer shared in this association.",
        "AhEnabled",
        "DiskIo_V0_TypeGroup1",
        "Require CRL Check",
        "Property for controlling whether  Dnssec  validation is required or not.",
        "A Win32_FolderRedirectionHealth object that represents the health of the user's redirected Contacts folder.",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_auth_flags",
        "Alias of the application",
        "RecordLog for IPMI",
        "Win32_DCOMApplicationAccessAllowedSetting",
        "File copy failed",
        "The Dependent reference represents the group accounts that exists on the domain.",
        "{58FD29F9-B516-40fd-871A-7EE76D5BB53E}",
        "4 - 'Initializing': In the process of establishing source/replica association and the copy operation has not started. ",
        "SetBindingSupport",
        "local|hkey_local_Machine\\software\\microsoft\\windows nt\\currentversion\\systemrestore|RPGlobalInterval",
        "CIM_IKESAEndpoint.OtherHashAlgorithm",
        "KeyManagementServiceUnlicensedRequests",
        "3221232494",
        "The Win32_TSSessionDirectorySetting class is an association with Win32_TerminalService as the Element and Win32_TSSessionDirectory as the Setting property that includes Terminal Server Session Directory Location, Cluster Name and SessionDirectoryActive properties.",
        " The type of registration for this data source. ",
        "CIM::Network::ProtocolEndpoints",
        "Process Create/Exit Event",
        "FillAttribute",
        "Toolbar Background Bitmap Path",
        "C_A810B8BCB28B4593289F5B14287BCC8F9F33A8E5A5BE4903C9226502B53FB3AA",
        "The FileSystemFlagsEx property indicates the file system flags associated with the CD-ROM drive. ",
        "{E693553E-EDF6-4D57-BF08-EFCAAE1A2E1C}",
        "Unknown or internal error",
        "{8502C541-5FBB-11D2-AAC1-006008C78BC7}",
        "object:MSFT_NetAdapterUsoSettingData",
        "IsCurrent",
        "Ethernet SNAP",
        "A LogRecord\\'s key structure includes a timestamp for the entry. If the timestamp for the entry is unknown, the value 99990101000000.000000+000 SHOULD be used.",
        "AccountManagement_AuditApplicationGroupManagement",
        "Set DF Bit in External Header to 1",
        "boolean",
        "0x8005003E",
        "AllowReportingServer",
        "An incompatibility has been detected among the library and driver modules",
        "OriginalCreationTime",
        "The Comment property contains a comment or description for this login profile.",
        "EnterpriseProtectedDomainNames",
        "Applies only when Protocol is ICMPv4 or ICMPv6.  ICMP Type/Code pairs this filter applies to.  May be an ICMP type (0-255), or an ICMP type/code pair in the format Type.Code, where type and code values are numbers from 0 to 255.",
        "CD_703C562B7404A6234AAFEB9B3BB242E3FF62C76339F84C997DCEF89443C2DF65.2040.2476293942.327",
        "MsftUtils_DebugGeneral",
        "MSNdis_FddiFramesLost",
        "Storage Workgroup Server Edition",
        "NameSpace",
        "CD_F7E9A52C76555077F4DA7D39B6593B2F1BE8BB803F9421C298C6579BFE9568D1.1539.3461538962.424",
        "Bytes",
        "SettingsLocationTemplate",
        "MSFT_SmbShareChangeEvent",
        "Specifies whether the Operation is invoked Synchronously or not.",
        "CD_AF9FF42200D7F24F94D2D927172EDE6E75DA70A13982C42099804CFF0709A576.2110.1857941684.1951",
        "Product identification such as a serial number on software or a die number on a hardware chip",
        "DenyLocalLogOn",
        "bits per pixel",
        "RequiresNew",
        "The Direct property indicates whether the print jobs should be sent directly to the printer.  This means that no spool files are created for the print jobs.",
        "SetCurrentRedirectableAddresses",
        "HBA Information",
        "CustomDeadLetterQueue",
        "Commonly used product name.",
        "SystemSpecificCollection",
        "ID of the token-based activation license that activated the product.",
        "Win32_PatchPackage",
        "AllowProjectionFromPC",
        "This property contains the name of a locality, such as a city, county or other geographic region.",
        "0xC0000014",
        "WMI_STORAGE_PREDICT_FAILURE_EVENT_GUID",
        "Win32_WIN32_TSCLIENTSETTING_Prov",
        "Original Target portal's socket number given in the login",
        "LicenseServers",
        "Reset the DAClientExperienceConfiguration configuration.",
        "A physical package is replaceable  if it is possible to replace (FRU or upgrade) the element with a physically different one.  ",
        "{0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9e}",
        "Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_RTSCTS",
        "DownForeLimitBps",
        "PrivatePageCount",
        "GuidName2",
        "Keyboard Extended ID Information",
        "SetIntegerElement",
        "PolicyActionName",
        "The preshared key for the target or IKE identification payload is not available.",
        "StartupMode",
        "I_BAE2729FB2A4F61D06933B050C473303CCE7911F610104E1004CA977C52C3E87.2434.3417119911.354",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.1173.581434339.424",
        "2 - 'Async': create and maintain an asynchronous copy of the source. ",
        "Exports a cache package",
        "High - Indicates a process that performs time-critical tasks that must be executed immediately for it to run correctly. The threads of a high-priority class process preempt the threads of normal-priority or idle-priority class processes. An example is Windows Task List, which must respond quickly when called by the user, regardless of the load on the operating system. Use extreme care when using the high-priority class, because a high-priority class CPU-bound application can use nearly all available cycles.  Only Realtime priority will preempt threads set to this level",
        "Analyze",
        "Completed with no error",
        "Specify the LanaID of the network adapter to set. If the LanaID specified is  invalid or does not exist, an appropriate error will be returned. The available list of LanaIDs is obtained by enumerating the property DeviceIDList belonging to the class.",
        "{acf1403d-a61c-11d0-8dd4-00c04fc3358c}",
        "Printer's horizontal resolution in pixels per inch.",
        "The IPXVirtualNetNumber property uniquely identifies the computer system on the network. It is represented in the form of an eight-character hexadecimal digit. ",
        "The number of PDUs transmitted without errors",
        "ProtocolIFType",
        "The maximum interval the power meter is able to average samples internally to produce the CurrentReading.",
        "Example: Microsoft Corporation",
        "The Win32_DiskDriveToDiskPartition class represents an association between a disk drive and a partition existing on it.",
        "NS_1BBA01731E96C19D0D6219D5469AEAB5B51946F70955812074A8F272593746D4\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_653B6A35271DAA7F4D6EDFC2E9E795101F58B4B177E4E4A5A213F1257972A915",
        "LPC_TRACE_RESERVED_0e",
        "NextEvent64BitTime",
        "Number of seconds that child process is allowed to run; if zero, process will not be terminated",
        "{B71D2538-57E2-4228-888B-1AF9B3BD01CD}",
        "iSCSI Request Processing Time",
        "        <UseUnifiedSchedulingEngine>true",
        "TM_NLAWPLG",
        "GoToIntranetForSingleWord",
        "Instances of this class represent any ODBC Translators that are included as part of a products installation.",
        "InProcServerPath",
        "Win32API|Device Context Functions|GetDeviceCaps|SIZEPALETTE",
        "65005",
        "Connect performance counter missing",
        "DaysOfWeek",
        "FDCtlGuid",
        "<NamespacePath>:<ClassName>.<Prop1>=\"<Value1>\", ",
        "This class provides ability to detect and provide inventory of remote applications of a subscribed device",
        "{eb004a05-9b1a-11d4-9123-0050047759bc}",
        "The PeakWorkingSetSize property indicates the peak working set size of the process./nExample: 1413120",
        "CD_5CC5CF05A7A1041C246328BDD1081AC6C5D60C48F12D405A2F1C3A3CF42897DE.1149.2692298785.448",
        "NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares",
        "Starting Account Name",
        "ref:Win32_1394Controller",
        "{17ABF473-982C-4d0e-B502-3A59D89E71DE}",
        "CIM_PhysicalAssetCapabilities.FRUInfoSupported",
        "MSFT_FileShareAccessControlEntry",
        "CR_B39F79BEF0550EE7F9E981A83A152A3A4B6173B3A32D2E630E92CBAA2FE60E90",
        "Base schema for all Metaconfiguration resources.",
        "CallerAddress",
        "SECAM D",
        "C_FB02245EE2505E5D90FC704D39CDAE9BCF7C7408D392BD5B8D624E7B60A6BBD8",
        "Win32_ClusterShare",
        "This property represents the PolicyRule that contains one or more PolicyActions.",
        "CD_DFCE5B8EEFC1AF231A170E8413130AF6AA4A71FD22AC6E352C7DBF46462589FC.1647.1.9014",
        "Volts",
        "Notification",
        "StoragePoolName",
        "The Architecture property specifies the processor architecture used by this platform. It returns one of the following        integer values:",
        "MSFC_NPIVLUNMappingInformation",
        "System File",
        "0xC0000005",
        "The Size property indicates the size of the disk drive.",
        "Size in bytes of the blocks which form this storage extent. ",
        "EntryName",
        "StoreFilePath",
        "ProtocolSelector",
        "Business N Edition",
        "Example: C:\\TEMP.",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmYResolution",
        "Static",
        "TWIRP (two-way infrared)",
        "External",
        "Hardware not compliant",
        "Require IPSEC",
        "The Published property indicates whether the printer is published in the network directory service.",
        "SupportsCloneLocal",
        "PolicyAction instances may be aggregated into either PolicyRule instances or CompoundPolicyAction instances.",
        "I_5306A39AE8099BE250137B7B473C6C6DC916A35E8018A185B5C9A31EB97EDE85.706.1.27844",
        "8251FIFO Compatible",
        "// iSCSI management applications rely upon this",
        "C_F76773412E97B049DE12EF0A4B3FEE352558F541338523F30899C82C78D5CB29",
        "SCSITargetId",
        "UDPPorts",
        "R_941298FE57B01D7A1E5DB7CD7C2688B06D8CF556A38C47811E3130A1974EF1B2",
        "PossibleStates",
        "ConnectorType",
        "Mapping of IPv4 address ranges to IPv4 prefixes",
        "This field specifies whether a parity-based resiliency setting is using a rotated or non-rotated parity layout. If the resiliency setting is not parity based, this field must be set to NULL",
        "Previous target idle state",
        "0 - 'Not Applicable' implies a non-iSCSI subsystem. ",
        "The threat status error code",
        "Flag that indicates whether the policy was applied over a slow link.",
        "A string representation of the disk's firmware version.",
        "BEHAVIOR",
        " it, and provides path information for the grouped files.",
        "I_1AC1FF9846D54F9F0147D2DB85F9B6094C79EC82E32CB9B2EA521A35465B977B.2710.2507324345.295",
        "Msft_WmiProvider_PutClassAsyncEvent_Post",
        "OtherIdentifyingInfo captures additional data, beyond asset tag information, that could be used to identify a physical element. ",
        "Object Reference",
        "TcpIPv6",
        "LoadOrderGroupDependencies",
        "On Board Sound Input from CD-ROM",
        "Maximum read request size in bytes, valid only for PCI-E devices",
        "PortalInfoCount",
        "ActiveProcessLimit",
        "DeletionPolicy",
        "Partition Info Extension V2",
        "This method removes one or more storage fault domains from manual allocation.",
        "HBA_BIND_TO_WWPN",
        "\\\\.\\root\\RSOP:__Win32Provider.Name=\"Rsop Planning Mode Provider\"",
        "The starting address of the bytes in error.",
        "SYNCHRONIZE",
        "SACK Option",
        "Critical failure",
        "IntervalBetweenEvents",
        "The SOM associated with the GPLink that references the GPOthat contains this Policy Object. A client-side extensionobtains this value from PGROUP_POLICY_OBJECT->lpLink.The prefix LDAP:// from lpLink should be stripped",
        "CR_2B0CB21E4574B83D661A7C62AD7BF3133DF3FBA914EA55D3A45DC4A7214DD006",
        "Input Device Error",
        " The CIM_SoftwareFeatureSoftwareElements associations identifies the software elements that make up a particular software feature.",
        "MDM_Policy_Result01_Storage02",
        "MSNdis_80211_PowerMode",
        "NS_3FBDCB08ECD33FBEF028D2DB3EF058F8CE959779B943F43AB3DB3EC34ACA147D\\KI_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB\\I_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848",
        "Win32_TSNetworkAdapterListSetting",
        "The InteractWithDesktop property allows the specified job to be interactive (meaning a user can give input to a scheduled job while it is executing).",
        "CIM_ComputerSystem.EnabledState",
        "NS_FE3EA006C3292950A76C2B5A0185D7DF99ADD6FD6502E0AC079E3A8650E76E3A\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_C52295624F06C940B122D80C080F06A7E8A3B72E8DBB8DAB3530E90B3C01E0C8",
        "htmlEditorProgram",
        "// The total number of identity authentication failures (Kerberos, certificate, and preshared key) that occurred during main mode negotiation.",
        "i$|RU",
        "LSOv1",
        "Counter9",
        "largeCustomLogoBitmapName",
        "ServicePack",
        "Delta collection",
        "NlServerAuth_End",
        "Win32_TSRemoteControlSetting",
        "The key to identify the instance of MDM_Updates class",
        "The PNPClass property contains name of the type of this Plug and Play device.",
        "A file share object models the subsystem's concept of a file share.",
        "Committed",
        "{8502C4DD-5FBB-11D2-AAC1-006008C78BC7}",
        "Number of split IO operations",
        "CertificatesSupported",
        "Specifies whether the Remote Desktop Easy Print printer driver is used first to install all client printers: (0) RD Session Host server tries to find a suitable printer driver to install the client printer. If the RD Session Host server does not have a printer driver that matches the client printer, the server tries to use the Remote Desktop Easy Print driver to install the client printer, (1) RD Session Host server first tries to use the Remote Desktop Easy Print printer driver to install all client printers. If for any reason the Remote Desktop Easy Print printer driver cannot be used, a printer driver on the RD Session Host server that matches the client printer is used.",
        "DhcpServer",
        "Off Duty",
        "LinkFailureCount",
        "LastProfileDownloadIntervalUnhealthyInHours",
        "The physical package that contains other physical elements, including other packages.",
        "Indicates that the drive letter shouldn't be assigned after attach.",
        "{29bacfdd-f063-48d8-952c-d3dc93300f15}",
        "PolicySourceEnableDFSS",
        "VerbType",
        "RowsetHelper",
        "Type of memory used in this device. This is an extra property being added to report the raw SMBIOS memory type. The value reported by the property MemoryType is a CIM value mapped to SMBIOS value.",
        "TROJANTELNET",
        "DelayedAutoStart",
        "Frame Relay DLCI Endpoint",
        "bject:MSFT_CliProperty",
        "TR_FD",
        "VolumeChangeEvents",
        "Lpc Flag",
        "HideShutDown",
        "SpeakerVolumeInfo",
        "\\\\.\\root\\cimv2\\mdm\\dmmap:__Win32Provider.Name=\"DMWmiBridgeProv\"",
        "CD_F63E9DDBFEF6B5F00A102DFF31BE7441561DE4396AD9FF89BE26AD8D006CEB79.1500.3172255832.254",
        "This property contains a list of the management server URLs associated to this authority",
        "Property which identifies if DNSSEC is enabled on the rule.",
        "C_C7753872127F972FAB5A4ECF3A59238F36736CDCAD139F5290039065976DB9ED",
        "Flag for enabling / disabling sync settings for Windows apps",
        "SM_GetLUNStatistics",
        "THREAT_MANUAL_STEPS_REQUIRED",
        "IsAdminOnLS",
        "NDIS Status Reset End",
        "C_16D6E45D9DC3C2448BBB5DF12E5A17B75BBAD53607DFAC1CCE27C411AB0AEA61",
        "The TracksPerCylinder property indicates the number of tracks in each cylinder on the physical disk drive. Note: the value for this property is obtained through extended functions of BIOS interrupt 13h. The value may be inaccurate if the drive uses a translation scheme to support high capacity disk sizes. Consult the manufacturer for accurate drive specifications.",
        "This error is informative only.",
        "ServiceSpecificExitCode",
        "Win32Registry|Software\\Microsoft\\Windows NT\\CurrentVersion|Plus! ProductId",
        "WakeChargeUser",
        "The MediaType property specifies the type of media being printed on. The property can be set to a predefined value or a driver-defined value greater than or equal to 256. For Windows 95 and later; Windows 2000.",
        "This method allows the physical disk's description to be changed.",
        "SetFileShare",
        "MSDAREM",
        "Failedover",
        "Number of slots in the changer",
        "Win32API|Windows Networking Functions|WNetEnumResource",
        "WakeReleasePreserveProcess",
        "RegFileOp",
        "MpsDrvTrace",
        "MSFT_Partition",
        "CD_9877A07ED842BA5F1FB4691948C0CDD95DF656BC3733002FE0D6F9D48056C255.2556.3113481387.680",
        "Processor Id",
        "Family",
        "0x10000000",
        "Win32_NamedJobObjectSecLimit",
        "objects per second",
        "SetDomainInfoPolicy_Start",
        "CIM_MemoryCheck",
        "CancelKTimer2",
        "PolicySourceProfilePath",
        "NS_5383CAE6BA7DF67C8540FB8486138E8E7854E1A417C357D4708E676797F6FF28\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_43B7B69F919BB681DCC1079E7BED6BA29BBE6F4DDA8822130874E698F9F22509",
        "HNet_PortMappingProtocol",
        "Indicates if the settings configured through this WMI class are taking affect.",
        "ref:CIM_Setting",
        "GetPhysicalPresenceResponse",
        "WSManWmiProvDebug Flag",
        "Proxy - Proxy logon. This logon type is not supported.",
        "SPACES_StorageHealthStatusChangeEvent",
        "MIF.DMTF|Voltage Probe|001.7",
        "XON/XOFF flow control supported",
        "MSNdis_SetHDSplitParameters",
        "CD_9A2FA4B503D51BA72E7F874AA07B2D2639867C129B89B4AF2230D146C0DBAD9A.1836.2429246904.415",
        "CR_F71CEDE68D110C46E631A74BD74BB02467459B066EB8F2E32432A8044C4EFD32",
        "Friendly name of the settings location template.",
        "Magstar MP",
        "B38813CF-0673-495C-A12F-384D47BDF1ED",
        "Supported Capabilities",
        "Target Name",
        "OldThreadQuantum",
        "R_30544E69098FEB7B3DBD10E5E79FA9F73E13B4CE82E27F9768299AB561F3C59F",
        "Ordered",
        "NTEventLogEventConsumer",
        "I_11D2E97DDF1CF080928910BF09863669E0E14A4659127F6B001724FBE86FEC93.2697.2945396924.271",
        "This method deletes the virtual disk. After this method is called, the space used by the virtual disk will be reclaimed and the user will be unable to reverse the delete operation.",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\AutoTreatAs[Default]",
        "R_5568D9406818EC7D25F6DD0ECD3BC28AB9840FC9891F58E36141C6AF33486A4B.271.2061032503.524",
        "HBASymbolicName",
        "The Name property contains a character string specifying the name of a Win32 environment variable. By specifying the name of a variable that does not yet exist, an application can create a new environment variable. /nExample: Path.",
        "The requested file(s) is(are) not pinned to a tier.",
        "DSDnsForestFlag",
        "MaxDataSize",
        "OnlineDevice should return 0 if successful, 1 if the request is not supported at all, 2 if the request is not supported due to the current state of the Device, and some other value if any other error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier. ",
        "CR_9306698C01F89BF0B51534BC38CEB10F9556344574338B9E17B1FD19E593FD78",
        "This field denotes the specific error code used for 'Access Denied'.",
        "CIM_SerialController",
        "s time is in effect.",
        "Destination Port Unreachable",
        "IPv6AutoConfig",
        "UnlockWithExternalKey",
        "{45068237-595D-4C7D-BD80-F84ADC0257F8}",
        "Tape format not supported",
        "SyncType",
        "autoConfigUseLocal",
        "Firmware",
        "EnableNetworkFSS",
        "The ICMMethod ( Image Color Matching Method ) property specifies how ICM is handled. For a non-ICM application, this property shows howICM is enabled. For ICM applications, the system examines this member to determine how to handle ICM support. This property can be one of the following predefined values, or a driver-defined value greater than or equal to 256.Value Meaning :-1",
        "R_68988603F70E94DB41A96D6CCAF4C1247D2A19BC8932E751AE8871C31295C890",
        "MSFT_ExpressionAssignment",
        "CIM_PhysicalFrame.PartNumber",
        "I_59C0D279AC4D00AA33C5DAB5CDF28150F681AA6C3210CD3E34E5D560A87ADB96.311.1142537083.249",
        "EnableXboxGameSaveTask",
        "MDM_WindowsIoT_SoftRealTimeProperties01",
        "AcquireDepth",
        "Dependents",
        "ErrorMethodology for CIM_Memory is a string property that indicates whether parity or CRC algorithms, ECC or other mechanisms are used. Details on the algorithm can also be supplied.",
        "ObjectAccess_AuditFilteringPlatformPacketDrop",
        "{e7001b59-c3d6-4537-b40e-a163d516e4a3}",
        "CommunicationStatus indicates the ability of the instrumentation to communicate with the underlying ManagedElement. CommunicationStatus consists of one of the following values: Unknown, None, Communication OK, Lost Communication, or No Contact. ",
        "0xC000001C",
        "MSMCAEvent_BusError",
        "PrefixLength",
        "TM_LOCK Flag",
        "Field Replaceable Unit Code",
        "NdisAtmHardwareCurrentAddress",
        "RSOP_PolmkrDriveSetting",
        "DiskIo_V2_TypeGroup2",
        "C_89FE4ECD715508D84EE36BC94DB9C9AB6DC6A560D227442061D4288D96910660",
        "WMI_CHANGER_PROBLEM_DEVICE_ERROR_GUID",
        "Bounded Ecp Write Count",
        "NoIoMmuSupport",
        "MSFT_CliAlias.FriendlyName=\"DiskDrive\"",
        "NodeSymbolicName",
        "CR_7AC6B537C17B7A0CE625AFA6380E4FC98418E800AD64DF240D5A7AD2482283AD",
        "Bulk Flag",
        "WriteTime",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmDisplayFrequency ",
        "Feature",
        "Network Operations Center",
        "HdSplitCurrentConfig",
        "Select * from Win32_Environment",
        "Win32Registry|.DEFAULT\\Control Panel\\Desktop\\WindowMetrics|IconSpacing",
        "The maximum number of accepted channels.",
        "3221232473",
        "CounterCount",
        "SetAutoRestartNotificationDisable",
        "BuiltIn",
        "The provider does not support a value for fault domain awareness other than physical disk or storage enclosure.",
        "IL_F725542BCC5EE818BB3268E2A39F3A53C7872F274EFAD1FD935D8C2ED42D5A80.1076.2672245562.263",
        "PreventLockScreenSlideShow",
        "hen the request is taking a long time to service. If a storage job has been created to track the operation, this method will return 4096 - 'Method Parameters Checked - Job Started'. Note, even if RunAsJob is TRUE, the method can still return a result if it has finished in sufficient time. ",
        "ARCNET",
        "{01dbb74a-2064-11d4-97eb-00c04f79c403}",
        "Undefined",
        "The PMTUBHDetectEnabled property indicates whether detection of black hole routers occurs. Setting this parameter to TRUE causes TCP to try to detect black hole routers while discovering the path of the Maximum Transmission Unit. ",
        "A reference to the endpoint the channel connects to.",
        "Example: SE_SHUTDOWN_NAME",
        "Preshared key",
        "This method allows the user to update or set various defaults on the storage pool. Note that not all parameters must be specified, and only those given will be updated.",
        "Allocation can be further controlled by the PhysicalDisksToUse parameter. There may be certain scenarios where a storage administrator wants to manually choose which physical disks should back the virtual disk. When this parameter is specified, data for the virtual disk will only be stored on the physical disks in this array and not on any others.",
        "A free form string representing the job's status.",
        "Re-run Job",
        "Denotes whether this subsystem supports a file server.",
        "HOSTPROC_TRACE_GENERAL Flag",
        "Select * from Win32_BaseBoard",
        "5 bit - Domain Join If Joined - Allows a join to a new domain even if the computer is already joined to a domain. ",
        "It is not suitable for images that include ",
        "The size of each buffer, in kilobytes. Should be less than one megabyte.",
        "The Size property indicates the size of the print job.",
        "CD_FBBE075DD8BF09CF56F5E18528E64829DF169227E061EAB31220ED102922500C.1227.809815937.7854",
        "MMCSS",
        "The CIM_ManagedSystemElement for which statistical or metric data is defined.",
        "The RemoteName property contains the remote network resource name for a network resource. For a current or persistent connection, RemoteName contains the network name associated with the name of the value in the LocalName property. ",
        "Write errors corrected with substantial delay",
        "CATV MAC Layer",
        "MIF.DMTF|Power Supply|004.15",
        "IP Forwarding",
        "CD_6ED1CC69327A33D759019C559267CFDE48C858749D7A22192B7DE8573CFC19A6.1535.3491659407.3547",
        "AnswerMode",
        "The optional lower-bound of the destination port filter condition. If only a single port value is required, then IPDstPortStartMatchCondition and IPDstPortEndMatchCondition must match. If the destination port filter condition is not required, set both fields to zero.",
        "NewAllocSize",
        "C_F9D4723921ADF841BA7CC65756244CF775FD9B7C648EEDAFF1E2DDD459957AE2",
        "HBA_EVENT_PHY_STAT_GROWTH",
        "AdvertiseTypeDescriptions",
        "categories",
        "C_73FDCA103A6930FD52B50CB857297C58B950838604AAF9FA2A8A8AC7D06D4361",
        "ErrorSourceInfo",
        "The Description property provides a textual description of the adapter. ",
        "The frequency (in Hertz) at the low end of this powersupply's input frequency range 1. A value of zero implies DC.",
        "MSVerifierIrpLogEntry",
        "thread",
        "ModuleSize",
        "EscEnabled",
        "ifOutDiscards",
        "The type of folder redirection to be performed.",
        "The full charge capacity of the battery in milliwatt-hours. Comparison of this value to the DesignCapacity property determines when the battery requires replacement.  A battery's end of life is typically when the FullChargeCapacity property falls below 80% of the DesignCapacity property. If this property is not supported, enter 0.",
        "Interdomain trust account",
        "ref:MSFT_NetSwitchTeam",
        "WSP_StorageAlertEvent",
        "WMI|Win32_SystemDriver",
        "One of the following values: - Disabled: Disable force window scaling on retransmit. - Enabled : Enable force window scaling on retransmit.",
        "The PurposeDescription property provides a description that extends the value of the Purpose property of this class.",
        "Uninstall",
        "The DeviceSpecificPens property indicates the current number of device-specific pens.  A value of 0xFFFFFFFF means the device does not support pens.  Pens are used to draw lines and theborders of polygonal objects.",
        " A list of paths, separated by semicolons, that represent the paths to be searched to find the imported DLLs. The list is usually a list of Win32_Properties, with each Win32_Property.Name enclosed inside square brackets ([ ]).",
        "The statistic information/object.",
        "Encryption Method",
        "STORAGE_FAILURE_PREDICT_STATUS",
        "RequiredProduct",
        "UNC share paths for the printer.",
        "C_3221B359A5416B849210C8EDE6CA9A31AE77982A28D76140A2605705EA5F2416",
        "iScsiFlagDigest",
        "Unsupported",
        "CD_0DCE749AD0E30C5A74941D6C326877243635B3D92AE3FA1BB77A2C716BB28364.1135.4132144727.526",
        "Specifies the size, in bytes, of the driver's internal input buffer. A value of zero indicates that the value is unavailable.",
        "DetectionTime",
        "C_6B87A2FD09C6892F4F975A26E2D24DFF27E8D9BD67B9DB050A7E8D7BE4DA7F6F",
        "Array of Performance States",
        "RssProcessorArraySize",
        "OldThreadState",
        "RSOP_IEToolbarButton",
        "NDIS ATM Receive Cells Dropped",
        "Passive Matrix LCD",
        "Ethernet 802.2",
        "The number of times that the Job should be run. A value of 1 indicates that the Job is not recurring, while any non-zero value indicates a limit to the number of times that the Job will recur. Zero indicates that there is no limit to the number of times that the Job can be processed, but that it is terminated either after the UntilTime or by manual intervention. By default, a Job is processed once.",
        "CredentialType",
        "userSOM",
        "BcdObjectListElement",
        "Specifies the default web message format for outgoing requests if the operation does not specify one.",
        "The maximum number of queue pairs that can be allocated on the adapter",
        "The number of broadcast packets received without errors through this interface.",
        "Number of vertically blanking pixels",
        "EnumPrivileges",
        "AllowsRestrictedSitesZoneTemplate",
        "Abnormal exit or termination",
        "OpTrustedDomByName",
        "Temperature",
        "Ndis80211NetworkTypes",
        "MajorDriverVersion",
        "DeferUpgradePeriod",
        "Instruction Fetch",
        "PerfVerbose Flag",
        "\\\\.\\root\\cimv2\\power:__Win32Provider.Name=\"PowerWmiProvider\"",
        "Example: B0.",
        "DistributedCachingIsEnabled",
        "I_1A671C0E762995F8E9061178C1591B318A37CF6147DE1AD7F5C9591F6F8F3EAC.2490.2381767898.326",
        "X%m;X%m;",
        "Public Loop",
        "{0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e90}",
        "TM_NLAAPI Flag",
        "CR_353ED06D06D3F543C1F82745622C061EF12A64D07607F4A41BBE9C01357C9257",
        "PreferredContentInformationVersion",
        "PCI_BUS_ERROR_STATUS is valid",
        "Mouse",
        "The collection trace listeners that listen to the System.ServiceModel.MessageLogging trace source.",
        "This method unregisters a subsystem. The provider will no longer manage this subsystem.",
        "Call cancellation request too late",
        "C_8A00FF3E28E2491BD7475BE0DBBFA1E38AE556F30FA37A400006A8673FBC26B8",
        "Returns token-based activation grants.",
        "SetInformation",
        "polmkrBaseGpoGuid",
        "Not enough storage objects were specified to successfully complete the operation.",
        "CurrentRefreshRate",
        "CD_CAEED6243C47285827AC6434674ED523459EB8C970204592D2B83B0408FC431D.1103.1059209740.2576",
        "The vendor-assigned version number of the NIC driver.",
        "I_10B389476894FB316640638E08A9C99AA36EB29A3A9801B1C82481AD256F36B8.2723.3202060040.288",
        "Scripting Standard Consumer Setting",
        "3DRAM",
        "The date or time when the state of the Job last changed. If the state of the Job has not changed and this property is populated, then it must be set to a 0 interval value. If a state change was requested, but rejected or not yet processed, the property must not be updated.",
        "46008",
        "OptimizedFilesSavingsRate",
        "HorizontalBorder",
        "DaylightDay",
        "Example: Adaptec",
        "VALIDATION_BITS",
        "OpenTrustedDomain_Start",
        "MSFT_TaskMonthlyDOWTrigger",
        "Defines the IPv4 LSOv2 encapsulation settings for the Adapter.",
        "ReadyToRun",
        "MSFT_NetFirewallRuleFilters",
        "0x000004",
        "I_45569AA056ADC9524DBBD290145103D4DAFF08E0CDB98D574F6E8F827058279E.2505.3778392268.333",
        "NDIS 802.11 supported network types",
        "51006",
        "ref:MSFT_ReplicaPeer",
        "{8209EC2A-2D6B-11d2-BA49-00A0C9062910}",
        "AllowManualMDMUnenrollment",
        "_DH_WMPDMOWRAPPER Flag",
        "The EnableStartupHeapPreallocation property indicates whether WMI will start with a pre-allocated heap.",
        "Either",
        "{8502C57D-5FBB-11D2-AAC1-006008C78BC7}",
        "NDIS Receive Block Size",
        "QuadSpeedThreshold",
        "BlockSize",
        "CIM_MonitorSetting",
        "Values: TRUE or FALSE. A value of TRUE indicates the network adapter is installed.  ",
        "object:HBAScsiID",
        "CR_39AC0100AEED67043710A65F5DEC2D0CE31D07895E6DF01491EEBF7E2088F387",
        "Win32_FolderRedirectionHealthConfiguration",
        "AllocatedBaseSize",
        "AllowPasswordManager",
        "The CompressEx method compresses the logical file (or directory) specified in the object path. CompressEx returns an integer value of 0 if the file was successfully compressed, and any other number to indicate an error. CompressEx is an extended version o",
        "Default Dial Up Connection",
        "EnableOnNetworkId",
        "Supports Removable Media",
        "The Name property indicates the name of the Registry. ",
        "LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps",
        "C_0CEA2BFA85C402C6870520D8882306321579F18BD47E8E598ED675B423931597",
        "CurrentProtocolVersion",
        "NtlmServerAccept_Info",
        "Count of the warnings. ",
        "The TcpMaxConnectRetransmissions property indicates the number of times TCP will attempt to retransmit a Connect Request before terminating the connection. ",
        "Toggles Strong Certificate revocation list checking",
        "Number of bytes sent at layer 2 for all outbound RDMA traffic",
        "QPSend performance counter missing",
        "%Group%",
        "Boolean indicating whether synchronization is maintained.",
        "CD_CE60FD48B8554305653B63F3FF89DE9F487AA367010DE6A864E4D5A7550F953A.1744.181948403.3384",
        "WakeDropUser",
        "Set iSCSI Tunnel Mode Outer Address",
        "Ndis80211KeyIndex",
        "The InprocServer property contains the full path to a 16-bit in-process server DLL for this COM component.",
        "FileDelete",
        "UnregisterByObject",
        "The LogonType is a numeric value indicating what type of logon session this is. ",
        "Describes a BranchCache hash cache",
        "CIM_PolicyActionStructure",
        "DefaultTime2Retain",
        "The PrintProcessor property indicates the print processor service used to process the print job. ",
        "MSFT_PhysicalDiskToStorageReliabilityCounter",
        "HOSTPROC_TRACE_IO",
        "configurationStatus",
        "The Create method creates a new service. The Win32_LoadOrderGroup parameter represents a grouping of system services defining execution dependencies. The services must be initiated in the order specified by the Load Order Group, as the services are dependent on each other. These dependent services require the presence of the antecedent services in order to function correctly. It returns one of the following integer values:",
        "LsoSupported",
        "ref:MSFT_NetEventPacketCaptureProvider",
        "File systems can read/write data in blocks which are defined independently of the underlying storage extents. This property captures the file system's block size for data storage and retrieval.",
        "R_6CE5293A4991040589451CEEA5CB3FB1F0BCB9AC8B0C16A2D34DE39822CD1F34",
        "NewByPeapAuth",
        "PCI_BUS_ID is valid",
        "MGR_TRACE_LPC",
        "RequestValue",
        "NotTargetPlatform",
        "CR_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11",
        "MSFT_NetEventSession_Provider",
        "IGMPLevel",
        "UnlockWithAdSid",
        "CR_91882C4E4700146BC908AC03DB139338C0844AE5A877163990AFB47483D7264C",
        "IPsecV1",
        "MSFT_OdbcPerfCounter",
        "MIF.DMTF|Video|003.6",
        "Disables the Large Send Offload (LSO) properties on the network adapter.",
        "If the application was installed via on-demand installation through a COM activation, this is the ProgId that caused the installation",
        "{32b94816-661a-4d68-a9d8-cd4831eb3d66}",
        "Number of bytes sent over this session",
        "FHLength",
        "The Win32_SystemResources class represents an association between a system resource and the computer system it resides on.",
        "Disable DH-CHAP for the Physical Port of a Fibre Channel HBA.",
        "Win32_TSExpandEnvironmentVariables",
        "DOT11_AUTOCONF_UI",
        "SecurityEncryption",
        "Published",
        "Describes modern application Background Tasks",
        "The Win32_SID of the object's group",
        "Example: 155.34.22.0",
        "The name of this driver.",
        "MinimumMtu",
        "Punycode",
        "The iSCSI connection ID for this connection instance.",
        "SupportsVirtualDiskCreation",
        "VirtualRotate",
        "Path and filename of the executable whose traffic to filter.",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|AttachedTo",
        "Indicates the type of this queue (Connection or Local queue).",
        "LockedDownIntranetZoneAllowAccessToDataSources",
        "Whether the interface should advertise itself as a default router regardless of whether the node has a default route itself. Valid only for advertising interfaces.",
        "Proprietary Multiplexor",
        "AMProductVersion",
        "PS_MMAgent",
        "Boot Option on Limit. Identifies the system action to be taken when the Reset Limit is reached.",
        "MSFT_StorageSubSystemToPartition",
        "MaximumInputBufferSize",
        "If TRUE, the Automount property indicates that the volume will be mounted to the file system automatically when the first I/O is issued. Otherwise it will not be mounted until explicitly mounted with the Mount method or by adding a drive letter or mount point.",
        "95C890.2033.4167959155.249",
        "U - The update (e.g. errata, patch, ..., in numeric form) describing the profile's creation or last modification.",
        "MDM_SideLoader",
        "M/5 o",
        "Rescan virtual port, including all logical buses associated with that port. Miniport is expected to notify Storport for targeted bus rescan",
        "Required field of log device is missing from input.",
        "Product",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_E7C8D1A4E2346FFDEE37907DDFF48B4344B5DAFEE4B2DF86123B0112A39FA3BDc311",
        "CD_FC7FFCA0C7A5D89DD371B2F0B241E87A604E23DE48746B1BF4F9C2034FE72A72.1667.1456759291.230",
        "CD_E0C55BEA2BBEB604B7FDA1662DA6041DA8767BF74D24BFE7A9F43067C0A21CFA.1570.718215742.550",
        "Color matching should optimize for color saturation. This value ",
        "Can not include in session",
        "WorkflowRulesPath",
        "_DH_LAYOUTMAN_DOCKING",
        "Specifies the Permissions that to be allowed. The permissions are a combination of one ore more of the following:WINSTATION_QUERY, WINSTATION_SET, WINSTATION_RESET, WINSTATION_VIRTUAL | STANDARD_RIGHTS_REQUIRED, WINSTATION_SHADOW,WINSTATION_LOGON, WINSTATION_LOGOFF, WINSTATION_MSG, WINSTATION_CONNECT, WINSTATION_DISCONNECT.",
        "A binary sensor that is part of the multi-state sensor.",
        "Example: microsoft.com.",
        "DeviceProfile",
        "Control bitmask",
        "Win32_ManagedSystemElementResource",
        "10GBase-LW",
        "Validate",
        "69A2D8AF80AAE4B443CB0029F3E62BFF8D77A98B6230DF9AE6C1",
        "FunctionKeys",
        "EstimatedRunTime",
        "CIM_RebootAction",
        "MiscInfo",
        "The name of the organization related to the account.",
        "Provision",
        "C_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396",
        "CD_68F60BCE5ED1CEFD06D072F2C79847AF4A3C52BA9A8E9F51041AA990EA82C70E.2033.3360216869.247",
        "STATUS",
        "BAim}",
        "0xEFFF0053",
        "CD_9D6DAF01BF9FEB3EF2C9DA9CCCD42495EF0FF0EB48CFEA8E496981FAD2449D94.2110.1955686057.5035",
        "object:MSFT_NetIPAddress",
        "Error - Drive Not Root Directory",
        "Configuration Changed",
        "LocalDirtyByteCount",
        "Video Port",
        "UserType",
        "NextNode",
        "The long address the NIC is currently using.",
        "NumberOfVideoPages",
        "SAM Open Alias",
        "AddByTcpPortLprMode",
        "MSFT_NetDependOnLaterGroup",
        "The DeadGWDetectEnabled property indicates whether dead gateway detection occurs. Setting this parameter to TRUE causes TCP to perform Dead Gateway Detection. With this feature enabled, TCP will ask IP to change to a backup gateway if it retransmits a segment several times without receiving a response. Default: TRUE.",
        "WIN95",
        "Sets the state of various storage settings on this computer. Only the parameters specified will be set on the system.",
        "iSCSISession",
        "Win32_ModuleTrace",
        "{ae53722e-c863-11d2-8659-00c04fa321a1}",
        "UmsContextSwitch",
        "#ifdef MSFC_HBA_API",
        "MDM_EnrollmentStatusTracking_Tracking03_02",
        "Software Environment Problem",
        "AdditionalOptions",
        "This identifies the type of device element. This value dictates whether this is a file device element or a partition device element.",
        "Is it a Appx bundle",
        "object:MSFT_NetDnsTransitionConfiguration",
        "{2306fe30-dbf6-11d2-9244-006008269001}",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightDate|wMonth",
        "DisallowDigestAuthentication",
        "ROOT\\Microsoft\\Windows\\CI",
        "TRACE_CLASS_ENGINE",
        "C_CC18C1970080B4FFF58C595866822F3DA823CFBA977008C1C68DD95950E96D07",
        "Bid2Etw_MSADCE_1_Trace_TextA",
        "RSOP_PolmkrImmediateTaskV2Setting",
        "EVENT_TRACE_FLAG_RELEASEMODWRITE",
        "GetFcpPersistentBinding",
        "Thumbprint of the certificate",
        "SMBIOS|Type 4|Part Number",
        "InternetCustom",
        "11 - The database to add a new service is locked.",
        "IsActive",
        "C1: GroupNumber = 1, ConditionNegated = FALSE ",
        "Note: Classes deriving from RSOP_PolicySettingBlocked must redefine 'id' as a key",
        "This operation is only supported on data partitions.",
        "The LSO setting data for network adapter.",
        "AllowEnterpriseModeSiteList",
        "58013",
        "MSNdis_TokenRingPermanentAddress",
        "MulticastTransmittedFrameCount",
        "MediaDuplexState",
        "Package full name",
        "MSNdis_StatusProtocolUnbind",
        "This property contains the string that names the load ordering group of which this service is a member.",
        "A remove connection request is already in progress for this session.",
        "The number of cells the NIC has received without errors.",
        "MIF.DMTF|Voltage Probe|001.6",
        "7 - Security Error. Errors of this type are associated with security violations, detection of viruses, and similar issues. ",
        "{2F1A8A9F-7988-457f-A17A-8979E82043C5}",
        "esource management. ",
        "50-ohm Coaxial",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\TypeLib[Default]",
        "RSoP_PolicySettingLink",
        "WDF DPC",
        "CD_2504DC1AC3CAB9C6ED112DDC44AEE64529224B292ABC0946F5963E4C35C80939.1501.2813936869.384",
        "AllowEditDeviceName",
        "The current bandwidth of the port in bits per second. For ports that vary in bandwidth or for those where no accurate estimation can be made, this property should contain the nominal bandwidth for the port.",
        "Deferred",
        "TypeOfDependency",
        "MDM_Policy_Result01_RemoteDesktop02",
        "This class associates the setting data for a power setting with the power setting.",
        "bytes",
        "ACPI version of throttle states in use",
        "This class exposes statistical information associated with a Fibre Channel port. There should be one instance of this class for each port.",
        "Returns an array of all hardware error sources",
        "IMAPI2 MSF",
        "enableDesktopChannelBarByDefault",
        "PCI-X Mode2 266 66MHz",
        "The Dependent reference represents the CIM_DataFile class associated with the program group.",
        "Specifies the direction of the traffic to be captured when Vm Targets are added - Ingress, Egress or IngressAndEgress.",
        "ResetToSync",
        "CIM_PackagedComponent",
        "NT Log Events",
        "Video mode descriptor",
        "Clears any previously configured KMS lookup domain.",
        "51007",
        "A string that identifies this ProtocolEndpoint with either a port or an interface on a device. To ensure uniqueness, the Name property should be prepended or appended with information from the Type or OtherTypeDescription properties. The method selected is described in the NameFormat property of this class.",
        "PageFault_VirtualAllocRundown",
        "R_403C7DAFD38411FBB7FFA51AD2D0CC5E3462A61D34EA60E279877DCCDC222D62",
        "CR_CCDB0F33BA6966E88C9C16D64D85DE69D152BBDDCA55C4187234D7D768C27675",
        "BootDirectory",
        "0x000000",
        "UserRefreshIntervalUnit",
        "If CannotPoolReason contains 1 - 'Other', this field contains the string representing the vendor defined reason why this physical disk cannot be added to a concrete pool. This property must be NULL if CannotPoolReason does not contain 1 - 'Other'.",
        "Client Name",
        "MaximumNumberOfRxQueues",
        "Image",
        "flags",
        "C_9A0DB23B4C5307A117BBF9E162F8E0A10B387D66AA6B5AEFE4F2996B31F1D028",
        "HBA_EVENT_PORT_BROADCAST_D24_0",
        "3221232490",
        "The SystemPaletteEntries property indicates the current number of entries in a system's color table. If the system is not using a palette then SystemPaletteEntries is null.<P>Example: 256",
        "Data Transfer Length",
        "IL_53CE600361D9DC049AB7920A4B0095959C43531AA0DA3E5EEA49EBF699C0A9D2.457.1.47278",
        "DisableSystemRestore",
        "ConfigurationMode",
        "ReplicationCapabilities",
        "Total percent fragmentation on the volume. This property is deprecated because the computed value is unreliable.  Use FilePercentFragmentation to evaluate the fragmentation of the volume.",
        "Gets only WDAC BidTrace settings that are associated with the specified folder. You can use wildcard characters.",
        "CIM|CIM_Controller",
        "Resizes the storage tier on the virtual disk. This method is not available for pool-level storage tiers.",
        "CIM_DiskSpaceCheck checks the amount of disk space the needs  to be available on the system. The amount is specified in  the AvailableDiskSpace property.  The details of this checks are compared with the  value of the AvailableSpace property of the  CIM_FileSystem object associated with the  CIM_ComputerSystem object that describes the environment.   When the value of AvailableSpace property is greater  than or equal to the value specified in  AvailableDiskSpace, the condition is satisfied. ",
        "GRAPHOBJ Flag",
        "Number of bytes in each request",
        "UltraSPARC IIIi",
        "The IPUseZeroBroadcast property indicates whether IP zeros-broadcasts are used. If this parameter is set TRUE, then IP uses zeros-broadcasts (0.0.0.0), and the system uses ones-broadcasts (255.255.255.255). ",
        "A brief description of the purpose of Replication Group.",
        "VerticalImageSize",
        "I_A0645C5482C6C0990FF3D834DE810EE73DD1C560AC29409CF0FE88CEBDDB1D73.311.2804001211.249",
        "The PID of the owning process.",
        "InvalidCRCCount",
        "IPv6TransmitIpExtensionHeadersSupported",
        "SamRemoveMemFromAlias",
        "CD_0CEA2BFA85C402C6870520D8882306321579F18BD47E8E598ED675B423931597.1677.4157864808.371",
        "Set Information",
        "Maximum payload size in bytes, valid only for PCI-E devices.",
        "{CA2AF3B4-C15E-412B-B453-557746675FB7}",
        "Enhanced ATA/IDE",
        "ClassId",
        "CR_9F036BA68CA921AFF06984BDB9CEE80E8A2696D8DB098A0C679A6507C62F4DAD",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|Log File Max Size",
        "MSFC_FibrePortHBAMethods",
        "MSFT_CliAlias.FriendlyName=\"SCSICONTROLLER\"",
        "NDIS FDDI Attachment Type",
        " service that runs its own process.",
        "This class represents the binding information of a network adapter.",
        "The value specified is invalid.",
        "Indicates the current statuses of the element.",
        "NlServerAuth",
        "MDM_ActiveSync_User_Accounts01_01",
        "ElementSettingData represents the association between ManagedElements and applicable setting data. This association also describes whether this is a default or current setting.",
        "0xD00F",
        "ResiliencySetting",
        "The LPR queue name.",
        "Method to reset the error and warning counters. The method takes one parameter as input an integer indicating which counter to reset. For this input parameter, 0 indicates all, 1 indicates a reset of the indeterminate error counter, 2 the critical error counter, 3 the major error counter, 4 the minor error counter and 5 the warning counter. The method returns 0 if successful, 1 if not supported, and any other value if an error occurred. A method is specified so that the logical device's instrumentation, which tabulates the errors and warnings, can also reset its internal processing and counters.",
        "Chemistry",
        "InitiatorId",
        "IdentificationCode",
        "Hidden - Hidden from some users on the network.",
        "BIOS Shadowing Allowed",
        "StartAddress",
        "The class name of the network component represented by this binding.",
        "Physical memory can be located on hosting boards, adapter cards, etc. This association explicitly defines this relationship of memory to cards.",
        "Descr",
        "Password Not Required",
        "Microsoft-Windows-P2P-PNRP",
        "MDM_eUICCs_Actions02",
        "DCEnd",
        "This class is used to translate instances from the NT Eventlog.",
        "Time zone data management. ",
        "MI_ERRORCATEGORY_NOT_INSTALLED",
        "The Description property provides the description of the verb",
        "MsftDiscFormat2RawImage_DebugX Flag",
        "The number of times this application has been re-deployed.",
        "3221232477",
        "PrefixMapping",
        "Vertical polarity is positive",
        "CIM_Chassis.ChassisTypes",
        "iScsiDebug30 Flag",
        "IEEE 802.3 10BASE2",
        "TimerCancelled",
        "RSOP ID",
        "Internal",
        "MSNdis_StatisticsInfo",
        "The MaximumComponentLength property contains the maximum length of a filename component supported by the drive. A filename component is that portion of a filename between backslashes.  The value can be used to indicate that long names are supported by the specified file system. ",
        "Low Water",
        "select * from Win32_ProcessStopTrace",
        "The name of the event log",
        "This method allows the virtual disk's intended usage to be updated. Not all virtual disks may allow this and will return 1 - 'Not Supported' if this operation cannot be performed.",
        "IL_317D1F2687177AFA27CB8EA6F6A360902286E215810936DE250861D000157F69.2460.749615048.336",
        "\\\\.\\root\\cimv2:__Win32Provider.Name=\"Standard Non-COM Event Provider\"",
        "The function number of a PCI network adapter.",
        "MaxConnections",
        "MSNdis_HardwareStatus",
        "{3f2c141e-83bc-11dd-94b8-001d09162bc3}",
        "IPv4/v6",
        "NS_FFCDDDB138CCE842C0BBD0D2866863A23437EAE09282C04519C244557B1817C4\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_1DA4E180531B401F40077208B50BBADCB6F447B0318A02A094D8CA2E1EE53845",
        "Native WIFI MSM Trace",
        "Example: 3COM.",
        "Monitor's horizontal resolution in pixels.",
        "Trusted Network configuration for VPN triggering",
        "Network Cleartext - Windows 2000: This logon type preserves the name and password in the authentication packages, allowing the server to make connections to other network servers while impersonating the client. This allows a server to accept clear text credentials from a client, call LogonUser, verify that the user can access the system across the network, and still communicate with other servers. ",
        "Provides extra status information about an extrinsic method's invocation",
        "{9eab5500-e517-4d4a-85b8-d0c633da2bf2}",
        "CLSID",
        "Startup",
        "C_8163F817343339B5E10A75E5D9ECCB7DED2F4F1B41C40C672B95F8BB7CCED36B",
        "Uninstalls this license.",
        "\"Emigrating\" element is being moved away from host element. ",
        "SECHC_LOG_FLAG_INIT Flag",
        "KeyMaterial",
        "RebuildIndex",
        "Specifies whether the auto configuration settings (.INS) file is on the local machine.",
        "h6m;h6m;",
        "TimerSet",
        "SERVICE_INTERACTIVE_PROCESS ",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2167.1045814340.188",
        "The MaximumInputBufferSize property specifies the maximum size of the serial port driver's internal input buffer. A value of zero indicates that no maximum value is imposed by the serial provider.",
        "C_47A1D2A8BCF5F91E1526321DD0154B4FC3C4CAC8A7D6DF2C21F3DBE6A8700273",
        "The platform architecture of the BidTrace setting. Either '32-bit' or '64-bit'.",
        "CommercialIdSetAndValid",
        "ProviderOperation_CreateInstanceEnumAsync",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_last_logoff",
        "{DC0E96FE-DB2A-11d2-85FC-0000F8102E5F}",
        "PLATFORM_TRACE_RESERVED_19",
        "currentTime",
        "Example: 178",
        "Deletes the specified Terminal. The function takes one parameter, the Terminalname. The call returns zero on success and an error on failure.",
        "Ndis80211RTSThreshold",
        "NS_20077C61AE959B1A631CA3A64493D24CBF9AADB0D615F63F619D6D619F5BB495\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_F693A7033BB33D7405BFB98C5A3415923CC9F4EC8AC330AFF545CF21BB41905F10.0",
        "Indicates the cause for RSC being disabled for IPv6 TCP packets.",
        "PolicySourceTimeZoneRedirection indicates whether the property TimeZoneRedirection is configured by Server(0) or Group Policy (1)",
        "If true, indicates that the hardware supports Windows Data Execution Prevention (DEP) technology. DEP ensures that all memory locations are marked with a non-executable attribute unless the memory location explicitly contains executable code.  This can help mitigate certain types of buffer overrun security exploits.  If DEP is available, 64-bit applications are automatically protected.  To determine if DEP has been enabled for 32-bit applications and drivers, use the DataExecutionPrevention_ properties ",
        "The current status of the BranchCache service",
        "SecureBootState",
        "Injects hardware Error",
        "C_8BC061EB0082E96D5DC5828FD96C3FC2A01095E7E42C720BCD36F363CA556A85",
        "Maximum bytes of user data in a single packet supported by the Adapter for IPv4 packets.",
        "RSS Platform Backgroundsync Perf Trace",
        "MS_SM_AdapterInformationQuery",
        "UMBus",
        "NumActiveVPorts",
        "OfflineScanAndFix",
        "Monitor's supported display features",
        "SendConfigurationApplyAsync",
        "CIM_ProcessorCapabilities.NumberOfProcessorCores",
        "10 -Unsupported Operation Error. Errors of this type are principally associated with requests that are not supported.",
        "AllowDesktopAnalyticsProcessing",
        "AllowNonMicrosoftSignedUpdate",
        "CreateGroupReplicaFromElements",
        "LastErrorDesc",
        "Tape Drive Problem Warning",
        "C_FFF2AE454B5EBA423321420C962DDADA7E00808CE9D4E5B4FF81481A2E9CA1B6",
        "InternetZoneAllowLessPrivilegedSites",
        "Operating system",
        "TimerId",
        "Perform an ICMP ping",
        "83C0A287546253E157907791BC6A0C92D8F12064B0617A40E589308.1533.4057702091.3922",
        "Heap_SubsegmentGroup",
        "The Username parameter is a pointer to a constant null-terminated character string that specifies the account name to use when connecting to the domain controller. The string must specify either a domain NetBIOS name and user account (for example, \"REDMOND\\user\") or the user principal name (UPN) of the user in the form of an Internet-style login name (for example, \"someone@microsoft.com\"). If this parameter is NULL, the caller's context is used. Blank password is passed by using an empty string /nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. ",
        "\\\\.\\root\\Microsoft\\Windows\\winrm:__Win32Provider.Name=\"WsmAgent\"",
        "NdisTokenRingLostFrames",
        "% of Maximum Frequency is the percentage of the current processor's maximum frequency. Some processors are capable of regulating their frequency outside of the control of Windows. % of Maximum Frequency will not accurately reflect actual processor frequency on these systems. Use Processor Information\\% Processor Performance instead.",
        "LightSource",
        "CIM::Device::Ports",
        "The MaximumSize property indicates the maximum size of the  registry. ",
        "iScsiFlagInit",
        "LetAppsAccessMessaging_UserInControlOfTheseApps",
        "{8B309BDA-E3D4-11d2-8601-0000F8102E5F}",
        "PublisherId",
        "\\\\.\\root\\Microsoft\\UEV:__Win32Provider.Name=\"ComputerConfigurationProvider\"",
        "Win32_ClientApplicationSetting",
        "Manufacturer",
        "object:MSFT_NetAdapterRdmaSettingData",
        "WMI_TAPE_DRIVE_PARAMETERS",
        "DOT11_IOCTL Flag",
        "MCA Memory Error Event",
        "The QuotasDisabled property indicates that Quota management is not enabled on this volume.",
        "AuditSuccess",
        "Detailed",
        "LPCDRVR_TRACE_RESERVED_16",
        "Enables the TCPIP checksum offload properties on the network adapter.",
        "Example: A client application running on a Win32 system.",
        "PhyIndex",
        "Shadow copy storage area already exists",
        "CIM_RegisteredProfile.AdvertiseTypeDescriptions",
        "The Msft_WmiProvider_LoadOperationEvent event class defines the successful activation and initialization of the provider cache entry. WMI caches provider registration objects to decrease overallexecution time. The substem will drop cache entries either through the cache ageing process, through loss of RPC connectivity, through user control or due to some change in the provider's registration.",
        "Create",
        "The first authentication local identity",
        "MSFT_CliAlias.FriendlyName=\"DosCmd\"",
        "The Plex property indicates whether the shadow copy was created by a split mirror shadow copy provider.  The provider can be implemented in hardware or software.",
        "The FileSize property represents the size of the file (in bytes).",
        "MediaTypeDefault",
        "The AutoConvertToClsid property contains the Globally Unique Identifier (GUID)of the COM class to which this COM component will automatically be converted.",
        "Cables and links utilize physical connectors to actually 'connect' physical elements. This association explicitly defines this relationship of connectors for CIM_PhysicalLink.",
        "C_8CFD3BDCF459E28A190CCF46FF43F533DE3394389F988133FD28EA5A0AEA1616",
        "Indicates the current statuses of the element. Various operational statuses are defined. Many of the enumeration\\'s values are self-explanatory. However, a few are not and are described here in more detail. ",
        "Current profile.  This is only valid in the ActiveStore.",
        "UniqueIdFormat informs the user what VPD Page 0x83 descriptor type was used to populate the UniqueId field.",
        "CIM_DirectorySpecification",
        "RS-232C",
        "MSFT_ExpressionKeywordParameter",
        "C_3F47C7C5EDE1255249E372E90C4D8EAB77757D572A8E1F6E22B79B0FD3819343",
        "HDSplitFlags",
        "A number that identifies the event in the event log.",
        "FileSystemImageTracing",
        "Raw Arcnet",
        "The operating system's number for the disk on this StorageNode. Disk 0 is typically the boot device. Disk numbers may not necessarily remain the same across reboot, and are not necessarily the same on different nodes.",
        "EdgeTraversalPolicy",
        "PhysicalDiskRedundancy",
        "LanguageMatch",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|Max Wait On Events",
        "LPC_TRACE_RESERVED_14",
        "ObHandleEvent",
        "LocalOnlyMapping",
        "O:BAG:BAD:(A;;0x1;;;BA)(A;;0x1;;;NS)(A;;0x1;;;LS)(A;;0x1;;;S-1-5-32-568)",
        "IsManualAttach",
        "Represents a Print Job on a print queue",
        "RemoveMembers",
        "ROOT\\Standardcimv2",
        "MDM_MultiSIM_01",
        "OverwriteOutDated",
        "MSNdis_ReceiveScaleCapabilities",
        "PNP_RESOURCE_WARNING_LEVEL",
        "IPv6OperationalState",
        "Volume is not mounted",
        "REG_BINARY (3) ",
        "CIWmi",
        "ESCD support is available",
        "The Group property indicates the type of codec represented by this class.",
        "Identifies the event within the NT Eventlog logfile. This is specific to the logfile and is used together with the logfile name to uniquely identify an instance of this class.",
        "The operating system.",
        "LPC_TRACE_RESERVED_1c Flag",
        "The VMQ Queue setting data for the network adapter.",
        "LetAppsAccessCellularData_UserInControlOfTheseApps",
        "Indicates if the Adapter supports TCP options for receive checksum offload on IPv6 packets.",
        "NDIS 802.11 Base Service Set Identifier: the MAC address of the associated access point. Writing this is useful when doing a site survey.",
        "A link between the operating system and one or more processes running in the context of this operating system.",
        "object:MSFT_NetAdapter_VmqFilter",
        "0xEFFF003A",
        "PersistentVolumeID",
        "MSFT_StorageObject.UniqueId",
        "LetAppsAccessMotion_ForceDenyTheseApps",
        "The interval of time provided for a receive operation to complete.",
        "4 - CIM_ERR_INVALID_PARAMETER. One or more parameter values passed to the method were invalid. ",
        "NormalDownloadsPending",
        "RequireEncryption",
        "Indicates if this is a fully discovered model",
        "C_A4B7E1219FA76BD23A588641B4F3CEC1D9A3585F7F85B74432295927C547BE69",
        "NISEngineVersion",
        " Starts the service during the StartServices action. ",
        "The name of NT Eventlog logfile. This is used together with the RecordNumber to uniquely identify an instance of this class.",
        "ref:CIM_PhysicalPackage",
        "StorageTierSizes",
        "SharePath",
        "Creates a new LPR printer port on a given server",
        "ReadWarning",
        "Number of layer 2 frames received for all inbound RDMA traffic",
        "R_01F6508C1866E0E79B21585B0217BD595D533D4A180A35479737402276CAE352",
        "Failover operation requires subsequent split",
        "CD_18BBD01AB9B011850ED53F3C153FB85C4D5FA9678EC8589287B293A340368BF6.2084.1.12902",
        "NetLogon Secure Channel Setup",
        "The CreateFlags property specifies additional values that control the priority class and the creation of the process. The following creation values can be specified in any combination, except as noted:",
        "Tracked",
        "If TRUE the share will be continuously available.",
        "ResetAuthLockOut",
        "The DriverDate property is the Date of the driver e.g 1-25-2001 ",
        "TimeOnBackup",
        "Example: EST = Eastern Standard Time. ",
        "2 - 'Completed': The request is completed. Copy operation is idle. ",
        "A list of CategoryId guids for categories that apply to this application.  Each guid corresponds to one of the CategoryId properties of an instance of RSOP_ApplicationManagementCategory.",
        "Maximum length of an adapter card that can be inserted into the slot, in inches.",
        "Query Security",
        "CIM_OperatingSystem.Name",
        "Windows cannot identify all the resources this device uses.",
        "Retrieves a structural representation of the object's security descriptor",
        "C:\\Windows\\System32\\drivers\\ACPI.sys[ACPIMOFResource]",
        "VESA GTF",
        "The variable-length null-terminated string specifying the name of the computer that generated this event.",
        "Info for a file extension associated with a RemoteApp",
        "The detailed status of the rule, as a string.",
        "DoNotSendAdditionalData",
        "Credential to access the proxy server",
        "DOT11_WLANGPA Flag",
        "FromLine",
        "Distinguished name for the subSchema object. The subschemaSubentry property and subschema are defined in LDAP 3.0 (see RFC 2251).",
        "Release For CC Flush",
        "SystemVariable",
        "InHost",
        "Both Initiator and Target",
        "RequiredClientCount",
        "PCI_BUS_CMD is valid",
        "ConfigureTraditionalChineseIMEVersion",
        "Journal",
        "ClientConnectionEncryptionLevel",
        "Class for holding properties of a resource object that changed state during current interval.",
        "HBA_FCPSCSIENTRY",
        "PFXCertPasswordEncryptionStore",
        "MSFT_NetConSecRuleQMCryptoSet",
        "Types",
        "CONTROL Flag",
        "SM_SendRLS",
        "{794569ee-137c-4a06-8add-d225b53dfc4b}",
        "The MaximumComponentLength property contains the maximum length of a filename component supported by the Win32 drive. A filename component is that portion of a filename between backslashes.  The value can be used to indicate that long names are supported by the specified file system. For example, for a FAT file system supporting long names, the function stores the value 255, rather than the previous 8.3 indicator. Long names can also be supported on systems that use the NTFS file system.",
        "Bridge",
        "Represents the replication capabilities of a storage subsystem.",
        "The SettableParityCheck property determines whether parity checking can be set on the serial port",
        "VirtualDiskNames",
        "5DCEADFA575A67B8870603880BD491602DCD3BD7BDE6B9896E3244EBC7BD1866",
        "UserDisksStorageUrl",
        "TemporarySubscriptionsTotal",
        "Retrieve the virtual ports created on a physical port.",
        "OtherErrorSourceFormat",
        "MaximumNumberOfTxQueuesPerNonDefaultVPort",
        "MGR_TRACE_RESERVED_16",
        "Name of GPO, if not specified the default GPO on the domain.",
        "\\\\.\\Root\\cimv2:__Win32Provider.Name=\"InvProv\"",
        "MIF.DMTF|Operational State|003.8",
        "//           via the HBA api set.",
        "C_972576376A5F2C5C3EBE5402A0C00A72BB51E33D448C072392A8C26DEF804EC3",
        "OS Scsi bus number target is mapped to. If 0xffffffff then any value can be picked by the miniport.",
        "\\\\.\\root\\wmi:__Win32Provider.Name=\"BcdProv\"",
        "SetByGroupPolicy",
        "{FAF76B8E-798C-11D2-AAD1-006008C78BC7}",
        "C_46C4D7624EF726AE82EECFECC7D2FAFCB46460D191B35F158A7EEAE469E508E2",
        "If true, do not detect slow network connections. If false, use the SlowLinkTimeOutParams property to determine whether the computer has a slow network connection.",
        "The platform architecture of the ODBC Connection Pooling PerfMon counters. Either '32-bit' or '64-bit'.",
        "HiveDCEnd",
        "The binding used by this endpoint.",
        "MDM_VPNv2_User_01",
        "SECAM H",
        "DebugPrograms",
        "TRUE if the adapter can use IPSEC to protect iSNS traffic.",
        "JobCountSinceLastReset",
        "OffloadDataTransferSetting",
        "The world wide node name of the physical port",
        "Association between iSCSITarget and iSCSIConnection",
        "Initiator",
        "This represents an object element. The Id field specifies a BcdObject in the same store.",
        "Removable Drive",
        "CreateObject",
        "{B5BD98B8-0201-11d1-A50E-00A0C9062910}",
        "LetAppsRunInBackground_UserInControlOfTheseApps",
        "NumVPorts",
        "VirtualMachineIsolationProperties",
        "IR_2493B293FAE24B9DB6F542A76F6954F10DD366AAEC07782F39E87A24408C09BC",
        "001 - Priority ",
        "Target ID at the time of the event",
        "It should be noted that there are two new values in RequestedState that build on the statuses of EnabledState. These are \"Reboot\" (10) and \"Reset\" (11). Reboot refers to doing a \"Shut Down\" and then moving to an \"Enabled\" state. Reset indicates that the element is first \"Disabled\" and then \"Enabled\". The distinction between requesting \"Shut Down\" and \"Disabled\" should also be noted. Shut Down requests an orderly transition to the Disabled state, and might involve removing power, to completely erase any existing state. The Disabled state requests an immediate disabling of the element, such that it will not execute or accept any commands or processing requests. ",
        "WarningLimit",
        "LocalTunnelEndpoint",
        "MDM_Policy_User_Result01_Education02",
        "IL_C0406F771E2762D51D71E72E6570A0AE6C617FB931ABE8CC68B7711AA6A0E7F1.311.3044912591.229",
        "I_CEEB04238836B14B55751D5FC8F0C378A54AF1942F10226666FDE7520B51B7EC.699.1.57184",
        "SHA-512",
        "LogChangeToken",
        "Specifies a string data value.",
        "CD_15D17602950F6C84D799561B467DD6E41D14A7C8F3BB2D223F118DC47EBDE909.1609.182019657.699",
        "{5ec10360-a61a-11d0-8dd4-00c04fc3358c}",
        "RestoreProperties",
        "32768..",
        "Behavior monitor is enabled",
        "Number of bytes in error record",
        "The size beyond which the 802.11 device should fragment packets",
        "AutoRestartNotificationSchedule",
        "Read buffer size in bytes.",
        "CD_FE3818270093A67B72B546EA3ACF6E4265D33BD8A3B28562DCE0CFA8C720DE41.1.293509503.173",
        "The AttachedTo property indicates the port to which the POTS modem is attached.",
        "The URL of this device (when discovered via IPP Directed discovery)",
        "{FAF76B5C-798C-11D2-AAD1-006008C78BC7}",
        "CD_7DB1E30FC06BBCD83555FCA1DA86A907938086DE88B466575ED4B935DD61EAE7.1998.2378983960.1742",
        "9CF698D7EEC94B834EB78003323F67E90BFA3A62F30C576",
        "ApplicationContentUriRules",
        "Specifies the most process memory in kilobytes used by any process ever associated with the job. ",
        "Coordination type",
        "Process name associated with the detection",
        "MSNdis_TokenRingLostFrames",
        "OtherHostTypeDescription",
        "3.5,  20.8MB, 512 bytes/sector",
        "The ResolveAddressesNames indicates whether or not the command will resolve address names of output address values.  The default is False - no resolution.",
        "CIM_ERR_SERVER_LIMITS_EXCEEDED",
        "AcquireFailures",
        "AddProgram",
        "ConfigAutomaticRestartSignOn",
        "MaxMrCount",
        "Best guess, if no match is found fallback to PS=3",
        "Site of target",
        "StreamingAllowReestablishmentInterval",
        "LanaIdList",
        "TestConfiguration",
        "Association between iSCSIConnection and Disk",
        "C_110AE6309AE2428224AA19A1DF291C0EC1E01C277EE0FBFA7CE4C91884A74444",
        "object:WSP_StorageFaultEvent",
        "The Win32_OnBoardDevice class represents common adapter devices built into the motherboard (system board).",
        "CR_48A5B17344C48EDAFAA391BF26A48FFF52648D73B54F3E703A672629602CEB4B",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1330.2476940105.211",
        "C_F78D535F784AB5BF2A7DF53DE5ACAAF1C73DACC48189425DF45543879C147259",
        "The UserName property indicates the owner of the environment setting. It is set to \"<SYSTEM>\" for settings that are specific to the Win32 system (as opposed to a specific user) and \"<DEFAULT>\" for default user settings.",
        "PlugInApplicationID",
        "FX_TRACE_RESERVED_1c Flag",
        "UseManagedPresentationBindingElement",
        "Object which contains details of a proxy server connection.",
        "User Flag",
        "String Security Descriptor associated with the Terminal.",
        "Win32_RDAllowListFileAssociation",
        "11011",
        "NumericSensorElementName",
        "HDSplitParameters",
        "ExclusionPath",
        "0x000010",
        "ValidationURL",
        "MSNdis_AtmMaxAal1PacketSize",
        "NTSC M",
        "TandemNT",
        "MDM_ClientCertificateInstall_PFXCertInstall01_01",
        "C_EC835FD001719DF0125212FFB95D0470D32F9067FFBFAA346321BD635810CDC2",
        "MsiProductCode",
        "LOGON Sessions.  ",
        "MGR_TRACE_RESERVED_07",
        "MajorVersion",
        "Thumbprint",
        "Specifies if the cleaning action was successful",
        " 0x00000000 ",
        "NDIS Set Port Auth Parameters on a Port",
        "See CIM_Sensor.SensorContext for details.",
        "MSNdis_StatusTaskOffloadChange",
        "Win32API|Font and Text Structures|LOGFONTW|lfHeight",
        "C_961B71EE3CEF77853FD06FD1FD078D670615B8B606936AC4407F5BADB29E35F4",
        "The message parameters that are plugged into the default message template for the Health Action type. These can be plugged into a custom message.",
        "Win32_DCOMApplication",
        "A non-negative integer for prioritizing this PolicySet component relative to other elements of the same PolicySet. A larger value indicates a higher priority. The Priority property MUST have a unique value when compared with others defined for the same aggregating PolicySet.",
        "Redeploy Count",
        "SCM Event Log Consumer",
        "EVENT_TRACE_FLAG_INTERNALDEVICECONTROL",
        "association",
        "0xC005005F",
        "PolicySourceLoadBalancing",
        "I_2C3E0B2C69ECC1F533E094C6BC0D6FE2FF50B62467F6FB0D4116BA80049303DF.2505.1781271333.301",
        "SlowLinkUIEnabled",
        "SaveProdSites",
        "ProcessorAcpiCst",
        "V.34bis",
        "PNP_EVENT_INFO_LEVEL",
        "Scans the registry to get the current file associations for an application.",
        "Token name for the translator within its package.",
        "Unknown",
        "MSFT_NetAdapter_RdmaAdapterInfo",
        "DefaultRecoveryPoint",
        "RadioSoftwareRevision",
        "{F34765F6-A1BE-4B9D-1400-B8A12921F704}",
        "ProcessorLevel",
        "The Win32_SessionConnection class represents an association between a session established with the local server, by a user on a remote machine, and the connections that depend on the session.",
        "OMI_BaseResource",
        "OIDs for extension controls supported by this directory server",
        "MSFT_Disk.Number",
        "SpinLockAcquireSampleRate",
        "FromPersistentLogin",
        "Extended",
        "CR_47A1D2A8BCF5F91E1526321DD0154B4FC3C4CAC8A7D6DF2C21F3DBE6A8700273",
        "MSFT_MaskingSetToVirtualDisk",
        "IsAttachAPN",
        "ROOT\\Appv",
        "LPCReceive",
        "ClientDebug",
        "CreatedFileServer",
        "Initializing",
        "The platform architecture of the ODBC DSN to retrieve. Possible values are '32-bit', '64-bit' or 'All'. The default is 'All'. This is the platform architecture on the remote machine if this command is executed in a remote CIM session.",
        "Indicates the physical elements that make up a product.",
        "The PrintJobDataType property indicates the data type of the print job pending on the printing device.",
        "Describes the contents of the instance: 1 = Applied Application, 2 = Removed Application, 3 = ARP List item.",
        "The interface is used by iSCSI software initiator and is in the paging path.",
        "SERIAL_WMI_COMM_DATA",
        "CIM_FRU",
        "The Description property provides a textual description of the storage job operation.",
        "I_BF593FDA4BA33F9ED167DAD655EB0DCA41D164E127B57BF7155EB8BC36FD4AEB.398.1.150684",
        "Class that represents data for folder redirection extension",
        "PhoneNumber",
        "VendorSpecificID",
        "Specifies whether an Activation message can be processed by the Operation.",
        "C_366404C6BBC789A7EE3D5ACCDE9C5AB09583CC8BC05AB7F7F7498213BA102D4C",
        "One of the following values:  - Disabled: Disable memory pressure protection.  - Enabled : Enable memory pressure protection.  - Default : Restore memory pressure protection state to the system default.",
        "ColorProfiles",
        "WPDShServiceObj_f2 Flag",
        "MSFT_TaskMaintenanceSettings",
        "FirstCipherAlgorithm",
        "9065566F-5FD6-4b40-9961-98E3A3DD174E",
        "The Name property contains an identifying name.",
        "Sequence",
        "OpenPolicy_End",
        "43024",
        "This class represents a BCD object which holds a collection of BCD elements. Each BCD object is is identified by a guid.",
        "SourceReplicationGroupFriendlyName",
        "MsiInterruptSupported",
        "IL_A149399DE5D286F444C4B111636DFBC68048E4FDC5152AA24ED98EA642F0ABAF.2457.373749567.361",
        "SetIPXVirtualNetworkNumber",
        "DataType",
        "SamSetInfoGrp_Start",
        "CreateReplicationGroup",
        "This field indicates the number of underlying physical disks across which data for this storage tier is striped.",
        "FieldParametersArrayElementSize",
        "Number of reports to be collected before the the api returns.",
        "The filter associated with the TCP setting.",
        "{FAF76B6D-798C-11D2-AAD1-006008C78BC7}",
        "Tapi Flag",
        "Configure Microsoft Defender Exploit Guard network protection feature.",
        "EnumerateAdministrators",
        "`0m;`0m;",
        "Xon Xmit Threshold",
        "3 = The application had potential upgrades for other applied settings, ",
        "Corrected single-bit error",
        "The SetTcpMaxDataRetransmissions method is used to set the  number of times TCP will retransmit an individual data segment before aborting the connection. The retransmission timeout doubles with each successive retransmission on a connection.",
        " Since software elements in a ready to run state cannot transition into  another state, the value of the phase property is restricted to  in-state for CIM_SoftwareElement objects in a ready to run state. ",
        "C06A7839AF030746D343DE6FF14B8AB.2705.3966710648.303",
        "The specified resiliency setting is not supported by this storage pool.",
        "Expired",
        "AppAlias",
        "RestrictedSitesZoneDownloadSignedActiveXControls",
        "MIF.DMTF|Processor|014.3",
        "ClearProductKeyFromRegistry",
        "PortableDeviceTypes_General",
        "You must specify a size by using the Size parameter.",
        "Mapper Flag",
        "The DisplayName parameter passes the display name of the service. This string has a maximum length of 256 characters. The name is case-preserved in the service control manager. DisplayName comparisons are always case-insensitive. ",
        "CIM_Processor.Family",
        "CIM_PhysicalComputerSystemView.LogInstanceID",
        "ResourcesNotInDesiredState",
        "{101C0E22-EBBA-A60A-EC3D-58797788928A}",
        "InputMegabytes",
        "MSFT_ExpressionValue_sint64",
        "PortableDeviceAPI_Internal",
        "The trace level of the System.ServiceModel trace source.",
        "The SharedElement reference represents the properties of the directory that has been mapped to a shared resource.",
        "object:MSFT_CliParam",
        "Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpBinaryPathName ",
        "11010",
        "CIM_MemoryWithMedia",
        "ContractName",
        "DnsServer2",
        "Localized version of RSOP_PolmkrPowerOptionsSetting for American English",
        "RTSSuccessCount",
        "#define HBA_EVENT_ADAPTER_REMOVE        0x102",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_3BF0ED88A4A3B50849FB14D362B499D7F456C13105F674E9CFB83E87773B49A7",
        "The provisioning policy for the virtual disk is determined in a similar way to the resiliency setting. If no preference is specified in the ProvisioningType parameter, the policy is determined by the storage pool's ProvisioningTypeDefault property. If the ProvisioningType parameter is specified, the default is ignored and the value specified will be used instead. ",
        "FX_TRACE_DRIVER",
        "IL_2A8E85BB31065B3FC60BA81CED6A654079AE6D371D42FEE2259112FC3A521E06.290.3903742088.330",
        "Synchronous Snapshot Remote",
        "{447956fa-a61b-11d0-8dd4-00c04fc3358c}",
        "Defer",
        "The firewall profile.",
        "dataBuffer",
        "BaseAddresses",
        "Represents a Windows Defender firewall rule.",
        "SM_GetPersistentBinding",
        "SAM Enumerate Domains In SAM Server",
        "Mini SG",
        "#define ISCSI_LOGIN_FLAG_USE_RADIUS_VERIFICATION          0x00000020",
        "This class provides capability to add additional management authorities and retrieve previously installed authorities",
        " The CIM_ApplicationSystem class is used to represent an  application or a software system that supports a particular  business function and that can be managed as an independent  units. Such a system can be decomposed into its functional  components using the CIM_SoftwareFeature class. The software  features for a particular application or software system are  located using the CIM_ApplicationSystemSoftwareFeature  association.  ",
        "\\\\.\\root\\msdtc:__Win32Provider.Name=\"MsDtcWmi_EventProvider\"",
        "BufferCount",
        "FC4Statistics",
        "CD_F71CEDE68D110C46E631A74BD74BB02467459B066EB8F2E32432A8044C4EFD32.2059.318580994.258",
        "DisableStealthMode",
        "ScsiBusNumber",
        "Win32_ClassicCOMClass",
        "ref:MSFT_NetAdapterUsoSettingData",
        "// The number of bytes received using the AH protocol.",
        "Error logging capability",
        "The FILE_DEVICE_XXX type for this device.",
        "CD_A9FE98FE5C3E9051AEEC71D48BD2011F883E1553AA2DD7968A20C510AD60108F.281.4084949831.450",
        "Win32_WIN32_TSSESSIONDIRECTORY_Prov",
        "C_CC8D8F676137BCD5D5531414C0F461E5894D404FA15D384607EF32C9D2D87E32",
        "CableManagementStrategy is a free-form string that contains information on how the various cables are connected and bundled for the frame. With many networking, storage-related and power cables, cable management can be a complex and challenging endeavor. This string property contains information to aid in assembly and service of the frame.",
        "MSFT_DiskToPartition",
        "iseconds",
        "Other - For integer values other than those listed above, refer to WinSock error code documentation.",
        "RebootNowMethod",
        "SONET Overhead Channel",
        "{8502C4B4-5FBB-11D2-AAC1-006008C78BC7}",
        "iScsiFlagInit Flag",
        "MsftDiscFormat2StreamInterleave_DebugConstructor Flag",
        "PCI-X Mode2 533 66MHz",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2473.3028845912.180",
        "Modifies the cache file configuration.",
        "The DaylightInEffect property specifies if the daylight savings is in effect. ",
        "DeviceInterface",
        "Power Save - Hibernate",
        "The ResumeService method attempts to place the service in the resumed state. It returns an integer value of 0 if the ResumeService request was accepted, 1 if the request is not supported, and any other number to indicate an error.",
        "MSiSCSI_QueryLBPolicy",
        "Supplies the setting for waking on Magic Packets. If this property is Enabled, then the adapter wakes the system on receipt of a Magic Packet.",
        "The space currently free on the volume.",
        "DeleteJobByObject",
        "{9565979F-7D80-11D2-AAD3-006008C78BC7}",
        "The maximum cache file size, in bytes",
        "ROOT\\cimv2\\mdm\\dmmap",
        "   /* Fabric Link  Events */",
        "The FixComments property contains additional comments relating to the update.",
        "Parent Process Id",
        "Relative paths are not supported.",
        "Hardware",
        "PLATFORM_TRACE_RESERVED_0d",
        "EnableLargeMtu",
        "This parameter indicates the default allocation policy for virtual disks created in a fault domain aware storage pool. For example, an enclosure aware subsystem could balance each data copy of the virtual disk across multiple storage enclosures such that each enclosure contains a full data copy of the virtual disk.",
        "Minor version number of the application.",
        "DriverCompleteRequest",
        "0 - 'Not Specified': The method of maintaining the copy is not specified. ",
        "LPCDRVR_TRACE_RESERVED_0d Flag",
        "PLATFORM_TRACE_LOG Flag",
        "NdisTokenRingCurrentRingState",
        "CD_66987DC488F04E3DC6BA6B1845D5EB313904DDD6D9EA97184EA6AED23E5B39CA.305.2621047284.2052",
        "The scan failed",
        "Wide Area Network (WAN)",
        "Boolean indicating that the alarm is visible. ",
        "0xC0000001",
        "MSFT_LocalizablePropertyQualifier",
        "CorrectableError",
        "move in (VHPT fill)",
        "One replication group per storage pool",
        "The DataQueueSize property indicates the size of the data queue.",
        "GetPhysicalPresenceConfirmationStatus",
        "DOT11_MSM_CONNECT",
        "Specifies the name of the print queue to delete the job from.",
        "WmiMonitorAnalogVideoInputParams",
        "The Unregister-AppBackgroundTask cmdlet unregisters the background task for the specified TaskID",
        "CD_ED6C3A2F6CC04DF3DD2F991B72C978A94559E5D3850ACCDF521D9DB88CF8E809.1172.1328899242.1834",
        "Enable_BCHostedServer",
        "Roaming",
        "valid",
        "Denotes whether this subsystem supports remote mirror replication.",
        "ref:Win32_IP4PersistedRouteTable",
        "DriveHardwareError",
        "SoftwareLicensingProduct",
        "Filter Tokens",
        "Invalid file",
        "FeatureUpdateMethod",
        "Minor failure",
        "SetClientProperty",
        "CD_84BBAE9FD8A6E21188B2D0767DBEB321A61D32EF3C67D9E47C565889A9DA260D.1622.1.17766",
        "The LocalAccount property indicates whether the account is defined on the local machine. ",
        "A non-negative integer for prioritizing this Policy Rule relative to other Rules. A larger value indicates a higher priority. The default value is 0.",
        "PolicySourceVideoPlaybackRedir indicates whether the property VideoPlaybackRedir is configured by Server (0),Group Policy (1).",
        "The Win32ErrorCode property contains the Win32 error code most recently encountered that caused the operation to fail.",
        "Current Monitor Brightness - percentage",
        "Supports Reparse Points",
        "MsftDiscFormat2StreamConcatenate_DebugGeneral Flag",
        "Client User Name",
        "R_2CEA3682CC09E7F94D9FBC1BBA63FC6DB39872E53B9187129DFF772A12215DD5",
        "MDM_Updates",
        "Property to tunnel DNS queries over IPsec channel.",
        "00454DDDA9AB999B5E05A2F468BA888F0D0794E6BA1EBDCCF2A4463EC03258CC6",
        "1 = local, 2 = site, 3 = domain, 4 = OU",
        "Farm Name",
        "CD_418C5DB6A4996A7931075FA27FB4B9D160A819D899115082794D414F286000CD.1050.238635868.242",
        "TerminalServer-MediaFoundationPlugin",
        "The password associated with StratName.",
        "Full Power",
        "Requests that the LogicalDevice be enabled (\"Enabled\" input parameter = TRUE) or disabled (= FALSE). If successful, the Device\\'s StatusInfo/EnabledState properties should reflect the desired state (enabled/disabled). Note that this method\\'s function overlaps with the RequestedState property. RequestedState was added to the model to maintain a record (i.e., a persisted value) of the last state request. Invoking the EnableDevice method should set the RequestedState property appropriately. ",
        "MIF.DMTF|Physical Extent|001.3",
        "Antivirus signature update date and time (using round-trip UTC format)",
        "1 = Complete memory dump ",
        "NtlmLogonUser_Start",
        "The PasswordChangeable property determines whether the password on the  user account can be changed.",
        "AppendPrimarySuffixes",
        "NumSuggestedReceiveBuffers",
        "Cycles",
        "iSCSITargetCreationScheme",
        "The configuration object that aggregates the dependency.",
        "<LocalID> is chosen by the business entity and should not be reused to identify different underlying (real-world) elements. If not null and the above \"preferred\" algorithm is not used, the defining entity must assure that the resulting InstanceID is not reused across any InstanceIDs produced by this or other providers for the NameSpace of this instance. ",
        "Number of bytes for network change status indication",
        "CD_316028CB4766215C2B0D3643DCC0FC70FE66BE560FA2335CAFFF2477CB4C6F30.1538.1069046242.535",
        "If this property does not contain 0 or null and the implementation does not support this parameter, a return code of \\'Use Of Timeout Parameter Not Supported\\' must be returned.",
        "The InitialR2T key is used to turn off the default use of R2T, thus allowing an initiator to start sending data to a target as if it has received an initial R2T with Buffer Offset=0 and Desired Data Transfer Length=min (FirstBurstSize, Expected Data Transfer Length).",
        "Authorized machines for transport mode, specified as an SDDL string.",
        "Create a virtual port on behalf of a Guest Virtual Machine with a specific WWPN with no authentication mechanism.",
        "ApplyCause",
        "EVENT_TRACE_FLAG_DISK_IO",
        "I_98233BC0D6E21C2CA3187CB9E2307592DF6D759478E209568F3CA340985F3F72.1163.1217761889.326",
        "MDM_Policy_Result01_Display02",
        "SamQueryInfoUser_Start",
        "ROOT\\Rsop\\User\\S_1_5_21_3968686040_3210279463_847977608_1001",
        "Socket 478",
        "{FAF76B84-798C-11D2-AAD1-006008C78BC7}",
        "CR_AD7EFADAD1289B4A3FEF0D60EBF19DD1D014EA7A1302D0431E7F57E3F564CBFB",
        "CD_F2BF551D2C47E413C4BD58FCB0E48E0B3211C53383EC4051E655BB8319ADD47D.32.2244598954.441",
        "Removable",
        "ref:CIM_LocalFileSystem",
        "The DebugFilePath property indicates the path to the debug file. A debug file is created with the memory state of the machine after a machine failure./nExample: %systemRoot%\\Memory.dmp",
        "The Primary Computer feature is enabled for this user",
        "50003",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_CA7CE6FFAF43B56926F209A331362CC194ADC07878E9BCCA1137E8869300AA67",
        "GenerateTokenActivationChallenge",
        "WINSTATION_SET=0x2",
        "SizeInBytes",
        "Bit position specifies the bit within the memory word that is in error",
        "Number of ports starting from the AutoReusePortRangeStartPort for automatic reuse port range.",
        "MaximumAllowed",
        "PCI Express Root Complex integrated endpoint",
        "Average Request Processing Time",
        "The firmware slot number to download the firmware image to.",
        "RS-485",
        "CIM_ERR_CONTINUATION_ON_ERROR_NOT_SUPPORTED",
        "QryTrstDomByNam_Start",
        "LogFlagFunction Flag",
        "CR_19C500FDB2411645397763142D9A3522EA74E9619B1C45A89DC1DCDB49E04CDD",
        "The serial controller.",
        "The Microsoft iSCSI Initiator Service is not running. Please start the service and retry.",
        "CD_F0EF832F7E32814D7777DD11888257DC22CAE482B915B9B0977CF796309CDC79.1836.264942133.332",
        "Specifies that split tunnel should be enabled for the VPN connection profile. If this parameter is not specified, split tunneling is disabled.",
        "The Win32_MethodParameter class is a base class forimplementation of method parameters derived from this class.",
        "Deprecated description: The type of module, when PortType is set to 1 (\"Other\".)",
        "CD_4BBA71B8B969B6626A0E7F60779736282C60AEC40553354F5884C7B9E51AF36A.17.1896102235.288",
        "IPv4 Address of the target PCSV device",
        "FATAL Flag",
        "A string describing and identifying how the card is mounted on or plugged into the 'other' card. slot information could be included in this field and may be sufficient for certain management purposes. If so, this avoids creating instantiations of connector/slot objects just to model the relationship of cards to hosting boards or other adapters. On the other hand, if slot and connector information is available, this field could be used to provide more detailed mounting or slot insertion data.",
        "4 - 'Prepared': All necessary preparation has completed. ",
        "MDM_SharedPC",
        "The c",
        "Event Trace Header Extension",
        "Is setting valid",
        "WMI|Win32_LoadOrderGroup",
        "AutoConvertToClsid",
        "   ISCSI_DIGEST_TYPE_CRC32C = 1",
        "EVENT_TRACE_FLAG_SETVOLINFO",
        "Async",
        "SOAPTraceClient Flag",
        "PageFileUsage",
        "Win32API|Device Context Functions|GetDeviceCaps|VERTRES",
        "AudioCaptureRedir",
        "CD_5F3A7D47CFF70177272CA0960C1975D28A99D9A71A82E07B0FC43A060E86CD93.1129.3389141475.375",
        "The DeviceEntriesInAColorTable property indicates the number of color indexes in a color table of a display device. If the device has a color depth of no more than 8 bits per pixel. For devices with greater color depths, -1 is returned.",
        "R_23DDB252CC4D2FD4A1F4DD3D5C1D39DC829D566848D6F27132AE759E1E502D48",
        "CR_85D86CD958DA6FAD92EA55F1468078F0400F29C2B1A327B27C870BF7829AB8FB",
        "// NIC performance information class, implement one instance for each port on",
        "#define ISCSI_LOGIN_FLAG_ALLOW_PORTAL_HOPPING         0x00000008",
        "EntryCount",
        "Unspecified network bridge",
        "object:MSNdis_NetworkDirectAdapterInfo",
        "The Name property indicates the name of the printer with which this configuration is associated.",
        "Print job management. ",
        "0 - Windows Server 2003, Small Business Edition ",
        "R_DD65DCCCF94B294A159B1976955652736468E9C2375F9198A05555F7A9DD6CB9.2466.2959430166.554",
        "APNName",
        "{8502C54A-5FBB-11D2-AAC1-006008C78BC7}",
        "Bid2Etw_MSDAREM_1_Trace_TextW",
        "Device error logging supported",
        "RequirePrinting",
        "The Win32_NetworkLoginProfile class represents the network login information of a particular user on a Win32 system. This includes, but is not limited to, password status, access privileges, disk quotas, and login directory paths.",
        "ref:RSOP_IEAKPolicySetting",
        "ClassVersion",
        "DUE_AS_SIGNATURE",
        "MSFT_HealthActionEvent",
        "This method allows the physical disk's usage to be updated.",
        "The Win32_DeviceBus class represents an association between a system bus and a logical device using the bus. This class is used to discover which devices are on which bus.",
        "Associates a FirewallRule to its AddressFilter.",
        "FrameworkName",
        "MachineDPI",
        "DiskIndex",
        "VersionMinor",
        "ProcessorStatus",
        "Available capacity of the media",
        "scsiStatus",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_FC2BFFA6927303B4EA6E4BF8BFA5EE1163BF97ADE47296175A18CABC7358E25A71d7",
        "TotalGetSPI",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|SpeakerModeDial",
        "HBA_FCID",
        "{A76BD4E3-9961-4d9b-B6BE-86E698260F68}",
        "R_6207FC985B813296446B1804CB375DB5F534F2ECBDB07E00035AFBECB15FD3A9",
        "TargetStoragePoolName",
        "CD_CF7E5037F6563CE949872FEF4BA72C8CE3F9C68DD9A3E9BD325E8B9ECC946118.1734.3897513760.475",
        "MI_ERRORCATEGORY_OPERATION_TIMEOUT",
        "SDBUS_DEBUG_WORKENG Flag",
        "{749AFE4D-804D-4662-A68B-DC696655C79A}",
        "The currently allocated size of the storage tier. If the storage tier's ProvisioningType is 2 - 'Fixed', this value should equal Size. If the ProvisioningType is 1 - 'Thin', this value is the amount of space actually allocated (i.e. some value less than Size).",
        "CIM_RegisteredSpecification.AdvertiseTypeDescriptions",
        "object:MSNdis_WmiOutputInfo",
        "_DH_WMP_LIBRARY",
        "The PMTUDiscoveryEnabled property indicates whether the Maximum Transmission Unit (MTU) path is discovered. ",
        "LogToEventlog",
        "CIM_IPProtocolEndpoint.IPv6Address",
        "NetMgmt",
        "CD_6C29EF4ACC836F85EF7659E17930E4D493CC19A2D7E63C6C1051EF8AB7CAEFC7.315.1833908819.1422",
        "MSFT_CliConnection",
        "Win32API|System Shutdown Functions|ExitWindowsEx",
        "ATM Address",
        "CR_36FFCD7C103F4CB151534CDC404DD1E71C91E39EA5D1DCB2E130739044899EBB",
        "Win32_TSAccount",
        "LossOfScopeAction",
        "3 - 'Suspend' stops the job temporarily. The intention is to subsequently restart the job with a second call to RequestStateChange requesting 1 - 'Start'. It might be possible to enter the 'Service' state while suspended. (This is job-specific.) ",
        "Socket 940",
        "CD_EC31DBAC8296A2F597184183FC259C7595AD4BCCFF23FB0BD832DE414BDE578A.40.592058408.553",
        "PLATFORM_BUS_SPECIFIC_DATA",
        "MovableFiles",
        "No Error Correction",
        "LUAInstall: error 0x00000005 setting flags [{740EC24D-46AD-4334-A076-41CCC3F8D9B4}]",
        "INPROGRESS_PLATFORM_UPDATE",
        "The TotalTracks property indicates the total number of tracks on the physical disk drive. ",
        "CIM_ParallelController.CapabilityDescriptions",
        "BudgetCrossed",
        "NS_822BF93DF9C3C1C79665F622BFB88ADE1B36A57966014C1ECF6C9DBE68DBADA5\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_100109F264418A8891B8DA48D69393178E571025D114D35005EB8841D88FAEA5",
        "CIM_FileAction",
        "Limit Priority Class",
        "Ndis802_11AuthModeAutoSwitch",
        "keyword",
        "This flag is only used for MsChapv2/EAP-MsChapv2 Authentication Methods. It indicated whether the User Winlogon Credentials are to be automatically used for connection using the current VPN connection profile.",
        "The method returns a 'generic failure' if it finds an invalid string in the registry key or an integer value that can be interpretted as follows: ",
        "The HorizontalResolution property indicates the current number of pixels in the horizontal direction (X axis) of the display.",
        "SPACES_VirtualDiskToStorageTier",
        "object:MSFT_SmbMapping",
        "The identifying information of the entity (i.e., the instance) generating the error. If this entity is modeled in the CIM Schema, this property contains the path of the instance encoded as a string parameter. If not modeled, the property contains some identifying string that names the entity that generated the error. The path or identifying string is formatted per the ErrorSourceFormat property.",
        "Quiesce",
        "Maximum data width (in bits) supported by the SCSIController.",
        "Normal boot",
        "{8ce71f2c-d63a-4390-a487-18fa47262ceb}",
        "A link between the operating system and the file system(s) from which this operating system is loaded. The association is many-to-many since a distributed OS could depend on several file systems in order to correctly and completely load.",
        "System Volume",
        "IdleTime",
        "The current installed state for the software element.",
        "ISCSI_RedirectPortalInfo",
        "GetSuspendCount",
        "The CurrentRefreshRate property specifies the frequency at which the video controller refreshes the image for the monitor. A value of 0 indicates the default rate is being used, while 0xFFFFFFFF indicates the optimal rate is being used.",
        "ServiceModel",
        "MMCSSEvent",
        "Bit field indicating which information is specified",
        "The Win32_DeviceSettings class represents an association between a logical device and a setting that can be applied to it.",
        "Parity checking supported",
        "SMBIOS|Type 1|System Information|Product Name",
        "MSFT_VirtualDiskToStorageFaultDomain",
        "20 - There are invalid characters in the name of the service.",
        "The Domain parameter returns the domain name under which this process is running.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1355.1261870644.180",
        "MetaData",
        "The hosting system.",
        "Specifies the transaction isolation level.",
        "Win32_DiskPartition",
        "7 - 'Split': The target element was gracefully (or systematically) split from its source element -- consistency is guaranteed. ",
        "CIM_AggregatePExtent",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.1463.2914244638.297",
        "The Quick Mode crypto set used by this rule.",
        "iScsiDebug29",
        "CallbackContext",
        "IR_EBF6936E6C9BCA72F0513569683DC50AAF6985750D21624859069228CB4387EA",
        "MSFT_Printer",
        "Registry_V0",
        "MDM_Policy_Result01_NetworkIsolation02",
        "The current operating mode of this BranchCache client",
        "R_3F82EE31D83B18D246D7774830C1021C0BC36D39A20BC99C61EDEE13101B1C56.1334.4121792424.538",
        "KeyValuePair",
        "This method refreshes the cached disk layout information. This is useful when the backing disk has changed size (if the backing data store is a VHD or a virtual disk).",
        "C_6FFBA8B5854E9C5C5C698A9277971D04E447B67166A26CB7D9DD0D9F278C2D8B",
        "Receive filter current capabilities of the adapter",
        "CD_4BD0F8A6C8D9EC0678D50228DC3CB44B9F26CFF9B291F8B882B0AD7C252B23A9.42.3154021213.219",
        "Certain values for UniqueIdFormat may include various sub-formats. This field is a free-form string used to describe the specific format used in UniqueId.",
        "String URL of the download manager location",
        "ETW trace session buffer size in KB.",
        "AttributeCachingForDirectoriesMax",
        "I_FD2C5547FFE1F8AE5543C4178384019AC9604DE68E2D71F4D4CAD1DB441347D3.2664.318208373.283",
        "SetForestTrustInfo_End",
        "UdpIPv4HashSupported",
        "is the most appropriate choice for business graphs when dithering ",
        "Remote resource requires remote CIMOM",
        "Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly",
        "9 - 'Quiesced': The replication has been quiesced and is ready for a change. ",
        "The Win32_SystemProcesses class represents an association between a computer system and a process running on that system.",
        "VersionMin",
        "Sensor type code of the sensor that generated the event",
        "OriginalLastWriteTime",
        "Wireless Profile xml for this connection.",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|EnableEvents",
        "KeyManagementServiceLowPriority",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_3FB1CC987258F8087BD78386B8DDA093F7A2030F966FAF6199D43EFA0F6275CC5200",
        "Instruction Cache",
        "MSFT_ResourceNotInDesiredState",
        "The Description property provides a descr",
        "Msft_WmiProvider_ExecQueryAsyncEvent_Pre",
        "TLBOp",
        "If the application was installed via on-demand installation through a COM activation, this is the CLSID that caused the installation",
        "CDROM",
        "SmartBatteryVersion",
        "The total number of kilobytes that can be stored in the operating system's paging files. Note that this number does not represent the actual physical size of the paging file on disk.  0 indicates that there are no paging files.",
        "21 - Invalid parameters have been passed to the service.",
        "LetAppsAccessPhone_ForceDenyTheseApps",
        "Default recovery point value",
        "Event Data Field 2",
        "RootDNForSearchAndQuery",
        "If the Operation parameter is supplied, the method returns only the CopyStates that the operation can be accepted.",
        "Msft_WmiProvider_PutInstanceAsyncEvent_Post",
        "{8502C4CB-5FBB-11D2-AAC1-006008C78BC7}",
        "NumberOfMediaSupported",
        "L2CacheSize",
        "MSNdis_LinkStateData",
        "MDM_EnrollmentStatusTracking_PolicyProviders02_01",
        "{F127E50E-E3E0-11d2-8601-0000F8102E5F}",
        "BaseAddress",
        "The buffer given for processing the request is too small.",
        "The QuotasRebuilding property indicates that the file system is in the active process of compiling information and setting the disk up for quota management.",
        "LetAppsActivateWithVoiceAboveLock",
        "CD_44176E2582D203C4E24AFCA28B3D2E229104AC44AFAB0DE90ED2E93CD38781CD.276.1213186376.139",
        "MSDART",
        "The Win32_VolumeQuotaSetting class associates the disk quota setting with a specific disk volume.",
        "JIS B4",
        "4294967295",
        "MSFT_DSCConfigurationStatus",
        "Class for holding properties of a resource object not in desired state.",
        "DiskPercent",
        "MSFT_StorageSubSystemToStorageNode",
        "CD_EE95DA75DAF58996DD64AF173044F543D1582822947D33302AD4D1498AE0C965.2145.1.35209",
        "Frame Size",
        "1 - 'Thin' indicates that the storage tier's capacity is allocated on demand. ",
        "The Name property identifies the network name of thenetwork client running on a Win32 system.",
        "Reserved; do not use.",
        "This method allows the user to specify the replication settings for this replication group.",
        "Win32Registry|.DEFAULT\\Control Panel\\Desktop|ScreenSaveTimeOut",
        "CscDclUser",
        "dscproxy",
        "Win32_PingStatus",
        "Property",
        "folderItem",
        "overwrite",
        "CreateStore",
        "FullScanAndRebootRequired",
        "ref:CIM_Processor",
        "CR_133926115907D1CAA329A707F5DA6057F1FEF2436D8F8041CFE6E68664D6F252",
        "The NumberOfLogons property indicates the number of successful times the user tried to log on to this account.  A value of 0xFFFFFFFF indicates that the value is unknown. This property is maintained separately on each backup domain controller (BDC) in the domain. To get an accurate value only the largest value from all BDCs should be used.",
        "MIF.DMTF|FRU|002.3",
        "Win32_SecuritySettingOfObject",
        "The InitiatorNode specifies the iSCSI name of the initiator node to use for the connection. If empty, then the adapter can choose any initiator node name.",
        "CIM_DependencyContext",
        "configurationNamingContext",
        "The ServiceName property indicates the service name of the network adapter. ",
        "This property specifies the type of the parameter. The \"int\", \"long\", \"word\", and \"dword\" types specify a numeric parameter; \"edit\" and \"enum\" types specify a text parameter. Note that the values for all the parameters that are displayed in the user interface, including numeric parameters, are stored in the registry as REG_SZ (null terminated string) data type.",
        "Attach",
        "EmbeddedIn",
        "OnlineMode",
        "LastQuickScanSource",
        "A PolicyAction aggregated by a PolicyRule or CompoundPolicyAction.",
        "7 - 'Resyncing': resync-in-progress. ",
        "CIM_VideoBIOSElement",
        "SamGetMemInAlias_End",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSNETWORKADAPTERSETTING_Prov\"",
        "The next hop address or gateway address.",
        "CD_1DC5050B83682C310993D0E23C7DB3EBF7DFCB3434893B4CCE67A03B9E83366B.1781.3945260413.6194",
        "IssuingThreadId",
        "The resource.",
        "firstPartyPrivacyType",
        "IsIndicationEnabled",
        "Image_V2",
        "CD_8DE46DD6446B26621A23E11758AE5CBC62C9F72998CAFB08B9CD58DF66902A20.1149.2006706579.422",
        "Enables the Large Send Offload (LSO) properties on the network adapter.",
        "R_FC7D3378D1DC67F512BCF3EFB19471A307C46119DC62738B7B6512B57CDA306A.1197.4284827137.560",
        "fc-a61b-11d0-8dd4-00c04fc3358c}",
        "Association between InitiatorId and VirtualDisk",
        "PreventInstallationOfMatchingDeviceInstanceIDs",
        "0x80050044",
        "lGPO\"",
        "CR_CFA7490FC441CDBFE3AC487F4E7E6794E550150460C43DF35BA636FBEF5C66C5",
        "dwProvSubType",
        "\\\\.\\root\\cimv2:__Win32Provider.Name=\"WMI Self-Instrumentation Event Provider\"",
        "HeapFree",
        "This field is an array of custom identifier for the node. If this field is set, the OtherIdentifyingInfoDescription field must also be set.",
        "Msft_CliAlias.FriendlyName=\"RDNIC\"",
        "A Status property indicates the current status of the Disk Quota.",
        "Sense Key",
        "The Win32_SystemDesktop class represents an association between a computer system and its desktop configuration.",
        "SupportsCQResize",
        "MSNdis_CoTransmitPduErrors",
        "WritePrivileges",
        "The IPPortSecurityEnabled property indicates whether IP port security is enabled globally across all IP-bound network adapters. ",
        "{123c80d2-937f-4cfe-80f4-c40d596e48b7}",
        "Win32API|Communication Structures|DCB|BaudRate",
        "FailedConnectionAttempts",
        "Temperature (in tenths of degrees Kelvin) at which the OS must activate CPU throttling (ie, enable passive cooling)",
        "MSFT_NetNatTransitionMonitoring",
        "The Win32_SessionResource association represents the relationship between a session and the resources that the session provides access to.",
        "The specified offset is not valid.",
        "NDIS Set Interrupt Moderation",
        "ServerHidden",
        "TM_CACHE",
        "Force option required",
        "MSFT_NetAdapterPowerManagement_Offload is the base class for various network adapter offloads.",
        "Indicates the total sum of all the capacity used by this storage pool. If the pool is primordial, this will be the sum of all capacity currently allocated to concrete storage pools. If the pool is concrete, this value should be the sum of all capacity currently allocated to virtual disks and other pool metadata.",
        "MSiSCSIInitiator_TargetClass",
        "TracingIoctl",
        "PolicySourceLoadBalancing indicates whether the property GetLoadBalancingStateis configured by Server (0) or Group Policy (1).",
        "{4479570a-a61b-11d0-8dd4-00c04fc3358c}",
        "The FileID of a Win32_FileSpecification associated with this selfreg module action.",
        "MPSA Bus",
        "IL_AF84A75EB301BFDAD9D850AE7DB9A8A21071085DBF56B1A75FE90C7F0D1A63A5.2687.1411970770.263",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_GRACEFUL_CLOSE",
        "ExpireOn",
        "NdisCoReceivePdusNoBuffer",
        "object:ProcessorAcpiCst",
        "ApplicationLaunchPrefetching",
        "Defragmentation",
        "iQualifier",
        "CPU cycle counter",
        "PLATFORM_TRACE_RESERVED_0e",
        "commandSpecificInformation",
        "CIM_ElementCapacity",
        "Ndis80211AuthenticationMode",
        "AllowDataSense",
        "The security settings of the share",
        "DiskSignature",
        "SetInformationPolicy2",
        "References the software element that is installed.",
        "Clears any previously specified activation method configured for the VL client.",
        "4 - Lockout -  The account is currently locked out. For NetUserSetInfo, this value can be cleared to unlock a previously locked account. This value cannot be used to lock a previously unlocked account.",
        "TM_LIST Flag",
        "SystemSpecificCollection for IPMI",
        "Free Address",
        "{5C59FD61-E919-4687-84E2-7200ABE2209B}",
        "NPIV_UNSUPPORTED_PROTOCOL_VERSION",
        "RemoveProgram",
        "FwpkclntTraceProvider",
        "ListLogTypeDesc",
        "MIF.DMTF|FRU|002.12",
        "RD_TRACE_RESERVED_10 Flag",
        "Delta Replica Target",
        "MIF.DMTF|IRQ|001.1",
        "The QuiesceDevice method has been deprecated in lieu of the more general RequestStateChange method that directly overlaps with the functionality provided by this method. ",
        "C_D13827DA0ED443FFD82DBB415FC1698F7DC60C2E8774ABDA878946AA14F41C91",
        "CD_488B67E05BD8C144F890DD1628D2D632822D5CE3B99BFDA24BA6CC55C387B3C4.30.1560784502.718",
        "OtherAccessContext",
        "MSFT_VolumeToFileShare",
        "C_FE8C3873BDAD1853EA9CE4F9A8CC51817A3AA40D4095EE7168936C23511B49CF",
        "RFC877 X.25",
        "61001",
        "CIM_NonVolatileStorage",
        "Set list of Programs to use Virtual IP",
        "CommittedSpace",
        "6273C542.2482.1673011973.1155",
        "The path to the icon for this file association",
        "AssetTag",
        "NetNcCim",
        "Win32_PnPSignedDriverCIMDataFile is an association class basically used to get all the binary files associated with the driver",
        "IntervalTimer",
        "Specifies the paper type that the Printer will use if a PrintJob does not specify a particular type. The string should be expressed in the form specified by ISO-IEC 10175 Document Printing Application (DPA) which is also summarized in Appendix C of RFC 1759 (Printer MIB).",
        "Classification settings are enabled.",
        "AccessCredentialManagerAsTrustedCaller",
        "The ShareName property indicates the share name of the Win32 printing device./nExample: \\\\PRINTSERVER1\\PRINTER2",
        "MIF.DMTF|Power Supply|004.16",
        "Local Replica Source or Target",
        "StreamingVerifyCertificateRevocationList",
        "{8502C4C3-5FBB-11D2-AAC1-006008C78BC7}",
        "{981f2d77-b1f3-11d0-8dd7-00c04fc3358c}",
        "Interface not configurable",
        "CD_2442933444240B68F1B8232208304D509D6ECF5830E4F4F8E4EDD13186DE1B28.38.1710327355.1251",
        " The UserInputDelay property indicates the time to wait, in seconds, for the user to hit any key before it begins to autochk the disks.",
        "IntegrityCheckMethod",
        "View is an abstract class that provides a common superclass for classes providing de-normalized, aggregate representations of managed resources. The definition of each sub-class will include properties propagated from the the graph of classes that are used to model the resource in the normalized view. The classes may be resource classes or associations. The definition of how a value is propagated (i.e. source class and value transformations) is required to be specified. ",
        "ALPC-Receive-Message",
        "Dial whenever a network connection is not present",
        "Win32_ProviderEx",
        "CR_5E9AFB2824E4C09259A80739D70D94E550D572E8A9E41593DAFDA14D65369AE4",
        "The SetPMTUDiscovery method is used to enable Maximum Transmission Unit (MTU) discovery. Setting this parameter to TRUE causes TCP to attempt to discover the MTU (or largest packet size) over the path to a remote host. By discovering the Path MTU and limiting TCP segments to this size, TCP can eliminate fragmentation at routers along the path that connect networks with different MTUs. Fragmentation adversely affects TCP throughput and network congestion. Setting this parameter to FALSE causes an MTU of 576 bytes to be used for all connections that are not to machines on the local subnet. Default: TRUE. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "0xEFFF002B",
        "0x301",
        "Channel",
        "LoggingLevel",
        "\\\\.\\root\\standardcimv2\\embedded:__Win32Provider.Name=\"AssignedAccess\"",
        "The Microsoft Defender Antivirus WDO Scan Class",
        "{5ec10361-a61a-11d0-8dd4-00c04fc3358c}",
        "#define ISCSI_LOGIN_OPTIONS_MAXIMUM_CONNECTIONS         0x00000004",
        "MSFT_MaskingSetToInitiatorId",
        "The Clsid property, if applicable, defines the COM CLSID associated with server implementation. Note: decoupled providers do not have an associated COM CLSID.",
        "DetailedTracking_AuditDPAPIActivity",
        "SPACES_StorageSubsystemToStorageNode",
        "42004",
        "Specifies the total number of processes terminated because of a limit violation. ",
        "Read Total Uncorrected Errors",
        "The CIM_PhysicalComponent class represents any low-level or basic component within a package. Any physical element that is not a link, connector, or package is a descendent (or member) of this class. For example, the UART chipset on an internal modem card would be a subclass (if additional properties or associations are defined) or an instance of CIM_PhysicalComponent.",
        "Router",
        "LetAppsAccessAccountInfo_ForceAllowTheseApps",
        "Specifies the computer name.",
        "HasCertificate",
        "AggressiveModeGroupID",
        "The Win32_MotherboardDevice class represents a device that contains the central components of the Win32 computer system.",
        "0 - 'Off': No files will be scrubbed. ",
        "Within the scope of the instantiating Namespace, InstanceID opaquely and uniquely identifies an instance of this class.",
        "CR_37D6265F83F0B4A807334DDDEAC8A1C96BFA3B726A45400FF628A9564B8A2E7A",
        "Temp Duplicate Account",
        "{fa77a74e-e109-11d0-ad6e-00c04fd8fdff}",
        "// This class exposes the configuration capabilities if the adapter able to",
        "PoolTrace",
        "object:DtcTransactionsTraceSettings",
        "ExpectedReading",
        "Reference to the dial-up connection settings.",
        "PageFault_HeapRangeDestroy",
        "CD_EA2F4ED6B8AA0BEEE14A7235028BAD0C1DDD97703732E8317B8FE1581E43A3CF.36.4016821109.632",
        "GroupCount",
        "BITS Service Trace",
        "File System Class Name",
        "PCMCIA Type I",
        "SECURITY_DESCRIPTOR",
        "47709ECAB1D7F037756AC8CE7.0.356834401.209",
        "The Uncompress method uncompresses the logical file (or directory) specified in the object path. Uncompress returns an integer value of 0 if the file was successfully decompressed, and any other number to indicate an error./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n",
        "C_BC8304297DAEA08EF836B71DA253942E5C6B510805DB5280CDD11086EF113EFB",
        "TxWords",
        "OutNumOfPhyCounters",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.2236362174.368",
        "Boolean indicating that the ComputerSystem, with its running OperatingSystem, supports power management. This boolean does not indicate that power management features are currently enabled, or if enabled, what features are supported. Refer to the PowerManagementCapabilities array for this information. If this boolean is false, the integer value 1 for the string, \"Not Supported\", should be the only entry in the PowerManagementCapabilities array.",
        "RSOP_PolmkrNtServiceSetting",
        "ValueRole",
        "{FECB095B-F0FA-11d2-8617-0000F8102E5F}",
        "MSFC_HBAPortAttributesResults",
        "R_094555A29C724CB99AD80F8257BA7ACBF3FB68F96D97E3E687892E1586B8D179",
        "Designation of the country/region for which the rack is designed. Country/region code strings are as defined by ISO/IEC 3166. The rack type is specified in the TypeOfRack property.",
        "NA-6x9-Envelope",
        "MSFT_DOUploadUsage",
        "NDIS Link Speed",
        "plicable",
        "{47B706B0-B103-4AFD-8ECF-16C2DDF81C15}",
        "PolicySourceHomeDirectory indicates whether the property HomeDirectory is configured by Server(0) or Group Policy (1).",
        "Indicates if the Adapter supports UDP checksum computation offload for transmit IPv4 packets.",
        "Association between the security settings of an object and its owner",
        "EnableProfile",
        "Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|QuotaPeakNonPagedPoolUsage",
        "The name under which this printer is shared.",
        "NtlmValidateUser",
        "Specifies the name of the VPN connection profile to be created.",
        "Is Deleted",
        "SELFHEAL",
        "ODBC Driver Instance Provider.",
        "Specifies the URI template for the request.",
        "CanAccessLicenseServer",
        "Maximum Space",
        "PartitionIdentifier",
        "MFTPercentInUse",
        "Association between StorageSubSystem and InitiatorId",
        "em Slot 1",
        "%State%",
        "The SCSI Path ID associated with this LUN, matching the SCSI_ADDRESS",
        "AllowVPNRoamingOverCellular",
        "Product version information.  Corresponds to the Version property in the product object in the DMTF Solution Exchange Standard.",
        "Version of the token-based activation license that activated the machine.",
        "CD_044C6F3044E48C22993C2C07FFE6E4308713F44D28305AEAA2DE9289AE1E867E.2555.3021878382.523",
        "Is interlaced",
        "The UserId property specifies the relative ID (RID) of the user.  The identifier verifies that the user exists and is unique to this domain.",
        "PCI_COMP_INFO_ClassCodeBaseClass",
        "Proxy Settings",
        "0 - Unknown. The format is unknown or not meaningfully interpretable by a CIM client application. ",
        "0xD020",
        "0 - 'Unknown': The severity is unknown or indeterminate. ",
        ",1m;,1m;",
        "Sets the power state of the computer. The use of this method has been deprecated. Instead, use the SetPowerState method in the associated PowerManagementService class.",
        "Allow",
        "OverWritePolicy",
        "Duplicate PathIds were specified in the call to set Load Balance Policy.",
        "MaxPartitionCount",
        "Port allocation count",
        "MSFT_NetIKEMMCryptoProposal",
        "CD_2A82469DE4EDED369FA467BEF3E6440FE893BBC1F56ED2AB23AD8D2515E35AC8.39.3633314286.1042",
        "The IPXAddress property indicates the Internetworking Packet Exchange (IPX) address of the network adapter. The IPX address identifies a computer system on a network using the IPX protocol.",
        "TrustedSitesZoneAllowAutomaticPromptingForActiveXControls",
        "LPCDRVR_TRACE_RESERVED_12 Flag",
        "Command Line Arguments setting",
        "CR_8F21C89CAF771FFCC47E28C59A7D76DBF0F63931FC16518B322428129F505FDF",
        "SMBIOS|CSMBios|GetVersion",
        "DisplayValue",
        "CIM_Dependency",
        "{652E2D58-DB37-11d2-85FC-0000F8102E5F}",
        "This method, for a given ReplicationType, returns the supported replication group CopyStates.",
        "Indicates if the Adapter supports TCP options for transmit checksum offload on IPv4 packets.",
        "The number of rekey operations for IPSEC SAs.",
        "This is a wrapper method used to change the network configuration of the BMC. ",
        "TargetNameSpace",
        "MDM_PassportForWork_DeviceUnlock01",
        "StartDate",
        "{BCD64CCE-DB29-11d2-85FC-0000F8102E5F}",
        "12 - CIM_ERR_NO_SUCH_PROPERTY. The specified Property does not exist. ",
        "MSFT_NetConSecRuleInProfile",
        "CR_6A87D660F0F6A66279CF024432941A2BC16A9043D5A3CF26ADC36D1DFFEBF2B9",
        "Specifies the prefixes for the addresses for which the proxy should not be used.",
        "Minimum VSync denominator",
        "CD_193A1F93E9A6CD7A4161C999356A3002DCBF3CA9FF51ADA6126191BC996D2103.2623.2154352180.653",
        "I_2A8E85BB31065B3FC60BA81CED6A654079AE6D371D42FEE2259112FC3A521E06.290.3903742088.330",
        "FirmwareType",
        "Horizontal refresh rate denominator",
        "object:MSNdis_WmiIPSecOffloadV1_Supported",
        "LogicalDisks can be BasedOn a single Volume (for example, exposed by a software volume manager), or be BasedOn a DiskPartition directly. The former relationship is made explicit in this association.",
        "Win32API|Performance Data Structures|PERF_OBJECT_TYPE|PrivilegedTime",
        "SecurityServicesRunning",
        "{CCCB122D-D5C4-4ee1-8001-B8AD6D3CE876}",
        "The RegisteredProfile that is referenced by the Dependent Profile.",
        "MaintainProcessorArchitectureOnUpdate",
        "The InitialSize property indicates the initial size of the page file.  ",
        "\"Lost Communication\" indicates that the ManagedSystem Element is known to exist and has been contacted successfully in the past, but is currently unreachable. ",
        "Int 14h, Serial Services are supported",
        "Cyclic integrity checksums that can be negotiated for the header digests",
        "POINTER_PORT_WMI_STD_I8042",
        "The thumbprint of the AD certificate for device registration",
        "R_7F637DAE12A5C57B84338EBF2100C5D2953335CDC28294203995748012501B4E",
        "GatewayName",
        "Pipelined Burst SRAM",
        "ScsiTargetNumber",
        "MCA Platform Specific Error Event",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.1172.511946988.1321",
        "Win32_ConnectionShare",
        "Member Workstation",
        "The OtherOperationCount property specifies the number of I/O operations performed, other than read and write operations.",
        "CD_FD3BBD4C42AC2F7FEF264340A9EB78A581FE5C28561CB63EDF780B329EAC2EE4.316.3636309488.3428",
        "GNU Hurd",
        "ref:MSFT_NetAdapterBindingSettingData",
        "REG_QWORD",
        "SupportsMultiEngine",
        "The vendor specific data (page 04h for example) from an enclosure.",
        "Bid2Etw_ODBC_1_Trace_TextA",
        "Errors not related to medium",
        "NdisStatusDot11DisassociationIndication",
        "SMBIOS|Type 1|UUID",
        "PurposeDescription",
        "C_3DBA7E264DDA7F8A7A309588967A7B5C3508359FF35613C96FF730C82E46EDC2",
        "ref:Win32_NamedJobObjectLimitSetting",
        "ScrubPolicy",
        "HNet_ResponseRange",
        "CR_D7E5160C539A0B6F0E4DAC59284A5E27B97E67D93CF88E4C35B4F0FB64E90C36",
        "Strings identifying the boot sources on this physical computer system. See CIM_BootSourceSetting.StructuredBootString description for details.",
        "The AdditionalDescription property contains additional information relating to the error.",
        "MSFT_NetServiceStopControlSuccess",
        "EVENT_TRACE_FLAG_RELEASESECTIONSYNCH",
        "AttachDebugger",
        "FRF .16 Multilink FR",
        "Library Loader Security Path Search Event",
        "GPE GUID",
        "UMDF - Framework Trace",
        "Redirected Target portal's socket number",
        " Adding the value 0x08000 to the flags in the following table specifies that the overall install will fail if the service cannot be installed into the system.",
        "06405DFC",
        "The hardware ID of this driver.",
        "IL_4BD704EFD82E90D58D3C406978C7C044F013A64518E8C54785195D2358D9CFAE.1806.2760646680.425",
        "50005",
        "The version string for the current management firmware on this physical computer system.",
        "TotalUserTime",
        "OtherAuthenticationMethod",
        "Indicates whether C type (burst) timing is supported (value=5) or not (value=4). Also, \"Other\" (1), \"Unknown\" (2) and \"ISA Compatible\" (3) are defined.",
        "02015DD6EAA0272.2642.837909254.263",
        "Timing Problem",
        "LastStartTime",
        "MetaConfiguration",
        "Table",
        "Percentage of freespace that is fragmented on the volume. This property is deprecated because the computed value is unreliable.  Use AverageFreeSpacePerExtent, LargestFreeSpaceExtent and TotalFreeSpaceExtents to evaluate the fragmentation of volume free space.",
        "0xEFFF004E",
        "Context information that the provider can use to optimize the set, This is optional.",
        "The lower-level endpoint that is accessed by the SAP.",
        "Win32|WINNT.H|QUOTA_LIMITS|MinimumWorkingSetSize",
        "R_DC75EB8D61AF59F2FEB9BAFCC51C26F93B19442C9F5E9F7C071B8627E9152155",
        "No Root Directory",
        "Win32_TypeLibraryAction",
        "SpoolEnabled",
        "Provider can manage remote source",
        "KernelQueueEnqueue",
        "AutoReusePortRangeNumberOfPorts",
        "The class returns both local as well as mapped logical disks. However, the recommended approach is to use this class for obtaining information on local disks and to use the Win32_MappedLogicalDisk class for information on mapped logical disk.",
        "R_62D05C4ECF40774F04063E6FDE0B1A6CE4B671271358A09E1596B6EBA1E2DD4A",
        "DynamicPortRangeNumberOfPorts",
        "Array",
        "The authentication scheme used to authenticate client requests being processed by an HTTP listener. ",
        "LUAInstall: error 0x00000005 setting flags [{92dbad9f-5025-49b0-9078-2d78f935e341}]",
        "SCSI Name String",
        "ClearKeyManagementServiceLookupDomain",
        "TXFKTM Flag",
        "Indicates the current status of SMART.",
        "MonthlyUploadRestriction",
        "R_B837FF0F19509FD7BD0B7ED8ED2B62529F924B69EF7322F8463864ECBCB01E5E",
        "Enables or Disables ClientWallPaper if the property is not enabled by Group Policy. It returns an integer value of 0 if call was a success in case of Server-Override mode and an error if the policy was set to Group control policy  ",
        "// Ping will perform ICMP ping requests to the destination address ",
        "Program version",
        "HorizontalRefreshRateDenominator",
        "A part of the object's key value, the DMA channel number.",
        "SSID for the wireless LAN.",
        "SMBiosData",
        "NewThreadWaitTime",
        "Service (11) indicates that the Job is in a vendor-specific state that supports problem discovery, or resolution, or both.",
        "MI_ERRORCATEGORY_RESOURCE_UNAVAILABLE",
        "0-365 | 4294967295",
        " 1 = default (system) ",
        "0x00000021",
        "IssuedTokenAuthentication",
        "deleteExistingFavorites",
        "ValidationFlags",
        "IMAPI2 Multisession Sequential",
        "Example: Floppy Disk Driver",
        "CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allow all instances of this class and its subclasses to be uniquely identified.",
        "File Trace",
        "UMS Scheduled Thread Park",
        "The time interval that the Job has been executing or the total execution time if the Job is complete. Note that this property is also present in the JobProcessingStatistics class. This class is necessary to capture the processing information for recurring Jobs, because only the \\'last\\' run time can be stored in this single-valued property.",
        "Number of ports (or TCP/IP addresses) on the adapter",
        "TransportBindingElement",
        "DnsIPAddress",
        "IL_AF686E0250184E59C8224EE6DB6A18B07AFF9644B10E666A16E16683312717E5.2681.3111836495.285",
        "NotNapCapable",
        "PublishingAllowServer4",
        "LocalMachineZoneJavaPermissions",
        "IL_B0D346C46B9FB4AC80F0B10779D27F152046C18A7D474120D250279643DB5AB0.2685.3073600845.275",
        "The scoping system's name. ",
        "ModulationBell",
        "PinnedForUserByPolicy",
        "LastRunVolsnapPinnedSlabs",
        "DataWidth",
        "IL_AF9342E98D42AF93D6B6DE01168D36238A3AA5B6BE6AF5714A68580A93B2B964.2695.2422142089.273",
        "Validation bits to indicate the validity of the subsequent fields",
        "ForceOffFeedback",
        "Windows Defender Firewall API",
        "The installed state of the product.",
        "Win32API|Network Management Structures|USE_INFO_1|ui1_status",
        "LetAppsAccessTasks_ForceAllowTheseApps",
        "0x000100",
        "CSwitch_V2",
        "MSFT_ResiliencySetting.InterleaveMin",
        "The name of the organization responsible for producing the physical element. This may be the entity from whom the element is purchased, but this is not necessarily true. The latter information is contained in the Vendor property of CIM_Product.",
        "ref:RSOP_SOM",
        "Remote Node Transmission Error",
        "CD_E5D4D776B7B585D555547688115A6F8AC1380E1C8D52767A06A9776972F7BC0E.310.3693403664.2297",
        "security audit failure",
        "iSCSI Initiator Instance",
        "#define HBA_EVENT_LINK_UNKNOWN          0x500",
        "SwitchName",
        "Win32_MemoryDevice",
        "KeyManagementServiceOOTGraceRequests",
        "Groups",
        "TRACE_CLASS_SESSION",
        "RD_TRACE_RESERVED_0f",
        "IL_B14D0FD3D5A8CFC6EB06319633CCC6B11EAB364BE3A00E6ABC259B60FA974330.2690.956885840.268",
        "The directory mounted.",
        "This control decides whether the network device should wake up the system only on receiving a Magic packet",
        "EspEnabled",
        "C_3FDA482EEA11D105F777BB4C0E86194FDFA63901845D94A245BC2172A88E5638",
        "AllowTabPreloading",
        "select * from WSP_FsStorageModificationEvent",
        "The DriverName property indicates the name of the printer driver used for the print job.",
        "EncodeImageQuality",
        "AllowLocalFirewallRules",
        "The remote tunnel endpoint(s).",
        "This field contains the address or unique identifier for the corresponding initiator port.",
        "_DH_WMP_HME Flag",
        "Admin",
        "SMBIOSBIOSVersion",
        "Remove all HTTP SSL certificates",
        "R_20EDCE2D529E2E6BCE41DEE4170C3E9E6D3DEAF61091F14E5541886CD554DE30",
        "Logoff",
        "Enables Built-in Diagnostics Tracing (BidTrace) for troubleshooting WDAC components. ",
        "Supplies the destination address of the SYN packet.",
        "N - The minor version (in numeric form). ",
        "Limit",
        "Duration",
        "ScriptFilename",
        "RD_TRACE_RESERVED_1c",
        "Report Count",
        "NT Domain management.  ",
        "Estimated Wait Time",
        "RestoreBackup",
        "MaximumModerationInterval",
        "PartOfDomain",
        "MSNdis_CoMacOptions",
        "4-m;4-m;",
        "A RegisteredProfile describes a set of CIM Schema classes with required properties and/or methods, necessary to manage a real-world entity or to support a usage scenario, in an interoperable fashion. RegisteredProfiles can be defined by the DMTF or other standards organizations. Note that this class should not be confused with CIM_Profile, which collects SettingData instances, to be applied as a 'configuration profile' for an element. ",
        "CD_BA7526B37D90714D7B62CC8C0306D68C0FA9CA2FF62FAB9215A612E133C74CD5.1649.3416858697.2266",
        "File Format Error",
        "Name of the item with all parent folders preceding it in the same format as that of folders preceding a file.",
        "Win32_PowerManagementEvent",
        "ControlFlags",
        "ObjectLocator",
        "Time To Clean Drive",
        "The following values for CIM status code are defined: ",
        "An identifier for the indication filter that selects this indication and causes it to be sent. This property is to be filled out by the indication sending service. The value shall be correlatable with the Name property of the instance of CIM_IndicationFilter describing the criteria of the indication. The value of the IndicationFilterName should be formatted using the following algorithm: < OrgID > : < LocalID >, where < OrgID > and < LocalID > are separated by a colon (:) and < OrgID > shall include a copyrighted, trademarked, or otherwise unique name that is owned by the business entity that is creating or defining the value or that is a registered ID assigned to the business entity by a recognized global authority. In addition, to ensure uniqueness, < OrgID > shall not contain a colon (:).When using this algorithm, the first colon to appear in the value shall appear between < OrgID > and < LocalID >. < LocalID > is chosen by the business entity and shall be used uniquely.",
        "This property signifies the requested network advertisement for specification information. It is used by the advertising services of the WBEM infrastructure to determine what should be advertised, via what mechanisms. The property is an array so that the specification may be advertised using several mechanisms. Note: If this property is null/uninitialized, shall be equivalent to specifying the value 2, \"Not Advertised\".",
        "PermanentAddress",
        "Packet Flag",
        "Product version information. ",
        "IL_BF593FDA4BA33F9ED167DAD655EB0DCA41D164E127B57BF7155EB8BC36FD4AEB.398.1.150684",
        "LPCDRVR_TRACE_FUNCTION Flag",
        "Win32_WIN32_TERMINAL_Prov",
        "CIM_Error.OtherErrorSourceFormat",
        "A globally unique identifier for the processor.  This identifier may only be unique within a processor family.",
        "Example 10.",
        "RegisterSCP",
        "CIM|CIM_Directory",
        "{2A7DC003-BAEF-11d2-85E5-0000F8102E5F}",
        "MMCSS_TypeGroup",
        "Bit mask defining the AAL types supported by the hardware.",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmCopies",
        "HOSTPROC_TRACE_OBJECT",
        "-Inch Floppy Disk",
        "C_810BF28A7C26F6878E189604887AB1090DF3478356CCB47422DB03C98B71BD38",
        "MSAgp_Information",
        "SAM Query Information Domain",
        "The ratio of deduplication savings to the logical size of all optimized files on the volume, expressed as a percentage.",
        "Session Id",
        "This property contains the FQDN of the device",
        "The Dependent property references a connection made to a shared resource on the local server.",
        "NdisHardwareStatusInitializing",
        "GetReplicationSettings",
        "The ReleaseDate property indicates the release date of the BIOS in the Coordinated Universal Time (UTC) format of YYYYMMDDHHMMSS.MMMMMM(+-)OOO.",
        "InstallOptionsValues",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"NamedJobObjectActgInfoProv\"",
        "Definitional formats for LogRecords could be specified by establishing a naming convention for the RecordID and Message Timestamp key properties.",
        "Address of the Remote VPN Server.",
        "UnregisterSubsystem",
        "GetExtendedStatus",
        "Authentication mode",
        "Indicates the day of the week in which security intelligence updates occur. If set to zero then security intelligence update occurs daily.",
        "1 = not removed, ",
        "SAProposal is a base class defining the common properties of, and anchoring common associations for, IPsec phase 1 and phase 2 proposals. It is defined as a kind of ScopedSettingData (scoped by a ComputerSystem or AdminDomain), since its subclasses define sets of IPsec properties that MUST be applied together, if negotiated. This subclassing is different than that defined in IETF\\'s IPSP Policy draft - where it is subclassed from Policy. The definition as SettingData is more consistent with the application of the properties as a set, to the negotiated Security Association. To indicate that \\'this\\' proposaltransform is negotiated for a Security Association, use the ElementSettingData to associate the proposal and the SA.",
        "root\\cimv2\\power",
        "Script Type",
        "AddNode",
        "Bid2Etw_SQLSRV32_1_Trace_TextW",
        "Asynchronous Clone Local",
        "{5d11e02f-0c36-4180-ad07-89062c9df9ec}",
        "The precedence value of the policy.",
        "Number of bytes of user data to skip before starting the check data interleave.",
        "CR_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937",
        "MinLifetimeKilobytes",
        "Use Advanced Settings",
        "MSNdis_ReceiveQueueParameters",
        "LUAInstall: error 0x00000005 setting flags [{742AD1FB-B2F0-3681-B4AA-E736A3BCE4E1}]",
        "DelegatorProvider",
        "IPv6 Only",
        "The upper 4 bits (28-31) represent the object type. The meaning of the lower 28 bits (0-27) is dependent on the object type.",
        "Config",
        "Context Flag",
        "SamSetMemAttrsOfGrp_Start",
        "PNP_REGISTRY_WARNING_LEVEL Flag",
        "CD_A435E1CD6D36EB19C6DA0BA1C7E62224942A59031964EC981FF17A68812E1011.1222.844616146.326",
        "Performance monitor data register",
        "CR_79CE5C3FFCFDB2E387AFB15F738C96DF562D23EEC0B9CE854EFF2796A5403198",
        "Printer's horizontal resolution in Pixels per Inch",
        "PaperLength",
        "The ReleaseDHCPLeaseAll method releases the IP addresses bound to all DHCP enabled network adapters. WARNING: If DHCP is enabled on this local computer system, the option will terminate all DHCP TCP/IP connections.",
        "Tape Cartridge",
        "0xEFFF0004",
        "countryCode",
        "This operation is not supported for local file servers.",
        "The DebugInfoType property indicates what type of debugging information is to be written to the log file.",
        "MIF.DMTF|Power Supply|002.8",
        "SystemDrive",
        "This field reports the minimum number of tolerable physical disk failures that can occur before data loss would occur.",
        "SECHC_LOG_FLAG_EVENT_LOG Flag",
        "HBAFCPBindingEntry",
        "Association between a subsystem and its file server",
        "RD_TRACE_DISPATCH",
        "HBA_PORTSTATE",
        "NumberOfColumnsMin",
        "Indicates whether this memory can be cached or not.",
        "Files Open",
        "Period",
        "40015",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_BANDWIDTH_ALLOCATION",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|InfPath",
        "JobType",
        "Snapshot",
        "IMAPI2 Disc Recorder Enumerator",
        "RegisterByPrincipal",
        "IntranetZoneJavaPermissions",
        "MIF.DMTF|FRU|002.6",
        "Bytes written using nibble mode",
        "CD_A17354395E79A088E63A18457CAA51A441A886387058324A6BE95873BE2C4E38.1998.3000079254.649",
        "Above_Normal - (Windows 2000 and later) Indicates a process that has priority higher than Normal but lower than High.",
        "EVENT_TRACE_FLAG_NETWORK",
        "// This class exposes login statistics",
        "WindowsStreamSecurityBindingElement",
        "Start on reboot",
        "MSFT_NetAdapterVmqSettingData",
        "object:MSFT_NetIPHttpsConfiguration",
        "TracingGeneral Flag",
        "Decrypt",
        "Reverse Roles operation requires subsequent resync",
        "MIF.DMTF|Operating System|001.4",
        "CIM_PrintJob.RequiredPaperType",
        "Win32Registry|DEFAULT\\Control Panel\\International|Locale",
        "LetAppsAccessLocation_UserInControlOfTheseApps",
        "CD_988CC64B9858C06D7E29C18EDBED8CE13CF165862E4E03964EAC303F3A8E79F6.1849.264504177.297",
        "Win32_TSPublishedApplication",
        "The numbers of the slots on which to set the power state.",
        "WindowsServer2012R2",
        "Logon Flag",
        "StrongARM PC",
        "Small Animated Bitmap Path",
        "Require use of Diffie-Hellman for enhanced security.",
        "RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl",
        "PortableDeviceAPI_Service",
        "{CCBA37FC-982B-433b-8AC2-455E616A8559}",
        "The Wallpaper property indicates the file name for the wallpaper design on the background of the desktop.",
        "Domain Join If Joined",
        "Sets the action to be taken if the session limit is reached or connection is broken, one of the following action is taken:Disconnect: The user is disconnected from the sessionTerminate:  The session is permanently deleted from the server the property BrokenConnectionAction that it is applicable only to Server-override mode and returns success in case of Server-Overridemode and an error if the policy was set to User or Group.",
        "MSSerial",
        "The number of bytes sent using the IPSEC protocol.",
        "DedupTracingProvider",
        "C_C089BE570AD24F592E44F1AB17521DCC9203176DB1FE73F89D8F1D13C2998CF4",
        "LocationWithinContainer",
        "AceType",
        "Image Load",
        "GetLoadBalancingState indicates whether the server is configured to participate in Session Broker Load Balancing or not.",
        "Majority Disks Unhealthy",
        "The total capacity of this physical memory, in bytes.",
        "MSMCAEvent_PCIBusError",
        "SidTypeDeletedAccount - Indicates a SID for a deleted account.",
        "An identifier for the Indication. This property is similar to a key value in that it can be used for identification, when correlating Indications (see the CorrelatedIndications array). Its value SHOULD be unique as long as correlations are reported, but MAY be reused or left NULL if no future Indications will reference it in their CorrelatedIndications array.To ensure uniqueness, the value of IndicationIdentifier should be constructed using the following \"preferred\" algorithm: ",
        "Requests a reset of the logical device. The return value should be 0 if the request was successfully executed, 1 if the request is not supported and some other value if an error occurred.",
        "PortableDeviceAPI_Properties",
        "CD_9A0E4B10C24AFAE23D25837341C73AF3317EA35AC13D0352F93F4194616EEDFF.2531.3271625074.82",
        "IR_787A200B25B0F5C6729D1D578C8F78CD412BA6F80EDCC079C80146CB69F7319B",
        "iScsiFlagErl",
        "IsProvisioned",
        "Defines the state of this port's Physical Connection Management (PCM) state machine.",
        "Storage jobs represent long running operations on a storage subsystem. These operations can either be user-initiated through the various management interfaces defined by this MOF, or automatically by intelligent storage subsystems.",
        "Operation not supported on a non-empty removable disk.",
        "Win32API|Device Context Functions|EnumDisplaySettings",
        "CloneObject",
        "SetDeviceElement",
        "{117FDB8C-D025-11d2-85F5-0000F8102E5F}",
        "Specifies which transport protocols can be used for RDP access to server. 0: both UDP and TCP are used, 1: only TCP is used, 2: either UDP or TCP is used.",
        "The user name of the logged on user when the event ocurred. If the user name cannot be determined this will be NULL",
        "The most recent time of the threat status change",
        "11012",
        "DestinationPrefix",
        "51005",
        "Mini-jack",
        "AllowUserPorts",
        "MGR_TRACE_RESERVED_0d",
        "ChangeNetworkConfiguration",
        "This property contains the name of the source files to be moved or copied.",
        "ConnectionTimeoutErrors",
        "VM/ESA",
        "CurrentBitsPerPixel",
        "If true, this is the primary BIOS of the computer system.",
        "PA-RISC 7100LC",
        "PNP_INFO_LEVEL",
        " 16-bit InprocHandler (appearing as the InprocHandler value) ",
        "CIM_InstalledOS",
        "Path of the .INS file used for auto-configuration.",
        "WmiMonitorColorCharacteristics",
        "EventIdentifier",
        "PriorityDownloads",
        "I_A905E989052353FA9D8F60E873BC56BF35837561C775D74EDFE4D77EF4FED58C.1500.283983751.381",
        "Shutdown Flag",
        "{07F12A62-E3D1-11d2-8601-0000F8102E5F}",
        "RoamingCompliance",
        "Ndis80211PowerMode",
        "FileSizeOnDesiredStorageTier",
        "Example: Even",
        "LogicalDisk",
        "C:\\Windows\\system32\\kernelbase.dll[MofResourceName]",
        "REG_EXPAND_SZ (2) ",
        "Sessions Failed",
        "Boolean indicating that the PowerSupply is a switching (instead of linear) supply.",
        "Primary Registration",
        "CD_E78B24A63ACB40A253226DA76298C783683B9FFCFE28CF1078C510D46CEF2248.287.4236143200.396",
        "GetErrorInjectionCapabilitiesRtn",
        "SSL (TLS 1.0) will be used for server authentication as well as forencrypting all data transferred between the server and the client.This setting requires the server to have an SSL compatible certificate.",
        "CIM_AssociatedSupplyCurrentSensor",
        "continuous graduations in intensity and ",
        "Association between InitiatorPort and iSCSISession",
        "R_12B44998951A18C05CEB407A59B6802A15C3E6B5204777F28106106376F6FBF8.1197.1441662724.520",
        "The StartFileName input parameter is a string that names the child file/directory to use as a starting point for TakeOwnerShipEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred",
        "CR_2BBDC6530C208169E005CD28108E36BCD72310DD490D1F6D9817675EE3291874",
        "Number of write operations to disk",
        "Multi-hop requires advance notice",
        "Targets allocated from Any storage pool",
        "CIM_PhysicalFrame.Tag",
        "Initiator Instance or Name",
        "CIM_PhysicalComponent",
        "Win32_SystemDesktop",
        "NetworkProfile",
        "Cred Flag",
        "0xEFFF0051",
        "MsftDiscMaster2_DebugDestructor Flag",
        "The frequency, in minutes, of how often a client will contact the KMS host before the client is licensed.",
        "       Subnet Mask, and Gateway were assigned to the NIC.",
        "Virtualize",
        "Win32_LUID",
        "SetPolicyDrivenUpdateSourceForFeatureUpdates",
        "MSFT_CliFormat",
        "This property is the string that user interface programs use to identify the service.",
        "   //  This used to be a string type, but we made this a fixed length",
        "Network Drive",
        "Reset DA site table entry configuration",
        "CR_ED34D9141DAAA89570F479B7904D4A54BEE568C398745E94687501AFF6347D73",
        "TRACE_RESERVED7 Flag",
        "The reason that this application was eligible for application to the target ",
        "AdapterDACType",
        "Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PeakVirtualSize",
        "SamQueryInfoDom",
        "MAC controller promiscuous mode setting.",
        "MUIResource",
        "4463864CF2615B27D56E94A95716A",
        "Loss of Multi Frame",
        "Thread SubProcessTag Changed",
        "0x501",
        "0xD00D",
        "configurations",
        "SentMulticastBytes",
        "The DisplayName of the IPsec rule.",
        "Indicates user mode Code Integrity policy enforcement status.",
        "The Msft_WmiProvider_OperationEvent_Post event class contains the operation event generated following completion of provider implementation.",
        "TCP Send Failed",
        "Link layer address of neighbor.",
        "48009",
        "MDM_EnterpriseModernAppManagement_AppSettingPolicy04",
        "iScsiFlagIoctl Flag",
        "EnableWakeOnMagicPacketOnly",
        "msieee80211ID",
        "NewPolicyStore",
        "{419f025a-bf06-4673-af66-d230bec2af02}",
        "object:MSFC_HBAPortStatistics",
        "Heap Create",
        "{cede75a0-a77f-452b-8f2f-541f926db0f9}",
        "I_3C259524726051D7603A4BD17307563E6BEB326182791CA695BB2B6FEF3A682F.311.293400504.249",
        "PS_VpnConnectionTriggerTrustedNetwork",
        "This class represents the advanced properties of a network adapter stored in the registry.",
        "MSSmBios_SysidUUIDList",
        "SMBIOS|Type 4|Processor Information|Socket Designation",
        "{8502C4BC-5FBB-11D2-AAC1-006008C78BC7}",
        "_DH_WMPCD_DPF Flag",
        "Result from Setting Header/ Split Parameters",
        "Internal loader flags",
        "AADKeyIdentifierList",
        "Denotes the reason why the storage pool is read-only. ",
        "59006",
        "Time when the operating system was last booted",
        "TcpOptions",
        "{FAF76B96-798C-11D2-AAD1-006008C78BC7}",
        "RandomizeScheduleTaskTimes",
        "_01AE29EDF18F0AC5E1759FD5DEB7A44E70C597DB04EB864315CE7CEFDCF23390.2702.2773771417.291",
        "Transmit Failure",
        "es-is",
        "Maximum Input Buffer Size",
        "CopyType describes the Replication Policy. Values are: ",
        "C_53C9505D2D8D5E4C029EC4B036D21F227EB8A3A950C13155EEE4FD0AF03B4451",
        "The current second of the current minute (0-59)",
        "0xEFFF004F",
        "1 - 'Warning': The majority of physical disks are healthy, but one or more may be failing I/O requests. ",
        "Values: TRUE or FALSE. If TRUE, the password will expire.",
        "PolicySourceEnableAutomaticReconnection indicates whether the property EnableAutomaticReconnection is configured by Server(0) or Group Policy (1).",
        "Indicates if VF RSS is supported",
        "IPv4 Address",
        "Header",
        "DefaultOutgoingRequestFormat",
        "DnsClientNrptGlobal",
        "{2D0E255C-E3D1-11d2-8601-0000F8102E5F}",
        "Out of Memory",
        "Friendly name of the profile",
        "The Extended Type property indicates a 32 bit type identifier for the keyboard.",
        "HBA_FCPBINDINGTYPE",
        "Specifies the version of the structure",
        "UsedSpace",
        "Configuration related to the BranchCache client role",
        "UniqueIdFormat indicates the type of identifier used in the UniqueId field. The identifier used in UniqueId must be the highest available identifier using the following order of preference: 8 (highest), 3, 2, 1, 0 (lowest). For example: if the virtual disk device exposes identifiers of type 0, 1, and 3, UniqueId must be the identifier of type 3, and UniqueIdFormat should be set to 3.",
        "{A83EF168-CA8D-11d2-B33D-00104BCC4B4A}",
        "Specifies the action to take on traffic that matches this rule.",
        "This class represents the links from a domain, OU, site or local scope to GPOs",
        "NS_2442BCC28C4B5A2EF54CB557CCCCCCDDEB8CA20A5F8F2C7C0CF36D2475F133F7\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_0A4A8CC499F46BAAE9FF49E6D68BB631793D5F6FAD2719C0358ED54A87A848293527",
        "Differential",
        "SECHC_LOG_FLAG_ASSERT Flag",
        "{B94A25A8-DB33-11d2-85FC-0000F8102E5F}",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\nwlnkipx\\Parameters\\Adapters|NetworkNumber",
        "Chassis Manager",
        "BcdDeviceLocateElementData",
        "Example: ********123000.000000-420 which implies 12:30 pm PST with daylight savings time in effect.",
        "R_0DBF24518A515720E2ADFC25BEC0135E619157C7551EB33A738576F79BC03C73.2436.4194446420.554",
        "Specifies the peak memory in kilobytes usage of all processes associated with the job. ",
        "ref:Win32_DfsNode",
        "IL_9C256CE37E6F9177BC0EC95344373747E0112D20D664373933986EE480BE67C9.298.3005903279.338",
        "this bit indicates whether the RTC wakeup status is reported in fix register space (0) or not (1)",
        "AllowUserUIAccess",
        "LetAppsAccessAccountInfo_UserInControlOfTheseApps",
        "LPCDRVR_TRACE_RESERVED_13 Flag",
        "The scope of the discovery operation is controlled by the DiscoveryLevel and RootObject parameters. DiscoveryLevel controls the depth of the object discovery. RootObject defines the starting point from which discovery will happen.",
        "List of dependent application frameworks",
        "NDISWMI_TRACE_HWINFO Flag",
        "The Get-AppBackgroundTask cmdlet gets background task information for the user-supplied PackageFamilyName.",
        "Example: ScsiPort0 device memory address.",
        "C_5CC5CF05A7A1041C246328BDD1081AC6C5D60C48F12D405A2F1C3A3CF42897DE",
        "Drive letter assigned to the volume.",
        "C_10E742B9ECC86ED440568BF61B0442BA9BC3AB32EBAC793C867FE3DDEE6FBA5B",
        "ForceArpNdWolPattern",
        "This parameter is used to specify the replica peer for the target group.",
        "StreamingAllowReestablishmentRetries",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_primary_group_id",
        "NetworkConfiguration",
        "Acess token address",
        "// Event types.",
        "SamGetMemInGrp_Start",
        "{75BCF4FE-DB46-11D2-B4C8-80080C7B6371}",
        "A user friendly name. This name may not be unique",
        "EnableTouchKeyboardAutoInvokeInDesktopMode",
        "PAGETABLEWRITE",
        "PfsGroupId",
        "Number of Function Keys",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1068.2673901424.340",
        "NDIS Query Receive Filter Global Parameters",
        "K)zBp",
        "H.323 Gatekeeper",
        "Requires resync",
        "HideView",
        "A Boolean value that indicates whether messages processed by this binding will be received exactly once.",
        "Stepping",
        "The Win32_NetworkAdapter class represents a network adapter on a Win32 system.",
        "This method adds an initiator to the masking set. All virtual disks in the masking set will be accessible (shown) to these initiators.",
        "Actions",
        "d2m;d2m;",
        "Integer indicating the number of power cords which must be connected to the chassis, for all the components to operate.",
        "RESPONDER_ID",
        "Describes the data compression characteristics of the modem.",
        "System account management.  ",
        "WD_LOG_FLAG_REFERENCES Flag",
        "{7970614A-BD82-439e-A828-CC96F8E91428}",
        "FacialFeaturesUseEnhancedAntiSpoofing",
        "PCI_COMP_MEM_NUM is valid",
        "TRACINGAPIERROR",
        "RestrictedSitesZoneAllowCopyPasteViaScript",
        "Tray icon enablement flag",
        "Event Data Field 3",
        "Unexpected ISR",
        "JobMemoryLimit",
        "Win32_PowerMeterConformsToProfile",
        "RemoteUdpEncapsulationPort",
        "The revision number component of the version information for the current management firmware on this physical computer system.",
        "MDM_Firewall_Action04",
        "ISCSI_ERR_DEVICE_RESET",
        "Max Request Processing Time",
        "A string describing the recovery action when the RecoveryAction property of the instance is 1 (\"Other\").",
        "Maximum number of tokens avaiable per subsystem",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_06DFAB71A3D8DBB356E2B69812AA4BD05249772CB8E5CA24F5D2BBA6FF1926AF",
        "CreateVolume",
        "IsolatedName",
        "True if Internet Explorer Enhanced Security Settings are Enabled",
        "ProposedSize",
        "EncapsulatedPacketTaskOffloadHardwareCapabilitiesNvgre",
        "CIM_NumericSensor.SensorType",
        "The HighThresholdOnClientObjects property specifies the maximum rate provider created objects can be delivered to clients. To accommodate speed differentials between providers and clients, WMI holds objects in queues before delivering them to consumers.. WMI slows down the addition of new objects into the queue when the low threshold is reached. If this does not help, and high threshold (specified by this property) is reached, WMI will accept no more objects from providers and return WBEM_E_OUT_OF_MEMORY to the clients.",
        "{2D79F3A0-D025-11d2-85F5-0000F8102E5F}",
        "RegFileId",
        "The ProviderOperation_NewQuery property indicates the number of calls to IWbemEventProviderQuerySink :: NewQuery.",
        "TP_V2_ThreadSet",
        "TSRdpInitTrace",
        "LastLogon",
        "The ProtocolEndpoint that is implemented on the LogicalPort.",
        "I_D1B648BE68EC7094B701AE10865E8710BF3CA0727020E467239EE608D1A161DA.691.1.31519",
        "This method allows for the creation of a replication relationship between virtual disks.",
        "The Workstations property contains the names of workstations from which the user can log on. Up to eight workstations can be specified;  a null string indicates no restrictions. ",
        "SpeakerModeSetup",
        "The MACAddress property indicates the Media Access Control (MAC) address of the network adapter. A MAC address is assigned by the manufacturer to uniquely identify the network adapter.",
        "Element Component",
        "CD_ECDF6473AEB5680FD494BFD070A3EC2B36A681EE68A62E383213B3D773EF9B61.32.1882114853.460",
        "Suspend",
        "Is AC Setting",
        "{2306fe34-dbf6-11d2-9244-006008269001}",
        "KeyUpdateFailures",
        "Win32_InstalledStoreProgram",
        "{250959aa-899d-11d2-819e-0000f875a064}",
        "MIF.DMTF|Temperature Probe|001.17",
        "SPACES_ResiliencySetting",
        "MsftUtils_DebugDestructor",
        "Discovery Disabled",
        "SetPowerState defines the desired power state for a logical device and when a device should be put into that state. The desired power state is specified by setting the PowerState parameter to one of the following integer values: 1=\"Full Power\", 2=\"Power S",
        "DwellTime",
        "MSFC_FibrePortNPIVMethods",
        "EnableForcedLogoff",
        "object:BcdStore",
        "Maximum number of seconds that cached attributes are held after directory update.",
        "PortAddress",
        "ScheduledInstallFourthWeek",
        "BitMap",
        "The Dependent reference is the session in the SubSession association that is the subsession.",
        "ParamsDataSize",
        "RefreshThresholdKbytesPercentage",
        "MachineCertificateEKUFilter",
        "PropertyName is a string property and is either DeleteTempFolders or UseTempFolders.They are flags that are either set to False or True according as whether Value is set to 0 or 1 respectively. The call returns 0 for success and an error if the policy was set to Group policy.",
        "{9565979D-7D80-11D2-AAD3-006008C78BC7}",
        "CR_9D89FA2B309F38D240606161FF6D4D1DD686574B6527CC994C80F23BE2267FCF",
        "C_ECA4BCE942A7519C8BD48784B00775961389BBC39B370F76AE4A3294CBE6E51C",
        "SamCompCreate_End",
        "Position",
        "This enables read/write traces",
        "2 - 'OK': The disk is responding to commands and is in a normal operating state.",
        "{49987cb1-a986-48bf-b668-65ece707c238}",
        "This field indicates the physical sector size of the physical disk in bytes. For example: for 4K native and 512 emulated disks, the value should be 4096.",
        "PREPARE_MDL_WRITE",
        "NumberOfConfigs",
        "IPv6HashEnabled",
        "Volume Size",
        "3 - 'Degraded/Warning': Action may be required by the user. ",
        "ING Flag",
        "Software Download Failure",
        "SamSetInfoAlias_Start",
        "CIM_SoftwareIdentity.MajorVersion",
        "{f2e0e060-bf32-4b88-b8e4-5cad15af6ae9}",
        "Create_Suspended",
        "Specifies whether print jobs in the queue should be kept after they are printed.",
        "I_EBF6936E6C9BCA72F0513569683DC50AAF6985750D21624859069228CB4387EA.2466.1946828672.363",
        "WorkingSetSize",
        "This property is identical to the ObjectId field of the disk object that contains this partition.",
        "{1008CCE5-7BFF-11D2-AAD2-006008C78BC7}",
        "Contains the expanded string data value for the named value. The string is only expanded if the environment variable (for example, %Path%) is defined. ",
        "A uniquely generated connection ID. Do not confuse this with CID.",
        "MsftDiscMaster2_DebugDestructor",
        "TEST_TRACE_RESERVED_0c Flag",
        "The volume is not exposed to the specified file server",
        "Example: NEC 5FGp  ",
        "Size of MS_SMHBA_SAS_Port or MS_SMHBA_FC_Port",
        "__EventFilter",
        "MDM_Personalization",
        "PeerProviderURI",
        "Per Day",
        "EVENT_TRACE_FLAG_SYSTEMCONTROL",
        "Indicates that the network adapter supports filtering received packets matching a MAC address and any arbitrary VLAN ID.",
        "The ScreenHeight property specifies the height of the physical screen.  ",
        "iScsiDebug31",
        "Synchronisation",
        "The return code should be 0 if the request was successfully executed, 1 if the request is not supported and some other value if an error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier.",
        "selectedRatingsBureau",
        "StandardHour",
        "The information would have been captured at an earlier time (via the SaveProperties method). This method may not be supported by all Devices. The method should return 0 if successful, 1 if the request is not supported, and some other value if any other error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier.",
        "ref:CIM_CopyFileAction",
        "Not Allocated",
        "ProcessorCurrentClockSpeed",
        "Port WWN",
        "WebProxyServers",
        "NetConnectionStatus is a string indicating the state of the network adapter's connection to the network. The value of the property is to be interpreted as follows:/n0 - Disconnected/n1 - Connecting/n2 - Connected/n3 - Disconnecting/n4 - Hardware not present/n5 - Hardware disabled/n6 - Hardware malfunction/n7 - Media disconnected/n8 - Authenticating/n9 - Authentication succeeded/n10 - Authentication failed",
        "Drive Letter",
        "Indicates the day of the week in which security intelligence updates occur. If set to zero (0x0) then security intelligence update occurs daily.",
        "System - Interactive - This logon type is intended for users who will be interactively using the machine, such as a user being logged on by a terminal server, remote shell, or similar process. ",
        "IPSrcPortEndMatchCondition",
        "MDM_Policy_Result01_Start02",
        "The Setting reference represents the role of a user that can access a component grouped under the associated Win32_DCOMApplication",
        "This event class represents events when a computer has begun the process of shutting down.",
        "Power Cycle",
        "iScsiDebug28",
        "Access denied",
        "The volume relative path to the directory that is being shared.",
        "CIM_ElementCapacity associates a CIM_PhysicalCapacity object with one or more physical elements. It serves to associate a description of min/max hardware requirements or capabilities (stored as a kind of CIM_PhysicalCapacity), with the physical elements being described.",
        "SDBUS_DEBUG_DUMP_REGS",
        "SupportsMirrorLocal",
        "OperationBehaviorAttribute",
        "WmiQueryReceiveFilterGlobalParameters",
        "Enables the Receive Side Scaling (RSS) properties on the network adapter.",
        "Unprotected",
        "MetadataExportInfo",
        "AppPathNameMatchCondition",
        "Requests that the state of the element be changed to the value specified in the RequestedState parameter. When the requested state change takes place, the EnabledState and RequestedState of the element will be the same. Invoking the RequestStateChange method multiple times could result in earlier requests being overwritten or lost. ",
        "Select * from Win32_PerfRawData_PerfNet_Server",
        "Win32Registry|MouseSynchIn100ns",
        "Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_INTTIMEOUTS",
        "DFHandling",
        "SQLOLEDB_1 formatted output (A)",
        "ErrorSourceFormat",
        "DECnet",
        "MDM_Policy_Config01_FactoryComposer02",
        "MIF.DMTF|Temperature Probe|001.10",
        "The SupportsMulticasting property indicates whether the protocol supports multicasting.",
        "The EOFCharacter property specifies the value of the character used to signal the end of data. .",
        "The Element reference in the Win32_WMIElementSetting association, represents the Win32 service using or surfacing WMI properties.",
        "DeploymentType",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1489.2360746573.368",
        "GlobalRefreshIntervalUnit",
        "second * 10^-3",
        "NDIS FDDI Short Multicast List",
        "RSOP_RegistryKeyBlocked",
        "CertificateServicesClient_CredentialRoaming",
        "IL_548C7B8CAA43CC9635C7EFD11A316C9E16085EF464E2F7DF7BF493D60EC389A2.2458.3903285571.354",
        "081AC6",
        "PacketIntegrity - all the data transferred between client and application is authenticated and verified.",
        "TrackingUri",
        "The Win32_LoadOrderGroup class represents a group of system services that define execution dependencies. The services must be initiated in the order specified by the Load Order Group, as the services are dependent on each other. These dependent services require the presence of the antecedent services in order to function correctly.",
        "The ExposedPath property is the file system path of the shadow copy when it is exposed. This property is NULL when the shadow copy is hidden or otherwise unexposed.",
        "CD_84F8BABB6CA8331C4E9169FA40BA6E129D7FC9914E1CFF1EF6A24C2F4E5BC1E2.1747.2591917215.489",
        "Limited Number of User Sessions: (0) feature is disabled , a value greater than 0 represents the number of sessions allowed per connection.",
        "EVENT_TRACE_FLAG_B",
        "PromotePercent",
        "PolicySourceDirectConnectLicenseServers",
        "GetOwnerAuth",
        "User Intervention",
        "Passphrase",
        "C_DBC9D7448979766FC3AA5E546B9F7F37A6E0C06BC06D343F27EAFCD412F13D2A",
        "The ClassGUID  property is the ClassGUID of the device e.g. {71A27CDD-812A-11D0-BEC7-08002BE2092F}",
        "InsertionStringTemplates",
        "CIM_ManagedSystemElement.OperationalStatus",
        "NetworkAdapterList",
        "CIM_NumericSensor.OtherSensorTypeDescription",
        "LPCDRVR_TRACE_RESERVED_19",
        "WRITE_DAC",
        "DLT Cartridge",
        "If specified, allocations for this storage tier are limited to the storage fault domains in the list.",
        "MacAddress",
        "Failover operation requires subsequent fracture",
        "Split IO Event",
        "14 - 'Aborted': Similar to Stopped, except that the disk stopped abruptly and may require configuration or maintenance.",
        "Common",
        "HostedCacheHttpConnectPort",
        "The product that is dependent on another product.",
        "The IPXNetworkNumber property represents an array of characters that uniquely identifies a frame/network adapter combination on the computer system. The NetWare Link (NWLink) IPX/SPX-compatible transport in Windows 2000 and Windows NT 4.0 and greater uses two distinctly different types of network numbers. This number is sometimes referred to as the external network number. It must be unique for each network segment. The order in this string list will correspond item-for-item with the elements in the IPXFrameType property.",
        "The Win32_SCSIControllerDevice class represents an association between a Small Computer System Interface (SCSI) controller and the logical device (disk drive) connected to it. Instances for this class are only provided on  Microsoft Windows NT/Windows 2000 or later and Windows 95 or later.",
        "Install",
        "Root CA",
        "JobState",
        "QueuedDeliveryRequirements",
        "{8502C4EF-5FBB-11D2-AAC1-006008C78BC7}",
        "Win32_OfflineFilesMachineConfiguration",
        "Suspended Ready",
        "MSFT_WmiConsumerProviderLoaded",
        "IncludeLiveDump",
        "52002",
        "DirNotify",
        "Processor Control Block Address",
        "0x00000100",
        "HeapCommitDecommit",
        "ref:CIM_Check",
        "securityGroups",
        "TextA",
        "CR_E6B31A90E686795D9E916C75179C5E297CC54460E452CC51EA148281AD5C6D23",
        "HardwareCapabilities",
        "C_00B170B62C2F3CE0CF652E9172FD442FD4ED6E6431FA0C941DE48C4F06E373D1",
        "\"The Green Grid\" identifies \"The Green Grid Association\"",
        "MIF.DMTF|FRU|002.8",
        "FileName",
        "{f9d2ba6a-899c-11d2-819e-0000f875a064}",
        "ProviderOperation_SetRegistrationObject",
        "IPv6TransmitTcpChecksumSupported",
        "MDM_Reboot",
        "Targets allocated from Shared storage pool",
        "The CIM_LogicalDevice dependent reference represents the CIM_LogicalDevice connected to the 1394 controller.",
        "0x00004000",
        "CIM_NumericSensor.BaseUnits",
        "{e1d18625-d144-4121-99e7-72b7bfb0e4c1}",
        "CD_0A8460FC46C2746BD21F545AC61155DB7CAC54BE761314A2A7E02864EFA1BFE6.2067.4131829609.167",
        "IR_3CA6A8A46045BF954508B3340CD11FE30993A59816D6AA3EB1B345A8EEDF8A01",
        "The SetWINSServer method sets the primary and secondary Windows Internet Naming Service (WINS) servers on this TCP/IP-bound network adapter. This method is applied independently of the network adapter. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "Win32API|Printing and Print Spooler Structures|DevMode|dmICMMethod",
        "C_632DEB324ADB39E99E029B3D88D503FFEF1874CB755EBE99E55CFDC82CE6D7E4",
        "C_DDCE0EEC8025DB3F389EB360CE7C50BBC0E131D334E8FAB08585F4C0CA2A98A2",
        "Win32_BootConfiguration",
        "A list of service principal names accepted by the service.",
        "Regular",
        "SW_HIDE",
        "CertificateHash",
        "The  property indicates the number of calls to IWbemServices :: PutClassAsync.",
        "The last time an attempt was made to synchronized this folder to the Offline Files cache, even if it was unsuccessful.",
        "invalid",
        "UseOpportunisticLocking",
        "CIM_ProductFRU is an association between product and FRU that provides information regarding what product components have been or are being replaced.  The association is one to many, conveying that a product can have many FRUs, and that a particular instance of a FRU is only applied to one (instance of a) product.",
        "Stale Metadata",
        "CreateClone",
        "{aa39f5ab-e260-4d01-82b0-b737c880ea05}",
        "Number of zones imported from another machine.",
        "ErrorTransferSize",
        "The CopyEx method copies the logical file or directory specified in the object path to the location specified by the FileName parameter. CopyEx returns an integer value of 0 if the file was successfully copied, and any other number to indicate an error. A copy is not supported if overwriting an existing logical file is required. CopyEx is an extended version of the Copy method./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n",
        "This parameter is used to specify the replica peer for the target virtual disk.",
        "Win32Regstry|System\\CurrentControlSet\\Control\\Session Manager\\Memory Management|PagingFiles",
        "CD_20435E8E6AE6B07C92579F794D715DB6D35677395F702CF6B0B37C21C5C70F22.146.754619585.220",
        "Transportable",
        "An integer indicating the lowest or 'bottom' U in which the chassis is mounted. A 'U' is a standard unit of measure for the height of a rack or rack-mountable component. It is equal to 1.75 inches or 4.445 cm.",
        "Last discovered KMS host IP address through DNS.",
        "{3b5605d8-1aaf-4ff6-85b9-bc5fb973dc54}",
        "Tachometer",
        "CD_253C1C96FB7F3D1A75A530DE68BF9EF86C6D306A9F09AAA285B8339C5035F10C.17.902807093.741",
        "MSFT_TaskMonthlyTrigger",
        "WLANHC_FATMSM Flag",
        "AccountOU",
        "Contract",
        "CIM_LANSegment.LANID",
        "Storage remediation event",
        "{FCEFF8B7-9D6B-4115-8422-05992451A629}",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2020.336309311.180",
        "ForceModuleImport",
        "Child",
        "Sub-classes may be explicitly constrained to be read only. If a sub-class is not constrained as read only, the designers are strongly encouraged to carefully consider the data synchronization and consistencies issues that may result. The ElementView association may be used to find the instances that form the normalized view of the managed resource.",
        "CLOUD",
        "NumberOfLicensedUsers",
        "CD_9B6218EFA94C067C7A0C80C5056C3D58C66F39DA9385FB7012B7F51EB8C27ACA.1802.3158356711.331",
        "ProtocolType",
        "LastQuickScanDateTimeEnd",
        "The DevLoader property is the Device Loader for the device",
        "ErrorDescription",
        "The time interval between consecutive runs to get the action from the server.",
        "PCI_COMP_INFO_ClassCodeSubClass",
        "VolumeRelativePath",
        "Number of entries",
        "Some error in cabling, or connection.",
        "NS_E1DD43413ED9FD9C458D2051F082D1D739399B29035B455F09073926E5ED9870\\KI_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170\\I_8E80D45658E49966FC3BA567F2C75690AE48EBAB9A2568429675180214107ACE27f9CE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0",
        "The optional lower-bound of the source port filter condition. If only a single port value is required, then IPSrcPortStartMatchCondition and IPSrcPortEndMatchCondition must match. If the source port filter condition is not required, set both fields to zero.",
        "MSFT_TargetNamespace",
        "Each bit of the property value acts as an index into the array of values in the BitValues list.",
        "WPD_TRACE_LEVEL_CRITICAL",
        "Mouse Port Information",
        "SMBIOS|Type 19|Memory Device Mapped Addresses|Starting Address",
        "This parameter returns a reference to the storage job used to track the long running operation.",
        "TransactionFlowBindingElement",
        "BrokenConnectionPolicy",
        "Background_Blue",
        "TRACE_WARNING",
        "object:MSFT_TaskRepetitionPattern",
        "PLATFORM_ERROR_OEM_ID is valid",
        "{D905AC1C-65E7-4242-99EA-FE66A8355DF8}",
        "BluetoothEnabled",
        "TopologyDiscoveryFlags",
        "{237D964E-E3D1-11d2-8601-0000F8102E5F}",
        "SubmittedTime",
        "The account",
        "InternetZoneAllowScriptlets",
        "guidName",
        "ProcessTokenSidType",
        "NS_E1DD43413ED9FD9C458D2051F082D1D739399B29035B455F09073926E5ED9870\\KI_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C\\I_C941A83BAA377FBAFF034894B44F1F5F2A08C06F70B4B461B6EF32C4D137250Ea\\10FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "MGR_TRACE_RESERVED_0b Flag",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"SppProvider\"",
        "370E0F636B9ED800555F83A8B0.264.236356448.518",
        "NDIS FDDI Long Maximum List Size",
        "MostRestrictiveSetting",
        "ServiceDescriptions",
        "AntiVirusProduct",
        "{148fab8a-0c88-4bcc-b7b4-1879096544de}",
        "MSFT_StorageRack",
        "KEY_SET_VALUE (0X0002) ",
        "Enter/Exit",
        "The Main Mode crypto set used in this rule.",
        "The IP4PersistedRouteTable class contains IP routes that are persisted.  By default, the routes you add to the routing table aren't permanent. You lose these routes when you reboot your computer. However, if you use the command route -p add, Windows NT makes the permanent--so you won't lose the route when you reboot your computer. Persistent entries are automatically reinserted in your route table each time your computer's route table is rebuilt. Windows NT stores persistent routes in the Registry. This class deals specifically with IP4 and does not address IPX or IP6.",
        "DVB-ASI Output",
        "5 = Application went out of scope, ",
        " 0x002 ",
        "A value representing the ReplicationType.",
        "DH Group 24",
        "ClipboardMapping",
        "TR_FD Flag",
        "ClipboardFileType",
        "C_A7642BB5BD25E38C8455D7FA5B5711E5CBB864E5CBFEC400B5BACCE7267F35B4",
        "CIM_Error.MessageID",
        "The MediaType property indicates the type of media currently present in the logical drive. This value will be one of the values of the MEDIA_TYPE enumeration defined in winioctl.h./n<B>Note:</B> The value may not be exact for removable drives if currently there is no media in the drive.",
        "Layer2 Security HC Diagnostics Trace",
        "JavaClass",
        "HardenedUNCPaths",
        "Below_Normal",
        "CD_47A47D9B6C73D6463867F73A57E933DD2525E443C9FB15C91CF6A9FC4BA05F96.2082.4205250405.6277",
        "A Flat panel's scan mode indicating either single (value=2) or dual scan (3).",
        "C_4BD0F8A6C8D9EC0678D50228DC3CB44B9F26CFF9B291F8B882B0AD7C252B23A9",
        "Processes",
        "SONET VT",
        "Defines whether this is the primary (value=3), secondary (value=4) or tertiary (value=5) cache. Also, \"Other\" (1), \"Unknown\" (2) and \"Not Applicable\" (6) can be defined.",
        "This property contains the certificate search criteria. E.g. Thumbprint=122344&store=my\\system",
        "%Control%",
        "object:MSFC_HBAPortAttributesResults",
        "Ignored",
        "Win32API|Device Context Functions|GetDeviceCaps|HORZRESVREFRESH",
        "The Type property indicates the type of the partition.",
        "DeviceFamily",
        "The access control entries for the share.",
        "The GatewayCostMetric parameter assigns an value ranging from 1 to 9999, used to calculate fastest and most reliable routes. The values of this parameter correspondence with the values in the DefaultIPGateway[] parameter. The default value for a gateway is 1. This parameter is for Windows 2000 only.",
        "The PasswordRequired property determines whether a password is required on the Win32 user account.",
        "Win32_Process",
        "NETIO_TRACE_PACER",
        "NdisAtmMaxAal5PacketSize",
        "Ndis802_11AutoUnknown",
        "InternetZoneAllowSmartScreenIE",
        "MSFT_CliAlias.FriendlyName=\"CSProduct\"",
        "CliQualifier",
        "EffectiveWindows8App",
        "CR_249E58828B05B219C8BA8313BA785229871D4134A57BDB6BE040EADBBFCCD561",
        "Bytes transferred for each mode for the device",
        "List of NDIS 802.11 network types",
        "CD_F71363625297B341F74A07A3245FC4F57BC952A1603833C9D340BD8DDA150C05.1562.1775636700.3207",
        "{945186BF-3DD6-4f3f-9C8E-9EDD3FC9D558}",
        "0xEFFF005A",
        "s too large",
        "ForegroundRatePct",
        "Example: NA-SALES",
        "Indicates the current operating condition of the process. Values include ready (2), running (3), and blocked (4), among others.",
        "Session type not supported",
        "The maximum number of channels that can wait to be accepted on the listener.",
        "NetworkDirectAcrossIPSubnets",
        "REG_SZ",
        "MSFT_iSCSISessionToDisk",
        "VLActivationType",
        "MSFT_WsdPrinterPort",
        "The BIOSVersion array property contains the complete System BIOS information. In many machines, there can be several version strings stored in the Registry representing the system BIOS info.  The property contains the complete set. ",
        "Least Significant Byte First",
        "The arguments of the trace listener.",
        "Gravities",
        "ref:Win32_TerminalService",
        "The privacy notice version.",
        "PMC Counter Configuration",
        "Set the IPsec Task Offload v2 properties on the network adapter.",
        "DSP0201.DMTF|ERROR.DESCRIPTION|2.3",
        "IsEnclosureAware",
        "A value that specifies whether to send unknown serialization data onto the wire.",
        "TrustedSitesZoneInitializeAndScriptActiveXControls",
        "CIM_VideoController.CapabilityDescriptions",
        "The DeviceID property contains a string uniquely identifying the logical disk from other devices on the system.",
        "ScsiOSLun",
        "AllTargetOsVersionsRequested",
        "CR_91604F794B64A61196688751D972A0B3626DF7A1827369CDD4AD7A23AC00FD14",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1075.3252102185.312",
        "The Dependent reference represents the driver that supports the Plug and Play device.",
        "TM_INTERNET",
        "TokenLength",
        "InitiatorInstance",
        "FAST Channel",
        "2 - 'Unhealthy': The majority of physical disks are unhealthy or in a failed state, and the pool no longer has data integrity.",
        "Policy object for IPSEC Policy",
        "WheaCommitPolicyRtn",
        "Class defining a report manager",
        "Old Allocation Address",
        "CIM_SCSIController",
        "PS_DnsClientNrptRule",
        "CachingMode",
        "SendOnly",
        "AppRollback",
        "CIM_RecordForLog",
        "NumberOfFiles",
        "DiskIo_V2_TypeGroup1",
        "CSwitch_V1",
        "The CIM_Setting reference represents the role of the CIM_Setting object of the CIM_ElementSetting association. Role: The associated setting provides the setting that implements the element setting.",
        "VolumeExt",
        "Non Specific Error",
        "Maximum SCSI data payload in bytes in an Data-In or a solicited Data-Out iSCSI sequence.",
        "This method resets the health and operational status of the physical disk. Exact behavior of this method is dependent on whether this physical disk belongs to a concrete pool. ",
        "SystemConfig_V0_IRQ",
        "General Debugging Information",
        "A value that controls whether the service attempts to impersonate using the credentials provided by the incoming message. ",
        "Description",
        "C_0085D9877CA4455C14CC08522BE2A35BD6BDD5C767F64875E5726A387A0D9FAD",
        "Started",
        "{0741C7BE-DAAC-4A5b-B00A-4BD9A2D89D0E}",
        "InternetZoneSecurityLevel",
        "TRC_INFORMATION Flag",
        "CD_B77F00C0AAB396341AF90E0CBAB7DE2932BB0B2F69B6D24907BE1A641C3162D0.2222.1.10988",
        "If IsClustered is TRUE, this disk is used in a clustered environment.",
        "The help file for this driver.",
        "DNS configuration for VPN triggering",
        "Element",
        "File Type",
        "MsftDiscFormat2Tao_DebugConstructor Flag",
        "The XCountChars property, used for processes creating a console window, specifies the screen buffer width in character columns. These values are ignored in GUI processes.  Note, XCountChars and YCountChars cannot be specified independently.",
        "CIM_ERR_SERVER_IS_SHUTTING_DOWN",
        "Read Failure",
        "The print provider needed for this driver.",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_19E57369527D4B1D06F7B62EA4740710580A7EE3221F927586AA3C452A7CD5DA5200",
        "TRACINGOBJECT Flag",
        "The config file for this driver.",
        "Type ID - Enumeration",
        "A Win32_FolderRedirectionHealth object that represents the health of the user's redirected Searches folder.",
        "CIM_ClusteringService",
        "{2306fe2b-dbf6-11d2-9244-006008269001}",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_A5134EAE65D9DD02F6CE0E924C84D387C2BC76C9409B3E6C9F586619D35EA1DA\\I_A4F640EA01E8E0975BA8BC876EC644CAB5707442FA9CA6E8B0CCDDF9DBF724D5p",
        "LS-120 boot is supported",
        "0xEFFF0016",
        "The Antispyware Signature version (major, minor, build, revision)",
        "RSOP_PolmkrStartMenuSettingVista",
        "The name of the threat",
        "MGR_TRACE_RESERVED_0c",
        "CritSecInit",
        "High Availability could not be enabled for this storage object.",
        "{8502C593-5FBB-11D2-AAC1-006008C78BC7}",
        "Alpha 21164a",
        "Whether the provider supports programmable interrupt moderation per completion queue through NDKPI.",
        "Thermal Transfer",
        "ServiceDebugBehavior",
        "Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn",
        "Resolution interval in minutes.",
        "0xD012",
        "Total number of XPSS States",
        "3 - 'Before Delta': This indicates that the source object will be maintained as a delta data from the replica. ",
        "DataExecutionPrevention_Available",
        "object:MSVerifierIrpLogEntry",
        "Association between NAT64 settings and inbound/outbound interfaces",
        "If the DeleteRoamingCache property is true, this property specifies the number of days after which a user profile should be deleted. User profiles older than this number of days are deleted when the computer is restarted.",
        "The Name property defines the label by which the object is known to the world outside the data processing system. This label is a human-readable name that uniquely identifies the element in the context of the element's namespace.",
        "// This class defines methods which allow Hyper-V to create, delete and",
        "PortableDeviceAPI_Enumeration Flag",
        "Digital Unix",
        "HealthCertificate",
        "ProcessingPrecommit",
        "See CIM_ProcessorCapabilities.NumberOfProcessorCores for details.",
        "Internet Per Connection Option List Data",
        "Where <OrgID> and <LocalID> are separated by a colon (:), and where <OrgID> must include a copyrighted, trademarked, or otherwise unique name that is owned by the business entity that is creating or defining the InstanceID or that is a registered ID assigned to the business entity by a recognized global authority. (This requirement is similar to the <Schema Name>_<Class Name> structure of Schema class names.) In addition, to ensure uniqueness, <OrgID> must not contain a colon (:). When using this algorithm, the first colon to appear in InstanceID must appear between <OrgID> and <LocalID>. ",
        "Remote Desktop for Administration",
        "Change a user profile's owner to another user, the result value is HRESULT",
        "C_3E82FB959451C3E35A276AAA1FE1C0F9B93A0726AEE69E99BECBBEB606DABFAD",
        "Operation Time",
        "tm_sec",
        "SubscriptionDebug Flag",
        "The identifier for the package from which this product was installed.",
        "An enumerated value indicating an administrator\\'s default or startup configuration for the Enabled State of an element. By default, the element is \"Enabled\" (value=2).",
        "LS_CONNECTABLE_UNKNOWN",
        "The Rename() allows for the renaming of the group name; a key in this class. The functionality to change the key property \"Name\" is implemented as a method to provide a separate context for the new name distinguishable from the key name associated with th",
        "C_956218CB3B130B9E0F4C99989C08F085EB3D3D40CE439ED3E9C6DD8BE7E440E8",
        "Program language",
        "NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients",
        "No Resources",
        "CD_B1B14559B824E121394FE392FF430F8FD008843C4AB8D519479CE971B3AF84D1.1667.46554871.699",
        "MIF.DMTF|Monitor Resolutions|002.4",
        "ICCID",
        "AllowScanningNetworkFiles",
        "MaxMwCount",
        "NtlmValidateUser_End",
        "{A571F412-E3D2-4A32-BF42-1D3B2203FF17}",
        "NetConName",
        "{F6004CE6-9507-4d86-AE1E-E9D64F166F2F}",
        "This parameter indicates whether the bad sectors should be located and the readable information should be recovered from these sectors.",
        "IPv6 Address",
        "The UTC time at which reliability metric data collection began",
        "ServiceToEndpointAssociation",
        "C_5C866111FD8D1933EECCE5D44B619D3E64BDDD0B43BC6F39166BF254D48A504F",
        "TRACE_RESERVED10 Flag",
        "Equipment Malfunction",
        "If Password and Username are left null, the provider does not care. ",
        "Expiration",
        "Supports temporary ReplicationEntity",
        "433EAFBBEC9AFF6B03CD94FB6D01B32C68CCEA476ACECCD0DB049A6CD.2668.2340397220.283",
        "{def2fe46-7bd6-4b80-bd94-f57fe20d0ce3}",
        "C_050953C58E97660582926667045FD157390A1B7EE9E1CDFCB3DD57BDA1E5B26D",
        "Length of the statistics structure",
        "productState",
        "The Reason parameter specifies the exit code for the process and for all threads terminated as a result of this call. ",
        "CR_B449E4C982007699901F8B11448557481BCA2B35C4809156A6C3E1390C860FE7",
        "LockPresent",
        "PolicySourceColorDepth indicates whether the property ColorDepth is configured by Server (0),Group Policy (1), Default (2).",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_25E364819A71426ED5E19DF77CD3F52F56BEBD4EC6ED9A7E80FD26BFFF23148E",
        "EcnMarking",
        "C_C231F504E2F0694DB5EE26E89F896D184F3E353B388345FC3E332D3F432F31D0",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_F39BE2F2CC7551BDE90E624B5C7301C158A68D618B887A135B21C9CB3CEFD863",
        "The EventType property indicates what type of device change notification event has occurred.",
        "FED7039E2B0FA9DB258BB8C709D82F4D62",
        "Name which uniquely identifies a rule",
        "Force option requiredUnknown error",
        "IR_2A8E85BB31065B3FC60BA81CED6A654079AE6D371D42FEE2259112FC3A521E06",
        "StartMenu",
        "// your adapter. For example, if you adapter supports 3 IP addresses then",
        "Online",
        "An arbitrary string that uniquely identifies the physicalelement and serves as the element's key.  The Tag property can contain information such as asset tag or serial number data. The key for CIM_PhysicalElement is placed very high in the object hierarchy in order to independently identify the hardware/entity, regardless of physical placement in or on cabinets, adapters, etc.  For example, a removable component that can be hot swapped, may be taken from its containing (scoping) package and be temporarily unused.  The object still continues to exist - and may even be inserted into a different scoping container.  Therefore, the key for physicalelement is an arbitrary string and is defined independently of any placement or location-oriented hierarchy.",
        "// if it is ever placed on a separate network from the PC NIC. Although",
        "Moderation of drain notifications based on a moderation interval value on any PD queue is supported.",
        "PNP_REGISTRY_TRACE_LEVEL",
        "Renames the specified printer",
        "ref:Win32_LogicalShareSecuritySetting",
        "spare",
        "VpnConfigurationXml",
        "DoNotShowFeedbackNotifications",
        "Indicates the current active firmware slot number of this storage enclosure",
        "StopService",
        "R_295BA595E75CC7D3A74C5F0B838A92FD0FC68A91DEB19B5C9E13269F4655BEC7.279.2824381758.518",
        "Ndis80211SsId",
        "Upgradeable BIOS",
        "Note: In order to receive all possible instances of this class, the SE_DEBUG_PRIVILEGE should be enabled.",
        "FileEqualVersion",
        "The InstanceID of the AuthSet to use for Phase 1 auth.",
        "ParentAdditionalOptions",
        "Indicates the type of address specified in DomainControllerAddress. The following valid values are presented in order, DS_INET_ADDRESS = Address is a string IP address (for example, \\\\157.55.94.74) of the domain controller.  DS_NETBIOS_ADDRESS = The NetBIOS name (for example, \\\\phoenix) of the domain controller.",
        "WARE\\P",
        "REDBOOK_WMI_PLAY_ENABLED",
        "MSFT_DSCLocalConfigurationManager",
        "The NetworkServerModeEnabled property determines whether Network Server Mode is enabled.",
        "C_C69F291BE89C7DCF47D514EEA88ABF7BDEC9B45B40FE7D549762134D0ED90168",
        "BootOptionOnLimit",
        "EVENT_TRACE_FLAG_N",
        "MaxQpCount",
        "{8502C51B-5FBB-11D2-AAC1-006008C78BC7}",
        "Values: TRUE or FALSE. A value of TRUE indicates the screen saver is active.",
        "TotalOutputPower",
        "Stack Key",
        "Service Cannot Accept Control",
        "PUAProtection",
        "I_0AE842411B3B68BDB60FB4610360E1ECD2D583F7968316F79131DB25BF102F63.311.3444058254.217",
        "ProvisionFavorites",
        "Kernel Idle State",
        "MSFT_Expression",
        "NdisMulticastList",
        "InstanceID",
        "CR_532671ED26AC2835681FE0B122A526862616ED33CAB2C220F171DB7BD5AD8B02",
        "R_B05CCAA71F3A61FD632B96A8D0CBAC4A42DD424FB85CD76DB922673FA7A32DD9",
        "System_AuditSecuritySystemExtension",
        "The transmit antenna number",
        "SetLinkPath",
        "Win32_WIN32_TSGENERALSETTING_Prov",
        "41008",
        "NewByEapTtlsAuth",
        "object:Win32_TokenPrivileges",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_C6EA9ADB21355CF6DA787E0D8D62E59CF47237122DE78FA8959CE74E2782F2F8",
        "AllowCommercialDataPipeline",
        "Bus mouse DB-9",
        "{8A3CF0B5-E0BC-450b-AE4B-61728FFA1D58}",
        "PolicyRoles",
        "This is a base abstract class that might be serialized to XML",
        "CD_92DB14183145FECB25D8F810D51EB91465DF70CF55ECB1D5FEEDBFFC4B20AADD.2060.1621076014.652",
        "Henries",
        "MaxCompletionQueueCount",
        "Limit Working Set - Causes all processes associated with the job to use the same minimum and maximum working set sizes.",
        "ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork",
        "DefaultWhite",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_7B1CEA145FD7FDDE85118A874F4CDC2DBDFFEFB5270CF85B4A7E073D01A42C9B",
        "CD_8804D243AE7A52758E6F83E5472ED92BCF2D0EC1642375FE251024B3FABA24DB.1667.868417273.1187",
        "BinarySD",
        "The Parameters property contains space set aside for use by applications. This string can be null, or it can have any number of characters before the terminating null character. Microsoft products use this member to store user configuration information. Do not modify this information because this value is specific to an application.",
        "0xEFFF005D",
        "ref:CIM_FileSpecification",
        "SpeakerVolumeHigh",
        "Indicates what is the configuration control: Group Policy or WMI",
        "WaitMode",
        "UdpIp_V0_TypeGroup1",
        "OperationTime",
        "Service Type",
        "TapeData",
        "0x003 ",
        "The Win32_TerminalSetting class is an abstract base class for all Terminal Service Setting classes.",
        "Component",
        "FrameDuplicateCount",
        "Tick Count",
        "RealTimeProtectionEnabled",
        "16.1.45904",
        "Win32_TerminalTerminalSetting",
        "{2CB2C452-C516-11D2-B364-00105A1F77A1}",
        "InternalReferenceDesignator",
        "MIF.DMTF|Electrical Current Probe|001.17",
        "Name of the registry key,",
        "MDM_Policy_Result01_AboveLock02",
        "TouchKeyboardNarrowModeAvailability",
        "This property has been deprecated in favor of the corresponding property in the Win32_PageFileSetting class.",
        "ThreadMinSet",
        "RD_TRACE_FDO",
        "Associates a network port with its binding information.",
        "The RSC hardware capabilities of the Adapter.",
        "CIM_MonitorResolution describes the relationship between horizontal and vertical resolutions, refresh rate and scan mode for a desktop monitor. The actual resolutions, etc. that are in use, are the values specified in the video controller object.",
        "]]1Z0",
        "Indicates the current operating condition of the thread. Values include ready (2), running (3), and blocked (4), among others.",
        "Specifies the allocation unit size to use when creating the storage tier.",
        "Count of # of bytes sent over this connection",
        "MDM_Policy_Config01_WindowsPowerShell02",
        "{44795707-a61b-11d0-8dd4-00c04fc3358c}",
        "DetectGateway",
        "This property gets/sets the maintenance window start hour values 0 to 23",
        "Power PC 601",
        "Volume is already a persistently bound volume.",
        "CIM::Device::CoolingAndPower",
        "A value used to define a UINT64 value. This value is readable.",
        "BspVersion",
        "object:MSFT_StoragePool",
        "FaultAlert",
        "Specifies how many physical disk failures the virtual disk should be able to withstand before data loss occurs. If specified, this value will override the PhysicalDiskRedundancyDefault which would have been inherited from the resiliency setting specified by ResiliencySettingName.",
        "Power Save - Other",
        "ISA Support",
        "{87B93A45-1F73-EC83-7261-2DFC972D9B1E}",
        "Constraints: Accepts the same value as the Name parameter.",
        "A Quick Mode SA.",
        "MSFT_NetPolicyRuleFilters",
        "The ExpandedMiniDumpDirectory property is an expanded version of the MiniDumpDirectory property. /nExample: C:\\WinNT\\MiniDump",
        "TM_SUPPORT Flag",
        "The ServicePackMinorVersion property indicates the minor version number of the service pack installed on the computer system. If no service pack has been installed, the value is zero. ServicePackMinorVersion is valid for computers running Windows 2000 and later (NULL otherwise).",
        "IsClustered",
        "Delete Temporary Folders on Exit bit.",
        "The new name for the rule.",
        "OLEDB.1 formatted output (W)",
        "HBA_SASPORTPROTOCOL",
        "The EventCharacter specifies the value of the control character that is used to signal an event, such as end of file.",
        "HideFastUserSwitching",
        "CD_43B35DA4EAEBC0284206ADBC4132DA71EB8556E731586CFE46B5A658E2C2F498.51.1518680481.682",
        "The DriveName property contains the drive name (letter) from the volume that has been added or removed from the system.",
        "SupportsGet",
        "Dependency",
        "PhysicalAddress",
        "WPD ShellServiceObject Trace",
        "Line art dithering",
        "MgmtInfo",
        "Derivation",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\CrashControl|LogEvent",
        "The unique identifier of the power supply device.",
        "SEL_EVENT_DATA3 is valid",
        "ISCSI_ERR_DATA_DIGEST_ERROR",
        "Maximum number of memory windows supported by the adapter",
        "This property is a string representation of the partition's GPT GUID. This property is only valid if the disk's PartitionStyle property is set to 2 - 'GPT' and will be NULL for all other partition stlyes.",
        "CIM_Error.ProbableCause",
        "CIM_DeviceSoftware",
        "Win32API|Network Management Structures|SHARE_INFO_502|shi502_max_uses",
        "Specifies the new size (in terms of disk percentage) of this cache file.",
        "The antecedent software feature.",
        "Longest moderation interval supported in nanoseconds.",
        "PNP_TRACE_LEVEL",
        "RemoveFailed",
        "The driver provider name.",
        "R_A66D0E591535F85D5DA7C1BDF3A1DC73BE40E7ED75F810DC35A2C1D0250B7F4C",
        "CD_F403B2915B550FE9485A23E9B50313A3835CEBAF72BAEF73F6D6D65501009E73.1589.1725133316.436",
        "SCSI Serial Storage Architecture",
        "Ndis80211InfrastructureMode",
        "C_45D7E6F87ACB8E8D445CCFB669888583D94123CEF1D8C0B902BDB864D192ADA3",
        "<LocalID> is chosen by the business entity and SHOULD not be re-used to identify different underlying (real-world) elements. If the above 'preferred' algorithm is not used, the defining entity MUST assure that the resultant InstanceID is not re-used across any InstanceIDs produced by this or other providers for this instance's NameSpace.",
        "SystemType",
        "TransactionProtocol",
        "CIM_ServiceAccessPoint",
        "IPSecCustomPolicy",
        "WD_LOG_FLAG_CONTROL Flag",
        "Description of the hash function when the value 1 (\"Other\") is specified for the property, HashAlgorithm.",
        "52001",
        "The UserName property contains the user name or the default user name used to establish a network connection. ",
        "EnumerateElementTypes",
        "moduleManifestFileData",
        "Win32_Trustee",
        "CIM_VideoBIOSFeature.CharacteristicDescriptions",
        "SupportsContinuouslyAvailableFileShare",
        "Failover",
        "Disable a settings location template.",
        "4 - 'Minor': Action is needed, but the situation is not serious at          this time. ",
        "Localized version of RSOP_PolmkrIniFileSetting for American English",
        "The storage extent accessed using the media access device.",
        "Split Count",
        "LockedDownIntranetZoneAllowSmartScreenIE",
        "Property to control IPsec tunnel encryption settings.",
        "ConfigureDeadlineGracePeriodForFeatureUpdates",
        "High Winds",
        "hResult",
        "RemainingCapacityStatus",
        "The ShareName parameter specifies the name of the share to which the link is associated with. For example, in order to create a link associated to a share \"\\\\myserver\\myshare\", the ShareName parameter should be set to \"myshare\". ",
        "OutstandingTasksTotal",
        "IPMI Driver Trace",
        "The maximum batch size for the transacted batching.",
        "CIM_ERR_QUERY_LANGUAGE_NOT_SUPPORTED",
        "I/O Active",
        "CoalescingExceptions",
        "Use Link Local Address",
        "1.5 stop bits",
        "object:MSFT_NetBranchCacheHashCache",
        "Returns the VpnConnectionProxy object that contains the proxy configuration for the specified VPN Connection",
        "C_5B62370FE5E6AF64717CE8FFF4DF7EE9BFEC8C45A936A424E7796E87491BE149",
        "iScsiFlagIpSec",
        "TimeLimitPolicy",
        "CookieHash",
        "The Type string defines the format expected for any value supplied for this parameter.",
        "Trace Problem",
        "SecureConversationAuthentication",
        "The trustee of this ACE entry",
        "3 - 'Auto' implies the subsystem automatically creates a Target. ",
        "I_C0DCD2330B402CCB79ADC9A534E5029F8DDEDEFB826D41905F5E8463B821C3EF.2457.3939950857.361",
        " The CIM_VersionCompatibilityCheck class specifies whether it is  permissible to create the next state of a software element. ",
        "Supplies the setting for selective suspend on the adapter.",
        "Indicates whether to use the same proxy server for all protocols.",
        "SDBUS_DEBUG_CARD_EVT",
        "IL_724155B2CA7FBBC304551F8A171392C3CA07A2D9AD12D47C6D2D987EFBFD727B.1163.872217503.187",
        "MSFT_iSCSIConnectionToiSCSITargetPortal",
        "MSMCAEvent_PCIComponentError",
        "The MaximumWorkingSetSize property indicates the maximum working set size of the process. The working set of a process is the set of memory pages currently visible to the process in physical RAM. These pages are resident and available for an application to use without triggering a page fault./nExample: 1413120.",
        "3 - Disconnecting",
        "Unique identifier of program",
        "SystemConfig_V0_Services",
        "Example: 00",
        ".2340397220.283",
        "XYZ CIE coordinates",
        "NS_892F8DB69C4EDFBC68165C91087B7A08323F6CE5B5EF342C0F93E02A0590BFC4",
        "The Name property defines the label by which the CIM_PhysicalCapacity object is known.  When subclassed, the Name property can be overridden to be a Key property.",
        "The supported statistics",
        "object:MSFT_PhysicalDisk",
        "Win32_DependentService",
        "The MatchAnyKeyword mask specified for the event capture.",
        "MSFT_ReplicationGroupToVirtualDisk",
        "BatteryStatus",
        "The object counts the number of times a login attempt from this local initiator has failed",
        "FrameType",
        "ISCSI_ERR_INVALID_RTT_PDU",
        "NDIS Receive No Buffer",
        "_UUUUUUUUUUU",
        "NDIS Receive Queue Parameters",
        "JIS B10",
        "A comma separated list of addresses, subnets, or ranges which this keyword represents. This must NOT be set if the 'AutoResolve' flag is TRUE.",
        "PackageName",
        "FSName",
        "// a specific format: ",
        "object:ISCSI_Supported_LB_Policies",
        "Win32API|Network Management Structures|AT_ENUM|JobId",
        "{1d25b795-68df-41a1-8255-a18329bcdbcc}",
        "{146360a3-88dd-11dd-94b8-001d09162bc3}",
        "InitialRto",
        "OfflineFileNameFolderGUID",
        "ShellNewValue",
        "SeLoadDriverPrivilege",
        "Win32API|Device Context Functions|GetDeviceCaps|NUMRESERVED",
        "R_5F3BD5E67807B789407C7E70FEA47B190EAF980A9E799D25A963DF46E602BBB8.291.970711598.520",
        "BackupRecoveryInformationToCloudDomain",
        "MSFT_NetAdapterRssElementSetting",
        "BiosMajorRelease",
        "Matches",
        "The physical extent.",
        "MSFT_StorageEnclosure",
        "GroupComponent",
        "BytesTotal",
        "The set of components enabled and the maximum number of prefetch files for scenarios recorded by the Operation Recorder API.",
        "The FileSystem the Directory is mounted on.",
        "Port Allocates",
        "Win32_TemperatureProbe",
        "HeapTrace_V2",
        "One of '32-bit', '64-bit', '32/64-bit' or 'Unknown Platform'.",
        "TxEnabled",
        "CR_9E927C42162CFFA3624D55690B21114853C375D15511354B30627B7E45D7DB02",
        "Heap Range Create Event",
        "DepositTokenActivationResponse",
        "ColorDepthPolicy",
        "SamRemoveMemFromAlias_End",
        "ThreatNotificationsValue",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\",
        "Integrated Networking",
        "StorageScaleUnitId",
        "WINSTATIO",
        "Vertical refresh rate denominator",
        "{7BB67AE8-E3D0-11d2-8601-0000F8102E5F}",
        "Reboot node if needed.",
        "SDDLToWin32SD",
        "PackageSize",
        "Number of listed supported monitor source modes",
        "A free-form string that describes the type of technology used on the LAN when the value of the LANType property is equal to 1 (i.e., \"Other\"). This property is deprecated since its purpose overlaps with OtherTypeDescription, which which is inherited from ProtocolEndpoint.",
        "PFXKeyExportable",
        "Values: TRUE or FALSE. If TRUE, DHCP is enabled.",
        "RSOP_PolmkrSetting",
        "ref:CIM_ApplicationSystem",
        "{A2EFC897-E3D3-11d2-8601-0000F8102E5F}",
        "Cancel Flag",
        "{C7BF35D3-AADB-11d1-BF4A-00A0C9062910}",
        "SlotOperationalStatus",
        "Capabilities and management  of a management controller.  An I2C microcontroller is a type of management controller.",
        "Capabilities and management of a refrigeration cooling device.",
        "DriverManagerTraceGuid",
        "Win32API|CWbemProviderGlue Class Methods|GetAllInstances",
        "The Win32_OperatingSystem class represents an operating system installed on a Win32 computer system. Any operating system that can be installed on a Win32 system is a descendent (or member) of this class.",
        "C_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2",
        "Color Bit Depth",
        "FireWire (IEEE P1394)",
        "GetSupportedCopyStates",
        "MaintenanceStartTime",
        "Decembera",
        "IdleDurationSeconds is the time an SA can remain idle (i.e., no traffic protected using the security association) before it is automatically deleted. The default (zero) value indicates that there is no idle duration timer and that the SA is deleted based upon the SA seconds and kilobyte lifetimes. Any non-zero value indicates the number of seconds that the SA may remain unused.",
        "ft-com",
        "Gauge",
        "LastSuccessfulSyncTime",
        "select * from MSFT_WMI_GenericNonCOMEvent",
        "The ProductName property indicates the product name of the sound device.",
        "Proteon 80Mbit",
        "MDM_EnterpriseAPN_01",
        "{cb7ac2e4-33f5-4ea2-8a44-cb18fdfa0597}",
        "The StartingAddress property specifies the beginning address referenced by an application or the operating system. This memory address is mapped by a memory controller for this memory object.",
        "Return BMC SEL entries as an array of MSFT_PCSVLogRecord instances",
        "AES-GCM-128",
        "Protocol",
        "{86E30E82-7DB2-11d2-90CB-0060081A46FD}",
        "EntryPoint Flag",
        "The ReleaseDHCPLeaseAll method releases the IP addresses bound to all DHCP enabled network adapters. WARNING: If DHCP is enabled on this local computer system, the option will terminate all DHCP TCP/IP connections.The method returns an integer value that can be interpretted as follows: ",
        "AllowWindowsIndexer",
        "The CIM_ToDirectoryAction association identifies the target directory for  the file action. When this association is used, the assumption  is that the target directory was created by a previous action.   This association cannot exist with a CIM_ToDirectorySpecification  association since a file action can only  involve a single target directory. ",
        "Indicates the current active firmware slot number of this physical disk",
        "Storage Device Failure Prediction Data",
        "SSLCertificateSHA1HashType",
        "DependedOnService",
        "The primary availability and status of the Device. (Additional status information can be specified using the Additional Availability array property.) For example, the Availability property indicates that the Device is running and has full power (value=3), or is in a warning (4), test (5), degraded (10) or power save state (values 13-15 and 17). Regarding the Power Save states, these are defined as follows: Value 13 (\"Power Save - Unknown\") indicates that the Device is known to be in a power save mode, but its exact status in this mode is unknown; 14 (\"Power Save - Low Power Mode\") indicates that the Device is in a power save state but still functioning, and may exhibit degraded performance; 15 (\"Power Save - Standby\") describes that the Device is not functioning but could be brought to full power \\'quickly\\'; and value 17 (\"Power Save - Warning\") indicates that the Device is in a warning state, though also in a power save mode.",
        "Monitor's raw EDID v.1.x data block accessor",
        "C_5953574AD268C37F4681AD557CF3BEA3442C419F9086A8F65CC3774027E8952E",
        "A storage pool on the target to be used as the source for creating the necessary TargetStorageElements. This parameter can be specified in lieu of TargetStorageElements.",
        "WSC_CallerAMPPLData",
        "ExclusionProcess",
        " Remove in either of the above cases.",
        "The ExternalReferenceDesignator property indicates the external reference designator of the port. External reference designators are identifiers that determine the type and use of the port.",
        "Filters traffic based on what interface it is sent or received on.",
        "One of the following values: - active: Address will disappear on next boot. - persistent: Address will be persistent. This is the default.",
        "PolicyValue",
        "Estimated speed of the connection in MegaBits Per Second",
        "AddressFamily",
        "The XOffCharacter property indicates the XOff character for the serial port",
        "Target group shall be supplied",
        "Unidirectional",
        "Enable DNS64",
        "A free-form string containing a human-readable description of CIMStatusCode. This description MAY extend, but MUST be consistent with, the definition of CIMStatusCode.",
        "DEVPROPTYPE",
        "The MethodName is a string container the name of the method for the object.",
        "Number of listed supported monitor frequency ranges",
        "MSFC_HBAFCPInfo",
        "ref:CIM_MemoryMappedIO",
        "Connection Name",
        "ISCSI_ERR_INSUFFICIENT_SESSION_RESOURCES",
        "_DH_PLAYER_FULLSCREEN",
        "Sparse",
        "CD_556BED9C5C7B0EE930A3BB6724BD19CEA9521081CDD971D1A19DD19DC37599CE.2427.1822125525.331",
        "Association between StorageNode and VirtualDisk.",
        "CIM_ConcreteJob.RequestStateChange()",
        "FunctionParameter",
        "CD_AD7EFADAD1289B4A3FEF0D60EBF19DD1D014EA7A1302D0431E7F57E3F564CBFB.1500.4180685050.694",
        "object:MSFT_StorageReliabilityCounter",
        "Win32API|Communication Structures|DCB|fDsrSensitivity",
        "NDISWMI_TRACE_QOS Flag",
        "Least Frequently Used (LFU)",
        "This field describes the maximum number of underlying physical disks across which data can be striped in the common striping-based resiliency settings.",
        "Get resource state.",
        "PA-RISC 8000",
        "The PixelsPerYLogicalInch property indicates the number of pixels per logical inch along the Y axis (vertical direction) of the display.  ",
        "Specifies how this firewall rule will handle edge traversal cases.",
        "Win32API|Device Input and Output Structures|SCSI_ADDRESS|Lun",
        "CreateVolume2",
        "ServerIpAddress",
        "C_44179BB601F070AC8C34C5B9994988FDFF5DD1A2C985178B6D48CCB665B74AD6",
        "StorageFaultDomain",
        "CD_C11E0B2968F07899C3C15A08181C55EA86BBBF2FCDF1D89855EC8855E08BA914.2111.682128206.1884",
        "43022",
        "IconPath",
        "Association between StoragePool and ResiliencySetting",
        "Unsupported Operation Error",
        "domainPortWWN",
        "65002",
        "TEST_TRACE_RESERVED_0a Flag",
        "PolicySourceVirtualIPActive indicates whether the property VirtualIPActive is configured by Server (0) or Group Policy (1).",
        "The ProcessStartupInformation parameter represents the startup configuration of a Win32 process. It includes information about displaying the window, characteristics of a console application, and handling errors. ",
        "The name of the resiliency setting used to create this virtual disk.",
        "MaxReadRequestSge",
        "MSPower_DeviceWakeEnable",
        "Own Process",
        "Sleep",
        "This property contains the SID of the local user account associated to the device",
        "RefsWppTrace",
        "CreateShare",
        "ReplicationEntity supports embedded instance",
        "58012",
        "C_4E6B2407BBFA735CD558FA956E39FDDAEBB739747AD4109DB6B2E67ADBD0148A",
        "The file sharing protocols supported by the file server.",
        "{9C49FB9B-4E8C-43AE-BACF-76404B422264}",
        "Storage health action event",
        "EntryValue",
        "The Antecedent reference represents the printing device controlled by the driver.",
        "//       targetname_#  where the  # is the SID",
        "{FAF76B92-798C-11D2-AAD1-006008C78BC7}",
        "// eventlog entry to be included in the system eventlog",
        "CIM_PhysicalComputerSystemView.Num",
        "IrBus",
        "Passive Trippoint",
        "TM_HANDLE Flag",
        "ref:MSFT_StorageTier",
        "AllowSuggestedSites",
        "object:MSNdis_LinkStateData",
        "lastaccesstime",
        "The Manufacturer property indicates the name of the network adapter's manufacturer.",
        "\\3m;\\3m;",
        "{485e7dea-0a80-11d8-ad15-505054503030}",
        "2147483648",
        "Retrieve the Configuration Agent output relating to a specific job.",
        "MSFT_NetFirstLogonFailed",
        "0x00080000",
        "The read-only GUID (Globally Unique Identifier) that represents this phone-book entry.",
        "{8502C4B2-5FBB-11D2-AAC1-006008C78BC7}",
        "DSDirectoryServiceFlag",
        "Indicates if the Adapter supports RSC for IPv4 TCP packets",
        "R_3E82FB959451C3E35A276AAA1FE1C0F9B93A0726AEE69E99BECBBEB606DABFAD",
        "AllowRecommendations",
        "DeploymentMachineData",
        "ProductStatus",
        "The Storage Tiers Management service is already optimizing the storage tiers on the specified volume.",
        "If specified, allocations for this virtual disk are limited to the storage fault domains in the list.",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2065.4189954886.180",
        "Last full scan start date and time (using round-trip UTC format)",
        "0x8005005E",
        "R_B1BDF04F409DA8A1218BDCCDF869651E770462250C203BC00DEB8F3479804AE1",
        "Length of time, in hours, the storage device has been powered on since manufacture.",
        "CIM_IKEProposal.VendorID",
        "{7944cf67-697b-4432-953e-1fdada884361}",
        "{0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9a}",
        "ref:CIM_SoftwareElement",
        "MemoryCompression",
        "GTF support",
        "IncludeAllLocalSites",
        "CustomLocate",
        "5.25,  720KB,  512 bytes/sector",
        "{6ba1639c-afc4-454e-b3e0-5e8f7fc39af9}",
        "Interle",
        "EVENT_TRACE_FLAG_NETWORK_TCPIP",
        "ref:CIM_StorageRedundancyGroup",
        "SamShutdownSamSrv_Start",
        "C_BFE8824DD38CFCF8E5C18FD190F5AFD951CFCCBCFCAC142E912A160B869182BC",
        "TimeCheck",
        "RSOP_GPLink",
        "C_DD19013C5DC1E320E81019FC349982C55E1E96FA47B8CD4B261815CDCB293CAE",
        "LogFlagDataBytes",
        "The scoping operating system's name.",
        "logEntries",
        "Contents of the icon for this file association",
        "NameEncoding",
        "OwnerAuthEscrowed",
        "The HardwareType property indicates the hardware type of the pointing device.",
        "MGR_TRACE_RESERVED_07 Flag",
        "DMWmiBridgeProv1",
        "The Y property specifies the y offset, in pixels, of the upper left corner of a window if a new window is created. The offsets are from the upper left corner of the screen.  For GUI processes, the specified position is used the first time the new process calls CreateWindow to create an overlapped window if the y parameter of CreateWindow is CW_USEDEFAULT.  Note, X and Y cannot be specified independently.",
        "Mount",
        "ref:Win32_CommandLineAccess",
        "MsftEnumDiscRecorder2_DebugConstructor",
        "HOSTPROC_TRACE_DEVICE Flag",
        "Win32_PortableBattery",
        "VirtualFree",
        "object:AcpiPssState",
        "HardMount",
        "SriovSupport",
        "True if Internet Explorer Enterprise Mode is enabled",
        "Denotes whether this subsystem supports local mirror replication.",
        "GetReport",
        "MSiSCSI_LB_VENDOR_SPECIFIC",
        "Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|QuotaNonPagedPoolUsage",
        "LUAInstall: error 0x00000005 setting flags [{93412589-74D4-4E4E-AD0E-E0CB621440FD}]",
        "DisableNetworkUI",
        "C_6D1FE252E44FF3546ECC7BED576DC3967B39474BC0CE652BF027660AF117633A",
        "HorizontalSyncPulseWidth",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_usr_comment",
        "Values: TRUE or FALSE. If TRUE, the driver terminates all read and write operations with an error status if an error occurs. The driver will not accept any further communications operations until the application acknowledges the error.",
        "The MessageOriented property indicates whether the protocol is message-oriented. A message-oriented protocol uses packets of data to transfer information. ",
        "{09A81E78-E1D3-44D4-84E3-C33A04A4CC6E}",
        "Describes settings related to the BranchCache content server role",
        "Win32_PortConnector",
        "create",
        "Instances of this class contain information about any environment variables that may need to be registered for their associated products installation.",
        "Firmware Version",
        "0x103",
        "Logins  Failed",
        "BackgroundRatePct",
        "Tape - DST Small ",
        "IPSourceRoutingProtectionLevel",
        "Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_DTRDSR",
        "CR_20EDCE2D529E2E6BCE41DEE4170C3E9E6D3DEAF61091F14E5541886CD554DE30",
        "5 = This application is the winning application ",
        "Growing",
        "This association relates a CIM_Configuration object to one or more managed system elements. The CIM_Configuration object represents a certain behavior, or a desired functional state for the associated CIM_ManagedSystemElement.",
        "AuthenticatedBytesReceived",
        "Win32API|Registry Functions|GetPrivateProfileString|Paths|TargetDevice",
        "Lowest Processor Performance State",
        "98 - Not all DHCP leases could be released/re",
        "ACQUIRE_FOR_SECTION_SYNCHRONIZATION",
        "TurnOffDataExecutionPreventionForExplorer",
        "0xC0050061",
        "SourceInstance",
        "OSPlatform",
        "SamSetInfoUser",
        "MINSTORE Flag",
        "Win32API|Process and Thread Structures|STARTUPINFO|lpTitle",
        "AllowRemoteShellAccess",
        "SMBIOSMajorVersion",
        "K6 Family",
        "ModulationCCITT",
        "FrameHeader",
        "UserInputDelay",
        "This property is an array of all the various mount points for the partition. This list includes drive letters, as well as mounted folders.",
        "Supplies the identifier ID of this offload, assigned by the system.",
        "HRCreateFlags",
        "VideoPlaybackRedir",
        "System reconfigured",
        "The base unit of the measurements.",
        "SERIAL_WMI_PARITY_SPACE",
        "CD_06F709A163637DA41871EC661878543C4C8F0288DCF32B1331F472D89C57FA5E.2377.481822045.789",
        "PreOpCompletion",
        "An association between a power meter and the registered power supply profile.",
        "MaxUploadRateProvider",
        "TcpConnectionIPv4",
        "Minute",
        "ReceivedBytes",
        "Document",
        "PolicySourceLevelOfControl",
        "ITU-IANA-ALARM-TC",
        "CIM_AssociatedSensor",
        "R_CA2D9CAD55F788BDDBEEB1BEFBBE80B4829CC0B88C20F28872DE5F91E068E98E.2505.1653669329.540",
        "//        exposed will be available in sysmon (perfmon) when running on ",
        "Cannot Print Page",
        "This class exposes FC3 Management information associated with a fibre channel adapter. There should be one instance of this class for each adapter",
        "ITU X.29 Host PAD",
        "State of the relay name resolution. One of the following values: enabled, disabled, automatic, default.",
        "OtherSensorTypeDescription",
        "D_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655.1166.1475828249.3715",
        "MSMCAEvent_SystemEventError",
        "The returned configuration of the requested printer.",
        "Keyword",
        "Describes the physical extents participating in a storage redundancy group.",
        "PauseFeatureUpdatesStartTime",
        "Non-RGB multicolor display",
        "CIM_ConnectorOnPackage",
        "Ethernet 3Mbit",
        "I_735452BBEBEFDAEBC6A68DCD86C8369C33E470B585707BA64EB646095B631099.1196.495475129.331",
        "SMBIOS|Type 16|Memory Error Correction",
        "GetEncryptionMethod",
        "IR_59543DA79A0A83C48BB9222B5916E17BBA9A5688C362D35DD3F13589A2596294",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightName",
        "DeleteJobByPrinterObject",
        "This method deletes a volume.",
        "C_81CBCA9C0215B59E860943652530299E5FB0DE537CE83929081B409741C1FE81",
        "Example: AT+V.",
        "IsPackageAware",
        "object:MSFT_NetAdapterUdpSegmentationOffloadCapabilities",
        "Specifies if the units returned by this Sensor are rate units. All the values returned by this Sensor are represented in the units obtained by (BaseUnits * 10 raised to the power of the UnitModifier). This is true unless this property (RateUnits) has a value different than \"None\". For example, if BaseUnits is Volts and the UnitModifier is -6, then the units of the values returned are MicroVolts. But, if the RateUnits property is set to a value other than \"None\", then the units are further qualified as rate units. In the above example, if RateUnits is set to \"Per Second\", then the values returned by the Sensor are in MicroVolts/Second. The units apply to all numeric properties of the Sensor, unless explicitly overridden by the Units qualifier. Any implementation of CurrentReading should be qualified with either a Counter or a Gauge qualifier, depending on the characteristics of the sensor being modeled.",
        "Optional text used by Microsoft to provide additional metadata.",
        "CIM|CIM_LogicalDevice",
        "Example: samples.microsoft.com example.microsoft.com",
        "polmkrBaseKeyValues",
        "CIM_Error.ProbableCauseDescription",
        "The virtual disk could not complete the operation because another computer controls its configuration.",
        "CD_0A4A77B99E06085632BB6F0B20A342FB9C17A36A3889D5E85FF4837055C41CA3.1617.1427124413.252",
        "Example: Accessories\\System Tools",
        "The state requested for the element. This information will be placed into the RequestedState property of the instance if the return code of the RequestStateChange method is 0 (\\'Completed with No Error\\'), or 4096 (0x1000) (\\'Job Started\\'). Refer to the description of the EnabledState and RequestedState properties for the detailed explanations of the RequestedState values.",
        "DisplayNames",
        "RemotingError",
        "C_404A8A60F06FF86C891EF2776F930A45A835547F74E3D08788D5D842F92EEA38",
        "AppDataRoaming",
        "SM_GetPortAttributesByWWN",
        "{2306fe2a-dbf6-11d2-9244-006008269001}",
        "KEY_CREATE_LINK (0X0020) ",
        "{7A2C6C2B-E5A5-49ad-AD68-133089ACD74D}",
        "The ProviderOperation_FindConsumer property indicates the number of calls to IWbemEventConsumerProvider :: FindConsumer.",
        "DrvMjFnRet",
        "ConfigurationProvider",
        "Microsoft Windows",
        "F903D6EC-8647-438f-9E42-891F4733EDAF",
        "MIF.DMTF|Memory Device|002.4",
        "The Windows authentication settings for this service.",
        "Supplying this parameter will automatically remove the supplied DNS suffixes from the current Trusted Network List.",
        "Secure Boot Capable",
        "Association between iSCSITarget and iSCSITargetPortal",
        "The scoping system's creation class name. ",
        "TR_UTIL Flag",
        "{B454051D-0A85-4346-A55B-7BDA5189A405}",
        "IP address used by the DA client to identify which site to use based on GSLB resolution",
        "htmlEditorHKLMRegData",
        "{6fbf2a5f-8b8f-4920-8143-e6c460f52524}",
        "The Win32_DfsNode class represents a root or a link of a domain based or a standalone distributed file system (DFS). ",
        "ChecksumOffloadHardwareCapabilities",
        "ServerShunt",
        "Capabilities of the media access device.  For example, the device may support \"Random Access\", removable media and \"Automatic Cleaning\".  In this case, the values 3, 7 and 9 would be written to the array. ",
        "CPASEC",
        "DCTCP",
        "C_F71CEDE68D110C46E631A74BD74BB02467459B066EB8F2E32432A8044C4EFD32",
        "Windows Kernel Trace",
        "C_9C46A759D30423AAF4F69D77D418152E94C7E20506D0B665994363777B2CCBC6",
        "The MinimumWorkingSetSize property indicates the minimum working set size of the process. The working set of a process is the set of memory pages currently visible to the process in physical RAM. These pages are resident and available for an application to use without triggering a page fault.",
        "Windows 2000 supports 3 levels of Encryption: Low, Medium/Client Compatible and High. Windows 2003 supports 4 levels of Encryption Low, Medium /Client Compatible, High andFIPS Compliant",
        "TargetPortal is an endpoint used by IP based storage networks (such as iSCSI). It provides initiators the IP address for which they should discover target ports on.",
        "select * from MSFT_MpEvent",
        "The RunAsUser property indicates whether the application is to be run under a specific user account on activation.",
        "Parent Path",
        "object:MS_SMHBA_PORTATTRIBUTES",
        "Example: johnsmith",
        "DOT11_ROAMING",
        "\\\\.\\root\\Microsoft\\Windows\\RemoteAccess\\Client:__Win32Provider.Name=\"VpnClientPSProvider\"",
        "DelayedAckTimeout",
        "MDM_Policy_Result01_Autoplay02",
        "doWipeMethod",
        "Specify the scan type to use for a scheduled scan.",
        "ForceClose",
        "Maximum number of active VCs the adapter can support.",
        "GlobalProcessCount",
        "HASEndpoint",
        "Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpServiceStartName",
        "The Description property provides a description of the Windows operating system. Some user interfaces (those that allow editing of this description) limit its length to 48 characters.",
        "The ActualColorResolution property indicates the current color depth of the video display.  ",
        "Specifies whether to enable or disable advanced RemoteFX graphics for RemoteApp.",
        "NapContext",
        "IL_5BB37259D5CC25306A3611D2ED686AFC58E38CCEED024E8AC562ECE33C896DC6.1338.418677725.192",
        "#define HBA_EVENT_ADAPTER_UNKNOWN       0x100",
        "CR_DEF6358C5F0DB3A8C212B6EB5152B0DBA8FDCC511B86D1F1B5A68B1427787DDC",
        "MSNdis_CoReceivePdusOk",
        "Collection",
        "CREATE_NAMED_PIPE",
        "TcpIp IPV4 Connect/Accept",
        "\"41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "object:Win32_OfflineFilesFileSysInfo",
        "WHY Flag",
        "The Application reference represents the DCOM application containing configuration options of the executable.",
        "DiskAvailableBytes",
        "SamCloseHandle",
        "BAUD_128K",
        "AllowInboundTimestampRequest",
        "Win32_OnBoardDevice",
        "WeakHostReceive",
        "MDM_EnterpriseModernAppManagement_AppManagement01",
        "The Timespan that specifies how long the channel initialization has to complete before timing out.",
        "Indicates whether NAT is enabled or disabled",
        "9FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "NETWORK_QUERY_OPEN",
        "CD_0D4A09511C06326D5D345B08A0B467BA70A695848B2E0A8AE92A1F33516CC3D6.2198.3413957900.810",
        "An acquire is a request by the IPSEC driver to have IKE perform a task. The active acquire statistic includes the outstanding request and the number of any queued requests. Typically, the number of active acquires is 1. Under a heavy load, the number of active acquires is 1 and the number of requests that are queued by IKE for processing.",
        "ISO 802.6 ",
        "The SNMP Community for this port.",
        "The child DS instance",
        "FolderRedirection",
        "ErrorsGrantedAccess",
        "Example: COM1.",
        "SingleSession",
        "The Location property specifies the physical location of the printer./nExample: Bldg. 38, Room 1164",
        "MSMCAInfo_RawMCAEvent",
        "43015",
        "WHERE DEVICEID='#'",
        "MSADCE.1 formatted output (A)",
        "Average time taken to process a request over this connection",
        "NeighborCacheLimit",
        "CIM_PrintJob.HorizontalResolution",
        "Bid2Etw_MSDART_1_Trace_TextA",
        "CIM_Container",
        "C_7A288281B12CD5978F882BFE4E06591343F1E62E2C1F812A6EF10FF3AC723D09",
        "MaxLogFileSize",
        "Specifies the error of the teredo interface",
        "ALPC Unwait",
        "Information Out of Sequence",
        "C_D1B22386C05D6CCE039F3E2E81A633B5C0FFE40FF5DDEB6DE1E49489FD86B241",
        "UserId",
        "MDM_Policy_Result01_SmartScreen02",
        "TM_PMUX Flag",
        "CD_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655.12.2167383571.520",
        "MSNdis_AtmSupportedServiceCategory",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_DF1D72ECC9268213FCB43A06A38DBF2A7452DFF83D9A2AF1D89F3CECA76D4AF1",
        "Peak Working Set Size",
        "D5A9A51E-03F9-404d-9722-15F90EB07038",
        "object:MSDiskDriver_PerformanceData",
        "CIM_PhysicalComputerSystemView.OtherIdentifyingInfo",
        "The Win32_TSPermissionsSetting class allows granting permissions to new accounts and restoring default permissions on the terminal.",
        "redirectingGroup",
        "Sha_1",
        "IsSystem",
        "Bytes written using hardware Epp mode",
        "Indicates the  Plug and Play device ID of the logical device.  ",
        "MIF.DMTF|Storage Devices|001.9",
        "MIPS R4400",
        "Cards may be plugged into motherboards/baseboards, are daughtercards of an adapter, or support special card-like modules. These relationships are described by the CIM_CardOnCard association.",
        "Audit Success",
        "CD_01F6508C1866E0E79B21585B0217BD595D533D4A180A35479737402276CAE352.263.1814521396.767",
        "Processor domain affinity",
        "TcpIp Disconnect",
        "{23b77e99-5c2d-482d-a795-62ca3ae5b673}",
        "IsPrimordial",
        "CIM_DeviceErrorCounts",
        "The name of the product's supplier. ",
        "ApplicationID",
        "IL_5C670A419305640007AA9AA161CE0975646DEEA64973112E2DE223893C0FA422.1499.570302633.340",
        "WakeOnPattern",
        "Association between DNS64 settings and accept/send interfaces",
        "Cannot assign access paths to hidden partitions.",
        "Label",
        "Maximum Partition Count",
        "The description for the current value of the property.",
        "MaxMemorySupported",
        "LogFlagTransferDetails Flag",
        "1 - 'Not Supported' implies the subsystem does not allow creation of a Target. ",
        "Local targets allocated from sources resource pool",
        "CD_01E1BC020A762ADC8945816F21D23E994CAF727D5579290522A7B046C6C167F5.2547.2740247068.1678",
        "__win32provider.Name=\"Microsoft.Uev.ManagedAgentWmi, Version=10.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\"",
        "ClassGuid",
        "SECAM B",
        "This field contains information about the device.",
        "A value other than 5 or 12 shall identify the state to which the element is in the process of transitioning.",
        "PixelsPerXLogicalInch",
        "The major version of this driver (e.g. 3 or 4).",
        "71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "EVENT_TRACE_FLAG_DISK_FILE_IO",
        "format",
        "ProcessorType",
        "ModemInfSection",
        "Specifies whether to enable or disable drive mapping.",
        "SamGetAliasMem_End",
        "JobTime",
        "MDM_Policy_User_Result01_CredentialsUI02",
        "GetWinstationDriverNames",
        "R_5E6C5AE950083E175CA12D415FB0E496349A073C308734F5F004DB31E4895266.1148.1910482409.536",
        "Property for controlling IPsec encryption type for DA",
        "Fracturing",
        "Driver Name",
        "{313e88dd-a4fd-11d8-b301-505054503030}",
        "DetailedTracking_AuditRPCEvents",
        "MDM_Policy_Result01_TextInput02",
        "Shared Storage",
        "SettableFlowControl",
        "MSFT_CliAlias.FriendlyName=\"UserAccount\"",
        "Localized version of RSOP_PolmkrFolderOptionsSetting for American English",
        "Workstation Trust Account",
        "IL_75757880EAB8961D1A3C186FDB42A3E5F36F1FCF20B2679D12A2FFFCA63470FF.551.1.33689",
        "StopTime",
        "Specifies the minimum working set size for all processes associated with the job. Ignored unless LimitFlags specifies Limit Working Set",
        "Initialize",
        "ReceivedDiscardedPackets",
        "The base class of IPv4 and IPv6 protocol for Microsoft TCPIP WMIv2 provider.",
        "{08E31939-FAAB-4a3b-9B10-50151D1B9D24}",
        "Maximum number of connections where MAXINT implies unlimited.",
        "//********************************************************************",
        "LowercaseLetters",
        "WSP_StorageNodeToDisk",
        "   //  The string type is variable length (up to MaxLen).              ",
        "The Win32_DeviceChangeEvent class represents device change events resulting from the addition, removal or modification of devices on the computer system.  This includes changes in the hardware configuration (docking and undocking), the hardware state, or newly mapped devices (mapping of a network drive).  For example, a device has changed when a WM_DEVICECHANGE message is sent.",
        "RegOwner",
        "ref:MSFT_iSCSITargetPortal",
        "DeviceMap",
        "4 - 'Stressed': indicates that the storage pool is functioning, but needs attention. Examples of 'Stressed' states are overload, overheated, and so on. ",
        "Auto Answer with Call-Back",
        "The number of records in the Master File Table.",
        "DefaultDatatype",
        "WmiQueryNICSwitchHardwareCapabilities",
        "CIM_ProductFRU",
        "The ImageBase property indicates the base address where the module was loaded into process memory.",
        "CD_935B071362B928DF8D6A74C10986C5790CCB0ED5E141E88F1610752926D4F6DB.2623.3358712077.350",
        "object:PeerTransportSecuritySettings",
        "MDM_Firewall_Addresses03_01",
        "The number of bytes that can be read from or written to a Media. This property is not applicable to \"Hard Copy\" (documentation) or cleaner Media. Data compression should not be assumed, as it would increase the value in this property. For tapes, it should be assumed that no filemarks or blank space areas are recorded on the Media.",
        "DeferUpgrade",
        "AllowPinnedFolderDocuments",
        "The unique identifier of the power meter device.",
        "PreviousClass",
        "ref:CIM_ServiceAccessPoint",
        "FILESHARINGPROGRAM",
        "The ThermalState property identifies the enclosure's thermal state when last booted.",
        "StorageSubsystemObjectId",
        "0xEFFF002D",
        "Timer Address",
        "704C2B50E4463864CF2615B27D56E94A95716A",
        "CD_E540585DCA2960F60394B8EF9EDC432CF6F41DA95FE565F23D6AD3E1AFE40536.1539.1099854327.481",
        "SAM Get Members In Alias",
        "SMBIOS|Type 16|Physical Memory Array|Memory Error Correction",
        "SM_AddPort",
        "Set iSCSI CHAP Shared Secret",
        "this flag indicates if wbinvd works EXCEPT that it does not invalidate the cache",
        "0xC000000E",
        "{f8a56d3e-e304-4a9f-a916-5187019d7759}",
        "NETIO_TRACE_EQOS Flag",
        "NS_8C42BEBD02EFBAC62404CD4CEA999A517B5A01487A2C77E2EFAE4ADBEB0788A8",
        "SMBIOS|Type 9|Slot Characteristics 1",
        "CorporateDNSProbeHostName",
        "AccountManagement_AuditDistributionGroupManagement",
        " logic\\",
        "NoRestart",
        "ref:CIM_AlarmDevice",
        "LastScanError",
        "Processor Frequency",
        "CBStart",
        "The Win32_NamedJobObject class represents a kernel object that is used to group processes for the sake of controlling the life and resources of the processes within the job object. Only the job objects that have been named are instrumented.",
        "PromptForPasswordUponConnection",
        "RemovalCause",
        "Indicates whether the licensing policy-cache needs to be updated: 0=not required, 1=Refresh required.",
        "AvailableJobSheets",
        "Win32API|File Functions|CreateFile",
        "77628.335",
        "Supported display features",
        "FSDir",
        "The DNSDomain parameter indicates the domain the DNSis associated with and is represented by an organization name followed by a period and an extension that indicates the type of organization.",
        "17 - 'Completed': The disk has completed an operation. This status value should be combined with OK, Error, or Degraded, depending on the outcome of the operation.",
        "Property to control Ipsec tunnel encryption settings",
        "Indicates the hashes should be saved to a staging area for future export",
        "RssSupported",
        "PassThroughServer is the name or address of the computer system hosting the proprietary storage provider classes.",
        "SetAccessSecurityDescriptor",
        "FX_TRACE_LOADER Flag",
        " Comments, reason for shutdown and timeout can be specifiedwhich is not available in Win32Shutdown method.The method returns an integer value that can be interpretted as follows: ",
        "The WS-Adressing action of the request message.",
        "{A598F86F-FC0D-4b6b-A591-661E0B49DB9E}",
        "ReceiveFilterGlobalParameters",
        "LastRunPotentialPurgeSlabs",
        "userSecurityGroups",
        "Enables, and sets parameters for the User VHD",
        "SetByCommitSet",
        "SystemConfig_V2_NIC",
        "MicrosoftNetworkClient_DigitallySignCommunicationsAlways",
        "MIF.DMTF|Temperature Probe|001.5",
        "WRITE_LOG_SECTORS",
        "SECHC_LOG_FLAG_DIAG Flag",
        "2 - Domain Controller ",
        "Name of interface on which to send outgoing queries",
        "ChannelPoolSettings",
        "Status of the OA2 BIOS marker.  0=No SLIC table, 1=SLIC table with Windows marker, 2=SLIC table without Windows marker, 3=Corrupted or invalid SLIC table",
        "C_3BDC2F0A0A90E9AC9B64A580B95D437559985136A7FD8C2487C72223A8541D52",
        "R_F22CF0C74A9002156D476F4DBA031C7F3F706A1A94FD4FF91611BCB6BD8FBB7C",
        "AGP_ENABLE",
        "ScheduledInstallSecondWeek",
        "Another shadow copy operation is already in progress",
        "Create a virtual port with a specific WWPN.",
        "R_5250EC9304AFCED3B4B4C6E595A1730CDF3C33CD4C1A0C35D2E9C70B3EAA91C7",
        "For Fibre Channel networks, this field should be the World-Wide Name (WWN) for the port, formatted as a hexadecimal string (16 characters long), with the most significant byte first. For example, a WWN address of 01:23:45:67:89:AB:CD:EF should be represented as 0123456789ABCDEF. ",
        "FileOp Flag",
        "Changer Problem Warning",
        "The source of entropy used to create keys.",
        "Disassociate the NDIS 802.11 device with the current SSID",
        "C_84BBAE9FD8A6E21188B2D0767DBEB321A61D32EF3C67D9E47C565889A9DA260D",
        "The Partitions property indicates the number of partitions on this physical disk drive that are recognized by the operating system.",
        "Win32_RDFileAssociation",
        "Timeout for synchronization from the settings repository (in milliseconds)",
        "NdisVlanId",
        "RssCaps",
        "No_GP_Fault_Error_Box - If this flag is set, the operating system does not display the general-protection-fault message box when such an error occurs. This flag should only be set by debugging applications that handle general protection (GP) faults themselves via an appropriate exception handler.",
        "WmiMonitorBrightnessMethods",
        "CompletionQueueError performance counter missing",
        "Indicates the total number of bytes being processed by this job.",
        "Win32_SystemProcesses",
        "SW_MINIMIZE",
        "Specifies the processor selection and load balancing profile applied.",
        "IsDAX",
        "If TRUE, this storage job represents an automated background task initiated by the storage subsystem. For all user / management initiated operations, this value should be set to FALSE.",
        "Cacheable",
        "CIM_RelatedStatistics",
        "LicenseStatus",
        "HBA_EVENT_PORT_STAT_GROWTH",
        "MDM_ApplicationControl_PolicyInfo03",
        "Grant number in the token-based activation license that activated the product.",
        "Value of maximum X resolution supported by server",
        "DefInprocHandler",
        "Layer 3 VLAN using IP",
        "This method will configure the associated instance of Product to the specified install state and level.",
        "CD_88F6BCC90DFA936CEB051CC0CC5EBEAC8E426A3D0DFAE58E560CEF1E3E70C3AE.210.4047163286.734",
        "The controller.",
        "EKUMapping",
        "10 - 'Failedover': Reads and writes to/from the target element. Source element is not reachable. ",
        "The time at which the event was logged.",
        "IL_84C50CAE138BE8DBF0961918247F6BEE4A1E2653F7AB56ED2DAD85047B7399C8.76.2268304904.305",
        "{1F20B83E-DB33-11d2-85FC-0000F8102E5F}",
        "Execute in 'count by byte' mode",
        "C_4FF6A0D7C7A873EB07C9F2EA16C1C5FF4B6E7F5EC9C729192D48026A285849C5",
        "The trace buffer size for the ETW session. The value range is 1KB to 1024KB.",
        "The StartName property indicates the account name under which the service runs. Depending on the service type, the account name may be in the form of \"DomainName\\Username\".The service process will be logged using one of these two forms when it runs. If the account belongs to the built-in domain, \".\\Username\" can be specified. If NULL is specified, the service will be logged on as the LocalSystem account. For kernel or system level drivers, StartName contains the driver object name (that is, \\FileSystem\\Rdr or \\Driver\\Xns) which the input and output (I/O) system uses to load the device driver. Additionally, if NULL is specified, the driver runs with a default object name created by the I/O system based on the service name.",
        "Return",
        "CIM_Job.ErrorDescription",
        "BackupInterval",
        "FileTypeMask",
        "The amount of time that the Job is retained after it has finished executing, either succeeding or failing in that execution. The job must remain in existence for some period of time regardless of the value of the DeleteOnCompletion property. ",
        "ISCSI_LoginOptions",
        "User specific configuration",
        "Native 802.11",
        "The Actions associated with a PolicyRule may be given a required order, a recommended order, or no order at all. For Actions represented as separate objects, the PolicyActionInPolicyRule aggregation can be used to express an order. ",
        "UdpIPv6HashSupported",
        "{361f227c-aa14-4d19-9007-0c8d1a8a541b}",
        "The identity of the MDM application",
        "Workgroup",
        "CD_2A2D6E6AC8E9DC7CFD3B145ECD6507F431971D2D607AF7EC159B3B5EAE53046F.33.2142122399.553",
        "MCA_ERROR_PCI_BUS_MASTER_ABORT_NO_INFO",
        "SM_GetRNIDMgmtInfo",
        "EvictNode removes a computer system from a cluster. The node to be evicted is specified as a parameter to the method. The return value should be 0 if the computer system is successfully evicted, 1 if the method is not supported and any other number if an error occurred.",
        "Select * from Win32_ComputerSystem",
        "VPNServerNameAddress (string)",
        "{FAF76B86-798C-11D2-AAD1-006008C78BC7}",
        "Virtual Path to the application (includes Environment Variables)",
        "R_DDEDD07282B8324F60B5A48A479C1B42607AE5EA149F90058D5C2368C1337E02",
        "MSFT_NetSwitchTeamMember",
        "SetKeyManagementServicePort",
        "MCA_WARNING_MEM_1_2",
        "ExplicitLogon",
        "An XML representation of this instance, which can be used as input for MSFT_VpnConnection::Set",
        "AddPrinterConnection",
        "Example: C:\\PAGEFILE.SYS",
        "Time Flag",
        "Requests that the Device re-establish its configuration, setup and/or state information from a backing store. The intent is to capture this information at an earlier time (via the SaveProperties method), and use it to return a Device to this earlier \"condition\". This method may not be supported by all Devices. The method should return 0 if successful, 1 if the request is not supported, and some other value if any other error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are \\'translated\\' may also be specified in the subclass as a Values array qualifier.",
        "PermissionsAllowed",
        "Specifies the email address to be used when sending the log files that are generated by NCA to the network administrator.",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services|Tcpip\\Parameters\\Interfaces|UDPAllowedPorts",
        "CIM_Printer.ErrorInformation",
        "startime",
        "Win32API|System Shutdown Functions|ExitWindowsEx|EWX_SHUTDOWN",
        "Specifies that TTLS should be used as the authentication method.",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSREMOTECONTROLSETTING_Prov\"",
        "CD_639FCCE3DE726C47FF30745340C22FCB819E5E4DFCA7546346272EDDA843022D.1177.3753724727.1871",
        "Unavailable Resour8",
        "Win32_TSStartMenuApplication",
        "Address Format",
        "PrivilegeGroup",
        "TM_PMUX",
        "MSWmi_ProviderInfo",
        "Specifies the least significant bits of the LUID.",
        "TM_LIST",
        "{C4819C8D-9AB8-4b2f-B8AE-C77DABF553D5}",
        "Failure",
        "Quiesced",
        "The LogicalDevice.",
        "StandbyTimeoutOnBattery",
        "Although not officially designated as \\'role combinations\\', multiple roles may be specified using the form: ",
        "If TRUE, this subsystem supports the deletion of its storage pools.",
        "NS_D8D295EDF64C7F3A5E94E377F9D35AA7B08D0DF6C56C2323D31A8EE4AEE51E6D",
        "DSwitchStart",
        "The bandwidth of the Port in Bits per Second.",
        "PolicyChange_AuditAuthenticationPolicyChange",
        "WmiSetTcpOffloadParameters",
        "An array representing the supported host types.",
        "%ProgramFiles%\\Windows Defender\\MsMpeng.exe",
        "WD_LOG_FLAG_ASSERT",
        "A class derived from System that is a special collection of ManagedSystemElements. This collection provides compute capabilities and serves as aggregation point to associate one or more of the following elements: FileSystem, OperatingSystem, Processor and Memory (Volatile and/or NonVolatile Storage).",
        "POWER",
        "Describes which policy the server uses in order to determine the connection settings.",
        "ElementSize",
        "StrongCRLRequired",
        "Configuration Control",
        "EnableVolumeScrub",
        "ScreenHeight",
        "The email addresses of those persons to be included on the BCC: line.",
        "Settings",
        "IsHidden",
        "This property corresponds to the RequestedState property of the logical computer system represented by CIM_ComputerSystem. See CIM_EnabledLogicalElement.RequestedState for details on RequestedState.",
        "E21555D2DB9537A0D6F20293E6715D",
        "NS_59411655A8F95EE7BEABDFB898861DFA8E2BF23293A8AFE96B2E5BB236E7FE01\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_8B68560B534A6D3AF089AA733C222DB25352C8528E5767D325B8757B271F3DD1",
        "AvailableDiskSpace",
        "Unsupported Version",
        "MDM_Policy_Result01_Power02",
        "TRACINGPOOL Flag",
        "{dab01d4d-2d48-477d-b1c3-daad0ce6f06b}",
        "ref:CIM_UnitaryComputerSystem",
        "Event Dir",
        "Query Receive Filter Parameters",
        "Indicates if the Adapter supports segmentation of a packet containing IPv4 options.",
        "CommercializationOperator",
        "MSFT_DeliveryOptimizationConfig",
        "InteractiveLogon_MachineInactivityLimit",
        "Boolean indicating that this card is physically unique from other cards of the same type and therefore requires a special slot. For example, a double-wide card requires two slots. Another example is where a certain card may be used for the same general function as other cards but requires a special slot (e.g., extra long), whereas the other cards can be placed in any available slot. If set to TRUE, then the corresponding property, RequirementsDescription, should specify the nature of the uniqueness or purpose of the card.",
        "The Win32_PrinterShare class represents an association between a local printer and the share that represents it as it is viewed over a network.",
        "FormFactor",
        "{6715375E-DB2A-11d2-85FC-0000F8102E5F}",
        "object:MSFT_NetAdapterPowerManagement_WakePattern",
        "Maximum HSync denominator",
        "TcpIp_Fail",
        "MSFT_NetIKEAuthSet",
        "MSFT_StorageDepartureEvent",
        "t71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "POINTER_PORT_WMI_TRACK_BALL",
        "Invalid IP  address",
        "Select * from Win32_ComputerSystemProduct",
        "The TagId property specifies a unique tag value for this service in the group. A value of 0 indicates that the service has not been assigned a tag. A tag can be used for ordering service startup within a load order group by specifying a tag order vector in the registry located at: HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\GroupOrderList. Tags are only evaluated for Kernel Driver and File System Driver start type services that have \"Boot\" or \"System\" start modes.",
        "NdisFddiShortMaximumListSize",
        "The FromValue property defines a value or set of values that is to be translated. If the value is a set the syntax <value1>-<value2> should be used. This will be interpreted as meaning any value in collating sequence order between and including value1 and value2. If the character \"-\" is to be included it should be escaped with a \\ character",
        "MSFT_CliAlias.FriendlyName=\"Service\"",
        "Reporting Method",
        "__IndicationRelated",
        "{442FF639-3DA0-4A70-A1D8-579E26C46A60}",
        "The InstanceObject property contains the object instance to be written.",
        "    ISCSI_ENCRYPT_NONE = 0,",
        "ValidateShareScope",
        "DeviceManufacturerDisplayName",
        "valueType",
        "CMsftMultisessionSequential",
        "Win32API|Communication Structures|COMMPROP|dwSettableParams|SP_PARITY_CHECK",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\CrashControl|SendAlert",
        "ThermalRating",
        "SMBios Data",
        "Key-value pair for ODBC CIM providers.",
        "CD_A810B8BCB28B4593289F5B14287BCC8F9F33A8E5A5BE4903C9226502B53FB3AA.39.1964842008.520",
        "VendorId",
        "CD_E6695722F42AFD2A38B87A3A03743A182D780F4AE622B7E7DF87DC65E7D101EB.75.1430516308.535",
        "R_29E8AA5244375C87F1F5AB9F42A22D9A1B648F420047277D7A92CD564C59256E",
        "MSNdis_80211_TransmitPowerLevel",
        "The SMBIOSPresent property indicates whether the SMBIOS is available on this computer system./nValues: TRUE or FALSE. If TRUE, SMBIOS is on this computer.",
        "ReportSetMarks",
        "__SERVER",
        "ref:Win32_Group",
        "AllowAutoComplete",
        "The underlying storage for the target elements (the replicas) will be drawn from TargetStoragePool if specified, otherwise the allocation is implementation specific. If target elements are supplied, this parameter shall be NULL.supplied, this parameter shall be NULL. ",
        "The Capacity property indicates in bytes, the size of the volume.",
        "VirtualizationBasedSecurityHwReq",
        "Message Description",
        "Specifies the version of the BranchCache hashing scheme to use",
        "Error Type.",
        "NS_CCA03770E562E2A170EDED20A589C069A2045A9BCD7412B77D068846D9054EC4",
        "Queue Tag",
        "SELFHEAL Flag",
        "The Compressed property indicates whether the logical volume exists as a single compressed entity, such as a DoubleSpace volume.  If file based compression is supported (such as on NTFS), this property will be FALSE.",
        "__NamespaceCreationEvent",
        "PortalPort",
        "\\\\.\\root\\Microsoft\\Windows\\Powershellv3:__Win32Provider.Name=\"DiscoveryProvider\"",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.1973968525.368",
        "OtherErrorType",
        "QueryLanguage",
        "This parameter contains the PPP Tunnel Type configured in the RAS config blob. This tunnel is decided after first successful connection.",
        "Specifies the path that contains the subkeys to be enumerated. ",
        "Permissions to a specific Remote Desktop connection.",
        "checkIfIEIsDefaultBrowser",
        "CommandLineEventConsumer",
        "MSFT_DtcLogTask",
        "ApplicationType",
        "losure 1",
        "MSFT_WebResourceManager",
        "Represents the TransportFilterTCPSetting association class in TCPIP WMIv2 provider.",
        "{B272D2EA-DB22-11d2-85FC-0000F8102E5F}",
        "ForceFraudWarning",
        "MDM_Policy_Result01_DeviceInstallation02",
        "BcdDeviceElement",
        "DNS Client NRPT",
        "SelectAllNetworkAdapters",
        "SamQueryDisplayInfo_End",
        "ExtendedInfo",
        "Counter2",
        "The ICMIntent (Image Color Matching Intent) property indicates the specific value of one of the three possible color matching methods (called intents) that should be used by default.  ICM applications establish intents by using the ICM functions.  This property can assume predefined values of 1 to 3, or driver-defined values from 4 to 256.  Non-ICM applications can use this value to determine how the printer handles color printing jobs.",
        "ConsumerClassNames",
        "IPv4 Link Local",
        "GetError",
        "MSFT_NetAdapterPacketDirectSettingData",
        "IPXFrameType",
        "9 - The directory path to the service executable was not found.",
        "Rendering Locally",
        "C_DE89CEAF49F8C74091CFA54D65C5205930932DBBEA319F95370A8BB021E5EAFD",
        "InjectErrorRtn",
        "The WINSPrimaryServer property indicates the IP address for the primary WINS server. ",
        "Counted",
        "CD_A15A00CD5014B43F15BAFD3D0F7CB556BF54FF60085CBA96C47BF4ABDD28D656.311.2693324341.1698",
        "The SetDNSSuffixSearchOrder method allows for the setting of the suffix search order as a array of elements. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. This is an instance independent method call that applies across all adapters. Windows NT only. ",
        "The Name property uniquely identifies the service access point and provides an indication of the functionality that is managed.  This functionality is described in more detail in the object's Description property.",
        "CONTROL",
        "ResetPerfCountersOnly",
        "Esp-cipher",
        "ifOutErrors",
        "PreventUsersFromTurningOnBrowserSyncing",
        "Cannot perform the requested operation when the drive is read only",
        "Download",
        "Support Xon Xoff",
        "MaxSpace",
        "Vertical polarity is negative",
        "ddedInstance",
        "SERVICE_SYSTEM_START ",
        "__Group",
        "GetMultiStringValue",
        "The DNSDomainSuffixSearchOrder parameter specifies the DNS domain suffixes that is appended to the host names during name resolution. When attempting to resolve a fully qualified domain name (FQDN) from a host only name, the system appends the local domain name. If this is not successful, the system uses the domain suffix list to create additional FQDNs in the order listed, and queries DNS servers for each one.",
        "Toolbar button object for the IE browser, used for IEAK RSoP.",
        "Flag to represent All User VPN Connection profile or Single user profile.",
        "TLB access due to data prefetch (both hardware and software)",
        "C_FAE2ECC09FED2EB4B7A4EC8980CE634E75CF805CEDF86064A82170B68F9B5074",
        "SequencedActions",
        "Total number of Kernel Idle States",
        "C_5F07E9A66A14C03CEA70F14BB69F6D6A77D54ED7E0162E55A1871003B04B5B0D",
        "The ComponentId property contains the Globally Unique Identifier (GUID) of this COM component.",
        "CONFIG Flag",
        "The group that this rule belongs to.  This field is based on the value of RuleGroup and changes to this field are ignored.",
        "The AccessMask property contains the access rights to the share, held by the user or group on whose behalf the instance is returned. ",
        "The current computer state",
        "Win32API|Printing and Print Spooler Structures|JOB_INFO_4|PagesPrinted",
        "4C86994DA8C.1797.2375707628.192",
        "C_9437CDD252D8899EB7AD00D86C43831F2CC65E71AFA52343D401A7ED5367A82A",
        "Require Server Authentication (DEPRECATED)",
        "WSP_ReplicaPeer",
        "{68a6caf8-ea81-4ad2-a2a7-e96a9cce87df}",
        "This parameter indicates the default allocation policy for storage pools created in this subsystem. If the subsystem does not support storage pool creation, then it determines the default allocation behavior for virtual disks created in this subsystem.",
        "OMI_ResourceModuleManager",
        "**typedef** Current status of adapter",
        "Total size of the volume",
        "MSNdis_CoVendorDescription",
        "Win32API|Process and Thread Structures|JOBOBJECT_BASIC_LIMIT_INFORMATION|PriorityClass",
        "The period within which a transaction must complete.",
        "C_0165CAB89BDC44E6A103BBB55829CE27E96FFC1FBC965B1148A99781C10E7A7B",
        "TM_IPPC",
        "WriteErrorsTotal",
        "Deletes the partition and corresponding volume.",
        "C_57DAE5D6F0455ADEAD486789BD3D641999E687462388031EF82C523529E0E36F",
        "Maximum number of state entries in the table. Value must be > 0.",
        "CD_E367B12CF12DEB20E317AE3B028692F15635A4C17B759C34D4B8D5D615A27793.1.1934871860.155",
        "EnableDAForAllNetworks",
        "TransactionScopeRequired",
        "{d5e09122-d0b2-4235-adc1-c89faaaf1069}",
        "The Description parameter specifies a comment describing the node.",
        "MSFT_BackgroundTask",
        "CR_0E5696839A5AB639CE4CA331881E4EEE21A91F994E8EF5EFC523806BDC11D8EF",
        "43004",
        "Whether the power budget configured in the BMC is enabled.",
        "DefaultLimit",
        "Off-line data collection status",
        "Bid2Etw_MSADCF_1_Trace_TextA",
        "FriendlyName is a user-friendly, display-oriented string to identify the disk.",
        "MSFT_DAConnectionStatus",
        "Set Link Parameters",
        "This method is used to add a mount point directory for the volume.  The result of this method is the creation of a Win32_MountPoint class associating this volume with the Win32_Directory instance representing the directory specified in the parameter list",
        "C_3DC91A797E626AC72558CF32A344BB47D2E2EC35EEBC7E9ECDD67B034B53206A",
        "Unused2",
        "<LocalID> is chosen by the business entity and should not be re-used to identify different underlying (real-world) elements. If the above \\'preferred\\' algorithm is not used, the defining entity must assure that the resulting InstanceID is not re-used across any InstanceIDs produced by this or other providers for the NameSpace of this instance. ",
        "PS_ModuleToModuleFile",
        "SerialOverrunErrorCount",
        "SMBIOS|Type 7|Supported SRAM Type",
        "SpecifyChannelBindingTokenHardeningLevel",
        "The VM NIC ID to which the Virtual Function is associated.",
        "CommitSizeInBytes",
        "PolicyAdvancedRemoteAppGraphics",
        "C_55795F81C8422B8993E279C97F35D31AD4DD7851F75BE99F367F8BA09963EB67",
        "IdleTimeout",
        "Event Source",
        "MaxThreadsPerQueue",
        "MDM_Policy_Result01_ControlPolicyConflict02",
        "UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated",
        "DefaultNumberUp",
        "The Binary property indicates whether the serial port is configured for binary data transfer. Since the Win32 API does not support non-binary mode transfers, this property must be TRUE. Specifying FALSE will not work. Values: TRUE or FALSE. A value of TRUE indicates the serial port is configured for binary data transfer.",
        "The configuration name of the binding.",
        "The AddPrinterConnection method provides a connection to an existing printer on the network and adds it to the list of available printers on the computer system. If successful, applications will be able to use this printer for print jobs.  If unsuccessful",
        "H4m;H4m;",
        "881D05F26BFED8",
        "IsVariableLeaf",
        "IndicationFilterName",
        "\"Error\" indicates the ManagedElement is in an Error condition. ",
        "CD_410D7099EDD88BE50D962D5B670D3AC5CA5FD46428D3FEEB55DA5CF9C0146EC2.1.837364299.269",
        "2.21.0",
        "{999A286E-CF9C-4f0c-8F0F-827C4C0D9CC6}",
        "Temperature Unacceptable",
        "{63ECB33C-DB33-11d2-85FC-0000F8102E5F}",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pDriverName",
        "C_56BB19692EC0F16AB4670B21CC11FD91410229C5E3EC8B45AF60003DC3CD47A8",
        "Win32API|Printing and Print Spooler Structures|JOB_INFO_4|SizeHigh",
        "The PortType property describes the function of the port./nExample: USB",
        "Target Mapping information given is invalid.",
        "Current time set on this directory server",
        "{6cc2405d-817f-4886-886f-d5d1643210f0}",
        "{BDBA4B12-8D00-4570-B9B2-3FDECF1D5661}",
        "The Name property defines the label by which the statistic or metric is known. When subclassed, the property can be overridden to be a Key property. ",
        "Software licensing server URL for the product certificate",
        "NdisFddiTypeWrapA",
        "Dirty",
        "The name of the file.",
        "since A and C can be performed in either order, but only at the \\'1\\' position. ",
        "This method returns the replication settings for this replication group.",
        "TRUE if the adapter should use DHCP to discovery its IP address information.",
        "The configuration provider for files and directories.",
        "PCMCIA Type III",
        "5 = \"Run Recovery Job\", meaning run the Job associated using the RecoveryJob relationship. Note that the recovery Job must already be in the queue from which it will run.",
        "LUN List",
        "InformationSpecified",
        "ref:MSFT_Disk",
        "VESA DMT",
        "MsftDiscFormat2StreamRandom",
        "String array of available physical network adapters and thecorresponding DeviceIDs are returned as an array of DeviceID qualifier.",
        "The DeviceID property contains a string that uniquely identifies the memory device.",
        "{F6FEF20A-E3D2-11d2-8601-0000F8102E5F}",
        "Reference to the IE toolbar button.",
        "See CIM_NumericSensor.CurrentReading for details.",
        "Client Realm",
        "SvchostGroup",
        "When true the session is automatically closed when a service closes a duplex session.",
        "ShortDisplayName",
        "Localized version of RSOP_PolmkrLocalUsersSetting for American English",
        "C_2432A5ABBE7173FA98223D70B4EDFB312E0AA87F456103A25E4B4191AB55FA02",
        "RemoteAddressDynamicKeywords",
        "CD_532671ED26AC2835681FE0B122A526862616ED33CAB2C220F171DB7BD5AD8B02.1355.1842705089.461",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmTTOption",
        "SERVICE_DISABLED ",
        "The numbers of the slots on which to enable or disable identification.",
        "{64c6f797-878c-4311-9246-65dba89c3a61}",
        "IPV4 Address",
        "NS_5CF6F9641D4AAF44F18181FA22B732295FA75500CE844EE9D6144DAF9F98E074\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_21E85A20CC15E835CB6487F54DC9B230DDD677D1A3F958EEE3ACBA0DE0846B34",
        "0x040000",
        "The percentage of the Master File Table that is in use.",
        "UserConfigurationData",
        "MSFT_DtcAdvancedSettingTask",
        "thirdPartyPrivacyTypeText",
        "CD_064843E966479C3B4CF71DBA14623DC8C5CF1B385A02FDC292B3B3F5C45F4BAC.2052.3124294998.164",
        "The local port of the connection.",
        "Analog",
        "AccountList",
        "#define HBA_EVENT_PORT_BROADCAST_D24_0  0x206",
        "NoProxy",
        "A three-byte IEEE-registered vendor code, followed by a single byte the vendor assigns to identify a particular NIC.",
        "SIP Trunk Group",
        "An association between an IEAK policy setting and a custom browser toolbar button.",
        "The IPAddress parameter lists all of the static IP addresses for the current network adapter. /nExample: 155.34.22.0",
        "CIM_FRUIncludesProduct",
        "_DH_LAYOUTMAN_DOCKING Flag",
        "InfoFormat",
        "The ForwardBufferMemory property indicates how much memory IP allocates to store packet data in the router packet queue. When this buffer space is filled, the router begins discarding packets at random from its queue. Packet queue data buffers areR",
        "The QueryId property holds the Identifier of the query which was canceled. This identifier was originally delivered to the provider by the NewQuery method of this interface.",
        "RD_TRACE_IO",
        "PDUTransmitted",
        "The Delete method will delete the logical file (or directory) specified in the object path. Delete returns an integer value of 0 if the file was successfully deleted, and any other number to indicate an error./nIt returns one of the following integer value",
        "PS_EapConfiguration",
        "See CIM_NumericSensor.LowerThresholdFatal description for details.",
        "The HypervisorPresent property determines whether the system is running under a hypervisor that follows the industry standard convention for reporting a hypervisor is present.",
        "L2tpPsk",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.454126105.368",
        "The DefaultIPGateway is an input parameter to the SetGateways method. It contains a list of IP addresses to gateways where network packets should be routed.",
        "object:MSFT_iSCSISession",
        "TypeDCStart",
        "Dispatcher operations",
        "Win32_POTSModem",
        "ThirdPartyVpn",
        "The child element in the association.",
        "3221232503",
        "80286",
        "VlanFilteringSupported",
        "MIF.DMTF|Electrical Current Probe|001.12",
        "R_DDB73D0F02FF17367F3458F82AD4C84E13BBC8D3B2C869DBFA99C5BA8000FD1A.2461.1202471016.558",
        "EDD (Enhanced Disk Drive) Specification is supported",
        "MSFT_MpComputerStatus",
        "0xEFFF0006",
        "DnsServer1",
        "Listed supported monitor source modes",
        "{5213e82c-ca20-44cc-b3fd-1edf027e5afc}",
        "GetTcgLog",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1475.3487665334.180",
        "Contains an array of subkey strings. ",
        "AppsAccessTasks_ForceDenyTheseApps",
        "SamEnumDomInSamSrv",
        "DeleteReplacedProfile",
        "If session limit is reached or connection is broken, one of the following actions is taken: Disconnect - User is disconnected from the session or Terminate - The session is permanently deleted from the server.",
        "SetHomeDirectory",
        "MSiSCSI_RADIUSConfig",
        "NamedPipeConnectionPoolSettings",
        "LocalMachineZoneAllowAutomaticPromptingForActiveXControls",
        "The AllocatedBaseSize property indicates the actual amount of disk space allocated for use with this page file. This value corresponds to the range established in Win32_PageFileSetting under the InitialSize and MaximumSize properties, set at system startup.",
        "0xEFFF0022",
        "The FQDN of the resource domain containing the KMS SRV records for the org. Returns null if SetKeyManagementServiceLookupDomain has not been called.",
        "CD_51F3F9CABF21479B5E00904A33BC282B6528414D4B4FFFAC999E337071761517.1520.3555833859.513",
        "Win32_TerminalServiceToSetting",
        "OpticalFlushInit",
        "NoAccess",
        "Describes the 6to4 sharing state. One of the following values: enabled, disabled, default.",
        "High Priority",
        "Process_V1_TypeGroup1",
        "#define SM_PORT_SPECIFIC_ATTRIBUTES_MAXSIZE  max(sizeof(MS_SMHBA_FC_Port),  sizeof(MS_SMHBA_SAS_Port))",
        "Win32_SystemProgramGroups",
        "{7A1FC391-5B23-4C19-B0EB-B1AEF59050C3}",
        "Settings location template",
        "Unable to release DHCP lease",
        "R_ECA4BCE942A7519C8BD48784B00775961389BBC39B370F76AE4A3294CBE6E51C",
        "This method converts a binary blob security descriptor format to a __SecurityDescriptor instance.",
        "A boolean indicating whether the network adapter is capable of automatically determining the speed of the attached/network media.",
        "IeeeDcbxSupported",
        "The SCSILogicalUnit property indicates the SCSI logical unit number (LUN) of the disk drive.  ",
        "KMS host SkuId in AO used for the last AD activation.",
        "NdisStatusDot11ConnectionCompletionIndication",
        "C_D7F3D9E12DEEE204449B9CAA8D3A0464D39F0FE9902E503068BD45CB162CC389",
        "Collection End Time",
        "ARCNet Plus",
        "EVENT_TRACE_FLAG_DRIVER",
        "ISCSI_ERR_EXCESS_DATA_SENT",
        "PLATFORM_TRACE_RESERVED_0b Flag",
        "This is used in conjunction with the PortIds filter to enable tracing per-packet events on one or more switch ports. ",
        "3.5 ,  1.23Mb, 1024 bytes/sector",
        "{19EE4CF9-5322-4843-B0D8-BAB81BE4E81E}",
        "{458bbea7-45a4-4ae2-b176-e51f96fc0568}",
        "Handshaking (flow control)",
        "MSFT_NetAdapter_QosSettings",
        "Microsoft-Windows-P2P-Mesh",
        "Security desriptor of the deployed application. This descriptor is in self-relative format",
        "g the serial port.",
        "CD_9F25211DB7D04527A2718EFAB934C1664FA38400093282D5A337A37681C23242.1668.1.17269",
        "Configures License type based on the Terminal Server Mode: For Remote Admin - Remote Desktop for AdministrationApplication Server - Per Device and Per UserPersonal Terminal Server - Personal Terminal Server.",
        "CentralAccessPolicyName",
        "Antenna Failure",
        "The InstallDate2 property represents the installation date of the product.",
        "Unable to configure DHCP service",
        "This property gets/sets the application content uri rules. E.g. 'https://mail.microsoft.com/owa'",
        "MDM_ApplicationSetting",
        "ExecutionState",
        "Mark_V0",
        "MSNdis_TokenRingLineErrors",
        "Links an IPsec rule to its auth and crypto sets.",
        "WindowSizeThreshold",
        "NS_390EB45D32F689282408ADA520CE6393A41EC4618EE204AA0FBC32CF2D7469E3\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_618BE348A47753A2409C56D8BA15B824FE864BAE4B7AEC8D5761691B87263426",
        "Name of initiator",
        "VF-45",
        "NdisFddiLemRejects",
        "DisableScanningNetworkFiles",
        "object:MSiSCSIInitiator_DeviceOnSession",
        "Policy store in which this configuration object is stored",
        "R_E340FB8EB4DB3A4F1ED0804CB2A3406B4CA2DC92297E79DEEE6E8BA2BD0D28FC",
        "{EC231970-6AFD-4215-A72E-97242BB08680}",
        "MDM_Policy_Config01_TaskManager02",
        "NS_3579DC951657EA60871CD1E9EBEE6A8D0AD711287837BD9631F6B3FC9EC7141E\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_867009D1FACF80A1E2C919A8EEB83F6A5BB16EF95BACD064E526589732F91844",
        "The IPUseZeroBroadcast property indicates whether IP zeros-broadcasts are used. If this parameter is set TRUE, then IP uses zeros-broadcasts (0.0.0.0), and the system uses ones-broadcasts (255.255.255.255). Computer systems generally use ones-broadcasts, but those derived from BSD implementations use zeros-broadcasts. Systems that do not use that same broadcasts will not interoperate on the same network. Default: FALSE.",
        "MonthlyCdnBytes",
        "Allows an administrator to explicitly disable a scan from checking any of the paths listed.",
        "Indentation",
        "CurrentPasswords",
        " A check is a condition or characteristic that is  expected to be true in an environment defined or  scoped by an instance of a CIM_ComputerSystem.   The checks associated with a particular software  element are organized into one of two groups  using the Phase property of the CIM_SoftwareElementChecks  association. Conditions that are expected to be  satisfied when a software element is in a particular  environment are known as in-state conditions.  Conditions that need to be satisfied in order to  transition the current software element to its  next state are known as next-state conditions   A CIM_ComputerSystem object represents the  environment in which CIM_SoftwareElement are already  installed or in which CIM_SoftwareElement will be installed.  For the case in which a software element is already installed,  the CIM_InstalledSoftwareElement association is used to  identify the CIM_ComputerSystem object that represents  the \"environment\". When a software elements is being  distributed and installed on a different computer system, the CIM_ComputerSystem object for the targeted system  is the environment.",
        "MSFT_MaskingSet",
        "ContentsRenamedInLocalCache",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2484.1653932254.180",
        "Localized version of RSOP_PolmkrNetworkOptionSetting for American English",
        "RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer",
        "Association between the security settings of a share and one member of its DACL",
        "{8502C55F-5FBB-11D2-AAC1-006008C78BC7}",
        "PAL NC",
        "Operation Type",
        "NdisFddiTypeWrapAB",
        "{8AC984F4-DB37-11d2-85FC-0000F8102E5F}",
        "0 - Ethernet 802.3",
        "PLATFORM_TRACE_RESERVED_17",
        "The QueryLanguage property hold the language of the following query filter. For this version of WMI, it will always be 'WQL'.",
        "MSNdis_SetTcpOffloadParameters",
        "A textual description of the  object.",
        "Read Write",
        "MSFT_CliProp",
        "ContentDownloadConnectPort",
        "The DisplayType property indicates how the network object should be displayed in a network browsing user interface.",
        "TPM_Certificate",
        "C_3574CA0F26B4AC51BE1A9D13287FDF35F510716AB14315900C3DD347BA7A0FA0",
        "TotalProcesses",
        "Stack9",
        "A request was made to enable unimplemented capabilities for a port",
        "Is Not Next",
        "TimeTaken",
        "Mouse port driver information",
        "LUAInstall: error 0x00000005 setting flags [{948B45F7-EFB8-46fb-8704-B340D847227A}]",
        "LPC_TRACE_RESERVED_09",
        "Time this policy object was created.",
        "BBE2D56B8634C3D06EF9",
        "Retrieves a list of winstation driver names.",
        "DisableCaching",
        "IPV6 Subnet Address",
        "NdisAtmSupportedServiceCategory",
        "Represents the TCP parameter setting for Microsoft TCPIP WMIv2 provider.",
        "The DeviceName property indicates the name of the display device.  ",
        "UpdateDynamicKeywordAddress",
        "Wireless WAN",
        "Win32API|Network Management Structures|SHARE_INFO_502|shi502_path",
        "The QuotaPagedPoolUsage property indicates the quota amount of paged pool usage for the process.",
        "SystemConfig_V2_DeviceFamily",
        "Win32Registry|HardwareInformation.MemorySize",
        "LUAInstall: error 0x00000005 setting flags [{93CB110F-9189-4349-BD9F-392D9A4D0096}]",
        "PowerState",
        "GroupMask7",
        "E8F93CB5F8195E21E8C383D6C44CC41",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_13770FB29B535A976ABDF141714ADA919FC9C51EFC37EDB5C1E955ACE56BE9DB",
        "{BADCC35D-8542-4A5C-A457-0ECCCF62508A}",
        "I_18B6D4EB7C4A1ECD9E8ACA9EE4BB46AFABE66672A92365FB5A8AEA913BD3EDDC.1751.21967571.185",
        "2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655.1166.1475828249.3715",
        "AGP Status",
        "MSFT_CliAlias.FriendlyName=\"NetClient\"",
        "UpgradeMethod",
        "ErrorRecoveryLevel",
        "This method converts a __SecurityDescriptor instance to SDDL string format.",
        "Win32API|File Structures|WIN32_FIND_DATA|cFileName",
        "ref:MSFT_iSCSIConnection",
        "Urgency",
        "Example: NTFS",
        "Not using interrupts.",
        "InteractiveLogon_SmartCardRemovalBehavior",
        "LastBootUpTime",
        "EntryPointIPAddress",
        "SlowDownProviders",
        "Indicates the thread priority status of KMS service: 0=Normal Priority (default), 1=Low priority.",
        "Job details as xml string",
        "SAM Query Information User",
        "The DeviceID property contains a string that uniquely identifies the disk drive and partition from the rest of the system",
        "CPUSpeed",
        "LPC_TRACE_RESERVED_1d Flag",
        "Optical Transport",
        "TRACE_FATAL",
        "EnableStateLocation",
        "RequiresDaughterBoard",
        "Stack13",
        "AllowSecondaryAuthenticationDevice",
        "SetInfoPolicy2_End",
        "MSFT_NetEventVmNetworkAdapter",
        "{89399c21-4aaf-408e-ba39-ab831a1298d5}",
        "If provider is configured for Per User Initialization, then the User property refers to User's particular instantiation of a provider instance.",
        "The Win32_LogonSessionMappedDisk class represents an association between a logon session and the mapped logical disks defined within the session.",
        "EVENT_TRACE_FLAG_PROCESS",
        "Internal device name",
        "Win32_PowerSettingDefinitionRangeData",
        "C_4F0D52044CEE6BA44A797C21E074FB5F72A44E740DF64604538AC24885525391",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\CrashControl|Overwrite",
        "The method enables setting a more granular set of permissions to the existing account. The flag, Allowspecifies if Permissions is to be allowed or denied.The permissions are set individually through PermissionMask.The PermissionMask is an enumeration of the following values:WINSTATION_QUERY, WINSTATION_SET, WINSTATION_LOGOFF, WINSTATION_VIRTUAL | STANDARD_RIGHTS_REQUIRED, WINSTATION_SHADOW,WINSTATION_LOGON, WINSTATION_MSG, WINSTATION_CONNECT,WINSTATION_DISCONNECT",
        "HotSwappable",
        "Win32_OfflineFilesHealth",
        "41005",
        "DownloadMode",
        "SetLoadBalancePolicy",
        "ThreatName",
        "Security Descriptor controlling access to the application, in SDDL Format. Empty string implies allow all access. Does not support DENY ACEs, or ACEs referring to non-domain users or groups.",
        "RestoreDefaultThresholds",
        "C_26F2DFA12DD4E238DF19BAA4547B3B8EF9BC62B9AB940056F71629B35FA95FCC",
        "bandwidth",
        "The spi for the first operation",
        "If true, allow cross-forest user policy and roaming user profiles. If false, a roaming profile user receives a local profile when logged on to a cross-forest domain.",
        "9 - CIM_ERR_CLASS_HAS_INSTANCES. Operation cannot be carried out on this class since it has instances. ",
        "UnsafeConnectionNtlmAuthentication",
        "primaryComputerEvaluation",
        "SystemConfig_V4",
        "The operating system installed on the computer system.",
        "Sequent",
        "    EncryptionLevel (string) Specifies the encryption level for the VPN connection profile. Available values: NoEncrytpion, Optional, Required, Maximum",
        "PfsGroup",
        "AppData\\Roaming folder, GUID is {3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}",
        "MSNdis_AtmMaxActiveVpiBits",
        "DontDisplayNetworkSelectionUI",
        "Connect When Not Broadcasting",
        "NdisTokenRingCurrentFunctional",
        "MSFT_WmiFilterEvent",
        "IdleAccounting",
        "Win32_Property",
        "GetTSLanaIds",
        "{485e7df0-0a80-11d8-ad15-505054503030}",
        "ARCNet",
        "BlockNonAdminUserInstall",
        "TEST_TRACE_RESERVED_19",
        "DDR-2",
        "UriTemplate",
        "IsOwned",
        "CR_B209BBC3E9792036932058EAFDFF59DF6B02D2E0E24C683DBB3CFAD2B25B83E4",
        "HOSTPROC_TRACE_FUNC Flag",
        "NOT_NULL",
        "ImapiV1Shim",
        "AllowEndTask",
        "ref:CIM_JobDestination",
        "ConnectToMorePreferedNetwork",
        "The high voltage of Input Voltage Range 1 for this Power Supply, in millivolts. A value of 0 denotes 'unknown'.",
        "ProfileXml",
        "ServiceModel Channel",
        "CD_E284DDF7F9BBC191C804CE3AADDF197ECFC83C10E016C1AED712528DDDFB1F1C.1730.116998595.516",
        "I_F504AFA6F9A141BC7801D87FAE2607276EEE57A330DE33914A0D2EC4FF8C2BEE.1480.1412314230.190",
        "C_E6211D2EE9E3D772F3F5092CE86BF256E8A0ACC7D6C04BC5100CBFDD67DEE026",
        "The trustee representing the owner of the object",
        "GlobalPending",
        "The Collate property specifies whether to collate the pages that are printed. To collate is to print out the entire document before printing the next copy, as opposed to printing out each page of the document the required number times. This property is ignored unless the printer driver indicates support for collation.",
        "Bus Master Latency in microseconds",
        "Win32_PnPDevicePropertySint16Array",
        "Not enough free space",
        "SidString",
        "Designates the switch ports to limit per-packet event tracing to. ",
        " Where TerminalName = '#'",
        "Failure - Unknown file system",
        "Indicates the total physical storage size of the disk in bytes",
        "C_50E2EF079B9FBAAF9D94FB8FDAA61134DC1E148B80881B48AAD04236871436C0",
        "A textual description of the CollectionOfMSEs object.",
        "InfPath",
        "HOSTPROC_TRACE_DEVICE",
        "C_4956F7377CADF88BAEF29AB167534942D2330E0E6BECB3AE4512BFCC91561A1E",
        "{8502C4FB-5FBB-11D2-AAC1-006008C78BC7}",
        "This represents the additional options for the element.",
        "WriteCacheSizeMin",
        "Search results information flags",
        "HyperV",
        "Single-bit ECC",
        "RPCEndpointMapperClientAuthentication",
        "Online Service",
        "SEL_DATA1",
        "FCPId",
        "The LogicalPort that represents the Device behind the ProtocolEndpoint.",
        "EnumerateTrustedDomainsEx",
        "TierSizeMax",
        "Provides  access to the jobs scheduled using the schedule service. ",
        "This property has the value of the lower 16-bits of the EventIdentifier property. It is present to match the value displayed in the NT Event Viewer. NOTE: Two events from the same source may have the same value for this property but may have different severity and EventIdentifier values",
        "VideoModeDescription",
        "43031",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_C2EEBA851C346DF34F861C42E7FA8ECBDDB628883251DE37984D2F4DA29D260F",
        "11005",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_53AF8608C104F86655F42A8871E5F73225A8D681F66B8151B7C200C46C518C505200",
        "VHD Set",
        "The ExecutablePath property indicates the path to the executable file of the process.",
        "Win32_TCPIPPrinterPort",
        "In some circumstances, a target port may be identifiable as a front-end or back-end port. For example: a storage array might have back-end ports to communicate with physical disks, and front-end ports to communicate with hosts. If there is no restriction on the use of the port, then the value should be set to 4 - 'Not restricted'.",
        "ACCOUNT Flag",
        "File System Driver",
        "Bid2Etw_ADODB_1_Trace",
        "Frame Relay",
        "File name of the setting file to be checked.",
        "MSNdis_QueryPciDeviceCustomProperty",
        "Win32API|File Functions|GetDiskFreeSpace",
        "Certificattion authority to validate the IPsec channel for DirectAccess.",
        "I_17DDB24E06C80D313A770A8371F66D654B7CABC1BB0EE94CAD421F946D9BF27D.2707.116747591.314",
        "AllowScriptScanning",
        "C_3A1E8C6ABCBF6CE8E93D082CCC274F6AA9174C864DC045530449FD4EA27D4BCC",
        "SAM Group Create",
        "LUAInstall: error 0x00000005 setting flags [{9324DA94-50EC-4A14-A770-E90CA03E7C8F}]",
        "MSFT_StoragePoolToVolume",
        "AuthenticationType",
        "Win32_WIN32_TSACCOUNT_Prov",
        "object:MSFT_MaskingSet",
        "OtherPortType",
        "R0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109",
        "{FCF7A6F2-3300-4386-9A4F-0DD4E3226507}",
        "CR_E4E3C277AFADB65E535A86CD5AAE23B1AEF585A2BE1A21A282B170B7F4278F9E",
        "PmcCounterProf",
        "10 - Infrared Wireless",
        "The operation is not supported while the cluster is being upgraded.",
        "KI_C0C025C38981E58EE50CB7BB4E4786CBA14FD933E638861EA3A6A2E0C806211E",
        "MDM_Policy_Result01_Maps02",
        "SYSID_UUID",
        "Associates a network port with its PacketDirect properties.",
        "PMC Counter Profile",
        "HwEppReadCount",
        "The action the Antimalware took on the detected threat (the threat status)",
        "An integer that specifies the maximum size of the pool that contains internal MSMQ message objects.",
        "The TransactionIdentifier property is for internal use, currently always {00000000-0000-0000-0000-000000000000}.",
        "SessionCxnTimeoutError",
        "R_9F036BA68CA921AFF06984BDB9CEE80E8A2696D8DB098A0C679A6507C62F4DAD",
        "Unique identifier of the threat",
        "3221232495",
        "newsgroupsProgram",
        "{42695762-ea50-497a-9068-5cbbb35e0b95}",
        "RString",
        "The RTSFlowControlType property specifies the  request-to-send (RTS) flow control. RTS is used to signal that data is available for transmission. Uses of this member include:",
        "AddSharedSecret",
        "MSFT_OdbcDriverTask",
        "SameElement",
        " Example: microsoft.com",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|Hostname",
        "Is Filter Allowed",
        "{981f2d79-b1f3-11d0-8dd7-00c04fc3358c}",
        "Opportunistically match full auth set per key module",
        "Specifies the per-job user-mode execution time limit, in 100 nanoseconds. The system adds the current time of the processes associated with the job to this limit. For example, if you set this limit to 1 minute, and the job has a process that has accumulated 5 minutes of user-mode time, the limit actually enforced is 6 minutes.",
        "Not Available",
        "RespBuffer",
        "String representation of the VPN connection profile to be modified or created.",
        "SET_SINGLE_POLICY",
        "OriginalIPAddr",
        "An estimate of the percentage of full charge remaining.",
        " Remove only when the associated component is being removed (msiInstallStateAbsent).",
        "object:TcpConnectionPoolSettings",
        "Continue Pending",
        "CR_9DC0A5652B71803D627A0DEBBA10D1832C8C71C7B53C3FDE13C8544A09726631",
        ".CE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0",
        "An opaque string that uniquely identifies, within the scope of the OwningEntity, the format of the Message.",
        "Resizes the volume. ",
        "CD_A3CFA2EA2CF7EBAE83315F59909BFC6F8978ACBDBD24E7ACA6B979B7B86A9975.2033.3840105443.197",
        "The local endpoint for the channel.",
        "_DH_WMP_SYNC_PERF Flag",
        "CD_1B1F12E77F513A1F34170D72EBDFB89B7AA666D5ABEE6CC04756D419F4107E74.2378.3246330840.786",
        "DaylightDayOfWeek",
        "PortSupportedClassofService",
        "{8c048bea-2913-4458-b68e-17f6c1e5c60e}",
        "CD_EC87315EA07FEB82B95B6ECC853900B53DFD9FAE520CF4C1FE8CD7F52B679C09.78.1.8441",
        "MDM_Policy_Config01_DeviceGuard02",
        "This class manages file integrity.",
        "Win32Registry|System\\CurrentControlSet\\Services\\Class\\Info|DACType",
        "{280AE270-DB34-11d2-85FC-0000F8102E5F}",
        "Enclosure Door Open",
        "Auto-Select",
        "n-bit",
        "SOCKMAN",
        " Note that the CIM_ComputerSystem Name calculated using the heuristic is the system's key value. Other names can be assigned and used for the CIM_ComputerSystem that better suit the business, using Aliases.",
        "ProviderOperation_CreateRefreshableEnum",
        "Defines the checksum offload encapsulation settings for the Adapter for IPv6 receive packets.",
        "Win32Registry|RevisionLevel",
        "CombinedWrite",
        "Description of the storage tier",
        "FilterID",
        "MSFT_CliAlias.FriendlyName=\"PageFile\"",
        "DSCP (RFC 2474) marking for inbound default-block exempted traffic. Value must be <= 63.",
        "I_02E3B029E91BD2F58BF6CF927BE5C0627DB8324470F3AE50EE9B8F6058666DE9.2704.2346721390.289",
        "8*m;8*m;",
        "InterpretationOfTrue is a string indicating what a 'True' value from the Binary sensor means.  This information could be displayed to a user.",
        "QUERY_SECURITY",
        "FLOODMAN",
        "Win32_OfflineFilesBackgroundSync",
        "Coulombs",
        "ref:MSFT_NetTCPSetting",
        "Designates one or more VLAN Ids to filter on.  Network traffic is logged when the filter matches. ",
        "Keyboard Port Information",
        "TcpConnectionOffloadCapacity",
        "AllowCortanaInAAD",
        "(SMART data autosave after event capability bit) - This bit is set to one for devices complying with this standard.",
        "LUAInstall: error 0x00000005 setting flags [{72d3edc2-a4c4-11d0-8533-00c04fd8d503}]",
        "WPD_TRACE_LEVEL_INFORMATION",
        "StatusInfo is a string indicating whether the logical device is in an enabled (value = 3), disabled (value = 4) or some other (1) or unknown (2) state. If this property does not apply to the logical device, the value, 5 (\"Not Applicable\"), should be used.",
        "The Metric4 property contains an alternate routing metric for this route. The semantics of this metric are determined by the routing protocol specified in the route's ipRouteProto value. If this metric is not used, its value should be set to -1.",
        "FX_TRACE_DRIVER Flag",
        "n0454DDDA9AB999B5E05A2F468BA888F0D0794E6BA1EBDCCF2A4463EC03258CC6",
        "object:Win32_SecurityDescriptor",
        "ROOT\\Microsoft\\Windows\\SmbWitness",
        "The SetDateTime method sets the current system time on the computer.  On computer systems running Windows NT/2000, the calling process must have the SE_SYSTEMTIME_NAME privilege.",
        "The Win32_SystemBootConfiguration class represents an association between a computer system and its boot configuration.",
        "CIM_RegisteredProfile.AdvertiseTypes",
        "CD_1FF99FD98547CA076FAA0DD1F2AF44F1BFF4454EC9483F61CC85AF85FC12393D.2613.3902641381.364",
        "C:\\Windows\\System32\\drivers\\mssmbios.sys[MofResource]",
        "R_259C5FBCDDA2F46A05D031FE1474E0BE7FAD9CC9F46018D9F05C6852D39E0093",
        "Specifies the order in which the virtual disks should be exposed to the initiator. This capability is only available if the storage subsystem's MaskingClientSelectableDeviceNumbers property is set to TRUE. If specified, this parameter must have a 1:1 mapping with the VirtualDiskNames parameter.",
        "IgnoreDetachedVirtualDisks",
        "BlockFailed",
        "NdisFddiStateNext",
        "The name of a Win32_Property whose value is assumed to resolve to the full path to the folder of the file to be removed. The property can be the name of a directory iproperty for a Win32_DirectorySpecification or any other property that represents a full path.",
        "Status information for a printer, beyond that specified in the logical device Availability property. ",
        "Windows Notification Facility Subscribe Unsubscribe",
        "Full Repair Needed",
        "BuildInfo",
        "Driver Major Function Return",
        "R_32F111A45E7594771F4B831EC4C51F536473C63323692A7F6C33516AB1164EDA",
        "Win32_PhysicalMemory",
        "MCA_ERROR_MEM_1_2_5_4",
        "This method disables real-time diagnostic tracing for the Storage SubSystem.",
        "FirewallOffInProfile",
        "Expands System Defined Environment Variables",
        "NaturalLanguagesSupported",
        "Privilege missing",
        "AllowOfflineMapsDownloadOverMeteredConnection",
        "OutputObject",
        "AllowRedirect",
        "DOMaxBackgroundDownloadBandwidth",
        "enterpriseclient",
        "READCACHE Flag",
        "A part of the object's key value, IRQ Number.",
        "Bid2Etw_ADOMD_1_Trace_TextW",
        "Encryption with RSA",
        "AllowIMENetworkAccess",
        "RS422 Port",
        "Is Slow Link",
        "LIPCount",
        "programSettings",
        "49A8A7DAC3FB0D74027E586B2E97BEF112C2070090FD\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "The world wide port name of the virtual port to create",
        "The number of outgoing packets that were discarded because of errors.",
        "R_5FB7EBFF7E65F2B5A8D86A305D94319B3C99F6846C3536F671E3F448D940CE69",
        "ASCII string format",
        "SerializationFormat",
        "NS_E1DD43413ED9FD9C458D2051F082D1D739399B29035B455F09073926E5ED9870\\KI_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C\\I_5C128A75C27B4985F58BF9F60D25F3AD1811C55F8449A91D8301FA08651ED431a\\1057E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "InUseCount",
        "The Open Group",
        "Values: TRUE or FALSE. A value of TRUE indicates the title wraps to the next line.",
        "AES-192",
        "2 = the application language was English, ",
        "If True, MSI interrupts are supported.",
        "The association between a shadow copy provider and a volume supported for differential storage area.",
        "IL_4BD704EFD82E90D58D3C406978C7C044F013A64518E8C54785195D2358D9CFAE.1806.3545598754.276",
        "DOT11_PEER",
        "1000BaseT",
        "EnableStatefulPptp",
        "AccessState",
        "ReadTotalCorrectedErrors",
        "select * from WSP_StorageFaultEvent",
        "ConfigureTelemetryForMicrosoft365Analytics",
        "No extended status object was found for the storage job.",
        "The DNSServerSearchOrder property indicates an ordered list of server IP addresses to be used in querying for DNS Servers.",
        "AuthType",
        "Management",
        "2147549445 - RPC Server Fault Error. ",
        "CIM_Battery",
        "ProtocolCode",
        "MDM_Policy_Config01_Audit02",
        "OsSkuIsValidForAppraiser",
        "Used by Third Party VPN plugins to specify custom configuration.",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2167.2887667098.188",
        "Unique identifier for an application",
        "NxEnabled",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Class|InfSection",
        "String array of available color depths. The string valuescan be derived from the Values qualifier ref: Section 7.3",
        "Supported LDAP management policies.",
        "Msft_WmiProvider_InitializationOperationEvent",
        "RemoteEndpoint",
        "Redirected Target IP Address",
        "IPv4TcpSyn",
        "{FA30C290-68DB-430a-AF76-91A2E1C49154}",
        "When IKEAction.ExchangeMode is set to \"Aggressive\" (4), this property specifies the key exchange groupID to use in the first packets of the phase 1 negotiation. This property is ignored unless the ExchangeMode is \\'aggressive\\'. If the GroupID number is from the vendor- specific range (32768-65535), the VendorID qualifies the group number. Well-known group identifiers from RFC2412, Appendix E, are: Group 1=\\'768 bit prime\\', Group 2=\\'1024 bit prime\\', Group 3=\\'Elliptic Curve Group with 155 bit field element\\', Group 4=\\'Large Elliptic Curve Group with 185 bit field element\\', and Group 5=\\'1536 bit prime\\'.",
        "ClampMss",
        "LocalCache",
        "MDM_Policy_Result01_Privacy02",
        "Infrared",
        "guration management.",
        "DEVICE_UI_FIRMWARE_REVISION_GUID",
        "Number of downstream Ports on the Hub, including those embedded in the Hub's silicon. Individual USBPorts are associated with the Hub using the USBPortOnHub association.",
        "MSFT_NetEventNetworkAdapter",
        "tsopt",
        "PreferredMaxProtocolVersion",
        "AsicVersion",
        "I_0F1BBB21A228CE82C5C2058AE50D21F55892BDF5343CF705176C26EA1F33161F.2720.3445580149.277",
        "A component is typically contained by a physical package, such as a chassis or card. The CIM_PackagedComponent association makes this relationship explicit. In the first sentence, the word, 'typically', is used. This is because a component may be removed from, or not yet inserted into, its containing package (i.e., the Removable boolean property is TRUE). Therefore, a component may not always be associated with a container.",
        "C_C80F6E9FDDA5B4FCB7E91E04A37B343ACE2C1B4C4C7D997B61E1037420FC6413",
        "PolicyVersionSupported",
        "CIM_Docked",
        "FileSizeOnCapacityTierClass",
        "Source group must have more than one element",
        "MaxYResolution",
        "OperationalDetails",
        "ISCSI_TCP_PROTOCOL_TYPE",
        "iScsiFlagPower",
        "Registry Hive Initialize",
        "object:MSFT_SmbServerConfiguration",
        "The Win32_ClassicCOMClass class represents the properties of a COM component.",
        "The LastLogoff property specifies the date and time the user last logged off the system. This value is calculated from the number of seconds elapsed since 00:00:00, January 1, 1970.  A value of zero means that the last logoff time is unknown. The format of this value is yyyymmddhhmmss.mmmmmm sutc.",
        "Docking",
        "The chassis which is mounted in the rack.",
        "Indicates whether the firmware slot can be used to download new firmware image to",
        "Best guess=1",
        "The TCP_CONNECTION_OFFLOAD_STATE of the TCP connection.",
        "InitialR2t",
        "NetClient",
        "Pred Fail",
        "WINSTATION_MSG=0x80",
        "IPV6 Scope Id",
        "NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares",
        "Change",
        "R_F2BF551D2C47E413C4BD58FCB0E48E0B3211C53383EC4051E655BB8319ADD47D",
        "{1008CCEE-7BFF-11D2-AAD2-006008C78BC7}",
        "PolicySourceClipboardMapping indicates whether the property ClipboardMapping is configured by Server (0),Group Policy (1), Default (2).",
        "The Information about the Adapter.",
        "ThisPeriodTotalUserTime",
        "CD_2703A8E21C310CB49F8D78606E1171ECCEEAFC54D7874D34C41113E240A97A5D.1191.1886593908.621",
        "Maximum bytes of user data in a single packet supported by the Adapter for IPv6 packets.",
        "Transfer Size in Bytes",
        "The Description property provides a textual description of the object.",
        "CIM_MediaAccessDevice represents the ability to access one or more media and use this media to store and retrieve data.",
        "MSFT_CliAlias.FriendlyName=\"PrintJob\"",
        "Win32_SerialPortSetting",
        "The network interface port on which this binding will process peer channel messages.",
        "Not enough physical disks were specified to successfully complete the operation.",
        "IsolationId",
        "UseMultimon",
        "TcpIPv4HashEnabled",
        "One or more slot numbers provided are not valid.",
        "R_556C6D300BDEA99DE8588E2B5D8DB1D5A33F34F7DA1F6E6A0DA0951B22252081",
        "The DriverEnabled property indicates whether this load order group can include drivers along with system services.",
        "Select * from WIN32_PROCESSOR",
        "Win32_Patch",
        "MSFT_NetDependOnLaterService",
        "SmbWitness",
        "object:Win32_OfflineFilesPinInfo",
        "The proxy server type to be used when connecting to Internet.",
        "EnabledState is an integer enumeration that indicates the enabled and disabled states of an element. It can also indicate the transitions between these requested states. For example, shutting down (value=4) and starting (value=10) are transient states between enabled and disabled. The following text briefly summarizes the various enabled and disabled states: ",
        "61002",
        "SamDeleteAlias_End",
        "RemainingWindowsReArmCount",
        "ApplyConfiguration",
        "CD_931EBC392DC240CC5527C3CA3643FE44E050E39FDDD4B5A76F950F248E19E470.1052.1102508798.6076",
        "DisableCatchupFullScan",
        "IsSrkAuthCompatible",
        "{4DA18760-E3D0-11d2-8601-0000F8102E5F}",
        "Win32Registry|System\\CurrentControlSet\\Services\\Class|InfSection",
        "\\\\.\\Root\\Default:__Win32Provider.Name=\"RegPropProv\"",
        "The time that the Job was actually started. This time can be represented by an actual date and time, or by an interval relative to the time that this property is requested. Note that this property is also present in the JobProcessingStatistics class. This class is necessary to capture the processing information for recurring Jobs, because only the \\'last\\' run time can be stored in this single-valued property.",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|BlindOn",
        "4 - 'Collision': There was a signature or identifier collision with another disk. ",
        "SyncPolicyDelta",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.2042.2428660879.3240",
        "Flag indicating whether the template is a suite parent.",
        "OpticalWrite",
        "Sync enablement flag",
        "Name of the Terminal Server whose properties are of interest.",
        " not complete the operation because its health or operational status does not permit it.",
        "If set to 3, caching for all the registered remote subsystem is enabled. If set to 2, caching for all the registered remote subsystem is disabled. This API only effects the remote subsystem registered and local Subsystem requests are not cached and reported live always.",
        "Raw SMBIOS Tables",
        "C_30756419C75AD9071C6B26EFDC29E973F64157E9E9415823E0E0D4E3B981BC76",
        "This field specifies the type of the identifier used for initiator address.",
        "Manual Feed",
        "SERIAL_WMI_INTTYPE_LATCHED",
        "CD_8519F629D57644187514674C7FCF7F8B0B70EEA799638913C1E17DC7E507CB73.2228.2036279718.1805",
        "The GroupOrder property indicates the sequence in which this group of services will be loaded onto the operating system.",
        "This class represents per-interface IP-HTTPs Configuration settings.",
        "The EnableIPFilterSec method is used to enable IP security globally across all IP-bound network adapters. With security enabled, the operational security characteristics for any single network adapter can be controlled using the network adapter specific EnableIPSec method. The method returns an integer value that can be interpretted as follows: ",
        "stem.",
        "NumberOfButtons",
        "MSFT_NetSevereServiceFailed",
        "Service Accepts Pause",
        "UploadUserActivities",
        "local-system",
        "Determines the current allocation behavior for this storage tier. Fault domain aware storage tiers will intelligently pick the physical disks to use for their redundancy to balance the fault tolerance between two (or more) fault domain units of the specified type.",
        "SM_RemoveLink",
        "CIM_BootService represents the functionality provided by a device, software or via a network to load an operating system on a unitary computer system.",
        "CIM_HostedService",
        "The number of bytes of received packet data, excluding the header, that will be indicated to the protocol driver.",
        "ASIC Version",
        "EnableAutoProvisioning",
        "ReplicationGroup",
        "DeleteProfilesOlderDays",
        "CurrentSize",
        "Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwTagId",
        "Data Buffer Pointer",
        "Small Animated Bitmap Name",
        "{82da10e5-6500-4311-a686-2d55b58bcc24}",
        "ConfigureHomeGroupProviderServiceStartupMode",
        "PrivilegesRequired",
        "Resume from Suspend",
        "Maximum transfer rate (in Bits per Second) supported by the SCSIController.",
        "This represents a Partial Configuration class.",
        "Specifies the image quality for RDP experience.",
        "Constraints: Must have a value. ",
        "There are not enough resources to complete the operation.",
        "C_475DC738959A6644A439D03D5CB8431B3F6A7C1B747C351A2E92646ECC0B1213",
        "The Element reference represents the computer system keeping track of the system time zone.",
        "For a rule-specific PolicyAction, the CreationClassName of the PolicyRule object with which this Action is associated. For a reusable PolicyAction, a special value, \\'NO RULE\\', should be used to indicate that this Action is reusable and not associated with a single PolicyRule.",
        "Time in kernel mode, in milliseconds. If this information is not available, a value of 0 should be used.",
        "AccountType",
        "C_61BD99E07DD9B896C168C32D63CDE78875D8845FB21EAF979A76CC25C89D073F",
        "Invalid host name",
        "A logical network adapters",
        "Unable to capture a live dump of the storage subsystem.",
        "The Win32_ComClassEmulator class represents an association between two versions of a COM class.",
        "0x8005006D",
        "SetData",
        "AllowPinnedFolderMusic",
        "MSNdis_TcpOffloadCurrentConfig",
        "ProcessCount",
        "RsnRekeyOffload",
        "The virtual disk could not complete the operation because its health or operational status does not permit it.",
        "AddByExeSet",
        "MDM_Policy_Result01_Kerberos02",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|Attributes",
        "{3f2c141b-83bc-11dd-94b8-001d09162bc3}",
        "The unit multiplier for the values returned by this Sensor. All the values returned by this Sensor are represented in the units obtained by (BaseUnits * 10 raised to the power of the UnitModifier). For example, if BaseUnits is Volts and the Unit Modifier is -6, then the units of the values returned are MicroVolts. However, if the RateUnits property is set to a value other than \"None\", then the units are further qualified as rate units. In the above example, if RateUnits is set to \"Per Second\", then the values returned by the Sensor are in MicroVolts/Second. The units apply to all numeric properties of the Sensor, unless explicitly overridden by the Units qualifier.",
        "FeatureUpdateStatus",
        "RELEASE_FOR_CC_FLUSH",
        "SamRemoveMemFromAlias_Start",
        "TRACE_PERFORMANCE",
        "XResolution",
        "MaxReadRequestSize",
        "lMemory.",
        "PCI_BUS_ID_BusNumber",
        "LUAInstall: error 0x00000005 setting flags [{94AB5C27-C954-4218-B0A1-29640412EFBE}]",
        "List of addresses that DNS64 should not translate",
        "The Metric1 property contains the primary routing metric for this persisted route. The semantics of this metric are determined by the routing protocol specified in the route's ipRouteProto value. If this metric is not used, its value should be set to -1.",
        "Local Time",
        "tm_mon",
        "Win32_TSVirtualIP",
        "EVENT_TRACE_FLAG_PROCESS_COUNTERS",
        "__Trustee",
        "C_8D357DFC4C878A0DE5A366543020A4BEF98C2B085CAA548AF24CF3ADFF66C0FF",
        "ConfigField",
        "The ClassName property is a string containing the name of the class for which instances are desired.",
        "0xEFFF0014",
        "NdisFddiStateConnect",
        "UseSynchronizationContext",
        "DatabaseMaxSize",
        "object:WmiMonitorSupportedDisplayFeatures",
        "The IconSpacing property specifies the spacing between icons.",
        "{327ABD78-E3D3-11d2-8601-0000F8102E5F}",
        "DirProperty",
        "Minimum number of segments that a large UDP packet must be divisible by before offloading to Adapter for segmentation for IPv4 packets.",
        "Transparency Printing",
        "object:DtcTransactionsTraceSession",
        "Masking set: The masking set, along with any associated target ports, initiator ids, and virtual disks will be discovered. ",
        "{A2EFC898-E3D3-11d2-8601-0000F8102E5F}",
        "falsecase",
        "This property indicates the partition's GPT type. This property is only valid when the disk's PartitionStyle property is set to 2 - 'GPT' and will be NULL for all other partition styles.",
        "DELNOTIFY Flag",
        "Indicates if the Adapter supports TCP checksum computation offload for transmit IPv6 packets.",
        "Describes the policy for the files that the automatic data integrity scanner will scrub. ",
        "Partial SCM",
        "Win32_ControllerHasHub",
        "{BF253431-1E4D-4F57-00E7-64B2CACC801E}",
        "uint8",
        "Win32_TerminalService",
        "The Manufacturer property is the Manufacturer of the driver e.g. Microsoft",
        "SamOpenDomain_End",
        "1 GBit/sec",
        "A storage tier.",
        "MSFT_NetAdapterUsoEncapsulationTypes",
        "System Name",
        "Represents the Route class in TCPIP WMIv2 provider.",
        "The Query property is a string containing the text of the query.",
        "DEVICE_UI_FIRMWARE_REVISION",
        "(power mode SMART data saving capability bit) - If this bit is set to one, the device saves SMART data prior to going into a power saving mode (Idle, Standby, or Sleep) or immediately upon return to Active or Idle mode from a Standby mode. If this bit is cleared to zero, the device does not save SMART data prior to going into a power saving mode (Idle, Standby, or Sleep) or immediately upon return to Active or Idle mode from a Standby mode.",
        "Describes all of the job sheets that are available on the Printer. This can also be used to describe the banner that a Printer might provide at the beginning of each Job, or can describe other user specified options.",
        "DNSDomainSuffixSearchOrder",
        "IncreaseSchedulingPriority",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSGENERALSETTING_Prov\"",
        "R_5953574AD268C37F4681AD557CF3BEA3442C419F9086A8F65CC3774027E8952E",
        "Localized version of RSOP_PolmkrLocalUsersAndGroupsSetting for American English",
        "Specify the time of day to run a scheduled quick scan.",
        "SystemConfig_V4_PnP",
        "The AddPrinterConnection method provides a connection to an existing printer on the network and adds it to the list of available printers on the computer system. If successful, applications will be able to use this printer for print jobs.  If unsuccessful the printer is not installed. The method can return the following values:",
        "The auth/crypto sets.",
        "{676347f3-fd20-4e7d-90b1-77e35f84af9a}",
        "Dynamic Least Queue Depth",
        "Win32API|Service Structures|SERVICE_STATUS|dwServiceSpecificExitCode",
        "Indicates that the sensor is linear over its dynamic range.",
        "Associates a firewall rule with a profile that it is in.",
        "MachineConfiguredWindows8App",
        "AutomaticClusteringEnabled",
        "Security Audit Failure",
        "Maximum number of protection domains supported by the adapter",
        "WPD_F2",
        "URL of the server used by report manager.",
        "WPD_F1",
        "R_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170",
        "MaxCmds",
        "CD_AA41A8343BA1D329E4982E46F903D80197DFB87E55CE7405A84B7AC638E427A0.1946.1.24524",
        "DeviceModelId",
        "LetAppsAccessCellularData",
        "ReceivedBroadcastPackets",
        "MS\\0x409",
        "\"Supporting Entity in Error\" describes that this element may be \"OK\" but that another element, on which it is dependent, is in error. An example is a network service or endpoint that cannot function due to lower layer networking problems. ",
        "MSNdis_NotifyFilterArrival",
        "The name of the System object in whose scope this PolicyAction is defined. ",
        "The RunRepeatedly parameter indicates whether the scheduled job should run repeatedly on the days that the job is scheduled.",
        "Maximum number of in-progress incoming read operations per QP",
        "{7880DD16-DB36-11d2-85FC-0000F8102E5F}",
        "BKA_^",
        "If TRUE, this subsystem supports the deletion of storage tiers.",
        "Enumeration of Receive Filters on a queue",
        "The maximum allowed array length.",
        "CreateStorageTier",
        "Processor address width in bits.",
        "SamDeleteUser_End",
        "SAS Expander",
        "Time Reading",
        "This method allows a user to set the power of enclosure elements to either Off or On",
        "Order of the button in a list.",
        "NS_A795D8845709332607DFFBB7F002DE04E0997E409BE31D5BA9FF05A1F3FC9068\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_66E6CB76E1CBB5C5C14CAA8D90DA0CEC84C6EFA9E1FDA743B2C669976130E260",
        "Mini-Centronics Type-14",
        "Indicates that case sensitive file names are supported.",
        "SpecialCharacters",
        "TransferSize",
        "AddInitiatorId",
        "The list of Virtual Port IDs attached to this Virtual Function.",
        "C4-Envelope",
        "{900ABE69-C4FC-11DA-82C4-000D5692A4BC}",
        "the event log name that can report an event when this CSE is applying policy",
        "MIF.DMTF|Storage Devices|001.12",
        "object:WmiMonitorColorXYZinCIE",
        "Number of bytes for dot11 connection completion status indication",
        "SMBIOS|Type 17|Maximum voltage",
        "IMAPI2_DebugGeneral Flag",
        "The StartFileName input parameter is a string that names the child file/directory to use as a starting point for CompressEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from the previous method call. If this parameter is NULL, the operation is performed on the file ordirectory specified in the ExecMethod call.",
        "This enables remove lock traces",
        "Default action for moderate severity threats.",
        "Smb Share Access Control Entry",
        "MSFT_TargetPortToTargetPortal",
        "MSFT_DtcTransactionTask",
        "December",
        "SS7 Signaling Link",
        "Whether the cert criteria (CertName, EKUs, Thumbprint) should be used when choosing which certificates to offer.",
        "48005",
        "TotalSessions",
        "EventTraceEvent",
        "MDM_RemoteFind_Location01",
        "MIF.DMTF|System Cache|003.15",
        "Proprietary Wireless Downstream",
        "Exists",
        "CharacteristicDescriptions",
        "Binding Cache Flag",
        "Name of the storage health setting to be removed.",
        "Example: WD-WM3493798728 for a disk serial number.",
        "NETIO_TRACE_INTERFACE",
        "The YSize property specifies the height, in pixels, of the window if a new window is created. For GUI processes, this is used only the first time the new process calls CreateWindow to create an overlapped window if the nWidth parameter of CreateWindow is CW_USEDEFAULT.  Note, XSize and YSize cannot be specified independently.",
        "ipconfig /FlushDns",
        " 64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41",
        "TransferMode",
        "incoming ptc.g",
        "Indicates what day of the week to perform the scheduled full scan to complete remediation.",
        "DefaultHopLimit",
        "mdlread",
        "C_6AD386ADF7788A35467E769D3EC3DE89211503B8A449E2B53EAB5B8CCD719DFD",
        "PORT_WWN",
        "InvProv",
        "This class supplies the PnPDeviceId for a specific device",
        "The RevisionNumber property indicates the revision number of the motherboard.",
        "ActivityQualifiers",
        "R_681F04C717B34C7842AFE82074DEC59FCDB97C166864F9245FF3327284F1AF2E",
        "If Usage is set to 1 - 'Other', this parameter takes in the string representation of a vendor defined usage for this storage pool. This parameter must not be set if Usage is a value other than 1 - 'Other'.",
        "86 - Frame/network number bounds error",
        "Share Process",
        "MSFT_LocalizableMethodQualifier",
        "StartBoundary",
        "Is sync on green supported",
        "Values: TRUE or FALSE. If TRUE, the printer collates all documents.",
        "R_0ED1C3985408CF8B2B34893CFA150055B29DB00EC2B161251E2022B947EB8ECF",
        "QPInvalidate performance counter missing",
        " Either the name of the file or the name of the file with a  directory prefix.  ",
        "TEST_TRACE_FUNCTION",
        "Hypercall Callcode",
        "Indicates the current status(es) of the element. Various operational statuses are defined. Many of the enumeration's values are self- explanatory. However, a few are not and are described in more detail. ",
        "The DeviceInterface property indicates the type of interface used for the pointing device.",
        "C_52F5ACBDAE24F4A28C0779E6C390795B2874AE035CBE1817D5BCF3119F482468",
        "Framing Error",
        "InternetZoneAllowNETFrameworkReliantComponents",
        "R_3FDA9FF251C6BD5841FB280A37A767A97FBDE0A3950C58F141AF2BCE7A64366D",
        "emailProgram",
        "OutgoingChannels",
        "ConfigureTelemetryOptInSettingsUx",
        "AutoDisposeParameters",
        "ref:CIM_SCSIController",
        "Example: 139",
        "PortName",
        "C_47C79E62C2227EDD0FF29BF44D87F2FAF9FEDF60A18D9F82597602BD95E20BD3",
        "RequirementsDescription",
        "StorageWMI",
        "static",
        "11007",
        "ReturnType",
        "UniqueConnectionId",
        "RunDown",
        "OtherUsageDescription",
        "TEST_TRACE_RESERVED_0c",
        "WakeChargeInstrumentation",
        "AccountExpires",
        "Genuine status for this product.",
        "2311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        "MSFT_SoftError_EmptyCache",
        "o dontCare(3): Do them -- I don\\'t care about the order. ",
        "Contrast",
        "Turn on removal of items from scan history folder. This setting defines the number of days items should be kept in the scan history folder before being permanently removed. The value represents the number of days to keep items in the folder. If set to zero, items will be kept forever and will not be automatically removed.",
        "MSFT_DiskToStorageReliabilityCounter",
        "CopyOnWrite",
        "CD_99526796DD78031C7C2FAD6BF8D8F64825A2F3F58DED87A8E35BA27BB08D1659.2033.1057221546.225",
        "The MaxCapacity property indicates the maximum memory size (in bytes) installable for this particular memory array. If the size is unknown, the property is given a value of 0.",
        "The VirtualSize property specifies the current size in bytes of the virtual address space the process is using.",
        "RS449 Port",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmPaperWidth ",
        "SKU Version and Edition corresponding to the Key in the OA3 BIOS marker.",
        "LogonType",
        "TargetFailureName",
        "DisableHealthUI",
        "RD_TRACE_RESERVED_1c Flag",
        "TaskPath",
        "SATA (Direct Attach)",
        "PPP Multilink Bundle",
        "Product working directory",
        "Auto Detect Configuration Settings",
        "Bus command or operation at the time of the event",
        "ref:CIM_SystemResource",
        "Close_Start",
        "SecondIntegrityAlgorithm",
        "LowBatterySignal",
        "OriginalLastAccessTime",
        "If this is an X86-only application, this property is true if the application may be deployed to an ia64 computer.If FALSE, the application may not be deployed to an ia64 computer.",
        "MSADDS.1 formatted output (A)",
        "PromiscuousMode",
        "The Remove-VpnConnectionTriggerTrustedNetwork removes DNS suffixes from the VPN profile. When any of these DNS suffixes is present on physical interface on the client, VPN connection will not be auto triggered.",
        "Flags for validations that may be supported. Combinations of these may also be supported.",
        "Filter",
        "{5e23b838-5b71-47e6-b123-6fe02ef573ef}",
        "The path to the driver's INF file.",
        "Context Blocks Queued/sec",
        "{2bb2b772-ffed-4aa6-b1b3-3d0cb74fc613}",
        "Win32_SoftwareElementCheck",
        "SetupDateTime",
        "Contains an array of data value types (integers). You can use these types to determine which Get method to call. For example, if the data value type is REG_SZ, you would call GetStringValue to retrieve the named value's data value. The elements of this array correspond directly with the elements of sNames. The following data value types are defined in Winnt.h: ",
        "New Tag",
        "This property indicates the partition's offset from the beginning of the disk, measured in bytes.",
        "MaskingValidInitiatorIdTypes",
        "InterfaceResolutionEmpty",
        "Require",
        "object:HBAFCPScsiEntry",
        "Storage Express Server Edition",
        "object:MSNdis_NetworkDirectAdapterCapabilities",
        "{d7673b11-e892-4a9d-8bd8-761ff256edd9}",
        "The CSName property is a string indicating the name of the computer system.",
        "The LastAccessed property is a datetime value indicating the time the file was last accessed.",
        "object:TraceListenerArgument",
        "R_34C7F02584835C9F53DA8B610B74BCACB61B9E0BCE6D8A239F117F5D7E99EE2B",
        "ApertureLength",
        "FSControl",
        "IL_AE9AC2BC8AFB5D056F36CB7B60980C94F15C74C0D55FBB321F636DEA98CD4F09.2458.3479316439.279",
        "UserDPI",
        "{D2D588B5-D081-11d0-99E0-00C04FC2F8EC}",
        "RemoteHostAllowsDelegationOfNonExportableCredentials",
        "Apply Cause",
        "object:MSFT_OdbcKeyValuePair",
        "A scan is already running on this drive. Chkdsk cannot run more than one simultaneous scan on a drive.",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1353.3692867184.368",
        "PCI_COMP_INFO_SegmentNumber",
        "Indicates whether a service supports one thread, multiple threads, or reentrant calls.",
        "TR_WQ",
        "DtcClusterTMMapping",
        "FUnjoinOptions",
        "The Username parameter is a pointer to a constant null-terminated character string that specifies the account name to use when connecting to the domain controller. The string must specify either a domain NetBIOS name and user account (for example, \"REDMOND\\user\") or the user principal name (UPN) of the user in the form of an Internet-style login name (for example, \"someone@microsoft.com\"). If this parameter is NULL, the caller's context is used. ",
        "Parallel Device Bytes Transferred",
        "28..32567",
        "SupportsDeduplication",
        "{8502C527-5FBB-11D2-AAC1-006008C78BC7}",
        "ATA/66",
        "CD_88AFB8925BED57D785F853EA39F60A2597B7DD047C4BBEFEFD01EFF42AC83C8A.37.2016315395.365",
        "Win32API|Device Input and Output Structures|DISK_GEOMETRY|BytesPerSector",
        "The MaximumSize property indicates the maximum size of the page file./nExample: 178",
        "Socks Proxy Server",
        "Quarter",
        "A Job is a LogicalElement that represents an executing unit of work, such as a script or a print job. A Job is distinct from a Process in that a Job can be scheduled or queued, and its execution is not limited to a single system.",
        "9 - x64 ",
        "S-1-5-15",
        "Win32API|Communication Structures|COMMPROP|dwSettableParams|SP_DATABITS",
        "Indicates what time to perform the scheduled full scan to complete remediation.",
        "PagesPrinted",
        "ACPI _CST",
        "The Win32_AssociatedProcessorMemory class represents an association between a processor and its cache memory.",
        "The SetDefaultTOS method is used to set the default Type of Service (TOS) value in the header of outgoing IP packets. The method returns 0 on success, and any other number to indicate an error.",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_81E1B447115AA495169E968D729B808E6AFAAA8904F1D6ECCF6F17BC5CB9988CpoinE083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "First thermal constant",
        "NDIS Protocol Bind Notification",
        "NDISWMI_TRACE_GENERAL Flag",
        "C_979D1EA059854DCEDF2345318722F29EF1D55F537C02E38427A8558140AFFFB1",
        "The FreeSpace property indicates in bytes how much free space is available on the logical disk.",
        "SpecialPurpose",
        "Whether to use a stateful protocol (i.e., DHCP) to obtain configuration information other than addresses. Setting this parameter will have no effect on an interface that has router discovery enabled & advertising disabled.  In that case the parameter is controlled by router discovery.",
        "Specifies a bitmask indicating which services are implemented by this provider. The SP_SERIALCOMM value is always specified for communications providers, including modem providers.",
        "The Dependent property references a mapped logical disk defined within the session referenced by the Antecedent property.",
        "Sets or Updates the Registration Token with the administrator supplied value",
        "FullScanAndRebootAndManualStepsRequired",
        "Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwServiceType",
        "A unique identifier for the source object.",
        "PowerFailSignal",
        "Win32_PrinterController",
        "PolicyName",
        "Error code",
        "HKEY_LOCAL_MACHINE (0x80000002) ",
        "A physical package is replaceable  if it is possible to replace (FRU or upgrade) the element with a physically different one. ",
        "BiosVersion",
        "ref:CIM_FilterEntryBase",
        "The Win32Shutdown method provides the full set of shutdown options supported by Win32 operating systems.",
        "Object Handle Events",
        "Default Block Size",
        "The parent product in the association.",
        "{C66015EE-014B-498A-9451-99FEAD0AB451}",
        "The StringParameter property, for create operations, string containing the path of the instance created during the call.The provider can pass the StringParameter to IWbemObjectSink :: SetStatus indicating the key of the instance just created.",
        "MDM_Policy_Result01_WindowsLogon02",
        "Enables or disables UserAuthenticationRequired. The function takes one parameter - the flag that enables or disables it. The call returns zero on success and an error on failure.",
        "ADActivationObjectDN",
        "CIM_AdjacentSlots",
        "InitialLoadInfo",
        "MaxRandomTime",
        "{cc85922f-db41-11d2-9244-006008269001}",
        "DrvComplReq",
        "I_A41A2A506F07DE19FA26EBBA5A53B62D2C62BAF775EC8BEA2B152B5D21A711E3.1489.1494767708.202",
        "3 - 'Parallel': repair will process as many allocation slabs as it can in parallel. This will result in the shortest repair time, but will have significant impact on I/O load.",
        "The management characterisitics of a USB Device. These ",
        "TypeID",
        "C_D8FA39278C1247AB8B1FBB10D8F82DA6DF57FDCA81312F4541EF472290E1F3B0",
        "additionalSenseLength",
        "The Phase 2 Authentication Set used by the rule.",
        "Aggregation",
        "PCI Express treated as PCI",
        "FDWNetCtlGuid",
        "{8502C53E-5FBB-11D2-AAC1-006008C78BC7}",
        "{6DA4DDCA-0901-4BAE-9AD4-7E6030BAB531}",
        "SamGetUserDomPwdInfo",
        "CIM_Process.CSName",
        "PLATFORM_ERROR_OEM_DATA_STRUCT is valid",
        "A free-form string describing the pin configuration and signal usage of a physical connector.",
        "ScreenWidth",
        "The number of active VLAN IDs on the non-default VPorts",
        "The DriverName property specifies the name of the printer driver.",
        "CD_FD01511EE67712BF18E22D5987177172AC0FC136DA3801B80EDFACBDC4A53CCF.93.4070397171.1404",
        "MSFT_NetIKEQMCryptoProposal",
        "MSSmBios_SysidUUID",
        "Controller's vertical resolution in pixels.",
        "Parameters necessary to respond to a DH-CHAP challenge.",
        "DoPacketLogging",
        "MakeAvailableOfflineButtonRemoved",
        "FlightIdList",
        "MDM_EnterpriseModernAppManagement_EffectiveRelease05",
        "Hard Disk",
        "DelayedAckFrequency",
        "Scan all downloaded files and attachments",
        "MonthlyCacheHostBytes",
        "Maximum amount of memory supported in bytes.",
        "**typedef** Indicates the current state of this connection",
        "MSFT_NetIPInterfaceRoute",
        "CD_49FB736F05F6E9A78F87E84FC5279EF60B08777EF5A714391B9E97553F332914.276.1439197231.173",
        "NDIS FDDI Upstream Node Long",
        "{FAF76B81-798C-11D2-AAD1-006008C78BC7}",
        "ac6d1350600005Q",
        "Target LUN",
        "The Name property indicates the name of the load order group.",
        "Win32API|Device Context Functions|GetDeviceCaps|NUMCOLORS",
        "C_25245316A9D3FA38DB37C9B83D3D9B2E2A5C8AB3690AC27BD6B5746485DD433D",
        "SystemVersion",
        "ref:Win32_LoadOrderGroup",
        "Black and White Printing",
        "NonExistingService",
        "{0 = none, 1 = ACPI 1.0, 3 = ACPI 3.0}",
        "select * from __InstanceModificationEvent where TargetInstance isa \"Win32_LocalTime\"",
        "CD_BEB09ED4AE60EA02D0906C72210DE0A889B4969BA537FC2684A64B66607CC566.1500.2463720529.344",
        "DestinationPort",
        "Example: Atdisk.",
        "43023",
        "The path to the trusted publisher store used to validate the signature of the mof document or modules.",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmLogPixels",
        "KioskModeUserTileDisplayText",
        "Configures BranchCache to operate in hosted cache client mode. ",
        "64 - Method not supported on this platform",
        "NTFS4",
        "ref:Win32_ShadowCopy",
        "AllowProjectionToPCOverInfrastructure",
        "Whether to group UDP packets into conversations based only upon the local address and port.  Applies only to UDP.",
        "See CIM_NumericSensor.LowerThresholdNonCritical for details.",
        "This method will preform an administrative install of an associated Win32_Product using the installation package provided through PackageLocation and any command line options that are supplied. The method can return the following values:",
        "MIF.DMTF|Physical Container Global Table|002.1",
        "Initiator Node Name",
        "Audit Failure",
        "Error Category.",
        "SMBIOS|Type 4|Thread Count",
        "IoavProtectionEnabled",
        "Win32_SoftwareFeatureParent",
        "A Boolean value that indicates whether copies of messages processed by this binding should be stored in the source journal queue.",
        "GetProcessInfoByTemplateId",
        "NDIS Dot11 PMKID Candidate List Status Indication",
        "AES_256_WITH_DIFFUSER",
        "9 - 'Snap-And-Clone': The service creates a snapshot of the source element first, then uses the snapshot as the source of the copy operation to the target element.",
        "DOT11_CLASS_COINSTALLER",
        "FileCreate",
        "Mouse Port",
        "C_27A364644C1B83931E072B22EAC45B45C2531EB36360F82204598576E1DF4301",
        "Name, a.k.a. Connection Name, ifAlias, or InterfaceAlias, is a unique name assigned to the adapter during installation. The Name of the adapter can be changed by the administrator and is persisted across the boot or network adapter restart.",
        "If TargetStoragePools supplied, TargetStoragePool shall be NULL.",
        "WMI_Tracing",
        "Win32Registry|HARDWARE\\Description\\System\\DisplayController\\0\\Identifier",
        "76 - Invalid file",
        "MajorErrorCount",
        "Active network connection management.",
        "PreventEnablingLockScreenCamera",
        "This method resizes the partition and any associated filesystem to the size specified by the Size parameter. If the size is outside of the bounds returned by the GetSupportedSize method, then this method will fail with a well defined error code. The resize operation is only supported on NTFS formatted partitions and RAW partitions.",
        "Remote Port",
        "The GroupComponent reference represents a DCOM application containing or using the COM component.",
        "Flash memory",
        "Win32API|Windows Networking Functions|WNetGetConnection",
        "BLOCK",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1196.579707988.368",
        "CIM_PExtentRedundancyComponent",
        "Count of Logout command PDUs with status code other than 0",
        "MIF.DMTF|Video BIOS Characteristic|001.3",
        "SupportSack",
        "WSP_StorageSubsystemToPartition",
        "CONFIG_API",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_BBA9D96E0F38BFCB6795F87F429E3FCAE741B083CE80ED2ED851A1D82E5F371787858467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251",
        "C_37D6265F83F0B4A807334DDDEAC8A1C96BFA3B726A45400FF628A9564B8A2E7A",
        "C_CCDB0F33BA6966E88C9C16D64D85DE69D152BBDDCA55C4187234D7D768C27675",
        "\\\\.\\root\\StandardCimv2:__Win32Provider.Name=\"NetNcCim\"",
        "The 802.11 transmit power level in mW",
        "WMI|Win32_PhysicalMemory",
        "LogRecord for IPMI",
        "Storage Spaces",
        "TracePower Flag",
        "SyncState",
        "{5ec10355-a61a-11d0-8dd4-00c04fc3358c}",
        "LogFlagDataBytes Flag",
        "highestCommittedUSN",
        "Select * from Win32_PhysicalMemoryArray",
        "The Win32_ServerSession class represents the sessions that have been established with the local computer, by users on some remote computer.",
        "CIM_NextHopRoute",
        "The MPU401Address property indicates the starting I/O address assigned to the MPU-401 port of the sound device.",
        "Data structure checksum",
        "ChapSecret",
        "Application Id",
        "WmiMonitorBrightness",
        "CreatedDate",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services|Tcpip\\Parameters\\Interfaces|TCPAllowedPorts",
        "Pictures folder, GUID is {33E28130-4E1E-4676-835A-98395C3BC3BB}",
        "Indicates the size for the virtual disk. Note that some storage subsystems will round the size up or down to a multiple of its allocation unit size. The size of the resulting volume will be the maximum size possible for the resulting virtual disk.",
        "{1C9D482E-93CE-4b9e-BDEC-23653CE0CE28}",
        "CtlGuidBthMtpEnum",
        "e41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "If IsSystem is TRUE, this disk contains the system partition.",
        "MSFT_NetBranchCacheSecondaryCache",
        "SettingIndexValue",
        "UdpIp Send/Receive",
        "CIM_CoolingDevice",
        "AllowRemoveProvisioningPackage",
        "#define HBA_EVENT_LINK_INCIDENT         0x501",
        "MCA_ERROR_MAS",
        "WindowsAuthentication",
        "One or more physical disks are not in the pool.",
        "UseGateway",
        "Win32_SystemDriver",
        "The PortNumber property indicates the number of the TCP port used by the port monitor to communitcate with the device.",
        "Line Group",
        "ModelName",
        "Third Party Privacy Type Text",
        "The Flags parameter contains a set of flags to shut the computer down.  The setting this parameter to 0 is the command to logoff.",
        "The Support16BitMode property determines whether 16-bit mode is supported on the Win32 serial port",
        "PolicySourceAudioMapping indicates whether the property AudioMapping is configured by Server (0),Group Policy (1), Default (2).",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_F39BE2F2CC7551BDE90E624B5C7301C158A68D618B887A135B21C9CB3CEFD863",
        "CR_1B410CA2C4AD84A438C361AB2935A45E1487677A7411DBBFAE5D52EC6FB1AD7F",
        "Denotes a vendor-specific recovery action to be taken for an unsuccessfully run job. This value should only be set if RecoveryAction is set to 1 - 'Other'.",
        "The DNS servers the DNS query is sent to when DA is disabled",
        "DH-1536 bit prime",
        "The Win32_WMISetting class is a Singleton class that contains the operational parameters for the WMI service. Win32_WMISetting can only have one instance. This single instance always exists for each Win32 system, and cannot be deleted. Additional instances cannot be created.",
        "alwaysViewableSites",
        "HostNameComparisonMode",
        "REMOTE_CONTROL_SOFTWARE",
        "\\\\.\\root\\Microsoft\\Windows\\CI:__Win32Provider.Name=\"CIWmi\"",
        "PartitionCount",
        "R_9436245449B3462827025A176C8658F8B2C7743E35FFF20FBD4F09A2D6A9EADB.2505.3672898925.540",
        "Sub Command",
        "WMI|Win32_Process",
        ". The first two characters specify the type of response. The second two characters specify information about the connection being made. The second two characters are used only for Negotiation Progress or Connect response codes. The next eight characters specify the modem-to-modem line speed negotiated in bits per second (bps). The characters represent a 32-bit integer doubleword format (byte and word reversed). The last eight characters indicate that the modem is changing to a different port or Data Terminal Equipment (DTE) speed. Usually this field is not used because modems make connections at a \"locked\" port speed regardless of the modem-to-modem or Data Communications Equipment (DCE) speed.",
        "FailedTransitions",
        "Extended Subtype",
        "An array of free-form strings providing explanations and details behind the entries in the OtherIdentifyingInfo array. Note, each entry of this array is related to the entry in OtherIdentifyingInfo that is located at the same index.",
        "ExcludeJapaneseIMEExceptShiftJIS",
        "{B3FF88A4-96EC-4cc1-983F-72BE0EBB368B}",
        "Wudfx02000KmdfTraceGuid",
        "SamQueryInfoGrp",
        "R_73447B89194EA500995C2E5AA4E3BE7AE297170CB5846782DDA43B3F2BA77D09",
        "FileSystemFlags",
        "BatteryPctToSeed",
        "Enable - RTS is left on for the data transfer session.",
        "This property corresponds to the OperationalStatus property of the logical computer system represented by CIM_ComputerSystem. See CIM_ManagedSystemElement.OperationalStatus Description for details.",
        "AveragePagesPerMinute",
        "Address Parity Error",
        "A Version number used along with the ILID to allow customers to version their licenses.",
        "Bus Mouse",
        "0x201",
        "{1F2EA300-DB37-11d2-85FC-0000F8102E5F}",
        "@.m;@.m;",
        "BaseUnits",
        "This method is used schedule chkdsk to be run at the next reboot if the dirty bit has been set.  The method is applicable to only those instances of logical disk that represent a physical disk in the machine. It is not applicable to mapped logical drives. ",
        "TR_CRYPTO Flag",
        "NumberOfConnections",
        "klininfo",
        "AdapterNames",
        "Win32_OperatingSystem",
        "PciExpressCurrentLinkWidth",
        "D6D60CF7B02015DD6EAA0272.2642.837909254.263",
        "IsolationType",
        "Range1InputVoltageLow",
        "WnfProvider",
        "WMI_DISK_PERFORMANCE",
        "Created date",
        "      <dsig:Transforms>",
        "Example: %systemRoot%\\MiniDump",
        "DriverVersion",
        "MaxWaitOnClientObjects",
        "Enabled (2) indicates that the element is/could be executing commands, will process any queued commands, and queues new requests. ",
        "D71F4D4CAD1DB441347D3.2664.318208373.283",
        "Network",
        "PollingInstructionsPerUser",
        "AcceptableValues",
        "The SettableFlowControl property determines whether the flow control can be set on the serial port",
        "ActiveHoursEnd",
        "The XOnXMitThreshold property indicates the XOn transmit threshold",
        "RSA Signatures",
        "Resource",
        "ConfirmationId",
        "Target Portal Structure Already Exists.",
        "MSFT_SoftError",
        "CIM_PhysicalElement",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardBias",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|ResponsesKeyName",
        "AlwaysSynthesize",
        "TRACE_WARNING Flag",
        "Win32API|System Information Structures|OSVERSIONINFOEX|szCSDVersion",
        "The OSProductSuite property identifies installed and licensed system product additions to the operating system.",
        "Size of Additional Data",
        "DHCPv6",
        "ScheduleAutoChk",
        "C_DB6D3B84420B8B2E5B0952A4263B4AAE435874E5D752A7B6377F6681799057A9",
        "{F022F413-3BF5-47ec-A942-33B81CF8E7FF}",
        "A RegisteredSpecification is used to advertise the implementation of a specification within a WBEM server. The specification may be authored by the DMTF or another standards organization. In this context, specification is used to describe a named and versioned set of constraints. There may be a one to one correspondence between the set of constraints and the document in which they are published. An example of a one to one correspondence is the mechanism used by the DMTF to publish its profiles. An example of one to many documents to specifications is an SMI-S book published by SNIA.",
        "MSFT_NetAdapter_ChecksumOffload",
        "Retrieves Built-in Diagnostics Tracing (BidTrace) for troubleshooting WDAC components.",
        "TransitionLatency",
        "AspNetCompatibilityRequirementsAttribute",
        "object:MSFT_NetAdapterChecksumOffloadCapabilities",
        "SpinLockSpinThreshold",
        "3      The driver for this device might be corrupted, or your system may be running low on memory or other resources. ",
        "Describes VXLAN Encapsulated Packet Task Offload hardware capabilities of this Adapter",
        "HostAddress",
        "object:MSFT_Net6to4Configuration",
        " A service start when the service control manager calls the StartService function.",
        "LetAppsRunInBackground",
        "RDMAOutFramesPerformanceCounterMissing",
        "Specifies the EtherType for filtering",
        "MSiSCSIInitiator_MethodClass",
        "GetPhysicalExtent",
        "{78ebc102-4cf9-11d2-ba4a-00a0c9062910}",
        "Win32APIDevice Management Messages|WM_SETTINGCHANGE",
        "iOm6^",
        "ValuesMap",
        "The specified partition alignment is not valid. It must be a multiple of the disk's sector size.",
        "CD_6C707473A832E8EC791BEE1730A35E787F78F19C8E76CAC82C47C44288E55A89.1734.1284122541.499",
        "MemoryPressureProtection",
        "Where: ",
        "Number of hard resets issued by the controller. A hard reset returns the device to its initialization or 'boot-up' state. All internal device state information and data are lost.",
        "PCI is supported",
        "MIB.IETF|Printer-MIB.prtMarkerMarkTech",
        "{8502C4B9-5FBB-11D2-AAC1-006008C78BC7}",
        "nnector.",
        "Adaptive Snapshot Local",
        "UploadRates",
        "CR_41695C2AF45A08336AFE1BDB6F027AEAD97E2A04551B2329B3A302DF92AC01FC",
        "Counter1",
        "The Model property indicates the product name of the computer given by the manufacturer./nConstraints: Must have a value",
        "{2b240425-3141-43ee-931f-ec9f997c7d7e}",
        "Win32_Volume",
        "T2m;T2m;",
        "Indicates whether KMS is enabled on the computer: 0 if false, 1 if true.",
        "PolicySourceInitialProgramPath",
        "TaskThreadsTotal",
        "Revision",
        "SetByComPlusSet",
        "{b90550e8-ae0a-11d1-a571-00c04fa34730}",
        "NS_892F8DB69C4EDFBC68165C91087B7A08323F6CE5B5EF342C0F93E02A0590BFC4\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_59BFAFEBF60E8B2104B07BA7FADAF4FCFEB18999FE92B11F1C00E938CB4B93A6",
        "AppleTalk Remote Access Protocol",
        "WPDNSE_CHANGENOTIFY",
        "HealthActionType",
        "CD_8B5A6B942AA5416825152D8055EE6894FDA3E8C591F37D309F86A2C72141DDBF.2114.304791894.2136",
        "MsftDiscFormat2StreamConcatenate_DebugConstructor",
        "BackOffice",
        "Name is a semi-unique (scoped to the owning storage subsystem), human-readable string used to identify the virtual disk.",
        "Since this format is only a recommendation, CIM clients shall treat the value as an opaque identifier for the sequence context and shall not rely on this format.",
        "Scope",
        "SubjectAlternativeNames",
        "LINUX",
        "CIM_ProductSoftwareFeatures",
        "ATM DXI",
        "object:MSFT_Expression",
        "CD_A3D3980C32FA18D3D98369F8A523D2756A2B0B161451E04A631ED0FE459C5FA2.1490.1335448166.1033",
        "SEL_GENERATOR_ID is valid",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|EnableAnonConnections",
        "The Win32_TSLogonSetting class allows configuring logon settings such as Username, Domain and PromptForPassword.",
        "Specifies the y coordinate of the upper left corner of a window",
        "XTS_AES_128",
        "ref:CIM_Product",
        "Indicates the enclosure slot number in which the disk physically resides",
        "Association between StorageProvider and StorageSubSystem",
        "A SCSI command was requested to an Nx_Port that was not a SCSI Target Port",
        "The CIM_CDROMDrive class represents a CD-ROM drive on the system.",
        "NumberOfGroupsMax",
        "A return code of 4096 shall indicate the state change was successfully initiated, a ConcreteJob has been created, and its reference returned in the output parameter Job.",
        "Disable NAT64",
        "CoNDIS Media Types Supported",
        "Type of address specified. It can be text: a DNS or dotted address or it can be a binary ipv4 or ipv6 address",
        "PLATFORM_TRACE_RESERVED_0d Flag",
        "Servic",
        "{cfa35540-a5a6-4e4b-8fbf-60a3458a6733}",
        "Win32_SystemUsers",
        "Security Descriptor",
        "The Win32_PhysicalElementsOfDiskDrive association defines the mapping between a disk drive and the physical components that implement it.",
        "Initiator Name",
        "Whether to turn on Chimney offload. One of the following values:  - Disabled  - Enabled  - Automatic",
        "Program Settings",
        "Display Name",
        "The Win32_SystemMemoryResource class represents a system memory resource on a Win32 system.",
        "Denotes whether virtual disk repair is enabled on this subsystem.",
        "AllowPinnedFolderDownloads",
        "NdisEthernetReceiveErrorAlignment",
        "Quality of Service Error",
        "CD_F58FFC0FC8B956F0D972BCF0F695E0980C1562E6A9119DDB8C681A1382993AFE.51.1540842173.1004",
        "Descriptive text describing this SOM Filter",
        "RTLostFile",
        "Automatically detect configuration settings.",
        "TimeZoneRedirection",
        "Least Blocks",
        "4 GBit/sec",
        "security settings for a logical file",
        "0xD002 - 'Detached': This value is reserved for Windows. This value indicates a virtual disk that is visible to the host system but does not have a disk device object. ",
        "PackagePublisher",
        "See CIM_System.OtherIdentifyingInfo for details.",
        "WPD_TRACE_LEVEL_WARNING Flag",
        "Number of GUIDs",
        "The last activation time for the product.",
        "AddReplicationEntity",
        "Guid path of the volume.",
        "The timestamp for this driver.",
        "Supports persistent ReplicationEntity",
        "Right Handed Operation",
        "DetailedTracking_AuditPNPActivity",
        "Process Id",
        "IL_0AE842411B3B68BDB60FB4610360E1ECD2D583F7968316F79131DB25BF102F63.311.3444058254.217",
        "R_55BF0CC0F072F8672008BA2E217FC98D14173100D32640D32F61CC0295647162",
        "Win32_Binary",
        "CIM_RedundancyGroup",
        "The FreeSpace property indicates in bytes how much free space is available on the volume.",
        "IPPortMatchCondition",
        "\"Communication OK \" indicates communication is established with the element, but does not convey any quality of service. ",
        "Dial Extra Sample Seconds",
        "Precedence Reason",
        "Query power management active capabilities",
        "LastDrive",
        "The fully qualified source filename.",
        "The Orientation property indicates the printing orientation of the paper.",
        "dispatcher",
        "MS_SM_PortEvent",
        "    <registryKey keyName=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\InstallService\">",
        "Handle Duplicate Event",
        "Limit Breakaway OK",
        "MaxNumberOfBuffers",
        "CR_14EA8D1B614BC6D260E31F428D1651D98B6F7F8F49C7964016B24597B70B73AE",
        "Standard Server Edition",
        "FunctionParameter Flag",
        "NODE_WWN",
        "TS RDP Shell Trace",
        "The types of the parameters of the operation.",
        "MDM_Policy_Config01_RemoteAssistance02",
        "TerminalServerMode",
        "CIM_Printer.CurrentMimeType",
        "AllowFallbackToSSL3",
        "Call - authentication is performed only at the beginning of each call when the application receives the request.",
        "C_40CAFB87B847B798AC8F2045737A2A8390AC0416A38406D6F38EE740FBB0A4AC",
        "RSOP_PolicySetting",
        "A return code of 0 shall indicate the state change was successfully initiated. ",
        "Location contains the PnP location path of the disk. The format of this string depends on the bus type. If the bus type is SCSI, SAS, or PCI RAID, the format is <AdapterPnpLocationPath>#<BusType>(P<PathId>T<TargetId>L<LunId>). If the bus type is IDE, ATA, PATA, or SATA, the format is <AdapterPnpLocationPath>#<BusType>(C<PathId>T<TargetId>L<LunId>). For example, a SCSI location may look like: PCIROOT(0)#PCI(1C00)#PCI(0000)#SCSI(P00T01L01). Note: For Hyper-V and VHD images, this member is NULL because the virtual controller does not return the location path.",
        "This method creates a virtual disk and single volume using the resources of the storage pool.",
        "HomePages",
        "AcpiPssState",
        "AddAdminGroupToRUPEnabled",
        "DataRoamingEnabled",
        "Specifies the width of the window",
        "{8502C58D-5FBB-11D2-AAC1-006008C78BC7}",
        "Indicates whether the physical disk's identification LEDs are active or not. This is typically used in maintenance operations.",
        "0xC005005D",
        "Association between Disk and Partition",
        "If true, prevent roaming profile changes from being copied to the server.",
        "Capabilities and management  of a magneto-optical drive, a subtype of media access device.",
        "\"Critical Failure\" (25) - The element is non-functional and recovery might not be possible. ",
        "WSAT Trace Record",
        "Gets the settings for the current storage health.",
        "AddCertificate",
        "Identifies the major release of the System BIOS.",
        "C_8DE46DD6446B26621A23E11758AE5CBC62C9F72998CAFB08B9CD58DF66902A20",
        "Indicates whether the print connectionhas been deleted.",
        "iSCSI Name",
        "If the corresponding RecordFormat property is <empty>, or cannot be parsed according to the recommended format, RecordData should be interpreted as a free-form string. If the RecordFormat property contains parseable format information (as recommended in the RecordFormat Description qualifier), the RecordData string SHOULD be parsed in accordance with this format. In this case, RecordData SHOULD begin with the delimiter character and this character SHOULD be used to separate substrings in the manner described. The RecordData string can then be parsed by the data consumer and appropriately typed.",
        "ModerationIntervalGranularity",
        "CD_2D600EDEB86FB22AC5475ED284E8022AA05DCE0A01ED5CD478BD3E89B6038610.1366.1.39313",
        "Supports Object IDs",
        "BaseBoardManufacturer",
        "PeerSupportsGuaranteeEncryption",
        "Indicates whether or not the contents of the local directory are moved",
        "OtherTransferCount",
        "MIF.DMTF|Temperature Probe|002.16",
        "R_1DE76A14218809A4BBAECDA99DCF12499E4B2F2C31612087FF7D8191EF84EF3A.1020.504989508.524",
        "RequireOrderedDelivery",
        "{7CE7448E-E3D4-11d2-8601-0000F8102E5F}",
        "0xD008",
        "Reference to the link item.",
        "CD_86E4864B1CF6600CE4B6DDC1904F1615B807835856FD99C1037F22B392220711.2615.3961754011.440",
        "This method converts the partition style of an already initialized disk.",
        "select * from WSP_HealthActionEvent",
        "SourceRoute",
        "C_E4786A08CF3335E88102AE00434A382BEF190C917949773F1CE0DBCB609258D9",
        "The file sharing protocol used by the share.",
        "The maximum number of connections that will be allowed within this session",
        "MaxRetryCycles",
        "The value for NumberOfGroups is outside of the supported range of values.",
        "Multiscan Color",
        "7 - Encrypted Test Password Allowed - Windows 2000: The user's password is stored under reversible encryption in the Active Directory. ",
        "WindowsDirectory",
        "5      The driver for this device needs a resource that Windows cannot manage. ",
        "Specifies the IP Addresses(V4/V6) for filtering",
        "1 = This is not an assigned application ",
        "milliseconds",
        "Primary Computer Evaluation",
        "LetAppsAccessMicrophone_ForceAllowTheseApps",
        "CIM_ComputerSystem.RequestStateChange(RequestedState)",
        "2 = This application's Product Identifier conflicts with the higher application ",
        "MGR_TRACE_RESERVED_1b Flag",
        "MsftDiscFormat2StreamConcatenate_DebugGeneral",
        "{b161eeab-ac03-4c2b-ae7a-5a3768f70e85}",
        "NDIS 802.11 data rates that are desirable for the radio to operate in.",
        "USBControllerHasHub defines the Hub(s) that are downstream of the USBController.",
        "ConcurrentUserLimit",
        "{b9760e75-6662-49e4-aa6c-f028befec8ee}",
        "PrivilegeCount",
        "Trace Control Guid",
        "The SettableParity property determines whether the parity can be set on the serial port",
        "0xEFFF001A",
        "- active: Set only lasts until next boot. - persistent: Set is persistent.",
        "The month during which the Job should be processed. Specify 0 for January, 1 for February, and so on.",
        "LUAInstall: error 0x00000005 setting flags [{7447A267-0015-42C8-A8F1-FB3B94C68361}]",
        "The Win32_GroupInDomain relationship identifies the group accounts associated with a NT domain.",
        "TRACINGCONTEXT",
        "The CommandLine property specifies the command line used to start a particular process, if applicable.",
        "FieldParameters",
        "inches",
        "MGR_TRACE_RESERVED_13 Flag",
        "The DriverDate property indicates the date and time the current video driver was installed.  ",
        "WlanDlgTraceGuid",
        "CIM_Process",
        "CIM_ERR_INVALID_PARAMETER",
        "MS_SMHBA_SAS_PHY",
        "DMTF|ComponentID|001.1",
        "Example: FindFast",
        "GetByPrinterObject",
        "NPIV_OUT_OF_RESOURCES",
        "EVENT_TRACE_FLAG_SESSIONID",
        "ref:CIM_IRQ",
        "Large Custom Logo Bitmap Path",
        "BytesTotalPersec",
        "Maximum number of process contexts the operating system can support. If there is no fixed maximum, the value should be 0. On systems that have a fixed maximum, this object can help diagnose failures that occur when the maximum is reached. If unknown, enter -1.",
        "MsftDiscFormat2Erase_DebugConstructor Flag",
        "WSP_PartitionToVolume",
        "ILVID",
        "Win32API|Communication Structures|COMMPROP|dwSettableParams|SP_STOPBITS",
        "A file server object models the subsystems concept of a file server.",
        "ref:CIM_BootSAP",
        "MSNdis_EthernetPermanentAddress",
        "LUAInstall: error 0x00000005 setting flags [{937C1A34-151D-4610-9CA6-A8CC9BDB5D83}]",
        "MinRto",
        "The ProcessName property contains the name of the process.",
        "uint3",
        "FIR (fast infrared)",
        "EnableIndication",
        "Xp4DTt\\",
        "LUAInstall: error 0x00000005 setting flags [{743B5D60-628D-11D2-AE0F-006097B01411}]",
        "The port number used by this portal / endpoint",
        "MSNdis_ReceiveQueueInfo",
        "Values: TRUE or FALSE. If TRUE, the slot is shared.",
        "InstalledBy",
        "Failed",
        "Trace all function entry/exits",
        "InternetZoneAllowLoadingOfXAMLFiles",
        "The mask for the IPv4 address of this portal / endpoint, if one is defined.",
        "The maximum number of MAC addresses that can be allocated on the adapter",
        "CIM_ComputerSystem.OtherIdentifyingInfo",
        "NdisFddiTypeWrapB",
        "Range",
        "TRACE_FLAG_TIMER",
        "ChangeType",
        "SecuritySetting",
        "Application-specific error code",
        "This method creates a clone of the virtual disk, resulting in another virtual disk with identical data to the source.",
        "object:MSNdis_WmiOffload",
        "PerfData",
        "Indicates how many firmware slots this physical disk supports",
        " The name of the software element being checked. ",
        "OutputInfo",
        "The number of antennas on the 802.11 radio.",
        "RemoveAccessPath",
        "tm_yday",
        "PrimaryPartition",
        "Supplies the friendly name of the offload.",
        "CIM::Interop",
        "InternetZoneEnableCrossSiteScriptingFilter",
        "DeleteBy",
        "C_1B410CA2C4AD84A438C361AB2935A45E1487677A7411DBBFAE5D52EC6FB1AD7F",
        "ventlog",
        "HighestUserAddress",
        "Ux Flag",
        "InitialTime",
        "Uint8Array",
        "object:MSFT_NetConSecRule",
        "R_5241CFC05A716A77CB0F36844F9A62538AED075865B9C000AF8A5A2832337841",
        "MSFT_NetAdapterLsoSettingData",
        "SECAM G",
        "SIDString",
        "MEM_ROW is valid",
        "PLATFORM_TRACE_FUNCTION Flag",
        "10.0.19041.3758",
        "The Path property indicates the local path of the share.",
        "autoConfigEnable",
        "ReliableSessionBindingElement",
        "OperationalStatus",
        "e355DB6CE31803BDDBDD2FF491BD2AAE24F28E7ADF16402B3F3B9C4CF695702EB",
        "Button Order",
        "18 - There are circular dependencies when starting the service.",
        "Active Off/Very Low Power Support",
        "The Win32_DMAChannel class represents a direct memory access (DMA) channel on a Win32 computer system. DMA is a method of moving data from a device to memory (or vice versa) without the help of the microprocessor. The system board uses a DMA controller to handle a fixed number of channels, each of which can be used by one (and only one) device at a time.",
        "networkKey",
        "DriverDate",
        "SELECT * FROM Win32_RemoteAppChangeEvent",
        "The Win32_DfsNodeTarget class associates a DFS node to one of its targets.",
        "Index number of this portal",
        "The Shared property indicates whether the two or more slots shared a location on the base board such as a PCI/EISA shared slot.",
        "Association between replicated virtual disks",
        "DER ASN1 GN",
        "ProviderOperation_PutClassAsync",
        "InteractiveLogon_DoNotDisplayUsernameAtSignIn",
        "KEYBOARD_PORT_WMI_STD_SERIAL",
        "SA Flags",
        "V30 Family",
        "Grant number in the token-based activation license that activated the machine.",
        "MSNdis_80211_PrivacyFilter",
        " The target operating system of the software element  being checked.",
        "Provider can create remote elements",
        "MSFT_StoragePoolToPhysicalDisk",
        "An abstraction or emulation of a hardware entity, that may or may not be realized in physical hardware. Any characteristics of logical devices that are used to manage its operation or configuration are contained in, or associated with, the CIM_LogicalDevice object. Examples of the operational properties for a printer would be paper sizes supported, or detected errors. Examples of the configuration properties of a sensor device would be threshold settings. Various configurations could exist for a logical device. These configurations could be contained in CIM_Setting objects and associated with the logical device.",
        "Association between the security settings of a file/directory and its group",
        "CIM_VideoBIOSFeatureVideoBIOSElements",
        "PolicySourceNetworkAdapter",
        "eFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "Service No Thread",
        "TransmitChecksumOffloadSupported",
        "PERF Flag",
        "How Gateway is Used",
        "I_1288A9F7AA57049E9963E48CE6150F40D8080204ED4013CE91E0269EB74BD0EA.2721.1522041857.271",
        "Address",
        "MI_ERRORCATEGORY_INVALID_ARGUMENT",
        "Null Modem",
        "Success - Chkdsk completed",
        "Bytes Total/sec",
        "LPC_TRACE_RESERVED_0a Flag",
        "MSFT_NetAdapterPowerManagement_WakePattern_MagicPacket defines settings for 'Wake on Magic Packet'.",
        "0xEFFF003C",
        "PortableDeviceClassExtension_f1",
        "Hard Page Fault Event",
        "SeSecurityPrivilege",
        "Example: A CD-ROM drive would return 5.",
        "NumberOfBlocks",
        "This is the HTTPS URL of the corporate website that will be used to determine the current domain location i.e. inside or outside corporate.",
        "SourceIPAddresses",
        "UTP Category 3",
        "Win32API|File Functions",
        "This parameter indicates the default allocation policy for virtual disks created in an enclosure aware storage pool. For example, an enclosure aware subsystem could balance each data copy of the virtual d",
        "{b90550e7-ae0a-11d1-a571-00c04fa34730}",
        "Fastest state considering policy restrictions",
        "DisableByObject",
        "C_38BD5C5FBE64888D5B30C67C4333B4A6856A6BD1D71F9FA08E4958EA88393E70",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|DefaultTOS",
        "TRACE_ERROR Flag",
        "Percentage",
        "The processor family type. For example, values include \"Pentium(R) processor with MMX(TM) technology\" (14) and \"68040\" (96).",
        "Values: TRUE or FALSE. A value of TRUE indicates the protocol allows data to be disconnected.",
        "// The total number of packets that contained a valid Sequence Number field.",
        "The setting data associated with a power setting.",
        "MSNdis_TokenRingCurrentAddress",
        "Link Path",
        "PLATFORM_REQUESTOR_ID",
        "PluginPackageFamilyName",
        "CIM_Printer.NaturalLanguagesSupported",
        "{791ad197-e35c-11d0-9692-00c04fc3358c}",
        "This method creates a point in time snapshot of the virtual disk.",
        "Account",
        "PC-98/Local bus add-on card",
        "CD_6F49E037E6F2BFB72144CC48C974D93CBE7417A8F27ACAB5CA25D34A28C29442.1690.1.81873",
        "PciXCurrentSpeedAndMode",
        "Win32API|GetDriveType",
        "The sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If the CurrentReading is between UpperThresholdCritical and UpperThresholdFatal, then the CurrentState is Critical.",
        "Issuer Name",
        "The Load method loads a specific instance of a provider.",
        "LPCDRVR_TRACE_RESERVED_0f",
        "The ClassObject property holds the object containing the class definition.",
        "BytesSent",
        "object:MSNdis_WmiTcpLargeSendOffloadV1",
        "OptionRomVersion",
        "7982F1017538FCA639874841D68FAD4E24866671A5CDE2C6CB4C169C859203D9",
        "CR_17E7C86738B59EB875E05FB8D2106E803DF9A9B0E69B9182F0E97C3BD2B3B709",
        "MsftEnumDiscRecorder2_DebugDestructor",
        " Creates or updates a .ini entry. ",
        "IpV6IPsecAuthRateLimitBytesPerSec",
        "DisableProcessesInEnhancedProtectedMode",
        "The HBA security information cache is not supported by this adapter.",
        "MDM_Policy_Config01_Bitlocker02",
        "Hardware configuration for serial port",
        "buttonOrder",
        "Portal Address",
        "FcLun",
        "HasAssetIntelligence",
        "NRI Last updated local time - If this has never updated you will see a null value in this property",
        "ModelDescription",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|RawIPAllowedProtocols",
        "\"OK\" indicates the ManagedElement is functioning normally. ",
        "PAL G",
        "TerminalProtocol",
        "FX_TRACE_RESERVED_13",
        "As a Kernel object job object names are case sensitive.  Because WMI keys are case insensitive, the name of the named job object must be decorated as follows: a capital letter should be preceded by a backslash.  As a consequence of this convention, 'A' and 'a' are lower case and '\\A' and '\\a' are upper case.",
        "IO Timer Events",
        "SupportedAsynchronousActions",
        "I_370D362D24157E77A6D437A1B6E44D31636578C65BA57AE250B7372F533440DE.2457.1240054415.346",
        "MaxLifetimeMinutes",
        "Setting",
        "Lead Acid",
        "Access Rights",
        "69 - More than 5 gateways specified",
        "GetKeyProtectors",
        "The ErrorGranularity identifies the level where the error can be resolved.",
        "BcdIntegerListElement",
        "x/m;x/m;",
        "Offline Internal",
        "0x00000101",
        "The maximum number of multicast short addresses the NIC driver can manage.",
        "LPC_TRACE_RESERVED_0c Flag",
        "Process_V2_TypeGroup4",
        "A value that indicates whether SSL client authentication is required.",
        "// The number of bytes sent using the ESP protocol.",
        "FPBGA",
        "The SystemStartupDelay property indicates the time to delay before starting the operating system",
        "CritSecTraceProvider",
        "CloseWait",
        "MaxBaudRateToSerialPort",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1352.1199241364.180",
        "MaxLength",
        "MaxOutstandingR2t",
        "The AdapterCompatibility properties contains the general chip set used for this controller in order to compare compatibilities with the system",
        "Win32Registry|HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System",
        "If this profile is a roaming profile, this property is a DATETIME value that indicates the last time the profile's registry hive was uploaded to the server.",
        "MIF.DMTF|Power Supply|004.7",
        "Current",
        "The Type of the Sensor, e.g. Voltage or Temperature Sensor. If the type is set to \"Other\", then the OtherSensorType Description can be used to further identify the type, or if the Sensor has numeric readings, then the type of the Sensor can be implicitly determined by the Units. A description of the different Sensor types is as follows: A Temperature Sensor measures the environmental temperature. Voltage and Current Sensors measure electrical voltage and current readings. A Tachometer measures speed/revolutions of a Device. For example, a Fan Device can have an associated Tachometer which measures its speed. A Counter is a general purpose Sensor that measures some numerical property of a Device. A Counter value can be cleared, but it never decreases. A Switch Sensor has states like Open/Close, On/Off, or Up/Down. A Lock has states of Locked/Unlocked. Humidity, Smoke Detection and Air Flow Sensors measure the equivalent environmental characteristics. A Presence Sensor detects the presence of a PhysicalElement.",
        "HOSTPROC_TRACE_IOTARGET",
        "SelectSleepButtonActionPluggedIn",
        " The CIM_SoftwareFeature class defines a particular function  or capability of a product or application system.  This  class in intended to capture the level of granularity that  is meaningful to a consumer or user of a product rather than  the units that reflect how the product is built or packaged.  The latter detailed is captured using a CIM_SoftwareElement  class.   When a software feature can exist on multiple platforms or  operating systems (for example, a client component of a  three tiered client/server applications might run on Solaris,  Windows NT, and Windows 95), a software feature is a collection  of all the software elements for these different platforms.  In this case, the users of the model must be aware of this situation  since typically they will be interested in a sub-collection of the  software elements required for a particular platform.   Software features are always defined in the context of a  CIM_Product class using the CIM_ProductSoftwareFeatures  association since features are delivered through products.  Optionally, software features from one or more products  can be organized into application systems using the  CIM_ApplicationSystemSoftwareFeature association.  ",
        "Where FriendlyName = '#'",
        "AuditApplicationGuard",
        "Signal Quality Problem",
        "PrefixSize",
        "The Antecedent property references a target for a DFS node. A node that is a link has one or more targets. A node that is a root has one target.",
        "RemoteAddr",
        "A95716A",
        "SRB Status",
        "sRGBSupported",
        "C_01938EB24A6B33B65014DBACDE3C7CA2C2E7C61637395768C92D80CCEFF91F8C",
        "MGR_TRACE_RESERVED_11 Flag",
        "OtherOperationCount",
        "CIM_StorageClientSettingData.ClientTypes",
        "The Msft_WmiProvider_ExecQueryAsyncEvent_Post event class represents an event generated immediately following completion of the provider's implementation of IWbemServices :: ExecQueryAsync.",
        "Result from Setting TCP Offload Parameters",
        "SamGetDisplayEnumIdx_End",
        "IsMpioEnabled",
        "Specifies the name of the VPN connection profile to be modified.  ",
        "NameFormat",
        "This contains a network key or pass-phrase.",
        "Enumeration indicating the type of rack.Information such as \"Telco\" rack (value=2) or standard 19 inch rack (1) can be specified. The country/region for which the rack is manufactured is defined in the CountryDesignation property.",
        "C_BA1712135E2C9766CB6DFE0CCDDC8590C3F7AF3B44B9DAE601D4E1FEFD0E276A",
        "58011",
        "CIM_LANEndpoint",
        "IgnoreMOUpdateDownloadLimit",
        "Sets the property LevelOfControl which specifies the level of control which is one of Disable, EnableInputNotify, EnableInputNoNotify, EnableNoInputNotify,  EnableNoInputNoNotify. The call returns an integer value of 0 for success in Server-Override mode and an error if the setting is under group policy control.",
        "Ultimate Edition",
        "EVENT_TRACE_FLAG_WRITE",
        "Association between the security settings of a share and one member of its SACL.",
        " The CIM_RemoveDirectoryAction removes directories for software elements. ",
        "QIC Cartridge",
        "ConcurrencyMode",
        "The QoS capabilities reported by the network adapter.",
        "CIM::Event",
        "ref:DN_Class",
        "An address or other identifying information to uniquely name the LogicalDevice.",
        "CD_0755C98F98A88832CE4AF388D7FD0A485984E8C8093D5B69AF797BCD21D684DE.2052.216095128.145",
        "a3c02200700000P",
        "NotificationsSent",
        "{acf14039-a61c-11d0-8dd4-00c04fc3358c}",
        "AllowVPN",
        "PasswordStatus",
        "11 - Bpc",
        "{2306fe39-dbf6-11d2-9244-006008269001}",
        "TargetState",
        "TargetAddress",
        "The Reboot method shuts down the computer system, then restarts it. On computers running Windows NT/2000, the calling process must have the SE_SHUTDOWN_NAME privilege.",
        "Win32API|Network Management Structures|AT_INFO|DaysOfMonth",
        "MsftDiscFormat2RawImage_DebugConstructor",
        "CIM_ProtectedSpaceExtent",
        "acquireforccflush",
        "Hw Ecp Read Count",
        "This device is using an Interrupt Request (IRQ) resource that another device is using.",
        "IkeextTraceProvider",
        "ecurity",
        "% of Maximum Frequency",
        "Transparent Bridge",
        "SetPowerState method defines the desired power state of a computer system and its running operating system, and when the system should be put into that state. The PowerState parameter is specified as one of the valid integer values defined for the property, PowerState. The Time parameter (for all state changes but 5, \"Power Cycle\") indicates when the power state should be set, either as a regular date-time value or as an interval value (where the interval begins when the method invocation is received). When the PowerState parameter is equal to 5, \"Power Cycle\", the Time parameter indicates when the system should power on again. power off is immediate. SetPowerState should return 0 if successful, 1 if the specified power state and time requests are not supported, and some other value if any other error occurred.",
        "MSFT_DSCConfigurationOutputReboot",
        "Number of PDU received via ethernet port",
        "Idle session limit in units specified in milliseconds where 0 implies NEVER.",
        "Create the IPAddress.",
        "MDM_Policy_User_Config01_Security02",
        "Discover",
        "TRACE_CLASS_THREAD",
        "CD_DC39EB125CD5896A582C9CCFCFEF5267AF9611EEF285D00CC4FF5DF7F8AE6FFC.40.40615820.573",
        "MSFT_NetOffloadGlobalSetting",
        "MDM_WindowsLicensing_Subscriptions01_01",
        "ref:MSFT_InitiatorId",
        "Allows an administrator to explicitly disable a scan from checking any of the processes listed.",
        "ull for DMTF-defined instances, the \"preferred\" algorithm must be used with the <OrgID> set to CIM.",
        "MSFT_StorageSubSystemToVirtualDisk",
        "RecordId",
        "HBAFCPID",
        "Win32Registry|Software\\Microsoft\\WBEM\\scripting|Default Namespace",
        "ref:CIM_MonitorResolution",
        "{A56DBCF9-C4F0-44a8-9C1B-BB3B3F774B4D}",
        "UMDF - Lpc Trace",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1075.2208756393.180",
        "IRQ trigger type indicating whether edge (value=4) or level triggered (value=3) interrupts occur. Also, \"Other\" (1) and \"Unknown\" (2) may be defined.",
        "Control value",
        "AppServer",
        "Basic data",
        "{acf14044-a61c-11d0-8dd4-00c04fc3358c}",
        "SoftAssociations",
        "41000",
        "_UUUU",
        "object:CIM_ManagedElement",
        "Page file settings management. ",
        "The interval of time that a destination waits before sending an acknowledgement to the message source on reliable channels that are created by the factory.",
        "MDM_Policy_Config01_WindowsInkWorkspace02",
        "CD_9D89FA2B309F38D240606161FF6D4D1DD686574B6527CC994C80F23BE2267FCF.1745.3562593171.4742",
        "BoundedEcpReadCount",
        "AutoBoost Entry Exhaustion",
        "C_E4331DF18896E69637CDDB420EDB4490D51A6789B8AD769669991F6030309A42",
        "MaxOperationAPIFiles",
        "LoginFlags",
        "Shared secret for communicating with primary and backup RADIUS servers. This field is a variable length array.",
        "CIM_Service",
        "{9AC5D4A1-1A1A-48ec-8E79-735806E9A1FA}",
        "A user-friendly string representing the name of the replication group.",
        "IPv6FailureReason",
        "R_49C003F958AE429B51E409471F01A643359D07DB4A4E6AA865D8578747CC13A3",
        "DATA_PROVIDER_PNPID_GUID",
        "Type F",
        "Changer problem data",
        "Limit Preserve Job Time",
        "CIM_Indication.SequenceNumber",
        "DeleteKey",
        "EVENT_TRACE_FLAG_THREAD",
        "CIM_BIOSFeature.Characteristics",
        "AdapterDescription",
        "GetConfiguration",
        "I_6E3B4399FA4EDE750602EAE85FB276C1B64644E78344F6BB3EF3F442D17FE8D8.352.1.287457",
        "The default string defines the default value used for the parameter if the user choose not to supply any actual value.",
        "CD_45D7E6F87ACB8E8D445CCFB669888583D94123CEF1D8C0B902BDB864D192ADA3.1149.1758528885.469",
        "Infiniband",
        "MSFT_NetServiceStartFailedII",
        "C_E4FC7CCBE036059F139218E837508435F1EEA217B72843BBC84B1DD56DF78DB9",
        "{d5418619-c167-44d9-bc36-765beb5d55f3}",
        "The value for PhysicalDiskRedundancy is outside of the supported range of values.",
        "((m;((m;",
        "Door Open",
        "{8502C54F-5FBB-11D2-AAC1-006008C78BC7}",
        "SystemElement represents one aspect of the LogicalElement.",
        "The distance, in inches, between adjacent slots.",
        "AuthenticationPackage",
        "The RegisteredProfile to which the ManagedElement conforms.",
        "The portal's aggregation tag",
        "ReadInit",
        "object:MSiSCSIInitiator_Portal",
        "LPC_TRACE_RESERVED_1d",
        "Supplies the setting for ARP offloads on the adapter.",
        " The CIM_InstalledSoftwareElement association allows one to identify the computer system a particular software element is installed on. ",
        "The Share reference represents the properties of a shared resource available through the directory.",
        "CD_79F50ECB454C073E4E5CB137ED1F04F729BBE896F53092F9F794786916DFD292.1489.911613200.86",
        "Monitor's minimum refresh rate in hertz, when a range of rates is supported at the specified resolutions.",
        "WmiIPv6",
        "The child element that is a component of a system.",
        "Disable privacy mode.",
        "Specifies the data type the printer will use to record print jobs",
        "C_61A3C0D6CB2A10AE4FD5F19276429EF7E249D991E911A200F124BE12E4F8F8C2",
        "Whether to turn on task offload. One of the following values:  - Disabled  - Enabled",
        "CIM_ServiceServiceDependency is an association between a service and another service, indicating that the latter is required to be present, required to have completed, or must be absent for the former service to provide its functionality. For example, boot services may be dependent upon underlying BIOS Disk and initialization services. In the case of the initialization services, the boot service is simply dependent on the init services completing.  For the disk services, boot services may actually utilize the SAPs of this service.  This usage dependency is modeled via the CIM_ServiceSAPDependency association.",
        "SizeInMB",
        "OperationalStatusDownLowPowerState",
        "CR_CDB4D0999BBE2F5F01BF7E500A934D82190F379CD1604609DAB79E05390DCEF9",
        "MmTargetName",
        "CD_38D82DBAF247C62CB271C7F968D7EF903F6B890D72656BFC47D699684D55D030.1190.3851673236.611",
        "MSFT_DODownloadUsage",
        "MSNdis_EthernetOneTransmitCollision",
        "Connects to the license server and updates the connectivity status",
        "Win32API|Windows 95/98 Functions|DRIVE_MAP_INFObtInt13Unit",
        "NS_892F8DB69C4EDFBC68165C91087B7A08323F6CE5B5EF342C0F93E02A0590BFC4\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_41AE0E8A27F69BB81713327447DFEB3E4D47E6C961601828958257151B049D62",
        "\\\\.\\root\\StandardCimV2:__Win32Provider.Name=\"NetPeerDist\"",
        "CD_91882C4E4700146BC908AC03DB139338C0844AE5A877163990AFB47483D7264C.199.2589104217.1783",
        "MSNdis_TcpConnectionOffloadCurrentConfig",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_C6EA9ADB21355CF6DA787E0D8D62E59CF47237122DE78FA8959CE74E2782F2F8",
        "DisableNetworkAccess",
        "The CategoryId property indicates a GUID for this component category.",
        "Maximum number of directly addressable entities supported by this Controller.  A value of 0 should be used if the number is unknown or unlimited.",
        "ModID",
        "C_4EF24D0957FB71C83C7AD35B30B8A4808EE94D32528B7C1738A8F12F7FFBB5AE",
        "Create_New_Console",
        "The total number of identity authentication failures (Kerberos, certificate, and preshared key) that occurred during main mode negotiation.",
        "The Msft_WmiProvider_CancelQuery_Post event class represents an event generated immediately following completion of the provider's implementation of IWbemEventProviderQuerySink :: CancelQuery.",
        "If TRUE, this subsystem supports the resizing of storage tiers.",
        "MSFC_EventControl",
        "HOSTPROC_TRACE_FILEOBJECT",
        "DedupTracingEventClass",
        "Expand",
        "{FAF76B6F-798C-11D2-AAD1-006008C78BC7}",
        "Win32API|Communication Structures|COMMPROP|dwSettableParams|SP_PARITY",
        "{5c3bda24-8b64-4829-a587-8ce719152fe2}",
        "StreamingSharedContentStoreMode",
        "disabled",
        "    5. Memory Compression",
        "Concurrency",
        "TextW",
        "Bid2Etw_MSADDS_1",
        "{29364538-5887-4C0F-9816-6BF099D8C815}",
        "CD_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D.1174.1.9480",
        "Supplies the setting for 802.11i RSN offloading.",
        "Specifies whether the system or the application enforces SOAP MustUnderstand header processing.",
        "Session",
        "C_69F693B09761D259F9E36F2E07509E240E77C62CCA21F57F463D23C41F558900",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_171DF71ABD7C6A7DF03D4AFA73A2CE1BA658B66016A9DF4DAB148F781BE2851A1c31E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "A class derived from redundancy group indicating that the aggregated elements have more capacity or capability than is needed.  An example of this type of redundancy is the installation of N+1 power supplies or fans in a system.",
        "AllowWiFiDirect",
        "TRACE_CLASS_REQUEST",
        "Invalid Address",
        "DOMinBatteryPercentageAllowedToUpload",
        "DBNETLIB.1 formatted output (A)",
        "hue such as scanned photographs. 5",
        "ScreenSaver Flag",
        "object:MSNdis_ReceiveFilterFieldParameters",
        "__EventProviderRegistration",
        "58008",
        "Denotes the version of the storage pool.",
        "The service. ",
        "Installation package task management. ",
        "The QueryLanguage property holds a string containing one of the query languages supported by Windows Management.",
        "The configuration repository source that this partial configuration will use",
        "SAM Connect",
        "Targets allocated from Exclusive storage pool",
        "CNG_Protect",
        "Disassociate",
        "15 - The service does not have the correct authentication to run on the system.",
        "CD_110AE6309AE2428224AA19A1DF291C0EC1E01C277EE0FBFA7CE4C91884A74444.2068.1646830325.8125",
        "IO Read Write Errors",
        "CIM_SAPSAPDependency is an association between a service access point and another service access point indicating that the latter is required in order for the former service access point to utilize or connect with its service. For example, to print at a network printer, local print access points must utilize underlying network-related SAPs, or protocol endpoints, in order to send the print request.",
        "LPC_TRACE_RESERVED_0d Flag",
        "The appdomain id of the appdomain that hosts the endpoint.",
        "2.11.0",
        "The ErrorReplaceCharacter property specifies the value of the character used to replace bytes received with a parity error. ",
        "CoordType",
        "MSFT_CliAlias.FriendlyName=\"PrinterConfig\"",
        "The maximum module size in MB that can be downloaded.",
        "The high voltage of Input Voltage Range 2 for this Power Supply, in millivolts. A value of 0 denotes 'unknown'.",
        "\"In Service\" describes an element that is in service and operational.",
        "If True, line-based interrupts are supported.",
        "Thermal Constant 2",
        "{04788120-12C2-498d-83C1-A7D92E677AC6}",
        "48002",
        "Requests a shutdown of the operating system. The return value should be 0 if the request was successfully executed, 1 if the request is not supported and some other value if an error occurred. It is up to the implementation or subclass of operating system to establish dependencies between the Shutdown and Reboot methods, and for example, to provide more sophisticated capabilities such as scheduled shutdown/reboot, etc.",
        "preferenceMode",
        " The CIM_RebootAction causes a reboot of the system where the software element is installed. ",
        "Specifies the default mime type used by the Printer if the DefaultLanguage is set to indicate a mime type is in use (value=47).",
        "C_F9C1E1A7069B9B36C3E7210F7D307B0A9A014B690546123D4B32550C45DB3C57",
        "Clik Disk",
        "ipWINSAddressAlternate",
        "object:MSFT_ResourceChanged",
        "{89D89015-C0DF-414c-BC48-F50E114832BC}",
        "Field Sequential Stereo with Right Image on Stereo Sync = 1",
        "CIM_StatisticalInformation",
        "EnterpriseNetworkDomainNames",
        "R_61AD70324F8E2B3494420EEDDA5029E5D1AF2B0083C1CC1767F12EF889E146D1",
        "SamGetMemInAlias_Start",
        "The CurrentTimeZone property  indicates the amount of time the unitary computer system is offset from Coordinated Universal Time.",
        "Win32API|Network Management Functions|NetScheduleJobAdd",
        "Working Set Size",
        "The priority of this job.",
        "MSFT_NetLbfoTeam_TeamMember",
        "TimeStampRecordAddress",
        "C_0B5C44F8259E201E409A59CCC827AEA5F69AAF6BCED724865BCF62AE4F5D48E1",
        "Success - Volume locked and chkdsk scheduled on reboot",
        "Duplicate network number",
        "The number of entries in the IKE receive buffers for incoming IKE messages.",
        "LogonDomain",
        "PCSystemType",
        "R_AF4BDB6DD9BB57D16C8BADF348F545B1D2FD7AE633E0E8A6436B37636CE2E03F.1617.592781436.596",
        "ROOT\\ServiceModel",
        "CD_B6D5ABBE2F1027301C23A1CF884681090FD42092F2E95A0F33AA6207C9180DA3.2065.1410675615.600",
        "MaxReceivedMessageSize",
        "ReportManagers",
        "CD_95EC7A4EFEC83ABBDDA5099FF99F34F3F0A26217E92C58663611DD1463FB39C5.1191.2553648132.314",
        "ApicId",
        "Disable",
        "0xC0050063",
        "The name of the ODBC DSN to create. You cannot use wildcard characters.",
        "Disable BidTrace for all applications under this folder.",
        "BcdDevicePartitionData",
        "An AddressFilter matches based on the local or remote address of the traffic.",
        "The DomainDNSRegistrationEnabled parameter specifies whether the IP addresses for this connection are registered in DNS under the domain name of this connection, in addition to registering under the computer's full DNS name. The domain name of this connection is either set via the method SetDNSDomain() or assigned by DHCP. The registered name is the host name of the computer with the domain name appended. This parameter has meaning only when FullDNSRegistrationEnabled is enabled. Default: FALSE. Windows 2000 only.",
        "Wakeup",
        "Failure using the VxD loader.",
        "DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection",
        "DirectAccessProxyType",
        "HighThresholdOnEvents",
        "\"No Additional Information\" indicates that the element is functioning normally as indicated by PrimaryStatus = \"OK\". ",
        "{acf14034-a61c-11d0-8dd4-00c04fc3358c}",
        "If this object is retrieved from the ActiveStore, with the TracePolicyStoreSource option set, contains the path to the PolicyStore where this rule originally came from.",
        "If FALSE indicates that data PDU Sequences may be transferred in any order.  If TRUE indicates that data PDU sequences must be transferred using continuously increasing offsets, except during error recovery.",
        "MinimumVersion",
        "CD_524EAE20B913314A702A0EBDD5A10C21EED93FAAED87245845E0CDD9834CDE3F.1.3703833417.180",
        "Credential Flag",
        "PortMonitor",
        "DELETE (0x00010000) ",
        "DVD-RW",
        "MSFT_StorageSubSystemToReplicaPeer",
        "Affinity Index",
        "SetColorDepthPolicy",
        "The CompatID property is the CompatID for the driver e.g. DETECTEDInternal\\ftdisk ",
        "The Provider property holds the Provider Name associated with a particular instantiation of a provider instance.The Provider Name is identical to the __Win32provider :: Name property.",
        "This propery returns the current 'User Access Control' level on the client",
        "PCI_BUS_ADDRESS is valid",
        "FileSystemName",
        "ANSI X3T9.5 FDDI",
        "SamGetUserDomPwdInfo_End",
        "Win32API|Service Structures|SERVICE_STATUS|dwCurrentState ",
        "DB-15",
        "DownloadDurationMsecs",
        "ProcessorCStateEvent",
        "The PartComponent reference represents the physical memory contained in the physical memory array.",
        "{433EEA38-C1A7-48f1-884F-B6875F176CC7}",
        "Identifies the provider",
        "MSFT_InitiatorPortToiSCSISession",
        "object:MSFT_SignatureValidation",
        "E3130A1974EF1B2.186.3776532559.828",
        "Frame Forward",
        "CIM_FileSpecification",
        "The order of elements in the security header for this binding.",
        "{0827250D-BA3E-11d2-B361-00105A1F77A1}",
        "Win32_Registry",
        "Apple AUI",
        "DeviceInterfaceName",
        "If TRUE, this parameter instructs Clear to zero out the entire disk in addition to removing all partition information. If the parameter is FALSE or NULL, only the first and last megabyte of the disk is zeroed.",
        "GuaranteesSequencing",
        "TimeOnBattery indicates the elapsed time in seconds since the computer system's UPS last switched to battery power, or the time since the system or UPS was last restarted, whichever is less. Zero shall be returned if the battery is 'on line'.",
        "Note that Privileges may be inherited through hierarchical Roles, or may overlap. For example, a Privilege denying any instance Writes in a particular CIM Server Namespace would overlap with a Privilege defining specific access rights at an instance level within that Namespace. In this example, the AuthorizedSubjects are either Identities or Roles, and the AuthorizedTargets are a Namespace in the former case, and a particular instance in the latter.",
        "An optional friendly name for the Name Resolution Policy Table  rule.",
        "StrongARM",
        "OtherRegisteredOrganization shall be a a free-form string providing a description of the organization if 1, \"Other\" is specified for the RegisteredOrganization.",
        "object:MSFT_PCSVLogRecord",
        "Fail-safe with network boot",
        "\") (value=8). In an enabled but offline mode, a Device may be performing out-of-band requests, such as running Diagnostics. If (\"Disabled\") StatusInfo value=4), a Device can only be \"enabled\" or powered off. In a personal computer environment, (\"Disabled\") means that the Device's driver is not available in the stack. In other environments, a Device can be disabled by removing its configuration file. A disabled device is physically present in a System and consuming resources, but can not be communicated with until a load of a driver, a load of a configuration file or some other \"enabling\" activity has occurred.",
        "object:MSFT_NetAdapter_PacketDirectCapabilities",
        "CIM_ComputerSystem.RequestStateChange(TimeoutPeriod)",
        "NSOffload",
        "PrinterHostAddress",
        "C_6C707473A832E8EC791BEE1730A35E787F78F19C8E76CAC82C47C44288E55A89",
        "AllowEnterpriseModeFromToolsMenu",
        "Read-Ahead",
        "{778C74EE-DB2A-11d2-85FC-0000F8102E5F}",
        "The phase 2 SAEndpoint.",
        "DNS address for this directory server",
        "IL_A87D41B4C2C9172F26125D10DA8DE639F52C18A451846541B1CAFDED8E0CB132.2691.2190529254.267",
        "WPD_F8",
        "MessageTimestamp",
        "CPU is Idle",
        "C_264DACE30DFDF75A51B9E979ABD65B07E47DD7DF3824D1BD7D92A8F6E964F507",
        "The Unique identifying key of the object.",
        "AssumeUdpContextOutbound",
        "User FQDN",
        "The file system that is located on the storage extent.",
        "values",
        "{7757BA9B-7986-4866-B53F-A31E89FCBA15}",
        "LockScreenImageUrl",
        "Network Time Protocol (NTP) Server",
        "CIM_CardOnCard",
        "Allows a user to set a custom usage type for the new storage pool object. This parameter can only be specified if the Usage parameter is set to 1 - 'Other'. ",
        "ProviderOperation_ValidateSubscription",
        "Unknown/Unspecified Error",
        "Query Volume Information",
        "{04c6e16d-b99f-4a3a-9b3e-b8325bbc781e}",
        "CIM_PolicyRule",
        "CompatibilityDescription",
        "LogAllowed",
        "NoExplicitCredMatch",
        "//  Note: These classes are recommended as by implementing them the data ",
        "NetworkAdapterID",
        "Bid2Etw_MSDATL3_1_Trace",
        "MSFT_CliAlias.FriendlyName=\"SysAccount\"",
        "The InProcServerPath property, if applicable, defines the server inproc32 executable  name.",
        "Win32_PhysicalMedia",
        "The QueryId property holds the Windows Management-generated identifier for the query. The provider can track this so that during a later cancellation it will know which query was canceled.",
        "KerbSetPassword_End",
        "2 - 'Level 2': Virtual disks and masking sets belonging to this subsystem have been discovered. ",
        "The SpecificationVersion property indicates the version number of the initialization data specification (upon which the structure is based).",
        "MSiSCSI_LB_WEIGHTED_PATHS",
        "The InprocServer32 property contains the full path to a 32-bit in-process server DLL for this COM component.",
        "CSCreationClassName contains the scoping computer system's creation class name.",
        "Conformant Standard",
        "CI_57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "EndTime",
        "Bus Master Latency",
        "MSKerbTrace",
        "Win32_1394Controller",
        "Win32_TSSessionSetting",
        "The number of broadcast packets transmitted without errors through this interface.",
        "CIM_IKEProposal.CipherAlgorithm",
        "MSNdis_TcpOffloadParameters",
        "SecureBootCapable",
        "AllowSearchToUseLocation",
        "MCA_WARNING_PCI_BUS_SERR",
        "Sbus IEEE 1396-1993 32 bit",
        "CtlGuidPortableDeviceConnectApi",
        "UINT32",
        "Reserved by Migration Services",
        "MDM_Policy_Result01_CredentialProviders02",
        "// The number of IPSEC key operations in progress",
        "AvailabilityType",
        "8 - ATM",
        "EventTraceEvent_V0",
        "C_40C12CAACA910BDCDC268A44F63FDE93601C53B5B501C80C38FD1FB3930C98D8",
        "System Drivers and Services",
        "FileShareBackup",
        "The AcceptStop property indicates whether the service can be stopped.",
        "MIF.DMTF|Memory Mapped I/O|001.1",
        "MDM_DeviceStatus_NetworkIdentifiers01_01",
        "56004",
        "{F25FE467-783E-11d2-90BF-0060081A46FD}",
        "Delete Existing Connection Settings",
        "Win32_RoamingUserHealthConfiguration",
        "8 = Removed due to removal from user profile.",
        "The Antecedent reference represents the Win32_DiskPartition containing the properties of a disk partition where the logical disk resides.",
        "Active/Unoptimized",
        "0xC0000025",
        "Current blocksize",
        "Boolean indicating that synchronous, as well as asynchronous, communication is supported.",
        "Attempt CRL Check",
        "CR_61AD70324F8E2B3494420EEDDA5029E5D1AF2B0083C1CC1767F12EF889E146D1",
        "This method removes the specified users from the denied access list for the file share.",
        "SetDisableForcibleLogoff",
        "DUE_PLATFORM_UPDATE",
        "Commonly used product name",
        "Microsoft Terminal Services",
        "The TCPIP checksum offload setting data for network adapter.",
        "Controls whether the computer's Offline files feature settings are configured by using UST Manageability WMI classes or by using Group Policy.",
        "PaeEnabled",
        "C_B7CFE88CDD4E2F20D43EF63AF2894F6D14A41F54E4CF74F7D9A3F5B4EC2A87C0",
        "{4199ee71-d55d-47d7-9f57-34a1d5b2c904}",
        "ConfiguredVoltage",
        "Specifies whether the outgoing request's web message format has been explicitly specified.",
        "CD_C8D0F277D7F7D59AF0E214825AC68160FC59DD15097C20883A4D4AAFF0736D39.1733.1152319089.498",
        "Win32Registry|.DEFAULT\\Control Panel\\Desktop|WallpaperStyle",
        "USB Storage Driver Tracing Provider",
        "ROOT\\Microsoft\\Windows\\DeviceGuard",
        "BatteryRechargeTime",
        "<Class.>Property",
        "CD_531B755AACF530EF0E073B9207E450A2EDCA2159A7AE00C6697E526492783911.1191.1438044756.612",
        "R_6C707473A832E8EC791BEE1730A35E787F78F19C8E76CAC82C47C44288E55A89",
        "TRUE if drive is predicting failure. In this case it is critical that the disk is backed up immediately",
        "The FilePath property contains the path to the INF file being used, (Example: c:\\temp\\driver).",
        "Send SCSI Report LUNs command",
        "Multi-Frequency Signaling Link",
        "Example: 20521201000230.000000000",
        "Windows8",
        "OutRespBufferSize",
        "ATAPI",
        "Query pending (12) waiting for a client to resolve a query",
        "// This class exposes the security capabilities if the adapter ",
        "The currently assigned drive letter to the partition. This property is NULL if no drive letter has been assigned.",
        "Unknown file system",
        "      <registryValue name=\"ActivationType\" valueType=\"REG_DWORD\" value=\"0x00000001\"></registryValue>",
        "Indicates that the cursor is in feedback mode for two seconds after CreateProcess is called.",
        "Represents the offload global setting class for Microsoft TCPIP WMIv2 provider.",
        "Bit flags specifying how the audit policies are inherited",
        "MDM_DeviceStatus_UAC01",
        "HideSignOut",
        "IsTamperProtected",
        "Custom",
        "The format the binding uses to serialize messages.",
        "Limit Process Memory - Causes all processes associated with the job to limit their committed memory. When a process attempts to commit memory that would exceed the per-process limit, it fails. If the job object is associated with a completion port, a JOB_OBJECT_MSG_PROCESS_MEMORY_LIMIT message is sent to the completion port. ",
        "NDIS Dot11 Association Start Status Indication",
        "DeviceID",
        "MSFT_StorageObject",
        "0wJT%",
        "WINSSecondaryServer",
        "The Hardware property indicates whether the interrupt is hardware or software based. A hardware IRQ is a physical wire from the peripheral to the programmable interrupt controller (PIC) chip through which the CPU can be notified of time critical events. Some IRQ lines are reserved for standard devices such as the keyboard, floppy disk drives, and the system clock. A software interrupt allows applications to get the attention of the processor./nValues: TRUE or FALSE. A value of TRUE indicates the interrupt is hardware based.",
        "EncryptionAvailableCount",
        "EventDateTime",
        "Example: Internal Battery",
        "40002",
        "A text string describing the manufacturer of adapter",
        "DiskIo_V2_TypeGroup3",
        "This method sets the attributes of the provider.",
        "Sectors Per Read Mask",
        "MsftDiscFormat2StreamZero_DebugConstructor Flag",
        "The SetDynamicDNSRegistration method is used to indicate dynamic DNS registration of IP addresses for this IP bound adapter. The method returns an integer value that can be interpretted as follows: ",
        "sFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "MSNdis_FddiLongPermanentAddress",
        "IppUrl",
        "The target name is not found or is marked as hidden from login.",
        "SamEnumDomInSamSrv_Start",
        "CR_A9FE98FE5C3E9051AEEC71D48BD2011F883E1553AA2DD7968A20C510AD60108F",
        "{54dea73a-ed1f-42a4-af71-3e63d056f174}",
        "{464FFAB7-946F-11d2-AAE2-006008C78BC7}",
        "TimeStampCount",
        "Write buffer size in bytes.",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_user_id",
        "A boolean value that specifies if flow control is enabled.",
        "Setting information for disk quotas on a volume. ",
        "RequireFullAuthSupport",
        "DisableRemovableDriveScanning",
        "Guid, the unique id of the provider installed on the computer.",
        "TEST_TRACE_RESERVED_0e Flag",
        "Indicates the tolerance of the Sensor for the measured property. Tolerance, along with Resolution and Accuracy, is used to calculate the actual value of the measured physical property. Tolerance may vary depending on whether the Device is linear over its dynamic range.",
        "NORMALIZE_NAME_COMPONENT",
        "C_FFBBEEB41878AC75CD38671CF9A4CECEB2F673622833FAA9EA04376FB4297330",
        "LockAddress",
        "A class to encapsulate a DN",
        "The number of frames transmitted that have not circled the ring within the maximum ring latency.",
        "SMBIOS|Type 4|Processor Information|Status",
        "ting is a Min/Max/Inc or a possible value.",
        "A string that specifies which contract this endpoint is exposing.",
        "The Win32_MemoryDeviceLocation class represents an association between a memory device and the physical memory on which it exists.",
        "EVENT_TRACE_FLAG_RELEASECCFLUSH",
        "MSFT_NetAdapter_ProcessorNumber",
        "MSFT_NetAdapterChecksumOffloadCapabilities",
        "The KeepAliveTime property indicates how often the TCP attempts to verify that an idle connection is still intact by sending a Keep Alive Packet. A remote system that is reachable will acknowledge the keep alive transmission. Keep Alive packets are not sent by default. This feature may be enabled in a connection by an application. Default: 7,200,000 (two hours)",
        "Interrupt",
        "The XOnXOffOutFlowControl specifies whether XON/XOFF flow control is used during transmission.",
        "89CE9BF67AB558DA70C47AAE.2682.3062810708.301",
        "Bitmap -  Prints TrueType fonts as graphics. This is the default action for dot-matrix printers.",
        "HighThresholdOnClientObjects",
        "AllowProjectionToPC",
        "ReplySize",
        "The ServiceSpecificExitCode property specifies a service-specific error code for errors that occur while the service is either starting or stopping. The exit codes are defined by the service represented by this class. This value is only set when the ExitCodeproperty value is ERROR_SERVICE_SPECIFIC_ERROR, 1066.",
        "object:MSNdis_WmiTcpLargeSendOffloadV2_IPv4",
        "0x00000000 ",
        "RestrictedSitesZoneAllowActiveScripting",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Class|InfPath",
        "Service - Indicates a service-type logon. The account provided must have the service privilege enabled.",
        "Other API error",
        "{146360ac-88dd-11dd-94b8-001d09162bc3}",
        "SelectPowerButtonActionOnBattery",
        "MSFT_NetConnectionTimeout",
        "Use Internet Explorer For FTP",
        "ExportByObject",
        "Designates one or more UDP Ports to filter on.  Network traffic is logged when the filter matches. ",
        "EnterpriseIPRange",
        "ifInDiscards",
        "Win32API|DeviceIoControl|IOCTL_SCSI_GET_ADDRESS",
        "Program architecture",
        "WriteCacheSizeDefault",
        "Service From Side",
        "PolicySourceDisconnectedSessionLimit",
        "MS_SM_ScsiInformationMethods",
        "Specifies whether to include managed exception information in the detail of SOAP faults returned to the clients for debugging purposes.",
        "Win32Registry|System\\CurrentControlSet\\Enum\\Root|HWRevision",
        "Win32_SystemAccount",
        "ContentDownloadListenPort",
        "NS_E0090746586FF2B53E60090572D8F454B1EFCE84D6470FDDC572C5F523A110EF\\KI_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB\\I_02B739C3EDAEF0D30BF435DDE3398CB6A025C2810BB0F2FF2E60FB58DCEB2C36",
        "NS_8C31E837D18DD5B2F5A6595D90480BF8E8731F0D7C29001E3F22318EC8F6F6A6\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_8620435B38BE1E99E74C0209777119091A237CDBD9A1C0FEF68B28339128BA61",
        "QueryForestTrustInfo_End",
        "The Rename method renames the logical file (or directory) specified in the object path. Rename returns an integer value of 0 if the file was successfully renamed, and any other number to indicate an error. A rename is not supported if the destination is o",
        "Win32_ProductSoftwareFeatures",
        "A string representation of the vendor defined operational status. This field should only be set if the OperationalStatus array contains 1 - 'Other'.",
        "- software components such as application servers, databases, and applications ",
        "Magneto-Optical Write Once",
        "OperationalStatusDownMediaDisconnected",
        "MSDeviceUI_FirmwareRevision",
        "Power PC Family",
        "The activation frequency, in minutes, of how often KMS-clients will contact the KMS host before they become licensed. The frequency must be greater than or equal to 15 and less than or equal to 43200. An error is returned if the method is called and the computer is not a KMS.",
        "NtlmClientInitialize_End",
        "The operating system's number for the partition. Ordering is based on the partition's offset, relative to other partitions. This means that the value for this property may change based off of the partition configuration in the offset range preceding this partition.",
        "MGR_TRACE_RESERVED_0f Flag",
        "Denotes the object types supported for Deduplication in this subsystem.",
        "{8502C4DF-5FBB-11D2-AAC1-006008C78BC7}",
        "This represents a partition device element.",
        "4 - 'Offline Internal': All newly discovered disks that do not reside on a shared bus remain offline and read-only.",
        "{8502C531-5FBB-11D2-AAC1-006008C78BC7}",
        "OpenTimeout",
        "Non-Zero value indicate display warning before logging off session when maximum idle time is reached. O means otherwise. There is no GP for this setting and can be set only through tsconfig.",
        "SettingsStoragePath",
        "object:PS_VpnServerAddress",
        "object:HNet_ResponseRange",
        "Number of bytes for dot11 MPDU max length change status indication",
        "The ProtectionLevel forContextBindingElement",
        "OMI_Error",
        "The disk is not large enough to support a GPT partition style.",
        "IsStub",
        "SamPwdChng_End",
        "{acf14045-a61c-11d0-8dd4-00c04fc3358c}",
        "Sets the FallBack printer driver to one of:  0=No fallback print drivers, 1=Best guess, 2 = Best guess and if no match is found fallback to PCL, 3=Best guess and if no match is found fallback to PS,  4=Best guess and if no match is found show both PCL and PS drivers.",
        "NS_0634BEAAA6D47E6371999AD405E0DDAFDA3BDAB3659C4858F565936A4909981F\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_1035B0F62EAAECC9C984E7834D0AB6A9928506852D8C840D14F9BAB2AAE4A68B",
        "9 - Wireless",
        "Specifies logical link control (LLC) encapsulation for routed protocols. Also used to indicate Ethernet LLC/SNAP encapsulation.",
        "The print processor needed for this driver.",
        "PCI_BUS_TARGET_ID is valid",
        "Sets security descriptor to the specified structure.",
        "The identifier by which the object is known.",
        "The Rename() allows for the renaming of the group name; a key in this class. The functionality to change the key property \"Name\" is implemented as a method to provide a separate context for the new name distinguishable from the key name associated with the instance to be modified in this class.",
        "AvgFragmentsPerFile",
        "{8502C526-5FBB-11D2-AAC1-006008C78BC7}",
        "ref:MSFT_NetAdapterVPortSettingData",
        "ref:MSFT_NetAdapterLsoSettingData",
        "String with the environment variables expanded",
        "Local Replica Target",
        "CompositeDuplexBindingElement",
        "ConnectIPV4",
        "object:MSNdis_ReceiveFilterParameters",
        "NumericSensorRateUnits",
        "Enable IPsec Task Offload v2 on the network adapter.",
        "0x00000000",
        "ServiceParameters",
        "MDM_Policy_Config01_MSSLegacy02",
        "Example: 42048",
        "Thu, 28 May 2026 15:27:32 GMT",
        "{FAF76B97-798C-11D2-AAD1-006008C78BC7}",
        "Example: 8.  ",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmCollate",
        "The physical element that is linked.",
        "Boolean indicating whether the IRQ can be shared.",
        "CtlGuidWPDCI",
        "TunnledNonEapAuthMethod",
        "MSV1_0DebugTrace",
        "Specifies the certificate signing algorithm to use.",
        "Track Point",
        "{8502C4B3-5FBB-11D2-AAC1-006008C78BC7}",
        "TotalCacheDiskPerUser",
        "CacheServerConnections",
        "SERVICE_ON_SYSTEM_SHUTDOWN",
        "ActiveInputVoltage indicates which input voltage range is currently in use. Range 1, 2, or both can be specified using the values 3, 4, or 5, respectively. If the Supply is not currently drawing power, the value 6 (\"Neither\") can be specified. This information is necessary in the case of a UPS, a subclass of PowerSupply.",
        "CIM_ComputerSystem.Name",
        "Granularity of intermediate moderation interval values supported between the MinimumModerationInterval and MaximumModerationInterval values.",
        "object:__Namespace",
        "ARRAY OF UINT32",
        "MSFT_NetAdapterHardwareInfoElementSetting",
        "ModifyAuditPermissions",
        "The Priority property indicates the scheduling priority of the process within the operating system. The higher the value, the higher priority the process receives. Priority values can range from 0 (lowest priority) to 31 (highest priority)./nExample: 7.",
        "Error",
        "C_AC7BB2CE72891CEE5B24D1161F798647F6D5827CC518A0A64C2F1BC7D1BEC738",
        "CoNDIS Transmits PDUs OK",
        "KDC Address",
        "alLevelStandard",
        "TurnOnCompatibilityHTTPSListener",
        "ref:MSFT_iSCSISession",
        "The platform architecture of the ODBC DSN to remove. Possible values are '32-bit', '64-bit' or 'All'. The default is '32-bit' on a 32-bit process and '64-bit' on a 64-bit process. This is the platform architecture on the remote machine if this command is executed in a remote CIM session.",
        "WebDAV",
        "C_500B791BBFEDD0EF6DC1FA9B56C1442D75CF8FCFADAEBCDCA51CF4251B2B1ECD",
        "The module or rank number of the memory error location",
        "Personal Terminal Server",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services|LeaseObtainedTime",
        "Outcoming",
        "IsDeduplicationEnabled",
        "Modifies an existing VPN connection profile. ",
        "NDIS Vendor Description",
        "RSS Platform Backgroundsync Trace",
        "The Win32_TemperatureProbe class represents the properties of a temperature sensor (electronic thermometer).",
        "Total Excess Fragments",
        "The Win32_SystemNetworkConnections class represents an association between a network connection and the computer system on which it resides.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1353.3692867184.368",
        "Realtime - Indicates a process that has the highest possible priority. The threads of a real-time priority class process preempt the threads of all other processes, including operating system processes performing important tasks, and high priority threads. For example, a real-time process that executes for more than a very brief interval can cause disk caches not to flush or cause the mouse to be unresponsive.",
        "Value Name",
        "AbortReadWriteOnError",
        "0xEFFF001D",
        "Privileges",
        "Returns the VpnServerAddress object",
        "DOT11_MISC",
        "SCSICONTROLLER",
        "{5DAF38AE-F6F8-4d90-8199-EBDE6800EC3B}",
        "object:MSFT_NetBranchCacheClientSettingData",
        "A value that specifies the size, in bytes, of the buffer used for encoding.",
        "The number of active VLAN IDs on the default VPort",
        "3221232491",
        "UniquePortId",
        "PerceivedSeverity",
        "Restore operation requires subsequent resume",
        "Creates a shadow copy using the specified context.",
        "Unlocked",
        "customLinks",
        "default",
        "Model",
        "ScanStateNotifications",
        "Policy name.",
        "The set of configuration names with which to register with the Pull Server.",
        "Determines whether local firewall rules should be merged into the effective policy along with Group Policy settings.",
        "Minimum number of segments that a large TCP packet must be divisible by before offloading to Adapter for segmentation for IPv4 packets.",
        "An association between a ServiceAccessPoint (SAP) and how it is implemented. The cardinality of this association is many-to-many. A SAP can be provided by more than one LogicalDevice, operating in conjunction. And, any Device can provide more than one ServiceAccessPoint. When many LogicalDevices are associated with a single SAP, it is assumed that these elements operate in conjunction to provide the AccessPoint. If different implementations of a SAP exist, each of these implementations would result in individual instantiations of the ServiceAccessPoint object. These individual instantiations would then have associations to the unique implementations.",
        "Default action for unknown threats.",
        "This field indicates the number of bytes that will form a strip in common striping-based resiliency settings. The strip is defined as the size of the portion of a stripe that lies on one physical disk. Thus, Interleave * NumberOfColumns will yield the size of one stripe of user data.",
        "The PartComponent reference represents the Win32_Processor containing the properties of a processor which is running the computer system.",
        "MSMouse",
        "ManuallySelected",
        "The name of the FRU's supplier.",
        "The ClassGuid property contains the Globally Unique Identifier (GUID) that uniquely identifies this Plug and Play device.",
        "MIF.DMTF|Power Supply|002.11",
        "{1E2C2980-F7DB-46AA-820E-8734FCC21F4C}",
        "UDPPort",
        "CD_AD7EFADAD1289B4A3FEF0D60EBF19DD1D014EA7A1302D0431E7F57E3F564CBFB.2152.3457610475.3209",
        "{0a21480c-e35f-11d0-9692-00c04fc3358c}",
        "The scoping device's ID. ",
        "{E79C9694-DB32-11d2-85FC-0000F8102E5F}",
        "SeSystemEnvironmentPrivilege",
        "Vertical refresh rate numerator (Hz)",
        "IdentityRemoting",
        "NewTriggerByWeekly",
        "The available disk space.",
        "If trace guid and enabled, indicates the flags currently used in logging",
        "CR_E4EC3642DBAAC119BB7D98363E08333001320E1E613FB7C4977DB452606906F4",
        "{A502B5A5-B91A-41d1-83D6-BBFA55076333}",
        "The Size property indicates the size of the disk drive. It is calculated by multiplying the total number of cylinders, tracks in each cylinder, sectors in each track, and bytes in each sector.",
        "WmiMonitorListedSupportedSourceModes",
        "MSADCF",
        "Source File Alias",
        "The AdapterRAM property indicates the memory size of the video adapter.",
        "table",
        "SMBIOS|Type 19|Memory Device Mapped Addresses|Ending Address",
        "MSFT_NetIPInterfaceNeighbor",
        "The DeviceType property indicates the physical type of the modem.",
        "ModifyPermissions",
        "50006",
        "TStoLSConnectivityStatus",
        "FDPHost Service Trace",
        "Specifies the number of read operations performed by all processes that have ever been associated with the job, in addition to all processes currently associated with the job.  ",
        "DeferFeatureUpdatesPeriodInDays",
        "MaximumProcessingTime",
        "Win32_OfflineFilesConnectionInfo",
        "CtlGuidWMP",
        "SFT_CliQualifier",
        "Whether to allow unicast responses to multicast traffic.",
        "TCP/IP configuration",
        "19 - CIM_ERR_INVALID_RESPONSE_DESTINATION. The specified destination for the asynchronous response is not valid. ",
        "057E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "{8502C534-5FBB-11D2-AAC1-006008C78BC7}",
        "Optical 50um",
        "CIM_ReplicationServiceCapabilities.SupportedAsynchronousActions",
        "#define ISCSI_HBA_PRESHARED_KEY_CACHE              0x00000001",
        "{0DD082C5-66F2-271F-74BA-2BF1F9F65C66}",
        "Hexadecimal ",
        "{ee0b76cd-314b-41f1-99d4-d4f3b0421430}",
        "UMS Disassociate From Primary",
        "FaultingObjectLocation",
        "x1394",
        "Select",
        "ExtenderNode",
        "41018",
        "TEST_TRACE_RESERVED_1a",
        "{FAF76B67-798C-11D2-AAD1-006008C78BC7}",
        "Small Custom Logo Bitmap Path",
        "LastProfileDownloadIntervalCautionInHours",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.3725407623.180",
        "The OldVersion reference represents the COM component that is automatically emulated by another component.",
        "Win32_PowerSupplyProfile",
        "MaximumQueueSize",
        "Example: 4.0",
        "PrinterNames",
        "The number of bytes of data transmitted without errors through this interface. This value includes bytes in unicast, broadcast, and multicast packets.",
        "HttpServer Flag",
        "IR_A41A2A506F07DE19FA26EBBA5A53B62D2C62BAF775EC8BEA2B152B5D21A711E3",
        "C_BEC7957390E69545622E33DF7D0A224770A47F3DEA408861F4867699D17DC297",
        "5.25, 320KB,  512 bytes/sector",
        "DIALER",
        "BIOSVersion",
        "The method's return code should indicate the success or failure of the quiesce. It should return 0 if successful, 1 if the request is not supported at all, 2 if the request is not supported due to the current state of the Device, and some other value if any other error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier.",
        "CD_92F96D470C0B7C61CA6FF1288FC335BCE4A6A5FC50FC3D3E646C17CCD603F881.2065.884498504.778",
        "CD_EAB63970C0C08943D473111F249624351EB5AAD600FD375231EB2F93F7AA8EFA.1544.729510163.534",
        "{55F7B88D-A254-4B22-B7BB-FCDBBA1AFA32}",
        "// This class allows the default session configuration to be managed. It ",
        "Example: C:\\Winnt",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmBitsPerPel",
        "Determines the fault domain type by which each column in this virtual disk is isolated.",
        "MSFT_MintPipelineExecution",
        "NDIS Status Link Speed Change",
        "ApiSetUnhosted",
        "RebootRequested",
        "Bytes Received",
        "The SetDynamicDNSRegistration method is used to indicate dynamic DNS registration of IP addresses for this IP bound adapter. The method returns 0 on success, and any other number to indicate an error.Windows 2000 only.",
        "The DNSHostName property indicates the host name used to identify the local computer for authentication by some utilities. Other TCP/IP-based utilities can use this value to acquire the name of the local computer. Host names are stored on DNS servers in a table that maps names to IP addresses for use by DNS. The name can be any combination of the letters A through Z, the numerals 0 through 9, and the hyphen (-), plus the period (.) character used as a separator. By default, this value is the Microsoft networking computer name, but the network administrator can assign another host name without affecting the computer name.",
        "{F31EAAD1-7FF7-4C92-B935-F59C0579F931}",
        "Generic_Warn Flag",
        "PacketDirect properties for a network adapter.",
        "Year of manufacture",
        "Digital Separate",
        "WD_LOG_FLAG_MEMORY",
        "Title Bar Custom Text",
        "When the media access device supports multiple individual media, this property defines the maximum number which can be supported or inserted.",
        "SMBIOS|Type 9|Current Usage",
        "The Copy method copies the logical file or directory specified in the object path to the location specified by the input parameter. Copy returns an integer value of 0 if the file was successfully copied, and any other number to indicate an error. A copy i",
        "MSFT_PrinterNfcTag",
        "ErrorInformation",
        "Indicates whether power to the Hub Ports is individually or gang-switched. If this value is FALSE, power is switched individually for each Port. If this value is TRUE, power is switched to all Ports on the Hub at once.",
        "CIM_PolicyAction",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2070.1590554102.368",
        "The DaylightSecond property specifies the second of of the DaylightMinute when the transition from standard time to daylight savings time occurs on this operating system.",
        "The FrontPanelResetStatus property identifies the hardware security settings for the reset button on the machine.",
        "The SpeakerModeOff property contains the command string used to turn the modem speaker off.",
        "\"Degraded\" indicates the ManagedElement is functioning below normal. ",
        "Flag for displaying the notification on settings import",
        "Get the information about the processes monitored by the current settings location template.",
        "ROOT\\cimv2",
        "CD_E4EC3642DBAAC119BB7D98363E08333001320E1E613FB7C4977DB452606906F4.1437.1.105503",
        "RD_TRACE_RESERVED_1a Flag",
        "CD_12B929733A58D0160C0FDFDB23E8B6DD247E7D1693029B77B484D1BBA4C89AC6.2612.1302707197.476",
        "PortalTag",
        "SetNewTabPageURL",
        "BehaviorMonitorEnabled",
        "ProvisioningAuthority",
        "The managed element.",
        "MustBeEmpty",
        "Hypercall Page",
        "RegistryKeyword",
        "object:MSFT_StorageFaultDomain",
        "pipelineDefinitionInstanceId",
        "SetTcpipNetbios [EnableNetbiosViaDhcp|EnableNetbios|DisableNetbios]",
        "Requestor ID at time of the event",
        "Example:10497-OEM-0031416-71674.",
        "Centralized Publishing Server Information Service",
        "StorageEnclosureId",
        "NewTabDefaultPage",
        "I_00A6FEF1B7DB377460CEA9E1CC721F7C9B56A8F48457D47C52B82FAD5B171EF2.2708.2475723418.293",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1780.3650505445.180",
        "HOSTPROC_TRACE_REMOTE_DISPATCHER Flag",
        "MDM_BrowserSecurityZones",
        "11006",
        "Enable state of the settings location template.",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.290.1202345297.2995",
        "S-1-15n",
        "The maximum number of multicast long addresses the NIC driver can manage.",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.1080.4140634058.188",
        "5 Gbps",
        "PingSessionDirectory",
        "MDM_EnterpriseModernAppManagement_AppManagement01_02",
        "Network - This logon type is intended for high performance servers to authenticate clear text passwords. LogonUser does not cache credentials for this logon type. ",
        "Raw Error Record",
        "SendRPL",
        "The rack that contains the chassis.",
        "Last quick scan age in days- if signatures have never been updated you will see an age of 65535 days.",
        "MSNdis_CoReceivePduErrors",
        "egProv\"",
        "HttpHelpPageBinding",
        "Count of Number of Format errors occured in this session",
        "0x200",
        "NDIS Vendor's Driver Version",
        "The BackupLastTime property specifies the date and time the last backup was performed.",
        "The physical package that has a connector.",
        "Associates a network adapter with its Receive Side Scale (RSS) setting data.",
        "Maximum number of outstanding requests per receive queue",
        "C_8E41820F5D3747F37A9AFB4C6D31D95936F76250DC1731B0B518951FA4D1C211",
        "NS_6C47599266B9BA84952719E087E8E66E4BC74C97F7F06A55E52E1C43037AC181",
        "ReceiveLinkSpeed",
        "MCA Memory Hierarchy Error Event",
        "I_DE57F7AE8FB501996807E146319066676112A55DF9DC0135A1A8C6E4EBECC8B8.341.1.89245",
        "BackupRADIUSServer",
        "\"Stressed\" indicates that the element is functioning, but needs attention. Examples of \"Stressed\" states are overload, overheated, etc. ",
        "Response Time Excessive",
        "PCI Component Information - DeviceId",
        "MSFT_ExpressionValue_uint8",
        "Note that in Windows XP and beyond, the WinstationDesktop string property (which previously defaulted to \"winsta0\\default\") is ignored in all cases. The value used in place of this parameter is an empty string (\"\").",
        "// The number of bytes sent using the IPSEC protocol.",
        "UseWinlogonCredential",
        "Server information management. ",
        "{E4B8FE8F-2ACB-4770-9123-68BA91DE248A}",
        "StandbyTimeoutPluggedIn",
        "NDISWMI_TRACE_ENCAP Flag",
        "CD_FCF416010D567B5041BC82F46732C142DC125B68750168BA980728F3E2F25AEF.1149.2212288522.296",
        " The CIM_ExecuteProgram causes files to be executed on the system  where the software element is installed. ",
        "CIM_ClassIndication",
        "SetupExpected",
        "NS_2442BCC28C4B5A2EF54CB557CCCCCCDDEB8CA20A5F8F2C7C0CF36D2475F133F7\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_0A4A8CC499F46BAAE9FF49E6D68BB631793D5F6FAD2719C0358ED54A87A84829",
        "sessionid",
        "object:MSFT_NetTeredoConfiguration",
        "Charging",
        "MSFT_CliAlias.FriendlyName=\"NICConfig\"",
        "IL_A963FF6A8458E9C4FEA354824C031F4237B8648981577F19FD6854C86994DA8C.1797.2375707628.192",
        "IsACSetting",
        "ROOT\\Microsoft\\Windows\\DesiredStateConfigurationProxy",
        "EDRAM",
        "CIM_PowerSupply",
        "PreOpFailure",
        "MSFT_NetImPlatProvider",
        "{266c72e7-62e8-11d1-ad89-00c04fd8fdff}",
        "Specifies how many physical disk failures the virtual disk should be able to withstand before data loss occurs. If specified, this value will override the PhysicalDiskRedundancyDefault value that would have been inherited from the resiliency setting specified by ResiliencySettingName.",
        "A globally unique identifier for the storage subsystem",
        "Win32_NetworkLoginProfile",
        "Example: 31 ",
        "TcpIp_TypeGroup1",
        "HOSTPROC_TRACE_DRVMGR Flag",
        "An array of Supported Operations.",
        "1 - 'Warning': Indicates that the subsystem is still functioning, but has detected errors or issues that may require administrator intervention. ",
        "DH-1024 bit prime",
        "DomainControllerName",
        "MSFT_CliVerb",
        "PnPDeviceId",
        "C_BE638133AD205E7E82E7EE572C3B8A31E527A6DE4CE929382C29EA547A1E1AF4",
        "NlSecChanlSetup_End",
        "createnamedpipe",
        "SMBIOS|Type 18|32-bit Memory Error Information|Error Resolution",
        "{8ecc74e1-ba85-482e-afaf-b4f8b087c06b}",
        "The Name property contains a character string specifying the name of a  environment variable. ",
        "IL_A41A2A506F07DE19FA26EBBA5A53B62D2C62BAF775EC8BEA2B152B5D21A711E3.1489.3205755308.339",
        "Win32_FolderRedirection",
        "AddServerCertificateMapping",
        "AMD Athlon(TM) 64 Processor Family",
        "Fast-paged",
        "FEPROM",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|InfSection",
        "CreatedStoragePool",
        "PolicySourceColorDepthPolicy",
        "Values: TRUE or FALSE. A value of TRUE indicates the order of data sent is guaranteed.",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_last_logon",
        "The number of files that currently qualify for optimization.",
        "CIM_SoftwareInstallationService.InstallFromURI(InstallOptions)",
        "{56B396A8-0B95-42fe-BBCE-D36FDA904F8E}",
        "CSwitch",
        "MfgDomain",
        "SHUTDOWN Flag",
        "%Action%",
        "3 = The application was already installed in the user's profile ",
        "MCA_WARNING_PCI_BUS_SERR_NO_INFO",
        "This method is used to set the one time boot source for the next boot on this computer system.",
        "UdpIp_V0",
        "IMAPI2 Concatenate Stream",
        "ConfigureMicrosoft365UploadEndpoint",
        "The name of the product's supplier. Corresponds to the Vendor property in the product object in the DMTF Solution Exchange Standard.",
        "The Metric2 property contains an alternate routing metric for this route. The semantics of this metric are determined by the routing protocol specified in the route's ipRouteProto value. If this metric is not used, its value should be set to -1.",
        "The BootPartition property determines whether the partition is the active partition. The operating system uses the active partition when booting from a hard disk.",
        "Printable ASCII",
        "Number of items in list of 802.11 network types",
        "The SetTcpNumConnections method is used to set the maximum number of connections that TCP may have open simultaneously.",
        "The Win32_AllocatedResource class represents an association between logical devices and system resources. This class is used to discover which resources, such as IRQs, or DMA channels, are in-use by a specific device.",
        "RSOP_PolmkrSchedTaskV2Setting",
        "The Resolution property indicates the tracking resolution.",
        "CD_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C.0.2208768175.275",
        "This method invokes the chkdsk operation on the disk. The method is applicable to only those instances of logical disk that represent a physical disk in the machine. It is not applicable to mapped logical drives. The return value of the method will indicate one of the following - Success - Chkdsk completed, Success - Locked and chkdsk scheduled on reboot, Failure - Unknown file system, Failure - Unknown error.",
        "RequiresReinstall",
        "C_329DCF22CC9EA0788BB9C3FFFB20B99F00D18849EEFBD38BCC78B3640485E3D9",
        "The Hardware property indicates whether the interrupt is hardware or software based. A hardware IRQ is a physical wire from the peripheral to the programmable interrupt controller (PIC) chip through which the CPU can be notified of time critical events. Some IRQ lines are reserved for standard devices such as the keyboard, floppy disk drives, and the system clock. A software interrupt allows applications to get the attention of the processor.",
        "MediaConnectState",
        "MIF.DMTF|Temperature Probe|001.12",
        "PLATFORM_TRACE_RESERVED_0f Flag",
        "Install Error",
        "ATM VCI Endpoint",
        "NDIS Query Link State",
        "A2F0F731789B8BD6294886FFBA95B74CEA7B86072988F101ACF53FD6E840B35A",
        "MSDADIAG.ETW formatted output (W)",
        "SamQueryInfoUser_End",
        "SYSTEM",
        "select * from Win32_ThreadStopTrace",
        "The privileges property specifies the level of privilege assigned to the name property.",
        "EVENT_TRACE_FLAG_LASTACCESSTIME",
        "A power supply device",
        "CD_7A2E82FAA3D7445BB721477AEF5A828AA728D419801621CF35B28E55DA9D6FA6.1745.3436595000.475",
        "Number of bytes of data read and streamed.",
        "Removable Disk",
        "MDM_PassportForWork_Policies02",
        "R_E091E6755173CEDA0C35AF424854DECB26CF90627B78F06DB8E87E6ED8C5E2E3",
        "Size of RLIR buffer",
        "A boolean value that indicates whether messages received by this binding should be locked when received.",
        "The SetDateTime method sets the current system time on the computer.  On computer systems running Windows NT/2000, the calling process must have the SE_SYSTEMTIME_NAME privilege./nThe method returns an integer value that can be interpretted as follows: /n0 - Successful completion./nOther - For integer values other than those listed above, refer to Win32 error code documentation.",
        "DesktopName",
        "AutologgerName",
        "The WriteRegistryValues action sets up registry information that the application desires in the system Registry. The registry information is gated by the Component class. A registry value is written to the system registry if the corresponding component has been set to be installed either locally or run from source.",
        "Unrecognized Metadata",
        "counts per inch",
        "FLUSH_BUFFERS",
        "Number of times the stream has paused due to insufficient stream buffers.",
        "Win32API|SCSI Structures|SCSI_REQUEST_BLOCK|Lun",
        "C_857A93520BEDC9F703DB461D5CC8192FB10A25C77E5665D06DE039388F19CB72",
        "NoEncapsulation",
        "CD_20A36A4D13FFEDA4F3BF68F20D7254C0839ABA34ECA738010C8AC2B49156D61F.2115.1218701693.1466",
        "TcpIPv4",
        "R_43D2FF9F27C9DEB49402058FFFFEABC225D67F17C30DC663FA2980525D05DB01",
        "TelemetryOptIn",
        "The aggregate physical extent participating in the redundancy group.",
        "Degrees F",
        "The percentage free space on the volume.",
        "C_DA6435B5A6AFDE1EA49B0F1FA576B2FE264B6CCD6A9F163C86C6173386BDC535",
        "CertificateBlob",
        "ServiceAuthorizationManager",
        "The number of active MAC addresses on the default VPort.",
        "UdpIp Fail",
        "LUAInstall: error 0x00000005 setting flags [{935249A5-B5E8-43F6-A991-61435E5954B3}]",
        "RunOnLastWeekOfMonth",
        "TraceDriver",
        "The CoolSwitch property indicates whether fasttask switching is turned on. Fast task switching allows the user to switch between windows using the ALT+TAB keyboard combination.",
        "DiscoverBootDevice",
        "CreateVirtualPortEx",
        "NdisStatusMediaSpecificIndication",
        "The permanent MAC address of the Virtual Function.",
        "WtGm&",
        "Server Offline",
        "FX_TRACE_INIT Flag",
        "Local Processor Responded To Request",
        "CD_9908FF01855D016DB247597026090F753BADB4AD0E4EFB1386220A76CAD43211.2557.841580195.680",
        "Destination Protocol Unreachable",
        "MSFT_CliAlias.FriendlyName=\"Environment\"",
        "The SetTcpWindowSize method is used to set the maximum TCP Receive Window size offered by the system. The Receive Window specifies the number of bytes a sender can transmit without receiving an acknowledgment. In general, larger receive windows improve performance over high delay and high bandwidth networks. For efficiency, the receive window should be an even multiple of the TCP Maximum Segment Size (MSS). The method returns an integer value that can be interpretted as follows: ",
        "Friendly Name",
        "Current link width (1, 2, 4, .., 32), valid only for PCI-E devices.",
        "PolicySourceStartIn",
        "RSOP_SystemServiceBlocked",
        "AdminDomain",
        "object:VpnConnectionTriggerDnsConfiguration",
        "Closing",
        "TargetProcessors",
        "Example: 2 25 (Male RS-232)",
        "Boot Configuration",
        "C_1DC5050B83682C310993D0E23C7DB3EBF7DFCB3434893B4CCE67A03B9E83366B",
        "LoaderCodedEventStatus",
        "Reference to the SOM or scope of management associated with this link",
        "Additional availability and status of the Device, beyond that specified in the Availability property. The Availability property denotes the primary status and availability of the Device. In some cases, this will not be sufficient to denote the complete status of the Device. In those cases, the AdditionalAvailability property can be used to provide further information. For example, a Device\\'s primary Availability may be \"Off line\" (value=8), but it may also be in a low power state (AdditonalAvailability value=14), or the Device could be running Diagnostics (AdditionalAvailability value=5, \"In Test\").",
        "PowerConsumption",
        "MIF.DMTF|Memory Device Mapped Addresses|001.4",
        "GslbFqdn",
        "The state requested for the element. This information will be placed into the instance's RequestedState property if the RequestStateChange method's return code is 0, 3, or 4096 (0x1000) - 'Completed with No Error', 'Timeout', or 'Job Started' respectively. Refer to the description of the EnabledState and RequestedState properties for the detailed meanings of the RequestedState values.",
        "The DataExecutionPrevention_SupportPolicy indicates which one of four Data Execution Prevention (DEP) settings is applied. Each setting varies by the extent to which DEP is applied to 32-bit applications.  Note that DEP is always applied to the Windows kernel. Always On (not available in the user interface) indicates that DEP is enabled for all 32-bit applications on the machine with no exceptions. OptOut indicates DEP is on by default for all 32-bit applications and that a user or administrator must explicitly remove support for a 32-bit application by adding to an exceptions list. OptIn indicates DEP is on for a limited number of binaries, the kernel, and all Windows services but it is off by default for all 32-bit applications; a user or administrator must explicitly choose the AlwaysOn (not available in the user interface) or OptOut setting before DEP can be applied to 32-bit applications.  AlwaysOff (not available in the user interface) indicates DEP is turned off for all 32-bit applications on the machine. ",
        "The enclosure does not support setting the power of the enclosure element.",
        "0xEFFF0012",
        "CD_65C33823125A389998EE918715634996D26443DD7799EEDA88DD0650D03B9936.2066.2958395638.778",
        "NegotiationTimeout",
        "Additional Sense Code",
        "Nickel Cadmium",
        "Sampled Profile Interval",
        "FadtDutyWidth",
        "Example: Base Board",
        "Home Page URL",
        "SetPagePriority",
        "Kernel Queue Enqueue Event",
        "RDToggle",
        "This field indicates the physical sector sxSizeInGB",
        "WRITE_OWNER",
        "TR_CRYPTO",
        "The count of currently active KMS clients on the KMS host. -1 indicates the host is not enabled as a KMS, or has not received any client licensing-requests.",
        "Supplies the setting for NS offloads on the adapter.",
        "{B9A8CFD5-8D72-47a4-AC0E-284A3200F4FB}",
        "    // Number of elements in RedirectPortalList array",
        "C_C013BAEF52C1702952D5C4A7F180A34E20C7F843E3022D39040318DA1B2232C2",
        "EnableVirtualizationBasedSecurity",
        "SetBinaryValue",
        "TypeOfRack",
        "ResiliencySettingName",
        "5 - Windows Server 2003, Small Business Edition Restricted ",
        "GetConfigurationStatus",
        "Specifies attributes of the LUID. This value contains two 32-bit flags. Its meaning is dependent on the definition and use of the LUIDSpecifies attributes of the LUID.",
        "TotalFragmentedFiles",
        "The type of memory. This is a part of the object key. Values correspond to the list of possible memory types in the CIM_PhysicalMemory class.",
        "C_156B8A4042E45863463CBEA7606B8486296C5FD66B55B4AAA7739008B570D8EB",
        "Example: The dynamic host configuration protocol (DHCP) client service on a Windows NT/Windows 2000 computer system.",
        "Predictive Failure",
        "QUARANTINE",
        "SectorsPerReadMask",
        "TotalExcessFragments",
        "MCA_WARNING_TLB",
        "Notify App Changes (No Dim)",
        "CIM_Product",
        "The InstanceID of the QuickModeCryptoSet to use for Quick Mode.",
        "NdisCurrentPacketFilter",
        "Example: public.",
        "(receive-line-signal-detect) supported",
        "AccessViolation",
        "If true, allow only local user profiles.",
        "MDM_DeviceStatus_Antispyware01",
        "HOSTPROC_RESERVED_14 Flag",
        "The unique name of this endpoint.",
        "A DiscreteSensor has a set of legal string values, that it can report.  These values are enumerated in the Sensor's PossibleValues property.  A DiscreteSensor will always have a 'current reading' that corresponds to one of the enumerated values.",
        "CSDVersion",
        "SystemDevice",
        "SEL_RECORD_TYPE",
        "AllowBasicAuthentication_Client",
        "Bus master latency in microseconds",
        "OfflineCollectionStatus",
        "(1.0,0.4)[V]",
        "ref:Win32_PageFileUsage",
        "WPD_TRACE_LEVEL_ASSERT Flag",
        "WmiGetMonitorRawEEdidV1Block",
        "    ISCSI_IP_ADDRESS_IPV4 = 1,",
        "The user SID or name filter match condition.",
        "installationType",
        "Specifies which finishings and other capabilities of the Printer are currently being used. An entry in this property should also be listed in the Capabilities array.",
        "The Name property contains the human-readable name for the COM class.",
        "MsftDiscFormat2RawImage_DebugGeneral Flag",
        "The Parity property indicates the type of parity used",
        "TelemetryProxy",
        "CR_C4F661973CD3C0A0D2984AF60EF23047396681C367251D4E47D1DDBCE0BCDFE6",
        "CD_E5C7C1FE3E6D7A2A16D7E74AFFD769F1A6084374257017AE4D85D9B4B8AA55D8.1163.2383880963.298",
        "The rule.",
        "MSiSCSI_TCPIPConfig",
        "CD_E69678D95075FB6BA6844B84FE0DE69C85BE49AC691754C5A6AA3AE728E45697.93.4250014313.1847",
        "SubscriptionError",
        "ManualStepsAndOfflineScanRequired",
        "RequestParameter",
        "This method is used to exclude volumes from the chkdsk operation to be run at the next reboot. If not excluded, chkdsk is performed on the volume if the dirty bit has been set for the disk. Note that the calls to exclude volumes are not cumulative. That is, if a call is made to excluded some volumes, then the new list is not added to the list of ones that were already marked for exclusion, instead the new list of volumes overwrites the previous one. The method is applicable to only those volume instances that represent a physical disk in the machine and is not applicable to mapped logical drives.",
        "ENDMENT",
        "The Name property contains a character string specifying the name of an environment variable. ",
        "FreeListLength",
        "CD_15544B0DAFDF759BD10B745F7A926F46821115EF3BE25FE076FC3A533C317B2D.2041.1723925235.421",
        "I_0F7F13DE43E9D814455F803EB91230753AE96BA9DA56B4E4422BA553F2EB4174.2693.3174317615.257",
        "Value of the storage health setting being set.",
        "RemoveInitiatorId",
        "OSType",
        "CIM_CollectionOfSensors",
        "MFTFragmentCount",
        "Color Printing",
        "DODownloadMode",
        "PolicySourceProgramList indicates whether the property ProgramList is configured by Server (0) or Group Policy (1).",
        "Dot11 Roaming Start status information.",
        "CD_F3ED82F33431603D84B59AD5C9C4CA59DF4FDC6F04E98BD4826D692A26D5A5C0.94.3343714706.769",
        "The iSCSI service timed out waiting for all persistent logins to complete.",
        "Frequency_Object",
        "EndBoundary",
        "SetSecurityDescriptor",
        "Bid2Etw_MSADCE_1_Trace",
        "TM_FSM Flag",
        "ref:Win32_OfflineFilesItem",
        "The size beyond which the 802.11 device should invoke the RTS/CTS mechanism",
        "LUAInstall: error 0x00000005 setting flags [{92ED88BF-879E-448f-B6B6-A385BCEB846D}]",
        "The maximum value of a numeric parameter.",
        "InterrogateService",
        "MIF.DMTF|Electrical Current Probe|001.15",
        "MSFT_NetEventCaptureTarget_CaptureProvider",
        "{8e0e93fb-76ad-42ee-8770-b9dfea596f65}",
        "MaskingSet",
        "The name of the ODBC driver for the new ODBC DSN. You cannot use wildcard characters.",
        "AllowModuleOverwrite",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_EXPEDITED_DATA",
        "Line Art",
        "SelectNetworkAdapter",
        "Local IP Address",
        "The TypeDetail property indicates the type of physical memory. ",
        "Specifies the security limitations for the job.A value of No Administrator prevents any process in the job from using a token that specifies the local administrators group.A value of Rescricted Token prevents any process in the job from using a token that was not created with the CreateRestrictedToken function.A value of Specific Token forces processes in the job to run under.A value Filter Tokens of applies a filter to the token when a process impersonates a client. Requires at least one of the following properties to be set - SidsToDisable, PrivilegesToDelete, or RestrictedSids.",
        "Peak Non-Paged Pool Usage Quota",
        "The size of the page file on the volume.  If there is no page file on the volume this property will be NULL. This property is deprecated because page file fragmentation is no longer available. The value returned for this property will always be zero.",
        "ActivationType",
        "Application Compatibility bit.",
        "<LocalID> is chosen by the business entity and should not be re-used to identify different underlying (real-world) elements. ",
        "DisableProxyChange",
        "Win32API|Printing and Print Spooler Structures|JOB_INFO_4|pDriverName",
        "ref:MSFT_Partition",
        "AllocationGranularity",
        "Win32_PowerSettingSubgroup",
        "TotalPages",
        "The MessageOriented property indicates whether the protocol is message-oriented. A message-oriented protocol uses packets of data to transfer information. Conversely, stream-oriented protocols transfer data as a continuous stream of bytes.",
        "The value of the argument.",
        "LargeSendOffloadV2HardwareCapabilities",
        "This property gets/sets whether to wake up the machine to start maintenance",
        "C_065EB15DF476F783A483B00F674DFF856DF35C72E87B7E414EE69BE5DF4E9372",
        "The roaming profile path to be set for all users that log on to this computer. The path should be in the form of \\\\ComputerName\\ShareName\\%USERNAME%.",
        "Maximum number of scripts run before the consumer will start a new instance.  The consumer should be shut down periodically to clear out memory leaks from the scripts.",
        "Drive Not Root Directory",
        "00000000001500.000000:000",
        "SetDNSServerSearchOrder",
        "49000",
        "REDBOOK_WMI_SECTORS_PER_READ",
        "SNA Address",
        "File Extensions owned by an Application on a Terminal Server",
        "ZzKh:",
        "GetServerWeight returns the Server weight value used in Session Broker Load Balancing.",
        "Specifies provider-specific data. Applications should ignore this member unless they have detailed information about the format of the data required by the provider.",
        "SD Bus Trace",
        "An integer indicating whether a hardware-level password is enabled at the keyboard (value=4), preventing local input. Other values are:  \"Disabled\" (3), \"Not Implemented\" (5), \"Other\" (1) and \"Unknown\" (2).",
        "CIM_Account is the information held by a SecurityService to track identity and privileges managed by that service. Common examples of an Account are the entries in a UNIX /etc/passwd file. Several kinds of security services use various information from those entries - the /bin/login program uses the account name ('root') and hashed password to authenticate users, and the file service, for instance, uses the UserID field ('0') and GroupID field ('0') to record ownership and determine access control privileges on files in the file system. This class is defined so as to incorporate commonly-used LDAP attributes to permit implementations to easily derive this information from LDAP-accessible directories. ",
        "WriteCacheEnabled",
        "MinVoltage",
        "R_838E13828F10196D3F66F7B92E25AEB70BD0868AFEF218970174CFCF1AE4D54E",
        "TRACELEVELTWO",
        "PopulateVolumeProperty",
        "Hardware Type",
        "CurrentTimeZone",
        "Network adapter cannot be removed by the user.",
        "{b027a21f-3cfa-4125-800b-3f7a18fddcdc}",
        "46001",
        "MSKeyboard_ExtendedID",
        "V1_DriverCompleteRequestReturn",
        "R_33B0A3C692AD567B6C92E618FD5072156CC98A3BCAA3A93CB3F15A5E87E34AD2",
        "CIM_Capabilities",
        "ChangerData",
        "The maximum number of service objects that can execute at one time.",
        "The number of frames transmitted without errors.",
        "LanConnectionCount",
        "TCPCopyIPV4",
        "CD_CA5E03B6357EEF3C2F92CFD39219BA6C5D6285B9E53EBC324CA96967ADC89A91.1520.166928778.662",
        "SetIntegerListElement",
        "CR_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D",
        "ching describes the kind of input voltage range switching that is implemented in this PowerSupply. For example, autoswitching can be specified (value=4).",
        "CD_3C3DC1FC0A2C3362852034A421CA1C0F5DEFC85E5D2010545B210907E075E4DF.1192.4026624119.246",
        "toolbarButtons",
        "The RemoteServerName property indicates the name of the remote server where the application is activated.",
        "TRACE_CLASS_CONTEXT Flag",
        "NDIS Current Packet Filter",
        "ProximityApps",
        "The ExitStatus property contains the exit status of the stopped process ",
        "MsftEnumDiscRecorder2_DebugGeneral Flag",
        "OtherSeverity",
        "RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows",
        "RD_TRACE_RESERVED_1e",
        "ImageFileName",
        "WWPNPhysicalPort",
        "{08FFAD62-8050-11d2-90CE-0060081A46FD}",
        "Describes iSCSI Initiator Paths",
        "The ThreadWaitReason property indicates why the thread is waiting. The value is only valid if the ThreadState member is set to Waiting. Values of 0 or 7 denote that the thread is waiting for the Executive, 1 or 8 for a Free Page, 2 or 9 for a Page In, 3 or 10 for a Pool Allocation, 4 or 11 for an Execution Delay, 5 or 12 for a Suspended condition, 6 or 13 for a User Request, 14 for an Event Pair High, 15 for an Event Pair Low, 16 for an Local Procedure Call (LPC) Receive, 17 for an LPC Reply, 18 for Virtual Memory, 19 for a Page Out. 20 and higher are not assigned. Event Pairs allow communication with protected subsystems (see Context Switches).",
        "Charging and Critical",
        "AntimalwareInfectionStatusProv",
        "R_E991E45745117956DEAFF1C67CF04DB972E8AC05E236ED8130C434E25D63E63D",
        "EnableHomeButton",
        "milliwatt-hours",
        "{64A552E1-6C60-B907-E59C-10F1DFF76B0D}",
        "This method is used to change the order of boot sources for the persistent boot configuration specified by the property CIM_PhysicalComputerSystemView.PersistentBootConfigOrder.",
        "VpnConnectionTriggerTrustedNetwork",
        "MDM_Policy_Result01_Audit02",
        "The SetIPXFrameTypeNetworkPairs method is used to set Internetworking Packet Exchange (IPX) network number/frame pairs for this network adapter. Windows 2000 and Windows NT 3.51 and higher use an IPX network number for routing purposes. It is assigned to each configured frame type/network adapter combination on your computer system. This number is sometimes referred to as the \"external network number.\" It must be unique for each network segment. If the frame type is set to AUTO, the network number should to zero. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "C_35B1B65B914DF07FAC7860C3407AEAACB382311D5C7C7979B2E9A007C56D4FA3",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.185318268.231",
        "Previous Data",
        "CI_FD3BBD4C42AC2F7FEF264340A9EB78A581FE5C28561CB63EDF780B329EAC2EE4",
        "CIM_AggregatePSExtent",
        "GetElementWithFlags",
        "dsccore",
        "Replaces current CIPolicy with policy given by FilePath",
        "The principal used to carry out operations on the server. ",
        "See CIM_NumericSensor.UpperThresholdNonCritical for details.",
        "SessionPoolAllocFree",
        "Base board (also known as a motherboard or system board) management.",
        "NewOwnerSID",
        "StartType",
        "The frequency (in hertz) at the low end of this powersupply's input frequency range 1. A value of zero implies DC.",
        "C_5001D415C6B6A7F33344EC2166974BCA3ED1A6D95B9DFF048A69B10233E39F47",
        "Certificate Services Client CredentialRoaming Trace",
        "Account Realm",
        "I_0E9849D44E8A92F007CC7648B79CBD989C2CF28FF06279CDB1EDDE6F58A57E3C.2721.743607737.281",
        "{8502C4BF-5FBB-11D2-AAC1-006008C78BC7}",
        "String array of the programs that are configured to use Virtual IP.It could be just a program name or the full binary path.",
        "Automount",
        "MIF.DMTF|BIOS Characteristic|003.4",
        "{F681E6CC-EC6C-4ee9-90A6-C0C4E83276C2}",
        "LicenseKeyType",
        "FX_TRACE_WIN32_IOTARGET",
        "DNS suffix of the VPN connection",
        "The BootDevice property indicates the name of the disk drive from which the Win32 operating system boots. ",
        "AddByLprPort",
        "iSCSI Static Connection Statistics Information",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.2051.1.14291",
        "SyncMaintained",
        "Reverse Roles operation requires Fractured state",
        "Identifies the event within the NT Eventlog logfile.",
        "Write Corrected Without Delay",
        "Uploading",
        "WFAPIGP",
        "LogFlagTransferDetails",
        "SendRLS",
        "Cannot remove a volume GUID path.",
        "Select * from WIN32_CACHEMEMORY",
        "Specifies a security identifier (SID).",
        "The Name property is a string representing the inherited name that serves as a key of a logical file instance within a file system. Full path names should be provided. ",
        "Category ID - Enumeration",
        "SDBUS_DEBUG_TRANSFER Flag",
        "File Path Operation",
        "The PhysicalAdapter property specifies whether the adapter is physical adapter or logical adapter.",
        "This method registers a subsystem to be managed by this provider. Note that the subsystem must be compatible with the provider software.",
        "AllowLanguageFeaturesUninstall",
        "{A7B05028-DB2A-11d2-85FC-0000F8102E5F}",
        "The maximum number of bytes that can be transferred by this DMA channel. ",
        "ClientDebug Flag",
        "SERVICE_CRITICAL_FAILURE",
        "__ArbitratorConfiguration",
        "The DriverName property specifies the name of the Win32 printer driver.",
        "I_2381C996A59A0D1EB6DDD79E1C697FECC05884247B858E341AE1AAFDFB086D7B.1197.2250181767.316",
        "DOT11_PNP Flag",
        "FullScanAndManualStepsAndOfflineScanRequired",
        "AMLIEvalData1_TypeGroup1",
        "RequestStateChange changes the state of a job. The possible values are as follows: ",
        "_DH_WMP_SYNCMGR",
        "LPC_TRACE_RESERVED_1b Flag",
        "The returned Parameter Savable bit of 1 indicates that page parameter data is savable.",
        "FT_CliQualifier",
        "PLATFORM_TRACE_RESERVED_14",
        "The device number for the enclosure on this storage node.",
        "{0F73ED54-8ED9-11d2-B340-00105A1F8569}",
        "The InterfaceType property indicates the interface type of physical disk drive.",
        "Indicates if BranchCache is enabled",
        "CD_EC218CCE39B1A69692B8F67C46683B41BCCB3079635712D8AAB3061393D01076.66.1377918102.190",
        "GetActions",
        "HeaderDigest",
        "I_866A032D6B2FE1717CF10787541C36C6A6484D51105E647FF1A0225D5CEBCD96.1475.1829273927.329",
        "CIM_PrintJob.Finishing",
        "CR_92D90F38218063ED84DEBF091001DAB75383FEA23B31338C700BDB5B69D9A383",
        "The key for the registry value.",
        "IgnoreLanguage",
        "Win32_PerfRawData",
        "{523A581F-EC58-40CE-99D3-36BF7897F3EC}",
        "384-bit Elliptic-Curve DSA",
        "CIM_PhysicalFrame.ServiceDescriptions",
        "TEST_TRACE_RESERVED_07 Flag",
        " priority action. Set to -1 if not used.",
        "Contains the parameter for the background upload of a roaming user profile's registry file while the user is logged on.",
        "#define HBA_EVENT_PORT_UNKNOWN          0x200",
        "CreateFileServer",
        "NDIS ATM Supported AAL Types",
        "The GUID of the domain. This member will be zero if the domain controller does not have a Domain GUID (for example, the domain controller is not a Windows 2000 domain controller).",
        "In use",
        "DisallowCloudNotification",
        "MSFC_FibreChannelAdapter",
        "PowerSupplyOperationalStatus",
        "ref:RSOP_ExtensionStatus",
        "CR_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416",
        "Hardware Malfunction",
        "This parameter indicates whether objects in this subsystem are automatically clustered.",
        "\\\\.\\ROOT\\CIMV2:__Win32Provider.Name=\"Win32_WinSAT\"",
        "0x209",
        "NumActiveDefaultVPortVlanIds",
        "msieee80211PolicyReserved",
        "CD_E9A271CDB0AA8DC93908354AF625A7677ECC24A76A0652A26604EE491F530085.1543.3553280417.521",
        "IntranetZoneAllowScriptlets",
        "41004",
        "CapabilitiesFlags",
        "Win32Registry|Software\\Microsoft\\Windows\\CurrentVersion|CurrentType",
        "MIF.DMTF|Electrical Current Probe|001.9",
        "AutoSharing",
        "Bid2Etw_ODBC_1_Trace_TextW",
        "HV_Hypercall",
        "The SetMTU method is used to set the default Maximum Transmission Unit (MTU) for a network interface. The MTU is the maximum packet size (in bytes) that the transport will transmit over the underlying network. The size includes the transport header. Note that an IP datagram may span multiple packets. Values larger than the default for the underlying network will result in the transport using the network default MTU. Values smaller than 68 will result in the transport using an MTU of 68. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "**typedef** Types of initiator node failure",
        "42m;42m;",
        "CompressionOff",
        "MaximumCapacity",
        "OldAllocAddress",
        "SetTrstedDomInfoByNam",
        "Event Trace Rundown Complete",
        "POINTER_PORT_WMI_STD_POINTER",
        "Bid2Etw_ADODB_1",
        "This method removes one or more physical disks from manual allocation.",
        "26     Windows is still setting up this device. ",
        "Restarts a print job in a print queue.",
        "Both Range 1 and 2",
        "LUAInstall: error 0x00000005 setting flags [{9440861a-25ca-4bc2-833e-866a6191d110}]",
        "Phone Number",
        "SystemConfig_V2_NumaNode",
        "Specifies the Permissions that to be allowed. The permissions are a combination of one ore more of the following:WINSTATION_QUERY, WINSTATION_SET, WINSTATION_VIRTUAL | STANDARD_RIGHTS_REQUIRED, WINSTATION_SHADOW,WINSTATION_LOGON, WINSTATION_LOGOFF, WINSTATION_MSG, WINSTATION_CONNECT, WINSTATION_DISCONNECT.",
        "PortableDeviceAPI_General",
        "Localized version of RSOP_PolmkrImmediateTaskSetting for American English",
        "CommunicationStatus",
        "UUUUUUU",
        "System memory",
        "SystemConfig_V0_NIC",
        "Select * from Win32_LogonSession",
        "The portal's network address",
        "OnDemandFileExtension",
        "IL_A9B3DD9EA49BF66D41F4D4C9CD5CC3BDC374E6A4B1AA37DFD45950011CE94B7E.2696.1905370396.277",
        "The StopFileName output parameter is a string representing the name of the file/directory where CompressEx failed. StopFileName will be null if the method succeeds.",
        "RSOP_PolicySettingBlocked",
        "PrinterName",
        "\\Microsoft\" would be returned as \"01:\\SOFTWARE\\Microsoft\". The registry roots returned are defined as follows:RootReturned Value",
        "MEM_DEVICE is valid",
        "DownForeLimitPct",
        "Original",
        "User account management.",
        "NS_0634BEAAA6D47E6371999AD405E0DDAFDA3BDAB3659C4858F565936A4909981F",
        "C_DC39EB125CD5896A582C9CCFCFEF5267AF9611EEF285D00CC4FF5DF7F8AE6FFC",
        "Processors APIC Id",
        "If TRUE, the initiator must wait for an R2T before sending data to the target.  If FALSE, the initiator may send data immediately, within limits set by FirstBurstSize and the expected data transfer length of the request.",
        "Disconnected",
        "Number of inbound RDMA connections established successfully",
        "MSFT_TaskAction",
        "SMBIOS|Type 16|Location",
        "Current target idle state",
        "\\\\.\\root\\cimv2\\mdm\\dmmap:__Win32Provider.Name=\"DMWmiBridgeProv1\"",
        "StackKeyKernel",
        "MDM_WindowsDefenderApplicationGuard_Audit01",
        "CIM_ProtocolEndpoint",
        "TcpIp",
        "Determines the allocation behavior for this virtual disk. Enclosure aware virtual disks will intelligently pick the physical disks to use for their redundancy. If TRUE, the virtual disk will attempt to use physical disks from different enclosures to balance the fault tolerance between two (or more) physical enclosures.",
        "PCI_BUS_CMD",
        "StateValue",
        "CompartmentGuid",
        "SessionsLoggedOff",
        "MonitorSourceModes",
        " The maximum version of a software elements being checked.",
        "$&m;$&m;",
        "ReplicasPerSourceMirrorMax",
        "MEM_MODULE",
        "MSNdis_TokenRingCurrentFunctional",
        "ReceiveErrorHandling",
        "CustomSurrogate",
        "Values: TRUE or FALSE. If TRUE, SMBIOS is on this computer.",
        "MSFT_NCProvAccessCheck",
        "ref:CIM_Battery",
        "An array of Win32_ACE entries that specify access to the object",
        "This is the device path.",
        "CD_8D338BAABD5A4CDE9CD22C60F5FCC1F5326D81FC7BA6D48335E5E3513B7182CB.149.848820524.651",
        "InitiatorCookie",
        "The Manufacturer property indicates the name of the manufacturer of the infrared device .",
        "Not Ready",
        "CIM_Job.RunDayOfWeek",
        "EDID map block",
        "Opt Out",
        "object:MSFT_NetAdapterQosSettingData",
        "customFavorites",
        "The CheckPoint property specifies a value that the service increments periodically to report its progress during a lengthy start, stop, pause, or continue operation. For example, the service should increment this value as it completes each step of its initialization when it is starting up. The user interface program that invoked the operation on the service uses this value to track the progress of the service during a lengthy operation. This value is not valid and should be zero when the service does not have a start, stop, pause, or continue operation pending.",
        "DOT11_PAM",
        "Example: \\\\infosrv1\\public",
        "VendorSetup",
        "DriverList",
        "CD_BBFCCB444CF66AA09AE6F15967A6865175BB0ED216D19970A7988B72CDF0A3A4.297.1386819367.2068",
        "The name that should be on the certificate.",
        "CPU Speed in MHz",
        "SourceOrganization",
        "MaxSizeInMB",
        "CD_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2.12.1651994020.792",
        "tall: ",
        "AllowStandardUserEncryption",
        "MSLSA_LookupIsolatedNameInTrustedDomains_TypeGroup1",
        "Slot 2",
        "CIM_Privilege",
        "GetIdentificationField",
        "MSNdis_TransmitsError",
        "NS_1EBEBCBF50415CCAFB547032CB72DA91A6E1A4AA2EBD10A138F0B7ED132BF57C",
        "PhysicalDiskOffset",
        "0xC0000021",
        "CR_F888AA6AC586756C18E219B06406D7BCD62E2EB0C94B51FB48F127652DA7E3EB",
        "OriginalAttributes",
        "State type",
        "The PelsWidth property indicates the width of the displayable surface.  This property is not used for printers.",
        "MSChangerProblemEvent",
        "    MachineCertifiacateEKUFilter (string[]) Specifies the EKU filters for Machine certificate selection",
        "The NumberOfLogicalProcessors property specifies the total number of logical processors.",
        "The Name property indicates the name of the system account on the domain. ",
        "Frequency_Sys100NS",
        "CD_CE0403D1F6C8F032B580CC54FFD1B59326317C97C1A606939745A3B9BE941D11.1793.3676170971.268",
        "MI_ERRORCATEGORY_DEADLOCK_DETECTED",
        "The scoping storage extent's DeviceID.",
        "MSFT_NetAdapterPowerManagement_Offload_RsnRekey",
        "Array of Idle States",
        "CIM_Account",
        "CurrentManagementFirmwareBuildNumber",
        "Locally unique identifier of the lowest interface in the stack.",
        "The DeviceMap property indicates the order in which devices are listed with this SCSI controller. /nThe DeviceMap property has been deprecated.  There is no replacementvalue and this property is now considered obsolete.",
        "CD_2D5BE2B23BA8B748FE728A0E39B335CC2B3500262599CB2529C98BB713577B01.1478.1830568369.6707",
        "CurrentProfiles",
        "The ModulationCCITT property contains the command string used to instruct the modem to use CCITT modulations for 300 and 1200 bps.",
        "0x205",
        "{BE9B3133-250B-44a5-A278-C532B7B7FF76}",
        "CD_4EF24D0957FB71C83C7AD35B30B8A4808EE94D32528B7C1738A8F12F7FFBB5AE.1204.3680005563.1743",
        "8 - 'Inactive': Copy operation has stopped, writes to source element will not be sent to target element. ",
        "MSStorageDriver_ScsiRequestBlock",
        "The Model property indicates the model of this POTS modem.",
        "MSFT_NetCircularDependencyDemand",
        "Capabilities",
        "The TargetOperatingSystem property allows the provider to specify the  operating system environment. ",
        "C_7E68D046DB13BCE41C3337B31F82C6F35EBC386E53A1006A94CDF711AEF82870",
        "The security filter applied to the rule.",
        "GroupId specifies the key exchange group ID. If the GroupID number is from the vendor-specific range (32768-65535), the VendorID qualifies the group number. Well-known group identifiers from RFC2412, Appendix E, are: Group 1=\\'768 bit prime\\', Group 2=\\'1024 bit prime\\', Group 3= \\'Elliptic Curve Group with 155 bit field element\\', Group 4= \\'Large Elliptic Curve Group with 185 bit field element\\', and Group 5=\\'1536 bit prime\\'.",
        "C_58EBCE462A5C99EEA826226A8DAA39BB4E44016ACD1726174C7DBA9B5E2879BE",
        "Excess Folder Fragments",
        "QueryInformationPolicy",
        "TransitionFault",
        "Func Flag",
        "x25Facilities",
        "AuthenticationFailures",
        "TimeToLive",
        "RandomDelay",
        "object:MSNdis_80211_NetworkInfrastructure",
        "SoftwareElementStateDesired",
        "IP 1394",
        "Number of transport in the changer",
        "{7d2a90ea-2041-11d4-97eb-00c04f79c403}",
        "IPV6 Flow Information",
        "5341C8B8313C296ECB08839CCF4A94507BC66DA5D3F382.1478.2587650861.329",
        "AcquireGenuineTicket",
        "RouteMetric",
        "Number of frames with an invalid FCS or a code violation.",
        "Indicates if asymmetric queue pairs are supported for non-default VPorts",
        "PushVerify",
        "PropertyValues",
        "MessageProtectionOrder",
        "Sint8",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_C18626E27D5153E5E65B72B574D4E2FD4416299A7B7135AC8C51438B7D94212Er",
        "DEVICE_CHANGE",
        "SignatureLevel",
        "RLIRBuffer",
        "CIM_Job.RunDay",
        "Denotes the current health status of the file share.",
        "The WINSScopeID property provides a way to isolate a group of computer systems that communicate with each other only. The Scope ID is a character string value that is appended to the end of the NetBIOS name. It is used for all NetBIOS transactions  over TCP/IP communications from that computer system. Computers configured with identical Scope IDs are able to communicate with this computer. TCP/IP clients with different Scope IDs disregard packets from computers with this Scope ID. Valid only when the EnableWINS method executes successfully.",
        "MDM_Policy_User_Result01_Notifications02",
        "idleDisconnectSeconds",
        "SourcePort",
        "NDIS 802.11 device statistics",
        "UrhiM",
        "The StandardDay property specifies the day of the StandardMonth when the transition from daylight savings time to standard time occurs on this operating system.",
        "This interface is an endpoint device and is not a true network interface that connects to a network.",
        "{FAF76B75-798C-11D2-AAD1-006008C78BC7}",
        "The long address of the NIC encoded in the hardware.",
        "Requires Binary Addresses",
        "9057D65F1A25A157C2ABB405A133D0F21AB61118DC6B4FBB2C013A804086D040",
        "Class Method",
        "DA client experience settings",
        "MSMCAEvent_SMBIOSError",
        "EVENT_TRACE_FLAG_CREATE",
        "The sampling period of the measurement provided by the BMC, if available, in milliseconds.",
        "AllowAutoAcceptPairingAndPrivacyConsentPrompts",
        "MediaGX",
        "DEFAULT",
        "Smbios Major Version",
        "The Duplex property indicates whether printing is done on one or both sides.",
        "HOSTPROC_TRACE_DDI",
        "6 bit - Join Unsecure -  Performs an unsecured join.",
        "Example: SCSI",
        "#define HBA_EVENT_TARGET_REMOVED        0x403",
        "ReceiveFilterInfoArray",
        "ClearBrowsingDataOnExit",
        "C_EAA4CBEB7BB9CF88FDD43FED82BEACA99806984E20E3D7B69232FF5F6CB9EE6E",
        "DNS Server",
        "C_6A87D660F0F6A66279CF024432941A2BC16A9043D5A3CF26ADC36D1DFFEBF2B9",
        "MSNdis_80211_DesiredDataRates",
        "CIM_CollectedCollections",
        "Script File",
        "Retrieves operation performance counter instance name",
        "CIM_NetworkPort.LinkTechnology",
        "This method allows the user to update or set various attributes on the storage tier. Note that not all parameters must be specified, and only those given will be updated.",
        "informationalSession",
        "The Win32_COMApplicationSettings class represents an association between a DCOM application and its configuration settings.",
        "VendorVersion",
        "ref:CIM_BinarySensor",
        "An IRQ of the computer system.",
        "Pictures",
        "The Version property contains the version of the BIOS. This string is created by the BIOS manufacturer. ",
        "Secondary",
        "DisallowDemandStart",
        "Indicates if the Adapter supports IP checksum validation offload for receive IPv4 packets.",
        "The formatted message describing the reason for the fault.",
        "NDIS Notify Filter Removal",
        "Voice Foreign Exchange Service",
        "C_03E318994DE320A2B2B6A80EC1700D149A451607E607421E61E8F027E9429B85",
        "NDIS 802.11 network type",
        "43016",
        "Hundredths of Percent",
        "Reset To Async",
        "This parameter specifies the level of access the initiator should have to each virtual disk specified by VirtualDiskNames. This parameter has a 1:1 mapping with the VirtualDiskNames parameter (the arrays must be the same length and have the same order).",
        "Backup Domain Controller",
        "ref:Win32_LogicalProgramGroupItem",
        "{aca5a8f7-96ca-4397-bade-43be2f577d51}",
        "Management of the  elements of a software product installed on a system.",
        "MGR_TRACE_RESERVED_09 Flag",
        "v0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109",
        "LogFileNameString",
        "EnableActivityFeed",
        "CurrentPayloadSize",
        "IPV4Addresses",
        "CD_044BD4F4AF9E96DD48DDBD1666684018230534EFDE72CF711BC2F8C5D5E9C959.276.93458255.282",
        "SubsegmentInit",
        "Alloc",
        "PLATFORM_ERROR_REQUESTOR_ID is valid",
        "FileRundown",
        "tenths of millivolts",
        "The Name parameter specifies a friendly name for the printer.  This may be overridden if the name has alreadybeen set by the printer.",
        "Write Operation Count",
        "Network Change status information.",
        "{24722B88-DF97-4FF6-E395-DB533AC42A1E}",
        "Driver Major Function Call",
        "Power Save",
        "0x00000008",
        "Name of the target PCSV device",
        "Int 13h - 5.25\" / 360 KB Floppy Services are supported",
        "This property corresponds to CIM_PhysicalFrame.PartNumber. See CIM_PhysicalFrame.PartNumber for details.",
        "The Permissions input parameter is a bit array of the permissions that the caller wishes to inquire about.",
        "TotalRespBufferSize",
        "The local address of the connection.",
        "WD_LOG_FLAG_LOCKS Flag",
        "C_B55C81E6C68BC4C439BC0ABBC4E8C0BD3216FAB41830394E3FAC0034894B6231",
        " - AddSharedSecret.",
        "references the commandline used to access the antecedent.",
        "ATM Emulated LAN for 802.5",
        "{11e6ba76-2053-11d4-97eb-00c04f79c403}",
        "IntegrityCheckMethod ( uint32)",
        " Where AccountName = '#' and TerminalName = '#'",
        "Example: 10",
        "AnnounceServer",
        "AudibleAlarm",
        "The environment of this driver.",
        "4 - Software Error. Error of this type are principally associated with a software or processing fault. ",
        "User devices are logical devices that allow a computer system's users to input, view or hear data. The CIM_UserDevice class is a superclass from which other classes, such as CIM_Keyboard or CIM_DesktopMonitor, descend.",
        "32788",
        "Is Next",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1606.690108275.180",
        "Other Flag",
        "} ISCSI_NIC_LINKSTATE, *PISCSI_NIC_LINKSTATE;",
        "CD_9908FF01855D016DB247597026090F753BADB4AD0E4EFB1386220A76CAD43211.2624.3634242138.531",
        "The Win32_POTSModem class represents the services and characteristics of a Plain Old Telephone Service (POTS) modem on a Win32 system.",
        "ref:PS_ModuleFile",
        "C_D2E1F5EB4F84E0C0B2E61F3513674DF2B7151098EA22604925123769286041D2",
        "AdvancedRemoteAppGraphics",
        "BCP.1 formatted output (W)",
        "GetFC4Statistics",
        "ControlCode",
        "PNP_INSTALL_TRACE_LEVEL Flag",
        "Create called on existing file",
        "Generic_Error",
        " to the service becaus",
        "Parameters Data Length",
        "Specifies the Rendering mode for the printer: SSR, CSR, or Branch Office Direct Printing.",
        "ACPI supported",
        "ref:CIM_ClusteringSAP",
        "{42B2EC5C-DB35-11d2-85FC-0000F8102E5F}",
        "R_45D7E6F87ACB8E8D445CCFB669888583D94123CEF1D8C0B902BDB864D192ADA3",
        "SCRUB",
        "MSFT_NetUDPEndpoint",
        "MSFT_SCMEventLogEvent",
        "NetworkFSSLocalSystemWeight",
        "(0.7,0.0)[V]",
        "Online All",
        "CD_0C1B95E6D290B66E321C724410DB4355B639D2A083CB9491EF83C50DE14B1E8C.2070.2566867204.4740",
        "AKAPRIME",
        "AuthorizedPrivilege",
        "ervice",
        "Specifies the name of the printer that will be used.",
        "Win32API|Component Categories|CATEGORYINFO|catid",
        "BranchCache networking configuration",
        "ConnID",
        "The ending address, referenced by an application or operating system and mapped by a memory controller, for this memory object. The ending address is specified in KBytes.",
        "h*m;h*m;",
        "Queue",
        "MaxClockSkew",
        " colors.",
        "WMI|Win32_SerialPort",
        "{07e397ec-c240-4ed7-8a2a-b9ff0fe5d581}",
        "IoPriorities",
        "Multiplexer Problem",
        "Update a settings location template by template file.",
        "profile",
        "AcceptPause",
        "C_8669524660923BEB3DA81E87F326B831E705D4AD2D26F7C6F43EC5D8367BA37C",
        "ReverseRoles",
        "Hardware address of the device or component initiating transaction",
        "ErrorMode",
        "The StartMode property indicates the start mode of the base service. \"Boot\" specifies a device driver started by the operating system loader. This value is valid only for driver services. \"System\" specifies a device driver started by the IoInitSystem function. This value is valid only for driver services. \"Automatic\" specifies a service to be started automatically by the service control manager during system startup. \"Manual\" specifies a service to be started by the service control manager when a process calls the StartService function. \"Disabled\" specifies a service that can no longer be started.",
        "PendingActionDetections",
        "IR_C72044C5359DF7DC4480B7B809AE99A37C9C4FD06BB902C72B46C39D4D671757",
        "InProgress",
        "RemoteLastWriteTime",
        "Defines the IPv6 LSOv2 encapsulation settings for the Adapter.",
        "SCSI Fibre Channel SCA-II (40 pins)",
        "CIM_ERR_INVALID_QUERY",
        "Designates one or more GRE keys to filter on.  Network traffic is logged when the filter matches. ",
        "CR_16C3460778AD17C374A21EA3EAA4769942B4820B8F8AA76B353EDCE060C07C55",
        "Indicates whether or not there are tiers associated with this virtual disk.",
        "EVENT_TRACE_FLAG_ALPC",
        "TransportName",
        "Win32Registry|SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Hotfix",
        "Routing compartment identifier.",
        "CD-ROM",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_302159DD437DF31C3447740E0D66617756BB40FBE840878868510D22B9CA06181821",
        "The operational QoS settings currently configured for the network adapter.",
        "43009",
        "Indicates if the Adapter supports IPv4 options for transmit checksum offload.",
        "R_378C3B019BA81FF898F9BF06FF0AC5FC705DA51C0F56DBDDF9AC986BBEE3099E",
        "ref:MSFT_NetAdapterHardwareInfoSettingData",
        "ActiveWidth",
        "NDIS Driver Version",
        "EnableLowPriority",
        "Product library directory",
        "The port name of the VM network adapter.",
        "If applicable, defines the server inproc32 executable  name.",
        "{C7E9D3B9-E62B-4A90-8CC5-A3C5F662DA7B}",
        "FileIo_V2_MapFile",
        "Current video mode.",
        "EnableCustomizedToasts",
        "OS SCSI port number",
        "ObjectClass",
        "StorageJob",
        "LockStatus",
        "PLATFORM_TRACE_RESERVED_1c",
        "FileIo_V2_OpEnd",
        "NS_7100C6423C40622098AFCC4AD8087F3ECEFAC621ACFC3A5D9490E740DC79989B",
        "SERVICE_WIN32_OWN_PROCESS ",
        "Aborted",
        "NtfsLog",
        "MGR_TRACE_RESERVED_1b",
        "Automatic Cleaning",
        "Management of software product subsets of SoftwareElement. ",
        "TR_DLL Flag",
        "EncapsulationMode indicates whether the IPsecSAEndpoint uses transport or tunnel encapsulation.",
        "Thumbprint of the issued certificate",
        "MsftDiscFormat2Data_DebugDestructor",
        "IEEE 802.3ad Link Aggregate",
        "Volume not supported",
        "CD_688EDFFAE1CD3706709D790A6046157BB8A78E3308174A187E2C588BBB236985.1700.1504515628.362",
        "DetailedStatus",
        "ICQEXPLOIT",
        "RebootAndOfflineScanRequired",
        "Supplies the replay counter.",
        "{b2fc00c4-2941-4d11-983b-b16e8aa4e25d}",
        "Web Page",
        "C_79F50ECB454C073E4E5CB137ED1F04F729BBE896F53092F9F794786916DFD292",
        "LatencyMilliseconds",
        "CR_2D600EDEB86FB22AC5475ED284E8022AA05DCE0A01ED5CD478BD3E89B6038610",
        "Executed",
        "{8502C4C4-5FBB-11D2-AAC1-006008C78BC7}",
        "LPC_TRACE_RESERVED_12 Flag",
        "{1BF00330-E3D1-11d2-8601-0000F8102E5F}",
        "PNP_TRACE_LEVEL Flag",
        "The Win32_ShadowContext class is used to specify how a shadow copy is to be created, queried, or deleted and the degree of writer involvment.",
        "MSFT_NetEventPacketCaptureProvider",
        "The binding specific security properties for the local service.",
        "RequiresBinaryIpAddresses",
        "Win32_DeviceSettings",
        "{8C27FBED-1C7B-47E4-A649-0E389D3ADA4F}",
        "WheaSetPolicyRtn",
        "WDF ISR",
        "EnableIPSec",
        "Example:130.215.24.1 157.54.164.1",
        "FileIo_V2_Name",
        "PNP_INSTALL_WARNING_LEVEL",
        "LUAInstall: error 0x00000005 setting flags [{73DA5D04-4347-45D3-A9DC-FAE9DDBE558D}]",
        "The inherited Name property serves as part of the key for the CIM_DeviceErrorCounts instance.  The object is scoped by the logical device to which the statistics apply. ",
        "LocalGlobalOpenPortsDisallowed",
        "Bid2Etw_RowsetHelper_1_Trace_TextW",
        "SMBIOS Function Number",
        "RawOnly - Allow only raw data type jobs to be spooled.",
        "NS_267C220794F508648239FA7778B7AB861354859A3A3BC7CD92CDCFF5E2286F1D",
        "NetworkAdapterLanaID",
        "PrivilegeGroup for IPMI",
        "process",
        "Set maximum monitors supported by the server 1 being the minimum and 10 the maximum",
        "Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|VirtualSize",
        "HyperThreadingFlag",
        "LPCDRVR_TRACE_RESERVED_07 Flag",
        "The dependency identifier for the family of SKUs used to determine license relationships for add-ons.",
        "R_26EBDAC8F156752113DE91B4EE3267ABEDBAA0A241ECD93D9A2C887C1566A5A3",
        "MSNdis_QueryInterruptModeration",
        "MediaLife",
        "LogicalSectorSize",
        "The DataType property indicates the format of the data for this print job. ",
        "CD_8D348295F5C8039788FF0FD535EA84E2DE9FD1810A97F958930762614BE11757.2532.1396254780.409",
        "4890EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "{4B2C30D7-BAFE-11d2-85E5-0000F8102E5F}",
        "No dithering",
        "The SID of an account",
        "{10458E26-DB37-11d2-85FC-0000F8102E5F}",
        "C_A1FDEDE7CEDFE5C8E19FD85650C6CE61DEFE385164ECD849CB5636A26A1B8561",
        "I_129AB6E1DAC83B8A4F15F872069B1769D0052D0A7D6F69174C6CC64702798ABF.2712.2490011464.298",
        "The SetPriority method attempts to change the execution priority of the process. In order to set the priority to Realtime, the caller must hold the SeIncreaseBasePriorityPrivilege.  Without this privilege, the highest the priority can be set to is High pr",
        "VendorID identifies the vendor when the value of GroupID is in the vendor-specific range, 32768 to 65535.",
        "MEM_COLUMN is valid",
        "__InstanceModificationEvent",
        "Color",
        "Malware",
        "JobID",
        "millisecon",
        "MSLSA_LookupIsolatedNameInTrustedDomains",
        "MSNdis_CurrentPacketFilter",
        "CIM_PhysicalComputerSystemView.NumericSensorCurrentReading",
        "NS_59411655A8F95EE7BEABDFB898861DFA8E2BF23293A8AFE96B2E5BB236E7FE01\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_6AB4C26A768DBAD972023075BD61506660628CCA5970C8992F70EF5AA2F932C9",
        "{BA4EAC04-AFCE-441a-A4F0-C4A97545425A}",
        "KI_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "WMI|Win32_WMISetting",
        "3864CF2615B27D56E94A95716A",
        "    ISCSI_NIC_LINKSTATE_DISCONNECTED = 0,",
        "BlueTooth",
        "The value for the qualifier. Note that the WMI convention will be strictly followed and qualifiers present without a value will not have any entries in this property. For example the Write qualifier is commonly used without a value and the presence of the qualifier is taken as indicating that the property is writable - its value is irrelevant.",
        "Win32_Terminal",
        "AddVirtualDisk",
        "MSNdis_PortArray",
        "DefaultAssociationsConfiguration",
        "The Element reference represents the role of the Win32_DCOMApplication",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000",
        "C_FC07F6E0375A047ACC1C9CE89E72A2C841B5C2CB6633B35D7C8A7F576CB2B31D",
        "Virtualization-based Security",
        "PreviousCompatibleNames",
        "Import_BCSecretKey",
        "This method is used to defrag the volume.",
        "C_EA9A1A204A0FA59819F57AD1F744E0CAB4BE1F06A46B3D439B85E87A7B3A09A6",
        "If FALSE indicates that data PDUs within sequences may be in any order. If TRUE indicates that data PDUs within sequences must be at continuously increasing addresses, with no gaps or overlay between PDUs.",
        "Status Value",
        "GetSupportedGroupFeatures",
        "CD_038FB93272FAE6ABFA86F7DB95C50EABB70457A3A4C501BDC273939A1E6BDB9D.2063.1.10081",
        "Last discovered KMS host name through DNS.",
        "SrkPublicKeyModulus",
        "TrustedHosts",
        "oUUUUU",
        "LOG Flag",
        "MSFT_NetTransactInvalid",
        "DesiredStorageTierClass",
        "MSADOX.1 formatted output (W)",
        "Defender",
        "RestrictedSitesZoneAllowScriptlets",
        "Number of kilobytes of physical memory currently unused and available",
        "TargetPortalPortNumber",
        "\\\\.\\ROOT\\CIMV2:__Win32Provider.Name=\"WhqlProvider\"",
        "TargetPortal",
        "MSFT_NetAdapterPowerManagementElementSetting",
        "The SeparatorFile property specifies the name of the file used to create a separator page. This page is used to separate print jobs sent to the printer.",
        "TxRPrepare",
        " ValueDescription ",
        "The InterfaceIndex property contains the index value that uniquely identifies the local interface.",
        "42000",
        "The HostingSpecification property currently is not used.",
        "Ndis80211NetworkType",
        "TcpIp_V1_Receive",
        "Indicates if the subsystem allows a virtual disk to be grown in size (using the Resize method of the virtual disk instance).",
        "`5m;`5m;",
        "The Information property contains a reference to MIB definitions specific to the particular routing protocol that is responsible for this route, as determined by the value specified in the route's ipRouteProto value. If this information is not present, its value should be set to the OBJECT IDENTIFIER {0 0}, which is a syntactically valid object identifier, and any conformant implementation of ASN.1 and BER must be able to generate and recognize this value.",
        "Version information of the current or last running operating system on this physical computer system. See CIM_OperatingSystem.Version for details.",
        "NdisMaximumTotalSize",
        "C_2B88F31612D07208335917632CBA42B5144EFFDFF3C42A0D46D364832769C7A2",
        "Source Info to correlate it back to powershell configuration script.",
        "The SizeHigh property indicates the size of the print job if the Size property exceeds 4,294,967,295 bytes.",
        "The BootVolume property indicates whether the volume contains the currently running operating system files.",
        "ChangePassPhrase",
        "DirtyInfo",
        "communication mode defines the form of communication in order to obtain support. For example, phone communication (value=2), fax (3) or email (8) can be specified.",
        "Specifies the name of the shared queue.",
        "Total Free Space Extents",
        "Dirty Reason",
        "The maximum number of bytes that can be transferred by this DMA channel.  If unknown, enter 0.",
        "MSiSCSI_RedirectPortalInfoClass",
        "The address of the remote endpoint the SA applies to.",
        "NumberOfTrafficClasses",
        "IO Error",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|Pulse",
        "VirtualDisksHealthy",
        "LUAInstall: error 0x00000005 setting flags [{934A7048-1E4A-4D6E-9A9A-CB739F519B07}]",
        "ref:Win32_ServiceSpecification",
        "Modifies the ODBC driver represented by the specified ODBC driver objects. Enter a variable that contains the objects, or type a command or expression that gets the objects.",
        "LoaderError",
        "Note that the value \"No Change\" (5) has been deprecated in lieu of indicating the last requested state is \"Unknown\" (0). If the last requested or desired state is unknown, RequestedState should have the value \"Unknown\" (0), but may have the value \"No Change\" (5).Offline (6) indicates that the element has been requested to transition to the Enabled but Offline EnabledState. ",
        "QUERY_VOLUME_INFORMATION",
        "VirtualizationFirmwareEnabled",
        "NS_5383CAE6BA7DF67C8540FB8486138E8E7854E1A417C357D4708E676797F6FF28",
        "{8502C4D3-5FBB-11D2-AAC1-006008C78BC7}",
        "CD_80B699E54B84239FD1066E5A81EB19D570A7344B7D65738ED8C91406D3A0502D.1535.1355092611.651",
        "This specifies when single sign on is performed.",
        "StorageTiers",
        "// This class exposes the quick mode IPSEC statistics",
        "EVENT_TRACE_FLAG_IMAGE_LOAD",
        "100 nanoseconds",
        "ServerLinkSpeed",
        "Threshold Exceeded",
        "MDM_Policy_Result01_LockDown02",
        "Mac Address of the network adapter.",
        "HOSTPROC_TRACE_PNP Flag",
        "AllowWebContentOnNewTabPage",
        "UserControlService",
        "Shared - Available as a shared network resource.",
        "{8502C4C9-5FBB-11D2-AAC1-006008C78BC7}",
        "Certificate Services Client Trace",
        "ROOT\\Microsoft\\Windows\\DeliveryOptimization",
        "The FileName property is a string representing the filename (without extension) of the file.",
        "MsftMultisessionSequential_DebugDestructor",
        "7DAC3FB0D74027E586B2E97BEF112C2070090FD\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "iSCSI HBA Main Mode IPSEC Statistics",
        "\"In Test\" element is performing test functions. ",
        "Pending Deletion",
        "NdisStatusDot11RoamingStartIndication",
        " This is an identifier for this software element.",
        "MSFT_NetImPlatTeam",
        "GetOwnerAuthForEscrow",
        "seconds",
        "MSFT_SCMEvent",
        "{E5D8A562-F6C0-11d2-B35E-00105A1F8569}",
        "PreSharedKey",
        "If the voltage (in millivolts) rises above the value specified by Range1InputVoltageHigh property, the UPS will compensate by trimming the voltage.  A value of 0 indicates that the voltage at which trimming occurs is 'unknown'.",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_B498B69E308CCD72907DFE63279C92042927888BB64E0D473D3C48463EEABEA9_",
        "Register a settings location template.",
        "EVENT_TRACE_FLAG_Q",
        "recommendedTemplateLevel",
        "Is Vsync pulse serration required",
        "Indicates if the Adapter supports IPv6 extension headers for receive checksum offload.",
        "Specifies the name of the server used.",
        "2147483650",
        "DirectAccessQueryIPsecRequired",
        "The maximum time the connection can be idle before being disconnected. ",
        "InboundBytes",
        "C_31380B1CBE2DE48F4953061E943634793359C618E73F753682430004D4E36FB0",
        "SM_SendCTPassThru",
        "ConfigureSMBV1Server",
        "The Device Control Block (DCB) property contains the control settings for a serial communications device, in this case, the modem device.",
        "Number of elements in SessionList array",
        "Flat panel's horizontal resolution in pixels.",
        "TR_POLICY",
        "The maximum speed (in MHz) of this processor.",
        "ROOT\\Default\\ms_409",
        "//  Module: iScsi Discovery api",
        "0xC0000023",
        "WmiQueryNICSwitchCurrentCapabilities",
        "DDN X.25",
        "FileIo_V2_SimpleOp",
        "ref:Win32_POTSModem",
        "SetPMTUBHDetect",
        "Join Unsecure",
        "CR_7450B933028ED3A9668E73BC07A8325B939DC7781D6560E2446E75795DDC2C3E",
        "OSLunNumber",
        "Valid",
        "GetAccessPaths",
        "MaintenanceDeadline",
        "ConfiguredBudget",
        "Support for the product.",
        "Specifies the cache file to operate on.",
        "NamedJobObjectActgInfoProv",
        "{5ec1035b-a61a-11d0-8dd4-00c04fc3358c}",
        "REDBOOK_WMI_PERF_STREAM_PAUSED_COUNT",
        "A string that uniquely identifies the entity that owns the definition of the format of the Message described in this instance. OwningEntity MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business entity or standards body defining the format.",
        "The Type property contains the type of shutdown that was initiated.  This event pertains to both shutdown as well as reboots of the system.",
        "The BootDevice property indicates the name of the disk drive from which the Win32 operating system boots. /nExample: \\\\Device\\Harddisk0.",
        "CountryDesignation",
        "NetConnectionID",
        "The Organization property indicates the the registered user's (of the operating system) company name./nExample: Microsoft Corporation.",
        "select * from WSP_ReplicationGroupStorageModificationEvent",
        "NotContentIndexed",
        "The management state of the network adapter. If True, the network adapter is locked and many of its properties cannot be changed unless the adapter is unlocked.",
        "An array containing the operational status of each controller of the enclosure. ",
        "The path to the package that is to be installed",
        "{8502C4D6-5FBB-11D2-AAC1-006008C78BC7}",
        "Connection ID token",
        "The email addresses of those persons to be included on the TO: line. Addresses must be separated by commas or semicolons.",
        "ProtectKeyWithExternalKey",
        "A timeout period that specifies the maximum amount of time that the client expects the transition to the new state to take. The interval format MUST be used to specify the TimeoutPeriod. A value of 0 or a null parameter indicates that the client has no time requirements for the transition. ",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_DF1D72ECC9268213FCB43A06A38DBF2A7452DFF83D9A2AF1D89F3CECA76D4AF1",
        "CD_0B8D0CD35EF9C37B2A0F0A7A5A12FCC21F082587427AFAC5F5A4AE61B8034D36.35.4292354994.420",
        "HbaType",
        "NdisMediaInUse",
        "SubsegmentAlloc",
        "CharSetsSupported",
        "C_8D99B89B2E26FAE38502F957460FFF2E9E23E0C0D9AA3DEF32147EBB968C38FA",
        "CIM_StorageExtent.SystemName",
        "Previous Alert Cleared",
        "CD_428941D3E4DA5D73C4ACFBC21B050EE334D4553F43C52B09A9D3CA1C7657E068.75.353606162.243",
        "0xC0000027",
        "0x80050068",
        "<LocalID> is chosen by the business entity and SHOULD not be re-used to identify different underlying (real-world) elements. If the above 'preferred' algorithm is not used, the defining entity MUST assure that the resultant InstanceID is not re-used across any InstanceIDs produced by this or other providers for this instance's NameSpace. For DMTF defined instances, the 'preferred' algorithm MUST be used with the <OrgID> set to 'CIM'.",
        "40001",
        "802.11g",
        "RemoteControlPolicy",
        "TargetGroup shall not be supplied",
        "2147549445",
        "SecurityFlags",
        "Link State **typedef**",
        "HeapTrace",
        "Example: &K0.",
        "The cipher algorithm for the second operation",
        "SignatureValidations",
        "IncludeAllNetworkPaths",
        "Reconnect",
        "OSBusNumber",
        "SetByPrinterObject",
        "Bid2Etw_MSDADIAG_ETW_Trace_TextW",
        "FileReplace",
        "0xD014",
        "Bit flags specifying what activities are audited",
        "Trace Listener",
        "DriverVersionString",
        "MemoryBlockSize",
        "Disable DNS64",
        "ShortPollTimeInMinutes",
        "{6B629D5E-E63C-48a3-9EBB-974227075265}",
        "Additional Data. At the moment, the only use is when the CategoryDiscriminant is equal to ThreatStateNotificationsthen this value will contains the ThreatID",
        "VHDCI Shielded (68 pins)",
        "NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers",
        "Monitor ID",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_A111E7F89C1C848588C2514B9F7117AA41CDA991BF49D22CA3C7528AAAD3EBCB11d7",
        "Association between VirtualDisk and StorageFaultDomain.",
        "SamOpenGrp_End",
        "CIM_VideoBIOSFeature",
        "InitiatorPortalAddress",
        "Slot Index",
        "function",
        "Active Trippoint Count",
        "Win32_IP4RouteTable",
        "0 - The request was accepted.",
        "ref:Win32_ODBCAttribute",
        "This method is used to unpin a file from a storage tier.",
        "MSFT_NetServiceControlSuccess",
        "C_90D6DB96E4E52DF3FCB751D8C2491313C169EEA2DEA2212CBFE4EFF8C0A5E947",
        "The ID property uniquely identifies the shadow provider on the system.",
        "The DeviceID property contains a string uniquely identifying this POTS modem from other devices on the system.",
        "ReserveSource",
        "DoCompleteFirst - Start jobs that are finished spooling first.",
        "131072",
        "Organization",
        "LifetimeKilobytes",
        "If the Create method fails to start, the ErrorControl parameter passes the severity of the error. The value indicates the action taken by the startup program if failure occurs. All errors are logged by the system. The system does not notify the user of \"Ignore\" errors. With \"Normal\" errors the user is notified. With \"Severe\" errors, the system is restarted with the last-known-good configuration. Finally, on \"Critical\" errors, the system attempts to restart with a good configuration.",
        "CIM_AlertIndication.PerceivedSeverity",
        "Phase2AuthSet",
        "Only one initiator address is acceptable for this operation.",
        "Abort",
        "LastRunTime",
        "The optional source IP prefix filter condition. Where applicable, both the source and destination prefix families must match. Examples of valid prefixes: 192.168.1.1, 192.168.1.0/24, or fe80::1001:2046/128",
        "NDIS 802.11 Privacy Filter",
        "The PrivilegesNotHeld property indicates required access privileges missing in order to complete an operation.  The types ofaccess privileges can be found under the Windows NT Privileges.  Example: SE_SHUTDOWN_NAME",
        "MSNdis_FddiRingManagmentState",
        "Stack4",
        "CD_6E3B4399FA4EDE750602EAE85FB276C1B64644E78344F6BB3EF3F442D17FE8D8.1185.667104842.320",
        "WMI|Win32_PageFileUsage",
        "SetFC3MgmtInfo",
        "R_35C0F224CC2308A9D8BACDB20F08468AE9D1134753B5808A41A3EA43EE4C047D",
        "MCA_WARNING_MEM_UNKNOWN",
        "I_4A3DDCEADF875B43B86031D680AEC99D3EBB91A5667B84178BECB0ED04142818.822.1.43301",
        "The UUID property contains the Universally Unique Identifier (UUID) for this product. A UUID is a 128-bit identifier that is guaranteed to be different from other generated UUIDs. (If a UUID is not available, a UUID of all zeros is used).",
        "0xEFFF000A",
        "passwordOverrideEnabled",
        "Small Custom Logo Bitmap Name",
        "CIM_ElementSetting",
        "Settings to be applied to target Replication Group.",
        "WifiDirectDevices",
        "C_23661D69AF1192D73D2CA18E9EAE4F8747A8AD619CA09B24089CE9CBFB6DC7C2",
        "Provides the ability to set the maximum number of prefetch files for scenarios recorded by the Operation Recorder API.",
        "WMISet",
        "SERIAL_PORT_WMI_PERF_GUID",
        "Win32_Share",
        "This is the parent device of this locate device.",
        "CR_93D683378335762C284317F9836C36B73320C30A8A815437365079222449D208",
        "Quarto",
        "ConnectionBufferSize",
        "An MCA/CMC/CPE event",
        "An index assigned to the network adapter at the time of installation.",
        "The AcceptPause property indicates whether the service can be paused.",
        "This method allows a user to set the description field of the share.",
        "ReserveKey",
        "SetDWORDValue",
        "DnsServerAddresses",
        "Pentium(R) II",
        "// The number of entries in the acquire heap, which stores active acquires. This number increases under a heavy load and then gradually decreases over time, as the acquire heap is cleared.",
        "CreateFlags",
        "Microsoft|DSLDAPInstanceProvider|V1.0",
        "Composite polarity is positive",
        "Get Failure Prediction Capability",
        "CD_D5E5B3762A5113A6C262F653E8716557160CDA5C8EFF2A001BCEF56E204DD0C1.1757.1204531561.416",
        "This enables initilization traces",
        "SmartScreenEnabled",
        "MDM_EASPolicy",
        "Media Disconnected",
        "on is read-only.",
        "SEL_DATA2",
        "IL_55BA3B97EE945A5FFAA048F94EB0B1F3BCDC2B26C8F2588BFFB42050A21365DE.337.1.27578",
        "Specifies the key that contains the named value to be deleted. ",
        "NS_5CF6F9641D4AAF44F18181FA22B732295FA75500CE844EE9D6144DAF9F98E074",
        "IR_B8F2F2BF1619AAC712E46ACDC25F9EE9CD9413AE0C42388950720F238FD4DDA1",
        "There is not enough redundancy remaining to repair the virtual disk.",
        "select * from SPACES_StorageHealthStatusChangeEvent",
        "HBA_EVENT_ADAPTER_REMOVE",
        "MSFT_NetCallToFunctionFailed",
        "DisabledInterfaceAliases",
        "The desired level of physical disk failure tolerance. This value must be between PhyscialDiskRedundancyMin and PhysicalDiskRedundancyMax.",
        "Specifies the routes to be plumbed.",
        "This method allows the user to remove members from this replication group.",
        "object:MSNdis_NicSwitchCapabilities",
        "CD_A50F2C71334A2A338CC6F1C013DEEB31B3684F92B727656C378E98BCCF3ADD1F.1469.3399152346.602",
        "object:Win32_LUID",
        "IEEE 802.12",
        "Specifies the maximum working set size for all processes associated with the job. Ignored unless LimitFlags specifies Limit Working Set",
        "}C20D4B021E0AFFB61E5D90A8AD1A949CBA948B6ED6C506FD3F623477DE2DDF5D",
        "HiveInit",
        "MEM_MODULE is valid",
        "MCA_EXTERNAL_ERROR",
        "LoggerId",
        "Specifies the x coordinate of the upper left corner of a window",
        "CscFastSync",
        "Cim_Key",
        "CD Recordable",
        "SDBUS_DEBUG_ENUM",
        "C_3DA09466BD5D17A4FE0B633E962F9D4150B210137F89EB9BBF5F24EDF1B00135",
        "A TimeSpan that specifies the maximum time difference between the system clocks of the two communicating parties.",
        "The last time this folder was successfully synchronized to the Offline Files cache.",
        "IsPinned",
        "LetAppsSyncWithDevices",
        "The ConnectorType property indicates the physical attributes of the connector used by this port.",
        "Should Be Archived",
        "Specifies the workflow application policy for the printer: Uninitialized, Disabled, or Enabled.",
        "Specifies the Audit Permissions for failure. The permissions are a combination of one or more of the following:WINSTATION_QUERY, WINSTATION_SET, WINSTATION_RESET, WINSTATION_VIRTUAL | STANDARD_RIGHTS_REQUIRED, WINSTATION_SHADOW,WINSTATION_LOGON, WINSTATION_LOGOFF, WINSTATION_MSG, WINSTATION_CONNECT, WINSTATION_DISCONNECT.",
        "MDM_DeviceStatus_CellularIdentities01_01",
        "    4. Application PreLaunch",
        "instanceID",
        "Win32API|Directory Service (Ds) Structures| DSROLE_PRIMARY_DOMAIN_INFO_BASIC|DSROLE_MACHINE_ROLE| MachineRole",
        "REMOTEACCESSTROJAN",
        "BudgetWriteable",
        "PauseQualityUpdates",
        "Write Count",
        "A Win32_FolderRedirectionHealth object that represents the health of the user's redirected Documents folder.",
        "PCMCIA Bus",
        "Win32_UserInDomain",
        "HDH 1822",
        "MSFT_NetAdapterPowerManagement_Offload",
        "HealthActionAlert",
        "Hardware information for a network adapter",
        "CR_4B835375C85830D11DAA3F01F5AF9F28573A4521B9279B28C7605832DE3B39C3",
        "MinBlockSize",
        "Limit Process Time - Establishes a user-mode execution time limit for each currently active process and for all future processes associated with the job.",
        "This method allows for the creation of virtual disks on a storage subsystem. This method is typically used when either a) the subsystem's storage pools do not allow virtual disk creation directly, or b) the subsystem does not support storage pools. Storage Management Providers may also choose to implement this method to 'intelligently' pick a storage pool for the user. If this method is supported, the subsystem's SupportsAutomaticStoragePoolSelection property should be set to TRUE.",
        "PCI Bus Intended Target ID at the time of the event",
        "The AveragePagesPerMinute property specifies the rate (average number of pages per minute) that the printer is capable of sustaining.",
        "This parameter allows the user to specify the desired FriendlyName for the masking set at the time of its creation. FriendlyNames are expected to be descriptive, however they are not requried to be unique.",
        "MSFT_NetEventWFPCaptureProvider",
        "object:MSFT_CliProperty",
        "The locale string consists of three sub-strings, separated by underscores: ",
        "List Of Portals",
        "CIM_ERR_NAMESPACE_NOT_EMPTY",
        "This method will configure the associated instance of Win32_Product to the specified install state and level. The method can return the following values:",
        "List of Compatible IDs for the device. If Setup cannot locate an INF file that matches one of a device's hardware IDs, it uses compatible IDs to locate an INF file.",
        "Type of guid",
        "C_51A4A09354423C467E946EF4050F2DF0E13DE3BBAD00C291A488D4E05F085A24",
        "OpticalDisk",
        "Win32API|Tape Backup Structures|TAPE_GET_DRIVE_PARAMETERS|ECC",
        "Disable script scanning.",
        "PCI-X Mode2 266 133MHz",
        "For DMTF-defined instances, the \"preferred\" algorithm should be used with the <OrgID> set to CIM.",
        "The TimeOfLastReset property indicates when the network adapter was last reset.",
        "LastConnected",
        "HBA_BIND_TO_LUIDHBA_BIND_TARGETS",
        "LowestIfNetLuid",
        "ref:Win32_Service",
        "CPASEC Flag",
        "MaintenanceScheduleDelayPattern",
        "PC-98/C24 add-on card",
        "SetByServiceSet",
        "Denotes the provisioning scheme of the storage tier. ",
        "Racks, as simple enclosures, contain chassis that provide the physical components realizing processing nodes, storage devices, UPSs, etc. The CIM_ChassisInRack association makes explicit the 'containing' relationship between the rack and the chassis.",
        "Win32API|Windows Sockets Version 2|getsockopt|IPX_ADDRESS",
        "68 Pin  Dual Inline",
        "DOT11_KEYMGR",
        "RepetitionInterval",
        "This parameter is used to specify the list of volumes that should be scheduled for autochk at next reboot. The string syntax consists of the the drive letter, mount point name, or volume GUID name for the volume.",
        "Win32_LogicalProgramGroupItemDataFile",
        "CR_EC28E29E31F548462327C3037DF69482A82EBE159236DA81AE2E5AA78F5CFB04",
        "MDM_Policy_Config01_Privacy02",
        "RDRAM",
        "SetVolume",
        "NDIS Enumerate VC",
        "CreatedVolume",
        "The DNSDomain property indicates an organization name followed by a period and an extension that indicates the type of organization, such as microsoft.com. The name can be any combination of the letters A through Z, the numerals 0 through 9, and the hyphen (-), plus the period (.) character used as a separator.",
        "4Uz4`",
        "PolicyStore property defines the store to retrieve the NCSI configuration policy.",
        "Private Loop",
        "{01779336-2064-11d4-97eb-00c04f79c403}",
        "NDIS Media Types In Use",
        "RDPermissions",
        "AuthMethod",
        "The AutoStartWin9X property indicates the circumstances under which WMI will start on Win9X systems.",
        "C_2D600EDEB86FB22AC5475ED284E8022AA05DCE0A01ED5CD478BD3E89B6038610",
        "ExpirationThreshold",
        "HBA_SASPHYSPEED",
        "SamCloseHandle_Start",
        "RequiresEncryption",
        "Thread Affinity Event",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_9BCEBFBD099FD1DBA49B8E7BCF49EE9762FC2EFF302F652F7F56BF3EDE25D1FA",
        "Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpLoadOrderGroup",
        "This parameter indicates the resiliency setting to be used by default when creating a new virtual disk on this storage pool. If the subsystem's SupportsMultipleResiliencySettingsPerStoragePool property is set to FALSE, this parameter also acts as a hint to the Storage Management Provider on which resiliency setting should be inherited by this storage pool. If no value is given, it is up to the Storage Management Provider to pick the most appropriate resiliency setting.",
        "{E7D29B98-E3D1-11d2-8601-0000F8102E5F}",
        "Returns the VpnConnectionTriggerDnsConfiguration object that contains the DNS suffixes and their corresponding DNS servers",
        "DefaultIPGateway",
        "Relates an IPsec rule to its Phase 1 Authentication Set.",
        "2 - Alpha ",
        "SetLoadBalancingState",
        "Initiator node name used to establish the session",
        "Available space on the volume",
        "Ndis802_11ReloadWEPKeys",
        "Dependent Services Running",
        "IPv6IpExtensionHeadersSupported",
        "Successful completion, no reboot required",
        "The IPConnectionMetric parameter assigns an value ranging from 1 to 9999, and indicates the cost of using the configured routes for this IP bound adapter and is the weighted value for those routes in the IP routing table. If there are multiple routes to a destination in the IP routing table, the route with the lowest metric is used. The default value is 1. Windows 2000 only.",
        "The DeviceID property contains a string uniquely identifying the tape drive with other devices on the system.",
        "This parameter allows the user to specify the virtual disk target on the target machine.",
        "Win32_ComputerSystemProcessor",
        "The owner registered to use the product.",
        "MIF.DMTF|Video BIOS|001.5",
        "DHCPLeaseObtained",
        "hello",
        "The ASPScriptEnabled property indicates whether WMI scripting can be used on Active Server Pages (ASP). This property is valid on Windows NT 4.0 systems only. For Windows 2000 systems, WMI scripting is always allowed on ASP.",
        "ResultSetQueries",
        "StorageExtent describes the capabilities and management of the various media that exist to store data and allow data retrieval. This superclass could be used to represent the various components of RAID (Hardware or Software) or as a raw logical extent on top of physical media.",
        "CD_DA2CC882B6BCEAC9BF31E89756B8510C103D6DA8CC0721E36AB1395322663D45.2484.403010983.637",
        "NdisCoHardwareStatus",
        "CheckID",
        "Is Legacy Interface Enabled",
        "Activate Consistency",
        "RandomizeIdentifiers",
        "CD_FFEB2E6E5C2BB60DF1E88218FF16E68C6AFD2FB957B5DD1907DD42EDC6D70FE0.1549.3846544125.4462",
        "EnergySaverBatteryThresholdPluggedIn",
        "GuidType",
        "Altitude",
        "The path to the package that contains the upgrade",
        "CIM_PowerManagementService.SetPowerState",
        "C_918165F99F828C6B53BA10EEE3979256F3A73E636E22656D27D129A14FA67468",
        "Win32_PrinterConfiguration",
        "Acpi _PCT status register",
        "Local",
        "select * from WSP_StorageHealthStatusChangeEvent",
        "TRACE_CLASS_ALGORITHM Flag",
        "Default credential to access resources.",
        "Win32_ProcessStartTrace",
        "The support telephone for the product.",
        "MDM_Policy_Result01_Games02",
        "UUUUUUUUUUUUUUUUUUUUUUU",
        "Single User",
        "CD_69C7869757A5F0A0B753F6CBF641632E43C401B354F79939A20946D52BD05C51.1667.3546741872.234",
        "Contains the DWORD data value for the named value. ",
        "Number of multicast short addresses enabled on the NIC.",
        "This method will reinstall the associated instance of SoftwareFeature using the specified reinstallation mode.",
        "DtcTransactionsTraceSession",
        "C_6A34DEB33A28A5C79FACD308002DEAAFD811689101AD1C977E557E3DB84950D4",
        "R_BEB5CFC405938CF504C4F022B26457B8BA4AAA062A6E8AB4E49ECA4FF82FF69D",
        "{2306fe31-dbf6-11d2-9244-006008269001}",
        "SDBUS_DEBUG_WARNING",
        "PortProtocol",
        "SamLookupDomInSamSrv_Start",
        "tenths of degrees centigrade",
        "Win32_CommandLineAccess",
        "(receive-line-signal-detect)",
        "LogDroppedPackets",
        "CIM_IKESAEndpoint.GroupID",
        "PerfFreq",
        "DSClass_To_DNInstance",
        "Object Reference/Dereference Events",
        "EnableStartupHeapPreallocation",
        "CIM_ProductParentChild",
        "The Command property contains the name of the command, batch program, or binary file (along with command line arguments) that the schedule service will use to invoke the job.",
        "The interface type as defined by the Internet Assigned Names Authority (IANA).",
        "AlternateDNSServer",
        "5 - 'ResyncInProgress': Synchronization or Resynchronization is in progress. This may be the initial 'copy' or subsequent changes being copied. ",
        "MSFT_NetDnsTransitionInterfaceAssociation",
        "HorizontalRefreshRateNumerator",
        "MaximumStorage",
        "SMBIOS|Type 4|Asset Tag",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|iMaxSockAddr",
        "FX_TRACE_RESERVED_1b",
        "Indicates whether this physical disk can be added to a concrete pool or not",
        " Specifies the per-process memory limit in kilobytes. It is ignored unless the LimitFlags specifies the Limit Process Memory.",
        "7ACA6B979B7B86A9975.1226.341122162.4158",
        "The UserPassword property may contain a password used to access resources.",
        "The Win32_USBControllerDevice class represents an association between a Universal Serial Bus (USB) controller and the CIM_LogicalDevice connected to it.",
        "The number of optimized files on the volume.",
        "The VolumeName property indicates the volume name of the logical disk.",
        "Options 2",
        "ecure",
        "#define HBA_EVENT_TARGET_ONLINE         0x402",
        "0x80050040",
        "Registry_Config",
        "5 - The requested control code cannot be sent to the service because the state of the servic",
        "CD_FC636783BFDB1A64DBDDC9D0C2A0FF3C8D482E7053A4FDFBCC7ACD0C12601125.1569.1620535831.1282",
        "QuiesceInProgress",
        "{96efd9c9-7f1b-4a89-bc04-3e9e271765f1}",
        "The DomainName property indicates the name of the domain. The DNS-style name (for example, microsoft.com.) will be returned if available. ",
        "File details",
        "Requires activate",
        "CD_E6165A2C7DA53547A217F4B5D9149125910FEBA09B8BB9B320094C6ECF81FDC5.311.2130075939.535",
        "Win32_OfflineFilesPinInfo",
        "Specifies whether to allow Video Playback redirection.",
        "A value that indicates whether the hostname is used to reach the service when matching on the URI.",
        "The qualifiers applicable to this Verb",
        "ConnectionSettings",
        "ProvisionedCertThumbprint",
        "MaxMpxCount",
        "TraceDriver Flag",
        "Call Parameters",
        "Provides the default set of permissions to Users and groups.",
        "NDIS Notify Adapter Removal",
        "Executable Path",
        "HOSTPROC_RESERVED_17 Flag",
        "The BuildNumber property indicates the build number of the operating system.  It can be used for more precise versioning information than product release version numbers",
        "|'m;|'m;",
        "TaskId",
        "The HostAddress property indicates the address of device or print server",
        "SAM Remove Member From Foreign Domain",
        "nameSpace",
        "OperationEnd",
        "Last quick scan start date and time (using round-trip UTC format)",
        "MSFT_NetServiceDifferentPIDConnected",
        "Note:  The SE_SYSTEM_ENVIRONMENT privilege is required on IA64bit machines. This privilege is not required for 32bit systems.",
        "RemoteNodeName",
        "Attributes",
        "SelectLidCloseActionPluggedIn",
        "1801 - Invalid printer name.",
        "MSNdis_80211_WEPStatus",
        "FSAN 155Mb PON",
        "LogoutOtherCodes",
        "object:Win32_OfflineFilesSuspendInfo",
        "64-bit Intel PC",
        "Modifies  Global NRPT  settings",
        "GetSetting",
        "PollingInterval",
        "tm_hour",
        "0xD002",
        "MinDevicePasswordLength",
        "Determines the fault domain type by which each column in this storage tier is isolated.",
        "ErrorOpcode",
        "The Win32_POTSModemToSerialPort class represents an association between a modem and the serial port the modem uses.",
        "CurrentMimeType",
        "supportedLDAPPolicies",
        "LogCurrentNumberOfRecords",
        "{464FFAB8-946F-11d2-AAE2-006008C78BC7}",
        "PortState",
        "Online - The specified computer is available.  ",
        "HideZoneInfoMechanism",
        "C_FBBE075DD8BF09CF56F5E18528E64829DF169227E061EAB31220ED102922500C",
        "CIM_Error.ErrorType",
        "The HardwareID property is the HardwareID of the driver e.g. ROOT\\FTDISK ",
        "ActiveTunnels",
        "RestartCount",
        "KillJob is being deprecated because there is no distinction made between an orderly shutdown and an immediate kill. CIM_ConcreteJob.RequestStateChange() provides \\'Terminate\\' and \\'Kill\\' options to allow this distinction. ",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.1520.583582620.442",
        "MaxNumMacAddresses",
        "Specified volume not supported",
        "Example: MICROSOFT PS2 MOUSE",
        "TraceMem",
        "Multiple primary paths specified when only one primary path is expected.",
        "SleepResp",
        "FX_TRACE_FUNCTION",
        "Uncorrectable error",
        "TEST_TRACE_RESERVED_12",
        "DAProxyType",
        "ROOT\\CIMV2\\TerminalServices",
        "NumberOfUsers",
        "PresharedKeyEncoding",
        "NS_2442BCC28C4B5A2EF54CB557CCCCCCDDEB8CA20A5F8F2C7C0CF36D2475F133F7",
        "Data Queue Size",
        "NewID",
        "LastQuickScanAge",
        "NetworkProfileManagerTraceGUID",
        "Dataset/Modem Error",
        "CIM_PrintJob.JobSize",
        "Updates the licensing status of Windows so that applications have access to current licensing information.",
        "Specifies whether to override the User's maximum color setting.",
        "connectionSettings",
        "EVENT_TRACE_FLAG_NOTIFYSTREAMFILEOBJ",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_FRAGMENTATION",
        "The Win32_MappedLogicalDisk class represents a network storage devices that are mapped as logical disks on the computer system. The instances returned for this class will be as follows.",
        "40014",
        "RD_TRACE_RESERVED_0f Flag",
        "MSNdis_NicSwitchCapabilities",
        "PinnedState",
        "I_4AB8B718BCED40CD13B099C54A6BC7459144DF3AF86EA1B35DB5EB6EBC6C202B.1349.115352558.284",
        "Specifies an expanded string data value. The environment variable specified in the string must exist for the string to be expanded when you call GetExpandedStringValue. ",
        "SCSI SCA-II (80 pins)",
        "NDISWMI_TRACE_RSS",
        "MDM_Policy_Config01_NetworkIsolation02",
        "VmName",
        "Session is busy since a request is already in progress.",
        "LastSuccessfulScanTime",
        "Specifies the processor group number for the first VMQ processor.",
        "The BufferOverrunCount property indicates the number of buffer overrun errors that occurred in the current session",
        "The Alias property indicates whether this instance represents the base port address or one of the ranges with an alias.",
        "PolicySourceRedirectSmartCards indicates whether the property RedirectSmartCards is configured by Server(0) or Group Policy (1).",
        "MSNdis_80211_DataRates",
        "IPv4Receive",
        "WellKnown",
        "RD_TRACE_RESERVED_15",
        "Bid2Etw_MSADDS_1_Trace_TextW",
        "The maximum time the connection can be idle before being disconnected.",
        "The number of frames successfully transmitted after exactly one collision.",
        "Off-line data collection activity was aborted by the device with a fatal error",
        "TRACE_LEVEL_VERBOSE",
        "Invalid domain name",
        "NA-7x9-Envelope",
        "Win32API|Windows Networking Structures|NETRESOURCE|dwDisplayType",
        "%ActualPID%",
        "RunOnlyIfNetworkAvailable",
        "The status of the BranchCache Hosted Cache Client Firewall Rules",
        "BIOS ROM is socketed ",
        "AvgCPULoadFactor",
        "WorkOffline - Queue print jobs when printer is not available.",
        "Win32API|Process and Thread Structures|STARTUPINFO|dwXSize",
        "guidID",
        "ReleaseServiceInstanceOnTransactionComplete",
        "Specifies the number of bytes transferred during operations, other than read and write operations, by all processes that have ever been associated with the job, in addition to all processes currently associated with the job.",
        "MsftDiscFormat2RawImage_DebugConstructor Flag",
        "#ifndef MS_SM_HBA_API",
        "The build number component of the current BIOS version information.",
        "C_4382409C2BA25AB891FE25D9946357B2012609A915D0D018CA8A80D2ABEE1CA0",
        "ScopeName",
        "EapConfiguration",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_C18626E27D5153E5E65B72B574D4E2FD4416299A7B7135AC8C51438B7D94212E5200",
        "C_D7860DB1594CB37DCB237A6AE7D8C1717E5D55CF386BCF7514E74D4C578E100D",
        "Unique identifier for objects of this class.  ",
        "SamDeleteUser",
        "WQL:UnarySelect",
        "AccountLogonLogoff_AuditIPsecExtendedMode",
        "iSCSI Initiator Load Balance Policies supported",
        "CIM_LogicalPort.Speed",
        "object:MSFT_TaskTrigger",
        "The Connection object defines parameters required when connecting to WMI",
        "Deletes current CIPolicy",
        "PolicyCacheRefreshRequired",
        "CD_318C41B790C73AD23330721F5FA83CE8CB8B0D762F5F83DFC686FAFD74664F53.1197.415966870.570",
        "Not present",
        "NetworkAdapterName",
        "PolicySourceRemoteSessionProfile",
        "PolicyDecisionStrategy",
        "SERVICE_FILE_SYSTEM_DRIVER ",
        "This is the DN string component of the tuple",
        "{8502C4FD-5FBB-11D2-AAC1-006008C78BC7}",
        "Msft_WmiProvider_ComServerLoadOperationEvent",
        "If FALSE, this virtual disk will not be added to the cluster. Note that this property is specific to Storage Spaces.",
        "{712A0B9F-4AA8-418a-823E-6421E1A895AD}",
        "OemPartnerRing",
        "MDM_AssignedAccess",
        "object:MSStorageDriver_SenseData",
        "CustomServiceNames",
        "ResiliencySettingNameDefault",
        "ReadBufferSize",
        "ref:Win32_DiskDrive",
        "The network adapter is not in a media-connected state.",
        "SecureBootEnabled",
        "The Antecedent reference represents the serial port used by the modem.",
        "The name of the data source attribute.",
        "MDM_HealthAttestation",
        "A Security Descriptor Definition Language (SDDL) formed string describing the desired access control list for this object.",
        "EnabledGlobally",
        "PackageArchitecture",
        "See CIM_System.IdentifyingDescriptions for details.",
        "TRUE if adapter should perform automatic discovery of iSNS server.",
        "{50a97b2d-99ad-4cf9-8437-b4ea0c07be4c}",
        "Temperature levels (in tenths of degrees Kelvin) at which the OS must activate active cooling",
        "MsftDiscFormat2MsfAddress_DebugConstructor Flag",
        " Deletes .ini entry. ",
        "Ide Port Information",
        "The locally unique identifier (LUID) for the network interface as a 64 bit number.",
        "IL_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251.297.1719363822.333",
        "C_5E9AFB2824E4C09259A80739D70D94E550D572E8A9E41593DAFDA14D65369AE4",
        "MSiSCSIInitiator_LUNList",
        "ExecutablePath",
        "The BadPasswordCount property indicates the number of times the user enters a bad password when logging on to a Win32 system.",
        "0x000040",
        "The DeviceID property contains a string uniquely identifying the volume on the system.",
        "JIS B1",
        "EndpointType",
        "The name of the appdomain.",
        "AllowInputPersonalization",
        "{2306fe38-dbf6-11d2-9244-006008269001}",
        "The Win32_SystemBIOS class represents an association between a computer system (including data such as startup properties, time zones, boot configurations, or administrative passwords) and a system BIOS (services, languages, system management properties).",
        "EnableFIPSCompliance",
        "try takes the form Major.Minor+, for instance 6.0, 6.1+, or 6.2.  If + is specified, then it means that the rule applies to that version or greater.  For instance, Windows Vista could be represented as 6 or 6.0, and Windows 7 or later would be represented as 6.1+.  + may only be attached to the final item in the list.  6.0+ is not valid because it means the same thing as null (all platforms).",
        "Specifies the media type of the physical disks to which allocations for this virtual disk are scoped to.",
        "Supports16BitMode",
        "Win32API|System Information Structures|SYSTEM_INFO|dwNumberOfProcessors",
        "CR_1B319F1F6B442943CD996FC1C57BB42D7AABA5E18673D64CB4BE3A2D7BB179E8",
        "C_EAAD7B12E42E8FD5A718C58D486924CE945F2F9D6534A799FEB67D3ED29E5A5B",
        "{E7CD451C-DB34-11d2-85FC-0000F8102E5F}",
        "TVolumeQuotaSetting associates the disk quota setting with a specific disk volume.",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|Low Threshold On Client Objects",
        "Semantics for transitioning T-states among dependent processors",
        "NumberOfReceiveQueues",
        "Removes a storage health intent on a storage object.",
        "{8502C546-5FBB-11D2-AAC1-006008C78BC7}",
        "CD_B0CABE1A8A062D484B15926B839DD85BE290434AB73617430C4831E218290BC6.1667.1700580522.658",
        "String",
        "The host address of the LPR port.",
        "RegistryValue",
        "Int 13h - 5.25\" /1.2MB Floppy Services are supported",
        "This table contains the property names and values for all defined properties in the installation. Properties with Null values are not present in the table.",
        "This output parameter will contain an array of all of the supported sizes for the storage tier. This parameter may be NULL if the number of supported sizes is large, but is useful for storage tiers that only support a select number of tier sizes.",
        "SetCost4G",
        "\"Unknown\" indicates the implementation is in general capable of returning this property, but is unable to do so at this time. ",
        "RSOP_ExtensionEventSource.id=\"{F31EAAD1-7FF7-4C92-B935-F59C0579F931}\"",
        "TRUE if adapter supports certificates",
        "MIF.DMTF|Temperature Probe|002.14",
        "HKEY_USERS",
        "C_6EB3291DAFAF5E4121A6DBB7E0E41C22E85218F8922D3C0FEDA4960BE686F47A",
        "\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "FX_TRACE_RESERVED_19",
        "select * from SPACES_StorageFaultEvent",
        "The InProcServer property, if applicable, defines whether the server supports inproc32 activation.",
        "CD_1DE1D06D7EB25E718A8B4717CC2834F5D199085AFABE977E92B5CC3DCFD8A932.1303.518322397.133",
        "LoginFailures",
        "The current issued token authentication settings for this service.",
        "PerfInfo_V1",
        "Specifies the maximum size, in bytes, of the driver's internal input buffer. A value of zero indicates that no maximum value is imposed by the serial provider",
        "Steradians",
        "CD_1EAA623E5E2107E59DEB71245C575469EF4587B65CD6A524FC65E9E8A98BAC62.2615.3674171710.406",
        "is not desired. 2",
        "SOAPTraceListener Flag",
        "MSFC_HBAPortStatistics",
        "The Win32_IDEController class manages the capabilities of an IDE controller device.",
        "NdisFddiStateActive",
        "LocalPortEnd",
        "BlockedUrls",
        "The PortName property identifies the ports that can be used to transmit data to the printer. ",
        "CD_2C1FABC8728F9E076F6727DBB7BA1358C4F010407356DEB983BF769E41D5848D.1105.3101978551.640",
        "Xoff Xmit Threshold",
        "StatusRetentionTimeInDays",
        "ResponseTime",
        "Layer 3 VLAN using IPX",
        "This property indicates when this profile is used last time.",
        " adapter.",
        "StandardMillisecond",
        "Serial Comm Information",
        "Intermediate CA",
        "A value that controls whether the service attempts to impersonate using the credentials provided by the incoming message while serializing the body of the response message. ",
        "AllowIMELogging",
        "{DAA6CAF5-6678-43f8-A6FE-B40EE096E06E}",
        "The CIM_PointingDevice class represents a device used to point to regions on the display. Membership criteria: Any device used to manipulate a pointer or point to regions on a visual display is a member of this class. Example: A mouse, stylus, touch pad, or tablet.",
        "rrespondence",
        "2 - CIM_ERR_ACCESS_DENIED. Access to a CIM resource was not available to the client. ",
        "Virtual Tape Library",
        "ServiceCertificate",
        "MsftDiscFormat2StreamInterleave_DebugDestructor",
        "IntranetZoneAllowFontDownloads",
        "The SecurityStatus property indicates the security setting for external input (such as a keyboard) to this computer.",
        "t-m;t-m;",
        "NDIS Transmit Errors",
        "This parameter controls the asynchronous behavior the method will follow.",
        "local|hkey_local_machine\\SYSTEM\\CurrentControlSet\\Control\\TerminalServer",
        "Affinity",
        "Data Length",
        "AllowPinnedFolderHomeGroup",
        "UnattendedSleepTimeoutOnBattery",
        "Cancel",
        "NS_741D1F510F67B02AECEE46B61323C34AF59FB3846CC56C042067E65CEDF537D4",
        "This property represents the identifiers for the underlying logs on this physical computer system. See CIM_RecordLog.InstanceID for details.",
        "ExtendedDetectedErrorState",
        "Win32_PageFileSetting",
        "49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655.1166.1475828249.3715",
        "Specifies the priority class for all processes associated with the job. Processes and threads cannot modify their priority class. Ignored unless LimitFlags specifies Limit Priority.",
        "Indicates whether the method implements an operation that can initiate a session on the server.",
        "Specifies a bitmask indicating the number of data bits that can be set",
        "CIM_PhysicalExtent",
        "segmentNumber",
        "GroupB",
        "PreventSmartScreenPromptOverrideForFiles",
        "DiablePrintingOverHTTP",
        "42012",
        "C_69C7869757A5F0A0B753F6CBF641632E43C401B354F79939A20946D52BD05C51",
        "CIM_ServiceAccessBySAP is an association that identifies the access points for a service. For example, a printer may be accessed by NetWare, Macintosh or Windows service accesspoints, potentially hosted on different systems.",
        "MDM_Policy_Result01_Licensing02",
        "Where DeviceID='#'",
        "Local UDP encapsulation port for NAT-T",
        "Allowed",
        "Use Same Proxy",
        "Friendly name of the storage tier",
        "The SeparatorFile property specifies the name of the file used to create a separator page. ",
        "The Win32_MemoryDeviceArray class represents an association between a memory device and the memory array in which it resides.",
        "Successful completion",
        "RenamePath",
        "Set_BCMinSMBLatency",
        "PLATFORM_TRACE_RESERVED_0a Flag",
        "Association between MaskingSet and VirtualDisk",
        "NumericSensorUpperThresholdNonCritical",
        "Controls whether congestion window is restarted.",
        "Reserved3",
        "C_342D3B3E95C15CE5558C1B7C7C427B6C66E4F69853BB4D1A94056D76079B0240",
        "The Win32_ServerConnection class represents the connections made from a remote computer, to a shared resource on the local computer.",
        "DOPercentageMaxBackgroundBandwidth",
        "SEL_SENSOR_NUM",
        "The ProviderOperation_DeleteInstanceAsync property indicates the number of calls to IWbemServices :: DeleteInstanceAsync.",
        "ReceiveQueueParameters",
        "{FAF76B73-798C-11D2-AAD1-006008C78BC7}",
        "MSFT_NetAdapterEncapsulatedPacketTaskOffloadElementSetting",
        "{DB91D602-DB32-11d2-85FC-0000F8102E5F}",
        "ChannelInitializationTimeout",
        "ModulePlaceHolder",
        "AGP_STD_DATA",
        "Total write errors encountered by the storage device.",
        "Remaining number of times the app can be rearmed successfully.",
        "The NDI setting data for network adapter.",
        "E.164",
        "NIC Description",
        "RouteRecordResolved",
        "The PagesPrinted property specifies the number of pages that have been printed. This value may be zero if the print job does not contain page delimiting information.",
        "11 - 'Idle': The 'normal' state for an UnSyncAssoc replica. ",
        "CSCreationClassName",
        "The server on which the printer is located.",
        "This class represents a Host Bus Adapter (HBA) an initiator port on the host system.",
        "Triggering properties of VPN connection",
        "0xEFFF0026",
        "0xEFFF0024",
        "FirewallAPI",
        "The Profile property specifies a directory path to the user's profile. This value can be a null string, a local absolute path, or a UNC path. A user profile contains settings that are customizable for each user such as the desktop colors.",
        "The number of bytes sent using the ESP protocol.",
        "0xD005",
        "I_548C7B8CAA43CC9635C7EFD11A316C9E16085EF464E2F7DF7BF493D60EC389A2.2458.3903285571.354",
        "ThreadPoolTrace",
        "Read errors corrected without much delay",
        "Assignment",
        "The AuthorizationFlags property contains a set of flags that specify the resources a user is authorized to use or modify.",
        "TelemetryConfiguration",
        "Experimental",
        "{FB9D6E62-DB36-11d2-85FC-0000F8102E5F}",
        "ForwardingEnabled",
        "The destination directory.",
        "WIn32API|Thread Object|LPTHREAD_START_ROUTINE|lpStartAddress",
        "DisableIOAVProtection",
        "Win32API|Tape Backup Structures|TAPE_GET_DRIVE_PARAMETERS|FeaturesLow",
        "SMBIOS Segment Group Number.",
        "Block",
        "RejectUnencryptedAccess",
        "The total number of negotiations that resulted in the use of plaintext (also known as soft SAs). This typically reflects the number of associations formed with computers that did not respond to main mode negotiation attempts. This can include both non-IPSEC-aware computers and IPSEC-aware computers that do not have IPSEC policy to negotiate security with this IPSEC peer.",
        "WmiQueryHardwareOffloadConfig",
        "Name of entry to be modified.",
        "Server hosting the GPO",
        "The Disabled property determines whether the Win32 user account is disabled.",
        "The PartComponent reference represents the properties of the file directory structure in the Win32_LogicalDiskRootDirectory association.",
        "MSFT_PrinterConfiguration",
        "NextHopRoute represents one of a series of \\'hops\\' to reach a network destination. A route is administratively defined, or calculated/learned by a particular routing process. A ConcreteDependency associaton may be instantiated between a route and its routing service to indicate this. (In this scenario, the route is dependent on the service.)",
        "The Setting reference represents a boot configuration for the computer system.",
        "The Disabled property determines whether the Win32 user account is disabled./nValues: TRUE or FALSE. If TRUE, the user account is disabled.",
        "UniqueIdFormat",
        "Directionality",
        "Example: 512",
        "Always On",
        "MIF.DMTF|Voltage Probe|001.19",
        "\"Supporting Entity in Error\" indicates that this element might be \"OK\" but that another element, on which it is dependent, is in error. An example is a network service or endpoint that cannot function due to lower-layer networking problems. ",
        "Application",
        "The FSCreationClassName property is a string indicating the class of the file system.",
        "ConnectionTransferRate",
        "RSOP_PolmkrPrinterSetting",
        "NumberOfEtsCapableTrafficClasses",
        "Gw_,#",
        "MSiSCSI_LB_DYN_LEAST_QUEUE_DEPTH",
        "Dot11 Connection Completion status information.",
        "Target Error",
        "An unique identifier of client.",
        "Represents a storage array that exposes virtual disks and/or a computer system that exposes file server capabilities.",
        "NS_59411655A8F95EE7BEABDFB898861DFA8E2BF23293A8AFE96B2E5BB236E7FE01\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_2C3E0B2C69ECC1F533E094C6BC0D6FE2FF50B62467F6FB0D4116BA80049303DF",
        "FX_TRACE_RESERVED_1a Flag",
        "EVENT_TRACE_FLAG_SETQUOTA",
        "Front-end only",
        "(request-to-send)/CTS (clear-to-send) supported",
        "PLATFORM_TRACE_DRIVERSTOP Flag",
        "All in One",
        "PoolNonpagedFailures",
        "Determination Per I/O",
        "LPC_TRACE_RESERVED_16",
        "Win32_WIN32_TSNETWORKADAPTERLISTSETTING_Prov",
        "Win32_FileSpecification",
        "LogFlagInfo Flag",
        "Standalone Workstation",
        "DisplayType",
        "The CapacityMultiplier property contains the multiplication factor of the Design Capacity value to ensure that the milliwatt hour value does not overflow for Smart Battery Data Specification (SBDS) implementations.",
        "Identifies the minor release of the embedded controller firmware.",
        "A list of crypto suites, in preferential order, to use when negotiating an SA.",
        "Specifies the name and the path of the program the user wants to start on logon to the Terminal Server.",
        "LoadBalancePolicy",
        "//        - or -",
        " The CIM_FileAction allows the author to locate files that  already exist on the users machine, and move or copy those  files to a new location.",
        "NEWTBD",
        "HBA_COS",
        "roperty should be set to this value to construct the mapped I/O resource key.",
        "CR_20C200D9E838157679E42B001B4147A35D03B45050CB643ED29839B5C1F1E6F1",
        "HBA_FCPID",
        "TRUE if TCP/IP traffic is integrated with the Windows networking TCP/IP stack via a software only initiator. An adapter with its own TCP/IP stack would set this to FALSE.",
        "MSFT_NetServiceExitFailedSpecific",
        "CD_8236493D7B4C97328F05E9610B58340A9B36DA2FAD39FFAA641A6E8D9062FAF7.1149.1032156782.672",
        "SigningAlgorithm",
        "ThrottleValue",
        "VPD83Type0",
        "Layer 3 Switch",
        "The number of IKE messages received that are queued for processing.",
        "Quality Normal",
        "The maximum length of time, in seconds, that an SA may be idle before it will be torn down.  0 means Not Configured.",
        "    ISCSI_ENCRYPT_3DES_HMAC_SHA1 = 1,",
        "AllowOutboundTimeExceeded",
        "CIM_PowerManagementCapabilities",
        "Test resource states based on input configuration file.",
        "This property contains the name to be given to the original file after it is moved or copied. If this field is blank, then the destination file is given the same name as the source file.",
        "\" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are \"Error\", \"Starting\", \"Stopping\" and \"Service\". The latter, \"Service\", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither \"OK\" nor in one of the other states.",
        "WPD Perf Flag",
        "Outbound address and port",
        "ZIP Disk",
        "MAPSReporting",
        "The bandwidth throttle rate action in bits per second unit. Set to 0 if not used.",
        "MsftUtils_DebugConstructor Flag",
        "NetSwitchTeam",
        "1 = It was assigned, ",
        "0x00040000",
        "R_7FCF3928CE1A9575028B7746073AE3C5F6F2163882EECBCF60F66F9FAFB60664",
        "{45DB06A5-20D5-4de3-A36C-3AB974600A4C}",
        "object:MSFT_TaskSettings",
        "{E40D5488-DB31-11d2-85FC-0000F8102E5F}",
        "NewFileSystemLabel",
        "GetFirmwareInformation",
        "The time after which the Job is invalid or should be stopped. This time can be represented by an actual date and time, or by an interval relative to the time that this property is requested. A value of all nines indicates that the Job can run indefinitely.",
        "CR_2277447C6063BFBAC05CE459DB8B2E90B2D0D7BB283ED825F0C1EAA1C62A123A",
        "A boolean value that specifies if each message contains a timestamp.",
        "MSFT_Volume",
        "ifHCInBroadcastOctets",
        "deleteExistingChannels",
        "Synchronous Clone Local",
        "The target mapping is not available",
        "{B24EF562-BBBE-11d2-ABFB-00805F538618}",
        "C_D628E03D0677752FF789EA97E9BA34C4E2A9B6A38484A7C74F4BA213CAD47E8C",
        "ROOT\\M",
        "The DNS servers which will be queried when DirectAccess is enabled.",
        "CIM_PrintJob.Language",
        "Determines how aggressively to enforce security on inbound traffic.",
        "CodeSet",
        "Last Modified",
        "MCA_ERROR_PCI_BUS_MASTER_ABORT",
        "WSD addresses for the printer.",
        "Cubic Meters",
        "43025",
        "NdisMacOptions",
        "MSFT_CliAlias.FriendlyName=\"NTDOMAIN\"",
        "Tag Id",
        "ref:Win32_VideoController",
        "The virtual disk repair operation encountered failures.",
        "The SupportsRLSD property indicates whether Received Line Signal Detect (RLSD) is supported on this serial port.",
        "Specifies whether report manager can use unsecure connection over http.",
        "M - The major version (in numeric form). ",
        "TRACE_CLASS_ALGORITHM",
        "12 - 'Failing back': Undoing the result of failover. ",
        "An array of MAC address and VLAN ID pair filters set on the queue.",
        "Values: TRUE or FALSE. A value of TRUE indicates the protocol supports data encryption.",
        "AllowStreamingAutoload",
        "IPv4/IPv6 address of the corresponding DNS servers that should be used for the specified DNS suffix",
        "ColumnNumber",
        "MSNdis_ReceivesOk",
        "The Antecedent reference is the session in the SubSession association that has a subsession.",
        "Example: C:\\WINNT\\SYSTEM32\\DRIVERS  ",
        "object:EapConfiguration",
        "Hw Epp Read Count",
        "SetForwardBufferMemory",
        "The Username parameter is a pointer to a constant null-terminated character string that specifies the account name to use when connecting to the domain controller. The string must specify either a domain NetBIOS name and user account (for example, \"REDMOND\\user\") or the user principal name (UPN) of the user in the form of an Internet-style login name (for example, \"someone@microsoft.com\"). If this parameter is NULL, the caller's context is used. /nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. ",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_priv",
        "OutstandingTasksPerUser",
        "alternateOffset",
        "CR_259A5E159C9BC70687CA1D3524FF3E5AFC0180D51D46E1351D0D2A9510F67A46",
        "CurrentControlSet",
        "CR_FD4F4D3C59F149D4ECD4F84E3818809F406BCF7E122C03BCFA93C04C2B2F4607",
        "truecase",
        "The UPN of the registered user",
        "LAT Protocol",
        "data prefetch (both hardware and software)",
        "Enumerates Guids registered with WMI. The InstanceName is the Guid.",
        "{26106246-4473-4295-841b-4a51c6afc3db}",
        "SetByUser",
        "subjectName",
        "This method converts a SDDL string security descriptor format to a __SecurityDescriptor instance.",
        "AllowPerformanceHit",
        "CD_6A87D660F0F6A66279CF024432941A2BC16A9043D5A3CF26ADC36D1DFFEBF2B9.1228.1.9113",
        "C_390D5ED0BE7821A9A41296EE6280A1479152221DCE5D93BE2F8AC7791409FDC4",
        "SetServerWeight",
        "C_AEB1302AC843DE3720FDF5243FA6FA29740C3EF6F87994A8A6D26F14FA996B57",
        "BandwidthAssignmentTable",
        "UINT32 Value",
        "WHERE JobId=#",
        "Share",
        "Get the content of a setting location template file by template ID.",
        "The DriveIntegrity property indicates whether files can be accurately read from the CD device. This is achieved by reading a block of data twice and comparing the data against itself.",
        "56001",
        "Logs the error, displays a message box and continues the startup operation.",
        "Name of the threat",
        "rE083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "A PolicySet aggregated into a PolicySet.",
        "0x004000",
        "The number of consecutive hours that this Device has been powered, since its last power cycle.",
        "ObjectParameter",
        "CD_90D6DB96E4E52DF3FCB751D8C2491313C169EEA2DEA2212CBFE4EFF8C0A5E947.1503.1.9213",
        "object:VpnServerAddress",
        "CQClose performance counter missing",
        "CIM_RegisteredSpecification",
        "TR_TRANS",
        "WMI|Win32_BootConfiguration",
        "This association relates an MSI check with any setting information it requires.",
        "CIM_NumericSensor.UpperThresholdNonCritical",
        "Transmission Selection settings are enabled.",
        "The Tone property contains the command string that instructs the modem to use tone mode for dialing. The phone line must support tone dialing.",
        "Non-Paged Pool Usage Quota",
        "GetTargetResource",
        "LimitEnhancedDiagnosticDataWindowsAnalytics",
        "AES-128",
        "Structural representation of a SECURITY_DESCRIPTOR",
        "The Element reference represents the printer that can be configured with the Settings member.",
        "0xD001",
        "The storage provider does not support a required profile.",
        "// The number of times that the TCP stack has failed when receiving IKE messages.",
        "Count of Elements in LoadBalancePolicies array",
        "SECHC_LOG_FLAG_FUNCTION",
        "CD_92DB14183145FECB25D8F810D51EB91465DF70CF55ECB1D5FEEDBFFC4B20AADD.1469.874884988.635",
        "MSNdis_EthernetCurrentAddress",
        "A Windows error object that encapsulates what is in CIM_Error as well as includes original_error.",
        "y41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "ref:MSFT_MaskingSet",
        "MsftDiscFormat2Raw_DebugConstructor",
        "AllowPINLogon",
        "Synchronous TokenizedClone Local",
        "The specified file system is not supported",
        "#define ISCSI_LOGIN_OPTIONS_DEFAULT_TIME_2_RETAIN       0x00000010",
        "LPCDRVR_TRACE_RESERVED_0b Flag",
        "This is the id of the object that this element belongs to.",
        " Where Account = # and Volume = #",
        "UF_NORMAL_ACCOUNT - default account type that representing a typical user. ",
        "driver",
        "StorageEnclosure",
        "MSFT_NetSwitchTeam_TeamMember",
        "Array of report managers pointing to a location that would help generate reports for DSC",
        "The SetArpAlwaysSourceRoute method is used to set the transmission of ARP queries by the TCP/IP. The method returns an integer value that can be interpretted as follows: ",
        "{A361A7AE-DB36-11d2-85FC-0000F8102E5F}",
        "StorageSubsystemUniqueId",
        "HOSTPROC_TRACE_IO Flag",
        "I_95836D7E2E497A1F78FB3DE04D6CC7B1E86FB113E1FC2C16F2960FB52159CE1E.556.1.28406",
        "MinOperatingBudget",
        "AllowForestSearchOrder",
        "The Win32_DriverForDevice class represents an association between a printing device on a Win32 computer system and the driver that supports this device.",
        "Replication groups",
        "18 bit - Install Invocation - The APIs were invoked during install. ",
        "C_B7CB0F72C5888EFB87CAA914B3258F858F11D8FC7438CC22070822389ABE2635",
        "MIF.DMTF|Power Supply|004.8",
        "The Domain property indicates the name of the Windows domain to which the user account belongs.",
        "ForceOutboundConnections",
        "CIM_Card",
        "SCSIPort",
        "MCA_WARNING_SYSTEM_EVENT",
        "Service From Back",
        "RSC statistics supported by a network adapter",
        "IDE SMART",
        "Cardbus",
        "RcvControlState",
        "Win32API|Process and Thread Functions|SetPriorityClass|dwPriorityClass",
        "This field reports the maximum number of tolerable physical disk failures that could occur before data loss would occur.",
        "50008",
        "SMBIOS|Type 3|System Enclosure or Chassis|Thermal State",
        "Medium",
        "Disables the SRIOV properties on the network adapter.",
        "LocalServiceHost",
        "FileIntegrity",
        "{1221948A-6332-4ac2-AA04-268AABCECE4F}",
        "0x80050054",
        "SMART Notification",
        "MSFT_CliAlias.FriendlyName=\"NIC\"",
        "UpdateSource",
        "Heap ReAllocate",
        "{ca1cf55c-9e49-4ad3-8038-39cb6f66af11}",
        "MIF.DMTF|Software Component Information|002.5",
        "Start Mode",
        "Encrypted",
        "ref:MSFT_InitiatorPort",
        "Win32_PrintJob",
        "A call was made to HBA_LoadLibrary when a library was already loaded",
        "The datatype of this job.",
        "Parameter4",
        "Sets Load Balance Policy for the iSCSI Initiator",
        "IR_1275BE448083C5AAB33DAF19956853ED9EA842E05F94D0AD39A63BA94DDA43EA",
        "Adapter/Card Error",
        "Identifies the type of access that caused the error",
        "MSDeviceUI",
        "Win32_PnPDevicePropertySint32",
        "IsReadyInformation",
        "WSAT_TraceEvent",
        "WMI|Win32_Printer",
        "ShellLauncher",
        "Win32_TSLogonSetting",
        "PCI_COMP_INFO_DeviceNumber",
        "This method creates a storage pool from available physical disks contained within a common primordial pool. A physical disk is available for storage pool creation if its CanPool property is set to TRUE. Storage pool creation is only available when the SupportsStoragePoolCreation field of the storage subsystem is TRUE.",
        "DisableErrorSourceRtn",
        "0311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        "C_D63BC7563E6D81203297654B46F4C100817863DC21DB2D7C0F010EBB549665E0",
        "CD_AD7EFADAD1289B4A3FEF0D60EBF19DD1D014EA7A1302D0431E7F57E3F564CBFB.2198.3176583093.3209",
        "UseSSL",
        "Installation Type: 1 = basic, 2 = advanced",
        "NotAssigned",
        "The PixelsPerYLogicalInch property indicates the resolution along the Y axis (vertical direction) of the monitor.",
        "FILEID",
        "LicensingDescription",
        "EnumTrstedDomEx_Start",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_logon_hours",
        "0xEFFF003F",
        "C_15D17602950F6C84D799561B467DD6E41D14A7C8F3BB2D223F118DC47EBDE909",
        "Substitute -  Substitutes device fonts for TrueType fonts. This is the default action for PostScript(r) printers.",
        "The filename in which to store the firewall log.",
        "0x0002",
        "The body of the email message.",
        "C_DCE2026ED26CB0FBF10B78E8B97608E5F27A055E0A11B1BC99B2DBD53F24F7F0",
        "Win32_SoftwareFeatureAction",
        "Decoupled:Com:FoldIdentity(true)",
        "VssTracingEventClass",
        "Specifies whether to lock the tag to prevent changes to the tag's contents.",
        "object:Win32_FolderRedirectionHealth",
        "    </dependentAssembly>",
        "The IP address that this ProtocolEndpoint represents, formatted according to the appropriate convention as defined in the AddressType property of this class (e.g., 171.79.6.40). This single property is deprecated to replace it by specific IPv4 and v6 addresses.",
        "Kernel Idle State Change Event",
        "Specifies parameters for the quick mode negotiation as well as dictating the crypto sets that should be proposed during the exchange.",
        "This method allows the user to add members to this replication group.",
        "Not Managed",
        "The SameElement represents persistent IP route in thisrelationship.",
        "SupportsQualityofService",
        "This property contains the user profile's path on the local computer.",
        "Target CHAP secret given is invalid.",
        "CIM_Product is a concrete class that is a collection of physical elements, software features and/or other products, acquired as a unit. Acquisition implies an agreement between supplier and consumer which may have implications to product licensing, support and warranty.",
        "The physical extent participating in the redundancy group.",
        "WmiSetInterruptModeration",
        "LUAInstall: error 0x00000005 setting flags [{93D11DE9-5F6C-354A-A7C5-16CCCA64A9B8}]",
        "The DNSEnabledForWINSResolution property indicates whether the Domain Name System (DNS) is enabled for name resolution over Windows Internet Naming Service (WINS) resolution. ",
        "AllowAddOnList",
        "Off-line data collection activity was suspended by an interrupting command from host",
        "NDIS Status External Connectivity Change",
        "The short address the NIC is currently using.",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2070.810431740.180",
        "HostedCacheHttpsConnectPort",
        "MUILanguages",
        "Example: C:\\PAGEFILE.SYS ",
        "Unique identifier for an application.",
        "The Win32_TSVirtualIPSetting class is an association with Win32_TerminalService as the Element and Win32_TSVirtualIP as the Setting property This includes capabilities such as Enable Virtual IP, Set Virtual IP modes Per-session/Per-Program.Add/Remove a program to/from the list of Programs that needs a virtual IP.Enumerate Network Adapters and set a Network Adapter to use.Enable/Disable Virtualization of Loopback Addresses Per-Program.",
        "TransitionState",
        "Unique ID of the settings location template",
        "R_371B99EAC7A90A5236CCFB6AAA21E86782D010716CB9A5D8B21ACD2546B950BA.276.1973707585.518",
        "This class encapsulates an association between a session and a provider",
        "MonthlyLinkLocalBytes",
        "TR_DLL",
        "PaperSizesSupported",
        "AllowMicrosoftAccountSignInAssistant",
        "HttpHelpPageUrl",
        "PolicyStoreSourceType",
        "ref:MSFT_TargetPortal",
        "NdisFddiRingNonOperational",
        "MSFT_TaskSettings2",
        "Physical system enclosure management.",
        "MDM_Policy_Config01_WindowsDefenderSecurityCenter02",
        "Offline All",
        "C_FBD8C5E53E09306926C4A97ACDB9C4FE5F1E24FABD58C6E18FCDBF7AF5106FB4",
        "SenseIsRunning",
        "MSiSCSI_RequestTimeStatistics",
        "CD_BBE16080A7EF2F0B1445053D0994143FB21FAF6CBC7F65EF8D2106E74618BE06.1499.1440657218.584",
        "Is protection technology enabled",
        "A BinarySensor provides a boolean output. Given the addition of the CurrentState and PossibleStates properties to Sensor, the BinarySensor subclass is no longer necessary, but is retained for backward compatibility. A BinarySensor can be created by instantiating a Sensor with two PossibleStates.",
        "Accept performance counter missing",
        "Read-Only",
        "The Alias property indicates whether this instance represents the base port address or one of the ranges with an alias. A base port address is a predetermined port address dedicated to a specific service or device. A port alias address is one that a device responds to as if it were the actual address of an I/O port. ",
        "{8502C590-5FBB-11D2-AAC1-006008C78BC7}",
        "A set of authentication proposals that can be used in Phase 2 of authentication.",
        "The ProviderOperation_StopRefreshing property indicates the number of calls to IWbemHiPerfProvider :: StopRefreshing.",
        "object:MSNdis_NetworkAddress",
        "object:PeerSecuritySettings",
        "The AutoReboot property determines whether the system will automatically reboot during a recovery operation.",
        "GET_ALL_ERROR_SOURCES",
        "SMBIOS|Type 18|32-bit Memory Error Information|Error Address",
        "DisallowStoringOfRunAsCredentials",
        "TROJANFTP",
        "ExportDataCache",
        "Error encountered in local configuration manager during configuration.",
        "CD_CCF174B484763861274B422B027A53D668C2557EB827A557AB0E7FF6CCAC8EF5.2041.308462118.859",
        "DeviceEnumerationPolicy",
        "MDM_Policy_Result01_Camera02",
        "Monitor brightness control API",
        "SPACES_StorageJobToAffectedStorageObject",
        "MsftWriteEngine2_DebugConstructor Flag",
        "{BFFF7609-3BB6-4E26-86EC-A28B40478D41}",
        "internetCallProgram",
        "Clears any diagnostic information being stored by the storage subsystem. This does not clear or reset any logs; it only frees any temporary files used by the GetDiagnosticInfo command",
        "MemoryDebug",
        "TruncationLength",
        "AdminDomain for IPMI",
        "Ndis80211PrivacyFilter",
        "IL_B0A591E0FA79B0A35E33827E8EE7FAA02C773C7B9DC2117EFC5619AA882D49AD.2678.1220187116.287",
        "Ioctl Based",
        "Bid2Etw_ADODB_1_Trace_TextA",
        "hertz * 10^6",
        "Set resource states based on input configuration file.",
        "MessageParameters",
        "Cannot complete within Timeout Period",
        "C_EA2A17F7F9011AC9DF174FA64700FA87A332EAD70BB23C4338DE684F34E350D6",
        "The SettableDataBits property determines whether the number of data bits can be set on the Win32 serial port",
        "ResourcesOpened",
        "StoragePool",
        "The DcSiteName property indicates the name of the site where the domain controller is located. This value may be NULL if the domain controller is not in a site (for example, the domain controller is a Windows NT 4.0 domain controller).",
        "OP_IEConnectionWinINetSettingsLink",
        "SupportInterSubsystem",
        "Boolean indicating that the Device can be power managed - ie, put into a power save state. This boolean does not indicate that power management features are currently enabled, or if enabled, what features are supported. Refer to the PowerManagementCapabilities array for this information. If this boolean is false, the integer value 1, for the string, \"Not Supported\", should be the only entry in the PowerManagementCapabilities array.",
        "SMBIOS|Type 1|System Information|Manufacturer",
        "bits 0-2:  Precedence. ",
        "#define ISCSI_HBA_CHAP_VIA_RADIUS                  0x00000008",
        "TEST_TRACE_RESERVED_11",
        "C_B1B3F51451050560540508AE61C59186CBB46746C5DF2B2C8763635DE336A9D9",
        "DriveLetterString",
        "PrincipalPermissionMode",
        "The UIRestrictions property indicates the restrictions on the job regarding the UI.",
        "WsdAddress",
        "Given connection was not found in the session.",
        "Indicates if the subsystem allows a virtual disk to be reduced in size (using the Resize method of the virtual disk instance).",
        "_UUUUUUUUUUUUUUUU",
        "ExcludedExtensions",
        "TEST_TRACE_FUNCTION Flag",
        "%StartupTime%",
        "SampleSharing",
        "The Reserved parameter provides a way to extend Win32Shutdown. Presently, the Reserved parameter is ignored.",
        "StartByPath",
        "CommandLineTemplate",
        "MEM_PLATFORM_TARGET is valid",
        "KEYBOARD_PORT_WMI_STD_DATA",
        "CIM_System.CreationClassName",
        "CD_8388B68C4DB97845C3C1C2649AA6C6E0CAC0BF4C68420F762A0E16A42522910B.284.3923597081.1732",
        "Memory Access",
        "TRACE_FLAG_DEBUG2",
        "This property specifies the deny-only SIDs that will be added to the access token, if SecurityLimitFlags is Filter Tokens. This property can be NULL if you do not want to specify any deny-only SIDs.",
        "EnableBIDI",
        "SecurityStatus",
        "PerProcessUserTimeLimit",
        "RDAccount",
        "VL-VESA is supported",
        "DedupMode",
        "HOSTPROC_RESERVED_15 Flag",
        "    // 1 = PFS Enabled; 0 = PFS Disabled",
        "CIM_CurrentSensor",
        "HKEY_LOCAL_MACHINE",
        "The current execution state of the storage job.",
        "The portal's socket number",
        "Forces the removal of Nrpt Rule from the VPN profile.",
        "NS_8AB6DA69CB6627FB081BC37E8D617B6783D655C47A60290F754524183A5A27DA\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_692596727A249B1A3EFAB222D026A12F1773B5DA1F8DB7A7F844A0179E73C0B9790e",
        "MSFT_ExpressionBegin",
        "M_StorageExtent",
        "SettingSource",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_5|pPrinterName",
        "Win32_ServerSession",
        "IsEndorsementKeyPairPresent",
        "Unable to gather the operational log of the storage subsystem.",
        "XT/AT Compatible",
        "The PelsHeight property indicates the height of the displayable surface.  ",
        "PhyType",
        "Maximum number of PD transmit queues that can be allocated on the default VPort.",
        "Expansion Chassis",
        "A power setting data.",
        "importCurrentConnSettings",
        "A PhysicalExtent is used to model an SCC RAID implementation. It defines the consecutive addressable block addresses on a single storage device, that are treated as a single StorageExtent and that are in the same StorageRedundancyGroup. An alternate possibility, if automatic configuration is used, is to instantiate or extend the AggregatePExtent class.",
        "TcbTablePartitions",
        "Generic Fabric Port",
        "Requests that the fan speed be set to the value specified in the method's input parameter. The return value should be 0 if the request was successfully executed, 1 if the request is not supported and some other value if an error occurred. ",
        "IPv4TransmitTcpOptionsSupported",
        "DownloadManagerName",
        "MaximumDownloadSizeMB",
        "The ErrorTransferSize property specifies the size of the data (containing the last error) being transferred. This property is set to 0 if there is no error.",
        "AttackSurfaceReductionRules",
        "PortalInformation",
        "ConfigurationSource",
        "R_058D669F3B99A388BB8D1F1BAFC9202BEC4D2384EDA7810CC1FFDDDBF965001E.2459.3997658301.558",
        "Default - The printer is the default printer on the computer.",
        "The content information version this client will request from content servers",
        "object:MS",
        "TracingMemory Flag",
        "object:MSFT_NetAdapterLargeSendOffloadV1Capabilities",
        "// ports.  If these values are false, Hyper-V will not attempt to use DH-CHAP.",
        "Web Caching",
        "Updates WNS Configuration",
        "This device is not working properly. One of its drivers or your registry might be corrupted.",
        "Ethernet MAC Address",
        "C_18488E32552B12B20AFF109B1C469144409190DFA262326863BED6DDC834F584",
        "MsftDiscFormat2Tao_DebugGeneral Flag",
        "IpProtocol",
        "Shareable",
        "CIM|CIM_VideoControllerResolution",
        "UserSid",
        "GetByAllApp",
        "Specifies the address of the remote VPN server to which the client will connect. Can be specified as a URL, friendly name, IPv4, or IPv6 address.",
        "MPI Bus",
        "Interface metric, added to route metrics for all routes over the interface. Default is automatic.",
        "I_C2E2D7F294A39E950FCB0FE91EB41D6C66630273B2EF4990C97F60DB582F2E17.1480.1055895111.278",
        "NonSackRttResiliency",
        "HideLock",
        "IL_5386CC6AC469C7F08CD169C28544D1F527C5084ADD70DCC11E9F92885E748C22.26.2765184564.195",
        "Differential Volume",
        "R_63AE4E45903071352AF2BD8A706C93C6350EBABCD37D7081D126C78DAB2B5B46.313.3042202754.518",
        "MSNdis_VendorDriverVersion",
        "Win32_SessionProcess",
        "Line Number",
        "MSFT_NetSAAssociation",
        " are not enough resources to complete the operation.",
        "LetAppsAccessTrustedDevices_ForceAllowTheseApps",
        "CIM_VideoController.CurrentVerticalResolution",
        "InitiatorInstanceName",
        "Encryption method plumbed in IPsec policy",
        "If IPV4 Address is specified as the Address Format then this conains the binary IPv4 ip address",
        "{05901221-D566-11d1-B2F0-00A0C9062910}",
        "NETIO_TRACE_SEND",
        "IL_2E857E8085C23F260E4A5714870E085AF1A5EB43D390A00657752F8ABAC8FA75.2459.2781981217.352",
        "MSMCAEvent_MemoryHierarchyError",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\Insertable",
        "IsShadowed",
        "\"None\" indicates that the implementation (provider) is capable of returning a value for this property, but not ever for this particular piece of hardware/software or the property is intentionally not used because it adds no meaningful information (as in the case of a property that is intended to add additional info to another property). ",
        "Control the redirection of smart card devices in a Remote Desktop Services session: (0) Remote Desktop Services users cannot use a smart card to log on to a Remote Desktop Services session, (1) smart card device redirection is allowed.",
        "FC Id",
        "0xEFFF0007",
        "DiskNumber",
        "0xffff",
        "RestrictUnauthenticatedRPCClients",
        "StorageChassis",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|EnablePMTUDiscovery",
        "AllowCamera",
        "{791ad1a1-e35c-11d0-9692-00c04fc3358c}",
        "The LSO V2 current capabilities of the Adapter.",
        "WFP_TRACE_ALE Flag",
        "Specifies the time at which security intelligence update check happens. By default the signatures are checked before the scheduled scan.",
        "TargetIPv6Addresses",
        "Reserved for Remote Replication Services",
        "PolicyType",
        "IPv6MaxOffLoadSizeSupported",
        "R_D441AD3F69852AA912E7DB88FCCCC4374628FEB4888BBCF4D0B24CAE723208E2",
        "PLATFORM_TRACE_RESERVED_0b",
        "Friendly name of the site",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|DeviceType",
        "GetCurrentRedirectableAddresses",
        "This field indicates the operating system type running on the host of the initiator port.",
        "CD_13D55C842CDBA0C119A52B652E2B026F106F2E9BE68DD61A338E909E5F70C55C.1149.3464545490.608",
        "DesiredStorageTierName",
        "TimerResolution",
        "Critical Trippoint",
        "MSFT_TaskLogonTrigger",
        "Boot From PC Card (PCMCIA) is supported",
        "Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|WriteTransferCount",
        "CIM_RecordLog.CurrentNumberOfRecords",
        "CR_9257E4A3C9993B750EBCB6C34C9BA11105FABAD75B9C0DE005A64417B00B58B0",
        "R_30D380391F0C7BBDBEB938061EF85587FF8CAC2EB47D3C2BB31A90F771936E23",
        "WriteFailure",
        "PnrpPeerResolverBindingElement",
        "Win32API|Network Management Structures|name",
        "OutgoingIPProtocol",
        "ROOT\\cli",
        "RequirePrivateStoreOnly",
        "Property for controlling whether IPsec is required or not for DA",
        "full line read",
        "FD3BBD4C42AC2F7FEF264340A9EB78A581FE5C28561CB63EDF780B329EAC2EE4",
        "A system defined name for this storage job.",
        "Display type",
        "The SessionId property specifies the unique identifier that is generated by the operating system when the session is created. ",
        "MopriaDiscoveryResourceId",
        "(data-terminal-ready)/DSR (data-set-ready) supported",
        "True if the ODBC connection pooling PerfMon counters is enabled.",
        "PreventOverrideForFilesInShell",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_B3CCF51DA7E2E82EF4B967050224C72E8B5296498ACE167E310066C0B48C98F4b952E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "CR_7E9D3FC591CA732EEA61C4B739CB4B4C95CC90462692A33742DEEEDCF2ED6366",
        "CR_F77EA4DCA78917FF5BEAD9815A0440B9CD3C526312D9427341EC66F96C8BAA82",
        "2-way Set-Associative",
        "Contains properties of the appdomain.",
        "GuidName1",
        "Denotes the provisioning type of the virtual disk. ",
        "7 - 'Data Integrity Scan Required': A data integrity scan is required.",
        "D&m;D&m;",
        "Unlocks a network adapter",
        "There is no IKE authentication information available.",
        "CIM_InstIndication",
        "The MIME type associated with this extension.",
        "C_45999BE1E716B224CDC60BBAEC2E4A9422A7548870411AB5310F9D9DCF7A8F92",
        "NETIO_TRACE_TUNNEL",
        "TEST_TRACE_RESERVED_05 Flag",
        "Denotes the iSCSI Target Creation Scheme supported by the subsystem. ",
        "The IPXNetworkNumber property represents an array of characters that uniquely identifies a frame/network adapter combination on the computer system. ",
        "VirtualIPActive",
        "LastErrorCode",
        "MSFT_PrinterPort",
        "CIM_SoftwareInstallationService.InstallFromURI(InstallOptionsValues)",
        "Disk Class Driver Tracing Provider",
        "Number of drives in the changer",
        "SMBIOS|Type 4|Core Enabled",
        "ShortcutFilename",
        "An enumerated integer that indicates that the referenced setting is used when the system is running in AC. ",
        "Serial Performance Data",
        "TotalUnmovableFiles",
        "CustomChannelBinding",
        "The Win32_ProcessStartup class represents the startup configuration of a Win32 process. The class is defined as a Method Type definition, which means that it is used only for passing information to a method (a procedure that provides access to an object's data).",
        "FX_TRACE_RESERVED_1e Flag",
        "Capabilities of the media access device.  ",
        "The Win32_SubSession association defines relationships between sessions where one session is a part of or utilizes another session for example where a Terminal session uses a Logon Session.",
        "The SendAdminAlert property indicates whether or not an alert message will be sent to the system administrator in the event of an operating system failure./nValues: TRUE or FALSE. If TRUE, the system will send an alert to the system administrator.",
        "Remaining number of times the client can be rearmed successfully.",
        "Specify the path of the program that need to use a Virtual IP. If the path is invalid or does not exist, the return value should indicate appropriately. The path is correct it will be added to the list of program in ProgramList.",
        "If the SMP is of type 2 - 'SMI-S', this field contains the protocol, IP address, and port of the SMI-S server. This field will be NULL otherwise.",
        "C_94BCFE87DCC2646309FB0D14E8A88AA9E4F4AA46940EF1448DB7AFC278BFB67A",
        "The BitsPerPel property indicates the number of bits used to represent the color in this configuration (the bits per pixel).",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_0B5AC83FB2725D33B41CFF3B51EF33467B960FD4E7B54F055ED580C64C086270",
        "CIM_MessageLog.CreationClassName",
        "_CORE_",
        "RSOP_PolmkrLocalUsersSetting",
        "MDM_Policy_Result01_Settings02",
        "The Win32_SerialPort class represents a serial port on a Win32 system.",
        " Creates a new entry or appends a new comma-separated value to an existing entry.",
        "NDIS Receive Filter Parameters",
        "Represents a suite of crypto algorithms to propose.",
        "CI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "WPD_TRACE_LEVEL_RESERVED",
        "970C0998-41FE-4275-B7D9-7DABAD3FBC4D",
        "The FileType property is a string descriptor representing the file type (indicated by the Extension property).",
        "Tru64",
        "The return type of the operation.",
        "0xC0000016",
        "Coffee",
        "PropertyName is an enumeration of the properties: 0 = LPTPortMapping, 1 = COMPortMapping, 2 = AudioMapping, 3 = ClipboardMapping, 4 = WindowsPrinterMapping. Each of them is a flag that is either False or True .according as Value is set to 0 or 1 respectively. The call returns 0 for success if the PropertyName is not under Group Policy / Server-overridable and an error otherwise.",
        "Indicates the DNS publishing status of a KMS host: 0=Disabled, 1=Auto publish enabled (default).",
        "An array (bag) of strings that specify the administrator -defined roles this System plays in the managed environment. Examples might be 'Building 8 print server' or 'Boise user directories'. A single system may perform multiple roles. ",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|Domain",
        "Specifies the name of the resiliency setting that should be used when determining the supported sizes. Note that the sizes returned may be different depending on the resiliency setting.",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_B4A2C5E94294CA48EE83444B581B7715F0456C2AE322533C1FC870F4B341BC92",
        "Power Meter Conforms To Profile",
        "MSFT_NetTCPConnection",
        "{6EBF1FC0-DB33-11d2-85FC-0000F8102E5F}",
        "UseRADIUSForCHAP",
        "The maximum nested node depth per read.",
        "Specifies the media type to use when creating the virtual disk.",
        "Network Inspection System signature version (major, minor, build, revision)",
        "AllocationUnitSize",
        "This is a wrapper method used to read BMC SEL log.",
        "MIF.DMTF|Voltage Probe|001.10",
        "PolicySourceColorDepth",
        "override",
        "The Dependent property references a DFS node.",
        "The boot service hosted on the system.",
        "Values: TRUE or FALSE. A value of TRUE indicates the parity can be set.",
        "ref:Win32_ODBCSourceAttribute",
        "A boolean value that specifies whether TCP port sharing is enabled for this connection.",
        "Allocated space on differential area volume",
        "DatabasePath",
        "The Metric1 property contains the primary routing metric for this route. The semantics of this metric are determined by the routing protocol specified in the route's ipRouteProto value. If this metric is not used, its value should be set to -1.",
        "BTU per hour",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services|DhcpServer",
        "The process id of the process that hosts the service.",
        "NdisCoMacOptions",
        "IKE_AUTHENTICATION_PRESHARED_KEY_METHOD",
        "e last call to HBA_RefreshInformation ",
        "C_D6F23AC5CCBEB47ECCF7BF129523258879FDED9D282F558043FF80249A7ED596",
        "Win32_PnPDevicePropertyDateTime",
        "Int16Array",
        "0xC005007B",
        "The StartFileName input parameter is a string that names the child file/directory to use as a starting point for CopyEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from the previous method call. If this parameter is NULL, the operation is performed on the file ordirectory specified in the ExecMethod call.",
        "object:MSNdis_PortArray",
        "MONITORINGSOFTWARE",
        "{04C8A870-3369-12F8-4769-24E484A9E725}",
        "ScheduledInstallThirdWeek",
        "Indicates the set of security properties that are required to be available.",
        "MaxNumberOfRecords",
        "LinkState",
        "DeliveryOptimizationMIProv",
        "Example: 256  ",
        "MDM_Policy_Config01_ApplicationManagement02",
        "{8b20d3e4-581f-4a27-8109-df01643a7a93}",
        "A Numeric Sensor is capable of returning numeric readings and optionally supports thresholds settings.",
        "STORAGE_FAILURE_PREDICT_THRESHOLDS",
        "S-1-5-32-545",
        "FragmentedDirectoryExtents",
        "Stack8",
        "{8502C500-5FBB-11D2-AAC1-006008C78BC7}",
        "ISO2022",
        "DWORD 1 = true, 2 = false, 3 = can't find file",
        "FC Switch",
        "GetPeerSystems",
        "MSNdis_80211_ReceiveAntennaSelected",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.314.1925181483.368",
        "This field describes the maximum number of light parities that can be formed for parity-based resiliency settings. If the resiliency setting is not parity-based, this field will be set to 1.",
        "WorkflowOperationBehavior",
        "SubChassis",
        "RD_TRACE_CANCEL",
        "Wireless Client Trace",
        "CIM::Core::Service",
        "I_2381C996A59A0D1EB6DDD79E1C697FECC05884247B858E341AE1AAFDFB086D7B.1196.3074802508.267",
        "Rating Systems",
        "ActiveStore",
        "L3CacheSpeed",
        "ref:MSFT_NetEventPacketCaptureTarget",
        "{C741E1B8-2F7F-4f2b-9A0C-57FCFD89F5C8}",
        "ipsecNegotiationPolicyReference",
        "Fast IO Check If Possible",
        "New inbound and outbound link speeds for the adapter.",
        "Represents the Neighbor in TCPIP WMIv2",
        "ProgressStatus describes the status of the association with respect to Replication activity. Values are: ",
        "0xC005003F",
        "Manual Answer",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\Control",
        "The CIM_PhysicalPackage class represents physical elements that contain or host other components. Examples are a rack enclosure or an adapter card.",
        "XOffCharacter",
        "RD_TRACE_WMI",
        "Proxy Override",
        "UltraSPARC",
        "MCA CPU Error Event",
        "KeepAliveEnabled",
        "ODBC PerfMon Counters Configuration.",
        "The Description property is the Description of the driver e.g. Volume Manager ",
        "megahertz",
        "The AppID property is a Globally Unique Identifier (GUID) for this DCOM application.",
        "C_56ACCF81C026D704BF64439555ED0FE36A1018BEC0E78E085DF8A96CFE6A37EE",
        "SPACES_StorageSubsystemToInitiatorId",
        "SetAttributes",
        "CIM_SAPSAPDependency is an association between one ServiceAccessPoint and another ServiceAccessPoint that indicates that the latter is required for the former to utilize or connect with its Service. For example, to print to a network printer, local Print Access Points must utilize underlying network-related SAPs, or ProtocolEndpoints, to send the print request.",
        "Running/Full Power",
        "MIF.DMTF|Operational State|006.4",
        "LUAInstall: error 0x00000005 setting flags [{72eb61e0-8672-4303-9175-f2e4c68b2e7c}]",
        "Disable catch-up full scan.  A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time.",
        "Specifies NULL encapsulation.",
        "A free-form string specifying information related to the CIM_ReplacementSet.  The purpose of the set or information related to how the component elements are replaced may be included in this property.",
        "CD_C69F291BE89C7DCF47D514EEA88ABF7BDEC9B45B40FE7D549762134D0ED90168.315.70871812.1043",
        "NewStartType",
        "No storage pools were found that can support this virtual disk configuration.",
        "EndExtension",
        "rFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "The DeviceID property contains a string uniquely identifying this UPS device with other devices on the system.",
        "SupportsElapsedTimeouts",
        "Common base class for all storage fault domain objects",
        "NRI Engine version (major, minor, build, revision)",
        "SignatureUpdateCatchupInterval",
        "Number of contiguous ProtectedSpaceExtents counted before looping back to the first ProtectedSpaceExtent of the current stripe. It is the number of Extents forming the user data stripe.",
        "select * from Win32_SystemConfigurationChangeEvent",
        "SamEnumUsersInDom",
        "PredefinedCallerApplication",
        "Logout Normal",
        "CD_3B46459D96BAF6024CC69D0B547D339FA3140A99F61C6D7F2039EDDAAF55977A.2076.1.25199",
        "The SuiteMask property indicates a set of bit flags that identify the product suites available on the system. This member can be a combination of the following values: ",
        "CD_15DF3954917D19E28725C2F53AE379712BC276A2F92080C36C49446645CD4952.2019.557995404.2064",
        "CIM_PCVideoController",
        "QKeDr",
        "ns, to address implementation needs for an array property, and to provide a migration path from today\\'s environment to the future. This change was not made earlier because it required the deprecated qualifier. Due to the widespread use of the existing Status property in management applications, it is strongly recommended that providers or instrumentation provide both the Status and OperationalStatus properties. Further, the first value of OperationalStatus should contain the primary status for the element. When instrumented, Status (because it is single-valued) should also provide the primary status of the element.",
        "SetStorageTier",
        "Failure Predict Status",
        "RequireProvisioningPackageSignature",
        "CompTIA",
        "Win32_USBHub",
        "TracingIoctl Flag",
        "The LogonId is the ID assigned to the logon session. The application that initiated the session should have called AllocateLocallyUniqueId in order to generate this ID. ",
        "Select * from Win32_VolumeUserQuota",
        "AllowBehaviorMonitoring",
        "BmLatency",
        "0B714A230756027CB9D944F3C101E5485E82B469361846E74358E5EEBA5C05B7",
        "KtmRmEndpointCid",
        "  of a magneto-optical drive, a subtype of media access device.",
        "UdpIPv6ExtensionHashEnabled",
        "Length of time that the job has been executing",
        "CIM_Refrigeration",
        "IsServerPort",
        "LPCDRVR_TRACE_RESERVED_0c Flag",
        "NS_0E3BAD336658AC1790DE65EC93590431EA8C91776907175DA4BAE9AE7DB97611\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_848E55FD5F4FC523C00864C2E37F5A0ECCC3D19673B52AA68E334B012EECD2F9",
        "{5efd8f2b-e1c7-46c1-a5cc-3aa70779c862}",
        "The EnableDNS method enables the Domain Name System (DNS) for service on TCP/IP-bound network adapters. The method returns an integer value that can be interpretted as follows: ",
        "SharedSecretSizeInBytes",
        "se.dll[MofResourceName]",
        "AdditionalActionsBitMask",
        "LS_CONNECTABLE_VALID_WS08",
        "- Keywords defined in this and other MOFs, or in DMTF white papers. These keywords provide a vendor- independent, installation-independent way of characterizing policy objects. ",
        "SM_GetDiscoveredPortAttributes",
        "SupportedGroupOperations",
        "ProfileActivated",
        "CIM_InstModification notifies when an instance is modified.",
        "RMSTemplateIDForEDP",
        "Defer to User",
        "ErrorData",
        "DomainRole",
        "LPCDRVR_TRACE_RESERVED_04 Flag",
        "The directory.",
        "DSC timer implementation as a WMIv2 provider",
        "C_0ED8829CD55CB10045BE12FF28DC63BFD30CC65BF9376DAA6A5D15ADE3CAC700",
        "TransactionType",
        "ID/Handle to Virtual-IF tunnel state",
        "C_77DBF4A2C876542515BB91822C77D6AAB627C74A2589D8CBC4096845BC539307",
        "CD_8DD4117F0A6CA8322CEA3B2EE2E937FF189016C7342D650B227DA4C96B557695.1649.3403034461.236",
        "LPC_TRACE_RESERVED_0d",
        "MDM_VPNv2_Certificate04",
        "FindDllByName",
        "LockedDownInternetZoneAllowNETFrameworkReliantComponents",
        "Describes a BranchCache data cache extension",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.305.307563796.372",
        "__Win32Provider=\"Win32ClockProvider\"",
        "MinBandwidthWeightAction",
        "The Win32_SystemDriver class represents the system driver for a base service.",
        "EntryPointName",
        "Realtime",
        "42007",
        "LANID",
        "The value to be written.",
        "\\\\.\\root\\PEH:__Win32Provider.Name=\"MINT\"",
        "IHVServiceFrameworkCtlGuid",
        "IL_8DA716445EA26247BDCD502C872559133B29770F7B55AFBFF871D80915CA3DBD.710.1.40746",
        "System utilities",
        "MGR_TRACE_PROCESS Flag",
        "CD_85F4FD558CEB2D53836A59CA16C7897C522A861DD40C1B575F3D3B0B10636B7E.1937.736702098.236",
        "DownForeLimitBpsProvider",
        "PWhere",
        "MaxBaudRate",
        "NS_FAD236DC88D4A39D9B808B598227AC32F45800A0F09FB4E10AAE80BE63A63AD1",
        "IsMultipathEnabled",
        "CR_80B699E54B84239FD1066E5A81EB19D570A7344B7D65738ED8C91406D3A0502D",
        "Get Error Sources",
        "Variable length array of ISCSI_RedirectSessionInfo. SessionCount specifies the number of elements in the array. NOTE: this is a variable length array.",
        "MSNdis_CoDriverVersion",
        "The ConnectionState property indicates the current state of the network connection.",
        "_DH_WMP_DPF",
        "Current Offload Configuration of the adapter",
        "0x02000000",
        "Length in bytes of the shared secret.",
        "One consistent async per RemoteReplicationCollection",
        "Cluster",
        "Frequency percentage",
        "SessionNameString",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters",
        "CreateTrustedDomEx_Start",
        "Advanced properties for the network adapter.",
        "The name of the server hosting the LPR device.",
        "new li",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\DefaultIcon[Default]",
        "Output from Setting Link Parameters of the adapter",
        "The All Win32_ShadowContext specifies all types of shadow copies. This context is used for shadow queries",
        "SeeAlso",
        "CIM_UninterruptiblePowerSupply",
        "InitiatorNodeAddress",
        "AES-256",
        "SystemConfig_V0_PnP",
        "Example: TCP/IP",
        "This property represents the binary data that is associated with this object.",
        "C_2337B9B06F01E50F06D083E14CD407858889BA1306F3231FBD80D8DA1B8F42E1",
        "A parameter is not valid for this type of partition.",
        "System_AuditSystemIntegrity",
        "Power Problem",
        "MDM_Policy_Config01_CredentialProviders02",
        "ROOT\\Hardware",
        "Reports",
        "DOT11_REPEATER",
        "Win32API|Service Functions|ControlService|dwControl|SERVICE_CONTROL_PAUSE",
        "C_EA2F4ED6B8AA0BEEE14A7235028BAD0C1DDD97703732E8317B8FE1581E43A3CF",
        "TenantAadToken",
        "SEL_DATA3",
        "MDM_AppLocker_Script03",
        "{35B78F79-B973-48c8-A045-CAEC732A35D5}",
        "Win32_WIN32_TSENVIRONMENTSETTING_Prov",
        "{FAF76B90-798C-11D2-AAD1-006008C78BC7}",
        "object:MSFT_TaskNetworkSettings",
        "SHA-384",
        "SECHC_LOG_FLAG_ONEX_DIAG Flag",
        "EVENT_TRACE_FLAG_PREPAREMDLWRITE",
        "PageSize",
        "Win32_UserAccount",
        "  <file name=\"InstallService.dll\" destinationPath=\"$(runtime.system32)\\\" sourceName=\"InstallService.dll\" importPath=\"$(build.nttree)\\\" sourcePath=\".\\\">",
        "{EA324793-51BB-486a-AA9D-0F5552353413}",
        "Win32_WIN32_TERMINALSERVICESETTING_Prov",
        "SPACES_StorageReliabilityCounter",
        "241C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "MsftUtils_DebugDestructor Flag",
        "LocalServiceSecuritySettings",
        "PortSymbolicName",
        "TEST_TRACE_RESERVED_0b",
        "ActiveConnection performance counter missing",
        "ReArmSku",
        "4-way Interleaved Stereo",
        "Header_PartitionInfoExtensionV2_TypeGroup",
        "Specifies the proposed encryption algorithm.",
        "3 - The service cannot be stopped because other services that are running are dependent on it.",
        "CIM_CollectionOfMSEs",
        "Denotes whether this subsystem supports local cloning. This field must be true if the VirtualDisk::CreateClone method is implemented.",
        "PatchSize",
        "NDIS Current Lookahead",
        "URIRecursiveMatchCondition",
        "FileSystemType",
        "The byte offset of this extent from the start of the physical disk.",
        "Live ETW trace session class.",
        "Capabilities and management of a diskette drive, a subtype of CIM_MediaAccessDevice.",
        "Win32_NamedJobObject",
        "UInt64Value",
        "MIF.DMTF|General Information|001.3",
        "The IsCompatible method verifies whether the referenced physical element may be contained by or inserted into the physical package. The return value should be 0 if the request was successfully executed, 1 if the request is not supported and some other value if an error occurred.  In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier.",
        "Email Program",
        "ConsistentMimeHandlingInternetExplorerProcesses",
        "ThreadingModel",
        "{e3c9e316-0b5c-4db8-817d-f92df00215ae}",
        "A end user relevant name for the element being created. If NULL, then a system supplied default name can be used. The value will be stored in the \\'FriendlyName\\' property for the created element.",
        "SamGetBootKeyInfo_Start",
        "Time in minutes for a detection in the 'failed' state to move to the 'cleared' state.",
        "Indicates whether the operation requires a transaction.",
        "DeleteItems",
        "Maximum amount of memory, in Kbytes, that can be supported by the associated physical element. ",
        "CR_58EBCE462A5C99EEA826226A8DAA39BB4E44016ACD1726174C7DBA9B5E2879BE",
        "Spot Fix Needed",
        "RSS Enabled on this adapter",
        "CurrentNumberOfRows",
        "Win32API|Process and Thread Structures|STARTUPINFO|dwFillAttribute",
        "TM Forum",
        "Auto download and schedule the install",
        "PFXCertPassword",
        "Specifies the name of the server on which the job resides.",
        "Localized version of RSOP_PolmkrDeviceSetting for American English",
        "ActionSuccess",
        "File Object",
        "ParentId",
        "ImageLoadBacked",
        "MimeSniffingSafetyFeatureInternetExplorerProcesses",
        "currentTemplateLevel",
        "The StringFormat property describes the type of characters used for text passed through the modem.",
        "ActiveProcesses",
        "Interrupt Type",
        "dwServiceMask",
        "InitialDetectionTime",
        "A RegisteredProfile is a named 'standard' for CIM-based management of a particular System, subsystem, Service or other entity, for a specified set of uses. It is a complete, standalone definition, as opposed to the subclass RegisteredSubProfile, which requires a scoping profile for context. ",
        "Bid2Etw_MSDADIAG_ETW_Trace",
        "IPv4/IPv6 address of the corresponding DNS servers that should be used for the specified DNS suffix.",
        "(For Windows NT only) The WinstationDesktop property specifies either the name of the desktop only or the name of both the desktop and window station for the process.  A backslash in the string indicates that the string includes both desktop and window station names.  If WinstationDesktop is NULL, the new process inherits the desktop and window station of its parent process.  If WinstationDesktop is an empty string, the process does not inherit the desktop and window station of its parent process; instead, the system determines if a new desktop and window station need to be created.  A window station is a secure object that contains a clipboard, a set of global atoms and a group of desktop objects. The interactive window station assigned to the logon session of the interactive user also contains the keyboard, mouse, and display device. A desktop is a secure object contained within a window station.  A desktop has a logical display surface and contains windows, menus, and hooks.  A window station can have multiple desktops. Only the desktops of the interactive window station can be visible and receive user input. ",
        "Bid2Etw_MSADOX_1",
        "R_FFF2AE454B5EBA423321420C962DDADA7E00808CE9D4E5B4FF81481A2E9CA1B6",
        "CR_EC0D9BE803395BC39DBCCA5405BADA8B14A82223193D36895536EB3BAC2EA6D7",
        "ity of the Sensor to resolve differences in the measured property. The units for this measurement are determined by BaseUnit*UnitModifier/RateUnit.",
        "The AutomaticResetCapability property determines whether the automatic reset is enabled. This capability is available on Windows NT but not on Windows 95./nValues: TRUE or FALSE. If TRUE, the automatic reset is enabled.",
        "MCA_ERROR_SYSTEM_EVENT",
        "Sets the file integrity state for the specified file.",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|AveragePPM",
        "Changer Problem Event",
        "{479b20b4-5559-46fe-be97-7d222154421f}",
        "Script Order",
        "Bid2Etw_MSADOX_1_Trace_TextA",
        "HardwareGraphicsAdapter",
        "MS_SMHBA_BINDINGENTRY",
        "Heap Flags",
        "SubclassCode",
        "XmlDictionaryReaderQuotas",
        "The Index property indicates the index number of the SCSI controller in the system registry.",
        "CR_D1B2F4E6056A69A2D8AF80AAE4B443CB0029F3E62BFF8D77A98B6230DF9AE6C1",
        "ConnectionType",
        "R_F5C834F5C60D3BABC115E6B6BE5546E7D8A66BBAF89B5C7BFA41187C8795D13E",
        "Denotes whether a user can create a virtual disk by using the CreateVirtualDisk method on either the storage subsystem or storage pool objects.",
        "Number of _PSS States",
        "Path of the file containing the key information to import.",
        "CD-ROM/XA",
        "InitiatorPortals",
        "5107C5341475AE649B7075E5FB1B219CF6D2FF755D735AA60A09AE0ED6BD6.185.1573459116.862",
        "Impact Other",
        "RestoreType",
        "SetStringElement",
        "SetByPrinterName",
        "If zero then this event is not logged to system eventlog",
        "typedef enum",
        "BAUD_134_5",
        "CATV Upstream",
        "Setting Type",
        "The server this driver is installed on.",
        "SelfHost",
        " The CIM_OSVersionCheck class specifies the versions of the OS that can support this software element. This check can be for a specific, minimum, maximum or a range of releases of an OS.   To specify a specific version the minimum and maximum versions must be the same. To specify a minimum,  the minimum version needs only be specified. To specify a maximum  version, the maximum version needs only be specified. To specify  a range both minimum and maximum version need to be specified.   The type of operating system is specified in the TargetOperatingSystem property of the owning software element.  The details of this checks are compared with the  corresponding details found in a CIM_OperatingSystem  object referenced by CIM_InstalledOS association for the  CIM_ComputerSystem object that describes the environment.  As long as there is at least one CIM_OperatingSystem that  satisfies the details of the condition, the check is  satisfied. In other words, all the operating systems on  the relevant computer system do not need to satisfy the  condition. There needs to be at least one.  Also, note the OSType property of the CIM_OperatingSystem  class must match the type of the TargetOperatingSystem  property. ",
        "The DNSDomainSuffixSearchOrder property specifies the DNS domain suffixes to be appended to the end of host names during name resolution. When attempting to resolve a fully qualified domain name (FQDN) from a host only name, the system will first append the local domain name. If this is not successful, the system will use the domain suffix list to create additional FQDNs in the order listed and query DNS servers for each.",
        "Encoding format for host names in the DNS query",
        "Zero-based index of the C-state entry in the corresponding ACPI _CST object",
        "Load Balance Policy that is currently being used by iSCSI Initiator - one element for each session on the adapter",
        "NextWorkerCount",
        "- 4=<Class.>Method. This example is very similar to the Property one, above. And, as above, the string \"*\" may be specified to select ALL methods. ",
        "ConnectorPresent",
        "The DHCPLeaseObtained property indicates the date and time the lease was obtained for the IP address assigned to the computer by the dynamic host configuration protocol (DHCP) server. ",
        "WMI|Win32_CacheMemory",
        "Service Dependency Deleted",
        "The DeviceID property contains a string uniquely identifying the network adapter from other devices on the system.",
        "Max Link Speed",
        "TraceEntryExit Flag",
        "PreventPerUserInstallationOfActiveXControls",
        "Vertical sync offset",
        "EventQueryList",
        "The Caption property is a short textual description..",
        "Prefix",
        "{8502C585-5FBB-11D2-AAC1-006008C78BC7}",
        "The number of MAC address and VLAN ID filters set on the queue.",
        "RespondentServerUrl",
        "The StopBits property indicates the number of stop bits for the serial port",
        "UseVersion",
        "Win32_SystemOperatingSystem",
        "MIF.DMTF|Temperature Probe|002.12",
        "{FF02BC96-7FB0-4bac-8F97-C71E495FA698}",
        "PrivilegeGranted",
        "TargetPortAddresses",
        "RS-422 port",
        "NETIO_TRACE_TDX",
        "The TCP port the KMS host uses to listen for activation requests.",
        "Operating System Name",
        "object:Win32_RDFileAssociation",
        "PatchID",
        "Win32_Session",
        "MonthlyBkRateBps",
        "Stereo mode type",
        "{FAF76B94-798C-11D2-AAD1-006008C78BC7}",
        "The name of the product's supplier. Corresponds to the vendor property in the product object in the DMTF Solution Exchange Standard.",
        "JIS B7",
        "A datetime value that indicates when the object was installed. Lack of a value does not indicate that the object is not installed.",
        "The CIM_SupportAccess association defines how to obtain assistance for a Product.",
        "AddToRemoteReplicationCollection",
        "Win32_TapeDrive|MediaType|Tape Drive",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_E7C8D1A4E2346FFDEE37907DDFF48B4344B5DAFEE4B2DF86123B0112A39FA3BD",
        "\\\\.\\root\\Microsoft\\Windows\\Storage\\PT:__Win32Provider.Name=\"DelegatorProvider\"",
        "Disable catch-up quick scan.  A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time.",
        "DebugPrint",
        "Parameters",
        "SourceFileName",
        "// MSiSCSI_QueryLBPolicy class is used to query the Initiator about",
        "Determines the allocation behavior for this storage tier. Fault domain aware storage tiers will intelligently pick the physical disks to use for their redundancy to balance the fault tolerance between two (or more) fault domain units of the specified type.",
        "C_A906A7709427F12DDE6D6641BDCB16CA4F2938A2A88AC6967D518CEE727A69AC",
        "o The values: ",
        "UnActivateLOB",
        "Specifies the number of bytes read by all processes that have ever been associated with the job, in addition to all processes currently associated with the job.",
        "3..15999",
        "esult in earlier requests being overwritten or lost. ",
        "A return code of 1 shall indicate that the method is not supported. A return code of 2 shall indicate that the method failed.",
        "BudgetEnabled",
        "AppraiserCodeAndDataVersionsAboveMinimum",
        "ref:Win32_SID",
        "AGP Information",
        "KerbInitSecurityContext_End",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|Compression_On",
        "Indicates the operation should not prompt for confirmation",
        "The MinimumAddressSize property specifies the minimum length of a socket address supported by the protocol. ",
        "Where Drive='#'",
        "A value that indicates whether HTTP decompression (gzip/deflate) is enabled on the client.",
        "DontStopIfGoingOnBatteries",
        "PolicySourceClientWallPaper",
        "Example: 19521201000230.000000 000",
        "Get Error Injection Capabilities",
        "SetTcpWindowSize",
        "Time in user mode, in 100 nanoseconds. If this information is not available, a value of 0 should be used.",
        "Capability",
        "Updates the list of specified license servers, replacing any existing specified license servers.",
        "3 = the application had the IgnoreLanguage attribute, ",
        "Example: Accessories or Startup.",
        "ImpersonateOnSerializingReply",
        "AllowSharedUserAppData",
        "Baud rate",
        "Encapsulates a Virtual Switch on the hyper-v host, on which the traffic is to be captured.",
        "Obtains entire list of Token Redirectable addresses or DNS Eligible address.",
        "IPSrcPrefixMatchCondition",
        "40025",
        "WINSTATION_VIRTUAL | STANDARD_RIGHTS_REQUIRED = 0xF008",
        "The character set encoding to be used for emitting messages on the binding.",
        "CD_8519F629D57644187514674C7FCF7F8B0B70EEA799638913C1E17DC7E507CB73.1638.1077066923.768",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_0FE84CB7228184819434E73184A33B5694CEFAED93B282C50B930127F187504C",
        "sackopt",
        "DoNotAllowPasswordSaving",
        "StorageControllerId",
        "CIM_PhysicalComputerSystemView.NumericSensorEnabledState",
        "usercontext",
        "GetByFolder",
        "FunctionNumber",
        "uint64",
        "The Win32_Processor class represents a device that is capable of interpreting a sequence of machine instructions on a Win32 computer system. On a multiprocessor machine, there will exist one instance of this class for each processor.",
        "SERIAL_PORT_WMI_PROPERTIES_GUID",
        "DER ASN1 DN",
        "SAM Set Information Group",
        "The SettableFlowControl property indicates whether flow control can be set for this serial port.",
        "dialUpState",
        "SyncTime",
        "Indicates the margin built around the thresholds. This margin prevents unnecessary state changes when the Sensor reading may fluctuate very close to its thresholds. This could be due to the Sensor's tolerance/accuracy/resolution or due to environmental factors. Once a threshold is crossed, the state of the Sensor should change. However, the state should not fluctuate between the old and new states unless the Sensor's change in the reading exceeds the hysteresis value. The units for this measurement are determined by BaseUnit*UnitModifier/RateUnit.",
        "{8502C548-5FBB-11D2-AAC1-006008C78BC7}",
        "C_EC31DBAC8296A2F597184183FC259C7595AD4BCCFF23FB0BD832DE414BDE578A",
        "MIF.DMTF|Physical Extent|001.6",
        "Classpnp Driver Tracing Provider",
        "The AccountType property contains flags describing the characteristics of Win32 user account:",
        "Limits the maximum number of pending receives that may be queued on the channel.",
        "Retrieves Name Resolution  Policy  Table global settings",
        "CurrentHealthStatus",
        "3221232484",
        "MSFT_VirtualDiskToVirtualDisk",
        "{87946AAC-DB22-11d2-85FC-0000F8102E5F}",
        "Bytes Written",
        "Copy-On-Write",
        "MIF.DMTF|Monitor Resolutions|002.7",
        "Policy object for IEEE 802.3 Network Policy",
        "PolicySourceReconnectionPolicy",
        "Values: TRUE or FALSE. A value of TRUE indicates special characters are supported.",
        "VerticalSyncPulseWidth",
        "Msft_WmiProvider_DeleteClassAsyncEvent_Post event class represents an event generated immediately following completion of the provider's implementation of IWbemServices :: DeleteClassAsync.",
        "  </file>",
        "Printer device management. ",
        "Bell 212A",
        "APM Timer",
        "Bid2Etw_MSDASQL_1",
        "GetKeyProtectorType",
        "Software",
        "DiskIo_TypeGroup3",
        "The scoping computer system's creation class name property.",
        "PAL B1",
        "BcdElement",
        "Supports transfer of data using tokens across different subystems.",
        "DC/OS",
        "This property has been deprecated in favor of a corresponding property(s) contained in the Win32_PageFileUsage and//or the Win32_PageFileSetting.",
        "R_DD2178271091FB1F73210A7F6D8E8121024FBB7967C9EA5A686C5C1AA5AFE401.1501.832184567.584",
        "Pentium(R) III Processor with Intel(R) SpeedStep(TM) Technology",
        "NDIS ATM Transmit Cells OK",
        "LicensingType",
        "Private address of peer behind NAT",
        "TargetName",
        "Creates a new TCP/IP printer port on a given server in LPR mode.",
        "Output GPO Session identifier",
        "SetReplicationRelationship",
        "MSFT_NetQosPolicySettingData",
        "R_664FCFB4C8DBC3167BFA873C90979DDE17B851EEF4DBA9A6155969A1A7AD64ED.2461.2184674864.554",
        "The AccessMask property is a bit array representing the access rights to the given file or directory held by the user or group on whose behalf the instance is returned. ",
        "FileIo_V1",
        "The TotalHeads property indicates the total number of heads on the disk drive. Note: the value for this property is obtained through extended functions of BIOS interrupt 13h. The value may be inaccurate if the drive uses a translation scheme to support high capacity disk sizes. Consult the manufacturer for accurate drive specifications.",
        "MSFT_StorageSubSystemToTargetPort",
        "Example: NEC  ",
        "Win32_FolderRedirectionHealth",
        "HttpGetBinding",
        "Aggregate",
        "LUAInstall: error 0x00000005 setting flags [{C23FC28D-C55F-4720-8B32-91F73C2BD5D1}]",
        "DATABASE",
        "E.2664.2180655825.585",
        "Monitor expects a blank-to-blank setup or pedestal per appropriate Signal Level Standard",
        "PercentFrequency",
        "Initiator Node Does Not Exist",
        "FX_TRACE_RESERVED_15",
        "MCA_WARNING_PCI_BUS_MASTER_ABORT_NO_INFO",
        "This class represents the setting definition data for a power setting in the system.",
        "The logical device that is alarmed. ",
        "BusNum",
        "The GroupName property indicates the name of the Win32 program group. Program groups are implemented as file folders in Win32.",
        "Dedicated IPv4 address pool and port range",
        "_UUUUUU",
        "CIM_ElementsLinked",
        "AntispywareSignatureLastUpdated",
        "OS SCSI Target Id",
        "Time of last Quick Scan end - If this has never updated you will see a null value in this property",
        "SubItems",
        "ref:Win32_Share",
        "C_3035B16D02866D7EE030442132A18B7ACF25E1EBBE385D31EBEA6DA0AB2F86A6",
        "MIF.DMTF|Physical Memory Array|001.11",
        "PendingFullScan",
        "CD_DBA99A7D488C87C166C15C9F1723F214A2817799E8F4CB02CBB2C24C78077720.1741.3649447187.352",
        "Install Date",
        "IsBackground",
        "The upper-bound of the destination port filter condition. This field complements IPDstPortStartMatchCondition.",
        "SMTPServer",
        "The SystemElement represents the active IP route beingused.",
        "The collection of binding elements implemented by the binding.",
        "NeighborDiscoverySupported",
        "Synchronized status of a storage object and its Snapshots / Clones / Mirrors.",
        "CR_03B5275A0D380627593F835B4AD2B03749EDE19E5B92F5526106699F68C22F4B",
        "The statistical information/object.",
        "PortAttributes",
        "8 - 'QuiesceInProgress': A quiesce operation is in progress. ",
        "ce665784-cdbf-4df5-aa8d-646b9cef02ab",
        "Extended UNIX Code",
        "EnableOplocks",
        "Win32_ShadowDiffVolumeSupport",
        "Indicates the record type",
        "The AbortReadWriteOnError property indicates whether read and write operations are terminated if an error occurs.",
        "\"Completed\" indicates that the element has completed its operation. This value should be combined with either OK, Error, or Degraded in the PrimaryStatus so that a client can tell if the complete operation Completed with OK (passed), Completed with Error (failed), or Completed with Degraded (the operation finished, but it did not complete OK or did not report an error). ",
        "The Log property references the log file that contains the NT log event.",
        "Physical extents spanned by the virtual disk.",
        " This class specifies information needed to check a particular setting file for a specific entry that contains  a value that is equal to, or contains, the value specified.  All compares are assumed to be case insensitive.",
        "Priority indicates the urgency or importance of execution of a process. If a priority is not defined for a process, a value of 0 should be used.",
        "Overall Order of the GPO Links found acrossall the applicable SOMs",
        "CD_27A364644C1B83931E072B22EAC45B45C2531EB36360F82204598576E1DF4301.2436.4096324972.6868",
        "Bid2Etw_MSDAREM_1",
        "The RegisterFonts action registers installed fonts with the system. It maps the Font.FontTitle to the path of the font file installed. The RegisterFonts action is triggered when the Component to which the Font.File_ belongs is selected for install. This implies that fonts can be made private, shared or system by making the Components to which they belong so.",
        "MD5Checksum",
        "IssuedToken",
        "The ColorTableEntries property indicates the size of the system's color table, if the device has a color depth of no more than 8 bits per pixel, null otherwise. <P>Example: 256",
        "CD_0ED1C3985408CF8B2B34893CFA150055B29DB00EC2B161251E2022B947EB8ECF.2105.2486443830.531",
        "\\\\.\\root\\Microsoft\\UEV:__Win32Provider.Name=\"UevConfigurationProvider\"",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Netbt\\Parameters|EnableDNS",
        "{8d49ef4c-c172-45d8-a303-c5fbc5601f37}",
        "Session Flag",
        "iSCSIWMIv2",
        "ce Error",
        "Represents a print queue and its associated settings.",
        "CD_B1B3F51451050560540508AE61C59186CBB46746C5DF2B2C8763635DE336A9D9.1465.1710771954.1478",
        "{1f177cd9-5955-4721-9f6a-78ebdfaef889}",
        "__MethodInvocationEvent",
        "Network Inspection System is enabled",
        "C_7C256082C028FC113E44225862F56FE496A6FB4D4EE2AD50DD39EB6DF6A574DF",
        "This property indicates when a roaming profile was uploaded to server last time.",
        "The multicast long address list on the NIC enabled for packet reception.",
        "Starts the event capture, applying the session configuration",
        "vA5134EAE65D9DD02F6CE0E924C84D387C2BC76C9409B3E6C9F586619D35EA1DA",
        "The PowerSupplyState identifies the state of the enclosure's power supply (or supplies) when last booted.",
        "LowPart",
        "GetData",
        "The SupportsDTRDSR property indicates whether Data Terminal Ready (DTR) and Data Set Ready (DSR) signals are supported on this serial port.",
        "ErrorSourceId",
        "3 - CIM_ERR_INVALID_NAMESPACE. The target namespace does not exist. ",
        "HKEY_LOCAL_MACHINE 02",
        "Failure Predict Thresholds",
        "Script List",
        "UpdateFirmware",
        "PackageCode",
        "TrustedSitesZoneAllowSmartScreenIE",
        "WSAT_TraceRecord",
        "Serration of the Vsync pulse is NOT required when composite sync or sync-on-green video is used",
        "WEP key index",
        "OneXAuthenticationMode",
        "43010",
        "Computer status enumeration",
        "MSNdis_CurrentLookahead",
        "Enforce",
        "SW_RESTORE",
        "Win32API|Device Input and Output Structures|STORAGE_DEVICE_DESCRIPTOR|ProductRevisionOffset",
        "MinValue",
        "Circular Kernel Session Provider",
        "The AccessState property indicates whether the controller is actively commanding or accessing the device (value=1) or not (value=2).  Also, the value, \"Unknown\" (0), can be defined. This information is necessary when a logical device can be commanded by, or accessed through, multiple controllers.",
        " A file system driver service.",
        "NumOtherQueriesSucceeded",
        "WorkerThread",
        "LargestFreeSpaceSize",
        "InitiatoriSCSIName",
        "Unregister a settings location template by template ID.",
        "CD_EDC552B835EFC5DE821208E3F9AEA0AA9771EB8639D25966017B5229C652D1DE.1544.1731286331.414",
        "C_5D2C2C389F5259E45332A86ADEF5107186DA3990C071FED897FC6FAECC4A4DBE",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.12.3821327255.274",
        "MSFT_DiskImage",
        "TotalFreeSpaceExtents",
        "SetPowerState defines the desired power state for a logical device and when a device should be put into that state. The desired power state is specified by setting the PowerState parameter to one of the following integer values: 1=\"Full Power\", 2=\"Power Save - Low Power Mode\", 3=\"Power Save - Standby\", 4=\"Power Save - Other\", 5=\"Power Cycle\" or 6=\"Power Off\". The Time parameter (for all state changes, except 5, \"Power Cycle\") indicates when the power state should be set, either as a regular date-time value or as an interval value (where the interval begins when the method invocation is received). When the PowerState parameter is equal to 5, \"Power Cycle\", the Time parameter indicates when the device should power on again. Power off is immediate. SetPowerState should return 0 if successful, 1 if the specified PowerState and Time request is not supported, and some other value if any other error occurred.",
        "AllowFipsAlgorithmPolicy",
        "RemoteIPv4Address",
        "License Servers to use",
        "UseSharedFolderForBooks",
        "PipeMgr_Trace Flag",
        "Specifies how to use address to filter a message, whether to use Exact match, Prefix match or match Any.",
        "PrivacyNoticeBindingElement",
        "Win32_ShadowProvider",
        "DSGlobalCatalogFlag",
        "A physical component is replaceable  if it is possible to replace (FRU or upgrade) the element with a physically different one.  For example, some computer systems allow the main processor chip to be upgraded to one of a higher clock rating. In this case, the processor is said to be replaceable . All removable components are inherently replaceable .",
        "LocalAddressRanges",
        " The CIM_ActionSequence association is used to define a series of  operations that either transitions the software element, referenced  by the CIM_SoftwareElementActions association, to its next state or  removes the software element from its current environment. The CIM_Action classes participating in this association must have the same value for the Direction property since they are either part of a sequence to  transition a software element into its next state or to uninstall a  software element. The next-state actions and uninstall actions  associated with a particular software element must be a continuous  sequence. Since the CIM_ActionSequence is an association the loops on  the CIM_Action class with roles for the 'prior' action and 'next' action in a sequence, the need for a continuous sequence implies:  (1)Within the set of next-state or uninstall actions, there is one and only one action that does not have an instance of the CIM_ActionSequence  association referencing it in the 'next' role. This is the first action in the sequence. (2) Within the set of next-state or uninstall actions, there is one and only one action that does not have an instance of the CIM_ActionSequence association referencing it in the \"prior\" role. This  is the last action in the sequence. (3) All other actions within the  set of next-state and uninstall actions must participate in two  instances of the CIM_ActionSequence association, one in a  prior role and one in the next role.",
        "AllowVPNOverCellular",
        "ConfirmationID",
        "BodyStyle",
        "Stack31",
        "The SettingData object associated with the element.",
        "object:MSNdis_WmiIPSecOffloadV1_IPv4ESP",
        "ref:Win32_DiskPartition",
        "C_1A826788D5CB396EF46883163CDFF0FAFFB8ED9B8BC20D60D3B7762CBFBD2C44",
        "FX_TRACE_DEVICE",
        "Defines whether this is write-back (value=3) or write-through (value=4) Cache, or whether this information \"Varies with Address\" (5) or is defined individually for each I/O (6). Also, \"Other\" (1) and \"Unknown\" (2) can be specified.",
        "RDMA missing performance counter information for a network adapter. NetworkDirect providers are required to support all the performance counters included in NDIS_NDK_PERFORMANCE_COUNTERS. However, in the rare case that a provider cannot support a counter due to an exceptional circumstance, it must indicate so.",
        "Resumes a paused print job",
        "CIM_RegisteredSpecification.OtherSpecificationType",
        "somOrder",
        "{FAF76B80-798C-11D2-AAD1-006008C78BC7}",
        "_DH_WMP_SQM Flag",
        "{464FFAB0-946F-11d2-AAE2-006008C78BC7}",
        "_DH_PLUGINS",
        "SystemDrivesRequireStartupAuthentication",
        "AssemblyPath",
        "IsBoot",
        "PrinterState",
        "UserDefined",
        "42014",
        "Maximum number of PD transmit queues that can be allocated on a nondefault VPort.",
        "The EnableDaylightSavingsTime property indicates whether Daylight Savings Time is recognized on this machine.  FALSE - time does not move an hour ahead or behind in the year.  NULL - the status of DST is unknown on this system",
        "User-mode PnP Manager Trace",
        "C_94145E2C57E0D4603F8377F5BA5E611EAA5A57D8CBDF073A7F4BA777C46D367E",
        "CD_4B625BD46CD9F6645F33476CE1E5AC2D9C2B5C6721426559A5E5B53B80B4B21C.1194.2746471374.2546",
        "{FAF76B6E-798C-11D2-AAD1-006008C78BC7}",
        "KeyManagementServiceLicensedRequests",
        "The related statistics or metrics.",
        "The StatusCode property returns the ping status codes.",
        "%ConfigField%",
        "MSTapeDriveProblemEvent",
        "MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers",
        "CD_F184832B4631E42C2D983F7EFCE295CB4A79F3A6CBFB4FAACF42325448D6184A.1576.1920700125.803",
        "The EnableDevice method has been deprecated in lieu of the more general RequestStateChange method that directly overlaps with the functionality provided by this method. ",
        "HideSwitchAccount",
        "Option Too Big",
        "IPv4Checksum",
        "CD_E2B2F2A9C4A7BE777C95CFBAC1ADF577ACC960E4E5C2F6E896E757D1BB542084.69.1503878399.450",
        "IL_C52295624F06C940B122D80C080F06A7E8A3B72E8DBB8DAB3530E90B3C01E0C8.1501.1965779237.618",
        "When the AccessContext property contains a value of 1, \"Other\" then this is a free form string providing more information about the role of RemoteServiceAccessPoint in the hosting system.",
        "ErrorReplacementEnabled",
        "Forward",
        "DeleteKeyProtectors",
        "C_128B2D3C252FFFC5768D285553F59F5171808A8CB495FDE06EFD9BA8DA4D8D8D",
        "Router lifetime. Default is 1800 seconds.",
        "Peripheral Chassis",
        "DisableAccountProtectionUI",
        "NotExecuting",
        "The InstalledBy property identifies who installed the update. If this value is unknown, the property will be empty.",
        "{FAF76B71-798C-11D2-AAD1-006008C78BC7}",
        "SourceRouteType",
        "EVENT_TRACE_FLAG_QUERYQUOTA",
        "Example: C:\\WINDOWS\\EXPLORER.EXE",
        "The Setting reference in the Win32_WMIElementSetting association, represents the WMI settings available to the Win32 service.",
        "A URI that contains the address of the proxy to use for HTTP requests.",
        "Synchronizing",
        "accessDenied",
        "PNP Device interface name",
        "The CSCreationClassName property is a string indicating the class of the computer system.",
        "Modifies the relationship between replication groups.",
        "Universal Serial Bus",
        "Specifies whether SNMP is enabled for this port.",
        "NDIS Query Physical Medium Type Ex",
        "ISCSI_ERR_SCSI_REQUEST_TIMEOUT",
        "The PrintJobDataType property indicates the default data type that will be used for a print job.",
        "DecreaseLevel",
        "The GroupComponent reference represents the Win32_LogicalProgramGroup that contains the logical program group for this association.",
        "AllowUpdateService",
        "A textual comment describing the printer.",
        "Represents a particular firewall profile. Multiple profiles may be in effect on any interface at any given time.",
        "TransportLayerFilterName",
        "AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers",
        "MinorFunction",
        "CD_F8EF7CD33C3F2510D1C17CE3538977B71D5AF70C10D3ABB08287498FE3E23A15.1455.1.16027",
        "The Recursive input parameter is a boolean that indicates whether the copy will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input parameter is ignored",
        "5 - 'Resource Exhaustion': There were insufficient resources to bring the disk online. ",
        "setinfo",
        "NDIS 802.11 WEP Status",
        "SeRestorePrivilege",
        "Position is a free-form string indicating the placement of a physical element.  It can specify slot information on a hosting board, mounting site in a cabinet, or latitude and longitude information, for example, from a GPS. It is part of the key of the CIM_Location object.",
        "This method, for a given ReplicationType, returns the supported features.",
        "0x00000103",
        "R_CE3BD7958DF29814D59DAC8422592164271EC69E371218B0819029BD62E51D7E.1464.2809056066.540",
        "SMBIOS|Type 13|Current Language",
        "object:IdleStateAccounting",
        "The InfSection property indicates the section of the .INF file where the Win32 video information resides.",
        "BranchCacheIsEnabled",
        "R_A09DF16E80CB8250C7E8F768EDC2F0DB283873E2BF1AF5FB3DCD5C1A024C9766",
        "See CIM_Processor.MaxClockSpeed for details.",
        "PolicySourceSessionDirectoryLocation indicates whether the property SessionDirectoryLocation is configured by Server (0) or Group Policy (1).",
        "MSSmBios_SMBiosEventlog",
        "CR_5ACAF83AC17F3EA7F1672F287BF1DD774125A890420CE4F482AACA090A7C6160",
        "DisableDefaultBlock",
        "3221232472",
        "FindLicenseServers",
        "CIM_RemoveFileAction",
        "Deleting",
        "The USO current capabilities of the Adapter.",
        "Msft_WmiProvider_AccessCheck_Post",
        "RemovePhysicalDisk2",
        "MIF.DMTF|System Slot|004.11",
        "The Tbl property provides an array of translate table entries that define the translations to be performed for this translate table.",
        "Write-Back",
        "e(Lg~",
        "Workstation",
        "{8502C511-5FBB-11D2-AAC1-006008C78BC7}",
        "{0F73ED5D-8ED9-11d2-B340-00105A1F8569}",
        "C_D13D81348F7983969C884BA6E5AABC73AE0A128B3CF746A401623C9284F0BB59",
        "21 - Invalid parameter.",
        "    <registryKey keyName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\InstallService\\InstallEventHandlers\">",
        "1 - Account Disabled -  The user's account is disabled.",
        "C_AA9C35FD43405602C3CB92A608E9261205300DEA694427FCF98EBA8499E2378F",
        "Requests that the Log be cleared of all entries. ",
        "The RSS setting data for network adapter.",
        "5ECA63A2575A533106A3DA4D4E7D3593AF8C1DBA30A77246287C3734644E9810",
        "RPLifeInterval",
        "Indicates whether Enhanced Transmission Selection (ETS) is configured on the network adapter.",
        "LetAppsAccessRadios_ForceDenyTheseApps",
        "Indicates whether the pipe is composed of lower-level pipes, and if so, how these lower-level pipes are aggregated (in parallel or in sequence). The specific instances of NetworkPipe that are combined are described using the NetworkPipeComposition association. ",
        "HiveDestroy",
        "HashKeySize",
        "ServiceElement_BehaviorConfiguration",
        "NdisFddiTypeLocalAB",
        "SupportsRTSCTS",
        "pounds",
        "Describes settings related to the BranchCache client role",
        "I_0CD345CD328C12E181201A1AF5FC238E8C7063787A2C0D3BB8A0184594786F96.2721.399900967.279",
        "Need Regeneration",
        "PLATFORM_TRACE_RESERVED_09 Flag",
        "AllowActiveXFiltering",
        "IPv6TcpOptionsSupported",
        "List of content download urls for dependent frameworks",
        "Sets the KMS host name to use for volume activation.",
        "SMBIOS|Type 7|Installed Size",
        "ref:CIM_USBController",
        "ProcessingPrepare",
        "CIM_CollectionSetting",
        "ReceiveContextEnabled",
        "// The number of bytes received using the ESP protocol.",
        "The physical extent that is located on the media.",
        "REG_DWORD",
        "RequestedState is an integer enumeration indicating the last requested or desired state for the element. The actual state of the element is represented by EnabledState. This property is provided to compare the last requested and current enabled/disabled states. Note that when EnabledState is set to 5 (\"Not Applicable\"), then this property has no meaning. By default, the element's RequestedState is 5 (\"No Change\"). Refer to the EnabledState's property Description for explanations of the values in the RequestedState enumeration. ",
        "HotKey",
        "Version number of the specified file system.  This is currently only valid for UDF. The default value (zero) will cause the format engine to select the version.",
        "DOT11_MSM Flag",
        "Searches folder, GUID is {7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}",
        "3) The change to a uint16 data type was discussed when CIM V2.0 was defined. However, existing V1.0 implementations used the string property and did not want to modify their code. Therefore, Status was grandfathered into the Schema. Use of the deprecated qualifier allows the maintenance of the existing property, but also permits an improved definition using OperationalStatus.",
        "S_1_5_21_3968686040_3210279463_847977608_1001",
        "OperationalSettings",
        "KeepPrintedJobs",
        "I_A652C2031A398BA1BCC19829AA29BBA940B833717CFD10EB3A678C370F38E883.449.1.60127",
        "DOT11_UPCALL Flag",
        "The Name property is an identifier for the DFS node. It is same as the entry path of a node, based on the Universal Naming Convention. ",
        "IP over CLAW",
        "Deletes all data in all cache files.  ",
        "Flushes DNS",
        "Quality High",
        "This method will upgrade the version of the storage pool.",
        "The Tag property uniquely identifies the physical media in the system.",
        "The Debug property indicates whether the operating system is a checked (debug) build. Checked builds provide error checking, argument verification, and system debugging code. Additional code in a checked binary generates a kernel debugger error message and breaks into the debugger. This helps  immediately determine the cause and location of the error. Performance suffers in the checked build due to the additional code that is executed.",
        "LacpTimer",
        "RemoteControl",
        "MaxReadable indicates the largest value of the measured property that can be read by the numeric sensor.",
        "{6D7A4B0E-66D5-4ac3-A7ED-0189E8CF5E77}",
        "SignInOnResume",
        "object:MSNdis_NetworkDirectVersion",
        "ProtocolAddress",
        "LetAppsAccessCamera",
        "Number of retries",
        "Dithering with a coarse brush",
        "v4.0.30319",
        "R_55795F81C8422B8993E279C97F35D31AD4DD7851F75BE99F367F8BA09963EB67",
        "AllowOnlineTips",
        "Wraps When Full",
        "{890a36ec-a61c-11d0-8dd4-00c04fc3358c}",
        "Time Stream Delay",
        "SessionProvider",
        "0xEFFF0044",
        "Certificate Issued To",
        "The SOAP version of the messages sent using the binding.",
        "CEB6A1F6",
        "Localized version of RSOP_PolmkrTaskSetting for American English",
        "ref:MSFT_NetMainModeRule",
        "SamChangePwdComputer_End",
        "Add_BCDataCacheExtensionBySizeBytes",
        "Devices_AllowUndockWithoutHavingToLogon",
        "RequireSecurityDevice",
        "Previous Value",
        "C_E7845F3041269988C5A1847DE98EF0D88E59CE50ED3A8AA1E310C1A1F393BB81",
        "\\\\.\\root\\microsoft\\windows\\EventTracingManagement:__Win32Provider.Name=\"EventTracingManagement\"",
        "MSNdis_WmiTcpLargeSendOffloadV1_IPv4",
        "MaxHSyncDenominator",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2167.2889658748.180",
        "ad-only.",
        "NS_3FBDCB08ECD33FBEF028D2DB3EF058F8CE959779B943F43AB3DB3EC34ACA147D\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_AF40BBBDE0B04254A7DB7168AD8BD4619F792348A29FDE87570C9FC2F908731C",
        "The Name property indicates a descriptive name of this component category.",
        "Whether include the discarded packet events",
        "iScsiFlagProtocolLogInOut Flag",
        "A logical device.",
        "AccessPaths",
        "InitStatus",
        "The name of a win32_Property whose value resolves to the full path to the destination directory.",
        "Win32_VideoSettings",
        " Value ",
        "The current speed and mode, valid only for PCI-X devices",
        "Disable block at first seen.",
        "TemperatureMax",
        "x%m;x%m;",
        "Path to the icon associated with this zone.",
        "Slate",
        " Id for a resource instance.",
        "Enable Or Disable Failure Prediction Polling",
        "CD_61AD70324F8E2B3494420EEDDA5029E5D1AF2B0083C1CC1767F12EF889E146D1.1500.1528867493.453",
        "PlusProductID",
        "The EightDotThreeFileName property is a string representing the DOS-compatible file name for this file.",
        "{8502C594-5FBB-11D2-AAC1-006008C78BC7}",
        "Query NIC Switch Hardware Capabilities",
        "PolicySourceProfilePath indicates whether the propertyProfilePath is configured by,Group Policy (1) or the Server (0).",
        "This is the class used to model the AD Syntax DN_With_Binary",
        "SERIAL_WMI_PARITY_NONE",
        "An enumerated value that describes the severity of the Indication from the notifier's point of view: ",
        "File data represented as byte array",
        "ref:CIM_DiskPartition",
        "    // Number of elements in LoadBalancePolicies array",
        "__EventProviderCacheControl",
        "MSFT_NetConSecRuleFilterByInterfaceType",
        "Controls initial congestion window in Maximum Segment Size. Values can range from 2 to 64 MSS.",
        "The SectorsPerTrack property indicates the number of sectors in each track for this physical disk drive.",
        "Indicates that the network adapter supports splitting the received packets at a lookahead offset.",
        "C_D5E5B3762A5113A6C262F653E8716557160CDA5C8EFF2A001BCEF56E204DD0C1",
        "<,m;<,m;",
        "__EventConsumerProviderCacheControl",
        "AuthenticationMethod is an enumeration that specifies the proposed authentication. The list of methods was generated from Appendix A of RFC2409. Note that the enumeration is different than the RFC list and aligns with the values in IKESAEndpoint.AuthenticationMethod. There is one change to the list - the value 65000 has special meaning. It is a special value that indicates that this particular proposal should be repeated once for each authentication method corresponding to credentials installed on the machine. For example, if the system has a pre-shared key and an public-key certificate, a proposal list would be constructed which includes a proposal that specifies a pre-shared key and a proposal for any of the public-key certificates.",
        "{127D46AF-4AD3-489f-9165-F00BA64D5467}",
        "List of LUNs mapped for this target",
        "CD_8669524660923BEB3DA81E87F326B831E705D4AD2D26F7C6F43EC5D8367BA37C.1560.47244273.331",
        "C_308A38A70C7E63C8B0D223B592F8A2FBAAB2069E8358BFE6F473E432CFDFF602",
        "Unregister",
        "NIC Port Configuration",
        "ExtendedPollTimeInMinutes",
        "An estimate of the percentage of full charge remaining for a UPS (that uses battery technology).",
        "This class does not have any instances.  It is used to manage locally-cached Group Policy Objects.",
        "This method allows a virtual disk to be resized. The size specified must be in the range of valid values given by the GetSupportedSize method on the storage pool object.",
        "MDM_Policy_User_Result01_Desktop02",
        "Block ID",
        "LogFlagPeer Flag",
        "CIM_LogicalDevice.CreationClassName",
        "IL_3985A64DD548C159337A855FB2D96B222C50720949C8FDEAE049F7ADFD2826A5.1784.2691966461.423",
        "sNames",
        "CD_9D8D293A690FFEF350AE4D7C020869D528F57982A60CEA02D406951DA64B57DC.2542.991807135.672",
        "The PolicyStore where this dynamic keyword address originally came from.",
        "SystemConfig_V0_Power",
        "TrustedSitesZoneAllowScriptlets",
        "PLATFORM_TRACE_INIT",
        "The Parity property specifies the method of parity checking to be used. Parity is used as an error checking technique where an extra parity bit is included with every unit of data. If even parity is used, the parity bit is used to make the total count of bits set an even number. The receiver can then verify the validity of the data by counting the bits that are set. Odd parity, sets the parity bit so that the count of bits set is an odd number. Mark parity always leaves the parity bit set to 1, while space parity always leaves the parity bit set to 0.",
        "English",
        "ServiceConfigPath",
        "CD_DA6435B5A6AFDE1EA49B0F1FA576B2FE264B6CCD6A9F163C86C6173386BDC535.20.4235065349.7270",
        "CIM_PhysicalComputerSystemView.InstallSoftwareFromURI(InstallOptionsValues)",
        "pointer",
        "TM_WEBPROBE",
        "VoltageCaps",
        " This property may be left blank. See the description of the SourceFolder property. This field may contain wildcard characters (* and ?).",
        "If ConditionListType = DNF, then the overall condition for the PolicyRule is: ",
        "Indicates the size for the virtual disk. Note that some storage subsystems will round the size up or down to a multiple of its allocation unit size. This parameter cannot be used if UseMaximumSize is set to TRUE.",
        "Specifies that IEEE 802.3p and IEEE 802.3q encapsulation settings are specified in the NetBufferList as OOB info.",
        "LUAInstall: error 0x00000005 setting flags [{94abaf2a-892a-11d1-bbc4-00a0c90640bf}]",
        "The initiator and target negotiate support for immediate data. To turn immediate data off, the initiator or target must state its desire to do so.  ImmediateData can be turned on if both the initiator and target have ImmediateData=Yes.",
        "Default directory used by process",
        "{8502C4B7-5FBB-11D2-AAC1-006008C78BC7}",
        "MSiSCSIInitiator_DeviceOnSession",
        "C_2B0CB21E4574B83D661A7C62AD7BF3133DF3FBA914EA55D3A45DC4A7214DD006",
        "The DeleteKey method deletes a subkey in the specified tree. ",
        "ResultCode",
        "NS_3D98EC37D63EBFB9210DB658120A818078461369A71EFFA3DDE47412F528D55E\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_61642E797CBA7FD308765D422A26458A770AD0BC77553C0534CCCD9FCA1BD1872913",
        ",'m;,'m;",
        "C_92DB14183145FECB25D8F810D51EB91465DF70CF55ECB1D5FEEDBFFC4B20AADD",
        "The FullDNSRegistrationEnabled parameter specifies whether the IP addresses for this connection are registered in DNS under the computer's full DNS name. The full DNS name of the computer is displayed on the Network Identification tab of the System Control Panel. Windows 2000 only.",
        "// ports for quickly migrating the VHD files associated with a VM from one",
        "SECHC_LOG_FLAG_INIT",
        "The method returns one of the following integer values:",
        "MS_SM_PortInformationMethods",
        "MSFT_ExpressionValue_sint32",
        "MSFT_CliAlias.FriendlyName=\"Process\"",
        "SpecificationVersion",
        "SetIpSecByDefault",
        "portNumber",
        "MDM_Policy_Result01_EventLogService02",
        "Remote UDP encapsulation port for NAT-T",
        "GUID of the main mode policy provider context corresponding to this SA",
        "42010",
        "Contains all redirection flags",
        "{A9ECEFF7-C502-11DA-82C4-000D5692A4BC}",
        "0x351",
        "Property that controls Direct Access",
        "Name of an ODBC DSN.",
        "{154E66D8-DB35-11d2-85FC-0000F8102E5F}",
        "The date or time when the EnabledState of the element last changed. If the state of the element has not changed and this property is populated, then it must be set to a 0 interval value. If a state change was requested, but rejected or not yet processed, the property must not be updated.",
        "Ports activated on the adapter",
        "SetPersistentEntry",
        "No Default",
        "CD_DCD0D619EF8A182EED9A67E50FF805F66843D183EA6353EF5D3D8CF6F3EB1769.1595.2650721807.416",
        "ExcludeFromAutochk",
        "The XML namespace of the binding.",
        "Indicates if a single VPort Pool is supported",
        "ipsecNegotiationPolicyAction",
        "Average Free Space Per Extent",
        "Thread_V1_TypeGroup1",
        "Temporary duplicate account",
        "dialExtraSampleSeconds",
        "Inbound",
        "SpotFix",
        "MaxNameTableCharCount",
        "CD_28D3480019EDB8568B100B133C2E45279CD6E1AD49C4AEEDB510EEF8207E9610.27.4262261146.520",
        "releaseformodwrite",
        "Desktop folder, GUID is {B4BFCC3A-DB2C-424C-B029-7FE99A87C641}",
        "Serial Port 16550 Compatible",
        "GetCapLockoutInfo",
        "Win32_SoftwareElementCondition",
        "Preferred DNS Server",
        "C_B837FF0F19509FD7BD0B7ED8ED2B62529F924B69EF7322F8463864ECBCB01E5E",
        "MI_ERRORCATEGORY_AUTHENTICATION_ERROR",
        "CurrentLinkWidth",
        "Redirection Options is configured by adding the following flags  None(0), Drives(1), Printers(2), Clipboard(4), Plug and Play(8), Smart Card(16)",
        "CIM_LANConnectivitySegment.OtherTypeDescription",
        "p355DB6CE31803BDDBDD2FF491BD2AAE24F28E7ADF16402B3F3B9C4CF695702EB",
        "Fully qualified distinguished name of AO used for the last AD activation.",
        "C_87C10E264E287342D3206BEE44C1E60CA6C7D6B38EBABA03EFD1FEBF2C09580E",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_19E57369527D4B1D06F7B62EA4740710580A7EE3221F927586AA3C452A7CD5DA",
        "FCPH Name",
        "ReleaseDHCPLease",
        "ConfigDebug",
        "ALPC_Receive_Message",
        "RS-423 port",
        "0xEFFF0028",
        "Installation UI",
        "ROOT\\Microsoft\\HomeNet",
        "FX_TRACE_WIN32_IOTARGET Flag",
        "MS_WmiInternal",
        "I_43E62AB0AD3F0F54666953AC95C414EE36B3A6541513F8BFD8A755EEC9A7E6E5.328.1.65559",
        "TargetAlias",
        "Liftime by number of packets",
        "R_8E82F22F00BE10A2BC028100E8A1A080AD346FFCD97EEEAB61E9AA6AEE7320EA.2469.3585460829.554",
        "Set Single Policy Setting",
        "Policy version if read from GPO.",
        "IL_91BB5F8AFE5873E9BA8EBD1189F17D947DC5BB7E366AF568F25A5BD3FADD34E6.1335.816371373.256",
        "A replication group represents a consistency grouping of storage replicas.",
        "AllowFlashClickToRun",
        "6..0x0FFF",
        "Specifies the Audit Permissions for failure. The permissions are a combination of one or more of the following:WINSTATION_QUERY, WINSTATION_SET, WINSTATION_VIRTUAL | STANDARD_RIGHTS_REQUIRED, WINSTATION_SHADOW,WINSTATION_LOGON, WINSTATION_LOGOFF, WINSTATION_MSG, WINSTATION_CONNECT, WINSTATION_DISCONNECT.",
        "System Class Name",
        "AllowEnhancedProtectedMode",
        "// This class allows System Center Virtual Machine Manager to create virtual",
        "NS_B6791A1CF7802A901B1534CADBB1A0E82FB154100B2BE08AF47386C43CEC462A\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6",
        "CD_0FB0A8E86C1430EE0BB7D412F66362E6E788646DB733ACDB85AE2E440B7F37A4.1172.1144799952.253",
        "DiskGuid",
        "DriveName",
        "WkDir",
        "EVENT_TRACE_FLAG_X",
        "The VirtualizationFirmwareEnabled property determines whether the Firmware has enabled virtualization extensions.",
        "Corrupt Data",
        "LPC_TRACE_RESERVED_13 Flag",
        "LPC_TRACE_API Flag",
        "UserRefreshOnLogon",
        "TRUE if the addresses should be appended to keyword's existing addresses, FALSE if it should overwrite them.",
        "0x000200",
        "BitmapPattern",
        "Designates one or more TCP ports to filter on.  Network traffic is logged when the filter matches. ",
        "HBA_EVENT_TARGET_UNKNOWN",
        "Number of times this SoftwareFeature has been used",
        "{FAF76B6A-798C-11D2-AAD1-006008C78BC7}",
        "CIM_SARule",
        "CD_D2E1F5EB4F84E0C0B2E61F3513674DF2B7151098EA22604925123769286041D2.1150.275485513.172",
        "SetPriority",
        "MDM_Policy_Result01_TimeLanguageSettings02",
        "C_3AA9C8A0942F537FDAE95E548CCBAD1AD1FFA8F4AD1AFE2EE57031F74E67B391",
        "Percentage of files that are fragmented on the volume.",
        "Win32_EncryptableVolumeProvider",
        "Metadata",
        "AutoBoost Set Floor Event",
        "Logout from the iSCSI Target in this session",
        "The request or operation is not supported.",
        "CD_33DCEF5A25E042E234D6018C36A73BB8BD2E0A0D570AA0A57D43D363A2232E3B.1505.1.9979",
        "AllowCredSSPAuthenticationClient",
        "CommittedMax",
        "CIM_DiscreteSensor",
        "\\\\.\\root\\Microsoft\\Windows\\Defender:__Win32Provider.Name=\"ProtectionManagement\"",
        " Where DeviceID = '#'",
        "00000000000500.000000:000",
        "StartWhenAvailable",
        "RevokeOnUnenroll",
        "EnableOfflineDiags",
        "PortableDeviceAPI_Resources Flag",
        "This method is used to flush the cached data in the volume's file system to disk.",
        "Track Ball",
        "Date and time of the malware incident (using round-trip UTC format)",
        "Win32API|File Reference and Time Reference",
        "MSRedbook_DriverInformation",
        "DrvComplRout",
        "Win32Registry|System\\CurrentControlSet\\Control\\Session Manager\\Environment",
        "PasswordExpires",
        "MSFT_MpPreference",
        "The ExpectedBatteryLife property indicates the amount of time it takes to completely drain the battery after it has been fully charged. ",
        "The ADSI Path to the object in the DS",
        "Win32_RemoveFileAction",
        "Indicates whether this PolicySet is administratively enabled, administratively disabled, or enabled for debug. The \"EnabledForDebug\" property value is deprecated and, when it or any value not understood by the receiver is specified, the receiving enforcement point treats the PolicySet as \"Disabled\". To determine if a PolicySet is \"Enabled\", the containment hierarchy specified by the PolicySetComponent aggregation is examined and the Enabled property values of the hierarchy are ANDed together. Thus, for example, everything aggregated by a PolicyGroup may be disabled by setting the Enabled property in the PolicyGroup instance to \"Disabled\" without changing the Enabled property values of any of the aggregated instances. The default value is 1 (\"Enabled\").",
        "Neighbor Discovery State.",
        "The QueryLanguage property contains the language of the following query filter. For this version of WMI, it will always be 'WQL'.",
        "userName",
        "CR_C6877D93883C0A287546253E157907791BC6A0C92D8F12064B0617A40E589308",
        "Product key from the OA3 BIOS marker.",
        "PermanentSubscriptionsTotal",
        "The TcpWindowSize parameter specifies the maximum TCP receive window size offered by the system. Valid Range: 0 - 65535.",
        "This property indicates that the computer is configured to start off of this disk. On computers with BIOS firmware, this is the first disk that the firmware detects during startup. On computers that use EFI firmware, this is the disk that contains the EFI System Partition (ESP). If there are no disks or multiple disks with an ESP partition, this flag is not set for any disk.",
        "The Access parameter passes the security descriptor for user level permissions. A security descriptor contains information about the permission, owner, and access capabilities of the resource.",
        "senseKey",
        "0E924287397948057A0F5F3DAE6E95080F8788429EB473.1539.2250730984.589",
        "WMI_DISK_GEOMETRY",
        "Policy Setting",
        "Note that the Name property of ManagedSystemElement is also defined as a user-friendly name. But, it is often subclassed to be a Key. It is not reasonable that the same property can convey both identity and a user-friendly name, without inconsistencies. Where Name exists and is not a Key (such as for instances of LogicalDevice), the same information can be present in both the Name and ElementName properties. Note that if there is an associated instance of CIM_EnabledLogicalElementCapabilities, restrictions on this properties may exist as defined in ElementNameMask and MaxElementNameLen properties defined in that class.",
        "RD_TRACE_RESERVED_0e Flag",
        "LPC_TRACE_RESERVED_1a",
        "TEST_TRACE_RESERVED_13 Flag",
        "The specific administrative distance of this route, overriding any default distances specified by the system or routing service.",
        "The PasswordRequired property determines whether a password is required on the user account.",
        "AuthIP",
        "RdmaMissingCounterInfo",
        "chronous",
        "Adds an ODBC DSN.",
        "Number of C-state dependencies",
        "The OSArchitecture property indicates the Architecture of the operating system.Example: 32-bit, 64-bit Intel, 64-bit AMD ",
        "PCMCIA Type II",
        "Sets the cryptographic key used in the generation of segment secrets.",
        "CIM_SpareGroup",
        "{2B590C72-DB2A-11d2-85FC-0000F8102E5F}",
        "CompatID",
        "NameActive",
        "// the iSCSI Initiator service can use this class with any discovery mechanism",
        "Adaptive Clone Local",
        "EVENT_TRACE_FLAG_CALLRESULTDATA",
        ".2033.2519391083.203",
        "Process Zombie Event",
        "MsftEnumDiscRecorder2_DebugConstructor Flag",
        "A TimeSpan that specifies the maximum duration for the security negotiation phase between server and client.",
        "Off-line data collection capability",
        "Continue With Next Job",
        "NDIS Ethernet More Transmit collisions",
        "The InstanceID of the MainModeCryptoSet to use for Main Mode.",
        "AcquireHeapSize",
        "CR_FCBAF5A1255D45B1176570C0B63AA60199749700C79A11D5811D54A83A1F4EFD",
        "WsmAgent",
        "RestrictedSitesZoneAllowUserDataPersistence",
        "Battery Failure",
        "DOT11_IOCTL",
        "HBA_BIND_TO_WWNN",
        "ObjectsGuid",
        "Indicates the Win32 Configuration Manager error code.",
        "IndirectionTableEntryCount",
        "MsftDiscFormat2Tao_DebugDestructor",
        "Timestamp of the event log",
        "CR_1F25AAFC1DFD302234A597D09198F965D3DA468B1863CE8D32B13C0CE151009D",
        "This method is used to pin a file to a storage tier.",
        "Device Firmware Revision",
        "0xEFFF001F",
        "MIF.DMTF|Electrical Current Probe|001.14",
        "Write Back",
        "Deletes any existing connection settings.",
        "Whether IPsec is required for DNSSEC queries.",
        "C_329C7091D99134315D75F4D3A2328F98C961B173B884F03A89824A063291C3C4",
        "The Win32_TSEnvironmentSetting class defines the configuration for Win32_Terminal. This includes capabilities such as Initial program policy.",
        "CD_057DBED191A93075F16FF3FD87CBC67F17C999F14E2DB4CC2AED9F24BB4E2107.92.1826583910.627",
        "LetAppsAccessNotifications_UserInControlOfTheseApps",
        "43014",
        " - AddServiceAccessPoint ",
        "RecordLog",
        "Out Of Memory",
        "AllowInternetZoneTemplate",
        "Maximum number of outstanding requests per initiator queue",
        " The SoftwareElementState is defined in this model to  identify various states of a software elements life cycle.   ",
        "A unique name identifying this instance of the SMTPEventConsumer.",
        "Returns the contents of the Icon specified by filepath and index",
        "The maximum inbound and outbound speeds of the NIC (kbps).",
        "UNCServerName",
        "The current value indicated by the Sensor.",
        "LEGACY_DEVICES",
        "CR_9F25211DB7D04527A2718EFAB934C1664FA38400093282D5A337A37681C23242",
        "\\\"m;\\\"m;",
        "SourceName",
        "LookaheadSplitSupported",
        "Wired Connection Oriented WAN",
        "CoNDIS MAC Options",
        "Win32API|Communication Structures|DCB|fOutxCtsFlow",
        "{5708cc20-7d40-4bf4-b4aa-2b01338d0126}",
        "iSCSITargetPortal",
        "CR_122152BC995251C3FCF68650245D240F361D06B5F08943C45B791533ECBA25B4",
        "C_62523CD9347FEC90C4D769CB3F74810C750EEB7D6102ABE0F8A3924C1484C14F",
        "BCP.1 formatted output (A)",
        "MostRecentAssessment",
        "The current MAC address of the Virtual Function.",
        "Spin Count",
        "GPO ID",
        "Time after which the job is invalid or should be stopped.",
        "AllowJapaneseIVSCharacters",
        "A diagnostic code which indicates why a computer is in a specific licensing state.",
        "SDBUS_DEBUG_ENUM Flag",
        "The DaylightMinute property specifies the minute of the DaylightHour when the transition from standard time to daylight savings time occurs on this operating system.",
        "A free-form string to provide more information for the Purpose property, e.g. \"Application Software\".",
        " Where DiffVolume = # and Volume = #",
        "NDISWMI_TRACE_USO",
        "SessionDirectoryExposeServerIP",
        "Sets the activation method configured for the VL client.",
        "Kerberos Initialize Security Context Handler",
        "PMKCacheMode",
        "Example: %SystemRoot%.",
        "is-is",
        "AllowLocalLogOn",
        "EnableAtStorageActivation",
        "The printer driver is unknown",
        "RelID",
        "Action type of install, uninstall or upgrade",
        "SelfTest",
        "C_B4352AE5BAF16E9168697F87BE74E2D35A37557397C95E650D63E6588187DC82",
        "CD_2B0CB21E4574B83D661A7C62AD7BF3133DF3FBA914EA55D3A45DC4A7214DD006.1700.3243377670.359",
        "OtherRegisteredOrganization",
        "Identification of the array in the micro architectural structure where the error was generated",
        "StorageHealthSetting",
        "This class exposes operations associated with FCP on a Fibre Channel adapter. There should be one instance of this class for each adapter.",
        "X.509 Certificates (machine as principal)",
        "//        Windows XP and Windows .Net server",
        "I_84DAE394D72EEC44948504C5752A6FB488C2F34AF0DDE614A4D6BA8E4EF41579.1151.76143916.266",
        "Peak Paged Pool Usage Quota",
        "Default size of write cache for virtual disk creation",
        "C_8D438C565310E95809DBB3581FC76968BAB1801A4D1A32B498FF8D19BC26268D",
        "C_EF449CE69828797E16ABEAB272BB63851199331E1B3809DFFF02FC6CB2F0B417",
        "MDM_Policy_Result01_DataUsage02",
        "R_7B2F35FE020C015C27E5303A73A6689342638C22D1969B462A84B8B90501905F.1105.3553415097.564",
        "Domain hosting the user",
        "Operation was successful ",
        "A copy of the 'previous' instance whose change generated the Indication. PreviousInstance contains 'older' values of an instance's properties (as compared to SourceInstance), selected by the IndicationFilter's Query.",
        "PromotePercent policy",
        "Fixed",
        "C_CE2D741F2F76D8B2DEF2CE5F7AFEC89E6175D7B4F954957AFC4C2CCF01EA7DB4",
        "FormatErrors",
        "This field specifies the operating system, version, driver, and other host environment factors that influence the behavior exposed by the storage subsystem.",
        "If set to TRUE, this instructs the physical disk to validate if enabling maintenance mode will be successful.",
        "RSOP_SystemService",
        "InternetZoneAllowAutomaticPromptingForFileDownloads",
        "UseCertificateForOnPremAuth",
        "0xEFFF0020",
        "Localized version of RSOP_PolmkrSharedPrinterSetting for American English",
        "AllowIndexingEncryptedStoresOrItems",
        "C_311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        "PolicySourceAvc444ModePreferred",
        "NoOscSupport",
        "ForegroundApplicationBoost",
        "Index",
        "Other unicast addresses that may be used to communicate with the LANEndpoint.",
        "{1ab5ac29-037f-43a1-9484-78c9db61f869}",
        "This class represents an association between a managed system element collection and the class representing statistical information about the collection.",
        "NS_3579DC951657EA60871CD1E9EBEE6A8D0AD711287837BD9631F6B3FC9EC7141E\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_07518836069F28661B2BDE63EA95AFE81F3822D4677A49CBAE5F594ED13FEBAFa81a0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109",
        "NTSC 433",
        "CIM::Policy",
        "A series of examples will make ordering of PolicyActions clearer: ",
        "Example: 32256",
        "I_BA0A62B9B252B8DF15D9E586D8D36A00E214D826B2BD41C8DD9DDC772381781C.1148.2517947688.342",
        "\\\\.\\root\\Microsoft\\Windows\\DesiredStateConfiguration:__Win32Provider.Name=\"dsccore\"",
        "Microsoft iSCSI Initiator: Connection Information",
        "Not Advertised",
        "DFSProvider",
        "The lower-level interface of the network adapter is a WDM bus driver such as USB.",
        "scriptType",
        "Win32_SystemDevices",
        "Association between StoragePool and Volume. This association should only exist for concrete pools.",
        "Note that HKEY_DYN_DATA is a valid tree for Windows",
        "The child product in the association.",
        "Setup Persistent iSCSI Volumes",
        "If 0 is returned, then the task completed successfully and the use of ConcreteJob was not required. If 4096 (0x1000) is returned, then the task will take some time to complete, ConcreteJob will be created, and its reference returned in the output parameter Job. Any other return code indicates an error condition.",
        "{0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e92}",
        "ConfigString is in the format <AppId>;<WNS Package Family Name>",
        "KDC Flag",
        "Phone Line",
        "// The number of times that the TCP/IP stack has failed when sending IKE messages.",
        "R_B4ED6CD6BB039C8A40404514D33A068C19B058FAE7508C9C445CEEFE558E436D",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_46525BAD3099F51458A5D518030526DE848A3DE564DD8816A47DE935CCD3FA82",
        "LastFullScanSource",
        "InfiniBand",
        "{EC69F5E0-2D03-49CA-A813-A7D5D62A5943}",
        "Install a license package for the current product.",
        "{aab6ac31-86fb-48fb-8b48-63db235ace16}",
        "C_AD19852B659F95D5A51E327D83B06F4CFE38AB7F7821BA9B06B5184C781CDC4D",
        "VFPFlowDirection",
        "Gets only ODBC DSNs that are using the specified ODBC driver. You can use wildcard characters. The default is to return all ODBC DSNs.",
        "cdProv\"",
        "security Groups",
        "802.11b",
        "ExpireKTimer2",
        "FunctionID",
        "The behaviors associated with this contract.",
        "PreventFirstRunPage",
        "HeapCreate_V2",
        "Language Id",
        "MaxOutstandingR2T",
        "CD_5E4C61B5F4870A86C87C8D3A31C679CD8547F13761DF48FEE0C77BF5C516F817.1186.922982298.360",
        "5 - 'Log': This indicates that the replica object is being maintained as a log of changes to the source. ",
        "SegmentNumber",
        "WorkflowType",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2750.2844578257.348",
        "Output Bin Full",
        "The type of Health Action.",
        "The maximum number of retry cycles to attempt delivery of messages to the receiving application.",
        "String URL of the resource module manager location",
        "WNFPublish",
        "#define HBA_EVENT_PORT_BROADCAST_SES    0x208",
        "uncName",
        "CDDASupported indicates the drive supports digital audio for some sector sizes.",
        "IPv6NonIPsecExtensionHeadersSupported",
        "Bad Request",
        "Blowfish",
        "DisableKeyManagementServiceHostCaching",
        "MachineOrUser",
        " 0x00000010 ",
        "Elements",
        "ReplayCacheSize",
        "CIM_MultiStateSensor",
        "The ProcessId property specifies the process identifier of the service.",
        " Type of driver service start",
        "Number of bytes written on disk",
        "Icon Path",
        "CIM_LogicalIdentity",
        "Warning Limit",
        "Compat",
        "R_153A90D31DAA2BB98D107166F8216FEE25A312878D4AECBB89966D3EAC52B5F6",
        "FileMax",
        "FaxClient Flag",
        "52E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "The maximum number of outbound connections per endpoint on the client.",
        "MIF.DMTF|Video|003.8",
        "Requests a reset of the LogicalDevice. The return value should be 0 if the request was successfully executed, 1 if the request is not supported and some other value if an error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are \\'translated\\' may also be specified in the subclass as a Values array qualifier.",
        "MSFT_NetEventProviderBase",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.1153235212.368",
        "R_3447964AD4B51A40682639E2C45B8A122022C3FEC3E3B3FE7276444680D9A4BB",
        "Win32_SecurityDescriptorHelper",
        "The Win32_PageFileElementSetting class represents an association between the initial settings of a page file and the state of those setting during normal use.",
        "UploadRatePct",
        "MSMCAEvent_InvalidError",
        "0xEFFF0030",
        "SystemStartupSetting",
        "PortType is defined to force consistent naming of the \\'type\\' property in subclasses and to guarantee unique enum values for all instances of NetworkPort. When set to 1 (\"Other\"), related property OtherPortType contains a string description of the type of port. A range of values, DMTF_Reserved, has been defined that allows subclasses to override and define their specific types of ports.",
        "Read Count",
        "PrimaryOwnerContact",
        "The Win32_SystemSlot class represents physical connection points including ports, motherboard slots and peripherals, and proprietary connections points.",
        "Direct memory access (DMA) channel management.",
        "MIF.DMTF|Voltage Probe|001.18",
        "_DH_WMP_CACHE_PROVIDER Flag",
        "TR_RPC",
        "Cleanup",
        "No Breach",
        "NS_CCC29D03D4E6FBE5C7F923DA21C7394564CE2AFFEE4FB60EA024B63A53FECA72",
        "MSNdis_CoHardwareStatus",
        "object:MSFT_NetBranchCacheHostedCacheServerSettingData",
        "LetAppsAccessMessaging",
        "{d3de60b2-a663-45d5-9826-a0a5949d2cb0}",
        "Optional handle to explicit credentials",
        "WSP_DiskToPartition",
        "Optional public IPv6 address or subnet, for which this policy is specified.",
        "arguments",
        "object:MSFT_NetAdapterLsoEncapsulationTypes",
        "MSNdis_FddiLongMaximumListSize",
        "The model of the physical disks in the storage fault domain to put into maintenance mode.",
        "Timestamp_Object",
        "MonthlyLanBytes",
        "The Receive Segment Coalescing (RSC) setting data for network adapter.",
        "PNP_RESOURCE_TRACE_LEVEL Flag",
        "TerminalServiceMode",
        "OSVolume",
        "Activity",
        "ref:Contract",
        "The component responsible for metadata generation associated with this service.",
        "Example: IDE Fixed Disk.",
        "The ServicePackInEffect property specifies what servicepack was in effect when the update was applied. If no service pack has been applied, the property takes on the value SP0. If it can not be determined what service pack was in effect, this property will be NULL.",
        "2 - 'Fixed': The storage for the volume is allocated up front.",
        "Author's organization",
        "SupportsVirtualDiskDeletion",
        "{90cbdc39-4a3e-11d1-84f4-0000f80464e3}",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2020.2776175683.368",
        "PolicyActions may be aggregated into rules and into compound actions. PolicyActionStructure is the abstract aggregation class for the structuring of policy actions.",
        "The SetTcpWindowSize method is used to set the maximum TCP Receive Window size offered by the system. The Receive Window specifies the number of bytes a sender can transmit without receiving an acknowledgment. In general, larger receive windows improve performance over high delay and high bandwidth networks. For efficiency, the receive window should be an even multiple of the TCP Maximum Segment Size (MSS). The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        " Modification ",
        "This parameter accepts the PackageFamilyName that the user wants to display background task information for.",
        "3.5 ,  1.2Mb,  512 bytes/sector",
        "Select * from Win32_NetworkConnection",
        "AccountLogonLogoff_AuditLogoff",
        "11032",
        "RSOP_ExtensionEventSource.id=\"{1256F140-6095-4722-A2C4-B5E3D47F1690}\"",
        "FabricName",
        "CD_F27728D32A3636F45280AD3F71C73821FAB17D765ED15BCD09B89B7007E5475A.74.4278201750.667",
        "Operating system's notion of the local date and time of day.",
        "MountOrSlotDescription",
        "2 - 'Initialized': The link to enable replication is established and source/replica elements are associated, but the copy operation has not started. ",
        "Values: TRUE or FALSE. If TRUE, a hypervisor is present.",
        "SpinLockContentionSampleRate",
        "Bid2Etw_DBNETLIB_1_Trace",
        "WDF WorkItem",
        "The StartingOffset property indicates the starting offset (in bytes) of the partition.",
        "Designates one or more destination IP addresses to filter on.  Network traffic is logged when the filter matches. ",
        "SAM Query Information Alias",
        "Microarchitecture",
        "MDM_LanguagePackManagement_InstalledLanguages01_01",
        "TEST_TRACE_RESERVED_06 Flag",
        "Provider Flag",
        "IP address to ping",
        "Overwrite modules when downloading from Pull Server.",
        "CoNDIS Minimum Link Speed",
        "3 - 'Continue With Next Job' meaning continue with the next job in the queue ",
        "TROJAN_MONITORINGSOFTWARE",
        "Hardware Security Breached",
        "WINCE",
        "CR_EE35AEE540BCEDF1393FC978093FBF16399E5CE3BB4E7B096885CF94D130CD38",
        "60004",
        "Note:  The SE_SYSTEM_ENVIRONMENT privilege is required on IA64bit machines. This privilege is not required for other systems.",
        "LUAInstall: error 0x00000005 setting flags [{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}]",
        "LUAInstall: error 0x00000005 setting flags [{72C984BA-0666-4D3F-A0DE-96BF43838E6E}]",
        "AMENDMENT",
        "OperatingStatus consists of one of the following values: Unknown, Not Available, In Service, Starting, Stopping, Stopped, Aborted, Dormant, Completed, Migrating, Emmigrating, Immigrating, Snapshotting. Shutting Down, In Test ",
        "0x00000800",
        "GSM Flag",
        "The Schema Version",
        "KI_CE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0",
        "C_AF3D854FF025C11AE0CB78C559DC0BD55EB8A356EAE34913761A09B3CF6B045E",
        "ISATAP tunnel interface",
        "Performance",
        "Media Connected",
        "Number of ACPI processor idle states supported by the platform",
        "Set Quota",
        "RemoteCreationTime",
        "SaveFilesToHost",
        "MIF.DMTF|IRQ|001.4",
        "PSPrinter",
        "WRITE Flag",
        "This parameter is used to specify the list of drives that should be scheduled for autochk at next reboot. The string syntax consists of the the drive letter for the logical disk.",
        "The Manufacturer property indicates the manufacturer of the IDE controller device.",
        "CreateGroupReplicaFromElementSynchronizations",
        "This parameter sets a limit on how far back log messages should be gathered (in minutes). Default is that all logs will be gathered, no matter how old.",
        "{8502C4F1-5FBB-11D2-AAC1-006008C78BC7}",
        "A clarification is needed with respect to the value 17 (\"Mobile User Device\"). An example of a dedicated user device is a mobile phone or a barcode scanner in a store that communicates via radio frequency. These systems are quite limited in functionality and programmability, and are not considered 'general purpose' computing platforms. Alternately, an example of a mobile system that is 'general purpose' (i.e., is NOT dedicated) is a hand-held computer. Although limited in its programmability, new software can be downloaded and its functionality expanded by the user.",
        "InstallProductKey",
        "iScsiFlagPower Flag",
        "BIOS/FCode",
        "65001..65535",
        "The MaximumStorage property specifies the maximum amount of disk space available to the user.  If MaximumStorage is set to USER_MAXSTORAGE_UNLIMITED the user is allowed to use all available disk space.",
        "This method allows the storage pool to be renamed.",
        "AllowProjectionFromPCOverInfrastructure",
        "The Antecedent reference is the Account used in the initiation of this session. The account could be either a user account or a system account.",
        "NDISWMI_TRACE_POWER Flag",
        "Example: WINNT.BMP",
        "Win32_ClassicCOMApplicationClasses",
        "PCI Bus Error Types",
        "ReassemblyLimit",
        "IR_BA0A62B9B252B8DF15D9E586D8D36A00E214D826B2BD41C8DD9DDC772381781C",
        "{acf1403a-a61c-11d0-8dd4-00c04fc3358c}",
        "iScsiFlagWmi",
        "    L2tpIPsecAuth (string) Specifies whether the L2TP/IPSec authentication uses a certificate or Pre-Shared key. Available values: Certificate, Psk",
        "Exposed Locally",
        "The PauseAfterReset property identifies the time delay before the reboot is initiated.  It is used after a system power cycle, system reset (local or remote), and automatic system reset.  A value of -1 indicates that the pause value is unknown",
        "SET_EA",
        "PreviousValue",
        "The name of the port associated with this printer.",
        "Disk IO entry",
        "// redirected target portal information for an iSCSI Connection.",
        "LockCount",
        "ResumeJobById",
        "An enumerated value that describes the probable cause of the error.",
        "The Dependent reference represents the Win32_DiskPartition containing the properties of a disk partition residing on the disk drive.",
        "Init Flag",
        "The LogFileName property indicates name of the log file.",
        "Per Second",
        "A class derived from FileSystem that represents the file store controlled by a ComputerSystem through local means (e.g., direct device driver access). In this case, the file store is managed directly by the ComputerSystem without the need for another computer to act as a file server. This definition does not breakdown in the case of a Clustered File System. In this scenario, the FileSystem is a LocalFileSystem, weak to the Cluster.",
        "ResponsesKeyName",
        "PhySpeed",
        "Play Enabled",
        "Win32_TSPublishedApplicationList",
        "R_9B6218EFA94C067C7A0C80C5056C3D58C66F39DA9385FB7012B7F51EB8C27ACA",
        "LeasingMode",
        "SettableParity",
        "MS_SMHBA_PROTOCOLSTATISTICS",
        "C6-Envelope",
        "Win32_ProgIDSpecification",
        "PermissionPreSet",
        "EnumerateFull",
        "A vendor-specific error code. The value must be set to zero if the Job completed without error. Note that this property is also present in the JobProcessingStatistics class. This class is necessary to capture the processing information for recurring Jobs, because only the \\'last\\' run error can be stored in this single-valued property.",
        "CRITICAL Flag",
        " value that can enable the TCP to perform dead gateway detection. If TRUE, the method will enable dead gateway detection.",
        "Release For Mod Write",
        "Unittest Flag",
        "Write Time",
        "Dvmrp",
        "Downlevel IPsec NetShell Plugin",
        "MSFT_iSCSITargetPortal",
        "ObHandleRundownEvent",
        "Sequential Access",
        "If true, do not send quad-A query before sending A query",
        "DetailedTracking_AuditProcessTermination",
        "Aggressive mode enabled",
        "Mpssvc",
        "{8502C55A-5FBB-11D2-AAC1-006008C78BC7}",
        "Disable running full scan on mapped network drives.",
        "I_0F33828E8CD7660C131A9B819C3D5A577748424BC8568964D9428FE644F6572B.2707.3821872533.284",
        "CaptureMode",
        "Bad argument ",
        "AllowToasts",
        "ExtError",
        "AccessRight",
        "AddConnection",
        "C_68F60BCE5ED1CEFD06D072F2C79847AF4A3C52BA9A8E9F51041AA990EA82C70E",
        "QuotaVolume",
        "NewTriggerByStartup",
        "The association between a shadow copy and the volume on which differential data is written.",
        "The Root property indicates whether the node is a DFS root or a link. A value of True indicates that the node is a root.",
        "RemoteMachineTransportAuthorizationList",
        "MSFT_WebDownloadManager",
        "A uniquely generated session ID used only internally.  This is the value returned by the LoginToTarget method.",
        "UnmovableFiles",
        "Msft_CliAlias.FriendlyName=\"MemoryChip\"",
        "Win32API|File System Functions|GetVolumeInformation|FS_FILE_COMPRESSION",
        "TrustedSitesZoneSecurityLevel",
        "wmic Alias #__PATH assoc",
        "Values: TRUE or FALSE. A value of TRUE indicates the baud rate can be changed.",
        "notifystreamfileobject",
        "IPAddressV4",
        "NDKPI Minor Version Number",
        "{58515BF3-2F59-4f37-B74F-85AEEC652AD6}",
        "R_43B35DA4EAEBC0284206ADBC4132DA71EB8556E731586CFE46B5A658E2C2F498",
        "{34ff16bf-30ca-4a2a-a46d-c7ee74bc3582}",
        "cache line is held exclusive",
        "{8502C4D0-5FBB-11D2-AAC1-006008C78BC7}",
        "The ServiceDependencies parameter passes a list containing names of services tha",
        "The Microsoft Defender Antivirus Heart Beat Class",
        "ManufacturerVersionInfo",
        "This property has been deprecated in favour of the GetAccessMask method of this class due to the expense of calling GetEffectiveRightsFromAcl. The value will be set to NULL",
        "Example: S46=138.",
        "Password Override Enabled",
        "CR_BE3C9A0F3A301859A6C844B2145A4F44B9BD768BEE695F45C60A8F416A0E9077",
        "MDM_MultiSIM_Policies02",
        "The InstanceID of the Phase1AuthenticationSet to use for Phase 1 auth.",
        "TRUE if Bi-directionsal SCSI comamnd supported",
        "The frequency (in hertz) at the high end of this powersupply's input frequency range 2. A value of zero implies DC.",
        "Win32_PnPDevicePropertyUint32Array",
        "ArpUseEtherSNAP",
        "FullyDecrypted",
        "InstanceName",
        "0xC000002A",
        "5.25, 320KB,  1024 bytes/sector",
        "ProcessorAffinityMask",
        "BcdDeviceLocateData",
        "Capacity",
        "Package Family Name",
        "MaxConcurrentInstances",
        "Scsi Target ID",
        "The Domain property indicates the name of the Windows domain to which a group or user belongs.",
        "The SerialNumber property indicatesthe operating system product serial identification number./nExample:10497-OEM-0031416-71674.",
        "G703 at 2Mb",
        "The Name property contains an identifying name for this instance of the Win32_OSRecoveryConfiguration class.",
        "The Reset property contains the command string used to reset the modem for the next call.",
        "The Domain property indicates the name of the  domain to which the user account belongs.",
        "Not Supported",
        "The PasswordExpires property determines whether the password on the user account will expire.",
        "MaxSpeed",
        "CD_CDB424FE67340CCC2621376F2156DC346548CA8F3622EA235EAF7BC515A8CBC2.314.224804471.226",
        "The format of the ErrorSource property is interpretable based on the value of this property. Values are defined as: ",
        "VirtualAllocDCStart",
        "MSNdis_FddiLongMulticastList",
        "DOT11_MSM_ADAPT Flag",
        "The VersionID provides a numeric representation of the shadow provider version.",
        "SpeakerModeOn",
        "TM_MEMORY Flag",
        "MCA memory hierarchy level",
        "OtherIdentifyingInfo captures additional data, beyond asset tag information, that could be used to identify a physical element. One example is bar code data associated with an element that also has an asset tag.",
        "CR_943386A936885D346F0D61FA24D7BB2533B7B797B4E446178A40D4E6F2C1683A",
        "IL_F461AA66D8B7B7D281791B03410E52860C27B31270AE3EE90F1659A118058546.388.1.47882",
        "MSNdis_ReceiveFilterParameters",
        "Automatic",
        "DisableCatchupQuickScan",
        "AffinityIndex",
        "This field describes the desired number of light parities that will be formed for parity-based resiliency settings. If the resiliency setting is not parity-based, this field will be set to 1.",
        "Unsuccessful Completion",
        "CIM_VideoControllerResolution",
        "MSiSCSI_SessionStatistics",
        "CollectionID",
        "CableManagementStrategy",
        "Read Warning",
        "BAUD_4800",
        "Regular 1822",
        "A representation of the access points of a boot service.",
        "computerName",
        "UINT8",
        "Offload",
        "CIM|Win32_IDEController",
        "There are other policies and user preference can prevent the profile from roaming.",
        "MSNdis_QueryPortState",
        "Interlaced Operation",
        "The name of the primary system owner.",
        "Denotes the perceived severity of the event from the notifier's point of view. ",
        "DtcInstance",
        "If true, the Offline Files feature is enabled for this folder.",
        "C_73859BDECC6E59555AB103C0DF5302F8942C19E249A9E48DB616B611E1AA3893",
        "A unique key which identifies a file within the scope of a product.",
        "TraceLSA",
        "{393da8c0-dbed-11d2-895b-00c04f79ab69}",
        "PNP_RESOURCE_TRACE_LEVEL",
        "Language",
        "{8502C510-5FBB-11D2-AAC1-006008C78BC7}",
        "The byte offset of this extent from the start of the virtual disk.",
        "EventVersion",
        "\\\\.\\Root\\Standardcimv2:__Win32Provider.Name=\"MsNetImPlatform\"",
        "Adds a new printer to the specified server using a new WSD or IPP printer port.",
        "Padding indicates the number of bytes inserted between blocks on a tape Media.",
        "\\\\.\\root\\CIMV2:__Win32Provider.Name=\"Win32_FolderRedirectionConfiguration\"",
        "Denotes whether this provider supports remote registration and management.",
        "select * from Win32_ModuleLoadTrace",
        "GetAvailableVirtualSize",
        "The Index property indicates the index number of the SCSI controller in the system registry./nExample: 0.",
        "The number of bytes sent using the AH protocol.",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_7D726A53C2E109A7102AA0733AF15E0ABEDDFCEA169FD750AACBD377D8D29F564a81E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "This setting allows you to enable or disable randomization of the scheduled scan start time and the scheduled security intelligence update start time. This setting is used to distribute the resource impact of scanning. For example, it could be used in guest virtual machines sharing a host, to prevent multiple guest virtual machines from undertaking a disk-intensive operation at the same time.",
        "The SetNumForwardPackets method is used to set the number of IP packet headers allocated for the router packet queue. When all headers are in use, the router will begin to discard packets from the queue at random.The method returns an integer value that can be interpretted as follows: ",
        "Error - Removable Drive",
        "The WINSSecondaryServer property indicates the IP address for the secondary WINS server. ",
        "HBA_EVENT_TARGET_REMOVED",
        "MSADCE",
        "CD_0750888F7DA336796CAD46D09BBCA6EE8FE708CB3E6A5972E9507072892D3743.2623.3928339205.219",
        "Control power management related standardized keywords",
        "The Win32_Desktop class represents the common characteristics of a user's desktop. The properties of this class can be modified by the user to customize the desktop.",
        "MDM_Reporting_EnterpriseDataProtection01_RetrieveByCount02",
        "CD_4AC7D53B353FF907A3871574884AE20E2C77DD82D160B77856929A17F6C699D4.1205.2742897983.362",
        "Win32_NetworkAdapterSetting",
        "CipherAlgorithm",
        "ModifyFirewallException",
        "SystemLevelAddress",
        "IsHighlyAvailable",
        "SQLSRV32.1 formatted output (W)",
        "This method returns the vendor specific data from an enclosure.",
        "Environment",
        "ROOT\\Microsoft\\Windows\\Defender",
        "RSOP_RestrictedGroup",
        "InternetZoneAllowCopyPasteViaScript",
        "MsftDiscFormat2RawImage_DebugRelease Flag",
        "The list of data rates, in units of 0.5 Mbps",
        "Allocation/Resource/Stress failures",
        "Server",
        "Time after which the job is invalid or should be stopped",
        "0x00000003",
        "NS_511626FAE4F57DBD20DF5CD44A41DAECED28CF7B3FD8B12012C7F4B58F44E665",
        "object:MSNdis_CountedString",
        "{8c8b30e4-b13f-469f-9854-f67feee02148}",
        "SettableThresholds",
        "MediaLoaded",
        "NDIS Status Media Connect",
        "OtherIdentifyingInfo captures additional data, beyond System Name information, that could be used to identify a ComputerSystem. One example would be to hold the Fibre Channel World-Wide Name (WWN) of a node. Note that if only the Fibre Channel name is available and is unique (able to be used as the System key), then this property would be NULL and the WWN would become the System key, its data placed in the Name property.",
        "TRUE if adapter should perform target discovery via iSNS.",
        "ref:CIM_PhysicalComponent",
        "Windows Server 2003, Web Edition",
        "Reachable time (in ms).",
        "The IPv6 address that this ProtocolEndpoint represents.",
        "CIM_HeatPipe",
        "{AB08D884-DB30-11d2-85FC-0000F8102E5F}",
        "Startup program's action ",
        "Contents of the Icon",
        "AutoSense",
        "NTLM Logon User",
        "A68530BF42F687579F4795E6FAE9D6D60CF7B02015DD6EAA0272.2642.837909254.263",
        "Extended Error Code",
        "TempDirectory",
        "{bf3a50c5-a9c9-4988-a005-2df0b7c80f80}",
        "1: create an ETW trace session at boot time; 0: otherwise.",
        "3221232504",
        "The Name parameter specifies the domain or workgroup to join. This parameter cannot be NULL.",
        "AccountNames",
        "REDBOOK_WMI_CDDA_SUPPORTED",
        "TP_V2_TimerCancelled",
        "JIS B2",
        "This is the class used to model the AD Syntax Octet String",
        "The level of error recovery negotiated between the initiator and the target.",
        "NDIS Maximum Frame Size",
        "DomainPortWWN",
        "Specifies the rights granted and denied to a trustee for a given object. Modeled after EXPLICIT_ACCESS",
        "MSFT_VpnConnection",
        "TRUE if the 'Keyword' is a FQDN and should be resolved automatically.",
        "C_5243094142BFF50E230A225F471ECAE0DCF0FC00D9021F08F10118DC4E9AD84C",
        "I_C7BED1CCC8E3279B70E4846D9154BA63003D9E227AE14E0590492F865356BD94.1499.2854629194.270",
        "C_3196586F94E9CFEA6D912774CB2A6C6FDB2471424853F54D4C0F4EE4F94880DF",
        "{7969ba4d-dd80-4bc7-b3e6-68043997e519}",
        "OtherErrorDescription",
        "{447956fd-a61b-11d0-8dd4-00c04fc3358c}",
        "object:MSNdis_ReceiveFilterInfoArray",
        "NS_EA3097416692F8FC803A1F4692E60E87151AD44E2791A9FD501A502D88A4093A",
        "CIM_FileSystem.Name",
        "Network TCP/IP",
        "RegisterSubsystem",
        "Product Description",
        "RdmaAdapterInfo",
        "3 - 'Full Copy': This indicates that a full copy of the source object is (or will be) generated. ",
        "The SetDefaultTOS method is used to set the default Type of Service (TOS) value in the header of outgoing IP packets. The method returns an integer value that can be interpretted as follows: ",
        "Alias",
        "Localized version of RSOP_PolmkrFolderOptionSettingVista for American English",
        "MSFT_StorageSubSystemToStoragePool",
        "MSFT_NetMainModeRuleFilterByAddress",
        "InstalledDisplayDrivers",
        "Protocol Version Flag",
        ",,m;,,m;",
        "MI_ERRORCATEGORY_FROM_STDERR",
        "Other - For integer values other than those listed above, refer to Win32 error code documentation. ",
        "MSNdis_80211_RTSThreshold",
        "GetSD",
        "CD_F2F304BEF42556C432C5A7D1B6A2CB5F5A5034C33F73E5E8567E46282BF32B4E.1595.2250501703.506",
        "{ebd0a0a2-b9e5-4433-87c0-68b6b72699c7}",
        "DevicePasswordEnabled",
        "3BB242E3FF62C76339F84C997DCEF89443C2DF65",
        "LocalFS",
        "SyncType describes the type of copy that will be made.",
        "R_DEFA254B5111B4FA7ADCAE8857BF29A2E7FD1456026F7A024C9658EE7DB22400.1781.1619915233.580",
        "The Path property indicates the local path of the Win32 share.",
        "The number of Virtual Functions currently allocated.",
        "Duplicate address detection retransmit time (in ms).",
        "AntispywareSignatureVersion",
        "The SNMPCommunity property contains a security level value for the device.  For example 'public'.",
        "InputRequests",
        "CD_1F1219F96576A4588331D02100737379E76B59AFFFE01B2EACFBBB0DBCD4C75C.1714.2403629231.436",
        "The SCSI Port ID associated with this LUN, matching the SCSI_ADDRESS",
        "The Version property specifies an architecture-dependent processor revision number. Note: This member is not used in Windows 95.",
        "The ArpUseEtherSNAP property indicates whether Ethernet packets follow the IEEE 802.3 Sub-Network Access Protocol (SNAP) encoding. ",
        "CtlGuidWPDSP",
        "Subject Name",
        "0xEFFF0017",
        "CD_96A5470A9748A5F228C216657A9DE5F01BB3D899482629507545192083B50D88.1925.4241078609.279",
        "TP_V2_CBEnqueue",
        "This class encapsulates an ETW provider on a computer for the event capture.",
        "Ethernet",
        "TR_DEFAULT",
        "SourceFilePath",
        "SoftwareVersion",
        "AuditedAccessMask",
        "object:ISCSI_RedirectPortalInfo",
        "The SetIPUseZeroBroadcast method is used to set IP zero broadcast usage. If this parameter is set to TRUE, then IP will use zeros-broadcasts (0.0.0.0) instead of ones-broadcasts (255.255.255.255). Most systems use ones-broadcasts, but systems derived from BSD implementations use zeros-broadcasts. Systems that use different broadcasts will not interoperate on the same network. Default: FALSE. The method returns an integer value that can be interpretted as follows: ",
        "Source is associated to SynchronizationAspect",
        "CreateNewAuthority",
        "Network adapter Virtual Port settings.",
        "_947A6ECFED1300E5950B4C8196704C2B50E4463864CF2615B27D56E94A95716A",
        "Specifies the server on which the printer is located.",
        "ClustersPerSlab",
        "CD_F8950447585CD6743131FC688F3AC5EE4D2DE57B4CA01C83E91AB8FD7ED70E93.1667.2297125398.268",
        "Win32Registry|.DEFAULT\\Control Panel\\Desktop\\WindowMetrics|IconTitleWrap",
        "TEST_TRACE_RESERVED_10",
        "Win32API|Windows Networking Structures|NETRESOURCE|dwType",
        "MajorVersionNumber",
        "MuiTraceData_String",
        "This property is a set of bit flags that specify the type of service.",
        "{0a214807-e35f-11d0-9692-00c04fc3358c}",
        "The amount of memory that needs to exist on a  computer system for a software element to executing  properly. ",
        "{cfdd34c4-dfaf-4f80-be62-2897711ae964}",
        "Win32API|Network Management Structures|USER_INFO_2|UF_LOCKOUT",
        "Whether the Connection profile is an AllUser or Local User profile.",
        "PhysicalPosition",
        "{3f2c141a-83bc-11dd-94b8-001d09162bc3}",
        "MIF.DMTF|Power Supply|004.18",
        "A positive or negative integer used in conjunction with RunDay to indicate the day of the week on which the Job is processed. RunDayOfWeek is set to 0 to indicate an exact day of the month, such as March 1. A positive integer (representing Sunday, Monday, ..., Saturday) means that the day of week is found on or after the specified RunDay. A negative integer (representing -Sunday, -Monday, ..., -Saturday) means that the day of week is found on or BEFORE the RunDay.",
        "{ca8a56f9-ce81-40e6-a70f-a067a476e9e9}",
        "MobTabPerfTraceProvider",
        "55001",
        "The WINSEnableLMHostsLookup property indicates whether local lookup files are used. Lookup files will contain a map of IP addresses to host names. If they exist on the local system, they will be found in %SystemRoot%\\system32\\drivers\\etc.",
        "Win32API|PartitionRecord|dwPartitionType",
        "MSFT_NetIKEMMCryptoSet",
        "The SetSecurityDescriptor method updates the specified key's security descriptor with the supplied __SecurityDescriptor. The method returns a uint32 which is 0 if successful or some other value if any other error occurred.",
        "BIOS is Upgradeable (Flash)",
        "File name and path on target node to copy or create.",
        "BindingState",
        "Enables or disables failure prediction checking at the hardware level",
        "object:MSFT_NetIKEAuthProposal",
        "WindowsInstaller",
        "ScheduledInstallEveryWeek",
        "Always Off",
        "I_0FCD55CFA46AEEB52F53BA4A255EAD5AF6771EA55E53002CAC4E98AE74ADFB9C.2698.1659596386.275",
        "INSTANCE",
        "Res Flag",
        "} ISCSI_ENCRYPTION_TYPES, *PISCSI_ENCRYPTION_TYPES;",
        "ClientRdmaCapable",
        "The ResponsesKeyName property contains the response this modem might report to the operating system during the connection process",
        "CreateTrustedDomEx_End",
        "No_GP_Fault_Error_Box",
        "InvalidBucketIndex",
        "RD_TRACE_RESERVED_11 Flag",
        "WMI|Win32_DCOMApplicationSetting",
        "Dynix",
        "{ebcca1c2-ab46-4a1d-8c2a-906c2ff25f39}",
        "Sampling Period",
        "The FirstMessageDelay property specifies the length of time between initial power failure and the first message sent to users. If power is restored within the FirstMessageDelay time, no message is sent, although the event is logged.",
        "SNMPIndex",
        "WdfWorkItem",
        "Bid2Etw_MSDATL3_1",
        "The name of the language monitor for this driver.",
        "NDIS Set Link Parameters",
        "DuplicateHandle",
        "Devices_AllowedToFormatAndEjectRemovableMedia",
        "The conditions and actions associated with a PolicyRule are modeled, respectively, with subclasses of PolicyCondition and PolicyAction. These condition and action objects are tied to instances of PolicyRule by the PolicyConditionInPolicyRule and PolicyActionInPolicyRule aggregations. ",
        "2.16.0",
        "IncludeAllApplications",
        "ReplaceableApplications",
        " - RemoveMembers ",
        "Enable_BCHostedClientByUseSCP",
        "RenamePrinter",
        "I_CE1AB475306539B9E244C98908B04E7D335C952B0802573B7D36EFEB15743AA7.695.1.29172",
        "CIM_ClassIndication is an abstract superclass describing changes in the definition of the schema. Subclasses represent specific types of change notifications, such as class creation, deletion and modification.",
        "PortableDeviceAPI_DriverCommunication Flag",
        "KI_D5472BB4000403F6D6CDB0F595804CE62C0D292549796526CA9E7773798E5F24",
        "SetKeyManagementServiceMachine",
        "Tape drive management.  ",
        "Below Normal",
        "C_0AD4DE64AD6766E900118148CD8470714DBEEA985A4EC80DD4AD11985B5223BF",
        "States of numeric sensors. See CIM_NumericSensor.EnabledState for details.",
        "iScsiDebug27",
        "NS_E8C4F9926E52E9240C37C4E59745CEB61A67A77C9F6692EA4295A97E0AF583C5",
        "The SCSITargetId property indicates the SCSI ID number of the Win32 CD-ROM drive.",
        "Win32_WIN32_TSSESSIONSETTING_Prov",
        "The Virtual Function ID.",
        "The ScanMode property determines whether the display device is interlaced.  ",
        "IsSerrationRequired",
        "DefaultIcon",
        "0x001 ",
        "Example: SIMM 3",
        "eo mode.",
        "Description of the battery's charge status. Values such as \"Fully Charged\" (value=3) or \"Partially Charged\" (11) can be specified. The value, 10, is not valid in the CIM Schema since in DMI it represents that no battery is installed. In this case, this object should not be instantiated.",
        "Base Address or Status Code",
        "{13CD7F92-5BAA-8C7C-3D72-B69FAC139A46}",
        "PortSupportedFc4Types",
        "Pentium(R) III",
        "TR_UTIL",
        "Sets the maximum age of an entry in the data cache.",
        "Win32Registry|Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards|DriverDate",
        "**typedef** The type of portal (Initiator or Target) ",
        "WMI_TAPE_PROBLEM_WARNING_GUID",
        "Restore Type",
        "object:MSFT_SmbShareAccessControlEntry",
        "object:MSFT_FileServer",
        "NetAdapterCimNDISWMI",
        "CIM_DisketteDrive",
        "PageCode",
        "IR_A149399DE5D286F444C4B111636DFBC68048E4FDC5152AA24ED98EA642F0ABAF",
        "The maximum data payload size supported for command or data PDUs within this session.",
        "CreateTrustedDomainEx",
        "Returns True if the product is identified as an add-on license.",
        "HNet_ConnectionProperties",
        "ISCSI_ERR_INVALID_CHAP_RESPONSE",
        "Teredo global settings associated with this interface",
        "Deferred (8) indicates that the element might be completing commands, but will queue any new requests. ",
        "ProcessorNumber",
        "CD_D5B792B23BC4AFF33F84619861154DB6F0B75D6C62833CE80A0CA636DA5E664B.0.2396170707.88",
        "LocalMachineZoneAllowAccessToDataSources",
        "TokenActivationCertificateThumbprint",
        "Specifies whether NCA service operates in passive mode.",
        "A PolicyRule may also be associated with one or more policy time periods, indicating the schedule according to which the policy rule is active and inactive. In this case it is the PolicySetValidityPeriod aggregation that provides this linkage. ",
        "ref:Win32_TerminalServiceSetting",
        "AllowLinguisticDataCollection",
        "Frequency_PerfTime",
        "10GBase-ER",
        "3D Accelerator",
        "Don't require",
        "Win32_ComputerSystem",
        "DebuggerEnabled",
        "             the corruption in order to use this profile again.",
        "String array of description of available physical Network Adapters",
        "Stuff Flag",
        "FastReconnect",
        "Number of stop bits to be transmitted.",
        "I_A963FF6A8458E9C4FEA354824C031F4237B8648981577F19FD6854C86994DA8C.1499.2362602321.331",
        "CIM_AggregateRedundancyComponent",
        "Product Name",
        "Provider can manage remote target group",
        "Cannot clear with data partitions present. To clear data partitions, use the RemoveData flag.",
        "Allows or Denies new TS Connections.",
        "SMBIOS|Type 7|Error Correction Type",
        "CD_697DA7CFBF1A5367B42159FA584B6D6C58403D44C1543977ACD7BED9F2898E8B.1172.4166405448.226",
        "Ways of performing persistent binding",
        "The Version property indicates the operating system version that the driver is intended for.",
        "MSFT_CliAlias.FriendlyName=\"Partition\"",
        "LockedDownLocalMachineZoneAllowSmartScreenIE",
        "ServiceType",
        "SkipIfPassed",
        "ContentServerConfiguration",
        "AliasAddresses",
        "CR_FBFFFF984DA9B7029EE7078D02385B8FF23DEF8E12B59491A9BDEA2549806FA0",
        "MIF.DMTF|Partition|002.4",
        "SamChangePwdComputer_Start",
        "The RevisionLevel property indicates the firmware revision level of the Win32 CD-ROM drive.",
        "EVENT_TRACE_FLAG_I",
        "Adapter WWN",
        "CD_006AB7DFED58A8FB352581D21227922FA9FD887AC08F63A547BAEA9722B5F62B.94.622034228.810",
        "Win32_SecuritySettingAuditing",
        "Specifies the allocation unit size to use when creating the virtual disk.",
        "ListenIPAddress",
        "Key Values",
        "The account name used to start this service.",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_BCA765E446D9097DBEA6C9E4DFDE858DC64A1737FEE09A95AB480242FE45EE0645",
        "Processor throttle states (T-states)",
        "Select * from Win32_BootConfiguration",
        "OneXEAPType",
        "The new slot provided by the adapter board.",
        "Example: J202",
        "L'm;L'm;",
        "MaxBatteryError",
        "Example: 1997",
        "MinimumSmbLatencyInMilliseconds",
        "MsftDiscFormat2StreamRandom_DebugDestructor Flag",
        "MDM_Policy_Config01_InternetExplorer02",
        "A string describing how or why the system is dedicated when the Dedicated array includes the value 2, \"Other\".",
        "Id that is globally unique for all instances of iSCSI initiators.",
        "RestrictActiveXInstallInternetExplorerProcesses",
        "Priority indicates the urgency or importance of execution of a job.",
        "ThirdPartyVpnConnection",
        "DeleteTempFolders",
        "This field indicates which storage pool should be used to hold the created snapshot. If this field is not set, this method will default to using the same storage pool that contains the source virtual disk.",
        "Values: 1 (true) or 0 (false). If true, hardware data compression is enabled.",
        "{A608750F-F8C9-4089-97E6-F8E32976A0D4}",
        "C_8D031DD0CB1D97D890A5740097E55E48F1625CDB53BFD253DBA62D3E95BCF78C",
        "Defrag engine error",
        "Friendly Name of Remote VPN Server.",
        "{D7931411-0376-4869-A491-8D679BFC004A}",
        "ODBCBCP",
        "MaximumVersion",
        "EVENT_TRACE_FLAG_POWER",
        "Budget Enabled",
        "MDM_PassportForWork_Remote03",
        "Sealed-Case PC",
        "POINTER_PORT_WMI_STD_SERIAL",
        "The username and password the client will use to authenticate itself to the service.",
        "RD_TRACE_RESERVED_15 Flag",
        "nettcpip",
        "RedirectionPath",
        "Network Query Open",
        "local|hkey_local_Machine\\software\\microsoft\\windows nt\\currentversion\\systemrestore|RPLifeInterval",
        "WMI|Win32_DiskDrive",
        "Win32_PrinterDriverDll",
        "ErrorSource",
        "ac6d1",
        "SMBIOS|Type 16|Extended Maximum Capacity",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\CrashControl|KernelDumpOnly",
        "WriteTotalUncorrectedErrors",
        "MsiSupported",
        "FunctionDetail",
        "TEST_TRACE_RESERVED_1a Flag",
        "The vendor",
        "The ICMMethod (Image Color Matching Method) property specifies how ICM is handled. ",
        "SetDisk",
        "SystemConfig",
        "A string that can be invoked on a system command line.",
        "This property gets/sets the device encryption policy to require",
        "HostNames are semi-unique (scoped to the owning storage subsystem),human-readable strings used to identify a file server. There is a separate host name element per file sharing protocol. It is valid to specify the same name for different protocols.",
        "ref:DS_LDAP_Root_Class",
        "R_99526796DD78031C7C2FAD6BF8D8F64825A2F3F58DED87A8E35BA27BB08D1659",
        "UnlockWithNumericalPassword",
        "HBA_WWNTYPE",
        "SERIAL_WMI_STOP_2",
        "Disables restore point.",
        "Seconds spent ready to stream, but unused. (*1E-7)",
        "Creates hashes for web content",
        "Guest",
        "QmSaId",
        "MSFT_NetConSecRule",
        "5 - 'Preparing': preparation-in-progress. ",
        "ADB (Apple Desktop Bus)",
        "FilterExempt",
        "FreeSpace",
        "The grouping or 'bag' object that represents the Collection.",
        "CR_9C46A759D30423AAF4F69D77D418152E94C7E20506D0B665994363777B2CCBC6",
        "CIM_BIOSElement represents the low-level software that is loaded into non-volatile storage and used to bring up and configure a computer system.",
        "0x004 ",
        "TransactionIdentifier",
        "StopByObject",
        "\\\\.\\ROOT\\CIMV2:__Win32Provider.Name=\"UserProfileConfigurationProvider\"",
        "ref:Win32_PowerPlan",
        "LowerLayerInterfaceIndices",
        "CD_3A281986D2DC73E5FFAF5C10E516D033611D0B81732C1211B5A9AB1B8BCF2D1D.1741.3218303423.610",
        "Create, enumerate, and delete registry keys ",
        "The Win32_ClassicCOMApplicationClasses class represents an association between a DCOM application and a COM component grouped under it.",
        "ProcessorAffinity",
        "AddressWidth",
        "If Usage is set to 1 - 'Other', this field contains the string representation of the vendor defined usage for the storage pool. This property must be NULL if Usage is not set to 1 - 'Other'.",
        "GROUPING",
        "Select * from Win32_VoltageProbe",
        "6 - 'Copy-On-Write': Affected data is copied on the first write to the source or to the target elements. ",
        "Win32API|Device Input and Output Structures|DISK_GEOMETRY|TracksPerCylinder",
        "The size of this extent in bytes.",
        "customDialDll",
        "R_45999BE1E716B224CDC60BBAEC2E4A9422A7548870411AB5310F9D9DCF7A8F92",
        "ClientViaBehavior",
        "HRRundown",
        "MDM_AppLocker_ApplicationLaunchRestrictions01_EXE03",
        "The Win32_COMClass class represents the properties of a Component Object Model (COM) component.",
        "Supplies the system defined ID of the wake pattern",
        "This parameter denotes the maximum supported size that a tier created in this pool can be.",
        "CIM_Statistics",
        "IsReady",
        "The SettableBaudRate property indicates whether the baud rate can be changed for this serial port.",
        "This field describes the minimum number of light parities that can be formed for parity-based resiliency settings. If the resiliency setting is not parity-based, this field will be set to 1.",
        "The data type the printer will use to record print jobs.",
        "Maximum Baud Rate",
        "EVENT_TRACE_FLAG_M",
        "FullyEncrypted",
        "LookupSids",
        "RDComplete",
        "{6381C27F-C8FA-4da7-8953-B86833736E15}",
        "IL_2E31AC6CC351BCC9BFA78493D8B97E49D4E7FFA3928279503F92FE6E22F6067E.2689.2236458503.276",
        " A Win32 service that shares a process.",
        "FullScanAge",
        "SecondLevelAddressTranslationExtensions",
        "IPv6NonIPsecExtensionHeadersEnabled",
        "The TcpWindowSize property contains the maximum TCP Receive  Window size offered by the system. The Receive Window specifies the number of bytes a sender may transmit without receiving an acknowledgment. In general, larger receiving windows will improve performance over high delay and high bandwidth networks. For efficiency, the receiving window should be an even multiple of the TCP Maximum Segment Size (MSS). Default: Four times the maximum TCP data size or an even multiple of TCP data size rounded up to the nearest multiple of 8192. Ethernet networks default to 8760. Valid Range: 0 - 65535.",
        "SharedSecret",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_8306F1354864AE1F5B32872474B76EB97820FBB1C9EEF8B036946CB0ED5E531E11d757E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "RemotingDebug Flag",
        "ACKFailureCount",
        "Fixed address of primary RADIUS server",
        "CIMWin32a",
        "This indicates whether Federal Information Processing Standards (FIPS) mode is enabled.",
        "Blocked",
        "The LargeSystemCache property indicates whether to optimize memory for applications (value=0) or for system performance (value=1).",
        "Configuration settings for DNS64",
        "Specifies a description of the share. This field can be used to store extra free-form information, such as notes or details about the intended usage.",
        "Number Of Transports",
        "VerticalPolarityType",
        "ifHCInOctets",
        "ExposedRemotely",
        "7..32767",
        "SPACES_StorageSite",
        "NDIS FDDI Frames Lost",
        "TokenActivationILVID",
        "ref:MSFT_iSCSITarget",
        "The value for WriteCacheSize is outside of the supported range of values.",
        "This method converts a __SecurityDescriptor instance to a binary blob security descriptor format.",
        "WorkOffline",
        "TransmitLinkSpeed",
        "A user-friendly string representing the name of the storage pool. Friendly name can be set using the SetFriendlyName method.",
        "CR_7BC06DFC2CCE54A0D578DEA59EBB1A8ADB06CF1508741E02D2DCC0BB4C755E69",
        "CIM_ApplicationSystem",
        "The previous self-test completed having the electrical element of the test failed.",
        "Performance information for serial port",
        "querysecurity",
        "MSSerial_CommInfo",
        "OfflineReason",
        "NumActiveNonDefaultVPortVlanIds",
        "Association between StorageSubSystem and MaskingSet",
        "Remote Source Route Bridging",
        "C_52D2D582CC450E6D07EBF7F5FA5E6D36BE955E5652346A68534B9BBF05E2BB4B",
        "IdleHandler context present",
        "DOGroupIdSource",
        "RemoveCertBinding",
        "WSP_ReplicationCapabilities",
        "The user who submitted this job.",
        "CallbackDataPtr",
        "Notify App Changes",
        "Shortcut",
        "DVD Recordable",
        "Creates a new listener stack based on the unique combination of Listern Name and NIC.",
        "The BlindOn property contains the command string used to dial whether or not there is a dial tone.",
        "CD_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D.2049.1.11765",
        "CD_857A93520BEDC9F703DB461D5CC8192FB10A25C77E5665D06DE039388F19CB72.2137.1.11416",
        "MGR_TRACE_RESERVED_14",
        "The Primary property determines whether this is the primary operating system.",
        "A choice between File and Directory. The default value is File.",
        "The Desired state for the COmputerSystem.",
        "VDI collection name for current computer",
        "PCI Component Information - Bus Number",
        "Reset IP-HTTPs configuration",
        "CD_87C10E264E287342D3206BEE44C1E60CA6C7D6B38EBABA03EFD1FEBF2C09580E.2483.1234155087.4750",
        "Security: NTLM Authentication",
        "Specifies the Ipv6 addresses of the endpoints of the IPsec tunnels that enable DirectAccess.",
        "A2286E",
        "TransactionEnd",
        "2 for 32 ",
        "NDIS Status Task Offload Change",
        "ConfiguredClockSpeed",
        "The FJoinOptions parameter contains a set of bit flags defining the join options. This parameter can be one or more of the following values: /nJoin Domain -  Joins the computer to a domain. If this value is not specified, joins the computer to a workgroup.",
        "CD_3FDA482EEA11D105F777BB4C0E86194FDFA63901845D94A245BC2172A88E5638.1638.2415188411.3918",
        "IEEE 802.11",
        "Third Party Privacy Type",
        "{91c3c007-185d-4d78-a751-bfcb31c2c64d}",
        "TargetPortals",
        "Configure extended cloud check. Valid values 0-50 seconds.",
        "41021",
        "UnsupportedQueries",
        "MSFT_CliAlias.FriendlyName=\"NTEvent\"",
        "TRUE if adapter should use RADIUS for CHAP authentication",
        "CIM_ErrorCountersForDevice",
        "This enables all configuration traces",
        "The name of the server that the printer port will be added to.",
        "The interface for the network adapter is provided by a hardware device.",
        "Off-line data collection activity was completed without error",
        "Returns single policy setting for Predictive Failure Analysis",
        "NumericSensorHealthState",
        "WinstationDesktop",
        "IPV6 flow information",
        "The ProviderOperation_CreateClassEnumAsync property indicates the number of calls to IWbemServices :: CreateClassEnumAsync.",
        "RTSFailureCount",
        "The StandardSecond property specifies the second of the StandardMinute when the transition from daylight savings time to standard time occurs on this operating system./nExample: 59",
        "The name of the network adapter driver.",
        "CD_84ED32E7ED04F469B11E1DF74E7E118AFE5E1CC1C17891C6425CB1D7BE20096D.293.3384264536.622",
        "UnitsOfCheckData",
        "The evaluation period for the iSCSI initiator service has expired.",
        "Type of cache operation that caused the machine check",
        "Win32API|System Structures|RESOURCE_DESCRIPTOR|InterfaceType",
        "Ribbon Cable",
        "Describes a BranchCache secondary cache",
        "Specifies the address of the last memory error. The type of error is described by the ErrorInfo property. If the ErrorInfo property is equal to 3, \"OK\", then this property has no meaning.",
        "CD_EC5C4DC0FE89185F526B955C798149CABA4B33211BEF571147AFFE5014EB1AA6.1740.3886288786.475",
        "RestoreByTemplateId",
        "Prefetch",
        "{b41d7bdf-4249-4651-ac0f-1879be0d5c0c}",
        "LastQuickScanDateTimeStart",
        "MSPower_DeviceEnable",
        "Filters traffic based on which Windows service it is sent or received by.",
        "MDM_Policy_Result01_LanmanWorkstation02",
        "The localized name of this rule.  This field's value is based on the value of ElementName.  Changes to this field are ignored.",
        "MSNdis_QueryReceiveFilterGlobalParameters",
        "RelatedStats",
        "Pool Nonpaged Bytes",
        "GetFC3MgmtInfo",
        "RSOP_IEConnectionSettingsLink",
        "0x0800",
        "I_E14960055650ADAC2C06C29022467C3EF58831F50C9AFF42B1D1C7B072FAC7F1.668.1.53493",
        "Fractured",
        "Parity Error Count",
        "Handedness",
        "CoNDIS Vendor Description",
        "tm_isdst",
        "MSFT_NetBadServiceState",
        "The AdditionalErrorData property contains additional error information. An example is ECC Syndrome, or the return of the check bits if a CRC-based ErrorMethodology is used. In the latter case, if a single bit error is recognized and the CRC algorithm is known, it is possible to determine the exact bit that failed. This type of data (ECC Syndrome, Check Bit, Parity Bit data, or other vendor-supplied information) is included in this field. This property is used only when the ErrorInfo property is not equal to 3.",
        "Hibernate",
        "milliamps",
        "The Setting reference represents the desktop settings that serve to customize a specific user account desktop.",
        "MDM_Win32CompatibilityAppraiser_UtcConfigurationDiagnosis02",
        "\\\\.\\root\\Microsoft\\Windows\\SmbWitness:__Win32Provider.Name=\"SmbWitnessWmiv2provider\"",
        "Access to the aliases available on the local system",
        "{0B4CD745-723E-4D23-B898-47BECD7F0DEF}",
        "NumQueuePairsForNonDefaultVPorts",
        "AllowSuggestedAppsInWindowsInkWorkspace",
        "MtpOp",
        "ExplicitCredentials",
        "SeparatorPageFile",
        "ReceiveQueueInfoArray",
        "C_6ED1CC69327A33D759019C559267CFDE48C858749D7A22192B7DE8573CFC19A6",
        "NetworkAdapterMacAddress",
        "GetSecurityDescriptor",
        "DnsConfig",
        "The StartTime property represents the time at which the session started.",
        "CIM_ReferencedProfile",
        "SMBIOS|Type 0|System BIOS Minor Release",
        "// specific LUN.",
        "R_6745FD83171C912384932B2460F0A939D3A35DD708158F930D2B33D61C719953",
        "UPNNameHints",
        "CIM_MemoryWithMedia indicates that memory is associated with a physical media and its cartridge. The memory provides media identification and also stores user-specific data. ",
        "ProductCodeID",
        "Receive Window Scale",
        "ref:Win32_PowerMeter",
        "Untrusted",
        "WMI|Win32_SerialPortConfiguration",
        "RegisterThisConnectionsAddress",
        "CR_26F2DFA12DD4E238DF19BAA4547B3B8EF9BC62B9AB940056F71629B35FA95FCC",
        "CIM_FileSystem",
        "C_8A4CE91E2CD3F00CCBC42B48A0F1A77FDADBC577D201010EEF9328E68E880837",
        "Win32API|Network Management Structures|USER_MODALS_INFO_0|usrmod0_max_passwd_age",
        "CR_E284DDF7F9BBC191C804CE3AADDF197ECFC83C10E016C1AED712528DDDFB1F1C",
        "PCI_BUS_REQUESTOR_ID is valid",
        "When the redirection policy is removed, the folder's content will be moved to the local profileIf true, the folder will be moved back to the local user profile location when policy is removed.If false, the folder will remain in the redirected location after the redirection policy is removed.",
        "\"Minor Failure\" (15) - All functionality is available but some might be degraded. ",
        "{3d6fa8d3-fe05-11d0-9dda-00c04fd7ba7c}",
        "Accessibility Flag",
        "MaxSupportedProtocolVersion",
        "IANA Reserved",
        "Collate",
        "{6e2d8b73-f928-4da9-bda1-ae54189a3825}",
        "CI_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB",
        "CD_410A7F9BCBF68F143E8FFFBF91BEB08109AC58714E0E02572A1BE71E6EE2A05C.71.797393471.1122",
        "This represents an integer element. Note that although Integer is a 64bit number, it must be passed as a string since Automation has no native 64bit type.",
        "Closest Processor",
        "The SetQWORDValue method sets the data value for a named value whose data type is REG_QWORD. ",
        "If the operation that this storage job was tracking has failed, the provider will set this with an error code defined by the method that invoked the operation. If this job tracked a background task, the error code can be set to any valid Storage Management error code as defined in the value map below. If there was no error, this property must be set to 0 - 'Success'. This property should be NULL until the operation has completed.",
        "MGR_TRACE_RESERVED_0c Flag",
        "DCStart",
        "{B48D49A1-E777-11d0-A50C-00A0C9062910}",
        "Humidity Unacceptable",
        "Service Machine",
        "_DH_WMP_DEVICE_CAPS Flag",
        "Per user storage volume quota management.",
        "TimerFlags",
        "10 - CIM_ERR_INVALID_SUPERCLASS. Operation cannot be carried out since the specified superclass does not exist. ",
        "An enumerable object that represents an object in a target subsystem for which there is a replication relationship.",
        "WmiQueryTcpConnectionOffloadCurrentConfig",
        "The CIM_LogicalDevice dependent reference represents the CIM_LogicalDevice connected to the Universal Serial Bus (USB) controller.",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services|LeaseTerminatesTime",
        "Group can be temporary",
        "Unique Connection ID",
        "X.509 Certificates (user as principal)",
        "The AccountOU optionally specifies the pointer to a constant null-terminated character string that contains the RFC 1779 format name of the organizational unit (OU) for the computer account. If you specify this parameter, the string must contain a full path, for example, OU=testOU, DC=domain, DC=Domain,DC=com. Otherwise, this parameter must be NULL. ",
        "Loss Of Scope Action",
        "MSFT_DSCConfigurationOutputWriteMessage",
        "C_1C871A69AE42FDAE2404C626ED2A6EE58970B1ADBD41309118A0347F713B188E",
        "MIF.DMTF|Bus Port|001.9|Maximum Number of Attachments",
        "HardwareMaxLinkRate",
        "ChildInstance",
        "Pending action detections",
        "this one bit flag indicates whether support for the C2 state is restricted to uniprocessor machines",
        "MSFT_CliAlias.FriendlyName=\"MEMCACHE\"",
        "StandardMonth",
        "FullACK",
        "CD_9E6BE90DCA6B96CBA3BF12EFB579708613DA0A405A49EA5E6B87A7FDB2747D9E.1226.3070921010.365",
        "The DefaultDataType property indicates the default data type for this printer driver, (example: EMF).",
        "_SystemSecurity",
        "NdisFddiFramesLost",
        "MIF.DMTF|Temperature Probe|001.18",
        "This represents an unknown element.",
        "RecordData",
        "NS_249921F3CE88C11455C9B24CA21BA6C160824D0FB1957DC288BC7721C86DB55D",
        "Prepare MDL Write",
        "DatabaseDirectory",
        "Name of the application",
        "Indicates that the network adapter supports changing the processor affinity of a queue dynamically and without restarting the queue.",
        "MSFT_MpThreat",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_8D9107E4ECAF109CE6D86793D80E0B566CE8692178AEB151294771B38F8935EA",
        "GridGranularity",
        "The StackBase property indicates the limit of the thread's stack.",
        "Logon Workstation",
        "PfsGroupID",
        "Updates Flag",
        "{74e10cbb-202e-4a97-871d-8547972b5141}",
        "The SpoolEnabled property shows whether spooling is enabled for this printer. ",
        "LetAppsAccessNotifications_ForceAllowTheseApps",
        "UseHelloCertificatesAsSmartCardCertificates",
        "CDDAAccurate indicates the drive accurately reads digital audio.  This ensures the highest quality audio",
        "SnapShot",
        "MSFT_NetEventSession",
        "MSiSCSIInitiator_InitiatorClass",
        "This provides access to the aliases available on the local system",
        "IsAutoUnlockEnabled",
        "Requests that the Device re-establish its configuration, setup and/or state information from a backing store. The intent is to capture this information at an earlier time (via the SaveProperties method), and use it to return a Device to this earlier \"condition\". This method may not be supported by all Devices. The method should return 0 if successful, 1 if the request is not supported, and some other value if any other error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier.",
        "endpoint type",
        "{ED2ED490-DB33-11d2-85FC-0000F8102E5F}",
        "LUAInstall: error 0x00000005 setting flags [{941C53C2-D2D7-4C74-84EA-28F8F6438D4B}]",
        "RewritePartition",
        "Win32_LogicalDiskToPartition",
        "ProviderOperation_CancelQuery",
        "{45FBBDD4-0582-4c5f-9CED-787B1DE35BA9}",
        "MinorDriverVersion",
        "Set to true if the ParallelController supports DMA.",
        "The OnlineDevice method has been deprecated in lieu of the more general RequestStateChange method that directly overlaps with the functionality provided by this method. ",
        "The Win32_UserProfile class contains information about user profiles on a Windows system.",
        "Message Signaled ISR",
        "InteractiveLogon_DoNotDisplayLastSignedIn",
        "The Win32_Volume class represents an area of storage on a hard disk. The class returns local volumes that are formatted, unformatted, mounted or offline. A volume is formatted by using a file system, such as FAT or NTFS, and may have a drive letter assigned to it. A single hard disk can have multiple volumes, and volumes can also span multiple disks.",
        "SupportsVirtualDiskRepair",
        "DialUpState is a string indicating when the default connection should be dialed:0 = never,1 = when a network connection is not present,2 = always.",
        "Whether to enable stateful PPTP.",
        "Name of transport bound",
        "SDBUS_DEBUG_INACTIVITY Flag",
        "The allocation unit size of the volume.",
        "FileOp",
        "SendAuthorizationState",
        "KerbChangePassword",
        "SamEnumUsersInDom_End",
        "{D4950C79-806D-4ECE-9DB1-11B34D33F514}",
        "EIA861A",
        "AcpiGenAddr",
        "SYSTEM_CONTROL",
        "CIM_IPAssignmentSettingData",
        "Correctable",
        "Near Field Recording",
        "StoreInstall",
        "Total number of _PSS States",
        "SamGetMemInAlias",
        "The Profile property specifies a directory path to the user's profile. ",
        "One of specified volumes is not eligible to be a log volume.",
        "Requests that the LogicalDevice be enabled (\"Enabled\" input parameter = TRUE) or disabled (= FALSE). If successful, the Device's StatusInfo/EnabledState properties should reflect the desired state (enabled/disabled). Note that this method's function overlaps with the RequestedState property. RequestedState was added to the model to maintain a record (i.e., a persisted value) of the last state request. Invoking the EnableDevice method should set the RequestedState property appropriately. ",
        "Minimum number of buffers of ETW trace session.",
        "MDM_Policy_User_Result01_ApplicationManagement02",
        "B4-Envelope",
        "Supplies the setting for power management of the adapter. If the property is anything other than Enabled, the remaining property values are undefined.",
        "AppId",
        "C_A963FF6A8458E9C4FEA354824C031F4237B8648981577F19FD6854C86994DA8C",
        "IL_9BCEBFBD099FD1DBA49B8E7BCF49EE9762FC2EFF302F652F7F56BF3EDE25D1FA.74.3024936235.324",
        "Smart Battery supported",
        "Stack25",
        "\\\\.\\root\\interop:Win32_PowerSupplyProfile.InstanceID=\"Power Supply\"",
        "Duplex",
        "AuditDiskModificationOnly",
        "CR_9C6A7E3E087A5B8DA585FF771A2BB4634D1FA2F66F376E9BF7FD6F960807500B",
        "CD_484456E3E724C112AF20813C7339BF5577C8FC1EC72751890A0F458FF4330C9D.1782.3754858147.391",
        "TipInterface",
        "The policy version used in metadata retrieved from the service.",
        "defaultNamingContext",
        "FunctionalitySupported",
        "The KernelModeTime property indicates the raw counter data from the performance counter type ",
        "Specifies a temporary folder to output staging data to",
        "This method will add one or more physical disks for manual allocation.",
        "The size of the largest free space extent on the volume.",
        "LPCDRVR_TRACE_RESERVED_1a Flag",
        "IEEnterpriseModeEnabledURL",
        "SecurityIntelligenceLocation",
        "ref:CIM_CollectionOfMSEs",
        "PerfDetail",
        "FaultTime",
        "Specifies whether a User certificate should be used for authentication.  This parameter is used with EAP-TLS. If it is not set, a smart card is used for authentication.",
        "AddressState",
        "ExternalKey",
        "The product for which compatible offerings are defined.",
        "IoSize",
        "TargetPortalAddress",
        "ConfigureJapaneseIMEVersion",
        "Due Time",
        "This is the binary data of the unknown device element.",
        "Destination Address",
        "No Authentication",
        "PLATFORM_ERROR_TARGET_ID is valid",
        "User that submitted the job.",
        "CIM_PoweredStatisticalData.TotalPowerOnHours",
        "AllowCrossDeviceClipboard",
        "Management of the system driver for a base service.",
        "StringTermination",
        "2 - 'Offline Shared': All newly discovered disks that do not reside on a shared bus are brought online and made read-write.",
        "File Kernel Trace; Operation Set 2",
        "{5ec10366-a61a-11d0-8dd4-00c04fc3358c}",
        "Describes the 6to4 service state. One of the following values: enabled, disabled, default.",
        "CD_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416.291.87104330.624",
        "PC Card",
        "CD_9C52BC59A122CC7517413B34FA6839E69A7AE3C55A75FE6EBEADED4D113D421E.2557.2065512082.676",
        "RestartJobByObject",
        "8CCEA476ACECCD0DB049A6CD.2668.2340397220.283",
        "ref:Win32_SecuritySetting",
        "ifHCOutUcastOctets",
        "InstalledOn",
        "Current signature validation policy.",
        "Win32API|Network Management Structures|USER_INFO_2|UF_PASSWD_NOTREQD",
        "Set or Expire KTIMER2 Event",
        "#ifdef MS_SM_HBA_API",
        "The time interval that the job has been executing or the total execution time if the storage job is complete.",
        "Rename DA site table entry",
        "IsInterlaced",
        "Specifies the latest time at which the printer will print a job, expressed as minutes elapsed since 12:00 AM GMT (Greenwich Mean Time).",
        "In-State",
        "0x80050052",
        "_DH_WMP_SQM",
        "MDM_Policy_Result01_RemoteShell02",
        "I_8B109770B70CC6D7972AE94E395D34EF4AF2D27D834986AE7388EC1225644A3F.1606.1789527066.329",
        "{86E30E86-7DB2-11d2-90CB-0060081A46FD}",
        "CanPool",
        "PdoName",
        "8 bit",
        "HEALTH_INITIALIZED",
        "QueryInfoPolicy2",
        "Ethernet II",
        "SamQuerySecurityObj",
        "object:BcdDeviceData",
        "The Storage Health is not online.",
        "{8502C515-5FBB-11D2-AAC1-006008C78BC7}",
        "Alpha 21064",
        "HostNames",
        "HeightAllowed",
        "\\\\.\\root\\Microsoft\\SecurityClient:Win32_ProviderEx.Name=\"AntimalwareHealthStatusProv\"",
        "Watch Subtree",
        "Supports Removeable Media",
        "The cluster size must be a multiple of the disk's physical sector size",
        "__NamespaceOperationEvent",
        "Additional actions required to complete remediation - Enumeration",
        "Features supported by the underlying driver, which could be emulating Ethernet.",
        "0xC0000024",
        "The Win32_NetworkAdapterSetting class represents an association between a network adapter and its configuration settings.",
        "The total number of packets for which the Security Parameters Index (SPI) was incorrect.",
        "Power Setting Data",
        "FOUR_GB",
        "MDM_Policy_Result01_Printers02",
        "The full path of applications for the BidTrace configuration (when Mode == 1), or the full path of application folder for the BidTrace configuration (when Mode==2). This is ignored for Mode == 3.",
        "Number of times this state has been entered",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|Backup Interval Threshold",
        "Client refresh interval (in seconds).",
        "wsopt",
        "The PartComponent reference represents the Win32_Directory that contains the subdirectory (subfolder) part of the association.",
        "The GetSecurityDescriptor method returns the specified key's security descriptor in a __SecurityDescriptor. The method returns a uint32 which is 0 if successful or some other value if any other error occurred.",
        "0xC0000006",
        "{c55e606b-334a-488b-b907-384abaa97b04}",
        "The CIM_ProductParentChild association defines a parent child hierarchy among products.  For example, a product may come bundled with other products. ",
        "RequestedUrgency",
        "The CIM_ToDirectorySpecification association identifies the target  directory for the file action. When this association is used,  the assumption is that the target directory already existed.   This association cannot exist with a CIM_ToDirectoryAction association since a file action can only involve a  single target directory.",
        "Maximum time to desynchronize temporary address preferred lifetimes. The default value is 10 minutes.",
        "0xC0050053",
        "Upgradeable Applications",
        "BaseIOAddress",
        "ROOT\\wmi",
        "PolicySourceEnableRemoteDesktopMSI",
        "gement.",
        "SAM Set Information Alias",
        "Read Log Sectors",
        "IDE Controller management.  ",
        "RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls",
        "CleanFailed",
        "C_55EDCCF4E5A9ABD76428DEC07ABF127ABAF79D731BF9177B4B1A7951CA86E45C",
        "AllowPersistence",
        "SERIAL_WMI_STOP_1_5",
        "The Enable-AppBackgroundTaskDiagnosticLog cmdlet allows users with Administrator access to enable background task related logging in Event Viewer.",
        "{93cfcd3f-6228-455c-905e-3ab80a2ff090}",
        "{FAF76B95-798C-11D2-AAD1-006008C78BC7}",
        "Debug_Process",
        "OP_PolmkrFolderOptionSetting",
        "MT Flag",
        "MaxMediaSize",
        "The availability and status of the device.  ",
        "FX_TRACE_RESERVED_17 Flag",
        "This is the file path of the store that this element is a part of.",
        "68530BF42F687579F4795E6FAE9D6D60CF7B02015DD6EAA0272.2642.837909254.263",
        "MDM_Policy_Config01_WindowsLogon02",
        "MDM_DeviceStatus_Compliance01",
        "You must specify an access right",
        "Interdomain Trust Account",
        "Unable to notify service",
        "Indicates the power supply's input frequency range measured by the associated sensor. Range 1, 2 or both can be specified using the values 2, 3 or 4, respectively.",
        "dnsclientcim",
        "NS_127B451CD685BF0DE131A6787BF6B66926311BF5D825DC0E69AA8DC3B4ADCAC1\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_F58EA9A4248FB79DDBF112DB65B98127C9A78FF4DF9FC34835E8B50C808C985B",
        "A managed system element acting as a spare and participating in the spare group.",
        "S-1-5-4",
        "BAUD_9600",
        "The Win32_Account class contains information about user accounts and group accounts known to the Win32 system. User or group names recognized by a Windows NT domain are descendents (or members) of this class. The Win32_Account class is not included in a default hardware inventory operation.",
        "Windows PowerShell scripts will run first",
        "EnableApp",
        "FileSharingProtocols",
        "object:MSFT_TaskMaintenanceSettings",
        "TransportMachinesEmpty",
        "SM_GetBindingSupport",
        "LogSizeInBytes",
        "C_B159926F0CC27D6492317BDFB79C85235741AEFF3D5B427CD61D2FFD2C6EA2BB",
        "Service From Top",
        "LetAppsActivateWithVoice",
        "This parameter is the context that the provider will use when creating the shadow copy.",
        "C_F3FE9F8C3A3CF33804F815B29E77D41E1175AE360C63A072F4404033FF71E150",
        "AllowStorageSenseTemporaryFilesCleanup",
        "MIF.DMTF|Electrical Current Probe|001.11",
        "Serial Port XT/AT Compatible",
        "FX_TRACE_RESERVED_14 Flag",
        "Managed Element",
        "UseEct0",
        "The text of the event as it appears in the event log",
        "MSFT_SmbWitnessClient",
        "DSwitchEnd",
        "The NumForwardPackets property indicates the number of IP packet headers allocated for the router packet queue. When all headers are in use, the router will begin to discard packets from the queue at random. This value should be at least as large as the ForwardBufferMemory value divided by the maximum IP data size of the networks connected to the router. It should be no larger than the ForwardBufferMemory value divided by 256, since at least 256 bytes of forward buffer memory are used for each packet. The optimal number of forward packets for a given ForwardBufferMemory size depends on the type of traffic carried on the network. It will lie somewhere between these two values. If the router is not enabled, this parameter is ignored and no headers are allocated. Default: 50, Valid Range: 1 - 0xFFFFFFFE.",
        "SMBIOS|Type 3|Security Status",
        "Password for iSCSI authentication",
        "EventSource",
        "C_61AD70324F8E2B3494420EEDDA5029E5D1AF2B0083C1CC1767F12EF889E146D1",
        "CD_3D10A0A77CAA5B54D6D0F826577C9C9001B09013C6D023D93A420AB24027FBBB.1177.4260128444.2397",
        "SetDeadGWDetect",
        "Capabilities and management of the SCSI controller, logical device.",
        "File Directory Searches",
        "WD_LOG_FLAG_INTERFACE",
        "The version of the hosted cache server",
        "ReferralPolicy",
        "7      Cannot filter. ",
        "MSFT_CliAlias.FriendlyName=\"NTEventLog\"",
        "C_27BD06140C1A1F8932E87156F8647090C9F195504BF06BA40A70C3770B3F31D8",
        "CD_E6041D969E0A83C6273254AECEEFB2E2E4BA3E5ADE2661BB572D7A354A85D2B6.1584.326815355.631",
        "CD_9E927C42162CFFA3624D55690B21114853C375D15511354B30627B7E45D7DB02.2308.3223051555.802",
        "Are separate syncs supported",
        "Machine Flag",
        "   ISCSI_DIGEST_TYPE_NONE = 0,",
        "Ready Thread Event",
        "CD_B1B3F51451050560540508AE61C59186CBB46746C5DF2B2C8763635DE336A9D9.2155.2579431692.3189",
        "2147483651",
        "WPD_TRACE_LEVEL_CRITICAL Flag",
        "ReplicaType",
        "Login Accept Responses",
        "A text string set by the manufacturer describing the model of adapter",
        "Registration",
        "WIN3x",
        "The Timeout property indicates the Timeout value in milliseconds. If a response is not received in this time no response  will be assumed. The default is 4000 milliseconds.",
        "SettingID",
        "UniqueId",
        "Win32_ClassicCOMClassSettings",
        "DurableServiceAttribute",
        "CD_AA0B4A55EEE4C1E476A0BDD0D3A0653497872B02CC12BE52258AE7DCEF46F38E.2033.3103682518.241",
        "The initial threat detection time",
        "ref:Win32_QuotaSetting",
        "Set_BCCacheByCache",
        "WNFCallback",
        "IL_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.281.3674678782.266",
        "ConfigureSystemGuardLaunch",
        "C_CDB424FE67340CCC2621376F2156DC346548CA8F3622EA235EAF7BC515A8CBC2",
        "CIM|CIM_USBController",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|Repository Directory",
        "CIM_SystemSpecificCollection",
        "{4a800b8c-2068-11d4-97eb-00c04f79c403}",
        "NS_FAD236DC88D4A39D9B808B598227AC32F45800A0F09FB4E10AAE80BE63A63AD1\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258744a71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "Target Port",
        "{8502C58B-5FBB-11D2-AAC1-006008C78BC7}",
        "MIF.DMTF|DMA|001.2",
        "NetworkAdapterIP",
        "CD_50478FEF0FA679E50347C8BAB55834F418A1E60E2411E2B1CF088F78A1275598.1193.3243271486.612",
        "LocateExDevice",
        "The Msft_WmiProvider_ComServerLoadOperationFailureEvent event class defines the unsuccessful activation of a com server instanceassociated with the provider registration.",
        "EVENT_TRACE_FLAG_FILE_IO",
        "Software Error",
        "The MonitorManufacturer property indicates the name of the manufacturer of the display device.",
        "WakeDropExecution",
        "//  NOTE: This file contains information that is based upon:",
        "IMAPI2 Track-at-Once CD Writer",
        "Minimum",
        "MSStorageDriver_FailurePredictData",
        "PaperSize",
        "EnhancedStorageDevices",
        "MIF.DMTF|Operational State|003.7",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"NamedJobObjectProv\"",
        "{8502C57A-5FBB-11D2-AAC1-006008C78BC7}",
        "Quotas Rebuilding",
        "WD_LOG_FLAG_ASSERT Flag",
        "_DH_WMP_LISL Flag",
        "0xD01B",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.1940.3407612383.3773",
        "SupportsCallback",
        "Bid2Etw_SQLSRV32_1_Trace",
        "ConfigurationItemProvider",
        "This field describes the desired number of bytes that will form a strip in common striping-based resiliency settings. The strip is defined as the size of the portion of a stripe that lies on one physical disk. Thus, Interleave * NumberOfColumns will yield the total size of one stripe.",
        " An association between a service and how it is implemented in software.  The cardinality of this association is many-to-many.  A service may be  provided by more than one software feature, operating in conjunction.   And, any software Feature may provide more than one service.  When  multiple software features are associated with a single service, it is  assumed that these elements operate in conjunction to provide the  service.  If different implementations of a service exist, each of  these implementations would result in individual instantiations of the  service object.  These individual instantiations would then have  associations to the unique implementations. ",
        "{F198A89A-5042-4294-ADF1-CB163E549798}",
        "SCSI SCA-I (80 pins)",
        "Parameter Problem",
        "PartitionNumber",
        "Dialect",
        "NamedValuesList",
        "Windows Notification Facility Callback",
        "OutDated",
        "HeapAffinitySlotChanged",
        "FX_TRACE_RESERVED_16",
        "10 - 'Stopped' and 14 - 'Aborted' are similar, although the former implies a clean and orderly stop, while the latter implies an abrupt stop where the state and configuration of the subsystem might need to be updated. ",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_D60AF79B9589ED18D416653DADBFA1520AD2BE7E2AAEFAD60E13B3048C5B4F73",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|SpeakerModeOff",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TERMINAL_Prov\"",
        "The name of the process involved",
        "C_B977125944CA8326977A414325742B1EF12C40157E5C5D20B7B02407CD6122F8",
        "C_F8EF7CD33C3F2510D1C17CE3538977B71D5AF70C10D3ABB08287498FE3E23A15",
        "18 - CIM_ERR_UNEXPECTED_RESPONSE. The returned response to the asynchronous operation was not expected. ",
        "AllowEnhancedSuggestionsInAddressBar",
        "The DebugFilePath property indicates the path to the debug file. A debug file is created with the memory state of the machine after a machine failure.",
        "Base schema for all native configuration providers.",
        "PolicySourceUserAuthenticationRequired indicates whether the property UserAuthenticationRequired is configured by Server (0),Group Policy (1), Default (2).",
        "EVENT_TRACE_FLAG_U",
        "MWClose performance counter missing",
        "object:ProcessorAcpiTssState",
        "R_6EA54EB6200DEACD9472C174A208E0EE91D2B991209F364CEE6C8C621CE142BD.1356.2547888708.584",
        "SystemConfig_V3_CPU",
        "LUAInstall: error 0x00000005 setting flags [{C22",
        "{8502C588-5FBB-11D2-AAC1-006008C78BC7}",
        "The Win32_JobObjectStatus class reports error information obtained while attempting any failed operation in the Job Object provider.",
        "C_4D4CE956D39D51456603D4ED1BF7ABAD64E72F02B0D569299B434D13F41AD4C4",
        "UMDF - Lpc Driver Trace",
        "No_Alignment_Fault_Except - (RISC only) If this flag is set, the operating system automatically fixes memory alignment faults and makes them invisible to the application. It does this for the calling process and any descendant processes.  This flag has no effect on x86 processors.",
        "DEPEND",
        " 32-bit InprocHandler (appearing as the InprocHandler32 value) ",
        "Alternate DNS Server",
        " The collection of address headers attached to this endpoint.",
        "Win32API|Device Input and Output Structures|DRIVE_LAYOUT_INFORMATION|Signature",
        "The PowerFailSignal property determines whether the power supply has a power failure signal.",
        "Example: Microsoft Word - Review.doc",
        "40009",
        "select * from MSFT_StorageModificationEvent",
        "C_3B46459D96BAF6024CC69D0B547D339FA3140A99F61C6D7F2039EDDAAF55977A",
        "DSP0200.DMTF|CIMError|1.3",
        "Inkjet Other",
        "Represents an auth proposal.",
        "If this property is NULL, then no threading model is used. The component is created on the main thread of the client and calls from other threads are marshaled to this thread. Please refer to the Platform Software Development Kit for information on the various threading models.",
        "MDM_Policy_Config01_TimeLanguageSettings02",
        "MCA Non Compliant Error Event",
        "Query TCP Connection Offload Current Configuration",
        "Alpha",
        "This field indicates the total storage pool capacity being consumed by this storage tier. For example: in the case of a 2-way mirrored storage tier of size 1 GB, the footprint on the pool will be approximately 2 GB.",
        "SPN cache Flag",
        "Ndis802_11PowerModeFast_PSP",
        "EndPort",
        "MSFT_PrinterNfcTagTasks",
        "Indicates the set of services that are configured.",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2120.2084505154.188",
        "\\\\.\\ROOT\\CIMV2:__Win32Provider.Name=\"ReliabilityMetricsProvider\"",
        "Controls whether the computer's folder redirection feature settings are configured by using UST Manageability WMI classes or by using Group Policy.",
        "LetAppsAccessCalendar",
        "MSFT_TaskPrincipal",
        "{7510bb9d-df70-4f7e-ba07-e29d330b3cc5}",
        "The Win32_CurrentProbe class represents the properties of a current monitoring sensor (ammeter).",
        "ResponseBufferCount",
        "CountryCode",
        "The CurrentSize property indicates the current physical size of the Win32 registry.",
        "Select * from Win32_SystemSlot",
        "Relates an IPsec rule to its Quick Mode crypto set.",
        "NumberOfProcessorCores",
        "MDM_Policy_User_Result01_Experience02",
        "The SystemDrive property contains the letter of the disk drive that the operating system resides on./nExample: C:",
        "ReArmWindows",
        "2 - 'Manual-Select': This physical disk should only be used if manually selected by an administrator at the time of virtual disk creation. A manual-select disk is selected using the PhysicalDisksToUse parameter to CreateVirtualDisk. ",
        "A value that specifies the number of security negotiations that can be active concurrently.",
        "The NoFragmentation property sets a 'Don't Fragment' on packets sent.  The default is False, not fragmented.",
        "A string representation of the disk's model.",
        "Heap Subsegment Changed Affinity",
        "This is the boolean value of the element.",
        "LPCDRVR_TRACE_RESERVED_06 Flag",
        "ProductType",
        "Warmup",
        "Specifies whether the user is always prompted for Password while logging on to the server.",
        "GUID ID which uniquely identifies this keyword.",
        "setsecurity",
        "GetSupportedGroupCopyStates",
        "__PropertyProviderCacheControl",
        "SevereThreatDefaultAction",
        "Accounts_EnableAdministratorAccountStatus",
        "C_E7ACEB5389BA8C32B04736209B872B130DCE3B94FF3A17F3972AEE3EFE29C3CE",
        "UpdateScanMethod",
        "{AEECF151-D0EA-11d2-ABFC-00805F538618}",
        "TakeOwnerShip",
        "CIM_SCSIInterface",
        "MSI is enabled.",
        "BypassTunnelIfEncrypted",
        "EnumTrustedDoms_End",
        "{880217b8-899d-11d2-819e-0000f875a064}",
        "hasValue",
        "The Win32_BaseBoard class represents a base board (also known as a motherboard or system board).",
        "The memory associated with physical media. ",
        "Space-Saving",
        "R_EC346D4B55B7A3D064DA670AC46B8BE53932F3BCFC8908523A9CE445AF651CD8",
        "TracePnP",
        "{90c8f61d-43f3-45cc-8ff0-e719748b3851}",
        "SMBIOS|Type 4|Processor Characteristics",
        "DOT11_CONFIG",
        "NS_5B2CC7EB2AAF010DD5D0084F2DEFC340AFEEECC12F24D870DFC50B8EB7C98139",
        "may be used to interpret: RecordData = \"*This is Friday*2002*20020807141000.000000-300\".",
        " The CRC1 property is the CRC value calculated using the middle  512K bytes.",
        "CD_9B47552D4116308DF54B1B8BABEB3824E2EAF0C2CFA9CF24D51A58C19C8849E8.2462.3213873635.1714",
        "DynamicProcessorAffinityChangeSupported",
        "Note: Classes deriving from RSOP_PolicySetting must redefine 'precedence' as a key",
        "CIM_VideoController.CurrentNumberOfColors",
        "CreateRemoteReplicationCollection",
        "SCSILun",
        "UCR Length",
        "AllowOutboundDestinationUnreachable",
        "{1babefb4-59cb-49e5-9698-fd38ac830a91}",
        "ipsecNFAReference",
        "Disable Error Source",
        "IL_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6.1489.549540612.321",
        "FeaturesHigh",
        "MapFile",
        "MinReadable indicates the smallest value of the measured property that can be read by the NumericSensor.",
        "{acf14036-a61c-11d0-8dd4-00c04fc3358c}",
        "{791ad192-e35c-11d0-9692-00c04fc3358c}",
        "Caution",
        "WUUUUUUUUUUU",
        "Parent class object from which favorites, favorite folders, and links are inherited.",
        "Stack26",
        "Logging Problems",
        "Specifies whether to force tunneling.",
        "MaxNumberUp",
        "Frequency in kHz",
        "MDM_Policy_Config01_FileExplorer02",
        "Instances of the CliQualifier class represent qualifiers that influence the handling of the associatied object. These qualifiers are drawn from the qualifiers on the underlying WMI object and should be handled the same way. For example ValueMap should be treated as a constraint on the values that may used with the Set verb on a property. The MaxLen qualifier should be treated as a constraint on the number of characters that can be provided on a Set.",
        "Scale",
        "MSFT_ReplicationGroup",
        "HBA_EVENT_TARGET_ONLINE",
        "Uint16",
        "RequestLength",
        "The EKU's to accept.",
        "8 - 'Delta-Update': Difference based replication where after the initial copy, only updates to source are copied to target. ",
        "IOControllerOperationalStatus",
        "All data sent between Server and client is protected by encryption based on server's standard key strength.",
        "MaxVerticalImageSize",
        "The MemoryType property indicates the characteristics of the memory resource on the Win32 system.",
        "DevProblem",
        "The StartFileName input parameter is a string representing the child file/directory to use as a starting point for ChangeSecurityPermissionsEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from the previous method call. If this parameter is NULL, the operation is performed on the file ordirectory specified in the ExecMethod call.",
        "select * from CIM_Error",
        "Enables or Disables the Terminal.",
        "{8502C4F2-5FBB-11D2-AAC1-006008C78BC7}",
        "MDM_Policy_Result01_UserRights02",
        "MaxAcceptedChannels",
        "NetAdapterCim",
        "CD_73F9CC8D0A2B5107ED79AE2372D78EAA3B2A7A24FD2BD2876517DA1B42CB16AD.1999.335101033.1360",
        "DaylightMonth",
        "WARNING",
        "CreationTime",
        "C_EC4C381761F3C10114EE1C99ED28B1BA382832F3C228DAE98DF8FBF4193D38BA",
        "MDM_VPNv2_Authentication03",
        "IL_7098BC90F08FB4F9DD6C8351961F1423D74E36F9FFA01C9012DB19053495EECA.1620.2108318268.186",
        "Connect (SYN) retransmit timeout (in milliseconds). default: 3000.",
        "GetSupportedClusterSizes",
        "{8502C525-5FBB-11D2-AAC1-006008C78BC7}",
        "Certificate",
        "This parameter indicates the interval in which the supported sizes increment. For example: If the minimum supported size is 10 GB, and this parameter is 2 GB, then the supported sizes for this pool would be 10 GB, 12 GB, 14 GB, etc. until the maximum supported size is reached.",
        "object:MS_SMHBA_SAS_PHY",
        "TXFRECOVERY Flag",
        "CD_33B0A3C692AD567B6C92E618FD5072156CC98A3BCAA3A93CB3F15A5E87E34AD2.1667.1576782823.353",
        "Most Significant Byte First",
        "object:BindingElement",
        "R_9D477AC3DF7741E8993375CB7B6EC3870626780031363A4F5096C4CACA7F4F5E",
        "TR_EAP",
        "TRACINGFRAMEWORKS Flag",
        "IpV4Address",
        "ValidLifetime",
        "Sbus IEEE 1396-1993 64 bit",
        "The ThreadingModel property specifies the threading model used by in-process COM classes, including:",
        "SYSID 1394",
        "9 - Unavailable Resource Error. Errors of this type are principally associated with the failure to access a required resource. ",
        "TLB access due to load instruction",
        "SMBIOS|Type 8|Internal Reference Designator",
        "GetSynchronizationAspectInstances",
        "CIM_IKEProposal.GroupId",
        "Values are:  \"Reserved\" (0), \"Other\" (1), \"Unknown\" (2), \"Available\" (3), \"In Use\" (4)",
        "SamplingPeriod",
        "The tolerance of the reading.",
        "PFXCertBlob",
        "MSFT_PhysicalExtent",
        "Software Virus Detected",
        "Microsoft.Uev.ManagedAgentWmi, Version=10.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
        "IPv4OptionsSupported",
        "SidTypeAlias - Indicates an alias SID.",
        "AntimalwareHealthStatusProv",
        "IPSecPermitUDPPorts",
        "MSFT_NetFirewallRuleFilterByInterfaceType",
        "The IsSigned property is the signature status of driver that is it represents whether the driver is signed or not",
        "object:MSFT_DASiteTableEntry",
        "C_18F346BD214F217E447A1FFE3109B06E13553A39E553F4F4B66A2D5285DF9EF5",
        "Personal computer architecture DMA.",
        "HyperChannel",
        "C_E367B12CF12DEB20E317AE3B028692F15635A4C17B759C34D4B8D5D615A27793",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.314.1165541664.180",
        "MDM_Policy_Result01_Handwriting02",
        "{23602A8A-DADD-462f-9AE5-30FA2C37DD5B}",
        "Updating firmware",
        "Interfaces that the firewall profile is disabled on.",
        "Is certificate installed",
        "IsFastIO",
        "CD_CE2D741F2F76D8B2DEF2CE5F7AFEC89E6175D7B4F954957AFC4C2CCF01EA7DB4.1538.2187160562.391",
        "ByteMode",
        "CertificateStoreName",
        "C_A96812E0A2895AED486061635646F9CE6BE6E74163A4F9C4D4D988FEA144F286",
        "BiosString",
        "22 - The account, which this service is to run under is either invalid or lacks the permissions to run the service.",
        "EncryptionAvailable",
        "The Setting reference represents the time zone properties tracked by the computer system.",
        "EVENT_TRACE_FLAG_LOCKCONTROL",
        "CopyState",
        "The label by which the CIM_Configuration object is known.",
        "ParentIrp",
        "WSP_StorageHealth",
        "Example: ReadWrite.",
        "A class representing a rule-specific or reusable policy action to be performed if the PolicyConditions for a Policy Rule evaluate to TRUE. Since all operational details of a PolicyAction are provided in subclasses of this object, this class is abstract.",
        "Association between StorageSubSystem and Partition",
        "Dependent represents the object dependent on the Antecedent.",
        "The name of the primary system owner. The system owner is the primary user of the system.",
        "ref:CIM_NonVolatileStorage",
        "MUI Resource Access",
        "CaseSensitive",
        " Hexadecimal ",
        "Properties Flag",
        "IsFIPS",
        "CD_DBC9D7448979766FC3AA5E546B9F7F37A6E0C06BC06D343F27EAFCD412F13D2A.69.2454709768.1673",
        "The MaximumSize property indicates the maximum size of the page file as set by the user.  The operating system will not allow the page file to exceed this limit.  ",
        "// This class exposes the main mode IPSEC statistics",
        "MDM_Policy_Result01_Experience02",
        "olean",
        "sVCl1",
        "Forces the addition of Application ID to the VPN profile.",
        "Int 13h - 3.5\" / 2.88 MB Floppy Services are supported",
        "The IconTitleSize property indicates the icon font size.",
        "SeBackupPrivilege",
        "NS_FE3EA006C3292950A76C2B5A0185D7DF99ADD6FD6502E0AC079E3A8650E76E3A\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_4BD704EFD82E90D58D3C406978C7C044F013A64518E8C54785195D2358D9CFAE",
        "TSClientActiveXControlTrace",
        "Sense Data",
        "PCI Component Information - Class Code Base Class",
        "OS SCSI bus number target is mapped to",
        "ref:MSFT_NetAdapterEncapsulatedPacketTaskOffloadSettingData",
        "The UTC time at which the system stability index value was calculated",
        "ActivityTransfer",
        "CD_39E75790979650C120BE778856591D7E59D2F85DDFBB3BFF1733B73153D5DC01.31.2941113497.474",
        "VpnServerAddress",
        "The Compressed property is a boolean value indicating that the file is compressed.",
        "Parallel Protocol",
        "The Pulse property contains the command string used to instruct the modem to use pulse mode for dialing. Pulse dialing is necessary for phone lines that are unable to handle tone dialing.",
        "systemcontrol",
        "NameSubRundown",
        "60010",
        "MinEncryptionLevel",
        "UnlockHomeButton",
        "CD_EA2A17F7F9011AC9DF174FA64700FA87A332EAD70BB23C4338DE684F34E350D6.74.1457848783.600",
        "C_9EB956FB069691A66CD9E5EA74E107D31AEB904391B2340F9557D3A32B77163F",
        "iScsiFlagSockets Flag",
        "I_614FEB5198DB6356C7D4E70E58F0634936BC6DE530AA5FD952207E56B5A89D3F.1635.3418873694.594",
        "WMI|Win32_SecurityDescriptor",
        "MSFT_WmiThreadPoolThreadCreated",
        "InternetPluginsEnabled",
        "The SetDNSServerSearchOrder method allows for the setting of the server search order as a array of elements. This is an instance dependent method call that applies on a per adapter basis. On Windows 2000 the setting applies to the targeted adapter. On NT4 this setting is global.The method returns an integer value that can be interpretted as follows: ",
        "PCSettingsPasswordSyncEnabled",
        "CD_59A8BCB9F6971B321C776BA9F2959B669CA7F5AE7D9DBEF59E2C6406BCC884D3.2080.1.15746",
        "FirmwareVersion",
        "UF_SERVER_TRUST_ACCOUNT - account is for a system backup domain controller that is a member of this domain. ",
        "UserProfileConfigurationProvider",
        "SamQueryInfoGrp_Start",
        "SystemConfig_V2_Network",
        "MSFT_NetTeredoConfiguration",
        "CD_5D8A70064F693F027290F7573CE6C1A3BB6513B39CC41447AC81334C5DC5B8F9.31.3712247612.840",
        "InitializationFlags",
        "PerUserInitialization",
        "V1IPv4Enabled",
        "The DriverEnabled property indicates whether this load order group can include drivers along with system service",
        "DriverName",
        "C_98233BC0D6E21C2CA3187CB9E2307592DF6D759478E209568F3CA340985F3F72",
        "NumericSensorCurrentReading",
        "Extended Type",
        "CD_81C106E09E02CD8E9F92751CDD19E5532DF222FFFFF38E1A22F4010E1CF8B4EB.292.447962976.5760",
        "C_216DB76437F8B84D04CA1AE8D4A960CE5436A185FD2383065B11CC5178009ADF",
        "MSFT_NetAdapterIPsecOffloadV2ElementSetting",
        "ref:Win32_BootConfiguration",
        "C_30D380391F0C7BBDBEB938061EF85587FF8CAC2EB47D3C2BB31A90F771936E23",
        "MIF.DMTF|Physical Memory Array|001.7",
        "Win32_FontInfoAction",
        "NumberOfCores",
        "Suffix origin of this address.",
        "No Media",
        "MSFT_ResiliencySetting.InterleaveDefault",
        "CD_02B5557CADEF33CFA29F52E782D8C5DEF3C67D29A7C0C3B389FF34D1D0708EC3.123.3021504251.3095",
        "MIPS-based PC",
        "DiagTrackServiceRunning",
        "Value",
        "This is the URL of the corporate website that will be used to perform an active probe against.",
        "Security: TSPkg",
        "The friendly name of the power supply device.",
        "\\\\.\\root\\default:__Win32Provider.Name=\"CommandLineEventConsumer\"",
        "Win32Registry|\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\Windows",
        "BytesFromGroupPeers",
        "The name of this job.",
        "An enumeration that describes the format of the Address property. It is deprecated since it is not needed, as the class contains both IPv4 and v6 addresses).",
        "DaysInterval",
        "Arguments to the script command.",
        "iSCSI Version Mismatch",
        "TaskIndex",
        "Dismount",
        "CR_A340B5A350335A2F698A9D474151FF7803797C56DD9A727636F061641184011B",
        "The FriendlyName string provides the name for the alias. The name will be unique in the context of the namespace in which the alias is defined. Note CLASS, QUERY, PATH and RESTORE cannot be used as alias names as they appear in the same location in the syntax.",
        "SyncSignalType",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_country_code",
        "CR_BC9D109850BB5F86324C40247B677E50BD3CFF55E165C6078CA0EA6516A48293",
        "The DeviceID property contains a identifier (unique to the computer system) for this video controller.",
        "RSOP_PolmkrPowerOptionsSetting",
        "C_244B2D44BCFE4686A8EB1967E3535273855A686C9B62600F3309068E24B5ABB8",
        "MGR_TRACE_RESERVED_17",
        "CR_C098D64978468CA957C3D43E75CFA62233296C00D54DABB8ADE5BEA89B9E0A4E",
        "Title Bar Text",
        "P)m;P)m;",
        "Process_V1",
        "Cluster Size",
        "MSFT_SmbBandwidthLimit",
        "Stand",
        "The volume to be optimized is corrupted.",
        "R_6E765102703260DFD7DCA65DAF6D57F3FFA2712944116AB624D4463AB0EF1F00.1499.950332518.566",
        "User-friendly names of the numeric sensors on the computer system. See CIM_NumericSensor.ElementName for details.",
        " Specifies the per-job memory limit in kilobytes. It is ignored unless the LimitFlags specifies the Limit Job Memory value.",
        "MSFT_DtcTransactionsStatisticsTask",
        "PLATFORM_TRACE_RESERVED_0a",
        "MemoryChip",
        "ParentInstance",
        "SMBIOSPresent",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmICMIntent",
        "LockedDownTrustedSitesZoneAllowScriptlets",
        "Dot11 Scan Confirm status information.",
        "A value that indicates whether proxies are ignored for local addresses.",
        "RouteProvider",
        "EnabledQueueTypes",
        "{21763208-feb5-49bc-a4e6-f56fdd8ccbd4}",
        "MSNdis_ReceiveFilterInfoArray",
        "The RunRepeatedly parameter indicates whether the scheduled job should run repeatedly on the days that the job is scheduled./nValues: TRUE or FALSE.  If TRUE, then the job is run repeatedly according to the DaysOfWeek and DaysOfMonth parameter. If no value is supplied the parameter defaults to FALSE.",
        "RecordCount",
        "s in queues before delivering them to consumers. WMI slows down the addition of new objects into the queue when the low threshold is reached. If this does not help, and high threshold (specified by this property) is reached, WMI will accept no more objects from providers and return WBEM_E_OUT_OF_MEMORY to the clients.",
        "OpenStore",
        "Relates a main mode rule to its Phase 1 Authentication Set.",
        "MsftDiscFormat2StreamZero_DebugConstructor",
        "Virtual device driver management. ",
        "4 - Microsoft Terminal Services ",
        "The Win32_SystemEnclosure class represents the properties associated with a physical system enclosure.",
        "CD_E4E3C277AFADB65E535A86CD5AAE23B1AEF585A2BE1A21A282B170B7F4278F9E.25.2531720024.4005",
        "Examples: Video adapter manufacturer, chipset version, display resolution, and number of colors.",
        "TRACINGPOOL",
        "Counter3",
        "R_10FBF338168AFFB186F56F269EDFF1DCA8A6F2924767681636FEAA39A6973BC1.1163.1634434399.556",
        "IL_BED999C9BF7E84BAB50F0A32D016E7D1CAEC2193DF18DA06E4E9B9F14F58F2B8.1751.4220363579.204",
        "IPv6Receive",
        "DirectoryName",
        "The Address property holds the value of the address requested.  This can be either hostname ('wxyz1234') or IP address ('193.128.177.124').",
        "This class exposes properties of installed token-based activation licenses.",
        "EDID base block",
        "The IdleTime property indicates the number of seconds that the session has been idle.",
        "CertificateName",
        "SuspendRoot",
        "Serial",
        "DecreaseTime",
        "JOKEPROGRAM",
        "DiscoveryMechanism",
        "Win32_SystemEnclosure",
        "Grants",
        "MaxDatagramSize",
        "{E86E9525-65B6-4B85-95C5-00BEACC975ED}",
        "UnregisterByName",
        "AllowOutboundSourceQuench",
        "R_0B8D0CD35EF9C37B2A0F0A7A5A12FCC21F082587427AFAC5F5A4AE61B8034D36",
        "Specifies whether to enable or disable Audio mapping.",
        "The Resume method resumes a paused print queue. The method can return the following values:",
        "Denotes the provisioning type of the volume. ",
        "F1366B89CD0EC7AF6BCCB323B247B082.1147.2096603149.536",
        "SERVICE_DEMAND_START ",
        "y corrective actions that may be taken.",
        "The AutomaticManagedPagefile property determines whether the system managed pagefile is enabled. This capability is notAvailable on windows server 2003,XP and lower versions.",
        "MSFT_NetAdapter_Group_Affinity",
        "Redirect Portal info for each connection",
        "CallbackData",
        "SetID",
        "Bad Configuration",
        "{ad33fa19-f2d2-46d1-8f4c-e3c3087e45ad}",
        "A short textual description (one-line string) for the FRU.",
        "C_9FAFCCC688F5A73C3B168A2E3CFB29D7012E555844D21034E40221A532E99A1D",
        "MaintainSecurityContext",
        "ID/Handle to virtual interface tunneling state",
        "NPIV_AUTHENTICATION_FAILED",
        "Win32API|Windows Networking Structures|NETRESOURCE|lpProvider",
        "The route associated with the interface",
        "Antispyware component is enabled",
        "The DriveLetter property indicates the drive letter assigned to the volume. This property is NULL for volumes without drive letters.",
        "NDIS Token Ring Current Group Address",
        " The CIM_CreateDirectoryAction creates empty directories for  software elements to be installed locally.",
        "IBM 260/370 OEMI Channel",
        "MsftDiscFormat2RawImage_DebugX",
        "errorCode",
        "CD_51F9DAF3CC7D989B6C98735C3A5D88F91E31E2F8AB94B8929062D8B11C53733D.1365.495755051.359",
        "CD_98233BC0D6E21C2CA3187CB9E2307592DF6D759478E209568F3CA340985F3F72.1164.3334768065.4217",
        "If false, connection settings are not customized.",
        "R_40D59F896F1B4CD78A547B4E482D63447FD0237E73E28B731E2036C3CEB6A1F6",
        "__MethodProviderRegistration",
        "FX_TRACE_RESERVED_17",
        "SelfTestResult",
        "Indicates that the Sensor is linear over its dynamic range.",
        "{8502C4F4-5FBB-11D2-AAC1-006008C78BC7}",
        "SMBIOS|Type 17|Attributes",
        "TM_BWC",
        "object:MSFT_SmbBandwidthLimit",
        "The ExpandedDebugFilePath property is an expanded version of the DebugFilePath property. ",
        "Win32API|Service Structures|SERVICE_DELAYED_AUTO_START_INFO|fDelayedAutostart",
        "This class specifies the information to be used to modify a particular setting file for a specific entry with a specific value. The value specified is created as a new entry or appends to, replaces, removes from,  or deletes the specified entry. All additions are assumed to be case sensitive. Removes are assumed to be case insensitive.",
        "DeleteReplicationRelationship",
        "Manufacturer name",
        "Classifications",
        "ReqBuffer",
        "HeaderName",
        "KI_311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        "FileIo_SimpleOp",
        "The TimestampRoute property indicates how many hops should be recorded with time stamp information while the packet is enroute. A Timestamp is the number of milliseconds that have passed since midnight UT. If the time is not available in milliseconds or cannot be provided with respect to midnight UT then any time may be inserted as a timestamp provided the high order bit of the timestamp field is set to one to indicate the use of a non-standard value. The default is zero.",
        "TargetReplicationGroupDescription",
        "Finalize KTIMER2 Disablement Event",
        "Response",
        "IL_227FDB4BBC644BF919A882A6D6A822A0CF6177C421C416CC297E11CDAC01770C.311.1001239533.249",
        "OSCreationClassName",
        "Values: TRUE or FALSE. If TRUE, the partition needs to be rewritten.",
        "NewTag",
        "MIF.DMTF|System Resource DMA Info|001.10",
        "Indicates if the Adapter supports UDP checksum validation offload for receive IPv6 packets.",
        "CIM_NetworkPipe",
        "The VideoModeDescription property indicates the current resolution, color, and scan mode settings of the video controller. ",
        "LockedDownIntranetZoneNavigateWindowsAndFrames",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|Autorecover MOFs",
        "PreviousCState",
        "CleaningAction",
        "CR_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2",
        "QueuedNotifications",
        "Horizontal sync offset",
        "The CIM_DataFile antecedent reference represents the driver file for this Win32 printer.",
        "The Setting object associated with the Collection.",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"WBEMCORE\"",
        "Sets configuration information for a printer.",
        "OptimizedFilesCount",
        "Index of the icon for this file association",
        "VideoMode",
        "Defer to App",
        "PrinterHostIP",
        "MSFT_NetSARuleMMCrypto",
        "PerformSLPDiscovery",
        "TcpConnectionIPv6",
        "MDM_AppLocker_EnterpriseDataProtection01_EXE03",
        "RequestBuffer",
        "I_84DBB136E33A9D65B07CEAEA34726CC95CE2EDA4327BE7B9EC86367DCA1342F8.2451.4135234177.360",
        "LargeRequestThreshold",
        "{80D071C8-DB33-11d2-85FC-0000F8102E5F}",
        "Localized version of RSOP_PolmkrNtServiceSetting for American English",
        "y MaxMonitors is configured by Server (0),Group Policy (1), Default (2).",
        "MEM_PLATFORM_OEM_ID is valid",
        "CD_0A4A77B99E06085632BB6F0B20A342FB9C17A36A3889D5E85FF4837055C41CA3.2098.1073558724.574",
        "The source of the setting data.",
        "MIB.IETF|Printer-MIB.prtLocalizationCharacterSet",
        "The video controller.",
        "Framing Protocol",
        "The TTOption property specifies how TrueType(r) fonts should be printed.  There are 3 possible values:/nBitmap -  Prints TrueType fonts as graphics. This is the default action for dot-matrix printers./nDownload -  Downloads TrueType fonts as soft fonts. This is the default action for printers that use the Printer Control Language (PCL)./nSubstitute -  Substitutes device fonts for TrueType fonts. This is the default action for PostScript(r) printers.",
        "Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|QuotaPeakPagedPoolUsage",
        "R_92C92331781DF35B14382C2C18FCF4F9CE2A3F0D9A27B8F847108A01941602A7",
        "MSFT_SmbComponent",
        "IntegratedTCPIP",
        "This property allows 'Windows Error Reporting' to be enabled or disabled on the device",
        "{FAF76B7D-798C-11D2-AAD1-006008C78BC7}",
        "TemplateId",
        "C_54D799461F62C50F4E33F56D51A5DAB2D83FEA13CE51DB9E4B33C4043A6D5638",
        "Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters",
        "SendConfigurationApply",
        "DeviceAccess must be specified for each virtual disk.",
        "Network Address",
        "Indicates whether or not the storage pool's configuration is read-only. If TRUE, the storage pool will not allow configuration changes to itself or any of its virtual and physical disks. Note that the data on the virtual disk may still be writable.",
        "Remote access",
        "Compression",
        "Number of days after which an event can be overwritten. Values are:/n0 = Any entry can be overwritten when necessary.1..365 = Events that have been in the log file for one year (365 days) or less can be overwritten.4294967295 = Nothing can be ever be overwritten. /nThere is an interdependence between the OverWriteOutDated property (which is writable) value and the OverWritePolicy property (which is not writable) value./nIf one changes the OverWriteOutDated property value to 0, the OverWritePolicy property value will be 'henNeeded' /nIf one changes the OverWriteOutDated property value to 1-365, the OverWritePolicy property value will be 'outDated' /nIf one changes the OverWriteOutDated property value to 4294967295, the OverWritePolicy property value will be 'Never'.",
        "AllowJapaneseNonPublishingStandardGlyph",
        "This method removes one or more target ports from the masking set.",
        "\\\\.\\root\\StandardCimv2:__Win32Provider.Name=\"dnsclientcim\"",
        "Brightness Level - in terms of percentage",
        "CR_BE7B96C50A5D954A89D26DEB913105A5F4A1453B9058D1ED2B066A1ED47BC2A6",
        "CD_0ED8829CD55CB10045BE12FF28DC63BFD30CC65BF9376DAA6A5D15ADE3CAC700.158.2662187714.250",
        "WMI|Win32_Group",
        "ProtectiSNSTraffic",
        "The Win32_TSAccount class allows deleting an existing account on the Win32_Terminal class and Modify exisiting Permissions ",
        "Get the information about the processes monitored by the given settings location template.",
        "CD_88C4A951AB74CAB93C6609B0E8AEEAE37E1052602716388B72A1ED8A64671F4E.203.2322342325.6006",
        "The shadow copy provider",
        "NDIS Token Ring Current Ring State.",
        "SignatureScheduleDay",
        "UnitModifier",
        "CD_3C22EE36FF380B4D0BD35CEC3718A5763A272DCD4163EFF8590784BADF9E36CF.1782.2494613822.798",
        "ref:CIM_BootService",
        "    //logout       - A valid iSCSI logout command has been sent or received, but",
        "Capabilities and management of the power supply logical device.",
        "WSP_StorageNodeToVolume",
        "AllowPrelaunch",
        "IconTitleSize",
        "object:MSFT_Disk",
        "LockedDownRestrictedSitesZoneAllowFontDownloads",
        "Monitor's basic connection parameters",
        "LogAddress",
        "ACPI control register",
        "MKProtocolSecurityRestrictionInternetExplorerProcesses",
        "CD_B1BDF04F409DA8A1218BDCCDF869651E770462250C203BC00DEB8F3479804AE1.1744.3725372905.492",
        "An optional friendly name for the NRPT rule.",
        "Path, file or object not found",
        "Domains",
        "Package license xml",
        "sndwinscale",
        "Registration Remove",
        "Flat panel's vertical resolution in pixels.",
        "C_FD962A7CCACAB88D552FB4EA114CD68ED5194A98AC098089803CCB7DCC90E78C",
        "IL_E95DE8A58F7A0B8BE8199A37DC9F2A4739FC0BDFAABA87D3B8EEB2F9DF7ADC4A.1806.922661647.380",
        "RemotePortRanges",
        "C_88F114F729A668FD2C1B85D0992A0E7B8F743B0CB06B7BE867F689C1410526C6",
        "3 - 'Level 3': Physical disks belonging to this subsystem have been discovered.",
        "MSFT_DtcNetworkSettingTask",
        "ClassCode",
        "CR_1A9E3B957294E1E2A3BD1A3F9CA79E41F6CD3130E2786884F3F69878725410E6",
        "SM_GetPhyStatistics",
        "MaxPerIPRateLimitQueues",
        "0xD00C",
        "UisEndpointCid",
        "countryID",
        "The SetTcpipNetbios method is used to set the default operation of NetBIOS over TCP/IP. Windows 2000 only. ",
        "Win32API|GetComputerNameEx|ComputerNameDnsHostname",
        "volume",
        "MSFT_iSCSISessionToiSCSIConnection",
        "This parameter indicates the default logical sector size for the storage pool. This is useful when a storage pool may contain a mix of 512 emulated and either 4K native or 512 native physical disks.",
        "HNet_BackupIpConfiguration",
        "DisplayFlags",
        "The Device reference represents the properties of the network adapter being used on the computer system.",
        "Win32_DCOMApplicationLaunchAllowedSetting",
        "millimeters",
        "CIM_IKESAEndpoint.OtherCipherAlgorithm",
        "Example: Physical Memory Array 1",
        "The HardwareType property indicates the type of hardware type used for the Win32 pointing device. ",
        "SECHC_LOG_FLAG_EVENT_LOG",
        "U6000",
        "C_D4D7929A8312A6DC45326BF70047842109EC7C6FE50B4DFC14E0212EF111A093",
        "Buffer Overrun Error Count",
        "PolicySourceDomain",
        "This acts as the base class of all the classes provides by the DS Provider",
        "RunAsUser",
        "If the voltage (in Millivolts) rises above the value specified by Range2InputVoltageHigh property, the UPS will compensate by trimming the voltage.  A value of 0 indicates that the voltage at which trimming occurs is 'unknown'.",
        "LockedDownTrustedSitesZoneAllowFontDownloads",
        "Power Save - Soft Off",
        "DesiredStorageTierUniqueId",
        "MarkingTechnology",
        "MSFT_NetRuleInProfile",
        "NotConfigured",
        "ref:CIM_LANEndpoint",
        "CD_B6F5DFB5FF9D262A34F808F6064BE3724B862C376624E6B9C572552907B49F21.1469.4229813137.742",
        "9_D*n",
        "{146360ab-88dd-11dd-94b8-001d09162bc3}",
        "R_2C338646F5C1CAA321EFF2BEDBEB6839F57D9EB755DB455A7F244BA25566E1F5",
        "NTStatusArray",
        "0xC0050047",
        "The ActiveTime property indicates the number of seconds since this session was established.",
        "MDM_Policy_Result01_ExploitGuard02",
        "CD_DB064F6F00AC6B8D3FA5B61DC9E5BA4F856D1F834E95E30D538DC0E3B653D24D.2055.422004350.326",
        "CQCreate performance counter missing",
        "CIM_DNSSettingData.DHCPOptionsToUse",
        "LS_CONNECTABLE_BUT_ACCESS_DENIED",
        "ref:MSFT_NetIPAddress",
        "The sub-folders and files if this is a directory.",
        "ModemInfPath",
        "Initialized",
        "I_0DD857EB2ADC5DFB72E5F5A4333BAD2BACF09A4F6529BCC15F86720371E4A7C6.2723.1572852183.283",
        "The SpeakerVolumeMed property contains the command string used to set the modem speaker to a medium volume.",
        "Example: 72  ",
        "\\\\.\\root\\cimv2:__Win32Provider.Name=\"SCM Event Provider\"",
        "SERIAL_PORT_WMI_HW_GUID",
        "iScsiFlagProtocolTransfer",
        "IdentifyingDescriptions",
        "{1BE949DA-DB36-11d2-85FC-0000F8102E5F}",
        "CD_01E49F2BC300B8406F535D199FFE723C66F3CBCD052B872FA9DADCCDBACAAF50.67.430747692.617",
        "NlSecChanlSetup_Start",
        "Ndis802_11IBSS",
        "The TracksPerCylinder property indicates the number of tracks in each cylinder on the physical disk drive. ",
        "Number of inbound and outbound failed RDMA connection attempts",
        "The Card number of the memory error location",
        "Non-Standard",
        "Identifies the GPO that contains this Policy Object.A client-side extension obtains this value fromPGROUP_POLICY_OBJECT->lpDSPath. The prefixLDAP://CN=Machine from lpDSPath should be stripped",
        "{acf14033-a61c-11d0-8dd4-00c04fc3358c}",
        "NDIS Status Media Specific Indication",
        "LdrSearchFlags",
        "CIM_CardInSlot",
        "If a Device is (\"Enabled\")(value=3), it has been powered up, and is configured and operational. The Device may or may not be functionally active, depending on whether its Availability (or AdditionalAvailability) indicate that it is (\"Running/Full Power\")(value=3) or (\"Off line\") (value=8). In an enabled but offline mode, a Device may be performing out-of-band requests, such as running Diagnostics. If (\"Disabled\") StatusInfo value=4), a Device can only be \"enabled\" or powered off. In a personal computer environment, (\"Disabled\") means that the Device\\'s driver is not available in the stack. In other environments, a Device can be disabled by removing its configuration file. A disabled device is physically present in a System and consuming resources, but can not be communicated with until a load of a driver, a load of a configuration file or some other \"enabling\" activity has occurred.",
        "Process Wake Counter",
        "9      This device is not working properly because the controlling firmware is reporting the resources for the device incorrectly. ",
        "This property returns whether at least one wifi network adapter is found and is enabled on the device",
        "Indicates network adapter support for Virtual Machine Queue (VMQ) for this encapsulated packet type.",
        "C_355DB6CE31803BDDBDD2FF491BD2AAE24F28E7ADF16402B3F3B9C4CF695702EB",
        "UnitsPerWeek",
        "Reference to the dial-up connection credentials.",
        "Specifies the maximum duration the channel is going to allow the other communicating party not to send any messages before faulting the channel.",
        "IL_C1051F006B768D96E4FCE6F2A8DC0C03012ECC7B68B7C95E31F5861C5B982207.1534.2812249662.333",
        "CD_6AD386ADF7788A35467E769D3EC3DE89211503B8A449E2B53EAB5B8CCD719DFD.1202.4131482504.356",
        "Association between VirtualDisk and Disk",
        "BaseAddress represents the base address of the module in the address space of the associated process.",
        "Example: microsoft.com",
        "Policy object for registry or Administrative Templates extension.Policy settings in an .adm file involve settings values on registrykeys which is abstracted by this class.",
        "Win32API|Process and Thread Structures|STARTUPINFO|dwX",
        "The Option input parameter specifies the actual security permission to be modified. Change_Owner_Security_Information - Change the owner of the logical file. Change_Group_Security_Information - Change the group of the logical file. Change_Dacl_Security_Information - Change the Access Control List of the logical file. Change_Sacl_Security_Information - Change the System Access Control List of the logical file.",
        "X.25 PLE",
        "MSFT_NetIKEKerbAuthProposal",
        "WaitHint",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_C248C547DC15B784B3A402BBD30D036FD929AD807FC5B87D093257C8615FE4B2",
        "{3559D159-47E8-4458-9B7E-5FD16D260B8D}",
        "Ethertype",
        "The AppID property contains a Globally Unique Identifier (GUID) for the COM application using this COM component.",
        "Informational",
        "object:MSFT_NetIPsecIdentity",
        "MDM_Firewall_App04",
        "DeactivateConsistency",
        "ReportingObjectUniqueId",
        "SamGrpCreate_End",
        "i[PROCESSORWMI]",
        "AllowPinnedFolderFileExplorer",
        "{50ffd030-c7d2-449a-be4a-a3f272996fd4}",
        "EVENT_TRACE_FLAG_CLOSE",
        "MGR_TRACE_RESERVED_0e",
        "Win32API|Communication Structures|DCB|XonLim",
        "ModerationByCountSupported",
        "Degraded Redundancy",
        "The Capabilities property defines chip level compatibility for the serial controller.  Therefore, this property describes the buffering and other capabilities of the serial controller, that may be inherent in the chip hardware. The property is an enumerated integer.",
        "Represents a driver property set on a print queue",
        "{d0520b5d-1b5f-4ecf-a940-6e57476ae4b0}",
        "UUUQU",
        "OnlySendAQuery",
        "PCLXL",
        "The BytesPerSector property indicates the number of bytes in each sector for the physical disk drive.",
        "If this flag is set, certificate authority names are excluded. This flag MUST be set only on first authentications.",
        "CD_B39F79BEF0550EE7F9E981A83A152A3A4B6173B3A32D2E630E92CBAA2FE60E90.1389.2857269146.2517",
        "{ceb7253D-bb96-9dfe-51d1-53d966d0cf8b}",
        "Values: TRUE or FALSE. A value of TRUE indicates the protocol is message oriented.",
        "C_ED0FE1836A8A43CE00507F00708D770A7EF86A8D404DA2B6D5FE190709C3FC86",
        "Specifies the specific communications provider type",
        "Interlaced",
        "LockedDownIntranetZoneAllowLessPrivilegedSites",
        "The DeviceName property specifies the friendly name of the printer.  This name is unique to the type of printer and may be truncated because of the limitations of the string from which it is derived.",
        "Win32Registry|System\\CurrentControlSet\\Enum\\Root|Mfg",
        "Additional detail related to the MediaType enumeration. For example, if value 3 (\"QIC Cartridge\") is specified, this property could indicate whether the tape is wide or 1/4 inch, whether it is pre-formatted, whether it is Travan compatible, etc.",
        "EVENT_TRACE_FLAG_F",
        "A user settable description of the file share. This field can be used to store extra free-form information, such as notes or details about the intended usage.",
        "Local Configuration Manager that controls the states of configuration files and uses Configuration Agent to apply the configurations.",
        "NDIS Notify VC Arrival",
        "Specifies the web message body style.",
        "_DH_WMPCD_DPF",
        "MaxNumVPorts",
        "MIF.DMTF|Video|003.10",
        "The time that the job was actually started.",
        "Specifies the Domain name in which the user's computer resides.",
        "Total number of cases where an incoming packet is found ineligible for coalescing",
        "RD_TRACE_RESERVED_16 Flag",
        "ObTrace",
        "PolicSOM",
        "ScalingHeuristics",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"WMIPingProvider\"",
        "C_755C3664114AA9097DEA3F0332A59D1FE1A4668C8001C4E97937639305CB9174",
        "VirtualSize",
        "MI_ERRORCATEGORY_METADATA_ERROR",
        "DiskPath",
        "C_6AFC03E55253E21322FCA663D825D0FB816D6FBD02CA8A1BBA06E585EA971CD4",
        "The windows credentials the client will use to authenticate itself to the service.",
        "Vista",
        " Description ",
        "The Count property is the number of shadow copies in the shadow copy set to which this shadow copy belongs.",
        "MSNdis_PMAdminConfig",
        "SignalLevelStandard",
        "Number of session on the adapter : Number of elements in RedirectSessionInfo array",
        "ALPC Receive Message",
        "InboundAddress",
        "Win32API|Communication Structures|DCB|XoffChar",
        "GetSystemDisk",
        "AceFlags",
        "SAM User Create",
        "MDM_DeviceManageability_Provider01_01",
        "The Manufacturer property indicates the name of the manufacturer of the network client running on the Win32 system.",
        "TunnelBytesReceived",
        "DiscoveredPortIndex",
        "How the keyboard is connected to the computer",
        "The Name property defines the label by which the object is known. In the case of an LDAP-derived instance, the Name property value may be set to the distinguished name of the LDAP-accessed object instance.",
        "TM_TRIEMAP Flag",
        "Activates a product by depositing an Offline Confirmation Identifier for this product when performing telephone or offline activation.",
        "OutboundFrames",
        "JobId",
        "{4307bff0-2129-11d4-97eb-00c04f79c403}",
        "Switch WWN",
        "The CIM_AggregatePExtent class provides summary information about the addressable logical blocks which are in the same storage redundancy group and reside on the same physical media. This is an alternative grouping for physical extents, when only summary information is needed or when automatic configuration is used. Automatic configuration can result in thousands of physical extents being defined. There is no value in modeling the individual extents.  So, the CIM_AggregatePExtent object was defined.",
        "The InstalledDisplayDrivers property indicates the name of the installed video driver.  ",
        "Class defining the structure of resource module managers",
        "RequestedState is an integer enumeration that indicates the last requested or desired state for the element, irrespective of the mechanism through which it was requested. The actual state of the element is represented by EnabledState. This property is provided to compare the last requested and current enabled or disabled states. Note that when EnabledState is set to 5 (\"Not Applicable\"), then this property has no meaning. Refer to the EnabledState property description for explanations of the values in the RequestedState enumeration. ",
        "Timer interval in milliseconds",
        "Bus mouse micro-DIN",
        "R_2C9E96C7F7E323559ADDB98919DA9CB9D792B77EB6D7DB30E98DE86B6BCDF5FC",
        "SDBUS_DEBUG_DEVCFG",
        "13 - 'Lost Communication': indicates that the subsystem is known to exist and has been contacted successfully in the past, but is currently unreachable. ",
        "CIM_Error",
        "MSDATL3",
        "MSFT_NetAdapterElementSettingData",
        "The time interval after midnight when the Job should be processed. For example, ",
        "The Msft_WmiProvider_PutClassAsyncEvent_Pre event class represents an event generated immediately prior to calling the provider's implementation of IWbemServices :: PutClassAsync.",
        "0x001000",
        "The Drive property is a string representing the drive letter (including colon) of the file. ",
        "{8E6B6962-AB54-4335-8229-3255B919DD0E}",
        "MSFT_StorageJob",
        "VSS tracing provider",
        "PageFile",
        "For a given ManagedElement and all instances of a SettingData subclass, there shall be at most one instance of ElementSettingData which references the ManagedElement and an instance of the SettingData sub-class where there is a specified non-null, non-key property of the SettingData sub-class, and the IsACSetting property on the referencing ElementSettingData instance has a value of \"Is AC Setting\".",
        "CMC handling switched from interrupt driver to polling",
        "External interface locked out",
        "NS_2EEEF6086B5AA3148DE8DC3E7A7263A417EE849A276BDB357874FDEB8ADED318\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_2381C996A59A0D1EB6DDD79E1C697FECC05884247B858E341AE1AAFDFB086D7B",
        "{8502C4DA-5FBB-11D2-AAC1-006008C78BC7}",
        "The scoping process' CreationClassName.",
        "HOSTPROC_RESERVED_13",
        "IL_B2096C9AA0F29B706796B428CA579EC2F42C2DFA6F8F47B76A11C7F44194A8B8.2690.2610895252.263",
        "ReadCorrectedWithoutDelay",
        "Instruction breakpoint register",
        "Maximum supported size for AAL5 packets.",
        "Units",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightDate|wDay",
        "CIM_HostedAccessPoint is an association between a serviceaccess point and the system on which it is provided.  The cardinality of this association is 1-to-many and is weak with respect to the system. Each system may host many service access points.  Heuristic:  If the implementation of the service access point is modeled, it must be implemented by a device or software feature that is part of the system hosting the service access point.",
        "RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer",
        "The total logical size of all optimized files on the volume, in bytes.",
        "I_01AF7823F90DAEC78BAF38771F45D60A37B0917DC6BBE974DF07B97707A15F13.2451.1886448488.295",
        "R_443EA03A729799AF7B722609B218862C5380ED55FDD1C6840B32FD56F51FDFBA",
        "InitiatorIds",
        "The IPAddress property contains a list of all of the IP addresses associated with the current network adapter.",
        "PreventIndexingLowDiskSpaceMB",
        "LetAppsAccessAccountInfo_ForceDenyTheseApps",
        "3 - 'Suspend' stops the job temporarily. The intention is to subsequently restart the job with a second call to RequestStateChange requesting 1 - 'Start'. It might be possible to enter the",
        "The Win32_NamedJobObjectStatistics association class relates a job object instance and the I/O accounting information instance containing accounting information for the job.",
        "WFP_TRACE_BASE",
        "The OtherTransferCount property specifies the amount of data transferred during operations other than read and write operations.",
        "OSVersion",
        "FD Core Trace",
        "The Shutdown method unloads programs and DLLs to the point where it is safe to turn off the computer. All file buffers are flushed to disk, and all running processes are stopped. On computer systems running Windows NT/2000, the calling process must have the SE_SHUTDOWN_NAME privilege.",
        "Create a virtual port on behalf of a Guest Virtual Machine with a specific WWPN using DH-CHAP for unidirectional authentication of the N_Port by the FibreChannel fabric.",
        "dialUpConnections",
        "I_07518836069F28661B2BDE63EA95AFE81F3822D4677A49CBAE5F594ED13FEBAF.1147.1898380277.285",
        "RS-449 port",
        "SavingsRate",
        "Process_V4_TypeGroup1",
        "ProviderContext",
        "connid",
        "Specifies the IP Protocols for filtering",
        "Hardware Error Correction",
        "MCA_ERROR_PLATFORM_SPECIFIC",
        "Power Production",
        "Notify",
        "18 - 'Requires resync': The requested operation has completed, however, the synchronization relationship needs to be resynced before further copy operations can be issued. ",
        "C_B000D7C01C41DA9F495CA1E95B37B424DFDDCCE8C00003B846B2C7E67953BB12",
        "NumberOfPorts",
        "Indicates whether the physical disk uses MPIO.",
        "The share",
        "MI_ERRORCATEGORY_PARSER_ERROR",
        "Compatibility",
        "GroupIds",
        "The name of the server this port resides on.",
        "Association between InitiatorPort and iSCSIConnection",
        "Frequency",
        "An enumerated integer indicating that the referenced setting is currently being used in the operation of the element, or that this information is unknown.",
        "Win32_COMApplicationSettings",
        "ForceUnloadDisabled",
        "IdleExitLatency",
        "SAM Password Push PDC",
        "R_CE2777A1E2E8F0439A275F7E5E7BEE453C2145F60A592F57CCEA55492EC8B6F1",
        "Select * from Win32_SoftwareElement",
        "MSFT_NetTCPSetting",
        "{F25FE469-783E-11d2-90BF-0060081A46FD}",
        "ROOT\\Microsoft\\Windows\\Storage\\PT\\Alt",
        "RemotePortResolutionEmpty",
        "The number of pages total in this job.",
        "41023",
        "Workstation trust account",
        "MIF.DMTF|Electrical Current Probe|001.10",
        "This method removes partition information and uninitializes a disk, sending it back into a RAW state. The caller must specify RemoveData, RemoveOEM or both with this method unless they first delete all data partitions, known OEM partitions, and ESP partitions on the disk. This requirement excludes metadata partitions such as the MSR, the LDM metadata partition, and unknown OEM partitions.",
        "ConfigError",
        "object",
        "KernelDumpOnly",
        "The GuaranteesDelivery property indicates whether the protocol guarantees that all data sent will reach the intended destination.",
        "Win32_EncryptableVolume",
        "ENABLE_DISABLE_FP_POLLING",
        "Redbook Driver Information",
        "The ResponseTimeToLive property indicates the time to live from moment the request is received.",
        "IL_B5845F4417EB0A7AD195B60C8C70005F48FB5E07E5853923BF9CEC00A11B4FA0.311.2565700494.249",
        "LanConnections",
        "PrimaryWinsServer",
        "CD_B6F5DFB5FF9D262A34F808F6064BE3724B862C376624E6B9C572552907B49F21.2060.2518766664.872",
        "ODBCBCP.1",
        "The ShareName indicates the name of the share that the link references.",
        "LetAppsAccessMicrophone_UserInControlOfTheseApps",
        "Qualifiers",
        "NisSignatureVersion",
        "Network Direct Interface capabilities supported by a network adapter",
        "TRUE if media is write protected",
        "QueryInfoPolicy",
        "The SystemDirectory property indicates the system directory of the operating system.",
        "-Friday",
        "The scoping computer system's creation class name.",
        "PolicyStore",
        "Status of the job",
        "TABLE",
        "DANameServers",
        "wPacketVersion",
        "Header_PartitionInfoExtension_TypeGroup",
        "Example: thomasw",
        "CR_B8B1FAB8A4F90C512F053D1AD5C7061AC5CC502A1FC989312218B5B68AB25BBF",
        "Name of the module that supports this resource.",
        "Delay in seconds before displaying the notification on settings import",
        "0 - x86 ",
        "The shadow copy",
        "A GUID used internally by the Software Licensing service to uniquely identify an XRML license.",
        "SPACES_InitiatorId",
        "ROOT\\WMI",
        "SNMPCommunity",
        "DOModifyCacheDrive",
        "Specifies the packet truncation length in bytes. The default is 128. The minimum is 14. The value of zero disables truncation.",
        "As input, this parameter contains the requested size for the virtual disk to become. As output, this parameter contains the size that was actually achieved after the resize operation.",
        "VirtualDiskFootprint",
        "Already exists",
        "The address filter applied to the rule.",
        "SamSetInfoAlias",
        "8#m;8#m;",
        "IL_9AADCFBEBD2729049C83114BED85D30D2725084DFCBD70BFC18E54B91E6865DF.1076.3805284346.338",
        "CodeV",
        "{205B4E48-C367-4d42-8C56-DA657D00AD8F}",
        "The fully qualified destination filename.",
        "Enables LPR Byte Counting.",
        "Tape Io Error",
        "millivolts",
        "ref:Win32_Terminal",
        "Kerberos",
        "Negotiating IPSEC",
        "A string defining \"Other\" values for ErrorSourceFormat. This value MUST be set to a non NULL value when ErrorSourceFormat is set to a value of 1 (\"Other\"). For all other values of ErrorSourceFormat, the value of this string must be set to NULL.",
        "PNP_WARNING_LEVEL",
        "CD_972576376A5F2C5C3EBE5402A0C00A72BB51E33D448C072392A8C26DEF804EC3.2087.1300814291.2771",
        "AMD AthlonXP(TM) Family",
        "ref:MSFT_NetAdapterPacketDirectSettingData",
        "This specifies if the virtual LAN (VLAN) used by the device changes based on the user's credentials.",
        "Win32API|System Information Functions|GetUserName",
        "Invalid Service Control",
        "IPv4 Addresses",
        "The MediaType property specifies the media type used by (or accessed by) this device. In this case, it is set to \"Tape Drive\".",
        "SamSetSecurityObj_End",
        "CPAST Flag",
        "Stack5",
        "Pending actions (bit flags indicating reboot/full scan/manual steps required)",
        "AccessAllowed",
        "C_486730B0C62C887E945DF074DD24ED6717120317D02115D40420B0BF288FF266",
        "eventID",
        "MinReadable indicates the smallest value of the measured property that can be read by the numeric sensor.",
        "Example: 255.",
        "SetByExeSet",
        "PNP_REGISTRY_TRACE_LEVEL Flag",
        "Win32_PnPDevicePropertyReal64Array",
        "ConfigurationModeFrequencyMins",
        "Create_Default_Error_Mode",
        "This method deletes the storage tier.This method is available only when the SupportsStorageTierDeletion propertyon the storage subsystem is set to TRUE. If it is set to FALSE, this methodwill fail with MI_RESULT_NOT_SUPPORTED.",
        "2 = \"Do Not Continue\", meaning stop the execution of the job and appropriately update its status ",
        "NormalMin provides guidance for the user as to the normal minimum range for the numeric sensor.",
        "LPC_TRACE_RESERVED_19",
        "VerticalBlankingPixels",
        "DSAccess_AuditDirectoryServiceChanges",
        "The Msft_WmiProvider_AccessCheck_Pre event class represents an event generated immediately prior to calling the provider's implementation of IWbemEventSecurity :: AccessCheck.",
        "TurnOffHybridSleepOnBattery",
        "Sets the location at which the service WSDL is published for retrieval using HTTPS.",
        "Perf Flag",
        "Win32_TerminalServiceSettingError",
        "Enumerate Receive Queues",
        "Make Available Offline",
        "Association between StoragePool and PhysicalDisk. Primordial storage pools should retain their association to all physical disks that originated from that pool. This means that if a physical disk has been added to a concrete pool, the disk should have an association with both its concrete and primordial pools.",
        "WSP_StorageModificationEvent",
        "CreateReplicationRelationship",
        "{acf1403b-a61c-11d0-8dd4-00c04fc3358c}",
        "TargetLun",
        "Installable",
        "The StartPassword parameter passes the password to the account name specified by the StartName parameter. Specify NULL if you are not changing the password. Specify an empty string if the service has no password. ",
        "C_2DD5D2C8F7B69285DFBD211B8783B9D8D8AAF5A927EC709DE65B6AC4223EE339",
        "PolicySourceWindowsPrinterMapping indicates whether the property WindowsPrinterMapping is configured by Server (0),Group Policy (1), Default (2).",
        "CD_896B6F9A9E07C666B49D000879A54E67F9CE0EAF2B8B7EF7BCA31E7303EC222A.1650.3665407438.2951",
        "AuthorizationStatus",
        "Critical Section Collision",
        "OS Scsi bus number target is mapped to",
        "PciExpressMaxPayloadSize",
        "Composite VirtualDisk Member",
        "object:MSFT_NetAdapterIPsecOffloadV2SettingData",
        "Answer mode defines the current auto-answer/call-back setting for the modem.",
        "Monitor brightness parameters",
        "The DeviceMap property indicates the order in which devices are listed with this SCSI controller. ",
        "The InfraredSupported property determines whether an infrared (IR) port exists on the computer system./nValues: TRUE or FALSE. If TRUE, an IR port exists.",
        "PLATFORM_TRACE_ERROR_REPORTING Flag",
        "{84CA6FD6-B152-4e6a-8869-FDE5E37B6157}",
        "InternetScriptingEnabled",
        "CR_43D2FF9F27C9DEB49402058FFFFEABC225D67F17C30DC663FA2980525D05DB01",
        "This device cannot start.",
        "ControlEventLogBehavior",
        "COMMIT_POLICY",
        "EnumTrustedDoms",
        "MaxSAIdleTimeSeconds",
        "NetDaCim",
        "GatewayAuthMode",
        "VendorModel",
        "Number Of UCRs",
        "The GatewayCostMetric reflects an integer cost metric (ranging from 1 to 9999) to be used in calculating the fastest, most reliable, and/or least expensive routes. This argument has a one to one correspondence with the DefaultIPGateway. Windows 2000 only.",
        "DEPEND_DUMP",
        "ResourceModuleManagers",
        "The Win32_SystemSystemDriver class represents an association between a computer system and a system driver running on that computer system.",
        "Number of multiple retries",
        "Win32API|Process and Thread Structures|STARTUPINFO|dwY",
        "Ndis80211Rssi",
        "NDIS_RSS_PROCESSOR",
        "SetPolicyDrivenUpdateSourceForQualityUpdates",
        "The UserType property indicates the type of account  the user has privileges to.",
        "One or more physical disks are not supported by this operation.",
        "%TimesFailed%",
        "AtaportGuid",
        "IPv4AddressOrigin identifies the method by which the IPv4 Address,  ",
        "TROJANDOWNLOADER",
        "A link between a process and the thread(s) running in the context of this process.",
        "A user settable string representing the name of the storage subsystem. The storage provider or subsystem is expected to supply an initial value for this field.",
        "{84840C72-9913-4D9F-BEE4-447A8A875B82}",
        "VendorID",
        "DesiredStateConfiguration",
        "The name of an organizational unit related to the account.",
        "QuickScanEndTime",
        "TRC_DETAIL",
        "C_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "DiscStatus",
        "HostedCacheScpRegistrationEnabled",
        "CodePage",
        "{8502C517-5FBB-11D2-AAC1-006008C78BC7}",
        "WINSTATION_SHADOW=0x10",
        "WHERE DomainName='#'",
        "PageFault_V2",
        "// class in order to interface with your adapter. Implement one instance",
        "FIPS Compliant",
        "Music",
        "Total size of the partition, measured in bytes.",
        "DnsServer4",
        "Max horizontal image size (in cm)",
        "MsftDiscFormat2Erase_DebugConstructor",
        "FixedDrivesRequireEncryption",
        "C_7D3C758EE8FB44B72514B3588512147905DB19A0456725381223C5A506626F7A",
        "Maximum link width (1, 2, 4, .., 32), valid only for PCI-E devices.",
        "The SetIGMPLevel method is used to set the extent to which the system supports IP multicasting and participates in the Internet Group Management Protocol. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "PCI_COMP_INFO_FunctionNumber",
        "HostNames are semi-unique (scoped to the owning storage subsystem), human-readable strings used to identify a file server. There is a separate host name element per file sharing protocol.",
        "HI-UX",
        "C_947A6ECFED1300E5950B4C8196704C2B50E4463864CF2615B27D56E94A95716A",
        "Tape drive problem data",
        "Complete",
        "\\\\.\\root\\Microsoft\\UEV:__Win32Provider.Name=\"SettingsLocationTemplateProvider\"",
        "Indicates if collating is enabled/disabled.",
        "TimeOfLastStateChange",
        "Contains printer data for an NFC tag.",
        "{3574bc0b-6f5f-4baf-af67-c48cc79fe957}",
        "Win32_BaseService",
        "Object which contains details for WinINet internet connection settings for a given connection.",
        "CIM_PhysicalFrame.Model",
        "Values: TRUE or FALSE. A value of TRUE indicates the flow control can be set.",
        "Specifies the algorithms to use with the binding.",
        "Consistency",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2736.2113456816.348",
        "DaysOfMonth",
        "C2: GroupNumber = 1, ConditionNegated = TRUE ",
        "IPv4FailureReason",
        "SECHC_LOG_FLAG_MEMORY",
        "MCA transaction type",
        "55002",
        "CompartmentDescription",
        "HvciEnabled",
        "0xC005004D",
        "CD_FC7FFCA0C7A5D89DD371B2F0B241E87A604E23DE48746B1BF4F9C2034FE72A72.1389.2433549545.332",
        "-Thursday",
        "Minor version number of the OA2 BIOS marker.",
        "3 = Small memory dump (64KB)",
        "Physical extents spanned by the storage tier.",
        "370 Pin Socket",
        "ref:CIM_FRU",
        "ISCSI_ERR_ISCSI_REQUEST_TIMEOUT",
        "Text Address",
        "DOT11_RECEIVE",
        "94 - Path, file or object not found",
        "Instances of this class represent and ProgIDs that need to be registered durring a given installation.",
        "NumericSensorSensorType",
        "The ResultCode property reveals the HRESULT code returned from the loading process.",
        "The part number assigned by the organization responsible for producing or manufacturing the physical element.",
        "DOT11_1X",
        "C_2C755AC62396ABBDA4DF17AA88E448E6599BEF0ABD01ACD402D70497EDC686A8",
        "IPsecTrustAuthority",
        "Win32_NetworkAdapter",
        "CD_57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA.0.2698991554.1940",
        "Date and time when the configuration was started.",
        "Processor Problem (Internal Machine Error)",
        "C_79FD2B1944A0E8569231538101AA02032B2AA1FD92C317847D2089CA52F4CD72",
        "Status Invalid Name",
        "Select * from Win32_VolumeQuotaSetting",
        "Locks a network adapter",
        "CIM_Setting",
        "PrecedenceReason",
        "ProxyAuthenticationScheme",
        "FileIo_V2_Create",
        "The IGMPLevel parameter sets the level that the system supports IP multicast and participates in the Internet Group Management Protocol. At level 0, the system provides no multicast support. At level 1, the system may only send IP multicast packets. At level 2, the system may send IP multicast packets and fully participate in IGMP to receive multicast packets.",
        "MSFT_NetAdapterRscCapabilities",
        "Show On Toolbar By Default",
        "DODelayCacheServerFallbackBackground",
        "This method grants the specified user accounts the specified access to the file share. ",
        "DirtyBitSet",
        "Windows Defender Firewall NetShell Plugin",
        "A unique key identifying this duplicate file action within its product.",
        "CD_DEA224BBEF40A5F2D4A2CA371BF633744D610A42E8901085FCD10393CC6D8624.1746.3011791680.494",
        "An optional friendly name for the Name Resolution Policy Table  rule",
        "MSFT_NetAdapter_QosClassificationElement.ProtocolSelector",
        "dwMaxTxQueue",
        "Reconnecting",
        "CD_A67F6CA5AD0F3F082B7328E37F2535113EC93F9273483374AD4B41FB5A9EBA2D.2435.2555529523.8043",
        "The LastLogon property indicates the date and time the user last logged on to the system. This value is calculated from the number of seconds elapsed since 00:00:00, January 1, 1970.  The format of this value is yyyymmddhhmmss.mmmmmm sutc.",
        "Provides a method to ",
        "I_C52295624F06C940B122D80C080F06A7E8A3B72E8DBB8DAB3530E90B3C01E0C8.1500.3783951989.277",
        "4 bit - Win9X Upgrade - The join operation is occurring as part of an upgrade of Windows 95/98 to Windows NT/Windows 2000.  ",
        "PerfInfo Event",
        "RecordID, with the MessageTimestamp property, serve to uniquely identify the LogRecord within a MessageLog. Note that this property is different than the RecordNumber parameters of the MessageLog methods. The latter are ordinal values only, useful to track position when iterating through a Log. On the other hand, RecordID is truly an identifier for an instance of LogRecord. It may be set to the record's ordinal position, but this is not required.",
        "LockedDownRestrictedSitesZoneAllowUserDataPersistence",
        "5311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        "Last time this SoftwareFeature was used",
        "Name of the target Replication Group to be created.",
        "Network login information (of a particular user) management. ",
        "CritSecTrace",
        "Trace",
        "DecimalArray",
        "{D31B6A3F-9350-40de-A3FC-A7EDEB9B7C63}",
        "NewDllBaseAddress",
        "Unique Session ID for the target mapping",
        "CIM_SoftwareIdentity.RevisionNumber",
        "3221232500",
        "Denotes the minimum number of physical disks required for creating a storage pool on this subsystem.",
        "Maximum data segment length in bytes they can receive in an iSCSI PDU.",
        "Empty replication groups allowed",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|Bias",
        "The CIM_ElementsLinked association indicates which physical elements are cabled together by a physical link.",
        "OnlyForNextBoot",
        "1C9E35DCF899DDC0B30F2B23CFF106F5805254E0E64E1E04F4",
        "PerfDefault",
        "Per internal IP address rate limit queue idle timeout in seconds.  Value must be > 0",
        "QueryValue",
        "Antispyware signature update date and time (using round-trip UTC format)",
        "Memory or IO address on the PCI bus at the time of the event",
        "CD_697DA7CFBF1A5367B42159FA584B6D6C58403D44C1543977ACD7BED9F2898E8B.1172.1760260658.234",
        "ref:__Provider",
        "SynSent",
        "206\\'Parameterized URL\\'- a URL containing ${parameterName} strings. Those strings are intended to be replaced in their entirety by the value of the named parameter. The interpretation of such parameters is not defined by this subclass. ",
        "The Name property is a string representing the inherited name that serves as a key of a logical file instance within a file system. Full path names should be provided. Example: c:\\winnt\\system\\win.ini",
        "NoUser",
        "The WriteDebugInfo property indicates whether or not debugging information is to be written to a log file.",
        "dsctimer",
        "{956597A0-7D80-11D2-AAD3-006008C78BC7}",
        "Header_Extension_V0_TypeGroup",
        "The WriteToSystemLog property indicates whether or not events will be written to a system log.  ",
        "CIM_ERR_METHOD_NOT_AVAILABLE",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|Logging Directory",
        "The scsi request failed",
        "InterfaceName",
        "HelpTelephone",
        "IsPagingIO",
        "{b8d2bc4a-1525-4386-bb1c-6bb2e24eb001}",
        "Maximum Output Buffer Size",
        "MDM_Policy_User_Result01_Start02",
        "Registration Key with which to register with the Reporting Server",
        "I_488680B9304A8CE240DD3162C60ABEBE0653A1B3DEF56BFB0E7A2CB3DC6AD158.2460.966863555.365",
        "VolumeId",
        "FailureCount",
        "__CacheControl",
        "DeleteJobById",
        "L2CacheSpeed",
        "Select * from Win32_TSNetworkAdapterSetting",
        "YCoordinate",
        "The CIM_ControlledBy relationship indicates which devices are commanded by or accessed through the controller logical device.",
        "StartMode is a string value indicating whether the Service is automatically started by a System, Operating System, etc. or only started upon request.",
        "LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls",
        "Volume optimization was unable to complete because the disk backing the volume is full.",
        "ImmediateData",
        "MDM_Policy_Config01_LanmanWorkstation02",
        "The Phase 1 Authentication Set used by the rule.",
        "PolicySourceUseTempFolders",
        "0xEFFF0062",
        "{5cec3d52-6eeb-474d-b468-58362888f1b0}",
        "SCSI Check Condition reported",
        "PC-98",
        "This aggregation does not indicate whether a specified action order is required, recommended, or of no significance; the property SequencedActions in the aggregating instance of PolicyRule provides this indication.",
        "NDIS Query Header/Data Split Current Config",
        "AddAccessPath",
        "crc32c",
        "AllowSimpleDevicePassword",
        "object:MSFT_NetBranchCacheDataCache",
        "- The first sub-string is the language code, as specified in ISO639. ",
        "Layer 2 VLAN using 802.1Q",
        "{FAF76B7F-798C-11D2-AAD1-006008C78BC7}",
        "Read log sectors",
        "InstalledTime",
        "Object representing the result of a Diagnose method call on a storage object.",
        "Enables Network Fair-Share Scheduling: (0) Network Fair-Share Scheduling is disabled, (1) Network Fair-Share Scheduling is enabled.",
        "{DA13DC3D-3F88-4A85-A89E-5735588A65E5}",
        "IsUserMsaConnected",
        "ATA/ATAPI",
        "Seconds spent ready to read, but unused. (*1E-7)",
        "NoAutoRelease",
        "IPV6Addresses",
        "RDPFileContents",
        "createonexistingfile",
        "The default job priority for jobs printed to this printer.",
        "11 - 'In Service': The disk is being configured, maintained, cleaned, or otherwise administered.",
        "Value of maximum monitors supported by server",
        "InteractiveLogon_DoNotRequireCTRLALTDEL",
        "PolicySourceClipboardMapping",
        "Win32_ODBCDataSourceAttribute",
        "The security settings of the object",
        "DefaultToClientPrinter",
        "MIF.DMTF|Operational State|003.9",
        "OldPriority",
        "TotalMFTFragments",
        "FieldParametersArrayNumElements",
        "TRACE_CLASS_ENGINE Flag",
        "An array representing the thresholds that are currently enabled for this Sensor.",
        "No Encryption/Authentication",
        "CR_610AB796758AF91BAFAAC5773CA30FA987962CB5B589ABCAD3D6EAA7F97EA9EE",
        "Tape Symbolic Name",
        "HardwareVariant",
        "Dependency domain number to which this T-state entry belongs",
        "Send SCSI Inquiry command",
        "Package Location",
        "CD_034DC06A7BA24821E2AA8A94509CDB2B6BBA02EFDD0801948AE379D7CD46E5AA.2392.1.11351",
        "TargetNodeName",
        "\"Non-recoverable Error\" (30) - The element has completed failed and recovery is not possible. All functionality provided by this element has been lost. ",
        "I_886C9F8982A417AFDAA51FF78BB9E9B6EE19BDA8B9BB937D782CF5D5173B6652.1147.1762140494.344",
        "CreateNewProcessGroup",
        "Shows any related aliases",
        "Name is a free-form string defining a label for the location. It is a part of the key for the object.",
        "OEMLogoBitmap",
        "LetAppsSyncWithDevices_ForceDenyTheseApps",
        "WakeOnMagicPacket",
        "Expiration Date",
        "\\\\.\\root\\CIMV2\\Security\\MicrosoftVolumeEncryption:Win32_ProviderEx.Name=\"Win32_EncryptableVolumeProvider\"",
        "Certificate Enrollment provider using Simple Certificate Enrollment Protocol",
        "{0ef94073-5b9d-4ec9-9c6d-a624d1c3be17}",
        "The StartService method attempts to place the service into its startup state. It returns one of the following integer values: ",
        "The ProcessStopTrace event class indicates a process has terminated.",
        "DOT11_WME Flag",
        "Indicates whether new sessions are allowed.This setting will not affect existing sessions for Post Windows 2000 builds",
        "Microsoft iSCSI Initiator: IKE Preshared Key Authentication Information",
        "ItemName",
        "Example: \\\\PHYSICALDRIVE0",
        "r71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "R_51447A26417532B0D1E85276A6FCB955003CCAAE5927BD755A45CC87195E9484",
        "Win32API|Network Management Structures|SHARE_INFO_502|shi502_type",
        "MSFT_NetAdapterPowerManagementSettingData represents the Power Management settings and features of a network adapter.",
        "Specifies the string identifying the app in the package.",
        "This association relates a MSI Check with any locational information it requires.  The location is in the form of a file and/or directory specification.",
        "Forces the removal of the VPN profile from the phonebook.",
        "IL_614FEB5198DB6356C7D4E70E58F0634936BC6DE530AA5FD952207E56B5A89D3F.1635.1118994179.316",
        "The TotalSectors property indicates the total number of sectors on the physical disk drive. ",
        "PercentSynced",
        "NDIS FDDI Downstream Node Long",
        "The requested ELS was rejected by the local adapter",
        "PeakWorkingSetSize",
        "MCA_WARNING_MEM_1_2_5_4",
        "RoamingPreference",
        "Subject name of the issued certificate",
        "48001",
        "GetReplicationRelationships",
        "Session Pool Allocation/Free Event",
        "{fe9af5c0-d3b6-11ce-a5b6-00aa00680c3f}",
        "ScanType",
        "C_8804D243AE7A52758E6F83E5472ED92BCF2D0EC1642375FE251024B3FABA24DB",
        "Select * from Win32_NTDomain",
        "CD_3935D6345388A245E9FF50F1CD42F69CC8FD444FF90B93C789385D0BD31672F7.17.2007166480.652",
        "Datacenter",
        "CIM_SoftwareElement.Name",
        "VideoOutputTechnology",
        "The InterleaveDataDepth property indicates the maximum number of consecutive rows of data that are accessed in a single interleaved transfer from the memory device. If the value is 0, then the memory is not interleaved.",
        "IsBundle",
        "0x8000..",
        "The QueryId property holds an identifier of the query which was canceled. This identifier was originally delivered to the provider by the NewQuery method of this interface.",
        "The version of this profile. The string representing the version MUST be in the form: ",
        "SetClientWallPaper",
        "Maximum transition latency in microseconds",
        "{F25FE468-783E-11d2-90BF-0060081A46FD}",
        "Holds the value of the user defined severity value when 'PerceivedSeverity' is 1 (\"Other\").",
        "State of the route.",
        "Represents the filter for transport protocol parameter setting for Microsoft TCPIP WMI v2 provider.",
        "EnableByObject",
        "SpinLockConfig_V3",
        "The EightDotThreeFileName property is a string representing the DOS-compatible file name for this file./nExample: c:\\progra~1",
        "The PlusProductID property contains the product identification number for the Windows Plus! operating system enhancement software (if installed).",
        "CI_20F26C6236C8252E1FCBB508B5F5781449304BFBC276C5E3DD747A3A26989746",
        "Select * from Win32_Printer",
        "Library Loader Coded Event",
        "Enable_BCDowngrading",
        "Configures all Network adapters for the specified Terminal.",
        "Total Folders",
        "dwSettableBaud",
        "DeleteOnKill",
        "HiddenSectors",
        "Product configuration directory",
        "PciExpressCurrentLinkSpeedEncoded",
        "Portal Symbolic Name",
        "Record",
        "Thread Pool Worker Thread NUMA Node Switch",
        "SessionDigestErrorCount",
        "Denotes the intended usage of the storage pool.",
        "Select * from Win32_PrintJob",
        "HideTPMTroubleshooting",
        "PortableDeviceAPI_General Flag",
        "The Method of Reporting Informational Exceptions (MRIE) indicates the methods that shall be used by the target to report information exception conditions.",
        "PLATFORM_TRACE_TRACING",
        "ConnectionPolicy",
        "SDBUS_DEBUG_SDCMD",
        "ScheduleInstallAt",
        "0 - Successful completion, no reboot required",
        "HKEY_CURRENT_USER",
        "Same as Main Mode",
        "If the voltage (in millivolts) drops below the value specified by Range2InputVoltageLow property, the UPS will compensate by boosting the voltage using its power source(s).  A value of 0 indicates that the voltage at which boosting occurs is 'unknown'.",
        "An abstract class defining the common properties of the policy managed elements derived from CIM_Policy. The subclasses are used to create rules and groups of rules that work together to form a coherent set of policies within an administrative domain or set of domains.",
        "CI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "\\\\.\\root\\Microsoft\\UEV:__Win32Provider.Name=\"ConfigurationProvider\"",
        "IniFile",
        "Support Parity Check",
        "PEUUUUUUUUUUUUUUUO",
        "Target Removed",
        "Normal account",
        "The ForwardBufferMemory property indicates how much memory IP allocates to store packet data in the router packet queue. ",
        "This field represents the model number of the hardware. For physical disk it must match the disk's SCSI inquiry data.",
        "DoPacketLogging causes a log message to be generated when the action is applied to a packet.",
        "C_290F6F8B3B7EAA26E7735FACB33E9185DC97B5AF85F7FE15A4C9FA4C0EBACD95",
        "Specifies the mime type currently being used by the Printer if the CurrentLanguage is set to indicate a mime type is in use (value = 47).",
        "Job Started",
        "{8F680851-A584-11d1-BF38-00A0C9062910}",
        "{A524EE6E-DB29-11d2-85FC-0000F8102E5F}",
        "Offline - The specified computer is offline or unavailable.  ",
        "An array of free-form strings providing more detailed explanations for any of the entries in the ServicePhilosophy array. Note, each entry of this array is related to the entry in ServicePhilosophy that is located at the same index.",
        "MGR_TRACE_DEVNODE",
        "Localized version of RSOP_PolmkrProSetting for American English",
        "Paused",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_171DF71ABD7C6A7DF03D4AFA73A2CE1BA658B66016A9DF4DAB148F781BE2851A",
        "Send the configuration document to the managed node and save it as pending.",
        "UpperThresholdCritical",
        "The destination prefix to be filtered.",
        "SM_GetFCPhyAttributes",
        "{7311AD03-18D6-45ac-9B08-B020BDD6A590}",
        "Number of Buffers Lost during collection",
        "NominalReading indicates the 'normal' or expected value for the NumericSensor.",
        "{8502C52C-5FBB-11D2-AAC1-006008C78BC7}",
        "C_2A5B35A7EDFDEFF055BB37FDA6DE592042B6B41AB95D0C58AFFCA90EFB735B71",
        "ref:Win32_Bus",
        "C_44B2B33F232E78585BC06F82C484DB1BDFCFCAAFCAC5D29C12B11CCF8EE5BA88",
        "DOT11_ISF Flag",
        "TState Handler",
        "XOnCharacter",
        "MIF.DMTF|Memory Device|002.15",
        "Contains the string data value for the named value. ",
        "EnableSharedPCMode",
        "C_057DBED191A93075F16FF3FD87CBC67F17C999F14E2DB4CC2AED9F24BB4E2107",
        "DisableRealtimeMonitoring",
        "R_C21E8ECEFF103DE2D58A051FBB124028D9968F5617844FDA582F260A7956CF1E",
        "Embedded class that describes the  properties of a virtual port.",
        "SET_ERROR_SOURCE_INFO",
        "40021",
        "CD_F329A9AA0CD7A7CB8F5B766F435284C69A84B4ACBC92612E21AD74FFB8C0C1F1.1594.988265671.411",
        "Voice Encapsulation",
        "EventTrace",
        "LowerThresholdCritical",
        "Version2",
        "The Control property indicates whether this COM component is an OLE control.",
        "MIF.DMTF|System Slot|004.9",
        " This is an identifier for this software element and is designed to be  used in conjunction with other keys to create a unique representation.",
        "The user-friendly interface name.",
        "DirectAccessEnabled",
        "The Name property indicates the name of the boot configuration. It is an identifier for the boot configuration.",
        "<LocalID> is chosen by the organizational entity and SHOULD not be re-used to identify different underlying (real-world) elements. If the above 'preferred' algorithm is not used, the defining entity MUST assure that the resultant InstanceID is not re-used across any InstanceIDs produced by this or other providers for this instance's NameSpace. ",
        "The Default property indicates whether this POTS modem is the default modem on the Win32 computer system.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1607.1989036250.180",
        "C_B49D54127CB3DDDF22487111FC3067928F0BA3A9AC1665011AEC9D08EE1BCDEC",
        "CD_FDBDC2AD47D9111246F3C36A212EEF164FF61E31A8B334E0CB50FB22BA107100.75.2460139752.1017",
        " Windows 2000: This logon type preserves the name and password in the authentication packages, allowing the server to make connections to other network servers while impersonating the client. This allows a server to accept clear text credentials from a client, call LogonUser, verify that the user can access the system across the network, and still communicate with other servers. /nNew Credentials - Windows 2000: This logon type allows the caller to clone its current token and specify new credentials for outbound connections. The new logon session has the same local identify, but uses different credentials for other network connections. /n",
        "OriginalPath",
        "SinglePhaseInDoubt",
        "Userupn password pair. E.g. x@y.com;pwd1",
        "ror 0x",
        "{8502C587-5FBB-11D2-AAC1-006008C78BC7}",
        "The ExternalReferenceDesignator property indicates the external reference designator of the port. ",
        "CD_98B52A08A953316DB082D59EC1D28C173ED16648A244894BFBE6E9E36C229250.1215.1.8413",
        "The Win32_Subdirectory class represents an association between a directory (folder) and one of its subdirectories (subfolders).",
        "Kernel memory dump",
        "An integer array indicating the types of paper supported.",
        "CD_498190A28B0F3E8C8B0AFCFFAE238D6B691B0B57B3836158124AC145A7281391.1209.898114835.753",
        "Percent Free Space Fragmentation",
        "\\\\.\\Root\\StandardCimv2:__Win32Provider.Name=\"NetSwitchTeam\"",
        "This property is a reference to the instance of a job object.",
        "HideHibernate",
        "NDIS Query NIC Switch Current Capabilities",
        "The part component.",
        "{0A59C856-E3D4-11d2-8601-0000F8102E5F}",
        "Debug Flag",
        "SCSI (A) Low-Density (50 pins)",
        "Thin provisioning threshold reached",
        "ProtectKeyWithNumericalPassword",
        "Pool Tag",
        "Number of days to retain configuration status history.",
        "Specifies the total number of page faults encountered by all active processes associated with the job, as well as all terminated processes no longer associated with the job. ",
        "DisableScriptScanning",
        "Read errors corrected by the storage device.",
        "MSNdis_StatusDot11RoamingCompletion",
        "IL_98233BC0D6E21C2CA3187CB9E2307592DF6D759478E209568F3CA340985F3F72.1163.1217761889.326",
        "Number of elements in LoadBalancePolicies array",
        "BrokenConnectionAction",
        "MSFT_StorageEnclosureToPhysicalDisk",
        "WlanGPClientGuid",
        "The locale-independent name for the group that this set belongs to.",
        "MSNdis_ReceiveFilterCapabilities",
        "Percent File Fragmentation",
        "Type of event",
        "CD_DD1327FC08EE6F810BD5622CD5EFD1804CFB8E69E3B82381F2E13055AC3B4DBB.42.2748646308.648",
        "IL_FF125414713AEFB3BE9B36BF5067B839DE545A44FB053F1F2696CC7ADC1B48DA.2458.1605326835.287",
        "CONFIG",
        "MSFT_NetIPsecIdentity",
        " 2 - Free ",
        "The SystemVolume property indicates whether the volume contains the hardware specific files required to start the operating system.",
        "C_3863CF198183B50B73BF68A52390640EB8E4B2490D653E0A1079EFA26ABECE5A",
        "The ProcessID property contains the process identifier of the process to which the thread belongs.",
        "MSFT_SomFilter",
        "MSChangerParameters",
        "Range 1",
        "NX Enabled",
        "Protect iSNS",
        "DisableHomePageChange",
        "AllowCloudProtection",
        "SamGetDomPwdInfo_End",
        "MSFT_NetAdapterVmqElementSetting",
        "TL_ERROR",
        "{73553260-DB22-11d2-85FC-0000F8102E5F}",
        "Enables or disables overriding user's maximum color settings.",
        "Precedence ",
        "C_DA2B7733DF2BD3EF26A98D0C67C53F3AE08EF07915BF46D535095C4431D97FF1",
        "MIF.DMTF|Partition|002.7",
        "GetBinaryValue",
        "ref:Endpoint",
        "Indicates the firmware revision represented by firmware in slot",
        "Recommendation.ITU|X733.Correlated notifications",
        "MIB.IETF|HOST-RESOURCES-MIB.hrSystemNumUsers",
        "ContentRetrievalUrlReservationEnabled",
        "WHERE jobid=#",
        "require that B,C, and D occur either as B,C,D or as B,D,C. Action A may appear at any point relative to B, C, and D. Thus the complete set of acceptable orders is: A,B,C,D; B,A,C,D; B,C,A,D; B,C,D,A; A,B,D,C; B,A,D,C; B,D,A,C; B,D,C,A. ",
        "MSNdis_QueryReceiveFilterCurrentCapabilities",
        "MaintenancePeriod",
        "OsVersion",
        "6 = Forced upgrade of locally installed application at logon. ",
        "IR_51C5ECC9391A52C9234FFF83EC435E9F3B07EA72829CDCC46218519D4A4947A9",
        "Win32_ComClassAutoEmulator",
        "winrm",
        "LAN Error",
        "Win32_PowerSetting",
        "Unique Detection ID (GUID)",
        "Time to Live",
        "L_EFEB887E59EC8D83C39D53CCF57EF6AD0D608FCDC88B6F50F3452B5EEBD4BF9F.597.1.47802",
        "C_5ACAF83AC17F3EA7F1672F287BF1DD774125A890420CE4F482AACA090A7C6160",
        "Win32_ShadowStorage",
        "C_155D9E7AE6D9F85361D5CC740FA1EFEDE91BCBF995E255746E05290A3497CB99",
        "ref:MSFT_NetIPInterface",
        "HNet_BridgeMember",
        "Critical Section Event",
        "AutoReboot",
        "CD_2DAA673000997F2F80951132F7F329F238406732862099A85474AE8120F4176F.1193.1480168656.256",
        "Wireless",
        "CR_FFEA4821B3229778E02955009800D7C28902CA2F2FADA0207E76D6E1DC9438B2",
        "IL_3E78A37E1DE70357C353A15D6BBB8A17A1D31F8D501ED8F1C3EB8104F5B04F97.299.1936312436.336",
        "The user name of the logged on user when the event ocurred.",
        "NumberVirtualPorts",
        "SMBIOS|Type 23|System Reset| Reset Limit",
        "IpOptions",
        "MsftDiscFormat2StreamConcatenate_DebugDestructor",
        "CIM_PhysicalFrame",
        "CR_5CC5CF05A7A1041C246328BDD1081AC6C5D60C48F12D405A2F1C3A3CF42897DE",
        "The given page number has not been implemented.",
        "ROOT\\Microsoft\\Windows\\PS_MMAgent",
        "ref:Win32_NamedJobObjectSecLimitSetting",
        "AllowTailoredExperiencesWithDiagnosticData",
        "OcpVersion",
        "CertThumbprint",
        "CD_5D2C2C389F5259E45332A86ADEF5107186DA3990C071FED897FC6FAECC4A4DBE.1999.4234012363.1759",
        "Example: Port Connector 1",
        "C_20A36A4D13FFEDA4F3BF68F20D7254C0839ABA34ECA738010C8AC2B49156D61F",
        "Auto Mount Enabled",
        "R_E67DF64CBE3D01A3E33D2078FC61C5DAF3C494C4A4DFFEC9CB77DA207B5AEF2D",
        "The required service.",
        "Distinguished name for the first domain in the forest that contains the domain of which this directory server is a member",
        "NdisPhysicalMediumTypeEx",
        "The TotalTracks property indicates the total number of tracks on the physical disk drive. Note: the value for this property is obtained through extended functions of BIOS interrupt 13h. The value may be inaccurate if the drive uses a translation scheme to support high capacity disk sizes. Consult the manufacturer for accurate drive specifications.",
        "AS400 Family",
        "This is a singleton that represents the Microsoft Antimalware service status",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|Tone",
        "QOSWMI_TRACE_POLICY Flag",
        "Circuit Emulation Service",
        "SamSetInfoDom",
        "2 = User Installed through Add / Remove Programs, ",
        "The SupportsConnectData property indicates whether the protocol allows data to be connected across the network.",
        "Inches",
        "Temperature (in tenths of degrees Kelvin) at which the OS must shutdown the system (ie, critical temperature)",
        "Example: All Users:Accessories\\System Tools",
        "SERIAL_WMI_PERF_DATA",
        "DSAccess_AuditDirectoryServiceAccess",
        "UserData",
        "Name of the ETW trace session to get.",
        "pixels per inch",
        "preLogon",
        "MI_ERRORCATEGORY_LIMITS_EXCEEDED",
        "DataCacheExtension",
        "VPD83Type2",
        "dwProvCapabilities",
        "ClassName",
        "DisablePerProcessDpiForApps",
        "CD_0783FC4315F6719B07F6F7780EAC7B73D0B0471C3E21E23BC45CB6B44FFECA8E.2751.1.9646",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|High Threshold On Events",
        "LetAppsAccessTrustedDevices_ForceDenyTheseApps",
        "   ISCSI_NO_AUTH_TYPE = 0,",
        "UsedSpaceOnly",
        "MDM_Policy_Result01_SystemServices02",
        "UUUUUUUUU",
        "I_E7C8D1A4E2346FFDEE37907DDFF48B4344B5DAFEE4B2DF86123B0112A39FA3BD.1929.3453402987.280",
        "The boot service.",
        "10     This device cannot start. ",
        "// This class is recommended. ",
        "The Antecedent reference represents the Plug and Play device controlled by the driver.",
        "scriptOrder",
        "PDUReceived",
        "IL_F023674AFA828B66F95ECE31F54E284BD33C3FE845D503CD7E6993EC70473BF7.1606.1049670122.283",
        "Aperture base",
        "MaxCalleeData",
        "{F25FE466-783E-11d2-90BF-0060081A46FD}",
        "The enclosure does not support identification of the enclosure element.",
        "EstimatedRuntime",
        "I_08E313D6BEB715DCDA53AC878FDC8CA32051886D2F14D1D12E5D2D43CCDB0398.2703.2929144872.290",
        "Indicates the set of services that are running.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.137043534.223",
        "MDM_Certificate",
        "HOSTPROC_TRACE_IOTARGET Flag",
        "Rsop Logging Mode Provider",
        "0xEFFF004C",
        "CIM_SoftwareInstallationService.InstallFromURI",
        "HOSTPROC_RESERVED_1e Flag",
        "C_FDA51E5A7FEC04F05BA768B870478212830881C45AE5889BF118736487DE2187",
        "MaxReadable indicates the largest value of the measured property that can be read by the NumericSensor.",
        "ProcessorAcpiCsd",
        "Certificates",
        "WPDCI_feature1 Flag",
        "OtherDedicatedDescriptions",
        "Data Write",
        "windowsdefender://",
        "TRACE_FLAG_QUEUE",
        "The Win32_TSRemoteControlSetting class defines the configuration for Win32_Terminal.  This includes capabilities such as Remote Control policy.",
        "PolicySourceProgramList",
        "QuantumLength",
        "The MaximumAllowed parameter passes the limit on the maximum number of users allowed to use this resource concurrently. /nExample: 10.",
        "{307a1805-daa2-454b-93fa-97241bb1aed5}",
        "ReconnectIPV4",
        "Win32API|Service Functions|ChangeServiceConfig|DeleteService",
        "CIM_HostedJobDestination",
        "DOT11_MISC Flag",
        "CD_80F94DB344488EBD67AC92604B50AD923B5145AED16129FD8EE9CB5A5BECF89F.1978.1.14185",
        "I_E0F2EFD539B7928A3CD461462D4CD79A5C30C390909F42CDB98D7B4B987E4A6E.715.1.265536",
        "The Win32_ComputerSystemProcessor class represents an association between a computer system and a processor running on that system.",
        "NdisFddiTypeLocalB",
        "FullChargeCapacity",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.2236362174.368",
        "CD_27A364644C1B83931E072B22EAC45B45C2531EB36360F82204598576E1DF4301.2461.1164011196.3812",
        "SPACES_VirtualDisk",
        "If TRUE, the storage job will be automatically deleted after a short time interval.",
        "Accessibility",
        "VxWorks",
        "When enabled the reply on the channel will be send asynchronously.",
        "Minimum block size supported",
        "{C100BECE-D33A-4A4B-BF23-BBEF4663D017}",
        "LogFlagService",
        "CreateJob",
        "MSFT_MpEvent",
        "0x00020000",
        "The LocalServer property, if applicable, defines whether the server supports localserver32 activation.",
        "Directory Service (DS) flag indicating that the domain controller hosts a write able DS or Security Accounts Manager (SAM).",
        "Win32_1394ControllerDevice",
        "SetDynamicDNSRegistration",
        "Vertical sync pulse width",
        "EnableNetworkProtection",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|ErrorControl_Off",
        "MIF.DMTF|Electrical Current Probe|001.6",
        "The major version of network adapter driver.",
        "The SocketDesignation property contains the type of chip socket used on the circuit.",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Netbt\\Parameters|EnableLMHOSTS",
        "The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined.",
        "0xEFFF005C",
        "Function enter/exit",
        "MaxBufferSize",
        "T41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "ISCSI_ERR_INVALID_TARGET_CHAP_SECRET",
        "A short textual description. ",
        "MSNdis_ReceiveBlockSize",
        "MSiSCSIInitiator_SessionClass",
        "The SupportsFileBasedCompression property indicates whether the logical disk partition supports file based compression, such as is the case with NTFS. This property is FALSE, when the Compressed property is TRUE.",
        "ROOT\\Policy",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmDitherType",
        "The Setting reference represents the configuration settings used on the network adapter.",
        "TemplateDescription",
        "DiskScore",
        "C_DBBAB694252A8FA02CC578AF6A541FC3E6E5ABF42798173F7194B1B5ACA4AE8A",
        "TxRRollback",
        "RDUGroup",
        "RequiredCommandLine",
        "Maximum amount of time, in seconds, dirty lines or buckets may remain in the cache before they are flushed. A value of zero indicated that a cache flush is not controlled by a flushing timer.",
        "IsPrimary",
        "CD_A23491B3C9DD8481EBD1370ABF1AD298CC29F6DA303209600E83B50112688260.2460.1309280638.3537",
        "CR_286D3AAA59AE00C2CF7EBCC4AB344CD2AFDCE3C2B408154E04E7644656DAE408",
        "UTC Time",
        "RecordNumber",
        "I_5B2FF6892109B8F6F172D6625542DC7633A3301F54DF5C58F0D3FD2969597405.304.739416858.189",
        "Perform the file operation even if it will destroy content files or directories.",
        "C_B8353D57A57BDAADE8E1FD8BF3D42DAAD04CAB50536C3870BE8C32D1CA4CBD9D",
        "CD_55AF22A4D3FD212FC3171AADE7109F17F27CA9F86C291AE560CF90E7D047839B.1466.558717046.1324",
        "KerbInitSecurityContext_Start",
        "Represents the total output power of the PowerSupply in milliWatts. 0 denotes 'unknown'.",
        " Meaning ",
        "ADSite",
        "ext highest precedence application.  ",
        "String Value",
        "0x002000",
        "TraceFunc",
        "Time when this CSE was last invoked.",
        "Composite Groups",
        "ResponseArray",
        "CIM_CompatibleProduct is an association between products that can indicate a wide variety of information. For example, it can indicate that the two referenced products interoperate, that they can be installed together, that one can be the physical container for the other, etc. The string property, CompatibilityDescription, defines how the products interoperate or are compatible, any limitations regarding interoperability or installation, ...",
        "WDF_ISR",
        "2.8.1000",
        "ref:CIM_VideoBIOSElement",
        "Range1InputVoltageHigh",
        "KeyUpdates",
        "PacketLoggingActive causes a log to be kept of traffic processed by the SAEndpoint.",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"RouteProvider\"",
        "AllowUserToResetPhone",
        "NDISCompatibility",
        "The Copies property indicates the number of copies to be printed. ",
        "3 - 'PrepareInProgress': Preparation for Replication is in progress and the Copy engine has started. ",
        "{4a4df982-2068-11d4-97eb-00c04f79c403}",
        "25 - CIM_ERR_FILTERED_ENUMERATION_NOT_SUPPORTED. Filtered Enumeratrions are not supported.",
        "IPXEnabled",
        "AllowPublishingRefreshUX",
        "The IPv4 address that this ProtocolEndpoint represents.",
        "0xEFFF000C",
        "Encoding format for host names in the DNS query.",
        "Select * from Win32_LogicalDisk",
        "The maximum time for the lease operation to complete before timing out.",
        "Contains the security descriptor to set on the key name. ",
        "I_82D62EACB411F46C88EF11FE5A18F1088AEDA0897AD63F2947178230B7AF5724.1780.1849282648.338",
        "3:ACTION D ",
        "AverageFreeSpacePerExtent",
        "DriverDescription",
        "CD_9B76BE6116634D98E523DAF9A0AD948B4D742F1F76F465B3DDA5D1B7EF1C7F0E.1201.2396054252.390",
        "CIM_ComputerSystemPackage",
        "OffsetFirstPort",
        "IdealProcessorAdjust",
        "11004",
        "\\\\.\\root\\Microsoft\\Windows\\Storage\\Providers_v2:__Win32Provider.Name=\"wsp_sr\"",
        "AccountModel",
        "{71F3A4A2-DC3F-4AD1-A1AD-81E2109D4414}",
        "FlightIds",
        "MSNdis_StatusProtocolBind",
        "Changer Data",
        "MDM_Policy_Config01_Troubleshooting02",
        "Media Write Protected",
        "The XOnXMitThreshold property specifies the minimum number of bytes allowed in the input buffer before the XON character is sent. This member works in conjunction with XOffXMitThreshold to regulate the rate at which data is transferred.",
        "AgentWWN",
        "77 - Invalid system path",
        "SM_RemovePort",
        "TransitionOnline",
        "The SlotDesignation property contains an SMBIOS string that identifies the system slot designation of the slot on the motherboard.",
        "DeviceID is an address or other identifying information to uniquely name the logical device.",
        "\\\\.\\root\\StandardCimv2:__Win32Provider.Name=\"NetTtCim\"",
        "CR_88951EE85045E3B94CBE9BC71EF70777E4B05816F4BF59A02A284DEFD098F378",
        "NETIO_TRACE_LEGACY Flag",
        "Activated",
        "Service Must Have Completed",
        "Prepare",
        "Block type",
        "MSFT_NetServiceNotInteractive",
        "WebMessageEncodingBindingElement",
        "al disk.",
        "KMDFv1 Trace Provider",
        "LPC_TRACE_RESERVED_12",
        "MSFT_NetAdapterPowerManagement_WakePattern",
        "The Encrypted property is a boolean value indicating that the file is encrypted.",
        "This method allows a user with sufficient privileges to set the security descriptor that control access to this specific object instance. If the call is not made in the context of a user specified in the security descriptor's access control list, this method will fail with 40001 - 'Access Denied'. If an empty security descriptor is passed to this function, the behavior is left to the specific implementation so long as there is some user context (typically domain administrators) that can access and administer the object.",
        "ISCSI_ERR_ISCSI_PDU_ERROR",
        "SPARC Family",
        "EnableDA",
        "DebugPrint_Event",
        "Example: %systemRoot%\\Memory.dmp",
        "ref:CIM_StorageExtent",
        "CIM_ERR_INVALID_ENUMERATION_CONTEXT",
        "{f59d1d86-cc03-4736-bc9c-4c7936871b3d}",
        "Minimum VSync numerator (in Hz)",
        "Force installation",
        "senseInfoBufferLength",
        "CIM_AssociatedBattery",
        "WSP_FileShare",
        "DigestDebugTrace",
        "Is this a fast IO operation",
        "Non-Toxic Leak Detected",
        "MDM_Policy_Config01_ControlPolicyConflict02",
        "Localized version of RSOP_PolmkrShortcutSetting for American English",
        "The revision number component of the current BIOS version information.",
        "WPD_TRACE_LEVEL_FUNCTRACE",
        "HBA_PORTTYPE_FLPORT",
        "EnableControlledFolderAccess",
        "Win32",
        "ProcessorGroup",
        "instanceGuid",
        "The MiniDumpDirectory property indicates the directory where small memory dump files will be recorded and accumulated. ",
        "RDMAInOctetsPerformanceCounterMissing",
        "Win32_QuotaSetting",
        "SendSRL",
        "iScsiDebug29 Flag",
        "Supplies the key confirmation key (KCK).",
        "ObjectPath",
        "MIF.DMTF|Monitor Resolutions|002.2",
        "Power Meter Event",
        "WQL Filter",
        "_DH_WMP_CDBURN Flag",
        "Receive Failure",
        "{9B81340A-E3D3-11d2-8601-0000F8102E5F}",
        "56002",
        "SCO UnixWare",
        "Example: \\\\NTRELEASE.",
        "ErrorsLogon",
        "ClassificationAtIsrSupported",
        "CIM_RemoteServiceAccessPoint.OtherInfoFormatDescription",
        "The ProtocolAddressResolved property contains the resolved address corresponding to the ProtocolAddress property",
        "Current ACPI Cooling Mode",
        "IRQ trigger level indicating whether the interrupt is triggered by the hardware signal going high (value=4) or low (value=3).  Also, \"Other\" (1) and \"Unknown\" (2) may be defined.",
        "SocVersion",
        "C_0B9091A7705333E08909D2D04FE2D8C67B717AD489BDF891C00D458657EAF4C7",
        "The prior action.",
        "The Msft_WmiProvider_InitializationOperationEvent event class defines the successful initialization of the provider server instance. Following activation of the provider server, the WMI will attempt to initialize the instance provider through a number of COM interface method calls. ",
        "MSDAREM.1",
        "READ_CONTROL (0x00020000) ",
        "NetworkPipe is a subclass of EnabledLogicalElement, representing the state and management of a connection or trail between endpoints. This object is different than the association between the endpoints (CIM_ActiveConnection) since the emphasis is NOT on the endpoints but on the management of the pipe itself - its state, configuration, etc. NetworkPipes are defined in the context of a CIM_Network and represent the \\'transfer of information . . . between . . . endpoints\\'. These concepts are aligned with the definition of the Pipe object in ITU\\'s M.3100 specification.",
        "Unique Detection ID",
        "R_CA638CFE13399694BAC2F76CEBB7B08DC881413B47D24732FDCE6DA8A0FBB80C",
        "TraceIoctl",
        "MSNdis_QueryReceiveFilterParameters",
        "This property holds the name of a PolicyAction contained by one or more PolicyRules.",
        "The Enabled property indicates whether or not the on-board device is available for use.",
        "Number of device configurations that are defined for the Device.",
        "C_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937",
        "Strings describing the various OperationalStatus array values. For example, if \"Stopping\" is the value assigned to OperationalStatus, this property may contain an explanation as to why an object is being stopped. Note that entries in this array are correlated with those at the same array index in OperationalStatus.",
        "Internal Status",
        "MDM_AppLocker_DLL03",
        "The height of the physical package in inches.",
        "The startup status of the AutoLogger; Otherwise win32 error code.",
        "5 - CIM_ERR_INVALID_CLASS. The specified Class does not exist. ",
        "Denotes the current health status of the storage pool. Health of a storage pool is derived from the health of the backing physical disks, and whether or not the storage pool can maintain the required levels of resiliency.",
        "QueryDomainInfoPolicy_End",
        "Private Interface",
        "SourceFolder",
        "Authentication Method: Preshared Key",
        "{d837ca92-12b9-44a5-ad6a-3a65b3578aa8}",
        "Print",
        "Output",
        "Win32_PnPDevicePropertyUint16",
        "8-way Set-Associative",
        "RemoveData",
        "QPIncomingWrite performance counter missing",
        "SetTcpMaxConnectRetransmissions",
        "This indicates whether PMK caching will be used.",
        "24     This device is not present, is not working properly, or does not have all its drivers installed. ",
        "// supports IPSEC.",
        "The local port used for the connection",
        "MessageDescription",
        "65006",
        "SourceStorageFaultDomain",
        "OutboundTransactionsEnabled",
        "SystemBiosMajorVersion",
        "ENABLE_OFFLINE_DIAGS",
        "Win32_PhysicalMemoryLocation",
        "7 - The service did not respond to the start request in a timely fashion.",
        "CR_E991E45745117956DEAFF1C67CF04DB972E8AC05E236ED8130C434E25D63E63D",
        "WD_LOG_FLAG_INIT",
        "DriveLetter",
        "LetAppsAccessEmail_UserInControlOfTheseApps",
        "CIM_BasedOn",
        "MCA_ERROR_PCI_BUS_TIMEOUT",
        "S0WakeupSupported",
        "C_8FC7E2EF8F90B92553B020FE4923ECFD22B98AADF22BDC0FF9332DE6A3457F87",
        "CD_7F6515E2EBD9049AE896B25B99B1906533354EA0DB3289C03EFADA9D23B196C7.1671.3825878562.235",
        "Average power consumption in the idle state [milliwatts]",
        "iSCSI target portal group",
        "An array of MAC address and VLAN ID pair filters set on the VPort.",
        "CD_6603235838D67F0A31998AE108546BB74586B33844F47241F23AECE3061C708F.1714.3548896070.344",
        "Select * from Win32_NTLogEvent",
        "MIF.DMTF|Serial Ports|004.7",
        "Capabilities and management  of a PCMCIA controller.",
        "Real64",
        "ProcessorFamily",
        "EVENT_TRACE_FLAG_FLUSHBUFFERS",
        "The count of KMS requests from clients with License Status=5 (Notification).",
        "No Lower-Level Composition",
        "WPD_F5 Flag",
        "The size of the cache file on disk, in bytes",
        "This method allows the replication group to be renamed.",
        "The maximum number of Quick Mode SA's that may be established with this SA before it must be renegotiated.",
        "object:MSFT_NetAdapterPowerManagementSettingData",
        "This is an all-in-one state data that uses an XML format with a standard CIM DTD schema",
        "C_629122007ACBC01F5C89876FEF5BF24FCF799FAC8975CF22D2EEA155F3C49ACF",
        "MIF.DMTF|Dynamic States|001.2",
        "DnsClientPolicyConfiguration",
        "DSC proxy to get resource state from local DSC service.",
        "CD_D5D74C06622314233E53DDBA8B2858E9C39F19EA4E9C34576583CC8C5481468C.1050.209351608.3300",
        "PNRPHLP Flag",
        "Association between iSCSISession and Disk",
        "System timer",
        "Enables a binding to a network adapter.",
        "Reset the Teredo configuration.",
        "Win32API|Process and Thread Structures|STARTUPINFO|wShowWindow",
        "R_62C8891E57F68B5018AA739FA2F9A6FA324F5514D7DD621D65681F6B7E0BBD4F",
        "TargetReplicationGroupFriendlyName",
        "Small Business",
        "Read EDID v.1.x descriptor block",
        "Physical connection ports management.",
        "Number of responses received",
        "ref:Win32_PhysicalMemoryArray",
        "LUAInstall: error 0x00000005 setting flags [{c12a0aa6-acf8-4947-acf3-81bdce609353}]",
        "LogFlagSerialize",
        "Query Statistics Info",
        "This method removes the access path from the partition regardless of whether or not it is in use.",
        "CtlGuidWpdFs",
        "The BootupState property specifies how the system was started. Fail-safe boot (also called SafeBoot) bypasses the user's startup files. ",
        "Process Window Station",
        "The GetBinaryValue method returns the data value for a named value whose data type is REG_BINARY. The GetBinaryValue method returns a uint32 which is 0 if successful or some other value if any other error occurred.",
        "StringParameter",
        "DisableContextMenus",
        "2:ACTION B ",
        "CR_24CFB2B4CEAD5BE9188CC5001933580DC2746C05DE76A8DB6DD098D52E4B25F0",
        "{8502C53F-5FBB-11D2-AAC1-006008C78BC7}",
        "Modified date",
        "The User property indicates the user name for whom this startup command will run.",
        "Example: Seagate",
        "This class surfaces HBA port events",
        "object:BcdObject",
        "Association between StorageSubSystem and StorageFaultDomain",
        "Socket A (Socket 462)",
        "The Win32_DesktopMonitor class represents the type of monitor or display device attached to the computer system.",
        "This is a wrapper method used to change the BMC user password.",
        "TO_WWN",
        "    AllUserConnection (boolean) Specifies that the VPN connection is in AllUserConnection phone book entries.",
        "Log Area Reset/Cleared",
        "An integer enumeration defining the system cache associativity. For example, 6 indicates a fully associative cache.",
        "This method, for a given ReplicationType, returns the supported group features.",
        "PublishPrinters",
        "CpuUsagePct",
        "MSFT_FileServer",
        "Video",
        "Win32SDToBinarySD",
        "Indicates the accuracy of the sensor for the measured property. Its value is recorded as plus/minus hundredths of a percent. Accuracy, along with resolution and tolerance, is used to calculate the actual value of the measured physical property. Accuracy may vary depending on whether the device is linear over its dynamic range.",
        "Object already exists",
        "ServerUrlList",
        "Primary ISDN",
        "WD_LOG_FLAG_INTERFACE Flag",
        "NDIS ATM Maximum Active VCs",
        "CIM_Rack",
        "StopDiagnosticLog",
        "SPACES_StorageNodeToStoragePool",
        "Win32API|SCSI Structures|SCSI_REQUEST_BLOCK|PathId",
        "NumberOfDrives",
        "ref:MSFT_NetAdapterQosSettingData",
        "\"Unknown\" (0) - The implementation can not report on HealthState at this time. ",
        "Size Not Supported",
        "Identifies the configured clock speed to the memory device, in megahertz (MHz) If the value is 0, the speed is unknown.",
        "The FullName property indicates the full name of the local user./nExample: Thomas Williams",
        "RSOP_PolmkrFolderOptionsSetting",
        "The InfName property is the name of the Inf file which installed this device e.g. machine.inf ",
        "C_D1F35069AB830308A3D10C95EC411D258E0A9CAA2EE0311B34E2874304803008",
        "Restore operation requires subsequent fracture",
        "CD_4C51C80A2BAFAD3102FF110F62EC213D34DD3E23F9AFBD5B7FE6DAFCFBF7A94A.98.1758378749.1908",
        "ControlledByDHCP",
        "Used to determine the scheduling priorities of the process's threads",
        "SDBUS_DEBUG_CARD_EVT Flag",
        "Where <OrgID> and <LocalID> are separated by a colon (:), and where <OrgID> must include a copyrighted, trademarked, or otherwise unique name that is owned by the business entity that is creating or defining the IndicationIdentifier or that is a recognized ID that is assigned to the business entity by a recognized global authority. (This requirement is similar to the <Schema Name>_<Class Name> structure of Schema class names.) In addition, to ensure uniqueness <OrgID> must not contain a colon (:). When using this algorithm, the first colon to appear in IndicationIdentifier must appear between <OrgID> and <LocalID>. ",
        "MSFT_DSCConfigurationOutputWhatIf",
        "Specifies relative queue priority.",
        "Routine",
        "DupACK",
        "Acquire For CC Flush",
        "Unmanaged",
        "FallbackSecure",
        "Indicates the current operating conditions of the virtual disk. Unlike HealthStatus, this field indicates the status of hardware, software, and infrastructure issues related to this virtual disk, and can contain multiple values. Various operational statuses are defined. ",
        "Query Ports on an Adapter",
        "0x206",
        "Reserved Field #2",
        "Denotes the version of this storage pool.",
        "Decoupled:Com:FoldIdentity(false)",
        "StateTrace Flag",
        "The previous self-test completed having the read element of the test failed.",
        "RequireDeviceEncryption",
        "select * from MSFT_SCMEvent",
        "CIM_VideoController.CurrentScanMode",
        "{E5639664-C4FC-11DA-82C4-000D5692A4BC}",
        "Dithering with a coarse brush. 3",
        "A logical device may use or require one or more batteries. This relationship is described by the CIM_AssociatedBattery dependency. It is also possible to model the individual batteries that comprise a UPS, using this association.",
        "UserStackBase",
        "- operating system components such as files, processes, and threads ",
        "HttpDigest",
        "LPCDRVR_TRACE_RESERVED_1b",
        "Default network fairshare weight for user session, valid number is 1 to 9",
        "CD_F048CF2C454CB8BAA99C1A4118013AD0A4526AC70F8F00D9BC60DB068406C882.1088.790594590.760",
        "RefreshMode",
        "This is an abstract base class for Hiperf provider",
        "KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "NatOutboundAddress",
        "{5f7c4ba5-d6a4-4625-900e-48fa7811e06a}",
        "C_5F3A7D47CFF70177272CA0960C1975D28A99D9A71A82E07B0FC43A060E86CD93",
        "Specifies whether FastReconnect is enabled or disabled in current configuration for PEAP.",
        "NumberOfInterruptMessages",
        "2-way Interleaved Stereo with Left Image on Even Lines",
        "CIM_RecordLog.InstanceID",
        "HOSTPROC_TRACE_INIT Flag",
        "{5ff6d537-9404-4324-9cba-f704aa329e01}",
        "The ProviderOperation_GetObjects property indicates the number of calls to IWbemHiPerfProvider :: GetObjects.",
        "I_43B7B69F919BB681DCC1079E7BED6BA29BBE6F4DDA8822130874E698F9F22509.1105.634992381.277",
        "The logical device being cooled.",
        "Tuesday",
        "OneXCacheUserData",
        "CD_FE3903A8A6E3E4819A9E93424E0AF9D5DF66EE46BB5392D0B1F436145A771C95.1569.3728724716.1960",
        "The power state to set.",
        "SMBIOS|Type 4|Processor Information|Processor Type",
        "Windows Version",
        "{6E78DAD9-E187-4d6e-BA63-760256D6F405}",
        "InterpretationOfFalse",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|Reset",
        "Minimum Working Set Size",
        "MSADOX",
        "CIM_PotsModem",
        "NONGENUINE",
        "FX_TRACE_API Flag",
        "Fully qualified computer name from which to restore packages",
        "TrustedTime",
        "Example: 1024  ",
        "CD_E2929E24A4D3F33074BBFC9EB2E285BE087B76057F553B22FB5CA19B172B3C4A.18.3433884882.471",
        "0x00000005 setting flags [{987",
        "ref:Win32_MappedLogicalDisk",
        "MsftDiscFormat2RawImage",
        "TR_SM Flag",
        "TcpConnectionPoolSettings",
        "CIM_ComputerSystem.OperationalStatus",
        "PrinterPaperNames",
        "PnP Flag",
        "Specifies an array of storage objects of the same type that are the source elements to be replicated. The ordering of this arrary determines the consistency ordering of the element replicas.",
        "Removable media other than floppy",
        "Acpi XPSS State",
        "EVENT_TRACE_FLAG_SETINFORMATION",
        "For DMTF defined instances, the 'preferred' algorithm MUST be used with the <OrgID> set to 'CIM'.",
        "HBA_PORTATTRIBUTES",
        "RSOP_IEEE80211PolicySetting",
        "Example: Bldg. 38, Room 1164",
        "SupportsXOnXOffSet",
        "ResolveAddressNames",
        "Association between VirtualDisk and VirtualDisk Snapshots / Clones",
        "3.5,  2.88MB, 512 bytes/sector",
        "ActivityID",
        "Storage Object on which the health report will be collected.",
        "WMIEvent",
        "IsStatic",
        "Debugger Enabled",
        "SamIdByName_Start",
        "EVENT_TRACE_FLAG_LOCAL",
        "LastTransitionResult",
        "R_48394ACFDBF2997914E68DA01913B5FBD80163B4632D972FB942C9D9BEF7EC87.290.3894672325.516",
        "QuotasRebuilding",
        "No Multicast",
        "CD_8105231C8A3F2DF94C9C7F6EBD5BD2604617F4A36486778B9E1603208DF83C44.37.798697673.411",
        "CTSOutflowControl",
        "CIM_DeviceErrorData.LastErrorCode",
        "The operating system's number for the disk that contains this partition. Disk numbers may not necessarily remain the same across reboots.",
        "The type of name used in CertName.",
        "Real-time",
        "MilliSeconds",
        "The Manufacturer property contains the name of the manufacturer of the Plug and Play device.",
        "2FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "Protection Mechanism Failure",
        "REG_MULTI_SZ (7) ",
        "NetUse",
        "0xEFFF0001",
        "The Win32ShutdownTracker method provides the full set of shutdown options supported by Win32 operating systems.",
        "MSFT_StorageJobToAffectedStorageObject",
        "ProtectKeyWithAdSid",
        "Microsoft-Windows-NetAdapterCim-Diag",
        "MACsec bypass for IEEE 802.1Qbb Priority-based Flow Control is supported.",
        "This is an abstract base class for Hiperf provider / cooked counter provider",
        "The number of multicast packets received without errors through this interface.",
        "InPolicyFilesSize",
        "Amount off time spent writing to disk",
        "{d9c8eea5-f16e-467c-84d5-6345a22ce213}",
        "moveType",
        "Sets the minimum latency that must exist between client and server before transparent caching functions are utilized.",
        "Service Principal Name (SPN) for the LDAP server. Used for mutual authentication",
        "Select * from CIM_DataFile",
        "ODBC.1 formatted output (A)",
        "The SupportsElapsedTimeouts property indicates whether elapsed timeouts are supported on this serial port. Elapsed timeouts track the total amount of time between data transmissions.",
        "Current high level state of the action.",
        "C_C6D84B5CA01F8150DB538B389B0DE75D972173BB6246F791D5F0EBDC55AA7278",
        "CD_9729932C6A230E6D076D16A739C9C55BCFE9B5CECD58C2301470D12143397086.1929.352479938.328",
        "Number of items in list of 802.11 BSSI",
        "Indicates which Printer driver to Fallback to.",
        "Denotes whether this subsystem supports direct creation of volumes on a storage pool.",
        "Win32_LogicalDiskRootDirectory",
        "I_CF17F65BDE5D27AA83EF3274842254733535B217A340E131A413188964603E19.867.1.35696",
        "Handle Create/Close Events",
        "ref:Win32_SoftwareElement",
        "MSFT_NetAdapterEncapsulatedPacketTaskOffloadSettingData",
        "%Error% (%Error(0x%X)%)",
        "XPSS states",
        "The SetDWORDValue method sets the data value for a named value whose data type is REG_BINARY. ",
        "MaxStringContentLength",
        "Exact Color",
        "C_B293971E18EBDBA3E18E429E10AEDF13A0739F0E375B42373FB5BD3B45C3B92C",
        "Write Transfer Count",
        "EnumerateElements",
        "If 0 is returned, then the task completed successfully. Any other return code indicates an error condition.",
        "I_0BAE40148725A8BAC63C3127905070C22A7EA0559C443FE82181719B5F9296DA.2721.2455150711.270",
        "__EventDroppedEvent",
        "Defines the LSOv1 encapsulation settings for the Adapter.",
        "CD_7AD87B163E5F080E34E60018A0634DBE95115F38F1BC264D0B548D7507D9109E.1365.1458643283.2803",
        "Warnings such as allocation failure",
        "ResetCounter",
        "Api More Flag",
        "C93BE914E77155B6C",
        "Bytes Per Sector",
        "The PaperLength property indicates the length of the paper.",
        "UserAccountControl_BehaviorOfTheElevationPromptForAdministrators",
        "Unused4",
        "Indicates whether this physical disk is equipped to tolerate a power loss without loss of data.",
        "IKEProposal contains the parameters necessary to drive the phase 1 IKE negotiation.",
        "AllowFastReconnect",
        "{FAF76B9C-798C-11D2-AAD1-006008C78BC7}",
        "20 - 'Pending': The flow of data has stopped momentarily due to limited bandwidth or busy system.",
        "InitializeAsAdminFirst",
        "NumberOfSlots",
        "Msft_ProviderSubSystem",
        "8mm Tape Cartridge",
        "Unique Id for a resource instance.",
        "AIT Cartridge",
        "False - files on this volume will not be scrubbed.",
        "This device failed.",
        "__NotifyStatus",
        "Retrieves Name Resolution  Policy  Table configured on the machine",
        "C_F875ABEA98E67A9A740EFA2E6386D639CE399E917B70AA67FC167FBE9663EAA3",
        "SetDescription",
        "RSOP_ScriptCmd",
        "Machines",
        "0 = Any entry can be overwritten when necessary.1..365 = Events that have been in the log file for one year (365 days) or less can be overwritten.4294967295 = Nothing can be ever be overwritten. ",
        "3221232478",
        "The DNSEnabledForWINSResolution property indicates whether the Domain Name System (DNS) is enabled for name resolution over Windows Internet Naming Service (WINS) resolution. If the name cannot be resolved using DNS, the name request is forwarded to WINS for resolution.",
        "QueryInfoPolicy_Start",
        "KeyManagementServiceProductKeyID",
        "Originator of this SOMFilter",
        "fies t<",
        "Dial-up settings for a given IE internet connection , used for IEAK RSoP.",
        "Refresh the list of discovered targets from this Send Targets portal",
        "DatacenterCustom",
        "_DH_WMP_FIRMWARE_UPDATE",
        "MIF.DMTF|Portable Battery|002.8",
        "MaxPackageSizeInBytes",
        "Power Setting",
        "UINT16",
        "MSNdis_LinkSpeed",
        "select * from MSFT_SmbShareChangeEvent",
        "i71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "TEST_TRACE_RESERVED_05",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|EnablePMTUBHDetect",
        "Win32_COMApplicationClasses",
        "Msft_WmiProvider_LoadOperationFailureEvent",
        "MSiSCSI_InitiatorLoginStatistics",
        "IL_549610262D899A609746B30777DA484C6B4E815F4E722D4B8F981494715B5A99.2461.388456328.358",
        "ClientInterfaceFriendlyName",
        "Values: TRUE or FALSE. A value of TRUE indicates the protocol is pseudo stream-oriented.",
        "{1f228de8-8a6c-11d2-819e-0000f875a064}",
        "IEEE 802.5 Token-Ring",
        "The TcpNumConnections property indicates the maximum number of connections that TCP can have open simultaneously. Default: 0xFFFFFE, Valid Range: 0 - 0xFFFFFE.",
        "OtherStatefulConfiguration",
        "CIM_Directory",
        "{FAF76B72-798C-11D2-AAD1-006008C78BC7}",
        "dport",
        "Multiscan Monochrome",
        "saddr",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62",
        "DeCommitted Size",
        "IL_4F0BC1994D1136D3357DCDA5A9CF33694FD285B2867DFD0EE5E8A215737DADF7.1479.3234706888.193",
        "SMBIOS|Type 20|Interleaved Data Depth",
        "DataSource",
        "msieee80211-PolicyReserved",
        "AddMembers",
        "SaveStateInOperationTransaction",
        "TargetNodeAddress",
        "Localized version of RSOP_PolmkrSchedTaskSetting for American English",
        "ObjectAccess_AuditFilteringPlatformConnection",
        "1 - 'Warning': The majority of replicas are healthy, but one or more may be not fully synchronized. ",
        "The last modification time of this application by the administratorwhen the application was applied to this target.",
        "SECHC_LOG_FLAG_REPAIR",
        "Receiver Failure",
        "MACAddress",
        "The DNSServerSearchOrder parameter indicates the list of server IP addresses suffixes to query for DNS Servers./nExample:130.215.24.1 157.54.164.1",
        "CIM_DirectoryContainsFile",
        " Microsoft CIM Win32|Win32_SID|SID",
        "R_79C2B8878CA0CC7D263478DAA5B22069FB6ABEB9CC6BF0071DCCD3AD247D51A9",
        "Win32API|Network Management Functions|NetUserEnum",
        "Failure Predict Functions",
        "If OperationalStatus contains 1 - 'Other', this field contains the string representing the vendor defined operational statu",
        "The Recursive input parameter is a boolean that indicates whether the decompression will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input parameter is ignored.",
        "{EC2AB55D-4139-4590-BF55-CB8B53B673E3}",
        "PageCombining",
        "ReceivedMulticastBytes",
        "ref:CIM_OperatingSystem",
        "Pause Pending",
        "LocalFirstId",
        "IsolationLevel",
        "MIF.DMTF|Network Adapter 802 Port|001.5",
        "The transmit link speed in bits per second.",
        "Maximum number of per internal IP address rate limit queues for inbound unauthenticated IPv6 IPsec traffic. Value must be > 0.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.279.3657065439.180",
        "MDM_VPNv2_PluginProfile02",
        "ROOT\\Microsoft\\Windows\\Storage\\MS_409",
        "59005",
        "DeviceId",
        "Could not repair the virtual disk because too many physical disks failed. Not enough information exists on the remaining physical disks to reconstruct the lost data.",
        "Calls",
        "Number Of Doors",
        "Allow Font Smoothing",
        "The Age property contains the number of seconds since this route was last updated or otherwise determined to be correct. No semantics of 'too old' can be implied except through knowledge of the routing protocol by which the route was learned.",
        "The manufacturer of the physical disks in the storage fault domain to be put into maintenance mode.",
        "CD_1E374C5CBDEECC7830AB4BADC56B9C8330C5C89908E9DD8A429AF2525AF02748.35.2245748507.482",
        "StopAtDurationEnd",
        "{6D477DBC-E3D1-11d2-8601-0000F8102E5F}",
        "The RouteRecord property holds a record of intermediate hops.",
        "MIF.DMTF|System Hardware Security|001.2",
        "Win32API|Device Input and Output Structures|SCSI_ADDRESS|TargetId",
        "TRC_FN_LEAVE",
        "CreateConstraint",
        "TcpIPv6Enabled",
        "// The total number of key deletions for IPSEC SA",
        "CD_6572B1CC4CD6AC35D80FB14E68E5854FA4FA40953667D1578E6FFD075F930AA0.1185.3197408207.2243",
        "BcdObject",
        "Sample based profiling",
        "Set EA",
        "StartByObject",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"CIMWin32\"",
        "The GetMultiStringValue method returns the data value for a named value whose data type is REG_MULTI_SZ. The GetMultiStringValue method returns a uint32 which is 0 if successful or some other value if any other error occurred.",
        "19 - There is a service running under the same name.",
        "R_C504B91CF040A007F72C24FC0CC99A78401C1C475112424D0A789E6908FEF373",
        "RemoteSubsystemCacheMode",
        "ADWARE",
        "SFT_StorageJob",
        "MaxSrqDepth",
        "largeAnimatedBitmapName",
        "SeverityID",
        "Header_BuildInfo_TypeGroup",
        "Processor extended performance states",
        "Denotes whether this subsystem supports remote cloning.",
        "{E2CBCB87-9C07-4523-A78F-061499C83987}",
        "Resolution indicates the ability of the sensor to resolve differences in the measured property.  This value may vary depending on whether the device is linear over its dynamic range.",
        "Bit flags: Perf set to zero indicates that informational exception operations that are the cause of delays are acceptable. DExcpt set to zero indicates information exception operations shall be enabled. Test of one instructs the drive to create false drive failures. LogErr bit of zero indicates that logging of informational exception conditions are vendor specific.",
        "WHEA Error Source Interface",
        "ImportStore",
        "HTML Editor HKCU Registry Data",
        "Targets require reserved elements",
        "MMCSSTrace",
        "ActivateKey",
        "The Lockout property determines whether the user account is locked out of the Win32 system./nValues: TRUE or FALSE. If TRUE, the user account is locked out.",
        "CD_C3366DDE9F2F54519CCC578CBF8A7581CEC6A62E8EB4A103001D861C9B636A37.1757.532796426.271",
        "Sunday",
        "C:\\Windows\\System32\\GroupPolicy\\Machine",
        "An extrinsic method for changing the state of this physical computer system. Requests that the state of the element be changed to the value specified in the RequestedState parameter. When the requested state change takes place, the EnabledState and RequestedState will be the same. Invoking the RequestStateChange method multiple times could result in earlier requests being overwritten or lost.",
        "The health status of this profile, based on the values that were set in the Win32_RoamingUserHealthConfiguration properties.",
        "Parameter2",
        "ClassificationTable",
        "Print Queue",
        "Lunit",
        "The number of unicast packets received without errors through this interface.",
        "PathState",
        "TRACINGOBJECT",
        "NdisCoVendorDescription",
        "C_A68B01B18C25C8BFC9B36419B9B64DB698A481D87C42ADCA7EC744307E0456D7",
        "tm_wday",
        "SBA_ENABLE",
        "targetName",
        "LUAInstall: error 0x00000005 setting flags [{73257e95-0378-49d6-a954-44aabc841eab}]",
        "Use DHCP for DNS",
        "{C5E2E36E-0D2D-4FAC-A9F4-DDAD14633222}",
        "Specifies the Internet call program you want to use with Internet Explorer.",
        "_0A4592DF371B0F1C9E35DCF899DDC0B30F2B23CFF106F5805254E0E64E1E04F4",
        "MessageLoggingTraceListeners",
        "ActiveCooling is a boolean indicating that the cooling device provides active (as opposed to passive) cooling.",
        "ErrorMethodology",
        "NDIS Status Network Change",
        "s71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "CD_5847C21BC6927B979DCCC7E87CBA9AC34DE69BF0C904AF77E2C0BE3CEEA06FCB.1667.2466246757.404",
        "ProviderOperation_ProvideEvents",
        "S-1-16-16384",
        "Defunct",
        "The Backup Win32_ShadowContext is the standard backup context. Specifies an auto-release, non-persistent shadow copy in which writers are involved in the creation.",
        "Values: TRUE or FALSE.  If TRUE, then the job is run repeatedly.  If FALSE, then the job is run once.",
        "UserName",
        "NtlmLogonUser_End",
        "SidTypeDomain",
        "V1_DriverMajorFunctionReturn",
        "The CIM_Configuration object that groups the settings and dependencies associated with the managed system element.",
        "Unknown or OEM System Specific Error",
        "Values: TRUE or FALSE.  A value of TRUE indicates the protocol supports expedited data.",
        "Other - For integer values other than those listed above, refer to the documentation on error codes returned by the Windows Installer API and the Win32 error codes.",
        "RDMAInFrames performance counter missing",
        "0x80050056",
        "Success - Locked and chkdsk scheduled on reboot",
        "\"Lost Communication\" indicates that the Managed Element is known to exist and has been contacted successfully in the past, but is currently unreachable.",
        "7 - Windows Server 2003, Datacenter Edition ",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.100.2980771457.188",
        "TraceICS",
        "RD_TRACE_RESERVED_10",
        "ArrayType",
        "Reserved; Returns a value of one.",
        "LicensingName",
        "A user settable description of the storage subsystem. This field can be used to store extra free-form information, such as notes or details about the subsystem's intended usage.",
        "CD_2CEA3682CC09E7F94D9FBC1BBA63FC6DB39872E53B9187129DFF772A12215DD5.1714.2360956410.365",
        "R_5401A055411F9811A09125DE8462BF6A4D708D8C770ADE3D670BFB9DAD21A39A",
        "The AccessMask property is a bit array representing the access rights to the given file or directory held by the user or group on whose behalf the instance is returned. This property is only supported under Windows NT and Windows 2000. On Windows 98 and on Windows NT/2000 FAT volumes, FULL_ACCESS is returned, indicating no security has been set on the object.",
        "This class defines a view class for a physical computer system.",
        "Bus Expansion Chassis",
        "FreeSpaceInPagingFiles",
        "Win32_PrinterShare",
        "WriteLogSectors",
        " 0x020 ",
        "WINSTATION_LOGOFF=0x4WINSTATION_VIRTUAL | STANDARD_RIGHTS_REQUIRED = 0xF008",
        "WSP_Synchronized",
        "The TcpNumConnections parameter specifies the maximum number of connections that TCP may have open simultaneously. Valid Range: 0 - 0xFFFFFE.",
        "The Unit Modifier which determines the magnitude of the unit. For example, -3 means the reading is 0.001 times of the base unit.",
        "Example: 178MB",
        "CD_9A6F5375A9497C640DD14311C5D352C43D073997E82C517C2CD3321E7C391BFA.1201.1133286525.2775",
        "Object which contains details for a phone number used for dialing up to the internet.",
        "HOSTPROC_TRACE_PNP",
        "object:MSFT_NetAdapterSriovSettingData",
        "The DriverVersion property indicates the version number of the printer driver.  ",
        "The WarningLimit property indicates the warning limit set for this particular user or group.",
        "iSCSI_PathCount",
        "5.25,  640KB,  512 bytes/sector",
        "Windows Defender",
        "dnString",
        "Example: Disk #0, Partition #1.",
        "SessionDigestError",
        "RESOLVE Flag",
        "MDM_BitLocker_Status01",
        "The child DS Class",
        "BytesPerSector",
        "MSKeyboard_PortInformation",
        "CR_0F40AC813525BF23B517D1D92CC88BD22739A3C5B59B5537548A36265FEAE58A",
        "Generate No Sense",
        "h%m;h%m;",
        "CurrentNumberOfColors",
        "This class manages various operating system wide settings related to storage management.",
        "NdCapabilities",
        "The InitialSize property indicates the initial size of the page file./nExample: 139",
        "Win32API|Device Context Functions|GetDeviceCaps|HORZRES",
        "CIM_System.Name",
        "{8a3b8d86-db1e-47a9-9264-146e097b3c64}",
        "A link between BIOS element and non-volatile storage where the BIOS is loaded.",
        "Contents of the RDP file corresponding to the desktop",
        "microSPARC IIep",
        "Select * from Win32_PortResource",
        "{322CE0F0-DB34-11d2-85FC-0000F8102E5F}",
        "Win32_IDEController",
        "The Record property references an NT log event.",
        "LUAInstall: error 0x00000005 setting flags [{73CFD649-CD48-4fd8-A272-2070EA56526B}]",
        "C_26EBDAC8F156752113DE91B4EE3267ABEDBAA0A241ECD93D9A2C887C1566A5A3",
        "The Win32_ProgramGroupContents class represents an association between a program group order and an individual program group or item contained in it.",
        "CD_7FCF3928CE1A9575028B7746073AE3C5F6F2163882EECBCF60F66F9FAFB60664.1197.2813777628.335",
        "NS_74107FEA5B2CB5DCE695F4D23B55D356A7A7AE87294080036E81FBFF00A5611A",
        "PackageCache",
        "CIM_Group",
        "Number of SCSI timeouts that have occurred since last hard or soft reset related to the controlled Device. The time of last reset is indicated in the TimeOfDeviceReset property, inherited from the ControlledBy association.",
        "The Win32_ScheduledJob class represents a job scheduled using the network management schedule service functions (also known as \"Job\" and \"AT command\" functions). Note that this is different from the tasks scheduled using the Windows 2000 Task Scheduler. This class is only instrumented on Windows NT 4.0 and later.  Each job scheduled against the schedule service is stored persistently (the scheduler will know to start the job even after a reboot) and is executed at the specified time and day of the week and/or month.  If the computer is not active or if the scheduled service is not running at the specified job time the schedule service will run the specified job on the next day at the specified time.  Scheduled jobs are scheduled with respect to Universal Coordinated Time (UTC), i.e. with bias offset from GMT.  This means that a job can be specified using any time zone specification.  The Win32_ScheduledJob class will return the local time with UTC offset when enumerating an object and convert to local time when creating new jobs.  For example a job specified to run on a computer in Boston at 10:30 pm Monday PST time will be scheduled to run locally at 1:30am Tuesday EST.  It should be noted that a client must take into account whether daylight savings time is in operation on the local computer and if so subtract a bias of 60 minutes from the UTC offset.",
        "{2AFCECBA-ABA5-404B-8F4F-15BECC9FEE20}",
        "7 - Media disconnected",
        "A GUID used to correlate reliability metrics on this computer. The GUID will be reset if an error prevents reliability metrics from being calculated",
        "{FAF76B5E-798C-11D2-AAD1-006008C78BC7}",
        "11008",
        "True if the Internet Protected Mode is enabled",
        "11009",
        "Win32_ServerConnection",
        "policyRemoval",
        "htmlEditorHKCURegData",
        "EVENT_TRACE_FLAG_FILE_IO_INIT",
        "This property contains a setting value associated to a SettingName",
        "Acpi _PSS object",
        "CIM_RecordLog.OverwritePolicy",
        "CD_EF67B600A31F150CE962D694F9CA3072B7F784C6A34776FDD01BE21CE72A06A9.1741.2954918898.516",
        "Win32Registry|Control Panel\\Desktop|CursorBlinkRate",
        "The privileges property specifies the level of privilege assigned to the user.",
        "BytesReceived",
        "MS-DOS V4 Huge",
        "ExecutionTimeLimit",
        "IL_C1B039C6B15CB1268319C147066B90BAE1F5E0DA59EE23E8DFE59CEDEE8D5513.761.1.144923",
        "MemPhysical",
        "#endif // MS_SM_HBA_API",
        "PortableDeviceClassExtension_f2 Flag",
        "ErrorObject",
        "InteractiveLogon_MessageTextForUsersAttemptingToLogOn",
        "CIM_NumericSensor.HealthState",
        "LoginNegotiateFail",
        "SessionId",
        "TotalMFTRecords",
        "SMBIOS|Type 3|System Enclosure or Chassis|Power Supply State",
        "DataString",
        "Describes the list of IPv6 corporate site prefixes that should be monitored for corporate connectivity",
        "IPsecSAEndpoints are types of SecurityAssociationEndpoints representing both negotiated and static SAs that correspond to AH, ESP, or IPCOMP transforms.",
        "MsftDiscRecorder2_DebugGeneral",
        "Last quick scan end date and time (using round-trip UTC format)",
        " Maximum version of required operating system. The value  is encoded as     <major>.<minor>.<revision> or     <major>.<minor><letter revision>",
        "The Priority parameter specifies the new priority class for the process.  Values:/nIdle - Specified for a process whose threads run only when the system is idle. The threads of the process are preempted by the threads of any process running in a higher priority class. An example is a screen saver. The idle-priority class is inherited by child processes./nBelow Normal - Indicates a process that has priority above IDLE_PRIORITY_CLASS but below NORMAL_PRIORITY_CLASS. For Windows 2000./nNormal - Specified for a process with no special scheduling needs./nAbove Normal - Indicates a process that has priority above NORMAL_PRIORITY_CLASS but below HIGH_PRIORITY_CLASS. For Windows 2000./nHigh Priority - Specified for a process that performs time-critical tasks that must be executed immediately. The threads of the process preempt the threads of normal or idle priority class processes. An example is the Task List, which must respond quickly when called by the user, regardless of the load on the operating system. Use extreme care when using the high-priority class, because a high-priority class application can use nearly all available CPU time./nRealtime - Specified for a process that has the highest possible priority. The threads of the process preempt the threads of all other processes, including operating system processes performing important tasks. For example, a real-time process that executes for more than a very brief interval can cause disk caches not to flush or cause the mouse to be unresponsive./n",
        "RSOP_SecurityEventLogSettingBoolean",
        "ConfigureFavoritesBar",
        "Acpi _PCT",
        "A Sensor is a hardware device capable of measuring the characteristics of some physical property - for example, the temperature or voltage characteristics of a UnitaryComputer System.",
        "GatewayUsage",
        "NumberOfLogons",
        "C_27AD50ACF498E4580849CBCD157A81D527ED4CE6ECB87F863A4E83FFC9365AD2",
        "Optical 62.5um",
        "SecurityLimitFlags",
        "StorageFaultDomains",
        "Committed Space",
        "Tape Snapped",
        "TRACINGIOTARGET Flag",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_5EBF93E0C149B1B151E338091E85B09A85B53ED88BB6E56FB2EB094E120431E2",
        "I_549610262D899A609746B30777DA484C6B4E815F4E722D4B8F981494715B5A99.2461.388456328.358",
        "ISCSI_PortalInfo",
        "Magneto-Optical",
        "{a41d90bc-899d-11d2-819e-0000f875a064}",
        "Asynchronous Mirror Remote",
        "MDL Read Complete",
        "The name of the qualifier - this must be unique within the set of qualifiers for the object the qualifier applies to",
        "Number of bytes to be reserved for user data.",
        "C_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416",
        "This field indicates the number of complete data copies that are being maintained. For example, RAID 5 maintains 1 copy of data, whereas RAID 1 maintains at least 2 copies.",
        "LastModified",
        "Deposits token-based activation response.",
        "real64",
        "Least Recently Used (LRU)",
        "NdisFddiTypeCWrapB",
        "Foreign key to RSOP_PolicySetting.",
        "PathWeight",
        "WmiSetALSBrightness",
        "How was the threat detected",
        "Array of configuration download manager objects that contain location information to download configurations",
        "MatchSource",
        "51003",
        "FX_TRACE_GENERAL",
        "Win32API|Device Input and Output Structures|DISK_GEOMETRY|MediaType",
        "BytesPerSecond",
        "The JobId property indicates the identifier number of the job.  It is used by methods as a handle to a single job being scheduled on this computer.",
        "LoginRedirectRsps",
        "CertChain",
        "C_0CD3432EB17462BFB5BD92FE309EBEDE9286A9F3ADCBFE4044D787F3CCDADE24",
        "NS_33649B8965454C922467A4F161F8843CBCFBC36216BF16B17C1FAAEAE38C9913\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_7BA978978EBF3CD1200A10044AC0BD6F4758993016B7F6B6A538255F2BFBBE7A",
        "DiscoveredKeyManagementServiceMachineIpAddress",
        "PortFrees",
        "NdisTransmitsError",
        "The 802.11 RSSI trigger value in dBm",
        "Indicates if CreateReplicationShip operation is supported",
        "MSAcpi_ThermalZoneTemperature",
        "Unit Modifier",
        "EnableWINS",
        "DetectionSourceTypeID",
        "shared",
        "The date/time when the element's EnabledState last changed. If the state of the element has not changed and this property is populated, then it MUST be set to a 0 interval value. If a state change was requested, but rejected or not yet processed, the property MUST NOT be updated.",
        "Win32_PnPDevicePropertyBinary",
        "Denotes the provisioning schemes that this storage pool supports.",
        "Disk is in use",
        "PLATFORM_TRACE_DRIVERSTOP",
        "UdpIPv4HashEnabled",
        "Create Mailslot",
        "L2tpIPsecAuth",
        "TunnelBytesSent",
        "   //  The first uint16 must hold the length of string (in bytes).",
        "The maximum number of VPorts that can be created on the adapter",
        "QueueDepth",
        "Major Function",
        "PartialConfigurations",
        "SetMTU",
        "CoNDIS Vendor's Driver Version",
        "Device",
        "The Type parameter passes the type of resource being shared. Types includes disk drives, print queues, interprocess communications (IPC), and general devices.",
        "KeyPackage",
        "SCSI Fibre Channel (DB-9, Copper)",
        "Int16",
        "m71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "Get Health Report for the Target Storage Object.",
        "    EapConfigXmlStream (XML) Specifies the contents of the XML file containing the EAP Configuration for the VPN connection profile.",
        "ref:MSFT_Net6to4Configuration",
        "C_976E9CD39F31ACFAAF8B7B730E468AD5B2E5984554170330FFB447FBCE0ADA0E",
        "Singleton",
        "ratingSystems",
        "DiskUniqueId",
        "MSNdis_TokenRingCurrentRingState",
        "0x80000000",
        "The OverwriteExistingDebugFile property indicates whether a new log file will overwrite an existing one. ",
        "LowerSoftwareElementVersion",
        "On input, RequestLength is the length (in octets) of the Descriptor that should be returned. If this value is less than the actual length of the Descriptor, only the requested length will be returned. If it is more than the actual length, the actual length is returned. On output, this parameter is the length, in octets, of the Buffer being returned. If the requested Descriptor does not exist, the contents of this parameter are undefined.",
        "{9b81c0c8-401d-4f7f-a5c7-c104c68dbdc6}",
        "ref:MSFT_StorageHealth",
        "LPCDRVR_TRACE_RESERVED_18",
        "MDM_PassportForWork_DynamicLock01",
        "IL_3985A64DD548C159337A855FB2D96B222C50720949C8FDEAE049F7ADFD2826A5.1782.1431924164.280",
        "SystemConfig_V3",
        "The world wide port name of the physical port",
        "The AdminPasswordStatus property identifies the system-wide hardware security settings for Administrator Password Status.",
        "CIM_ConcreteComponent",
        "MDM_VPNv2_01",
        "This class exists for backward compatibility to earlier CIM Schema definitions. With additions to Sensor and NumericSensor in V2.2, it is no longer necessary. A Tachometer can be defined by setting the SensorType property. inherited from Sensor, to 5 (\"Tachometer\"). Other properties of this class are hard-coded to constant values to correspond to definitions in the Sensor hierarchy.",
        "Filename",
        "CD_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937.1166.3868619072.1088",
        "ContainerAvailable",
        "\"Unknown\" (0) - The implementation cannot report on HealthState at this time. ",
        "Object changed by the operation corresponding to the event",
        "GetLicenseFromStoreMethod",
        "Number of traffic classes supported.",
        "857E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "0xD011",
        "Configured Budget",
        "Generator Failure",
        "Network Port",
        "R_6A23F044A3652D7FC71AC14411C94E256DCCF9AC4805A4A211FBC6A5B34872FD",
        "{703574D6-AA1B-4FBF-A938-9A59C89343FA}",
        "BitsPerPixel",
        "C_191877833EBB16E938034A3506BE0709B7FE03ACAA65FB61B2F3088D1DCE72BF",
        "{8502C507-5FBB-11D2-AAC1-006008C78BC7}",
        "Win32_ServiceControl",
        "{8C2147A4-FF29-4336-B8A4-227B54CC0966}",
        "Win32API|File Functions|ReadFile",
        "C_D5B792B23BC4AFF33F84619861154DB6F0B75D6C62833CE80A0CA636DA5E664B",
        "enableTrustedPublisherLockdown",
        "Values are TRUE or FALSE. If BootROMSupported equals TRUE, then a boot ROM is supported.",
        "Access describes whether the media is readable (value=1), writeable (value=2), or both (value=3). \"Unknown\" (0) and \"Write Once\" (4) can also be defined.",
        "The current 802.11 power mode",
        "ErrorCount",
        "LPCDRVR_TRACE_RESERVED_0f Flag",
        "Set maximum X resolution supported by the server (minimum is 200 and maximum is 4096).",
        "Task provider for ODBC Data Source Name (DSN).",
        "If TRUE, the disk will be made read-only. If FALSE, the disk will become writable.",
        "ErrorTime",
        "FileData",
        "CIM_ManagedSystemElement.DetailedStatus",
        "SendCTPassThru",
        "HBA_EVENT_PORT_ALL",
        "Imported Zone Count",
        "The location of the installed product.",
        "RestrictedSitesZoneAllowBinaryAndScriptBehaviors",
        "NdisCoReceivePduErrors",
        "NDIS ATM Supported Service Category",
        "IL_AF1EC31F9D52CED588A2CF637F321B04B95D0B076BF99F2FD31094917A943784.2681.2648932912.275",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.314.941523886.188",
        "WPD_TRACE_LEVEL_FUNCTRACE Flag",
        "The compression format to apply to the messages.",
        "RemoteIPv6Address",
        "CR_16275E16EEED6E74BD48AA48ACA3AF381CEAB3C980CF5112BF5B3053B0589A21",
        "C_E4EC3642DBAAC119BB7D98363E08333001320E1E613FB7C4977DB452606906F4",
        "ObTypeEvent",
        "State of the interface",
        "Specifies the processor group number for the last RSS processor.",
        "Unprepare",
        "4 - The requested control code is not valid, or it is unacceptable to the service.",
        "UserAuthenticationRequired",
        "The availability and status of the device.",
        "Configure cloud protection level.",
        "C_6C29EF4ACC836F85EF7659E17930E4D493CC19A2D7E63C6C1051EF8AB7CAEFC7",
        "AllowYourAccount",
        "RSOP_PolmkrSchedTaskSetting",
        "MGR_TRACE_RESERVED_10 Flag",
        "LetAppsAccessCalendar_ForceAllowTheseApps",
        "iScsiFlagRadius Flag",
        "DefaultDisplayValue",
        "Disable manual activation of IP-HTTPs profile",
        "object:MSFT_NetAdapter_Group_Affinity",
        "CA033FB2C117DB216DD2382445258C0099435360113084CE8.1188.3082289951.314",
        "{3c6434d0-257b-4516-9222-4fa0467d67f9}",
        "CIM_PhysicalCapacity describes the minimum and maximum requirements and ability to support different types of hardware for a physical element.",
        "C_328F09EA94A11C49CE9879973AEFE371583535ABF3A24603CDCD08371B636C41",
        "SDBUS_DEBUG_DEVICE Flag",
        "WipingPercentage",
        "SetKeepAliveTime",
        "C_8F21C89CAF771FFCC47E28C59A7D76DBF0F63931FC16518B322428129F505FDF",
        "Sectors Per Track",
        "      <registryValue name=\"ExcludedContentIdsForUpdate\" valueType=\"REG_SZ\" value=\"06C0BCC4-0782-AAF5-61FD-41AA756C3F0D|30D0561D-73B8-A3AB-7882-963DD6547573|30E843B4-FFB2-54AA-8ED7-B4FAAA04C09B|46876348-0600-377E-C31A-4A4D53E546BA|53466E60-4DA9-D32B-D0C1-E0686457D28F| 7EAF50D1-A0BE-225B-768F-7C3A2323C00F|87F376E7-D407-DBEC-F5D2-2525065A8B6E|B07066B7-67FC-81DB-A7AC-3746C6DACE6D|D46E886D-DD2C-1071-2CC9-4E623D5E2DC4|DB826507-79B5-FB9A-6D65-39D573D74055\"></registryValue>",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2484.1653932254.180",
        "Parent ID",
        "The physical component that implements the device.",
        "CIM_EnabledLogicalElement.RequestedState",
        "1 - 'Policy': The user requested the disk to be offline. ",
        "The maximum number of send packets the MiniportSendPackets function can accept.",
        "Specifies the ID of the print job to be paused.",
        "%DriverList%",
        "The service filter applied to the rule.",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_FDFF3C9B0664E0FAF284BFA12AE8B9782E6E99E4BAEA05AB7851730AFE40F0921a2a",
        "When enabled the IExtensibleDataObject interface on data contract types will be ignored.",
        "References the application.",
        "0x80050071",
        "Conditionally Generate Recovered Error",
        "Auto Dial Function",
        "Interrupts",
        "Tape drive problem warning event",
        "Root Certificate Issuer Filter.",
        "Bypassed",
        "ServiceModel Operation",
        "MSFT_SoftError_NotInCache",
        "Data Read",
        "TEST_TRACE_RESERVED_14 Flag",
        "DiskId",
        "The Enable method enables SR on a drive.It returns a COM error code.",
        "BackupLastTime",
        "MSFT_LocalizableClassQualifier",
        "The Transportable property indicates whether the shadow copy can be surfaced on another machine. If this property is FALSE and the volumes are surfaced locally, it may not be possible to surface them later on a different machine.",
        "ActiveConnectionPerformanceCounterMissing",
        "PState Context",
        "DODelayCacheServerFallbackForeground",
        "{7cb1dab9-fff7-40fe-a916-6b2f04cb5e1c}",
        "CIM_ERR_INVALID_RESPONSE_DESTINATION",
        "CD_65AD9D71C7F4EC93858B91DB3439405127306083D38D59BB8579B4F63675934C.314.48741601.1432",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|EnableDeadGWDetect",
        "IEEE-488",
        "Best guess, if no match is found show both PCL and PS drivers=4",
        "MSFT_CliAlias.FriendlyName=\"Product\"",
        "Win32Registry|Control Panel\\Desktop|GridGranularity",
        "3 - 'Majority Disks Unhealthy': The majority of the supporting physical disks are in an unhealthy state that has forced the storage pool into a read-only state.",
        "MsixMessageAffinityArray",
        "Large Animated Bitmap Path",
        "Synchronous Mirror Remote",
        "\\\\.\\root\\default:__Win32Provider.Name=\"ActiveScriptEventConsumer\"",
        "EnableWebSignIn",
        "AllowCookies",
        "Logging - Complete",
        "The slot into which the card is inserted.",
        "Indicates whether the virtual disk is available for read and/or write access",
        "SeparatorFile",
        "OS SCSI LUN number target LUN is mapped to",
        "SetInfoPolicy",
        "Extra Standard",
        "C_40D59F896F1B4CD78A547B4E482D63447FD0237E73E28B731E2036C3CEB6A1F6",
        "IdleWaitTimeout",
        "MsftUtils_DebugGeneral Flag",
        "Install Invocation",
        "The EnumValues method enumerates the named values of the given subkey. ",
        "CD_AC7BB2CE72891CEE5B24D1161F798647F6D5827CC518A0A64C2F1BC7D1BEC738.314.610731876.1246",
        "SubSegmentSize",
        "Win32API|Time Functions|GetTimeZoneInformation",
        "SpecifyIdleTimeout",
        "DisableDebugConfiguration",
        "..15999",
        "Identifies the packet capture target.",
        "CPU Failure",
        "ResolutionState",
        "Sense Info Buffer Length",
        "The type of desktop monitor or CRT. For example, multiscan color or monochrome monitors (values 2 or 3, respectively) can be indicated in this property.",
        "IL_54BBF40E19FE5F0CE8FD57918CEFA4A1969D570EBD46B32003DB10D6E81927AE.1075.15506189.186",
        "VRefresh",
        "KeyManagementServiceNonGenuineGraceRequests",
        "CIM_Chassis.TypeDescriptions",
        "DtcLogFileSettings",
        "Flags associated with the specified zone. This can be one of the ZAFLAGS values.",
        "Remote Desktop permissions management.",
        "#define HBA_EVENT_PORT_NEW_TARGETS      0x203",
        "Encapsulation",
        "OffloadState",
        "16 bit",
        "INPROGRESS_ROUTINE_CLEANING",
        "ISR_MSI",
        "The SupportsQualityofService property indicates whether the protocol is capable of Quality of Service (QOS) support via the underlying layered service provider or transport carrier. QOS is a collection of components that enable differentiation and preferential treatment for subsets of data transmitted over the network. QOS loosely means subsets of data get higher priority or guaranteed service when traversing a network. ",
        "I_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.285.2021993801.242",
        "The UserControlService method attempts to send a user-defined control code to a service. It returns an integer value of 0 if the UserControlService request was accepted, 1 if the request is not supported, and any other number to indicate an error.",
        "UUUUUUUUUUUUUU",
        "TrustedSitesZoneAllowAutomaticPromptingForFileDownloads",
        "CR_A90E76A32C4A193B19FDC863622FA085D4532219E7648490CF033C6770DCAB51",
        "This structure contains free form strings defined by the OEM. Examples of this are: Part Numbers for Reference Documents for the system, contact information for the manufacturer, etc.",
        "EnableDevice",
        "OtherInfoFormatDescription",
        "ThinProvisioningPolicy",
        "SetByThirdParty",
        "AllowSIMErrorDialogPromptWhenNoSIM",
        "QPReceive performance counter missing",
        "EnableInsecureGuestLogons",
        "MonthlyFrRateBps",
        "ServiceAuthorizationAuditLevel",
        "{59D95679-9799-458F-8B5B-FE00D8DA0AE4}",
        "When several bus and/or connection data widths are possible, the NegotiatedDataWidth property defines the one in use between the devices.  Data width is specified in bits.  If data width is not negotiated, or if this information is not available/important to device management, the property should be set to 0.",
        "DCOM Application management.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2041.2715216352.368",
        "MIF.DMTF|Physical Memory Array|001.8",
        "Power Save - Warning",
        "The distinguished name of the NTDS settings object for this directory server",
        "Idle States Accounting",
        "CR_896B6F9A9E07C666B49D000879A54E67F9CE0EAF2B8B7EF7BCA31E7303EC222A",
        "{182f9e0c-b1f3-11d0-8dd7-00c04fc3358c}",
        "Never dial a connection",
        "MDM_DeviceStatus_Firewall01",
        "HideChangeAccountSettings",
        "The Shared property indicates whether the printer is available as a shared network resource.",
        "{C1CC6857-1A26-4f6d-AB98-291F0C3BBD4C}",
        "The required ServiceAccessPoint.",
        "Error record contents",
        "The SetPMTUBHDetect method is used to enable detection of Black Hole routers. Setting this parameter to TRUE causes TCP to try to detect Black Hole routers while doing Path MTU Discovery. A Black Hole router does not return the Internet Control Message Protocol (ICMP) Destination Unreachable messages when it needs to fragment an IP datagram with the Don't Fragment bit set. TCP depends on receiving these messages to perform Path MTU Discovery. With this feature enabled, TCP will try to send segments without the Don't Fragment bit set if several retransmissions of a segment go unacknowledged. If the segment is acknowledged as a result, the maximum segment size (MSS) will be decreased and the Don't Fragment bit will be set in future packets on the connection. Enabling black hole detection increases the maximum number of retransmissions performed for a given segment. The method returns an integer value that can be interpretted as follows: ",
        "You must specify a name.",
        "LogFreeSpace",
        "scriptFile",
        "The Drive property indicates the drive letter of the CD ROM drive.",
        "Network adapter media type.",
        "RS-232 serial port",
        "WPDMTP_feature1",
        "Property for controlling whether Dnssec validation is required or not",
        "The Element reference represents the DCOM application where the settings are applied.",
        " Meaning",
        "MsftDiscFormat2Data_DebugDestructor Flag",
        "IR_5C670A419305640007AA9AA161CE0975646DEEA64973112E2DE223893C0FA422",
        "StringSecurityDescriptor",
        "Values: TRUE or FALSE. A value of TRUE indicates parity checking is supported.",
        "If IsScaleOut is TRUE, the disk is scaled out.",
        "MDM_Policy_Result01_ActiveXControls02",
        "The Manufacturer property indicates the manufacturer of the drive.",
        "An enumeration of the types of links. When set to 1 (\"Other\"), the related property OtherLinkTechnology contains a string description of the type of link.",
        "The slot number of a PCI network adapter.",
        "FcpLun",
        "The InitialSize property indicates the initial size of the page file.",
        "EnabledState of the current or last running operating system on this physcial computer system.",
        "IkePolicyKey",
        "pixels per logical inch",
        "object:MSFT_StorageTier",
        "Failing over",
        "No primary/secondary WINS server defined",
        "SoftwareElementID",
        "UnlockWithCertificateThumbprint",
        "Standard Non-COM Event Provider",
        "Association between FileServer and its FileShares",
        "The elements of the Formats array define lists of properties to be shown for this alias. This is a list of lists indexed by the format name (for example FULL, BRIEF, INSTANCE or a user defined qualifier).",
        "Queue Depth",
        "OtherSpecificationType",
        "Pressure Unacceptable",
        "No Contact",
        "The Add-VpnConnectionTriggerTrustedNetwork adds DNS suffixes to the VPN profile. When any of these DNS suffixes is present on physical interface on the client, VPN connection will not be auto triggered.",
        "C_E58DB6F2713150A46F7C4D8E4C78CFE7E744DC308B2C7F2F5D3E19AF5E925D5A",
        "MS Storage Class Driver Error Log",
        "AllowAllTrustedApps",
        "EVENT_TRACE_FLAG_READ",
        "C_20435E8E6AE6B07C92579F794D715DB6D35677395F702CF6B0B37C21C5C70F22",
        "NdisPortStateStatusIndication",
        "C_1E1CD952E598C3858F01E05DCEB6E0FDDB93A88BD0100C8466601561A5B05EFB",
        "A class derived from FileSystem that represents access of the FileSystem via a network-related service. In this case, the file store is hosted by a computer, acting as a file server. For example, the file store for an NFS FileSystem is typically NOT on a ComputerSystem's locally controlled media, nor is it directly accessed through a device driver. Subclasses of RemoteFileSystem contain client-side configuration information related to the access of the FileSystem.",
        "WakeEventExecution",
        "If false, authenticode security information is not customized.",
        "ValueDescriptions",
        "PolicySourceMaximumConnections",
        "DepositOfflineConfirmationId",
        "**typedef** Bit flags that indicate various functionality supported",
        "1F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.3885814277.180",
        "SMM Security Mitigations 1.0",
        "AMD SEV-SNP",
        "The count of the consecutive times the link confidence test (LCT) has failed during connection management.",
        "The PrinterPaperNames property indicates the list of paper sizes supported by the printer. The printer-specified names are used to represent supported paper sizes.",
        "LocalMachineZoneAllowSmartScreenIE",
        "MSFT_NetConSecRuleEMAuthSet",
        "Ipv4Index",
        "HostProcessIdentifier",
        "SessionsTimedOut",
        "The PnP component ID, a.k.a. Hardware ID of the network adapter.",
        "{37D2C3CD-C5D4-4587-8531-4696C44244C8}",
        "Multifunction Device",
        "1 - 'Online All': All newly discovered disks are brought online and made read-write.",
        "An error occurred while accessing the Registry for the requested information",
        "USO properties for a network adapter.",
        "WMI|Win32_PhysicalMemoryArray",
        "ShowLockOnUserTile",
        "{C3C5D8AF-2FD5-4500-A8E7-379C2D0BBE2E}",
        "Where <OrgID> and <LocalID> are separated by a colon \\':\\', and where <OrgID> must include a copyrighted, trademarked or otherwise unique name that is owned by the business entity that is creating or defining the InstanceID, or that is a registered ID that is assigned to the business entity by a recognized global authority. (This requirement is similar to the <Schema Name>_<Class Name> structure of Schema class names.) In addition, to ensure uniqueness <OrgID> must not contain a colon (\\':\\'). When using this algorithm, the first colon to appear in InstanceID must appear between <OrgID> and <LocalID>. ",
        "_DH_WMP_SYNC_PERF",
        "Power Saving Modes Entered Automatically",
        "CD_745B48F3D3663775E674F1AC382685A30C5D61F06F3C74BC6E2C4180489D568F.1173.2869032566.280",
        "The value for NumberOfDataCopies is outside of the supported range of values.",
        "CD_581FDBF3A3E51D753168374466B7C40E39F607E7397DAAFA13C9AC84F1F3CEA3.2425.2414082761.364",
        "C_EC87315EA07FEB82B95B6ECC853900B53DFD9FAE520CF4C1FE8CD7F52B679C09",
        "{d62c5793-c0eb-400e-a97b-2db5df757b8c}",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_27FAEA5F317A7D777DA2A8EBCBC3C42776D2CE02DCD68C27018D6EFB15E2A7CD",
        "Win32API|Network Management Structures|AT_INFO|Flags|JOB_NONINTERACTIVE",
        "\\\\.\\root\\standardcimv2:__Win32Provider.Name=\"NetAdapterCim\"",
        "0x000002",
        "MaxChannels",
        "MSFT_ReplicaPeer",
        "WMI_CHANGER_PARAMETERS_GUID",
        "ManufacturerId",
        "In Service",
        "CIM_LogicalDiskBasedOnPartition",
        "This describes the framing method for the upper layer SAP or Endpoint that is bound to the LANEndpoint. Note: \"Raw802.3\" is only known to be used with the IPX protocol.",
        "CR_C1EDB2C3B16B75C05D994CBAD887CFED943CA4B2E1180F3891F60984B8988B63",
        "HOSTPROC_TRACE_FUNCTION Flag",
        "Level of multicast support.  - None: Multicast packets can neither be sent nor received - SendOnly: Multicast packets can be sent but not received - All: Multicast packets can be sent as well as received",
        "SupportsVirtualDiskCapacityReduction",
        "CR_81F5CC7DCEFB1E634599916220181F35C3DB70B94808983CB78C381325F1AAF3",
        "SetPMTUDiscovery",
        "MFT Flag",
        "Rename IP-HTTPs profile",
        "Bytes read using software Ecp mode",
        "DVD-ROM",
        "C_064843E966479C3B4CF71DBA14623DC8C5CF1B385A02FDC292B3B3F5C45F4BAC",
        "Creds",
        "ReservedSystemPaletteEntries",
        "Server name",
        "Whether the provider writes incoming data into the consumer's buffer in order, i.e., the last byte position in the consumer's buffer is guaranteed NOT to be updated before any prior byte position.",
        "Renew",
        "NDIS Query NIC Switch Hardware Capabilities",
        "Indicates whether this driver is package-aware.",
        "C_7E0816BCB5F44018ABCEB520770DDD7EE174F2DB2071F89833FE5E4D9500CE80",
        "Local Udp encapsulation port for NAT traversal",
        "CR_ADADA2B2CDD3BACE2485D2B360E811514E03484B4187AE7DDB3778A03ABAD994",
        "Guid, the unique id of the session, when part of a session. NULL Guid otherwise.",
        "{35E25AA5-E3D1-11d2-8601-0000F8102E5F}",
        "{D2A60D61-0F87-4673-A86C-9C461457FE27}",
        "GetKeyProtectorAdSidInformation",
        "SizeMin",
        "PeerResolverBindingElement",
        "The Win32_Keyboard class represents a keyboard installed on a Win32 system.",
        "Mutual CHAP",
        "MAC address and VLAN ID filters for VMQ and VPorts",
        "The SuperclassName property, if not NULL or blank, specifies a superclass name. Only classes that are subclasses of this class are returnedIf NULL or blank, and Flags contains WBEM_FLAG_SHALLOW,only top-level classes, that is, those which have noparent class or superclass, are returned. If it isNULL or blank and Flags is WBEM_FLAG_DEEP, all classes within the namespace are returned.",
        "The returned print job.",
        "{6a399ae0-4bc6-4de9-870b-3657f8947e7e}",
        "Below_Normal - (Windows 2000 and later): Indicates a process that has priority higher than Idle but lower than Normal.",
        "WMI|Win32_DiskPartition",
        "iScsiFlagAdapter Flag",
        "MSFT_MintEngine",
        "MDM_DevDetail_Microsoft02",
        "This class provides the capability to configure WNS notifications for the MDM agent",
        "Specifies whether to publish the printer in the A.D",
        "Sets the KMS lookup domain to use for volume activation.",
        "{8D500594-DB33-11d2-85FC-0000F8102E5F}",
        "PortableDataVolume",
        "Win32API|Service Structures|SERVICE_STATUS|dwCheckPoint",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|TCPAllowedPorts",
        "DVB-ASI Input",
        "The ProviderType property specifies the communications provider type.",
        "CreateHandle",
        "PossibleStates enumerates the string outputs of the Sensor. For example, a \"Switch\" Sensor may output the states \"On\", or \"Off\". Another implementation of the Switch may output the states \"Open\", and \"Close\". Another example is a NumericSensor supporting thresholds. This Sensor can report the states like \"Normal\", \"Upper Fatal\", \"Lower Non-Critical\", etc. A NumericSensor that does not publish readings and thresholds, but stores this data internally, can still report its states.",
        "EnabledFilterTypes",
        "TelemetryReportingFrequency",
        "Indicates if the ChkDsk method should be run at next boot up.",
        "   /* Target Level Events */",
        "{db089a12-f250-47aa-b9d0-89806d928ba6}",
        "SRIOV Capabilities",
        " 2 - Supported ",
        "SAM Delete User",
        "PS_StorageCmdlets",
        "Example: 657",
        "TM_REFOBJ Flag",
        "\\\\.\\root\\StandardCimv2:__Win32Provider.Name=\"NetDaCim\"",
        "The sequence context portion of a sequence identifier for the indication. The sequence number portion of the sequence identifier is provided by the SequenceNumber property. The combination of both property values represents the sequence identifier for the indication.",
        "MSMCAEvent_SwitchToCPEPolling",
        "Parent Folder",
        "importedZoneCount",
        "// The number of bytes received using the IPSEC protocol.",
        "ROOT\\microsoft\\windows\\EventTracingManagement",
        "MIF.DMTF|Memory Device|002.16",
        "CIM::Network::IP",
        "CIM_PhysicalComputerSystemView.NumericSensorRateUnits",
        "UnSyncUnAssoc",
        "Heap Subsegment Failed Reusability check",
        "ref:M",
        "The reference to an instance of DN_Class that gives the ADSI path of the object below which the search should be scoped",
        "I_91BB5F8AFE5873E9BA8EBD1189F17D947DC5BB7E366AF568F25A5BD3FADD34E6.1334.3559712411.305",
        "PNP_EVENT_WARNING_LEVEL Flag",
        "2.26.0",
        "41006",
        "PhysicalSectorSize",
        "3 - Windows Server 2003, Communications Edition ",
        "ResetLimit",
        "Conflict",
        "Name under which the directory is exported.",
        "WMI_TAPE_MEDIA_PARAMETERS_GUID",
        "PerfInfo_V0",
        "PCI Component Information - Class Code Interface",
        "30A793AAB4882409B7",
        "Configure how the Win32_UserProfile::HealthStatus property should reflect the use of temporary profiles.",
        "ley\\* ",
        "TargetStorageFaultDomain",
        "CIM_OperatingSystemSoftwareFeature",
        "Service Marked For Deletion",
        "IPv6SourceRoutingProtectionLevel",
        "SYSID_1394",
        "This property contains the textual name of the local Operating System",
        "TemplateVersion",
        "smallAnimatedBitmapPath",
        "ref:Win32_NetworkAdapterConfiguration",
        "KerbProxy",
        "R_97C7D526C4DBEB7083476F235A5653C31F00C78AFD98652230E17D721E353ADD",
        "The product name, if available",
        "HOSTPROC_RESERVED_16",
        "MSFT_NetMainModeRule",
        "Counter8",
        "The ID of the Virtual Machine to which the queue is assigned.",
        "The RunRepeatedly property indicates whether the scheduled job should run repeatedly on the days that the job is scheduled.",
        "Indicates if provider should pick up the auto write cache size or not",
        "309EBEDE9286A9F3ADCBFE4044D787F3CCDADE24",
        "WLANMACAddress",
        "How the mouse is connected to the computer",
        "The number of outbound quick mode security associations (SAs) added by IKE ",
        "Values: TRUE or FALSE, A value of TRUE indicates the OperatingSystem was booted from a supported locally connected storage device.",
        "The name of the error type, for example : 'HRESULT' or 'MI_RESULT' or 'Win32'",
        "CwndRestart",
        "{8502C508-5FBB-11D2-AAC1-006008C78BC7}",
        "MCA_ERROR_REGISTER_FILE",
        "R_3A1D2B9036996AE4681DD029594209329760282E8301045223F1DC6AF85114EF",
        "Indicates that the device can be power managed - i.e. can be put into suspend mode, etc. This boolean does not indicate that power management features are currently enabled, only that the logical device is capable of power management.",
        "BFE2B8D722298B02602F918D61267E0DFA61213B",
        "CD_DBAFD0363B932C012CC74B45C91F067589F90C7E922E99CF5A5FE27D21332F93.1812.1.17862",
        "ROOT\\Hardware\\ms_409",
        "Management of physical connection points including ports,  slots and peripherals, and proprietary connections points.",
        "Adds a VPN connection to the Connection Manager phonebook. ",
        "CIM_OperatingSystem.CSName",
        "TransmittedFragmentCount",
        "Indicates whether to persist",
        "WmiDataId",
        "{0F73ED50-8ED9-11d2-B340-00105A1F8569}",
        "NDISWMI_TRACE_VMQ Flag",
        "JobStatus",
        "Select * from Win32_IDEController",
        "C_92F79C606CEA0C128DE3EACA21B84DC513661F7F539551F200C91725DE47D5D0",
        "CR_8E41820F5D3747F37A9AFB4C6D31D95936F76250DC1731B0B518951FA4D1C211",
        "**typedef** The name of the iSCSI header digest scheme in use within this session.",
        "The description for the network adapter driver.",
        "MDM_Policy_Result01_DeviceHealthMonitoring02",
        "TRC_WARNING Flag",
        "Indicates if VLANs are supported",
        "{8823d030-fa30-4b73-b339-db19207f0d81}",
        "QuerySecurity",
        "{ceb7253c-bb96-9dfe-51d1-53d966d0cf8b}",
        "MCA_WARNING_PCI_BUS_TIMEOUT",
        "MDM_EnterpriseModernAppManagement_AppManagement01_03",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services|EnableDHCP",
        "r0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109",
        "Specifies the printer for which to set properties.",
        "NdisAtmMaxActiveVcs",
        "The SpeakerModeDial property contains the command string used to turn the modem speaker on after dialing a number, and turning the speaker off when a connection has been established.",
        "TaskOffloadCapabilities",
        "IM Flag",
        "The web application shortcut file parent folder",
        "CIM_HostedBootSAP",
        "The previous self-test completed having the servo (and/or seek) test element of the test failed.",
        "NS_892F8DB69C4EDFBC68165C91087B7A08323F6CE5B5EF342C0F93E02A0590BFC4\\KI_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C\\I_B9EE4A50A67D6134A9B62FB7EC1E9B243A0F3C36ECEF51393A3D740A782225E0",
        "CollectionEnd",
        "Read errors not corrected by the storage device.",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pParameters",
        "R_5D84A86A9E670C8219DF639957B4D8868501AA04224951D3A5414B644058CEAA.1105.3541494386.568",
        "This property is a reference to the instance of Win32_Process that is part of the job object.",
        "RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls",
        "The Manufacturer property indicates the name of the SCSI controller manufacturer.",
        "ISCSI_ERR_UNKNOWN_ISCSI_OPCODE",
        "StartName",
        "MSFT_NetFirstLogonFailedII",
        "ref:MSFT_NetIKEQMCryptoSet",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_14E81FED65CA256A291552D7368076BDF086E65B079868D33E50C9799C909A98",
        "GlobalRefreshInterval",
        "TThreadId",
        "Win32_SystemServices",
        "100 - Flash Override ",
        "CR_155D9E7AE6D9F85361D5CC740FA1EFEDE91BCBF995E255746E05290A3497CB99",
        "{8502C51A-5FBB-11D2-AAC1-006008C78BC7}",
        "The Msft_WmiProvider_PutInstanceAsyncEvent_Post event class represents an event generated immediately following completion of the provider's implementation of IWbemServices :: PutInstanceAsync.",
        "R_293C515626057C49BE9FEBCADE3529905E03FDEE2BB0FB67FF107DAC390E7179",
        "SOMID",
        "SpinLockHoldThreshold",
        "Defines a single rule in a SOM, expressed as a query",
        "MIF.DMTF|Host Device|001.5",
        "FX_TRACE_IOTARGET",
        "MSFT_CliParam",
        "Double-Bit Error",
        "TEST_TRACE_FLTRDRIVER Flag",
        "Cluster size is too small",
        "SMBIOS|Type 16|Number of Memory Devices",
        "SampProcessMappedAttributes",
        "Registration data common to all instances of the Scripting Standard Consumer",
        "// firing this WMI event appropriately a miniport can cause a useful",
        "CD_BC8304297DAEA08EF836B71DA253942E5C6B510805DB5280CDD11086EF113EFB.1150.1519852227.337",
        "CursorBlinkRate",
        "Remark",
        "12 - CoWan",
        "The DefaultTTL property indicates the default Time To Live (TTL) value set in the header of outgoing IP packets. The TTL specifies the number of routers an IP packet may pass through to reach its destination before being discarded. ",
        "Join Domain -  Joins the computer to a domain. If this value is not specified, joins the computer to a workgroup. 0 bit - Join Domain - If not present, a workgroup is joined. ",
        "File systems supported on this subsystem.",
        "Resulting streamed output from GetConfigurationResultOutput method.",
        "CIM_PolicySetInRoleCollection",
        "Filters traffic based on certain high-level security constraints, like whether or not the traffic is encrypted.  Connection Security rules will have to be created in order for traffic to pass the rule.",
        "Failure - Unsupported File System",
        "\\\\.\\root\\Microsoft\\UEV:__Win32Provider.Name=\"ConfigurationItemProvider\"",
        "BootArchitecture",
        "eventLogName",
        "HealthActionId",
        "Total Files",
        "C_D3559258225BBBDD5E2DFDF52DE5A11681B899B436DB12CA240C43C8641B92A8",
        "{76148BF6-E3D1-11d2-8601-0000F8102E5F}",
        "Get resource states based on input configuration file.",
        "UdpIPv6",
        "MSADCO.1",
        "The Microsoft Defender Antivirus Scan Class",
        "CIM_LogicalDevice.SystemName",
        "Disable IPsec Task Offload v2 on the network adapter.",
        "CD_D628E03D0677752FF789EA97E9BA34C4E2A9B6A38484A7C74F4BA213CAD47E8C.0.2713842881.111",
        "CurrentDirectory",
        "SAM Name By Id",
        "{656E1F1E-E3D2-11d2-8601-0000F8102E5F}",
        "The platform architecture of the WDAC BidTrace setting. Possible values are '32-bit', '64-bit' or 'All'. The default is '32-bit' on a 32-bit process and '64-bit' on a 64-bit process. This is the platform architecture on the remote machine if this command is executed on a remote CIM session.",
        "MSFT_NetTakeOwnership",
        "VLActivationTypeEnabled",
        "AffinitySlotChanged",
        "TcpMappingTimeout",
        "Intel(R) Xeon(TM) processor MP",
        "TrustedStorePath",
        "16 - Don't Expire Password -  For Windows NT/Windows 2000: password should never expire on the account.",
        "Handshake - RTS is turned off if the transmission buffer is more than three-quarters full, and RTS is turned on when the buffer is less than one-half full.",
        "CasePreserved",
        "The installation source directory of the product.",
        "SMBIOS Bus Number.",
        "Service Unavailable",
        "Specify the time of day to run a scheduled scan.",
        "StandardBias",
        "CurrentManagementFirmwareMajorVersion",
        "Unknown Package",
        "MSFT_NetTransactTimeout",
        "Security Audit Success",
        "PortableDeviceTypes_General Flag",
        "CIM_AssociatedAlarm",
        "Specifies the number of underlying physical disks across which data should be striped. If specified, this value will override the NumberOfColumnsDefault value that would have been inherited from the resiliency setting specified by ResiliencySettingName.",
        "VersionCurrentlyRunning",
        "AMD AthlonMP(TM) Family",
        "MuiTrace",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_258A203CF40D0BB1DCA0464E58BDF32C1FE546C6E10F7B59F5BC4AD6787D2A7Ced. ",
        "ValidateTargetName",
        "ProviderOperation_CreateRefresher",
        "PARPORT_WMI_ALLOCATE_FREE_COUNTS_GUID",
        "2 - 'Unhealthy': The volume is not functioning, due to errors or failures. The volume needs immediate attention from an administrator.",
        "@)m;@)m;",
        "{0e9847b3-13e8-44e6-9659-2b60a140a573}",
        "AlphanumericDevicePasswordRequired",
        "WPD_TRACE_LEVEL_ERROR Flag",
        "Describes the NCSI Policy settings.",
        "LocalAuthorizedApplicationsDisallowed",
        "Function entry/exit (Detail)",
        "RD_TRACE_DMCONTROL Flag",
        "{9C88041D-349D-4647-8BFD-2C0A167BFE58}",
        "RetransmitIPV6",
        "C_4082A72ACD016CE3E809C18525EF28CAFFEB76B1D6E2F5C00FFCF2C67654A896",
        "M - The major version (in numeric form) describing the profile's creation or last modification. ",
        "RestartManager",
        "#define HBA_REGISTRY_BINDING_KEY            L\"Bindings\"",
        "FX_TRACE_RESERVED_1d",
        "MSFT_NetFirewallRuleFilterByApplication",
        "No_Alignment_Fault_Except",
        "Target-defined portion of the iSCSI Session ID",
        "AppvPublishingServer",
        "EOFCharacter",
        "{75BCF4F8-DB46-11D2-B4C8-80080C7B6371}",
        "SONET Path",
        "Values TRUE or FALSE. If TRUE, then only the state of kernel is written to a file in the event of a system failure. If FALSE, the system will try to log the state of the memory and any devices that can provide information about the system when it failed.",
        "ref:MSFT_NetAdapterRscSettingData",
        "Use HKLM",
        "MDM_PassportForWork_Device_Policies02",
        "MSDATL3.1 formatted output (A)",
        "Specifies the location of the printer.",
        "TM_NLAAPI",
        "Sets the IPsec parameters to default value",
        "CR_E69678D95075FB6BA6844B84FE0DE69C85BE49AC691754C5A6AA3AE728E45697",
        "object:LocalServiceSecuritySettings",
        "R_15DD3B0DCF2819EDB87C4363412C3F99792BF1AFEF4BDC92585A3BCD2CD95F12",
        "No Auto Release",
        "{e2a24a32-00dc-4025-9689-c108c01991c5}",
        "2 and 0 - Information and Unknown (respectively) follow common usage. Literally, the Error is purely informational or its severity is simply unknown.",
        "redirectionFlags",
        "Preferred",
        "This is a singleton that represents the Microsoft Antimalware service infection status",
        "CD_F5E490F396B19933B329A25606C9DB239136B855ECEF4EAC26CCB02B99FB61B0.1555.2510179974.803",
        "DefaultPrinterName",
        "ref:Win32_TSVirtualIP",
        "The WriteDebugInfo property has been deprecated in favor of the DebugInfoType property in the same class.  All future work should use this new property.  ",
        "ref:Win32_NetworkProtocol",
        "tE083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "Property for controlling IPsec encryption type for DA.  ",
        "The speed of the physical memory, in nanoseconds.",
        "The contract this endpoint is exposing.",
        "MSFT_TaskExecAction",
        "{dd9d47d1-282b-41e4-b924-66368817fcd3}",
        "FreqPercentage",
        "Worker Thread Event",
        "Type of the EAP used for this connection.",
        "CD_8757FA834BF17A34F40DA9E567F73EB3C0F519BA77B457CB4D641370202A1355.136.2445950292.4355",
        "MIF.DMTF|Physical Extent|001.8",
        "AllowCertificateAddressMismatchWarning",
        "CD_1B2F7F9B30B8E3085F6FFF8AD6831B1EC53004667DF11651EE5F82516EC047F3.2625.1266690007.570",
        "**typedef** The transport protocol over which this connection instance is running.",
        "The template ID",
        "Speed of network link in megabits per second.",
        "RemoteAdministrationAccessEnabled",
        "Schedule",
        "Do Until Failure - execute actions according to predefined order, until the first failure in execution of an action instance.",
        "Localized version of RSOP_PolmkrStartMenuSetting for American English",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2750.1656231170.180",
        "MultiLayer",
        "MSFT_NetAdapterPowerManagement_Offload_Arp contains settings related to ARP offloading.",
        "ConfigStorageSenseGlobalCadence",
        "Set current brightness setting",
        "Process management. ",
        "MIF.DMTF|Operational State|003.5",
        "CIM_SystemResource",
        "ROOT\\standardcimv2\\embedded",
        "Batch",
        "ProcessorURL",
        "DSAccess_AuditDetailedDirectoryServiceReplication",
        "Bid2Etw_SQLOLEDB_1",
        "Renames the specified printer.",
        "MSWmi_PnPDeviceId",
        "UmsDirectedSwitchEnd",
        "IsAuthorized",
        "FRU name.",
        "MSFT_NetBranchCachePrimaryCache",
        "NoConnection",
        "Prefix origin of this address.",
        "{2ee6aef1-0851-458b-bf0d-792343d1cde1}",
        "TROJAN_DENIALOFSERVICE",
        "LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls",
        "Unhealthy threshold, in hours. If the number of hours since the last attempted synchronization is greater than or equal to this threshold, the HealthStatus property of the Win32_FolderRedirectionHealth class is set to Unhealthy.",
        "NS_3579DC951657EA60871CD1E9EBEE6A8D0AD711287837BD9631F6B3FC9EC7141E",
        "ProviderVersion",
        "Number of soft resets issued by the controller. A soft reset does not completely clear current device state and/or data. Exact semantics are dependent on the device, and on the protocols and mechanisms used to communicate to it.",
        "DSClass",
        "MGR_TRACE_RESERVED_16 Flag",
        "PerformanceState",
        "LicensingClientId",
        "ChangeUserPassword",
        "IsVolumeInitializedForProtection",
        "This method allows the file server to be renamed.",
        "IPEnabled",
        "MaxTries",
        "Receive filter hardware capabilities of the adapter",
        "NDIS Dot11 Scan Confirm Status Indication",
        "Supports NTFS File System",
        "The Manufacturer property indicates the name of the USB controller  manufacturer.",
        "FaxCtlGuid",
        "CR_A8DDF63277493FA7727FA87F83A98725771DF4DFD8E57B19F776BF46D63FDE5D",
        "Place Favorites At Top Of List",
        "The number of receive cells the NIC has dropped.",
        "Target Address",
        "Which profiles this rule is active on.",
        "{E5D8A560-F6C0-11d2-B35E-00105A1F8569}",
        "{8502C58A-5FBB-11D2-AAC1-006008C78BC7}",
        "%%%%%Error%",
        "ObObjectEvent",
        "No Paper",
        "HighlyRestricted",
        "{485e7de8-0a80-11d8-ad15-505054503030}",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"VolumeChangeEvents\"",
        "AdditionalAvailability",
        "{7a877086-2204-4a8a-92a4-e3e8ab626629}",
        "Specifies the path to the data package",
        "The NASRollback Win32_ShadowContext specifies a persistent, and non auto-release shadow copy without writer involvement.",
        "SidTypeGroup",
        "      <registryValue",
        "SelfTestStatus",
        "SingleVportPoolSupported",
        "7 - 'Non-Recoverable Error': A non-recoverable error has occurred.",
        "This property is a reference to the instance that contains limit settings for the job object.",
        "WMI|Win32_DCOMApplication",
        "This specifies the way the setting value should be compared.",
        "5 - 'Major': Immediate action is needed. ",
        "PhoneUpdateRestrictions",
        "DirectorySpecification",
        "CIM|CIM_DataFile",
        "ConfigurationDownloadManagers",
        "MSSerial_CommProperties",
        "AlignmentClusters",
        "DeleteExpiredTaskAfter",
        "C_D20240298678DE7FA3C580B599D2D13C6F4AD796F634F024D78D97ACD858006A",
        "FileSizeOnPerformanceTierClass",
        "ActiveTripPoint",
        "CD_566A3F0A3752D08CE0ADC81B0285E070B30778837B6AE3D337DCE7469AD2C7FD.286.3351955927.926",
        "Represents the IPInterfaceIPAddress association class in TCPIP WMIv2 provider.",
        "5.25, 360KB,  512 bytes/sector",
        "HBA_PORTSPEED",
        "MSNdis_PortChar",
        "The SystemElement reference represents the the Plug and Play device associated with the logical device.",
        "MIF.DMTF|Power Supply|002.7",
        "A value that specifies whether messages are traced at the service level (before encryption and transport-related transforms).",
        "Registration Key with which to register with the Resource Repository Web",
        "Bit flags specifying inheritance of the ACE",
        "Established",
        "Maximum number of neighbor cache entries.",
        "CD_9257E4A3C9993B750EBCB6C34C9BA11105FABAD75B9C0DE005A64417B00B58B0.102.1548703774.2058",
        "Example: MS San Serif.",
        "Trace Record",
        "{8502C504-5FBB-11D2-AAC1-006008C78BC7}",
        "W!UT%",
        "The DnsForestName property indicates the name of the domain at the root of the DS tree. The DNS-style name (for example, microsoft.com.) will be returned if available. ",
        "MSFT_ExpressionIdentifier",
        "IL_B164027B8F8EDAE57EABF8CD1B8464CBA3C565F2CE3EE41FF4CD5FD7099DFE7C.2700.2378009690.275",
        "System Parameters",
        "{FAF76B6B-798C-11D2-AAD1-006008C78BC7}",
        "3221232513",
        "The Location reference represents the other side of the Check.",
        "TTOption",
        "TransportSecurityBindingElement",
        "{78ebc103-4cf9-11d2-ba4a-00a0c9062910}",
        "Integrity Streams",
        "Creates User Disk Template of specified max size and at the specified location. All User Disks created will have max sizes matching the Template's max size.",
        "BottomU",
        "R_C942A8F8E1BE4E76DBC399ECCEE0BD23B27FF78ECB20D416057B9D24D6D47B1E.2462.1209922039.558",
        "NDIS Notify VC Removal",
        "ALPC Send Message",
        "FolderId",
        "NewTerminalName",
        "Thread Set Name Event",
        "{ff0c6ce2-9528-4a91-b9c7-bcf834b6f79a}",
        "The Win32_OperatingSystem antecedent reference represents the Win32_OperatingSystem effected by the product update in this association.",
        "InRespBufferMaxSize",
        "NETIO_TRACE_TRANSPORT",
        "MSFT_NetAdapterSriovCapabilities",
        "The scoping System's CreationClassName. ",
        " An association between a service access point and how it is   implemented in software.  The cardinality of this association  is many-to-many.  A SAP may be provided by more than one  software feature, operating in conjunction.  And, any  software feature may provide more than one service access point. a  When many software features are associated with single SAP,  it is assumed that these elements operate in conjunction to  provide the access point.  If different implementations of a  SAP exist, each of these implementations would result in  individual instantiations of the service access point object.  These individual instantiations would then have associations  to the unique implementations. ",
        "UserSettings",
        "PointingType",
        "ISCSI_ERR_INVALID_STATUS_SEQ_NUM",
        "EVENT_TRACE_FLAG_C",
        "On Demand File Extension",
        "The ProcessID property indentifies the process that loaded the module.",
        "PortConnector",
        "The underlying file system type of the volume.",
        "I_59543DA79A0A83C48BB9222B5916E17BBA9A5688C362D35DD3F13589A2596294.1164.4075838192.328",
        "{765dc702-c5e8-4b67-843b-3f5a4ff2648b}",
        "If true, indicate if this folder is being redirected.",
        "Maximum number of load-unload cycles within which the storage device is capable of normal operation.",
        "The AutoTreatAsClsid property contains a Globally Unique Identifier (GUID) for the COM component that will automatically emulate instances of this class.",
        "See CIM_ComputerSystem.Dedicated for details.",
        "%Milliseconds%",
        "The CIM_RedundancyComponent class associates a redundancy group composed of managed system elements and indicates that these elements, taken together, provide redundancy. All elements aggregated in a redundancy group should be instantiations of the same object class.",
        "ActualColorResolution",
        "HNet_FwIcmpSettings",
        "65B1148A99781C10E7A7B.2060.634247663.1091",
        "If TRUE, the partition will not be able to receive a drive letter assignment, nor will mount manager assign a volume GUID name. The partition will not be enumerated by the FindFirstVolume and FindNextVolume functions. The partition can be opened by its associated volume device name (i.e. \\?GLOBALROOT\\Device\\HarddiskVolumeX).",
        "RevertToDefault",
        "Values: TRUE or FALSE. If TRUE, the system will send an alert to the system administrator.",
        "WdfPassiveISR",
        "The ViaUri.",
        "WebInvokeAttribute",
        "MDM_Policy_User_Config01_Settings02",
        "CIM_DNSGeneralSettingData",
        "CIM_VolumeSet",
        "MSNdis_AtmReceiveCellsDropped",
        "Number of bytes for header/data split current config change indication",
        "NumberOfGroups",
        "SamNameById_End",
        "TL_WARN",
        "CIM_NumericSensor.LowerThresholdNonCritical",
        "Application on the Start Menu of a Terminal Server",
        "{8502C4FE-5FBB-11D2-AAC1-006008C78BC7}",
        "LUAInstall: error 0x00000005 setting flags [{93cf36dd-dc00-499c-8477-7cbe51501a15}]",
        "EAP Configuration xml used for this connection.",
        "TerminalName",
        "{a1d71610-3d63-4e02-9314-ae35d9b3233c}",
        "The Flags property indicates the properties available to this network profile.  Properties that can be set include:/nUF_SCRIPT -  A logon script executed./nUF_ACCOUNTDISABLE -  The user's account is disabled./nUF_HOMEDIR_REQUIRED -  A home directory is required. /nUF_PASSWD_NOTREQD -  No password is required./nUF_PASSWD_CANT_CHANGE -  The user cannot change the password./nUF_LOCKOUT -  The account is currently locked out. For NetUserSetInfo, this value can be cleared to unlock a previously locked account. This value cannot be used to lock a previously unlocked account./nUF_DONT_EXPIRE_PASSWD -   password should never expire on the account./nThe following properties describe the account type. Only one value can be set:/nUF_NORMAL_ACCOUNT -  Default account type that represents a typical user./nUF_TEMP_DUPLICATE_ACCOUNT -  An account for users whose primary account is in another domain. This account provides user access to this domain, but not to any domain that trusts this domain. The User Manager refers to this account type as a local user account./nUF_WORKSTATION_TRUST_ACCOUNT -  A computer account for a workstation or a server that is a member of this domain./nUF_SERVER_TRUST_ACCOUNT -  A computer account for a backup domain controller that is a member of this domain./nUF_INTERDOMAIN_TRUST_ACCOUNT -  A permit to trust account for a domain that trusts other domains.",
        "ConsistencyType",
        "CD_3E82FB959451C3E35A276AAA1FE1C0F9B93A0726AEE69E99BECBBEB606DABFAD.1149.1822413114.394",
        "HiPerf",
        "The DaylightMonth property specifies the month when the transition from standard time to daylight savings time occurs on this operating system.",
        "InstallationState",
        "Microsoft iSCSI Initiator: Persistent Login Class",
        "{8502C4C1-5FBB-11D2-AAC1-006008C78BC7}",
        "Status Invalid Parameter",
        "R_F27728D32A3636F45280AD3F71C73821FAB17D765ED15BCD09B89B7007E5475A",
        "PostOpCompletion",
        "RemoveByName",
        "POLICY",
        "MDM_DeviceStatus_TPM01",
        "SPACES_StorageNodeToVirtualDisk",
        "The accuracy of the reading.",
        "The appdomain id of the appdomain that hosts the contract.",
        "Subnet Mask",
        "CD_E4F1C8D43CF6961CAD75D4CE9F32B9D90760450C3087C094F4C15FE6A994A33D.1616.1830096799.427",
        "Enable_BCServeOnBattery",
        "If TRUE, the CreateVirtualDisk method on the storage subsystem is supported.",
        "CIM_PhysicalComputerSystemView.LogCurrentNumberOfRecords",
        "AssessmentState",
        " Where ID = '#'",
        "Value of the storage health setting.",
        "The StandardDayOfWeek property specifies the day of the week when the transition from daylight savings time to standard time occurs on this operating system.",
        "NdisCoTransmitPduErrors",
        "If set to TRUE, this instructs the enclosure to set the power of the specified element to Off. The element should remain Off until a second call to PowerElement on the same element is made with this parameter specified as FALSE.",
        "Status of the IP-HTTPs interface",
        "Unknown failure",
        "Destructor",
        "Example: System Slot 1",
        "The Sources property indicates the applications that are registered to log into this log file.",
        "True if the namespace exists in the specified security zone",
        "PolicySourceHardwareGraphicsAdapter indicates whether the property HardwareGraphicsAdapteris configured by Server (0),Group Policy (1).",
        "LSO properties for a network adapter.",
        "{f01b7774-7ed7-401e-8088-b576793d7841}",
        "Directory Control",
        "IMAPI2_DebugGeneral",
        "The InfSection property indicates the section of the .inf file where the Win32 video information resides.  ",
        "GUID_REDBOOK_WMI_PERF_DATA",
        "Servers to perform name resolution against",
        "The CIM_ElementConformsToProfile association defines the RegisteredProfiles to which the referenced ManagedElement is conformant. Note: This association may apply to any Managed Element. Typical usage will apply it to a higher level instance, such as a System, NameSpace, or Service. When applied to a higher level instance, all constituent parts MUST behave appropriately in support of the ManagedElement's conformance to the named RegisteredProfile.",
        "FCSErrorCount",
        "CD_1F25AAFC1DFD302234A597D09198F965D3DA468B1863CE8D32B13C0CE151009D.35.2557704513.1124",
        "CleaningActionID",
        "ReadPolicy",
        "ExpectedPID",
        "DOT11_MSM",
        "cmdletOutput",
        "DestName",
        "yFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "The IPFilterSecurityEnabled parameter specifies whether IP security is enabled globally across all IP-bound network adapters. If the input parameter IPFilterSecurityEnabled is TRUE, security is enabled. If the input parameter IPFilterSecurityEnabled is FALSE, all port and protocol traffic are allowed to flow unfiltered.",
        "Timeout Flag",
        "HBA_EVENT_PORT_BROADCAST_D29_7",
        "The MaximumComponentLength property indicates the maximum length of a filename component supported by the Win32 CD-ROM drive. A filename component the portion of a filename between backslashes. The value can be used to indicate that long names are supported by the specified file system. For example, for a FAT file system supporting long names, the function stores the value 255, rather than the previous 8.3 indicator. Long names can also be supported on systems that use the NTFS file system.",
        "NumberOfRecords",
        "MaximumBlockSize",
        "SystemConfig_V2",
        "Directory Service (DS) flag indicating that the domain controller is the Primary Domain Controller (PDC) of the domain.",
        "A power setting.",
        "HostedCacheVersion",
        "caption",
        "The JoinDomainOrWorkgroup method joins computer systems to a domain or workgroup.  This method is only available on Windows 2000 platforms and beyond. The method can return the following values:/n0 - Success./nOther - For integer values other than those lis",
        "PolicyAppId",
        "Allows an administrator to explicitly disable a scan from checking any of the extensions listed.",
        "SCSI Parallel Interface",
        "MSFT_NetAdapterPowerManagement_WakePattern_Bitmap defines settings for waking on a bitmap/mask wake pattern.",
        "C_F77EA4DCA78917FF5BEAD9815A0440B9CD3C526312D9427341EC66F96C8BAA82",
        "Class for doing operations to iSCSI Target",
        "Errors System",
        "C_07C552EB8842D691C4A22716140805262ED277A06CAB4124C417993F14E689CF",
        "The number of frames detected in error by this NIC that have not been detected in error by another device on the ring.",
        "C_EC97D00816B4530E92B0346A6B6B453699A71F2B879F99F794A6FF9189BD53FF",
        "Connection Type",
        "object:MSiSCSIInitiator_TargetMappings",
        "{6E7E2EF2-F881-472A-8E32-17CA95710402}",
        "This method will install an associated Product using the installation package provided through PackageLocation and any command line options that are supplied.",
        "PassThroughNamespace",
        "The Create method is used to create a new instance of the Win32_DfsNode class.",
        "Optional. String that specifies the namespace to which you log on. For example, to log on to the root\\default namespace, use 'root\\default'. If you do not specify this parameter, it defaults to the namespace that has been configured as the default namespace for scripting. For more information on the default value for this parameter, see WMI SDK help entries on Object Creation and Monikers.",
        "AttributeCachingForDirectoriesMin",
        "The DMABufferSize property indicates the size of the Direct Memory Access buffer.",
        "R_703C562B7404A6234AAFEB9B3BB242E3FF62C76339F84C997DCEF89443C2DF65",
        "MaximumAddressSize",
        "{f1d6abe8-15e4-4407-81b7-6b830c777cd9}",
        "OEMEventCode",
        "11..32767",
        "The KeepAliveInterval property indicates the interval separating Keep Alive Retransmissions until a response is received. Once a response is received, the delay until the next Keep Alive Transmission is again controlled by the value of KeepAliveTime. The connection will be aborted after the number of retransmissions specified by TcpMaxDataRetransmissions have gone unanswered. Default: 1000, Valid Range: 1 - 0xFFFFFFFF.",
        "NS_FE3EA006C3292950A76C2B5A0185D7DF99ADD6FD6502E0AC079E3A8650E76E3A\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_3985A64DD548C159337A855FB2D96B222C50720949C8FDEAE049F7ADFD2826A5rame",
        "The WallpaperTiled property indicates whether the wallpaper is tiled or centered.",
        "C_F0EF832F7E32814D7777DD11888257DC22CAE482B915B9B0977CF796309CDC79",
        "DNSDomain",
        "The MessageInterval property specifies the length of time between messages sent to users to inform the users of power failure.",
        "The ExitCode property specifies a Win32 error code defining any problems encountered in starting or stopping the service. This property is set to ERROR_SERVICE_SPECIFIC_ERROR (1066) when the error is unique to the service represented by this class, and information about the error is available in the ServiceSpecificExitCode member. The service sets this value to NO_ERROR when running, and again upon normal termination.",
        "SSID string",
        "MIF.DMTF|Temperature Probe|001.13",
        "File Create",
        "WSP_StorageArrivalEvent",
        "MSFT_VirtualDiskToStorageTier",
        "Win32API|System Structures|CM_PARTIAL_RESOURCE_DESCRIPTOR|Interrupt|Level",
        "HBA_EVENT_ADAPTER_CHANGE",
        "The SupportsEncryption property indicates whether the protocol supports data encryption.",
        "CD_FF89590C844CBA58D43564BFAF3A9C1E0ACA3DFA20CB42FA7E832F2021AD16C0.29.2732496118.692",
        "C_0F40AC813525BF23B517D1D92CC88BD22739A3C5B59B5537548A36265FEAE58A",
        "ReadAccess",
        "22..32767",
        "PersistenceProviderBehavior",
        "{651d672b-e11f-41b7-add3-c2f6a4023672}",
        "TEST_TRACE_RESERVED_09",
        "The operating system's number for the disk. Disk 0 is typically the boot device. Disk numbers may not necessarily remain the same across reboots.",
        "This method invokes the chkdsk operation on the disk. The method is applicable to only those instances of logical disk that represent a physical disk in the machine. It is not applicable to mapped logical drives. The return value of the method will indica",
        "C_8E07A2F75E966B98765D0E68961E5A84D43A10AD950CED298EB40220B7B9296C",
        "select * from WSP_FsStorageArrivalEvent",
        "DomainUser",
        "Composite Volume Member",
        "A link between the computer system and the file system(s) hosted on this computer system.",
        "    <registryKey keyName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\InstallService\\InstallWorkFactories\">",
        "GetKeyProtectorPlatformValidationProfile",
        "{e76fdaf3-0be7-4d95-87e9-5aead4b590e9}",
        "The NoAutoRelease property indicates whether the shadow copy is automatically deleted when the shadow copy requestor process ends.  If this property is TRUE, the shadow copy is retained after the requestor process ends.",
        "Specifies whether the RD Session Host server uses the hardware graphics renderer as the default adapter.",
        "Package family name of the Application",
        "Disables Rdma on the network adapter.",
        "Block content",
        "The SystemPaletteEntries property indicates the current number of color index entries reserved for system use. This value is only valid for display settings that use an indexed palette . Indexed palettes are not used for color depths greater than 8 bits per pixel. If the color depth is more than 8 bits per pixel, this value is set to NULL.",
        "The maximum cache file size, represented as a percentage of the disk volume on which the cache is stored",
        "RunDay",
        "DisplayOffTimeoutOnBattery",
        "0x102",
        "DisableCompatView",
        "__SecurityDescriptor",
        "ref:MSFT_NetIKEP1AuthSet",
        "SamGrpCreate_Start",
        "CR_F10840352061CD18DB7516F60841E629D131C524C9F2F089E5D2B510560FC583",
        "object:HBAFC3MgmtInfo",
        "C_70B5C3F445D36D84AF1F9F0E062B6A21EF707E1616BEC072F41A3F1113BAD785",
        "Specifies the total amount of kernel-mode execution time, in 100 nanoseconds, for all active processes associated with the job, as well as all terminated processes no longer associated with the job.",
        "16450 Compatible",
        "It is possible that a particular instance of EnabledLogicalElement may not support RequestedStateChange. If this occurs, the value 12 (\"Not Applicable\") is used.",
        "{7f3fe630-462b-47c5-ab07-67ca84934abd}",
        "\\\\.\\root\\cimv2\\power:__Win32Provider.Name=\"ProfileAssociationProviderCimV2\"",
        "CacheOp",
        "MSiSCSI_MMIPSECStats",
        "A string that contains the configuration name of the binding. This value is a user-defined string that acts as the identification string for the custom binding.",
        "Optional text provided by the customer and included in the Issuance License (IL).",
        "OakleyMainMode",
        "Character Set: Alphanumeric  ",
        "<B>Note:</B> The name of the drive does not correspond to the logical drive letter assigned to device, which is the name of the logical storage device dependent on this drive.",
        "LockedDownInternetZoneInitializeAndScriptActiveXControls",
        "Number of horizontally active pixels",
        "Inconsistent",
        "CD_1E626C3D32F7EF024573AE985B5FB35B84A93E624F99B15B594BE7E0989B4A14.2623.593840701.809",
        "Where <OrgID> and <LocalID> are separated by a colon ':', and where <OrgID> MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business entity creating/defining the InstanceID, or is a registered ID that is assigned to the business entity by a recognized global authority (This is similar to the <Schema Name>_<Class Name> structure of Schema class names.) In addition, to ensure uniqueness <OrgID> MUST NOT contain a colon (':'). When using this algorithm, the first colon to appear in InstanceID MUST appear between <OrgID> and <LocalID>. ",
        "{29380131-a312-4400-be0c-53877a41c465}",
        "Major",
        "TextMessageEncodingBindingElement",
        "The FileSystemSize property stores the total size of the file system in bytes. If unknown, enter 0.",
        "RSS capabilities of the adapter",
        "BIOSVendor",
        "CD_A0C4181E36B5BF6BE271221B7FC9D6F392B6369BD0BAB6A546F2790003BEF7B3.2198.3548258565.1830",
        "IPv4TransmitTcpChecksumSupported",
        "C_BB925C26F6C4E973C68AC5FC9E68CE66EBB8087D6E05ABF71723D446983422A5",
        "Capabilities and management of cooling devices.",
        "This method is used exclude disks from the chkdsk operation to be run at the next reboot. If not excluded, chkdsk is performed on the disk if the dirty bit has been set for the disk. Note that the calls to exclude disks are not cumulative. That is, if a call is made to excluded some disks, then the new list is not added to the list of ones that were already marked for exclusion, instead the new list of disks overwrites the previous one. The method is applicable to only those instances of logical disk that represent a physical disk in the machine and is not applicable to mapped logical drives. /nFor example, a valid specification of drives would be \"C:\", \"d:\",\"G:\"  Note that the colon is required with the drive letter.",
        "AllowCredSSPAuthenticationService",
        "// your adapter would implement 3 instances of this class.",
        "DeviceSleepOnDisconnect",
        "4 - 'After Delta': This indicates that the replica will be maintained as delta data from the source object. ",
        "This class is the SAS_Port attributes",
        "MCA_ERROR_PCI_BUS_SERR_NO_INFO",
        "ROOT\\Microsoft\\Windows\\Powershellv3",
        "CIM_SupportAccess",
        "RemoteMachines",
        "MSFT_Pipeline",
        "Example: C:\\Program Files",
        "TRC_WARNING",
        "8 - Oversubscription Error. Errors of this type are principally associated with the failure to allocate sufficient resources to complete the operation. ",
        "Represents a WSD or IPP printer port",
        "ref:CIM_Job",
        "The DaysOfMonth property indicates the days of the month when the job is scheduled to run.",
        "MDM_Policy_Config01_ServiceControlManager02",
        "C_9A6F5375A9497C640DD14311C5D352C43D073997E82C517C2CD3321E7C391BFA",
        "SamSetMemAttrsOfGrp_End",
        "Win32_MemoryArray",
        "SM_GetTargetMapping",
        "EnableByTemplateId",
        "PoolId",
        "Free Space Percent",
        "A physical component is replaceable  if it is possible to replace (FRU or upgrade) the element with a physically different one.  ",
        "MaxHeaderSize",
        "DaysLeft",
        "Describes the recovery action to be taken for an unsuccessfully run Job. The possible values are: ",
        "12 - 'No Contact': The storage provider has knowledge of the disk, but has never been able to establish communi%",
        "0xEFFF0002",
        "CD_F57973CF3F7C64653DDA6A8742229664CE37027D841F58BB761893FA6B462162.1580.3372814455.1282",
        "The SpeakerModeSetup property contains the command string used to instruct the modem to turn the speaker on (until a connection is established).",
        "Heap Contract",
        "RequestNoSinglePointOfFailure",
        "I_725C909F3FE4FF1D4452519DC5E7319F49B4FDA30799FA428AB30E8A93652894.828.1.81389",
        "R_54C8B2145FBF6DCDCAEFF33B39FBF359799D5087F9B974E853C4A5903604B330",
        "Not Found",
        "CR_664AF66B21C2039DE71ED4563B6D82F78FB404975A3235A5DEEC63FCFAD8513C",
        "C_D0463C61C5FB59AFB14652F5029984454DBCBB9EA71D7BD37E6D26E78285BA33",
        "Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_RLSD",
        "select * from MSFT_StorageHealthStatusChangeEvent",
        "Controller shall supply Hsync during Vsync",
        "IsLockedOut",
        "Enumeration",
        "CIM_VideoController.CurrentHorizontalResolution",
        "The main mode crypto set used in this rule.",
        "ref:MSFT_NetServiceFilter",
        "CD_9E784A36A3818CCEF710DDD5C36D397926DEF1DD3DBF75F107C211B75FEBAA90.1515.2105838193.6027",
        "This class represents the settings for the autochk operation for a disk. The setting applies to all disks on the computer system. Note that the settings are applicable only to instances of logical disk that represent physical disks on the machine and not to mapped drives.",
        "MIF.DMTF|Power Supply|004.21",
        "CIM_DeviceSAPImplementation",
        "{1dac0dfe-43e5-44b7-b759-7bf46de32e81}",
        "A user-friendly string representing the description of the replication group.",
        "Logon Type",
        "ReplacementPolicy",
        "The CodePage property specifies the code page for the user's language of choice.  A code page is the character set used.",
        "The StackBase property indicates the base address of the thread's stack.",
        "MSFT_CliAlias.FriendlyName=\"LOGON\"",
        "SamGetGrpsForUser",
        "IsPublishedToUser",
        "LUAInstall: error 0x00000005 setting flags [{7312498D-E87A-11d1-81E0-0000F87557DB}]",
        "Number of failed AAAA queries",
        "Process_Defunct_TypeGroup1",
        "{89497f50-effe-4440-8cf2-ce6b1cdcaca7}",
        "Represents the total output power of the power supply in Milliwatts. 0 denotes 'unknown'.",
        "Windows7",
        "Storage Enterprise Server Edition",
        "LocalTalk",
        "MSFT_NetAdapterPowerManagement_Offload_RsnRekey contains parameters for offloading the RSN Rekey protocol.",
        "Win32_ActionCheck",
        "WFP_TRACE_STM Flag",
        "The CIM_ClusteringService class represents the functionality provided by a cluster. For example, failover functionality may be modeled as a service of a failover cluster.",
        "R_698A32B2EFB9AF12EFCD0A0FC46109785288AB2107A556F691113D8AB3DB5783",
        "NDIS FDDI Long Current Address",
        "The ProcessHandle property indicates the process that created the thread. The contents of this property can be used by Win32 API elements.",
        "Association between the security settings of a file/directory and one member of its DACL",
        "NdisAtmReceiveCellsDropped",
        "This method is used exclude disks from the chkdsk operation to be run at the next reboot. If not excluded, chkdsk is performed on the disk if the dirty bit has been set for the disk. Note that the calls to exclude disks are not cumulative. That is, if a call is made to excluded some disks, then the new list is not added to the list of ones that were already marked for exclusion, instead the new list of disks overwrites the previous one. The method is applicable to only those instances of logical disk that represent a physical disk in the machine and is not applicable to mapped logical drives. ",
        "Version Number Lo",
        "MCA_ERROR_PCI_BUS_UNKNOWN",
        "Exception",
        "FrequencyRangeDescriptor",
        "The cipher algorithm for the first operation",
        "MSNdis_SetPortParameters",
        "CD_8BF1B53C1F7CA8C4B9A4193DB4F8D9C9B5E53B2A698928B57CB97CFCCD44963C.1930.1978430390.333",
        "StackThread",
        "C_F27728D32A3636F45280AD3F71C73821FAB17D765ED15BCD09B89B7007E5475A",
        "The name of the device object for this adapter.",
        "Example: somedomain\\johndoe",
        "MSNdis_StatusDot11RoamingStart",
        "Category of Notification.",
        "TRACE_UNITTEST Flag",
        "IL_C004F31EED0C3389D3663FFEDC2379761F7F253446DFB3E07A859B8D44F5D78E.417.1.15778",
        "{740f3c34-57df-4bad-8eea-72ac69ad5df5}",
        "ReceivedUnicastPackets",
        "SMI-S",
        "IL_352DA062E6CEF4DA2F5F5D5156A0C6A57E2D07D0BD43F09E3B9B31D33B72076E.2462.3117649240.360",
        "The file sharing protocol used by the share if the server supports more than one protocol.",
        "DeviceURL",
        "ChangeAccess",
        "The ThreadID property contains the thread identifier of the thread involved in the event.",
        "Initial",
        "WMI_Tracing_Client_Operations",
        "0x8004..",
        "ConnectionErrorPerformanceCounterMissing",
        "Enterprise Server IA64 Edition",
        "8      The driver loader for the device is missing. ",
        "PreferenceIndex",
        "MIF.DMTF|Location|001.2",
        "11002",
        "The logical device needing or associated with the battery",
        "C_B16263CC6C59AA3DEF58BA0C86C651F601D7D8872D7821EC2597A2AFC1F04035",
        "EngagedRestartTransitionSchedule",
        "Indicates if the Adapter supports segmentation when the final packet length is less than MSS for IPv4.",
        "NDIS Token Ring Last Open Status",
        "SamAddMemGrp",
        "The CliSeeAlso association provides a relationship between an alias and related aliases that may be used as a part of the same role.",
        "If in character mode, number of columns for this video controller. Otherwise, enter 0.",
        "If set to TRUE, this instructs the physical disks in the storage enclosure to enable maintenance mode.",
        "TCPIPv4Checksum",
        "LetAppsAccessCellularData_ForceAllowTheseApps",
        "The average size of free space extents on the volume.",
        "Size of Raw Error Record",
        "The TypeOfAlgorithm specifies the algorithm used for data redundancy and reconstruction. For example, \"P+Q\" (value=5) or \"P+S\" (7) may be specified. The value, 0, is not valid in the CIM Schema since in DMI it represents that no redundancy exists.  In this case, the object should not be instantiated.",
        "SentUnicastBytes",
        "EVENT_TRACE_FLAG_K",
        "This storage pool does not support the creation of tiered virtual disks with custom allocation unit sizes.",
        "Enterprise Server Edition",
        "WindowTitle",
        "TRACE_CLASS_COMMAND Flag",
        "This property corresponds to CIM_PhysicalFrame.SerialNumber. See CIM_PhysicalFrame.SerialNumber for details.",
        "MSFT_HealthRecordReal64",
        "KeyManagementServiceLookupDomain",
        "redirectedPaths",
        "LPC_TRACE_RESERVED_11 Flag",
        "AllowDeveloperTools",
        "IRQAffinity",
        "{890CB943-D715-401b-98B1-CF82DCF36D7C}",
        "MDM_Policy_Result01_RemoteProcedureCall02",
        "LowerThresholdFatal",
        "The VersionIndependentProgId property contains a program identifier that is consistent for all versions of the same program.",
        "object:Win32_RoamingProfileBackgroundUploadParams",
        "           // Binary IPv4 address",
        "A value that specifies whether malformed messages are logged.",
        "MaxLookaheadSplitSize",
        "Sets various attributes and properties of the partition.",
        "EnablePinRecovery",
        "75 - No primary/secondary WINS server defined",
        "{0f760256-8fc6-47ad-9d2e-f0d69801de7c}",
        "Describes settings related to BranchCache",
        "Limit Job Memory",
        "{aaacfca7-954a-4632-a16e-a8a63793a9e5}",
        "The SetDefaultPrinter method sets the printer to be the default printer for the user who executes the method. The method can return the following values:",
        "DeviceNumber",
        "This is the type of partition, MBR or GPT..",
        "{932B59F2-90C2-D8BA-0956-3975C344AE2B}",
        "A namespace that may belong in a security zone",
        "CD_F9D4723921ADF841BA7CC65756244CF775FD9B7C648EEDAFF1E2DDD459957AE2.1135.1356573348.199",
        "TransparentCachingLatencyThreshold",
        "Low Toner",
        " The AllowDownVersion property indicates that this software element  can transition to its next state even if a higher or latter version  of the software element already exists in the  environment.",
        "Number of vertically active pixels",
        "{8502C4BB-5FBB-11D2-AAC1-006008C78BC7}",
        "BB98D107166F8216FEE25A312878D4AECBB89966D3EAC52B5F6",
        "Phone",
        "SupportAccessID is an arbitrary, free form string defined by the product vendor or by the organization that deploys the product.  This property, since it is a key, should be unique throughout the enterprise.",
        "CIM_JobDestination",
        "Method",
        "The Dependent reference represents the properties of the logical device that is using the system resources assigned to it.",
        "Source Quench",
        "AutoBoostEntryExhaustion",
        "ProtectKeyWithTPMAndPINAndStartupKey",
        "Number of PDU received over this session",
        "The total number of Master File Table fragments on the volume.",
        "LocalSystemHost",
        "{E2AD2F90-AC32-4DF6-B47A-61458E559320}",
        "TRACE_FLAG_INIT",
        "ToolBoxBitmap32",
        "The Win32_NetworkAdapterConfiguration class represents the attributes and behaviors of a network adapter. This class has been extended to include extra properties and methods that support the management of the TCP/IPprotocols (and are independent of the network adapter).",
        "The event source",
        "The physical medium type of the NIC.",
        "A textual description of the adapter.",
        "File Server",
        "The MacAddress or the LinkLayerAddress of the VM Network Adapter.",
        "The Target Address type given is not supported",
        "ElapsedTime",
        "The ProviderName property is the Provider of the driver e.g. Microsoft ",
        "IAID needed on the host to keep this VM from entering notifications.",
        "MobileID",
        "SettableRLSD",
        "DELNOTIFY",
        "R_73859BDECC6E59555AB103C0DF5302F8942C19E249A9E48DB616B611E1AA3893",
        "FaultId",
        "If true, indicates that 32-bit applications are running with Data Execution Prevention (DEP) applied. (false if DataExecutionPrevention_Available = false)",
        "WMI|Win32_ProcessStartup",
        "DisableCallback",
        "VIProgID",
        "Input/Output error",
        "MI_ERRORCATEGORY_RESOURCE_EXISTS",
        "The GetOwnerSid method retrieves the security identifier (SID) for the owner of this process.",
        "The ToValue property defines the value to be substituted for the value recognised by the FromValue property.",
        "User to be notified upon job completion or failure. This property is restricted to 16 characters under Windows 9x platforms.",
        "Standby",
        "This method shows a virtual disk to an initiator. This operation is also known as 'exposing' or 'unmasking' a virtual disk.",
        "LetAppsAccessTasks_UserInControlOfTheseApps",
        "Describes whether new TS connections are allowed.",
        "CD_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396.2056.1.22193",
        "MGR_TRACE_RESERVED_1e Flag",
        "4301..32767",
        "\\\\.\\root\\Microsoft\\UEV:__Win32Provider.Name=\"UserSettingsProvider\"",
        "NumberOfClassificationElements",
        "{DAE10783-CC31-4d2a-8A0F-861C04077A95}",
        "The Label property indicates the volume name of the logical disk. Constraints: Maximum 32 characters. This property is NULL for a volume without a label.",
        "This class associates a power setting with a subgroup.",
        "IpV6IPsecUnauthPerIPRateLimitBytesPerSec",
        "CDDAAccurate",
        "f the corresponding property contained in the Win32_PageFileUsage and the Win32_PageFileSetting.",
        "Sectors (2352 bytes each) per read.",
        "Keyboard port extended ID",
        "L\"m;L\"m;",
        "OkToRunAtBootUp",
        "The GetEffectivePermission method determines whether the caller has the aggregated permissions specified by the Permission argument not only on the file object, but on the share the file or directory resides on (if it is on a share).",
        "Asynchronous TokenizedClone Remote",
        "The network adapter is in the paused state.",
        "MSFT_DNSClientServerAddress",
        "MIF.DMTF|Portable Battery|002.16",
        "LUAInstall: error 0x00000005 setting flags [{94FBC195-CB86-4142-9A6A-8E9CCF0D4F4D}]",
        "List of media types the NIC supports.",
        "The clustering service.",
        "stpsvc.mof",
        "Recognizer Driver",
        "The UserComment property contains a user defined comment or description for this profile.",
        "SetLicensingAadInfo",
        "SectorsPerRead",
        "SetVLActivationTypeEnabled",
        "RSOP_SecuritySettingBoolean",
        "CD_8519F629D57644187514674C7FCF7F8B0B70EEA799638913C1E17DC7E507CB73.1356.1940313505.1863",
        "\\\\.\\root\\subscription:__Win32Provider.Name=\"CommandLineEventConsumer\"",
        "MIF.DMTF|Video|003.11",
        "Win32_Desktop",
        "IcmpSettings",
        "ParentDll Base Address",
        "DOT11_CONFIG Flag",
        "VideoStandardType",
        "CR_7C2448C779B501004A8AC92BAE296EF71C889D4A4797C480FE572242B6C55673",
        "The Shutdown method unloads programs and DLLs to the point where it is safe to turn off the computer. All file buffers are flushed to disk, and all running processes are stopped. On computer systems running Windows NT/2000, the calling process must have the SE_SHUTDOWN_NAME privile",
        "EcsAutoProvisionEnabled",
        "n level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. ",
        "PersistenceProviderFactoryType",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1352.1199241364.180",
        "AllowTelemetry",
        "The ErrorReplacementEnabled specifies whether bytes received with parity errors are replaced with the ErrorReplaceCharacter value. Characters with parity errors are only replaced if this member is TRUE and the parity is enabled.",
        "SupportedClusterSizes",
        "ATM Virtual",
        "  <file name=\"InstallServiceTasks.dll\" destinationPath=\"$(runtime.system32)\\\" sourceName=\"InstallServiceTasks.dll\" importPath=\"$(build.nttree)\\\" sourcePath=\".\\\">",
        "EnableFlags",
        "A unique key identifying this remove file action within its product.",
        "MSFT_DSCConfigurationOutput",
        "C_EC218CCE39B1A69692B8F67C46683B41BCCB3079635712D8AAB3061393D01076",
        "Software Program Error (Incorrect Results)",
        "The QuotaNonPagedPoolUsage property indicates the quota amount of non-paged pool usage for the process./nExample: 15",
        "CopyMethodology",
        "ROOT\\Default",
        "IsDiscovered",
        "0x8001",
        "Processor Speed",
        "The number of pages printed in this job.",
        "The Element reference represents the Win32_VideoController containing the properties of the video controller that a video setting can be used on.",
        "0xEFFF002E",
        "40020",
        "The EnableDHCP method enables the Dynamic Host Configuration Protocol (DHCP) for service with this network adapter. DHCP allows IP addresses to be dynamic allocated. The method returns an integer value that can be interpretted as follows: ",
        "This class associates a power setting definition data with the power setting definition.",
        "NumaNode",
        "Associates a network adapter with its Encapsulation Offload data.",
        "CIM_Job.RecoveryAction",
        "File IO completion",
        "The Tag property uniquely identifies the system slot represented by an instance of this class.",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardDate|wDay",
        "Indicates the contents of the local data cache will be included in the package",
        "R_639A48AE01E60F4C5372BCE94302125223C8DE05464D188B338C60C65E4A5441",
        "DOT11_SOFTAP Flag",
        "Errors Logon",
        "Whether automatic context management is enabled for ContextBindingElement",
        "TSMFTrace",
        "LocalMachineZoneAllowLessPrivilegedSites",
        "Certificate Expires On, stored as a 64bit FILETIME format",
        "context",
        "ref:CIM_TemperatureSensor",
        "s from",
        "SupportsThrottling",
        "object:MSFT_StorageHealthReport",
        "NDIS 802.11 Power Mode",
        "MDM_ApplicationControl_Token03",
        "Name of the script to be run",
        "VolumeExtent",
        "AllowStoringImagesFromVisionSearch",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.305.307563796.372",
        "MDM_Policy_Result01_ErrorReporting02",
        "This is the class used to model the AD Syntax DN_With_String",
        "This class encapsulates a target network adapter, on which the traffic is to be captured.",
        "{81A1FEF1-9A54-4B10-927C-877F1241F4E8}",
        "HorizontalResolution",
        "MaxLifetimeKilobytes specifies the maximum kilobyte lifetime the IKE message sender proposes for an SA to be considered valid after it has been created. A value of zero (the default) indicates that there should be no maximum kilobyte lifetime. A non-zero value specifies the desired kilobyte lifetime.",
        "The UserName property indicates the name of the user that established the session.",
        "Specifies which direction of traffic to match with this rule.",
        "L3m;L3m;",
        "{8502C4E0-5FBB-11D2-AAC1-006008C78BC7}",
        "MsftWriteEngine2_DebugGeneral Flag",
        "Driver Delay Complete Request Return",
        "SupportedRemoteSubsystemCacheModes",
        "The Win32_LogicalProgramGroupItemDataFile class represents an association between the program group items of the start menu and the files in which they are stored.",
        "{B0A2AB46-F612-4469-BEC4-7AB038BC476C}",
        "UserID is the value used by the SecurityService to represent identity. For an authentication service, the UserID may be the name of the user, or for an authorization service the value which serves as a handle to a mapping of the identity.",
        "PLATFORM_ERROR_OEM_DEVICE_PATH is valid",
        "Number of VLANs supported per port.",
        "object:MSiSCSIInitiator_TargetLoginOptions",
        "Directories (CIM)",
        "{EDB16A62-B16C-11D1-BD98-00A0C906BE2D}",
        "DisableLockdownOfStartPages",
        "Event Log Source",
        "C_F2BEF717752C099CDF2C7677200AF2332E7D1E48B470B17CCD440B8D710B7A38",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardDate|wHour",
        "mFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "The XOffCharacter property specifies the value of the XOFF character for both transmission and reception. XOFF is a software control to stop the transmission of data (whereas RTS and CTS are hardware controls). XON resumes the transmission.",
        "UtilDebug Flag",
        "The CSName property contains the local name of the computer system. The value for this member comes from the CIM_ComputerSystem class.",
        "The Parameters property contains space set aside for use by applications. This string can be null, or it can have any number of characters before the terminating null character. ",
        "AllowRoamingFileExclusions",
        "AllowTrustedSitesZoneTemplate",
        "TokenizedClone",
        "UnsolicitedRemoteAssistance",
        "InterfaceMetric",
        "AllowCloudSearch",
        "The SetDNSSuffixSearchOrder method allows for the setting of the suffix search order as a array of elements. This is an instance independent method call that applies across all adapters. Windows NT only. The method returns an integer value that can be interpretted as follows: ",
        "The product to which the FRU is applied.",
        "SetPartitionDeviceElementWithFlags",
        "DeviceClientID",
        "0xEFFF0061",
        "This class exposes port information operations that can be determined from the adapter.  There should be one instance of  this class for each adapter",
        "LetAppsAccessCalendar_ForceDenyTheseApps",
        "A class derived from CIM_LogicalElement that is a special collection of managed system elements. This collection indicates that the aggregated components together provide redundancy. All elements aggregated in a redundancy group should be instantiations of the same object class.",
        "The NetworkServerModeEnabled property determines whether Network Server Mode is enabled./nValues: TRUE or FALSE.  If TRUE, Network Server Mode is enabled.",
        "IL_42B2E3A3A6520FF2AA7BA157666764419AB7273E011404BF98FB167E54E43BA9.2460.2198995473.354",
        "NDIS Status Reset Start",
        "CD_DDEDD07282B8324F60B5A48A479C1B42607AE5EA149F90058D5C2368C1337E02.34.1813377521.523",
        "9B3417C75F77ECA2958634DDB1",
        "Minimum amount of memory, in Kbytes, that is needed for the associated physical element to operate correctly. ",
        "object:MSFT_NetAdapterRscSettingData",
        "Removes the ODBC DSNs represented by the specified ODBC DSN objects. Enter a variable that contains the objects, or type a command or expression that gets the objects.",
        " The ApplicationCommandLine association allows one to  to identify connection between an application and it's command line access point.",
        "The ContinueXMitOnXOff property specifies whether data transmissions continue when the receiving buffer is close to full and an XoffChar character has been sent to the transmitter.",
        "Please Note: though updating instances of this class is supported, supplying property values which are invalid or unrecognized by the network protocol stack will not update successfully and the original values will persist.  An error is not guaranteed to be generated when this happens, but if one does, nothing is updated.",
        "HDSplitCombineFlags",
        "The Revision property specifies the system's architecture-dependent revision level. The meaning of this value depends on the architecture of the processor. It contains the same values as the \"Version\" member, but in a numerical format.",
        "58001",
        "This property indicates whether the times represented in the RunStartInterval and UntilTime properties represent local times or UTC times. Time values are synchronized worldwide by using the enumeration value 2, \"UTC Time\".",
        "Win32_SessionConnection",
        "Starting automatic reuse port number between 1025 and 65535.",
        "IsEnabledGlobally",
        "The Win32_SMBIOSMemory class represents the properties of a computer system's memory as seen through the System Management BIOS (SMBIOS) interface. The SMBIOS interface does not distinguish between non-volatile, volatile, and flash memories. As such, the CIM_Memory class is the parent class of all types of memory.",
        "A persistent binding request included a bad local SCSI bus number",
        "SetDatabasePath",
        "Network interface on which NAT64 operates",
        "deleteExistingConnSettings",
        "DetectSlowLinkDisabled",
        "object:KernelIdleState",
        "Win32API|Service Structures|SERVICE_STATUS|dwWaitHint",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|CompatibilityFlags",
        "{4BBB69EA-6853-11d2-8ECE-00C04F8EF481}",
        "ipDNSAddressAlternate",
        "NS_EC9F2768D2769112CE1EF50D7321735D7B87D36D0F8A1B65990E1538277EB1A0",
        "#define ISCSI_LOGIN_OPTIONS_DEFAULT_TIME_2_WAIT         0x00000008",
        "File System Path",
        "MSDATL3.1",
        "Designates one or more VXLAN TNI values to filter on.  Network traffic is logged when the filter matches. ",
        "LPC_TRACE_FUNCTION",
        "//       targetname_#:# where the first # is the SID, and the second",
        "I_FFD5182D10C96F3C53E9257F5B142EC4439B6AAEBFBA417E597718215F5C19B0.1520.4118710752.245",
        "Bytes Received/sec",
        "The checksum offload hardware capabilities of the Adapter.",
        "CD_49C003F958AE429B51E409471F01A643359D07DB4A4E6AA865D8578747CC13A3.34.1787134301.577",
        "AlwaysEnableBooksLibrary",
        "DoActiveDirectoryOnlineActivation",
        "CD_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396.14.3560472040.4091",
        "Thread Pool Callback Enqueue Start",
        "Legacy Device interface name",
        "NDIS Hardware Status",
        "C_DEF6358C5F0DB3A8C212B6EB5152B0DBA8FDCC511B86D1F1B5A68B1427787DDC",
        "CD_E5CECE3568E22A8D095DA9D66ACADDD40984DA04C8DFB2D049DE12067ABD39BF.1543.3925039947.1538",
        "The Win32_BootConfiguration class represents the boot configuration of a Win32 system.",
        "The ConnectorType property indicates the physical attributes of the connector used by this slot.",
        "GetKeyProtectorNumericalPassword",
        "Token name for the environment specification within its package.",
        "The number of bits controllable in the VCI field of the cell header.",
        "MCA_WARNING_SMBIOS",
        "AvailableVirtualSize",
        "The LSO V1 hardware capabilities of the Adapter.",
        "The Manufacturer property indicates the name of the computer manufacturer./nExample: Acme",
        "PCI_BUS_ERROR_STATUS",
        "tFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "SysClEnter",
        "RouteCacheLimit",
        "AlwaysOn",
        "A string used to identify the process. A process ID is a kind of process handle.",
        "{A51D806C-DB32-11d2-85FC-0000F8102E5F}",
        "Windows Server 2003, Datacenter Edition",
        "30     This device is using an Interrupt Request (IRQ) resource that another device is using. ",
        "MCA_INFO_CPU_THERMAL_THROTTLING_REMOVED",
        "AllowUserControl",
        "Removes a route from the specified VPN connection",
        "Shared library directory",
        "CapabilityDescriptions",
        "LCMState",
        "Supports undiscovered resources",
        "Reset the ISATAP configuration.",
        "Hostname",
        "CD_8F21C89CAF771FFCC47E28C59A7D76DBF0F63931FC16518B322428129F505FDF.2155.3011937589.675",
        "ChangeMode",
        "The non-volatile storage.",
        "SeAssignPrimaryTokenPrivilege",
        "The identifier by which the job object security limit setting instance is known. ",
        "The Msft_WmiProvider_DeleteClassAsyncEvent_Pre event class represents an event generated immediately prior to calling the provider's implementation of IWbemServices :: DeleteClassAsync.",
        "sint8",
        "CR_9545373C4C410A85043435CEFDB53CA783FCE515B65345546AA266D2B18EC658",
        "The SameElement reference represents the logical device properties that are associated with the Plug and Play device.",
        "Signifies whether or not the partition is active and can be booted. This property is only relevant for MBR disks.",
        "OBJID",
        "HardwareType",
        "MIF.DMTF|System Resource IRQ Info|001.3",
        "RestrictedSIDs",
        "The VolumeName property indicates the volume name of the Win32 CD-ROM drive.",
        "Minimum iSCSI Version",
        "Specifies whether AVC444 mode is preferred.",
        "CD_197AC7D184C8FB7AE4353D80B67A53A62AFB8962E788E6E6756C5B11036C7B44.1700.2347061713.514",
        "PowerMeterProvider",
        "R_AEB1302AC843DE3720FDF5243FA6FA29740C3EF6F87994A8A6D26F14FA996B57",
        "5F9D988B459EA167A80BFD4782DA6DB5BC1F63F5A3F73F9B",
        "C_43C86C3E5B2B7F1DD0443A6DA4E17AA95D65F56EE0C19CF4FD3B5D9A5F63C522",
        "The AddPrinterDriver method installs a printer driver. The method can return the following values:",
        "SubsegmentFreeCached",
        "is the most appropriate choice for scanned or photographic images ",
        "Represents whether the printer should use color.",
        "The L2CacheSize property specifies the size of the processor's Level 2 cache. A Level 2 cache is an external memory area that has a faster access times than the main RAM memory.",
        "If set to true: retries are performed in the foreground. If set to false: if the first mount attempt fails, retries are performed in the background.",
        "{0268a8b6-74fd-4302-9dd0-6e8f1795c0cf}",
        "// NIC Port configuration class, implement one instance for each physical ",
        "DOT11_SCAN Flag",
        "{FAF76B74-798C-11D2-AAD1-006008C78BC7}",
        "CIM_PolicyActionInPolicyRule",
        "ClientRSSCapable",
        "SPACES_StorageSubsystemToVirtualDisk",
        "The SoftwareElementID of the software element associated with this action.",
        "IL_B3004F14DFF3478FDC001CFC6308017B340B717CA8EF3510446CA3775B4E50A4.2690.2986701296.265",
        "This is not a supported replication scenario.",
        "R_F33D7C5F62C48A98254F1B0ADED8C5A8E56D1601D517CF44369F4A800E4AA9F6",
        "ExecuteSelfTest",
        "This class models the parent-child container relationship of instances in the DS",
        "{0F73ED5A-8ED9-11d2-B340-00105A1F8569}",
        "I_08837FBDBD3097471CC2C297165FAF98E393B0957D4C58A3770FE396DE076DF5.2710.1628297984.299",
        "Media specific status information.",
        "Client can supply RelationshipName",
        "Array of C-state dependencies",
        "{83B2A7AA-DB36-11d2-85FC-0000F8102E5F}",
        "Page Savable",
        "43020",
        "AddTargetPort",
        "CIM_Product.Version",
        "select * from SPACES_StorageModificationEvent",
        " The minimum version of a software elements being checked.",
        "NDISWMI_TRACE_STATS",
        "e71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "Represents a BranchCache data cache",
        "C_FFCB0C410AEE7D445593F568F39CA2170FF6D60B08D2A845F16225D10B0579AD",
        "BinaryPath",
        "Newsgroups Program",
        "object:DtcClusterTMMapping",
        "R_9670F10EE6DDB8E306101B08B39BD50A63BEE4B7DCABA524C96620EE066E2BC8",
        "The JobStatus property indicates whether a scheduled service executed successfully the last time this job was supposed to run.",
        "POINTER_PORT_WMI_ABSOLUTE_POINTER",
        "scriptList",
        "CD_F7C3FC7B0FE5CB399C100F2AF228B5E443901701ED625E3927914BAA4C7D7971.1602.1674113518.444",
        "Win32_PrinterDriver",
        "object:MSNdis_LinkParameters",
        "Example: Adaptec AHA-2940UW.",
        "No Reporting",
        "The Win32_Thread class represents a thread of execution.While a process must have one thread of execution, the process can create other threads to execute tasks in parallel.  Threads share the process environment, thus multiple threads under the same process use less memory than the same number of processes.",
        "SupportsMaskingVirtualDiskToHosts",
        "select * from SPACES_StorageAlertEvent",
        "T-m;T-m;",
        "SlotLayout is a free-form string that describes the slot positioning, typical usage, restrictions, individual slot spacings or any other pertinent information for the slots on a card.",
        "5.25, 1.2MB,  512 bytes/sector",
        "CIM_PackageCooling",
        "PostOpFailure",
        "MDM_Policy_Config01_WindowsConnectionManager02",
        "Instances of this class represent conditional checks that must be evaluated to TRUE before their associated Win32_SoftwareElement can be installed.",
        "Size, in bytes, of a single cache bucket or line.",
        "SourceReplicationGroup",
        "Instances of this class represent individual patches that are to be applied to a particular file and whose source reside at a specified location.",
        "Number of user sessions for which the operating system is currently storing state information",
        "Impact Band",
        "The product code for the product of which this property is a part.",
        "CD_027708FDC4F21C8AE43624362617A067ABEAE7FC96FE6B2F6BAB070555EAA6F0.65.3039197314.687",
        "CR_43C86C3E5B2B7F1DD0443A6DA4E17AA95D65F56EE0C19CF4FD3B5D9A5F63C522",
        "53001",
        "WakeReleaseKernel",
        "Sync pulse should appear on all 3 video signal lines",
        "R_9A0DB23B4C5307A117BBF9E162F8E0A10B387D66AA6B5AEFE4F2996B31F1D028",
        "A Pre-shared Key authentication proposal.",
        "I_C2E2D7F294A39E950FCB0FE91EB41D6C66630273B2EF4990C97F60DB582F2E17.1480.1382634392.302",
        "CD_455876B64E565F4962FC035AF2C8087D1797E42AAA9586F45C5A3E20F37175C3.291.978620278.590",
        "Compression Method",
        "0xC000000C",
        "NetLogin",
        "{d67abd39-81f8-4a5e-8152-72e31ec912ee}",
        "SMBIOS|Type 16|Maximum Capacity",
        "PnP Device Id",
        "CD_8E06F8A253AE0A7703F13AD4EB4C65D4E0C2634FF3666E5F2D0DCC0FEBE693BB.2619.1628817560.2044",
        "ExpandedDebugFilePath",
        "ODBC DSN Instance Provider.",
        "RSOP_PolmkrStartMenuSetting",
        "Specifies the desired number of physical disks to stripe data across. This value must be between NumberOfColumnsMin and NumberofColumnsMax.",
        "The Msft_WmiProvider_NewQuery_Post event class represents an event generated immediately following completion of the provider's implementation of IWbemEventProviderQuerySink :: NewQuery.",
        "Microsoft iSCSI Initiator: Target Address",
        "The directory specification.",
        "Indicates that the process has access to the desktop. ",
        "DiskIo",
        "CD_236671D190B5A97B69CF698D7EEC94B834EB78003323F67E90BFA3A62F30C576.2119.421946922.2153",
        "DriverProviderName",
        "MSNdis_AtmHardwareCurrentAddress",
        "UdpEspSupported",
        "0xC000001D",
        "Current hardware status of the underlying NIC.",
        "Progress",
        "UpLimitMonthlyGB",
        "MDM_VPNv2_Proxy02",
        "CI_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251",
        "{1008CCEB-7BFF-11D2-AAD2-006008C78BC7}",
        "{fd209e2e-813b-41c0-8646-4c3e9c917511}",
        "MSFT_MpScan",
        "License",
        "Relative order of instantiation of RSOP_ScriptPolicySetting",
        "The file system from which the operating system is loaded.",
        "OptimizedOut",
        "The Msft_WmiProvider_CreateClassEnumAsyncEvent_Post event class represents an event generated immediately following completion of the provider's implementation of IWbemServices :: CreateClassEnumAsync.",
        "CIM_ManagedSystemElement.HealthState",
        "MCA_WARNING_REGISTER_FILE",
        "CD_68F60BCE5ED1CEFD06D072F2C79847AF4A3C52BA9A8E9F51041AA990EA82C70E.1226.2085859970.359",
        "The Mask property contains the mask used in this persisted entry. Masks should be logical-ANDed with the destination address before being compared to the value in the ipRouteDest field.",
        "One or more physical disks could not be removed because they are still in use.",
        "MachineName",
        "The number of VPorts that can be allocated on the switch",
        "Kernel Thermal Policy Event",
        "This parameter is True if user possesses the specified access permissions. Otherwise, the parameter is False. ",
        "Principal",
        "StringValue",
        "DOT11_AUTOCONF",
        "The interface indices of lower layer interfaces.",
        "Network Profile Manager",
        "If TRUE, this field instructs the storage provider (or subsystem) to automatically pick what it determines to be the best number of columns for the virtual disk. If this field is TRUE, then the NumberOfColumns parameter must be NULL.",
        "CIM_Memory.BlockSize",
        "The time value is represented as the number of hours between update checks. Valid values range from 1 (every hour) to 24 (once per day).",
        "The Win32_Refrigeration class represents the properties of a refrigeration device.",
        "Cable Tamper",
        "iSCSI Initiator Login statistics",
        "Current active sessions for NAT",
        "PLATFORM_TRACE_RESERVED_13 Flag",
        "Select * from Win32_QuickFixEngineering",
        "PCI_COMP_INFO_VendorId",
        "The AdapterRAM property indicates the memory size of the video adapter. ",
        "0xEFFF0036",
        "TargetiSCSIName",
        "C_C494166FEC78B76B06AE6864E10BB6C47EF436F2498312A79210EB6DD47C6CAE",
        "MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees",
        "CR_10549F8F6A0C1E0A975F931BF6E1962F49CF18068F6079CD179A794A32D030D5",
        "CIM_EnabledLogicalElement.EnabledState",
        "Indicates whether the ND interface is enabled or disabled on the adapter",
        "Example: 154.55.34",
        "object:MSNdis_ReceiveQueueInfo",
        "CD_22E55A76AF91714908793A9D6F196391BDBB704CE7B4C27172941A36699A38A0.1715.1.38967",
        "IL_B1CA4324A757DDD58567627DD36F9B666F172DF97B3B65FE93751C1BF30285F4.2688.1623980323.274",
        "Associates a network adapter with its Virtual Machine Queue (VMQ) setting data.",
        "CR_8DE46DD6446B26621A23E11758AE5CBC62C9F72998CAFB08B9CD58DF66902A20",
        "The IPv4 address that this portal / endpoint uses.",
        "This property corresponds to the HealthState property of the logical computer system represented by CIM_ComputerSystem. See CIM_ManagedSystemElement.HealthState for details.",
        "BcdBooleanElement",
        "Microsoft.Management.Infrastructure.CimInstance#DnsClientPolicyConfiguration object contains all the  properties of  DNS client NRPT policy. If \"Effective\" is specified, only the contents of  Effective policy are retrieved.",
        "Percentages at which an alert should be generated",
        "AddByLocalPort",
        "CIM_RealizesDiskPartition",
        "NumAAAAQueriesSynthesized",
        "SamLookupDomInSamSrv_End",
        "TriggerLevel",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2197.1807584343.368",
        "DVD-18",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmDriverVersion",
        "FX_TRACE_RESERVED_16 Flag",
        "Number of Buffers Written",
        "Cannot convert the style of a disk with data or other known partitions on it.",
        "{3f2c1419-83bc-11dd-94b8-001d09162bc3}",
        "NdisStatusDot11MPDUMaxLengthChangeIndication",
        "The ColorPlanes property indicates the current number ofcolor planes used in the display configuration. A color plane is another way to represent pixel colors. Instead of assigning a single RGB value to each pixel, color planes separate the graphic into each of the primary color components (red, green, blue), and store them in their own planes. This allows for greater color depths on 8- and 16-bit video systems. Present graphics systems have the bitwidth large enough to store color depth information; meaningonly one color plane is needed.",
        "C_880F8A6DDAF35DED5DB5957A3D536A3E6F1D34B0BE1907B4DC24ED25832006B8",
        "Example: C:\\win\\profiles\\ThomasSteven",
        "LocalUdpEncapsulationPort",
        "Interrupt Vector",
        "RD_TRACE_DEVIF",
        "C_11BDD83D3BDB7F7DD4A04A3CC49869E53E73157A8718941705A791A42E561334",
        "NTEventlogProviderConfig",
        "#define HBA_EVENT_PORT_BROADCAST_CHANGE 0x205",
        "IR_DDB91418F3D637554FACB27F0581F4445917CEB1CCA74DD48A7FCFC0D9F39BBE",
        "0xC000001B",
        "I_DDB91418F3D637554FACB27F0581F4445917CEB1CCA74DD48A7FCFC0D9F39BBE.280.4158920745.392",
        "One of the physical disks specified uses a sector size that is not supported by this storage pool.",
        "RequestType is bit-mapped and identifies the type of Descriptor request and the recipient. The type of request may be 'standard', 'class' or 'vendor-specific'. The recipient may be 'device', 'interface', 'endpoint' or 'other'. Refer to the USB Specification for the appropriate values for each bit.",
        "CurrentAlternateSettings",
        "MCA_ERROR_MEM_1_2_5",
        "Fail_Critical_Errors",
        "AES_256",
        "Cisco iSCSI Storage Router",
        "The RefreshRate property indicates the refresh rate of the video configuration.  A value of 0 or 1 indicates a default rate is being used.",
        "NewName",
        "RT_LostEvent",
        "An enumerated integer that describes the format and interpretation of the AccessInfo property.",
        "SessionLogging",
        "#define SendRPL_OUT_RspBuffer_SIZE_HINT 28 // 12+16*n",
        "Renames the Terminal. The function takes one parameter, the New Terminalname. The call returns zero on success and an error on failure.",
        "DFHandling controls how the \\'Don\\'t Fragment\\' bit is managed by the IPsecSAEndpoint.",
        "object:MSFT_NetAdapter_RssProcessor",
        "r41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "ref:CIM_BIOSFeature",
        "VssTracingProvider",
        "FX_TRACE_FUNCTION Flag",
        "Magazine Size",
        "__EventConsumerProviderRegistration",
        "CD_9EE045C4E2FFD0DF955EEE77C315F6E7AE148A81490C1DE25137DB14C2197D9A.1204.576945284.1453",
        "Win32Registry|HARDWARE\\DESCRIPTION\\SYSTEM\\MultifunctionAdapter",
        "The final result of pushed printer connection. 0 indicate success",
        "A string that describes the enabled or disabled state of the element when the EnabledState property is set to 1 (\"Other\"). This property must be set to null when EnabledState is any value other than 1.",
        "Indicates whether the provider should pick up the auto write cache size",
        "PciExpressCurrentPayloadSize",
        "The disk's partition limit has been reached.",
        "GroupName",
        "Reserved Space",
        "ref:Win32_PnPSignedDriver",
        "wSettableData",
        "The Win32_SystemConfigurationChangeEvent is an event class which indicates that the device list on the system has been refreshed.  Refreshed meaning: a device has been added, removed, or the configuration changed.  This event is fired when the windows message 'DevMgrRefreshOn<ComputerName>' is sent. The exact change to the device list is not contained in the message and therefore a device refresh is required in order to obtain the current system",
        "The PageFaults property indicates the number of page faults generated by the process.",
        "Reserved for Sparing",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pServerName",
        "AutoStartWin9X",
        "TM_DLLMAIN",
        "WSManWmiProvError",
        "docked'.",
        "NS_0634BEAAA6D47E6371999AD405E0DDAFDA3BDAB3659C4858F565936A4909981F\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_02E3B8C824FD0B9C15B4D49AB84CF02FA38E02CAF699DC3CBDCBB2D79F3025DF",
        "AllowEAPCertSSO",
        "1) Status is more correctly defined as an array. This definition overcomes the limitation of describing status using a single value, when it is really a multi-valued property (for example, an element might be OK AND Stopped. ",
        "The SetIPConnectionMetric method is used to set the routing metric associated with this IP bound adapter. The method returns an integer value that can be interpretted as follows: ",
        "Bid2Etw_DBNETLIB_1_Trace_TextW",
        "Win32_ModuleLoadTrace",
        "SRQCreate performance counter missing",
        "4!m;4!m;",
        "MaxReadable",
        "PortableDeviceAPI_Properties Flag",
        "A FilterList is weak to the network device (e.g., the ComputerSystem) that contains it. Hence, the ComputerSystem keys are propagated to this class.",
        "The specified virtual disk could not be found.",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_E89A7FFCC0B0A06779EA36F241515EEDC0397EE054953EB7D572C69DEFE87E2F11d7",
        "The port on which this hosted cache server will listen for incoming offer messages on its HTTP channel",
        "NumberOfDataCopiesDefault",
        "CIM_SoftwareIdentity.MinorVersion",
        "C_A15A00CD5014B43F15BAFD3D0F7CB556BF54FF60085CBA96C47BF4ABDD28D656",
        "Above Normal",
        "SupportsStoragePoolFriendlyNameModification",
        "AllowPackageScripts",
        "This field denotes the cache level that has been discovered. This corresponds to the storage provider's DiscoveryLevel parameter in the Discover method. ",
        "Version should be in the form <Major>.<Minor>.<Revision> or <Major>.<Minor><letter><revision>",
        "LUAInstall: error 0x00000005 setting flags [{7444C717-39BF-11D1-8CD9-00C04FC29D45}]",
        "_}kaN",
        "NS_7D21B78EAA0B5CBC1D181E478D1F43B86260B16C8A6D7CD39506F3FAB894CD04",
        "NS_384B446250BB5D2F492F1908A5C0DAEA147CA4130DA383C4929CE3B9A73DC35F",
        "ContinueXMitOnXOff",
        "netmgmt",
        "C_55AF22A4D3FD212FC3171AADE7109F17F27CA9F86C291AE560CF90E7D047839B",
        "KeyManagementServiceNotificationRequests",
        "PolicyAdvancedRemoteAppGraphics indicates whether the property AdvancedRemoteAppGraphicsis configured by Server (0),Group Policy (1).",
        "Array of virtual ports.",
        "CIM_PhysicalCapacity",
        "Enable ping of the sync provider",
        "AllowExperimentation",
        "EVENT_TRACE_FLAG_R",
        "subschemaSubentry",
        "SamShutdownSamSrv",
        "The PacketDirect properties for the network adapter.",
        "UEFI Code Readonly",
        "The Index property indicates the physical drive number of the given drive. This member is filled by Get Drive Map Info.  ",
        "CD_8753AFFD6FF7988B6BD5723778343D3CBE2068B8054CFA332AC07BDAA246DC64.315.2232152022.2407",
        "The DeviceID property contains a string that uniquely identifies the memory array.",
        "2500BaseT",
        "TracePnP Flag",
        "ettcpip",
        "Local Disk",
        "I_D4987B113B08C3865459E47A2D1ADCA49682B6AFDB4DC21088112FF54FBA16D7.893.1.69984",
        "Responder-Only",
        "Success",
        "MDM_Policy_Result01_BITS02",
        "The Win32_ProgramGroupOrItem class represents a logical grouping of programs on the user's Start|Programs menu.  It contains program groups and program group items.",
        "Auto Answer",
        "o If all actions have the same sequence number, regardless of whether it is \\'0\\' or non-zero, any order is acceptable. ",
        "TE083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "Settable Stop Bits",
        "ByteOffset",
        "Microsoft-Windows-OfflineFiles-CscFastSync",
        "1 - 'Other': A vendor-specific OperationalStatus has been specified by setting the OtherOperationalStatusDescription property.",
        "CommunicationInfo provides the details of the communication mode. For example, if the communication mode is 'Phone', CommunicationInfo specifies the phone number to be called.",
        "NewThreadId",
        "RegProv",
        "The count of KMS requests from clients with License Status=0 (Unlicensed).",
        "Report Setmarks",
        "Padding",
        "SMBIOS|Type 17|Memory_Type",
        "This parameter allows the user to specify the FriendlyName at the time of the volume creation. FriendlyNames are expected to be descriptive, however they are not required to be unique. The filesystem's label will also be set to this friendly name.",
        "This property provides the status of Windows updates",
        "This property contains the SID of the user who owns this user profile.",
        "InfoClass",
        "ShowMessageWhenOpeningSitesInInternetExplorer",
        "WinstaDriverName",
        "Identifies the available character sets for the output of text related to managing the Printer.",
        "0x00000008 - Indicate the profile is a corrupted profile, and not in use, user or administrator must fix ",
        "DeviceName",
        "58009",
        "Win32Registry|System\\CurrentControlSet\\Services\\Class\\Info|VideoMemory",
        "IsLSAvailable",
        "Current Connection",
        "Number of bytes to be reserved for check data.",
        "C_8236493D7B4C97328F05E9610B58340A9B36DA2FAD39FFAA641A6E8D9062FAF7",
        "This class surfaces HBA target events",
        "NdisCoMinimumLinkSpeed",
        "R_8105231C8A3F2DF94C9C7F6EBD5BD2604617F4A36486778B9E1603208DF83C44",
        "A unique key identifying this reserve cost item within its product.",
        "Issuers",
        "ProcessorBiosCStates",
        "E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "RD_TRACE_CANCEL Flag",
        "{a0a352c5-b8ec-41e9-9936-8452c1c0a6cf}",
        "SamCompPwdSet_Start",
        "TrustedSitesZoneAllowAccessToDataSources",
        "object:MSNdis_WmiTcpIpChecksumOffload_IPv6TransmitReceive",
        "AuthorizationFlags",
        "LockedDownTrustedSitesZoneAllowLessPrivilegedSites",
        "Full Scan",
        "msDataSize",
        "CR_038FB93272FAE6ABFA86F7DB95C50EABB70457A3A4C501BDC273939A1E6BDB9D",
        "TargetHandle",
        "This parameter is the volume that is used for the shadow copy. This volume is sometimes referred to as the 'original' volume.  This parameter can be specified as a volume drive letter, mount point or volume GUID name.",
        "Win32_ApplicationService",
        "#define ISCSI_HBA_STATUS_WORKING           0",
        "deviceProperties",
        "ActualResponseBufferCount",
        "Print Queue Admin",
        "Indicates whether this Guid is enabled currently. For data guids this means if collection is enabled, For event guids this means if events are enabled. For Trace control guids this means the trace logging is enabled.",
        "CIM::Network::Pipes",
        "Power Setting Subgroup",
        "DeviceLocator",
        "MDM_ActiveSync_User_Options03",
        "LetAppsAccessEmail_ForceDenyTheseApps",
        "This method deletes an empty replication group. If the group contains any replicas, these replicas must be removed first.",
        "object:DnsClientNrptGlobal",
        "C_18CF4DFADB65FD9009884647249EF310A7B2E05DDBD0DAD1404A0AE55A5E4EE4",
        "CR_F9C1E1A7069B9B36C3E7210F7D307B0A9A014B690546123D4B32550C45DB3C57",
        "Process creations/deletions",
        "STATUS Flag",
        "Other - HRESULT Win32 error code.",
        "Frozen",
        "DmaAddressWidth",
        "{5B6C820A-E3D0-11d2-8601-0000F8102E5F}",
        "MGR_TRACE_RESERVED_05",
        "InstallationDirectory",
        "An array of target port addresses from which the virtual disk should be shown",
        "Local storage device management.",
        "Not Usable",
        "The NT Job Object identifier filter condition.",
        "Win32_Group",
        "GetSrkPublicKeyModulus",
        "PoolPagedBytes",
        "AbortedTransactionsTracingEnabled",
        "3 - 'Unsynchronized': Not all the source element data has been copied to the target element. ",
        "SetVirtualizeLoopbackAddressesEnabled",
        "I_5430A0963BDFE45F48448BEFE49162AB9A7F5390BEE895620AB94C03956A31E5.805.1.36972",
        "0xC0000017",
        "SendInterface",
        "RequesterID",
        "C_18BBD01AB9B011850ED53F3C153FB85C4D5FA9678EC8589287B293A340368BF6",
        "MSFT_WmiConsumerProviderSinkLoaded",
        "ScreenSaverExecutable",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|TcpWindowSize",
        "This is the key for any DS Object",
        "CoNDIS Receive PDUs No Buffer",
        "ATM Emulated LAN for 802.3",
        "Net Protocols",
        "Registry_V1_TypeGroup1",
        "Typesetter",
        "PolicySourceDenyAdminPermissionForCustomization",
        "Shutting Down (4) indicates that the element is in the process of going to a Disabled state. ",
        "Mobility Center Trace",
        "Strings describing the various OperationalStatus array values. For example, if \"Stopping\" is the value assigned to OperationalStatus, then this property may contain an explanation as to why an object is being stopped. Note that entries in this array are correlated with those at the same array index in OperationalStatus.",
        "Maximum number of PD receive queues that can be allocated on the default VPort. RSS receive queues are not included in this number.",
        "SamGetGrpsForUser_Start",
        "7..65000",
        "object:VideoModeDescriptor",
        "Set Port Auth Parameters on a Port",
        "FileSizeInCache",
        "Kernel Driver",
        "Function not supported.",
        "MSFT_NetDnsTransitionConfiguration",
        "This field is the node identifier / address. ",
        "PciExpressVersion",
        "QuotaPeakPagedPoolUsage",
        "SetIoPriority",
        "The SystemTrace class is the base class for all system trace events.  System trace events are fired by the kernel logger via the event tracing API.",
        "Indicates if a device can wake up via PME while the system is in S0.",
        "{3A1E7679-4B1F-4f31-A8AE-FE9278730924}",
        "MSFT_StorageDiagnoseResult",
        "Specifies the file system to format the created volume. Specifying a CSV file system is only supported on a storage spaces subsystem. For CSV the disk must be clusterable and the volume created will be a cluster shared volume.",
        "MsiXInterruptSupported",
        "TebBase",
        "The Name property contains an identifying name for the video configuration class.  ",
        "CD_8B7F99C264005A257FC33FC5B8BB55F758A76C6761D36338B6FB1E0C0931778A.1056.2628720468.762",
        "MSFT_NetBaseIPProtocol",
        "TM_LOCK",
        "IMAPI2 Zero Stream",
        "Optional",
        "Defrag",
        "CD_838E13828F10196D3F66F7B92E25AEB70BD0868AFEF218970174CFCF1AE4D54E.314.3466380270.324",
        "HwEppWriteCount",
        "ByPassForLocal",
        "True if Smart Screen is enabled",
        "LpcTraceGuid",
        "ThrottleRateAction",
        "I_F693673C4CEEE255A0773D7A8C79A487F5442508823CBC6EC11DEA6527F363E6.576.1.17537",
        "Disable real-time monitoring.",
        "Object Not Found",
        "TRACINGDMA",
        "PS/2 Compatible",
        "Imports a cache package",
        "802.2",
        "The DeviceID property contains a string uniquely identifying the pointing device with other devices on the system.",
        "Link Speed",
        "CIM_DeviceErrorData.ErrorDescription",
        "UpgradeableApplications",
        "Time at which the fault was first detected.",
        "The maximum size for a message that is processed by this binding.",
        "ref:CIM_Rack",
        "CheckForSignaturesBeforeRunningScan",
        "WakeChargeKernel",
        "Id that is globally unique to each instance of each adapter. Using the address of the Adapter Extension is a good idea.",
        "Describes the rendering mode for connections made to this printer.",
        "ProductVersion",
        "IsOwned_InitialValue",
        "Win32_PowerMeter",
        "ResourceType",
        "CipherTransformConstants",
        "Id of the associated Main Mode",
        "FRUInfoSupported",
        "CD_54D799461F62C50F4E33F56D51A5DAB2D83FEA13CE51DB9E4B33C4043A6D5638.1198.3091817334.3315",
        "Incorrect Length",
        "This class represents status of the Optional Features present on the operating system",
        "VpnClientPSProvider",
        "OrgId",
        "Checks if the TS is allowed to request CALs from license server based on the the license server security group policy on the license server and membership of RDS Endpoint Servers local group on the license server. Returns S_OK if the TS has access to the license server S_FALSE if not",
        "Associates a network adapter with its TCPIP checksum offload data.",
        "ifHCInUcastPkts",
        "The MediaLoaded property determines whether the media for a disk drive is loaded.  For fixed disk drives, this property will always be TRUE ",
        "The Name property indicates the name of the page file.",
        "IP address of the adapter",
        "If specified, allocation of this virtual disk's storage is limited to the physical disks in the list. These physical disks must already be added to this storage pool.",
        "IPv4TransmitUdpChecksumSupported",
        "(EXECUTE OFF-LINE IMMEDIATE implemented bit) - If this bit is set to one, then the SMART EXECUTE OFF-LINE IMMEDIATE command is implemented by this device. If this bit is cleared to zero, then the SMART EXECUTE OFF-LINE IMMEDIATE command is not implemented by this device.",
        "36 Track Tape",
        "Documents folder, GUID is {FDD39AD0-238F-46AF-ADB4-6C85480369C7}",
        "object:XmlDictionaryReaderQuotas",
        "The Username parameter is a pointer to a constant null-terminated character string that specifies the account name to use when connecting to the domain controller. The string must specify either a domain NetBIOS name and user account (for example, \"REDMOND\\user\") or the user principal name (UPN) of the user in the form of an Internet-style login name (for example, \"someone@microsoft.com\"). If this parameter is NULL, the caller's context is used. Blank password is passed by using an empty string ",
        "EapConfigXmlStream",
        "The percentage of the job that has completed at the time that this value is requested. Note that this property is also present in the JobProcessingStatistics class. This class is necessary to capture the processing information for recurring Jobs, because only the \\'last\\' run data can be stored in this single-valued property. ",
        "object:Channel",
        "{8502C523-5FBB-11D2-AAC1-006008C78BC7}",
        "LPCDRVR_TRACE_DRIVER Flag",
        "SPACES_StorageSubsystem",
        "The ProviderID uniquely identifies the shadow provider that created the shadow.",
        "Product key channel string. Returns null if a product key ",
        "Space parity",
        "Sets the server weight value for Session Broker Load Balancing. Valid range is 1 to 10000.",
        "CD_9A0DB23B4C5307A117BBF9E162F8E0A10B387D66AA6B5AEFE4F2996B31F1D028.2229.2004972511.224",
        "{E5B5B938-52A0-4B37-8659-24EB5165B9A0}",
        "84 - IP not enabled on adapter",
        "Com Flag",
        "Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|SessionId",
        "The Result property holds the HRESULT Status code of operation.",
        "CIM_BIOSFeature.CharacteristicDescriptions",
        "This class surfaces HBA link events",
        "internetPerConnOptionListDataSize",
        "7 - 'Snapshot': create a point-in-time, virtual copy of the source. ",
        "FirstMessageDelay",
        "CR_9D6744533171E0AA4C64E98982376A00322E3135FA3701918441437BEC34C877",
        "NS_C8FAC0B9742DA2229C2ECF37FBD0ED6687D27F243CFB10F824B862A83467DDCF\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_D78E65D43C587EB37A9E43FCF3F4E7363727C5F50EEB63C8CEDB36F05164AC6D-16",
        "LetAppsAccessEmail_ForceAllowTheseApps",
        "ScaleOut",
        "The capabilities this power meter supports.",
        "AllowClipboardHistory",
        "{4583178d-1aa8-4594-9793-6d12ce2e9e67}",
        "Fully Charged",
        "SupportsPut",
        "//           api dll and HBA driver miniport.",
        "This class represents a security identifier (SID) and its attributes.",
        "   //",
        "Example PCL/HP LaserJet",
        "This method, for a given ReplicationType, returns recovery point data.",
        "The length of the SID in BYTES",
        "Business Edition",
        "object:ISCSI_Path",
        "{8A8B5246-6EB6-4339-8B59-B0085B9F4890}",
        "Msft_WmiProvider_ComServerLoadOperationFailureEvent",
        "Win32API|Communication Structures|DCB|fErrorChar",
        "EnableInputNoNotify",
        "The name of the account to which the access right is granted.",
        "AppvClientApplication",
        "MDM_PassportForWork_ExcludeSecurityDevices03",
        "Restoring",
        "The name of the ODBC DSN to set. You can use wildcard characters.",
        "The Monochrome property indicates whether gray scale or color is used to display images.",
        "System log directory",
        "R_8FC855D7602E18735159E09D060B2A4579AF2F707E3AC0A6FFCD7B596E0D3182.1148.3344138171.532",
        "MSFT_NetAdapterPacketDirectElementSetting",
        "MSFT_NetFirewallDynamicKeywordAddress",
        "MI_ERRORCATEGORY_READ_ERROR",
        "tenths of milliamps",
        "PolicySourcePNPRedirection indicates whether the property PNPRedirection is configured by Server (0),Group Policy (1).",
        "The identifier of the switch.",
        "Communications Error",
        "PolicySourceSessionActive indicates whether the property SessionDirectoryActive is configured by Server (0) or Group Policy (1).",
        "Tunnel Mode",
        "Failover clustering could not be enabled for this storage object.",
        "TraceCreateClose",
        "MIF.DMTF|Operational State|006.5",
        "The ProviderOperation_QueryInstances property indicates the number of calls to IWbemHiPerfProvider :: QueryInstances.",
        "Send log file of the specified ETW trace session to configured remote share.",
        "RD_TRACE_DRIVER",
        "The AccessPoint or ProtocolEndpoint that is dependent on the lower-level endpoint.",
        "CD_BE3C9A0F3A301859A6C844B2145A4F44B9BD768BEE695F45C60A8F416A0E9077.1740.1219518310.4737",
        "WMI|Win32_POTSModem",
        "IsSlotWritable",
        "Net_Attached",
        "0x4030x500",
        "The StandardSecond property specifies the second of the StandardMinute when the transition from daylight savings time to standard time occurs on this operating system.",
        "OpticalReadInit",
        "Bid2Etw_MSADDS_1_Trace",
        "PossibleValues",
        "{E527D7F2-E3D4-11d2-8601-0000F8102E5F}",
        "TxRCommit",
        "Advanced",
        "A QoS policy.",
        "ref:Win32_LogicalElement",
        "Change_Dacl_Security_Information",
        "d900-4a3e-11d1-84f4-0000f80464e3}",
        "{59e81c3b-ae09-4bc5-9ebc-7605ab74d37b}",
        "The required service access point",
        "object:AcpiPss",
        "MSFT_NetIKEPSKAuthProposal",
        "See CIM_ComputerSystem.OtherDedicatedDescriptions for details.",
        "BootROMSupported",
        "MSFT_iSCSITargetToiSCSISession",
        "An association describing where a job is submitted for processing, i.e. to which job destination.",
        "TerminalServices",
        "WakeChargePreserveProcess",
        "CR_5200A18802E4747264437AC469BB415FA346E34983915EA25009200F37191BB2",
        "Count of the critical errors. ",
        "The event data.",
        "IpV6Address",
        "Discovery Configuration",
        "ElementName",
        "Data Guid",
        "Delayed Information",
        "UseDefault",
        "I_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.293.3106448493.356",
        "SelectionCriteria",
        "R_88AFB8925BED57D785F853EA39F60A2597B7DD047C4BBEFEFD01EFF42AC83C8A",
        "Many devices, such as processors or power supplies, require their own cooling devices.  This association indicates where fans or other cooling devices are specific to a device, versus providing enclosure or cabinet cooling.",
        "CD_7EDED54BF5B36D8BEF13515E9D3B438A3A9E5E4F640CC2539BC6DFFDF6BB9476.1977.3910277750.2770",
        "Windows cannot load the driver for this device.",
        "EncapsulatedPacketTaskOffloadHardwareCapabilitiesVxlan",
        "LanguagesSupported",
        "AveragingInterval",
        "MSNdis_PhysicalMediumType",
        "C_59998C21660422211077DE80E05C8A70A59B3233A43120323CA16489848947CD",
        "LPCDRVR_TRACE_RESERVED_03",
        "object:DtcTransactionInfo",
        "NDIS MAC Options",
        "A value that indicates whether the client accepts cookies and propagates them on future requests.",
        "2724244B685F217C0AAE00A921",
        "{382AC1B5-9C16-4CCD-9D00-D5053977B8D6}",
        "Radio MAC",
        "Example: Thomas Williams",
        "The EnableAtStorageActivation property indicates whether the instance of the DCOM application retrieves the saved state of the application or begins from the state in which the application is first initialized.",
        "{B65449EC-4319-4C96-9ABD-E9257D00DB84}",
        "CanCreateInstance",
        "PageFault_HardFault",
        "CD_B4ED6CD6BB039C8A40404514D33A068C19B058FAE7508C9C445CEEFE558E436D.1475.3375461920.635",
        "C_AB6B0E99E53700B220CC98E6FA99632EF2E30AA8973E530FB5000EC341F81DBE",
        "SysCallExit",
        "LogFlagLock Flag",
        "Operation",
        "Maximum pixel rate (in Hz)",
        "Win32API|Access Control Functions|GetEffectiveRightsFromAcl",
        "{43D7FDB4-B94D-4415-8792-54AF9FBEBB82}",
        "CR_1D13F523791F1EB20EAEF6F153AF80EF4F13EE29DAAF24D54E908D208A687279",
        "R_DE2F09E5209C548EB2CA373A925D80847E176AA4A3A4ACC0CB143A779C8154B2",
        "customAuthenticationKey",
        "This class represents unknown device data and exposes the data as a binary blob.",
        "CD_F8E20627EC0277AD3D6139BDD1CFFCE8B83EB1D53C7352CA749209255434ABB0.30.3343781402.553",
        "It's time to clean the drive",
        "Msft_WmiProvider_ExecMethodAsyncEvent_Post",
        "CD_3DBA7E264DDA7F8A7A309588967A7B5C3508359FF35613C96FF730C82E46EDC2.1625.1.10958",
        "TestTraceGuid",
        "The X property specifies the x offset, in pixels, of the upper left corner of a window if a new window is created.  The offsets are from the upper left corner of the screen.  For GUI processes, the specified position is used the first time the new process calls CreateWindow to create an overlapped window if the x parameter of CreateWindow is CW_USEDEFAULT.  Note, X and Y cannot be specified independently.",
        "Breach Attempted",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1620.401451610.180",
        "MsChapv2",
        "The maximum number of pending connections on the service.",
        "Thread Pool Timer Expiration Group",
        "Overall product status (MPSTATUS_FLAG enumeration bitmask)",
        "UntilTime",
        "MmSaId",
        "Cache memory management.",
        "TrafficLuid",
        "HeapTraceProvider",
        "WPD_TRACE_LEVEL_INFORMATION Flag",
        "Discovered Port WWN",
        "The StartMode property indicates the start mode of the Win32 base service. \"Boot\" specifies a device driver started by the operating system loader. This value is valid only for driver services. \"System\" specifies a device driver started by the IoInitSystem function. This value is valid only for driver services. \"Automatic\" specifies a service to be started automatically by the service control manager during system startup. \"Manual\" specifies a service to be started by the service control manager when a process calls the StartService function. \"Disabled\" specifies a service that can no longer be started.",
        "object:FrequencyRangeDescriptor",
        "AllowPinnedFolderPersonalFolder",
        "075E5FB1B219CF6D2FF755D735AA60A09AE0ED6BD6.185.1573459116.862",
        "MSFT_CliAlias.FriendlyName=\"Temperature\"",
        "MDM_Policy_Config01_Games02",
        "MaxLifetimeSeconds specifies the maximum time the IKE message sender proposes for an SA to be considered valid after it has been created. A value of zero indicates that the default of 8 hours be used. A non-zero value indicates the maximum seconds lifetime.",
        "Adjustable CopyPriority",
        "C_ECDF6473AEB5680FD494BFD070A3EC2B36A681EE68A62E383213B3D773EF9B61",
        "Win32API|Process and Thread Functions|GetEnvironmentVariable|WinBootDir",
        "This method Will install an associated Win32_Product using the installation package provided through PackageLocation and any command line options that are supplied. The method can return the following values:",
        "ID/Handle to Virtual-IF traffic selector(s)",
        "MGR_TRACE_RESERVED_19 Flag",
        "This parameter contains the Vpn Connection Profile Type",
        "object:HBAFCPID",
        "DisableInPrivateBrowsing",
        "This method retrieved the Health Actions being perfomed on the Storage Subsystem.",
        "Execute Set on a provider directly",
        "CD_8B5A6B942AA5416825152D8055EE6894FDA3E8C591F37D309F86A2C72141DDBF.1748.1887554265.1393",
        "The following types of service starts are valid only for driver services.",
        "DTRFlowControlType",
        "MimeTypesSupported",
        "Proprietary Memory Card Slot",
        "EntryExit",
        "LPCDRVR_TRACE_RESERVED_12",
        "WPD_F2 Flag",
        "Erasing",
        "Windows Build Number",
        "IR_82D62EACB411F46C88EF11FE5A18F1088AEDA0897AD63F2947178230B7AF5724",
        "This is the array of object ids this element refers to.",
        "PolicyDecisionStrategy defines the evaluation method used for policies contained in the PolicySet. There are two values currently defined: ",
        "An integer enumeration indicating the type of video memory.",
        "Creates logical grouping of virtual disks, target ports, and initiators for the purpose of showing virtual disks to host systems.",
        "21E8C383D6C44CC41",
        "Dual Scan",
        "This method allows a user to perform certain identification tasks on the enclosure and its elements.",
        "CIM_PrintService.PaperTypesAvailable",
        "IL_4AB8B718BCED40CD13B099C54A6BC7459144DF3AF86EA1B35DB5EB6EBC6C202B.1349.115352558.284",
        "{61B397FD-F5AE-4950-9758-0EE598E3C6E6}",
        "iWarp",
        "DeviceEncryptionStatus",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\ProductOptions|ProductSuite",
        "Test (7) indicates that the element is in a test state. ",
        "Copy operation requires offline source",
        "Two Sided Short Edge",
        "ContentServerIsEnabled",
        "FullDuplex",
        "The Debug property indicates whether the operating system is a checked (debug) build. Checked builds provide error checking, argument verification, and system debugging code. Additional code in a checked binary generates a kernel debugger error message and breaks into the debugger. This helps  immediately determine the cause and location of the error. Performance suffers in the checked build due to the additional code that is executed./nValues: TRUE or FALSE, A value of TRUE indicates the debugging version of User.exe is installed.",
        "Win32_OfflineFilesCache",
        "Select * from WIN32_DESKTOPMONITOR",
        "InstanceID is the property that may be used to opaquely and uniquely identify an instance of this class within the scope of the instantiating Namespace.",
        "{cd1887dd-be99-4a92-8006-e9a52db53df4}",
        "CD_4956F7377CADF88BAEF29AB167534942D2330E0E6BECB3AE4512BFCC91561A1E.1671.855419236.681",
        "HostName",
        "Security Capabilities",
        "AccessControlEntries",
        "This method returns the physical extents spanned by the virtual disk.",
        "Raw SMBIOS Eventlog",
        "Describes the profile path for the machine.",
        "The power meter that is associated to the power supply profile in ConformantStandard.",
        "Metric2",
        "The starting address where the BIOS is located in non-volatile storage.",
        "Specifies the total amount of user-mode execution time, in 100 nanoseconds, for all active processes associated with the job (as well as all terminated processes no longer associated with the job) since the last call that set a per-job user-mode time limit.   This property is set to 0 on creation of the job, and each time a per-job user-mode time limit is established",
        "Limits the maximum number of objects that may be deserialized by the data contract serializer in a single deserialization episode.",
        "Reverse Roles operation requires Split state",
        "NS_55B7453F9A92245078FCB5133CDA2D219EDE36D5B0C242DB457F8DA87C352EDB",
        "Free form descriptions of the recommended actions to take to resolve the cause of the fault.",
        "CSName",
        "Settable Parity Check",
        "WLANHC_RNWFMSM",
        "NdisFddiRingManagmentState",
        "KeyRundown",
        "CloudPrintResourceId",
        "InprocHandler32",
        "HostedCacheHttpsUrlReservationEnabled",
        "This is a special grouping of ManagedSystemElements. The grouping is viewed as a single entity, reflecting that all of its components are administered similarly - either by the same user, group of users or policy. It serves as an aggregation point to associate one or more of the following elements: network devices, such as routers and switches, servers, and other resources that can be accessed by end systems. This grouping of devices plays an essential role in ensuring that the same administrative policy and actions are applied to all of the devices in the grouping. The specific behavior and/or semantics of the AdminDomain can be identified through its aggregated and associated entities.",
        "Dns Suffix search list for the auto-triggered VPN connection.",
        "OEMStringArray",
        "The extension associated with an instance.",
        "ImagePath",
        "AuthFw NetShell Plugin",
        "A class derived from CIM_System that is a special collection of CIM_ManagedSystemElement instances. This collection provides compute capabilities and serves as aggregation point to associate one or more of the following elements: file system, operating system, processor and memory (volatile and/or non-volatile storage).",
        "MWCreate performance counter missing",
        "CD_0685F0E7DE4E9ADE69B83CB6CC4B69291D69C22AD0E71A095A2E4AEBC8EC8B85.33.1837258014.441",
        "Package name",
        "object:ThirdPartyVpnConnection",
        "MSFT_NetAdapterIPsecOffloadV2SettingData",
        "The name of the profile.",
        "{BBB7EBAA-DB32-11d2-85FC-0000F8102E5F}",
        "ExactDayOfMonth",
        "Special",
        "ReplyInconsistency",
        "Inheritance",
        "incorrectLength",
        "CD_BB85D56CC063D388F160FAD75C503ADCEEA6EC0F0714FF843F3191BD8BC9ED19.1634.584570998.349",
        "TR_TRANS Flag",
        "LogicalSectorSizeDefault",
        "FailureReason",
        "Reserved for internal use by the WMI provider only.",
        "DeviceId identifies the associated storage device. When associated with an MSFT_PhysicalDisk, it will be the same as its DeviceId field. When associated with an MSFT_Disk, it will be the same as its Number field.",
        "POINTER_PORT_WMI_STD_MOUSE",
        "PCI Component Information - Segment Number",
        "The iscsi driver implementation did not complete an operation correctly",
        "SwitchWWN",
        "If TRUE, this subsystem supports the creation of tiered virtual disks.",
        "The UserModeTime property indicates the raw counter data from the performance counter type ",
        "MethodName",
        "CIM_DirectorySpecificationFile",
        "_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655.1166.1475828249.3715",
        "StarLAN",
        "$!m;$!m;",
        "SOAPTraceClient",
        "Compress",
        "The ProductName property indicates the product name of the network adapter.",
        "C_349E3A31D1133135695017907CF38FA6787B7F880BB1D36773A1D88E19A7CE09",
        "Query Receive Filter Global Parameters",
        "SidTypeAlias",
        "C_F29100A757BDE75968386F1F8F50FAF18D4793B63DC12FB4378C18D9CD66C352",
        "41002",
        "TM_CACHE Flag",
        "Per Year",
        "StopBits",
        "10 - 'RestoreInProgress': An operation is in progress to copy the Synced object to the System object. ",
        "VirtualMachineIsolation",
        "NonCriticalFailure",
        "Set TCP Offload Parameters",
        "SPYWARE",
        "strin",
        "ConfigureTaskbarCalendar",
        "object:MSFT_iSCSITargetPortal",
        "IL_3C2C2907345FD9238E14A72F66B1B84060440D64FBC7FA8518759968C7E4B75B.790.1.49293",
        "AES-CTR/CBC-MAC with XCBC",
        "QueryParser Flag",
        "CacheMesi",
        "8 - Temp Duplicate Account -  An account for users whose primary account is in another domain. This account provides user access to this domain, but not to any domain that trusts this domain. The User Manager refers to this account type as a local user account.",
        "MDM_Policy_User_Result01_EnterpriseCloudPrint02",
        "HIPERLAN Type 2",
        "Attached",
        "AutoTuningLevelLocal",
        "The virtual disk could not complete the operation because it is in cluster maintenance mode.",
        "Returns the print jobs in a given print queue.",
        "The iSCSI name specified contains invalid characters or is too long.",
        "The optional match condition template that, if specified, overrides all other match conditions with predefined conditions. For example, the iSCSI template has a predefined match on TCP well-known port 3260.",
        "Fail_Critical_Errors - If this flag is set, the operating system does not display the critical-error-handler message box when such an error occurs. Instead, the operating system sends the error to the calling process.",
        "Win32API|Communication Structures|COMMPROP|dwMaxRxQueue",
        "One of the following values:  - DatacenterCustom, InternetCustom, Datacenter, Compat, Internet, Automatic.",
        "The TargetOperatingSystem property allows the provider to specify the  operating system environment. The value of this property does not  ensure binary executable.  Two other pieces of information are needed.   First, the version of the OS needs to be specified using the OS  version check. The second piece of information is the architecture the  OS runs on. The combination of these constructs allows the provider to  clearly identify the level of OS required for a particular software  element.",
        "IPv6 Subnet Address",
        "CD_632DEB324ADB39E99E029B3D88D503FFEF1874CB755EBE99E55CFDC82CE6D7E4.1544.2431455190.294",
        "PARPORT_WMI_ALLOC_FREE_COUNTS",
        "A string that uniquely identifies the entity that owns the definition of the format of the Message described in this instance. OwningEntity must include a copyrighted, trademarked or otherwise unique name that is owned by the business entity or standards body defining the format.",
        "Recommendation.ITU|X733.Probable cause",
        "MsChap",
        "Specifies the name of the server.",
        "ResponseBufferSize",
        "VULNERABILTIY",
        "CIM_USBHub",
        "RSS Platform Perf Trace",
        "Digest Errors",
        "DisableFamilyUI",
        "Additional availability and status of the Device, beyond that specified in the Availability property. The Availability property denotes the primary status and availability of the Device. In some cases, this will not be sufficient to denote the complete status of the Device. In those cases, the AdditionalAvailability property can be used to provide further information. For example, a Device's primary Availability may be \"Off line\" (value=8), but it may also be in a low power state (AdditonalAvailability value=14), or the Device could be running Diagnostics (AdditionalAvailability value=5, \"In Test\").",
        "runspace",
        "The low voltage of Input Voltage Range 1 for this Power Supply, in millivolts. A value of 0 denotes 'unknown'.",
        "Modifies one or more ODBC DSNs.",
        "MEM_ADDR_MASK is valid",
        "WHERE LocalName='#'",
        "The CurrentUsage property indicates whether the system slot is currently in use.",
        "Indicates whether DNS64 is enabled or disabled",
        "PacketsWithReplayDetection",
        "ifHCOutBroadcastPkts",
        "The multi-state sensor.",
        "// The number of active IPSEC tunnels.",
        "5E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "C_F10840352061CD18DB7516F60841E629D131C524C9F2F089E5D2B510560FC583",
        "ComputerStatus",
        "SMBIOS|Type 4|Serial Number",
        "SPACES_PhysicalDisk",
        "CD_D13827DA0ED443FFD82DBB415FC1698F7DC60C2E8774ABDA878946AA14F41C91.2462.3864814976.3209",
        "PropertyContext",
        "MSFT_DtcTransactionsTraceSessionTask",
        "CD_AC11DDCF9F71868BCCF23A662420DD51F76B4387A8230D6D41F7DBED8D2981ED.1666.858834705.7870",
        "Highest",
        "CIM_ElementCapabilities",
        "MDM_Policy_Result01_Notifications02",
        "MSDADIAG.ETW formatted output (A)",
        "CompatibilityDescription is a free-form string defining how the two referenced products interoperate or are compatible, any limitations to compatibility, etc.",
        "CurrentOperation",
        "MSFT_NetServiceCrash",
        "CD_0ED8829CD55CB10045BE12FF28DC63BFD30CC65BF9376DAA6A5D15ADE3CAC700.293.1883591654.213",
        "login",
        "{8500591e-a0c7-4efb-9342-b674b002cbe6}",
        "ref:Win32_ODBCDriverSpecification",
        "CD_9E064E4DC0D110210A0F35639C83ED75CA571522B2C951BEF2951DE6D3CADF05.1779.519131259.305",
        "sure management.",
        "MIF.DMTF|ComponentID|001.2",
        "DiskImage",
        "MsftDiscFormat2StreamZero_DebugGeneral Flag",
        "AllowCrossForestUserPolicy",
        "{810DC764-C1E0-4A3A-8734-87C8390A1371}",
        "AccessPath",
        "WPA2-Enterprise",
        "#define ISCSI_HBA_STATUS_FAILED            3",
        "HostingBoard",
        "ServiceAppDomain",
        "Mouse class driver information",
        "Determines the behavior of the software when the GPO for the application goes out of scope: 1 = uninstall the software, 2 = Unmanage it.",
        "{714C00BA-DB37-11d2-85FC-0000F8102E5F}",
        "VersionUsedToCreateDB",
        "If true, wait for a remote user profile.",
        "Generic Read",
        "LUAInstall: error 0x00000005 setting flags [{73FB9979-623F-41A6-BF1C-BA817C519C4F}]",
        "The InterfaceIndex property contains the index value that uniquely identifies the local interface through which the next hop of this route should be reached.",
        "Response Buffer",
        "MSiSCSI_QMIPSECStats",
        "CD_46224D79234790478799E373715902A3BEF0846D474FEF97E0FCD898A61C06EA.1191.3823289365.296",
        "FixedDrivesRecoveryOptions",
        "Pixel clock rate (Hz)",
        "CD_57D40BA37FE8186F3446A32034E557900E56ACCCD48ACC004BB55BAE4E42928A.1191.1555259249.607",
        "LoadingEnd",
        "The IPSecPermitTCPPorts property lists the ports that will be granted access permission for TCP. The list of protocols is defined using the EnableIPSec method. The list will either be empty or contain numeric values. A numeric value of zero indicates access permission is granted for all ports. An empty string indicates that no ports are granted access permission when IPFilterSecurityEnabled is TRUE.",
        "The FileSystem property indicates the file system on the logical disk.",
        "CR_4382409C2BA25AB891FE25D9946357B2012609A915D0D018CA8A80D2ABEE1CA0",
        "SetProgramList",
        "NumberOfItems",
        "An invalid key text was encountered",
        "PermissionMask",
        "IPv6 address ranges attributed to a DA site",
        "LogFlagError",
        "Specifies whether to enable or disable LPT Port mapping.",
        "The DNSServerSearchOrder parameter indicates the list of server IP addresses to query for DNS Servers.",
        "Pending 24 hour move to cleared and non critical remediation failure detections",
        "C_832531694CC32AEF12EEFA0D2DDA8BF782C32F932BED169759F268D0FEAF39B8",
        "CD_DDFBE2B8C9C0EB71960ADB33E49F91EDA6D2896A8A0783F02D140DCEC2F9FEC6.77.2322781230.485",
        "Transitioning",
        "Number of processors in this dependency domain",
        "If RunAsJob is set to TRUE and this method takes a while to execute, this parameter returns a reference to the storage job used to track the long running operation.",
        "CIM_Slot.PurposeDescription",
        "InternetConnectionCount",
        "C_DF35CAA9032B2BC8E9E68BEFAD5091A66EF205D46DBC51F13F62EC987E8BBEAC",
        "VPN Connection profile management and remediation class",
        "AllowGraphingCalculator",
        "SourceFileAlias",
        "List of Hardware IDs associated with the device. A hardware ID is a vendor-defined identification string that Setup uses to match a device to an INF file.",
        "Signal sync type",
        "ScsiPathId",
        "Uploads",
        "Append",
        "The Differential property indicates whether the shadow copy was created by a differential shadow copy provider. The provider can be implemented in hardware or software.",
        "57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        " The DirectoryType property characterizes the type of directory being  described. ",
        "MSMCAInfo_RawMCAData",
        "DisableGeolocation",
        "2 GBit/sec",
        "portIndex",
        "HigherLayerInterfaceIndices",
        "Dot11 Association Completion status information.",
        "ShellNew",
        "PrinterConfig",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_workstations",
        "A text string set by the manufacturer describing the firmware version of adapter",
        "MDM_Policy_Config01_Kerberos02",
        "Win32_ThreadStopTrace",
        "MSNdis_NetworkAddress",
        "The Antecedent reference represents the Win32_BaseService containing the base service relied upon by the Dependent property of this class.",
        "EncryptionCompliance",
        "\\\\.\\root\\CIMV2\\Security\\MicrosoftTpm:Win32_ProviderEx.Name=\"Win32_TpmProvider\"",
        "KeyManagementServiceFailedRequests",
        "SendTimeout",
        "TEST_TRACE_GENERAL Flag",
        "msieee80211-Name",
        "VirtualAllocDCEnd",
        "Hash algorithm to use in ESP.",
        "CD_1A56F41D63578C6740DEEE2D125A595986E3783B82D23576EACB16C1622C2314.1186.2709006802.778",
        "Initial property values of the resource before it is enacted.",
        "{05D1FFF2-DB36-11d2-85FC-0000F8102E5F}",
        "CD_A66D0E591535F85D5DA7C1BDF3A1DC73BE40E7ED75F810DC35A2C1D0250B7F4C.41.3690810158.523",
        "Custom Links",
        "DecryptionInProgress",
        "Allow-List info for a file extension associated with a RemoteApp",
        "NdisEncapsulationIeeLlcSnapRouted",
        "AppBackgroundTask",
        "Port Frees",
        "MI_ERRORCATEGORY_CONNECTION_ERROR",
        "The number of bytes of disk space reserved if the associated software element is installed to run from source.",
        "RemoteIPAddress",
        "AccessInfo",
        "Not Applicable (5) indicates the element does not support being enabled or disabled. ",
        "Make this power scheme the active one on the system.",
        "NDIS Token Ring Current Address",
        " CE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0",
        "Describes settings related to the BranchCache hosted cache server role",
        "The resolutions, refresh rates, scan mode and number of colors that can be set for the Controller.",
        "DurationInSeconds",
        "Sideloading key",
        "Block Paging IO",
        "ErrorCode",
        "s.SupportedReplicationTypes",
        "The Sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If Current Reading is between LowerThresholdNonCritical and Upper ThresholdNonCritical, then the Sensor is reporting a normal value. If CurrentReading is between LowerThresholdNonCritical and LowerThresholdCritical, then the CurrentState is NonCritical.",
        "Represents a storage array subsystem that exposes virtual disks.",
        "Disables downgrading, so that the client will no longer request the specified version of content information from servers.",
        "Whether to disable Memory Compression (disabling will take effect after the system is restarted). Memory compression is a Windows feature which compresses unused memory to keep more data resident in RAM. It also reduces the amount of data written to and read from the pagefile, thus improving performance.",
        "TM_MEDIA Flag",
        "Touch Screen",
        "object:__Trustee",
        "See CIM_SoftwareInstallationService.InstallFromURI.InstallOptionsValues for details.",
        "C_F8A40DE76638BC2D6B465FB946B5587EB32CE4928E4F71A985E7A4A1C7848063",
        "RemovePackageMethod",
        "The Collate property specifies whether to collate the pages that are printed. To collate is to print out the entire document before printing the next copy, as opposed to printing out each page of the document the required number times. ",
        "MSFT_ReplicationGroupToPartition",
        "WSP_StorageSubsystemToReplicationGroup",
        "TEST_TRACE_RESERVED_1e Flag",
        "Delay in ms between sending quad-A query and A query",
        "MSNdis_EnumerateReceiveQueues",
        "Errors Access Permissions",
        "DHGroup",
        "331EF4E9B8630371",
        "HeaderIntegrity",
        "Embedded NT",
        "{8B98D3F2-3CC6-0B9C-6651-9649CCE5C752}",
        "DisabledByPolicy",
        "Win32_NamedJobObjectLimit",
        "NETIO_TRACE_RECEIVE Flag",
        "B2628C#",
        "Identity flags",
        "ISCSI_ERR_INVALID_INITIATOR_CHAP_SECRET",
        "SOM id, which is a unique identifier for objects of this class",
        "0x8005005C",
        "NS_37FD5386C028E960C90BC77B9D8DDCA28B24BAE2E315E8D8209BF5E2633575D8",
        "Directory",
        "Property for controlling DirectAccess rules state.",
        "Comma separated list of dependent applications",
        "Example: Jsmith.",
        "object:MSFT_PrintJob",
        "The company registered to use the product.",
        "ResumeConversion",
        "Octetstring",
        "By default, this property will be true to let the roaming profile roam between the local computer and the server.",
        "LPCDRVR_TRACE_RESERVED_0c",
        "Caption is a short textual description (one-line string) of the CIM_PhysicalCapacity object.",
        "SamUserCreate",
        "Indicates the current power state of the computer system and its associated operating system. Regarding the power saving states, these are defined as follows: Value 4 (Unknown) indicates that the system is known to be in a power save mode, but its exact status in this mode is unknown; 2 (Low Power Mode) indicates that the system is in a power save state but still functioning, and may exhibit degraded performance; 3 (Standby) describes that the system is not functioning but could be brought to full power 'quickly'; and value 7 (Warning) indicates that the computerSystem is in a warning state, though also in a power save mode.",
        "TEST_TRACE_RESERVED_1e",
        "MSNdis_FddiFrameErrors",
        "TcpIp IPV6 Send",
        "MSFT_DASettingsIndication",
        "{1008CCE7-7BFF-11D2-AAD2-006008C78BC7}",
        "TRACE_RESERVED6 Flag",
        "IPHttpsProfile",
        "Bid2Etw_MSADCO_1_Trace",
        "dialUpSettings",
        "MIF.DMTF|Electrical Current Probe|001.8",
        "quest ",
        "MSI-X is supported.",
        "I_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6.1489.398642378.282",
        "CdnConnections",
        "Valid from date of the issued certificate",
        "The Insertable property indicates whether the COM component can be inserted into OLE container applications.",
        "13 - CIM_ERR_TYPE_MISMATCH. The value supplied is incompatible with the type. ",
        "Version string from version resource if one is present.",
        "The configuration object that aggregates the setting.",
        "CD_050953C58E97660582926667045FD157390A1B7EE9E1CDFCB3DD57BDA1E5B26D.2071.1.38378",
        "Win32API|Communication Structures|DCB|ByteSize",
        "The TimeToLive property indicates the lifespan of the ping packet in seconds. This is an upper limit and not absolute as all routers MUST decrement this value by one and hops between routers rarely take this amount of time.  When this value becomes zero the packet will be dropped by the router. The default value is 80 seconds.",
        "Proprietary Virtual/Internal",
        "command",
        "ountedString",
        "Certificate In Base-64 encoded format",
        "MIB.IETF|HOST-RESOURCES-MIB.hrDeviceStatus",
        "Queue Size Exceeded",
        "Volume Mount",
        "TM_STORE",
        "The LastModified property is a datetime value indicating the time the file was last modified.",
        "Normal Account",
        "/D25701B24B8",
        "Localized version of RSOP_PolmkrPowerSetting for American English",
        "AddNode brings a new computer system into a cluster. The node to be added is specified as a parameter to the method. The return value should be 0 if the computer system is successfully added, 1 if the method is not supported and any other number if an error occurred.",
        "MaxReadPoolSize",
        "{29B273F2-E3D3-11d2-8601-0000F8102E5F}",
        "ConfigureHomeButton",
        "RouteEventProvider",
        "WMPNsSciGuid",
        "CHAP Username given is invalid.",
        "Parameter1",
        "PLATFORM_TRACE_RESERVED_17 Flag",
        "Denotes whether this subsystem supports creation of a file server.",
        "IL_B4A2C5E94294CA48EE83444B581B7715F0456C2AE322533C1FC870F4B341BC92.2459.1269866449.285",
        "PA-RISC 8500",
        "Videos folder, GUID is {18989B1D-99B5-455B-841C-AB7C74E4DDFC}",
        "QuantumType",
        "Boolean indicating that this slot is physically unique and may hold special types of hardware, e.g. a graphics processor slot. If set to TRUE, then the property, PurposeDescription property (a string), should specify the nature of the uniqueness or purpose of the slot.",
        "DnsServers",
        "0x8005004A",
        "The name used by NDIS. This is typically the service name for the protocol.",
        "MSI Product code",
        "AppData",
        "Detailed Signature Notifications.",
        "BAUD_14400",
        "Upgraded",
        "MIF.DMTF|Memory Device|002.19",
        "Port symbolic name",
        "The Query property is a string containing the event query filter, which was registered by a logical consumer.",
        "PolicySourceVirtualIPMode",
        "DataFile Management.  ",
        "Minimum number of synchronous replication partnerships that are in synchronous replication state for I/O to continue on source Replication Group.",
        "LetAppsAccessCalendar_UserInControlOfTheseApps",
        "Processor State Flags",
        "CurrentNumberOfColumns",
        "NCSICtlGuid",
        "R_9027205FD7E053DF439410755A9BD704E454F745D87AB219C121424FF63B731D",
        "Bit flags representing rights granted/denied to the trustee",
        "This field denotes the specific error code used for 'Relative paths not supported'.",
        "TRACINGPNPPOWERSTATES Flag",
        "InternetZoneAllowVBScriptToRunInInternetExplorer",
        "SyncPairs",
        "Version number of schema.",
        "CD_C85BEC05E1DE78CAC5454E6D33A2BAFD69D28B4057355776F41B00B3DF99855E.2427.3947980781.400",
        "MDM_PassportForWork_Biometrics01",
        "AllowStandbyStatesWhenSleepingOnBattery",
        "companyName",
        "Supports ReFS File System",
        "CIM_ComputerSystem.RequestedState",
        "UniqueId is a mandatory property that is used to uniquely identify a logical instance of a storage subsystem's object. This value must be the same for an object viewed by two or more provider instances (even if they are running on seperate management servers). UniqueId can be any globally unique, opaque value unless otherwise specified by a derived class.",
        "SourceLines",
        "NdisRingStateClosed",
        "MSFT_Rule",
        "C_946F4B9CC4FC67CBB30182CFEF8E5287FF27217BE36B1392758F9655E96E5C2F",
        "GroupA",
        "object:HBAFCPBindingEntry",
        "AllowScreenMonitoring",
        "OEM specific bus dependent data",
        "Provides the capability to disable any combination of the following:",
        "{F04C3F9B-20B3-40E1-A824-3A41FE3D7931}",
        "The ListOfLanguages property contains a list of namesof available BIOS-installable languages.",
        "MaximumPINLength",
        "Status information for a Printer, beyond that specified in the LogicalDevice Availability property. Values include \"Idle\" (3) and an indication that the Device is currently printing (4).",
        "SECHC_LOG_FLAG_ONEX_DIAG",
        "ProfileUploadDisabled",
        "The interval of time provided for an open operation to complete.",
        "ESCON",
        "Bytes written using SPP mode",
        "SyncType describes the intended outcome of the replication. Values are: ",
        "The maximum interval of time that a chunk of a message or a full message can remain buffered in memory before being sent out.",
        "{8502C4F8-5FBB-11D2-AAC1-006008C78BC7}",
        "The resource module repository source that this partial configuration will use",
        "The identity of the endpoint.",
        "C_C3366DDE9F2F54519CCC578CBF8A7581CEC6A62E8EB4A103001D861C9B636A37",
        "object:Win32_OfflineFilesConnectionInfo",
        "{1D40FFD4-DB32-11d2-85FC-0000F8102E5F}",
        "FileTrace",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"WMI Kernel Trace Event Provider\"",
        "RTLostBuffer",
        "SYSID UUID",
        "This method allows a user to perform certain maintenance tasks on the physical disks in the storage enclosure. ",
        "ExclusiveResources",
        "The main mode rule being filtered.",
        "Boolean indicating that the DiskPartition is labelled as bootable. This does not mean that an OperatingSystem is actually loaded on the partition.",
        "NAT64 settings associated with this interface",
        "SolicitedNodeIPv6Address",
        "Hive Address",
        "Exception (10) indicates that the Job is in an abnormal state that might be indicative of an error condition. Actual status might be displayed though job-specific objects. ",
        "I_75757880EAB8961D1A3C186FDB42A3E5F36F1FCF20B2679D12A2FFFCA63470FF.551.1.33689",
        "LocalityName",
        "Specifies the property values of the new ODBC DSN. Format as an array of strings where each string is: <key>=<value>.",
        "The DirectoryPath property is used to capture the name of a directory.  The value supplied by an application provider is actually a default or recommended path name.  The value can be changed for a particular environment.",
        "BaudRate",
        "HOSTPROC_TRACE_API",
        "{5ec10356-a61a-11d0-8dd4-00c04fc3358c}",
        "See CIM_Processor.Family for details.",
        "IPsec Task Offload v2 settings for a network adapter",
        "BreachDescription is a free-form string providing more information if the SecurityBreach property indicates that a breach or some other security-related event occurred.",
        "WiMAX",
        "Win32API|Process and Thread Functions|TerminateProcess|uExitCode ",
        "ChangeNotify",
        "Multi-hop elements must have same SyncType",
        "BinaryRepresentation",
        "NETIO_TRACE_NSI",
        "EA_IME_API",
        "Renames a network adapter",
        "MGR_TRACE_RESERVED_1e",
        "AllowOutboundParameterProblem",
        "This parameter is only used for domain renames on Windows 2000 platforms and beyond. ",
        "TM_ICSC",
        "Deletes a cache file.",
        "BytesTransmitted",
        "ClientCredentials",
        "ROOT\\Microsoft\\Windows\\DesiredStateConfiguration\\MS_409",
        "FileSystemLabel",
        "Branch register",
        "The world wide node name of fabric",
        "IL_AF63A33DD08D45D1B69DD77DFB1C679EC967FCF05E3CDDCE214188739111AC70.2698.1235244509.272",
        "I_C004F31EED0C3389D3663FFEDC2379761F7F253446DFB3E07A859B8D44F5D78E.417.1.15778",
        "FX_TRACE_RESERVED_15 Flag",
        "IsEmbedded",
        "{6E964E9B-46BD-45C6-88B4-4F9D5593237B}",
        "This bit indicates whether the machine supports reset",
        "9FFAA641A6E8D9062FAF7.1149.984498510.664",
        "configurationControl",
        "DeleteDirectConnectLicenseServer",
        "The GroupComponent reference represents the properties of the computer system where the logical device exists.",
        "The security settings of the share object",
        "Hard page faults",
        "Name is a user-friendly system defined name for the masking set. Name is unique within the scope of the owning storage subsystem.",
        "hundredths of percent",
        "The EnableWINS method enables Windows Internet Naming Service (WINS) settings specific to TCP/IP, but independent of the network adapter. The method returns an integer value that can be interpretted as follows: ",
        "FirewallStatus",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.1165.892627244.1603",
        "CR_5C019BBCF7CD2BCBAB2E1080A9EEA832173CDA76E5635A18F883174B94FE0F77",
        "Microsoft Recovery",
        "C_F33D7C5F62C48A98254F1B0ADED8C5A8E56D1601D517CF44369F4A800E4AA9F6",
        "NS_892F8DB69C4EDFBC68165C91087B7A08323F6CE5B5EF342C0F93E02A0590BFC4\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_D980EB9E5642F0999DC4AB724E6D1AB5BD3BF32EB2B6ED1230F2BCEF6E536E10;",
        "CIM_PolicySetComponent.Priority",
        "The name of the port monitor for this port.",
        "{E159FC63-02FE-42F3-A234-028B9B8561CB}",
        "object:MSFT_ScheduledTask",
        "AllowPowerSleep",
        "WSP_ReplicationSettings",
        "The  HostProcessIdentifier property defines the process identifier hosting the particular instance of the provider.",
        "The Metric3 property contains an alternate routing metric for this route. The semantics of this metric are determined by the routing protocol specified in the route's ipRouteProto value. If this metric is not used, its value should be set to -1.",
        "EnableUnsecuredResponse",
        "Win32Registry|.DEFAULT\\Control Panel\\Desktop\\WindowMetrics|IconFont",
        "indirect",
        "WTNodeSwitch",
        "9 Pin Dual Inline",
        "timestamp",
        "#define ScsiReadCapacity_OUT_ResponseBuffer_SIZE_HINT 16",
        "Resize",
        "Qualifier for LS availability",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{GUID}[ActivateAtStorage]",
        "Maximum number of completion entries per completion queue",
        "R_4594D6C30924C4ED031F78EE8103A8C70830325B9BD2B6144E91FDA4F064B1F6.284.1680801173.520",
        "CR_EB5DF692E5695761F8BB75E5CAB5C2E64C9D570F7A2AE8F24E9823A6FAB0CA95",
        "SDBUS_DEBUG_DEVINIT",
        "{acf14038-a61c-11d0-8dd4-00c04fc3358c}",
        "select * from Win32_ProcessStartTrace",
        "IL_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.285.2021993801.242",
        "SCSI Request Block",
        "LPC_TRACE_RESERVED_17 Flag",
        "The maximum event level for the event capture.",
        "Not Implemented",
        "GetSupportedOperations",
        "The CreateShortcuts action manages the creation of shortcuts. In the Advertise mode, the action creates shortcuts to the key files of components of features that are enabled. Advertised shortcuts are those for which the Target property is the feature of the component and the directory of the shortcut is one of the Shell folders or below one. Advertised shortcuts are created with a Microsoft installer technology Descriptor as the target. Non-advertised shortcuts are those for which the Target column in the Shortcut class is a property or the directory of the shortcut is not one of the Shell folders or below one. Advertised shortcuts are created with a Microsoft installer technology Descriptor as the target. In the non-advertise mode (normal install) the action creates shortcuts to the key files of components of features that are selected for install as well as non-advertised shortcuts whose component is selected for install.",
        "Folder Item",
        "DesktopInteract",
        "Publish_BCFileHashes",
        "LPC_TRACE_LOOKASIDE",
        "{EB98A1B2-DB36-11d2-85FC-0000F8102E5F}",
        "Note that the Name property of ManagedSystemElement is also defined as a user-friendly name. But, it is often subclassed to be a Key. It is not reasonable that the same property can convey both identity and a user-friendly name, without inconsistencies. Where Name exists and is not a Key (such as for instances of LogicalDevice), the same information can be present in both the Name and ElementName properties.",
        "DSDnsControllerFlag",
        "ed among the library and driver modules",
        "SetIntegrityStreams",
        "EventPairLow",
        "R_46220D63709C3AA26B1F26BFEDBED5BF0C3449D14236275DE54E229C2751EF56",
        "The service's x.509 certificate.",
        "0XD027..",
        " A service start during startup of the system.",
        "ScheduledStartTime",
        "LoaderCodedEventPath",
        "MIF.DMTF|Network Adapter 802 Port|001.2",
        "C_C0932D78F140997A49C8B45C94D66A040A7701473EF29BB14AA1C56EBE031CB2",
        "00000000000030.000000:000",
        "The DriverDate property indicates the date of the modem driver.",
        "Capabilities and management of cache memory. Cache memory is dedicated or allocated RAM that a Processor searches first for data, before going to 'regular' memory. CacheMemory is used to speed up the delivery of data to a Processor. It is usually described by its closeness to the Processor (for example, Primary or Secondary Cache).\\nIf a DiskDrive includes RAM allocated for holding the disk's most recently read and/or adjacent data (in order to speed up retrieval), this also would be modeled as CacheMemory. Note that CacheMemory is NOT operating system or application level buffers but actual RAM allocated for caching data for a Processor, from a hard disk, etc.",
        "MsftWriteEngine2_DebugConstructor",
        "Win32API|Communication Structures|DCB|EvtChar",
        "CIM_IPProtocolEndpoint.IPv4Address",
        "`)m;`)m;",
        "88 - Invalid network number",
        "R_F1D630BEF68CF726458C1876C0DE9976B74EB5D695E5BE33FC487E2CEB030F7F.1197.1681292377.564",
        "Switch parameter to denote that the cmdlet is being executed for a third party profile",
        "object:MSNdis_WmiTcpConnectionOffload",
        "Failure Predict Data",
        "ServicePackMajorVersion",
        "R_CE7115C334FCF4CAF18779B5DCE6EE49094B2697F81975FFC890786B7C5BEB22",
        "CATV Downstream",
        "AccountLogon_AuditCredentialValidation",
        "ECFirmwareMinorRelease",
        "This association relates an MSI feature with any condition or locational information that a feature may require.",
        "RemoveVirtualDisk",
        "Filtering flags",
        "CD_9BD335E67BAE50C9848BEA0828D53089414BA43D5342FE18815FB3521F2F4CC6.1783.3265818418.555",
        "MEM_COLUMN",
        "CIM_Process.CSCreationClassName",
        "DOT11_PNP",
        "Query Link State",
        "MIF.DMTF|Memory Mapped I/O|001.2",
        "iScsiFlagAdapter",
        "The current state indicated by the Sensor. This is always one of the \"PossibleStates\".",
        "userAgentText",
        "NumericParameterStepValue",
        "CIMObjectPath",
        "Phase1AuthSet",
        "Uint64",
        "NullSessionShares",
        "Accounts",
        "TCPOffLoadAvailable",
        "GetDiscoveredPortAttributes",
        "TP_V2_TimerExpiration",
        "Status Circular Dependency",
        "CD_A435E1CD6D36EB19C6DA0BA1C7E62224942A59031964EC981FF17A68812E1011.1807.1630028497.417",
        "C_038FB93272FAE6ABFA86F7DB95C50EABB70457A3A4C501BDC273939A1E6BDB9D",
        "NDIS Token Ring Current Ring Status",
        "MDM_Policy_Config01_KioskBrowser02",
        "LogCount",
        "CD_E52BD2BB65ED90ABABACDFC8937D94C5808CFF6C3FD9A7BEE235CE9F6DF64BCB.74.1554351600.580",
        "Per-machine",
        "C_0F2DD3599D613DB74CB1ED2BE9F8DA01F5C4A980B89415432A1F6BEC216D618E",
        "DestinationIPAddresses",
        "The DeviceID property contains a string identifying the parallel port.",
        "TO_D_ID",
        "#define ISCSI_LOGIN_OPTIONS_USERNAME                    0x00000020",
        "object:MSNdis_WmiTcpIpChecksumOffload",
        "{72FB9358-A9B3-41E0-AE41-E8DECA41E3A8}",
        "Level 2",
        "CIM_Printer",
        "MSFT_ExpressionLet",
        "\\\\.\\root\\Microsoft\\Windows\\Storage\\Providers_v2:__Win32Provider.Name=\"wsp_fs\"",
        "DOAbsoluteMaxCacheSize",
        "Supports Dual Sided Media",
        "WPD_F7",
        "C_C12F1595FB14302AC3BDABF5969819839654D56DFF22512157B1EA1002807534",
        "DetachedReason",
        "RequireSecuritySignature",
        "The number of frames received with alignment errors.",
        "Line Data",
        "HorizontalBlankingPixels",
        "Accepts foreign object paths",
        "The order of message encryption and signing for this binding.",
        "PolicySourceSessionDirectoryLocation",
        "The number of disconnected sessions on this server.  These sessions may still be actively consuming server resources, however they currently have no network.",
        "UInt32",
        "__EventGenerator",
        "PS_ModuleFile",
        "1 - 'Level 1': Storage pools, resiliency settings, target ports, target portals, and initiator ids belonging to this subsystem have been discovered. ",
        "SupportsMultipleResiliencySettingsPerStoragePool",
        "StreamingAllowPackageSourceRoot",
        "FD Publication Trace",
        "R_142623D3E4F607F4C710DC9D110BC19440768FE0613231D265775B5055DD4B5E.1501.2196819660.586",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1797.1859355143.180",
        "CD_3AE83E61965FB27603BA5CEF6287221F55B7F43E8EF0935F985E7B5963177B6A.1700.259369830.341",
        "47000",
        "This indicates the length of time, in minutes, that a PMK cache will be kept.",
        "40005",
        "NS_5383CAE6BA7DF67C8540FB8486138E8E7854E1A417C357D4708E676797F6FF28\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_43B7B69F919BB681DCC1079E7BED6BA29BBE6F4DDA8822130874E698F9F22509",
        "The DSROutflowControl property determines whether data outflow control is enabled when there is a Data Set Ready (DSR) condition. DSR signals that the connection has been established by the devices on the serial connection.",
        "PackageFamilyName",
        "True if the go to Intranet for single word setting is enabled",
        "Not_Null",
        "Inherited from RSOP_PolicySetting.",
        "CIM_Error.CIMStatusCodeDescription",
        "PolicySourceSingleSession indicates whether the property SingleSession is configured by Server(0) or Group Policy (1).",
        "Specifies whether network detection is used. 0:used at connect time and in steady state., 1:disabled at connect time, 2:disabled in steady state,3:disabled at connect time and in steady state.",
        "Storage device wear indicator, in percentage. At 100 percent, the estimated wear limit will have been reached.",
        "MSPower",
        "{F8C60AED-EF8D-4f95-9EA8-F04318A00F30}",
        "MaxTimeUs",
        "object:MSStorageDriver_ClassErrorLogEntry",
        "(self-test implemented bit) - If this bit is cleared to zero, the device does not implement the Short and Extended self-test routines. If this bit is set to one, the device implements the Short and Extended self-test routines.",
        "Invoke",
        "Number of active RDMA connections",
        "A value used to define an array of binary values. This value is readable.",
        "CR_90D6DB96E4E52DF3FCB751D8C2491313C169EEA2DEA2212CBFE4EFF8C0A5E947",
        "AuthenticationMethod is an enumeration that specifies the operation of the IKESAEndpoint. The list of methods was generated from Appendix A of RFC2409. Note that the enumeration is different than the RFC list, since the values of Unknown and Other are taken into account.",
        "Access or addressing information or a combination of this information for a remote connection. This information can be a host name, network address, or similar information.",
        "MSFT_CliAlias.FriendlyName=\"ComputerSystem\"",
        "IR_0194D7E956D38B1C947B3250090E0D48410CD052B7BC03F2F1F43DC398A99DC9",
        "MCA_WARNING_PCI_BUS_UNKNOWN",
        "{7c65ceb0-75ba-46b9-884e-67e038c5b003}",
        "The PMTUDiscoveryEnabled property indicates whether the Maximum Transmission Unit (MTU) path is discovered. Setting this parameter to TRUE causes TCP to attempt to discover the MTU (the largest packet size) over the path to a remote host. By discovering the MTU path and limiting TCP segments to this size, TCP can eliminate fragmentation at routers along the path that connect networks with different MTUs. Fragmentation adversely affects TCP throughput and network congestion. Setting this parameter to FALSE causes an MTU of 576 bytes to be used for all connections that are not to machines on the local subnet. Default: TRUE.",
        "Minimum number of segments that a large TCP packet must be divisible by before offloading to Adapter for segmentation.",
        "The replication group contains replicas.",
        "EnableLowCPUPriority",
        "SetFileDeviceElement",
        "IL_BBFCCB444CF66AA09AE6F15967A6865175BB0ED216D19970A7988B72CDF0A3A4.297.1059767373.342",
        "NDIS Dot11 TKIPMIC Failure Status Indication",
        "MSFT_DOUsage",
        "CD_D5472BB4000403F6D6CDB0F595804CE62C0D292549796526CA9E7773798E5F24.133.2231630649.318",
        "{E5D8A563-F6C0-11d2-B35E-00105A1F8569}",
        "cal inch",
        "NdisCoTransmitPdusOk",
        "The ExecutablePath property indicates the path to the executable file of the process./nExample: C:\\WINDOWS\\EXPLORER.EXE",
        "MSFT_ResiliencySetting.Name",
        "Whether to use Stealth Mode for IPsec-protected traffic.",
        "WBEMCORE",
        "ProcessLimitAllHosts",
        "object:VpnCommonConfig",
        "0 - Disconnected",
        "CR_4082A72ACD016CE3E809C18525EF28CAFFEB76B1D6E2F5C00FFCF2C67654A896",
        "A user-friendly name for the object. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information. ",
        "<LocalID> MUST include either a vendor specified unique identifier, or if mapping from an ITU M.3100 environment, the trailID, connectionID or subNetworkConnectionID of the instances of PipeR2.",
        "AutomaticResetBootOption",
        "EnableDevQ - Enable the queue on the printer if available.",
        "7BF412EF517BF16CBEA0AD032C8FE94CB2DD73B9CD909C08659DB8C5BC0A.1354.303244126.276",
        "MSNdis_MacOptions",
        "WMI|Win32_NetworkAdapterConfiguration",
        "ThreatStatusID",
        "{A2EFC896-E3D3-11d2-8601-0000F8102E5F}",
        "R_A9AE64C03C11270991C8BCE26EBE3DD0FF3F841C3C80D3A28DC949EF9B62D60B",
        "NETIO",
        "OpTrustedDomByName_End",
        "The volume optimization operation requested is not supported by the hardware backing the volume.",
        "The Delete method will delete the logical file (or directory) specified in the object path. Delete returns an integer value of 0 if the file was successfully deleted, and any other number to indicate an error./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n",
        "The MaxLogFileSize property indicates the maximum size of the log files produced by the WMI service.",
        "SystemConfig_V2_TelemetryInfo",
        "File Backed Virtual",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"RouteEventProvider\"",
        "C_0C79684F32FD7D7088A468F0BE92EA35ACEB9FB4BBDF74F4E887F74EA9111458",
        "InterfaceOperationalStatus",
        "The Hidden property indicates whether the printer is hidden from network users.",
        "Msft_CliAlias.FriendlyName=\"RDPermissions\"",
        "Storage Fault domain on which the maintenance mode will be enabled/disabled.",
        "ProcessName",
        "The language of the type library.",
        "Association between StorageSubSystem and OffloadDataTransferSettings",
        "REDBOOK_WMI_SECTORS_PER_READ_MASK",
        "The sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If the CurrentReading is above UpperThresholdFatal, then the CurrentState is Fatal.",
        "EvaluationEndDate",
        "The Dependent reference represents the driver that supports the printing device.",
        "Upgrade",
        "Lifetime over which the route is preferred. The default value is infinite.",
        "R_169484918492FC0AC4886BF1A48556EDC1984793E915C243C1C0A4B8E678F4FD",
        "object:Win32_RoamingProfileSlowLinkParams",
        "MDM_Policy_Result01_AppRuntime02",
        "{0725C3CB-FEFB-11d0-99F9-00C04FC2F8EC}",
        "This class represents per-interface ISATAP Configuration settings.",
        "Events",
        "Bid2Etw_SQLOLEDB_1_Trace",
        "TipInterface Flag",
        "Restore",
        "DownForeLimitPctProvider",
        "Evaluate",
        "Ndis80211ReceivedSignalStrengthTrigger",
        "This parameter is used to specify an array of source storage objects by Ids to be replicated. Consistency ordering is based on the order of objects in this array.",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmPaperSize",
        "MDMWinsOverGP",
        "R_518737FCD9736D06CAEE43D2445A32ADF7BA5172ECE7281110883C447A0C8E05",
        "options3",
        "ThreadRoutine",
        "HighDateTime",
        "R_E7ACEB5389BA8C32B04736209B872B130DCE3B94FF3A17F3972AEE3EFE29C3CE",
        "LocalConsecRulesDisallowed",
        "#define HBA_EVENT_PORT_BROADCAST_D01_4  0x209",
        "The name of the class or the subclass used in the creation of the System object in whose scope this PolicyAction is defined. ",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmDeviceName",
        "{0F73ED5E-8ED9-11d2-B340-00105A1F8569}",
        "Maximum refresh rate of the video controller in hertz.",
        "65003",
        "C_BBD86C45827BAA3142E8EBB2B4C0577FACECCA56171A99F17B3F06E280A3C32F",
        "IoStopTimer",
        "QueryInfo",
        "RSC properties for a network adapter.",
        "Win32_ComputerSystemProduct",
        "The SMBIOSPresent property indicates whether the SMBIOS is available on this computer system..",
        "GR303 RDT",
        "NetworkFSSUserSessionWeight",
        "SetInfoPolicy_End",
        "LPC_TRACE_CONNECTION Flag",
        "The number of unicast bytes received without errors through this interface.",
        "Data Parity Error",
        "The maximum speed of the NIC (kbps).",
        "CR_FF26EE1E822090646FAD145AA9A6AA2ADDD373CED2E3B2B3D92A588873B3BEC9",
        "Specifies the new default resiliency setting that should be used by this storage pool. The resiliency setting specified must already be associated with this storage pool.",
        "Demand Installable",
        "Invalid Root Path",
        "QueryId",
        "AllowLockedDownInternetZoneTemplate",
        "DeploymentOptions",
        "MaskingMapCountMax",
        "CD_2277447C6063BFBAC05CE459DB8B2E90B2D0D7BB283ED825F0C1EAA1C62A123A.1.1591629636.404",
        "Text that appears in the IE browser title bar after the standard string, \"Microsoft Internet Explorer provided by.\"",
        "MsftDiscFormat2Data_DebugConstructor",
        "SelectLidCloseActionOnBattery",
        "RD_TRACE_RESERVED_19",
        "The FileSystem property indicates the file system on the logical disk. Example: NTFS",
        "CD_6733173DBDD8F69CA9013116A1C86DBB32D2314712D9192FE9CAEE8C9CAD7094.2117.1014708722.2072",
        "Disables the Receive Segment Coalescing (RSC) properties on the network adapter.",
        "Values: TRUE or FALSE. A value of TRUE indicates DTR and DSR signals are supported.",
        "WPD_TRACE_LEVEL_VERBOSE Flag",
        "C_3E11F2867F2D534D95C0593A0AA32ECA612C606596AA91228C49611E4A1C3BBE",
        "EVENT_TRACE_FLAG_E",
        "Tape - DST Medium",
        "ProductKeyHash",
        "{643B0017-1AAE-4AFA-B921-4BE3FB8308A2}",
        "MinimumPackageVersion",
        "TPCBCancel",
        "singleton",
        "The StartFileName input parameter is a string that names the child file/directory to use as a starting point for UncompressEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from the previous method call. If this parameter is NULL, the operation is performed on the file ordirectory specified in the ExecMethod call.",
        "The Delete method deletes a scheduled job.",
        "Boot configuration management.",
        "DOT11_WLANGPA",
        "Denotes the provisioning scheme of the virtual disk. ",
        "Maximum size (in bytes) of a single memory registration that the adapter can address.",
        "MSADDS.1 formatted output (W)",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_7E3FC52173BBB0BAC6E789BDD1BE5FCFF346F5F20489B64EB487016A0284A279",
        "IsConfiguredByWMI",
        "\\\\.\\root\\Microsoft\\Windows\\Storage:__Win32Provider.Name=\"iSCSIWMIv2\"",
        "The connection pool settings.",
        "StartDscReportingTimer",
        "Action",
        "Provides the ability to debug the application prelaunch of a specific application by triggering the prelaunch to occur and to exit debug mode for the application.",
        "SCSI II",
        "SIP Signaling",
        "The Name property indicates the name of the Win32 system account on the domain specified by the Domain member of this class.",
        "The CSDVersion property contains a null-terminated string, that indicates the latest Service Pack installed on the computer system. If no Service Pack is installed, the string is NULL. For computer systems running Windows 95, this property contains a null-terminated string that provides arbitrary additional information about the operating system./nExample: Service Pack 3.",
        "IL_1381AFED302C67D34DA20CE9AE190A6FF403DD395BB18D45FA87AB2B0CC50B0D.1064.1865296601.347",
        "Win32API|Device Context Functions|GetDeviceCaps|LOGPIXELSX",
        "MDM_Policy_Result01_DataProtection02",
        "%Account%",
        "Datacenter Server Edition",
        "Objects per second",
        "Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PageFaultCount",
        "New Task Offload Capabilities.",
        "{acf1403f-a61c-11d0-8dd4-00c04fc3358c}",
        "grant Type",
        "SystemConfig_Boot",
        "Mini-Jack",
        "Denotes the page number for which vendor data is requested.",
        "SamTraceVersion",
        "ChassisTypes",
        "object:__ntlmuser9x",
        "CIMTYPE",
        "bootSession",
        "This property indicates whether the times represented in the StartTime, TimeOfLastStateChange, and TimeSubmitted properties represent local times or UTC times. Time values are synchronized worldwide by using the enumeration value 2 - 'UTC Time'.",
        "HealthState",
        "Color matching should optimize for color contrast. This value ",
        "ref:CIM_StorageError",
        "GrantAccess",
        "ProfileSingleProcess",
        "NdisAtmMaxAal1PacketSize",
        "The PrimaryBusType property indicates the primary bus type of the motherboard.",
        "Win32Registry|SYSTEM\\CurrentControlSet\\control\\MediaResources\\wave|DeviceID",
        "If one changes the OverWriteOutDated property value to 0, the OverWritePolicy property value will be 'henNeeded' ",
        "C_25C2E8C327D4AE50AB0B89215561563C42973CDF72E4E8164880862FB1C155CC",
        "ImpersonationLevel",
        "AdditionalData",
        "Hint to help open documents with this file association",
        "GetInfoByName",
        "4 = This application is upgraded by the higher precedence application. ",
        "If the profile is a roaming profile, this property is a DATETIME value that indicates the last time an attempt was made to download the profile from the server, even if it was unsuccessful. If the profile is a local profile, this property is zero.",
        "Number of encryption types available.",
        "The TCP/IP port address of this port.",
        "MSFT_CliAlias.FriendlyName=\"QFE\"",
        "PolicySourceDefaultToClientPrinter indicates whether the property DefaultToClientPrinter is configured by Server (0),Group Policy (1), Default (2).",
        "RestrictedSitesZoneAllowMETAREFRESH",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2473.3607361720.188",
        "NumberOfAvailableCopies",
        "TEST_TRACE_TSTDRIVER Flag",
        "Target portal to use for connection to the target.",
        "Windows Server 2003, Communications Edition",
        "The ResourceType property identifies the type of resource to enumerate or connect to.",
        "Contains a string that represents the contents of the file. To create an empty file, the string must be empty. The contents will be written and compared using UTF-8 character encoding.",
        "A chassis can contain other packages, such as other chassis and cards. The CIM_PackageInChassis association makes explicit this relationship.",
        "Example: corpdns",
        "// This class must be registered using PDO instance names with a single instance",
        "LengthEachLogTypeDesc",
        "{2306fe2c-dbf6-11d2-9244-006008269001}",
        "If this flag is set, Windows will attempt to map certificates to domain accounts.",
        "NumericalPassword",
        "RestrictedSitesZoneEnableCrossSiteScriptingFilter",
        "HiveDirty",
        "SERIAL_WMI_INTTYPE_LEVEL",
        "54000",
        "UMS Events",
        "TREEUPDATE",
        "The RSOP_SOM class is an abstraction for a Scope of Management.  A scope of management can be a site, domain, organizational unit or local scope.",
        "Protect iSCSI",
        "Rename this rule.",
        "EnablePerProcessDpi",
        "Enterprise Server",
        "CIM_USBDevice.CurrentAlternateSettings",
        "ReturnToResourcePool",
        "tObject",
        "MDM_Policy_User_Result01_InternetExplorer02",
        "869b-4",
        "The check.",
        "NdisMedium",
        "C_5241CFC05A716A77CB0F36844F9A62538AED075865B9C000AF8A5A2832337841",
        "MI_ERRORCATEGORY_INVALID_OPERATION",
        "TRACE_RESERVED7",
        "fileiocompletion",
        "ref:CIM_CoolingDevice",
        "Specifies the type of the physical media, as an enumerated integer. The MediaDescription property is used to provide more explicit definition of the media type, whether it is pre-formatted, compatibility features, etc.",
        "Enable Compression",
        "41001",
        "The Name property indicates the path and file name of the page file./nExample: C:\\PAGEFILE.SYS",
        "Thu, 28 May 2026 15:30:41 GMT",
        "Example: PLEXTOR",
        "I_B4BE796E49BD940EF3233AA1E20E02F74C49D58803EFB7DC7A8BF19657D6854C.291.4294172468.274",
        "{4c7acd5c-b440-442a-8c85-9c09bc36ada8}",
        "PCI PME#",
        "Tape Data",
        "Enables or disables polling for failure prediction status",
        "Scsi Info Exceptions",
        "The HostingGroup specification defines the second component of the __Win32provider :: HostingModel whenthe hosting model is one of LocalSystemHost, LocalSystemHostOrSelfHost, NetworkServiceHost or LocalServiceHost.The hosting group defines a particular instantiation of a wmi provider host, providers that share the same hosting modeland hosting group share the same surrogate process.",
        "The Verbs array is the list of verbs supported for this alias.",
        "Bid2Etw_MSDASQL_1_Trace_TextW",
        "Run scheduled scans only if system is idle.",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSSESSIONDIRECTORY_Prov\"",
        "SupportsHotPlug",
        "NdisRingStateOpening",
        "RssProcessorArray",
        "C_C0C025C38981E58EE50CB7BB4E4786CBA14FD933E638861EA3A6A2E0C806211E",
        "MIB.IETF|HOST-RESOURCES-MIB.hrStorageAllocationUnits",
        "C:\\Windows\\System32\\drivers\\en-US\\processr.sys.mui[PROCESSORWMI]",
        "MDM_Policy_Config01_RemoteShell02",
        "Error code.",
        "Indicates that the device can be power managed - i.e. can be put into suspend mode, etc. ",
        "{7DA1385C-F8F5-414d-B9D0-02FCA090F1EC}",
        "TurnOnGdiDPIScalingForApps",
        "This property corresponds to CIM_PhysicalFrame.Version. See CIM_PhysicalFrame.Version for details.",
        "Degrees C",
        "ReadCount",
        "{981f2d7f-b1f3-11d0-8dd7-00c04fc3358c}",
        "CD_1556B1A5E87D4310C75D4BC7292B6D4E10E4ED4FFA6353E1CEFCF645DF12E488.2614.3861396044.546",
        "Vendor specific failure prediction data",
        "Win32_ShortcutAction",
        "SSA SCSI",
        "The current week in the current month (1-6)",
        "PolicySourceConfiguredLicenseServers indicates whether the license servers returned by GetSpecifiedLSList is configured by Server(0) or Group Policy (1).",
        "AllowInPrivate",
        "Debug_Process - If this flag is set, the calling process is treated as a debugger, and the new process is a process being debugged.  The system notifies the debugger of all debug events that occur in the process being debugged.  On Windows 95 and Windows 98 systems, this flag is not valid if the new process is a 16-bit application.",
        "{43FF3654-DB32-11d2-85FC-0000F8102E5F}",
        "{8a39d0c4-c412-4095-b882-7b16104516c6}",
        "CustomPackageId",
        "Qualifier for Mode of discovery",
        "Partition ID",
        "ObjectAccess_AuditRegistry",
        "{66902796-54f4-4e24-ad91-0ab3b1ad65af}",
        "File Kernel Trace; Volume To Log",
        "Guid that identifies this application.",
        "6 - 'Synchronizing': sync-in-progress. ",
        "**typedef** Authentication type used when establishing the connection.",
        "MCA_ERROR_CACHE",
        "C_5125E87B865F9C6DC59486D1BB02124F8523E09293ABB2126C845245277E44EE",
        "TierOptimize",
        "    ConnectionStatus (string) Specifies the connection status of the VPN connection profile. Available values: Connected, NotConnected, Connecting, Limited, Dormant",
        "0xD017",
        "0xD01F",
        "ValueRange",
        "ALPC Wait For New Message",
        "CR_B6A3DCDB97084B5AC4FE4FED6FDDF2AC8904E59EA78E2E887EC614E42011F697",
        "Indicates if IP checksum offload is currently enabled for IPv4 packets on this Adapter.",
        "ConfigurationID",
        "AddressIdentity",
        "The Win32_TokenGroups abstract class contains information about the group account security identifiers (SIDs) associated with an access token. For more information about token groups and the TOKEN_GROUPS structure, see the Access Tokens topic in the Platform SDK Access Control documentation.",
        "INDEXES",
        "WQL:Associators",
        "Maximum amount of inline data in bytes that can be sent in a single send or write request",
        "Total number of Read errors",
        "Logon Session Flag",
        "MSFT_TaskTrigger",
        "AllowOptionalContent",
        "{0C51B20C-F755-48a8-8123-BF6DA2ADC727}",
        "C_337863EF99B561BCCD899B7AFA2247DE6CE14F0D81601137B3F7CD2CFAE44723",
        "Directory Service (DS) flag indicating that the DomainName is in DNS format(for example, www.mynode.com or 135.5.33.19).",
        "0xD00A - 'Off': The element has not been turned on. ",
        "If L2TP is used, enforces supplying the Pre-Shared Key value over unsecure channel.",
        "The SNMP Community Name.  Must be specified if SNMP is enabled.",
        "The MaxBatteryError property indicates the difference between the highest estimated amount of energy left in the battery and the current amount reported by the battery.",
        "The ChangeStartMode method modifies the StartMode of a service. It returns an integer value of 0 if the service was successfully modified, 1 if the request is not supported, and any other number to indicate an error.",
        "0xEFFF0033",
        "The maximum time, in seconds, to wait for the network transport to be available if a user has a roaming user profile. If the network is unavailable after this time has elapsed, the user is logged on, but the profile is not synchronized.",
        "The storage subsystem is not registered.",
        "TwoSidedShortEdge",
        "MSFT_NetServiceStartFailed",
        "loggingStatus",
        "TLB probe instruction (probe, tpa)",
        "CD_DA3DC1260150EA9B0B2628C0C2AA81125377900B91EB681EA05BC31E6A7900FC.1144.1.16490",
        "AllowWindowsSpotlight",
        "A persistent binding request included a bad FCP Target Port WWN",
        "The Writeable property is a boolean value indicating if the file can be written.",
        "The uses for a RegisteredProfile or SubProfile MUST be specified in the document that defines the profile. Examples of Profiles are to manage various aspects of an Operating System, Storage Array, or Database. The name of the profile is defined and scoped by its authoring organization.",
        "On-access protection is enabled",
        "The PriorityClass property controls the priority class of the new process (used to determine the scheduling priorities of the threads in the process).  If the PriorityClass property is left null, the priority class defaults to Normal unless the priority class of the creating process is Idle or Below_Normal. In these cases, the child process receives the default priority class of the calling process. One of the following values can be specified:",
        "The IGMPLevel property indicates the extent to which the system supports IP multicast and participates in the Internet Group Management Protocol. At level 0, the system provides no multicast support. At level 1, the system may only send IP multicast packets. At level 2, the system may send IP multicast packets and fully participate in IGMP to receive multicast packets. Default: 2",
        "Optional parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h: ",
        "Management of system services that define execution dependencies. ",
        "Describes the DirectAccess connection substatus.",
        "Prefetchable",
        "The FeaturesLow property specifies the low-order 32 bits of the device features flag.",
        "Number of enabled cores per processor socket.",
        "Win32_ProductCheck",
        "BranchCacheServiceStartType",
        "A persistent binding remove reque",
        "The profile",
        "ActiveConnections",
        "A textual description of the object.",
        "Quarantine",
        "CIM_JobDestination is a logical element representing where a job is submitted for processing. It can refer to a queue that contains zero or more jobs, such as a print queue containing print jobs. job destinations are hosted on systems, similar to the way that services are hosted on systems.",
        "Network adapter administrative status, as described in RFC 2863.",
        "SupportsConnectData",
        "GroupFeatures",
        "NdisMaximumLookahead",
        "SDBUS_DEBUG_DEVCFG Flag",
        "CmdletOutput",
        "The MTU property overrides the default Maximum Transmission Unit (MTU) for a network interface. The MTU is the maximum packet size (including the transport header) that the transport will transmit over the underlying network. ",
        "DiagnoseResults",
        "Linux",
        "Targets allocated from Multiple storage pools",
        "Indicates whether this physical disk is partially consumed by a system or service whose use is outside of normal storage pool operations.",
        "Total number of resources in configuration.",
        "{A5B32DDD-7F39-4abc-B892-900E43B59EBB}",
        "Win32API|Power Management Events",
        "A short textual description (one-line string) of the CIM_Setting object.",
        "IPv6ReceiveEncapsulation",
        "GetTStoLSConnectivityStatus",
        "If set to true: control attribute caching is enabled. If set to false: control attribute caching is disabled.",
        "channels",
        "MaxRegistrationSize",
        "SMBIOS|Type 16|Use",
        "object:ISCSI_IP_Address",
        "Flags.",
        "{c2ba06e2-f7ce-44aa-9e7e-62652cdefe97}",
        "MSFT_StorageSite",
        "SamGetDisplayEnumIdx",
        "CD_199B86443F24E0A1E6BF357315CA9CBEAD82F24D15E6EF0C429DB46E1456E291.1977.4192482770.645",
        "IR_7E686F9D61EDF11086E78252FCD41558F7EFA25ADD316FFADF03AEA3869D1C7A",
        "Informational Flag",
        "t#spM",
        "The PossibleValues property enumerates the string outputs that can be output by the discrete sensor.",
        "C Bus",
        "DNS configuration for VPN triggering.",
        "The power supply that is associated to the power supply profile in ConformantStandard.",
        "ID_IPV6_ADDR",
        "{8feae2c6-ee28-469f-8b5d-9f743bab21aa}",
        "object:Win32_ProcessStartup",
        "Sets the volume attributes",
        "SupportContactDescription",
        "TRACINGAPIERROR Flag",
        "Id of the storage enclosure containing this physical disk",
        "msdadiag",
        "System failure: Try changing the driver for this device. If that doesn't work, see your hardware documentation.",
        "LoadedKeyCount",
        "Heap Free",
        "The number of bytes of disk space reserved if the associated software element is installed to run locally.",
        "RedundancyStatus provides information on the state of the redundancy group. \"Fully Redundant\" (value=2) means that all of the configured redundancy is still available; \"Degraded Redundancy\" (3) means that some failures have been experienced but some reduced amount of redundancy is still available; \"Redundancy Lost\" (4) means that a sufficient number of failures have been experienced such that no redundancy is available and the next failure experienced will cause overall failure. Also, the values, \"Other\" (1) and \"Unknown\" (0), are defined.",
        "{fb6a424f-b5d6-4329-b9d5-a975b3a93ead}",
        "The PrimaryAddressResolutionStatus property holds status information resulting from the gethostbyname call.  This property reports the status of the resolution of the address value (ie value of the address property) given in the query. It is not related to any other resolution performed. ",
        "R_79FD2B1944A0E8569231538101AA02032B2AA1FD92C317847D2089CA52F4CD72",
        "SEL_SENSOR_TYPE",
        "The operation is not allowed on a system or critical partition.",
        "I_B40FE5BB7D3AAD0C5E26212696A1B37175024D4725396AA1CD7AE0B640ED7993.1580.325098574.265",
        "TRACE_CLASS_MAPPING",
        "Enables or disables file hash computation feature.",
        "{0F73ED52-8ED9-11d2-B340-00105A1F8569}",
        "The User that submitted the Job, or the Service or method name that caused the job to be created.",
        "CommittedSize",
        "Namespace in which to evaluate query",
        "Indicates the number associated with the firmware slot",
        "FileIo_V2_DirEnum",
        "MSFT_NetBranchCacheHashCache",
        "object:DnsClientNrptRule",
        "autoDetectConfigSettings",
        "SMBIOS|Type 17|Configured Memory Clock Speed",
        "The code set used by this software element. ",
        "REDBOOK_WMI_CDDA_ACCURATE",
        "DownloadModeProvider",
        "EnableSMB2Protocol",
        "Indexed",
        "AllowStorageSenseGlobal",
        "0xC0000026",
        "NDISWMI_TRACE_NETCFG",
        "Spare Disk",
        "TRACINGIO",
        "ScheduleScanDay",
        "Example: Fast EtherLink XL",
        "Main System Chassis",
        "OperationalStatusDownDefaultPortNotAuthenticated",
        "A text string set by the manufacturer describing the Asic version",
        "HOSTPROC_TRACE_DISPATCHER Flag",
        "select * from MSFT_DASettingsIndication",
        "GptType",
        "TRACE_CLASS_TIMER",
        "Query Receive Filter Current capabilities",
        "The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. Operational statuses are \"OK\", \"Degraded\" and \"Pred Fail\". \"Pred Fail\" indicates that an element may be functioning properly but predicting a failure in the near future. An example is a SMART-enabled hard drive. Non-operational statuses can also be specified. These are \"Error\", \"Starting\", \"Stopping\" and \"Service\". The latter, \"Service\", could apply during mirror-resilvering of a disk, reload of a user permissions list, or other administrative work. Not all such work is on-line, yet the managed element is neither \"OK\" nor in one of the other states.",
        "MSFT_PhysicalDisk",
        "dialExtraPercent",
        "The QueryId property holds a Windows Management-generated identifier for the query. The provider can track this so that during a later cancellation it will know which query was canceled.",
        "Win32_MappedLogicalDisk",
        "MSFT_NetAdapter_QosCapabilities",
        "Read/Write",
        "43033",
        "Options",
        "27     This device does not have valid log configuration. ",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_BCA765E446D9097DBEA6C9E4DFDE858DC64A1737FEE09A95AB480242FE45EE06",
        "RestrictedSitesZoneLogonOptions",
        "Roles",
        "FullScanAndOfflineScanRequired",
        "0x8000",
        "A string describing the data structure of the information in the property, RecordData. If the RecordFormat string is <empty>, RecordData should be interpreted as a free-form string. ",
        "ACTIVITYID Flag",
        "TEST_TRACE_RESERVED_08 Flag",
        "MIB.IETF|Printer-MIB.prtLocalizationLanguage",
        "One tick",
        "Indicates the highest version of LSO supported by the Adapter.",
        "Minifilter IO Failure",
        "{3b9e3da4-70b8-46d3-9ef2-3ddf128bded8}",
        "Target element requires resource pool reserved for replication",
        "CD_BBA26CEBD94E02C63A4812F98BAF8B828E20477373D54CAFB6CE9D30D952E46C.2428.1.48955",
        "The InfFileName property indicates the name of the .inf file for the Win32 pointing device.",
        "ROOT\\cimv2\\TerminalServices",
        "bits/sec",
        "Replaceable",
        "The LogonServer property contains the name of the server to which logon requests are sent.  Server names should be preceded by two backslashes (\\\\). A server name with an asterisk (\\\\*) indicates that the logon request can be handled by any logon server. A null string indicates that requests are sent to the domain controller. ",
        "TREEUPDATE Flag",
        "MSFT_CliAlias.FriendlyName=\"SystemSlot\"",
        "DEPRECATED. The AllUsers input parameter has been deprecated as the functionality implied is not supported. The operation will effect all users on the machine.  ",
        "LetAppsAccessNotifications",
        "cFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "PerJobUserTimeLimit",
        "DoNotAllowActiveXControlsInProtectedMode",
        "ErrorMethodology is a free-form string describing the type(s) of error detection and correction supported by this device.",
        "RemoveRunThisTimeButtonForOutdatedActiveXControls",
        "ColorDepth",
        "TcpUseRFC1122UrgentPointer",
        "CD_97E0533A6FD37D7B4F42C138D3F910EF7AFF6D78F1A820A11C33EF12521B5B2B.1252.1.27027",
        "IrpStackSize",
        "FADT C2 latency in microseconds",
        "object:ProcessorAcpiTss",
        "Move the contents of local <folder> to the new location. This will copy the redirected folder data into the local UNC location. Then this content will be synced with the server share content. Effectively, moving the content from the local location to the share",
        "Time that the process was stopped or terminated.",
        "The UnjoinDomainOrWorkgroup method un-joins or removes a computer system from a domain or workgroup.  This method is only available on Windows 2000 platforms and beyond. The method can return the following values:/n0 - Success./nOther - For integer values other than those listed above, refer to Win32 error code documentation./nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. ",
        "    3. Page Combining",
        "l3m;l3m;",
        "TRACE_LEVEL_ENTER_EXIT",
        "Portal Port",
        "AntimalwareInfectionStatus",
        "ProtocolIFType\\'s enumeration is limited to IP-related and reserved values for this subclass of ProtocolEndpoint.",
        "Boolean that indicates that the port is operating in full duplex mode.",
        "True if scripting is enabled for the Internet security zone",
        "CD_9AB73F8DA60B37A5DAD8EB945BB4F0C79687E3F0DF399D6BD50EEB5E9D647763.2560.418760564.1452",
        "NdisAtmMaxActiveVpiBits",
        "0xC0000008",
        "GetMetaConfiguration",
        "DisableSearchProviderChange",
        "CR_0AFC43F6F954497AA8887334BB937F82532036AD13DD27C64055852F3060BED7",
        "SendRPS",
        "{3927843b-6980-4b48-b15b-4de50977ac40}",
        "The InfSection property indicates the section of the .inf file that holds configuration information for the Win32 pointing device.",
        "{2F648FBA-DB22-11d2-85FC-0000F8102E5F}",
        "This property contains a thumb print of the certificate for this authority",
        "hangUpExtraSampleSeconds",
        "The status of this job.",
        "MachineMethod",
        "RSOP_PolmkrNetShareSetting",
        "C_B6A3DCDB97084B5AC4FE4FED6FDDF2AC8904E59EA78E2E887EC614E42011F697",
        "CreateVirtualPortExUsingDHCHAP",
        "C_DA629F0FADBF1E9D6C65713F31978C9EA30680E880B4ED8EDE3DC7BD5AFDAA23",
        "Joy Stick Port",
        "41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "NS_59411655A8F95EE7BEABDFB898861DFA8E2BF23293A8AFE96B2E5BB236E7FE01\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_E00AA51439CFEF2CB1C8968598F9EDCB88E110D118FD610991FA2919E478D23F",
        "802.11a",
        "{F8F3EA26-AB2C-4593-8B84-C56428E6BEDB}",
        "Association between InitiatorPort and iSCSITarget",
        "Power Cycling Supported",
        "CIM_IKEProposal.OtherHashAlgorithm",
        "C_8753AFFD6FF7988B6BD5723778343D3CBE2068B8054CFA332AC07BDAA246DC64",
        "QuotaRetryCount",
        "Similar to the way that logical devices are 'Realized' by physical elements, unitary computer systems are realized in one or more physical packages. The CIM_ComputerSystemPackage association explicitly defines this relationship.",
        "C_08958AE641D88CDE3333B847D49BEA2D42C946BF3924FE9A6259F27FADF6495E",
        "ecified in the call to set Load Balance Policy is not valid.",
        "A free-form string describing the LogRecord's data structure.",
        "The PartOfDomain property indicates whether the computer is part of a domain or workgroup.  If TRUE, the computer is part of a domain.  If FALSE, the computer is part of a workgroup.  If NULL, the computer is not part of a network group, or is unknown.",
        "The DuplicateFileAction allows the author to make one or more duplicate copies of files installed by the InstallFiles executable action, either to a different directory than the original file, or to the same directory, but with a different name.",
        "The UniqueId of the replica peer within the replica's storage subsystem.",
        "The maximum number of bytes which can be sent within a single sequence of Data-In or Data-Out PDUs",
        "IndirectionTable",
        "CD_EFBE1C465A2F3406BAA068078725F0502A25A1F712603161F9A1B1D445463141.1589.2009271668.1053",
        "LetAppsAccessCallHistory_ForceAllowTheseApps",
        "IsSelected",
        "SignatureScheduleTime",
        "IpV4 Address",
        "A system set description of the capabilities of the resiliency setting, including (but not limited to) when a setting should be used, its strengths and drawbacks, performance information, and any other information that the vendor feels is helpful to the user. ",
        "cpp_quote",
        "Subclasses of CIM_PhysicalElement define any component of a system that has a distinct physical identity. Instances of this class can be defined in terms of labels that can be physically attached to the object. All processes, files, and logical devices are considered not to be physical elements. For example, it is not possible to attach a label to a modem. It is only possible to attach a label to the card that implements the modem. The same card could also implement a LAN  adapter. These are tangible managed system elements (usually actual hardware items) that have a physical manifestation of some sort. A managed system element is not necessarily a discrete component. For example, it is possible for a single card (which is a type of physical element) to host more than one logical device. The card would be represented by a single physical element associated with multiple logical devices.",
        "Vendor",
        "ROOT\\standardcimv2",
        "ParameterName",
        "Create a virtual disk using the largest supported size. This parameter cannot be used with the Size parameter.",
        "LookupNames_Start",
        "object:MSFT_ReplicationSettings",
        "TcpIp_TypeGroup2",
        "NewDllLoad",
        "MDM_VPNv2_Sso03",
        "Path to the file system, i.e. sysvol part of the GPO.",
        "ExternalMetadataLocation",
        "ConfigurationChanged",
        "Generates Installation ID for AD forest activation using the specified product-key ",
        "ManufacturerModelName",
        "INCITS",
        "Example: Draft",
        "Win32_PnPDevicePropertyBoolean",
        "LookupSids_Start",
        "p+m;p+m;",
        "TM_IPPC Flag",
        "C_F3ED82F33431603D84B59AD5C9C4CA59DF4FDC6F04E98BD4826D692A26D5A5C0",
        "A value of 5 \"No Change\" shall indicate that no transition is in progress.A value of 12 \"Not Applicable\" shall indicate the implementation does not support representing ongoing transitions. ",
        "CIM_NumericSensor.UpperThresholdFatal",
        "importSecurityZoneSettings",
        "The time that the current Job is scheduled to start. This time can be represented by the actual date and time, or an interval relative to the time that this property is requested. A value of all zeroes indicates that the Job is already executing. The property is deprecated in lieu of the more expressive scheduling properties, RunMonth, RunDay, RunDayOfWeek, and RunStartInterval.",
        "Used to determine detailed enrollment request error if Status is EnrollError",
        "The DitherType property indicates the dither type of the display. This property can assume predefined values of 1 to 5, or driver-defined values from 6 to 256. Line art dithering is a special dithering method that produces well-defined borders between black, white, and gray scalings. It is not suitable for images that include continuous graduations in intensity and hue (such as scanned photographs).  ",
        "IsInformationalSession",
        "WSP_StorageFaultEvent",
        "Synchronous Mirror Local",
        "The VerticalResolution property indicates the print resolution along the Y axis (height) of the print job. ",
        "SupportedUsages",
        "WD_LOG_FLAG_CONNECTION Flag",
        "LunCount",
        "CIM_BindsTo",
        "PCI-X Mode conventional PCI",
        "msgStr",
        "ProviderOperation_DeleteClassAsync",
        "The name of the ODBC driver for this DSN.",
        "Indicates if Distributed Caching is enabled",
        "Win32API|Process and Thread Functions|TerminateProcess",
        "Larger buffer required ",
        "SystemConfig_V2_OpticalMedia",
        "DeferUpdatePeriod",
        "CATV Upstream Channel",
        "LPCDRVR_TRACE_FUNCTION",
        "LPCDRVR_TRACE_RESERVED_11",
        "MCA_WARNING_PCI_DEVICE",
        "Current overwrite policy the Windows NT/Windows 2000 Event Log service employs for this log file. The possible values of the property are: ",
        "ref:Service",
        "Qpc Offset From Root",
        "NumericSensor",
        "BiosMinorRelease",
        "AllowDiscoverableMode",
        "The ReportSetMarks property specifies whether setmark reporting is enabled. ",
        "SetPrimaryLicenseServer",
        "CD_29E8AA5244375C87F1F5AB9F42A22D9A1B648F420047277D7A92CD564C59256E.34.2742257452.636",
        "The ID of the VPort.",
        "DisabledObject",
        "nE083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "The FileSystemFlagsEx property indicates the file system flags associated with the Win32 CD-ROM drive. This parameter can be any combination of flags. FS_FILE_COMPRESSION and FS_VOL_IS_COMPRESSED are mutually exclusive.",
        "HostType",
        "The Win32_ShadowProvider class represents a component, typically a combination of user-mode and kernel/firmware implementation, that will perform the work involved in creating and representing volume shadow copies",
        " whether the flat panel supports color display.",
        "The CIM_Chassis class represents the physical elements that enclose other elements and provide definable functionality, such as a desktop, processing node, UPS, disk or tape storage, or a combination of these.",
        "CD_46AA6DB53AC46BAA33853977D7E4DA4D42054013D01A0E1C7E44D0593EAD8697.1982.947412126.1813",
        "Renaming a computer can be performed only by a member of the Administrators local group on the computer. You cannot call this Rename function remotely for domain computers. /nPassword and Username must use a high authentication level (i.e. no less than RPC",
        "ModifyListSettingsDefineState",
        "B72992879F6DC823F6267C256838F35D96B57836E37CB0558435E32B2B16111B",
        "SMBIOS|Type 23|Capabilities|Boot Option",
        "MSFT_NetConSecRuleFilters",
        "The integrity algorithm for the second operation",
        "RFC822",
        "PreferredProfile",
        "Published - Indicates whether the printer is published in the network directory service.",
        "SamAddMemToAlias_End",
        "Boot ROM",
        "The type of specification.",
        "HeapHandle",
        "READCACHE",
        "NotUserRemovable",
        "ForceOnFeedback",
        "The GroupComponent reference represents the Win32_Directory that contains the properties of the parent directory (folder) in this association.",
        " Licensing Mode",
        "Program settings object for the IE browser, used for IEAK RSoP.",
        "CurrentClockSpeed",
        "Heap Event",
        "Ntfs_NtfsLog",
        "RegisteredLSList",
        "IL_66796251E5D0B06708BBA28B2F0C8A38E56DC5083BFF260568BAD57F3AAC7FBA.311.2942916013.249",
        "MSFT_NetEventVFPProvider",
        "CurrentReading",
        "Returns mechanism used to read failure prediction status ",
        "R_513CDE95079518F112965AA406F17722C0A89A191927E09A325D3D3202159331",
        "FUNC_TRACE Flag",
        "The ObjectPath property holds a string containing the object path of the object for which the method is to be executed.",
        "A physical package is removable if it is designed to be taken in and out of the physical container in which it is normally found, without impairing the function of the overall packaging. A package can still be removable if power must be 'off' in order to perform the removal. If power can be 'on' and the package removed, then the element is removable and can be hot swapped. For example, an extra battery in a laptop is removable, as is a disk drive package inserted using SCA connectors. However, the latter can be hot swapped.  A laptop's display is not removable, nor is a non-redundant power supply.  Removing these components would impact the function of the overall packaging or is impossible due to the tight integration of the package.",
        "SystemConfig_V1_LogDisk",
        "CD_9AB53806E88665C047824D5369B271C53B233BBEAC7C15BE3BA9BD214E527500.201.4204543249.413",
        "Sensor",
        "The Win32_CIMLogicalDeviceCIMDataFile class represents an association between logical devices and data files, indicating the driver files used by the device. This class is used to discover which device drivers a device uses.",
        "Whether to enable Memory Compression. Memory compression is a Windows feature which compresses unused memory to keep more data resident in RAM. It also reduces the amount of data written to and read from the pagefile, thus improving performance.",
        "CIM_NumericSensor.Accuracy",
        "PoolSnapDCEnd",
        "Represents the duplexing mode of the printer.",
        "SEL_EVENT_DATA2 is valid",
        "Microsoft-Windows-Remote-FileSystem-Monitor",
        "The CompressionMethod property is a free form string indicating the algorithm or tool used to compress the logical file. If it is not possible (or not desired) to describe the compression scheme (perhaps because it is not known), use the following words: \"Unknown\" to represent that it is not known whether the logical file is compressed or not, \"Compressed\" to represent that the file is compressed but either its compression scheme is not known or not disclosed, and \"Not Compressed\" to represent that the logical file is not compressed.",
        "SECHC_LOG_FLAG_STATE Flag",
        "SamConnect",
        "CIM_HostedAccessPoint",
        "SBP2 Port Driver Tracing Provider",
        "DnsSecIPsecCARestriction",
        "CIM_LANSegment.LANType",
        "Action Path",
        "C_D64B12C2A619E8EC9F45DCE9E49A35E068B0A85B0C1FC30DB6BB343CD56AC3E2",
        "CD_25A225BFD7C0706940B21958E1B4E7879B81C1069B2DA72D3945C2F2A653CB92.27.69741701.381",
        "PowerOnPasswordStatus",
        "Itanium(TM) Processor",
        "0xC005007E",
        "DownloadRates",
        "SPACES_StorageNodeToPhysicalDisk",
        "The driver-specific version of this driver.",
        "The Option input parameter specifies the actual security privilege to be modified. Change_Owner_Security_Information - Change the owner of the logical file. Change_Group_Security_Information - Change the group of the logical file. Change_Dacl_Security_Information - Change the Access Control List of the logical file. Change_Sacl_Security_Information - Change the System Access Control List of the logical file.",
        "Returns the VpnConnection object that contains the VpnConnection configuration settings",
        "Underlying RDMA technology.",
        "0xEFFF0023",
        "MSFT_StorageFaultDomain",
        "{b67c0b5e-c0ff-41c6-885d-5bdcd71837aa}",
        "LockedDownTrustedSitesZoneAllowSmartScreenIE",
        "Example: MainProf",
        "6 - 'Critical': Immediate action is needed and the scope of the issue is broad. ",
        "B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D",
        "TcpMaxConnectRetransmissions",
        "CD_8C387D212D52C17AB84A1800318321139D190C8ACE84173AF79A5939FE8790CA.1930.760267666.1051",
        "ScanNotificationsValue",
        "The BusinessCategory property may be used to describe the kind of business activity performed by the members of the group.",
        "See CIM_Processor.CurrentClockSpeed for details.",
        "Reserved0",
        "The Kerberos proxy server to use when authenticating remotely.",
        "Namespace",
        "The LimitFlags property indicates the limits that are in effect. One or more of the following limits can be in effect: ",
        "TRACELEVELTWO Flag",
        "Indicates the USB class code.",
        "Bi-Directional",
        "The AdapterType property reflects the network medium in use. This property may not be applicable to all types of network adapters listed within this class. Windows NT only.",
        "5 data bits",
        "Scsi Address",
        "Win32_PowerPlan",
        "CIM|CIM_Setting",
        "FSAN 622Mb PON",
        "Disable archive scanning.",
        "The BootROMSupported property determines whether a boot ROM is supported.",
        "The SID property contains the security identifier (SID) for this account. ",
        "FileSizeOnDesiredStorageTierClass",
        "\\\\.\\root\\Microsoft\\UEV:__Win32Provider.Name=\"UserConfigurationProvider\"",
        "Win32Registry|Software\\Microsoft\\WBEM|MOF Self-Install Directory",
        "The maximum lifetime for a Quick-Mode SA before it must be rekeyed, in kilobytes.",
        "MIF.DMTF|System Slot|004.3",
        "CIM_FileSystem.CSCreationClassName",
        "Entry Type",
        "Assert",
        "Anonymous",
        "The SetForwardBufferMemory method is used to specify how much memory IP allocates to store packet data in the router packet queue. When this buffer space is filled, the router begins discarding packets at random from its queue. Packet queue data buffers are 256 bytes in length, so the value of this parameter should be a multiple of 256. Multiple buffers are chained together for larger packets. The IP header for a packet is stored separately. This parameter is ignored and no buffers are allocated if the IP router is not enabled. The buffer size can range from the network MTU to the a value smaller than 0xFFFFFFFF. Default: 74240 (fifty 1480-byte packets, rounded to a multiple of 256).",
        "SidTypeComputer - Indicates a SID for a computer.",
        "AutoRestartRequiredNotificationDismissal",
        "0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109",
        "The object type of this replica peer.",
        "The chassis that contains other physical packages.",
        "SDBUS_DEBUG_TRANSFER",
        "Management of common adapter devices built into the motherboard (system board).",
        "{0E5ACD14-DB33-11d2-85FC-0000F8102E5F}",
        "{F31AA484-82E6-4159-9DBB-7DE30196F75F}",
        "MSFT_NetAdapterLargeSendOffloadV1Capabilities",
        "MDM_Policy_Config01_Experience02",
        "DS_LDAP_Instance_Containment",
        "This property corresponds to CIM_PowerAllocationSettingData.Limit. See CIM_PowerAllocationSettingData.Limit for details.",
        "40019",
        "The product code for the product to which this patch package is applied.",
        "Enabled (2) indicates that the element is or could be executing commands, will process any queued commands, and queues new requests. ",
        "00000000020000.000000:000 ",
        "Protection technology name",
        "Specifies the disk allocation unit size or cluster size. All file systems used by this version of Windows organize your hard disk based on cluster size, which represents the smallest amount of disk space that can be allocated to hold a file. The smaller the cluster size you use, the more efficiently your disk stores information. If no cluster size is specified during format, Windows",
        "HNet_ConnectionAutoconfig",
        "The SDDL representation of the permissions set on this printer.",
        "Insufficient storage available",
        "<B>Note:</B> The value may not be exact for removable drives if currently there is no media in the drive.",
        "TransactionFlowOption",
        "LookaheadSize",
        "SupportsLoopbackConnections",
        "Applies only when Protocol is TCP or UDP.  Remote ports this filter applies to.  May be a number or range 0-65535, or one of the following: Any, IPHTTPSOut.",
        "I_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258.1164.198150230.271",
        "Specifies the fault domain awareness that should be used when determining the supported sizes. Note that the sizes returned may be different depending on the fault domain awareness.",
        "Do Until Success",
        "\"Completed\" indicates that the element has completed its operation. This value should be combined with either OK, Error, or Degraded in the PrimaryStatus so that a client can tell if the complete operation Completed with OK (passed), Completed w3",
        "Specifies the paper type that the Printer is currently using. The string should be expressed in the form specified by ISO/IEC 10175 Document Printing Application (DPA) which is also summarized in Appendix C of RFC 1759 (Printer MIB).",
        "LetAppsAccessCallHistory",
        "Indicates whether the profile is active or not",
        "MIF.DMTF|UPS Battery|001.4",
        "Database Inconsistency",
        "Monitor does NOT expect a blank-to-blank setup or pedestal per appropriate Signal Level Standard",
        "{E989AF08-2217-4d67-8E20-282594606E80}",
        "SMBIOSAssetTag",
        "WmiQueryReceiveFilterCurrentCapabilities",
        "KeyCreate",
        "MethodHeader",
        "XAEndpointCid",
        "NS_E1DD43413ED9FD9C458D2051F082D1D739399B29035B455F09073926E5ED9870\\KI_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170\\I_8E80D45658E49966FC3BA567F2C75690AE48EBAB9A2568429675180214107ACE",
        "WD_LOG_FLAG_EVENT",
        "WmiScale",
        "MSRedbook_Performance",
        "2 = Client Side Extension logged could not log data, data might be incomplete, ",
        "C_C32DF9F947B29FF4184A098E1939B4BC6F452D2B88C38983D24946818DE6DD9B",
        "97 - Interface not configurable",
        "CD_700A223C2BE9D4D6498C555306C3D6D2A20F7ED7C0635EDD45F157ECA54B627F.1667.4070860710.232",
        "ScsiStatus",
        "initializers",
        "IL_21E85A20CC15E835CB6487F54DC9B230DDD677D1A3F958EEE3ACBA0DE0846B34.1500.370985859.312",
        "CIM_Privilege.QualifierFormats",
        "CD_896B6F9A9E07C666B49D000879A54E67F9CE0EAF2B8B7EF7BCA31E7303EC222A.2033.897841472.2646",
        "10.0.19041.1",
        "CD_FA5F0CACE5010B22488E1F75B605E9518F7EAD5CC9CA9A11556B5DD22F5A4687.1562.2471414630.425",
        "MaxInactivityTimeDeviceLock",
        "%OldStartType%",
        "Drain notification is supported on any PD queue.",
        "DataDigest",
        "Specifies a single DNS suffix.",
        "The Workgroup property contains the name of the workgroup.  This value is only valid if the PartOfDomain property is FALSE.",
        "SDBUS_DEBUG_SDRESP Flag",
        "ReferencedDomainName",
        "ParaId",
        "Computer System Class Name",
        "ActivateConsistency",
        "Protected through SCC (SCSI-3 Controller Command)",
        "The host address of the tcp port.",
        "PrivilegesToDelete",
        "GetRedirectableAddresses",
        "MDM_AppLocker_ApplicationLaunchRestrictions01_StoreApps03",
        "WPDNSE_REFCOUNT Flag",
        "I_BCDF0AE7DC27FAFED7F3086084877E579AF9D73C546674217B8E86B2518960DB.276.1212514244.319",
        "0xC0050041",
        "MSDADIAG.ETW",
        "Win32_UserProfile",
        "The cleaning action - Enumeration",
        "Proxy settings of the VPN connection.",
        "Not compliant",
        "CIM::IPsecPolicy",
        "Monitor's digital video input parameters",
        "PAL I",
        "This property indicates the availability of the FRU Information on this physical computer system. See CIM_PhysicalAssetCapabilities.FRUInfoSupported for details.",
        "NodeIdDataFormat",
        "This method adds a virtual disk to the masking set, allowing it to be shown to the initiators contained in the set.",
        "The event record number in the original event log",
        "WSManAutoError Flag",
        "If the specified size is smaller than the original size, this method will move files so that they are as close as possible to the beginning of the partition, in order to consolidate free space at the end of the partition. It then truncates the file system volume, reducing its size, and then truncates the partition.",
        "Indicates if BranchCache hosted cache server is enabled",
        "DNS Client Name Resolution Policy Table Entry",
        "HibernateTimeoutOnBattery",
        "IpIPv4Enabled",
        "Win32API|System Information Structures|OSVERSIONINFOEX|wServicePackMajor",
        "3 - The user does not have sufficient privilge.",
        "__TimerInstruction",
        "GCW profile management class",
        "TEST_TRACE_APP",
        "The QuantumLength property defines the number of clock ticks per quantum. A quantum is a unit of execution time that the scheduler is allowed to give to an application before switching to other applications. When a thread runs one quantum, the kernel preempts it and moves it to the end of a queue for applications with equal priorities. The actual length of a thread's quantum varies across different Windows platforms. For Windows NT/Windows 2000 only.",
        "The principal unicast address used in communication with the LANEndpoint. The MAC address is formatted as twelve hexadecimal digits (e.g., \"010203040506\"), with each pair representing one of the six octets of the MAC address in \"canonical\" bit order according to RFC 2469.",
        "CD_983B4451C80CBF8C28AA7D3AE44B31F386CD9D49DCF52E720114DECC8C984041.2527.534896237.506",
        "Audit Flag",
        "GroupMask4",
        " A Microsoft Win32",
        "For a Main Mode or Connection Security rule, sets parameters for the main mode negotiation and describes the crypto proposals that should be negotiated.",
        "NormalMax provides guidance for the user as to the normal maximum range for the NumericSensor.",
        "{8502C4CD-5FBB-11D2-AAC1-006008C78BC7}",
        "SerrationOfVsyncRequired",
        "WMPNsCfgGuid",
        "CIM_OperatingSystem.TotalSwapSpaceSize",
        "Anycast",
        "Username for iSCSI authentication",
        "NextRunTime",
        "The name of the server the printer resides on.",
        "Get the number of reliability records",
        "This association makes explicit the dependency of a SAP or ProtocolEndpoint on an underlying LANEndpoint, on the same system.",
        "{8502C552-5FBB-11D2-AAC1-006008C78BC7}",
        "CD_9E9C09D30F7B6C1C4DDFBE795ADB6A836F2310F7AF7CD6B6BA1E05BFB3CEFE19.1151.2445984221.1676",
        "PStateHandler",
        "Maximum iSCSI Version",
        "MaximumFileNameLength",
        "EventTrace_V0_Header",
        "7 - 'Copy-On-Access': Affected data is copied on the first access to the source element. ",
        "{8e598056-8993-11d2-819e-0000f875a064}",
        "Indicates the maximum number of masking sets that a particular virtual disk can be added to.",
        "#define ISCSI_SECURITY_FLAG_VALID                    0x00000001                ",
        "ADEC14586C.1926.827264054.1014",
        "PLATFORM_TRACE_RESERVED_0e Flag",
        "The Win32_NTLogEventLog class represents an association between an NT log event and the log file that contains the event.",
        "MSIXTableEntry",
        "KerberosClientSupportsClaimsCompoundArmor",
        "The Status property is a string indicating the current status of the object. ",
        "SMBIOS|Type 24|Hardware Security Settings|PowerOnPasswordStatus",
        "Sharing violation",
        "A physical component can be hot swapped if it is possible to replace the element with a physically different but equivalent one while the containing package has power applied to it (i.e., is 'on'). ",
        "Electro Luminescent Display",
        "The StopFileName output parameter is a string representing the name of the file/directory where TakeOwnerShipEx method failed. StopFileName parameter will be null if the method succeeds.",
        "RelayState",
        "IconSpacing",
        "ConditionListType",
        "FontTitle",
        "Default value for recovery point",
        "Represents a printer driver",
        "Name is a semi-unique (scoped to the owning file server), human-readable string used to access and identify a file share.",
        "EnableAutoUnlock",
        "TRACINGREQUEST Flag",
        "PolicySourceMinEncryptionLevel indicates whether the property MinEncryptionLevel is configured by Server (0),Group Policy (1).",
        "46002",
        "ISDN U Interface",
        "OwnerAuthStatus",
        "M2 Family",
        "2C1FABC8728F9E076F6727DBB7BA1358C4F010407356DEB983BF769E41D5848D",
        "RedundantFirmwareVersion",
        "The ShareName property indicates the share name of the Win32 printing device.",
        "If the device is partitionable, the partition number of the device. Otherwise -1",
        "GuaranteeEncryption",
        "DependentFiles",
        "New Processor Performance States Event",
        "LprHostAddress",
        "Values: TRUE or FALSE.  If TRUE, the error is correctable.",
        "Failed Media",
        "TcpIPv6HashEnabled",
        "LoaderCodedEvent",
        "//  Purpose: Header defining interface between user mode configuration",
        "The minimum bandwidth weight action. Set to 0 if not used.",
        "Get the configuration status history.",
        "Enable/Disable the DNS Publishing on a KMS host computer: 0=Enable, 1=Disable.",
        "Provider ID",
        "IPConnectionMetric",
        "object:MSFT_StorageExten",
        "DestinationDirectory",
        "The number of print-stream pages that the Printer will render onto a single media sheet unless a Job specifies otherwise.",
        "21 - The specified parameter is invalid.",
        "Security Credential Mismatch",
        "msieee80211PolicyData",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|FlowControl_Soft",
        "ARRAY OF UINT16",
        "4 - 'Retired': This physical disk should be retired from use. At a minimum, no new allocations should go to this disk. If the virtual disks that reside on this disk are repaired, the data should be moved to another active physical disk.",
        "EntryType",
        "OtherEnabledState",
        "R_F38B416C06E01116C4C7FDB33809E7349A9BD3A1DDD8A08F3E2B66387C9FA2E2.1356.1637245121.590",
        "The Msft_WmiProvider_PutClassAsyncEvent_Post event class represents an event generated immediately following completion of the provider's implementation of IWbemServices :: PutClassAsync.",
        "DOT11_SEND Flag",
        "Frame Relay Interconnect",
        "e used when creating new virtual disks unless overridden.",
        "AutoTuningLevelEffective",
        "length",
        "MSNdis_WmiTcpLargeSendOffloadV1",
        "Tape Problem Event",
        "The description for the default value of the parameter.",
        "SourceMACAddresses",
        "PNP_REGISTRY_VERBOSE_LEVEL Flag",
        "DisplayParameterType",
        "CD_EFC301AD50CF7400DE3E25D8E0D5A8D1B7C96DA2B66F07663C39FE11E2C00C70.1548.695660703.422",
        "Whether Application Launch Prefetching is enabled",
        "ForceRetrieve",
        "The element.",
        "CR_00637C6FCCC93CC75F9D988B459EA167A80BFD4782DA6DB5BC1F63F5A3F73F9B",
        "MCA request type",
        "BufferSize",
        "{<$7[",
        "Win32_WIN32_TERMINALTERMINALSETTING_Prov",
        "The instance contexts for the extensions of the service instance.",
        "Product key ID. Returns null if a product key is not installed.",
        "Values: TRUE or FALSE. A value of TRUE indicates RTS and CTS signals are supported.",
        "MIF.DMTF|Memory Device|002.12",
        "C_4548ABC60D8D754BA5CDF5BF3F98D090EE4DF751AB5940B6E9A6298C3D9C3BAA",
        "Not Present",
        "Microsoft iSCSI Initiator: Portal",
        "The WriteToSystemLog property indicates whether or not events will be written to a system log.  /nValues: TRUE or FALSE. If TRUE, information will be written to a system log file.",
        "The alarm device. ",
        "CIM_ManagedSystemElement is the base class for the System Element hierarchy. Any distinguishable component of a System is a candidate for inclusion in this class. Examples of system components include: ",
        "KernelPerfStates",
        "EVENT_TRACE_FLAG_PREVIOUSDATA",
        "ID_FQDN",
        "CIM_Policy",
        "ref:Win32_Account",
        "Password and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authenticatio",
        "LPC_TRACE_RESERVED_09 Flag",
        "The organization that defines this specification. ",
        "__ClassCreationEvent",
        "MIF.DMTF|Electrical Current Probe|001.5",
        "25     Windows is still setting up this device. ",
        "VpnConnectionTrigger",
        "FirstUseNotificationEnabled",
        "%Reason%",
        "SetSecurityLayer",
        "Specifies the friendly name of the switch to limit tracing to.   This is used in conjunction with the PortIds filter to enabled tracing per-packet events on one or more switch ports.",
        "\"Power Mode\" indicates the element has additional power model information contained in the Associated PowerManagementService association. ",
        "MDM_ApplicationFramework",
        "Win32_COMClass",
        "The physical element which is contained in the package.",
        "The CurrentVoltage specifies the voltage of the processor. bits 0-6 of the field contain the processor's current voltage times 10. This value is only set when SMBIOS designates a voltage value. For specific values, see VoltageCaps.",
        "Win32_SystemSetting",
        "Begin Time",
        "object:MSFT_Credential",
        "Enables the Virtual Machine Queue (VMQ) on the network adapter.",
        "Scale Out could not be enabled for this storage object.",
        "WMI_ATAPI_FAILURE_PREDICT_DATA_GUID",
        "MaxSizeSupported",
        "SERVICE_WIN32_SHARE_PROCESS ",
        "The Win32_Environment class represents an environment or system environment setting on a Win32 computer system.",
        "MSFT_ResourceChanged",
        "SCSI Status",
        "Requests that the Device capture its current configuration, setup and/or state information in a backing store. The goal would be to use this information at a later time (via the RestoreProperties method), to return a Device to its present \"condition\". This method may not be supported by all Devices. The method should return 0 if successful, 1 if the request is not supported, and some other value if any other error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are \\'translated\\' may also be specified in the subclass as a Values array qualifier.",
        "System",
        "MSNdis_CoMinimumLinkSpeed",
        "C_CDB4D0999BBE2F5F01BF7E500A934D82190F379CD1604609DAB79E05390DCEF9",
        "The number of bytes of data received without errors through this interface. This value includes bytes in unicast, broadcast, and multicast packets.",
        "Resources",
        "Defines the valid address bits in the 64-Bit physical address of the memory error. The mask specifies the granularity of the physical address which is dependent on the hardware implementation factors such as interleaving.",
        "CatalogError",
        "An array indicating all the transfer widths (in bits) supported by this DMA channel.  If unknown, enter 0.",
        "Local Processor Originated Request",
        "0xD013 - 'Offline': In Windows-based storage subsystems, this indicates that the object is offline.",
        "SelectPowerButtonActionPluggedIn",
        "object:KernelPerfState",
        "UILockdown",
        "A free-form string that can be used to provide guidelines on how this PolicyRule should be used.",
        "Maximum supported size for a PD transmit queue. A value of 0 indicates that the adapter does not have a hard limit.",
        "Target Already Exists",
        "Types of addresses",
        "The Mask property contains the mask used in this entry. Masks should be logical-ANDed with the destination address before being compared to the value in the ipRouteDest field.",
        "ASCII",
        "HotStandby property is a boolean indicating that the spare is operating as a hot standby.",
        "{78ebc104-4cf9-11d2-ba4a-00a0c9062910}",
        "8 bit - Deferred SPN Set - Specifies that writing SPN and DnsHostName attributes on the computer object should be deferred until the rename that will follow the join. ",
        "SMBIOS|Type 9|Slot Designation",
        "Aperture length",
        "ActiveDesktop",
        "TotalSlabs",
        "NetworkServiceHost",
        "A value that indicates whether the messages processed by this binding are durable or volatile.",
        "PSLDebug",
        "configurationData",
        "IdentifyElement",
        "CD_E37269864F3637B328FA737B6C8E3288A3E8993FA114D0276C743CCFAFDD80C2.1602.2002470063.498",
        "MSNdis_AtmSupportedVcRates",
        "    // 1 = Main Mode Enabled; 0 = MM Disabled",
        "CreatedStorageTier",
        "OnboardingState",
        "I_867009D1FACF80A1E2C919A8EEB83F6A5BB16EF95BACD064E526589732F91844.1148.214367202.283",
        "Synchronous Clone Remote",
        "SupportsFileShareCreation",
        "The RSoP_PolicySettingStatus class provides information about a specific error that occured when trying to apply a policy setting.",
        "HostedInstall",
        "C_3777205E8B20487F970347DB3B54C0C1CE84371ABD4BCBDB57E68DB30949BA61",
        "LetAppsAccessCellularData_ForceDenyTheseApps",
        "HashAlgorithm is an enumeration that specifies the hash function used by the IKESAEndpoint. The list of algorithms was generated from Appendix A of RFC2409. Note that the enumeration is different than the RFC list, since the values of Unknown and Other are taken into account.",
        "The BIOS version information in string format.",
        " Stops the service during the StopServices action. \\nn 0x004 ",
        "VersionIndependentProgId",
        "EnableDownlevelTimewarp",
        "    UseWinlogonCredential (boolean) Specifies whether the Windows logon user credentials should be automatically for VPN connection profile.",
        "The Win32_SoundDevice class represents the properties of a sound device on a Win32 computer system.",
        "All privileges that may be required to perform the operation whether currently held or not. This may be a subset or all of the priviliges named in the schema privilege qualifiers and a superset of the PrivilegesNotHeld array property.",
        "OwnerAuth",
        "NdisTransmitBlockSize",
        "KernelPerfState",
        "C_6F71654DC948E1EB11B435B2742F01766B113983E761ED75069E656F44119002",
        "TaskType",
        "SpecifyMaxRemoteShells",
        "Product identification such as a serial number on software or a die number on a hardware chip.",
        "Denotes the intended usage of the virtual disk",
        "object:MSFT_StorageJobOutParams",
        "If TRUE, storage pools on this subsystem support the replacement or removal of physical disks by use of the RemovePhysicalDisk method on the storage pool instance.",
        "UUUUUU",
        "The key to identify the instance of MDM_SecurityStatus class",
        "LockedDownLocalMachineZoneAllowLessPrivilegedSites",
        "MailAgeFilter",
        "ref:CIM_NextHopRoute",
        "SamEnumAliasesInDom_End",
        "CreateDefaultRunspace",
        "The DeleteValue method deletes a named value in the specified subkey.",
        "VersionId",
        "    // 1 = Transport Mode Preferred; 0 = No Preference",
        "Name of the packet capture provider.",
        "Disable_BCDowngrading",
        "#define MSFC_HBA_API",
        "The Model property indicates the manufacturer's model number of the disk drive.",
        "RequireDeferUpgrade",
        "MaxLogSize",
        "The name of the contract in WSDL.",
        "Class ID",
        "The Prefix property indicates the dialing prefix used to access an outside line.",
        "CD_950B982CC6F803B6E071200389755F5BC713572EAEDAD6AD08F5A06B9E237444.1148.2518851921.868",
        "The RegisteredUser property indicates the name of the registered user of the operating system.",
        "LastRequestedThrottle",
        "Lost Communication",
        "SendRNID",
        "Cubic Centimeters",
        "CI_2C1FABC8728F9E076F6727DBB7BA1358C4F010407356DEB983BF769E41D5848D",
        "WHEAErrorInjectionMethods",
        "Provides registration data common to all instances of the Active Script Consumer",
        "MDM_Policy_Config01_RemoteDesktopServices02",
        "CLOUD Flag",
        "ref:Win32_ApplicationService",
        "flushbuffers",
        "Bid2Etw_DBNETLIB_1_Trace_TextA",
        "MSFT_NetBranchCacheHostedCacheServerSettingData",
        "Win32API|GetSystemMetrics|SM_DEBUG",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1131.2861187749.180",
        "Maximum cell rate supported.",
        "Specifies the scheduling class for all processes associated with the job. The valid values are 0 to 9. Use 0 for the least favorable scheduling class relative to other threads, and 9 for the most favorable scheduling class relative to other threads. Ignored unless LimitFlags specifies Limit Scheduling Class.",
        "{64B86CA6-E3D1-11d2-8601-0000F8102E5F}",
        "NDIS Dot11 Phy State Change Status Indication",
        "MSVerifierIrpLogInformation",
        "AadDeviceId",
        "CIM_TapeDrive",
        "Reserved4",
        "DeviceDescriptionLen",
        "Number of bytes for packet filter status indication",
        "CD_9E7A3EDE33ECA9119BCEA76C74DC7F82F81BD50C5633DBA89810B055F180A2DE.55.1.9780",
        "Number of transmitted fragments",
        "Either 'User' or 'System'.",
        "The column number associated with this extent.",
        "Specifies the file sharing protocol versions supported.",
        "DownBackLimitBps",
        "PeakPageFileUsage",
        "Number of supported traffic classes that can be enabled for IEEE 802.1Qaz Enhanced Transmission Selection.",
        "SpecifyMaximumFileSizeSystemLog",
        "UtilDebug",
        "82 - Unable to renew DHCP lease",
        "0x204",
        "Maximum number of memory regions supported by the adapter",
        "IR_8B109770B70CC6D7972AE94E395D34EF4AF2D27D834986AE7388EC1225644A3F",
        "MIF.DMTF|System Resource DMA Info|001.4",
        "C_208AE2247013C3372A171DBD4988D1DBD87A3518363B9A8CB1FE166BE1D06432",
        "This property has the value of the lower 16-bits of the EventIdentifier property. It is present to match the value displayed in the NT Event Viewer. ",
        "NumElements",
        "C_29DECD57CEAC20C8FBE48C1CEA8F70E0F53A065C3A111386C70723311B9A2585",
        "{B8D765F0-2D93-4da2-8186-A187622B4302}",
        "PNP_EVENT_INFO_LEVEL Flag",
        "CatalogDebug",
        "Retrieves DNS client Name Resolution Policy Table rules",
        "Modify",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2136.1388182681.368",
        "MI_ERRORCATEGORY_NOT_SPECIFIED",
        "A rule that alters the behavior of main-mode authentications.",
        "TLB shoot down access",
        "Shadow Copy",
        "IRQGroup",
        "EVENT_TRACE_FLAG_NETWORKQUERYOPEN",
        "The status of the BranchCache Content Retrieval Firewall Rules",
        "NETIO_TRACE_NSI Flag",
        "KillTimeout",
        " A description of the objects.",
        "This class exists for backward compatibility to earlier CIM Schema definitions. With additions to Sensor and NumericSensor in V2.2, it is no longer necessary. A CurrentSensor can be defined by setting the SensorType property, inherited from Sensor, to 4 (\"Current\"). Other properties of this class are hard-coded to constant values to correspond to definitions in the sensor hierarchy.",
        "NDIS Enumerate Receive Filters",
        "Xoff Character",
        "Best guess, if no match is found fallback to PCL=2",
        "-Wednesday",
        "SourceNamespace",
        "Specifies the print job to resume.",
        "medium",
        "On the other hand, if ConditionListType = CNF, then the overall condition for the PolicyRule is: ",
        "ACPI Support",
        "OwningEntity",
        "Watts",
        "WmiMethodId",
        "The Name property defines the label by which the object is known. When subclassed, the Name property can be overridden to be a Key property.",
        "imPress",
        "QueryForestTrustInfo",
        "LocalLastWriteTime",
        "ShortFileNameSupport",
        "This property identifies the number of processors on this physical computer system.",
        "The DefaultTOS parameter specifies the Type of Service (TOS) value put in the header of outgoing IP packets. See RFC 791 for a definition of the values.",
        "StreamingAllowHighCostLaunch",
        "DNSEnabledForWINSResolution",
        "__EventQueueOverflowEvent",
        "Win32API|Windows Networking Structures|NETRESOURCE|lpLocalName",
        "Specifies the ID of a print job to delete.",
        "QoS functionality is enabled for the network adapter.",
        "MIF.DMTF|Video|003.13",
        "Current Processor Performance State",
        "CD_755C3664114AA9097DEA3F0332A59D1FE1A4668C8001C4E97937639305CB9174.2041.928460865.228",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_86B3BCA296587429BCD61A2968A848617DB93023BC6D3C1858853C5540E12A3E",
        "The QueryLanguage property is a string containing one of the query languages supported by Windows Management.",
        "Printer name",
        "Win32_DCOMApplicationSetting",
        "Win32_TokenGroups",
        "The SupportsGracefulClosing property indicates whether the protocol supports two-phase close operations - also known as graceful close operations. If not, the protocol supports only abortive close operations. ",
        "HidePeopleBar",
        "R_708C32C766D9971484B0E64ECC9BA26A9738A3C69831CA885AADB8A4B125BF1A",
        "The frequency, in minutes, of how often a client will contact the KMS host after the product is licensed.",
        "The type of the ODBC DSN to set. Possible values are 'User', 'System' or 'All'.",
        "Fragmented Folders",
        "WindowsServer2019",
        "MSNdis_StatusDot11AssociationStart",
        "SetEncryptionLevel",
        "CD_FCBAF5A1255D45B1176570C0B63AA60199749700C79A11D5811D54A83A1F4EFD.0.1862998048.89",
        "UInt64Array",
        "Storage tier operations must be called on the clustering node that owns the metadata volume.",
        "SPACES_StorageModificationEvent",
        "For example, US English appears as: \"en_US_WIN\", where the \"WIN\" variant would specify a Windows browser-specific collation (if one exists). Since the variant is not standardized, it is not commonly used and generally is limited to easily recognizable values (\"WIN\", \"UNIX\", \"EURO\", etc.) used in standard environments. The language and country codes are required; the variant may be empty.",
        "The PasswordExpires property indicates the date and time when the password will expire. The value is set in this format: yyyymmddhhmmss.mmmmmm sutc",
        "Administrator Defined Route",
        "BACKDOOR",
        "FilterId",
        "Heap Events",
        "QualifierName",
        "Identifies the current language being used by the Printer for management. The language listed in the CurrentNaturalLanguage property should also be listed in NaturalLanguagesSupported.",
        "NumericSensorLowerThresholdFatal",
        "ReceiveFailures",
        "value",
        "ActiveReceive",
        "Exit Windows",
        "Association between VirtualDisk and PhysicalDisk. A virtual disk and a physical disk are associated when the virtual disk has data residing on the physical disk.",
        "Cipher plumbed in IPsec policy.",
        "Windows Defender Firewall Service",
        "ISO 802.6 MAN",
        "If the UserName parameter specifies an account name, the Password parameter must point to the password to use when connecting to the domain controller. Otherwise, this parameter must be NULL. ",
        "This field indicates the total storage pool capacity being consumed by this virtual disk. For example: in the case of a 2-way mirrored virtual disk of size 1 GB, the footprint on the pool will be approximately 2 GB.",
        "WmiPerfInst",
        "- 6=Namespace. Example: If the authorization target is a CIM Service, then the ActivityQualifiers entries can define a list of Namespaces that the authorized subject is able to access. ",
        "ref:MSFT_NetLbfoTeam",
        "R_E3C7967C97A946463CB89C85CA1D74F3DAB68F3859ED864589727DCF93BB4954.2458.3139891486.558",
        "AllowTSConnections",
        "CD_8688B6B3A5AFA46698CC5C2A2A938F01175B6D9F4A0E5E74F0C3AA6D73897983.2033.3138347932.239",
        "Rules",
        "SupportsMirrorRemote",
        "R_F29100A757BDE75968386F1F8F50FAF18D4793B63DC12FB4378C18D9CD66C352",
        "Service Flag",
        "Msft_WmiProvider_DeleteClassAsyncEvent_Post",
        "MSFT_NetAdapterPowerManagement_WakePattern_WildCard",
        "ReservedSpace",
        "BAUD_7200",
        "MDM_Policy_Result01_Update02",
        "Method_Reserved",
        "MemoryHierarchyLevel",
        "{8502C4CA-5FBB-11D2-AAC1-006008C78BC7}",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2426.34478244.180",
        "Read cache is only supported by the ReFS filesystem.",
        "{8502C57B-5FBB-11D2-AAC1-006008C78BC7}",
        "AutomaticVMActivationHostMachineName",
        "Is Not Current",
        "ref:CIM_PhysicalConnector",
        "Version of the package",
        "DesiredAccuracy",
        "Custom Dial Dll",
        "WMI Kernel Trace Event Provider",
        "Remote Desktop NIC management.",
        "ValidPeriod",
        "Name of target involved in failure",
        "PState Handler",
        "Alternate Offset",
        "PolicySourceUseTempFolders indicates whether the property UseTempFolders is configured by Server(0) or Group Policy (1).",
        "CD_12471D6936B91DC2838F052A66838F273DE5045F0CB1852A0C46455436BAB9A5.2613.3532380003.370",
        "#define SendRPS_OUT_RspBuffer_SIZE_HINT 64",
        "iScsiFlagProtocolTMF",
        "Socket Flag",
        "FoundKnownDll",
        "The operations of this contract.",
        "CD_7A2E82FAA3D7445BB721477AEF5A828AA728D419801621CF35B28E55DA9D6FA6.2111.3244341525.523",
        "ConfigureFeatureUpdateUninstallPeriod",
        "Specifies the maximum size (in MB) of the Branch Office Remote Offline Logging file for this printer.",
        "Smartcard Required",
        "blocked",
        "CIM_AggregatePExtent is realized on a physical media. This relationship is made explicit by the CIM_RealizesAggregatePExtent association.",
        "The SupportRTSCTS property determines whether Ready To Send (RTS) and Clear To Send (CTS) signals are supported on the serial port",
        "C_FEA174838505F017ED6B4301AAC1DD5D141215A4B6A1F43D4092C1E5AC1A3F37",
        "RSOP_ExtensionEventSource.id=\"{B674D32B-6214-435F-A8BB-14B8F306BDBD}\"",
        "9EA3-D33A-4a4b-BF23-BBE",
        "RSOP_PolmkrTaskSetting",
        "{2C6811D2-DB32-11d2-85FC-0000F8102E5F}",
        "System Partition",
        " A device driver started by calling the IoInitSystem function. Use this in the ServiceControl Table, with the StartServices action put after the InstallServices action, to start a driver service during an install.",
        "Domain not found",
        "Subject alternative names of the issued certificate with separator bar as delimiter.",
        "Reserved Field #1",
        "productWantsWscNotifications",
        "The maximum number of times a reliable channel attempts to retransmit a message it has not received an acknowledgement for, by calling Send on its underlying channel.",
        "ConfigureXboxLiveAuthManagerServiceStartupMode",
        "The CompressEx method compresses the logical file (or directory) specified in the object path. CompressEx returns an integer value of 0 if the file was successfully compressed, and any other number to indicate an error. CompressEx is an extended version of the Compress method./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n",
        "The DeviceID property contains a string uniquely identifying the processor with other devices on the system.",
        "DirectoryPath",
        "C_0CB02E03FB8893004847A1CD792CD15C9298AEB5220B65C1D3CF55365F8EA8F7",
        "Number of Buttons",
        "CD_5401A055411F9811A09125DE8462BF6A4D708D8C770ADE3D670BFB9DAD21A39A.1671.3232368433.1542",
        "ThermalConstant2",
        "C_1BC80DB435E63BDB0D0BAE6F783293CFD13F829052965F211A74FB5B4AD97A7E",
        "Number Of Buffers",
        "\\'m;\\'m;",
        "System environment settings management.",
        "GetPolicyInformationDWord",
        "MSFT_FileResourceManager",
        "Number of ms to wait for response",
        "Process In Swap Event",
        "Reserved1",
        "NS_0634BEAAA6D47E6371999AD405E0DDAFDA3BDAB3659C4858F565936A4909981F\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_02E3B8C824FD0B9C15B4D49AB84CF02FA38E02CAF699DC3CBDCBB2D79F3025DF",
        "runspaceName",
        "Number of start-stop cycles performed by the storage device.",
        "ALPC Wait For Reply",
        "51002",
        "Inheritance-related flags.  See SECURITY_DESCRIPTOR_CONTROL",
        "The command line options for the advetisement.  These should be in the form of property=setting",
        "SetReplicationSettings",
        "picks defaults based on the size of the volume. These defaults have been selected to reduce the amount of space lost and to reduce the amount of fragmentation on the volume. For general use, default settings are strongly recommended.",
        "SMBios Guid of the target PCSV device",
        "KeyDelete",
        "CIM_OperatingSystem.OtherTypeDescription",
        "Associativity",
        "Image_Load_V2",
        "StorageHealth",
        "2.22.1",
        "Fully Redundant",
        "Maximum height of an adapter card that can be inserted into the slot, in inches.",
        "Users to revoke access to the file share.",
        "{146360aa-88dd-11dd-94b8-001d09162bc3}",
        "Write Warning",
        "This class represents per-interface Teredo Configuration settings.",
        "How was the malware detected (Enumeration)? RTP/Scheduled Scan/...",
        "AverageFileSize",
        "BinarySDToSDDL",
        "WinInit",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2120.2084505154.188",
        "CIM_RealizesAggregatePExtent",
        "Microsoft-Windows-LLTD-Responder",
        "Windows Server 2012 R2",
        "RD_TRACE_PROCESS Flag",
        "If this property is set to TRUE, the operating system does not assign a drive letter automatically when the partition is discovered. This is only honored for GPT disks and is assumed to be FALSE for MBR disks. This attribute is useful in storage area network (SAN) environments.",
        "KernelImageBase",
        "CR_E707FBA0E2CA2FF8FDB82241C8B012B9A1B221B3B69ACD6A3EDCF3E478558D31",
        "MSSAMTrace",
        "CD_053DD41219FAA16153F07241CEA1789B6627CF883354607B4109B4BE9101FD9E.259.387126323.218",
        "RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls",
        "Indicates the set of Virtual Machine Isolation properties that are available.",
        "TRACE_LEVEL_WARNING",
        "TCP Window Size",
        "Prefix of the policy.",
        "Adds the User, Group or Computer to the existing set with the set of permissions defined. The AccountName comprises of both: Domain and Name of the entry and PermissionPreSet is enumeration of following PermissionsWINSTATION_GUEST_ACCESS, WINSTATION_USER_ACCESS, WINSTATION_ALL_ACCESS",
        "SamShutdownSamSrv_End",
        "FaxClient",
        "Starting Maintenance Mode",
        "89255468.435",
        "object:MSFT_Volume",
        "DisableVirusUI",
        ": erro",
        "AMLIEvent",
        "The VideoMode property contains a user readable description of the current screen resolution and color setting of the display.",
        "PowerWmiProvider",
        "Whether to follow certificate renewal.",
        "Changer Errors",
        "LocalPort",
        "// manipulate virtual ports for use on behalf of virtual machines.",
        "CD_76B92FF8B3AA20856691665FB718428ADC2A8F423D381B9A75A40096351B6F0B.1677.2015001673.1975",
        "AlertType",
        "The inherited Name property serves as key of an operating system instance within a computer system.",
        "When IPsec is in use, extra work is required to enable NAT traversal. This setting indicates on which side NAT traversal should be attempted.",
        "{FAF76B91-798C-11D2-AAD1-006008C78BC7}",
        "Run Recovery Job",
        "A DATETIME value, in string format, that represents the last time an attempt was made to synchronized this folder to the Offline Files cache, even if it was unsuccessful.",
        "Where and are separated by a colon ':', and where shall include a copyrighted, trademarked or otherwise unique name that is owned by the business entity creating/defining the InstanceID, or is a registered ID that is assigned to the business entity by a recognized global authority. (This is similar to the _ structure of Schema class names.) In addition, to ensure uniqueness, shall not contain a colon (':'). The first colon to appear in InstanceID shall appear between and . is chosen by the organizational entity and should not be re-used to identify different underlying (real-world) elements. ",
        "MSSerial_PortName",
        "DeliveryQoS",
        "{8502C4F0-5FBB-11D2-AAC1-006008C78BC7}",
        "Execution State",
        "The SetDateTime method sets the current system time on the computer.  On computer systems running Windows NT/2000, the calling process must have the SE_SYSTEMTIME_NAME privilege./nThe method returns an integer value that can be interpretted as follows: /n0 ",
        "PLATFORM_TRACE_SECURITY",
        "{023763EC-E3D2-11d2-8601-0000F8102E5F}",
        "{e6c44c65-8d7d-4784-9fb0-d35703b3f351}",
        "Options that affect how login is performed. See ISCSI_LoginOptions",
        "Active Process Limit - Establishes a maximum number of simultaneously active processes associated with the job.",
        "MDM_Policy_Config01_DataProtection02",
        "Set Security",
        "Signed",
        "DODelayBackgroundDownloadFromHttp",
        "CR_7F6515E2EBD9049AE896B25B99B1906533354EA0DB3289C03EFADA9D23B196C7",
        "MaxRetryCount",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\AutoConvertTo[Default]",
        "ISA add-on card",
        "UserMethod",
        "CD_9538FC3E850F71E31007FD8FC3E5ABC5EAB1DBB946651E9F96D53B48A625555B.1779.2531336812.287",
        "RTC_WAKE_FROM_S4",
        "C_FB45B8D9320E818405D79801CDC499E87D50956AC9FA6D71D017C76991D657C0",
        "SetConfiguration",
        "License status of this product's application.  0=Unlicensed, 1=Licensed, 2=OOBGrace, 3=OOTGrace, 4=NonGenuineGrace, 5=Notification, 6=ExtendedGrace.",
        "R_A21DD98AF56DC0A7D21C24764DDA5A5F7A3EA65FE4980FAAB7F2035E4807972C",
        "The VolumeSerialNumber property indicates the volume serial number of the media in the CD-ROM drive.",
        "Printer device configuration management.  ",
        "// the load balance policy that is currently used.",
        "ref:MSFT_NetEventProvider",
        "SetProperties",
        "UnknownThreatDefaultAction",
        "object:VpnConnectionTriggerTrustedNetwork",
        "CD_4FD2270AA7CC321848B51530B7A77A9E39B5486B55CE0C09A2B597A1F1FCE1E6.1130.2034941254.1312",
        "CIM_Card.RequirementsDescription",
        "The BuildNumber property indicates the build number of the operating system.  It can be used for more precise versioning information than product release version numbers/nExample: 1381",
        "IcmpRedirects",
        "//                 ULONG            Version;",
        "- 7=URL. Example: An authorization target may not be defined, but a Privilege could be used to deny access to specific URLs by individual Identities or for specific Roles, such as the 'under 17' Role. ",
        "DeviceTimingMode",
        "SaveProperties",
        "SetObjectElement",
        "Snoop",
        "WriteDebugInfo",
        "CD_9C52BC59A122CC7517413B34FA6839E69A7AE3C55A75FE6EBEADED4D113D421E.2624.2491819219.523",
        "\\\\.\\root\\default:__Win32Provider.Name=\"SMTPEventConsumer\"",
        "- 9=Command Line Instruction. Example: If the authorization target is a ComputerSystem or Service, then the ActivityQualifiers entries can define a list of command line instructions that may or may not be 'Executed' by the authorized subjects.",
        "rcvwinscale",
        "Win32API|Communication Structures|DCB|XonChar",
        "DiscoveryProvider",
        "TCP or UDP Port",
        "The ending address of the bytes in error.",
        "SunOS",
        "r system.",
        "{FAF76B7C-798C-11D2-AAD1-006008C78BC7}",
        "Turning Remote Desktop listener on or off remotely.",
        "9F2EA16C1C5FF4B6E7F5EC9C729192D48026A285849C5",
        "ref:CIM_SARule",
        "locale",
        "The GuaranteesDelivery property indicates whether the protocol guarantees that all data sent will reach the intended destination. If this flag is FALSE, there is no such guarantee. /nValues: TRUE or FALSE. A value of TRUE indicates the protocol supports guaranteed delivery of data packets.",
        "C_103563D59E224884B92C8B7934BDD6592D64C63C0FEB52D1B636E2F48012EA04",
        "{ED60BC3F-3D56-42f0-B4D0-81DD16E28515}",
        "RequirePasswordWhenComputerWakesPluggedIn",
        "PeerObjectType",
        "PriorityValue8021Action",
        "SPACES_HealthActionEvent",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2426.2699293546.211",
        "R_95C330C17D14564CA1EEB1DC2DFF820B2D8ABC77CEBD942070B5C3589AD8A70D.2461.1898999374.554",
        "SamUserPwdSet_Start",
        "CD_8DD4117F0A6CA8322CEA3B2EE2E937FF189016C7342D650B227DA4C96B557695.2031.2460019784.221",
        "ReArmApp",
        "LUAInstall: error 0x00000005 setting flags [{937847E7-C78A-4834-9CE8-5F3EC99BD604}]",
        "Specifies the largest Job (as a byte stream) that the Printer will accept in units of Kbytes. A value of zero indicates that no limit has been set.",
        "The ErrorCorrectType property indicates the error correction method used by the cache memory.",
        "The storage pool could not complete the operation because its configuration is read-only.",
        "SERVICE_NON_CRITICAL_FAILURE",
        "Edgelit",
        "AccountManagement_AuditOtherAccountManagementEvents",
        "NewProtectorID",
        "An integer value that represents the hour, in 24-hour time, for the time of day when they sync should occur. This must be an integer value from 0 to 23.",
        "Win32Registry|Hardware\\DeviceMap\\Scsi|ScsiPort",
        "Antecedent",
        "XNumCharacters",
        "The ClassName property holds the name of the class targeted for deletion.",
        "{8502C506-5FBB-11D2-AAC1-006008C78BC7}",
        "CIM_ChassisInRack",
        "Specifies the Display Name of the LanAdapter.",
        "R_1B1F12E77F513A1F34170D72EBDFB89B7AA666D5ABEE6CC04756D419F4107E74",
        "Docking Station",
        "PoolFree",
        "Event Log Name",
        "IPAddr",
        "ScratchDirectory",
        "3221232483",
        "TokenRing",
        "Burst Synchronous DRAM",
        "ApplyAndAutoCorrect",
        "DOT11_REPEATER Flag",
        "Serial Port Name",
        "CIM_AdjacentSlots describes the layout of slots on a hosting board or adapter card.  Information like the distance between the slots and whether they are 'shared' (if one is populated, then the other slot can not be used), is conveyed as properties of the association.",
        "SourceWWN",
        "PortalAddress",
        "R_01E49F2BC300B8406F535D199FFE723C66F3CBCD052B872FA9DADCCDBACAAF50",
        "EnableTimeoutWarning",
        "Underlying Resource Unavailable",
        "_DH_WMP_LIBRARY Flag",
        "o6?=;",
        "Export_BCCachePackageByExportDataCache",
        "The VariableValue property contains the placeholder variable of an environment variable. Information like the file system directory can change from machine to machine. The operating system substitutes placeholders for these.",
        "{BE0A9830-2B8B-11d1-A949-0060181EBBAD}",
        "{1008CCF0-7BFF-11D2-AAD2-006008C78BC7}",
        "use more granular filters (e.g., address, and direction filters).",
        "The JavaClass property indicates whether the COM component is a Java component.",
        "KNOWN",
        "Stack16",
        "MinTimeUs",
        "PassThroughIds is a comma-separated list of all implementation specific keys. It is used by storage management applications to access the vendor proprietary object model. This field should be in the form: key1='value1',key2='value2'.",
        "InstallLicense",
        "Import Security Zone Settings",
        "RegistryValueChangeEvent",
        "DSS Signatures",
        "0xC0050049",
        "DMTF Reserved",
        "Inherited from RSOP_PolicySettingBlocked",
        "The IPInterface associated with the IP addresses.",
        "DeliveryRequirementsAttribute",
        "CD_B1BDF04F409DA8A1218BDCCDF869651E770462250C203BC00DEB8F3479804AE1.2109.1886272285.490",
        "CIM_SoftwareFeature",
        "Service Logon Failed",
        "//        #define MSFC_HBA_API",
        "NIC Switch hardware capabilities of the adapter",
        "Message",
        "BandwidthThrottlingTransferRate",
        "Specifies the ID of the print job to restart.",
        "For console processes, this is the title displayed in the title bar if a new console window is created",
        "KernelModeTime",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.296.1863209304.368",
        "Provides the capability to enable any combination of the following:",
        "LockedDownTrustedSitesZoneAllowAccessToDataSources",
        "Indicates if the Adapter supports TCP checksum validation offload for receive IPv4 packets.",
        "JobRunTimes",
        "One or more physical disks could not be removed. The policy on this storage pool requires a minimum number of physical disks to remain present.",
        "C_F855A6D4334AEF984264ECC01FA41D9E9BBC66D0101436CE6BC0A37CF0955C3F",
        "Disables Built-in Diagnostics Tracing (BidTrace) for troubleshooting WDAC components.",
        "CD_E44783D75BEF4F0F8614CE9C4168FDBD1FA3135B7D74FF2017BA6E02123BBDC0.1740.4002485430.1223",
        "Values: TRUE or FALSE. A value of TRUE indicates the protocol allows data to be connected.",
        "9AB53806E88665C047824D5369B271C53B233BBEAC7C15BE3BA9BD214E527500",
        "VMName",
        "Group not found",
        "{123afe1d-a270-414f-9e6b-5c241811e66f}",
        "The LoadOrderGroup parameter passes the group name that it is associated with. Load order groups are contained in the system registry, and determine the sequence in which services are loaded into the operating system. If the pointer is NULL, or if it points to an empty string, the service does not belong to a group. Dependencies between groups should be listed in the LoadOrderGroupDependencies parameter. Services in the load-ordering group list are started first, followed by services in groups not in the load-ordering group list, followed by services that do not belong to a group. The system registry has a list of load ordering groups located at:",
        "MaxVSyncNumerator",
        "ObjectAccess_AuditFileShare",
        "RawData",
        "IPv6Encapsulation",
        "Example: A mouse, touch pad, or stylus/tablet.",
        "CIM_NumericSensor.CurrentReading",
        "IL_A8C08024CBBA3AB7F7414387F341D4297567CE71AA49081987E0F0528989B49E.2398.121812873.258",
        "Flags2",
        "SubSegmentActivated",
        "MPLS Label",
        "The DriverName property indicates the driver file name of the SCSI controller.",
        "OperationTimeoutInterval",
        "// network interface port on your adapter.",
        "CD_AF9FF42200D7F24F94D2D927172EDE6E75DA70A13982C42099804CFF0709A576.1746.2030129531.1121",
        "The Flags property indicates the properties available to this network profile.  Properties that can be set include:",
        "An array of free-form strings providing more detailed explanations for any of the parallel controller features indicated in the Capabilities array. Note, each entry of this array is related to the entry in the Capabilities array that is located at the same index.",
        "smallAnimatedBitmapName",
        "SlotLayout is a free-form string that describes the slot positioning, typical usage, restrictions, individual slot spacing or any other pertinent information for the slots on a card.",
        "MEM_PLATFORM_REQUESTOR_ID is valid",
        "The maximum network packet size in bytes the NIC supports, not including a header.",
        "System_AuditSecurityStateChange",
        "Values: TRUE or FALSE. A value of TRUE indicates RLSD is supported.",
        "Server hosting the gpo",
        "WARNING : Drive is experiencing write problem.",
        "User-friendly interface index.",
        "AttributeCachingForRegularFilesMin",
        "SAM Open Group",
        "ConfigureGroupMembership",
        "C_5CB6A0A003499DF6531A245112372798390EB984E42ACEC32EC128E82F56ADB5",
        "{b9e4e2f9-ee89-4756-b057-38f9d9b59a92}",
        "Alias of this file association's RemoteApp",
        "IPSec policy delta",
        "filterAllowed",
        "AutoTrigger",
        "C_96C0C62C985812B4BE911B17087624F5F181BC4A34E4B6F778659666F96320E6",
        "LongLivedTransactionsTracingEnabled",
        "Indicates if RSC is currently operational for IPv4 TCP packets.",
        "setting information for disk quotas on a volume.",
        "MDM_VPNv2_AppTriggerList02_App04",
        "STORAGE_FAILURE_PREDICT_EVENT",
        "HRRelease",
        "WakeToRun",
        "The SupportsExpeditedData property indicates whether the protocol supports expedited data (also known as urgent data) across the network. Expedited data can bypass flow control and receive priority over normal data packets./",
        "context and shall not rely on this format.",
        "\\\\.\\root\\cimv2:__Win32Provider.Name=\"ProviderSubSystem\"",
        "default load base address, as listed in the NT image header; if the requested address is unavailable the image will be loaded at a different address (ImageBase), causing rebasing.",
        "MSiSCSI_InitiatorNodeFailureEvent",
        "StringFormat",
        "The GroupComponent reference represents the Win32_LoadOrderGroup containing the load order group properties associated with the base service.",
        "Guid of the extension",
        "MDL_READ_COMPLETE",
        "MSNdis_QueryReceiveQueueParameters",
        "Enable BidTrace for all applications under this folder.",
        "TRACINGHANDLE",
        "TcpIPv6ExtensionHashSupported",
        "ref:CIM_RedundancyGroup",
        "TEST_TRACE_RESERVED_13",
        "NDIS 802.11 authentication mode setting",
        "The PWhere property defines a from/where clause (i.e. a WQL query without the Select clause). The query string may contain substitution parameters (tokens preceded by a '#' mark) indicating where values may be substituted into the query string. The parameter values are taken from the tokens immediately after the alias if the token cannot be resolved to a switch or verb - this allows for example a command such as 'w KillProcess 154' where the PWhere value for the KillProcess alias would be 'From Win32_process Where ProcessId = #ProcId'",
        "{43920a24-2129-11d4-97eb-00c04f79c403}",
        "HitCount",
        "MSFT_DSCResource",
        "Range2InputVoltageHigh",
        "CIM_PrintJob.CharSet",
        "{41F377B0-DB2A-11d2-85FC-0000F8102E5F}",
        "iScsiFlagDigest Flag",
        "GenerateActiveDirectoryOfflineActivationId",
        "ClassificationEnabled",
        "TcpIp_SendIPV4",
        "Planned Failover operation requires fractured state",
        "Active Matrix LCD",
        "575739.189",
        "PortableDeviceTypes_Collections",
        "Unique ID of the settings location template.",
        " 0x008 ",
        "VirtualDiskSizeDivisor",
        "The ProviderOperation_CreateRefresher property indicates the number of calls to IWbemHiPerfProvider :: CreateRefresher.",
        "If true, users will be notified when an application listens on a port that is closed.",
        "{A3864E0E-DB33-11d2-85FC-0000F8102E5F}",
        "policy Removal",
        "A list of core printer drivers this driver depends on.",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\VersionIndependentProgId[Default]",
        "Contains",
        "60003",
        "setquota",
        "360A5ACE2240DC19B0464EB.1606.690108275.180",
        "A integer indicating the type of operating system.",
        "Win32_VideoController",
        "WSP_ReplicationGroupToVirtualDisk",
        "C_524EAE20B913314A702A0EBDD5A10C21EED93FAAED87245845E0CDD9834CDE3F",
        "The DeleteEx method will delete the logical file (or directory) specified in the object path. DeleteEx returns an integer value of 0 if the file was successfully deleted, and any other number to indicate an error. DeleteEx is an extended version of the De",
        "ref:Win32_Directory",
        "The Dependent reference represents the POTS modem using the serial port.",
        "ref:Win32_LogicalFileSecuritySetting",
        "ea,dZ",
        "Example: L2.",
        "2.24.0",
        "Electrophotographic Other",
        "TS Rdp Init Trace",
        "MSFT_ResiliencySetting.InterleaveMax",
        "I_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6.1489.3536658575.306",
        "Estimated throughput of the link in bytes per second",
        "UserName is the name of the user that an authorization service maps to an identity.",
        "LPC_TRACE_COMMUNICATION",
        "Id that is unique to this session within this adapter. ",
        "Optional. String that specifies the user name to use while attempting to connect. This can be in the form of a user name or Domain\\Username. Leave it blank to use the current logged-on user name. The strUser parameter should only be used with connections to remote WMI servers. If you attempt to specify strUser for a local WMI connection, the connection attempt fails.",
        "MSADCE.1",
        "The PMTUBHDetectEnabled property indicates whether detection of black hole routers occurs. Setting this parameter to TRUE causes TCP to try to detect black hole routers while discovering the path of the Maximum Transmission Unit. A black hole router does not return ICMP Destination Unreachable messages when it needs to fragment an IP datagram with the Don't Fragment bit set. TCP depends on receiving these messages to perform Path MTU Discovery. With this feature enabled, TCP will try to send segments without the Don't Fragment bit set if several retransmissions of a segment go unacknowledged. If the segment is acknowledged as a result, the MSS will be decreased and the Don't Fragment bit will be set in future packets on the connection. Enabling black hole detection increases the maximum number of retransmissions performed for a given segment. The default value of this property is FALSE.",
        "{8502C532-5FBB-11D2-AAC1-006008C78BC7}",
        "Destination Net Unreachable",
        "This enables device enumeration traces",
        "EC2N-155 bit field element",
        "POINTER_PORT_WMI_STD_USB",
        "NumericSensorContext",
        "The ErrorControlOn property contains the command string used to enable error control.",
        "MIF.DMTF|Processor|006.7",
        "Computer system registry management.",
        "DateArray",
        "Failed Logins",
        "SendAllSamples",
        "entryName",
        "IPProtocols",
        "ReadFailure",
        "The total count of valid KMS requests.",
        "CIM_VideoBIOSFeature represents the capabilities of the low-level software that is used to bring up, configure and use a computer system's video controller and display.",
        "Interval in minutes for when auto-configuration will happen.  A value of 0 means auto-config will only happen at browser startup and navigation time.",
        "filesystemcontrol",
        "MicrosoftNetworkServer_DigitallySignCommunicationsAlways",
        "TotalNumberOfMacAddresses",
        "Int64",
        "ReceiveFilterParameters",
        "shortName",
        "MSFT_DSCConfigurationOutputWriteArray",
        "Intel(R) Xeon(TM)",
        "TapeDrive",
        "DisableUserVhd",
        "This class represents the catalog of recognized threats",
        "LPC_TRACE_RESERVED_0c",
        "PortAllocates",
        "TcpIp_V1_TypeGroup2",
        "fastiocheckifpossible",
        "SDBUS_DEBUG_INTERFACE Flag",
        "ManagedAddressConfiguration",
        "Kerberos (user as principal)",
        "Boolean indicating that the match condition described in the properties of the FilterEntryBase subclass should be negated. This property is defined for ease of use when filtering on simple negations - for example, to select all source ports except 162. It is not recommended that this Boolean be set to True when filtering on multiple criteria, such as defining an IPHeadersFilter based on source/destination addresses, ports, and DiffServ Code Points.",
        "Specifies a quad word data value. ",
        "TM_PLGINT",
        "CIM_Process.Handle",
        "The FreeSpace property indicates the space available in the paging file. The operating system can enlarge the paging file as necessary up to the limit imposed by the user.  This member shows the difference between the size of current committed memory and the current size of the paging file - it does not show the largest possible size of the paging file.  ",
        "{f77324b6-5bb9-4721-b63c-b39d1826d72b}",
        "{a11e5d6b-353d-4bf6-97a8-ede4cba45524}",
        "S-1-16-12288",
        "PlayEnabled indicates the drive is currently using the RedBook filter.",
        "SystemStartupDelay",
        "DAProxyServerName",
        "Defines the resources that are exclusive to this particular partial configuration",
        "R71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "RegisterByObject",
        "Example: PLEXTOR CD-ROM PX-12CS 1.01",
        "MSFC_DH_Chap_Parameters",
        "Win32_POTSModemToSerialPort",
        "CD_9BA1AB7C3163917E292E29E8907497F4785695E458493ACBBC6CCE3EBFDCC92C.2534.3137005187.504",
        "FX_TRACE_REQUEST Flag",
        "LocalPortRanges",
        "New Processor Throttle States Event",
        "Supports Writing",
        "Maximum number of shadow copies reached",
        "Tab Index",
        "// The total number of packets for which the Security Parameters Index (SPI) was incorrect.",
        "The OSAutoDiscovered property indicates whether the parallel port was automatically detected by the operating system or by other means (such as being manually added through the Control Panel).",
        "MSFT_NetIPsecDoSPSetting",
        "SendIntranetTraffictoInternetExplorer",
        "Dot11 Association Start status information.",
        "productUptoDate",
        "C_612461B1AECF14916F6F139FD9951F2BD0CB766E0BB9EF5DA8A04D9DEB890739",
        "A Windows language ID for the language supported by the application.",
        "Win32_ProcessTrace",
        "State detail of local configuration manager.",
        "The DisplayFlags property contains two bits of information about the display. This member communicates whether the display device is monochrome or colored, and interlaced or non-interlaced, by masking its value with the DM_GRAYSCALE and DM_INTERLACED masks respectively. Printer drivers do not use this property.",
        "If this property does not contain 0 or null and the implementation does not support this parameter, a return code of \\'Use Of Timeout Parameter Not Supported\\' shall be returned.",
        "MinimumPasswordAge",
        "SamOpenUser_Start",
        "Storage Device Enclosure",
        "SPACES_MaskingSetToVirtualDisk",
        "The Description property provides a textual description of the object. ",
        "The Configuration object allows the grouping of sets of parameters (defined in CIM_Setting objects) and dependencies for one or more managed system elements. The Configuration object represents a certain behavior, or a desired functional state for the managed system elements. The desired functional state is typically driven by external requirements such as time or location. For example, to connect to a mail system from 'home', a dependency on a modem exists, but a dependency on a network adapter exists at 'work'. Settings for the pertinent logical devices (in this example, POTS modem and network adapter) can be defined and aggregated by CIM_Configuration. Therefore, two 'Connect to Mail' configurations may be defined grouping the relevant dependencies and CIM_Setting objects.",
        "The use of this method is being deprecated, since Current senor reading can be retrieved through the GetInstance operation. ",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.1143516498.368",
        "{a47401f6-a8a6-40ea-9c29-b8f6026c98b8}",
        "NamedJobObjectProv",
        "CD_9877A07ED842BA5F1FB4691948C0CDD95DF656BC3733002FE0D6F9D48056C255.2614.1526007969.368",
        "ConfidentialBytesReceived",
        "Rate limit for inbound ICMPv6 traffic.",
        "IconTitleFaceName",
        "RowsetHelper.1 formatted output (W)",
        "DynamicPortRangeStartPort",
        "LanaIdDescriptions",
        "A datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed.",
        "Parallel Port ECP/EPP",
        "Vertical image size (mm)",
        "IdType",
        "ServerNames",
        "Precedence",
        "DNS namespace which can be a Suffix/Prefix/FQDN/Subnet/Any.In order to specify Any, the value must be .(dot)",
        "CD_5F5583215800877E78DF32C89A95963A09372E548E11061C174A3C01BAB56758.2104.834132275.5677",
        "SpeakerVolumeMed",
        "The User reference represents the user account associated with a disk quota.",
        "Flood Detected",
        "The Dependent reference represents the Win32_BaseService containing a base service that is dependent on the Antecedent property of this class.",
        "object:MSNdis_80211_WLanBssId",
        "TimetoCleanDrive",
        "DSCP (RFC 2474) marking for authenticated inbound IPv6 IPsec traffic. Value must be <= 63.",
        "LetAppsAccessContacts_UserInControlOfTheseApps",
        "A method to disable sideloading LOB applications",
        "AutoShareServer",
        "NICName",
        "ProtectKeyWithTPM",
        "WINSTATION_CONNECT=0x100",
        "One of the following values:  - Disabled: Disable RFC 1323 timestamps.  - Enabled: Enable RFC 1323 timestamps.",
        "MIF.DMTF|DMA|001.3",
        "MaxLifetimeKilobytes",
        "MDM_Policy_Config01_AboveLock02",
        "Example: 1024 X 768 with 256 colors.  ",
        "Dial Up Connections",
        "CIM_DMA",
        "Example: Microsoft Windows Network",
        "MSFT_ExpressionValue_uint16",
        "RSOP_RestrictedGroupExBlocked",
        "MDM_Policy_Config01_SystemServices02",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_home_dir_drive",
        "Event Flag",
        "CD_1C238E1735BD05B8EF9AABB593689748E0D68B3ECED3CA94445FDC58B5AAF1A8.2619.768489710.2169",
        "NS_3FBDCB08ECD33FBEF028D2DB3EF058F8CE959779B943F43AB3DB3EC34ACA147D\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848",
        "Application type of Windows modern app, web application or remote application",
        "Ctxt Flag",
        "Never - This corresponds to OverWriteOutdated = 4294967295. ",
        "PLATFORM_TRACE_RESERVED_09",
        "The number of VPorts currently allocated on the switch",
        "RegistrationKey",
        " 0x080 ",
        "Disables the Receive Side Scaling (RSS) properties on the network adapter.",
        "Supports target element count",
        "Punch",
        "CeeDcbxSupported",
        "The power budget currently configured in this power meter. This value is marked writable. The value will take effect when the instance is saved, but only if Writeable is set to TRUE. Otherwise the save will fail.",
        "PTConv_Trace",
        "Secure Launch",
        "DataPduInOrder",
        "Caption property is a optional feature display name",
        "\\\\.\\root\\Microsoft\\SecurityClient:Win32_ProviderEx.Name=\"AntimalwareInfectionStatusProv\"",
        "StartOffset",
        "C_161D7B1F7DD552C780B6CD4154D40388F29AC0271BBCB7991C59595342903A38",
        "The Comment property specifies the comment of a print queue./nExample: Color printer",
        "The maximum number of switches that can be created on the adapter",
        "MsftDiscFormat2Raw_DebugGeneral Flag",
        "CI_64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41",
        "YResolution",
        "Parallel",
        "Unicode",
        "CD_54C8B2145FBF6DCDCAEFF33B39FBF359799D5087F9B974E853C4A5903604B330.1677.3409521922.344",
        "The unitary computer system.",
        "SMBIOS|Type 23|Timeout",
        "IL_C22F3CC14B7FF9F4D80D447AFE68C087DA4445EEF4656FE00DD99580B53D33A3.1606.3932967909.228",
        "The inherited Name property serves as a part of the CIM_MemoryCapacity object key.",
        "C_CA638CFE13399694BAC2F76CEBB7B08DC881413B47D24732FDCE6DA8A0FBB80C",
        "Represents a crypto suite to propose in main mode.",
        "VerticalResolution",
        "C_15544B0DAFDF759BD10B745F7A926F46821115EF3BE25FE076FC3A533C317B2D",
        "CD_55795F81C8422B8993E279C97F35D31AD4DD7851F75BE99F367F8BA09963EB67.1533.4017663126.552",
        "CurrentGroup",
        "VirtualizeLoopbackAddressesEnabled",
        "_DH_WMP_DRM",
        "Add a connection to the session",
        "An array of free-form strings providing more detailed explanations for any of the video BIOS features indicated in the Characteristics array. Note, each entry of this array is related to the entry in the Characteristics array that is located at the same index.",
        "Warning",
        "The KernelDumpOnly property indicates whether only kernel debug information will be written to the debug log file. /nValues TRUE or FALSE. If TRUE, then only the state of kernel is written to a file in the event of a system failure. If FALSE, the system will try to log the state of the memory and any devices that can provide information about the system when it failed.",
        "The FileID of the Win32_FileSpecification representing this translators setup dll.",
        "Invalid printer name",
        "The DeviceID property DeviceID is an address or other identifying information which uniquely identifies the USBHub.",
        "AllowDoNotTrack",
        "AutomaticVMActivationLastActivationTime",
        "PassThroughNamespace is the WBEM namespace that contains the proprietary storage provider classes.",
        "SIR (serial infrared)",
        "UseBiometrics",
        "Control",
        "tter fq",
        "Port Number",
        "22     This device is disabled. ",
        "The SettableParityCheck property indicates whether parity checking can be set for this serial port (if parity checking is supported). ",
        "Maximum time in milliseconds, that a Device can run in a \"Quiesced\" state. A Device's state is defined in its Availability and AdditionalAvailability properties, where \"Quiesced\" is conveyed by the value 21. What occurs at the end of the time limit is device-specific. The Device may unquiesce, may offline or take other action. A value of 0 indicates that a Device can remain quiesced indefinitely.",
        "This method is used to generate a defrag analysis for the volume.",
        "ref:CIM_CurrentSensor",
        "This property corresponds to PowerUtilizationModesSupported property of CIM_PowerUtilizationManagementCapabilities. See CIM_PowerUtilizationManagementCapabilities.PowerUtilizationModesSupported for details.",
        "The TcpipNetbiosOptions parameter specifies a bitmap of the possible settings related to NetBIOS over TCP/IP.",
        "C937FF2960366D3679AB8F23C7A6B508B41E35226B8C5FD67AC45163D3C64350",
        "ProcessorSpeed",
        "L2CAP Flag",
        "The Antecedent property references the session established to connect to the shared resource.",
        "{A998F9B4-E3D4-11d2-8601-0000F8102E5F}",
        "DeviceInterfaceGuid",
        "Option Rom Version",
        "3:ACTION C ",
        "BootConfig",
        "PageIn",
        "TimesFailed",
        "Example: M3.",
        "Specifies the path to XOML defined Workflow.",
        "{424721e1-4662-4828-ba3a-f354dd170c96}",
        "The UnjoinDomainOrWorkgroup method un-joins or removes a computer system from a domain or workgroup.  This method is only available on Windows 2000 platforms and beyond. The method can return the following values:",
        "The CIM_ReplacementSet.",
        "PolicySourceLPTPortMapping",
        "CIM_DesktopMonitor",
        "NumberOfTracks",
        "CR_FBBE075DD8BF09CF56F5E18528E64829DF169227E061EAB31220ED102922500C",
        "iSCSI Portal Info",
        "SidTypeInvalid",
        "The DeviceID property contains a string that uniquely identifies the cache represented by an instance of Win32_CacheMemory.",
        "__UPDATE_QUALIFIER_CONFLICT",
        "NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic",
        "Indicates if UDP checksum offload is currently enabled for IPv6 packets on this Adapter.",
        "NlServerAuth_Start",
        "Information on the parity setting for transmitted data. No parity (value=1), even (2) or odd (3) can be specified.",
        "The HelpFile property contains the help file for this printer driver, (example: pscrptui.hlp).",
        "SetProfilePath",
        "The ReportSetMarks property specifies whether setmark reporting is enabled. Setmark reporting makes use of a specialized recorded element that does not contain user data. This recorded element is used to provide a segmentation scheme. This segmentation scheme is hierarchically superior to filemarks. Setmarks provide faster positioning on high-capacity tapes.",
        "Sets the power state of the Device. The use of this method has been deprecated. Instead, use the SetPowerState method in the associated PowerManagementService class.",
        "MsftDiscFormat2RawCD",
        "PackedXml",
        "C_896B6F9A9E07C666B49D000879A54E67F9CE0EAF2B8B7EF7BCA31E7303EC222A",
        "ConfigurationData",
        "This flag shall store the credentials for the VPN Connection to the credman after first successful connection.",
        "This parameter is the directory where the volume is to be mounted.",
        "Number of ports starting from the DynamicPortRangeStartPort for dynamic port range.",
        "Values: TRUE or FALSE. If TRUE, ErrorAddress contains a system-level address.",
        "GetDiagnosticInfo",
        "NdisReserved2",
        "{5ec10362-a61a-11d0-8dd4-00c04fc3358c}",
        "MSiSCSIInitiator_IKEPresharedKeyAuthenticationInfo",
        "SystemConfig_V0_CPU",
        "__RELPATH",
        "Exposes methods for reading and writing Printer NFC tags.",
        "{C63BAA94-DB32-11d2-85FC-0000F8102E5F}",
        "{8502C4F7-5FBB-11D2-AAC1-006008C78BC7}",
        "Number of virtual ports on this adapter.",
        "Deduplication event type class used to describe the actual event.",
        "RuleGroup",
        "Media type of this storage tier",
        "If TRUE, this application may be displayed in the ARP applet.  If FALSE, it will not be displayed in the applet.",
        "AvailableSecurityProperties",
        "RS-423",
        "IR_6A6B9E2BBE3244917A6F8976955E1E6E04DDACCE833988626D557DC094A5D1C2",
        "ClockType",
        "Migrating",
        "The SupportsDisconnectData property indicates whether the protocol allows data to be disconnected across the network.",
        "The specified CHAP secret is less than 96 bits and will not be usable for authenticating over non ipsec connections.",
        "SCSI Serial Bus Protocol-2 (1394)",
        "Trace Guid",
        "9 - Authentication succeeded",
        "Monarch-Envelope",
        "PackageUrl",
        "ACQUIRE_FOR_MOD_WRITE",
        "Impersonation",
        "DurableHandleV2TimeoutInSeconds",
        "PolicySourceDefaultToClientPrinter",
        "Separate syncs are supported",
        "bits   5:  0 = Normal Relibility, 1 = High Relibility. ",
        "The remote machine port the SA applies to, or 0 for all ports.",
        "iSCSIName",
        "MFTRecordCount",
        "File Name",
        "The Recursive input parameter is a boolean that indicates whether the security permissions will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input para",
        "The scoping ComputerSystem\\'s CreationClassName.",
        "Threads represent the ability to execute units of a process or task in parallel.  A process can have many threads, each of which is weak to the process.",
        "Log represents any type of event, error or informational register or chronicle. The object describes the existence of the log and its characteristics. Log does not dictate the form of the data represented or how records/messages are stored in the log and/or accessed. Subclasses will define the appropriate methods and behavior.",
        "DoNotUpdate",
        "FullScanAndManualStepsRequired",
        "3221232506",
        "File Information",
        "CreateOnExisting",
        "Win32_PnPDevicePropertyString",
        "R_C5E17D61729E7377496CB88367D8A18CD6A24A14E576524968A24894CCE3FA5F",
        "Ndis80211Privacy",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.1143516498.368",
        "Delayed Auto-Start",
        "LogFlagError Flag",
        "The Description property describes the on-board device and is filled by the manufacturer of the device.",
        "FallbackPrintDriverType",
        "C_5A7FDF4BD2E1212A8A01E74B4FDC157480285641E8AADC2FDCB8D0A2D1720315",
        "ReferenceFile",
        "CostedNetworkBehaviorBackgroundPriority",
        "Boolean indicating that the alarm is audible. ",
        "Specifies the ID of the print job to delete.",
        "1.0.0.0",
        "RestrictedSitesZoneTurnOnProtectedMode",
        "Updates the dynamic keyword address.",
        "object:MSNdis_PMCapabilityState",
        "{3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c}",
        "NtLmV2",
        "CD_DC27C286F2A3847C59A7DE34D71C7D711789AC9856A6490D5B105789D8070BD5.1543.3416818442.397",
        "NdisHardwareStatus",
        "ThreadPool",
        "{C2225311-00A1-47FC-B163-49006EDFD693}",
        "Queued",
        "Server-Override",
        "WSP_HealthActionEvent",
        "Monitor's bandwidth in megahertz. If unknown, enter 0.",
        "This parameter allows the user to specify the FriendlyName at the time of the volume creation. FriendlyNames are expected to be descriptive, however they are not required to be unique. The filesystem's label will be set to this friendly name.",
        "Videos",
        "The path to the package that is to be admined",
        "Win32_ApplicationCommandLine",
        "I_6F81082C846AC0017D1A9842210D9B991E25C88C600008415AF922EE372AE131.1067.1029015456.298",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_SUPPORTS_MULTICAST",
        "WmiPerfClass",
        "Reserved as Pool Contributor",
        "Win32Registry|Software\\Microsoft\\WBEM|Installation Directory",
        "\"Stopping\" describes an element being brought to an orderly stop. ",
        "Flag to indicate whether this SOM blocks inheritance of policy from other SOMs higher in the SDOU hierarchy",
        "iScsiFlagIsr Flag",
        "SM_ScsiReadCapacity",
        "Ethernet Address",
        "MSNdis_AtmSupportedAalTypes",
        "Statistics",
        "TotalPageFaultCount",
        "Contains the key to be created. The CreateKey method creates all subkeys specified in the path that do not exist. For example, if MyKey and MySubKey do not exist in the following path, CreateKey creates both keys: ",
        "NS_E0090746586FF2B53E60090572D8F454B1EFCE84D6470FDDC572C5F523A110EF",
        "Controls whether the service publishes its WSDL at the address controlled by the HttpGetUrl attribute.",
        "MSFT_HealthRecordUInt64",
        "CD_C6877D93883C0A287546253E157907791BC6A0C92D8F12064B0617A40E589308.1533.4057702091.3922",
        "WHERE ExternalReferenceDesignator='#'",
        "The ActionID property is a unique identifier assigned to a particular  action for a software element. ",
        "Relocating",
        " The CIM_SoftwareElementVersionCheck class specifies  a type of software element that must exist in the environment. This check can be for a specific,  minimum, maximum or a range of versions. To specify a specific version the lower and upper versions must be the same. To specify a minimum the lower version  needs only be specified. To specify a maximum version the upper version needs only be specified. To specify a range both upper and lower version need to be specified. The details of this checks are compared with the corresponding details found in a CIM_SoftwareElement object referenced by an CIM_InstalledSoftwareElement association for the CIM_ComputerSystem object. As long as there is at least one CIM_SoftwareElement that satisfies the details of the condition, the check is satisfied. In other words, all the software elements on the relevant computer system do not need to satisfy the condition. There needs to be at least one.",
        "Computer Name",
        "InternetZoneIncludeLocalPathWhenUploadingFilesToServer",
        "PLATFORM_TRACE_RESERVED_0c",
        "FirstElementOffset",
        "{78ebc105-4cf9-11d2-ba4a-00a0c9062910}",
        "AES-GCM-256",
        "IEEE 802.1Qbb Priority Flow Control enabled per Priority.",
        "The IsBusy property determines whether the serial port is busy",
        "FixComments",
        "NeighborUnreachabilityDetection",
        "The LogonType is a numeric value indicating what type of logon session this is. /nSystem - Interactive - This logon type is intended for users who will be interactively using the machine, such as a user being logged on by a terminal server, remote shell, or similar process. /nNetwork - This logon type is intended for high performance servers to authenticate clear text passwords. LogonUser does not cache credentials for this logon type. /nBatch - This logon type is intended for batch servers, where processes may be executing on behalf of a user without their direct intervention; or for higher performance servers that process many clear-text authentication attempts at a time, such as mail or web servers. LogonUser does not cache credentials for this logon type./nService - Indicates a service-type logon. The account provided must have the service privilege enabled./nProxy - Proxy logon. This logon type is not supported./nUnlock - This logon type is intended for GINA DLLs logging on users who will be interactively using the machine. This logon type allows a unique audit record to be generated that shows when the workstation was unlocked. /nNetwork Cleartext - Windows 2000: This logon type preserves the name and password in the authentication packages, allowing the server to make connections to other network servers while impersonating the client. This allows a server to accept clear text credentials from a client, call LogonUser, verify that the user can access the system across the network, and still communicate with other servers. /nNew Credentials - Windows 2000: This logon type allows the caller to clone its current token and specify new credentials for outbound connections. The new logon session has the same local identify, but uses different credentials for other network connections. /n",
        "The Msft_WmiProvider_OperationEvent event class is the root definition of all WMI provider events.A provider operation is defined as some execution on behalf of a client via WMI that resultsin one or more calls to a provider executable, The properties of this class define the identity of the provider associated with the operation being executed and is uniquely associated with instances of the class Msft_Providers. Each instance of __Win32Provider can have an associated operation and be identified using the properties below. Internally WMI can contain any number of objects that refer to a particular instance of __Win32Provider since it differentiates each object based on whether the provider supports per user or per locale instantiation and also depending on where the provider is being hosted. Currently TransactionIdentifier is always an empty string. ",
        "TcpChecksum",
        "C_73D523E5D8422D25C3616043387358F30734A705AA52BC4685A9ACF44AAE4050",
        "C_B449E4C982007699901F8B11448557481BCA2B35C4809156A6C3E1390C860FE7",
        "Indicates the power supply's input voltage range measured by the associated sensor. Range 1, 2 or both can be specified using the values 2, 3 or 4, respectively.",
        "IsCommandPresent",
        "1:ACTION A ",
        "I_133AE77889577C41679A67ADB2FE6AD9A47EDBC4C9E19AA735345C392697BF03.522.1.61884",
        "SetInfoTrustedDom_Start",
        "The CliConnection class defines parameters to be used with the owning alias when establishing the connection to the namespace on which the Alias will operate. If one of the connection properties is not specified it should default to the current value for that property for the utility session.",
        "5 - 'Predictive Failure': indicates that the subsystem is functioning nominally but predicting a failure in the near future. ",
        "Persistent",
        "Service Must Not Be Started",
        "Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwStartType",
        "MSFT_NetAdapter_RdmaMissingCounterInfo",
        "Severe errors that need logging",
        "SecurityAuthentication",
        "Returns the VPN connection DNS trigger properties, DNS suffixes and their corresponding DNS servers",
        "R_2A9212E5C5A3E7B6904A9AD5755292499E2868895335A7FB104CA7C39F4970DA",
        "PCI-X Mode1 66MHz",
        "Master Abort",
        "Block Count",
        "NTLM Security Protocol",
        "Values: TRUE or FALSE. If TRUE, parity checking is enabled.",
        "{5ec10365-a61a-11d0-8dd4-00c04fc3358c}",
        "Registration Update",
        "The system stability index value",
        "This class represents a static power supply on the system",
        "EVENT_TRACE_FLAG_SETEA",
        "CurrentLinkSpeed",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardName",
        "C_62D05C4ECF40774F04063E6FDE0B1A6CE4B671271358A09E1596B6EBA1E2DD4A",
        "An association between a FileSystem and the StorageExtent where it is located. Typically, a FileSystem ResidesOn a LogicalDisk.",
        "WD_LOG_FLAG_EVENT Flag",
        "CR_E9D1340FA30260FE6DC9A13A7C426F447F5CFE8119285A157042BB8CB324B46E",
        "RestoreDefaults",
        "MaxRecvDataSegmentLength",
        "{8502C519-5FBB-11D2-AAC1-006008C78BC7}",
        "User friendly name of this policy object",
        "The GPT guid of the disk. This property is only valid on GPT disks and will be NULL for all other disk types.",
        "MIF.DMTF|System Cache|003.5",
        "MGR_TRACE_FUNCTION",
        "AllowWiFi",
        "RegisterByUser",
        "object:MSFT_CliConnection",
        "Specifies the TCP ports for filtering",
        "TransactionIdentifer",
        "I_7098BC90F08FB4F9DD6C8351961F1423D74E36F9FFA01C9012DB19053495EECA.1620.2108318268.186",
        "DisableArchiveScanning",
        "Whether to require Authentication.  NoEncapsulation means that authentication is still required, but only once at the beginning of the traffic flow, instead of on every packet.",
        "PolicySourceEncodeImageQuality indicates whether the property EncodeImageQualityis configured by Server (0),Group Policy (1).",
        "TcpIp Copy/ACK",
        "The Msft_WmiProvider_AccessCheck_Post event class represents an event generated immediately following completion of the provider's implementation of IWbemEventSecurity :: AccessCheck.",
        "A free-form string that represents the status of the job. The primary status is reflected in the inherited OperationalStatus property. JobStatus provides additional, implementation-specific details.",
        "IL_B2979C83544972870A2ECB51F3135158FBB5ECEB65EE0B9FDCFBAD64445743A0.2680.2462356620.290",
        "0xD011 - 'Not Ready': In Windows-based storage subsystems, this indicates that the object is not ready.",
        "The OBJECT IDENTIFIERs (OIDs) identifying the supported capabilities of the server",
        "CD_D13827DA0ED443FFD82DBB415FC1698F7DC60C2E8774ABDA878946AA14F41C91.2437.2929810970.4998",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_DBCD4213014601A293AABE7F4277D0A7FEC9623E379CDC7AA6A9EE60BBE340D35200",
        "Indicates the capacity of the storage pool. If the pool is primordial, this is the sum of all the healthy physical disk sizes. If the pool is concrete, this is the sum of all associated physical disks (except hot-spares, and including failed drives).",
        "Specifies whether or not the client should operate in a downgraded mode and which version should be used.",
        "The maximum bandwidth of the Port in Bits per Second.",
        "The MonitorType property indicates the type of monitor. ",
        "The Pause method pauses a job in a print queue. If the job was currently printing, no other job will be printed. If the job wasn't printing yet, another unpaused print job may begin printing. The method can return the following values:",
        "PolicySourceDirectConnectLicenseServers property is deprected.",
        "18 - Smartcard Required - Windows 2000: Requires the user to log on to the user account with a smart card.  ",
        "ChassisSKUNumber",
        "CR_18A46D7BB56A85A77A8B14FC7C4A83D15E2F885E67C71399BAA10EFBE87C920E",
        "ref:CIM_PhysicalMedia",
        "The GuaranteesSequencing property indicates whether the protocol guarantees that data will arrive in the order in which it was sent. Note that this characteristic does not guarantee delivery of the data, only its order. ",
        "The Use property indicates how the memory is used in the computer system.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2065.2755160865.368",
        "80386",
        "Constraints: Maximum 32 characters",
        "Resync Replica",
        "ContextUser",
        "SupportedRevision",
        "Schema version (major, minor, build, revision)",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"SystemConfigurationChangeEvents\"",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_D341FCEF2DB25B0BD9A420247A558AF86FF883E9F4AB35114C795D1EE77C1047",
        "Critical Write Failures",
        "Describes the modulation scheme of the modem.",
        "CD_410A129DDF9C5559586E57FD96A9E962121A44EE9BB4B632CAC4A1E45DD8F6B4.16.1352257118.600",
        "Specifies the paper size the printer should use by default.",
        "Bid2Etw_DBNETLIB_1",
        "50000",
        "SamEnumUsersInDom_Start",
        "8)N %",
        "The LowThresholdOnClientObjects property specifies the rate at which WMI will start to slow the creation of new objects created for clients. To accommodate speed differentials between providers and clients, WMI holds objects in queues before delivering them to consumers.. If the rate of requests for objects grows out of control, WMI gradually slows down the creation of new objects to match the client's rate of use. This slowdown starts when the rate at which objects are being created exceeds the value of this property. The slowdown continues until equilibrium is achieved, or the high threshold is reached.",
        "10BaseT",
        "ServiceAccessPoint.InfoFormat",
        "Trace Flag",
        "{8116a35d-671e-47b2-bcf6-1a43b7ec8b4a}",
        "UtcConnectionReport",
        "WPD FSDriver Trace",
        "Example: On Board Device 1",
        "Specifies the authentication method to be used for the VPN connection. Available methods include PAP, CHAP, MSCHAPv2, and EAP.",
        "Number of PDU transmitted via ethernet port",
        "CIM_ERR_FILTERED_ENUMERATION_NOT_SUPPORTED",
        "CSwitch_V3",
        "Back-end only",
        "    </asmv2:hash>",
        "Supplies the setting for sleeping on media disconnect. If this property is Enabled, then the adapter may enter a low power state on a media disconnect event.",
        "Storage Health report generated for the current state of the MSFT_Volume.",
        "The DSRSensitivity property specifies whether the communications driver is sensitive to the state of the DSR signal. ",
        "FreeSpacePercent",
        "The scoping System's Name.",
        "NamedPipeTransportBindingElement",
        "Thread Create/Exit Event",
        "2 - Connected",
        "Mount Manager Trace",
        "The AM Engine version (major, minor, build, revision)",
        "8251 Compatible",
        "The AdapterDACType property indicates the name of the digital-to-analog chip (DAC) used in the adapter.  ",
        "UserStackLimit",
        "MSFT_ReplicationCapabilities.SupportedReplicationTypes",
        "VerticalRefreshRateDenominator",
        "If this service fails to start during startup, the ErrorControl parameter passes the severity of the error. The value indicates the action taken by the startup program if failure occurs. All errors are logged by the system. The system does not notify the user of \"Ignore\" errors. With \"Normal\" errors the user is notified. With \"Severe\" errors, the system is restarted with the last-known-good configuration. Finally, on \"Critical\" errors, the system attempts to restart with a good configuration.",
        "// included in the system eventlog. This is useful as the iscsilog.h",
        "Legal",
        "The SIDType property contains enumerated values that specify the type of security identifier (SID). SIDTypes include:",
        "CIM::Core::Capabilities",
        "PrivacyNoticeVersion",
        "NT Number",
        "The statistics setting data for the network adapter.",
        "\\\\.\\root\\Microsoft\\Windows\\Storage\\Providers_v2:__Win32Provider.Name=\"mispace\"",
        "LoaderBaseEvent",
        "Durable",
        "NTLM (user as principal)",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|SpeakerModeSetup",
        "Win32_DuplicateFileAction",
        "Deduplication feature is not available",
        "The command line options for the upgrade.  These should be in the form of property=setting",
        "__TimerNextFiring",
        "Specifies the number of write operations performed by all processes that have ever been associated with the job, in addition to all processes currently associated with the job.",
        "_ESS_ Flag",
        "SynchronousDispatch",
        "Identifies the available character sets for the output of text related to managing the Printer. Strings provided in this property should conform to the semantics and syntax specified by section 4.1.2 (\"Charset parameter\") in RFC 2046 (MIME Part 2) and contained in the IANA character-set registry. Examples include \"utf-8\", \"us-ascii\" and \"iso-8859-1\".",
        "Example: Microsoft Corporation.",
        "SMBIOS|Type 0|System BIOS Major Release",
        "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE",
        "{DC1D8140-DB30-11d2-85FC-0000F8102E5F}",
        "Ikev2",
        "CIM_ERR_QUERY_FEATURE_NOT_SUPPORTED",
        "{55A2DC30-DB32-11d2-85FC-0000F8102E5F}",
        "DisableStatefulFtp",
        "DefBlockExemptRateLimitBytesPerSec",
        "The Terminator property contains the string that marks the end of a command string.",
        "PLATFORM_TRACE_RESERVED_08 Flag",
        "PeakJobMemoryUsed",
        "CIM_DNSProtocolEndpoint",
        "The Manufacturer property in-",
        "\\\\.\\root\\CIMV2:__Win32Provider.Name=\"MSVSS__PROVIDER\"",
        "ServeDistributedCachingPeersOnBatteryPower",
        "WSP_DiskToStorageReliabilityCounter",
        "Supplies the type of offload.",
        "Activate",
        "SupportBudgeting",
        "C_B18A79A265A485271ADF7583A11B74126B27D0421B9B453C88A99D39E80DF5B2",
        "Archive file name already exists.",
        "The IPv6 address that this portal / endpoint uses.",
        "MSFT_NetServiceFilter",
        "NDIS 802.11 Base Service Set Identifier list. This is a list of all BSSID in range, their SSID and RSSI.",
        "ServicePhilosophy is an enumerated, integer-valued array that indicates whether the frame is serviced from the top (value=2), front (3), back (4) or side (5), whether it has sliding trays (6) or removable sides (7), and/or whether the frame is moveable (8), for example, having rollers.",
        "{977E36CA-DB2A-11d2-85FC-0000F8102E5F}",
        "The maximum lifetime, in seconds, for SA's created by this rule across the forwarding path.",
        "Bid2Etw_MSDAREM_1_Trace_TextA",
        "Availability of the IRQ.",
        "The index that identifies the network interface. This index value may change when a network adapter is disabled and then enabled, and should not be considered persistent.",
        "The LoadPercentage property specifies each processor's load capacity averaged over the last second. The term 'processor loading' refers to the total computing burden each processor carries at one time.",
        "{72891EE8-C088-4331-9745-5BF4AA7B344D}",
        "10 - Windows Server 2003, Web Edition",
        "// This class uses PDO instance names with a single instance.",
        "Deduplication Tracing Event class used to group related events.",
        "Associates a main mode rule with its filters.  Instances of this class can be traversed and the values in the associated filters can be modified, but instances of this class may not be created or deleted.",
        "ReplacementCopyNumber",
        "Registry",
        "{21A28820-3C4C-4944-AC4F-DA7FEBA21168}",
        "The method returns a 0 if no options are involved.",
        "Current state of local configuration manager.",
        "DirEnum",
        "OldInterval",
        "C_BC4F91591102411312342399DC065D3EC257C15FFCA13E42BB6956DC3F1EDBC3",
        "MSFT_NetBranchCacheDataCacheExtension",
        "Name Subscription",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmYResolution ",
        "The number of bytes received using the IPSEC tunnel mode.",
        "LUAInstall: error 0x00000005 setting flags [{94C00EC1-6E51-447A-87FA-8DF83767C155}]",
        "PrimaryOwnerName",
        "DestFCID",
        "MSFT_NetCompartment",
        "DNSSuffixesToAppend",
        "GetSecureBootBindingState",
        "Blocked_DevQ",
        "Fmifs.dll | Method FormatRoutine",
        "A short textual description (one-line string) for the statistic or metric.",
        "NTLM Server Accept",
        "This method will configure the associated instance of Win32_SoftwareFeature to the specified install state. The method can return the following values:",
        "The qualifiers applicable to this Alias",
        "The command-line arguments for the shortcut.",
        "creationTime",
        "IdleSettings",
        "MI_ERRORCATEGORY_SYNTAX_ERROR",
        "Unregister the current settings location template.",
        "SMBIOS|Type 7|Cache Speed",
        "The BadPasswordCount property indicates the number of times the user enters a bad password when logging on to a system.",
        "CD_9CF93B4CC1BA3A3821CB93A70057B3494ED76B95F0DD947CA799629B3F94C395.1266.3420775221.1185",
        "Number of function keys on the Keyboard.",
        "The Description property provides a description of the alias",
        "Win32API|Process and Thread Structures|STARTUPINFO|lpDesktop",
        "CD_C78AC0FF7EE3F58DB7822FB4C033CAB6C42D54AE8C8F1545E75A7C5FC5C2ABDE.1849.1339191877.593",
        "MeterType",
        "Example: Windows NT Fax Driver",
        "BIOS shadowing is allowed",
        "MEM_CARD is valid",
        "Microsoft iSCSI Initiator: Target Mappings",
        "Socket 939",
        "DeploymentUserData",
        "The thread running in the context of the process.",
        "Enables BranchCache and configures a machine to operate in distributed cache mode.",
        "ProviderOperation_FindConsumer",
        "Win32API|Network Management Structures|SHARE_INFO_1|shi1_remark",
        "Event Guid",
        "The Terminate method terminates a process and all of its threads. It returns an integer value of 0 if the process was successfully terminated, and any other number to indicate an error.",
        " Acme",
        "ConsistencyState",
        "The local filename to which event capture traces will be written to. Only valid when CaptureMode equals SaveToFile",
        "RouteRecord",
        "CD_DB064F6F00AC6B8D3FA5B61DC9E5BA4F856D1F834E95E30D538DC0E3B653D24D.1784.679634973.301",
        "SendUnenrollRequest",
        "NDIS Maximum Packet Total Size",
        "This device is not working properly because the controlling firmware is reporting the resources for the device incorrectly.",
        "MSFC_NPIVLUNMappingInformationEx",
        "SplitIo",
        "Denotes the type of the volume.",
        "The Win32_SecurityDescriptorHelper class provides the basic functionality for converting a security descriptor between three different representations:    1) __SecurityDescriptor   2) SDDL - string representation of a security descriptor   3) Binary representation of a security descriptor",
        "PrivilegeUse_AuditOtherPrivilegeUseEvents",
        "RuleUsage",
        "LockoutRecovery",
        "One or more physical disks use a sector size that is not supported by this storage pool.",
        "CD_A32ED3FB3CFDAAEBC2DED4EED7D1FF0A45801F8552173833B24960BDB076B896.2623.1122905285.1934",
        "CIM_RealizesPExtent",
        "The GridGranularity property indicates the spacing of the grid that windows are bound to on the desktop. This makes organizing windows easier. The spacing is usually fine enough that the user does not notice it.",
        "The ResponseTime property indicates the time elapsed to handle the request.",
        "Association between the security of an object and its group",
        "KCBRundownBegin",
        "HBA_EVENT_PORT_BROADCAST_D04_7",
        "_WMI_TRACE_CLIENT_OPERATIONS_ Flag",
        "This class represents the IO accounting information for a job object.",
        "Win32Registry|HARDWARE\\Description\\System|SystemBiosVersion",
        "VideoMemoryType",
        "Scoped",
        "Close_End",
        "IkeV2",
        "1 - 'Warning': TBD.",
        "This class is used to define the capabilities of the VXLAN encapsulation type supported by a network adapter for task offloads.",
        "If this property is set to TRUE, the partition is not detected by the mount manager. As a result, the partition does not receive a drive letter, does not receive a volume GUID path, does not host volume mount points, and is not enumerated by calls to FindFirstVolume and FindNextVolume. This ensures that applications such as disk defragmenter do not access the partition. The Volume Shadow Copy Service (VSS) uses this attribute on its shadow copies.",
        "StandardDay",
        "MACH Kernel",
        "ExceededNotification",
        "DriverMinorNdisVersion",
        "AMLI Eval Trace Provider",
        "Key of section containing the settings to be checked.",
        "0xD021",
        "FJoinOptions",
        "The XOffXMitThreshold pask",
        "MaximumAveragingInterval",
        "Video memory",
        "TRC_INFO",
        "The power meter this event originated from.",
        "The state of the TCP connection. The value can be: - Closed,  - Listen,   - SynSent,   - SynReceived,   - Established,   - FinWait1,   - FinWait2,   - CloseWait,   - Closing,   - LastAck,   - TimeWait",
        "R_EC31DBAC8296A2F597184183FC259C7595AD4BCCFF23FB0BD832DE414BDE578A",
        "R_6FF6CB589253824DE681EA946AEBFF7061F07B8322E36020A90CC770B8046443",
        "StateUnknown",
        "SMBIOS|Type 23|Capabilites|Boot Option on Limit",
        "WHERE ProcessId='#'",
        "C_189326F4F721F3B084F2B9D28FCA49B5C1A7BD8ADE57D16572A5693E864389B6",
        "IL_53A1DC0DDA2E39C523B626FE8ECD05C37BEC420D592C1BC708D9489C28C35DE9.1066.916608438.262",
        "Slot A",
        "Volume optimization aborted because the storage slab size changed while performing the operation.",
        "The AccessContext property identifies the role this RemoteServiceAccessPoint is playing in the hosting system.",
        "Windows Server 2003, Enterprise Edition",
        "TotalTerminatedProcesses",
        "Indicates if the Adapter supports IPv4 options for receive checksum offload.",
        "{2306fe29-dbf6-11d2-9244-006008269001}",
        "You must specify a sharing protocol for this file share.",
        "MsftDiscMaster2",
        "CertificateEcdsa256",
        "MSFT_NetAdapterHardwareInfoSettingData",
        "previousdata",
        "RequireStorageCardEncryption",
        "errorUnhandled",
        "WmiRefProperty",
        "{480217a9-f824-4bd4-bbe8-f371caaf9a0d}",
        "Time after which to end disconnected session in milliseconds where 0 implies NEVER.",
        "The FileID of the Win32_FileSpecification representing this drivers setup dll.",
        "NdisFddiDownstreamNodeLong",
        "C_1D9A9343F720B6D89833DCA8A7B92F53169B46316C0AEF3756FA68AE0584CC8D",
        "DH Group 19",
        "MSNdis_PMCapabilities",
        "UseCentralLicensingSettings",
        "C_52FA3652DE48FD253CE895AA1E0F7F7869B94D77DBBF33883D1DBCF38C65343A",
        "The InstallDate property is datetime value indicating when the object was installed.",
        "Accounting Data for Kernel Idle States",
        "autoDialDll",
        "The DaylightInEffect property specifies if the daylight savings mode is on. /nValues: TRUE or FALSE.  If TRUE, daylight savings is in effect.",
        "Specifies whether the connection defaults to the standard Windows Authentication if another Authentication package has been installed on the system.",
        "Define the order of sources for downloading security intelligence updates This setting allows you to define the order in which different security intelligence update sources should be contacted. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources in order. Possible values are: 'InternalDefinitionUpdateServer'  'MicrosoftUpdateServer'  'MMPC'  'FileShares' ",
        "TcpMaxDataRetransmissions",
        "PolicySourceLicensingType indicates whether the property LicensingType is configured by Server(0) or Group Policy (1)",
        "Switch",
        "ThreatClean",
        "SlotDesignation",
        "TRACINGRESOURCES Flag",
        "RDMAInOctets performance counter missing",
        "The InternalReferenceDesignator property indicates the internal reference designator of the port. Internal reference designators are specific to the manufacturer and identify the circuit board location or use of the port.",
        "Win32_PageFileElementSetting",
        "LPCDRVR_TRACE_RESERVED_1a",
        "The DeviceID property contains a string that uniquely identifies this motherboard.",
        "This property is a reference to the instance that contains statistical information about the job object.",
        "Media Library",
        "<OrgID>:<LocalID> ",
        "Ticket Renewal Flag",
        "Can be enabled, disabled, or controlled by DHCP.",
        "namingContexts",
        "OBJID Flag",
        "CD_26F2DFA12DD4E238DF19BAA4547B3B8EF9BC62B9AB940056F71629B35FA95FCC.2066.3130761771.4366",
        "SupportsColor",
        "NS_B6791A1CF7802A901B1534CADBB1A0E82FB154100B2BE08AF47386C43CEC462A\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6",
        "The scope of active performance counters in the appdomain.",
        "object:ISCSI_PortalInfo",
        "C_DA8AC0D78FD1B90698550FC0FF5C609171143A2B0FA32F0B779BC5DC2D3441C8",
        "SESS Flag",
        "This property is optional only when the Context property is set to the LocalServer or LocalServer32 server context. The text is registered as the argument against the OLE server and is used by OLE for invoking the server.",
        "Specifies the ID of a print job to restart.",
        "SessionFormatError",
        "Win32_USBController",
        "The MaximumAllowed parameter passes the limit on the maximum number of users allowed to concurrently use this resource. /nExample: 10.",
        "Supports Named Streams",
        "WMIProv",
        "The SampleRate property indicates the rate at which the pointing device is polled for input information.",
        "OverrideBlockRules",
        "C-state dependencies",
        "pipelineName",
        "IL_5DF699F99654C2DBF66C5FDB8987B09A99F1CFAA95812890C5421B937233B9AB.432.1.100514",
        "MessageSecurityVersion",
        "Relates an IPsec rule to its Phase 2 Authentication Set.",
        "CreateStoragePool2",
        "StackWalk_TypeGroup1",
        "#endif // MSFC_HBA_API",
        "CD_4863CCD7EA7AAB9B370DC41C90A9C0EAFEA91FBA205A7BBE9446323C4F6EDFAB.263.743118307.219",
        "MethodNumber",
        "roduct",
        "Startin",
        "59000",
        "MSFT_NetAdapter_VmqFilter",
        "{76DBA91A-5A36-FC80-2CAD-3185532B7CB1}",
        "Property flags of the ETW trace provider.",
        "SaOffloadCapacitySupported",
        "object:MSFT_NetAdapterRssSettingData",
        "The IndexEx property indicates the device instance ID for this POTS modem.",
        "New Processor Idle States Event",
        "The WINSSecondaryServer parameter specifies the IP address of the secondary WINS server.",
        "{791ad191-e35c-11d0-9692-00c04fc3358c}",
        "MIF.DMTF|Video|003.14",
        "Dirty Bit Set",
        "MSNdis_NotifyVcRemoval",
        "This property is set as the result of a method invocation (such as Start or StopService on CIM_Service), or may be overridden and defined as WRITEable in a subclass. The method approach is considered superior to a WRITEable property, since it allows an explicit invocation of the operation and the return of a result code. ",
        "__Event",
        "Win32API|Configuration Manager Structures|IO_INFO",
        "UserProfileProvider",
        "WmiRevertToPolicyBrightness",
        "IP DNS Address Alternate",
        "The ProcessStartupInformation parameter represents the startup configuration of a Win32 process. It includes information about displaying the window, characteristics of a console application, and handling errors.",
        "PackageFullName",
        "The scoping System\\'s Name.",
        "{6c744b0e-ee9c-4205-90a2-015f6d65f403}",
        "CounterType",
        "EVALUATION_MODE",
        "Loss of Pointer",
        "VirtualDiskFriendlyName",
        "MCA_ERROR_MEM_1_2",
        "LogMaxNumberOfRecords",
        "CD_7D60A6BC1BF80C348C255CD9C78A30B16F7F9A390E537387D471354838C57ABA.1983.3584870241.3598",
        "BinaryVersionSupported",
        "RunOnlyIfIdle",
        "MSFT_StorageSubSystem",
        "SamLookupDomInSamSrv",
        "CIM_RemoteServiceAccessPoint.AccessContext",
        "MIF.DMTF|Electrical Current Probe|001.7",
        "seqnum",
        "Name of the operating system instance within a computer system.",
        "Maximum number of kilobytes of memory that can be allocated to a process. For operating systems with no virtual memory, this value is typically equal to the total amount of physical memory minus memory used by the BIOS and OS. For some operating systems, this value may be infinity - in which case, 0 should be entered. In other cases, this value could be a constant - for example, 2G or 4G.",
        "Length",
        "{6515834D-6125-4878-A3A3-6B0A73B809A2}",
        "NumericParameterBaseValue",
        "__User",
        "Version",
        "Example: 1413120",
        "MSFT_CliAlias.FriendlyName=\"OnBoardDevice\"",
        "JIS B3",
        "This class represents per-interface 6to4 Configuration settings.",
        "The number of PDUs a NIC fails to transmit.",
        "MIF.DMTF|Video|003.3",
        "Lpc More Flag",
        "Indicates whether DMA may execute in 'count by word' mode (value=4) or not (value=3).  Also, \"Other\" (1) and \"Unknown\" (2) may be defined.",
        "MS_SM_TargetEvent",
        "AcpiPct",
        "CDDA Accurate",
        "0xC0050069",
        "SessionPoolSnapDCEnd",
        "ReplicationQuorum",
        "Every Day",
        "Disable UEV.",
        "Password",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\PriorityControl|Win32PrioritySeparation",
        "CONNECTION_STATE_DISCONNECTED",
        "RecvIPV6",
        "Disable removable drive scanning.",
        "BFE Trace Provider",
        "Remote Replica Target",
        "_DH_WMP_DEVICES Flag",
        "R_D36BA3ECD67E70A681B6A3C59013CFFFBADE74E531546E307816C80C79F820CF",
        "Microsoft-Windows-QoS-WMI-Diag",
        "2 - 'Unhealthy': Indicates that the subsystem is not functioning due to errors or failures. The subsystem needs immediate attention from an administrator.",
        "PCI add-on card",
        "MaxPendingReceives",
        "iSCSI HBA quick mode IPSEC Statistics",
        "AutoUpdatePolicy",
        "The ProviderOperation_CreateRefreshableObject property indicates the number of calls to IWbemHiPerfProvider :: CreateRefreshableObject.",
        "Drive Problem Type",
        "{8502C4EB-5FBB-11D2-AAC1-006008C78BC7}",
        "CurrentQueueSize",
        "KeyIndex",
        "NDISWMI_TRACE_HWINFO",
        "21 - Use DES Key Only - Windows 2000: Restrict this principal to use only Data Encryption Standard (DES) encryption types for keys. ",
        "An array of Supported Features.",
        "select * from __InstanceCreationEvent where TargetInstance isa \"Win32_NTLogEvent\"",
        "PreventAutomaticDeviceEncryptionForAzureADJoinedDevices",
        "CreatedVirtualDisk",
        "Amount off time spent reading from disk",
        "UdpIp_TypeGroup1",
        "The SerialNumber property indicates the serial number of the volume. Example: A8C3D032",
        "The MaximumMessageSize property indicates the maximum message size supported by the protocol. This is the maximum size of a message that can be sent from or received by the host. For protocols that do not support message framing, the actual maximum size of a message that can be sent to a given address may be less than this value. There are two special values defined for this property:",
        "MSFT_NetBranchCacheCache",
        "Machine connection",
        "AllowRemoteServerManagement",
        "ConnectionState",
        "This method deletes an empty storage pool. If the storage pool contains any virtual disks, these virtual disks should be removed first.",
        "R_DA60DE4570557569315706E8539F2BA1D42DB73DA9542D7DBEAA586346CFF0D8",
        "NOSCount",
        "ProgramId",
        "KCBCreate",
        "This is the GUID value last set by the SetGenerationalGuid method in the MSiSCSI_Operations class.",
        "AllowDateTime",
        "FileIo_Info",
        "This method creates a single volume using the remaining space on the disk.",
        "\"Unknown\" (0) indicates the last requested state for the element is unknown.",
        "NotNull",
        "An association between a computer system and the DMA channels available on it.",
        "Meter Type",
        "The scoping Log's CreationClassName.",
        "BSM Flag",
        "70 - Invalid IP  address",
        "The total number of packets for which data could not be verified. ",
        "{deb45316-71b5-4736-bdef-0a9e9f4e62dc}",
        "BankLabel",
        "DestinationMACAddresses",
        "Quick Fix Engineering.  ",
        "MS_Shutdown_Event_Provider",
        "The family identifier for the SKU used to determine license relationships for add-ons.",
        "NdisPMAdminConfigStateEnabled",
        "DNS namespace which can be a suffix/prefix/FQDN/subnet/any. In order to specify any, the value must be .(dot)",
        "SetByTraceSet",
        "WindowDecode",
        "TrustedSitesZoneAllowFontDownloads",
        "TM_INTRANET",
        "If Trace guid and enabled, indicates the LoggerId to which this Guid is currently logging data",
        "FX_TRACE_REMOTE_INTERFACE Flag",
        "A list of file system paths to Windows Installer transform files used to modify this application's package.",
        "The Win32_TSNetworkAdapterSetting class defines the configuration for Win32_Terminal. This includes capabilities such as Network Adapter, Maximum Connections etc.",
        "PC-98Hireso",
        "Left Handed Operation",
        "PortSupportedSpeed",
        "SamQueryDisplayInfo_Start",
        "Enumeration of Receive queues on a miniport",
        "HOSTPROC_RESERVED_1c Flag",
        "Association between TargetPort and VirtualDisk",
        "ROOT\\Microsoft\\Windows\\Smb",
        "PasswordSize",
        "Specifies the string that appears for DirectAccess connectivity when the user clicks the Networking notification area icon.",
        "A textual description of the CIM_Configuration object.",
        "{bdc67efa-e5e7-4777-b13c-621459657099}",
        "50 Pin Dual Inline",
        "20     Failure using the VxD loader. ",
        "Registry_V0_TypeGroup1",
        "The IKE id payload type specified is not supported.",
        "If MaskingValidInitiatorIdTypes contains the value 1 - 'Other', this field is used to enumerate the other valid initiator id types for this storage subsystem.",
        "CD_F6F37666AE13755FCAE2FDAFEECD2EB4BC3DDE98783C006B41BA49C3F5EA37B1.1571.1.29660",
        "MSFT_NetRoute",
        "DVD-5",
        "0x202",
        "Locale defines the geographic region and/or language dialect to which this Support resource pertains.",
        "Method Parameters Checked - Transition Started",
        "EVENT_TRACE_FLAG_H",
        "6disable specific power management capabilities on the adapter.",
        "TS Client ActiveX Control Trace",
        "select * from WSP_ReplicationGroupStorageDepartureEvent",
        "Service Accepts Stop",
        "ThermalZone temperature information",
        "Total number of write errors that were corrected",
        "Number of slots hosted within the enclosure",
        "DnsSuffixSearchList",
        "Session1",
        "Priority Change Event",
        "SamGetAliasMem_Start",
        "HOSTPROC_RESERVED_19 Flag",
        "Object which contains details for ESC attributes for the security zone.",
        "4&m;4&m;",
        "CIM_LogicalElement is a base class for all the components of a System that represent abstract system components, such as Files, Processes, or LogicalDevices.",
        "0x00400000",
        "ref:Win32_IDEController",
        "VolumeQuotaSetting",
        "Product version information.  ",
        "RebootPending",
        "ConfigureTelemetryOptInChangeNotification",
        "The qualifiers applicable to this Property",
        "65 - Unknown failure",
        "EnableNetbios",
        "{8502C4E7-5FBB-11D2-AAC1-006008C78BC7}",
        "Failed to offline the storage object in Failover cluster.",
        "Error Count",
        "Example: Cache Memory 1",
        "Current number of horizontal pixels.",
        "Processor Control Block Length",
        "7C16C2FE0AF90126FE83C9B098410A7D38A4977B5C5D80E7C5B5.797.1.60719",
        "The Name property indicates the name of the Win32 group account on the domain specified by the Domain member of this class.",
        "{D5C6A3E9-FA9C-434e-9653-165B4FC869E4}",
        "Pinned",
        "AutomaticallySelected",
        "R_112D5871031FA8548B77FA449AA39B2BB51A4848F5CC93A4CF0AC90CF6249BE0",
        "Process",
        "I_7BA06B043DD4F1C4BC3ACB7E4C10A6223E3DA1067522BFF187585B0486BDFDF7.1354.3298274962.380",
        "79 - Invalid security parameter",
        "The name of the user logged in when the detection occurred",
        "3eab588a-a6eb-409e-a287-f18daff7ff26",
        "This field is a string representation of the serial number of the subsystem array.",
        "SentUnicastPackets",
        "SMBIOS|Type 9|Bus Number",
        "CD_D7F3D9E12DEEE204449B9CAA8D3A0464D39F0FE9902E503068BD45CB162CC389.1512.1.8220",
        "The sequence number portion of a sequence identifier for the indication. The sequence context portion of the sequence identifier is provided by the SequenceContext property. The combination of both property values represents the sequence identifier for the indication.",
        "StateRecovered",
        "C12475FF36464179F4.1202.3223302417.1817",
        "An incompatibility has been detect",
        "Name of the ISATAP router.",
        "NameFormat contains the naming heuristic that is selected to ensure that the value of the Name property is unique. For example, you might choose to prepend the name of the port or interface with the Type of ProtocolEndpoint (for example, IPv4) of this instance followed by an underscore.",
        "POINTER_PORT_WMI_TOUCH_SCRENE",
        "TargetStoragePoolObjectId",
        "MDM_Policy_Result01_AppVirtualization02",
        "WDAC BidTrace Configuration.",
        "Map service to endpoint",
        "SAM Add Member To Alias",
        "Win32API|Memory Management Structures|MEMORYSTATUS|dwTotalPageFile",
        "ref:RSOP_IEProgramSettings",
        "Combined In Parallel",
        "MGR_TRACE_RESERVED_17 Flag",
        "x25PadType",
        "The Readable property is a boolean value indicating if the file can be read.",
        "The GetQWORDValue method returns the data value for a named value whose data type is REG_QWORD. ",
        "The RegisterMIMEInfo action registers the MIME related registry information with the system. In the Advertise mode the action registers all MIME info for servers for which the corresponding feature is enabled. Else the action registers MIME info for servers for which the corresponding feature is currently selected to be installed.",
        "MDM_Policy_Result01_InternetExplorer02",
        "SomFilterPutStatus",
        "ref:CIM_LogicalFile",
        "The PortName property identifies the ports that can be used to transmit data to the printer. If a printer is connected to more than one port, the names of each port are separated by commas. Under Windows 95, only one port can be specified. /nExample: LPT1:, LPT2:, LPT3:",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2197.3686679771.180",
        "ServiceCredentials",
        "Within the scope of the instantiating Namespace, InstanceID opaquely and uniquely identifies an instance of this class. ",
        "The inherited Name serves as key of a System instance in an enterprise environment.",
        "HorizontalImageSize",
        "CD_7C2448C779B501004A8AC92BAE296EF71C889D4A4797C480FE572242B6C55673.1526.3014907320.903",
        "CompartmentId",
        "PolicySourceDriveMapping indicates whether the property DriveMapping is configured by Server (0),Group Policy (1), Default (2).",
        "No Additional Information",
        "The lower level storage extent.",
        "ng the USBPortOnHub association.",
        "StateFlags",
        "Last scan source",
        "Is it a framework application",
        "CachedOpenLimit",
        "    VpnTrigger (VpnConnectionTrigger) Specifies Trigger properties of VPN connection.",
        "{A76F5058-B1F0-4622-9E88-5CC41E34454A}",
        "NewThreadQuantum",
        "Unconditionally Generate Recovered Error",
        "IL_DE468BF74FB57C16C2FE0AF90126FE83C9B098410A7D38A4977B5C5D80E7C5B5.797.1.60719",
        "Export_BCCachePackageByStagingPath",
        "Idle - Specified for a process whose threads run only when the system is idle. The threads of the process are preempted by the threads of any process running in a higher priority class. An example is a screen saver. The idle-priority class is inherited by child processes.",
        "Offset",
        "Specifies the location ",
        "Transform",
        "Bid2Etw_MSDAPRST_1",
        "StreamingSupportBranchCache",
        "SetEDURestart",
        "LUAInstall: error 0x00000005 setting flags [{94297043-BD82-4DFD-B0DE-8177739C6D20}]",
        "CD_13D55C842CDBA0C119A52B652E2B026F106F2E9BE68DD61A338E909E5F70C55C.1150.2138500337.1471",
        "0x000080",
        "InUseMFTRecords",
        "PortLun",
        "      ",
        "object:MSNdis_InterruptModerationParameters",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.2197.2023026650.3240",
        "PolicySourceSecurityLayer indicates whether the property SecurityLayer is configured by Server (0),Group Policy (1), Default (2).",
        "LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls",
        "StopOnIdleEnd",
        "String array of available DeviceIDs returned in the order of physical network adapters returned in NetworkAdapterList array.",
        "I_A9B77B6FB8EEFAA0386ECE3D9F763120D7E0B46CF98ACF71EF752F98F67AAC11.428.1.32140",
        "Write Clipboard",
        "{44795700-a61b-11d0-8dd4-00c04fc3358c}",
        "SuffixSearchList",
        "MSNdis_QueryReceiveFilterHardwareCapabilities",
        "OS Processor Id",
        "QueryInfoPolicy2_Start",
        "           // Empty address",
        "Original Request Pointer",
        "UnattendedSleepTimeoutPluggedIn",
        "REDBOOK_WMI_PERF_TIME_READING_DELAY",
        "WPD_TRACE_LEVEL_WARNING",
        "AllowUnsecureConnection",
        "DataXfer",
        "The array entry of the InitialLoadInfo property, that holds the data corresponding to booting the currently loaded operating system.",
        "Association between iSCSIConnection and iSCSITargetPortal",
        "NS_A2A98E75472B9249D4EF445DC9D4C380289067BF73931A828AFBC7CD7964FEBB\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_F41AAB3CE0418D59CCEE78DC6089E8A71443DF08351201B015241ECCC0AF9C70",
        "MSNdis_EnumeratePorts",
        "MapFileDCEnd",
        "{E565CAF2-2B8D-4499-9148-7EBAD978D4EF}",
        "TL_WARN Flag",
        "Category String",
        "object:MSFT_OdbcPerfCounter",
        "CIM_SettingData",
        "LetAppsAccessGazeInput_ForceAllowTheseApps",
        "DSConfig",
        "I_0ED380DCCE5F8BBB4D1AC97ADFE47418E9E71153132861C7AA0B46AF1DD6829F.2723.166470887.283",
        "CD_F7113F6F79893405611B3E0C1184CFF87E4747F2432D2CE16AC2FA972D4FCE30.32.3032063208.491",
        "CIM_USBDevice",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|Default",
        "ConformantStandard",
        "The Access property describes whether the media is readable (value=1), writable (value=2), or both (value=3). \"Unknown\" (0) can also be defined.",
        "The DNSHostName property indicates the host name used to identify the local computer for authentication by some utilities. Other TCP/IP-based utilities can use this value to acquire the name of the local computer. Host names are stored on DNS servers in a table that maps names to IP addresses for use by DNS. ",
        "Msft_WmiProvider_OperationEvent_Post",
        "NotSelected",
        "{637a0f36-dff5-4b2f-83dd-b106c1c725e2}",
        "DisableEnclosureDownloading",
        "object:AntimalwareDetectionStatus",
        "Target Alias",
        "UpdateNotificationLevel",
        "AllowWildcardAction",
        "SetVhdDeviceElement",
        "This enables media change notification traces",
        "MDM_eUICCs_Profiles02_01",
        "DisableKeyProtectors",
        "ClientUserName",
        "Association between FileServer and eligible Volumes for file shares",
        "C_C098D64978468CA957C3D43E75CFA62233296C00D54DABB8ADE5BEA89B9E0A4E",
        "The ArpUseEtherSNAP property indicates whether Ethernet packets follow the IEEE 802.3 Sub-Network Access Protocol (SNAP) encoding. Setting this parameter to 1 will force TCP/IP to transmit Ethernet packets using 802.3 SNAP encoding. By default, the stack transmits packets in DIX Ethernet format. Windows NT/Windows 2000 systems are able to receive both formats. Default: FALSE.",
        "Msft_WmiProvider_ExecMethodAsyncEvent_Pre",
        "\\\\.\\root\\directory\\LDAP:__Win32Provider.Name=\"Microsoft|DSLDAPClassProvider|V1.0\"",
        "SecondaryBusType",
        "PolicySourceMaxResolution indicates whether the propert",
        "Delete Existing Toolbar Buttons",
        "The Comment property specifies the comment of a print queue.",
        "The SupportsRTSCTS property indicates whether Ready To Send (RTS) and Clear To Send (CTS) signals are supported on this serial port.",
        "{ef4109dc-68fc-45af-b329-ca2825437209}",
        "IL_866A032D6B2FE1717CF10787541C36C6A6484D51105E647FF1A0225D5CEBCD96.1475.1829273927.329",
        "MSFT_LocalPrinterPort",
        "If TRUE the file server will support continuously available file shares.",
        "PortId",
        "RequireStrictKDCValidation",
        "CIM_HostedBootService",
        "Installable File System",
        "BaseBoardVersion",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.292.3327434568.188",
        "Previous Client",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_7E6A00AAB8467A7129258A087A168DE70442F1968001FDE8C28653B84A0C1849",
        "8 - 'Clone': create a point-in-time, full copy the source.",
        "Parity checking",
        "A string representation of the disk's hardware manufacturer.",
        "Localized version of RSOP_PolmkrSchedTaskV2Setting for American English",
        "ACCOUNT",
        "_DH_WMP_SYNCWIZ",
        "SizeBytes",
        "CIM_Controller",
        "Unused1",
        "Specifies the name of the printer to be added.",
        "3 for 64 ",
        "{d451642c-63a6-11d7-9720-00b0d03e0347}",
        "NDIS ATM Supported VC Rates",
        "The Description property indicates the full name of the codec driver. This string is intended to be displayed in large (descriptive) spaces.",
        "Localized version of RSOP_PolmkrEnvironmentSetting for American English",
        "The Win32_SerialPortSetting class represents an association between a serial port and its configuration settings.",
        "The DeviceID property contains a string uniquely identifying the infrared device with other devices on the system.",
        "Win32API|Communication Structures|DCB|fOutxDsrFlow",
        "Determines how aggressively to enforce security on outbound traffic.",
        "The LogPixels property contains the number of pixels per logical inch.  This member is valid only with devices that work with pixels (this excludes devices such as printers).",
        "Hard Copy",
        "This class is used to report LSOv2 capabilities on a network adapter.",
        "cswitch",
        "CD_C25AD6A436EAF64345F40DAC491FA65148B33848B9F75EA21BC89509C8ED1C31.305.4198615495.921",
        "Win32_MSIResource",
        "MSIProv",
        "MSNdis_StatusDot11LinkQuality",
        "This method is used to exclude volumes from the chkdsk operation to be run at the next reboot. If not excluded, chkdsk is performed on the volume if the dirty bit has been set for the disk. Note that the calls to exclude volumes are not cumulative.",
        "NetworkDirect capabilities on this adapter",
        "Ndis80211WEPStatus",
        "C_59BB151BFB7474042FE846D38FA0CC3A5BA58498F9DD04AAF5BDB993481B126E",
        "This policy setting allows you to set Teredo to be ready to communicate, a process referred to as qualification. By default, Teredo enters a dormant state when not in use. The qualification process brings it out of a dormant state.",
        "AllowWindowsSpotlightOnSettings",
        "UppercaseLetters",
        "A power supply may have an associated current sensor, monitoring its input frequency. This is described by this association.",
        "WakeDropInstrumentation",
        "WritePolicy",
        "If the voltage (in Millivolts) drops below the value specified by Range1InputVoltageLow property, the UPS will compensate by boosting the voltage using its power source(s).  A value of 0 indicates that the voltage at which boosting occurs is 'unknown'.",
        "Logs the error if it is possible and the system is restarted with the last configuration known to be good. If the last-known-good configuration is being started, the startup operation fails.",
        "IPv4MinSegmentCountSupported",
        "MDM_AppInstallJob",
        "Graphics Accelerator",
        "{45BD8DD2-DB33-11d2-85FC-0000F8102E5F}",
        "Number of Sessions failed belonging to this instance",
        "RemoveMember",
        "PNP_ERROR_LEVEL",
        "Gets the file integrity information for the specified file.",
        "Ndis80211Configuration",
        "Worst case transition latency to enter and exit the idle state [QueryPerformanceCounter units]",
        "This field indicates how many backing physical disks can fail without compromising data redundancy. For example: RAID 0 cannot tolerate any failures, RAID 5 can tolerate a single drive failure, and RAID 6 can tolerate 2 failures.",
        "RD_TRACE_FUNCTION Flag",
        "HOSTILEACTIVEXCONTROL",
        "The DriveType property contains a numeric value corresponding to the type of disk drive this logical disk represents. ",
        "{791cd79c-65b5-48a3-804c-786048994f47}",
        "BlockContent",
        "Identifier for the third party application.",
        "EVENT_TRACE_FLAG_MDLWRITECOMPLETE",
        "OriginalChangeTime",
        "DMTF|ComponentID|001.3",
        "The Win32_LUIDandAttributes abstract class represents a locally unique identifier (LUID) of a privilege and a set of bit flags that indicate the attributes of the privilege, such as whether the privilege is enabled. Each LUID and attributes structure defines the availability of a security privilege for the process. For more information, see LUID_AND_ATTRIBUTES.",
        "UseLinkLocalAddress",
        "QryInfoTrustDom_Start",
        "0 - Success.",
        "{4B82D255-E3CD-11d2-8601-0000F8102E5F}",
        "RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles",
        "{36363AAA-DB36-11d2-85FC-0000F8102E5F}",
        "AccountLogonLogoff_AuditLogon",
        "CIM_PowerManagementCapabilities.PowerCapabilities",
        "This field is a user-settable preference for how many physical disk failures a virtual disk should be able to withstand before data loss occurs.",
        "{f8012701-7e99-49c5-b832-1db8bc4a610d}",
        "The processor that accesses the memory or uses the cache.",
        "Example: 1059045376",
        "SupportsMulticasting",
        "object:BcdElement",
        "PriorityAssignmentTable",
        "For a rule-specific PolicyAction, the name of the PolicyRule object with which this Action is associated. For a reusable PolicyAction, a special value, \\'NO RULE\\', should be used to indicate that this Action is reusable and not associated with a single PolicyRule.",
        "UpperSoftwareElementVersion",
        "File system on the volume.",
        "MSNdis_MediaSupported",
        "CIM_PhysicalComputerSystemView.NumericSensorPrimaryStatus",
        "SAM Delete Member From Group",
        "TreatAsClsid",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.3725407623.180",
        "The ServiceDependencies parameter passes a list containing names of services that must start before this service starts. The array is doubly null-terminated. If the pointer is NULL, or if it points to an empty string, the service has no dependencies. Dependency on a service means that this service can only run if the service it depends on is running.",
        "TPM12",
        "The sensor.",
        "Win32API|Printing and Print Spooler Structures|JOB_INFO_4|pPrinterName",
        "Update",
        "CD_E626C49C2DBDF1D0BDC38FFC05C85B76B4BE8E69CBFD214D5F89F70F619AD6CD.1389.2247690691.132",
        "ThreadFlags",
        "MDM_Policy_Config01_EventLogService02",
        "Queued  - Print jobs are buffered and queued.",
        "Win32Registry|System\\CurrentControlSet\\Services\\Class|PortDriver",
        "CurrentManagementFirmwareRevisionNumber",
        "fResourceName]",
        "DontSyncWindows8AppSettings",
        "SetTimeZoneRedirection",
        "SupportRTSCTS",
        "Win32_NTLogEventUser",
        "Accounts_BlockMicrosoftAccounts",
        "Windows Media Player Trace",
        "R_8A4037032A1E93595308B4A4BD6D8BFAF65C3C979F3304AFFC616809C573E05E",
        "Minimum block size, in bytes, for media accessed by this device.",
        "Override",
        "ForceTunneling",
        "\\\\.\\root\\standardcimv2:__Win32Provider.Name=\"wfascim\"",
        "SMHBA_BIND_TO_WWPN",
        "R_84870D549CA44B59AD67F4C0994509F90F4C2166C2AF214E580B660B1839E23E.1489.823425596.574",
        "CD_349957449457FCB3DC5CC416323F05E6E56083B532266B79EAB7F5AB720C36C1.92.3411141240.633",
        "65008",
        "The SetDefaultTTL method is used to set the default Time to Live (TTL) value in the header of outgoing IP packets. The TTL specifies the number of routers an IP packet may pass through to reach its destination before being discarded. Each router decrements the TTL count of a packet by one and discards the packets with a TTL of 0. Default: 32, Valid Range: 1 - 255",
        "The AutomaticResetBootOption property determines whether the automatic reset boot option is enabled, i.e. whether the machine will try to reboot after a system failure./nValues: TRUE or FALSE. If TRUE, the automatic reset boot option is enabled.",
        "PhysicalExtents",
        "CIM_NFS",
        "68xxx Family",
        "LengthAllowed",
        "R_B449E4C982007699901F8B11448557481BCA2B35C4809156A6C3E1390C860FE7",
        "High+",
        "NdisEncapsulationNotSupported",
        "logout",
        "RemoteMachineTunnelAuthorizationList",
        "MCA TLB Error Event",
        "MSFT_TargetPortToVirtualDisk",
        "The AdapterChipType property contains the name of the adapter chip.",
        "When enabled details about exceptions on the callback are attached to the faults returned to the service.",
        "PLATFORM_ERROR_STATUS is valid",
        "PoolCreate",
        "0xEFFF001B",
        "MDM_EnrollmentStatusTracking_Setup01",
        "MSFT_NetSwitchTeam",
        "R_998F3774EFD99EE364D0E26FD868917690CC4AA071C4ABAB4D58906B9D2FAF38",
        "NETIO_TRACE_EQOS",
        "MSFT_NetLbfoTeam",
        "This class represents a power setting subgroup in the system.",
        "{FAF76B65-798C-11D2-AAD1-006008C78BC7}",
        "TM_WEBPROBE Flag",
        "MSFT_TaskIdleTrigger",
        "The interface type filter applied to the rule.",
        "FaultDomainAwarenessDefault",
        "EnableAuthenticateUserSharing",
        " A device driver started by the operating system loader.",
        "SDDL string describing Remote Machines that are allowed by this rule.  If this is empty, all users are allowed.  If LocalUsers/RemoteUsers/RemoteMachines are specified, then they apply conjunctively, and this is an ''Allow-Bypass'' rule and ProtectionLevel must be set above None (so that authentication is required).",
        "The .ini file key within the section.",
        "WPD_F6 Flag",
        "The Name property contains the name of the printer to which the print job is being spooled.",
        "CD_2BCD1B775A7C921CCA4DF4C5E4916A9787D7BF64C3C7B304FDF5584EE4504E73.2458.4269438112.226",
        "The policy rule within the profile.",
        "{3e0d7b2c-401b-480f-8303-d0c20ea1a7d8}",
        "MSNdis_EthernetMacOptions",
        "CIMStatusCode",
        "ProviderOperation_StopRefreshing",
        "Virtual",
        "Bid2Etw_MSADCO_1",
        "Virtual memory allocations",
        "FeaturesLow",
        "TracingCache",
        "Id that is globally unique for all instances of iSCSI initiators. Use the address of the Adapter Extension or another address owned by the device driver.",
        "CD_73A800D7866C4390667315AF06F93202489C8838112B8D051CF005E872136F01.2099.465073980.4826",
        "EnableSmartScreenInShell",
        "QpcOffsetFromRoot",
        "Enable UI Lockdown mode.",
        "MessageAuthenticationAuditLevel",
        "R_58EBCE462A5C99EEA826226A8DAA39BB4E44016ACD1726174C7DBA9B5E2879BE",
        "This field is the message displayed to the user. %1 should be replaced with the corresponding storage provider's Name field. %2 can be replaced with extra error information.",
        "The InstanceID of the CryptoSet to use for Quick Mode.",
        "RSOP_IEPrivacySettings",
        "Indicates if the Adapter supports RSC for IPv6 TCP packets",
        "The class identifier of a COM server",
        "Bytes written using software Ecp mode",
        "0xD012 - 'No Media': In Windows-based storage subsystems, this indicates that the object has no media present.",
        "SampledProfileInterval_V3",
        "ifHCOutMulticastOctets",
        "PCI Bus Requestor ID at the time of the event",
        "Sets the Home Directory for the machine.",
        "The L3CacheSize property specifies the size of the processor's Level 3 cache. A Level 3 cache is an external memory area that has a faster access times than the main RAM memory.",
        "Requests that the LogicalDevice cleanly cease all current activity (\"Quiesce\" input parameter = TRUE) or resume activity (= FALSE). For this method to quiesce a Device, that Device should have an Availability (or Additional Availability) of \"Running/Full Power\" (value=3) and an EnabledStatus/StatusInfo of \"Enabled\". For example, if quiesced, a Device may then be offlined for diagnostics, or disabled for power off and hot swap. For the method to \"unquiesce\" a Device, that Device should have an Availability (or AdditionalAvailability) of \"Quiesced\" (value=21) and an EnabledStatus/StatusInfo of \"Enabled\". In this case, the Device would be returned to an \"Enabled\" and \"Running/Full Power\" status. ",
        "EOTWarningZoneSize indicates the size, in bytes, of the area designated as 'end of tape'. Access in this area generates an 'end of tape' warning.",
        "Specifies the range, in bytes, to which the last error can be resolved. For example, if error addresses are resolved to bit 11 (i.e., on a typical page basis), then errors can be resolved to 4K boundaries and this property is set to 4000. If the ErrorInfo property is equal to 3, \"OK\", then this property has no meaning.",
        "FrameworkVersion",
        "Rack Mount Chassis",
        "{BCF02FFE-5560-4de2-B419-272918693426}",
        "PFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "The Print Ticket XML defining default print settings for this device.",
        "RegionSize",
        "Specify the maximum percentage of CPU utilization during a scan. This policy setting allows you to configure the maximum percentage CPU utilization permitted during a scan. Valid values for this setting are a percentage represented by the integers 5 to 100. A value of 0 indicates that there should be no throttling of CPU utilization.",
        "CD_3AA1CCF33D8CEFD2B415A45A121A40E7E45802CD4F254AAE61989F4AA8DC738A.30.4178802298.502",
        "C_DAF09917B9CFA8B255E2F8328EEFD54CDCBF643D68C0AC3F94A83078C17C15DB",
        "Stack14",
        "ComputerName",
        "ROOT\\Microsoft\\Windows\\TaskScheduler",
        "HOSTPROC_RESERVED_1d Flag",
        "ISDN BRI Endpoint",
        "First Party Privacy Type",
        "{7552EF7F-7CC8-4022-9049-3B5E1B4B3852}",
        "13 - 'Skewed': The target has been modified and is no longer synchronized with the source element or the point-in-time view. ",
        "Threat execution status",
        "errorRetried",
        "DoActionLogging causes a log message to be generated when the action is performed.",
        "SupportsStorageTierFriendlyNameModification",
        "HBA_FCPBINDINGENTRY",
        "48007",
        "CIM_SystemComponent",
        "Setup",
        "VerticalSyncOffset",
        "C_DFC25D46E8711DD4634FF6390AFD6E0F348F88B4F5FAE966D405DF4EAE83DD54",
        "Returns the VpnConnection object that contains the VpnConnection configuration settings. ",
        "Sets whether the automatic data integrity scanner should scrub files on this volume. ",
        "PA-RISC 7200",
        "FlowControlOff",
        "Example: ISA",
        "Registry_TypeGroup1",
        "The ProcessorType property specifies the processor's primary function.",
        "The BatteryRechargeTime property has been deprecated.  There is no replacementvalue and this property is now considered obsolete.",
        "Describes the manner in which this application ceased to be applied: 1 = not removed, 2 = upgraded, 3 = uninstalled, 4 = Unmanaged.",
        "C_BE3C9A0F3A301859A6C844B2145A4F44B9BD768BEE695F45C60A8F416A0E9077",
        "R_F9C9BF1D438816A18A92B3E8522F73D7F60F0DD6F678D67DAD4AE3DD5EBC727E",
        "ExposedName",
        "IL_614FEB5198DB6356C7D4E70E58F0634936BC6DE530AA5FD952207E56B5A89D3F.1635.3418873694.594",
        "CurrentMacAddress",
        "The target has already been logged in via an iSCSI session.",
        "Specifies the named value whose data value you are retrieving. Specify an empty string to get the default named value. ",
        "Removes one or more existing DSNs from the system.",
        "Win32_PrivilegesStatus",
        "A value of 7 \"DHCPv6\" shall indicate the values were assigned using DHCPv6. See RFC 3315. ",
        "NdPeerNatBoundary",
        "CIM_SettingsDefineCapabilities",
        "This class exposes product-independent properties and methods of the Software Licensing service.",
        "VLActivationInterval",
        "ConnectionPoolSettings",
        "Optical Channel Group",
        "TM_REFOBJ",
        "Customize Animated Bitmaps",
        "Common base class for all Storage Management Provider objects",
        "CscService",
        "NetProtocol",
        "AdapterTypeId",
        "The BIOS stored in the non-volatile extent.",
        "SenseBufferSize",
        "AllowDeviceHealthMonitoring",
        "Set Error Source Info",
        "This event represents a change to RemoteApp settings on this terminal server.",
        "Exclusive",
        "18..32767",
        "The Msft_WmiProvider_ProvideEvents_Pre event class represents an event generated immediately prior to calling the provider's implementation of IWbemEventProvider :: ProvideEvents.",
        "Trace Listener Argument",
        "Data Integrity Scan Required",
        "The WS-ReliableMessaging protocol version used in the reliable session.",
        "rrect Br",
        "This represents a locate element device element.",
        "{D9131565-E1DD-4C9E-A728-951999C2ADB5}",
        "Static Default Gateway IP address",
        "The type of message authentication level that is used to log audit events.",
        "C_60A55C37A891C02E43DCC85CF24FBB0AEC4CE837463192AE3DF9F07B12D58EBF",
        "Whether this power scheme is currently active on the system.",
        "HasClassRefs",
        "SupportedTemplateSchemaVersions",
        "ata instances, to be applied as a 'configuration profile' for an element. ",
        "228B1593D6C5E10185F550FF2997587B5AB69BBBB9891",
        "This parameter specifies the resiliency setting to use as a template for this virtual disk. This property's value should correspond with the particular resiliency setting instance's Name property. Only resiliency settings associated with this storage pool may be used.",
        "LogfileName",
        "The VoltageCaps property specifies the voltage capabilities of the processor. Bits 0-3 of the field represent specific voltages that the processor socket can accept. All other bits should be set to zero. The socket is configurable if multiple bits are being set. For a range of voltages see CurrentVoltage. If the property is NULL, then the voltage capabilities are unknown.",
        "C_81E923C5F7AE79357104AE6BF842B77A8DC803A5873AE34E77FAE62049CD7FEB",
        "Successful Completion",
        "BlockedUrlExceptions",
        "SourceClassName",
        "Package Type",
        "CD_DE89CEAF49F8C74091CFA54D65C5205930932DBBEA319F95370A8BB021E5EAFD.1757.3458635635.413",
        "Framework_Trace Flag",
        "MSNdis_80211_BSSIList",
        "ReadTotalErrors",
        "Trace information from the destructors",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2070.810431740.180",
        "PCI-66MHZ",
        "MsftDiscFormat2RawImage_DebugGeneral",
        "Example: 9600",
        "Source Name",
        "UUUUUUUUUUUUUUUUUU",
        "Removable Media",
        "HBA_PORTTYPE",
        "CIM_LANConnectivitySegment.LANID",
        "Shadow copy provider failure",
        "Radians",
        "The StartFileName input parameter is a string that names the child file/directory to use as a starting point for CopyEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from the",
        "Win32_PnPDevice",
        "CIM_Processor.MaxClockSpeed",
        "IPsecCARestriction",
        "\\,m;\\,m;",
        "Limit Job Time",
        "SetConfigurationSecurityDescriptor",
        "The power supply associated with the voltage sensor.",
        "Installs a print driver into the print server's driver store.",
        "0x00000003 ",
        "MountFailureRetries",
        "Detaching",
        "MIF.DMTF|Electrical Current Probe|001.18",
        "AllowSpeechModelUpdate",
        "    CustomConfiguration (string) Specifies custom configuration used by Third Party VPN plugins. ",
        "The URL update information the product.",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1218.932574012.180",
        "PlusVersionNumber",
        "{8502C581-5FBB-11D2-AAC1-006008C78BC7}",
        "EnableAppUriHandlers",
        "R_EAD7B47A72C4A7A6ADA6E436CA7769B3D175775986737A1D4F283DC99D5BA2FA.2457.1973315924.558",
        "The CTSOutflowControl property determines whether the Clear To Send (CTS) is checked before transmitting data. CTS signals that both devices on the serial connection are ready to transfer data. ",
        "Shutting Down",
        "CIM_SystemDevice",
        "Win32_ODBCAttribute",
        "MSFT_NetBranchCacheClientSettingData",
        "WmiExpense",
        "R_DCE585FC8090201AD2A481DCDA9678ADBEED6FFAAA2CD50925EF913678001533",
        "I_8E23EB78FFAC4A759215B5BD6EC35386D5DAFFB04E17A1E0F3F33C9BDCE81E56.1194.2393799953.283",
        "Out of CPU Cycles",
        "The IPPortSecurityEnabled property indicates whether IP port security is enabled globally across all IP-bound network adapters. This property has been deprecated in favor of IPFilterSecurityEnabled.",
        "Bytes read using channelized Nibble mode (IEEE 1284.3)",
        "The video BIOS element that implements the capabilities described by video BIOS feature.",
        "Format is unknown",
        "The stock keeping unit number for this physical element.",
        "A Windows error object that encapsulates what is in CIM_Error as well as includes error code, errorCategory, errorMessage and errorType.",
        "SeSystemTimePrivilege",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2197.3686679771.180",
        "UevConfiguration",
        "The MTU property overrides the default Maximum Transmission Unit (MTU) for a network interface. The MTU is the maximum packet size (including the transport header) that the transport will transmit over the underlying network. The IP datagram can span multiple packets. The range of this value spans the minimum packet size (68) to the MTU supported by the underlying network.",
        "C_E091E6755173CEDA0C35AF424854DECB26CF90627B78F06DB8E87E6ED8C5E2E3",
        "Win32API|Device Context Functions|GetDeviceCaps|COLORRES",
        "Multicast UUID for device detection for the WSD Port, this parameter can not be specified at the same time with IppUrl",
        "CBDequeue",
        "The date or time when the state of the job last changed. If the state of the job has not changed and this property is populated, it must be set to a 0 interval value. If a state change was requested, but was rejected or not yet processed, the property must not be updated.",
        "Win32API|SCSI Structures|SCSI_REQUEST_BLOCK|ScsiStatus",
        "ID_IPV4_ADDR",
        "Determines the current allocation behavior for this virtual disk. Enclosure aware virtual disks will intelligently pick the physical disks to use for their redundancy. If TRUE, the virtual disk will attempt to use physical disks from different enclosures to balance the fault tolerance between two (or more) physical enclosures.",
        "DefaultMachineName",
        "The RenewDHCPLease method renews the IP address on specific DHCP-enabled network adapters. The lease for the IP address assigned via a DHCP server has an expiration date that the client must renew if it intends to continue use of the assigned IP address. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "An abstraction or emulation of a hardware entity, that may or may not be Realized in physical hardware. Any characteristics of a LogicalDevice that are used to manage its operation or configuration are contained in, or associated with, the LogicalDevice object. Examples of the operational properties of a Printer would be paper sizes supported, or detected errors. Examples of the configuration properties of a Sensor Device would be threshold settings. Various configurations could exist for a LogicalDevice. These configurations could be contained in Setting objects and associated with the LogicalDevice.",
        "CD_FD3BBD4C42AC2F7FEF264340A9EB78A581FE5C28561CB63EDF780B329EAC2EE4.314.2317161516.637",
        "PARALLEL_WMI_LOG_INFO",
        "Adapter Ethernet Maximum Multicast List Size",
        "DefaultDataType",
        "C_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2",
        "The CurrentUsage property indicates the current usage of the system slot.  ",
        "PLATFORM_TRACE_RESERVED_1a Flag",
        "CD_777909665755481973F85E4F05948A22C8B9B138E770DF765F9B0B2561A71FAB.1185.2995586805.289",
        "DTF Cartridge",
        "CaptureLayerSet",
        "The Win32_PhysicalMemory class represents a physical memory device located on a computer system as available to the operating system.",
        "IxWorks",
        "{36851DFE-F0FE-11d2-8617-0000F8102E5F}",
        "Not_null",
        "Indicates which address formats can be inferred by the storage provider and subsystem when working with initiator ids.",
        "UMDF - Reflector Trace",
        "Repeater",
        "C_D03948432DCEFB99FB1EBE3230848319D45009B95943838EC079B34AD2F12F73",
        "CIM_SoftwareElementChecks",
        "IpV6IPsecUnauthDscp",
        "The System object and its derivatives are Top Level Objects of CIM. They provide the scope for numerous components. Having unique System keys is required. A heuristic can be defined in individual System subclasses to attempt to always generate the same System Name Key. The NameFormat property identifies how the System name was generated, using the subclass' heuristic.",
        "TargetProcessId",
        "The trustee representing the group of the object",
        "Processor",
        "Adaptive TokenizedClone Local",
        "WmiQueryReceiveQueueParameters",
        "Profile",
        "DirectedMacWolPattern",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.1130.3648072470.305",
        "ref:CIM_Controller",
        "C_E706FF8586C52A7176ACA48D7702EC2A6550564F0E42B0C09AE3FD1CCEA62CD4",
        "The DiskIndex property indicates the index number of the disk containing this partition.",
        "Sampling period",
        "True if Force Fraud Warning is enabled",
        "Specifies the named value whose data value you are setting. You can specify an existing named value (update) or a new named value (create). Specify an empty string to set the data value for the default named value. ",
        "CR_AC11DDCF9F71868BCCF23A662420DD51F76B4387A8230D6D41F7DBED8D2981ED",
        "Integer value specifying the operating mode.  ) indicates a copy, 1 indicates a move.",
        "NDIS Status Media Disconnect",
        "The web application name, also the shortcut file name",
        "SupportInteractive",
        "HOSTPROC_TRACE_DRIVER Flag",
        "Generic_Warn",
        "ReleaseDate",
        "Name of the matching transport filter",
        "Logger Name",
        "3221232479",
        "EUI64",
        "43012",
        "GetLastRestoreStatus",
        "Set password related settings values",
        "\\\\.\\Root\\Default:__Win32Provider.Name=\"SystemRestoreProv\"",
        "PhysicalDisksToUse",
        "The Setting reference represents the printer configuration settings that can be applied to the associated printer.",
        "PerfInfo",
        "{dbc0ceab-cff3-4c0f-85f2-0c2107142f36}",
        "ProcessorDescription",
        "iSCSI does not support IPSEC for this version of the OS.",
        "ConfigureWindowsSpotlightOnLockScreen",
        "ArpOffload",
        "C_8C64C742C17295C471BDDFBB0449A20033FBA45FC5101E58D4755F4826009F5A",
        "This represents a key-value pair.",
        "CD_8F55F9DEF3426989FE817E17CEEF2E31FFED7183978F9BC99857EF3CAE702C82.138.2616965543.869",
        "I_55BA3B97EE945A5FFAA048F94EB0B1F3BCDC2B26C8F2588BFFB42050A21365DE.337.1.27578",
        "{87B93A44-1F73-EC83-7261-2DFC972D9B1E}",
        "ListOfLanguages",
        "Not applicable (signal sync type must be digital composite)",
        "CR_9B3B36A993A462F50891454718B9E94854BEF6CDA6B45E39722B69B985CF4900",
        "A ProtocolEndpoint that is dedicated to running IP.",
        "R_D191D09F01E11CDE861309DF3A3FD6CFDF2B4DE2CE06D9CD8DA51C330712DAAB.1606.3997140931.596",
        "SPACES_StorageEnclosure",
        "{0a21480b-e35f-11d0-9692-00c04fc3358c}",
        "CIM_InstIndication is an abstract superclass describing changes to instances. Subclasses represent specific types of change notifications, such as instance creation, deletion and modification.",
        "RemoveSetting",
        "The number of active IPSEC tunnels.",
        "LetAppsAccessPhone_ForceAllowTheseApps",
        "OA2xBiosMarkerStatus",
        "WPDCI_feature2",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.10.2207877211.368",
        "The GroupComponent reference represents the properties of the computer system upon which the operating system is installed.",
        "InterleavePosition",
        "EnableByAllApp",
        "NDIS FDDI LCT Failures",
        "Endpoint type",
        "ReferencedSetQueries",
        "Fibre Channel Worldwide Name",
        "The base address of the client.",
        "BlockOutStartTimeHoursMinutes",
        "Create the PrefixPolicy.",
        "Sets the Security layer to one of RDP Security Layer, Negotiate or SSL. The function takes one parameter that specifies the Security Layer: 0 = RDP Security Layer, 1 = Negotiate, 2 = SSL. Note that if current Encryption level = 1, then Security Layer = 2 setting is invalid.",
        "Information that will be gathered from memory when the operating system fails. ",
        "CD_84BBAE9FD8A6E21188B2D0767DBEB321A61D32EF3C67D9E47C565889A9DA260D.2139.1.28036",
        "object:MSFT_NetAdapterLsoSettingData",
        "TEST_TRACE_RESERVED_18 Flag",
        "FILE_APPEND_DATA (file) or FILE_ADD_SUBDIRECTORY (directory)",
        "//        defining MS_SM_HBA_API or MSFC_HBA_API before including this file.",
        "Enables the Receive Segment Coalescing (RSC) properties on the network adapter.",
        "SECURITY Flag",
        "OpenMax",
        "3 - 'Dormant': Indicates that the copy operation is inactive suspended or quiesced. ",
        "Localized version of RSOP_PolmkrProfileSetting for American English",
        "Maximum number of connections, 0 implies no limit",
        "{f9be9c98-10db-4318-bb61-cb0ddea08bf7}",
        "MSFT_CliAlias.FriendlyName=\"IDECONTROLLER\"",
        "Class that represents client-side extensions' Session Status",
        "SupportsVirtualDiskModification",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services|Tcpip\\Parameters\\Interfaces|RawIPAllowedProtocols",
        "XonCharacter",
        "{B4D1C606-8682-4b7a-AC6B-D883D91555FB}",
        "Select * from Win32_PageFileUsage",
        "The relevance of the remote access point and information on its use are described by subclassing RemoteServiceAccessPoint or by associating to it.",
        "HBA_EVENT_PORT_BROADCAST_D16_7",
        "DisconnectIPV6",
        "optional",
        "PolicySourceUseRDEasyPrintDriver",
        "RSOP_PolmkrLocalUsersAndGroupsSetting",
        "SupportsDiskQuotas",
        "ConfigOptions",
        "SERVICE_UNAVAILABLE",
        "Last discovered KMS host port through DNS.",
        "MapViewBegin",
        "LowThresholdOnEvents",
        "TransactionBegin",
        "NumberOfBuffers",
        "CD_68988603F70E94DB41A96D6CCAF4C1247D2A19BC8932E751AE8871C31295C890.2033.4167959155.249",
        "CIM_InstModification",
        "Set9XUserList",
        "CIM_RegisteredSpecification.OtherRegisteredOrganization",
        " .m; .m;",
        "Win32_ShadowOn",
        "TrafficSelectorId",
        "ACPI Bios Processor Information",
        "{c861d0e2-a2c1-4d36-9f9c-970bab943a12}",
        "WSP_PartitionToReplicaPeer",
        "InterpretationOfFalse is a string indicating what a 'False' value from the binary sensor means.  This information could be displayed to a user.",
        "IPv4Transmit",
        "Number of counters",
        "AbnormalTermination",
        "Example: C:\\WINDOWS",
        "object:MSNdis_WmiTcpLargeSendOffloadV2_IPv6",
        "Fan Failure",
        "Maximum block size supported",
        "This contains the raw MCA logs",
        "KernelThermalConstraintChange",
        "SMBIOS|Type 1|System Information|Family",
        "TRACE_CLASS_TIMER Flag",
        "CR_AB6B0E99E53700B220CC98E6FA99632EF2E30AA8973E530FB5000EC341F81DBE",
        "Driver Update Needed",
        "THREAT_FULLSCAN_REQUIRED",
        "NdisHardwareStatusReady",
        "CIM_SerialInterface",
        "CD_49077985F3FCF4259B2FE7EFC831F5599CA91F6DC9D11720E6A401A1DE18B2D2.270.3138366782.649",
        "MS_SMHBA_FC_PHY",
        "ShortcutFolder",
        "Indicates whether an operation returns a reply message.",
        "CIMWin32",
        "   //  contain this type.",
        "A DATETIME value, in string format, that represents the last time this folder was successfully synchronized to the Offline Files cache.",
        "AppPath",
        "If AutomaticiSNSDiscovery is FALSE then this contains the fixed addresses of iSNS servers",
        "3 = Install",
        "The Antecedent reference represents the properties of a system resource available to the logical device.",
        "{E5D8A561-F6C0-11d2-B35E-00105A1F8569}",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1780.1602717935.368",
        "TransportTunnelCombined",
        "LogFlagRefCount Flag",
        "The CreateRestorePoint method creates a restore point.It returns a COM error code.",
        "NdisFddiRingOperationalDup",
        "LocalTime",
        "object:MSFT_DAClientExperienceConfiguration",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.2026.1.14291",
        "IPX not enabled on adapter",
        "TargetPortNumber",
        "WPDNSE_DLLREFCOUNT",
        "Supplies the friendly name of the wake pattern.",
        "Not Allowed",
        "The RevisionLevel property indicates the firmware revision level of the CD-ROM drive.",
        "CD_970DC7308218759AD490467E5E7DDEACBB9B35C9AF8457A911A09ACCC5B3AA93.1779.1383867497.284",
        "Reason",
        "IntranetZoneAllowAutomaticPromptingForFileDownloads",
        "The Attributes property indicates the attributes of the Win32 printing device. These attributes are represented through a combination of flags. Attributes of the printer include:",
        "CloseHandle",
        "HOSTPROC_TRACE_FUNC",
        "MSFT_NetAdapter_EncapsulationTypes",
        "PAGETABLEWRITE Flag",
        "SByte",
        "NumVFs",
        "MDM_Policy_Result01_TaskScheduler02",
        "WmiSetBrightness",
        "C_2E052A2746A43D11BFF3F6205A3F0D292400CF9B8F3DB09F6AD7A671FE848750",
        "MsftDiscMaster2_DebugGeneral",
        "Win32_ShortcutFile",
        "Example: 2159",
        "Count of guids being registered, unregistered, or updated",
        "queryquota",
        "CD_E837FA5B478BEDED44320E3A480DE1EA4A5820B99185EB351156356529FE5C28.66.2877317343.675",
        "I_F41AAB3CE0418D59CCEE78DC6089E8A71443DF08351201B015241ECCC0AF9C70.1617.2645183154.291",
        "TakeOwnership",
        "CD_8DE46DD6446B26621A23E11758AE5CBC62C9F72998CAFB08B9CD58DF66902A20.1150.1044209753.111",
        "NetworkServerModeEnabled",
        "Limit Process Time",
        "A BcdStore is uniquely identified by its file path. The system store is denoted via an empty file path.",
        "LS_CONNECTABLE_VALID_WS08R2",
        "CD_133926115907D1CAA329A707F5DA6057F1FEF2436D8F8041CFE6E68664D6F252.1365.2744259024.2750",
        "Program vendor",
        "R_4AC7D53B353FF907A3871574884AE20E2C77DD82D160B77856929A17F6C699D4",
        "Low Profile Desktop",
        "MaximumTxPartialBufferCount",
        "LinkName",
        "MIF.DMTF|System Slot|004.4",
        "Comment",
        "The description of this port.",
        "Analog Composite",
        "C_A5134EAE65D9DD02F6CE0E924C84D387C2BC76C9409B3E6C9F586619D35EA1DA",
        "SupportedQueueProperties",
        "ErrorArray",
        "Encrypt",
        "17.1.15778",
        "An array of integers defining the type of physical connector. An array is specified to allow the description of 'combinations' of connector information. For example, one array entry could specify RS-232 (value=25), another DB-25 (value=23) and a third entry define the connector as \"Male\" (value=2).",
        "Total width, in bits, of the physical memory, including check or error correction bits. ",
        "IPv6MinSegmentCountSupported",
        "SupportedHostType",
        "MSNdis_VendorID",
        "Cookie",
        "PCMCIA add-on card",
        "The NextHop property contains the IP address of the next hop of this route. (In the case of a route bound to an interface that is realized via a broadcast media, the value of this field is the agent's IP address on that interface.).",
        "NumForwardPackets",
        "The SetPMTUDiscovery method is used to enable Maximum Transmission Unit (MTU) discovery. Setting this parameter to TRUE causes TCP to attempt to discover the MTU (or largest packet size) over the path to a remote host. By discovering the Path MTU and limiting TCP segments to this size, TCP can eliminate fragmentation at routers along the path that connect networks with different MTUs. Fragmentation adversely affects TCP throughput and network congestion. Setting this parameter to FALSE causes an MTU of 576 bytes to be used for all connections that are not to machines on the local subnet. Default: TRUE. The method returns an integer value that can be interpretted as follows: ",
        "Id of the Win32_InstalledWin32Program instance",
        "C_DA60DE4570557569315706E8539F2BA1D42DB73DA9542D7DBEAA586346CFF0D8",
        "To receive an Indication, a consumer (or subscriber) must create an instance of CIM_IndicationFilter describing the criteria of the notification, an instance of CIM_ListenerDestination describing the delivery of the notification, and an instance of CIM_IndicationSubscription associating the Filter and Handler.",
        "The PartComponent reference represents a memory device part of the Win32_MemoryDeviceArray association.",
        "MaxNumberOfPasswords specifies the number of passwords definable in the modem itself. If this feature is not supported, enter 0.",
        "Kerberos Logon User Handler",
        "iSCSI HBA Quick Mode IPSEC Statistics",
        "The SessionId property indicates the id of the session used by the user connected to the computer system. The user may be connected to the system via a local logon or via a terminal session.",
        "Login",
        "MSFT_StorageHealthSetting",
        "BytesReceivedPersec",
        "SetMaxMonitors",
        "PartNumber",
        "Unknown Drive",
        "Bid2Etw_MSDAPRST_1_Trace_TextA",
        "IR_352DA062E6CEF4DA2F5F5D5156A0C6A57E2D07D0BD43F09E3B9B31D33B72076E",
        "Base class for printer ports.",
        "R_161D7B1F7DD552C780B6CD4154D40388F29AC0271BBCB7991C59595342903A38",
        "{C92CF544-91B3-4dc0-8E11-C580339A0BF8}",
        "Specify one or more log modes, such as EVENT_TRACE_REAL_TIME_MODE 0x100.  Each mode is a bit field.   ",
        "The Win32_SystemLoadOrderGroups class represents an association between a computer system and a load order group.",
        "Specifies a bitmask indicating the baud rates that can be used",
        "DomainControllerAddress",
        "EVENT_TRACE_FLAG_ACQUIREMODWRITE",
        "The ID property uniquely identifies the shadow copy on the system.",
        "Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|HandleCount",
        " Decimal ",
        "Multimedia Mail over IP",
        "CD_BEAC6077B19FEAE9A9DA302629391F9E0FFBBEB033EB1ABEA99A1F0843A415BA.1757.1026585916.219",
        "IsPublishedGlobally",
        "SAM Lookup Domain In SAM Server",
        "DevicePasswordHistory",
        "The desired number of full data copies to maintain. This value must be between NumberofDataCopiesMin and NumberofDataCopiesMax.",
        "V1_DriverMajorFunctionCall",
        "ref:MSFT_StorageNode",
        "LS_CONNECTABLE_BETA_RTM_MISMATCH",
        "Out of memory",
        "IL_F90254E7F99DA09977CCA3AFC876E2F69B143A5C7B620A38194806CCC0551447.810.1.92690",
        "PCI-X",
        "IL_8E80D45658E49966FC3BA567F2C75690AE48EBAB9A2568429675180214107ACE.313.2989851214.331",
        "The logical size of the virtual disk measured in bytes",
        "This class is used to report PacketDirect capabilities on a network adapter.",
        "MinNumberNeeded",
        "PCI-X Mode2 533 133MHz",
        "SeShutdownPrivilege",
        "IL_662CB144681343CD914A84B6324D30356940F0E892AC14E72E79452BFD8511B8.675.1.129842",
        "The ModemInfSection property indicates the name of the section in the modem's .inf file that contains information about the modem.",
        "WNFNameSubRundown",
        "2.9.0",
        "EnableNap",
        "MSNdis_ReceiveFilterGlobalParameters",
        "C_D6B832D04D0FAB582A050E5212201E6DF3C06194D4D96931CCBF8B3053F5A8AF",
        "A string representing the name of the management server. This value is only relevant for Storage Management Providers that implement the SMI-S standard.",
        "A cookie is a value contained in a received IKE message that is used by IKE to find the state of an active main mode. A cookie in a received IKE message that cannot be matched with an active main mode is invalid.",
        "The Parameters property indicates optional parameters to send to the print processor. See the PrintProcessor member for more information.",
        "xMEM_DEVICE",
        "IrqNumber",
        "This class represents the directory layout for the product. Each instance of the class represents a directory in both the source image and the destination image. Directory resolution is performed during the CostFinalize action and is done as follows: Root destination directories: Root directories entries are those with a null Directory_Parent value or a Directory_Parent value identical to the Directory value. The value in the Directory property is interpreted as the name of a property defining the location of the destination directory. If the property is defined, the destination directory is resolved to the property's value. If the property is undefined, the ROOTDRIVE property is used instead to resolve the path. Root source directorires: The value of the DefaultDir column for root entries is interpreted as the name of a property defining the source location of this directory. This property must be defined or an error will occur. Non-root destination directories: The Directory value for a non-root directory is also interpreted as the name of a property defining the location of the destination. If the property is defined, the destination directory is resolved to the property's value. If the property is not defined, the destination directory is resolved to a sub-directory beneath the resolved destination directory for the Directory_Parent entry. The DefaultDir value defines the name of the sub-directory.  Non-root source directories: The source directory for a non-root directory is resolved to a sub-directory of the resolved source directory for the Directory_Parent entry. Again, the DefaultDir value defines the name of the sub-directory.",
        "Burst",
        "The key to use in the authentication.",
        "A description of the display illumination type. For example, backlit (value=2) or reflective (4) can be specified.",
        "ExecuteExpression",
        "PnPDeviceID",
        "85 - IPX not enabled on adapter",
        "MDM_Policy_Config01_RemoteManagement02",
        "DataExecutionPrevention_SupportPolicy",
        "Bindings",
        "The user account",
        "CR_C494166FEC78B76B06AE6864E10BB6C47EF436F2498312A79210EB6DD47C6CAE",
        "TargetIPAddress",
        "UnusedParameter",
        "CD_612461B1AECF14916F6F139FD9951F2BD0CB766E0BB9EF5DA8A04D9DEB890739.1.4166332249.177",
        "USB Legacy is supported",
        "MS_SystemInformation",
        "Win32API|System Shutdown Functions|ExitWindowsEx|EWX_REBOOT",
        "QueryParser",
        "Example: M0.",
        "Values: 0 = None ",
        "// This class advertizes the ability to use DH-CHAP with physical or virtual",
        "Decommit",
        "Represents a volume on the system.",
        "{2CAF4666-AC9B-45AB-00A6-AF8C537794C2}",
        "Cover",
        "// The total number of successful IPSEC SA negotiations",
        "Target ID",
        "The MonitorManufacturer property indicates the name of the monitor manufacturer. ",
        "protectionManagement",
        "Indicates the specific power-related capabilities of the logical device. The array values, 0=\"Unknown\", 1=\"Not Supported\" and 2=\"Disabled\" are self-explanatory. The value, 3=\"Enabled\" indicates that the power management features are currently enabled but the exact feature set is unknown or the information is unavailable. \"Power Saving Modes Entered Automatically\" (4) describes that a device can change its power state based on usage or other criteria. \"Power State Settable\" (5) indicates that the SetPowerState method is supported. \"Power Cycling Supported\" (6) indicates that the SetPowerState method can be invoked with the PowerState input variable set to 5 (\"Power Cycle\"). \"Timed Power On Supported\" (7) indicates that the SetPowerState method can be invoked with the PowerState input variable set to 5 (\"Power Cycle\") and the Time parameter set to a specific date and time, or interval, for power-on.",
        "0 - Successful completion.",
        "The physical link that has a connector.",
        "IsDefined",
        "MsftDiscFormat2RawImage_DebugDestructor Flag",
        "ExecutionStrategy",
        "ROOT\\Microsoft\\Windows\\AppBackgroundTask\\MS_409",
        "IEEE 802.3 10BASE5",
        "ChildIrp",
        "CountriesSupported",
        "reserved1",
        "select * from MSFT_StorageDepartureEvent",
        "TotalEntryCount",
        "object:DtcInstance",
        "ROOT\\CIMV2",
        "The Win32_DisplayConfiguration class represents configuration information for the display device on a Win32 system. This class is being deprecated in favor of the properties in Win32_VideoController, Win32_DesktopMonitor, and CIM_VideoControllerResolution",
        "SMBIOS|Type 9|Device Number",
        "SetVLActivationInterval",
        "NS_3579DC951657EA60871CD1E9EBEE6A8D0AD711287837BD9631F6B3FC9EC7141E\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_6F81082C846AC0017D1A9842210D9B991E25C88C600008415AF922EE372AE131a81a",
        "Apple GeoPort",
        "RequirePinForPairing",
        "The name of the server this printer resides on.",
        "LSOv2",
        "ActiveSA",
        "{956597A1-7D80-11D2-AAD3-006008C78BC7}",
        "Win32_SecuritySettingAccess",
        "23AA20618BD06EA1320CC257373FA4D3.21.1466421988.769",
        "0xEFFF0032",
        "Auto Dial Dll",
        "{4731F89B-71CB-11d1-A52C-00A0C9062910}",
        "RSOP_IPSECPolicySetting",
        "ATAPI_FAILURE_PREDICT_DATA",
        "MSFT_NetIKEP1AuthSet",
        "It should be noted that there are two new values in RequestedState that build on the statuses of EnabledState. These are \"Reboot\" (10) and \"Reset\" (11). The former, Reboot, refers to doing a \"Shut Down\" and then moving to an \"Enabled\" state. The latter, Reset, indicates that the element is first \"Disabled\" and then \"Enabled\". The distinction between requesting \"Shut Down\" and \"Disabled\" should also be noted. The former, Shut Down, requests an orderly transition to the Disabled state, and MAY involve removing power, to completely erase any existing state. The latter, the Disabled state, requests an immediate disabling of the element, such that it will not execute or accept any commands or processing requests. ",
        "Specifies the processor number for the first VMQ processor.",
        "EVENT_TRACE_FLAG_PROCESSWINDOWSTATION",
        "The Hidden property is a boolean value indicating if the file is hidden.",
        "Fast Ethernet 100BaseFX",
        "HKEY_CLASSES_ROOT (0x80000000) ",
        "The SRIOV capabilities currently enabled on the network adapter.",
        "Property Is Not Supported",
        "SystemBiosMinorVersion",
        "Maximum version number of the iSCSI spec supported by adapter",
        "40024",
        "Example: M2.",
        "List of decimal language Ids, comma-separated if more than one.",
        "Specifies the address of the remote VPN server to which the client will connect. Can be specified as a URL, IPv4, or IPv6 address.",
        "Inferno",
        "Takes the disk offline.",
        "CR_0A6750C7348B537B441FD2B8326BDF41C8B5D59AA69254D1D9F804769C8106B9",
        "NS_CCA03770E562E2A170EDED20A589C069A2045A9BCD7412B77D068846D9054EC4\\KI_272E5753DC3EECDD6057038DB6F26170E7D1CD565B954C6C4A406CB1BC2D023E\\I_9198D744566952E9D937A9D8D71A6CC17D1A1D6B2B12D5542FD7AFC9BDA275B1",
        "FadtDutyOffset",
        "List of resources this resource depends on.",
        "SamSetInfoGrp_End",
        "I_0DCB38B872FB59592D18B80943B89BEC42F008EB48C9E96443375D95C2BE138E.2724.1862574426.290",
        "C_D3EEBB9E3A4C5F3CA348B142AF6727D3A274A152187FB63005FF1EA0DBF75FAE",
        "NS_3D3E81DCD26451B69577998483A82363FD54E34563AA1BC6E73E4A2DC2212802",
        "Processes Confirmation ID for AD forest using the specified product-key to generate and then publish the Activation Object (AO) into Active Directory.",
        "LockedDownTrustedSitesZoneJavaPermissions",
        "vE083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "Mirror",
        "Critical",
        "The GuaranteesDelivery property indicates whether the protocol guarantees that all data sent will reach the intended destination. If this flag is FALSE, there is no such guarantee. ",
        "dwProvSpec1",
        "RemoteAddressResolutionEmpty",
        "DataProcessed",
        "Never",
        "MDM_Policy_Result01_WindowsPowerShell02",
        "68010",
        "RouteUsesEndpoint depicts the relationship between a next hop route and the local Endpoint that is used to transmit the traffic to the \\'next hop\\'.",
        "Certification authority to validate the IPsec channel for DNSSEC.",
        "ReceiveFilterHardwareCapabilities",
        "This method allows for the creation of a replication group on a storage subsystem.",
        "BlockCount",
        "CR_18CF4DFADB65FD9009884647249EF310A7B2E05DDBD0DAD1404A0AE55A5E4EE4",
        "PortSharingEnabled",
        "PNP_EVENT_VERBOSE_LEVEL",
        "ifHCInMulticastPkts",
        "Application directory path",
        "SecondCipherAlgorithm",
        "The AccountOU optionally specifies the pointer to a constant null-terminated character string that contains the RFC 1779 format name of the organizational unit (OU) for the computer account. If you specify this parameter, the string must contain a full pa",
        "NS_B6791A1CF7802A901B1534CADBB1A0E82FB154100B2BE08AF47386C43CEC462A",
        "printerName",
        "RspBuffer",
        "5 - 'UnSyncUnAssoc': create an unsynchronized copy with a temporary association that is deleted upon completion of the copy operation.",
        "MDM_Policy_Result01_Search02",
        "NameOfUserSIDProperty",
        "IDECONTROLLER",
        "Batch - This logon type is intended for batch servers, where processes may be executing on behalf of a user without their direct intervention; or for higher performance servers that process many clear-text authentication attempts at a time, such as mail or web servers. LogonUser does not cache credentials for this logon type.",
        "MatchingID",
        "Device does grayscaling. ",
        "C_5F5583215800877E78DF32C89A95963A09372E548E11061C174A3C01BAB56758",
        "The manufacturer of the physical disks to be put into maintenance mode.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1797.1859355143.180",
        "New process inherits the error mode of the calling process. ",
        "AllowPinnedFolderPictures",
        "Scheduled",
        "Indicates the operation should not prompt for confirmation.",
        "Supplies the MAC address used in the TLLA field of the NA message.",
        "WPDNSE_TRANSCODE Flag",
        "Additional data to include in eventlog message, typically iSCSI Header",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\CrashControl|CrashDumpEnabled",
        "The physical component which is contained in the package.",
        "The extended protection policy used by the server to validate incoming client connections.",
        "Supplies an optional IPv4 address representing the Source Protocol Address (SPA) of the ARP request.",
        "NewOwnerAuth",
        "0x40000000",
        "EDPEnforcementLevel",
        "Indicates if the volume should be enabled for compression",
        "CIM_VersionCompatibilityCheck",
        "CR_A58578087E737BC8DD57D102F9138F5ADF8AA5D8A71EB3BDCC001417DBE8780F",
        "DSTimeServiceFlag",
        "A textual description of the statistic or metric.",
        "DOT11_CLASS_COINSTALLER Flag",
        "AddressOrigin identifies the method by which the IP Address, Subnet Mask, and Gateway were assigned to the IPProtocolEndpoint.A value of 3 \"Static\" shall indicate the values were assigned manually. A value of 4 \"DHCP\" shall indicate the values were assigned utilizing the Dynamic Host Configuration Protocol. See RFC 2131 and related. ",
        "The URL of the manufacturer of this driver.",
        "Budget Writeable",
        "60008",
        "{a94766cf-0670-45b6-8ba5-04bd664d6e79}",
        "I_0FE8DF8C1589996CA7CC6EF89C3E3F94B16EDB28E99D479F30DDCA4CE5D31A8C.2683.2061049043.283",
        "FileIo_V0_Name",
        "UF_WORKSTATION_TRUST_ACCOUNT - This is a computer account for a Windows NT/Windows 2000 machine that is a member of this domain.",
        "Port Error",
        "iScsiFlagUnit Flag",
        "ACPI _TSS",
        "For Windows Installer packages, this is the file system path to the Windows installer package.  For ZAP packages, this is the path to the setup.exe program.",
        "FileIo_OpEnd",
        "AllowSearchEngineCustomization",
        "A6EE2C2F2E7F371415F2AF045A6F.1382.1535836310.326",
        "I_C72044C5359DF7DC4480B7B809AE99A37C9C4FD06BB902C72B46C39D4D671757.1635.1430452203.331",
        "1 - 'Auto-Select': This physical disk should only be used for data storage. ",
        "The XOffXmitThreshold property indicates the XOff transmit threshold for the serial port",
        "ref:MSFT_NetAdapterSriovVfSettingData",
        "The error code if the action failed (the threat status code). Zero if succeeded. HRESULT",
        "resourceProperty",
        "MIF.DMTF|Physical Extent|001.7",
        "Win32_IRQResource",
        "Integer indicating whether the controller operates in interlaced (value=5) or non-interlaced (4) mode.",
        "EditSecurity",
        "Generational Guid",
        "PNP Device interface guid",
        "PLATFORM_TRACE_RESERVED_07",
        "This is the partition identifier.",
        "A CIM_Action is an operation that is part of a process to either create a software element in its next state or to eliminate the software element in the current state. ",
        "LocalServer32",
        "{106b464d-8043-46b1-8cb8-e92a0cd7a560}",
        "An access point for a service. Access points are dependent in this relationship since they have no function without a corresponding service. ",
        "Win32_PnPDevicePropertyReal64",
        "The address at which the error occurred.",
        "The inherited Name property serves as key of a CIM_System instance in an enterprise environment.",
        "Boolean indicating that the most recent error was correctable. If the ErrorInfo property is equal to 3, \"OK\", then this property has no meaning.",
        "Kill (5) terminates the job immediately with no requirement to save data or preserve the state. ",
        "Channel Type",
        "SetSpecifiedLicenseServerList",
        "IL_AF6887ABF3C2B4A743A4EEEEFAB87EEBCE0C92311CF3924640F5CF4750FD3A90.2677.2197206733.281",
        "CR_59BB151BFB7474042FE846D38FA0CC3A5BA58498F9DD04AAF5BDB993481B126E",
        "IKE Identification Payload Type",
        "I_F55E9786D9F50DBDFB52762DDD65690364DF865004D37F7A0B919F2DED2C5FD1.317.1.19893",
        "NewActionByExec",
        "Debug",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"NamedJobObjectLimitSettingProv\"",
        "WdfDPC",
        "A communication endpoint which, when its associated interface device is connected to a LAN, may send and receive data frames. LANEndpoints include Ethernet, Token Ring and FDDI interfaces.",
        "LetAppsSyncWithDevices_ForceAllowTheseApps",
        "ConvertStyle",
        "SubProcessTagChanged",
        "ref:MSFT_NetRoute",
        "The Location property is the Location of the driver ",
        "NdisFddiAttachmentType",
        "CD_58036643D64E8A1516491471C2E429C56B6A6CFED0C27493BF3ECB5339DF324D.1183.4167475373.1958",
        "RSOP_CentralAccessPolicySetting",
        "ClientPort",
        "Media Type",
        "CR_59998C21660422211077DE80E05C8A70A59B3233A43120323CA16489848947CD",
        "Address lifetime state.",
        "PageFault_VirtualRotate",
        "This field is a string representation of the model number of the subsystem array.",
        "SCRUB Flag",
        "{5341576e-75c4-4aeb-a82b-873cd3c6b384}",
        "R_6B2889479D57435939038FBF287B4AFDC16FF0B74EF9BB25FE6D86160746289D",
        "MonitorOnly",
        "CIM_ERR_UNEXPECTED_RESPONSE",
        "Allows the user to delete an instance of an initiator id",
        "PolicySourceSecurityLayer",
        "{d47c5407-2e75-46dd-8146-1d7ed2d6ab1d}",
        "x m;x m;",
        "WarningExceededNotification",
        "10 - 'Splitting': split-in-progress. ",
        "#define ISCSI_HBA_IPSEC_TUNNEL_MODE                0x00000004",
        "PreferLocalNamesAllowed",
        "6CD.2668.2340397220.283",
        "Forces the resetting of the DNS servers for the given DNS Suffix.",
        "C_B2287B7C7375EAC6C3F512941317C3A57D34B32E4D080470E5E3D04FD567BA70",
        "INPROGRESS_SYSTEM_SCAN",
        "C_AC08CDDB7433769D37C6A6528B8CE57C28FD33ED152F2651E59B9F045070D6C8",
        "{B24EF563-BBBE-11d2-ABFB-00805F538618}",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmColor",
        "ROOT\\standardcimv2\\MS_409",
        "C_A3D3980C32FA18D3D98369F8A523D2756A2B0B161451E04A631ED0FE459C5FA2",
        "2 - 'By Policy': The administrator has either requested the pool to be read-only or has enacted a policy on the system that requires the pool to be read-only. ",
        "The status of the BranchCache Hosted Cache Server Firewall Rules",
        "TransportProtocol",
        "FragmentedExtents",
        "CIM_BootServiceAccessBySAP is the relationship between a boot service and its access points.",
        "ReflectorTraceGuid",
        "I_9E4BACCE11F49E9D089586BC1222A0D92425B46D601EBAD2E04BFC3E26B9CE55.2451.518996735.362",
        "ShareRelativePath",
        "Variable length array of sessions.  SessionCount specifies the number of elements in the array. NOTE: this is a variable length array.",
        "Current brightness (in percentage of total)",
        "Specifies the total amount of user-mode execution time, in 100 nanoseconds, for all active processes associated with the job, as well as all terminated processes no longer associated with the job.",
        "C_55BF0CC0F072F8672008BA2E217FC98D14173100D32640D32F61CC0295647162",
        "CD_9D13D81A0232A3B9A054E304F017E99ED70EE31D77185E5048D602C8F68F1D2C.1152.1291903130.313",
        "EnableBandwidthThrottling",
        "C_DBBD84EF91CECC27B905BD3504998EC3FAFFD6A1F5D11327943B474B842AEACD",
        "CIM_OperatingSystem.OSType",
        "Local Talk",
        "I_F023674AFA828B66F95ECE31F54E284BD33C3FE845D503CD7E6993EC70473BF7.1606.1049670122.283",
        "CIM_ClassDeletion notifies when a class is deleted from the schema.",
        "bit  6-7:  Reserved. ",
        "This method allows the FriendlyName to be set.",
        "IdleDurationSeconds",
        "This property allows 'Data Roaming' to be enabled or disabled on the device",
        "Termination Date",
        "TierSizeMin",
        "This field represents the name of the company responsible for the hardware backing the fault domain oject. For physical disk it must match the disk's SCSI inquiry data.",
        "RSOP_SecurityEventLogSettingBooleanBlocked",
        "UF_INTERDOMAIN_TRUST_ACCOUNT - account is for a system domain that trusts other domains.",
        "6 - ARCNET",
        "NumberOfPartitions",
        "DisableCount",
        "HostedCacheDiscoveryEnabled",
        "SupportedHeaders",
        "MGR_TRACE_RESERVED_08 Flag",
        "CD_AC08CDDB7433769D37C6A6528B8CE57C28FD33ED152F2651E59B9F045070D6C8.1533.2281179418.507",
        "EvpdCmddt",
        "Win32_RemoveIniAction",
        "startpassword = \"\" ",
        "ProfileGP",
        "IRQNum",
        "SamGetUserDomPwdInfo_Start",
        "Minutes",
        "object:MSFT_TaskAction",
        "Power Supply Failure",
        "Specifies the CLR type of the instance of persistence provider factory configured for durable services.",
        "DmiRevision",
        "NewPriority",
        "NdPeerBoundary",
        "The Extent reference defines the storage extent on which the errors occurred.",
        "The MaxFileSize property indicates the maximum size (in bytes) permitted for the log file. If the file exceeds its maximum size, its contents are moved to another file and the primary file is emptied. A value of zero indicates no size limit. ",
        "HostedCache",
        "Status and Additional Data fields that identify the boot status",
        "ClientInterfaceIndex",
        "dwMaxBaud",
        "ReasonText",
        "Thread Pool Timer Set",
        "The DatabasePath property indicates a valid Windows file path to standard Internet database files (HOSTS, LMHOSTS, NETWORKS, PROTOCOLS).  The file path is used by the Windows Sockets interface. This property is only available on Windows NT/Windows 2000 systems.",
        "The Manufacturer property indicates the manufacturer of the Win32 CD-ROM drive.",
        "Available",
        "Power Setting Definition Data",
        "This class represents a power setting in the system.",
        "Minimum number of seconds that cached attributes are held after file modification.",
        "Whether the provider supports resizing CQ objects or not. If this is false, CQ resize request must NOT be used by the NDKPI consumer.",
        "E385164ECD849CB5636A26A1B8561.1200.2297851335.259",
        "DirectoryCount",
        "0xEFFF000E",
        "WPDCI_feature2 Flag",
        "5 - 'Differential-Copy': Only the new writes to the source element are copied to the target element. ",
        "Indication",
        "This is the guid id of this object, unique to this store.",
        "iSCSI Initiator Instance Statistics",
        "Length of user-friendly name",
        "PrintFilterPipelineSvc_ObjectsGuid",
        "VirtualDisk",
        "    ServerList (VpnServerAddress[]) Specifies the address of the Remote VPN Server.",
        "0xEFFF005B",
        "#define ISCSI_SECURITY_FLAG_TUNNEL_MODE_PREFERRED    0x00000040",
        "The \"Step\" value of a numeric parameter.",
        "SwitchType",
        "DisableBypassOfSmartScreenWarnings",
        "BitWidth",
        "Indicates the Win32 Configuration Manager error code.  The following values may be returned: ",
        "CIM_SoftwareIdentity.VersionString",
        "DisableWebAddressAutoComplete",
        "CD_EC28E29E31F548462327C3037DF69482A82EBE159236DA81AE2E5AA78F5CFB04.2065.2779075191.4022",
        "Msft_WmiProvider_ProvideEvents_Post",
        "{45755098-4291-43df-9720-B58642DD63DF}",
        "WmiMonitorID",
        "UdpIPv6ExtensionHashSupported",
        "SMBIOS|Type 9|Slot Characteristics 2",
        "Write errors corrected without much delay",
        "{02FE721A-0725-469E-A26D-37B3C09FAAC1}",
        "XOnXMitThreshold",
        "ProgramList",
        "OtherConnectionTypeDescription",
        "PLATFORM_TRACE_RESERVED_0c Flag",
        "Specifies the Type of Workflow.",
        "HBA_FC4TYPES",
        "CD_95CE38D55F514EB56E1FD96114137062153D80888E94FE34DB4826CDF9096258.40.259309307.677",
        "between black, white, and gray scalings. ",
        "Radio configuration parameters",
        "KernelEventVersion",
        "C_23723A40115126D6A71E3769E290B77D9B1A77AD1C76D6761CA490DE9745C4D1",
        "This is the value for Description found in Win32_NetworkAdapterConfiguration of theLAN Adapter to be set. The value 0 implies All LAN Adapters.",
        "DownBackLimitBpsProvider",
        "MSiSCSI_InitiatorInstanceStatistics",
        "The counter data is in 100 nanosecond units.",
        "FC4Type",
        "#define HBA_EVENT_TARGET_UNKNOWN        0x400",
        "ref:MSFT_NetEventSession",
        "Threat Rollup Status",
        "The SetForwardBufferMemory method is used to specify how much memory IP allocates to store packet data in the router packet queue. When this buffer space is filled, the router begins discarding packets at random from its queue. Packet queue data buffers are 256 bytes in length, so the value of this parameter should be a multiple of 256. Multiple buffers are chained together for larger packets. The IP header for a packet is stored separately. This parameter is ignored and no buffers are allocated if the IP router is not enabled. The buffer size can range from the network MTU to the a value smaller than 0xFFFFFFFF. Default: 74240 (fifty 1480-byte packets, rounded to a multiple of 256).The method returns an integer value that can be interpretted as follows: ",
        "DecPPL",
        "This enables PNP traces",
        "BigPoolSnapDCStart",
        "SchemaAvailable",
        "FALSE",
        "CD_3E78A37E1DE70357C353A15D6BBB8A17A1D31F8D501ED8F1C3EB8104F5B04F97.299.1189181731.561",
        "DiskIo_V2",
        "Gets the list of known license servers.  If there are no known license servers, returns an empty array.",
        "d!m;d!m;",
        "You must specify the FileSystem parameter.",
        "AllowConfigurationUpdateForBooksLibrary",
        "CustomizeConsentSettings",
        "CD_09416880DC950121CF927099A50B486F189A631C326B4B438123E20ABA622175.1176.1880004916.268",
        "The PartOfDomain property indicates whether the computer is part of a domain or workgroup.",
        "The IPUseZeroBroadcast parameter specifies the value indicating whether IP zero broadcast is used. Setting the parameter to TRUE indicates that IP zero broadcast is used.",
        "CSE status",
        "MsiEnabled",
        "Disables the User VHD",
        "ipsecData",
        "Time Generated",
        "SelectNetworkAdapterID",
        "CIM_CopyFileAction",
        "Abnormal termination/exit",
        "OutboundPacketErrors",
        "Base-64 encoded raw certificate blob",
        "One Sided",
        "Values:TRUE or FALSE. A value of TRUE indicates the protocol supports QOS.",
        "Template",
        "UUUUUUUUUUUU",
        "IssuerHash",
        "PciDeviceLabelString",
        "IPV6 scope id",
        "{0F73ED5B-8ED9-11d2-B340-00105A1F8569}",
        "The Persistent property indicates whether the shadow copy is persistent across reboots.",
        "R_4C5229B4915A098FA9E249BF643245728F52EEA4263D760742E82296F3E1B97E",
        "Weight assigned to the path",
        "{146360a5-88dd-11dd-94b8-001d09162bc3}",
        "This method denies the specified users access to the file share.",
        "ReadCorrectionAlgorithmProcessed",
        "#define ISCSI_LOGIN_FLAG_USE_RADIUS_RESPONSE          0x00000010",
        "Win32_PnPDevicePropertyReal32Array",
        "PingLicenseServer",
        "NdisCoReceivePdusOk",
        "Values: TRUE or FALSE. If TRUE, the existing debug file will be overwritten. If FALSE, a log file is not written if the filename already exists.",
        "GlobalRefreshOnLogon",
        "Prepared",
        "LineNumber",
        "The Win32_UserDesktop class represents an association between a user account and desktop settings that are specific to it.",
        "Dial Extra Percent",
        "MSNdis_WmiOffload",
        "TestResult",
        "MSMCAEvent_TLBError",
        "SetPowerPolicies",
        "ATM SubInterface",
        "The key to identify the instance of MDM_EASPolicy class",
        "Tag is an identifier for the subsystem that is independent from any location-based information. Examples of a tag could be the subsystem's serial number or asset tag.",
        "HBA_FCPBINDINGENTRY2",
        "Bid2Etw_BCP_1",
        "KeyDeletions",
        "UseActiveDirectory",
        "CIM_ProductSupport",
        "WaitForSyncTimeoutInMilliseconds",
        "// policy to use.",
        "WinstaDriverNames",
        "Ndis80211ReceiveAntennaSelected",
        "CIM_UserDevice",
        "The specified FaultDomainAwareness, ColumnIsolation, or both are not valid.",
        "Active/Optimized",
        "Defines a file share for security intelligence in virtual environments.",
        "Denotes the current health status of the replication group. Health of a group is derived from the health of the backing storage replicas.",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.1130.2391290052.1669",
        "NetworkId",
        "RequestSize",
        "SERIAL_WMI_HW_DATA",
        "48011",
        "ConfigStorageSenseCloudContentDehydrationThreshold",
        "The Device number of the memory error location",
        "The remote port of the TCP connection.",
        "A bit map containing the remote execution options for the software element.",
        "C_E6165A2C7DA53547A217F4B5D9149125910FEBA09B8BB9B320094C6ECF81FDC5",
        "LastUse",
        "HRReserve",
        "RSOP_GlobalSaclSetting",
        "EnterpriseCloudResources",
        "The ActiveTime property indicates the number of seconds since this connection was established.",
        "{BAE20634-E3D4-11d2-8601-0000F8102E5F}",
        "Device Driver",
        "{0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e91}",
        "CR_E7845F3041269988C5A1847DE98EF0D88E59CE50ED3A8AA1E310C1A1F393BB81",
        "IsOwnershipAllowed",
        "DOT11_ISF",
        "N - The minor version (in numeric form) describing the profile's creation or last modification. ",
        "Maximum IGMP/MLD version supported by the host.",
        "The Condition class can be used to modify the selection state of any entry in the Feature class, based on a conditional expression. If Condition evaluates to True, the corresponding Level value in the Feature class will be set to the value specified in the Condition class's Level column. Using this mechanism, any feature can be permanently disabled (by setting the Level to 0), set to be always installed (by setting the Level to 1), or set to a different install priority (by setting Level to an intermediate value). The Level may be set based upon any conditional statement, such as a test for platform, operating system, a particular property setting, etc.",
        "{94d4c9eb-0d01-41ae-99e8-15b26b593a83}",
        "]bd]P",
        "WPD_Perf Flag",
        "Toolbar Button",
        "CleanerMedia",
        "Specifies whether to enable or disable client window's printer mapping.",
        "The storage redundancy group.",
        "// This class exposes initiator statistics",
        "SpecifyMaximumFileSizeSecurityLog",
        "Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_SETXCHAR",
        "The service of this appdomain.",
        "MSFC_FibrePortHBAAttributes",
        "The storage extent.",
        "HTTP Proxy Server",
        "CtlGuidPortableDeviceClassExtension",
        "Add or Remove to group requires Split state",
        "MPLS Tunnel",
        " - CreateGroup ",
        "CIM_Job",
        "SDBUS_DEBUG_WARNING Flag",
        "LastRunTrimmedSlabs",
        "QUERY_EA",
        "HandlesPerHost",
        "Snoozed",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmPrintQuality",
        "The SetID uniquely identifies the shadow copy set to which the shadow belongs.",
        "CD_493669C1CCA456E36A12CE6590E4C5AD1ECD05339BEE6C958085F31C96B6122A.1520.3405479319.548",
        "List Of ISCSI_RedirectSessionInfo ",
        "Cache",
        "Specifies an array of string data values. ",
        "object:MSNdis_WmiTcpLargeSendOffloadV2",
        "ISO8859",
        "Win32_VolumeQuotaSetting",
        "Example: COM1",
        "Note: This property is deprecated in lieu of the ProtocolIFType enumeration. This deprecation was done to have better alignment between the IF-MIB of the IETF and this CIM class. ",
        "DeleteSystemStore",
        "      <dsig:DigestValue>LSfKHBuBgmS87JRzEeQeFcFT5IJ76eZfxMimP8ZHjZw=</dsig:DigestValue>",
        "Time Read Delay",
        "Example: 16777216  ",
        "C_583286F85B8F8F1515639919A5A74FB9CA29959320E37E0C7F595D1E986D9C26",
        "OutDated - This corresponds to OverWriteOutdated of 1 to 365.",
        "MSFT_StorageHealth",
        "MSFT_ResiliencySetting.NumberOfDataCopiesMin",
        "Switch parameter used to bypass web-proxy for local (intranet) addresses.",
        "SystemConfig_V1_PnP",
        "The Win32_PnPDeviceProperty class represents a property returned by Win32_PnPEntity's GetDeviceProperties() Method.",
        "R_2B0CB21E4574B83D661A7C62AD7BF3133DF3FBA914EA55D3A45DC4A7214DD006",
        "Removable media",
        "A value used to define a power setting. This value is readable. The SettingIndex is only used if the power setting is defined as a list of possible values.",
        "Secure Boot enabled",
        "callbackNumber",
        "Reserved",
        "SecurityBreach is an enumerated, integer-valued property indicating whether a physical breach of the frame was attempted but unsuccessful (value=4) or attempted and successful (5). Also, the values, \"Unknown\", \"Other\" or \"No Breach\", can be specified.",
        "Allow traffic that is already encrypted to bypass the tunnel.",
        "BranchOfficeOfflineLogSizeMB",
        "C_C6F2B33A9F7EE971E46DC4A05944D1F3ED258A4BBB229A6782F76407411C3AAF",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|KeepAliveInterval",
        "The Win32_PortConnector class represents physical connection ports, such as DB-25 pin male, Centronics, and PS/2.",
        "SMBIOS|Type 10|Device Type n",
        "SCM Event Provider",
        "Contains tools to update and confirm CI Policy",
        "TRACINGUSEROBJECT",
        "RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode",
        "The Win32_PrivilegesStatus class reports information about privileges required to complete an operation.  It may be returned when an operation failed, or when a partially populated instance has been returned.",
        "NumMsiMessages",
        "AllowSignInOptions",
        "A free-form string indicating the format and layout of the Keyboard.",
        "R_88C26A92C49B5D5790C3E39CE2E3D67877AF641A877697A10369432F961B840E.2457.1302123976.558",
        "dinates.",
        "ACPI data string",
        "The Element reference represents the role of the CIM_ManagedSystemElement object of the CIM_ElementSetting association. Role: The associated managed system element provides the element that implements the element setting.",
        "Provider can manage remote target",
        "Target element can be added to collections",
        "C_443EA03A729799AF7B722609B218862C5380ED55FDD1C6840B32FD56F51FDFBA",
        "Whether fragments should be collected into groups before being forwarded.",
        "VlanID",
        "DiskIo_V0",
        "Full dll name",
        "MSNdis_ObjectHeader",
        "Recommended Template Level",
        "TEST_TRACE_RESERVED_0f Flag",
        "MIF.DMTF|Monitor Resolutions|002.6",
        "{9e814aad-3204-11d2-9a82-006008a86939}",
        "The time interval, in hours.",
        "Specifies the type of User Authentication used for remote connections.If enabled, the protocol requires early user authentication at connection time toincrease server protection against network attacks. Only RDP clients that supportRDP version 6.0 or higher will be able to connect. To avoid disruptions forremote users, it is recommended to deploy RDP clients supporting the appropriateprotocol version before enabling the property.",
        "C_BB8167061523345F8CD6783B9C5021F1F77CD1511AEA7467940486ABC39B70EA",
        "The standard profile that is associated to the managed element in ManagedElement.",
        "Tunnel",
        "BS2000",
        "Ipv6Index",
        "CompatibilityFlags",
        "Maximum number of SGEs that can be specified in a read request (This overrides the MaxInitiatorRequestSge value for read requests.)",
        "This property returns the status of the account password",
        "Ethernet using DIX header format",
        "iSCSI Redirect Portal Info",
        "File Extension",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pLocation",
        "CD_5CEE3E694DB50EA9714886DD418F6CA358B9A4D6FD8DAFD5BAAA13B6529F39A0.1610.3258533973.290",
        "Storage Device Failure Prediction Event",
        "0xC0050051",
        "MDM_Policy_User_Config01_ApplicationManagement02",
        "KeyManagementServicePort",
        "PacketsNotDecrypted",
        "Storage fault event",
        "TRACE_FLAG_ISR",
        "ItemType",
        "The next action.",
        "The FullDNSRegistrationEnabled property specifies whether the IP addresses for this connection are registered in DNS under the computer's full DNS name. The full DNS name of the computer is displayed on the Network Identification tab of the System Control Panel. ",
        "Setting Value",
        "RSOP_PolmkrNetworkOptionSetting",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_MESSAGE_ORIENTED",
        "SourceObjectId",
        "The file integrity information.",
        "The UnjoinDomainOrWorkgroup method un-joins or removes a computer system from a domain or workgroup.  This method is only available on Windows 2000 platforms and beyond. The method can return the following values:/n0 - Success./nOther - For integer values o",
        "_DH_WMP_CACHE_PROVIDER",
        "DefaultURL",
        "RemovePropertyValue",
        "POTENTIALUNWANTEDSOFTWARE",
        "The Type property reveals the type of route. The values direct(3) and indirect(4) refer to the notion of direct and indirect routing in the IP architecture. Setting this object to the value invalid(2) has the effect of invalidating the corresponding entry in the RouteTable object. That is, it effectively disassociates the destination identified with said entry from the route identified with said entry. It is an implementation-specific matter as to whether the agent removes an invalidated entry from the table. Accordingly, management stations must be prepared to receive tabular information from agents that corresponds to entries not currently in use. Proper interpretation of such entries requires examination of the relevant ipRouteType object.",
        "DuplexingMode",
        "SupportsBatching",
        "UniqueIdFormat indicates the type of identifier used in the UniqueId field. The identifier used in UniqueId must be the highest available identifier using the following order of preference: 8 (highest), 3, 2, 1, 0 (lowest). For example: if the physical disk device exposes identifiers of type 0, 1, and 3, UniqueId must be the identifier of type 3, and UniqueIdFormat should be set to 3.",
        "QueueTransferProtocol",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_A3BFBEBE234E4658CAF2F881D4107E925EE23BCFF10DB187E30DCBCBC937403Ec311E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "Write Cache",
        "One or more files failed to copy.",
        "Specifies the printer configuration settings to set.",
        "TcpIp_V0_TypeGroup1",
        "MaxWorkItems",
        "RoamingConfigured",
        "The DNSServerSearchOrder parameter indicates the list of server IP addresses suffixes to query for DNS Servers.",
        "Specifies whether or not integrity streams are enabled for this file.",
        "Management of commands that run automatically when users log onto the computer system.",
        "Antivirus Last updated local time - If this has never updated you will see a null value in this property",
        "I_0A9C692AFE67AD32626E68B31C73B073673CF431D0AE38A2B95919B7B7CA46B3.2713.100574119.281",
        "Persistent ACLs",
        "CD_745B48F3D3663775E674F1AC382685A30C5D61F06F3C74BC6E2C4180489D568F.1173.572888487.288",
        "//             } HBAP_PERSISTENT_BINDINGS, *PHBAP_PERSISTENT_BINDINGS;",
        "CSVFS_ReFS",
        "{33be4128-d02e-4b6f-949e-ab77cc8164b1}",
        "ASERIES",
        "An array of free-form strings providing more detailed explanations for any of the access device features indicated in the Capabilities array. ",
        "SourceGroup",
        "0xD016",
        "IntranetZoneNavigateWindowsAndFrames",
        "ShareState",
        "UseDefaultErrorMode",
        "WdacWmiProv",
        "EncryptionAlgorithmsEnabled",
        "MSNdis_CountedString",
        "Initiator Instance",
        "C_1B0301F62502D60F6575CB09308C7A3739069A23886569D046BCB5BF22A5D75E",
        "{0573f70f-ded8-401c-8b56-a62bb528c0e2}",
        "{433c345c-2129-11d4-97eb-00c04f79c403}",
        "ISCSI_ERR_INSUFFICIENT_CONNECTION_RESOURCES",
        "Sensor Failure",
        "A Boolean value that indicates whether messages processed by this binding should be traced.",
        "Extended w/Extended Int 13",
        "Volume Dos Name",
        "C_0E5696839A5AB639CE4CA331881E4EEE21A91F994E8EF5EFC523806BDC11D8EF",
        "Instances of the CliAlias class represent aliases. These are used by the WMI command utility as a mechanism for restructuring the capabilities provided by the WMI schema. The restructuring is done by roles. The roles are represented by namespaces. CliAlias instances are organized into role oriented namespaces in such a way that the aliases required by a specific operational role will all be found together. For example all the printer management aliases will be found in the \\\\.\\root\\ops\\printer namespace. Each alias consists of a list of Formats and verbs. The formats provide various display strategies for the Alias (for example FULL or BRIEF). The verbs represent behavior that is available through the Alias (for example RESET in the context of a printer). Each format consists of a list of properties. The Alias itself is related to the schema through the Target property that contains a WQL query or a valid path (which may be just a class name) that defines the instance or set of instances the alias applies to. ",
        "Win32_TSDiscoveredLicenseServer",
        "WPD_F4",
        "MSFT_CliAlias.FriendlyName=\"IRQ\"",
        "Example: 768  ",
        "Defines the semantics of corresponding entries in the ActivityQualifiers array. An example of each of these 'formats' and their use follows: ",
        "2 and 0 - Information and Unknown (respectively) follow common usage. Literally, the Indication is purely informational or its severity is simply unknown.",
        "The RenewDHCPLease method renews the IP address on specific DHCP-enabled network adapters. The lease for the IP address assigned via a DHCP server has an expiration date that the client must renew if it intends to continue use of the assigned IP address. The method returns an integer value that can be interpretted as follows: ",
        "Microsoft|DSLDAPClassProvider|V1.0",
        "TotalPowerOnHours",
        "LUAInstall: error 0x00000005 setting flags [{713aacc8-3b71-435c-a3a1-be4e53621ab1}]",
        "failedRequestDetails",
        "Specified directory not empty",
        "Authority name",
        "{3011A7BD-0491-478e-8C79-3C76424D05E2}",
        "BAUD_USER",
        "{13FFA73F-25AA-4b66-B63C-B635514678C5}",
        "Product SKU (stock keeping unit) information.",
        "{C10B4771-4DA0-11D2-A2F5-00C04F86FB7D}]",
        "12-bit FAT",
        "The Create method creates a new process. It returns an integer value of 0 if the process was successfully created, and any other number to indicate an error.",
        "Percentage of Highest Frequency",
        "AppDomainId",
        "ParityCheckEnable",
        "MSNdis_80211_AddWEP",
        "LockedDownRestrictedSitesZoneAllowSmartScreenIE",
        "LPC_TRACE_RESERVED_16 Flag",
        "LdrLoadFlags",
        "SetDisableUXWUAccess",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE",
        "I_3C2C2907345FD9238E14A72F66B1B84060440D64FBC7FA8518759968C7E4B75B.790.1.49293",
        "Win32_ComponentCategory",
        "Largest Free Space Extent",
        "This class represents QoS settings on a network adapter.",
        "Serial number of the issued certificate",
        "SMBIOS|Type 4|Processor Information|Voltage",
        "DSROutflowControl",
        "LocalAddressResolutionEmpty",
        "RebootRequired",
        "EVENT_TRACE_FLAG_SPLIT_IO",
        "{FAF76B70-798C-11D2-AAD1-006008C78BC7}",
        "MDM_VpnApplicationTrigger",
        "UniqueIdFormatDescription",
        "C_16DADF7B882F03A24B4CBB8BF019AD75A37563B4BB21A28112B781908EB8D5AF",
        "Indicates the Plug and Play device ID of the logical device.  ",
        "SubscriptionError Flag",
        "List of dynamic keyword address IDs to corresponding to the remote addresses for this rule.",
        "QuotaNonPagedPoolUsage",
        "ASC Flag",
        "iScsiFlagCHAP",
        "AllowSyncMySettings",
        "TS_TRACE_LEVEL_ASSERT",
        "MSFT_NetServiceStatusSuccess",
        "Capabilities and management of a heat pipe cooling device.",
        "iSNS Server Address",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_0B5AC83FB2725D33B41CFF3B51EF33467B960FD4E7B54F055ED580C64C086270",
        "{5ec10357-a61a-11d0-8dd4-00c04fc3358c}",
        "The CommandLine parameter specifies the command line to execute.  The system adds a null character to the command line, trimming the string if necessary, to indicate which file was actually used. ",
        "Deployable",
        "MSFT_MpThreatCatalog",
        "Current value of the registry keyword. For a parameter that is displayed in user interface and is of \"enum\" type, this is a value in EnumParameterRegistryValues array and not the description for the current value of the parameter.",
        "EVENT_TRACE_FLAG_MEMORY_PAGE_FAULTS",
        "RefCount",
        "The target namespace of the service in WSDL.",
        "ContextManagementEnabled",
        "IR_735452BBEBEFDAEBC6A68DCD86C8369C33E470B585707BA64EB646095B631099",
        "ReadTime",
        "DeviceUUID",
        "RemoveVirtualPortEx",
        "If the voltage (in Millivolts) drops below the value specified by Range2InputVoltageLow property, the UPS will compensate by boosting the voltage using its power source(s).  A value of 0 indicates that the voltage at which boosting occurs is 'unknown'.",
        "FX_TRACE_REQUEST",
        "LockedDownIntranetZoneAllowUserDataPersistence",
        "Native",
        "Count of Number of ConnectionTimeout errors occured in this session",
        "Specifies the translation of the subcategory. The translation is source specific.",
        "WaitForRemoteProfile",
        "Select * from Win32_ScheduledJob",
        "{13DAD3AD-9F41-4722-8DEB-7D151C1E4F9B}",
        "Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|InheritedFromUniqueProcessId",
        "{4B647745-F438-0A42-F870-5DBD29949C99}",
        "Synchronous TokenizedClone Remote",
        "MaxQueuePairCount",
        "CIM_InstCreation notifies when a new instance is created.",
        "{44795706-a61b-11d0-8dd4-00c04fc3358c}",
        "R_D4639B8A3A234C7C421B844825ADE1FE2360CB4CE746D79998FBB9573B4B4A5C",
        "Execute Get on a provider directly",
        "ShadowCopy",
        "CIM_ProductPhysicalElements",
        "DaylightInEffect",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2115.693805320.188",
        "Maximum number of in-progress outgoing read operations per QP",
        "The Show Command specifies the view state of the application window and is similar to the ShowWindow Windows function.",
        "EnableMultiChannel",
        "AllowWorkplace",
        "Unspecified failure",
        "CIM_ParallelController",
        "Number of frame checksum errors",
        "C_916EF6B6122453D1C58D648E96BD869758A18BA38D348DDAE67570192E8AB140",
        "Associates a network adapter with its Receive Segment Coalescing (RSC) data.",
        "{ba1f4c14-a945-4762-b916-0b5515b6f43a}",
        "UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations",
        "Specifies an array of SIDs and attributes.",
        "Note:  The SE_CREATE_PAGEFILE privilege is required for Windows XP",
        "The Scale property specifies the factor by which the printed output is to be scaled.  For example a scale of 75 reduces the print output to 3/4 its original height and width.",
        "I_D5015F0F522081FD020EE5B4501E138DF661E57BB72BDD7C27479EFFDC65FAEE.1334.1051082552.362",
        "WFP_TRACE_FE Flag",
        "FX_TRACE_REMOTE_IOTARGET Flag",
        "The VerticalResolution property indicates the print resolution along the Y axis (height) of the print job. This value is only set when the PrintQuality property of this class is positive, and is similar to the YResolution property.",
        "{51734B23-5B7E-4892-BA8E-45BC110B735C}",
        "GetSupportedGroupOperations",
        "{0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e93}",
        "System limit exceeded (e.g. voltage or temperature threshold exceeded",
        "Reset",
        "DisableBehaviorMonitoring",
        "CIM_MemoryCapacity",
        "3221232480",
        "UdpIp IPV4 Send/Receive",
        "C_0ABAFED91AF3160513FD4A097A7FC5F22572733C3EBFF5EDB2C1119EA3585424",
        "DefaultAlgorithmSuite",
        "NS_892F8DB69C4EDFBC68165C91087B7A08323F6CE5B5EF342C0F93E02A0590BFC4\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_41AE0E8A27F69BB81713327447DFEB3E4D47E6C961601828958257151B049D62",
        "BranchCacheServiceStatus",
        "Minifilter IO Init",
        "PerformanceStates",
        "Provider Binary Path",
        "The Persistent property determines whether this connection will be reconnected automatically by the operating system on the next logon.",
        "Color matching should optimize to match the exact color requested. ",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.314.941523886.188",
        "{FAF76B99-798C-11D2-AAD1-006008C78BC7}",
        "Neutral",
        "0xEFFF0064",
        "   /* Adapter Level Events */",
        "FreeBSD",
        "{791ad1a5-e35c-11d0-9692-00c04fc3358c}",
        "Local filename to which event capture traces will be written to.",
        "I_11AD18A79EBCEB689369B81E350D3496AC2AF45588A574E361F6358743201A7E.2707.4045560932.288",
        "select * from WSP_ReplicationGroupStorageArrivalEvent",
        "BuildNumber",
        "{3A20796C-DB33-11d2-85FC-0000F8102E5F}",
        "CIM_ManagedSystemElement.StatusDescriptions",
        "GetByObject",
        "Indicates whether Priority Flow Control (PFC) is configured on the network adapter.",
        "Rdma settings for a network adapter",
        "Maxumum CDB length supported by the adapter",
        "The 2",
        "PPM (parts/million)",
        "The Purpose property indicates the role that the data file plays with regard to its associated logical device.",
        "Timestamp_PerfTime",
        "Time this instance was created",
        "RunRepeatedly",
        "Grays",
        "58005",
        "Example: Creative Labs SoundBlaster AWE64PNP",
        "0x302",
        "Unable to quick format",
        "C_9545373C4C410A85043435CEFDB53CA783FCE515B65345546AA266D2B18EC658",
        "48008",
        "0x80050066",
        "EVENT_TRACE_FLAG_CREATENAMEDPIPE",
        "{B6501BA0-C61A-C4E6-6FA2-A4E7F8C8E7A0}",
        "\\CIMV2\\Security\\MicrosoftVolumeEncryption",
        "The logical device for which information is measured by the sensor.",
        "RegisteredSubsystem",
        "Number of read operations from disk",
        "SessionBigPoolSnapDCEnd",
        "status",
        "ref:CIM_PolicyRule",
        "The original package name for the product.",
        "MemUsageKBytes",
        "CR_A3FF4B5E169562F5D12527C651F2FA9F17677983CAE812428672F30175B2773F",
        "MsaServiceEnabled",
        "CD_D6B832D04D0FAB582A050E5212201E6DF3C06194D4D96931CCBF8B3053F5A8AF.1386.1.24020",
        "CompatibleID",
        "LetAppsAccessPhone_UserInControlOfTheseApps",
        "DriverMajorFunctionCall",
        "Create_Unicode_Environment - The environment settings listed in the EnvironmentVariables property use Unicode characters. If clear, the environment block uses ANSI characters.",
        "AllowSoftwareWhenSignatureIsInvalid",
        "NewVolumeKeyProtectorID",
        "SystemConfig_V2_CodeIntegrity",
        "MaxMemoryRegionCount",
        "PackageStatus",
        "CountrySelected",
        "WriteInit",
        "CIM_FlatPanel",
        "CreateVirtualDisk",
        "AllowFontProviders",
        "If the UserName parameter specifies an account name, the Password parameter must point to the password to use when connecting to the domain controller. Otherwise, this parameter must be NULL. /nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. /nThis parameter is only used for domain renames on Windows 2000 platforms and beyond. ",
        "COMPACTION Flag",
        "LookupDomain",
        "{d2b115a6-259b-4d9a-b14d-8ddea2739d3e}",
        "AllowWUfBCloudProcessing",
        "The current value indicated by the sensor.",
        "IpV6FilterExemptRateLimitBytesPerSec",
        "RemediationTime",
        " 0x00000001 ",
        "Discrete",
        "Lunch Box",
        "//    # is the CID.",
        "Current version of local configuration manager.",
        "The Msft_WmiProvider_ExecMethodAsyncEvent_Post event class represents an event generated immediately following completion of the provider's implementation of IWbemServices :: ExecMethodAsync.",
        "Ndis80211ReloadDefaults",
        "NanoSeconds",
        "RenewDHCPLeaseAll",
        "Fine Brush",
        "fieldReplaceableUnitCode",
        "Contents of the RDP file corresponding to the Custom RDP Settings",
        "Windows Server 2012 R2 Preview",
        "ref:Win32_DCOMApplication",
        "LogFile",
        "Accounts_RenameAdministratorAccount",
        "PushResult",
        "SetHomeButtonURL",
        "TO_OTHER",
        "Note that the value 101 is undefined and will be not be allowed in the next major revision of the specification.",
        "8 pixels",
        "The path to this driver in the driver store.",
        "MSFT_NetSecuritySettingData",
        "TState Context",
        "File System Name",
        "EVENT_TRACE_FLAG_D",
        "MDM_EnterpriseDataProtection",
        "CD_9C6234A862ECB7785AEE1C8C46C69B53F75E4A1B191D9AE24604A07719AA0D8E.1533.3047527346.549",
        "Modem Device",
        "I_5A83D395085B6B03108F7917D2C4F3D0683B0E479C446703225592BD963CB748.756.1.38386",
        "RD_TRACE_IO Flag",
        "LanaId",
        "LPC_TRACE_RESERVED_15",
        "MSFT_NetBranchCacheStatus",
        "Number of IEPorts in the changer",
        "1.0.1",
        "SlowLinkTimeOutParams",
        "The Size property indicates the total size (in bytes) of the partition.",
        "The availability and status of the device.  For example, the Availability property indicates that the device is running and has full power (value=3), or is in a warning (4), test (5), degraded (10) or power save state (values 13-15 and 17). Regarding the power saving states, these are defined as follows: Value 13 (\"Power Save - Unknown\") indicates that the device is known to be in a power save mode, but its exact status in this mode is unknown; 14 (\"Power Save - Low Power Mode\") indicates that the device is in a power save state but still functioning, and may exhibit degraded performance; 15 (\"Power Save - Standby\") describes that the device is not functioning but could be brought to full power 'quickly'; and value 17 (\"Power Save - Warning\") indicates that the device is in a warning state, though also in a power save mode.",
        "TEST_TRACE_RESERVED_17 Flag",
        "CIM_PrintJob.RequiredJobSheets",
        "Suspending",
        "Win32_ThreadTrace",
        "Related",
        "Security level for the Internet security zone",
        "HRAddress",
        "RD_TRACE_RESERVED_1a",
        "The connection security rule.",
        "PFXCertPasswordEncryptionType",
        "LoginAuthenticateFail",
        "High Priority - Specified for a process that performs time-critical tasks that must be executed immediately. The threads of the process preempt the threads of normal or idle priority class processes. An example is the Task List, which must respond quickly when called by the user, regardless of the load on the operating system. Use extreme care when using the high-priority class, because a high-priority class application can use nearly all available CPU time.",
        "0x8005004E",
        "Ignores default routes on the interface. Default: Disabled.",
        "CD_169484918492FC0AC4886BF1A48556EDC1984793E915C243C1C0A4B8E678F4FD.2229.1174744692.228",
        "{f1fea491-bfa6-436c-a178-a70d03b4fb1a}",
        "ScheduledInstallFirstWeek",
        "MachineData",
        "Qualifier for LS issuing CALs to TS",
        "{51E28842-DB33-11d2-85FC-0000F8102E5F}",
        "Partially on tier",
        "MSFT_TaskComHandlerAction",
        "NdisHardwareStatusClosing",
        "R_D53926DD08FC0504729C14668CB5F77993A493481CE344FD381209E767534057.2505.965822365.540",
        "EIA861B",
        "PrivateV6Address",
        "Displayname",
        "SHA-256",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSVIRTUALIP_Prov\"",
        "Property to store  admin comments.",
        "QPBind performance counter missing",
        "error_Type",
        "C_F9D6E5641FF66EA233E60BBAC7C675015AAFDD5EA5CE8B2ACA26EEB642AA98C0",
        "InternetZoneAllowAccessToDataSources",
        "LogIgnored",
        "The VolumeName property indicates the volume name of the logical disk./nConstraints: Maximum 32 characters",
        "Wmi Instance Names for the device. This property is useful for mapping from the wmi namespace to the cimv2 namespace classes using the view provider",
        "The MiniDumpDirectory property indicates the directory where small memory dump files will be recorded and accumulated. /nExample: %systemRoot%\\MiniDump",
        "CD_0ABF3D1589A9B18F0AFA08F69190699B7E9CE95E28F1B4B39B6534E41F4C3C0E.2625.3575338684.597",
        "Heap Affinity Slot Assigned To Thread",
        "pathToSignedProductExe",
        "ACQUIRE_FOR_CC_FLUSH",
        "A string indicating the current status of the object. Various operational and non-operational statuses are defined. This property is deprecated in lieu of OperationalStatus, which includes the same semantics in its enumeration. This change is made for 3 reasons: ",
        "{A6B834B1-F974-4445-8F2E-FC996638B350}",
        "CD_C21EED7191192F2ADBCB9708104DAD6A17FD5A43846B186D22E5E8405D0D7A69.1736.1776891584.5007",
        "12 - 'Broken': The relationship is non-functional due to errors in the source, the target, the path between the two or space constraints. ",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_3D90968CBF38C76EB9C64EC58DF8BAD337C1A48A70D1C9EF256656BDBCD3DFE411d771140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "The KeepPrintedJobs property indicates whether the print spooler should not delete the jobs after they are completed.",
        "Public network interfaces",
        "ReceivedCount",
        "The IPSecPermitIPProtocols property lists the protocols permitted to run over the IP. The list of protocols is defined using the EnableIPSec method. The list will either be empty or contain numeric values. A numeric value of zero indicates access permission is granted for all protocols. An empty string indicates that no protocols are permitted to run when IPFilterSecurityEnabled is TRUE.",
        "LetAppsAccessLocation_ForceDenyTheseApps",
        "See CIM_ProcessorCapabilities.NumberOfProcessorThreads for details.",
        "A value that indicates whether Unsafe Connection Sharing is enabled on the server.",
        "PreventSmartScreenPromptOverride",
        "    NapState (string) Specifies the NAP status for PEAP authentication method. Available values: Success, NotNapCapable, NoConnection, Error",
        "object:MSNdis_ReceiveFilterInfo",
        "Win32Registry|SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
        "OldThreadPriority",
        "The UserStackLimit property indicates the limit of the thread's user-mode stack.",
        "SamQueryInfoAlias_End",
        "MSFT_ExpressionValue_uint32",
        "TS Client Trace",
        "The security settings of the file/directory object -- CANNOT BE ENUMERATED",
        "An array of free-form strings providing more information on the ChassisTypes array entries. ",
        "R_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D",
        "The SetIPXVirtualNetworkNumber method is used to set the Internetworking Packet Exchange (IPX) virtual network number on the target computer system. Windows 2000 and Windows NT 3.51 or greater uses an internal network number for internal routing. The internal network number is also known as a virtual network number. It uniquely identifies the computer system on the network. The method returns an integer value that can be interpretted as follows: ",
        "Windows Remote Management Trace",
        "This property indicates whether the user prefer to roam this profile if RoamingConfigured is true.",
        "Represents a unit of adding storage in a data center.",
        "Redirected",
        "CD_97BB199CE4D9B053D267D3E21705BC5FEFBBA4BB59B3C0549DB5A62CA7F3BB34.1604.3074032774.2807",
        "Association(TRUE)",
        "R_F9C105403362A1B751E34E98A48FF5F80223E74C87FC8FCA699A26FA5C230218.1521.3079970201.518",
        "MDM_Policy_Result01_FileExplorer02",
        "SecondsIdle",
        "WmiEnumReceiveQueues",
        "Terminated (8) indicates that the job has been stopped by a \\'Terminate\\' state change request. The job and all its underlying processes are ended and can be restarted (this is job-specific) only as a new job. ",
        "The Index property indicates the physical drive number of the given drive. This member is filled by Get Drive Map Info.  A value of 0xFF indicates that the given drive does not map to a physical drive.",
        "TRACE_CLASS_HELLO Flag",
        "The physical package(s) that realize a unitary computer system.",
        "This indicates the time in seconds before stale data will be moved off the physical disks in this storage enclosure",
        "CompressionEnabled",
        "Control register",
        "TP_V2_CBCancel",
        "53000",
        "COMPortMapping",
        "Win32_NTLogEventComputer",
        "Averaging Interval",
        "BatteryPctToSeedProvider",
        "{86E30E83-7DB2-11d2-90CB-0060081A46FD}",
        "PointAndPrintRestrictions_User",
        "Double",
        "VpnCommonConfig consists of the following fields: ",
        "NoComma",
        "Interacts With Desktop",
        "SessionDirectoryIPAddress",
        "NdisFddiStateJoin",
        "Physical Medium type (Ex) of the adapter",
        "The battery.",
        "DllSearchPathInternal",
        "IoStartTimer",
        "UnloadTimeout",
        "JobData",
        "Device Change",
        "UpdatedObjectId",
        "MSNdis_ReceiveNoBuffer",
        "R_D4A97CD760E9DC657E08D29140B18BCC6B8D0D59DB6745F4739A4443DFD0F72F",
        "UmsEvent",
        "{290FC242-DB36-11d2-85FC-0000F8102E5F}",
        "TRACE_NONE Flag",
        "{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}",
        "MaxTransferSize",
        "Idle Time",
        "MSFT_Synchronized",
        "{f5b7d202-e594-4aa3-be43-4976833c7840}",
        "PCI-X Mode1 100MHz",
        "Specifies the printer comment.",
        "Cannot clear with OEM partitions present. To clear OEM partitions, use the RemoveOEM flag.",
        "CIM_DeviceConnection",
        "MSNdis_NetworkDirectState",
        "C_43B35DA4EAEBC0284206ADBC4132DA71EB8556E731586CFE46B5A658E2C2F498",
        "Hw Ecp Write Count",
        "Maximum number of NFS retransmissions allowed.",
        "DomainDiscovery",
        "           // Text based host name. This needs to be resolved to binary form",
        "ref:MSFT_NetIKEMMCryptoSet",
        "Refsv1WppTrace",
        "Secure Memory Overwrite",
        "NdisTokenRingCurrentGroup",
        "Sync mode is not allowed to be set to this value.",
        "PDUResponsesReceived",
        "76G)|",
        "Win32_LogicalShareAccess",
        "Instances of this class represent the services that are to be installed along with an associated package.",
        "GET_FP_CAPABILITY",
        "Select * from Win32_Product",
        "CD_B715CBD523374FBED801AECAF12284FC6BC34C5D6F6D2476176EDBA2C8EF1A70.1750.654124313.389",
        "Certificate expiration threshold in days ",
        "Win32_MoveFileAction",
        "LocalAddr",
        "CIM_StorageExtent.CreationClassName",
        "Internet Per Connection Option List Data Size",
        "Log file mode of ETW trace session.",
        "Autonomous System",
        "Indicates if LSOv2 is currently enabled for IPv6 TCP packets.",
        "ConnectFailurePerformanceCounterMissing",
        "The Delete method deletes a share name from a server's list of shared resources, disconnecting connections to the shared resource. Only members of the Administrators or Account Operators local group or those with Communication, Print, or Server operator group membership can successfully execute the method. The Print operator can delete only printer queues. The Communication operator can delete only communication-device queues.",
        "Non-Repudiation Failure",
        "QoS properties for a network adapter.",
        "WmiIPv4ESP",
        "CD_4082A72ACD016CE3E809C18525EF28CAFFEB76B1D6E2F5C00FFCF2C67654A896.1700.2620054311.365",
        "Win32_SecuritySetting",
        "OpenObject",
        "0xEFFF002A",
        "Handle",
        "IL_0FDEA6B1EF5C766CB87D84DBF8B39A72DE3796CA0B78D5F22281D9A8B21093AF.1499.3351237689.194",
        "The specified cluster size is invalid.",
        "object:MSFT_NetBranchCacheCache",
        "29     This device is disabled because the firmware of the device did not give it the required resources. ",
        "Baud Rate",
        "The Tag property contains a string that uniquely identifies the physical memory array.",
        "MaximumRxPartialBufferCount",
        "ref:CIM_LogicalDisk",
        "BAUD_19200",
        "^UUUUUUUUU",
        "CD_8B2D824B1B1EA753A4826FD6EB54DBE4A6D394AEDFDA04796F002F1017CDCD06.2624.3011621350.486",
        "C_259FCFE2A3935A15F180BDB11D2BB86ACCAE71C54E422895B35143097454A85F",
        "NumberLogTypeDesc",
        "ADODB.1 formatted output (A)",
        "PelsHeight",
        "IP Multicast",
        "select * from __InstanceModificationEvent where TargetInstance isa \"Win32_UTCTime\"",
        "NetworkSecurity_LANManagerAuthenticationLevel",
        "CIM_ERR_TYPE_MISMATCH",
        "Limit Scheduling Class - Causes all processes in the job to use the same scheduling class. ",
        "Specifies the GPT partition type. GptType is only valid if the disk's PartitionStyle property is set to 2 - 'GPT', otherwise an error will be returned. If this parameter is not specified, CreatePartition will default to {ebd0a0a2-b9e5-4433-87c0-68b6b72699c7} - 'Basic Data'.",
        "Specifies the value of Pre-Shared Key to be used for L2TP authentication. If this parameter is not specified, by default a certificate will be used for L2TP.",
        "IPv4AddressOrigin identifies the method by which the IPv4 Address, Subnet Mask, and Gateway were assigned to the NIC.",
        "LockedDownIntranetZoneInitializeAndScriptActiveXControls",
        "MIF.DMTF|Memory Device|002.18",
        "Hertz",
        "GetHardwareEncryptionStatus",
        "Specifies the new property value.",
        "MSFT_NetLbfoProvider",
        "ErrorsSystem",
        "CIM_NumericSensor",
        "The IP4RouteTable class information governs where network data packets are routed to (e.g. usually internet packets are sent to a gateway, and local packets may be routed directly by the client's machine).  Administrators can use this information to trace problems associated with misrouted packets, and also direct a computer to a new gateway as necessary. This class deals specifically with IP4 and does not address IPX or IP6. It is only intended to model the information revealed when typing the 'Route Print' command from the command prompt. ",
        "This is the time threshold, in hours, after which the profile health is reported as Unhealthy when the profile has not been downloaded yet",
        "MIF.DMTF|Video|003.2",
        "DOSetHoursToLimitBackgroundDownloadBandwidth",
        "MSFT_NetIPv6Protocol",
        "MSNdis_80211_ConfigurationInfo",
        "The VMQ setting data for the network adapter.",
        "ConnectionEstablished",
        "object:MSFT_NetRoute",
        "ATA-3",
        "DH Group Plumbed in Ipsec policy.",
        "CD_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D.1165.103062011.3667",
        "{7FD18652-0CFE-40d2-B0A1-0B066A87759E}",
        "LoadUnloadDeviceDrivers",
        "Read Corrected With Delay",
        "93 - Already exists",
        "Do not use proxy server for addresses beginning with this string.  The value '<local>' means do not use a proxy server for local (intranet) addresses.",
        "0xEFFF0027",
        "nFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "Milliseconds",
        "ISCSI_ERR_INVALID_COMMAND_SEQUENCE_NUMBER",
        "RawRecord",
        "RSOP_IEConnectionSettings",
        "Example: 1024 x 768 x 256 colors.",
        "ScreenTimeoutWhileLocked",
        "MIF.DMTF|Physical Memory Array|001.12",
        "ThresholdCrossed",
        "CC32361.2689.3546730086.265",
        "The ScopedSettingData class represents the general concept of SettingData, which is scoped or contained by a ManagedElement (that is, settings that are specifically defined for a system, device, and so on). ScopedSettingData is tied to a ManagedElement using the ScopedSetting association. Note that the cardinality of the ManagedElement reference is Min(1), Max(1). This cardinality mandates the instantiation of the ScopedSetting association for the referenced instance of ScopedSettingData. ScopedSetting describes the existence requirements and context for the referenced instance of ManagedElement. Specifically, the ManagedElement must exist and it provides the context for the ScopedSettingData.",
        "The server hosting the LPR printer.",
        "{94C1FEE8-EDFD-4db1-B07F-FB06622C882D}",
        "Hand Held",
        "MGR_TRACE_SERVICE_KEY",
        "If this service fails to start during startup, the ErrorControl property specifies the severity of the error. The value indicates the action taken by the startup program if failure occurs. All errors are logged by the computer system. The computer system does not notify the user of \"Ignore\" errors. With \"Normal\" errorsthe user is notified. With \"Severe\" errors, the system is restarted with the last-known-good configuration. Finally, on\"Critical\" errors the system attempts to restart with a good configuration.",
        "MSDASQL_1 formatted output (A)",
        "R_68B63D85C07431A40103A6BD810D7F59382555974E6EFAD3DDDB4C278A22DFDE.2457.2986948068.558",
        "SERIAL_WMI_COMMPROP",
        "Tertiary",
        "ODBC.1 formatted output (W)",
        "08DC881413B47D24732FDCE6DA8A0FBB80C.310.3386896044.285",
        "IsEnabledToUser",
        "WPD_F1 Flag",
        "Gets policy information of type string.",
        "Contains an array of string data values for the named value. ",
        "SetIPXFrameTypeNetworkPairs",
        "Group account management. ",
        "This method enables High Availability and Scale Out features on this disk. These features are only available to disks that belong to a highly available storage subsystem.",
        "networkqueryopen",
        "This class exposes port discovery operations that can be by a fibre channel adapter. There should be one instance of this class for each adapter",
        "SDBUS_DEBUG_FAIL Flag",
        "Microsoft iSCSI Initiator: Send Target Portal Class",
        "{5ec10358-a61a-11d0-8dd4-00c04fc3358c}",
        "This property contains the local Operating System version in the following format: major.minor.revision",
        "LinkLayerAddress",
        "Specifies the name of the server that the printer port will be added to. ",
        "SetSessionDirectoryProperty",
        "ReplicaType provides information on how the Replica is being maintained. Values are: ",
        "The port on which this hosted cache server will listen for incoming offer messages on its HTTPS channel",
        "DBNETLIB",
        "Boolean indicating that at least one daughterboard or auxiliary card is required in order to function properly.",
        "The MaxQuiesceTime property has been deprecated. When evaluating the use of Quiesce, it was determine that this single property is not adequate for describing when a device will automatically exit a quiescent state. In fact, the most likely scenario for a device to exit a quiescent state was determined to be based on the number of outstanding requests queued rather than on a maximum time. This will be re-evaluated and repositioned later. ",
        "{4AE27CD9-8DFA-4c37-A42C-B88A93E3E521}",
        "ProcessorState",
        "{19b30cde-3e41-4cff-83c8-3df2779f840c}",
        "LastLoadInfo",
        "UserModeTime",
        "IKEv2",
        "MSFT_StorageJobOutParams",
        "The upper 4 bits (28-31) determine the class of the element. The next 4 bits (24-27) determine the format of the element data. The lower 24 bits (0-23) determine the sub-type of the element.",
        "FX_TRACE_RESERVED_1c",
        " The target operating system of the this software element.",
        "CD_5C866111FD8D1933EECCE5D44B619D3E64BDDD0B43BC6F39166BF254D48A504F.305.1503074335.498",
        "NumberOfSoftResets",
        "MaxNumVFs",
        "EmbeddedObject",
        "If this property does not contain 0 or null and the implementation does not support this parameter, a return code of 'Use Of Timeout Parameter Not Supported' shall be returned.",
        "MCA_ERROR_PCI_BUS_PARITY",
        "Normal - Specified for a process with no special scheduling needs.",
        "SessionDirectoryClusterName",
        "TraceLevel",
        "Heap Subsegment Activated",
        "WakeEventInstrumentation",
        "SIDsToDisable",
        "The PartComponent reference represents a user or  system account that is a part of a group of accounts.",
        "{92ECDE80-E3D2-11d2-8601-0000F8102E5F}",
        "The TransportName property specifies the name of the transport that the client is using to communicate with the server",
        "%ExpectedPID%",
        "The UUID property contains the Universally Unique Identifier (UUID) for this product. A UUID is a 128-bit identifier that is guaranteed to be different from other generated UUIDs. If a UUID is not available, a UUID of all zeros is used.",
        "IgnoreExtensionDataObject",
        "byte * 10^3",
        "CD_4548ABC60D8D754BA5CDF5BF3F98D090EE4DF751AB5940B6E9A6298C3D9C3BAA.1480.3576073111.1736",
        "Noise",
        "Access.bus",
        "ref:CIM_PolicyAction",
        "I_F461AA66D8B7B7D281791B03410E52860C27B31270AE3EE90F1659A118058546.388.1.47882",
        "970DA",
        "Virtual Trunk Group",
        "Synchronize IPsec policy",
        "1 = \"Other\", indicating that the recovery action will be specified in the OtherRecoveryAction property ",
        "Number of media types in use.",
        "Effective",
        "VirtualIfTunnelId",
        "ConnectionStatus",
        "Data for Scsi Info Exceptions Mode Page",
        "CR_5FB7EBFF7E65F2B5A8D86A305D94319B3C99F6846C3536F671E3F448D940CE69",
        "This field indicates the sum of used space on this physical disk. This should include usage from all storage pools and other data stored on the disk.",
        "CD_6C707473A832E8EC791BEE1730A35E787F78F19C8E76CAC82C47C44288E55A89.2099.3274795999.552",
        "MIB.IETF|HOST-RESOURCES-MIB.hrSystemDate",
        "XCoordinate",
        "InfraredSupported",
        "Set_BCSecretKey",
        "{A3E41207-BE04-492a-AFF0-19E880FF7545}",
        "Associates the processor and system memory, or a processor's cache.",
        "The specified sharing protocol is not supported.",
        "Reference to the job (may be null if task completed).",
        "The specified portal was not found.",
        "%1: The storage management provider's cache is empty.%2",
        "IL_A652C2031A398BA1BCC19829AA29BBA940B833717CFD10EB3A678C370F38E883.449.1.60127",
        "The receive link speed in bits per second.",
        "CIM_NumericSensor.SensorContext",
        "R_979D1EA059854DCEDF2345318722F29EF1D55F537C02E38427A8558140AFFFB1",
        "GetOwnerSid",
        "RemoteServerName",
        "AutoBoost Clear Floor",
        "SyncInterval",
        "Diagnose",
        "Specifies if the capture is required at each possible layer in the target networking stack, or just the default layer. For a VMSwitch, the filter is installed at the top of the extension stack by default. For a physical network adapater, the filter is installed just above the miniport.",
        "ref:MSFT_NetAdapterPowerManagementSettingData",
        "RSOP_GPO.id=\"LocalGPO\"",
        "MCA_WARNING_CPU",
        "_DH_WMP_SYNCMGR Flag",
        "TargetPool shall not be supplied",
        "RWString",
        "SpecifyMaximumFileSizeApplicationLog",
        "FileIo_ReadWrite",
        "NdisDriverVersion",
        "System Call Enter",
        "Storage arrival events are used whenever a storage object is added or created.",
        "NdisStatusDot11TkipmicFailureIndication",
        "WMI_CHANGER_PROBLEM_WARNING_GUID",
        "ID of the token-based activation license that activated the machine.",
        "MSiSCSIInitiator_TargetAddress",
        "CIM_Sensor",
        "This column contains the server extension that is to be associated with the MIME content, without the dot.",
        "IMAPI2 Utilities",
        "Win32_LUIDandAttributes",
        "DOT11_MSM_SCAN Flag",
        "WhenNeeded - This corresponds to OverWriteOutdated = 0.",
        "The MaximumAddressSize property indicates the maximum length of a socket address supported by the protocol.  Socket addresses may be items like URLs (www.microsoft.com) or IP addresses (130.215.24.1).",
        "LPCDRVR_TRACE_RESERVED_0d",
        "PNP_RESOURCE_VERBOSE_LEVEL",
        "Maximum supported size for a PD receive queue. A value of 0 indicates that the adapter does not have a hard limit.",
        "40023",
        "The name of the product's supplier.",
        "MDM_Policy_Config01_ExploitGuard02",
        "Name is a semi-unique (scoped to the owning file server), human-readable string used to identify a file share.",
        "Specifies the time at which the source generated the event.",
        "C_EC5C4DC0FE89185F526B955C798149CABA4B33211BEF571147AFFE5014EB1AA6",
        "Configures the Web-proxy for the specified VPN connection",
        "The TargetOperatingSystem indicates the target operating system of the owning software element.",
        "AddByAdaptivePort",
        "Electrophotographic LED",
        "Minor operation",
        "SystemSKUNumber",
        "UserMatchCondition",
        "Bid2Etw_OLEDB_1_Trace",
        "CIM_PrintJob.Copies",
        "An identity used by IPsec",
        "IL_CA599D6A29EF58E9CC298260942301AFE42CF6FFCEB9502DACD0BAA50DED4DEE.530.1.21465",
        "MI_ERRORCATEGORY_RESOURCE_BUSY",
        "SetPromptForPassword",
        "The EnableDevQueryPrint property indicates whether to hold documents in the queue, if document and printer setups do not match",
        "The minimum number of clients required to connect to a KMS host in order to enable volume licensing.",
        "A copy of the instance that changed to generate the Indication. SourceInstance contains the current values of the properties selected by the Indication Filter's Query. In the case of CIM_InstDeletion, the property values are copied before the instance is deleted.",
        "WPD_TRACE_LEVEL_VERBOSE",
        "Computer system's physical memory management. ",
        "CIM_Sensor.OtherSensorTypeDescription",
        "Proprietary Point-to-Point Serial",
        "TracePower",
        "LUID of the FWPS_LAYER_IPSEC_XX layer FWPS filter corresponding to this SA",
        "Enable Or Disable Hardware Failure Prediction",
        "Offloading",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.314.2772854538.368",
        "ref:MSFT_NetAdapterChecksumOffloadSettingData",
        "MsDtcWmi_EventProvider",
        "LUAInstall: error 0x00000005 setting flags [{C21B45B8-5D76-4575-BA27-54823098C491}]",
        "The AccessMask property is a bit array representing the access rights as set remotely on the network share held by the user or group on whose behalf the instance is returned. This property is only supported under Windows NT and Windows 2000. ",
        "SupportedSynchronousActions",
        "The EnableIPSec method is used to enable IP security on this specific TCP/IP-enabled network adapter. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. Ports are secured only when the IPFilterSecurityEnabled property is TRUE.",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardDate|wMinute",
        "ThreatID",
        "CD_8A4037032A1E93595308B4A4BD6D8BFAF65C3C979F3304AFFC616809C573E05E.39.2394225330.570",
        "{632fcc78-6057-48f9-8d5f-4bb0f73d3cd1}",
        "UpgradeEditionWithProductKeyMethod",
        "Controls RSC setting for IPv4 TCP packets.",
        "The IPSecPermitIPProtocols property lists the protocols permitted to run over the IP. The list of protocols is defined using the EnableIPSec method. ",
        "Autoswitch",
        "14 - 'Mixed': Applies to the CopyState of GroupSynchronized. It indicates the StorageSynchronized associations of the elements in the groups have different CopyState values.",
        "IR_3FD6B33F4FF166B0F7CE61EB62E55B303FF2BF4A74F913CACB488AD245C02047",
        "MDM_ApplicationControl_PolicyIDs03",
        "The ReplySize property indicates the size of the buffer returned.",
        "Win32API|Service Functions|ControlService|dwControl|SERVICE_CONTROL_STOP",
        "NotSurfaced",
        "Caption",
        "Minimum package version",
        "CD_1A9E3B957294E1E2A3BD1A3F9CA79E41F6CD3130E2786884F3F69878725410E6.35.3109101709.310",
        "PointerSize",
        "Slowest performance state disregarding policy restrictions",
        "object:HBAFCPBindingEntry2",
        "This event is the base event for process events.",
        "The StartTime parameter represents the UTC time to run the job.  This is of the form YYYYMMDDHHMMSS.MMMMMM(+-)OOO, where YYYYMMDD must be replaced by ********.",
        "Storage Standard Server Edition",
        "CIM_MediaAccessDevice",
        "AccountLogon_AuditKerberosAuthenticationService",
        "Invalid subnet mask",
        "LPCDRVR_TRACE_RESERVED_02 Flag",
        "StorageTierUniqueId",
        "CD_B39F79BEF0550EE7F9E981A83A152A3A4B6173B3A32D2E630E92CBAA2FE60E90.1649.3486047473.1072",
        "UseDefaultWebProxy",
        "The Priority property indicates the dynamic priority of the thread. Each thread has a dynamic priority that the scheduler uses to determine which thread to execute. Initially, a thread's dynamic priority is the same as its base priority. The system can raise and lower the dynamic priority, to ensure that it is responsive (guaranteeing that no threads are starved for processor time). The system does not boost the priority of threads with a base priority level between 16 and 31. Only threads with a base priority between 0 and 15 receive dynamic priority boosts. Higher numbers indicate higher priorities.",
        "BranchCache task orchestrator",
        "{846FD708-3D8E-44DD-BF22-04813ED03586}",
        "R_F2A1670452611B171DBD4E5FF5429578943F6D66B18C2769FE1D044818E2B5AB.2460.4189449634.554",
        "The Win32_ImplementedCategory class represents an association between a component category and the COM classusing its interfaces.",
        "RevisionLevel",
        "Adapter",
        "SamSetInfoUser_Start",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_DE17C9D5088F4B642733CF8AEA90F5A7AFA5A9B0892FB2650254AF86F16B343D",
        "0xC0000013",
        "StorageFaultDomainsToUse",
        "Soft Off",
        "{527BC6CE-BAFE-11d2-85E5-0000F8102E5F}",
        "CurrentHorizontalResolution",
        "I_E3D6956C9AC5D82845A5B017A22EF25487755E3C3A9322BE0116D0C7010A0C20.569.1.55789",
        "AllowSetKey",
        "Active width (in pixels)",
        "UUUUU",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pPortName",
        "Sets various attributes and properties of the disk. The disk must be online for most attributes to be set.",
        "MIB.IETF|HOST-RESOURCES-MIB.hrProcessorLoad",
        "Media type of this physical disk",
        "Control Value",
        "FeedUrl",
        "LocalPath",
        "Classification of this storage tier in the virtual disk",
        "Abandoned",
        "MSFT_NetAdapterUsoSettingData",
        "PathExists",
        "AllowNullTargetNameMatch",
        "MSKeyboard",
        "C_297B009625C3BEC5F682DA65A87D7971BDE24BF0C5093DE7BD3ABBE18CF35D09",
        "ImplementationSource",
        "PNPClass",
        "LoadOrder",
        "InputObject",
        "Count of Number of Digest errors occured in this session",
        "LockedDownInternetZoneJavaPermissions",
        "A TimeSpan that specifies the lifetime issued to all new security cookies.",
        "I_33E04994CA4A70429FE677E9D3FD3A84A89CF8D3D2921E1207010996980144D0.311.4076504440.249",
        "Win32_OfflineFilesProvider",
        "Msft_WmiProvider_NewQuery_Post",
        "The DomainDNSRegistrationEnabled property specifies whether the IP addresses for this connection are registered in DNS under the domain name of this connection, in addition to registering under the computer's full DNS name. The domain name of this connection is either set via the method SetDNSDomain() or assigned by DHCP. The registered name is the host name of the computer with the domain name appended. Windows 2000 only.",
        "AcpiPss",
        "CD_153A90D31DAA2BB98D107166F8216FEE25A312878D4AECBB89966D3EAC52B5F6.2039.1537572267.240",
        "Entry",
        "The email addresses of those persons to be included on the CC: line.",
        "An array containing the operational status of each voltage sensor of the enclosure. ",
        "MinorOperation",
        "{a14f1c97-8839-4f8a-9996-a28996ebbf1d}",
        "the TypeOfService property provides an indication of the abstract parameters of the quality of service desired.  These parameters are to be used to guide the selection of the actual service parameters when transmitting a datagram through a particular network.  The default value is 0. ",
        "#ifndef _ISCSI_ISCSIDSC_",
        "A Boolean value that specifies whether Teredo (a technology for addressing clients that are behind firewalls) is enabled. ",
        "Field to display whether the resource is in desired state.",
        "QuadWords",
        "KerbLogonUser",
        "Specifies whether to enable or disable Clipboard mapping.",
        "The ScreenWidth property specifies the width of the physical screen.   ",
        "DisableBlockAtFirstSeen",
        "\\\\.\\Root\\Microsoft\\Windows\\DeliveryOptimization:__Win32Provider.Name=\"DeliveryOptimizationMIProv\"",
        "HBA_EVENT_PORT_NEW_TARGETS",
        "An integer enumeration describing the algorithm to determine which cache lines or buckets should be re-used.",
        "CR_35B1B65B914DF07FAC7860C3407AEAACB382311D5C7C7979B2E9A007C56D4FA3",
        "    EapConfigXmlStream  - a string that specifies the content of XML file containing the EAP Configuration.",
        "BIOSReleaseDate",
        "Transport Mode",
        "IMAPI2 dll",
        "CD_4CC99CFC9275918BD831680B062D25E87A34D427349AA13CFBBAC5888CFC907F.1192.677086726.290",
        "Specifies the percent of the work completed to reach synchronization. Must be set to NULL if implementation is not capable of providing this information.",
        "{697d5a7e-2062-11d4-97eb-00c04f79c403}",
        "object:MSStorageDriver_ScsiRequestBlock",
        "ref:MSFT_NetAdapter",
        "This parameter contains the Authentication method configured for the current VPN connection profile.",
        "5BD8C144F890DD1628D2D632822D5CE3B99BFDA24BA6CC55C387B3C4.137.2065240135.1520",
        "Computer",
        "R_E80ABEF9F2B89F7F7F65B9C5267052D745A292EFA75CA4F2CB385D3318120667.1500.1672323294.588",
        "Asynchronous Snapshot Local",
        "The position of this physical memory in an interleave. 0 indicates non-interleaved. 1 indicates the first position, 2 the second position and so on. ",
        "{57d6ff16-db8a-4205-bdc0-b690e9a2f862}",
        "The Name of the VPN Connection profile.",
        "LUAInstall: error 0x00000005 setting flags [{73D14237-B9DB-4efa-",
        "Select * from Win32_PrinterConfiguration",
        "Challenge",
        "Win32_PowerSettingDefinitionPossibleValue",
        "    //                   has been sent or received.",
        "{96ab095a-9519-4f5c-81ee-c510b0a45463}",
        "Active High",
        "POINTER_PORT_WMI_OTHER",
        "Remove_BCDataCacheExtensionByPath",
        "Slot M",
        "522E1798-D74F-4516-94F5-C121B0F4A8CB",
        "Allocation Address",
        "The Protocol property reveals the routing mechanism via which this route was learned. Inclusion of values for gateway routing protocols is not intended to imply that hosts must support those protocols.",
        "NDIS 802.11 network type in use determines whether the station uses Frequency Hopping Spread Spectrum or Direct Sequence Spread Spectrum.",
        "Character Set: Alphanumeric",
        "NdisMediaConnectStatus",
        "object:MSNdis_WmiIPSecOffloadV1_IPv4AH",
        "1 - 'Integrity Streams': Only files with integrity streams will be scrubbed. ",
        "CIM_PhysicalComputerSystemView.NumericSensorUpperThresholdNonCritical",
        "Association between StorageNode and StoragePool.",
        "The Lockout property determines whether the user account is locked out of the system.",
        "NetworkAdapter is an Abstract class defining general networking hardware concepts (for example, PermanentAddress or Speed of operation). NetworkAdapters are Devices with the ability to support multiple, higher level protocols and provide the implementation behind the Network Model's ProtocolEndpoint class. (This information is conveyed using the DeviceSAPImplementation association, defined in the Core Model.) NetworkAdapters and their Endpoints represent the potential for connectivity among peers.",
        "#define HBA_EVENT_TARGET_OFFLINE        0x401",
        "ExitCode",
        "2 - 'OK': The element is present and working with no issues detected. ",
        "SAM Get Members In Group",
        "DeviceChar",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|InactivityScale",
        "REDBOOK_WMI_PERF_DATA",
        "Paths, represented by an array of redirection paths",
        "{791ad19a-e35c-11d0-9692-00c04fc3358c}",
        "Specifies the number of bytes used to form a strip in common striping-based resiliency settings. The strip is defined as the size of the portion of a stripe that lies on one physical disk. Thus Interleave * NumberOfColumns will yield the total size of one stripe.",
        "TimeCheck policy [QueryPerformanceCounter units]",
        "CR_25A225BFD7C0706940B21958E1B4E7879B81C1069B2DA72D3945C2F2A653CB92",
        "SCSI Fibre Channel SCA-II (20 pins)",
        "A string containing LogRecord data. ",
        "The LogicalFile 'contained within' the Directory.",
        "The FlowControlHard property contains the command string used to enable hardware flow control. Flow control consists of signals sent between computers that verify that both computers are ready to transmit or receive data.",
        "MinNumberNeeded indicates the smallest number of elements that must be operational in order to have redundancy.  For example, in an N+1 redundancy relationship, the MinNumberNeeded property should be set equal to N.",
        "10GBase-SW",
        "StreamingAllowLocationProvider",
        "InternetZoneJavaPermissions",
        "CRITICAL",
        "The specified LUN is not provided by the specified adapter",
        "Whether NetworkDirect connectivity outside of local IP subnet is allowed or not. One of the following values:  - Blocked  - Allowed",
        "CD_9D8D293A690FFEF350AE4D7C020869D528F57982A60CEA02D406951DA64B57DC.2615.3657052618.566",
        "B291553C4CBCA712D0343FC3CCA099002D9033C.2654.176141691.346",
        "LocalAddress",
        "Mini-Centronics Type-26",
        "Section",
        "Font name. For TrueType Fonts and TrueType Collections if NULL the installer registers the font after reading the correct font title from the font file.",
        "PCI Parity Error",
        "CIM_BootSourceSetting.StructuredBootString",
        "The DNSDomain property indicates an organization name followed by a period and an extension that indicates the type of organization, such as microsoft.com. ",
        "DetailedTracking_AuditProcessCreation",
        "ref:Win32_PhysicalMemory",
        "IPProtocolMatchCondition",
        "ERROR",
        "RouterDiscovery",
        "LossofDwordSyncCount",
        "object:MSFT_NetAdapter_RdmaStatistics",
        "Enables Disk Fair-Share Scheduling: (0) Disk Fair-Share Scheduling is disabled, (1) Disk Fair-Share Scheduling is enabled.",
        "HOSTPROC_TRACE_REQUEST",
        "Specifies the HTTP method allowed for the request.",
        "PlugPlay",
        "0x80050042",
        "1 - Other. The format is defined by the value of the OtherErrorSourceFormat property.2 - CIMObjectPath. A CIM Object Path as defined in the CIM Infrastructure specification. Note: CIM 2.5 and earlier used the term object names.",
        "AttributeCaching",
        "One of the physical disks specified is not supported by this operation.",
        "GetKeyPackage",
        "MIF.DMTF|Memory Device|002.21",
        "Win32_NTDomain",
        "MSFC_FibrePortNPIVMethodsEx",
        "MaxChannelPerSession",
        "StoreInstallMethod",
        "The ExposedLocally property indicates whether the shadow copy is exposed on the local machine with a drive letter or mount point. If this flag and the ExposedRemotely flag is not set, the shadow copy is hidden.",
        "DistanceBetweenSlots",
        "43032",
        "PLATFORM_TRACE_RESERVED_1e Flag",
        "ColorTableEntries",
        "__PATH",
        "Number of bytes transmitted via ethernet port",
        "SetByPrintConfigObject",
        "CD_20435E8E6AE6B07C92579F794D715DB6D35677395F702CF6B0B37C21C5C70F22.1617.3365262687.365",
        "CIM_SoftwareIdentity.BuildNumber",
        "R_C02C41AB4846F97931E5D01FBF12A4A1A5B3CB06D088BD1C51C3165A032FC9C8",
        "windowsVersion",
        "CreateGroup",
        "Microsoft iSCSI Initiator: Target Login Options",
        "PortableDeviceAPI_Automation Flag",
        "Count",
        "This field should contain the CIM Object Path to the SMP storage provider object.",
        "AdapterString",
        "PAL B",
        "DisableDiagnosticDataViewer",
        "RSOP_PolmkrEnvironmentSetting",
        "Structure identification. These bits identify the microarchitectural structure where the error occurred.",
        "RestrictedSitesZoneAllowAccessToDataSources",
        "Downlevel IPsec Service",
        "MSFT_DOCurrentStatus",
        "CertificateID",
        "CD_4B73D56414C32450B76C83F50259BEF1BF1973367F51A9AA685F527A570A98B1.1185.3693822253.298",
        "v64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41",
        "Target",
        "SessionConnectionTimeoutErrorCount",
        "NDIS Receive Buffer Space",
        "After Delta",
        "The name of the ODBC attribute.",
        "C_A9AE64C03C11270991C8BCE26EBE3DD0FF3F841C3C80D3A28DC949EF9B62D60B",
        "AuditSmb1Access",
        "CR_1592BFFCE522F75E708AF00D4ECAEEBA5AFE422B12D1211F8015509DB1FF98D6",
        "Specifies the Security Identifier of the entry.",
        "RDNIC",
        "appliedOrder",
        "Invalid security parameter",
        "The ExtClock property specifies the external clock frequency. If the frequency is unknown this property is set to null.",
        "SamChangePwdComputer",
        "LockedDownIntranetJavaPermissions",
        "PublishingAllowServer3",
        "The DHCPEnabled property indicates whether the dynamic host configuration protocol  (DHCP) server automatically assigns an IP address to the computer system when establishing a network connection. ",
        "WUUUUU",
        "3 - Quality of Service Error. Errors of this type are principally associated with failures that result in reduced functionality or performance. ",
        "VolumeDosName",
        "UPSPort",
        "The Scale-Out File Server cluster role is not installed.",
        "An enumeration indicating the activities that are granted or denied. These activities apply to all entities specified in the ActivityQualifiers array. The values in the enumeration are straightforward except for one, 4=\"Detect\". This value indicates that the existence or presence of an entity may be determined, but not necessarily specific data (which requires the Read privilege to be true). This activity is exemplified by 'hidden files'- if you list the contents of a directory, you will not see hidden files. However, if you know a specific file name, or know how to expose hidden files, then they can be 'detected'. Another example is the ability to define search privileges in directory implementations.",
        "Task provider for the BidTrace setting for WDAC components.",
        "This class will be used for iSCSI discovery logins.",
        "Win32_CurrentTime",
        "CR_A3BB95ED0B202A25A7223B16F2A4B7FC5CE2975B203508279C7D21714713609A",
        "Specifies the name of the port used or created for the printer.",
        "This parameter indicates whether the chkdsk operation should be performed at next boot up time, in case the operation could not be performed because the disk was locked at time the method was called.",
        "Case Sensitive Search",
        "LastRunInitialBackedSlabs",
        "LicenseDependsOn",
        "SidTypeUnknown - Indicates an unknown SID type.",
        "CR_25FE04D9255CB27C85849C6AF1510F628FE6A726CD3A80FEA1131E58085890F1",
        "Default block size supported",
        "UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation",
        "12 - WorkStation Trust Account -  A computer account for a Windows NT/Windows 2000 workstation or a Windows NT/Windows 2000 server that is a member of this domain.",
        "Win32_CurrentProbe",
        "MessageID",
        "select * from MSFT_StorageFaultEvent",
        "\\\\.\\root\\cimv2:__Win32Provider.Name=\"Msft_ProviderSubSystem\"",
        "2.5 Gbps",
        "The Win32_PageFile class has been Deprecated in favor of the Win32_PageFileUsage and Win32_PageFileSetting. These classes respectively correspond to the runtime and persisted states of pagefiles. The Win32_PageFile represents the file used for handling virtual memory file swapping on a Win32 system.",
        "Object which contains details of a connection to the Internet, including proxy settings.",
        "CR_2800F9F89075C56302A7CF7269B5300116A62BE579546FA42D0E22E3EA14FE1F",
        "DomainName",
        "CategoryString",
        "PNRPHLP",
        "TR_BUF",
        "CR_FC9E01349E08A98452DDAB16AF1AEDB5BCA867ACBFA422162975D70294A03F4B",
        "blocking",
        "The Windows Installer product code, a unique id identifying the software product.",
        "TraceInit Flag",
        "CRLcheck",
        "CD_5CF48B4594AF5A29D8F38D01C51E1EBAB43B90EB9606F532D289B128EB56580D.1735.1574734703.7957",
        "Example: Elnkii.",
        "Whether to log blocked traffic.",
        "\\\\.\\root\\default:__Win32Provider.Name=\"LogFileEventConsumer\"",
        "This method adds one or more storage fault domains for manual allocation.",
        "16550 Compatible",
        "Maximum number of seconds that cached attributes are held after file modification.",
        "TRACE_STACK",
        "Scanner Device",
        "Win32_ODBCTranslatorSpecification",
        "Autonomous System Number",
        "AlternatePortAddress",
        "The maximum number of pending asynchronous accept threads that are available for processing incoming connections on the service.",
        "OLEDB",
        "The version number of this WMI Provider",
        "C_BC9D109850BB5F86324C40247B677E50BD3CFF55E165C6078CA0EA6516A48293",
        "NDISWMI_TRACE_CALL Flag",
        "Security level for the Trusted Sites security zone",
        "An enumerated value indicating an administrator's default/startup configuration for an element's Enabled State. By default, the element is \"Enabled\" (value=2).",
        "Whether the binding requires signature confirmation.",
        "Indicates the current printer language being used. A language that is being used by the Printer should also be listed in LanguagesSupported.",
        "PrivateInterfaceAliases",
        "Clears any previously specified port number.",
        "MIF.DMTF|Memory Device|002.6",
        "The route using the endpoint.",
        "CoalescingEvents",
        "Use Configuration Agent to apply the configuration.",
        "The GUID property specifies the Globally-unique identifier for the connection.",
        "WD_LOG_FLAG_FUNCTION_TRACE Flag",
        "ROOT\\Microsoft\\SecurityClient",
        "Capabilities and management of the processor logical device.",
        "CD_F63E9DDBFEF6B5F00A102DFF31BE7441561DE4396AD9FF89BE26AD8D006CEB79.2198.2816180968.359",
        "NS_43C2C02FBB103B6C99DD6A3C49100E0157200FB50F8CAEF2EC314CAEF9D9E15C",
        "ModifyFirmwareEnvironment",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.314.1165541664.180",
        "ref:RSOP_IEToolbarButton",
        "CE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0",
        "Monitor's descriptor",
        "#define ISCSI_LOGIN_FLAG_REQUIRE_IPSEC                0x00000001",
        "The ProviderOperation_ValidateSubscription property indicates the number of calls to IWbemEventConsumerProviderEx :: ValidateSubscription.",
        "The ErrorMethodology property specifies the types of error checking used by the memory hardware.",
        "Indicates whether or not the Job should be automatically deleted upon termination. This parameter takes precedence over the property, DeleteOnCompletion.",
        "Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|ReadTransferCount",
        "MDM_Restrictions",
        "CIM_Thread",
        "The Recursive input parameter is a boolean that indicates whether the change of ownership will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input param",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|UseZeroBroadcast",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_53D75572FCE95F80C91561DC225542041A284A87D7D3C4BC247CCB4A988D11E5",
        "I_37ECB0FC067D850AC282384258FD54C71F901EB4FE0DA87DE18B8C19E1262A36.587.1.74409",
        "The Index property specifies the index number of the Win32 network adapter configuration. The index number is used when there is more than one configuration available.",
        "Shadow copy provider vetoed the operation",
        "IPv4SubnetMask",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|lpProtocol",
        " 95 and Windows 98 computers only. ",
        "0xEFFF0059",
        "AddressSpaceID",
        "Specifies the Internet contacts or address-book program you want to use with Internet Explorer.",
        "An array indicating the print languages natively supported.",
        "userGPOFilters",
        "Indicates if a device supports 64-bit DMA.",
        "If this method is successful, the Device's Availability and AdditionalAvailability properties should reflect the updated status. If a failure occurs trying to bring the Device online or offline, it should remain in its current state. IE, the request, if unsuccessful, should not leave the Device in an indeterminate state. When bringing a Device back \"Online\", from an \"Offline\" mode, the Device should be restored to its last \"Online\" state, if at all possible. Only a Device that has an EnabledState/StatusInfo of \"Enabled\" and has been configured can be brought online or taken offline. ",
        "fileMark",
        "6 - 'Error': The element detected one or more critical issues. ",
        "The SendAdminAlert property indicates whether or not an alert message will be sent to the system administrator in the event of an operating system failure.",
        "USNJRNL Flag",
        "C_DCC2AE997AB356670D27AB6AF0A0DF5B38BE28906D897D91C86FB38CED159D17",
        "The List of Published Applications available on a Terminal Server",
        "C_F63E9DDBFEF6B5F00A102DFF31BE7441561DE4396AD9FF89BE26AD8D006CEB79",
        "MSFT_NetLbfoTeam_TeamNic",
        "CscNetApi",
        "Disk Performance Information",
        "A textual description. ",
        "EffectiveAddressFamily",
        "The name of the binding.",
        "AuthorizedPrivilege for IPMI",
        "AutomaticSessionShutdown",
        "TEST_TRACE_RESERVED_1c Flag",
        "{1008CCEA-7BFF-11D2-AAD2-006008C78BC7}",
        "SPACES_StorageProvider",
        "BfeTraceProvider",
        "EncryptionStatus",
        "The user-friendly name for this instance of a Job. In addition, the user-friendly name can be used as a property for a search or query. (Note: Name does not have to be unique within a namespace.)",
        "BOOT Flag",
        "PriorityClass",
        "Limit Affinity",
        "SpecifiedLSList",
        "The DfsEntryPath parameter specifies the path of the DFS root.",
        "PolicySourceTimeZoneRedirection",
        "Decoupled:Com",
        "Win32_OSRecoveryConfiguration",
        "This column specifies the action taken by the startup program if the service fails to start during startup. One of the following error control flags must be specified in this column.",
        "Sets the GPT guid of the disk. This parameter is only valid when the disk's PartitionStyle property is set to 2 - 'GPT'. An error will be returned if the disk is any other partition style.",
        "Memory Card",
        "{FCC86599-DB20-11d2-85FC-0000F8102E5F}",
        "HOSTPROC_RESERVED_19",
        "Win32_CIMLogicalDeviceCIMDataFile",
        "Flexible Diskette",
        "AntivirusSignatureVersion",
        "C_EA78D27F46C798D1329821D7CEABFD06DD3833EE6512664694DD451E0D988F35",
        "HiPerfCooker_v1",
        "CD_AC9AD25BD40B6722261E256701F4549D4AD6E3CDC6187FFACB6CAF3D4F5CC978.266.2566627531.680",
        "Other - For integer values other than those listed above, refer to the documentation on the Win32 error codes.",
        "ConfigureSimplifiedChineseIMEVersion",
        "40-bit",
        "Determines whether local IPsec rules should be merged into the effective policy along with rules from Group Policy.",
        "Class for holding properties of a resource object.",
        "MSIde",
        "Number of SCSIController timeouts that have occurred since the TimeOfLastReset.",
        "ConnectionSpecificSuffixSearchList",
        "Remote Replica Source or Target",
        "Deactivate",
        "P_GPLink",
        "setting",
        "C:\\Windows\\system32\\drivers\\ndis.sys[MofResourceName]",
        "MDM_Firewall_PrivateProfile02",
        "ApiSetHosted",
        "The MaximumSize property indicates the maximum size of the page file.",
        "Name of GPO, if not specified the default GPO on the domain",
        "SamGetGrpsForUser_End",
        "CD_9A0DB23B4C5307A117BBF9E162F8E0A10B387D66AA6B5AEFE4F2996B31F1D028.1638.345736028.317",
        "One of the following values:   No: Not advertised in Route Advertisements. This is the default.   Age: Advertised in Route Advertisements with a finite lifetime.   Yes: Advertised in Route Advertisements with an infinite lifetime.",
        "The IPXEnabled property determines whether the or Internetwork Packet Exchange (IPX) protocol is bound and enabled for this adapter.",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_ENCRYPTS",
        "I_352DA062E6CEF4DA2F5F5D5156A0C6A57E2D07D0BD43F09E3B9B31D33B72076E.2462.3117649240.360",
        "WLANHC_AUTOCONFIG",
        "CR_3AA9C8A0942F537FDAE95E548CCBAD1AD1FFA8F4AD1AFE2EE57031F74E67B391",
        "SMBIOS|Type 13|Language Strings",
        "RSOP_PolmkrShortcutSetting",
        "CIM_VolumeSet represents a contiguous range of logical blocks presented to the operating environment for reading and writing user data.  Volume sets shall not overlap one another. They are based on one or more physical extents, protected space extents, or aggregate extents (all of the same type). These based on associations should be instantiated or subclassed as needed.",
        "FileObject",
        "The extended partition still contains other partitions.",
        "R_2460E8CBAD4976C1EF65909F8B454C3EA4189EE3EFB11690076237B70F3B14A4.1635.3365930065.564",
        "LS-120 Support",
        "{DAC60DFB-C50C-11DA-82C4-000D5692A4BC}",
        "OperationalStatus replaces the Status property on ManagedSystemElement to provide a consistent approach to enumerations, to address implementation needs for an array property, and to provide a migration path from today's environment to the future. This change was not made earlier because it required the deprecated qualifier. Due to the widespread use of the existing Status property in management applications, it is strongly recommended that providers or instrumentation provide both the Status and OperationalStatus properties. Further, the first value of OperationalStatus should contain the primary status for the element. When instrumented, Status (because it is single-valued) should also provide the primary status of the element.",
        "Win32API|System Information Structures|OSVERSIONINFOEX|dwMajorVersion, dwMinorVersion",
        "Supplies the priority of this offload. A lower value implies a higher priority offload.",
        "This indicates the time before stale data will be moved off of this fault domain object.",
        "MDM_Policy_User_Result01_System02",
        "The XOnCharacter property specifies the value of the XON character for both transmission and reception. XON is a software control to resume the transmission of data (whereas RTS and CTS are hardware controls). XOFF stops the transmission.",
        "R_C6F2B33A9F7EE971E46DC4A05944D1F3ED258A4BBB229A6782F76407411C3AAF",
        "RequireUpdateApproval",
        "TRUE if the adapter should use DHCP to discover DNS addresses.",
        "AccountLogonLogoff_AuditIPsecQuickMode",
        "Port Name",
        "R_130F1C3C29111AD1E8F485A9C57AAA4AFD7E43ED53D005581436A437F8C3A1B8",
        "The ResetLimit property indicates the number of consecutive time the system reset will be attempted. A value of -1 indicates that the limit is unknown",
        "MIF.DMTF|Memory Device Mapped Addresses|001.6",
        "PUnit",
        "NominalReading indicates the 'normal' or expected value for the numeric sensor.",
        "MDM_Policy_Config01_UserRights02",
        "{9668DF4E-DB32-11d2-85FC-0000F8102E5F}",
        "VmqSupported",
        "DOMinBackgroundQos",
        "LogDisk",
        "The service that is dependent on an underlying SAP.",
        "LogHeaderDescExists",
        "TimeZoneInformation",
        "CR_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45",
        "ScsiReportLuns",
        "CR_6C1898742A435BD7596F148E1B69FF49CF55B8A3AC2058CDA5C944CFF7E6FBB0",
        "The ClassName property hold the name of the class targeted for deletion.",
        "CR_D6B832D04D0FAB582A050E5212201E6DF3C06194D4D96931CCBF8B3053F5A8AF",
        "R_7758B30874183320F25F4F9789C477D48C7F6AAB3A386DF09B6FBEBA7488BB28",
        "PolicyStoreSource",
        "Index ort set of the micro architectural structure where the error was located.",
        "Presence",
        "IL_D1B648BE68EC7094B701AE10865E8710BF3CA0727020E467239EE608D1A161DA.691.1.31519",
        "C_D769628D5FBDC4BA586DBAD54F9BBC7939E2EAE50970F6EE1F1C2EEC6A00F545",
        "The number of frames the NIC cannot receive due to lack of NIC receive buffer space.",
        "System failure: Try changing the driver for this device. If that does not work, see your hardware documentation.Windows is removing this device.",
        "A persistent binding request included a bad local SCSI logical unit number",
        "TRACE_CLASS_NLC",
        "             enumerated either. If ReplaceNewOwnerProfile is not specified, this flag will have ",
        "Shadow Set ID",
        "IsNested",
        "TargetStorageObjects",
        "PauseFunctions",
        "WheaGetAllPolicyRtn",
        "object:__ACE",
        "Specifies the number of bytes that should be used for a strip in the common striping-based resiliency settings. The strip is defined as the size of the portion of a stripe that lies on one physical disk. Thus Interleave * NumberOfColumns will yield the size of one stripe of user data.",
        "USECOUNT Flag",
        "MSNdis_80211_ConfigurationFH",
        "LastSyncDurationCautionInHours",
        "iScsiDebug26",
        "The time interval between consecutive runs for reapplying the configuration to get to the desired state.",
        "The Name string provides the name of the property to be displayed.",
        "Portal Identifier String",
        "PCI_BUS_DATA is valid",
        "LogAreaLength",
        "iScsi Portal Information Class",
        "The location of the audit log. ",
        "CR_DA3DC1260150EA9B0B2628C0C2AA81125377900B91EB681EA05BC31E6A7900FC",
        "RSOP_SecuritySettingNumericBlocked",
        "11 - Invalid Address",
        "20 - CIM_ERR_NAMESPACE_NOT_EMPTY. The specified Namespace is not empty.",
        "{8502C4B0-5FBB-11D2-AAC1-006008C78BC7}",
        "TraceUser",
        "SamGetAliasMem",
        "Simple Text",
        "The name of the server that the printer driver will be added to.",
        "The actual hash algorithm used by the SA.",
        "BlockOutDurationMin",
        "ConfirmTargetData",
        "TRACELEVELONE Flag",
        "Whether the the connection is applied per machine, per user1 = User, 2 = Machine.",
        "SessionKeyRolloverInterval",
        "TunnelEnabled",
        "LUAInstall: error 0x00000005 setting flags [{73959FD1-7360-42F7-807D-622341783DC0}]",
        "Maximum size, in Kbytes, of media supported by this device. KBytes is interpreted as the number of bytes multiplied by 1000 (NOT the number of bytes multiplied by 1024).",
        "Private network interfaces",
        "MultifunctionDevice",
        "Specifies whether to use the current synchronization context to choose the thread of execution.",
        "The Slot class represents Connectors into which Packages are inserted. For example, a PhysicalPackage that is a DiskDrive may be inserted into an SCA 'Slot'. As another example, a Card (subclass of PhysicalPackage) may be inserted into a 16-, 32-, or 64-bit expansion 'Slot' on a HostingBoard. PCI or PCMCIA Type III Slots are examples of the latter.",
        "object:Win32_PrinterDriver",
        "DnsEnabled",
        "Admin Flag",
        "2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "Maximum Due Time",
        "GetBindingCapability",
        "Win32API|Tape Backup Structures|TAPE_GET_DRIVE_PARAMETERS|Compression",
        "    <registryKey keyName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.InstallService.Control.InstallServiceControl\">",
        "Exposed Remotely",
        "WSManAutoDebug",
        "MDM_Update_Rollback01",
        "Client",
        "TRUE if the interface is in promiscuous mode or FALSE if it is not.",
        "SM_RemoveTarget",
        "IL_C59E83547F1BC933FE30770D4EDB5077AA988B54FE242F5F66DA214D449E875A.320.1.62809",
        "CIM_Product.IdentifyingNumber",
        "ComputerSystem",
        "DVD-Audio",
        "RemoteAttributes",
        "Quotas Enabled",
        "Output from Setting Interrupt Moderation of the adapter",
        "MaxValue",
        "Meta-Configuration information at time of configuration.",
        "MSFT_NetAdapterSettingData",
        "    Guid (Guid) Specifies the read-only GUID that represents the phone-book entry",
        "Virtual Path to the application",
        " Individual USBPorts are associated with the Hub using the USBPortOnHub association.",
        "MSIndex",
        "C_73F9CC8D0A2B5107ED79AE2372D78EAA3B2A7A24FD2BD2876517DA1B42CB16AD",
        "BytesTransmittedPersec",
        "Indicates whether or not a user must use the same client in order  to reconnect to a disconnected session.",
        "Key Handle",
        "An array of strings indicating the network addresses for an adapter.",
        "MIF.DMTF|Memory Array Mapped Addresses|001.3",
        "WSP_FileServerToVolume",
        "Enables QoS on the network adapter.",
        "Specifies the UDP ports for filtering",
        "ACPI T-state dependency",
        "The guid of the type of object the security settings are applied to",
        "CD_5E46683FD84F3219E379253BDA01FEC308C95988FDF4807D31199D70DC1E39D4.1677.1699830722.344",
        "AutoDetect",
        "A physical package can be hot swapped if it is possible to replace the element with a physically different but equivalent one while the containing package has power applied to it (i.e., is 'on').  For example, a disk drive package inserted using SCA connectors is removable and can be hot swapped. All packages that can be hot swapped are inherently removable and replaceable.",
        "NOTIFY_STREAM_FILE_OBJECT",
        "Internal store name to install the certificate",
        "PolicySourceActiveSessionLimit indicates whether the property ActiveSessionLimit is configured by Server (0),Group Policy (1), Default (2).",
        "Moveable",
        "IL_133AE77889577C41679A67ADB2FE6AD9A47EDBC4C9E19AA735345C392697BF03.522.1.61884",
        "OldVersion",
        "PrivilegesNotHeld",
        "ActionTime",
        "RequireKerberosArmoring",
        "RegistryConfigured",
        "Win32_PnPDeviceProperty",
        "Process Terminate Event",
        "CR_FCF416010D567B5041BC82F46732C142DC125B68750168BA980728F3E2F25AEF",
        "Bid2Etw_MSADCF_1_Trace",
        "User_Intervention_Req",
        "ValidTo",
        "PortableDeviceTypes_Collections Flag",
        "The IPsec rule.",
        "CIM_InstCreation",
        "NeedsCleaning",
        "Win32API|Device Context Functions|GetDeviceCaps|VERTSIZE",
        "The hotkey for the shortcut. It has the virtual-key code for the key in the low-order byte, and the modifier flags in the high-order byte. ",
        "A persi",
        "Release For Section Synchronization",
        "47001",
        "List of VPN servers the VPN client can connect to",
        "C_524ED280AB38E3BD86074B4D556A261D98A4E9D85B8A2DCDD6AA2F85E3342805",
        "Dedicated",
        "MsftMultisessionSequential_DebugDestructor Flag",
        "C_D2A706123FEDDDB0E412FDF2001A3E316EB3BAC437EDAC79D66B7AE69CAEFF59",
        "C_D3E87AC2C5095799D67D44AE7591A2749E7365471471AF9E1AB7656018268D5D",
        "GetKeyProtectorExternalKey",
        "The Priority property indicates the scheduling priority of the process within the operating system. ",
        "Win32_TSDeploymentSettings",
        "FILE_READ_ATTRIBUTES",
        "ProductKeyURL",
        "{7ebb5755-1255-44aa-bd20-25f77b03d064}",
        "This parameter specifies the target ports which should be used when showing the virtual disks to the initiators. The number of target ports that can be specified depends on the subsystem's MaskingPortsPerView property. If MaskingPortsPerView is set to 4 - 'All target ports share the same view', this parameter is essentially ignored as all target ports on the system will be associated with this masking set.",
        "The Win32_Share class represents a shared resource on a Win32 system. This may be a disk drive, printer, interprocess communication, or other shareable device.",
        "S-HDSL",
        "BiosDate",
        "Thermal Stamp",
        "WeekOfManufacture",
        "MSFT_ResiliencySetting.NumberOfColumnsMax",
        "Statistics Info of the adapter",
        "This flag indicates whether the VPN Connection is auto-trigger enabled.",
        "The HandleCount property specifies the total number of handles currently open by this process. This number is the sum of the handles currently open by each thread in this process. A handle is used to examine or modify the system resources. Each handle has an entry in an internally maintained table. These entries contain the addresses of the resources and the means to identify the resource type.",
        "The SMBIOSMajorVersion property contains the major SMBIOS version number. This property will be NULL if SMBIOS not found.",
        "CR_048516085D0CFD11B2F57F36AC760E979F1E172A7E7675BE4EBC8F8315497197",
        "Name of the setting in storage health that wants to be retrieved. If omitted, all the settings are retrieved.",
        "PortableDeviceAPI_DriverCommunication",
        "Indicates the physical elements that make up a FRU.",
        "The State property indicates the current state of the base service.",
        "AutomaticUseCustom",
        "An association between a policy setting and its status.",
        "Rollback to previous configuration.",
        "TRACE_CLASS_COMMAND",
        "MDM_Client",
        "Specifies the duplexing mode the printer should use by default.",
        "CI_4890EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "ResetFWRulesOnly",
        "TargetClass",
        "The KeepAliveInterval parameter specifies the value for the interval separating Keep Alive Retransmissions until a response is received.",
        "Win32API|Process and Thread Structures|STARTUPINFO|dwYSize",
        "This describes a single RSOP session.  Currently there can be only one of these per namespace.",
        "ChannelStatus",
        "Name of Licensing Mode",
        "The specified storage tier could not be found on the volume. Confirm that the storage tier name is valid.",
        "Pool Paged Bytes",
        "MaxProcessors",
        ", m;, m;",
        "CD_8236493D7B4C97328F05E9610B58340A9B36DA2FAD39FFAA641A6E8D9062FAF7.1131.252662121.300",
        "Restore users' application and Windows settings back to the original settings state.",
        "21     System failure: Try changing the driver for this device. If that does not work, see your hardware documentation. Windows is removing this device. ",
        "Limit Job Time - Establishes a user-mode execution time limit for the job. This flag cannot be used with Limit Preserve Job Time. ",
        "The InprocHandler property contains the full path to a 16-bit custom handler for the COM component.",
        "Force",
        "8/m;8/m;",
        "Retransmit time (in ms).",
        "MSFT_CliAlias.FriendlyName=\"UPS\"",
        "Determines the default allocation behavior for virtual disks created in this pool. Fault domain aware virtual disks will intelligently pick the physical disks to use for their redundancy to balance the fault tolerance between two (or more) fault domain units of the specified type.",
        "Specifies the encryption level for the VPN connection.",
        "DOPercentageMaxForegroundBandwidth",
        "RSOP_AuditPolicyBlocked",
        "One or more physical disks are already in use.",
        "PendingClientTimeoutInSeconds",
        "S4U Error Flag",
        "MIF.DMTF|Software Signature|002.5",
        "A value used to define a UINT32 value. This value is readable.",
        "NonInteractiveProcessEnforcement",
        "IL_ABAFF26A954D1C98B7369DD9DD561E63B101887A4E8D958C085057A4F843012F.2676.2277202629.275",
        "{e700e91e-8451-4a81-89ba-c5779050ea6b}",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|Compression_Off",
        "second * 10^-9",
        "PublishingAllowServer2",
        "CheckApp",
        "HbaPortWWN",
        "BufferOverrunErrorCount",
        "The dynamic UnLoad method unloads the COM server associated with the particular instance of the provider. Further calls intothe provider with the same CLSID will return WBEM_E_PROVIDER_DISABLED. If the COM server implementation is an inproc server hosted in the provider host process it will receive calls to the exported function DllCanUnloadNow, if the provider responds by returning TRUE then COM will unload the executable image. Currently COM is configured to unload the executable approximately 30 seconds after the first successful call to DllCanUnloadNow. If hosted in some other process surrogate the surrogate will unload using some other strategy. The provider can be re-enabled either through the use of the Msft_Provider :: Load method, changes to the associated instance of __Win32Provider or via service restart.",
        "CD_FADBE2E77FCF902970F9409C89AA00953D8589FFDED776632A19501236075BDC.1570.1926945154.430",
        "IsCommandBlocked",
        "CHAP secret given does not conform to the standard. Please see system event log for more information.",
        "This property indicates the partition's MBR type. This property is only valid when the disk's PartitionStyle property is set to 1 - 'MBR' and will be NULL for all other partition styles.",
        "{520319a9-b932-4ec7-943c-61e560939101}",
        "msieee8023-PolicyData",
        "Check if UEV is in reboot required state.",
        " The InstalledSoftwareElement association allows one to  to identify the Computer System a particular Software element is installed on. ",
        "MsftDiscMaster2_DebugConstructor Flag",
        "   ISCSI_CHAP_AUTH_TYPE = 1,",
        "The Name property provides a unique identifier for the table. This identifier may be referenced in the Translate switch.",
        "MSNdis_AtmMaxActiveVciBits",
        "NdisReserved3",
        "WUUUUUUUUU",
        "Alternate Phone Numbers",
        "Enable/Disable UEV",
        "The FlowControlSoft property contains the command string used to enable software flow control. Flow control consists of signals sent between computers that verify that both computers are ready to transmit or receive data.",
        "Current number of partitions",
        "MSNdis_StatusDot11TkipmicFailure",
        "CD_DF63DA4731494DE04BDDA4D884913821094DB03ED408823FA36FE78B0159CEB1.1594.701274514.1053",
        "appbackgroundtask",
        "The ElapsedTime property indicates the total execution time given to this thread since its creation.",
        "TypeOfAlgorithm",
        "MonitorManufacturer",
        "The Username parameter is a pointer to a constant null-terminated character string that specifies the account name to use when connecting to the domain controller. The string must specify either a domain NetBIOS name and user account (for example, \"REDMON",
        "HeapSubsegmentReuseThresholdActivated",
        "ref:Win32_MSIResource",
        "PreviousClassDefinition",
        "Example: C:\\PUBLIC.",
        "ref:Win32_SerialPortConfiguration",
        "Win32_WIN32_TERMINALSERVICE_Prov",
        "iScsiFlagBoot",
        "Registry Hive Rundown",
        "{6ac4e23d-a950-4518-8b2b-aa4dcd5fe14a}",
        "HBA_STATUS",
        "Assignment Type",
        "MSNdis_StatusResetEnd",
        "SecurityCenter2",
        "OptimizedFilesSize",
        "ReceivedPacketErrors",
        "File resource module manager class inheriting from OMI_ResourceModuleManager class",
        "The AutoRecoverMofs property contains a list of fully qualified MOF file names used to initialize or recover the WMI repository. The list determines the order in which MOFs are compiled.",
        "SleepTimeout",
        "Workstations",
        "SECAM L1",
        "{FAF76B8C-798C-11D2-AAD1-006008C78BC7}",
        "File Trace Event",
        "TR_BUF Flag",
        "Inherited from RSOP_PolicySetting",
        "The Win32_ProtocolBinding class represents an association among a system level driver, network protocol, and network adapter.",
        "SDDLString",
        "MSFT_NetEventProvider",
        "An integer enumeration indicating the memory access operation that caused the last error. The type of error is described by the ErrorInfo property. If the ErrorInfo property is equal to 3, \"OK\", then this property has no meaning.",
        "__CLASS",
        "EnableDevQ",
        "List of urls to download content from",
        "VccMixedVoltageSupport",
        "Last full scan age in days",
        "This property returns whether the 'Passwords' option under 'Change Settings' is turned on",
        "Number of bytes for dot11 disassociation status indication",
        "FX_TRACE_RESERVED_13 Flag",
        "ProfileType",
        "TRUE if the redirection is temporary. FALSE otherwise",
        "The Pause method pauses the print queue. No jobs can print anymore until the print queue is resumed. The method can return the following values:",
        "AppvClientConnectionGroup",
        "This field describes the minimum number of bytes that can form a strip in common striping-based resiliency settings. The strip is defined as the size of the portion of a stripe that lies on one physical disk.",
        "ScanScheduleTime",
        "File name of the file represented by this instance.",
        "InstallLicensePackage",
        "Verbs",
        "lemented",
        "IL_BD93AFD54A2CBC0AAE6AC538B824779A9A1273B2B91BB9D43D9256B804C5A7BC.445.1.30870",
        "SwitchID",
        "SmhbaLUN",
        "The Group reference represents the CIM_SpareGroup.",
        "The hardware information setting data for network adapter.",
        "SettableBaudRate",
        "RSSPlatformPerformanceTraceProvider",
        "CD_94167BF91BE19E1C62EEDAB062E1BD60608CAB59EBE8824D966E9FC0913F7356.1103.260938622.488",
        "This method gathers all diagnostic information and logs that the Storage SubSystem maintains, and copies them to the path specified by the DestinationPath parameter.",
        "Registry override of a specific capability",
        "MSStorageDriver_ClassErrorLog",
        "AllowTextSuggestions",
        "RPSessionInterval",
        "Related Activity ID",
        "LocalPortResolutionEmpty",
        "//  in the registry.",
        "Count of # of  PDU sent over this connection",
        "Report Records",
        "CD_A05374182360C61F50CB18CDEC015D253C42693E608575287859129E69245893.2620.1459082191.1743",
        "OneXEAPXml",
        "Key-value pairs of the ODBC driver.",
        "Gopher Proxy Server",
        "The BuildVersion property contains version information for the currently installed WMI service.",
        "XUQUUs",
        "This property is the registry value.",
        "AllowCameraMicrophoneRedirection",
        "File IO",
        "Partition",
        "MS_Power_Management_Event_Provider",
        "Invalid volume label",
        "0xEFFF0010",
        "Win32API|Service Functions|ControlService|dwControl",
        "TurboChannel",
        "SessionLimitType",
        "The Id of the appdomain.",
        "Represents a 3D print queue and its associated settings.",
        "CD_A963FF6A8458E9C4FEA354824C031F4237B8648981577F19FD6854C86994DA8C.1798.1.8651",
        "Processes (CIM)",
        "OldOwnerAuth",
        "CIM_StorageExtent.SystemCreationClassName",
        "CIM_Sensor.SensorType",
        "DVD-10",
        "NumOpens",
        "RemoveConnection",
        "Kernel Thermal Event",
        "Storage pool: The pool, along with any associated resiliency settings, virtual disks, and physical disks will be discovered. ",
        "MSFT_NetIPv4Protocol",
        "The DiscardNULLBytes property determines whether to discard NULL bytes (characters) when they are received.",
        "Specifies whether to publish the printer in the AD.",
        "MSFT_CliAlias.FriendlyName=\"CPU\"",
        "CIM_LogicalDevice.SystemCreationClassName",
        "R_F33B13E58D7A9AAB64E31B8DEDA19CFF557C834DF5EDDCB1F5F929CFA150BD59",
        "Brings the partition online by mounting the associated volume (if one exists).",
        "The card that hosts another card.",
        "CIM_StorageDefect",
        "GetReplicationRelationshipInstances",
        "DoNotUseWebResults",
        "R_57839BB831B678823813D6DE5621B2492B8DEE2CAA3C37F3643245385D720644",
        "The storage pool could not complete the operation because its health or operational status does not permit it.",
        "CIM_ToDirectoryAction",
        "MIDI Port",
        "LUAInstall: error 0x00000005 setting flags [{C20CE506-5DA9-4B9C-9662-D88BD30",
        "CheckServerCertificateRevocation",
        "Indicates the version of the provider.",
        "CD_1FD7B26C8C4FFE0BF45F5DDC5492AED41895B4A7FEA3E20CF6E8FADC218E797E.40.981822121.397",
        "PLATFORM_TRACE_RESERVED_14 Flag",
        "Dial String",
        "NS_5CF6F9641D4AAF44F18181FA22B732295FA75500CE844EE9D6144DAF9F98E074\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_21E85A20CC15E835CB6487F54DC9B230DDD677D1A3F958EEE3ACBA0DE0846B34",
        "Interactive UNIX",
        "RmClient_RestartManager",
        "EventTrace_V1_Header",
        "SAAction is the base class for the various types of key exchange or IPsec actions. It is abstract and used to categorize the different types of actions of SARules.",
        "The Name property specifies the name of the user account on a particular domain or machine. The number of characters in the name cannot exceed the value of UNLEN.",
        "R_E307BE2388F4DD08F0918C82D97E15C14EE0D97137D0C6FB34A30F84A30D07C8.1149.1548500264.516",
        "Compression Capable",
        "CommonName",
        "Creation time.",
        "GuidInheritedObjectType",
        "LetAppsAccessMotion_UserInControlOfTheseApps",
        "NormalDownloads",
        "PublishingAllowServer1",
        "ChangeBootConfiguration",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"DFSProvider\"",
        "BusSpeed",
        "The quota setting",
        "MSFT_NetFirewallRuleFilterByInterface",
        "Breach Successful",
        "The State property indicates the state of the target. The state is reported as a bit map, where each bit is interpretted as follows. Note that Offline and Online are mutually exclusive.",
        "IPC Admin",
        "TotalVirtualMemorySize",
        "Relates a connection security rule to its Quick Mode Crypto Set.",
        "CIM_PSExtentBasedOnPExtent",
        "_UUUUUUU",
        "ItemPath",
        "Bits per Second",
        "CD_1E88F907B6AB946BA7ADADEE8E260F06B3FB1525A4BFD9A858EFE9DCEC84BE35.2622.3905402544.223",
        "LockedDownIntranetZoneAllowNETFrameworkReliantComponents",
        "Localized version of RSOP_PolmkrImmediateTaskV2Setting for American English",
        "MIF.DMTF|Portable Battery|002.11",
        "8..65000",
        "ref:CIM_System",
        "Paperout",
        "MSFT_PipelineDefinition",
        "ROOT\\Microsoft\\Windows\\HardwareManagement",
        "Idle timout for established TCP sessions",
        "DemotePercent",
        "Read Time",
        "NS_FE3EA006C3292950A76C2B5A0185D7DF99ADD6FD6502E0AC079E3A8650E76E3A\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_4BD704EFD82E90D58D3C406978C7C044F013A64518E8C54785195D2358D9CFAE",
        "IsBridge",
        "{5808c8aa-7e8f-42e0-85d2-e1e90434cfb3}",
        "The parent Policy in the association.",
        "The maximum number of outbound channels per endpoint.",
        "SupportsVolumeCreation",
        "MsftDiscFormat2Erase",
        "Indicates the SRIOV support for the device.",
        "GraphicsScore",
        "FileServerNodeName",
        "MSFT_StorageTier",
        "Association between StorageSubSystem and Disk",
        "SupportThresholds",
        "Execution Status ID - Enumeration",
        "Win32API|Network Management Functions|Domain",
        "Combat Net Radio",
        "I_D66C684E9FC811F59DEEE01676A52DEC4EE3ED220BA185CD83762B906B852957.883.1.79329",
        "PhyDisk",
        "object:MS_SMHBA_BINDINGENTRY",
        "MSFT_NetBranchCacheNetworkSettingData",
        "Specifies the permissions for the printer as an SDDL string.",
        "Id of the operation's process",
        "ChannelId",
        "The AttachDebugger method launches the currently registered debugger for this process.  Dr. Watson, however, is not supported. /nThe method returns a 'generic failure' if it finds an invalid string in the registry key or an integer value that can be interp",
        "C_BFC8B938622E2DB869D95C1AAA9015F080331D812139563B91142DFEA46D4FF4",
        "Key ID",
        "For assigned applications, whether or not a lightweight install or an actual install is performed ",
        "The DNSHostName parameter specifies the name of the DNS host to be enabled by this method./nExample: corpdns",
        "Binding",
        "GetPortAttributesByWWN",
        "Page Punt",
        "Returns the VpnConnectionTriggerTrustedNetwork object containing the list of trusted networks for auto triggering",
        "MaintenanceScheduleAllowWakeup",
        "TRACINGIOTARGET",
        "Both XonXoff and RTS/CTS",
        "\\\\.\\root\\CIMV2:__Win32Provider.Name=\"MSVDS__PROVIDER\"",
        "FragmentedFiles",
        "C_048516085D0CFD11B2F57F36AC760E979F1E172A7E7675BE4EBC8F8315497197",
        "Device Type",
        "The name of the volume for which this report is generated.  This property can the the volume drive letter, a mount point or the volume GUID name.",
        "MSFT_TaskPrincipal2",
        "Reference to the job spawned if the operation continues after the method returns. (May be null if the task is completed).",
        "Last requested throttle percentage",
        "ipsecOwnersReference",
        "SupportedFileServerProtocols",
        "CD_05D916B8A6374C4F193D5E08BCB54B1C2461B412F69F755D01428DA36005F49B.2545.2210461905.574",
        "PackageVersion",
        "The ArpAlwaysSourceRoute property indicates whether the Address Resolution Protocol (ARP) must always use source routing. If this property is TRUE, TCP/IP will transmit ARP queries with source routing enabled on Token Ring networks. By default, ARP first queries without source routing, and retries with source routing enabled if no reply was received. Source routing allows the routing of network packets across different types of networks. Default: FALSE.",
        "Association between iSCSITarget and iSCSISession",
        "SetInfoTrustedDom",
        "UseProxyName",
        "MSiSCSI_Eventlog",
        "URL for directed discovery used for an Ipp port, this parameter can not be specified at the same time with DeviceURL or DeviceUUID",
        "Fast Ethernet (100BaseT)",
        "Total Master File Table Fragments",
        "The Win32_VideoConfiguration class is not active in releases after Windows 2000. It will not return any instances as there is no provider backing it.  ",
        "The physical element whose location is specified.",
        "The Tag property uniquely identifies the on-board device connected to the system.",
        "Option",
        "WMI_TAPE_PROBLEM_WARNING",
        "PrinterEnvironment",
        "The RemoteName property contains the remote network resource name for a network resource. ",
        "EnableDNS",
        "HTMLEditorProgram",
        "// The number of IKE messages received that are queued for processing.",
        "CreatedPartition",
        "SettingIndex",
        "Indicates the selected paper size.",
        "R_DFC25D46E8711DD4634FF6390AFD6E0F348F88B4F5FAE966D405DF4EAE83DD54",
        "DSCP (RFC 2474) marking for inbound IPv6 filter exempted traffic. Value must be <= 63.",
        "PageSavable",
        "smallCustomLogoBitmapPath",
        "Defines the checksum offload encapsulation settings for the Adapter for IPv4 transmit packets.",
        "One or more storage devices are unresponsive.",
        "Direct Mapped",
        "CIM_Indication.SequenceContext",
        "This class exposes offload data transfer (ODX) settings for a subsystem.",
        "MCA_ERROR_MEM_UNKNOWN",
        "The friendly name the Virtual Machine to which the queue is assigned.",
        "0XD025",
        "CurrentCacheLevel",
        "Memory chip information.",
        "    <registryKey keyName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\WindowsUpdate.Internal.InstallControl\">",
        "IsWriteable",
        "INFO Flag",
        "HKEY_USERS (0x80000003) ",
        "NtNumber",
        "CIM_PCMCIAController",
        "Generic Address Descriptor",
        "SameElement represents an alternate aspect of the System entity.",
        "NuBus",
        "CR_290F6F8B3B7EAA26E7735FACB33E9185DC97B5AF85F7FE15A4C9FA4C0EBACD95",
        "12 - 'Aborted': The copy operation is aborted with the Abort operation. Use the Resync Replica operation to restart the copy operation. ",
        "]UUUUUU",
        "ObjectId is a mandatory property that is used to opaquely and uniquely identify an instance of a class. ObjectIds must be unique within the scope of the management server (which is hosting the provider). The ObjectId is created and maintained for use of the Storage Management Providers and their clients to track instances of objects. If an object is visible through two different paths (for example: there are two separate Storage Management Providers that point to the same storage subsystem) then the same object may appear with two different ObjectIds. For determining if two object instances are the same object, refer to the UniqueId property.",
        "The amount of memory, in bytes, on the NIC available for buffering transmit data.",
        "SourceHandle",
        "{8502C4D4-5FBB-11D2-AAC1-006008C78BC7}",
        "Transport security settings.",
        "Denotes whether a user can delete a virtual disk through the use of the DeleteObject extrinsic method on the virtual disk instance.",
        "iScsiDebug31 Flag",
        "The Level property further defines the processor type. The value  depends on the architecture of the processor.",
        "Specifies the VPN Server List.",
        "nanoseconds",
        "s INF file in the driver store.",
        "C_567A5780A80E396C0983EB16985C38ECB3908CF71E7B109F7F8365635205A7AB",
        "MSNdis_SetLinkParameters",
        "6 - 'Synchronized': An Async or Sync replication is currently synchronized. When this value is set, SyncMaintained will be true. ",
        "Enables or disables the SingleSession state.",
        "The QuantumType property specifies either fixed or variable length quantums. Windows NT 4.0 Workstation/Windows 2000 defaults to variable length quantums where the foreground application has a longer quantum than the background applications. Windows NT Server defaults to fixed-length quantums. A quantum is a unit of execution time that the scheduler is allowed to give to an application before switching to another application. When a thread runs one quantum, the kernel preempts it and moves it to the end of a queue for applications with equal priorities. The actual length of a thread's quantum varies across different Windows platforms. For Windows NT/Windows 2000 only./nThe property can take the following values: /n0 = Unkown - Quantum Type not known./n1 = Fixed - Quantum length is fixed./n2 = Variable - Quantum length is variable.",
        "Paradyne EtherLoop 2",
        "3 - 'Hot Spare': This physical disk should be used as a hot spare. ",
        "The PauseService method attempts to place the service in the paused state. It returns an integer value of 0 if the PauseService request was accepted, 1 if the request is not supported, and any other number to indicate an error. It returns one of the following integer values:",
        "MSStorageDriver_FailurePredictThresholds",
        "ref:Win32_NamedJobObjectActgInfo",
        "TEST_TRACE_RESERVED_15",
        "SelectedCounter",
        "SetCost3G",
        "ISCSI_ERR_INVALID_CHAP_CHALLENGE_SIZE",
        "The group number for a set of logical processors.",
        "File System",
        "AllowFullScreenMode",
        "SLActivate",
        "Active",
        "OutputRequests",
        "The Win32_ClassicCOMClassSettings class represents an association between a COM class and the settings used to configure instances of the COM class.",
        "{36B58EA2-C461-4bb0-AC8E-952F59D251ED}",
        "Win32API|Communication Structures|DCB|fOutX",
        "Teredo server used by the client",
        "R_0B91D9FD5945CFB775F0EBD6F596CF88166602A6156A99CD2B11EC548E5ED28D",
        "Low Battery",
        "Associates a network port with its advanced property configuration stored in the registry.",
        "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE",
        "Returns whether any combination of the following are enabled:",
        "The User who is to be notified upon the Job completion or failure.",
        "DisallowExploitProtectionOverride",
        "One of the following values:   Active: Set only lasts until next boot.   Persistent: Set is persistent (default).",
        "R_241ED574CEA1CE45C178048218C62F092191B3FEDB2EDBBB00DA39363C5BD5B2.1163.2401848248.526",
        "C_2610AE43344CB8A8BEBCBF0C082C8831B2C58FDE9BB071E6F1F013E7085FE453",
        "0x00001000",
        "CIM_SoftwareElement.SoftwareElementState",
        "A user-friendly string representing the name of the fault domain object.",
        "WMI|Win32_PrinterConfiguration",
        " The Reinstall property indicates that this software element can  transition to its next state even if a software element of the same  version  already exists in the environment.",
        "SCSITimeouts",
        "Win32_ShadowVolumeSupport",
        "LogFileName",
        "A value that specifies the time, in seconds, after which an idle connection is terminated. Unless the idle time-out is disabled, the entire connection is terminated if the connection is idle for the specified interval.",
        " The CIM_SoftwareElement class is used to decompose  a CIM_SoftwareFeature object into a set of individually  manageable or deployable parts for a particular platform.   A software element's platform is uniquely identified by its  underlying hardware architecture and operating system  (for example Sun Solaris on Sun Sparc or Windows NT on Intel).   As such, to understand the details of how the functionality  of a particular software feature is provided on a particular  platform, the CIM_SoftwareElement objects referenced by   CIM_SoftwareFeatureSoftwareElement associations are organized   in disjoint sets based on the TargetOperatingSystem property.    A CIM_SoftwareElement object captures the management  details of a part or component in one of  four states  characterized by the SoftwareElementState property.   ",
        "FSCreationClassName",
        "Receive filter global parameters of the adapter",
        "Win32_VideoConfiguration",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmPaperLength",
        "The name of the print processor for this device.",
        "ConfigurationNumber",
        "MaxTransferLength",
        "The default action for outbound traffic.",
        "0x20000000",
        "RequestedFilterIdBitCount",
        "FirstRangeSize",
        "CIM_PhysicalComputerSystemView.NumericSensorUpperThresholdFatal",
        "Current network interface operational status.",
        "No primary path specified when at least one is expected.",
        "A free form string describing the media and/or its use.",
        "Win32_OperatingSystemAutochkSetting",
        "Pool Snapshot Event",
        "WEDL_AssignedAccess",
        "MSNdis_WmiTcpLargeSendOffloadV2_IPv4",
        "GroupMask6",
        "Read Cache",
        "ProcessStartupInformation",
        "CD_92D90F38218063ED84DEBF091001DAB75383FEA23B31338C700BDB5B69D9A383.1147.1473008673.1810",
        "ExclusionExtension",
        "The FileShareBackup Win32_ShadowContext specifies a non-persistent and auto-release shadow copy created without writer involvement.",
        "VPD83NAA5",
        "{07ffaa1d-34f6-49cd-b541-2f0d7dff15c4}",
        "AutoDisconnectTimeout",
        "MSTapeDriveParam",
        "ref:Win32_NTLogEvent",
        "{aceb7864-9a14-4c73-8ed0-94ec53f6651c}",
        "The name of this port.",
        "stance",
        "MaximumConnections",
        "65000",
        "ykyqo",
        "RouteMetric provides a numeric indication as to the preference of this route, compared to other routes that reach the same destination.",
        "Average File Size",
        "This represents a boolean element.",
        "TRACE_CLASS_CALL",
        "The URL of this device (when discovered via WSD Directed discovery).",
        "Lithium Polymer",
        "AutoBoostClearFloor",
        "ApertureBase",
        "CIM_ERR_CLASS_HAS_INSTANCES",
        "C_4BB71B6ADFF06C586A8BDF449E468900F2E5FA784A24501C7DD0806A9C51B570",
        "This parameter allows the user to specify a drive letter for the partition at the time of creation. This parameter cannot be used in conjunction with AssignDriveLetter. If both parameters are specified, an Invalid Parameter error will be returned. If the drive letter is not available, the partition will be created, but error '42002' will be returned.",
        "EXECUTE_SELF_TEST",
        "MaxInitiatorRequestSge",
        "SchedulingClass",
        "Special 16-bit mode supported",
        "Start Menu folder, GUID is {625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}",
        "LPC_TRACE_RESERVED_11",
        "natawareclient",
        "CIM_SettingCheck",
        "ROOT\\Microsoft\\Windows\\AppBackgroundTask",
        "Username",
        "Transp HDLC",
        "ISCSI_ERR_CONNECTION_LOST",
        "Package",
        "ReiserFS",
        "R_D3BE10B39550C29DA4ECB4ED6ADD5EC09B160843E405B8520402F382429C8E1D.2451.534044567.558",
        "Association between StorageSubSystem and VirtualDisk",
        "DoNotBlockOutdatedActiveXControls",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.279.3657065439.180",
        "E8069D8AEA3384120BB143668FB2E",
        "The ScriptPath property indicates the directory path to the user's logon script.  A logon script automatically executes a set of commands each time a user logs on to a system.",
        "BinaryMessageEncodingBindingElement",
        "DeploymentLastModifyTime",
        "42006",
        "Core Flag",
        "MSFT_CliAlias.FriendlyName=\"WMISet\"",
        "Language Match",
        "0x00000004 - Indicate the profile is a mandatory profile.",
        "BytesFromLanPeers",
        "This class represents the setting data for a power setting in the system.",
        "SPACES_StorageNodeToStorageEnclosure",
        "The key to identify the instance of MDM_SecurityStatusUser class",
        "NumTotalMacAddresses",
        "Whether weak host receives are enabled.",
        "ttlMinutes",
        "C_48A5B17344C48EDAFAA391BF26A48FFF52648D73B54F3E703A672629602CEB4B",
        "CD_C6E3EE8EF6D56B8775AB86145B48EEB7F23DE79E3696F196FBB9A7C5293D0CA2.1937.1371710679.304",
        "RegisteredUser",
        "KernelQueueDequeue",
        "A string used to identify the process. A process ID is a process handle.",
        "{7e2dbfc7-41e8-4987-bca7-76cadfad765f}",
        "MemorySize",
        "LPCDRVR_TRACE_RESERVED_1c",
        "Example: 9.",
        "System Error",
        "{f16185ab-da1b-4e5f-aab4-84a0f1e673c7}",
        "AdditionalInfo",
        "{F126ACC2-E3D4-11d2-8601-0000F8102E5F}",
        "The GetOwner method retrieves the user name and domain name under which the process is running. It returns an integer value of 0 if successful, and any other number to indicate an error.",
        "D0PacketCoalescing",
        "REMOTECONTROLSOFTWARE",
        "WPD_F5",
        "The Win32_Terminal class is the element of the TerminalSetting association where groups such as: General, Logon, Session, Environment, Remote Control, Client, Network Adapter and Permission are several configuration setting classes.",
        "iScsiFlagTimer",
        "The Locale property indicates the language identifier used by the operating system. A language identifier is a standard international numeric abbreviation for a country or region. Each language has a unique language identifier (LANGID), a 16-bit value that consists of a primary language identifier and a secondary language identifier.",
        "CIM_ParallelController.Capabilities",
        "ServicePhilosophy",
        "IL_43B7B69F919BB681DCC1079E7BED6BA29BBE6F4DDA8822130874E698F9F22509.1105.634992381.277",
        "Win32_DeviceGuard",
        "MSRedbook",
        "Modifies DNS client NRPT rule for given namespace.",
        "IF-GSN/HIPPI-6400",
        "AttackSurfaceReductionRules_Ids",
        "UserSettingsProvider",
        "DisableConfiguringHistory",
        "The namespace of the service.",
        "SMBIOSMinorVersion",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1520.1430031708.180",
        "FL Port",
        "MGR_TRACE_RESERVED_0e Flag",
        "Defines the maximum settable communication speed for accessing the phone system.",
        "Is Current",
        "Maximum size to which file is allowed to grow.  It will be archived when it exceeds this size.  Archived files have an extension of .001 through .999.  A value of zero will be interpreted to mean 'do not archive.' ",
        "ErrorControlInfo",
        "Do not reboot",
        "RenameItem",
        "Msft_WmiProvider_PutClassAsyncEvent_Pre",
        "The maximum number of queue pairs for the non-default VPort",
        "UseSurrogate",
        "RemoteDirtyByteCount",
        "Disable - RTS is ignored after the first RTS signal is received.",
        "The storage transport on this subsystem.",
        "MSFT_StorageSubSystemToTargetPortal",
        "Absolute path to the settings package file",
        "DS_NETBIOS_ADDRESS",
        "CurrentVoltage",
        "This class provides user-specific security health metrics on the device",
        "RFC1483 Multiprotocol over ATM",
        "RequirementsMode",
        "NS_C8FAC0B9742DA2229C2ECF37FBD0ED6687D27F243CFB10F824B862A83467DDCF\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_D78E65D43C587EB37A9E43FCF3F4E7363727C5F50EEB63C8CEDB36F05164AC6D",
        "Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_XONXOFF",
        "ActiveTime",
        "A laptop, a type of chassis, may be docked in another type of chassis, a docking station. This is the relationship represented by the CIM_Docked association. Because this is such a typical relationship, it is explicitly described.",
        "NdisReserved1",
        "Specifies the number of light parities to form for parity-based resiliency settings. This value must be between NumberOfGroupsMin and NumberOfGroupsMax for the resiliency setting specified by ResiliencySettingName.",
        "object:MSNdis_WmiIPSecOffloadV1",
        "FunctionEntryExit",
        "CD_308A38A70C7E63C8B0D223B592F8A2FBAAB2069E8358BFE6F473E432CFDFF602.2000.121875979.2914",
        "TraceEntryExit",
        "ROOT\\Microsoft\\Windows\\RemoteAccess\\Client\\MS_409",
        "NS_B9F15E9C0955B84B8B7E840A878C292A9483B55C2BC37006562DC762D466102F",
        "msieee8023PolicyData",
        "Volume was not found.",
        "\"Major Failure\" (20) - The element is failing. It is possible the some or all of the functionality of this component is degraded or not working. ",
        "DOMaxCacheAge",
        "TrayIconEnabled",
        "SPACES_StorageEnclosureToPhysicalDisk",
        "mCE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0",
        "UsePassportForWork",
        "IP Address",
        "Win32API|Network Management Structures|WKSTA_INFO_100|wki100_langroup",
        "extensionIds",
        "Win32_ExtensionInfoAction",
        "MSStorageDriver_ATAPISmartData",
        "C2B50E4463864CF2615B27D56E94A95716A",
        "MinSegmentCount",
        "The FJoinOptions parameter contains a set of bit flags defining the join options. This parameter can be one or more of the following values: ",
        "The AdapterType property reflects the network medium in use. ",
        "The Recursive input parameter is a boolean that indicates whether the compression will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input parameter is ignored.",
        "Thread_V4",
        "Gets only WDAC BidTrace settings that are associated with the specified application full path. You can use wildcard characters. The default is to return all WDAC BidTrace settings.",
        "IL_FDC07BF412EF517BF16CBEA0AD032C8FE94CB2DD73B9CD909C08659DB8C5BC0A.1354.303244126.276",
        "CR_E66D2A11AD2317154A9C2C61CC140BA5F198CC545A25F24736AE23D74E16B49B",
        "EncryptionInProgress",
        "0xD015",
        "MSIde_PortDeviceInfo",
        "CreatePermanentSharedObjects",
        "UserFriendlyNameLength",
        "MSFT_DeliveryOptimizationFilePeerInfo",
        "Context information that the provider can use to optimize the set from TestTargetResource, This is optional.",
        "Login Redirect Responses",
        "MDM_DeviceStatus",
        "The Win32_Service class represents a service on a Win32 computer system. A service application conforms to the interface rules of the Service Control Manager (SCM) and can be started by a user automatically at system boot through the Services control panel utility, or by an application that uses the service functions included in the Win32 API. Services can execute even when no user is logged on to the system.",
        "The ControlCode parameter specifies defined values(from 128 to 255) that provide control commands specific to a user.",
        "Charging and High",
        "The name of the server which this printer resides on.",
        "A PolicySet that aggregates other PolicySet instances.",
        "{266c72e5-62e8-11d1-ad89-00c04fd8fdff}",
        "Get Error Source Information",
        "TM_ICSC Flag",
        "Decoupled:COM",
        "Remote Desktop account management.",
        "class VpnConnectionIPsecConfiguration VpnClientIPSecPolicy",
        "SAS (SSP or STP)",
        "MGR_TRACE_RESERVED_15 Flag",
        "0:ACTION A ",
        "0xEFFF0054",
        "Enumeration indicating the supported object types associated with these replication capabilities.",
        "0xD00D - 'Scan Needed': In Windows-based storage subsystems, this indicates a scan is needed but not repair.",
        "CD_A05B58817295181CBA7B676653ED97C1E23D591F86C20D99BF4C67B62E0E211D.1748.4220100683.485",
        "CD_FD962A7CCACAB88D552FB4EA114CD68ED5194A98AC098089803CCB7DCC90E78C.1538.2489165089.512",
        "If Usage is set to 1 - 'Other', this parameter takes in the string representation of a vendor defined usage for this virtual disk. This parameter must not be set if Usage is a value other than 1 - 'Other'.",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_AFB1F2A4391AB360C9692594F916CB837FC1E6CCCCC7C79E1D6F44A2E3986C3C",
        "CurrentBrightness",
        "This method will remove one or more physical disks from manual allocation.",
        "LargeSystemCache",
        "DefragRecommended",
        "CD_0CD3432EB17462BFB5BD92FE309EBEDE9286A9F3ADCBFE4044D787F3CCDADE24.2118.119567097.911",
        "Second thermal constant",
        "Peer transport security settings.",
        "\\\\.\\root\\Microsoft\\Windows\\AppBackgroundTask:__Win32Provider.Name=\"appbackgroundtask\"",
        "Whether to turn on NetworkDirect. One of the following values:  - Disabled  - Enabled",
        "MDM_Policy_Config01_Cryptography02",
        "WNFTrace",
        "Random",
        "CD_9523EA3FC3599ACD240F830E8AF95EA7460902FA81374A4C7BBD754E74F49B88.1581.187403951.239",
        "Apartment",
        "WakeChargeExecution",
        "CD_532671ED26AC2835681FE0B122A526862616ED33CAB2C220F171DB7BD5AD8B02.1135.1710411332.181",
        "The InteractWithDesktop parameter indicates whether the specified job should be interactive (meaning a user can give input to the scheduled job while it is executing)./nValues TRUE or FALSE.  If TRUE, then the job will be interactive.  The default value of this parameter is FALSE.",
        "SamIdByName_End",
        "NS_E0090746586FF2B53E60090572D8F454B1EFCE84D6470FDDC572C5F523A110EF\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_DD169CBA4BF6715007331ACA211ACA813A231B933DCC0D2F47B4270F95EBC882",
        "The ConfigurationPath property indicates the path to the configuration files. ",
        "NOACTION",
        "Event ID",
        "MiniDumpDirectory",
        "SetInfoPolicy_Start",
        "CustomCommands",
        "CIM_LogicalDevice.DeviceID",
        "DAT Cartridge",
        "ProfileAssociationProviderInterop",
        "AudioMapping",
        "SW_FORCEMINIMIZE",
        "MPU401Address",
        "ref:Win32_FileSpecification",
        "DiskTotalBytes",
        "{e3eac9dd-2fd3-4963-bffd-b4692888c0d4}",
        "PLATFORM_TRACE_RESERVED_18",
        "Order",
        "The ModuleTrace event class is the base event for module events.",
        "OfflineScanRequired",
        "Device Arrival",
        "0x401",
        "CIM_InstIndication.SourceInstance",
        "3221232488",
        "MSMCAInfo",
        "ws Defender Firewall API - GP",
        "object:MSFT_NetAdapter_QosCapabilities",
        "Denotes the operational status of the PhysicalDisk on this StorageNode.",
        "// The number of outbound quick mode security associations (SAs) added by IKE ",
        "Describes the error correction characteristics of the modem.",
        "Target portals in group",
        "Win32API|Device Input and Output Structures|STORAGE_DEVICE_DESCRIPTOR|SerialNumberOffset",
        "GroupPolicy",
        "Acpi _PSS State",
        "The maximum bandwidth of the port in bits per second",
        "RequestId",
        "Sliding Trays",
        "error_WindowsErrorMessage",
        "MaxVSyncDenominator",
        "IoFlags",
        "0  - The protocol is stream-oriented; the concept of message size is not relevant.",
        "MaxPerfState",
        "Operating System Class Name",
        "T0454DDDA9AB999B5E05A2F468BA888F0D0794E6BA1EBDCCF2A4463EC03258CC6",
        "IrpPtr",
        "Indicate that the network adapter supports using the same interrupt vector for multiple queues when all those queues are targeted to the same processor.",
        "{570ED2E8-E3D1-11d2-8601-0000F8102E5F}",
        "FreeSpaceWipingPaused",
        "MSNdis_EthernetMoreTransmitCollisions",
        "{485e7def-0a80-11d8-ad15-505054503030}",
        "NS_B9F15E9C0955B84B8B7E840A878C292A9483B55C2BC37006562DC762D466102F\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_F725542BCC5EE818BB3268E2A39F3A53C7872F274EFAD1FD935D8C2ED42D5A80",
        "Ignore any detached virtual disks.",
        "The TCP/IP port number.  Defaults to 515.",
        "\\\\.\\Root\\WMI:__Win32Provider.Name=\"WMIProv\"",
        "Data management of a temperature sensor (electronic thermometer).",
        "{FAF76B66-798C-11D2-AAD1-006008C78BC7}",
        "{c7631639-a700-45ee-a603-a0aeac9a78e2}",
        "IPv6TransmitEncapsulation",
        "TEST_TRACE_RESERVED_07",
        "Indicates the current operating conditions of the file server. Unlike HealthStatus, this field indicates the status of hardware, software, and infrastructure issues related to this server, and can contain multiple values. Various operational statuses are defined. Many of the enumeration's values are self-explanatory.",
        "The Win32_Registry class represents the system registry on a Win32 computer system.",
        "WordMode",
        "MSFT_StorageHealthReport",
        "ClientAuthenticationMode",
        "The minimum value of a numeric parameter.",
        "Tape Drive Parameters",
        "{8502C4F5-5FBB-11D2-AAC1-006008C78BC7}",
        "R_24CFB2B4CEAD5BE9188CC5001933580DC2746C05DE76A8DB6DD098D52E4B25F0",
        "EmbeddedInstance",
        "Month",
        "Configuration",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\LanmanWorkstation\\NetworkProvider|Name",
        "DevicePath",
        "IsSigned",
        "LPCDRVR_TRACE_RESERVED_06",
        "MDM_Policy_User_Config01_Authentication02",
        "Was the cleaning action successful?",
        "PermissionSDDL",
        "The Msft_WmiProvider_UnLoadOperationEvent event class defines the removal of the provider cache entry. At this point there will be no reference held by WMI onthe COM server instance.  WMI caches provider registration objects to decrease overallexecution time. The substem will drop cache entries either through the cache ageing process, through loss of RPC connectivity, through user control or due to some change in the provider's registration.",
        "CloudBlockLevel",
        "LUAInstall: error 0x00000005 setting flags [{7390f3d8-0439-4c05-91e3-cf5cb290c3d0}]",
        "The USBHub that is associated with the Controller.",
        "SupportsEnumeration",
        "The Recursive input parameter is a boolean that indicates whether the copy will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input parameter is ignored.",
        "The scoping ComputerSystem\\'s Name.",
        "REG_BINARY",
        "CD_0DB6BAAFECF887C41F21A2964B768059B86C21B174F1D609DDE0EDA03CED0234.1540.852968003.1196",
        "CIM_StorageError",
        "Example: T.",
        "IP Protocol Number that this filter applies to.  May be 0-255 or one of the following: ICMPv4, ICMPv6, TCP, UDP.",
        "A TimeSpan that specifies the duration after which the initiator will renew the key for the security session.",
        "The Win32_MemoryArray class represents the properties of the computer system memory array and mapped addresses.",
        "The starting address on the physical media where the disk partition begins.  Ending address of the partition is determined using the NumberOfBlocks and BlockSize properties of the disk partition object.",
        "NS_1DF6C16A17137F6A0B94BEE4497A3450EBAB7A7BA90A714911FA5D8F44DE73D1",
        "0x00000004",
        "CIM::Core::Settings",
        "Error - Remote Drive",
        "R_486709A1BC1AEA1713B7B7854CB54E0BA9471BB018357C834E1DD6BAF7DE7457",
        "Passphrase to use in the computation of the server secret key.",
        "Is Next For Single Use",
        "// use radius to perform CHAP authentication. Using RADIUS is encouraged",
        "The Msft_WmiProvider_ProvideEvents_Post event class represents an event generated immediately following completion of the provider's implementation of IWbemEventProvider :: ProvideEvents.",
        "MSSid",
        "FullDllName",
        "DenyRemoteDesktopServicesLogOn",
        "MSFT_CliAlias.FriendlyName=\"MemPhysical\"",
        "ROOT\\Microsoft\\Windows\\DesiredStateConfiguration",
        "PersistentBootSource",
        "SPACES_StorageSubsystemToPhysicalDisk",
        "Manually activate specified IP-HTTPs profile",
        "Asynchronous hardware timer expired and issued a system reset",
        "C_B6D5ABBE2F1027301C23A1CF884681090FD42092F2E95A0F33AA6207C9180DA3",
        "SamAddMemToAlias_Start",
        "TS Rdp Sound End Point Trace",
        "WSP_HealthAction",
        "This volume cannot be optimized.",
        "InvalidCookiesReceived",
        "RecoveryPointIndicator",
        "The storage objects to remove from the group.",
        "PLATFORM_TRACE_RESERVED_16 Flag",
        "The UserName property indicates the owner of the environment setting. It is set to \"<SYSTEM>\" for settings that are specific to the  system (as opposed to a specific user) and \"<DEFAULT>\" for default user settings.",
        "HNet_IcsSettings",
        "M class.",
        "Translator",
        "New (2) indicates that the job has never been started. ",
        "CompCS",
        "NdisStatusDot11AssociationStartIndication",
        "9 Track Tape",
        "MSDAPRST.1 formatted output (A)",
        "tained in the Win32_VideoController, Win32_DesktopMonitor and//or CIM_VideoControllerResolution",
        "A Win32_FolderRedirectionHealth object that represents the health of the user's redirected Music folder.",
        "TP@HX\\D ",
        "CR_F071A22EE25478DF80A205153198A6FC12F84A9E6BFE53B8E5DFD1E7E2ED2B8E",
        "TcpIp_V1_TypeGroup1",
        "PerformanceCounters",
        "Use Temporary Folders Per Session bit.",
        "Specifies the processor group number for the first RSS processor.",
        "5 = Language did not match.",
        "string",
        "OutParameters",
        "Resume Automatic",
        "rasEntryData",
        "SSLCertificeSHA1HashType indicates whether the property SSLCertificeSHA1Hash is Invalid (0), Default Self-signed (1), Default GP Enforced (2) or Custom (3).",
        "CD_01E49F2BC300B8406F535D199FFE723C66F3CBCD052B872FA9DADCCDBACAAF50.200.4029537105.781",
        "CertType",
        "TEST_TRACE_RESERVED_1b",
        "RedirectPortalList",
        "0xC0000004",
        "CD_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937.1177.2402625961.3004",
        "LocalSASAddress",
        "order",
        "{FAF76B8A-798C-11D2-AAD1-006008C78BC7}",
        "RSOP_RegistryPolicySettingBlocked",
        "If set to TRUE, this instructs the physical disks in the storage scale unit to validate if enabling maintenance mode will be successful.",
        "MCA Platform IPMI System Eventlog Error Event",
        "Out of Service",
        "13     Windows cannot verify this device's resources. ",
        "The required service access point.",
        "MIF.DMTF|ComponentID|001.1",
        "10 - The service is already running.",
        "MaskingPortsPerView",
        "EVENT_TRACE_FLAG_SYSTEMCALL",
        "C_8519F629D57644187514674C7FCF7F8B0B70EEA799638913C1E17DC7E507CB73",
        "Stack12",
        "The maximum number of trace buffers used for the ETW session.",
        "CD_838E13828F10196D3F66F7B92E25AEB70BD0868AFEF218970174CFCF1AE4D54E.316.1978341804.470",
        "HostedInstallMethod",
        "object:MSFT_PrinterConfiguration",
        "A disk object models the operating system's concept of a disk device. The disk may be directly attached to the computer system, or a virtual disk exposed to the system through the use of a Storage Management Provider.",
        "Lumens",
        "The SubnetMask parameter contains the subnet masks that complement the values in the IPAddress parameter.",
        "Below Normal - Indicates a process that has priority above IDLE_PRIORITY_CLASS but below NORMAL_PRIORITY_CLASS. For Windows 2000.",
        "calendarProgram",
        "Win32API|Process and Thread Functions|CreateProcess|dwCreationFlags",
        "DSWritableFlag",
        "SamSetSecurityObj_Start",
        "LogPath",
        "Win32_SystemResources",
        "CD_3CFDE39E9D28C34AE877E11B2DF9F63280B899B04139F6BF489E37FF8557DDA2.39.2594731857.249",
        "Number of kilobytes of virtual memory currently unused and available. For example, this may be calculated by adding the amount of free RAM to the amount of free paging space (i.e., adding the properties, FreePhysicalMemory and FreeSpaceInPagingFiles).",
        "EncryptAfterHardwareTest",
        "PageFault_VirtualAlloc",
        "This method deletes the storage tier. This method is available only when the SupportsStorageTierDeletion property on the storage subsystem is set to TRUE. If it is set to FALSE, this method will fail with MI_RESULT_NOT_SUPPORTED.",
        "FWPKCLNT Trace Provider",
        "Ledger",
        "CD_22F378A2DB3FAA5D62FAF5FD5413472AD1B5CCD6D24CF8D271819C462726461F.2614.4011863282.406",
        "{4660a5d3-197e-4d58-8643-f9853b1049c1}",
        "Hyper V Enabled",
        "Select * from Win32_UninterruptiblePowerSupply",
        "X.509 Certificates (machine health)",
        "UpperThresholdNonCritical",
        "Standard Mouse",
        "OriginalString",
        "LogFlagPeer",
        "SMM Firmware Measurement",
        "The Win32_Battery class represents a battery connected to the computer system. This class applies to both batteries in Laptop Systems and other internal/external batteries.",
        "The ParityCheckEnabled property determines whether parity checking is enabled.",
        "Authentication method used by this identity",
        "MupLog",
        "{346b65dd-bbb9-43c8-a254-779b2aff95f9}",
        "The directory",
        "Endpoint2",
        "//  Each binding entry that SetPersistentEntry accepts will be stored",
        "An integer enumeration indicating the flow control (Xon-Xoff and/or RTS/CTS) for transmitted data.",
        "IdleHandler",
        "57608E0BFF28F226F0190D45.2043.1.14612",
        "Module",
        "MemoryNumberOfBlocks",
        "Proxy",
        "This field contains details on the operation of the fault domain object.",
        "An indication of the kind of technology used on the LAN. This property is deprecated in lieu of ProtocolType, which is an enumeration inherited from ProtocolEndpoint and which includes the Values specified here.",
        "IsNegated",
        "OneXSingleSignOnAllowAdditionalDialogs",
        "Association between a volume and its file shares",
        "EstimatedChargeRemaining",
        "TRACE_CLASS_MAPPING Flag",
        "3.5,  720KB,  512 bytes/sector",
        "TimeZone",
        "Power PC 620",
        "IsSuiteParent",
        "{77D8F687-8130-4A14-B8A6-3B922E05B99C}",
        "gopherProxyServer",
        "If FALSE or NULL, file will not be Unicode.",
        "CD_3196586F94E9CFEA6D912774CB2A6C6FDB2471424853F54D4C0F4EE4F94880DF.2238.1.30730",
        "0xEFFF001E",
        "Configure the Controlled folder access feature.",
        "ConversionStatus",
        "LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads",
        "IL_DD169CBA4BF6715007331ACA211ACA813A231B933DCC0D2F47B4270F95EBC882.1049.1151473019.316",
        "{ED4B1828-CD88-460F-AEFF-3D63FC8BBF68}",
        "this bit indicates whether the PWR button is treated as a fix feature (0) or a generic feature (1)",
        "SMTP Server",
        "UseUnifiedSchedulingEngine",
        "TM_PLGINT Flag",
        "WSP_StorageSubsystemToReplicationCapabilities",
        "{E5639666-C4FC-11DA-82C4-000D5692A4BC}",
        "AllowInternetExplorerStandardsMode",
        "RestrictedSitesZoneScriptingOfJavaApplets",
        "ReadCorrectedWithDelay",
        "iScsiFlagRadius",
        "MonitorType",
        "{0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9d}",
        "Specifies whether the binding supports ordered messages.",
        "Uint32",
        "The ThreadCount property specifies the number of active threads in this process. An instruction is the basic unit of execution in a processor, and a thread is the object that executes instructions. Every running process has at least one thread. This property is for computers running Windows NT only.",
        "Configuration type of this instance",
        "MSNdis_80211_FragmentationThreshold",
        "object:MSFT_NetAdapterVmqSettingData",
        "SDRAM",
        "AdvertiseDefaultRoute",
        "I_B8F2F2BF1619AAC712E46ACDC25F9EE9CD9413AE0C42388950720F238FD4DDA1.2465.2260862905.358",
        "This class provides capability to get and set configuration settings for the oma-dm agent",
        "Method Parameters Checked - Job Started",
        "DeadLetterQueue",
        "DisableBypassOfSmartScreenWarningsAboutUncommonFiles",
        "Attribute",
        "IR_51D11BF229FB1D15ABABE5E850C4C70DAC3E3C57CE24C8E314204FC6FEE752FC",
        "TraceBufferSize",
        "PhysicalPresencePrompts_Allowed",
        "TotalHeads",
        "A fatal error or unknown test error occurred while the device was executing its self-test routineand the device was unable to complete the self-test routine.",
        "FullScanEndTime",
        "13 - 'Lost Communication': indicates that the storage pool is known to exist and has been contacted successfully in the past, but is currently unreachable. ",
        "Indicates that the case of file names are preserved.",
        "ROOT\\Microsoft\\Windows\\Storage\\Providers_v2",
        "C_C8AF925AAF65508EDB0CDC4476BDCF15BFD7128CFC50F1E93BC62F64D59AB5C0",
        "A value that specifies the protection scenario being enforced by the policy.",
        "EventType",
        "{AE565838-DB33-11d2-85FC-0000F8102E5F}",
        "Specifies whether the service supports one thread, multiple threads, or reentrant calls.",
        "Describes BranchCache networking settings",
        "LS_CONNECTABLE_UNKNOWN_VALIDITY",
        "T83FE6007ACA7CBFCFFECDEAF04CC25BAB1807917E74F65A7A46C4B6A4B61A057",
        "C_7531D0F73C9D0FCC20C0C9C036C7F34D7F189FB9D62AC61E8FFDD74B2A07A836",
        "Indicates the modified cache should be output",
        "// Types of addresses that can be passed by management app to driver",
        "DoNotSyncBrowserSettings",
        "Object which contains details of program associations for IE.",
        "ManualEntryPointSelectionAllowed",
        "    RememberCredential (boolean) Specifies whether the credentials for the VPN Connection are stored in cache after first successful connection.",
        "CollectionStart",
        "NewTriggerByLogon",
        "Quiesce (9) indicates that the element is enabled but in a restricted mode. The element's behavior is similar to the Enabled state, but it only processes a restricted set of commands. All other requests are queued. ",
        "Base units of the values returned by the numeric sensors. See CIM_NumericSensor.BaseUnits for details.",
        "I_5DF699F99654C2DBF66C5FDB8987B09A99F1CFAA95812890C5421B937233B9AB.432.1.100514",
        "The CpuStatus property specifies the current status of the processor. Changes in status arise from processor usage, not the physical condition of the processor.",
        "PinnedForUser",
        "Values TRUE or FALSE. If TRUE the XOffCharacter is sent when the input buffer comes within XOffXMitThreshold bytes of being full, and the XOnCharacter is sent when the input buffer comes within XOnXMitThreshold bytes of being empty.",
        "PolicySourceReconnectPolicy indicates whether the property ReconnectPolicy is configured by Server (0),Group Policy (1), Default (2).",
        "TotalSizeInMB",
        "DcSiteName",
        "0x01000000",
        "Values: TRUE or FALSE.  A value of TRUE indicates the RLSD can be set.",
        "AllowBypass",
        "MSTapeMediaCapacity",
        "CurrentTemperature",
        "QuotaPeakNonPagedPoolUsage",
        "CD_AD7EFADAD1289B4A3FEF0D60EBF19DD1D014EA7A1302D0431E7F57E3F564CBFB.1502.4171025029.694",
        "MDM_DeviceRegistrationInfo",
        "CD_F2BEF717752C099CDF2C7677200AF2332E7D1E48B470B17CCD440B8D710B7A38.21.552539303.2773",
        "If enabled (value = 4), the unitary computer system can be reset via hardware (e.g. the power and reset buttons). If disabled (value = 3), hardware reset is not allowed. In addition to Enabled and Disabled, other values for the property are also defined - \"Not Implemented\" (5), \"Other\" (1) and \"Unknown\" (2).",
        "MSFT_StorageSubSystemToOffloadDataTransferSetting",
        "Proposals",
        "Offline Shared",
        "SECAM K1",
        "The SMBIOSPresent property indicates whether the SMBIOS is available on this computer system.",
        "CD_CE0403D1F6C8F032B580CC54FFD1B59326317C97C1A606939745A3B9BE941D11.1649.580960354.236",
        "NewSettings",
        "The signature validation type.",
        "Win32_PowerSupplyConformsToProfile",
        "AllowLockedDownRestrictedSitesZoneTemplate",
        "BackgroundImagePath",
        "CIM_EnabledLogicalElement",
        "Specifies the maximum size, in bytes, of the driver's internal output buffer. A value of zero indicates that no maximum value is imposed by the serial provider",
        "VPN Common Config",
        " The CheckMode property is used to indicate whether the condition is  expected to exist or not exist in the environment.  When the value is True, the condition is expected to exist  (e.g., a file is expected to be on a system) so invoke() is expected to  return True.  When the value is False, the condition is not expect to exist  (e.g., a file is not to be on a system) so invoke is expected to return false ",
        "KeepAliveInterval",
        "C_FA26B3AB039983C42BFEA6183B0636B462D5A8C2A474808A0AA419D892800FDB",
        "When the corresponding array entry in SupportedHostType[] is \"Other\", this entry provides a string describing the manufacturer and OS/Environment. When the corresponding SupportedHostType[] entry is not \"Other\", this entry allows variations or qualifications of ClientTypes - for example, different versions of Solaris.",
        "SubsegmentAllocCached",
        "MSNdis_StatusPacketFilterChange",
        "iSNSServerAddress",
        "KerbChangePassword_End",
        "R_1A3FB2187E23B82908958F340DD0F5EA4D8685478FCE0E52ADA73DFC114F95DA",
        "{9cfcc123-dfa0-49e1-880b-560bc8e55757}",
        "SoftwareElement",
        "The display name of the transport or filter.",
        "The MaximumOutputBufferSize property specifies the maximum size of the serial port driver's internal output buffer. A value of zero indicates that no maximum value is imposed by the serial provider.",
        "CD_F5C834F5C60D3BABC115E6B6BE5546E7D8A66BBAF89B5C7BFA41187C8795D13E.1807.313948410.288",
        "The InteractWithDesktop parameter indicates whether the specified job should be interactive (meaning a user can give input to the scheduled job while it is executing).",
        "- 2=Class Name. Example: If the authorization target is a CIM Service or a Namespace, then the ActivityQualifiers entries can define a list of classes that the authorized subject is able to create or delete. ",
        "DeviceClass",
        "The value of the SOAP action for the reply message of the operation.",
        "Cannot filter.",
        "Bitwise mask of supported sectors per read for this drive.  The lowest bit is one sector reads.  If all bits are set, there are no restrictions.",
        "Policy object for PPc",
        "MIF.DMTF|Voltage Probe|001.14",
        "This field represents the serial number of the hardware. For physical disk it must match the disk's SCSI inquiry data.",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_DBCD4213014601A293AABE7F4277D0A7FEC9623E379CDC7AA6A9EE60BBE340D3b952E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "Authenticating",
        "IL_663060429A6938D1B4C13319904DC9CB4D95E1E1D71EE9B0A8EA8DACAE58E45C.516.1.45904",
        "IPMI Provider Trace",
        "ref:Win32_COMClass",
        "MSADCF.1",
        "This field indicates the physical sector size of the disk in bytes. For example: both 4K native disks and 512 emulated disks will report 4096.",
        "PhysicalDiskRedundancyDefault",
        "Disables the BranchCache service. ",
        "Select * from Win32_BIOS",
        "Ndis80211Config",
        "12 - 'No Contact': indicates that the storage provider has knowledge of this subsystem, but has never been able to establish communications with it. ",
        "I_EFEB887E59EC8D83C39D53CCF57EF6AD0D608FCDC88B6F50F3452B5EEBD4BF9F.597.1.47802",
        "of the cache files to be packaged",
        "KioskModeApp",
        "Dial-up credentials for a given IE internet connection , used for IEAK RSoP.",
        "MDM_AppLocker_CodeIntegrity03",
        "Alpha 21364",
        "I8042",
        "The Size property indicates in bytes, the size of the logical disk.",
        "Version Number of this GPO.",
        "CD_47A47D9B6C73D6463867F73A57E933DD2525E443C9FB15C91CF6A9FC4BA05F96.1793.2262061748.4072",
        "DisableWindowsErrorReporting",
        "HandleDCEnd",
        "DumpedFrames",
        "The size of the data transfer in bits that caused the last error. 0 indicates no error. If the ErrorInfo property is equal to 3, \"OK\", then this property should be set to 0.",
        "subscription",
        "The MaximumInputBufferSize property indicates the maximum input buffer size (in bytes)",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2115.693805320.188",
        "IPv4Arp",
        "R_A4F5A56059DDF119F4CC303056A7BB3F243745A5AAA1FF57F146D0A87968F7FD",
        "WriteCacheSize",
        "\"4890EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "LUAInstall: erro",
        "NDIS Transmit Buffer Space",
        "Heap Commit and Decommit",
        "EngagedRestartDeadline",
        "Unicast",
        "VdiCollectionName",
        "SDBUS_DEBUG_WORKENG",
        "TurnOffGdiDPIScalingForApps",
        "WmiQueryTcpConnectionOffloadHardwareConfig",
        "CR_947907BE0C21868B3B6C1E2B3F2F4D8F4078DF318D2CD738491AC5AC30B4B16C",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_EBAEEA562CCAE5F44F8DC529A43985A152EC238D3F950BE794ACAB0A20B829799Bae57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "{e4ff10d8-8a88-4fc6-82c8-8c23e9462fe5}",
        "The requested access path is already in use.",
        "object:MSFT_VirtualDisk",
        "0xEFFF0057",
        "0DCE749AD0E30C5A74941D6C326877243635B3D92AE3FA1BB77A2C716BB28364",
        "Configure timeout for detections requiring additional action.",
        "UserNameAuthentication",
        "Specifies the SOAP encoding style.",
        "See CIM_ComputerSystem.TimeoutPeriod for details.",
        "ManufactureDate",
        "Write the local cached GPO info back to AD",
        "Storage subsystem: All associated objects will be discovered. ",
        "The SetPriority method attempts to change the execution priority of the process. In order to set the priority to Realtime, the caller must hold the SeIncreaseBasePriorityPrivilege.  Without this privilege, the highest the priority can be set to is High priority.",
        "Ion Deposition",
        "C_B4204F4CD845FAF261673483B3D9C407E18AF7773A24D7B43C66C3052F5D6AAB",
        "TRUE if this adapter is a multifunction device, that is it also exposes a netcard interface",
        "The scoping Log's Name.",
        "NdisFddiLConnectionState",
        "0x0000",
        "KeyboardPasswordStatus",
        "CD_F10840352061CD18DB7516F60841E629D131C524C9F2F089E5D2B510560FC583.18.233466750.476",
        "Describes NVGRE Encapsulated Packet Task Offload hardware capabilities of this Adapter",
        "I8042 Connector",
        "Handshake",
        "This method will advertise an associated Product using the installation package provided through PackageLocation and any command line options that are supplied.",
        "CD_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937.1131.1762488467.974",
        "0xC000000D",
        "WD_LOG_FLAG_RPC",
        "Storage tiers on this virtual disk",
        "58006",
        "Win32Registry|Hardware\\DeviceMap\\Scsi",
        "The time the process was created",
        "The bitmask for a set of logical processors in a group.",
        "MIF.DMTF|Memory Device|002.7",
        "SetByObject",
        "MinCellRate",
        "{53EF8D5F-36F3-4124-8B76-C6AD521A1021}",
        "Driver delays",
        "Cannot open drive for direct access",
        "VolumeKeyProtectorID",
        "The output is an array of CIM objects of type MSFT_OdbcPerfCounter, each of which represents an ODBC Performance Counter setting.",
        "A link between video BIOS feature and its aggregated video BIOS elements.",
        "ref:Win32_NetworkAdapter",
        "StartingAddress indicates where in lower level storage, the higher level extent begins.",
        "8D3F609CF92D2D881D05F26BFED8",
        "lossless",
        "56006",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.2043.1.14612",
        "ref:Win32_NTEventlogFile",
        "The CIM_SystemResource class is an entity managed by BIOS and/or an operating system which is available for use by software and/or logical devices. Examples of Resources in the x86 environment are IRQs, DMA channels and memory mapped I/O.",
        "A collection of strings that specify the roles this system plays in the IT-environment.",
        "CIM_ComputerSystemIRQ",
        "{155689b8-2053-11d4-97eb-00c04f79c403}",
        "The VolumeName property identifies the original volume for which the shadow copy was taken.",
        "CategoryOff",
        "Service application management. ",
        "MSNdis_StatusPortState",
        "SetName",
        "Netware",
        "   //  Each string starts with a ushort that holds the strings length  ",
        "C_6FF6CB589253824DE681EA946AEBFF7061F07B8322E36020A90CC770B8046443",
        "The Manufacturer property specifies the name of the processor's manufacturer.",
        "SupportsCreate",
        "CD_EA78D27F46C798D1329821D7CEABFD06DD3833EE6512664694DD451E0D988F35.74.817017449.601",
        "URI_IP",
        "The CheckAccess method verifies that the user possesses the specified permissions. The method returns a uint32 which is 0 if successful or some other value if any other error occurred.",
        "Vendor specific failure prediction thresholds",
        "R_C067A199C1ACCE03298DA4A596E9323C2C865C447DF4449AEE4DAF3E29B9DD32",
        "If TRUE, this subsystem supports the modification of the storage tier friendly name.",
        "// This class fires an event when an initiator failure occurs.",
        "SMBIOS|Type 9|Slot Type",
        "CD_25D6DE4F10F10C9622833D068798F50E89401E52F3D552BA53470C9A0F55267B.17.3246894690.863",
        "NegotiatedDataWidth",
        "NlaSvcTraceCtlGuid",
        "CurrentSRAM",
        "Conventional PCI",
        " <reserved> ",
        "EnableDFSS",
        "BaseBoard",
        "This method revokes accesses to the file share for the specified users.",
        "MIF.DMTF|Memory Device|002.17",
        "An array of octets holding additional error information. An example is ECC Syndrome or the return of the check bits if a CRC-based error methodology is used. In the latter case, if a single bit error is recognized and the CRC algorithm is known, it is possible to determine the exact bit that failed.  This type of data (ECC Syndrome, Check Bit or Parity Bit data, or other vendor supplied information) is included in this field. If the ErrorInfo property is equal to 3, \"OK\", then the AdditionalErrorData property has no meaning.",
        "LastSessionStatus",
        "Define the order of sources for downloading security intelligence updates. This setting allows you to define the order in which different security intelligence update sources should be contacted. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources in order. Possible values are: 'InternalDefinitionUpdateServer'  'MicrosoftUpdateServer'  'MMPC'  'FileShares' ",
        "The Setting reference represents the configuration settings associated with the DCOM application.",
        "Bookmark",
        "0xD023",
        "{8502C4D9-5FBB-11D2-AAC1-006008C78BC7}",
        "FullScanAndRebootAndOfflineScanRequired",
        "BackgroundSyncParams",
        "MSParallel_AllocFreeCounts",
        "k drive.",
        "The IP address.",
        "ResultData",
        "{8502C578-5FBB-11D2-AAC1-006008C78BC7}",
        "MaxItemsInObjectGraph",
        "C_A0C4181E36B5BF6BE271221B7FC9D6F392B6369BD0BAB6A546F2790003BEF7B3",
        "FullScanRequired",
        "Worker Thread Start/Stop Event",
        "Mouse - Optical Sensor",
        "SUBTYPE",
        "//                 HBA_FCPBINDING2  Bindings;",
        "C_A90E76A32C4A193B19FDC863622FA085D4532219E7648490CF033C6770DCAB51",
        "CD_0669091BB70564F4C28F9EBBB95CE7699D1CBEC6909BE49F84E8F214B14C6216.277.2822121361.375",
        "C_A7E164E66BC7BA8FC3752641961C8B1829E354DA32CDE974E0423F3F5730EDE5",
        "PCI Express specification version, valid for PCI-E devices.",
        "Service Already Running",
        "      <registryValue name=\"ServiceDll\" valueType=\"REG_EXPAND_SZ\" value=\"%SystemRoot%\\system32\\InstallService.dll\"></registryValue>",
        "MSIAllowUserControlOverInstall",
        "PowerUtilizationModesSupported",
        "ErrorControlOff",
        "Enumerate all parts of all rules",
        "Stack15",
        "CIM_PhysicalMemory is a subclass of CIM_Chip, representing low level memory devices - SIMMS, DIMMs, raw memory chips, etc.",
        "ActiveInputVoltage indicates which input voltage range is currently in use. Range 1, 2 or both can be specified using the values 3, 4 or 5, respectively.",
        "Copy this rule.",
        "IPv6Enabled",
        "Win32_ImplementedCategory",
        "ServerCommunicationPort",
        "BCP.1",
        "Executing",
        "WMI|Win32_PNPEntity",
        "ErrorCleared is a boolean property indicating that the error reported in LastErrorCode property is now cleared.",
        "MDM_VPNv2_CryptographySuite03",
        "Supports MBR Partition",
        "An array of target port addresses from which the virtual disk should be hidden. Note: this array may contain a subset of the addresses originally given in Show.",
        "Add protected folders to the Controlled folder access feature.",
        "Ndis802_11PrivFilterAcceptAll",
        "CIM_ComputerSystem.OtherDedicatedDescriptions",
        "The CIM_DirectoryContainsFile class represents an association between a directory and files contained within that directory.",
        "You may specify a write cache size by using either the WriteCacheSize or AutoWriteCacheSize parameter, but not both.",
        "The Win32_SID of the trustee for this access entry",
        "ConfigManagerUserConfig",
        "StatusDescription",
        "BootOptionOnWatchDog",
        "{14575942-E3E1-11d2-8601-0000F8102E5F}",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSCLIENTSETTING_Prov\"",
        "9 - 'Suspended': Data flow between the source and target elements has stopped. Writes to source element are held until the association is resumed. ",
        "ROOT\\Microsoft\\Windows\\PS_MMAgent\\MS_409",
        "Job ID associated with configuration.",
        "MSFT_StorageNodeToStoragePool",
        "itSMF",
        "22 - Don't Require Preauthorization - Windows 2000: This account does not require Kerberos preauthentication for logon. ",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"DskQuotaProvider\"",
        "WeeksInterval",
        "7 = Installed via ProgId activation ",
        "CD_3A4B092E649E9EDDE3FA5F08BAF4EBD82A1D1063DB19A1DD0454E516CA8119BC.2458.1131341115.5139",
        "Battery Charging Failure",
        "SPACES_StorageFaultEvent",
        "SecureNameQueryFallback",
        "R_1E374C5CBDEECC7830AB4BADC56B9C8330C5C89908E9DD8A429AF2525AF02748",
        "{B35694DE-D323-49d2-ABB2-8139209AD150}",
        "KEYBOARD_PORT_WMI_STD_DATA_GUID",
        "New Interval",
        "RemotePortStart",
        "SocketDesignation",
        "The UntilTime property specifies the latest time the printer can print a job (if the printer has been limited to print only at certain times). This value is expressed as time elapsed since 12:00 AM GMT (Greenwich mean time).",
        "WhenNeeded",
        "May contain a reference to the ConcreteJob created to track the state transition initiated by the method invocation.",
        "Windows Defender Firewall Driver",
        "MIF.DMTF|Temperature Probe|002.10",
        "I_84F7DA8FDA90FAE6187111C2192FDA36DDBDE6FDE609673EA728B3013AF37B7B.650.1.36555",
        "iScsiFlagQueue Flag",
        "The voltage sensor.",
        "{33831ED4-42B8-11d2-93AD-00805F853771}",
        "NDIS ATM Maximum AAL3/4 Packet Size",
        "If TRUE the share is continuously available.",
        "The QuotaSetting associated with the referenced LogicalDisk.",
        "MSFT_StorageProviderToStorageSubSystem",
        "This class provides the ability to add an application as a trigger to MDM installed VPN profiles",
        "Subkey",
        "C_F2CA4DB3C668E6418D579525693A11C910C0B4C82E7E68D52D07432FC8FDACEC",
        "Disables the specified error source",
        "This property contains the registry value name. If this is Null, then the data entered into the Value proeprty are written to the default registry key.",
        "InDesiredState",
        "CIM_PhysicalComputerSystemView.NumericSensorCurrentState",
        "ConnectionIdentifier",
        "Cannot shrink a partition containing a volume with errors.",
        "The specified cluster size is invalid",
        "The Antecedent reference represents the physical memory containing the memory device.",
        "TimeSpan",
        "MDM_Update_InstallableUpdates01_01",
        "The ProviderOperation_CancelQuery property indicates the number of calls to IWbemEventProviderQuerySink :: CancelQuery.",
        "NS_892F8DB69C4EDFBC68165C91087B7A08323F6CE5B5EF342C0F93E02A0590BFC4\\KI_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C\\I_A7E84BB1D3739B54369DFFE44BADD220083DD356D5C5AB46BF570D9C77D7DC1981a2",
        "Standard 19 Inch",
        "{A3C97737-76D9-4f5f-B917-4DE47FE023C8}",
        "IsDeviceCacheEnabled",
        "SAM Get Alias Membership",
        "The BusType property indicates the type of the physical bus. This value will be one of the values in the INTERFACE_TYPE enumeration defined in bus.h.",
        "{c6ae95d2-489d-413e-b6eb-18949fc533fd}",
        "HasPreferredTimingMode",
        "Number of records in the log file. This value is determined by calling the Win32 function GetNumberOfEventLogRecords.",
        "777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655.1166.1475828249.3715",
        "Number of duplicate address detection transmits.",
        "{FE28FD98-C875-11d2-B352-00104BC97924}",
        "The physical package whose health, security, environment, etc. is alarmed. ",
        "G703 at 64K",
        "NumProcessors",
        "2CA8A7F45BC7.2113.1299760912.180",
        "RowsetHelper.1",
        "MSWmi_PnPInstanceNames",
        "FX_TRACE_PNP Flag",
        "Persistent Connection",
        "The Version property indicates the version number of the operating system.",
        "R_50F45F1E0408C3E83DD9ADFFA8E0F9ECC05CAAF4A8BF49AD8D699571203B781D.1617.1332748330.600",
        "      <registryValue name=\"Server\" valueType=\"REG_SZ\" value=\"InstallService\"></registryValue>",
        "eventTime",
        "Private Page Count",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.286.1443573607.368",
        "ROOT\\cimv2\\power\\ms_409",
        "TR_TLV",
        "Letter",
        "DisableAutoProvisioning",
        "Whether the firewall is enabled on this profile.",
        "HBA_EVENT_LINK_UNKNOWN",
        "NDIS Query Ports on an Adapter",
        "AddStorageFaultDomain",
        "Windows modern app deployment options",
        "NdisFddiStateOff",
        "The PasswordExpires property determines whether the password on the Win32 user account will expire./nValues: TRUE or FALSE. If TRUE, the password will expire.",
        "CD_7E470595B07CCACED12AF52AF9B26E1DC367DE0F25EDA25E0FC74FECC24A888A.1172.63931690.279",
        "MSNdis_NetworkLinkSpeed",
        "The number of incoming packets that were discarded because of errors.",
        "CD_0FD0888899B6AE2520B6E2DBF0621375C2A450EF8AEE903A752140EFA51EAA5D.2369.2503462697.2719",
        "Communication properties for serial port",
        "FreeSpaceNotWiped",
        "Win32_RoamingProfileBackgroundUploadParams",
        "enableProxy",
        "PortActiveFc4Types",
        "Win32_PowerSettingDefineCapabilities",
        "EVENT_TRACE_FLAG_S",
        "CurrentBIOSMajorVersion",
        "R_821FCC238F627B3C78AF6F9EAC85DA5F86FE1B2A0EA8142CAF6057765FD44631",
        "User Sid Data Length",
        "Base Address",
        "MSFT_CliProper",
        "RD_TRACE_RESERVED_14 Flag",
        "Loopback Flag",
        "Unique Id for Application install/un-install",
        "The network adapter driver date in FILETIME format. This is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC).",
        "ith Error (failed), or Completed with Degraded (the operation finished, but it did not complete OK or did not report an error). ",
        "This method is used schedule chkdsk to be run at the next reboot if the dirty bit has been set.  The method is applicable to only those instances of logical disk that represent a physical disk in the machine. It is not applicable to mapped logical drives.",
        "Token Ring",
        "The TransmittedCount property indicates the number of bytes transmitted in the current session",
        "MGR_TRACE_RESERVED_1d",
        "AntivirusSignatureLastUpdated",
        "Power PC 603",
        "CR_5401A055411F9811A09125DE8462BF6A4D708D8C770ADE3D670BFB9DAD21A39A",
        "ISO 802.6N",
        "{B3F86390-DB37-11d2-85FC-0000F8102E5F}",
        "SignatureNotificationsValue",
        "EncapsulationMode",
        "SPACES_StorageArrivalEvent",
        "Pages",
        "CIM_VideoControllerResolution describes the various video modes that a video controller can support.  Video modes are defined by the possible horizontal and vertical resolutions, refresh rate, scan mode and number of colors settings supported by a controller. The actual resolutions, etc. that are in use, are the values specified in the CIM_VideoController object.",
        "Time of last reset of the Printer Device.",
        "LUAInstall: error 0x00000005 setting flags [{94a909a5-6f52-11d1-8c18-00c04fd8d503}]",
        "12 - 'No Contact': The storage provider has knowledge of the volume, but has never been able to establish communication with it.",
        "PoolAllocation",
        " Specifies a service that can no longer be started.",
        "CIM_RouteUsesEndpoint",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|Prefix",
        "VME64",
        "C_B4ED6CD6BB039C8A40404514D33A068C19B058FAE7508C9C445CEEFE558E436D",
        "2 - Windows Server 2003, Backoffice Edition ",
        "SMBIOS|Type 21|Interface",
        "C_3D99FB3CA80AE1CE212D0927EC12435777EEF4DA6F5F65601554C83DBFCAA5F3",
        "ref:Win32_AutochkSetting",
        "Tape Media Capacity",
        "The MaxNumberControlled property indicates the maximum number of directly addressable ports supported by this network adapter. A value of zero is used if the number is unknown.",
        "The HostPrintQueue property contains the name of the computer on which the print job was created.",
        "C_C7B7FFF993314953BE1A6F3ACE26353D36CC0DC4B7DED5F1ED16B7B7499EF72F",
        "HBA_EVENT_PORT_STAT_THRESHOLD",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_GUARANTEED_ORDER",
        "RD_TRACE_RESERVED_16",
        "JoinDomainOrWorkgroup",
        "Not on tier",
        "CIM_BasedOn is an association describing how storage extents can be assembled from lower level extents. For example, protected space extents are parts of physical extents, while volume sets are assembled from one or more physical or protected space extents. As another example, cache memory can be defined independently and realized in a physical element or can be 'based on' volatile or non-volatile storage extents.",
        "Contacts",
        "OpenPath",
        "The UUID of this device (when discovered via Multicast).",
        "LogStatus",
        "WC transactions",
        "CD_176649CD4E57E4232DDDF6DF456E1D2A1BEC4DED47B202F904E6181846857EAD.2098.1523510017.511",
        "__SystemClass",
        "deviceType",
        "C_B18E35596C7AC0C7A9B67022489D5864495B96E12E56FDACDF13C1E2D5D12666",
        "ClientCoexistenceAllowMigrationmode",
        "C_2277447C6063BFBAC05CE459DB8B2E90B2D0D7BB283ED825F0C1EAA1C62A123A",
        "Command line arguments",
        "RSoP_PolicySettingStatus",
        "The Tag property contains a string that uniquely identifies a port connection on the computer system.",
        "ProfilePath",
        "Specifies one or more ODBC drivers by driver name. You can use wildcard characters.",
        "IncreaseLevel",
        "toolbarBackgroundBitmapPath",
        "VisibleAlarm",
        "MIF.DMTF|Memory Device|002.20",
        "XonXoff",
        "{266c72d4-62e8-11d1-ad89-00c04fd8fdff}",
        "EVENT_TRACE_FLAG_QUERYVOLINFO",
        "IsTerminating",
        "PolicySourceMinEncryptionLevel",
        "Microsoft Defender Antivirus Event Indication Class",
        "0x1000..0x7FFF",
        "ClientError",
        "ProxyURL",
        "Disable the BidTrace represented by the specified BidTrace setting objects. Enter a variable that contains the objects, or type a command or expression that gets the objects.",
        "LogConnections",
        "CD_08D91009B4ED68E4353E05322783CB69F176F87E9111E33A5121866D19386BA0.40.2651246070.400",
        "MSFT_CliAlias.FriendlyName=\"QuotaSetting\"",
        "Volume does not support the no-automount state",
        "The PasswordRequired property determines whether a password is required on the Win32 user account./nValues: TRUE or FALSE. If TRUE, a password is required.",
        "Msft_CliAlias.FriendlyName=\"Volume\"",
        "FanOperationalStatus",
        "R_AF3DAFA72013C3690171F734765DB1412DBEFDA2A461CB66FFED0CC4B21B88F0",
        "Telnet",
        "CD_27AD50ACF498E4580849CBCD157A81D527ED4CE6ECB87F863A4E83FFC9365AD2.1783.2339590913.395",
        "BAUD_110",
        "{55D5B446-DB2A-11d2-85FC-0000F8102E5F}",
        "p71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "Main Mode Enabled",
        "The IPFilterSecurityEnabled property indicates whether IP port security is enabled globally across all IP-bound network adapters. This property is used in conjunction with IPSecPermitTCPPorts, IPSecPermitUDPPorts, and IPSecPermitIPProtocols. A value of TRUE indicates that IP port security is enabled and that the security values associated with individual network adapters are in effect. A value of FALSE indicates IP filter security is disabled across all network adapters and allows all port and protocol traffic to flow unfiltered.",
        "EVENT_TRACE_FLAG_G",
        "ObjectAccess_AuditFileSystem",
        "Association between ReplicationGroup and Partition",
        "Windows",
        "read or load",
        "ROOT\\Microsoft\\Windows\\HardwareManagement\\MS_409",
        "Required field of replication group name is missing from input.",
        "CD_45825D5E91CA2C0282764680BAD49693442FDEEE8D15EF9FADD54C4BF9438553.279.2401677735.2321",
        "CD_3E11F2867F2D534D95C0593A0AA32ECA612C606596AA91228C49611E4A1C3BBE.2251.1.27563",
        "FileOperation",
        "Glossy",
        "WmiMissingData",
        "Base reachable time (in ms).",
        "The Msft_WmiProvider_CreateClassEnumAsyncEvent_Pre event class represents an event generated immediately prior to calling the provider's implementation of IWbemServices :: CreateClassEnumAsync.",
        "The name of the virtual machine that the VM network adapter belongs to.",
        "polmkrBaseGpeGuid",
        "17 - 'Requires fracture': The requested operation has completed, however, the synchronization relationship needs to be fractured before further copy operations can be issued. ",
        "LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls",
        "NS_2EEEF6086B5AA3148DE8DC3E7A7263A417EE849A276BDB357874FDEB8ADED318\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_614FEB5198DB6356C7D4E70E58F0634936BC6DE530AA5FD952207E56B5A89D3F",
        "Mini-DIN",
        "{8502C57E-5FBB-11D2-AAC1-006008C78BC7}",
        "The Bias property specifies the current bias for local time translation. The bias is the difference between Coordinated Universal Time (UTC) and local time. All translations between UTC and local time are based on the following formula: UTC = local time + bias. This member is required.",
        "C_BC1364958E3C7F9CA5ABA0C9A15549E0C0B0F96B96EE058473CACD93E1EABD27",
        "Modem Port",
        "MSDiskDriver_PerformanceData",
        "OtherIdentifyingInfo",
        "GetSrkADThumbprint",
        "The GroupComponent reference represents the properties of the computer system upon which the driver is running.",
        " 0x040 ",
        "Win32_SecurityDescriptor",
        "AllowScreenTimeoutWhileLockedUserConfig",
        "WMI|Win32_NetworkProtocol",
        "requestId",
        "The ProviderName property indicates the network path name to the logical device.",
        "The support link for the product.",
        "select * from SPACES_StorageDepartureEvent",
        "Resources successfully configured in the configuration.",
        "MSFT_FileStorageTier",
        "MIF.DMTF|Disks|003.7",
        "Example: Microsoft Windows NT Workstation|C:\\WINNT40|\\Device\\Harddisk0\\partition1",
        "CreateTrustedDomEx",
        "Announcement Traffic Indication Message (ATIM) Window in Kusec",
        "0xD013",
        "All target ports share the same view",
        "ProtectionScenario",
        "LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads",
        "IL_0FE84CB7228184819434E73184A33B5694CEFAED93B282C50B930127F187504C.2434.692288446.311",
        "Liters",
        "Example: LOGON.SCR.",
        "CreatePartition",
        "ISCSI_ERR_SETUP_NETWORK_NODE",
        "//  This is done so that storport capable drivers may have access to",
        "{447956fb-a61b-11d0-8dd4-00c04fc3358c}",
        "Critical Section Address",
        " Deletes the service during the DeleteServices action.",
        "MCA_ERROR_PCI_DEVICE",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.1163.1796628911.413",
        "MSMonitorClass",
        "AuthenticationMethod",
        "%JNZ\\",
        "SECHC_LOG_FLAG_REPAIR Flag",
        "9D6D60CF7B02015DD6EAA0272.2642.837909254.263",
        "The version used for message security.",
        "CD_DAD7DC48BEC7F412021168603D2D9D3CF712E3B9F8DCC4820417979B6C361AE6.1741.1788314267.463",
        "ExternalReferenceDesignator",
        "Medium-low",
        "DHCPEnabled",
        "NdisCoMediaInUse",
        "MSNdis_StatusDot11ConnectionStart",
        "SupportIp6ExtensionHeaders",
        "Capabilities and management  of a WORM drive, a subtype of media access device.",
        "Logon Failed",
        "NS_8BF863F3FD8ADE8AE6FB5A27773D0C0B0E7558E3C96E9E01A1EC786D0ECAE077\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_E40B350B9BB81074A88A01DF558BE6E740B757A79BA5DDB554D0F7289A193F174CDD",
        "HostingModel",
        "The FeaturesHigh property specifies the high-order 32 bits of the device features flag.",
        "LanguageFeatures",
        "RestrictedSitesZoneAllowUpdatesToStatusBarViaScript",
        "Win32Registry|.DEFAULT\\Control Panel\\Desktop|Wallpaper",
        "SplitTunneling",
        "CustomRDPSettings",
        "NETIO_TRACE_NETWORK Flag",
        "ref:MSFT_NetTeredoConfiguration",
        "Localized version of RSOP_PolmkrDataSourceSetting for American English",
        "ConfigDeviceHealthMonitoringScope",
        "Monitor's refresh rate in hertz. If a range of rates is supported, use the MinRefreshRate and MaxRefreshRate properties, and set RefreshRate (this property) to 0.",
        "Number of user licenses for the operating system. If unlimited, enter 0. If unknown, enter -1.",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2041.2715216352.368",
        "LockedDownTrustedSitesZoneAllowUserDataPersistence",
        "XoffCharacter",
        "MSI Package code",
        "WmiQueryStatisticsInfo",
        "Mandatory",
        "RememberCredential",
        "UnitsBeforeCheckDataInterleave",
        "LPCDRVR_TRACE_RESERVED_18 Flag",
        "Is application trigger added to all MDM installed VPN profiles",
        "SetInfoPolicy2",
        "POINTER_PORT_WMI_STD_DATA_GUID",
        "MDM_Policy_Config01_RemoteDesktop02",
        "NumericParameterMaxValue",
        "The Win32_SID of the object's owner",
        "The Parameters property specifies optional parameters for the print processor./nExample: Copies=2",
        "StoreName",
        "RSOP_SubcategorySystemAuditSetting",
        "RenderingMode",
        "NDIS Enumerate Receive Queues",
        "GetPhysicalPresenceRequest",
        "MSMCAEvent_MemoryPageRemoved",
        "This provides the locate device element.",
        "MSNdis_StatusOperationalStatus",
        "The total number fragmented folders on the volume.",
        "GroupPolicy Flag",
        "Unique identifier for this instance, expected to be a GUID in registry format",
        "Metric",
        "LUAInstall: error 0x00000005 setting fla",
        "Supports Long Names",
        "The ProviderName property contains the name of the provider that owns the resource. This property can be NULL if the provider name is unknown.",
        "The client certificate authentication and provisioning settings for this service.",
        "Max vertical image size (in cm)",
        "This property provides the unique ID associated with a PCI device.",
        "Specifies the file system to format the created volume. Specifying a CSV file system is only supported on a storage spaces subsystem. For CSV the pool must be clusterable and the volume created will be a cluster shared volume.",
        "{FAE1F7B6-DB33-11d2-85FC-0000F8102E5F}",
        "4100..32767",
        "SetIScsiInitiatorCHAPSharedSecret",
        "MDM_ClientCertificateInstall_Install03",
        "CIM_MediaAccessDevice.CapabilityDescriptions",
        "IMAPI2 Media Eraser",
        "NS_1A89B57DFA926FAB28EFD5C7FC82B078C2A123A46004BC299B214EFEC424D2B0\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_C2E2D7F294A39E950FCB0FE91EB41D6C66630273B2EF4990C97F60DB582F2E177",
        "Example: 3  ",
        "The StopFileName output parameter is a string representing the name of the file/directory where DeleteEx failed. This string parameter will be null if DeleteEx succeeds.",
        "Whether neighbor unreachability detection is enabled. Default depends on type of interface.",
        "R_CC6778A70C199F671CD04BFF86EE613A1E47C11B60BA19CC09AC555F9BA03FEF",
        "{FAF76B8B-798C-11D2-AAD1-006008C78BC7}",
        "SSLEcdsa256",
        "NS_0E3BAD336658AC1790DE65EC93590431EA8C91776907175DA4BAE9AE7DB97611\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_848E55FD5F4FC523C00864C2E37F5A0ECCC3D19673B52AA68E334B012EECD2F9",
        "CIM_Rack.TypeOfRack",
        "The DriveIntegrity property indicates whether files can be accurately read from the CD device. ",
        "object:MSFT_SmbServerCertificateMapping",
        "UdpIp_Fail",
        "32568..65535",
        "{785B1AD0-DB32-11d2-85FC-0000F8102E5F}",
        "TimeStampRecord",
        "Capabilities and management of volatile storage.",
        "MaximumFileSize",
        "SM_AddTarget",
        "This parameter indicates whether repair is enabled on virtual disks in this subsystem.",
        "WmiSupported",
        "LastRunActualPurgeSlabs",
        "RestrictedSitesZoneUsePopupBlocker",
        "Portal Groups",
        "A string that identifies the queue.",
        "LowerThreshol",
        "IsNext",
        "Specifies whether to allow PNP redirection.",
        "ROOT\\Microsoft\\Windows\\CI\\MS_409",
        "MSNdis_FddiShortPermanentAddress",
        "The Name property indicates the name of the Win32 Registry. Maximum length is 256 characters.",
        "A short textual description (one-line string) of the CIM_Configuration object.",
        "Remote Udp encapsulation port for NAT traversal",
        "Win32API|Network Management Functions|NetScheduleJobDel",
        "root\\interop",
        "Changer Device Error",
        "ciscoISLvlan",
        "The DeviceID property contains a string identifying the battery.",
        "ref:CIM_IPsecSAEndpoint",
        "PCI Component Information - Function Number",
        "RDP Port",
        "PS_VpnConnectionTriggerDnsConfiguration",
        "CompartmentType",
        "Unavailable Resour",
        "ObjectAccess_AuditCertificationServices",
        "PermanentAddress defines the network address hard coded into an adapter.  ",
        "Number",
        "D93D9A2C887C1566A5A3",
        "SamDeleteGrp",
        "NS_0634BEAAA6D47E6371999AD405E0DDAFDA3BDAB3659C4858F565936A4909981F\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_1035B0F62EAAECC9C984E7834D0AB6A9928506852D8C840D14F9BAB2AAE4A68B",
        "Interop",
        "Select * from Win32_PortConnector",
        "C_AA89F446191A5311D6195827FCB555530663B59BC79B2415F2F523FE46FD51DC",
        "Monitor",
        "User that submitted the job",
        "The Win32_Printer dependent reference represents the Win32_Printer",
        "iSCSI HBA main mode IPSEC Statistics",
        "Default HopLimit of packets sent.",
        "NdisFddiTypeThrough",
        "VolumeGuidName",
        "Indicates the configuration currently selected for the Device. If this value is zero, the Device is unconfigured.",
        "EventAccess",
        "IL_5A594905C8F81E999D9B9057D3667626B70DB4CAA9232253B2044B135DF40086.786.1.31819",
        "Pending",
        "WorkingDirectory",
        "NumberOfHardResets",
        "The StopService method places the service in the stopped state. It returns an integer value of 0 if the service was successfully stopped, 1 if the request is not supported, and any other number to indicate an error. It returns one of the following integer values:",
        "IsBridgeMember",
        "The logical device.",
        "IL_AFCDD0BC10CA71EFD3F3FF0CBBCC80863EF81191642B6BE63B2E7FC60BD5D9F0.2695.1151484921.275",
        "UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations",
        "FrameErrorCount",
        "__SUPERCLASS",
        "FileTime",
        "The minimum size, in bytes, of the lookahead segment if lookahead split is enabled.",
        "ALS brightness state",
        "Battery Discharging",
        "CIM_BIOSLoadedInNV",
        "Per User",
        "DoubleWords",
        "BootLoaderVersion",
        "The Rename method renames the logical file (or directory) specified in the object path. Rename returns an integer value of 0 if the file was successfully renamed, and any other number to indicate an error. A rename is not supported if the destination is on another drive or overwriting an existing logical file is required/nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n",
        "LPCDRVR_TRACE_RESERVED_09 Flag",
        "PNP_RESOURCE_INFO_LEVEL Flag",
        "Check",
        "Magneto-Optical Rewriteable",
        "IsVmFarm",
        "Create On Existing File",
        "WMIBinaryMofResource",
        "Shared Secret",
        "List of Portals in this Portal Group",
        "TEST_TRACE_RESERVED_0f",
        "The TcpMaxDataRetransmissions property indicates the number of times TCP will retransmit an individual data segment (non-connect segment) before terminating the connection. The retransmission timeout doubles with each successive retransmission on a connection. Default: 5, Valid Range: 0 - 0xFFFFFFFF.",
        "Deduplication Tracing Provider",
        "CollectionId",
        "ref:MSFT_NetInterfaceTypeFilter",
        "The requested object type cannot be assigned to a storage tier.",
        "Win9X Upgrade",
        "Composite Link",
        "C_9E152E3E3D8A2665C8A4533F9A4E67D0D1AAA1D8B83D4A80BEDF2999A2CA16CE",
        "MsftDiscFormat2Raw_DebugConstructor Flag",
        "Floppy/Diskette",
        "WallpaperStretched",
        "The ConfigurationPath property indicates the path to the configuration files. This value may be similar to the value in the BootDirectory.",
        "__PropertyProviderRegistration",
        "CommercialDataOptIn",
        "Remote Desktop connection management on a specific network adapter.",
        "CIM_ElementConfiguration",
        "processwindowstation",
        "IL_F29B7A2DDA607A820C01A6084774262633A7D7048E9240AF094D62E3ACEE7413.1936.2270089716.202",
        "The underlying LANEndpoint, which is depended upon.",
        "Master File Table In Use Percentage",
        "VolumeKeyPr",
        "DtcNetworkSettings",
        "CIM_RegisteredSpecification.AdvertiseTypes",
        "CPU Cycles Limit Exceeded",
        "6B043DD4F1C4BC3ACB7E4C10A6223E3DA1067522BFF187585B0486BDFDF7",
        "NumberOfAttachedNodes",
        "CD_BC8304297DAEA08EF836B71DA253942E5C6B510805DB5280CDD11086EF113EFB.1150.1079007642.329",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_46525BAD3099F51458A5D518030526DE848A3DE564DD8816A47DE935CCD3FA8213",
        "Link Down",
        "CTXT Flag",
        "PCI_COMP_INFO_ClassCodeInterface",
        "Win32Registry|HARDWARE\\Description\\System\\MonitorPeripheral\\0|Identifier",
        "IL_AAB2361D5BE7402BBEEA8C75F0C67526A834F4857A9BAE731DBD8E4D03F06056.2686.751587766.263",
        "SDBUS_DEBUG_DEVICE",
        "DVB-RCC Downstream",
        "VOLBITMAP",
        "Time that the job was submitted.",
        "Width",
        "{8502C583-5FBB-11D2-AAC1-006008C78BC7}",
        "ADODB.1 formatted output (W)",
        "The RSS setting data for the network adapter.",
        "The CanTurnOffRemotely property determines whether the power supply can be turned off remotely.",
        "Authentication or tunnel address cache is corrupted.",
        "CR_832531694CC32AEF12EEFA0D2DDA8BF782C32F932BED169759F268D0FEAF39B8",
        "ApplyUACRestrictionsToLocalAccountsOnNetworkLogon",
        "MIF.DMTF|Voltage Probe|001.8",
        "PolicySourceEnableAutomaticReconnection",
        "AllowUnencryptedTraffic_Service",
        "ModulationScheme",
        "OutputResource",
        "Bytes read using byte (bidirectional / PS/2) mode",
        "TcpIPv6ExtensionHashEnabled",
        "C_901AC56EC8F00C00FBAC686F0B7E1614E207CC1998593D930358F2BBE88093FF",
        "HBA_BIND_TO_D_ID",
        "TypeDescriptions",
        "WPD ClassInstaller Trace",
        "The MaximumAllowed property indicates the limit on the maximum number of users allowed to use this resource concurrently. The value is only valid if the AllowMaximum member set to FALSE .",
        "SCSILogicalUnit",
        "MaxCqDepth",
        "PrimaryStatus consists of one of the following values: Unknown, OK, Degraded or Error. \"Unknown\" indicates the implementation is in general capable of returning this property, but is unable to do so at this time. ",
        "CIM_PrintJob.NaturalLanguage",
        "Error ",
        "{d63d537a-59c1-4fae-8f9b-cd9fbbecb85a}",
        "The SecurityDescriptor input parameter specifies the security information",
        "Number of received multicast frames",
        "7977394.1295",
        "double",
        "CR_B1B3F51451050560540508AE61C59186CBB46746C5DF2B2C8763635DE336A9D9",
        "The Descriptions property provides a description of how the SeeAlsoAlias relates to the original",
        "41015",
        "FileID",
        "Minor",
        "A Uri that contains the address of the endpoint.",
        "{f786fbd6-c049-11dd-b885-001d09162bc3}",
        "Hidden",
        "RSOP_Session",
        "Idle time before the VPN connection is disconnected",
        "CD_805206C561285684F42D728C26661B4F548F5E54321B06170E013CB108084182.65.3951828876.660",
        "The long address of the station below this NIC on the ring or zero if the address is unknown.",
        "PciExpressMaxLinkSpeedEncoded",
        "40007",
        "object:MSFT_NetSecDeltaCollection",
        "To ensure uniqueness within the NameSpace, the value of InstanceID should be constructed using the following \"preferred\" algorithm: ",
        "Reserved for Local Replication Services",
        "CD_FDFE527398F2ABFB9174C6F115BD3281FC3B3D869047BED0A5719E7F2618C914.1548.3490643378.630",
        "Tape symbolic name",
        "LaunchURI",
        "KeyName",
        "DOT11_PEER Flag",
        "CipherTransformConstants (uint32)",
        "SensorClassExtensionControlGuid",
        "Version3",
        "MSFT_MpWDOScan",
        "MSFT_StorageAlertEvent",
        "Receive Filter Parameters",
        "Win32_PowerSupply",
        "Get the content of the template file of the current instance.",
        "MIF.DMTF|Bus Port|001.9",
        "0x30000000",
        "This field describes the protocols supported by file servers on this subsystem.",
        "CIM_PrintJob.MimeTypes",
        "Controller's horizontal resolution in pixels.",
        "TM_COMPCLNT Flag",
        "MSFT_Runspace",
        "CSVFS_NTFS",
        "0xD006",
        "BDD865D1-D7C1-11d0-A501-00A0C9062910",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.1784.1770657715.2570",
        "OS Device Name",
        "The group component.",
        "RSOP_IEImportedProgramSettings",
        "Small Business(Restricted)",
        "QueryDomainInfoPolicy",
        "A string that uniquely identifies the type of the object that triggered the action.",
        "C_50988C8CC93A3243BAA0056B1B959C7138E8342783269A1D2B5E4A28855995C8",
        "PartitionInfoExtensionV2",
        "SupportsRLSD",
        "The ProtocolAddress property contains the address that the destination used to reply.",
        "polmkrBaseHash",
        "MCA_WARNING_PCI_BUS_PARITY_NO_INFO",
        "CreateSharedWowVdm",
        "0xEFFF0050",
        "SystemStabilityIndex",
        "HostingGroup",
        "    // 1 = Tunnel Mode Preferred; 0 = No Preference",
        "{CC78410E-E3D1-11d2-8601-0000F8102E5F}",
        "{C3E25A3C-DB31-11d2-85FC-0000F8102E5F}",
        "MSFT_NetEventPacketCaptureTarget",
        "Invalid State Transition",
        "PoolSnapshot",
        "PS_ClusteredScheduledTask",
        "ReturnCode",
        "8mm Advanced Metal Evaporate",
        "The FileName property is a string representing the filename (without extension) of the file. Example: autoexec",
        "MDM_Policy_Result01_RemoteManagement02",
        "Unsupported Format",
        "The remote address of the TCP connection.",
        "MSFT_TaskSettings3",
        "MaxLinkSpeed",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2005.729656931.368",
        "The IP address associated with the IP interface",
        "ReportingNonCriticalTimeOut",
        "WMI caches provider registration objects to decrease overallexecution time. The substem will drop cache entries either through the cache ageing process, through loss of RPC connectivity, through user control or due to some change in the provider's registration. This event defines the unsuccessful activation and initialization of the provider cache entry.",
        "{FAF76B82-798C-11D2-AAD1-006008C78BC7}",
        "LooseSourceMapping",
        "WSP_FileServer",
        "This parameter is used to specify the target replication group.",
        "Volume Name",
        "The owner of the file/directory object",
        "ref:CIM_LogicalPort",
        "The current definition of the class that is created, changed or deleted in the schema. In the case of a CIM_ClassDeletion Indication, the definition for the class just prior to deletion should be placed in this property.",
        "Default initiator name for registering with iSNS.",
        "0xC005003D",
        "Specifies the contents of the EAP XML configuration file (including the EAP method ID).",
        "ErrorSourceArray",
        "LUNCount",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Class|DriverDesc",
        "Specifies whether to automatically print to the client's local printer.",
        "MaxProcessorNumber",
        "MSFT_NetFirewallRuleInProfile",
        "DenyAdminPermissionForCustomization",
        "Note: the following methods are not supported asynchronously, hence the gap between 11 and 19: ",
        "WPD_F6",
        "Specifies the DNS Suffix.",
        "ThreadsPerHost",
        "The driver loader for the device is missing.",
        "VLRenewalInterval",
        "11 - 'In Service': describes a virtual disk being configured, maintained, or otherwise administered. ",
        "C_8BB282EC877EF750BA67E21AEFC765F0958A7E18EB5158F15A448065A4876EFB",
        "C_939FCC6B5B4675BB5CEC42A6515416373AC42FCCBCF280E4E5D7805BB730869F",
        "A value that specifies whether the messages are buffered or streamed with the connection-oriented transport.",
        "NumberOfBytes",
        "This class represents a BCD store which holds a collection of BCD objects.",
        "NdisStatusDot11ConnectionStartIndication",
        "Credentials Required",
        "The FUnjoinOptions parameter specifies the unjoin options. If this parameter is NETSETUP_ACCT_DELETE, the account is disabled when the unjoin occurs. Note that this option does not delete the account. Currently, there are no other unjoin options defined.  /n2 bit - Acct Delete - Delete the account when a domain is left. /nThe method returns a 0 if no options are involved.",
        "GetElement",
        "NS_3579DC951657EA60871CD1E9EBEE6A8D0AD711287837BD9631F6B3FC9EC7141E\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_07518836069F28661B2BDE63EA95AFE81F3822D4677A49CBAE5F594ED13FEBAF",
        "connectionName",
        "NetLuid",
        ", but is currently unreachable. ",
        "Identifier Duplication",
        "CD_FD4F4D3C59F149D4ECD4F84E3818809F406BCF7E122C03BCFA93C04C2B2F4607.1733.2608275601.2940",
        "DirectoryCacheEntrySizeMax",
        "LogicalDisks can be BasedOn a DiskPartition. For example, a personal computer's C: drive may be located on a Partition on local PhysicalMedia. In this association of LogicalDisks to Partitions, note that the cardinality of the Antecedent, DiskPartition, is Max(1). This dictates that a LogicalDisk can not span more than one Partition. However, there are cases where this is true. When it occurs, the LogicalDisk is really based on some kind of RAID configuration (for example, a mirror or stripe set). In these scenarios, the LogicalDisk is more correctly BasedOn a StorageVolume. To prevent incorrectly using the LogicalDiskBasedOnPartition association, the Max(1) qualifier was put on the Antecedent reference to the DiskPartition.",
        "Boolean indicating that the Device can be power managed. The use of this property has been deprecated. Instead, the existence of an associated PowerManagementCapabilities class (associated using the ElementCapabilities relationhip) indicates that power management is supported.",
        "MultipleInstances",
        "Header_LastDroppedTimes_TypeGroup",
        "Certificates Supported",
        "MDM_Policy_Config01_Licensing02",
        "Thread Migration Event",
        "SMBIOS|Type 2|Product",
        "Keyboard port driver information",
        "If IPV6 Address is specified as the Address Format then this conains the binary IPv6 ip address",
        "Example: L3.",
        "IL_A85EB91570422B050DB7748E0E8B03DED2263BB8BCFA7BAB1D3902444584ECDA.2681.3467768499.284",
        "MSFT_OdbcPerfCounterTask",
        "{8919f267-a053-4669-aa69-2da0d4a20d92}",
        "Whether to enable Application Launch Prefetching. Application launch prefetching would would speed up app startup by monitoring the data and code accessed in these cases and use that information to preload the data and code into physical memory for subsequent app startups.",
        "NS_0E3BAD336658AC1790DE65EC93590431EA8C91776907175DA4BAE9AE7DB97611\\KI_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB\\I_848E55FD5F4FC523C00864C2E37F5A0ECCC3D19673B52AA68E334B012EECD2F9",
        "The initiator and target negotiate the minimum time, in seconds, to wait before attempting an explicit/implicit logout or active task reassignment after an unexpected connection termination or a connection reset.",
        "SNMPEnabled",
        "Country ID",
        "Several of the enumerated values require some explanation: 1) Value 11, Supports Dual Sided Media, distinguishes a Device that can access both sides of dual sided Media, from a Device that reads only a single side and requires the Media to be flipped; and, 2) Value 12, Predismount Eject Not Required, indicates that Media does not have to be explicitly ejected from the Device before being accessed by a PickerElement.",
        "LUAInstall: error 0x",
        "SourceStorageElements",
        "Name of the category",
        "FirstTransformType",
        "Number of reliability records in the database",
        "Port free count",
        "SetByParams",
        "NDISWMI_TRACE_SRIOV Flag",
        "MSNdis_MaximumFrameSize",
        "SMBIOS|Type 24|Hardware Security Settings|AdminPasswordStatus",
        "A LogRecord's key structure includes a timestamp for the entry.",
        "AllowLockedDownLocalMachineZoneTemplate",
        "Device Name",
        "Logon",
        "{39C14290-F036-4999-B8A1-B6F871FB329E}",
        "The Create function submits a job to the operating system for execution at a specified future time and date.  This function requires that the schedule service be started at the computer towhich the job is submitted.",
        "The new name for the printer.",
        "Number of RDMA completion queues that went into an error state",
        "Encoding",
        "Describes malware detected by Forefront Antimalware",
        "ref:MSFT_NetAdapterRssSettingData",
        "The Antecedent reference represents the Win32_LogicalProgramGroupItem that represents program groupings in the start menu.",
        "NS_1A89B57DFA926FAB28EFD5C7FC82B078C2A123A46004BC299B214EFEC424D2B0\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_C2E2D7F294A39E950FCB0FE91EB41D6C66630273B2EF4990C97F60DB582F2E17",
        "Function Name",
        "CIM_RegisteredProfile.RegisteredOrganization",
        "MSFT_StorageSubSystemToReplicationGroup",
        "{debac832-6b54-4add-8a62-8d3861b97b1d}",
        "Enable BidTrace only for this process ID.",
        "GroupAddresses",
        "Active Process Limit",
        "EnableCompression",
        "Supplying this parameter will automatically add the supplied DNS suffixes to the current Trusted Network List.",
        "CIM_DiskSpaceCheck",
        "Indicates whether the list of PolicyConditions associated with this PolicyRule is in disjunctive normal form (DNF), conjunctive normal form (CNF), or has no conditions (i.e., is an UnconditionalRule) and is automatically evaluated to \"True.\" The default value is 1 (\"DNF\").",
        "Link Parameters to set",
        "WPDMTP_feature2 Flag",
        "{E5639665-C4FC-11DA-82C4-000D5692A4BC}",
        "Execution Time",
        "IR_E0849CDEB189AA76D8525CE1B639DCC35E6FEC1238BA020F29888EDAD9D3FEAF",
        "Win32_DeviceChangeEvent",
        "C_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "CreatePipeline",
        "Maximum number of start-stop cycles within which the storage device is capable of normal operation.",
        "WdfISR",
        "DesktopImageStatus",
        "MaxNumQueuePairs",
        "HOSTPROC_RESERVED_1b Flag",
        "RegenerateTime",
        "MMAgentComponents",
        "The SpeakerVolumeLow property contains the command string used to set the modem speaker to the lowest volume.",
        "Time of last Quick Scan start - If this has never updated you will see a null value in this property",
        "MIF.DMTF|ComponentID|001.5",
        "0xC0000029",
        "Powershellv3",
        "r of the corresponding property contained in the Win32_PageFileUsage and the Win32_PageFileSetting.",
        "object:DtcNetworkSettings",
        "UdpChecksum",
        "Thread Pool Timer Expiration",
        "ref:CIM_Directory",
        "The short summary description of the health action.",
        "CR_0783FC4315F6719B07F6F7780EAC7B73D0B0471C3E21E23BC45CB6B44FFECA8E",
        "I_FDC07BF412EF517BF16CBEA0AD032C8FE94CB2DD73B9CD909C08659DB8C5BC0A.1336.2924169968.467",
        "UvhdShareUrl",
        "object:MSFT_FileIntegrity",
        "local-user",
        "The count of KMS requests from clients with License Status=3 (OOTGrace).",
        "StandardYear",
        "3 - 'Degraded': The element detected one or more non-critical issues. ",
        "RepetitionDuration",
        "The SetBinaryValue method sets the data value for a named value whose data type is REG_BINARY. The SetBinaryValue method returns a uint32 which is 0 if successful or some other value if any other error occurred.",
        "{A0F93E27-F05D-4153-A151-F3720369A4C7}",
        "TRACE_LEVEL_FATAL",
        "Callback ID",
        "LocalSystemHost:DscLcm",
        "move in (cache line fill)",
        "{886372E9-9221-4263-B064-0FED17832E54}",
        "Values: 1 (true) or 0 (false). If true, setmark reporting is enabled.",
        "object:MSFT_NetAdapter_QosClassificationElement",
        "CD_9D451FE1048C25B1734C21AA9BF5F52F617BAC50A46B49E962E9AA59BDD63A0E.1190.3098294277.611",
        "PipeMgr_Trace",
        "DriveProblemType",
        "This bit indicates whether the machine has no video",
        "NDIS VLAN Identifier",
        "CD_09416880DC950121CF927099A50B486F189A631C326B4B438123E20ABA622175.270.110672010.216",
        "5 - Hardware Error. Errors of this type are principally associated with an equipment or hardware failure. ",
        "StackWalk",
        "MDM_DeviceUpdateCenter_DesiredUpdates01",
        "CD_C21EED7191192F2ADBCB9708104DAD6A17FD5A43846B186D22E5E8405D0D7A69.2102.915478675.5064",
        "#define HBA_EVENT_PHY_STAT_GROWTH       0x352",
        "Example: Generic.",
        "DMA channel timing.  For example, \"Type A\" (value =4) or \"Type F\" (6) could be specified.",
        "Specifies what types of interface to filter on.",
        "Range1InputFrequencyHigh",
        "Boolean indicating that the media access device needs cleaning. Whether manual or automatic cleaning is possible is indicated in the Capabilities array property. ",
        "0xEFFF0005",
        "{74628299-57EC-4f12-BA1C-08B477BF447A}",
        "Win32_ProductResource",
        "3 - Degraded/Warning should be used when its appropriate to let the user decide if action is needed. ",
        "LocalUserEmpty",
        "BytesWritten",
        "Instance XML",
        "This parameter is the context that the provider will use when creating the shadow.",
        "PacketPrivacy",
        "CR_D36EEB4FA019E601112818DDC069B750B95BF09F1ACA992BF14D32259D2DE75F",
        "Queue Action",
        "Disable BidTrace for this application full path.",
        "NS_D8D295EDF64C7F3A5E94E377F9D35AA7B08D0DF6C56C2323D31A8EE4AEE51E6D\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_6CCA910ED692A20FC05D2E2F3F038996446CB86CE2DBA190B79D021048C8880C",
        "Association between a StorageJob and objects affected by the job's operation. Instances of this association should only exist once the storage job has been completed, and should remain for a period of time (recommended 24-hours) after.",
        " The CIM_CopyFileAction specifies files that  exist on a computer system, and to move or copy those  files to a new location.   The to/from information for the copy is specified using  either the CIM_ToDirectorySpecification/CIM_FromDirectorySpecification  or the CIM_ToDirectoryAction/CIM_FromDirectoryAction associations.  The first set is used when the source and/or the target are to  exist before any actions are taken. The second set is  used when the source and/or target are created as a part  of a previous action. In the latter case, the action  to create the directory must occur prior to the CIM_CopyFileAction object.  ",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1164.2707538804.368",
        "{4054e80f-2bc1-4ccc-b033-4abc0c4a1e8c}",
        "RemoteFirstId",
        "Stack18",
        "Win32_Thread",
        "RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads",
        "SQLSRV32.1",
        "AllowGameDVR",
        "MaxInitiatorQueueDepth",
        "//  iscsiprf.h",
        "Information MisK",
        "TypeDetail",
        "TRC_FN_ENTER Flag",
        "PortFcId",
        "Total Unmovable Files",
        "EnableLowCpuPriority",
        "The Setting reference represents settings that can be applied to the logical device.",
        "and also returns the maximum number of prefetch files for scenarios recorded by the Operation Recorder API.",
        "PolicySourceSingleSession",
        "This parameter is used to specify an array of physical disk objects that will be used as the backing data storage for the created storage pool. The physical disks must come from a primordial pool on the subsystem on which you are creating this pool. Only the disks from a single primordial pool may be used.",
        "The priority of this printer when scheduling print jobs.",
        "Write Total Uncorrected Errors",
        "The guid associated with the type of object these rights apply to",
        "0x00000102",
        "Indicates whether incoming transaction flow is enabled.",
        "ref:CIM_FileAction",
        "21 - CIM_ERR_INVALID_ENUMERATION_CONTEXT. The enumeration context supplied is not valid.",
        "Win32API|Device Input and Output Structures|DISK_GEOMETRY|SectorsPerTrack",
        "Metric3",
        "cast out (explicit or implicit write-back of a cache line)",
        "MatchAllKeyword",
        "er second",
        "The Name property indicates the alias given to a path set up as a share on a  Win32 system.",
        "A value that specifies the maximum number of cookies that can be cached.",
        "The CollectionOfMSEs.",
        "NoDefaultDriveLetter",
        "Supplies the type of wake pattern.",
        "{8502C50F-5FBB-11D2-AAC1-006008C78BC7}",
        "FRMRPageCount",
        "LPCDRVR_TRACE_RESERVED_02",
        "ATM Radio",
        "SECHC_LOG_FLAG_FUNCTION Flag",
        "createmailslot",
        "This class encapsulates the WFP Capture Filter ETW provider on a computer",
        "EMAILFLOODER",
        "_UUUUU",
        "CoolingMode",
        "The label to use for the new volume.  The volume label can contain up to 11 characters for FAT and FAT32 volumes or up to 32 characters for NTFS volumes.",
        "ref:CIM_ConcreteJob",
        "OplockBreakWait",
        "This method allows the storage pool's intended usage to be updated. Not all storage pools may allow this and will return 1 - 'Not Supported' if this operation cannot be performed.",
        "Specifies the default web message format for outgoing responses if the operation does not specify one.",
        "Example: 3",
        "PeerV4PrivateAddress",
        "MDM_Policy_Config01_Settings02",
        "R_755C3664114AA9097DEA3F0332A59D1FE1A4668C8001C4E97937639305CB9174",
        "Load Reason",
        "Main Mode target SPN",
        "Process_V2_TypeGroup2",
        "7 = Removed due to product conflict, ",
        "ServerVirtualIP",
        "TargetOperatingSystemDesired",
        "Power Meter",
        "CIM_PackageTempSensor",
        "Errors Granted Access",
        "Maximum number of PD receive queues that can be allocated on a nondefault VPort. RSS receive queues are not included in this number.",
        "{C2600530-C4FC-11DA-82C4-000D5692A4BC}",
        "Detailed Scan Notifications.",
        "The SNMPEnabled property, when true, indicates that this printer supports RFC1759 (Simple Network Management Protocol) and can provide rich status information from the device.",
        "Win32Registry|System\\CurrentControlSet\\Services\\Class\\",
        "{100985A4-E3D2-11d2-8601-0000F8102E5F}",
        "CD_59CC62799ED4524121BE28A013B19C8FA8396DA9DB0959637F6F4B761CC22896.1190.3562943868.302",
        "It can take one of the following two forms: \\\\DfsServerName\\ShareName\\PathToLink where - DfsServerName is the name of a server that hosts the DFS root volume, ShareName is the name of the share published on the host server, PathToLink is the path to the physical share. The PathToLink is applicable only to nodes that are DFS links.\\\\DomainName\\FtDfsName\\PathToLink where - DomainName is the name of the domain that hosts the DFS root volume, FtDfsName is the name of the fault tolerant DFS root published in the domain directory service, PathToLink is the path to the physical share. The PathToLink is applicable only to nodes that are DFS links.",
        "Non-rotated Parity",
        "LPCDRVR_TRACE_RESERVED_15 Flag",
        "Sequence Number",
        "CIM_RemoveDirectoryAction",
        "filterId",
        "1 bit - Acct Create - Creates the account on the domain. ",
        "ty indicates the type of codec represented by this class.",
        "KEYBOARD_ID_EX",
        "ManufacturerVersion",
        "NumAAAAQueriesIn6ArpaPtr",
        "Values: TRUE or FALSE. If TRUE, printing is done on both sides.",
        "MsftDiscFormat2Tao_DebugConstructor",
        "Status of configuration.",
        "{acf14041-a61c-11d0-8dd4-00c04fc3358c}",
        "If this property does not contain 0 or null and the implementation doesn't support this parameter. A return code of 'Use Of Timeout Parameter Not Supported' MUST be returned.",
        "Events are traced if the filter matches. To limit tracing to a particular flow, ",
        "{0254ba6d-7ff0-4bfe-a3f9-8fd8da667641}",
        "Parallel port",
        "Supports SynchronizationAspect",
        "BaseStatus",
        "MSiSCSI_BootConfiguration",
        "AVC444ModePreferred",
        "ScheduledPID",
        "Per MicroSecond",
        "MDM_Policy_Config01_Accounts02",
        "WINSScopeID",
        "The CodeSet property indicates the code page value used by the operating system. A code page contains a character table used by the operating system to translate strings for different languages. The American National Standards Institute (ANSI) lists values that represent defined code pages. If the operating system does not use an ANSI code page, this member will be set to 0. The CodeSet string can use up to six characters to define the code page value./nExample: 1255.",
        "Specifies the web-proxy server address and port number pair in colon separated format.",
        "A value used to define a power setting. This value is readable. The InstanceID of this class will encode whether this setting is a Min/Max/Inc or a possible value.",
        "WMI|Win32_QuickFixEngineering",
        "The video architecture.  For example, VGA (value=5) or PC-98 (160) may be specified.",
        "OEM_COMPONENT_ID",
        "{ce1dbfb4-137e-4da6-87b0-3f59aa102cbc}",
        "The previous self-test completed having a test element that failed and the test element that failed is not known.",
        "The Name property indicates the name of the Win32 user account on the domain specified by the Domain member of this class./nExample: thomasw",
        "PortSpeed",
        "MIF.DMTF|Memory Device|002.5",
        "WMI_STORAGE_FAILURE_PREDICT_DATA_GUID",
        "MEM_PHYSICAL_MASK",
        "Ndis802_11WEPKeyAbsent",
        "ref:CIM_Location",
        "object:IdleStateAccountingEx",
        "Management Service",
        "CurrentPerfState",
        "NdisTransmitBufferSpace",
        "LicenseIsAddon",
        "IsIcsPrivate",
        "TcpIp Connect/Accept",
        "MSFT_NetAdapterEncapsulatedPacketTaskOffloadCapabilitiesEx",
        "t311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        "CD_24BE268C5603D757BD8CCA53193660D8F104AD29F4F74D327C13832A44E7DF1F.17.3409386182.369",
        "The DNS servers the DNS query is sent to when DA is disabled.",
        "CapacityMultiplier",
        "MGR_TRACE_RESERVED_08",
        "NonRecover",
        "SupportsEmptyReplicationGroup",
        "Fabric expansion port",
        "GetShare",
        "This method returns the physical extents on the physical disk.",
        "PlatformID",
        "MaxUploadRatePct",
        "16 - 'Supporting Entity in Error': indicates that this subsystem might be OK, but that another element, on which it is dependent, is in error. ",
        "The Uncompress method uncompresses the logical file (or directory) specified in the object path. Uncompress returns an integer value of 0 if the file was successfully decompressed, and any other number to indicate an error./nIt returns one of the following",
        "(C1 AND (NOT C2) AND C3) OR (C4 AND C5) ",
        "Non-Burst",
        "Information about the devices exposed by this session",
        "IO Active",
        "IsInitiating",
        "SamOpenDomain",
        "3DES HMAC/SHA1",
        "The ObjectPath property hold the path of the object to retrieve.",
        "NumActiveNonDefaultVPortMacAddresses",
        "The frequency (in hertz) at the low end of this powersupply's input frequency range 2. A value of zero implies DC.",
        "PoolClose",
        "HOSTPROC_TRACE_WIN32_DISPATCHER Flag",
        "{8502C4EC-5FBB-11D2-AAC1-006008C78BC7}",
        "CIM_ElementConformsToProfile",
        "This is the host name of a PC known to be on the corporate network.",
        "MI_ERRORCATEGORY_INVALID_DATA",
        "IL_2381C996A59A0D1EB6DDD79E1C697FECC05884247B858E341AE1AAFDFB086D7B.1196.3074802508.267",
        "The DriveType property contains a numeric value corresponding to the type of disk drive this logical disk represents.  Please refer to the Platform SDK documentation for additional values./nExample: A CD-ROM drive would return 5.",
        "SetInfoPolicy2_Start",
        "LPCDRVR_TRACE_RESERVED_1e",
        "Logoff Flag",
        "DisableStealthModeIpsecSecuredPacketExemption",
        "The SpeakerVolumeHigh property contains the command string used to set the modem speaker to the highest volume.",
        "An alarm device is a type of device that emits audible or visible indications related to a problem situation. ",
        "LogMessagesAtServiceLevel",
        "The MBR signature of the disk. This property is only valid on MBR disks and will be NULL for all other disk types.",
        "This association relates an MSI action with any locational information it requires.  This location is in the form of a file and/or directory specification.",
        "ref:CIM_USBHub",
        "MSFT_ResiliencySetting.PhysicalDiskRedundancyDefault",
        "MIB.IETF|HOST-RESOURCES-MIB.hrSystemMaxProcesses",
        "OSTarget",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{GUID}[RunAs]",
        "The managed system element.",
        "An association between a LocalFileSystem and its Directories indicating that the specified Directories are available for mount. When exporting an entire FileSystem, the Directory should reference the topmost directory of the FileSystem.",
        "CD_FD01511EE67712BF18E22D5987177172AC0FC136DA3801B80EDFACBDC4A53CCF.254.2988099716.2564",
        "RD_TRACE_RESERVED_1d",
        "The Threat Status ID - Enumeration",
        ")71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "FreeVirtualMemory",
        "CD_6FFBA8B5854E9C5C5C698A9277971D04E447B67166A26CB7D9DD0D9F278C2D8B.2042.3409808955.1460",
        "BadPasswordCount",
        "MSFT_LocalizableMethodParameterQualifier",
        "CIM_Error.ErrorSourceFormat",
        "CD_884D60D0DBFE6460D83079FECA71E009FB88E0ACAA9538FA4A82F908C79947A6.1749.2924974041.769",
        "TrustedNetwork",
        "{345d03af-4a1d-4ce7-ac3d-4d27b21b4a6e}",
        "CompositePolarityType",
        "111 - Network Control ",
        "The SerialNumber property indicates the operating system product serial identification number.",
        "NewByEapTlsAuth",
        "NdisCoVendorID",
        "Unreachable",
        "\\\\.\\ROOT\\Microsoft\\Windows\\Smb:__Win32Provider.Name=\"smbwmiv2\"",
        "File not found.",
        "MSNdis_StatusResetStart",
        "C_AEF4BCAFA3CEE844FC32B54865C308E2A65BDF0B3637732FB1712E3C76E4A368",
        "CD_672AC91064DD7727FB109DFF59E95A1F605E4D89A741855158B3D85A026CCD54.2083.4141131704.4819",
        "QueryMultipleValue",
        "User account hosting the infected process",
        "See CIM_NumericSensor.UpperThresholdFatal for details.",
        "This specifies, in seconds, the maximum delay before the single sign on connection attempt fails.",
        "{5413531c-b1f3-11d0-8dd7-00c04fc3358c}",
        "CIM_DeviceSoftware.Purpose",
        "CD_6AC83E7C3405E237BE031334BE2B1588654DC981BE9868FD8B2192931F6350E6.1534.240925494.1218",
        "NS_7D21B78EAA0B5CBC1D181E478D1F43B86260B16C8A6D7CD39506F3FAB894CD04\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_4AB8B718BCED40CD13B099C54A6BC7459144DF3AF86EA1B35DB5EB6EBC6C202Be_f7",
        "CreateSeparateWowVdm",
        "TunnledEapAuthMethod",
        "CurrentBIOSVersionString",
        "Indicates if the Adapter supports TCP options for transmit checksum offload on IPv6 packets.",
        "C_C8016B6B0049BC20107AF6058F0D557305357C2E4A27EC0BC24AF4A11B9B1028",
        "Example: In the back, on the left-hand side",
        "OverwriteExistingDebugFile",
        "TotalKernelTime",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.866272930.368",
        "Volume",
        "IL_F98CD8F4EA96B0B77910240E3039FCC377A97641ECA44728EE7350A6200A681A.2462.640519852.342",
        "ref:CIM_BIOSElement",
        "WorkflowDefinitionPath",
        "SYSID_UUID_DATA_GUID",
        "NS_3579DC951657EA60871CD1E9EBEE6A8D0AD711287837BD9631F6B3FC9EC7141E\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_867009D1FACF80A1E2C919A8EEB83F6A5BB16EF95BACD064E526589732F9184444a8",
        "volumedismount",
        "AllowConnectedDevices",
        "Count of the number of times a login is aborted due to a target authentication failure",
        "C_9B76BE6116634D98E523DAF9A0AD948B4D742F1F76F465B3DDA5D1B7EF1C7F0E",
        "StartStopCycleCount",
        "BlockId",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|DevLoader",
        "LOCALE",
        "ProcessorAcpiXpssState",
        "NS_2EEEF6086B5AA3148DE8DC3E7A7263A417EE849A276BDB357874FDEB8ADED318\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_2381C996A59A0D1EB6DDD79E1C697FECC05884247B858E341AE1AAFDFB086D7B",
        "Example: 1413120.",
        "EVENT_TYPE_QUALIFIERS",
        "R_610AB796758AF91BAFAAC5773CA30FA987962CB5B589ABCAD3D6EAA7F97EA9EE",
        "RecordID",
        "CIM_ComputerSystem.HealthState",
        "SPACES_PhysicalDiskToStorageReliabilityCounter",
        "SectorCount",
        "{6DC76655-063C-4524-A862-B8410C26281B}",
        "hhBp\\",
        "NDIS Dot11 Roaming Completion Status Indication",
        "NPIV_WWPN_IN_USE",
        "Synchronize",
        "{455C66F5-2F69-4113-AF2F-ED22F1473B28}",
        "ForceWS",
        "Applications for VPN triggering",
        "C_A107EAA2D6C2A698530A8358D207D9A3B8B427F7073C80586F1820045E4C35C1",
        "MSNdis_WmiTcpIpChecksumOffload_IPv6TransmitReceive",
        "MaxStatefulNegotiations",
        "Amount off disk idle time",
        "SetWINSServer",
        "MSFT_CliSeeAlso",
        "The Win32_1394ControllerDevice class represents an association between the high-speed serial bus (IEEE 1394 Firewire) Controller and the CIM_LogicalDevice connected to it. This serial bus provides enhanced connectivity for a wide range of devices, including consumer audio/video components, storage peripherals, other computers, and portable devices. IEEE 1394 has been adopted by the consumer electronics industry and provides a Plug and Play-compatible expansion interface.",
        "IsFirewalled",
        "NDISWMI_TRACE_SRIOV",
        "Always compare the DestinationPath with the SourcePath. The default is false, meaning we will use cached information.",
        "Auto download and notify for install",
        "External interface enabled",
        "A free-form string describing the probable cause of the error.",
        "This class provides information on the WNS channel used for notifications to the MDM agent",
        "TotalClusters",
        "This method will advertise an associated Win32_Product using the installation package provided through PackageLocation and any command line options that are supplied. The method can return the following values:",
        "x64-based PC",
        "R_6603235838D67F0A31998AE108546BB74586B33844F47241F23AECE3061C708F",
        "Sync over metered network when roaming flag",
        "MCA processor participation description",
        "Resume",
        "MSSmBios_RawSMBiosTables",
        " The SoftwareElementState is defined in this model to  identify various states of a software elements life cycle.   - A software element in the deployable state describes     the details necessary to successful distribute it and     the details (conditions and actions) required to create     a software element in the installable state (i.e., the next state).  - A software element in the installable state describes     the details necessary to successfully install it and the    details (conditions and actions required to create a     software element in the executable state (i.e., the next state).  - A software element in the executable state describes the     details necessary to successfully  start it and the details     (conditions and actions required to create a software element in     the running state (i.e., the next state).  - A software element in the running state describes the details     necessary to monitor and operate on a start element.",
        "TRUE if drive supports compression.",
        "Transport mode preferred",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.2042.3850410451.466",
        "Transforms",
        "CD_0053847C9174B114F63255F7E8E42BF75E9B7A4222D19AA84EE0BCCF56E90337.2545.2267548185.695",
        "Eight Dot Three File Name",
        "PPR1Set",
        "C_9FF931ABDDA027CB18E2F61D38FD5A4FC1AF5875DF376367CE6BBA8FD924FFC2",
        "48010",
        "IsSnapshot",
        "Qualifier for TS having admin access to LS",
        "{A83EF167-CA8D-11d2-B33D-00104BCC4B4A}",
        "ISR-Unexpected",
        "Quarantined",
        "SupportDTRDSR",
        "HandleCount",
        "If false, program settings are not customized.",
        "Controls the congestion provider. One of the following values:  - Default - NewReno - CTCP  - DCTCP - LEDBAT - CUBIC",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|Model",
        "This method creates a file share",
        "{94c79108-b23b-4418-9b7f-e6d75a3a0ab2}",
        "ClientLogonInfoPolicy",
        "DisableHeatGathering",
        "MSNdis_NotifyFilterRemoval",
        "_UUUUUUUU",
        "This method returns the firmware information for a storage enclosure.",
        "SvchostProcessMitigation",
        "CLOSE",
        "The Microsoft Defender Antivirus Signature Class",
        "CIM_VideoBIOSElement represents the low-level software that is loaded into non-volatile storage and used to bring up, configure and access a computer system's video controller and display.",
        "SamDeleteUser_Start",
        "Scan Needed",
        "object:MSFT_ClusteredScheduledTask",
        "C_3C61ABEFEAF778102D0BD005D591A85A882509AB85CE543323A63CC898834695",
        "The DriverName property indicates the driver file name of the SCSI controller./nExample: Adaptec",
        "SetCHAPSecret",
        "LockedDownInternetZoneAllowFontDownloads",
        "MDM_Policy_Config01_DeviceInstallation02",
        "MSFT_NetMainModeRuleMMCryptoSet",
        "Removes a setting from the current storage health.",
        "Not evaluated because primary computer policy is not enabled",
        "0x80050060",
        "The EOTWarningZoneSize property indicates the zone size for the End Of Tape (EOT) warning.",
        "A TimeSpan that specifies the duration in which individual message nonces are valid.",
        "CI_41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "IcmpV6Dscp",
        "Timestamp denoting time failure occured",
        "C_B7D757AC18FF2608497B974C70CC80BE5C41C99B984057C2991D1A13D3816E92",
        "DownloadUrlList",
        "The Title property used for console processes contains the string displayed in the title bar if a new console window is created.  If NULL, the name of the executable file is used as the window title instead.  This property must be NULL for GUI or console processes that do not create a new console window.",
        "Users",
        "IPDstPortStartMatchCondition",
        "ACPI _TSD",
        "Sync Loss or Mismatch",
        "%1: %2",
        "NS_892F8DB69C4EDFBC68165C91087B7A08323F6CE5B5EF342C0F93E02A0590BFC4\\KI_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C\\I_CB9763CADFAE461DFE976536B62DC6599EB9A4BFDCF34872007002B0B9896A3A",
        "Video output technology type",
        "The DriverVersion property indicates the version number of the Win32 printer driver.  The version numbers are created and maintained by the driver manufacturer.",
        "GetCapabilitiesID",
        "C_6D429FD402093547E603FFEF7F3DCBB64D26C88E650742C35EAA4E9D319AB841",
        "SM_SendLIRR",
        "TotalBytesDownloaded",
        "This parameter is used to force the defrag even if free space on the disk is low.",
        "WSManAutoError",
        "l'm;l'm;",
        "Absolute path to the settings template catalog path",
        "Foreground_Green",
        "PolicySourcePromptForPassword",
        "CIM_ScopedSettingData",
        "Registry Hive Dirty",
        "L2CAP",
        "Values: TRUE or FALSE. If TRUE, the serial port is busy.",
        "EVENT_TRACE_FLAG_MDLREAD",
        "Bid2Etw_MSDAPRST_1_Trace_TextW",
        "R_1E1566DEC98AD7EEA11B96CAEF5FEB6AE754AB31A01EE8B2B82E97FC4849BD59",
        "The HardwareVersion property indicates the hardware version number of the SCSI controller.",
        "C_F31884BFB479ECDC8FA0C6525BD2E05B732CCD07D844062B2D8F0B23B81A2F45",
        "ManagedElement",
        "CSE GUID",
        "RefreshThresholdSecondsPercentage",
        "DNS Client NRPT Rule",
        "The DNSDomainSuffixSearchOrder property specifies the DNS domain suffixes to be appended to the end of host names during name resolution. ",
        "7 - 'Fatal/NonRecoverable': An error has occurred, but it is too late to take remedial action. ",
        "Service Not Active",
        "Circular",
        "0xEFFF0021",
        "One of the physical disks specified could not be removed because it is still in use.",
        "ISCSI_TargetMapping",
        "CD_2B52813C6387932BDFDA0985812CEC314027392B2888A6CAF0E363C856302651.1205.1988356380.1697",
        "    PlugInApplicationID (string) Specifies Identifier for the third party application. ",
        "WmiMonitorSupportedDisplayFeatures",
        "For DMTF defined instances, the \\'preferred\\' algorithm MUST be used with the <OrgID> set to \\'CIM\\'.",
        "WriteToSystemLog",
        "MissingCounterMask",
        "BAUD_600",
        "TRACE_CLASS_CONTEXT",
        "KMS host PID in AO used for the last AD activation.",
        "DhcpMediaSense",
        "C_3FDA9FF251C6BD5841FB280A37A767A97FBDE0A3950C58F141AF2BCE7A64366D",
        "PhysicalAdapter",
        "C_A435E1CD6D36EB19C6DA0BA1C7E62224942A59031964EC981FF17A68812E1011",
        "VerifyServerIdentity",
        "The Win32_TSNetworkAdapterListSetting class enumerates IP address, GUID and Name of the Network Adapter.",
        "Write errors corrected by the storage device.",
        "wPacketLength",
        "LogFile Name",
        "Data Cache",
        "DisableAdvertisingId",
        "DeferToMSAccount",
        "OfflineCollectCapability",
        "NPIV_NOT_SUPPORTED_HOST",
        "CR_5F5583215800877E78DF32C89A95963A09372E548E11061C174A3C01BAB56758",
        "Callback Return",
        "CreateKey",
        "NDIS Status Operational Status",
        "HTTP proxy server address and port.",
        "object:ProcessorAcpiCstState",
        "Version of the token-based activation license that activated the product.",
        "BAUD_56K",
        "Composite polarity type (this is polarity of Hsync pulses outside of Vsync)",
        "MDM_ActiveSync_User_ContentTypes04_01",
        "CIM_SCSIInterface is a CIM_ControlledBy relationship indicating which devices are accessed through a SCSI controller and the characteristics of this access.",
        "OtherIdentifyingInfo captures additional data, beyond DeviceID information, that could be used to identify a LogicalDevice. One example would be to hold the Operating System's user friendly name for the Device in this property.",
        "TM_APPSRV",
        "qoswmiQOSWMI",
        "InfFilename",
        "This method is used to mount a volume to the file system.",
        "The VPort setting data for the network adapter.",
        "LS_CONNECTABLE_LOWER_VERSION",
        "CD_1D13F523791F1EB20EAEF6F153AF80EF4F13EE29DAAF24D54E908D208A687279.1677.1083281548.329",
        "MachineProfilePath",
        "Server Sessions",
        "Ndis802_11FH",
        "ProcessorAcpiCstState",
        "SupportedMaximumTransmissionUnit",
        "DOT11_ASSOCIATE Flag",
        "I_867009D1FACF80A1E2C919A8EEB83F6A5BB16EF95BACD064E526589732F91844.1148.4075638430.259",
        "The Msft_WmiProvider_GetObjectAsyncEvent_Pre event class represents an event generated immediately prior to calling the provider's implementation of IWbemServices :: GetObjectAsync. ",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|TcpUseRFC1122UrgentPointer",
        "C_AD28C82889667A5985FA157872F7F42C3CF0F9FD284883BEB8BA71DEFF026FBB",
        "CD_5997589696FB2E4597FC4CE1E1612FCF4F0EAE5655998B39A34DFA12CA0BE14A.2229.494115016.2361",
        "Number of elements in RedirectPortalList array",
        "Routing Failure",
        "Pseudo-static",
        "The AutomaticResetCapability property determines whether the auto reboot feature is available with this machine. This capability is available on Windows NT but not on Windows 95.",
        "CD_A845C3809E8DF42635819F5D4441FC804E08EFF7CF893C7B960B207ABE392F53.2203.1.86747",
        "MDM_Firewall_Global02",
        "Example: E:",
        "The scoping computer system's name.",
        "The Name property indicates the user assigned name followed by the group name. Program groups are implemented as file folders in Win32.",
        "{502F00A0-DB2B-11d2-85FC-0000F8102E5F}",
        "Maximum Averaging Interval",
        "0xC0050045",
        "PAE Enabled",
        "Invalid frame type",
        "The SetDeadGWDetect method is used to enable Dead Gateway detection. Setting this parameter to TRUE causes TCP to perform Dead Gateway Detection. With this feature enabled, TCP asks IP to change to a backup gateway if it retransmits a segment several times without receiving a response. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "MSFT_WmiConsumerProviderUnloaded",
        "If TRUE, the subsystem will only allow one initiator to be added to a masking set.",
        "MIF.DMTF|Software Component Information|002.4",
        "6 - 'Mirror': create and maintain a copy of the source. ",
        "This parameter indicates that the user wants to display detailed resource usage data for background tasks.",
        "VBS enabled",
        "DeCommittedSize",
        "R_C84DD871FB7E9CB6D29DCC02EA27D46F8AC10106A4A5F7B1A7A789F07E15462D",
        "The Local property indicates whether the printer is attached to the network.  A masquerading printer is printer that is implemented as local printers but has a port that refers to a remote machine.  From the application perspective these hybrid printers should be viewed as printer connections since that is their intended behavior.",
        "VpnPeerCachingAllowed",
        "MobilePlatform",
        "StorageNode",
        "Specifies a LUID value.",
        "UnlockWithCertificateFile",
        "Status code resulting from operation",
        "MSiSCSI_DiscoveryConfig",
        "RS232 Serial Port",
        "CIM_VideoController.CurrentRefreshRate",
        "0x00000200",
        "Win32_MemoryDeviceArray",
        "SetByTraceAllParameterSet",
        "SourceInstanceHost",
        "ErrorControlForced",
        "NapState",
        "Script execution time.",
        "Date and time the WMI Event was generated",
        "DtcName",
        "SamOpenGrp_Start",
        "Composite sync (on Hsync line) is supported",
        "CD_D0463C61C5FB59AFB14652F5029984454DBCBB9EA71D7BD37E6D26E78285BA33.1.1218841027.355",
        "S-1-5-11",
        "Health Actions currently being performed on the Volume.",
        "NPIV_WWPN_NOT_FOUND",
        "CIM_CDROMDrive",
        "Enables SNMP and specifies the index.",
        "ReaderQuotas",
        "{0C0B0642-1DEB-43DF-8032-7A9BF5811A74}",
        "Win32_EnvironmentSpecification",
        "DriveMapping",
        "PCSystemTypeEx",
        "OperatingStatus provides a current status value for the operational condition of the element and can be used for providing more detail with respect to the value of EnabledState. It can also provide the transitional states when an element is transitioning from one state to another, such as when an element is transitioning between EnabledState and RequestedState, as well as other transitional conditions.",
        "Degraded Signal",
        "KeepConn",
        "InternetZoneAllowUserDataPersistence",
        "DeviceCreationClassName",
        "The Win32_InstalledWin32Program class represents an installed Win32 application.",
        "The value for this data source attribute.",
        "CD_8724BEA2FF9D9B28718AB2DA764FE15C27C309D192B8F3C70C0BADEEA7D258BF.2624.2350402897.351",
        "slowLink",
        "ref:MSFT_NetIPHttpsConfiguration",
        "SessionName",
        "MIF.DMTF|Memory Device|002.9",
        "String URL of the proxy server",
        "Direct",
        "Maximum Operating Budget",
        "C_FFED3214ADBDED8EDC1C230F9F76288FB7BCCC548BBB6399505DF304ECB3A518",
        "The access path is not valid.",
        "AllowRegion",
        "FriendlyName",
        "The Win32_SystemUsers class represents an association between a computer system and a user account on that system.",
        "Sets security descriptor on the service to the specified structure. ",
        "The user who requested remediation",
        "InitializationTimeoutInterval",
        "D8AF1424B994565A4F30353F70D9AAA5FA171745944447722281AE60C.2719.4053836459.280",
        "A Win32_FolderRedirectionHealth object that represents the health of the user's redirected Start Menu folder.",
        "The FileID of a Win32_FileSpecification for which this action applies (must be a valid binary file.)",
        "The environment for the server.",
        "ResourceName",
        "This field is the message displayed to the user. %1 should be replaced with the corresponding storage provider's Name field. %2 should be replaced with the error message.",
        "An array of enumerated integers indicating the Vpp voltage supported by this slot.",
        "{0cffd0fc-8333-4000-9a3b-200735d698f9}",
        "The IPXNetworkNumber parameter specifies an array of characters that uniquely identify an adapter on the computer system. The NetWare Link (NWLink) IPX/SPX-compatible transport in Windows 2000 and Windows NT 3.51 or higher, uses two different types of network numbers. This number is sometimes referred to as the External Network Number. It must be unique for each network segment. The values in this string list must have a corresponding value in the IPXFrameType parameter identifying the packet frame type used for this network.",
        "The path to the packag",
        "Apply IPsec policy deltas",
        "MaxVirtualPortCount",
        "AgentId",
        "LPC_TRACE_TIMER",
        "This operation is not supported on primordial storage pools.",
        "The guid associated with the parent of the object these rights apply to",
        "The BindImage action binds each executable that needs to be bound to the DLLs imported by it by computing the virtual address of each function that is imported from all DLLs. The computed virtual address is then saved in the importing image's Import Address Table (IAT). The action works on each file installed locally.",
        "The GroupComponent reference represents the computer system where the resource is located.",
        "{5ec10354-a61a-11d0-8dd4-00c04fc3358c}",
        "Function Flag",
        "CD_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD.0.882587623.197",
        "SystemConfig_V1_Video",
        "The AdapterDescription property contains a description or descriptive name of the video adapter.  ",
        "DVD-9",
        "// This class exposes session and connection information on the initiator.",
        "MSFT_StorageEvent",
        "{8518ABC0-DB32-11d2-85FC-0000F8102E5F}",
        "{8502C562-5FBB-11D2-AAC1-006008C78BC7}",
        "58010",
        "14     This device cannot work properly until you restart your computer. ",
        "TCPPorts",
        "SuiteParentId",
        "MaxOffLoadSize",
        "MSAcpiInfo",
        "Internal Error Code",
        "A value that indicates whether the machine-wide proxy settings are used rather than the user specific settings.",
        "{24EB52AC-7C77-438b-AB61-D024DAB0C03A}",
        "Specifies the reinstall mode",
        "Moles",
        "MCA_FRC_ERROR",
        "CR_DA8AC0D78FD1B90698550FC0FF5C609171143A2B0FA32F0B779BC5DC2D3441C8",
        "CIM_Job.OtherRecoveryAction",
        "Note that the non-zero sequence numbers need not start with \\'1\\', and they need not be consecutive. All that matters is their relative magnitude.",
        "TargetStorageElements",
        "Minimum Averaging Interval",
        "FilterBlock",
        "pE083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "Completely on tier",
        "CIM_PointingDevice",
        "CIM_RedundancyComponent",
        "EVENT_TRACE_FLAG_L",
        "QueryInfoPolicy_End",
        "MSFT_NetMainModeSA",
        "PLATFORM_TRACE_RESERVED_12",
        "InNumOfPhyCounters",
        "CompanyName",
        "PrimaryStatus provides a high level status value, intended to align with Red-Yellow-Green type representation of status. It should be used in conjunction with DetailedStatus to provide high level and detailed health status of the ManagedElement and its subcomponents. ",
        "Connection Oriented WAN",
        "ref:Win32_LogicalProgramGroup",
        "TrustedSitesZoneNavigateWindowsAndFrames",
        "R_6A28C9121AC74A9EB361B4BCCF85389D5F225385AD9FDFA10E6FCB506E2CAE2C",
        "FullName",
        "C_EA4DF20054CBD87001EE67FE2E62392134ACBA7D580330C315985BC30E5F543E",
        "Servicing",
        "Create_New_Process_Group - The new process is the root process of a new process group. The process group includes all processes that are descendants of this root process. The process identifier of the new process group is the same as the process identifier (returned in the ProcessID property of the Win32_Process class).  Process groups are used by the GenerateConsoleCtrlEvent function to enable sending a CTRL+C or CTRL+BREAK signal to a group of console processes.",
        "The Win32_PrintJob class represents a print job generated by a Win32 application. Any unit of work generated by the Print command of an application running on a Win32 system is a descendent (or member) of this class.",
        "SDBUS_DEBUG_EVENT Flag",
        "The Win32_NamedJobObjectSecLimit association class relates a job object and the job object security limit settings.",
        "MIF.DMTF|Physical Memory Array|001.15",
        "Flag for enabling / disabling first use notification",
        "WaitForSyncOnApplicationStart",
        "{8502C503-5FBB-11D2-AAC1-006008C78BC7}",
        "ERROR Flag",
        "This field indicates the number of underlying physical disks across which data for this virtual disk is striped.",
        "Allows setting the NodeAddress for an iSCSI initiator port by passing an IQN as the NodeAddress string.",
        "Example: 11",
        "Configuration/Customization Error",
        "ImageBase",
        "PeakProcessMemoryUsed",
        "This method provides ability to lock the device",
        "Number of process contexts currently loaded or running on the operating system.",
        "PNP_INSTALL_INFO_LEVEL",
        "Hours",
        "{47653BC1-623A-42f0-9E60-A5BD9E0587D9}",
        "{E23A07D1-1E89-4B22-8411-051B40A0A357}",
        "SupportsSnapshotRemote",
        "Mobility Center Performance Trace",
        "ALLOW_PERFORMANCE_HIT",
        "VolumePathNames",
        "CD_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2.296.1483793053.566",
        "The SecondaryBusType property indicates the secondary bus type of the motherboard.",
        "MemoryConsumableBlocks",
        "The time and date of creation of the Indication. The property may be set to NULL if the entity creating the Indication is not capable of determining this information. Note that IndicationTime may be the same for two Indications that are generated in rapid succession.",
        "KerbInitSecurityContext",
        "SetDNSDomain",
        "AvailableSpace indicates the total amount of free space for the file system, in bytes. If unknown, enter 0.",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_0FE84CB7228184819434E73184A33B5694CEFAED93B282C50B930127F187504C",
        "Note: The name of the drive does not correspond to the logical drive letter assigned to device.",
        "Alpha 21066",
        "The name of the shortcut to be created.",
        "The size of the patch in bytes.",
        "LocalAttributes",
        "CD_F4FEF988E7256B64289F1FEF1273A667F21EB83A5DB1731752AF9AC27A4871C8.1595.3580357121.495",
        "HighResResponseTime",
        "ROOT\\CIMV2\\ms_409",
        "C_4EB6D1B0651A9BCB05273D40A94D002733C3A80273FBEF6807ADDE10DBD5A05C",
        "Win32_PortResource",
        "RSOP_SOM.id=\"Local\",reason=1",
        "bypass_getobject",
        "Protocols (and their network characteristics) management.",
        "MinTotalDiskSizeProvider",
        "CIM_PhysicalElementLocation associates a physical element with a CIM_Location object for inventory or replacement purposes.",
        "NdisFddiFrameErrors",
        "NDISWMI_TRACE_LSO",
        "Denotes the new intended usage of the storage pool.",
        "Half-Inch Magnetic Tape Cartridge",
        "0x04000000",
        "MDM_EnterpriseModernAppManagement_ReleaseManagement01_01",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.3885814277.180",
        "object:MSNdis_PortStateData",
        "The identity of the device in the AD device registration record",
        "DeleteOnCompletion",
        "MSFT_NetIKEQMCryptoSet",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_7E6A00AAB8467A7129258A087A168DE70442F1968001FDE8C28653B84A0C1849",
        "ConfigureRecoveryPasswordRotation",
        "AutomaticMaintenanceWakeUp",
        "FreePhysicalMemory",
        "Provides static methods for adding ports.",
        "C_EC0D9BE803395BC39DBCCA5405BADA8B14A82223193D36895536EB3BAC2EA6D7",
        "455CE053-2552-4051-A3E4-C4200DC31B7",
        "NdisFddiStateVerify",
        "LsoV2Supported",
        "OS SCSI Target number target is mapped to",
        "Antivirus signature age in days",
        "Script",
        "Product key PID2 of the AVMA host.",
        "This class supplies additional information about a data provider. Querying this class with an instance name returned from another class query will return additional information about the instance",
        "LastSyncStatus",
        "RAM Disk",
        "ThermalState",
        "MSFT_DtcClusterTMMappingTask",
        "   //  Please note that this should still be treated as a string.",
        "Win32API|Memory Management Structures|MEMORYSTATUS|dwTotalPhys",
        "InternetZoneAllowFontDownloads",
        "The Derivation string provides an expression that will be used by the commandline utility to derive the value for the property. The derivation must be either the name of a property defined by the Alias' WMIObject or a Command Line command such as 'w System Get Name'.",
        "This class provides the ability to set Windows modern application settings",
        "The product code for the product of which this binary is a part.",
        "RSOP_ExtensionEventSourceLink",
        "InboundSecurity",
        "ProtectKeyWithNetworkCertificate",
        "CD_3088866DF50426CCC6D9D3B32AAD3B6CF7FC73EC115545308C15A220D5B5FA14.1192.1784710186.296",
        "RemoveOEM",
        "{8502C53A-5FBB-11D2-AAC1-006008C78BC7}",
        "SetPropertyValue",
        "Page faults",
        "IPsec encryption level for DirectAccess.",
        "CD_5001D415C6B6A7F33344EC2166974BCA3ED1A6D95B9DFF048A69B10233E39F47.1205.3623000426.3790",
        "InternetZoneEnableProtectedMode",
        " - AddReplicationEntity ",
        "LockedDownIntranetZoneAllowScriptlets",
        "The DefaultIcon property contains the path to the executable file and the resource identifier of the default icon used by the class.",
        "The CurrentDirectory parameter specifies the current drive and directory for the child process. The string requires that the current directory resolves to a known path. A user can specify an absolute path or a path relative to the current working directory. If this parameter is NULL, the new process will have the same path as the calling process. This option is provided primarily for shells that must start an application and specify the application's initial drive and working directory.",
        "The AdapterType property indicates the type of video adapter.",
        "TaskOffload",
        "Maximum space on differential area volume",
        "Connection Establishment Error",
        "Win32_IP4PersistedRouteTable",
        "HomeDirectoryDrive",
        "MCA_ERROR_CPU_BUS",
        "The name of the Win32_Property that has the path of the working directory for the shortcut.",
        "SidTypeGroup - Indicates a group SID.",
        "WFP layer set",
        "{08145BE0-DB34-11d2-85FC-0000F8102E5F}",
        "Archive",
        "{2306fe3a-dbf6-11d2-9244-006008269001}",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|LastStartupHeapPreallocation",
        "GetTokenActivationGrants",
        "CR_FF3F8092D51DC6205402036D2FD6093424ECB5C60982335F342BEB529DB60880",
        "_DH_WMP_SYNC_STATUS Flag",
        "Identifier for tiebraking simultaneous SAs",
        "UDP Port",
        "The time that the action was started.",
        "{CD7CA120-E3D2-11d2-8601-0000F8102E5F}",
        "The base unit of the values returned by this Sensor. All the values returned by this Sensor are represented in the units obtained by (BaseUnits * 10 raised to the power of the UnitModifier). For example, if BaseUnits is Volts and the UnitModifier is -6, then the units of the values returned are MicroVolts. However, if the RateUnits property is set to a value other than \"None\", then the units are further qualified as rate units. In the above example, if RateUnits is set to \"Per Second\", then the values returned by the Sensor are in MicroVolts/Second. The units apply to all numeric properties of the Sensor, unless explicitly overridden by the Units qualifier.",
        "LocalMachineZoneAllowScriptlets",
        "Win32StartAddr",
        "C_DBAFD0363B932C012CC74B45C91F067589F90C7E922E99CF5A5FE27D21332F93",
        "OfflineFiles",
        "CtlGuidFDSSDP",
        "Addresses",
        "BDD865D2-D7C1-11d0-A501-00A0C9062910",
        "NS_33649B8965454C922467A4F161F8843CBCFBC36216BF16B17C1FAAEAE38C9913\\KI_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB\\I_7BA978978EBF3CD1200A10044AC0BD6F4758993016B7F6B6A538255F2BFBBE7A",
        "Features",
        "Win32API|Network Management Structures|AT_ENUM|Flags|JOB_EXEC_ERROR",
        "NumberOfFreeClusters",
        "Win32_PNPAllocatedResource",
        "The component ID of the transport or filter.",
        "PMAdminConfigParam",
        "Kernel Idle State Accounting",
        "Consumer",
        "Win32_SCSIController",
        "This property is deprecated in lieu of the use of an association, CIM_PolicySetInRoleCollection. The latter is a more explicit and less error-prone approach to modeling that a PolicySet has one or more PolicyRoles.",
        "endOfMedia",
        "Tower",
        "WPD Event Flag",
        "Example: 15",
        "SizeT",
        "TransitionFunction",
        "WmiMonitorDigitalVideoInputParams",
        "Indicating that the NV storage is writeable.",
        "Collision",
        "FullDNSRegistrationEnabled",
        "Boot Start",
        "UseIKEIdentityType specifies what network identity type should be used when negotiating with the peer. It is used in conjunction with the available IPNetworkIdentity instances, that are associated with an IPProtocolEndpoint.",
        "The SetDNSServerSearchOrder method allows for the setting of the server search order as a array of elements. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. This is an instance dependent method call that applies on a per adapter basis. On Windows 2000 the setting applies to the targeted adapter. On NT4 this setting is global.",
        "C_955E009A78C91FAD360B439EA408CFF48F11DEE9AF7E212F013EAC8F62A69A82",
        "Only certs issued by this CA should be allowed.",
        "CIM_PhysicalComputerSystemView.NumericSensorOtherSensorTypeDescription",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services|BatteryLife",
        "0xEFFF0060",
        "The Win32_DeviceMemoryAddress class represents a device memory address on a Win32 system.",
        "{266c72e6-62e8-11d1-ad89-00c04fd8fdff}",
        "0x00800000",
        "Noise Flag",
        "HealthStatusForTempProfiles",
        "TimeOut",
        "Is Virtual Machine Isolation enabled.",
        "DisableAdobeFlash",
        "The PartComponent reference represents the properties of a logical device that exists on the computer system.",
        "Specifies one or more share paths (e.g. \\printServer\\shareName) to be written to the tag",
        "{81bc8189-b026-46ab-64b9-f182e342934e}",
        "C5257.2490.3162878524.213",
        "PeerTransportBindingElement",
        "Win32_PowerSettingCapabilities",
        "TypeOfRangeSwitching describes the kind of input voltage range switching implemented in this power supply. For example, Autoswitch can be specified (value=4).",
        "Dot11 TKIPMIC Failure status information.",
        "ISCSI_LUNList",
        "IPv6ReceiveTcpChecksumSupported",
        "PreferredLifetime",
        "What happened to the malware? (Enumeration)? Blocked/Allowed/Executing/...",
        "IPMIDRIVER",
        "MIF.DMTF|Pointing Device|001.1",
        "Values: TRUE or FALSE. A value of TRUE indicates the variable is a system variable.",
        "5 - Ethernet using DIX header format",
        "UnknownDevice",
        "Win32_Perf",
        "InternetZoneAllowAutomaticPromptingForActiveXControls",
        "If context indexing is enabled this property will be TRUE",
        "CD_8D338BAABD5A4CDE9CD22C60F5FCC1F5326D81FC7BA6D48335E5E3513B7182CB.37.3632132477.256",
        "C_41C5F66D28A54B11831E9923AC9C75B6E565CD4B23788137E12DA876D6CFE78C",
        "OneWayBindingElement",
        "Count of Elements in iScsiPortalInfo array",
        "DOT11_OID Flag",
        "DetectReplays",
        "CleanState",
        "The default value is 3 (\"DontCare\").",
        "Smb Share",
        "TRACE_CLASS_TRANSACTION Flag",
        "MaxArrayLength",
        "PolicySourceAudioMapping",
        "CD_39D7EFFDA11AE4B0AF9356A4C33FF1047BBDB65DB33A2E97D55D112810C928E7.1190.2562165177.621",
        "NDIS ATM Maximum AAL1 Packet Size",
        "Reverse Roles operation requires Suspended state",
        "AcknowledgementInterval",
        "TotalCacheDisk",
        "OldThreadWaitReason",
        "TouchKeyboardFullModeAvailability",
        "R_01938EB24A6B33B65014DBACDE3C7CA2C2E7C61637395768C92D80CCEFF91F8C",
        "FW@c]",
        "Indicates whether transactions flow or not.",
        "C_1463900C5E85009C74D970DC08429284D480248969B543718E853FA68E152A48",
        "{53f5630f-b6bf-11d0-94f2-00a0c91efb8b}",
        "In a multi-node system, this value identifies the node containing the memory in error",
        "{01f89130-95ae-4b6c-a6d3-71982562263e}",
        "SMBIOS|Type 22|Design Capacity Multiplier",
        "Specifies the current character set being used for the output of text relating to management of the Printer. The character set described by this property should also be listed in CharsetsSupported. The string specified by this property should conform to the semantics and syntax specified by section 4.1.2 (\"Charset parameter\") in RFC 2046 (MIME Part 2) and contained in the IANA character-set registry. Examples include \"utf-8\", \"us-ascii\" and \"iso-8859-1\".",
        "Example: 255.255.0.0",
        "Tablet",
        "{BDF9E8B8-6C66-4e45-BA15-E050393DD079}",
        "{8502C4F6-5FBB-11D2-AAC1-006008C78BC7}",
        "The shadow copy is not currently in the device namespace of the local machine.",
        "A string representation of the disk's serial number.",
        "{FA06375D-F0A4-4a47-AD8D-148595F1E0B8}",
        "{8502C54B-5FBB-11D2-AAC1-006008C78BC7}",
        "Example: &K1.",
        "SuspendedRoot",
        "MDM_EnterpriseModernAppManagement_EffectiveRelease03",
        "The Win32_Printer class represents a device connected to a Win32 computer system that is capable of reproducing a visual image on a medium.",
        "The polling interval that the Sensor hardware or the instrumentation uses to determine the current state of the Sensor.",
        "R_48BC67131BFD22F5DA28A903403A15608DD05C18742BBFEFD4FFEEC39F82B3B1",
        "To control ECN codepoints for outgoing packets. Four possible values: - Disabled - UseEct1 - UseEct0 - AppDecide",
        "FileType",
        "CD_0B48320BC1A528B3C1FD27BF622CF9AB5E3E6560AA1B8D7B4BB227712F4B7CA3.2283.2614274260.714",
        "EnumerateShares",
        "OutboundSecurity",
        "Friendly name of the storage tier, defined by the user",
        "HOSTPROC_TRACE_USB_DISPATCHER Flag",
        "Routes",
        "PCI Device Custom Property of the adapter",
        "Deletion",
        "importProgramSettings",
        "ConnectionID",
        "ContentsMovedOnPolicyRemoval",
        "ScheduledTaskProv",
        "Use a Certificate to Sign the RDP Files",
        "Critical Error Counter",
        "AutoBoost Entry Exhaustion Event",
        "FullAccess",
        "ref:PS_Module",
        "Number of additional errors in the record",
        "RdmaStatistics",
        "Rsop Planning Mode Provider",
        "{791ad198-e35c-11d0-9692-00c04fc3358c}",
        "MSFT_NetAdapterVPortSettingData",
        "The PaperSize property indicates the size of the paper.",
        "Enumerate Receive Filters",
        "{4ec63447-2238-43a7-ac33-11c7cc7d8665}",
        "General register (bank 1)",
        "SetSecurity",
        "The PrintProcessor property indicates the print processor service used to process the print job. A printer processor works in conjunction with the printer driver to provide additional translation of printer data for the printer, and can also be used to provide special options such as a title page for the job.",
        "MSFT_StorageNodeToDisk",
        "{8502C50E-5FBB-11D2-AAC1-006008C78BC7}",
        "The SystemStartupOptions property array indicates the options for starting up the Win32 computer system./nConstraints: Must have a value",
        "InitiatorSideIdentifier",
        "The MonitorName property contains the name of the of the monitor for this printer driver, (example: PJL monitor).",
        "MSFT_StorageSubSystemToPhysicalDisk",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1780.1602717935.368",
        "PhysicalDiskRedundancyMax",
        "SystemConfig_V1_PhyDisk",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|NameServer",
        "DefaultOutgoingResponseFormat",
        "IP over CDLC",
        "Service Disabled",
        "CD_20BDCD5FC76289684890138F1E0F84424ECAE89F8B991F35AE342CA8A7F45BC7.2113.1299760912.180",
        "CD_1B0301F62502D60F6575CB09308C7A3739069A23886569D046BCB5BF22A5D75E.2379.1083403841.5272",
        "IL_4BD704EFD82E90D58D3C406978C7C044F013A64518E8C54785195D2358D9CFAE.1807.561115493.325",
        "The KeepAliveTime parameter specifies the interval the TCP waits to check that an idle connection is still available.",
        "MSFT_StorageSetting",
        "CD_8E41820F5D3747F37A9AFB4C6D31D95936F76250DC1731B0B518951FA4D1C211.1360.1.11982",
        "Enable Debug DSC Configuration.",
        "59002",
        "Unittest",
        "A1BA48",
        "DeliveryFlags",
        "The current minute (0-59)",
        "R_D06B3F1802B79F2B6A9EFCAB81EC72ACEFE151A62CB6B68EFB702290BD7BA485.2466.1703999170.558",
        "Page Fault Event",
        "The ProviderOperation_CreateInstanceEnumAsync property indicates the number of calls to IWbemServices :: CreateInstanceEnumAsync.",
        "WMI_TAPE_MEDIA_PARAMETERS",
        "Stale",
        "DECNT",
        "Target user or computer.",
        "The current speed and mode, valid only for conventional PCI devices",
        "StorageTier",
        "_DH_WMPRENDER Flag",
        "NdisReceiveNoBuffer",
        "{1d6560ec-8e48-4a3e-9fd5-a01b698db6c5}",
        "EVENT_TRACE_FLAG_SETSECURITY",
        "Autologger session configuration ID.",
        "InitialSize",
        "A list previous driver names that are compatible with this driver.",
        "\\\\.\\Root\\Microsoft\\Windows\\PS_MMAgent:__Win32Provider.Name=\"PS_MMAgent\"",
        "This class encapsulates a Packet Capture Target on a computer",
        "Assignment type of the product.",
        "ProtocolIFType is an enumeration that is synchronized with the IANA ifType MIB. The ifType MIB is maintained at the URL, https://www.iana.org/assignments/ianaiftype-mib. Also, additional values defined by the DMTF are included. The property is used to categorize and classify instances of the ProtocolEndpoint class. Note that if the ProtocolIFType is set to 1 (Other), then the type information should be provided in the OtherTypeDescription string property.",
        "devicecontrol",
        "The current matching year (4 digits)",
        "NETIO_TRACE_FRAMING",
        "C_C5695436582346972D28A3A00D6B225B8193B828EFE5B198E49A8EAC5B05CE91",
        "Indicates whether this is informational session",
        "UTF-16",
        "58007",
        "{5C6CE734-1B3E-705E-C2AB-B272D99AAF8F}",
        "Indicates whether the property Disabled is configured by Server (0),Group Policy (1), Default (2) ",
        "4C164CBD027C88BF47D531661219C8D5DD2913FC696E",
        "TurnOffHeapTerminationOnCorruption",
        "Registry keyword name of the parameter.",
        "Parent",
        "NSP Flag",
        "Deployment Settings for the Remote Programs Wizard",
        "IL_8B1547E29C4669664E5C74CF6C63C0DCB167707EDB55532CBAA32AF8A1CDDE88.291.1379513984.373",
        "subEntries",
        "The State property describes the current state of the shadow copy",
        "PMNDOffload",
        "ClientSearchCriteria",
        "LetAppsAccessGazeInput",
        "MissingValue",
        "CR_D6EC41525ABC21864A19F0FDAF8BF6677886C4CAC1281F55DE47919C07EC9C67",
        "The Description property provides a textual description of the CIM_PhysicalCapacity object.",
        "Association between a replication group and its virtual disks",
        "POINTER_PORT_WMI_STD_DATA",
        "MSFT_NetAdapter",
        "NdisHardwareStatusReset",
        "Standard Video BIOS",
        "Indicates if this client will serve other distributed caching peers when operating on battery power",
        "Impact Moving Head Fully Formed",
        "Multiple bit ECC memory error",
        "Allows or Denies new TS Connections. The second parameter is optional, if specified and set to TRUE, then enables or disables Remote Desktop firewall exception rule depending on whether AllowTSConnections is true or false respectively.",
        "MSFT_NetServiceExitFailed",
        "{ec524523-0bda-434b-941e-8f296cbf97a6}",
        "Assets",
        "System executable directory",
        "NDIS 802.11 privacy filter setting",
        "A LogicalDisk is a presentation of a contiguous range of logical blocks that is identifiable by a FileSystem via the Disk's DeviceId (key) field. For example in a Windows environment, the DeviceID field would contain a drive letter. In a Unix environment, it would contain the access path; and in a NetWare environment, DeviceID would contain the volume name. LogicalDisks are typically built on a DiskPartition or StorageVolume (for example, exposed by a software volume manager) using the LogicalDiskBasedOnPartition or LogicalDiskBasedOnVolume associations. However, it can be based on other StorageExtents, like CIM_Memory, in the case of a RAM disk. The latter is described using the LogicalDiskBasedOnExtent relationship. (Indeed, the BasedOnExtent association is the superclass for the BasedOnPartition and BasedOnVolume relationships.)",
        "ExcludeDiagnosticLog",
        "No Writers",
        "NDIS Dot11 Roaming Start Status Indication",
        "The authentication realm.",
        "{18074AFA-F0FE-11d2-8617-0000F8102E5F}",
        "The sensor reading to get information for.",
        "LsoV2",
        "MSNdis_StatusDevicePowerOn",
        "NTEvent",
        "Laptop",
        "{37cab40c-d1e8-4301-8c1d-58465e0c4c0f}",
        "{9a280ac0-c8e0-11d1-84e2-00c04fb998a2}",
        "PixelClockRate",
        "Upgrades",
        "Bid2Etw_ADODB_1_Trace_TextW",
        "ActualRespo",
        "#define SendRNIDV2_OUT_RspBuffer_SIZE_HINT 76",
        "NewTriggerByDaily",
        "The SecondLevelAddressTranslationExtensions property determines whether the processor supports address translation extensions used for virtualization.",
        "NetworkSettings",
        "TimeToLive Expired Reassembly",
        "CR_F9D4723921ADF841BA7CC65756244CF775FD9B7C648EEDAFF1E2DDD459957AE2",
        "ProcessCreateTime",
        "Synchronized clone target detaches automatically",
        "The major number component of the version information for the current management firmware on this physical computer system.",
        "The low voltage of input voltage range 1 for this power supply, in millivolts. A value of 0 denotes 'unknown'.",
        "See CIM_Memory.NumberOfBlocks for details.",
        "CIM_RecordLog.LogState",
        "ISO 802.3 CSMA/CD",
        "C_1E81C3B7838F4D33A0DBCA06EFC99B61816E8507E0CB2D2FE7B2D8431699B9E0",
        "The Priority property indicates the scheduling priority of the process within the operating system. The higher the value, the higher priority the process receives. Priority values can range from 0 (lowest priority) to 31 (highest priority).",
        "Windows Wininit Trace",
        "Msft_WmiProvider_Counters",
        "Cannot remove the last connection for a session.",
        "CD_455876B64E565F4962FC035AF2C8087D1797E42AAA9586F45C5A3E20F37175C3.291.705755656.598",
        "MobileOperator",
        "Win32API|Windows Networking Structures|NETRESOURCE|lpComment",
        "Key-value pairs of the ODBC DSN.",
        "MSFT_iSCSISessionToiSCSITargetPortal",
        "ParentDeviceType",
        "The ProviderName property indicates the network path to the computer that provides the modem services.",
        "MSiSCSIInitiator_PortalGroup",
        "CtlGuidWpdShellExtension",
        "VoltageSensorOperationalStatus",
        "CD_EC97D00816B4530E92B0346A6B6B453699A71F2B879F99F794A6FF9189BD53FF.76.3986834222.502",
        "SamDeleteAlias_Start",
        "DistinguishedName",
        "DataXfer Flag",
        "TS_TRACE_LEVEL_TEST   Flag",
        "ObjectAccess_AuditRemovableStorage",
        "8C0AC3F94A83078C17C15DB",
        "MemoryDebug Flag",
        "42013",
        "PCI-X Mode1 ECC 133MHz",
        "R_597D151DB991C7E12F8334FF42966FD0AE0C0626270E7DE6F6AB8FD3ECEB0687.1500.1807282480.584",
        "MSStorageDriver",
        "Processing",
        "NumberOfTokensMax",
        "object:MSNdis_WmiMethodHeader",
        "Represents the IPv4 protocol of Microsoft TCPIP WMIv2 provider.",
        "RSOP_RestrictedGroupBlocked",
        "uld be used for storage tier creation.",
        "{11140D44-E3D1-11d2-8601-0000F8102E5F}",
        "Select * from Win32_Group",
        "The ConnectionlessService property indicates whether the protocol supports connectionless service. A connectionless (datagram) service describes a communications protocol or transport in which data packets are routed independently of each other and may follow different routes and arrive in a different order from that in which they were sent. Conversely, a connection-oriented service provides a virtual circuit through which data packets are received in the same order they were transmitted. If the connection between machines fails, the application is notified.",
        "Optimize for System Performance",
        "0x000800",
        "MaxFileSize",
        "onlineHelpPageURL",
        "Detach",
        "CR_88057F4853FAFFBCAA324F022CBE7B7579DAEAEA64628A39AFC4B91F61CE7752",
        "V.32bis",
        " 3 - Neutral ",
        "OtherTargetOS",
        "ipsecID",
        "RoutingPolicyType",
        "Win32_CheckCheck",
        "Specify the day of the week to run a scheduled scan.",
        "PsDscRunAsCredential",
        "827c0a6f-feb0-11d0-bd26-00aa00b7b32a",
        "RenewalInterval",
        "{C41FF872-07B1-4926-819B-8C94E6B1FBB9}",
        "LowThresholdOnClientObjects",
        "HardwareAssisted",
        "The compartment in which route(s) are located.",
        "Known Good",
        "CIM_RecordLog",
        "{C7A3A54B-0250-11d3-9CD1-00105A1F4801}",
        "MSFT_SmbServerConfiguration",
        "Example: J101",
        "IR_45569AA056ADC9524DBBD290145103D4DAFF08E0CDB98D574F6E8F827058279E",
        "Writeable",
        "The DNSServerSearchOrder parameter indicates the list of server IP addresses to query for DNS Servers./nExample:130.215.24.1 157.54.164.1",
        "TurnOffFileHistory",
        "Client Accessible",
        "Logon Total",
        "An array of free-form strings providing more detailed explanations for any of the entries in the ServicePhilosophy array.",
        "A DefragAnalysis is the result of executing the Win32_Volume::DefragAnalysis or Defrag methods;it is passed as an [out] parameter from these methods.",
        "Specifies whether the binding for a service supports contracts.",
        "The model of the physical disks to put into maintenance mode.",
        "8251 FIFO Compatible",
        "Win32_Reliability",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2736.2113456816.348",
        "Specifies a double word data value. ",
        "PCI_BUS_ERROR_TYPE is valid",
        "AccessFromNetwork",
        "MS_SMHBA_SAS_Port",
        "CR_E4FC7CCBE036059F139218E837508435F1EEA217B72843BBC84B1DD56DF78DB9",
        "1394 boot is supported",
        "MDM_WindowsDefenderApplicationGuard",
        "DE51E01CC9C7625981822E2D1C37B70F78DC6E6179505A7BD928",
        "The CIM_USBController antecedent reference represents the Universal Serial Bus (USB) controller associated with this device.",
        "The Manufacturer property indicates the name of the SCSI controller manufacturer./nExample: Adaptec",
        "ConnectState",
        "Per-user",
        "ref:CIM_NetworkPort",
        "TaskDefinition",
        "The DefaultPriority property specifies the default priority value assigned to each print job.",
        "Maximum lifetime over which a temporary address is valid. The default value is 7 days.",
        "Device Problem Code",
        "The Win32_Volume class represents an area of storage on a hard disk. The class returns local volumes that are formatted, unformatted, mounted or offline. A volume is formatted by using a file system, such as FAT or NTFS, and may have a drive letter assigned to it. A single hard disk can have multiple volumes, and volumes can also span multiple disks. The Win32_Volume class does not support diskette drive management.",
        "ACTIVITYID",
        "Win32_ProtocolBinding",
        "ref:MSFT_StorageFaultDomain",
        "ThreadPoolTrace_V2",
        "ACPI status register",
        "SmbiosMinorVersion",
        "NA-Legal",
        "MDM_PassportForWork_PINComplexity03",
        "AllowAppVClient",
        "SecondsExists",
        "EntryPointRange",
        "CIM_MessageLog.Name",
        "SPACES_StorageProviderToStorageSubsystem",
        "149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855",
        "This text string identifies a particular computer configuration for sale. It is sometimes also called a product ID or purchase order number",
        "Paper Problem",
        "2 - 'Fixed' indicates that the virtual disk's capacity is fully allocated upon creation. ",
        "C_74BDAD13EFC25BDDDA03231B2D3B39ABD8B91202277E5C78F927E74B85FE75B7",
        "\\\\.\\root\\Microsoft\\Windows\\Storage:__Win32Provider.Name=\"StorageWMI\"",
        "Win32API|cHwRes|INTERFACE_TYPE",
        "LoggedOnUsers",
        "C_66B4AAE372CBC10B0496696F6E3E5C00A5D9FE6B85AA03A0FC19CA05435472B7",
        "MSSmBios_Sysid1394",
        "object:MSNdis_ReceiveFilterGlobalParameters",
        "The CIM_FromDirectorySpecification association identifies the source  directory for the file action. When this association is used,  the assumption is that the source directory already existed.  This association cannot exist with a  CIM_FromDirectoryAction association since a file action  can only involve single source directory.",
        "AllowInstallationOfMatchingDeviceSetupClasses",
        "{A42C7BD1-5AF3-4b32-9BC6-B85EB31D3F4A}",
        "This cmdlet will remove the ODBC DSN using this driver only. You can use wildcard characters. The default is to remove all ODBC DSNs.",
        "HostedCacheHttpListenPort",
        "MSStorageDriver_FailurePredictStatus",
        "The name used remotely for the server.",
        "C_0BFBBC27194F31119DF7EC9CDE40B8D9322865505281E1329BDA61CD53B1D995",
        "ConnectClientDrivesAtLogon",
        "object:MSFT_HealthAction",
        "The Name property defines the label by which the object is known. The value of this property may be set to be the same as that of the UserID property or, in the case of an LDAP-derived instance, the Name property value may be set to the distinguishedName of the LDAP-accessed object instance.",
        "Adaptive Mirror Remote",
        "DSDnsDomainFlag",
        "R_9E75389C0792124C1DF0E93856EFBE7DD2DBB60D509A695E77FDE0138B272CC3.1198.1479017878.516",
        "PROTO",
        "LossOfSyncCount",
        "{5280028a-c24f-43ec-b27d-a960a70e319a}",
        "TCPCopyIPV6",
        "TRACE_RESERVED9",
        "Get Local Configuration Manager settings that are used to control Configuration Agent.",
        "CD_6FFBA8B5854E9C5C5C698A9277971D04E447B67166A26CB7D9DD0D9F278C2D8B.13.1308828709.944",
        "ScreenSaverTimeout",
        "Command Line Arguments required for this application",
        "PolicyStore property defines the store to retrieve the ISATAP configuration policy.",
        "C_59A8BCB9F6971B321C776BA9F2959B669CA7F5AE7D9DBEF59E2C6406BCC884D3",
        "InactivityTimeout defines the time limit (in seconds) for automatic disconnection of the phone line, if no data is exchanged.  A value of 0 indicates that this feature is present but not enabled.",
        "Configuration document that is to be applied.",
        "The platform architecture of the ODBC DSN you are adding. Possible values are '32-bit' or '64-bit'. The default is '32-bit' on a 32-bit process and '64-bit' on a 64-bit process. This is the platform architecture on the remote machine if this command is executed in a remote CIM session.",
        "Pentium(R) Pro",
        "0xC0000015",
        "AllowWindowsDefenderApplicationGuard",
        "OtherIdentifyingInfoDescription",
        "Win32_LogonSession",
        "The DiskSpaceUsed property indicates the current number of bytes currently in use by this particular user or group.",
        "C_28D3480019EDB8568B100B133C2E45279CD6E1AD49C4AEEDB510EEF8207E9610",
        "GUID ID of the keyword to update",
        "24 - CIM_ERR_PULL_CANNOT_BE_ABANDONED. The attempt to abandon a pull operation has failed.",
        "AllowUnicastResponseToMulticast",
        "The name of this printer.",
        "Y]afkosw",
        "MDM_WindowsAdvancedThreatProtection_Configuration01",
        "Indicates if BranchCache content server functionality is enabled",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"MS_NT_EVENTLOG_EVENT_PROVIDER\"",
        "2E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "Specifies the active process limit for the job. If you try to associate a process with a job, and this causes the active process count to exceed this limit, the process is terminated and the association fails. Ignored unless LimitFlags specifies Active Process Limit.",
        "phoneNumber",
        "CritSecCollision",
        "0x80050062",
        "Flag indicating whether the template represents a template file.",
        "LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads",
        "ref:CIM_PhysicalElement",
        "IL_E14960055650ADAC2C06C29022467C3EF58831F50C9AFF42B1D1C7B072FAC7F1.668.1.53493",
        " The CIM_DirectorySpecification class captures the major directory  structure of a software element.  This class is used to organize  the files of a software element into manageable units that can  be relocated on a computer system.  ",
        "R_DA290273C5C5246EBD4AD92A0C51323EC9F3405D662C9D949CD09183391AA1F8.1164.1513370804.530",
        "In the case of an LDAP-derived instance, the UserPassword property may contain an encrypted password used to access the person's resources in a directory.",
        "Domain of this object, in DNS format: \"redmond.corp.microsoft.com\"",
        "43030",
        "R_03E318994DE320A2B2B6A80EC1700D149A451607E607421E61E8F027E9429B85",
        "C_BEEEB6B78BFA29F6F9A10B9A1DE6F2C01EFC08D1BB19CFC65419A1BB0BC83594",
        "Referral Flag",
        "PeerCount",
        "If True, specifying this parameter is optional. Otherwise it is mandatory.",
        "CreateReplica",
        "Default actions for Attack Surface Reduction Rule(ASR). The actions need to be in the same order as their respective rule Ids specified in the AttackSurfaceReductionRules_Ids property.",
        "NS_FE3EA006C3292950A76C2B5A0185D7DF99ADD6FD6502E0AC079E3A8650E76E3A\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_3985A64DD548C159337A855FB2D96B222C50720949C8FDEAE049F7ADFD2826A5",
        "AllowSiteToZoneAssignmentList",
        "MSFT_ExpressionKeywordValue",
        "AcceptStop",
        "This association relates an MSI feature with an action used to register and/or publish the feature",
        "DriverPath",
        "CD_4C388CE7AE5DC6521AA42C4856C6B40FD20A765CE0A1AB00E36A2A499F181279.1734.64657427.656",
        "MSNdis_StatusDot11MPDUMaxLengthChange",
        "Boolean indicating that the DiskPartition is labelled as the primary partition for a ComputerSystem.",
        "Category Id",
        "PLATFORM_TRACE_RESERVED_12 Flag",
        "policySetting",
        "The type of the channel.",
        "HopSet",
        "MaxHSyncNumerator",
        "Destination prefix of the route to be added",
        "WmiSetPortParameters",
        "I_9A1B596721539D9615A6900B0F6364E9823374D126BDDBDF36FABAC428F02B9B.560.1.66330",
        "PreferredAadTenantDomainName",
        "The diagnostic log has already been started for this storage subsystem.",
        "WallpaperTiled",
        "OEM Event",
        "AllowPromptedProximalConnections",
        "HardwareInterface",
        "SessionPoolFree",
        "AddressHeaders",
        "ConnectionSpecificSuffix",
        "DisableRemovableDriveIndexing",
        "The OverwriteExistingDebugFile property indicates whether a new log file will overwrite an existing one. /nValues: TRUE or FALSE. If TRUE, the existing debug file will be overwritten. If FALSE, a log file is not written if the filename already exists.",
        "{62bef71e-899d-11d2-819e-0000f875a064}",
        "Service (6) puts the job into a vendor-specific service state. It might be possible to restart the job.",
        "R_BCC51EBEB630858C0B60676634F08D5808792D53B6A2D49F8CF03616958EEB0D.1489.3002493814.568",
        "Kernel Hypercalls",
        "This method manually fires alerts",
        "C_D4A97CD760E9DC657E08D29140B18BCC6B8D0D59DB6745F4739A4443DFD0F72F",
        "Supplies the parameters for protocol offloads on the adapter.",
        "Hang Up Extra Percent",
        "The event message as it appears in the NT Eventlog. This is a standard message with zero or more insertion strings supplied by the source of the NT event. The insertion strings are inserted into the standard message in a predefined format. If there are no insertion strings or there is a problem inserting the insertion strings, only the standard message will be present in this field.",
        "SharedSecretLength",
        "-Tuesday",
        "SyncOnGreenVideoSupported",
        "CONFIG_API Flag",
        "User-friendly compartment description.",
        "NASRollback",
        "Antivirus signature version (major, minor, build, revision)",
        "Local SMTP Server",
        " MS_SMHBA_SAS_Port or MS_SMHBA_FC_Port Buffer",
        "In Test",
        "3.5 MO 128Mb   512 bytes/sector",
        "LUAInstall: error 0x00000005 setting flags [{9456A480-E88B-43EA-9E73-0B2D9B71B1CA}]",
        "The DiskSpaceUsed property indicates the current number of Bytes currently in use by this particular user or group.",
        "DeleteRoamingCacheEnabled",
        "The Id property indicates the manufacturer's identifying name of the Win32 CD ROM drive.",
        "RD_TRACE_RESERVED_0d",
        "iScsiFlagGeneral",
        "ExecuteMethods",
        "AvailableSpace",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_BCDF0AE7DC27FAFED7F3086084877E579AF9D73C546674217B8E86B2518960DB",
        "To describe the data structure of RecordData, the RecordFormat string should be constructed as follows: ",
        "The Win32_ApplicationService class represents any installed or advertised components or applications available on the system. Instances of this class include all properly installed and instrumented executables.",
        "Generic Write",
        "The ImageSize property indicates the size in bytes of the loaded module.",
        "The PowerOnPasswordStatus property identifies the system-wide hardware security settings for Power On Password Status.",
        "TraceListener",
        "PolicySourceLevelOfControl indicates whether the property LevelOfControl is configured by Server (0),Group Policy (1), Default (2).",
        "MSNdis_80211_NetworkTypeInUse",
        "Severe error events (usually internal)",
        "A communication point from which data can be sent or received. ProtocolEndpoints link system or computer interfaces to LogicalNetworks.",
        "Security: SChannel",
        "CD_7C256082C028FC113E44225862F56FE496A6FB4D4EE2AD50DD39EB6DF6A574DF.1528.4141416222.2192",
        "NdisPermanentAddress",
        "IL_317D1F2687177AFA27CB8EA6F6A360902286E215810936DE250861D000157F69.2460.1550424754.287",
        "NDIS Token Ring Permanent Address",
        "s41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "ModerateThreatDefaultAction",
        "MinTotalRAMProvider",
        "The SystemDrive property contains the letter of the disk drive that the operating system resides on.",
        "MDM_Policy_Config01_DeliveryOptimization02",
        "RSOP_IERegistryPolicySetting",
        "SamCompPwdSet_End",
        "Not execute in 'count by word' mode",
        "Only the first 2 TB are usable on MBR disks.",
        "Horizontal sync pulse width",
        "If the physical disk is not a member of a concrete pool, then this method should not only reset the health and operational statuses, but it should return the disk into a state where it is usable as storage for a concrete pool. For example: If a physical disk had become missing and then has reappeared (after it has been replaced) this physical disk is expected to be in the primordial pool only with an operational status indicating its data is either split or unrecognized. Calling Reset shoul",
        "Pulse",
        "RemoteUsers",
        "CollectionSetting represents the association between a CollectionOfMSEs class and the Setting class(es) defined for them.",
        "TimeStreaming",
        "PreviousNamespace",
        "Thread_V1",
        "A profile that is referenced by another RegisteredProfile.",
        "QUERY_INFORMATION",
        "THREAT_CALLISTO_REQUIRED",
        "TR_PROTO Flag",
        "IL_37CB291E96206B811B242E1B2E99A15E443B14749AA28D9EF51C66CFB85086A0.1608.992405960.282",
        "The MediaType property indicates the type of media used or accessed by this device. In this class, the value will always be \"CD-ROM\".",
        "The Win32_LoadOrderGroupServiceMembers class represents an association between a load order group and a base service. Note: Win32_SystemDriver objects are members of that load order group. Not all services are members of groups, and not all groups have services within them.",
        "MSiSCSI_NICConfig",
        "Example: X3.",
        "MaximumNumberOfTxQueuesForDefaultVPort",
        "Fail to create replication group.",
        "Data on the PCI bus at the time of the event",
        "Supplies the IPv4 address used as the Source Protocol Address (SPA) in ARP responses.",
        "Group can only have one single relationship active",
        "PagefileUsage",
        "HBA_SCSIID",
        "The Extension property is a string representing the file's extension (without the dot). ",
        "The Default property indicates whether the printer is the default printer on the computer.",
        "0x402",
        "{981f2d7d-b1f3-11d0-8dd7-00c04fc3358c}",
        "TLB access due to store instruction",
        "GPOSession",
        "SupportsVirtualDiskCapacityExpansion",
        "ActionOrder is an unsigned integer \\'n\\' that indicates the relative position of a PolicyAction in the sequence of actions associated with a PolicyRule or CompoundPolicyAction. When \\'n\\' is a positive integer, it indicates a place in the sequence of actions to be performed, with smaller integers indicating earlier positions in the sequence. The special value \\'0\\' indicates \\'don\\'t care\\'. If two or more PolicyActions have the same non-zero sequence number, they may be performed in any order, but they must all be performed at the appropriate place in the overall action sequence. ",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1131.784967978.368",
        "LPCDRVR_TRACE_RESERVED_0b",
        "Registry Hive Destory",
        "The logical width of the display in screen coordinates.",
        "object:MSFT_TaskIdleSettings",
        "11013",
        "TRACE_CLASS_QUIESCENT Flag",
        "{4ff7a7db-43ca-470a-8b64-3003e2d22042}",
        "object:MSNdis_WmiTcpIpChecksumOffload_IPv4TransmitReceive",
        "This class provides ability to detect and provide inventory of web applications of a device",
        "The path and name of firmware image file.",
        "The name of the remote application",
        "The XOnCharacter property indicates the XOn character",
        "C_7D26F1E16BC9CE86FDDDA09E425A859A3BF87CD94B9004A4B2B575CD1EF41374",
        "LoaderLockRelease",
        "The CIM_DeviceConnection relationship indicates that two or more device are connected together.",
        "10 - 'Stopped' and 14 - 'Aborted' are similar, although the former implies a clean and orderly stop, while the latter implies an abrupt stop where the state and configuration of the storage pool might need to be updated. ",
        "CR_6DECEA152EB68C3B8F3895F0BFE2B8D722298B02602F918D61267E0DFA61213B",
        "ConnectorPinout",
        "The user interface level of the install: 1 = Basic, 2 = Maximum.",
        "DtcResourceName",
        "EVENT_TRACE_FLAG_INTERRUPT",
        "MDM_Policy_Result01_DeviceGuard02",
        "Denotes the intended usage of the storage tier",
        "MinLookaheadSplitSize",
        "If set to TRUE, this instructs the physical disks in this storage scale unit to enable maintenance mode.",
        "The bus number of a PCI network adapter.",
        "BAUD_075",
        "NdSecure",
        "CD_832531694CC32AEF12EEFA0D2DDA8BF782C32F932BED169759F268D0FEAF39B8.2033.2519391083.203",
        "The service access point that is dependent on an underlying SAP.",
        "SourceReplicationGroupDescription",
        "- The first character is a delimiter character and is used to parse the remainder of the string into sub-strings. ",
        "C_F7420DA6533A2C562AF06F1F87B007C0FB6BFFD5F71653722CBFC32EEC340ED0",
        "A string representing the network adapter driver version.",
        "Urgency is an enumerated value that indicates the relative frequency at which the Alarm flashes, vibrates and/or emits audible tones. ",
        "IL_21E85A20CC15E835CB6487F54DC9B230DDD677D1A3F958EEE3ACBA0DE0846B34.1499.2500204981.288",
        "SECHC_LOG_FLAG_LOCKS",
        "Power Save - Low Power Mode",
        "A method for activating sideloading and installing the product key",
        "DMWmiBridgeProv",
        "ROOT\\RSOP",
        "Finds the rules that will be used to secure the specified traffic.",
        "WmiMonitorColorXYZinCIE",
        "Full Path of the module",
        "Uninitialized",
        "FallbackPrivate",
        "6 - Windows XP Embedded ",
        "Test - Not a failure",
        "NAS Head",
        "The TimeStampRecord property holds a record timestamps for intermediate hops.",
        "Shared include directory",
        "ScsiInquiry",
        "Name of the GPO on which to operate",
        "ref:RSOP_IEConnectionSettings",
        "ScriptPath",
        "The total number of requests submitted by IKE to obtain a unique Security Parameters Index (SPI) that failed.",
        "useSameProxy",
        "Flags to indicate login authentication type",
        "CIM_ComputerSystemMappedIO",
        "Inject Hardware Error",
        "DirectoryType",
        "Profiles",
        "PreventAddingNewPrinters",
        "PNPRedirection",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|ScopeID",
        "Denotes whether this subsystem supports remote snapshotting.",
        "This property indicates whether the user has a roaming profile configured.",
        "CD_DF597A1A2BAD4809466E7A636A80CAB8A01D7F4907CEA5AC6B1078FB23BB559B.1609.3466538633.550",
        "MSTapeProblemDeviceError",
        "PrepareInProgress",
        "Specifies Trigger properties of VPN Connection.",
        "sint64",
        "__QOSFailureEvent",
        "CR_E00F912E9047D1A2BF3DA9E198CE534F57C5B76F41F1AAB4887EE2C73627DAB0",
        "40000",
        "Number of Error Log Entries",
        "The Win32_NamedJobObjectLimit association class relates a job object and the job object limit settings for that job.",
        "If TRUE, this subsystem supports the ability to create new concrete storage pools from one or more physical disks. If FALSE, either the subsystem uses pre-created storage pools, or it does not support storage pools.",
        "Sas Flag",
        "PCMCIA Support",
        "{2F1A8A9D-7988-457f-A17A-8979E82043C5}",
        "C_D1B2F4E6056A69A2D8AF80AAE4B443CB0029F3E62BFF8D77A98B6230DF9AE6C1",
        "Closed",
        "<LocalID> is chosen by the business entity and SHOULD not be re-used to identify different underlying (real-world) elements. If the above 'preferred' algorithm is not used, the defining entity MUST assure that the resultant InstanceID is not re-used across any InstanceIDs produced by this or other providers for this instance's NameSpace. ",
        "Rhapsody",
        "MSNdis_AtmMaxActiveVcs",
        "HBA_EVENT_PORT_OFFLINE",
        "I_0B2F54DC248571B756F7BF8B112CC00CF7EC2CD6588E2E36744B13AA0012BCBD.2706.982681186.285",
        "This class provides ability to subscribe a device to remote application server",
        "REG_DWORD (4) ",
        "The replication settings.",
        "RemotePort",
        "Removes a DNS suffix and corresponding DNS servers from the trigger properties",
        "Link Order",
        "AltitudeAccuracy",
        "2835681FE0B122A526862616ED33CAB2C220F171DB7BD5AD8B02",
        "CIM_SANegotiationAction",
        "ProgrammedMaxLinkRate",
        "ref:CIM_SoftwareFeature",
        "FAT12",
        "Counter10",
        "The DeviceID property contains a string uniquely identifying the printer  with other devices on the system.",
        "Win32_DiskQuota",
        "msieee80211-PolicyData",
        "CR_040EEFB9D32ACFDF35093E1B9FBC87E0DA3C6102445122A04A158078F02AF3C6",
        "Format Errors",
        "Microsoft-Windows-OfflineFiles-CscNetApi",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightDate|wMilliseconds",
        "SystemSlot",
        "A user relevant name for the relationship between the source and target groups or between a source element and a target group (i.e. one-to-many). If NULL, the implementation assigns a name. If the individual target elements require an ElementName, the implementation constructs an appropriate ElementName using the RelationshipName. For example, RelationshipName as a prefix followed by \"_n\" sequence number, where n is a number beginning with 1.",
        "SettingId",
        "LUAInstall: error 0x00000005 setting flags [{74620884-155F-4B72-A4F0-0FADDBC0721E}]",
        "Maximum number of records that can be captured in the Log. If undefined, a value of zero should be specified.",
        "Localized version of RSOP_PolmkrRegistrySetting for American English",
        "Caller",
        "NS_3FBDCB08ECD33FBEF028D2DB3EF058F8CE959779B943F43AB3DB3EC34ACA147D",
        "CR_E483DF7E28B72B64DDC8E69D7B9D7A194DAA49C1FD6E07E079F14E12C3A828EF",
        "ShareName",
        "ProtectionStatus",
        "DataFile",
        "ClientSiteName",
        "The InfFilename property indicates the path to the video adapter's .INF file. ",
        "The PrivilegesRequired property indicates all privileges required to perform an operation.  This includes values from the PrivilegesNotHeld property.",
        "\\\\.\\root\\Microsoft\\Windows\\HardwareManagement:__Win32Provider.Name=\"MSFT_PCSVDevice\"",
        "LPC_TRACE_LOOKASIDE Flag",
        "Values: TRUE or FALSE.  If TRUE, then the job is run repeatedly according to the DaysOfWeek and DaysOfMonth parameter. If no value is supplied the parameter defaults to FALSE.",
        "MDL_WRITE_COMPLETE",
        "PhysicalDiskUniqueId",
        "The DisplayName parameter passes the display name of the service.  This string has a maximum length of 256 characters. The name is case-preserved in the service control manager. DisplayName comparisons are always case-insensitive. ",
        "6F808F341EE215AD8783D29EA117262",
        "MSFT_KeyValuePair",
        "Leaks Flag",
        "InSenseBufferMaxSize",
        "l.m;l.m;",
        "Return Code",
        "WPDNSE_TRANSCODE",
        "DeviceIDList",
        "OperationalStatus replaces the Status property on ManagedSystemElement to provide a consistent approach to enumerations, to address implementation needs for an array property, and to provide a migration path from today's environment to the future. This change was not made earlier since it required the DEPRECATED qualifier. Due to the widespread use of the existing Status property in management applications, it is strongly RECOMMENDED that providers/instrumentation provide BOTH the Status and OperationalStatus properties. Further, the first value of OperationalStatus SHOULD contain the primary status for the element. When instrumented, Status (since it is single-valued) SHOULD also provide the primary status of the element.",
        "Type of operation that caused the error",
        "Reserved2",
        "For DMTF defined instances, the \\'preferred\\' algorithm must be used with the <OrgID> set to \\'CIM\\'.",
        "RSOP_PolmkrRegistrySetting",
        "The DeviceID property contains a unique name that identifies the bus.",
        "DeletedOffline",
        "PoolPagedFailures",
        "MsftDiscFormat2StreamZero_DebugDestructor Flag",
        "TargetOperatingSystem",
        "MSFT_NetSARuleMMAuth",
        "HKEY_CURRENT_CONFIG (0x80000005) ",
        "The Delete method deletes a scheduled job. The method returns an integer value which can be interpretted as follows: ",
        "Example: X4.",
        "PreventUsingLocalHostIPAddressForWebRTC",
        "An integer that defines how many messages can be read simultaneously without allocating new readers. ",
        "CurrentUsage",
        "Designates the host operating system or other host environment factors that may influence the behavior the storage subsystem should take when showing a virtual disk to an initiator.",
        "StatusInfo",
        "10GBase-SR",
        "3A0AA32ECA612C606596AA91228C49611E4A1C3BBE",
        "The NetEnabled property specifies whether the network connection is enabled or not.",
        "NetDirectPortMatchCondition",
        "CIM_WORMDrive",
        "AntivirusSignatureUpdateDateTime",
        "CR_12A251E4688047981D607B15F79436DB837E075ADA0B6AC78025F676ADBF2AD7",
        "The Signature property is used to identify a disk. It can be used to identify a shared resource. ",
        "Message for incoming requests to DSC.",
        "3 - 'High': copy engine I/O has higher priority than host I/O.",
        "LaunchAppAfterLogOn",
        "Internet Explorer Enterprise Mode Reporting Url Specified In Enable Value",
        "SamSetBootKeyInfo_Start",
        "t2m;t2m;",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1606.3584255166.312",
        "Registry keyword data type. For parameters displayed in user interface, this value is always REG_SZ even if the parameter is a numeric parameter.",
        "object:AcpiControlStatus",
        "CD_9B47552D4116308DF54B1B8BABEB3824E2EAF0C2CFA9CF24D51A58C19C8849E8.2437.2180387242.2639",
        "NibbleReadCount",
        "FX_TRACE_FILEOBJECT Flag",
        "Access",
        "TandemNSK",
        "The Synch property specifies the length of time after which the next interrupt is assumed to indicate the start of a new device packet (partial packets are discarded). In the event that an interrupt is lost, this allows the pointing device driver to synchronize its internalrepresentation of the packet state with the hardware state.",
        "TimestampValidityDuration",
        "TR_COM Flag",
        "Draft",
        "MediaWriteProtected",
        "leShare",
        "Directed",
        "AhSupported",
        "RSOP_PolmkrFolderOptionSetting",
        "R_9212E0D756DE59946D687462B752A6AF5A16EC3A329D47D13E039D19732A1344",
        "OpticalFlushBuffers",
        "BitValueMap",
        "Number Of IE Ports",
        "The InstalledSize property indicates the current size of the installed cache memory.",
        "Indicates if the Adapter supports TCP checksum computation offload for transmit IPv4 packets.",
        "Action to take on policy removal: 1 = leave folder in new location, 2 = redirect the folder back to the user profile location",
        "Block Type",
        "GenerationalGuid",
        "113BE6A1D690E2",
        "AccessPointName",
        "NdisEthernetMoreTransmitCollisions",
        "BBCB50A3E35BB9672B8B458A16DD242DDDDEA6BED48E25ABA8EEF2B0E49A9B3E",
        "{19196b33-a302-4c12-9d5a-eac149e93c46}",
        "Win32_PnPDevicePropertySint64",
        "} ISCSI_AUTH_TYPES, *PISCSI_AUTH_TYPES;",
        "Indicates the enclosure number in which the disk physically resides",
        "SamEnumGrpsInDom_Start",
        "1 - 'Thin': The storage for the volume is allocated on-demand. ",
        "HANDLE Flag",
        "Example: NEC 5FGp",
        "MSFT_DedupProperties",
        "The Name property contains the name for the protocol./nExample: TCP/IP",
        "Select * from Win32_TSAccount",
        "MSFT_StorageScaleUnit",
        "framingProtocol",
        "Number Of Processors",
        "RemotingDebug",
        "Compartment identifier.",
        "This method allows a user to perform certain maintenance tasks on the physical disks in this storage scale unit. ",
        "I_5196BF4BB193F5FD32B65F33245729BAACD84D68DE23317722BE58D06EBE86BD.2719.288418102.280",
        "SystemConfig_V1_NIC",
        "{cc85922e-db41-11d2-9244-006008269001}",
        "DS_LDAP_Root_Class",
        "SystemName",
        "I_51C5ECC9391A52C9234FFF83EC435E9F3B07EA72829CDCC46218519D4A4947A9.1520.303744990.343",
        "__InstanceOperationEvent",
        "WmiGenerateHeader",
        "The Name property serves as a key of a logical file instance within a file system. ",
        "WebScriptEnablingBehavior",
        "InstallPath",
        "socksProxyServer",
        "Process_V2_TypeGroup5",
        "Specifies the processor affinity for all processes associated with the job. The affinity of each thread is set to this value, but threads are free to subsequently set their affinity, as long as it is a subset of the specified affinity mask. Processes cannot set their own affinity mask. Ignored unless LimitFlags specifies Limit Affinity.",
        "File last access time",
        "This method removes a virtual disk from the masking set. Once removed, this virtual disk will no longer be shown to the initiators contained in this masking set.",
        "The DeviceClass property is DeviceClass of the driver e.g. SYSTEM ",
        "\\\\.\\root\\standardcimv2:__Win32Provider.Name=\"NetEventPacketCapture\"",
        "You must specify a volume for this file share.",
        "Counter5",
        "The new GPOSession for the set.",
        "known folder unique id (guid)",
        "Internal Device Control",
        "_CORE_ Flag",
        "    Routes (MSFT_NetRoute[]) Specifies the route to be plumbed.",
        "ref:Win32_PrinterConfiguration",
        "NormalMin provides guidance for the user as to the normal minimum range for the NumericSensor.",
        "The Priority property specifies the priority of the  printer. The jobs on a higher priority printer are scheduled first.",
        "object:MSFT_DSCMetaConfiguration",
        "The HomeDirectory property specifies the path to the home directory of the user.  This string may be empty if the user chooses not to specify a home directory.",
        "A PolicyRule aggregates zero or more instances of the PolicyAction class, via the PolicyActionInPolicyRule association. A Rule that aggregates zero Actions is not valid--it may, however, be in the process of being entered into a PolicyRepository or being defined for a System. Alternately, the actions of the policy may be explicit in the definition of the PolicyRule. Note that a PolicyRule should have no effect until it is valid. ",
        "{8502C57C-5FBB-11D2-AAC1-006008C78BC7}",
        "The SubnetMask parameter contains the subnet masks that complement the values in the IPAddress parameter./nExample: 255.255.0.0",
        "LUN to virtual port mapping.",
        "CD_4EB6D1B0651A9BCB05273D40A94D002733C3A80273FBEF6807ADDE10DBD5A05C.1191.1123943498.302",
        "Array of partial configurations that are specified to be applied",
        "Green",
        "WPD_F3 Flag",
        "Maximum size of reassembly buffer in bytes.",
        "PowerElement",
        "ValueType",
        "Registry_Counters",
        "{5ebb59d1-4739-4e45-872d-b8703956d84b}",
        "Address family(ies) currently protected",
        "MSFT_NetAdapterStatisticsElementSetting",
        "The provider does not support the allocation unit size parameter.",
        "NPIV_LINK_DOWN",
        "CIM_OperatingSystem.CreationClassName",
        "DbgIdRSDS",
        "Send the configuration document to the managed node and start using the Configuration Agent to apply the configuration. Use GetConfigurationResultOutput to retrieve result output.",
        "UserComment",
        "The ColorPlanes property indicates the current number of color planes used in the video display.  A color plane is another way to represent pixel colors; instead of assigning a single RGB value to each a pixel, color planes separate the graphic into each of the primary color components (red green blue), and store them in their own planes.  This allows for greater color depths on 8 and 16 bit video systems.   Present graphics systems have the bitwidth large enough to store color depth information, making only one color plane necessary.",
        "ISO 802.211c",
        "Count of Session digest errors",
        "secureProxyServer",
        "Token name for the driver within its package.",
        "The port number on which BranchCache is listening for incoming download requests",
        "Insufficient privilege",
        "This text string identifies the family to which a particular computer belongs. A family refers to a set of computers that are similar but not identical from a hardware or software point of view",
        " The CIM_ProductSoftwareFeatures association identifies the software   features for a particular product. ",
        "finiBand",
        "#define ISCSI_SECURITY_FLAG_PFS_ENABLED              0x00000010",
        "expression",
        "The HostingSpecification property defines the first component of the __Win32provider :: HostingModelproperty. The hosting property is defined to be one of the following value types :-WmiCore - Activate provider in host to the winmgmt service, note this is only supported for OS components.Note, attempts to register providers with WmiCore as HostingModel will fail with WBEM_E_ACCESS_DENIEDWmiCoreOrSelfHost - Activate provider in host to the winmgmt service or as local server,Note this is only supported for OS components.SelfHost - Activate provider as a local server implementation.Decoupled:Com - Activate provider as a decoupled com provider.Decoupled:NonCom - Activate provider as a non com event provider.LocalSystemHost[:((.)+)] - Activate provider in host to a wmi provider host running as LocalSystem.Note, this is the default if __Win32provider :: HostingModel is not set. Further note, that on creation of an instance of __Win32provider with HostingModel equal to NULL, LocalSystemHost or LocalSystemHostOrSelfHost, an event log record is generated so that admins are aware ofproviders running under the trusted status.LocalSystemHostOrSelfHost[:((.)+)] - Activate provider in host to a wmi provider host running as LocalSystem or as local server. Note, this is the default if __Win32provider :: HostingModel is not set. Further note, that on creation of an instance of __Win32provider with HostingModel equal to NULL, LocalSystemHost or LocalSystemHostOrSelfHost, an event log record is generated so that admins are aware ofproviders running under the trusted status.NetworkServiceHost[:((.)+)] - Activate provider in host to a wmi provider host running as NetworkService.LocalServiceHost[:((.)+)] - Activate provider in host to a wmi provider host running as LocalService.Note, [:((.)+)] refers to a regular expression that defines the hosting group for the provider.",
        "Select * from Win32_TSPermissionsSetting",
        "Get the schema used by a settings location template.",
        "Association between MaskingSet and InitiatorId",
        "0 - 'Healthy': Indicates that the subsystem is functioning normally. ",
        "CtlGuidFDWSD",
        "WriteCorrectedWithDelay",
        "IR_61D4B20454D9364143E7FCDD696A05EA880F3DCC132A499B1EBCE94AEC8918AE",
        "CIM_SecurityAssociationEndpoint.LifetimeSeconds",
        "AllowWarningForOtherDiskEncryption",
        "Perform a survey to refresh the NDIS 802.11 BSS list",
        "Default registry value for the parameter.",
        "March",
        "The Properties property is a string array that lists all the properties (and their values) for this modem.",
        "Settable Baud Rate",
        "Specifies one or more ODBC drivers by driver name. You can use wildcard characters. The default is to return all ODBC drivers.",
        "NS_1A89B57DFA926FAB28EFD5C7FC82B078C2A123A46004BC299B214EFEC424D2B0\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_C2E2D7F294A39E950FCB0FE91EB41D6C66630273B2EF4990C97F60DB582F2E17",
        "TimeDateStamp",
        "Version Number Hi",
        "Don't start",
        "IL_AACBAD46B3B003AE6D7031961E9FBBCD51DB26638F2E8966437CDE247F25A712.2697.980367197.261",
        "LUAInstall: error 0x00000005 setting flags [{93443EB9-3F77-4DBE-84A2-D8467C1DD847}]",
        "Volume mount points not supported",
        "userSids",
        "{C8775641-5430-4220-BA25-7DA561CB64CE}",
        "{74ACE9F1-513F-4423-8863-47DB4D3E47DE}",
        "Win32_Battery",
        "An array of free-form strings providing more detailed explanations for any of the access device features indicated in the Capabilities array. Note, each entry of this array is related to the entry in the Capabilities array that is located at the same index.",
        "Example: Color printer",
        "\"z!&0",
        "MIF.DMTF|Software Component Information|002.7",
        "{FAF76B9A-798C-11D2-AAD1-006008C78BC7}",
        "CD_403C7DAFD38411FBB7FFA51AD2D0CC5E3462A61D34EA60E279877DCCDC222D62.39.3901164362.452",
        "Indicates whether to automatically commit the current transaction if no unhandled exceptions occur.",
        "CD_2435F543C14D77EBC0F0A1B12249B8DC7F253A838F1A9C04985BEFFC4FAC101B.2612.177673659.344",
        "15 - CIM_ERR_INVALID_QUERY. The query is not valid for the specified query language. ",
        "TotalCylinders",
        "EnableExtendedBooksTelemetry",
        "Either the name of the desktop only or the name of both the desktop and window station for this process.  Note: This property has been Deprecated in Windows XP and is no longer used.",
        "Requir",
        "SourceURL",
        "LogSectors",
        "Stops the event capture",
        "NTFS5",
        "StartFileName",
        "R_AAD0D760D72ECB11742773406575974B851067AEA4863E381AADAD2897C3D328",
        "ActiveInputVoltage indicates which input voltage range is currently in use. Range 1, 2 or both can be specified using the values 3, 4 or 5, respectively. If the Supply is not currently drawing power, the value 6 (\"Neither\") can be specified. This information is necessary in the case of a UPS, a subclass of PowerSupply.",
        "CD_832531694CC32AEF12EEFA0D2DDA8BF782C32F932BED169759F268D0FEAF39B8.1197.4285440418.494",
        "MSFT_ExpressionLoop",
        "ValidDisplayValues",
        "DiagL2SecCtlGuid",
        "TerminationDate",
        "To change to network service:  ",
        "Source Absent",
        "LS_NOT_CONNECTABLE",
        "wWUUUUUU",
        "ADActivationCsvlkSkuId",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.2889952617.180",
        "DoubleArray",
        "ThreadId",
        "The identification of the Collection object. When subclassed, the CollectionID property can be overridden to be a Key property.",
        "Authentication Password, for CHAP this is the shared secret to use when generating the response to the target challange. This field is a variable length array.",
        "NS_ECC38DB72CDA9C35493A5511A56C487389544B60BB7D455E01A7B574EF71B32D",
        "Above Normal - Indicates a process that has priority above NORMAL_PRIORITY_CLASS but below HIGH_PRIORITY_CLASS. For Windows 2000.",
        "D3F609CF92D2D881D05F26BFED8",
        "DiscoveredPortWWN",
        "The Check reference represents one side of the Check.",
        "RdmaTechnology",
        "Remote",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pSepFile",
        "CurrentOwner",
        "RelocateImageBegin",
        "The storage objects to add to the group.",
        "DHCPOptionsToUse",
        "The SystemType property indicates the type of system running on the Win32 computer./nConstraints: Must have a value",
        "PortalSymbolicName",
        "CR_1E1CD952E598C3858F01E05DCEB6E0FDDB93A88BD0100C8466601561A5B05EFB",
        "MSNdis_StatusMediaDisconnect",
        "Win32API|File Installation Library Functions|GetFileVersionInfo",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_C5A1AE4D66D54DE31BD0DB67526AE9F7258CD2800AEF5AF0F2B6F67014B52345",
        "PauseAfterReset",
        "CIM_NumericSensor.UnitModifier",
        "Siemens",
        "Specifies the Permissions that are allowed. The permissions are a combination of one or more of the following:WINSTATION_QUERY, WINSTATION_SET, WINSTATION_RESET, WINSTATION_VIRTUAL | STANDARD_RIGHTS_REQUIRED, WINSTATION_SHADOW,WINSTATION_LOGON, WINSTATION_LOGOFF, WINSTATION_MSG, WINSTATION_CONNECT,WINSTATION_DISCONNECT.",
        "11018",
        "OpenPolicy",
        "The InprocHandler32 property contains the full path to a 32-bit custom handler for the COM component.",
        "EPROM",
        "Bad Option",
        "Number of succeeded non-AAAA queries",
        "{1256F140-6095-4722-A2C4-B5E3D47F1690}",
        "ClasspnpGuid",
        "\\\\.\\ROOT\\CIMV2:__Win32Provider.Name=\"Win32_OfflineFilesProvider\"",
        "_DH_WMP_SYNC Flag",
        "QuiesceDevice",
        "0xEFFF0042",
        "HOSTPROC_RESERVED_1c",
        "This device is not working properly because there is probably a re-enumeration problem.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1333.1020230547.336",
        "NotConnected",
        "MsftDiscFormat2RawImage_DebugAddRef",
        "Bid2Etw_ODBC_1",
        "IPv4AddressPortPool",
        "The Compress method compresses the logical file (or directory) specified in the object path. Compress returns an integer value of 0 if the file was successfully compressed, and any other number to indicate an error./nIt returns one of the following integer",
        "If set to TRUE then cleanly cease all activity, if FALSE resume activity.",
        "HardwareErrorCorrection",
        "The total number of excess folder fragments on the volume.",
        "The Win32_DCOMApplicationSetting class represents the settings of a DCOM application. It contains DCOM configuration options associated with the AppID key in the registry. These options are valid on the components logically grouped under the given application class.",
        "Names of outbound interfaces",
        "This contains a Corrected Platform event",
        "The name of the provider",
        "The name of the printer driver associated with this printer.",
        "ref:Win32_PhysicalMedia",
        "Example: 2649024",
        "Localized version of RSOP_PolmkrFileTypesSetting for American English",
        "The CIM_ActsAsSpare association indicates which elements can spare or replace the other aggregated elements.  The fact that a spare can operate in \"hot standby\" mode is specified on an element by element basis.",
        "ReportSetmarks",
        "Select * from Win32_DeviceMemoryAddress",
        "C_D353A723558494456907934904E2EEA7D4159B1627D44F40729031ACBDED0D25",
        "Associates a network port with its SRIOV VF data.",
        "IL_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.293.3106448493.356",
        "A link between BIOS feature and its aggregated BIOS elements.",
        "Represents a storage rack in a data center.",
        "Win32_SubDirectory",
        "Win32_BIOS",
        "BRIEF",
        "WdmInterface",
        "0X10000000",
        "Win32API|Service Functions|StartService",
        "MaxPendingConnections",
        "AllowUpdateComplianceProcessing",
        "This property contains the local workstation SID",
        "If set to true: interrupts are permitted for hard mounts. If set to false: interrupts are ignored for hard mounts.",
        "OtherGroupId",
        "Reads printer connection data from the next NFC tag tapped against the system\\'s default NFC reader.",
        "Win32API|Network Management Structures|SERVER_INFO_101|sv101_type|SV_TYPE_SERVER",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1480.2002022883.180",
        "MDM_Policy_User_Result01_Authentication02",
        "{8502C533-5FBB-11D2-AAC1-006008C78BC7}",
        "Win32API|Device Context Functions|GetDeviceCaps",
        "IPv4ReceiveTcpOptionsSupported",
        "ConfigureWebcamAccessDomainNames",
        "NextWritableAddress",
        "SoftwareFeatures and SoftwareElements: A 'SoftwareFeature' is a distinct subset of a Product, consisting of one or more 'SoftwareElements'. Each SoftwareElement is defined in a Win32_SoftwareElement instance, and the association between a feature and its SoftwareFeature(s) is defined in the Win32_SoftwareFeatureSoftwareElement Association.  Any component can be 'shared' between two or more SoftwareFeatures. If two or more features reference the same component, that component will be selected for installation if any of these features are selected.",
        "To indicate that direct MAC Wake-On-LAN patterns should be turned on.",
        "SaIdleTime",
        "Digital Power Line",
        "ExtendedPrinterStatus",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.3789313510.368",
        "Warning Flag",
        "MIB.IETF|HOST-RESOURCES-MIB.hrSystemProcesses",
        "Mode of configuration.",
        "UCRLength",
        "Write errors not corrected by the storage device.",
        "Win32_LoadOrderGroupServiceDependencies",
        "Data Center",
        "Process Wake Events",
        "RedirectionOptions",
        "MSFT_DSCConfigurationOutputWriteError",
        "DiskIo_V1",
        "CIM_LogRecord",
        "PeerSubsystemName",
        "supportedLDAPVersion",
        "This property is deprecated, please use MaxCapacityEx",
        "SMBIOSGuid",
        "MIF.DMTF|Volume Set|001.5",
        "IPsecExempt",
        "DfsEntryPath",
        "KEY_QUERY_VALUE (0X0001) ",
        "DMTF|ComponentID|001.4",
        "The Win32_SystemPartitions class represents an association between a computer system and a disk partition on that system.",
        "Removes DNS client NRPT rule",
        "AdminLocked",
        "The prefix length for the IPv6 address of this Protocol Endpoint, if one is defined.",
        "BackgroundSyncWorkOfflineSharesEnabled",
        "object:ISCSI_TargetPortal",
        "GenuineStatus",
        "I_171DF71ABD7C6A7DF03D4AFA73A2CE1BA658B66016A9DF4DAB148F781BE2851A.1019.286285166.420",
        "In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier.",
        "The TcpipNetbiosOptions property specifies a bitmap of the possible settings related to NetBIOS over TCP/IP.",
        "lvalue",
        "TreatHostAsStableStorage",
        "Specifies the print queue to delete the job from.",
        "// A cookie is a value contained in a received IKE message that is used by IKE to find the state of an active main mode. A cookie in a received IKE message that cannot be matched with an active main mode is invalid.",
        "MSLSATrace",
        "alternatePhoneNumbers",
        "Jammed",
        "__ListOfEventActiveNamespaces",
        "MSFT_NetEventVmSwitchProvider",
        "C:\\Windows\\System32\\drivers\\en-US\\mssmbios.sys.mui[MofResource]",
        "An ordered array of strings representing the order of boot sources.",
        "Number of supported MAC addresses per port.",
        " 256 bytes in length, so the value of this parameter should be a multiple of 256. Multiple buffers are chained together for larger packets. The IP header for a packet is stored separately. This parameter is ignored and no buffers are allocated if the IP router is not enabled. The buffer size can range from the network MTU to the a value smaller than 0xFFFFFFFF. Default: 74240 (fifty 1480-byte packets, rounded to a multiple of 256).",
        "CIM_RemoteFileSystem",
        "parameters",
        "The identifier by which the ralated object is known.",
        "CIM_LogRecord.RecordData",
        "The maximum number of items allowed in a serialized object.",
        "MSFT_WdacBidTrace",
        "CertValidationLevel",
        "PCI_BUS_TARGET_ID",
        "CodeIntegrity",
        "ValidateAliasNotCircular",
        "TRACE_VERBOSE",
        "FRUNumber",
        "revolutions per minute",
        "Login Failed",
        "Example: GenuineSilicon",
        "MIF.DMTF|Parallel Ports|003.8",
        "NdisFddiRingDirected",
        "WorkflowRuntimeBehavior",
        "R_B9D58526785010F225A5B7C3571EBE488D29C0DEC319541C93BE914E77155B6C",
        "CD_BC68F03B4B8F91EBABF0C9EFED9C57ABF605182A4D8760A0679947CF4F1C5F19.1829.2435593048.463",
        "NdisRingStateClosing",
        "AuthenticationTransformConstants (uint32)",
        "MSFT_NetRoute object.",
        "MSFT_Disk.ObjectId",
        "EVENT_TRACE_FLAG_ALL",
        "CIM_MemoryMappedIO",
        "I_11E7CFD2E458F6C890E351AC0A37FC5E0C06A7839AF030746D343DE6FF14B8AB.2705.3966710648.303",
        "urnValue",
        "ThreatStateNotifications",
        "Default White CIE coordinates",
        "CD_12706E8B04FEE8F3D76199B384B2FE632A6036284472947E8464FF115D49DB77.2609.1563168971.3438",
        "NdisFddiTypeLocalA",
        "CIM_Memory.ConsumableBlocks",
        "// This class must be registered with PDO instance names using a single instance",
        "CR_920782A19D0C199BDC99CD6BCD549187886CE3AD64D29AEC0D7E3B1ED7356A9A",
        "ProcessInitDone",
        "CreateListReplica",
        "The QuotaPeakNonPagedPoolUsage property indicates the peak quota amount of non-paged pool usage for the process./nExample: 31",
        "IsPrivate",
        "ActionDelay",
        "NormalMax provides guidance for the user as to the normal maximum range for the numeric sensor.",
        "A masking set is a collection of virtual disks, target ports, and initiator ids that are used for bulk Show and Hide operations. When a resource is added to a masking set it is made available for access to all other resources in the masking set. For example, adding a virtual disk object to a masking set will allow all initiator IDs in the masking set to access the virtual disk object.",
        "ref:MSFT_NetApplicationFilter",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|BlindOff",
        "LPCDRVR_TRACE_RESERVED_1c Flag",
        "The PeakPageFileUsage property indicates the maximum amount of page file space  used during the life of the process./nExample: 102367",
        "MSFT_NetAdapterAdvancedPropertySettingData",
        "CD_33D246EB3B57E6928B893AD6FD55D978AB60895C15739A40D6B9E85119ED3D71.265.4268454207.573",
        "Values: TRUE or FALSE. A value of TRUE indicates parity checking can be set.",
        "Bus master latency",
        "The MediaType property defines the particular type of media through which transmission signals pass. Common network media include twisted-pair (value=11 or 12), coaxial (7, 8 or 9) and fiber-optic cable (10).",
        "VendorSpecific3",
        "Number of layer 2 frames sent for all outbound RDMA traffic",
        "AuthenticationTransformConstants",
        "0x00000001 - Indicate the profile is a temporary profile, it will be deleted at user logoff.",
        "FreeSpaceWiped",
        "The UncompressEx method uncompresses the logical file (or directory) specified in the object path. UncompressEx returns an integer value of 0 if the file was successfully decompressed, and any other number to indicate an error. UncompressEx is an extended version of the Uncompress method./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n",
        " Starts the service during the StartServices action.",
        "CIM_LANEndpoint.LANType",
        "Indicates whether to use proxy servers to for internet connections.",
        "RD_TRACE_RESERVED_13",
        "The property SNMPDevIndex indicates the SNMP index number of this device for the SNMP agent.",
        "C:\\Windows\\System32\\drivers\\en-US\\ACPI.sys.mui[ACPIMOFResource]",
        "StackBase",
        "Memory partition level",
        "WPD_F3",
        "CD_2AC62F8FBDE5396DE0E714628FC5276EAD8299E75B3476107B0361922E630658.1196.3333194408.3096",
        "OpenTrustedDomain_End",
        "PoolTag",
        "ObjectPortNumber",
        "Element Missing",
        "Note that HKEY_DYN_DATA is a ",
        "TotalWidth",
        "Other",
        "00000000000000.000000:000",
        "Maximum log size in bytes supported for replication.",
        "The OEMUrl property provides a world wide web link to the printer manufacturer's web site.  Note that this property is not populated when the Win32.INF file is used and is only applicable for drivers provided directly from the manufacturer.",
        "RSOP_IEProgramSettings",
        "Example: 15 ",
        "Win32API|GetPrivateProfileSection|Operating Systems",
        "CD_DF35CAA9032B2BC8E9E68BEFAD5091A66EF205D46DBC51F13F62EC987E8BBEAC.293.1435625100.652",
        "ExpandedString",
        "REDBOOK_WMI_NUMBER_OF_BUFFERS",
        "100 - DHCP not enabled on adapter",
        "DetectedErrorState",
        "The Win32_PrinterDriverDll class represents the association between a local printer and its driver file.",
        "Indicates whether to automatically close a session when a client closes an output session.",
        "AllowAddressBarDropdown",
        "object:MSFT_NetNeighbor",
        "C_D56193964E51CF773304523DD4D95B2AA6C5D33866F47DB7D43681D0C19210B9",
        "Hash algorithm to use in AH.",
        "HBA_LUID",
        "ServerList",
        "MSFT_InitiatorPortToiSCSIConnection",
        "MsftDiscFormat2StreamRandom_DebugGeneral Flag",
        "0xEFFF004A",
        "MSFT_DSCMetaConfiguration",
        "PNP_REGISTRY_INFO_LEVEL",
        "X4m;X4m;",
        "Maximum number of mount failure retries allowed.",
        "FriendlyName is a user-friendly name of the masking set. It is specified during the creation of the masking set, and can be changed using the SetFriendlyName method.",
        "object:MS_SMHBA_SCSIENTRY",
        "AllowLocalIPsecRules",
        "    <registryKey keyName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\InstallService\\Configuration\">",
        "IsInstalled",
        "Win32_TSSessionDirectory",
        "ClearAllAutoUnlockKeys",
        "NdisReceiveError",
        "Power PC 603+",
        "{2E2D2463-B537-4da7-8EEE-51306F1F482F}",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|IPFilterSecurityEnabled",
        "17 - MNS Logon Account - MNS locon account type that represents a MNS user. ",
        "49002",
        "Win32_JobObjectStatus",
        "The DeleteEx method will delete the logical file (or directory) specified in the object path. DeleteEx returns an integer value of 0 if the file was successfully deleted, and any other number to indicate an error. DeleteEx is an extended version of the Delete method./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n",
        "This class describes a mapping from a an OS LUN to target device LUN",
        "EncryptData",
        "WMI|Win32_BIOS",
        "The DisplayFrequency property indicates the display's vertical refresh rate. The refresh rate for a monitor is the number of times the screen is redrawn per second (frequency).  ",
        "SRIOV VPort settings for a network adapter",
        "The expiration time for the WNS channel",
        "This method allows a user to modify the default values for this resiliency setting.The updated values will take effect only for subsequent virtual disk creations and are not retroactively applied.",
        "Deduplication is not enabled for the volume",
        "CIM_MediaPresent",
        "Dma64BitSupported",
        "SETTINGSMODIFIER",
        "The AdapterCompatibility property specifies the name of the manufacturer of the adapter.  This name can be used to compare the compatibility of this device with the needs of the computer system.  ",
        "VideoInputType",
        "    TunnelType (string) Specifies the VPN Tunnel Type in the VPN Connection profile. Available values: Automatic, Pptp, L2tp, Sstp, Ikev2",
        "Command being run on the key, or value.",
        "SkipFolderCycle",
        "Sizes of each tier",
        "CreationClassName",
        "WINSTATION_RESET=0x4",
        "- The third sub-string is a variant, which is vendor specific. ",
        "Specifies the property values of the ODBC driver to be deleted. This is an array of keys to be removed.",
        "Software Bundle",
        "This property returns whether the 'Sync settings over metered connection' option under 'Change Settings' is turned on",
        "MaxSessionSize",
        "ConnectionName",
        "PrintJob",
        "A text string set by the manufacturer describing the option rom version of adapter",
        "Defer target/system reset",
        "IPAddrV4",
        "The TakeOwnerShip method obtains ownership of the logical file specified in the object path . If the logical file is actually a directory, then TakeOwnerShip will act recursively, taking ownership of all the files and sub-directories the directory contains. /nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n",
        "The ShowWindow property specifies how the window is to be displayed to the user.",
        "object:ExtendedProtectionPolicy",
        "Subject",
        "IKEAction specifies the parameters to use for an IPsec IKE phase 1 negotiation.",
        "Enables or disables logging off an administrator who is logged on to the console.",
        "RSOP_IEConnectionWinINetSettingsLink",
        "The local tunnel endpoint address.",
        "This enables timer traces",
        "Check if UEV is enabled.",
        "VirtualDiskSizeMin",
        "VolumeName",
        "AntiVirusSignatureStatus",
        "Example: 75",
        "MinimumPINLength",
        "Wallpaper",
        "TOOLBAR",
        "Win32_RoamingProfileMachineConfiguration",
        "An association between a job destination and a system on which it resides. The cardinality of this association is 1-to-many.  A system may host many job queues. Job destinations are weak with respect to their hosting system. Heuristic: A job destination is hosted on the system where the logical devices, software features or services that implement/provide the job destination are located.",
        "A string describing the operating system's version number. The format of the version information is as follows: <Major Number>.<Minor Number>.<Revision> or <Major Number>.<Minor Number>.<Revision Letter>.",
        "C_688EDFFAE1CD3706709D790A6046157BB8A78E3308174A187E2C588BBB236985",
        "The ExpandedMiniDumpDirectory property is an expanded version of the MiniDumpDirectory property. ",
        "Acquire For Mod Write",
        "PortSpecificAttributesSize",
        "Supplies the TCP source port number of the SYN packet.",
        "NetWare",
        "ifHCOutBroadcastOctets",
        "#define HBA_REGISTRY_BINDING_RELATIVE_PATH  L\"System\\\\CurrentControlSet\\\\Control\\\\Storage\\\\FC\"",
        "#define ISCSI_SECURITY_FLAG_AGGRESSIVE_MODE_ENABLED  0x00000008",
        "IMAPI2 Write Engine",
        "Array of bytes containing the security descriptor associated with this GPO in self-relative format.",
        "{791ad19c-e35c-11d0-9692-00c04fc3358c}",
        "RSSEnabled",
        "Setting source",
        "THREADS Flag",
        "DitherType",
        "NISSignatureLastUpdated",
        "A user settable description of the fault domain object.",
        "C_B25DA333436380B14065F5CAF15967BBB759113E2ED71069E1E95253766795D5",
        "The file identifier specified is not valid on the volume.",
        "ref:CIM_DirectoryAction",
        "A method for adding the package signing certificate",
        "CIM_VoltageSensor",
        "MSDAPRST",
        "NumericSensorOtherSensorTypeDescription",
        "SOAPTraceListener",
        "MSiSCSI_LB_ROUND_ROBIN_WITH_SUBSET",
        "The monitor resolution associated with the desktop monitor.",
        "object:MSFT_SmbClientConfiguration",
        "Whether to turn on receive segment coalescing. One of the following values:  - Disabled  - Enabled",
        "ScanMode",
        "y71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "The name of the port.",
        "The Antecedent reference represents the existing slot(s) of the hosting board, or frame that are being adapted to accommodate a card that would otherwise not be physically and/or electrically compatible with it.",
        "AttackSurfaceReductionOnlyExclusions",
        "SDBUS_DEBUG_PNP Flag",
        "rg/200",
        "CD_EA9A1A204A0FA59819F57AD1F744E0CAB4BE1F06A46B3D439B85E87A7B3A09A6.2033.1803082927.243",
        "As an example use: If a parameter named \\'CompanyURL\\' has a value of \\'www.DMTF.org\\' and the value of AccessInfo was \\'http:\\${CompanyURL}\\', then the resultant URL is intended to be \\'http:\\www.dmtf.org\\'.",
        "R_D353A723558494456907934904E2EEA7D4159B1627D44F40729031ACBDED0D25",
        "Current working directory path",
        "LineBasedInterrupts",
        "The remote computer system's (i.e., the NFS File 'Server's) UDP port number.",
        "Dithering with a fine brush",
        "Specifies the Internet newsreader program you want to use with Internet Explorer.",
        "32772",
        "SystemConfig_V3_MobilePlatform",
        "BitsPerByte",
        "If FALSE or NULL, this method will follow default WMI asynchronous behavior as determined by the client's method for invocation (i.e. synchronous unless requested otherwise).",
        "ProtectKeyWithTPMAndPIN",
        "SupportsReplicationGroup",
        "EnableSMB1Protocol",
        "The position of this  job in the print queue.",
        "The MemoryType property indicates the characteristics of the memory resource on the system.",
        "CIM_MediaAccessDevice.Capabilities",
        "3..32767",
        "Capabilities and management of the Printer LogicalDevice.",
        "Priority indicates the urgency or importance of execution of a thread. A thread may have a different priority than its owning process. If this information is not available for a thread, a value of 0 should be used.",
        "WLANScanMode",
        "MSFT_CliAlias.FriendlyName=\"PortConnector\"",
        "iSCSI Session class",
        "FSCTL_IS_VOLUME_DIRTY",
        "{4C8A0917-F587-4ecf-9C89-48147528F4E1}",
        "DataContractSerializerOperationBehavior",
        "MIF.DMTF|Temperature Probe|001.9",
        "object:MSFT_NetAdapter_ProcessorNumber",
        "Win32API|_beginthreadex",
        "SetLaunchSecurityDescriptor",
        "Designated-Long-Envelope",
        "MSFT_HealthAction",
        "This output parameter contains the maximum size that this partition can become.",
        "Crusoe(TM) TM3000 Family",
        "ref:Win32_PowerSettingDefinition",
        "Invalid Argument",
        "Unlock",
        "EVENT_TRACE_FLAG_CSWITCH",
        "ref:CIM_ManagedSystemElement",
        "//  iscsimgt.h",
        "Display transfer characteristic (100*Gamma-100)",
        "ServerURL",
        "Sense Key Specific",
        "Win32DLL|NTDLL.DLL|NtQuerySystemInformation|SystemPageFileInformation|PageFileName",
        "The Smart Battery Data Specification version number supported by this battery. If the battery does not support this function, the value should be left blank.",
        "The StringParameter property is currently always NULL.",
        "AddByExistingPort",
        "Library Loader Security Search Event",
        "CD_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB.0.1436577077.762",
        "CompressionInfo",
        "MSNdis_CoVendorDriverVersion",
        "Example: 7.",
        "Module Index",
        " Type of service ",
        "AllowWindowsSpotlightOnActionCenter",
        "{4C3A040A-E3D1-11d2-8601-0000F8102E5F}",
        "IoTimerEvent",
        "This class provides methods for activating sideloading of LOB applications",
        "SelfEncryptionDriveEncryptionMethod",
        "{684c1fef-3c76-4147-b214-e9aa061a7564}",
        "The Dependent represents another physical connector that serves as the other end of the connection.",
        "StoreLocation",
        "Localized version of RSOP_PolmkrPortPrinterSetting for American English",
        "Math Processor",
        "GetPeerSystems can return access points",
        "Identifies the session",
        "MSFT_NetAdapter_RdmaStatistics",
        "Status bitmask",
        "Operational",
        "WMI_TAPE_PROBLEM_IO_ERROR",
        "Interactive Process",
        "User can set this property to false to prevent roaming, then the profile will work like a local profile.",
        "SMBIOS|Type 18|32-bit Memory Error Information|Vendor Syndrome",
        "The Dependent property is a reference to CIM_DataFile which represents the binary file associated with the PnP driver ",
        "volts",
        "TS_TRACE_LEVEL_NRM Flag",
        "Defines how to evaluate the existence of the destination file.",
        "ScansOutOfDate",
        "57000",
        "IKE Authentication Information",
        "State",
        "Configure",
        "ref:MSFT_StorageSubSystem",
        "The previous self-test routine completed without error or no self-test has ever been run",
        "SensorReading",
        "MSFT_CliAlias.FriendlyName=\"NetUse\"",
        "SMBIOS|Type 18|32-bit Memory Error Information|Error Operation",
        "48013",
        "BootFromDisk",
        "Win32API|Performance Data Structures|PERF_OBJECT_TYPE|UserTime",
        "Non-Interlaced Operation",
        "The Win32_TapeDrive class represents a tape drive on a Win32 computer.  Tape drives are primarily distinguished by the fact that they can be accessed only sequentially.",
        "C_FCF416010D567B5041BC82F46732C142DC125B68750168BA980728F3E2F25AEF",
        "MsftDiscFormat2MsfAddress_DebugGeneral",
        "SM_GetSASPhyAttributes",
        "The full description of the action.",
        "Transmitter Failure",
        "MDM_Policy_Config01_LockDown02",
        "EmbeddedControllerMinorVersion",
        "R_5D2BB5E72A2F48A448D0C78E4EF523FCA37E91EFD1ED92B23F38B836649C78DA",
        "CategoryDiscriminant",
        "Internet Call Program",
        "CIM_FileSystem.CreationClassName",
        "AllowOneWordEntry",
        "IP Phone",
        "PolicySourceClientWallPaper indicates whether the property ClientWallPaper is configured by Server (0),Group Policy (1), Default (2).",
        "STORAGE_FAILURE_PREDICT_FUNCTION",
        "%Comment%",
        "This parameter indicates the provisioning type to be used by default when creating a new virtual disk on this storage pool. If no default is specified, the default is inherited from the primordial pool.",
        "Foot-Pounds",
        "RestartJobByPrinterObject",
        "DomainLocationDeterminationURL",
        "AsynchronousSendEnabled",
        "Credential",
        "TcpIp_V1_Fail",
        "Values: TRUE or FALSE. If TRUE, then a pre-allocated heap with the size of LastStartupHeapPreallocation is created when WMI is initialized.",
        "\\\\.\\Root\\Default:__Win32Provider.Name=\"RegProv\"",
        "RcvAuthorizationState",
        "HBA_SCSILUN",
        "\\\\.\\Root\\cimv2:__Win32Provider.Name=\"RegPropProv\"",
        "Computer system product information from SMBIOS. ",
        "PLATFORM_TRACE_RESERVED_1e",
        "The laptop that is 'docked'.",
        "Fully qualified path name for the log file. If file does not exist, it will be created. If directory does not exist, file will not be created.",
        "MyKey",
        "RotateRecoveryPasswordsStatus",
        "Maximum Speed of network link in megabits per second.",
        "C_284916CD952AAE32B075C2CF9D6353A3004441F29529D83865782726D8CFD589",
        "DllDir",
        "Values: TRUE or FALSE. A value of TRUE indicates interval timeouts are supported.",
        "The remote QoS settings currently reported by the network adapter's link peer.",
        "PathId",
        "ISCSI_ConnectionStaticInfo",
        "HostedCacheServerConfiguration",
        "MIF.DMTF|Power Supply|004.17",
        "AddLSToSpecifiedLicenseServerList",
        "Win32_PnPDevicePropertyStringArray",
        "server",
        "ovider\"",
        "The BitsPerByte property indicates the number of bits transmitted and received for each byte of data for the Win32 serial port. The number may vary with control and error correction bits, such as parity bits.",
        "Passes the object created by this cmdlet through the pipeline. By default, this cmdlet does not pass any objects through the pipeline.",
        "Flags 1",
        "Limit Die On Unhandled Exception",
        "ObjectId for internal use only.",
        "C_86E4399BC4DD7BCA81C24CBCF67DD3AC1AB2674904D37AD60CB8F1387993FF14",
        "0xC0050078",
        "MI_ERRORCATEGORY_OBJECT_NOT_FOUND",
        "The order or precedence in which this Policy Object is applied.The winning policy is contained in the Policy Object whose precedence is 1. Precedence greater that 1 means that the policy contained in this Policy Object is a conflicting value that did not 'win'.  ",
        "CIM_ManagedElement",
        "WHERE EventType=#",
        "object:MSFT_WdacBidTrace",
        "SAM Get Display Enumeration Index",
        "IPv4 address of the server virtual ip. Not applicable if running as teredo client.",
        "Returns the trigger properties of a VPN connection",
        "Events per second",
        "MSVDS__PROVIDER",
        "The DSCP action. Set to -1 if not used.",
        "SupportsQuotas",
        "Example: L1.",
        "CD_7AD87B163E5F080E34E60018A0634DBE95115F38F1BC264D0B548D7507D9109E.1638.267618327.1344",
        "{e53e0a7d-36f0-4a77-879e-9c6b5e4a8554}",
        "_DH_PLAYER_FULLSCREEN Flag",
        "DesiredStorageTierFriendlyName",
        "CIM_LogicalDevice.OtherIdentifyingInfo",
        "Shutdown_ClearVirtualMemoryPageFile",
        "WSAT Trace Event",
        "EnableByName",
        "{9FA9C28B-5E5C-4035-A5F8-67D4554F8D04}",
        "C_4BBA71B8B969B6626A0E7F60779736282C60AEC40553354F5884C7B9E51AF36A",
        "MCA_INTERNALTIMER_ERROR",
        "Congestion",
        "CR_A68B01B18C25C8BFC9B36419B9B64DB698A481D87C42ADCA7EC744307E0456D7",
        "DNS namespace which can be a Suffix/Prefix/FQDN/Subnet.",
        "Requests a reset of the LogicalDevice. The return value should be 0 if the request was successfully executed, 1 if the request is not supported and some other value if an error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier.",
        "NewPassPhrase",
        "This combination of parameters is unsupported.",
        "Retrieves one or more installed ODBC drivers from the system.",
        "EnforceLockScreenAndLogonImage",
        "CD_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416.1520.1390676603.369",
        "RedirectSmartCards",
        "QryInfoTrustDom",
        "NoPinningToTaskbar",
        "CIM_Error.ErrorSource",
        "IPV6 Address",
        "PolicySourceIdleSessionLimit indicates whether the property IdleSessionLimit is configured by Server (0),Group Policy (1), Default (2)",
        "{2306fe2e-dbf6-11d2-9244-006008269001}",
        "ATM Adaptation Layer 2",
        "CIM_Printer.CapabilityDescriptions",
        "Unavailable Resource Error",
        "This represents a locate device element.",
        "SupportedReplicatedPartitionFeatures",
        "Count of the indeterminate errors. ",
        "DisableAutoExclusions",
        "ForwardBufferMemory",
        "IsShadowCopy",
        "The Boot SAP hosted on the unitary computer system.",
        "DesignVoltage",
        "R_AAEDA1FD61325BC0D86B140D66A91281FE871D9B4FBF60BD8537F2A662C67E1B",
        "Cluster size is beyond 32 bits",
        "Association between StorageNode and StorageEnclosure",
        "Used by Third Party VPN plugins to specify custom configuration",
        "2 - 'Fixed' indicates that the storage tier's capacity is fully allocated upon creation. ",
        "{86460B6B-E709-11d2-B139-00105A1F77A1}",
        "Number of ACPI processor idle states",
        "This class exists for backward compatibility to earlier CIM Schema definitions. With additions to Sensor and NumericSensor in V2.2, it is no longer necessary. A TempertatureSensor can be defined by setting the SensorType property, inherited from Sensor, to 2 (\"Temperature\"). Other properties of this class are hard-coded to constant values to correspond to definitions in the sensor hierarchy.",
        "CheckAccess",
        "TP_V2_CBDequeue",
        "Level 0",
        "The position of this physical memory in an interleave. 0 indicates non-interleaved. 1 indicates the first position, 2 the second position and so on. For example, in a 2:1 interleave, a value of '1' would indicate that the memory is in the 'even' position.",
        "EnumerateLocalUsersOnDomainJoinedComputers",
        "WPD ShellExtension Trace",
        "HomeNet",
        "Unregister all settings location templates.",
        "NumberOfColumns",
        "Device level",
        "24 - The service is currently paused in the system.",
        "CD_A7E164E66BC7BA8FC3752641961C8B1829E354DA32CDE974E0423F3F5730EDE5.41.1053461887.474",
        "ScsiPortNumber",
        "autoDialFunction",
        "The associated ODBC driver name.",
        "RTLostEvent",
        "engine",
        "OptionROMVersion",
        "Small memory dump",
        "MSNdis_AtmMaxAal5PacketSize",
        "{4333BD60-E3D1-11d2-8601-0000F8102E5F}",
        "NUUUUUUUU",
        "S-1-1-0",
        "The Domain property indicates the name of the domain to which the computer belongs.",
        "Indicates if a connector is present on the network adapter. This value is set to TRUE if this is a physical adapter or FALSE if this is not a physical adapter.",
        "PrefixOrigin",
        "Class that represents client-side extensions' event log message sources",
        "ALPC_Wait_For_New_Message",
        "The network adapter driver date in YYYY-MM-DD format.",
        "Not enough available capacity",
        "The VariableValue property contains the placeholder variable of a Win32 environment variable. Information like the file system directory can change from machine to machine. The operating system substitutes placeholders for these.",
        "F666E21555D2DB9537A0D6F20293E6715D",
        "second",
        "The Priority parameter specifies the new priority class for the process.  Values:",
        "TEST_TRACE_RESERVED_11 Flag",
        "Smart Battery",
        "The association of subjects (Roles and Identities) to Privileges is accomplished using policy or explicitly via the associations on a subclass. The entities that are protected (targets) can be similarly defined. ",
        "CIM_CreateDirectoryAction",
        "The Win32_NamedJobObjectLimitSetting class represents the limit settings for a job object. The limit settings specify the resources available to the job in accord with how the limit setting flags are set.",
        "SilentMode",
        "EnableFirewall",
        "The output is an array of CIM objects of type MSFT_OdbcDriver, each of which represents an ODBC driver.",
        "ScriptingStandardConsumerSetting",
        "The logical device to which the resource is assigned.",
        "EnableFastFirstSignIn",
        "WHERE Name='#'",
        "ref:CIM_DataFile",
        "NumOfMonitorSourceModes",
        "LogFlagDownload",
        "NTLM V2 Flag",
        "ServiceThrottlingBehavior",
        "ISCSI_INFO_RECONNECTED_TO_TARGET",
        "SupportsExplicitShutdown",
        "61CB66FFED0CC4B21B88F0",
        "TR_RPC Flag",
        "LUAInstall: error 0x00000005 setting flags [{72C97D74-7C3B-40AE-B77D-ABDB22EBA6FB}]",
        "CIM_PCIController",
        "Multi-Bit Error",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmDisplayFlags ",
        "{7A9E24ED-E3D2-11d2-8601-0000F8102E5F}",
        "A rack is a physical frame that represents an enclosure in which chassis are placed. Typically a rack is nothing more than the enclosure, and all the functioning components are packaged in the chassis, loaded in the rack.",
        "The design capacity of the battery in milliwatt-hours. If this property is not supported, enter 0.",
        "NtlmServerAccept",
        "Candelas",
        "Firmware Revision",
        "Win32API|Communication Structures|DCB|EofChar",
        "The authentication mode for hosted cache clients",
        "0x40050070",
        "Identifier",
        "Unable to create the destination path.",
        "R_BFFEDA03FDD0EDDDBE7B9391DA27C88AE2463D26F7B40B37D530B4319B353DCE.1635.583430141.560",
        "Computer ID created by MAPS",
        "MSNdis_WmiTcpIpChecksumOffload",
        "NumberOfBuffers*SectorsPerRead*2352 is the amount of memory used to reduce skipping.",
        "O:BAG:BAD:(A;;0x1;;;BA)(A;;0x1;;;NS)",
        "3221232474",
        "1000Base-CX",
        "ReadTransferCount",
        "PolicySourceSessionDirectoryClusterName indicates whether the property SessionDirectoryClusterName is configured by Server (0) or Group Policy (1).",
        "Detection Source Type ID - Enumeration",
        "R_DA629F0FADBF1E9D6C65713F31978C9EA30680E880B4ED8EDE3DC7BD5AFDAA23",
        "A text string set by the manufacturer describing the version of adapter",
        "MaximumLsoVersionSupported",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|DefaultTTL",
        "TimerDPC",
        "A channel binding token used when authenticating clients.",
        "MaximumWorkingSetSize",
        "ResolutionInterval",
        "Removable Sides",
        "The DeviceID property indicates the number that uniquely identifies this device with other peripherals using the Plug and Play BIOS. This property is derived from CIM_LogicalDevice.",
        "The Compression property specifies whether hardware data compression is enabled or disabled.",
        "The StatusInfo property indicates whether the Logical Device is in an enabled (value = 3), disabled (value = 4) or some other (1) or unknown (2) state. If this property does not apply to the LogicalDevice, the value, 5 (\"Not Applicable\"), should be used. StatusInfo has been deprecated in lieu of a more clearly named property with additional enumerated values (EnabledState), that is inherited from ManagedSystemElement. ",
        "// Flags that define the functionality supported by the HBA",
        "CIM_PhysicalComputerSystemView.StructuredBootString",
        "PendingOfflineScan",
        "AgentDomain",
        "Win32_Refrigeration",
        "Local - Directly connected to this computer.",
        "The RawOnly property indicates whether the printer accepts only raw data to be spooled.",
        "Zero-terminated string describing the NIC.",
        "Storage Virtualizer",
        "MSFT_MpThreatDetection",
        "KI_7010B213179D98B16AF38723EE1D750E86F808F341EE215AD8783D29EA117262",
        "The SCSITargetId property indicates the SCSI ID number of the CD-ROM drive.",
        "EnableByInputObject",
        "TR_WIZ Flag",
        "6E036713C798F9F1CC163773CF7693F41C4A2ACF1A7DC2B900BA8E73F.1807.3210342868.590",
        "dnsConfig",
        "tickCount",
        "AccountLogonLogoff_AuditIPsecMainMode",
        "{01d925f1-cf6a-4352-8aac-b139b1a80cb4}",
        "The TcpipNetbiosOptions property specifies a bitmap of the possible settings related to NetBIOS over TCP/IP. Windows 2000 only.",
        "FrameworkVersionActual",
        "AllowAadPasswordReset",
        "MultiBus",
        "The owner of this policy.",
        "Supports GUID Partition Table",
        "Win32Registry|Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards|Manufacturer",
        "IL_BA2B64DEBCEAD4B5E79E8DFCDA9F0F1222A0566FE820AF52659088247BFF8F7C.311.1988916545.249",
        "TempProfileLogonBlocked",
        "The PartComponent reference represents the Win32_DiskPartition containing the properties of a disk partition that exists on the computer system.",
        "RD_TRACE_RESERVED_12 Flag",
        "Specifies whether printer jobs in the queue should be kept after spooling.",
        "ProcessHandle",
        "Interval time-outs supported",
        "Disk performance statistics",
        "17 - 'Completed': The volume has completed an operation. This status value should be combined with OK, Error, or Degraded, depending on the outcome of the operation.",
        "The Win32_CDROMDrive class represents a CD-ROM drive on a Win32_ComputerSystem. ",
        "LockedDownRestrictedSitesZoneAllowScriptlets",
        "The high voltage of input voltage range 1 for this power supply, in millivolts. A value of 0 denotes 'unknown'.",
        "WorkerThread_V1",
        "C_B9D58526785010F225A5B7C3571EBE488D29C0DEC319541C93BE914E77155B6C",
        "UdpIp_TypeGroup2",
        "IsDefault",
        "The DeviceName property specifies the friendly name of the printer.  ",
        "MDM_Policy_Result01_Connectivity02",
        "RootDSE",
        "Indicates if Replication Groups is supported",
        "The AuthenticationLevel property specifies the minimum client authentication level required by this COM server. If NULL, the default values are used. Authentication levels include:",
        "{0e85a5a5-4d5c-44b7-8bda-5b7ab54f7ea0}",
        "Teredo tunnel interface",
        "DA Site table entry",
        "Suspended Blocked",
        "{B674D32B-6214-435F-A8BB-14B8F306BDBD}",
        "0xEFFF0031",
        "NDIS Device Power Off Ex Notification",
        "CIM::Network::IPsec",
        "DecryptionPaused",
        "{8502C4CC-5FBB-11D2-AAC1-006008C78BC7}",
        "User connection",
        "Never Viewable Sites",
        "Win32_DeviceBus",
        "VESA BIOS Extensions Supported",
        "{8502C4E4-5FBB-11D2-AAC1-006008C78BC7}",
        "HowDiscovered",
        "The PathName property contains the fully qualified path to the service binary file that implements the service.",
        "Index for the Icon wanted",
        "MinimumAddressSize",
        "Determines the current allocation behavior for this virtual disk. Fault domain aware virtual disks will intelligently pick the physical disks to use for their redundancy to balance the fault tolerance between two (or more) fault domain units of the specified type.",
        "Associates a network port with its QoS properties.",
        "97220.283",
        "VmFarmSettings",
        "UpperFilters",
        "Select * from WIN32_NetworkClient",
        "MSFT_StoragePool",
        "SlowLinkEnabled",
        "{1101D829-167B-4ebf-ACAE-28CAB7C34802}",
        "Minimum number of segments that a large TCP packet must be divisible by before offloading to Adapter for segmentation for IPv6 packets.",
        "BoostFlags",
        "The specified UDF version is not supported",
        "{32354668-ef89-4ffd-951a-9d483291ea84}",
        "The ProgId property contains a programmatic identifier associated with the COM component. The format of a ProgID is <Vendor>.<Component>.<Version>. This identifier is not guaranteed to be unique.",
        "WSP_VolumeToFileShare",
        "{8502C4D1-5FBB-11D2-AAC1-006008C78BC7}",
        "VIRUS",
        "C_841F1DC98C3FA6D8D114A873F8BBB48736A8E2FDF60D6C1F08DF493438718909",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|StartTime",
        "0xC000001A",
        "The Usages array provides the text that defines how the verb should be used.",
        "CreateGlobalObjects",
        "ref:Win32_QuickFixEngineering",
        "WMI|Win32_Bus",
        "Unique identifier for the instance.",
        "The location of the locally cached package for this product.",
        "ObReferenceEvent",
        "ref:MSFT_NetAdapterVmqQueueSettingData",
        "AdminDistance",
        "MSNdis_QueryNicSwitchCurrentCapabilities",
        "When set to true, AM Service will not initiate security intelligence update on start-up, regardless of whether an Engine is present or not.",
        "This property is only valid if the parameter is displayed in user interface.",
        "OtherCipherAlgorithm",
        "Creates hashes for file content",
        "CD_90D6DB96E4E52DF3FCB751D8C2491313C169EEA2DEA2212CBFE4EFF8C0A5E947.1536.1.9757",
        "CD_E707FBA0E2CA2FF8FDB82241C8B012B9A1B221B3B69ACD6A3EDCF3E478558D31.29.3018176920.433",
        "NS_FE3EA006C3292950A76C2B5A0185D7DF99ADD6FD6502E0AC079E3A8650E76E3A",
        "ifHCOutOctets",
        "\\\\.\\root\\cimv2\\mdm:__Win32Provider.Name=\"MDMSettingsProv\"",
        "CD_DF35CAA9032B2BC8E9E68BEFAD5091A66EF205D46DBC51F13F62EC987E8BBEAC.42.2198918788.652",
        "object:MSFT_NetAdapter_QosSettings",
        "A dependency variable indicating which partial configuration must be applied prior to this",
        "CD_FF74CDAE39923232968131488C628881C63A5FB177CC4E0E28EB62D76E9B7164.1596.586302973.468",
        "NdisEthernetOneTransmitCollision",
        "BuffersLost",
        "IR_84DBB136E33A9D65B07CEAEA34726CC95CE2EDA4327BE7B9EC86367DCA1342F8",
        "3 - 'Degraded': The disk is responding to commands, but is not running in an optimal operating state.",
        "CurrentBIOSBuildNumber",
        "Antivirus Signature age in days- if signatures have never been updated you will see an age of 65535 days",
        "Dot11 Roaming Completion status information.",
        "KI_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB",
        "Whether to respect globally opened ports created in the legacy Windows XP firewall.",
        "- 8=Directory/File Name. Example: If the authorization target is a FileSystem, then the ActivityQualifiers entries can define a list of directories and files whose access is protected. ",
        "Sbp2portGuid",
        "CD_E241A982292C9628611468FB40BE60D4CC1B723333EE25A7584E871FE9DA753E.1080.2882072815.428",
        "Static Subnet Mask",
        "TransitioningToState",
        "Redirection Path [may be used when RedirectionType == {0,1}",
        "CD_B4204F4CD845FAF261673483B3D9C407E18AF7773A24D7B43C66C3052F5D6AAB.2020.2652331080.346",
        "Sampled Profile",
        "Intel(R) Itanium(R) 2",
        "PropertyPolicy",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1218.932574012.180",
        "Describes which mode is used.",
        "Degrees K",
        "The name of the property.",
        "Image_V0_Load",
        "R_6AD386ADF7788A35467E769D3EC3DE89211503B8A449E2B53EAB5B8CCD719DFD",
        "Specifies the property to modify.",
        "RD_TRACE_LPC Flag",
        "GetStringValue",
        "An unexpected I/O error has occurred",
        "ExtendedFilterId",
        "VersionMajor",
        "Microsoft iSCSI Initiator: iSNS Server Class",
        "IL_ACB78AB1C22DE7E2D1D91C09C96C157ED8C7C29196B9534A8A961D540401FACE.2683.841128546.280",
        "Detailed information",
        "HeuristicMax",
        "LocalLastAccessTime",
        "Count of Login other failed Responses",
        "Example: USB",
        "Becquerels",
        "0FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "o mandatory(1): Do the actions in the indicated order, or don\\'t do them at all. ",
        "{5ec10363-a61a-11d0-8dd4-00c04fc3358c}",
        "Represents the transport connection class for  Microsoft TCPIP WMIv2 provider.",
        "RemovePort",
        "showOnToolbarByDefault",
        "NotAvailable",
        "R_176649CD4E57E4232DDDF6DF456E1D2A1BEC4DED47B202F904E6181846857EAD",
        "// Adapter Information class. The iSCSI initiator service relies upon this",
        "IpChecksum",
        "R_C943D0F25B0073795B467B1155FEA65E3CB48CA53F5B1BA641095BEAA27A7533.1480.2551345328.566",
        "Information Flag",
        "ResourceGet",
        "CertificateIssuedBy",
        "FinalState",
        "CIM_PhysicalMedia",
        "CIM_AdminDomain",
        "CIM_Keyboard",
        "Status Invalid Service Account",
        "SetIScsiTunnelModeOuterAddress",
        "Set DF Bit in External Header to 0",
        "MaxValidLifetime",
        "InterfaceStatus",
        "ProtocolSupported",
        "The StandardMillisecond property specifies the millisecond of the StandardSecond when the transition from daylight savings time to standard time occurs on this operating system.",
        "Boot Volume",
        "#define SendSRL_OUT_RspBuffer_SIZE_HINT 8",
        "SupportEmail",
        "The UserName property indicates the users who can access the Win32 program group. Program groups are implemented as file folders in Win32.",
        "Maximum size (in bytes) for a single memory window",
        "Channels",
        "A Boolean value that specifies whether connections using WS-Reliable messaging will attempt to reconnect after transport failures.",
        "StorageReliabilityCounter provides reliability statistics or counters reported by a storage device. This information is dynamic and should be obtained from the storage device whenever needed.",
        "FILE_SYSTEM_CONTROL",
        "SendIPV4",
        "CD_9B85FF5CF1326F4370A0D245830AD60317CB312C53E60E05480454CFB6E5D2C1.1610.1716559465.256",
        "SAM Close Handle",
        "CD_55AF22A4D3FD212FC3171AADE7109F17F27CA9F86C291AE560CF90E7D047839B.2055.4272185905.2427",
        "The EndingAddress property contains the ending address of memory mapped I/O.",
        "The service that is dependent on an underlying service.",
        "Required",
        "LsoV2IPv6",
        "Page File Size",
        "{n67^",
        "IdleDurationSeconds specifies how long the SA can be idle before it is deleted. The default value, 0, indicates that there is no idle timeout period.",
        "EnumerateObjects",
        "UniqueId of a disk contains the VPD Page 0x83 information that uniquely identifies this disk. The following types are accepted (in order of precedence): 8 - SCSI Name String; 3 - FCPH Name; 2 - EUI64, 1 - Vendor Id, 0 - Vendor Specific. If the disk is an exposed VirtualDisk, UniqueId is used map the association between the two objects.",
        "ReadErrorsUncorrected",
        "IsAutoProvisioningEnabled",
        "NodeMap",
        "The ProposedSize property indicates the proposed size of the Win32 registry. It is the only registry setting that can be modified, and its proposal is attempted the next time the system boots.",
        "A class derived from CIM_ComputerSystem that represents a desktop, mobile, network PC, server or other type of a single node computer system.",
        "AddMountPoint",
        "TM_PLGWORKER Flag",
        "WorkflowServiceBehavior",
        "A string that uniquely identifies the type of health action.",
        "#define ISCSI_LOGIN_FLAG_RESERVED1                    0x00000004",
        "PlatformState",
        "The PageFaults property indicates the number of page faults generated by the process./nExample: 10",
        "Reserved as a Delta Replica Container",
        "AllTransactionsTracingEnabled",
        "RecoveryPointValues",
        "Contains an array of binary bytes. ",
        "3 - 'Full Copy': This indicates that a full copy of the source object is (or will be) generated . ",
        "{CD7CA121-E3D2-11d2-8601-0000F8102E5F}",
        "EventTimeStamp",
        "RD_TRACE_RESERVED_1e Flag",
        "{2306fe2f-dbf6-11d2-9244-006008269001}",
        "The QuotasIncomplete property indicates that quota management was used but has been disabled. Incomplete refers to the information left in the file system after quota management was disabled.",
        "Size of the tier on the virtual disk. This property is available only when the storage tier is part of a virtual disk. The property is unspecified for pool-level storage tiers.",
        "The ClientAccessible property is indicates whether the shadow copy was created by the Windows Previous Versions component.",
        "Removal Type",
        "GuardPageFault",
        "IsLinear",
        "0x352",
        "CR_79F50ECB454C073E4E5CB137ED1F04F729BBE896F53092F9F794786916DFD292",
        "C_712B73F1329A92FADFBFDFF586AE86DD55A96BF25CBD08473137CA20DEF39F25",
        "MSNdis_FddiLctFailures",
        "Specifies the type of event being logged",
        "ActiveSlotNumber",
        "ReplaceNewOwnerProfile",
        "CD_4981A3BB969F4ED9382A86F274047A36B2A04D2A53526DFA477217266B033E1E.30.1193437684.1237",
        "A physical package is replaceable  if it is possible to replace (FRU or upgrade) the element with a physically different one.  For example, some computer systems allow the main processor chip to be upgraded to one of a higher clock rating. In this case, the processor is said to be replaceable . Another example is a power supply package mounted on sliding rails. All removable packages are inherently replaceable .",
        "t#m;t#m;",
        "Bitmap",
        "Indicates the level of caller impersonation that the operation supports.",
        "MDM_EnterpriseDataProtection_Settings01",
        "Last Access Time",
        "ExtraInfo",
        "{94acefe3-9e56-49e3-9895-7240a231c371}",
        "Reserved5",
        "In Process",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_FDFF3C9B0664E0FAF284BFA12AE8B9782E6E99E4BAEA05AB7851730AFE40F092a81aE083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "The MUILanguages property indicates the MUI Languages installed in the system. ",
        "I_E21083758A128727DEF6FF7FB30AAB8529BDD6F7C5C936DBCA6F06226211C86C.853.1.52579",
        "CopyEx",
        "QuarantineFailed",
        "Pending manual steps due to threat action",
        "The UTC time at which the source generated the event",
        "BootTime",
        "Valuemap",
        "IOTimer",
        "Values: TRUE or FALSE, A value of TRUE indicates the debugging version of User.exe is installed.",
        "Bid2Etw_RowsetHelper_1_Trace",
        "Mappingstrings",
        "The ComputerName property indicates the name of the computer from which the connection is established",
        "The PortName property identifies the ports that can be used to transmit data to the printer. If a printer is connected to more than one port, the names of each port are separated by commas. Under Windows 95, only one port can be specified. ",
        "CR_E626C49C2DBDF1D0BDC38FFC05C85B76B4BE8E69CBFD214D5F89F70F619AD6CD",
        "If True, MSI-X interrupts are supported.",
        "The setting value for a power setting. This value is writable. The InstanceID of this class will encode whether this setting is for AC or DC power setting. Important: setting saving a power setting value does not automatically make the power setting value take effect on the system. Win32_PowerPlan.Activate() needs to be executed.",
        "UnitsOfUserData",
        "RevisionNumber",
        "LookupNames_End",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.304.2883904097.180",
        "FX_TRACE_DRVMGR Flag",
        "A brief description of the rule.  May be an indirect string.  If it is an indirect string, then it may not be overwritten.",
        "The StartFileName input parameter is a string representing the child file/directory to use as a starting point for ChangeSecurityPermissionsEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which an",
        "LockedDownLocalMachineZoneInitializeAndScriptActiveXControls",
        "The FormName property indicates the name of the form used for the print job.  This property is used only on Windows NT/Windows 2000 systems.",
        "2 - 'Do Not Continue' meaning stop the execution of the job and appropriately update its status ",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.2804936995.180",
        "{acf1403c-a61c-11d0-8dd4-00c04fc3358c}",
        "CIM_RegisteredProfile",
        "object:MSNdis_ReceiveFilterCapabilities",
        "CD_006AB7DFED58A8FB352581D21227922FA9FD887AC08F63A547BAEA9722B5F62B.255.4005509153.904",
        "MuiLoadString",
        "Close",
        "CreateGroupReplica",
        "Cache memory",
        "I_5361F0B5BCF344E5F8BAFF7D3C773CFDA995B3843B674DB9DB34AC35EA55A657.748.1.63404",
        "38CD7",
        "Process_V3",
        "{623F4588-CF01-4f0e-B197-ABBEE5E0CFF3}",
        "RSOP_IESecurityZoneSettings",
        "{73b1292c-60a2-405d-a008-a13632059431}",
        "GetHardwareTestStatus",
        "NumberOfGroupsDefault",
        "PassThru",
        "NA-Letter",
        "8 - 'Starting': The volume is in the process of starting.",
        "TRACE_ERROR",
        "2 - 'Fixed': The storage for the virtual disk is allocated up front.",
        "Example: Permanent.",
        "DiagnosticCode",
        "4 - 'Stressed': indicates that the subsystem is functioning, but needs attention. Examples of 'Stressed' states are overload, overheated, and so on. ",
        "Multi-hop element replication",
        "0xEFFF0056",
        "The process Id.",
        "StartDscTimer",
        "WWN not recognized ",
        "CIM_ToDirectorySpecification",
        "EnumTrstedDomEx",
        "CIM_IRQ",
        "41016",
        "{927907E5-A066-4b07-BD4F-F53C7B748124}",
        "ProcessorCount",
        "AvailableRequestedStates indicates the possible values for the RequestedState parameter of the method RequestStateChange, used to initiate a state change. The values listed shall be a subset of the values contained in the RequestedStatesSupported property of the associated instance of CIM_EnabledLogicalElementCapabilities where the values selected are a function of the current state of the CIM_EnabledLogicalElement. This property may be non-null if an implementation is able to advertise the set of possible values as a function of the current state. This property shall be null if an implementation is unable to determine the set of possible values as a function of the current state.",
        "AllowMessageSync",
        "Flags that affect how login occurs",
        "MSNdis_StatusDevicePowerOff",
        "Socket number",
        "1 - MIPS ",
        "Query of interest",
        "ISDN B Channel Endpoint",
        "Indicates when in the course of an operation invocation to recycle the object.",
        "{225B9D64-47A9-41c8-81CD-69BC02652D87}",
        "The DeviceType property indicates the type of device being represented.",
        "EVENT_TRACE_FLAG_DIRECTORYCONTROL",
        "Enable Trusted Publisher Lockdown",
        "NumericSensorLowerThresholdNonCritical",
        "Client Network Address",
        "PSLError",
        "Transition Latency",
        "ReleaseManagementId",
        "Specifies the type of tunnel used for the VPN connection. Options include  PPTP, L2TP (for L2TP/IPSec), SSTP, IKEv2 and Automatic (IKEv2, L2TP)",
        "C_99150BD9D0963359046E30AE0385F17D4AFD0667F8DA5119FF433CFAA1D95BA6",
        "SlotB",
        "MinimumModerationInterval",
        "This method will upgrade the associated Product using the upgrade package provided through PackageLocation and any command line options that are supplied.",
        "The current temperature of the storage device in Celsius.",
        "TRACE_VERIFICATION Flag",
        "SLEEP_BUTTON_GENERIC",
        "WmiVersion",
        "iSNSServer",
        "{361290c0-cb1b-49ae-9f3e-ba1cbe5dab35}",
        "CoNDIS Media Connect Status",
        "Disables scanning network files.",
        "The 'potential for connectivity' is very different than the master-slave/controller-controlled by relationships of CIM_Controller. Sometimes, however, a single Device is both a kind of NetworkAdapter and a Controller - for example, when a FibreChannelAdapater is operating as a ComputerSystem's SCSIController. In this case, there are aspects of the Device that are network oriented and others that are Controller oriented - and, both the Controller and Adapter classes should be instantiated. A DeviceIdentity relationship would also be created to tie together these differing aspects/abstractions of the Device.",
        "Network adapter emulates a physical network card.",
        "_UUUUUUUUU",
        "SetStorageSubSystem",
        "E829A1544FF8B694A6E8073DFF9D1CD4B2724FDB9291959D5493401980F",
        "Permissions",
        "Element Unavailable",
        "Broken",
        "C_A3CFA2EA2CF7EBAE83315F59909BFC6F8978ACBDBD24E7ACA6B979B7B86A9975",
        "Green CIE coordinates",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.314.699093998.180",
        "DHCP Server",
        "RotateRecoveryPasswordsMethod",
        "TRACE_CLASS_QOS",
        "{4cdec0d4-b0c4-4ea7-8d75-40236a87f3ed}",
        "Unable to configure TCP/IP service",
        "SessionBigPoolSnapDCStart",
        "VolumeDirty",
        "The AutomaticResetBootOption property determines whether the automatic reset boot option is enabled. /nValues: TRUE or FALSE. If TRUE, the automatic reset boot option is enabled.",
        "11015",
        "This represents a string locate device element.",
        "ref:MSFT_NetISATAPConfiguration",
        "CopyObject",
        "802.11h",
        "The Win32_TSSessionDirectory class defines the configuration for Win32_TSSessionDirectorySetting. This includes capabilities such as Session Directory store, Cluster Name and Server IP address.",
        "I_B295448335625AE4F30B1C13C498CDDD136CBDFE27D0ECE17CA7AAD4E56199B6.1938.1342239621.200",
        "This is the DeviceID value found in Win32_NetworkAdapter of theLAN Adapter to be set. The value 0 implies All LAN Adapters.",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.1173.3034325421.7271",
        "TM_INTERFACEHOP",
        "Don't Require Preauthorization",
        "MIF.DMTF|Electrical Current Probe|001.19",
        "MDM_Policy_Result01_WindowsDefenderSecurityCenter02",
        "RSOP_SecurityEventLogSettingNumericBlocked",
        "SMDS ICIP",
        "Represents the IPInterfaceAdapter association class in TCPIP WMIv2 provider.",
        "Specifies the package full name of the application.",
        "NetworkDirect",
        "Any Client",
        "A free-form string describing the ErrorType when 1, \"Other\", is specified as the ErrorType.",
        "MSFT_ResiliencySetting.NumberOfDataCopiesDefault",
        "MIB.IETF|HOST-RESOURCES-MIB.hrFSMountPoint",
        "THREAT_REBOOT_REQUIRED",
        "0xD003 - 'Incomplete': describes a virtual disk which does not have enough redundancy remaining to successfully repair or regenerate its data.",
        "C_4714D9B900765C427A8C3A4D74360B2C569F951B888844030608A447B457F27B",
        "NDIS Device Power On Notification",
        "CIM_ProcessExecutable",
        "ref:MSFT_NetDnsTransitionConfiguration",
        "Note that this method\\'s function overlaps with the RequestedState property. RequestedState was added to the model to maintain a record (i.e., a persisted value) of the last state request. Invoking the OnlineDevice method should set the RequestedState property appropriately.",
        "The Antecedent reference represents the domain the user account exists in.",
        "{03E7DAD7-17A6-4F91-A879-F276B6FD62F8}",
        "Action Values",
        "FriendlyName is a user-friendly name of the target port.",
        "Remove",
        "The FormName property indicates the name of the form used for the print job.  ",
        "Asynchronous TokenizedClone Local",
        "KillJob",
        "{11A902C8-E95E-4450-9B6F-6DDC9ACDF06E}",
        "Array of resource module managers pointing to a location to download missing DSCResources",
        "MSADCO",
        "IpV6IPsecAuthDscp",
        "MIF.DMTF|Voltage Probe|001.9",
        "SECHC_LOG_FLAG_LOCKS Flag",
        "reason",
        "RecoverOS",
        "Interleave",
        "First In First Out (FIFO)",
        "AMD29000 Family",
        "ref:MSFT_CliAlias",
        "CD_8688B6B3A5AFA46698CC5C2A2A938F01175B6D9F4A0E5E74F0C3AA6D73897983.1203.1031135213.347",
        "RetransmissionAttempts",
        "The FileID of the Win32_FileSpecification representing this translator.",
        "Provides for setting a more granular set of auditing permissions to the existing account specified.The permissions are set individually through PermissionMask.The PermissionMask is an enumeration of the following values:WINSTATION_QUERY=0, WINSTATION_SET=1, WINSTATION_LOGOFF=2, WINSTATION_VIRTUAL | STANDARD_RIGHTS_REQUIRED=3, WINSTATION_SHADOW=4,WINSTATION_LOGON=5, WINSTATION_MSG=7, WINSTATION_CONNECT=8,WINSTATION_DISCONNECT=9",
        "CPU socket information including data on how this Processor can be upgraded (if upgrades are supported). This property is an integer enumeration.",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|SpeakerVolume_Med",
        "The Setting reference represents a logical program group on the computer system.",
        "MSFT_NetEventVmSwitch",
        "NewGPOSession",
        "object:MSFT_NetAdapterEncapsulatedPacketTaskOffloadSettingData",
        "options",
        "PacketDirect functionality is operational on the network adapter.",
        "ref:CIM_ReplacementSet",
        "4311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        "The IsBusy property determines whether the serial port is busy.",
        "Zero tolerance",
        "Type of Configuration.",
        "SystemDrivesRecoveryMessage",
        "MSMCAEvent_Header",
        "StandardCimv2",
        "TcpTransportBindingElement",
        "2 - 'Redundant Path': The disk is used for multi-path I/O. ",
        "BinarySDToWin32SD",
        "The domain of the user logged in when the detection occurred",
        "\\\\.\\root\\cimv2\\mdm:__Win32Provider.Name=\"MDMAppProv\"",
        "Reverse Portrait",
        "DnsForestName",
        "Win32_CollectionStatistics",
        "PreAuthMode",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_06DFAB71A3D8DBB356E2B69812AA4BD05249772CB8E5CA24F5D2BBA6FF1926AF",
        "The VMMonitorModeExtensions property determines whether the processor supports Intel or AMD Virtual Machine Monitor extensions.",
        "Media type of the storage tier",
        "NDIS Notify Filter Arrival",
        "KernelThermalPolicyChange",
        "Win32_InfraredDevice",
        "The LoadOrderGroupDependencies parameter passes a list of load ordering groups that must start before this service. The array is doubly null-terminated. If the pointer is NULL or if it points to an empty string, the service has no dependencies.  Group names must be prefixed by the SC_GROUP_IDENTIFIER (defined in the WINSVC.H file) character to differentiate it from a service name, because services and service groups share the same name space.  Dependency on a group means that this service can run if at least one member of the group is running after an attempt to start all members of the group.",
        "The minor number component of the current BIOS version information.",
        "Celeron(TM)",
        "Memory Management Agent",
        "Type of operation",
        "NdisFddiTypeCWrapS",
        "CorporateSitePrefixList",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_84C50CAE138BE8DBF0961918247F6BEE4A1E2653F7AB56ED2DAD85047B7399C8",
        "The DeviceID property indicates a string that uniquely identifies the IDE controller with other devices on the system.",
        "ReadErrorsTotal",
        "This property contains the COM server CLSID that is associated with the MIME content.",
        "Values: TRUE and FALSE. A value of TRUE indicates the wallpaper is stretched to fit the entire screen. If FALSE, the wallpaper retains its original dimensions on the desktop background.",
        "The DefaultIPGateway property contains a list of IP addresses of the default gateways used by the computer system.",
        "The MACAddress property indicates the Media Access Control (MAC) address of the network adapter. ",
        "ManualStepsRequired",
        "4-way Set-Associative",
        "This parameter specifies the initiators for which the virtual disks should be shown. If the subsystem's MaskingOneInitiatorIdPerView property is TRUE, only one initiator can be specified for this masking set. The list of valid initiator address formats can be determined through the subsystem's MaskingValidInitiatorIdTypes property.",
        "MsftDiscFormat2StreamZero_DebugDestructor",
        "InitiatorPortNumber",
        "Boolean indicating that the physical media is used for cleaning purposes and not data storage.",
        "WMI_extension",
        "The number of received IKE messages that are invalid, including IKE messages with invalid header fields, incorrect payload lengths, and incorrect values for the responder cookie (when it should be set to 0). ",
        "RemoveLSFromSpecifiedLicenseServerList",
        "XSize",
        "ISCSI_TargetPortalGroup",
        "WLANHC_TEST Flag",
        "R_DDB9E5284035E7C991E364E045E2FE8D29BD27906672F0EE3919740EC2221800",
        "{8502C4FA-5FBB-11D2-AAC1-006008C78BC7}",
        "Server Trust Account",
        "TR_EAP Flag",
        "Off-line data collection activity was never started",
        "LastProfileUploadIntervalCautionInHours",
        "Win32_BindImageAction",
        "MSFT_ReplicationCapabilitie",
        "SMBIOS|Type 3|Chassis|SKU Number",
        "BlockedFailed",
        "The CIM_RedundancyComponent association indicates that 'this set of fans' or 'these physical extents' participate in a single redundancy group.",
        "Failed to remove persistent login information.",
        "MDM_CertificateEnrollment",
        "C_D36EEB4FA019E601112818DDC069B750B95BF09F1ACA992BF14D32259D2DE75F",
        "Currently unsafe to perform the operation",
        "QryTrstDomByNam_End",
        "The InstallableLanguages property indicates the number of languages available for installation on this system. Language may determine properties such as the need for Unicode and bi-directional text.",
        "HashAlgorithmAH",
        "MSNdis_WmiEnumAdapter",
        "The value of this attribute.",
        "The Antecedent propety is a reference to Win32_PnPSignedDriver",
        "MPEG Transport",
        "Example: All Users",
        "See CIM_NumericSensor.UpperThresholdCritical description for details.",
        "The Name parameter passes the alias to a path set up as a share on a Win32 system./nExample: public.",
        "Win32_SoundDevice",
        "Link State",
        "56003",
        "NdAdapterInfo",
        "Designates one or more source MAC addresses to filter on.  Network traffic is logged when the filter matches. ",
        "MIF.DMTF|FRU|002.4",
        "TXFRM",
        "The group that this set belongs to.  This field is based on the value of RuleGroup and changes to this field are ignored.",
        "TargetLocation",
        "DoCompleteFirst",
        "RoleProvider",
        "Sets the TCP port used by a client to make requests of a KMS host. If not specified, port 1688 is used.",
        "UtilError",
        "HorizontalPolarityType",
        "NS_8B6812A49FF95A56BD1A2DF47F355C035587BE9FBA56C9E3DC5C16762C0879F9",
        "Bits Per Byte",
        "MSDiskDriver",
        "The PasswordChangeable property determines whether the password on the Win32 user account can be changed./nValues: TRUE or FALSE. If TRUE, the password can be changed.",
        "Maximum size, in bytes, of the private data that can be sent via an accept or reject request",
        "Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpBinaryPathName",
        "Directory Service (DS) flag indicating that the domain controller is a directory service server for the domain.",
        "SetValues",
        "KeyManagementServiceListeningPort",
        "InternetZoneLogonOptions",
        "Specifies the interval after which idle workflow instances in memory are terminated.",
        "Counter11",
        "Heap Subsegment Events",
        "VSS tracing event type",
        "MSFT_CliAlias.FriendlyName=\"MemLogical\"",
        "WLANHC_DLLMAIN Flag",
        "NFS timeout in tenths of a second.",
        "NS_892F8DB69C4EDFBC68165C91087B7A08323F6CE5B5EF342C0F93E02A0590BFC4\\KI_A5134EAE65D9DD02F6CE0E924C84D387C2BC76C9409B3E6C9F586619D35EA1DA\\I_2B425BF8CE8732BEB182F0BC728E928FFB0498DF8A9FBACA0C514518961A5460d744",
        "RD_TRACE_RESERVED_18 Flag",
        "SmbWitnessWmiv2provider",
        "The BlindOff property contains the command string used to detect a dial tone before dialing.",
        "The low voltage of input voltage range 2 for this power supply, in millivolts. A value of 0 denotes 'unknown'.",
        "OtherIdentifyingInfo captures additional data, beyond asset tag information, that could be used to identify a physical element. One example is bar code data associated with an element that also has an asset tag. ",
        "The new policy store for the rule.",
        "Send Window Scale",
        "This method will reinstall the associated instance of Win32_SoftwareFeature using the specified reinstallation mode. The method can return the following values:",
        "Tracks Per Cylinder",
        "Logfile",
        "Spinlock Configure Event",
        "The ConfigOptions property contains strings that describe the configuration of the jumpers and switches located on the base board.",
        "Win32Shutdown",
        "{cd5f1102-590f-4ada-ab65-5b31b1dc0172}",
        "CD_D3EEBB9E3A4C5F3CA348B142AF6727D3A274A152187FB63005FF1EA0DBF75FAE.1150.3388036314.543",
        "Anti Starvation Boost Event",
        "LockedDownInternetZoneNavigateWindowsAndFrames",
        "LetAppsAccessMicrophone",
        "Possible",
        "__InstanceDeletionEvent",
        "KerbLogonUser_End",
        "The Domain property indicates the name of the Windows domain to which the group account belongs.",
        "SyncOnCostedNetworkEnabled",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2482.476375418.368",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services|RechargeRate",
        "{b557bd86-4128-4d5c-b6e6-b65f9bd68722}",
        "IL_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6.1489.3536658575.306",
        "R_349957449457FCB3DC5CC416323F05E6E56083B532266B79EAB7F5AB720C36C1",
        "The SetPriority method attempts to change the execution priority of the process. In order to set the priority to Realtime, the caller must hold the SeIncreaseBasePriorityPrivilege.  Without this privilege, the highest the priority can be set to is High priority./nThe method returns an integer value that can be interpretted as follows: /n0 - Successful completion./n2 - The user does not have access to the requested information./n3 - The user does not have sufficient privilge./n8 - Unknown failure./n9 - The path specified does not exist./n21 - The specified parameter is invalid./nOther - For integer values other than those listed above, refer to Win32 error code documentation.",
        "Notify for download and notify for install",
        "ManufacturerDisplayName",
        "SM_ScsiInquiry",
        "C_0669091BB70564F4C28F9EBBB95CE7699D1CBEC6909BE49F84E8F214B14C6216",
        "23 - The service exists in the database of services available from the system.",
        "R_A44408E1DD38D6545C617326A4354A58277DE2EC9DC5930CD9DADCDCF31C706D",
        "FreeAddress",
        "UltraSPARC II",
        "C_D6AB8C1C24557CA6DE44D819F0432B2802C5E7B6285091EE8E19F537397B3A04",
        "Maximum number of SGEs that can be specified in a single request over a receive queue",
        "CD_938698B0DF6D498AC9977F56BC06022F271BD32FB79DBFC9EF3962F022C26E04.2615.2676342091.552",
        "Supplies an optional IPv6 address representing the Source Address field in the IPv6 header of the NS message.",
        "SystemElement",
        "GetGracePeriodDays",
        "C_CE7115C334FCF4CAF18779B5DCE6EE49094B2697F81975FFC890786B7C5BEB22",
        "DAIPsecRequired",
        "0xEFFF0039",
        "Allows a user to set a custom usage type for the new virtual disk object. This parameter can only be specified if the Usage parameter is set to 1 - 'Other'. ",
        "Transmission Error",
        "The BitsPerByte property indicates the number of bits per byte for the serial port",
        "RtpEnabled",
        "The minor number component of the version information for the current management firmware on this physical computer system.",
        "H/m;H/m;",
        "CR_AEB1302AC843DE3720FDF5243FA6FA29740C3EF6F87994A8A6D26F14FA996B57",
        "Default block size, in bytes, for this device.",
        "GslbIP",
        "Exit Code",
        "ROOT\\Microsoft\\Windows\\Wdac",
        "// The number of quick mode state entries.",
        "Example: Microsoft PCM Converter.",
        "Other - For integer values other than those listed above, refer to Win32 error code documentation.",
        "GetNonLinearFactors",
        "ConnectedAccountPolicy",
        "Total (elapsed) time-outs supported",
        "Shortest moderation interval supported in nanoseconds.",
        "Win32Registry|System\\CurrentControlSet\\Control\\Session Manager\\Memory Management|TempPageFile",
        "Group Policy Infrastructure",
        "Win32API|Device Context Functions|GetDeviceCaps|VREFRESH",
        "C_4918F636CE6C9B5C75F87478AB3EFCC73FE606FE12C4815A0162B548617F58D0",
        "Clean",
        "MSFT_ReplicationSettings",
        "The CIM_Controller antecedent reference represents the local device associated with this printer.",
        "16-way Set-Associative",
        "MSFT_NetSecDeltaCollection",
        "\\\\.\\root\\Microsoft\\Windows\\DeviceGuard:__Win32Provider.Name=\"Win32_DeviceGuard\"",
        "The maximum size of the buffer pool",
        "This property provides the status of the firewall",
        "ActiveAcquire",
        "ref:Win32_SCSIController",
        "MIB.IETF|Printer-MIB.prtInterpreterLangFamily",
        "GREKeys",
        "Enable Error Source",
        "Win32API|Communication Structures|DCB|fParity",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_max_storage",
        "AuthenticationScheme",
        "MSiSCSI_HBASessionConfig",
        "IL_370D362D24157E77A6D437A1B6E44D31636578C65BA57AE250B7372F533440DE.2457.1240054415.346",
        "Emigrating",
        "PhysicalAddressLen",
        "Disable KTIMER2 Event",
        "TotalNumOfPhyCounters",
        "String specifying the name of the backup file.",
        "Additional Sense Length",
        "The operational statuses associated with this extent.",
        "The copy number associated with this extent.",
        "ref:Win32_Session",
        "Size of the write cache for the virtual disk",
        "WPD_F7 Flag",
        "A power consumption meter representation with the capability to measure and control budgeting and thresholds of the underlying metering hardware on the system.",
        "LogHeaderStart",
        "PasswordRequired",
        "Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_TOTALTIMEOUTS",
        "RSOP_IEESC",
        "IFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "MSFT_WmiEssEvent",
        "CIM_Component is a generic association used to establish 'part of' relationships between Managed System Elements. For example, the SystemComponent association defines parts of a System.",
        "ValueName",
        "CEE DCBX is supported.",
        "AMD Opteron(TM) Family",
        "SamSetInfoDom_End",
        "C_E9E54EEA82B8A799BAB440BC9A0D51FEA49FF0156E4DB012B3AF1E723AA4EFD5",
        "0x20b",
        "// This class is required if adapter supports IPSEC.",
        "This class provides ability to manage wireless profiles on the device",
        "UserConfiguration",
        "MIF.DMTF|System Cache|003.14",
        "GENERATE_FILE_NAME",
        "Indicates the current status of the node.",
        "InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls",
        "The number of frames a NIC receives but does not indicate to the protocols due to errors.",
        "In Maintenance Mode",
        "ref:MSFT_NetAddressFilter",
        "Win32_TSApplicationFileExtensions",
        "LocalMachineZoneAllowAutomaticPromptingForFileDownloads",
        "// This class exposes portal information. It provides the original and ",
        "LPCDRVR_TRACE_RESERVED_04",
        "Old Tag",
        "Disable intrusion prevention system.",
        "C_736DA1BE1383B0FEB2F66F7268F46979989C22B45120DC2F7115B633EBF80496",
        "LookupSids_End",
        "An indication of whether the device is locked, preventing user input or output.",
        "Logging Status:  1 = Client Side Extension logged data successfully, ",
        "{FAF76B7E-798C-11D2-AAD1-006008C78BC7}",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightBias",
        "The count of KMS requests from clients with License Status=1 (Licensed).",
        "Win32API|Process and Thread Structures|PROCESS_INFORMATION|dwProcessId ",
        "MsftMultisessionSequential_DebugConstructor",
        "SDDL for remote machine tunnel SA authorization",
        "MissingPfDriver",
        "MIF.DMTF|Portable Battery|002.15",
        "iption",
        "ReadWrite",
        "Reset_BC",
        "UserConfiguredWindows8App",
        "DataOffset",
        "Progress of the application job",
        "RunMonth",
        "PixelsPerYLogicalInch",
        "DOMaxForegroundDownloadBandwidth",
        "CACHE Flag",
        "Class that represents policy data for scripts extension",
        "Processor Performance State",
        "WRITE",
        "NdisVendorDescription",
        "Snooze",
        "PrimaryAddressResolutionStatus",
        "EVENT_TRACE_FLAG_CREATEMAILSLOT",
        "CIM_IKEProposal.AuthenticationMethod",
        "Central Processor",
        "DetailedStatus compliments PrimaryStatus with additional status detail. It consists of one of the following values: Not Available, No Additional Information, Stressed, Predictive Failure, Error, Non-Recoverable Error, SupportingEntityInError. Detailed status is used to expand upon the PrimaryStatus of the element. ",
        "QUERY_QUOTA",
        "The SetGateways method is used to specify a list of gateways for routing packets destined for a different subnet than the one this adapter is connected to.  A more specific route should not exist for this subnet. The method returns an integer value that can be interpretted as follows: ",
        "AutoBoost Clear Floor Event",
        "{671A8285-4EDB-4cae-99FE-69A15C48C0BC}",
        "IR_BAE2729FB2A4F61D06933B050C473303CCE7911F610104E1004CA977C52C3E87",
        "SpecialRequirements",
        "ClientIpAddress",
        "Group",
        "SplitCount",
        "Microsoft iSCSI Initiator: Session Class",
        "mation Missing",
        "IsDFP1xCompatible",
        "Sector Count",
        "Connected",
        "90 - Parameter out of bounds",
        "4 for 128 ",
        "The subsystem name of the replica peer within the replica's storage subsystem.",
        "SMBIOS|Type 17|Device Locator",
        "2f81b}]",
        "SM_AddLink",
        "Availability",
        "43034",
        "ReportedObjectUniqueId",
        "MSArrayId",
        "MaxCacheSize",
        "FindValidCertificates",
        "In the case of an LDAP-derived instance, the ObjectClass property value(s) may be set to the objectClass attribute values.",
        "s attributes.",
        "SendFailures",
        "Credentials Source",
        "COMPRESSED Flag",
        "RegCompany",
        "NumberOfFreeBlocks",
        "CD_234C00C48C3A9C34F82AAA3B652AA3E2A181F3A939430AAEB85DD9A80A3A5915.2621.2950549508.430",
        "The ArpUseEtherSNAP parameter enables (TRUE)TCP/IP to transmit Ethernet packets using 802.3 SNAP encoding.",
        "IPv4MaxOffloadSizeSupported",
        "Impersonated",
        "OSLanguage",
        "DVD+RW",
        "11 - 'In Service': The volume is being configured, maintained, cleaned, or otherwise administered.",
        "2DC5A6B44F3255647A4F9E3D4F932FDB937FF6A6BFC90FAEFA2788D220375335",
        "2147490692",
        "View Unknown Rated Sites",
        "PollingInstructionsTotal",
        "SAM Get Boot Key Information",
        "The computer system.",
        "Gives TS Domain Name",
        "PhysicalDisksPerStoragePoolMin",
        "Returns the security descriptor from the key name. ",
        "SM_SendTEST",
        "40010",
        "%ActionDelay%",
        "C_3A281986D2DC73E5FFAF5C10E516D033611D0B81732C1211B5A9AB1B8BCF2D1D",
        "This property corresponds to CIM_PhysicalFrame.SKU. See CIM_PhysicalFrame.SKU for details.",
        "System boot. If implemented this log entry is guaranteed to be the first one written on any system boot",
        "The ExposedRemotely property indicates whether the shadow copy is exposed on a remote machine with a network share. If this flag and the ExposedLocally flag is not set, the shadow copy is hidden.",
        "ProgID",
        "MSFT_NetMainModeRuleMMAuthSet",
        "The DefaultTTL property indicates the default Time To Live (TTL) value set in the header of outgoing IP packets. The TTL specifies the number of routers an IP packet may pass through to reach its destination before being discarded. Each router decrements the TTL count of a packet by one as it passes through and discards the packets if the TTL is 0. Default: 32, Valid Range: 1 - 255.",
        "CR_E5893386A7B4C018092F4F8B136F60610FB13ED7B0A8A3475C8F55E3E9FBCB90",
        "The Number property indicates the physical slot number, which can be used as an index into a system slot table, whether or not that slot is physically occupied.",
        "B5B.2417.2179563484.526",
        "The iSNS server was not found or is unavailable.",
        "TCPIP Service Trace",
        "The method returns an integer value that can be interpreted as follows: ",
        "IncreaseTime",
        "16 data bits",
        "Enables the UDP Segmentation Offload (USO) properties on the network adapter.",
        "CD_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396.1132.1.8512",
        "__ExtendedStatus",
        "TCPIPv6Checksum",
        "CD_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D.1501.3402683322.4366",
        "The WINSHostLookupFile property contains a path to a WINS lookup file on the local system. This file will contain a map of IP addresses to host names. If the file specified in this property is found, it will be copied to the %SystemRoot%\\system32\\drivers\\etc folder of the local system. Valid only if the WINSEnableLMHostsLookup property is TRUE.",
        "SetInterval",
        "WmiMonitorListedFrequencyRanges",
        "One of the following values:  Active: Change only lasts until next boot.  Persistent: Change is persistent.",
        "UserToSignIn",
        "ref:CIM_VideoController",
        "LockedDownRestrictedSitesZoneAllowLessPrivilegedSites",
        "PelsWidth",
        "MSNdis_EthernetMulticastList",
        "MaxCellRate",
        "LUAInstall: error 0x00000005 setting flags [{92E76A74-2622-3AA9-A3CA-1AE8BD7BC4A8}]",
        "TRACE_CLASS_QOS Flag",
        "ExpirationTime",
        "SDBUS_DEBUG_DUMP_REGS Flag",
        "Owning Thread",
        "File system not NTFS",
        "TEST_TRACE_RESERVED_0d Flag",
        "CD_0C641AF43E24BC384C9291373FBBEE013FBB02E71DB5BE5F4A078ACA9D6EB46E.33.3994791708.577",
        "GetRDSVersion",
        "ref:Win32_OperatingSystem",
        "PlayEnabled",
        "iScsiFlagNetwork",
        "{d08bd885-501e-489a-bac6-b7d24bfe6bbf}",
        "SamQuerySecurityObj_End",
        "Toggle - RTS is turned on if there is any data buffered for transmission.",
        "Register file identifier",
        "{F62037D8-E3D0-11d2-8601-0000F8102E5F}",
        "Female",
        "GroupConnectionCount",
        "MIF.DMTF|System Resource DMA Info|001.7",
        "MIF.DMTF|Operational State|003.3",
        "ClusterSize",
        "Default network fairshare weight for local system process, valid number is 1 to 9",
        "SmbServerNameHardeningLevel",
        "The upper-bound of the source port filter condition. This field complements IPSrcPortStartMatchCondition.",
        "Alpha 21264",
        "0x020000",
        "This property gets/sets whether to make microsoft accounts optional to use modern applications",
        "AllowsLockedDownTrustedSitesZoneTemplate",
        "The frequency (in hertz) at the high end of the Input Frequency Range 1 of this Power Supply. A value of 0 implies DC.",
        "OMI_ReportManager",
        "FileVerify",
        "PollingMemoryTotal",
        "MSADCO.1 formatted output (A)",
        "The Password parameter passes the password (when the server is running with share-level security) for the shared resource. If the server is running with user-level security, this parameter is ignored.",
        "AllowAddingNonMicrosoftAccountsManually",
        "MSFT_Engine",
        "{6929e718-2062-11d4-97eb-00c04f79c403}",
        "ref:Win32_PowerSetting",
        "Type of Encapsulation - NVGRE (1) or VXLAN (2) with possibility to bitwise combine",
        "IsBackgroundTask",
        "HandleNewDescsEnd",
        "271140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "Level 3",
        "IsMicrosoftAccountOptional",
        "ref:CIM_PowerSupply",
        "MDM_Policy_Config01_Browser02",
        "{2306fe32-dbf6-11d2-9244-006008269001}",
        "5 - Hardware disabled",
        "The Win32_ClientApplicationSetting class represents an association between an executable and a DCOM application that contains the DCOM configuration options for the executable.",
        "The ComputerSystem object and its derivatives are Top Level Objects of CIM. They provide the scope for numerous components. Having unique System keys is required. The NameFormat property identifies how the ComputerSystem Name is generated. The NameFormat ValueMap qualifier defines the various mechanisms for assigning the name. Note that another name can be assigned and used for the ComputerSystem that better suit a business, using the inherited ElementName property.",
        "CIM_AllocatedResource",
        "Whether to respect user allowed applications created in the legacy Windows XP firewall.",
        "PFS group plumbed in IPsec policy.",
        "VendorSpecific4",
        "System Configuration",
        "CD_DFF237252232921ADE7987E5391E4968B2F362CE0BB4B63D377328B49C8CC5FA.40.4153110936.486",
        "The discovery method for this port (Multicast or Directed).",
        "AllowMultipleVersions",
        "CD_0783FC4315F6719B07F6F7780EAC7B73D0B0471C3E21E23BC45CB6B44FFECA8E.5.1.9646",
        "CustomConfiguration",
        "Call Cancelled",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_num_logons",
        "The Create method initiates sharing for a server resource. Only members of the Administrators or Account Operators local group or those with Communication, Print, or Server operator group membership can successfully execute Create. The Print operator can ",
        "    </registryKey>",
        "InboundDirection",
        "TeamOfTheMember",
        "The Type of the Sensor, e.g. Voltage or Temperature Sensor. If the type is set to \"Other\", then the OtherSensorType Description can be used to further identify the type, or if the Sensor has numeric readings, then the type of the Sensor can be implicitly determined by the Units. A description of the different Sensor types is as follows: A Temperature Sensor measures the environmental temperature. Voltage and Current Sensors measure electrical voltage and current readings. A Tachometer measures speed/revolutions of a Device. For example, a Fan Device can have an associated Tachometer which measures its speed. A Counter is a general purpose Sensor that measures some numerical property of a Device. A Counter value can be cleared, but it never decreases. A Switch Sensor has states like Open/Close, On/Off, or Up/Down. A Lock has states of Locked/Unlocked. Humidity, Smoke Detection and Air Flow Sensors measure the equivalent environmental characteristics. A Presence Sensor detects the presence of a PhysicalElement. A Power Consumption Sensor measures the instantaneous power consumed by a managed element. A Power Production Sensor measures the instantaneous power produced by a managed element such as a power supply or a voltage regulator. A pressure sensor is used to report pressure.",
        "Base Virtualization Support",
        "Verify the access permissions for a user ",
        "Vertical polarity type",
        "Assert Flag",
        "Name of the Terminal.",
        "EndingAddress indicates where in lower level storage, the higher level extent ends. This property is useful when mapping non-contiguous extents into a higher level grouping.",
        "The antenna selected for transmitting on the radio of the 802.11 device",
        "ValueMap",
        "No Redundancy",
        "QuickScanStartTime",
        "Limit Affinity - Causes all processes associated with the job to use the same processor affinity.",
        "Port State of a sub-Interface of the adapter",
        "TargetPortalGroupTag",
        "CIM_DeviceErrorCounts is a statistical class containing error-related counters for a logical device. The types of errors are as defined by CCITT (Rec X.733) and ISO (IEC 10164-4).",
        "NDIS Ethernet One Transmit collision",
        "U - The update (e.g. errata, patch, ..., in numeric form).",
        "Chimney",
        "C_5E38482AA73EA29B759E8DA322C89333B6EB11675AB299997E04B67232DA3442",
        "TenantIds",
        "IL_B93E6686A3652ED68A2C315C7A4538886FE8CF7FE0CACBC7828D45201F16DD39.1976.3537722519.185",
        "RunLevel",
        "Scsi Interface Error",
        "The inherited SettingID serves as part of the key for a CIM_VideoControllerResolution instance.",
        "The port to which this hosted cache client will offer content to the hosted cache server on its HTTP channel",
        "CurrentManagementFirmwareMinorVersion",
        "DeviceType",
        "RD_TRACE_DISPATCH Flag",
        "Represents a TCP/IP printer port",
        "{D52706F2-8045-11d2-90CE-0060081A46FD}",
        "Volume Guid Name",
        "MDM_Policy_Result01_WindowsConnectionManager02",
        "PolicySourcePNPRedirection",
        "RemoteAddressRanges",
        "Read a GPO, and cache results locally",
        "ROOT\\Microsoft\\Windows\\Wdac\\MS_409",
        "The storage pool is reserved for special usage only.",
        "0xC005004F",
        "{0a214809-e35f-11d0-9692-00c04fc3358c}",
        "NS_1BBA01731E96C19D0D6219D5469AEAB5B51946F70955812074A8F272593746D4\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_653B6A35271DAA7F4D6EDFC2E9E795101F58B4B177E4E4A5A213F1257972A915",
        "PingIPAddress",
        "The number of MSI-X table entries supported by the hardware.",
        "The usage of this virtual disk can be set using the Usage and OtherUsageDescription parameters. If a value for OtherUsageDescription is given, Usage must be set to 1 - 'Other', otherwise an error will be returned. ",
        "C_81F5CC7DCEFB1E634599916220181F35C3DB70B94808983CB78C381325F1AAF3",
        "The Win32_LoggedOnUser association represents the relationship between a session and the user account using that session. Although the association will usually be one to one - users are possible that involve more than one session. At the termination of the session the association instance is deleted.",
        "The logical disk which is built on the partition.",
        "CurrentActiveCacheSize",
        "The StartFileName input parameter is a string that names the child file/directory to use as a starting point for DeleteEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from the previous method call. If this parameter is NULL, the operation is performed on the file ordirectory specified in the ExecMethod call.",
        "CD_486709A1BC1AEA1713B7B7854CB54E0BA9471BB018357C834E1DD6BAF7DE7457.37.1828699760.365",
        "Architecture of the package",
        "CertificateExpiresOn",
        "SPACES_StorageAlertEvent",
        "This property gives a policy administrator a way of specifying how the ordering of the PolicyActions associated with this PolicyRule is to be interpreted. Three values are supported: ",
        "Defines the checksum offload encapsulation settings for the Adapter for IPv4 receive packets.",
        "This specifies the number of entries in the PMK cache.",
        "TL_FUNC Flag",
        "{E6B8552B-7C62-4c6e-99EB-67CE6087894C}",
        "The DaysOfWeek parameter indicates the days of the week when the job is scheduled to run, and is used only when the RunRepeatedly parameter is TRUE.",
        "// This class exposes the configuration capabilities for the adapter to be able to",
        "Janus Flag",
        "Terminate (4) stops the job cleanly, saving data, preserving the state, and shutting down all underlying processes in an orderly manner. ",
        "Exceeded max sessions for this initiator.",
        "Invalid parameter",
        "I_993D150D0C9C8AECC30617FB0FF207B447C72B60CB9837CA152ECAA0421F80ED.533.1.143317",
        "0xC005007F",
        "The VolumePath property indicates the name of the volume that disk quotas are on. It can be volume name, volume path (ex D:\\) or it can be the unique volume name like \\\\?Volume{GUID}\\.",
        "XWizard Framework",
        "Antispyware signature version (major, minor, build, revision)",
        "IL_B2126DF89CF1DE3913FAC3B998A658DE3E47D87D0A73369A702B132DBA49F337.2681.1404652002.279",
        "Storage Capacity Problem",
        "Tentative",
        "PacketCoalescingFilter",
        "C_0A88143E1C3CA6AAD532712FF8639D26F391192D06CCAD53461A69205DC057F1",
        "LoadReason",
        "D3DScore",
        "The EnableEvents property indicates whether the WMI event subsystem should be enabled./nValues: TRUE or FALSE, If TRUE,then the event subsystem is enabled.",
        "CIM_SettingContext",
        "LogFlagTask",
        "The path to the package that is to be advertised",
        "Query Receive Filter Hardware capabilities",
        "One of the following values:   Unicast: Marks the address as a unicast address. This is the default.   Anycast: Marks the address as an anycast address.",
        "The printer this configuration is associated with.",
        "CD_0F6F4793DA673F1C347C3D8CA2454121EC5D32EA0CAF379FB0C0BF42C511B174.38.3368124563.483",
        "QualityUpdateStatus",
        "RegistryDataType",
        "Win32_Directory",
        "MaxOutboundReadLimit",
        "C_8125E110531A89ED8BE4900320A962FACBC3DD4F09BA92855250F1BACABA704B",
        "CIM_USBControllerHasHub",
        "CurrentConfigValue",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1520.23086391.368",
        "SupportsStorageTierResize",
        "ParityCheckEnabled",
        "CD_5EA07488A9CBC676B6ADCCAF378807D330C6A6A97786CF041307B3FDB3A6030B.1980.1726229958.6268",
        "Indicates network adapter support for Large Send Offload (LSO) V2 for this encapsulated packet type.",
        "IdleHandler present",
        "{8502C592-5FBB-11D2-AAC1-006008C78BC7}",
        "AppraiserRunResultReport",
        "IRQNumber",
        "To control whether DHCP is enabled on this IPInterface. Two possible values: - Disabled - Enabled",
        "RestrictedSitesZoneJavaPermissions",
        "Ports",
        "t(m;t(m;",
        "{3B1A329C-6562-4183-B229-981062FE72BD}",
        "OfflineAccessEnabled",
        "Nickel Metal Hydride",
        "CurrentCharSet",
        "MSNdis_ReceiveError",
        "Reset the 6to4 configuration.",
        "MSFT_NetConSecRuleFilterByProtocolPort",
        "SECAM L",
        "Access Denied",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_PSEUDO_STREAM",
        "Path to the application icon",
        "{FE5D55E0-E3D3-11d2-8601-0000F8102E5F}",
        "ValidRegistryValues",
        "MSFT_DOBaseStatus",
        "{f5c5796c-de7a-456b-891f-03a2e006e07c}",
        "Native WIFI Filter Driver Trace",
        "59003",
        "The Location property indicates the path where the startup command resides on the disk file system.",
        "Detailed traces from intermediate steps",
        "CIM_SAProposal",
        "C_115C2C7C875DAA2D80858EAB217D4BA6077F4CCDF9EB9B75A301CD68389427E6",
        "RSOP_IEAdministrativeTemplateFile",
        "OtherFamilyDescription",
        "IL_18B6D4EB7C4A1ECD9E8ACA9EE4BB46AFABE66672A92365FB5A8AEA913BD3EDDC.1751.21967571.185",
        "The Vector property indicates the vector of the IRQ resource",
        "IPv4ReceiveUdpChecksumSupported",
        "DnsSecIPsecRequired",
        "C_EC28E29E31F548462327C3037DF69482A82EBE159236DA81AE2E5AA78F5CFB04",
        "True if the WDAC BidTrace setting is enabled.",
        "Infrared Wireless",
        "UDPIPv6Checksum",
        "Settable Data Bits",
        "{3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c}",
        "{8502C53C-5FBB-11D2-AAC1-006008C78BC7}",
        "The Sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If the CurrentReading is below LowerThresholdFatal, then the Current State is Fatal.",
        "PermanentMacAddress",
        "2 - 'Unhealthy': TBD.5 - 'Unknown': TBD.",
        "LetAppsAccessCamera_UserInControlOfTheseApps",
        "CreateStorageTier2",
        "The DefaultWarningLimit property indicates the default warning limit set for quotas on this particular volume.",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_EBAEEA562CCAE5F44F8DC529A43985A152EC238D3F950BE794ACAB0A20B82979",
        "Proprietary",
        "PortableDeviceClassExtension_f1 Flag",
        "AllowInboundRouterRequest",
        "Resources failed in the configuration.",
        "KerbSetPassword",
        "ControlledFolderAccessProtectedFolders",
        "Win32Registry|System\\CurrentControlSet\\Services\\Class|Ver",
        "CPE handling switched from interrupt driver to polling",
        "AntispywareSignatureUpdateDateTime",
        "Credentials Flag",
        "The TakeOwnerShipEx method obtains ownership of the logical file specified in the object path. If the logical file is actually a directory, then this method will act recursively, taking ownership of all the files and sub-directories the directory contains",
        "The number of Queue pairs for the default VPort",
        "The name of the ASP .Net role provider.",
        "CIM_HostedService is an association between a service and the system on which the functionality resides.  The cardinality of this association is 1-to-many.  A system may host many services. services are weak with respect to their hosting system. Heuristic:  A service is hosted on the system where the logical devices or software features that implement the service are located.  The model does not represent services hosted across multiple systems.  This is modeled as an application system that acts as an aggregation point for services, that are each located on a single host.",
        "Sessions Forced Off",
        "StateChange",
        "C_EDDF316486234851D86580CFE9B06D5A43E06F671105861787434F12D58AD4EC",
        "If the DefaultSeparateVDM switch in the Windows section of WIN.INI is TRUE, this flag causes the CreateProcess function to override the switch and run the new process in the shared Virtual DOS Machine.",
        "DisableDirectXDatabaseUpdate",
        "Deferred SPN Set",
        "The certificate associated with this service.",
        "fEnableTerminal",
        "InputResource",
        "ReceiveSegmentCoalescing",
        "} ISCSIIPADDRESSTYPE, *PISCSIIPADDRESSTYPE;",
        "Specifies the UDP Port Number for VXLAN Traffic.",
        "Login Other Failed Responses",
        "RestrictedSitesZoneRunActiveXControlsAndPlugins",
        "ConfigureTimeZone",
        "BindType",
        "4 - 'Minor': Action is needed, but the situation is not serious at this time. ",
        "\\\\.\\root\\standardcimv2:__Win32Provider.Name=\"nettcpip\"",
        "WriteBufferSize",
        "EVENT_TRACE_FLAG_T",
        "object:MSSmBios_SysidUUID",
        "MSFT_NetIPInterfaceIPAddress",
        "This device cannot work properly until you restart your computer.",
        "OSLUN",
        "TSPkgDebugTrace",
        "object:MSFT_ResourceInDesiredState",
        "{649e3596-2620-4d58-a01f-17aefe8185db}",
        "Both IPv4 and IPv6",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\nwlnkipx\\Parameters\\Adapters|PktType",
        "FileSystem",
        "MDM_SecurityStatus",
        "MaxHorizontalImageSize",
        "ISCSI_ERR_INVALID_CHAP_CHALLENGE",
        "TEST_TRACE_RESERVED_0e",
        "Supported Copy States.",
        "MIF.DMTF|Voltage Probe|001.12",
        "MSNdis_DeviceWakeOnMagicPacketOnly",
        "C_3F67FA0166F0C8A24B462CDA43C543F340CD7BDE061E1F57A0BF997BF74531EB",
        "UsingLegacyInterface",
        "Demand Start",
        "OnlyAllowLocalProfiles",
        "BigPoolSnapDCEnd",
        "MSFT_CliAlias.FriendlyName=\"OS\"",
        "__InstanceProviderRegistration",
        "LINKMAN Flag",
        "CaPSL",
        "LockedDownTrustedSitesZoneNavigateWindowsAndFrames",
        "C_8D36CA25014FC3D1E225A7C28F608753348B2A8115F75C792A0330884C670CDB",
        "LPC_TRACE_MSG Flag",
        "CD_174A2AEB54BD548E043873CC69AA038DD6DC3AC5FE2EA12ED542CDBBEFBB3320.1700.2284182261.344",
        "ACPI 1.0 and 2.0 C-states",
        "SMTPEventConsumer",
        "ISCSI_ERR_HEADER_DIGEST_NEEDED",
        "SwEcpReadCount",
        "CIM_Slot.SpecialPurpose",
        "R_097B2F9E0FE36EC7F3877350AB1E8E8E0879DBC3C32560F4916D3C7C564BDDF7.290.3208422924.514",
        "Verification failed",
        "ALPC_Send_Message",
        "LifetimePackets",
        "CreateSectionEnd",
        "Count of the major errors. ",
        "MSNdis_80211_ReceivedSignalStrengthEventTrigger",
        "RS-422",
        "The specified discovery mechanism was not found.",
        "StateIdleTimeoutSeconds",
        "Stack11",
        "The IPEnabled property indicates whether TCP/IP is bound and enabled on this network adapt.",
        "Mixed",
        "LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls",
        "Foreground_Blue",
        "Redundancy Lost",
        "CIM_ServiceSAPDependency is an association between a service and a service access point indicating that the referenced SAP is utilized by the service to provide its functionality. For example, boot services may invoke BIOS' disk services (interrupts) in order to function.",
        "Client Workstation",
        "1      This device is not configured correctly. ",
        "The scoping storage extent's creation class name.",
        "__IntervalTimerInstruction",
        "A Win32_FolderRedirectionHealth object that represents the health of the user's redirected Saved Games folder.",
        "SystemConfig_V1_IRQ",
        "VerticalRefreshRateNumerator",
        "RSOP_GPO",
        "AffinityManagerEnable",
        "BandwidthThrottlingEndTime",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_27FAEA5F317A7D777DA2A8EBCBC3C42776D2CE02DCD68C27018D6EFB15E2A7CD",
        "Fixed hard disk media",
        "MDM_Win32CompatibilityAppraiser_AppraiserConfigurationDiagnosis02",
        "CompressionCapable",
        "MSiSCSIInitiator_TargetLoginOptions",
        "The IPXMediaType property represents an Internetworking Packet Exchange (IPX) media type identifier.",
        "Disables a network adapter",
        "MSFT_NetServiceShutdownFailed",
        "IL_1E59813E7045B8656EFFCBCD5C1862D995CA0F602D3213FEC6EFBA0ED3F2AD29.311.697620915.249",
        "The dependent service.",
        "HibernateTimeoutPluggedIn",
        "R_BC68F03B4B8F91EBABF0C9EFED9C57ABF605182A4D8760A0679947CF4F1C5F19",
        "Describes the type of module, when PortType is set to 1 (\"Other\").",
        "DnsSecIPsecEncryptionType",
        "Diagnostic",
        "Type of the module.",
        "ForceStartSize",
        "{2A7B042D-578A-4366-9A3D-154C0498458E}",
        "C_664AF66B21C2039DE71ED4563B6D82F78FB404975A3235A5DEEC63FCFAD8513C",
        "RefreshThresholdSecondsPercentage is the lifetime percentage after which a new SA should be acquired, before the existing SA expires. A random period may be added to a calculated threshold to reduce network thrashing.",
        "Reverse Roles operation does not change CopyState",
        "OneXSingleSignOnUserBasedVirtualLAN",
        "9BF0B51534BC38CEB10F9556344574338B9E17B1FD19E593FD78",
        "MSFT_CliAlias.FriendlyName=\"Port\"",
        "MSFT_NetSARuleQMCrypto",
        "C_ACE6286BD25F0AA2207D2355DA74065D91E7CE838C5E66A6FF0F8AF0C177656D",
        "RD_TRACE_RESERVED_0e",
        "C_F2BF551D2C47E413C4BD58FCB0E48E0B3211C53383EC4051E655BB8319ADD47D",
        "PDUCommandsSent",
        "Functionality Supported",
        "StorageNodeName",
        "cache line is held shares",
        "10GBase-EW",
        "The DefaultTTL parameter specifies the Time to Live value set in the header of outgoing IP packets.",
        "2 - 'Initialized': The link to enable replication is established and source/replica elements are associated, but the Copy engine has not started. ",
        "#ifndef MSFC_HBA_API",
        "// contains the default values to use when establishing a session.",
        "C_2D5BE2B23BA8B748FE728A0E39B335CC2B3500262599CB2529C98BB713577B01",
        "New deduplication mode of the volume.",
        "Bytes written using software Epp mode",
        "Performance Data Information",
        "1 - 'Level 1': Storage pools, resiliency settings, target ports, target portals, and initiator ids will be discovered.",
        "The UPSPort property specifies the name of the serial port to which the UPS is connected.",
        "Horizontal polarity is positive",
        "Display Settings",
        "{5BBB6C18-AA45-49b1-A15F-085F7ED0AA90}",
        "The Target Mapping Address passed is out of range for the adapter configuration",
        "The maximum number of queued connection requests that can be pending.",
        "Classification entries.",
        "CIM_FromDirectorySpecification",
        "Example: NEC",
        "DefaultScale",
        "ATM FUNI",
        "{43671f40-2129-11d4-97eb-00c04f79c403}",
        "CIM_Fan",
        "CopyState describes the state of the association with respect to replication activity. Values are: ",
        "SecretEncoding",
        "AllowWindowsInkWorkspace",
        "\\\\.\\root\\cimv2:__Win32Provider.Name=\"WmiPerfInst\"",
        "FltIoFailure",
        "UseLicenseURL",
        "SystemConfig_V2_IDEChannel",
        "security audit success",
        "The EnableBIDI property indicates whether the printer can print bidirectionally.",
        "Sets the TCP port used by a KMS host to listen for activation requests. Applies to KMS hosts only. If not specified, 1688 is used.",
        "CR_BA7526B37D90714D7B62CC8C0306D68C0FA9CA2FF62FAB9215A612E133C74CD5",
        "NSHIPSEC",
        "RemoteAccess",
        "HardwareID",
        "Gigabit Ethernet",
        "This class surfaces HBA adapter events",
        "C_EAB06445AE40CB0AB3321BBA04962C98586E49396B67AFD5B74F4985163D9EC2",
        "C_CC0ACF58FA3646F311BC16A78942AC6DB48973323025BC27052C3593D5CE6061",
        "JobIdCopy",
        "ErrorGranularity",
        "MinorErrorCount",
        "Number of errors that occurred on this device",
        "ResumeService",
        "This field is a string representation of the physical disk's software version.",
        "Fully Associative",
        "WPDShServiceObj_f1",
        "encryptionType",
        "The Win32_DCOMApplicationAccessAllowedSetting class is an association between the Win32_DCOMApplication and the user sid's that can access it",
        "Win32_ServiceSpecificationService",
        "MIF.DMTF|UPS Battery|001.2",
        " lette",
        "HP MPE",
        "CD_FAE2ECC09FED2EB4B7A4EC8980CE634E75CF805CEDF86064A82170B68F9B5074.1526.3860091587.357",
        "Policy that shall be employed by the cache for handling read requests. For example, \"Read\", \"Read-Ahead\" or both can be specified using the values, 3, 4 or 5, respectively. If the read policy is determined individually (ie, for each request), then the value 6 (\"Determination per I/O\") should be specified. \"Other\" (1) and \"Unknown\" (2) are also valid values.",
        "Win32API|Device Input and Output Structures|DISK_GEOMETRY|MediaType|FixedMedia",
        "The nature of the service to service dependency. This property describes that the associated service must have completed (value=2), must be started (3) or must not be started (4) in order for the service to function.",
        "CD_9775D7E59301DC60631DCE98F8981384E13FBB752E9A4E20554B45DDF5046735.2528.3323910669.1959",
        "Transient Error",
        "Stack20",
        "MSFT_ExpressionLambda",
        "MDM_Policy_Result01_DeliveryOptimization02",
        "Extended Partition",
        "Partition access path is not available for replication group.",
        "_DH_WMP_SYNC",
        "Unused",
        "NdisCoDriverVersion",
        "ProductKeyChannel",
        "SPACES_StorageSubsystemToMaskingSet",
        "{1cf5fd19-1ac1-4324-84f7-970a634a91ee}",
        "SetByXml",
        "Leak Detected",
        "IL_100109F264418A8891B8DA48D69393178E571025D114D35005EB8841D88FAEA5.1163.3162972686.263",
        "CurrentBIOSMinorVersion",
        "watt * 10^-3",
        "MDM_Reboot_Schedule01",
        "This class supplies the binary mof information",
        "CIM_SlotInSlot",
        "Forces the removal of Application ID from the VPN profile.",
        "UniqueAdapterId",
        "BasePriority",
        "Registry_HiveRundown",
        "Count of the number of times login failed due to negotiation failure with target",
        "ROOT\\cimv2\\ms_409",
        "NS_70510928A17E0AE7C516357BFE4903931B93CD566BD3293C433D896D0FD7AFC0\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_B84D4A8F309AF2F6984062AB08B3B336381470849C9D00DBE645D458571018B8",
        "Bandwidth assignments per Traffic Class.",
        "CD_8E41820F5D3747F37A9AFB4C6D31D95936F76250DC1731B0B518951FA4D1C211.2028.1.18314",
        "The signature validation options of the node.",
        "ISCSI_ERR_HEADER_DIGEST_ERROR",
        "SW_SHOWNORMAL",
        "RequestType",
        "Adaptive",
        "ref:Win32_ODBCDataSourceSpecification",
        "ThreadNum",
        "Thread_V2",
        "Week of manufacture (1..53, 0 = undefined)",
        "0xD010 - 'Online': In Windows-based storage subsystems, this indicates that the object is online.",
        "RSOP_PolmkrDialupOptionSetting",
        "I_663060429A6938D1B4C13319904DC9CB4D95E1E1D71EE9B0A8EA8DACAE58E45C.516.1.45904",
        "Returns the status (0=fail, 1=success, 2=interrupted) of the last restore.",
        " 0x02FFh.",
        "VersionMax",
        "Reserved (only available in Win64)",
        "Information about the connections for this session",
        "Name of the VPN connection profile",
        "NewAllocAddress",
        "The WriteTransferCount property specifies the amount of data written.",
        "Healthy",
        "SamSetSecurityObj",
        "    // informationalSession  - session is used for a limited number of scsi commands",
        "Reference to the imported program settings.",
        "CD_DA8AC0D78FD1B90698550FC0FF5C609171143A2B0FA32F0B779BC5DC2D3441C8.37.124095850.961",
        "DACType",
        "Number of the sensor that generated the event",
        "Identifies the GPO that contains this Policy Object",
        "Flags passed to the providers. Reserved for future use.",
        "Encryption method plumbed in IKE policy.",
        "41022",
        "ADActivationObjectName",
        "Basic input/output services (BIOS) management.",
        "R_C21BFFFCE15B0AC36B6B41107E5EBBFA7DCF9522B5F1767BA6C1E65ABBEDE3D8",
        "CD_90474CF00D4AF038E01AFFE1D325BE4CFECCFEC8C771DBEF31ED1256C9A59468.2528.371700746.656",
        "PortableOperatingSystem",
        "QuotaPagedPoolUsage",
        "NS_FE3EA006C3292950A76C2B5A0185D7DF99ADD6FD6502E0AC079E3A8650E76E3A\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_FDC07BF412EF517BF16CBEA0AD032C8FE94CB2DD73B9CD909C08659DB8C5BC0A",
        "Flush",
        "If TRUE the iSCSI Initiator service will perform any DNS lookup and pass binary IP addresses to the adapter; the adapter must be on the same network as the Windows TCP/IP stack. If FALSE then DNS must be available on adapter.",
        "C_3CFCAB1516C75164A42E3401D0ADF64A4765F50E4818FC30D95B8671DE07D069",
        "SupportsEncryption",
        "RSSPlatformBackgroundsyncTraceProvider",
        "MS_SMHBA_PORTATTRIBUTES",
        "CR_EA2F4ED6B8AA0BEEE14A7235028BAD0C1DDD97703732E8317B8FE1581E43A3CF",
        "Win32_ShadowCopy",
        "IPv6ExtensionHashEnabled",
        "The remaining time to charge the battery fully in minutes at the current charging rate and usage.",
        "Unconditional Rule",
        "SignatureStatus",
        "Example: 168 (hours per week",
        "SMBIOS|Type 10|Description",
        "Win32_Condition",
        "Reserved5 Flag",
        "R_E0728E680677E2DC755DB0B32FACA9688F4B71D12279046ADFB604C5714997EF",
        "The QuotasEnabled property indicates that quota management is enabled for this volume.",
        "CD_F78D535F784AB5BF2A7DF53DE5ACAAF1C73DACC48189425DF45543879C147259.21.3889884863.562",
        "The MAC address filter.",
        "MIF.DMTF|Video|003.15",
        "Win32API|Windows Networking Functions|WNetGetUser",
        "NumberOfDataCopiesMax",
        "The CollectionOfMSEs object allows the grouping of ManagedSystemElements for the purposes of associating Settings and Configurations. It is abstract to require further definition and semantic refinement in subclasses. The CollectionOfMSEs object does not carry any state or status information, but only represents a grouping or 'bag' of Elements. For this reason, it is incorrect to subclass groups that have state/status from CollectionOfMSEs - an example is CIM_RedundancyGroup (which is correctly subclassed from LogicalElement).",
        "Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly",
        "The Antecedent reference represents resources used by this session.",
        "MSNdis_StatusLinkSpeedChange",
        "d-m;d-m;",
        "Target Moved Permamently",
        "IntegrationAllowRootGlobal",
        "NdisPMAdminConfigStateUnspecified",
        "NPIV operations that can be performed on a physical adapter",
        "TROJAN_DROPPER",
        "{8B98D3F3-3CC6-0B9C-6651-9649CCE5C752}",
        "CD_1BEC388ED8B3DBC0D0D66BF6CA421BBFADBD5A16B9BFFBD5E8B6E83ED38EB253.2113.1859148367.4249",
        "BindName",
        "CD_8E07A2F75E966B98765D0E68961E5A84D43A10AD950CED298EB40220B7B9296C.295.3702337040.790",
        "Counter7",
        "QueryDomainInfoPolicy_Start",
        "MonthlyGroupBytes",
        "AllowAutofill",
        "Pool Event",
        "CR_CEDA967BE18BB6CFCE80E11488429372F9B550100D4D99059A8B8A740BD83EBB",
        "Default action for severe severity threats.",
        "Win32API|Service Functions|CreateServicelpServiceName",
        "REMOVE",
        "59004",
        "In Use and Available/Shareable",
        "The Win32_ParallelPort class represents the properties of a parallel port on a Win32 computer system.",
        "List of recovery point values based on recovery point indicator",
        "SAM Query Display Information",
        "CIM_ReplicationServiceCapabilities.SupportedReplicationTypes",
        "Operation was not successful for all initiators.",
        "{8502C539-5FBB-11D2-AAC1-006008C78BC7}",
        "Enumeration corresponding to the category enum in MI.h",
        "ipDNSAddress",
        "MDM_EnterpriseModernAppManagement_StoreLicenses02_01",
        "MaximumSize",
        "8E-E86",
        "Win32_ProcessStartup",
        "SamConnect_Start",
        "XOffXMitThreshold",
        "C_1333CB41C7BFD90D640EF18568976AC9246A93F3945F32BDDD813256745C7061",
        "SourceProcessorIndex",
        "This method allows the user to update or set various attributes on the virtual disk. Note that not all parameters must be specified, and only those given will be updated.",
        "UseSuffixSearchList",
        "AllowIntrusionPreventionSystem",
        "DataSequenceInOrder",
        "DriveType",
        "LOCK_API Flag",
        "LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents",
        "This class is used to define the capabilities of the NVGRE encapsulation type supported by a network adapter for task offloads.",
        "Cleaned",
        "Set Volume Information",
        "SamOpenGrp",
        "Uses hardware",
        "Win32API|Network Management Structures|SHARE_INFO_1|shi1_netname",
        "ExactlyOnce",
        "The Win32_SystemTimeZone class represents an association between a computer system and a time zone.",
        "ValueLimit",
        "\\\\.\\root\\Microsoft\\Windows\\Storage\\PT\\Alt:__Win32Provider.Name=\"DelegatorProvider\"",
        "This class is used to report QoS capabilities on a network adapter.",
        "MFTSize",
        "The primary availability and status of the Device. (Additional status information can be specified using the Additional Availability array property.) For example, the Availability property indicates that the Device is running and has full power (value=3), or is in a warning (4), test (5), degraded (10) or power save state (values 13-15 and 17). Regarding the Power Save states, these are defined as follows: Value 13 (\"Power Save - Unknown\") indicates that the Device is known to be in a power save mode, but its exact status in this mode is unknown; 14 (\"Power Save - Low Power Mode\") indicates that the Device is in a power save state but still functioning, and may exhibit degraded performance; 15 (\"Power Save - Standby\") describes that the Device is not functioning but could be brought to full power 'quickly'; and value 17 (\"Power Save - Warning\") indicates that the Device is in a warning state, though also in a power save mode.",
        "MSFT_NetPrefixPolicy",
        "Login Negotiation Failed",
        "iScsiFlagUnit",
        "The PageFileUsage property indicates the amountof page file space currently being used by the process./nExample: 102435",
        "{E068FEBB-6D51-4c15-9725-CB96A3746838}",
        "Acpi _PCT object",
        "ResiliencySetting is a detailed description of the resiliency capabilities offered by a storage pool. A storage pool can have one or more of these settings. It specifies a series of properties with a minimum, maximum, and default value. The minimum and maximum values may not reflect the current capabilities of the storage pool, but rather the ideal range of capabilities offered by the subsystem. The default values will be used when creating new virtual disks unless overridden.",
        "Disable_BCServeOnBattery",
        "Win32API|Windows Networking Structures|NETRESOURCE|lpRemoteName",
        "DefaultTTL",
        "A list of Win32 machine architectures supported by this application.",
        "{9EE72A18-7BD4-44E1-8BA9-1E8E60D8CCA3}",
        "String UNC path of the File resource manager",
        "Win32_TerminalSetting",
        "INDEXES Flag",
        "89 - Duplicate network number",
        "SANegotiationAction is the base class for negotiated SAs. It is abstract, specifying the common parameters that control the IPsec phase 1 and phase 2 negotiations.",
        "TRACINGLOCKING Flag",
        "senseData",
        "Specifies the profile for RDP experience.",
        "{88F073D8-DB35-11d2-85FC-0000F8102E5F}",
        "FileInfoCacheEntriesMax",
        "Microsoft Defender Antivirus Preferences Class",
        "Kerberos Accept Security Context Handler",
        "RecvIPV4",
        "AtLogOn",
        "The LocalServer32 property contains the full path to a 32-bit local server application.",
        "The Name property indicates the alias given to a path set up as a share on a  system.",
        "roperty specifies the maximum number of bytes allowed in the input buffer before the XOFF character is sent.",
        "Platform",
        "MDM_Policy_Result01_TaskManager02",
        "Example: 00:80:C7:8F:6C:96",
        "Member Server",
        "0x80050048",
        "The physical connector.",
        "IR_D5015F0F522081FD020EE5B4501E138DF661E57BB72BDD7C27479EFFDC65FAEE",
        "CD_C17EBBF86D4537DC1A3044DCC316F63FF8183E01B0197617CF6F88A826A1D730.1734.1122796058.527",
        "Example: 1  ",
        "The DaylightYear property indicates the year when daylight saving time is in effect. This member is not required.",
        "TRACE_CLASS_REQUEST Flag",
        "The maximum characters allowed in XML element content.",
        "CreateElementReplica",
        "{7250D62E-E3D0-11d2-8601-0000F8102E5F}",
        "CIM_OperatingSystem.Version",
        "IPsecRuleDisplayName",
        "MSMCAEvent_MemoryError",
        "EncryptionMethodFlags",
        "Example: A Microsoft Natural(R) keyboard",
        "CIM_Slot",
        "CurrentSizeOnDiskAsNumberOfBytes",
        "AllowMUUpdateService",
        "R_F7081F5A6CF52C9F216602AC246801E052220B10F614083361A2E39F71967154.2458.1636221751.554",
        "aption",
        "CommandLineArguments",
        "SupportsUpdate",
        "MSFC_HBAAdapterMethods",
        "object:MSFT_NetAdapterBindingSettingData",
        "Time of last Full Scan end - If this has never updated you will see a null value in this property",
        "This output parameter will contain an array of all of the supported sizes by the storage pool. This parameter may be NULL if the number of supported sizes is large, but is useful for storage pools that support only a select number of virtual disk sizes.",
        "NDIS FDDI Frame Errors",
        "TRACE_CLASS_EMIT",
        "{1008CCE8-7BFF-11D2-AAD2-006008C78BC7}",
        "PAL N",
        "SidLength",
        "CIM_RunningOS",
        "HardPageFault",
        "MCA_WARNING_CPU_BUS",
        "LastProfileUploadIntervalUnhealthyInHours",
        "The CIM_Card class represents a type of physical container that can be plugged into another card or hosting board, or is itself a hosting board/motherboard in a chassis. The CIM_Card class includes any package capable of carrying signals and providing a mounting point for  physical components, such as chips, or other physical packages, such as other cards.",
        "No element level StorageSynchronized",
        "The PartComponent reference represents the Win32_BaseService containing the base service that is a member of a load order group",
        "Example: PCIBus",
        "TunnelType",
        "Severity Of Startup Failure",
        "MDM_ClientCertificateInstall_SCEP01_01",
        "CR_31380B1CBE2DE48F4953061E943634793359C618E73F753682430004D4E36FB0",
        "LPCDRVR_TRACE_DEVICE",
        "MSNdis_PMAdminConfigState",
        "RecoveryEnvironmentAuthentication",
        "MDM_WebApplication",
        "ref:Win32_WMISetting",
        "Created",
        "On Board Floppy Connector",
        "0xEFFF0045",
        "This specifies that different dialog boxes are presented to the user at logon for Single Sign On, if applicable.",
        "HBAScsiID",
        "Hot Icon Path",
        "TeredoEnabled",
        "Boolean indicating whether the flat panel supports color display.",
        "PropertyName",
        "LossOfSignalCount",
        "PS_DnsClientNrptPolicy",
        "PLATFORM_RESPONDER_ID",
        "The property can take the following values:  ",
        "Precommitted",
        "MSFT_FileIntegrity",
        "SetOneTimeBootSource",
        "DeviceAccesses",
        "The StartFileName input parameter is a string that names the child file/directory to use as a starting point for TakeOwnerShipEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from the previous method call. If this parameter is NULL, the operation is performed on the file ordirectory specified in the ExecMethod call.",
        "If true, return synthesized quad-A response even if A record was found",
        "CIM_Rack.CountryDesignation",
        "A link between the file system and the logical file(s) addressed through this file system.",
        "MaxDataWidth",
        "The KeyboardPasswordStatus property identifies the system-wide hardware security settings for Keyboard Password Status.",
        "INTAP",
        "100-ohm Coaxial",
        "areaCode",
        "\\\\.\\ROOT\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_TSPublishedApplication_Prov\"",
        "StopByPath",
        "OpenTrustedDomain",
        "The Virtual LAN Identifier set on the network adapter.",
        "The object with security settings",
        "CD_A340B5A350335A2F698A9D474151FF7803797C56DD9A727636F061641184011B.1090.2855886365.205",
        "Win32_ThreadStartTrace",
        "{4BCCBCE4-20E8-44A1-A170-C9A4D941CBA4}",
        "7..64999",
        "The Win32_TSClientSetting class defines the configuration for Win32_Terminal. This includes capabilities such as Connection policy, printer, drive, clipboard mappings, color depth and connection settings.",
        "LogonTotal",
        "} ISCSI_DIGEST_TYPES, *PISCSI_DIGEST_TYPES;",
        "C_318C41B790C73AD23330721F5FA83CE8CB8B0D762F5F83DFC686FAFD74664F53",
        "Ndis80211SsIdLength",
        "The PartComponent reference represents the process running on the computer system.",
        "The FileName input parameter is a string representing the fully qualified name of the copy of the file (or directory). Example: c:\\temp\\newdirectory.",
        "queryvolinfo",
        "The StartingAddress property contains the starting address of memory mapped I/O. ",
        "This method allows the user to update or set various properties on the virtual disk. Note that not all parameters must be specified, and only those given will be updated.",
        "NS_37FD5386C028E960C90BC77B9D8DDCA28B24BAE2E315E8D8209BF5E2633575D8\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_BC000CFE04C2A23B745105FB1571CA3D890D9580D1AA6746224E398C7587FD84",
        "ConfigString",
        "Represents an IPsec Rule.  Subtypes differentiate between Connection Security Rules (MSFT_NetConSecRule) and Main Mode Rules (MSFT_NetMainModeRule).",
        "NoFragmentation",
        "Lock Count",
        "LogFileMode",
        "Certificate selection criteria: Enhanced key usages with Comma as delimiter. Matching on all specified EKUs",
        "The 802.11 received signal strength in dBm",
        "MustUnderstandBehavior",
        "CompletionQueueErrors",
        "DisableDualScan",
        "object:MSFC_EventBuffer",
        "Zinc air",
        "DefaultPaperType",
        "LevelOfControl",
        "Security Flag",
        "Proprietary I/O Riser Slot",
        "CreateWinstation",
        "Power Save - Unknown",
        "TRACE_LEVEL_WARNINGTRACE_LEVEL_INFORMATION",
        "The protected space extent which is built on the physical extent.",
        "{bf31b34a-fcdf-45f3-a777-badecf0ad4b2}",
        "SDBUS_DEBUG_INFO",
        "MSNdis_StatusDot11PhyStateChange",
        "CD_43D2FF9F27C9DEB49402058FFFFEABC225D67F17C30DC663FA2980525D05DB01.1671.1261015942.363",
        "I/O Flush Buffers Event",
        "823F90DAEC78BAF38771F45D60A37B0917DC6BBE974DF07B97707A15F13.2451.111154847.344",
        "Bus Error Type",
        "MSFC_AdapterEvent",
        "BlindOff",
        "NetworkAdapterDescription",
        "CD_803E283D75B31FC987B7EC08347BA9088A22475CEE4377C7AE84C9F0F1991181.1667.1254924834.995",
        "STORAGE_SCSI_INFO_EXCEPTIONS",
        "IPv4Connectivity",
        "Uncompress",
        "C_5CEE3E694DB50EA9714886DD418F6CA358B9A4D6FD8DAFD5BAAA13B6529F39A0",
        "0xEFFF0052",
        "40012",
        "_DH_WMP_DEVICE_CAPS",
        "A snapshot error occurred while scanning this drive. You can try again, but if this problem persists, run an offline scan and fix.",
        "LogInstanceID",
        "X*m;X*m;",
        "Destination prefix of the route to be removed",
        "\"Degraded/Warning\" (10) - The element is in working order and all functionality is provided. However, the element is not working to the best of its abilities. For example, the element might not be operating at optimal performance or it might be reporting recoverable errors. ",
        "fG|kK",
        "BuildVersion",
        "SidTypeComputer",
        "Cautious threshold, in hours. If the number of hours since the last attempted synchronization is greater than or equal to this threshold, the HealthStatus property of the Win32_FolderRedirectionHealth class is set to Caution.",
        "00.314.1352278839.435",
        "SeCreatePagefilePrivilege",
        "\\\\.\\root\\Microsoft\\Windows\\Storage\\providers_v2:__Win32Provider.Name=\"wsp_health\"",
        "Use deployment-wide licensing settings, as opposed to setting them per-server.  If this is set to false, all other licensing settings are ignored.",
        "RemoteSize",
        "{6e0e9528-e2d9-42e4-82f9-124727330ed9}",
        "Call Result Data",
        "%1: The storage management provider has not been authenticated with the storage subsystem \"%2\". Extra configuration may be required.%3",
        "ParkFlags",
        "SamUserPwdSet_End",
        "The Element reference represents the user account whose desktop can be customized by the Settings property of this class.",
        "Win32_IniFileSpecification",
        "MsftDiscFormat2MsfAddress_DebugDestructor Flag",
        "Select * from Win32_NetworkAdapter",
        "A bit map representing the operations for which this object applies. The following are the valid values ",
        "Win32_NetworkConnection",
        "BAUD_2400",
        "Specifies that the VPN connection should be retrieved from the AllUserConnection phone book entries.",
        "CIM_CacheMemory",
        "MDM_PassportForWork",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|TcpMaxDataRetransmissions",
        "PossibleLicensingTypes",
        "1  - The maximum outbound (send) message size is dependent on the underlying network MTU (maximum sized transmission unit) and hence cannot be known until after a socket is bound. Applications should use getsockopt to retrieve the value of SO_MAX_MSG_SIZE after the socket has been bound to a local address.",
        "Indicates the number of target ports that can be used for masking a virtual disk. This applies to both masking sets and the virtual disk Show method.",
        "_DH_WMPGRAPH Flag",
        "ObjectAccess_AuditOtherObjectAccessEvents",
        "This property indicates how the operating system will proceed with repairing of virtual disks for this storage pool.",
        "Contains a serialized certitificate store containing all of the certificates from the machine's MY store which are valid server certificates for use with Terminal Server SSL.",
        "NDISWMI_TRACE_STATS Flag",
        "DH group plumbed in IPsec policy.",
        "Time that this object was created",
        "where the individual role names appear in alphabetical order (according to the collating sequence for UCS-2). Implementations may treat PolicyRoles values that are specified as \\'role combinations\\' as simple strings. ",
        "Set iSCSI RADIUS Shared Secret",
        "CD_9D6744533171E0AA4C64E98982376A00322E3135FA3701918441437BEC34C877.1090.2481674859.179",
        "ActiveHeight",
        "Capabilities and management of the scanner logical device.",
        "WmiSetLinkParameters",
        "NDISWMI_TRACE_POWER",
        "MSFT_OdbcKeyValuePair",
        "QryTrstDomByNam",
        "46005",
        "DiskSpaceLimitParams",
        "Bus error severity. The encodings of error severity are platform specific",
        "MSFT_NetAdapterVmqQueueElementSetting",
        "SuspendJobByObject",
        "MSNdis",
        "C_9B47552D4116308DF54B1B8BABEB3824E2EAF0C2CFA9CF24D51A58C19C8849E8",
        "PlatformValidationProfile",
        "6 - Environmental Error. Errors of this type are principally associated with a failure condition relating the to facility, or other environmental considerations. ",
        "X.25 Hunt Group",
        "B98E34E7C718B63E6",
        "Reverse Roles operation requires Synchronized state",
        "The ConnectionType property indicates the persistence type of the connection used for connecting to the network.",
        "frequency",
        "Used for compliance to determine if certificate matching the enrollment request and criteria is issued",
        "NoMachineLuidVerify",
        "AllUsers",
        "Xenix Type 2",
        "PLATFORM_TRACE_RESERVED_1b Flag",
        "No Toner",
        "The Element reference represents the computer system containing the logical program group.",
        "PCI_BUS_OEM_DATA_STRUCT is valid",
        "root\\cimv2",
        "    // 1 = IKE/IPSec Enabled; 0 = IKE/IPSec Disabled",
        "Binary Data",
        "object:MSFT_ReplicationGroup",
        "The ReservedSystemPaletteEntries property indicates the current number of reserved entries in a system's color table. The operating system may reserve entries to support standard colors for task bars and other desktop display items. If the system is not using a palette, then ReservedSystemPaletteEntries is null.<P>Example: 24.",
        "The Name property uniquely identifies the service and provides an indication of the functionality that is managed.  ",
        "This indicates the time in seconds before stale data will be moved off of the physical disks in this storage scale unit.",
        "CIM_ClusterServiceAccessBySAP",
        "A physical component is removable if it is designed to be taken in and out of the physical container in which it is normally found, without impairing the function of the overall packaging. A component can still be removable if power must be 'off' in order to perform the removal. If power can be 'on' and the component removed, then the element is removable and can be hot swapped. For example, an upgradeable processor chip is removable.",
        "DevolutionLevel",
        "SlotSelectionEnabled",
        "The SourceRouteType property indicates the type of source route option to be used on host list specified in the SourceRoute property. If a value outside of the ValueMap is specified 0 is assumed. The default  is zero.",
        "{0e3913c5-9760-4ced-b133-004a64e8d53c}",
        "DBNETLIB.1",
        "DisallowAutoplayForNonVolumeDevices",
        "The remote port used for the connection",
        "DisableUpdateCheck",
        "Writes printer connection data to the next NFC tag tapped against the system\\'s default NFC writer.",
        "PlacementStatus",
        "Win32_TSGetIcon",
        "Packet",
        "Ribbon",
        "CIM_LogRecord.RecordFormat",
        "FX_TRACE_RESERVED_18 Flag",
        "C_DACB9CF054C4E86C828A247EC8DC850FA3036240686D11B03BDFBEB866D387C6",
        "{98C7E2C6-D592-11d2-B355-00105A0A323A}",
        "List of resources affected by the threat",
        "__EventFilter.Name=\"SCM Event Log Filter\"",
        "CD_F288534564F7CEA5A7BE0115B4FF5B20B967ADA096D3CA8E077825C980B49E14.1741.2768674400.355",
        "Information has changed since the lass",
        "CommunicationMode",
        "sSubKeyName",
        "{0E17B9EA-E3D3-11d2-8601-0000F8102E5F}",
        "RSOP_RegistryPolicySetting",
        "Denotes the file system types supported for Deduplication in this subsystem.",
        "The Win32_OperatingSystemQFE class represents an association between an operating system and product updates applied as represented in Win32_QuickFixEngineering.",
        "TxFrames",
        "Issuer",
        "SizeMax",
        "RemoveByMappingNameParameterSet",
        "97B5616538EF4A2537CF0ACB8ADFCD77134622191BFAD44A946A34F0.1352.2211812683.194",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pDataType",
        "Hardware Error",
        "SecurityDescriptorString",
        "Entries in the NT Event Log.  ",
        "Process_V2",
        "The Win32_ClassicCOMClassSetting class represents the settings of a COM component.",
        "// SetLoadBalancePolicy instructs the iSCSI Initiator what Load Balance",
        "SetDefaultTTL",
        "MSFT_NetDnsTransitionMonitoring",
        "PCI_BUS_ERROR_TYPE",
        "The locale-independent name of the rule.  May be an indirect string.",
        "Abnormal Latency",
        "Performance Data",
        "MIF.DMTF|System Cache|003.10",
        "CEFB1E634599916220181F35C3DB70B94808983CB78C381325F1AAF3",
        "C_3A4B092E649E9EDDE3FA5F08BAF4EBD82A1D1063DB19A1DD0454E516CA8119BC",
        "The GroupComponent reference represents the Win32_ComputerSystem containing the properties of the computer system on which the processor is running.",
        "SCSIBus",
        "interval",
        "UMLPackagePath",
        "AcceptedConnections",
        "C_A65407F850C2BCA806A67DD48A46ADD12B41F479B7F5CB65FF34B01AEAFD8220",
        "ROOT\\interop",
        "additionalSenseCodeQualifier",
        "SetArpAlwaysSourceRoute",
        "Limit Job Memory - Causes all processes associated with the job to limit the job-wide sum of their committed memory. When a process attempts to commit memory that would exceed the job-wide limit, it fails. If the job object is associated with a completion port, a JOB_OBJECT_MSG_JOB_MEMORY_LIMIT message is sent to the completion port. ",
        "CR_9A36BB4E390B7DD04D76CD832679A7EB96B353EDC2C276A7C316493A7FCF4652",
        "VirtualName",
        "WMI|Win32_MemoryArray",
        "The transaction protocol used in flowing a transaction.",
        "LoginOptions",
        "MDM_Policy_User_Config01_CredentialsUI02",
        "MSFT_NetServiceStartTypeChanged",
        "The Create function submits a job to the operating system for execution at a specified future time and date.  This function requires that the schedule service be started at the computer towhich the job is submitted. The method returns an integer value which can be interpretted as follows: ",
        "A text string specifying the name of the driver for the adapter",
        "RecordID, with the MessageTimestamp property, serve to uniquely identify the LogRecord within a MessageLog. Note that this property is different than the RecordNumber parameters of the MessageLog methods. The latter are ordinal values only, useful to track position when iterating through a Log. On the other hand, RecordID is truly an identifier for an instance of LogRecord. It may be set to the record\\'s ordinal position, but this is not required.",
        "Counter4",
        "{FF7DA3FC-DB32-11d2-85FC-0000F8102E5F}",
        "MaxCapacityEx",
        "MaxConcurrentCalls",
        "WMIPingProvider",
        "iSCSIInterface",
        "CD_A3CFA2EA2CF7EBAE83315F59909BFC6F8978ACBDBD24E7ACA6B979B7B86A9975.1226.341122162.4158",
        "HideAppList",
        "ConnectionInfo",
        "MSNdis_FddiDownstreamNodeLong",
        "Example: ab.inf",
        "Gets the current state of all storage settings for the computer.",
        "HideWindowsSecurityNotificationAreaControl",
        "IsActivated_InitialValue",
        "LowerThresholdCritica",
        "The Antecedent reference represents the Win32_LogicalProgramGroup associated with the file directory.",
        "C_BC68F03B4B8F91EBABF0C9EFED9C57ABF605182A4D8760A0679947CF4F1C5F19",
        "Invalid subnet m",
        "Denotes the reason why this virtual disk is detached. This field will only be set when the virtual disk's OperationalStatus includes 0xD002 - 'Detached'. Note that this field is specific to Storage Spaces.",
        "The CIM_ComputerSystem object and its derivatives are Top Level Objects of CIM. They provide the scope for numerous components. Having unique CIM_System keys is required. A heuristic is defined to create the CIM_ComputerSystem name to attempt to always generate the same name, independent of discovery protocol. This prevents inventory and management problems where the same asset or entity is discovered multiple times, but can not be resolved to a single object. Use of the heuristic is optional, but recommended. /n The NameFormat property identifies how the computer system name is generated, using a heuristic. The heuristic is outlined, in detail, in the CIM V2 Common Model specification. It assumes that the documented rules are traversed in order, to determine and assign a name. The NameFormat values list defines the precedence order for assigning the computer system name. Several rules do map to the same Value. /n Note that the CIM_ComputerSystem Name calculated using the heuristic is the system's key value. Other names can be assigned and used for the CIM_ComputerSystem, that better suit the business, using Aliases.",
        "VirtualDiskRepairEnabled",
        "CR_EC87315EA07FEB82B95B6ECC853900B53DFD9FAE520CF4C1FE8CD7F52B679C09",
        "FeatureSet",
        "The DataType property indicates the format of the data for this print job. This instructs the printer driver to eithertranslate the data (generic text, PostScript, or PCL) before printing, or to print in a raw format (for graphics and pictures).",
        "object:MSNdis_ReceiveQueueInfoArray",
        "CertNameType",
        "MDM_Update_FailedUpdates01_01",
        "Storage Device Failure Prediction Functions",
        "The name of the source that generated the event.",
        "SetPhysicalPresenceRequest",
        "EVENT_TRACE_FLAG_O",
        "NumberofPhys",
        "The ScreenSaverTimeout property indicates the amount of time that passes before the screen saver starts.",
        "An association between a computer system and the memory mapped I/O ports available on it.",
        "The Antecedent reference represents the properties of the logical device that is being used by the data file.",
        "HypercallPage",
        "IdleSessionLimit",
        "KeyHandle",
        "Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PeakWorkingSetSize",
        "Enabled but Offline (6) indicates that the element may be completing commands, and will drop any new requests. ",
        "CustomStoreUrl",
        "packageFamilyName",
        "SessionType",
        "\\\\.\\Root\\Policy:__Win32Provider.Name=\"PolicSOM\"",
        "The Win32_DiskPartition class represents the capabilities and management capacity of a partitioned area of a physical disk on a Win32 system.",
        "Property to control Ipsec tunnel encryption settings.",
        "If TRUE, language is ignored when determining whether this application applies to a user or machine. If FALSE, language is taken into consideration.",
        "The Dependent reference represents the system driver that uses the network adapter through the network protocol of this class.",
        "MaxPoolSize",
        "MegaBytes",
        "TRUE if adapter should perform target discovery via SLP.",
        "Storage departure events are used whenever a storage object is removed or deleted.",
        "SpecifyMaxProcesses",
        "CPU Disabled by User via BIOS Setup",
        "Specifies whether to use the current synchronization context to choose the thread execution.",
        "CR_931EBC392DC240CC5527C3CA3643FE44E050E39FDDD4B5A76F950F248E19E470",
        "CD_5953574AD268C37F4681AD557CF3BEA3442C419F9086A8F65CC3774027E8952E.1149.1308959200.466",
        "Target elements can be added to collections",
        "{3CACB2F3-A6AB-4DCB-8CA7-3BF4D75BEDA8}",
        "This device does not have valid log configuration.",
        "StackWalk_Event",
        "Number of Acknowledgement failures",
        "PC-98Note",
        "DSPrimaryDomainControllerFlag",
        "ParameterTypes",
        "RenewDHCPLease",
        "e-printjob cmdlet will resume a print job",
        "Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpDisplayName",
        "ProviderOperation_QueryInstances",
        "HBA_EVENT_ADAPTER_UNKNOWN",
        "{af9b60a0-1431-4f62-bc68-3311714a69ad}",
        "The Win32_DependentService class represents an association between two interdependent base services.",
        "C2 latency",
        "MDM_Policy_Config01_Autoplay02",
        "Landscape",
        "Do Until Success - execute actions according to predefined order, until successful execution of a single action. ",
        "searchBarURL",
        "The Element reference represents the Win32_SerialPort containing the properties of a serial port on the computer system.",
        "LUAInstall: error 0x00000005 setting flags [{743F1DC6-5ABA-429F-8BDF-C54D03253DC2}]",
        "{69526f9a-2062-11d4-97eb-00c04f79c403}",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.1165.1252411979.318",
        "Win32API|Service Structures|SERVICE_STATUS|dwControlsAccepted|SERVICE_ACCEPT_PAUSE_CONTINUE",
        "Number of synthesized AAAA queries",
        "R_F7113F6F79893405611B3E0C1184CFF87E4747F2432D2CE16AC2FA972D4FCE30",
        "C_7DB1E30FC06BBCD83555FCA1DA86A907938086DE88B466575ED4B935DD61EAE7",
        "SetIPUseZeroBroadcast",
        "SetSessionDirectoryActive",
        "Kernel Queue Dequeue Event",
        "A persistent binding request included an FCP Logical Unit Number not defined by the identified Target",
        "{8502C4E2-5FBB-11D2-AAC1-006008C78BC7}",
        "IPV4 Address Range",
        "Specifies the cache package to import",
        "AggregationBehavior",
        "{0888e5ef-9b98-4695-979d-e92ce4247224}",
        "CoNDIS Link Speed",
        "C_153A90D31DAA2BB98D107166F8216FEE25A312878D4AECBB89966D3EAC52B5F6",
        "Example: Sportster 56K External.",
        "iSCSI Initiator Node Name",
        "CIM_LinkHasConnector",
        "Audit failure",
        "MDM_Policy_Result01_Messaging02",
        "Win32_PrinterSetting",
        "Specifies the Permissions that are allowed. The permissions are a combination of one or more of the following:WINSTATION_QUERY, WINSTATION_SET, WINSTATION_VIRTUAL | STANDARD_RIGHTS_REQUIRED, WINSTATION_SHADOW,WINSTATION_LOGON, WINSTATION_LOGOFF, WINSTATION_MSG, WINSTATION_CONNECT,WINSTATION_DISCONNECT.",
        "C_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45",
        "R_7C47B73E5E9A5506254AEC98C6F5B5C4749A5453EF79AF4AD8EFFB7A16B6EBFE",
        "CreatedShare",
        "The BatteryRechargeTime property indicates the time required to fully charge the battery. ",
        "IPv6TransmitTcpOptionsSupported",
        "The SaveStateInOperationTransaction boolean in DurableServiceAttribute",
        "TROJAN_PROXYSERVER",
        "InterfaceIndex",
        "Total swap space in kilobytes. This value may be NULL (unspecified) if swap space is not distinguished from page files.  However, some operating systems distinguish these concepts.  For example, in UNIX, whole processes can be 'swapped out' when the free page list falls and remains below a specified amount.",
        "RDComplete_V0",
        "7D56E94A95716A",
        "LastStartupHeapPreallocation",
        "The User parameter returns the user name of the owner of this process.",
        "DisableByPath",
        "//        Please specify which WMI interfaces the provider will implement by",
        "StartMeasurementDate",
        "Optical",
        "{FA8DE7C4-ACDE-4443-9994-C4E2359A9EDB}",
        "OldIdealProcessorIndex",
        "HeatGeneration",
        "IsAutoTriggerEnabled",
        "MSNdis_CoVendorId",
        "Heap_TypeGroup1",
        "NdisCoLinkSpeed",
        "TrustedSitesZoneAllowUserDataPersistence",
        "The StandardName property indicates the name of the time zone being represented when standard time is in effect.",
        "0x000008",
        "MDM_Policy_Config01_Speech02",
        "ByteCount",
        "LPCDRVR_TRACE_RESERVED_08",
        "MSFT_StorageExtendedStatus",
        "LUAInstall: error 0x00000005 setting flags [{94357B53-CA29-4b78-83AE-E8FE7409134F}]",
        "AGP_RATE_4X",
        "The array of variables and values from the original event",
        "JobCount",
        "Unshielded",
        "Example: ST32171W",
        "Denotes whether storage tiers are supported by the subsystem.",
        "SCSIPath",
        "LockedDownRestrictedSitesZoneAllowAccessToDataSources",
        "__PROPERTY_COUNT",
        "This field is reserved for future releases.",
        "Substitute",
        "This is an XML Stream containing the detailed EAP Configuration for the VPN profile.",
        "Description of the settings location template.",
        "__ExtrinsicEvent",
        "HttpsGetEnabled",
        "TapeSnapped",
        "Select * from Win32_DMAChannel",
        "An array of integers indicating printer capabilities. Information such as \"Duplex Printing\" (value=3) or \"Transparency Printing\" (7) is specified in this property.",
        "MDM_Policy_Config01_Printers02",
        "40026",
        "NDIS FDDI LEM Rejects",
        "Association between the security settings of a file/directory and its owner",
        "Win32API|Process and Thread Functions|CreateProcess|lpProcessInformation|dwProcessId",
        "{990E7AE6-DB33-11d2-85FC-0000F8102E5F}",
        "EVENT_TRACE_FLAG_FILESYSCONTROL",
        "object:MSFT_DedupProperties",
        "NdisEncapsulationIeee802_3PAndQInOob",
        "NS_A2A98E75472B9249D4EF445DC9D4C380289067BF73931A828AFBC7CD7964FEBB",
        "srbFlags",
        "SamGetDomPwdInfo",
        "R_ED2E871CAA85DB91DA82D43856C298DADCDDAA2D7C9D06C8655F1779E6509A4E",
        "MIB.IETF|Printer-MIB.hrPrinterStatus",
        "{68fdd900-4a3e-11d1-84f4-0000f80464e3}",
        "MSFT_NetRevertedToLastKnownGood",
        "Not applicable (signal sync type must be [bipolar] analog composite or digital composite)",
        "End Time",
        "NumberOfEvents",
        "FileKey",
        "If TRUE, this method will make use of the CreatedStorageJob out parameter when the request is taking a long time to service. If a storage job has been created to track the operation, this method will return 4096 - 'Method Parameters Checked - Job Started'. Note, even if RunAsJob is TRUE, the method can still return a result if it has finished in sufficient time. ",
        "MSFT_MpSignature",
        "NDIS Query TCP Connection Offload Hardware Config",
        "EVENT_TRACE_FLAG_DISPATCHER",
        "InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles",
        "F25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "The Name property indicates the name of the boot configuration. ",
        "IL_F41AAB3CE0418D59CCEE78DC6089E8A71443DF08351201B015241ECCC0AF9C70.1617.2645183154.291",
        "MDM_DevDetail",
        "The Win32_DiskQuota association class tracks disk space usage for NTFS volumes. System administrators can configure Windows to prevent further disk space use and log an event when a user exceeds a specified disk space limit. They can also log an event when a user exceeds a specified disk space warning level. Note that disk quotas cannot be set for the Administrator accounts themselves.",
        "SendIPV6",
        "Volume Dismount",
        "Extension",
        "The Option input parameter specifies the actual security privilege to be modified. Change_Owner_Security_Information - Change the owner of the logical file. Change_Group_Security_Information - Change the group of the logical file. Change_Dacl_Security_Inf",
        "C_772F556B04D98F51D070688680FBBEB205D86BB8F4E24F468AE459F92ED94CDD",
        "Win32_DfsNodeTarget",
        "NTEventLogEventConsumer.Name=\"SCM Event Log Consumer\"",
        "Win32_LogicalShareAuditing",
        "MSNdis_80211_BssIdListScan",
        "MIF.DMTF|BIOS Characteristic|003.3",
        "ISCSI target portal",
        "The CompatibilityFlags property lists all modem connection protocols with which this modem device is compatible.",
        "LegacySelectiveWipeID",
        "CIM_Job.ErrorCode",
        "RegisteredVersion",
        "ref:RSOP_ExtensionEventSource",
        "NumberOfDataCopies",
        "C_635497AA16B16AF0A6344C164CBD027C88BF47D531661219C8D5DD2913FC696E",
        "Example: 3.",
        "The Vector property indicates the vector of the Win32 IRQ resource. A vector contains the memory address to the function that will execute once the CPU acknowledges the interrupt request.",
        "The FUnjoinOptions parameter specifies the unjoin options. If this parameter is NETSETUP_ACCT_DELETE, the account is disabled when the unjoin occurs. Note that this option does not delete the account. Currently, there are no other unjoin options defined.  ",
        "Non-Critical",
        "RemoteSessionProfile",
        "BytesFromHttp",
        "TRACINGERROR",
        "Indicates the default resiliency setting used for virtual disk creation. This default can be overridden at the time of virtual disk creation. This property's value should correspond to the resiliency setting's Name field.",
        "Boolean indicating whether the IRQ can be shared",
        "object:MSFT_DiskImage",
        "Number of bytes of provider specific data",
        "LockWorkstation",
        "BcdObjectElement",
        "Accounts_EnableGuestAccountStatus",
        "InvalidPackets",
        "MAC Address",
        "22 - CIM_ERR_INVALID_OPERATION_TIMEOUT. The specified Namespace is not empty.",
        "Values: TRUE or FALSE. If TRUE, the system will automatically rebooted.",
        "The AutomaticResetBootOption property determines whether the automatic reset boot option is enabled, i.e. whether the machine will try to reboot after a system failure.",
        "Win32API|MEMORYSTATUS|dwTotalPageFile",
        "_DH_WMP_SYNC_STATUS",
        "SystemConfig_V1",
        "Description of the encryption algorithm when the value 1 (\"Other\") is specified for the property, CipherAlgorithm.",
        "DOMinRAMAllowedToPeer",
        "16     Windows cannot identify all the resources this device uses. ",
        "SpecificationType",
        "LocalSize",
        "IpV6FlowInfo",
        "ExploitProtectionSettings",
        "TcpIp IPV6 Generic",
        "winINetSettings",
        "The source directory.",
        "R_44EA48F1447554EE6A5F1B2B75B3D13F8D9F6E269F5EA85D941FE91968D91A16",
        "MSFT_ExpressionValue_sint16",
        "    // bootSession           - session is being used to boot an initiator",
        "The name of the VPort.",
        "The GroupComponent reference represents the COM application containing the COM component.",
        " ) indicates per machine, ",
        "Win32_QuickFixEngineering",
        "AppInventoryQuery",
        "//        That is:",
        "ConnectionsList",
        "HidePowerButton",
        "An array containing the operational status of each fan of the enclosure. ",
        "Inbound address and port",
        "NDIS Ethernet MAC Options",
        "SectorsPerCluster",
        "The high voltage of input voltage range 2 for this power supply, in millivolts. A value of 0 denotes 'unknown'.",
        "IsIcsPublic",
        "MainModeCryptoSet",
        "EDPShowIcons",
        "preparemdlwrite",
        "MIF.DMTF|Temperature Probe|002.7",
        "ProcessorBiosInfo",
        "CD_24CFB2B4CEAD5BE9188CC5001933580DC2746C05DE76A8DB6DD098D52E4B25F0.1671.922454185.1189",
        "This property represents the name of the optional feature",
        "CIM_BootServiceAccessBySAP",
        "SpinLockConfig_V2",
        "ProtectKeyWithCertificateFile",
        "Service Control Manager Trace",
        "The key to identify the instance of MDM_BrowserSettings class",
        "Disabled",
        "Initialization",
        "I_C0406F771E2762D51D71E72E6570A0AE6C617FB931ABE8CC68B7711AA6A0E7F1.311.3044912591.229",
        "PublicKey",
        "InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl",
        "Ndis80211ReceivedSignalStrength",
        "Number of portals in group",
        "16 - 'Suspending': The copy operation is in the process of being suspended. ",
        "The DNSDomain parameter indicates the domain the DNSis associated with and is represented by an organization name followed by a period and an extension that indicates the type of organization./nExample: microsoft.com.",
        "Specifies the operation should be applied to subfolders",
        "Evaluates a list of SOMs, returns array result codes matching result of evaluating each",
        "TEST_TRACE_FLTRDRIVER",
        "LPC_TRACE_RESERVED_1a Flag",
        "READ_CONTROL",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.1357.1.16908",
        "Indicates whether the automatic data integrity scanner should scrub files on this volume. ",
        "R_DD1327FC08EE6F810BD5622CD5EFD1804CFB8E69E3B82381F2E13055AC3B4DBB",
        "customizeAnimatedBitmaps",
        "TEST_TRACE_RESERVED_18",
        "Network address of neighbor.",
        "The platform architecture of the ODBC driver. Possible values are '32-bit', '64-bit' or 'All'. The default is '32-bit' on a 32-bit process and '64-bit' on a 64-bit process. This is the platform architecture on the remote machine if this command is executed in a remote CIM session.",
        "CIM_PhysicalFrame.SecurityBreach",
        "LUAInstall: error 0x00000005 setting flags [{71A5EC7F-F325-4376-9D94-622C372E256F}]",
        "SupportsStoragePoolRemovePhysicalDisk",
        "This is the integer value of the element.",
        "PrepareVolumeEx",
        "GetCallerAccessRights",
        "CD_A8D86B382CC27EA5869ED6808E06A1A8C7D37476C8DC9964F86AC7B5FA42F3FB.2620.1552047265.1825",
        "CD_939BDE950037625234CD85F8C6B1EA2B080202B0F17AF76D4D121C0816452127.2052.3057883997.159",
        "TRACINGIO Flag",
        "object:PerformanceState",
        "CIM_Product.Name",
        "{0a214805-e35f-11d0-9692-00c04fc3358c}",
        "Self-contained NAS",
        "Performance States",
        "AllowAutomaticRestartSignOn",
        "Certificate selection criteria: Issuer subject names with separator bar as delimiter. Case sensitive matching on one of specified issuers",
        "HOSTPROC_TRACE_USB_DISPATCHER",
        "PA-RISC Family",
        "Speed of the bus, in MHertz, between the processor and memory. ",
        "Hang Up Extra Sample Seconds",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightDate|wYear",
        "p41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "CompressionMethod",
        "MIF.DMTF|System Memory Settings|001.3",
        "EnableStrictNameChecking",
        "OutboundBytes",
        "CD_532671ED26AC2835681FE0B122A526862616ED33CAB2C220F171DB7BD5AD8B02.2059.885129154.3825",
        "NumericSensorUnitModifier",
        "IL_A86E4FE82D68DC639C18ADBD851C146386472289AADBFBB0866B1EEBE2A6C9CD.2688.3131487539.264",
        "No stereo",
        "bGranted",
        "l\"m;l\"m;",
        "Based on RFC1274, the host name of the system(s) for which the account applies. The host name may be a fully-qualified DNS name or it may be an unqualified host name.",
        "GetAccessControlEntries",
        "This field indicates what type of parity layout is being used for parity resiliency settings. This field should be NULL if the virtual disk does not use a parity resiliency setting.",
        "atialPerception_ForceDenyTheseApps",
        "The MediaType property specifies the media type used by (or accessed by) this device. ",
        "RollBack",
        "Modifies the ODBC DSNs represented by the specified ODBC DSN objects. Enter a variable that contains the objects, or type a command or expression that gets the objects.",
        "VerticalActivePixels",
        "{8F680853-A584-11d1-BF38-00A0C9062910}",
        "RestrictedSitesZoneInitializeAndScriptActiveXControls",
        "87 - Invalid frame type",
        "Specifies the path to Rules file for a XOML defined Workflow.",
        "MIF.DMTF|Aggregate Physical Extent|001.2",
        "True if the always send do not track header setting is enabled",
        "CIM_Card.SpecialRequirements",
        "The command line options for configure. These should be in the form of property=setting",
        "IR_8B1547E29C4669664E5C74CF6C63C0DCB167707EDB55532CBAA32AF8A1CDDE88",
        "1 - Windows Server 2003, Enterprise Edition ",
        "Part number of the Key in the OA3 BIOS marker.",
        "VirtualServerName",
        "ChangerProblemType",
        "Status of the cache line",
        "Scheduler",
        "%windir%\\system32\\wbem\\win",
        "Specifies the number of ACKs that will be outstanding before the delayed ACK timer is ignored. Value can range from 1 to 255.",
        "Sw Ecp Write Count",
        "object:PS_VpnConnectionTriggerDnsConfiguration",
        "SysCallAddress",
        "YNumCharacters",
        "Driver",
        "C_05D4D8FA77ED969866E398C6023AE274A4FE95E964B8F30EBE0E3225DB2EC75B",
        "object:MSFT_ExpressionAssignment",
        "Hardware Assisted",
        "32 bit",
        "rsopPrecedence",
        "{5f81cfd0-f046-4342-61af-895acedaefd9}",
        "LocalGPO",
        "NS_59411655A8F95EE7BEABDFB898861DFA8E2BF23293A8AFE96B2E5BB236E7FE01\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_FBF50E9B05799DA2F07A79202B0E7B53E9C07349CE7F1C414483261C33333909",
        "The 802.11 access point MAC address.",
        "schemaNamingContext",
        "76BCA3FFB16063ACA85E663ADBA78B63EC0DAF8A23C68DAD672A3EF9.37.3988981590.441",
        "ref:AppDomainInfo",
        "Associates an object to its security settings",
        "0x8000..0xFFFF",
        "WmiEnumeratePorts",
        "HeapAffinitySlotAssigned",
        "This field is a string representation of the subsystem's firmware version.",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|FlowControl_Off",
        "{486F2A44-D0BF-46c1-9543-68EF5D37F1F9}",
        "LanguageEdition",
        "FX_TRACE_IO Flag",
        "Disk Failure",
        "supportedSASLMechanisms",
        "ref:CIM_Card",
        "The DomainRole property indicates the role this computer plays within its assigned domain-workgroup. The domain-workgroup is a collection of computers on the same network.  For example, the DomainRole property may show this computer is a \"Member Workstation\" (value of [1]).",
        "MsftUtils",
        "Do Until Failure",
        "Interleave Channel",
        "ComputerConfiguration",
        "MaxWindowSize",
        "The session cannot be logged out since a device on that session is currently being used.",
        "{074737F0-ACBC-11d2-ABF6-00805F538618}",
        "RunAsJob",
        "LPC_TRACE_RESERVED_14 Flag",
        "dFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "CurrentPasswords is an array (bag) containing the currently defined passwords for the modem. This array may be left blank for security reasons.",
        "Specifies if a client certificate is required for this binding.",
        "#include <iscsidef.h>",
        "Login Authentication Failed Responses",
        "Describes the name or IPv4 address of the Teredo server.",
        "Conventional PCI 33MHz",
        "C_FCB8F5186AFCE657559BD1E3B7945F03AFA3222D1F02A94B0C21BFF34C6501B2",
        "Win32API",
        "ScheduledThreadId",
        "SPACES_StoragePoolToPhysicalDisk",
        "The AttachDebugger method launches the currently registered debugger for this process.  Dr. Watson, however, is not supported. /nThe method returns a 'generic failure' if it finds an invalid string in the registry key or an integer value that can be interpretted as follows: /n0 - Successful completion./n2 - The user does not have access to the requested information./n3 - The user does not have sufficient privilge./n8 - Unknown failure./n9 - The path specified does not exist./n21 - The specified parameter is invalid./nOther - For integer values other than those listed above, refer to Win32 error code documentation.",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\CrashControl|DumpFile",
        "ValidPeriodUnits",
        "EventTraceEvent_V1",
        "16384",
        "Tunnel mode preferred",
        "Log Address",
        "The Protocol property has two values: 'Raw' indicates printing directly to a device and 'Lpr' indicates printing to device or print server; LPR is a legacy protocol, which will eventually be replaced by RAW. Some printers support only LPR.",
        "TRACE_STACK Flag",
        "Fast-register memory region (FRMR) size (in PAGE_SIZE pages) for which the adapter supports the most number of FRMRs",
        "Final property values of the resource after it is enacted.",
        "Neither slab consolidation nor slab analysis can run if slabs are less than 8 MB.",
        "The Sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If the CurrentReading is between LowerThresholdNonCritical and UpperThresholdNonCritical, then the Sensor is reporting a normal value. If the CurrentReading is between UpperThreshold NonCritical and UpperThresholdCritical, then the CurrentState is NonCritical.",
        "CD_60A55C37A891C02E43DCC85CF24FBB0AEC4CE837463192AE3DF9F07B12D58EBF.2061.1.8698",
        "SystemConfig_V2_DPI",
        "Inbox GCW profile consist of following additional fields: ",
        "ThreatSeverityDefaultAction",
        "Example: \\\\NTRELEASE (c:\\public).",
        "PBLK Address",
        "{44795705-a61b-11d0-8dd4-00c04fc3358c}",
        "MSFC_TM",
        "Capabilities and management of a PC video controller, a subtype of video controller.",
        "Binary Array Value",
        "3221232510",
        "{981f2d85-b1f3-11d0-8dd7-00c04fc3358c}",
        "The formatted message describing the reason for the fault",
        "SMBIOS|Type 8|Port Type",
        "CD_C3440650E548BFF63B5539FA293CA94632CF3A6097074784DC3E6A84D3E44079.315.530971725.1286",
        "The name property is the descriptive name of the provider.",
        "Bytes Read",
        "NDIS Notify Adapter Arrival",
        "Descriptor",
        "Boot Config Info",
        "Is not primary computer",
        "OperationAPI",
        "Localized version of RSOP_PolmkrPowerSchemeSetting for American English",
        "MSNdis_CoReceivePdusNoBuffer",
        "DeleteExistingObject",
        "Failed to enable compression after format completed",
        "CD_362D6A29547775E750DA92891446A0CA4101CA2DDBB5289355E858D0775A2D0A.1977.657345573.2230",
        "IL_A905E989052353FA9D8F60E873BC56BF35837561C775D74EDFE4D77EF4FED58C.1500.283983751.381",
        "yName",
        "The day in the month on which the Job should be processed. There are two different interpretations for this property, depending on the value of DayOfWeek. In one case, RunDay defines the day-in-month on which the Job is processed. This interpretation is used when the DayOfWeek is 0. A positive or negative integer indicates whether the RunDay should be calculated from the beginning or end of the month. For example, 5 indicates the fifth day in the RunMonth and -1 indicates the last day in the RunMonth. ",
        "S-1-5-64-10",
        "DirectoryCacheEntriesMax",
        "{39524FB7-028F-4035-8C2B-8E65D2B17E67}",
        "Private",
        "SMBIOS|Type 7|Current SRAM Type",
        "{8502C4BE-5FBB-11D2-AAC1-006008C78BC7}",
        "CompressEx",
        "Select * from Win32_Process",
        "C_5F36D1944A2418B5A351C20BD9C1B5E3BF64E7FA512D227A09AA6978A5B805AC",
        "C_DDEDD07282B8324F60B5A48A479C1B42607AE5EA149F90058D5C2368C1337E02",
        "The target port address specified is not valid.",
        "CIM_PolicyComponent",
        "Parity Error",
        "MDM_Policy_Config01_ActiveXControls02",
        "StartingOffset",
        "The WINSEnableLMHostsLookup parameter specifies the lookup files containing mappings of IP addresses to host names. If available, the files will be found in %SystemRoot%\\system32\\drivers\\etc.",
        "The major number component of the current BIOS version information.",
        "MSNdis_WmiIPSecOffloadV1_IPv4ESP",
        "CIM_MonitorSetting associates the monitor resolution with the desktop monitor to which it applies.",
        "CD_C17EBBF86D4537DC1A3044DCC316F63FF8183E01B0197617CF6F88A826A1D730.2021.857760628.589",
        "SetExpandedStringValue",
        "Denial of Service Detected",
        "15 - 'CopyInProgress': A deferred background copy operation is in progress to copy the source to the replica target for an UnSyncAssoc association. ",
        "128-bit",
        "The SetTcpMaxConnectRetransmissions method is used to set the number of attempts TCP will retransmit a Connect Request before aborting. The initial retransmission timeout is 3 seconds and doubles for each attempt.",
        "Creates a new local printer port on a given server",
        "ref:CIM_DirectorySpecification",
        "C_84ED32E7ED04F469B11E1DF74E7E118AFE5E1CC1C17891C6425CB1D7BE20096D",
        "GangSwitched",
        "DNS Client Name Resolution Policy Table Global Settings",
        "Win32_PnPDevicePropertyUint64",
        "LibID",
        "R_555CCC84470F70F2FC20F0644F1052980A071F16595D7E58EA0A3ED5BA0D5F14.2460.301507587.558",
        "SupportedThresholds",
        "MSFT_NetApplicationFilter",
        "SuspendCount",
        "C_152A8109FBC9BC9F4E7BCE13CE14711A471088C4A0497E45C7C22F28216A40AD",
        "of Hours Activity",
        "A string representing the boot source for next boot.",
        "NdisTransmitsOk",
        "NS_FFCDDDB138CCE842C0BBD0D2866863A23437EAE09282C04519C244557B1817C4\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_1DA4E180531B401F40077208B50BBADCB6F447B0318A02A094D8CA2E1EE53845",
        "DSP Processor",
        "Please refer to the RoamingPreference and Status property.",
        "IsBusy",
        "This device is disabled.",
        "The NetworkDirect port filter condition. This filter is only applicable if the Data Center Bridging server feature is installed. Otherwise, the policy is effectively no-op.",
        "ServiceTimeoutsBehavior",
        "SettingsTemplateCatalogPath",
        "MSNdis_StatusDevicePowerOffEx",
        "This is a class that represents a single detection",
        "    AuthenticationMethod (string[]) Specifies the authentication method set configured for the VPN Connection profile. Available values: Pap, Chap, MsChapv2, Eap",
        "I_A41A2A506F07DE19FA26EBBA5A53B62D2C62BAF775EC8BEA2B152B5D21A711E3.1489.3205755308.339",
        "Cyclic integrity checksums that can be negotiated for the data digests",
        "CurrentChannels",
        "CD_847B47B3B9DFABC8A17BC79B345074758B8A3E5B2BEBFAC49A4BE58E4D1CE00A.250.3723048787.1708",
        "CD_841F1DC98C3FA6D8D114A873F8BBB48736A8E2FDF60D6C1F08DF493438718909.190.137403084.1088",
        "The ResultCode property, if applicable, defines the result code returned from the COM activation procedure.",
        "R_406F546FAB6014271EADE336F5C1DA060EE35CB23E405330559A7A1A746C6CC8",
        "Sense Info Buffer Pointer",
        "The DeviceID property contains a string identifying the voltage probe.",
        "FileSharingProtocol",
        "SetKeyManagementServiceLookupDomain",
        "sport",
        "(abort/restart off-line by host bit) - If this bit is set to one, then the device shall abort all off-line data collection activity initiated by an SMART EXECUTE OFF-LINE IMMEDIATE command upon receipt of a new command within 2 seconds of receiving the new command. If this bit is cleared to zero, the device shall suspend off-line data collection activity after an interrupting command and resume off-line data collection activity after some vendor-specified event.",
        "Quality Low",
        "UWPLaunchOnBoot",
        "GR303 IDT",
        "Default",
        "Bid2Etw_MSADCF_1",
        " name of the codec driver. This string is intended to be displayed in large (descriptive) spaces.",
        "26 - CIM_ERR_CONTINUATION_ON_ERROR_NOT_SUPPORTED. Continue on error is not supported.",
        "MEM_BANK is valid",
        "D3466F7E30F1C2489F076B5641F666F273A9F923A32E11B6B851",
        "Bipolar Analog Composite",
        "DefaultCopies",
        "SpinLock",
        "The frequency (in hertz) at the low end of the Input Frequency Range 2 of this Power Supply. A value of 0 implies DC.",
        "Performance counter frequency in counts per second",
        "NTLM Client Initialize",
        "Key identifier for the security zone",
        "object:MSNdis_WmiHDSplitCurrentConfig",
        "This method returns the supported sizes for a virtual disk created on this storage pool. These sizes can either be returned in an array of all supported sizes, through a min, max, and divisor, or both.",
        "MulticastForwarding",
        "UltraSPARC III",
        "NdisPMAdminConfigState",
        "Reserved for Migration Services",
        "An extrinsic method for installing software on this physical computer system. If 0 is returned, the function completed successfully and no ConcreteJob instance was required. The return value shall be 1 if the request is not supported, and 2 if an error occurred. If 4096 is returned, a ConcreteJob will be started to to perform the install. The Job\\'s reference will be returned in the output parameter Job.",
        "WSP_StorageSubsystemToVolume",
        "R_6BA587F6AF181129EF94B57125FFF3ABFF81218B46E9C3323CB782B9288DC94A",
        "Thumbprint of the certificate that activated the machine.",
        "The FUnjoinOptions parameter specifies the unjoin options. If this parameter is NETSETUP_ACCT_DELETE, the account is disabled when the unjoin occurs. Note that this option does not delete the account. Currently, there are no other unjoin options defined. ",
        "RegistryKey",
        "/* Phy Statistics Events */",
        "Voice Foreign Exchange Office",
        "PhysicalPresenceVersionInfo",
        " device.",
        "The SpecificationVersion property indicates the version number of the initialization data for the device associated with the printer.",
        "SystemConfig_Virtualization",
        "Associates a network adapter with its virtual port data.",
        "Static column",
        "PaperWidth",
        "Resync operation requires subsequent activate",
        "NS_FE3EA006C3292950A76C2B5A0185D7DF99ADD6FD6502E0AC079E3A8650E76E3A\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_4BD704EFD82E90D58D3C406978C7C044F013A64518E8C54785195D2358D9CFAEmete",
        "Gives number of days left for Terminal Server grace period, A zero value indicates that grace period is over",
        "A method to create a new authority",
        "D-935F",
        "The start of the remote port number.",
        "Example: Memory Device 1",
        "SamRemoveMemFromForeignDom_End",
        "_DH_WMPDMOWRAPPER",
        "PreventLiveTileDataCollection",
        "64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41",
        "An enumerated integer indicating whether or not the referenced setting is the next setting to be applied. For example, the application could take place on a re-initialization, reset, reconfiguration request. This could be a permanent setting, or a setting used only one time, as indicated by the flag. If it is a permanent setting then the setting is applied every time the managed element reinitializes, until this flag is manually reset. However, if it is single use, then the flag is automatically cleared after the settings are applied. Also note that if this flag is specified (i.e. set to value other than \"Unknown\"), then this takes precedence over any SettingData that may have been specified as Default. For example: If the managed element is a computer system, and the value of this flag is \"Is Next\", then the setting will be effective next time the system resets. And, unless this flag is changed, it will persist for subsequent system resets. However, if this flag is set to \"Is Next For Single Use\", then this setting will only be used once and the flag would be reset after that to \"Is Not Next\". So, in the above example, if the system reboots in a quick succession, the setting will not be used at the second reboot.",
        "This represents a file device element.",
        "Windows Connect Now",
        "NetworkFSSCatchAllWeight",
        "Service Functions|ChangeServiceConfig|dwStartType",
        "The key to identify the instance of MDM_Client class, This is a device id",
        "CIM_Privilege.ActivityQualifiers",
        "PrivilegeUse_AuditNonSensitivePrivilegeUse",
        "Non-recoverable error",
        "Win32_DiskDriveToDiskPartition",
        "ForceDiffieHellman",
        "46007",
        "CIM_ParticipatesInSet",
        "CD_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655.1176.3405963235.6741",
        "Ice Buildup",
        "StartTime",
        "RSOP_AdministrativeTemplateFile",
        "C_CF7E5037F6563CE949872FEF4BA72C8CE3F9C68DD9A3E9BD325E8B9ECC946118",
        "MCA_TLB_ERROR",
        "PCI_COMP_ERROR_STATUS",
        "//  Copyright (c) 2001 Microsoft Corporation",
        "implicit or explicit write-back operation",
        "CD_C414F6F9E5383DC717CF413A8534BAA7170F0D0BD81767423A9D7B9FA1F44AD8.1783.775617835.523",
        "ContainerName",
        "This is the class used to model the LDAP RootDSE object",
        "When true, all SOAP header with the MustUnderstand attribute that are not handled will cause the behavior to throw.",
        "Number of times this SoftwareFeature has been used.",
        "NDISWMI_TRACE_RSC Flag",
        "NumberOfProcesses",
        "AuthenticationAlgorithmsEnabled",
        "Association between iSCSISession and iSCSIConnection",
        "NDISWMI_TRACE_BINDING",
        "// The total number of requests submitted by IKE to obtain a unique Security Parameters Index (SPI).",
        "This class encapsulates the Packet Capture Filter ETW provider on a computer",
        "The AppRollback Win32_ShadowContext specifies a persistent and non auto-release shadow copy with writer involvement.",
        "HostedCacheClientFirewallRulesEnabled",
        "Write-Through",
        "IsFramework",
        "SendConfiguration",
        "ciscoIgrp",
        "Partially Charged",
        "ComponentID",
        "ToeplitzHashFunctionSupported",
        "PerfVerbose",
        "TargetVirtualDiskObjectId",
        "DevLoader",
        "ResetToAsync",
        "RSOP_PolmkrIniFileSetting",
        "5 - 'Predictive Failure': The disk is functioning, but a failure is likely to occur in the near future.",
        "Maximum bus width of adapter cards that can be inserted into this slot, in bits.",
        "CD_6A87D660F0F6A66279CF024432941A2BC16A9043D5A3CF26ADC36D1DFFEBF2B9.2033.1612043649.234",
        "namespace",
        "BackgroundUploadParams",
        "Value for shell execution.",
        "The DHCPServer property indicates the IP address of the dynamic host configuration protocol (DHCP) server.",
        "object:MSFT_FileStorageTier",
        "Photographic Other",
        "Sets the properties InitialProgramPath and StartIn which specify the name and path of the program and the working directory path for the program the user wants to start on logon to the Terminal Server. It returns an integer value of 0 if call was a success in case of Server-Override mode and an error if the policy was set to Group control policy.",
        "MitigationAction",
        "{857e2326-2041-11d4-97eb-00c04f79c403}",
        "13F10DFF47709ECAB1D7F037756AC8CE7",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_3FB1CC987258F8087BD78386B8DDA093F7A2030F966FAF6199D43EFA0F6275CC",
        "Win32Registry|Software\\Microsoft\\WBEM\\scripting|Enable for ASP",
        "MCACpuBusError",
        "The TCP/IP port number.  Defaults to 9100.",
        "{75BCF4FB-DB46-11D2-B4C8-80080C7B6371}",
        "SoftwareElementState",
        "{38BA58F0-DB32-11d2-85FC-0000F8102E5F}",
        "DisableCrashDetection",
        "When enabled http connections are kept alive regardless of activity level.",
        "SystemConfig_V1_Power",
        "MSNdis_NetworkDirectCapabilities",
        "IsCallback",
        "The Manufacturer property indicates the name of the PCMCIA controller manufacturer.",
        "Number of Indicators",
        "On Demand Prog Id",
        "011 - Flash ",
        "Maximum Block Size",
        "Realtime - Specified for a process that has the highest possible priority. The threads of the process preempt the threads of all other processes, including operating system processes performing important tasks. For example, a real-time process that executes for more than a very brief interval can cause disk caches not to flush or cause the mouse to be unresponsive.",
        "MI_ERRORCATEGORY_CLOSE_EERROR",
        "Name of the framework package",
        "HeaderFields",
        "LastRunPinnedSlabs",
        "Seconds spent streaming data. (*1E-7)",
        "DVB-RCC Upstream",
        "The connection security rule being filtered.",
        "Windows NetworkItemFactory Trace",
        "select * from MSFT_StorageArrivalEvent",
        "The LocalAccount property indicates whether the account is defined on the local machine. To retrieve only accounts defined on the local machine state a query that includes the condition 'LocalAccount=TRUE'.",
        "ref:CIM_PowerMeter",
        "CR_9DA9A42CAE7919197E51305D69CEECAE7B645320A73D6DC468ACB11BA2001D79",
        "AMD(R) Duron(TM) Processor",
        "SMBIOS|Type 23|System Reset|Reset Count",
        "A string describing the element's enabled/disabled state when the EnabledState property is set to 1 (\"Other\"). This property MUST be set to NULL when EnabledState is any value other than 1.",
        "The QuotaPeakPagedPoolUsage property indicates the peak quota amount of paged pool usage for the process./n Example: 31",
        "IPSubnet",
        "ModifyPersistentBootConfigOrder",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|ProviderName",
        "MSFT_StorageSubSystemToFileShare",
        "The X.509 certificate the client uses to authenticate to the service.",
        "The DeviceID property contains a string that uniquely identifies a desktop monitor.",
        "{8502C505-5FBB-11D2-AAC1-006008C78BC7}",
        "MSNdis_WmiReceiveScaleCapabilities",
        "ImpersonationType",
        "0xD003",
        "MDM_Policy_User_Config01_Notifications02",
        "StandbySupported",
        "C_C9D9452296EB13E3615C122157CD56E9BB0D20377DF2B13731EB18D5AF7A66B0",
        "Data bits",
        "Is serration required",
        "{A0EC11A8-B16C-11D1-BD98-00A0C906BE2D}",
        "AGP4X",
        "The HBA security information cache is full.",
        "LastUploadTime",
        "TestStatus",
        "ROOT\\Policy\\ms_409",
        "R_D3559258225BBBDD5E2DFDF52DE5A11681B899B436DB12CA240C43C8641B92A8",
        "FA452BCE-5B4F-4A56-BF52-7C4533984706",
        "SMDS DXI",
        "MSiSCSI_InitiatorSessionInfo",
        "IPVersionSupport",
        "SamSetInfoDom_Start",
        "Target portal group tag for this Session ",
        "No fallback dirvers=0",
        "    IdleDisconnectSeconds (uint32) Specifies the idle time before the VPN connection is disconnected",
        "Operational Parameters",
        "IconTitleWrap",
        "Pentium(R) processor with MMX(TM) technology",
        "MUI Resource Trace",
        "SamGrpCreate",
        "NDKPI Major Version Number",
        "PolicySourceWindowsPrinterMapping",
        "SentBroadcastPackets",
        "MSNdis_LinkState",
        "C_D18B021DE887D56CED90F13460DE767FA0BA3077FF010C862ECF83FC393D6F1F",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSENVIRONMENTSETTING_Prov\"",
        "Links folder, GUID is {BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}",
        "Whether Page Combining is enabled",
        "KeyManagementServiceOOBGraceRequests",
        "0xEFFF0003",
        "MaxFrameSize",
        "40008",
        "The local network address used for the connection",
        "MIF.DMTF|Support|001.3",
        "TestError",
        "SRQClose performance counter missing",
        "CIM_IKEProposal.OtherAuthenticationMethod",
        "MSFT_NCProvClientConnected",
        "SMBIOS|Type 0|BIOS Version",
        "FilterList",
        "The Path parameter indicates the local path of the share.",
        "Bid2Etw_BCP_1_Trace",
        "Set_BCDataCacheEntryMaxAge",
        "Is it a resource only package",
        "MSFT_NetAdapterStatisticsSettingData",
        "The optional URI filter condition. This condition may only be combined with the URIRecursiveMatchCondition, IPDstAddressMatchCondition, IPDstPortStartMatchCondition, and IPDstPortEndMatchCondition fields.",
        "If TRUE the share data transmission is encrypted.",
        "IPv4ReceiveIpChecksumSupported",
        "AccountManagement_AuditUserAccountManagement",
        "DisableByFolder",
        "Win32Registry|Software\\Microsoft\\WBEM|Build",
        "Fail-safe boot",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.1465.3004816588.3773",
        "{2306fe36-dbf6-11d2-9244-006008269001}",
        "MSFT_CliAlias.FriendlyName=\"BaseBoard\"",
        "Select * from Win32_Registry",
        "Start SendReq Time",
        "C_3AA22630705AFF3975D1F6344798271087D2AF7B509FA6E34ED791616A9DF674",
        "Indicates whether or not the job should be automatically deleted upon completion. Note that the \\'completion\\' of a recurring job is defined by its JobRunTimes or UntilTime properties, or when the Job is terminated by manual intervention. If this property is set to false and the job completes, then the extrinsic method DeleteInstance must be used to delete the job instead of updating this property.",
        "A timeout period that specifies the maximum amount of time that the client expects the transition to the new state to take. The interval format must be used to specify the TimeoutPeriod. A value of 0 or a null parameter indicates that the client has no time requirements for the transition. ",
        "CIM_InstDeletion notifies when an existing instance is deleted.",
        "CreatedOffline",
        "DESKTOP-HGH2VBT\\defaultuser0",
        "{3AC66736-CC59-4cff-8115-8DF50E39816B}",
        "Specifies that the VPN connection should be added to the AllUserConnection phone book entries.",
        "CD_9378929BCE127447D66F1472F6CC39E5CC7C4B21AB66617AED19F5689DC55677.2623.3191355456.359",
        "NdisLinkSpeed",
        "IPAddresses",
        "The scoping operating system's creation class name.",
        "SetPolicyDrivenUpdateSourceForOtherUpdates",
        "If TRUE, the application may be used to satisfy a demand install for a clsid or file extension.  If FALSE, the application may not be used for this purpose.",
        "The XResolution property has been deprecated to theHorizontalResolution property.  Please refer to the description of that property.",
        "Denial of Service Prevention Settings for IPsec.",
        "GROUPING Flag",
        "FTP Proxy Server",
        "Win32API|Network Management Functions|NetShareAdd",
        "Nibble Error",
        "{014DE49F-CE63-4779-BA2B-D616F6963A87}",
        "This indicates whether pre-authentication will be used by the client.",
        "If the physical disk is not a member of a concrete pool, then this method should not only reset the health and operational statuses, but it should return the disk into a state where it is usable as storage for a concrete pool. For example: If a physical disk had become missing and then has reappeared (after it has been replaced) this physical disk is expected to be in the primordial pool only with an operational status indicating its data is either split or unrecognized. Calling Reset should clear the physical disk of any data, remove any remaining ties to its former concrete pool, and return the disk to a healthy, usable state.",
        "The FileName input parameter is a string representing the fully qualified name of the copy of the file (or directory). Example: c:\\temp\\newdirectory",
        "Win32_HeatPipe",
        "49003",
        "CallCode",
        "The WINSEnableLMHostsLookup parameter specifies whether local lookup files are used. Lookup files will contain mappings of IP addresses to host names.",
        "CR_4FD2270AA7CC321848B51530B7A77A9E39B5486B55CE0C09A2B597A1F1FCE1E6",
        "The DNSServerSearchOrder parameter specifies the list of server IP addresses to query for DNS servers.",
        "Revert",
        "NdisStatusLinkSpeedChange",
        "SOCKMAN Flag",
        "pipeline",
        "CIM_AssociatedPowerManagementService.PowerState",
        "For a ProtectedSpaceExtent that is allocated to a VolumeSet, (i.e. is named in a CIM_VolumeSetBasedOnPSExtent association), this property is the number of user data bytes placed on this ProtectedSpaceExtent before moving on to the next ProtectedSpaceExtent in the VolumeSet.  Otherwise, this ProtectedSpaceExtent is considered to be unallocated and this property shall be set to zero (0h.)",
        "The MaxWaitOnClientObjects property specifies the amount of time a newly created object waits to be used by the client before it is discarded and an error value is returned.",
        "Number of bytes for dot11 scan confirm status indication",
        "TPM_PIN",
        "D6F23AC5CCBEB47ECCF7BF129523258879FDED9D282F558043FF80249A7ED596",
        "WDMClassesOfDriver",
        "Magstar 3590",
        "Example: c:\\winnt\\notepad.exe myfile.txt.",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}[AppID]",
        "C_DE2F09E5209C548EB2CA373A925D80847E176AA4A3A4ACC0CB143A779C8154B2",
        "PC-98Full",
        "Time the administrative template file was last written",
        "object:MSFT_FileDirectoryConfiguration",
        "LPCDRVR_TRACE_RESERVED_11 Flag",
        "Localized version of RSOP_PolmkrLocalGroupsSetting for American English",
        "IMAPI2 Pseudo-Random Stream",
        "NicSwitchCurrentCapabilities",
        "Removes the specified VPN connection profile. ",
        "MicrosoftTpm",
        "Range2InputFrequencyHigh",
        "{8502C573-5FBB-11D2-AAC1-006008C78BC7}",
        "ExtendedStatus allows the storage provider to return e",
        "Peak Page File Usage",
        "PolicySourceSelectTransport indicates whether the property SelectTransportis configured by Server (0), Group Policy (1).",
        "Domain",
        "Specifies whether Antivirus protection is enabled",
        "Max package size (in bytes)",
        "3221232493",
        "y array.",
        "The creation date and time of the file. ",
        "The VLAN ID filter. This value may be NULL.",
        "Specifies whether the computer is monitoring file and program activity on your computer",
        "DisableNotifications",
        "NegotiatedLinkRate",
        "Win32_GroupUser",
        "CriticalTripPoint",
        "{F43E8166-162C-4B12-8C2B-510D21516082}",
        "Identifies an instance of MSFT_BranchCache",
        "Sanitize",
        "ps|VERTRES",
        "C_BDE5107C5341475AE649B7075E5FB1B219CF6D2FF755D735AA60A09AE0ED6BD6",
        "MsftDiscRecorder2_DebugDestructor",
        "PortableDeviceAPI_Events Flag",
        "RsopLoggingModeProvider",
        "2 - 'Level 2': Virtual disks and masking sets will be discovered.",
        "If applicable, defines the server localserver32 executable application name.",
        "t;i1\"",
        "Network interface on which DNS queries are sent or received",
        "One of the following: 1 (= Full path); 2 (= Folder); 3 (= All applications).",
        "The Manufacturer property indicates the name of the disk drive manufacturer.",
        "C:\\Windows\\System32\\drivers\\processr.sys[PROCESSORWMI]",
        "D0D22317B6B52E4D7E08F0AE9225C6A090F83945AA47F9AECD26.2568.3597818075.278",
        "An enumerated integer to indicate the role this software plays in regards to its associated device. For example, this software could be instrumentation (value=5) or firmware (6).",
        "Name of a wireless LAN profile.",
        "This class exists for backward compatibility to earlier CIM Schema definitions. With additions to Sensor and NumericSensor in V2.2, it is no longer necessary. A VoltageSensor can be defined by setting the SensorType property, inherited from Sensor, to 3 (\"Voltage\"). Other properties of this class are hard-coded to constant values to correspond to definitions in the sensor hierarchy.",
        "{96B4C734-DB36-11d2-85FC-0000F8102E5F}",
        "TRACE_FLAG_LOCK",
        "NdisFddiTypeLocalS",
        "MSNdis_StatusDevicePowerOnEx",
        "SpeakerModeOff",
        "73EF9B61",
        "PLATFORM_TRACE_RESERVED_08",
        "MSFT_CliProperty",
        "CD_E6F405501CF9EB51604EF826550E0336D9FF9DAB805C48FA3ECE279D5B21648A.1807.3515981708.431",
        "UMDF - WDF Core",
        "WMI|Win32_ClassicCOMClassSetting",
        "homePageURL",
        "10GBaseT",
        "GetSchemaByTemplateId",
        "MSFT_ClusteredScheduledTask",
        "Silent Breakaway OK",
        "Win32_IDEControllerDevice",
        "The SID of the account",
        "targetID",
        "The AcceptableValues property details which of the strings in the PossibleValues property are considered 'acceptable' (i.e., 'not an error').",
        "Active Trippoint",
        "AddSearchProvider",
        "{42bb73b0-2129-11d4-97eb-00c04f79c403}",
        "Not Healthy",
        "The CreationClassName property is a string indicating the name of this class.",
        "IsFast",
        "CD_532671ED26AC2835681FE0B122A526862616ED33CAB2C220F171DB7BD5AD8B02.1093.2670870092.461",
        "RD_TRACE_RESERVED_1d Flag",
        "where Name='#'",
        "CD_DCED63C3DB35CDD25F0739F377553C4490C7489F0B94C0224ED7054DFFB34F3E.1582.3844714335.3083",
        "images when an exact color match is required. ",
        "DDE013F24CC5899E85C",
        "WD_LOG_FLAG_CONNECTION",
        "This indicates whether the shared key will be a network key or a pass phrase.",
        "The number of times that the TCP stack has failed when receiving IKE messages.",
        "PolicySourceSelectNetworkDetect",
        "{fbfe2540-452b-41bb-9219-dfb6fd1a129b}",
        "4 = the application was language neutral, ",
        "C_0DCE749AD0E30C5A74941D6C326877243635B3D92AE3FA1BB77A2C716BB28364",
        "Smb2CreditsMax",
        "SKUNumber",
        "DH Group 20",
        "Protected through SCC-2 (SCSI-3 Controller Command)",
        "RemoveLink",
        "Win32API|Communication Structures|DCB|ErrorChar",
        "An aggregated dependency.",
        "This class provides identification for a user/device pair. It also provides methods for un-enrolling the device from management and device lock",
        "CreateToken",
        "MSNdis_80211_ReloadDefaults",
        "InContext",
        "Compressed CS Event",
        "The value of this property shall correspond to the name given to the set of versioned constraings by a specification or standard. The value does not identify the name of the document or publishing media, unless it happens to be the same as the name given to the versioned constraints.",
        "Structure that denotes NDK adapter capabilities and limits that are relevant for an individual NDKPI consumer (in contrast to system-wide limits).",
        "WLAN Diagnostics Trace",
        "ChannelNibbleReadCount",
        "CR_EA4DF20054CBD87001EE67FE2E62392134ACBA7D580330C315985BC30E5F543E",
        "The SupportDTRDSR property determines whether Data Terminal Ready (DTR) and Data Set Ready (DSR) signals are supported on the Win32 serial port.",
        "Default network fairshare weight for catch-all network traffic, valid number is 1 to 9",
        "Running (4) indicates that the Job is running. ",
        "42009",
        "wfascim",
        "Low Paper",
        "Disable the current settings location template.",
        "MDM_Policy_User_Config01_Experience02",
        "CIM_PhysicalMedia.MediaDescription",
        "icrosoft\\Windows\\HardwareManagement\\MS_409",
        "Not all DHCP leases could be released/renewed",
        "MSFT_NetNetworkLayerSecurityFilter",
        "No Compression",
        "DailyRecurrent",
        "FlowControlInfo",
        "PolicySourceUserName indicates whether the property UserName is configured by Server (0),Group Policy (1), Default (2).",
        "Total read errors encountered by the storage device.",
        "The Win32_ComponentCategory class represents a component category. Component categories are groups of COM classes with a defined functionality set shared between them. A client using these interfaces queries the registry for the category title and unique identifier called a CategoryID, which is created from a globally unique identifier (GUID).",
        "PauseDeferrals",
        "Indicates when a background upload should be performed. One of the following values can be specified. SpecificTime - Perform the background upload at the time of day specified in the Time property. SetInterval  - Perform the background upload at the interval specified in the Interval property.",
        "FirstIntegrityAlgorithm",
        "NtlmLogonUser",
        "PointAndPrintRestrictions",
        "EventCount",
        "DueTime",
        "Windows XP Embedded",
        "The disk partition that is located on the media.",
        "C_B6F5DFB5FF9D262A34F808F6064BE3724B862C376624E6B9C572552907B49F21",
        "The Win32_SystemOperatingSystem class represents an association between a computer system and its operating system.",
        "SMBIOS|Type 20|Minimum voltage",
        "Invalid input parameter",
        "{98A2B9D7-94DD-496a-847E-67A5557A59F2}",
        "__AbsoluteTimerInstruction",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services|Tcpip\\Parameters\\Interfaces",
        "The IPXFrameType parameter specifies an integer array of frame type identifiers. The values in this array correspond to the elements in the IPXNetworkNumber parameter.",
        "Dot11 PMKID Candidate List status information.",
        "ThreadState",
        "LetAppsAccessRadios_UserInControlOfTheseApps",
        "I_3FD6B33F4FF166B0F7CE61EB62E55B303FF2BF4A74F913CACB488AD245C02047.2461.1289881593.347",
        "MSNdis_WmiTcpLargeSendOffloadV2_IPv6",
        "CR_D6B1F4AAAFDB618A9CCA914AD92E90625471E15F06457F12DC8D813813101B8A",
        "This class represents a Windows Defender Firewall dynamic keyword address.",
        "CCITT",
        "The storage pool contains virtual disks.",
        "ApplicationPreLaunch",
        "{464FFABB-946F-11d2-AAE2-006008C78BC7}",
        "Microsoft-Windows-LLTD-Mapper",
        "The GatewayCostMetric reflects an integer cost metric (ranging from 1 to 9999) to be used in calculating the fastest, most reliable, and/or least expensive routes. ",
        "GlobalPortsAllowUserPrefMerge",
        "CommunicationInfo",
        "CtlGuidAssocDB",
        "AssemblyName",
        "MSFT_StorageNode",
        "Metric4",
        "MaxReceiveRequestSge",
        "Neither",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1489.2360746573.368",
        "REGIS",
        "{CE3324AA-DB34-11d2-85FC-0000F8102E5F}",
        "One of the following values:  - Disabled: Set the receive window at its default value.  - HighlyRestricted: Allow the receive window to grow beyond its default value, but do so very conservatively.  - Restricted: Allow the receive window to grow beyond its default value, but limit such growth in some scenarios.  - Normal: Allow the receive window to grow to accomodate almost all scenarios.  - Experimental: Allow the receive window to grow to accomodate extreme scenarios.",
        "This field is the message displayed to the user.",
        "Windows PowerShell scripts will run last",
        "NormalPriority",
        "The association between the volume for which a shadow copy is made and the volume to which the differential data is written.",
        "onseBufferCount",
        "CIM_ERR_CLASS_HAS_CHILDREN",
        "MDM_WirelessProfileXml",
        "The SRIOV capabilities reported by the network adapter.",
        "Indicates whether write caching is enabled on this physical disk or not.",
        "What type of encapsulation to use.",
        "- \\'All\\' (2) executes the actions of ALL rules whose conditions evaluate to TRUE, in the set. As noted above, the order of processing of the rules is defined by the property, PolicySetComponent.Priority (and within a rule, the ordering of the actions is defined by the property, PolicyActionStructure.ActionOrder). Note that when this strategy is defined, processing MUST be completed of ALL rules whose conditions evaluate to TRUE, regardless of errors in the execution of the rule actions.",
        "NotifyAntivirusPrograms",
        "Additional information for token-based activation.",
        "CtlGuidPortableDeviceAPI",
        "LPC_TRACE_WORKER",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_2AED356462B2786C0E1FA1993CF981AE917D300D3F467D583FB4D81ECCFDFFA01a2a",
        "The Antivirus Signature version (major, minor, build, revision)",
        "AutoConfigUrl",
        "D2m;D2m;",
        "CD_F29100A757BDE75968386F1F8F50FAF18D4793B63DC12FB4378C18D9CD66C352.37.2335960961.445",
        "Microsoft iSCSI Initiator: Persistent Devices",
        "RdmaReadSinkFlagNotRequired",
        "CD_DA3DC1260150EA9B0B2628C0C2AA81125377900B91EB681EA05BC31E6A7900FC.1144.1.16473",
        "The user cancelled the operation.",
        "An array indicating all the transfer widths (in bits) supported by this DMA Channel. Permissible values are 8, 16, 32, 64 or 128 bits.  If unknown, enter 0.",
        "Partition Info Extension",
        "IR_6BED86547A30ACCAD1302C7FA283B163848C4E58E936CB646E57DB7DE244D555",
        "SOFTWAREBUNDLER",
        "TRACINGLOCKING",
        "ref:__EventFilter",
        "{8502C4E3-5FBB-11D2-AAC1-006008C78BC7}",
        "This property returns whether the 'Sync your settings' option under 'Change Settings' is turned on",
        "SuiteMask",
        "ChangeStamp",
        "Not evaluated due to user configured with roaming profile",
        "Token ring",
        "snoop (coherency check)",
        "TRACE_RESERVED9 Flag",
        "43003",
        " Where Name = '#'",
        "The header fields will be inserted into the SMTP email header without interpretation.",
        "Heap Range Destroy Event",
        "OutboundDiscardedPackets",
        "The physical element being described.",
        "Cache out of date",
        "0xD014 - 'Failed': In Windows-based storage subsystems, this indicates that the object is in a failed state.",
        "This class encapsulates an ETW Trace provider on a computer.",
        "ROOT\\Microsoft\\UEV",
        "LockedDownLocalMachineZoneJavaPermissions",
        "WordCount",
        "The specified volume does not support storage tiers.",
        "NS_A2A98E75472B9249D4EF445DC9D4C380289067BF73931A828AFBC7CD7964FEBB\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_F41AAB3CE0418D59CCEE78DC6089E8A71443DF08351201B015241ECCC0AF9C70",
        "5 - 'Predictive Failure': indicates that the storage pool is functioning nominally but predicting a failure in the near future. ",
        "Critical Flag",
        "PNP_WARNING_LEVEL Flag",
        "C_37F745714D456922ABC6A6C3392453CACBCC48856287D98BA28B9B6BD50EA75C",
        "TEST_TRACE_RESERVED_0b Flag",
        "Starting (10) indicates that the element is in the process of going to an Enabled state. New requests are queued.",
        "LogFlagTask Flag",
        "The Win32_TimeZone class represents the time zone information for a Win32 system. This includes changes needed for the transition to and from daylight savings time.",
        "LDM Data",
        "40022",
        "Command Specific Information",
        "256-bit Elliptic-Curve DSA",
        "Generates a new XML file with the specified EAP configuration parameters.",
        "Indicates that a rule applies to a particular firewall profile.",
        "LetAppsAccessBackgroundSpatialPerception",
        "_DH_WMP_LISL",
        "ControllerTimeouts",
        "General Failure",
        "The ProviderOperation_GetProperty property indicates the number of calls to IWbemPropertyProvider :: GetProperty.",
        "WD_LOG_FLAG_CONTROL",
        "The maximum number of instances of the log file that ETW creates.",
        "MSNdis_WmiSetHeader",
        "LastAck",
        "R_A726CC10C860A315296DCD93520657C7C068B6652EE5FFD6550B3E0DAB8CACAE",
        "Enable the current settings location template.",
        "V.turbo",
        "C_8390A92B686E2E10DEC51624CF7D9A9B36CA99C04138C2088DBC0519EB26D47A",
        "The maximum number of print-stream pages that the Printer can render onto a single media sheet.",
        "MSChangerProblemDeviceError",
        "Adaptive Snapshot Remote",
        "CIM_Statistics is an association that relates managed system elements to the statistical group(s) that apply to them.",
        "{4184DF1B-EDFE-406b-B172-54C91FBD9BAF}",
        "The value for AllocationUnitSize must be a multiple of 256 MB.",
        "WINSPrimaryServer",
        "AutoTuningLevelGroupPolicy",
        "Number of requests waiting in the disk queue",
        "C_02B5557CADEF33CFA29F52E782D8C5DEF3C67D29A7C0C3B389FF34D1D0708EC3",
        "Denotes the current health status of the virtual disk. Health of a virtual disk is derived from the health of the backing physical disks, and whether or not the virtual disk can maintain the required levels of resiliency.",
        "The build number component of the version information for the current management firmware on this physical computer system.",
        "Killed",
        "MaxTransferRate",
        "The path to the program.",
        "CR_A726CC10C860A315296DCD93520657C7C068B6652EE5FFD6550B3E0DAB8CACAE",
        "PageFilePresent",
        "The configuration apply mode for the server.",
        "The size of the buffer used to transmit a chunk of the serialized message on the wire from the client or service. ",
        "PipeBuf_Trace Flag",
        "I_1E59813E7045B8656EFFCBCD5C1862D995CA0F602D3213FEC6EFBA0ED3F2AD29.311.697620915.249",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_FF125414713AEFB3BE9B36BF5067B839DE545A44FB053F1F2696CC7ADC1B48DA",
        "Single-Bit Error",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\LocalServer[Default]",
        "Specifies whether Antispyware protection is enabled",
        "CR_E78B24A63ACB40A253226DA76298C783683B9FFCFE28CF1078C510D46CEF2248",
        "The StopFileName output parameter is a string representing the name of the file/directory where ChangeSecurityPermissionsEx failed. StopFileName will be null if the method succeeds.",
        "MsftDiscFormat2StreamRandom_DebugConstructor Flag",
        "C_24BE268C5603D757BD8CCA53193660D8F104AD29F4F74D327C13832A44E7DF1F",
        "SystemConfig_V2_ProcGroup",
        "BytesProcessed",
        "CurrentNode",
        "Win32API|Printing and Print Spooler Structures|JOB_INFO_4|pParameters ",
        "This subsystem is already registered with another user's credentials. Use the -Force flag to remove the existing registration and add a new one anyway.",
        "R_E180FA56BE25537B4EDBF25A70C610DD0A17358432E8B0D7F517AF0A54245AFC",
        "Maximum size the log file can reach before being rotated.  May be a uint32 value, or MAXUINT64 for Not Configured.",
        "HNet_Connection",
        "CD_4FD2270AA7CC321848B51530B7A77A9E39B5486B55CE0C09A2B597A1F1FCE1E6.1184.4237161846.5400",
        "TXFRECOVERY",
        "CD_4C5229B4915A098FA9E249BF643245728F52EEA4263D760742E82296F3E1B97E.74.4237442598.603",
        "The beginning address, referenced by an application or operating system and mapped by a memory controller, for this memory object. The starting address is specified in KBytes.",
        "SubsettingFailed",
        "Number of media types supported.",
        "Corrected error",
        "SAM Computer Create",
        "FlowControlSoft",
        "EnableDevQueryPrint",
        "CIM_SoftwareElementVersionCheck",
        "WHERE IRQNumber=#",
        "SystemManufacturer",
        "NoFailure",
        "Printer name,",
        "MSFT_SmbConnection",
        "8B57E83A2372C128C06C6ABCD",
        "Policy object for IEEE 802.11 Network Policy",
        "Order of the GPO within the SOM",
        "Wide Range",
        "Controls TCP retransmission timeout in milliseconds. Value can range from 20 milliseconds to 300 milliseconds.",
        "8 - 'Restoring': restore-in-progress. ",
        "SEL_EVENT_DIR_TYPE",
        "MofProcessed",
        "DSKerberosDistributionCenterFlag",
        "EVENT_TRACE_FLAG_PNP",
        "InstallDate2",
        "ref:CIM_Thread",
        "Indicates if the Adapter supports segmentation when the final packet length is less than MSS for IPv6.",
        "IndicationTime",
        "The RecordRoute property indicates how many hops should be recorded while the packet is enroute. The default is zero.",
        "CD_404A8A60F06FF86C891EF2776F930A45A835547F74E3D08788D5D842F92EEA38.69.2705932747.519",
        "The OperatingSystemSKU property identifies the SKU of the operating system.",
        "The Key Module used to negotiate the SA and its child SA's.",
        "On Board Floppy",
        "SpecifyUseOfActiveXInstallerService",
        "The PathName parameter passes the fully qualified path of the service binary file that implements the service.",
        "Default monitor profile",
        "Indicates whether to delete the source file after the copy operation.",
        "Timing type",
        "object:MSFT_Printer",
        "The most recent UTC time at which reliability metric data was collected",
        "SidTypeUnknown",
        "The EncryptionMethod property is a free form string indicating the algorithm or tool used to encrypt the logical file. If it is not possible (or not desired) to describe the encryption scheme (perhaps for security reasons), use the following words: \"Unknown\" to represent that it is not known whether the logical file is encrypted or not, \"Encrypted\" to represent that the file is encrypted but either its encryption scheme is not known or not disclosed, and \"Not Encrypted\" to represent that the logical file is not encrypted.",
        "MSMCAInfo_Entry",
        "SetRTCores",
        "LocalMachineZoneInitializeAndScriptActiveXControls",
        "The destination path is not accessible.",
        "WUUUUUUUU",
        "The RecordForLog class is used to instantiate records to be aggregated to a Log.",
        "IPv4Encapsulation",
        "error_Code",
        "D01B32C68CCEA476ACECCD0DB049A6CD.2668.2340397220.283",
        "Enabled For Debug",
        "DenyAccess",
        "\\\\.\\root\\StandardCimv2:__Win32Provider.Name=\"NlmCim\"",
        "CR_9FFC730BEA787E28FF305A66FE71BC4BDA5863470D337AF3119C48B654F08702",
        "The Msft_WmiProvider_CreateInstanceEnumAsyncEvent_Pre event class represents an event generated immediately prior to calling the provider's implementation of IWbemServices :: CreateInstanceEnumAsync.",
        "Win32_MIMEInfoAction",
        "VmNicID",
        "HardError",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_2C3390DA0D8113E7B067C5F12CC8E1742CA924FE4948190A81257D1A9CF5BDEB",
        "CD_55BF0CC0F072F8672008BA2E217FC98D14173100D32640D32F61CC0295647162.1700.2703408897.359",
        "Privilege is the base class for all types of activities which are granted or denied by a Role or an Identity. Whether an individual Privilege is granted or denied is defined using the PrivilegeGranted boolean. Any Privileges not specifically granted are assumed to be denied. An explicit deny (Privilege Granted = FALSE) takes precedence over any granted Privileges. ",
        "The DNS servers which will be queried when Direct Access is enabled",
        "Framework version actually used",
        "Data width of the physical memory, in bits. A data width of 0 and a total width of 8 would indicate that the memory is solely used to provide error correction bits.",
        "ref:Win32_ComputerSystem",
        "{13CD7F93-5BAA-8C7C-3D72-B69FAC139A46}",
        "SDBUS_DEBUG_EVENT",
        "//  Module: iSCSI Discovery api",
        "InfFileName",
        "OS Scsi Target number target is mapped to. If 0xffffffff then any value can be picked by the miniport.",
        "AllowFlash",
        "The Win32_LogonSession class describes the logon session or sessions associated with a user who has logged on to Windows NT or Windows 2000.",
        "AE083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "zZi,@",
        "Win32SDToSDDL",
        "83 - Unable to release DHCP lease",
        "SyncMethod",
        "The Disable method disables the network adapter on the target computer. ",
        "//  this information during boot",
        "EnableDaylightSavingsTime",
        "C_0755C98F98A88832CE4AF388D7FD0A485984E8C8093D5B69AF797BCD21D684DE",
        "IcmpType",
        "Auto configuration allows you to make updates to a user's machine after deployment.",
        "Unavailable",
        "CIM_ManagementController",
        "SlotNumber",
        "Specifies the property values of the ODBC DSN that you are modifying or adding. Format as an array of strings where each string is: <key>=<value>.",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\ServiceGroupOrder.",
        "bits   4:  0 = Normal Throughput, 1 = High Throughput. ",
        "{80321714-DB31-11d2-85FC-0000F8102E5F}",
        "LastRunUnknownEvictFailSlabs",
        "{42fbba45-4524-4316-82f1-e53a201b74e0}",
        "UMB Trace",
        "Single Scan",
        "RD_TRACE_RESERVED_18",
        "CtlGuidPortableDeviceTypes",
        "NS_59411655A8F95EE7BEABDFB898861DFA8E2BF23293A8AFE96B2E5BB236E7FE01\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_8B68560B534A6D3AF089AA733C222DB25352C8528E5767D325B8757B271F3DD1",
        "The PauseService method attempts to place the service in the paused state. It returns an integer value of 0 if the PauseService request was accepted, 1 if the request is not supported, and any other number to indicate an error.",
        "If this field is set to TRUE, the storage pool is primordial. A primordial pool, also known as the 'available storage' pool is where storage capacity is drawn and returned in the creation and deletion of concrete storage pools. Primordial pools cannot be created or deleted. ",
        "Count of # of bytes received over this connection",
        "rrorData.ErrorDescription",
        "AllowSideloadingOfExtensions",
        "Windows XP Home Edition",
        "{4B647746-F438-0A42-F870-5DBD29949C99}",
        "2 - Information should be used when providing an informative response. ",
        "OsComponent",
        "Describes the expected address of the host name used as for the DNS probe.",
        "$^NvP",
        "IPXAddress",
        "{A9C1A3B7-54F3-4724-ADCE-58BC03E3BC78}",
        "SerialNumber",
        "ActionOrder",
        "State type: 1 = performance, 2 = throttle",
        "NameFormat describes the format of the Name identifier.",
        "SDDL for remote machine transport SA authorization",
        "NS_3CE8582EE8FFA928E42F84B5CDF7241A25C3C463C6F6E68C9EFB47A560BAD872\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_4F053C55BF94F687587D950205791AF583FFC7915ACC38F3CD7A51F2DB97B327",
        "Invalid object",
        "DEVPROPTYPEArray",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_B4A2C5E94294CA48EE83444B581B7715F0456C2AE322533C1FC870F4B341BC9282",
        "Query NDIS Physical Medium Type (Ex) of the NIC",
        "R_B2287B7C7375EAC6C3F512941317C3A57D34B32E4D080470E5E3D04FD567BA70",
        "The GetOwner method retrieves the user name and domain name under which the process is running. ",
        "redirecting Group",
        "{095FBE97-3876-48EF-8A04-1C55935D0DF5}",
        "SetTcpipNetbios",
        "Win32_SMBIOSMemory",
        "ref:MSFT_NetNetworkLayerSecurityFilter",
        "embedded",
        "{734AC5AE-68E1-4fb5-B8DA-1D92F7FC6661}",
        "Get All Policy Settings",
        "MDM_Policy_Result01_Defender02",
        "RemoteUserEmpty",
        "CurrentManagementFirmwareElementName",
        "{A91081E2-DB37-11d2-85FC-0000F8102E5F}",
        "NS_CCA03770E562E2A170EDED20A589C069A2045A9BCD7412B77D068846D9054EC4\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D0C7964659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41",
        "The SettableBaudRate property determines whether the baud rate can be set on the serial port",
        "Win32API|File Functions|GetTempPath",
        "AllowAdvancedGamingServices",
        "MDM_WNSChannel",
        "Query counters for DNS64",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\TreatAs[Default]",
        "C_E0728E680677E2DC755DB0B32FACA9688F4B71D12279046ADFB604C5714997EF",
        "HRDestroy",
        "The SecurityDescriptor input parameter specifies the security information.",
        "This field is a user-settable preference for the number of complete data copies to maintain. Its value must be within the range defined by NumberofDataCopiesMin and NumberOfDataCopiesMax (inclusive). For new concrete pools, the default should be inherited from the corresponding primordial pool's capability. In the case of the primordial pool, the initial value for this field is left to the Storage Management Provider software.",
        "R_00DF7A47830858F23144255CF1187C256ED7DEF5815A0D59214EE29ECE512284.1609.3123379440.596",
        "FX_TRACE_DEVICE Flag",
        "No Group/Non-Diffie-Hellman Exchange",
        "Current Performance State",
        "CD_23A50366135FBF364F350BC34F639BE141A61D21A478BB4C1230D838F1296A4E.2042.1160634697.2700",
        "This method will reinstall the associated instance of Product using the specified reinstallation mode.",
        "Win32API|Network Management Functions|NetShareSetInfo",
        "Values: TRUE or FALSE. A value of TRUE indicates the protocol uses aconnectionless service.",
        "Partitions",
        "x25UserData",
        "FLOODMAN Flag",
        "DependsOn",
        "The NetConnectionID property specifies the name of the network connection as it appears in the 'Network and Dial-up Connections' applet.",
        "Client's UDP port.",
        "TesterAccount",
        "43005",
        "An array of string description of the format used in the custom identifiers defined in the OtherIdentifyingInfo field. There must be a 1:1 mapping between this array and OtherIdentifyingInfo.",
        "The media access device.",
        "MSFT_NetTransportFilter",
        "WakeReleaseUser",
        "CD_EA9A1A204A0FA59819F57AD1F744E0CAB4BE1F06A46B3D439B85E87A7B3A09A6.1219.3661581209.353",
        "CD_61AD70324F8E2B3494420EEDDA5029E5D1AF2B0083C1CC1767F12EF889E146D1.2151.1745393114.1191",
        "AGP_RATE_1X",
        "Target Flag",
        "The SID property contains the security identifier (SID) for this account.",
        "SEL_RECORD_TYPE is valid",
        "ref:Win32_ShortcutAction",
        "VPD83NAA6",
        "object:Win32_SID",
        "C_9E5B3D45F8CAE1C4CFE56075A9FB448C0393D1604515DCC51D7A6ED3FDECC308",
        "Indicates whether to accept certificates only from the root TrustedCA, or to also accept certificates from Intermediate CA's which are children of the TrustedCA.",
        "Bus Time Out or No Device Present (No DEVSEL#)",
        "CIM_TemperatureSensor",
        "CD_5997589696FB2E4597FC4CE1E1612FCF4F0EAE5655998B39A34DFA12CA0BE14A.1356.1055001447.2439",
        "The Row number of the memory error location",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|Logging",
        "1 - 'None': The pool is not read-only. ",
        "Id of the device",
        "{9A17DFD1-34FA-4d61-B9BB-3A1097E7FADF}",
        "C_9A36BB4E390B7DD04D76CD832679A7EB96B353EDC2C276A7C316493A7FCF4652",
        "The minimum number of bytes that a single net packet occupies in the transmit buffer space of the NIC.",
        "TextAddress",
        "The BIOS feature.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1076.3303974372.180",
        "Wait timeout for synchronization from the settings repository (in milliseconds)",
        "MSFT_WmiThreadPoolThreadDeleted",
        "10 - 'Stopped': The volume was stopped or shut down in a clean and orderly fashion.",
        "SymmetricSecurityBindingElement",
        "LogFlagDownload Flag",
        "CD_0992284CF6AEAC48C1F5BDF0973A6119AD14B4C683C698E5BA85ECEAF0A68CE1.2626.1794138547.874",
        "CIM_Component is a generic association used to establish \\'part of\\' relationships between Managed Elements. For example, it could be used to define the components or parts of a System.",
        "DN_Class",
        "Unknown - check in devpropdef.h",
        "Virtual machine farm settigns corresponding to the desktop",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_GUARANTEED_DELIVERY",
        "Win32_TSClientSetting",
        "Machine Architectures",
        "Duplicate Information",
        "CIM_OSVersionCheck",
        "Disable email scanning.",
        "Incomplete",
        "Label value that allows for policies that prefer a particular source address prefix for use with a destination address prefix.",
        "VSS tracing event",
        "Win32Registry|.DEFAULT\\Control Panel\\Desktop|Pattern",
        "Type Event",
        "WPD WMDMCompat Trace",
        "Represents the IPv6 protocol for Microsoft TCPIP WMIv2 provider.",
        "RSOP_PolmkrPortPrinterSetting",
        "Audit Mode",
        "If True, resets only the Windows firewall rules.",
        "{FAF76B79-798C-11D2-AAD1-006008C78BC7}",
        "EmbeddedControllerMajorVersion",
        "This property provides a hash of the installed product key.",
        "Win32_Processor",
        "The Extension property is a string representing the file's extension (without the dot). Example: txt, mof, mdb.",
        "Specified directory not found",
        "LPC_TRACE_RESERVED_10 Flag",
        "Referral",
        "The BootPartition property determines whether the partition is the active partition. ",
        "ClearDiagnosticInfo",
        "Foreground_Intensity",
        "NumQueues",
        "(0.714,0.286)[V]",
        "IP not enabled on adapter",
        "The Clsid property, if applicable, defines the COM CLSID associated with server implementation. Note:  decoupled providers do not have an associated COM CLSID.",
        "14 - 'Frozen': All blocks copied from source to an UnSyncAssoc replica and the copy engine is stopped. ",
        "Number of strings to be inserted into the event text.",
        "LINKMAN",
        "    <asmv2:hash xmlns:asmv2=\"urn:schemas-microsoft-com:asm.v2\" xmlns:dsig=\"http://www.w3.org/2000/09/xmldsig#\">",
        "Store",
        "AllocatedSpace",
        "DataIntegrity",
        "MCA Support",
        "FailedCount",
        "The LPR Queue name for this port when configured for the LPR protocol.",
        "IR_76BBC96B178A1C054AB319522EC35C13427283C8227727BACFAF1E007CEB0AB9",
        "Maximum number of shared receive queues supported by the adapter If this field is 0, adapter does not support shared receive queues.",
        "Integer indicating whether the monitor operates in interlaced (value=5) or non-interlaced (4) mode.",
        "PolicySourceHomeDirectory",
        "CD_D0BD75AC3D8DE4C152208F12EDDCF12218F074D81D44606C9B3E833C29C2790D.1850.1.8433",
        "{F14383B5-8D69-42E8-939A-9ADB781A7FAD}",
        "RSOP_AuditPolicy",
        "Read-only",
        "LockdownFavorites",
        "DisableActiveXVersionListAutoDownload",
        "Path to this driver",
        "\\\\.\\root\\Microsoft\\SecurityClient:Win32_ProviderEx.Name=\"AntimalwareMonitoringProvider\"",
        "See CIM_RecordLog.MaxNumberOfRecords for details.",
        "CD_7C2448C779B501004A8AC92BAE296EF71C889D4A4797C480FE572242B6C55673.2154.1376950963.3457",
        "SetInformationTrustedDomain",
        "MsftDiscFormat2Tao",
        "EdgeTraversal",
        "\"Starting\" describes an element being initialized. ",
        "TRACINGDRIVER",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}[Default]",
        "MSNT_FileBaseTrace_Set2",
        "MSFT_OdbcDriver",
        "ProtocolStatistics",
        "NDIS FDDI Short Current Address",
        "Note: The use of this property is deprecated in lieu of CIM_LogicalPort.PortType. ",
        "If TRUE, all resiliency settings will be copied from the primordial pool and added to a concrete pool upon its creation. If FALSE, the storage pool should copy the setting specified in the ResiliencySettingNameDefault parameter of CreateStoragePool. If no name was given, the resiliency setting specified by the primordial pool's ResiliencySettingNameDefault property should be used.",
        "C_FCA81D040FC95DE948FEF608A6C792CE7659D295F84C50D931F9A2E52513B2BA",
        "CD_3F71F51676E0E4D666CAF1EBCB8834168AA41A1C9D4D74E4D596C66D86A39AA9.67.1065059953.587",
        "The SetArpUseEtherSNAP method is used to enable ethernet packets to use 802.3 SNAP encoding. By default, the stack transmits packets in Digital, Intel, Xerox(DIX) Ethernet format. It will always receive both formats. The method returns an integer value that can be interpretted as follows: ",
        "object:CIM_Error",
        "n57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "{9831B7E6-09AC-491f-8D07-3C3D649D8240}",
        "SamCreateAliasInDom_Start",
        "LUAInstall: error 0x00000005 setting flags [{73843B93-848F-453B-953D-2E5B911429DC}]",
        "Create_Unicode_Environment",
        "Parallel Port XT/AT Compatible",
        "HOSTPROC_RESERVED_14",
        "The device file.",
        "I_8B1547E29C4669664E5C74CF6C63C0DCB167707EDB55532CBAA32AF8A1CDDE88.291.1379513984.373",
        "RegisteredOrganization",
        "CD_F4AD89F24C5E59F704DEBE5DF4920F1D71930B871988589A8D9D698640C4E7BA.68.1122748136.4858",
        "NdisStatusDot11PmkidCandidateListIndication",
        "Media Life",
        "The Win32_LogicalProgramGroup class represents a program group in a Win32 system.",
        "#define HBA_REGISTRY_BINDING_VERSION        (1)",
        "9CD8E1CE-0D27-4a41-AADE-F8D200230FF4",
        "Array defining the character sets or encoding supported by the FileSystem. For example, the values, \"ASCII\" (2) or \"ISO2022\" (4), may be specified.",
        "Deletes a printjob from a given queue.",
        "ActiveScriptEventConsumer",
        "Example: 1",
        "ueMap",
        "New default size of write cache for virtual disk creation",
        "DisallowNegotiateAuthenticationClient",
        "{A2ABF536-DB35-11d2-85FC-0000F8102E5F}",
        "439.180",
        "SuspendInfo",
        "LastUseTime",
        "Pause",
        "IPsecTunnelEndpoints",
        "MSFT_StorageChassis",
        "SMBIOS|Type 22|Location",
        "CD_9E0BBFD642722F22A3DE9294E48CA8E34C291ACC893F65DEE82C20A071D99D86.2525.2912366455.642",
        "IdleStateAccountingEx",
        "Initiator Node Already Exists",
        "CR_85F4FD558CEB2D53836A59CA16C7897C522A861DD40C1B575F3D3B0B10636B7E",
        "-Sunday",
        "Often, a temperature sensor is installed in a package such as a chassis or a rack, not to measure any particular device, but the package's environment in general.  This relationship is described by the CIM_PackageTempSensor association.",
        "The PartComponent reference represents the network connection (to this computer system).",
        "TRC_ERROR",
        "HOSTPROC_TRACE_API Flag",
        "The ThreadStartTrace event class indicates a new thread has started.",
        "SignatureFallbackOrder",
        "{4C572733-2FBA-4346-9601-F86DBA666EF2}",
        "R_1D13F523791F1EB20EAEF6F153AF80EF4F13EE29DAAF24D54E908D208A687279",
        "SHUTDOWN",
        "DtcTransactionsTraceSettings",
        "TEST_TRACE_RESERVED_0a",
        "onAccessScanningEnabled",
        "The DisplayFlags property indicates whether the display device is color (versus monochrome), and non-interlaced (versus interlaced). By masking its value with the DM_GRAYSCALE and DM_INTERLACED masks respectively, DisplayFlags indicates whether the display device is color (versus monochrome), and non-interlaced (versus interlaced). The DisplayFlags property contains two bits of information about the display.  ",
        "The maximum number of sessions a host can accept at one time.",
        "PageFault_ImageLoadBacked",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\nwlnkipx\\Parameters|VirtualNetworkNumber",
        "DependentProduct",
        "IPDstPrefixMatchCondition",
        "V.22bis",
        "MaxCDBLength",
        "A Win32 error code that indicates the actual failure.",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSSESSIONSETTING_Prov\"",
        "C_D821F8DA4BB17D06861EA625B573DB6B0B2A831564E8C02E1D4046ADA0C2D7FB",
        "KmdfTraceGuid",
        "AOLEXPLOIT",
        "CD_976460FC508BD53D3838566D8C58041C0F122103C6C680E64E3D0EE074E4E90C.1924.2083649903.1049",
        "The number of broadcast bytes transmitted without errors through this interface.",
        "InstallWindowsDefenderApplicationGuard",
        "Example: Primary disk",
        "Inherit",
        "ConnectionErrors",
        "ProcessorName",
        "CD_36FFCD7C103F4CB151534CDC404DD1E71C91E39EA5D1DCB2E130739044899EBB.1502.560625237.4551",
        "// the flags and values are taken directly from the iSNS spec",
        "The Imported property indicates whether the shadow copy was imported onto this machine using the Import method rather than created using the ShadowCopy create method.",
        "SOMOrder",
        "Trusted network DNS suffixes for the auto-triggered VPN connection.",
        "RSOP_PolmkrProSetting",
        "Describes the volume level of the audible tones from the modem. For example, high, medium or low volume can be reported (values 3, 4 or 5, respectively).",
        "The Msft_WmiProvider_OperationEvent_Pre event class contains the operation event generated prior to calling provider implementation.",
        "The type of the ODBC DSN to remove. Possible values are 'User', 'System' or 'All'.",
        "settings. Examples of configuration changes affected are IRQ settings, COM ports and BIOS version, to name a few.",
        "Cannot register/unregister the storage subsystem on local host.",
        "The Win32_PortResource class represents an I/O port on a Win32 computer system.",
        "WFPCompatibility",
        "Maximum transfer rate (in bits per second) supported by the SCSIController.",
        "IntranetZoneAllowUserDataPersistence",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.2426.1729662260.194",
        " in it and provides path information for the grouped files.",
        "Session Cxn Timeout Errors",
        "Logical devices may have memory installed on them or otherwise associated with them - such as cache memory. This is made explicit in this association.",
        "C_8B69999466A9B0AA953868559581679FA4866B51DCA8E619279463BF323E73B7",
        "C_CCF174B484763861274B422B027A53D668C2557EB827A557AB0E7FF6CCAC8EF5",
        "A string that uniquely identifies the type of the object that triggered the fault.",
        "SignedItemType",
        "This parameter allows the user to specify the FriendlyName at the time of the storage pool creation. FriendlyNames are expected to be descriptive, however they are not required to be unique. Note that some storage subsystems do not allow setting a friendly name during pool creation. If a subsystem doesn't support this, storage pool creation should still succeed, however the pool may have a different name assigned to it.",
        "{f917b663-845e-4d3d-b6d4-15eb27af81c5}",
        "IPv4Address",
        "The health status of this folder, based on the values that were set in the Win32_FolderRedirectionHealthConfiguration properties.",
        "PrintTestPage",
        "ATAPI Failure Predict Data",
        "MaxPixelRate",
        "ClientLoadableCLSID",
        "WQL:References",
        "0xC0000007",
        "Values: TRUE or FALSE. If TRUE, the driver ignores any bytes received, unless the DSR modem input line is high.",
        "CIM_BIOSFeatureBIOSElements",
        "SCSI Fibre Channel (Fibre)",
        "Maximum Sectors Per Read",
        "Kerberos Change Password",
        "SpecifyMaxMemory",
        "Reserved3 Flag",
        "The value of this property identifies the language edition of this software element. ",
        "1 for 16 ",
        "Number of requests to send",
        "DiffVolume",
        "Specifies that the VPN connection should be removed from the AllUserConnection phone book entries.",
        "Domain Name",
        "Period in 100ms increments for reporting that an information exception condition has occurred.",
        "s. This property must be NULL if OperationalStatus does not contain 1 - 'Other'.",
        "Reply-To line for the email message. If NULL, no Reply-To field will be used.",
        "TotalUsedClusters",
        "R_9F2C8728656BD03C35DD704E67342E1CE48E0B661EEBE259A5EA9C171C77DCFF.2457.1498661043.554",
        "Low Fuel",
        "CIM_Printer.LanguagesSupported",
        "Depth",
        "WeekInMonth",
        "The PageFileUsage property indicates the amountof page file space currently being used by the process.",
        "This property helps to identify the System object in whose scope this instance of PolicyAction exists. For a rule-specific PolicyAction, this is the System in whose context the PolicyRule is defined. For a reusable PolicyAction, this is the instance of PolicyRepository (which is a subclass of System) that holds the Action. ",
        "InvalidDwordCount",
        "I/O Read/Write/Flush Start Event",
        "SessionKeyRenewalInterval",
        "Thread Pool Thread Set",
        "C_7F37FED1C026EDCE926CB499855DB24934E3ECD34B906BCF0F300E633AFADD55",
        "ROOT\\Rsop\\User\\S_1_5_21_3968686040_3210279463_847977608_1000",
        "This field denotes the specific error code used for 'Not in Cache'.",
        "AllowInstallationOfMatchingDeviceInstanceIDs",
        "0x000400",
        "IPsec encryption level for DNSSEC.",
        "SpareByte",
        "This class represents health-related system activities that are rolled up and scoped by the three designated health-monitored classes, i.e. MSFT_StorageSubsystem, MSFT_FileShare, and MSFT_Volume.",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_5209325547C4C3DC85433F489AC2215394EE00249CB48AA92AD2B0B6C8014C31",
        "there",
        "MIF.DMTF|Temperature Probe|002.6",
        "Number of threads per processor socket.",
        "SW_SHOW",
        "{51565945-498A-4a77-ACC6-151BECC805CA}",
        "SecondTransformType",
        "The DNSDomain parameter specifies the DNS's domain. This parameter is represented by an organization name followed by a period, then an extension that indicates the type of organization./n Example: microsoft.com",
        "The BufferSize property indicates the buffer size sent with the ping command.  The default value is 32.",
        "VirtualDiskName",
        "The original volume",
        "The FileName input parameter is a string representing the new name for the logical file (or directory). The FileName input parameter must be a fully qualified path name. Example: c:\\temp\\newfile.txt.",
        "The Location property indicates the physical location of the memory array.",
        "The CIM_ConnectedTo association indicates that two or more physical connectors are connected together.",
        "OSName",
        "{bbbc81cf-e219-469c-a405-f820ee496194}",
        "Clears any previously specified listening port. Applies to KMS hosts only.",
        "TotalUsers",
        "PartitionDevice",
        "The TreatAsClsid property contains a Globally Unique Identifier (GUID), of a COM component that can emulate instances of this component.",
        "EC2N-185 bit field element",
        "RD_TRACE_RESERVED_1b",
        "CreatediSCSISession",
        "IPXVirtualNetNumber",
        "DHCP Enabled",
        "XATransactionsEnabled",
        "6to4 tunnel interface",
        "UdpIPv6Enabled",
        "HotStandby",
        "Win32_LogicalProgramGroup",
        "object:MSNdis_GroupAffinity",
        "Software NMI",
        "I/O Device Error",
        "The TimeStampRecordAddressResolved property holds the resolved address corresponding to the TimeStampRecordAddress entry.",
        "A user-settable, display-oriented string representing the name of the virtual disk.",
        "DefaultJobPriority",
        "PCI_BUS_ID_SegmentNumber",
        "R_C5761C3070F8524ADE05668572E4FDB40ECD5928A4711EFE630E999B3BD9F768.2465.1206482617.554",
        "SEL_EVENT_DIR is valid",
        "IR_00A3D44FFAF8698AE63571084DAA6CF90AC720DEC2AEF17232DB655787BF4EA0",
        "This enables power traces",
        "TXFFCB",
        "SDBUS_DEBUG_DEVCMD",
        "Represents the total output power of the power supply in milliwatts. 0 denotes 'unknown'.",
        "This specifies whether the user credentials are cached for subsequent connections.",
        "SW_SHOWNA",
        "A bitmask that defines optional properties of the underlying driver or its NIC.",
        "Stack3",
        "{a3ec8fe8-83cd-40af-9513-11936d531cea}",
        "16 - 'Supporting Entity in Error': This status value does not necessarily indicate trouble with the disk, but it does indicate that another device or connection that the disk depends on may need attention.",
        "CreatedReplicaPeer",
        "PMESignal",
        "NetOffloadGlobalDisabled",
        "__GENUS",
        "HttpConnectionCount",
        "I/O port management.",
        "Datatype",
        "TXFFCB Flag",
        "SAM Delete Alias",
        "DsnType",
        "Software licensing server URL for the process certificate",
        "Monochrome/grayscale display",
        "{98C7E2C7-D592-11d2-B355-00105A0A323A}",
        "D731582B47CFA9BC650A236C1F46BF8FBD13E2443B7BC5F904",
        "Major version number of the application.",
        "An array (bag) of strings that specify the roles this System plays in the IT-environment. Subclasses of System may override this property to define explicit Roles values. Alternately, a Working Group may describe the heuristics, conventions and guidelines for specifying Roles. For example, for an instance of a networking system, the Roles property might contain the string, 'Switch' or 'Bridge'.",
        "Extension GUID",
        "LoginNegotiateFails",
        "DOT11_MSM_CONNECT Flag",
        "CD_2A9212E5C5A3E7B6904A9AD5755292499E2868895335A7FB104CA7C39F4970DA.33.4059063771.472",
        "The Setting reference represents the Win32_SerialPortConfiguration containing a configuration setting for the serial port.",
        "08DF14CD383D0A357608E0BFF28F226F0190D45",
        "CD_E0728E680677E2DC755DB0B32FACA9688F4B71D12279046ADFB604C5714997EF.35.4240126380.467",
        "RDP Security Layer: Communication between the serverand the client will use native RDP encryption.",
        "{C170CF06-DB34-11d2-85FC-0000F8102E5F}",
        "The NumberOfLogicalProcessors property indicates the number of logical processors currently available on the system.",
        "SW_SHOWNOACTIVATE",
        "Win32_PnPSignedDriver",
        "RSOP_IEEE80211GroupPolicySetting",
        "WriteOnly",
        "Fixed Frequency Color",
        "Win32ErrorCode",
        "Quotas Incomplete",
        "A string describing the Sensor type - used when the SensorType property is set to \"Other\".",
        "BthActiveConnect Flag",
        "VoiceSwitchFeature",
        "ProviderOperation_PutProperty",
        "DisplayName",
        "RAS Entry Data Size",
        "CD_20EDCE2D529E2E6BCE41DEE4170C3E9E6D3DEAF61091F14E5541886CD554DE30.1667.2913789371.362",
        "NumberOfTransports",
        "LastErrorCode captures the last error code reported by the LogicalDevice.",
        "The service metadata settings.",
        "The ProviderOperation_ExecMethodAsync property indicates the number of calls to IWbemServices :: ExecMethodAsync.",
        "__ClassProviderRegistration",
        "A link between the computer system and the operating system(s) installed or loaded on it. An operating system is 'installed' on a computer system, when placed on one of its storage extents - for example, copied to a disk drive or downloaded to memory. Using this definition, an operating system is 'installed' on a NetPC when downloaded via the network.",
        "Array of ACPI processor idle states (C-states)",
        "WmiQueryReceiveFilterHardwareCapabilities",
        "Group is nameable",
        "MinDevicePasswordComplexCharacters",
        "The PatchPackage class describes all patch packages that have been applied to this product. For each patch package, the unique identifier for the patch is provided along with information about the media image the on which the patch is located.",
        "LastAttemptedProfileDownloadTime",
        "InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls",
        "If the profile is a roaming profile, this property is a DATETIME value that indicates the last time an attempt was made to upload the profile to the server, even if it was unsuccessful.",
        "MACAddresses",
        "Per Week",
        "TStateVersionInUse",
        "NTEventLog",
        "RD_TRACE_PROCESS",
        "The remote network address used for the connection",
        "The IEEE 802.1Q VLAN ID assigned to this NIC.",
        "Network Client management.",
        "acquireformodwrite",
        "CD_20A36A4D13FFEDA4F3BF68F20D7254C0839ABA34ECA738010C8AC2B49156D61F.1617.4065007010.651",
        "PolicySourceAudioCaptureRedir indicates whether the property AudioCaptureRedir is configured by Server (0),Group Policy (1).",
        "C_92F96D470C0B7C61CA6FF1288FC335BCE4A6A5FC50FC3D3E646C17CCD603F881",
        "TS_TRACE_LEVEL_ERROR",
        "Empty Address",
        "NDIS ATM Maximum Active VPI Bits",
        "MSMouse_PortInformation",
        "EnumerateKey",
        "Sets driver properties via an MSFT_Printer object",
        "An array of strings containing directories to exclude from the roaming profile.",
        "Specifies whether the runtime will complete the instance after the Operation.",
        "AutoTreatAsClsid",
        "ServiceModel Contract",
        "QryInfoTrustDom_End",
        "RegistryEventProvider",
        "READ Flag",
        "InitialProgramPolicy",
        "IPv4TransmitIpOptionsSupported",
        "The transforms of the product.",
        "ReferenceObject",
        "The Handle property represents a handle to a thread. The handle has full access rights by default. With the correct security access, the handle can be used in any function that accepts a thread handle. Depending on the inheritance flag specified when it is created, this handle can be inherited by child processes.",
        "MSNdis_AtmMaxAal34PacketSize",
        "char16",
        "ConfirmationStatus",
        "ServiceDependencies",
        "ProbableCause",
        "An enumerated integer indicating that the referenced setting is a default setting for the element, or that this information is unknown.",
        "NS_FE3EA006C3292950A76C2B5A0185D7DF99ADD6FD6502E0AC079E3A8650E76E3A\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_FDC07BF412EF517BF16CBEA0AD032C8FE94CB2DD73B9CD909C08659DB8C5BC0A",
        "    //login          - The TCP connection has been established, but a valid iSCSI",
        "RemovableDiskDenyWriteAccess",
        "_DH_DEFAULT",
        " The OtherTargetOS property records the manufacturer and  operating system type for a software element when  the TargetOperatingSystem property has a value of  1 (\"Other\").  ",
        "SetByInputObject",
        "PNP Bus",
        "Win32API|Tool Help Structures|THREADENTRY32|th32OwnerProcessID",
        "CD_C793B9525D878D9706E959E8F468E81449F6D48F127A802D380F8F7D8B8795DB.2220.1.13418",
        "Parity Check Enable",
        "MSFT_NetAdapterPowerManagement_Offload_Arp",
        "Generic Error",
        "The MaxCacheSize property indicates the maximum cache size installable to this particular cache memory.",
        "C_259A5E159C9BC70687CA1D3524FF3E5AFC0180D51D46E1351D0D2A9510F67A46",
        "SamQueryInfoAlias",
        "Per MilliSecond",
        "Process_Terminate_TypeGroup1",
        "MDM_SecureAssessment",
        "Request timed out, retry may be effective",
        "OMI_Error is a class used to report errors in the OMI infrastructure and components built on that infrastructure.",
        "The Win32_StartupCommand class represents a command that runs automatically when a user logs onto the computer system.",
        "C_D6EC41525ABC21864A19F0FDAF8BF6677886C4CAC1281F55DE47919C07EC9C67",
        "Base storage event indication",
        "Configuration item",
        "C_BFFBB3D86E600A82D520DD30A8659721378043D33095F0E858A6F28BF4593D34",
        "TransferRate",
        "The SourceRoute property contais a comma separated list of valid Source Routes.",
        "The ProviderOperation_CreateRefreshableEnum property indicates the number of calls to IWbemHiPerfProvider :: CreateRefreshableEnum.",
        "Extended LUN to virtual port mapping.",
        "SDBUS_DEBUG_DEVCMD Flag",
        "CR_6EB3291DAFAF5E4121A6DBB7E0E41C22E85218F8922D3C0FEDA4960BE686F47A",
        "CD_9A1C938ACA675F962ECF2A2D496BBF16933C0F6F4FA335A59840FFDE0DC3612B.1466.2230921516.861",
        "Sync over metered network flag",
        "Boolean indicating that the equipment includes a visible alarm.",
        "Url on which the server interface listens for HTTP(S) requests OR Url to which the client interface sends HTTP(S) requests",
        "Enable Offline Diags",
        "0 - 'Unknown' meaning it is unknown as to what recovery action to take ",
        "iScsiFlagTimer Flag",
        "HardwareEncryptionStatus",
        "SwitchCount",
        "AttributeCachingForRegularFilesMax",
        "NewTriggerByOnce",
        "Win32API|Communication Structures|DCB|Parity",
        "The EncryptionMethod property is a free form string indicating the algorithm or tool used to encrypt the logical file. ",
        " 0x00000003 ",
        "SAM Get Groups For User",
        "The TcpMaxConnectRetransmissions property indicates the number of times TCP will attempt to retransmit a Connect Request before terminating the connection. The initial retransmission timeout is 3 seconds. The retransmission timeout doubles for each attempt. Default: 3, Valid Range: 0 - 0xFFFFFFFF.",
        "BackfillSize",
        "MSWmi_GuidRegistrationInfo",
        "Status information for a printer, beyond that specified in the logical device Availability property. Values include \"Idle\" (3) and an indication that the device is currently printing (4).",
        "An array of keywords for characterizing / categorizing policy objects. Keywords are of one of two types: ",
        "Last error code for the IP-HTTPs interface",
        "FabricPortId",
        "OnDemandProgId",
        "Long Read DSL",
        "The Win32_SystemDevices class represents an association between a computer system and a logical device installed on that system.",
        "{120BB700-DB2B-11d2-85FC-0000F8102E5F}",
        "The Type property indicates the type of SAP such as 'attached' or 'Redirected'.",
        "6to4 global settings associated with this interface",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|SpeakerVolume_Low",
        "Generic_Error Flag",
        "ROOT\\cimv2\\mdm\\MS_409",
        "CD_20CFEAED94ACDCC3A138A72CB986A84D9FCBF45A8FD6E58CA8EE0387379B9D44.2612.2894527643.415",
        "TRACINGDEVICE Flag",
        "IL_F55E9786D9F50DBDFB52762DDD65690364DF865004D37F7A0B919F2DED2C5FD1.317.1.19893",
        "Packet Too Big",
        "Limit Die On Unhandled Exception - Forces a call to the SetErrorMode function with the SEM_NOGPFAULTERRORBOX flag for each process associated with the job.",
        "Modem",
        "{2F156260-DB21-11d2-85FC-0000F8102E5F}",
        "StorageRack",
        "{1ac55562-d4ff-4bc5-8ef3-a18e07c4668e}",
        "WMI|Win32_MemoryDevice",
        "Maximum number of buffers of ETW trace session.",
        "Print Flag",
        "NdisFddiStateSignal",
        "{e712d39d-a3a6-4224-a1bd-4717b24e4e8c}",
        "REDBOOK_WMI_PERF_DATA_PROCESSED",
        "Specifies the name of the VPN connection profile for which trigger properties to be retrieved.",
        "The TotalPhysicalMemory property indicates the total size of physical memory.",
        "MIPS R4600",
        "Whether router advertisments are to be sent on this interface.  Default is Disabled.",
        "CD_E4F1C8D43CF6961CAD75D4CE9F32B9D90760450C3087C094F4C15FE6A994A33D.2136.55714116.604",
        "AppvClientPackage",
        "Running",
        "Whether the Terminal Server restricts remote applications to those on the list.",
        "PolicySourceCOMPortMapping",
        "ErrorCorrectType",
        "NT eventlog file management. ",
        "The port number passed is not valid for the initiator.",
        "R_06F709A163637DA41871EC661878543C4C8F0288DCF32B1331F472D89C57FA5E",
        "C_E78B24A63ACB40A253226DA76298C783683B9FFCFE28CF1078C510D46CEF2248",
        "Output Device Error",
        "Special wide path through serial hardware lines",
        "WSP_Disk",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|Terminator",
        "NoPrint",
        "DisableRealtimePersistence",
        "The proposals within this set, in order of preference.",
        "LPC_TRACE_RESERVED_0b",
        "LTO Accelis",
        "Utf8WithMapping",
        "instance ",
        "Win32API|Access Control Enumeration Types|SID_NAME_USE",
        "FeedbackHandler",
        "StatisticsInfo",
        "PlatformStatus",
        "IMFilter",
        "SecondsSinceLastReset",
        "iSCSI Sessions",
        "The full pathname of the file or directory",
        "Requests that the LogicalDevice be brought online (\"Online\" input parameter = TRUE) or taken offline (= FALSE). \"Online\" indicates that the Device is ready to accept requests, and is operational and fully functioning. In this case, the Device's Availability property would be set to a value of 3 (\"Running/Full Power\"). \"Offline\" indicates that a Device is powered up and operational, but not processing functional requests. In an offline state, a Device may be capable of running diagnostics or generating operational alerts. For example, when the \"Offline\" button is pushed on a Printer, the Device is no longer available to process print jobs, but could be available for diagnostics or maintenance. ",
        "MSFT_TaskBootTrigger",
        "The organization that defines this profile.",
        "Indicates if LSOv2 is currently enabled for IPv4 TCP packets.",
        "LPC_TRACE_RESERVED_18",
        "Identifies an instance of MSFT_BranchCacheStore",
        "C_54C8B2145FBF6DCDCAEFF33B39FBF359799D5087F9B974E853C4A5903604B330",
        "PNP_REGISTRY_INFO_LEVEL Flag",
        "MsftDiscFormat2Data_DebugGeneral Flag",
        "SW_NORMAL",
        "The Element reference represents the computer system where the desktop configuration exists.",
        "ManufacturerVersionFull20",
        "PC-98/E add-on card",
        "CritSec",
        "MemSize",
        "MessageArguments",
        "RemoteMachineEmpty",
        "Win32_NetworkClient",
        "41003",
        "Hardware error. Check drive",
        "Sensor (discrete sensor) for IPMI",
        "TcpIp Send/Receive",
        "{5D06847A-DB34-11d2-85FC-0000F8102E5F}",
        "{D25E0260-AAB7-48cb-A192-4D73D2FD375F}",
        "TimeWait",
        "The number of bytes received using the ESP protocol.",
        "The ThreadState property indicates the current execution state for the thread. A thread can have one of eight values: Initialized (recognized by the microkernel), Ready (prepared to run on next available processor), Running (executing), Standby (about to run, only one thread may be in this state at a time), Terminated (finished executing), Waiting (not ready for the processor, when ready, it will be rescheduled), Transition (thread is waiting for resources other than the processor), and Unknown (the thread state is unknown).",
        "SECURITY",
        "Set Local Configuration Manager settings that are used to control Configuration Agent.",
        "RD_TRACE_DEVIF Flag",
        "DisableAppBrowserUI",
        "MSFT_NCProvCancelQuery",
        "RD_TRACE_RESERVED_1b Flag",
        "R_6AE72BDD0B919DBFC69F59E9377DA38DCBBAC21329EE0949152EC064204ABDC2.11.696898079.524",
        "This field is a free-form string indicating where the hardware is located.",
        "Process_V3_TypeGroup1",
        "ProcessorIndex",
        "{F4546078-F3B2-417E-94CD-47EA306C5751}",
        "HashAlgorithm",
        "lE706FF8586C52A7176ACA48D7702EC2A6550564F0E42B0C09AE3FD1CCEA62CD4",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\CrashControl|MiniDumpDir",
        "Add allowed applications to the Controlled folder access feature.",
        "This method will reinstall the associated instance of Win32_Product using the specified reinstallation mode. The method can return the following values:",
        "The scoping Log\\'s Name.",
        "MSFT_NetIPHttpsState",
        "LocalOrUtcTime",
        "The type of PCI device.",
        "The count of invalid KMS requests.",
        "Padding1",
        "C_E00F912E9047D1A2BF3DA9E198CE534F57C5B76F41F1AAB4887EE2C73627DAB0",
        "Greyscale",
        "The maximum power budget allowed by this power meter.",
        "CD_4B3CC5F49167F6FB69E56B79BCD6431008E7D86DB966C05AB2DF4218DD0EABBE.1490.1222519961.625",
        "EventId",
        "CD_ADECB48EEF41EBFB1D5570217FF2A1BA19BC73CECF67D875589C0486F35636B9.1210.3203630919.1373",
        "Indicates if the Adapter supports UDP checksum computation offload for transmit IPv6 packets.",
        "TRUE if compression is enabled.",
        "The unique identifier for the category.",
        "ThreatIDDefaultAction_Ids",
        "The PasswordChangeable property determines whether the password on the Win32 user account can be changed.",
        "KeyManagementServiceTotalRequests",
        "The SetTcpMaxConnectRetransmissions method is used to set the number of attempts TCP will retransmit a Connect Request before aborting. The initial retransmission timeout is 3 seconds and doubles for each attempt.The method returns an integer value that can be interpretted as follows: ",
        "An integer that defines how many messages can be sent simultaneously without allocating new writers.",
        "LUAInstall: error 0x00000005 setting flags [{93714ED0-53F0-11D2-9EE6-006008039E37}]",
        "The number of this device",
        "MSFT_iSCSISession",
        "DiscardNULLBytes",
        "The differential volume",
        "C:\\Windows\\System32\\GroupPolicy\\User",
        "One TargetPort per view",
        "IPv4DefaultGateway",
        "Documentation",
        "SignatureStateNotifications",
        "IL_F64CBB6502987426C70B3559DBDC49D7508E36CCA9EC2C17804EE9C4A5287859.1781.1862597321.384",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_B3CCF51DA7E2E82EF4B967050224C72E8B5296498ACE167E310066C0B48C98F45200",
        "R_9E80816304B77C3F7FB69E6FA27E369EEAF4355C2560E5D96A7A1A687778DD04",
        "PeerTransportSecuritySettings",
        "System_AuditOtherSystemEvents",
        "RemoveConfiguration",
        "AllowDownVersion",
        "The number of active MAC addresses on the non-default VPorts",
        "59001",
        "MSFT_iSCSIConnectionToDisk",
        "InterfaceDescription",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1475.418471363.292",
        "C_C867B637B25E413A5893A8DF403F24B113B36FB9DA058811D901C232D15C4E60",
        "VppMixedVoltageSupport",
        "R_11BDD83D3BDB7F7DD4A04A3CC49869E53E73157A8718941705A791A42E561334",
        "The data file participating in the execution of the process.",
        "Acpi _PCT control register",
        "The WINSScopeID parameter specifies the Scope ID value that will be appended to the end of the computer's NetBIOS name. Systems using the same Scope ID can communicate with this computer.",
        "The DaylightHour property specifies the hour of the day when the transition from standard time to daylight savings time occurs on this operating system.",
        "MSiSCSIInitiator_iSNSServerClass",
        "InterruptCount",
        "ExcludeCAName",
        "Specifies the number of entries in the Privileges array.",
        "Remove a virtual port ",
        "The total amount of physical memory (in Kbytes) available to the OperatingSystem. This value does not necessarily indicate the true amount of physical memory, but what is reported to the OperatingSystem as available to it.",
        "8,     256KB,  128 bytes/sector",
        "CIM_Chassis",
        "PrimaryPath",
        "A brief description for Licensing Mode",
        "Specify the path of the program that need not use a Virtual IP. If the program does not exist in ProgramList, the return value should indicate appropriately. Otherwize it will be removedfrom the list of program in ProgramList.",
        "Win32_PnPDevicePropertyBooleanArray",
        "Ndis80211WLanBssIdLength",
        "PCI Component Information - Class Code SubClass",
        "0xD000",
        "SM_ScsiReportLuns",
        "The key to identify the instance of MDM_SideLoader class.",
        "{3d6fa8d4-fe05-11d0-9dda-00c04fd7ba7c}",
        "EscapeP",
        "This identifies the state of the optional feature. It shows if the Optional feature is enabled, disabled, absent or unknown",
        "Error type of the major error in the section",
        "Certificate Issued By",
        "\"Critical Failure\" (25) - The element is non-functional and recovery MAY NOT be possible. ",
        "I2O boot is supported",
        "MSNdis_80211_InfrastructureMode",
        "Parallel Port Alloc Free Counts",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|Max DB Size",
        "ScheduledInstallTime",
        "MobileOperatorName",
        "AddPrinterDriver",
        "Indicates whether the device is using a user-defined configuration.",
        "UNKNOWN",
        "Values: TRUE or FALSE. A value of TRUE indicates  XON/XOFF flow control setting is supported.",
        "object:MSFT_NetAdapterLargeSendOffloadV2Capabilities",
        "CompressionFormat",
        "Bid2Etw_MSDASQL_1_Trace",
        "C_ECB038604F9CFB5C266539C1297002E6A1178A983B1B38CAC375931349F1C5AD",
        "0x400",
        "CIM_CompatibleProduct",
        "LastFullScanAge",
        "C_A8D7D05E30C15984C36B978D9865EFFD857B3D0BF5D2F0230858282BB5082506",
        "SPACES_VirtualDiskToStorageFaultDomain",
        "Recurse",
        "TRACE_CLASS_PACKET Flag",
        "SessionsForcedOff",
        "Number of PDU sent over this session",
        "The Scale property specifies the factor by which the printed output is to be scaled. ",
        "CIM_ServiceAccessPoint represents the ability to utilize or invoke a service.  Access points represent that a service is made available to other entities for use.",
        "CD_7AC6B537C17B7A0CE625AFA6380E4FC98418E800AD64DF240D5A7AD2482283AD.1741.1528103963.3269",
        "I_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848.281.3674678782.266",
        "ROOT\\Microsoft\\Windows\\RemoteAccess\\Client",
        "The DesktopInteract parameter passes the value that indicates whether the service can create or communicate with windows on the desktop.",
        "UInt64",
        "DecompressionEnabled",
        "DefaultPriority",
        "R_4082A72ACD016CE3E809C18525EF28CAFFEB76B1D6E2F5C00FFCF2C67654A896",
        "Per Device",
        "Is deleted",
        "Allows an administrator to specify if Automatic Exclusions feature for Server SKUs should be turned off.",
        "VersionID",
        "Acpi C-state type (1=C1, 2=C2, ...",
        "PowerManagementSupported",
        "This parameter is used to specify the list of volumes that should be excluded from autochk at next reboot. The string syntax consists of the the drive letter followed by a colon for the logical disk.",
        "The current speed (in MHz) of this processor.",
        "This property is a set of bit flags that specify when to start the service.",
        "CD_DA629F0FADBF1E9D6C65713F31978C9EA30680E880B4ED8EDE3DC7BD5AFDAA23.1829.1813233206.431",
        "QOSWMI_TRACE_CALL",
        "S-1-5-32-544",
        "Dot11 Connection Start status information.",
        "Remote IP Address",
        "#define SendRNID_OUT_ResponseBuffer_SIZE_HINT 76",
        "TRC_FN_LEAVE Flag",
        "IP WINS Address",
        "SystemConfig_V2_FlightIds",
        "0x000 ",
        "Win32_ComputerSystemEvent",
        "Maximum number of shadow storage areas reached",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|IGMPLevel",
        "TcpIp Send",
        "cleanup",
        "ScriptText",
        "84m;84m;",
        "Win32_PnPDevicePropertySint8Array",
        "IPv6ReceiveUdpChecksumSupported",
        "iScsiFlagScsiDataIO Flag",
        "ericSensorHealthState",
        "CIFS(SMB)",
        "CD_09CCBE426DD52D60374145524B2F98C4F709DE617A8D3D97D699BC5E8702A3D1.2623.3454393096.395",
        "{8502C4C5-5FBB-11D2-AAC1-006008C78BC7}",
        "JAZ Disk",
        "{FAF76B9B-798C-11D2-AAD1-006008C78BC7}",
        "The Name property indicates the alias given to a path set up as a share on a  system./nExample: public.",
        "Keyboard Port",
        "SendRNIDV2",
        "Revolutions",
        "EncryptionFlags",
        "12     This device cannot find enough free resources that it can use. ",
        "Total size of the volume.",
        "Record ID used for System Event Log access",
        "RTSFlowControlType",
        "The WriteOperationCount property specifies the number of write operations performed.",
        "Win32API|Communication Structures|DCB|fAbortOnError",
        "PS_BackgroundTask",
        "The Win32_ComClassAutoEmulator class represents an association between a COM class and another COM class that it automatically emulates.",
        "MIF.DMTF|Voltage Probe|001.13",
        "Registy Hive Link",
        "Note: In order to use the Change method to change a service from network service to local system, the StartName and StartPassword input parameters should be given the following values: ",
        "Antecedent represents the independent object in this association.",
        "iScsiFlagScsiDataIO",
        "Number of bytes for dot11 TKIPMIC Failure status indication",
        "This is the disk signature.",
        "IoPriority",
        "Example: B1.",
        "MSFT_NetServiceConfigBackoutFailed",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_profile",
        "Indicates the current operating status of the target port.",
        "Configuration settings for IP-HTTPs",
        "SGRAM",
        "picks defaults based on the size of the volume. These defaults have been selected to reduce the amount of space lost and to reduce the amount of fragmentation on the volume. For general use, default setting (zero) are strongly recommended.",
        "MSStorageDriver_SenseData",
        "91 - Access denied",
        "The firewall rule.",
        "Specifies the name of the computer that the printer will be added to.",
        "A text string that qualifies the value in the ComponentId property. A qualifier is used to distinguish multiple forms of the same software element, such as a software element that is implemented in multiple languages.",
        "PFSInUse indicates whether perfect forward secrecy is required when refreshing keys.",
        "CD_6E3B4399FA4EDE750602EAE85FB276C1B64644E78344F6BB3EF3F442D17FE8D8.1185.358192853.328",
        "ProtectiScsiTraffic",
        "A link between a process and a data file indicating that the file participates in the execution of the process.",
        "FX_TRACE_REMOTE_IOTARGET",
        "LastSyncDurationUnhealthyInHours",
        "EnableInAppCustomization",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.2168.772470297.3240",
        "Creation",
        "RSOP_IELinkItemLink",
        "OpticalRead",
        "The description of the object that triggered the fault",
        "CIM_VideoController",
        "SHA-1",
        "Brings the disk online.",
        "Within the scope of the instantiating Namespace, InstanceID opaquely and uniquely identifies an instance of this class. In order to ensure uniqueness within the NameSpace, the value of InstanceID SHOULD be constructed using the following \\'preferred\\' algorithm: ",
        "Power Flag",
        "An array of free-form strings providing more detailed explanations for any of the BIOS features indicated in the Characteristics array. Note, each entry of this array is related to the entry in the Characteristics array that is located at the same index.",
        "Disk Geometry",
        "iScsiFlagLock",
        "ValidateShareScopeNotAliased",
        "// The number of active IPSEC SAs",
        "C1717231-5F16-4AE6-966F-6CA856B7AAF6",
        "MSiSCSIInitiator_TargetMappings",
        "MIF.DMTF|Software Signature|002.4",
        "{52E56374-B17E-41DC-00EC-FC3E6E8D8783}",
        "NDIS Query TCP Offload Current Config",
        "Variable",
        "Associated IPSec Custom Policy.",
        "LLTDSVC",
        "The DaylightHour property specifies the hour of the day when the transition from standard time to daylight savings time occurs on this operating system. ",
        "{8502C501-5FBB-11D2-AAC1-006008C78BC7}",
        "{45049fc6-54d8-40c8-9c3d-b011c4e715bc}",
        "Support16BitMode",
        "C_F69D8029CE443505782739E5EA30F705BD18A050DBF4E379EF0B690D5B10D87B",
        "Specifies the HTML editing program you want to use with Internet Explorer.",
        "7 - Fatal/NonRecoverable should be used to indicate an error occurred, but it's too late to take remedial action. ",
        "CountrySelected is a string value defining the country/region for which the modem is currently programmed. When multiple countries/regions are supported, this property defines which one is currently selected for use.",
        "APM is supported",
        "RSOP_IEESCSecurityZoneSettings",
        "Input",
        "Listed monitor frequency ranges",
        "// names for each port",
        "Association",
        "NoDriveLetter",
        "15 - 'Dormant': The volume is reachable, but it is inactive.",
        "R_7CBBFC903B769BFE526D96D753E16AD7ABA21D8A6B6B1A1612CBB8FF7201B692",
        "NDIS ATM Maximum AAL0 Packet Size",
        "dwCurrentRxQueue",
        "{93e5f37b-7071-4c21-8733-d2eea2691e1a}",
        "MIF.DMTF|Temperature Probe|001.14",
        "ATM Logical",
        "C_CFA7490FC441CDBFE3AC487F4E7E6794E550150460C43DF35BA636FBEF5C66C5",
        "MSiSCSIInitiator_SendTargetPortalClass",
        "{64f756ad-26ae-4ef7-b63c-204599916ad5}",
        "X.25 MLP",
        "The Manufacturer property indicates the name of the manufacturer of the 1394 controller. ",
        "PreventInstallationOfDevicesNotDescribedByOtherPolicySettings",
        "Round Robin with Subset",
        "MSNdis_HDSplitCurrentConfig",
        "SystemConfig_V3_IRQ",
        "StartPort",
        "CR_960A016BC71A8D938443FD5B4BD545FA10D9D76A0776A92D75D4E23235CAD0D0",
        "InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked",
        "IP protocol for this traffic.  Only specified if the traffic is more general than the matching filter",
        "syscall",
        "The Recursive input parameter is a boolean that indicates whether the decompression will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input parameter i",
        "Method to create application job",
        "MSFT_NetSettingData",
        "Discover failed for the root object.",
        "DOT11_AUTOCONF_UI Flag",
        "InterfaceAlias",
        "The TransferRate property indicates the CD-ROM drive's transfer rate. A value of -1 indicates that the rate could not be determined. This could potentially happen, for example, if the CD is not in the drive.",
        "MSNdis_ReceiveBufferSpace",
        "Enable_BCDistributed",
        "Favorites folder, GUID is {1777F761-68AD-4D8A-87BD-30B759FA33DD}",
        "PolicySourceDisconnectedSessionLimit indicates whether the property DisconnectedSessionLimit is configured by Server (0),Group Policy (1), Default (2).",
        "Win32_SecuritySettingOfLogicalFile",
        "Values are TRUE or FALSE. If InfraredSupported equals TRUE, then an IR port exists.",
        "{FAF76B89-798C-11D2-AAD1-006008C78BC7}",
        "EnsureOrderedDispatch",
        "100BaseT",
        " Default inproc handler.   May be optionally provided only for Context = LocalServer or LocalServer32. A non-numeric value is treated as a system file that serves as the 32-bit InprocHandler (appearing as the InprocHandler32 value). ",
        "DnsSecQueryIPsecRequired",
        "The Shortcut target specifies the action to be taken when a shortcut is launched.  This can reference a software feature or a file specification of directory specification.",
        "RSOP_File",
        "Time after lastPolicyApplicationTime when this namespace can be deleted.",
        "Enables or Disables Virtual IP.",
        "This field indicates the physical sector size of the storage pool, in bytes. This value is derived from the backing physical disks for this storage pool.",
        "MIF.DMTF|Serial Ports|004.6",
        "{FAF76B87-798C-11D2-AAD1-006008C78BC7}",
        "_DH_WMPRENDER",
        "TM_ME",
        "MSFT_StorageSubSystemToStorageFaultDomain",
        "MDM_Policy_Result01_DmaGuard02",
        "MDM_BridgeMgmt_Transaction",
        "Physical packages contain connectors as well as other physical elements. The CIM_ConnectorOnPackage association makes explicit the containment relationship between connectors and packages.",
        "Disable behavior monitoring.",
        "Windows Defender Firewall API - GP",
        "LicenseFamily",
        "Available Capacity",
        "IL_77E8F3E5C979A568F3203DE2542233AA744B340EA7CD046A020B3F37D5ECA5F4.313.3856196657.315",
        "MSFT_NetConSecRuleMMAuthSet",
        "{477B769B-785C-48dd-A02E-57E051BE7B85}",
        "MatchAnyKeyword",
        "A free form string indicating the algorithm or tool used by the device to support compression. If it is not possible or not desired to describe the compression scheme (perhaps because it is not known), recommend using the following words: \"Unknown\" to represent that it is not known whether the device supports compression capabilities or not, \"Compressed\" to represent that the device supports compression capabilities but either its compression scheme is not known or not disclosed, and \"Not Compressed\" to represent that the devices does not support compression capabilities.",
        "The Color property indicates whether the document is to be printed in color or monochrome.  Some color printers have the capability to print using true black instead of a combination of Yellow, Cyan, and Magenta.  This usually creates darker and sharper text for documents.  This option is only useful for color printers that support true black printing.",
        "This method will perform an administrative install of an associated Product using the installation package provided through PackageLocation and any command line options that are supplied.",
        "The DNS servers which will be queried when DA is enabled.",
        "The Antecedent reference represents the properties of the system bus that is used by the logical device.",
        "CD_7010B213179D98B16AF38723EE1D750E86F808F341EE215AD8783D29EA117262.0.2693613263.200",
        "Indicates Code Integrity policy enforcement status.",
        "8 - Authenticating",
        "Client can supply target ElementName",
        "AddSyncPair",
        "The end of the local port number.",
        "CD_040BB4AE5C8C1563BE4142EBDDB8539C7E5CCE64A27291E9F997DFF018BE9069.2160.3768636244.1712",
        "Microsoft Reserved",
        "Loaded",
        "2615B27D56E94A95716A",
        "MSFT_DeliveryOptimizationFile",
        "VirtualDiskReplicaPeer",
        "{0F73ED5C-8ED9-11d2-B340-00105A1F8569}",
        "SetForestTrustInfo",
        "FD WNet Trace",
        "Subsystem",
        "HostedCacheServerFirewallRulesEnabled",
        "RestoreFromReplica",
        "DataExecutionPrevention_Drivers",
        "3AD698A5BFCDF51549DD\\I_46525BAD3099F51458A5D518030526DE848A3DE564DD8816A47DE935CCD3FA8213",
        "SMBIOS|Type 22|Manufacturer",
        "A CIM_System is a LogicalElement that aggregates an enumerable set of Managed System Elements. The aggregation operates as a functional whole. Within any particular subclass of System, there is a well-defined list of Managed System Element classes whose instances must be aggregated.",
        "Gets license policy Information of type DWORD.",
        "StatisticsLength",
        "PmcCtrConfig",
        "object:PerformanceStates",
        "Thread Migration",
        "In almost all cases, there will be some files that are immovable. For example, file system and storage driver metadata files are likely to be immovable. For this reason, the amount by which a partition can be shrunk is usually less than the total amount of free space on the partition.",
        "   //  (in bytes) followed by the WCHARs that make up the string.      ",
        "Designates the direction of the traffic flows to trace - Inbound, Outbound, or InboundOutbound. ",
        "// This class uses PDO instance names with 1 instance for each TCP/IP interface.",
        "Set maximum Y resolution supported by the server (minimum is 200 and maximum is 2048).",
        "The CreationDate property is a datetime value indicating the file's creation date.",
        "The partition was deleted, although its access paths were not.",
        "0x00000001 - If the new owner already has a profile, calling this method with this flag will replace ",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.1939.2383100844.2505",
        "Describes the ISATAP service state. One of the following values: disabled, enabled or default.",
        "MSFT_NetAdapterQosSettingData",
        "I_C59E83547F1BC933FE30770D4EDB5077AA988B54FE242F5F66DA214D449E875A.320.1.62809",
        "The name of the user on whose behalf the event occurred, if available",
        "An association between a service and how it is implemented. The cardinality of this association is many-to-many. A service may be provided by more than one logical device, operating in conjunction.  And, any device may provide more than one service.  When multiple devices are associated with a single service, it is assumed that these elements operate in conjunction to provide the service.  If different implementations of a service exist, each of these implementations would result in individual instantiations of the service object.  These individual instantiations would then have associations to the unique implementations.",
        "MPENGINE_UNAVAILABLE",
        "The time that the last memory error occurred. The type of error is described by the ErrorInfo property. If the ErrorInfo property is equal to 3, \"OK\", then this property has no meaning.",
        "The URI scheme for the transport.",
        "MSFT_NetIPAddress",
        "version",
        "This is the time threshold, in hours, after which the profile health is reported as Unhealthy when the profile has not been uploaded yet",
        "Names of interfaces on which to accept incoming queries",
        "Logon Server",
        "The time the service was opened.",
        "TotalTimeUs",
        "The Queue property is used with the LPR protocol to indicate the name of the print queue on the server.",
        "LogRecord",
        "R_B40D3520BE405FC4657163F736BABFC4C621DFE31B785DB86EA40E1DB23F5C09.1155.1802257897.520",
        "IntranetZoneInitializeAndScriptActiveXControls",
        "Zone Index",
        "NETIO_TRACE_TDX Flag",
        "{8502C4B1-5FBB-11D2-AAC1-006008C78BC7}",
        "AppID",
        "NS_741D1F510F67B02AECEE46B61323C34AF59FB3846CC56C042067E65CEDF537D4\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_FFD5182D10C96F3C53E9257F5B142EC4439B6AAEBFBA417E597718215F5C19B0c3110899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109",
        "Subscription",
        "lbase.dll[MofResourceName]",
        "Determines whether the the address is considered intranet or Internet.",
        "Failback",
        "TraceRecord",
        "Contacts folder, GUID is {56784854-C6CB-462b-8169-88E350ACB882}",
        "Certification authority to validate the IPsec channel",
        "Msft_WmiProvider_NewQuery_Pre",
        "If the AM Engine is enabled",
        "Parameterized URL",
        "NDIS Status Port State Change",
        "SupportsGuaranteedBandwidth",
        "The Name property defines the label by which the job is known. ",
        "The start type of the BranchCache service",
        "Count of Logout command PDU with reason code 0",
        "EnableRemoteDesktopMSI",
        "CD_9A36BB4E390B7DD04D76CD832679A7EB96B353EDC2C276A7C316493A7FCF4652.2034.1.11863",
        "MSFC_PortEvent",
        "AuditFail",
        "DSCCoreProviders",
        "OneTimeBootSource",
        "AcquireTime",
        "R_AD28C82889667A5985FA157872F7F42C3CF0F9FD284883BEB8BA71DEFF026FBB",
        "ThreatIDDefaultAction_Actions",
        "RegisteredProfile",
        "RD_TRACE_PNP",
        "65535",
        "This is the time threshold, in hours, after which the profile health is reported as Caution when the profile has not been uploaded yet",
        "Whether the provider supports loopback connections (from a local network address on a given RNIC to the same local address on the same RNIC).",
        "May be one or more of the following:",
        "numEntries",
        "Specifies the name of the resiliency setting that should be used for storage tier creation.",
        "DisallowTileNotification",
        "VESA DFP 1.x (or compatible)",
        "Compare",
        "The fully qualified path of the log file.  Default is %SystemRoot%\\System32\\LogFiles\\WMI\\<Name>.etl.",
        "1 = the application language matched the system language, ",
        "The Win32_NTDomain class represents a NT Domain. A domain is a single security boundary of a Windows NT computer network. Active Directory is made up of one or more domains. On a standalone workstation, the domain is the computer itself. A domain can span more than one physical location. Every domain has its own security policies and security relationships with other domains.  When multiple domains are connected by trust relationships and share a common schema, configuration, and global catalog, you have a domain tree. Multiple domain trees can be connected together into a forest. All the domains in a forest also share a common schema, configuration, and global catalog.",
        "CD_38BD5C5FBE64888D5B30C67C4333B4A6856A6BD1D71F9FA08E4958EA88393E70.1197.347651778.1660",
        "Predict Failure",
        "Reserved for internal use by the WMI provider only",
        "AllowWindowsConsumerFeatures",
        "    ISCSI_IP_ADDRESS_IPV6 = 2,",
        "dE083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "7 data bits",
        "GetErrorSourceInfoRtn",
        "MSNdis_NetworkShortAddress",
        "{3A608798-E3D3-11d2-8601-0000F8102E5F}",
        "ImeDDI Flag",
        "A list of arguments for starting services. The arguments are separated by null characters [~]. For example, the list of arguments One, Two, and Three are listed as: One[~]Two[~]Three.",
        "Controls whether the service publishes its WSDL over HTTPS at the address controlled by the HttpsGetUrl attribute.",
        "Specifies whether to automatically connect to all mapped local client printers at logon.",
        "28     The drivers for this device are not installed. ",
        "MDM_Policy_Config01_Cellular02",
        "AllowDeletingBrowsingHistoryOnExit",
        "Large Custom Logo Bitmap Name",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSSESSIONDIRECTORYSETTING_Prov\"",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"NamedJobObjectSecLimitSettingProv\"",
        "Win32_AccountSID",
        "This parameter is the volume to be used to store the shadow copy differential area.  If this paramter is not supplied the specified Volume will be used to store the differential area.  This parameter can be specified as a volume drive letter, mount point or volume GUID name.",
        "PowerPC",
        "PacketsNotAuthenticated",
        "TEST_TRACE_RESERVED_1d Flag",
        "Certification authority to validate the IPsec channel.",
        "LUAInstall: error 0x00000005 setting flags [{93AAD2A0-036A-4B11-A078-DA8776B38139}]",
        "Often, an alarm device is installed as part of a package, not to indicate issues with any particular logical device or physical component, but with the package's environment in general, its security state or its overall health. This relationship is described by the CIM_PackageAlarm association. ",
        "SystemConfig_V2_Video",
        "The SCSIBus property indicates the SCSI bus number of the disk drive.",
        "The scoping system's name.",
        "ReqBufferSize",
        "R_0B5C44F8259E201E409A59CCC827AEA5F69AAF6BCED724865BCF62AE4F5D48E1",
        "{A14A5594-25DE-410e-9B92-80F0801AEC07}",
        "MSFT_InitiatorPort",
        "UseMsmqTracing",
        "{C7BF35D0-AADB-11d1-BF4A-00A0C9062910}",
        "MaxXResolution",
        "An operating system is software/firmware that makes a computer system's hardware usable, and implements and/or manages the resources, file systems, processes, user interfaces, services, ... available on the computer system.",
        "The JoinDomainOrWorkgroup method joins computer systems to a domain or workgroup.  This method is only available on Windows 2000 platforms and beyond. The method can return the following values:/n0 - Success./nOther - For integer values other than those listed above, refer to Win32 error code documentation./nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. ",
        "NdisReceiveBufferSpace",
        "Win32API|System Information Structures|OSVERSIONINFOEX|dwBuildNumber",
        "Associates a policy rule to its filters.",
        "KernelBase",
        "C_037F73558996BA2785098F824A14DE2797E69E82C9ABBC6D1677D799C2469137",
        "C_DD3FB1A6B8FC9755CFB7A3BD7A61E1F24E5C869D8697CB909E277ECC11293496",
        "{e1cb227a-6d55-4282-a5f7-6fa4a5922c0b}",
        "R_07175BBA4C96099E611E7C4DB8EA7DEC92B3AEAE5EC6DF957DB2495087F658D2",
        "PageFaultCount",
        "The Extended Type property indicates a 32 bit subtype identifier for the keyboard.",
        "Free Space",
        "Enable_BCHostedClientByServerNames",
        "See CIM_RecordLog.LogState for details.",
        "SupportParityCheck",
        "NS_05AF7137D710B4DD69629818893397542700695CD759396B44A708AE6493C356\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_EAEF166D07823DD8DA7D2576AC47944178108FF5F11E6F92829261BEA2612408",
        "I/O Channel Check",
        "The Id property indicates the manufacturer's identifying name of the drive.",
        "PolicySourceColorDepthPolicy indicates whether the property ColorDepthPolicy is configured by Server (0),Group Policy (1), Default (2).",
        "AllowInternetSharing",
        "SetDNSSuffixSearchOrder",
        "CIM_FilterEntryBase",
        "A file share access control entry object models the subsystem's concept of an access control entry for a file share.",
        "CD_90D6DB96E4E52DF3FCB751D8C2491313C169EEA2DEA2212CBFE4EFF8C0A5E947.2199.1.9836",
        "{DB150AA8-E3D1-11d2-8601-0000F8102E5F}",
        "{acf14042-a61c-11d0-8dd4-00c04fc3358c}",
        "The IPSecPermitUDPPorts property lists the ports that will be granted User Datagram Protocol (UDP) access permission. The list of protocols is defined using the EnableIPSec method. ",
        "R_E284DDF7F9BBC191C804CE3AADDF197ECFC83C10E016C1AED712528DDDFB1F1C",
        "{8502C4F9-5FBB-11D2-AAC1-006008C78BC7}",
        "Maximum size, in bytes, of the private data that can be sent via a connect request",
        "Enables Remote Desktop MSI: (0) Remote Desktop MSI is disabled, (1) Remote Desktop MSI is enabled.",
        "TPCBDequeue",
        "ipsecISAKMPReference",
        "HardWareID",
        "Specifies IEEE 802.3p and IEEE 802.3q encapsulation.",
        "Example: Service Pack 3.",
        "NtlmClientInitialize_Start",
        "Contents of the RDP file corresponding to the application",
        "Int64Array",
        "MSFT_NetAdapterChecksumOffloadEncapsulationTypes",
        "DMA address width supported by the adapter.",
        "GroupId",
        "X86-based PC",
        "FX_TRACE_OBJECT Flag",
        "C_BCFFCC5A22D2740C320A7FDB3EAAC4A750026811E61430ADA48FBA2937496A0E",
        "TrackingPoliciesCreated",
        "{8a696d12-576b-422e-9712-01b9dd84b446}",
        "Paper Out",
        "MSFT_ReplicaPeer.PeerObjectType",
        "Specifies the AccountName that comprises of both: Domain and Name of the entry.",
        "1 - 'Thin' indicates that the virtual disk's capacity is allocated on demand. ",
        "The CurrentUsage property indicates how much of the total reserved page file is currently in use. ",
        "Fixed address of backup RADIUS server",
        "The privileges property specifies the level of privilege assigned to the usri3_name property.",
        "Win32_ShareToDirectory",
        "Advertising",
        "ReportCount",
        "CBCancel",
        "C_B7BCFF3BD4E96F7233C3DB7B6D678F32D754777FD131B4A0A3799E101E4F57D0",
        "SamGetDisplayEnumIdx_Start",
        "I_61D4B20454D9364143E7FCDD696A05EA880F3DCC132A499B1EBCE94AEC8918AE.1192.2086484367.345",
        "BinaryMofData",
        "CR_4EFE28EFCD0C2B5177C06210204A407FCEB7434631D258DE8A983EFF1957B86E",
        "The Manufacturer property indicates the name of the computer manufacturer.",
        "DOT11_AUTOCONF_CLIENT Flag",
        "Channel Nibble Read Count",
        "LUAInstall: error 0x00000005 setting flags [{93445657-12CA-4B80-AB18-9996D7293EC6}]",
        "other",
        "RemediationScheduleTime",
        "R_77DBF4A2C876542515BB91822C77D6AAB627C74A2589D8CBC4096845BC539307",
        "0xEFFF0015",
        "CertificateEcdsa384",
        "RSOP_RegistryValueBlocked",
        "WriteByManualSpecification",
        "TargetSideIdentifier",
        "Reserved for future use",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.286.175755000.180",
        "PAL H",
        "MIF.DMTF|Physical Memory Array|001.14",
        "The Win32_WMIElementSetting class represents an association between a service running in the Win32 system, and the WMI settings it can use.",
        "K5 Family",
        "Filter_Trace Flag",
        "NDIS Dot11 MPDU Max Length Change Status Indication",
        "A value of 1 in this column means to wait until the service actually completes before proceeding. This implies that the event is critical to the install, and that if the event fails the resulting error cannot be ignored. A value of 0 in this column means to wait only until the service control manager (SCM) reports that this service is in a pending state.",
        "Product base directory",
        "tenths of a millimeter",
        "C_C55A7470B8332BF850F6A1BB899F44CC31C22E85ECE7FEB3F9DFE496B3C9D7D6",
        "DigestErrors",
        "NotificationsCancelled",
        "MSFT_CliAlias.FriendlyName=\"TapeDrive\"",
        "ProgId",
        "IL_BF9D9C18AB1A6E18A896CC939C82B68B48ACFFF2BF3B071F74FFEAF1FAE680D6.1475.3660458206.288",
        "Event Data Field 1",
        "NumberOfMissedRuns",
        "Count of Session format error",
        "object:ProcessorAcpiXpssState",
        "PublicInterfaceAliases",
        "PageFault_HeapRangeCreate",
        "LPC_TRACE_RESERVED_1b",
        "Thread Pool",
        "CIM_ComputerSystem.RequestStateChange",
        "NDIS Query TCP Connection Offload Current Config",
        "2 = Kernel memory dump ",
        "CD_40BEEFCD86669714A96D09FC1ADF38E568E0B01D634EF8F9AD700B7740B2B19A.36.2230701201.646",
        "CIM_PolicySetComponent",
        "Win32_SystemDriverPNPEntity",
        "NPIV_AUTHENTICATION_TRANSACTION_ALREADY_STARTED",
        "tes the Unique Name associated with the instance of __Win32Provider.",
        "RD_TRACE_CONTROL",
        "NdAllowClearTimeoutSeconds",
        "CD_F7E10C2E2B48C52ACA99548FFAFB6BFFFF056CE9E9128CD48CB817FDF7995302.92.1610037842.637",
        "StartLayout",
        "Loopback",
        "AbortedMax",
        "TemporaryRedirect",
        "CountriesSupported is an array (bag) that contains a set of strings defining the countries/regions in which the modem can operate.",
        "StateCount",
        "The BinaryModeEnabled property indicates whether binary-mode data transfers are enabled for the serial port. Win32 systems only allow binary transfers through serial ports, so this value will always be TRUE.",
        "DynamicTransport",
        "MSRedbook_DriverInformationGuid",
        "The operation was successful but requires a driver reload or reboot to become effective.",
        "Ultra",
        "MsftDiscFormat2StreamInterleave",
        "MSSerial_PerformanceInformation",
        "Maximum size of the file used to log events",
        "    <dependentAssembly dependencyType=\"preRequisite\">",
        "RequirePrivacy",
        "The event ID number",
        "Indicates whether the caller has Owner permissions to the object.  ",
        "The PaperWidth property indicates the width of the paper.",
        "SAM Delete Group",
        "Power",
        "AutomaticResetCapability",
        "PNP_INSTALL_INFO_LEVEL Flag",
        "The device number specified is not valid.",
        "ProcessorPerformance",
        "The Target property indicates the name of the object that this is a shortcut to.",
        " The CRC2 is the CRC value for the middle 512K bytes with a  offset modulo 3 to the start of the file of zero.",
        "Change_Group_Security_Information",
        "<Prop2>=\"<Value2>\", ...",
        "C_17431B4BA51D33CDA0A6628CA12FC7DFF5F227BEC60D95CF88873EA792342553",
        "CR_5241CFC05A716A77CB0F36844F9A62538AED075865B9C000AF8A5A2832337841",
        "This property has been deprecated because it is not applicable to printers.  There is no replacement value.",
        "The target does not have enough resources to process the given request.",
        "EncapsulationType",
        "pixels",
        "CD_947907BE0C21868B3B6C1E2B3F2F4D8F4078DF318D2CD738491AC5AC30B4B16C.1749.3031933529.4088",
        "InterfaceAdminStatus",
        "MDM_VPNv2_Eap04",
        "ProviderOperation_AccessCheck",
        "MI_ERRORCATEGORY_OPEN_ERROR",
        "The Name parameter specifies the new name. The name cannot include control characters, leading or trailing spaces, or any of the following characters:  / \\ [ ] : | < > + = ; , ? ",
        "The Description indicates a comment describing the node.",
        "6 - 'Service' puts the job into a vendor-specific service state. It might be possible to restart the job.",
        "Hosted cache servers to which this client will connect",
        "Returns the VpnConnectionTriggerApplication object that contains the applications configured for VPN trigger",
        "PMKCacheSize",
        "ref:MSFT_NetAdapterSriovSettingData",
        "SupportedSizes",
        "MSFT_TaskWeeklyTrigger",
        "Sets configuration information for a printer",
        "ObjectAccess_AuditHandleManipulation",
        "R_5E33BA8BB8301B0D571DB35AB12D7C91B7A0EB2F54B87081058135E8F4EE33DF",
        "Win32API|Thread Wait Reason",
        "SpecVersion",
        "SH-x PC",
        "StartStopCycleCountMax",
        "friendlyName",
        "The ReadWrite property indicates whether the shadow copy is both readable and writeable. If this property is FALSE, then the shadow copy is read-only",
        "object:VpnConnection",
        "{6165f3e2-ae38-45d4-9b23-6b4818758bd9}",
        "Sets the properties ConnectClientDrivesAtLogon, ConnectPrinterAtLogon and DefaultToClientPrinter. It returns an integer value of 0 if call was a success and error in case of Server-Override mode.",
        "ViewBase",
        "49004",
        "Sets the DNS servers for a specific DNS suffix",
        "PhysicalDisk",
        "object:MSNdis_80211_ConfigurationInfo",
        "PLATFORM_TRACE_RESERVED_15 Flag",
        "MIF.DMTF|System BIOS|001.3",
        "{FAF76B85-798C-11D2-AAD1-006008C78BC7}",
        "AMEngineVersion",
        "an extra property being added to report the raw SMBIOS memory type. The value reported by the property MemoryType is a CIM value mapped to SMBIOS value.",
        "AllowSearchSuggestionsinAddressBar",
        "MSNdis_TransmitBlockSize",
        "TemporarySubscriptionsPerUser",
        "Subcommand",
        "The CIM status code that characterizes this instance. ",
        "Vendor Id",
        "directorycontrol",
        "// The total number of requests submitted by IKE to obtain a unique Security Parameters Index (SPI) that failed.",
        "ScsiInterfaceError",
        "Connection",
        "dialMode",
        "Win32_SystemLoadOrderGroups",
        "LocateDevice",
        "SecurityAssociationEndpoint (SAEndpoint) represents the endpoint of a secure connection. This is typically an IP connection, although the model allows more flexibility than just IP. The SecurityAssociationEndpoint is tied to an IPProtocolEndpoint (or possibly other endpoint) using the LogicalIdentity association. Note that an endpoint is defined at both ends of the connection.",
        "CR_1283D6E2E269ECFAA20DDCA78E5D8B7B8AC13879915B95F38BE4B062F89C60F6",
        "The LinkName indicates the entry path of the link to which this target belongs.",
        "__PARAMETERS",
        "PPR1AlreadySet",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_parms",
        "Specifies the number of I/O operations performed, other than read and write operations, by all processes that have ever been associated with the job, in addition to all processes currently associated with the job.  ",
        "CD_0359987C58272876B4E70E901F284C82B892B0C1E02B693AD3548D264D28EC8A.26.3767636659.483",
        "The Description property provides a description of the property",
        "RelatedActivityID",
        "NwfMsmCtlGuid",
        "The specified object is managed by the Microsoft Failover Clustering component. The disk must be in cluster maintenance mode and the cluster resource status must be online to perform this operation.",
        "SamSetInfoUser_End",
        "MDM_Policy_Config01_MSSecurityGuide02",
        "Win32_RoamingProfileUserConfiguration",
        "MuiAccess",
        "SetupPersistentIScsiVolumes",
        "RD_TRACE_RESERVED_12",
        "Specifies administrator commands that will be included in logs by NCA service.",
        "ROOT\\directory\\LDAP",
        "Controls the ambient light sensor brightness state",
        "CR_18844B622E692B354A4D328535B8F3AF7181D02C445E691E16C25BD8BD83D1D1",
        "MIB.IETF|HOST-RESOURCES-MIB.hrStorageSize",
        "InterleaveMax",
        "TotalNumberOfBlocks",
        "tenths of seconds",
        "The IPFilterSecurityEnabled property indicates whether IP port security is enabled globally across all IP-bound network adapters. This property is used in conjunction with IPSecPermitTCPPorts, IPSecPermitUDPPorts, and IPSecPermitIPProtocols. ",
        "CIM_ProductSupport is an association between product and support Access that conveys how support is obtained for the product.  This is a many-to-many relationship, implying that various types of support are available for a product, and that the same support object can provide assistance for multiple products.",
        "The class GUID of the network component represented by this binding.",
        "112..15999",
        "SequenceNumber",
        "CD_79FD2B1944A0E8569231538101AA02032B2AA1FD92C317847D2089CA52F4CD72.1151.1786882101.627",
        "SM_SendECHO",
        "R_BC4F91591102411312342399DC065D3EC257C15FFCA13E42BB6956DC3F1EDBC3",
        "HypervisorPresent",
        "0xEFFF0029",
        "Never Notify",
        "{6df28b22-73be-45cc-ba80-8b332b35a21d}",
        "Partial Write",
        "CatalogError Flag",
        "Int 13h - Japanese Floppy for NEC 9800 1.2mb (3.5\", 1k Bytes/Sector, 360 RPM) is supported",
        "Per Minute",
        "This field is a string representation of the company responsible for creating the storage subsystem hardware.",
        "AcceptInterface",
        "CR_264DACE30DFDF75A51B9E979ABD65B07E47DD7DF3824D1BD7D92A8F6E964F507",
        "This filter condition supplements URIMatchCondition. If set, the URI match happens for all resources with the base path indicated by URIMatchCondition. Otherwise, a match only happens for a resource with the exact URI.",
        "Defines the encapsulation types the Adapter can support for USO.",
        "{f786fbd8-c049-11dd-b885-001d09162bc3}",
        "CIM_ClassDeletion",
        "CIM_ProcessorCapabilities.NumberOfHardwareThreads",
        "Source requires reserved element",
        "The CIM_TapeDrive class represents a tape drive on the system. Tape drives are primarily distinguished by the fact that they can only be accessed sequentially.",
        "CD_71926B9951B4E8AFC04CC2F1AC5B5FEC04E9A08320F8B28164D32D905C0A41AC.39.230330083.342",
        "The CountryCode property specifies the country/region code for the user's language of choice.",
        "The ServiceName property indicates the service name of the network adapter. This name is usually shorter that the full product name. ",
        "The WINSPrimaryServer parameter specifies the IP address of the primary WINS server.",
        "The PeakUsage property indicates the highest use page file.",
        "GetOutParameters",
        "stryVak",
        "This method for a given ReplicationType returns the supported CopyStates and a parallel array to indicate for a given CopyState the target element is host accessible or not. ",
        "ApplicationResolutionEmpty",
        "OutboundInterface",
        "ForceEncryptionType",
        "The TcpUseRFC1122UrgentPointer property indicates whether TCP uses the RFC 1122 specification or the mode used by Berkeley Software Design (BSD) derived systems, for urgent data. The two mechanisms interpret the urgent pointer differently and are not interoperable.",
        "IPv4ReceiveIpOptionsSupported",
        "UUUUUUUUUUU",
        "CD_A8D7D05E30C15984C36B978D9865EFFD857B3D0BF5D2F0230858282BB5082506.2055.4090916021.575",
        "MSDAREM.1 formatted output (A)",
        "The ChangeSecurityPermissions method changes the security permissions for the logical file specified in the object path. If the logical file is actually a directory, then ChangeSecurityPermissions will act recursively, changing the security permissions of all the files and sub-directories the directory contains. ChangeSecurityPermissions returns an integer value of 0 if the permissions were changed, and any other number to indicate an error./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n",
        "If the OperationalStatus on the Job is not \"OK\", then this method will return a CIM Error instance. Otherwise, when the Job is \"OK\", null is returned.",
        "PA-RISC 7100",
        "HardFault",
        "{8531d6e6-2041-11d4-97eb-00c04f79c403}",
        "Vendor_Reserved",
        "Win32_OfflineFilesSuspendInfo",
        "BusType",
        "AllowAdvertising",
        "WMsg Flag",
        "Trustee",
        "C_006AB7DFED58A8FB352581D21227922FA9FD887AC08F63A547BAEA9722B5F62B",
        "IL_BC62D2F1A8964BE05CE3C8E4A92D6196F3ABA9FF68221E9970F3291305AD53F0.419.1.28222",
        "WSP_StorageSubsystemToStorageHealth",
        "Universal Naming Convention (UNC) name of the server on which this operation is to be performed. If NULL, the operation is performed on the local computer.",
        "CIM_Tachometer",
        " Stops the service during the StopServices action.",
        "Remote Drive",
        "Stop Bits",
        "The portal's transport protocol",
        "CIM_PhysicalComputerSystemView.LogMaxNumberOfRecords",
        "SM_SendSMPPassThru",
        "Localized version of RSOP_PolmkrSetting for American English",
        "CD_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396.1178.1.22169",
        "OpportunisticallyMatchAuthSetPerKM",
        "Data Link Switching",
        "Process_V4",
        "useAdvancedSettings",
        "Number of XPSS states",
        "Specifies the outgoing response's web message format.",
        "CD_8390A92B686E2E10DEC51624CF7D9A9B36CA99C04138C2088DBC0519EB26D47A.1090.1646392810.1357",
        "SuperSPARC",
        "Current payload size in bytes, valid only for PCI-E devices.",
        "ProcessorArchitecture",
        "MIF.DMTF|Voltage Probe|001.17",
        "CIM_ServiceSAPDependency",
        "PostOpInit",
        "Specifies the maximum number of VMQ processors for the network adapter.",
        "PolicyStore property defines the store to retrieve the 6to4 configuration policy.",
        "The Antecedent reference represents the network protocol that is used with the system driver and on the network adapter.",
        "X25 User Data",
        "UmsApcControlFlags",
        "IL_ABD504D4660345C0768AAE3A45E3240E43BCCA6F6D9D29FA0B7677D9B247603A.2675.2707313331.271",
        "MessageNumber",
        "TypeLibraryId",
        "{956597A4-7D80-11D2-AAD3-006008C78BC7}",
        "SupportedProvisioningTypes",
        "The EnableIPSec method is used to enable IP security on this specific TCP/IP-enabled network adapter. Ports are secured only when the IPFilterSecurityEnabled property is TRUE.The method returns an integer value that can be interpretted as follows: ",
        "LogonSess",
        "#define ISCSI_LOGIN_OPTIONS_DATA_DIGEST                 0x00000002",
        "Additional Sense Code Qualifier",
        "The AllowMaximum property indicates whether the number of concurrent users for this resource has been limited.",
        "0x8002",
        "11 - 'Prepared': Initialization completed and the copy operation started; however, the data flow has not started. ",
        "USB Legacy Support",
        "If applicable, defines whether the server supports inproc32 activation.",
        "Cluster size is too large",
        "CD_639A48AE01E60F4C5372BCE94302125223C8DE05464D188B338C60C65E4A5441.2103.2130381399.548",
        "IORequestPacket",
        "ALPC_Unwait",
        "NDIS Enumerate Adapter",
        "MSNdis_EthernetMaximumMulticastListSize",
        "PassiveMode",
        "Records",
        "MSiSCSIInitiator_Portal",
        "Win32_PnPDevicePropertySint16",
        "Policy ID.",
        "Specifies whether real-time protection is enabled",
        "HResult",
        "Ndis80211FragmentationThreshold",
        "Number of null-terminated string describing the chassis or enclosure SKU number",
        "Win32API|System Information Structures|OSVERSIONINFOEX|wServicePackMinor",
        " 0xFFFFFFFF - There is no specified maximum message size defined.",
        "GetSupportedSize2",
        "LinkBps",
        "A set of volumes where the replication journal for the ReplicationGroup is hosted.",
        "RDMA statistics",
        "IsEnabled",
        "SamCompCreate",
        "{8875A39E-DB29-11d2-85FC-0000F8102E5F}",
        "LastThreatStatusChangeTime",
        "BindingElement",
        "Scsi Lun",
        "MVL DSL",
        "PCSettingsMeteredNetworkSyncEnabled",
        "Product executable directory",
        "The FriendlyName property is the array of FriendlyName/Caption of the driver e.g. Communications Port (COM2)",
        "List of ISCSI_ConnectionStaticInfo.  ConnectionCount specifies the number of elements in the array. NOTE: This is a variable length array.",
        "C_6E42F619B70AE9A2B05F70FCE3E0B6857CF973C6024DBCB714BC2386FB5CDB64",
        "NDIS Set TCP Offload Parameters",
        "Optional. If the strAuthority parameter begins with the string 'kerberos:', Kerberos authentication is used and this parameter should contain a Kerberos principal name. If the strAuthority parameter contains any other value, NTLM authentication is used and this parameter should contain an NTLM domain name. If you leave this parameter blank the operating system negotiates with DCOM to determine whether NTLM or Kerberos authentication is used. This parameter should only be used with connections to remote WMI servers. If you attempt to set the authority for a local WMI connection, the connection attempt fails. For more information see Using Kerberos or NTLM Authentication with the Scripting API in the WMI SDK help file for more information. ",
        "CIM_ERR_ACCESS_DENIED",
        "0xEFFF001C",
        "The ShortDisplayName property specifies the COM application's short name (used in menus and pop-ups).",
        "MSNdis_80211_TransmitAntennaSelected",
        "The YResolution property has been deprecated to theVerticalResolution property. ",
        "Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|BasePriority",
        "MIF.DMTF|Parallel Ports|003.7",
        "Security: Kerberos Authentication",
        "Power State Settable",
        "MixedYieldCount",
        "MsftDiscFormat2StreamConcatenate_DebugConstructor Flag",
        "IPVersion",
        "DllMainExit",
        "ComponentsChanged",
        "MSFT_TaskSettings",
        "The video BIOS feature.",
        "DiscoveryMaxPrinterLimit",
        "CD_878D5D30666EBFE440F941E45E7884E8AFCA7A1478E4D09AB57DC26571C8B7A6.1166.3704247041.272",
        "The DaylightBias property specifies a bias value to be used during local time translations that occur during daylight time. ",
        "MSFT_PrintJob",
        "CR_95151EBC7602F93A6E06460EF447E398F547B7CD3033E5B6ADD3848197B31384",
        "TimeoutPeriod",
        "ScsiId",
        "P64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41",
        "SamCreateAliasInDom",
        "{23bc497f-13f0-47a1-9e88-048f6eefdf60}",
        "CD_47C79E62C2227EDD0FF29BF44D87F2FAF9FEDF60A18D9F82597602BD95E20BD3.1.3107675964.545",
        "Home Server Edition",
        "{01FAF041-842C-4230-A31E-1335428CD8F0}",
        "QuotasEnabled",
        "Remote execution option, one of irsEnum: ifrsFavorLocal   = 0:  Install components locally, if possible ifrsFavorSource  = 1:  Install components to run from the source CD/Server, if possible ifrsFollowParent = 2:  Follow the remote execution option of the parent feature",
        "AllowHardwareKeyboardTextSuggestions",
        "(4m;(4m;",
        "PathName",
        "Values: TRUE or FALSE. A value of TRUE indicates the stop bits can be set.",
        "Mapping of IPv4 address ranges to IPv6 prefixes",
        "SAM Open Domain",
        "Represents a WSD printer port",
        "SPACES_MaskingSetToInitiatorId",
        "C_2C1FABC8728F9E076F6727DBB7BA1358C4F010407356DEB983BF769E41D5848D",
        "Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|QuotaPagedPoolUsage",
        "iSCSI Connection Statistics",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\LocalServer32[Default]",
        "LargeSendOffloadV1HardwareCapabilities",
        "Indicates if the Adapter supports IP checksum computation offload for transmit IPv4 packets.",
        "Stack28",
        "EnableErrorSourceRtn",
        "Value of maximum Y resolution supported by server",
        "MSFT_NetBranchCacheContentServerSettingData",
        "rigger value.",
        "The IPConnectionMetric indicates the cost of using the configured routes for this IP bound adapter and is the weighted value for those routes in the IP routing table. If there are multiple routes to a destination in the IP routing table, the route with the lowest metric is used. The default value is 1.Windows 2000 only.",
        "The docking station.",
        "|3m;|3m;",
        "TM_NLAPROVIDER Flag",
        "The EnableDNS method enables the Domain Name System (DNS) for service on this TCP/IP-bound network adapter. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "PortSpecificAttributesMaxSize",
        "User Mode Time",
        "ProgressStatus",
        "0xEFFF0055",
        "MEM_NODE is valid",
        "{5EEFEBDB-E90C-423a-8ABF-0241E7C5B87D}",
        "Number of Performance States",
        "Encapsulated packet task offload properties for a network adapter.",
        "object:MSNdis_PMAdminConfigParam",
        "SharedSignaturesPath",
        "WorkingDirectoryProvider",
        "R_0180FDA42F646D19EEC85216A140C231868F43DCE0B8FA45078244BA438B18B4.2466.2980322375.558",
        "SupportsParityCheck",
        "{467fea10-701b-4388-917f-730620cea328}",
        "MaxCompletionQueueDepth",
        "3rd Party profile consist of following additional fields: ",
        "Limit Preserve Job Time - Preserves any job time limits you previously set. As long as this flag is set, you can establish a per-job time limit once, then alter other limits in subsequent calls. This flag cannot be used with Limit Job Time. ",
        "Error Log Array",
        "If enabled (value = 4), the ComputerSystem can be reset via hardware (e.g. the power and reset buttons). If disabled (value = 3), hardware reset is not allowed. In addition to Enabled and Disabled, other Values for the property are also defined - \"Not Implemented\" (5), \"Other\" (1) and \"Unknown\" (2).",
        "__ConsumerFailureEvent",
        "IEEnterpriseModeSitelist",
        "UTP Category 4",
        "ref:Win32_USBController",
        "0X08000000",
        "Compliant",
        "The maximum number of immediate retry attempts on a message that is read from the application queue.",
        "For all other objects: Only that object will be discovered / refreshed.",
        "The Name property contains the name for the protocol.",
        "\\\\.\\root\\default:__Win32Provider.Name=\"NTEventLogEventConsumer\"",
        "See CIM_Memory.ConsumableBlocks for details.",
        "The ResetCount property indicates the number of automatic resets since the last intentional reset.  A value of -1 indicates that the count is unknown.",
        "HPGL2",
        "ReadOnlyReason",
        "The IPSecPermitUDPPorts parameter specifies the list of ports that should be granted access permission for UDP. A numeric value of zero indicates access permission is granted for all ports. An empty string indicates that no ports should be granted access permission.",
        "IsRebootRequired",
        "{5e612efd-c05e-4f76-bced-f5607aa3d46e}",
        "NewDiskPolicy",
        "A free-form string providing additional information related to the AdvertiseType. A description MUST be provided when the AdvertiseType is 1, \"Other\". An entry in this array corresponds to the entry in the AdvertiseTypes array at the same index. It is not expected that additional descriptions are needed if the Type is set to \"Not Advertised\" or \"SLP\". However, as the SLP template expands, or as other advertisement mechanisms are defined, support for additional descriptions may be needed. This array is defined to support this.",
        "Is fast",
        "{8502C4C7-5FBB-11D2-AAC1-006008C78BC7}",
        "Distinguished name for the schema container",
        "The virtual disk could not complete the operation because its Manual Attach status does not permit it.",
        "IpIPv4",
        "BreachDescription",
        "0xEFFF0034",
        "{b914e34f-7b80-46b0-8034-6d9b689e1ddd}",
        "HRSize",
        " 0x010 ",
        "A memory mapped I/O port of the computer system.",
        "MSFT_NetAdapterUdpSegmentationOffloadCapabilities",
        "C_5D2BB5E72A2F48A448D0C78E4EF523FCA37E91EFD1ED92B23F38B836649C78DA",
        "Maximum HSync numerator (in Hz)",
        " 0 - 'Healthy': All physical disks are present and in a healthy state. ",
        "Set Interrupt Moderation",
        "Scrubs the data for the specified file.",
        "CD_8C9782D73659C517B4402B8048CDD3A9B1023D31F875B4A3CD21F41348734569.1929.3994637946.1057",
        "BeaconPeriod",
        "The MediaType property indicates the type of media currently present in the logical drive. This value will be one of the values of the MEDIA_TYPE enumeration defined in winioctl.h.",
        "SAS Address",
        "ref:Win32_Desktop",
        "Example: \\\\MyServer",
        "MaximumSectorsPerRead",
        "Implemented",
        "Preferred monitor source mode index",
        "AutoRestartDeadlinePeriodInDaysForFeatureUpdates",
        "46006",
        "R_9671316BE0648F7C1D73FD6CDDBB29A6CD7F8E1A0572BD920BA61DD15D49A12F.2466.322490298.554",
        "This method initializes a RAW disk with a particular partition style. If no partition style is specified, GPT will be selected by default. If the disk is already initialized, this method will fail with a well defined error code.",
        "SupportsShutdown",
        "0xEFFF0013",
        "Association between the security settings of a file/directory one member of its SACL.",
        "Instances of the CliProperty class describe values that will be used in a Format. Each property has a name, description and a Derivation. Note any formatting strategies such as truncation length or formatting strategies for numeric values will be defined in the stylesheet defined for the format containing the property.",
        "TEST_TRACE_RESERVED_09 Flag",
        "TargetReleaseVersion",
        "MDL Read",
        "CR_9D13D81A0232A3B9A054E304F017E99ED70EE31D77185E5048D602C8F68F1D2C",
        "SystemSpecificCollection represents the general concept of a collection which is scoped (or contained) by a System. It represents a Collection that only has meaning in the context of a System, and/or whose elements are restricted by the definition of the System. This is explicitly described by the (required) association, HostedCollection. ",
        "DeCommitted Address",
        "UMDF - Host Process Trace",
        "MsftEnumDiscRecorder2_DebugGeneral",
        "Bid2Etw_MSDART_1",
        "OSBus",
        "The SettableDataBits property indicates whether data bits can be set for this serial port.",
        "ttings",
        "DUMMY",
        "C_700A223C2BE9D4D6498C555306C3D6D2A20F7ED7C0635EDD45F157ECA54B627F",
        "NewByEapMsChapv2Auth",
        "Denotes the health of the subsystem. ",
        "Path to which this folder is redirected",
        "IEEnterpriseModeEnabled",
        "The PelsHeight property indicates the height of the displayable surface. ",
        "The Win32_COMClass represents the COM component grouped under the COM application.",
        "ROOT\\Microsoft\\Windows\\DesiredStateConfigurationProxy\\MS_409",
        "Win32_ODBCDriverSoftwareElement",
        "NETIO_TRACE_NMR",
        "FileSysInfo",
        "How often, in seconds, the trace buffers are forcibly flushed.",
        "A free-form string that contains the vendor error description. Note that this property is also present in the JobProcessingStatistics class. This class is necessary to capture the processing information for recurring Jobs, because only the \\'last\\' run error can be stored in this single-valued property.",
        "{f1c521ca-da82-4d79-9ee4-d7a375723b68}",
        "MSFT_CliAlias.FriendlyName=\"DCOMAPP\"",
        "Not restricted",
        "MSFT_NetServiceRecoveryFailed",
        "ipsecDataType",
        "The ExtendedDetectedErrorState property reports standard error information.  Any additional information should be recorded in the DetecteErrorState property.",
        "IpV6 Address",
        "{8c6bc95b-e363-418d-b86b-686f49c26608}",
        "CertificateThumbprints",
        "EnabledDefault",
        "SetSystemStoreDevice",
        "{544d4c9d-942c-46d5-bf50-df5cd9524a50}",
        "{47772EC4-DB21-11d2-85FC-0000F8102E5F}",
        "KEYBOARD_PORT_WMI_STD_I8042",
        "The friendly name of the power meter device.",
        "NumActiveDefaultVPortMacAddresses",
        "Win32API|Error Functions|SetErrorMode",
        "Text address, either a DNS address or dotted address",
        "TP_V2_TimerExpirationGroup",
        "Defines which functions the processor supports.",
        "GetAvailableTargetElements",
        "{8502C4ED-5FBB-11D2-AAC1-006008C78BC7}",
        "The Recursive input parameter is a boolean that indicates whether the security permissions will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input parameter is ignored.",
        "RDMAOutOctets performance counter missing",
        "object:MSFT_KeyValuePair",
        "largeAnimatedBitmapPath",
        "DestFolder",
        "SOM Order",
        "The channel pool settings.",
        "{44795709-a61b-11d0-8dd4-00c04fc3358c}",
        "TurnOffAutoPlay",
        "The RemoveFiles action uninstalls files previously installed by the InstallFiles action. Each of these files is 'gated' by a link to an entry in the Component class; only those files whose components are resolved to the iisAbsent Action state, or the iisSource Action state IF the component is currently installed locally, will be removed. The RemoveFiles action can also remove specific author-specified files that weren't installed by the InstallFiles action. Each of these files is 'gated' by a link to an entry in the Component class; those files whose components are resolved to any 'active' Action state (i.e. not in the 'off', or NULL, state) will be removed (if the file exists in the specified directory, of course). This implies that removal of files will be attempted when the gating component is first installed, during a reinstall, and again when the gating component is removed.",
        "C_B39F79BEF0550EE7F9E981A83A152A3A4B6173B3A32D2E630E92CBAA2FE60E90",
        "WMI|Win32_Processor",
        "MSADCO.1 formatted output (W)",
        "PendingKeyOperations",
        "WMI|Win32_NetworkAdapter",
        "MSFT_TaskNetworkSettings",
        "C_4B835375C85830D11DAA3F01F5AF9F28573A4521B9279B28C7605832DE3B39C3",
        "MDM_Policy_Config01_Notifications02",
        "The Supports16BitMode property indicates whether 16-bit mode is supported on this serial port.",
        "Indicates the current activation state of the site",
        "Type of action to be performed on the specified setting entry.  Create -  Creates the specified entry. Delete - Deletes the specified entry. Append - Append to the end of the specified entry. Remove - Remove the value from the specified entry.",
        "NdisLinkStateStatusIndication",
        "CIM_ComputerSystem.IdentifyingDescriptions",
        "Win32_TpmProvider",
        "The AutoReboot property determines whether the system will automatically reboot during a recovery operation./nValues: TRUE or FALSE. If TRUE, the system will automatically rebooted.",
        "This method allows for the creation of a replication relationship between replication groups.",
        "SERVICE_BOOT_START ",
        "FileIndex",
        "EVENT_TRACE_FLAG_DEVICECONTROL",
        "9 - Normal Account -  Default account type that represents a typical user.",
        "The ID of the attached function. This could be the Vf or the PF ID.",
        "Name of transport unbound",
        "NS_37FD5386C028E960C90BC77B9D8DDCA28B24BAE2E315E8D8209BF5E2633575D8\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_BC000CFE04C2A23B745105FB1571CA3D890D9580D1AA6746224E398C7587FD84\\10.",
        "Win32Registry|Manufacturer",
        "MSNdis_PortAuthParameters",
        "AllowUserDecryption",
        "Contains the key to be verified. ",
        "MsftDiscFormat2MsfAddress_DebugConstructor",
        "IpAddress",
        "Enumeration indicating what operations will be executed as asynchronous jobs. If an operation is included in both this and SupportedSynchronousActions properties then the underlying implementation is indicating that it may or may not create a job.",
        "LPCDRVR_TRACE_RESERVED_0a Flag",
        "If IsHighlyAvailable is TRUE, the disk is highly available.",
        "C_E52BD2BB65ED90ABABACDFC8937D94C5808CFF6C3FD9A7BEE235CE9F6DF64BCB",
        "WPD BusEnumService Trace",
        "MSRedbook_PerformanceGuid",
        "3C1561BEDE5B613B8E3A3B85C32FB8071",
        "A Boolean value that specifies if the user wants to take control of message addressing. ",
        "0 - 'Level 0': The storage provider and storage subsystem objects have been discovered. ",
        "OA3xOriginalProductKeyDescription",
        "The Timeout property indicates the time in seconds for which the client caches the referral of this node.",
        "EEPROM",
        "MSProcessorClass",
        "75-ohm Coaxial",
        "Name of new autologger session configuration.",
        "Enumeration indicating whether the ComputerSystem is a special-purpose System (ie, dedicated to a particular use), versus being 'general purpose'. For example, one could specify that the System is dedicated to \"Print\" (value=11) or acts as a \"Hub\" (value=8). ",
        "DoNotAllow",
        "81 - Unable to configure DHCP service",
        "NDIS 802.11 Reload Default Settings",
        "DisableEnterpriseAuthProxy",
        "IP-HTTPs global settings associated with this interface",
        "WmiMonitorBasicDisplayParams",
        "ExcludedPaths",
        "Listen",
        "NdisFddiTypeCWrapA",
        "79E3A865",
        "This property contains the user's roaming profile path if RoamingConfigured is true.",
        "Power Status Change",
        "CD_4C5A81206183284769D910458D05B5688A17E07BEACF6B75FDB41F487B4FC2AD.1185.201277974.4913",
        "Media Specific status information.",
        "A string indicating the manufacturer of the SMP software.",
        "MSFT_StorageReliabilityCounter",
        "Select * from Win32_WMISetting",
        "CIM_SettingsDefineCapabilities.ValueRange",
        "Win32_DesktopMonitor",
        "MsiPackageCode",
        "DisableDA",
        "R_E6165A2C7DA53547A217F4B5D9149125910FEBA09B8BB9B320094C6ECF81FDC5",
        "PolicySourceDriveMapping",
        "11 - 'Failing over': in the process of switching source and target. ",
        "x6m;x6m;",
        "WeakHostSend",
        "Win32API|File Functions|GetDriveType",
        "CD_EF9D1330272D4FA53F4D27BDEB85692B26627659356689430C4A1C94857C96C4.1555.3899432424.1140",
        "ImportStoreWithFlags",
        "ProviderId",
        "20260528152850.000000+000",
        "registryKey",
        "StateChanged",
        "LPCDRVR_TRACE_DEVICE Flag",
        "A persistent binding request included a bad local SCSI target number",
        "Indicates the battery's expected lifetime in minutes, assuming that the battery is fully charged. This property represents the total expected life of the battery, not its current remaining life, which is indicated by the EstimatedRunTime property. ",
        "MSDSL",
        "CIM_StorageExtent",
        "Delete Existing Channels",
        "Whether application path is valid",
        "TraceASC",
        "HorizontalSyncOffset",
        "TRACE_CLASS_QUIESCENT",
        "C_C8D0F277D7F7D59AF0E214825AC68160FC59DD15097C20883A4D4AAFF0736D39",
        "{146360a4-88dd-11dd-94b8-001d09162bc3}",
        "Session Broker Drain Mode: (0) Allow new user logons, (1) Deny new user logons until reboot, (2) Deny new user logons.",
        "The Autologger of the provider, when part of a Autologger configuration.",
        "SERIAL_WMI_PARITY_EVEN",
        "BucketIndex",
        " The software element state of a software element ",
        "Arguments",
        "The size (in bytes) of this job.",
        "NPIV operations that can be performed on a physical adapter which enable Fibre Channel in a Guest Virtual Machine",
        "Sets the mode of the Virtual IP according as whether Value is set to 0 or 1 respectively. The call returns 0 for success and an error if the policy was set to Group policy.",
        "SPACES_StorageChassis",
        "dword",
        "Portable Device Connectivity API Trace",
        "16000..65535",
        "The average number of fragments per file on the volume.",
        "DUE_AV_SIGNATURE",
        "The MaximumMessageSize property indicates the maximum message size supported by the protocol. This is the maximum size of a message that can be sent from or received by the host. For protocols that do not support message framing, the actual maximum size of a message that can be sent to a given address may be less than this value. There are two special values defined for this property:/n0  - The protocol is stream-oriented; the concept of message size is not relevant./n1  - The maximum outbound (send) message size is dependent on the underlying network MTU (maximum sized transmission unit) and hence cannot be known until after a socket is bound. Applications should use getsockopt to retrieve the value of SO_MAX_MSG_SIZE after the socket has been bound to a local address./n 0xFFFFFFFF - There is no specified maximum message size defined./n",
        "      <dsig:DigestValue>bWSGtbThlvJajcJP4W941/tb61mkBxWSJIaa939Lb2s=</dsig:DigestValue>",
        "SamQueryInfoUser",
        "61000",
        "This method returns the USBDevice Descriptor as specified by the input parameters. Each parameter is briefly described here with more detail in its Qualifier list. RequestType is an input parameter that defines whether the request is for standard, class or vendor-specific information, as well as specifying the recipient. RequestValue is also an input parameter and defines the USB Descriptor Type and Index. RequestIndex is an input parameter which describes the language used to return a string Descriptor. RequestLength is both an input and output parameter. It specifies the length of the Descriptor that should be returned (on input) and what is actually returned in the Buffer parameter (on output). Buffer is an output parameter, containing the Descriptor data. The GetDescriptor method returns an integer value of 0 if the USB Descriptor is successfully returned, 1 if the request is not supported and any other number to indicate an error.",
        "2 - Fiber Distributed Data Interface (FDDI)",
        "The destination prefix and metric field are populated",
        "{49db8722-2068-11d4-97eb-00c04f79c403}",
        "I_128E3497A7B9585C582706F0CB14E662A033FEADFABF19FD1304E460A1023EBB.2707.3225679955.279",
        "NDIS Query TCP Offload Hardware Config",
        "extensionGuid",
        "92 - Out of memory",
        "CD_E6B31A90E686795D9E916C75179C5E297CC54460E452CC51EA148281AD5C6D23.22.1.22615",
        "The frequency (in hertz) at the low end of the Input Frequency Range 1 of this Power Supply. A value of 0 implies DC.",
        "CacheServerConnectionCount",
        "Error Flag",
        "The Manufacturer property indicates the manufacturer of the CD-ROM drive.",
        "The BootROMSupported property determines whether a boot ROM is supported./nValues: TRUE or FALSE. If TRUE, a boot ROM is supported.",
        "MIF.DMTF|System BIOS|001.2",
        "FilesOpenedTotal",
        "Example: C:",
        "object:__ExtendedStatus",
        "iSCSINodeName",
        "EngagedRestartTransitionScheduleForFeatureUpdates",
        "iScsiFlagBoot Flag",
        "local|hkey_local_Machine\\software\\microsoft\\windows nt\\currentversion\\systemrestore\\cfg|DiskPercent",
        "KioskModeAUMID",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"MS_NT_EVENTLOG_PROVIDER\"",
        "Property which identifies if DirectAccess is enabled.",
        "IcmpV6RateLimitBytesPerSec",
        "Specifies attributes of the SID. This value contains up to 32 one-bit flags. Its meaning depends on the definition and use of the SID.",
        "_DO_NOT_USE_",
        "{306F88F2-DB35-11d2-85FC-0000F8102E5F}",
        "0x8005005A",
        "C_ED4454436F5D89AB54BFEDBE7EEBD0A50AFC4CD518207832B9D92042E30CAC88",
        "The maximum number of outstanding request-to-transmit (R2T) per task within this session",
        "SamSetInfoGrp",
        "CD_81E923C5F7AE79357104AE6BF842B77A8DC803A5873AE34E77FAE62049CD7FEB.1210.2148069860.733",
        "The specified user account could not be found",
        "AllowFindMyFiles",
        "LicenseUsage",
        "CStateVersionInUse",
        "The version for Name Resolution Policy Table entry.",
        "SupportsDisconnectData",
        "Denotes whether this subsystem supports automatic object clustering.",
        "FCID passed into HBA_SendRNIDV2 violates access control rules",
        "MINSTORE",
        "Plugins",
        "FX_TRACE_LOADER",
        "{E9E47403-D1D7-43F8-8EE3-53CDBFFF5646}",
        "ConfigureKoreanIMEVersion",
        "The Direction property indicates whether a particular   CIM_Action object is part of a sequence of actions to transition the   current software element to its next state, such as \"Install\" or to  remove the current software element, such as \"Uninstall\".",
        "HOSTPROC_TRACE_GENERAL",
        "WPD Bluetooth MTP Emumerator Driver Trace",
        "Indicates the accuracy of the sensor for the measured property. Its value is recorded as plus/minus hundredths of a percent. ",
        "The platform architecture of the ODBC Connection Pooling PerfMon counters to get. Possible values are '32-bit', '64-bit' or 'All'. The default is 'All'. This is the platform architecture on the remote machine if this command is executed on a remote CIM session.",
        "File system label of the volume.",
        "Values: TRUE or FALSE. If TRUE, debug information is written to a file.",
        "CD_ED8BE0EA146608759C0E924287397948057A0F5F3DAE6E95080F8788429EB473.1539.2250730984.589",
        "I_03FC7356696B81A172A3FFFEF4518C34DB3C12FFC7871897C20171F501F26D8B.2711.1966896471.289",
        "{447956fc-a61b-11d0-8dd4-00c04fc3358c}",
        "Display In ARP",
        "3221232482",
        "CR_AB754770CC19ECF1708863E61B4513A3C8CECABE89D78E5D727A64FE3F1CF111",
        "Represents the IPInterfaceRoute association class in TCPIP WMIv2 provider.",
        "Win32_AutochkSetting",
        "I_227FDB4BBC644BF919A882A6D6A822A0CF6177C421C416CC297E11CDAC01770C.311.1001239533.249",
        "68 Pin Dual Inline",
        "PolicySourceMinEncryptionLevel indicates whether the property MinEncryptionLevel is configured by Server (0),Group Policy (1), Default (2).",
        "One of the adjacent slots.",
        "ActiveHoursMaxRange",
        "ResponseTimeToLive",
        "The Msft_WmiProvider_CreateInstanceEnumAsyncEvent_Post event class represents an event generated immediately following completion of the provider's implementation of IWbemServices :: CreateInstanceEnumAsync.",
        "{2306fe3b-dbf6-11d2-9244-006008269001}",
        "SupportsExtendedStatus",
        "2EAE85FB276C1B64644E78344F6BB3EF3F442D17FE8D8.352.1.287457",
        "TargetStorageSubsystem",
        "The name of the directory (as a path, reference to a directory specification or reference to a property) where the space is reserved.",
        "DisablePrivacyMode",
        "SupportsCreateReplicationRelationshipMethod",
        "AdditionalErrors",
        "CD_264DACE30DFDF75A51B9E979ABD65B07E47DD7DF3824D1BD7D92A8F6E964F507.1689.88608955.3806",
        "CD_955E009A78C91FAD360B439EA408CFF48F11DEE9AF7E212F013EAC8F62A69A82.1231.4250234883.425",
        "Registry_V1",
        "Service Requested",
        "NdisAtmReceiveCellsOk",
        "LogDevice",
        "{5b26b94f-0272-4d4c-8744-bd84be421f3b}",
        "TokenActivationGrantNumber",
        "Search",
        "ocation.",
        "Microsoft Power Supply Device",
        "NS_511626FAE4F57DBD20DF5CD44A41DAECED28CF7B3FD8B12012C7F4B58F44E665\\KI_A0108CE261D6CD70D350F5B72F2E9874AE6E004D3029015B0919B1BD326BB649\\I_F60EB53436D6291A5CA381CCEC704B4F119A4D095DBB7398C4E6AC1D85D5A994",
        "{FAF76B64-798C-11D2-AAD1-006008C78BC7}",
        "Type24",
        "Directory Service (DS) flag indicating that the domain controller is a Global Catalog (GC) server for DnsForestName.",
        "IMAPI2 Interleave Stream",
        "SamQueryInfoDom_Start",
        "TP_V2_WTNodeSwitch",
        "The DebugFilePath property indicates the full path to the debug file. ",
        "RSOP_RestrictedGroupEx",
        "MIF.DMTF|Physical Container Global Table|002.12",
        "PolicySetComponent is a concrete aggregation that collects instances of the subclasses of PolicySet (i.e., PolicyGroups and PolicyRules). Instances are collected in sets that use the same decision strategy. They are prioritized relative to each other, within the set, using the Priority property of this aggregation. ",
        "The printer associated with this job.",
        "The state of the VPort.",
        "SCSI Wide",
        "ObjectId",
        "Byte Read Count",
        "ref:RSOP_IELinkItem",
        "{1BCD547A-62F6-4F2D-A0E3-B4930A3F3C33}",
        "CIM_ERR_INVALID_SUPERCLASS",
        "Auto Configuration Time",
        "//  once for each binding entry.",
        "Contact IT URL",
        "CIM_Printer.CurrentLanguage",
        "AllowManualWiFiConfiguration",
        "C_E6323222C9A136F6C273CAA11042C26BCC58281688835481ECD05350F4040D8A",
        "MSVSS__PROVIDER",
        "Terminal Problem",
        "The FullName property indicates the full name of the user belonging to the network login profile. This string can beempty if the user chooses not to associate a full name with a user name.",
        "{8502C579-5FBB-11D2-AAC1-006008C78BC7}",
        "Spinlock Release Event",
        "ShareType",
        "Export a settings package file to a XML file listing all the settings in the package.",
        "DragFullWindows",
        "Old Interval",
        "IpsecPolStore",
        "2 - 'Unhealthy': The majority of replicas are unhealthy or in a failed state.",
        "Association between replicated partitions",
        "When set, Microsoft Defender Antivirus will check for new signatures before running a scan.  If new signatures are found they will be downloaded and installed before the scan begins.  If no new signatures are found, the scan will start based on the existing signatures.",
        "Instances of this class represent products as they are installed by MSI.  A product generally correlates to a single installation package.",
        "object:AcpiPct",
        "SignatureDisableUpdateOnStartupWithoutEngine",
        "Force If Hung",
        "EVENT",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\nwlnkipx\\Parameters\\Adapters",
        "The CIM_FromDirectoryAction association identifies the source directory  for the file action. When this association is used, the assumption  is that the source directory was created by a previous action.  This association cannot exist with a CIM_FromDirectorySpecification  association since a file action can only  involve a single source directory. ",
        "MSFT_CliAlias.FriendlyName=\"DeviceMemoryAddress\"",
        "The SetNumForwardPackets method is used to set the number of IP packet headers allocated for the router packet queue. When all headers are in use, the router will begin to discard packets from the queue at random.",
        "ConfigStorageSenseDownloadsCleanupThreshold",
        "Query PCI Device Custom Property",
        "TypeCTiming",
        "EVENT_TRACE_FLAG_SHUTDOWN",
        "NAT outbound address and port",
        "SMBIOS|Type 1|System Information|SKU Number",
        "NS_CCA03770E562E2A170EDED20A589C069A2045A9BCD7412B77D068846D9054EC4\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "12 - 'No Contact': The storage provider has knowledge of the disk, but has never been able to establish communication with it.",
        "The cooling device.",
        "Combined In Sequence",
        "Removing from pool",
        "Device Control",
        "MSFT_StorageSubSystemToMaskingSet",
        "VpnConnection",
        "This parameter allows the user to specify whether the disk should enable Scale Out features. By default, this parameter is 'True', enabling Scale Out.",
        "{fa20a145-baea-4d8a-bacd-a952e926fe8f}",
        "OutSenseBufferSize",
        "The association between a shadow copy and the volume for which the shadow copy was created.",
        "Bid2Etw_MSADCO_1_Trace_TextA",
        "Associates a connection security rule with its filters.  Instances of this class can be traversed and the values in the associated filters can be modified, but instances of this class may not be created or deleted.",
        "Product Identifier",
        "Target Flags",
        "MI_ERRORCATEGORY_ACCESS_DENIED",
        ":gbPQ",
        "Describes the format when the property InfoFormat is set to 1 (Other).",
        "StandardMinute",
        "The group number for the processors specified in ProcessorAffinityMask property.",
        "DynamicLock",
        "C_498190A28B0F3E8C8B0AFCFFAE238D6B691B0B57B3836158124AC145A7281391",
        "FAX device",
        "MonitoringRange",
        "MaximumMessageSize",
        "C_AC74BA8CCBB8B7653E84CC3AAB6F43C1B7147F57F54B0A2F4FF0A55FCB7892BB",
        "NDISWMI_TRACE_ADVPROP Flag",
        "Name is a globally unique, human-readable string used to identify a storage subsystem.",
        "SET_INFORMATION",
        "Physical disk drive management. ",
        "CD_9212E0D756DE59946D687462B752A6AF5A16EC3A329D47D13E039D19732A1344.1650.177051227.341",
        "The SetDNSDomain method allows for the setting of the DNS domain. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. This is an instance dependent method call that applies on a per adapter basis. On Windows 2000 the setting applies to the targeted adapter. On NT4 this setting is global.",
        "60006",
        "Fuse Failure",
        "D021DDCC83A8D429CDB678D3D29879253FD3",
        "CD_169484918492FC0AC4886BF1A48556EDC1984793E915C243C1C0A4B8E678F4FD.1638.175585457.323",
        "NS_390EB45D32F689282408ADA520CE6393A41EC4618EE204AA0FBC32CF2D7469E3\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_618BE348A47753A2409C56D8BA15B824FE864BAE4B7AEC8D5761691B87263426",
        "Parameters for shell execution.",
        "SetFallbackPrintDriverType",
        "The Serial number property is a manufacturer-allocated number used to identify the physicalmedia.  ",
        "NONDRA",
        "FarmName",
        "Horizontal polarity is negative",
        "Win32_SystemConfigurationChangeEvent",
        "Defines the current state of the Ring Management state machine.",
        "The Component reference represents the COM class using the associated category.",
        "A textual description of the physical location of the printer.",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{GUID}[RemoteServerName]",
        "TRACELEVELONE",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_CONNECT_DATA",
        "0xD024",
        "The CIM_IRQ class represents an Intel architecture IRQ",
        "End Of Media",
        "{8502C4CF-5FBB-11D2-AAC1-006008C78BC7}",
        "CIM_PhysicalComputerSystemView.NumericSensorHealthState",
        "NumberOfColorPlanes",
        "LowDateTime",
        "Maximum number of queue pairs supported by the adapter",
        "The KernelDumpOnly property indicates whether only kernel debug information will be written to the debug log file. ",
        "RoamingPath",
        "The difference between the logical size of the optimized files and the logical size of the store (the deduplicated user data plus deduplication metadata).",
        "IR_AB83450D2C362894742984071630B17B68677FB118022A7E22EAA68EDF64D1E8",
        "RollupStatus",
        "ref:Win32_MemoryDevice",
        "CreateListSynchronizationAspect",
        "This method initiates a repair of the virtual disk - restoring data and redundancy to different (or new) physical disks within the storage pool.",
        "C_7AD87B163E5F080E34E60018A0634DBE95115F38F1BC264D0B548D7507D9109E",
        "The configuration ID used to get the configuration from the pull server.",
        "LinkTechnology",
        "R_390D5ED0BE7821A9A41296EE6280A1479152221DCE5D93BE2F8AC7791409FDC4",
        "WildCard",
        "The GroupComponent reference represents the computer system where the load order group exists.",
        "C_4FD2270AA7CC321848B51530B7A77A9E39B5486B55CE0C09A2B597A1F1FCE1E6",
        "{52C84ACA-027A-4536-A74A-E0BB50C44782}",
        "DOT11_PAM Flag",
        "Image_V1",
        "\"Completed\" indicates that the element has completed its operation. This value should be combined with either OK, Error, or Degraded in the PrimaryStatus so that a client can tell if the complete operation Completed with OK (passed), Completed w",
        "This method allows for the creation of a file server on a storage subsystem.",
        "ReadyThread",
        "NumberOfProcessors",
        "RegistryEvent",
        "Buffer padding to 32 bits, do not use",
        "Retrieves the ODBC Connection Pooling PerfMon counters for ODBC Connection Pooling feature.",
        "CR_73D523E5D8422D25C3616043387358F30734A705AA52BC4685A9ACF44AAE4050",
        "VolumeSerialNumber",
        "Dmi Revision",
        "CD_978F575657B58CCD4ADDD20377EBE045FC67DB638FC034EF8F9A1689AD6805E5.1605.3997361857.2558",
        "Win32Registry|System\\CurrentControlSet\\Services|Device0|DefaultSettings.Interlaced",
        "RemovingApplication",
        "A persistent binding set request included a local SCSI ID that was already bound",
        "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY",
        "{9d66cffa-b7c5-42e0-a7df-a16ee84b020e}",
        "Enabled keying modules",
        "__thisNAMESPACE",
        "51004",
        "EngagedRestartDeadlineForFeatureUpdates",
        "sValue",
        "R_3ECB043C95F0C9AAB7C16383D55D2891C8AE6907321F09C2CBFD38E505562934.2460.2926819268.558",
        "FileContext",
        "SupportsCloneRemote",
        "// This class exposes session statistics",
        "TM_UNITTEST Flag",
        "The ProviderOperation_ExecQueryAsync property indicates the number of calls to IWbemServices :: ExecQueryAsync.",
        "LAT protocol",
        "Renaming a computer can be performed only by a member of the Administrators local group on the computer. You cannot call this Rename function remotely for domain computers. /nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. /nThe method can return the following values:  /n0 - Success. Reboot required. /nOther - For integer values other than those listed above, refer to Win32 error code documentation.",
        "Next-State",
        "The ReadOperationCount property specifies the number of read operations performed.",
        "Boot Architecture",
        "typedef enum ",
        "ApiSetUnresolved",
        "The data file for this driver.",
        "Internal Power Bus",
        "Thread_TypeGroup1",
        "fdpHostCtlGuid",
        "CD_B8B1FAB8A4F90C512F053D1AD5C7061AC5CC502A1FC989312218B5B68AB25BBF.0.1980148045.98",
        "ref:Win32_DfsTarget",
        "ref:Win32_PowerSettingSubgroup",
        "partial read",
        "rasDialParamsData",
        "CUBIC",
        "QueryInfoPolicy2_End",
        "SamOpenAlias",
        "AccountManagement_AuditSecurityGroupManagement",
        "DefaultLanguage",
        "Buffer Too Small",
        "ForwardPathInitiator",
        "Callback",
        "Activates the current product.",
        "The SetTcpipNetbios method is used to set the default operation of NetBIOS over TCP/IP for this network adapter. Windows 2000 only. The method returns an integer value that can be interpretted as follows: ",
        "Takes the partition offline by dismounting the associated volume (if one exists). The partition remains offline until explicitly brought online or an access path is added to the partition.",
        "The ChangeStartMode method modifies the StartMode of a service. It returns one of the following integer values:",
        "GetOwnerAuthStatus",
        "The property GroupId specifies the proposed phase 1 security association key exchange group. This property is ignored for all aggressive mode exchanges (IKEAction.ExchangeMode = 4). If the GroupID number is from the vendor-specific range (32768-65535), the property VendorID qualifies the group number. Well-known group identifiers from RFC2412, Appendix E, are: Group 1=\\'768 bit prime\\', Group 2=\\'1024 bit prime\\', Group 3 =\\'Elliptic Curve Group with 155 bit field element\\', Group 4= \\'Large Elliptic Curve Group with 185 bit field element\\', and Group 5=\\'1536 bit prime\\'.",
        "If TRUE, this virtual disk will only be attached to the system if an explicit call is made to the Attach method. Note that this property is specific to Storage Spaces.",
        "CIM_PrintService.LanguagesSupported",
        "ISCSI_SECURITY_FLAGS are valid",
        "{F0FF8EBB-F14D-4369-bd2e-d84fbf6122d6}",
        "Maximum number of partitions allowed.",
        "TierSizeDivisor",
        "The ClientType property indicates the type of the connected client.",
        "Internal Processor",
        "UAPInfo",
        "Indication(TRUE)",
        "3221232498",
        "FX_TRACE_RESERVED_1a",
        "Win32API|Network Management Structures|SHARE_INFO_503|shi503_servername",
        "The UserName property indicates the name of the currently-logged-on user./nConstraints: Must have a value. /nExample: johnsmith",
        "Cannot connect to the storage provider.",
        "{63dbb180-dbed-11d2-895b-00c04f79ab69}",
        "Indicates how many firmware slots this storage enclosure supports",
        "PartACK",
        "CR_8BC061EB0082E96D5DC5828FD96C3FC2A01095E7E42C720BCD36F363CA556A85",
        "This is an abstract class that shows the status of a Microsoft protection technology.",
        "TRACE_VERIFICATION",
        "Asynchronous Event Reporting",
        "LPC_TRACE_RESERVED_18 Flag",
        "HVAC Problem",
        "This parameter denotes the minimum supported size that a virtual disk created in this pool can be.",
        "Specifies that no encapsulation offload is supported.",
        "Space",
        "InstanceNameList",
        "Win32_ACE",
        "An enumeration indicating the cache type that is compatible with this memory. For example, 4 indicates write-through cache.  If the Cacheable property is set to false, then this property does not have meaning and should be set to 5, \"Not Applicable\".",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1607.1989036250.180",
        "Win32API|Printing and Print Spooler Structures|DevMode|dmICMIntent",
        "The scoping Log\\'s CreationClassName.",
        "{d6145693-5988-457f-8581-9a0157b58690}",
        "C_DA73568A33421108A6DACFCC11E7E041F3E9C8CE8D59EB3EF5250A5065604FCD",
        "The current credential authentication and provisioning settings to be used by peer transport endpoints.",
        "HOSTPROC_TRACE_OBJECT Flag",
        "LPCDRVR_TRACE_RESERVED_10",
        "Capabilities and management of the PowerSupply LogicalDevice.",
        "GetFailurePredictionCapability",
        "Specifies which platforms the rule is applicable on.  If null, the rule applies to all platforms (the default).  Each entry takes the form Major.Minor+, for instance 6.0, 6.1+, or 6.2.  If + is specified, then it means that the rule applies to that version or greater.  For instance, Windows Vista could be represented as 6 or 6.0, and Windows 7 or later would be represented as 6.1+.  + may only be attached to the final item in the list.  6.0+ is not valid because it means the same thing as null (all platforms).",
        "This parameter is a string indicating the access path, which is a user-mode path that can be used to open the partition. An access path can be a drive letter (in the form C: or C:\\) or a path to an empty directory on an NTFS volume. The access path string does not require a trailing backslash.",
        "The TotalSectors property indicates the total number of sectors on the physical disk drive.  Note: the value for this property is obtained through extended functions of BIOS interrupt 13h. The value may be inaccurate if the drive uses a translation scheme to support high capacity disk sizes. Consult the manufacturer for accurate drive specifications.",
        "This object contains the data identifying either the initial load device (its key) or the boot service that requested the last operating system load. In addition, the load parameters (ie, a pathname and parameters) may also be specified.",
        "object:ChannelPoolSettings",
        "MSFT_NetAdapterVPortElementSetting",
        "Host-based RAID controller",
        "{72967901-68EC-11d0-B729-00AA0062CBB7}",
        "CD_C867B637B25E413A5893A8DF403F24B113B36FB9DA058811D901C232D15C4E60.34.107941735.730",
        "HeapSnapShot",
        "MachineId",
        "CD_3593792BE66B364C91CB864BB99BBAAA7F25D2BB3385AF25FEAE463E3985026A.75.4172547056.443",
        "Association between iSCSISession and iSCSITargetPortal",
        "ClientName",
        "StackFrame",
        "HttpsTransportBindingElement",
        "TR_CACHE Flag",
        "The SettableRLSD property indicates whether RLSD can be set for this serial port (if Received Line Signal Detect (RLSD) is supported). ",
        "Select * from Win32_NetworkLoginProfile",
        "MDM_ApplicationControl_Policies01_01",
        "CD_EE95DA75DAF58996DD64AF173044F543D1582822947D33302AD4D1498AE0C965.1627.1.25082",
        "A free-form string describing the way(s) in which this card is physically unique from other cards. This property only has meaning when the corresponding boolean property, SpecialRequirements, is set to TRUE.",
        "HideRestart",
        "AES_128_WITH_DIFFUSER",
        "8AEA913BD3EDDC.1751.21967571.185",
        "ScanPath",
        ".. - Other - For integer values other than those listed above, refer to Win32 error code documentation.",
        "productHasNotifiedUser",
        "TRC_FN_ENTER",
        "IL_5619F5F895C3D573343163A85231441998067CF9B7F0925D97380D29EEA3F575.423.1.33645",
        "VpnKeywordsProvider",
        "The inherited SettingID serves as part of the key for a CIM_MonitorResolution instance.",
        "IKEv1",
        "WSP_FileServerToFileShare",
        "Setting Name",
        "RemoveBlockedCommand",
        "Select * from Win32_CDROMDrive",
        "Touch Pad",
        "MEMCACHE",
        "PersistentStore",
        "Bytes written using bounded Ecp mode",
        "CR_5DEB181FA3808D9D7D9C352C844B65D0C9A0221A91C57777C58BAB412DD30F67",
        "Win32API|Tool Help Structures|MODULEENTRY32|szExePath",
        "MsftDiscFormat2StreamInterleave_DebugGeneral",
        "RequireIntegrity",
        "AllowAddProvisioningPackage",
        "The process Id of the process that hosts the contract.",
        "NUMA Scaling",
        "2 - 'Same': copy engine I/O has the same priority as host I/O. ",
        "NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange",
        "The Win32_CodecFile class represents the audio or video codec installed on the computer system. Codecs convert one media format type to another, typically a compressed format to an uncompressed format. The name \"codec\" is derived from a combination of \"compress\" and \"decompress.\"  For example, a codec can convert a compressed format such as MS-ADPCM to an uncompressed format such as PCM, which most audio hardware can play directly.",
        "MCA_ERROR_UNKNOWN_NO_CPU",
        "OpenVMS",
        "AutomaticVMActivationHostDigitalPid2",
        "RemoteSettings",
        "LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls",
        "TLSCipherSuites",
        "Private methods used for mapping cmdlets to WMI methods. These methods should not be used directly and can change without notice.",
        "4FA9D18C6AEA8D3F609CF92D2D881D05F26BFED8",
        "The TcpUseRFC1122UrgentPointer parameter specifies whether TCP uses the RFC 1122 specification or the mode used by BSD-derived systems, for urgent data. If TRUE, urgent data is sent in RFC 1122 mode.",
        "PhySupportSpeed",
        "C_040BB4AE5C8C1563BE4142EBDDB8539C7E5CCE64A27291E9F997DFF018BE9069",
        "Denotes the provisioning type of the virtual disk. A value of 1 - 'Thin' means that the storage for the disk is allocated on-demand. A value of 2 - 'Fixed' means that the storage is allocated up front.",
        "WMP Network Sharing Service",
        "SysCallNtStatus",
        "Indicates that the network adapter supports filtering received packets based on the VLAN ID.",
        "Tape - DST Large",
        "WSManWmiProvError Flag",
        "{B364997C-4D5F-418c-BDA2-DBAB3A4314CD}",
        "In the case of an LDAP-derived instance, the SeeAlso property specifies distinguished name of other Directory objects which may be other aspects (in some sense) of the same real world object.",
        "C_EE95DA75DAF58996DD64AF173044F543D1582822947D33302AD4D1498AE0C965",
        "CD_3DBA7E264DDA7F8A7A309588967A7B5C3508359FF35613C96FF730C82E46EDC2.2143.1.14635",
        "If the above \"preferred\" algorithm is not used, the defining entity should assure that the resulting IndicationIdentifier is not re-used across any IndicationIdentifiers that are produced by this or other providers for the NameSpace of this instance. ",
        "CIM_AssociatedCooling",
        "If IsOffline is TRUE, this property informs the user of the specific reason for the disk being offline. ",
        "MSFT_SmbGlobalMapping",
        "The icon index for the shortcut.",
        "ProcessCreationClassName",
        "PortSpecificAttributes",
        "PacketIntegrity",
        "Capabilities and management of a fan cooling device.",
        "The PrivatePageCount property specifies the current number of pages allocated that are accessible only to this process ",
        "CIM_SAPSAPDependency",
        "MIF.DMTF|System Cache|003.12",
        "Win32_DisplayConfiguration",
        "Unmanage",
        "The IconTitleFaceName property indicates the nameof the font used for the names of the icons.",
        "CR_3FDA482EEA11D105F777BB4C0E86194FDFA63901845D94A245BC2172A88E5638",
        "ProductKeyID",
        "thirdPartyPrivacyType",
        "The IKE id payload size specified is not correct.",
        "LastRunFullDefragTime",
        "The ServiceName property indicates the service name of the network adapter. This name is usually shorter than the full product name. ",
        "C3 latency",
        "EnablePacketQueuing",
        "ScanOnlyIfIdleEnabled",
        "MIF.DMTF|Temperature Probe|002.11",
        "C_F4AD89F24C5E59F704DEBE5DF4920F1D71930B871988589A8D9D698640C4E7BA",
        "CIM_CollectedMSEs",
        "Home Basic Edition",
        "ErrorCleared",
        "MSFT_MintRunspace",
        "The parent system in the association",
        "Reverts the original storage volume to this shadow copy. After Revert is done, the original volume will be identical to this shadow copy and every newer shadow copy will be deleted. You cannot cancel or undo the revert operation - any data written to the original volume after the shadow copy was created will be lost!",
        "C_7EB464F197DCBE575080B9282C967BE21B4306F539F2D486C42140F55C5D0FC8",
        "Denotes the operational status of the PhysicalDisk.",
        "TRACE_CLASS_BINDING",
        "The Win32_PrinterConfiguration class defines the configuration for a printer device.  This includes capabilities such as resolution, color, fonts, and orientation.",
        "UpdateConfiguration",
        "CIM_VideoController.AcceleratorCapabilities",
        "MDM_PassportForWork_User_Policies02",
        "{bc80e27f-6b74-4da9-abfc-2e4e82b81000}",
        "{2F86B8BD-EFF5-4C07-8FA5-60788517EF95}",
        "DrvMjFnCall",
        "Indicates if RSC is currently operational for IPv6 TCP packets.",
        "ProviderType",
        "Is Not AC Setting",
        "X25 Pad Type",
        "Voice over Frame Relay",
        "IL_F65757B9154C5EBDDAE70D4285BD74985CCB42751F841E9E56AE020776DD15BB.579.1.61471",
        "MSFT_NetImPlatAdapter",
        "0x00000002 - Indicate the profile is now set to roaming, if this bit is not set, then it is set to local.",
        "QPOutgoingWrite performance counter missing",
        "Alignment",
        "The percentage of the job that has completed at the time that this value is requested.",
        "C_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D",
        "SetInformationPolicy",
        "If this parameter is specified then EffectiveNrptPolicy is returned",
        "WS-Identify",
        "StartService",
        "The CSDVersion property contains a null-terminated string, that indicates the latest Service Pack installed on the computer system. If no Service Pack is installed, the string is NULL. For computer systems running Windows 95, this property contains a null-terminated string that provides arbitrary additional information about the operating system.",
        "HostedCacheServerIsEnabled",
        "Win32_VoltageProbe",
        "Connector Type",
        "The Win32_NamedJobObjectProcess association class relates a job object and a process contained in the job object. A job can contain multiple processes.",
        "The ExceedNotification property indicates whether or not events will be written to the event log when quotas are exceeded.",
        "{9565979E-7D80-11D2-AAD3-006008C78BC7}",
        "{8502C58C-5FBB-11D2-AAC1-006008C78BC7}",
        "DisconnectIPV4",
        "GroupMask8",
        "SetObjectListElement",
        "{4A626026-DB36-11d2-85FC-0000F8102E5F}",
        "NumberOfColumnsDefault",
        "NDIS FDDI Long Multicast List",
        "Oversubscription Error",
        "HighestState",
        "#define HBA_EVENT_PORT_OFFLINE          0x201",
        "\\\\.\\root\\subscription:__Win32Provider.Name=\"LogFileEventConsumer\"",
        "SMBIOS|Type 4|Processor Information|External Clock",
        "RememberCredentials",
        "AdvertiseTypes",
        "AddCertBinding",
        "MsftEnumDiscRecorder2",
        "CD_021AFE414882C03F97BF442E09455A26212B908FBBC7D7673C42DD465658CAAB.276.2720137495.206",
        "MaxSynRetransmissions",
        "Stores admin notes ",
        "The 'collected' Collection.",
        "Transparency",
        "Win32_UserStateConfigurationProvider",
        "A free-form string describing recommended actions to take to resolve the error.",
        "Member",
        "CD_9A36BB4E390B7DD04D76CD832679A7EB96B353EDC2C276A7C316493A7FCF4652.1649.1620314628.2164",
        "CD_B18A79A265A485271ADF7583A11B74126B27D0421B9B453C88A99D39E80DF5B2.215.2664669812.604",
        "MagazineSize",
        "C_C20D4B021E0AFFB61E5D90A8AD1A949CBA948B6ED6C506FD3F623477DE2DDF5D",
        "Target Id given in Target Mapping is invalid.",
        "IKEEXT Trace Provider",
        "RD_TRACE_PNP Flag",
        "Owner",
        "The cache extension which should be removed",
        "HKEY_CLASSES_ROOT",
        "Smoke Detection",
        "8 data bits",
        "MSFT_StorageHealthStatusChangeEvent",
        "SystemPreferredUILanguages",
        "The file name.",
        "ClientBaseAddress",
        "iSCSI Initiator Instance Failure Event",
        "EnforcementMode",
        "LockedDownLocalMachineZoneNavigateWindowsAndFrames",
        "AllowRoamingRegistryExclusions",
        "MIF.DMTF|Processor|006.6",
        "6-EEAB-455E-BEC2-A2CC8FDFF976}]",
        "Downlevel IPsec Policy Store",
        "The total number of hours that this Device has been powered.",
        "LockedDownLocalMachineZoneAllowUserDataPersistence",
        "This device is not present, is not working properly, or does not have all its drivers installed.",
        "NumberOfColumnsMax",
        "      <assemblyIdentity name=\"Microsoft-Windows-Store-Install-Service.Resources\" version=\"10.0.19041.1\" processorArchitecture=\"amd64\" language=\"*\" buildType=\"release\" publicKeyToken=\"31bf3856ad364e35\"></assemblyIdentity>",
        "Description of the zone.",
        "Restricted Token",
        "{220c16fc-b9a8-11d4-b675-002048570337}",
        "PerVportInterruptModerationSupported",
        "The Disabled property determines whether the  user account is disabled.",
        "SupportsXOnXOff",
        "Indicates if the directory must be empty.",
        "24 bit",
        "Specifies a printer name.",
        "RemoveByDsnObject",
        "IR_092A55272DD5776D1F8B56BC2DC2767240A3BAAE69BF8801B96D23CE4A45B158",
        "Proprietary Broadband Wireless Access Point to Mulipoint",
        "BAUD_1200",
        "Upper Filters",
        "object:MSFT_SmbMultichannelConstraint",
        "C_E6695722F42AFD2A38B87A3A03743A182D780F4AE622B7E7DF87DC65E7D101EB",
        "DisplayTransferCharacteristic",
        "SubsegmentFree",
        "True if popups are disabled",
        "6 - 'Fractured': Target is split from the source. ",
        "The ProviderOperation_PutClassAsync property indicates the number of calls to IWbemServices :: PutClassAsync.",
        "HandleOldDescsEnd",
        "whenChanged",
        "Property to enable AD bit check on DNS responses.",
        "CIM_StorageRedundancyGroup",
        "This method allows for the creation of two replication groups and a replication relationship between them. This method requires the subsystem to support fully discovered replication.",
        "TokenActivationAdditionalInfo",
        "ManagedElement is an abstract class that provides a common superclass (or top of the inheritance tree) for the non-association classes in the CIM Schema.",
        "LetAppsAccessGazeInput_UserInControlOfTheseApps",
        "Bus mouse",
        "Performance Degraded",
        "String number for the asset tag of this processor",
        "NameSub",
        "NDISWMI_TRACE_USO Flag",
        "You must specify a host name for this file server.",
        "If AssignDriveLetter is set to TRUE, the next available drive letter will be assigned to the created partition. If no more drive letters are available, the partition will be created with no drive letter. This parameter cannot be used in conjunction with DriveLetter. If both parameters are specified, an Invalid Parameter error will be returned.",
        "partial write",
        "C_AF4BE4279039B330700F9676DFB82FB8AA7B80608BAF978E72E54EFC9915FE11",
        "Lost Comm",
        "MDM_Policy_User_Config01_Display02",
        "{87FEEDCA-DB2A-11d2-85FC-0000F8102E5F}",
        "The child element that is a component of a system",
        "ClientError Flag",
        "HANDLE",
        "RedirectedIPAddr",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_DE17C9D5088F4B642733CF8AEA90F5A7AFA5A9B0892FB2650254AF86F16B343D",
        "The ObjecPath property holds the path of the object to retrieve.",
        "CIM_SerialController.CapabilityDescriptions",
        "The ErrorData property contains data captured from the last memory access with an error. The data occupies the first n octets of the array necessary to hold the number of bits specified by the ErrorTransferSize property. If ErrorTransferSize is 0, then this property is not used.",
        "{EC278F3A-BFE8-42d5-99C0-E25F5EF4A3D1}",
        "The ServiceType parameter passes the type of service provided to processes calling the service.",
        "Requests that the Device capture its current configuration, setup and/or state information in a backing store. The goal would be to use this information at a later time (via the RestoreProperties method), to return a Device to its present \"condition\". This method may not be supported by all Devices. The method should return 0 if successful, 1 if the request is not supported, and some other value if any other error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier.",
        "PLATFORM_TRACE_INIT Flag",
        "ComponentClassName",
        "ContextBlocksQueuedPersec",
        "42005",
        "PortableDeviceAPI_Enumeration",
        "ErrorDataOrder",
        "IL_3985A64DD548C159337A855FB2D96B222C50720949C8FDEAE049F7ADFD2826A5.1784.1476947504.329",
        "Example: DWDOM\\Admin.",
        "DOMonthlyUploadDataCap",
        "C_8ED07F8AE1220DCA0AA67C713F95FF5F2613D1EF04C9C11037C57B91CCCB3B53",
        "IR_C0DCD2330B402CCB79ADC9A534E5029F8DDEDEFB826D41905F5E8463B821C3EF",
        "The cache which should be modified",
        "41012",
        "KeepAliveTime",
        "DefaultOutboundAction",
        "The NetConnectionID property specifies the name of the network connection as it appears in the 'Network Connections' folder.",
        "DetectionSource",
        "Msft_CliAlias.FriendlyName=\"VolumeUserQuota\"",
        "The Msft_WmiProvider_PutInstanceAsyncEvent_Pre event class represents an event generated immediately prior to calling the provider's implementation of IWbemServices :: PutInstanceAsync.",
        "VirtualDiskOffset",
        "PermanentSubscriptionsPerUser",
        "CIM_NumericSensor.Resolution",
        "String that contains the path to the file that contains the icon",
        "ObjectWWN",
        "PciDeviceType",
        "ListenUri",
        "SupportsStoragePoolDeletion",
        "IP (for APPN HPR in IP Networks)",
        "WSP_Partition",
        "Favorites",
        "TEST_TRACE_TSTDRIVER",
        "Bit mask defining the service categories supported by the hardware.",
        "Instances ofthis class represent binary information (such as bitmapps, icons, executables, etc...) that are used by an installation.",
        "{77CA1248-1505-4221-8EB6-BBB6EC771A87}",
        "C_23DDB252CC4D2FD4A1F4DD3D5C1D39DC829D566848D6F27132AE759E1E502D48",
        "CIM_PhysicalFrame.BreachDescription",
        "PortalCount",
        "Identifies the event. ",
        "R_7F0C45BECF0AE38ABEC381EFAA7EA36E4140C97C5F097E86E0524E666D767CEA.1480.3490792441.562",
        "Indicates that a FRU may be composed of other product(s).",
        "SystemManifestVersion",
        "The ComputerName property indicates the name of the computer from which the session is established",
        "February",
        "Output NetConSecRule",
        "CurrentCredential",
        "Win32Registry|.DEFAULT\\Control Panel\\Desktop|ScreenSaverIsSecure",
        "ReportingObjectId",
        "The ServicePackMajorVersion property indicates the major version number of the service pack installed on the computer system. If no service pack has been installed, the value is zero. ServicePackMajorVersion is valid for computers running Windows 2000 and later (NULL otherwise).",
        "Local area network",
        "KeyProtection",
        "IL_FF125414713AEFB3BE9B36BF5067B839DE545A44FB053F1F2696CC7ADC1B48DA.2458.1833003234.336",
        "IsActivated",
        "I_3BB2F25840E05D325FAFACABBB276A102D49D79CD3C3CCD8CF11A4F77E826041.2505.2359748797.326",
        "Supplies an array of two IPv6 addresses. An NA message will be sent in response to any NS message with a Target Address field matching either address in this array.",
        "C_C793B9525D878D9706E959E8F468E81449F6D48F127A802D380F8F7D8B8795DB",
        "Mini-Centronics Type-20",
        "3 - 'Level 3': Physical disks will be discovered.",
        "DeviceId is an address or other identifier that uniquely names the enclosure. For example, DeviceId is the enclosure GUID in Storage Spaces provider.",
        "Based on inetOrgPerson and for directory compatibility, the UserCertificate property may be used to specify a public key certificate for the person.",
        "JobObjectMatchCondition",
        "NdisFddiRingOperational",
        "NS_2EEEF6086B5AA3148DE8DC3E7A7263A417EE849A276BDB357874FDEB8ADED318",
        "HKEY_USERS 03",
        "NdisTokenRingLineErrors",
        "File associations for this application",
        "SpecificTime",
        "LUAInstall: error 0x00000005 setting flags [{92D2CC58-4386-45a3-B98C-7E0CE64A4117}]",
        "StorageType",
        "The MediaType property specifies the type of media being printed on. ",
        "The slot into which the physical package is inserted.",
        "Descriptions",
        "GetContentByTemplateId",
        "The PeakWorkingSetSize property indicates the peak working set size of the process.",
        "PermissionsDenied",
        "MDM_WNSConfiguration",
        "ExportedDirectoryName",
        "Result",
        "C_9C6234A862ECB7785AEE1C8C46C69B53F75E4A1B191D9AE24604A07719AA0D8E",
        "ZeroOutEntireDisk",
        "Cancel KTIMER2 Event",
        "Foreground_Red",
        "CD_849BB872FA48C9D9F0979EF051B133EED262AD47FF263C164F3A538EED0B65F3.1.1304466958.230",
        "Example: 00001201000230.000000 000",
        "Detailed Threat Notifications.",
        "Network address of target involved in failure",
        "IL_0255C72DE857C2548B152EEC30DB6E16802B631CB06DED8AAADBC49C9509FDEB.616.1.272838",
        "PseudoStreamOriented",
        "CorporateDNSProbeHostAddress",
        "SEL_TIME_STAMP",
        "Specifies Trigger DNS Configurations.",
        "{04C8A86F-3369-12F8-4769-24E484A9E725}",
        "KeyAdditionFailures",
        "8 - 'Starting': The disk is in the process of starting.",
        "Win32_LoadOrderGroupServiceMembers",
        "I_109BD1A95093AEF0A632244BD18A876529B9EE47C13A28C3FB4CAC19C751D964.2697.41031290.273",
        "ScanScheduleQuickScanTime",
        "An access point for the boot service.",
        "You must specify a sharing protocol for this file server.",
        "MEM_PLATFORM_BUS_SPECIFIC_DATA is valid",
        "SystemConfig_V2_Platform",
        "A free-form string describing that this slot is physically unique and may hold special types of hardware. ",
        "InfSection",
        "MSDASQL_1",
        "Microsoft-Windows-NetworkConnectivityStatus",
        "The SetDefaultTTL method is used to set the default Time to Live (TTL) value in the header of outgoing IP packets. The TTL specifies the number of routers an IP packet may pass through to reach its destination before being discarded. Each router decrements the TTL count of a packet by one and discards the packets with a TTL of 0. Default: 32, Valid Range: 1 - 255The method returns an integer value that can be interpretted as follows: ",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805",
        "RemainingSkuReArmCount",
        "The EnableStatic method enables static TCP/IP addressing for the target network adapter. As a result, DHCP for this network adapter is disabled. The method returns an integer value that can be interpretted as follows: ",
        "PolicySourceDeleteTempFolders indicates whether the property DeleteTempFolders is configured by Server(0) or Group Policy (1).",
        "MaximumTxQueueSize",
        "DisablePublishing",
        "DVB-RCC MAC Layer",
        "Object Manager Events",
        "EVENT_TRACE_FLAG_VOLUMEMOUNT",
        "SamProcessMappedAttributes_End",
        "MSMouse_ClassInformation",
        "MSFT_TaskEventTrigger",
        "Irq Affinity Mask",
        "FilesOpen",
        "ChangeDate",
        "{8502C4C0-5FBB-11D2-AAC1-006008C78BC7}",
        "local|hkey_local_Machine\\software\\microsoft\\windows nt\\currentversion\\systemrestore|RPSessionInterval",
        "DefaultCapabilities",
        "The Element reference represents the properties of anetwork adapter that is using a particular network adapter setting.",
        "MGR_TRACE_RESERVED_1c",
        "The NDIS 802.11 WEP key index",
        "C_9E927C42162CFFA3624D55690B21114853C375D15511354B30627B7E45D7DB02",
        "The name attribute of the service in WSDL.",
        "CD_916EF6B6122453D1C58D648E96BD869758A18BA38D348DDAE67570192E8AB140.2216.3632298505.6819",
        "The current Http Digest credential.",
        "The CursorBlinkRate property indicates the length of time between successive cursor blinks.",
        "Applies only when Protocol is TCP or UDP.  Local ports this filter applies to.  May be a number or range 0-65535, or one of the following: Any, RPC, RPC-EPMap, IPHTTPSIn, PlayToDiscovery.",
        "PLATFORM_TRACE_LOG",
        "CD_73A800D7866C4390667315AF06F93202489C8838112B8D051CF005E872136F01.1734.560543502.2776",
        "EVENT_TRACE_FLAG_CALLPARAMETERS",
        "LPC_TRACE_MSG",
        "CD_70B5C3F445D36D84AF1F9F0E062B6A21EF707E1616BEC072F41A3F1113BAD785.2427.1496682488.524",
        "CloudPrintOAuthAuthority",
        "Win32_OfflineFilesDirtyInfo",
        "Enable",
        "ACPI _PTC",
        "Win32API|Component Categories|CATEGORYINFO|szDescription",
        "Win9x",
        "DOMaxCacheSize",
        "ScheduleImminentRestartWarning",
        "Adds a route to the specified VPN connection",
        "WMI|Win32_Account",
        "Localized version of RSOP_PolmkrLocalPrinterSetting for American English",
        "Win32API|Process and Thread Functions|CreateProcess",
        "Range1InputFrequencyLow",
        "The profile ID corresponding to the actual interface that the traffic is going out on or coming in from the wire.",
        "Specifies whether to collate this printer's output by default.",
        "Bid2Etw_MSDART_1_Trace_TextW",
        "When the job is executing or has terminated without error, then this method returns no CIM_Error instance. However, if the job has failed because of some internal problem or because the job has been terminated by a client, then a CIM_Error instance is returned.",
        "C_28B64F0A4A4B406BEF1C2ABA6655968C837E1E9DA0BC417F80E2473D3793AF08",
        "Failure - Unknown error",
        "An MSFT_Printer instance specifying the printer to be renamed.",
        "FilePath",
        "The machine name of the AVMA host.",
        "The low voltage of Input Voltage Range 2 for this Power Supply, in millivolts. A value of 0 denotes 'unknown'.",
        "MaxQueuesPerQueueGroup",
        "ClusterName",
        "If traffic type is transport mode, this is the LUID of the FWPS transport layer filter corresponding to this traffic. If traffic type is tunnel mode, this is the LUID of the associated QM policy. In tunnel mode, this represents the QM traffic selectors for the tunnel",
        "Partition Type",
        "Localized version of RSOP_PolmkrRegionOptionSetting for American English",
        "R_28D3480019EDB8568B100B133C2E45279CD6E1AD49C4AEEDB510EEF8207E9610",
        "DidThreatExecute",
        "Win32_TerminalError",
        "MIF.DMTF|FRU|002.11",
        "WUUUU",
        "Corrupt Master File Table detected",
        "Bytes written using hardware Ecp mode",
        "Indexing Enabled",
        "Old Allocation Size",
        "MGR_TRACE_RESERVED_1c Flag",
        "MSFT_CliAlias.FriendlyName=\"LoadOrder\"",
        "MSFT_DSCConfigurationOutputWriteProgress",
        "PNP_EVENT_WARNING_LEVEL",
        "description",
        "{3C852D74-7E49-4FF3-BF21-81EF888078D4}",
        "SMBAutoEncryptedFileExtensions",
        "CacheSizeBytes",
        "{5BC42B62-C7A1-11d2-911D-0060081A46FD}",
        "Timestamps",
        "If TRUE the share will be encrypted during transport.",
        "ref:Win32_COMApplication",
        "ServerAddress",
        "MDM_MultiSIM_Slots02_01",
        "MediaSenseEventLog",
        "MSFT_CliAlias.FriendlyName=\"RecoverOS\"",
        "This optional class allows the author to 'reserve' a specified amount of disk space in any directory, depending on the installation state of a component. Reserving cost in this way could be useful for authors who want to ensure that a minimum amount of disk space will be available after the installation is completed. For example, this disk space might be reserved for user documents, or for application files (such as index files) that are created only after the application is launched following installation. The ReserveCost class also allows custom actions to specify an approximate cost for any files, registry entries, or other items, that the custom action might install.",
        "The GroupComponent reference represents a group that the account is a member of.",
        "firstPartyPrivacyTypeText",
        "Uint8",
        "ProfileSource",
        "NlmCim",
        "Linear Frame Buffer",
        "This property contains the name of a Win32_Property having a value that resolves to the full path to the source directory. If the SourceName property is left blank, then the property named in the SourceFolder property is assumed to contain the full path to the source file itself (including the file name).",
        "Unable to find the mount point of the volume.",
        "DnsSuffix",
        "The ResultCode property holds the HRESULT Status code of operation.",
        "CreateVirtualDisk3",
        "The Properties arrays is the list of properties to be shown for this Format.",
        "TimeToLive Expired Transit",
        "IL_5361F0B5BCF344E5F8BAFF7D3C773CFDA995B3843B674DB9DB34AC35EA55A657.748.1.63404",
        "The cooling device for the package.",
        "ISCSI_ERR_INVALID_BURST_LENGTH",
        "CD_18CF4DFADB65FD9009884647249EF310A7B2E05DDBD0DAD1404A0AE55A5E4EE4.1135.1897622505.1026",
        "MSNdis_80211_NetworkInfrastructure",
        "The DriverVersion property is the version of the driver e.g. 5.1.2427.1 ",
        "LogonServer",
        "The Win32_Directory class represents a directory entry on a Win32 computer system. Directory is a type of file that logically groups data files 'contained' in it and provides path information for the grouped files.",
        "A Boolean value that specifies whether messages are guaranteed to arrive in the order they were sent.",
        "MaxConcurrentUsers",
        "The SerialOverrunCount property indicates the number of serial overrun errors that occurred in the current session",
        "Height",
        "LUAInstall: error 0x00000005 setting flags [{9343812e-1c37-4a49-a12e-4b2d810d956b}]",
        "OriginalPort",
        "C_1F1219F96576A4588331D02100737379E76B59AFFFE01B2EACFBBB0DBCD4C75C",
        "Example: AT&F.",
        "Specifies that  EAP-TLS (smart card or user certificate) should be used as the authentication method. ",
        "LoadAadCredKeyFromProfile",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_logon_server",
        "WLanDiagCtlGuid",
        "IBM390 Family",
        "SamDeleteGrp_Start",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_3D90968CBF38C76EB9C64EC58DF8BAD337C1A48A70D1C9EF256656BDBCD3DFE435",
        "Indicates how many days items should kept in Quarantine folder before being removed.",
        "y57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "The frequency, in minutes, of how often a client will contact the KMS host after the client is licensed.",
        "The Location property indicates the physical location of the battery. This property is filled by the computer manufacturer.",
        "LineSize",
        "daddr",
        "Frame Relay Address",
        "Win32API|Network Management Functions|NetShareDel",
        "MDM_Policy_Config01_WirelessDisplay02",
        "The DataFile property contains the data file for this printer driver, (example: qms810.ppd).",
        "WmiIPv4",
        "NewDriveLetter",
        "MGR_TRACE_MGR Flag",
        "Electroerosion",
        "The StandardYear property indicates the year when standard time is in effect. This member is not required.",
        "C_2648AFE05B7E0F21678E759462EA0EABBE7924AFC35D246F32D9D0F1F494FCA9",
        "0x00000020 ",
        "Testing",
        "Parameter that specifies the tree that contains the",
        "Values: TRUE or FALSE. If TRUE, information will be written to a system log file.",
        "\"Predictive Failure\" indicates that an element is functioning nominally but predicting a failure in the near future. ",
        "The Dependent reference represents the Win32_Directory that contains the file directory for thelogical program group.",
        "This field is a string representation of the physical disk's part number or SKU.",
        "WMI|Win32_UserAccount",
        "Consent for sample submission.",
        "SystemRestoreConfig",
        "Service Must Be Started",
        "The name of the printer for which to retrieve printer configuration.",
        "DOT11_NOTIFY_OBJECT",
        "C_65C33823125A389998EE918715634996D26443DD7799EEDA88DD0650D03B9936",
        "ifHCInBroadcastPkts",
        "UniqueSessionId",
        "IL_AEBBB507A29E8F338269B9CA27CFB703530BD08BC38B11D5941903CA1890F254.2544.105354383.263",
        "MIF.DMTF|Electrical Current Probe|001.16",
        "Parity",
        "#define ISCSI_HBA_ISNS_DISCOVERY                   0x00000010",
        "CIM_Job.LocalOrUtcTime",
        "CIM_IKEProposal",
        "R_E78B24A63ACB40A253226DA76298C783683B9FFCFE28CF1078C510D46CEF2248",
        "Text of the script, expressed in a language known to the scripting engine.",
        "\"Migrating\" element is being moved between host elements. ",
        "TR_TLV Flag",
        "CIM_Action",
        "ConnectionOrientedTransportBindingElement",
        "ClusterResourceName",
        "Supports Remote Storage",
        "Certificate issuer filter for IKEv2 machine certificate selection",
        "This class provides access to Windows Update policies",
        "CIM_Printer.CharSetsSupported",
        "DeviceEncryptionPolicy",
        "Unrecoverable",
        "Dial Mode",
        "ClientConfiguration",
        "IncludeResourceUsage",
        "WmiQueryCurrentOffloadConfig",
        "{FAF76B7B-798C-11D2-AAD1-006008C78BC7}",
        "15 - 'Dormant': indicates that the storage pool is inactive. ",
        "Resets BranchCache to a default configuration.",
        "This property reflects the NAP (Health) status of the connection if it is configured to use PEAP authentication method and is currently connected to the Remote VPN Server.",
        "LsaCfgCredGuardStatus",
        "lDevice.",
        "NdisFddiRingTrace",
        "The amount of storage, in bytes, that a single packet occupies in the receive buffer space of the NIC.",
        "DisplayInARP",
        "WerConnectionReport",
        "A free form string describing the role of the processor - for example, \"Central Processor\"' or \"Math Processor\"",
        "{4838fe4f-f71c-4e51-9ecc-8430a7ac4c6c}",
        "Elements of group can be mix of thin and thick",
        "MSiSCSI_LB_FAILOVER",
        "OfflineInstallationId",
        "The AppID property is a Globally Unique Identifier (GUID) for the DCOM application.",
        "E-mail",
        "Timestamp_Sys100NS",
        "__AdapStatus",
        "TM_PNP",
        "invalid handle ",
        "IL_CE1AB475306539B9E244C98908B04E7D335C952B0802573B7D36EFEB15743AA7.695.1.29172",
        "The Win32_SCSIController class represents a SCSI controller on a Win32 system.",
        "Network Location Awareness Trace",
        "You must specify the size info (either the Size or UseMaximumSize parameter) or the tier info (the StorageTiers and StorageTierSizes parameters), but not both size info and tier info.",
        "Succeeded",
        "The StartTime property represents the UTC time to run the job, in the form of YYYYMMDDHHMMSS.MMMMMM(+-)OOO, where YYYYMMDD must be replaced by ********.  The replacement is necessary because the scheduling service only allows jobs to be configured on a day of the month, day of the week, or run once. A job cannot be run on a specific date./nExample: ********123000.000000-420 which implies 12:30 pm PST with daylight savings time in effect.",
        "PermanentAddress defines the network address that is hardcoded into a port. This \\'hardcoded\\' address can be changed using a firmware upgrade or a software configuration. When this change is made, the field should be updated at the same time. PermanentAddress should be left blank if no \\'hardcoded\\' address exists for the NetworkAdapter.",
        "VolumeDriveLetter",
        "The TypeDetail property indicates the type of physical memory represented by Win32_PhysicalMemory.",
        "PortParameters",
        "Thermal Diffusion",
        "RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles",
        "{464FFABA-946F-11d2-AAE2-006008C78BC7}",
        "Policy",
        "Volume Is Compressed",
        "CD_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2.295.4087736782.1172",
        "Current User",
        "The QuotasRebuilding property indicates an active state signifying that the file system is in process of compiling information and setting the disk up for quota management.",
        "AllowMicrosoftAccountsToBeOptional",
        "SystemPaletteEntries",
        "CreateSnapshot",
        "CIM_PhysicalComputerSystemView.Dedicated",
        "Beacon period in Kusec",
        "NoInterrupt",
        "The name of this registered profile. Since multiple versions can exist for the same RegisteredName, the combination of RegisteredName, RegisteredOrganization, and RegisteredVersion MUST uniquely identify the registered profile within the scope of the organization.",
        "C_9E9C09D30F7B6C1C4DDFBE795ADB6A836F2310F7AF7CD6B6BA1E05BFB3CEFE19",
        "SDBUS_DEBUG_SDCMD Flag",
        "AllowICMPRedirectsToOverrideOSPFGeneratedRoutes",
        "This class is a representation of a particular Storage Management Provider (SMP) software package which is used to manage a storage subsystem.",
        "RSOP_PolmkrFileTypesSetting",
        "Command Line To Start Process",
        "{313e88df-a4fd-11d8-b301-505054503030}",
        "Example: B5 (JIS).",
        "Infected process",
        "{A9ECEFF6-C502-11DA-82C4-000D5692A4BC}",
        "C_5A900E37ECD3AD176DF3B2408CEE2A05339FDF5781218575370BC8E3B869737D",
        "The KeepAliveInterval property indicates the interval separating Keep Alive Retransmissions until a response is received.",
        "Capabilities and management of the video controller.",
        "object:MSFC_FC4STATISTICS",
        "dwMaxRxQueue",
        "NS_88591E56F7DF51C96BBDD94E4112A5C7AADAE3154C1ACB64E20A2CB89B0D6F02",
        "SamEnumDomInSamSrv_End",
        "DaylightYear",
        "The name of the replica peer within the replica's storage subsystem.",
        "CIM_DeviceAccessedByFile",
        "EnterpriseIPRangesAreAuthoritative",
        "Last quick scan source",
        "PS_VpnConnectionTriggerApplication",
        "RedeployCount",
        "ErrorType",
        "Supplies the key encryption key (KEK).",
        "Indicates the latest USB Version supported by the USB Device. The property is expressed as a Binary-Coded Decimal (BCD) where a decimal point is implied between the 2nd and 3rd digits. For example, a value of 0x201 indicates that version 2.01 is supported.",
        "RegisteredName",
        "PageFault_HeapRangeRundown_V2",
        "Name of the storage health setting",
        "The YResolution property has been deprecated to theVerticalResolution property.  Please refer to the description of that property.",
        "The main mode rule.",
        "Unknown or Unspecified Error",
        "SupportedMinimumLogSize",
        "Win32_SoftwareFeature",
        "DestinationPath",
        "UnLoad",
        "Security Groups",
        "FAX Device",
        "PolicySourceSessionDirectoryExposeServerIP indicates whether the property SessionDirectoryExposeServerIP is configured by Server (0) or Group Policy (1).",
        "RSOP_PolmkrImmediateTaskSetting",
        "NetPeerDist",
        "MSNdis_AtmMaxAal0PacketSize",
        "Not Installed",
        "ROOT\\CIMV2\\Security\\MicrosoftVolumeEncryption",
        "R_CF7E5037F6563CE949872FEF4BA72C8CE3F9C68DD9A3E9BD325E8B9ECC946118",
        "Connect",
        "__FilterToConsumerBinding",
        "{6DAE7092-DB36-11d2-85FC-0000F8102E5F}",
        "Specifies whether the User name are retrieved from the client.",
        "3311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        "Specifies the paper type that the Printer will use if a PrintJob does not specify a particular type. The string should be expressed in the form specified by ISO/IEC 10175 Document Printing Application (DPA) which is also summarized in Appendix C of RFC 1759 (Printer MIB).",
        "Fiber Distributed Data Interface (FDDI)",
        "SizeRemaining",
        "MIPS R4200",
        "HBA_EVENT_PORT_BROADCAST_CHANGE",
        "R_7C4D4C779B8655DD6A7E86DC91922E10770F67B8451A5A7276C3310C51D0FD42",
        "{eb225178-f5f0-42b7-895b-db89276f647a}",
        "Never Overwrites",
        "Power Supply 0",
        "3221232485",
        "CIM_ERR_NOT_FOUND",
        "SMBIOSMemoryType",
        "GetSystemPartition",
        "TotalFolders",
        "Empty",
        "Power PC 750",
        "This is the string value of the element.",
        "CD_B6D5ABBE2F1027301C23A1CF884681090FD42092F2E95A0F33AA6207C9180DA3.1474.2338126691.606",
        "CIM_OperatingSystem.EnabledState",
        "CreateOptions",
        "{485e7deb-0a80-11d8-ad15-505054503030}",
        "EngagedRestartSnoozeScheduleForFeatureUpdates",
        "65007",
        "The ForwardBufferMemory parameter specifies the size of the router packet queue used to store packet data.",
        "The Msft_Providers class exposes configuration relating to provider instances",
        "CD_A57480D0D82DDE51E01CC9C7625981822E2D1C37B70F78DC6E6179505A7BD928.293.3064914020.164",
        "Bootable",
        "RSOP_PolmkrDataSourceSetting",
        "R_B6F5DFB5FF9D262A34F808F6064BE3724B862C376624E6B9C572552907B49F21",
        "The number of times that an acquire has failed.",
        "The IPsec Encapsulation Mode that should be used.",
        "The 'other' adjacent slot.",
        "I_82D62EACB411F46C88EF11FE5A18F1088AEDA0897AD63F2947178230B7AF5724.1780.3306664901.199",
        "MSFT_NetAdapterPowerManagementSettingData",
        "Size in bytes of shared secret used to communicate with RADIUS servers",
        "Select * from Win32_DiskPartition",
        "CD_60A55C37A891C02E43DCC85CF24FBB0AEC4CE837463192AE3DF9F07B12D58EBF.1470.1.8869",
        "This class provides the ability to create a job for installing or un-installing an application and also provides the job status and error code if any",
        "HiFreq",
        "CounterName",
        "The Antecedent reference represents the Win32_LoadOrderGroup containing the properties of the load order group that must start before the dependent base service of this class can start.",
        "Internal Modem",
        "CopyObjects",
        "Set iSCSI Group Preshared Key",
        "TRACINGDBGPRINT Flag",
        "ShowWindowCommand",
        "MacSecBypassSupported",
        "Gauss",
        "Pentium(R) II Xeon(TM)",
        "RSSPlatformBackgroundsyncPerformanceTraceProvider",
        "RD_TRACE_RESERVED_13 Flag",
        "Integer containing bit flags representing file attributes (with the decimal value of each bit position in parentheses).  See the remarks below for more information:       Bit 0:   Read Only (1)    Bit 1:   Hidden (2)     Bit 2:   System (4)     Bit 8:   Split (256) - the file is split between two or more compression cabinets    Bit 9:   Vital (512) - this file is vital for the proper operation of the component to which it belongs    Bit 12:  Permanent (4096) - the file will not be removed on uninstall    Bit 13:  Uncompressed (8192) - the file is uncompressed on the source media    Bit 14:  Patch (16384) (reserved for future use)    Bit 15:  PatchSourceIgnore (32768) - the file can be ignored during a patch upgrade if it is run-from-source",
        "NetworkServiceHost:[ReliabilityMetricsProvider]",
        "Msft_WmiProvider_DeleteInstanceAsyncEvent_Pre",
        "January",
        "SMBIOS|Type 17|Type Detail",
        "68030",
        "BandwidthThrottlingStartTime",
        "T(m;T(m;",
        "{1008CCE9-7BFF-11D2-AAD2-006008C78BC7}",
        "RestrictedSitesZoneEnableMIMESniffing",
        "MSNdis_SetInterruptModeration",
        "TEST_TRACE_GENERAL",
        "1.0.0.1",
        "The segment number of a PCI network adapter.",
        "{FAF76B63-798C-11D2-AAD1-006008C78BC7}",
        "DeferQualityUpdatesPeriodInDays",
        "Collection is an abstract class that provides a common superclass for data elements that represent collections of ManagedElements and its subclasses.",
        "SearchInfo",
        "ReadyToInit",
        "The DisplayName property indicates the display name of the service. This string has a maximum length of 256 characters. The name is case-preserved in the Service Control Manager. DisplayName comparisons are always case-insensitive. ",
        "EventPairHigh",
        "The Sid property returns the security identifier descriptor for this process.",
        "Video Processor",
        "RD_TRACE_RESERVED_17",
        "Internal error",
        "The inherited Name property serves as key of a Win32_LogicalProgramGroupItem instance within a computer system.  Program Groups are implemented as file folders in Win32.  Full path names should be provided. Example: f:\\WINNT\\Profiles\\a-kevhu.000\\ Start Menu\\Programs\\Accessories\\WordPad.Lnk",
        "CacheFileDirectoryPath",
        "SignatureType",
        "Specifies which kinds of certificate problems should cause a certificate to be rejected.",
        "Size of the read cache on the virtual disk",
        "Charging and Low",
        "0FD\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "0 - the Perceived Severity of the indication is unknown or indeterminate. ",
        "Specifies the initial text and background colors if a new console window is created in a console application",
        "MSFT_ExpressionValue_datetime",
        "This column is an identifier for the MIME content. It is commonly written in the form of type/format.",
        "supportedCapabilities",
        "LetAppsAccessMessaging_ForceDenyTheseApps",
        "Header_DbgIdRSDS_TypeGroup",
        "{8502C4FF-5FBB-11D2-AAC1-006008C78BC7}",
        "Toner Low",
        "EapConfiguration consists of the following fields: ",
        "ProhibitInstallationAndConfigurationOfNetworkBridge",
        "ref:HNet_Connection",
        "MIF.DMTF|Electrical Current Probe|001.13",
        "The type of callback when the contract is a duplex contract.",
        "SharedElement",
        "Target Portal",
        "A unique key identifying this service control item within its product.",
        "RSOP_PolmkrPowerSetting",
        "object:Win32_ACE",
        "LPCDRVR_TRACE_RESERVED_13",
        "AddAccount",
        "Win32_PatchFile",
        "iScsiFlagScsi",
        "UdpIp IPV6 Send/Receive",
        "The SetTcpUseRFC1122UrgentPointer method is used to specify whether TCP uses the RFC 1122 specification for urgent data, or the mode used by Berkeley Software Design (BSD) derived systems. The two mechanisms interpret the urgent pointer in the TCP header and the length of the urgent data differently. They are not interoperable. Windows 2000 and Windows NT version 3.51 or higher defaults to BSD mode. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "40006",
        "Indicates network adapter support for Receive Checksum Offload for this encapsulated packet type.",
        "client",
        "BC1F63F5A3F73F9B",
        "TCP Transport Error",
        "D2 Tape",
        "IPsec",
        "The SCSILogicalUnit property indicates the SCSI logical unit number (LUN) of the disk drive.  The LUN is used to designate which SCSI controller is being accessed in a system with more than one controller being used. The SCSI device ID is similar, but is the designation for multiple devices on one controller.",
        "Denotes the current health status of the enclosure.",
        "Count of # of PDU received over this connection",
        "AC9604DE68E2D71F4D4CAD1DB441347D3.2664.318208373.283",
        "Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_16BITMODE",
        "CI_47C79E62C2227EDD0FF29BF44D87F2FAF9FEDF60A18D9F82597602BD95E20BD3",
        "C_8950808B8A2EB8D5AE895F8D253EC27AA46290C0D9FCF34907198A4AB3C923D1",
        "Maintenance2",
        "MSFT_ResiliencySetting.NumberOfGroupsMin",
        "LetAppsAccessMotion",
        "MembersOf",
        "C_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D",
        "CIM_PhysicalComputerSystemView.NumericSensorSensorType",
        "MDM_AppLocker_EnterpriseDataProtection01_StoreApps03",
        "Specifies the configuration XML blob for tunneled EAP, EAP-TTLS, or PEAP authentication. ",
        "IL_76BBC96B178A1C054AB319522EC35C13427283C8227727BACFAF1E007CEB0AB9.1533.2682743591.332",
        "InterruptType",
        "MSFT_CliAlias.FriendlyName=\"VolumeQuotaSetting\"",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.286.1443573607.368",
        "5F3A7D47CFF70177272CA0960C1975D28A99D9A71A82E07B0FC43A060E86CD93",
        "The type of the pointing device.",
        "SendScsiReportLuns",
        "IL_3BD30BBD5E5F0A0256E5304240954604220B8912EA00BA63FEA8E61AC5DAFDD4.2689.2449392308.269",
        "CopyPriority allows the priority of background copy engine I/O to be managed relative to host I/O operations during a sequential background copy operation. Values are: ",
        "{524ED194-DB35-11d2-85FC-0000F8102E5F}",
        "The Sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If the CurrentReading is above UpperThresholdFatal, then the Current State is Fatal.",
        "SchedulingMethod",
        "A unique identifier of the object that triggered the fault.",
        "The width of the physical package in inches.",
        "Author",
        "The key to identify the instance of MDM_Restrictions class",
        "Name of the vendor of the software.",
        "{fb66c8fe-1da0-48a2-92db-02c341143c46}",
        "AppDir",
        "Time in minutes for a detection in the 'critically failed' state to move to either 'additional action' or 'cleared' state.",
        "The Win32_TSVirtualIP class defines the configuration for Win32_TSVirtualIPSetting. This includes capabilities such as Enable Virtual IP, Set Virtual IP modes Per-session/Per-Program.Add/Remove a program to/from the list of Programs that needs a virtual IP.Enumerate Network Adapters and set a Network Adapter to use.",
        "MDM_Policy_Config01_Messaging02",
        "Start Pending",
        "SupportsExpeditedData",
        "The friendly name or description of the target network adapter.",
        "Remove_BCDataCacheExtensionByDataCacheExtension",
        "R_9A2FA4B503D51BA72E7F874AA07B2D2639867C129B89B4AF2230D146C0DBAD9A",
        "ref:CIM_VolumeSet",
        "LockoutCounter",
        "SMHBA_BIND_TO_LUID",
        "MsftDiscRecorder2_DebugConstructor Flag",
        "Performance monitor control register",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TERMINALSERVICESETTING_Prov\"",
        "NameOfRawDataProperty",
        "SW_SHOWMINIMIZED",
        "HOSTPROC_RESERVED_13 Flag",
        "additionalSenseCode",
        "MDM_ApplicationControl_Tokens01_01",
        "NewPrincipalByGroup",
        "Determines the allocation behavior for this virtual disk. Fault domain aware virtual disks will intelligently pick the physical disks to use for their redundancy to balance the fault tolerance between two (or more) fault domain units of the specified type.",
        "ToValue",
        "Requests that the state of the job be changed to the value specified in the RequestedState parameter. Invoking the RequestStateChange method multiple times could result in earlier requests being overwritten or lost. ",
        "Bid2Etw_OLEDB_1_Trace_TextW",
        "{8502C4D8-5FBB-11D2-AAC1-006008C78BC7}",
        "Thumbprint of the certificate that activated the product.",
        "MDM_Firewall_FirewallRules02_01",
        "The file system format to use for the volume.",
        "RequestBufferCount",
        "SET_QUOTA",
        "DiskIo_V1_TypeGroup1",
        "Solaris",
        "{0EFF663F-8B6E-4e6d-8182-087A8EAA29CB}",
        "Maximum size, in Kbytes, of media supported by this device.",
        "nifiedSchedulingEngine>true",
        "Library Loader Basic Event",
        "Thread Pool Callback Dequeue Stop",
        "ChannelTiming",
        "SubjectName",
        "__Subject",
        "Outlook",
        "Maximum thermal dissipation of the slot in Milliwatts.",
        "8 - Unknown failure.",
        "Win32API|GetPrivateProfileInt|Boot Loader|timeout",
        "\"Non-recoverable Error\" (30) - The element has completely failed, and recovery is not possible. All functionality provided by this element has been lost. ",
        "Downloads",
        "C_BBA26CEBD94E02C63A4812F98BAF8B828E20477373D54CAFB6CE9D30D952E46C",
        "DateTime",
        "Framework publisher",
        "OperationalParameters",
        "InUse",
        "MSNdis_WmiIPSecOffloadV1",
        "Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_SPECIALCHARS",
        "The name of the trace listener.",
        "42008",
        "CD_56ACCF81C026D704BF64439555ED0FE36A1018BEC0E78E085DF8A96CFE6A37EE.2427.183473358.1250",
        "ProviderName",
        "C_9257E4A3C9993B750EBCB6C34C9BA11105FABAD75B9C0DE005A64417B00B58B0",
        "WHEAErrorSourceMethods",
        "SysDriver",
        "Boolean indicating that the media access device needs cleaning. ",
        "Transmitted Count",
        "TEST_TRACE_RESERVED_04 Flag",
        "32792",
        "Redbook Performance Information",
        "CIM_PhysicalCapacity is an abstract class describing a physical element's minimum/maximum requirements and ability to support different types of hardware. For example, minimum and maximum memory requirements can be modeled as a subclass of CIM_PhysicalCapacity.",
        "MIF.DMTF|Voltage Probe|001.5",
        "Reachable",
        "Example: ^e",
        "CD_3AA22630705AFF3975D1F6344798271087D2AF7B509FA6E34ED791616A9DF674.1749.3138720245.1668",
        "The Win32_1394Controller class represents the capabilities and management of a 1394 controller.  IEEE 1394 is a specification for a high speed serial bus.",
        "Retrieves a structural representation of the object's security descriptor.",
        "CIM_IKESAEndpoint.CipherAlgorithm",
        "AllowUsersToConnectRemotely",
        "EVENT_TRACE_FLAG_CREATEONEXISTINGFILE",
        "PROTO Flag",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\InprocServer32[ThreadingModel]",
        "IR_9731A66D417FDC024A9D93DAD0B38C4D96CBFD2BEC45E5FB4706D56140B553A0",
        "ManagePreviewBuilds",
        "DisableClearTpmButton",
        "valuemap",
        "PCI-X Mode2 533 100MHz",
        "Unable to notify DNS service",
        "Win32API|Thread State",
        "CD_7C256082C028FC113E44225862F56FE496A6FB4D4EE2AD50DD39EB6DF6A574DF.2155.1089045040.3476",
        "Create the Route.",
        "CodeIntegrityInfo",
        "DestinationNode",
        "YSize",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_A3BFBEBE234E4658CAF2F881D4107E925EE23BCFF10DB187E30DCBCBC937403E11d7",
        "Parameter that specifies the tree that contains the sSubKeyName path. The default value is HKEY_LOCAL_MACHINE (0x80000002). The following trees are defined in Winreg.h: ",
        "Realm",
        "WMP Network Sharing Taskbar",
        "EnableByteRangeLockingOnReadOnlyFiles",
        "WFP_TRACE_IPSEC Flag",
        "PrintTicketXML",
        "The MaximumComponentLength property indicates the maximum length of a filename component supported by the CD-ROM drive.",
        " Direct  - Specifies that the document should be sent directly to the printer.  This is used if print job are not being properly queued.",
        "SCSI Fibre Channel Protocol",
        "CD_E444CD7B23739F9E179DAD07B13CB31D8D111ED6AEEFD52B89FB204BF93A5A2C.40.925121659.580",
        "LpcDriverTraceGuid",
        "The current state of MPIO paths between the node and physical disk.",
        "SDDL for remote user tunnel SA authorization",
        "Thread_V0_TypeGroup1",
        "Example: C:\\PAGEFILE.SYS  ",
        "subtype",
        "Where <OrgID> and <LocalID> are separated by a colon ':', and where <OrgID> MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business entity creating/defining the InstanceID, or is a registered ID that is assigned to the business entity by a recognized global authority. (This is similar to the <Schema Name>_<Class Name> structure of Schema class names.) In addition, to ensure uniqueness <OrgID> MUST NOT contain a colon (':'). When using this algorithm, the first colon to appear in InstanceID MUST appear between <OrgID> and <LocalID>. ",
        "The method signature of the operation.",
        "RAS Dial Params Data",
        "Default action for high severity threats.",
        "MGR_TRACE_RESERVED_18 Flag",
        "Kernel Perf State Domain Transition Event",
        "SetDefaultPrinter",
        "Mapping",
        "CD_1AEFFB6222622A61AE00A6A8A6B976D42F502B57E04086F26915152E496EAF89.1292.3206024161.180",
        "TRACE_RESERVED8",
        "{6733c4e9-4792-11d4-97f1-00c04f79c403}",
        "Specifies resources on the intranet that are normally accessible to DirectAccess clients.",
        "C_3935D6345388A245E9FF50F1CD42F69CC8FD444FF90B93C789385D0BD31672F7",
        "Passphrase used to encrypt the file containing the key information.",
        "ActiveOffSupported",
        "AddTarget",
        "Slowest state considering policy restrictions",
        "LoadFlags",
        "Thermal Other",
        "Unique name of a location from which the internet can be dialed.",
        "CD_DED77797B1689BED6B94AFBF9C743E829865A2A20644965BAF07B0D354CDC951.65.3220177655.647",
        "{8E7F70E8-C856-11D2-B364-00105A1F77A1}",
        "direct",
        "pathToSignedReportingExe",
        "UMPass Driver Trace",
        "ExchangeMode",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TERMINALTERMINALSETTING_Prov\"",
        "This class is the FC_Port attributes",
        "Display name for the local machine personal certificate subject name",
        "CM_DSLID",
        "Win32API|System Information Functions|GetSystemDirectory",
        "The cost associated with the registration of the type library in bytes.",
        "41019",
        "AntispywareEnabled",
        "//*********************************************************************",
        "Win32API|Communication Structures|DCB|XoffLim",
        "ATTUNIX",
        "MSNdis_StatusDot11ConnectionCompletion",
        "The Model property indicates the product name of the computer given by the manufacturer.",
        "Bluetooth",
        "Active Low",
        "CIM_SystemComponent is a specialization of the CIM_Component association that establishes 'part of' relationships between a System and the Managed System Elements of which it is composed.",
        "{0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e98}",
        "I_0FDDA11AC916ED71F32FEE36D469E077FADCD247C9F70B38F6B7F22F5EFD8737.2700.3092675816.270",
        "I_1257F088005C68EC5FA4DFBBA0AEB198E19233AC30C02CB7FD214AAB22B161AE.2712.2406208286.288",
        "ServiceModel Service",
        "CD_0CD3432EB17462BFB5BD92FE309EBEDE9286A9F3ADCBFE4044D787F3CCDADE24.41.1235163419.481",
        "The POTSModem class represents a Device that translates binary data into wave modulations for sound based transmission.  It connects to the POTS (Plain Old Telephone System) network.",
        "CIM_ApplicationSystemSoftwareFeature",
        "September",
        "{447956fe-a61b-11d0-8dd4-00c04fc3358c}",
        "{8502C52B-5FBB-11D2-AAC1-006008C78BC7}",
        "The AccessMask property is a bit array representing the access rights as set remotely on the network share held by the user or group on whose behalf the instance is returned. ",
        "C_554B16C9365D83D15EEFD2ED88E19BDB73646FD9C4C1F4781F93EC1BCB3E664E",
        "TRACE_FLAG_POWER",
        "OtherLinkTechnology",
        "Is Not Default",
        "Could not attach the virtual disk because too many physical disks have failed or gone missing.",
        "Display name of the zone.",
        "GetStorageReliabilityCounter",
        "UtilError Flag",
        "DisableByInputObject",
        "The Win32_TerminalServiceSetting class defines the configuration for  TerminalServerSetting. This includes capabilities such as Terminal Server Mode, Licensing, Active Desktop, Permissions Capability,Deletion of Temporary folders and Temporary folders per session.",
        "DataCache",
        " - AddMembers ",
        "NumberOfEnabledCore",
        "1 = This application's Language is a less suitable match for the target, ",
        "0xD00B - 'No Access Allowed': No access is allowed to the element. ",
        "If true, a configured roaming profile will only be downloaded if the machine is a primary computer for the user.",
        "This property has been deprecated in favor of PrinterStatus, DetectedErrorState and ErrorInformation CIM properties that more clearly indicate the state and error status of the printer. The PrinterState property specifies a values indicating one of the possible states relating to this printer.",
        "Composite polarity is negative",
        "{16716917-4306-4be4-9b5a-3809ae44b125}",
        "HandleOldDescsBegin",
        "The MofSelfInstallDirectory property contains the direh",
        "19 - Trusted For Delegation - Windows 2000: The account is enabled for delegation. This is a security-sensitive setting; accounts with this option enabled should be tightly controlled. This setting allows a service running under the account to assume a client's identity and authenticate as that user to other remote servers on the network. ",
        "{0DD082C4-66F2-271F-74BA-2BF1F9F65C66}",
        "{e2a26f78-ae07-4ee0-a30f-ce354f5a94cd}",
        "MSFT_SmbServerNetworkInterface",
        "MSiSCSI_InitiatorInstanceFailureEvent",
        "Volume Quotas",
        "ref:MSFT_VirtualDisk",
        "object:MSNdis_80211_NetworkType",
        "MCACpuCacheError",
        "SupportedPlatform",
        "Always",
        "Auto Connect",
        "The DHCPLeaseExpires property indicates the expiration date and time for a leased IP address that was assigned to the computer by the dynamic host configuration protocol (DHCP) server.",
        "Net6to4Configuration represents global 6to4 configuration shared across all 6to4 interfaces.",
        "The GUID for the network interface.",
        "Represents a local printer port.",
        "passPhrase",
        "The Win32_IRQResource class represents an interrupt request line (IRQ) number on a Win32 computer system. An interrupt request is a signal sent to the CPU by a device or program for time critical events. IRQ can be hardware or software based.",
        "0x00000022",
        "Minimum refresh rate of the video controller in hertz.",
        "FaultingObjectDescription",
        "Unsynchronized",
        "Virtual Allocations",
        "AllowRealtimeMonitoring",
        "FullScanStartTime",
        "Values: TRUE or FALSE. A value of TRUE indicates the protocol supports guaranteed delivery of data packets.",
        "Invalid start file",
        "Decimal",
        "DllSearchPathExternal",
        "DH-768 bit prime",
        "To indicate whether the address family for this neighbor is v4 or v6.",
        "I_A963FF6A8458E9C4FEA354824C031F4237B8648981577F19FD6854C86994DA8C.1797.2375707628.192",
        "DefineValues",
        "DadTransmits",
        "ClientWallPaper",
        "10 - 'Stopped': The disk was stopped or shut down in a clean and orderly fashion.",
        "Inkjet Solid",
        "Bid2Etw_MSADCF_1_Trace_TextW",
        "ISCSI_ERR_CHAP_OFFERED",
        "Is primary computer",
        "IL_7B1CEA145FD7FDDE85118A874F4CDC2DBDFFEFB5270CF85B4A7E073D01A42C9B.2461.3033647899.340",
        "This parameter is a Win32_DefragAnalysis object that contains properties describing the extent to which the volume is fragmented.",
        "Values: TRUE or FALSE. A value of TRUE indicates the interrupt is hardware based.",
        "The availability and status of the device. ",
        "MS_409",
        "AccessToken",
        "_WMI_TRACE_CLIENT_OPERATIONS_",
        "Bytes read using software Epp mode",
        "{09F81337-D568-41d1-A177-D6779AF55847}",
        "APIC Virtualization",
        "HwEcpReadCount",
        "Number Of Cleaner Slots",
        "MSStorageDriver_FailurePredictEvent",
        "Negotiated Flags",
        "PhysicalAddr",
        "Supplies the setting for waking on a packet pattern. If this property is Enabled, then the adapter wakes the system on receipt of a specified pattern.",
        "C_6CE5293A4991040589451CEEA5CB3FB1F0BCB9AC8B0C16A2D34DE39822CD1F34",
        "VME Bus",
        "Printer's vertical resolution in Pixels per Inch",
        "NeverSend",
        "{FAF76B5B-798C-11D2-AAD1-006008C78BC7}",
        "CD_59998C21660422211077DE80E05C8A70A59B3233A43120323CA16489848947CD.2032.1235839788.834",
        "MSFT_NetSARule",
        "LocalDateTime",
        "This property contains a thumb print of the trusted root certificate for this authority",
        "CD_86063DABE8CE896A69DCD5B43BD505C1E3B2A298B4207DEC8AA9B679D5A8639E.42.3671217056.182",
        "Updating Firmware",
        "ref:Win32_PnPEntity",
        "MinHSyncNumerator",
        "MSFT_DscProxy",
        "TRACE_FLAG_WMI",
        "ref:CIM_ProtocolEndpoint",
        "CR_15A139866A05DA114FEFEDBCDD1A1CE7ECC7161C7A0053EFB8918A0783845D31",
        "SPACES_VirtualDiskToVirtualDisk",
        "The time that the Job was submitted to execute. A value of all zeroes indicates that the owning element is not capable of reporting a date and time. Therefore, the ScheduledStartTime and StartTime are reported as intervals relative to the time their values are requested.",
        "SDDLToBinarySD",
        "You must specify a size by using either the Size or the UseMaximumSize parameter. You can specify only one of these parameters at a time.",
        "Optional parameter that specifies the access permissions to be verified. You can add these values together to verify more than one access permission. The default value is 3. The following access permission values are defined in Winnt.h: ",
        "Bid2Etw_MSADOX_1_Trace",
        "Setting Definition Value Index",
        "Links",
        "The name of the system that hosts this service",
        "NumericSensorEnabledState",
        "Lifetime over which the route is valid. The default value is infinite.",
        "NameResolutionFailures",
        "CoreDriverDependencies",
        "RemoveTarget",
        "Other transaction",
        "The .ini file section.",
        "PortNumbers",
        "}C0C025C38981E58EE50CB7BB4E4786CBA14FD933E638861EA3A6A2E0C806211E",
        "MIF.DMTF|ComponentID|001.3",
        "LogCreationClassName",
        "MSFT_AdaptivePrinterPort",
        "HOSTPROC_TRACE_LOADER",
        "If trace guid and If enabled, indicates the level of logging",
        "CD_09A1CD34FC28B461D4B117DD4689EFC08E3B06527FEBB7251285DFC403031764.37.2241583001.348",
        "The manufacturer of this driver.",
        "Synchronized",
        "Stack27",
        "CopyType",
        "Disable BidTrace only for this process ID.",
        "{2280CB02-DB35-11d2-85FC-0000F8102E5F}",
        "CoalescedBytes",
        "IsKeyManagementServiceMachine",
        "NumericSensorPrimaryStatus",
        "The unique identifier for a patch package.",
        "HomeDirectory",
        "titleBarText",
        "MSFT_SmbMultichannelConnection",
        "{C827993C-6D1F-4194-9B5C-D7C0A5F1CFB7}",
        "SettingsLocationTemplateProvider",
        "IPsec configuration of a VPN connection",
        "4157E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "RemoveSyncPair",
        "Win32API|Network Management Structures|AT_ENUM|JobTime",
        "IP over ATM",
        "SupportedDeduplicationFileSystemTypes",
        "SPACES_StoragePoolToVirtualDisk",
        "RoCEv2",
        "For example, a valid specification of drives would be \"C:\", \"d:\",\"G:\"  Note that the colon is required with the drive letter.",
        "R_76B92FF8B3AA20856691665FB718428ADC2A8F423D381B9A75A40096351B6F0B",
        "IssuedCookieLifetime",
        "An array of Win32_ACE entries that specify which users/groups auditing information is gathered for",
        "CIM_AlarmDevice",
        "IL_E00A8EF4F74D23B882355F3A0D21293BA28C6F1C8A1BC8F9B30030B2F4330712.655.1.32485",
        "EncryptionPaused",
        "ErrorSeverity",
        "{db1d0418-105a-4c77-9a25-8f96a19716a4}",
        "Boolean indicating that this card is a motherboard or, more generically, a baseboard in a chassis.",
        "TM_FUSER Flag",
        "User Agent Text",
        "RealTimeScanDirection",
        "Auto Start",
        "%Service%",
        "NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts",
        "{485e7ded-0a80-11d8-ad15-505054503030}",
        "PCI-X Mode1 133MHz",
        "TimeOfLastReset",
        "The WIn32_VideoSettings class represents an association between a video controller and video settings that can be applied to it.",
        "Manual-Discovery",
        "CIM_PhysicalMedia.MediaType",
        "Loose Source Routing",
        "If TRUE, this parameter instructs Clear to send command to the disk to physically obliterate data.",
        "WSP_ReplicationGroupStorageModificationEvent",
        "NDIS Physical Medium Type",
        "{7EA56435-3F2F-3F63-A829-F0B35B5CAD41}",
        "DataCacheExtensions",
        "Redundant Path",
        "The DisableIPSec method is used to disable IP security on this TCP/IP-enabled network adapter. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "The SessionId property specifies the unique identifier that is generated by the operating system when the session is created. A session spans a period of time from log in to log out on a particular system.",
        "MIF.DMTF|System Resource DMA Info|001.2",
        "MSFT_NetAdapterBindingSettingData",
        "Waiting",
        "Per internal IP address rate limit for unauthenticated inbound IPv6 IPsec traffic.",
        "Requests that the LogicalDevice be brought online (\"Online\" input parameter = TRUE) or taken offline (= FALSE). \"Online\" indicates that the Device is ready to accept requests, and is operational and fully functioning. In this case, the Device\\'s Availability property would be set to a value of 3 (\"Running/Full Power\"). \"Offline\" indicates that a Device is powered up and operational, but not processing functional requests. In an offline state, a Device may be capable of running diagnostics or generating operational alerts. For example, when the \"Offline\" button is pushed on a Printer, the Device is no longer available to process print jobs, but could be available for diagnostics or maintenance. ",
        "Denotes the date and time in which the event that triggered this indication occurred.",
        "Calendar Program",
        "Where <OrgID> and <LocalID> are separated by a colon \\':\\', and where <OrgID> MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business entity creating/defining the InstanceID, or is a registered ID that is assigned to the business entity by a recognized global authority. (This is similar to the <Schema Name>_<Class Name> structure of Schema class names.) In addition, to ensure uniqueness <OrgID> MUST NOT contain a colon (\\':\\'). When using this algorithm, the first colon to appear in InstanceID MUST appear between <OrgID> and <LocalID>. (For DMTF defined instances, the \\'preferred\\' algorithm MUST be used with the <OrgID> set to \\'CIM\\'.) ",
        "CD_AEB1302AC843DE3720FDF5243FA6FA29740C3EF6F87994A8A6D26F14FA996B57.1649.715370947.344",
        "The file or directory",
        "DeadGatewayDetection",
        "A string identifying the physically labeled bank where the memory is located - for example, 'Bank 0' or 'Bank A'.",
        "KernelYieldCount",
        "WSP_StorageSubSystemToFileShare",
        "Name of the current VPN Connection profile.",
        "Is the app in development mode",
        "Maximum Working Set Size",
        "Enables the BranchCache service in local caching mode.",
        "List Of Sessions",
        "ccount management.  ",
        "Win32_ClassInfoAction",
        "This parameter indicates that it is OK to remove OEM and other special partitions. If this parameter is FALSE or not specified, Clear will fail in the presence of these types of partitions.",
        "computerGPOFilters",
        "Specifies the ID of the print job to suspend.",
        "virtalloc",
        "A short textual description (one-line string) of the CollectionOfMSEs object.",
        "KMS product key ID. Returns null if not applicable.",
        "0xC000000B",
        "C_0BEADEF5D3A88C78AC78DA4B138F927C4277A4A7EF33E41BF5355AB5E59743F0",
        "Pad: not used",
        "CorruptionCount",
        "iScsiFlagIoctl",
        "C_62B7F57437B06407AB4B39D9915D0BBD1E5003DEA18F986400E85C5F698F8D97",
        "StringIndirectList",
        "object:MSFT_StorageHealthSetting",
        "MSNdis_QueryStatisticsInfo",
        "Platform not NT/Windows 2000",
        "CriticalErrorCount",
        "TargetGroupObjectId",
        "The Uri the endpoint listens on.",
        "PolicySourceDomain indicates whether the property Domain is configured by Server (0),Group Policy (1), Default (2).",
        " This is an identifier for this software element and is designed to be  used in conjunction with other keys to create a unique representation  of the element. ",
        "CD_F46834254F05C21D05F1FCBE7DDBF6422B6F64465143171291F6775670622C8B.1077.2447533354.6085",
        "NotFailed_and_NonePending",
        "Out of Resources",
        "$+m;$+m;",
        "The Win32_IP4RouteTableEvent class represents IP route change events resulting from the addition, removal or modification of IP routes on the computer system.",
        "Warming Up",
        "C_E626C49C2DBDF1D0BDC38FFC05C85B76B4BE8E69CBFD214D5F89F70F619AD6CD",
        "There are not enough eligible physical disks in the storage pool to create the specified virtual disk configuration.",
        "DISABLE_ERROR_SOURCE",
        "Query Interrupt Moderation",
        "@H(lxh",
        "PERF_SIZE_LARGE | PERF_TYPE_COUNTER | PERF_COUNTER_RATE | PERF_TIMER_100NS | PERF_DELTA_COUNTER | PERF_DISPLAY_PERCENT",
        "The IP address on which the peer node will listen for messages.",
        "Initiator Port Number",
        "Fail Over",
        "Printer error information.",
        "MSFT_CliAlias.FriendlyName=\"Job\"",
        "Checksum",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1780.3650505445.180",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.304.2883904097.180",
        "NS_33649B8965454C922467A4F161F8843CBCFBC36216BF16B17C1FAAEAE38C9913\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_7BA978978EBF3CD1200A10044AC0BD6F4758993016B7F6B6A538255F2BFBBE7A",
        "AES-GMAC-256",
        "The Bias property specifies the current bias for local time translation. The bias is the difference between Coordinated Universal Time (UTC) and local time. All translations between UTC and local time are based on the following formula: UTC = local time + bias. ",
        "AddMember",
        "SetTrstedDomInfoByNam_End",
        "CountPerSecond",
        "Win32_TSPublishedApplication_Prov",
        "{7C39D12A-DB2B-11d2-85FC-0000F8102E5F}",
        "DefaultBase",
        "C_B209BBC3E9792036932058EAFDFF59DF6B02D2E0E24C683DBB3CFAD2B25B83E4",
        "StatusMask",
        "// bit flags for ISCSI_LOGIN_FLAGS",
        "_PROVIDERS_ Flag",
        "{94335eb3-79ea-44d5-8ea9-306f49b3a070}",
        "PreviousValueLength",
        "The NDIS version in use by the NIC driver.",
        "select * from meta_class where __Dynasty = 'CIM_StatisticalInformation'",
        "__NAMESPACE",
        "EventCount Flag",
        "Unsupported shadow copy context",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_913204304A08724134A9D5DC4A1AABD6DF33BE96D109BB06756E60F16CD52120",
        "MinTotalDiskSize",
        "The DeviceID property contains a string identifying the current probe.",
        "UpgradeEditionWithLicenseMethod",
        "Switch parameter to specify that all DNS suffixes in the VpnConnectionTriggerDnsConfiguration object must be copied into the DNS suffixes for VpnConnectionTriggerTrustedNetwork. DNS suffixes without corresponding DNS servers will not be copied.",
        "object:Operation",
        "RSOP_IEESCPrivacySettings",
        "The BuildType property indicates the type of build used for the operating system. Examples are retail build and checked build.",
        "lockcontrol",
        "MGR_TRACE_RESERVED_14 Flag",
        "UseRemotePassport",
        "EdpModeId",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1475.3487665334.180",
        "Pounds",
        "ManageAuditingAndSecurityLog",
        "CorporateWebsiteProbeURL",
        "C_A0108CE261D6CD70D350F5B72F2E9874AE6E004D3029015B0919B1BD326BB649",
        "The key to identify a setting by name",
        "The Target string defines the object to be operated on through the Alias. The string may be a simple class name or a WQL query. If the Target property is empty only verbs based on commandline utilities may be used by the alias",
        "This class encapsulates an ETW capture session on a computer.",
        "A free-form string describing the LogRecord\\'s data structure.",
        "Current status of the Capture.",
        "ISO 802.4 Token Bus",
        "SetIdentificationField",
        "TemplateProfile",
        "TaskID",
        "C_F0D0424EC702B17B5367CB152393B7E5322793C4C7DD8F7A83FA112EC516608B",
        "C_672AC91064DD7727FB109DFF59E95A1F605E4D89A741855158B3D85A026CCD54",
        "UserRefreshInterval",
        "WFP_TRACE_ALE",
        "CD_E78B24A63ACB40A253226DA76298C783683B9FFCFE28CF1078C510D46CEF2248.1135.4026673404.974",
        "object:ProcessorAcpiCsdDependency",
        "ProcessId",
        "Access Server",
        "Policy Repository",
        "Resets the licensing status of an Application.",
        "{4731F89C-71CB-11d1-A52C-00A0C9062910}",
        "MDM_Policy_Config01_RemoteProcedureCall02",
        "The OriginatingMachine property identifies the machine hosting the original volume.",
        "An array representing the thresholds supported by this Sensor.",
        "CD_6733173DBDD8F69CA9013116A1C86DBB32D2314712D9192FE9CAEE8C9CAD7094.1750.4037169654.1198",
        "DeviceWakeUpEnable",
        "ClearVLActivationTypeEnabled",
        "CD_59998C21660422211077DE80E05C8A70A59B3233A43120323CA16489848947CD.1356.1038812945.933",
        "Software licensing server URL for the user license",
        "full line write",
        "{FAF76B9E-798C-11D2-AAD1-006008C78BC7}",
        "Latitude",
        "OnlineDevice",
        "Recursive",
        "41017",
        "RSOP_ExtensionStatus",
        "Contains the key name to get the security descriptor for. ",
        "This parameter allows the user to specify the FriendlyName at the time of the virtual disk creation. FriendlyNames are expected to be descriptive, however they are not required to be unique. Note that some storage subsystems do not allow setting a friendly name during virtual disk creation. If a subsystem doesn't support this, virtual disk creation should still succeed, however the disk may have a different name assigned to it.",
        "Number of translated PTR queries",
        "I_0D0C408DA61D1D81B5295D02AF7B7B37B653E3A9A8C3EC1985E8DB9FFB9B3ECA.2709.2499305137.305",
        "Values: TRUE or FALSE. If TRUE, the password can be changed.",
        "Example: Physical Memory 1",
        "Specifies the MBR partition type. MbrType can only be set if the disk's PartitionStyle property is set to 1 - 'MBR', otherwise an error will be returned. If this parameter is not specified, CreatePartition will default to type 6 - 'Huge'.",
        "Specifies the named value whose data value you are retrieving. Specify an empty string to get the default named value.",
        "WmiQueryInterruptModeration",
        "SamQueryInfoGrp_End",
        "11016",
        "{442c2ae4-9bc5-4b90-a889-455ef220f4ee}",
        "The number of unicast bytes transmitted without errors through this interface.",
        "The initiator address specified is not valid",
        "I_E0849CDEB189AA76D8525CE1B639DCC35E6FEC1238BA020F29888EDAD9D3FEAF.2462.1487720740.353",
        "AgpCommand",
        "ConnectionTimeout Errors",
        "TransmissionSelectionEnabled",
        "object:MSNdis_WmiTcpLargeSendOffloadV1_IPv4",
        "ProcessCount represents the reference count of the file in the associated process.",
        "If this application has a lower precedence than another, the reason this application has the lower precedence than the n",
        "CancelAllJobs",
        "computerSecurityGroups",
        "Defines the checksum offload encapsulation settings for the Adapter for IPv6 transmit packets.",
        "PartitionId",
        "MSFT_NetNatTransitionConfiguration",
        "Sectors Per Read",
        "CR_A09DF16E80CB8250C7E8F768EDC2F0DB283873E2BF1AF5FB3DCD5C1A024C9766",
        "This class represents a power setting definition.",
        "0xC0000012",
        "LUAInstall: error 0x00000005 setting flags [{93073C40-0BA5-11d2-A484-00C04F8EFB69}]",
        "The scoping device's creation class name. ",
        "Where <OrgID> and <LocalID> are separated by a colon \\':\\', and where <OrgID> MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business entity creating/defining the InstanceID, or is a registered ID that is assigned to the business entity by a recognized global authority. (This is similar to the <Schema Name>_<Class Name> structure of Schema class names.) In addition, to ensure uniqueness <OrgID> MUST NOT contain a colon (\\':\\'). When using this algorithm, the first colon to appear in InstanceID MUST appear between <OrgID> and <LocalID>. ",
        "MSNdis_FddiShortCurrentAddress",
        "OSDeviceName",
        "ReinfectionLoop",
        "Enable DH-CHAP for the Physical Port of a Fibre Channel HBA, allowing for unidirectional authentication of the physical port by the Fibre Channel fabric.",
        "ProcessorIdentifier",
        "Write",
        "Thread_V2_TypeGroup1",
        "Win32API|Communication Structures|DCB|fDtrControl",
        "The Win32_ShadowCopy class is a storage extent that represents a duplicate copy of the original volume at some previous time.",
        "582-5FBB-11D2-AAC1-006008C78BC7}",
        "The identifier of the controller to which this port belongs",
        "Weighted Paths",
        " Represents a storage chassis in a data center.",
        "SRIMM",
        "CD_F361CD902D6FB5B5BC72726163E8257DF5E310350EACFCB5758995876F4EB4D6.1559.1111469157.1689",
        "{61da4c13-cdca-44d5-ba39-dc4c73e5e049}",
        "PCI_COMP_INFO is valid",
        "Disable the privacy mode.",
        "Quick Scan",
        "R_F62E0666212AC3F3422A2CD244B01C66D5C5B4C6B82C02CAED0A73F78C5069FA",
        "ICMMethod",
        "IdleTimeBuckets",
        "RsnRekey",
        "RecoveryPointObjective",
        "Filters traffic based on which local application is sending or receiving the traffic.",
        "MSFT_TaskNamedValue",
        "I_A600B813C3AEE4D495996259138D2BE996C368532199D64507DCA6E373C2D027.779.1.56137",
        "ScanScheduleDay",
        "Forwarding",
        "One or more physical disks are not connected to the nodes on which the pool is being created.",
        "SM_SendSRL",
        "TcpIp IPV4 Send",
        "0x00000001",
        "// The number of bytes sent using the AH protocol.",
        "InternetBlockPopups",
        "OS SCSI Logical Unit Number",
        "Stream",
        "CIM_DeviceSoftware.PurposeDescription",
        "Win32_SecuritySettingOfLogicalShare",
        "SetMaxXResolution",
        "The AffinityMask property indicates the affinity mask of the IRQ resource",
        "ref:CIM_Memory",
        "R_7362E8F68732AA5E821EC10EE1BECFA5EBEB33CEDC9F406248A6EF25071BCC2C",
        "NoAction",
        "An array containing the operational status of each current sensor of the enclosure. ",
        "R_A031CEAC5953C8D3D1F35E1808CFDA9CF75C860B9E43860077ADEB4071235C56",
        "The Msft_WmiProvider_CancelQuery_Pre event class represents an event generated immediately prior to calling the provider's implementation of IWbemEventProviderQuerySink :: CancelQuery.",
        "(#m;(#m;",
        "{dde0a090-96bc-452b-9a64-6fbb6a19c47d}",
        "n-Clie",
        "The world wide node name of the virtual port",
        "MaxBurstLength",
        "R_A0108CE261D6CD70D350F5B72F2E9874AE6E004D3029015B0919B1BD326BB649",
        "OnDemandClsid",
        "IdleDuration",
        "IEEE 802.3 1BASE5",
        "PLATFORM_TRACE_RESERVED_1a",
        "IL_675C8C02435D74D2BF9FB2F1ACC8A427A072276AD5C19F68D5A3EC506D13F5D8.118.2343476280.299",
        "The DeviceID property contains a string uniquely identifying the serial port with other devices on the system.",
        "PAL D",
        "rCFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C",
        "C_2C912D30C6F2C9872585F2917A9F51466121BD73DCC0AA6A9A6D8C6362427472",
        "CIM_Configuration",
        "Represents an auth proposal.  Instances of this class only exist as embedded instances within a MSFT_NetIKEP1AuthSet and MSFT_NetIKEP2AuthSet.",
        "InstallDate records when the SA (and its endpoint) was created.",
        "This device is disabled because the firmware of the device did not give it the required resources.",
        "Critical Section Initialize",
        "NOTE: User has a roaming profile configured does not mean that this profile is indeed roaming.",
        "IL_F41AAB3CE0418D59CCEE78DC6089E8A71443DF08351201B015241ECCC0AF9C70.1617.460483849.315",
        "AMD Athlon(TM) Processor Family",
        "This class is used to report USO capabilities on a network adapter.",
        "67 - An error occurred while processing an Instance that was returned",
        "GetIcon",
        "{D905AC1D-65E7-4242-99EA-FE66A8355DF8}",
        "LUAInstall: error 0x00000005 setting flags [{93F551D6-2F9E-301B-BE63-85AEF508CAE0}]",
        "DaylightHour",
        "Maximum sectors per read (depends on both adapter and drive).",
        "6311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        "object:RSOP_ScriptCmd",
        "60012",
        "RegisterByXml",
        " The SoftwareElementID is an identifier for this software element.",
        "{8502C58E-5FBB-11D2-AAC1-006008C78BC7}",
        "Printer's vertical resolution in pixels per inch.",
        "{2306fe37-dbf6-11d2-9244-006008269001}",
        "Settings on how a user is managed on the computer",
        "The CIM_ReplacementSet class aggregates physical elements that must be 'replaced' or 'FRUed' together. For example, when replacing a memory card, the component memory chips could be removed and replaced as well. Or, a set of memory chips may be specified to be replaced or upgraded together using this association.",
        "IPv4Options",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_81E1B447115AA495169E968D729B808E6AFAAA8904F1D6ECCF6F17BC5CB9988C",
        "Computer system management.",
        "C_9E80816304B77C3F7FB69E6FA27E369EEAF4355C2560E5D96A7A1A687778DD04",
        "PLATFORM_TRACE_TRACING Flag",
        "EnableLeasing",
        "CR_337863EF99B561BCCD899B7AFA2247DE6CE14F0D81601137B3F7CD2CFAE44723",
        "Bytes read using hardware Epp mode",
        "{26c28774-4252-48fe-a610-a58a398c0eb1}",
        "C_A58578087E737BC8DD57D102F9138F5ADF8AA5D8A71EB3BDCC001417DBE8780F",
        "HttpGetUrl",
        "The thumbprint to accept.",
        "The number of cells the NIC has transmitted without errors.",
        "HardwareRevision",
        "In-Context",
        "TM_NLAWPLG Flag",
        "PS_VpnServerAddress",
        "The WindowsDirectory property indicates the Windows directory of the operating system./nExample: C:\\WINDOWS",
        "IsReadOnly",
        "SignatureDefinitionUpdateFileSharesSources",
        "Win32API|Communication Structures|DCB|fInX",
        "\\\\.\\ROOT\\CIMV2:__Win32Provider.Name=\"Win32_OfflineFilesConfigurationProvider\"",
        "FX_TRACE_IOTARGET Flag",
        "iScsi Redirect Portal Information Class",
        "MSKernelPpmClass",
        "FltIoInit",
        "TRACINGPNP",
        "RemoteSecondId",
        "User-friendly name",
        "C_AB754770CC19ECF1708863E61B4513A3C8CECABE89D78E5D727A64FE3F1CF111",
        "Example: \"1&08\"",
        "LoginAuthFail",
        "n64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41",
        "The minimum network latency, in milliseconds, before the SMB client will use BranchCache",
        "Degraded",
        "Warnings",
        "CD_9D89FA2B309F38D240606161FF6D4D1DD686574B6527CC994C80F23BE2267FCF.2111.167449512.5076",
        "Win32_CacheMemory",
        "Adds a new connection to a shared print queue.",
        "Log File",
        "CD_0FD1FAA819681F2EC44E2931633C629893BC924C7278A0294B94667101A7CC55.2371.72617338.955",
        "The active or negotiated maximum transmission unit (MTU) that can be supported.",
        "Defines the encapsulation types the Adapter can support for LSO.",
        "IsPhysicalPresenceHardwareEnabled",
        "This class provides ability to manage wireless profiles through WLAN xml",
        "MCA_ERROR_TLB",
        "The number of IPSEC key operations in progress",
        "This class describes a QoS classification element.",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2020.336309311.180",
        "11014",
        "Win32_Tpm",
        "CR_962C6E7C58B97BBA37F5179D96ED3E00EE4A4FC20E4C3C3A3312674F9F7C4195",
        "Sync pulse should only appear on the green video signal line",
        "Win32API|Performance Data",
        "The EndingAddress property specifies the ending address referenced by an application or operating system. This memory address is mapped by a memory controller for this memory object.",
        "Number of SCSI retries that have occurred since last hard or soft reset related to the controlled Device. The time of last reset is indicated in the TimeOfDeviceReset property, inherited from the ControlledBy association.",
        "WSP_VirtualDiskToReplicaPeer",
        "The address of the initiator to which the virtual disk should be hidden",
        "D!m;D!m;",
        "The FileID of the Win32_FileSpecification this patch applies to.",
        "Security Flags",
        "The Msft_WmiProvider_ComServerLoadOperationEvent event class defines the successful activation of a com server instanceassociated with the provider registration.",
        "RetransmissionTimeout",
        "RAS Entry Data",
        "This parameter is used to specify the list of drives that should be excluded from autochk at next reboot. The string syntax consists of the the drive letter followed by a colon for the logical disk.",
        "Example: 64000",
        "Dll Load directory path",
        "PortIndex",
        "This method allows for the deletion of a replication relationship between groups. The groups themselves will be deleted if they have no more relationships with other groups; however this does not apply for SMI-S, the group may still exist. ",
        "DBCS string format",
        "MaxNumSwitches",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|MTU",
        "AllowInboundMaskRequest",
        "AntiStarvationBoost",
        "Bid2Etw_ODBCBCP_1",
        "The Organization property indicates the registered user's (of the operating system) company name.",
        "MsftDiscFormat2MsfAddress",
        "Flag to indicate whether this GPO is enabled",
        "A free form string indicating the algorithm or tool used to compress the file system. If it is not possible or not desired to describe the compression scheme (perhaps because it is not known), recommend using the following words: \"Unknown\" to represent that it is not known whether the file system is compressed or not, \"Compressed\" to represent that the file system is compressed but either its compression scheme is not known or not disclosed, and \"Not Compressed\" to represent that the file system is not compressed.",
        "\"Degraded/Warning\" (10) - The element is in working order and all functionality is provided. However, the element is not working to the best of its abilities. For example, the element may not be operating at optimal performance or it may be reporting recoverable errors. ",
        "CD_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170.1.2190771445.725",
        "MSNdis_StatusDot11PmkidCandidateList",
        "The status of the BranchCache Peer Discovery Firewall Rules",
        "Reboot was requested for resource.",
        "NumOfMonitorFreqRanges",
        "OtherTypeDescription",
        "C_8950872A12F7D2C94B8C7D080DB29BDCF4FDD3AE62780BA9D92B3DD00B3F7D6D",
        "Instances containing the health reports on the specified target object.",
        "0xEFFF0008",
        "NumberOfLogicalProcessors",
        "CR_A57480D0D82DDE51E01CC9C7625981822E2D1C37B70F78DC6E6179505A7BD928",
        "No Error",
        "Authentication Succeeded",
        "The BaseIOAddress is the base IO address for the serial port",
        "TEST_TRACE_APP Flag",
        "{5CC70817-DB31-11d2-85FC-0000F8102E5F}",
        "SamEnumGrpsInDom",
        "IL_DE17C9D5088F4B642733CF8AEA90F5A7AFA5A9B0892FB2650254AF86F16B343D.2451.1722177901.342",
        "Raw802.3",
        "The queue identifier",
        "TotalTime",
        "MSFT_NetAdapterPowerManagement_WakePattern defines a Wake-on-LAN (WOL) pattern.",
        "InsertionStrings",
        "VendorSpecific2",
        "Quiesce (9) indicates that the element is enabled but in a restricted mode.",
        "{2306fe35-dbf6-11d2-9244-006008269001}",
        "favoriteItem",
        "Minimum package version for the dependent framework",
        "TSRdpEndPointTrace",
        "This device cannot find enough free resources that it can use.",
        "ErrorSourceFormat should be the CIM Object Path.",
        "Pauses a print job in a print queue.",
        "Microsoft iSCSI Initiator: Device attached to a session",
        "MSFT_NCSIPolicyConfiguration",
        "NdBoundary",
        "CreatedFileShare",
        "Specifies the property to set.",
        "  <dependency discoverable=\"no\" resourceType=\"Resources\">",
        "This device is not configured correctly.",
        "The BootDirectory property indicates the path to the system files required for booting the system. ",
        "CD_F542449B0CBD50CC1A71BFA6B7B20474C5DA76B95F621A678DD36C9156526568.1544.3398123194.751",
        "MCA_ERROR_UNKNOWN",
        "DEV_CONFIG",
        "// This class defines the parameters used to set up DH-CHAP.",
        "Event Trace Event",
        "The BootOptionOnWatchDog Property indicates the type of re-boot action to be taken after the time on the watchdog timer has elapsed.",
        "This method returns the minimum and maximum sizes that the partition can be resized to using the Resize method. The minimum size is determined by the disk defragmenter and takes into account the location of immovable files. The maximum size is determined by adding the size of any free extents immediately after the current partition.",
        "CaptureType",
        "Shadow copy management.",
        "Ignore any detached virtual disks with allocations on this physical disk.",
        "ConfigureHomeGroupListenerServiceStartupMode",
        "InternetZoneEnableMIMESniffing",
        "0xD018..",
        "The DeviceID property is the DeviceID of the device e.g. ROOT\\FTDISK\\0000 ",
        "This parameter is the volume to be used to store the shadow differential area.  If this paramter is not supplied the specified Volume will be used to store the differential area.  This parameter can be specified as a volume drive letter, mount point or volume GUID name.",
        "CD_C494166FEC78B76B06AE6864E10BB6C47EF436F2498312A79210EB6DD47C6CAE.1742.1.10471",
        "11003",
        "Bid2Etw_BCP_1_Trace_TextA",
        "Specifies when a new service object is created.",
        "The Set method creates or modifies the VPN connection profile  as specified by the method parameter Profile. ",
        "ThreadMigration",
        "KeyAdditions",
        "Enable this rule.",
        "This device is asking for an unknown resource type.",
        " session.",
        "17 - CIM_ERR_METHOD_NOT_FOUND. The specified extrinsic Method does not exist. ",
        "UowCount",
        "importContentRatingsSettings",
        "CD_99526796DD78031C7C2FAD6BF8D8F64825A2F3F58DED87A8E35BA27BB08D1659.1226.3167956345.326",
        "ServiceState",
        "CD_DDCE0EEC8025DB3F389EB360CE7C50BBC0E131D334E8FAB08585F4C0CA2A98A2.1748.2544688577.475",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|ErrorControl_On",
        "NS_B9F15E9C0955B84B8B7E840A878C292A9483B55C2BC37006562DC762D466102F\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_53A1DC0DDA2E39C523B626FE8ECD05C37BEC420D592C1BC708D9489C28C35DE9",
        "Metric1",
        "MGR_TRACE_RESERVED_06",
        "MCA_BUS_TIMEOUT_ERROR",
        "Severe errors",
        "{26d8b8f6-db82-49eb-8bf3-4c130ef06950}",
        "5 - 'Broken': The relationship is non-functional due to errors in the source, the target, the path between the two or space constraints. ",
        "Logons",
        "RscHardwareCapabilities",
        "ErrorReplaceCharacter",
        "Slot 1",
        "Retired",
        "LetAppsRunInBackground_ForceDenyTheseApps",
        "I_30485B836AA5A6FD10A8644930D90B38AA35B211E21BF4839647DE43EFA8F751.1355.1159673590.275",
        "FieldParametersArrayOffset",
        "Contact List Program",
        "SetProxyBehaviorForUpdateDetection",
        "The FileName property indicates the filename of the loaded module.",
        "Number Of Drives",
        "LUAInstall: error 0x00000005 setting flags [{934A9523-A3CA-4BC5-ADA0-D6D95D979421}]",
        "SupportsFragmentation",
        "Ndis802_11PrivFilter8021xWEP",
        "Last quick scan age in days",
        "UnblockAccess",
        "This relationship associates Configuration objects with Setting objects. For example, a NetworkAdapter's Settings could change based on the site/network to which its hosting ComputerSystem is attached. In this case, the ComputerSystem would have two different Configuration objects, corresponding to the differences in network configuration for the two network segments. Configuration A would aggregate a Setting object for the NetworkAdapter when operating on segment \"ANet\", whereas Configuration B would aggregate a different NetworkAdapter Setting object, specific to segment \"BNet\". Note that many Settings of the computer are independent of the network Configuration. For example, both Configurations A and B would aggregate the same Setting object for the ComputerSystem's MonitorResolution.",
        "FX_TRACE_PNP",
        "Indicates the urgency or importance of execution of the Job. The lower the number, the higher the priority. Note that this property is also present in the JobProcessingStatistics class. This class is necessary to capture the setting information that would influence the results of a job.",
        "CR_25951CCF498736F09F8CDC3085BB276C2817DE47EF5312A0F051C1AC3B67B2CE",
        "{C744CF5A-DB33-11d2-85FC-0000F8102E5F}",
        "MSFT_WmiFilterDeactivated",
        "ISR-PASS",
        "13 - Server Trust Account -  A computer account for a backup domain controller that is a member of this domain.",
        "RemoveByAllParameterSet",
        "HRRangeCount",
        "MSFT_PartitionToVolume",
        "ROOT\\wmi\\ms_409",
        "LookupIsolatedNameInTrustedDomains",
        "RESOLVE",
        "IPSrcPortStartMatchCondition",
        "AllowIntranetZoneTemplate",
        "BootVolume",
        "RSOP_IEAKPolicySetting",
        "Invalid Message Received",
        "SamCloseHandle_End",
        "WSP_ReplicationGroupToReplicaPeer",
        "If true, the user is prompted to specify whether his or her profile should be downloaded even when the network connection is slow.",
        "PCI Express endpoint",
        "MDM_Policy_Result01_WirelessDisplay02",
        "2 = default (system) ",
        "The StatusMask property specifies a bitmap of the possible statuses relating to this print job.",
        "Last full scan age in days- if signatures have never been updated you will see an age of 65535 days",
        "LocalFirewallRulesDisallowed",
        "The SetExpandedStringValue method sets the data value for a named value whose data type is REG_EXPAND_SZ. The SetExpandedStringValue method returns a uint32 which is 0 if successful or some other value if any other error occurred.",
        "Delta-Update",
        "Enable BidTrace for all applications.",
        "Planned Failover operation requires split state",
        "Win32_TSRemoteDesktop",
        "TargetNamespace",
        "AllowSaveAsOfOfficeFiles",
        "CD_BB643341D226A49E491A828FD60D1BF2BD90CDEABA005283886D93DE233001D8.2055.3137936088.1589",
        "{DC7E5E90-DB33-11d2-85FC-0000F8102E5F}",
        "LastSyncTime",
        "CD_A0C4181E36B5BF6BE271221B7FC9D6F392B6369BD0BAB6A546F2790003BEF7B3.1501.2941965304.1520",
        "TotalLatency",
        "Filename of a script file to be run, note that this is intended as an alternative to specifying the text of the script in ScriptText.  Results are undefined if both properties are assigned values.",
        "CD_9CD08C33F827418E52A142082B3E53DC14490B507641080CA3D5F25B878664A3.1248.2138283909.1021",
        "Specifies the number of complete data copies to maintain for this storage tier. If specified, this value will override the NumberOfDataCopiesDefault value that would have been inherited from the resiliency setting specified by ResiliencySettingName.",
        "Localized version of RSOP_PolmkrPrinterSetting for American English",
        "IL_84F7DA8FDA90FAE6187111C2192FDA36DDBDE6FDE609673EA728B3013AF37B7B.650.1.36555",
        "The Win32_PnPEntity class represents the properties of a Plug and Play device. Plug and Play entities are shown as entries in the Device Manager located in the Control Panel.",
        "Array of Client side extension Ids.",
        "SppWriteCount",
        "Not supported",
        "iSCSI Session Statistics",
        "The HostType requested is not supported.",
        "MSNdis_StatusMediaConnect",
        "// since it allows centralized management of CHAP credentials.",
        "SidTypeWellKnownGroup - Indicates a SID for a well-known group.",
        "ACPI version of idle states in use",
        "Application domain information",
        "CIM_HostedBootService defines the hosting system for a boot service. Since this relationship is subclassed from CIM_HostedService, it inherits the scoping/naming scheme defined for service - where a service is weak to its hosting system.",
        "NS_2B689AF3F38A341BB9044301A8A9039A9FAB11D0506D58B53A8B271288AD4404",
        "LsoV2IPv4",
        "SecurityDebug Flag",
        "MinVSyncDenominator",
        "KCBDelete",
        "The MatchAllKeyword mask specified for the event capture.",
        "internaldevicecontrol",
        "\\\\.\\Root\\Policy:__Win32Provider.Name=\"PolicStatus\"",
        "68040",
        "The association between a shadow copy and the provider that created the shadow copy",
        "The start of the local port number.",
        "TP_V2_PoolCreateClose",
        "MaxRechargeTime",
        "CD_8BC061EB0082E96D5DC5828FD96C3FC2A01095E7E42C720BCD36F363CA556A85.1136.2199924786.217",
        "CacheSpeed",
        "LocationInformationLen",
        "CD_A05B58817295181CBA7B676653ED97C1E23D591F86C20D99BF4C67B62E0E211D.2114.3381669943.532",
        "SERIAL_WMI_PARITY_MARK",
        "ComPlusAppId",
        "Process Performance Counters",
        "NTStatus",
        "Short Name",
        "NetLuidIndex",
        "The value for ParityLayout is outside of the supported range of values.",
        "Padding2",
        "Hosting Model, provides compatibility with Windows XP and Windows Server .NET. Do not override.",
        "Sync on green video is supported",
        "An array of strings that represent the various network addresses for the target port. The type and format of these addresses depend on the PortType.",
        "RequirePlatformSecurityFeatures",
        "{91384181-aaf9-44d2-9c19-8b73f177dc0a}",
        "TEST_TRACE_RESERVED_04",
        "Register",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_flags",
        "A generic association to establish dependency relationships between objects.",
        "Name of the source Replication Group to be created.",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.1500.17407651.442",
        "CD_3FDA482EEA11D105F777BB4C0E86194FDFA63901845D94A245BC2172A88E5638.2229.71780315.2531",
        "SAM Set Information Domain",
        "object:MSNdis_ReceiveQueueParameters",
        "C_57AD49AAA93A9DB4C747A5522BD17E886017CE9B2B40450392A8012CE5FE8334",
        "PCI Bus Responder ID at the time of the event",
        "Rtp is enabled",
        "Checks to see if current CIPolicy matches policy given by FilePath",
        "SignatureAuGracePeriod",
        "NDIS Ethernet Receive Error Alignment",
        "{8502C53D-5FBB-11D2-AAC1-006008C78BC7}",
        "Photographic Microfiche",
        "DaylightBias",
        "Maximum baud rate in bits per second supported by the SerialController.",
        "The Dependent reference indicates the logical memory array implemented by the physical memory array.",
        "WHERE DeviceID=#",
        "XonXmitThreshold",
        "TCP/IP Telnet protocol",
        "Invalid Parameter",
        "C_01485C56AD31BD1C7B9875265E909545C1FD016E19345A12E2E00973CE0EF1CF",
        "CIM_PhysicalLink",
        "ContextExchangeMechanism",
        "0xD00F - 'Full Repair Needed': In Windows-based storage subsystems, this indicates full repair is needed.",
        "Specifies how many physical disk failures the storage tier should be able to withstand before data loss occurs.",
        "Fabric Port",
        "The volume still has access path to it.",
        "Cleaning Action - Enumeration",
        "LinkPath",
        "object:MSFT_NetAdapterChecksumOffloadSettingData",
        "The type of physical memory.",
        "CD_0FB0A8E86C1430EE0BB7D412F66362E6E788646DB733ACDB85AE2E440B7F37A4.1171.219885359.269",
        "Sub Notebook",
        "MSFT_WmiSelfEvent",
        "IcmpTypesAndCodes",
        "HKEY_DYN_DATA (0x80000006) ",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|Low Threshold On Events",
        "Field to display whether the resource changed its state.",
        "The registry value name.     If the Value column is null, then the following strings in the Name column have special significance.    +  The key is to be created, if absent upon the installation of the component.    -  The key is to be deleted, if present, with all its values and subkeys upon the uninstallation of the component.     *  The key is to be created, if absent upon the installation of the component AND the key is to be deleted, if present, with all its values and subkeys upon the uninstallation of the component.",
        "dataSession",
        "Localized version of RSOP_PolmkrDriveSetting for American English",
        "CD-DA",
        "MSiSCSIInitiator_PersistentDevices",
        "Loss of Redundancy",
        "Win32API|Tape Backup Structures|TAPE_GET_DRIVE_PARAMETERS|ReportSetmarks",
        "KEY_NOTIFY (0X0010) ",
        "MSNdis_StatusDot11Disassociation",
        "DhcpEnabled",
        "MIF.DMTF|Power Supply|002.17",
        "Memory Error Status",
        "MGR_TRACE_RESERVED_11",
        "MajorFunction",
        "CIM_RecordForLog.RecordData",
        "Specifies the protocol used in the ProtocolSpecificValue field.",
        "MSNdis_80211_RemoveWEP",
        "MCA_WARNING_PCI_BUS_PARITY",
        "PMWiFiRekeyOffload",
        "The value of the property.",
        "CD_73FDCA103A6930FD52B50CB857297C58B950838604AAF9FA2A8A8AC7D06D4361.1213.1.10004",
        "The Dependent reference represents the Win32_BaseService containing the properties of the base service that is dependent upon the load order group in order to start running.",
        "Volume is too small",
        "Process counters",
        "RSOP_IEEE8023GroupPolicySetting",
        "Subscribe",
        "This method returns the supported sizes for a new storage tier. These sizes can either be returned in an array of all supported sizes, through a min, max, and divisor, or both.",
        "Identifies the major release of the embedded controller firmware.",
        "MSFT_NetInterfaceFilter",
        "CD_31380B1CBE2DE48F4953061E943634793359C618E73F753682430004D4E36FB0.1671.453072388.359",
        "I_FDC07BF412EF517BF16CBEA0AD032C8FE94CB2DD73B9CD909C08659DB8C5BC0A.1356.1547423517.325",
        "VxlanEncapsulatedPacketTaskOffloadEnabled",
        "ModifiedData",
        "MaxOperatingBudget",
        "Connection ID string",
        "Execute",
        "Imported",
        "I_8E23EB78FFAC4A759215B5BD6EC35386D5DAFFB04E17A1E0F3F33C9BDCE81E56.1197.3581331220.259",
        "LsoEnabled",
        "Forget",
        "SetDateTime",
        "SDBUS_DEBUG_POWER Flag",
        "A9B6A38484A7C74F4BA213CAD47E8C",
        "The physical element's location.",
        "CD_B977125944CA8326977A414325742B1EF12C40157E5C5D20B7B02407CD6122F8.1610.704689201.300",
        "C_C85BEC05E1DE78CAC5454E6D33A2BAFD69D28B4057355776F41B00B3DF99855E",
        "The ArpAlwaysSourceRoute parameter specifies a value that indicates if TCP/IP transmits ARP queries. Setting this parameter to TRUE will force TCP/IP to transmit ARP queries with source routing enabled on Token Ring networks. By default, the stack transmits ARP queries without source routing first, then retries with source routing enabled if no reply is received.",
        "SQLOLEDB",
        "C_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC",
        "WindowsPrinterMapping",
        "NETBIOS",
        "Processor Performance States",
        "Constructor",
        "NextStep",
        "Constraints: Must have a value",
        "UserInterface",
        "MSNdis_80211_Configuration",
        "Scheme",
        "This subsystem does not support creation of virtual disks with the specified provisioning type.",
        "CD_23934BAB3D64E6FBBA2D103113B7071EEDD4C5897E664D2380D00F90496625D2.2615.3374453671.421",
        "SMBIOS|Type 3|Asset Tag",
        "QueueType",
        "LockedDownInternetZoneAllowUserDataPersistence",
        "Name of AO used for the last AD activation.",
        "GROUPING_GO Flag",
        "RdmaCapable",
        "MIF.DMTF|System Memory Settings|001.4",
        "CustomBindingElement",
        "ColumnIsolation",
        "Class defining the configuration download manager",
        "HOSTPROC_RESERVED_16 Flag",
        "Creation Time",
        "MGR_TRACE_MGR",
        "DeliverSynchronously",
        "C_C512ED5FC2F1197607B14D5DB5ACB87E40AB351866BBAFEF73C3BDEFEF11BE00",
        "The IP well-known port filter condition. This matches either the local port number or the remote port number of a supported IP connection. This type of filter is especially effective if the port number is a well-known number assigned by the IANA. If the value of this field is non-zero, then all the following fields are ignored: IPSrcPrefixMatchCondition, IPSrcPortStartMatchCondition, IPSrcPortEndMatchCondition, IPDstPrefixMatchCondition, IPDstPortMatchCondition, and IPDstPortEndMatchCondition.",
        "The Win32_DCOMApplication class represents the properties of a DCOM application.",
        "MSFT_NetAdapterPowerManagementElementSetting associates a network adapter with its MSFT_NetAdapterPowerManagementSettingData.",
        "Partition Count",
        "This is the channel created for WNS notifications for the MDM user on this device",
        "Win32_NamedJobObjectProcess",
        "The Recursive input parameter is a boolean that indicates whether the compression will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input parameter is ",
        "Requests that the state of the element be changed to the value specified in the RequestedState parameter. When the requested state change takes place, the EnabledState and RequestedState of the element will be the same. Invoking the RequestStateChange method multiple times could r",
        "This property is being deprecated in lieu of using the Resolution and Accuracy properties. ",
        "PreCall",
        "Minimum number of seconds that cached attributes are held after directory update.",
        "Fastest Available Processor Performance State",
        "Returns token-based activation challenge.",
        "RescanVirtualPort",
        "LoaderLockAcquire",
        "Array of names that failed name resolution",
        "MDM_Policy_Config01_Power02",
        "acquireforsectionsynchronization",
        "BatchEvaluate",
        "Security flags",
        "R_AC74BA8CCBB8B7653E84CC3AAB6F43C1B7147F57F54B0A2F4FF0A55FCB7892BB",
        "Total width, in bits, of the physical memory, including check or error correction bits. If there are no error correction bits, the value in this property should match that specified for the DataWidth property.",
        "PrinterObject",
        "Is Access Denied",
        "OuterModeAddress",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|TcpNumConnections",
        "MaxCallerData",
        "Unique identifier for the adapter. This idenitifer must be unique among all adapters. The same value for the identifier must be used for the same adapter in other classes that expose adapter information",
        "This property signifies the advertisement for the profile information. It is used by the advertising services of the WBEM infrastructure to determine what should be advertised, via what mechanisms. The property is an array so that the profile MAY be advertised using several mechanisms. Note: If this property is null/uninitialized, this is equivalent to specifying the value 2, \"Not Advertised\".",
        "PrepareVolume",
        "NDIS 802.11 Service Set Identifier string that identifies a set of interconnected basic service sets. This is a NULL terminated ANSI string up to 32 characters long.",
        "The ResumeService method attempts to place the service in the resumed state. It returns one of the following integer values:",
        "OutboundAddress",
        "58014",
        "SystemEnclosure",
        "The Dependent reference represents the user accounts that exists on the domain.",
        "GetSupportedFeatures",
        "RFSMon",
        "The SystemStartupOptions property array indicates the options for starting up the computer system./nConstraints: Must have a value./nNote:  The SE_SYSTEM_ENVIRONMENT_NAME privilege is required on IA64bit machines. This privilege is not required for 32bit systems.",
        "SetIPConnectionMetric",
        "RxEnabled",
        "The flags associated with this extent.",
        "CIM_NumericSensor.UpperThresholdCritical",
        "The HardwareVersion property indicates the hardware version number of the SCSI controller./nExample: 1.25",
        "FilteringFlags",
        "CALLS Flag",
        "MDM_Policy_Result01_Cryptography02",
        "CD_15A0574CC6A502D68CCFDC53B1AC5E00FF52C94DF0173E0C428828FB42537813.2118.2684230107.2076",
        "RequestIndex",
        "CD_664AF66B21C2039DE71ED4563B6D82F78FB404975A3235A5DEEC63FCFAD8513C.0.2996532711.140",
        "Performance Percentage",
        "If TRUE, this field instructs the storage provider (or subsystem) to automatically pick what it determines to be the best number of columns for this resiliency setting. If this field is TRUE, then the NumberOfColumnsDefault parameter must be NULL.",
        "LUAInstall: error 0x00000005 setting flags [{94d86820-3128-41cd-be63-5e7bbd96a958}]",
        "ref:CIM_SettingData",
        "RS-449",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\009|System Up Time",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_script_path",
        "Example: 67108864",
        "iScsiFlagWmi Flag",
        "CD_44B2B33F232E78585BC06F82C484DB1BDFCFCAAFCAC5D29C12B11CCF8EE5BA88.46.3477544344.357",
        "The Descriptions property values may contain human-readable descriptions of the object. In the case of an LDAP-derived instance, the description attribute may have multiple values that, therefore, cannot be placed in the inherited Description property.",
        "Maximum capacity of the media",
        "Limited",
        "PortWWN",
        "Serial Communications Information",
        "First Matching",
        "VideoProcessor",
        "MSFT_ResiliencySetting.NumberOfDataCopiesMax",
        "Large UCR Space",
        "NDIS Media Types Supported",
        "OEMVersion",
        "The EnableWINS method enables Windows Internet Naming Service (WINS) settings specific to TCP/IP, but independent of the network adapter. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "The transport credential type of the peer security element.",
        "{900ABE68-C4FC-11DA-82C4-000D5692A4BC}",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_53AF8608C104F86655F42A8871E5F73225A8D681F66B8151B7C200C46C518C50b952E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "HideSleep",
        "OS400",
        "CR_700A223C2BE9D4D6498C555306C3D6D2A20F7ED7C0635EDD45F157ECA54B627F",
        "Server For Small Business Edition",
        "The IRQLevel property indicates the level of the IRQ resource",
        "Usage",
        "NS_FAD236DC88D4A39D9B808B598227AC32F45800A0F09FB4E10AAE80BE63A63AD1\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258l.",
        "The Status property is a string indicating the current status of the object.",
        "SetFileSystemLabel",
        "Specifies the path where an output reference file should be generated",
        "ReadOperationCount",
        "I_102077698EA904DF5C8F0CFC70F0723E119E347A7F574EFEC1AF2933127E6253.2704.2839603618.287",
        "The package in the slot.",
        "The returned NFC data.",
        "Represent the Storage Health in the Subsystem.",
        "SupportedLogVolumeFeatures",
        "Whether interface identifiers are randomized.",
        "{C75258E9-BE79-4a48-A23D-EEB6F8FB940C}",
        "TRACINGFULL",
        "VendorIdentifier",
        "A CIM_Service is a Logical Element that contains the information necessary to represent and manage the functionality provided by a Device and/or SoftwareFeature. A Service is a general-purpose object to configure and manage the implementation of functionality.  It is not the functionality itself.",
        "Profile the template is associated with.",
        "The CurrentLanguage property shows the name of the current BIOS language.",
        "WPD Types Trace",
        "QueryForestTrustInfo_Start",
        "Transport",
        "MDM_Policy_Config01_Authentication02",
        "The StopBits specifies the number of stop bits to be used. StopBits separate each unit of data on an asynchronous serial connection. They are also sent continuously when no data is available for transmission.",
        "TS_TRACE_LEVEL_TEST",
        "{24722B89-DF97-4FF6-E395-DB533AC42A1E}",
        "IsOneWay",
        "Select * from Win32_SCSIController",
        "Specifies the IP Address of the LanAdapter.",
        "SW_SHOWMAXIMIZED",
        "Win32_OperatingSystemQFE",
        "PmcCounterProfile",
        "C_20B4E701C3271ED94785243972C16A9A8FA123A78EDAC768D9A7B370EC4A42D1",
        "{5A966D1C-6B48-11DA-8BDE-F66BAD1E3F3A}",
        "Immigrating",
        "ISDN S/T Interface",
        "AccessContext",
        "The Win32_USBHub class represents the management characterisitics of a USB Hub.",
        "Recovery Point Objective indicates the maximum interval in which data might be lost in seconds. For synchronous copy operations, RPO is 0. For asynchronous copy operations RPO represents the interval since the most recent transmission of data to the target element.",
        "Power Supply Conforms To Profile",
        "SessionBrokerDrainMode",
        "Microsoft-Windows-OfflineFiles-CscService",
        "NRI Signature age in days- if signatures have never been updated you will see an age of 65535 days",
        "The CIM_System object and its derivatives are top level objects of CIM. They provide the scope for numerous components. Having unique system keys is required. A heuristic can be defined in individual system subclasses to attempt to always generate the same system name key. The NameFormat property identifies how the system name was generated, using the subclass' heuristic.",
        "Current stop-clock throttle value",
        "CIM_DeviceServiceImplementation",
        "Link State of the adapter",
        "UMDF - Platform Library Trace",
        "Gas Plasma",
        "EstimatedRunTime is an estimate in minutes of the time to battery charge depletion under the present load conditions if the utility power is off, or lost and remains off, or a Laptop is disconnected from a power source.",
        "This method allows the user to update or set various attributes on the file server. Note that not all parameters must be specified, and only those given will be updated.",
        "Cooling Policy",
        "IntranetZoneAllowAutomaticPromptingForActiveXControls",
        "0xDO1C",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\nwlnkipx\\Parameters",
        "Second Transform type",
        "ProcessorAcpiXpss",
        "MIF.DMTF|Voltage Probe|001.16",
        "CD_FFF2AE454B5EBA423321420C962DDADA7E00808CE9D4E5B4FF81481A2E9CA1B6.37.1248595431.465",
        "{3CE7904F-459F-480d-9A3C-013EDE3BDDE8}",
        "ODBCBCP.1 formatted output (A)",
        "I_43B7B69F919BB681DCC1079E7BED6BA29BBE6F4DDA8822130874E698F9F22509.1105.2387327780.301",
        "IR_2E857E8085C23F260E4A5714870E085AF1A5EB43D390A00657752F8ABAC8FA75",
        "HasProvisioningCompleted",
        "Dont know",
        "Specifies which finishings and other capabilities of the Printer will be used by default. An entry in DefaultCapabilities should also be listed in the Capabilities array.",
        "WMP Network Sharing API",
        "Values: TRUE or FALSE. If TRUE, the automatic managed pagefile is enabled.",
        "Attempts to access a session directory server",
        "InterpretationOfTrue",
        "The Metric5 property contains an alternate routing metric for this route. The semantics of this metric are determined by the routing protocol specified in the route's ipRouteProto value. If this metric is not used, its value should be set to -1.",
        "CIM_Memory",
        "Initiator Instance Does Not Exist",
        "Last full scan source",
        "The storage optimizer could not continue because the file system's master file table is too fragmented.",
        "DeliveryOptimization",
        "CompletionQueueErrorPerformanceCounterMissing",
        "The InstanceID of the Phase2AuthenticationSet to use for Phase 2 auth.",
        "LongDisplayName",
        "Entering Suspend",
        "WARNING Flag",
        "FromValue",
        "ZV Port",
        "BcdDeviceQualifiedPartitionData",
        "iScsiFlagGeneral Flag",
        "Disable Automatic Updates",
        "Degraded/Warning",
        "The server context for this server.  This may be one of the following values: LocalServer, LocalServer32, InprocServer, InprocServer32",
        "FormattedVolume",
        "Health Actions currently being performed on the File Share.",
        "The desktop monitor.",
        "READ_LOG_SECTORS",
        "{8502C4E5-5FBB-11D2-AAC1-006008C78BC7}",
        "Changer Problem Type",
        "Adaptive TokenizedClone Remote",
        "Enterprise",
        "Win32_SystemSystemDriver",
        "nd provides path information for the grouped files.",
        "The SetKeepAliveTime method is used to set how often TCP attempts to verify that an idle connection is still available by sending a Keep Alive packet. If the remote system is still reachable and functioning, it will acknowledge the Keep Alive transmission. Keep Alive packets are not sent by default. This feature may be enabled in a connection by an application. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "The specified partition layout is invalid.",
        "object:MSNdis_StatisticsInfo",
        "Inherited from RSOP_PolmkrProSetting.",
        "Config Flag",
        "Copy from Internal to External IP Header",
        "GetDeviceProperties",
        "The Type property specifies the type of event.",
        "CD_4B66FACE2F9688020890084420324926AA3CF21932AD39E8C9ACEA5209F73583.43.3564511159.262",
        "Timeout value for ETW trace session to flush capture buffer.",
        "C_E8E72C534ABA427E69CE6B883E8FFA9701DE1CDD9E04D7D1815F4420292F16DC",
        "Sync on green video is NOT supported",
        "Example: Jane Doe",
        "Latched",
        "CollectionInCollection",
        "6-a7f7-c9ab3323ee51}]",
        "Query Hardware Offload Configuration",
        "The KeepAliveTime property indicates how often the TCP attempts to verify that an idle connection is still intact by sending a Keep Alive Packet. ",
        "SamNameById_Start",
        "KeyLocation",
        "LUNList",
        "MSFT_CliAlias.FriendlyName=\"Share\"",
        "CommandLine",
        "LogTypeDescLength",
        "Specifies a list of DNS suffixes",
        "DATABASE Flag",
        "{1008CCF1-7BFF-11D2-AAD2-006008C78BC7}",
        "QOSWMI_TRACE_POLICY",
        "CIM_ERR_PULL_CANNOT_BE_ABANDONED",
        "Specifies whether to send unknown serlialization data onto the wire.",
        "SamQueryInfoAlias_Start",
        "results",
        "NdisMaximumSendPackets",
        "JIS B8",
        "Representative",
        "The NRI Signature version (major, minor, build, revision)",
        "setea",
        "InboundFrames",
        "Windows Notification Facility Publish",
        "NS_1A8E82799C1533DB9FBAB0C0F04C00F4B58AD9F63A6874474DB57A9DDEF264A6",
        "POINTER_PORT_WMI_TABLET",
        "Used in CimInstance.ToString(). A short string for describing this instance when debugging.",
        "StandardDayOfWeek",
        "A conditional statement which evaluates to TRUE or FALSE to determine whether the Level value should be applied to the associated software feature.",
        "The ActivityQualifiers property is an array of string values used to further qualify and specify the privileges granted or denied. For example, it is used to specify a set of files for which 'Read'/'Write' access is permitted or denied. Or, it defines a class' methods that may be 'Executed'. Details on the semantics of the individual entries in ActivityQualifiers are provided by corresponding entries in the QualifierFormats array.",
        "ActivityId",
        "Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PrivatePageCount",
        "Incremental-Copy",
        "If true, indicates that the video BIOS is shadowed.",
        "Example: 255",
        "Product log directory",
        "R_B429BF87F7F0A497C5B7AE20F4439409307BAF462AA12B16BC819F2237482591.1350.1565589985.586",
        "Extended self-test routine recommended polling time (in minutes)",
        "The control sets whether the device should dynamically power on and off while the system is working.",
        "MDM_Policy_Config01_LocalPoliciesSecurityOptions02",
        "DiscoveredKeyManagementServiceMachineName",
        "{8502C547-5FBB-11D2-AAC1-006008C78BC7}",
        " output.",
        "PolicySourceConfiguredLicenseServers",
        "SMBIOS|Type 13|Installable Languages",
        "Cannot assign drive letter to this type of partition.",
        "EVENT_TRACE_FLAG_DPC",
        "The SetDeadGWDetect method is used to enable Dead Gateway detection. Setting this parameter to TRUE causes TCP to perform Dead Gateway Detection. With this feature enabled, TCP asks IP to change to a backup gateway if it retransmits a segment several times without receiving a response. The method returns an integer value that can be interpretted as follows: ",
        "AllowCellularData",
        "ref:CIM_Dependency",
        "IncludeTimestamp",
        "If this field is set to FALSE, the storage pool is a concrete pool. These pools are subject to all of the management operations defined on the storage pool class. This includes creation, deletion, creation of virtual disks, etc.",
        "iSCSI",
        "R_9C6234A862ECB7785AEE1C8C46C69B53F75E4A1B191D9AE24604A07719AA0D8E",
        "{8502C4C2-5FBB-11D2-AAC1-006008C78BC7}",
        "CD_829131EDC6839DA24011A54FBEA38B1D13A2BDFBD97A229CCB462F4A95FA5DB7.147.336365997.423",
        "The StopFileName output parameter is a string representing the name of the file/directory where UncompressEx failed. StopFileName will be null if the method succeeds.",
        "Digital Audio Filter Driver Performance Data (redbook)",
        "InstallationUI",
        "Communication OK",
        "LPC_TRACE_API",
        "Header for all MSMCA events",
        "Specify Attack Surface Reduction Rule(ASR) Ids. The rule Ids need to be in the same order as their respective actions specified in the AttackSurfaceReductionRules_Actions property.",
        "Commit Policy Settings",
        "The ratio of deduplication savings to the logical size of all of the files on the volume, expressed as a percentage.",
        "Stage",
        "Reinstall the drivers for this device.",
        "PrimaryStatus",
        "LSess",
        "This index is unique in the scope of interface type.",
        "#define HBA_EVENT_ADAPTER_CHANGE        0x103",
        "RestrictLocalStorage",
        "Indicates the accuracy of the sensor for the measured property. Its value is recorded as plus/minus hundredths of a percent.",
        "SupportedFilterTests",
        "ForceDismount",
        " The Phase property indicates whether the referenced check is an  in-state check or a next-state check.",
        "CR_A393FEDC8D8439E642FD70414F2815F8C5D6DC216A8FBF3F8BB710BDED38BED7",
        "The GuaranteesSequencing property indicates whether the protocol guarantees that data will arrive in the order in which it was sent. Note that this characteristic does not guarantee delivery of the data, only its order. /nValues: TRUE or FALSE. A value of TRUE indicates the order of data sent is guaranteed.",
        "ref:MSFT_ResiliencySetting",
        "The DefaultLimit property indicates the default limit set for quotas on this particular volume.",
        "The ProtectionLevel for the TCP stream.",
        "PNP_INSTALL_VERBOSE_LEVEL Flag",
        "MCA_WARNING_CACHE",
        "LineBasedInterruptSupported",
        "OneXSingleSignOnMaxDelay",
        "maxlen",
        "This method retrieves various messages returned by a job.",
        "Validate a settings location template.",
        "reserved",
        "C_E180FA56BE25537B4EDBF25A70C610DD0A17358432E8B0D7F517AF0A54245AFC",
        "Enables PacketDirect on the network adapter.",
        "R_44179BB601F070AC8C34C5B9994988FDFF5DD1A2C985178B6D48CCB665B74AD6",
        "WMI_STORAGE_FAILURE_PREDICT_THRESHOLDS_GUID",
        "C_B0796CE9F628CF73E17A3427BE2460F8DA001FAD27D1712ECBCBDAAC25C4954C",
        "LPC_TRACE_LPC",
        "RedirectSessionList",
        "MSFT_Net6to4Configuration",
        "MSNdis_TokenRingLastOpenStatus",
        "{63021F4B-F377-4a88-ABD1-835D14142142}",
        "{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}",
        "WMI_TAPE_SYMBOLIC_NAME_GUID",
        "NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM",
        "The computer name",
        "1..365",
        "C_E991E45745117956DEAFF1C67CF04DB972E8AC05E236ED8130C434E25D63E63D",
        "CD_353ED06D06D3F543C1F82745622C061EF12A64D07607F4A41BBE9C01357C9257.2750.3805583994.824",
        "curity",
        "ref:MSFT_NetFirewallProfile",
        "PSExtentInterleaveDepth",
        "iniString",
        "ThreadMaxSet",
        "ComputerConfigurationProvider",
        "Export_BCSecretKey",
        "MsftDiscFormat2StreamZero_DebugGeneral",
        "Denotes the current health status of the file server.",
        "FileTimeArray",
        "NdisEncapsulationNotNull",
        "PowerUtilizationMode",
        "SysClExit",
        "1000Base-LX",
        "Unpin",
        "The OSLanguage property indicates which language version of the operating system is installed.",
        "MaxQuiesceTime",
        "Number of T-state dependencies",
        "Pentium(R) III Xeon(TM)",
        "Hysteresis",
        "RSOP_PolmkrOpenWithSetting",
        "Number Of Slots",
        "Security level for the Restricted Sites security zone",
        "Security",
        "SMBIOS|Type 22|Maximum Error in Battery Data",
        "NumFilters",
        "Distinguished name for the server object for this directory server in the configuration container",
        "Is Nested",
        "Windows error message.",
        "Fracture In Progress",
        "NS_59411655A8F95EE7BEABDFB898861DFA8E2BF23293A8AFE96B2E5BB236E7FE01\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_7C20621C04548080C1EE521AE245952B5749C3FB727288FDD27EDA07E39B175A",
        "- 5=Object Reference. Example: If the authorization target is a CIM Service or Namespace, then the ActivityQualifiers entries can define a list of object references (as strings) that the authorized subject can access. ",
        "The process running in the context of the operating system",
        "MSFT_ExpressionValue_string",
        "CIM_CollectedCollections is an aggregation association representing that a CollectionOfMSEs may itself be contained in a CollectionOfMSEs.",
        "VersionNumberHi",
        "C_A53803A976BCA3FFB16063ACA85E663ADBA78B63EC0DAF8A23C68DAD672A3EF9",
        "C_5E33BA8BB8301B0D571DB35AB12D7C91B7A0EB2F54B87081058135E8F4EE33DF",
        "PolicyChange_AuditFilteringPlatformPolicyChange",
        "Last In First Out (LIFO)",
        "Unknown Failure",
        "ConfigureXboxLiveGameSaveServiceStartupMode",
        "The Dependent reference represents the CIM_LogicalDevice connected to the IDE controller.",
        "Enables or disables Loopback Adsress Virtualization based on whether 1 or 0 respectively. The call returns 0 for success and an error if the policy was set to Group policy.",
        "LDAP versions (specified by major version number) supported by this directory server",
        "C_C6E3EE8EF6D56B8775AB86145B48EEB7F23DE79E3696F196FBB9A7C5293D0CA2",
        "FX_TRACE_RESERVED_1e",
        "If the NRI Engine is enabled",
        "Plug and Play is supported",
        "ISCSI_RedirectSessionInfo",
        "The IPSecPermitUDPPorts property lists the ports that will be granted User Datagram Protocol (UDP) access permission. The list of protocols is defined using the EnableIPSec method. The list will either be empty or contain numeric values. A numeric value of zero indicates access permission is granted for all ports. An empty string indicates that no ports are granted access permission when IPFilterSecurityEnabled is TRUE.",
        "IE favorites and favorite folders, used for IEAK RSoP.",
        "A free-form string describing that this slot is physically unique and may hold special types of hardware. This property only has meaning when the corresponding boolean property, SpecialPurpose, is set to TRUE.",
        "D90D640EF18568976AC9246A93F3945F32BDDD813256745C7061.1616.1235232375.425",
        "CD_2DD5D2C8F7B69285DFBD211B8783B9D8D8AAF5A927EC709DE65B6AC4223EE339.1781.2689695414.443",
        "The EnableEvents property indicates whether the WMI event subsystem should be enabled.",
        "object:MSFT_NetAdapterChecksumOffloadEncapsulationTypes",
        "PortableDeviceTypes_Serialization",
        "Set Header/Data split Parameters",
        "Password Expired",
        "EnableNetbiosViaDhcp",
        "DialType",
        "Sound",
        "Contents of the RDP file corresponding to the Deployment Settings, if this is set the corresponding Redirection settings and other Deployment settings are ignored and this RDP file is used.",
        "ConfigureSMBV1ClientDriver",
        "The FullName property indicates the full name of the user belonging to the network login profile. ",
        "ref:CIM_VoltageSensor",
        "MSFT_CliAlias.FriendlyName=\"SoftwareElement\"",
        "Email",
        "The ScreenSaverActive property indicates whether the screen saver is active.",
        "CIM_NumericSensor.PrimaryStatus",
        "ToLine",
        "An array of processor affinity masks of MSI-X messages allocated by the network adapter driver.",
        "SeDebugPrivilege",
        "The mode of the capture - SaveToFile, RealtimeRPC, RealtimeLocal.",
        "Custom data that is specific to Download Manager.",
        "Paged Pool Usage Quota",
        "LetAppsAccessMotion_ForceAllowTheseApps",
        "SAM Process Mapped Attributes",
        "C_00637C6FCCC93CC75F9D988B459EA167A80BFD4782DA6DB5BC1F63F5A3F73F9B",
        "FX_TRACE_GENERAL Flag",
        "E36BCD72310DD490D1F6D9817675EE3291874",
        "PNP_INSTALL_TRACE_LEVEL",
        "PipeMgr_Reach",
        "MSNdis_WmiOutputInfo",
        "The ProcessId property contains the global process identifier that can be used to identify a process. The value is valid from the creation of the process until the process is terminated.",
        "DOT11_WME",
        "{1C385E29-A5B4-40F0-96CF-929FC00958B}",
        "The EventType property indicates the type of change in the system power state.",
        "MtpOp Flag",
        "Differential-Copy",
        "12 - Credentials Required",
        "InactivityScale",
        "Token name for the data source within its package to which this attribute applies.",
        "The operational details associated with this extent.",
        "OtherSpecificationType shall be a a free-form string providing a description of the specification type if 1, \"Other\" is specified for the SpecificationType.",
        "{8502C559-5FBB-11D2-AAC1-006008C78BC7}",
        "MSNdis_WmiIPSecOffloadV1_Supported",
        "SW_SHOWMINNOACTIVE",
        "0xEFFF005E",
        "IL_58385CE20F50E3CF60B5ED0C6A30FCCEC7D96510EE2507D6CDC84407FB8AEAA1.1475.661856827.233",
        "NS_390EB45D32F689282408ADA520CE6393A41EC4618EE204AA0FBC32CF2D7469E3\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_8ECEB18F5D5956ADBB92C60B6BBF657386F0BE596CEC9435AABD185EAE1B6B42ecb9",
        "MGR_TRACE_FUNCTION Flag",
        "#19{(",
        "    Name (string) Specifies the name of the VPN connection profile. ",
        "TimeReading",
        "iScsiFlagProtocolTMF Flag",
        "The repair failed",
        "Status of the virtual port",
        "CIM_VideoController.MaxRefreshRate",
        "The Win32_VideoConfiguration class represents a configuration of a video subsystem.  This class has been deprecated in favor of the properties contained in the Win32_VideoController, Win32_DesktopMonitor, and CIM_VideoControllerResolution classes",
        "AMServiceVersion",
        "The JoinDomainOrWorkgroup method joins computer systems to a domain or workgroup.  This method is only available on Windows 2000 platforms and beyond. The method can return the following values:",
        "DirectoriesToSyncAtLogonLogoff",
        "CIM_ActionSequence",
        "EVENT_TRACE_FLAG_Y",
        "FADT DUTY_WIDTH",
        "SamPwdPushPdc_End",
        "CD_1D169410B8B805F1ECD27322AB7A731FC553836A8F92AC0D372B6B972CA98337.2098.863020646.495",
        "SECHC_LOG_FLAG_MEMORY Flag",
        "LPC_TRACE_RESERVED_0a",
        "Product Must Not Be Installed",
        "40016",
        "Active Directory Domain Services: SAM",
        "MSNdis_NdisEnumerateVc",
        "Example: 1 for the United States)",
        "The TcpUseRFC1122UrgentPointer property indicates whether TCP uses the RFC 1122 specification or the mode used by Berkeley Software Design (BSD) derived systems, for urgent data. The two mechanisms interpret the urgent pointer differently and are not interoperable. Windows 2000 and Windows NT version 3.51 and higher defaults to BSD mode. If TRUE, urgent data is sent in RFC 1122 mode. Default: FALSE.",
        "DedupTracingEventClass_DedupTracingEventTypeClass",
        "CD_D6B832D04D0FAB582A050E5212201E6DF3C06194D4D96931CCBF8B3053F5A8AF.1662.1.25340",
        "The Port property specifies the DMA port used by the host bus adapter. ",
        "Thursday",
        "C_5D07EFD0154EDE42BE53FB8CF6E91224DB5D0700E20DD6C51DC04AF1C039C10A",
        "C_F2984F836656306DFA8E2AE41D08C60DF8CD88A0E6AEAAAF9B747A88F60C0C5B",
        "OP_PolmkrLocalUsersAndGroupsSetting",
        "NDIS Enumerate Adapter EX.",
        "ReachableTime",
        "DefaultRecoveryPointObjective",
        "ArchiveFileName",
        "MCA_ERROR_SMBIOS",
        "polmkrBaseInstanceXml",
        "WMI|Win32_Service",
        "User Sid",
        "The StartAddress property indicates the starting address of the thread. Because any application with appropriate access to the thread can change the thread's context, this value may only be an approximation of the thread's starting address.",
        " )m; )m;",
        "LockedDownRestrictedSitesZoneJavaPermissions",
        "RSC statistics",
        "CustomData",
        "{4731F89A-71CB-11d1-A52C-00A0C9062910}",
        "Class that represents a list of  scripts",
        "e5c3b2ae23}",
        "Index number of this portal group",
        "April",
        "RsopPlanningModeProvider",
        "IPv6SubMssFinalSegmentSupported",
        "{bd458e7d-c40a-4401-a179-11919cbcc5c6}",
        "object:MSNdis_PciDeviceProperty",
        "PFSInUse",
        "VssTracingEventClass_VssTracingEventTypeClass",
        "The PixelsPerXLogicalInch property indicates the resolution along the X axis (horizontal direction) of the monitor.",
        "The BiosCharacteristics property identifies the BIOS characteristics supported by the system as defined by the System Management BIOS Reference Specification",
        "**typedef** Type of iSCSI session",
        "IPv4TcpOptionsSupported",
        "E8E72C534ABA427E69CE6B883E8FFA9701DE1CDD9E04D7D1815F4420292F16DC",
        "Win32_TokenPrivileges",
        "HNet_ConnectionPortMapping2",
        "C_97BC75F32D55E19412F779268A66FCC6A5BD410C650CA3D0DF71CCC46B370F28",
        "Whether message-level and transport-level security are used by an endpoint configured with the binding.",
        "The Parameters array provides an array of objects that describe the parameters accepted by the verb.",
        "EnableNavigationButtons",
        "{A228E208-DB22-11d2-85FC-0000F8102E5F}",
        "The maximum temperature in Celsius at which the storage device is capable of normal operation.",
        "DisableEncryptionSupport",
        "LockedDownInternetZoneAllowAccessToDataSources",
        "DiskPartitions can be directly realized on a PhysicalMedia. This is used to model the creation of Partitions on a raw SCSI or IDE drive, using the fdisk (DOS and Unix) or pdisk (Unix) command. The StartingAddress of the DiskPartition on the PhysicalMedia is also specified as a property of this relationship. An alternative is that Partitions can be BasedOn StorageVolumes, such as a VolumeSet or a Volume exposed by a hardware RAID cabinet. The latter relationship is modeled using the DiskPartitionBasedOnVolume association.",
        "VolumeSets in SCC have additional status information beyond that captured in the Availability and StatusInfo properties, inherited from ManagedSystemElement. This additional information (for example, \"Protection Disabled\", value=9) is captured in the VolumeStatus property.",
        "{8502C53B-5FBB-11D2-AAC1-006008C78BC7}",
        "InterleaveDataDepth",
        "AGP2X",
        "DemandInstallable",
        "MsftDiscFormat2StreamRandom_DebugConstructor",
        "{791ad19f-e35c-11d0-9692-00c04fc3358c}",
        "CIM_ClassCreation",
        "Rate limit for inbound default-block exempted traffic.",
        "C_9F25211DB7D04527A2718EFAB934C1664FA38400093282D5A337A37681C23242",
        "Win32Registry|Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards|ProductName",
        "Name of the 6to4 relay.",
        "PeerInfoCount",
        "MCA_WARNING_UNKNOWN",
        "A string that describes the type of ProtocolEndpoint when the Type property of this class (or any of its subclasses) is set to 1 (Other). This property should be set to null when the Type property is any value other than 1.",
        "LoaderLockAttempt",
        "The leading connection in the session cannot be removed.",
        "SetByNetworkSettings",
        "ExtendedSessionTimeout",
        "The HorizontalResolution property indicates the print resolution along the X axis (width) of the print job. This value is only set when the PrintQuality property of this class is positive and is similar to the XResolution property.",
        "The enumeration for DebugMode.",
        "{592977c2-cfbe-462c-b5cf-1a7679fe1cba}",
        "Indicate whether Windows Powershell scripts in the GPO will run before or afterthe non-Windows Powershell scripts in the GPO",
        "NETIO_TRACE_FRAMING Flag",
        "The total number of KBytes that can be mapped into the OperatingSystem's paging files without causing any other pages to be swapped out. 0 indicates that there are no paging files.",
        "IL_7B1CEA145FD7FDDE85118A874F4CDC2DBDFFEFB5270CF85B4A7E073D01A42C9B.2461.3285604882.291",
        "ROOT\\Microsoft\\Windows\\Storage",
        "MIB.IETF|RFC1213-MIB.ifSpeed",
        "This method invokes the chkdsk operation on the volume. The method is applicable to only those volume instances that represent a physical disk in the machine. It is not applicable to mapped logical drives.",
        "The ErrorControlForced property contains the command string used to enable error correction control when establishing a connection. This increases the reliability of the connection.",
        "MbrType",
        "SessionPoolSnapDCStart",
        "User security identifier",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1606.690108275.180",
        "SystemConfig_V2_PnP",
        "NetworkAddresses",
        "QOSWMI_TRACE_CALL Flag",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.292.289543839.188",
        "WindowsVersion",
        "rasEntryDataSize",
        "SupportsTransactions",
        "HDSL-2",
        "Reference to the favorite item.",
        "TM_TRIEMAP",
        "Name of the VPN Connection profile.",
        "SMBIOS|Type 8|External Reference Designator",
        "Attaches a Storage Spaces based virtual disk to the system. This operation is similar to Show and Hide, however there is no need for target and initiator configuration since everything is done locally. Depending on the system's NewDiskPolicy (formerly SAN policy), a Storage Space may need to be Attached before it can be used.",
        "Started is a boolean indicating whether the service has been started (TRUE), or stopped (FALSE).",
        "//***************************************************************************",
        "Generic",
        "The SupportsDiskQuotas property indicates if the volume supports disk quotas.",
        "This class specifies any Data Sources (DSNs) that need to be registered as part of an installation.",
        "Note: the following methods are not supported asynchronously: ",
        "Always Viewable Sites",
        "<'m;<'m;",
        "%NonExistingService%",
        "NPIV_WWPN_INVALID_FORMAT",
        "R_8BA1D21E61960B29D0AFE87B07C528E316D314C9CDB4E6E4157971C5502F0ED5",
        "Starting port number between 1 and 65535.",
        "ExcessFolderFragments",
        "This error is of the type 'Software Error'.",
        "Reference to GPO associated with this link",
        "ServerWeightValue",
        "Within the scope of the instantiating Namespace, InstanceID opaquely and uniquely identifies an instance of this class. In order to ensure uniqueness within the NameSpace, the value of InstanceID SHOULD be constructed using the following 'preferred' algorithm: ",
        "MSADOX.1 formatted output (A)",
        "0x20c",
        "RefreshThresholdKbytesPercentage is the lifetime percentage of kilobytes processed, at which a new SA should be acquired. A random value may be added to the calculated threshold to reduce network thrashing.",
        "The CIM_Chip class represents any type of integrated circuit hardware, including ASICs, processors, memory chips, etc.",
        "SamOpenAlias_End",
        "titleBarCustomText",
        "events per second",
        "The Setting reference represents configuration settings associated with the COM class.",
        "SetPowerState",
        "WMI_STORAGE_SCSI_INFO_EXCEPTIONS_GUID",
        "Ndis802_11DS",
        "CD_23723A40115126D6A71E3769E290B77D9B1A77AD1C76D6761CA490DE9745C4D1.293.2840089987.718",
        "An entry on the object's DACL",
        "SamDelMemGrp_End",
        "Win32API|Communication Structures|COMMPROP|dwProvSubType",
        "{a852c2c8-1a4c-423b-8c2c-f30d82931a88}",
        "RSOP_IEConnectionDialUpCredentials",
        "    //full            - A valid iSCSI login response with the final bit set ",
        "MissingAcs",
        "2.19.0",
        "MSFT_WMI_GenericNonCOMEvent",
        "R_EB6AD886198E6F65EE0C752A5FF5E8A8CEAC439C9AF6E57BB6318A547969C13C",
        "{8502C4D2-5FBB-11D2-AAC1-006008C78BC7}",
        "Encapsulates configuration information for a printer.",
        "MDM_WindowsAdvancedThreatProtection_HealthState01",
        "The ServerName indicates the name of the server that the link references.",
        "SyncUnlistedWindows8Apps",
        "The certificate ID used to locate the certificate for secure connections.",
        "MDM_Firewall_PublicProfile02",
        "MSFT_DAClientExperienceConfiguration",
        "NewReno",
        "Minimum HSync denominator",
        "IL_59C0D279AC4D00AA33C5DAB5CDF28150F681AA6C3210CD3E34E5D560A87ADB96.311.1142537083.249",
        "PMKCacheTTL",
        "ParentID",
        "The Name property indicates the name of the user account on the domain specified by the Domain member of this class.",
        "CorporateResources",
        "0xD01A",
        "sint32",
        "ResourcesInDesiredState",
        "InboundTransactionsEnabled",
        "True if the WDAC BidTrace setting is defined.",
        "{25007F51-57C2-11d1-A528-00A0C9062910}",
        "MSWmi_MofData",
        "CD_88CE5A07CD2F69DBBB73BA9DE9D43614B1ABE5A1326A7EBD8D82AB018DF39B74.2616.3549370181.1622",
        "DESKTOP-HGH2VBT\\admin",
        "NA-10x14-Envelope",
        "The default port of the network adapter is not authenticated.",
        "MEM_BIT_POSITION is valid",
        "LimitNegotiation",
        "FaultingObjectUniqueId",
        "BytesPerCluster",
        "CIM_PowerAllocationSettingData.Limit",
        "CorrelatedIndications",
        "ExclusionRoute",
        "WaitTimeout",
        "The EnumKey method enumerates the subkeys for the given path. ",
        "Mode describes whether the target elements will be updated synchronously or asynchronously. If NULL, implementation decides the mode.",
        "Base IO Address",
        "{75BCF4F9-DB46-11D2-B4C8-80080C7B6371}",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pShareName",
        "Discovery Mechanism",
        "Creates a new TCP/IP printer port on a given server in TCP mode.",
        "MRClose performance counter missing",
        "RefreshTargetList",
        "{F2D96E32-2A34-475b-878D-B0AE7657519F}",
        "The HotFixID property specifies the unique identifier associated with a particular QFE.",
        "MsftDiscFormat2StreamZero",
        "PortableDeviceAPI_Resources",
        "CreatePageFile",
        "NS_892F8DB69C4EDFBC68165C91087B7A08323F6CE5B5EF342C0F93E02A0590BFC4\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_59BFAFEBF60E8B2104B07BA7FADAF4FCFEB18999FE92B11F1C00E938CB4B93A6d74457E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "Login Options",
        "C_39AC0100AEED67043710A65F5DEC2D0CE31D07895E6DF01491EEBF7E2088F387",
        "The Copy method copies the logical file or directory specified in the object path to the location specified by the input parameter. Copy returns an integer value of 0 if the file was successfully copied, and any other number to indicate an error. A copy is not supported if overwriting an existing logical file is required./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n",
        "NdisFddiStateTrace",
        "HOSTPROC_TRACE_DISPATCHER",
        "R_0C641AF43E24BC384C9291373FBBEE013FBB02E71DB5BE5F4A078ACA9D6EB46E",
        "If the application was installed via on-demand installation by a file extension, this is the file extension that caused that installation.",
        "Specifies the print job to be paused.",
        "ISCSI_SessionStaticInfo",
        "Logout Other Codes",
        "A short textual description.",
        "HIPPI Interface",
        "Precedence value in the policy table, used for sorting destination addresses.",
        "AcceleratorCapabilities",
        "IndexEx",
        "options2",
        "Case Preserved Names",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control|RegistrySizeLimit",
        "This method retrieved the Health Actions being perfomed on the File Share.",
        "The name property has been deprecated in favor of the corresponding property contained in the Win32_PageFileUsage and the Win32_PageFileSetting.",
        "Return the print jobs in a given print queue",
        "Connection Failed",
        "BcdDeviceFileData",
        "Query Receive Queue Parameters",
        "CR_9B85FF5CF1326F4370A0D245830AD60317CB312C53E60E05480454CFB6E5D2C1",
        "Win32API|AccessControl|Windows NT Privileges",
        "ReceiveHeapSize",
        "ref:Win32_Product",
        "This event reports whenever a guid is registered or unregistered",
        "setvolinfo",
        "Scanner device",
        "Authorized users for transport mode, specified as an SDDL string.",
        "PrimaryHandler",
        "LetAppsAccessRadios",
        "Ndis802_11PowerModeCAM",
        "AutoBoost Set Floor",
        "CR_B18E35596C7AC0C7A9B67022489D5864495B96E12E56FDACDF13C1E2D5D12666",
        "EnumerateValueKey",
        "R_8688B6B3A5AFA46698CC5C2A2A938F01175B6D9F4A0E5E74F0C3AA6D73897983",
        "wwntype",
        "WMI|Win32_ComputerSystem",
        "Win32_PCMCIAController",
        "{1362C2AC-DB34-11d2-85FC-0000F8102E5F}",
        "iScsi",
        "SetPolicyDrivenUpdateSourceForDriverUpdates",
        "The StopService method places the service in the stopped state. It returns an integer value of 0 if the service was successfully stopped, 1 if the request is not supported and any other number to indicate an error.",
        "Bid2Etw_MSADCE_1",
        "Capabilities and management of the serial port, logical device.",
        "Driver Complete Request",
        "MSFT_StorageSubSystemToDisk",
        "The maximum time for a lease operation to complete before timing out.",
        "The ModuleLoadTrace event class indicates a process has loaded a new module.",
        "A conditional statement which evaluates to TRUE or FALSE to determine whether the associated software element should is installed.",
        "The identifier by which the job object limit setting instance is known. ",
        "An enumeration that describes the battery's chemistry.",
        "CD_D63BC7563E6D81203297654B46F4C100817863DC21DB2D7C0F010EBB549665E0.1747.203272719.4290",
        "A free form string indicating the algorithm or tool used to encrypt the file system. If it is not possible or not desired to describe the encryption scheme (perhaps for security reasons), recommend using the following words: \"Unknown\" to represent that it is not known whether the file system is encrypted or not, \"Encrypted\" to represent that the file system is encrypted but either its encryption scheme is not known or not disclosed, and \"Not Encrypted\" to represent that the file system is not encrypted.",
        "MSDASQL_1 formatted output (W)",
        "MaxWaitOnEvents",
        "GetServerWeight",
        "The DriverPath property contains the path for this printer driver, (example: C:\\drivers\\pscript.dll).",
        "TurnOnCompatibilityHTTPListener",
        "Reference to the RSoP_PolicySettingStatus",
        "Active height (in pixels)",
        "Name of the iSCSI Target",
        "CD_38522FF056841CE5D155E4CC0CC353966200DA04021E80EE70B3AC6C9663D8EF.93.3732652140.556",
        "SetSpeed",
        "MSFT_StorageNodeToStorageEnclosure",
        "LastRunClustersTrimmed",
        "Exceeded the number of trace sessions that can enable the provider.",
        "PS_ScheduledTask",
        "- physical components such as chips and cards.",
        "CertName",
        "The semantics of Account overlap with that of the class, CIM_Identity. However, aspects of Account - such as its specific tie to a System - are valuable and have been widely implemented. For this reason, the Account and Identity classes are associated using a subclass of LogicalIdentity (AccountIdentity), instead of deprecating the Account class in the CIM Schema. When an Account has been authenticated, the corresponding Identity's TrustEstablished Boolean would be set to TRUE. Then, the Identity class can be used as defined for authorization purposes.",
        "SDBUS_DEBUG_PNP",
        "Describes the Home Directory for the machine.",
        "The Print Capabilities XML defining print capabilities for this device.",
        "RawOnly",
        "iSCSI Initiator Node Failure Event",
        "Win32_PnPDevicePropertyReal32",
        "Indicates whether this printer is currently shared.",
        "EnableNoInputNotify",
        "ATAPI SMART Data",
        "11 - CIM_ERR_ALREADY_EXISTS. Operation cannot be carried out because an object already exists. ",
        "Number of processors",
        "Int 9h, 8042 Keyboard services are supported",
        "PARALLEL_WMI_BYTES_TRANSFERRED_GUID",
        "HBA_EVENT_PORT_BROADCAST_D27_4",
        "Operation is not allowed on the last administrative account.",
        "PerfCtrRundown",
        "AssignDriveLetter",
        "The SetIPConnectionMetric method is used to set the routing metric associated with this IP bound adapter. The method returns 0 on success,  and any other number to indicate an error.Windows 2000 only.",
        "The LoggingLevel property indicates whether event logging is enabled and the verbosity level of logging used.",
        "The Description parameter passes an optional comment to describe the resource being shared.",
        "The disk has already been initialized.",
        "The MachineName property contains the name of the machine for which the event had occurred.",
        "This parameter specifies whether the L2TP IPSec Authentication method is Machine Certificate or Pre Shared Key.",
        "Cimwin32A",
        "ReadLogSectors",
        "Bid2Etw_MSDATL3_1_Trace_TextA",
        "MDM_Policy_Config01_Handwriting02",
        "CIM_NetworkPort",
        "CD_59BB151BFB7474042FE846D38FA0CC3A5BA58498F9DD04AAF5BDB993481B126E.1733.3151333082.618",
        "The allocate and free counts track the port sharing of the parallel port. If the allocate count equals the free count then the port is idle. If the allocate count is greater than the free count (free count + 1) then some other driver in the system has acquired exclusive access to that port. If the allocate count stays constant at freecount+1 for an arbitrarily long period of time, then some driver may have illegally locked the port preventing other drivers from accessing the port.",
        "MSI-X is enabled.",
        "The value for Interleave is outside of the supported range of values.",
        "PasswordChangeable",
        "270AA7CC321848B51530B7A77A9E39B5486B55CE0C09A2B597A1F1FCE1E6.1136.1574526417.5669",
        "ActualRspBufferSize",
        "{313e88dc-a4fd-11d8-b301-505054503030}",
        "ActiveHoursStart",
        "NdisFddiRingNonOperationalDup",
        "SERIAL_WMI_PARITY_ODD",
        "Toggle",
        "If a Device is (\"Enabled\")(value=3), it has been powered up, and is configured and operational. The Device may or may not be functionally active, depending on whether its Availability (or AdditionalAvailability) indicate that it is (\"Running/Full Power\")(value=3) or (\"Off lineDescription",
        "SAM Enumerate Users In Domain",
        "The card that is plugged into or otherwise mounted on another card.",
        "RoamingUserProfile",
        "NDIS Query Receive Filter Hardware Capabilities",
        "CD_9212E0D756DE59946D687462B752A6AF5A16EC3A329D47D13E039D19732A1344.2033.2838613873.240",
        "MSFT_EtwTraceSession",
        "Example: C:\\TEMP",
        "The LocalService property contains the name for the services provided by the DCOM application.",
        "TaskScheduler",
        "MSFT_OdbcDsn",
        "Win32_ODBCDriverAttribute",
        "Serration of the Vsync pulse is required when composite sync or sync-on-green video is used",
        "SerializableToXml",
        "MaxOutputDelay",
        " - DeleteGroup ",
        "This field reports the maximum number of complete copies of data that can be maintained by the storage pool.",
        "If this parameter is specified, the specified application will no longer be in debug mode. If not specified, the application will be prelaunched in debug mode.",
        "Onboarding",
        "Win32API|MEMORYSTATUS",
        "Array of V4 addresses",
        "PolicySourceMaxResolution",
        "The Name property contains the name of the adapter used in this configuration.  ",
        "This field indicates the logical sector size of the disk in bytes. For example: a 4K native disk will report 4096, while a 512 emulated disk will report 512.",
        "C_ED34D9141DAAA89570F479B7904D4A54BEE568C398745E94687501AFF6347D73",
        "{8502C561-5FBB-11D2-AAC1-006008C78BC7}",
        "Win32_SystemTrace",
        "0xEFFF002C",
        "List of storage health settings.",
        "MSFT_TaskRepetitionPattern",
        "The NextHop property contains the IP address of the next hop of this persisted route. (In the case of a route bound to an interface that is realized via a broadcast media, the value of this field is the agent's IP address on that interface.).",
        "MSStorageDriver_ClassErrorLogEntry",
        "MSFT_NetBranchCacheDataCache",
        "Updates the internal cache of software objects (i.e. Disks, Partitions, Volumes). This is useful if there was extensive change to the storage layout exposed to that computer. ",
        "PerformRequiredConfigurationChecks",
        "Absent",
        "ISCSI_ERR_FIPS_NOT_AVAILABLE",
        "MSFT_NetAdapterSriovVfElementSetting",
        "This property corresponds to CIM_PhysicalFrame.Tag. See CIM_PhysicalFrame.Tag for details.",
        "The TempPageFile property specifies whether a temporary page file has been created, usually because there is no permanent page file on the current computer system.",
        "MSFT_NetAdapterPowerManagement_WakePattern_EapolRequestId",
        "DhChapAvailableOnPhysicalPort",
        "AttachedTo",
        "An array of values that denote the current operational status of the volume.",
        "{1008CCE6-7BFF-11D2-AAD2-006008C78BC7}",
        "MediaType",
        "Peak Virual Address Space Usage",
        "_ESS_",
        "Not Delegated",
        "NdisOperationalStatusStatusIndication",
        "LinkUsageBps",
        "GetAclNonAdmin",
        "CIM_Printer.Capabilities",
        "ShowInPortal",
        "Win32API|Printing and Print Spooler Structures|DeviceCapabilities|DC_PAPERNAMES",
        "MaxDadAttempts",
        "Represents the UDP connection class for Microsoft TCPIP WMIv2 provider.",
        "Virtual memory file swapping management. ",
        "Myrinet",
        "MSFT_NetSAActionInSARule",
        "This parameter specifies the list of virtual disks to show to the initiators in the masking set. The identifier used by this parameter is the virtual disk Name property. This parameter has a 1:1 mapping with the DeviceAccesses parameter (the arrays must be the same length and have the same order).",
        "Network path location to the Session Directory.",
        "Win32_PnPDevicePropertyUint8",
        "MCA_BUS_ERROR",
        "OutgoingPort",
        "Transport protocol being translated",
        "Configuration settings for NAT",
        "SmbInstance",
        "No protection",
        "Registry_HiveDirty",
        "SpindleSpeed",
        "object:MSFC_DH_Chap_Parameters",
        "VerticalBorder",
        "C_FF89590C844CBA58D43564BFAF3A9C1E0ACA3DFA20CB42FA7E832F2021AD16C0",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_06D6FB193493B2B3AB18566CA818BD25528D88E2A3D498D0E28DC2460169A56A13e071140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "The number of PDUs a NIC receives but does not indicate to the protocols due to errors.",
        "{e28ee0eb-6181-49df-b859-2f3fd289a2d1}",
        "TS_TRACE_LEVEL_ERROR Flag",
        "RecentlyCleanedDetections",
        "CIM_SoftwareFeatureServiceImplementation",
        "The credentials peer node uses to authenticate itself to other nodes in the mesh.",
        "object:Win32_OfflineFilesChangeInfo",
        "HeapSnapShot_V2",
        "AdjustReason",
        "pipelineExecutionName",
        "Win32_PnPDevicePropertySecurityDescriptorArray",
        "I_0F942249317BEBCCE2E53B2549FC597828D5AA6569444A28BADB2A9391E3E070.2677.143490917.275",
        "Association between StorageSubSystem and StoragePool",
        "bit    3:  0 = Normal Delay,      1 = Low Delay. ",
        "CIM_ReplicationServiceCapabilities.SupportedSynchronousActions",
        "doWipePersistProvisionedDataMethod",
        "ExitTime",
        "Software licensing server URL for Genuine Validation",
        "Win32_SerialPortConfiguration",
        "MsiXSupported",
        "DeviceManufacturer",
        "ReasonCode",
        "0xC0000028",
        "msieee8023PolicyReserved",
        "I_724155B2CA7FBBC304551F8A171392C3CA07A2D9AD12D47C6D2D987EFBFD727B.1163.872217503.187",
        "Reference to the proxy settings.",
        "The scoping System's CCN.",
        "{230e423d-7b3a-4e6e-9d4d-91f73561364a}",
        "C_A3CDC244A79A815521A8D6C0B832C3F9285789277B7E7D570DD27AC360EEA44B",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{GUID}[Default]",
        "UpperFiltersCount",
        "LIF Socket",
        "SOHO Server",
        "Specify the IP Address of the NetworkAdapter to set. If the IP is invalid or does not exist, the return value should indicate appropriately. The IP Address can be obtained by enumerating the properties of Win32_TSNetworkAdapterListSetting class.",
        "{aefe45f4-8548-42b4-b1c8-25673b07ad8b}",
        "CD_F87E378B75AF3F6BDC043610EC09B06E61B8E3291FCBCED338BE9D76C99D19BC.1598.2502865502.503",
        "A flag indicating that the evaluation of the Policy Conditions and execution of PolicyActions (if the Conditions evaluate to TRUE) is required. The evaluation of a PolicyRule MUST be attempted if the Mandatory property value is TRUE. If the Mandatory property is FALSE, then the evaluation of the Rule is \\'best effort\\' and MAY be ignored.",
        "MaskingClientSelectableDeviceNumbers",
        "Identifier for the third party application",
        "{DBD71B6B-F717-4a61-A914-2337BC50B0D6}",
        "In a Pool",
        "The service access point implemented using the logical device.",
        "Describes the Teredo service. One of the following values: disabled, client, enterpriseclient, natawareclient, server, default.",
        "AccountLogonLogoff_AuditSpecialLogon",
        "CoNDIS Transmit PDU Errors",
        "There is an interdependence between the OverWriteOutDated property (which is writable) value and the OverWritePolicy property (which is not writable) value.",
        "Log Off",
        "TypeOfRangeSwitching",
        "Msft_WmiProvider_CreateInstanceEnumAsyncEvent_Pre",
        "The Storage Tiers Management service detected that the specified volume is in the process of being dismounted.",
        "CD_3F47C7C5EDE1255249E372E90C4D8EAB77757D572A8E1F6E22B79B0FD3819343.1231.2086022349.597",
        "The IPConnectionMetric indicates the cost of using the configured routes for this IP bound adapter and is the weighted value for those routes in the IP routing table. ",
        "MemoryPerHost",
        "Enable DA manual site selection",
        "The integrity algorithm for the first operation",
        "DisableApp",
        "{492dc449-13d9-4bd6-89d4-96e3534e6a05}",
        "CD_E4FC7CCBE036059F139218E837508435F1EEA217B72843BBC84B1DD56DF78DB9.1135.2802911265.322",
        "A return code of 4096 (0x1000) shall indicate the state change was successfully initiated, a ConcreteJob has been created, and its reference returned in the output parameter Job. Any other return code indicates an error condition.",
        "ScreenSaverSecure",
        "userSid",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2136.1388182681.368",
        "CD_D7F3D9E12DEEE204449B9CAA8D3A0464D39F0FE9902E503068BD45CB162CC389.2214.1.12124",
        "CD_A09DF16E80CB8250C7E8F768EDC2F0DB283873E2BF1AF5FB3DCD5C1A024C9766.2119.24614279.1014",
        "UsbstorGuid",
        "The SetKeepAliveInterval method is used to set the interval separating Keep Alive Retransmissions until a response is received. Once a response is received, the delay until the next Keep Alive Transmission is again controlled by the value of KeepAliveTime. The connection will be terminated after the number of retransmissions specified by TcpMaxDataRetransmissions have gone unanswered. The method returns an integer value that can be interpretted as follows: ",
        "The Dependent reference is the session that the account is currently using.",
        "Authentication method to be used to connect to the wireless LAN.",
        "CD_639A48AE01E60F4C5372BCE94302125223C8DE05464D188B338C60C65E4A5441.1737.337666014.497",
        "ref:MSFT_FileServer",
        "PCI-E",
        "Error returned by the provider.",
        "kilobytes",
        "GetFcpTargetMapping",
        "CD_77DBF4A2C876542515BB91822C77D6AAB627C74A2589D8CBC4096845BC539307.1635.18204115.585",
        "{58E8F67D-29E9-456C-B23D-C6489E341BB0}",
        "BoostBitmap",
        "{8502C4B6-5FBB-11D2-AAC1-006008C78BC7}",
        "Whether to turn on receive side scaling. One of the following values:  - Disabled  - Enabled",
        "The MinimumWorkingSetSize property indicates the minimum working set size of the process. The working set of a process is the set of memory pages currently visible to the process in physical RAM. These pages are resident and available for an application to use without triggering a page fault./nExample: 20480.",
        "WmiMonitorRawEEdidV1Block",
        "The DeviceMap property has been deprecated.  There is no replacementvalue and this property is now considered obsolete.",
        "EnumTrustedDoms_Start",
        "MaxMonitors",
        "HeapAlloc",
        "BooleanArray",
        "MSSmBios_Sysid1394List",
        "object:OMI_ReportManager",
        "Example: 20  ",
        "VOLBITMAP Flag",
        "This association establishes a ServiceAccessPoint as a requestor of protocol services from a ProtocolEndpoint. Typically, this association runs between SAPs and endpoints on a single system. Because a ProtocolEndpoint is a kind of ServiceAccessPoint, this binding can be used to establish a layering of two protocols, with the upper layer represented by the Dependent and the lower layer represented by the Antecedent.",
        "SlotNumbers",
        "RssCapable",
        "QPOutgoingRead performance counter missing",
        "Offline",
        "\"Supporting Entity in Error\" indicates that this element might be \"OK\" but that another element, on which it is dependent, is in error. An example is a network service or endpoint that cannot function due to lower-layer networking problems.",
        "LoginAuthenticateFails",
        "IP DNS Address",
        "Add or Remove to group requires Suspended state",
        "PrintQuality",
        "CIM_PhysicalComputerSystemView.NumericSensorBaseUnits",
        "MsNetImPlatform",
        "Maxlen",
        "Is Default",
        "CATimeout",
        "computerSOM",
        "CIM_RelatedStatistics is an association that defines hierarchies and/or dependencies of related CIM_StatisticalInformation classes.",
        "Acct Delete",
        "object:MS_SMHBA_PORTLUN",
        "HRPid",
        "CIM_DeviceFile",
        "ThisPeriodTotalKernelTime",
        "NumberOfStopBits",
        "SignatureUpdateInterval",
        "HostPrintQueue",
        "The key to identify an authority by name",
        "AllowX86OnIA64",
        "LS_CONNECTABLE_NOT_IN_TSCGROUP",
        "CD_841D3DD3F3A7F09379A97AB7745347C579CB951819312FE93085B68F6AB63E24.282.123381841.888",
        "WDF_WorkItem",
        "RetryDelay",
        "Stack1",
        "CD_E78B24A63ACB40A253226DA76298C783683B9FFCFE28CF1078C510D46CEF2248.290.22917891.982",
        "C_E8CE06DB509B0590994561E0942576B49C1468E2ADAE12E9135A0B28175DA679",
        "NDIS 802.11 Received Signal Strength Indication event trigger. An event of class MSNdis_80211_ReceivedSignalStrengthEvent is generated when the current RSSI goes past the trigger value.",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_71D1BC07380B4FE4C5EDCC0F02E934EE8E495942B17AB007E3FEF57F0329043C",
        "CD_EAF3B59209A6FD8D082F3B655183ECFA165075910E5DEE9A2A2382671ABC6D42.1545.2675260131.666",
        "The PelsWidth property indicates the width of the displayable surface.  ",
        "C_D7A5A6FDE7193A09C153CBD1A0ED6D9E1BE99552FF2A49A452AEED9CDE64FAD5",
        "  </dependency>",
        "Specifies the name of the print processor used by the printer.",
        "MSFT_PipelineExecution",
        "13..32767",
        "<LocalID> is chosen by the business entity and SHOULD not be re-used to identify different underlying (real-world) elements. If the above \\'preferred\\' algorithm is not used, the defining entity MUST assure that the resultant InstanceID is not re-used across any InstanceIDs produced by this or other providers for this instance\\'s NameSpace. ",
        "32768",
        "HasConnectedAccount",
        "object:MSFT_Partition",
        "DataLength",
        "ComputerState",
        "The identifier by which the CIM_Setting object is known.",
        "{791ad1a7-e35c-11d0-9692-00c04fc3358c}",
        "Version of the security client",
        "SourceStoreFile",
        "HomeFolder",
        "ref:CIM_PolicySet",
        "The value for NumberOfColumns is outside of the supported range of values.",
        "58002",
        "3 - PowerPC ",
        "SharedKeyProtected",
        "CD_D03948432DCEFB99FB1EBE3230848319D45009B95943838EC079B34AD2F12F73.2136.645240087.883",
        "Parity Memory error",
        " One of the following service types must be specified in this column.",
        "Don't Expire Password",
        "TRACE_FLAG_GENERAL",
        "Slots are special types of connectors into which adapter cards are inserted. This relationship of a card in a slot is made explicit using the CIM_CardInSlot association.",
        "Maximum number of route cache entries.",
        "milliwatts",
        "CD_9D6DAF01BF9FEB3EF2C9DA9CCCD42495EF0FF0EB48CFEA8E496981FAD2449D94.1744.2477445674.3959",
        "TM_FUSER",
        "x25Address",
        "Deferred (8) indicates that the element may be completing commands, but will queue any new requests. ",
        "MSFT_ResiliencySetting.NumberOfGroupsMax",
        "Reliability related events. When available, these events are associated with the original records in the Win32_NTLogEvent class",
        "Win32API|Network Management Structures|AT_INFO|Flags|JOB_RUN_PERIODICALLY",
        "IssuingCALs",
        "TouchKeyboardHandwritingModeAvailability",
        "DeviceObject",
        "{68542fed-5c74-461e-8934-91c6f9c60960}",
        "EnrollMethod",
        "MiniQic",
        "LAP-F",
        "LocalService",
        "0xD022",
        "Association between MaskingSet and TargetPort",
        "The SCSI controller.",
        "The name of the switch",
        "{C0AA9D93-2EF5-47fb-960C-F90FC644B48E}",
        "Example: +Q6S36=3S48=128.",
        "CR_9A376F6E77D1E893429991208782EDA1E1B82E08D8048C53AFF147F9753BF1B3",
        "The Index property indicates the index number for this POTS modem.",
        "The storage pool could not complete the operation because the health or operational status of one or more virtual disks in it does not permit it.",
        "EmailAddress",
        "FAST_WRITE",
        "BadSPIPackets",
        "GetRecoveryPointData",
        "NewPassword will be stored on the BMC as the new password for the user specified by the CurrentCredential parameter.",
        "Enables execution of offline diagnostics",
        "currentUser",
        "Suboptimal",
        "MIF.DMTF|Monitor Resolutions|002.5",
        "A RegisteredProfile that references other profiles.",
        "CurrentBIOSRevisionNumber",
        "UmsDisassociate",
        "Type of the settings location template (OS, Application).",
        "This method is used to format the volume.",
        "TraceInfo",
        "If one changes the OverWriteOutDated property value to 4294967295, the OverWritePolicy property value will be 'Never'.",
        "SamProcessMappedAttributes_Start",
        "{9138500E-3648-4EDB-AA4C-859E9F7B7C38}",
        "I_EC3B8FD717A738425E0159268883F206D489A3D720198C69718F01AF4B120295.1020.3483875226.298",
        "MNS Logon Account",
        "Extensions",
        "The proxy server to be used when connecting to the Internet.",
        "X/m;X/m;",
        "String2",
        "The RegisterTypeLibraries action registers type libraries with the system. The action works on each file referenced which is triggered to be installed.",
        "Target is associated to SynchronizationAspect",
        "This property is a reference to the instance that contains statistical information about a collection.",
        "PolicySourceUseRDEasyPrintDriver indicates whether the property UseRDEasyPrintDriver is configured by Server(0) or Group Policy (1).",
        "Denotes the access right.",
        "Recommendation.ITU|X733.Perceived severity",
        "An estimate of the current bandwidth in bits per second. For endpoints which vary in bandwidth or for those where no accurate estimation can be made, this property should contain the nominal bandwidth.",
        "Network adapter VMQ settings for each queue",
        "Unlock Flag",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightDate|wHour",
        "NdisCurrentAddress",
        "r9PM]",
        "erviceDependencies",
        "MSFT_DSCConfigurationOutputWriteObject",
        "Controller is a superclass for grouping the miscellaneous control-related Devices that exist. Examples of Controllers are SCSIControllers, USBControllers, SerialControllers, ... The Controller class is an abstraction for Devices with a single protocol stack, which exist primarily for communication to, and control or reset of downstream (ControlledBy) Devices.",
        "Originating Machine",
        "{B3C848A7-B870-4C47-AD52-685CC8FACAC9}",
        "0x080000",
        "CIM_DataFile.Path",
        "Is sync on RGB",
        "directory",
        "iScsiDebug30",
        "B2E1180F3891F60984B8988B63",
        "Win32_VolumeQuota",
        "C_9212E0D756DE59946D687462B752A6AF5A16EC3A329D47D13E039D19732A1344",
        "LicenseServersList",
        "StatusDescriptions",
        "The Version property provides a textual representation of the shadow provider version.",
        "SamGetMemInGrp_End",
        "CD_703C562B7404A6234AAFEB9B3BB242E3FF62C76339F84C997DCEF89443C2DF65.1650.1756201996.430",
        "Refresh",
        "Maximum pixel rate",
        "SwEppWriteCount",
        "MIF.DMTF|Temperature Probe|001.19",
        "Time indicates when the power state should be set, either as a regular date-time value or as an interval value (where the interval begins when the method invocation is received.",
        "This property indicates a number that identifies the job object. ",
        "0      This device is working properly. ",
        "Win32API|Device Context Functions|GetDeviceCaps|HORZSIZE",
        "RestrictedSitesZoneNavigateWindowsAndFrames",
        "Win32API|Network Management Structures|USER_INFO_2|usri2_full_name",
        "I_5A594905C8F81E999D9B9057D3667626B70DB4CAA9232253B2044B135DF40086.786.1.31819",
        "The username/password settings for this service.",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_code_page",
        "The InputParameters property is Null, if no inbound parameters are required to execute the method. Otherwise, an object that contains the properties acting as inbound parameters for the method execution. The contents of the object are method-specific, and are part of the specification for the provider in question.",
        "TeamMembers",
        "#define ScsiReportLuns_OUT_ResponseBuffer_SIZE_HINT 16 // 8+8*number_of_luns",
        "The .ini file key below the section.",
        "PS_VpnConnection",
        "Mark parity",
        "ProtectionManagement",
        "The DriverInfo parameter specifies the neccessary inforation needed in order to create the printer driver.",
        "SetByTraceSelectedParameterSet",
        "Callback Context",
        "PolicySourceIdleSessionLimit",
        "NS_3FBDCB08ECD33FBEF028D2DB3EF058F8CE959779B943F43AB3DB3EC34ACA147D\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_84DAE394D72EEC44948504C5752A6FB488C2F34AF0DDE614A4D6BA8E4EF41579_1c3",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|Properties",
        "OemSoftwareVersion",
        "This property corresponds to CIM_PhysicalFrame.Manufacturer. See CIM_PhysicalFrame.Manufacturer for details.",
        "A Win32_FolderRedirectionHealth object that represents the health of the user's redirected AppData\\Roaming folder.",
        "{5b6a8b86-708d-4ec6-82a6-39adcf6f6433}",
        "Interactive",
        "CD_70B5C3F445D36D84AF1F9F0E062B6A21EF707E1616BEC072F41A3F1113BAD785.2457.4077745899.522",
        "Win32_SystemBootConfiguration",
        "The DebugInfoType property indicates what type of debugging information is to be written to the log file./nValues: 0 = None /n1 = Complete memory dump /n2 = Kernel memory dump /n3 = Small memory dump (64KB)",
        "List of DNS suffixes",
        "SetGateways",
        "Requests that the element's state be changed to the value specified in the RequestedState parameter. When the requested state change takes place, the element's EnabledState and RequestedState will be the same. Invoking the RequestStateChange method multiple times could result in earlier requests being overwritten/lost. ",
        "Incompatible media in drive",
        "15 - 'Mixed': Applies to groups with element pairs with different statuses. Generally, the individual statuses need to be examined. ",
        "FAT16",
        "CableManagementStrategy is a free-form string that contains information on how the various cables are connected and bundled for the frame. ",
        "The contract to which it applies.",
        "The Antecedent reference represents the physical component that implements the DiskDrive device.",
        "Specifies whether the service object is recycled when the current transaction completes.",
        "ref:MSFT_StorageEnclosure",
        "{5954bc51-c5ec-4aaa-831c-6f2c1b2515b6}",
        "ReceiveFilterCurrentCapabilities",
        "FAT32",
        "IPv4Addresses",
        "C_0321441591402F5AF02BB91D74BEE22B0CD8DD0874929978DA89FBE91F7CA9DF",
        "WHERE LogfileName='#'",
        "The representation of IPv4 address and IPv6 address.",
        "DisableForcibleLogoff",
        "EventCharacter",
        "NDIS ATM Maximum Active VCI Bits",
        "60009",
        "ref:CIM_NFS",
        "StartMode",
        "CPUScore",
        "C_9A2FA4B503D51BA72E7F874AA07B2D2639867C129B89B4AF2230D146C0DBAD9A",
        "The desired name of the virtual disk clone",
        "WmiSetHDSplitParameters",
        "43008",
        "tabIndex",
        "{9565979A-7D80-11D2-AAD3-006008C78BC7}",
        "QPClose performance counter missing",
        "New Allocation Size",
        "The TimeOfLastReset property indicates the date and time this controller was last reset.  This could mean the controller was powered down, or reinitialized.",
        "Resolution",
        "dmmap",
        "{189d4015-1b25-4d8e-a4a9-f9eba82197c7}",
        "{995e6b7f-d653-497a-b978-36a30c29bf01}",
        "NISSignatureAge",
        "Do Not Continue",
        "End SendReq Time",
        "IMAPI2 Disc Recorder",
        "The information returned by this method could be used at a later time (via the RestoreProperties method), to return a Device to its present \"condition\". This method may not be supported by all Devices. The method should return 0 if successful, 1 if the request is not supported, and some other value if any other error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier.",
        "6 - Hardware malfunction",
        "Monday",
        "A set of authentication proposals used in Phase 1 of authentication.",
        "IL_7D726A53C2E109A7102AA0733AF15E0ABEDDFCEA169FD750AACBD377D8D29F56.1476.2555114093.305",
        "I_662CB144681343CD914A84B6324D30356940F0E892AC14E72E79452BFD8511B8.675.1.129842",
        "SupportedDeduplicationObjectTypes",
        "Specifies the processor number for the last RSS processor.",
        "SupportedCopyStates",
        "CommitAddress",
        "The NewVersion reference represents the COM component containing interfaces that emulate the older version of the component.",
        "Non Interlaced",
        "CD_EF449CE69828797E16ABEAB272BB63851199331E1B3809DFFF02FC6CB2F0B417.2047.1.10248",
        "A free form string indicating the algorithm or tool used by the device to support compression. ",
        "CIM_RemoteServiceAccessPoint.InfoFormat",
        "Determines the default allocation behavior for virtual disks created in this pool. Enclosure aware virtual disks will intelligently pick the physical disks to use for their redundancy. If TRUE, the storage subsystem will use physical disks from different enclosures to balance the fault tolerance between two (or more) physical enclosures.",
        "Use of Timeout Parameter Not Supported",
        "Outlook Flag",
        "Power Switch",
        "The MaxWaitOnEvents property specifies the amount of time an event sent to a client is queued before being discarded.",
        "Clears any previously configured KMS host name.",
        "DirectAccessQueryIPsecEncryption",
        "RsopEnumerateUsers",
        "NegotiatedFlags",
        "TcpOffloadParameters",
        "WEP key length in bytes",
        "UninstallUnmanaged",
        "The ICMMethod (Image Color Matching Method) property indicates how ICM is handled. For a non-ICM application, this property indicates if ICM is enabled or disabled. For ICM applications, the system examines this member to determine which part of the computer system handles ICM support.  ",
        "Association between StorageSubSystem and StorageHealth",
        "R_124B2D8A86058DD102C833379996E9AF4D90CC4B792958ACD8E55DB72860976E",
        "SetMaxYResolution",
        "Ndis80211NumberOfAntennas",
        "UseSuffixWhenRegistering",
        "DCOMAPP",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|FlowControl_Hard",
        "(C1 OR (NOT C2) OR C3) AND (C4 OR C5) ",
        "Indicates if VXLAN Encapsulated Packet Task Offloads are currently enabled for this Adapter",
        "Version of the Software Licensing service",
        "MSFT_NetFirewallRuleFilterByAddress",
        "CD_3196586F94E9CFEA6D912774CB2A6C6FDB2471424853F54D4C0F4EE4F94880DF.1362.1.22595",
        "Optical Channel",
        "ModifySettingsDefineState",
        "Whether the provider supports multiple execution engines on a given RNIC.",
        "MemoryAllHosts",
        "Weight",
        "PCI Express legacy endpoint",
        "Exposed Name",
        "QueryIPv6Only",
        "String specifying the name of a file in which a current copy of the event logfile will be placed. If this file already exists, the function fails. ",
        "DisplayErrorNotification",
        "TypeEvent",
        "NETIO_TRACE_LEGACY",
        "C_F8950447585CD6743131FC688F3AC5EE4D2DE57B4CA01C83E91AB8FD7ED70E93",
        "Recurse all child directories",
        "Off Line",
        "TRACE_LEVEL_ERROR",
        "A physical package can be hot swapped if it is possible to replace the element with a physically different but equivalent one while the containing package has power applied to it (i.e., is 'on'). ",
        "IR_A905E989052353FA9D8F60E873BC56BF35837561C775D74EDFE4D77EF4FED58C",
        "ObjectAccess_AuditDetailedFileShare",
        "CertificateIssuedTo",
        "object:AcpiGenAddr",
        "The InterruptType property indicates the interrupt type of the IRQ resource",
        "Number of times correction algorithm was processed for write",
        "CIM_ConfigurationData.ApplyConfiguration",
        "CI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109",
        "CD_4BD0F8A6C8D9EC0678D50228DC3CB44B9F26CFF9B291F8B882B0AD7C252B23A9.293.2240452953.219",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|PortSubClass",
        "The ReceivedCount property indicates the number of bytes received in the current session",
        "PNP_INSTALL_VERBOSE_LEVEL",
        "ProcessID",
        "//             typedef struct {",
        "MIF.DMTF|Support|001.5",
        "Antimalware",
        "(off-line read scanning implemented bit) - If this bit is cleared to zero, the device does not support off-line read scanning. If this bit is set to one, the device supports off-line read scanning.",
        "{B7E6042C-DB36-11d2-85FC-0000F8102E5F}",
        "DefaultQualified",
        "SpeakerModeDial",
        "This is a class that represents the current detailed state of a threat",
        "Integer indicating the maximum length of a file name within the file system. 0 indicates that there is no limit on file name length.",
        "The number of multicast bytes received without errors through this interface.",
        "Specifies the working directory path for the program the user wants to start on logon to the Terminal Server.",
        "DOT11_APROUTER Flag",
        "ref:MSFT_NetSwitchTeamMember",
        "CIM_ERR_INVALID_NAMESPACE",
        "The SuperclassName property, if not NULL or blank, this parameter specifies a superclass name. Only classes that are subclasses of this class are returnedIf NULL or blank, and Flags contains WBEM_FLAG_SHALLOW,only top-level classes, that is, those which have noparent class or superclass, are returned. If it isNULL or blank and Flags is WBEM_FLAG_DEEP, all classes within the namespace are returned.",
        "The total number of packets that contained a valid Sequence Number field.",
        "ReceiveTimeout",
        "Win32Registry|HKEY_CURRENT_USER\\Environment",
        "The DatabaseMaxSize property specifies the maximum size of the WMI repository.",
        "In both cases, there is an unambiguous specification of the overall condition that is tested to determine whether to perform the PolicyActions associated with the PolicyRule. ",
        "ref:CIM_VideoControllerResolution",
        "LogMalformedMessages",
        "Date and time when the resource was started.",
        "WebGetAttribute",
        "SetSessionDirectoryExposeServerIP",
        "{DE1B36A6-4157-43ed-937F-D90606C09216}",
        "Values: TRUE or FALSE. A value of TRUE indicates this is the primary operating system.",
        "R_8F21C89CAF771FFCC47E28C59A7D76DBF0F63931FC16518B322428129F505FDF",
        "The endpoint used to reach the route\\'s destination.",
        "DeviceTunnel",
        "PacketDirect diagnostic state of the adapter.",
        "EntryStatus",
        "The RegisterClassInfo action manages the registration of COM class information with the system. In the Advertise mode the action registers all COM classes for which the corresponding feature is enabled. Else the action registers COM classes for which the corresponding feature is currently selected to be installed.",
        "Number of successful AAAA queries",
        "Critical remediation failure detections",
        "ImeDDI",
        "Local Processor Observed Error As Third Party",
        "This class exposes the SM-HBA Adapter attributes. This will include the number of ports on this adapter.",
        "IconIndex",
        "ServiceModel Binding",
        "TRACE_RESERVED10",
        "TpmReadyStatus",
        "2147490687",
        "The ErrorGranularity property identifies the level where the error can be resolved.",
        "The status of the BranchCache Hosted Cache HTTPS URL Reservation",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwMessageSize",
        "DirectAccessProxyName",
        "Whether weak host sends are enabled.",
        "SessionID",
        "CIM_SerialController.Capabilities",
        "Voice over ATM",
        "This method provides ability to unenroll the device",
        "SetPowerState defines the desired power state for a logical device and when a device should be put into that state. The desired power state is specified by setting the PowerState parameter to one of the following integer values: 1=\"Full Power\", 2=\"Power Save - Low Power Mode\", 3=\"Power Save - Standby\", 4=\"Power Save - Other\", 5=\"Power Cycle\" or 6=\"Power Off\". The Time parameter (for all state changes, except 5, \"Power Cycle\") indicates when the power state should be set, either as a regular date-time value or as an interval value (where the interval begins when the method invocation is received). When the PowerState parameter is equal to 5, \"Power Cycle\", the Time parameter indicates when the device should power on again. Power off is immediate. SetPowerState should return 0 if successful, 1 if the specified PowerState and Time request is not supported, and some other value if any other error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier.",
        "C_7ADB3A758B71404FF95472D98780622B0177ABFE993DE8C448448F3816B71A61",
        "43007",
        "0x000001",
        "A persistent binding request included an undefined or otherwise in accessible Logical Unit Unique Identifier",
        "Boolean specifying whether the media is currently write protected by some kind of physical mechanism, such as a protect tab on a floppy diskette.",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1075.2949736959.180",
        "A value that specifies whether messages are buffered or streamed or a request or response.",
        "Boolean indicating whether the slot supports hot-plug of adapter cards.",
        "Initiative Wrapper",
        "WmiTime",
        "Search Flag",
        "ConnectFailure performance counter missing",
        "C_286D3AAA59AE00C2CF7EBCC4AB344CD2AFDCE3C2B408154E04E7644656DAE408",
        "Photographic Imagesetter",
        "TransactionAutoComplete",
        "NDIS 802.11 Infrastructure mode - defines how the device connects to the network.",
        "WitnessNodeName",
        "The StartFileName input parameter is a string that names the child file/directory to use as a starting point for CompressEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from",
        "Example: SPOOLSS.DLL.",
        "force",
        "The type of power meter event this is.",
        "Win32_PnPDevicePropertySint8",
        "The abstraction of a port or connection point of a Device. This object should be instantiated when the Port has independent management characteristics from the Device that includes it. Examples are a Fibre Channel Port and a USB Port.",
        "FirmwareRevision",
        "Win32_PhysicalMemoryArray",
        "I_A41A2A506F07DE19FA26EBBA5A53B62D2C62BAF775EC8BEA2B152B5D21A711E3.1480.1551136378.339",
        "DisplayFrequency",
        "\\\\.\\root\\directory\\LDAP:__Win32Provider.Name=\"Microsoft|DSLDAPClassAssociationsProvider|V1.0\"",
        "CIM_Error.CIMStatusCode",
        "AuthorityName",
        "C_92C92331781DF35B14382C2C18FCF4F9CE2A3F0D9A27B8F847108A01941602A7",
        "Meta data of configuration.",
        "autoConfigTime",
        "Keyboard class driver information",
        "zoneIndex",
        "R_68F60BCE5ED1CEFD06D072F2C79847AF4A3C52BA9A8E9F51041AA990EA82C70E",
        "I_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258.1164.378460097.247",
        "{FAF76B77-798C-11D2-AAD1-006008C78BC7}",
        "WSP_StorageSubSystemToFileServer",
        "CIM_ERR_METHOD_NOT_FOUND",
        "PCI_COMP_REGS_DATA_PAIR is valid",
        "2 - 'Fixed': Storage for the virtual disk is allocated at the time of virtual disk creation.",
        "Maximum duplicate address detection attempts for temporary addresses. The default value is 3.",
        "C_23A50366135FBF364F350BC34F639BE141A61D21A478BB4C1230D838F1296A4E",
        "NewFriendlyName",
        "BackupEventlog",
        "AllowDemandStart",
        "NS_FE3EA006C3292950A76C2B5A0185D7DF99ADD6FD6502E0AC079E3A8650E76E3A\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_C52295624F06C940B122D80C080F06A7E8A3B72E8DBB8DAB3530E90B3C01E0C88",
        "\\\\.\\root\\interop:__Win32Provider.Name=\"ProfileAssociationProviderInterop\"",
        "Clsid",
        "SelectNetworkAdapterIP",
        "Specifies the name of the VPN connection profile to be removed.",
        "MDM_Policy_Config01_ErrorReporting02",
        "Micro-DIN",
        "OLEDB.1 formatted output (A)",
        "SamAddMemGrp_Start",
        "Interpress",
        "FreeSpaceWipingInProgress",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardDate|wYear",
        "Ready",
        "ChapUsername",
        "The GetExpandedStringValue method returns the data value for a named value whose data type is REG_EXPAND_SZ. ",
        "Win32API|File System Functions|GetVolumeInformation",
        "MODCA",
        "The Msft_WmiProvider_DeleteInstanceAsyncEvent_Pre event class represents an event generated immediately prior to calling the provider's implementation of IWbemServices :: DeleteInstanceAsync.",
        "GetInfoByObject",
        "EnableStructuredExceptionHandlingOverwriteProtection",
        "ScheduleScanTime",
        "The CIM_PhysicalLink class represents the cabling of physical elements together. For example, serial or Ethernet cables, and infrared Links would be subclasses (if additional properties or associations are defined) or instances of CIM_PhysicalLink. In many cases, the numerous physical cables within a physical package or network will not be modeled. However, where these cables or links are critical components, or are tagged assets of the company, these objects can be instantiated using this class or one of its descendent classes.",
        "CD_5F5583215800877E78DF32C89A95963A09372E548E11061C174A3C01BAB56758.1738.1.8469",
        "Protocol Type",
        "Time that the job was begun",
        "select * from MSFT_HealthActionEvent",
        "The Win32_LogicalProgramGroupItem class represents an element contained by a Win32_ProgramGroup, that is not itself another Win32_ProgramGroup.",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_8D9107E4ECAF109CE6D86793D80E0B566CE8692178AEB151294771B38F8935EA",
        "IPv6TcpSyn",
        "Accuracy",
        "CD_3AA9C8A0942F537FDAE95E548CCBAD1AD1FFA8F4AD1AFE2EE57031F74E67B391.1639.1.33271",
        "C_112D5871031FA8548B77FA449AA39B2BB51A4848F5CC93A4CF0AC90CF6249BE0",
        "ms_409",
        "{464FFAB1-946F-11d2-AAE2-006008C78BC7}",
        "RSOP_PolmkrSharedPrinterSetting",
        "NDIS Dot11 Disassociation Status Indication",
        "PrimaryOS",
        "ReceivedUnicastBytes",
        "P0m;P0m;",
        "Joules",
        "Set_BCAuthentication",
        "GetAttributes",
        "0x8005006A",
        "{a7a9597c-2f8e-410b-9bb3-5c3a50792bfc}",
        "0xAFFF003B",
        "DiscoveryVolumeType",
        "Microsoft iSCSI Initiator: Target Class",
        "The Win32_NTLogEventUser class represents an association between an NT log event and the active user at the time the event was logged. ",
        "Shutting Down (6) indicates that the job is moving to a \\'Completed\\', \\'Terminated\\', or \\'Killed\\' state. ",
        "MSKeyboard_ClassInformation",
        "ChannelCode",
        "If a CIM service does not support sequence identifiers for indications, this property shall be NULL.",
        "AccountLogonLogoff_AuditOtherLogonLogoffEvents",
        "A class derived from RedundancyGroup indicating that one or more of the aggregated elements can be spared. (The actual Spares are defined using the ActsAsSpare association.) An example is the use of redundant NICs in a ComputerSystem - where one NIC is primary and the other is Spare. The 'primary' NIC would be a member of the SpareGroup (associated using the RedundancyComponent class) and the 'other' NIC would be associated using the ActsAsSpare relationship.",
        "TE Link",
        "Transition latency",
        "ConfigDebug Flag",
        "MaxBufferPoolSize",
        "Retrieves a structural representation of the printer's security descriptor.",
        "VirtualDiskSizeMax",
        "TRUE if login was redirected. RedirectedIPAddr and RedirectedPort are valid then.",
        "The DaylightName property indicates the name of the time zone being represented when daylight savings time is in effect.",
        "C_A4F5A56059DDF119F4CC303056A7BB3F243745A5AAA1FF57F146D0A87968F7FD",
        "ROOT\\PEH",
        "Boot from CD is supported",
        "SetShareInfo",
        "The NewVersion reference represents the COM component that can automatically emulate the associated COM component. This information is obtained through the AutoTreatAs registry entry.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1489.2481664846.180",
        "Access Allowed",
        "HeapContract",
        "ReliabilityMetricsProvider",
        "AGP is supported",
        "Element can be member of multiple groups",
        "MDM_Policy_Config01_CredentialsDelegation02",
        "e index.",
        "Win32_OptionalFeature",
        "Contact IT Description",
        "_DO_NOT_USE_ Flag",
        "#define ISCSI_SECURITY_FLAG_TRANSPORT_MODE_PREFERRED 0x00000020",
        "CSProduct",
        "MIF.DMTF|IRQ|001.3",
        "Quick Format",
        "This method performs a diagnostic on the storage subsystem, returning any actionable results.",
        "Adapter busy or reserved, retry may be effective",
        "iScsiFlagErl Flag",
        "IL_9A1B596721539D9615A6900B0F6364E9823374D126BDDBDF36FABAC428F02B9B.560.1.66330",
        "Deprecated",
        " 'Service' state while suspended. (This is job-specific.) ",
        "Remove a WEP key on the NDIS 802.11 device",
        "Image Load in PageFile Event",
        "ModifyListSynchronization",
        "ref:MSFT_Pipeline",
        "Adds a new printer to the specified server using an existing printer port.",
        "22 - Service not started",
        "EnableEvents",
        "Framework_Trace",
        "Rebuild the template index from the existing registered template files.",
        "C_BDB1FB83B60E9BD18231450213923BBA0EC1BFB3618EC2AD0ABF9ED38791F05A",
        "mdlreadcomplete",
        "Shared secret to be used at the basis of a DH-CHAP challenge.",
        "IPAddrV6",
        "SetDomainInformationPolicy",
        "TRACE_FLAG_MCN",
        "BorderWidth",
        "MinVSyncNumerator",
        "The URI transport scheme that is used by the channel and listener factories that are built by the binding.",
        "The server associated with this job.",
        "CIM_ERR_INVALID_CLASS",
        "MIPS R4000",
        "CD_9E178FA2A34645B8FAC228D88E7D08922CA628703FFC498A6C1FBFD97A3CB433.1248.3302948071.605",
        "CD_224B5CC2DC8F3AC1441E2D19046B5D0473DC87327FB7FEADFB35C0CF4DD98702.2625.2897893762.557",
        "NS_127B451CD685BF0DE131A6787BF6B66926311BF5D825DC0E69AA8DC3B4ADCAC1\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_F58EA9A4248FB79DDBF112DB65B98127C9A78FF4DF9FC34835E8B50C808C985B",
        "__CIMOMIdentification",
        "ProtectKeyWithCertificateThumbprint",
        "TargetFlags",
        "Proprietary Connectionless",
        "True when the operation is a callback operation.",
        "Unspecified",
        "ref:MSFT_FileShare",
        "TM_PLGWORKER",
        "RecoveryTime",
        "QualifiedPartition",
        "SECHC_LOG_FLAG_EXT Flag",
        "Total number of Kernel Performance States",
        "TraceStuff",
        "CannotPoolReason",
        "DORestrictPeerSelectionBy",
        "ISO6429",
        "I_0127A7661BBBCD4388742549D522C2574BE39C7911E6AAABA36EFEEDB5CEC716.2706.1328598686.291",
        "CD_F01107CB054F8A386963F327634C557818A4B4AC71917F4F3A17F67A816EEA4B.1545.1023871706.413",
        "SMBIOS|Type 7|Location",
        "EVENT_TRACE_FLAG_P",
        "Page Code",
        "   /* Port Statistics Events */",
        "SCM Event Log Filter",
        "Idle - Indicates a process whose threads run only when the system is idle and are preempted by the threads of any process running in a higher priority class. An example is a scLd",
        "Crusoe(TM) TM5000 Family",
        "Downloads folder, GUID is {374DE290-123F-4565-9164-39C4925E467B}",
        "Provides a method to enable specific power management capabilities on the adapter.",
        "ScsiTargetId",
        "TotalPageFileFragments",
        "SECHC_LOG_FLAG_DIAG",
        "WQL:V1ProviderDefined",
        "R_98EA0A670D6389997E9783969F4DEC84E9FC2CA3BC30C21C3E4EDAC886CFE30D.1478.2835079812.536",
        "CD_9C249B506244FB7EBFF9753C728C15CC6F408B144591C0ACA30DB0C62A64551F.1583.4257925954.80",
        "object:IdleStateBucketEx",
        "LAP-B",
        "Win32_PointingDevice",
        "CIM_LogicalDevice.Availability",
        "RequestFormat",
        "Win32_TSDeploymentLicensing",
        "C_41CA8C613150E784C004C908CB24132353B7EC2401C8DD6755B2ABBEB98C39B0",
        "5 = installed via clsid activation, ",
        "MIF.DMTF|Disks|003.3",
        "ActAsPartOfTheOperatingSystem",
        "The SupportedSRAM property indicates the supported types of Static Random Access Memory (SRAM) that can be used for the cache memory.",
        "LockedDownLocalMachineZoneAllowScriptlets",
        "EnabledSource",
        "DataRecoveryCertificate",
        "Whether IPsec is required for DirectAccess.",
        "NumberOfDoors",
        "VendorData",
        "Changer library problem warning type",
        "Flags1",
        " The SwapSpaceSize property specifies the minimum number of Kilobytes  of swap space that needs to be available on the target system.",
        "2 - 'Unhealthy': The majority of physical disks are unhealthy or in a failed state, and the virtual disk no longer has data integrity.",
        "The TempDirectory property indicates the directory where temporary files are stored.",
        "CD_51A4A09354423C467E946EF4050F2DF0E13DE3BBAD00C291A488D4E05F085A24.1197.3179138808.4219",
        "PrintingSettings",
        "The Dependent reference represents the disk drive.",
        "Specifies whether or not the UDP Port Number for VXLAN Traffic can be configured.",
        "AES_128",
        "Win32_PageFileUsage",
        "MSFT_FileShare",
        "User-friendly interface name.",
        "Econet",
        "Retrieves the list of specified license servers.",
        "Old Target Idle State",
        "The DriverDate property indicates the last modification date and time of the currently-installed video driver.",
        "Bid2Etw_ODBCBCP_1_Trace_TextA",
        "iScsiFlagProtocolTransfer Flag",
        "Specifies one or more ODBC DSNs by DSN name. You can use wildcard characters. The default is to return all ODBC DSNs.",
        "Compatible versions of current local configuration manager.",
        "LPCDRVR_TRACE_RESERVED_1d",
        "{932B59F1-90C2-D8BA-0956-3975C344AE2B}",
        "NtlmClientInitialize",
        "rootDomainNamingContext",
        "SupportsStorageTierCreation",
        "Storage object on which the storage health intent will be removed.",
        "EVENT_TRACE_FLAG_DISK_IO_INIT",
        "Proprietary Wireless Upstream",
        "TcpIp IPV6 Connect/Accept",
        "CIM_IPProtocolEndpoint",
        "MSFC_NPIVCapabilities",
        "// the best results are obtained by using iSNS.",
        "LUAInstall: error 0x00000005 setting flags [{C1F400A0-3F08-11D3-9F0B-006008039E37}]",
        "TolerableDelay",
        "ServiceModelTraceListeners",
        "NPIV_HASH_FUNCTION_NOT_USABLE",
        "{71312AB6-DB31-11d2-85FC-0000F8102E5F}",
        " Use an instance of this class to allow the client to give a hint to the DS Instance Provider to scope enumerations and queries to a particular sub-tree or a naming context. The client should create instances of this class if it wants the DS Provider to do enumerations and queries of a specific DS class from a specific DS Object as the root",
        "{8502C4E9-5FBB-11D2-AAC1-006008C78BC7}",
        "C_5997589696FB2E4597FC4CE1E1612FCF4F0EAE5655998B39A34DFA12CA0BE14A",
        "GetResourceState",
        "4 - Hardware not present",
        "The directory exported for NFS mount.",
        "43000",
        "R_8AD8BB59AD76539933CA61E487AC9890B90072B3A3E2702B40F21CB1F591E761",
        "EnterpriseDiscovery",
        "Content",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2167.1045814340.188",
        "\\\\.\\root\\wmi:__Win32Provider.Name=\"HiPerfCooker_v1\"",
        "__SystemEvent",
        "MfrAssignedRevisionLevel",
        "Indicates the USB subclass code.",
        "Deletes a print job from a given queue.",
        "ROOT\\microsoft\\protectionManagement",
        "        <StartWhenAvailable>false</StartWhenAvailable>",
        "Engine version (major, minor, build, revision)",
        "ResourcesMonitored",
        "GPO Display Name",
        "Whether DNSSEC validation is required or not.",
        "The Win32_BaseService class represents executable objects that are installed in a registry database maintained by the Service Control Manager. The executable file associated with a service can be started at boot time by a boot program or by the system. It can also be started on-demand by the Service Control Manager. Any service or process that is not owned by a specific user, and that provides an interface to some functionality supported by the computer system, is a descendent (or member) of this class.",
        "Specifies the print job to delete.",
        "High Availability could not be disabled for this storage object.",
        "The InstanceID of the CryptoSet to use for Main Mode.",
        "//         under the REG_BINARY key Bindings  is the struct:",
        "Power PC 604",
        "// The number of times that an acquire has failed.",
        "EISA is supported",
        "FloatArray",
        "Handle Count",
        "SET_SECURITY",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_06D6FB193493B2B3AB18566CA818BD25528D88E2A3D498D0E28DC2460169A56A",
        "SMBIOS Device Number",
        "RSOP_SecurityEventLogSettingNumeric",
        "nextSRB",
        "C_DF597A1A2BAD4809466E7A636A80CAB8A01D7F4907CEA5AC6B1078FB23BB559B",
        "EncryptionMethod",
        "SetUrgency is a method for defining the desired urgency level for the alarm. Its input parameter, RequestedUrgency, is specified using the Values list of CIM_AlarmDevice's Urgency property. SetUrgency returns 0 if the request is successfully implemented, 1 if the specified urgency level is not supported, and some other value if any other error occurred.",
        "{AF88EAF6-3E95-4838-BFF5-2EAD0AD6221A}",
        "NdisRingStateOpenFailure",
        "The Name property defines the label by which the object is known. ",
        "80487",
        "46000",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\nwlnkipx\\Parameters|MediaType",
        "C_ED6C3A2F6CC04DF3DD2F991B72C978A94559E5D3850ACCDF521D9DB88CF8E809",
        "C5B9BC0F0D1F0FC4733FA2AA35939C",
        "A user-friendly name of this PolicyRule.",
        "MaxDevicePasswordFailedAttempts",
        "Sets the given license server as the first entry in the list of specified license servers.",
        "Win32Registry|System\\CurrentControlSet\\Services\\Class\\Info|ChipType",
        "CIM_NetworkPort.OtherLinkTechnology",
        "The TcpMaxDataRetransmissions property indicates the number of times TCP will retransmit an individual data segment (non-connect segment) before terminating the connection. ",
        "Specifies the number of connect retry attempts using SYN packets. Value can range from 2 to 8.",
        "GatewayUseCachedCreds",
        "ref:CIM_PhysicalCapacity",
        "CR_9212E0D756DE59946D687462B752A6AF5A16EC3A329D47D13E039D19732A1344",
        "CD_FBC71D3D1DD9772ECC7466D75E7CA5C00F778C7F0EA2DC410B71690DEDB23FFB.1596.3093081225.833",
        "CD_44199FEB2EA5AA114C34FEFCE15EC340288F3AE7F2F9B159DAE8176076473712.1998.4063895195.743",
        "The IPAddress parameter lists all of the static IP addresses for the current network adapter. ",
        "The LastStartupHeapPreallocation property specifies the size of the pre-allocated heap created by WMI during initialization.",
        "devicechange",
        "LetAppsAccessMessaging_ForceAllowTheseApps",
        "C_7A72389BB1759518065C4AF4001515EC91E03811075FE8C84FE22087E293F0F4",
        "Socks proxy server address and port separated by a colon (and no space).",
        "Provides for setting a more granular set of auditing permissions to the existing account specified.The permissions are set individually through PermissionMask.The PermissionMask is an enumeration of the following values:WINSTATION_QUERY=0, WINSTATION_SET=",
        "RebootAndManualStepsRequired",
        "SM_SendRPL",
        "CD_A67F6CA5AD0F3F082B7328E37F2535113EC93F9273483374AD4B41FB5A9EBA2D.2459.3161263480.5820",
        "Level",
        "SupportsDTRDSR",
        "BitOffset",
        "IOAV protection is enabled",
        "Infrastructure",
        "This parameter is used to force the original volume to dismount before starting the revert operation. Forcing a volume to dismount forces all open handles to files on the volume to be closed. Applications holding open handles will likely be returned an error code on subsequent operations performed on the handles. If the flag is set to false and some application has an open handle to a file on the volume, then revert will fail with 'Volume is in use'.",
        "LoggingDirectory",
        "Note that ManagedSystemElement's Name property is also defined as a user-friendly name. But, it is often subclassed to be a Key. It is not reasonable that the same property can convey both identity and a user friendly name, without inconsistencies. Where Name exists and is not a Key (such as for instances of LogicalDevice), the same information MAY be present in both the Name and ElementName properties.",
        "A user-friendly string representing the name of the file server. Friendly name can be set using the SetFriendlyName method.",
        "AntimalwareMonitoringProvider",
        "SettingName",
        "NDIS ATM Hardware Current Address",
        "{947148e5-c935-4162-bbeb-653e2456f6eb}",
        "SERIAL_PORT_WMI_NAME_GUID",
        "Deployment Type",
        "DownBackLimitPctProvider",
        "script",
        "Home Dir Required",
        "IsBodyStyleSetExplicitly",
        "23     System failure: Try changing the driver for this device. If that doesn't work, see your hardware documentation. ",
        "IpsecPolicyAgent",
        "D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB",
        "object:MSFT_DSCConfigurationOutput",
        "PLATFORM_ERROR_STATUS",
        "Committed Address",
        "Defines the number of days after which a catch-up signature is warranted. Works with SignatureUpdateLastChecked. 0 = no catch-up;  1 = 1 day;  2 = 2 days, etc.",
        "Maximum number of outstanding requests per shared receive queue. 0 means no SRQ support.",
        "MIF.DMTF|Power Supply|002.16",
        "SupportsFileBasedCompression",
        "7 - 'FractureInProgress': An operation to fracture an Async or Sync replication is in progress. ",
        "PortalType",
        "RTS/CTS",
        "CD_7E9D3FC591CA732EEA61C4B739CB4B4C95CC90462692A33742DEEEDCF2ED6366.1782.1730004135.920",
        "EncryptionPercentage",
        "The ProviderOperation_DeleteClassAsync property indicates the number of calls to IWbemServices :: DeleteClassAsync.",
        "COMPACTION",
        "C_1EBAFD575878C70CE2D0C173ADE6E91E3E2B346C0148ED7DBBE48D6EBAD5CDDB",
        "IL_69022805775A062CC94D57E8561A4967FBB78097CF06B06D79EE411943106C3F.1075.2283585362.190",
        "Win32API|Security Identifiers (SIDs)",
        "The EnableIPFilterSec method is used to enable IP security globally across all IP-bound network adapters. With security enabled, the operational security characteristics for any single network adapter can be controlled using the network adapter specific EnableIPSec method. The EnableIPFilterSec method returns an integer value of 0 on successful completion, a 1 when a reboot is required, and any other value to indicate an error.",
        "StateType",
        "LicenseXml",
        "Whether to enable Page Combining. Page Combining helps reduce the physical memory usage of the operating system by periodically combining pages in physical memory that have identical content.  ",
        "Start",
        "NewInterval",
        "moduleType",
        "TraceInit",
        "The maximum number of QM SA's that may be established using this MMSA before it must be re-established.",
        "The Win32_PowerManagementEvent class represents power management events resulting from power state changes. These state changes are associated with either the Advanced Power Management(APM) or the Advanced Configuration and Power Interface(ACPI) system management protocols.",
        "SystemConfig_V1_Services",
        "Associates a network adapter with its UDP Segmentation Offload (USO) data.",
        "Note: Classes deriving from RSOP_PolicySetting must redefine 'id' as a key",
        "Win32_SoftwareFeatureSoftwareElements",
        "ClientLinkSpeed",
        "I_A1C1D10CC78BE7A5C3AB54515C19F31277BB3701F61C98AD4F3CEB32242F741C.860.1.30027",
        "The NumberOfUsers property indicates the number of users associated with this connection.",
        "HOSTPROC_TRACE_INIT",
        "PLATFORM_TRACE_RESERVED_0f",
        "WD_LOG_FLAG_LOCKS",
        "IL_FDC07BF412EF517BF16CBEA0AD032C8FE94CB2DD73B9CD909C08659DB8C5BC0A.1356.1547423517.325",
        "MSDiskDriver_Performance",
        "The GUID that identifies the library.",
        "The MemoryDevices property indicates the number of physical slots or sockets available in this memory array.",
        "SERIAL_PORT_WMI_COMM_GUID",
        "TimeBeforeRemoval",
        "NativeProtocolType",
        "This property contains a textual description of the main processor on the device",
        "Specifies a bitmask indicating the stop bit and parity settings that can be selected.",
        "iSCSI Static Sessions Statistics Information",
        "lags [",
        "Association between StorageEnclosure and PhysicalDisk",
        "PLATFORM_TRACE_CONFIG",
        "WMI|Win32_COMApplication",
        "IR_549610262D899A609746B30777DA484C6B4E815F4E722D4B8F981494715B5A99",
        "Note that this method's function overlaps with the RequestedState property. RequestedState was added to the model to maintain a record (i.e., a persisted value) of the last state request. Invoking the OnlineDevice method should set the RequestedState property appropriately.",
        "ref:CIM_DeviceErrorCounts",
        "Aborting",
        "BatteryInstalled",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_C5A1AE4D66D54DE31BD0DB67526AE9F7258CD2800AEF5AF0F2B6F67014B52345E2",
        "TracingCache Flag",
        "LPCDRVR_TRACE_RESERVED_07",
        "The EncryptionLevel property specifies if the encryption level for secure transactions is 40-bit, 128-bit, or n-bit encryption.",
        "Example: \\HOMEDIR",
        "#define HBA_EVENT_PORT_FABRIC           0x204",
        "DEVICE_CONTROL",
        "Action Time in the Round-Trip Format",
        "The DriverName property specifies the name of the Win32 printer driver./nExample: Windows NT Fax Driver",
        "PolicyStore property defines the store to retrieve the Teredo configuration policy.",
        "The CompressionOff property contains the command string used to disable hardware data compression.",
        "LetAppsAccessCamera_ForceDenyTheseApps",
        "The Name property indicates the name of the Win32 user account on the domain specified by the Domain member of this class.",
        "ModuleVersion",
        "Specifies the friendly name of the switch to limit tracing to. ",
        "EnableFileHashComputation",
        "IsResponseFormatSetExplicitly",
        "CD_5CC5CF05A7A1041C246328BDD1081AC6C5D60C48F12D405A2F1C3A3CF42897DE.1150.3386837879.257",
        "PageFault_HeapRangeRundown",
        "The address of the local endpoint the SA applies to.",
        "Moderate",
        "The return value should be 0 if the request was successfully executed, 1 if the request is not supported, and some other value, as indicated by the ValueMap/Values qualifiers, if an error occurred.",
        "SamPwdChng_Start",
        "CD_52FCD2E5BE7CE0007B4E896F37512A3F9F16709231D802A1F0878D02E5765394.1191.2692173128.611",
        "{FAF76B69-798C-11D2-AAD1-006008C78BC7}",
        "The iSNS version number returned from the iSNS server is not compatible with this version of the iSNS client.",
        "This method returns deduplication properties of the volume.",
        "NS_8C31E837D18DD5B2F5A6595D90480BF8E8731F0D7C29001E3F22318EC8F6F6A6\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_8620435B38BE1E99E74C0209777119091A237CDBD9A1C0FEF68B28339128BA61291371140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "00000001000000.000000:000",
        "CIM_Printer.PaperTypesAvailable",
        "{6F9D4740-8324-11d2-AAD9-006008C78BC7}",
        "Example: Portable Battery",
        "ipWINSAddress",
        "Registry Key",
        "The status of the BranchCache Hosted Cache HTTP URL Reservation",
        "Specifies the number of bytes written by all processes that have ever been associated with the job, in addition to all processes currently associated with the job.",
        "Alpha 21164",
        "MSMCAInfo_RawCorrectedPlatformEvent",
        "Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|ReadOperationCount",
        "Initiator CHAP secret given is invalid.",
        "AllowLocalIpsecPolicyMerge",
        "IconContents",
        "See CIM_NumericSensor.RateUnits for details.",
        "MaxSharedReceiveQueueDepth",
        "DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards",
        "NdisTokenRingLastOpenStatus",
        "ref:MSFT_OffloadDataTransferSetting",
        "{64A552E0-6C60-B907-E59C-10F1DFF76B0D}",
        "SupportedFileSystems",
        "The point in time that the virtual disks were synchronized.",
        "SupportsStoragePoolAddPhysicalDisk",
        "9 Pin Dual Inline (pin 10 cut)",
        "PrimaryBusType",
        "CD_038AC7DC2B3B3FE18119C0922FD190491410A00C8C9DE6AF3AED2E4BB066C596.1930.2037324493.1048",
        "PowerOnHours",
        "If the UserName parameter specifies an account name, the Password parameter must point to the password to use when connecting to the domain controller. Otherwise, this parameter must be NULL. /nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. ",
        "The PageFilePresent property indicates whether the volume contains a system memory paging file.",
        "ODBCBCP.1 formatted output (W)",
        "The variable-length null-terminated string specifying the name of the source (application, service, driver, subsystem) that generated the entry. It is used, together with the EventIdentifier, to uniquely identify an NT event type.",
        "MCA_ERROR_CPU",
        "A unique identifier for the object reporting the fault.",
        "MaxRefreshRate",
        "ErrorInfo",
        "ThreadCount",
        "{4AF3F4A4-06C8-4b79-A523-633CC65CE297}",
        "MaxCacheSizeAsNumberOfBytes",
        "Many-to-many groups",
        "This enables ISR traces",
        "DnsSecEnable",
        "0 - 'Healthy': The disk is functioning normally.",
        "ENABLE_DISABLE_FP",
        "Shut Down",
        "Newtons",
        "615B27D56E94A95716A",
        "This property indicates the status of SR-IOV support for the device.",
        "SoftwareLicensingTokenActivationLicense",
        "0x00000400",
        "TcpNumConnections",
        "InstanceID is an optional property that may be used to opaquely and uniquely identify an instance of this class within the scope of the instantiating Namespace. Various subclasses of this class may override this property to make it required, or a key. Such subclasses may also modify the preferred algorithms for ensuring uniqueness that are defined below.",
        "\\\\.\\root\\CIMV2:__Win32Provider.Name=\"Win32_UserStateConfigurationProvider\"",
        "Indicates if Asp.Net compatibility mode is active.",
        "CD_F888AA6AC586756C18E219B06406D7BCD62E2EB0C94B51FB48F127652DA7E3EB.41.2959931563.278",
        "autoConfigURL",
        "TargetPort",
        "Non-recoverable",
        "Msft_WmiProvider_ProvideEvents_Pre",
        "Specifies the number of bytes that should be used for a strip in the common striping-based resiliency settings. The strip is defined as the size of the portion of a stripe that lies on one physical disk. Thus Interleave * NumberOfColumns will yield the size of one stripe of user data. If this parameter is specified, this value will override the InterleaveDefault which would have been inherited from the resiliency setting specified by ResiliencySettingName.",
        "%ReasonText%",
        " The CIM_DirectorySpecificationFile association identifies the   directorythat contains the file being specified by referencing  the CIM_DirectorySpecification class. ",
        "UnlockWithPassPhrase",
        "InstanceId",
        "MSFT_InitiatorIdToVirtualDisk",
        "Processor data width in bits.",
        "Epson",
        "object:MSFT_TaskPrincipal",
        "CD_3035B16D02866D7EE030442132A18B7ACF25E1EBBE385D31EBEA6DA0AB2F86A6.57.345690657.3394",
        "SMBIOS_EVENT_TYPE",
        "TRACE_FLAG_DEBUG1",
        "NDISWMI_TRACE_CHKSUM Flag",
        "I_081DE5F9EB43C01864947DA4AF882FB1863E1DA519AB3901734A76A173C64485.2709.2273293940.291",
        "DEPRECATED",
        "The MACAddress property indicates the media access control address for this network adapter. A MAC address is a unique 48-bit number assigned to the network adapter by the manufacturer. It uniquely identifies this network adapter and is used for mapping TCP/IP network communications.",
        "I_BF9D9C18AB1A6E18A896CC939C82B68B48ACFFF2BF3B071F74FFEAF1FAE680D6.1475.3660458206.288",
        "Credential Guard",
        "ALPC-Wait-For-New-Message",
        "// The number of outbound quick mode security associations (SAs) submitted by IKE that failed",
        "PolicySourceVideoPlaybackRedir",
        "This is the base device element class. Device elements come in two flavors, File and Partition, and can be distinguished by the DeviceType field.",
        "MIF.DMTF|Monitor Resolutions|002.3",
        "ResumeJobByPrinterObject",
        "RSOP_SecuritySettingString",
        "3.5 ,  640KB,  512 bytes/sector",
        "The DaysOfWeek property indicates the days of the week when the job is scheduled to run.",
        "The PolicyRule class uses the property ConditionListType, to indicate whether the conditions for the rule are in DNF (disjunctive normal form), CNF (conjunctive normal form) or, in the case of a rule with no conditions, as an UnconditionalRule. The PolicyConditionInPolicyRule aggregation contains two additional properties to complete the representation of the Rule\\'s conditional expression. The first of these properties is an integer to partition the referenced PolicyConditions into one or more groups, and the second is a Boolean to indicate whether a referenced Condition is negated. An example shows how ConditionListType and these two additional properties provide a unique representation of a set of PolicyConditions in either DNF or CNF. ",
        "One of the following protocols:  - TCP   - UDP",
        "Advanced EAP Configuration",
        "C_62D705EEE1342BED8EAA270755244DE39EAF602D11698E63DBE2E645EB742AFE",
        "LPCDRVR_TRACE_RESERVED_17 Flag",
        "A translatetable entry defines a mapping between one value or set of values and another value.",
        "StageData",
        "IPv4IpOptionsSupported",
        "SupportedMacHeaderFields",
        "HashAlgorithmESP",
        "I_C22F3CC14B7FF9F4D80D447AFE68C087DA4445EEF4656FE00DD99580B53D33A3.1606.3932967909.228",
        "The CountryCode property indicates the code for the country/regionused by the operating system. Values are based on international phone dialing prefixes (also referred to as IBM country/region codes). The CountryCode string can use up to six characters to define the country/region code value.",
        "SamQuerySecurityObj_Start",
        "The logical file stored in the context of the file system.",
        "NPIV_NOT_SUPPORTED_FABRIC",
        "Fabric port id",
        "R_4F0DC2D766DE63D22C2118312C7C8A4306FD995CC443322263FCAFC5C5AE9AB8",
        "MSNdis_CoLinkSpeed",
        "SM_GetPortType",
        "Specifies that ICM is handled by Windows. 3",
        "IrpFlags",
        "Drive not the same",
        "{52e82f1a-7cd4-47ed-b5e5-fde7bf64cea6}",
        "The CodeSet property indicates the code page value used by the operating system. A code page contains a character table used by the operating system to translate strings for different languages. The American National Standards Institute (ANSI) lists values that represent defined code pages. If the operating system does not use an ANSI code page, this member will be set to 0. The CodeSet string can use up to six characters to define the code page value.",
        "MDM_Win32CompatibilityAppraiser_CompatibilityAppraiser01",
        "Reference to the RSOP_PolicySetting",
        "The L2CacheSpeed property specifies the clockspeed of the processor's Level 2 cache. A Level 2 cache is an external memory area that has a faster access times than the main RAM memory.",
        "Create_Suspended - The primary thread of the new process is created in a suspended state and does not run until the ResumeThread function is called.",
        "CD_02B5557CADEF33CFA29F52E782D8C5DEF3C67D29A7C0C3B389FF34D1D0708EC3.1992.134747559.5232",
        "8 - Unknown failure when starting the service.",
        "{3CE2D6A0-7346-4826-972F-F2C19779D1D1}",
        "%ActionType%",
        "{96bd320f-1e51-4c06-86f3-ee64f0a2f0cf}",
        "Commercial Power Problem",
        "MSNdis_StatusExternalConnectivityChange",
        "Specifies that the VPN connection being modified is in the AllUserConnection phone book entries. ",
        "A unique key identifying this move file action within its product.",
        "E.2714.1746936388.282",
        "0.m;0.m;",
        "{791ad1a3-e35c-11d0-9692-00c04fc3358c}",
        "TRACE_FLAG_PNP",
        "Flash",
        "FX_TRACE_RESERVED_1d Flag",
        "DISTINGUISHED NAMEs for all naming contexts stored on this directory server. By default, a Windows 2000 domain controller contains at least three namespaces: Schema, Configuration, and one for the domain of which the server is a member",
        "smallCustomLogoBitmapName",
        "Multicast addresses to which the LANEndpoint listens.",
        "R_9E6BE90DCA6B96CBA3BF12EFB579708613DA0A405A49EA5E6B87A7FDB2747D9E",
        "Minimum number of segments that a large UDP packet must be divisible by before offloading to Adapter for segmentation for IPv6 packets.",
        "A text string set by the manufacturer describing the serial number of adapter",
        "DebugInfoType",
        "Lost_Event",
        "TEST_TRACE_RESERVED_14",
        "MSFT_EtwTraceProvider",
        "TripleDes",
        "The maximum length supported for unsolicited data sent within this session",
        "Associates a network adapter with its IPsec Task Offload v2 setting data.",
        "AddressOrigin",
        "R_4FC7350D0697D65B1585376855E9596964780B95A8CAA540BF3CC2CD97C19696",
        "MSFT_PrinterDriver",
        "Specifies that ICM is handled by the device driver. 4",
        "NDIS Status Header/Data Split Current Config",
        "LPC_TRACE_RESERVED_10",
        "Specifies MAC Addresses or LinkLayerAddress for filtering",
        "Machine Password Passed",
        "LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads",
        "ReplicationType",
        "DisableIgnoringCertificateErrors",
        "IL_F98CD8F4EA96B0B77910240E3039FCC377A97641ECA44728EE7350A6200A681A.2462.1414865239.293",
        "S-1-5-114",
        "ChangeOwnerAuth",
        "NdisRingStateOpened",
        "65536",
        "Per Hour",
        "RadioHardwareRevision",
        "TemplateType",
        "C_06B95516C170444CC895270E847F3B76BA4712C919901870D883B631ED78C408",
        "A value that specifies the number of cached nonces used for replay detection.",
        "Msft_WmiProvider_CreateClassEnumAsyncEvent_Post",
        "RSOP_IEConnectionDialUpSettingsLink",
        "SetTcpMaxDataRetransmissions",
        "Single-App Mode",
        "Win32_SecuritySettingOwner",
        "SchannelDebugTrace",
        "Win32_NamedJobObjectSecLimitSetting",
        "provider.",
        "Indicates the specific mode currently enabled for the port. If the port is logged in, this will be the negotiated port type. Otherwise, the configured port type will be reported.",
        "Referenced HBA has ",
        "WLANHC_DLLMAIN",
        "LUTransactionsEnabled",
        "TM_ARPND Flag",
        "Weekly",
        "IPv6ReceiveIpExtensionHeadersSupported",
        "R_5DEB181FA3808D9D7D9C352C844B65D0C9A0221A91C57777C58BAB412DD30F67",
        "CD_D3559258225BBBDD5E2DFDF52DE5A11681B899B436DB12CA240C43C8641B92A8.1248.4048035429.338",
        "minutes",
        "IdleStateBucketEx",
        "MDM_Application",
        "{564F1E25-FC86-28E1-74F8-5CA0D950BEE0}",
        "SASAddress",
        "Join Microsoft MAPS.",
        "A manufacturer-allocated number used to identify the physical element.",
        "Pool Paged Failures",
        "SM_GetProtocolStatistics",
        "I_BED999C9BF7E84BAB50F0A32D016E7D1CAEC2193DF18DA06E4E9B9F14F58F2B8.1751.4220363579.204",
        "TupleResolutionEmpty",
        "SetByName",
        "ISR_Unexpected",
        "The DriveType property contains a numeric value corresponding to the type of disk drive this logical disk represents.  Please refer to the Platform SDK documentation for additional information.",
        "CIM_NumericSensor.EnabledState",
        "TRACE_CLASS_NLC Flag",
        "WHEAPolicyManagementMethods",
        "SerialNumberID",
        "Win32_ComputerShutdownEvent",
        "Minimum version number of the iScsi spec supported by adapter",
        "MSFT_VirtualDiskToReplicaPeer",
        "CIM_PhysicalFrame.ServicePhilosophy",
        "iSCSI Authentication Cache",
        "Single bit ECC memory error",
        "MsmqIntegrationBindingElement",
        "//  hbapiwmi.h",
        "MsftDiscFormat2Erase_DebugGeneral Flag",
        "vpnStrategy",
        "IsTiered",
        "WifiEnabled",
        "PortalGroups",
        "OffloadParameters",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|DefaultPriority",
        "The Name property indicates the name that identifies the current desktop profile.",
        "{8502C553-5FBB-11D2-AAC1-006008C78BC7}",
        "EnableKeyManagementServiceLowPriority",
        "The PartComponent reference represents the user account on the computer system.",
        "AllowMdnsDiscovery",
        "DnsClientNrptRule",
        "CD_161D7B1F7DD552C780B6CD4154D40388F29AC0271BBCB7991C59595342903A38.1700.3703283181.374",
        "The ParaId string is the formal name for the parameter.",
        "4f898a",
        "CIM_ClassModification",
        "NA-Number-10-Envelope",
        "Spare",
        "DefBlockExemptDscp",
        "The DitherType property indicates the dither type of the printer.  This member can assume predefined values of 1 to 5, or driver-defined values from 6 to 256.  ",
        "HOSTPROC_RESERVED_1b",
        "select * from meta_class",
        "AllowOnAccessProtection",
        "MSParallel_DeviceBytesTransferred",
        "PolicySourceVirtualIPActive",
        "E078CF7C2D3C5371AB7D7BA2E3A5C78D38FD26BACE479.12.927762452.1617",
        "If this parameter is specified as TRUE, the next available drive letter will be assigned to the partition.",
        "SELECT * FROM meta_class",
        "PLATFORM_TRACE_RESERVED_1c Flag",
        "CD_2095EEA1CCD8C1CFEEBDA5FC6FC84B8ED7715409578D2FABD172B27E3EA581F9.2615.729392336.641",
        "DomainGuid",
        "CD_04C7B00B843DD535EEFF8ADBC90D1E1778B3D8338A06E37E21692258CCC50FA9.2528.1905850821.85",
        "Value represented by an array of bytes",
        "Network adapter is the adapter edge of an intermediate filter component.",
        "network",
        "The settings for poison message handling.",
        "Alloc Flag",
        "The DiskVolume for the associated disk quota setting.",
        "INTERNAL_DEVICE_CONTROL",
        "      <registryValue name=\"\" valueType=\"REG_SZ\" value=\"ContainerHostActivation\"></registryValue>",
        "Win32_API|Line Device Structures|LINEDEVCAPS|dwStringFormat",
        "{45d8cccd-539f-4b72-a8b7-5c683142609a}",
        "\"Shutting Down\" describes an element being brought to an abrupt stop. ",
        "Voice Receive and Transmit",
        "C_2BBDC6530C208169E005CD28108E36BCD72310DD490D1F6D9817675EE3291874",
        "CR_0DCE749AD0E30C5A74941D6C326877243635B3D92AE3FA1BB77A2C716BB28364",
        "An array of free-form strings providing more detailed explanations for any of the Printer features indicated in the Capabilities array. Note, each entry of this array is related to the entry in the Capabilities array that is located at the same index.",
        "MsiXEnabled",
        "{8502C4F3-5FBB-11D2-AAC1-006008C78BC7}",
        "CD_4F3E89FFD328D071A7EF820B6542CC8779DD91A8E0E7900B2A3BF4F5F4353427.1531.1.8392",
        "5B423931597",
        "If TRUE, the storage provider supports the use of the DeviceNumbers parameter of the CreateMaskingSet and AddVirtualDisk methods.",
        "IL_098D2BC6F12E73776192C2458399FA507AEC03E53B212D94397DDD13D12328E0.1538.2152314052.334",
        "GuidCount",
        "TransportSupported",
        "WPDNSE_CHANGENOTIFY Flag",
        "SamPwdPushPdc",
        "ref:RSOP_IEConnectionDialUpSettings",
        "UINT64",
        "QuerySupportLevels",
        "015DD6EAA0272.2642.837909254.263",
        "{44795708-a61b-11d0-8dd4-00c04fc3358c}",
        "Values: TRUE or FALSE. If TRUE, the media is loaded.",
        "19     Your registry might be corrupted. ",
        "{A1BC18C0-A7C8-11d1-BF3C-00A0C9062910}",
        "SoftwareFeature",
        "A call was made to HBA_FreeLibrary when no library was loaded",
        "CIM_LogicalDevice.AdditionalAvailability",
        "Changer Parameters",
        "// your adapter. ",
        "C403031764",
        "Default actions for threats upon which default action should not be taken when detected. The actions need to be in the same order as their respective Ids specified in the ThreatIDDefaultAction_Ids property.",
        "Free form string providing more information if the ErrorType property is set to 1, \"Other\". If not set to 1, this string has no meaning.",
        "See CIM_SoftwareInstallationService.InstallFromURI.InstallOptions for details.",
        "IsSyncOnRGB",
        "DllLoadDir",
        "R_4DA19C7C1345D18991969860D5303884780EF4410093048FC0F1820643E62177",
        "Limit Breakaway OK - If any process associated with the job creates a child process using the CREATE_BREAKAWAY_FROM_JOB flag while this limit is in effect, the child process is not associated with the job.",
        "IsResourcePackage",
        "GRAPHMAIN",
        "PC Card (PCMCIA) is supported",
        "ClearKeyManagementServicePort",
        "Proto",
        "Profile Source",
        "AlternateNodeAddress",
        "C_AD547D8BC0F447772171D34927B4E8F9F5F0EE2793A91997022D273EBA01574A",
        "MGR_TRACE_RESERVED_05 Flag",
        "SentBytes",
        "Hard disk information",
        "Number of paths specified in Set Load Balance Policy does not match the number of paths to the target.",
        "MicrosoftVolumeEncryption",
        "NS_3CE8582EE8FFA928E42F84B5CDF7241A25C3C463C6F6E68C9EFB47A560BAD872\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_EA4ACC1C83A3FACD216DD4D4AE09BD81AEC8CE31C188BC51B0CBE5ACC0B6F6A4",
        "LogFlagWarning Flag",
        "Completed (7) indicates that the job has completed normally. ",
        "Select * from WIN32_DCOMApplication",
        "Mini-Centronics",
        "Strings to be inserted into the event text.",
        "DaylightName",
        "The AttachDebugger method launches the currently registered debugger for this process.  Dr. Watson, however, is not supported. ",
        "RemoteServiceAccessPoint describes access or addressing information or a combination of this information for a remote connection that is known to a local network element. This information is scoped or contained by the local network element, because this is the context in which the connection is remote. ",
        "SwEcpWriteCount",
        "on level",
        "MSFT_DAConnectionStatus represents DirectAccess connection status.",
        "MsftDiscFormat2RawImage_DebugRelease",
        "Example: 4",
        "EVENT_TRACE_FLAG_J",
        "This parameter indicates the default media type to use when creating a new virtual disk on this storage pool.",
        "I_CFA0B1B6160A70ECE951031F3670527FBE802E17A9872F45C34E57CB7BE2954F.2466.2515631069.356",
        "A textual description of the FRU.",
        "CD_39DCEF2AB20FDF7CAFAA304F91E99DB86E3E37A5DC94A931621C7269DB8703BF.40.90087890.1182",
        "The UserControlService method attempts to send a user-defined control code to a service. It returns one of the following integer values:",
        "I_092A55272DD5776D1F8B56BC2DC2767240A3BAAE69BF8801B96D23CE4A45B158.1089.1901740824.308",
        "{3F3B81D4-DB34-11d2-85FC-0000F8102E5F}",
        "Fmifs.dll | Method ChkDskExRoutine",
        "Detect",
        "NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication",
        "MSFT_StorageObject.ObjectId",
        "__SystemSecurity",
        "MSFT_WmiConsumerProviderEvent",
        "The connection status of the external NIC",
        "The IPXFrameType property represents an integer array of frame type identifiers. The values in this array correspond to the elements in the IPXNetworkNumber.",
        "Pattern",
        "The PacketDirect capabilities reported by the network adapter.",
        "NS_CCA03770E562E2A170EDED20A589C069A2045A9BCD7412B77D068846D9054EC4\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D0C79404D0C79FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "46011",
        "PNP ISA Bus",
        "ResumeJobByObject",
        "No Value",
        "A second logical device connected to the Antecedent device.",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|SpeakerModeOn",
        "SynReceived",
        "iSCSI_Paths",
        "\\\\.\\root\\cimv2:__Win32Provider.Name=\"WmiPerfClass\"",
        "Path to the Desktop icon",
        "ManufacturerIdTxt",
        "CD_86ED431FCE21CAA67833F50E8CEB80C11FAD7D40366CDE16E2C8794094F18925.2098.2053724725.1304",
        "iSCSI Initiator Query LoadBalance Policy",
        "LetAppsGetDiagnosticInfo",
        "Change_Owner_Security_Information",
        "RSOP_PolmkrDeviceSetting",
        "Directory Service (DS) flag indicating that the Domain Controller Name is in DNS format (for example, www.mynode.com or 135.5.33.19).",
        "NDIS ATM Maximum AAL5 Packet Size",
        "None - no authentication is performed.",
        "NdisVendorID",
        "The Priority parameter specifies the new priority class for the process.  Values:/nIdle - Specified for a process whose threads run only when the system is idle. The threads of the process are preempted by the threads of any process running in a higher pri",
        "gs [{934b410c-43e4-415e-9935-fbc081ba93a9}]",
        "LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads",
        "Supported",
        "The file to scrub.",
        "LUAInstall: error 0x00000005 setting flags [{9311A763-D284-4CE5-B2AA-6A99D9305D60}]",
        "\\\\root\\cimv2",
        "audit failure",
        "Route for a VPN connection",
        "Id of the storage scale unit containing this physical disk",
        "The interface filter applied to the rule.",
        "RemoteUserTransportAuthorizationList",
        "AppDomainInfo",
        "C_9F6D9AEF44C6D6D731582B47CFA9BC650A236C1F46BF8FBD13E2443B7BC5F904",
        "LetAppsAccessLocation",
        "object:MSiSCSIInitiator_LUNList",
        "LogoutNormals",
        "The Win32_UserAccount class contains information about a user account on a Win32 system.",
        "ref:MSFT_NetProtocolPortFilter",
        "Preparing",
        "C39AB0A136360A5ACE2240DC19B0464EB.1163.866272930.368",
        "Monochrome",
        "Disk Space Used",
        "The Port property specifies the DMA port used by the host bus adapter. This is meaningful for MCA-type buses.",
        "The Win32_MemoryDevice class represents the properties of a computer system's memory device along with it's associated mapped addresses.",
        "Whether media sense is enabled or not.",
        "Critical Section Trace Provider",
        "CONNECTION_STATE_RECONNECTING",
        "EventInfo",
        "{5966A24F-6AA5-418E-B75C-2F214DFB4B18}",
        "CD_A5134EAE65D9DD02F6CE0E924C84D387C2BC76C9409B3E6C9F586619D35EA1DA.0.2249453560.325",
        "Members",
        "The session of the provider, when part of a session.",
        "Network PC/Thin Client",
        "Whether this application should be shown in the TS Web Access",
        "Size in bytes of Target Username.",
        "Int 13h - 3.5\" / 720 KB Floppy Services are  supported",
        "{1EF94880-01A8-11d2-A90B-00AA00BF3363}",
        "If TRUE, this subsystem supports the ability to create new storage tiers. If FALSE, either the subsystem uses pre-created storage tiers, or it does not support storage tiers.",
        "TemplateMatchCondition",
        "The Index property indicates the network adapter's  index number, which is stored in the system registry. ",
        "Specifies the desired size of a data strip on a single physical disk in a striping based resiliency setting. This value must be between InterleaveMin and InterleaveMax. ",
        "Registration Add",
        "0xEFFF0018",
        "{8502C50A-5FBB-11D2-AAC1-006008C78BC7}",
        "2.22.0",
        "An enumeration value that indicates the type of dead letter queue to use.",
        "AllowInsecureTransport",
        "%1: The storage management provider's cache does not contain the requested object or object type.%2",
        "MSFT_NetConSecRuleFilterByInterface",
        "Login Attempts Failed",
        "AntiSpywareProduct",
        "ResetUserPassword",
        "Serial Connector",
        "Specifies the size, in bytes, of the driver's internal output buffer. A value of zero indicates that the value is unavailable.",
        "GetSpecifiedLicenseServerList",
        "IPv6ReceiveTcpOptionsSupported",
        "Efficeon(TM) TM8000 Family",
        "msieee8023-PolicyReserved",
        "Name is a semi-unique (scoped to the owning storage subsystem), human-readable string used to identify a storage pool.",
        "extension",
        "Cylinders",
        "NextGroup",
        "Localized version of RSOP_PolmkrOpenWithSetting for American English",
        "Bit flags that specify which login option values are specified",
        "R_C867B637B25E413A5893A8DF403F24B113B36FB9DA058811D901C232D15C4E60",
        "__EventConsumer",
        "The Synchronisation property, if applicable, defines the server synchronisation model, can take on one of the following values: ",
        "InternetExplorerTelemetryOptIn",
        "The DeviceID property contains a string uniquely identifying the 1394 controller with other devices on the system.",
        "The total number of requests submitted by IKE to obtain a unique Security Parameters Index (SPI).",
        "Current states of numeric sensors. See CIM_NumericSensor.CurrentState for details.",
        "IR_CFA0B1B6160A70ECE951031F3670527FBE802E17A9872F45C34E57CB7BE2954F",
        "{FFB58B9A-E3D0-11d2-8601-0000F8102E5F}",
        "CtlGuidWpdMtp",
        "Current packet types that will be received and indicated by the NIC.",
        "The SupportsBroadcasting property indicates whether the protocol supports a mechanism for broadcasting messages across the network.",
        "The physical memory which is located on the card.",
        "The default is five minutes.",
        "Monitor's vertical resolution in pixels.",
        "C_7BF884F7361F0D677A40C5CD7F9E2139AF67CB14ACDB2E9D39E3D5ADFB888E91",
        "{8EAEF9D8-C053-49d3-9205-65C703C2ECC1}",
        "WPD WiaCompat Trace",
        "Specify the GUID of the NetworkAdapterID to set. If the ID is invalid or does not exist, the return value should indicate appropriately.",
        "C9E19AA735345C392697BF03.522.1.61884",
        "TotalCacheDiskPerTask",
        "object:MSNdis_ObjectHeader",
        "LPC_TRACE_FUNCTION Flag",
        "Win32Registry|Software\\Microsoft\\Windows\\CurrentVersion|RegisteredOrganization",
        "Microsoft-Windows-OfflineFiles-CscDclUser",
        "TRACINGDRIVER Flag",
        "EventTracingManagement",
        "NumMsixTableEntries",
        "CIM_NumericSensor.ElementName",
        "9 - 'Stopping': The disk is in the process of stopping.",
        "DeviceNumbers",
        "CI_C0C025C38981E58EE50CB7BB4E4786CBA14FD933E638861EA3A6A2E0C806211E",
        "ref:MSFT_NetInterfaceFilter",
        "\"In Service\" describes an element being configured, maintained, cleaned, or otherwise administered. ",
        "ObjectAccess_AuditApplicationGenerated",
        "The host IP address of this port.",
        "Win32Registry|Software\\Microsoft\\Windows NT\\CurrentVersion|ProductId",
        "Indicates whether the tag is locked, preventing changes to the tag's contents.",
        "I_02BE0D0F4383EA07C00615531BF67EAFD4EDE92AB28CE4D74EBD94EDB757160D.2702.4104989389.296",
        "SessionTimeout",
        "TRUE if the framework is a private copy",
        "move Type",
        "Specifies the desired number of light parities to form in a parity-based resiliency setting. This value must be between NumberOfGroupsMin and NumberOfGroupsMax.",
        "HardwareManagement",
        "Horizontal border",
        "If the SMP is of type 2 - 'SMI-S', this field contains the name of the host running the SMI-S provider software. This field will be NULL otherwise.",
        "Bridge/Extender",
        "\\\\.\\root\\cimv2:__Win32Provider.Name=\"SECRCW32\"",
        "This method resets the values of the thresholds to hardware defaults. This method returns 0 if successful, 1 if unsupported and any other value if an error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier.",
        "If TRUE, this application will cause currently installed unmanaged applications with the same Windows Installer Product Identifier to be removed in order to install this application.",
        "PacketDirect functionality is administratively enabled for the network adapter.",
        "User accounts to deny access to the file share.",
        "0xEFFF0019",
        "The port to which this hosted cache client will offer content to the hosted cache server on its HTTPS channel",
        "If false, security zone settings are not customized.",
        "VpnConnectionProxy",
        "EVENT_TRACE_FLAG_ACQUIRESECTIONSYNCH",
        "Reset To Sync",
        "DeviceDescription",
        "ACPI C-state dependency",
        "DN_With_String",
        "The ICMIntent (Image Color Matching Intent) property indicates the specific value of one of the three possible color matching methods (called intents) that should be used by default.  ICM applications establish intents by using the ICM functions.  This property can assume predefined values of 1 to 3, or driver-defined values from 4 to 256.  ",
        "0xC0050055",
        "CD_59BB151BFB7474042FE846D38FA0CC3A5BA58498F9DD04AAF5BDB993481B126E.2086.3222164500.1264",
        "CD_3B52DE0976ED7CD9B4784B5C2E3249BB9E7405EB7D80E56153B90FBCA2B2EFDA.1977.2452644867.1127",
        "MSFT_NetIKECertAuthProposal",
        "InitiatorAddress",
        "RsopCreateSession",
        "Error code if any that has caused the processing to abort",
        "File Dir Enum",
        "Specifies the proposed hash algorithm.",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_2C3390DA0D8113E7B067C5F12CC8E1742CA924FE4948190A81257D1A9CF5BDEB0.0",
        "The locale-independent name of the set.  May be an indirect string.",
        "o recommended(2): Do the actions in the indicated order if you can, but if you can\\'t do them in this order, do them in another order if you can. ",
        "ArpAlwaysSourceRoute",
        "HBAFC3MgmtInfo",
        "LetAppsGetDiagnosticInfo_ForceDenyTheseApps",
        "A string describing the processor family type - used when the family property is set to 1 (\"Other\"). This string should be set to NULL when the family property is any value other than 1.",
        "The DomainDNSRegistrationEnabled property specifies whether the IP addresses for this connection are registered in DNS under the domain name of this connection, in addition to registering under the computer's full DNS name. ",
        "Synch",
        "EspSupported",
        "WD_LOG_FLAG_FUNCTION_TRACE",
        "Object which contains details for security content ratings settings.",
        "Indicates whether an Administrator logged onto the console can be logged off.",
        "ResyncInProgress",
        "PageFileSet",
        "Other Operation Count",
        "Represents an arbitrary SID -- CANNOT BE ENUMERATED",
        "The scoping System's CreationClassName.",
        "Win32_ProcessStopTrace",
        "ChangeSecurityPermissionsEx",
        "Total number of read errors that were corrected",
        "SelectiveSuspend",
        "The total number folders on the volume.",
        "The interval of time provided for a close operation to complete. ",
        "Get9XUserList",
        "Identity",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_5EBF93E0C149B1B151E338091E85B09A85B53ED88BB6E56FB2EB094E120431E2",
        "{FAF76B61-798C-11D2-AAD1-006008C78BC7}",
        "Denotes whether this subsystem supports continuously available (CA) file servers.",
        "The DaylightDay property specifies the DaylightDayOfWeek ofthe DaylightMonth when the transition from standard time to daylight savingstime occurs on this operating system. ",
        "{0FF18C30-FA51-11d3-9C37-006008B088CE}",
        "DtcTransactionInfo",
        "Msft_Providers",
        "R_2E4CB0F875356763EA64F3060366993EE0D49772670FDDF29B1CAAF86CE9720B",
        "|.m;|.m;",
        "Enable/Disable the caching of the KMS hostname and port on a volume activation client computer: 0=Enable, 1=Disable.",
        "MultipleRetryCount",
        "C_BA7526B37D90714D7B62CC8C0306D68C0FA9CA2FF62FAB9215A612E133C74CD5",
        "t[R[:",
        "File name, including path, of administrative template file",
        "MSNdis_AtmTransmitCellsOk",
        "RequestValue contains the Descriptor Type in the high byte and the Descriptor Index (for example, index or offset into the Descriptor array) in the low byte. Refer to the USB Specification for more information.",
        "LogArea",
        "Logon Authentication type given is invalid.",
        "LoaderNewDllEvent",
        "EightDotThreeFileName",
        "A condition that must evaluate to TRUE for installation to begin.",
        "MaxHashTableSize",
        "LockedDownIntranetZoneAllowFontDownloads",
        "I_5C670A419305640007AA9AA161CE0975646DEEA64973112E2DE223893C0FA422.1499.570302633.340",
        "WSManAutoDebug Flag",
        " The following values are only used during an uninstall ",
        "Fiber MIC",
        "object:DtcTransactionsStatistics",
        "MSFT_DtcDefaultTask",
        "Number of tokens in use for the subsystem.",
        "KernelIdleStates",
        "Win32_PowerMeterEvent",
        "FormName",
        "Authentication Failure",
        "{213f2c06-42ba-4124-8f19-f4ba22ce8f25}",
        "MSFT_NetISATAPState",
        "MSNdis_80211_BaseServiceSetIdentifier",
        "Specifies the simple EAP-TTLS client authentication methods. ",
        "C_0C89E3FE1CDFD790CBD5FEE0B9AE5F8AE27F38181A372EB2194AFCBADEB37DA8",
        "If enabled, bypasses the tunnel miniport and IPv4 routing layer for high throughput on the Teredo Relay functionality of the Teredo Server.",
        "REDBOOK_WMI_PERF_TIME_STREAMING_DELAY",
        "Shared base directory",
        "20 - Not Delegated - Windows 2000: Marks the account as 'sensitive'; other users cannot act as delegates of this user account.  ",
        "MaxBatchSize",
        "MaxPageFileSizeMB",
        "DeviceLoader",
        "Priority",
        "index",
        "{719A6839-C124-11d2-85E8-0000F8102E5F}",
        "C_E6555E0E3A2A0EB36147D0BA2B88FF99C450AC95610E6A4CA8EA619881318FDC",
        "ref:CIM_ClusteringService",
        "NDISWMI_TRACE_RSC",
        "LinkParameters",
        "The RSOP_GPO class is an abstraction for a Group Policy Container or Object",
        "Thread Count",
        "C_93FA26AC21CD81110C300205F91E593B4450632250F10BF0040FB84450AF694F",
        "CD_00637C6FCCC93CC75F9D988B459EA167A80BFD4782DA6DB5BC1F63F5A3F73F9B.1638.2297301218.365",
        "Store in which this configuration object is stored",
        "object:WSP_HealthActionEvent",
        "DMTF|ComponentID|001.2",
        "A representation of the access points of a clustering service.",
        "The WaitHint property specifies the estimated time required (in milliseconds) for a pending start, stop, pause, or continue operation. After the specified amount of time has elapsed, the service makes its next call to the SetServiceStatus function with either an incremented CheckPoint value or a change in Current State. If the amount of time specified by WaitHint passes, and CheckPoint has not been incremented, or the Current State has not changed, the service control manager or service control program assumes that an error has occurred.",
        "automatic",
        "PolicySourceVirtualIPMode indicates whether the property VirtualIPMode is configured by Server (0) or Group Policy (1).",
        "ref:Win32_LogicalDisk",
        "1 - Token Ring 802.5",
        "UserAccountControl_AllowUIAccessApplicationsToPromptForElevation",
        "UInt32Value",
        "OtherNetworkPortType",
        "AutoRestartDeadlinePeriodInDays",
        "DOT11_UPCALL",
        "C_830BF8BFA5BF93F39AE2488CCF30ECCF24868D5104B63DE9163FCAF3C26491CA",
        "volt * 10^-3",
        "InstalledSize",
        "Represents an LPR printer port",
        "DestinationFolder",
        "VpnConnectionTriggerDnsConfiguration",
        "NdisPMAdminConfigActive",
        "AllowPackageCleanup",
        "Heap Subsegment Initialization",
        "{e808ff73-2093-472a-a5cc-df24f031b035}",
        "CD_25D6DE4F10F10C9622833D068798F50E89401E52F3D552BA53470C9A0F55267B.109.707494031.1118",
        "This specifies the type of credentials used for authentication.",
        "Specifies the name of the VPN connection profile to be retrieved.",
        "NUKER",
        "Win32_DefragAnalysis",
        "audit success",
        "Instances of the CliParam class define verb parameters. Each verb has a (possibly empty) list of parameters accepted by the verb. The CliParam instance defines the name of the paramater, the default value for the parameter, the type of the parameter and whetehr the parameter is optional or not.",
        "Terminator",
        "Drive hardware problem",
        "The EnableStatic method enables static TCP/IP addressing for the target network adapter. As a result, DHCP for this network adapter is disabled. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "RSOP_IEConnectionDialUpSettings",
        "UseTemporaryAddresses",
        "Values: TRUE or FALSE. If TRUE, the CD is in the drive.",
        "Enables the ODBC Connection Pooling PerfMon counters for troubleshooting ODBC Connection Pooling feature.",
        "iScsiFlagNetwork Flag",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.11.1005103121.368",
        "ref:CIM_PhysicalMemory",
        "SetForestTrustInfo_Start",
        "This is the actual value of the element inside the BCD store.",
        "This object represents the storage subsystem's view of an initiator port. This is used in conjunction with target port to establish which initiator port is allowed to access to the subsystem's virtual disks.",
        "CD_5CB6A0A003499DF6531A245112372798390EB984E42ACEC32EC128E82F56ADB5.1999.3847220884.1352",
        "MNP 5",
        "The DNS name specified was not resolved.",
        "PNP_RESOURCE_VERBOSE_LEVEL Flag",
        " [{4B7",
        "CIM_Error is a specialized class that contains information about the severity, cause, recommended actions and other data related to the failure of a CIM Operation. Instances of this type MAY be included as part of the response to a CIM Operation.",
        "Machine",
        "CD_191877833EBB16E938034A3506BE0709B7FE03ACAA65FB61B2F3088D1DCE72BF.2059.342061585.562",
        "KeyLength",
        "This parameter accepts the GUID identifier for the background task to be started ",
        "File Kernel Trace; Optional Data",
        "API Flag",
        "Path to infected resource",
        "CIM_ResidesOnExtent",
        "smbwmiv2",
        "A list of ApplicationId's in guid form for applications replaced (uninstalled) by this application.  Each ApplicationId corresponds to the ApplicationId property of an instance of RSOP_ApplicationManagementPolicySetting.",
        "PolicySourceDeleteTempFolders",
        "The BackupInterval property specifies the length of time that will elapse between backups of the WMI database.",
        "Administrator",
        "Proteon 10Mbit",
        "The VirtualSize property specifies the current size in bytes of the virtual address space the process is using. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. Virtual space is finite, and by using too much, the process can limit its ability to load libraries.",
        "MSFT_NetAdapterBindingElementSetting",
        "I_66796251E5D0B06708BBA28B2F0C8A38E56DC5083BFF260568BAD57F3AAC7FBA.311.2942916013.249",
        "PortableDeviceAPI_Service Flag",
        "SamSetBootKeyInfo",
        "The platform architecture of the ODBC driver. Possible values are '32-bit', '64-bit' or 'All'. The default is 'All'. This is the platform architecture on the remote machine if this command is executed in a remote CIM session.",
        "CD_962C6E7C58B97BBA37F5179D96ED3E00EE4A4FC20E4C3C3A3312674F9F7C4195.39.268383370.494",
        "DisconnectedSessions",
        "NS_2EEEF6086B5AA3148DE8DC3E7A7263A417EE849A276BDB357874FDEB8ADED318\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_614FEB5198DB6356C7D4E70E58F0634936BC6DE530AA5FD952207E56B5A89D3F0",
        "ref:HNet_FwIcmpSettings",
        "These are options that can be used for logging into a target",
        "MSFT_NetConSecRuleFilterByAddress",
        "DH-CHAP available for physical port",
        "AuthIp",
        "TRACE_NONE",
        "Specifies whether server identity validation should be performed for the VPN connection.  This parameter is used with PEAP and EAP-TLS (with tunneled EAP client authentication).",
        "The web application shortcut file name",
        "Values: TRUE or FALSE. A value of TRUE indicates the protocol supports broadcasting.",
        "QueryInformationPolicy2",
        "CIM_DataFile.FileName",
        "PinnedForFolderRedirection",
        "Telco",
        "HBA Status result for the query operation",
        "CurrentCredential is a delimited string containing both the current username and password, separated by a colon.",
        "GetDedupProperties",
        "NICConfig",
        "Current power consumption in milliwatts",
        "The InstallDate property is datetime value indicating when the object was installed. ",
        "TotalRspBufferSize",
        "GRAPHOBJ",
        "C_549DC252C669D007BF4D8B198347293ACC33C289963BCA05C61A46DBFC8CA4BF",
        "Hive Filename",
        "CreatorSID",
        "DomainAuthenticationKind",
        "Bid2Etw_ADOMD_1_Trace_TextA",
        "MSFT_NetBranchCacheOrchestrator",
        "ResourceTest",
        "This property completes the identification of the System object in whose scope this instance of PolicyAction exists. For a rule-specific PolicyAction, this is the System in whose context the PolicyRule is defined. For a reusable PolicyAction, this is the instance of PolicyRepository (which is a subclass of System) that holds the Action.",
        "PeerSecuritySettings",
        "SMBIOS|Type 3|Bootup State",
        "CR_6AFC03E55253E21322FCA663D825D0FB816D6FBD02CA8A1BBA06E585EA971CD4",
        "Win32API|DRIVE_MAP_INFO|btInt13Unit",
        "The total number of sessions on this server. This includes both connected and disconnected sessions.",
        "Association between StorageNode and PhysicalDisk.",
        "The Win32_ComputerSystemProduct class represents a product. This includes software and hardware used on this computer system.",
        "ref:MSFT_StoragePool",
        "BOOTP",
        "DomainId",
        "The Id property indicates the driver letter uniquely identifying this CD-ROM drive.",
        "ChangePassword Flag",
        "Max CDB Length",
        "PowerSupplyState",
        "Example: A4 or Letter",
        "C_0E67BB25323DC3EA41359AD7146AF598B2070A0BF4C85FF998893FA100060D77",
        "Free - components place no restrictions on which threads or how many threads can enter the object. The object cannot contain thread-specific data and must protect its data from simultaneous access by multiple threads. Free-threaded components however, cannot be accessed by apartment threads directly, and calls to them are marshaled across from the client apartment.",
        "The path to the configuration of the service.",
        "DOT11_ROAMING Flag",
        "Restore operation requires subsequent detach",
        "3221232509",
        "The ProductType property indicates additional information about the system. This member can be one of the following values: ",
        "DOT11_ASSOCIATE",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2167.1101948841.368",
        "KernelIdleStateChange",
        "NewCredentials",
        "Note that this method's function overlaps with the RequestedState property. RequestedState was added to the model to maintain a record (i.e., a persisted value) of the ",
        "The time (in milliseconds) spent processing this job.",
        "CR_524EAE20B913314A702A0EBDD5A10C21EED93FAAED87245845E0CDD9834CDE3F",
        "Argument",
        "IR_866A032D6B2FE1717CF10787541C36C6A6484D51105E647FF1A0225D5CEBCD96",
        "object:MSFT_CliVerb",
        "Property for controlling DNS client query policy.",
        "347FC1E4EBDFB8267FE065E5721.1576.1566409741.413",
        "MsftDiscFormat2StreamRandom_DebugGeneral",
        "EngagedRestartSnoozeSchedule",
        "FX_TRACE_USB_IOTARGET",
        "CR_D2A706123FEDDDB0E412FDF2001A3E316EB3BAC437EDAC79D66B7AE69CAEFF59",
        "RD_TRACE_DEVICE",
        "The name of the event log type where the event was logged. E.g. Application, System.",
        "ROOT\\default#",
        "Configuration related to the BranchCache content server role",
        "Applied Order",
        "SDBUS_DEBUG_FAIL",
        "WmiQueryPhysicalMediumTypeEx",
        "SourceVirtualDisk",
        "__SecurityRelatedClass",
        "DUE_FULL_SCAN",
        "I_0A4A8CC499F46BAAE9FF49E6D68BB631793D5F6FAD2719C0358ED54A87A84829.1607.1929139302.263",
        "SAM Remove Member From Alias",
        "HEALBITMAP Flag",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmMediaType",
        "NdisStatusDot11AssociationCompletionIndication",
        "NS_3FBDCB08ECD33FBEF028D2DB3EF058F8CE959779B943F43AB3DB3EC34ACA147D\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_84DAE394D72EEC44948504C5752A6FB488C2F34AF0DDE614A4D6BA8E4EF415791151",
        "The SID of the trustee in string format (e.g., S-1-1-0)",
        "NTSC J",
        "Creates a timer to call into LCM to send reports after every ReportingTimerValue minutes.",
        "TM_ARPND",
        "PNP_REGISTRY_VERBOSE_LEVEL",
        "CD_8B9C64D6F0CAE8DF209DA22B283F97ABF536FD5C8E4A2B26F552B4E6C866C08D.1190.2947691819.302",
        "{F0B752E8-DB30-11d2-85FC-0000F8102E5F}",
        "Information Modification",
        "CIM_PhysicalFrame is a superclass of rack, chassis and other frame enclosures, as they are defined in extension classes. Properties like visible or audible alarm, and data related to security breaches are in this superclass.",
        "This parameter allows the user to specify the replica target subsystem when setting up a relationship with another subsystem.",
        "PerfCtr",
        "The Report instance object UniqueId.",
        "TROJAN",
        "EOTWarningZoneSize",
        "CIM_View",
        "An association between a service access point and how it is implemented. The cardinality of this association is many-to-many.  A SAP may be provided by more than one logical device, operating in conjunction.  And, any device may provide more than one service access point. When many logical devices are associated with a single SAP, it is assumed that these elements operate in conjunction to provide the access point.  If different implementations of a SAP exist, each of these implementations would result in individual instantiations of the service access point object.  These individual instantiations would then have associations to the unique implementations.",
        "LPTPortMapping",
        "GTFSupported",
        "CR_C089BE570AD24F592E44F1AB17521DCC9203176DB1FE73F89D8F1D13C2998CF4",
        "RequireSignatureConfirmation",
        "Select * from Win32_Directory",
        "AddPhysicalDisk2",
        "The CIM_VideoSetting class associates the CIM_VideoControllerResolution setting object with the controller to which it applies.",
        "FILE_READ_DATA (file) or FILE_LIST_DIRECTORY (directory)",
        "CD_B23B95CC62B7FE1710548CD8E1F8EA0575C88F97DB71C9F2CD52A08E2E5CF281.1667.4031264349.594",
        "The MediaType property indicates the type of media used or accessed by this device. In this class, the value will always be \"CD-ROM\". ",
        "CD_0D9683B316E22A1A30127D06C57766F844EEB6AAA1805E5281206E24CF5C1BAE.2389.192565331.3121",
        "The number of PDUs the NIC receives without errors and indicates to bound protocols.",
        "Use DES Key Only",
        "The Create method creates a new process. ",
        "ACPI _CSD",
        "This method adds a mount path or drive letter ass",
        "CR_9226DE8FE74359C1BFD228B1593D6C5E10185F550FF2997587B5AB69BBBB9891",
        "y64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41",
        "DisableByName",
        "**typedef** Array of encryption types. This field is a variable length array.",
        "%RegistryKey%",
        "A9E6E4113BE6A1D690E2",
        "ReconnectTransportOnFailure",
        "{D3B1178A-DB29-11d2-85FC-0000F8102E5F}",
        "CloudExtendedTimeout",
        "An integer enumeration describing the type of error that occurred most recently. For example, single (value=6) or double bit errors (7) can be specified using this property. The values, 12-14, are undefined in the CIM Schema since in DMI, they mix the semantics of the type of error and whether it was correctable or not.  The latter is indicated in the property, CorrectableError.",
        "The ModulationBell property contains the command string used to instruct the modem to use Bell modulations for 300 and 1200 bps.",
        "TemplateName",
        "object:Win32_TSDiscoveredLicenseServer",
        "A string describing the manufacturer and operating system type - used when the operating system property, OSType, is set to 1 (\"Other\"). The format of the string inserted in OtherTypeDescription should be similar in format to the Values strings defined for OSType.  OtherTypeDescription should be set to NULL when OSType is any value other than 1.",
        "The number of PDUs the NIC cannot receive due to lack of NIC receive buffer space.",
        "NegotiatedSpeed",
        "LoaderPathSearchResults",
        "Determines how referrals are shared among peers.",
        "ISCSI_ERR_INVALID_LOGIN_REDIRECT_DATA",
        "Represents the Compartment for Microsoft TCPIP WMIv2 provider.",
        "Advertised",
        "DExcpt",
        "MSNdis_80211_NumberOfAntennas",
        "ChangePIN",
        "The Antecedent reference represents the physical memory array that implements the logical memory array.",
        "{576C3C56-DB36-11d2-85FC-0000F8102E5F}",
        "NtlmServerAccept_Start",
        "UTP Category 5",
        "ContinueConfiguration",
        "UserAccountControlStatus",
        "Valid Cache",
        "OtherLANType",
        "MSNdis_CoMediaConnectStatus",
        "MSFT_ExpressionValue_sint8",
        "CD_07175BBA4C96099E611E7C4DB8EA7DEC92B3AEAE5EC6DF957DB2495087F658D2.34.1801291789.491",
        "Too many Connections",
        "PublishingAllowServer5",
        "Indicates the number of bytes processed by this job so far.",
        "No Change",
        "// class in order to interface with the adapter. Implement one instance",
        "Template ID",
        "UnregisterAll",
        "InstanceContextMode",
        "String to be appended to the userAgent property value of the navigator object.",
        "TRACE_FLAG_ENUM",
        "EAAPI",
        "FixedDataVolume",
        "Voice E&M Feature Group",
        "{8502C4CE-5FBB-11D2-AAC1-006008C78BC7}",
        "LicensePackage",
        "This output parameter contains the minimum size that this partition can become. Note that if this method is run multiple times, this value can change slightly depending on the placement of various temporary files.",
        "11     This device failed. ",
        "EnableDisableHardwareFailurePrediction",
        "SupportBudgetEvents",
        "dnsHostName",
        "The frequency (in hertz) at the high end of the Input Frequency Range 2 of this Power Supply. A value of 0 implies DC.",
        "UnmapFile",
        "MsftDiscFormat2StreamInterleave_DebugConstructor",
        "MDM_Policy_User_Result01_Display02",
        "DOT11_KEYMGR Flag",
        "Using line based interrupts.",
        "PredictFailure",
        "If True, resets only the Performance Counters.",
        "Reference to the RSOP_IEAKPolicySetting.",
        "MS_NT_EVENTLOG_PROVIDER",
        "CIM_ProductProductDependency",
        "DHCPLeaseExpires",
        "PS_VpnConnectionTrigger",
        "StandardName",
        "OtherRecoveryAction",
        "This method allows the storage tier to be renamed.",
        "MessageOriented",
        "The ordering for data stored in the ErrorData property. \"Least Significant Byte First\" (value=1) or \"Most Significant Byte First\" (2) can be specified. If ErrorTransferSize is 0, then this property has no meaning.",
        "The AccountExpires property specifies when the account will expire. This value is calculated from the number of seconds elapsed since 00:00:00, January 1, 1970, and is set in this format: yyyymmddhhmmss.mmmmmm sutc.",
        "SenseBuffer",
        "GetDictionaryAttackParameters",
        "This value is most appropriate for use with business logos or other ",
        "CR_A7642BB5BD25E38C8455D7FA5B5711E5CBB864E5CBFEC400B5BACCE7267F35B4",
        "ConfigurationDialog",
        "Splitting",
        "Win32_RemoteAppChangeEvent",
        "TEST_TRACE_RESERVED_10 Flag",
        "TM_PLGEXT",
        "      <registryValue name=\"TrustLevel\" valueType=\"REG_DWORD\" value=\"0x00000000\"></registryValue>",
        "MuiTraceData",
        "SupportedOnlyWhenDischarging",
        "Debug_Only_This_Process - If not set and the calling process is being debugged, the new process becomes another process being debugged by the process of the calling debugger. If the calling process is not a process being debugged, no debugging related actions occur.",
        "Spp Write Count",
        "Sw Ecp Read Count",
        "MaintenanceSettings",
        "NISSignatureVersion",
        "I_F65757B9154C5EBDDAE70D4285BD74985CCB42751F841E9E56AE020776DD15BB.579.1.61471",
        "ref:MSFT_SomFilter",
        "// This class is optional.",
        "SDBUS_DEBUG_INACTIVITY",
        "RSOP_ApplicationManagementCategory",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_61E669D3482C420F68FA27C086C8D9EDD1797B7765A7ADEF6912A148755E11FD",
        "WakePacketType",
        "Real-time scan direction enumeration",
        "troller.",
        "Values: TRUE or FALSE. A value of TRUE indicates the service can be paused.",
        "'!gF-",
        "HomePNA",
        "MSNdis_StatusDot11AssociationCompletion",
        "Enables or Disables the PromptForPasword flag if it is not under group policy.",
        "SystemConfig_V2_Services",
        "SetupFile",
        "FAST_IO_CHECK_IF_POSSIBLE",
        "{69aaa7c4-2062-11d4-97eb-00c04f79c403}",
        "Win32API|Device Input and Output Structures|SCSI_ADDRESS|PathId",
        "MIF.DMTF|Memory Device|002.8",
        "ref:CIM_Configuration",
        "The Recursive input parameter is a boolean that indicates whether the change of ownership will be applied recursively to files and directories within the directory specified by the CIM_LogicalFile instance.Note for file instances the Recursive input parameter is ignored.",
        "Worst-case transition latency in microseconds",
        "Includes non-error cases",
        "Count of Login Redirect Responses",
        "The VariableValue property contains the placeholder variable of an environment variable. ",
        "This method will add one or more physical disks from the primordial storage pool to an existing concrete storage pool.",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pPrintProcessor",
        "{8F680852-A584-11d1-BF38-00A0C9062910}",
        "{B24EF561-BBBE-11d2-ABFB-00805F538618}",
        "LocalEndpoint",
        "Software ID if event was generated by software",
        "AdditionalDescription",
        "PolicySourceEnableDFSS indicates whether the property EnableDFSS is configured by Server(0) or Group Policy (1).",
        "SecurityClient",
        "DriverDateData",
        "RegisterDNS",
        "object:MSFT_NetLbfoTeam",
        "49007",
        "46004",
        "precedence",
        "TxRGUID",
        "CreateVirtualDisk requires only FriendlyName and Size to be specified. Sizes can be specified explicitly through the Size parameter, or you can use the maximum available space from the storage pool by specifying the UseMaximumSize parameter. Both FriendlyName and Size are treated as goals rather than hard requirements. For example, not all SMI-S based arrays support custom friendly names; however, the virtual disk creation will still succeed. If the size specified is not achieved, the actual size used for the virtual disk will be returned in the out parameter structure. ",
        "TL_ERROR Flag",
        "AllowSavingHistory",
        "MonthOfYear",
        "SamCompPwdSet",
        "DontForward",
        "This method is used when a user wants to explicitly discover or re-enumerate objects owned by the storage provider. A call to this method could result in a full or partial cache invalidation and over-the-wire calls to the storage subsystem(s) in order to discover new or updated objects. As this is a time consuming task, it should be used sparingly by the user.",
        "MSFT_NetBadAccount",
        "TRC_INFORMATION",
        "Field Emission Display",
        "Set's the ColorDepth property to one of the following possible values 1 = 8 bits, 2 = 15 bits, 3 = 16 bits, 4 = 24 bits and 5 = 32 bits.It returns an integer value of 0 if call was a success in case of Server-Override mode and an error if the setting is under group policy control.",
        "The PrintTestPage method prints a test page. The method can return the following values:",
        "LastStopTime",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2167.2887667098.188",
        "The QuotaVolume reference represents the disk volume which has disk quotas.",
        "6..32767",
        "Voltage sensor (electronic voltmeter) data management.",
        "EmptySpecifiedLicenseServerList",
        "IsCompressionEnabled",
        "CD_ED2E871CAA85DB91DA82D43856C298DADCDDAA2D7C9D06C8655F1779E6509A4E.34.2696675514.522",
        "executionTime",
        "The FlowControlOff property contains the command string used to disable flow control. Flow control consists of signals sent between computers that verify that both computers are ready to transmit or receive data.",
        "C_A09DF16E80CB8250C7E8F768EDC2F0DB283873E2BF1AF5FB3DCD5C1A024C9766",
        "HttpsHelpPageUrl",
        "BackgroundSyncEnabled",
        "Limit Priority Class - Causes all processes associated with the job to use the same priority class. ",
        "The Tag property contains a string that uniquely identifies the physical memory device.",
        "Hypervisor Enforced Code Integrity",
        "CIM_Product.Vendor",
        "MIF.DMTF|System Hardware Security|001.4",
        "ContactITDescription",
        "ServerSessions",
        "object:MSFT_ResourceNotInDesiredState",
        "AllowScreenCapture",
        "Removal Cause",
        "UseRDEasyPrintDriver",
        "R_E0068A669A82F8C2F714C6C4A97E7D76641D2A61061D9F5753AD2A31EAF1F777.2457.746639331.554",
        "Maximum VSync numerator (in Hz)",
        "MSNdis_TokenRingCurrentGroup",
        "NumberofDiscoveredPorts",
        "ref:CIM_LogicalElement",
        "The Sid property is the security identifier representing the user context under which the event happened.",
        "Communications Subsystem Failure",
        "TM_ME Flag",
        "AddLink",
        "The user-friendly name for the current management firmware on this physical computer system.",
        "Soft error can be returned by intrinsic methods (EnumerateInstances, GetInstance, etc.) to help distinguish between a query with no results (no error) and a query that failed for a specific reason.",
        "PortSubClass",
        "C_99526796DD78031C7C2FAD6BF8D8F64825A2F3F58DED87A8E35BA27BB08D1659",
        "{24783E8A-DB31-11d2-85FC-0000F8102E5F}",
        "MaxClockSpeed",
        "PinInfo",
        "0x002 ",
        "CD_3F67FA0166F0C8A24B462CDA43C543F340CD7BDE061E1F57A0BF997BF74531EB.15.236894778.3175",
        "The interval of time that indicates how long the messages processed by this binding can be in the queue before they expire.",
        "Correctable memory log disabled",
        "ISCSI_ERR_LOGIN_FAILED",
        "CD_BF60071AF2C3DDF2AED3F8F1BE212D887152724D7DDF24F313DABC672EFA8F5F.1836.856278439.255",
        "CD_B6A3DCDB97084B5AC4FE4FED6FDDF2AC8904E59EA78E2E887EC614E42011F697.2059.2506730865.3406",
        "The maximum number of days a cache entry is valid in the data cache.",
        "A free-form string that can contain a vendor-specific error description if the action failed.",
        "Win32_ODBCSourceAttribute",
        "TargetFailureAddr",
        "IL_E3D6956C9AC5D82845A5B017A22EF25487755E3C3A9322BE0116D0C7010A0C20.569.1.55789",
        "HBA Session Default Configuration",
        "Generic DNS Servers",
        "Specifies the allocation unit size in bytes for this storage tier.",
        "List of Connections",
        "NdisCoMediaSupported",
        "MIF.DMTF|Power Supply|004.19",
        "Current scan mode. \"Interlaced\" (value=3) or \"Non Interlaced\" (4) can be defined using this property.",
        "C_13091E3C3054BC345002416FA26EA86BA000D8B72D69780944E68B3A51252A0B",
        "DefaultGateway",
        "Select * from Win32_UserAccount",
        "BranchReadinessLevel",
        "AutomaticiSNSDiscovery",
        "DDR2 FB-DIMM",
        "{BD568F21-FCCD-B948-054E-DB3421115D61}",
        "Microsoft.MSI",
        "wsp_sr",
        "AllowBuildPreview",
        "The domain portion of the account",
        "endtime",
        "MIF.DMTF|System Resource DMA Info|001.3",
        "ADSIPath",
        "EmTargetName",
        "The IP protocol filter condition. If set to 0, then all the following fields are ignored: IPPortMatchCondition, IPSrcPrefixMatchCondition, IPSrcPortStartMatchCondition, IPSrcPortEndMatchCondition, IPDstPrefixMatchCondition, IPDstPrefixMatchCondition, and IPDstPortEndMatchCondition.",
        "UF_TEMP_DUPLICATE_ACCOUNT - Local user account for users whose primary account is in another domain. This account provides user access to this domain, but not to any domain that trusts this domain.",
        "DayOfWeek",
        "0xEFFF000D",
        "25 Pin Dual Inline",
        "TargetElementSupplier",
        "TotalCacheMemoryPerTask",
        "A list of IndicationIdentifiers whose notifications are correlated with (related to) this one.",
        "The VI Program ID associated with this Class ID.",
        "DSCP (RFC 2474) marking for unauthenticated inbound IPv6 IPsec traffic. Value must be <= 63",
        "NVGRE",
        "NodeAddress",
        "The number of frames a NIC fails to transmit.",
        "SetDefaults",
        "Limit Scheduling Class",
        "CD_16D6E45D9DC3C2448BBB5DF12E5A17B75BBAD53607DFAC1CCE27C411AB0AEA61.2045.1.11747",
        "InstallSource",
        "Detached",
        "Triggers",
        "Paswword Can't Change",
        "XWIZARD_TRACE_GUID",
        "The ServerName property indicates the cluster server on which the share is hosted ",
        "3221232481",
        "0)m;0)m;",
        "MIF.DMTF|System Resource Memory Info|001.5",
        "MSFT_TaskRegistrationTrigger",
        "CurrentState",
        "Defines the maximum settable communication speed to the COM port for an external modem. Enter 0 if not applicable.",
        "The ErrorAccess property indicates the memory access operation that caused the last error. This property is valid only when ErrorInfo is not set to 3.",
        "The BaudRate property indicates the baud rate for this serial port",
        "Service suspends source I/O when necessary",
        "Valid to date of the issued certificate",
        "ExclusiveRightsGranted",
        "    ISCSI_NIC_LINKSTATE_CONNECTED = 1",
        "Contains the key name to set the security descriptor on. ",
        "MDM_Policy_User_Result01_Printers02",
        "PartitionStyle",
        "The total size of the disk, measured in bytes.",
        "Common Flag",
        "MaxSharedReceiveQueueCount",
        "Win32_NamedJobObjectActgInfo",
        "MSNdis_ReceiveQueueInfoArray",
        "CD_5E4C61B5F4870A86C87C8D3A31C679CD8547F13761DF48FEE0C77BF5C516F817.1186.1620012873.352",
        "CD_1A3FB2187E23B82908958F340DD0F5EA4D8685478FCE0E52ADA73DFC114F95DA.2112.4162611070.504",
        "\\\\.\\root\\cimv2\\power:__Win32Provider.Name=\"PowerMeterProvider\"",
        "NoWriters",
        "SetVirtualDisk",
        "Not Dedicated",
        "DiskSpaceLimitEnabled",
        "{0b6d3c89-5917-43ca-b578-d01a7967c41c}",
        "NIC Switch Current capabilities of the adapter",
        "DOT11_SCAN",
        "CD_F4663152AE3837F467703D43AFBBB6630C1BA3529FA8A88B46C0496F26CBAAD5.67.2097169677.705",
        "CD_EAAD7B12E42E8FD5A718C58D486924CE945F2F9D6534A799FEB67D3ED29E5A5B.1783.3509764794.707",
        "MDM_Policy_Result01_MSSLegacy02",
        "SamConnect_End",
        "SystemCreationClassName",
        "DaysToRetainCleanedMalware",
        "    <registryKey keyName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\InstallService\\OEMDiscovery\">",
        "CR_8B5A6B942AA5416825152D8055EE6894FDA3E8C591F37D309F86A2C72141DDBF",
        "Win32API|Printing and Print Spooler Structures|JOB_INFO_4|pDocument",
        "Specifies the allocation unit size in bytes for this virtual disk.",
        "Flags passed to the providers. reserved for future use.",
        "6EDCAD2493CB9C9AE066E77642818C8D9B9BC312C7B4C3A76A07871F0E60FEB1",
        "{94335eb3-79ea-44d5-8ea9-306f49b3a041}",
        "The new GPOSession for the rule.",
        "CIM_PhysicalComputerSystemView.OtherDedicatedDescriptions",
        "The MaximumSize property indicates the maximum size of the registry. ",
        "A system resource of the computer system.",
        "MIF.DMTF|Sequential Access Devices|001.2",
        "The IPSecPermitTCPPorts parameter specifies the list of ports that should be granted access permission for TCP. A numeric value of zero indicates access permission is granted for all ports. An empty string indicates that no ports should be granted access permission.",
        "SAM Open User",
        "MIF.DMTF|Storage Devices|001.11",
        "{6C683A5C-32B8-47cd-AC28-4B292414D032}",
        "MaxSessionPerConnection",
        "MSFT_DtcClusterDefaultTask",
        "Specifies the most significant bits of the LUID.",
        "{8502C4D7-5FBB-11D2-AAC1-006008C78BC7}",
        "Specifies the number of complete data copies to maintain for this virtual disk. If specified, this value will override the NumberOfDataCopiesDefault value that would have been inherited from the resiliency setting specified by ResiliencySettingName.",
        "TM_INTERNET Flag",
        "3221232475",
        "LockedDownInternetZoneAllowSmartScreenIE",
        "Flag to indicate whether a GPO passed the filter check.",
        "IpV6ScopeId",
        "NetQosCim",
        "IL_41CD80BFBD3EF2A72B1311F93D87AFDE77273A97897B7B012F0BFA851DE8E60A.154.1130414801.297",
        "IsDataDigest",
        "Hive Size",
        "The Comment property contains a comment supplied by the network provider.",
        "Win32API|Service Structures|QUERY_SERVICE_CONFIG|lpDependencies",
        "Ethernet CSMA/CD",
        "MDM_EnrollmentStatusTracking_PolicyProviders03_01",
        "CIM_NetworkPort.OtherPortType",
        "Kernel Model Time",
        "EVENT_TRACE_FLAG_FASTIOCHECKIFPOSSIBLE",
        "DesiredStorageTier",
        "The ProviderOperation_ProvideEvents property indicates the number of calls to IWbemEventProvider :: ProvideEvents.",
        "method that produces well defined borders ",
        "3.5, 120M Floppy",
        "IntendedConsumer",
        "8 - Unknown failure",
        "Services (CIM)",
        "50001",
        "MaxReturnPathLifetimeSeconds",
        "IsPowerProtected",
        "ITU X.3 Terminal PAD",
        "ProvisioningTypeDefault",
        "pathToCaller",
        "MIF.DMTF|Temperature Probe|001.16",
        "Example: 63",
        "ref:CIM_DMA",
        "AllowDeveloperUnlock",
        "Example: 300",
        "MachineCertificateIssuerFilter",
        "TimeWritten",
        "A boolean value that specifies if security should be enabled with insecure transports.",
        "MsftDiscFormat2Erase_DebugGeneral",
        "Win32_CreateFolderAction",
        "DefaultInboundAction",
        "MSFT_StoragePoolToVirtualDisk",
        "Name of the item without its preceding parent folders.",
        "An array of free-form strings providing more detailed explanations for any of the video accelerator features indicated in the Capabilities array. Note, each entry of this array is related to the entry in the Capabilities array that is located at the same index.",
        "Number of bytes for link state status indication",
        "A system set, user-friendly, display-oriented string which describes the resiliency setting.",
        "The Queued property indicates whether the printer buffers and queues print jobs.",
        "Stack2",
        "UltraSPARC IIi",
        "RadioSoftwareVersion",
        "The local machine port the SA applies to, or 0 for all ports.",
        "Values: 1 (true) or 0 (false). If true, hardware error correction is supported.",
        "HKEY_CURRENT_USER 01",
        "AccessMethod",
        "MSFT_VirtualDiskToPhysicalDisk",
        "Longitude",
        "Add or Remove to group requires Fractured state",
        "CD_EB78AA3AB0AAD297911A31C4BE3F414FA271AE65201757FD6A0D70088B508E8E.1541.3876614604.490",
        "CD_FB60C1AF4D6C46482A1812E45C6387D7979085C05A1408B5980C3DA6770C2B4A.1595.4220938855.785",
        "CIM_Component",
        "PLATFORM_TARGET_ID",
        "Disable this rule.",
        "NextHop",
        "{d804a67f-4c25-43c1-896f-89ff78b3a911}",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSNETWORKADAPTERLISTSETTING_Prov\"",
        "Example: 20480.",
        "The SetTcpUseRFC1122UrgentPointer method is used to specify whether TCP uses the RFC 1122 specification for urgent data, or the mode used by Berkeley Software Design (BSD) derived systems. The two mechanisms interpret the urgent pointer in the TCP header and the length of the urgent data differently. They are not interoperable. Windows 2000 and Windows NT version 3.51 or higher defaults to BSD mode. The method returns an integer value that can be interpretted as follows: ",
        "QuotasDisabled",
        "// The total number of negotiation failures that occurred during main mode (also known as Phase I) or quick mode (also known as Phase II) negotiation.",
        "Auto Configuration Proxy URL",
        "A StorageVolume is an Extent that is presented to the Operating System (for example, by a hardware RAID cabinet), to a File System (for example, by a software volume manager) or to another entity. StorageVolumes do NOT participate in StorageRedundancy Groups. They are directly Realized in hardware or are the end result of assembling lower level Extents.",
        "WriteCorrectionAlgorithmProcessed",
        "ExcludeOperationalLog",
        "WinLogon",
        "MSFT_NetServiceStartHung",
        "bbnSpfIgp",
        "This property is set as the result of a method invocation (such as Start or StopService on CIM_Service), or can be overridden and defined as WRITEable in a subclass. The method approach is considered superior to a WRITEable property, because it allows an explicit invocation of the operation and the return of a result code. ",
        "An integer enumeration describing the type of flat panel display.",
        "AccountLogonLogoff_AuditAccountLockout",
        "InitiatorNode",
        "Name of device powered on",
        "DS1 Facility Data Link",
        "HNet_FirewallLoggingSettings",
        "DOT11_AUTOCONF Flag",
        "The Win32_PrinterDriver class represents the drivers for a Win32_Printer.",
        "IR_F8B808D7A9252DEF065341C8B8313C296ECB08839CCF4A94507BC66DA5D3F382",
        "The new policy store for the set.",
        "HelpLink",
        "5 - 'Predictive Failure': The volume is functioning, but a failure is likely to occur in the near future.",
        "Client SID",
        "The output is an array of CIM objects of type MSFT_WdacBidTrace, each of which represents a WDAC BidTrace setting.",
        "NetConnectionStatus is a string indicating the state of the network adapter's connection to the network. The value of the property is to be interpreted as follows:",
        "Destination Host Unreachable",
        "Last Dropped Event Times",
        "MaskingOneInitiatorIdPerView",
        "The Flags parameter contains a set of flags to shut the computer down.  Setting this parameter to 0 is the command to logoff.",
        "MDM_Policy_Result01_FactoryComposer02",
        "SetTrustedDomainInfoByName",
        "KernelHypercall",
        "DesiredSpeed is the currently requested fan speed, defined in revolutions per minute, when a variable speed fan is supported (VariableSpeed boolean = TRUE). The current speed is determined via a sensor (CIM_Tachometer) that is associated with the fan using the CIM_AssociatedSensor relationship.",
        "EnableStealthModeForIPsec",
        "Array of V6 addresses",
        "KEY_CREATE_SUB_KEY (0X0004) ",
        "IMAPI2FS Tracing",
        "#define HBA_EVENT_PHY_STAT_THRESHOLD    0x351",
        "Characteristics",
        " Where ServerName = '#'",
        "MSNdis_EthernetReceiveErrorAlignment",
        "WorkerThread_StartStop_V2",
        "5 - Access denied.",
        "{2484dc26-49d3-4085-a6e4-4972115cb3c0}",
        "The CancelAllJobs method cancels and removes all print jobs from the printer queue including the job currently printing. The method can return the following values:",
        "MSNdis_StatusHDSplitCurrentConfig",
        "New Allocation Address",
        "NDIS Query RSS Capabilities",
        "0xD009 - 'Not Installed': The element is not present. ",
        "CR_2C912D30C6F2C9872585F2917A9F51466121BD73DCC0AA6A9A6D8C6362427472",
        "Given the addition of the CurrentState and PossibleStates properties to Sensor, the DiscreteSensor subclass is no longer necessary, but is retained for backward compatibility. Information in the CurrentReading and PossibleValues properties will typically have the same values and semantics as for the CurrentState and PossibleStates properties, inherited from Sensor.",
        "Local Storage",
        "Int 13h - Japanese Floppy for Toshiba 1.2mb (3.5\", 360 RPM) is supported",
        "MaximumOutputBufferSize",
        "TcpWindowSize",
        "Optional. For access to a remote computer using DCOM, this parameter specifies the computer name. One example is 'myserver'. If you do not provide this parameter, the call defaults to the local computer.",
        "EtherType",
        "The InUseCount property is an integer indicating the number of 'file opens' that are currently active against the file.",
        "Thread Pool Event",
        "HideRansomwareDataRecovery",
        "PersistenceOperationTimeout",
        "MSFT_NetServiceLogonTypeNotGranted",
        "MSNdis_StatusLinkState",
        "\"No Contact\" indicates that the monitoring system has knowledge of this element, but has never been able to establish communications with it. ",
        "MSFC_LinkEvent",
        "ISO 802.5 Token Ring",
        "NDIS Dot11 Association Completion Status Indication",
        "\"Servicing\" describes an element being configured, maintained, cleaned, or otherwise administered. ",
        "The number of currently queued print jobs for this printer.",
        "inpartition",
        "WIN98",
        "Values:TRUE or FALSE. ",
        "Address is a free-form string indicating a street, building or other type of address for the physical element's location.",
        "MSFT_StorageNodeToVolume",
        "This class provides the ability to detect an application and inventory of applications",
        "A class derived from redundancy group containing mass storage-related redundancy information. Storage redundancy groups are used to protect user data.  They are made up of one or more physical extents, or one or more aggregate physical extents. Storage redundancy groups may overlap.  However, the underlying extents within the overlap should not contain any check data.",
        "SetByPrincipal",
        "Single",
        "      <overridable name=\"Start\" scope=\"Microsoft\" type=\"REG_DWORD\"></overridable>",
        "UpdateServiceUrlAlternate",
        "The total logical size of all files on the volume, in bytes. This is an estimate of the volume used space if deduplication feature was disabled.",
        "iScsiFlagScsi Flag",
        "The ColorTableEntries property indicates the number of color indexes in a color table for a video display. This property is used if the device has a color depth of no more than 8 bits per pixel. For devices with greater color depths, -1 is returned.",
        "GetSynchronizationAspects",
        "SuperclassName",
        "MSFT_StorageNodeToPhysicalDisk",
        "Requests a reboot of the operating system. The return value should be 0 if the request was successfully executed, 1 if the request is not supported and some other value if an error occurred.  The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier.",
        "StructuredBootString",
        "The ReplyInconsistency property reports inconsistent reply data.",
        "Starts the background task specified by the user",
        "Query Port State",
        "A DMA channel of the computer system.",
        "LsoV1",
        "NoVfBarSpace",
        "0x000020",
        "SetAttributes3",
        "If true, do not allow users to log in with temporary profiles.",
        "The GUID that identifies a KMS client to a KMS host. The client includes this in requests it sends to the KMS.",
        "The short address of the NIC encoded in the hardware.",
        "EnableUserVhd",
        "A return code of 3 shall indicate that the state transition cannot complete within the interval specified by the TimeoutPeriod parameter. ",
        "Values TRUE or FALSE. If TRUE, transmission stops when the XOffCharacter is received and starts again when the XonCharacter is received.",
        "{81d1303c-ab00-4e49-80b1-5e6e0bf9be53}",
        "NS_3CE8582EE8FFA928E42F84B5CDF7241A25C3C463C6F6E68C9EFB47A560BAD872\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_010FE08CC153DC11B4971C18AA25B426DA166841A530748D5F8B5C0F7FA99E8E",
        "The Win32_Bus class represents a physical bus as seen by a Win32 operating system. Any instance of a Win32 bus is a descendent (or member) of this class.",
        "TakeOwnerShipEx",
        "0xC0050057",
        "PDUs Sent",
        "CIM_Error.MessageArguments",
        "This specifies the number pre-authentication attempts to try on neighboring Access Points.",
        "I_2E857E8085C23F260E4A5714870E085AF1A5EB43D390A00657752F8ABAC8FA75.2459.2781981217.352",
        "MIF.DMTF|Physical Memory Array|001.13",
        "object:MSFT_TaskNamedValue",
        "Operations",
        "LetAppsAccessCamera_ForceAllowTheseApps",
        "Antispyware Last updated local time. If this has never updated you will see a null value in this property",
        "The ErrorInfo property contains an integer enumeration describing the type of error that occurred most recently.  The values, 12-14 are not used with this property. These values indicate whether an error is correctable but this information is found in the CorrectableError property.",
        "ROOT\\StandardCimV2\\MS",
        "MDM_Policy_User_Config01_Desktop02",
        "LPCDRVR_TRACE_RESERVED_08 Flag",
        "One of the following values: - Disabled: Disable rtt resiliency for non sack clients. - Enabled : Enable rtt resiliency for non sack clients.",
        "UevConfigurationProvider",
        "Chkntfs.exe",
        "NetworkItemFactoryTrace",
        "Specify the exclusions for Attack Surface Reduction Rules.",
        "0xC005004B",
        "AnnounceComment",
        "NumberOfTokensInUse",
        "MSNdis_ReceiveFilterInfo",
        "The parameter(s) to be reloaded to default settings",
        "RSOP_PolmkrFileSetting",
        "PackageLocation",
        "object:MSNdis_PortChar",
        "CIM_RunningOS indicates the currently executing operating system. At most one operating system can execute at any time on a computer system. 'At most one' is specified, since the computer system may not be currently booted, or its operating system may be unknown.",
        "VPN server address class",
        "Note that HKEY_DYN_DATA is a valid tree for Windows 95 and Windows 98 computers only. ",
        " The CIM_SwapSpaceCheck class specifies the amount of swap space  that needs to be available on the system. The amount is  specified in the SwapSpaceSize property.  The details of this checks are compared with the  corresponding details found in a CIM_OperatingSystem  object referenced by CIM_InstalledOS association for the  CIM_ComputerSystem object describing the environment.  When the value of TotalSwapSpaceSize property is greater  than or equal to the value specified in  SwapSpacesize, the condition is satisfied. ",
        "SessionFormatErrorCount",
        "0x208",
        "LprByteCounting",
        "The SetIPXFrameTypeNetworkPairs method is used to set Internetworking Packet Exchange (IPX) network number/frame pairs for this network adapter. Windows 2000 and Windows NT 3.51 and higher use an IPX network number for routing purposes. It is assigned to each configured frame type/network adapter combination on your computer system. This number is sometimes referred to as the \"external network number.\" It must be unique for each network segment. If the frame type is set to AUTO, the network number should to zero. The method returns an integer value that can be interpretted as follows: ",
        "{74a75b03-36d8-ede6-d10e-95b691503408}",
        "To show whether to neighbor discovery is supported. Two possible values: - No - Yes",
        "The Win32_PhysicalMemoryArray class represents details about the computer system's physical memory. This includes the number of memory devices,  memory capacity available, and memory type (for example, system memory or video memory).",
        "AntimalwareHealthStatus",
        "The type of the ODBC DSN to retrieve. Possible values are 'User', 'System' or 'All'. The default is 'All'.",
        "Win32API|Communication Structures|DCB|fNull",
        "TIME_CREATED",
        "WakeDropPreserveProcess",
        "TrustedSitesZoneJavaPermissions",
        "Association between StorageNode and Volume.",
        "A user confirmation is sought by default by this cmdlet. If -Force is specified, the default confirmation is not sought from the user.",
        "{f6027ab3-a560-4222-a48c-3f572a6967a7}",
        "LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents",
        "CIM_ProtocolEndpoint.ProtocolType",
        "InternetZoneAllowUpdatesToStatusBarViaScript",
        "PLATFORM_TRACE_RESERVED_1d",
        "TcpIp Fail",
        "PSExtentStripeLength",
        "C_25951CCF498736F09F8CDC3085BB276C2817DE47EF5312A0F051C1AC3B67B2CE",
        "Example: 324",
        "SetTcpUseRFC1122UrgentPointer",
        "Opt In",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_6325C5C96DFD6B51FE5D97621FD65EC8FE5EA211AEF50ECB08E778B30E57BCAC",
        "MSFT_NetTransportFilterTCPSetting",
        "- \\'First Matching\\' (1) executes the actions of the first rule whose conditions evaluate to TRUE. The concept of \\'first\\' is determined by examining the priority of the rule within the policy set (i.e., by examining the property, PolicySetComponent.Priority). Note that this ordering property MUST be maintained when processing the PolicyDecisionStrategy. ",
        "Represents the Interface class of Microsoft TCPIP WMIv2 provider.",
        "R_93D683378335762C284317F9836C36B73320C30A8A815437365079222449D208",
        "PoolNonpagedBytes",
        "NDIS Query PCI Device Custom Property",
        "The User property references the active user at the time the event was logged.",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{GUID}[ServiceParameters]",
        "Most Frequently Used (MFU)",
        "The Disable-AppBackgroundTaskDiagnosticLog cmdlet allows users with Administrator access to disable background task related logging in Event Viewer.",
        "The name of the service configuration.",
        "iScsiFlagPnP Flag",
        "Pre-shared Key",
        "Values: TRUE or FALSE. If TRUE, the user account is locked out.",
        "Horizontal polarity type",
        "{d63a5850-8f16-11cf-9f47-00aa00bf345c}",
        "Stack23",
        "Counter6",
        "MaxOutboundConnectionsPerEndpoint",
        "On Demand Clsid",
        "L2GPStore Trace",
        "Split",
        "ExposedPath",
        "Ndis80211DataRate",
        "SetDisablePauseUXAccess",
        "ESCD Support",
        "IPX Address",
        "DisableTpmFirmwareUpdateWarning",
        "{96b827a7-2b4a-49c8-9097-078200c5a5cd}",
        "This method is deprecated and will return WBEM_E_NOT_SUPPORTED without doing any operations.",
        "The software element.",
        "EndingAddress",
        "The StartName property indicates the account name under which the service runs. Depending on the service type, the account name may be in the form of \"DomainName\\Username\".  The service process will be logged using one of these two forms when it runs. If the account belongs to the built-in domain, \".\\Username\" can be specified. If NULL is specified, the service will be logged on as the LocalSystem account. For kernel or system level drivers, StartName contains the driver object name (that is, \\FileSystem\\Rdr or \\Driver\\Xns) which the input and output (I/O) system uses to load the device driver. Additionally, if NULL is specified, the driver runs with a default object name created by the I/O system based on the service name.",
        "WhqlProvider",
        "First Party Privacy Type Text",
        "Non Facility Associated Signaling",
        "pathID",
        "No parity",
        "TotalTracks",
        "OwnerPermissions",
        "8514A",
        "TSRDPShellTrace",
        "Used Space",
        "C_557539563EFEA085A51C933372B76B0DBDD1D1003F13AE16F6DC6CC216910E08",
        "DisallowHardTerminate",
        "{F3F3A266-DB32-11d2-85FC-0000F8102E5F}",
        "The Name property contains a character string specifying the name of a Win32 environment variable. By specifying the name of a variable that does not yet exist, an application can create a new environment variable. ",
        "LOCK_API",
        "Denotes the role of this controller port. For iSCSI, this port must act as either a target or an initiator endpoint. Other transports allow a port to act as both an initiator and a target.",
        "C_A20285D23E76CAA1A5AA4BB56A34542AD06AD62940A11046E81BFE8B238005B3",
        "Win32API|Service Functions|ChangeServiceConfig",
        "0xEFFF005F",
        "CIM_BindsToLANEndpoint",
        "C_ADECB48EEF41EBFB1D5570217FF2A1BA19BC73CECF67D875589C0486F35636B9",
        "MapFileDCStart",
        "WPD_Install",
        "DriverCompletionRoutine",
        "LocalChangeTime",
        "warning",
        "FlowControlEnabled",
        "NdisPMAdminConfigStateDisabled",
        "RDMAInFramesPerformanceCounterMissing",
        "{F3A5233A-E3D3-11d2-8601-0000F8102E5F}",
        "object:MSFT_BackgroundTask",
        "Phase Change Dual Rewriteable",
        "OleTxEndpointCid",
        "NetworkAdapterDescriptionList",
        "{A7DFE761-B6BC-4490-91B0-D9CF4A24D37C}",
        "PutInstance",
        "NeutralResources",
        "Alarm Received",
        "DesiredSpeed",
        "DllPathSearchResults",
        "{34d84181-c28a-41d8-bb9e-995190df83df}",
        "This field reports the minimum number of complete copies of data that will be maintained by the storage pool.",
        "GroupMask5",
        "R_C8D0F277D7F7D59AF0E214825AC68160FC59DD15097C20883A4D4AAFF0736D39",
        "The SID in binary format",
        "For a non-linear Sensor, the resolution, accuracy, tolerance and hysteresis vary as the current reading moves. This method can be used to get these factors for a given reading. It returns 0 if successful, 1 if unsupported, and any other value if an error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier.",
        "Heap SnapShot",
        "Loading of this processor, averaged over the last minute, in percent.",
        "Stack7",
        "MCA_MEMORYHIERARCHY_ERROR",
        "MSFT_DtcTransactionsTraceSettingTask",
        "ProgIdHint",
        "TimerInterval",
        "The new owner's SID.",
        "The ChangeSecurityPermissionsEx method changes the security permissions for the logical file specified in the object path. If the logical file is actually a directory, then this method will act recursively, changing the security permissions of all the fil",
        "Service",
        "If TRUE, take the device online, if FALSE, take the device OFFLINE.",
        "Filesystem directory entry management. ",
        "WINSTATION_QUERY=0x1",
        "AllowKeyboardTextSuggestions",
        "ref:CIM_ComputerSystem",
        "The Win32_ShortcutFile class represent files that are shortcuts to other files, directories, and commands.",
        "Volume has mount points",
        "The SystemVariable property indicates whether the variable is a system variable. A system variable is set by the operating system, and is independent from user environment settings.",
        "Dot11 MPDU Max Length Change status information.",
        "The Domain property indicates the name of the Windows domain to which the system account belongs.",
        "Audio",
        "ManufacturerName",
        "p$m;p$m;",
        "AGP Support",
        "The Name property indicates the name of the group account on the domain specified by the Domain member of this class.",
        "This field describes the type of alert being received.",
        "CIM_PhysicalComputerSystemView.LogOverwritePolicy",
        "WLAN AutoConfig Trace",
        "CD_8B69999466A9B0AA953868559581679FA4866B51DCA8E619279463BF323E73B7.1153.2810256203.1235",
        "_PSS States",
        "Maximum number of completion queues supported by the adapter",
        "C_9398EE9389657B6A830EB223CFE8021EDA6EBF0AE7CE6FA1ECC3991C40D9983D",
        "By default, the resiliency setting applied to this virtual disk will be whatever is specified in the storage pool's ResiliencySettingNameDefault property. This can be overridden using the ResiliencySettingName parameter. Note that the name given here must correspond to a resiliency setting associated with this storage pool. Any other value will result in an error. ",
        "Path not found",
        "MaximumComponentLength",
        "Background_Red",
        "KeepPrintedJobs - Specifies that the spooler should not delete documents after they are printed.",
        "Check Point Count",
        "object:__Event",
        "PasswordAge",
        "MDM_VPNv2_APNBinding02",
        "The Option input parameter specifies the actual security permission to be modified. Change_Owner_Security_Information - Change the owner of the logical file. Change_Group_Security_Information - Change the group of the logical file. Change_Dacl_Security_In",
        "PrecisionFactor",
        "OpTrustedDomByName_Start",
        "MS_SMHBA_SASPHYSTATISTICS",
        "41020",
        "Known Bad",
        "Operation is not allowed on specified special groups; user, admin, local or guest.",
        "DefaultWarningLimit",
        "{3a2e63d1-5dc4-4168-85ea-3e331f88ce83}",
        "Range 2",
        "EVENT_TRACE_FLAG_DEVICECHANGE",
        "MIF.DMTF|Partition|002.8",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_317D1F2687177AFA27CB8EA6F6A360902286E215810936DE250861D000157F69",
        "Image_V1_Load",
        "WifiDirectDisplay",
        "MSFT_PartitionToReplicaPeer",
        "The PrinterState property specifies a values indicating one of the possible states relating to this printer.",
        "Backup",
        "{CC0F48D2-C847-11d2-911E-0060081A46FD}",
        "CR_E367B12CF12DEB20E317AE3B028692F15635A4C17B759C34D4B8D5D615A27793",
        "WMI|Win32_Share",
        "SPACES_InitiatorIdToVirtualDisk",
        "String UNC source path of the download manager location",
        "MDM_Policy_Config01_Camera02",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1164.2705033010.180",
        "// The number of rekey operations for IPSEC SAs.",
        "WPD_TRACE_LEVEL_ERROR",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_7D726A53C2E109A7102AA0733AF15E0ABEDDFCEA169FD750AACBD377D8D29F56",
        "Conditional",
        "MDM_Policy_Result01_Speech02",
        "Result from Setting Port Auth Parameters",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_01AF7823F90DAEC78BAF38771F45D60A37B0917DC6BBE974DF07B97707A15F13",
        "VPortName",
        "rface.).",
        "Executable",
        "WINSTATION_LOGOFF=0x40",
        "25 Pin Dual Inline (pin 26 cut)",
        "PCMCIA",
        "MSNdis_WmiMethodHeader",
        "PercentLoaded",
        "CD_8A00FF3E28E2491BD7475BE0DBBFA1E38AE556F30FA37A400006A8673FBC26B8.1154.2730603220.311",
        "The QuotaPeakPagedPoolUsage property indicates the peak quota amount of paged pool usage for the process.",
        "Alpha 21164PC",
        "MSDART.1 formatted output (A)",
        "Win32_LogicalShareSecuritySetting",
        "WorkItemShortages",
        "The connection status of the NIC on the network.",
        "The BootupState property specifies how the system was started. Fail-safe boot (also called SafeBoot) bypasses the user's startup files. /nConstraints: Must have a value.",
        "Association between StorageSubsystem and TargetPortal",
        "CIMStatusCodeDescription",
        "RemoteShutdown",
        "{ccbd0dd0-c124-4e03-b4ae-81ba236b629f}",
        "ReturnValue",
        "The maximum speed, in bits per second, for the network adapter.",
        "ManualAddressing",
        "The DNSDomain property indicates an organization name followed by a period and an extension that indicates the type of organization. ",
        "Last Accessed",
        "The operational state of the queue.",
        "CIM_Mount",
        "Pentium(R) brand",
        "Indicates the tolerance of the sensor for the measured property. Tolerance, along with resolution and accuracy, is used to calculate the actual value of the measured physical property.  ",
        "DletePath",
        "Associates a network adapter with its hardware data.",
        "maximum amount in bytes of unsolicited data an iSCSI initiator may send to the target, during the execution of a single SCSI command. This covers the immediate data (if any) and the sequence of unsolicited Data-Out PDUs (if any) that follow the command.",
        "TotalCacheMemoryPerUser",
        "Destination Device",
        "Win32_LogonSessionMappedDisk",
        "Instances of this class represent instrctions for controlling both installed and uninstalled services.",
        "Win32_LocalTime",
        "GetPolicyInformationString",
        "CIM_UnitaryComputerSystem",
        "CatalogDebug Flag",
        "CD_09118298CC8EE9F900C2AC9CB3704C71C7C2F2B7198EBC74799BC99713851937.1135.771122698.3540",
        "Time in kernel mode, in 100 nanoseconds. If this information is not available, a value of 0 should be used.",
        "Indicates if the subsystem supports explicit repairing of a virtual disk through the Repair method of the virtual disk instance.",
        "Total Master File Table Size",
        "Varies with Address",
        "_DH_WMPGRAPH",
        "SelectTransport",
        "UdpIp_V1_TypeGroup1",
        "CD_C6289081C8AB688F844FF931CF917B4DD7080FB5ABF4C1BADA0FD2591FE183FD.1.117710330.173",
        "Installed",
        "ScreenSaverActive",
        "Secure Proxy Server",
        "The ChangeSecurityPermissionsEx method changes the security permissions for the logical file specified in the object path. If the logical file is actually a directory, then this method will act recursively, changing the security permissions of all the files and sub-directories the directory contains. ChangeSecurityPermissionsEx returns an integer value of 0 if the permissions were changed, and any other number to indicate an error. The ChangeSecurityPermissionsEx method is an extended version of the ChangeSecurityPermissions method./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n",
        "DOCacheHost",
        "The DNSDomain parameter specifies the DNS's domain. This parameter is represented by an organization name followed by a period, then an extension that indicates the type of organization.",
        "Sub-Entries",
        "Maximum lifetime over which a temporary address is preferred. The default value is 1 day.",
        "Win32API|NTDLL.DLL|NtQuerySystemInformation|SystemRegistryQuotaInformation",
        "Antispyware Signature age in days - if signatures have never been updated you will see an age of 65535 days",
        "Specifies the Internet e-mail program you want to use with Internet Explorer.",
        "Enumerates all the License Servers along with the method of discovery",
        "CreateNewId",
        "    ISCSI_IP_ADDRESS_EMPTY = 3",
        "APIC Id",
        "EnableDelegation",
        "ReadOffset",
        "The Win32_InstalledProgramFramework class represents a framework that a Win32_InstalledWin32Program instance depends on.",
        "CIM_ComputerSystem",
        "This class represents the Name - Value pairs for storage health settings related to the subsystem.",
        "PNP_EVENT_TRACE_LEVEL Flag",
        "CD_3D2C236C15D0F323FB188363066C67D486CC3E23871B0BEF2C84284D4CE5E729.1734.3377841290.349",
        "CreateUserDiskTemplate",
        "A URI that contains the location of the per-application dead letter queue, where messages that have expired or that have failed transfer or delivery are placed.",
        "HIPPI",
        "The percentage of the action that has completed at the time that this value is requested.",
        "      <registryValue name=\"ServiceMain\" valueType=\"REG_SZ\" value=\"ServiceMain\"></registryValue>",
        "ClearKeyManagementServiceListeningPort",
        "The proxy server to be used when connecting to the Internet",
        "EnrollmentInfo",
        "The SetGateways method is used to specify a list of gateways for routing packets destined for a different subnet than the one this adapter is connected to.  A more specific route should not exist for this subnet. The method returns an integer value of 0 on successful completion and any other number to indicate an error.",
        "MSFC_TargetEvent",
        "TemperatureSensorOperationalStatus",
        "ExpandedMiniDumpDirectory",
        "PolicySourceFallbackPrintDriverType",
        "VpnConnectionIPsecConfiguration",
        "GetExternalKeyFileName",
        "The Namespace property indicates the namespace where instance of __Win32Provider is instantiated.",
        "The number of broadcast bytes received without errors through this interface.",
        "The file server still contains file shares.",
        "AhEspCombined",
        "GetConversionStatus",
        "3 = default (system) ",
        "SupportIp6",
        "Win32_OfflineFilesChangeInfo",
        "ClearDfOnTunnel",
        "Given target mapping already exists.",
        "Refresh the list of discovered targets from this iSNS server",
        "UpgradeVolume",
        "DELETE",
        "ChangeExternalKey",
        "CIM_HostedBootSAP defines the hosting unitary computer system for a CIM_BootSAP. Since this relationship is subclassed from CIM_HostedAccessPoint, it inherits the scoping/naming scheme defined for CIM_ServiceAccessPoint - where an access point is weak to its hosting system.  In this case, CIM_BootSAP must be weak to its hosting CIM_UnitaryComputerSystem.",
        "ExitStatus",
        "LOGON",
        "AlwaysPrompt",
        "Completed with No Error",
        "Example: Device level.",
        "Information",
        "Server Unknown",
        "NumberOfDataCopiesMin",
        "MSNdis_MediaConnectStatus",
        "CR_74BDAD13EFC25BDDDA03231B2D3B39ABD8B91202277E5C78F927E74B85FE75B7",
        "Security mechanisms supported for SASL negotiation (see LDAP RFCs). By default, GSSAPI is supported",
        "// and return the number of ping responses received. This is only supported",
        "CD_E340FB8EB4DB3A4F1ED0804CB2A3406B4CA2DC92297E79DEEE6E8BA2BD0D28FC.1807.3798262489.428",
        "Indication of whether the fan supports variable speeds.",
        "Link State status information.",
        "CD_2DFD705737CCA1D522B20CA726C52DA2B2D27D5AFDDBDB8AFBAD6D71A22D7026.1466.1386221683.2026",
        "This class encapsulates the association between the packet capture provider and a packet capture target.",
        "IL_02E3B8C824FD0B9C15B4D49AB84CF02FA38E02CAF699DC3CBDCBB2D79F3025DF.1596.3726577277.263",
        "This property specifies the SIDs to disable for access checking, if SecurityLimitFlagss is Filter Tokens.This property can be NULL if you do not want to disable any SIDs.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1620.401451610.180",
        "Retrieves the VPN connection profile specified by the parameters.",
        "8 - The user does not have adequate privileges.",
        "ratingSystemFileNames",
        "Specifies whether to automatically connect to the client's drives at logon.",
        "Devices",
        "Process ID",
        "RSOP_IELinkItem",
        "MaximumMemoryCapacity",
        "MIF.DMTF|Protected Space Extent|001.6",
        "Win32API|System Information Functions|GetSystemDirectory|\\drivers\\etc\\lmhosts",
        "MaxInterruptMessages",
        "// troubleshooting, but can't be fired directly by a miniport. By",
        "CD_0A8460FC46C2746BD21F545AC61155DB7CAC54BE761314A2A7E02864EFA1BFE6.1523.1718622983.1774",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_FF125414713AEFB3BE9B36BF5067B839DE545A44FB053F1F2696CC7ADC1B48DADA",
        "StorageReliabilityCounter",
        "Address of the VPN server",
        "ClientMachineID",
        "Locks",
        "IR_548C7B8CAA43CC9635C7EFD11A316C9E16085EF464E2F7DF7BF493D60EC389A2",
        "DVD-RAM",
        "Example: 12",
        "The State property indicates what the level of quota management set for this particular volume. Disabled indicates that Quota management is not enabled on this volume. Tracked indicates that Quota's are tracked but the limit value is not enforced and users may exceed their quota limit. Enforced indicates that Quota's are tracked and enforce on this volume.",
        "Example: 0x0807 (German, Switzerland)",
        "The dependent files for this driver.",
        "ref:MSFT_PhysicalDisk",
        "LUAInstall: error 0x00000005 setting flags [{94E7F5BD-FC4F-446C-93D2-3942E8FE34C9}]",
        "MSFC_EventBuffer",
        "Hardware Disabled",
        "IL_993D150D0C9C8AECC30617FB0FF207B447C72B60CB9837CA152ECAA0421F80ED.533.1.143317",
        "Error Paging",
        "Performance Server",
        "IL_7BA06B043DD4F1C4BC3ACB7E4C10A6223E3DA1067522BFF187585B0486BDFDF7.1354.3298274962.380",
        "CD_9398EE9389657B6A830EB223CFE8021EDA6EBF0AE7CE6FA1ECC3991C40D9983D.206.2331212459.1247",
        "{5C6CE735-1B3E-705E-C2AB-B272D99AAF8F}",
        "Win32_TSSystemInfo",
        "Unable to renew DHCP lease",
        "{84E9DDB6-E233-4dfc-988C-7412C8754FEC}",
        "DEPEND_DUMP Flag",
        "IL_B8A661C1D622FBC77353C6283693E0067AFF965D515809B24B4E9FF26EFC7D7E.603.1.105338",
        "0xC0050079",
        "LrgObj",
        "RsopDeleteSession",
        "Contains an array of named value strings. The elements of this array correspond directly with the elements of iTypes. ",
        "This indicates whether a shared key is encrypted.",
        "ALPC-Unwait",
        "EnableMaintenanceMode",
        "Info Flag",
        "OID/OSI",
        "TRACE",
        "C_8DD4117F0A6CA8322CEA3B2EE2E937FF189016C7342D650B227DA4C96B557695",
        "SetMaximumContextTokenSize",
        "MSFT_InitiatorId",
        "Specifies the IEEE 802.1p priority value to use when a match is made.",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_4|sPrinterName",
        "uint16",
        "DirectAccessDnsServers",
        "Stop bits",
        "The type of the ODBC DSN to add. Possible values are 'User' or 'System'.",
        "R_805206C561285684F42D728C26661B4F548F5E54321B06170E013CB108084182",
        "If the voltage (in Millivolts) rises above the value specified by Range1InputVoltageHigh property, the UPS will compensate by trimming the voltage.  A value of 0 indicates that the voltage at which trimming occurs is 'unknown'.",
        "FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "Represents a storage site in a stretch cluster.",
        "Win32_ServiceSpecification",
        "ProfileXML",
        "TM_UNITTEST",
        "2 - 'All': All files will be scrubbed. ",
        "InterDomain Trust Account",
        "SaveExternalKeyToFile",
        "MSNdis_TransmitsOk",
        "Indicates if the ReplicaPeer is primary i.e: If the ReplicaPeer is a System Element and not a Synced Element",
        "{e6942f49-28f5-4d77-92dd-e1c8c6d1494c}",
        "MSNT_CKCLTraceProvider",
        "The ManufactureDate property identifies the date when the battery was manufactured.",
        "HostedCacheHttpsListenPort",
        "AllTargets",
        "R_962C6E7C58B97BBA37F5179D96ED3E00EE4A4FC20E4C3C3A3312674F9F7C4195",
        "A string indicating the version of the physical element.",
        "MSFT_NetAdapterRdmaElementSetting",
        "EFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "Method not supported in this subsystem.",
        "0xEFFF0047",
        "Verifier kernel information",
        "EnableInputNotify",
        "SendAdminAlert",
        "ATA 3-1/2 Inch (40 pins)",
        " The SoftwareElementState is defined in this model to  identify various states of a software elements life cycle.  ",
        "Microsoft iSCSI Initiator: Method Class",
        "toolbarButton",
        "BSDUNIX",
        "AsymmetricQueuePairsForNonDefaultVPortsSupported",
        "\\\\.\\Root\\cimv2:__Win32Provider.Name=\"RegProv\"",
        "OldTag",
        "TRACE_INFORMATION Flag",
        " This is an identifier for this software element and is designed to be  used in conjunction with other keys to create a unique representation  of this CIM_SoftwareElement",
        "The 802.11 fragmentation threshold in bytes",
        "SetStoragePool",
        "CR_050953C58E97660582926667045FD157390A1B7EE9E1CDFCB3DD57BDA1E5B26D",
        "Multiple adapters have a matching WWN",
        "Enables or disables VirtualIP according as whether Value is set to 0 or 1 respectively. The call returns 0 for success and an error if the policy was set to Group policy.",
        "MSFT_NetServiceSlowStartup",
        "CIM_ServiceServiceDependency",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.3885814277.180",
        "The parent DS Class",
        "Win32_Keyboard",
        "The address of the initiator to which the virtual disk should be shown",
        "The property GroupId gives the phase 1 security association key exchange group. Well-known group identifiers from RFC2412, Appendix E, are: Group 1='768 bit prime', Group 2='1024 bit prime', Group 3 ='Elliptic Curve Group with 155 bit field element', Group 4= 'Large Elliptic Curve Group with 185 bit field element', and Group 5='1536 bit prime'.  Note that only groups 1, 2, 14, 19, 20, and 24 are acceptable in Windows 8.",
        "RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls",
        "Starts the consistency check.",
        "The WindowsDirectory property indicates the Windows directory of the operating system.",
        "0x010000",
        "NPIV_AUTHENTICATION_MECHANISM_NOT_USABLE",
        "LicenseServerList",
        "C_10549F8F6A0C1E0A975F931BF6E1962F49CF18068F6079CD179A794A32D030D5",
        "percentage",
        "{20c46239-d059-4214-a11e-7d6769cbe020}",
        "PrimaryThreadId",
        "// This class is required if adapter supports using RADIUS for CHAP authentication.",
        "The number of bytes received using the IPSEC protocol.",
        "CD_0FB0A8E86C1430EE0BB7D412F66362E6E788646DB733ACDB85AE2E440B7F37A4.1172.243002396.245",
        "Manual-Select",
        "A user-friendly name of this PolicyAction.",
        "The ParityCheckEnabled property determines whether parity checking is enabled",
        "QuotasIncomplete",
        "The starting address on the physical media where the physical extent begins.  Ending address of the physicalextent is determined using the NumberOfBlocks and BlockSize properties of the CIM_PhysicalExtent object.",
        "WaitForSyncOnLogon",
        "Win32API|GetPrivateProfileString|Support Information",
        "The property GroupId specifies the proposed phase 1 security association key exchange group. Well-known group identifiers from RFC2412, Appendix E, are: Group 1='768 bit prime', Group 2='1024 bit prime', Group 3 ='Elliptic Curve Group with 155 bit field element', Group 4= 'Large Elliptic Curve Group with 185 bit field element', and Group 5='1536 bit prime'.  Note that only groups 1, 2, 14, 19, 20, and 24 are acceptable in Windows 8.",
        "Maximum operating voltage for this device, in millivolts. If the value is 0, the voltage is unknown",
        "If set to TRUE, this instructs the physical disk to enable its indication LED. The indication LED should remain enabled until a second call to Maintenance is made with this parameter specified as FALSE.",
        "Backplane Failure",
        "See CIM_Memory.BlockSize for details.",
        "PauseFeatureUpdates",
        "The DeviceID property contains a string identifying the temperature probe.",
        "Language in which query is expressed",
        "ISC Flag",
        "The pending action resulting from the action taken on the threat (status flag)",
        "Sensor ClassExtension Trace",
        "CD_A107EAA2D6C2A698530A8358D207D9A3B8B427F7073C80586F1820045E4C35C1.31.1059774604.414",
        "NS_741D1F510F67B02AECEE46B61323C34AF59FB3846CC56C042067E65CEDF537D4\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_304546A1C1E96E9129142E75E297CCEA0DD08492A7C88D17C5C3618E4AA084620c31",
        "DPC_V1",
        "If set to a valid access path, the system will attempt to use this path as a way to access the local volume. If the access path could not be set, or this parameter was left NULL, a new access path will be automatically assigned.",
        "Distributed",
        "Query Pending",
        "BlockNonEnterpriseContent",
        "NS_37FD5386C028E960C90BC77B9D8DDCA28B24BAE2E315E8D8209BF5E2633575D8\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_BC000CFE04C2A23B745105FB1571CA3D890D9580D1AA6746224E398C7587FD84",
        "0x8005006F",
        "The DisplayFrequency property indicates the refresh frequency of the display The refresh frequency for a monitor is the number of times the screen is redrawn per second. ",
        "Microsoft-Windows-OfflineFiles-CscUM",
        "This property explicitly defines support for different versions of the IP protocol, for this Endpoint. It is deprecated since the ProtocolIFType also provides this functionality by describing an endpoint as IPv4 only (value=4096), IPv6 only (value=4097), or IPv4/v6 (value=4098).",
        "Win32_LogicalFileGroup",
        "OneXSingleSignOnType",
        "MSFT_CliAlias.FriendlyName=\"BIOS\"",
        "Received Count",
        "Dirty Region Tracking",
        "CD_16D6E45D9DC3C2448BBB5DF12E5A17B75BBAD53607DFAC1CCE27C411AB0AEA61.1939.2609311141.4506",
        "CIM_AdminDomain.Name",
        "{4504B1D4-C5EE-4df6-951F-16180E3DD815}",
        "ARRAY OF STRING",
        "If this parameter is set, discovery will begin from this object. When DiscoveryLevel is NULL, well-defined actions will be taken depending on the type of object specified by RootObject: ",
        "IP WINS Address Alternate",
        "InitialState",
        "ThinProvisioningAlertThresholds",
        "ref:CIM_SAAction",
        "MSFT_NetReadfileTimeout",
        "reen saver. The idle priority class is inherited by child processes.",
        "SAM Add Member to Group",
        "RegisteredProfile for IPMI",
        "C_DF85153FB4444BFC904B433D6CDD9675CBBAF1556A07F0E7E082E4B4F8C33E3A",
        "callbackID",
        "DHCP not enabled on adapter",
        "Read Correction Algorithm Processed",
        "ScanPurgeItemsAfterDelay",
        "// if neither defined then default to MSFC",
        "The ProviderOperation_SetRegistrationObject ProviderOperation_SetRegistrationObject property is currently not set.",
        "Logout",
        "List of media types the NIC is currently supporting.",
        "NA-Number-9-Envelope",
        "CurrentPaperType",
        "FileIo_V0",
        "CD_74BDAD13EFC25BDDDA03231B2D3B39ABD8B91202277E5C78F927E74B85FE75B7.1.3322736739.186",
        "Number of bytes for dot11 Phy State change status indication",
        "L3CacheSize",
        "MSFT_CliAlias.FriendlyName=\"Printer\"",
        "SetVirtualIPActive",
        "SM-HBA Version 1.0/FC-HBA Version 2.18",
        "CriticallyFailedDetections",
        "Values: TRUE or FALSE. If TRUE, the user account is disabled.",
        "Msft_WmiProvider_UnLoadOperationEvent",
        "MSFT_CliAlias",
        "NDISWMI_TRACE_BINDING Flag",
        "FileInfoCacheLifetime",
        "This device is working properly.",
        "EnableHighAvailability",
        "CloudPrintOAuthClientId",
        "ReservedFlags",
        "PnP Device Id for the device. This property is useful for mapping from the wmi namespace to the cimv2 namespace classes using the view provider",
        "ISCSI_ERR_LOGIN_PDU_ERROR",
        "SetByForgetSet",
        "ConnectionCount",
        "Session Already Exists",
        "    //                  the TCP connection has not yet been closed.",
        "LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps",
        "Specifies provider-specific data.",
        "Example: +Q5S36=4S48=7.",
        "R_33AFC5533FEF2AB8957C705077D2CB2428067503BF4A8D79697DC98C53B8A138",
        "object:Win32_Trustee",
        "ConnectPerformanceCounterMissing",
        "DoNotAllowUsersToAd",
        "Whether this power budget is writeable. If this is false, then saving an instance with a modified CurrentBudget will fail and currently configured budget will not be changed.",
        "Creates differential area storage for the specified Volume on the specified DiffVolume with the specified MaxSpace.",
        "FATAL",
        "Out-Context",
        "CR_EC97D00816B4530E92B0346A6B6B453699A71F2B879F99F794A6FF9189BD53FF",
        "NdisPMAdminConfigInactive",
        "ription",
        "MSFT_DNSClientGlobalSetting",
        "2 - 'Sequential': repair will process one allocation slab at a time. This will result in longer repair times, but small impact on the I/O load.",
        "Win32API|System Shutdown Functions|InitiateSystemShutdownEx",
        "43028",
        "The instance name like file1.",
        "NumQueuePairs",
        "Win32Registry|.DEFAULT\\Control Panel\\Desktop|TileWallpaper",
        "The ProviderID uniquely identifies the shadow copy provider that created the shadow copy.",
        "7 - CIM_ERR_NOT_SUPPORTED. The requested operation is not supported. ",
        "The Signer property is the signer of driver if it is signed e.g. ntbuild ",
        "MIF.DMTF|Portable Battery|002.14",
        "Property to tunnel DNSSEC queries over IPsec channel.",
        "EnableFirstLogonAnimation",
        "MaxProcessMemorySize",
        "CD_49164C7AB89E7FE6DA81BECB881C8C4D65839FBBD034989674E74CAE234E85F7.75.1724504165.535",
        "CD_B9845544951A3B035DE4DE7FD4E415EC9B667E42A6D89461752D201AF24E4FC6.1984.1.22234",
        "NS_5B2CC7EB2AAF010DD5D0084F2DEFC340AFEEECC12F24D870DFC50B8EB7C98139\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_91BB5F8AFE5873E9BA8EBD1189F17D947DC5BB7E366AF568F25A5BD3FADD34E6cb95",
        "object:MSFT_ExpressionIdentifier",
        "MSFT_NetAdapterLargeSendOffloadV2Capabilities",
        "AllowBluetooth",
        "DefaultDir",
        "The ActiveRoute class assoctiates the current IP4 Route being used with the persisted IP route table.",
        "R_4274C87DD763EAFD68CB5D56AC30576722978B71BAE02D4F3CA2BD53BD6A6928.2451.2779238806.554",
        "Timeout - in seconds",
        "NegotiationFailures",
        "String number for the serial number of this processor This value is set by the manufacturer and normally not changeable.",
        "UMS Directed Switch - End",
        "TransportEnabled",
        "WMI_TAPE_PROBLEM_IO_ERROR_GUID",
        "AutorecoverMofs",
        "dwSettableParams",
        "Counter",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|TcpMaxConnectRetransmissions",
        "DisableDeviceSecurityUI",
        " Minimum version of required operating system. The value  is encoded as     <major>.<minor>.<revision> or     <major>.<minor><letter revision>",
        "NumAAAAQueriesSucceeded",
        "The SID property contains the security identifier (SID) for this account. a SID is a string value of variable length used to identify a trustee. Each account has a unique SID issued by an authority (such as a Windows domain), stored in a security database. When a user logs on, the system retrieves the user's SID from the database and places it in the user's access token. The system uses the SID in the user's access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot be used again to identify another user or group.",
        "Initiator Address",
        "Bid2Etw_RowsetHelper_1",
        "DeviceModel",
        "AllowStartIfOnBatteries",
        "SamSetMemAttrsOfGrp",
        "{8502C4EE-5FBB-11D2-AAC1-006008C78BC7}",
        "CD_F9AF1E0E64A5F88E91652C8C44C8A5E0B35B46F211646049A589ADDFD182AD4B.1740.1209414626.744",
        "CD_DBBAB694252A8FA02CC578AF6A541FC3E6E5ABF42798173F7194B1B5ACA4AE8A.2083.3452098432.3282",
        "The Win32_DiskDrive class represents a physical disk drive as seen by a computer running the Win32 operating system. Any interface to a Win32 physical disk drive is a descendent (or member) of this class. The features of the disk drive seen through this object correspond to the logical and management characteristics of the drive. In some cases, this may not reflect the actual physical characteristics of the device. Any object based on another logical device would not be a member of this class.",
        "Select * from Win32_LoadOrderGroup",
        "The value of this property identifies the language edition of this software element. The language codes defined in ISO 639 should be used. Where the software element represents multi-lingual or international version of a product, the string multilingual should be used.",
        "DirectAccess Server address",
        "EndPointInterface",
        "DefaultRegistryValue",
        "Target must remain associated to source",
        "BuildType",
        "Frame/network number bounds error",
        "Name of an ODBC driver.",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmSpecVersion",
        "Health states of numeric sensors. See CIM_NumericSensor.HealthState for details.",
        "startname = \"localsystem\"  ",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2426.34478244.180",
        "The Availability property indicates the availability of the DMA.",
        "NT image timestamp (usually set at link time), as listed in the NT image header; it is a  used to identify the binary image along with the original file name and ImageSize, which is also retrieved from the NT image header.",
        "7 - Fatal/NonRecoverable should be used to indicate an error occurred, but it\\'s too late to take remedial action. ",
        "Query Current Offload Configuration",
        "TcpIp_V0",
        "The EnableStartupHeapPreallocation property indicates whether WMI will start with a pre-allocated heap./nValues: TRUE or FALSE. If TRUE, then a pre-allocated heap with the size of LastStartupHeapPreallocation is created when WMI is initialized.",
        "IndeterminateErrorCount",
        "Not Surfaced",
        "CIM_MemoryOnCard",
        "HiveLink",
        "{058DD951-7604-414d-A5D6-A56D35367A46}",
        "1 - 'Thin': The storage for the virtual disk is allocated on-demand. ",
        "Requests that the Log be cleared of all entries.",
        "Intel Pentium M Processor",
        "Instance required",
        "CIM_VideoSetting",
        "{1FF10429-99AE-45bb-8A67-C9E945B9FB6C}",
        "CR_161D7B1F7DD552C780B6CD4154D40388F29AC0271BBCB7991C59595342903A38",
        "Applied",
        "Specifies the print job to restart.",
        "{8502C57F-5FBB-11D2-AAC1-006008C78BC7}",
        "C_8CB3FFD7A1A650625018591E5EB6DCDAB3ED214411C673CFC9AAA91D2D57C51F",
        "RSOP_PolmkrRegionOptionSetting",
        "IR_98233BC0D6E21C2CA3187CB9E2307592DF6D759478E209568F3CA340985F3F72",
        "This field describes the minimum number of underlying physical disks across which data can be striped in the common striping-based resiliency settings.",
        "SCSI (P) High-Density (68 pins)",
        "LockedDownLocalMachineZoneAllowFontDownloads",
        "IL_0BE16089DDC1582CDB25043DB42CD7AE12C51808071C234ECBB1734648B1CD8B.659.1.73443",
        "SppProvider",
        "{76DBA919-5A36-FC80-2CAD-3185532B7CB1}",
        "The SpecificationVersion property indicates the version number of the initialization data for the device associated with the Win32 printer.",
        "Header_Extension_V1_TypeGroup",
        "UninstallProductKey",
        "AllowComputerToTurnOffDevice",
        "ATIMWindow",
        "indicates that the Job should be run on or after two o\\'clock, local time or UTC time (distinguished using the LocalOrUtcTime property.",
        "The IPInterface associated with the NetworkPort.",
        "IpExtensionHeadersSupported",
        "MIF.DMTF|Voltage Probe|001.11",
        "VPortState",
        "CreationDate",
        "EndMeasurementDate",
        "__Provider",
        "%NewStartType%",
        "U2U Flag",
        "R_4C11DEAF7A8558F3989E0E42F67497A3DF8A0B97EC73A206C1E9955B630EFD68",
        "The ObjectPath property is a string containing the object path of the object for which the method is to be executed.",
        "AntivirusEnabled",
        "The desired name of the snapshot virtual disk",
        "Copy this set.",
        "Random Access",
        "AddToCluster",
        "Win32_Fan",
        " Type of service start ",
        "PCI_BUS_OEM_ID is valid",
        "The DitherType property indicates the dither type of the video controller.  The property can be one of the following predefined values, or a driver-defined value greater than or equal to 256: Value Meaning :-1",
        "This parameter indicates whether the drive should be forced to dismount before checking.",
        "{B6501BA1-C61A-C4E6-6FA2-A4E7F8C8E7A0}",
        "ISCSI_TargetPortal",
        "MsftDiscFormat2Erase_DebugDestructor",
        "The CIM_ComputerSystem object and its derivatives are Top Level Objects of CIM. They provide the scope for numerous components. Having unique CIM_System keys is required. A heuristic is defined to create the CIM_ComputerSystem name to attempt to always generate the same name, independent of discovery protocol. This prevents inventory and management problems where the same asset or entity is discovered multiple times, but can not be resolved to a single object. Use of the heuristic is optional, but recommended. ",
        "UdpEspEnabled",
        "NumOtherQueriesFailed",
        "The remote address associated with the channel.",
        "USB Connector",
        "MIF.DMTF|Storage Controller|001.3",
        "KerbChangePassword_Start",
        "Maximum number of partial PD_BUFFERs which can be posted to a PD transmit queue as a chain to be transmitted as a single layer 2 frame.",
        "VirtualIPMode",
        "MSFT_DeliveryOptimizationExtendedConfig",
        "Win32_LogicalProgramGroupDirectory",
        "startname = \"NT AUTHORITY\\NetworkService\" ",
        "Lifetime over which the address is valid. The default value is infinite.",
        "MsmqBindingElementBase",
        "LocationInformation",
        "PrimaryBIOS",
        "SetFriendlyName",
        "MRCreate performance counter missing",
        "QueryBoth",
        "Win32API|Printing and Print Spooler Structures|JOB_INFO_4|pMachineName",
        "CurrentSpeedAndMode",
        "Starter Edition",
        "MDM_Policy_Result01_Cellular02",
        "CIM_MemoryCapacity describes the type of memory that can be installed on a physical element and its minimum/maximum configurations. Information on what memory is currently 'installed', versus an element's min/max requirements, is located in instances of the CIM_PhysicalMemory class.",
        "Ounce-Inches",
        "AInsta",
        "FILE_WRITE_DATA (file) or FILE_ADD_FILE (directory)",
        "object:MSFT_NCSIPolicyConfiguration",
        "This property identifies the boot source that is used for the next one-time boot. The value of this property is an index referencing an element in the array of StructuredBootString.",
        "Boolean indicating whether the physical link is an actual cable (TRUE) or a wireless connection (FALSE).",
        "Platforms",
        "This parameter is the initial maximum size of the differential area.",
        "New Target Idle State",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.314.699093998.180",
        "Number of bytes for dot11 association completion status indication",
        "The Name property uniquely identifies the ServiceAccessPoint and provides an indication of the functionality that is managed. This functionality is described in more detail in the Description property of the object.",
        "{FAF76B8F-798C-11D2-AAD1-006008C78BC7}",
        "0 - Ignored ",
        "The IPSecPermitTCPPorts property lists the ports that will be granted access permission for TCP. The list of protocols is defined using the EnableIPSec method. ",
        "The physical media on which the extent is realized.",
        "MDM_Policy_Config01_DataUsage02",
        "object:MSSmBios_Sysid1394",
        "Value to be checked that is associated with the named entry.",
        "HardwareVersion",
        "Indicates the hosted cache server should register a service connection point",
        "ISCSI_ERR_SEND_FAILED",
        "The volume on which the share is to be created.",
        "Not Reported",
        "DriverEnabled",
        "MaximumPartitionCount",
        "{4556569B-4546-4C74-A0DB-8D889238137D}",
        "The PriorityBase property indicates the current base priority of a thread. The operating system may raise the thread's dynamic priority above the base priority if the thread is handling user input, or lower it toward the base priority if the thread becomes compute-bound. The PriorityBase propertycan have a value between 0 and 31",
        "DhChapAvailableOnVirtualPorts",
        "Network adapter statistics",
        "Win32API|Device Context Functions|GetDeviceCaps|BITSPIXEL",
        "ref:RSOP_IEFavoriteItem",
        "See CIM_SoftwareIdentity.Classifications for details.",
        "CD_1A56F41D63578C6740DEEE2D125A595986E3783B82D23576EACB16C1622C2314.1186.2793507055.786",
        "Minimum latency that must exist between client and server before BranchCache should be used.",
        "The IPXVirtualNetNumber parameter specifies the virtual network number for this system.",
        "FunctionDetail Flag",
        "Enabled but Offline",
        "CD_09A0BD3FA42FC22051D80101735E2603C2C685F3E4BE5F21BEA3DDC5EBA5AA79.1671.3882546781.414",
        "CD_AC74BA8CCBB8B7653E84CC3AAB6F43C1B7147F57F54B0A2F4FF0A55FCB7892BB.2033.748077032.257",
        "Change Stamp",
        "Security IDs of the new groups for target.",
        "The Color property indicates whether the document is to be printed in color or monochrome.  ",
        "{8502C566-5FBB-11D2-AAC1-006008C78BC7}",
        "SAM Get Domain Password Information",
        "C_47A47D9B6C73D6463867F73A57E933DD2525E443C9FB15C91CF6A9FC4BA05F96",
        "CD_A9AE64C03C11270991C8BCE26EBE3DD0FF3F841C3C80D3A28DC949EF9B62D60B.1829.3179625842.455",
        "LUAInstall: error 0x00000005 setting flags [{C1B22BC2-5EE5-4A3E-BA37",
        "A value of 6 \"IPv4 Link Local\" shall indicate the values were assigned using the IPv4 Link Local protocol. See RFC 3927.",
        "Read Total Corrected Errors",
        "The interface indices of higher layer interfaces.",
        "Select * from Win32_ShadowCopy",
        "ServiceAuthorizationBehavior",
        "The DirectoryName indicates the name of the directory to which the action applies.",
        "KEY_ENUMERATE_SUB_KEYS (0X0008) ",
        "{1131c56a-0a5a-4d79-8dde-1e6f178005ee}",
        "If applicable, defines the COM CLSID associated with server implementation. Note: decoupled providers do not have an associated COM CLSID.",
        "ACPI _TPC",
        "The frequency, in minutes, of how often a client will contact the KMS host before the product is licensed.",
        "10GBase-LX4",
        "NdisFddiLongMaximumListSize",
        "ConfidentialBytesSent",
        "mispace",
        "Source ID",
        "Insertable",
        "Serial Number",
        "Virtual IP Address",
        "CD_1E99B42A14C8BDFFB63BA2F8D428227D04A8E5DF131E69A53A073AA04FCE464F.2622.161908990.1821",
        "FirmwareVersionInSlot",
        "Sub Entry",
        "MIF.DMTF|System Slot|004.10",
        "Range2InputVoltageLow",
        "Sets the value to indicate whether the server will participate in Session Broker Load Balancing.0 = The server will not participate in Session Broker Load Balancing1 = The server will participate in TS Session Broker Load Balancing",
        "The disk partition.",
        "Kernel Queue Dequeue",
        "IL_C52295624F06C940B122D80C080F06A7E8A3B72E8DBB8DAB3530E90B3C01E0C8.1500.3783951989.277",
        "Boolean",
        "Query Load Balance policy used by iSCSI Initiator",
        "Window Station",
        "414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2473.1344709254.368",
        "802.3",
        "The LoggingDirectory property specifies the directory path containing the location of the WMI system log files.",
        "Publisher name of the package",
        "This class describes an iSCSI Path (A TCP Connection to the target)",
        "Note: If moving a computer from a Domain to a WorkGroup, the computer must first be removed from the domain before running this method to join the Workgroup. ",
        "UDPIPv4Checksum",
        "AllowJapaneseUserDictionary",
        "An array representing the writable thresholds supported by Sensor.",
        "The link error monitor (LEM) count of times that a link was rejected.",
        "Association between a StorageFaultDomain object and its ancestor or descendent StorageFaultDomain objects.",
        "The DriveType property contains a numeric value corresponding to the type of disk drive this logical disk represents.  Please refer to the Platform SDK documentation for additional values.",
        "Win32_PowerSettingDataIndex",
        "32776",
        "Example: 20521201000230.000000 000",
        "GetProtectionStatus",
        "-Monday",
        "Minimum Operating Budget",
        "Win32_ShadowBy",
        "{2D2434AA-EF83-4200-BA24-DE366C415F7B}",
        "43001",
        "NoEncryption",
        "XML blob containing static attributes like Issuer Name, SCEP URL, Retries which will be used by the client for the SCEP calls to Network Device Enrollment Service (NDES). This one comes in the CI digest",
        "One of the following values:  - Disabled: Fix the receive window at its default value.  - HighlyRestricted: Allow the receive window to grow beyond its default value, but do so very conservatively.  - Restricted: Allow the receive window to grow beyond its default value, but limit such growth in some scenarios.  - Normal: Allow the receive window to grow to accommodate almost all scenarios.  - Experimental: Allow the receive window to grow to accomodate extreme scenarios.",
        "The IconTitleWrap property indicates whether the icon's title text wraps to the next line.",
        "GetConfigurationResultOutput",
        "TempPageFile",
        "Denotes the total number of physical disk slots in the subsystem or enclosure.",
        "ACPITrace",
        "I_C248C547DC15B784B3A402BBD30D036FD929AD807FC5B87D093257C8615FE4B2.279.3409176461.312",
        "NdisPacketFilterStatusIndication",
        "#define ISCSI_HBA_SLP_DISCOVERY                    0x00000020",
        "MsftDiscFormat2StreamInterleave_DebugGeneral Flag",
        "This field indicates the intended usage for this virtual disk.",
        "LetAppsRunInBackground_ForceAllowTheseApps",
        "The Restore method restores the system to a specified restore point.It returns a COM error code.",
        "Execute Test on a provider directly",
        "LifetimeKilobytes specifies the maximum number of kilobytes of data traffic to be protected by the SA. A value of zero (the default) indicates that there should be no maximum kilobyte lifetime. A non-zero value specifies the desired kilobyte lifetime. The SA is deleted when the LifetimeKilobyte value is exceeded.",
        "Phase1SAUsedForPhase2 associates a phase 1 endpoint (such as an IKESAEndpoint) with an IPsecSAEndpoint that was negotiated using that phase 1 Security Association.",
        "InitialCongestionWindow",
        "d (implementation specific) error information.",
        "]A0108CE261D6CD70D350F5B72F2E9874AE6E004D3029015B0919B1BD326BB649",
        "If set to TRUE, the partition will fill the largest free extent on the disk. This parameter cannot be used with the Size parameter.",
        "DMASupport",
        "WMI|Win32_OperatingSystem",
        "MSNdis_VlanIdentifier",
        "C_4EFE28EFCD0C2B5177C06210204A407FCEB7434631D258DE8A983EFF1957B86E",
        "CIM_PhysicalComputerSystemView.NumericSensorUpperThresholdCritical",
        "Specifies the current secure conversation settings.",
        "File name of setting file entry to be modified.",
        "{F3B44268-DB34-11d2-85FC-0000F8102E5F}",
        "ADOMD.1",
        "CD_5CF48B4594AF5A29D8F38D01C51E1EBAB43B90EB9606F532D289B128EB56580D.2100.1.8216",
        "PciExpressMaxReadRequestSize",
        "3221232502",
        "Win32_Product",
        "Number of elements in RedirectSessionInfo array",
        "SlotA",
        "AgentId of the current Dsc Agent.",
        "MSFT_DSCConfigurationOutputResult",
        " The Checksum property is a checksum calculated as the 16-bit  sum of the first 32 bytes of the file.",
        "Provider must create remote group",
        "AppliedSetting",
        "queryea",
        "IsEnabled_InitialValue",
        "SAM Get User Domain Password Information",
        "IsDirectory",
        "CreateStoragePool",
        "__ClassModificationEvent",
        "Pool Metadata Version",
        "October",
        "AllowUsingDiacritics",
        "CD_337863EF99B561BCCD899B7AFA2247DE6CE14F0D81601137B3F7CD2CFAE44723.1741.1422671123.488",
        "{45309ef4-c59e-425e-b95b-19f1c5a3c55a}",
        "WarningCount",
        "Shared resource management. ",
        "Localized version of RSOP_PolmkrDialupOptionSetting for American English",
        "RegistryTreeChangeEvent",
        "SetVirtualIPMode",
        "Alpha Family",
        "C_ED2E871CAA85DB91DA82D43856C298DADCDDAA2D7C9D06C8655F1779E6509A4E",
        "VPN Strategy",
        "Interface Description, a.k.a. ifDescr or friendly name is a unique name assigned to the network adapter during installation. This name cannot be changed and is persisted as long as the network adapter is not uninstalled.",
        "Processor domain coordination",
        "Parameter3",
        "Thread Pool Timer Set Nt Timer",
        "Alias of the Desktop",
        "NS_E1DD43413ED9FD9C458D2051F082D1D739399B29035B455F09073926E5ED9870",
        "The total size of the Master File Table on the volume.",
        "qCa0B",
        "The GetEffectivePermission method determines whether the caller has the aggregated permissions specified by the Permission argument not only on the file object, but on the share the file or directory resides on (if it is on a share). /nThe method returns a",
        "MDM_Policy_Result01_Accounts02",
        "HBA_EVENT_PHY_STAT_THRESHOLD",
        "0x00000006",
        "ref:Win32_Processor",
        "Specifies the name of the print queue to suspend the job on.",
        "iScsiDebug28 Flag",
        "CIM_ParticipatesInSet indicates which physical elements should be replaced together.",
        "CR_7F586BA17943C172DA17564383FF9D3B7933EA9BA65A58BF1162084BFFFFF070",
        "The DaylightDayOfWeek property specifies the day of the week when the transition from standard time to daylight savings time occurs on this operating system.",
        "Processor Frequency in Megahertz",
        "DisableEmailScanning",
        "Thermal information change stamp",
        "AverageFragmentsPerFile",
        "Threat category enumeration",
        "Bytes read using bounded Ecp mode",
        "Context",
        "CIM_RegisteredProfile.OtherRegisteredOrganization",
        " The NameFormat property identifies how the computer system name is generated, using a heuristic. The heuristic is outlined, in detail, in the CIM V2 Common Model specification. It assumes that the documented rules are traversed in order, to determine and assign a name. The NameFormat values list defines the precedence order for assigning the computer system name. Several rules do map to the same Value. ",
        "MSFT_3DPrinter",
        "The ObjectParameter property holds the object defining the extended status passed though provider's IWbemObjectSink :: SetStatus call, possibly NULL.",
        "Unsubscribe",
        "There is no media in the device.",
        "power",
        "\"Major Failure\" (20) - The element is failing. It is possible that some or all of the functionality of this component is degraded or not working. ",
        "TLB access due to instruction fetch or instruction prefetch",
        "LPCDRVR_TRACE_RESERVED_14",
        "PerLocaleInitialization",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|Modulation_CCITT",
        "SessionMode",
        "Constraints: Maximum 11 characters",
        "Whether the computer will respond to ICMP Address mask packets",
        "SaveCredentials",
        "R_D18B021DE887D56CED90F13460DE767FA0BA3077FF010C862ECF83FC393D6F1F",
        "Disables the ODBC Connection Pooling PerfMon counters represented by the specified ODBC PerfMon counters objects. Enter a variable that contains the objects, or type a command or expression that gets the objects.",
        "X25 Address",
        "AuditMode",
        "Irq Vector",
        "C_094CD032BE77E24831D84EE3DE38C46FBDC0C57F2466CC9AAB2CC4B43209B790",
        "The Version property contains the version number of this COM class.",
        "The LowThresholdOnEvents property specifies the rate at which  WMI will start to slow the delivery of new events. to accommodate speed differentials between providers and clients, WMI queues events before delivering them to consumers. If the queue grows out of control, WMI slows down the delivery of events gradually to get them in line with the client's rate . This slowdown starts when the rate at which events are generated exceeds the value of the this property. The slowdown continues until either the equilibrium is achieved, or the high threshold is reached.",
        "Number of supported traffic classes that can be enabled for IEEE 802.1Qbb Priority-based Flow Control.",
        "FreeSpacePercentFragmentation",
        "SyncTimeoutInMilliseconds",
        "The FillAttribute property specifies the initial text and background colors if a new console window is created in a console application.  These values are ignored in GUI applications.",
        "No_Open_File_Error_Box",
        "Bid2Etw_MSDADIAG_ETW",
        "InfName",
        "RestorePointType",
        "UNICODE string format",
        "TimeOnBackup indicates the elapsed time in seconds since the UPS last switched to battery power, generator, ...  Or, the time since the UPS was last restarted, whichever is less. Zero shall be returned if the UPS is 'on line'.",
        "{A83EF166-CA8D-11d2-B33D-00104BCC4B4A}",
        "The ReleaseDHCPLease method releases the IP address bound to a specific DHCP enabled network adapter. WARNING: If DHCP is enabled on this local computer system, the option disables TCP/IP on this specific network adapter. Unless you have an alternate path to the target system; that is, another TCP/IP bound network adapter, all TCP/IP communications will be lost. The method returns an integer value that can be interpretted as follows: ",
        "InprocServer32",
        "Product Id",
        "SDBUS_DEBUG_WORKENG2 Flag",
        "Last requested throttle",
        "MSFT_WmiConsumerProviderSinkUnloaded",
        "Variable length array of iScsiPortalInfo.  PortalInfoCount specifies the number of elements in the array. NOTE: this is a variable length array.",
        "SetSD",
        "NETIO_TRACE_SEND Flag",
        "msieee80211Name",
        "TotalTransitions",
        "NS_A2A98E75472B9249D4EF445DC9D4C380289067BF73931A828AFBC7CD7964FEBB\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_F023674AFA828B66F95ECE31F54E284BD33C3FE845D503CD7E6993EC70473BF7",
        "IsEffective",
        "DispatcherSynchronizationBehavior",
        "LastLogoff",
        "0xEFFF003E",
        "The total number of free space extents on the volume.",
        "The ResourcesOpened property indicates the number of files, devices and pipes opened during this session.",
        "The full path of the BidTrace adapter.",
        "Specifies the processor number for the first RSS processor.",
        "5 - 'Kill' terminates the job immediately with no requirement to save data or preserve the state. ",
        "SCSI SMART",
        "The name of the organization responsible for producing the physical element.",
        "The Pattern property indicates the name of the pattern used as the background for the desktop",
        "ID_USER_FQDN",
        "CD_4DD1A5A9057BCA223E822F92B883994F78B43967069098EDCB429059D716ACBF.1737.612369042.737",
        "Property which identifies if DirectAccess is enabled on the rule.",
        "9 - The path specified does not exist.",
        "Product Must Be Installed",
        "The Workstations property contains the names of workstations from which the user can log on. Up to eight workstations can be specified; the names must be separated by commas (,). A null string indicates no restrictions. To disable logons from all workstations to this account, set the UF_ACCOUNTDISABLE in the Flags property of this class.",
        "TaskName",
        "GetProcessInfo",
        "{d789adfa-9c56-433b-ad01-7574f3cedbe9}",
        "The total number of packets that failed decryption.",
        "ROOT\\cimv2\\mdm",
        "EnterpriseModeSiteList",
        "Socket",
        "CIM_DataFile is a type of logical file that is a named collection of data or executable code./n<B>The behavior of the provider backing this class will be changed in future releases. Currently the provider returns both files on fixed disks as well as files on mapped logical disks. In the future, only instances of files on local fixed disks will be returned.<B>",
        "RSOP_IEProxySettings",
        "Values: TRUE or FALSE. A value of TRUE indicates the protocol supports graceful closing of network connections.",
        "Win32_WIN32_TSNETWORKADAPTERSETTING_Prov",
        "Lockout",
        "HOSTPROC_TRACE_WIN32_DISPATCHER",
        "Specifies the proposed authentication. The list of methods was generated from Appendix A of RFC2409. Note that the enumeration is different than the RFC list and aligns with the values in IKESAEndpoint.AuthenticationMethod.",
        "The LoadOrderGroupDependencies parameter passes a list of load ordering groups that must start before this service starts. The array is doubly null-terminated. If the pointer is NULL, or if it points to an empty string, the service has no dependencies. Group names must be prefixed by the SC_GROUP_IDENTIFIER (defined in the WINSVC.H file) character to differentiate them from service names because services and service groups share the same name space. Dependency on a group means that this service can run if at least one member of the group is running after an attempt to start all members of the group.",
        "CD_F9C9BF1D438816A18A92B3E8522F73D7F60F0DD6F678D67DAD4AE3DD5EBC727E.30.397307748.586",
        "Win32Registry|System\\CurrentControlSet\\Services\\Class|InfPath",
        "reserved2",
        "CD_E8B3CF9E7D4D054B2D1D38A67EC16137D2A01F187F2016735DA7DDF287167C16.1584.3597900165.2432",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|UDPAllowedPorts",
        "ConfigureDeadlineGracePeriod",
        "DefaultBodyStyle",
        "Text that appears in the IE browser title bar, including the standard string \"Microsoft Internet Explorer provided by.\"",
        "CIM_Log",
        "5.25, 180KB,  512 bytes/sector",
        "Your registry might be corrupted.",
        "CR_A4F5A56059DDF119F4CC303056A7BB3F243745A5AAA1FF57F146D0A87968F7FD",
        "28 - CIM_ERR_SERVER_IS_SHUTTING_DOWN. The WBEM Server is shutting down.",
        "EventID",
        "GetCorruptionCount",
        "CD_00330E7458B5D9A0228F0B77CE0CF834B3F16E931D55E4B84F81D2634A6E0B53.2528.3116218708.496",
        "LUAInstall: error 0x00000005 setting flags [{7459A610-B47B-4655-B86D-29D04B2755C1}]",
        "One or more parameters specified in LoginTargetIN structure is invalid.",
        "CD_BDB1FB83B60E9BD18231450213923BBA0EC1BFB3618EC2AD0ABF9ED38791F05A.2441.596887300.5279",
        "PartComponent",
        "The DoCompleteFirst property indicates whether the printer should start jobs that have finished spooling as opposed to the order of the job received.",
        "Report On Request",
        "{8F680855-A584-11d1-BF38-00A0C9062910}",
        "DefaultDnsSuffixes",
        "Volume is too large",
        "SAM Query Information Group",
        "I_0255C72DE857C2548B152EEC30DB6E16802B631CB06DED8AAADBC49C9509FDEB.616.1.272838",
        "HRFlags",
        "MDM_BrowserSettings",
        "MessageInterval",
        "The time of this job",
        "BusNumber",
        "Specific Token",
        "{B490264C-8D8F-40fd-B1BE-CD69AD779EC1}",
        "DomainDNSRegistrationEnabled",
        "A9A10",
        "BROWSERPLUGIN",
        "0804301.362",
        "Seconds spent reading data from source. (*1E-7)",
        "BcdDeviceData",
        "Reserved2 Flag",
        "Saves the specified event log to a backup file. The method returns an integer value that can be interpretted as follows: ",
        "Indicates whether the user is granted exclusive access",
        "Insertion Strings",
        "MSFT_CliAlias.FriendlyName=\"DMAChannel\"",
        "MSDASQL",
        "LetAppsAccessTrustedDevices",
        "Returns information describing the platform's hardware error injection capabilities",
        "Win32_Service",
        "CD_C4C4AC3CDD7A9E38A340BB56FE91B2D1BB13CEAA14A840B9C15B1953B57A1EE9.111.2356838062.1609",
        "The count of KMS requests from clients with License Status=2 (OOBGrace).",
        "A user-friendly name for the object. This property allows each instance to define a user-friendly name IN ADDITION TO its key properties/identity data, and description information. ",
        "DisallowKMSClientOnlineAVSValidation",
        "CIM_LANConnectivitySegment.ConnectivityType",
        "SAM Computer Password Set",
        "System failure: Try changing the driver for this device. If that does not work, see your hardware documentation. Windows is removing this device.",
        "CD_152A8109FBC9BC9F4E7BCE13CE14711A471088C4A0497E45C7C22F28216A40AD.36.1517753552.310",
        "SMBIOS|Type 10|Device Status n",
        "The SID in string format",
        "Can NOT complete within Timeout Period",
        "SecurityCenter",
        "IL_95836D7E2E497A1F78FB3DE04D6CC7B1E86FB113E1FC2C16F2960FB52159CE1E.556.1.28406",
        "C_BF1E5E829A1544FF8B694A6E8073DFF9D1CD4B2724FDB9291959D5493401980F",
        "If TRUE, the partition's MBR active bit will be set, and the partition will become bootable. This parameter is only valid for MBR disks.",
        "Relates an IPsec rule to its Main Mode crypto set.",
        "Specifies the position of the physical memory in a 'row'. For example, if it takes two 8-bit memory devices to form a 16-bit row, then a value of '2'means that this memory is the second device. 0 is an invalid value for this property.",
        "Determines the fault domain type by which each column in this storage tier should be isolated.",
        "The DisplayName property indicates the display name of the service. ",
        "Specifies the outgoing request's web message format.",
        "BusSev",
        "WSP_ReplicationGroupToPartition",
        "The namespace of the <portType> element in WSDL.",
        "A free-form string that contains the vendor error description.",
        "AssignedAccess",
        "I_B5845F4417EB0A7AD195B60C8C70005F48FB5E07E5853923BF9CEC00A11B4FA0.311.2565700494.249",
        "The JobId property indicates the identifier number of the job. It is used by other methods as a handle to a single job spooling to the printer.",
        "If applicable, defines the COM server name present within the unnamed value of the CLSID key.",
        "CIM_AssociatedSupplyVoltageSensor",
        "QueueID",
        "Standard Group - Reserved",
        "CIM_Indication is the abstract root class for all notifications about changes in schema, objects and their data, and about events detected by providers and instrumentation. Subclasses represent specific types of notifications. ",
        "Cannot resize a partition containing an unknown file system.",
        "MIF.DMTF|IRQ|001.2",
        "ErrorsAccessPermissions",
        "__ProviderRegistration",
        "\\\\.\\ROOT\\CIMV2:__Win32Provider.Name=\"UserProfileProvider\"",
        "Microsoft-Windows-Fax",
        "This parameter indicates whether defragmentation or the volume is recommended.",
        "object:MSFT_NetNatTransitionConfiguration",
        "InternetProtectedModeEnabled",
        "AssignmentType",
        "3 - Home Dir Required -  A home directory is required. This value is ignored in Windows NT/Windows 2000.",
        "Note that instrumentation's view of a System's 'roles' is defined by instantiating a specific subclass of System and/ or by properties in a subclass. For example, a ComputerSystem's purpose is defined using the Dedicated and OtherDedicatedDescription properties.",
        "The NameOfRawDataProperty property is the name of the property in the event which contains a UserSID in string or array of bytes format. This will become the lpUserSid param in the ReportEvent API function.",
        "DSP0201.DMTF|ERROR.CODE|2.3",
        "TunnelSupported",
        "CIM_StorageExtent.DeviceID",
        "Indicates whether this physical disk supports firmware update operation used by Windows",
        "Win32API|Service Functions|ControlService|dwControl|SERVICE_CONTROL_INTERROGATE",
        "BcdDeviceLocateStringData",
        "MCA_WARNING_PCI_BUS_TIMEOUT_NO_INFO",
        "OutStatusCount",
        "Indicates if TCP checksum offload is currently enabled for IPv4 packets on this Adapter.",
        "The maximum transmission unit (MTU) that can be supported.",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2136.3952311231.180",
        "The SystemLevelAddress property indicates whether the address information in the ErrorAddress property is a system-level address (TRUE) or a physical address (FALSE). This property is used only when ErrorInfo is not set to 3.",
        "PortNumber",
        "Change Notification Registration",
        "SharedKeyType",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{GUID}[AuthenticationLevel]",
        "AllowEdgeSwipe",
        "The volume cannot be quick formatted",
        "NS_59411655A8F95EE7BEABDFB898861DFA8E2BF23293A8AFE96B2E5BB236E7FE01\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_2C3E0B2C69ECC1F533E094C6BC0D6FE2FF50B62467F6FB0D4116BA80049303DF",
        "LSA Flag",
        "PNP_ERROR_LEVEL Flag",
        "Version of the settings location template.",
        "Win32_LaunchCondition",
        "The Plug and Play Device ID.",
        "This method adds one or more physical disks for manual allocation.",
        "// The number of bytes sent using the IPSEC tunnel mode.",
        "UpLimitMonthlyGBProvider",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2167.1101948841.368",
        "MDM_Update_PendingRebootUpdates01_01",
        "{748b14e8-32ee-4425-b91b-c9848c58b55a}",
        "Physical extent properties.",
        "IdleAccountingEx",
        "Specifies whether to enable or disable COM Port mapping.",
        "GET_INJECTION_CAPABILITIES",
        "ServicesAllowedList",
        "C_C6F302354CD11663A914DC4001850FBF0A66C16EFA86F9329AFF93A3CB628944",
        "Win32API|Process and Thread Functions|lpCommandLine ",
        "Win32_TSNetworkAdapterSetting",
        "0x00200000",
        "USECOUNT",
        "GetTSRedirectorMode",
        "SupportsCompletionQueueResize",
        "HeapRealloc",
        "I_F90254E7F99DA09977CCA3AFC876E2F69B143A5C7B620A38194806CCC0551447.810.1.92690",
        "This method is used schedule chkdsk to be run at the next reboot if the dirty bit has been set.The method is applicable to only those volume instances that represent a physical disk in the machine. It is not applicable to mapped logical drives. ",
        "9 - The user does not have adequate privileges.",
        "DnsClientPSProvider",
        "Device memory addresses management.",
        "DB-25",
        "AcpiControlStatus",
        "Specifies a bitmask indicating the communications parameter that can be changed",
        "CIM_EnabledLogicalElement.RequestStateChange",
        "WMI|Win32_1394Controller",
        "IsCompatible",
        "The Win32_SCSIController class represents a SCSI controller on a Win32 system./nExample: Adaptec AHA-2940UW.",
        "CD_4890EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4.279.1113330032.433",
        "UInt16Array",
        "Object which contains details for dialing up to the internet.  Corresponds to the RASENTRY structure",
        "The HomeDirectoryDrive property specifies the drive letter assigned to the user's home directory for logon purposes. ",
        "C_DC75EB8D61AF59F2FEB9BAFCC51C26F93B19442C9F5E9F7C071B8627E9152155",
        "MaxPayloadSize",
        "The MaximumBaudRate property indicates the maximum baud rate of the serial port",
        "Specifies whether the credentials supplied at the time of first successful connection should be stored in the cache.",
        "Example: 8",
        "80387",
        "UnsupportedFormat",
        "SDBUS_DEBUG_EVT_HANDLING Flag",
        "AllowPopups",
        "TimeDays",
        "C_A8F32ED73CC909392CBB6D2CFB5C52391FFF3A4DD4AE1EBE1F9D40C03A8C9EA6",
        "CreateVirtualDisk2",
        "grantType",
        "// This class is required.",
        "MS_SM_TargetInformationMethods",
        "    <securityDescriptor name=\"WRP_FILE_DEFAULT_SDDL\"></securityDescriptor>",
        "DirectoryTableBase",
        "Device does gray scaling",
        "LOCKS Flag",
        "ReplayWindow",
        "SERVICE_AUTO_START ",
        "AddressType",
        "To indicate whether the address family for this IP address is v4 or v6.",
        "IR_5C8E889EFDCAAB9A824CAD60A6893896BC511EF516AD1D2FC6061C440F917D0B",
        "{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}",
        "EAP Configuration object.",
        "0x00000005",
        "Ndis802_11AuthModeShared",
        "RAMBUS",
        "ITU X.213",
        "MDM_RemoteFind",
        "LargestFreeSpaceExtent",
        "The SCSIPort property indicates the SCSI port number of the disk drive.",
        "{485e7de9-0a80-11d8-ad15-505054503030}",
        "Example: C:\\WinNT\\Memory.dmp",
        "Number of bytes for dot11 connection start status indication",
        "PCIController is a superclass for the PCIBridge and PCIDevice classes. These classes model adapters and bridges on a PCI bus. The properties in PCIController and its subclasses are defined in the various PCI Specifications published by the PCI SIG.",
        "The ServiceType property supplies the type of service provided to calling processes.",
        "EstimatedRunTime is an estimate in minutes of the time to battery, generator, ... depletion under the present load conditions if the utility power is off, or lost and remains off.",
        "2.25.0",
        "Stream Paused Count",
        "SARule is a base class for defining IKE and IPsec Rules. Although concrete (because it subclasses from a concrete class), it is not intended to be instantiated. It defines a common connection point for associating conditions and actions for both types of rules. Note that each valid PolicyGroup containing SARules MUST use a unique priority number for the Rule in the aggregation, PolicySetComponent.Priority.",
        "Win32API|Process and Thread Functions|GetProcessVersion",
        "MSFT_NetLbfoTeamNic",
        "p0m;p0m;",
        "The ExposedName property is the file system name of the shadow copy when it is exposed.  This property might contain a drive letter or mount point.   This property is NULL when the shadow copy is hidden or otherwise not exposed.",
        "ChangeProductKeyMethod",
        "NA-9x11-Envelope",
        "Associates a firewall rule with its filters.  Instances of this class can be traversed and the values in the associated filters can be modified, but instances of this class may not be created or deleted.",
        "Unicode On Disk",
        "The group address enabled on the NIC for packet reception.",
        "The state of the ISATAP resolution. One of the following values: disabled, enabled, default.",
        "Verification in progress",
        "The scoping system's creation class name.",
        "Example: Creative Labs",
        "49005",
        "{f8c12ed7-c769-49fa-bf3e-db0b0160c94e}",
        "InitiatorName",
        "Vertical border",
        "IsLanConnection",
        "The new process runs in a private Virtual DOS Machine (VDM).",
        "Settable Parity",
        "SamIdByName",
        "DisableDebugMode",
        "AutoNegotiationFlags",
        "             without this flag will fail and return HRESULT_FROM_WIN32(ERROR_ALREADY_EXISTS). ",
        "{1008CCED-7BFF-11D2-AAD2-006008C78BC7}",
        "EnumKey",
        "{64439f80-c739-41eb-a192-6dba528a0244}",
        "Folio",
        "This field is a string representation of the enclosure's firmware version.",
        "UnregisterByTemplateId",
        "The software features that make up the operating system.",
        "IsVirtualMachine",
        "ref:MSFT_NetNeighbor",
        "Interfaces that the traffic applies to.  They may be specified by LUID or by Alias.",
        "EnabledThresholds",
        "IL_735452BBEBEFDAEBC6A68DCD86C8369C33E470B585707BA64EB646095B631099.1196.495475129.331",
        "AlwaysSendDoNotTrackHeader",
        "WMI|Win32_LogicalProgramGroupItem",
        "Example: PCI",
        "ReleaseDHCPLeaseAll",
        "The ObjectId of the replica peer within the replica's storage subsystem.",
        "Wired",
        "The new ID for the set.",
        "The Msft_WmiProvider_NewQuery_Pre event class represents an event generated immediately prior to calling the provider's implementation of IWbemEventProviderQuerySink :: NewQuery.",
        "RemoteAttestation",
        "// This class allows Hyper-V to identify the virtual port associated with a",
        "ROOT\\Microsoft\\Windows\\winrm",
        "QueryPolicy",
        "CD_84F8BABB6CA8331C4E9169FA40BA6E129D7FC9914E1CFF1EF6A24C2F4E5BC1E2.2112.3374214635.537",
        "IccId",
        "AllowDirectMemoryAccess",
        "Detached_Process - For console processes, the new process does not have access to the console of the parent process.  This flag cannot be used if the Create_New_Console flag is set.",
        "MDM_RemoteApplication",
        "Error - Unknown Drive",
        "o return extended (implementation specific) error information.",
        "VariableSpeed",
        "KeyManagementServiceHostCaching",
        "Which keying modules to use.",
        "StorageProvider",
        "MonitorFreqRanges",
        "0xEFFF002F",
        "{b062d889-ea7c-4d18-86d7-c26c42f9b108}",
        "The group of the file/directory object",
        "The CreationClassName of the scoping System.",
        "Example: Acme",
        "LifetimeSeconds specifies the maximum time that the SA will be considered valid after it has been created. A value of zero indicates that the default of 8 hours be used. A non-zero value indicates the seconds lifetime.",
        "The minor version of network adapter driver.",
        "TRUE indicates that this is a static route, and FALSE indicates a dynamically-learned route.",
        "Path to a file containing PDL for a separator page.",
        "An enumerated value that describes the severity of the Indication from the notifier\\'s point of view: ",
        "CD_8CFD3BDCF459E28A190CCF46FF43F533DE3394389F988133FD28EA5A0AEA1616.0.1669354959.382",
        "This field specifies the operating system, version, driver, and other host environment factors that influence the behavior exposed by storage systems.",
        "AES-GMAC-128",
        "R_988F45C7D3827182CC9E311CB986FEA0532897BB2CDEED83739CF2F82341462E",
        "RS423 Port",
        "C_95A9ADB2045BD99C8214F501BE25CE3247A7F55B6BF14CC069CB47314F289D9D",
        "NS_E9B749FAC938A42C5A021B8195BC99015D3E509222ADA5BB98A53C9CF3ADF3A4\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_BF9D9C18AB1A6E18A896CC939C82B68B48ACFFF2BF3B071F74FFEAF1FAE680D6",
        "PacketLoggingActive",
        "PerIPRateLimitQueueIdleTimeoutSeconds",
        "ption",
        "TM_DLLMAIN Flag",
        "{8502C4E1-5FBB-11D2-AAC1-006008C78BC7}",
        "The WallpaperStretched property indicates whether the wallpaper is stretched to fill the entire screen. Microsoft Plus! must be installed before this option is available.",
        "MachineURL",
        "ValidityDuration",
        "TR_COM",
        "SupportsFullDiscovery",
        "Thread Pool Timer Cancelled",
        "NDIS Device Power On Ex Notification",
        "PrimaryComputerEnabled",
        "NodeCount",
        "The Win32_PhysicalMemoryLocation class represents an association between an array of physical memory and its physical memory.",
        "A unique identifier for the health action instance.",
        "Audio Port",
        "Frame Relay MPI",
        "CIM::Network::Filtering",
        "PipeBuf_Trace",
        "NdisNetworkChangeStatusIndication",
        "43017",
        "Depleted",
        "InstallWindowsDefenderApplicationGuardMethod",
        "FullScanAndRebootAndManualStepsAndOfflineScanRequired",
        "Configures setting that specifies if additional failure prediction checking can cause a loss of performance",
        "CIM_USBController",
        "NS_6802DE5CFCF7BA416C8E2EAF790F087E2F2BDAFDA4AA4BB8DBEDCE204DD4A614",
        "SamSetBootKeyInfo_End",
        "The PrintProcessor property specifies the name of the print spooler that handles print jobs./nExample: SPOOLSS.DLL.",
        "Status",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_full_name",
        "IsScaleOut",
        "Example: A computer running Windows 2000 workstation or Windows 98 that is part of a Windows 2000 domain.",
        "The TotalHeads property indicates the total number of heads on the disk drive. ",
        "CR_878D5D30666EBFE440F941E45E7884E8AFCA7A1478E4D09AB57DC26571C8B7A6",
        "OpenPolicy_Start",
        "NDIS Vendor ID",
        "CIM_Printer.DetectedErrorState",
        "StartAddr",
        "Copy-On-Access",
        "The DeviceID property contains a string to uniquely identify this CD-ROM drive.",
        "Blocking Requests Rejected",
        "CD_CDE4A8C7C0B03EC0C311F78F07CE34C050F510D55C1F5373A349277F064EB193.1737.169116800.3849",
        "CR_25D6DE4F10F10C9622833D068798F50E89401E52F3D552BA53470C9A0F55267B",
        "PreventRemoteQueries",
        "RemovePackage",
        "MDM_Policy_Result01_RemoteAssistance02",
        "Non-volatile RAM",
        "Number of bytes for dot11 roaming completion status indication",
        "The collection trace listeners that listen to the System.ServiceModel trace source.",
        "WFP_TRACE_IPSEC",
        "The number of times that the TCP/IP stack has failed when sending IKE messages.",
        "IL_A8BC9FB28AE536629F0C3F24CCFF3FD727EF91A331918572457F22C8A4B50211.2675.989249670.288",
        "Returns the VpnConnectionTriggerDnsConfiguration object containing the list of DNS suffixes and their corresponding DNS servers",
        "FirstBurstLength",
        "write or store",
        "SizeStoredInPagingFiles",
        "Reinstall",
        "TransportBytesReceived",
        "MSADCF.1 formatted output (A)",
        "Server_Unknown",
        "{F8036571-42D9-480A-BABB-DE7833CB059C}",
        "AllocAddress",
        "The StartTime property represents the UTC time to run the job, in the form of YYYYMMDDHHMMSS.MMMMMM(+-)OOO, where YYYYMMDD must be replaced by ********.  The replacement is necessary because the scheduling service only allows jobs to be configured on a day of the month, day of the week, or run once. A job cannot be run on a specific date.",
        "Microsoft-Windows-Remote-FileSystem-Log",
        "WindowsServer2012",
        "Monitor's listed supported source modes",
        "k355DB6CE31803BDDBDD2FF491BD2AAE24F28E7ADF16402B3F3B9C4CF695702EB",
        "GRAPHMAIN Flag",
        "Meters",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_B498B69E308CCD72907DFE63279C92042927888BB64E0D473D3C48463EEABEA9",
        "hDefKey",
        "10 - Authentication failed",
        "If the voltage (in millivolts) drops below the value specified by Range1InputVoltageLow property, the UPS will compensate by boosting the voltage using its power source(s).  A value of 0 indicates that the voltage at which boosting occurs is 'unknown'.",
        "{900ABE67-C4FC-11DA-82C4-000D5692A4BC}",
        "MSStorageDriver_ScsiInfoExceptions",
        "The number of inbound quick mode security associations (SAs) added by IKE ",
        "Transfer",
        "relay",
        "MSNdis_FddiLongCurrentAddress",
        "CIM_SecurityAssociationEndpoint.PacketLoggingActive",
        "C_9B3B36A993A462F50891454718B9E94854BEF6CDA6B45E39722B69B985CF4900",
        "UpdateDirectConnectLicenseServer",
        "EVENT_TRACE_FLAG_QUERYINFORMATION",
        "transactionMiResult",
        "Enable a settings location template.",
        "No Access Allowed",
        "Manual Cleaning",
        "TCP Port",
        "useHKLM",
        "This field describes the maximum number of bytes that can form a strip in common striping-based resiliency settings. The strip is defined as the size of the portion of a stripe that lies on one physical disk.",
        "FHConfig",
        "MDM_Policy_User_Config01_Privacy02",
        "DATA_PROVIDER_PNPID_INSTANCE_NAMES_GUID",
        "{09f58643-31fb-45b5-852b-09b4d3ff3765}",
        "ISR_V1",
        "PhysicalAddrLen",
        "Note that this property, and the analogous property SystemName, do not represent propagated keys from an instance of the class System. Instead, they are properties defined in the context of this class, which repeat the values from the instance of System to which this PolicyAction is related, either directly via the PolicyActionInPolicyRepository association or indirectly via the PolicyActionInPolicyRule aggregation.",
        "CR_55AF22A4D3FD212FC3171AADE7109F17F27CA9F86C291AE560CF90E7D047839B",
        "Filter ID from the QM policy matching the extended mode filter",
        "TPM_StartupKey",
        "Defines a file share for security intelligence updates in virtual environments.",
        "I_F41AAB3CE0418D59CCEE78DC6089E8A71443DF08351201B015241ECCC0AF9C70.1617.460483849.315",
        "The Win32_Process class represents a sequence of events on a Win32 system. Any sequence consisting of the interaction of one or more processors or interpreters, some executable code, and a set of inputs, is a descendent (or member) of this class.",
        "NdisFddiRingIsolated",
        "Auto Configuration Enable",
        "The HighThresholdOnEvents property specifies the maximum rate at which events are to be delivered to clients. To accommodate speed differentials between providers and clients, WMI queues events before delivering them to consumers.. WMI slows down the addition of new events into the queue when the low threshold is reached. If this does not help, and high threshold (specified by this property) is reached, WMI will accept no more events from providers and return WBEM_E_OUT_OF_MEMORY to the clients.",
        "C_B89F81602D340760DCBF9C7FA464908E742B64A7C6E08A776FA3C9E7E3DE6507",
        "The UnitsPerWeek property indicates the number of time units the week is divided into.  It is used with the LogonHours property to limit user access to the computer.",
        "REDBOOK_WMI_PERF_TIME_STREAMING",
        "{791ad19d-e35c-11d0-9692-00c04fc3358c}",
        "Example: Path.",
        "Bid2Etw_SQLSRV32_1",
        "The ContextExchangeMechanism for ContextBindingElement",
        "InternetZoneDownloadUnsignedActiveXControls",
        "Number of bytes for dot11 PMKID candidate list status indication",
        "ExpectedBatteryLife",
        "{FAF76B62-798C-11D2-AAD1-006008C78BC7}",
        "Win32Registry|.DEFAULT\\Control Panel\\Desktop\\WindowMetrics|BorderWidth",
        "Length of configuration structure",
        "IL_A41A2A506F07DE19FA26EBBA5A53B62D2C62BAF775EC8BEA2B152B5D21A711E3.1489.1494767708.202",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardDate|wDayOfWeek",
        "The job ID for this job.",
        "MDM_EnterpriseModernAppManagement_AppInstallation01_01",
        "Minimum Template Level",
        "CD_FD5A09758773146E01CAB43EAC38C6EEFB9A870C8F888B5F24F7E89AF0CC12B8.61.2048206993.668",
        "43002",
        "Specifies whether the machine has tamper protection on",
        "Bytes Transmitted/sec",
        "StorageManagerName",
        "The Win32_ConnectionShare class represents an association between a shared resource on the computer and the connection made to the shared resource.",
        "ADOMD",
        "FrameworkPublisher",
        "dsize",
        "0xC0050059",
        "WD_LOG_FLAG_MEMORY Flag",
        "LogFlagInfo",
        "d1-84f4-0000f80464e3}",
        "The collection of behaviors implemented by this endpoint.",
        "{CA8E7FE6-B85E-497f-8858-9B5D93A66FE1}",
        "The specified object is managed by the Microsoft Failover Clustering component. The disk must be removed from the cluster to perform this operation.",
        "The request failed due to a fatal device hardware error.",
        "CR_18D8719A943B4599747ADA74EA7D32C69D833172BB0F49178849B0570759A4F9",
        "MaximumNumberOfRxQueuesForDefaultVPort",
        "RSOP_SecuritySettingsBlocked",
        "ServerRdmaCapable",
        "C_90E9A4B512231958877A8081A43A190212C66DB13315174B31713DA5090FB2E1",
        "The TcpMaxDataRetransmissions parameter specifies the number of times TCP will retransmit an individual data segment before aborting the connection. Valid Range: 0 - 0xFFFFFFFF.",
        "5..65000",
        "Time this namespace was created.",
        "{8c89045c-3f5d-4289-939a-fb854000cb6b}",
        "           // Binary IPv6 address",
        "Win32_SettingCheck",
        "Name is used to identify this software element",
        "DisableByTemplateId",
        "Proprietary Processor Card Slot",
        "The ExchangeMode designates the mode IKE should use for its key negotiations.",
        "DMAChannel",
        "SNMPDevIndex",
        "The NameOfUserSIDProperty is the name of a property in the event which contains an array of bytes, or a string. This will become the lpRawData param in ReportEvent API function.",
        "InteractiveLogon_MessageTitleForUsersAttemptingToLogOn",
        "The Index property specifies the index number of the network adapter configuration. ",
        "CD_189326F4F721F3B084F2B9D28FCA49B5C1A7BD8ADE57D16572A5693E864389B6.2106.1015868107.795",
        "FileNotFoundCacheEntriesMax",
        "CD_9D3103F1FED20F5A89A186A2A5165255DA3A6E898D7F2AF1A34CB11242007EC6.2099.597977299.1319",
        "SupportsFileServer",
        "RestartInterval",
        "MSFT_MaskingSetToTargetPort",
        "Verbose",
        "The maximum number of messages actively processing across all dispatcher objects in a ServiceHost. ",
        "Guid, the unique Id of the session",
        "CD_9D3103F1FED20F5A89A186A2A5165255DA3A6E898D7F2AF1A34CB11242007EC6.1733.3746481792.628",
        "Enables or disables time zone redirection.",
        "LetAppsAccessNotifications_ForceDenyTheseApps",
        "A label or identifier for the LAN Segment to which the Endpoint is connected. If the Endpoint is not currently active/connected or this information is not known, then LANID is NULL.",
        "The ID of the Virtual Machine to which the Virtual Function is assigned.",
        "An extrinsic method for clearing a log on this physical computer system.",
        "NewDllLoadAsData",
        "CD_9BCC36936A7CD2114CBD6BB3117D20BDC217533B6143F306B044A23AE20B32DC.1477.3331139944.294",
        "QYzWI",
        "OBJECT",
        "Time prior to deprecating a temporary address when a new address is generated. The default value is 5 seconds.",
        "KernelIdleState",
        "RD_TRACE_RESERVED_0d Flag",
        "vFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "__DYNASTY",
        "uint32",
        "TracingGeneral",
        "NetworkServiceHost:CLR",
        "NdisReceivesOk",
        "AttachedSASAddress",
        "BytesFromInternetPeers",
        "CD_C85BEC05E1DE78CAC5454E6D33A2BAFD69D28B4057355776F41B00B3DF99855E.2457.3806472261.234",
        "Allocated Size",
        "The authentication information for the target is not available",
        "Appliance PC",
        "LetAppsAccessContacts",
        "ObjectAccess_AuditKernelObject",
        "A subsystem drive or spindle.",
        "ImportEdgeAssets",
        "CR_0C89E3FE1CDFD790CBD5FEE0B9AE5F8AE27F38181A372EB2194AFCBADEB37DA8",
        "VPNServerFriendlyName (string)",
        "SourceInstanceModelPath",
        "CR_E706FF8586C52A7176ACA48D7702EC2A6550564F0E42B0C09AE3FD1CCEA62CD4",
        "eventSource",
        "PendingManualSteps",
        "{124E2045-8D63-4C23-B420-BBCD6A0ED61A}",
        "9B934CA495991B7852B855",
        "The file to set the integrity information for.",
        "// This class is required. ",
        "{FF9E2BDD-0E24-437c-84BE-7CFCAE635808}",
        "Irq Number",
        "CIM_ManagedSystemElement",
        "Win32API|Communication Structures|COMMPROP|dwProvCapabilities|PCF_PARITY_CHECK",
        "C_0783FC4315F6719B07F6F7780EAC7B73D0B0471C3E21E23BC45CB6B44FFECA8E",
        "NormalMin",
        "Invalid system path",
        "{4FB9130E-1FEF-4ae6-9E48-77839204D413}",
        "GetBindingSupport",
        "A persistent binding request included a bad FCP Target Node WWN",
        "SamAddMemToAlias",
        "MDM_Policy_Result01_RestrictedGroups02",
        "CD_E8DA4E4A5B4172ED75EC2B701107D8BF6AB896481F2534AE694C3BB5BC84D1F2.1561.2319829827.1303",
        "TR_POLICY Flag",
        "Adaptive Mirror Local",
        "{75BCF4F6-DB46-11D2-B4C8-80080C7B6371}",
        "User to be notified upon job completion or failure.",
        "Reliant UNIX",
        "TimestampRoute",
        "DefaultBlockSize",
        "TotalPhysicalMemory",
        "100Base-SX",
        "SeIncreaseQuotaPrivilege",
        "PagePriority",
        "VirtualAddress",
        "43027",
        "This method is used to dismount a volume from the file system.",
        "{9aec974b-5b8e-4118-9b92-3186d8002ce5}",
        "Defragment",
        "MCA_WARNING_PLATFORM_SPECIFIC",
        "PC-H98",
        "Portable",
        "Contents of the icon corresponding to the application",
        "OldThreadWaitIdealProcessor",
        "An association between a computer system and the system resources available on it.",
        "This object contains the data needed to find either the initial load device (its key) or the boot service to request the operating system to start up. In addition, the load parameters (ie, a pathname and parameters) may also be specified.",
        "Embedd",
        "ref:Win32_PowerSettingDataIndex",
        "_DH_WMP_MLS Flag",
        "ExecutionDelay",
        "{acf14040-a61c-11d0-8dd4-00c04fc3358c}",
        "8 - CIM_ERR_CLASS_HAS_CHILDREN. Operation cannot be carried out on this class since it has instances. ",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2736.2831676613.180",
        "{791ad196-e35c-11d0-9692-00c04fc3358c}",
        "The SystemVariable property indicates whether the variable is a system variable. ",
        "The ToolBoxBitmap32 property indicates the module name and resource ID for a small (16 x 16) bitmap used for the face of a toolbar or toolbox button. Used when the COM component is an OLE or ActiveX control",
        "CD_DAA0835D90559AB1BED3F4706FE66DA711EF5A48A581A0339267CD41A8EB5EF9.15.3478891741.1086",
        "IKE/IPSec Enabled",
        "C_33DCEF5A25E042E234D6018C36A73BB8BD2E0A0D570AA0A57D43D363A2232E3B",
        "CopyPriority",
        "FlushTimer",
        "when dithering is desired. 3",
        "The Name property indicates the path and file name of the page file.",
        "MSNdis_80211_Disassociate",
        "ReadLatencyMax",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_name",
        "Indeterminate Error Counter",
        "Microsoft Windows Server 2003",
        "Configuration Software",
        "Win32API|Printing and Print Spooler Structures|JOB_INFO_4|Status",
        "Bid2Etw_MSDADIAG_ETW_Trace_TextA",
        "The event message as it appears in the NT Eventlog.",
        "Specifies the GUID of the LanAdapter.",
        "DBNETLIB.1 formatted output (W)",
        "Subsegment",
        "IR_3BB2F25840E05D325FAFACABBB276A102D49D79CD3C3CCD8CF11A4F77E826041",
        "Time that the process was stopped or terminated",
        "ReadCacheSize",
        "TRACE_LEVEL_INFORMATION",
        "Controls the binding for metadata retrieval using HTTPS.",
        "Administrative",
        "MGR_TRACE_RESERVED_0b",
        "IPv4Enabled",
        "{125d41bc-7643-4155-b81c-e2f128ad1fb4}",
        "{935F4AE6-845D-41C6-97FA-380DAD429B72}",
        "The current state of the specified configuration resources.",
        "MDM_Policy_Config01_ApplicationDefaults02",
        "RD_TRACE_DEVICE Flag",
        "A Win32_FolderRedirectionHealth object that represents the health of the user's redirected Favorites folder.",
        "ExportByName",
        "16-bit FAT",
        "C_5EBF5C53D7C8D0D262B25B6FAB388FB8F7A1F2DD89675D93810B1C0121FE11D1",
        "SolicitedRemoteAssistance",
        "{0d9e01e1-ba70-11d4-b675-002048570337}",
        "CD_5F8086938F6BF421BA200D039913652FDC167A0FF909755EB1FA584E2EE04F6B.1783.143354355.728",
        "StreamPausedCount",
        "DH-CHAP available for virtual ports",
        "Win32_ReserveCost",
        "CIM_Error.OtherErrorType",
        "PerfInfo_V2",
        "Purpose",
        "MSFT_ExpressionCall",
        "TRACE_CLASS_THREAD Flag",
        "SavedGames folder, GUID is {4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4}",
        "Indicates the size of the read cache on the virtual disk.",
        "Recoverable",
        "CIM_IKESAEndpoint.HashAlgorithm",
        "Specifies whether to allow Audio Capture redirection.",
        "Bit flags specifying how the access rights are inherited",
        "The Win32_TSGeneralSetting includes capabilities such as Protocol, Transport, Comment, Windows authentication and Encryption Level.",
        "This field indicates the intended usage for this storage tier.",
        "ControlRequests",
        "I_6A6B9E2BBE3244917A6F8976955E1E6E04DDACCE833988626D557DC094A5D1C2.2469.2992845625.349",
        "{1FF6B227-2CA7-40f9-9A66-980EADAA602E}",
        "\"Stopped\" and \"Aborted\" are similar, although the former implies a clean and orderly stop, while the latter implies an abrupt stop where the state and configuration of the element might need to be updated. ",
        "PolicyChange_AuditOtherPolicyChangeEvents",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1068.2673901424.340",
        "C_7FCF3928CE1A9575028B7746073AE3C5F6F2163882EECBCF60F66F9FAFB60664",
        "MetadataExporter",
        "The PlusVersionNumber property contains the version number of the Windows Plus! operating system enhancement software (if installed).",
        "R_FCA9F76AC6C239B0B01B1672252F6805168C019918C672ED3A9DA5B69DB47E2C",
        "Specifies the new default provisioning type of the storage pool.",
        "PeerCustomResolverBindingElement",
        "SPACES_StoragePool",
        "NS_93222BF82F7ED3C9F50890B91B7CDA9A6E48A3EFBC7BEE0C8A4F913101034177",
        "CIM_Indication.IndicationIdentifier",
        "LPC_TRACE_RESERVED_19 Flag",
        "The SCSI Target ID associated with this LUN, matching the SCSI_ADDRESS",
        "WLANDLG_TRACE Flag",
        "Generic_Exception",
        "ID of current product's Application",
        "PolicySourceRemoteSessionProfile indicates whether the property RemoteSessionProfileis configured by Server (0),Group Policy (1).",
        "__NTLMUser9X",
        "Win32API|System Structures|CM_PARTIAL_RESOURCE_DESCRIPTOR|Dma|Port",
        "Associates a network adapter with the setting data of its VMQ queues.",
        "Association between StorageSubSystem and PhysicalDisk. This association should include all physical disks that the subsystem is aware of.",
        "CD_3A4B092E649E9EDDE3FA5F08BAF4EBD82A1D1063DB19A1DD0454E516CA8119BC.2434.3984468180.6348",
        "The Win32_OSRecoveryConfiguration class represents the types of information that will be gathered from memory when the operating system fails. This includes boot failures and system crashes.",
        "Name of the extension (e.g. .txt)",
        "MDM_DevDetail_Ext01",
        "ProductCode",
        "RSOP_ExtensionEventSource",
        "An array of integers indicating Printer capabilities. Information such as \"Duplex Printing\" (value=3) or \"Transparency Printing\" (7) is specified in this property.",
        "Win32API|Process and Thread Structures|STARTUPINFO|XCountChars",
        "AdapterCompatibility",
        "C_BA885398BE174F1F7801A16318AAD62AEB981E3F5EEB2272CF873A91B96E49E3",
        "configurationNumber",
        "7BEF112C2070090FD\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "Logon/sec",
        "0x100000",
        "{956597A1-7D80-11D2-AAD3-006008C78BC7}:ToInstance",
        "provider",
        "MSFT_DiskImageToVolume",
        "ImageChecksum",
        "LUAInstall: error 0x00000005 setting flags [{93C063B0-68CB-4DE7-B032-8F56C1D2E99D}]",
        "Query",
        "CIM_PowerUtilizationManagementService.PowerUtilizationMode",
        "Subsegment Size",
        "polmkrBaseGpoDisplayName",
        "Work Station",
        "MSFT_NetProtocolPortFilter",
        "R_FBFFFF984DA9B7029EE7078D02385B8FF23DEF8E12B59491A9BDEA2549806FA0",
        "// The total number of negotiations that resulted in the use of plaintext (also known as soft SAs). This typically reflects the number of associations formed with computers that did not respond to main mode negotiation attempts. This can include both non-IPSEC-aware computers and IPSEC-aware computers that do not have IPSEC policy to negotiate security with this IPSEC peer.",
        "AntispywareSignatureAge",
        "CertificateServicesClient",
        "PCI_COMP_IO_NUM is valid",
        "Shadow copy provider not registered",
        "CIM_StorageError references the Error object, defining the starting and ending addresses that are 'mapped out' of the storage extent.",
        "The application filter applied to the rule.",
        "IR_2FEB110D9B2D8B964448231D62D228EB77833D966ACDE6C751FBBBE880E8D6B9",
        "A textual description of the product.",
        "Win32_SoftwareElementResource",
        "Specifies the element replicas for Add or RemoveSyncPair.",
        "Replaceable Applications",
        "C_939BDE950037625234CD85F8C6B1EA2B080202B0F17AF76D4D121C0816452127",
        "The ConnectionlessService property indicates whether the protocol supports connectionless service. ",
        "Initiator Port",
        "WSManAutoFlow",
        "QuerySecret_End",
        "SetVLRenewalInterval",
        "MSFC_VirtualFibrePortAttributes",
        "A MainMode SA.",
        "MGR_TRACE_RESERVED_06 Flag",
        "MSFT_NetAdapter_PacketDirectCapabilities",
        "The VerticalResolution property indicates the current number of pixels in the vertical direction (Y axis) of the display.",
        "The FileID of the Win32_FileSpecification representing this driver.",
        "2 - Communications Error. Errors of this type are principally associated with the procedures and/or processes required to convey information from one point to another. ",
        "QuarantinePurgeItemsAfterDelay",
        "Revised Encryption with RSA",
        "PriorityDownloadsPending",
        "Class Name",
        "USERDEFINED",
        "This cmdlet adds a DNS suffix to the trigger properties. Whenever client tries to access a resource that matches the DNS suffix, VPN connection is auto-triggered.",
        "Many devices include sensors or have sensors installed nearby, in order to measure critical input and output properties.  This association indicates that relationship.",
        "MDM_Policy_Config01_Security02",
        "4 = Installed via file extension activation, ",
        "\\\\.\\root\\Microsoft\\Windows\\DesiredStateConfiguration:__Win32Provider.Name=\"DSCCoreProviders\"",
        "SP_SERIALCOMM",
        "Data Dependent Multiple Algorithms",
        "InterfaceGuid",
        "C_410D7099EDD88BE50D962D5B670D3AC5CA5FD46428D3FEEB55DA5CF9C0146EC2",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.1973968525.368",
        "Win32_DfsTarget",
        "The Name property defines the label by which the Filter Entry is known and uniquely identified.",
        "Example: 530.",
        "EnableAutomaticReconnection",
        "MaxConcurrentSessions",
        "ttings9",
        "Stack",
        "The IPSubnet property contains a list of all the subnet masks associated with the current network adapter.",
        "CR_DF35CAA9032B2BC8E9E68BEFAD5091A66EF205D46DBC51F13F62EC987E8BBEAC",
        "A unique key identifying this service specification item within its product.",
        "The GroupComponent reference represents the computer system upon which the process is running.",
        "TargetElement shall not be supplied",
        "MCACpuMSError",
        "I_05871F7367735F5F486B28150ED59EA0C3553ADBEDC56F11017BA47141A37867.2708.3908838371.285",
        "ConfigLength",
        "BUS_SPECIFIC_DATA",
        "The MofSelfInstallDirectory property contains the directory path for applications that install MOF files to the CIM repository. WMI automatically compiles any MOF files placed in this directory and, depending on its success, moves the MOF to a subdirectory labeled \"good\" or \"bad\". If the \"autorecover\" pragma is included, the fully qualified file name is added to the AutorecoverMofs list used when WMI is initializing or recovering the repository. The list determines the order in which MOFs are compiled.",
        "The total number of fragmented files on the volume.",
        "D5472BB4000403F6D6CDB0F595804CE62C0D292549796526CA9E7773798E5F24",
        "CurrentManagementFirmwareVersionString",
        "WNS Channel Creation Status",
        "MSFC_HbaApiVersion",
        "CheckPoint",
        "MSFT_NetIPInterfaceAdapter",
        "The ICMIntent ( Image Color Matching Intent ) property indicates the specific value of one of the three possible color matching methods, (or intents) that should be used by default. This property is primarily for non-ICM applications. ICM applications establish intents by using the ICM functions. This property can be one of the following predefined values, or a driver defined value greater than or equal to 256.Value Meaning :-1",
        "CD_F2E5B645DF6978E5AB18256B0F51A44E754826A7C900B35CBE3234B8A07F16B9.1750.828384169.478",
        "The name of the argument.",
        "The PseudoStreamOriented property indicates whether the protocol is a message-oriented protocol that can receive variable-length data packets or streamed data for all receive operations. This optional capability is useful when an application does not want the protocol to frame messages, and requires stream-oriented characteristics.",
        "SetDomainInfoPolicy",
        "11001",
        "CD_80675749A482112913F21FDBD7D7D7162BF42E8F9D4DFDC3F2A040FA1BE63D51.1490.3827769967.3233",
        "REG_SZ (1) ",
        "LocalCreationTime",
        "PLATFORM_TRACE_RESERVED_07 Flag",
        "LDAPServiceName",
        "Cluster Server Edition",
        "C_AD7EFADAD1289B4A3FEF0D60EBF19DD1D014EA7A1302D0431E7F57E3F564CBFB",
        "C_A21DD98AF56DC0A7D21C24764DDA5A5F7A3EA65FE4980FAAB7F2035E4807972C",
        "SERIAL_WMI_STOP_1",
        "CIM_RegisteredSpecification.SpecificationType",
        "OSArchitecture",
        "object:ISCSI_RedirectSessionInfo",
        "Defines the file shares for downloading security intelligence updates. setting allows you to configure UNC file share sources for downloading security intelligence updates. Sources will be contacted in the order specified. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources. For example: {\\unc1 | \\unc2 }. The list is empty by default.",
        "LicenseStatusReason",
        "Win32API|System Information Structures|SYSTEM_INFO|wProcessorArchitecture",
        "PeerDiscoveryFirewallRulesEnabled",
        "{6BD6AECA-AFB0-45b7-BAC4-F292EC0F3F41}",
        "The KernelDumpOnly property has been deprecated in favor of the DebugInfoType property in the same class.  All future work should use this new property.  /nThe KernelDumpOnly property indicates whether only kernel debug information will be written to the debug log file. /nValues TRUE or FALSE. If TRUE, then only the state of kernel is written to a file in the event of a system failure. If FALSE, the system will try to log the state of the memory and any devices that can provide information about the system when it failed.",
        "49006",
        "This represents a string element.",
        "PolicyVersion",
        "The maximum number of copies that can be produced by the Printer from a single Job.",
        "DeleteTCB",
        "RxTxEnabled",
        "RSOP_ScriptPolicySetting",
        "The association between a shadow copy provider and a supported volume.",
        "2.35.0",
        "d(m;d(m;",
        "This parameter specifies the partition offset (measured in bytes). If the offset is not aligned and the Alignment parameter is not specified, the offset is rounded up or down to the closest alignment boundary depending on the size of the disk on which the partition is created.",
        "SystemConfig_V3_PnP",
        "The driver for this device might be corrupted, or your system may be running low on memory or other resources.",
        "NotifyOnListen",
        "Represents a manageable physical disk enclosure.",
        "iteable.",
        "IL_787A200B25B0F5C6729D1D578C8F78CD412BA6F80EDCC079C80146CB69F7319B.1105.1363291257.319",
        "MSFT_SmbShareAccessControlEntry",
        "Indicates if LSOv1 is currently enabled for TCP packets.",
        "PreventAccessToAboutFlagsInMicrosoftEdge",
        "HeapFlags",
        "displayName",
        "17     This device is asking for an unknown resource type. ",
        "The CIM_RemoveFileAction uninstalls files.",
        "ResultByteArrayValue",
        "{39511dbe-899b-11d2-819e-0000f875a064}",
        "CD_D18B021DE887D56CED90F13460DE767FA0BA3077FF010C862ECF83FC393D6F1F.1836.2989187561.281",
        "The Name string provides the name for the verb.",
        "Number of virtual ports that can be created on this physical FC port",
        "ServiceSecurityAuditBehavior",
        "ReleaseInstanceMode",
        "RestoreFilesAndDirectories",
        "ResetToFactoryStateMethod",
        "Indicates that the feedback cursor is forced off while the process is starting.",
        "Settable XON/XOFF supported",
        "PageFault_HeapRangeTypeGroup",
        "   //******************************************************************",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_6952BC8C6187412BA6F7CAEE56328B9DCA8AFF615B18BF7135EB8A91F51729F6",
        "System configuration directory",
        "// per miniport instance (adapter). ",
        "CD_755C3664114AA9097DEA3F0332A59D1FE1A4668C8001C4E97937639305CB9174.1650.2711726867.323",
        "Reserved field",
        "SourceGroupSettings",
        "CD_29DECD57CEAC20C8FBE48C1CEA8F70E0F53A065C3A111386C70723311B9A2585.1569.708274825.330",
        "Association between Partition and Volume",
        "SystemConfig_V2_CPU",
        "Fatal",
        "IL_51D55482B7AF4894C57C3464572BF16B3F50568D4C97132E3EE18E297A796DF9.299.653620820.315",
        "        <dsig:Transform Algorithm=\"urn:schemas-microsoft-com:HashTransforms.Identity\"></dsig:Transform>",
        "{3FB828F7-F119-4066-B1E6-DB407CE9DE91}",
        "linkOrder",
        "ISCSI Login Options Version",
        "ref:Win32_SystemDriver",
        "The FileSystemFlags property is deprecated in favor of FileSystemFlagsEx",
        "DemotePercent policy",
        "MCA_WARNING_MAS",
        "QueryIsolationType",
        "Microsoft",
        "Buffer",
        "largeCustomLogoBitmapPath",
        "RemoveFromRemoteReplicationCollection",
        "Win32API|Printing and Print Spooler Structures|JOB_INFO_4|Size",
        "MSFT_SoftError_NotAuthenticated",
        "{F55C5B4C-517D-11d1-AB57-00C04FD9159E}",
        "MDM_VPNv2_TrafficFilterList02_App04",
        "The Win32_TokenPrivileges abstract class contains information about a set of privileges for an access token. Each process or thread in the job object has an access token specifying what resources and actions are available to it. For more information, see the Access Tokens topic in the Platform SDK Access Control documentation.",
        "The FSName property is string indicating the name of the file system.",
        "Specifies the type of event. This is an enumerated string",
        "KeyModule",
        "I_C52295624F06C940B122D80C080F06A7E8A3B72E8DBB8DAB3530E90B3C01E0C8.1501.2805401284.326",
        "PolicySourceSelectNetworkDetect indicates whether the property SelectNetworkDetectis configured by Server (0), Group Policy (1).",
        "CD_8DE46DD6446B26621A23E11758AE5CBC62C9F72998CAFB08B9CD58DF66902A20.1782.1189413192.422",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_F98CD8F4EA96B0B77910240E3039FCC377A97641ECA44728EE7350A6200A681A",
        "The host name is invalid.",
        "AverageProcessingTime",
        "Initiator and target negotiate the maximum number of outstanding R2Ts per task, excluding any implied initial R2T that might be part of that task.  An R2T is considered outstanding until the last data PDU (with the F bit set to 1) is transferred, or a sequence reception timeout (section 6.12.1) is encountered for that data sequence.",
        "Do All - execute ALL actions which are part of the modeled set, according to their predefined order. Continue doing this, even if one or more of the actions fails. ",
        "MoveTo",
        "1 - The request is not supported.",
        "Sense Buffer",
        "The MethodName property holds a string container the name of the method for the object.",
        "RSOP_IEFavoriteOrLinkItem",
        "IP Switch",
        "LocalPackage",
        "The CopyEx method copies the logical file or directory specified in the object path to the location specified by the FileName parameter. CopyEx returns an integer value of 0 if the file was successfully copied, and any other number to indicate an error. A",
        " $(,048<@DHLPTX\\`dhlptx|",
        "C_BFADFC7C01226A013315DA8D6A490777F3088D0548B91B44B7B3C64DD75485EE",
        "CD_38CA7FED21B16AE8C42210D10395046AA0C1BC650EF11697FFB6D8AC7EB96050.67.2370432329.250",
        "CIM_IKESAEndpoint.OtherAuthenticationMethod",
        "SSLEcdsa384",
        "H.323 Proxy",
        "C_848678FEA3E9DEEA8B4E9FB42ED8A13EB705C3DB7C73AB893E320FAEEC87714C",
        "Specifies the cache file to operate on. ",
        "IsKeyAttestationCapable",
        "AH/ESP",
        "Indicates network adapter support for Receive Side Scaling (RSS) for this encapsulated packet type.",
        "The power supply associated with the current sensor.",
        "MIF.DMTF|System Resource Memory Info|001.6",
        "instruction fetch or instruction prefetch",
        "_DH_WMP_MLS",
        "The location for the administrative image to be installed at.",
        "REDBOOK_WMI_STD_DATA",
        "TimeReadDelay",
        "AbsolutePathToTemplate",
        "Device Admin",
        "The NumForwardPackets parameter specifies the number of IP packet headers allocated for the router packet queue. This should be at least as large as the value of the ForwardBufferMemory property divided by the maximum IP data size of the networks connected to the router. It should be no larger than the ForwardBufferMemory value divided by 256, since at least 256 bytes of forward buffer memory are required by each packet. The optimal number of forward packets for a given ForwardBufferMemory size depends on the type of traffic carried on the network, and will be somewhere between these two values. If the router is disabled, this parameter is ignored and no headers are allocated. Valid Range: 1 - 0xFFFFFFFE.",
        "WINSTATION_DISCONNECT=0x200",
        "kilobytes per second",
        "FaultingObjectType",
        "EnableLoadBalanceScaleOut",
        "Unified",
        "Adds the given license server to the end of the list of specified license servers.",
        "CBStop",
        "ClassContext",
        "0xD01E",
        "InstanceObject",
        "Specifies whether the machine is a virtual machine",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|VoiceSwitchFeature",
        "This property returns the presence of connected account",
        "CR_961B71EE3CEF77853FD06FD1FD078D670615B8B606936AC4407F5BADB29E35F4",
        "The localized name of this set.  This field's value is based on the value of ElementName.  Changes to this field are ignored.",
        "The insertion strings that accompanied the report of the NT event.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2041.1860447720.180",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_units_per_week",
        "The path to store the collected logs. On a remote subsystem, this path must be accessible to the client (management) machine, and not necessarily the remote subsystem.",
        "TRACE_CLASS_PROTOCOL Flag",
        "Size of replication journal in units of bytes. Size must be in multiples of gigabytes.",
        "TM_STORE Flag",
        "Token Ring Address",
        "InitialR2T",
        "48006",
        "State Name",
        "r 0x00000005 setting flags [{C1F400A4-3F08-11D3-9F0B-006008039E37}]",
        "I_B1169607B8866983843438F9EA397897C0E954A6BE0361A15C053E12F2A28323.2714.1728243524.303",
        "{0F73ED59-8ED9-11d2-B340-00105A1F8569}",
        "RecordFormat",
        "SupportAccessId",
        "1 - 'Warning': The disk is still functioning, but has detected errors or issues that require administrator intervention.",
        "SetTrstedDomInfoByNam_Start",
        "SetNumForwardPackets",
        "MIF.DMTF|General Information|001.4",
        "CIM_LogicalDisk",
        "WmiQueryReceiveFilterParameters",
        "YFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "Specifies the authentication mode.  ",
        "Write Total Corrected Errors",
        "C_7C45DDC3F0B908F61AA329F5465AEFAE6329C442DE4912860BDE52AD5F8B5167",
        "ProcessMemoryLimit",
        "{4a8aaa94-cfc4-46a7-8e4e-17bc45608f0a}",
        "M1 Family",
        "MSFT_SmbMultichannelConstraint",
        "Values: TRUE or FALSE. A value of TRUE indicates XON/XOFF is supported.",
        "Origin",
        "MsftDiscFormat2StreamInterleave_DebugDestructor Flag",
        "Where: indication-service-name is the value of the Name property of the CIM_IndicationService instance responsible for delivering the indication. cim-service-start-id is an identifier that uniquely identifies the CIM service start, for example via a timestamp of the start time, or via a counter that increases for each start or restart. listener-destination-creation-time is a timestamp of the creation time of the CIM_ListenerDestination instance representing the listener destination.",
        ";\"s'<",
        "{a7eb57f6-145e-4f18-bd75-dbbf6f7e23a7}",
        "I71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "0x40000022",
        "customizeLogoBitmaps",
        "A localizable text describing the qualified component of this instance. The string is commonly parsed by the application and can be displayed to the user.",
        "Win32_SerialPort",
        "MSNdis_HDSplitParameters",
        "SEL_EVM_REV is valid",
        "Values:  TRUE or FALSE. If TRUE, the load order group can includedrivers.",
        "The name of the instance of performance counters of the endpoint.",
        "1 - Connecting",
        "MSFT_ResourceInDesiredState",
        "MIF.DMTF|Power Supply|002.20",
        "CIM_DNSProtocolEndpoint.AppendPrimarySuffixes",
        "The Firmware Revision property is a manufacturer-allocated number used to identify the physicalmedia.",
        "DataStore Flag",
        "1 - Not supported",
        "MS_SM_HbaApiVersion",
        "The HiddenSectors property indicates the number of hidden sectors in the partition.",
        "FlushLatencyMax",
        "Disable Debug DSC Configuration.",
        "XmitLinkSpeed",
        "Resource Exhaustion",
        "Indicates the caching status of KMS host name and port: 0=Caching disabled, 1=Caching enabled (default).",
        "actelisMetaLOOP",
        "The ServerName property identifies the server that controls the printer. If this string is NULL, the printer is controlled locally. ",
        "sNAMESPACE",
        "SamGetBootKeyInfo_End",
        "The assigned serial number of this software element.",
        "ActiveTripPointCount",
        "WPD Composite Driver Trace",
        "SetColorDepth",
        "Local Configuration Manager settings.",
        "Resources changed state in the configuration.",
        "User to be notified upon job completion or failure",
        "WriteTransferCount",
        "MSNdis_StatusDot11ScanConfirm",
        "Settings to be applied to source Replication Group.",
        "MinHSyncDenominator",
        "AddressFilterMode",
        "The position of this patch in the sequence of patches on the source media.",
        "Security level for the Intranet security zone",
        "Network Inspection System engine version (major, minor, build, revision)",
        "Example: Legal",
        "Two Sided Long Edge",
        "Select * from Win32_IRQResource",
        "Cable Modem",
        "Not Applicable (5) indicates the element doesn't support being enabled/disabled. ",
        "Clear_BCCache",
        "MemResetInfo",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\CrashControl|AutoReboot",
        "DriverCompleteRequestReturn",
        "MSFT_CliAlias.FriendlyName=\"DriverVXD\"",
        "Example: c:\\public.",
        "LetAppsAccessTrustedDevices_UserInControlOfTheseApps",
        "polmkrBaseCseGuid",
        "TimeLimit",
        "The value for NoSinglePointOfFailure is not supported.",
        "The maximum amount of time that can elapse before this MMSA must be re-established.",
        "Reference to the job (may be null if job completed).",
        "MSFT_StorageSubSystemToStorageHealth",
        "TimerCancelNtTimer",
        "INVALID",
        "Network Interface Controller (NIC) management.",
        "PhyResetProblemCount",
        "The command line options for the install.  These should be in the form of property=setting",
        "ACPI BIOS throttle states",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|UntilTime",
        "Severe",
        "__ObjectProviderCacheControl",
        "IEEE DCBX is supported.",
        "{acf14035-a61c-11d0-8dd4-00c04fc3358c}",
        "Not applicable (signal sync type must be digital separate)",
        "DefaultMimeType",
        "The Name property indicates the name of the current network connection. It is the combination of the value in the RemoteName property and the value in the LocalName property.",
        "{A5AE701E-DB31-11d2-85FC-0000F8102E5F}",
        "Disconnecting",
        "PCI_BUS_DATA",
        "Read Corrected Without Delay",
        "QualifierValue",
        "Clone",
        "MSFT_StorageFaultDomainToStorageFaultDomain",
        "The name specified is invalid.",
        "MachineArchitectures",
        "UseDHCPForDNS",
        "SecurityGroups",
        "SuppressDuplicateDeletion",
        "ConfigureDeadlineForFeatureUpdates",
        "C_D36BA3ECD67E70A681B6A3C59013CFFFBADE74E531546E307816C80C79F820CF",
        "Lower Filter Count",
        "Proprietary Wireless MAC Layer",
        "Values: TRUE or FALSE. If TRUE, DSR data transmission is suspended until DSR signal is given.",
        "Msft_WmiProvider_DeleteInstanceAsyncEvent_Post",
        "LogFlagLock",
        "RequestStateChange",
        "//  Module: WDM classes to expose HBA api data from drivers",
        "Color Temperature Degrees K",
        "Win32API|Network Management Functions|domainname",
        "A list of ApplicationId's in guid form for applications that upgraded (installed over) by applying this application.  Each ApplicationId corresponds to the ApplicationId property of an instance of RSOP_ApplicationManagementPolicySetting.",
        "AhEspCombinedEnabled",
        "VpnConnection consists of the following fields: ",
        "OldAllocSize",
        "IMAPI2 Raw Image Writer",
        "_DH_WMP_CDBURN",
        "ref:MSFT_DiskImage",
        "Values: TRUE or FALSE. If TRUE, a password is required.",
        "Enumeration indicating what operations will be executed synchronously -- without the creation of a job. If an operation is included in both this property and SupportedAsynchronousActions then the underlying implementation is indicating that it may or may not create a job.",
        "MGR_TRACE_RESERVED_12 Flag",
        "CD_3B46459D96BAF6024CC69D0B547D339FA3140A99F61C6D7F2039EDDAAF55977A.1788.1.19730",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|ArpAlwaysSourceRoute",
        "59007",
        "If OperationalStatus contains 1 - 'Other', this field contains the string representing the vendor defined operational status. This property must be NULL if OperationalStatus does not contain 1 - 'Other'.",
        "AccountLogonLogoff_AuditUserDeviceClaims",
        "C_98772C151E80309DDC5E68EA8FD1FD4D236455E4349502089D504086779DE396",
        "Offloaded",
        "60001",
        "Class for holding propertis of configuration status object.",
        "CR_8757FA834BF17A34F40DA9E567F73EB3C0F519BA77B457CB4D641370202A1355",
        "CD_3E214E33D7A5FDE14F0AA348BFED5EB5C77FBA80E64B04793EFEA1E92F43C436.1190.103934137.244",
        "IKESAEndpoint is created in the first phase of SA negotiation and protects the key negotiation traffic. This endpoint is only created when IKE is the key exchange protocol. Other protocols and their endpoints will be defined in a future release.",
        "ISA is supported",
        "BcdDeviceLocateElementChildData",
        "C_AA1DD3640D7B2D57CFE7C2BEFC6486AE9A0D1C4F244663B25B67A3D81A74611F",
        "AntimalwareDetectionStatus",
        "0xD002..",
        "The frequency (in Hertz) at the low end of this powersupply's input frequency range 2. A value of zero implies DC.",
        "AsyncPattern",
        "CD-RW",
        "The security settings of the file or directory",
        "CIM_Processor",
        "The 802.11 infrastructure mode",
        "A file or data set store local to a computer system or remotely mounted from a file server.",
        "IsPhysicalClearDisabled",
        "Suppose we have a PolicyRule that aggregates five PolicyConditions C1 through C5, with the following values in the properties of the five PolicyConditionInPolicyRule associations: ",
        "Msft_WmiProvider_InitializationOperationFailureEvent",
        "Smb2CreditsMin",
        "iFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "Indicates whether the registry key, or registry value has been deleted.",
        "EXFAT",
        "LPCDRVR_TRACE_RESERVED_14 Flag",
        "Protecting Resource Failure",
        "B41C53E6DB1ACF2453CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "{8502C589-5FBB-11D2-AAC1-006008C78BC7}",
        "NCR3000",
        "MSFT_ExpressionValue",
        "PoolAllocFree",
        "{2b440188-92ac-4f60-9b2d-20a30cbb6bbe}",
        "cation with it.",
        "The FileName property is a string representing the filename (without extension) of the file. ",
        "Allows or Denies retrieving IP address of the Session Directory.",
        "Group Policy",
        "The ConnectionlessService property indicates whether the protocol supports connectionless service. A connectionless (datagram) service describes a communications protocol or transport in which data packets are routed independently of each other and may follow different routes and arrive in a different order from that in which they were sent. Conversely, a connection-oriented service provides a virtual circuit through which data packets are received in the same order they were transmitted. If the connection between machines fails, the application is notified./nValues: TRUE or FALSE. A value of TRUE indicates the protocol uses a connectionless service.",
        "Object which contains details for security zone attributes for a given zone.",
        "GET_ALL_POLICY",
        "HBAType",
        "Platform generic error status",
        "C_D3AFCBAF22653374F26FE8337CBE6005C90DBCA84C064E5B13CA4595121B7209",
        "Win32Registry|System\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}",
        "Preference Mode",
        "Hard Error",
        "PortIds",
        "Negotiate",
        "ManageVolume",
        "GetFCPStatistics",
        "object:MSNdis_PMCapabilitiesParam",
        "MEM_BANK",
        "BranchCache data cache",
        "HOSTPROC_TRACE_FILEOBJECT Flag",
        "SessionsErroredOut",
        "ContentsMoved",
        "SetUsage",
        "NotificationBarInternetExplorerProcesses",
        "class VpnServerAddress",
        "RelayName",
        "SupportsContinuouslyAvailableFileServer",
        "C_95EC7A4EFEC83ABBDDA5099FF99F34F3F0A26217E92C58663611DD1463FB39C5",
        "Status of the path - connected, disconnected, reconnecting",
        "@5m;@5m;",
        "CD_286D3AAA59AE00C2CF7EBCC4AB344CD2AFDCE3C2B408154E04E7644656DAE408.1476.2706488538.4987",
        "ReplicasPerSourceCloneMax",
        "CD_947907BE0C21868B3B6C1E2B3F2F4D8F4078DF318D2CD738491AC5AC30B4B16C.2115.1047513203.5320",
        "The status of the printer device.",
        "Win32_TSGeneralSetting",
        "RedundantOptionROMVersion",
        "LPCDRVR_TRACE_RESERVED_1e Flag",
        "Display name of the extension being run",
        "MSFT_CliAlias.FriendlyName=\"Server\"",
        "supportedControl",
        "KerberosDebugTrace",
        "The Win32_COMApplicationClasses class represents an association between a COM component and the COM application where it resides.",
        "{981f2d82-b1f3-11d0-8dd7-00c04fc3358c}",
        "The Win32_TerminalTerminalSetting class represents an association between a Terminal and its configuration settings.",
        "ATM Emulated Circuit",
        "Minimum HSync numerator (in Hz)",
        "MIF.DMTF|Memory Device Mapped Addresses|001.7",
        "Xon Character",
        "select * from MSFT_SCMEventLogEvent",
        "StopConfiguration",
        "{452ee08e-2536-11d4-97eb-00c04f79c403}",
        "Policy Precedence.",
        "AGP Command",
        "Enable_BCLocal",
        "@$m;@$m;",
        "Number of horizontally blanking pixels",
        "ifInErrors",
        "OA3xOriginalProductKeyPkPn",
        "The maximum size of the buffer to use.",
        "Last time this object was updated",
        "filters",
        "The Set-VpnConnectionTriggerTrustedNetwork sets the trusted network list with the NRPT DNS suffixes that have been configured as part of triggering properties. The NRPT exemption entries are ignored.",
        "ClassDefinition",
        "FriendlyNameLength",
        "{2306fe2d-dbf6-11d2-9244-006008269001}",
        "R_8C64C742C17295C471BDDFBB0449A20033FBA45FC5101E58D4755F4826009F5A",
        "This method enables real-time diagnostic tracing for the Storage SubSystem. Tracing will remain on until DisableDiagnosticLog is called. Tracing may add some additional overhead to the subsystem, so only use it when trying to root-cause a failure that could not otherwise be solved. For most cases, you should only use this method when troubleshooting an issue with your storage subsystem vendor's support staff.",
        "This bit indicates whether the machine implements a 24 or 32 bit timer.",
        "I_53CE600361D9DC049AB7920A4B0095959C43531AA0DA3E5EEA49EBF699C0A9D2.457.1.47278",
        "HOSTPROC_TRACE_LOADER Flag",
        "Win32_LogicalDisk",
        "If this method is successful, the Device\\'s Availability and AdditionalAvailability properties should reflect the updated status. If a failure occurs trying to bring the Device online or offline, it should remain in its current state. IE, the request, if unsuccessful, should not leave the Device in an indeterminate state. When bringing a Device back \"Online\", from an \"Offline\" mode, the Device should be restored to its last \"Online\" state, if at all possible. Only a Device that has an EnabledState/StatusInfo of \"Enabled\" and has been configured can be brought online or taken offline. ",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|EnableStartupHeapPreallocation",
        "SchemaVersion",
        "PCI Component Information - Device Number",
        "C_92D90F38218063ED84DEBF091001DAB75383FEA23B31338C700BDB5B69D9A383",
        "// by some HBA, use the ping command for the software initiator.",
        "ref:Win32_DCOMApplicationSetting",
        "RegPropProv",
        "PeerObject",
        "This parameter indicates whether the folder cycle checking should be skipped or not.",
        "MSFT_SmbServerCertificateMapping",
        "The logical device that requires or uses the software.",
        "The BatteryInstalled property determines whether a battery is installed on the device.",
        "TargetStoragePool",
        "Directory is a type of file that logically groups data files 'contained' in it, and provides path information for the grouped files.",
        "Virtual Rotate",
        "A power supply profile as defined by the DMTF specification",
        "ALTSTREAMS",
        "RelocateImageEnd",
        " 1 indicates per user.",
        "Where a storage extent must be accessed through a media access device, this relationship is described by the CIM_MediaPresent association.",
        "Service From Front",
        "LogonPersec",
        "Future I/O",
        "CIM_ClusterServiceAccessBySAP is the relationship between a clustering service and its access points.",
        "The Storage Object is not supported for report.",
        "MDM_WindowsDefenderApplicationGuard_Settings01",
        "MSFT_StorageNodeToVirtualDisk",
        "The friendly name of the Virtual Machine to which the Virtual Function is assigned.",
        "{DE57D792-A032-11D2-90F0-0060081A46FD}",
        "ReturnLatency",
        "ize of the storage pool, in bytes. This value is derived from the backing physical disks for this storage pool.",
        "The Version property contains the version of the BIOS. ",
        "C_EAB61DD44B853A5368E6DEF80BB5C6272003255B9203C275FD85B8806E87A024",
        "CIM_Printer.MimeTypesSupported",
        "TargetLUN",
        "Formats",
        "Provider",
        "UTF-8",
        "RetryCount",
        "Allow Performance Degredation",
        "Device Errors",
        "// Definitions for iscsi security flags. These flags provide",
        "IdleStateAccounting",
        "AssignedOfflineFiles",
        "#define ISCSI_LOGIN_FLAG_MULTIPATH_ENABLED            0x00000002",
        "MaxTransferWindowSize",
        "CheckType",
        "MSFT_NetAdapterChecksumOffloadElementSetting",
        "Severity ID - Enumeration",
        "{8856918E-74C7-431C-B63D-3A5FDCC6AC08}",
        "C_E4F1C8D43CF6961CAD75D4CE9F32B9D90760450C3087C094F4C15FE6A994A33D",
        "Designated PCI Bus Identifier encountering error",
        "Ndis80211SupportedRate",
        "CR_75B21F448BC6FF62B3ED2CD311F63E496645D7FB9BF098798AFD0623A4CD84C1",
        "NS_892F8DB69C4EDFBC68165C91087B7A08323F6CE5B5EF342C0F93E02A0590BFC4\\KI_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C\\I_7CF7DA788CB633591FE5B31F4F2207A3A629FD098D55AD1913CE2E46186B87B6",
        "Win32API|Device Input and Output Structures|PARTITION_INFORMATION|RewritePartition",
        "Commit the policy settings for Predictive Failure Analysis",
        "The name of the resiliency setting used to create this storage tier.",
        "CD_E9CDE95B78A19AEE2B087772DB9EB45B8857BFE7606062680ECCF0441F1E7AB7.1758.4025113417.345",
        "The StdRegProv class contains methods that interact with the system registry. You can use these methods to: ",
        "Counter Name",
        "Accept",
        "0x00000005 setting flags [{C185ECE5-0720-472c-B407-9BB4E8DD5E72}]",
        "No Dithering",
        "CimServerName",
        "Monitor brightness change event",
        "MDM_Policy_Config01_TaskScheduler02",
        "The StandardMonth property specifies the month when the transition from daylight savings time to standard time occurs on this operating system.",
        "SoundDev",
        "LUAInstall: error 0x00000005 setting flags [{942B7909-A28E-49a1-A207-34EBCBCB4B3B}]",
        "Indicates whether this physical disk is hidden or not",
        "Implementation decides",
        "Exposed Path",
        "ParentItemPath",
        "MicroChannel",
        "#define HBA_EVENT_ADAPTER_ADD           0x101",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1075.2139482593.332",
        "ROOT\\StandardCimV2",
        "NumericSensorCurrentState",
        "CR_1463900C5E85009C74D970DC08429284D480248969B543718E853FA68E152A48",
        "Corresponds to the SMP's StorageProvider.Name field.",
        "Whether the application is assigned or published: 1 = Assigned, 2 = Published.",
        "Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|WriteOperationCount",
        "Global settings for IPsec.",
        "PortType",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_6|dwStatus",
        "The locally unique identifier for the network interface. in InterfaceType_NetluidIndex format. Ex: Ethernet_2.",
        "{64c71824-1bb8-47d2-b347-a8fbd95b9c07}",
        "150.1044209753.111",
        "If TRUE indicates whether the initiator and target have agreed to support immediate commands on this session.",
        "The state of the NIC driver with respect to entering the ring.",
        "Number of bytes for operational status status indication",
        "//     System\\CurrentControlSet\\Control\\Storage\\FC\\<PortWWN>",
        "PolicySourceMaximumConnections indicates whether the property MaximumConnections is configured by Server (0),Group Policy (1), Default (2).",
        "IL_F693673C4CEEE255A0773D7A8C79A487F5442508823CBC6EC11DEA6527F363E6.576.1.17537",
        " A CIM_FileSpecification identifies a file that is either to  be on or off the system. The file is to be located in the  directory identified by the CIM_DirectorySpecificationFile  associations.   When the invoke() method is used, it is expected that  it will use the combination of information provided to  check for the file existence. Therefore, any of the  properties with a NULL value are not checked. So, if  only the Name and the MD5 properties have values, they  are the only ones consider by the invoke() method.  ",
        "MaintenanceExclusive",
        "CR_BF1E5E829A1544FF8B694A6E8073DFF9D1CD4B2724FDB9291959D5493401980F",
        "The Format string provides the location of an XSL file  that can be used to format the output from the category.",
        "The name of the printer this property belongs to.",
        "DN_With_Binary",
        "{ba41c883-592f-4ab9-b2a9-c6263b011fe7}",
        "The ErrorControlOff property contains the command string used to disable error control.",
        "AllowMicrosoftCompatibilityList",
        "PartitionType",
        "ref:MSFT_Runspace",
        "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices",
        "Connections already exist on initiator node",
        "CallbackContract",
        "C_390A7265D9FEAD6AA3D52AB61B20BCCA9E6B67E5811FC8A0748502D100C63214",
        "EnforceLockScreenProvider",
        "MSFT_CliAlias.FriendlyName=\"Group\"",
        "ref:Win32_ServerSession",
        "0xC000001F",
        "Indicates the Primary Computer evaluation result: 1 = Is not primary computer 2 = Is primary computer 3 = Not evaluated because primary computer policy is not enabled 4 = Not evaluated due to user configured with roaming profile ",
        "MDM_EnterpriseModernAppManagement_ReleaseManagement03_01",
        "WSP_StorageSubsystemToReplicaPeer",
        "GCW Profile",
        "Product identification such as a serial number on software, a die number on a hardware chip, or (for non-commercial Products) a project number.",
        "An association between a computer system and the IRQs available on it.",
        "This property specifies the privileges to delete from the token, if SecurityLimitFlags is Filter Tokens. This property can be NULL if you do not want to delete any privileges. ",
        "{8502C4FC-5FBB-11D2-AAC1-006008C78BC7}",
        "Power Setting Definition",
        "C_4890EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "The device number of a PCI network adapter.",
        "MI_ERRORCATEGORY_SECURITY_ERROR",
        "SDBUS_DEBUG_RECOVERY",
        "IndexingEnabled",
        "The job destination, possibly a queue.",
        "Example: 1.",
        "PLATFORM_TRACE_RESERVED_18 Flag",
        "WorkgroupDiscovery",
        "Allocation Size",
        "TL_INFO",
        "CD_52D2D582CC450E6D07EBF7F5FA5E6D36BE955E5652346A68534B9BBF05E2BB4B.1734.2078368004.533",
        "Win32_LogicalFileSecuritySetting",
        "ProviderOperation_GetObjectAsync",
        "Password(0)",
        "The property contains the name of the file to be removed. If this column is null, then the specified folder will be removed if it is empty. All of the files that match the wildcard will be removed from the specified directory.",
        "Northwest Energy Efficiency Alliance",
        "MMCSSWakeup",
        "object:MSFT_NetBranchCacheNetworkSettingData",
        "ReceivedMulticastPackets",
        "DomainNameType",
        "LogFlagWarning",
        "MDM_Policy_Config01_DmaGuard02",
        "A Connection Security Rule.",
        "Bit flags specifying what permissions are affected",
        "A set of supported NDIS 802.11 data rates in the operational rate set that the radio is capable of running at.",
        "ServerRSSCapable",
        "Time that the job was begun.",
        "Target Specific ID",
        "Defines the style of the SOAP message.",
        "MsftDiscFormat2RawImage_DebugDestructor",
        "Inter Machine Trunk",
        "This field is the message displayed to the user. %1 should be replaced with the corresponding storage provider's Name field. %2 should be replaced with the subsystem FriendlyName. %3 can be replaced with extra error information.",
        "Unexpected Information",
        "Wait for sync when starting an application",
        "NA-9x12-Envelope",
        "C_AEF5A70C706EB1C2AF0BC5B36F14C87FA31F991587A5360179E66B8CF9ECD4E1",
        "C_94250441BCE05715192D37120EDEE5CCA50FD2B2134EFE3C9E35BB834F26457D",
        "RequireRetrieveHealthCertificateOnBoot",
        "WPD API Trace",
        "SidTypeDomain - Indicates a domain SID.",
        "WSP_FsStorageModificationEvent",
        "CPU Enabled",
        "BAUD_57600",
        "Often, a cooling device is installed in a package such as a chassis or a rack, not for a specific device, but to assist in the cooling of the package in general.  This relationship is described by the CIM_PackageCooling association.",
        "The aggregate size of all files that currently qualify for optimization.",
        "Pool Nonpaged Failures",
        "R_41695C2AF45A08336AFE1BDB6F027AEAD97E2A04551B2329B3A302DF92AC01FC",
        "ActualType",
        "Timer Resolution",
        "DaylightSecond",
        "IdleDisconnectSeconds",
        "UdpIPv4Enabled",
        "NONCACHEDIO Flag",
        "TRACE_RESERVED6",
        "CD_297B009625C3BEC5F682DA65A87D7971BDE24BF0C5093DE7BD3ABBE18CF35D09.2032.4291846294.6773",
        "MsftDiscFormat2Erase_DebugDestructor Flag",
        "Restarts a network adapter",
        "MSFT_PartialConfiguration",
        "DevTyp",
        "VendorSpecific",
        "Power Event",
        "ServerInterfaceIndex",
        "productEnabled",
        "Select * from Win32_Volume",
        "MDM_WindowsAdvancedThreatProtection_DeviceTagging01",
        "SignaturesOutOfDate",
        "The amount of memory in bytes that a process needs to execute efficiently, for an operating system that uses page-based memory management. If an insufficient amount of memory is available (< working set size), thrashing will occur. If this information is not known, NULL or 0 should be entered.  If this data is provided, it could be monitored to understand a process' changing memory requirements as execution proceeds.",
        "LetAppsAccessRadios_ForceAllowTheseApps",
        "VmFriendlyName",
        "Captive Mode Required",
        "MSFT_CliAlias.FriendlyName=\"Registry\"",
        "Specifies whether an entry for DirectAccess connectivity appears when the user clicks the Networking notification area icon.",
        "MSFT_NetISATAPConfiguration",
        "TRACE_CLASS_CALL Flag",
        "PassThroughClass",
        "CD_48B0C9029B67A5C53A5796286B490AC8D6BEC1B48F8B30CB5F54159AC40ECED3.1016.4056784705.246",
        "DocumentName",
        "ProtocolAddressResolved",
        "FX_TRACE_REMOTE_INTERFACE",
        "0xEFFF0037",
        "YieldCount",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2426.391187006.188",
        "Link Item",
        "KI_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "OpenTrustedDomainByName",
        "The default datatype for this driver.",
        "AllowUnencryptedTraffic_Client",
        "%path%",
        "42002",
        "60005",
        "ResponseCount",
        "Stapling",
        "Indicates if SRIOV is currently enabled on the Adapter.",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmScale",
        "Volume dirty bit is set",
        "nector 1",
        "Must be zero",
        "WorkflowPolicy",
        "Integrity method plumbed in IPsec policy",
        "TcpTimedWaitDelay",
        "Debugger",
        "C_CE0403D1F6C8F032B580CC54FFD1B59326317C97C1A606939745A3B9BE941D11",
        "NumericSensorLowerThresholdCritical",
        "KeyManagementServiceMachine",
        "SequenceContext",
        "AllowInputPanel",
        "ConfigureDeadlineNoAutoReboot",
        "The Dependent reference represents the properties of the logical device that is using the system bus.",
        "AllowThirdPartySuggestionsInWindowsSpotlight",
        "User accounts to grant access to the file share.",
        "Payload Mismatch",
        "Job creation time",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_7B1CEA145FD7FDDE85118A874F4CDC2DBDFFEFB5270CF85B4A7E073D01A42C9Baed571140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "<Class.>Method",
        "This is the LanaID of the network adapter that is used to identify the network adapter assigned to the specified Terminal.",
        "ScriptedWindowSecurityRestrictionsInternetExplorerProcesses",
        "UdpIPv6HashEnabled",
        "The short name of the service to be filtered.",
        "The RenamePrinter method renames a printer. The method can return the following values:/n0 - Success./n5 - Access denied./n1801 - Invalid printer name./nOther - For integer values other than those listed above, refer to the documentation on the Win32 error co",
        "MaxOutboundChannelsPerEndpoint",
        "50007",
        "Product include directory",
        "The CIM_Container association represents the relationship between a contained and a containing physical element. A containing object must be a physical package.",
        "CreateSectionBegin",
        "InternetZoneDownloadSignedActiveXControls",
        "WPDMTP_feature2",
        "{E2E5A310-ECED-444F-81D7-ACCA6AC8A1A8}",
        "Heap Trace Provider",
        "Association between a subsystem and its file shares",
        "WIN-Q8N34IVM0GK",
        "Virtual Allocations Rundown",
        "MCACpuTlbError",
        "PendingActions",
        "fdResPubCtlGuid",
        "NoBusResources",
        "Whether to use a stateful protocol (i.e., DHCP) to obtain an address. Setting this parameter will have no effect on an interface that has router discovery enabled & advertising disabled. In that case the parameter is controlled by router discovery.",
        "Antispyware signaturen age in days",
        "DeploymentRDPSettings",
        "ScanParameters",
        "The authorization manager used for custom authorization.",
        "KEY ID",
        "Select * from Win32_PageFileSetting",
        "{6EDF1DD2-DB35-11d2-85FC-0000F8102E5F}",
        "Win32_SystemTimeZone",
        "MsftDiscFormat2Raw_DebugGeneral",
        "C_3277B54ADD63DD9DAF9212009ACC4BB7EE33B9AEB2FD840D7E82EEE595AC86D7",
        "The number of MSI messages allocated by the network adapter driver.",
        "select * from MSFT_WmiEssEvent",
        "{5F5B101E-DB35-11d2-85FC-0000F8102E5F}",
        "dwReserved1",
        "Number of bytes for dot11 roaming start status indication",
        "Impact Moving Head Dot Matrix Other",
        "modules",
        "R_D44FC3A3D65B734A03695B43A5B8D840A531C99703846276525370A3AA163980.2460.600190466.554",
        "C_DEA224BBEF40A5F2D4A2CA371BF633744D610A42E8901085FCD10393CC6D8624",
        "TargetGroupReplicaPeer",
        "{0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e94}",
        "PeerUniqueId",
        "TRUE if drive reports setmarks",
        "MEMORY",
        "IPv4 Subnet Address",
        "SOCVersion",
        "The MfrAssignedRevisionLevel property indicates the manufacturer assigned firmware revision level of the CDROM drive./n",
        "{FD4F53E0-65DC-11d1-AB64-00C04FD9159E}",
        "QuotaSetting",
        "FileDirectorySearches",
        "Win32_FolderRedirectionUserConfiguration",
        "AddPort",
        "TransferWidths",
        "If set to true: once the file system is mounted, NFS requests are retried until the hosting system responds. If set to false: once the file system is mounted, an error is returned if the hosting system does not respond.",
        "String that contains the environment variables to expand",
        "If a Device is (\"Enabled\")(value=3), it has been powered up, and is configured and operational. The Device may or may not be functionally active, depending on whether its Availability (or AdditionalAvailability) indicate that it is (\"Running/Full Power\")(value=3) or (\"Off line\") (value=8). In an enabled but offline mode, a Device may be performing out-of-band requests, such as running Diagnostics. If (\"Disabled\") StatusInfo value=4), a Device can only be \"enabled\" or powered off. In a personal computer environment, (\"Disabled\") means that the Device's driver is not available in the stack. In other environments, a Device can be disabled by removing its configuration file. A disabled device is physically present in a System and consuming resources, but can not be communicated with until a load of a driver, a load of a configuration file or some other \"enabling\" activity has occurred.",
        "This is the base class for all BCD elements. The Type field identifies the specific sub-type of element.",
        "Rules to be evaluated",
        "The FullDNSRegistrationEnabled property specifies whether the IP addresses for this connection are registered in DNS under the computer's full DNS name. The full DNS name of the computer is displayed on the Network Identification tab of the System Control Panel. Windows 2000 only.",
        "The Win32_MemoryArrayLocation class represents an association between a logical memory array and the physical memory array upon which it exists.",
        "C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.mui[MofResourceName]",
        "The value of the Commandline property provides the string used to start the service.",
        "RestrictFileDownloadInternetExplorerProcesses",
        "GeneralPurpose",
        "The operation is not supported on cluster.",
        "RetransmitIPV4",
        "Application Subsystem Failure",
        "BypassProxyForLocal",
        "C_9E6BE90DCA6B96CBA3BF12EFB579708613DA0A405A49EA5E6B87A7FDB2747D9E",
        "%L.'p",
        "{f86676b9-d9fa-4d26-95ce-bfbc77d80596}",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_9FD082137700729C3A00983D83A072D395DC7E5AA5061738FF9BBDA92779EC8F",
        "WMI|Win32_BaseService",
        "CIM_ComputerSystemResource",
        "{56415ACC-B16D-11D1-BD98-00A0C906BE2D}",
        " Deletes a tag from a .ini entry.",
        "\"Power Mode\" indicates that the element has additional power model information contained in the Associated PowerManagementService association. ",
        "{04a660e9-78d4-4da2-bea5-6442f1919f20}",
        "WLANHC_TEST",
        "InstructionPointer",
        "SQLSRV32",
        "ref:MSFT_ReplicationCapabilities",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2167.2889658748.180",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\InprocHandler[Default]",
        "DeviceSpecificPens",
        "C_2F12799EC4705459E9FD61FC6C601B5A8AAE36085966AD27E0D7247EDCA6524B",
        "MSFT_NCProvNewQuery",
        "EKU filter for IKEv2 machine certificate selection",
        "The Name property defines the label by which the statistic or metric is known. ",
        "NA-10x15-Envelope",
        "{0F23F5FA-0223-48e3-ADBC-9B56B201E0CD}",
        "Collection of MPIO path IDs, reported by the MPIO DSM, when applicable.",
        "QualityUpdateMethod",
        "The SupportParityCheck property determines whether parity checking is supported on the Win32 serial port",
        "This association relates an MSI software element with an action that access the element.",
        "CD_916EF6B6122453D1C58D648E96BD869758A18BA38D348DDAE67570192E8AB140.1514.2929700575.4421",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2484.660329875.368",
        "DestWWN",
        "0xC005007C",
        "The SystemType property indicates the type of system running on the Win32 computer.",
        "{8502C518-5FBB-11D2-AAC1-006008C78BC7}",
        "ReconnectionPolicy",
        "CIM_EnabledLogicalElement.OtherEnabledState",
        "Forced dismount failed because the volume is locked.",
        "Minimum refresh rate in hertz, when a range of rates is supported at the specified resolutions.",
        "Win32_DisplayControllerConfiguration",
        "EnabledState",
        "DAIPsecEncryptionType",
        "AllowAppStoreAutoUpdate",
        "An enumerated value indicating an administrator's default or startup configuration for the Enabled State of an element. By default, the element is \"Enabled\" (value=2).",
        "#define SendLIRR_OUT_RspBuffer_SIZE_HINT 8",
        "MaxCapacity",
        "PMTUBHDetectEnabled",
        "TM_MEDIA",
        "CIM class for Nrpt policy configured on machine",
        "Flag set to 1 if TCP offload is supported for this connection, 0 otherwise.",
        "2 - 'Fixed' means that the storage is allocated up front.",
        "errorPaging",
        "Indicates the current operating conditions of the storage pool. Unlike HealthStatus, this field indicates the status of hardware, software, and infrastructure issues related to this storage pool, and can contain multiple values. Various operational statuses are defined. Many of the enumeration's values are self-explanatory. However, a few are not and are described here in more detail. ",
        "t2PK`",
        "Token",
        "The physical package which is contained in the chassis.",
        "GetPhysicalPresenceTransition",
        "NPIV_UNKNOWN_ERROR",
        "The GroupComponent reference represents the memory array part of the Win32_MemoryDeviceArray association.",
        "CD_9C89CD12D6BC26922A4DCAAA9B4707FCF99911A5CC1919F958629CE9DE116F55.2532.500907766.5049",
        "NS_A2A98E75472B9249D4EF445DC9D4C380289067BF73931A828AFBC7CD7964FEBB\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_37CB291E96206B811B242E1B2E99A15E443B14749AA28D9EF51C66CFB85086A0",
        "This property may not be applicable to all types of network adapters listed within this class. Windows NT only.",
        "CR_2F12799EC4705459E9FD61FC6C601B5A8AAE36085966AD27E0D7247EDCA6524B",
        "The type of the contract.",
        "An association between logical devices and system resources, indicating that the resource is assigned to the device.",
        "MilliWatts",
        "LogFlagFunction",
        "MIO X.25",
        "DEPEND Flag",
        "Remote Desktop connection permission management.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2136.3952311231.180",
        "EVENT_TRACE_FLAG_W",
        "OS/390",
        "Query EA",
        "I_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.2473.3607361720.188",
        "LPC_TRACE_RESERVED_0f",
        "BGP Policy Accounting",
        "A free-form string describing the way(s) in which this card is physically unique from other cards. ",
        "The Win32_ComputerSystem class represents a computer system operating in a Win32 environment.",
        "Values: TRUE or FALSE. A value of TRUE indicates the protocol supports a guaranteed bandwidth.",
        "AdminPasswordStatus",
        "Account Name",
        "__ACE",
        "SamUserCreate_End",
        "ThreadWaitReason",
        "{eb6517d4-090c-48ab-825e-adad366406a2}",
        "0xEFFF0009",
        "The domain of the account associated with the SID",
        "C_BEAC6077B19FEAE9A9DA302629391F9E0FFBBEB033EB1ABEA99A1F0843A415BA",
        "The GetStringValue method returns the data value for a named value whose data type is REG_SZ. ",
        "rights",
        "{e17a999c-97f7-4213-bf6f-de08e9d7ecf5}",
        "Event Type",
        "Win32_FolderRedirectionConfiguration",
        "0x00000020",
        "Enable Multi-Monitor for desktop (not RAIL)",
        "MDM_Policy_Result01_Bluetooth02",
        "C_2B52813C6387932BDFDA0985812CEC314027392B2888A6CAF0E363C856302651",
        "Query RSS Capabilities",
        "Mem Flag",
        "DeviceIoControl::OID_GEN_MEDIA_IN_USE",
        "LOCKS",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}",
        "S-1-2-1",
        "A free-form string providing additional information related to the AdvertiseTypes. A description shall be provided for each occurrence of AdvertiseTypes. entry in this array corresponds to the entry in the AdvertiseTypes array at the same index. It is not expected that additional descriptions are needed if the Type is set to \"Not Advertised\" or \"SLP\". However, as the SLP template expands, or as other advertisement mechanisms are defined, support for additional descriptions may be needed. This array is defined to support this.",
        "The NumberOfProcessors property indicates the number of physical processors currently available on the system. This is the number of processors whose status is \"enabled\" - versus simply the number of processors for the computer system. The former can be determined by enumerating the number of processor instances associated with the computer system object, using the Win32_ComputerSystemProcessor association.",
        "CR_3E11F2867F2D534D95C0593A0AA32ECA612C606596AA91228C49611E4A1C3BBE",
        "PCI_COMP_ERROR_STATUS is valid",
        "050646C5B9BC0F0D1F0FC4733FA2AA35939C",
        "Select * from Win32_SoftwareFeature",
        "// This class should use PDO instance names with a single instance.",
        "RemoteUserTunnelAuthorizationList",
        "C_33B0A3C692AD567B6C92E618FD5072156CC98A3BCAA3A93CB3F15A5E87E34AD2",
        "CD_AF3D854FF025C11AE0CB78C559DC0BD55EB8A356EAE34913761A09B3CF6B045E.2153.928844790.7616",
        "{9083C21E-7D58-4e0e-BC30-0BC8922AFB8B}",
        "MSFT_DASiteTableEntry",
        "Failed to communicate with cluster health resource",
        "Software Program Abnormally Terminated",
        "PersistentBootConfigOrder",
        "SM_GetBindingCapability",
        "Regional Network Provider",
        "IPv6Supported",
        "This parameter indicates that it is OK to remove data partitions from the disk. If this parameter is FALSE or NULL, Clear will fail in the presence of a data partition.",
        "Whether multicast packets can be forwarded.",
        "CD_8CB4A8C4AE0DA8CEB0CFD6BB61EF3B4F6166FD0C6E711E54D6688A14B9EB8CF6.2625.90034906.598",
        "R_DDCE0EEC8025DB3F389EB360CE7C50BBC0E131D334E8FAB08585F4C0CA2A98A2",
        "Heuristic",
        "The VolumeDirty property indicates whether the disk requires chkdsk to be run at next boot up time. The property is applicable to only those instances of logical disk that represent a physical disk in the machine. It is not applicable to mapped logical drives. ",
        "The number of bits used to display each pixel.",
        "Indicates the desired size for the virtual disk. Note that some storage subsystems will round the size up or down to a multiple of its allocation unit size. If this parameter is specified, UseMaximumSize must be NULL or FALSE.",
        "select * from RegistryEvent",
        "1 - Other, by CIM convention, is used to indicate that the Severity's value can be found in the OtherSeverity property. ",
        "05 set",
        "CIM_SoftwareIdentity.ElementName",
        "EnclosureNumber",
        "Checksum Error",
        "LPCDRVR_TRACE_RESERVED_15",
        "LocalPortStart",
        "878.2",
        "StackKey",
        "ACPI Table data",
        "NDIS Query Interrupt Moderation",
        "The Dependent reference represents the memory device existing in the physical memory.",
        "PolicySourceLicensingType",
        "Trigger",
        "CR_153A90D31DAA2BB98D107166F8216FEE25A312878D4AECBB89966D3EAC52B5F6",
        "Disk Drive",
        "MSFT_NetAdapter_QosClassificationElement",
        "WMI|Win32_PageFileSetting",
        "AllowMicrosoftManagedDesktopProcessing",
        "FADT C3 latency in microseconds",
        "WMI_TAPE_DRIVE_PARAMETERS_GUID",
        " privilege is required for Windows XP",
        "Adds a rule to Name Resolution Policy Table",
        "LANType",
        "Corrupted",
        "SetPolicyDelta",
        "MsftDiscFormat2Raw_DebugDestructor Flag",
        "Gateway Name",
        "AuthAppsAllowUserPrefMerge",
        "{C7BF35D2-AADB-11d1-BF4A-00A0C9062910}",
        "MS_SMHBA_SCSIENTRY",
        "Proprietary add-on card",
        "Reboot was requested during configuration.",
        "CD_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655.1166.1475828249.3715",
        "PeakUsage",
        "Address of Remote VPN Server.",
        "0x8005003C",
        "DisableKeyManagementServiceDnsPublishing",
        "File Compression",
        "The Timeout parameter is the time in seconds before shutdown take place. The default value is 0.",
        "MIF.DMTF|System Cache|003.9",
        " The invoke method is to evaluate a particular check. The  details of how the method evaluates a particular check in   a CIM context is described by the non-abstract CIM_Check sub classes.  The results of the method are based on the return value.    - A 0 (zero) is returned if the condition is satisfied.   - A 1 (one) is returned if the method is not supported.    - Any other value indicates the condition is not satisfied. ",
        "Gopher proxy server address and port.",
        "UOW Count",
        "NS_7100C6423C40622098AFCC4AD8087F3ECEFAC621ACFC3A5D9490E740DC79989B\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_C7BED1CCC8E3279B70E4846D9154BA63003D9E227AE14E0590492F865356BD94",
        "ActionType",
        "CD_4FC7350D0697D65B1585376855E9596964780B95A8CAA540BF3CC2CD97C19696.2032.397457388.241",
        "MsftWriteEngine2_DebugGeneral",
        "LoginAuthFailRsps",
        "Setting name",
        "    //                    login response with the final bit set has not been sent or received.",
        "Security: WDigest",
        "MSNdis_80211_Statistics",
        "PreviousHealthStatus",
        "#define HBA_EVENT_PORT_BROADCAST_D16_7  0x20b",
        "TCPCopy",
        "CIM_ClassModification notifies when a class definition in the schema is modified.",
        "LogMaxSizeKilobytes",
        "MilliVolts",
        "MSiSCSI_LB_ROUND_ROBIN",
        "Query Quota",
        "2 - 'Unhealthy': TBD.",
        "3.5 MO 230Mb   512 bytes/sector",
        "{422D175A-E3D5-11d2-8601-0000F8102E5F}",
        "_DH_WMP_DEVICES",
        "PacketDirect buffer management domain identifier for the adapter.",
        "The given Load Balance policy is not recognized by iScsi initiator.",
        "\\\\.\\root\\Microsoft\\Windows\\Dns:__Win32Provider.Name=\"DnsClientPSProvider\"",
        "Module ID",
        "MSFT_NetUDPSetting",
        "ref:CIM_Slot",
        "This property indicates that the computer has booted off of this disk.",
        "ThreadPriority",
        "MDM_DeviceStatus_OS01",
        "15     This device is not working properly because there is probably a re-enumeration problem. ",
        "The Id of the virtual machine that the VM network adapter belongs to.",
        "Signer",
        "ipsecNegotiationPolicyType",
        "Supports File Based Compression",
        "When retrying the delivery of an indication, this property shall have the same value as in the original delivery.",
        "The DTRFlowControlType property specifies the use of the data-terminal-ready (DTR) flow control after a connection has been established. After a communication line has been established the DTR can be left in the following states: enabled, to show that the connection is still active; disabled, to ignore the DTR once received; or it can be used as a data flow control flag.",
        "The destination prefix.",
        "Adds the User, Group or Computer to the existing set with the set of permissions defined. The AccountName comprises of both: Domain and Name of the entry and PermissionPreSet is enumeration of following PermissionsWINSTATION_GUEST_ACCESS, WINSTATION_USER_ACCESS and WINSTATION_STANDARD_ACCESS",
        "IPv6NS",
        "Category",
        "ref:Win32_ServerConnection",
        "C_28E04ED4579402BA90E254EFFBE2F4B62A2F444F99D6E873BA6A10FA5706B34A",
        "CIM::Device::Sensors",
        "OwningProcess",
        "{8502C4DC-5FBB-11D2-AAC1-006008C78BC7}",
        "TransactionFlowAttribute",
        "ChassisBootupState",
        "HBA_EVENT_PORT_UNKNOWN",
        "The StartName property indicates the account name the service runs under. Depending on the service type, the account name may be in the form of \"DomainName\\Username\", The service process will be logged using one of these two forms when it runs. If the account belongs to the built-in domain, \".\\Username\" can be specified. If NULL is specified, the service will be logged on as the LocalSystem account. For kernel or system-level drivers, StartName contains the driver object name (that is, \\FileSystem\\Rdr or \\Driver\\Xns) that the input and output (I/O) system uses to load the device driver. If NULL is specified, the driver runs with a default object name created by the I/O system based on the service name.",
        "Special character support provided",
        "otectorID",
        "Whether this Remote Desktop is meant for a virtual machine farm",
        "Thermal constraint as a percentage",
        "C_4CC99CFC9275918BD831680B062D25E87A34D427349AA13CFBBAC5888CFC907F",
        "EventTrace_Header",
        "IPFilterSecurityEnabled",
        "State entry idle timeout in seconds. Value must be > 0",
        "DOMinDiskSizeAllowedToPeer",
        "LastRunActualPurgeClusters",
        "The Win32_NTLogEventComputer class represents an association between an NT log event and the computer from which the event was generated.",
        "Win32API|Network Management Structures|AT_INFO|DaysOfWeek",
        "SM_SendRNID",
        "InstallSoftwareFromURI",
        "Maximum number of message interrupts a device supports in hardware. Valid only if the device supports message interrupts.",
        "DeviceMemoryAddress",
        "SetChapForPhysicalPort",
        "The Win32_PageFileUsage class represents the file used for handling virtual memory file swapping on a Win32 system. Information contained within objects instantiated from this class specify the runtime state of the page file. ",
        "Receive",
        "Dependencies",
        "The mount point associates a volume to the directory at which it is mounted.",
        "Represents a crypto suite to propose in quick mode.",
        "Thread creations/deletions",
        "SDBUS_DEBUG_SDRESP",
        "ScheduleQuickScanTime",
        "Protected space extents are based on a physical extent. This relationship is made explicit in this association.",
        "MDM_Policy_Result01_RemoteDesktopServices02",
        "MDM_Policy_Config01_DeviceHealthMonitoring02",
        "SyncOverMeteredNetwork",
        "File System Control",
        "PreventUserRedirectionOfProfileFolders",
        "NTDOMAIN",
        "CoNDIS Receive PDUs OK",
        "Query Result Data",
        "The ProcessId parameter returns a global process identifier that can be used to identify a process. The value is valid from the time the process is created until the time the process is terminated. ",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\ProgID[Default]",
        "FinWait1",
        "he card.",
        "Invalid argument",
        "__InstanceCreationEvent",
        "14 - The service has been disabled from the system.",
        "ClipboardSettings",
        "Local interface alias",
        "The resource name like File.",
        "MSFT_CliAlias.FriendlyName=\"Voltage\"",
        "ChangePassword",
        "The SetArpAlwaysSourceRoute method is used to set the transmission of ARP queries by the TCP/IP. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "Whether to log allowed packets.",
        "NDIS Transmit Block Size",
        "The Win32_PointingDevice class represents an input device used to point to and select  regions on the display of a Win32 computer system. Any device used to manipulate a pointer, or point to the display on a Win32 computer system is a member of this class.",
        "DisableByPlatform",
        "object:MSNdis_WmiEnumAdapter",
        "AllowEmailScanning",
        "T71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "IL_DDB91418F3D637554FACB27F0581F4445917CEB1CCA74DD48A7FCFC0D9F39BBE.280.4158920745.392",
        "Describes which policy the server uses in orderto determine the Active Session limit for user sessions.",
        "TouchKeyboardSplitModeAvailability",
        "Duplicate",
        "SetAttributes2",
        "Delete Admin Created Favorites Only",
        "Last full scan date end and time (using round-trip UTC format)",
        "Win32Registry|Control Panel\\Desktop|CoolSwitch",
        "The CIM_Sensor class represents a hardware device capable of measuring the characteristics of some physical property - for example, the temperature or voltage characteristics of a unitary computersystem.",
        "{66A9B302-F9DB-4864-B0F1-843905E8080F}",
        "The maximum lifetime for a Quick-Mode SA before it must be rekeyed, in minutes.",
        "ObjectAccess_AuditCentralAccessPolicyStaging",
        "Directory Service (DS) flag indicating that the domain controller is a Kerberos Key Distribution Center for the domain.",
        "MSFT_MintPipeline",
        "SPACES_MaskingSet",
        "MSFT_NetIKEAuthProposal",
        "VariableValue",
        "The operating system currently running on the computer system.",
        "UserRight",
        "TcpIp_TypeGroup3",
        "MSStorageDriver_FailurePredictFunction",
        "SEL_SENSOR_NUM is valid",
        "MSFT_DNSClient",
        "A user-friendly name of this policy-related object.",
        "Audit success",
        "Select * from WIN32_DESKTOP",
        "Win32_PowerSettingInSubgroup",
        "Specified volume not found",
        "postLogon",
        "Small Business Server Edition",
        "The Query property holds a string containing the event query filter, which was registered by a logical consumer.",
        "    ServerAddress (string) Specifies the address of the Remote VPN Server.",
        "MSNdis_80211_AuthenticationMode",
        "{8502C540-5FBB-11D2-AAC1-006008C78BC7}",
        "ErrorCleared is a boolean property indicating that the error reported in LastErrorCode is now cleared.",
        "MsftDiscRecorder2_DebugGeneral Flag",
        "{acf14043-a61c-11d0-8dd4-00c04fc3358c}",
        "Indicates the reason why this physical disk cannot be added to a concrete pool",
        "MDM_Policy_User_Config01_Printers02",
        "CIM_Check",
        "pported.",
        "Frequency Hopping Failure",
        "FuncCall Flag",
        "URLUpdateInfo",
        "Number of receive queues that the network adapter supports.",
        "Size of the read cache for the virtual disk",
        "HttpTransportBindingElement",
        "object:VpnConnectionIPsecConfiguration",
        "ISCSI_ERR_HEADER_DATA_NEEDED",
        "C_20C8A4313A9882D64219A6814548B8CA23AA20618BD06EA1320CC257373FA4D3",
        "PCI_COMP_INFO_DeviceId",
        "The variable-length null-terminated string specifying the name of the source (application, service, driver, subsystem) that generated the entry.",
        "CD_A23491B3C9DD8481EBD1370ABF1AD298CC29F6DA303209600E83B50112688260.2427.3681100524.4843",
        "{b2412d0d-26c8-4f4e-93df-f7b705a0b433}",
        "Driver Completion Routine",
        "HOSTPROC_RESERVED_1e",
        "Check if the user live ID is connected.",
        "Win32_UserStateConfigurationControls",
        "MSNdis_80211_ReceivedSignalStrength",
        "LPCDRVR_TRACE_RESERVED_16 Flag",
        "C_6E24E0F3B897790EE4AD7CBEC57A77254DFB861B7DD873ABDD3B8E12E255FD64",
        "This field is a string representation of the node's firmware version.",
        "RequestedSpeed",
        "R_48A8B413DD01FD4E2902F07984087CB61CF9EEDF75071E3262DDCA296E4FFEDB",
        "Example: 194.161.12.1 194.162.46.1",
        "{acf14032-a61c-11d0-8dd4-00c04fc3358c}",
        "EVENT_TRACE_FLAG_ACQUIRECCFLUSH",
        "\"Stressed\" indicates that the element is functioning, but needs attention. Examples of \"Stressed\" states are overload, overheated, and so on. ",
        "PolicyEnforcement",
        "LPCDRVR_TRACE_RESERVED_10 Flag",
        "Win32_TapeDrive",
        "NumberOfResources",
        "A UTC datetime after which the Issuance License (IL) cannot be used for Token Activation.",
        "MSFT_CliQualifier",
        "sCE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0",
        "{25EFB242-17CB-4260-BE2B-38E70ACF8524}",
        "WinChip",
        "Windows Server 2003, Small Business Edition",
        "CIM_AssociatedMemory",
        "See CIM_NumericSensor.OtherSensorTypeDescription for details.",
        "Kernel Queue Enqueue",
        "{0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e96}",
        "LoadBalancePolicies",
        "INJECT_HARDWARE_ERROR",
        "The RemoveIniValues action deletes .INI file information that the application desires to delete from .INI files. The deletion of the information is gated by the Component class. A .INI value is deleted if the corresponding component has been set to be installed either locally or run from source.",
        "Example: USB Bus.",
        "Boolean indicating that the media access device needs cleaning. /n",
        "Bid2Etw_MSDAPRST_1_Trace",
        "PBLK Length",
        "101 - CRITIC/ECP ",
        "The SetArpUseEtherSNAP method is used to enable ethernet packets to use 802.3 SNAP encoding. By default, the stack transmits packets in Digital, Intel, Xerox(DIX) Ethernet format. It will always receive both formats. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "MaxUserPort",
        "CIM_Process.CreationClassName",
        "An Out parameter to indicate the semantics of the supported values.",
        "CIM_Key",
        "CDDASupported",
        "{ee751f9d-cec5-4686-9816-ff6d1ca2261c}",
        "Is setup expected",
        "NPIV_MAX_VPORT_COUNT",
        "SettingType",
        "110 - Internetwork Control ",
        "Not Configured",
        "Bid2Etw_MSADCO_1_Trace_TextW",
        "Unique Id for the error record containing this error",
        "ConfigFile",
        "Physical extents on the physical disk.",
        "GetLockStatus",
        "Adapter Id",
        "{379c7092-9b76-476a-a66b-1937939ed1d0}",
        "Activity Transfer Event",
        "    // dataSession           - session is being used as a full feature session",
        "NDIS Query Receive Filter Current Capabilities",
        "Unique id of the non-primordial storage pool the disk is a member of",
        "Indicates if USO is currently enabled for IPv4 TCP packets.",
        "TimeStamp",
        "ref:CIM_Service",
        "C_4AC7D53B353FF907A3871574884AE20E2C77DD82D160B77856929A17F6C699D4",
        "DefragAnalysis",
        "{101C0E21-EBBA-A60A-EC3D-58797788928A}",
        "RouterAdvertisement",
        "MSNdis_FddiLConnectionState",
        "Framework version",
        "{8502C554-5FBB-11D2-AAC1-006008C78BC7}",
        "The last open error status returned for a protocol's call to NdisOpenAdapter.",
        "Security settings of a file or directory object",
        "Indicates the Configuration Manager error code.",
        "ScreenSaver",
        "Maximum frame size",
        "DisablePasswordReveal",
        "CD_E5893386A7B4C018092F4F8B136F60610FB13ED7B0A8A3475C8F55E3E9FBCB90.12.3814985754.2627",
        "The current matching day (1-31)",
        "Write Through",
        "select * from Msft_WmiProvider_OperationEvent",
        "TrustedSitesZoneAllowNETFrameworkReliantComponents",
        "The maximum transfer window size for the reliable session.",
        "BusinessCategory",
        "{27EFABA4-362A-4F20-920B-ED66E280FCF5}",
        "The NUMA node of the network adapter.",
        "{acf14037-a61c-11d0-8dd4-00c04fc3358c}",
        "C_7269FF3A437308DE8B5DF3B97B35E871B7E243E24C717CDD217432928EA0D1A3",
        "An identification number for the device",
        "CD_FD27ECDAAA7D6C49E1565C286F03227F09CFD14146B494ADDE67CAC27EC54A8B.1457.1.39407",
        "ProviderOperation_GetProperty",
        "ThreadName",
        "MSNdis_FddiShortMulticastList",
        "Stack29",
        "CR_EA78D27F46C798D1329821D7CEABFD06DD3833EE6512664694DD451E0D988F35",
        "C_68988603F70E94DB41A96D6CCAF4C1247D2A19BC8932E751AE8871C31295C890",
        "Mappings",
        "The total number of MAC addresses that the network adapter supports.",
        "SPACES_StorageTier",
        "SPACES_VirtualDiskToPhysicalDisk",
        "DisableBranchOfficeLogging",
        "localeid",
        "Int 5h, Print Screen Service is supported",
        "7 bit - Machine Password Passed - Indicates that the machine (not user) password is passed. This option is only valid for unsecure joins ",
        "Msft_WmiProvider_PutInstanceAsyncEvent_Pre",
        "CIM_Dependency is a generic association used to establish dependency relationships between ManagedElements.",
        "AddServiceAccessPoint",
        "Windows Notification Facility Event",
        "not_null",
        "ADODB.1",
        "ThMsft_WmiProvider_Counters class exposes approximate internal operation call count information accross all providers.",
        "The Win32_UserInDomain relationship identifies the user accounts associated with a NT domain.",
        "object:MSFT_NetBranchCacheDataCacheExtension",
        "Indicates if USO is currently enabled for IPv6 TCP packets.",
        "RequestedCopyState is an integer enumeration that indicates the last requested or desired state for the association. The actual state of the association is represented by CopyState. Note that when CopyState reaches the requested state, this property will be set to 'Not Applicable.",
        "DODelayForegroundDownloadFromHttp",
        "SMBIOS",
        "PortableDeviceAPI_Internal Flag",
        "A user settable description of the storage tier",
        "Disable Callback",
        "The job destination hosted on the system.",
        "DUE_QUICK_SCAN",
        "CIM_SecurityAssociationEndpoint",
        "UpdateServiceUrl",
        "Indicates if Hosted Cache discovery is enabled",
        "Opened",
        "ResetCapability",
        "// header has many iSCSI specific eventlog messages that are useful for",
        "C_DA2CC882B6BCEAC9BF31E89756B8510C103D6DA8CC0721E36AB1395322663D45",
        "Minifilter IO Completion",
        "IL_C52295624F06C940B122D80C080F06A7E8A3B72E8DBB8DAB3530E90B3C01E0C8.1501.2805401284.326",
        "Radius Configuration",
        "Pinwriter",
        "CLEAN",
        "MGR_TRACE_PROCESS",
        "CIM_ActsAsSpare",
        "This method returns the firmware information for a physical disk.",
        "Enables a network adapter",
        "RestrictedSitesZoneDownloadUnsignedActiveXControls",
        "0x00008000",
        "MSMCAInfo_RawCMCEvent",
        "The DisableIPSec method is used to disable IP security on this TCP/IP-enabled network adapter. The method returns an integer value that can be interpretted as follows: ",
        "Ndis802_11AuthModeOpen",
        "The ProviderOperation_GetObjectAsync property indicates the number of calls to IWbemServices :: GetObjectAsync.",
        "Q.2931",
        "Prior",
        "This property gets/sets the policy for regular application of Windows updates",
        "Example: 1381",
        "{e6f51a1b-eb37-4377-9b0e-2cb3508be135}",
        "MCA_MICROCODE_ROM_PARITY_ERROR",
        "The ThreadingModel property, if applicable, defines the server threading model, can take one of the following values: ",
        "CD_A41AFD053649038BED9397E93370DEB60FBFF83AF8C35F1EAF8651CFC8534ECC.2624.1807748504.543",
        "I_AB83450D2C362894742984071630B17B68677FB118022A7E22EAA68EDF64D1E8.1150.3715020661.357",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmFormName",
        "Kernel Image Base",
        "The number of outgoing packets that were discarded even though they did not have errors.",
        "CR_D628E03D0677752FF789EA97E9BA34C4E2A9B6A38484A7C74F4BA213CAD47E8C",
        "PackageType",
        "Disables the Virtual Machine Queue (VMQ) on the network adapter.",
        "PNPX AssocDB Trace",
        "Configures the Hyper-V Virtual Switch ETW provider that is part of the NetEventSession.",
        "NotPossible",
        "Volume deduplication properties.",
        "Win32Registry|Hardware\\DeviceMap\\SerialComm",
        "Allows or Denies retrieving IP address of SessionDirectory according as whether Value is set to 1 or 0 respectively. The call returns 0 for success and an error if the policy was set to Group policy.",
        "PLATFORM_TRACE_RESERVED_1b",
        "Example: defrag /q /f",
        "SetByDisableNetwork",
        "{8502C4E8-5FBB-11D2-AAC1-006008C78BC7}",
        "Win32_LoggedOnUser",
        "ref:Win32_PrinterDriver",
        "OutEntryCount",
        "IsDeployed",
        "Verbose Error logging",
        "Specifies that the automatic configuration WPAD script specified for web-proxy configuration should be used.",
        "MsftDiscRecorder2_DebugDestructor Flag",
        "TargetVirtualDisk",
        "The Direct property indicates whether the print jobs should be sent directly to the printer.  This means that no spool files are created for the print jobs./n",
        "The multicast short address list on the NIC enabled for packet reception.",
        "MSFT_CliAlias.FriendlyName=\"Alias\"",
        "Supports SynchronizationAspect of replication group",
        "The Win32_NetworkProtocol class represents a protocol and its network characteristics on a Win32 computer system.",
        "MDM_Policy_Config01_AppVirtualization02",
        "A user-friendly name for this SOM Filter",
        "The CIM_FRU class is a vendor-defined collection of products and/or physical elements that is associated with a product for the purpose of supporting, maintaining or upgrading that product at the customer's location. FRU is an acronym for 'field replaceable unit'. ",
        "Information Missing",
        "Fail Over Only",
        "Server Specific Exit Code",
        "AffinitySlotAssigned",
        "Large Animated Bitmap Name",
        "    <registryKey keyName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\InstallService\\State\">",
        "Dial Up Settings",
        "An example of a SystemSpecificCollection is a Fibre Channel zone that collects network ports, port groupings and aliases (as required by a customer) in the context of an AdminDomain. The Collection is not a part of the domain, but merely an arbitrary grouping of the devices and other Collections in the domain. In other words, the context of the Collection is restricted to the domain, and its members are also limited by the domain.",
        "ErrorMethodology is a free-form string describing the type of error detection and correction supported by this device.",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\ToolBoxBitmap32[Default]",
        "Win32_ODBCDataSourceSpecification",
        "NDIS Maximum Send Packets",
        "FILE_EXECUTE (file) or FILE_TRAVERSE (directory)",
        "$2m;$2m;",
        "Electrostatic",
        "Represents a storage node in a cluster.",
        "C_737D301CB8F93905D70C42253781F901EC7FCADD3289B3588BFF04F6F6A13AB1",
        "TracingMemory",
        "The Name property indicates the alias given to a path set up as a share on a  system. ",
        "Reverse Roles operation requires FailedOver state",
        "Win32_ReliabilityRecords",
        "CD_48C8FF9D3F57E7744A3D1C2C52E57FC97BA717E184730EB1BDE77718DB3C9C93.51.3268578348.772",
        "FileServer",
        "Notify Stream File Object",
        "Association between StoragePool and VirtualDisk. This association should only exist for concrete pools.",
        "I_0F3AB3AAD38DC62E71EC95B3EBCF4B32C73DF010511E88F91EAE962110D82CAA.2678.3560459195.282",
        "The ServerName property, if applicable, defines the COM server name present within the unnamed value of the CLSID key.",
        "NDIS FDDI Short Maximum List Size",
        "CIM_ERR_ALREADY_EXISTS",
        "PacketRoutable",
        "MDM_Policy_User_Config01_InternetExplorer02",
        "FileAssociations",
        "Describes configuration related to the BranchCache hosted cache server role",
        "MDM_Policy_User_Config01_Start02",
        "intendedPurposes",
        "hresultCode",
        "AlwaysUseAutoLangDetection",
        "Web resource module manager class inheriting from OMI_ResourceModuleManager",
        "Timer",
        "RDMAOutFrames performance counter missing",
        "ref:Win32_ClassicCOMClassSetting",
        "ContactITUrl",
        "The size of the file system allocation.",
        "CREATE_MAILSLOT",
        "C_838E13828F10196D3F66F7B92E25AEB70BD0868AFEF218970174CFCF1AE4D54E",
        "FX_TRACE_IO",
        "BytesToInternetPeers",
        "WNFSubUnsub",
        "iScsiFlagIsr",
        "Enables the ODBC Connection Pooling PerfMon counters represented by the specified ODBC PerfMon counters objects. Enter a variable that contains the objects, or type a command or expression that gets the objects.",
        "    // 1 = Aggressive Mode Enabled; 0 = Disabled",
        ")E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "bits per second",
        "RestrictedSitesZoneAllowFileDownloads",
        "IPv4TransmitIpChecksumSupported",
        "Example: M1.",
        "PCMCIA Modem",
        "AllowStandbyWhenSleepingPluggedIn",
        "Maximum Interface Type",
        "__ProviderHostQuotaConfiguration",
        "Refresh rate in hertz. If a range of rates is supported, use the MinRefreshRate and MaxRefreshRate properties, and set RefreshRate (this property) to 0.",
        "The number of frames the NIC receives without errors and indicates to bound protocols.",
        "SuspendSupported",
        "The Delete method deletes an existing service. It returns one of the following integer values:",
        "object:Win32_TokenGroups",
        "CurrentUsers",
        "Year and week of storage device manufacture.",
        "R_D494E9A85935E059369DBBB5BC793F2672E05B3CE93CFCC0DD52A3144BCDAC07",
        "Major Error Counter",
        "p5m;p5m;",
        "Defines the IPv4 USO encapsulation settings for the Adapter.",
        "The Description property provides description of the parameter",
        "Number of bytes for task offload change indication",
        "Sets properties on the specified printer",
        "0x203",
        "aa[Mx",
        "Installs a license.",
        "Specifies the path that contains the named values to be enumerated. ",
        "ALPC-Wait-For-Reply",
        "Local Port",
        "\\\\.\\Root\\Default:__Win32Provider.Name=\"RegistryEventProvider\"",
        "AdapterChipType",
        "MSFT_NetTeredoState",
        "CategoryID",
        "OldState",
        "LPC_TRACE_COMMUNICATION Flag",
        "Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PagefileUsage",
        "Trusted For Delegation",
        "The name of the virtual switch the VM network adapter is connected to.",
        "ElementSetting represents the association between ManagedSystemElements and the Setting class(es) defined for them.",
        "TRUE if the adapter should use an autogenerated and non routable (link local) address as its IP address.",
        "CIM_ComputerSystem.Dedicated",
        "Specifies the printer for which to set configuration information.",
        "CIM::Network::DNS",
        "Whether to enable Operation Recorder API Functionality. Operation Recorder enables applications to speed up operations that repeatedly access the same file data by exposing the Windows prefetching mechanism as a public interface.",
        "ReceivedFragmentCount",
        "Method not supported on this platform",
        "CommandOrdinal",
        "Win32API|System Information Functions|GetWindowsDirectory",
        "MaxProcessorGroup",
        "WLANHC_AUTOCONFIG Flag",
        "CIM_PolicyComponent is a generic association used to establish \\'part of\\' relationships between the subclasses of CIM_Policy. For example, the PolicyConditionInPolicyRule association defines that PolicyConditions are part of a PolicyRule.",
        "Discovery via SLP",
        "MDM_VPNv2_DomainNameInformationList02_01",
        "The Win32_SystemDriverPNPEntity class represents an association between a Plug and Play device on the Win32 computer system and the driver that supports the Plug and Play device.",
        "Flag indicating whether the template defers to MS account.",
        "This property returns the Enterprise Client Sync product's url for which the client will sync to",
        "Win32_Account",
        "RemotePortEnd",
        "The specified ProvisioningType is not supported.",
        "BaseBoardProduct",
        "DeleteObject",
        "CallbackRoutine",
        "Whether to log an event when rules are ignored.",
        "perty",
        "Array of processor throttle states (T-states)",
        "The PMTUBHDetectEnabled parameter specifies whether the detection of \"Black Hole\" routers is enabled. If TRUE, the method makes TCP attempt to discover \"Black Hole\" and route packets in different network paths.",
        "(currently not used)",
        "// The number of bytes received using the IPSEC tunnel mode.",
        "Passphrase for the file containing the key information.",
        "Values",
        "Binding information for the network adapter.",
        "RetryCycleDelay",
        "ModifiedTime",
        "Trusted",
        "The PDO property represents Physical Device Object e.g \\Device\\00000002 PDOs represent individual devices on a bus to a bus driverA bus driver creates a PDO for each device that it enumerates on its bus.The PDO represents the device to the bus driver. Other drivers for a device attach device objects on top of the PDO--the PDO is always at the bottom of the device stack",
        "LogFlagSerialize Flag",
        "I_19E57369527D4B1D06F7B62EA4740710580A7EE3221F927586AA3C452A7CD5DA.1478.1775475337.253",
        "CR_D4D7929A8312A6DC45326BF70047842109EC7C6FE50B4DFC14E0212EF111A093",
        "File Read Write",
        "Voice over Cable",
        "CreatedReplicationGroup",
        "AddByComPlusSet",
        "MaxFileNameLength",
        "CIM_Error.Message",
        "Win32_PnPDevicePropertySecurityDescriptor",
        "68000",
        "The media duplex state of the network adapter.",
        "The network profiles for which the policy applies.",
        "Unsupported file system",
        "MI_ERRORCATEGORY_OPERATION_STOPPED",
        "CD_3777205E8B20487F970347DB3B54C0C1CE84371ABD4BCBDB57E68DB30949BA61.1076.870414287.3769",
        "Two ticks",
        "The name of the organization responsible for producing the physical element. ",
        "Both - components that can be used in either apartment-threaded or free-threaded modes. These components can be entered by multiple threads, protect their data from thread collisions, and do not contain thread-specific data.",
        "ConcreteCollection for IPMI",
        "Bad Read",
        "Send SCSI Read Capacity command",
        "MSFT_ResiliencySetting",
        "CD_199CFC4A1FC7A648AECC1FFEF43CFCD6FD4BBDB0667CA99257540823E6C76661.39.37850779.281",
        "The ScreenSaverExecutable property indicates the name of the current screen saver executable file.",
        "Printing",
        "2 - 'Manual' implies the subsystem allows manual creation of the Target. ",
        "AutomaticManagedPagefile",
        "The CacheSpeed property specifies the speed of the cache in nanoseconds.",
        "ReplaceIfExists",
        "A Boolean that indicates whether the NetworkPort is capable of automatically determining the speed or other communications characteristics of the attached network media.",
        "NumMacAddressesPerPort",
        "TM_MEMORY",
        "Read/Write Supported",
        "COM Object",
        "             no effect.",
        "Offboarding",
        "AllowArchiveScanning",
        "The SupportXOnXOff property determines whether software flow control is supported on the serial port",
        "Per-Session",
        "DadRetransmitTime",
        "DisableOneDriveFileSync",
        "ref:Win32_IP4RouteTable",
        "FX_TRACE_RESERVED_1b Flag",
        "All data sent between Server and client is protected by encryption based onserver's maximum key strength.",
        "PolicySourceCOMPortMapping indicates whether the property COMPortMapping is configured by Server (0),Group Policy (1), Default (2).",
        "Specifies if threat has executed",
        "95 - Unable to notify service",
        "CD_91272CCB786B80704637F2DA5FEC31804C0D45A10039A155AE9DF9B9224919E1.1106.1.50448",
        "Terminate",
        "3 - Wide Area Network (WAN)",
        " One of the following types of service start must be specified in this column.",
        "Policy App Id corresponding for this rule.",
        "14 - 'Aborted': Similar to Stopped, except that the volume stopped abruptly and may require configuration or maintenance.",
        "MSFT_NetAdapterVmqQueueSettingData",
        "0 - Success. Reboot required. ",
        "TEST_TRACE_RESERVED_08",
        "MDM_Policy_User_Result01_Security02",
        "PolicySourceAudioCaptureRedir",
        "The actionable results of diagnose.",
        "Whether the packet is routable.",
        "ErrorLogCapability",
        "Maximum number of PD transmit queues that can be allocated on the adapter.",
        "R_31380B1CBE2DE48F4953061E943634793359C618E73F753682430004D4E36FB0",
        "The ServerName parameter specifies the name of the server that hosts the share to which the link is associated. For example, in order to create a link associated to a share \"\\\\myserver\\myshare\", the ServerName parameter should be set to \"\\\\myserver\".",
        "010 - Immediate ",
        "SetSingleSession",
        "SentBroadcastBytes",
        "SDBUS_DEBUG_INFO Flag",
        "The Msft_WmiProvider_ExecQueryAsyncEvent_Pre class represents an event generated immediately prior to calling the provider's implementation of IWbemServices :: ExecQueryAsync.",
        "Number of load-unload cycles performed by the storage device.",
        "The filters associated with the rule.",
        "C_A4EFDDEDDCE2AE550D296107D6D386ED594FA4146A7AE71A7D9821F0681D3985",
        "The 802.11 RTS threshold, in bytes",
        "discoverySession",
        "MaximumDueTime",
        "NDIS Dot11 Connection Start Status Indication",
        "HandleNewDescsBegin",
        "The mask for the IPv4 address of this ProtocolEndpoint, if one is defined.",
        "NDISWMI_TRACE_LSO Flag",
        "Denotes the health status of the PhysicalDisk on this StorageNode.",
        "PLATFORM_TRACE_SECURITY Flag",
        "neverViewableSites",
        "RemoteClientAccessEnabled",
        "Monitor's raw EDID v.1.x data block",
        "ISCSI_IP_Address",
        "The KernelDumpOnly property has been deprecated in favor of the DebugInfoType property in the same class.  All future work should use this new property.  ",
        "A string representation of the vendor defined link technology. This field should only be set if LinkTechnology is set to 1 - 'Other'.",
        "Ethernet 802.3",
        "AccountLogonLogoff_AuditNetworkPolicyServer",
        "CD_36FFCD7C103F4CB151534CDC404DD1E71C91E39EA5D1DCB2E130739044899EBB.2053.1.13289",
        "OperationType",
        "I_3CA6A8A46045BF954508B3340CD11FE30993A59816D6AA3EB1B345A8EEDF8A01.1608.3979994243.332",
        "TRACE_CLASS_EMIT Flag",
        "Minimum log size in bytes supported for replication.",
        "CD_040EEFB9D32ACFDF35093E1B9FBC87E0DA3C6102445122A04A158078F02AF3C6.1932.997009678.721",
        "0xC0050065",
        "The number of antennas",
        "DATETIME",
        "Supplying this parameter will automatically replace the current Trusted Network List with the DNS suffixes present in VpnConnectionTriggerDnsConfiguration. Note that only DNS suffixes with corresponding DNS server addresses are copied from  VpnConnectionTriggerDnsConfiguration",
        "AttackSurfaceReductionRules_Actions",
        "SCO OpenServer",
        "Path Id sp",
        "Sets the location to which the service redirects metadata requests.",
        "NDIS Ethernet Permanent Address",
        "MSFT_ResiliencySetting.PhysicalDiskRedundancyMin",
        "R_7C983320414DFF8D2BA0128B25033C8FB169F5189449E13D88BE3724B6F2E9D3",
        "PacketPrivacy - The properties of the other authentication levels are used, and all data is encrypted.",
        " 0x00000100A ",
        "ROOT\\msdtc",
        "MI_ERRORCATEGORY_QUOTA_EXCEEDED",
        "Localized version of RSOP_PolmkrServerSetting for American English",
        "RemoveApp",
        "A TimeSpan that specifies the time interval a previous session key is valid on incoming messages during a key renewal.",
        "10 GBit/sec",
        "AutoWriteCacheSize",
        "ComponentClassGuid",
        "// This class is recommended.",
        "rCE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0",
        "HOSTPROC_RESERVED_15",
        "4C7FCF7F8B0B70EEA799638913C1E17DC7E507CB73.1638.1077066923.768",
        "NS_5456CA76306BB18057C7C64D8BB2414E19DC9CF4F51E2760534CB23439D79B06\\KI_272E5753DC3EECDD6057038DB6F26170E7D1CD565B954C6C4A406CB1BC2D023E\\I_1A84077BF4FB1F232DECD798D5154E1CD2AEFFEDE9344CA623848E1E6D64A35B",
        "The Antecedent reference represents the Win32_DiskDrive containing the properties of the disk drive where the partition exists.",
        "object:MSNdis_80211_ConfigurationFH",
        "Scsi Bus Number",
        "RemoteTunnelEndpoint",
        "AsynchronousCredits",
        "1.1.0",
        "This is the file path of the store that this object belongs to.",
        "WPA-Personal",
        "Example: 1 = January",
        "WLAN Extensibility Trace",
        "{01853a65-418f-4f36-aefc-dc0f1d2fd235}",
        "CREATE Flag",
        "Example: PCI-1",
        "Handles",
        "tract",
        "MDM_AppLocker_MSI03",
        "MSFT_NetAdapterQosElementSetting",
        "The DriverVersion property indicates the release version of the display driver.  ",
        "InterfaceType",
        "{6d2fd9c5-8bd8-4a5d-8aa8-01e5c3b2ae23}",
        "Groups, represented by an array of security groups",
        "A string representation of the vendor defined connection type. This field should only be set if ConnectionType is set to 1 - 'Other'.",
        "ref:Win32_TerminalSetting",
        "{46456be3-05cf-4a65-88b6-99ef787d0d1f}",
        "Device Status",
        "FileIo_Name",
        "Capabilities and management of an uninterruptible power supply. The properties of the UPS device indicate when incoming power is trimmed or boosted, and the aggregated information of the batteries, generators, etc. that comprise the device.  These individual components (for example, multiple batteries) can also be independently modeled and associated with the UPS.",
        "Controls whether the computer's roaming user profile feature settings are configured by using UST Manageability WMI classes or by using Group Policy.",
        "SamProcessMappedAttributes",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2736.2831676613.180",
        "A version string used by the SMP manufacturer to differentiate between software versions.",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\nwlnkipx\\Parameters|NetworkNumber",
        "Bus time-out",
        "CD_E66D2A11AD2317154A9C2C61CC140BA5F198CC545A25F24736AE23D74E16B49B.14.2746877542.840",
        "MIF.DMTF|System BIOS|001.9",
        "CIM_ConcreteJob",
        "Pointer Size in Bytes",
        "3 - 'Degraded': The volume is responding to commands, but is not running in an optimal operating state.",
        "IL_6E3B4399FA4EDE750602EAE85FB276C1B64644E78344F6BB3EF3F442D17FE8D8.352.1.287457",
        "The IPInterface used to reach the neighbor.",
        "Remaining time in minutes before the parent application goes into Notification Mode.  For volume clients, this is the remaining time before re-Activation is required.",
        "HttpsHelpPageBinding",
        "MGR_TRACE_RESERVED_0f",
        "The total number of unmovable files on the volume.",
        "SMBIOS|Type 9|Segment Group Number",
        "CD_6CDFA95C1CD82B67F7CE9D96621CA3D40FBBB6ED3577D6A166218E452130A3BA.1463.2076710543.663",
        "SoftwareCode",
        "To disable real time persistence, set this value to 1.",
        "I_614FEB5198DB6356C7D4E70E58F0634936BC6DE530AA5FD952207E56B5A89D3F.1635.1115446966.267",
        "CD_4AC1D3A26D87995319BF08535EEE6BAC00658FC9706A2D0A430BCE00D546062C.97.1913818272.655",
        "Program name",
        "Maximum number of incoming outstanding read requests supported by the adapter. If this field is 0, there's no adapter-wide limit. There is still a limit per queue pair, which is indicated by the NetworkDirectAdapterInfo.MaxInboundReadLimit field.",
        "SnappingStart",
        "Object",
        "Dont Care",
        "2.7.0",
        "{3081F2A5-95F5-4d2a-813D-EE59864C6FC5}",
        "When RunDayOfWeek is not 0, RunDay is the day-in-month on which the Job is processed, defined in conjunction with RunDayOfWeek. For example, if RunDay is 15 and RunDayOfWeek is Saturday, then the Job is processed on the first Saturday on or after the 15th day in the RunMonth (for example, the third Saturday in the month). If RunDay is 20 and RunDayOfWeek is -Saturday, then this indicates the first Saturday on or before the 20th day in the RunMonth. If RunDay is -1 and RunDayOfWeek is -Sunday, then this indicates the last Sunday in the RunMonth.",
        "0xEFFF0058",
        "PositionInRow",
        "The property description in user interface.",
        "CopyExistingInfoOnly",
        "ref:Win32_USBHub",
        "MsftWriteEngine2_DebugDestructor Flag",
        "MDM_ApplicationMinVersion",
        "ISCSI_Path",
        "AdapterSerialNumber",
        "The LongDisplayName property specifies the COM application's full name. It is used in areas such as the Results field of the OLE Paste Special dialog box.",
        "Size in bytes of the blocks which form this StorageExtent. If variable block size, then the maximum block size in bytes should be specified. If the block size is unknown or if a block concept is not valid (for example, for Aggregate Extents, Memory or LogicalDisks), enter a 1.",
        "DrainNotificationSupported",
        "CD_D03948432DCEFB99FB1EBE3230848319D45009B95943838EC079B34AD2F12F73.1617.2188337604.602",
        "RSOP_ExtensionStatus.extensionGuid=\"{00000000-0000-0000-0000-000000000000}\"",
        "Specifies that PEAP should be used as the authentication method.",
        "This parameter indicates the media type to be used by default when creating a new virtual disk on this storage pool. If no default is specified, the default is inherited from the primordial pool.",
        "Flag for enabling / disabling default sync settings for Windows apps",
        "EC0C311F78F07CE34C050F510D55C1F5373A349277F064EB193",
        "Equipment Shelf",
        "megabytes",
        "object:PS_VpnConnectionRoute",
        "IncludeExceptionDetailInFaults",
        "hangUpExtraPercent",
        "C_4BAA21648FDB845BC99AC457B05278DDADF6666FEF0E8ACFB4E6AF8CB185DBE3",
        "The DeviceID property contains a string uniquely identifying the SCSI controller with other devices on the system.",
        "CIM_Privilege.Activities",
        "C_2504DC1AC3CAB9C6ED112DDC44AEE64529224B292ABC0946F5963E4C35C80939",
        "IL_B4A2C5E94294CA48EE83444B581B7715F0456C2AE322533C1FC870F4B341BC92.2459.3129702897.334",
        "{8502C4C6-5FBB-11D2-AAC1-006008C78BC7}",
        "6AEA8D3F609CF92D2D881D05F26BFED8",
        "TRACINGFRAMEWORKS",
        "ROOT\\subscription",
        "The Dependent reference represents the processor that is using the cache memory.",
        "MGR_TRACE_RESERVED_0a Flag",
        "Path of the file that will contain the key information.",
        "ProtectKeyWithTPMAndStartupKey",
        "WakeReleaseInstrumentation",
        "SamAddMemGrp_End",
        "DeviceEntriesInAColorTable",
        "ref:MSFT_NetIKEP2AuthSet",
        "object:VpnConnectionProxy",
        "FRU identification such as a serial number on software or a die number on a hardware chip.",
        "Auth transform plumbed in IPsec policy.",
        "ref:Win32_PNPEntity",
        "HostIPv4Address",
        "MGR_TRACE_RESERVED_1d Flag",
        "Win32_API|Windows Sockets Structures|WSAPROTOCOL_INFO|dwServiceFlags1|XP1_QOS_SUPPORTED",
        "SAM Set Member Attributes Of Group",
        "The name used to identify this software element",
        "msdtc",
        "Import_BCCachePackage",
        "String array of Mac Addresses of available physical Network Adapters",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_14E81FED65CA256A291552D7368076BDF086E65B079868D33E50C9799C909A98",
        "AuthInfo",
        "Next SRB Pointer",
        "Win32_WIN32_TSVIRTUALIPSETTING_Prov",
        "PeakPagefileUsage",
        "Bid2Etw_ADOMD_1",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2750.1656231170.180",
        "Indicates whether the storage enclosure is physically connected to this storage node.",
        "AuthenticationAlgorithmsSupported",
        "IL_C7BED1CCC8E3279B70E4846D9154BA63003D9E227AE14E0590492F865356BD94.1499.2854629194.270",
        "DOT11_AUTOCONF_CLIENT",
        "Vector",
        "D74027E586B2E97BEF112C2070090FD\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "LastError",
        "If TRUE, the storage subsystem supports showing and hiding (masking) a virtual disk to a host initiator through the Show/Hide methods of the virtual disk and by the use of masking sets.",
        "The interval of time provided for a send operation to complete.",
        "CopyNumber",
        "The number of copies that will be produced for a single Job unless otherwise specified.",
        "MSFT_CliAlias.FriendlyName=\"SystemEnclosure\"",
        "MaxBytesPerRead",
        "SystemConfig_V2_MobilePlatform",
        "Caption string is required.",
        "object:MSFT_StorageObject",
        "Master File Table Record Count",
        "Unable to retrieve replication group id right now.",
        "The RefreshRate property indicates the refresh rate of the video adapter. A value of 0 or 1 indicates a default rate is being used. A value of -1 indicates that an optimal rate is being used.",
        "PrintJobDataType",
        "SynchronousReceiveBehavior",
        "NonMediumErrors",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_01AF7823F90DAEC78BAF38771F45D60A37B0917DC6BBE974DF07B97707A15F13",
        "This parameter indicates whether the volume should be forced to dismount before checking.",
        "CIM_FileStorage",
        "Name of the server containing the GPO",
        "Monitor's maximum refresh rate in hertz, when a range of rates is supported at the specified resolutions.",
        "The SetKeepAliveInterval method is used to set the interval separating Keep Alive Retransmissions until a response is received. Once a response is received, the delay until the next Keep Alive Transmission is again controlled by the value of KeepAliveTime. The connection will be terminated after the number of retransmissions specified by TcpMaxDataRetransmissions have gone unanswered. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "Performs online activation of AD forest using the specified product-key to generate and then publish the Activation Object (AO) into Active Directory.",
        "internalStatus",
        "CR_D3EEBB9E3A4C5F3CA348B142AF6727D3A274A152187FB63005FF1EA0DBF75FAE",
        "{28c9f48f-d244-45a8-842f-dc9fbc9b6e92}",
        "SystemProductName",
        "WSP_ReplicationGroupStorageDepartureEvent",
        "PCI_BUS_RESPONDER_ID is valid",
        "0xC005007A",
        "NdisPMCapabilityState",
        "Win32Registry",
        "Optional private IPv6 address or subnet, for which this policy is specified.",
        "WPD_F4 Flag",
        "CD_86ED431FCE21CAA67833F50E8CEB80C11FAD7D40366CDE16E2C8794094F18925.1737.3861103065.744",
        "CD_2C9E96C7F7E323559ADDB98919DA9CB9D792B77EB6D7DB30E98DE86B6BCDF5FC.38.3854489050.466",
        "OMI_MetaConfigurationResource",
        "MCA_WARNING_CMC_THRESHOLD_EXCEEDED",
        "TimeToFullCharge",
        "A return code of 0 shall indicate the state change was successfully initiated.",
        "YearOfManufacture",
        "Selected Ratings Bureau",
        "A free-form string providing a description of the organization when 1, \"Other\", is specified for the RegisteredOrganization.",
        "MGR_TRACE_RESERVED_18",
        "Security settings of a share object",
        "\"Immigrating\" element is being moved to new host element. ",
        "ServiceModel Endpoint",
        "The Win32_LogicalDiskToPartition class represents an association between a logical disk drive and the disk partition it resides on.",
        "{9B3AC16A-EEE5-11d2-B13B-00105A1F77A1}",
        "CD_40CAFB87B847B798AC8F2045737A2A8390AC0416A38406D6F38EE740FBB0A4AC.21.2336647194.1508",
        "TRACINGUSEROBJECT Flag",
        "HighThreatDefaultAction",
        "NumberOfSessions",
        "PrimaryGroupId",
        "The SupportIntervalTimeouts property determines whether interval timeouts are supported on the serial port",
        "Management Controller",
        "tm_min",
        "minimumTemplateLevel",
        "The Win32_PnPSignedDriver class provides digital signature information about drivers ",
        "Boot Flag",
        "DestinationAddress",
        "DetailedTracking_AuditTokenRightAdjusted",
        "ISCSI_ERR_INSUFFICIENT_WORKITEM_RESOURCES",
        "ApplicationId",
        "EnableOfflineMapsAutoUpdate",
        "TRUE if the network adapter supports wake-on-LAN capability and the capability is enabled, or FALSE if it does not",
        "CIM_RecordLog.MaxNumberOfRecords",
        "WMPNetwkGuid",
        "WlansvcCtlGuid",
        "DOT11_MSM_SECURITY_PKT",
        "LockDown",
        "Enables or Disables the Terminal. The function takes one parameter, the flag thatenables or disables it. The call returns zero on success and an error on failure.",
        "CD_15BB74500CCB05CD5AC2C91DC16CB85AAAE5FB06E9A05F8A5AA7D6BCB68E38B6.2097.1148474094.1913",
        "Privilege is the base class for all types of activities which are granted or denied to a Role or an Identity. AuthorizedPrivilege is a subclass defining static renderings of authorization policy rules. The association of Roles and Identities to AuthorizedPrivilege is accomplished using the AuthorizedSubject relationship. The entities that are protected are defined using the AuthorizedTarget relationship. ",
        "ISCSI_ERR_INSUFFICIENT_REQ_PACKET_RESOURCES",
        "{80be1943-684e-41b9-82e5-32b18d858a2c}",
        "43018",
        "41011",
        "4 = \"Re-run Job\", indicating that the job should be re-run ",
        "00000000000015.000000:000",
        "MGR_TRACE_RESERVED_0a",
        "MIF.DMTF|DMA|001.1",
        "Retained",
        "The FRU's revision level.",
        "WmiEnumReceiveFilters",
        "L0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170",
        "TRACE_FATAL Flag",
        "CIM_EnabledLogicalElement.PrimaryStatus",
        "QuickFormat",
        "Stack to Stack",
        "Breach of Confidentiality",
        "The UserName property indicates the name of the user that made a connection.",
        "{514A9270-C856-11D2-B364-00105A1f77A1}",
        "PolicySourceAllowTSConnections indicates whether the property AllowTSConnections is configured by Server(0) or Group Policy (1).",
        "Bid2Etw_ODBCBCP_1_Trace",
        "SamGetBootKeyInfo",
        "A value that specifies the maximum number of pending security sessions that the service supports.",
        "65004",
        "Number of elements in iScsiPortalInfo array",
        "The associated TCPSetting's SettingName.",
        "Indicates whether this rule is administratively enabled or disabled.",
        "68020",
        "PercentComplete",
        "ContentRetrievalFirewallRulesEnabled",
        "SupportedReplicationTypes",
        "586B2E97BEF112C2070090FD\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "The Win32_USBController class manages the capabilities of a Universal Serial Bus (USB) controller.",
        "The VolumeSerialNumber property indicates the volume serial number of the logical disk.",
        "GPOID",
        "TCP Connection Offload Current Configuration of the adapter",
        "EncryptionMethodByDriveType",
        "Specifies whether the printer should use color.",
        "FabricWWN",
        "Error Code",
        "MaxProtectionDomainCount",
        "The Change method modifies a service. The Win32_LoadOrderGroup parameter represents a grouping of system services defining execution dependencies. The services must be initiated in the order specified by the Load Order Group as the services are dependent on each other. These dependent services require the presence of the antecedent services in order to function correctly. ",
        "DMTF has reserved the unused portion of the continuum for additional HealthStates in the future.",
        "This bit indicates whether the machine case can be opened",
        "ParityInfo",
        "This parameter allows the user to specify the replication group target on the target machine.",
        "Win32_DMAChannel",
        "Customize Logo Bitmaps",
        "InterruptModeration",
        "This field allows the Storage Management Provider (SMP) to provide a brief description explaining the indication.",
        "The Name property indicates the name of the system account on the domain.",
        "PLATFORM_TRACE_RESERVED_11",
        "LogFlagService Flag",
        "SetUserAuthenticationRequired",
        "{1311095b-b9ff-497a-8560-2f43ca5438e4}",
        "sint16",
        "PLATFORM_TRACE_RESERVED_16",
        "The address the NIC is currently using.",
        "object:ISCSI_ConnectionStaticInfo",
        "Denotes the access type ( Allow, Deny ).",
        "An identifier used in conjunction with other keys to uniquely identify the check",
        "1 - 'Low': copy engine I/O lower priority than host I/O. ",
        "RelPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\MyKey\\MySubKey ",
        "proccntr",
        "MaxReceiveQueueDepth",
        "write",
        "WINSTATION_LOGOFF=0x4",
        "{368c45b5-c129-43c1-939e-7edc2d7fe621}",
        "ClearTPMIfNotReady",
        "CIM_Process.OSName",
        "QueueState",
        " with this file is specified using the CIM_DeviceAccessedByFile relationship.",
        "NumQueuePairsForDefaultVPort",
        "Specifies the interval after which persistence operations are considered timed out.",
        "The CIM_CollectionOfSensors association indicates the binary sensors that make up the multi-state sensor.",
        "jobId",
        "DeleteValue",
        "Boolean indicating that the operating system is the default OS for the computer system.",
        "CIM_PhysicalFrame.SKU",
        "InEntryCount",
        "Brightness - percentage",
        "The DNSHostName parameter specifies the name of the DNS host to be enabled by this method.",
        "#define ISCSI_HBA_STATUS_DEGRADED          1",
        "MPLS Tunnel Destination",
        "The name of the context",
        "SetQWORDValue",
        "This parameter allows the user to specify the desired FriendlyName at the time of the virtual disk creation. FriendlyNames are expected to be descriptive, however they are not required to be unique. Note that some storage subsystems do not allow setting a friendly name during virtual disk creation. If a subsystem doesn't support this, virtual disk creation should still succeed, however the disk may have a different name assigned to it.",
        "CD_DC65173170329CBC28153539525DF4928293E66F1C821340853F94ED0B12705C.1783.332066254.1249",
        "// The number of inbound quick mode security associations (SAs) added by IKE ",
        "{EDCE42F9-0991-11d3-910A-00105AA630BE}",
        "This method gets the access control entries for the specified accounts.",
        "5 - The requested control code cannot be sent to the service because the state of the service (Win32_BaseService:State) is equal to 0, 1, or 2.",
        "Win32_ShadowContext",
        "{8B19C1CD-C80C-4AEC-AAE2-4E39FEDD24D0}",
        "tagDefault Flag",
        "InstallationId",
        "FadtC3Latency",
        "0x8005006E",
        "CorrelationID",
        "Enable Flags",
        "srbStatus",
        "TestTargetResource",
        "CreatedMaskingSet",
        "The BitsPerPixel property indicates the actual number of bits per pixel representing the display.  This may be scaled to the current video setting (represented by the ActualColorResolution property) of the user.",
        "RestartJobById",
        "Stack17",
        "A Win32_FolderRedirectionHealth object that represents the health of the user's redirected Videos folder.",
        "The url of the remote application server",
        "CallbackBehavior",
        "Commit",
        "DenyAccessFromNetwork",
        "ThermalConstant1",
        "AES-GCM-192",
        "Resets the licensing status of a SKU.",
        "{D75D8303-6C21-4bde-9C98-ECC6320F9291}",
        "BinaryValue",
        "CR_1C871A69AE42FDAE2404C626ED2A6EE58970B1ADBD41309118A0347F713B188E",
        "StorageSubSystemUniqueId",
        "The NumberOfFunctionKeys property indicates the number of function keys on the keyboard.",
        "MDM_ApplicationControl",
        "This method adds a mount path or drive letter assignment to the partition. The AccessPath and AssignDriveLetter parameters are mutually exclusive, and will result in an invalid parameters error if both are specified at once. This method adds the access path by creating a mounted folder (also called a volume mount point). Note that mounted folders are supported only on NTFS formatted partitions. This method returns an error if the path specified in AccessPath is a folder that is already in use (even if the directory is empty) or if it contains a path to a non-empty directory.",
        "MSFT_NetServiceCrashNoAction",
        "SourceId",
        "This parameter is to specify the Encryption level to be used with the current VPN connection.",
        "The file server that will own this volume.",
        "If set to TRUE, this instructs the fault domain to enable maintenance mode.",
        "The amount of memory on the NIC available for buffering receive data.",
        "C787CDD6148B3A1710BABB66FFAAB061F700558EE123742FA9A22BAEF228EE96.1538.560674016.910",
        "stri<",
        "Specify the exclusions for Attack Surface Reduction Rules(ASR).",
        "AutofillEnabled",
        "C_64F94F3450D7629325CA5169EB2D437E79C378BC4227DD614FBE4F965CC6B706",
        "58004",
        "CIM_ComputerSystem.CreationClassName",
        "C_455876B64E565F4962FC035AF2C8087D1797E42AAA9586F45C5A3E20F37175C3",
        "The Win32_PrinterController class represents an association between a printer and the local device to which the printer is connected. Note that this class only returns instances for local printers.",
        "Whether the provider requires NDKPI consumer to use NDK_MR_FLAG_RDMA_READ_SINK or NDK_OP_FLAG_RDMA_READ_SINK flags when registering sink buffers for RDMA Read requests.",
        "An XML representation of this instance, which can be used as input for MSFT_ThirdPartyVpnConnection::Set",
        "The ChangeSecurityPermissions method changes the security permissions for the logical file specified in the object path. If the logical file is actually a directory, then ChangeSecurityPermissions will act recursively, changing the security permissions of",
        "9 - Path not found",
        "Information Mis",
        "2 bit - Acct Delete - Delete the account when a domain is left. ",
        "R_3221B359A5416B849210C8EDE6CA9A31AE77982A28D76140A2605705EA5F2416",
        "MSTapeSymbolicName",
        "I_AA1B5BB8A762366D711DCFE877B29E175333778C99FBCFF14D33452DE7A9A746.463.1.297697",
        "The IPSecPermitIPProtocols parameter specifies the list of protocols permitted to run over the IP. A numeric value of zero indicates access permission is granted for all protocols. An empty string indicates that no protocols should be granted access permission.",
        "IR_42B2E3A3A6520FF2AA7BA157666764419AB7273E011404BF98FB167E54E43BA9",
        "MaximumNumberOfRxQueuesPerNonDefaultVPort",
        "{5a1600d2-68e5-4de7-bcf4-1c2d215fe0fe}",
        "CardBus",
        "NETIO_TRACE_NETWORK",
        "The PeakPageFileUsage property indicates the maximum amount of page file space  used during the life of the process.",
        "Disable IOAV protection.",
        "CD_34FD9E1177E28334594B80DCA69BD741401DD280ADBA44870846F7381632F88D.71.1187103344.441",
        "Framework name",
        "Explosive Gas",
        "Objects",
        "Association between a subsystem and replica peer",
        "8 = The application was re-deployed",
        "Gets the volume attributes",
        "If the SMP is of type 2 - 'SMI-S', this field contains the protocol, computer host name, and port of the SMI-S server. This field will be NULL otherwise.",
        "PinnedStorageTierClass",
        "If true, cached copies of the roaming profile are deleted at log off",
        "The name of the KMS host. Returns null if SetKeyManagementServiceMachine has not been called.",
        "UseSCP",
        "The Remote Desktop Users group, in SDDL format",
        "experience",
        "Buffers Flag",
        "C_3D10A0A77CAA5B54D6D0F826577C9C9001B09013C6D023D93A420AB24027FBBB",
        "{7A9135CA-DB21-11d2-85FC-0000F8102E5F}",
        "The GetAvailableVirtualSize method retrieves the currently size in bytes of the free virtual address space available to this process. ",
        "Lost Event Event",
        "Target Address Structure Already Exists.",
        "MSFT_ResiliencySetting.NumberOfColumnsMin",
        "An array of strings containing network directories to synchronize at when the user logs on to or off of a local computer.",
        "xUcw0",
        "WMI_STORAGE_FAILURE_PREDICT_STATUS_GUID",
        "This class exposes attribute information associated with a Fibre Channel port. There should be one instance of this class for each port.",
        "LPCDRVR_TRACE_RESERVED_0a",
        "Acquire For Section Synchronization",
        "Local Replica Source",
        "object:MSFT_NetAdapter_RdmaMissingCounterInfo",
        "DataExecutionPrevention_32BitApplications",
        "DMA Protection",
        "This parameter specifies the resiliency setting to use as a template for this volume. This property's value should correspond with the particular resiliency setting instance's Name property. Only resiliency settings associated with this storage pool may be used.",
        "ExceptionPrefix",
        "Total number of consecutive blocks, each block the size of the value contained in the BlockSize property, which form this storage extent. Total size of the storage extent can be calculated by multiplying the value of the BlockSize property by the value of this property. If the value of BlockSize is 1, this property is the total size of the storage extent.",
        "Specifies whether the User's permission is required to remotely control the session.",
        "Specifies that ICM is handled by the destination device. ",
        "The PublishComponents action manages the advertisement of the components that may be faulted in by other products with the system. In the Advertise mode the action publishes the all components for which the corresponding feature is enabled. Else the action publishes components for which the corresponding feature is currently selected to be installed.",
        "MSFT_NetAdapterPowerManagement_WakePattern_WildCard defines settings for 'Wake on any Packet'.",
        "Is this a paging operation",
        "KI_64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41",
        "Paths",
        "Specifies the named value to be deleted from the subkey. Specify an empty string to delete the default named value (the default named value is not deleted its value is set to \"value not set\"",
        "Client Domain Name",
        "PS_VpnConnectionRoute",
        "IntranetZoneAllowNETFrameworkReliantComponents",
        "SetMultiStringValue",
        "K6-2+",
        "The ServerName property identifies the server that controls the printer. ",
        "NDIS Device Power Off Notification",
        "Embed",
        "MSNdis_MaximumSendPackets",
        "CheckSum",
        "0xAFFF004D",
        "The Resume method resumes execution of providers suspended through the use of the Suspend method.",
        "DaylightMinute",
        "Bid2Etw_MSADOX_1_Trace_TextW",
        "Determines the number of logged on sessions for given terminal",
        "{FEE8368A-DB2A-11d2-85FC-0000F8102E5F}",
        "The TypeLibraryId property contains a Globally Unique Identifier (GUID) for the Type-Library for this COM component.",
        "KerbLogonUser_Start",
        "CD_A435E1CD6D36EB19C6DA0BA1C7E62224942A59031964EC981FF17A68812E1011.2032.1922277993.256",
        "SystemRestoreProv",
        "4 - 'Incremental-Copy': Only changed data from source element is copied to target element. ",
        "Not applicable (signal sync type must be [bipolar] analog composite)",
        "CIM_IPsecSAEndpoint",
        "TXFKTM",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1534.585318014.292",
        "WHEA Error Injection Interface",
        "{A1E89BB0-EF73-4980-8C99-DD15F7271D7E}",
        "This describes the type of the package to be installed: 1 = Windows Installer, 2 = ZAP.",
        "Firmware Type",
        "UserAccount",
        "The current matching month (1-12)",
        "QuickScanAge",
        "ProtocolIFType is an enumeration that is synchronized with the IANA ifType MIB. The ifType MIB is maintained at the URL, http://www.iana.org/assignments/ianaiftype-mib. Also, additional values defined by the DMTF are included. The property is used to categorize and classify instances of the ProtocolEndpoint class. Note that if the ProtocolIFType is set to 1 (Other), then the type information should be provided in the OtherTypeDescription string property.",
        "Win32_PnPDevicePropertySint32Array",
        "Power Mode",
        "OFTWAR&",
        "Example: 102435",
        "GroupPolicyConfigured",
        "//  A call to HBA_SetPersistentBindingV2 will call SetPersistentEntry",
        "CIM_SoftwareElementActions",
        "This method converts a SDDL string security descriptor format to a binary blob security descriptor format.",
        "The TakeOwnerShipEx method obtains ownership of the logical file specified in the object path. If the logical file is actually a directory, then this method will act recursively, taking ownership of all the files and sub-directories the directory contains. TakeOwnerShipEx returns an integer value of 0 on success, and any other number to indicate an error. TakeOwnerShipEx is an extended version of the TakeOwnerShip method./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n",
        "C_BE9C3C03699415DC90398309F46D14386ED8803A3E02DAC3C1D2D0F69AA43EE4",
        "Header/Data split Current Config of the adapter",
        "Insufficient Capacity",
        "ScheduledPark",
        "The Network Layer MTU of this interface.  The default is the natural MTU of the link.",
        "The LastDrive property indicates the last drive letter to which a physical drive is assigned.",
        "Diffie-Hellman Group to use with PFS",
        "List of UUID SYSIDS",
        "SendControlState",
        "Individual settings of the resiliency setting can be overridden using the NumberOfDataCopies, PhysicalDiskRedundancy, NumberOfColumns, and Interleave parameters. If these parameters are not used, the defaults from the resiliency setting will be used. These overrides will not persist back to the particular resiliency setting instance; however some storage providers may choose to create a new resiliency setting instance to capture this new configuration. If any of the goals specified in the override parameters are out of range, or are not supported by the storage pool, an error will be returned. ",
        "The Msft_WmiProvider_GetObjectAsyncEvent_Post event class representes an event generated immediately following completion of the provider's implementation of IWbemServices :: GetObjectAsync. ",
        "OriginalSize",
        "DeviceGuard",
        "CD_B55C81E6C68BC4C439BC0ABBC4E8C0BD3216FAB41830394E3FAC0034894B6231.1152.3046061894.664",
        "Behavior",
        "A uniquely generated session ID, it is the same id returned by the LoginToTarget method.  Do not confuse this with ISID or SSID.",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TERMINALSERVICETOSETTING_Prov\"",
        "PNP_EVENT_TRACE_LEVEL",
        "The GuaranteesSequencing property indicates whether the protocol guarantees that data will arrive in the order in which it was sent. ",
        "RadioHardwareVersion",
        "Hobbit Family",
        "The SupportsXOnXOffSet property indicates whether the communications provider supports configuration of the XON/XOFF flow control setting.",
        "FileChar",
        "An array of integers that specify the features supported by the BIOS. For example, one can specify that PnP capabilities are provided (value=9) or that infrared devices are supported (21). The value, 3, is not valid in the CIM schema since in DMI it represents that no BIOS features are supported. In this case, this object should not be instantiated.",
        "I_41CD80BFBD3EF2A72B1311F93D87AFDE77273A97897B7B012F0BFA851DE8E60A.154.1130414801.297",
        "Ndis80211MacAddress",
        "Win32Registry|Control Panel\\Desktop|DragFullWindows",
        "LocalUIEnabled",
        "{5ec1035f-a61a-11d0-8dd4-00c04fc3358c}",
        "TargetContract",
        "__AggregateEvent",
        "Enable BidTrace for this application full path.",
        "CD_FFBBEEB41878AC75CD38671CF9A4CECEB2F673622833FAA9EA04376FB4297330.39.3774916501.346",
        "Win32_RoamingProfileSlowLinkParams",
        "The ProcessID property identifies the process involved in the event.",
        "The following types of service are unsupported.",
        "PortableDeviceAPI_Events",
        "Indicates that an operation is implemented asynchronously using a Begin<> and End<> method pair in a service contract.",
        "NS_B6791A1CF7802A901B1534CADBB1A0E82FB154100B2BE08AF47386C43CEC462A\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6",
        "The TakeOwnerShip method obtains ownership of the logical file specified in the object path . If the logical file is actually a directory, then TakeOwnerShip will act recursively, taking ownership of all the files and sub-directories the directory contain",
        "{5ec10359-a61a-11d0-8dd4-00c04fc3358c}",
        "ref:Win32_Printer",
        "CIM_Job is a logical element representing a unit of work for a system, such as a print job. A job is distinct from a process in that a job can be scheduled.",
        "MIF.DMTF|Volume Set|001.4",
        "\"Not Available\" indicates that the implementation (provider) is capable of returning a value for this property, but not ever for this particular piece of hardware/software or the property is intentionally not used because it adds no meaningful information (as in the case of a property that is intended to add additional info to another property). ",
        "Need Reallocation",
        "An access point for the clustering service.",
        "WmiIPv4AH",
        "MEM_PLATFORM_OEM_DATA_STRUCT is valid",
        "MSDATL3.1 formatted output (W)",
        "Deployment Last Modify Time",
        "Specifies whether LPR byte counting is enabled for this port when configured for the LPR protocol.",
        "Modem Ring",
        " Where Tag = '#'",
        "ProfileAssociationProviderCimV2",
        "0x00000001 ",
        "{65bfb548-d00a-4d4c-a357-7daa23bc2e3d}",
        "CD_D7860DB1594CB37DCB237A6AE7D8C1717E5D55CF386BCF7514E74D4C578E100D.1836.725535529.306",
        "ModerationByIntervalSupported",
        "In diagnostics mode",
        "ctory path for applications that install MOF files to the CIM repository. WMI automatically compiles any MOF files placed in this directory and, depending on its success, moves the MOF to a subdirectory labeled \"good\" or \"bad\". If the \"autorecover\" pragma is included, the fully qualified file name is added to the AutorecoverMofs list used when WMI is initializing or recovering the repository. The list determines the order in which MOFs are compiled.",
        "{f5905497-65ad-4f5a-997c-7fcc359c896f}",
        "Values: TRUE or FALSE. A value of TRUE indicates the protocol supports multicasting.",
        "The Lockout property determines whether the user account is locked out of the Win32 system.",
        "A fully qualified path to the Windows Installer advertisement script.",
        "JIS B9",
        "RSOP_SecuritySettingStringBlocked",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2426.1493845832.368",
        "cdbLength",
        "TRUE if the adapter caches are valid",
        "SetNodeAddress",
        "GuidList",
        "Stepping is a free-form string indicating the revision level of the processor within the processor family.",
        "C_14EA8D1B614BC6D260E31F428D1651D98B6F7F8F49C7964016B24597B70B73AE",
        "InterleaveMin",
        "{acf1403e-a61c-11d0-8dd4-00c04fc3358c}",
        "UpdateHostStorageCache",
        "HOSTPROC_RESERVED_17",
        "The Element reference represents the computer system using the boot configuration.",
        "NDIS 802.11 Transmit power level",
        "CIM_AssociatedProcessorMemory",
        "ExtendedStatus allows the storage provider to return extended (implementation specific) error information.",
        "Predismount Eject Not Required",
        "MS_SM_FabricAndDomainManagementMethods",
        "InternetZoneAllowScriptInitiatedWindows",
        "A multi-state sensor is a multi-member set of binary sensors, each binary sensor reporting a boolean result.",
        "VpnTrigger",
        "Number of Idle States",
        "CR_7C256082C028FC113E44225862F56FE496A6FB4D4EE2AD50DD39EB6DF6A574DF",
        "SampleProf",
        "SetNetworkAdapterLanaID",
        "InstanceIdentifier",
        "object:__SecurityDescriptor",
        "Win32ClockProvider",
        "SamUserCreate_Start",
        "SupportedOperations",
        "This property provides an identification string associated with a PCI device.",
        "dwProvCharSize",
        "The PMTUDiscoveryEnabled parameter can enable TCP to attempt to discover the Maximum Transmission Unit (MTU) or largest packet size over the path to a remote host. If TRUE, the method makes TCP to attempt to discover the MTU.",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\LanmanWorkstation\\NetworkProvider|Mfg",
        "Supplies the TCP destination port number of the SYN packet.",
        "PreventTurningOffRequiredExtensions",
        "Return To ResourcePool",
        "(/m;(/m;",
        "OwnerPassPhrase",
        "Subtype",
        "Deferred procedure calls",
        "C_A50F2C71334A2A338CC6F1C013DEEB31B3684F92B727656C378E98BCCF3ADD1F",
        "Locked",
        "CD_8BB282EC877EF750BA67E21AEFC765F0958A7E18EB5158F15A448065A4876EFB.283.2496562711.765",
        "Win32API|Communication Structures|DCB",
        "Finds the best local IP address and best route to reach the specified remote address.",
        "Example: 64",
        "Files Opened Total",
        "Disk Drive Admin",
        "Where Index=#",
        "Adaptive Clone Remote",
        "{8c50fa6e-394e-4b47-b6d1-a880a5f225a2}",
        "ectProv",
        "For a console process, specifies the height of the window in characters",
        "BlockAccess",
        "Whether the path cache is updated in response to ICMP redirect packets.",
        "The BorderWidth property sets the width of the borders around all windows with adjustable borders.",
        "InternetConnections",
        "RDComplete_V1",
        "SetKTimer2",
        "Encryption Types",
        "#define HBA_EVENT_PORT_STAT_THRESHOLD   0x301",
        "MSNdis_LinkParameters",
        "CIM_Realizes",
        "NeighborDiscovery",
        "Indicates if NVGRE Encapsulated Packet Task Offloads are currently enabled for this Adapter",
        "Stage Hint",
        "Number of ports",
        "CIM_CollectedMSEs is a generic association used to establish the members of the grouping object, CollectionOfMSEs.",
        "HttpsHelpPageEnabled",
        "CtlGuid",
        "TwoSidedLongEdge",
        "SDBUS_DEBUG_WORKENG2",
        "If TRUE the server supports file share creation.",
        "SRB Extension Pointer",
        "The SetID uniquely identifies the shadow copy set to which the shadow copy belongs.",
        "CD_E8DCB251351DCD2ACA88B24D719FF7EAAFED25D4F7644A276B6EAA9D145ECB88.1564.2472948608.545",
        "Indicates whether this link is enforced down the SOM hierarchy",
        "The DaylightDay property specifies the day of the DaylightMonth when the transition from standard time to daylight savings time occurs on this operating system.",
        "UInt16",
        "Third Party VPN Profile",
        "CD_0427B3D7710F368D831E2478F76F011E2ADE4882C334EE5ECDBD3047B1FDDE39.12.593978504.1053",
        "ResponderCookie",
        "ISCSI_ERR_INVALID_KEY_DURING_CHAP",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_F5E021D5620DF76DB11A714354730BFDB3845D5ACC1D57EAF3889D51C85AA6FB5200",
        "PrinterStatus",
        "ref:CIM_FileSystem",
        "AMServiceEnabled",
        "The service hosted on the system.",
        "Is Blocked",
        "Indicates whether the operation should be applied to the current user (FALSE) or all users on the machine (TRUE).",
        "MGR_TRACE_LPC Flag",
        "SMBIOS|Type 18|32-bit Memory Error Information|Error Type",
        "MSFT_OffloadDataTransferSetting",
        "OtherHashAlgorithm",
        "{7924BBA8-1913-4B0E-8E6F-6F45CE499731}",
        "See CIM_ComputerSystem.RequestedStateChange.RequestedState for details.",
        "// This class must be registered using PDO instance names with a single instance.",
        "Win32API|Network Management Structures|SHARE_INFO_502|shi502_passwd",
        "SAM Create Alias In Domain",
        "MIF.DMTF|Power Supply|004.11",
        "FeedbackHubAlwaysSaveDiagnosticsLocally",
        "MDM_Reporting_SecurityAuditing01_RetrieveByTimeRange02",
        "AMLIEvalData1",
        "MSNdis_ReceiveFilterFieldParameters",
        "{25059476-899f-11d2-819e-0000f875a064}",
        "// The number of entries in the IKE receive buffers for incoming IKE messages.",
        "EDO RAM",
        "ExportPackage",
        "AddLicenseMethod",
        "object:MSFT_OdbcDriver",
        "RequiredPrivilege",
        "Describes the workflow application policy for connections made to this printer.",
        "DA Settings change notification",
        "Number of Bytes successfully sent",
        "The physical element which should be replaced with other elements, as a set.",
        "CD_02E226BBCB88A35C58DB3E55C3D201306E2FAABE9C83D64654DC4E16660DF61A.214.1607399945.897",
        "RamdiskDevice",
        "MaxDepth",
        "ErrorControl",
        "I_C2E2D7F294A39E950FCB0FE91EB41D6C66630273B2EF4990C97F60DB582F2E17.1480.707803988.317",
        "   ISCSI_MUTUAL_CHAP_AUTH_TYPE = 2 ",
        "Layout",
        "LogFlagRefCount",
        "Hardware address of the responder to the transaction",
        "Example: 19521201000230.000000000",
        "SupportsCompletionQueueInterruptModeration",
        "The SupportContactDescription property is an array that indicates the support contact information for the Win32 computer system.",
        "SourceRoutingBehavior",
        "TenantID",
        "GetByPath",
        "{FAF76B78-798C-11D2-AAD1-006008C78BC7}",
        "{9565979B-7D80-11D2-AAD3-006008C78BC7}",
        "The MoveFiles action allows the author to locate files that already exist on the user's machine, and move or copy those files to a new location.",
        "4 = removed by user, ",
        "MulticastReceivedFrameCount",
        "Use the same user credentials for TS Gateway and TS Server when possible",
        "The SMBIOSMinorVersion property contains the minor SMBIOS Version number. This property will be NULL if SMBIOS not found.",
        "LogErr",
        "For example, using a '*' delimiter, RecordFormat = \"*string ThisDay*uint32 ThisYear*datetime SomeTime\" ",
        "FuncCall",
        "\\\\.\\root\\Hardware:__Win32Provider.Name=\"IPMIPrv\"",
        "C_AA08179966355DA227023310A55A3E7595BBA6EE2C2F2E7F371415F2AF045A6F",
        "MemberOfTheTeam",
        "DeleteEx",
        "FILE_WRITE_ATTRIBUTES",
        "Activation type used for the last successful VL client activation.",
        "Vendor assigned product code ID",
        "SAM Change Password Computer",
        "Operation not supported on a critical disk.",
        "// This class exposes request processing time statistics",
        "Multiple target ports per view",
        "The device to which the error counters apply. ",
        "BcdUnknownElement",
        "MSFT_SmbSession",
        "Documents",
        "MDM_Policy_Config01_Search02",
        "Win32Registry|Software\\Microsoft\\WBEM\\CIMOM|High Threshold On Client Objects",
        "The self-test routine was interrupted by the host with a hardware or software reset",
        "PNPDeviceID",
        "T!m;T!m;",
        "ISCSI_ERR_INVALID_CHAP_ALGORITHM",
        "The Add-VpnConnectionTriggerApplication adds applications, which when launched will auto-trigger the VPN connection",
        "HOSTPROC_RESERVED_1d",
        "Asynchronous Mirror Local",
        "Values: TRUE or FALSE.  If TRUE, Network Server Mode is enabled.",
        "NDIS FDDI Ring Management State",
        "The RSOP_PolicySettingBlocked class is the abstract parent object from which client-side extensions' policy objects are inherited",
        "TokenActivationILID",
        "Indicates whether the contract requires the binding associated with this contract to use channel sessions.",
        "ISDN D Channel Endpoint",
        "Context2",
        "IO Flag",
        "The YCountChars property, used for processes creating a console window, specifies the screen buffer height in character rows.  These values are ignored in GUI processes.  Note, XCountChars and YCountChars cannot be specified independently.",
        "Example: 31",
        "The UseSurrogate property specifies whether the DCOM application can be activated as an out-of-processserver by use of a surrogate executable.",
        "ref:CIM_Process",
        "{691a00ec-4e8e-4993-879e-960011a46cef}",
        "ProcessingPostcommit",
        "Traffic exemptions",
        "{220b1188-a358-4be7-aa64-13f8033eb07a}",
        "R_EAB06445AE40CB0AB3321BBA04962C98586E49396B67AFD5B74F4985163D9EC2",
        "DYNPROPS",
        "The service associated with the endpoint.",
        "Write Failure",
        "Maximum Datagram size supported by the transport in bytes",
        "CD_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC.2371.407012226.3202",
        "InstallMode",
        "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v3\" manifestVersion=\"1.0\" copyright=\"Copyright (c) Microsoft Corporation. All Rights Reserved.\">",
        "deviceName",
        "The SupportedPlatform property indicates the operating environments that the driver is intended for.  Examples are 'Windows NT x86' or 'Windows IA64'.",
        "FILE_WRITE_EA",
        "object:Win32_LUIDandAttributes",
        "55000",
        "The scoping process' Handle.",
        "The SidLength property indicates the length of the SID in bytes",
        "RELEASE_FOR_SECTION_SYNCHRONIZATION",
        "MIF.DMTF|System Cache|003.2",
        "Home Basic N Edition",
        "This method allows a user to update or set various defaults on the storage subsystem. Note that not all parameters must be specified, and only those given will be updated.",
        "TxrGUID",
        "EstimatedLinkSpeed",
        "0xD00E - 'Spot Fix Needed': In Windows-based storage subsystems, this indicates limited repair is needed.",
        "WINNT",
        "The Msft_WmiProvider_InitializationOperationFailureEvent event ",
        "MaxVoltage",
        "GetAllErrorSourcesRtn",
        "CD_FCB8F5186AFCE657559BD1E3B7945F03AFA3222D1F02A94B0C21BFF34C6501B2.31.1850576567.494",
        "The Win32_LogicalProgramGroupDirectory class represents an association between logical program groups (groupings in the start menu) and the file directories in which they are stored.",
        "A power setting subgroup.",
        "object:MSFT_NetPrefixPolicy",
        "PreferredDNSServer",
        "ObjectType",
        "CD_956218CB3B130B9E0F4C99989C08F085EB3D3D40CE439ED3E9C6DD8BE7E440E8.1.3632825112.161",
        "Create the Neighbor.",
        "The interrupt moderation for the VPort.",
        "ReadErrorsCorrected",
        "MGR_TRACE_RESERVED_12",
        "DOT11_NOTIFY_OBJECT Flag",
        "CD_F7420DA6533A2C562AF06F1F87B007C0FB6BFFD5F71653722CBFC32EEC340ED0.1794.2104170577.523",
        "{DACA056E-216A-4FD1-84A6-C306A017ECEC}",
        "FX_TRACE_DDI Flag",
        "The CreateKey method creates a subkey in the specified tree. ",
        "NwfDrvCtlGuid",
        "Returns the contents of the Icon in the filepath using the icon index",
        "HBA_EVENT_PORT_FABRIC",
        "\\\\.\\root\\RSOP:__Win32Provider.Name=\"Rsop Logging Mode Provider\"",
        "RequireSecureRPCCommunication",
        "SMBIOS|Type 24|Hardware Security Settings|KeyboardPasswordStatus",
        "snoop probe",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1164.2705033010.180",
        "EnableDisableFailurePredictionPolling",
        "Ignore Language",
        "This is the GP container path as retrieved from the DS.",
        "Win32_IP4RouteTableEvent",
        "Manufacturer string from version resource if one is present.",
        "MsftWriteEngine2",
        "The receive antenna number",
        "48000",
        "ColorBitDepth",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_0FE84CB7228184819434E73184A33B5694CEFAED93B282C50B930127F187504C",
        "Last time this SoftwareFeature was used.",
        "1000Base-SX",
        "UUUUUUUUUUUUUUU",
        "{e18641aa-009f-4e43-a076-72282381747b}",
        "%systemroot%\\system32\\wbem",
        "#define ISCSI_LOGIN_OPTIONS_AUTH_TYPE                   0x00000080",
        "AntivirusSignatureAge",
        "ref:RSOP_PolicySetting",
        "The Parameters property specifies optional parameters for the print processor.",
        "Joining",
        "UserCertificate",
        "CIM_OperatingSystem.FreePhysicalMemory",
        "EnhancedKeyUsages",
        "WHERE DeviceID='#'",
        "RunDayOfWeek",
        "Size of write cache on the virtual disk",
        "0XD026",
        "ref:Win32_OfflineFilesCache",
        "Basic",
        "MIF.DMTF|Power Supply|004.20",
        "Privilege not held",
        "Consistency enabled for all groups",
        "V.42bis",
        "ExcludedFileTypes",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardDate|wSecond",
        "GetMessages",
        "Indicates the provisioning scheme to use when creating new virtual disks on this storage pool. ",
        "Win32API|Communication Structures|COMMPROP|dwSettableParams|SP_RLSD",
        "R_DC39EB125CD5896A582C9CCFCFEF5267AF9611EEF285D00CC4FF5DF7F8AE6FFC",
        "This association relates an MSI element with any condition or locational information that a feature may require.",
        "{805CAF4E-336C-4eb2-8C0C-02F351CBF13C}",
        "DurableOperationAttribute",
        "DataQueueSize",
        "Read Operation Count",
        "Send the configuration document to the managed node and test it against the current configuration.",
        "CD_16275E16EEED6E74BD48AA48ACA3AF381CEAB3C980CF5112BF5B3053B0589A21.38.2237218042.311",
        "43011",
        "The SupportsXOnXOff property indicates whether XON/XOFF flow control is supported on this serial port.",
        "2.8.0",
        "NdisCurrentLookahead",
        "EncryptionLevel",
        "Heap Range Rundown Event",
        "ErrorAddress",
        "MS_SMHBA_PORTLUN",
        "Get the schema used by the current settings location template.",
        "IdleTransitions",
        "{1528D111-708A-4ca4-9215-C05771161CDA}",
        "MIF.DMTF|System Resource DMA Info|001.8",
        "0xC000000F",
        "The mode parameter allows the user to modify Global Pool settings for background tasks on the system.  The available settings are Normal and Conservative.",
        "CRC Error",
        "The network adapter is in a low power state.",
        "Specifies one or more ODBC DSNs to remove. You can use wildcard characters.",
        "The Sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If the CurrentReading is between LowerThresholdCritical and Lower ThresholdFatal, then the CurrentState is Critical.",
        "RSOP_SecuritySettings",
        "TRACE_INFORMATION",
        "Filters traffic based on its protocol and port.",
        "CIM_ConfigurationData.ConfigurationInformation",
        "NETIO_TRACE_RECEIVE",
        "Logging - Not Supported",
        "CIM_PrintJob.NumberUp",
        "MIB.IETF|HOST-RESOURCES-MIB.hrFSAccess",
        "Win32_NTLogEvent",
        "The antenna selected for receiving on the radio of the 802.11 device",
        "Orientation",
        "No dithering. 2",
        "SystemVolume",
        "|\"m;|\"m;",
        "WorkOfflineButtonRemoved",
        "Performance Flag",
        "C_09A5E19B62E24065CFCA8EE94EA9E5C149E6CB498581E688EF627C4525368332",
        "ThirdPartyVpnConnection consists of the following fields: ",
        "PortableDeviceTypes_Values",
        "Optional. String that specifies the localization code. If you want to use the current locale, leave it blank. If not blank, this parameter must be a string that indicates the desired locale in which information should be retrieved. For Microsoft locale identifiers, the format of the string is 'MS_xxxx', where xxxx is a string in hexadecimal form that indicates the LCID. For example, American English would appear as 'MS_409'",
        "ProcessorAcpiTssState",
        "dialUpCredentials",
        "PageFaults",
        "LoadUnloadCycleCountMax",
        "MSFT_NetLbfoTeam_Provider",
        "ReconnectIPV6",
        "This field denotes the level (or depth) of discovery that should be performed. This parameter can only be specified if the root object is a storage provider, storage subsystem, or NULL. When specified, the storage provider will discover objects starting from Level 0 and continuing until the specified level is reached. Associations between objects (within the discovered levels) will also be discovered. The discovery levels are defined as follows: ",
        "MaskingOtherValidInitiatorIdTypes",
        "Example: DesktopMonitor1",
        "Win32API|Device Input and Output Functions|DeviceIoControl",
        "AllocSize",
        "LastDownloadTime",
        "PropertyName is an enumeration of the properties: 0 = SessionDirectoryLocation and 1 = SessionDirectoryClusterNamewhich are flags that are either set to False or True according as whether Value is set to 0 or 1 respectively. The call returns 0 for success and an error if the policy was set to Group policy.",
        "Example: Model 2, Stepping 12.",
        "Categories",
        "IPv4SubMssFinalSegmentSupported",
        "The InstallationDirectory property contains the directory path where the WMI software has been installed. The default location is: \\system32\\wbem.",
        "CD_979D1EA059854DCEDF2345318722F29EF1D55F537C02E38427A8558140AFFFB1.1365.3725216772.337",
        "R_DAF09917B9CFA8B255E2F8328EEFD54CDCBF643D68C0AC3F94A83078C17C15DB",
        "CR_F8950447585CD6743131FC688F3AC5EE4D2DE57B4CA01C83E91AB8FD7ED70E93",
        "UseSourceJournal",
        "The Name parameter passes the name of the service to install to the Create method. The maximum string length is 256 characters. The service control manager database preserves the case of the characters, but service name comparisons are always case insensitive. Forward-slashes (/) and double back-slashes (\\) are invalid service name characters.",
        "MaxInlineDataSize",
        "CD_B4ED6CD6BB039C8A40404514D33A068C19B058FAE7508C9C445CEEFE558E436D.2066.3702445882.639",
        "0xC0000009",
        "Delay",
        "Line art dithering; a special dithering ",
        "The verb for the command.",
        "{8502C565-5FBB-11D2-AAC1-006008C78BC7}",
        "IPv4Supported",
        "CIM_NumericSensor.LowerThresholdFatal",
        "An error occurred while processing an Instance that was returned",
        "The MaxNumberControlled property indicates the maximum number of directly addressable ports supported by this network adapter. A value of zero should be used if the number is unknown.",
        "// This class uses PDO instance names with 1 instance for each physical",
        "Cluster to which this Terminal server belongs. Typically, it is a DNS entry which represents the Virtual IP address of computers.",
        "ROOT\\CIMV2\\Security\\MicrosoftTpm",
        "The ErrorDataOrder property indicates the ordering for data stored in the ErrorData property. This property is used only when ErrorTransferSize is 0.",
        "Number of bytes received at layer 2 for all inbound RDMA traffic",
        "TRC_FATAL Flag",
        "{1507db16-2053-11d4-97eb-00c04f79c403}",
        "FX_TRACE_INIT",
        "Identifies the event. This is specific to the source that generated the event log entry, and is used, together with SourceName, to uniquely identify an NT event type.",
        "C_5FEC17D2A692E21EEC8DB94637D5BF52B054EFD1DC032078BF1B5DD5BA812C6F",
        "{abb14b68-899b-11d2-819e-0000f875a064}",
        "Sets properties via an MSFT_PrinterProperty object",
        "Disables the Encapsulation Offload properties on the network adapter.",
        "The location of the object that triggered the fault",
        "Temperature at thermal zone in tenths of degrees Kelvin",
        "Previous Value Length",
        "ChannelType",
        "You must specify the enclosure awareness (either the IsEnclosureAware or EnclosureAwareDefault parameter) or the fault domain awareness (either the FaultDomainAwareness or FaultDomainAwarenessDefault parameter), but not both.",
        "Denotes the I/O bus type used by this disk.",
        "Critical error: Media life expired.",
        "Settable Flow Control",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1104.1598114626.211",
        "R_191877833EBB16E938034A3506BE0709B7FE03ACAA65FB61B2F3088D1DCE72BF",
        "volumemount",
        "DskQuotaProvider",
        "Stopping",
        "PBlkLen",
        "SEL_RECORD_ID is valid",
        "Present",
        "I_0B80258DB20F78C812419F350CB492491FD1F51CFDE794F94FBCCC1B7768782E.2709.293911390.295",
        "RGB color display",
        "Encrypted Test Password Allowed",
        "Names of the hosted cache servers to use.",
        "Device Object",
        "{3fbeb6fc-0fe2-43fd-b2ad-bd99b5f93e13}",
        "Win32API|Communication Structures|COMMPROP|dwSettableParams|SP_BAUD",
        "The internal identifier for this compilation of this software element.",
        "NS_E1578D36E8972985C3607CB2490418C572C190C71151F301302674342C5C885D",
        "The HighThresholdOnClientObjects property specifies the maximum rate provider created objects can be delivered to clients. To accommodate speed differentials between providers and clients, WMI holds objects in queues before delivering them to consumers. WMI slows down the addition of new objects into the queue when the low threshold is reached. If this does not help, and high threshold (specified by this property) is reached, WMI will accept no more objects from providers and return WBEM_E_OUT_OF_MEMORY to the clients.",
        " 0x00000002 ",
        "True - files on this volume will be scrubbed. ",
        "Idle States",
        "Firewall",
        "This method adds one or more target ports to the masking set.",
        "Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|OtherTransferCount",
        "SDBUS_DEBUG_POWER",
        "The earliest time at which the printer will print a job, expressed as minutes elapsed since 12:00 AM GMT (Greenwich Mean Time).",
        "Type A",
        "Frequency range descriptor",
        "\"E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1163.866272930.368",
        "Association between StorageSubSystem and Volume",
        "This method converts a binary blob security descriptor formatto a SDDL string security descriptor format.",
        "Average Fragments Per File",
        "The CommandFile property specifies the name of a command file to execute immediately before shutting down.",
        "Buttons",
        "I_DC022C56ADDC30CC3E115551AF0C2E3A0D951D2FE3A0143EA391171B0F62E529.946.1.67353",
        "The Win32_TCPIPPrinterPort class represents a TCP//IP service access point. For example a TCP/IP printer port.",
        "MSFT_ResiliencySetting.NumberOfColumnsDefault",
        "CD_B4204F4CD845FAF261673483B3D9C407E18AF7773A24D7B43C66C3052F5D6AAB.1219.1384606852.295",
        "The process.",
        "{791ad193-e35c-11d0-9692-00c04fc3358c}",
        "The Caption property is a short textual description (one-line string) of the object.",
        "0 - Apartment ",
        "LCMStateDetail",
        "Hardware address of intended target of transaction",
        "Type of operation corresponding to the event",
        "80287",
        "RequestedState",
        "CD_00637C6FCCC93CC75F9D988B459EA167A80BFD4782DA6DB5BC1F63F5A3F73F9B.2229.3822629263.174",
        "The local file system.",
        "URIMatchCondition",
        "NdisEncapsulationIeee802_3",
        "Win32API|Communication Structures|DCB|fTXContinueOnXoff",
        "SyncMode",
        "Target Node Name",
        "FileSystemSize",
        "Performance counter value (high resolution)",
        "The product.",
        "AllowMaximum",
        "Not Applicable",
        "IL_2381C996A59A0D1EB6DDD79E1C697FECC05884247B858E341AE1AAFDFB086D7B.1197.2250181767.316",
        "IL_FDC07BF412EF517BF16CBEA0AD032C8FE94CB2DD73B9CD909C08659DB8C5BC0A.1336.2924169968.467",
        "{791ad195-e35c-11d0-9692-00c04fc3358c}",
        "DHGroup (uint32)",
        "ExtendedProtectionPolicy",
        "Contains information for the HKCR (this CLSID) key.  If multiple patterns exist, they must be delimited by a semicolon, and numeric subkeys are generated: 0, 1, 2.",
        "Round Robin",
        "LetAppsAccessPhone",
        "DOT11_SEND",
        "A free-form string representing the positioning of the PhysicalElement within the PhysicalPackage. Information relative to stationary elements in the Container (for example, 'second drive bay from the top'), angles, altitudes and other data may be recorded in this property. This string could supplement or be used in place of instantiating the CIM_Location object.",
        "Stop Pending",
        "Specifies the new location on disk for this this cache file.",
        "The PortSubClass property contains the string definingthe port used for this modem.",
        "RD_TRACE_DRIVER Flag",
        "UtJ`;",
        "SetInfoTrustedDom_End",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_CA7CE6FFAF43B56926F209A331362CC194ADC07878E9BCCA1137E8869300AA67c311",
        "CIM_SoftwareElement.TargetOperatingSystem",
        "NumberOfColors",
        "Specifies the allocation unit size to use when formatting the volume.",
        "AllowFontSmoothing",
        "Value for the command arguments.",
        "// The total number of successful SAs created during main mode negotiations.",
        "ParentProcessID",
        "PublicV6Address",
        "f80464e3}",
        "IPv6 Addresses",
        "MinLifetimeSeconds prevents certain denial of service attacks where the peer requests an arbitrarily low lifetime value, causing renegotiations with expensive Diffie-Hellman operations. The property specifies the minimum lifetime, in seconds, that will be accepted from the peer. A value of zero (the default) indicates that there is no minimum value. A non-zero value specifies the minimum seconds lifetime.",
        "Enumeration Flag",
        "November",
        "MSNdis_WmiTcpLargeSendOffloadV2",
        "The logical height of the display in screen coordinates.",
        "iScsiFlagPnP",
        "tm_year",
        "Msft_WmiProvider_LoadOperationEvent",
        "MDM_Win32CompatibilityAppraiser_UniversalTelemetryClient01",
        "An indicator as to whether this object is insertable or not.",
        "WakeDropKernel",
        "CD_8B3C017D4428136AA9032BCF9FC656670ACA0B318BBA4C22D2ED590B175FAAB4.1189.3798786043.597",
        "Indicates whether or not the storage pool is used in a clustered environment.",
        "DS0 Bundle",
        "BytesFromCacheServer",
        "ASPScriptDefaultNamespace",
        "NDIS Token Ring Current Functional Address",
        "SCSI Fibre Channel BNC",
        "A physical component can be hot swapped if it is possible to replace the element with a physically different but equivalent one while the containing package has power applied to it (i.e., is 'on').  For example, a fan component may be designed to be hot swapped. All components that can be hot swapped are inherently removable and replaceable .",
        "PRODUCT_EXPIRED",
        "IMAPI2 Standard Data Writer",
        "15 - 'Dormant': The disk is reachable, but it is inactive.",
        "R_F7A86A3787E9C97DEDE790732FDCD3FB5583FC6332B8554299CB95F1CCD6648D.1020.3267929144.520",
        "The installed state of the software feature.",
        "Delete Existing Favorites",
        "The physical package whose environment is monitored.",
        "The product ID.",
        "The ECC property specifies whether the device supports hardware error correction.",
        "WakeEventKernel",
        "Gets only WDAC BidTrace settings that are associated with 'all applications'.",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_F5E021D5620DF76DB11A714354730BFDB3845D5ACC1D57EAF3889D51C85AA6FBb952E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "InitiatorNodeName",
        "The Copies property indicates the number of copies to be printed. The printer driver must support printing multi-page copies.",
        "Current link speed encoded, valid only for PCI-E devices.",
        "object:Win32_OfflineFilesBackgroundSync",
        "NS_390EB45D32F689282408ADA520CE6393A41EC4618EE204AA0FBC32CF2D7469E3\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_8ECEB18F5D5956ADBB92C60B6BBF657386F0BE596CEC9435AABD185EAE1B6B42",
        "PolicySourceAllowTSConnections",
        "Maximum File Name Length",
        "IPv4OptionsEnabled",
        "Credentials under which the resource runs. ",
        "Normal",
        "The ModemInfPath property indicates the path to this modem's .inf file. This file contains initialization information for the modem and its driver.",
        "%DependedOnService%",
        "WindowLength",
        "C_5991C657AC0F9E2512F72FDD17A5173C60A75B8E36E129493637EEFC667B2A38",
        "\\\\.\\Root\\WMI:__Win32Provider.Name=\"MSiSCSIInitiatorProvider\"",
        "Number of seconds that the script is allowed to run, if zero script will not be terminated.",
        "{46bdcf4a-e076-4550-82b2-9f32eded3e7f}",
        "ProxyCredential",
        "Generate Unit Attention",
        "Values: TRUE or FALSE. A value of  TRUE indicates the data bits can be set.",
        "MDM_SecurityStatusUser",
        "Specifies whether to process multiple messages concurrently at the dispatcher layer.",
        "This column is a list of names of services or load ordering groups that the system must start before this service. Names in the list are separated by Nulls. If the service has no dependencies, then Null or an empty string is returned. Dependency on a group means that this service can run if at least one member of the group is running after an attempt to start all members of the group.",
        "LogRecords",
        "A0W7x",
        "14 - CIM_ERR_QUERY_LANGUAGE_NOT_SUPPORTED. The query language is not recognized or supported. ",
        "HbaApiVersion",
        "Sources",
        "msieee80211Data",
        "ref:MSFT_NetAdapterRdmaSettingData",
        "Win32_SoftwareFeatureCheck",
        "StorageSetting",
        "PolicySourceEncodeImageQuality",
        "InPolicyFilesCount",
        "Initiator-Only",
        "NS_FE3EA006C3292950A76C2B5A0185D7DF99ADD6FD6502E0AC079E3A8650E76E3A\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_3985A64DD548C159337A855FB2D96B222C50720949C8FDEAE049F7ADFD2826A5",
        "{6CDD7B40-369D-4725-AB7F-EFE53EE2C455}",
        "C_7F6515E2EBD9049AE896B25B99B1906533354EA0DB3289C03EFADA9D23B196C7",
        "The SetMTU method is used to set the default Maximum Transmission Unit (MTU) for a network interface. ",
        "LanguageId",
        "Specifies whether to allow Remote Desktop Connection clients to automatically reconnect to sessions on an RD Session Host server if their network link is temporarily lost: (0) automatic reconnection of clients is prohibited, (1) automatic reconnection is attempted for all clients running Remote Desktop Connection whenever their network connection is lost.",
        "WindowsServer2016",
        "Multicast",
        "The Location property indicates the physical location of the cache memory.",
        "Number of stability metric records in the database",
        "Log Sectors",
        "Pressure",
        "LifetimeSeconds",
        "Gateway",
        "DownloadManagerCustomData",
        "CIM_PrintService.Capabilities",
        "SpeakerVolumeLow",
        "The Dependent reference represents the properties of the data file assigned to the logical device.",
        "IPMIPrv",
        "This parameter indicates whether the volume should be dismounted to a no-automount (offline) state. The volume may be returned to the automount state by explicitly calling the Mount method or creating a mount point for the volume.",
        "IPSecPermitIPProtocols",
        "Win32API|Process and Thread Structures|SYSTEM_PROCESS_INFORMATION|OtherOperationCount",
        "- device components such as disk drives, controllers, processors, and printers ",
        "EISA Support",
        "makeAvailableOffline",
        "The setting applied for this TCP connection. The value can be: - Internet,  - Datacenter,   - Compat,   - InternetCustom,   - DatacenterCustom",
        "Service Already Paused",
        "Serial Port",
        "See CIM_SoftwareInstallationService.InstallFromURI.URI for details.",
        "IL_59543DA79A0A83C48BB9222B5916E17BBA9A5688C362D35DD3F13589A2596294.1164.4075838192.328",
        "The Derivation string represents the name of the method the verb is based on or the name of a standard verb (for example the standard verb 'CALL').",
        "MIF.DMTF|Temperature Probe|002.17",
        "CR_16D6E45D9DC3C2448BBB5DF12E5A17B75BBAD53607DFAC1CCE27C411AB0AEA61",
        "InstalledLocation",
        "WSP_FileShareAccessControlEntry",
        "NS_390EB45D32F689282408ADA520CE6393A41EC4618EE204AA0FBC32CF2D7469E3",
        "R_094CD032BE77E24831D84EE3DE38C46FBDC0C57F2466CC9AAB2CC4B43209B790",
        "PreviousCState or OldThreadRank",
        "MSFT_CliAlias.FriendlyName=\"TimeZone\"",
        "FileStorageTier",
        "NICDescription",
        "MIB.IETF|Printer-MIB.hrPrinterDetectedErrorState",
        "NlSecChanlSetup",
        "TcpOptionsSupported",
        "MEM_CARD",
        "EnableDHCP",
        "Initial Time",
        "DiskLevelCaching",
        "Threat severity enumeration",
        "NETIO_TRACE_TUNNEL Flag",
        "This class provides EAS PIN Password Policy configuration on the device",
        "ValidateMaintenanceMode",
        "AutoConnect",
        "This class provides configuration to modify browser security zone settings on the device",
        "Path to the application",
        "LimitedUserSessions",
        "TR_WSD",
        "Auto Configuration Use Local",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"MS_Shutdown_Event_Provider\"",
        "CIM_SerialInterface is a CIM_ControlledBy relationship indicating which devices are accessed through the serial controller and the characteristics of this access.",
        "NodeWWN",
        "This class exposes attribute information associated with a fibre channel adapter. There should be one instance of this class for each adapter",
        "CD_E051E777C7E7563456908117F89B298B636645144CE61DF3136AB528CB03746A.1521.844302516.265",
        "Metric of the route being added",
        "Maximum size in MByte of log file before a new one created. Default is 100 MB.",
        "DOGroupId",
        "CR_81E71CD6BF54F730FEDC98CAF91AFC2B597F2C22AEB0626A38F278436A564F49",
        "Registry details",
        "3 = This application was deployed more recently than the higher application ",
        "CD_065EB15DF476F783A483B00F674DFF856DF35C72E87B7E414EE69BE5DF4E9372.122.2658536417.758",
        "H*m;H*m;",
        "Configures a client to listen for content discovery requests in distributed cache mode when operating on battery.",
        "NumberOfFunctionKeys",
        "NisEnabled",
        "Win32_MethodParameterClass",
        "{464FFAB6-946F-11d2-AAE2-006008C78BC7}",
        "NdisFddiUpstreamNodeLong",
        "RepairPolicy",
        "Participation",
        "CD_20B4E701C3271ED94785243972C16A9A8FA123A78EDAC768D9A7B370EC4A42D1.1999.2046402642.747",
        "Resets the licensing status of the computer to OOB Grace (see LicenseStatus). Note: you must reboot the client for the changes to take effect.",
        "{A251CCB3-5AB0-411B-8771-5430EF53A26C}",
        "The QuotasIncomplete property indicates that Quota management was used but has been disabled.  Incomplete refers to the information left in the file system  after quota management has been disabled.",
        "The PrimaryGroupId property specifies the relative ID (RID) of the Primary Global Group for this user.  The identifier verifies the primary group to which the user's profile belongs.",
        "Win32_COMApplication",
        "ATA 2-1/2 Inch (44 pins)",
        "Inbox",
        "Bid2Etw_SQLOLEDB_1_Trace_TextA",
        "Capabilities and management of memory-related logical devices.",
        "MIF.DMTF|Temperature Probe|001.7",
        "ref:RSOP_IEConnectionWinINetSettings",
        "ClearEventlog",
        "Access Bus Port",
        "The depth of the physical package in inches.",
        "Time when this CSE finished processing the last invoked.",
        "The CIM_LogicalDevice Dependent reference represents the logical device connected to the SCSI controller.",
        "Describes a BranchCache primary cache",
        "Float",
        "ParentDllBaseAddress",
        "Request Timed Out",
        "AcceptPerformanceCounterMissing",
        "Import Program Settings",
        "This class provides the ability to detect a application using min version lookup",
        "ref:CIM_Sensor",
        "MSFT_SmbClientNetworkInterface",
        "__Win32Provider",
        "#define HBA_EVENT_PORT_BROADCAST_D27_4  0x207",
        "Magazine size if one exists",
        "ref:MSFT_NetTransportFilter",
        "Unrestricted",
        "3221232496",
        "MSFT_iSCSITargetToiSCSITargetPortal",
        "The SetIPUseZeroBroadcast method is used to set IP zero broadcast usage. If this parameter is set to TRUE, then IP will use zeros-broadcasts (0.0.0.0) instead of ones-broadcasts (255.255.255.255). Most systems use ones-broadcasts, but systems derived from BSD implementations use zeros-broadcasts. Systems that use different broadcasts will not interoperate on the same network. Default: FALSE. The method returns an integer value of 0 on successful completion and any other number to indicate an error.",
        "LUAInstall: error 0x00000005 setting flags [{73bf00aa-f928-4a23-b598-cd8afb33d717}]",
        "MDM_Policy_Config01_Connectivity02",
        "Select * from Win32_QuotaSetting",
        "The identifier by which the  object is known.",
        "CurrentHopLimit",
        "The DaylightBias property specifies a bias value to be used during local time translations that occur during daylight time. This member is ignored if a value for the DaylightDay member is not supplied. The value of this member is added to the Bias member to form the bias used during daylight time. In most time zones, the value of this member is -60.",
        "WDiagCoreCtlGuid",
        "The SetShareInfo method sets the parameters of a shared resource. Only members of the Administrators or Account Operators local group or those with Communication, Print, or Server operator group membership can successfully execute SetShareInfo. The print operator can set only printer queues. The Communication operator can set only communication device queues.",
        "The types of authorization events that are recorded in the audit log. ",
        "{C5BFFE2E-9D87-D568-A09E-08FC83D0C7C2}",
        "sE083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "The behaviors associated with this service.",
        "ROOT\\subscription#",
        "TracksPerCylinder",
        "Provider can create remote target group",
        "\\\\.\\root\\subscription:__Win32Provider.Name=\"SMTPEventConsumer\"",
        "Gateway Authentication Mode",
        "The AdapterDACType property contains a string of the Digital-to-Analog converter (DAC) chip name or ID.",
        "DOMinFileSizeToCache",
        "Names of inbound interfaces",
        "Indicates the accuracy of the Sensor for the measured property. Its value is recorded as plus/minus hundredths of a percent. Accuracy, along with Resolution, is used to calculate the actual value of the measured physical property. Accuracy may vary depending on whether the Device is linear over its dynamic range.",
        "Primary classification of the error. The following values are defined: ",
        "Win32_GroupInDomain",
        "Stack6",
        "ref:Win32_SerialPort",
        "HeapSubsegmentInitialize",
        "GuidObjectType",
        "CheckMode",
        "{7FB1D98A-F895-4761-8DC2-774969C84D10}",
        "Shielded",
        "D-m;D-m;",
        "Cannot remove the drive letter of a boot or paging file partition.",
        "SamEnumAliasesInDom",
        "Volume supported by provider",
        "ParityLayout",
        "rebootNeeded",
        "ref:Win32_ShadowProvider",
        "Arbitrary Certificate Index",
        "r47C79E62C2227EDD0FF29BF44D87F2FAF9FEDF60A18D9F82597602BD95E20BD3",
        "LogOverwritePolicy",
        "SupportsGracefulClosing",
        "CIM_RemoteServiceAccessPoint.OtherAccessContext",
        "Win32API|Communication Structures|DCB|StopBits",
        "TL_INFO Flag",
        "ication.",
        "MSFT_NetAdapterLsoEncapsulationTypes",
        "SPACES_StorageDepartureEvent",
        "MSFT_NetAdapter_RscStatistics",
        "User friendly name of the VPN server",
        "Seconds",
        "MSNdis_WmiTcpIpChecksumOffload_IPv4TransmitReceive",
        "5 - Major should be used to indicate action is needed NOW. ",
        "Allow User to Choose(4)",
        "WPA-Enterprise",
        "MsftDiscFormat2Data",
        "Event",
        "The ParentProcessId property specifies the unique identifier of the process that created this process. Process identifier numbers are reused, so they only identify a process for the lifetime of that process. It is possible that the process identified by ParentProcessId has terminated, so ParentProcessId may not refer to an running process. It is also possible that ParentProcessId incorrectly refers to a process which re-used that process identifier. The CreationDate property can be used to determine whether the specified parent was created after this process was created.",
        "ClientComputerName",
        "This method updates firmware to the storage enclosure.",
        "The PasswordAge property indicates the length of time a password has been in effect.  This value is measured from the number of seconds elapsed since the password was last changed.",
        "CurrentRequiredOrProduced",
        "MIF.DMTF|Temperature Probe|001.6",
        "ConfigureKioskResetAfterIdleTimeout",
        "MaxMemoryWindowCount",
        "System Start",
        "**typedef** The name of the iSCSI data digest scheme in use within this session.",
        " The MD5 algorithm is a well-known algorithm for computing a 128-bit  checksum for any file or object. The likelihood of two different   files producing the same MD5 checksum is very small  (about 1 in 2^64), and as such, the MD5 checksum of a file can be  used to construct a reliable content identifier that is very  likely to uniquely identify the file. The reverse is also true.  If two files have the same MD5 checksum, it is very likely that  the files are identical. For purposes of MOF specification  of the MD5 property, the MD5 algorithm always generates a 32  character string. For example: The string abcdefghijklmnopqrstuvwxyz  generates the string c3fcd3d76192e4007dfb496cca67e13b. See http://www. rsa.com/pub/rfc1321.txt for details on the implementation of the MD5  algorithm.",
        "object:MSFT_NetISATAPConfiguration",
        "Select * from Win32_SystemDriver",
        "Win32API|Service Functions|CreateService",
        "CD_286D3AAA59AE00C2CF7EBCC4AB344CD2AFDCE3C2B408154E04E7644656DAE408.2067.3151996187.5824",
        "Thermal Zone Information",
        "NDIS Receive Errors",
        "0 - 'Unknown': May mean that this information is unavailable, or the storage pool uses a proprietary method of allocation.",
        "The ProviderOperation_PutInstanceAsync property indicates the number of calls to IWbemServices :: PutInstanceAsync.",
        "The SetTcpNumConnections method is used to set the maximum number of connections that TCP may have open simultaneously.The method returns an integer value that can be interpretted as follows: ",
        "ReserveFolder",
        "Number of bytes for port state status indication",
        "Indicates the software features that make up the operating system. The software features can be part of different products.",
        "Parent Process ID",
        "{AA527A40-4D9A-11d2-93AD-00805F853771}",
        "TotalPercentFragmentation",
        "Sieverts",
        "Association between StorageSubSystem and StorageNode",
        "The logical device that is a component of a system.",
        "HostingSpecification",
        "I_C28E154433EAFBBEC9AFF6B03CD94FB6D01B32C68CCEA476ACECCD0DB049A6CD.2668.2340397220.283",
        "CIM_OperatingSystem",
        "FB-DIMM",
        "CommandLineSetting",
        "RegistryKeyChangeEvent",
        "LookupNames",
        "{7BA1437A-C51C-421B-A359-2906AF2BDD9F}",
        "The last ring status indicated with an NDIS_RING_XXX status code.",
        "MSFT_CliAlias.FriendlyName=\"FSDir\"",
        "SidTypeDeletedAccount",
        "Completed",
        "StartInstallationMethod",
        "WriteWarning",
        "EnableAccountManager",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1104.1598114626.211",
        "DisplayOffTimeoutPluggedIn",
        "LetAppsAccessTasks",
        "Error recovery from Broken state Automatic",
        "Supplies the pattern to match against incoming packets.",
        "Standard Server Core Edition",
        "ActualPID",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1489.2481664846.180",
        "ref:Win32_PowerSupply",
        "PolicyRule.Priority is deprecated and replaced by providing the priority for a rule (and a group) in the context of the aggregating PolicySet instead of the priority being used for all aggregating PolicySet instances. Thus, the assignment of priority values is much simpler. ",
        "Create_New_Console - The new process has a new console, instead of inheriting the parent's console. This flag cannot be used with the Detached_Process flag.",
        "Win32_ODBCDriverSpecification",
        "Win32API|GetSystemMetrics|SM_CLEANBOOT",
        "Logical devices may have one or more alarm devices associated with them, in order to indicate problem situations. This relationship is indicated by the CIM_AssociatedAlarm dependency. ",
        "Storage Device Number",
        "NS_59411655A8F95EE7BEABDFB898861DFA8E2BF23293A8AFE96B2E5BB236E7FE01\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_12F9C45C633D9A35EAD4B21831269F92F066A3C04FA000604BBFDB67F87BF6AC",
        "DOCacheHostSource",
        "MSADDS.1",
        "Registry key is under the HKEY_CURRENT_USER hive,  Theoretically, if this is false, the class instance should be stored in a separate namespace than those under the current user, but the IEAK ADM file design necessitates they exist in the same namespace.",
        "ForegroundMount",
        "17 - There is no execution thread for the service.",
        "IL_82D62EACB411F46C88EF11FE5A18F1088AEDA0897AD63F2947178230B7AF5724.1780.1849282648.338",
        "C_25191DCE3358FD8B8C1714272C2D24314EFB64EE716A136F809F4CE188499657",
        "MSFT_LocalizableElement",
        "FileSystemFlagsEx",
        "The PartComponent reference represents Win32_BIOS contained in the computer system of this association.",
        "MSiSCSI_ConnectionStatistics",
        "object:MSFT_CliQualifier",
        "Boot Flags",
        "HeapCreate",
        "This parameter is used to specify an array of target objects by Id to be replicated. Consistency ordering is based on the order of objects in this array.",
        "SensorType",
        "RecordRoute",
        "This subsystem is already registered.",
        "where Caption='#'",
        "CIM_PhysicalFrame.Manufacturer",
        "SignatureFirstAuGracePeriod",
        "LocalMachineZoneAllowNETFrameworkReliantComponents",
        "IMAPI2 Disc Master",
        "Proprietary P2P Wireless",
        "NS_876145C71900245306A149A8A7DAC3FB0D74027E586B2E97BEF112C2070090FD\\KI_272E5753DC3EECDD6057038DB6F26170E7D1CD565B954C6C4A406CB1BC2D023E\\I_54275311190E6AF40C7E1ECA677C26F666E21555D2DB9537A0D6F20293E6715D",
        "ShadowStorage",
        "32796",
        "File Mark",
        "FileIo_V2",
        "Query Time",
        "VirtualAlloc",
        "MonitorName",
        "Values: TRUE or FALSE. A value of TRUE indicates 16-bit mode is supported.",
        "Internet",
        "MSFT_NetAdapterRssSettingData",
        "Invalid Session Id",
        "C_A7FECC21424DD62A9349C934969747482C567805103F48A0D0D942C0F6B52DD7",
        "Adds a Third Party VPN connection to the Connection Manager phonebook. ",
        "UpdateId",
        "AvgFreeSpaceSize",
        "Example: 255.255.0",
        "0xC005005B",
        "ftpProxyServer",
        "The specified initiator name was not found.",
        "Permanent",
        "CIM_NetworkAdapter",
        "Name of the configuration and module Download Manager.",
        "**extra fields** Authentication Username, for CHAP this is the CHAP Name (CHAP_N) use when authenticating with the target. NOTE: This field is a variable length array, the field that follows this field starts immediately after the end of this field subject to appropriate padding.",
        "ConvertToOwnerAuth",
        "{4B314A47-12E0-4d52-95FE-084B9224DD4F}",
        "DoubleSpeedThreshold",
        "{0F73ED51-8ED9-11d2-B340-00105A1F8569}",
        "{a3285184-ea99-48ed-825e-a426b11c2754}",
        "JavaVM",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB\\I_AF25D8805F3B512CE077E12B9EC07A7664A32A328B0F1BF77828BC5BA1C8AEBC",
        "The ShareName property indicates the share name of the printing device.",
        "0xC005007D",
        "CreateMaskingSet",
        "Domain Port WWN",
        "SamEnumAliasesInDom_Start",
        "Background_Green",
        "964659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41",
        "Indent",
        "6 - ia64 ",
        "cache line is modified",
        "PolicySourceSessionDirectoryActive",
        "Whether to allow Trusted Intermediaries to set the key of SA's created by this rule.",
        "DOT11_1X Flag",
        "DiscoveryLevel",
        "FireShareChangeEvent",
        "32784",
        "Sessions Logged Off",
        "WRITE_DAC (0X00040000) ",
        "MSFT_CliAlias.FriendlyName=\"NetLogin\"",
        "The LogonHours property specifies the times during the week when the user can log on. Each bit represents a unit of time specified by the UnitsPerWeek member. For instance, if the unit of time is hourly, the first bit (bit 0, word 0) is Sunday, 0:00 to 0:59; the second bit (bit 1, word 0) is Sunday, 1:00 to 1:59; and so on.  If this member is set to NULL, then there is no time restriction.  The time is set to GMT and must be adjusted for other time zones (for example, GMT minus 8 hours for PST).",
        "The ExtensionInfoAction manages the registration of extension related information with the system. The action registers the extension servers for which the corresponding feature is currently selected to be uninstalled.",
        "MinimumMemoryCapacity",
        "Provider can manage remote source group",
        "DOT11_FATMSM",
        "0xC0000002",
        "VirtualizationBasedSecurityStatus",
        "// boot from an iSCSI disk.",
        "\\\\.\\Root\\cimv2:__Win32Provider.Name=\"RegistryEventProvider\"",
        "QueryTime",
        "0$m;0$m;",
        "This class associates a power setting with a plan.",
        "Ignore",
        "RunOnLastDayOfMonth",
        "Updates",
        "The time the operation started",
        "TransitioningToState indicates the target state to which the instance is transitioning. ",
        "Buffer returns the requested Descriptor information. If the Descriptor does not exist, the contents of the Buffer are undefined.",
        "CIM_SoftwareElement.Version",
        "             profile is left alone, no user will use that profile automatically, it will not be ",
        "ref:MSFT_TargetPort",
        "SwitchFlags",
        "SecurityDescriptor",
        "MDM_Policy_Config01_System02",
        "This parameter indicates whether the volume should be forced to dismount if open handles exist.",
        "0 = \"Unknown\", meaning it is unknown as to what recovery action to take ",
        "MSNdis_80211_NetworkTypesSupported",
        "Smartcard(1)",
        "DOT11_MSM_ADAPT",
        "ifHCInUcastOctets",
        "PFS Enabled",
        "The StartTime property specifies the earliest time the printer can print a job (if the printer has been limited to print only at certain times). This value is expressed as time elapsed since 12:00 AM GMT (Greenwich mean time).",
        "NDIS Transmits OK",
        "A user-friendly string representing the name of the replication group. Friendly name can be set using the SetFriendlyName method.",
        "localPhoneNumber",
        "NDIS Set Header/Data Split Parameters",
        "0D890AC6A929040B86C73ED707F71F3BF5A8D5C24B862ABCFD812E1937C8FB0BB",
        "The TcpWindowSize property contains the maximum TCP Receive  Window size offered by the system. The Receive Window specifies the number of bytes a sender may transmit without receiving an acknowledgment. In general, larger receiving windows will improve performance over high delay and high bandwidth networks.",
        "\\\\.\\root\\microsoft\\protectionManagement:__Win32Provider.Name=\"ProtectionManagement\"",
        "Physical extents are realized on a physical media. This relationship is made explicit by the CIM_RealizesPExtent association.  In addition, the starting address of the physical extent on the physical media is specified here.",
        "MSFT_CliAlias.FriendlyName=\"SoftwareFeature\"",
        "Reads specified EDID v.1.x descriptor block",
        "LockedDownLocalMachineZoneAllowAccessToDataSources",
        "In the context of M.3100, the ability to be composed of lower-level pipes is modeled as a Trail. A Trail is made up of one or more Connections. (Note that both Trails and Connections are subclasses of Pipe). Because of the flexibility of the NetworkPipeComposition association, there is no need to subclass NetworkPipe, as was done in M.3100, but merely to instantiate the NetworkPipeComposition association to describe the bundling of the lower-level pipes (i.e., the connections), or the sequencing of them.",
        "GetOwner",
        "Indicate whether the DMA channel supports burst mode",
        "NdisCoMediaConnectStatus",
        "NDISWMI_TRACE_RDMA",
        "SetKeyManagementServiceListeningPort",
        "CD_EB74DE80A4ECAF39B636937B76E6D45F7589467EC770ADEAD91605298392EEDE.71.6847208.2074",
        "Win32API|Tool Help Structures|THREADENTRY32|th32ThreadID",
        "The provider does not support the fault domain awareness parameter.",
        "WakeEventUser",
        "Example: ^Z",
        "The PartComponent reference represents the properties of the operating system running on this computer system.",
        "46010",
        "MaxFrequency",
        "Number of bytes for dot11 association start status indication",
        "CIM_Process.OSCreationClassName",
        "ref:MSFT_ReplicationGroup",
        "R_C6A58238B2D52C6D3379638DCD2CA314F0199706EB38629389BCEB5D0D36CE14.2441.3993179634.552",
        " Creates a .ini entry only if the entry does not already exist. ",
        "ref:MSFT_Engine",
        "object:MSFT_TaskDynamicInfo",
        "VMMonitorModeExtensions",
        "The Compress method compresses the logical file (or directory) specified in the object path. Compress returns an integer value of 0 if the file was successfully compressed, and any other number to indicate an error./nIt returns one of the following integer values:/n0 - The request was successful./n2 - Access was denied./n8 - An unspecified failure occurred./n9 - The name specified was invalid./n10 - The object specified already exists./n11 - The file system is not NTFS./n12 - The platform is not Windows NT or Windows 2000./n13 - The drive is not the same./n14 - The directory is not empty./n15 - There has been a sharing violation./n16 - The start file specified was invalid./n17 - A privilege required for the operation is not held./n21 - A parameter specified is invalid./n",
        "MIF.DMTF|Video|003.5",
        "This property gets/sets the connected account policy to require",
        "MDM_Policy_Config01_BITS02",
        "ROOT\\Microsoft\\Windows\\Storage\\PT",
        "XTS_AES_256",
        "Not execute in 'count by byte' mode",
        "SessionPoolAllocation",
        "IdMethod",
        "C_878D5D30666EBFE440F941E45E7884E8AFCA7A1478E4D09AB57DC26571C8B7A6",
        "MSNdis_QueryNicSwitchHardwareCapabilities",
        "Specify PUA(Potentially Unwanted Application) protection mode.",
        "Bid2Etw_OLEDB_1_Trace_TextA",
        "StateTrace",
        "R_00637C6FCCC93CC75F9D988B459EA167A80BFD4782DA6DB5BC1F63F5A3F73F9B",
        "Reserved by Replication Services",
        "WMI|Win32_TimeZone",
        "Supplies the priority of the wake pattern.",
        "The Tag property contains a string that uniquely identifies the physical memory device represented by an instance of Win32_PhysicalMemory.",
        "MemReset Info",
        "ASPScriptEnabled",
        "NdisVendorDriverVersion",
        "Data Processed",
        "0xC0000019",
        "WMI_STORAGE_FAILURE_PREDICT_FUNCTION_GUID",
        "TRACE_CLASS_DISPATCH",
        "Threat ID - Enumeration",
        "The LocalServer property contains the full path to a 16-bit local server application.",
        "ParameterInfo",
        "Indicates the newly created cache extension should be output",
        "Properties",
        "UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU",
        "Stack24",
        "The binary data that accompanied the report of the NT event.",
        "References the computer system hosting a particular software element. ",
        "Array of Certificate EKU Filter, EKU Name for standard EKU else EKU OID.",
        "C_BA591BD8B27F441C811869BE1DF44DAE00F08BE9A7051676EA2B61A487918FB4",
        "MGR_TRACE_DEVNODE Flag",
        "Values: TRUE or FALSE, If TRUE,then the event subsystem is enabled.",
        "The Provider property indicates the Unique Name associated with the instance of __Win32Provider.",
        "Path name or other information defining the root of the file system.",
        "Win32Registry|SampleRate",
        "{E5D8A564-F6C0-11d2-B35E-00105A1F8569}",
        "Activities",
        "-Saturday",
        "RoamingStatus",
        "TotalCacheMemory",
        "required",
        "iSCSI Initiator Login Statistics",
        "CD_F013AA523FB7E1141C46835F3813ED7DA1F035235D72E00C304E0C6683ABF645.1542.3756247903.1218",
        "SupportXonXoff",
        "SupportsSynchronousConnect",
        "Memory Management Agent Component Configuration",
        "DependencyUrlLists",
        "Irq Level",
        "SMBIOS|Type 22|Manufacture Date",
        "Unique Session ID",
        "LastAccessTime",
        "PolicySourceAvc444ModePreferred indicates whether the property AVC444ModePreferredis configured by Server (0),Group Policy (1).",
        "WmiSetALSBrightnessState",
        "C_51F9DAF3CC7D989B6C98735C3A5D88F91E31E2F8AB94B8929062D8B11C53733D",
        "The Msft_WmiProvider_DeleteInstanceAsyncEvent_Post event class represents an event generated immediately following completion of the provider's implementation of IWbemServices :: DeleteInstanceAsync.",
        "NoGateway",
        "// This class must be registered with PDO instance names with one instance",
        "Restore from Replica",
        "sRGB support",
        "CD_6EB3291DAFAF5E4121A6DBB7E0E41C22E85218F8922D3C0FEDA4960BE686F47A.290.3616645377.151",
        "Select * from Msft_CliAlias",
        "MSFT_NetLbfoTeamMember",
        "Win32_WinSAT",
        "The second authentication local identity",
        "Win32API|FileFunctions|GetDriveType",
        "Has a preferred timing mode",
        "TRACE_VERBOSE Flag",
        "MSFT_AutologgerConfig",
        "EVENT Flag",
        "A request was made concerning an unsupported FC-4 protocol",
        "ADODB",
        "Microsoft.AppV.AppVClientWmi, Version=10.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
        "The Win32_Session class defines state information specific to the interaction between a user and a resource, typically a computer system or a terminal session.",
        "Online Help Page URL",
        "Activity ID",
        "The BIOS element that implements the capabilities described by BIOS feature.",
        "Bid2Etw_MSDATL3_1_Trace_TextW",
        "The frequency (in Hertz) at the high end of this powersupply's input frequency range 1. A value of zero implies DC.",
        "MSAcpi",
        "0C9BF007-50E9-407e-A9DA-0F33800E4B45",
        "MDM_EnrollmentStatusTracking_TrackedResourceTypes04",
        "State transition started",
        "0xD019",
        "CD_9DD2597311C29BD08E085D0347CF2A159A6DBD82B7A0B5D91EAAC81FF9077FEA.2623.1487065201.412",
        "CompositeSyncSupported",
        "{082dff20-f430-11d9-8cd6-0800200c9a66}",
        "The ErrorResolution property specifies the amount of data actually determined to cause the error. This property is unused when the ErrorInfo property is set to 3.",
        "MSFC_FCAdapterHBAAttributes",
        "CIM_DNSProtocolEndpoint.DNSSuffixesToAppend",
        "TEST_TRACE_RESERVED_0d",
        "DisableAutoUnlock",
        "{FAF76B8D-798C-11D2-AAD1-006008C78BC7}",
        "NonForced",
        "ProgrammedMinLinkRate",
        "SamDelMemGrp",
        "{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}",
        "{2a3cf567-a736-4138-a085-0f8f99665572}",
        "CD_443EA03A729799AF7B722609B218862C5380ED55FDD1C6840B32FD56F51FDFBA.1782.2117121293.593",
        "Default action for low severity threats.",
        "TRACINGDMA Flag",
        "Command",
        "This parameter returns a reference to the storage job used to track the long running operation. When the operation has completed, an association should exist between the storage job and the created objects.",
        "StartupTime",
        "AllowExtensions",
        "Specify the IP Address of the NetworkAdapter to set. If the IP is invalid or does not exist, the return value should indicate appropriately. The IP Address can be obtained by enumerating the properties of NICCONFIG alias.",
        "IMAPI2 Raw CD Writer",
        "RebootNodeIfNeeded",
        "MDM_ApplicationControl_TokenInfo03",
        "VlanSupported",
        "The MaximumAllowed property indicates the limit on the maximum number of users allowed to use this resource concurrently. The value is only valid if the AllowMaximum member set to FALSE ",
        "SwapSpaceSize",
        "{0a214806-e35f-11d0-9692-00c04fc3358c}",
        "Specifies the desired partition style for the disk. If no value is given, Initialize will default to 2 - 'GPT'.",
        "For a console process, specifies the width of the window in characters",
        "NDISWMI_TRACE_ADVPROP",
        "Digital Wrapper Overhead Channel",
        "DontStopOnIdleEnd",
        "ProviderOperation_ExecMethodAsync",
        "UmsScheduledPark",
        "CD_A03A0B9B0FDC488FC2A108014B7B7F05E69F51726268CB0321B939811F003F3D.2624.1613869695.353",
        "CI_CE7B495DC4F9C5B3025BD303D59CCF3C872F4A46BF11E24BFCC42869498C54B0",
        "MDL Write Complete",
        "ReplicaPeer",
        "Providers",
        "PEER Flag",
        "Specifies an array of binary data values. ",
        "The currently configured averaging interval set in the BMC.",
        "Win32Registry|.DEFAULT\\Control Panel\\Desktop|ScreenSaveActive",
        "ErrorAccess",
        "Version of the offer protocol to use when contacting this hosted cache server.",
        "callparameters",
        "The ShareName property indicates the share resource to which the connection is established",
        "CIM_LogicalIdentity is an abstract and generic association, indicating that two LogicalElements represent different aspects of the same underlying entity. This relationship conveys what could be defined with multiple inheritance. It is restricted to the 'logical' aspects of a ManagedSystemElement. In most scenarios, the Identity relationship is determined by the equivalence of Keys or some other identifying properties of the related Elements. The association should only be used in well understood scenarios. This is why the association is abstract - allowing more concrete definition and clarification in subclasses. One of the scenarios where this relationship is reasonable is to represent that a Device is both a 'bus' entity and a 'functional' entity. For example, a Device could be both a USB (bus) and a Keyboard (functional) entity.",
        "Synchronous",
        "BcdStore",
        "Fiber-optic",
        "This method allows the physical disk to be renamed.",
        "// This class exposes portal information.",
        "LUAInstall: error 0x00000005 setting flags [{941b8883-7f97-4389-9c66-49630c5ba2a9}]",
        "{DAC60DFA-C50C-11DA-82C4-000D5692A4BC}",
        "NDIS Query Port State",
        "C_7BC06DFC2CCE54A0D578DEA59EBB1A8ADB06CF1508741E02D2DCC0BB4C755E69",
        "CD_FE8C3873BDAD1853EA9CE4F9A8CC51817A3AA40D4095EE7168936C23511B49CF.18.3075561145.479",
        "Determines whether the queries expressed in Rules apply to this machine. Returns S_OK (0) if all queries expressed in rules return results; S_FALSE (1) if they do not; and an applicable WMI error code if an error occurs.",
        "The total number of successful IPSEC SA negotiations",
        "Minimum cell rate supported.",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmPelsWidth ",
        "PreAuthThrottle",
        "ZIF Socket",
        "TS_TRACE_LEVEL_NRM",
        "Sequence with respect to the media images; order must track cabinet order.",
        "TargetGroupSettings",
        "6 - 'Critical Write Failures': There were critical write failures on the disk. ",
        "The sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If the CurrentReading is between LowerThresholdNonCritical and UpperThresholdNonCritical, then the Sensor is reporting a normal value. If the CurrentReading is between UpperThresholdNonCritical and UpperThresholdCritical, then the CurrentState is NonCritical.",
        "6 - Critical should be used to indicate action is needed NOW and the scope is broad (perhaps an imminent outage to a critical resource will result). ",
        "2      Windows cannot load the driver for this device. ",
        "DirectAccessIPsecCARestriction",
        "Do All",
        "Context switches",
        "CD_4A805754DC4920C5CDF55FA12C65FB3FF31068A56F7569D69AC9CEBF6B6C724B.26.2454400919.533",
        "WSP_FsStorageArrivalEvent",
        "C_950B982CC6F803B6E071200389755F5BC713572EAEDAD6AD08F5A06B9E237444",
        "Whether temporary addresses are enabled. It takes one of the following values: - No: Don't use temporary addresses. - Yes: Use temporary addresses. - Always: Use temporary addresses and always generate a new temporary address each time a network is connected.",
        "Win32API|Service Functions|CreateService|dwDesiredAccess|SERVICE_USER_DEFINED_CONTROL",
        "Create Named Pipe",
        "The Domain property indicates the name of the  domain to which the system account belongs.",
        "An array containing the operational status of each power supply of the enclosure. ",
        "LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps",
        "Association between replicated groups",
        "Frame Error Count",
        "Current Power Consumption in milliwatts",
        "Example: ^C",
        "AllowDiskHealthModelUpdates",
        "50009",
        "The BusNum property indicates the logical number assigned to the physical bus.",
        "CIM_ServiceAccessPoint represents the ability to utilize or invoke a Service. Access points represent that a Service is made available for other entities to use.",
        "0xC000001E",
        "select * from Win32_ThreadStartTrace",
        "PCI-X Mode2 266 100MHz",
        "The Name property indicates the driver name for this printer.  This is a compound key composed of the Name, Version and SupportedPlatform values.",
        "PolicyChange_AuditPolicyChange",
        "PTConv_Trace Flag",
        "CD_4B73D65E2FE4553C66EBB3CAEECF929ED3C6295923490BCF82E45AB15E13C3B2.33.3124051792.546",
        "RecommendedActions",
        "GetByName",
        "Specifies a printer object for which to change configuration settings.",
        "SmbiosMajorVersion",
        "Communication",
        "Condition",
        "DebugPrint Event",
        "Name is a free-form string defining a label for the CIM_ReplacementSet. It is the key for the object.",
        "Pipeline Burst",
        "If true, indicates that drivers are running with Data Execution Prevention (DEP) applied. (false if DataExecutionPrevention_Available = false)",
        "SRB Flags",
        "UpgradeSettingsMandatory",
        "Insufficient storage",
        "Esp-auth-firewall",
        "Indicates whether this storage enclosure supports firmware update operation used by Windows",
        "MSFT_NetBranchCacheSettingData",
        "OwningThread",
        "TraceListenerArgument",
        "C_FE3818270093A67B72B546EA3ACF6E4265D33BD8A3B28562DCE0CFA8C720DE41",
        "SetAllowTSConnections",
        "Specifies the prefixes for the addresses for which the proxy should not be used",
        "Least Queue Depth",
        "Proxy settings object for the IE browser, used for IEAK RSoP.",
        "    ISCSI_IP_ADDRESS_TEXT = 0,",
        "object:PS_VpnConnectionProxy",
        "msiscsi_iScsi",
        "One of the following values: - Disabled: Disable window scaling heuristics. - Enabled : Enable window scaling heuristics.",
        "MDM_Policy_Result01_System02",
        "\\\\.\\root\\ServiceModel:__Win32Provider.Name=\"ServiceModel\"",
        "Probe",
        "(+.159=A{EIM",
        "LegacyName",
        "{7F598975-37E0-4a67-A992-116680F0CEDA}",
        "LPCDRVR_TRACE_RESERVED_09",
        "SessionDirectoryLocation",
        "The SNMP index for this port.",
        "cache line is invalid",
        "CurrentSensorOperationalStatus",
        "MSFT_StorageSubSystemToFileServer",
        "The NumberOfProcessors property indicates the number of processors currently available on the system. This is the number of processors whose status is \"enabled\" - versus simply the number of processors for the computer system. The former can be determined by enumerating the number of processor instances associated with the computer system object, using the Win32_ComputerSystemProcessor association.",
        "CIM_ERR_INVALID_OPERATION_TIMEOUT",
        "SubProcessTag",
        "The amount of memory in bytes that a process needs to execute efficiently, for an operating system that uses page-based memory management.",
        "IL_43E62AB0AD3F0F54666953AC95C414EE36B3A6541513F8BFD8A755EEC9A7E6E5.328.1.65559",
        "LogFileEventConsumer",
        "MSFT_NetMainModeRuleFilters",
        "Set a WEP key to the NDIS 802.11 device",
        "Extension Flag",
        "ProtectionLevel",
        "ThreadAffinity",
        "This property corresponds to CIM_PhysicalFrame.Model. See CIM_PhysicalFrame.Model for details.",
        "SyncEnabled",
        "Type of Bus transaction that caused the machine check abort",
        "The FileID of a Win32_FileSpecification that represents this fonts file.",
        "0xD00B",
        "SetArpUseEtherSNAP",
        "MSNdis_NotifyAdapterRemoval",
        "Gets or sets the interval of time before a message locked by ReceiveContext is unlocked and returned to the Queue.",
        "{BFDB09BA-5A7A-47ad-86BD-ACF6E55AA864}",
        "MIF.DMTF|System Resource DMA Info|001.9",
        "UseMaximumSize instructs the storage array to create the largest possible virtual disk given the available resources of this storage pool. This parameter cannot be used if the Size parameter is set.",
        "MSFT_NetCallToFunctionFailedII",
        "// per adapter instance.",
        "LPCDRVR_TRACE_RESERVED_19 Flag",
        "IkeV1",
        "MSiSCSIInitiator_ConnectionInformation",
        "ROOT\\Rsop\\Computer",
        "KeyPath",
        "SupportsStoragePoolCreation",
        "IR_370D362D24157E77A6D437A1B6E44D31636578C65BA57AE250B7372F533440DE",
        "IntranetZoneDoNotRunAntimalwareAgainstActiveXControls",
        "object:MSNdis_NetworkLinkSpeed",
        "VendorID specifies the value to be used in the Vendor ID payload. An empty string (the default) means that the Vendor ID payload will not be generated or accepted. A non-NULL value means that a Vendor ID payload will be generated (when acting as an initiator) or is expected (when acting as a responder).",
        "MSFT_ResiliencySetting.PhysicalDiskRedundancyMax",
        "Digital Composite",
        "OSTargetNumber",
        "SetTemplateProfileByTemplateId",
        "{725BA9B3-C1F3-4518-AF1B-C8D669191E15}",
        "15 bit",
        "LocalSystemHostOrSelfHost",
        "MSFT_ExpressionValue_boolean",
        "AccountLogon_AuditOtherAccountLogonEvents",
        "Ounces",
        "AllowAutoWindowsUpdateDownloadOverMeteredNetwork",
        "PfsGroup (uint32)",
        "{de94bba4-06d1-4d40-a16a-bfd50179d6ac}",
        "AsymmetricSecurityBindingElement",
        "SMBIOS|CSMBios|Init",
        "Grant the user exclusive rights to <folder>",
        "EnableEndSessionButton",
        "IL_EC794B3467A52CCDF1B174E691E806AC5F2BE51FBBD02FD9D19305BDFD36C8D8.1017.657475596.341",
        "InactiveThreshold",
        "C_49777012274A486E8E2DA653CCC9FE3C0BAFC8CB49FF0E373F8540A5B458A655",
        "The maximum total packet length, in bytes, the NIC supports, including the header.",
        "The SupportsIntTimeouts property indicates whether interval time-outs are supported. An interval timeout is the amount of time allowed to elapse between the arrival of each piece of data.",
        "Predicate register",
        "NDISWMI_TRACE_QOS",
        "object:ProcessorAcpiTsdDependency",
        "constructor",
        "ALTSTREAMS Flag",
        "{CCC64809-6B5F-4c1b-AB39-336904DA9B3B}",
        "NamedJobObjectSecLimitSettingProv",
        "R_BC0FC27106A767FEC0851E8860A023F04DDFD5CE172A9F5CC2B8EE5C7AD4FF73",
        "ISO 802.5 CRFP",
        "Name of target",
        "AllowLocalMachineZoneTemplate",
        "Printer",
        "ProviderOperation_GetObjects",
        "Window DRAM",
        "Inkjet Aqueous",
        "Priority to Traffic Class assignments.",
        "SymbolicName",
        "Endpoint1",
        "CD_0670B73B6B090142BD85762A0781366FE00115AA7451B9B2750B5D23B1B3C0EE.1058.3967403014.1601",
        "Voice over IP",
        "{D368CA4A-DB31-11d2-85FC-0000F8102E5F}",
        "MSFT_WmiFilterActivated",
        "PA-RISC 7300LC",
        "IEEE 802.3 100BASEVG",
        "0xC0000010",
        "The Win32_CommandLineAccess class represents the command line interface to a service or application. The name of the access point is always the full command line text.",
        "LoaderLockWait",
        "ref:CIM_Action",
        "The CountryCode property indicates the code for the country/regionused by the operating system. Values are based on international phone dialing prefixes (also referred to as IBM country/region codes). The CountryCode string can use up to six characters to define the country/region code value./nExample: 1 for the United States)",
        "Thread",
        "MSFT_ScheduledTask",
        "ToeplitzHashFunctionEnabled",
        "The Network property indicates whether the printer is a network printer.",
        "SupportsStorageTieredVirtualDiskCreation",
        "Size in bytes of Target Password.",
        "The maximum number of pending connections.",
        "Recommendation.ITU|X733.Notification identifier",
        "The ServiceDependencies parameter passes a list containing names of services that must start before this service starts. The array is doubly null-terminated. If the pointer is NULL, or if it points to an empty string, the service has no dependencies. Dependency on a service means that this service can run only if the service it depends on is running.",
        " 0x00000004 ",
        "CustomTextToShowInPrompt",
        "Event Version",
        "{d43412ac-67f9-4fbb-a081-1752a2c33e84}",
        "{44795702-a61b-11d0-8dd4-00c04fc3358c}",
        "{467c1914-37f0-4c7d-b6db-5cd7dfe7bd5e}",
        "Registry_ChangeNotification",
        "object:Win32_OfflineFilesDiskSpaceLimit",
        "Smbios Minor Version",
        "BAUD_300",
        "{65878E68-DB2B-11d2-85FC-0000F8102E5F}",
        "Server trust account",
        "Asynchronous Snapshot Remote",
        "LetAppsAccessAccountInfo",
        "Qualifier",
        "Supplies the solicited node IPv6 address.",
        "Indicates whether this virtual disk is a snapshot of another virtual disk",
        "Win32_NTLogEventLog",
        "Length of time that the job has been executing.",
        "EntryExit Flag",
        "0x00100000",
        "Each instance of the CIM_Process class represents a single instance of a running program. A user of the OperatingSystem will typically see a Process as an application or task. Within an OperatingSystem, a Process is defined by a workspace of memory resources and environmental settings that are allocated to it. On a multitasking System, this workspace prevents intrusion of resources by other Processes. Additionally, a Process can execute as multiple Threads, all which run within the same workspace.",
        "USB Hub Device.",
        "If not set to null for DMTF-defined instances, the \"preferred\" algorithm must be used with the <OrgID> set to CIM.",
        "RecordLog serves as an aggregation point for LogRecord objects. This class presents a higher level view of a log than its peer class MessageLog (which uses iterators) and introduces a new key structure. Access to records in this log is achieved through the use of the standard CIM Operations defined as part of WBEM.",
        "Process_V2_TypeGroup3",
        "Win32_UTCTime",
        "Decibels",
        "ReportingObjectType",
        "QueryInfoTrustedDomain",
        "This indicates whether to connect to a hidden network or not.",
        " extent.",
        "ActionResults",
        "MIF.DMTF|Voltage Probe|001.15",
        "PriorityBase",
        "AllowWindowsSpotlightWindowsWelcomeExperience",
        "CD_E6693E875674598B86E9046055C21F06E3880E36F7B4D4AB3B0150ED979EA8CB.1563.405885921.488",
        "Communication Server",
        "1 - CIM_ERR_FAILED. A general error occurred that is not covered by a more specific error code. ",
        "LUAInstall: error 0x00000005 setting flags [{9440F424-33D8-4114-BC6E-033867239A09}]",
        "ResourceId",
        "MinimumWorkingSetSize",
        "HNet_Connection.Guid=\"{4C572733-2FBA-4346-9601-F86DBA666EF2}\"",
        "WinRM",
        "BidTraceAdapter",
        "A user friendly description of the current rule.",
        "T10VID",
        "Query Header/Data split Current Config",
        "        <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>",
        "MSFT_SomFilterStatus",
        "MSFT_ExpressionIf",
        "MinRefreshRate",
        "Specifies a single DNS suffix",
        "MaxNumQueuePairsPerNonDefaultVPort",
        "DisallowStartIfOnBatteries",
        "TRACE_FLAG_IOCTL",
        "MDM_Policy_User_Result01_AttachmentManager02",
        "This enables I/O queue traces",
        "Set_BCCacheByPath",
        "UserAccountControl_UseAdminApprovalMode",
        "NdisTokenRingCurrentRingStatus",
        "MSFT_NetCircularDependencyAuto",
        "{0ef94073-5b9d-4ec9-9c6d-a624d1c3be18}",
        "CD_155D9E7AE6D9F85361D5CC740FA1EFEDE91BCBF995E255746E05290A3497CB99.1672.1.16925",
        "The sequence identifier for the indication enables a CIM listener to identify duplicate indications when the CIM service attempts the delivery retry of indications, to reorder indications that arrive out-of-order, and to detect lost indications.",
        "Gather only those log messages which correspond to a particular activity ID. This can be when an extended status message has been reported by an operation which supplies an ActivityId. It will help find log messages related to that extended status failure message.",
        "Smoke",
        "Associates a network port with its configuration data.",
        "CD_230EA8264BAA6C50B01C67268E97AB7EA0B455AC7B2538115EE2F298AB497196.1203.2333377647.1538",
        "Failed to save persistent login information.",
        "The directory path where the cache file is located",
        "SharedKeyMaterial",
        "CR_0B9091A7705333E08909D2D04FE2D8C67B717AD489BDF891C00D458657EAF4C7",
        "Page File Usage",
        "The PartComponent reference represents the system driver running on the computer system.",
        "Protected",
        "{313e88e0-a4fd-11d8-b301-505054503030}",
        "MSFT_iSCSITargetToiSCSIConnection",
        "C_A57480D0D82DDE51E01CC9C7625981822E2D1C37B70F78DC6E6179505A7BD928",
        "A Win32_FolderRedirectionHealth object that represents the health of the user's redirected Desktop folder.",
        "Bid2Etw_MSADCE_1_Trace_TextW",
        "The NameFormat property identifies how the Name of the AdminDomain is generated, using the heuristic specified in the CIM V2 System Model spec. It assumes that the documented rules are traversed in order, to determine and assign a Name. The NameFormat Values list defines the precedence order for assigning the Name of the AdminDomain. ",
        "KCBRundownEnd",
        "The SMBIOSBIOSVersion property contains the BIOS version as reported by SMBIOS.",
        "This parameter allows the user to specify the FriendlyName at the time of the file server creation. FriendlyNames are expected to be descriptive, however they are not required to be unique. Note that some storage subsystems do not allow setting a friendly name during file server creation. If a subsystem doesn't support this, file server creation should still succeed, however the file server may have a different name assigned to it.",
        "ScsiLun",
        "SetValue",
        "Associates a network adapter with its Large Send Offload (LSO) data.",
        "ImageSize",
        "MemorySpeed",
        "The HostingGroup property currently is not used.",
        "Memory installed on or associated with a device.",
        "The number of bytes sent using the IPSEC tunnel mode.",
        "LocalDeviceName",
        "TrustedNetworkDetection",
        "The Namespace property indicates the Namespace associated with a particular instantiation of a provider instance.",
        "MSNdis_CoMediaInUse",
        "CreateTimeStamp",
        "Conventional PCI 66MHz",
        "iScsiFlagLock Flag",
        "{791ad1a6-e35c-11d0-9692-00c04fc3358c}",
        "iScsiFlagCHAP Flag",
        "msieee80211DataType",
        "CIM_FRUPhysicalElements",
        "The Antecedent represents a physical connector that serves as one end of the connection.",
        "CD_EEA03BCBA3B96A242B9DF0CF75DAE7464E37C83E292EC97AF81E8D15CE5623E3.1594.2626109873.432",
        "Indicates if the Adapter supports UDP checksum validation offload for receive IPv4 packets.",
        "MSFT_ExpressionValue_real32",
        "NTLM Validate Credentials",
        "CD_01F6508C1866E0E79B21585B0217BD595D533D4A180A35479737402276CAE352.99.3430469742.309",
        "VINES",
        "RequiredSecurityProperties",
        "Bi-directionsal SCSI comamnd supported",
        "The MaximumSize property indicates the maximum size of the Win32 registry. If the system is successful in using the ProposedSize member, MaximumSize should contain the same value.",
        "SQLSRV32.1 formatted output (A)",
        "SMBIOS|Type 12|Configuration Options Strings",
        "Check If IE Is Default Browser",
        "LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls",
        "000 - Routine  ",
        "A client may be configured to not listen for content discovery requests in distributed cache mode when operating on battery.",
        "The largest information field that may be sent or received by the LANEndpoint.",
        "C_7450B933028ED3A9668E73BC07A8325B939DC7781D6560E2446E75795DDC2C3E",
        " 3 - Required ",
        "LocalMachineZoneNavigateWindowsAndFrames",
        "Personal Computer architecture Memory Mapped I/O. This class addresses both memory and port I/O resources. The property, MappedResource, defines whether memory or I/O is mapped (and for I/O whether the mapping is to a memory or a port space.",
        "CIM_PackageAlarm",
        "{7D33100E-E3D3-11d2-8601-0000F8102E5F}",
        "CIM_LocalFileSystem",
        "InternetZoneLaunchingApplicationsAndFilesInIFRAME",
        "VL VESA Support",
        "Electrical",
        "The Id property indicates the manufacturer's identifying name of the tape drive.",
        "MIF.DMTF|Portable Battery|002.10",
        "{f786fbd7-c049-11dd-b885-001d09162bc3}",
        "CD_064843E966479C3B4CF71DBA14623DC8C5CF1B385A02FDC292B3B3F5C45F4BAC.1522.2467262012.3455",
        "GUID ID",
        "Security Error",
        "Method Reserved",
        "Gilberts",
        "I_BC62D2F1A8964BE05CE3C8E4A92D6196F3ABA9FF68221E9970F3291305AD53F0.419.1.28222",
        "<RoleName>[&&<RoleName>]* ",
        "AutoShareWorkstation",
        "Device name.",
        "Thread Pool Callback Cancel",
        "The InstanceObject property holds the object instance to be written.",
        "EventsLost",
        "Storage modification events are used when the underlying state of an object has changed. Not all properties should be tracked (for example AllocatedSize may change so frequently that sending events would be impractical). At a minimum, an event should be sent any time an objects HealthStatus or OperationalStatus properties change.",
        "Windows Notification Facility Provider",
        "R_C048801BD5D3FA6AC71997C20307BC2294AA0650B75F6BCDC38FC1AE7FFD834D.1462.2398215406.540",
        "Select * from Win32_NetworkAdapterConfiguration",
        "{5ec1035d-a61a-11d0-8dd4-00c04fc3358c}",
        "MEM_PHYSICAL_ADDR",
        "MDM_WindowsLicensing",
        "CIM_SettingsDefineCapabilities.PropertyPolicy",
        "MaxPendingSessions",
        "Msft_WmiProvider_OperationEvent_Pre",
        "The renewal frequency, in minutes, of how often KMS-clients will contact the KMS host after they have become licensed. The frequency must be greater than or equal to 15 and less than or equal to 43200. An error is returned if the method is called and the computer is not a KMS.",
        "ATM IMA",
        "IsSwitchingSupply",
        "ParametersLength",
        "CR_503E99E1F76A9D46449F32E9069632CBB392B8A00D8C4838939B6A5881D7193A",
        "The Win32_PrinterSetting class represents an association between a printer and its configuration settings.",
        "The PartComponent reference represents a load order group existing on the computer system.",
        "BrokenConnection",
        "Pizza Box",
        "{3DD82D10-E6F1-11d2-B139-00105A1F77A1}",
        "A string indicating the current status of the object. Various operational and non-operational statuses are defined. This property is deprecated in lieu of OperationalStatus, which includes the same semantics in its enumeration. This change is made for 3 reasons: 1) Status is more correctly defined as an array. This overcomes the limitation of describing status via a single value, when it is really a multi-valued property (for example, an element may be OK AND Stopped. 2) A MaxLen of 10 is too restrictive and leads to unclear enumerated values. And, 3) The change to a uint16 data type was discussed when CIM V2.0 was defined. However, existing V1.0 implementations used the string property and did not want to modify their code. Therefore, Status was grandfathered into the Schema. Use of the Deprecated qualifier allows the maintenance of the existing property, but also permits an improved definition using OperationalStatus.",
        "The world wide node name to associate with the created virtual port",
        "MIPS R10000",
        "05m;05m;",
        "Header_Extension_TypeGroup",
        "LocationInformationString",
        "Levels",
        "CR_54B0E217B287F6F85D4DEAB32DF5A8CE4DFDF560D8AC01819FC50FC0ACC66BC3",
        "The Name property indicates the name of the current network connection. ",
        "Schema",
        "TRACINGFULL Flag",
        "Example: C:\\WinNT\\MiniDump",
        "CD_91604F794B64A61196688751D972A0B3626DF7A1827369CDD4AD7A23AC00FD14.137.457697488.3051",
        "Add or Remove to group requires FailedOver state",
        "CIM_ElementSettingData",
        "CIM_PhysicalComputerSystemView.NumericSensorUnitModifier",
        "The name of the share",
        "Count of the minor errors. ",
        "{2DCD1DAF-A110-49c0-BFDB-6FDF557B5FDF}",
        "IPDstPortEndMatchCondition",
        "An array providing supplemental information for the current error state, indicated in DetectedErrorState.",
        "The number of Queue pairs for the non-default VPort",
        "unknown",
        "DomainControllerAddressType",
        "HttpsGetBinding",
        "NumberOfPfcEnabledTrafficClasses",
        "Severity of the error record",
        "MCACpuRegFileError",
        "{AE7B614F-AFE0-41ea-807E-3BD3F83CAF66}",
        "Complex networking devices often are chassis-based. These chassis allow for enhancement and/or augmentation of their base functionality by accepting additional chassis devices, similar to accepting functionality in the form of adding cards. This association models this capability.",
        "This is the key of the section of the setting entry to be modified.",
        "Vendor's organizational unique identifier (OUI)",
        "{74a75b02-36d8-ede6-d10e-95b691503408}",
        "The timer to use when logging the time stamp for each event.",
        "event source",
        "{981f2d76-b1f3-11d0-8dd7-00c04fc3358c}",
        "object:MSFT_PartialConfiguration",
        "TransactionTimeout",
        "{FAF76B76-798C-11D2-AAD1-006008C78BC7}",
        "SkipAsSource",
        "SystemConfig_V2_Power",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|DatabasePath",
        "The DriverName of the driver ",
        "Association between DiskImage and Volume",
        "Number of slots for cleaner cartridge in the changer",
        "C_36FFCD7C103F4CB151534CDC404DD1E71C91E39EA5D1DCB2E130739044899EBB",
        "GlobalProcessCount is the current number of processes that have the file loaded in memory.",
        "RotateRecoveryPasswordsRequestID",
        "IL_5C128A75C27B4985F58BF9F60D25F3AD1811C55F8449A91D8301FA08651ED431.297.2524730711.305",
        "Primary statuses of numeric sensors. See CIM_NumericSensor.PrimaryStatus for details.",
        "Work Item Shortages",
        "MSFT_NetBootSystemDriversFailed",
        "InprocServer",
        "OutputReferenceFile",
        "The sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If the CurrentReading is below LowerThresholdFatal, then the CurrentState is Fatal.",
        "MNP 4",
        "DiagnosticsSubmissionEnabled",
        "ProcessorAcpiTsdDependency",
        "The PasswordExpires property determines whether the password on the Win32 user account will expire.",
        "The PrivilegesStatus class reports information about privileges required to complete an operation.  It may be returned when an operation failed, or when a partially populated instance has been returned.",
        "InternetZoneDoNotRunAntimalwareAgainstActiveXControls",
        "{ba138e10-e250-4ad7-8616-cf1a7ad410e7}",
        "IL_A9F8B44D617BF5CE113FEF784720616F96802102F33327316324B2A6D9D506A6.297.338166298.188",
        "SMBIOS|Type 0|BIOS Characteristics",
        "Status of last change",
        "Represents the UDP parameter setting for Microsoft TCPIP WMIv2 provider.",
        "PCI Bus",
        "__namespace",
        "NetEventPacketCapture",
        "Controls TCP delayed ACK time-out in milliseconds. Value can range from 10 milliseconds to 600 milliseconds.",
        "ng fla",
        "The InfFilename property specifies the path to the .inf file of the video driver.",
        "AdjustIncrement",
        "Reason that the SOM is applicable, 1= Normal, 2 = Loopback",
        "Indicates network adapter support for Transmit Checksum Offload for this encapsulated packet type.",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_86B3BCA296587429BCD61A2968A848617DB93023BC6D3C1858853C5540E12A3E3E",
        "msieee80211-DataType",
        "NullEsp",
        "TsaAssignmentTable",
        "Values: TRUE or FALSE. If TRUE, the automatic reset boot option is enabled.",
        "CD_92D90F38218063ED84DEBF091001DAB75383FEA23B31338C700BDB5B69D9A383.1148.4107397820.4385",
        "The status of this setting",
        "Socket 754",
        "MSFT_VirtualDiskToDisk",
        "AdministrativeMode",
        "InstallationID",
        "IsVxlanUDPPortConfigurable",
        "C_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11",
        "Creating tiered virtual disks is available only when the SupportsStorageTieredVirtualDiskCreation property on the storage subsystem is set to TRUE. If it is set to FALSE, this method will fail with MI_RESULT_NOT_SUPPORTED. ",
        "WSP_StorageSubsystemToDisk",
        "C_5FDD5C517B158FA6F136FDA5163883910AF54452C20644A4B22DCE61A6AAF3A7",
        "GlobalRefreshEnabled",
        "A physical package can be hot swapped if it is possible to replace the element with a physically different but equivalent one while the containing package has power applied to it (i.e., is 'on').",
        "PhysicalLocation",
        "C_556BED9C5C7B0EE930A3BB6724BD19CEA9521081CDD971D1A19DD19DC37599CE",
        "IL_2E32DD3C4304AB7C0A3A6A35FE2D5283221F256440C1893B09E3BF79A85CFB96.1352.520578658.333",
        "Win32API|Windows Networking Structures|NETRESOURCE|dwScope",
        "Uninstalled",
        "NlMtu",
        "A guid corresponding to the ApplicationId property of RSOP_ApplicationManagmentPolicySetting for the application that caused this application to no longer apply to the target.",
        "I_91BB5F8AFE5873E9BA8EBD1189F17D947DC5BB7E366AF568F25A5BD3FADD34E6.1335.816371373.256",
        "ClearPersistentIScsiVolumes",
        "MaxLinkWidth",
        "CIM_FileSystem.CSName",
        "Bid2Etw_MSDART_1_Trace",
        "{4b6efb94-30ea-49a7-bb29-e9ed9dce67da}",
        "IL_43B7B69F919BB681DCC1079E7BED6BA29BBE6F4DDA8822130874E698F9F22509.1105.2387327780.301",
        "SamEnumGrpsInDom_End",
        "XCountChars",
        " 16-bit as well as 32-bit InprocHandlers",
        "Specifies whether the user  has UI control for the DirectAccess entry when the user clicks the Networking notification area icon.",
        "The UserName property indicates the name of the currently-logged-on user.",
        "{981f2d7e-b1f3-11d0-8dd7-00c04fc3358c}",
        "Indicators",
        "PointerType",
        "Win32API|Windows GDI|HMONITOR",
        "   //  array so the WmiSizeIs() will work correctly for structs that ",
        "Msft_CliAlias.FriendlyName=\"ShadowCopy\"",
        "{6C770D54-0441-AFD4-DCAB-1D89155FECFC}",
        "MSIAlwaysInstallWithElevatedPrivileges",
        "CD_9E6BE90DCA6B96CBA3BF12EFB579708613DA0A405A49EA5E6B87A7FDB2747D9E.2033.2624884185.251",
        "EAAPI Flag",
        "The Win32_InfraredDevice class represents the capabilities and management of an infrared device.",
        "SamSetInfoAlias_End",
        "error_Category",
        "Instance name of the instance of the performance counters of the service. ",
        "VXLAN",
        "object:MSNdis_WmiReceiveScaleCapabilities",
        "Either '32-bit' or '64-bit'.",
        "ToLocalUserProfile",
        "Absolute path to the settings location template file",
        "IPv4 Address Range",
        "Bid2Etw_BCP_1_Trace_TextW",
        "Desktop Monitor management.",
        "I_CA599D6A29EF58E9CC298260942301AFE42CF6FFCEB9502DACD0BAA50DED4DEE.530.1.21465",
        "NdisPhysicalMediumType",
        "BlindOn",
        "C_6F49E037E6F2BFB72144CC48C974D93CBE7417A8F27ACAB5CA25D34A28C29442",
        "RemovePhysicalDisk",
        "EVENT_TRACE_FLAG_REGISTRY",
        "object:Win32_PnPDeviceProperty",
        "I_0B5EDAA42C9675F8D2021C39B37DD031763091DE8523969BAB52C951879C0978.2722.637542004.287",
        "\"Minor Failure\" (15) - All functionality is available but some MAY be degraded. ",
        "MCA is supported",
        "object:MSFT_PhysicalExtent",
        "CIM_ProtocolEndpoint.OtherTypeDescription",
        "58000",
        "The Ids of threats upon which default action should not be taken when detected. The actions in ThreatIDDefaultAction_Actions need to be specified in the same order as the Ids in ThreatIDDefaultAction_Ids",
        "TypeofService",
        "Localized version of RSOP_PolmkrStartMenuSettingVista for American English",
        "MSFT_Net6to4State",
        "DisableSecondaryHomePageChange",
        "Overwrite",
        "Whether Application PreLaunch is enabled",
        "11 - 'In Service': describes a storage pool being configured, maintained, or otherwise administered. ",
        "50004",
        "The frequency (in hertz) at the high end of this powersupply's input frequency range 1. A value of zero implies DC.",
        "SyncOverMeteredNetworkWhenRoaming",
        "ParentPath",
        "SourceDirectory",
        "YCountChars",
        "ServiceMachine",
        "WheaGetPolicyRtn",
        "NDISWMI_TRACE_VMQ",
        "MDM_VPNv2_DeviceCompliance02",
        "HttpHelpPageEnabled",
        "autoProxyURL",
        "Together, the PolicySet.PolicyDecisionStrategy and PolicySet Component.Priority properties determine the processing for the groups and rules contained in a PolicySet. A larger priority value represents a higher priority. Note that the Priority property MUST have a unique value when compared with others defined for the same aggregating PolicySet. Thus, the evaluation of rules within a set is deterministically specified.",
        "DaylightMillisecond",
        "Microsoft.Management.Infrastructure.CimInstance#DnsClientNrptGlobal object contains all the  properties of  DNS client NRPT  Global settings.",
        "PCI System Error",
        "True if identical. False otherwise.",
        "ChildClass",
        "The InstallDate property is datetime value indicating when the object was installed. A lack of a value does not indicate that the object is not installed.",
        "MIF.DMTF|Memory Device Mapped Addresses|001.5",
        "Volume is in use",
        "MSFT_NetFirewallRuleFilterBySecurity",
        "The type of ACE entry this is",
        "KernelPerfStateDomainChange",
        "Win32_MountPoint",
        "Remove a connection from the session",
        "EcnCapability",
        "CR_DBC9D7448979766FC3AA5E546B9F7F37A6E0C06BC06D343F27EAFCD412F13D2A",
        "Level of cache, TLB or microarchitectural structure where error occurred (0 indicates first level)",
        "TRACINGDEVICE",
        "The name of the feature within the associated product to which this condition applies.",
        "RestrictedSitesZoneAllowSmartScreenIE",
        "MDM_Policy_Config01_TextInput02",
        "Clear Persistent iSCSI Volumes",
        "TargetPath",
        "Specifies whether pending transactions are completed when the current session closes.",
        "QOSWMI_TRACE_UTILS",
        "WmiProv",
        "C_FBFFFF984DA9B7029EE7078D02385B8FF23DEF8E12B59491A9BDEA2549806FA0",
        "srbExtension",
        "48004",
        "Short server name",
        "The FJoinOptions parameter contains a set of bit flags defining the join options. This parameter can be one or more of the following values: /nJoin Domain -  Joins the computer to a domain. If this value is not specified, joins the computer to a workgroup. 0 bit - Join Domain - If not present, a workgroup is joined. /n1 bit - Acct Create - Creates the account on the domain. /n2 bit - Acct Delete - Delete the account when a domain is left. /n4 bit - Win9X Upgrade - The join operation is occurring as part of an upgrade of Windows 95/98 to Windows NT/Windows 2000.  /n5 bit - Domain Join If Joined - Allows a join to a new domain even if the computer is already joined to a domain. /n6 bit - Join Unsecure -  Performs an unsecured join./n7 bit - Machine Password Passed - Indicates that the machine (not user) password is passed. This option is only valid for unsecure joins /n8 bit - Deferred SPN Set - Specifies that writing SPN and DnsHostName attributes on the computer object should be deferred until the rename that will follow the join. /n18 bit - Install Invocation - The APIs were invoked during install. /nThe method returns a 0 if no options are involved.",
        "C:\\Windows\\System32\\drivers\\monitor.sys[MonitorWMI]",
        "RD_TRACE_LPC",
        "Heap Affinity Manager Enabled",
        "Enterprise Edition",
        "ExcludedProfileDirs",
        "Computed Route",
        "C_F888AA6AC586756C18E219B06406D7BCD62E2EB0C94B51FB48F127652DA7E3EB",
        "The scoping System\\'s CreationClassName.",
        "The endpoint associated with the service.",
        "I_19E57369527D4B1D06F7B62EA4740710580A7EE3221F927586AA3C452A7CD5DA.1020.116025462.277",
        "D_7FCF3928CE1A9575028B7746073AE3C5F6F2163882EECBCF60F66F9FAFB60664.1197.2813777628.335",
        "StackLimit",
        "Second",
        "SetEduPolicies",
        "deleteExistingToolbarButtons",
        "LastFullScanDateTimeEnd",
        "SEL_GENERATOR_ID",
        "{3333d2fc-3aee-479f-985d-8bebae552b99}",
        "EVENT_TRACE_FLAG_Z",
        "SslStreamSecurityBindingElement",
        "TM_NLAPROVIDER",
        "TRACE_CLASS_DISPATCH Flag",
        "CD_26F2DFA12DD4E238DF19BAA4547B3B8EF9BC62B9AB940056F71629B35FA95FCC.1475.2398875989.4422",
        "ChangeStartMode",
        "The return value shall be 0 if the request was successfully executed, 1 if the request is not supported, and 2 if an error occurred. A return code of 4096 shall indicate the request to clear log was successfully initiated, a ConcreteJob has been created, and its reference returned in the output parameter Job.",
        "UnSyncAssoc",
        "CIM_NumericSensor.RateUnits",
        "DSAccess_AuditDirectoryServiceReplication",
        "\"Completed\" indicates that the element has completed its operation. This value should be combined with either OK, Error, or Degraded so that a client can tell if the complete operation Completed with OK (passed), Completed with Error (failed), or Completed with Degraded (the operation finished, but it did not complete OK or did not report an error). ",
        "CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified.",
        "MSFT_NetQuickModeSA",
        "RedirectedPort",
        "condition",
        "Property for controlling DirectAccess rules state. ",
        "{530c69c9-2f51-49de-a1af-088d54ffa474}",
        "SessionsList",
        "ProviderOperation_ExecQueryAsync",
        "Class that represents the a category of applications inthe Add/Remove Programs control panel applet.",
        "Associates a network adapter with the setting data of its statistics.",
        "RequestedCopyState",
        "Bid2Etw_OLEDB_1",
        "CD_EE8C4640FD60905905B00B1CDD578E162950539A8911836499849B2BDE6B0C53.1559.3765131599.428",
        "odel Path of the SourceInstance. The following format MUST be used to encode the Model Path: ",
        "StartPassword",
        "Clear",
        "ConfigStorageSenseRecycleBinCleanupThreshold",
        "ReceiveRetryCount",
        "ProviderSubSystem",
        "%FunctionName%",
        "C_FA52CB5E7D6BA7133233B22EA252FFA4A8C664E7F86ACC00B362A212DA58071C",
        "{43fe82d8-3468-497e-9dcf-f8ffc0133744}",
        "F5343CF705176C26EA1F33161F.2720.3445580149.277",
        "LUAInstall: error 0x00000005 setting",
        "CD_9FFC730BEA787E28FF305A66FE71BC4BDA5863470D337AF3119C48B654F08702.2112.646779241.1488",
        "FWCFG",
        "ResetCount",
        "Remote Replica Source",
        "CurrentNaturalLanguage",
        "The current matching day of the current week (0-6, Sunday being 0)",
        "SoftwareLicensingService",
        "TransactionIsolationLevel",
        "C_5847C21BC6927B979DCCC7E87CBA9AC34DE69BF0C904AF77E2C0BE3CEEA06FCB",
        "Command Parity Error",
        "The Win32_ClusterShare class represents a shared resource on a cluster.",
        "You must specify a file server to expose this volume to",
        "LCMVersion",
        "Application Software",
        "The Destination property contains the destination IP address for this persisted route.",
        "MSNdis_NetworkDirectVersion",
        "If  the transition day DaylightDayOfWeek occurs on a Sunday, then the value 1 denotes the first Sunday of the DaylightMonth, 2 denotesthe second Sunday, and so forth, and 5 denotes the last Sunday of theDaylightMonth. ",
        "Credential to use for DSC configuration providers.",
        "ConstraintType",
        "Object Create/Delete Events",
        "RD_TRACE_RESERVED_17 Flag",
        "MDM_Policy_Config01_Display02",
        "Exemptions",
        "The SID of the enrolled user",
        "NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM",
        "CipherAlgorithm is an enumeration that specifies the proposed encryption algorithm. The list of algorithms was generated from Appendix A of RFC2409. Note that the enumeration is different than the RFC list and aligns with the values in IKESAEndpoint.CipherAlgorithm.",
        "ISO 802.5r DTR",
        "Headware Offload Configuration of the adapter",
        "The name of the operation.",
        "ChangeInfo",
        "Resource at or Nearing Capacity",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_SUPPORTS_BROADCAST",
        "AllowFullScanRemovableDriveScanning",
        "PreviousInstance",
        "The situation that triggered the removal of the application: ",
        "VideoArchitecture",
        "0x00002000",
        "REDBOOK_WMI_PERF_TIME_READING",
        "The SetMTU method has been deprecated.  There is no replacementand the values returned do not corresepond to the method's intended purpose. ",
        "{9565979C-7D80-11D2-AAD3-006008C78BC7}",
        "TeredoServerIP",
        "Power in milliwatts",
        "Standard Absolute Pointer",
        "Client may be instructed to operate in a downgraded mode, in which it will issue specified version requests to content servers.",
        "Specifies the Internet calendar program you want to use with Internet Explorer.",
        "tagNetworkItemFactory",
        "PCI Support",
        "C_D19777074C5B32D9DC9992840BAA8166B47EC1038BA93E9572C45BE663CDE8EC",
        "Restore In Progresss",
        "If true, the share is working in Online mode",
        "Parallel Port",
        "ConfigManagerErrorCode",
        "The number of queue pairs.",
        "Disable DA manual site selection",
        "MsftDiscRecorder2_DebugConstructor",
        "{f831dd6e-85d0-4f7d-8ac0-bb2099682c4e}",
        "Used20CallingMethod",
        "LogoutOthers",
        "NDIS Ethernet Current Address",
        "43C86C3E5B2B7F1DD0443A6DA4E17AA95D65F56EE0C19CF4FD3B5D9A5F63C522",
        "6 - 'Error': An error has occurred.",
        "SamOpenUser_End",
        "CIM_SoftwareElement",
        "The identifier. ",
        "CIM_SettingsDefineCapabilities.ValueRole",
        "MDM_Policy_Result01_ApplicationDefaults02",
        "DialType is an integer indicating whether tone (value=1) or pulse dialing (value=2) is used. \"Unknown\" (0) can also be defined.",
        "InactiveProfile",
        "SAM Enumerate Aliases In Domain",
        "CIM_VolatileStorage",
        "The current bandwidth of the Port in Bits per Second. For ports that vary in bandwidth or for those where no accurate estimation can be made, this property should contain the nominal bandwidth.",
        "ScheduleForceRestartForUpdateFailures",
        "{CFA6EF26-8675-4E27-9A0B-B4A860DDD0F3}",
        "The PartComponent reference represents the the resource (such as I/O services, memory resources) available on the computer system.",
        "MCA_ERROR_PCI_BUS_SERR",
        "Enrollment Certificate Request ID",
        "The ErrorAddress property specifies the address of the last memory error. This property is used only when ErrorInfo is not set to 3.",
        "LocalServer",
        "An enumerated, integer-valued array indicating the type of chassis.",
        "Event Trace Version",
        "MSADCE.1 formatted output (W)",
        "C_95CE38D55F514EB56E1FD96114137062153D80888E94FE34DB4826CDF9096258",
        "LPC_TRACE_RESERVED_1e",
        "CreateStorageTier3",
        "SecurityDescriptorList",
        "Terminal Server",
        "ClearKeyManagementServiceMachine",
        "Perfect forward secrecy group id",
        "FlushDns",
        "SMHBA_BIND_CAPABILITY",
        "{3d2c9e3e-bb19-4617-8489-cabb9787de7d}",
        "Extended grace time in minutes before the parent application becomes unlicensed.",
        "2 - The user does not have access to the requested information.",
        "LPCDRVR_TRACE_RESERVED_03 Flag",
        "NewByThirdParty",
        "SourcePath",
        "The health status of the Volume.",
        "WMI_TAPE_PROBLEM_DEVICE_ERROR_GUID",
        "Localized version of RSOP_PolmkrNetShareSetting for American English",
        "R_23A50366135FBF364F350BC34F639BE141A61D21A478BB4C1230D838F1296A4E",
        "CD_3CDC4183D44F52048CE0039132A93204204F5A3326DCB27DE7954C1D3930FD11.1939.2072208055.297",
        "ClientCertificate",
        "n at t",
        "Status of the operation",
        "{C75D89F8-DB30-11d2-85FC-0000F8102E5F}",
        "LUAInstall: error 0x00000005 setting flags [{7444C719-39BF-11D1-8CD9-00C04FC29D45}]",
        "object:MSFT_OdbcDsn",
        "Each instance of this class represents a source file with it's various attributes, ordered by a unique, non-localized identifier.  For uncompressed files, the File property is ignored, and the FileName column is used for both the source and destination file name. You must set the 'Uncompressed' bit of the Attributes column for any file that is not compressed in a cabinet.",
        "MDM_Policy_Result01_Troubleshooting02",
        "AdditionalErrorData",
        "AllowCellularDataRoaming",
        "There is no tunnel mode outer address specified.",
        "{c2a0e094-a178-4372-b4fe-a33e48c3585c}",
        "NDIS Receives OK",
        "MSFT_DtcAdvancedHostSettingTask",
        "FileIo_V2_Info",
        "{b6661e6f-075e-4209-ae20-fe81db03d979}",
        "0xD010",
        "PlatformLibraryTraceGuid",
        "LastDroppedTimes",
        "MSFT_NetAdapterPowerManagement_WakePattern_EapolRequestId defines settings for an 802.1X EAPOL wake pattern.",
        "The Name string corresponds to the format used with the SHOW command. The format name may be one of the system defined formats(FULL, BRIEF, INSTANCE) or may be an arbitrary user-defined format.",
        "Command line string",
        "UncompressEx",
        "The connection speed, in kilobytes per second (kbps). This threshold is used to determine if the connection is a slow link. If the server's transfer rate in kbps is less than this threshold, the connection is considered to be slow. This property applies to IP networks.",
        "The system property is a boolean value indicating if the file is a system file.",
        "0xEFFF0025",
        "SetPartition",
        "RT Lost Event",
        "resultantPath",
        "CIM_USBDevice.CurrentConfigValue",
        "ScanParameter",
        "Resolution indicates the ability of the sensor to resolve differences in the measured property.  ",
        "Dot11 Disassociation status information.",
        "Modern app installation path",
        "Win32ShutdownTracker",
        "The Dependent property references the connection that was made to the shared resource.",
        "The OtherErrorDescription property provides more information when the ErrorInfo property is set to 1.",
        "Specifies the print ticket XML defining default print settings for this printer.",
        "The Resume method continues a paused print job. The method can return the following values:",
        "IR_20A2FCD02AFF243CF774088A45E089FBE5A849A9F82F70950D8BFE6D4323904A",
        "LAN Remote",
        "NetworkDirect state on this adapter",
        "Is Active",
        "WriteCount",
        "Last five characters of this product's key. Returns null if a product key is not installed.",
        "Interval Timer",
        "CD_008720254C2A979DBD5FF3822840A198E79AD81A362A92EB99483EEC5D47BE05.1928.4065419693.306",
        "Name for this keyword. If the 'AutoResolve' flag is TRUE, then this should be a FQDN (i.e 'contoso.com' or '*contoso.com'.",
        "IL_5306A39AE8099BE250137B7B473C6C6DC916A35E8018A185B5C9A31EB97EDE85.706.1.27844",
        "ConnectionInformation",
        "C_FC7FFCA0C7A5D89DD371B2F0B241E87A604E23DE48746B1BF4F9C2034FE72A72",
        "MCA SMBIOS Error Event",
        "MsftDiscFormat2MsfAddress_DebugDestructor",
        "TM_PLGEXT Flag",
        "This method allows the virtual disk to be renamed.",
        "I_6456463FE04288A1885C6F7DFFFA4040E415617C14B667F2C51BCDF537F3D501.864.1.21995",
        "R_80AFDCC52F3C92AD7D0F8DD0B12150C7B0CC34A13BF2D3DD52C62A73F9713B79",
        "CD_F61D3A37372046376CAFA47C2FBD5009ED63EA8C65A1E072429CA32FDA52CF26.61.588964556.629",
        "MDM_Policy_User_Config01_AttachmentManager02",
        "An array containing the dynamic content of the message.",
        "SystemDirectory",
        "When several bus and/or connection speeds are possible, the NegotiatedSpeed property defines the one in use between the devices.  Speed is specified in bits per second.  If connection or bus speeds are not negotiated, or if this information is not available/important to device management, the property should be set to 0.",
        "If True, the binding has been enabled by admin. If False, the binding has been disabled.",
        "Maximum number of partial PD_BUFFERs which can be returned by the PD provider from a PD receive queue as a chain which forms a single coalesced packet.",
        "The current hour of the current day (0-23)",
        "0x100",
        "R_6DC3E270C710F842652B84A8A32FBA808CE5138A68A074ABC88D5C6A3FAF3EBA.2457.1162379856.554",
        "DllMainEnter",
        "CR_8A00FF3E28E2491BD7475BE0DBBFA1E38AE556F30FA37A400006A8673FBC26B8",
        "Thread_V0",
        "{222962ab-6180-4b88-a825-346b75f2a24a}",
        "Localized version of RSOP_PolmkrInternetSetting for American English",
        "FollowRenewal",
        "An array of enumerated integers indicating the Vcc voltage supported by this slot.",
        "CD_5997589696FB2E4597FC4CE1E1612FCF4F0EAE5655998B39A34DFA12CA0BE14A.1638.2675219912.637",
        "Tape is snapped. Replace media",
        "UMS Context Switch",
        "For iSCSI networks, this field should be the IQN.",
        "MSFT_MintPipelineDefinition",
        "Denotes the caching modes this provider supports. The modes are 'Disabled' and 'Manual-Discovery'.",
        "GenerateSecurityAudits",
        "The RenewDHCPLeaseAll method renews the IP addresses on all DHCP-enabled network adapters. The lease for the IP address assigned via a DHCP server has an expiration date that the client must renew if it intends to continue use of the assigned IP address. The method returns an integer value that can be interpretted as follows: ",
        "The XResolution property has been deprecated to theHorizontalResolution property. ",
        "ThermalConstraint",
        "object:PS_BackgroundTask",
        "Uses software",
        "CIM_ClusteringSAP",
        "SAM User Password Set",
        "Whether to disable Application PreLaunch. Application PreLaunch can speculatively launch applications that the user is likely to use in the near future, thus reducing application switch time.",
        "2.19.1",
        "password",
        "MSFT_NetAdapterRdmaSettingData",
        "SupportsStorageTierDeletion",
        "NicPropertyDisabled",
        "__NamespaceDeletionEvent",
        "FX_TRACE_FILEOBJECT",
        "Specifies IEEE 802.3 encapsulation.",
        "This is array of uint8 values that for the Octet String",
        "PeerTypes",
        "WMI|Win32_Directory",
        "CIM_PoweredStatisticalData.PowerOnHours",
        "GetLaunchSecurityDescriptor",
        "Minimum operating voltage for this device, in millivolts. If the value is 0, the voltage is unknown",
        "If this object is retrieved from the ActiveStore, describes the current enforcement status of the rule.",
        "DataStore",
        "NdisFddiStateBreak",
        "The Caption property is a short textual description.",
        "Stack Trace",
        "Win32API|SystemStructures|CM_PARTIAL_RESOURCE_DESCRIPTOR|Flags",
        "I_3E5C71F597B81038891F6DBE304274708E2BB2389008548AA6B8A0CCE07BBFD8.500.1.38483",
        "BurstMode",
        "TRACE_CLASS_PROTOCOL",
        "0xD00E",
        "MSFT_NetAdapterSriovSettingData",
        "0xEFFF000B",
        "iSCSI Connection Class",
        "wsp_health",
        "13 - 'Lost Communication': indicates that the subsystem is known to exist and has been contacted successfully in the past",
        "eBeam",
        "DrvComplReqRet",
        "Decoupled:NonCOM",
        "AllowLanguage",
        "MldVersion",
        "Parallel SCSI",
        "The maximum number of bytes the NIC can always provide as lookahead data.",
        "NumericSensorUpperThresholdCritical",
        "Disables the TCPIP checksum offload properties on the network adapter.",
        "Specifies the new size of this cache file.",
        "VLANIds",
        "Dependent",
        "Select * from Win32_PhysicalMemory",
        "The DefaultTOS property indicates the default Type Of Service (TOS) value set in the header of outgoing IP packets. RFC 791 defines the values. Default: 0, Valid Range: 0 - 255.",
        "CIM_PhysicalMemory",
        "SM CLP",
        "CD_777909665755481973F85E4F05948A22C8B9B138E770DF765F9B0B2561A71FAB.1185.1909437578.281",
        "TraceParameter",
        "Result Data Length",
        "MIF.DMTF|Support|001.2",
        "{AB40A5C1-804B-40bd-9DFE-A640691C6956}",
        "CR_5997589696FB2E4597FC4CE1E1612FCF4F0EAE5655998B39A34DFA12CA0BE14A",
        "Values: TRUE or FALSE. A value of TRUE indicates the service can be stopped.",
        "CIM_DNSProtocolEndpoint.AppendParentSuffixes",
        "ClientType",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1164.2707538804.368",
        "g system.",
        "MSParallel",
        "ref:CIM_DesktopMonitor",
        "Specifies if the threat is active",
        "CR_97BC75F32D55E19412F779268A66FCC6A5BD410C650CA3D0DF71CCC46B370F28",
        "I_0818CC83DEB978B7B8752F2310EEAABC322DC2BDA1B9720BFC816D57CF461D84.2706.2862974922.285",
        "Read errors corrected with substantial delay",
        "CIM_LogicalDevice.IdentifyingDescriptions",
        "      <registryValue name=\"ServiceDllUnloadOnStop\" valueType=\"REG_DWORD\" value=\"0x00000001\"></registryValue>",
        "SeSystemEnvironmentNamePrivilege",
        "Maximum number of minutes before the consumer will start a new instance.  If zero, consumer lifetime is controlled by the MaximumScripts property. Valid Range: 0-71,000.",
        "Rename this set.",
        "If this property is set to TRUE, the partition is a shadow copy of another partition. This attribute is used by the Volume Shadow Copy service (VSS). This attribute is an indication for file system filter driver-based software (such as antivirus programs) to avoid attaching to the volume. An application can use this attribute to differentiate a shadow copy partition from a production partition. For example, an application that performs a fast recovery will break a shadow copy virtual disk by clearing the read-only and hidden attributes and this attribute. This attribute is set when the shadow copy is created and cleared when the shadow copy is broken.",
        "Id of WQL filter on GPO.",
        "LockScreenImageStatus",
        "Actual Route",
        "IrqVector",
        "SystemConfig_V0",
        "The MaximumWorkingSetSize property indicates the maximum working set size of the process. The working set of a process is the set of memory pages currently visible to the process in physical RAM. These pages are resident and available for an application to use without triggering a page fault.",
        "NumVlansPerPort",
        "The install level for the associated software feature if condition evaluates to TRUE.",
        "The DomainControllerAddress property indicates the address of the discovered domain controller.",
        "deleted",
        "InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows",
        "SubSegment",
        "NdisEncapsulationIeee802_3pAndq",
        "Loss of Signal",
        "NumberOfGroupsMin",
        "DisableStoreOriginatedApps",
        "AddBlockedCommand",
        "Allows a user with sufficient permissions to query and turn the Terminal Services listener on or off remotely.",
        "WifiDirectPrinting",
        "14 - 'Aborting': abort-in-progress. ",
        "The physical media.",
        "Executes command in response to an event, see the Win32 SDK documentation for CreateProcess for more complete description of properties.",
        "A unique identifier for this instance",
        "40018",
        "This class represents global ISATAP Configuration shared across all ISATAP interfaces.",
        "Binary",
        "FilePercentFragmentation",
        "CIM_PackageInSlot",
        "MSFT_WmiThreadPoolEvent",
        "CIM_Memory.OtherErrorDescription",
        "TRACE_CLASS_INIT",
        "The CIM_Display class is a superclass for grouping the miscellaneous display devices that exist.",
        "System Control",
        "Total number of packets that have resulted from one or more coalescing events",
        "object:MSMCAInfo_Entry",
        "CD_C787CDD6148B3A1710BABB66FFAAB061F700558EE123742FA9A22BAEF228EE96.1538.560674016.910",
        "CD_DF80435D3E5FC16DFFC6C486D3AEA3D7EEA4CC923E5206FCF82ADE2C4977A73D.1547.1998858766.884",
        "AuthMode",
        "TouchKeyboardDictationButtonAvailability",
        "Version ID",
        "PrintCapabilitiesXML",
        "16550A Compatible",
        "Conservative Scaling",
        "Target Moved Temporarily",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_61E669D3482C420F68FA27C086C8D9EDD1797B7765A7ADEF6912A148755E11FD",
        "MinimumBuffers",
        "LogState",
        "CD_0783FC4315F6719B07F6F7780EAC7B73D0B0471C3E21E23BC45CB6B44FFECA8E.2737.1.9646",
        "WaitForNetworkInSec",
        "SessionStatus",
        "SetDomainInfoPolicy_End",
        "0xD007",
        "Enable/Disable KMS service running with low priority: 0=Disable, 1=Enable.",
        "HBA_EVENT_PORT_BROADCAST_D01_4",
        "C4: GroupNumber = 2, ConditionNegated = FALSE ",
        "IL_71D1BC07380B4FE4C5EDCC0F02E934EE8E495942B17AB007E3FEF57F0329043C.2457.2936753202.343",
        "FX_TRACE_FUNC",
        "InputParameters",
        "Stopped",
        "R_5EA1F84E0651D5FDE833CBE5A59837FABBB4428524C058736835BFBF47BBF01A.2434.3042830361.558",
        "PassThroughServer",
        "Version  of the module that supports this resource.",
        "OldThreadId",
        "C_742E9B93637882507F385BA153B7841CA1D9B1C432715D51E29011AA3B0D693C",
        "Master Data Parity Error",
        "The ClientSiteName property indicates the name of the site where the domain controller is configured to be in. This value may be NULL if the site that the computer named by ComputerName cannot be found (for example, if the DS administrator has not associated the subnet that the computer is in with a valid site).",
        "CscApi",
        "Upgrade Settings Mandatory",
        "WINSHostLookupFile",
        "Win32_LoadOrderGroup",
        "ModuleName",
        "WPA-2-Personal",
        "IL_EFEB887E59EC8D83C39D53CCF57EF6AD0D608FCDC88B6F50F3452B5EEBD4BF9F.597.1.47802",
        "CritSecAddr",
        "ErrorControlOn",
        "String number for the part number of this processor This value is set by the manufacturer and normally not changeable.",
        "TR_WQ Flag",
        "LockedDownRestrictedSitesZoneNavigateWindowsAndFrames",
        "CD_5A7FDF4BD2E1212A8A01E74B4FDC157480285641E8AADC2FDCB8D0A2D1720315.1088.779121350.1852",
        "CR_CCF174B484763861274B422B027A53D668C2557EB827A557AB0E7FF6CCAC8EF5",
        "{0a21480a-e35f-11d0-9692-00c04fc3358c}",
        "MDM_Policy_Config01_Storage02",
        "CD_054A38929ECC5F2B71B017259D5DF98C968C29C9039A37FA5C286398E463CDBA.156.3682654902.370",
        "OnBoardDevice",
        "Maximum thermal dissipation of the slot in milliwatts.",
        "MSFT_CliAlias.FriendlyName=\"LogicalDisk\"",
        "IL_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258.1164.378460097.247",
        "11 - InterDomain Trust Account -  A permit to trust account for a domain that trusts other domains.",
        "URLInfoAbout",
        "//  Purpose: Contains WDM classes that specify the HBA data to be exposed ",
        "The ErrorTime property contains the time that the last memory error occurred. This property is valid only when ErrorInfo is not set to 3.",
        "TimerExpirationEnd",
        "TPM_PIN_StartupKey",
        "Represents an auth proposal for Kerberos.",
        "SetByPrinterPropertyObject",
        "SettableParityCheck",
        "BypassProxyOnLocal",
        "The Win32_DCOMApplicationLaunchAllowedSetting class is an association between the Win32_DCOMApplication and the user sid's that can launch it",
        "_DH_WMP_DPF Flag",
        "ROOT\\Microsoft\\Uev",
        "MSNdis_TokenRingCurrentRingStatus",
        "PCI_COMP_INFO_BusNumber",
        "Ndis802_11PowerModeMAX_PSP",
        "RD_TRACE_FUNCTION",
        "Values: TRUE or FALSE.  If TRUE, daylight savings is presently being observed.  In most cases this means that the current time is one hour earlier than the standard time.",
        "RootThumbprint",
        "DeviceForm",
        "EVENT_TRACE_FLAG_QUERYEA",
        "HyperVisorEnabled",
        "{DE5051A7-BF27-48f1-BD12-07CADE92AEFD}",
        "C_5ECA63A2575A533106A3DA4D4E7D3593AF8C1DBA30A77246287C3734644E9810",
        "HardwareMinLinkRate",
        "EVENT_TRACE_FLAG_CLEANUP",
        "The maximum size, in bytes, of the lookahead segment if lookahead split is enabled.",
        "A Null return indicates the implementation (provider) does not implement this property. ",
        "Skewed",
        "object:MSFT_CliFormat",
        "FreePage",
        "BasicXml",
        "The LPR name of the printer.",
        "An array of elements identifying the boot order of the persistent boot configuration that shall be used during the next boot of the computer system, unless the OneTimeBootSource for the next boot is specified. The value of each element in this array is an index referencing an element in the array of StructuredBootString.",
        "Service not started",
        "Windows Server 2012",
        "CD_3E11F2867F2D534D95C0593A0AA32ECA612C606596AA91228C49611E4A1C3BBE.1371.1.22077",
        "DH Group 1",
        "MDM_Policy_Config01_SmartScreen02",
        "SampledProfile",
        "SubcategoryName",
        "8277EB1A0",
        "ActivationObjectName",
        "List of RSOP_ScriptCmd objects containing information about the scripts to be run.",
        "WmiTimeStamp",
        "Indicates if empty Replicaiotn Groups are allowed",
        "X86-Nec98 PC",
        "IpOptionsSupported",
        "Total number of uncorrected read errors",
        "ExtendedStatus",
        "EIA861",
        "VOLUME_MOUNT",
        "C_D9A10218F30FA4E428551F3E416442A7D38AB8762B28D40A8E89B4D3006D1DA2",
        "GetSchema",
        "Misc Flag",
        "NDIS FDDI Short Permanent Address",
        "lastWriteTime",
        "Firmware not compliant",
        "{8502C4D5-5FBB-11D2-AAC1-006008C78BC7}",
        "MSFT_StorageSubSystemToStorageEnclosure",
        "Starting (3) indicates that the job is moving from the \\'New\\', \\'Suspended\\', or \\'Service\\' states into the \\'Running\\' state. ",
        "IL_DE57F7AE8FB501996807E146319066676112A55DF9DC0135A1A8C6E4EBECC8B8.341.1.89245",
        "The SystemDirectory property indicates the system directory of the operating system./nExample: C:\\WINDOWS\\SYSTEM32",
        "EnablePacketQueue",
        "See CIM_RecordLog.CurrentNumberOfRecords for details.",
        "List of guids",
        "C_BBE16080A7EF2F0B1445053D0994143FB21FAF6CBC7F65EF8D2106E74618BE06",
        "Import Content Ratings Settings",
        "TimingType",
        "Allows filtering traffic to/from endpoints by certain kinds of virtual transports, rather than traditional tuples of addresses, protocols, and ports.",
        "Virtualization Config Info",
        "{1EF6898F-EDB3-4DA9-BBEA-EBBC3FAD87EB}",
        "HotFixID",
        "NS_876145C71900245306A149A8A7DAC3FB0D74027E586B2E97BEF112C2070090FD\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "PendingReboot",
        "1930 - Incompatible printer driver.",
        "MSFT_ExpressionValue_real64",
        "The ProcessorId property contains processor-specific information that describes the processor's features. For x86 class CPUs, the field's format depends on the processor's support of the CPUID instruction. If the instruction is supported, the ProcessorId property contains two DWORD-formatted values. The first (offsets 08h-0Bh) is the EAX value returned by a CPUID instruction with input EAX set to 1. The second (offsets 0Ch-0Fh) is the EDX value returned by that instruction. Only the first two bytes of the ProcessorID property are significant (all others are set to 0) and contain (in WORD-format) the contents of the DX register at CPU reset.",
        "The Win32_1394Controller antecedent reference represents the 1394 controller associated with this device.",
        "NdisFddiStateMaintenance",
        "AddByServiceSet",
        "The ExpectedBatteryLife property has been deprecated.  There is no replacementvalue and this property is now considered obsolete.",
        "HBA_EVENT_ADAPTER_ADD",
        "Whether MSS clamping is enabled for outgoing forwarded packets on this interface. Default is Disabled.",
        "HBAFCPScsiEntry",
        "SM_SetPersistentBinding",
        "\\\\.\\root\\standardcimv2:__Win32Provider.Name=\"NetQosCim\"",
        "Starting offset of the thinly provisioned or DAX partition is not aligned to a cluster boundary.",
        "Dll name or path",
        "This property returns whether at least one bluetooth device is found and is enabled on the device",
        "implemented",
        "TargetInstance",
        "The MediaLoaded property indicates whether a CD-ROM is in the drive.",
        "Receive Queue Parameters",
        "{FAF76B68-798C-11D2-AAD1-006008C78BC7}",
        "Examples: JP2: 1-2 Cache Size is 256K, 2-3 Cache Size is 512K, SW1-1: Close to Disable On Board Video",
        "SyncProviderPingEnabled",
        "2 = The application is applied to the user's profile, ",
        "CR_85779E8BAFE3789E38C6257CF29ACDF9D244A27016D22CDF8620CFDEE1A226EE",
        "CD_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D.1219.1946315906.3773",
        "WFP_TRACE_FE",
        "Read, Modify or All.",
        "Indicates the cause for RSC being disabled for IPv4 TCP packets.",
        "Network Access Protection context",
        "Msft_WmiProvider_AccessCheck_Pre",
        "Win32_WIN32_TSSESSIONDIRECTORYSETTING_Prov",
        "Load Balance policy supported by the iSCSI Initiator",
        "The number of outbound quick mode security associations (SAs) submitted by IKE that failed",
        "MSNdis_FddiShortMaximumListSize",
        "object:Win32_FolderRedirection",
        "This property indicates when a roaming profile was downloaded from server last time.",
        "DtcTransactionsStatistics",
        "Esp-auth",
        "Copy of the alert payload to be fired",
        "CPU management.",
        "SLActivate Flag",
        "A list of auth suites, in preferential order, to use when negotiating an SA.",
        "SetDefaultSearchEngine",
        "Win32_ScheduledJob",
        "`$m;`$m;",
        "C_50478FEF0FA679E50347C8BAB55834F418A1E60E2411E2B1CF088F78A1275598",
        "Ndis802_11Infrastructure",
        "The SupportsSpecialCharacters property indicates whether serial port control characters are supported. These characters signal events rather than data. These characters are not displayable and are set by the driver. They include EofChar, ErrorChar, BreakChar, EventChar, XonChar, and XoffChar.",
        "MDM_Policy_Config01_Maps02",
        "MemOrIo",
        "Specifies a trustee. Either a name or a SID (byte array) can be used",
        "MaxNumberOfPasswords",
        "CIM_BootOSFromFS",
        "R_39111DE6643E0CE135E3218054CABDAE5D22F63BCDD71E8E8F760C46C7306F9F",
        "CIM_Memory.ErrorInfo",
        "Example:S-1-5-21-1579938362-1064596589-3161144252-1006",
        "#define ISCSI_HBA_ISCSI_AUTHENTICATION_CACHE       0x00000002",
        "NewPassword",
        "{F27851CD-BBAC-11d2-85E5-0000F8102E5F}",
        "Values: TRUE or FALSE. A value of TRUE indicates the network connection will be automatically connected.",
        "SendScsiReadCapacity",
        "CIM_NumericSensor.LowerThresholdCritical",
        "Win32_SystemPartitions",
        "PFS Group plumbed in Ipsec policy.",
        "PageFault_MemReset",
        "RD_TRACE_RESERVED_19 Flag",
        "Hw Epp Write Count",
        "CD_7BF884F7361F0D677A40C5CD7F9E2139AF67CB14ACDB2E9D39E3D5ADFB888E91.1687.1.15243",
        "MDM_Policy_Result01_ServiceControlManager02",
        "{8502C4DE-5FBB-11D2-AAC1-006008C78BC7}",
        "GetDWORDValue",
        "Software licensing server URL for the binding certificate",
        "MSDAREM.1 formatted output (W)",
        "object:MSFT_StorageDiagnoseResult",
        "MsftUtils_DebugConstructor",
        "MaxPdCount",
        "Download -  Downloads TrueType fonts as soft fonts. This is the default action for printers that use the Printer Control Language (PCL).",
        "TM_SUPPORT",
        "The requested bandwidth of the Port in Bits per Second. The actual bandwidth is reported in LogicalPort.Speed.",
        "Association between StorageSubSystem and TargetPort",
        "The number of bits controllable in the VPI field of the cell header.",
        "MappingStrings",
        "Win32Registry|System\\CurrentControlSet\\Services|Parameters\\Tcpip",
        "A unique key identifying this ini file specification within its product.",
        "{981f2d80-b1f3-11d0-8dd7-00c04fc3358c}",
        "             specify this flag will delete the replaced profile. Without this flag, the replaced ",
        "Win32_SoftwareElementAction",
        "SamDeleteGrp_End",
        "Strict Source Routing",
        "OfflineFilesCacheEncrypted",
        "MapToAccount",
        "0xC0000003",
        "StackWalk_Key",
        "The status of the BranchCache Content Retrieval HTTP URL Reservation",
        "RealIfProfileId",
        "ASSERT Flag",
        "The minimum interval the power meter is able to average samples internally to produce the CurrentReading.",
        "CIM_InstDeletion",
        "CD_79FD2B1944A0E8569231538101AA02032B2AA1FD92C317847D2089CA52F4CD72.1151.3907305928.877",
        "C5: GroupNumber = 2, ConditionNegated = FALSE ",
        "MaxInboundReadLimit",
        "Application ID containing DCOM information for the associated application (string GUID).",
        "MSNdis_CoTransmitPdusOk",
        "{791ad1a2-e35c-11d0-9692-00c04fc3358c}",
        "SlotLayout",
        "Represents a logical grouping of physical disks that may be used to create virtual disks. These virtual disks can be created with different characteristics and levels of resiliency based on the number of available physical disks and the capabilities of the storage pool.",
        "FileIo_DirEnum",
        "Stats",
        "2.10.0",
        "InUseSlabs",
        "Win32API|Tool Help Structures|THREADENTRY32|tpDeltaPri",
        "{7be7579b-4370-4a75-857c-9e789d1aff8a}",
        "WindowStation",
        "Swarms",
        "System configuration information",
        "RegisterByParams",
        "NS_3D98EC37D63EBFB9210DB658120A818078461369A71EFFA3DDE47412F528D55E\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_0BF1F14F0E0C43957D66FE26E430827322F9091C1E5C92D04AB8BA791B9F67E0",
        "Power Plan",
        "The SupportsExpeditedData property indicates whether the protocol supports expedited data (also known as urgent data) across the network. Expedited data can bypass flow control and receive priority over normal data packets.",
        "The ReservedSystemPaletteEntries property indicates the current number of color index entries reserved for system use. This value is only valid for display settings that use an indexed palette. Indexed palettes are not used for color depths greater than 8 bits per pixel. If the color depth is more than 8 bits per pixel, this value is set to NULL.",
        "ChangeSystemTime",
        "The Archive property is a boolean value indicating that the file should be archived.",
        "NullSessionPipes",
        "An array of integers that specify the features supported by the video BIOS. For example, one could indicate support for VESA power management (value=6) or video BIOS shadowing (8). The value, 3, is not valid in the CIM schema since in DMI it represents that no BIOS features are supported.  In this case, the object should not be instantiated.",
        "Supported brightness levels",
        "MSNdis_RSSEnabled",
        "MapViewStart",
        "DesiredStateConfigurationProxy",
        "Folder",
        "The OEMEventCode property indicates the system power state defined by the original equipment manufacturer (OEM) when the EventType property of this class is set to \"OEM Event\", otherwise, this property is set to NULL. OEM events are generated when an APM BIOS signals an APM OEM event. OEM event codes are in the range 0x0200h - 0x02FFh.",
        "MIF.DMTF|Video|003.4",
        "MsftDiscFormat2StreamConcatenate_DebugDestructor Flag",
        "Removes one or more applications from trigger properties for a VPN connection",
        "The Name of the scoping System.",
        "BcdIntegerElement",
        "Fracture",
        "IPv4 Subnet Mask of the target PCSV device",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2484.660329875.368",
        "MsftMultisessionSequential_DebugConstructor Flag",
        "MsftDiscFormat2MsfAddress_DebugGeneral Flag",
        "real32",
        "Name of IP-HTTPs profile to enable for this site",
        "object:DnsClientPolicyConfiguration",
        "NDIS Query Statistics Info",
        "SidTypeUser",
        "Ndis80211TransmitAntennaSelected",
        "Bid2Etw_SQLOLEDB_1_Trace_TextW",
        "Example: Microsoft Windows 95.",
        "Select * from Win32_TerminalServiceSetting",
        "SamCompCreate_Start",
        "Modem device",
        "The FrameErrorCount property indicates the number of framing errors that occurred in the current session",
        "{44795701-a61b-11d0-8dd4-00c04fc3358c}",
        "EnumerateAdapter",
        "Service name at the address.",
        "CIM_SwapSpaceCheck",
        "SysAccount",
        "The type (boolean, integer or string) of the property.",
        "This represents a qualified partition device element.",
        "_DH_PLUGINS Flag",
        "GuidArray",
        "DSCP (RFC 2474) marking for inbound ICMPv6 traffic. Value must be <= 63",
        "Maximum supported size for AAL3/4 packets.",
        "ActiveInputVoltage",
        "UserDiskMaxSizeInGB",
        "Resolution indicates the ability of the sensor to resolve differences in the measured property. ",
        "ToFullPath",
        "CPAST",
        "Denotes whether this subsystem supports local snapshotting. This field must be true if the VirtualDisk::CreateSnapshot method is implemented.",
        "StorageElements",
        "Win32API|Device Context Functions|GetDeviceCaps|LOGPIXELSY",
        "Build Information",
        "The ObjectParameter property holds the o defining the extended status passed though provider's IWbemObjectSink :: SetStatus call, possibly NULL.",
        "The ChassisBootupState property indicates the enclosure's bootup state.",
        "CD_6AD386ADF7788A35467E769D3EC3DE89211503B8A449E2B53EAB5B8CCD719DFD.2033.3606027292.245",
        "CIM_ServiceAccessBySAP",
        "The ReleaseDHCPLeaseAll method releases the IP addresses bound to all DHCP enabled network adapters. WARNING: If DHCP ",
        "Win32_TerminalServiceSetting",
        "MSNdis_AtmReceiveCellsOk",
        "The nature of the product dependency. This property describes that the associated product must be installed (value=2) or must be absent (value=3) in order for the product to function.",
        "CallbackFunction",
        "C_20A86FF9BCE2704D3211C5DF2F6EE611B397EFC650CD0CC8097C4D642C5980FF",
        "DmaStopped",
        "Lifetime over which the address is preferred. The default value is infinite.",
        "{FAF76B88-798C-11D2-AAD1-006008C78BC7}",
        "MSFT_NetNeighbor",
        " The SoftwareElementState indicates the state of a software element ",
        "43006",
        "15 - 'Dormant': indicates that the subsystem is inactive. ",
        "Microsoft iSCSI Initiator: Initiator Class",
        "IL_B3082C3F9799617E93A60B0A5A46A9C812E71430D2C694055B03ADABB08B0D1C.2674.1006866635.262",
        "HBA_WWN",
        "Port State status information.",
        "Separate syncs are NOT supported",
        "Set the storage fault domain object maintenance mode.",
        "StopIfGoingOnBatteries",
        "CD_7450B933028ED3A9668E73BC07A8325B939DC7781D6560E2446E75795DDC2C3E.1534.1518831143.5117",
        "Contains the key to be deleted. ",
        "CreateBy",
        "CR_A4B7E1219FA76BD23A588641B4F3CEC1D9A3585F7F85B74432295927C547BE69",
        "MSFT_NetInterfaceTypeFilter",
        "The file system.",
        "Bell 103",
        "- The second sub-string is the country code, as specified in ISO3166. ",
        "PolicySourceUserAuthenticationRequired",
        "SavingsSize",
        "V1_DriverCompleteRequest",
        "The DragFullWindows property indicates whether the contents of a window are shown when a user moves the window.",
        "ROOT\\Microsoft\\Windows\\Defender\\MS_409",
        "ISA Compatible",
        "Read and Read-Ahead",
        "HTTPS",
        "AddPhysicalDisk",
        "Specifies the share name for this printer.",
        "SM_RefreshInformation",
        "MSFT_ReplicationCapabilities",
        "The MediaType property is the type of media used or accessed by this device.",
        "FreeSpaceCount",
        "The physical element which is a part of the FRU.",
        "100Base-FX",
        "Secure Boot",
        "SuspendJobById",
        "RestrictedSitesZoneAllowLoadingOfXAMLFiles",
        "Path can be used to open an operating system handle to the disk device.",
        "BIOS Characteristics Not Supported",
        "CIM_NetworkPort.OtherNetworkPortType",
        "CommercialId",
        "This class represents a processor affinity mask.",
        "Specifies the Audit Permissions for success. The permissions are a combination of one or more of the following:WINSTATION_QUERY, WINSTATION_SET, WINSTATION_VIRTUAL | STANDARD_RIGHTS_REQUIRED, WINSTATION_SHADOW,WINSTATION_LOGON, WINSTATION_LOGOFF, WINSTATION_MSG, WINSTATION_CONNECT, WINSTATION_DISCONNECT.",
        "Basic ISDN",
        "Whether forwarding is enabled for incoming packets on this interface. Default is Disabled.",
        "This parameter allows the user to specify the replica target subsystem.",
        "A textual description of the CIM_Setting object.",
        "{8502C4B5-5FBB-11D2-AAC1-006008C78BC7}",
        "SSP Flag",
        "RPC Server Fault Error",
        "ServerName",
        "The product code for the product to which this patch is applied.",
        "DESKTOP",
        "The Antecedent reference represents the IDE controller associated with this device.",
        "MSNdis_FddiAttachmentType",
        "LPCDRVR_TRACE_RESERVED_1d Flag",
        "The time of the remediation.",
        "Phase",
        "Virtual Address Space Usage",
        "C_0D4A09511C06326D5D345B08A0B467BA70A695848B2E0A8AE92A1F33516CC3D6",
        "{00000000-0000-0000-0000-000000000000}",
        "{89FEF2D6-654B-11d2-9E15-00C04F8EF481}",
        "MSFT_NetIPInterface",
        "InstallDate",
        "ParentKey",
        "CD_9FFC730BEA787E28FF305A66FE71BC4BDA5863470D337AF3119C48B654F08702.1747.2468415157.948",
        "Removes all license servers from the list of specified license servers.",
        "0 - 'Unknown': The operational status is unknown.",
        "MSFT_CliAlias.FriendlyName=\"SoundDev\"",
        "ResyncReplica",
        "C_E168D377E3EBDC80567E91D3F17E5FB581443E43A2B4D4956F85A552763C3781",
        "CACHE",
        "CD_33DCEF5A25E042E234D6018C36A73BB8BD2E0A0D570AA0A57D43D363A2232E3B.2201.1.15005",
        "A NEW SECURITY LAYER in LONGHORN.",
        "CIM_SoftwareElement.SoftwareElementID",
        "MSFT_TaskDynamicInfo",
        "I_84DAE394D72EEC44948504C5752A6FB488C2F34AF0DDE614A4D6BA8E4EF41579.1105.3603858765.242",
        "ref:MSFT_NetLbfoTeamMember",
        "ipAddress",
        "Descri",
        "EnergySaverBatteryThresholdOnBattery",
        "Scale Out could not be disabled for this storage object.",
        "The user settings",
        "1 - Other, by CIM convention, is used to indicate that the Severity\\'s value can be found in the OtherSeverity property. ",
        "MSI is supported.",
        "MSNdis_TransmitBufferSpace",
        "QPError performance counter missing",
        "Set iSCSI Initiator Load Balance Policies",
        "AvailableCapacity",
        "SMBIOS|Type 0|Embedded Controller Firmware Major Release",
        "RADSL",
        "Utf8WithoutMapping",
        "MIF.DMTF|FRU|002.7",
        "resumeOutputBookmark",
        "_DH_WMP_HME",
        "Application register",
        "AUTH Flag",
        "Read Clipboard",
        "CR_77DBF4A2C876542515BB91822C77D6AAB627C74A2589D8CBC4096845BC539307",
        "The name for the driver.",
        "TotalSwapSpaceSize",
        "BootDriveLetter",
        "GatewayCostMetric",
        "Contains slow network connection timeout parameters to be used for user profiles.",
        "oseconds",
        "Indicates the type of the embedded switch",
        "NumberOfCleanerSlots",
        "The AvailableVirtualSize property returns the free virtual address space available to this process.",
        "History",
        "ReSynchroniseOnNamespaceOpen",
        "Timed Power On Supported",
        "CR_55BF0CC0F072F8672008BA2E217FC98D14173100D32640D32F61CC0295647162",
        "{05c79d97-2fee-44c3-b680-843bb8fc14b3}",
        "MDM_DeviceUpdateCenter_Enrollment01",
        "I2O Boot Support",
        "OnlineDevice should return 0 if successful, 1 if the request is not supported at all, 2 if the request is not supported due to the current state of the Device, and some other value if any other error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are \\'translated\\' may also be specified in the subclass as a Values array qualifier. ",
        "{7EA56436-3F2F-3F63-A829-F0B35B5CAD41}",
        "The PortType property describes the function of the port.",
        "C_0A8460FC46C2746BD21F545AC61155DB7CAC54BE761314A2A7E02864EFA1BFE6",
        "Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwErrorControl",
        "8mm Metal Particle",
        "AllowDeviceDiscovery",
        "WPD_Perf",
        "TransportBytesSent",
        "ObHandleDuplicateEvent",
        "TrustedCA",
        "The MaxDataWidth property returns the maximum bus width of adapter cards that can be inserted into this slot, in bits. The value of the property is to be interpreted as follows:",
        "object:VpnConnectionTrigger",
        "TP_V2_TimerSetNtTimer",
        "CD_12C8B809AE9CE5F53FFB63FC457B4D2DCB7488DD14E84D1D82A5FA5D35BEFF46.2626.4073583792.118",
        "Operational Status status information.",
        "MaxPendingAccepts",
        "Returns the VpnConnectionTriggerApplication object that contains the trigger application settings. ",
        "MaxCachedCookies",
        "Represents the settings to be configured on a group or sync pair.",
        "__EventSinkCacheControl",
        "FileNotFoundCacheLifetime",
        "The hysteresis margin.",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.454126105.368",
        "Pool Paged Peak",
        "RefreshLicenseStatus",
        "Specifies the state of the teredo interface",
        "The Comment parameter specifies a message   to display in the shutdown dialog box and also stored as a comment in the event log entry.",
        "This property indicates the ref count of the profile. If the profile is loaded, the ref count is at least 1.",
        "EncryptionMethod (uint32)",
        "C_75840B9867302C265945D054719AA22E26645943E0473183701AB28A355B5161",
        "Region register",
        "CD_DCC2AE997AB356670D27AB6AF0A0DF5B38BE28906D897D91C86FB38CED159D17.1667.2814445947.376",
        "SAM Set Information User",
        "The number of multicast bytes transmitted without errors through this interface.",
        "The SCSITargetId property indicates the SCSI ID number of the disk drive.",
        "Detaches a Storage Spaces based virtual disk from the system. This operation is similar to Hide, however there is no need for target and initiator configuration since everything is done locally. Detaching a Storage Space will result in it's corresponding disk object to be suprise removed from the system. Note that detaching can happen in response to certain failure and warning conditions (such as failing redundancy, or thin provisioning capacity limits being reached).",
        "SamQueryDisplayInfo",
        "IdentifyingNumber",
        "HDSplitCurrentConfig",
        "pmPr|",
        "Rating System File Names",
        "C_9B6218EFA94C067C7A0C80C5056C3D58C66F39DA9385FB7012B7F51EB8C27ACA",
        "InterfaceTypes",
        "_DH_WMP_FIRMWARE_UPDATE Flag",
        "C_BB643341D226A49E491A828FD60D1BF2BD90CDEABA005283886D93DE233001D8",
        "Non Medium Errors",
        "Active size",
        "Fn;pFn;",
        "NDIS Protocol Unbind Notification",
        "Consortium for Service Innovation",
        "The Dependent reference represents the Win32_LogicalDisk containing the properties of a logical disk that resides on a physical disk partition.",
        "Error records",
        "The DoubleSpeedThreshold property contains one of two acceleration values. The sensitivity of the pointing device doubles (toggles from the first to the second value) when the pointing device moves a distance greater than this threshold value.",
        "CIM_PhysicalMemory.MemoryType",
        "{0F73ED53-8ED9-11d2-B340-00105A1F8569}",
        "ref:Win32_NetworkConnection",
        "HNet_ApplicationProtocol",
        "Number of successfully established RDMA connections on which an error occurred before being disconnected by local or remote client",
        "IgnoreDefaultRoutes",
        "TRC_ERROR Flag",
        "ref:Win32_Volume",
        "GetExpandedStringValue",
        "SMBIOS|Type 1|System Information|Wake-up Type",
        "PageDirectoryBase",
        "RSOP Precedence",
        "The device that is accessed using the device file.",
        "The status of the last attempt to synchronize this folder to the Offline Files cache.",
        "MSFT_ReplicationGroupToReplicaPeer",
        "If applicable, defines whether the server supports localserver32 activation.",
        "R_8A3B6432A229F674039F0136B188BB0F847AE08B53B1611977C2FC30461CBDDC",
        "Removed",
        "UdpIp_V1",
        "Security group membership that caused this folder to redirect",
        "I_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6.1489.549540612.321",
        "MSNdis_MediaInUse",
        "IPv6 Address Range",
        "SetDefaultAutoRunBehavior",
        "CIM_ExecuteProgram",
        "R_1F1219F96576A4588331D02100737379E76B59AFFFE01B2EACFBBB0DBCD4C75C",
        "LUAInstall: error 0x00000005 setting flags [{93AC9CB8-27D5-4482-BFDF-68F21C7454A3}]",
        "CompressionOn",
        "The Vector property indicates the vector of the IRQ resource. A vector contains the memory address to the function that will execute once the interrupt request is acknowledged by the CPU.",
        "The maximum number of multicast addresses the NIC driver can manage.",
        "Indicates the deduplication mode of the volume.",
        "Messages",
        "The ProviderOperation_AccessCheck property indicates the number of calls to IWbemEventProviderSecurity :: AccessCheck.",
        "Registry_HiveLink",
        "CD_1B55B55FA6B082DE82471ED3376542A1505C8C97D1118986FF01EC622C5CF23B.32.537794177.502",
        "Direction",
        "InteractWithDesktop",
        "LetAppsAccessCallHistory_ForceDenyTheseApps",
        "Stopped Printing",
        "R_60B2C39E9389EC16D58497FA8BDBAF35697A8853CDA423F037ECBE4502882230",
        "Boot device configuration",
        "Win32API|File System Functions|IOCTRL_VOLUME_ONLINE",
        "GroupMask1",
        "Win32_InstalledWin32Program",
        "AccountLogonLogoff_AuditGroupMembership",
        "Not Used",
        "Home Premium Edition",
        "UvhdRoamingPolicyXml",
        "DriverInfo",
        "TcpIp_V1_TypeGroup3",
        "An integer used to uniquely identify a paticular port",
        "Win32_PowerSettingDataIndexInPlan",
        "Per-Program",
        "ProvisioningType",
        "NumberOfIEPorts",
        "I_0A99BE060E23FF6761359B992B74BD229BF1DDB4BA0B1CEB20D3B086485592FC.2702.4240166095.285",
        "ResponsesReceived",
        "A TimeSpan that specifies the duration in which a time stamp is valid.",
        "IMAPI1 Shim",
        "{d0235521-1976-4480-a962-16aba137f34a}",
        "Indicates the Win32 Plug and Play device ID of the logical device.  Example: *PNP030b",
        "C_E6F405501CF9EB51604EF826550E0336D9FF9DAB805C48FA3ECE279D5B21648A",
        "The disk is read only.",
        "Wireless LAN",
        "An identifier for this product's application that can be used for telephone or offline activation. Returns null if a product key is not installed.",
        "AC Power Restored",
        "C_849BB872FA48C9D9F0979EF051B133EED262AD47FF263C164F3A538EED0B65F3",
        "Win32API|Service Functions|CreateService|lpPassword",
        "NdisAtmTransmitCellsOk",
        "Fire Detected",
        "TcpIPv4Enabled",
        "A GUID used to identify the Issuance License (IL) to the customer. The ILID is not unique, unless combined with the ILVID.",
        "MSFT_MpHeartBeat",
        "Active Desktop bit.",
        "Logical devices may be aggregated by a system. This relationship is made explicit by the CIM_SystemDevice association. ",
        "Win32API|Printing and Print Spooler Structures|JOB_INFO_4|TotalPages",
        "SupportsSubsystemRegistration",
        "RssOnPortsSupported",
        "C_C3440650E548BFF63B5539FA293CA94632CF3A6097074784DC3E6A84D3E44079",
        "CD_4BB71B6ADFF06C586A8BDF449E468900F2E5FA784A24501C7DD0806A9C51B570.1464.3207785886.441",
        "This property indicates whether this profile is loaded.",
        "A Win32_FolderRedirectionHealth object that represents the health of the user's redirected Pictures folder.",
        "Whether to require Encryption.  Dynamic encryption means that the first packet may be protected but not encrypted.",
        "NISEnabled",
        "MGR_TRACE_RESERVED_1a",
        "System Call Exit",
        "SystemConfig_V1_CPU",
        "An array of strings representing the descriptions for the registry keyword values used in EnumParameterRegistryValues.",
        "C_20BDCD5FC76289684890138F1E0F84424ECAE89F8B991F35AE342CA8A7F45BC7",
        "Point to Point",
        "file share. This field can be used to store extra free-form information, such as notes or details about the intended usage.",
        "WLAN Dialog Trace",
        "The SerialNumber property indicates the serial number of the volume. Constraints: Maximum 11 characters. Example: A8C3-D032",
        "#define ISCSI_LOGIN_OPTIONS_PASSWORD                    0x00000040",
        "Count of Login Accept Responses",
        "LoadUnloadCycleCount",
        "Win32_SoftwareElement",
        "{8ed60a3a-8c12-49c5-a518-fdf451bc10fc}",
        "__NamespaceModificationEvent",
        "LowerThresholdNonCritical",
        "WHEA Policy Management Interface",
        "NumberOfInsertionStrings",
        "32768..65535",
        "object:NamedPipeConnectionPoolSettings",
        "CIM_Realizes is the association that defines the mapping between a logical device and the physical component that implements the device.",
        "The HardwareAssisted property indicates whether the shadow copy was created by a hardware shadow copy provider.",
        "MDM_VPNv2_Manual03",
        "Write Corrected With Delay",
        "20260528152538.000000+000",
        "MIF.DMTF|Power Supply|002.12",
        "RINTER_INFO_2|pComment",
        "Rate limit for authenticated inbound IPv6 IPsec traffic.",
        "ProgramCounter",
        "LoginAcceptRsps",
        "The protocol/port filter applied to the rule.",
        "CIM_DiskPartition",
        "Total number of Performance States",
        "TimerRoutine",
        "The TTOption property specifies how TrueType(r) fonts should be printed.  There are 3 possible values:",
        "ReceivedBroadcastBytes",
        "ProcessingCommit",
        "{0827250D-BA3E-11d2-B361-00105A1F77A2}",
        "ref:MSFT_NetAdapterSettingData",
        "Count of Elements in SessionList array",
        "NS_E0090746586FF2B53E60090572D8F454B1EFCE84D6470FDDC572C5F523A110EF\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_8F59483D428B08AE2A177FAF77675A77C85F88DE7C8B3EB6EBF49ADE58E241BDa2aa",
        "CD_F31884BFB479ECDC8FA0C6525BD2E05B732CCD07D844062B2D8F0B23B81A2F45.1.4164975150.161",
        "CD_EAB06445AE40CB0AB3321BBA04962C98586E49396B67AFD5B74F4985163D9EC2.37.168300490.464",
        "MGR_TRACE_RESERVED_0d Flag",
        "Name of the package",
        "ProviderID",
        "C_4FC7350D0697D65B1585376855E9596964780B95A8CAA540BF3CC2CD97C19696",
        "SMBIOS|Type 18|Error Granularity",
        "ref:Win32_MemoryArray",
        "ETW session clock types.",
        "4a5&5",
        "Type of the interface",
        "ATA Port Driver Tracing Provider",
        "C_9D13D81A0232A3B9A054E304F017E99ED70EE31D77185E5048D602C8F68F1D2C",
        "RestrictedSitesZoneSecurityLevel",
        "BitsPerPel",
        "Incoming",
        "CurrentLanguage",
        "FlushBuffers",
        "CD_8BDD9C2AE81784F0CFF79A8F035B6CA9B5C2EC0B45383CE33CDD57DF061981E6.272.3851099599.1147",
        "BFED8",
        "551B2329B3A302DF92AC01FC",
        "CIM_IKESAEndpoint.AuthenticationMethod",
        "MIF.DMTF|Video|003.12",
        "Do not automatically make redirected folders available offline",
        "MsDtcWmi",
        "ref:Win32_Patch",
        "NS_59411655A8F95EE7BEABDFB898861DFA8E2BF23293A8AFE96B2E5BB236E7FE01\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_95CB120F7297824918CEA5A1263DB00A65E3AF757627DD3A88751B475FC39D92",
        "Example: Atdisk ",
        "The product code for the product of which this service control is a part.",
        "43021",
        "The error message format version",
        "SetIScsiIKEInfo",
        "Typical counters SMHBA_SASPHYSTATISTICS (9 counters) or MSFC_HBAPortStatistics (15 counters)",
        "ProxyAddress",
        "A persistent binding request included a bad or unlocatable FCP Target FCID",
        "NewPrincipalByUser",
        "FX_TRACE_RESERVED_18",
        "MSFT_NetIKEBasicAuthProposal",
        "classref",
        "CD_8467A5D32DFAA09A39BDC8BB8DDCC953CDC4A4C5E390EC615CB5FA0C07CF5251.297.580066819.1247",
        "Invoice",
        "The Win32_TSDiscoveredLicenseServer class provides details of the discovered license server",
        "C_66987DC488F04E3DC6BA6B1845D5EB313904DDD6D9EA97184EA6AED23E5B39CA",
        "TraceCreateClose Flag",
        "ref:CIM_MultiStateSensor",
        "C_65AD9D71C7F4EC93858B91DB3439405127306083D38D59BB8579B4F63675934C",
        "ElementToCheck",
        "InitiatorAddresses",
        "CD_ED63447AC10EFFD570567110ECFD7E57B65338C366F9DC0975F468A0220F367B.71.1079732042.287",
        "ConnectIPV6",
        "FX_TRACE_API",
        "FrontPanelResetStatus",
        "For DMTF defined instances, shall be set to 'CIM'.",
        "FUNC_TRACE",
        "MSFT_NetAdapterAdvancedPropertyElementSetting",
        "param",
        "Contains the ProgID for any version independent programs.",
        "ClassObject",
        "MSFT_NetAdapterPowerManagement_Offload_NS contains settings related to Neighbor Solicitation offloading.",
        "Storage health status change event",
        "This parameter allows the user to specify the replica target machine.",
        "GracePeriodRemaining",
        "FX_TRACE_DRVMGR",
        "C_48C8FF9D3F57E7744A3D1C2C52E57FC97BA717E184730EB1BDE77718DB3C9C93",
        "H#m;H#m;",
        "Enables Dynamic Fair-Share Scheduling: (0) Dynamic Fair-Share Scheduling is disabled, (1) Dynamic Fair-Share Scheduling is enabled.",
        "Requires fracture",
        "The Name property specifies the name of the user account on a particular domain or machine. ",
        "Canceled",
        "File configuration download manager class inheriting from OMI_ConfigurationDownloadManager",
        "IsKeyProtectorAvailable",
        "Create_New_Process_Group",
        "MDM_Policy_Result01_CredentialsUI02",
        "TR_SM",
        "The StartingAddress property contains the starting address of memory mapped I/O. The hardware resource identifier property should be set to this value to construct the mapped I/O resource key.",
        "The StandardDay property specifies the StandardDayOfWeekof the StandardMonth when the transition from daylight saving time to standardtime occurs on this operating system.",
        "SDBUS_DEBUG_RECOVERY Flag",
        "This method retrieved the Health Actions being perfomed on the Volume.",
        "The Win32_TerminalService class provides Terminal Service load balancing indicators.",
        "The Name of the class for which scoping is to be used",
        "ISO-Designated",
        "Join Domain",
        "RD_TRACE_WMI Flag",
        "Win32_TSSessionDirectorySetting",
        "SetStringValue",
        "MSFC_FC4STATISTICS",
        "Values: TRUE or FALSE. A value of TRUE indicates the protocol supports transmitting the data in fragments.",
        "This method returns the physical extents spanned by the storage tier.",
        "Silent Breakaway OK - Allows any process associated with the job to create child processes that are not associated with the job. ",
        "LS_CONNECTABLE_VALID_WS08R2_VDI",
        "This method for a given ReplicationType returns the supported Operations on a StorageSynchronized association that can be supplied to the ModifyReplicaSynchronization method.",
        "Registry_HiveInitialize",
        "SetBooleanElement",
        "0xEFFF0011",
        "NDIS Status Packet Filter Change",
        "NetBSD",
        "ref:CIM_SecurityAssociationEndpoint",
        "Win32_PowerSettingDefinition",
        "TXFRM Flag",
        "CD_2A4F98E46770D35357CEB6ADA3489C9F0FD306040FCD6B065CED71BECBE5700A.27.3354561968.395",
        "Win32_AllocatedResource",
        "MSNdis_PMAdminConfigParam",
        "MaxLifetimeSeconds",
        "Indicates the current operating conditions of the group. Unlike HealthStatus, this field indicates the status of hardware, software, and infrastructure issues related to this group, and can contain multiple values.",
        "The QuadSpeedThreshold property contains the one of two acceleration threshold values.  The system doubles the speed of the pointer movement when the pointer device moves a distance greater than this value.  Since this speed increase occurs after the DoubleSpeedThreshold has been met, pointer effectively moves at four times it original speed",
        "Time taken to process entire configuration.",
        "Sdbus",
        "HashCache",
        "JobState is an integer enumeration that indicates the operational state of a Job. It can also indicate transitions between these states, for example, \\'Shutting Down\\' and \\'Starting\\'. Following is a brief description of the states: ",
        "Indicates the client should locate hosted cache servers using service connection points.",
        "Packet - authentication is performed on all data received from the client.",
        "ClearOnDeallocate",
        "__win32provider.Name=\"Microsoft.AppV.AppVClientWmi, Version=10.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\"",
        "0005 setting flags [{C100BEA3-D33A-4a4b-BF23-BBE",
        "RD_TRACE_RESERVED_14",
        "C_5B2556AB9E26BA57F6C3EDFE9DDB3CD3C905F536AEA737972265B4CB89473B27",
        "STEALTHNOTIFIER",
        "The Msft_WmiProvider_ExecMethodAsyncEvent_Pre event class represents an event generated immediately prior to calling the provider's implementation of IWbemServices :: ExecMethodAsync.",
        "MDM_BitLocker",
        "ExclusionList",
        "Flush Buffers",
        "Values TRUE or FALSE.  If TRUE, then the job will be interactive.  If FALSE, then the job will not be interactive.",
        "6 = This assigned application is upgraded by an optional upgrade",
        "Win32_DfsNode",
        "Reboot",
        "HideFrequentlyUsedApps",
        "RestrictedSitesZoneAllowNETFrameworkReliantComponents",
        "The DeviceObject property is the Windows object manager name of the underlying storage device that supports the original volume.",
        "LogMessagesAtTransportLevel",
        "This class defines the port statistics thresholds that will cause a HBA_EVENT_PORT_STAT_THRESHOLD event to occur",
        "CD_FBD11BA7DCC0C416362AC2A1F8EEFD82230A37B2505B7C99363ED198FE2F89CA.25.772787412.2139",
        "RSOP_PolmkrLocalPrinterSetting",
        "CIM_RemoteServiceAccessPoint",
        "      </dsig:Transforms>",
        "ALPC_Wait_For_Reply",
        "FC-GS.INCITS-T11 | Platform | PlatformType",
        "TcpIp_V1",
        "The ServiceAccessPoint that is dependent on an underlying SAP.",
        "SDBUS_DEBUG_EVT_HANDLING",
        "The PCSystemType property indicates the nature of the PC a user is working with like Laptop, Desktop, Tablet-PC etc. ",
        "MaxTimeBetweenSyncs",
        "CIMV2",
        "The second authentication remote identity",
        "Major failure",
        "CD_9C256CE37E6F9177BC0EC95344373747E0112D20D664373933986EE480BE67C9.298.1385547623.1046",
        "Id that is globally unique to each instance of each adapter. This is the value reported by the MSiSCSI_HBAInformation class.",
        "This method removes one or more physical disks from the pool and returns all previously allocated space on the disk to the available capacity in the primordial pool.",
        "Provider can create remote elements using TargetPools",
        "NumberOfEntries",
        "This class represents any ODBC drivers that are to be installed as part of a particular product.",
        "OtherIdentifyingInfo captures additional data, beyond DeviceID information, that could be used to identify a LogicalDevice. One example would be to hold the Operating System\\'s user friendly name for the Device in this property.",
        "The description of the object that triggered the fault.",
        "CD_69F693B09761D259F9E36F2E07509E240E77C62CCA21F57F463D23C41F558900.316.842997153.3436",
        "A value that specifies when ExtendedProtection should be enforced.",
        "e taken.",
        "KerbAcceptSecurityContext",
        "Request",
        "CloudPrinterDiscoveryEndPoint",
        "42001",
        "NS_FE3EA006C3292950A76C2B5A0185D7DF99ADD6FD6502E0AC079E3A8650E76E3A\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_C52295624F06C940B122D80C080F06A7E8A3B72E8DBB8DAB3530E90B3C01E0C8",
        "CR_9FAFCCC688F5A73C3B168A2E3CFB29D7012E555844D21034E40221A532E99A1D",
        "#define ISCSI_SECURITY_FLAG_MAIN_MODE_ENABLED        0x00000004",
        "This method changes the deduplication mode of the volume.",
        "SnappingEnd",
        "object:MSFT_PrinterProperty",
        "{BD568F20-FCCD-B948-054E-DB3421115D61}",
        "DebugFilePath",
        "RemediationScheduleDay",
        "Note: Classes deriving from RSOP_PolicySettingBlocked must redefine 'precedence' as a key",
        "CurrentWorkerCount",
        "Describes which policy the server uses in order to determine when a connection is broken either due to network loss or time limits.",
        "NDIS ATM Receive Cells OK",
        "Allocated Space",
        "{07136e6c-c254-436d-a200-1404e98881b6}",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1196.579707988.368",
        "Set a setting to the current storage health. If the setting doesn't exist, it creates it.",
        "SODIMM",
        "MSiSCSI_PortalInfoClass",
        "Current Control Set",
        "Creates a storage tier template on the storage pool. This method is available onlywhen the SupportsStorageTierCreation property on the storage subsystem is set toTRUE. If it is set to FALSE, this method will fail with MI_RESULT_NOT_SUPPORTED.This method is also not supported for primordial pools.",
        "NDIS Token Ring Line Errors",
        "callresultdata",
        "Twinaxial",
        "Total time in seconds to complete off-line data collection activity",
        "DevicePasswordExpiration",
        "Int 17h, printer services are supported",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"SessionProvider\"",
        "WPD_TRACE_LEVEL_ASSERT",
        "More than 5 gateways specified",
        "EnableDiskFSS",
        "Locale",
        "Specifies whether local administrator is denied customizingof permissions",
        "Procedural Error",
        "InstallState",
        "{1E45DFA6-DB34-11d2-85FC-0000F8102E5F}",
        "ref:Win32_NTDomain",
        "\"Non-Recoverable Error \" indicates that this element is in an error condition that requires human intervention. ",
        "CopyMethodology specifies what copy methodology the copy engine uses to create and/or maintain the target element. Values are: ",
        "NetworkSecurity_AllowPKU2UAuthenticationRequests",
        "Process_V2_TypeGroup1",
        "Specifies whether the outgoing response's web message format has been explicitly specified.",
        "BcdStringElement",
        "Disables a binding to a network adapter.",
        "The SupportsFileBasedCompression property indicates if the volume supports file based compression as is the case with the NTFS file system.",
        "CI_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170",
        "A value that specifies whether messages are traced at the transport level.",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSPERMISSIONSSETTING_Prov\"",
        "WPDMTP_feature1 Flag",
        "{0669d100-066e-4e49-a68c-e05199596132}",
        "Indicates if UDP checksum offload is currently enabled for IPv4 packets on this Adapter.",
        "The ServiceMachine property identifies the machine currently servicing the shadow copy.",
        "ReportToPnP",
        "A concrete version of Collection. This class represents a generic and instantiable collection, such as a group of ComputerSystems (e.g., a pool of hosts available for executing Jobs). It is defined as a concrete subclass of the abstract CIM_Collection class, to be used in place of many specific subclasses that add no semantics. Note that when defining additional semantics for Collection that this class MUST NOT be subclassed. Specific semantics continue to be defined as subclasses of the abstract CIM_Collection. ConcreteCollection is limited in its use as a concrete form of a general collection or bag. It was deemed more prudent to create this concrete subclass than to change Collection from an abstract to a concrete class.",
        "587B5AB69BBBB9891",
        "Logging",
        "Sw Epp Read Count",
        "A persistent binding remove request included a binding which did not match a binding established by the specified port",
        "Interrupt Moderation of the adapter",
        "SAM Set Security Object",
        "IL_A0645C5482C6C0990FF3D834DE810EE73DD1C560AC29409CF0FE88CEBDDB1D73.311.2804001211.249",
        "senseInfoBuffer",
        "Specifies the name of the print queue to restart the job on.",
        "    // discoverySession      - session is being used only for discovery",
        "THREADS",
        "Multi-bit ECC",
        "WLANDLG_TRACE",
        "SPACES_StorageFaultDomainToStorageFaultDomain",
        "R_8BF7316094E8A80DC0D7725F4A2CC6D98B4E58683C02D8C287671872E3109F47",
        "The storage provider cannot connect to the storage subsystem.",
        "Msft_CliAlias.FriendlyName=\"ShadowStorage\"",
        "TRACE_UNITTEST",
        "MGR_TRACE_RESERVED_09",
        "SetOrExpireKTimer2",
        "Absolute",
        "Process_V0_TypeGroup1",
        "The Element reference represents the properties of a page file while the Win32 system is in use.",
        "Nonce",
        "SetIGMPLevel",
        "RSOP_IEFavoriteItemLink",
        "RemainingAppReArmCount",
        "PCSettingsSyncEnabled",
        "      <registryValue name=\"ActivateOnHostFlags\" valueType=\"REG_DWORD\" value=\"0x00000001\"></registryValue>",
        "C_147F0D132856028790BD82BB481BC269758A25AA87CD8C1E0071C39359DE0C51",
        "The ResultCode property reveals the HRESULT code returned from the initialization process.",
        "ComputerNotificationsValue",
        "Example: 10.",
        "MaxSrqCount",
        "ref:Win32_TSSessionDirectory",
        "StorageConnectionType",
        "VolumePath",
        "0 - Script -  A logon script executed. This value must be set for LAN Manager 2.0 and Windows NT/Windows 2000.",
        "Win32_WIN32_TSPERMISSIONSSETTING_Prov",
        "{85be837c-2041-11d4-97eb-00c04f79c403}",
        "KVc%f",
        "Inproc",
        "Device Removal",
        "Association between a subsystem and replication group",
        "VESA Power Management Supported",
        "ref:CIM_LogicalDevice",
        "AllowPinnedFolderNetwork",
        "DHCPServer",
        "MemoryDevices",
        "Entries",
        "{ABEE8C61-A43F-4088-0081-9D00B3FF6545}",
        "The Win32_PnPDevice represents an association between a device (known to Config Manager as a PnPEntity), and the function it performs. Its function is represented by a subclass of the logical device that describes its use. For example, a Win32_Keyboard or Win32_DiskDrive. Both referenced objects represent the same underlying system device - changes to resource allocation on the PnPEntity side will effect the associated Device.",
        "IPType",
        "TP_V2_TimerSet",
        "\"Dormant\" indicates that the element is inactive or quiesced. ",
        "KeyManagementServiceDnsPublishing",
        "object:MSFT_StorageSetting",
        "MSDAPRST.1",
        "SetTcpNumConnections",
        "Self-test routine in progress.",
        "GetKeyProtectorFriendlyName",
        "RequirePasswordWhenComputerWakesOnBattery",
        "AllowPrinting",
        "The Disable method disables SR on a drive.It returns a COM error code.",
        "{2504b6c2-1fa5-11d4-97eb-00c04f79c403}",
        "Specifies the logical device that is associated with, and accessed using the referenced CIM_DeviceFile.",
        "0xEFFF0043",
        "CD_18F346BD214F217E447A1FFE3109B06E13553A39E553F4F4B66A2D5285DF9EF5.2088.3958427728.7338",
        "Get the number of stability metric records",
        "Win32_OfflineFilesDiskSpaceLimit",
        "CD_009060D2904B4B02AF55083DEF7BC672283599AF1BEDA6D3B9EC703CB3D5B011.38.1728723065.472",
        "ref:CIM_MediaAccessDevice",
        "ref:CIM_VideoBIOSFeature",
        "CD_8348E5895FE4B45964F288F6208DF14CD383D0A357608E0BFF28F226F0190D45.2426.1486326943.122",
        "MSFT_CliAlias.FriendlyName=\"DesktopMonitor\"",
        "AllowDynamicVirtualization",
        "ClearAfter",
        "CR_E6555E0E3A2A0EB36147D0BA2B88FF99C450AC95610E6A4CA8EA619881318FDC",
        "Real Time Clock Failure",
        "Shutdown",
        "The initiator service did not respond to the request sent by the driver.",
        "WakePatterns",
        "Parallel Port PS/2",
        "AllowCortanaAboveLock",
        "1 - 'Other' indicating that the recovery action will be specified in the OtherRecoveryAction property ",
        "DescriptionLength",
        "SetSetting",
        "A Win32_FolderRedirectionHealth object that represents the health of the user's redirected Downloads folder.",
        "Environmental Error",
        "0xD00A",
        "Select * from Win32_StartupCommand",
        "4 - 'Synchronized': For the Mirror, Snapshot, or Clone replication, the target represents a copy of the source. ",
        "Win32_NamedJobObjectStatistics",
        "NetworkAdapterMacList",
        "Maximum time taken to process a request over this connection",
        "29013152-7F77-4A8A-A8BB-E1F24DECE9F7",
        "Sets the ProfilePath for the machine.",
        "Delivery Flags",
        "The Name property indicates the filename of the startup command.",
        "Eligibility",
        "{8502C58F-5FBB-11D2-AAC1-006008C78BC7}",
        "Base Units",
        "This is the error code if the action failed. This should be set to 0 if the action was successful. This should be NULL until the action has completed.",
        "{E67E1BDB-D130-4143-9EB2-8BEE1899FD52}",
        "MIF.DMTF|Temperature Probe|002.13",
        "I_A149399DE5D286F444C4B111636DFBC68048E4FDC5152AA24ED98EA642F0ABAF.2457.373749567.361",
        "The name of the property set on the printer.",
        "Win32_WMIElementSetting",
        "A Boolean value that specifies if the credential supports interactive negotiation.",
        "The protocol used by the controller to access 'controlled' devices.",
        "The WindowsVersion property indicates the version of Windows in which the process is running.",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_302159DD437DF31C3447740E0D66617756BB40FBE840878868510D22B9CA061821d771140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "Minimum Block Size",
        "The PrintProcessor property specifies the name of the print spooler that handles print jobs.",
        "Service Request Timeout",
        "ConnectPrinterAtLogon",
        "0 - 'Unknown' ",
        "GetPackageVersion",
        "Unable to connect to defrag engine",
        "0 for 8 ",
        "Maximum allowed time for Active session in milliseconds where 0 implies NEVER.",
        "MSNdis_StatusNetworkChange",
        "R_8BC6339FCF5E7E877887AF33D8907FEF60BF3232B42D18741672CB93E5378C2F.1134.4208802927.536",
        "0x00000010",
        "PC-98-Hireso",
        "Power Supply",
        "Integrity method plumbed in IPsec policy.",
        "The DeviceID property contains a string uniquely identifying the USB controller from other devices on the system.",
        "The DomainControllerName property indicates the computer name of the discovered domain controller.",
        "SourceServer",
        "The physical element which is a part of the product.",
        "Sint64",
        "Secure proxy server address and port.",
        "The CurrentSRAM property indicates the types of Static Random Access Memory (SRAM) that being used for the cache memory.",
        "Windows cannot verify this device's resources.",
        "Authentication Failed",
        "C_FF26EE1E822090646FAD145AA9A6AA2ADDD373CED2E3B2B3D92A588873B3BEC9",
        "CD_4B73D56414C32450B76C83F50259BEF1BF1973367F51A9AA685F527A570A98B1.1185.248449445.290",
        " The initiator and target negotiate the maximum time, in seconds after an initial wait (Time2Wait), before which an explicit/implicit connection Logout or active task reassignment is still possible after an unexpected connection termination or a connection reset.",
        "GpoName",
        "LicenseServer",
        "The Antecedent reference represents the session which is related to the process.",
        "AllowFailed",
        "000:000",
        "Designates one or more destination MAC addresses to filter on.  Network traffic is logged when the filter matches. ",
        "{B5BD98B7-0201-11d1-A50E-00A0C9062910}",
        "Import Authenticode Security Info",
        "August",
        "IsLocked",
        "CIM_Indication",
        "CapabilitiesChanged",
        "40004",
        "Processors",
        "CD_BC1364958E3C7F9CA5ABA0C9A15549E0C0B0F96B96EE058473CACD93E1EABD27.1088.1259441278.1454",
        "TrustedCAType",
        "Storage Device Failure Prediction Status",
        "C_AC11DDCF9F71868BCCF23A662420DD51F76B4387A8230D6D41F7DBED8D2981ED",
        "Win32_ProgramGroupContents",
        "ConfigurationPath",
        "{45350D79-4497-42f1-BD1B-83587575B91A}",
        "CR_C0C025C38981E58EE50CB7BB4E4786CBA14FD933E638861EA3A6A2E0C806211E",
        "StatusCode",
        "The QuotaNonPagedPoolUsage property indicates the quota amount of non-paged pool usage for the process.",
        "6 - CIM_ERR_NOT_FOUND. The requested object could not be found. ",
        "The time that the job was submitted to execute. A value of all zeroes indicates that the owning element is not capable of reporting a date and time.",
        "E561334.2067.3342357913.858",
        "CD_F69D8029CE443505782739E5EA30F705BD18A050DBF4E379EF0B690D5B10D87B.2087.966010337.3142",
        "BlockingRequestsRejected",
        "I_C1B039C6B15CB1268319C147066B90BAE1F5E0DA59EE23E8DFE59CEDEE8D5513.761.1.144923",
        "{0 = none, 1 = ACPI 1.0, 2 = ACPI 2.0",
        "This method allows a user to set the description field of the storage subsystem.",
        "ref:MSFT_NetAdapterStatisticsSettingData",
        "PhyCounter",
        "LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls",
        "The State property indicates the status of the node.",
        "\\\\.\\root\\subscription:__Win32Provider.Name=\"NTEventLogEventConsumer\"",
        "y,BQp",
        "CIM_IPNetworkIdentity.IdentityType",
        "Token Ring 802.5",
        "MGR_TRACE_RESERVED_15",
        "A boolean value that specifies the behavior for suppressing failures of writing to the audit log.",
        "The Command property indicates the string representing the command line run by the startup command.",
        "BreakAll",
        "GetByPrinterName",
        "Denotes the previous health status of the source object.",
        "CD_020D216315EBE851D1E95EB38EBC3A47071878BADCF464608068D12F0A2A6B6D.2539.2528994836.492",
        "FileAttributes",
        "BaseProcessorGroup",
        "OffloadType",
        "Another volume optimization operation is currently in progress on the volume.",
        "LetAppsAccessLocation_ForceAllowTheseApps",
        "The Dependent reference represents the session using the resource.",
        "{418ca16d-3937-4208-940a-ec6196278085}",
        "LockMemory",
        "MSNdis_WmiIPSecOffloadV1_IPv4AH",
        "The StartService method attempts to place the service into its startup state. It returns one of the following integer values:/n0 - The request was accepted./n1 - The request is not supported./n2 - The user did not have the necessary access./n3 - The service cannot be stopped because other services that are running are dependent on it./n4 - The requested control code is not valid, or it is unacceptable to the service./n5 - The requested control code cannot be sent to the service because the state of the service (Win32_BaseService:State) is equal to 0, 1, or 2./n6 - The service has not been started./n7 - The service did not respond to the start request in a timely fashion./n8 - Unknown failure when starting the service./n9 - The directory path to the service executable was not found./n10 - The service is already running./n11 - The database to add a new service is locked./n12 - A dependency for which this service relies on has been removed from the system./n13 - The service failed to find the service needed from a dependent service./n14 - The service has been disabled from the system./n15 - The service does not have the correct authentication to run on the system./n16 - This service is being removed from the system./n17 - There is no execution thread for the service./n18 - There are circular dependencies when starting the service./n19 - There is a service running under the same name./n20 - There are invalid characters in the name of the service./n21 - Invalid parameters have been passed to the service./n22 - The account which this service is to run under is either invalid or lacks the permissions to run the service./n23 - The service exists in the database of services available from the system./n24 - The service is currently paused in the system./n",
        "NdisPhysicalMedium",
        "MIF.DMTF|Temperature Probe|002.8",
        "Power Consumption",
        " 0 - 'Healthy': All replicas are in a healthy state. ",
        "NumericParameterMinValue",
        "LUAInstall: error 0x00000005 setting flags [{73AD6842-ACE0-45E8-A4DD-8795881A2C2A}]",
        "CIM_IKEProposal.OtherCipherAlgorithm",
        "32780",
        "CreateNewConsole",
        "Indicates the tolerance of the sensor for the measured property. Tolerance, along with resolution and accuracy, is used to calculate the actual value of the measured physical property.  Tolerance may vary depending on whether the device is linear over its dynamic range.",
        "AllowLocalPolicyMerge",
        "CR_A53803A976BCA3FFB16063ACA85E663ADBA78B63EC0DAF8A23C68DAD672A3EF9",
        "Logs the error and continues with the startup operation.",
        "EnabledForUser",
        "MDM_LanguagePackManagement_Install01_01",
        "CD_05C8462B4A570021DD79117F0A18597CFCABA57FA3361AE21ECBD780B8BC0A9B.2531.148590190.473",
        "SampledProfile_V1",
        "CR_A0A150CA5213FD3CBDE2DB5507EB556997D615915D27644E5F01AB072F205064",
        "3 - 'Offline All': All newly discovered disks remain offline and read-only.",
        "MI_ERRORCATEGORY_INVALID_RESULT",
        "{4731F899-71CB-11d1-A52C-00A0C9062910}",
        "16 - 'Supporting Entity in Error': This status value does not necessarily indicate trouble with the volume, but it does indicate that another device or connection that the volume depends on may need attention.",
        "PolicySourceSelectTransport",
        "Library Loader New/Dependence DLL Load Event",
        "MSFT_CliTranslateTable",
        "Power Off",
        "CR_D64B12C2A619E8EC9F45DCE9E49A35E068B0A85B0C1FC30DB6BB343CD56AC3E2",
        "An association between a FileSystem and a Directory which indicates that the Directory is being attached to the FileSystem. The semantics of this relationship require that the mounted Directory be contained by a FileSystem (via the FileStorage association) that is different from the FileSystem referenced as the Dependent. The Directory's containing FileSystem could be either local or remote. For example, a LocalFileSystem on a Solaris ComputerSystem can mount a Directory from the FileSystem accessed via the machine's CDROM drive, i.e., another LocalFileSystem. On the other hand, in a 'remote' case, the Directory is first exported by its FileSystem, which is hosted on another ComputerSystem acting (for example) as a file server. In order to distinguish these two types of Mount, it is recommended that a CIM_Export association always be defined for the remotely accessed/mounted Directories.",
        "Specifies whether you want Internet Explorer to remain your default Internet browser, even if you install additional Internet browsing software.  When this check box is selected, each time Internet Explorer starts it checks to make sure it is still registered as the default Internet browser. If another program is registered as the default browser, Internet Explorer asks whether you want to restore Internet Explorer as your default browser.",
        "Web Server Edition",
        "SAM Enumerate Groups In Domain ",
        "TRACE_CLASS_BINDING Flag",
        "Win32API|Service Structures|SERVICE_STATUS|dwControlsAccepted|SERVICE_ACCEPT_STOP",
        "8..32767",
        "The SetWINSServer method sets the primary and secondary Windows Internet Naming Service (WINS) servers on this TCP/IP-bound network adapter. This method is applied independently of the network adapter. The method returns an integer value that can be interpretted as follows: ",
        "CD_CC0ACF58FA3646F311BC16A78942AC6DB48973323025BC27052C3593D5CE6061.1999.3122297759.1752",
        "Win32_NetworkProtocol",
        "__DERIVATION",
        "This method allows a user to set the SupportsAutomaticObjectClustering field of the storage subsystem.",
        "IntranetZoneAllowAccessToDataSources",
        "VolumeSize",
        "CD_35B1B65B914DF07FAC7860C3407AEAACB382311D5C7C7979B2E9A007C56D4FA3.73.3266986208.194",
        "The ending address where the BIOS is located in non-volatile storage.",
        "Number of video pages supported given the current resolutions and available memory.",
        "Name of device powered off",
        "RenameByObject",
        "Segment Number",
        "AcceptIPV4",
        "78F4FA18-EE46-4D4C-AB9B-8CC0D42B7038",
        "SyQuest Disk",
        "This parameter is an array of initiator addresses. For each address contained in this array, a corresponding initiator ID instance should be created and then associated with this masking set.",
        "_DH_WMHTML Flag",
        "Defines the IPv6 USO encapsulation settings for the Adapter.",
        "Humidity",
        "Create_Default_Error_Mode - Newly created processes are given the system default error mode of the calling process instead of inheriting the error mode of the parent process.  This flag is useful for multi-threaded shell applications that run with hard errors disabled.",
        "IsRequestFormatSetExplicitly",
        "{BE46D060-7A7C-11d2-BC85-00104B2CF71C}",
        "{791ad19b-e35c-11d0-9692-00c04fc3358c}",
        "EnumValues",
        "NumberOfFailures",
        "FD SSDP Trace",
        "SMBIOS|Type 32|System Boot Information|Boot Status",
        "The GroupComponent reference represents the Win32_ComputerSystem containing the properties of the computer system on which the service exists.",
        "Fixed hard disk",
        "EVENT_TRACE_FLAG_V",
        "WINSEnableLMHostsLookup",
        "43019",
        "The QuantumType property specifies either fixed or variable length quantums. Windows NT 4.0 Workstation/Windows 2000 defaults to variable length quantums where the foreground application has a longer quantum than the background applications. Windows NT Server defaults to fixed-length quantums. A quantum is a unit of execution time that the scheduler is allowed to give to an application before switching to another application. When a thread runs one quantum, the kernel preempts it and moves it to the end of a queue for applications with equal priorities. The actual length of a thread's quantum varies across different Windows platforms. For Windows NT/Windows 2000 only.",
        "nnection.",
        "SMBIOS - Type 17 - Attributes. Represents the RANK.",
        "QualifierFormats",
        "Win32API|Multimedia Structures|WAVEOUTCAPS|szPname",
        "DOT11_RECEIVE Flag",
        "object:MSFT_SmbShare",
        "Example: 2",
        "The Path property is a string representing the path of the file. This includes leading and trailing backslashes. Example: \\windows\\system\\",
        "{e43445e0-0903-48c3-b878-ff0fccebdd04}",
        "VMware ESXi",
        "The Win32_QuotaSetting class contains setting information for disk quotas on a volume.",
        "Maximum supported size for AAL1 packets.",
        "Example: 8  ",
        "MSFT_FileDirectoryConfiguration",
        "Specifies that split tunnel should be enabled for the VPN connection profile. ",
        "This indicates how the language was matched to the system: ",
        "ref:CIM_DeviceFile",
        "Detected",
        "The value for ReadCacheSize is outside of the supported range of values.",
        "Designates one or more Source IP addresses to filter on.  Network traffic is logged when the filter matches. ",
        "MSFT_StorageModificationEvent",
        "SYSID_1394_DATA_GUID",
        "z/Architecture base",
        "TM_INTRANET Flag",
        "C_63A1FE81FBEC96DF829C5431EBEA9F1CBB9A0D22D4B1BBC01BCA21BBDA82E9B0",
        "Timer Routine",
        "WD_LOG_FLAG_INIT Flag",
        "MSNdis_QueryPhysicalMediumTypeEx",
        "The Computer property references the computer from which the event was generated.",
        "PortableDeviceClassExtension_f2",
        "tagNetworkItemFactory Flag",
        "An aggregated setting.",
        "LPC_TRACE_RESERVED_0b Flag",
        "Windows Server 2003, Backoffice Edition",
        "{464FFAB5-946F-11d2-AAE2-006008C78BC7}",
        "The CreateFolder action creates empty folders for components set to be installed locally. The removal of these folders is handled by the RemoveFolders action. When a folder is created (and didn't already exist), it is registered with the appropriate component id.",
        "OnAccessProtectionEnabled",
        "Service Control Manager",
        "RequestID",
        "Requests that the Device re-establish its configuration, setup and/or state information from a backing store. This is handled more generally by the ConfigurationData subclass of SettingData. Therefore, this method is deprecated. ",
        "MDM_Win32CompatibilityAppraiser_WindowsErrorReporting01",
        "MSFT_CliAlias.FriendlyName=\"CDROM\"",
        "Failover clustering was enabled for the storage object but it failed to come online.",
        "StackWalk Event",
        "Symbolic name such as Tape0",
        "Compression Enabled",
        "Configure driver\\'s properties for one or more installed ODBC drivers.",
        "C_3185D5C87B795C19200377606F945624F3779B631EE5626D7BE05E1CE6DB71A9",
        "MessageEncodingBindingElement",
        "Highest USN used on this directory server. Used by directory replication",
        "NS_5456CA76306BB18057C7C64D8BB2414E19DC9CF4F51E2760534CB23439D79B06",
        "HOSTPROC_RESERVED_18",
        "CIM_LogicalDevice",
        "Win32Registry|System\\CurrentControlSet\\Services|Parameters|DefaultGateway",
        "    ISCSI_ENCRYPT_AES_CTR = 2              ",
        "MIB.IETF|Printer-MIB.prtInputMediaName",
        "Win32_MemoryArrayLocation",
        "MSNdis_NotifyAdapterArrival",
        "0x00000002",
        "TransitionOffline",
        "MEM_ERROR_STATUS is valid",
        "41010",
        "iScsiFlagEnum Flag",
        "Describes which policy the server uses in  order to retrieve the remote control settings.",
        "BuffersWritten",
        "C_80675749A482112913F21FDBD7D7D7162BF42E8F9D4DFDC3F2A040FA1BE63D51",
        "23 - Password Expired - Indicates that password has expired.",
        "The MfrAssignedRevisionLevel property indicates the manufacturer assigned firmware revision level of the CDROM drive.",
        "Manufacturer of this software element",
        "CD_4FD2270AA7CC321848B51530B7A77A9E39B5486B55CE0C09A2B597A1F1FCE1E6.291.1812066129.5662",
        "object:MSFT_NetAdapterAdvancedPropertySettingData",
        "DisableKTimer2",
        "AuthenticationLevel",
        "APM Support",
        "TcgLog",
        "AllowLockedDownIntranetZoneTemplate",
        "MI_ERRORCATEGORY_DEVICE_ERROR",
        "object:MSFT_NetAdapterEncapsulatedPacketTaskOffloadCapabilitiesEx",
        "3 - 'Sync': create and maintain a synchronized copy of the source. ",
        "CD_5DCEADFA575A67B8870603880BD491602DCD3BD7BDE6B9896E3244EBC7BD1866.314.3758602078.230",
        "MSFT_TargetPort",
        "C_79CE5C3FFCFDB2E387AFB15F738C96DF562D23EEC0B9CE854EFF2796A5403198",
        "Win32API|Tape Backup Structures|TAPE_GET_DRIVE_PARAMETERS|FeaturesHigh",
        "{BFA655DC-6C51-11DA-8BDE-F66BAD1E3F3A}",
        "Style",
        "SetMinimumEncryptionKeySize",
        "PolicyRuleCreationClassName",
        "Example: Memory Array 1",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Control\\Class|ErrorControl_Forced",
        "CredSource",
        "Invalid state transition",
        "ref:Win32_CacheMemory",
        "RecoverBadSectors",
        "IPv6Address",
        "WSAT Trace Provider",
        "Select * from Win32_ShadowStorage",
        "{6e3ce1ec-b1f3-11d0-8dd7-00c04fc3358c}",
        "Acpi Processor Id",
        "NewState",
        "TcpIp_SendIPV6",
        "CIM_IKEAction",
        "MDM_ConfigSetting",
        "Supports Cluster Shared Volume",
        "ipsecFilterReference",
        "IPv4TransmitEncapsulation",
        "object:MSFT_NetAdapterSriovCapabilities",
        "Returns all policy settings for Predictive Failure Analysis",
        "{AD3C1FA2-DB36-11d2-85FC-0000F8102E5F}",
        "MDM_EnterpriseAPN_Settings01",
        "TRACINGDBGPRINT",
        "Specifies the property values of the ODBC DSN to be deleted. This is an array of keys to be removed.",
        "SectionKey",
        "PendingConfiguration",
        "I_B93E6686A3652ED68A2C315C7A4538886FE8CF7FE0CACBC7828D45201F16DD39.1976.3537722519.185",
        "fileSystemPath",
        "MSFT_StorageFaultEvent",
        "A power setting definition.",
        "VirtualMemory",
        "HOSTPROC_RESERVED_1a",
        "MDM_Reporting_SecurityAuditing01_RetrieveByCount02",
        "C_353ED06D06D3F543C1F82745622C061EF12A64D07607F4A41BBE9C01357C9257",
        "Power consumption",
        "Win32_SystemBIOS",
        "Adds a new republication cache file to increase the amount of storage available on a hosted cache server.",
        "The maximum size of the local file to which event capture traces will be written to, in MB. Only valid when CaptureMode equals SaveToFile. Minimum value is 1. When set to 0, there is no limit on the file size.",
        "Win32_Environment",
        "Indication of whether the modem supports call-back",
        "PNP_INFO_LEVEL Flag",
        "ServicePackInEffect",
        "TRACINGHANDLE Flag",
        "Assigned",
        "SMBIOS|Type 17|Configured voltage",
        "object:MetadataExporter",
        "RefreshTimerValue",
        "An array of free-form strings providing more detailed explanations of any mime types that are supported by the Printer. If data is provided for this property, then the value 47, \"Mime\", should be included in the LanguagesSupported property.",
        "The DeadGWDetectEnabled property indicates whether dead gateway detection occurs.",
        "Support",
        "SetQualifiedPartitionDeviceElement",
        "Describes a BranchCache cache",
        "0x8005004C",
        "DUE_SAMPLES",
        "Script file or executable to run when the button is pressed.",
        "The product which is a part of the FRU.",
        "PartitionInfoExtension",
        "Auto Configuration URL",
        "MoveClient",
        "The MediaLoaded property determines whether the media for a disk drive is loaded.  ",
        "MDM_Win32CompatibilityAppraiser_WerConfigurationDiagnosis02",
        "ref:CIM_ManagedElement",
        "      <securityDescriptor name=\"WRP_REGKEY_DEFAULT_SDDL\"></securityDescriptor>",
        "The total number excess file fragments on the volume.",
        "TransactionId",
        "Constraint type",
        "31     This device is not working properly because Windows cannot load the drivers required for this device.",
        "SecondSPI",
        "This field denotes the specific error code used for 'Cache out of date'.",
        "The world wide port name of the virtual port",
        "BootupState",
        "The refresh mode for the server. Valid values are Pull, Push and Disabled.",
        "Datacenter Server Core Edition",
        "ref:MSFT_NetAdapterAdvancedPropertySettingData",
        "NdisStatusDot11RoamingCompletionIndication",
        "MSFT_CliAlias.FriendlyName=\"DESKTOP\"",
        "MinimumAveragingInterval",
        "CD_D8FA39278C1247AB8B1FBB10D8F82DA6DF57FDCA81312F4541EF472290E1F3B0.1736.77039531.508",
        "CD_186915C028DB302F51311CBCC5A8139806C4A3DD8133E0744A122DF58FD5C571.2602.4198066975.281",
        "C_13D55C842CDBA0C119A52B652E2B026F106F2E9BE68DD61A338E909E5F70C55C",
        "CR_311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        "MDM_Update_ApprovedUpdates01_01",
        "ResponseFormat",
        "Options 3",
        "Initiator Error",
        "NotRequired",
        "The multicast address list on the NIC enabled for packet reception.",
        "AccessMask",
        "{8502C529-5FBB-11D2-AAC1-006008C78BC7}",
        "#define HBA_EVENT_PORT_BROADCAST_D04_7  0x20a",
        "LastErrorCode captures the last error code reported by the logical device.",
        "13 - The service failed to find the service needed from a dependent service.",
        "AffectedStorageObject",
        "This field indicates the rotational speed of spindle-based physical disks. For solid state devices (SSDs) or other non-rotational media, this field should set to 0. For rotating media which has an unknown speed, this field should be set to -1 (UINT32_MAX).",
        "PNP_REGISTRY_WARNING_LEVEL",
        "useIEForFTP",
        "MSFT_DNSClientCache",
        "The Win32_LogicalDiskRootDirectory class represents an association between a logical disk and its directory structure.",
        "C_B7D88CBAAF2C338213E1E72001B6814092CBE165351937E6CEF7D675A2947B58",
        "Normal - Indicates a normal process with no special scheduling needs.",
        "Dial Up State",
        "PortableDeviceTypes_Serialization Flag",
        "The Win32_QuickFixEngineering class represents system-wide Quick Fix Engineering (QFE) or updates that have been applied to the current operating system.",
        "Other Transfer Count",
        "NS_A795D8845709332607DFFBB7F002DE04E0997E409BE31D5BA9FF05A1F3FC9068",
        "Win32API|Network Management Structures|USER_INFO_2|UF_PASSWD_CANT_CHANGE",
        "List of 1394 SYSIDS",
        "The BitsPerPixel property indicates either the number of bits used to represent the color in this configuration, or the bits in each pixel.",
        "PLATFORM_TRACE_ERROR_REPORTING",
        "CD_1AF8551C42A0C4EC8EE76C1BB09B2DA1F658691D78A8F23A9542567B67EB474A.1983.32061222.738",
        "The NetworkPort associated with the IPInterface",
        "An array containing the operational status of each slot of the enclosure. ",
        "EnableAnonWin9xConnections",
        "{981f2d81-b1f3-11d0-8dd7-00c04fc3358c}",
        "Persistent storage",
        "The Antecedent reference represents cache memory available to the processor.",
        "Query NIC Switch Current Capabilities",
        "TEST_TRACE_RESERVED_1b Flag",
        "CIM_PrintService.MimeTypesSupported",
        "local|hkey_local_machine\\SYSTEM\\CurrentControlSet\\Control\\TerminalServer\\TSAppSrv\\VirtualIP",
        "MIF.DMTF|Temperature Probe|002.9",
        "Win32_ShortcutSAP",
        "Retransmission Rate Excessive",
        "ref:CIM_AggregatePExtent",
        "SplitIo_Info",
        "MSFT_Credential",
        "Capabilities and management of the parallel port logical device",
        "The Win32_LogicalDisk class represents a data source that resolves to an actual local storage device on a Win32 system.",
        "PLATFORM_ERROR_SPECIFIC_DATA is valid",
        "ProviderOperation_NewQuery",
        "Name of executable module",
        "REQUESTOR_ID",
        "FolderEnumerationMode",
        "y other error occurred.",
        "The CurrentSize property indicates the current physical size of the  registry.",
        "WriteProtectOn",
        "ControlledFolderAccessAllowedApplications",
        "ID of the suite parent template.",
        "MSFT_NetAdapterLsoElementSetting",
        "CIM_BIOSFeature represents the capabilities of the low-level software that is used to bring up and configure a computer system.",
        "Suspended",
        "PolicySourceFallbackPrintDriverType indicates whether the property FallbackPrintDriverType is configured by Server(0) or Group Policy (1).",
        "CD_4D02D2507121F4F9419B3B4E42345F52E9719162092A87545BBD14771DBD18F7.1498.1930752775.332",
        "Path ID",
        "Example: s3  ",
        "DA03231B2D3B39ABD8B91202277E5C78F927E74B85FE75B7",
        "ref:CIM_SpareGroup",
        "Hot Spare",
        "Constraints: Accepts the same value as the Name property.",
        "I_BA2B64DEBCEAD4B5E79E8DFCDA9F0F1222A0566FE820AF52659088247BFF8F7C.311.1988916545.249",
        "Win32_SystemNetworkConnections",
        "Logs events into NT event log, see Win32 SDK documentation for more complete descriptions",
        "The Document property specifies the name of the print job. The user sees this name when viewing documents waiting to be printed. ",
        "ActiveSessionLimit",
        "CorrectableError property indicates whether the most recent error was correctable. This property is not used if ErrorInfo is set to 3.",
        "PLATFORM_TRACE_FUNCTION",
        "FX_TRACE_OBJECT",
        "New Credentials - Windows 2000: This logon type allows the caller to clone its current token and specify new credentials for outbound connections. The new logon session has the same local identify, but uses different credentials for other network connections. ",
        "Mini Tower",
        "Filter identifier.",
        "IR_7BA06B043DD4F1C4BC3ACB7E4C10A6223E3DA1067522BFF187585B0486BDFDF7",
        "CD_F2861A4DA5DC3097CDD41BE98AFC0D26991CB4501C7A9352DBC909EEDF0D4BDA.1601.485000663.488",
        "This method will uninstall the associated instance of Product",
        "2.15.0",
        "The Win32_BIOS class represents the attributes of the computer system's basic input/output services (BIOS) that are installed on the computer.",
        "  <registryKeys>",
        "The volume set.",
        "I_614FEB5198DB6356C7D4E70E58F0634936BC6DE530AA5FD952207E56B5A89D3F.1635.1118994179.316",
        "x*m;x*m;",
        "The MonitorType property indicatesMAN",
        "The AllocatedBaseSize property indicates the actual amount of disk space allocated for use with this page file. ",
        "ISCSI_ERR_AUTH_METHOD_NOT_OFFERED",
        "Return code",
        "SupportIp4",
        "The major NDIS version the network adapter driver conforms to.",
        "Identifies the packet capture provider.",
        "I_2FEB110D9B2D8B964448231D62D228EB77833D966ACDE6C751FBBBE880E8D6B9.1520.1495436781.329",
        "POST Memory Resize",
        "SampleRate",
        "No media in drive",
        "Service Database Locked",
        "The NumberOfButtons property indicates the number of buttons on the pointing device.",
        "MS_SMHBA_FC_Port",
        "Management Firmware",
        "StorageSubSystem",
        "TEST_TRACE_RESERVED_1d",
        "{0800F074-CB98-11d2-B35D-00104BC97924}",
        "Kerberos Set Password",
        "ACPI Driver Trace Provider",
        "HardwareIssue",
        "scale",
        "SECHC_LOG_FLAG_EXT",
        "Network isolation identifier.",
        "Specifies whether to perform a quick format by removing files from the disk without scanning the disk for bad sectors. Use this option only if this disk has been previously formatted and you are sure the disk is not damaged.",
        "TransactedBatchingBehavior",
        " names.) In addition, to ensure uniqueness <OrgID> MUST NOT contain a colon (':'). When using this algorithm, the first colon to appear in InstanceID MUST appear between <OrgID> and <LocalID>. ",
        "Device Hardware Error",
        "S-1-5-113",
        "2 - 'Start' changes the state to 'Running'. ",
        "CD_35A718313A1D788647FBE70E3BDCD7DD0916025FCA299E4EDF879E32418A1A55.52.751762984.8061",
        "For example, using a \\'*\\' delimiter, RecordFormat = \"*string ThisDay*uint32 ThisYear*datetime SomeTime\" ",
        "The DitherType property indicates the dither type of the printer.  This member can assume predefined values of 1 to 5, or driver-defined values from 6 to 256.  Line art dithering is a special dithering method that produces well defined borders between black, white, and gray scalings.  It is not suitable for images that include continuous graduations in intensity and hue such as scanned photographs.",
        "The Service property contains the name of the service that supports this Plug and Play device. See also: Win32_SystemDriverPNPEntity class.",
        "frameSize",
        "Win32API|Communication Structures|COMMPROP|dwSettableParams|SP_HANDSHAKING",
        "C_135FEFCCBE59BF421E79A3B9F572052648A0ED4C004AD4F8F01A7059366646C2",
        "VpnConnectionTriggerApplication",
        "CurrentVerticalResolution",
        "InProcServer",
        "Pool Allocation/Free Event",
        "If L2TP is used, enforces supplying the Pre-Shared Key value over unsecure channel. ",
        "{9877D8A7-FDA1-43F9-AEEA-F90747EA66B0}",
        "An integer enumeration indicating the capabilities of the parallel controller",
        "SupportsSendStatus",
        "The Win32_SystemSetting class represents an association between a computer system and a general setting on that system.",
        "EnumTrstedDomEx_End",
        "Reflective",
        "The NewPrinterName parameter specifies the new printer name.",
        "NTLMV2",
        "CD_45F5A698FE1F369FCC9E35170EFC43E4DFBC18F38DA62C3D1FEF22A7B3B706DD.58.4271515548.1313",
        "MSFT_S",
        "SupportedSRAM",
        "CIM_Job.RunMonth",
        "Detection time in the Round-Trip Format",
        "LoaderDllSearchResults",
        "actionPath",
        "MDM_Policy_Result01_WindowsInkWorkspace02",
        "Indicates if the Adapter supports IPv6 extension headers for transmit checksum offload.",
        "unittype",
        "7 - 'Non-Recoverable Error': The element detected one or more non-recoverable issues. ",
        "Cubic Feet",
        "Win32API|Process and Thread Functions|CreateProcess|lpCurrentDirectory ",
        "MDMAppProv",
        "4 - 'UnSyncAssoc': create an unsynchronized copy and maintain an association to the source. ",
        "object:CIM_ManagedSystemElement",
        "InDoubtMax",
        "KeyEncoding",
        "Set iSCSI Initiator Node Name",
        "SubsegmentReuseThresholdActivated",
        "On Board IDE Connector",
        "Negotiate Flag",
        "  <assemblyIdentity name=\"Microsoft-Windows-Store-Install-Service\" version=\"10.0.19041.1\" processorArchitecture=\"amd64\" language=\"neutral\" buildType=\"release\" publicKeyToken=\"31bf3856ad364e35\" versionScope=\"nonSxS\"></assemblyIdentity>",
        "DesignCapacity",
        "TM_COMPCLNT",
        "This represents an integer list element. Note that although Integers are 64bit numbers, they must be passed as strings since Automation has no native 64bit type.",
        "{313e88de-a4fd-11d8-b301-505054503030}",
        "Access to some DOS commands",
        "SuccessfulRemediation",
        "{D7C3453E-1F1C-48CD-AFE6-CFF2A937D337}",
        "CD_5125E87B865F9C6DC59486D1BB02124F8523E09293ABB2126C845245277E44EE.1515.1806780080.1867",
        "Represents the TCP connection class for Microsoft TCPIP WMIv2 provider.",
        "New group of target.",
        "ReadTotalUncorrectedErrors",
        "The FRU.",
        "Advertise",
        "Win32_LogicalFileAuditing",
        "ref:MSFT_PipelineExecution",
        "The CompressionOn property contains the command string used to enable hardware data compression.",
        "The checksum type to use when determining whether two files are the same.",
        "The ThreadTrace event class is the base event for thread events.",
        "DSCPAction",
        "ConnectionlessService",
        "SecurityHeaderLayout",
        "An enumerated array describing the power management capabilities of the ComputerSystem. The use of this property has been deprecated. Instead, the Power Capabilites property in an associated PowerManagement Capabilities class should be used.",
        "    SplitTunneling (boolean) Specifies whether split tunneling is enabled or disabled.",
        "OutContext",
        "The resum",
        "System base directory",
        "Capabilities and management of a USB controller.",
        "CIM_System",
        "CIM_ProcessThread",
        "LPC_TRACE_RESERVED_15 Flag",
        "GetExternalKeyFromFile",
        "IP Versions supported **Add #defines**",
        "If set to TRUE, this instructs the physical disks in the storage enclosure to validate if enabling maintenance mode will be successful.",
        "Win32API|File System Functions|GetVolumeInformation|FS_VOL_IS_COMPRESSED",
        "LargeUCRSpace",
        "ref:CIM_PhysicalExtent",
        "The DNSEnabledForWINSResolution parameter specifies whether the Domain Name System (DNS) is enabled for name resolution over WINS resolution.",
        "Short self-test routine recommended polling time (in minutes)",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1131.784967978.368",
        "The CreationClassName property indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified.",
        "SamOpenAlias_Start",
        "SamDeleteAlias",
        "DisplayGroup",
        "NDISWMI_TRACE_RSS Flag",
        "Weeks",
        "The InstanceID of the AuthSet to use for Phase 2 auth.",
        "An array of values that denote the current operational status of the fileshare.",
        "InitiatorPort",
        "GetDomain",
        "An array of free-form strings specifying the types of paper that are currently available on the Printer. Each string should be expressed in the form specified by ISO/IEC 10175 Document Printing Application (DPA) which is also summarized in Appendix C of RFC 1759 (Printer MIB). Examples of valid strings are \"iso-a4-colored\" and \"na-10x14-envelope\". By definition a paper size that is available and listed in PaperTypesAvailable should also appear in the PaperSizesSupported property.",
        "CR_9D3103F1FED20F5A89A186A2A5165255DA3A6E898D7F2AF1A34CB11242007EC6",
        "This method invokes the chkdsk operation on the disk. The method is applicable to only those instances of logical disk that represent a physical disk in the machine. It is not applicable to mapped logical drives. The return value of the method will indicate one of the following - Success - Chkdsk completed, Success - Locked and chkdsk scheduled on reboot, Failure - Unknown file system, Failure - Unknown error, Failure - Unsupported File System.",
        "Indicates the type of this device (Standard or 3D Printer).",
        "ShowAppCellularAccessUI",
        "Time that the job was submitted",
        "The count of KMS requests from clients with License Status=4 (NonGenuineGrace).",
        "MIF.DMTF|Power Supply|004.12",
        "LiveMigration",
        "LogonId",
        "{451FE14C-E3D3-11d2-8601-0000F8102E5F}",
        "MSFT_NetMainModeRuleInProfile",
        "ReplyToLine",
        "EnableByPlatform",
        "Daily",
        "SCSIRetries",
        "The parent system in the association.",
        "Timeout after which the IPsec SA should stop accepting packets coming in the clear in negotiation discovery mode",
        "SPACES_StoragePoolToStorageTier",
        "Refresh the entire list of targets using all available discovery methods",
        "ConfigureAdditionalSearchEngines",
        "Logging - Not Complete",
        "Object which contains details for security authenticode certificates.",
        "ModifyReplicaSynchronization",
        "Requests that the Device capture its current configuration, setup and/or state information in a backing store. This is handled more generally by the ConfigurationData subclass of SettingData. Therefore, this method is deprecated. ",
        "NdisHardwarestatusNotReady",
        "IsValid",
        "For a detailed description of the various serive types, refer to RFC 791, page 12.",
        "CIM_DirectoryAction",
        "The RegisteredUser property indicates the name of the registered user of the operating system./nExample: Jane Doe",
        "The CLSID property is the COM class id registered for the shadow provider.",
        "FD501A502D88A4093A",
        "CIM_Chip",
        "The Program ID associated with this extension.",
        "MIF.DMTF|Power Supply|002.19",
        "1 - Successful completion, reboot required",
        "MSFT_NetFirewallRule",
        "The list of in-range BSSIDs and their properties",
        "A Common Name is a (possibly ambiguous) name by which the group is commonly known in some limited scope (such as an organization) and conforms to the naming conventions of the country or culture with which it is associated.",
        "object:OMI_ResourceModuleManager",
        "The InfraredSupported property determines whether an infrared (IR) port exists on the computer system.",
        "The Username parameter is a pointer to a constant null-terminated character string that specifies the account name to use when connecting to the domain controller. The string must specify either a domain NetBIOS name and user account (for example, \"REDMOND\\user\") or the user principal name (UPN) of the user in the form of an Internet-style login name (for example, \"someone@microsoft.com\"). If this parameter is NULL, the caller's context is used. /nPassword and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. /nIf Password and Username are left null, the provider does not care. /nIf the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. /nThis parameter is only used for domain renames on Windows 2000 platforms and beyond. ",
        "MsftDiscFormat2RawImage_DebugAddRef Flag",
        "MIF.DMTF|Network Adapter 802 Port|001.3",
        "The Sid property holds a Byte Array representing the SID of the client creating the subscription, NULL if subscription is temporary.",
        "R_B18A79A265A485271ADF7583A11B74126B27D0421B9B453C88A99D39E80DF5B2",
        "46003",
        "WINSTATION_LOGON=0x20",
        "WSManWmiProvDebug",
        "object:MSFT_NetAdapterPowerManagement_Offload",
        "Clone Remote",
        " $m; $m;",
        "29EA117262",
        "The SupportsFragmentation property indicates whether the protocol supports transmitting the data in fragments. Physical network Maximum Transfer Unit (MTU) is hidden from applications. Each media type has a maximum frame size that cannot be exceeded. The link layer is responsible for discovering the MTU and reporting it to the protocols being used. ",
        "2 = Lightweight install ",
        "The minimum power budget allowed by this power meter.",
        "rcvwin",
        "76746942-D94B-47E2-BBA4-AFD2FDBA61",
        "2-way Interleaved Stereo with Right Image on Even Lines",
        "4 - 'Terminate' stops the job cleanly, saving data, preserving the state, and shutting down all underlying processes in an orderly manner. ",
        "Packet over SONET/SDH",
        "eventLogSource",
        "CD_6FFBA8B5854E9C5C5C698A9277971D04E447B67166A26CB7D9DD0D9F278C2D8B.1463.934757058.837",
        "LetAppsAccessContacts_ForceDenyTheseApps",
        "MDM_LanguagePackManagement_LanguageSettings01",
        "InDoubt",
        "MSFT_WmiProviderEvent",
        "A storage pool on the target to be used as the source for creating the necessary TargetStorageElements. This parameter is ignored if the target group contains any elements.",
        "{8502C50D-5FBB-11D2-AAC1-006008C78BC7}",
        "The current sensor.",
        "{791ad194-e35c-11d0-9692-00c04fc3358c}",
        "FailureType",
        "The Win32_CacheMemory class represents cache memory (internal and external) on a computer system.",
        "FileIo_V1_Name",
        "DeleteFile",
        "CD_A906A7709427F12DDE6D6641BDCB16CA4F2938A2A88AC6967D518CEE727A69AC.1.2819455716.231",
        "WinSPRLevel",
        "Values: TRUE or FALSE. If TRUE, NULL bytes are discarded.",
        "The SRIOV setting data for a network adapter.",
        "Local Security Authority (LSA)",
        "LUN on target to use as boot device.",
        "AutoConfigurationScript",
        "LowestPerfState",
        "The GroupComponent reference represents the Win32_ComputerSystem containing the BIOS of the association.",
        "AppvClientAsset",
        "MSiSCSI_HBAInformation",
        "CIM_BootService",
        "//  Purpose: Internal header defining interface between user mode discovery",
        "To show whether the interface is connected or not. Two possible values: - Connected - Disconnected",
        "LUAInstall: ",
        "EnableNoInputNoNotify",
        "Bid2Etw_MSADDS_1_Trace_TextA",
        "A description of the object.",
        "SetKeepAliveInterval",
        "Specifies the auditing for a given trustee on a given object. Modeled after EXPLICIT_ACCESS",
        "NetworkCleartext",
        "Critical Error : Too many write errors.",
        "PolicyKeywords",
        "C_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109",
        "The ComponentId property contains the Globally Unique Identifier (GUID) of this COM class.",
        "The BitsPerPel property contains the number of bits per pixel for the output device Win32 printer.  This member is used by display drivers and not by printer drivers.",
        "Where DMAChannel=#",
        "Host Name",
        "The OEMLogoBitmap array holds the data for a bitmap created by the OEM.",
        "The base addresses used by the service.",
        "This field is a user-settable preference for the number of underlying physical disks across which data should be striped.",
        "Enable UEV.",
        "// are needed to insure a successful IKE/IPSEC negotiation. Note that",
        "Generates a VPN server object",
        "Endpoint",
        "{6710597F-7319-4AAE-9B85-C8D87136A56B}",
        "{5ec1035c-a61a-11d0-8dd4-00c04fc3358c}",
        "StorageDeviceNumber",
        "If set to TRUE, this instructs the enclosure to enable its identification LED on the specified element. The identification LED should remain enabled until a second call to IdentifyElement on the same element is made with this parameter specified as FALSE.",
        " The CIM_ApplicationSystemSoftwareFeature associations identifies the  software features that make up a particular application system.  The software features can be part of different products. ",
        "XENIX",
        "Isolated Name",
        "MSFT_NetAdapterUsoElementSetting",
        "WSP_FsStorageDepartureEvent",
        "Hardware Not Present",
        "CD_649A96A7525C03C672BD4CABDF65BD579104DAE8BCF03213836A9B50A7DFDB15.1343.210172114.1162",
        "SendLIRR",
        "LPCDRVR_TRACE_DRIVER",
        "Setup Flag",
        "The value to be deleted.",
        "IPXNetworkNumber",
        "queueAction",
        "The Installed property determines whether the network adapter is installed in the system.",
        "Specifies the number of complete data copies to maintain for this virtual disk.",
        "Microsoft-Windows-LLTD-MapperIO",
        "ErrorFrames",
        "BranchCache hash cache",
        "RestartOnIdle",
        "ScanCompleted",
        "WriteLatencyMax",
        "\\\\.\\root\\subscription:__Win32Provider.Name=\"ActiveScriptEventConsumer\"",
        "AllowFindMyDevice",
        "Select * from Win32_Share",
        "tenth-volts",
        "DOAllowVPNPeerCaching",
        "This flag specifies whether Split Tunneling has to be enabled or disabled.",
        "MSNdis_EnumerateAdapterEx",
        "iSCSI Connections",
        "A bit flag representing patch attributes. A value of 1  indicates that the failure to apply this patch is not a fatal error.",
        "datetime",
        "CIM_NumericSensor.CurrentState",
        "EnableIPFilterSec",
        "If a CIM service supports sequence identifiers for indications, this property shall be maintained by the CIM service for each registered listener destination, and its value shall uniquely identify the CIM service and the indication service within the CIM service such that restarts of the CIM service and deregistration of listener destinations to the CIM service cause the value to change, without reusing earlier values for a sufficiently long time.",
        "Specifies the total number of processes associated with the job during its lifetime, including those that have terminated. For example, when a process is associated with a job, but the association fails because of a limit violation, this value is incremented. ",
        "C_169484918492FC0AC4886BF1A48556EDC1984793E915C243C1C0A4B8E678F4FD",
        "CD_2D5BE2B23BA8B748FE728A0E39B335CC2B3500262599CB2529C98BB713577B01.2069.207744560.7061",
        "PSLError Flag",
        "Supplies the source address of the SYN packet.",
        "IL_A9B77B6FB8EEFAA0386ECE3D9F763120D7E0B46CF98ACF71EF752F98F67AAC11.428.1.32140",
        "Ndis802_11WEPDisabled",
        "IL_E0849CDEB189AA76D8525CE1B639DCC35E6FEC1238BA020F29888EDAD9D3FEAF.2462.1487720740.353",
        "A short textual description (one-line string) for the Product.",
        "RemoveChapForPhysicalPort",
        "LoaderBasicEvent",
        "ADOMD.1 formatted output (W)",
        "{FAF76B7A-798C-11D2-AAD1-006008C78BC7}",
        "Indicates the specific power-related capabilities of the logical device. ",
        "HBAFCPBindingEntry2",
        "CIM_ERR_PULL_HAS_BEEN_ABANDONED",
        "Toggle IPSec queuing of packets for RSS-like functionality",
        "Serial Port 16550A Compatible",
        "Win32_ReliabilityStabilityMetrics",
        "MSTapeProblemIoError",
        "R_592AD4245F5967C5343D00E56AE24D1F0F5CE094EF04D954AC81ECB94104BFA6",
        "Common Startup",
        "Denotes the provisioning type of the disk device. ",
        "OEMUrl",
        "Property for controlling DNS client name resolution fallback policy.",
        "RcvLinkSpeed",
        "TRACE Flag",
        "endTime",
        "UserPending",
        "ref:CIM_RegisteredProfile",
        "BootStartDriverInitialization",
        "CR_7E8FAF5FFDD42234424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D",
        "C_0C1B95E6D290B66E321C724410DB4355B639D2A083CB9491EF83C50DE14B1E8C",
        "{600c8260-c838-4aa6-b818-553f6308ad8b}",
        "Transmission Selection Algorithm assignments per Traffic Class.",
        "Specifies whether users are allowed to manually select a DA site.",
        "CIM_OperatingSystem.CSCreationClassName",
        "SNMP Trap Destination",
        "The SessionID property identifies the session under which the process exists.",
        "object:MSFT_DSCConfigurationStatus",
        "RemoveTargetPort",
        " Win32 service that interacts with the desktop. This value cannot be used alone and must be added to one of the two previous types.",
        "MDM_DeviceStatus_Antivirus01",
        "      <securityDescriptor name=\"WRP_REGKEY_STORE_AGENT_RW_SDDL\"></securityDescriptor>",
        "Operation is allowed only on the primary domain controller of the domain",
        "{FCD0E156-DB31-11d2-85FC-0000F8102E5F}",
        "Boolean indicating whether the frame is equipped with an audible alarm.",
        "ialized.",
        "SByteArray",
        "I_5386CC6AC469C7F08CD169C28544D1F527C5084ADD70DCC11E9F92885E748C22.26.2765184564.195",
        "PolicStatus",
        "DiskIo_TypeGroup1",
        "TEST_TRACE_RESERVED_19 Flag",
        "MSFT_StorageSubSystemToVolume",
        "ConfigureKioskMode",
        "FireAlert",
        "TRC_INFO Flag",
        "MIProv\"",
        "ByteReadCount",
        "FileShare",
        "Number of days after which an event can be overwritten. Values are:",
        "Controls the binding for metadata retrieval using HTTP.",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_7E3FC52173BBB0BAC6E789BDD1BE5FCFF346F5F20489B64EB487016A0284A27979",
        "TRACE_FLAG_RW",
        "GroupForwardedFragments",
        "The physical link.",
        "Event Code",
        "This property corresponds to the EnabledState property of the logical computer system represented by CIM_ComputerSystem. See CIM_EnabledLogicalElement.EnabledState for details on EnabledState.",
        "Description String",
        "SystemConfigurationChangeEvents",
        "Log size from input is not a valid log size.",
        "The minor NDIS version the network adapter driver conforms to.",
        "ObjectAccess_AuditSAM",
        "The Setting reference represents the role of a user that can launch a component grouped under the associated Win32_DCOMApplication",
        "Win32API|Service Structures|SERVICE_STATUS_PROCESS|dwProcessId",
        "80 - Unable to configure TCP/IP service",
        "The ThreadStopTrace event class indicates a thread has terminated.",
        "// An acquire is a request by the IPSEC driver to have IKE perform a task. The active acquire statistic includes the outstanding request and the number of any queued requests. Typically, the number of active acquires is 1. Under a heavy load, the number of active acquires is 1 and the number of requests that are queued by IKE for processing.",
        "FX_TRACE_RESERVED_19 Flag",
        "ROOT\\Microsoft\\Windows\\Dns",
        "Optional. String that specifies the password to use when attempting to connect. Leave it blank to use the password of the current logged-on user. The Password parameter should only be used with connections to remote WMI servers. If you attempt to specify Password for a local WMI connection, the connection attempt fails. ",
        "3221232515",
        "WDF_DPC",
        "LastFullScanDateTimeStart",
        "The SetPMTUBHDetect method is used to enable detection of Black Hole routers. Setting this parameter to TRUE causes TCP to try to detect Black Hole routers while doing Path MTU Discovery. A Black Hole router does not return the Internet Control Message Protocol (ICMP) Destination Unreachable messages when it needs to fragment an IP datagram with the Don't Fragment bit set. TCP depends on receiving these messages to perform Path MTU Discovery. With this feature enabled, TCP will try to send segments without the Don't Fragment bit set if several retransmissions of a segment go unacknowledged. If the segment is acknowledged as a result, the maximum segment size (MSS) will be decreased and the Don't Fragment bit will be set in future packets on the connection. Enabling black hole detection increases the maximum number of retransmissions performed for a given segment. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "Monitor's analog video input parameters",
        "Printer jobs processed since last reset.  These jobs may be processed from one or more PrintQueues.",
        "2 - 'Full Copy': This indicates that a full copy of the source object is (or will be) generated . ",
        "MSNT_SystemTrace",
        "ISCSI_Supported_LB_Policies",
        "Write log sectors",
        "The Win32_COMApplication class represents a COM application. In this context, a COM application is a logical grouping of COM classes.",
        "The RemoteName property contains the remote network resource name for a network resource. For a current or persistent connection, RemoteName contains the network name associated with the name of the value in the LocalName property. The name in RemoteName must follow the network provider's naming conventions. ",
        "Type of data encryption to use to connect to a wireless LAN.",
        "Critical Error : Too many read errors.",
        "ReplyAction",
        "The copy number of the replacement for this extent.",
        "1 - Work Station ",
        "ExpectedReading indicates the 'normal' value for the sensor.",
        "AllowAutoPlay",
        "HOSTPROC_TRACE_REMOTE_DISPATCHER",
        "96 - Unable to notify DNS service",
        "SourceUniqueId",
        "The ScratchDirectory property indicates the directory where temporary files can reside during boot time.",
        "The InactivityScale property is a multiplier used with the InactivityTimeout property to calculate the timeout period of a connection.",
        "Side-by-Side Interleaved Stereo",
        "Win32_ActiveRoute",
        "Win32Registry|System\\CurrentControlSet\\Control\\Session Manager\\Memory Management|PagingFiles",
        "I_76BBC96B178A1C054AB319522EC35C13427283C8227727BACFAF1E007CEB0AB9.1533.2682743591.332",
        "BAUD_38400",
        "ENABLE_ERROR_SOURCE",
        "AutoResolve",
        "MDM_Policy_Result01_Browser02",
        "CR_C85BEC05E1DE78CAC5454E6D33A2BAFD69D28B4057355776F41B00B3DF99855E",
        "IsTemplateFile",
        "To control whether to use automatic metric. Two possible values: - Disabled - Enabled",
        "DS_LDAP_Class_Containment",
        "ISR-MSI",
        "The authentication cookie used to subscribe to the server",
        "This parameter denotes the maximum supported size that a virtual disk created in this pool can be.",
        "Indicates if the Adapter supports TCP options for receive checksum offload on IPv4 packets.",
        "PageFileSize",
        "Describes the aggregate physical extent in a storage redundancy group.",
        "DNSServerSearchOrder",
        "42011",
        "Active Directory: Kerberos Client",
        "UpdateProfile",
        "Win32_InstalledSoftwareElement",
        "Text StringW",
        "I_53AF8608C104F86655F42A8871E5F73225A8D681F66B8151B7C200C46C518C50.1462.1061050821.302",
        "Pk?cD",
        "NS_E1DD43413ED9FD9C458D2051F082D1D739399B29035B455F09073926E5ED9870\\KI_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C\\I_675C8C02435D74D2BF9FB2F1ACC8A427A072276AD5C19F68D5A3EC506D13F5D8a\\10",
        "MSNdis_CoMediaSupported",
        "DisableNetbios",
        "{791ad1a0-e35c-11d0-9692-00c04fc3358c}",
        "NS_3FBDCB08ECD33FBEF028D2DB3EF058F8CE959779B943F43AB3DB3EC34ACA147D\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_8E23EB78FFAC4A759215B5BD6EC35386D5DAFFB04E17A1E0F3F33C9BDCE81E56",
        "Win32_NamedJobObjectLimitSetting",
        "Indicates the current health of the element. This attribute expresses the health of this element but not necessarily that of its subcomponents. The possible values are 0 to 30, where 5 means the element is entirely healthy and 30 means the element is completely non-functional. The following continuum is defined: ",
        "Abstract",
        "MsftDiscMaster2_DebugConstructor",
        "The file specification.",
        "Association between StorageNode and Disk.",
        "PowerEvents",
        "The file to get the integrity information for.",
        "DOT11_COMMON",
        "Event Time",
        "Memory page has been removed",
        "Select * from Win32_Service",
        "The Win32_TerminalServiceToSetting class is an association with Win32_TerminalService as the Element and Win32_TerminalServiceSetting as the Setting property that includes Terminal Server Mode,Licensing, Active Desktop, Permissions Capability, Deletion of Temporary folders and Temporary folders per session.",
        "The ServiceParameters property contains the command line parameters passed to the DCOM application. This is valid only if the application is written as a Win32 service",
        "ConnectionListSize",
        "The locale-independent name for the group that this rule belongs to.  If this field is non-null, then Windows Defender Firewall with Advanced Security assumes that this rule belongs to a Windows component or an installed application, and some parts of the rule are protected (including but not limited to the Name, Description, Program, and Service).",
        "CR_703C562B7404A6234AAFEB9B3BB242E3FF62C76339F84C997DCEF89443C2DF65",
        "RequireAuthorization",
        "Ethernet Switch",
        "shutdown",
        "Behaviors",
        "CLRVersion",
        "CD_3FF84C03B328C80EE72EA722B2C1AB0D0A4549FDEC5EB94A2670D175C0A3657F.40.3014044045.666",
        "startpassword = \"\"   this is important, it needs to be an empty string, NOT null  ",
        "CacheRefreshInterval",
        "ProcessorPerfStateEvent",
        "An array containing the operational status of each temperature sensor of the enclosure. ",
        "16 - CIM_ERR_METHOD_NOT_AVAILABLE. The extrinsic Method could not be executed. ",
        "Recommendation.ITU|M3100.probableCause",
        "MEM_PLATFORM_RESPONDER_ID is valid",
        "RemoveVirtualPort",
        "OutputMegabytes",
        "pipelineExecution",
        "16 - This service is being removed from the system.",
        "// The total number of packets that failed decryption.",
        "Portals",
        "CIM_SoftwareIdentity.Classifications",
        "{3f2c141c-83bc-11dd-94b8-001d09162bc3}",
        "C_81C106E09E02CD8E9F92751CDD19E5532DF222FFFFF38E1A22F4010E1CF8B4EB",
        "TEST_TRACE_RESERVED_1c",
        "RemotePath",
        "C_25DB973753814296778CE91619DACD1D75BADC5FEADDBE8C05CED0CE57CC8084",
        "AppendParentSuffixes",
        "The NumberOfFiles property indicates the number of open files associated with this connection.",
        "The authentication scheme used to authenticate client requests being processed by an HTTP proxy.",
        "C_988F45C7D3827182CC9E311CB986FEA0532897BB2CDEED83739CF2F82341462E",
        "MSFT_NetConnectionProfile",
        "CIM_LogicalElement",
        "An enumerated array describing the power management capabilities of the Device. The use of this property has been deprecated. Instead, the PowerCapabilites property in an associated PowerManagementCapabilities class should be used.",
        "ProviderOperation_DeleteInstanceAsync",
        "UserSID",
        "NdisCoVendorDriverVersion",
        "ShowWindow",
        " The state of the software element being checked.",
        "ref:CIM_ProtectedSpaceExtent",
        "Thermal Constant 1",
        "ForceClear_Allowed",
        "EnterpriseInternalProxyServers",
        "MtomMessageEncodingBindingElement",
        "AllowMicrosoftAccountConnection",
        "ConfigDeviceHealthMonitoringUploadDestination",
        "2.0.0",
        "CD_18DF4E7DC43FB5F7943BBAB3261441AF37AC157D8DEB54891BB97D3B897A5305.21.1906864971.525",
        "MajorErrorType",
        "fileio",
        "Apartment - components may be entered by one and only one thread. Common data held by these kinds of object servers must be protected against thread collisions since the object server supports multiple components. Each component can be entered simultaneously by different threads.",
        "IR_488680B9304A8CE240DD3162C60ABEBE0653A1B3DEF56BFB0E7A2CB3DC6AD158",
        "MSFT_CliAlias.FriendlyName=\"DiskQuota\"",
        "RefreshRate",
        "OperationalMode",
        "0 - Successful completion",
        "9 - Windows XP Home Edition ",
        "Win32API|Process and Thread Structures|STARTUPINFO|YCountChars",
        "A FilterList aggregates instances of (subclasses of) FilterEntryBase via the aggregation EntriesInFilterList. The filter entries are always ANDed together when grouped by the FilterList. Note that it is possible to aggregate different types of filters into a single FilterList - for example, packet header filters (represented by the IpHeadersFilter class) and IPsec security filters. ",
        "R_3277B54ADD63DD9DAF9212009ACC4BB7EE33B9AEB2FD840D7E82EEE595AC86D7",
        "AES-GMAC-192",
        "Maximum length of a filename component supported by the Windows drive. A filename component is that portion of a filename between backslashes. The value can be used to indicate that long names are supported by the specified file system. For example, for a FAT file system supporting long names, the function stores the value 255, rather than the previous 8.3 indicator. Long names can also be supported on systems that use the NTFS file system. Example: 255",
        "Key Count at Hive Load",
        "TEST_TRACE_RESERVED_17",
        "MIF.DMTF|Video BIOS Characteristic|001.4",
        "Win32_LogicalProgramGroupItem",
        "CD_878D5D30666EBFE440F941E45E7884E8AFCA7A1478E4D09AB57DC26571C8B7A6.1176.3360590187.370",
        "41009",
        "Block Address",
        "C_41DBF5B1870AF9F0B77D7680767E231A2460610113F21236505A5E4A30EFFCA6",
        "The Setting reference represents the initial settings of a page file when the Win32 system is starting up.",
        "1 - 'Warning': The volume is still functioning, but has detected errors or issues that require administrator intervention.",
        "{c12a7328-f81f-11d2-ba4b-00a0c93ec93b}",
        "{fd306974-c420-4433-b0fe-4cf6a613f59f}",
        "Integer indicating whether the pointing device is configured for right (value=2) or left handed operation (value=3). Also, the values, \"Unknown\" (0) and \"Not Applicable\" (1), can be defined.",
        "C_FAB579260306CF6BFF8AA42E9AAC8900DD8AC191A796F9430DC39085EEC7005A",
        "CommandFile",
        "TRACINGPNPPOWERSTATES",
        "s setup dll and entrypoint for this driver.",
        "InactivityTimeout",
        "Chkdsk",
        "StackKeyUser",
        "Virtual Library System",
        "class defines the unsuccessful initialization of the provider server instance.  Following activation of the provider server, the WMI willattempt to initialize the instance provider through a number of COM interface method calls. This event defines the unsuccessful initialization of the provider server instance.",
        "object:MSFT_CliTranslateTableEntry",
        "PMTUDiscoveryEnabled",
        "TargetStoragePools",
        "PerfStates",
        "MaximumConnectionCountPerServer",
        "NS_40C72902909872C8CB8F54A549C2E7A4220C5928218B00BA638889979EE39E62\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_F98CD8F4EA96B0B77910240E3039FCC377A97641ECA44728EE7350A6200A681A",
        "The TransactionIdentifer property is for internal use, currently always empty.",
        "LetAppsGetDiagnosticInfo_ForceAllowTheseApps",
        "Resyncing",
        "The disk has not been initialized.",
        "Version1",
        "C_B1A1651DDC605A98CB61526F4FA9D18C6AEA8D3F609CF92D2D881D05F26BFED8",
        "Serial Overrun Error Count",
        "UserPermission",
        "RSOP_PolmkrProfileSetting",
        "I/O Read/Write Event",
        "The proxy server type to be used when connecting to the Internet.",
        "MDM_Update",
        "DisableByAllApp",
        "Win32Registry|System\\CurrentControlSet\\Control\\GroupOrderList",
        "MIF.DMTF|System Slot|004.2",
        "AllocatedSize",
        "The ManagedElement that conforms to the RegisteredProfile.",
        "SamGetMemInGrp",
        "QueueGroupId",
        "Pascals",
        "local",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_7D726A53C2E109A7102AA0733AF15E0ABEDDFCEA169FD750AACBD377D8D29F565200",
        "Dimensionless",
        "MDM_Policy_Result01_DeviceLock02",
        "PerUserSchema",
        "OA2xBiosMarkerMinorVersion",
        "MaximumRxQueueSize",
        "Title",
        "GET_ERROR_SOURCE_INFO",
        "REG_EXPAND_SZ",
        "MDM_Reporting_EnterpriseDataProtection01_RetrieveByTimeRange02",
        "REG_MULTI_SZ",
        "The CIM_DiskDrive class represents a physical disk drive as seen by the operating system. The features of the drive seen through this object correspond to the logical and management characteristics of the drive and, in some cases may not reflect the actual physical characteristics of the device. Any interface to a physical drive is a member of this class. Any object based on another logical device would not be a member of this class.",
        "GroupMask2",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\Version[Default]",
        "{6B510852-3583-4e2d-AFFE-A67F9F223438}",
        "Generic_Exception Flag",
        "MACOS",
        "BytesRead",
        "Current number of vertical pixels.",
        "Absolute path to the settings storage path",
        "11 - 'In Service': describes a subsystem being configured, maintained, cleaned, or otherwise administered. ",
        "beginTime",
        "LPC_TRACE_RESERVED_17",
        "Configure whether low cpu priority should be used during scheduled scan.",
        "Example: \\\\PRINTSERVER1\\PRINTER2",
        "DeleteKeyProtector",
        "BOOLEAN",
        "Rdma missing performance counter information for a network adapter.",
        "Uninstall Unmanaged",
        "CP on a Fibre Channel adapter. There should be one instance of this class for each adapter.",
        "Selectable Boot is supported",
        "Stack21",
        "LastTaskResult",
        "{7E6475FE-CF3C-4e22-892E-0E58482158E3}",
        "C_16C3460778AD17C374A21EA3EAA4769942B4820B8F8AA76B353EDCE060C07C55",
        "NS_FE3EA006C3292950A76C2B5A0185D7DF99ADD6FD6502E0AC079E3A8650E76E3A\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_FDC07BF412EF517BF16CBEA0AD032C8FE94CB2DD73B9CD909C08659DB8C5BC0A",
        "Specifies the number of groups in the access token.",
        "Do not use the address as source address for any outgoing packet unless explictly asked to.",
        "The ClientAccessible Win32_ShadowContext specifies a read-only, client-accessible shadow copy supporting the Previous Versions Server feature. Only the system provider (the default provider available on the system) can create this type of shadow copy.",
        "DedupProperties",
        "OptimalDataTokenSize",
        "The total number of kilobytes that can be mapped into the operating system's paging files without causing any other pages to be swapped out.",
        "SourceAddress",
        "WriteErrorsUncorrected",
        "0xC0000011",
        "Always Notify",
        "Sets the properties UserName,  Password and Domain which specify the credentials explicitly to be used for authentication. The call returns success in case of Server-Override mode and an error if the policy was set to User or Group.",
        "MSNdis_StatusMediaSpecificIndication",
        "0x00000080",
        "3221232489",
        "Dot11 Phy State Change status information.",
        "The VolumeName property indicates the volume name of the CD-ROM drive.",
        "Standard",
        "// Bit flags for InformationSpecifies",
        "MSFT_NetSARuleEMAuth",
        "The number of bytes received using the AH protocol.",
        "Wired WAN",
        "Power Supply Profile",
        "SettableStopBits",
        "SystemDrivesRecoveryOptions",
        "Implementation decides group member order",
        "{8502C538-5FBB-11D2-AAC1-006008C78BC7}",
        "C_E241A982292C9628611468FB40BE60D4CC1B723333EE25A7584E871FE9DA753E",
        "EE083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "The TCP port used by clients to send KMS-activation requests. Returns 0 if SetKeyManagementServicePort has not been called.",
        "NtStatus",
        "Ext Pos Loc Report System",
        "WARNING : Drive is experiencing read problem.",
        "Intranet",
        "Voltage",
        "The physical package that contains component(s).",
        "SDBUS_DEBUG_INTERFACE",
        "IL_B40FE5BB7D3AAD0C5E26212696A1B37175024D4725396AA1CD7AE0B640ED7993.1580.325098574.265",
        "CIM_BIOSElement",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightDate|wDayOfWeek",
        "Number of entries in MSiSCSI_Paths array",
        "    // Type of iSCSI session",
        "MSFT_StorageArrivalEvent",
        "SaOffloadCapacityEnabled",
        "Error Retried",
        "OA3xOriginalProductKey",
        "FB72144CC48C974D93CBE7417A8F27ACAB5CA25D34A28C29442",
        "From line for the email message. If NULL, a from line will be constructed of the form WinMgmt@MachineName",
        "Free List Length",
        "Enterprise Server Core Edition",
        "RSPNDR",
        "C_846C560B82577D9FF88EE61507FEFE652D765E2149E65AD69717E4D9BBA459B8",
        "ConfigureXboxAccessoryManagementServiceStartupMode",
        "Janus",
        "CR_17431B4BA51D33CDA0A6628CA12FC7DFF5F227BEC60D95CF88873EA792342553",
        "46012",
        "GET_SINGLE_POLICY",
        "NumAAAAQueriesFailed",
        "iScsiDebug27 Flag",
        "STRING",
        "Counters",
        "The application package this rule applies to, given as a SID.",
        "RequireServerAuth",
        "The TotalPages property specifies the number of pages required to complete the job. This value may be zero if the print job does not contain page-delimiting information.",
        "Select * from Win32_DiskDrive",
        "Printed",
        "EntryPoint",
        "{8502C542-5FBB-11D2-AAC1-006008C78BC7}",
        "4 = The application would be eligible in logging mode only if the application were already applied to the target ",
        "RateUnits",
        "IEEE 802.3 10BROAD36",
        "CheckApplicabilityMethod",
        "ref:Win32_ProgramGroupOrItem",
        "SAM Query Security Object",
        "Extensions to GroupId",
        "The number of entries in the acquire heap, which stores active acquires. This number increases under a heavy load and then gradually decreases over time, as the acquire heap is cleared.",
        "56000",
        "originalRequest",
        "TcpIp Receive",
        "You must specify a name for this volume",
        "When the corresponding array entry in HostType[] is \"Other\", this entry provides a string describing the manufacturer and OS/Environment. When the corresponding HostType[] entry is not \"Other\", this entry allows variations or qualifications of ClientTypes - for example, different versions of Solaris.",
        "In order to ensure uniqueness within the NameSpace, the value of InstanceID SHOULD be constructed using the following 'preferred' algorithm: ",
        "SRIOV settings for a network adapter",
        "VmCaptureDirection",
        "The first authentication remote identity",
        "The TotalPhysicalMemory property indicates the total size of physical memory./nExample: 67108864",
        "A subsystem storage volume.",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmDuplex",
        "The volume alignment is invalid for the slab consolidation/trim operation requested.",
        "NDIS WMI Common Method Header",
        "ShadowID",
        "0xEFFF0049",
        "R_BB27EFE66C80515ACDA70B8D93AC3E041408A503B4091461E3CAAE9E0BE7A5DB.1480.38763953.560",
        "C_2F43B8EB8E14762A257D84DCB10913E4CD9E8069D8AEA3384120BB143668FB2E",
        "ResponseBuffer",
        "A unique identifier for the fault",
        "If TRUE, the storage pool should clear (zero out) physical disks that are removed from the pool.",
        "Privilege(s) that are currently known to be required and are not held causing the operation to fail. Example: SE_SHUTDOWN_NAME",
        "MSFT_CliAlias.FriendlyName=\"DATAFILE\"",
        "Exceeded",
        "The LowBatterySignal property determines whether the power supply has a low battery signal.",
        "object:OMI_ConfigurationDownloadManager",
        "Specifies that ICM is disabled. 2",
        "WUUUUUU",
        "The distinguished name for the domain of which this directory server is a member",
        "{E2EB5B52-08B1-4391-B670-F58317376247}",
        "Values TRUE or FALSE.  If TRUE, then the job will be interactive.  The default value of this parameter is FALSE.",
        "The maximum outbound connections per endpoint.",
        "StorageObjects",
        "0x80050050",
        "Microsoft|DSLDAPClassAssociationsProvider|V1.0",
        "If the voltage (in millivolts) rises above the value specified by Range2InputVoltageHigh property, the UPS will compensate by trimming the voltage.  A value of 0 indicates that the voltage at which trimming occurs is 'unknown'.",
        "KI_C937FF2960366D3679AB8F23C7A6B508B41E35226B8C5FD67AC45163D3C64350",
        "C_0B48320BC1A528B3C1FD27BF622CF9AB5E3E6560AA1B8D7B4BB227712F4B7CA3",
        "Lower Filters",
        "0DE6AAF8-49F1-4868-B3D4-61CB69BA4322",
        "Example: Marketing2.",
        "mdlwritecomplete",
        "InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode",
        "CR_A8F32ED73CC909392CBB6D2CFB5C52391FFF3A4DD4AE1EBE1F9D40C03A8C9EA6",
        "IPSecPermitTCPPorts",
        "MCA_WARNING_CPU_THERMAL_THROTTLED",
        "Field Sequential Stereo with Left Image on Stereo Sync = 1",
        "CIM_PhysicalConnector",
        "Win32Registry|SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\drivers.desc",
        "WmiMonitorDescriptorMethods",
        "HEALBITMAP",
        "LostEvent",
        "state",
        "The SendAdminAlert property indicates whether or not an alert message will be sent to the system administrator in the event of an operating system failure. If TRUE, the system will send an alert to the system administrator.",
        "MSFT_StorageSubSystemToReplicationCapabilities",
        "DAEnable",
        " the model name of the display device.",
        "This property provides the status of antivirus updates",
        "UseDevolution",
        "PCI Component Information - VendorId",
        "AUTHFWCFG",
        "The SystemStartupSetting property indicates the index of the default start profile. This value is 'calculated' so that it usually returns zero (0) because at write-time, the profile string is physically moved to the top of the list. (This is how Windows NT determines which value is the default.)",
        "{4159353c-5cd7-42ce-8fe4-a45a2380cc4f}",
        "Stopping Maintenance Mode",
        "CIM_ConnectedTo",
        "R_91F50D2862F71528CE8ADD5DA789B79DF6B5B0054A4603D0ADF36E42EB1CD08C.1020.3075478322.518",
        "LDM Metadata",
        "Active Directory: NetLogon",
        "CR_B860282B4A1153A407ECADB9A68A7564DFACE81902C1C29A9243B46F5679275A",
        "This abstract class represents any resources that are used by the MSI installer durring the course of an installation, patch or upgrade",
        "PropertyNames",
        "JobInactivityTimeout",
        "The DaylightMillisecond property specifies the millisecond of the DaylightSecond when the transition from standard time to daylight savings time occurs on this operating system.",
        "Transition",
        "The Win32_NetworkClient class represents a network client on a Win32 system. Any computer system on the network with a client relationship to the system is a descendent (or member) of this class.",
        "CIM::System::Logs",
        "InboundDirection specifies whether the SA applies to inbound (TRUE) or outbound (FALSE) traffic.",
        "MsftDiscRecorder2",
        "Directory not empty",
        "RefreshInterval",
        "Specifies the total amount of kernel-mode execution time, in 100 nanoseconds, for all active processes associated with the job (as well as all terminated processes no longer associated with the job) since the last call that set a per-job kernel-mode time limit.  This property is set to 0 on creation of the job, and each time a per-job kernel-mode time limit is established. ",
        "C_E051E777C7E7563456908117F89B298B636645144CE61DF3136AB528CB03746A",
        "The Green Grid",
        "The VolumeSerialNumber property indicates the volume serial number of the logical disk./nConstraints: Maximum 11 characters",
        "PreventDeviceMetadataFromNetwork",
        "MCA_WARNING_CPE_THRESHOLD_EXCEEDED",
        "Providers_v2",
        "If set to TRUE, this instructs the physical disk to enable maintenance mode.",
        "SubProcessTag Changed",
        "DevStatus",
        "The volume",
        "Connect - authentication is performed only when the client establishes a relationship with the application.",
        "PageFault",
        "16000..",
        "Pings license server returns S_OK if valid license server S_FALSE if not",
        "{0F73ED4F-8ED9-11d2-B340-00105A1F8569}",
        "SlabConsolidate",
        "{564F1E24-FC86-28E1-74F8-5CA0D950BEE0}",
        "BcdDeviceUnknownData",
        "PoweredOn",
        "Amount of heat generated by the chassis in BTU/hour.",
        "ref:Win32_ComponentCategory",
        "OperationalStatus replaces the Status property on ManagedSystemElement to provide a consistent approach to enumerations, to address implementation needs for an array property, and to provide a migration path from today\\'s environment to the future. This change was not made earlier because it required the deprecated qualifier. Due to the widespread use of the existing Status property in management applications, it is strongly recommended that providers or instrumentation provide both the Status and OperationalStatus properties. Further, the first value of OperationalStatus should contain the primary status for the element. When instrumented, Status (because it is single-valued) should also provide the primary status of the element.",
        "{9565cd55-3402-4e32-a5b6-2f143f2f2c30}",
        "The availability and status of the device.  For example, the Availability property indicates that the device is running and has full power (value=3), or is in a warning (4), test (5), degraded (10) or power save state (values 13-15 and 17). ",
        "DetectionID",
        "Shared Secret Encoding",
        "Win32_OfflineFilesFileSysInfo",
        "The Present property denotes if this Plug and Play device is currently in the system.",
        "Data captured during the last erroneous memory access. The data occupies the first n octets of the array necessary to hold the number of bits specified by the ErrorTransferSize property. If ErrorTransferSize is 0, then this property has no meaning.",
        "AllowSmartScreen",
        "Important",
        "RingsBeforeAnswer",
        "LogDevices",
        "CIM_ProductProductDependency is an association between two products, indicating that one must be installed, or must be absent, for the other to function. This is conceptually equivalent to the CIM_ServiceServiceDependency association.",
        "The DeviceID property contains a string identifying the heat pipe.",
        "ErrorDescription is a free-form string supplying more information about the error recorded in LastErrorCode property, and information on any corrective actions that may be taken.",
        "Win32API|Performance Data Structures|PERF_OBJECT_TYPE|PerfTime",
        "The Type property indicates to which class the shadow provider belongs.",
        "SystemConfig_V0_PhyDisk",
        "The SystemStartupOptions property array indicates the options for starting up the computer system. Note that this property is not writable on IA64 bit machines. ",
        "BITSServiceTrace",
        "{8c7d3579-252b-4614-82c5-a650daa15049}",
        "ScheduledInstallDay",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_1DD976C2C1EC41AE2C2E9AE437798C835C95C683651B2DFFD6DE00EF8BD37B9B",
        "60002",
        "InOrderDMA",
        "statusCode",
        "I_21E85A20CC15E835CB6487F54DC9B230DDD677D1A3F958EEE3ACBA0DE0846B34.1499.2500204981.288",
        "Name which uniquely identifies a rule.",
        "ResourcesChanged",
        "Win32_PowerSettingElementSettingDataIndex",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|DaylightDate|wSecond",
        "DSRSensitivity",
        "The state requested for the element. This information will be placed into the RequestedState property of the instance if the return code of the RequestStateChange method is 0 ('Completed with No Error'), or 4096 (0x1000) ('Job Started'). Refer to the description of the EnabledState and RequestedState properties for the detailed explanations of the RequestedState values.",
        "FinalizeKTimer2",
        "RemoveSmbComponent",
        "Example: d:\\ ",
        "Win32API|Printing and Print Spooler Structures|DEVMODE|dmPelsHeight ",
        "__ClassOperationEvent",
        "Win32_StartupCommand",
        "An enumeration value that indicates the queued communication channel transport that this binding uses.",
        "MaximumNumberOfTxQueues",
        "LocalServerPath",
        "C_230EA8264BAA6C50B01C67268E97AB7EA0B455AC7B2538115EE2F298AB497196",
        "Minor Function",
        "object:MSFT_NetAdapterUsoEncapsulationTypes",
        "This command is not supported on x86 running in x64 environment",
        "Number of bytes for media specific status indication",
        "The 802.1p priority action. Set to -1 if not used.",
        "VPD83Type1",
        "0x008000",
        "The Setting reference represents the properties of the setting that can be applied to the computer system.",
        "Win32API|Service Structures|QUERY_SERVICE_CONFIG|dwServiceType|SERVICE_INTERACTIVE_PROCESS",
        "NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers",
        "AllowSharingOfOfficeFiles",
        "IPV4 Subnet Address",
        "Win32_TSVirtualIPSetting",
        "0xEFFF0063",
        "CIM_ERR_FAILED",
        "The server generated hash of cookie used to subscribe to the server",
        "C_B496E3C91F33B99F414E0CF911598E2EF9133E94328E67220F22C24A7531B226",
        "KEYBOARD_PORT_WMI_STD_USB",
        "Discover failed on one or more subsystems.",
        "Copies",
        "The service implemented using the logical device.",
        "Associates a network port with its SRIOV data.",
        "Regenerating",
        "RunningDisparityErrorCount",
        "String1",
        "StreamingAllowCertificateFilterForClient_SSL",
        "Values: TRUE or FALSE. A value of TRUE indicates the service can create or communicate with windows on the desktop.",
        "MSNetLogonTrace",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services",
        "SECAM K",
        "Note that this class and its AuthorizedSubject/Target associations provide a short-hand, static mechanism to represent authorization policies.",
        "Shared executable directory",
        "RADIUSServer",
        "ref:Win32_Process",
        "MSFT_NetServiceStartFailedNone",
        "MDM_MgmtAuthority",
        "RSOP_IESecurityContentRatings",
        "New Header/Data split configuration.",
        "contactListProgram",
        "Summary information word count for the product",
        "Compartment type.",
        "RSOP_UserPrivilegeRightBlocked",
        "The Antecedent property references the shared resource to which the connection was made.",
        "The PixelsPerXLogicalInch property indicates the number of pixels per logical inch along the X axis (horizontal direction) of the display.  ",
        "placeFavoritesAtTopOfList",
        "Disable_BC",
        "Example: P.",
        "R_E92F7F6859DA3540BD4772DC997C69CDE333458F416E1FC00383C239893539BD",
        "R_A97D8E3A56A53B2D4CADC8129B89F0FB2C2165B47CFAF4A34E3AE69B94AF3324.1635.1587423163.558",
        "Maximum Capacity",
        "FileSpecification",
        "A manufacturer-allocated number used to identify the PhysicalElement.",
        "MSWmi_Guid",
        "PolicySourceBrokenConnectionAction indicates whether the property BrokenConnectionAction is configured by Server (0),Group Policy (1), Default (2).",
        "EnforcementStatus",
        "RELEASE_FOR_MOD_WRITE",
        "ICMIntent",
        "object:MSFT_NetIKECryptoProposal",
        "{777BA8FF-2498-4875-933A-3067DE883070}",
        "NDIS Token Ring Lost Frames",
        "The friendly name of the session.",
        "SupportsSpecialCharacters",
        "Split IO",
        "Stack30",
        "WriteCorrectedWithoutDelay",
        "Certification authority to validate the Ipsec channel for DirectAccess",
        "Hop limit in outbound traffic.",
        "Specifies the maximum number of RSS processors for the network adapter.",
        "WmiSizeIs",
        "C_D3EDA6D3072598111F4D360786284F18068B3C68DDCCA5982ABB599E92A62555",
        "BootDevice",
        "The SetKeepAliveTime method is used to set how often TCP attempts to verify that an idle connection is still available by sending a Keep Alive packet. If the remote system is still reachable and functioning, it will acknowledge the Keep Alive transmission. Keep Alive packets are not sent by default. This feature may be enabled in a connection by an application. The method returns an integer value that can be interpretted as follows: ",
        "SDDL for remote user transport SA authorization",
        "Command Line Instruction",
        "Unspecified Error",
        "This is an abstract class that shows the base status.",
        "OldThreadWaitMode",
        "CIM_AuthorizedPrivilege",
        "OtherOperationalStatusDescription",
        "A user-friendly name of the storage provider.",
        "Gets only WDAC BidTrace settings that are associated with the specified Process ID. The parameter PlatformId is optional. The default is to return all WDAC BidTrace settings.",
        "OS SCSI path identifier or bus number",
        "No Administrator",
        "//  Persistent bindings are stored in the registry under:",
        "CD_B449E4C982007699901F8B11448557481BCA2B35C4809156A6C3E1390C860FE7.1650.3932095509.389",
        "Content is renamed from old to new location in Offline Files cache; assumes data on server is moved between names through other means",
        "GetRegisteredLicenseServerList",
        "NDIS Dot11 Connection Completion Status Indication",
        "CR_8D99B89B2E26FAE38502F957460FFF2E9E23E0C0D9AA3DEF32147EBB968C38FA",
        "The Win32_Fan class represents the properties of a fan device in the computer system. For example, the CPU cooling fan.",
        "Start (2) changes the state to \\'Running\\'. ",
        "CreatedTargetPortal",
        "select * from SPACES_StorageArrivalEvent",
        "The ByteCount property, when true, causes the computer to count the number of bytes in a document before sending them to the printer and the printer to report back the number of bytes actually read.  This is used for diagnostics when one discovers that bytes are missing from the print output.",
        "48012",
        "The Win32_TSSessionSetting class defines the configuration for Win32_Terminal. This includes capabilities such as Time-limits, Disconnection and Reconnection actions.",
        "CIM_LogicalDiskBasedOnVolumeSet",
        "MS_SmBios",
        "TEST_TRACE_RESERVED_12 Flag",
        "MSNdis_MaximumTotalSize",
        "FillEmptyContentUrls",
        "WMI|Win32_PnPEntity",
        "ConsistencyTimerValue",
        "An opaque tag passed in by the app. 128 bit so that a guid can be stored in it.",
        "iconPath",
        "StopFileName",
        "Weitek",
        "Impact Moving Head Dot Matrix 9pin",
        "FaultType",
        "CIM_SecurityAssociationEndpoint.IdleDurationSeconds",
        "CipherAlgorithm is an enumeration that specifies the encryption algorithm used by the IKESAEndpoint. The list of algorithms was generated from Appendix A of RFC2409. Note that the enumeration is different than the RFC list, since the values of Unknown and Other are taken into account.",
        "Authentication",
        "QPIncomingRead performance counter missing",
        "Whether this association is for a primary handler",
        "ROOT\\microsoft\\windows\\EventTracingManagement\\MS_409",
        "CongestionProvider",
        "R_848678FEA3E9DEEA8B4E9FB42ED8A13EB705C3DB7C73AB893E320FAEEC87714C",
        "The required product.",
        "PauseConversion",
        "ConfigurationStatus is 0 if not configured and 1 if configured",
        "HeapSubSegmentActivated",
        "NETIO_TRACE_PACER Flag",
        "SecurityDebug",
        "CIM_ComputerSystemDMA",
        "I_37CB291E96206B811B242E1B2E99A15E443B14749AA28D9EF51C66CFB85086A0.1608.992405960.282",
        "Configuration document that to be applied.",
        "ExtClock",
        "The InstalledOn property provides the date and time when the update was installed. If this value is unknown, the property will be empty.",
        "1311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        " Microsoft CIM Win32|Win32_DCOMApplication|AppID",
        "TRESPASS",
        "3FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "ref:MSFT_NetAdapterVmqSettingData",
        "Configures the IPsec parameter of the specified VPN connection",
        "The Primary property determines whether this is the primary operating system./nValues: TRUE or FALSE. A value of TRUE indicates this is the primary operating system.",
        "Desktop",
        "ProviderOperation_CreateRefreshableObject",
        "Mountmgr",
        "Bad Destination",
        "Denotes the current health status of the source object.",
        "Whether to allow this rule to take precedence over Block rules.  This setting may only be applied on Allow rules that require Authentication with specific RemoteUsers and/or RemoteMachines.",
        "WSP_ReplicationGroup",
        "ComputerID",
        "Timeout",
        "Creation Date",
        "Unused parameter",
        "GroupConnections",
        "The number of inbound packets which were chosen to be discarded even though no errors were detected to prevent the packets from being deliverable to a higher-layer protocol.",
        "Associates the disk quota setting with a specific disk volume. ",
        "UINT64 Value",
        "CD_09A5E19B62E24065CFCA8EE94EA9E5C149E6CB498581E688EF627C4525368332.2052.1961258099.633",
        "// The total number of packets for which data could not be verified. ",
        "UserAccountControl_RunAllAdministratorsInAdminApprovalMode",
        "MSFC_FibrePortNPIVAttributes",
        "WRITE_OWNER (0X00080000) ",
        "The name portion of the account",
        "The DatabasePath parameter specifies a valid Windows 2000 and Windows NT 3.51 or higher file path to standard Internet database files (HOSTS, LMHOSTS, NETWORKS, PROTOCOLS) used by the Windows Sockets interface.",
        "CustomizeWarningMessages",
        "The certificate ID used to locate the certificate.",
        "ref:MSFT_StorageProvider",
        "ReAlloc",
        "Repair",
        "Description found in win32_networkadapter.",
        "74 - Invalid host name",
        "MEM_BIT_POSITION",
        "Select * from Win32_NetworkProtocol",
        "The number of connections that currently belong to this session",
        "Maximum number of PD receive queues that can be allocated on the adapter. RSS receive queues are not included in this number.",
        "The group name of the connection pool used by the binding element.",
        "RestrictAppToSystemVolume",
        "SamDelMemGrp_Start",
        "0xAFFF0048",
        "point",
        "C_503E99E1F76A9D46449F32E9069632CBB392B8A00D8C4838939B6A5881D7193A",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP_DISCONNECT_DATA",
        "I_304546A1C1E96E9129142E75E297CCEA0DD08492A7C88D17C5C3618E4AA08462.1520.8942720.295",
        "The SetDNSDomain method allows for the setting of the DNS domain. This is an instance dependent method call that applies on a per adapter basis. On Windows 2000 the setting applies to the targeted adapter. On NT4 this setting is global.The method returns an integer value that can be interpretted as follows: ",
        "Win32API|Process and Thread Functions|SetPriorityClass",
        "LAP-D",
        "The Win32_PingStatus class contains the values returned by the standard ping command. More information on ping can be found in RFC 791.",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2041.1860447720.180",
        "MSFT_CliTranslateTableEntry",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"MS_Power_Management_Event_Provider\"",
        "installation Type",
        "e: AT+V.",
        "A bit map that tells when this action will be preformed based on the following",
        "SourceStorageObjects",
        "MIF.DMTF|Software Component Information|002.6",
        "This class manages file pinning.",
        "Policy object for Wireless Network Policy",
        "ref:Win32_SoftwareFeature",
        "Win32_PnPSignedDriverCIMDataFile",
        "This enables IOCTL traces",
        "CD_64659AB9F8F1C4B568DB6438BAE11B26EE8F93CB5F8195E21E8C383D6C44CC41.0.1574635466.180",
        "TcpIPv4HashSupported",
        "Time taken to process resource.",
        "TurnOnPowerShellScriptBlockLogging",
        "WMI|Win32_ComponentCategory",
        "If the provider registration specifies per user initialization, then the User property defines the client principal identity associated with specific instantiation of a provider.",
        "Edition",
        "HttpServer",
        "The Win32_AllocatedResource class represents an association between logical devices and system resources. This class is used to discover which resources, such as IRQs, or DMA channels, are in-use by a specific device.  This class has been deprecated in favor of the Win32_PNPAllocatedResource class.",
        "MethodSignature",
        "The Win32_IDEControllerDevice class represents an association between an Integrated Drive Electronics (IDE) controller and the logical device, for example, a disk drive, connected to it.",
        "Replacement/Piggy Back",
        "{E0B40AA8-544B-4d5e-BA60-A03F136DA83D}",
        "ref:CIM_Policy",
        "PreventInstallationOfMatchingDeviceSetupClasses",
        "MSiSCSI_NICPerformance",
        "MSFT_FileServerToVolume",
        "SetErrorSourceInfoRtn",
        "WMI|Win32_ClassicCOMClass",
        "C3-Envelope",
        "C_BB85D56CC063D388F160FAD75C503ADCEEA6EC0F0714FF843F3191BD8BC9ED19",
        "{673E0A2C-E3D0-11d2-8601-0000F8102E5F}",
        "DisableUnicastResponsesToMulticastBroadcast",
        "AllowUserInputFromWirelessDisplayReceiver",
        "Lithium-ion",
        "This control indicates whether the device should be configured to wake a sleeping system.",
        "SubscriptionDebug",
        "CD_CCF174B484763861274B422B027A53D668C2557EB827A557AB0E7FF6CCAC8EF5.1784.203986476.652",
        "MaximumBaudRate",
        "ColorPlanes",
        "C_B706BC14333E9F557E01BE09BE8FFA1FC0DEE90584F33ADE84BE299A35433F7C",
        "Kernel Perf State Transition Event",
        "Minimum value of IPv4 MTU. The default value is 576. The value can range between 352 and 576.",
        "A physical package is removable if it is designed to be taken in and out of the physical container in which it is normally found, without impairing the function of the overall packaging. ",
        "TRACINGAPI Flag",
        "Delete",
        "Video input type",
        "MEM_NODE",
        "The RewritePartition property specifies whether the partition information has changed. When you change a partition (with IOCTL_DISK_SET_DRIVE_LAYOUT), the system uses this property member to determine which partitions have changed and need their information rewritten.",
        "PoolNonpagedPeak",
        "Flag to indicate that this SOM is blockedby a SOM lower in the SDOU hierarchy",
        "Wait for sync when logging on",
        "TimerExpirationBegin",
        "ThreadedDPC",
        "If TRUE, the storage subsystem will automatically retire missing physical disks in this storage pool and replace them with hot-spares or other available physical disks (in the storage pool).",
        "If this is true, administrators will be able to create firewall rules which allow unsolicited inbound traffic to be accepted.  If this is false, such rules will be ignored.",
        "The order in which this SOM is evaluated with regard to other SOMs when evaluating Group Policy for the current target",
        "Reverse Roles operation requires Read Only source",
        "21B9B453C88A99D39E80DF5B2",
        "Example: LPT1:, LPT2:, LPT3:",
        "CD_B18E35596C7AC0C7A9B67022489D5864495B96E12E56FDACDF13C1E2D5D12666.2060.753767182.4658",
        "RD_TRACE_FDO Flag",
        "The 802.11 network type",
        "If the virtual disk's Usage field is set to 1 - 'Other', this field must contain a description of the vendor or user defined usage. If Usage is not set to 1 - 'Other', this field must not be set.",
        "Specifies the printer that will be used.",
        "Array of T-state dependencies",
        "An entry on the object's SACL",
        "object:MSFT_ReplicaPeer",
        "This property returns the device encryption status as reported by EasClientSecurityPolicy.CheckCompliance result",
        "{34e1fa48-b9b6-11d4-b675-002048570337}",
        "{3292A418-BAC2-4BBF-BB07-66A1CB3B8B7D}",
        "RSOP_IEAuthenticodeCertificate",
        "0 - 'Healthy': The volume is functioning normally.",
        "BootPartition",
        "Suspended (5) indicates that the Job is stopped, but can be restarted in a seamless manner. ",
        "DisableHighAvailability",
        "UUUUUUUU",
        "Cholesteric LCD",
        "R_0CEA2BFA85C402C6870520D8882306321579F18BD47E8E598ED675B423931597",
        "R_75718F4326DA5F211EA5E599736AEB4B062053726FB954E7CB56C0359501D763.1520.42189104.520",
        "Pending full scan due to threat action",
        "0x00000002 - If the new owner already has a profile, and ReplaceNewOwnerProfile is specified, then ",
        "object:MSFT_StorageSubSystem",
        "MSNdis_WmiTcpConnectionOffload",
        "8-Inch Floppy Disk",
        "dataTransferLength",
        "SEL_EVENT_DATA1 is valid",
        "0x80050064",
        "This property defines the status codes that MAY be return by a conforming CIM Server or Listener. Note that not all status codes are valid for each operation. The specification for each operation SHOULD define the status codes that may be returned by that operation. ",
        "An array of integers indicating the graphics and 3D capabilities of the video controller.",
        "{0fee8708-df65-456e-b4ca-fa623266a12a}",
        "s submission.",
        "CD_9B5F61295CB5EF58512B95264F50C53A1EAB89490A47953F5E027131D60A14DF.1758.3838567022.727",
        "EnterpriseProxyServers",
        "0xEFFF000F",
        "CIM_Phase1SAUsedForPhase2",
        "MSNdis_80211_WLanBssId",
        "PreventManagingSmartScreenFilter",
        "Indicates if the Adapter supports segmentation of a packet containing IPv6 Extension headers.",
        "IPv4ReceiveEncapsulation",
        "Win32API|Device Context Functions|GetDeviceCaps|NUMPENS",
        "error",
        " Command)",
        "R_455876B64E565F4962FC035AF2C8087D1797E42AAA9586F45C5A3E20F37175C3",
        "doWipePersistUserDataMethod",
        "Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|PeakPagefileUsage",
        "Signature",
        "If provider is configured for Per Local Initialization, then the Locale property refers to Locale's particular instantiation of a provider instance.",
        "R_CAD4BC0418B92AF385128D89B08989F8AE935585E9C019DDE2E4449A4CA88416",
        "AppUserModelId",
        "Indicates if TCP checksum offload is currently enabled for IPv6 packets on this Adapter.",
        "TRACINGREQUEST",
        "The platform architecture of the ODBC Connection Pooling PerfMon counters to disable. Possible values are '32-bit', '64-bit' or 'All'. The default is '32-bit' on a 32-bit process and '64-bit' on a 64-bit process. This is the platform architecture on the remote machine if this command is executed on a remote CIM session.",
        "True if plugins are enabled",
        "CD_23A50366135FBF364F350BC34F639BE141A61D21A478BB4C1230D838F1296A4E.1136.2346883401.533",
        "GetSupportedSize",
        "ActiveCooling",
        "Provisioning Authority of the VPN Profile.",
        "FltIoCompletion",
        "MSChangerDriver",
        "CD_211E06180BCB1B723514A6B61A4F9437E8B7FAF07E83A8E52C3887B5E0B0CDFC.29.1615907457.524",
        "sValueName",
        "Ablative Write Once",
        "PerformiSNSDiscovery",
        "ExcludeWUDriversInQualityUpdate",
        "NdisFddiRingDetect",
        "NETBIOS Flag",
        "C_D760BC36A4E7F2EC138BE2205EECF2AA17893C6B9D8DB739718A0ED0B078D4B0",
        "8E152A48",
        "GetDescriptor",
        "R_B6D5ABBE2F1027301C23A1CF884681090FD42092F2E95A0F33AA6207C9180DA3",
        "SDDL string describing Local Users that are allowed by this rule.  If this is empty, all users are allowed.  If LocalUsers/RemoteUsers/RemoteMachines are specified, then they apply conjunctively, and this is an ''Allow-Bypass'' rule and ProtectionLevel must be set above None (so that authentication is required).",
        "MIF.DMTF|Bus Port|001.2",
        "CSwitch_V4",
        "CD_DD0471D542F51C9EA0B9D431D1C99AEBFD6E3F5C7A54107E961A136C056FBC71.1560.1209585044.1486",
        "The StartFileName input parameter is a string that names the child file/directory to use as a starting point for UncompressEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred fr",
        "CIM_ProtocolEndpoint.ProtocolIFType",
        "The channels that are outgoing from the service instance.",
        "SCSITarget",
        "Specifies the path that contains the named values. ",
        "Support 16Bit Mode",
        "{180F6B35-6C1B-403b-ABA2-16FB4F935AC3}",
        "The StartFileName input parameter is a string that names the child file/directory to use as a starting point for DeleteEx.The StartFileName property typically, is the StopFileName parameter specifying the file or directory at which anerror occurred from t",
        "Used space on differential area volume",
        "Support RTSCTS",
        "Lower layer down",
        "BlockPicturePassword",
        "PageNumber",
        "AllowWindowsTips",
        "hundredths of degrees centigrade",
        "ref:RSoP_PolicySettingStatus",
        "LogonHours",
        "I_BD93AFD54A2CBC0AAE6AC538B824779A9A1273B2B91BB9D43D9256B804C5A7BC.445.1.30870",
        "DirectoryCacheLifetime",
        "Win32_PnPEntity",
        "CIM_ERR_NO_SUCH_PROPERTY",
        "HideUserTile",
        "The component.",
        "The boot configuration for this device conflicts with other devices.",
        "C_0C9AB5617BA8A9B7C3F74C1EB3942161CC46D714C581CA50C949594A28711EC7",
        "RSOP_FolderRedirectionPolicySetting",
        "Unique identifier for the port. This idenitifer must be unique among all ports on all adapters. The same value for the identifier must be used for the same port in other classes that expose port information",
        "Binary path",
        "CIM_Printer.DefaultMimeType",
        "CD_17F8BC3833237B1EA834BBEC43AD4224D002BECFAA4FFA94A67748C23C3FA2BD.2614.2100074799.398",
        "The LocalName property indicates the local name of the connected network device.",
        "2) A MaxLen of 10 is too restrictive and leads to unclear enumerated values. ",
        "{2b1831b2-2216-4ede-a469-9fe3dd6d5a7e}",
        "This is a wrapper method used to set both the one time boot source and persistent boot source added to support the PCSVDevice cmdlets. This just calls the other two methods internally. The API users for this class should call the other methods directlly insted of this. This method will only change one setting at a time, if you pass values for both paramters, then this method will fail.",
        "ProcessorMaxClockSpeed",
        "An integer indicating the DMA channel address size in bits. ",
        "Bandwidth Reduced",
        "//        SM-HBA Version 1.0 and FC-HBA 2.18 specification.",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\AuxUserType\\2[Default]",
        "LinkLocalConnections",
        "ISCSI_ERR_INVALID_AUTHMETHOD",
        " 1 - Both ",
        "IL_AD6336C175D9F9D2E56D05ECB1A5E2CBA761DB39CD3155C45C4ABCA3DE2AF082.2676.2068188204.275",
        "UserDiskMa",
        "Instruction",
        "Phase 1 SAEndpoint that protected the negotiation of the phase 2 Security Association. An example of a phase 1 endpoint is an IKESAEndpoint.",
        "CIM_PowerUtilizationManagementCapabilities.PowerUtilizationModesSupported",
        "HBA_EVENT_TARGET_OFFLINE",
        "If one changes the OverWriteOutDated property value to 1-365, the OverWritePolicy property value will be 'outDated' ",
        "The statistical object - in this case, the error counter class. ",
        "13 - 'Fractured': An Async or Sync replication is fractured. ",
        "49001",
        "CD_2F43B8EB8E14762A257D84DCB10913E4CD9E8069D8AEA3384120BB143668FB2E.91.3074961256.667",
        "LastAccessed",
        "EventTime",
        "CR_4956F7377CADF88BAEF29AB167534942D2330E0E6BECB3AE4512BFCC91561A1E",
        "Indicates the default media type to use when creating new virtual disks on this storage pool.",
        "Asynchronous",
        "CIM_FromDirectoryAction",
        "{41cf6a6e-cfb6-4b00-b6e7-39ccbd0c3f88}",
        "ActionAfterReboot",
        "#define HBA_EVENT_PORT_ONLINE           0x202",
        "\\\\.\\ROOT\\cimv2:__Win32Provider.Name=\"Win32_WIN32_TERMINALSERVICE_Prov\"",
        "REDBOOK_WMI_MAX_SECTORS_PER_READ",
        "The InstalledDisplayDrivers property indicates the name of the installed display device driver.",
        "MsftDiscFormat2Raw_DebugDestructor",
        "This method rebalances the data in the storage pool.",
        "This flag is not used",
        "{35E25AA4-E3D1-11d2-8601-0000F8102E5F}",
        "IL_5A83D395085B6B03108F7917D2C4F3D0683B0E479C446703225592BD963CB748.756.1.38386",
        "KI_FD3BBD4C42AC2F7FEF264340A9EB78A581FE5C28561CB63EDF780B329EAC2EE4",
        "This field indicates the largest contiguous block of free space on the disk. This is also the largest size of a partition which can be created on the disk.",
        "4 - 'Re-run Job' indicating that the job should be re-run ",
        "CompletesInstance",
        "VxlanUDPPortNumber",
        "RSOP_PolmkrApplicationSetting",
        "SecurityDescriptorStringList",
        "Msft_WmiProvider_CreateInstanceEnumAsyncEvent_Post",
        "The owner of the firewall rule, as a SID.",
        "object:MMAgentComponents",
        "STORAGE_FAILURE_PREDICT_DATA",
        "AccountName",
        "The VerbType property identifies the type of the verb. If the VerbType property has the value 2 (CommandLine), the verb is executed by invocation of the command line utility named in the Derivation property. If no Parameters are provided as a part of the verb definition, at invocation time the text up to the next carriage return should be passed to the utility named in the Derivation property. If any Parameters are provided as a part of the verb definition - the parameter definitions should be used in checking actual parameters provided at invocation time.",
        "CD_0755C98F98A88832CE4AF388D7FD0A485984E8C8093D5B69AF797BCD21D684DE.1528.745101946.5361",
        "Power PC",
        "To indicate whether the address family for this interface is v4 or v6.",
        "IdentificationField",
        "SettingsImportNotifyDelayInSeconds",
        "Session Digest Errors",
        "SessionGuid",
        "Specifies whether this printer will be shared.",
        "TRACE_PERFORMANCE Flag",
        "Specifies the marking technology used by the Printer.",
        "MaxBaudRateToPhone",
        "Fastest Available Processor Throttle State",
        "Win32_PageFile",
        "rsion property indicates the version number of the initialization data for the Win32 display device.  ",
        "Capabilities and management of the keyboard logical device.",
        "This MOF defines the following keywords: \\'UNKNOWN\\', \\'CONFIGURATION\\', \\'USAGE\\', \\'SECURITY\\', \\'SERVICE\\', \\'MOTIVATIONAL\\', \\'INSTALLATION\\', and \\'EVENT\\'. These concepts are self-explanatory and are further discussed in the SLA/Policy White Paper. One additional keyword is defined: \\'POLICY\\'. The role of this keyword is to identify policy-related instances that may not be otherwise identifiable, in some implementations. The keyword \\'POLICY\\' is NOT mutually exclusive of the other keywords specified above.",
        "60011",
        "PNP_RESOURCE_INFO_LEVEL",
        "NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic",
        "ReliableMessagingVersion",
        "Whether to turn on packet coalescing filters. One of the following values:  - Disabled  - Enabled",
        "SPACES_StorageSubsystemToStorageFaultDomain",
        "Debugger Event",
        "ProtectionTechnologyStatus",
        "Represents security settings for a managed element",
        "The total number of successful SAs created during main mode negotiations.",
        "Registry_TxR",
        "NDIS 802.11 device radio configuration parameters",
        "GetRecordCount",
        "WaitTillEnabled",
        "SectorsPerTrack",
        "Source",
        "Capabilities and management of the battery logical device. This class applies to both batteries in laptop systems and other internal/external batteries, such as used in, or as UPSs.",
        "MSFT_CliAlias.FriendlyName=\"BootConfig\"",
        "The bhaviors associated with this operation.",
        "NdisAtmMaxActiveVciBits",
        "MSFT_PCSVLogRecord",
        "Bid2Etw_MSDAREM_1_Trace",
        "The MaxPartitionCount property indicates the maximum part count for the tape drive.",
        "R_35002FCC142049858649CB1BCD62043BE23AE98B3CC34288C266F1C2B8C4A3A3",
        "CreatedStorageJob",
        "21 - Invalid parameter",
        "MIF.DMTF|Memory Array Mapped Addresses|001.4",
        " Where Element = # and Setting = #",
        "percent * 10^-2",
        "MDM_VPNv2_NativeProfile02",
        "UserRefreshEnabled",
        "SCSI Port",
        "PolicySourceSessionDirectoryExposeServerIP",
        "The Win32_PCMCIAController class manages the capabilities of a Personal Computer Memory Card Interface Adapter (PCMCIA of PC card) controller device.",
        "ReplicasPerSourceSnapshotMax",
        "Bytes Sent",
        "C_BA2C021F642EFC72B5ED5FC31813540F5BA649D97F9C2021662B9F43F49C356E",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_511F4789E4422A6FBC095B24CEA0FC371975762D13382D739A2A7ED6638FF240E",
        "PNP_EVENT_VERBOSE_LEVEL Flag",
        "R_336E7A880175CEC7983BFE0692AA78604916DE79A3400288DC3CA68EB96A07CD",
        "A string used to identify the thread.",
        "int32",
        "The AccessPoint or ProtocolEndpoint dependent on the LANEndpoint.",
        "19 - 'Requires activate': The requested operation has completed, however, the synchronization relationship needs to be activated before further copy operations can be issued. ",
        "User Intervention Required",
        "11017",
        "Background_Intensity",
        "QueueName",
        "MSFT_SmbShare",
        "{3f2c141d-83bc-11dd-94b8-001d09162bc3}",
        "Maximum bytes of user data in a single packet supported by the Adapter.",
        "localsystemhost",
        "WLANHC_RNWFMSM Flag",
        "Deletes the User or Group from the existing.",
        "MDM_Firewall_DomainProfile02",
        "R_7BD86541C4D37094DD12C29DFB358834E34ADB28AD42E60E36A946EB5619F833",
        "The maximum buffer pool size for the binding.",
        "I_7C20621C04548080C1EE521AE245952B5749C3FB727288FDD27EDA07E39B175A.2505.1748417304.294",
        "MSFT_NetAdapterSriovElementSetting",
        "The Attributes property indicates the attributes of the printing device. ",
        "A power supply may have an associated voltage sensor, monitoring its input voltage. This is described by this association.",
        "NdisStatusDot11PhyStateChangeIndication",
        "System stability index value history",
        "This bit indicates whether the machine supports docking",
        "Slots can be located in close proximity on hostingboards or other cards, such that if one of these slots is populated by an adapter card, the other slot must be left empty. This relationship is indicated by the SharedSlots boolean set to TRUE.",
        "Supplies the MAC address used as the Source Hardware Address (SHA) field of the ARP response.",
        "InPartition",
        "Resets the advanced property of a network adapter to its factory default value.",
        "A physical component can be hot swapped if it is possible to replace the element with a physically different but equivalent one while the containing package has power applied to it (i.e., is 'on').  ",
        "Select * from Win32_OnBoardDevice",
        "Filter_Trace",
        "The location information for a PCI network adapter. This string includes bus, device and function number for the network adapter as displayed in device manager.",
        "NS_5456CA76306BB18057C7C64D8BB2414E19DC9CF4F51E2760534CB23439D79B06\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "MSFT_StoragePoolToStorageTier",
        "LowerFiltersCount",
        "This method hides a virtual disk from an initiator. This operation is also known as 'unexposing' or 'masking' a virtual disk.",
        "AvailableRequestedStates",
        "The Win32_PhysicaMedia class represents any type of documentation or storage medium, such as tapes, CD ROMs, etc.",
        "PageOut",
        "LogPixels",
        "The maximum number of Virtual Functions that can be created on the adapter",
        "HeapAffinityManagerEnable",
        "ACPI processor idle states (C-states)",
        "SupportedObjectTypes",
        "Network name",
        "Local Phone Number",
        "GetEffectivePermission",
        "Maximum link speed encoded, valid only for PCI-E devices.",
        "The currently allocated size of the virtual disk. If the virtual disk's ProvisioningType is 2 - 'Fixed', this value should equal Size. If the ProvisioningType is 1 - 'Thin', this value is the amount of space actually allocated (i.e. some value less than Size).",
        "NetTtCim",
        "Global Atoms",
        "The ReasonCode parameter specifies the reason for initiating the shutdown.",
        "RemoveStorageFaultDomain",
        "Execute in 'count by word' mode",
        "TaskThreadsPerUser",
        "The GetDWORDValue method returns the data value for a named value whose data type is REG_DWORD. ",
        "#define HBA_EVENT_PORT_ALL              0x2ff",
        "Specifies the property values of the ODBC driver to be modified or added. Format as an array of strings where each string is: <key>=<value>.",
        "blockpagingio",
        "AddByTcpPort",
        "The card in the slot.",
        "CD_D3AFCBAF22653374F26FE8337CBE6005C90DBCA84C064E5B13CA4595121B7209.1.3839519982.246",
        "The endpoint address and binding used to contact the locat security token service.",
        "Win32API|Service Structures|SERVICE_STATUS|dwWin32ExitCode",
        "Specifies the ID of the print job to resume.",
        "Failure Predict Event",
        "MDM_RestrictionsUser",
        "The short summary description of the action.",
        "1:ACTION C ",
        " A driver service.",
        "Sets security descriptor to the specified structure",
        "Friday",
        "HostProcessTraceGuid",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2426.1493845832.368",
        "// This method is recommended.",
        "RestrictedSitesZoneAllowScriptInitiatedWindows",
        "units",
        "SMBIOS|Type 24|Hardware Security Settings|FrontPanelResetStatus",
        "HypercallPageVa",
        "NetDirect Port",
        "0x08000000",
        "OSProductSuite",
        "ref:MSFT_NetAdapterIPsecOffloadV2SettingData",
        "A file on the disk could not be opened.",
        "The SettableParity property indicates whether parity can be set for this serial port.",
        "{67F74295-BA42-11d2-85E5-0000F8102E5F}",
        "Complete memory dump",
        "Dependency domain number to which this C-state entry belongs",
        "ModifyObjectLabel",
        "{DBAD0F60-DB34-11d2-85FC-0000F8102E5F}",
        "UdpIp",
        "CD_47B8D9FB99659B3546500CA55AB79FFA62B2FC16F96D81F5B390216EEB78A7A9.38.1750957004.1932",
        "ISO 802.5j Fibre Token Ring",
        "1 - 'Thin': Storage for the virtual disk is allocated on-demand. ",
        "MSDAPRST.1 formatted output (W)",
        "PStateContext",
        "NDISWMI_TRACE_CALL",
        "Thread_V3_TypeGroup1",
        "MSFT_NetIKEP2AuthSet",
        "The SettableStopBits property determines whether the number of stop bits can be set on the serial port",
        "Voice FGD EANA",
        "Total number of bytes that have resulted from one or more coalescing events",
        "5 - Password Not Required -  No password is required.",
        "CIM_PhysicalComputerSystemView.InstallSoftwareFromURI(InstallOptions)",
        "MSFC_FibrePort",
        "Multipath Enabled",
        "TimeStreamDelay",
        "\\\\.\\root\\cimv2:__Win32Provider.Name=\"MSIProv\"",
        "No value",
        "Progress Update",
        "In some circumstances, a LogicalPort might be identifiable as a front end or back end port. An example of this situation would be a storage array that might have back end ports to communicate with disk drives and front end ports to communicate with hosts. If there is no restriction on the use of the port, then the value should be set to \\'not restricted\\'.",
        "MsftDiscFormat2Data_DebugGeneral",
        "DeActivated",
        "This property indicates whether this profile belongs to a special system service.",
        "The Setting reference represents a desktop configuration existing on the computer system.",
        "Boolean indicating whether the Privilege is granted (TRUE) or denied (FALSE). The default is to grant permission.",
        "The Win32_NetworkConnection class represents an active network connection in a Win32 environment.",
        "agent_domain",
        "iSCSI Redirect Session Info",
        "DVD-Video",
        "Configures the Virtual Filtering Platform ETW provider on a computer.",
        "WMI service operational parameters management. ",
        "DriveRequiresCleaning",
        "1797 - The printer driver is unknown.",
        "this flag indicates that the C1 state is supported on all processors.",
        "DeleteAfterCopy",
        "Specifies the position of the physical memory in a 'row'. ",
        "The actual encryption algorithm used by the SA.",
        "ConfigInfo",
        "23 - CIM_ERR_PULL_HAS_BEEN_ABANDONED. The specified Namespace is not empty.",
        "DisableEnhancedNotifications",
        "DisableScanningMappedNetworkDrivesForFullScan",
        "Small Business Server Premium Edition",
        "If it is a member of a concrete pool, the health and operational statuses should be reset to 1 - 'Healthy', and 1 - 'OK', respectively. If any additional errors are detected after Reset, the health and operational statuses should reflect these new errors. ",
        "WMI|Win32_LogicalProgramGroup",
        "The StartTime parameter represents the UTC time to run the job.  This is of the form YYYYMMDDHHMMSS.MMMMMM(+-)OOO, where YYYYMMDD must be replaced by ********./nExample: ********123000.000000-420 which implies 12:30 pm PST with daylight savings time in effect.",
        "The SettableStopBits property indicates whether stop bits can be set for this serial port.",
        "ProductName",
        "CD-ROM management.",
        "The height of the physical package in 'U's. A 'U' is a standard unit of measure for the height of a rack or rack-mountable component. It is equal to 1.75 inches or 4.445 cm.",
        "TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls",
        "expirationDate",
        "Whether to allow Trusted Intermediaries to be notified when the encryption keys for this SA change.",
        "ModuleInstance",
        "Capabilities and management of an CIM_InfraredController.",
        "Imports the cryptographic key used in the generation of segment secrets.",
        "{DCA1D084-E3D3-11d2-8601-0000F8102E5F}",
        "Aborts any service-initiated update immediately after first install by the configured amount of time.",
        "Mapper",
        "IR_A963FF6A8458E9C4FEA354824C031F4237B8648981577F19FD6854C86994DA8C",
        "MinLifetimeKilobytes prevents certain denial of service attacks where the peer requests an arbitrarily low lifetime value, causing renegotiations with expensive Diffie-Hellman operations. The property specifies the minimum lifetime, in kilobytes, that will be accepted from the peer. A value of zero (the default) indicates that there is no minimum value. A non-zero value specifies the minimum kilobytes lifetime. Note that there has been considerable debate regarding the usefulness of applying kilobyte lifetimes to phase 1 security associations, so it is likely that this property will only apply to the subclass, IPsecAction.",
        "The Win32_SCSIController antecedent reference represents the SCSI controller associated with this device.",
        "MSFT_NCProvEvent",
        "IL_1DD976C2C1EC41AE2C2E9AE437798C835C95C683651B2DFFD6DE00EF8BD37B9B.77.4005104059.331",
        "Parallel Port EPP",
        "RequestCount",
        "KeyUsage",
        "LPC_TRACE_WORKER Flag",
        "Leak Track Flag",
        "{f33959b4-dbec-11d2-895b-00c04f79ab69}",
        "AllowMdnsAdvertisement",
        "SPACES_StoragePoolToResiliencySetting",
        "object:MSFT_NetAdapterPacketDirectSettingData",
        "D.2668.2340397220.283",
        "9 - 'Fracturing': fracture-in-progress. ",
        "Verbose Flag",
        "SECURITYDISABLER",
        "DEVPROPKEYArray",
        "A value that indicates the time delay between retry cycles when attempting to deliver a message that could not be delivered immediately.",
        "Values: TRUE or FALSE.  A value of TRUE indicates elapsed timeouts are supported.",
        "{0a214808-e35f-11d0-9692-00c04fc3358c}",
        "WmiQueryPortState",
        "{8502C584-5FBB-11D2-AAC1-006008C78BC7}",
        "PolicySourceLPTPortMapping indicates whether the property LPTPortMapping is configured by Server (0),Group Policy (1), Default (2).",
        "PnP Support",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_340CBE78ECDC147CC0D8E08D25E28D5812DD352A6020A7847860B23A3D747C84",
        "IP & IGMP multicast",
        "WMIDataID",
        "TRUE if session created from a persistent login",
        "The DisplayFlags property contains two bits of information about the display. This member communicates whether the display device is monochrome or colored, and interlaced or non-interlaced, by masking its value with the DM_GRAYSCALE and DM_INTERLACED masks respectively. ",
        "The TotalCylinders property indicates the total number of cylinders on the physical disk drive.",
        "BootStatus",
        "1.0.0",
        "object:MS_SMHBA_PROTOCOLSTATISTICS",
        "Bid2Etw_SQLSRV32_1_Trace_TextA",
        "devicePropertyKeys",
        "Specifies the maximum level of trace messages to gather. Each subsequent level will include events from previous levels. (i.e. 5 - 'Verbose' will log all events.)",
        "The StopFileName output parameter is a string representing the name of the file/directory where CopyEx failed. This string parameter will be null if the method succeeds.",
        "CD_5125E87B865F9C6DC59486D1BB02124F8523E09293ABB2126C845245277E44EE.2197.3343646218.2001",
        "SQLOLEDB_1 formatted output (W)",
        "Call cancelled",
        "This class is used to report LSOv1 capabilities on a network adapter.",
        "EnableLevel",
        "Enable NAT64",
        "PoolType",
        "Supplies a mask indicating which bits of the pattern to match against incoming packets.",
        "Select * from Win32_OSRecoveryConfiguration",
        "The Set-AppBackgroundTaskResourcePolicy cmdlet allows the user to configure the use of Global pool by background tasks",
        "MSFT_CliAlias.FriendlyName=\"NetProtocol\"",
        "StdRegProv",
        "HP-HIL",
        "amps at 120 volts",
        "Horizontal image size (mm)",
        "The TcpMaxConnectRetransmissions parameter specifies the number of attempts TCP will retransmit a connect request before aborting. Valid Range: 0 - 0xFFFFFFFF.",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\CrashControl|AutoReboot",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardDate|wMilliseconds",
        "AdapterWWN",
        "IncoherentWithHardware",
        "CIM_ReplacementSet",
        "0xC0050072",
        "{447956ff-a61b-11d0-8dd4-00c04fc3358c}",
        "Indicates if the Adapter supports TCP checksum validation offload for receive IPv6 packets.",
        "VbsEnabled",
        "ROOT\\Microsoft\\Windows\\Storage\\providers_v2",
        "{227C5B36-F148-4B4B-AEC1-943E394D9885}",
        "EVENT_TRACE_FLAG_MDLREADCOMPLETE",
        "StreamingAllowPackageInstallationRoot",
        "object:DtcLogFileSettings",
        "LAN MAC Address of the target PCSV device",
        "MessageVersion",
        "DoNotAllowDriveRedirection",
        "ApplyOnly",
        "Idle Disconnect Seconds",
        "Name of the storage health setting being set.",
        "Specifies the path to a file containing PDL for a separator page.",
        "ReplayCounter",
        "The plug and play state of the network adapter.",
        "HBA_EVENT_LINK_INCIDENT",
        "SM_GetAdapterPortAttributes",
        "{0F73ED55-8ED9-11d2-B340-00105A1F8569}",
        "Capabilities and management of the flat panel logical device.",
        "Win32_Bus",
        "Microsoft-Windows-OfflineFiles-CscApi",
        "This property allows the specified job to be interactive (meaning a user can give input to a scheduled job while it is executing).",
        "Last Write Time",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_13770FB29B535A976ABDF141714ADA919FC9C51EFC37EDB5C1E955ACE56BE9DB",
        "The DisplayFrequency property indicates the refresh frequency of the display  The refresh frequency for a monitor is the number of times the screen is redrawn per second. ",
        "Example: &K2.",
        "CD_0225910331B79FEA7A0ECC2E4C8BDD189B002B524044FF48F864D7BDEF12F05B.2490.482081186.181",
        "Encryption Types Available",
        "MIB.IETF|MIB-II.sysServices",
        "ECFirmwareMajorRelease",
        "ReportingAdditionalActionTimeOut",
        "This is the guid id of the object this element refers to.",
        "Identifier of the IKE phase 1 negotiation responder. Combined with the InitiatorCookie, this value, in string form, may be used to construct the value of the key field \\'Name\\', inherited from ServiceAccessPoint.",
        "The SystemDevice property indicates the physical disk partition the operating system is installed on.",
        "R_50988C8CC93A3243BAA0056B1B959C7138E8342783269A1D2B5E4A28855995C8",
        "Unique Threat ID",
        "Example: 1.25",
        "Example: EDT = Eastern Daylight Time. ",
        "ParentClass",
        "Win32API|Network Management Structures|AT_INFO|Command",
        "tartWhenAvailable>",
        "Number of ACPI processor throttle states",
        "Loader search flags",
        "mE083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        " Type of service",
        "Data size hint (in bytes) above which read and write operations will yield better results than send and receive operations",
        "OperatingStatus",
        "Esp-auth-and-cipher",
        "ipsecName",
        "MSFT_DscTimer",
        "OwnerCheckDisabled",
        "Example: System Enclosure 1",
        "R_3EE174B01792C3896222E757E49B9B60C68E15C93D8D9614EF55A8EF89C4DA61.1475.259980034.606",
        "Represents an auth proposal that uses certificates to authenticate the remote peer.  Instances of this class only exist as embedded instances within a MSFT_NetIKEP1AuthSet and MSFT_NetIKEP2AuthSet.",
        "Slots are special types of connectors into which adapter cards are typically inserted. The CIM_SlotInSlot relationship represents the ability of a special adapter to extend the existing slot structure to enable otherwise incompatible cards to be plugged into a frame or hosting board. The adapter effectively creates a new slot and can be thought of (conceptually) as a slot in a slot. This enables cards that would otherwise be physically and/or electrically incompatible with the existing slots to be supported, by interfacing to the slot provided by the adapter. This has many practical uses. For example, networking boards are very expensive. As new hardware becomes available, chassis and even card configurations change. To protect the investment of their customers, networking vendors will manufacture special adapters that enable old cards to fit into new chassis or HostingBoards and/or new cards to fit into old. This is done using a special adapter that fits over one or more existing slots and presents a new slot into which the card can plug.",
        "MIF.DMTF|Temperature Probe|002.19",
        "DnsSecQueryIPsecEncryption",
        "InterruptVectorCoalescingSupported",
        "SecurityBindingElement",
        "Flags 2",
        "Flow Control settings are enabled.",
        "MCA_WARNING_PCI_BUS_MASTER_ABORT",
        "MSDART.1 formatted output (W)",
        "16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2136.3952311231.180",
        "{4C51D7AE-DB22-11d2-85FC-0000F8102E5F}",
        "Win32_MemoryDeviceLocation",
        "Win32API|System Information Functions|SystemParametersInfo",
        "HBA_EVENT_PORT_ONLINE",
        "PreventCertErrorOverrides",
        "X25 Facilities",
        "{8502C4BA-5FBB-11D2-AAC1-006008C78BC7}",
        "MaxPreferredLifetime",
        "Kernel Idle States",
        "The Encapsulated Packet Task Offload setting data for network adapter.",
        "MSFT_TaskDailyTrigger",
        "List of resources affected by the threat (using a <schema>:<path> format)",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_0AB5FE8B82025AB1311A722ADBCABA39548BD06B6E3EE3FDC272C88EEDCF65DCb",
        "The Suspend method suspends execution of providers. All calls passing through a particular instance of the provider will be pass through aninterception layer, this layer will fail the call. Depending on the particular operation, the client may receive the status code WBEM_E_PROVIDER_SUSPENDED ",
        "The total number of fragments for the page file.  If there is no page file on the volume this property will be NULL. This property is deprecated because page file fragmentation is no longer available. The value returned for this property will always be zero.",
        "6 data bits",
        "Connecting",
        "{553644e9-f998-48c3-b037-26e5909f4333}",
        "Responder ID at time of the event",
        "TL_FUNC",
        "CD_E7845F3041269988C5A1847DE98EF0D88E59CE50ED3A8AA1E310C1A1F393BB81.39.79970766.239",
        "Win32_PublishComponentAction",
        "PipeMgr_Reach Flag",
        "RxTxControl",
        "SpinLockAddress",
        "NEC201PL",
        "9517F3108A323CCB520DE03AFA2EB81.2219.1520024917.7330",
        "SessionFailureCount",
        "TotalMFTSize",
        "ThirdParty",
        "This method deletes a file share. Deleting the share does not delete the underlying volume.",
        "The Setting reference represents a CIM_VideoControllerResolution containing settings that can be applied to the video controller.",
        "Multihop element replication",
        "SamRemoveMemFromForeignDom_Start",
        "The unique id of the storage tier associated with this extent.",
        "If TRUE, this application must be installed if one of the applications in its list of upgradeable or replaceable applications is already applied to the target",
        "IsAutoUnlockKeyStored",
        "NewVersion",
        "CD_4BB71B6ADFF06C586A8BDF449E468900F2E5FA784A24501C7DD0806A9C51B570.2041.1898443703.574",
        "The ConfigurationDialog property contains the modem initialization string. This property is comprised of command strings from other members of this class.",
        "Overrides CheckForSignatureBeforeRunningScan.  Aborts any service-initiated update if signature was updated successfully within this amount of time. Time in minutes.",
        "Dot11 Link Quality status information.",
        "Product version (major, minor, build, revision)",
        "{F34765F7-A1BE-4B9D-1400-B8A12921F704}",
        "AddressSize",
        "User to be notified upon job completion or failure. ",
        "// This class must be registered with dynamic instance names using",
        "ExpirationDate",
        "Thread_V1_TypeGroup2",
        "2 - 'Information': The event is for informative purposes. ",
        "InternetZoneAllowDragAndDropCopyAndPasteFiles",
        "TM_INTERFACEHOP Flag",
        "tteryLife",
        "C_943386A936885D346F0D61FA24D7BB2533B7B797B4E446178A40D4E6F2C1683A",
        "MSNdis_PciDeviceProperty",
        "BAUD_150",
        "KernelPerfStateChange",
        "Win32Registry|Software\\Microsoft\\Windows NT\\CurrentVersion|RegisteredOwner",
        "Win32_SID",
        "CD_B209BBC3E9792036932058EAFDFF59DF6B02D2E0E24C683DBB3CFAD2B25B83E4.1083.980680094.631",
        "CD_009060D2904B4B02AF55083DEF7BC672283599AF1BEDA6D3B9EC703CB3D5B011.154.1949465910.785",
        "Real-time scan direction - Enumeration",
        "Qualifier for Licensing Mode",
        "60000",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSACCOUNT_Prov\"",
        "Values: TRUE or FALSE. A value of TRUE indicates the content of the window is displayed while the user moves the window.",
        "The drivers for this device are not installed.",
        "CD_59A8BCB9F6971B321C776BA9F2959B669CA7F5AE7D9DBEF59E2C6406BCC884D3.1791.1.11296",
        "TRUE if drive supports hardware error correction",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|iMinSockAddr ",
        "RestrictedSitesZoneAllowLessPrivilegedSites",
        "WWPNVirtualPort",
        "MGR_TRACE_RESERVED_13",
        "SystemConfig_V2_ProcNumber",
        "The user-friendly interface index.",
        "Sets the location at which the service WSDL is published for retrieval using HTTP.",
        "fTokenRedirection",
        "Cartridge Disk",
        "NA-10x13-Envelope",
        "\"Predictive Failure\" indicates that an element is functioning normally but a failure is predicted in the near future. ",
        "MDM_Policy_Config01_CredentialsUI02",
        "AddElementsToGroupSynchronized",
        "To indicate that ARP, Neighbor Discovery, Wake-On-LAN patterns should be turned on.",
        "{DF87D4ED-4612-4D12-85FB-83574EC34B7C}",
        "Indicates that the file system is designated as read only.",
        "The number of active IPSEC SAs",
        "DisableAutomaticReDeploymentCredentials",
        "SysCallEnter",
        "AllowStorageCard",
        "Network Bridge",
        "Publisher",
        "CD_65C33823125A389998EE918715634996D26443DD7799EEDA88DD0650D03B9936.1475.2534798520.582",
        "WDM Provider Internal class.",
        "2 - The user did not have the necessary access.",
        "Win32API|Communication Structures|COMMPROP|dwMaxTxQueue",
        "pingStrings",
        "Vendor Specific",
        "A string that provides information on how the primary system owner can be reached (e.g. phone number, email address, ...).",
        "VirtualDiskUniqueId",
        "object:Binding",
        "EISA FailSafe Timer timeout",
        "The UserId property specifies the relative ID (RID) of the user. ",
        "FileMissing",
        "SM_SendRPS",
        "CIM_IndicationFilter.Name",
        "The number of multicast packets transmitted without errors through this interface.",
        "Success Bitmask",
        "DOT11_APROUTER",
        "PCI_BUS_REQUESTOR_ID",
        "UserFriendlyName",
        "This provides the locate device type.",
        "0x80050046",
        "B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "MSFT_StorageSubSystemToInitiatorId",
        "MaxStateEntries",
        "This class contains the .INI information that the application needs to set in an .INI file. The .INI file information is written out when the corresponding component has been selected to be installed, either locally or run from source.",
        "RPGlobalInterval",
        "Text StringA",
        "IPv6Transmit",
        "//           apps and HBA driver miniport.",
        "linkItem",
        "USNJRNL",
        "FileExact",
        "The version describing the creation or last modificationof the specification. The string representing the version shall be in the form: ",
        "Cubic Inches",
        "CD_559C5EF519C1325645DA42E84C00BB0A8E3127E1C2CAD3C6D3C28A084C0B62C1.1749.3680759863.345",
        "Length of 802.11 WEP structure",
        "{FAF76B83-798C-11D2-AAD1-006008C78BC7}",
        "This property reflects the current connection status of the VPN connection.",
        "{d919fb1d-4388-4c96-8e4e-67b4fc92cc28}",
        "Enable Proxy",
        "The ProcessStartTrace event class indicates a new process has started.",
        "WPDCI_feature1",
        "IL_82D62EACB411F46C88EF11FE5A18F1088AEDA0897AD63F2947178230B7AF5724.1780.3306664901.199",
        "CD_EAB9370E6F0303E816A75B33B853238E66F81872D99E818B001BE572FCD0B89A.2042.1746916102.1916",
        "ProximitySharing",
        "{0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9f}",
        "SPACE",
        "AgpStatus",
        "Deleted",
        "Microsoft.Management.Infrastructure.CimInstance#DnsClientNrptRule Object contains all the  properties of  DNS client NRPT rule",
        "Invalid gateway IP address",
        "Area Code",
        "CD_E180FA56BE25537B4EDBF25A70C610DD0A17358432E8B0D7F517AF0A54245AFC.1741.2380761687.514",
        "SidTypeUser - Indicates a user SID.",
        "The current quarter of the current year (1-4)",
        "OldStartType",
        "WriteOperationCount",
        "Restores the backup packages from another machine. Returns false if a restore is already pending, true otherwise",
        "object:MSFT_NetAdapter_RscStatistics",
        "Association between TargetPort and TargetPortal",
        "3 = Client Side Extension does not support logging",
        "DisableClassBasedDefaultRoute",
        "Product key ID2, PID2, string. Returns null if a product key is not installed.",
        "CIM_PolicySet",
        "FirewallProduct",
        "CIM_PhysicalFrame.Version",
        "MIF.DMTF|System Power Controls|001.2",
        "R_2F43B8EB8E14762A257D84DCB10913E4CD9E8069D8AEA3384120BB143668FB2E",
        "ParityErrorCount",
        "I_2C3E0B2C69ECC1F533E094C6BC0D6FE2FF50B62467F6FB0D4116BA80049303DF.2505.719625217.277",
        "If true, do not forcibly unload the user's registry when the user logs off.",
        "MsftDiscFormat2Tao_DebugGeneral",
        "BackupFilesAndDirectories",
        "Search Bar URL",
        "Selected",
        "The Caption property is a short textual description. ",
        "ChangeOwner",
        "PLATFORM_ERROR_RESPONDER_ID is valid",
        "The total number of key deletions for IPSEC SA",
        "Sets security descriptor on the printer to the specified structure. ",
        "TEST_TRACE_RESERVED_16",
        "GetConfigurationSecurityDescriptor",
        "2 - Access denied",
        "{1ee17050-0039-40f7-9ead-14ad51612cb2}",
        "Kernel Processor Performance State",
        "A method to kill this job and any underlying processes, and to remove any \\'dangling\\' associations.",
        "Modern Application ID to be launched when that user logs in",
        "Select * from Win32_TimeZone",
        "CaptureStatus",
        "RSOP_SOM",
        "HOSTPROC_TRACE_REQUEST Flag",
        "MaxCacheSizeAsPercentageOfDiskVolume",
        "MDM_DeviceStatus_DeviceGuard01",
        "C_E284DDF7F9BBC191C804CE3AADDF197ECFC83C10E016C1AED712528DDDFB1F1C",
        "72 - An error occurred while accessing the Registry for the requested information",
        "{9ABA5122-C7A1-11d2-911D-0060081A46FD}",
        "EVENT_TRACE_FLAG_PROFILE",
        "LogBlocked",
        "WaitTimeInCycles",
        "The DeadGWDetectEnabled parameter specifies a value that can enable the TCP to perform dead gateway detection. If TRUE, the method will enable dead gateway detection.",
        "TargetGroup",
        "ACPI C-state",
        "}272E5753DC3EECDD6057038DB6F26170E7D1CD565B954C6C4A406CB1BC2D023E",
        "MaxCopies",
        "C_8415A398133EAE0716C73F02F5C279072A12B0ED56A7172F6985A7EBD9376FCE",
        "CriticalFailure",
        "ActivationInterval",
        "IL_B1642623BA0E939E58ACB54CEC792BDDE78371F427AAD399BCD5EBEE8CA804F0.2700.1596003987.269",
        "This cmdlet will set the ODBC DSN using this driver only. You can use wildcard characters. The default is to set all ODBC DSNs.",
        "Computer specific configuration",
        "POINTER_PORT_WMI_PEN",
        "Buffer Size in Bytes",
        "Distinguished name for the configuration container",
        "PLATFORM_TRACE_CONFIG Flag",
        "FX_TRACE_FUNC Flag",
        "CD_703C562B7404A6234AAFEB9B3BB242E3FF62C76339F84C997DCEF89443C2DF65.1365.696672421.474",
        "{0C5A3172-2248-44FD-B9A6-8389CB1DC56A}",
        "MaxQMSAs",
        "0xD00A - 'Not Available': The element is present but has problems. ",
        "MSNdis_InterruptModerationParameters",
        "CIM::Core::Device",
        "InterleaveDefault",
        "This method updates firmware to the physical disk.",
        "MSFT_NetAdapterRscSettingData",
        "Number of Events Lost during collection",
        "a1751678600000M",
        "The Sid property is a Byte Array representing the SID of the client creating the subscription, NULL if subscription is temporary.",
        "The ReleaseDHCPLease method releases the IP address bound to a specific DHCP enabled network adapter. WARNING: If DHCP is enabled on this local computer system, the option disables TCP/IP on this specific network adapter. Unless you have an alternate path",
        "Phase Change Rewriteable",
        "{8ead9a22-7f69-4bc6-949a-c8187b074e61}",
        "PS_VpnConnectionProxy",
        "NS_1D70990137E7397FED436F11C0EF3FAAE00714CEC2B803AD7499863F985BD191",
        "Indicates if BranchCache hosted cache server Scp registration is enabled",
        "Indicates the set of security properties that are currently available.",
        "FunctionName",
        "SONET",
        "Represents the base class for network adapter settings.",
        "CoNDIS Hardware Status",
        "The LaunchCondition class is used by the LaunchConditions action. It contains a list of conditions, all of which must be satisfied for the action to succeed.",
        "WPD_F8 Flag",
        "This method deletes the masking set instance.",
        "MIF.DMTF|Physical Memory Array|001.10",
        "A textual description of the type of support provided.",
        "Semantics for transitioning C-states among dependent processors",
        "AdapterType",
        "Represents the IPInterfaceNeighbor association class in TCPIP WMIv2 provider.",
        "WmiQueryPciDeviceCustomProperty",
        "Heap Range Event",
        "MinReadable",
        "{0D51A84E-DB32-11d2-85FC-0000F8102E5F}",
        "svSms",
        "MemoryErrorCorrection",
        "{f786fbd5-c049-11dd-b885-001d09162bc3}",
        "A target port represents an instance of an endpoint in a storage subsystem with associated properties for showing and hiding virtual disks. Fibre Channel, Serial Attached SCSI, or iSCSI ports within a storage subsystem controller are all examples of target ports.",
        "{8502C564-5FBB-11D2-AAC1-006008C78BC7}",
        "The optional destination IP prefix filter condition. Where applicable, both the source and destination prefix families must match. Examples of valid prefixes: 192.168.1.1, 192.168.1.0/24, or fe80::1001:2046/128",
        "A DiskPartition is a presentation of a contiguous range of logical blocks that is identifiable by the OperatingSystem via the Partition's type and subtype fields. DiskPartitions should be directly realized by PhysicalMedia (indicated by the RealizesDiskPartition association) or built on StorageVolumes (indicated by the PartitionBasedOnVolume association.",
        "SelectNetworkDetect",
        "EnableKeyProtectors",
        "ref:Win32_TimeZone",
        "MDM_Policy_Config01_DeviceLock02",
        "TargetObject",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{GUID}[LocalService]",
        "This field indicates the object that caused the indication.",
        "The Win32_SessionProcess represents the association between a logon-session and the processes belonging to that session.",
        "Specifies whether the display of Windows Client Wallpaper is disabled. This option can save system resources by decreasing the time required to repaint the screen.",
        "The DefaultIPGateway property contains a list of IP addresses of default gateways used by the computer system.",
        "The ConfigFile property contains the configuration file for this printer driver, (example: pscrptui.dll).",
        "InvalidTxWordCount",
        "AllUserConnection",
        "NDIS 802.11 Received Signal Strength Indication",
        "SystemConfig_V3_Services",
        "NullEncryption",
        "HVCI enabled",
        "{6e1f2449-f1f3-4634-b51f-46e2c6625892}",
        "LPC_TRACE_CONNECTION",
        "Avalon 12MPP Switch",
        "68 - Invalid input parameter",
        "Not Removed",
        "Substatus",
        "Fixed Frequency Monochrome",
        "{a7dbab52-999e-4362-be8c-fe6e5fa30c71}",
        "To guarantee this uniqueness, the property value should be constructed using the following format (defined in ABNF): sequence-context = indication-service-name \"#\" cim-service-start-id \"#\" listener-destination-creation-time",
        "Closest Processor Static",
        "MSiSCSIInitiator_PersistentLoginClass",
        "CD_E67DF64CBE3D01A3E33D2078FC61C5DAF3C494C4A4DFFEC9CB77DA207B5AEF2D.1533.130657779.557",
        "LocalMachineZoneAllowUserDataPersistence",
        "The port number to which BranchCache will send outgoing download requests",
        "ErrorOccurred",
        "Select * from Win32_SystemAccount",
        "Describes the DirectAccess connection status.",
        "ALPC-Send-Message",
        "unknown/unclassified",
        "C_A23491B3C9DD8481EBD1370ABF1AD298CC29F6DA303209600E83B50112688260",
        "Drive",
        "A physical component is removable if it is designed to be taken in and out of the physical container in which it is normally found, without impairing the function of the overall packaging. ",
        "select * from Win32_ComputerShutdownEvent",
        "L,m;L,m;",
        "The serialized encoded string form of the VPN Connection profile.",
        "0xEFFF0040",
        "h/m;h/m;",
        "Number of TimeStamps",
        "DataTieringType",
        "Job Flag",
        "Specifies a protocol-specific value for classification. For example, this property is set to a TCP port number if ProtocolSelector is set to \"TCP Port\", or Ethertype value is ProtocolSelector is set to \"Ethertype\".",
        "ResourceID",
        "The AuthenticationPackage is the name of the subsystem used to authenticate the logon session. ",
        "Autostart",
        "Extended Error klininfo",
        "CD_027708FDC4F21C8AE43624362617A067ABEAE7FC96FE6B2F6BAB070555EAA6F0.197.2789269034.819",
        "COMPRESSED",
        "Win32_UserDesktop",
        "Context More Flag",
        "Path of the bitmap used as the background for the toolbar.",
        "NS_1BBA01731E96C19D0D6219D5469AEAB5B51946F70955812074A8F272593746D4",
        "UsermodeCodeIntegrityPolicyEnforcementStatus",
        "CurrentNumberOfRecords",
        "FileSharingProtocolVersions",
        "CI_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C",
        "I_787A200B25B0F5C6729D1D578C8F78CD412BA6F80EDCC079C80146CB69F7319B.1105.1363291257.319",
        "0xC0050043",
        "CD_99987ACE788FDA6044200C5CAD36E8FBA4C6DFACC2585158E6C31C93918E7DB8.2116.1514180294.987",
        "Supports ConsistencyExempt when adding to group",
        "Designates one or more IP protocols (such as TCP or UDP) to filter on.  Network traffic is logged when the filter matches. ",
        "// The number of received IKE messages that are invalid, including IKE messages with invalid header fields, incorrect payload lengths, and incorrect values for the responder cookie (when it should be set to 0).",
        "BytesToGroupPeers",
        "2 stop bits",
        "CR_3196586F94E9CFEA6D912774CB2A6C6FDB2471424853F54D4C0F4EE4F94880DF",
        "An array of strings that indicates the network addresses for the port.",
        "Name of the configuration this is a part of",
        "Bucket Index",
        "41013",
        "Win32_WIN32_TERMINALSERVICETOSETTING_Prov",
        "0xD004",
        "InitializationReentrancy",
        "IPProtocol",
        "The number of thin provisioning alert thresholds specified exceeds the limit for this storage pool.",
        "TimeGenerated",
        "Heap Handle",
        "Tape Device Error",
        "Embedded class that describes DH-CHAP parameters.",
        "SQLOLEDB_1",
        "\\\\.\\Root\\CIMV2:__Win32Provider.Name=\"Cimwin32A\"",
        "StorageScaleUnit",
        "SystemConfig_V0_LogDisk",
        "CONNECTION_STATE_CONNECTED",
        "InitialProgram",
        "SET_VOLUME_INFORMATION",
        "CD_FBBE075DD8BF09CF56F5E18528E64829DF169227E061EAB31220ED102922500C.2033.2124504769.219",
        "RSOP_PolmkrServerSetting",
        "179E66B8CF9ECD4E1",
        "C_39111DE6643E0CE135E3218054CABDAE5D22F63BCDD71E8E8F760C46C7306F9F",
        "DeleteInstance",
        "CPU Disabled By BIOS (POST Error)",
        "PolicySourceMaxMonitors",
        "Propagated",
        "RestrictedSitesZoneAllowFontDownloads",
        "DnsSecValidationRequired",
        "DEV_CONFIG Flag",
        "CD_E763711E2F865B0BD95274A728A183E97B0FFE938A90F67174325F503A036106.1598.2892012292.681",
        "ref:MSFT_NetNatTransitionConfiguration",
        "An array of supported features of partition objects for replication.",
        "ISCSI_ERR_CHAP_NOT_OFFERED",
        "Time of last Full Scan start - If this has never updated you will see a null value in this property",
        "Win32_MotherboardDevice",
        "CounterInstanceName",
        "CD_18CF4DFADB65FD9009884647249EF310A7B2E05DDBD0DAD1404A0AE55A5E4EE4.1136.3462929138.704",
        "IPv4OperationalState",
        "Is Busy",
        "DMABufferSize",
        "Nibble Read Count",
        "Specifies the size, in bytes, of the entire data packet, regardless of the amount of data requested",
        "wcProvChar",
        "CD_07C552EB8842D691C4A22716140805262ED277A06CAB4124C417993F14E689CF.2438.1.19933",
        "Example: +Q5S36=7S48=7.",
        "True if Autofill is enabled",
        "The current size of the cached data, in bytes",
        "SetIScsiInitiatorNodeName",
        "The SetMultiStringValue method sets the data value for a named value whose data type is REG_MULTI_SZ. The SetMultiStringValue method returns a uint32 which is 0 if successful or some other value if any other error occurred.",
        "IsPartial",
        "    1. Application Launch Prefetching",
        "Example: A8C3-D032",
        "Login to this target",
        "dsServiceName",
        "WriteCacheSizeMax",
        "4 - Minor should be used to indicate action is needed, but the situation is not serious at this time. ",
        "The Power Management setting data for the network adapter.",
        "EnableBIDI - Enable bi-directional printing.",
        "object:MSWmi_Guid",
        "Enumeration indicating the supported SyncType/Mode/Local-or-Remote combinations.",
        "The ReleaseDate property indicates the release date of the Win32 BIOS in the Coordinated Universal Time (UTC) format of YYYYMMDDHHMMSS.MMMMMM(+-)OOO.",
        "IL_AEDC90AF54A3D5AF696D2BD78F01D79B909BB9F082E2736232A14FE22A818FB2.2688.3738335647.268",
        "CoNDIS Receive PDU Errors",
        "The Win32_Printer dependent reference represents the Win32_Printer.",
        "SERVICE_KERNEL_DRIVER ",
        "CreateEndorsementKeyPair",
        "Reserved by subsystem",
        "Proprietary ATM",
        "MsftDiscFormat2StreamRandom_DebugDestructor",
        "msieee80211-Data",
        "PackageVersionId",
        "The amount of space currently used on the disk.",
        "FTP proxy server address and port.",
        "ConfigureDeadlineForQualityUpdates",
        "CR_9A3419D1BEB3DD772F317128C59554641FCDDB696104EEE43BBF4385A72BA8A9",
        "MSMCAEvent_PlatformSpecificError",
        "Configures BranchCache to operate in hosted cache server mode. ",
        "LTO Ultrium",
        "#define ScsiInquiry_OUT_ResponseBuffer_SIZE_HINT 96",
        "50002",
        "The current status of the Session - Running, Stopped, Failed",
        "The unique id of the physical disk associated with this extent.",
        "ISCSI_ERR_UNEXPECTED_PDU",
        "MSFT_PCSVDevice",
        "Index not recognized ",
        "ster is being upgraded.",
        "Win32_DriverForDevice",
        "MSFC_FibrePortHBAStatistics",
        "1 stop bit",
        "Logs events to a text file",
        "AllowAutoUpdate",
        "A Win32_FolderRedirectionHealth object that represents the health of the user's redirected Links folder.",
        "StringIndirect",
        "Array of names of dial-up connections to be imported.",
        "MSFT_NetAdapterChecksumOffloadSettingData",
        "HandleDCStart",
        "DMTF/IANA Reserved",
        "NewPath",
        "Win32_NetworkAdapterConfiguration",
        "Enables the SRIOV properties on the network adapter.",
        "ROOT\\Microsoft\\Windows\\Dns\\MS_409",
        "ActionID",
        "This class models the possible superiors of a DS class",
        "versionNumber",
        "AllowWindowsEntitlementReactivation",
        "The LoadOrderGroup parameter passes the group name associated with the new service. Load order groups are contained in the registry, and determine the sequence in which services are loaded into the operating system. If the pointer is NULL or if it points to an empty string, the service does not belong to a group. Dependencies between groups should be listed in the LoadOrderGroupDependencies parameter. Services in the load-ordering group list are started first, followed by services in groups not in the load-ordering group list, followed by services that do not belong to a group. The registry has a list of load ordering groups located at:",
        "The Create method creates a new service. It returns an integer value of 0 if the service was successfully created, 1 if the request is not supported, and any other number to indicate an error. The Win32_LoadOrderGroup parameter represents a grouping of system services defining execution dependencies. The services must be initiated in the order specified by the Load Order Group, as the services are dependent on each other. These dependent services require the presence of the antecedent services in order to function correctly.",
        "Win32Registry|System\\CurrentControlSet\\Services|Parameters\\Tcpip|IPAddress",
        "TokenizedClone ConsistentPointInTime",
        "Total number of uncorrected write errors",
        "Win32_PnPDevicePropertyUint32",
        "CIM_InstalledSoftwareElement",
        "In Use by Cluster",
        "Controls RSC setting for IPv6 TCP packets.",
        "Win32_SystemSlot",
        "WHERE Index=#",
        "The maximum allowed bytes returned per read.",
        "LPCReply",
        "Tiger",
        "TapeSymbolicName",
        "The Type property specifies the type of resource being shared. Types include disk drives, print queues, interprocess communications (IPC), and general devices.",
        "Certificate store location",
        "RadioSwV",
        "C_9E784A36A3818CCEF710DDD5C36D397926DEF1DD3DBF75F107C211B75FEBAA90",
        "Enables Rdma on the network adapter.",
        "IDLength",
        "C_8771AE8CEBB5614A0203ECA1F5690F7C9DE50BB712DED367D1D2978F0B190194",
        "SMBIOS|Type 0|Embedded Controller Firmware Minor Release",
        "Fabric",
        "- Each sub-string is separated by the delimiter character and should be in the form of a CIM property declaration (i.e., datatype and property name). This set of declarations may be used to interpret the similarly delimited RecordData property. ",
        "Example: C:\\Windows.",
        "MSFT_OdbcDsnTask",
        "FlushInit",
        "Describes the recovery action to be taken for an unsuccessfully run job. The possible values are: ",
        "CD_1CB9E7DC27B4A89E576CF24BDA3B45DCE8B5B969797A00622E9D1746514F3E59.2387.2190182367.758",
        "ResetStatistics",
        "Indicate when the scripts in 'ScriptList' are to be run: 1=Logon, 2=logoff, 3=startup, 4=shutdown. ",
        "I_66FFF9930E5CCC0D760D3BBAE923EAA766D470F40F422E860FC653AA3204A9F2.838.1.60167",
        "Indicates whether support for wildcard action with transaction flow is enabled.",
        "TargetId",
        "rsopID",
        "CancelCount",
        "WriteErrorsCorrected",
        "Capabilities and management of the desktop monitor (CRT) logical device.",
        "C_B4744AE091F96C1897CB0086813E1AABE89C9AB276818B172EDE2A19A9884429",
        "One or more paramaters specified is not valid.",
        "NumFirings",
        "CoNDIS Driver Version",
        "CR_0FD0888899B6AE2520B6E2DBF0621375C2A450EF8AEE903A752140EFA51EAA5D",
        "PhonebookPath",
        "WFP_TRACE_BASE Flag",
        "PriorityFlowControlEnableArray",
        "\\\\.\\Root\\WMI:__Win32Provider.Name=\"WMIEventProv\"",
        "This parameter is the volume that is to be shadowed.  This parameter can be specified as a volume drive letter, mount point or volume GUID name.",
        "This property is a reference to the instance that contains security limit settings for the job object.",
        "QuickModeCryptoSet",
        "WMI|Win32_NetworkConnection",
        "LPC_TRACE_RESERVED_13",
        "{8502C509-5FBB-11D2-AAC1-006008C78BC7}",
        "CD_82B5DE0B52236FBA718C6012FF3A7FD447F711EA1896FB5FD863DEC9F4CC1877.271.3909361512.528",
        "object:OMI_BaseResource",
        "CD_A845C3809E8DF42635819F5D4441FC804E08EFF7CF893C7B960B207ABE392F53.1507.1.37693",
        "EISA add-on card",
        "This method allows the user to update or set various attributes on the storage pool. Note that not all parameters must be specified, and only those given will be updated.",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_5209325547C4C3DC85433F489AC2215394EE00249CB48AA92AD2B0B6C8014C31",
        "RxWords",
        "ReleaseTime",
        "The Rename method is used to change the name of a computer either in a workgroup or a domain.  When working remotely, the Rename method does not function for Windows XP Home Edition or on Professional Edition (workgroup only).  It should be noted that, for any computer in a domain (except the Domain Controller, since it can authenticate itself), delegation is required as a second hop is needed from the machine being remoted over to the Domain Controller for authentication.  There are no restrictions for local cases. ",
        "ApprovedInstallationSites",
        "FilterType",
        "CD_4D801D24EB7B11E677EAD4F9CF2C38B141666B7557B0420D554E864D72C8EE9E.1746.375606618.6081",
        "If knowledge of the last RequestedState is not supported for the EnabledLogicalElement, the property shall be NULL or have the value 12 \"Not Applicable\".",
        "CD_A8B7F475B823CD27197221367DA5046937A001F70FDA319AF654A4CA16237214.2116.705128811.196",
        "PhysicalDisks",
        "{c350f6ad-f45f-45c9-9e62-1f50bb3fc25f}",
        "Level 1",
        "PassiveTripPoint",
        "SEL_SENSOR_TYPE is valid",
        "41014",
        "CIM_InfraredController",
        "MDM_Policy_Result01_MSSecurityGuide02",
        "BackupRecoveryInformationToActiveDirectory",
        "Class for holding properties of a resource object in desired state.",
        "object:Behavior",
        "FILEID Flag",
        "Unlock - This logon type is intended for GINA DLLs logging on users who will be interactively using the machine. This logon type allows a unique audit record to be generated that shows when the workstation was unlocked. ",
        "ISCSI_SECURITY_FLAGS_QUALIFIERS",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_0899307408A32040A6DA19C0B1EC2745A3D604BAA9DFFE8EE4B75C3D91E16109\\I_EC3B8FD717A738425E0159268883F206D489A3D720198C69718F01AF4B120295",
        "{FAF76B93-798C-11D2-AAD1-006008C78BC7}",
        "C_AE9B26B8983BE299B5F536E4C06DDEBC3F57E793409C1E488B880AEA4E8EB6FB",
        "EVENT_TRACE_FLAG_BLOCKPAGINGIO",
        "{106b464a-8043-46b1-8cb8-e92a0cd7a560}",
        "UdpIPv4",
        "AtStartup",
        "The DesktopInteract property indicates whether the service can create or communicate with windows on the desktop.",
        "Gets Terminal Services Network Card Ids and descriptions.",
        "DNS Client Policy Configuration",
        "I_00AC489F58BEB2FAE012EB9EADB94D27B8C0EF1A86F7EF90CCC478E4E29CD982.2703.1518068467.288",
        "LocalAttestation",
        "{3EC525AF-3189-4ea1-966E-B6F437F5D289}",
        "Key Expired",
        "close",
        "PhysicalDiskRedundancyMin",
        "NS_5B2CC7EB2AAF010DD5D0084F2DEFC340AFEEECC12F24D870DFC50B8EB7C98139\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_91BB5F8AFE5873E9BA8EBD1189F17D947DC5BB7E366AF568F25A5BD3FADD34E681a2",
        "{2306fe33-dbf6-11d2-9244-006008269001}",
        "AllowIOAVProtection",
        "PolicySourceHardwareGraphicsAdapter",
        "If user A is enumerating the instances, then the provider will look for a logon session of user A on that machine. If there is one (and only one) such logon session, then the provider will return the mapped drives of that session. If there is more than one session that user A has on the machine, then no mapped drive instances will be returned (since the provider has no reasonable way of deciding which session to use). If there are no sessions of user A running, and there is a locally logged on user B, then the provider will impersonate A and return the mapped drives of user B. This case supports the scenario of helpdesk wanting to see the instances of a locally logged on user. Again, if there is more than one session of user B running on the machine, then the provider has no way of deciding which to use. In this case no mapped drive instances will be returned.",
        "XOnXOffInFlowControl",
        "Farads",
        "CD_0A5DCBDCC4320C6314CD6EB830F4C97344090EC565D71BFEB9D454B9AD1D8788.2622.3551777992.1785",
        "ResourceSet",
        "TimerSetNtTimer",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{GUID}[DllSurrogate]",
        "Indicates the current statuses of the element. Various operational statuses are defined. Many of the enumeration's values are self-explanatory. However, a few are not and are described here in more detail. ",
        "i57E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "]4890EFF41348A2D3FA104A85C8075E20E025F7CF40D004E2BC1C3C9AA54865F4",
        "This class provides the ability to install and delete the certificates on the device",
        "TotalVisibleMemorySize",
        "DH Group 2",
        "PolicySet is an abstract class that represents a set of policies that form a coherent set. The set of contained policies has a common decision strategy and a common set of policy roles (defined via the PolicySetInRole Collection association). Subclasses include PolicyGroup and PolicyRule.",
        "The PMESignal property indicates whether the PCI bus Power Management Enabled signal is supported by this slot. PMESignal will be FALSE for non-PCI slots. If TRUE, then the Power Management Enabled signal is supported.",
        "The Win32_PageFileSetting class represents the settings of a page file. Information contained within objects instantiated from this class specify the page file parameters used when the file is created at system startup. The properties in this class can be modified and deferred until startup. These settings are different from the run time state of a page file expressed through the associated class Win32_PageFileUsage.",
        "Entry Name",
        "A unique ID of the component reporting the error",
        "{f0610966-50c3-47ab-8db5-a2f3bccf3cb1}",
        "IL_A8BCD93BC22EF320B7622844E22888B089CB41B56213C006B8F310211D4DA771.2700.719005940.284",
        "Optimize for Applications",
        "CIM_Export",
        "{8502C524-5FBB-11D2-AAC1-006008C78BC7}",
        "CIM_SoftwareFeatureSAPImplementation",
        "AnyVlanSupported",
        "The Manufacturer property indicates the name of the operating system manufacturer.  For Win32 systems this value will be Microsoft Corporation.",
        "MIF.DMTF|Processor|006.5",
        "13 - 'Detaching': detach-in-progress. ",
        "SignatureUpdateFileSharesSources",
        "iSCSI Static Initiator Session Information",
        "DS_INET_ADDRESS",
        "18 Track Tape",
        "0xD009",
        "OakleyQuickMode",
        "Logical Disk Manager",
        "SettingData",
        "AllowPhonePCLinking",
        "Replication quorum is not allowed to be set to this value.",
        "Instance Name List",
        "SessionCount",
        "SetUrgency",
        "IL_A963FF6A8458E9C4FEA354824C031F4237B8648981577F19FD6854C86994DA8C.1499.2362602321.331",
        "BAUD_1800",
        "booL>2",
        "QOSWMI_TRACE_UTILS Flag",
        "Session ID",
        "The Manufacturer property names the manufacturer of the sound device.",
        "InternetZoneInitializeAndScriptActiveXControls",
        "LocalIPAddress",
        "Sets the relationship between virtual disks.",
        "The SCSILogicalUnit property indicates the SCSI logical unit number (LUN) of the disk drive.",
        "CIM_ErrorCountersForDevice relates the CIM_DeviceErrorCounts class to the logical device to which it applies. ",
        "Claims",
        "Values: TRUE or FALSE.  If TRUE, the screen saver password is enabled.",
        "Determines the default allocation behavior for storage pools created in this subsystem. If the subsystem does not support storage pool creation, then it determines the default allocation behavior for virtual disks created in this subsystem.",
        "CD_E6211D2EE9E3D772F3F5092CE86BF256E8A0ACC7D6C04BC5100CBFDD67DEE026.2065.1886946718.938",
        "DiscoveredKeyManagementServiceMachinePort",
        "{4135419a-2ebe-472b-a8c8-8416ca2ae1d8}",
        "You must specify a name for this file share.",
        "R_92DB14183145FECB25D8F810D51EB91465DF70CF55ECB1D5FEEDBFFC4B20AADD",
        "NDIS WMI Method Common Header",
        "FileDevice",
        "Authority",
        "Int 10h, CGA/Mono Video Services are supported",
        "SCSI (A) High-Density (50 pins)",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\InprocServer[Default]",
        "40011",
        "GROUPING_GO",
        "Stack22",
        "ResetSrkAuth",
        "The job that is in the job queue/Destination.",
        "FX_TRACE_DDI",
        "{DAF7F63A-F9EA-4869-87E1-AE8A7C2261E2}",
        "Windows Notification Facility Name Subscription Rundown",
        "Win32_OfflineFilesConfigurationProvider",
        "CIM|CIM_SystemResource",
        "parentFolderId",
        "DNS64 settings associated with this interface",
        "MSFT_NetAdapterPowerManagement_Offload_NS",
        " Example: en-us.",
        "le: Acme",
        "Xenix Type 1",
        "The CompressionMethod property is a free form string indicating the algorithm or tool used to compress the logical file. ",
        "HelpFile",
        "EVENT_TRACE_FLAG_VOLUMEDISMOUNT",
        "CR_7AD87B163E5F080E34E60018A0634DBE95115F38F1BC264D0B548D7507D9109E",
        "Intel TDX",
        "This is the value to be used to add, append, or replace to the specified setting.",
        "ConfigurationNames",
        "{237D964F-E3D1-11d2-8601-0000F8102E5F}",
        "CIM_System represents an entity made up of component parts (defined by the SystemComponent relationship), that operates as a 'functional whole'. Systems are top level objects in the CIM hierarchy, requiring no scoping or weak relationships in order to exist and have context. It should be reasonable to uniquely name and manage a System at an enterprise level. For example, a ComputerSystem is a kind of System that can be uniquely named and independently managed in an enterprise. However, this is not true for the power supply (or the power supply sub-'system') within the computer. ",
        "DisableLockScreenAppNotifications",
        "TRACINGRESOURCES",
        "StoragePoolFriendlyName",
        "MSAgp",
        "The text displayed on the context menu.",
        "MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees",
        "Page File Present",
        "Duplicate Account",
        "First Transform type",
        "AllowDeviceNameInDiagnosticData",
        "v71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "MIF.DMTF|System Resource IRQ Info|001.2",
        "DeviceModelDisplayName",
        "HKEY_CLASSES_ROOT 00",
        "AccountIcon",
        "LetAppsAccessEmail",
        "MSFT_VirtualDisk.UniqueIdFormat",
        "CIM_BootSAP",
        "The DeviceID property contains a string identifying the refrigeration device.",
        "0xEFFF0046",
        "SystemDrivesMinimumPINLength",
        "MI_ERRORCATEGORY_NOT_IMPLEMENTED",
        "7311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        "Mobile User Device",
        "CD_2E4CB0F875356763EA64F3060366993EE0D49772670FDDF29B1CAAF86CE9720B.32.2134886676.514",
        "Removes the given license server from the list of specified license servers.",
        "_DH_DEFAULT Flag",
        "The UserSID property indicates the SID of the user for whom this startup command will run. That User property may be empty but UserSID still has a value if the user name can't be resolved (like in the case of a deleted user). The property is helpful to distinguish between commands associated w/ two different users with unresolved names. It may be NULL when the command is associated with items not actually identifying a user like All Users.",
        "Win32_SCSIControllerDevice",
        "SamNameById",
        "Application Management Policy Setting",
        "NetEnabled",
        "ref:Win32_LogonSession",
        "NDISWMI_TRACE_RDMA Flag",
        "CIM_PhysicalComputerSystemView.IdentifyingDescriptions",
        "CD_A20285D23E76CAA1A5AA4BB56A34542AD06AD62940A11046E81BFE8B238005B3.1542.3920809618.394",
        "Modification",
        "The name of the Product's supplier, or entity selling the Product (the manufacturer, reseller, OEM, etc.). Corresponds to the Vendor property in the Product object in the DMTF Solution Exchange Standard.",
        "AllowCortana",
        "MaxNumberControlled",
        "TargetProcessorIndex",
        "NewPrinterName",
        "rCimV2\"",
        "PolicyStore property defines the store to retrieve the NCA configuration policy.",
        "Metric5",
        "SAM Id By Name",
        "True if the Intranet security zone is enabled",
        "MSFT_SmbClientConfiguration",
        "DisableContext",
        "MSFT_NetAdapterSriovVfSettingData",
        "Coarse Brush",
        "Format",
        "MsmqTransportBindingElement",
        "RemoteAdmin",
        "PolicySourcePromptForPassword indicates whether the property PromptForPassword is configured by Server (0),Group Policy (1), Default (2).",
        "PLATFORM_TRACE_RESERVED_13",
        "WmiQueryLinkState",
        "Maximum size of write cache for virtual disk creation",
        "SyncFavoritesBetweenIEAndMicrosoftEdge",
        "C_ADADA2B2CDD3BACE2485D2B360E811514E03484B4187AE7DDB3778A03ABAD994",
        "MCA PCI Bus Error Event",
        "424D10D1B6504179D220FC453A0ED3C78C0356F01FFA929D",
        "SetDefaults2",
        "CIM_DHCPProtocolEndpoint.OptionsReceived",
        "Off-line data collection activity was aborted by an interrupting command from host",
        "CIM_Job.RunStartInterval",
        "IsPhysicallyConnected",
        "GetContent",
        "ODBC.1",
        "Authentication method specified for login",
        "ref:CIM_SerialController",
        "SharedSlots",
        "NdisFddiTypeIsolated",
        "      <dsig:DigestMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#sha256\"></dsig:DigestMethod>",
        "MaximumBuffers",
        "// This class exposes connection statistics statistics",
        "\\\\.\\root\\Microsoft\\Windows\\DesiredStateConfigurationProxy:__Win32Provider.Name=\"dscproxy\"",
        "MsftDiscFormat2Data_DebugConstructor Flag",
        "DiscardedEvents",
        "Int32",
        "iSCSIConnection",
        "MDM_eUICCs_Policies02",
        "Configured voltage for this device, in millivolts. If the value is 0, the voltage is unknown.",
        "The output is an array of CIM objects of type MSFT_OdbcDsn, each of which represents an ODBC DSN.",
        "TM_HANDLE",
        "A value of 8 \"IPv6 AutoConfig\" shall indicate the values were assinged using the IPv6 AutoConfig Protocol. See RFC 4862.",
        "{6328B2A8-DB32-11d2-85FC-0000F8102E5F}",
        "Note:  The  SE_DEBUG_PRIVILEGE privilege is required to invoke this method",
        "Support DTRDSR",
        "This field is ignored.",
        "{4479570b-a61b-11d0-8dd4-00c04fc3358c}",
        "2147483649",
        "select * from Win32_VolumeChangeEvent",
        "Winchester Removable Disk",
        "ImpersonateClient",
        "CD_556BED9C5C7B0EE930A3BB6724BD19CEA9521081CDD971D1A19DD19DC37599CE.2457.2547680710.405",
        "Daughter Board",
        "Specifies whether Network Access Protection (NAP) should be enabled for PEAP. ",
        "BindingElements",
        "The Limit property indicates the limit set for this particular user or group.",
        "httpProxyServer",
        "IEEE 1394",
        "ConnectionError performance counter missing",
        "MSFT_CliAlias.FriendlyName=\"Startup\"",
        "Intended Purposes",
        "C0AAE00A921",
        "The LocalAccount property indicates whether the account is defined on the local machine.",
        "Outer Mode Address",
        "SPACES_StorageJob",
        "The RenewDHCPLeaseAll method renews the IP addresses on all DHCP-enabled network adapters. The lease for the IP address assigned via a DHCP server has an expiration date that the client must renew if it intends to continue use of the assigned IP address. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "This class provides configuration to restrict settings on the device for standard users",
        "Collation",
        "The Status property is a string indicating the current status of the object. Various operational and non-operational statuses can be defined. ",
        "ServicePackMinorVersion",
        "The CIM_AggregatePExtent that is located on the media.",
        "Boolean indicating whether the frame is protected with a lock.",
        "False",
        "{72970BEB-81F8-46d4-B220-D743F4E49C95}",
        "RSOP_SecuritySettingBooleanBlocked",
        "MIF.DMTF|Power Supply|002.21",
        "CD_1463900C5E85009C74D970DC08429284D480248969B543718E853FA68E152A48.2426.1149355407.187",
        "Digital",
        "The Element reference represents properties of the logical device on which the settings can be applied.",
        "CD_94D3D66BD2EBA9427DC5E5441BF12C249317CE8B6E74F24C2C5B169DCAA56DA0.1779.1190232201.318",
        "Updates the specified error source using the supplied information",
        "The NumForwardPackets property indicates the number of IP packet headers allocated for the router packet queue. When all headers are in use, the router will begin to discard packets from the queue at random. ",
        "Network adapter Virtual Machine Queue (VMQ) settings",
        "Relates a main mode rule to its Main Mode Crypto Set.",
        "CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C",
        "SM_SetBindingSupport",
        "An integer indicating the DMA channel address size in bits. Permissible values are 8, 16, 32 or 64 bits. If unknown, enter 0.",
        " The AllowMultipleVersions option controls the ability to configure  multiple versions of a product on a system.",
        "MSADDS",
        "DriveIntegrity",
        "Local storage volume management.",
        "NominalReading",
        "Win32_VolumeChangeEvent",
        "Idenfier for the log that is requested to be cleared.",
        "This field indicates the logical sector size of the physical disk in bytes. For example: a 4K native disk should report 4096, while a 512 emulated disk should report 512.",
        "DesktopMonitor",
        "Contents",
        "The compatible product.",
        "The ForegroundApplicationBoost property indicates the increase in priority given to the foreground application. On computer systems running Windows NT 4.0 and Windows 2000, application boost is implemented by giving an application more execution time slices (quantum lengths). A ForegroundApplicationBoost value of 0 indicates the system boosts the quantum length by 6; if 1, then 12; and if 2 then 18. On Windows NT 3.51 and earlier, application boost is implemented by increasing the scheduling priority. For these systems, the scheduling priority is increased by the value of this property. The default value is 2.",
        "PLATFORM_TRACE_RESERVED_11 Flag",
        "43013",
        "{3B873591-9427-4418-A086-79175735738F}",
        "The formatted message. This message is constructed by combining some or all of the dynamic elements specified in the MessageArguments property with the static elements uniquely identified by the MessageID in a message registry or other catalog associated with the OwningEntity.",
        "PauseQualityUpdatesStartTime",
        "RSOP_FileBlocked",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|EnableLMHOSTS",
        "DisablePrivacyExperience",
        "MSFT_Volume_Repair_AsyncOutput",
        "ExtName",
        "BccLine",
        "Reset the NCSI configuration.",
        "EnableLanguageFeatureInstallations",
        "{FE28FD96-C875-11d2-B352-00104BC97924}",
        "I_8DD5B4325D414AEB9A2E89B2A9012972DB466402E099F6F23B86F048D798271C.505.1.85098",
        "FootprintOnPool",
        "I_98D9637DFF75E87222F5EE1D6ECAC855AD744FED98F1A3D93FDD69C3F245A650.1617.588610527.341",
        "MSFT_ExpressionValue_uint64",
        "Indicates whether this link is enabled or disabled",
        "Service From TopService From Front",
        "C3: GroupNumber = 1, ConditionNegated = FALSE ",
        "UniqMatchId",
        "MDM_Policy_User_Config01_System02",
        "BthActiveConnect",
        "The event identifier specifies the message that goes with this event as an entry in the message file associated with the event source.",
        "Win32_NTEventlogFile",
        "C_9EE045C4E2FFD0DF955EEE77C315F6E7AE148A81490C1DE25137DB14C2197D9A",
        "{43EC6B13-10BB-4bf6-B716-1C1E2F10BB5F}",
        "Electrophotographic Laser",
        "This class provides device registration details",
        "This method returns the security descriptor that controls access to this specific object instance.",
        "The UserStackBase property indicates the base address of the thread's user-mode stack.",
        "Total Page File Fragments",
        "3 = \"Continue With Next Job\", meaning continue with the next job in the queue ",
        "\"OK\" (5) - The element is fully functional and is operating within normal operational parameters and without error. ",
        "R_0BE2D770E1C6713BC08289BEC275FEF959A2FD8AA97ACC94B170742B77AEAA60.1476.126207939.536",
        "PMCapabilitiesParam",
        "The Win32_GroupUser class represents an association between a group and an account that is a member of that group.",
        "ReceiveFilterTest",
        "CR_F2BEF717752C099CDF2C7677200AF2332E7D1E48B470B17CCD440B8D710B7A38",
        "CreateSymbolicLinks",
        "NS_05AF7137D710B4DD69629818893397542700695CD759396B44A708AE6493C356\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_EAEF166D07823DD8DA7D2576AC47944178108FF5F11E6F92829261BEA2612408",
        "ForcedAbort",
        "Physical Address of memory paged removed from use by OS",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|ForwardBufferMemory",
        "Specifies not to issue a prompt",
        "{2cb15d1d-5fc1-11d2-abe1-00a0c911f518}",
        "valueName",
        "Specifies the height of the window",
        "Supports Encryption",
        "TypeDCEnd",
        "LimitNegotiation is used as part of processing either a key exchange or IPsec Rule. Before proceeding with either a phase 1 or a phase 2 negotiation, this property is checked to determine if the negotiation role of the Rule matches that defined for the negotiation being undertaken (e.g., Initiator, Responder, or Both). If this check fails, then the negotiation is stopped. Note that this only applies to new negotiations and has no effect on either renegotiation or refresh operations with peers for which an established Security Association already exists.",
        "TEK4014",
        "PolicyChange_AuditAuthorizationPolicyChange",
        "This field indicates the class of the object which caused the indication. For example: if the object causing the indication is a storage pool, this field should be set to MSFT_StoragePool (not the vendor derived class).",
        "ServerAddresses",
        "ref:RSOP_IEConnectionDialUpCredentials",
        "The IRQNumber property indicates the number of the IRQ resource",
        "Error logging",
        "MSFT_NetAdapterPowerManagement_WakePattern_Bitmap",
        "Words (data)",
        "PartialProductKey",
        "A free-form string describing the video processor/Controller.",
        "One of the following values:  Active: Change only lasts until next boot.  Persistent: Change is persistent.  This is the default.",
        "This field indicates the size in bytes of the user data footprint from virtual disks on this physical disk.",
        "Video BIOS Shadowing Allowed",
        "Not Yet Configured",
        "IL_E8B0AE665CC1B0CA83C8A423B1942F60D1F2C8F5DB0B8045FCDAEC26A269E1C6.1489.398642378.282",
        "A value of 5 \"BOOTP\" shall indicate the values were assigned utilizing BOOTP. See RFC 951 and related. ",
        "File extensions owned by the application",
        "Monitor color characteristics",
        "MALWARE_CREATION_TOOL",
        "ClearLog",
        "This setting may not be changed due to the global registry setting",
        "Win32API|Service Functions|CreateServicelpDisplayName",
        "Committed Size",
        "ProcessorId",
        "Software Loopback",
        "importAuthenticodeSecurityInfo",
        "Discovery via iSNS",
        "ref:CIM_PhysicalLink",
        "Interrupt request line (IRQ) management. ",
        "MSFT_FileDownloadManager",
        "{625B4512-DB36-11d2-85FC-0000F8102E5F}",
        "Error Reserved",
        "MDM_WirelessProfile",
        "LoadOrderGroup",
        "The default Program ID associated with this Class ID.",
        "The MaximumMessageSize property indicates the maximum message size supported by the protocol. ",
        "{FDD21E6F-7381-4048-B085-4CE47EDCA2A4}",
        "Write Correction Algorithm Processed",
        "CD_830BF8BFA5BF93F39AE2488CCF30ECCF24868D5104B63DE9163FCAF3C26491CA.104.3341827725.2072",
        "IPv6Addresses",
        "Identifies the operation that caused the machine check",
        "Red CIE coordinates",
        "ErrorDetail",
        "Win32_COMSetting",
        "C_4C6C03582703FDD60332B03ADAEA6F879DFEE5D9E8B3E7C908FFE36555EEEBC9",
        "Current refresh rate in hertz.",
        "IPsecRuleName",
        "Specifies the IP Address of the LanAdapter that is used by the Session Directory.",
        "MSMCAEvent_CPUError",
        "6B2E97BEF112C2070090FD\\KI_B0FE43D7F9BDBFB580A0CA5527EF25F6B36EC4B671BA143B338B380B1F45C27D\\I_9DBB4C3BF3B30BAE5D6C926F40F2DD55381A6262819DBC80F2482838052C404D",
        "Domain Controller",
        "Snap-And-Clone",
        "The Name property indicates the name of the USB Hub.",
        "This class describes a mapping from a target LUN to a Windows port driver LUN",
        "Registry keywords may be associated with a parameter displayed in user interface. Some registry keywords are not associated to any parameter displayed in user interface.",
        "R_39E75790979650C120BE778856591D7E59D2F85DDFBB3BFF1733B73153D5DC01",
        "{20E25881-F081-448e-85C9-4707A9400593}",
        "0xC0050067",
        "SystemConfig_V2_PhyDisk",
        "EnterpriseSiteListServiceUrl",
        "Number of Request To Send success",
        "CIM_Display",
        "IsDevelopmentMode",
        "Bitvalues",
        "object:Win32_OfflineFilesDirtyInfo",
        "This property provides the status of bitlocker encryption",
        "C_EEEC9C53357AA474163EF7B420A745739C413E8DF61FA9B4FEF91F245EDBD4F9",
        "FileOlderVersion",
        "FileIo",
        "Max Frame Size",
        "iSCSI node name of the target",
        "TEST_TRACE_RESERVED_15 Flag",
        "MSNdis_FddiLemRejects",
        "JIS B6",
        "CR_54C8B2145FBF6DCDCAEFF33B39FBF359799D5087F9B974E853C4A5903604B330",
        "R_CBA9EB33EE1BC25EFACE06DB1F10569606293FE4A3E43C86A81D2EA19CDF0FE3.2469.816339834.558",
        "errorReserved",
        "UseMaximumSize",
        "The number of unicast packets transmitted without errors through this interface.",
        "C_76A570B33AD5E980266DA88075A5C8D352CFF0581C8C28B18A7DED74969E7051",
        "PeerObjectId",
        "The Location property specifies the physical location of the printer.",
        "The number of times this NIC detected a format error during frame reception such that the frame was stripped.",
        "The ICMIntent (Image Color Matching Intent) property indicates the value of one of the three possible color matching methods (intents) that should be used by default. This property is used primarily for non-ICM applications. ICM applications establish intents by using the ICM functions. This property can assume predefined values of 1 to 3, or driver-defined values from 4 to 256.  ",
        "wSettableStopParity",
        "Win32_LogicalFileOwner",
        "Integer",
        "Win32API|Device Context Functions|GetDeviceCaps|PLANES",
        "HttpGetEnabled",
        "The StopService method places the service in the stopped state. It returns an integer value of 0 if the service was successfully stopped, 1 if the request is not supported, and any other number to indicate an error.",
        "ValidateMustUnderstand",
        "0x200000",
        "12 - 'No Contact': indicates that the storage provider has knowledge of this storage pool, but has never been able to establish communications with it. ",
        "WakeUpType",
        "Version of LCM at time of configuration.",
        "ref:Win32_BIOS",
        "If true, don't check the owners of user profiles.",
        "Indicates the number of times to report an informational exception condition to the application client. A value of zero indications there is no limit.",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_9634FA8EA8666E17362935E85D317FF216D0E456B4F0F4516AB4F0B62EDB082111d757E5F3ADD9E242C4E9F9EDF79AA97F79E7911C5A8B902EC150D6442E3B85A5AA",
        "Licensing Settings for the RDV Deployment",
        "WSP_StorageDepartureEvent",
        "ServiceName",
        "SystemSKU",
        "releaseforccflush",
        "SamCreateAliasInDom_End",
        "Directory Service (DS) flag indicating that the DnsForestName is in DNS format (for example, www.mynode.com or 135.5.33.19).",
        "TouchKeyboardWideModeAvailability",
        "The name by which the physical element is generally known.",
        "LowerFilters",
        "Boolean variable to allow unsecure connections",
        "SystemConfig_V2_Defrag",
        "The specified partition type is not valid.",
        "Win32_OfflineFilesItem",
        "RenameByName",
        "ContextMachine",
        "CR_B73E13EE752D9B5AF02139CC8E7B9DD86AA46977B13267D0D5F674F26F8C3D67",
        "CR_E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855",
        "CIM_Collection",
        "Specifies the authentication scheme for clients.",
        "CR_6FFBA8B5854E9C5C5C698A9277971D04E447B67166A26CB7D9DD0D9F278C2D8B",
        "DOT11_SOFTAP",
        "NisEngineVersion",
        "{AAEAE72F-0328-4763-8ECB-23422EDE2DB5}",
        "TraceInfo Flag",
        "{ac1de07e-50bd-49ec-a849-c1b7e089e3c0}",
        "AllocatedStorageTierClass",
        "Where <OrgID> and <LocalID> are separated by a colon ':', and where <OrgID> MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business entity creating/defining the InstanceID, or is a registered ID that is assigned to the business entity by a recognized global authority. (This is similar to the <Schema Name>_<Class Name> structure of Schema class names.) In addition, to ensure uniqueness, <OrgID> MUST NOT contain a colon (':'). When using this algorithm, the first colon to appear in InstanceID MUST appear between <OrgID> and <LocalID>. ",
        "RemoteTunnelEndpointDNSName",
        "ROOT\\StandardCimv2",
        "IPsec rule name",
        "The maximum number of prefetch files for scenarios recorded by the Operation Recorder API",
        "disk space usage for NTFS volumes.",
        "CacheType",
        "select * from MSFT_NcProvEvent",
        "DoNotAllowUsersToAddSites",
        "The qualifiers applicable to this Parameter",
        "TCP Connection Offload Hardware Configuration of the adapter",
        "A device file is a special type of logical file that represents a device. This convention is useful for some operating systems that manage devices using a byte stream I/O model. The logical device that is associated with this file is specified using the CIM_DeviceAccessedByFile relationship.",
        "\\\\.\\root\\directory\\LDAP:__Win32Provider.Name=\"Microsoft|DSLDAPInstanceProvider|V1.0\"",
        "Writes out the configured list of either Token Redirectable addresses or DNS Eligible addresses.",
        "One of the physical disks specified is already in use.",
        "Win32_SystemMemoryResource",
        "Token name for the data source within its package.",
        "MSFT_Synchronized.SyncType",
        "Favorite Item",
        "{8F680850-A584-11d1-BF38-00A0C9062910}",
        "**typedef** Type of failure",
        "I_06DFAB71A3D8DBB356E2B69812AA4BD05249772CB8E5CA24F5D2BBA6FF1926AF.2469.3067110696.282",
        "Idle Exit Latency",
        "SyncVariance",
        "R_B59B61CC7D9A09771322E31CC4E05FF1DCA2EFD4C76A82AC0B86177C3096E55B",
        "CI_D5472BB4000403F6D6CDB0F595804CE62C0D292549796526CA9E7773798E5F24",
        "SelectSleepButtonActionOnBattery",
        "CreateSynchronizationAspect",
        "TR008",
        "CanTurnOffRemotely",
        "CDB Length",
        "R_21F1E1F149DFC99965A781A396AF7873962AA365AB6A21C1E301F1804CC089AE",
        "zoneMappings",
        "225..4095",
        "ref:Win32_NamedJobObject",
        "    DnsSuffix (string) Specifies the connection specific DNS suffix    ",
        "Header_ProviderBinaryPath_TypeGroup",
        "C_2593546F7F7FAC2B60CA22440D930CA43315D905BCE5BBEB889FEE3F3AF27006",
        "LocalUserAuthorizationList",
        "Maximum refresh rate in hertz, when a range of rates is supported at the specified resolutions.",
        "PrivilegeUse_AuditSensitivePrivilegeUse",
        "this one bit flag indicates whether or not the WBINVD instruction works properly,if this bit is not set we can not use S2, S3 states, or C3 on MP machines",
        "ROOT\\WMI\\ms_409",
        "CIM_AggregatePSExtent defines the number of addressable logical blocks on a single storage device, excluding any logical blocks mapped as check data. These logical blocks are contained within a single volume set (if volume sets are defined). This is an alternative grouping for CIM_ProtectedSpaceExtent, when only summary information is needed or when automatic configuration is used. Automatic configuration can result in thousands of CIM_ProtectedSpaceExtent being defined. There is no value in modeling the individual extents.  So, the CIM_AggregatePSExtent object was defined.",
        "R_72CE255A513997878296D59B226FF6EE1ECACB0D9393C9190FE27B84F4A71669.2451.822704615.558",
        "PackageId",
        "Win32_USBControllerDevice",
        "C_F32492DA8D1952EDCCAB707AFA3F69E046829AB6D46D4B2279EAC5E6BCBBB3FB",
        "Enables or Disables Loopback Adresses Virtualization.",
        "Video BIOS Upgradeable",
        "SystemStartupOptions",
        "netProtocols",
        "The AccountType property contains flags describing the characteristics of the user account.",
        "GetAccessSecurityDescriptor",
        "SystemConfig_V0_Video",
        "MSFT_SignatureValidation",
        "FrameworkTraceGuid",
        "MacHeaderField",
        "LetAppsAccessContacts_ForceAllowTheseApps",
        "Sets the brightness back to the policy setting",
        "Location",
        "NetworkCategory",
        "0 - Success. ",
        "The MTU input parameter specifies the default Maximum Transmission Unit (MTU) for a network interface The range of this value spans the minimum packet size (68) to the MTU supported by the underlying network.",
        "JIS B5",
        "The central class used for representing the \\'If Condition then Action\\' semantics of a policy rule. A PolicyRule condition, in the most general sense, is represented as either an ORed set of ANDed conditions (Disjunctive Normal Form, or DNF) or an ANDed set of ORed conditions (Conjunctive Normal Form, or CNF). Individual conditions may either be negated (NOT C) or unnegated (C). The actions specified by a PolicyRule are to be performed if and only if the PolicyRule condition (whether it is represented in DNF or CNF) evaluates to TRUE. ",
        "{E0AECAEE-B311-426f-B67A-18D5E55D0996}",
        "MSNT_FileBaseTrace_VolumeToLog",
        "Read Transfer Count",
        "Optical 9um",
        "Directory/File Name",
        "TransmittedCount",
        "23075BD61506660628CCA5970C8992F70EF5AA2F932C9.2462.3575936436.290",
        "The ParityErrorCount property indicates the number of parity errors that occurred in the current session",
        "Bound",
        "MIF.DMTF|Software Signature|002.6",
        "NETIO_TRACE_TRANSPORT Flag",
        "CD_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2.1165.2468385363.1049",
        "4 - 'Stressed': The disk is functioning, but needs attention. For example, the disk might be overloaded or overheated.",
        "redirected Paths",
        "Example: d:\\",
        "ConfigureXboxLiveNetworkingServiceStartupMode",
        "{8D6D6880-DB2B-11d2-85FC-0000F8102E5F}",
        "R_ECDF6473AEB5680FD494BFD070A3EC2B36A681EE68A62E383213B3D773EF9B61",
        " 4 - RequiresNew ",
        "User's Desktop management.",
        "The parent element in the association.",
        "Type information of the current or last running operating system on this physical computer system. See CIM_OperatingSystem.OSType for details.",
        "MGR_TRACE_RESERVED_10",
        "{B4A6821D-4D2E-40DD-9EE0-89C2CD07BF69}",
        "DefineDataId",
        "The DeviceLoader property indicates the name of the device loader for the modem. A device loader loads and manages device drivers and enumerators for a given device.",
        "SW_SHOWDEFAULT",
        "C_A340B5A350335A2F698A9D474151FF7803797C56DD9A727636F061641184011B",
        "{C260052F-C4FC-11DA-82C4-000D5692A4BC}",
        "M + \".\" + N + \".\" + U ",
        "18     Reinstall the drivers for this device. ",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\nwlnkipx\\Parameters|PktType",
        "The ReadTransferCount property specifies the amount of data read.",
        "The Manufacturer property indicates the manufacturer of the battery.",
        "WMI|Win32_COMClass",
        "abstract",
        "The 'higher level' or parent element in the aggregation.",
        "NdisMediaSupported",
        "Maximum number of SGEs that can be specified in a single request over an initiator queue",
        "NdisMaximumFrameSize",
        "This field indicates what type of parity layout is being used for parity resiliency settings. This field should be NULL if the storage tier does not use a parity resiliency setting.",
        "The QoS properties for the network adapter.",
        "Backlit",
        "//        #define MS_SM_HBA_API",
        "CR_7BF884F7361F0D677A40C5CD7F9E2139AF67CB14ACDB2E9D39E3D5ADFB888E91",
        "splitio",
        "Ndis80211BSSIList",
        "Communications Protocol Error",
        "0x207",
        "InstallLevel",
        "MtuSize",
        "ScheduledTID",
        "Creates a Terminal. The function takes three parameters: a name for the terminal, TerminalProtocol and the Transport, both of which are properties of Win32_TSGeneralSetting class. This creates a Terminal with default settings which can be customized by through appropriate functions in the various Win32_TerminalSetting classes. The function returns zero on success and an error on failure.",
        "I_FDC07BF412EF517BF16CBEA0AD032C8FE94CB2DD73B9CD909C08659DB8C5BC0A.1354.303244126.276",
        "POST Error",
        "CD_FC20EE275CBDBB5DCCFF390F786A4E446220959FE7B3B5319E000553B67DC64F.1541.306207219.414",
        "Session Keys Flag",
        "LocalMachineZoneAllowFontDownloads",
        "The USO setting data for network adapter.",
        "CD_0165CAB89BDC44E6A103BBB55829CE27E96FFC1FBC965B1148A99781C10E7A7B.2060.634247663.1091",
        "AddressMaskReply",
        "B94560CA-41CC-4FB5-BD56-282329DA41DA",
        "Current required by the chassis at 120V. If power is provided by the chassis (as in the case of a UPS), this property may indicate the amperage produced, as a negative number.",
        "TotalSectors",
        "TotalNumberOfClusters",
        "CBEnqueue",
        "TagId",
        "RemoteLastAccessTime",
        "TR_DEFAULT Flag",
        "Shutdown or Reboot",
        "Win32Registry|ProductId",
        "MaintenanceScheduleStartHour",
        "GetAccessMask",
        "{bba3add2-c229-4cdb-ae2b-57eb6966b0c4}",
        "NDISWMI_TRACE_GENERAL",
        "GetLicensingAadInfo",
        "C_73A800D7866C4390667315AF06F93202489C8838112B8D051CF005E872136F01",
        "HOSTPROC_RESERVED_1a Flag",
        "DownBackLimitPct",
        "CD_4C11DEAF7A8558F3989E0E42F67497A3DF8A0B97EC73A206C1E9955B630EFD68.1533.1277046256.559",
        "Element Reinitialized",
        "Readable",
        "765084E1887D699089D5053E1B6F8275CB71A33668FD58E6595E74BE3D526F1D",
        "C42B40D18695E044F98E85080DC73D0D2D750952C365600DBAFFF12874C6651C",
        "MaxLen",
        "CD_36FF9B91B98151142333CB13DA769BB44A2F51FDE32F09FD4FB06D672F7B7CB5.1190.2886804735.612",
        "The USBController.",
        "Sessions Errored Out",
        "I_42B2E3A3A6520FF2AA7BA157666764419AB7273E011404BF98FB167E54E43BA9.2460.2198995473.354",
        "IDEChannel",
        "VolMgr",
        "The sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If CurrentReading is between LowerThresholdNonCritical and UpperThresholdNonCritical, then the Sensor is reporting a normal value. If CurrentReading is between LowerThresholdNonCritical and LowerThresholdCritical, then the CurrentState is NonCritical.",
        "rvalue",
        "{8F680854-A584-11d1-BF38-00A0C9062910}",
        "SEL_RECORD_ID",
        "StateName",
        "Music folder, GUID is {4BD8D571-6D19-48D3-BE97-422220080E43}",
        "LPC_TRACE_RESERVED_1e Flag",
        "AGP_WMI_STD_DATA_GUID",
        "O:BAG:BAD:(A;;0x1;;;BA)(A;;0x1;;;NS)(A;;0x1;;;AU)",
        "Source File Name",
        "FileSize",
        "The printer driver is not compatible with a policy enabled on your computer that blocks NT 4.0 drivers",
        "viewUnknownRatedSites",
        "DisableIPSec",
        "Identifies the available languages for strings used by the Printer for the output of management information. The strings should conform to RFC 1766, for example \"en\" is used for English.",
        "Whether to group UDP packets into conversations based upon the local address, local port, and remote port.  Applies only to UDP.",
        "Medium-high",
        "UMDF - Test Trace",
        "DIRECTORY_CONTROL",
        "XOnXOffOutFlowControl",
        "DiscoveryMethod",
        "ReadLog",
        "Shadow copy storage area management.",
        "Unknown error",
        "GroupOrder",
        "Error Unhandled",
        "The GroupComponent reference represents the properties of the logical disk in the Win32_LogicalDiskRootDirectory association.",
        "IPv4AddressOrigin",
        "Serial Hardware Configuration",
        " Remove only when the associated component is being installed (msiInstallStateLocalor msiInstallStateSource).",
        "SignatureValidationPolicy",
        "Win32Registry|.DEFAULT\\Control Panel\\Desktop|SCRNSAVE.EXE",
        "IL_CEEB04238836B14B55751D5FC8F0C378A54AF1942F10226666FDE7520B51B7EC.699.1.57184",
        "// These match the definitions in hbaapi.h and must be kept in sync.",
        "MDM_WindowsAdvancedThreatProtection",
        "MofSelfInstallDirectory",
        "R_35B1B65B914DF07FAC7860C3407AEAACB382311D5C7C7979B2E9A007C56D4FA3",
        "Task provider for ODBC Connection Pooling PerfMon counters setting.",
        "Select * from Win32_SystemEnclosure",
        "The Caption pro",
        "Win32Registry|HKEY_LOCAL_MACHINE\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port\\Scsi Bus\\Target Id\\Logical Unit Id\\Identifier",
        "Portrait",
        "NotMonitored",
        "Specifies the NUMA Node for the RSS Processors.",
        "KerbAcceptSecurityContext_Start",
        "Network adapter is hidden and does not appear in any user interface.",
        "object:MSiSCSIInitiator_PortalGroup",
        "Win32Registry | HKLM\\CurrentControlSet\\Control\\Session Manager | AutoChkTimeOut",
        "Module Manifest data",
        "PageFault_TypeGroup1",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\InprocServer32[JavaClass]",
        "MsftEnumDiscRecorder2_DebugDestructor Flag",
        "OriginatingMachine",
        "Win32API|Network Management Structures|USER_INFO_2|usri2_flags",
        "TotalFiles",
        "The ASPScriptDefaultNamespace property contains the namespace used by calls from the script API if none is specified by the caller.",
        "The new process is the root process of a new process group.",
        "CEFD41398198E613F10DFF47709ECAB1D7F037756AC8CE7",
        "Time that the process began executing.",
        "HRCreate",
        "If this property is set to TRUE, the partition is in direct access mode. In this mode a memory mapped file doesn't reside in RAM, instead it is mapped directly onto the Storage Class Memory device and IOs bypass the storage stack. If set to FALSE, the partiton is in the standard block mode.",
        "LogName",
        "40013",
        "SEL Free space in Bytes",
        "registry",
        "dicates the name of the operating system manufacturer.  For Win32 systems this value will be Microsoft Corporation.",
        "The Change method modifies a service. It returns an integer value of 0 if the service was successfully modified, 1 if the request is not supported and any other number to indicate an error.  The Win32_LoadOrderGroup parameter represents a grouping of syst",
        "object:MSFT_ExtendedStatus",
        "MSFT_StorageProvider",
        "WMI_CHANGER_PROBLEM_DEVICE_ERROR",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\AuxUserType\\3[Default]",
        "The SupportsQualityofService property indicates whether the protocol is capable of Quality of Service (QOS) support via the underlying layered service provider or transport carrier. QOS is a collection of components that enable differentiation and preferential treatment for subsets of data transmitted over the network. QOS loosely means subsets of data get higher priority or gu",
        "Specifies a printer object to change the property on.",
        "The SpeakerModeOn property contains the command string used to turn the modem speaker on.",
        "AcceptIPV6",
        "LPC_TRACE_RESERVED_0f Flag",
        "PC-98/C20 add-on card",
        "R_A435E1CD6D36EB19C6DA0BA1C7E62224942A59031964EC981FF17A68812E1011",
        "]9AB53806E88665C047824D5369B271C53B233BBEAC7C15BE3BA9BD214E527500",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2020.2776175683.368",
        "NewThreadPriority",
        "GetLoadBalancingState",
        "The SID property contains the security identifier (SID) for this account. a SID is a string value of variable length used to identify a trustee. ",
        "Number of duplicate frames",
        "newed",
        "The default action for Inbound traffic.",
        "SystemConfig_V2_IRQ",
        "CIM_key",
        "NtlmServerAccept_End",
        "{3E24D5A6-DB2B-11d2-85FC-0000F8102E5F}",
        "The method can return the following values:  ",
        "The URL of this device (when discovered via Directed discovery).",
        "The Win32_Share dependent referenceindicates the Win32_Share representing the network share of the printer in this association.",
        "ISCSI_WRN_RECEIVED_ASYNC_LOGOUT",
        "The dependent service access point.",
        "User Name",
        "This class represents a power plan in the system",
        "TimeStampRecordAddressResolved",
        "MSFT_WdacBidTraceTask",
        "NoImpersonationLuidVerify",
        "Enable the BidTrace represented by the specified BidTrace setting objects. Enter a variable that contains the objects, or type a command or expression that gets the objects.",
        "7 - ARCNET (878.2)",
        "Returns the MSFT_NetRoute object",
        "m2432A5ABBE7173FA98223D70B4EDFB312E0AA87F456103A25E4B4191AB55FA02",
        "#define ISCSI_HBA_STATUS_CRITICAL          2",
        "{e3dff7bd-3915-11d2-9103-00c04fb998a2}",
        "percent",
        "NumberOfPowerCords",
        "MSFT_StoragePoolToResiliencySetting",
        "Dependent represents the object that is dependent on the Antecedent.",
        "C_5D42E4DF5B7B899925957BE4D19450E2FFF69AB58BCABDBDE9133A0AD51A2BC3",
        "MSFT_LocalizableQualifier",
        "OneSided",
        "Unit modifiers for the values returned by the numeric sensors. See CIM_NumericSensor.UnitModifier description for details.",
        "The BuildNumber property indicates the build number of the operating system.  ",
        "Defines the number of days after which a catch-up signature is warranted. Works with SignatureUpdateLastChecked. 0 = no catch-up,  1 = 1 day,  2 = 2 days, etc.",
        "PmcCounterConfig_V2",
        "CIM_VideoController.MinRefreshRate",
        "{270B9B86-B16D-11D1-BD98-00A0C906BE2D}",
        "TurnOffHybridSleepPluggedIn",
        "R_EA9A1A204A0FA59819F57AD1F744E0CAB4BE1F06A46B3D439B85E87A7B3A09A6",
        "UseIKEIdentityType",
        "MSFT_ExtendedStatus",
        "MSFT_TcpIpPrinterPort",
        "SSLCertificateSHA1Hash",
        "Product key channel string. Returns null if a product key is not installed.",
        "CIM_IKEProposal.HashAlgorithm",
        "Specifies that MSCHAPv2 should be used as the authentication method, and Windows logon credentials should be used automatically when connecting with the VPN connection profile.",
        "19mm Tape Cartridge",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.314.2772854538.368",
        "The SCSIBus property indicates the SCSI bus number for the disk drive.",
        "Msft_WmiProvider_CreateClassEnumAsyncEvent_Pre",
        "VESA CVT",
        "DisallowNetworkConnectivityActiveTests",
        "MEM_PHYSICAL_ADDR is valid",
        "Cpu Speed",
        "The Installed property has been deprecated.  There is no replacementvalue and this property is now considered obsolete.",
        "The EnvironmentVariables property contains a list of settings for the configuration of a computer.  Environment variables specify search paths for files, directories for temporary files, application-specific options, and other similar information.  The system maintains a block of environment settings for each user and one for the computer.  The system environment block represents environment variables for all users of the particular computer.  A user's environment block represents the environment variables the system maintains for that particular user, including the set of system environment variables.  By default, each process receives a copy of the environment block for its parent process.  Typically, this is the environment block for the user who is logged on.  A process can specify different environment blocks for its child processes.",
        "wmiprov",
        "Stack32",
        "If the Password and Username parameters are specified, then the connection to winmgmt must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. ",
        "InSwap",
        "Optimize",
        "The L3CacheSpeed property specifies the clockspeed of the processor's Level 3 cache. A Level 3 cache is an external memory area that has a faster access times than the main RAM memory.",
        "MAC address of node at time of configuration.",
        "WindowsServer2016RS3",
        "The Client reference represents an executable that uses DCOM settings.",
        "WD_LOG_FLAG_REFERENCES",
        "Msft_WmiProvider_ExecQueryAsyncEvent_Post",
        "Minor Error Counter",
        "See CIM_RecordLog.OverWritePolicy for details.",
        "The new name for the set.",
        "TRACE_RESERVED8 Flag",
        "Point of Presence",
        "Registry_HiveDestroy",
        "Enables or Disables Session Directory.",
        "X.25 standards",
        "ROMVersion",
        "AutoReusePortRangeStartPort",
        "securityDescriptor",
        "{9fe00cf7-e26e-483d-9493-4d826980c079}",
        "The DebugFilePath property indicates the full path to the debug file. A debug file is created with the memory state of the machine after a machine failure.",
        "The ScreenSaverSecure property determines whether the password is enabled for the screen saver.",
        "RSOP_UserPrivilegeRight",
        "PortableDeviceTypes_Values Flag",
        "Count of active trip points",
        "Designates the switch ports to limit per-packet event tracing to. Events are traced if the filter matches.",
        "If TRUE, the volume exists as a single compressed entity, such as a DoubleSpace volume.If file based compression is supported (such as on NTFS), this property will be FALSE.",
        "{e027f259-b3f1-466f-8053-033842a34d48}",
        "At least one account name needs to be specified",
        "CreateFileShare",
        "The long address of the station above this NIC on the ring or zero if the address is unknown.",
        "Win32_SubSession",
        "MIF.DMTF|Temperature Probe|002.5",
        "Activation type configured for VL client.",
        "Win32API|File Functions|GetLogicalDriveStrings",
        "dwCurrentTxQueue",
        "Paper Jam",
        "HBA_FCPHYTYPE",
        "RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting",
        "The Win32_ShareToDirectory class represents an association between a shared resource on the computer system and the directory to which it is mapped.",
        "Query Information",
        "Latency",
        "Protection technology version (major, minor, build, revision)",
        "ResourceScriptBreakAll",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2070.1590554102.368",
        "This represents a child locate element device element.",
        "The total count of failed KMS requests.",
        "SettingValue",
        "The space currently used on the volume.",
        "Referenced HBA has been removed or deactivated",
        "CD_13D55C842CDBA0C119A52B652E2B026F106F2E9BE68DD61A338E909E5F70C55C.1150.1814074717.1463",
        "MDM_Policy_Result01_ApplicationManagement02",
        "Execute Self Test",
        "MonthlyInternetBytes",
        "Ndis802_11WEPNotSupported",
        "Local Group Policy",
        "{8502C586-5FBB-11D2-AAC1-006008C78BC7}",
        "TimerExpiration",
        "HeapExpand",
        "Reserved4 Flag",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_password_age",
        "{13976d09-a327-438c-950b-7f03192815c7}",
        "The EnableDHCP method enables the Dynamic Host Configuration Protocol (DHCP) for service with this network adapter. DHCP allows IP addresses to be dynamic allocated. The method returns an integer value that can be interpretted as follows: /n0 - Successful ",
        "The InfName property contains the name of the INF file being used. The default is 'ntprint.INF'.  This will only be different if the drivers are provided directly by the manufacturer of the printer and not the operating system.",
        "QueryTrustedDomainInfoByName",
        "MSFT_CliAlias.FriendlyName=\"PageFileSet\"",
        "Authorization Failure",
        "Rate limit for inbound IPv6 filter exempted traffic.",
        "The interface function for callers to call in to start the consistency and refresh timers. ",
        "R_A50F2C71334A2A338CC6F1C013DEEB31B3684F92B727656C378E98BCCF3ADD1F",
        "The ObjectPath property holds a string containing path of instance to be deleted.",
        "Management of partitioned areas of a physical disk.",
        "The subject of the email message.",
        "The Optional boolean indicates that the parameter may be omotted.",
        "P5m;P5m;",
        "C_D08FBE660E54A308159ADDC588C79311912D65E76D5871EF0ACC7C841B0E3373",
        "CI_311B24D471FA470BE235FB95E85291DE8C56EB6FA6CF9B1EEB6871E43BBD912C",
        "LsaCfgFlags",
        "CR_1DCEB1693B085B2991E1748C5527FE1000E59774A81597D782C7656FA24FA810",
        "object:unint32",
        "Win32_Printer",
        "The type of modification made.",
        "One-to-many replication",
        "The Win32_Group class represents data about a group account. A group account allows access privileges to be changed for a list of users. ",
        "Denotes whether a user can modify attributes or other properties on a virtual disk by using the various Set* extrinsic methods. (For example: SetFriendlyname ).",
        "AllowHardTerminate",
        "RxFrames",
        "PolicySourceMaxMonitors indicates whether the property MaxMonitors is configured by Server (0),Group Policy (1), Default (2).",
        "NdisFddiLctFailures",
        "object:MSFT_SmbGlobalMapping",
        "MSNdis_DriverVersion",
        "AGP_RATE_2X",
        "SetIScsiGroupPresharedKey",
        "releaseforsectionsynchronization",
        "Computer System Name",
        "Select * From meta_class Where __this isa \"DS_LDAP_Root_Class\"",
        "Policy Store",
        "CIM_LogicalPort",
        "{44795704-a61b-11d0-8dd4-00c04fc3358c}",
        "Defines the attachment of the NIC to the network.",
        "uValue",
        "DH Group 14",
        "Antivirus component is enabled",
        "Write Once",
        "MDM_Policy_Config01_Defender02",
        "NdisEthernetMaximumMulticastListSize",
        "TR_PROTO",
        "Send the configuration document to the managed node and use Configuration Agent to apply the configuration using the Get method.",
        "The application path name filter condition.",
        "MinimumBlockSize",
        "The DfsTarget class represents a target of a DFS link.",
        "Values: TRUE or FALSE. A value of TRUE indicates the wallpaper is tiled.",
        "64bit physical address of the memory error",
        "MDM_Policy_Result01_Authentication02",
        "BasicUIRestrictions",
        "Boolean indicating whether the address information in the property, ErrorAddress, is a system-level address (TRUE) or a physical address (FALSE). If the ErrorInfo property is equal to 3, \"OK\", then this property has no meaning.",
        "MSADOX.1",
        "IrqLevel",
        "QPFastRegister performance counter missing",
        "Parallel Port ECP",
        "RSOP_PolmkrFolderSetting",
        "{8835CFC9-BAEF-11d2-85E5-0000F8102E5F}",
        "CR_2F2626B7E6B190AABAC337367EE2C30A587328DFC7C5ED27A37779833EA30396",
        "TargetSettingGoal shall not be supplied",
        "HighPart",
        "LoadingStart",
        "HBA_FCPHYSPEED",
        "The number of quick mode state entries.",
        "5.25, 160KB,  512 bytes/sector",
        "DMTF_Reserved",
        "UmBus Driver Trace",
        "C_B8B1FAB8A4F90C512F053D1AD5C7061AC5CC502A1FC989312218B5B68AB25BBF",
        "MSNdis_TcpConnectionOffloadHardwareConfig",
        "HOSTPROC_TRACE_DRIVER",
        "Network Access Provider",
        "The QuotaPeakNonPagedPoolUsage property indicates the peak quota amount of non-paged pool usage for the process.",
        "iSCSI Unique connection id",
        "XmlSerializerOperationBehavior",
        "DiskQuota",
        "HorizontalActivePixels",
        "NdisMediaStateConnected",
        "#define HBA_EVENT_PORT_STAT_GROWTH      0x302",
        "The implementation form factor for the chip.For example, values such as SIMM (7), TSOP (9) or PGA (10) can be specified.",
        "HOSTPROC_RESERVED_18 Flag",
        "This parameter indicates whether a vigorous check of index entries should be performed.",
        "CREATE",
        "UsageRestriction",
        "Provides a list of rules, expressed as queries which are evaluated on target machine",
        "RuleValidationResults",
        "KiloBytes",
        "A snapshot error occurred while scanning this drive. Run an offline scan and fix.",
        "Name of the discovered Terminal Server License Server.",
        "The Win32_VideoController class represents the capabilities and management capacity of the video controller on a Win32 computer system. ",
        "I_100109F264418A8891B8DA48D69393178E571025D114D35005EB8841D88FAEA5.1163.3162972686.263",
        "MDM_Policy_Config01_Bluetooth02",
        "I_B8A661C1D622FBC77353C6283693E0067AFF965D515809B24B4E9FF26EFC7D7E.603.1.105338",
        "NdisFddiTypeWrapS",
        "WindowScale Option",
        "Indicates the current statuses of the subsystem. Various operational statuses are defined. Many of the enumeration's values are self-explanatory. However, a few are not and are described here in more detail. ",
        "ConcreteCollection",
        "MSFT_SmbOpenFile",
        "RequestIndex defines the 2 byte Language ID code used by the USBDevice when returning string Descriptor data. The parameter is typically 0 for non-string Descriptors. Refer to the USB Specification for more information.",
        "R_5E46683FD84F3219E379253BDA01FEC308C95988FDF4807D31199D70DC1E39D4",
        "DiskLevelDeletion",
        "ExclusionProce6;\\",
        "ErrorResolution",
        "Win32API|File System Functions|FSCTRL_DISMOUNT_VOLUME,IOCTL_VOLUME_OFFLINE",
        "RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME",
        "C_8757FA834BF17A34F40DA9E567F73EB3C0F519BA77B457CB4D641370202A1355",
        "MCA_WARNING_UNKNOWN_NO_CPU",
        "The SIDType property contains enumerated values that specify the type of security identifier (SID). SIDTypes include:/nSidTypeUser - Indicates a user SID./nSidTypeGroup - Indicates a group SID./nSidTypeDomain - Indicates a domain SID./nSidTypeAlias - Indicates an alias SID./nSidTypeWellKnownGroup - Indicates a SID for a well-known group./nSidTypeDeletedAccount - Indicates a SID for a deleted account./nSidTypeInvalid - Indicates an invalid SID./nSidTypeUnknown - Indicates an unknown SID type./nSidTypeComputer - Indicates a SID for a computer./n",
        "An array of free-form strings providing explanations and details behind the entries in the OtherIdentifying Info array. Note, each entry of this array is related to the entry in OtherIdentifyingInfo that is located at the same index.",
        "SourceInfo",
        "Accounts_RenameGuestAccount",
        "The DeviceID property contains a string uniquely identifying the disk drive with other devices on the system.",
        "MSNdis_80211_ServiceSetIdentifier",
        "MIF.DMTF|Portable Battery|002.7",
        "Sequential",
        "RebootAndManualStepsAndOfflineScanRequired",
        "SetBasePriority",
        "Time Streaming",
        "C_5200A18802E4747264437AC469BB415FA346E34983915EA25009200F37191BB2",
        "AllowLocation",
        "Average power consumption in milliwatts",
        "The method returns an integer value that can be interpretted as follows: ",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_home_dir",
        "AveragingIntervalChanged",
        "Disk space usage for NTFS volumes.",
        "LetAppsAccessGazeInput_ForceDenyTheseApps",
        "C_E707FBA0E2CA2FF8FDB82241C8B012B9A1B221B3B69ACD6A3EDCF3E478558D31",
        "Status value",
        "40003",
        "The DeviceID property contains a string identifying the Plug and Play device.",
        "CD_B715CBD523374FBED801AECAF12284FC6BC34C5D6F6D2476176EDBA2C8EF1A70.2115.2165207628.559",
        "{60fc6b57-0f66-11d1-96a7-00c04fc3358c}",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.292.720466710.180",
        "CIM_ModifySettingAction",
        "Boolean indicating that the physical element is powered on (TRUE), or is currently off (FALSE).",
        "LPC_TRACE_PORT",
        "98 - Not all DHCP leases could be released/renewed",
        "The unique id of the virtual disk associated with this extent.",
        "MEM_ROW",
        "NDIS 802.11 Authentication Mode",
        "The Sensor's threshold values specify the ranges (min and max values) for determining whether the Sensor is operating under Normal, NonCritical, Critical or Fatal conditions. If the CurrentReading is between LowerThresholdCritical and LowerThresholdFatal, then the CurrentState is Critical.",
        "This is the error code in the event that WNS channel creation fails",
        "SupportCapabilities",
        "Thread Pool Pool Create Close",
        "TotalResponseBufferCount",
        "{8502C50C-5FBB-11D2-AAC1-006008C78BC7}",
        "0x0001",
        "Name Subscription RefCount",
        "PCI_BUS_RESPONDER_ID",
        "DECnet Address",
        "EnableDebugConfiguration",
        "Unique identifier of the incident (GUID)",
        "hertz",
        "PolicyRule instances may also be used to aggregate other PolicyRules and/or PolicyGroups. When used in this way to implement nested rules, the conditions of the aggregating rule apply to the subordinate rules as well. However, any side effects of condition evaluation or the execution of actions MUST NOT affect the result of the evaluation of other conditions evaluated by the rule engine in the same evaluation pass. That is, an implementation of a rule engine MAY evaluate all conditions in any order before applying the priority and determining which actions are to be executed.",
        "#define SendCTPassThru_OUT_ResponseBuffer_SIZE_HINT 768",
        "Storage Chassis",
        "2.6.0",
        "The name of the account associated with the SID",
        "NoAssessmentAvailable",
        "Current number of records in the Log.",
        "Wednesday",
        "Characteristics of the network component represented by this binding.",
        "Sessions Timed Out",
        "Overall Order of the Applied GPO Links found acrossall the applicable SOMs",
        "IPv6TransmitUdpChecksumSupported",
        "LetAppsAccessCallHistory_UserInControlOfTheseApps",
        "SetDefaultTOS",
        "DeviceId is an address or other identifier that uniquely names the physical disk.",
        "SAM Shutdown SAM Server",
        "Task provider for ODBC driver.",
        "The count of currently active KMS clients on the KMS host. -1 indicates the computer is not enabled as a KMS, or has not received any client licensing-requests.",
        "RSOP_SecuritySettingNumeric",
        "WriteByPrinterNfcTag",
        "MSNdis_EnumerateAdapter",
        "0xD018",
        "subEntry",
        "EA IME API",
        "Win32API|Communication Structures|DCB|fBinary",
        "CoNDIS Vendor ID",
        "_DH_WMP_DRM Flag",
        "MemoryScore",
        "MSNdis_PortStateData",
        "Audit",
        "NdisAtmMaxAal34PacketSize",
        "71 - Invalid gateway IP address",
        "CIM::Core::CoreElements",
        "SendScsiInquiry",
        "MSDiskDriver_Geometry",
        "LPC_TRACE_RESERVED_1c",
        "InternetZoneUsePopupBlocker",
        "MI_ERRORCATEGORY_NOT_ENABLED",
        "DisableDeviceDelete",
        "No diagnostic logs were enabled for this storage subsystem.",
        "DestPortWWN",
        "InitialProgramPath",
        "NS_42E4E0D295908E5E61369FD892A1F8D55E4601E6F286F3D44587BC7BAFF4CF40",
        "The SetIPXVirtualNetworkNumber method is used to set the Internetworking Packet Exchange (IPX) virtual network number on the target computer system. Windows 2000 and Windows NT 3.51 or greater uses an internal network number for internal routing. The internal network number is also known as a virtual network number. It uniquely identifies the computer system on the network. The method returns an integer value of 0 on successful completion, and any other number to indicate an error.",
        "object:TraceListener",
        "MDM_Policy_Result01_LocalPoliciesSecurityOptions02",
        "ISATAP global settings associated with this interface",
        "ExcludedProcesses",
        "This class represents the association between an operating system and the autochk settings that apply to the disks on the machine.Note that the setting is associated to operating system rather than computer system since there can be one or more operating systems installed on the machine, each with its own autochk settings.",
        "The controlled device.",
        "Describes which policy the server uses in order to determine the  initial program path and filename and the startin folder.",
        "This property is a reference to the instance of Win32_NamedJobObject in which the processes are contained.",
        "R_F7E10C2E2B48C52ACA99548FFAFB6BFFFF056CE9E9128CD48CB817FDF7995302",
        "The Antecedent property references a logon session.",
        "Standalone Server",
        "LPC_TRACE_RESERVED_0e Flag",
        "iScsiFlagEnum",
        "The SetDatabasePath method sets the path to the standard Internet database files (HOSTS, LMHOSTS, NETWORKS, PROTOCOLS). It is used by the Windows Sockets interface. The method returns an integer value that can be interpretted as follows: ",
        "NumericSensor for IPMI",
        "ARPCopy",
        "ifHCOutMulticastPkts",
        "MSNdis_NetworkDirectAdapterCapabilities",
        "SECHC_LOG_FLAG_STATE",
        "ControlMask",
        "Restart",
        "GPO GUID",
        "LPC_TRACE_LPC Flag",
        "4 - 'Stressed': The volume is functioning, but needs attention. For example, the volume might be overloaded or overheated.",
        "Specifies whether Branch Office Remote Logging is disabled for this printer.",
        "Stopping the configuration in progress.",
        "I_21E85A20CC15E835CB6487F54DC9B230DDD677D1A3F958EEE3ACBA0DE0846B34.1500.370985859.312",
        "Compact Disc",
        "GetEventBuffer",
        "ServerUrl",
        "Thread_V3",
        "PolicyChange_AuditMPSSVCRuleLevelPolicyChange",
        "System include directory",
        "9 - 'Stopping': The volume is in the process of stopping.",
        "Extension Status",
        "WLAN HC Diagnostics Trace",
        "The new process has a new console. Note: This property has been Deprecated in Windows XP and is no longer used.",
        "This setting may not be changed due to the group policy setting",
        "NS_3F2E8022E512721B56515EF3BC51FB34E6E540D0FD898B8F849D2B28C15BFF55",
        "Specifies the maximum allowable baud rate, in bits per second (bps). This member can be one of the following values: Value Meaning",
        "MDM_RemoteWipe",
        "Encryption Type",
        "TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications",
        "Returns information describing the specified hardware error source",
        "IL_B295448335625AE4F30B1C13C498CDDD136CBDFE27D0ECE17CA7AAD4E56199B6.1938.1342239621.200",
        "\"Error\" indicates the ManagedElement is in an Error condition.",
        "XMLFragment",
        "VpnPeerCachingAllowedProvider",
        "{8502C582-5FBB-11D2-AAC1-006008C78BC7}",
        "The TotalCylinders property indicates the total number of cylinders on the physical disk drive. Note: the value for this property is obtained through extended functions of BIOS interrupt 13h. The value may be inaccurate if the drive uses a translation scheme to support high capacity disk sizes. Consult the manufacturer for accurate drive specifications.",
        "26 15:30:41 GMT",
        "Service Dependency Failure",
        "Higher values indicates there are more than one applications or services has loaded the profile and using it.",
        "The MemoryErrorCorrection property indicates the type of error correction used by the memory array.",
        "CD_F8DBCCC9EC3564253249A34557C34EC79D44268E23A36532F093DF4A918D7FBA.58.3344631149.248",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_58F8973372F3501A9EC11539D15E25FC4FCFC2D0AB8D64BD3D0FD5BE87B740C6",
        "store",
        "56007",
        "Password and Username must use a high authentication level (i.e. no less than RPC_C_AUTHN_LEVEL_PKT_PRIVACY) when they connect to winmgmt (i.e. in the call to obtain the IWbemServices interface) or SetProxyBlanket on their IWbemServices ptr. If they are local to winmgmt then this is not a concern because their authentication level is as good as RPC_C_AUTHN_LEVEL_PKT_PRIVACY as well as their client request never goes over the wire to get to the winmgmt. ",
        "IR_98D9637DFF75E87222F5EE1D6ECAC855AD744FED98F1A3D93FDD69C3F245A650",
        "HideRecentlyAddedApps",
        "MSNT_FileBaseTrace_OptionalData",
        "CoNDIS Media Types In Use",
        "PolicySourceInitialProgramPath indicates whether the property InitialProgramPath is configured by Server (0),Group Policy (1), Default (2).",
        "The GroupComponent reference represents the physical memory array that contains the physical memory.",
        "60007",
        "The total number of successful SAs created during quick mode negotiations",
        "Destroy",
        "MSFT_NetFirewallRuleFilterByProtocolPort",
        "This parameter indicates the default allocation policy for virtual disks created in an enclosure aware storage pool. For example, an enclosure aware subsystem could balance each data copy of the virtual disk across multiple physical enclosures such that each enclosure contains a full data copy of the virtual disk.",
        "Specifies the ID of the job to get.",
        "NullTerminated",
        "MDM_Policy_Result01_KioskBrowser02",
        "41007",
        "WinSATAssessmentState",
        "HopPattern",
        "Win32_InstalledProgramFramework",
        "WSAT_TraceProvider",
        "dwProvSpec2",
        "NotificationTime",
        "I_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2482.476375418.368",
        "TimeOnBattery",
        "Packet Filter status information.",
        "Switch parameter used to Automatically detect proxy settings",
        "ScriptingEngine",
        "MSNdis_EnumerateReceiveFilters",
        "The operation is not supported while the clust included a binding which did not match a binding established by the specified port",
        "Primary",
        "{8502C575-5FBB-11D2-AAC1-006008C78BC7}",
        "AccessControlType",
        "C_C69021AD1257EACAD7939BF557F7345378A0D2A133C46981184D4659B6575E49",
        "ObjectName",
        "OpticalWriteInit",
        "SamRemoveMemFromForeignDom",
        "PauseService",
        "This class supplies the Instance names associated with a PnP Device Instance Id",
        "MldLevel",
        "domain",
        "TriggerEnabledInAllMDMProfiles",
        "The \"Base\" used in representing a numeric parameter.",
        "DisableDownloadingOfPrintDriversOverHTTP",
        "ParentProcessId",
        "Bytes read using hardware Ecp mode",
        "Disconnect",
        "IL_33A7BFA2025BA7F7DB0CEEE1B24DBF7556E415894EBBCB30BC86C2A1966AD8CB.1480.2036682156.194",
        "CD_D4A97CD760E9DC657E08D29140B18BCC6B8D0D59DB6745F4739A4443DFD0F72F.1748.3865379420.479",
        "Retrieves the configuration information for a Printer.",
        "MIF.DMTF|ComponentID|001.4",
        "_thisNAMESPACE",
        "MIF.DMTF|Operating System|001.3",
        "AutoUpdateStatus",
        "NDIS FDDI LConnect State",
        "The Tag property uniquely identifies the base board of the system.",
        "MSV1_0Trace",
        "PS_UpdateAndCompareCIPolicy",
        "Warning Counter",
        "The PrintQuality property indicates one of four quality levels of the print job.  If a positive value is specified, the quality is measured in dots per inch.",
        "PolicySourceRedirectSmartCards",
        "If TRUE, storage pools on this subsystem support capacity expansion through adding more physical disks.",
        "Install a product key.",
        "IrqAffinityMask",
        "Add_BCDataCacheExtensionByPercentage",
        "senseKeySpecific",
        "ProtectKeyWithPassPhrase",
        "CloseTimeout",
        "DllSearchResults",
        "CR_D2E1F5EB4F84E0C0B2E61F3513674DF2B7151098EA22604925123769286041D2",
        "PassThroughClass is the WBEM class name of the proprietary storage provider object.",
        "Excessive Vibration",
        "Bit flags that provide information about the descriptor's contents and format",
        "{5016E228-DB34-11d2-85FC-0000F8102E5F}",
        "Read Total Errors",
        "The printer this LPR port points to.",
        "PDUs Received",
        "PciExpressMaxLinkWidth",
        "Compressed",
        "Application published for remote use through Terminal Services",
        "The Dependent reference represents the process associated with the session.",
        "MSFT_NetNatTransitionInterfaceAssociation",
        "MaximumScripts",
        "C_C17EBBF86D4537DC1A3044DCC316F63FF8183E01B0197617CF6F88A826A1D730",
        "MSFT_WmiError",
        "OpenFiles",
        "Credential to access remote resources.",
        "LookupIsolatedNameInTrustedDomains_TypeGroup1",
        "RDP Security Layer",
        "PoolSnapDCStart",
        "UseGatewayBypassLocal",
        "MDM_Policy_Config01_Wifi02",
        "Load Balance Policy for each session",
        "Select * from Win32_TemperatureProbe",
        "MS_SM_EventControl",
        "RSOP_IEFavoriteItem",
        "Tolerance",
        "The protocol (RAW or LPR) for this port.",
        "If TRUE enable the device, if FALSE disable the device.",
        "Supports Disk Quotas",
        "A boolean value that specifies if the response can be unsecured.",
        "The ServiceAccessPoint implemented using the LogicalDevice.",
        "msieee80211-ID",
        "The DefaultTOS property indicates the default Type Of Service (TOS) value set in the header of outgoing IP packets. ",
        "MSNdis_NetworkDirectAdapterInfo",
        "Packages",
        "MSFT_HealthRecord",
        "             the existing profile. If the new owner already has a profile, calling this method ",
        "EventCode",
        "ServiceBehaviorAttribute",
        "Number Of Page Faults",
        "CIM_Memory.NumberOfBlocks",
        "MDM_Policy_User_Result01_Settings02",
        "CR_4FC7350D0697D65B1585376855E9596964780B95A8CAA540BF3CC2CD97C19696",
        "NetworkPort is the logical representation of network communications hardware such as a physical connector and the setup or operation of the network chips, at the lowest layers of a network stack.",
        "VigorousIndexCheck",
        "Central Office Switch",
        "An array of free-form strings providing more detailed explanations for any of the serial controller features indicated in the Capabilities array. Note, each entry of this array is related to the entry in the Capabilities array that is located at the same index.",
        "CIM_IKESAEndpoint",
        "The guid of the type of object this object inherits from",
        "Win32API|Network Management Structures|USER_INFO_3|usri3_acct_expires",
        "Values: TRUE or FALSE. If TRUE, the automatic reset is enabled.",
        "NETIO_TRACE_NMR Flag",
        "This property gets/sets the maintenance window start delay pattern e.g. PT30M",
        "Populated when \"Type\" has the value of \"EmbeddedInstance\".",
        "CIM_LogicalFile",
        "The functional address enabled on the NIC for packet reception.",
        "NONCACHEDIO",
        "R_9BD335E67BAE50C9848BEA0828D53089414BA43D5342FE18815FB3521F2F4CC6",
        "2E1}]",
        "MsftMultisessionSequential_DebugGeneral",
        "DomainSID",
        "{6C770D53-0441-AFD4-DCAB-1D89155FECFC}",
        "Number of error records",
        "Sets the Encryption level to one of Low, Medium or High. The function takes one parameter that specifies the Encryption Level: 1 = Low, 2 = Medium, 3 = High, 4 = FIPS Compliant.",
        "CD_FF159D71CBDBE76CD3A5D20DD10524A5A1A348C9E7D67EDF646E6CECE8CFB385.1539.1747564666.492",
        "EFS Flag",
        "valid tree for Windows 95 and Windows 98 computers only. ",
        "TEST_TRACE_RESERVED_16 Flag",
        "CD_7BC06DFC2CCE54A0D578DEA59EBB1A8ADB06CF1508741E02D2DCC0BB4C755E69.1659.1.22229",
        "{8502C571-5FBB-11D2-AAC1-006008C78BC7}",
        "The address which serves as the destination to be reached.",
        "This field indicates which storage pool should be used to hold the created clone. If this field is not set, this method will default to using the same storage pool that contains the source virtual disk.",
        "Phase Change Write Once",
        "DetectionFrequency",
        "Function",
        "LLTDIO",
        "{149ADDEE-DB2A-11d2-85FC-0000F8102E5F}",
        "Win32Registry|HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{GUID}\\InprocServer32[Default]",
        "Specifies whether behavior monitoring is enabled",
        "818DB2B3AB26C49A2AEB1D243B555363E794DB6E712436AF8BBB2D25701B24B8",
        "Deactivate Consistency",
        "Windows is still setting up this device.",
        "C_A17354395E79A088E63A18457CAA51A441A886387058324A6BE95873BE2C4E38",
        "C_133926115907D1CAA329A707F5DA6057F1FEF2436D8F8041CFE6E68664D6F252",
        "CD_20C200D9E838157679E42B001B4147A35D03B45050CB643ED29839B5C1F1E6F1.39.4028008967.1933",
        "The ThreadCount property specifies the number of active threads in this process. ",
        "C_703C562B7404A6234AAFEB9B3BB242E3FF62C76339F84C997DCEF89443C2DF65",
        "The MofSelfInstallDirectory property contains ",
        "R_0CD3432EB17462BFB5BD92FE309EBEDE9286A9F3ADCBFE4044D787F3CCDADE24",
        "Localized version of RSOP_PolmkrFolderOptionSetting for American English",
        "TcpIPv6HashSupported",
        "InstallableLanguages",
        "Example: S46=136.",
        "GetServiceAccessPoints",
        "SentMulticastPackets",
        "Version should be in the form <major>.<minor>.<revision> or <major>.<minor><letter><revision>.",
        "NS_3D98EC37D63EBFB9210DB658120A818078461369A71EFFA3DDE47412F528D55E\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_61642E797CBA7FD308765D422A26458A770AD0BC77553C0534CCCD9FCA1BD187",
        "request.",
        "MSMCAEvent_SwitchToCMCPolling",
        "\\\\.\\Root\\Microsoft\\Windows\\TaskScheduler:__Win32Provider.Name=\"ScheduledTaskProv\"",
        " This association is used to identify the actions for a software element. ",
        "InitiatedConnections",
        "05459E9FD61FC6C601B5A8AAE36085966AD27E0D7247EDCA6524B",
        "{e779ab61-b9ab-11d4-b675-002048570337}",
        "The child/part Policy in the association.",
        "WMI|Win32_ProgramGroupOrItem",
        "The PartComponent reference represents the Win32_ProgramGroupOrItem containing a start menu group or item for this association",
        "NS_876145C71900245306A149A8A7DAC3FB0D74027E586B2E97BEF112C2070090FD",
        "User info (Registration/Wizard flow paths)",
        "{0320F14D-D374-470E-B7B1-DAE86A4C0FF4}",
        "This device is not working properly because Windows cannot load the drivers required for this device.",
        "{8502C52D-5FBB-11D2-AAC1-006008C78BC7}",
        "Web-proxy configuration for VPN connection",
        "Image load",
        "Specifies an access control entry",
        "Read, write, and delete data values ",
        "CD_7AC6B537C17B7A0CE625AFA6380E4FC98418E800AD64DF240D5A7AD2482283AD.2106.595497892.3223",
        "CD_6572B1CC4CD6AC35D80FB14E68E5854FA4FA40953667D1578E6FFD075F930AA0.1185.1340850843.2251",
        "KeyManagementServiceCurrentCount",
        "doWipeProtectedMethod",
        "MSFT_NetAdapterPowerManagement_WakePattern_TcpSyn",
        "SPACES_StorageSubsystemToStoragePool",
        "MIF.DMTF|Temperature Probe|001.15",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|NumForwardPackets",
        "Msft_WmiProvider_OperationEvent",
        "Source element can be removed from group",
        "The printer for which to retrieve printer configuration.",
        "GetKeyProtectorCertificate",
        "MaxNumberOfProcesses",
        "Example: 2794",
        "MemoryType",
        "InternetZoneNavigateWindowsAndFrames",
        "Whether Operation API Prefetching Functionality is enabled",
        "This parameter specifies the desired size (measured in bytes) for the partition. This must be equal to or less than the size specified by the disk's LargestFreeExtent property. This parameter cannot be used with UseMaximumSize.",
        "Auth Transform plumbed in IPsec policy",
        "WmiRefClass",
        "EstimatedThroughput",
        "Win32API|Printing and Print Spooler Structures|PRINTER_INFO_2|pComment",
        "MDM_Policy_Config01_RestrictedGroups02",
        "\\\\.\\Root\\cimv2\\TerminalServices:__Win32Provider.Name=\"Win32_WIN32_TSVIRTUALIPSETTING_Prov\"",
        "MSADCF.1 formatted output (W)",
        "- 3=<Class.>Property. Example: If the authorization target is a CIM Service, Namespace or Collection of instances, then the ActivityQualifiers entries can define the class properties that may or may not be accessed. In this case, the class names are specified with the property names to avoid ambiguity - since a CIM Service, Namespace or Collection could manage multiple classes. On the other hand, if the authorization target is an individual instance, then there is no possible ambiguity and the class name may be omitted. To specify ALL properties, the wildcard string \"*\" should be used. ",
        "SCSI Serial Bus Protocol",
        "PageVisibilityList",
        "Win32_VolumeUserQuota",
        "SuppressAuditFailure",
        "Power PC X704",
        "0x80050058",
        "#define ISCSI_LOGIN_FLAGS ULONG",
        "CIM_Printer.DefaultLanguage",
        "characters",
        "The total amount of physical memory available to the operating system.  This value does not necessarily indicate the true amount of physical memory, but what  is reported to the operating system as available to it",
        "If in character mode, number of rows for this video controller. Otherwise, enter 0.",
        "Total Fragmented Files",
        "CD_9DD2597311C29BD08E085D0347CF2A159A6DBD82B7A0B5D91EAAC81FF9077FEA.2555.181478980.523",
        "The AdapterTypeId property reflects the network medium in use. This property gives the same information as the AdapterType property, except that the the information is returned in the form of an integer value that corresponds to the following: ",
        "enabled",
        "CECABE89D78E5D727A64FE3F1CF111.1937.3401591082.928",
        "kFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "LockedDownInternetZoneAllowLessPrivilegedSites",
        "select * from Win32_PowerManagementEvent",
        "The StartMode parameter passes the start mode of the Win32 base service. \"Boot\" specifies a device driver started by the operating system loader. This value is valid only for driver services. \"System\" specifies a device driver started by the IoInitSystem function. This value is valid only for driver services. \"Automatic\" specifies a service to be started automatically by the service control manager during system startup. \"Manual\" specifies a service to be started by the service control manager when a process calls the StartService function. \"Disabled\" specifies a service that can no longer be started.",
        "The GroupComponent reference represents the Win32_ComputerSystem containing the properties of the computer system where the disk partition is located.",
        "CIM_PhysicalComputerSystemView",
        "CR_B8FE5FFFD9F56B516894A4BDA66D0309DC9561575F8C5722578410589488B53F",
        "Off-line scan required",
        "PolicySourceDisabled",
        "Identifier of the IKE phase 1 negotiation initiator. Combined with the ResponderCookie, this value, in string form, may be used to construct the value of the key field \\'Name\\', inherited from ServiceAccessPoint.",
        "The SessionType property indicates how the session was opened. Only on Win NT.",
        "NameServers",
        "The method enables setting a more granular set of permissions to the existing account. The flag, Allowspecifies if Permissions is to be allowed or denied.The permissions are set individually through PermissionMask.The PermissionMask is an enumeration of t",
        "a9546a82-feb0-11d0-bd26-00aa00b7b32a",
        "Name of the Desktop",
        "ref:MSFT_NetLbfoProvider",
        "PortalIdentifierString",
        "DepositActiveDirectoryOfflineActivationConfirmation",
        "SetPartitionDeviceElement",
        "Controls the TCP ECN Capability.  Disabled by default in client, enabled by default in server. The value can be one of the following values:  - Disabled: Disable ECN Capability.  - Enabled : Enable ECN Capability.",
        "Specifies the Audit Permissions for success. The permissions are a combination of one or more of the following:WINSTATION_QUERY, WINSTATION_SET, WINSTATION_RESET, WINSTATION_VIRTUAL | STANDARD_RIGHTS_REQUIRED, WINSTATION_SHADOW,WINSTATION_LOGON, WINSTATION_LOGOFF, WINSTATION_MSG, WINSTATION_CONNECT, WINSTATION_DISCONNECT.",
        "DefaultTOS",
        "The maximum characters allowed in a table name.",
        "MSFT_SoftError_RelativePath",
        "The Win32_VolumeUserQuota association relates per user quotas to quota enabled volumes. System administrators can configure Windows to prevent further disk space use and log an event when a user exceeds a specified disk space limit. They can also log an event when a user exceeds a specified disk space warning level. Note that disk quotas cannot be set for the Administrator accounts themselves.",
        "CR_5C6828A3364FB35ACCB00567C7BCB4FAA9D96E7DAA4FEE16FD257A946F33EA50",
        "78 - File copy failed",
        "C_15BB74500CCB05CD5AC2C91DC16CB85AAAE5FB06E9A05F8A5AA7D6BCB68E38B6",
        "IL_46525BAD3099F51458A5D518030526DE848A3DE564DD8816A47DE935CCD3FA82.2457.3971602568.328",
        "\\\\.\\Root\\Microsoft\\Windows\\Wdac:__Win32Provider.Name=\"WdacWmiProv\"",
        "object:MSFT_PrinterNfcTag",
        " 0x001 ",
        "The host name is already in use.",
        "The ExpandedDebugFilePath property is an expanded version of the DebugFilePath property. /nExample: C:\\WinNT\\Memory.dmp",
        "Description of the method when the value 1 (\"Other\") is specified for the property, AuthenticationMethod.",
        "The Win32_SerialPortConfiguration class represents the default settings for data transmission on a Win32 serial port. this may include the default configuration for establishing a connection and error checking.",
        "MSFT_NetAdapterEncapsulatedPacketTaskOffloadCapabilities",
        "CpuStatus",
        "Win32API|Printing and Print Spooler Structures|JOB_INFO_4|pPrintProcessor",
        "MSFT_FileServerToFileShare",
        "Object which contains details for privacy attributes for the 'internet' security zone.",
        "NvgreEncapsulatedPacketTaskOffloadEnabled",
        "Lock Flag",
        "Drive Hardware Error",
        "MaxBlockSize",
        "Displays the type of transport used for the connection: Example TCP, NETBIOS, IPX/SPX.",
        "StackProcess",
        "The maximum length of the physical link in feet.",
        "MDM_Policy_Result01_CredentialsDelegation02",
        "183 - Archive file name already exists. Cannot create file. ",
        "{c89b8490-350a-4a34-90b6-98b37f4ed5b2}",
        "The RSOP_PolicySetting class is the abstract parent object from which client-side extensions' policy objects are inherited",
        "Associate a template with a profile",
        "    // If set then all other ISCSI_SECURITY_FLAGS are valid                ",
        "CD_F22CF0C74A9002156D476F4DBA031C7F3F706A1A94FD4FF91611BCB6BD8FBB7C.28.2534231134.415",
        "The trusted time for the product.",
        "DOSetHoursToLimitForegroundDownloadBandwidth",
        "Asynchronous Clone Remote",
        "Win32API|Process Status|SYSTEM_PROCESS_INFORMATION|NumberOfThreads",
        "RD_TRACE_DMCONTROL",
        "This method creates a virtual disk using the resources of the storage pool. This method is available only when the SupportsVirtualDiskCreation property on the storage subsystem is set to TRUE. If it is set to FALSE, this method will fail with MI_RESULT_NOT_SUPPORTED. This method is also not supported for primordial pools. ",
        "CscUm",
        "TRACE_CLASS_INIT Flag",
        "C_F048CF2C454CB8BAA99C1A4118013AD0A4526AC70F8F00D9BC60DB068406C882",
        "A Boolean value that specifies whether replay attacks against the channel are detected and dealt with automatically.",
        "RSOP_ApplicationManagementPolicySetting",
        "Valid Data Tracking",
        "SamOpenUser",
        "WatchSubtree",
        "_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "TRUE if the adapter can use IPSEC to protect iSCSI traffic.",
        "ASSERT",
        "Specifies the network adapter connection state.",
        "Win32API|Printing and Print Spooler Structures|DevMode|dmSpecVersion",
        "DOT11_FATMSM Flag",
        "VESA Display Data Channel Supported",
        "Service version (major, minor, build, revision)",
        "ExtendedGrace",
        "UUTUUUUUU",
        "CR_9D6DAF01BF9FEB3EF2C9DA9CCCD42495EF0FF0EB48CFEA8E496981FAD2449D94",
        "WorkStation Trust Account",
        "TimeSubmitted",
        "CD_46220D63709C3AA26B1F26BFEDBED5BF0C3449D14236275DE54E229C2751EF56.270.761933767.566",
        "Criticality",
        "Successful completion, reboot required",
        "Win32_ComClassEmulator",
        "The MTU is the maximum packet size (in bytes) that the transport will transmit over the underlying network. The size includes the transport header. Note that an IP datagram may span multiple packets. Values larger than the default for the underlying network will result in the transport using the network default MTU. Values smaller than 68 will result in the transport using an MTU of 68. The method returns an integer value that can be interpretted as follows: ",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_71140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD\\I_6952BC8C6187412BA6F7CAEE56328B9DCA8AFF615B18BF7135EB8A91F51729F6",
        "Collections typically aggregate 'like' objects, and represent an optimization. Without Collections, one is forced to define individual ElementSetting and ElementConfiguration associations, to tie Settings and Configuration objects to individual ManagedSystemElements. There may be much duplication in assigning the same Setting to multiple objects. In addition, using the Collection object allows the determination that the Setting and Configuration associations are indeed the same for the Collection's members. This information would otherwise be obtained by defining the Collection in a proprietary manner, and then querying the ElementSetting and ElementConfiguration associations to determine if the Collection set is completely covered.",
        "3.5,  1.44MB, 512 bytes/sector",
        "8U6k6",
        "PassPhrase",
        "Fatal Flag",
        "Specifies the time at which the event was written to the logfile.",
        "If the provider determines that the authentication level is too low and a Password or Username has been specified then WBEM_E_ENCRYPTED_CONNECTION_REQUIRED will be returned. ",
        "Default credential to access the file location",
        "DisableProfile",
        "Example: Removable media",
        "C_AA41A8343BA1D329E4982E46F903D80197DFB87E55CE7405A84B7AC638E427A0",
        "DomainController",
        "Describes overall configuration and state for BranchCache",
        "PolicySourceUserName",
        "The type power meter this is, i.e. input or output power.",
        "Win32_ClassicCOMClassSetting",
        "LoginOtherFail",
        "User SID",
        "VPortID",
        "FixErrors",
        "PS_VpnConnectionIPsecConfiguration",
        "WMI_CHANGER_PARAMETERS",
        "PNP_INSTALL_WARNING_LEVEL Flag",
        "IPUseZeroBroadcast",
        "R_960A016BC71A8D938443FD5B4BD545FA10D9D76A0776A92D75D4E23235CAD0D0",
        "DUMMY Flag",
        "ThreadID",
        "This class provides configuration to restrict settings on the device",
        "AllowWatchKey",
        "AppDecide",
        "The DeviceID property contains a string identifying the portable battery.",
        "TransactionAutoCompleteOnSessionClose",
        "SuffixOrigin",
        "CIM_PhysicalComputerSystemView.NumericSensorElementName",
        "Country Code",
        "Moderation of drain notifications based on a moderation count value on any PD queue is supported.",
        "SetPolicyPropertyName",
        "NtlmValidateUser_Start",
        "CD_284916CD952AAE32B075C2CF9D6353A3004441F29529D83865782726D8CFD589.1750.1795449462.2574",
        "The MPIO load balance policy being used by the disk.",
        "Win32API|Device Input and Output Structures|DISK_GEOMETRY|Cylinders",
        "CR_6F49E037E6F2BFB72144CC48C974D93CBE7417A8F27ACAB5CA25D34A28C29442",
        "C_A85D741861673C53E1690A3A36DD370F35BF62AC7197C00161000A38E681F23C",
        "C_C6289081C8AB688F844FF931CF917B4DD7080FB5ABF4C1BADA0FD2591FE183FD",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Netbt\\Parameters|ScopeID",
        "The QueryLanguage property holds the language of the following query filter. For this version of WMI, it will always be 'WQL'.",
        "The quotas of the readers.",
        "20F26C6236C8252E1FCBB508B5F5781449304BFBC276C5E3DD747A3A26989746",
        "2 - 'OK': The volume is responding to commands and is in a normal operating state.",
        "queueTag",
        "Set Header/Data Split Parameters",
        "TStateHandler",
        "CacheHost",
        "__TimerEvent",
        "Downlevel IPsec API",
        "MDM_Policy_Result01_Wifi02",
        "Aggressive",
        "The current length of the physical link in feet. For some connections, especially wireless technologies, this property may not be applicable and should be left uninitialized.",
        "The PathName parameter passes the fully qualified path to the executable file that implements the service.",
        "RestartOnIdleTime",
        "{D5C870CE-4ED0-4fdc-BB54-8B452C18797E}",
        "The Name property indicates the name of the Win32 serial port.",
        "MDM_DeviceStatus_Battery01",
        "TypeOfRangeSwitching describes the kind of input voltage range switching that is implemented in this PowerSupply. For example, autoswitching can be specified (value=4).",
        "Snapshotting",
        "6279CF024432941A2BC16A9043D5A3CF26ADC36D1DFFEBF2B9.1228.1.9113",
        "AppInventoryResults",
        "System memory management (configuration layout and availability of memory).  ",
        "GetSPIFailures",
        "RedundancyStatus",
        "//  iscsicfg.h",
        "LetAppsAccessMicrophone_ForceDenyTheseApps",
        "SupportedMaximumLogSize",
        "Per Month",
        "53B353FF907A3871574884AE20E2C77DD82D160B77856929A17F6C699D4.2033.251139252.249",
        "AllowPinnedFolderVideos",
        "DTE-DCE Interface Error",
        "SamPwdPushPdc_Start",
        "65001",
        "{ECDE0B90-DB2A-11d2-85FC-0000F8102E5F}",
        "QuerySecret",
        "Disables QoS on the network adapter.",
        "Fibre Channel",
        "AllowPinnedFolderSettings",
        "Win32API|Device Input and Output Structures|PARTITION_INFORMATION|RecognizedPartition",
        "UseWriteThrough",
        "Last transition result",
        "COOKIE",
        "If this service fails to start during startup, the ErrorControl property specifies the severity of the error. The value indicates the action taken by the startup program if failure occurs. All errors are logged by the computer system. The computer system does not notify the user of \"Ignore\" errors. With \"Normal\" errors the user is notified. With \"Severe\" errors, the system is restarted with the last-known-good configuration. Finally, on\"Critical\" errors the system attempts to restart with a good configuration.",
        "object:MS_SMHBA_FC_PHY",
        "SyncState describes the state of the association with respect to Replication activity. Values are: ",
        "NewPIN",
        "CD_B837FF0F19509FD7BD0B7ED8ED2B62529F924B69EF7322F8463864ECBCB01E5E.1151.3923877549.882",
        "The DriverVersion property indicates the version number of the  printer driver.  The version numbers are created and maintained by the driver manufacturer.",
        "This method will upgrade the associated Win32_Product using the upgrade package provided through PackageLocation and any command line options that are supplied. The method can return the following values:",
        "The Query property holds a string containing the text of the query.",
        "SMBIOS|Type 11|OEM Strings",
        "VfRssSupported",
        "The PartComponent reference represents the COM component existing in or used by the DCOM application.",
        "6 - The service has not been started.",
        "Number of bytes received over this session",
        "IL_FD7092A4531E1D5420328B4DF5F17D0BB4CCBF2A132542C00A61B45BBF11451C.394.1.26559",
        "DnsServer3",
        "IL_9F79CC9E07BFC5EC416BFC61E17D76D6387C16B055C0398D995353255C542258.1164.198150230.271",
        "CD_5241CFC05A716A77CB0F36844F9A62538AED075865B9C000AF8A5A2832337841.1671.2536784597.362",
        "An association between a power supply and the registered power supply profile.",
        "CIM_LogicalPort.PortType",
        "__ObjectProviderRegistration",
        "SupportURL",
        "The logical disk which is built on the volume set.",
        "The specified storage pool could not be found.",
        "KerbSetPassword_Start",
        "This field indicates the number of light parities to form for parity-based resiliency settings. If the resiliency setting is not parity-based, this field will be set to 1.",
        "IntegrationAllowRootUser",
        "QueueId",
        "Example: 22",
        "The ObjectPath property is a string containing the path of instance to be deleted.",
        "SAM Set Boot Key Information",
        "CD_8E41820F5D3747F37A9AFB4C6D31D95936F76250DC1731B0B518951FA4D1C211.1220.1.11545",
        "ActiveMaximumTransmissionUnit",
        "The GroupComponent reference represents the computer system connected to the network.",
        "ref:MSFT_NetLbfoTeamNic",
        "Boolean indicating that this card is physically unique from other cards of the same type and therefore requires a special slot. ",
        "PackageRelativeAppId",
        "{0134d07e-2064-11d4-97eb-00c04f79c403}",
        "R_950B982CC6F803B6E071200389755F5BC713572EAEDAD6AD08F5A06B9E237444",
        "10GBase-CX4",
        "{7cc9edb6-944b-45cd-95cb-00bf221a4ae9}",
        "AutoBoostSetFloor",
        "DriverMajorFunctionReturn",
        "TROJAN_MASSMAILER",
        "LetAppsGetDiagnosticInfo_UserInControlOfTheseApps",
        "CIM_Scanner",
        "isk across multiple physical enclosures such that each enclosure contains a full data copy of the virtual disk.",
        "CIM_StatisticalInformation is a root class for any arbitrary collection of statistical data and/or metrics applicable to one or more managed system elements.",
        "{a676b545-4cfb-4306-a067-502d9a0f2220}",
        "DisableFirstRunWizard",
        "See CIM_NumericSensor.LowerThresholdCritical description for details.",
        "WmiCore",
        "TFD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "cwdEu5B",
        "CopyToDeviceInternationalSettings",
        "LastRunSpaceInefficientSlabs",
        "MSFT_iSCSIConnection",
        "CLEANUP",
        "Count of LUNs mapped for this target",
        "The XOnXOffInFlowControl property specifies whether XON/XOFF flow control is used during reception.",
        "Denotes whether the provider is a stand-alone SMP provider or an SMIS provider that uses the SMIS proxy SMP.",
        "CIM_ERR_NOT_SUPPORTED",
        "The RenamePrinter method renames a printer. The method can return the following values:",
        "\"Completed\" indicates the element has completed its operation. This value should be combined with either OK, Error, or Degraded so that a client can till if the complete operation passed (Completed with OK), and failure (Completed with Error). Completed with Degraded would imply the operation finished, but did not complete OK or report an error. ",
        "Count of Login Authentication Failed Responses",
        "local|hkey_local_machine\\SYSTEM\\CurrentControlSet\\Control\\TerminalServer\\WinStations",
        "6 - Paswword Can't Change -  The user cannot change the password.",
        "ProcessorAcpiTsd",
        "select * from Win32_IP4RouteTableEvent",
        "Win32_DiskDrivePhysicalMedia",
        "The slow-network connection timeout, in milliseconds. This threshold is used to determine if the connection is a slow link. If the delay in milliseconds is greater than this threshold, the connection is considered to be slow. This property applies to non-IP networks.",
        "MSNdis_VendorDescription",
        "ScanAvgCPULoadFactor",
        "EVENT_TRACE_FLAG_A",
        "NPIV capabilities",
        "Specifies a list of DNS suffixes.",
        "Localized version of RSOP_PolmkrFolderSetting for American English",
        "Time in user mode, in milliseconds. If this information is not available, a value of 0 should be used.",
        "MSFT_NetIKECryptoProposal",
        "{791ad1a4-e35c-11d0-9692-00c04fc3358c}",
        "<1m;<1m;",
        "Descriptive name for the listener.",
        "DOT11_OID",
        "ShareAccess",
        "Protection key register",
        "Win95 w/Extended Int 13",
        "UmPass",
        "Enables the Encapsulation Offload properties on the network adapter.",
        "Gives the list of file extensions owned by an application",
        "The action after reboot the server.",
        "How to encode Pre-Shared Keys.",
        "DisplayInHex",
        "Win32API|Memory Management Structures|MEMORYSTATUS|dwAvailPageFile",
        "Network - Attached to the network.",
        "Shared",
        "Microsoft iSCSI Initiator: Portal Group",
        "Win32_CodecFile",
        "Win32_ParallelPort",
        "SIDType",
        "The platform architecture of the ODBC DSN to set. Possible values are '32-bit', '64-bit' or 'All'. The default is '32-bit' on a 32-bit process and '64-bit' on a 64-bit process. This is the platform architecture on the remote machine if this command is executed in a remote CIM session.",
        "CRC32C",
        "Deadline",
        "SubcategoryGuid",
        "SecurityServicesConfigured",
        "HashAlgorithm is an enumeration that specifies the proposed hash function. The list of algorithms was generated from Appendix A of RFC2409. Note that the enumeration is different than the RFC list and aligns with the values in IKESAEndpoint.HashAlgorithm.",
        "Number of bytes for dot11 link quality status indication",
        "Number of classification entries.",
        "CD_229F3CD4638E22D422843A148AD2ADA2C95B3802ED7FA9E6E4113BE6A1D690E2.1172.4166589129.3299",
        "The Win32_NamedJobObjectSecLimitSetting class represents the security limit settings for a job object. For more information about job object security limit settings, see the Job Object Security and Access Rights topic in the Platform SDK Base Services documentation.",
        "TypeOfRoute",
        "Msft_WmiProvider_CancelQuery_Pre",
        "R_6D121D3EDB5D89CA7CA6D8551DFC968AAA296B4827B690ADD9D3BB6EF063E2C1.2465.209982398.558",
        "MsftWriteEngine2_DebugDestructor",
        "diskinit",
        "Dormant",
        "BROWSERMODIFIER",
        "MinTotalRAM",
        "CoolSwitch",
        "The CommandLine parameter specifies the command line to execute.  The system adds a null character to the command line, trimming the string if necessary, to indicate which file was actually used. A fully qualified path must be specified in cases where the program to be launched is not in the search path of Winmgmt (not the user's path).",
        "Number of failed non-AAAA queries",
        "AhEspCombinedSupported",
        "A class derived from RemoteFileSystem representing that the FileSystem is mounted, using the NFS protocol, from a ComputerSystem. The properties of the NFS object deal with the operational aspects of the mount and represent the client-side configuration for NFS access. The FileSystemType (inherited from FileSystem) should be set to indicate the type of this FileSystem as it appears to the client.",
        "Original Target IP Address given in the login",
        "SlotIndex",
        "WMI|Win32_LogicalDisk",
        "Specify the MAC Address of the NetworkAdapter to set. If the MAC is invalid or does not exist, or if the mode is per-Session the return value should indicate appropriately.",
        "The DeviceID property contains a string identifying the fan device.",
        "ReplicationSettings",
        "DriverMajorNdisVersion",
        "The name of the printer to be renamed",
        "Name of the scripting engine, ex: VBScript",
        "ySelect",
        "Current File Open Count",
        "KEYLOGGER",
        "DemandZeroFault",
        "Destination",
        "MSNdis_TcpOffloadHardwareConfig",
        "(0.7,0.3)[V]",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.2750.2844578257.348",
        "Win32Registry|Software\\Microsoft\\Windows NT\\CurrentVersion|Plus! VersionNumber",
        "DriverProvider",
        "EVC signal level standard",
        "AllowJapaneseIMESurrogatePairCharacters",
        "Duplex Printing",
        "You must specify a value.",
        "FragmentedFolders",
        "he hea",
        "PLATFORM_TRACE_RESERVED_1d Flag",
        "CurrentCapabilities",
        "C_4981A3BB969F4ED9382A86F274047A36B2A04D2A53526DFA477217266B033E1E",
        "The Win32_VoltageProbe class represents the properties of a voltage sensor (electronic voltmeter).",
        "PPR2Set",
        "NDIS Ethernet Multicast List",
        "GPO Name as a guid.",
        "0 - 'Level 0': The storage provider and storage subsystem objects will be discovered. ",
        "ISCSI_ERR_INVALID_DATA_SEGMENT_LENGTH",
        "ElementChild",
        "Local non-adminstator account SID that is to be used for a single purpose",
        "CD_094CD032BE77E24831D84EE3DE38C46FBDC0C57F2466CC9AAB2CC4B43209B790.1677.1952888209.344",
        "{647BD8C2-658B-4eca-ABC7-FC5C0BF1704D}",
        "MSFT_NetTransportConnection",
        "DisableBackoff",
        "Flag set to 1 if the path is a primary path, 0 otherwise.",
        "Values: TRUE or FALSE. If TRUE, data transmission is suspended until CTS signal is given.",
        "Association between StorageSubSystem and StorageEnclosure",
        "SetPhysicalDisk",
        "SystemConfig_PnP",
        "0x101",
        "Bandwidth",
        "NamedJobObjectLimitSettingProv",
        "Kerberos (machine as principal)",
        "IPAddress",
        "LastAttemptedProfileUploadTime",
        "Enabled but Offline (6) indicates that the element might be completing commands, and will drop any new requests. ",
        "SecurityZonesUseOnlyMachineSettings",
        "SpinCount",
        "AdvertisedRouterLifetime",
        "The SetIGMPLevel method is used to set the extent to which the system supports IP multicasting and participates in the Internet Group Management Protocol. The method returns an integer value that can be interpretted as follows: ",
        "_DH_WMP_SYNCWIZ Flag",
        "This object contains the data needed to find either the initial load device (its key) or the boot service to request the operating system to start up.",
        "PolicySourceNetworkAdapter indicates whether the property NetworkAdapter is configured by Server (0) or Group Policy (1).",
        "object:MSFT_NetAdapterRscCapabilities",
        "ProgramPath",
        "Broadcast Channel Failure",
        "AccessMethodAddress",
        "Storage Manager Name",
        "Composite sync (on Hsync line) is NOT supported",
        "Exports a secret key to a file.",
        "object:MSFT_NetBranchCacheContentServerSettingData",
        "This property corresponds to the PowerUtilizationMode of the CIM_PowerUtilizationManagementService. See CIM_PowerUtilizationManagementService.PowerUtilizationMode for details.",
        "FlowControlHard",
        "The PortableOperatingSystem property indicates if theOperating System is booting from a supported locally connected storagedevice.",
        "The volume relative path of an existing directory to share. If this parameter is not provided, an empty share will be created.",
        "Centronics",
        "Win32_SelfRegModuleAction",
        "IPV6 Address Range",
        "Change_Sacl_Security_Information",
        "Send the configuration document to the managed node and use Configuration Agent to apply the configuration.",
        "{8D079BEE-DB36-11d2-85FC-0000F8102E5F}",
        "R_AA0B4A55EEE4C1E476A0BDD0D3A0653497872B02CC12BE52258AE7DCEF46F38E",
        "QuerySecret_Start",
        "SecurityLayer",
        "Range2InputFrequencyLow",
        "MSFT_NetFirewallProfile",
        "0xEFFF003D",
        "CD_3AA9C8A0942F537FDAE95E548CCBAD1AD1FFA8F4AD1AFE2EE57031F74E67B391.2230.1.63562",
        "A manufacturer-allocated number used to identify the physicalelement.",
        "Air Flow",
        "AdapterRAM",
        "MDM_Policy_User_Result01_Privacy02",
        "SupportsDelete",
        "0 - 'Not Specified': The method of maintaining the copy is not specified.",
        "Non-volatile",
        "Processor Performance",
        "Stack19",
        "LoadBalancingAlgorithm",
        "TypeName",
        "iScsiFlagProtocolLogInOut",
        "PollingMemoryPerUser",
        "A URL for presentation to the user when support for the application is needed",
        "ContentType",
        "C_BCAAEBA95E435CA5300A680BE9BF735F04A93ECECD18F46C56865C6158D43B74",
        "The LogPixels property contains the number of pixels per logical inch. This property is valid only with devices that work with pixels (this excludes devices such as printers).  ",
        "EVENT_TRACE_FLAG_MEMORY_HARD_FAULTS",
        "NS_3FBDCB08ECD33FBEF028D2DB3EF058F8CE959779B943F43AB3DB3EC34ACA147D\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_544CFC82C21CDF4713B5295DE1D928C00A64169D63339BF46F7D6B04314B4848|",
        "StorageSubSystemId",
        "ReportingCriticalFailureTimeOut",
        "MaximumAge",
        "MSFT_PrinterPortTasks",
        "SlowLinkParams",
        "ValidFrom",
        "Terminated",
        "\"Transitioning\" describes an element that is between states, that is, it is not fully available in either its previous state or its next state. This value should be used if other values indicating a transition to a specific state are not applicable.",
        "CR_23A50366135FBF364F350BC34F639BE141A61D21A478BB4C1230D838F1296A4E",
        "HBA_EVENT_PORT_BROADCAST_SES",
        "MaxWritePoolSize",
        "ref:CIM_StatisticalInformation",
        "Sint16",
        "Number of bytes read on disk",
        "MagicPacket",
        "The TimeStampRecordAddress property holds the intermediate hop corresponding to the TimeStampRecord entry.",
        "Extension Ids",
        "This contains a CMC event",
        "Redirect portal info - one element for each connection in the session",
        "- Installation-dependent keywords for characterizing policy objects. Examples include \\'Engineering\\', \\'Billing\\', and \\'Review in December 2000\\'. ",
        "PalmPilot",
        "Uncorrectable CPU-complex error",
        "CR_FD3BBD4C42AC2F7FEF264340A9EB78A581FE5C28561CB63EDF780B329EAC2EE4",
        "WmiHbaApiVersion",
        "2 = upgraded, ",
        "Flags",
        "The CIM_PhysicalConnector class represents any physical element that is used to connect to other elements. Any object that can be used to connect and transmit signals or power between two or more physical elements is a descendant (or member) of this class. For example, slots and D-shell connectors are types of physical connectors.",
        "Alive",
        "Qualifier for Mode of Terminal Service",
        "TRACE_CLASS_TRANSACTION",
        "IfIndex",
        "Reverse Landscape",
        "Specifies whether a body style has been explicitly specified.",
        "Kernel Idle Accounting",
        "SetIScsiInitiatorRADIUSSharedSecret",
        "MaxMacHeaderFilters",
        "internetPerConnOptionListData",
        "Supplies the list of packet patterns programmed to wake the system.",
        "DisableVhdDeviceDetection",
        "DoNotBlockOutdatedActiveXControlsOnSpecificDomains",
        "Executive",
        "Win351",
        "ref:CIM_Capabilities",
        "Win32API|Time Structures|TIME_ZONE_INFORMATION|StandardDate|wMonth",
        "Primary Domain Controller",
        "{c03d857e-9979-44f6-9bc8-caab762a8235}",
        "{F80CB85E-0EAE-4021-A873-0918F594145F}",
        "ProtocolSpecificValue",
        "CD_A7642BB5BD25E38C8455D7FA5B5711E5CBB864E5CBFEC400B5BACCE7267F35B4.1655.1.27001",
        "Name of this instance of WinNAT",
        "ref:Win32_BaseService",
        "This event class represents events related to a computer sytem.",
        "HKEY_CURRENT_USER (0x80000001) ",
        "NdisAtmSupportedAalTypes",
        "IsPersistent",
        "Instances of the CliVerb class represent behavior available through the alias. The Name property defines the actual function to be invoked when the verb is used in a command. The function may be either a fiixed list of system defined standard functions such as CALL. Or the function may be a method by on the Target of the alias. The verb has both a Descriptions property providing a description of what the verb does and a Usages property providing a description of how the verb should be called.",
        "AllowInboundRules",
        "A identifier of the object that triggered the action.",
        "The Win32_LoadOrderGroupServiceDependencies class represents an association between a base service and a load order group that the service depends on to start running.",
        "Capabilities of the media access device.  For example, the device may support \"Random Access\", removable media and \"Automatic Cleaning\".  ",
        "DiskDrive",
        "Blue CIE coordinates",
        "HiFreq Flag",
        "Select * From meta_class Where __Class = \"DS_LDAP_Root_Class\"",
        "System_AuditIPsecDriver",
        "This represents a list of objects. Each element in the Ids array specifies the guid id of an object in the same store.",
        "LOCK_CONTROL",
        "WPDNSE_REFCOUNT",
        "C_FD3BBD4C42AC2F7FEF264340A9EB78A581FE5C28561CB63EDF780B329EAC2EE4",
        "iScsiFlagIpSec Flag",
        "Flag to indicate that a GPO is found but inaccessible for security reasons.",
        "Receive Side Scale (RSS) settings for a network adapter",
        "{8502C535-5FBB-11D2-AAC1-006008C78BC7}",
        "LimitFlags",
        "RunInteractively",
        "HideSecureBoot",
        " 5 - Unknown",
        "PreOpInit",
        "Name of the module ",
        "object:MSFT_StorageExtendedStatus",
        "RSS Platform Trace",
        "0F953A",
        "The host address or IP of this port.",
        "CIM_StorageVolume",
        "This property indicates whether the disks comprising this pool are able to tolerate power loss without data loss, e.g. automatically flush volatile buffers to non-volatile media after external power is disconnected.",
        "CD_8D17C26DD0763A67C7D4D83EC64CB45890D927901B9A9155ED001A8938DA67C3.2619.904210388.479",
        "Win32_SessionResource",
        "MDL_READ",
        " 3m; 3m;",
        "The state of the auto dispose feature for parameters. ",
        "CIM_MemoryCheck specifies a condition for the minimum amount  of memory that needs to be available on a system.  The amount is specified in the MemorySize property.  The details of this checks are compared with the  value of the FreePhysicalMemory property of the  CIM_OperatingSystem object referenced by an CIM_InstalledOS association for the CIM_ComputerSystem object that describes  the environment.   When the value of FreePhysicalMemory property is greater  than or equal to the value specified in MemorySize, the  condition is satisfied. ",
        "10-100BaseT",
        "ReceiveChecksumOffloadSupported",
        "Whether dead gateway detection is enabled. Default is enabled.",
        "Identifies the minor release of the System BIOS.",
        "CSName contains the scoping computer system's name.",
        "MI_ERRORCATEGORY_PROTOCOL_ERROR",
        "CR_1F1219F96576A4588331D02100737379E76B59AFFFE01B2EACFBBB0DBCD4C75C",
        "IE links, used for IEAK RSoP.",
        "General register (bank 2)",
        "0xC0000018",
        "MDM_VPNv2_RouteList02_01",
        "AllowAzureRMSForEDP",
        "PMARPOffload",
        "ComponentId",
        "The Name property uniquely identifies the service and provides an indication of the functionality that is managed. This functionality is described in more detail in the object's Description property. ",
        "43029",
        "51000",
        " The invoke method is to take a particular action. The  details of how the method performs the action is implementation  specific.  The results of the method are based on the return value.    - A 0 (zero) is returned if the condition is satisfied.   - A 1 (one) is returned if the method is not supported.    - Any other value indicates the condition is not satisfied. ",
        "Reset DNS64 configuration",
        "7DD7DF3824D1BD7D92A8F6E964F507",
        "CR_F15C23121D56EB64CEDC9D19B9CBACBF5742596C0D8EF3BAB76E325DE01F06D6",
        "An enumerated integer indicating whether the route is administrator-defined (value=2), computed (via a routing protocol/algorithm, value=3) or the actual route implemented in the network (value=4). The default is a computed route.",
        "A brief description of the set.  May be an indirect string.  If it is an indirect string, then it may not be overwritten.",
        "Obtains the currently configured list of either Token Redirectable addresses or DNS Eligible addresses.",
        "CD_47A1D2A8BCF5F91E1526321DD0154B4FC3C4CAC8A7D6DF2C21F3DBE6A8700273.0.750296520.154",
        "CD_1EBAFD575878C70CE2D0C173ADE6E91E3E2B346C0148ED7DBBE48D6EBAD5CDDB.1153.770567269.1457",
        "RemotingError Flag",
        "{2e8d9ec5-a712-48c4-8ce0-631eb0c1cd65}",
        "NumericPassword",
        "Example: SYSTEM.",
        "WDigestAuthentication",
        "SPACES_StorageSubsystemToStorageEnclosure",
        "CtlGuidUMB",
        "Block Server",
        "MI_ERRORCATEGORY_WRITE_ERROR",
        "The PeakVirtualSize property specifies the maximum virtual address space the process has used at any one time. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. However, virtual space is finite, and by using too much, the process might limit its ability to load libraries.",
        "ModifiedAttributes",
        "The SupportsDiskQuotas property indicates whether this volume supports disk Quotas",
        "{BC4DD36C-FA66-4080-87A0-0C5922EB7887}",
        "{45fc997e-899d-11d2-819e-0000f875a064}",
        "In Use",
        "0xEFFF0038",
        "Win32API|Windows Networking Structures|NETRESOURCE",
        "HealthStatus",
        "iScsiFlagSockets",
        "Name of AD site used by the client",
        "output",
        "SecondsRemaining",
        "Upper Filters Count",
        "IsOffline",
        "CompatibleProduct",
        "{A605A67F-CE6E-44c7-AD55-E37332D888A6}",
        "AllowBasicAuthentication_Service",
        "UdpSegmentationOffloadHardwareCapabilities",
        "UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers",
        "queryinfo",
        "Extent",
        "IL_3C259524726051D7603A4BD17307563E6BEB326182791CA695BB2B6FEF3A682F.311.293400504.249",
        "Maximum time in milliseconds, that a Device can run in a \"Quiesced\" state. A Device\\'s state is defined in its Availability and AdditionalAvailability properties, where \"Quiesced\" is conveyed by the value 21. What occurs at the end of the time limit is device-specific. The Device may unquiesce, may offline or take other action. A value of 0 indicates that a Device can remain quiesced indefinitely.",
        "If TRUE dynamically discover boot device.",
        "RscStatistics",
        "CR_A5405992D9D674E902DFC53B45CA5EA7030AC30531ACB3BF91D0DF7BC783E1A4",
        "Logon Domain",
        "PowerAllocationLimit",
        "8922BC827}]",
        "The self-test routine was aborted by the host",
        "RSOP_PolmkrInternetSetting",
        "Values: TRUE or FALSE. A value of TRUE indicates the device is enabled for use.",
        "SupportsFileServerCreation",
        "Bid2Etw_ADOMD_1_Trace",
        "DomainNamesForEmailSync",
        "NS_68577372C66A7B20658487FBD959AA154EF54B5F935DCC5663E9228B44322805\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_AFB1F2A4391AB360C9692594F916CB837FC1E6CCCCC7C79E1D6F44A2E3986C3C13e071140CCD66EDC20B9C2CDF52F3C8373ACA9F966D80A43AD698A5BFCDF51549DD",
        "CR_1BEC388ED8B3DBC0D0D66BF6CA421BBFADBD5A16B9BFFBD5E8B6E83ED38EB253",
        "Relates a connection security rule to its Phase 2 Authentication Set.",
        "The most secure layer that is supported by the client will be used.If supported, TLS 1.0 will be used.",
        "The URL information for the product.",
        "The Delete method deletes an existing service. It returns an integer value of 0 if the service was successfully deleted, 1 if the request is not supported, and any other number to indicate an error.",
        "Get Single Policy Setting",
        "ProbableCauseDescription",
        "RSOP_RegistryValue",
        "scription",
        "Example: 10000000",
        "The temperature sensor for the package.",
        "PortableDeviceAPI_Automation",
        "SidTypeInvalid - Indicates an invalid SID.",
        "object:MSFT_Synchronized",
        "MSDOS",
        "{8502C577-5FBB-11D2-AAC1-006008C78BC7}",
        "Buffer Number with earliest TimeStamp for a Circular LogFile",
        "LockedDownInternetZoneAllowScriptlets",
        "The Module or RANK number of the memory error location",
        "Controller shall NOT supply Hsync during Vsync",
        "0x80000020",
        "Win32_WMISetting",
        "CIM_ControlledBy",
        "EnableAppInstallControl",
        "Sets the MBR signature of the disk. This parameter is only valid when the disk's PartitionStyle property is set to 1 - 'MBR'. An error will be returned if the disk is any other partition style.",
        "FWPUCLNT Trace Provider",
        "DEVPROPKEY",
        "Removing the configuration files.",
        "If a CIM service supports sequence identifiers for indications, this property shall be maintained by the CIM service for each registered listener destination, and its value shall uniquely identify the indication within the sequence context provided by SequenceContext. It shall start at 0 whenever the sequence context string changes. Otherwise, it shall be increased by 1 for every new indication to that listener destination, and it shall wrap to 0 when the value range is exceeded.",
        "object:ISCSI_LoginOptions",
        "Win32_WIN32_TSREMOTECONTROLSETTING_Prov",
        "WFP_TRACE_STM",
        "BootFlags",
        "C_F07924A860C6EA66C3DF17AE55C191EA3569D370A9FFFB4913667722B2AD2E22",
        "Allow Portal Hopping",
        "MakeFolderAvailableOfflineDisabled",
        "CD_6EE562F9CE34E3BB818812CE4284F5CF1EB787E76D4B158EA1D7F5687A628C0F.2442.4275905618.3083",
        "MSFT_Disk",
        "Attributes for file / directory",
        "ATAPI ZIP Drive boot is supported",
        "SCSI target is busy",
        "WdfCoreTraceGuid",
        "The web application url",
        "Saturation",
        "SendSafeSamples",
        "SystemRestore",
        "The total number of negotiation failures that occurred during main mode (also known as Phase I) or quick mode (also known as Phase II) negotiation.",
        "The DeviceSpecificPens property indicates the current number of device-specific pens.  0xffff means the device does not support pens. ",
        "MSFT_InitiatorPortToiSCSITarget",
        "LocalSecondId",
        "TRACINGERROR Flag",
        "C_E5D4D776B7B585D555547688115A6F8AC1380E1C8D52767A06A9776972F7BC0E",
        "SwEppReadCount",
        "GetQWORDValue",
        "The disk is offline.",
        "{994FF278-3512-4d9b-A241-54CEF45F5A25}",
        "CAThumbprint",
        "ple: ISA",
        "NumericSensorUpperThresholdFatal",
        "DisableFlipAheadFeature",
        "The ErrorMode property controls how the operating system handles several types of serious errors.  You can specify that the operating system handle these errors or that the application receives and handles them.  On some non-x86 processors, misaligned memory references cause an alignment fault exception.  The No_Alignment_Fault_Except flag lets you control whether the system automatically fixes such alignment faults or makes them visible to an application.  On a MIPS platform, an application must explicitly call SetErrorMode with the No_Alignment_Fault_Except flag to have the operating system automatically fix alignment faults.  The default setting is for the operating system to make alignment faults visible to an application.  Since the x86 platform does not make alignment faults visible to an application, the No_Alignment_Fault_Except flag will not make the operating system raise an alignment fault error even if the flag is not set.  The default state for ErrorMode is to set all flags to 0.  Defined values for this flag are are:",
        "CIM_PackageInChassis",
        "PS_Module",
        "R_5120F8DED242719988A9B53EE954218632D3A896BD93867D072F4224AC3F8FBA",
        "The frequency (in Hertz) at the high end of this powersupply's input frequency range 2. A value of zero implies DC.",
        "0x00000040",
        "WMI_TAPE_SYMBOLIC_NAME",
        "WmiMonitorConnectionParams",
        "{447956f9-a61b-11d0-8dd4-00c04fc3358c}",
        "RequireClientCertificate",
        "ClientAccessible",
        "WPDNSE_DLLREFCOUNT Flag",
        "{0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e99}",
        "I_BBA9D96E0F38BFCB6795F87F429E3FCAE741B083CE80ED2ED851A1D82E5F3717.313.1586896896.295",
        "C_9BD335E67BAE50C9848BEA0828D53089414BA43D5342FE18815FB3521F2F4CC6",
        "The detailed status of the rule, as a numeric error code.",
        "PowerPC Reference Platform",
        "MDM_Policy_Result01_Bitlocker02",
        "UseEct1",
        "{5ec10367-a61a-11d0-8dd4-00c04fc3358c}",
        "KEYBOARD_PORT_WMI_EXTENDED_ID",
        "ST506",
        "EncryptionAlgorithmsSupported",
        "PCI_BUS_ADDRESS",
        "SMBIOS|Type 4|Processor Information|Processor ID",
        "A boolean value that is set to TRUE if VMQ is enabled and FALSE if it is not.",
        "CR_BC8A5D3527D1BDCB19AA2B963526E673CF7D0B41B579C91C1089F6FC06405DFC",
        "{0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e97}",
        "CheckSignaturesOnDownloadedPrograms",
        "SystemConfig_V2_Processors",
        "Cipher plumbed in IPsec Policy",
        "CHAP authentication via RADIUS",
        "There is no target portal available to complete the login.",
        "Whether media sense logging is enabled or not.",
        "GetSupportedFileSystems",
        "UsernameSize",
        "Comma separated list of addresses, subnets, or ranges to update the keyword with",
        "Specifies whether or not integrity streams are enforced for this file.",
        "C_85F4FD558CEB2D53836A59CA16C7897C522A861DD40C1B575F3D3B0B10636B7E",
        "The SCSI LUN, matching the SCSI_ADDRESS",
        "IndicationIdentifier",
        "MSFT_NetAdapterPowerManagement_WakePattern_MagicPacket",
        "3\\%cG",
        "Pool Nonpaged Peak",
        "Publish_BCWebHashes",
        "MCA_WARNING_MEM_1_2_5",
        "Number of bytes received via ethernet port",
        "Forces the addition of the DNS servers for the given DNS Suffix.",
        "MIF.DMTF|UPS Battery|001.3",
        "I_6325C5C96DFD6B51FE5D97621FD65EC8FE5EA211AEF50ECB08E778B30E57BCAC.1018.3247761884.484",
        "TCP/IP TelNet",
        "Architecture",
        "Information has changed since the last call to HBA_RefreshInformation ",
        "MSFT_WmiCancelNotificationSink",
        "ReserveLocal",
        "{7b74299d-998f-4454-ad08-c5af28576d1b}",
        "To indicate whether the address family for this route is v4 or v6.",
        "{5ec1035e-a61a-11d0-8dd4-00c04fc3358c}",
        "The Win32_SystemAccount class represents a system account.  The system account is used by the operating system and by services that run under Windows NT.  There are many services and processes within NT that need the capability to logon internally (for example during a Windows NT installation).  The system account was designed for that purpose; it is an internal account, does not show up in User Manager, cannot be added to any groups, and cannot have user rights assigned to it.  On the other hand, the system account does show up on an NTFS volume in File Manager in the Permissions portion of the Security menu.  By default, the system account is granted full control to all files on an NTFS volume.  Here the system account has the same functional privileges as the administrator account.",
        "CDRAM",
        "Msft_WmiProvider_DeleteClassAsyncEvent_Pre",
        " 4 - Unknown",
        "issuerName",
        "An array of free-form strings providing more information on the ChassisTypes array entries. Note, each entry of this array is related to the entry in ChassisTypes that is located at the same index.",
        "TierClass",
        "AddSyncPair requires Synchronized mirror pair",
        "#endif",
        "MachineCertificate",
        "Write Total Errors",
        "This contains a MCA event",
        "The ProviderOperation_PutProperty property indicates the number of calls to IWbemPropertyProvider :: PutProperty.",
        "Total number of cases where an incoming packet is found eligible for coalescing",
        "Stack10",
        "The unique name of this service.",
        "SegmentGroupNumber",
        "LicenseServerName",
        "CR_A3CFA2EA2CF7EBAE83315F59909BFC6F8978ACBDBD24E7ACA6B979B7B86A9975",
        "The ArpAlwaysSourceRoute property indicates whether the Address Resolution Protocol (ARP) must always use source routing. ",
        "Allows a user to set a vendor specific usage for the new virtual disk object. This parameter can only be specified if the Usage parameter is set to 1 - 'Other'.",
        "LUAInstall: error 0x00000005 setting flags [{72BFEB11-2681-490D-874B-652FC1D75ED8}]",
        "C_E340FB8EB4DB3A4F1ED0804CB2A3406B4CA2DC92297E79DEEE6E8BA2BD0D28FC",
        "The StartService method places the Service in the started state. It returns an integer value of 0 if the Service was successfully started, 1 if the request is not supported and any other number to indicate an error. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are 'translated' may also be specified in the subclass as a Values array qualifier.",
        "{7F72CC7A-74A0-45b4-909C-14FB8186DD7E}",
        "C_E5C7C1FE3E6D7A2A16D7E74AFFD769F1A6084374257017AE4D85D9B4B8AA55D8",
        "SamPwdChng",
        "psScriptOrder",
        "{2e991575-c2ed-42a7-97ff-a0d6571f1862}",
        "16 - 'Supporting Entity in Error': indicates that this storage pool might be OK, but that another element, on which it is dependent, is in error. ",
        "LDAP Server",
        "HOSTPROC_TRACE_FUNCTION",
        "LCMCompatibleVersions",
        "Name of the object",
        "CIM_FileSystem.AvailableSpace ",
        "The design voltage of the battery in millivolts. If this attribute is not supported, enter 0.",
        "SecurityBreach",
        "Ndis80211DesiredRate",
        "FILE_READ_EA",
        "DirectConnectLicenseServers property is deprecated.",
        "Any color profiles associated with this driver.",
        "Defrag engine is already running",
        "MinorVersionNumber",
        "Retrieves the registration token value set earlier by the administrator.",
        "RemoteDynamicKeywordAddresses",
        "The CustomSurrogate property contains the name of the custom surrogate in which the in-process DCOM application is activated. If this value is NULL and the UseSurrogate key is TRUE, then the system provides a surrogate process.",
        "QPCreate performance counter missing",
        "ref:Win32_PageFileSetting",
        "LeaseTimeout",
        "The PelsHeight property indicates the height of the displayable surface.  (This property is not used for printers).",
        "WipingStatus",
        "C_29496EE13A50FC208C78C52B2E38D7EBB9517F3108A323CCB520DE03AFA2EB81",
        "TcpIp_TypeGroup4",
        "IpV6IPsecUnauthRateLimitBytesPerSec",
        "RefreshInformation",
        "{4D23FBD0-DB31-11d2-85FC-0000F8102E5F}",
        "Specifies a subcategory for this event. This subcategory is source specific.",
        "SELECT * FROM Win32_PowerMeterEvent",
        "Clears the specified event log, and optionally saves the current copy of the logfile to a backup file. The method returns an integer value that can be interpretted as follows: ",
        "NS_945DCC5B649BA9BD80D7373019A699C26DE93F09F11292BCFCCCD2685C53CAEE\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_D17C32F22586C7FF68377F9A82DA79BF8D54BB445B387B595E64C515CC034A7D",
        "See CIM_NumericSensor.SensorType for details.",
        "EVENT_TRACE_FLAG_USERCONTEXT",
        "WmiMonitorBrightnessEvent",
        "0E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "StoragePoolUniqueId",
        "TrustedSitesZoneAllowLessPrivilegedSites",
        "BaseProcessorNumber",
        "SupportMeasurement",
        "{9B81340B-E3D3-11d2-8601-0000F8102E5F}",
        "indicate two acceptable orders: A,C,B,D or C,A,B,D, ",
        "The neighbor associated with the IP interface",
        "The Win32_QuickFixEngineering dependent reference represents the Win32_QuickFixEngineering applied to the operating system in this association.",
        "R_3205C234B2D5F02B734949988492FBCD94159F50911E0F44A000D975CE1C5819",
        "C_78648B4777563867EAC1D3203AA282334AD332B4AED362C60F895FFE37CD52AD",
        "BcdProv",
        "CD_3E11F2867F2D534D95C0593A0AA32ECA612C606596AA91228C49611E4A1C3BBE.1223.1.17156",
        "SidTypeWellKnownGroup",
        "FallbackUnsecure",
        "KeyProtectorType",
        "AuditLogLocation",
        "NewDll Base Address",
        "IpV6FilterExemptDscp",
        "MSFT_ResiliencySetting.NumberOfGroupsDefault",
        "Locale of the node running the configuration.",
        "DereferenceObject",
        "Inactive",
        "Flag indicating whether the template is enabled for the current user.",
        "ConfigurationName",
        "PLATFORM_TRACE_RESERVED_19 Flag",
        "3 - 'Snapshot': The disk is a snapshot disk. ",
        "Digits",
        "Saturday",
        "C_0A7ABE63F36E2B2920FEDAFAE849823AF9429CC0EA373FFEE1507EDB21FD9170",
        "IpAddresses",
        "The name of this registered specification. Since multiple versions can exist for the same RegisteredName, the combination of RegisteredName, RegisteredOrganization, and RegisteredVersion shall uniquely identify the registered specification within the scope of the organization. ",
        "LoadPercentage",
        "6      The boot configuration for this device conflicts with other devices. ",
        "Represents the prefix policy for Microsoft TCPIP WMIv2 provider.",
        "\\\\.\\root\\msdtc:__Win32Provider.Name=\"MsDtcWmi\"",
        "e2432A5ABBE7173FA98223D70B4EDFB312E0AA87F456103A25E4B4191AB55FA02",
        "CD_C11E0B2968F07899C3C15A08181C55EA86BBBF2FCDF1D89855EC8855E08BA914.1750.1455055579.992",
        "This method will uninstall the associated instance of Win32_Product. The method can return the following values:",
        "Storage Device Failure Prediction Thresholds",
        "Specifies how many physical disk failures the virtual disk should be able to withstand before data loss occurs.",
        "RSOP_PolmkrPowerOptionsV2Setting",
        "Mode Based Execution Control",
        "The Win32_DisplayControllerConfiguration class represents the video adapter configuration information of a Win32 system.  This class has been deprecated in favor of Win32_VideoController, Win32_DesktopMonitor, and CIM_VideoControllerResolution classes",
        "This method allows the storage tier's description to be changed.",
        "C_936D541CD85969DF0CC7874005A3CA167B065E798E6CB9B3817781424E973EAA",
        "Even parity",
        "Record Number",
        "<\"m;<\"m;",
        "C8CE7",
        "C_7010B213179D98B16AF38723EE1D750E86F808F341EE215AD8783D29EA117262",
        "FileExtensions",
        "CIM_ExtraCapacityGroup",
        "L2GPStoreGuid",
        "{01ac07a2-2064-11d4-97eb-00c04f79c403}",
        "timeOutValue",
        "IL_2515B1950A64510A509CF61C80D68865E7CFF544688645F2490CFFE0E6C807F2.297.668444964.338",
        "The MaximumOutputBufferSize property indicates the maximum output buffer size (in bytes)",
        "CI_FD1C1D414B71B5082C266A650E31EF6D5019382724244B685F217C0AAE00A921",
        "C_1990BA6B868083E5BDD438C1C9438F9F7D36FE1A112C7FDBF6648416023E84DA",
        "Video standard type",
        "The CurrentUsage property indicates the amount of disk space currently used by the page file.",
        "RLIRBufferSize",
        "SuspendJobByPrinterObject",
        "OSAutoDiscovered",
        "Total number of blocks (including the check data blocks) contained in this aggregate physical extent.  The block size (an inherited property) should be set to the same value as for the media access device associated with this extent.",
        "MSFT_PrinterProperty",
        "HTML Editor HKLM Registry Data",
        "LocalFilePath",
        "NoOfUCRs",
        "C_CE60FD48B8554305653B63F3FF89DE9F487AA367010DE6A864E4D5A7550F953A",
        "UpgradeCode",
        "Not Specified",
        "GroupMask3",
        "NS_892F8DB69C4EDFBC68165C91087B7A08323F6CE5B5EF342C0F93E02A0590BFC4\\KI_CFF41370C70E26A169C5F7CC5594050646C5B9BC0F0D1F0FC4733FA2AA35939C\\I_BAC3F6A6A35DD56CC51CAD0BAF325F0D287989C281F534A9DBB76FD59710B3DE81a2",
        "LinkSpeed",
        "Enables the specified error source",
        "Library Loader BaseAddress Event",
        "Indicates if Interrupt moderation is supported per VPort",
        "{86522023-4536-4b58-a1f4-2538941ace43}",
        "C_E8A8D6B4FC24D90ADB5A9D008E4FC2860257836A2DC3482FE5576FCC1546870D",
        "Parameter out of bounds",
        "VpnKeywords",
        "{8502C4B8-5FBB-11D2-AAC1-006008C78BC7}",
        "Time Written",
        "AutoNumberOfColumns",
        "Monitor's listed supported frequency ranges",
        "R_316028CB4766215C2B0D3643DCC0FC70FE66BE560FA2335CAFFF2477CB4C6F30",
        "Outbound",
        "MSNdis_PMCapabilityState",
        "MIF.DMTF|Temperature Probe|001.8",
        "DisallowStartOnRemoteAppSession",
        "Map service to app domain",
        "CIM_Processor.CurrentClockSpeed",
        "Determines the behavior for source routed packets. Per RFC 5095 support for forwarding of source routed IPv6 packets has been removed, and the setting forward now has the same effect as dontforward.",
        "SchedulingPriority",
        "Returns a Boolean value that indicates whether queue addresses should be converted using Active Directory.",
        "DesktopImageUrl",
        "SupportedStatistics",
        "MSTapeDriver",
        "TM_BWC Flag",
        "Data type of value, which corresponds to registry value types such as REG_SZ.",
        "per inch",
        "CD_02E226BBCB88A35C58DB3E55C3D201306E2FAABE9C83D64654DC4E16660DF61A.70.2831678191.629",
        "The LocalServerPath property, if applicable, defines the server localserver32 executable application name.",
        "MSFT_DSCMethodInvoked",
        "ScriptFile",
        "Unauthorized Access",
        "RenameItemEx",
        "This method will configure the associated instance of SoftwareFeature to the specified install state.",
        "MobileOperatorDisplayName",
        "Describes an instance in time as returned by Win32ClockProvider.  When a query is submitted to the Win32UTCClockProvider, the results are returned as Win32_UTCTime objects with times matching the query.  These are returned as part of __InstanceModificationEvents",
        "Protection Path Failure",
        "Register File",
        "The QuotaPagedPoolUsage property indicates the quota amount of paged pool usage for the process./nExample: 22",
        "Win2000DDK|KernelModeDrivers|STORAGE_DEVICE_DESCRIPTOR|ProductRevisionOffset",
        "SoftwareElementName",
        "KdcAddress",
        "{8502C4DB-5FBB-11D2-AAC1-006008C78BC7}",
        "Support Interval Timeouts",
        "SupportsAutomaticStoragePoolSelection",
        "{62134E43-6FC4-40CA-8DF8-D488C715D908}",
        "The card that includes or 'contains' memory.",
        "ForceInboundConnections",
        "Web download manager class inheriting from OMI_ConfigurationDownloadManager",
        "IL_A944F785A51BBDA87CAE1C427827906080841BCF187F56E21654E9005CF78E7A.2694.37616635.273",
        " This property has been deprecated because it is not applicable to printers.  There is no replacement value.",
        "EventNamespace",
        "The NumberOfCores property contains a Processor's total number of cores. e.g dual core machine will have NumberOfCores = 2.",
        "CIM_MagnetoOpticalDrive",
        "SecondaryWinsServer",
        "StereoModeType",
        "The ServiceType parameter passes the type of services provided to processes that call them.",
        "object:MSFT_NetAdapter",
        "Enabled",
        "VerifyHealthMethod",
        "Description of the partial configuration",
        "CD_41DBF5B1870AF9F0B77D7680767E231A2460610113F21236505A5E4A30EFFCA6.1155.3640459074.813",
        "IPXMediaType",
        "A concrete version of Job. This class represents a generic and instantiable unit of work, such as a batch or a print job.",
        "Unchanged",
        "Resolution indicates the ability of the Sensor to resolve differences in the measured property. The units for this measurement are determined by BaseUnit*UnitModifier/RateUnit.",
        "CD_D3E87AC2C5095799D67D44AE7591A2749E7365471471AF9E1AB7656018268D5D.1748.2980534113.4304",
        "The types of physical media that the network adapter supports",
        "LocalConfigurationManager",
        "R_3AE6AE4FC05317EACD52C3BD668C58CE614118C1241AE4CE2FC6907C9BF86C84.1020.4186970821.524",
        "WPD_Install Flag",
        "Number of transmitted multicast frames",
        "select * from WSP_FsStorageDepartureEvent",
        "MSDART.1",
        "C_3E93490AD7E19BA9FBA51E3DC8E6582CA6AAC992C61FC9D54D14390E9939C366",
        "DnsSecEnabled",
        "If true, add the Administrator group to roaming user profiles.",
        "HideRecentJumplists",
        "Whether to enable stateful FTP.",
        "The file system owned by the computer system.",
        "Win32Registry|SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters|ArpUseEtherSNAP",
        "List of resources affected by the detection",
        "Win32Registry|System\\CurrentControlSet\\Services|Parameters|SubnetMask",
        "Image_V0",
        "CIM_RecordForLog.RecordFormat",
        "CtlGuidWPDShServiceObj",
        "The host name or IP address of the SourceInstance.",
        "agementServiceMachineIpAddress",
        " Specifies the per-process user-mode execution time limit, in 100 nanoseconds. It is ignored unless LimitFlags specifies Limit Process Time.The system periodically checks to determine whether each process associated with the job has accumulated more user-mode time than the set limit. If it has, the process is terminated. ",
        "The return code should be 0 if the request was successfully executed, 1 if the request is not supported and some other value if an error occurred. In a subclass, the set of possible return codes could be specified, using a ValueMap qualifier on the method. The strings to which the ValueMap contents are \\'translated\\' may also be specified in the subclass as a Values array qualifier.",
        "CD_9E152E3E3D8A2665C8A4533F9A4E67D0D1AAA1D8B83D4A80BEDF2999A2CA16CE.2070.822292662.2427",
        "HNet_ConnectionIcmpSetting",
        "ROOT\\StandardCimV2\\MS_409",
        "Current Temperature",
        "The process ID of a particular application for the BidTrace configuration. This is ignored for Mode != 1.",
        "AllowUserApps",
        "The Win32_SID of the trustee for this audit entry",
        "MMCSS Events",
        "VPath",
        "ClassificationAtDpcSupported",
        "Win32_RegistryAction",
        "TR_WIZ",
        "Reset To Adaptive",
        "E2507D6CDC84407FB8AEAA1.1475.661856827.233",
        "This method upgrades the version of the storage pool.",
        "Constraints: Must have a value.",
        "Query TCP Connection Offload Hardware Configuration",
        "Only data sent from client to server is protected by encryption based on server's standard key strength. Data sent from Server to client is not protected.",
        "CR_4B66FACE2F9688020890084420324926AA3CF21932AD39E8C9ACEA5209F73583",
        "R_E2929E24A4D3F33074BBFC9EB2E285BE087B76057F553B22FB5CA19B172B3C4A",
        "LogDataStart",
        "CD_95FB3FABFA971E67BBC725545D4CD1F75233F0599BB8B29A944361BD82FEDE56.198.2958685315.4587",
        "PPR1Allowed",
        "I_0B8BF58309BF9E34389F1C832AE582473CA071ADFAE618E784E2A5B7F73FBBED.2722.1238422130.288",
        "Interrupt Moderation Parameters to set",
        "59F3C7EA026EB96DBC471703C7B38EF25FC1D9.1604.1009104264.2323",
        "ClientRealm",
        "IPv6Connectivity",
        "Status Duplicate Name",
        "Win32_ShadowFor",
        "This method removes one or more initiator ids from the masking set. Note that the initiator id instances themselves should not be deleted from the system.",
        "\\\\.\\root\\StandardCimV2:__Win32Provider.Name=\"MSFT_Printer\"",
        "NDIS 802.11 WEP Status setting",
        "Deprecated description: ProtocolType is an enumeration that provides information to categorize and classify different instances of this class. For most instances, information in this enumeration and the definition of the subclass overlap. However, there are several cases where a specific subclass of ProtocolEndpoint is not required (for example, there is no Fibre Channel subclass of ProtocolEndpoint). Therefore, this property is needed to define the type of Endpoint.",
        "FieldByteArrayValue",
        "The Win32_VolumeQuota association relates a volume to the per volume quota settings.",
        "MaxRechargeTime indicates the maximum time, in minutes, to fully charge the battery. This property represents the time to recharge a fully depleted battery, not the current remaining charging time, which is indicated in the TimeToFullCharge property. ",
        "The Element reference represents the COM class where the settings are applied.",
        "Account Disabled",
        "Indicates whether the pipe is bi-directional (value = 2), unidirectional (value = 3), or this information is not known (value = 0). For unidirectional pipes, the source and sink are indicated by a property (SourceOrSink) of the association, EndpointOfNetworkPipe.",
        "Indicates whether the physical disk is physically connected to this storage node.",
        "MSFT_NetGPO",
        "WakeReleaseExecution",
        "ChangeSecurityPermissions",
        "WMIEventProv",
        "IL_EEC4121F2A07B61ABA16414812AA9AFC39AB0A136360A5ACE2240DC19B0464EB.1499.3789313510.368",
        "SubmitSamplesConsent",
        "RD_TRACE_RESERVED_11",
        "ViewSize",
        "ErrorMethodology is a free-form string describing the type of error detection and correction supported by this storage extent.",
        "The address of the NIC encoded in the hardware.",
        "The SetDatabasePath method sets the path to the standard Internet database files (HOSTS, LMHOSTS, NETWORKS, PROTOCOLS). It is used by the Windows Sockets interface. The method returns an integer value of 0 on successful completion, and any other number to indicate an error. Default: %SystemRoot%\\system32\\drivers\\etc.",
        "Size in bytes of the blocks which form this storage extent. If unknown or if a block concept is not valid (for example, for aggregate extents, memory or logical disks), enter a 1.",
        "DoActionLogging",
        "CD_7E470595B07CCACED12AF52AF9B26E1DC367DE0F25EDA25E0FC74FECC24A888A.1172.3962771221.271",
        "HwEcpWriteCount",
        "CIM_JobDestinationJobs",
        "The RemotePath property contains the full path to the network resource.",
        "Example: Copies=2",
        "Maximum total length that can be referenced by all SGEs in a single send, receive, read, or write request",
        "ref:Win32_UserAccount",
        "ThermalStamp",
        "ISCSI_ERR_ISCSI_PDU_REJECTED",
        "The Win32_InstalledStoreProgram class represents an installed store application.",
        "NumberOfProcessorThreads",
        "ref:MSFT_StorageReliabilityCounter",
        "Win32_OfflineFilesUserConfiguration",
        "{146360a9-88dd-11dd-94b8-001d09162bc3}",
        "The SMBIOSAssetTag property indicates the asset tag number of the system enclosure.",
        "ChipType",
        "C_18D8719A943B4599747ADA74EA7D32C69D833172BB0F49178849B0570759A4F9",
        "R_B62B59E86E07741341079FA1421457C8D2F2E61FE1E29EC64686B7A4663C4D75.2459.1414166320.554",
        "DeleteElement",
        "LocalUsers",
        "Instances of the CliFormat class represent a display strategy for the alias. The display strategy consists of a list of properties to be displayed together with aformat (represented by an XSL style sheet) to be used indisplaying them",
        "Retrieves one or more ODBC DSNs from the system.",
        "Number of times correction algorithm was processed for read",
        "NS_B5EC8ADF96E5E6064AD9EB0B1370FDBD664E0B0E7802B6A2A5796B5FAF22AFEE\\KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C\\I_30485B836AA5A6FD10A8644930D90B38AA35B211E21BF4839647DE43EFA8F75102df",
        "Maximum VSync denominator",
        "This method gets the tier information for pinned files.",
        "Specifies that EAP-MSCHAPv2 should be used as the authentication method, and Windows logon credentials should be used automatically when connecting with the VPN connection profile.",
        "MSiSCSIInitiatorProvider",
        "{8c7980e1-f62b-419e-aa82-276c8d064a1f}",
        "The number of Virtual Functions that can be allocated on the switch",
        "MSFT_NetIKECryptoSet",
        "Repetition",
        "NewCpuPriorityFloor",
        "Uninterruptible power supply (UPS) management. ",
        "{f7a4960a-ace3-44dc-b51e-72e05c5eafa8}",
        "BlockDiskModificationOnly",
        "ProductKeyID2",
        "SetInfo",
        "{956597A3-7D80-11D2-AAD3-006008C78BC7}",
        "No Access",
        "Standard Pointer",
        "6 = Removed due to transform conflict, ",
        "actionValues",
        "Is Enabled",
        "MGR_TRACE_RESERVED_1a Flag",
        "The PartComponent reference represents theWin32_Service containing the service that exists on the computer system.",
        "ConnectWhenNotBroadcasting",
        "Load reason",
        "SmartCapability",
        "ref:Win32_ClassicCOMClass",
        "{485e7dee-0a80-11d8-ad15-505054503030}",
        "29 - CIM_ERR_QUERY_FEATURE_NOT_SUPPORTED. The specified Query Feature is not supported.",
        "deleteAdminCreatedFavoritesOnly",
        "CD_E9D1340FA30260FE6DC9A13A7C426F447F5CFE8119285A157042BB8CB324B46E.1731.1.11991",
        "MaxPendingChannels",
        "CD_99987ACE788FDA6044200C5CAD36E8FBA4C6DFACC2585158E6C31C93918E7DB8.1749.457719459.622",
        "The ShowWindowCommand can be any of the SW_ constants defined in WINUSER.H.",
        "Boolean indicating whether the operating system is distributed across several computer system nodes. If so, these nodes should be grouped as a cluster.",
        "Indicates if KMS is enabled on the computer: 1 if true, 0 if false.",
        "LPC_TRACE_PORT Flag",
        "CR_8CFD3BDCF459E28A190CCF46FF43F533DE3394389F988133FD28EA5A0AEA1616",
        "C_DFCE5B8EEFC1AF231A170E8413130AF6AA4A71FD22AC6E352C7DBF46462589FC",
        "MinLifetimeSeconds",
        "MaxCqCount",
        "This class exposes product-specific properties and methods of the Software Licensing service.",
        "Values: TRUE or FALSE. A value of TRUE indicates the number of concurrent users of this resource has not been limited and the value in the MaximumAllowed property is ignored.",
        "The platform architecture of the ODBC Connection Pooling PerfMon counters. Possible values are '32-bit', '64-bit' or 'All'. The default is '32-bit' on a 32-bit process and '64-bit' on a 64-bit process. This is the platform architecture on the remote machine if this command is executed on a remote CIM session.",
        "Within the scope of the instantiating Namespace, InstanceID opaquely and uniquely identifies an instance of this class. In order to ensure uniqueness within the NameSpace, the value of InstanceID shall be constructed using the following 'preferred' algorithm: ",
        "This field is an array of custom identifier for the subsystem. If this field is set, the OtherIdentifyingInfoDescription field must also be set.",
        "The SetTcpMaxDataRetransmissions method is used to set the  number of times TCP will retransmit an individual data segment before aborting the connection. The retransmission timeout doubles with each successive retransmission on a connection.The method returns an integer value that can be interpretted as follows: ",
        "Win32_TSPermissionsSetting",
        "Message Number",
        "CD_49358D38287F930E1B9B4F03B6EAC81CD41EBFE0283F257F89AEA8AE3D4D8465.1190.2780080177.612",
        "R_5F4AA329CE28ACB351FC6ED10B24538C59741D24DCE7E4F79448CF1ED4DE3BED.276.754342863.520",
        "Win32APIDevice Management Messages|WM_DEVICECHANGE|wParam",
        "CIM|Win32_SCSIController",
        "80486",
        "NDISWMI_TRACE_CHKSUM",
        "Specifies one or more WSD host addresses to be written to the tag.",
        "The IPXVirtualNetNumber property uniquely identifies the computer system on the network. It is represented in the form of an eight-character hexadecimal digit. Windows NT/2000 uses the virtual network number (also known as an internal network number) for internal routing.",
        " The value of this property is the manufacturer's identifier for this software element. Often this will be a stock keeping unit (SKU) or a part number.",
        "Impact Moving Head Dot Matrix 24pin",
        "WPDShServiceObj_f1 Flag",
        "NdisRingStateRingFailure",
        "The WorkOffline property indicates whether to queue print jobs on the computer if the printer is offline.",
        "IntranetZoneAllowSmartScreenIE",
        "{5CE27CDE-D179-4c68-937F-A07B8CC2EA39}",
        "IsConnected",
        "0xEFFF0035",
        "LocalSystemHost:UmpoWmi",
        "InprocHandler",
        "TARGET_ID",
        "C_71926B9951B4E8AFC04CC2F1AC5B5FEC04E9A08320F8B28164D32D905C0A41AC",
        "UMS Directed Switch - Start",
        "CD_9DC0A5652B71803D627A0DEBBA10D1832C8C71C7B53C3FDE13C8544A09726631.1538.3265819325.2941",
        "A boolean indicating whether the NetworkAdapter is capable of automatically determining the speed or other communications characteristics of the attached network media.",
        "TRC_FATAL",
        "RetireMissingPhysicalDisks",
        "SubQueue",
        "{94335eb3-79ea-44d5-8ea9-306f49b3a040}",
        "The higher level storage extent.",
        "{0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9b}",
        "Error code if cleaning action failed",
        "RSOP_RegistryKey",
        "MaxLifetimeSessions",
        "// This class must be registered with PDO instance names",
        "cription",
        "2AEE1C523572B9C00CB53A36167EDA3CA812EECDDE0",
        "ConfigureWindowsPasswords",
        "CD_ED68C5D9F6B69094D35F0FE61D30082A4B839307A54E9EAB1C21A62829FFFE84.1543.3943487010.525",
        "Win32API|Network Management Structures|USER_INFO|UF_ACCOUNTDISABLE",
        "// host to another.",
        "Services",
        "ScheduleRestartWarning",
        "StartBuffers",
        "KI_E083376FF2F9C4C523A988C92531F9188F5D2764166BDDDE013F24CC5899E85C",
        "CD_D4D7929A8312A6DC45326BF70047842109EC7C6FE50B4DFC14E0212EF111A093.1757.3912881443.597",
        "bit / second",
        "CD_8F21C89CAF771FFCC47E28C59A7D76DBF0F63931FC16518B322428129F505FDF.1465.1744315508.465",
        "MSNdis_PMCapabilitiesParam",
        "Floating point register",
        "Win32_BaseBoard",
        "RSOP_PolmkrLocalGroupsSetting",
        "PortImplementsEndpoint associates a LogicalPort with one or more ProtocolEndpoints that are implemented on it. This class specializes the DeviceSAPImplementation association. It indicates that the referenced Endpoint is dependent on the operations of the Port Device.",
        "IL_2797AA0512B80E7E1C1A6BA2AC1D2A5EAB929047EBF4944B5812DE3C32DEE06C.313.3654328068.299",
        "IPv4 Only",
        "SCSI Controller",
        "Supplies the setting for D0 Packet Coalescing on the adapter.",
        "Win32API|Performance Data Structures|PERF_OBJECT_TYPE|PerfPriorityBase",
        "Example: 0.",
        "CD_E991E45745117956DEAFF1C67CF04DB972E8AC05E236ED8130C434E25D63E63D.1836.716013129.435",
        "iSCSI Eventlog generation event",
        "MSFT_DtcTask",
        "STATISTICS",
        "66 - Invalid subnet mask",
        "Preshared Key Cache",
        "QuickModeFilterId",
        "SeparateSyncsSupported",
        "MDM_RemoteAppUserCookie",
        "CD_9E784A36A3818CCEF710DDD5C36D397926DEF1DD3DBF75F107C211B75FEBAA90.2217.1.8451",
        "The CIM_StorageDefect aggregation collects the storage errors for a storage extent.",
        "VolumeScrubEnabled",
        "ApplyAndMonitor",
        "C:\\Windows\\system32\\en-US\\kernelbase.dll.mui[MofResourceName]",
        "C_B1D75A909E6CF2DABA2DE9D5B0D2A805DDF2E38027D332B19EBFB8BA7F770899",
        "Specifies the earliest time at which the printer will print a job, expressed as minutes elapsed since 12:00 AM GMT (Greenwich Mean Time).",
        "CIM_SoftwareFeatureSoftwareElements",
        "C_A67F6CA5AD0F3F082B7328E37F2535113EC93F9273483374AD4B41FB5A9EBA2D",
        "Example: C:\\WINNT\\INF.",
        "Memory Chip information",
        "A string that uniquely identifies this instance within the PolicyStore.",
        "The PolicyRoles property represents the roles associated with a PolicySet. All contained PolicySet instances inherit the values of the PolicyRoles of the aggregating PolicySet but the values are not copied. A contained PolicySet instance may, however, add additional PolicyRoles to those it inherits from its aggregating PolicySet(s). Each value in PolicyRoles multi-valued property represents a role for which the PolicySet applies, i.e., the PolicySet should be used by any enforcement point that assumes any of the listed PolicyRoles values. ",
        "Instance not found",
        "CD_48B29E9AE4FFC8EF806EFE0B21B81E1AD49B510512EB4535634C1F796E081ABA.72.1024667953.915",
        "8 - Single User ",
        "SPI contains the Security Parameter Index of the SA. This value in string form may also be used in the key field \\'Name\\' inherited from ServiceAccessPoint.",
        "r second",
        "The Model Path of the SourceInstance. The following format MUST be used to encode the Model Path: ",
        "EconomicalAdminPinningEnabled",
        "The Win32_COMSetting class represents the settings associated with a COM component or COM application.",
        "Indicates whether DMA may execute in 'count by byte' mode (value=4) or not (value=3).  Also, \"Other\" (1) and \"Unknown\" (2) may be defined.",
        "Installed Operating System/s management. ",
        "SECHC_LOG_FLAG_ASSERT",
        "33327316324B2A6D9D506A6.2120.2084505154.188",
        "MSFT_TaskTimeTrigger",
        "Removing Application",
        "Compartment globally unique identifier.",
        "CD_884D60D0DBFE6460D83079FECA71E009FB88E0ACAA9538FA4A82F908C79947A6.2116.3749599012.1207",
        "CurrentScanMode",
        "Unique ID.",
        "Cannot determine the file system of the drive",
        "Values: TRUE or FALSE. If TRUE, transmission continues after the input buffer has come within XoffLim bytes of being full and the driver has transmitted the XoffChar character to stop receiving bytes. If FALSE, transmission does not continue until the input buffer is within XonLim bytes of being empty and the driver has transmitted the XonChar character to resume reception.",
        "ProductID",
        "EnterpriseProxyServersAreAuthoritative",
        "Select * from WIN32_SoundDevice",
        "Maximum File Size in MBytes",
        "Win32_API|Windows Sockets Structures|PROTOCOL_INFO|dwServiceFlags|XP1_CONNECTIONLESS",
        "CertificateThumbprint",
        "UUUUUUUUUUUUUUUUU",
        "C_9AB53806E88665C047824D5369B271C53B233BBEAC7C15BE3BA9BD214E527500",
        "Total number of files on the volume.",
        "DisallowNotificationMirroring",
        "Recommended",
        "SystemFamily",
        "Encryption",
        "Ndis80211TransmitPowerLevel",
        "CIM_SAAction",
        "ComputerStateNotifications",
        "UserDataStripeDepth",
        "select * from WMIEvent",
        "The Rename() allows for the renaming of the user account name; a key in this class. The functionality to change the key property \"Name\" is implemented as a method to provide a separate context for the new name distinguishable from the key name associated ",
        "Win32Registry|HardwareInformation.",
        "Type of the capture - Physical, VMSwitch or Both",
        "FileIo_V2_ReadWrite",
        "VESA DPMS Suspend support",
        "SettingsImportNotifyEnabled",
        "IL_AF40BBBDE0B04254A7DB7168AD8BD4619F792348A29FDE87570C9FC2F908731C.290.1157322922.282",
        "Specifies the total number of processes currently associated with the job. When a process is associated with a job, but the association fails because of a limit violation, this value is temporarily incremented. When the terminated process exits and all references to the process are released, this value is decremented. ",
        "Initiator failed to configure IPSec for the given connection. This could be because of low resources.",
        "CurrentTimeZone indicates the number of minutes the operating system is offset from Greenwich Mean Time. Either the number is positive, negative or zero.",
        "OSEnabledState",
        "Example: TEXT",
        "VolumeType",
        "Debug_Only_This_Process",
        "IP Address of node at time of configuration.",
        "Maintenance",
        "inition",
        "Filters traffic based on the type of interface it is sent or received on.",
        "Get the version of a settings package.",
        "WPD_TRACE_LEVEL_RESERVED Flag",
        "The path to the installed software element. If the component is a registry key,the registry roots are represented numerically. For example, a registry path of \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\" would be returned as \"01:\\SOFTWARE\\Microsoft\". The registry roots returned are defined as follows:RootReturned Value",
        "GetTSRedirectorMode indicates whether the server is configured to be a Redirector or not.",
        "WriteTotalErrors",
        "CD_02E158B45830B6D4377ECD1CD643B18552229BB1DFCB48A9FF9F91F3ACA3AD62.312.138204832.340",
        "The Win32_SystemServices class represents an association between a computer system and a service program that exists on the system.",
        "Specifies a reference file from a previous execution",
        "Manual",
        "The InterrogateService method requests that the service update its state to the service manager. It returns one of the following integer values:",
        "MSNT_FileBaseTrace_Set1",
        "User not found",
        "Sets security descriptor to the specified structure. ",
        "0xC000000A",
        "PCI-X Mode1 ECC 100MHz",
        "TcpIp_V1_Send",
        "Win32_PnPDevicePropertyUint16Array",
        "CIM::Network::Routes",
        "CIM_SecurityAssociationEndpoint.LifetimeKilobytes",
        "An array of USB 'alternate settings' for each interface in the currently selected configuration (indicated by the CurrentConfigValue property). This array has one entry for each interface in the configuration. If the property, CurrentConfigValue, is zero (indicating the Device is not configured), the array is undefined. To understand how to parse this octet string, refer to the USB Specification.",
        "Used 20 Calling Method",
        "Threshold Crossed",
        "{28c9f48f-d244-45a8-842f-dc9fbc9b6e94}",
        "LowThreatDefaultAction",
        "Msft_WmiProvider_GetObjectAsyncEvent_Pre",
        "Maximum",
        "SPACES_StorageNode",
        "{981f2d84-b1f3-11d0-8dd7-00c04fc3358c}",
        "The StandardMinute property specifies the minute of the StandardDay when the transition from daylight savings time to standard time occurs on this operating system.",
        "DisableCustomerExperienceImprovementProgramParticipation",
        "C_FD27ECDAAA7D6C49E1565C286F03227F09CFD14146B494ADDE67CAC27EC54A8B",
        "0x00010000",
        "CD_335C9D1C30BF96E7BC1FFA98ECADFD675A3EA69829813F59062A99C13DC71866.1193.3041454891.248",
        "The InterrogateService method requests that the service update its state to the service manager. It returns an integer value of 0 if the InterrogateService request was accepted, 1 if the request is not supported, and any other number to indicate an error.",
        "MSSerial_HardwareConfiguration",
        "A Security Descriptor Definition Language (SDDL) formed string describing the access control list of the object.",
        "If  the transition day StandardDayOfWeek  occurs on a Sunday, then thevalue 1 denotes the first Sunday of the StandardMonth, 2 denotes the secondSunday, and so forth, and 5 denotes the last Sunday of the StandardMonth.",
        "The indication of the capacity remaining in the UPS' batteries, generator, ...  A value of \"Normal\" (2) indicates that the remaining estimated minutes of run-time is greater than the UPS' defined 'low power' state (typically two minutes). A value of \"Low\" (3) indicates that the remaining estimated minutes of run-time is less than or equal to the UPS' defined 'low power' state.  A value of \"Depleted\" (4) indicates that the UPS will be unable to sustain the present load when and if the utility power is lost (including the possibility that the utility power is currently absent).",
        "The FullName property indicates the full name of the local user.",
        "GetVersion",
        "ReKeys",
        "NdisPMAdminConfigUnsupported",
        "CD_AA0B4A55EEE4C1E476A0BDD0D3A0653497872B02CC12BE52258AE7DCEF46F38E.1219.1069400742.350",
        "HOSTPROC_TRACE_DDI Flag",
        "Win32_SIDandAttributes",
        "Reserved for ComputerSystem (the block server)",
        "TM_FSM",
        "VolumeUserQuota",
        "VirtualComponentsAllowList",
        "The TcpNumConnections property indicates the maximum number of connections that TCP can have open simultaneously. ",
        "\"FC\" has been deprecated and replaced by \"WWN\" to be consistent with the other ValueMaps.",
        "This method adds one or more physical disks from the primordial storage pool to an existing concrete storage pool.",
        "UUUUUUUUUU",
        "{69D76D1B-B12E-4913-8F48-671B90195A2B}",
        "Win32API|Service Functions|ControlService|dwControl|SERVICE_CONTROL_CONTINUE",
        "In order to use the SSLCertificateSHA1Hash WMI property, you mustfirst find the hexadecimal Thumbprint value for the certificatethat you want to set the target server to use.  The thumbprintof a certificate may be found using the Certificates MMC snap-in.In the Certificates snap-in open the properties page of thecertificate and go to the Details tab.",
        "Values: TRUE or FALSE. If TRUE, the logical disk supports file based compression.",
        "CD_4D4CE956D39D51456603D4ED1BF7ABAD64E72F02B0D569299B434D13F41AD4C4.32.708442167.1664",
        "Administrative Template File",
        "Indicates the specific power-related capabilities of a computer system and its associated running operating system. The values, 0=\"Unknown\", 1=\"Not Supported\", and 2=\"Disabled\" are self-explanatory. The value, 3=\"Enabled\" indicates that the power management features are currently enabled but the exact feature set is unknown or the information is unavailable. \"Power Saving Modes Entered Automatically\" (4) describes that a system can change its power state based on usage or other criteria. \"Power State Settable\" (5) indicates that the SetPowerState method is supported. \"Power Cycling Supported\" (6) indicates that the SetPowerState method can be invoked with the PowerState parameter set to 5 (\"Power Cycle\"). \"Timed Power On Supported\" (7) indicates that the SetPowerState method can be invoked with the PowerState parameter set to 5 (\"Power Cycle\") and the Time parameter set to a specific date and time, or interval, for power-on.",
        "Idle state type per ACPI {1=C1, 2=C2, 3=C3, 4=C4, ...}",
        "{4A97ED30-BFAA-491a-9DFD-B43ADEDBF8E3}",
        "The ExitCode property specifies a error code defining any problems encountered in starting or stopping the service. This property is set to ERROR_SERVICE_SPECIFIC_ERROR (1066) when the error is unique to the service represented by this class, and information about the error is available in the ServiceSpecificExitCode member. The service sets this value to NO_ERROR when running, and again upon normal termination.",
        "CD_5F36D1944A2418B5A351C20BD9C1B5E3BF64E7FA512D227A09AA6978A5B805AC.0.3390574330.287",
        "Copy In Progress",
        "RSSPlatformTraceProvider",
        "UserPassword",
        "DoNotPreserveZoneInformation",
        "Api Flag",
        "Autologger session configuration class.",
        "C_94167BF91BE19E1C62EEDAB062E1BD60608CAB59EBE8824D966E9FC0913F7356",
        "Dithering with a fine brush. 4",
        "{2B306494-DB33-11d2-85FC-0000F8102E5F}"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 4344
    },
    {
      "name": [
        "wdsclientapi.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/00436605b013e26f39b3ff6aab1e5577fe6e4950c4c803d534d0bbd912b3f7e0",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll"
      ],
      "size": 249288,
      "crc32": "EA751A5F",
      "md5": "c8622591ea490127898ff612c4d0fce8",
      "sha1": "609b9a81d5ccbcac62377eeee95ff328daec3618",
      "sha256": "00436605b013e26f39b3ff6aab1e5577fe6e4950c4c803d534d0bbd912b3f7e0",
      "sha512": "cbdf1828e892035f05554298480f0416aadbd83c5020ee02ab7fb13bd7b03418297632c7aadc4c82ef850c5e79b03f9044c86a3d5be09dcb07c1834b90db2f23",
      "rh_hash": null,
      "ssdeep": "6144:dwSCAMOtf9vjREEQytxZAAB8A866ZAbl3YKcNFsvGbxlVrFJp3qM95BZc61:LWAB8M5bl3YKcgvw1/",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T158344B0137E995F9E6773930367C523524BEFA201BC2DACF03548E5AB8615C0EB3976A",
      "sha3_384": "6a6536e0f4d9bd9fae1dd635ebbef400c97926dde32a400e0a7b3d78259b9b96e16756f16b3b1c5aa9a31590d85a3add",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x00033b80",
        "ep_bytes": "8bff558bec837d0c017505e8f5050000",
        "peid_signatures": null,
        "reported_checksum": "0x00042052",
        "actual_checksum": "0x00042052",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "WdsClientApi.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x100382bc",
                "name": "iswdigit"
              },
              {
                "address": "0x100382c0",
                "name": "_wtoi"
              },
              {
                "address": "0x100382c4",
                "name": "wcsncmp"
              },
              {
                "address": "0x100382c8",
                "name": "wcsrchr"
              },
              {
                "address": "0x100382cc",
                "name": "toupper"
              },
              {
                "address": "0x100382d0",
                "name": "wprintf"
              },
              {
                "address": "0x100382d4",
                "name": "towlower"
              },
              {
                "address": "0x100382d8",
                "name": "iswxdigit"
              },
              {
                "address": "0x100382dc",
                "name": "wcstoul"
              },
              {
                "address": "0x100382e0",
                "name": "wcsncat_s"
              },
              {
                "address": "0x100382e4",
                "name": "towupper"
              },
              {
                "address": "0x100382e8",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x100382ec",
                "name": "_vsnprintf"
              },
              {
                "address": "0x100382f0",
                "name": "_wcsicmp"
              },
              {
                "address": "0x100382f4",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x100382f8",
                "name": "__RTDynamicCast"
              },
              {
                "address": "0x100382fc",
                "name": "memcmp"
              },
              {
                "address": "0x10038300",
                "name": "memcpy"
              },
              {
                "address": "0x10038304",
                "name": "memmove"
              },
              {
                "address": "0x10038308",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x1003830c",
                "name": "_onexit"
              },
              {
                "address": "0x10038310",
                "name": "__dllonexit"
              },
              {
                "address": "0x10038314",
                "name": "_unlock"
              },
              {
                "address": "0x10038318",
                "name": "_lock"
              },
              {
                "address": "0x1003831c",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x10038320",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x10038324",
                "name": "_initterm"
              },
              {
                "address": "0x10038328",
                "name": "_amsg_exit"
              },
              {
                "address": "0x1003832c",
                "name": "_XcptFilter"
              },
              {
                "address": "0x10038330",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x10038334",
                "name": "bsearch"
              },
              {
                "address": "0x10038338",
                "name": "wcstol"
              },
              {
                "address": "0x1003833c",
                "name": "_callnewh"
              },
              {
                "address": "0x10038340",
                "name": "?what@exception@@UBEPBDXZ"
              },
              {
                "address": "0x10038344",
                "name": "??1exception@@UAE@XZ"
              },
              {
                "address": "0x10038348",
                "name": "??0exception@@QAE@ABV0@@Z"
              },
              {
                "address": "0x1003834c",
                "name": "??0exception@@QAE@XZ"
              },
              {
                "address": "0x10038350",
                "name": "malloc"
              },
              {
                "address": "0x10038354",
                "name": "free"
              },
              {
                "address": "0x10038358",
                "name": "_purecall"
              },
              {
                "address": "0x1003835c",
                "name": "wcschr"
              },
              {
                "address": "0x10038360",
                "name": "_wtoi64"
              },
              {
                "address": "0x10038364",
                "name": "_set_errno"
              },
              {
                "address": "0x10038368",
                "name": "_get_errno"
              },
              {
                "address": "0x1003836c",
                "name": "wcsncpy_s"
              },
              {
                "address": "0x10038370",
                "name": "_wcsupr"
              },
              {
                "address": "0x10038374",
                "name": "wcstok_s"
              },
              {
                "address": "0x10038378",
                "name": "qsort_s"
              },
              {
                "address": "0x1003837c",
                "name": "memset"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x10038050",
                "name": "RaiseException"
              },
              {
                "address": "0x10038054",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x10038058",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x1003805c",
                "name": "GetEnvironmentVariableW"
              },
              {
                "address": "0x10038060",
                "name": "MultiByteToWideChar"
              },
              {
                "address": "0x10038064",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x10038068",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x1003806c",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x10038070",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x10038074",
                "name": "GetTickCount"
              },
              {
                "address": "0x10038078",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x1003807c",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x10038080",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x10038084",
                "name": "TerminateProcess"
              },
              {
                "address": "0x10038088",
                "name": "OutputDebugStringA"
              },
              {
                "address": "0x1003808c",
                "name": "GetProcAddress"
              },
              {
                "address": "0x10038090",
                "name": "FreeLibrary"
              },
              {
                "address": "0x10038094",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x10038098",
                "name": "GetModuleFileNameW"
              },
              {
                "address": "0x1003809c",
                "name": "CloseHandle"
              },
              {
                "address": "0x100380a0",
                "name": "WriteFile"
              },
              {
                "address": "0x100380a4",
                "name": "GetLastError"
              },
              {
                "address": "0x100380a8",
                "name": "CreateFileW"
              },
              {
                "address": "0x100380ac",
                "name": "GetCurrentThread"
              },
              {
                "address": "0x100380b0",
                "name": "HeapFree"
              },
              {
                "address": "0x100380b4",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x100380b8",
                "name": "GetFullPathNameW"
              },
              {
                "address": "0x100380bc",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x100380c0",
                "name": "CreateEventW"
              },
              {
                "address": "0x100380c4",
                "name": "HeapAlloc"
              },
              {
                "address": "0x100380c8",
                "name": "CompareStringW"
              },
              {
                "address": "0x100380cc",
                "name": "SetLastError"
              },
              {
                "address": "0x100380d0",
                "name": "GetSystemInfo"
              },
              {
                "address": "0x100380d4",
                "name": "SetEndOfFile"
              },
              {
                "address": "0x100380d8",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x100380dc",
                "name": "SetEvent"
              },
              {
                "address": "0x100380e0",
                "name": "QueueUserWorkItem"
              },
              {
                "address": "0x100380e4",
                "name": "CopyFileW"
              },
              {
                "address": "0x100380e8",
                "name": "SetFileValidData"
              },
              {
                "address": "0x100380ec",
                "name": "SetFileAttributesW"
              },
              {
                "address": "0x100380f0",
                "name": "FindNextFileW"
              },
              {
                "address": "0x100380f4",
                "name": "FindClose"
              },
              {
                "address": "0x100380f8",
                "name": "SetFilePointerEx"
              },
              {
                "address": "0x100380fc",
                "name": "LoadLibraryW"
              },
              {
                "address": "0x10038100",
                "name": "OutputDebugStringW"
              },
              {
                "address": "0x10038104",
                "name": "ExpandEnvironmentStringsW"
              },
              {
                "address": "0x10038108",
                "name": "SetThreadAffinityMask"
              },
              {
                "address": "0x1003810c",
                "name": "GetProcessAffinityMask"
              },
              {
                "address": "0x10038110",
                "name": "CompareFileTime"
              },
              {
                "address": "0x10038114",
                "name": "GetFileAttributesExW"
              },
              {
                "address": "0x10038118",
                "name": "DeleteFileW"
              },
              {
                "address": "0x1003811c",
                "name": "GetFileSizeEx"
              },
              {
                "address": "0x10038120",
                "name": "SetEnvironmentVariableW"
              },
              {
                "address": "0x10038124",
                "name": "Sleep"
              },
              {
                "address": "0x10038128",
                "name": "FindFirstFileW"
              },
              {
                "address": "0x1003812c",
                "name": "SystemTimeToFileTime"
              },
              {
                "address": "0x10038130",
                "name": "FileTimeToSystemTime"
              },
              {
                "address": "0x10038134",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x10038138",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x1003813c",
                "name": "CloseThreadpoolCleanupGroupMembers"
              },
              {
                "address": "0x10038140",
                "name": "CreateThreadpoolCleanupGroup"
              },
              {
                "address": "0x10038144",
                "name": "CreateThread"
              },
              {
                "address": "0x10038148",
                "name": "GetTempPathW"
              },
              {
                "address": "0x1003814c",
                "name": "GetTempFileNameW"
              },
              {
                "address": "0x10038150",
                "name": "SetFilePointer"
              },
              {
                "address": "0x10038154",
                "name": "CopyFileExW"
              },
              {
                "address": "0x10038158",
                "name": "GetComputerNameW"
              },
              {
                "address": "0x1003815c",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x10038160",
                "name": "ReadFile"
              },
              {
                "address": "0x10038164",
                "name": "SleepConditionVariableSRW"
              },
              {
                "address": "0x10038168",
                "name": "WakeAllConditionVariable"
              },
              {
                "address": "0x1003816c",
                "name": "AcquireSRWLockExclusive"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x10038000",
                "name": "RegEnumValueW"
              },
              {
                "address": "0x10038004",
                "name": "RegOpenKeyExW"
              },
              {
                "address": "0x10038008",
                "name": "RegEnumKeyExW"
              },
              {
                "address": "0x1003800c",
                "name": "RegFlushKey"
              },
              {
                "address": "0x10038010",
                "name": "RegCloseKey"
              },
              {
                "address": "0x10038014",
                "name": "LookupPrivilegeValueW"
              },
              {
                "address": "0x10038018",
                "name": "AdjustTokenPrivileges"
              },
              {
                "address": "0x1003801c",
                "name": "PrivilegeCheck"
              },
              {
                "address": "0x10038020",
                "name": "OpenProcessToken"
              },
              {
                "address": "0x10038024",
                "name": "RegLoadKeyW"
              },
              {
                "address": "0x10038028",
                "name": "RegUnLoadKeyW"
              },
              {
                "address": "0x1003802c",
                "name": "RegQueryInfoKeyW"
              },
              {
                "address": "0x10038030",
                "name": "OpenThreadToken"
              },
              {
                "address": "0x10038034",
                "name": "LogonUserW"
              },
              {
                "address": "0x10038038",
                "name": "RevertToSelf"
              },
              {
                "address": "0x1003803c",
                "name": "ImpersonateLoggedOnUser"
              },
              {
                "address": "0x10038040",
                "name": "RegQueryValueExW"
              }
            ]
          },
          "ole32": {
            "dll": "ole32.dll",
            "imports": [
              {
                "address": "0x100383a4",
                "name": "CoCreateInstance"
              },
              {
                "address": "0x100383a8",
                "name": "CLSIDFromProgID"
              },
              {
                "address": "0x100383ac",
                "name": "CoInitializeEx"
              }
            ]
          },
          "MPR": {
            "dll": "MPR.dll",
            "imports": [
              {
                "address": "0x10038174",
                "name": "WNetCancelConnection2W"
              },
              {
                "address": "0x10038178",
                "name": "WNetAddConnection2W"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x10038384",
                "name": "RtlInitUnicodeString"
              },
              {
                "address": "0x10038388",
                "name": "NtQuerySystemInformation"
              },
              {
                "address": "0x1003838c",
                "name": "RtlAllocateHeap"
              },
              {
                "address": "0x10038390",
                "name": "RtlAdjustPrivilege"
              },
              {
                "address": "0x10038394",
                "name": "RtlNtStatusToDosError"
              },
              {
                "address": "0x10038398",
                "name": "RtlFreeHeap"
              },
              {
                "address": "0x1003839c",
                "name": "NtUnloadKey2"
              }
            ]
          },
          "WS2_32": {
            "dll": "WS2_32.dll",
            "imports": [
              {
                "address": "0x10038270",
                "name": "closesocket"
              },
              {
                "address": "0x10038274",
                "name": "inet_addr"
              },
              {
                "address": "0x10038278",
                "name": "WSASocketW"
              },
              {
                "address": "0x1003827c",
                "name": "ntohs"
              },
              {
                "address": "0x10038280",
                "name": "WSAGetLastError"
              },
              {
                "address": "0x10038284",
                "name": "FreeAddrInfoW"
              },
              {
                "address": "0x10038288",
                "name": "GetAddrInfoW"
              },
              {
                "address": "0x1003828c",
                "name": "WSAAddressToStringW"
              },
              {
                "address": "0x10038290",
                "name": "WSAStartup"
              },
              {
                "address": "0x10038294",
                "name": "WSACleanup"
              },
              {
                "address": "0x10038298",
                "name": "WSAIoctl"
              }
            ]
          },
          "RPCRT4": {
            "dll": "RPCRT4.dll",
            "imports": [
              {
                "address": "0x100381b0",
                "name": "UuidToStringW"
              },
              {
                "address": "0x100381b4",
                "name": "RpcStringFreeW"
              },
              {
                "address": "0x100381b8",
                "name": "UuidCreate"
              }
            ]
          },
          "SETUPAPI": {
            "dll": "SETUPAPI.dll",
            "imports": [
              {
                "address": "0x100381c0",
                "name": "SetupDiGetDeviceInstanceIdW"
              },
              {
                "address": "0x100381c4",
                "name": "SetupDiEnumDeviceInfo"
              },
              {
                "address": "0x100381c8",
                "name": "SetupDiDestroyDeviceInfoList"
              },
              {
                "address": "0x100381cc",
                "name": "SetupDiGetDeviceRegistryPropertyW"
              },
              {
                "address": "0x100381d0",
                "name": "SetupDiGetClassDevsW"
              }
            ]
          },
          "SHLWAPI": {
            "dll": "SHLWAPI.dll",
            "imports": [
              {
                "address": "0x100381d8",
                "name": "PathIsUNCW"
              }
            ]
          },
          "VERSION": {
            "dll": "VERSION.dll",
            "imports": [
              {
                "address": "0x100381e0",
                "name": "GetFileVersionInfoSizeW"
              },
              {
                "address": "0x100381e4",
                "name": "GetFileVersionInfoSizeExW"
              },
              {
                "address": "0x100381e8",
                "name": "GetFileVersionInfoExW"
              },
              {
                "address": "0x100381ec",
                "name": "VerQueryValueW"
              },
              {
                "address": "0x100381f0",
                "name": "GetFileVersionInfoW"
              }
            ]
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x10038188",
                "name": "SysAllocString"
              },
              {
                "address": "0x1003818c",
                "name": "SysFreeString"
              },
              {
                "address": "0x10038190",
                "name": "SysStringLen"
              },
              {
                "address": "0x10038194",
                "name": "VariantInit"
              },
              {
                "address": "0x10038198",
                "name": "VariantClear"
              },
              {
                "address": "0x1003819c",
                "name": "SystemTimeToVariantTime"
              },
              {
                "address": "0x100381a0",
                "name": "VariantTimeToSystemTime"
              },
              {
                "address": "0x100381a4",
                "name": "GetErrorInfo"
              },
              {
                "address": "0x100381a8",
                "name": "SetErrorInfo"
              }
            ]
          },
          "Normaliz": {
            "dll": "Normaliz.dll",
            "imports": [
              {
                "address": "0x10038180",
                "name": "IdnToAscii"
              }
            ]
          },
          "WdsImage": {
            "dll": "WdsImage.dll",
            "imports": [
              {
                "address": "0x100382a0",
                "name": "WdsImgClose"
              },
              {
                "address": "0x100382a4",
                "name": "WdsImgGetXml"
              },
              {
                "address": "0x100382a8",
                "name": "WdsImgOpenImage"
              },
              {
                "address": "0x100382ac",
                "name": "WDSParseImageInformation"
              },
              {
                "address": "0x100382b0",
                "name": "WDSInitializeEmptyImageInformation"
              },
              {
                "address": "0x100382b4",
                "name": "WDSFreeImageInformation"
              }
            ]
          },
          "WDSTPTC": {
            "dll": "WDSTPTC.dll",
            "imports": [
              {
                "address": "0x10038240",
                "name": "WdsTransportClientInitializeSession"
              },
              {
                "address": "0x10038244",
                "name": "WdsTransportClientInitialize"
              },
              {
                "address": "0x10038248",
                "name": "WdsTransportClientRegisterCallback"
              },
              {
                "address": "0x1003824c",
                "name": "WdsTransportClientReleaseBuffer"
              },
              {
                "address": "0x10038250",
                "name": "WdsTransportClientCancelSession"
              },
              {
                "address": "0x10038254",
                "name": "WdsTransportClientStartSession"
              },
              {
                "address": "0x10038258",
                "name": "WdsTransportClientShutdown"
              },
              {
                "address": "0x1003825c",
                "name": "WdsTransportClientCancelSessionEx"
              },
              {
                "address": "0x10038260",
                "name": "WdsTransportClientCompleteReceive"
              },
              {
                "address": "0x10038264",
                "name": "WdsTransportClientAddRefBuffer"
              },
              {
                "address": "0x10038268",
                "name": "WdsTransportClientCloseSession"
              }
            ]
          },
          "WDSCORE": {
            "dll": "WDSCORE.dll",
            "imports": [
              {
                "address": "0x100381f8",
                "name": "CurrentIP"
              },
              {
                "address": "0x100381fc",
                "name": "ConstructPartialMsgVW"
              },
              {
                "address": "0x10038200",
                "name": "WdsSetupLogMessageW"
              }
            ]
          },
          "WDSCSL": {
            "dll": "WDSCSL.dll",
            "imports": [
              {
                "address": "0x10038208",
                "name": "WdsCpParameterQuery"
              },
              {
                "address": "0x1003820c",
                "name": "WdsCpRecvPacketInitialize"
              },
              {
                "address": "0x10038210",
                "name": "WdsCpPacketGetBuffer"
              },
              {
                "address": "0x10038214",
                "name": "WdsCpPacketInitialize"
              },
              {
                "address": "0x10038218",
                "name": "WdsClientSessionExecute"
              },
              {
                "address": "0x1003821c",
                "name": "WdsClientSessionShutdown"
              },
              {
                "address": "0x10038220",
                "name": "WdsClientSessionCreate"
              },
              {
                "address": "0x10038224",
                "name": "WdsClientInitializeLibrary"
              },
              {
                "address": "0x10038228",
                "name": "WdsCpPacketRelease"
              },
              {
                "address": "0x1003822c",
                "name": "WdsClientFreeLibrary"
              },
              {
                "address": "0x10038230",
                "name": "WdsCpParameterValidate"
              },
              {
                "address": "0x10038234",
                "name": "WdsClientPacketFree"
              },
              {
                "address": "0x10038238",
                "name": "WdsCpParameterAdd"
              }
            ]
          },
          "IPHLPAPI": {
            "dll": "IPHLPAPI.DLL",
            "imports": [
              {
                "address": "0x10038048",
                "name": "GetAdaptersAddresses"
              }
            ]
          }
        },
        "exported_dll_name": "WDSCLIENTAPI.dll",
        "exports": [
          {
            "address": "0x1000c250",
            "name": "WdsCliAuthorizeSession",
            "ordinal": 1
          },
          {
            "address": "0x10016060",
            "name": "WdsCliCancelTransfer",
            "ordinal": 2
          },
          {
            "address": "0x1000c570",
            "name": "WdsCliClose",
            "ordinal": 3
          },
          {
            "address": "0x10011790",
            "name": "WdsCliConnectToImageStore",
            "ordinal": 4
          },
          {
            "address": "0x1000bf40",
            "name": "WdsCliCreateSession",
            "ordinal": 5
          },
          {
            "address": "0x1000bf70",
            "name": "WdsCliCreateSessionEx",
            "ordinal": 6
          },
          {
            "address": "0x1000d720",
            "name": "WdsCliFilterImageArchitecture",
            "ordinal": 7
          },
          {
            "address": "0x1000d6e0",
            "name": "WdsCliFilterImageFirmwareType",
            "ordinal": 8
          },
          {
            "address": "0x1000d600",
            "name": "WdsCliFilterImageVersion",
            "ordinal": 9
          },
          {
            "address": "0x1000d6a0",
            "name": "WdsCliFilterImageVersionMatchingBootImage",
            "ordinal": 10
          },
          {
            "address": "0x1000c5f0",
            "name": "WdsCliFindFirstImage",
            "ordinal": 11
          },
          {
            "address": "0x1000c990",
            "name": "WdsCliFindNextImage",
            "ordinal": 12
          },
          {
            "address": "0x10013690",
            "name": "WdsCliFreeDomainJoinInformation",
            "ordinal": 13
          },
          {
            "address": "0x10017c80",
            "name": "WdsCliFreeStringArray",
            "ordinal": 14
          },
          {
            "address": "0x1000e1a0",
            "name": "WdsCliFreeUnattendVariables",
            "ordinal": 15
          },
          {
            "address": "0x1000d750",
            "name": "WdsCliGetClientUnattend",
            "ordinal": 16
          },
          {
            "address": "0x10018420",
            "name": "WdsCliGetDeploymentMetadata",
            "ordinal": 17
          },
          {
            "address": "0x10018390",
            "name": "WdsCliGetDeploymentMetadataAvailable",
            "ordinal": 18
          },
          {
            "address": "0x10013230",
            "name": "WdsCliGetDomainJoinInformation",
            "ordinal": 19
          },
          {
            "address": "0x10017bc0",
            "name": "WdsCliGetDriverQueryXml",
            "ordinal": 20
          },
          {
            "address": "0x1000ca70",
            "name": "WdsCliGetEnumerationFlags",
            "ordinal": 21
          },
          {
            "address": "0x10014870",
            "name": "WdsCliGetImageArchitecture",
            "ordinal": 22
          },
          {
            "address": "0x10014570",
            "name": "WdsCliGetImageDescription",
            "ordinal": 23
          },
          {
            "address": "0x10014e30",
            "name": "WdsCliGetImageFiles",
            "ordinal": 24
          },
          {
            "address": "0x10014b90",
            "name": "WdsCliGetImageGroup",
            "ordinal": 25
          },
          {
            "address": "0x100147b0",
            "name": "WdsCliGetImageHalName",
            "ordinal": 26
          },
          {
            "address": "0x1000ca00",
            "name": "WdsCliGetImageHandleFromFindHandle",
            "ordinal": 27
          },
          {
            "address": "0x100161c0",
            "name": "WdsCliGetImageHandleFromTransferHandle",
            "ordinal": 28
          },
          {
            "address": "0x10014f10",
            "name": "WdsCliGetImageIndex",
            "ordinal": 29
          },
          {
            "address": "0x10014fe0",
            "name": "WdsCliGetImageLanguage",
            "ordinal": 30
          },
          {
            "address": "0x100150b0",
            "name": "WdsCliGetImageLanguages",
            "ordinal": 31
          },
          {
            "address": "0x10014a00",
            "name": "WdsCliGetImageLastModifiedTime",
            "ordinal": 32
          },
          {
            "address": "0x10014630",
            "name": "WdsCliGetImageName",
            "ordinal": 33
          },
          {
            "address": "0x10014c60",
            "name": "WdsCliGetImageNamespace",
            "ordinal": 34
          },
          {
            "address": "0x10015180",
            "name": "WdsCliGetImageParameter",
            "ordinal": 35
          },
          {
            "address": "0x10014ac0",
            "name": "WdsCliGetImagePath",
            "ordinal": 36
          },
          {
            "address": "0x10014930",
            "name": "WdsCliGetImageSize",
            "ordinal": 37
          },
          {
            "address": "0x10014d30",
            "name": "WdsCliGetImageType",
            "ordinal": 38
          },
          {
            "address": "0x100146f0",
            "name": "WdsCliGetImageVersion",
            "ordinal": 39
          },
          {
            "address": "0x100181d0",
            "name": "WdsCliGetSystemMetadata",
            "ordinal": 40
          },
          {
            "address": "0x10015a30",
            "name": "WdsCliGetTransferSize",
            "ordinal": 41
          },
          {
            "address": "0x1000dd20",
            "name": "WdsCliGetUnattendVariables",
            "ordinal": 42
          },
          {
            "address": "0x10012a00",
            "name": "WdsCliGetWimImageReferenceFile",
            "ordinal": 43
          },
          {
            "address": "0x1000e7e0",
            "name": "WdsCliInitializeLog",
            "ordinal": 44
          },
          {
            "address": "0x1000ecc0",
            "name": "WdsCliLog",
            "ordinal": 45
          },
          {
            "address": "0x100179e0",
            "name": "WdsCliObtainDriverPackages",
            "ordinal": 46
          },
          {
            "address": "0x10017ad0",
            "name": "WdsCliObtainDriverPackagesEx",
            "ordinal": 47
          },
          {
            "address": "0x1000be80",
            "name": "WdsCliRegisterTrace",
            "ordinal": 48
          },
          {
            "address": "0x10012b90",
            "name": "WdsCliResetBootProgram",
            "ordinal": 49
          },
          {
            "address": "0x1000cac0",
            "name": "WdsCliSetSupportedFeatures",
            "ordinal": 50
          },
          {
            "address": "0x10018290",
            "name": "WdsCliSetSystemMetadata",
            "ordinal": 51
          },
          {
            "address": "0x10015a10",
            "name": "WdsCliSetTransferBufferSize",
            "ordinal": 52
          },
          {
            "address": "0x1000cb10",
            "name": "WdsCliSimulateArchitecture",
            "ordinal": 53
          },
          {
            "address": "0x1000d3f0",
            "name": "WdsCliSimulateDeviceId",
            "ordinal": 54
          },
          {
            "address": "0x1000cb80",
            "name": "WdsCliSimulateSmbiosInfo",
            "ordinal": 55
          },
          {
            "address": "0x10015da0",
            "name": "WdsCliTransferFile",
            "ordinal": 56
          },
          {
            "address": "0x10015a80",
            "name": "WdsCliTransferImage",
            "ordinal": 57
          },
          {
            "address": "0x10016100",
            "name": "WdsCliWaitForTransfer",
            "ordinal": 58
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x00034930",
            "size": "0x0000080e"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x000383b8",
            "size": "0x0000017c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x0003a000",
            "size": "0x00000448"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x0003ac00",
            "size": "0x000021c8"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x0003b000",
            "size": "0x000032b4"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x0000b9d0",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x00002a1c",
            "size": "0x00000018"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x00002970",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x00038000",
            "size": "0x000003b4"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x0003413e",
            "size_of_data": "0x00034200",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.37"
          },
          {
            "name": ".data",
            "raw_address": "0x00034600",
            "virtual_address": "0x00036000",
            "virtual_size": "0x00001604",
            "size_of_data": "0x00001200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "3.36"
          },
          {
            "name": ".idata",
            "raw_address": "0x00035800",
            "virtual_address": "0x00038000",
            "virtual_size": "0x00001974",
            "size_of_data": "0x00001a00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.54"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x00037200",
            "virtual_address": "0x0003a000",
            "virtual_size": "0x00000448",
            "size_of_data": "0x00000600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "2.60"
          },
          {
            "name": ".reloc",
            "raw_address": "0x00037800",
            "virtual_address": "0x0003b000",
            "virtual_size": "0x000032b4",
            "size_of_data": "0x00003400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.75"
          }
        ],
        "overlay": {
          "offset": "0x0003ac00",
          "size": "0x000021c8"
        },
        "resources": [
          {
            "name": "RT_VERSION",
            "offset": "0x0003a060",
            "size": "0x000003e4",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.50"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows Deployment Services Client API Library"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WdsClientApi.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "WdsClientApi.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "472dd20a44216e1e6eb76cb32c695b1b",
        "timestamp": "2018-01-30 12:51:00",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 18
      },
      "data": null,
      "strings": [
        "base\\eco\\wds\\lib\\ddp\\mgmtclient\\src\\ddpmgmtclient.cpp",
        "mk-MK",
        "ro-MD",
        "ChassisTypes",
        "=\">:>_>",
        "516@6O6Z6l6",
        "3\"383=3V3g3q3",
        "sr-Cyrl-RS",
        "WDS.Client.JoinDomain.Account.PrestageUsingMAC",
        "es-DO",
        ".CRT$XLA",
        "Microsoft Time-Stamp Service",
        "G\\!_P!_TQ",
        "3t4~4",
        "3*3/3i3",
        "SystemTimeToFileTime",
        "mi-NZ",
        "Control\\Class\\{4D36E966-E325-11CE-BFC1-08002BE10318}",
        "4Q4X4b4x4",
        "Device Name=%s",
        "> >(>0>8>@>H>P>X>d>h>l>",
        "\\system32\\ssshim.dll",
        "WdsCliSetTransferBufferSize",
        "5$5.5d5n5",
        "2/2F2Q2j2z2",
        "ar-MA",
        "5(545@5L5X5d5p5|5",
        "SPLEVEL",
        "RtlNtStatusToDosError",
        "ml-IN",
        "WdsCliGetSystemMetadata",
        "nb-NO",
        "Control\\MUI\\UILanguages",
        "=n=y=",
        ">+?C?",
        "lo-LA",
        ":\";6;I;d;",
        "778c8",
        "es-BO",
        "malloc",
        "base\\eco\\wds\\lib\\ddp\\wdsmachineinfo\\src\\wdsmitargetosinfo.cpp",
        "_wtoi64",
        "929w9",
        "ProcessProgressMessage",
        "<$<.<[<e<",
        "u jW_hs",
        "MsgQueueDestroy",
        "uImageIndex",
        "6(6,6H6L6P6T6h6l6",
        "9F:P:i:v:",
        "<*<]<",
        "az-Cyrl-AZ",
        "VER_CLIENT_AUTO",
        "j=Xf9C",
        "de-CH",
        "pwszDeviceName",
        "sr-Latn",
        ".?AUIWdsMetadataEntry@@",
        "GROUP_%u",
        "0Q1X1(2/2y2",
        "j$hxG",
        "%s=%I64d",
        "SetFileValidData",
        "Image Edition=%s",
        "DeviceIdentifier",
        "3 3,383D3P3\\3h3t3",
        "5T6_6",
        "WdsTransportConsumerInitialize",
        "GetFileVersionInfoW",
        "en-CA",
        ";3<<<\\<h<",
        "ts-ZA",
        "WdsCliGetClientUnattend",
        ":.:]:k:u:",
        "SessionReference",
        "tej.Yf9",
        "QueueUserWorkItem",
        "QSVWjH3",
        "rackmountchassis",
        "TerminateProcess",
        "6$7.7N7X7x7",
        "ORGNAME",
        ".idata$5",
        "Unable to retrieve the SMBIOS Model information.",
        "fr-029",
        ": :,:8:D:P:\\:h:t:",
        "9)9m9|9",
        "tn-BW",
        "tower",
        "ExpandEnvironmentStringsW",
        ">9?J?c?",
        "=\">@>`>p>",
        "2%2;2x2",
        "8.969H9R9",
        "es-CL",
        "8@8u8",
        "03191l1v1",
        "Image OS Version Info = %d.%d.%d",
        "pwszManufacturer",
        "_purecall",
        "j1Yf;",
        "040904B0",
        "Microsoft Time-Stamp Service0",
        "hi-IN",
        "Binary",
        "HeapFree",
        "base\\eco\\wds\\lib\\metadata\\core\\metadata.cpp",
        "SetThreadpoolThreadMaximum",
        "sw-KE",
        "Number of Chassis Types = %d",
        ".data$r$brc",
        "7(747@7L7X7d7p7|7",
        "898A8F8K8P8U8Z8d8s8",
        "es-MX",
        "969l9",
        "WDSDDP_MACHINE_INFO",
        "kok-IN",
        "Redmond1",
        "fr-CA",
        "4K4Y4",
        ";)<?<",
        "ole32.dll",
        "SpLevel",
        ".?AVCWdsRemoteDeviceControllerClient@@",
        "PXEv6 Warning: DUID-UUID of unexpected length %Iu, require precisely %Iu",
        "cy-GB",
        "wcstok_s",
        "f;L$4t",
        "j\\Yf;",
        "am-ET",
        "gn-PY",
        "__RTDynamicCast",
        "pwszHardwareDescription",
        "j:Zf;",
        "yi-001",
        "SMBIOS Information",
        "Device",
        "Device InstanceId=%s",
        "j=Yf;",
        "hy-AM",
        "7+7Y7`7l7",
        "5!5+5R5\\5y5",
        ">K?c?~?",
        "VERSION/BUILD",
        ".?AUIWdsMetadataBuilder@@",
        "-> WdsClipTransferNextFile",
        "uImageFormat",
        "ullVersion",
        "9NXvt",
        "<- WdsCliCancelTransfer=%x",
        "zu-ZA",
        "ur-PK",
        "> >)>2>A>G>L>a>k>",
        "8@9J9W9",
        "jyhlN",
        "CurrentIP",
        "839:9D9e9l9v9",
        "=*>5>B>Y>",
        "SubNotebook",
        "WDSCLIENTAPI",
        "ar-EG",
        ".xdata$x",
        "Handheld",
        "fr-SN",
        "en-ZW",
        "pizzabox",
        "VER_OS_AUTO",
        "Microsoft Corporation1",
        "5\\5c5{5",
        "\\VarFileInfo\\Translation",
        ">b?u?z?",
        "en-AE",
        "============================",
        "0&000=0i0z0",
        "2.2D2V2o2y2",
        "MachineGuid",
        "WdsTransportClientReleaseBuffer",
        "WdsCliSetSystemMetadata",
        "4#5/5N5W5b5",
        ";+;5;R;`;j;",
        "230865+4584940",
        "VERSION",
        "WDS.Client.JoinDomain.Machine.Domain",
        "StringFileInfo",
        "N0L0J",
        "ja-JP",
        "r~akow",
        "CompatibleIds",
        "[%S:%u] Expression: %S, Win32 Error=0x%x",
        "343H3i3}3",
        "'SQWP",
        "SetupDiGetDeviceRegistryPropertyW",
        "<<<C<S<Z<g<n<~<",
        "7V8`8",
        "9D$Tt",
        "%u.%u.%u.%u",
        "GetAddrInfoW",
        "4D4N4",
        "ControlSet???",
        "1@1G1S1i1",
        "iu-Latn",
        "tzm-Tfng-MA",
        "Chassis Type Info:",
        "ka-GE",
        "<?=K=R=e=",
        ";(;2;s;|;",
        ">$>Q>V>",
        "OPTIONS",
        "D$$;A",
        "PXEv6 Warning: DUID-LLT unrecognized hardware type %u",
        "GetAdaptersAddresses",
        "=\"=&=*=.=2=6=:=>=B=F=J=N=R=V=Z=^=b=f=j=n=r=v=",
        "WDS.Client.DDP.Default.Match",
        "8.9Q9}9",
        "-> CallbackTransportSessionStart",
        "cs-CZ",
        "<,<0<H<L<d<t<",
        ".text$x",
        "WdsTransportClientCompleteReceive",
        "ff-Latn-SN",
        "RackMountChassis",
        "tk-TM",
        "Unable to retrieve the Chassis information.",
        "fi-FI",
        "tzm-Tfng",
        "WdsCliSimulateDeviceId",
        "pDeviceName",
        "6'6B6R6h6}6",
        "WdsCliRegisterTrace",
        "~$9~ t",
        "IPHLPAPI.DLL",
        "nn-NO",
        "jW_hz",
        "%systemroot%\\system32\\kernel32.dll",
        "WDS.Client.Property.SMBIOS.ChassisType",
        "es-HN",
        "BUILD",
        "VarFileInfo",
        "ar-DZ",
        "WDSDDP_FILE",
        "465=5V5]5",
        "bg-BG",
        "1(141@1L1X1d1p1|1",
        "WdsClientSessionShutdown",
        "ibb-NG",
        "DeleteCriticalSection",
        ">`base\\eco\\wds\\wdslib\\xml\\xmldocument.cpp",
        "WSAAddressToStringW",
        "qj*Xf;",
        "ca-ES-valencia",
        "memmove",
        "AdjustTokenPrivileges",
        "0<1F1Q1]1h1u1~1",
        "9$9b9p9z9",
        "-0@0E0f0",
        "pa-Arab",
        "=.=:=n=w=",
        "1W1a1 2/242W2f2k2",
        "t!j|h",
        "9A9K9m9w9",
        "7.7<7M7i7y7",
        "quz-PE",
        "PQQVW",
        "454<4F4\\4",
        "1(3-3",
        "ig-NG",
        "3,3?3]3",
        "8T8o8",
        "JH;ZLr",
        ":D;R;w;",
        "2K3t3",
        "dwArchitecture",
        "9t$ u7",
        ".Index",
        "BIOS Vendor Info = %s",
        "ProductSuite",
        ";8;B;",
        "es-SV",
        "fr-CD",
        "IdnToAscii",
        "N{h[)",
        "WDS.Client.JoinDomain.User.LastName",
        "</<9<",
        "WDS.Client.Unattend.FilePath",
        "msvcrt.dll",
        ">,>0>H>X>h>x>",
        "WDS.Client.Property.SMBIOS.Vendor",
        "?3?W?w?",
        "FALSE",
        "GetCurrentThreadId",
        "D$$9D$0",
        "gsw-FR",
        "0&0C0d0w0|0",
        "~(9~,t",
        "2l2v2",
        ">C>H>y>~>",
        "j:Xf;",
        "Hardware Id [%d]=%s",
        "5!5C5J5T5v5",
        "WdsCliSimulateSmbiosInfo",
        "sma-NO",
        "272E2k2r2",
        "quc-Latn",
        "4-4<4[4",
        "FreeLibrary",
        "`.data",
        "8,8F8g8m8",
        "C0j0s0",
        "en-HK",
        "\\Registry\\Machine",
        "|$8Y3",
        ">`base\\eco\\wds\\lib\\ddp\\wdsmachineinfo\\src\\wdsmirawsmbios.cpp",
        "9O8t\"",
        "~,9~$t",
        "CreateThreadpoolWork",
        "0(0,00040H0L0h0l0p0t0",
        "expansionchassis",
        "4(4,4H4L4P4T4h4l4",
        "sd-Arab",
        "D$HSVW",
        "WDSMachineInfo/TargetOsInfo",
        ":+:5:N:^:h:",
        "MsgQueueNotifyProgress",
        "PackageGuid",
        "-> ConvertMachineInfo",
        "L$ PQ",
        "6+6>6L6n6",
        "CreateThreadpoolCleanupGroup",
        "pwszBiosVendor",
        "ControllerList",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z",
        "km-KH",
        "101h1m1",
        ".CRT$XCA",
        "u F;s",
        "=\"=5=\\=o=t=",
        "2%2B2",
        "G PQQ",
        "GetFileSizeEx",
        "BiosVersion",
        "tcPQP",
        "MsgQueueNotifySessionComplete",
        "NotEqual",
        "ATL$__a",
        "SetFilePointer",
        "fr-MA",
        "C;\\$ ",
        "212R2_2",
        "hBMSR",
        "WdsCpPacketRelease",
        "LowProfileDestkop",
        "or-IN",
        "ha-Latn-NG",
        ".?AV?$CComObject@VCWdsComMetadata@@@ATL@@",
        "base\\eco\\wds\\clientapi\\client\\src\\transfer.cpp",
        ",zezBuw5nSATlu/5zeHu1B9mD489JH9HxUdL8/lE3bXM=0Z",
        ".?AUIUnknown@@",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "RegQueryInfoKeyW",
        "GreaterThanOrEqual",
        "7M8W8",
        "VWSh<V",
        "8=8U8n8",
        "xjG;}",
        "3+4U4~4",
        "5(5h5q5|5",
        ">\"?6?E?O?V?u?",
        "200304182929Z",
        "WDS.Client.Property.SMBIOS.Manufacturer",
        "{00000000-0000-0000-0000-000000000000}",
        "4E4X4]4",
        "sr-Cyrl-BA",
        ">+?]?g?",
        "Received session complete callback for session 0x%08x",
        "onecore\\base\\eco\\wds\\wdslib\\dhcplib\\dhcpv6options.cpp",
        "$Microsoft Ireland Operations Limited1&0$",
        "9O9Y9",
        "tt-RU",
        "PRODUCTSUITE",
        "base\\eco\\wds\\clientapi\\lib\\src\\imgsrvpacket.cpp",
        "InternalName",
        "<<Failed>>",
        "D$$Pj",
        "250701214655Z0|1",
        "7(7,7H7L7P7T7h7l7",
        "base\\eco\\wds\\clientapi\\client\\src\\imageinfo.cpp",
        "base\\eco\\wds\\clientapi\\client\\src\\domainjoin.cpp",
        "%s=%u.%u.%u.%u",
        ".?AV?$CComObject@VCWdsComMetadataEntry@@@ATL@@",
        "5n6x6",
        "3 3$3(3,303<3H3T3`3l3x3",
        "080=0b0l0",
        "ConstructPartialMsgVW",
        "storagechassis",
        "=4=D=T=d=h=l=p=x=",
        "w49wdt",
        "PSSSSSS",
        "bs-Latn",
        "WdsTransportClientCloseSession",
        "PATH_%u",
        "WdsTransportClientCancelSession",
        "WdsCpRecvPacketInitialize",
        "-> WdsCliObtainDriverPackages",
        "String",
        "1&2,2",
        "CloseThreadpoolCleanupGroupMembers",
        "u(jJh",
        "fr-FR",
        "Translation",
        "j]Xf9Ds",
        "%s.%s[%u]",
        "nl-BE",
        "ve-ZA",
        "tzm-Latn",
        ".tls$",
        ":/:6:@:E:",
        "D$ PS",
        "tr-TR",
        "fr-HT",
        "PSj h(:",
        "pwszProviderName",
        "mr-IN",
        "memcpy",
        "~!jW^h",
        "kernel32.dll",
        "GetModuleHandleW",
        "?@?J?z?",
        "WDSDDP_TARGET_OS_INFO",
        ".CRT$XLZ",
        "GetSystemInfo",
        "0$0I0P0r0y0",
        "WSShhV",
        "dwBuild",
        "WdsCliCreateSession",
        "gl-ES",
        "CWdsMiTargetOsInfo::LogW",
        "WdsCliFreeStringArray",
        "MESSAGE_TYPE",
        "Image Lang Pack [%d]=%s",
        ";.;Y;o;",
        "3J3T3",
        "20201008085628Z",
        " http://www.microsoft.com/windows0",
        "tPVVPQ",
        "%s-%u",
        "1(1,10141H1L1h1l1p1t1",
        "0)0p0z0",
        "t2j-Zf9",
        "8!8.878e8",
        "DataMgrGetPercentWritten",
        ";4;I;i;y;",
        "WdsCliGetDeploymentMetadata",
        "tzm-Arab-MA",
        "bs-Cyrl",
        "4!5(5d5k5",
        "Washington1",
        "WakeAllConditionVariable",
        "<1<U=m=",
        ";MatchGroup=",
        "Group",
        "%s={%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}",
        ";O<q<",
        "RegLoadKeyW",
        "CurrentBuildNumber",
        "wcstoul",
        "2W2|2",
        "fr-MC",
        "LogonUserW",
        "5*5]5c5v5",
        "hSeManageVolumePrivilege",
        ".tls$ZZZ",
        "PXEv6 Warning: DUID-LLT unexpected hardware address length %u",
        "WNetAddConnection2W",
        "9\\$,t",
        "Error: %s",
        "m_dwCurrent <= m_ImageHandleArray.GetCount()",
        "WdsClientPacketFree",
        "te-IN",
        "x3WVj",
        "FileDescription",
        "WdsTransportClientInitializeSession",
        "_XcptFilter",
        "808H8L8P8T8X8d8h8l8p8",
        "yo-NG",
        "ar-KW",
        ".DependentFile",
        "7K7n7u7",
        "6.6B6_6",
        "IMAGE ARCHITECTURE",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "t$(WQ",
        " Rich",
        ".idata$6",
        "</%s>",
        "WDSParseImageInformation",
        "MACHINEDN",
        "wcschr",
        "40555.686s6x6",
        "8)9.9",
        "7.888]8g8",
        "WdsCliObtainDriverPackages",
        "r'j6Xf;",
        "LessThan",
        "WdsCliWaitForTransfer",
        "<- WdsCliGetImageHandleFromTransferHandle=%x",
        "9)9.9F9O9b9g9",
        "ms-MY",
        ":#:):.:_:f:p:",
        ">#?-?",
        "GetFileVersionInfoSizeW",
        "UuidCreate",
        "pwszImageFilePath",
        "Control\\ProductOptions",
        "127.0.0.1",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\strutil.cpp",
        "9x(vH",
        "is-IS",
        "1\"151=1",
        "PVj h(:",
        "Microsoft Corporation",
        "Files",
        "WS2_32.dll",
        "6G7L7o7y7",
        "Devices",
        "dz-BT",
        "1:1a1k1|1",
        "8C8Y8",
        ": :$:(:4:8:@:H:`:d:|:",
        "1N2q2x2",
        "CJ\\B/",
        "sLanguagePacks",
        "4(444@4L4X4d4p4|4",
        "5[6r6",
        "RegQueryValueExW",
        "-> WdsCliGetImageHandleFromTransferHandle",
        "Msxml2.DOMDocument.6.0",
        "3A3I3P3V3[3g3r3",
        "6 7M7W7l7{7",
        "WDS.Client.JoinDomain.ResetBootProgram",
        "5!5'5,555;5A5F5O5U5[5`5i5o5u5z5",
        "ky-KG",
        "IMAGE_NAME",
        "dsb-DE",
        "797n7",
        "wdscc",
        "-> WdsCliTransferImage",
        "CLIENT_UNATTEND",
        "dwSpLevel",
        "ARM64",
        "D$`PjZ",
        "GetProcessHeap",
        "other",
        "$0.0N0Y0",
        ":4;o;F<L<",
        "t jW^h",
        "WDS.Client.JoinDomain.Machine.Name",
        "SetEndOfFile",
        "xh-ZA",
        "Integer",
        "3L3Z3}3",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\wdscommon.cpp",
        "pt-PT",
        "W7aDL>d\"",
        "=P=Z=o=",
        "j.Zf;",
        "5 5*5O5V5\\5a5l5w5",
        "base\\eco\\wds\\clientapi\\lib\\src\\clientlib.cpp",
        "VWj,3",
        ":L:`:|:",
        "tQf9>u",
        "WdsCliGetImageDescription",
        "Device Description=%s",
        "DeviceList.Count",
        "MINOR",
        "0G0/191r1w1",
        "PVj hT<",
        "wcsncpy_s",
        "mt-MT",
        "tPWWj",
        "NAMESPACE_%u",
        "WDS.Client.JoinDomain.User.FirstName",
        "CreateThreadpool",
        "WdsCliFindNextImage",
        "??1exception@@UAE@XZ",
        "multisystemchassis",
        "8S8Z8e8|8",
        "WDS.Client.Unattend.XML",
        "<)=`=g=n=",
        ";X;{;",
        "y PhH",
        "Metadata specified %s=TRUE but no other unattend entries were provided.",
        "8 8(8,84888@8D8L8P8X8\\8d8h8p8t8|8",
        "1pyyT",
        "ProductType",
        "%s.%s",
        "Target Image Information",
        "%s[%s:%u] %s",
        "3V4`4",
        "ar-SA",
        "GetTempPathW",
        "et-EE",
        "my-MM",
        "G9^8u",
        "7!777>7T7[7j7q7",
        "\"Microsoft Window",
        "bo-CN",
        "9t$(u",
        ";Q;[;",
        "G;~(r",
        ":$:A:J:P:q:y:",
        "~(9~$",
        "= >^>",
        "GreaterThan",
        "9^(v=",
        "RegEnumKeyExW",
        "878>8g8q8",
        "<\"<V<]<",
        "\\system32\\config\\",
        "WdsTransportConsumerInitializeSession",
        "CLIENT_ADDRESS",
        ".Path",
        "es-ES_tradnl",
        "Unable to retrieve the BIOS information.",
        ":);4;",
        "6;6A6k6u6",
        "Unable to retrieve the BIOS Vendor information.",
        "7@7K7d7t7",
        "bsearch",
        "SetThreadAffinityMask",
        "WDS.Request.Type='Deployment'",
        "FreeAddrInfoW",
        "INSTALLATIONTYPE",
        "pwszXml",
        "MultiSystemChassis",
        "ADVAPI32.dll",
        "tg-Cyrl",
        "CheckProgress",
        "=&=d=",
        "\"0+020R0",
        "EnterCriticalSection",
        "0B1e1n1x1",
        ">7?E?",
        "PathIsUNCW",
        ">M>}>",
        "EventUnregister",
        "LOGLEVEL",
        "90G0i0p0z0",
        "3,3Y3",
        "=(=,=H=L=P=T=",
        "1#1(1A1R1W1",
        "pa-Arab-PK",
        "3!4&4K4R4",
        "WdsSetupLogMessageW",
        "sr-Latn-CS",
        "already exists",
        "uKj-X",
        "SYSTEMROOT",
        "fr-RE",
        ".text$mn$01",
        "base\\Eco\\WDS\\wdslib\\xml\\XmlDocument.h",
        "0'0A0X0r0",
        "ControlSet%03u",
        "pwszBiosVersion",
        "RtlAllocateHeap",
        "MACHINE_OU",
        "-> WdsCliObtainDriverPackagesEx",
        "QQSVW3",
        "Kernel32",
        "AdvancedTca",
        "WdsCliCreateSessionEx",
        "VERSION/MAJOR",
        "1/0-0",
        "9K:b:g:",
        "ta-LK",
        "8$848;8C8T8[8c8o8x8",
        "uNamespaceContentSize",
        "5.5\\5t5",
        "CloseThreadpoolWork",
        "707T7",
        "40565w5",
        "InstallLanguage",
        ".?AVbad_alloc@std@@",
        "WdsCliGetImageFiles",
        "D$thp9",
        "UuidToStringW",
        "1V2]2o2t2",
        "Microsoft\\Windows NT\\CurrentVersion",
        "7)7Y7z7",
        "_onexit",
        "9,:N:",
        "Created new session.  Caller handle: 0x%08x, MC Client handle: 0x%08x",
        "-> WdsCliCancelTransfer",
        ".?AVCWdsComMetadataEntry@@",
        "dockingstation",
        "<FALLBACK LANGUAGE=\"%s\">%s</FALLBACK>",
        "base\\eco\\wds\\lib\\ddp\\wdsmachineinfo\\src\\wdsmachineinfo.cpp",
        "t(f98t#",
        ":(:,:H:L:P:T:h:l:",
        "030N0",
        "UnknownChassis",
        "4.5:5",
        "0E1q1",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\netaddr.cpp",
        "RtlInitUnicodeString",
        "WdsCliGetImageLanguage",
        "5S5~5",
        "9,9o9",
        "5*646w6",
        "(SVWj",
        "quz-BO",
        "eu-ES",
        "WDS.Client.Driver.Path",
        "0)080B0c0m0",
        "pwszImageGroup",
        "CompactPci",
        "bs-Cyrl-BA",
        "WdsImgOpenImage",
        "Microsoft Corporation1(0&",
        "9'9.94999D9Q9e9",
        "LegalCopyright",
        "FIRMWARE",
        "7;7Z7j7",
        "Expected 0 or 1 instances of Tag [%s]; received %u instances",
        ">*?S?X?y?",
        "Y__^[",
        "4%4/4",
        "<- CallbackTransportSessionComplete=%x",
        ".idata$3",
        "tzm-Latn-DZ",
        "626?6O6h6",
        "towlower",
        "1'2-2G2N2w2",
        "$`2X`F",
        "WDSCLIENTAPI.dll",
        "MESSAGE",
        "GetFileVersionInfoSizeExW",
        "[9w,t",
        "??1type_info@@UAE@XZ",
        "qps-plocm",
        "1I2V2p2",
        "WDSCORE.dll",
        "WDS.Client.Property.SMBIOS.Version",
        "NAMESPACE_SIZE_%u",
        "5-525U5d5i5",
        "|hK,_",
        "WIM image requires more than one reference file (count=%u); not supported",
        "RETAIL ASSERT",
        "6;6E6c6m6",
        "<WDSMachineInfo/>",
        "uz-Latn",
        "EventRegister",
        "BiosVendor",
        "IMAGE_GROUP",
        "D$(Ph",
        "LookupPrivilegeValueW",
        "u%9_ ",
        "SetupDiDestroyDeviceInfoList",
        "<$<0<<<H<T<`<l<x<",
        "wcsncat_s",
        ">@>N>~>",
        ".edata",
        "<- WdsCliObtainDriverPackages=%x",
        "3!3>3H3s3",
        "=$=+=<=C=T=[=l=s=",
        "2;3^3e3o3",
        "sd-Arab-PK",
        "QQSVWjl",
        "u$j|h",
        "es-EC",
        "nso-ZA",
        "RegOpenKeyExW",
        "5%5Q5[5q5v5",
        "979Z9~9",
        "Notebook",
        ".00cfg",
        "Current",
        "PPPPW",
        ":X;q;",
        "j]Yf9",
        "<0<:<e<o<",
        "he-IL",
        "ar-LY",
        "D$(j@P",
        "6P6Z6~6",
        "\\system32\\kernel32.dll",
        "7X7c7r7",
        "0;0E0n0x0",
        "PPPhBMSR",
        "304e4",
        "GetCurrentThread",
        "base\\eco\\wds\\clientapi\\client\\src\\handle.cpp",
        "#Vx\"&6",
        "%s=%s",
        "0 020@0J0",
        "ar-QA",
        "WdsCliGetImageParameter",
        "StorageChassis",
        ".data$brc",
        "404g4q4",
        "CoCreateInstance",
        "EventWriteTransfer",
        "Microsoft Time-Stamp PCA 2010",
        "?$?2?",
        "0.131g1n1",
        ".?AVCComObjectRootBase@ATL@@",
        "0+040G0L0{0",
        "j.Yf9",
        "sr-Cyrl",
        "Legal_Policy_Statement",
        "ar-TN",
        "__CxxFrameHandler3",
        "_wcsnicmp",
        "nl-NL",
        "pa-IN",
        "WdsCliGetDomainJoinInformation",
        "uz-Latn-UZ",
        "Equal",
        "151p1",
        "dv-MV",
        "WdsCliFilterImageFirmwareType",
        "DateAddedToStore",
        "WSASocketW",
        "Cj-Zf;",
        "LanguagePacks/LanguagePack",
        "CLIENT_GUID",
        "1(0&0",
        "4#4;4]4y4",
        "ProcessReceiveMessage",
        "x=[4n",
        "hsb-DE",
        "4c4m4",
        "WINDOWS",
        "PWj h(:",
        "?$?0?<?H?T?`?l?x?",
        "Received session start callback for session 0x%08x",
        "XML_%u",
        "XPSSh",
        "=*=U=f=~=",
        "=*>U>",
        "UUID Info = %s",
        "Microsoft Code Signing PCA 20100",
        "8C8m8w8",
        "D$H)F<B",
        "LoadLibraryW",
        "SetUnhandledExceptionFilter",
        "SessionCancel",
        "4$4S4X4",
        "<&<m<",
        "COM Error: '%s'",
        "_XcaF",
        "tOVVj",
        "7Z>@B1",
        "D$L;T$8r",
        "RESOURCEFILEPATH_%u",
        ";AllOf",
        "u}9G(v@",
        "141E1V1",
        "WDS_TRACING_%u",
        "=&=0=S=]=",
        "WdsClientInitializeLibrary",
        ">:>t>",
        "H ;x(r",
        "pwszInfFilePath",
        "arn-CL",
        "<Invalid>",
        "D$$hhz",
        "5$505<5H5T5`5l5x5",
        "WdsTransportConsumerCancelSession",
        "0(1-1",
        "WdsCliGetImageVersion",
        "WdsCliGetUnattendVariables",
        ".?AV?$CComObject@VCWdsComMetadataBuilder@@@ATL@@",
        "lowprofiledesktop",
        "iu-Cans-CA",
        "9_$ve",
        "st-ZA",
        ".CRT$XIZ",
        "<- WdsCliObtainDriverPackagesEx=%x",
        "CompanyName",
        "5+575<5W5",
        "GetComputerNameW",
        "NtUnloadKey2",
        " !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~",
        "3,3R3h3",
        ":2;B;[;s;",
        "de-LU",
        "sealedcasecomputer",
        ": :F:O:V:`:",
        "8>8E8W8f8",
        "WdsCliGetImageNamespace",
        ";\\$(r",
        "PWj h",
        "9D$8u",
        "7 7,787D7P7\\7h7t7",
        ">H>^>s>",
        "CreateFileW",
        "pSmbiosInfo",
        "SetFilePointerEx",
        "FIRSTNAME",
        "sk-SK",
        "wd9wht",
        "Xml Failure: ",
        "8E8\\8",
        "wcsrchr",
        ".text",
        "es-CO",
        "en-PH",
        "fr-CI",
        ";6;V;",
        "?-?7?",
        "portable",
        "%s: failing with error 0x%08x",
        "6\\7|7",
        "Microsoft Corporation1-0+",
        "808?8Y8t8",
        "ba-RU",
        "SubChassis",
        "0@0t0",
        "-----------------------------------------------------------------",
        "9~ vG",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "5G6g6",
        "-> WdsCliWaitForTransfer",
        "10.0.19041.572",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "base\\eco\\wds\\clientapi\\client\\src\\metadata.cpp",
        "j:^f9",
        "WdsCliFindFirstImage",
        "CompatibleIds/CPID",
        "handheld",
        "DeviceList.Identifier",
        "8N9i9",
        "p0123456789abcdefABCDEF",
        "WDS.Client.Unattend.Override",
        "2.252}2",
        "WdsCliGetImageIndex",
        "9.:8:",
        "WDS.Client.InstallImageChoice",
        "spacesaving",
        "050E0X0c0s0y0",
        "advancedtca",
        "3G4m4",
        "<- CallbackTransportSessionStart=%x",
        "s V9x",
        "SetFileAttributesW",
        "co-FR",
        "iswdigit",
        "_vsnwprintf",
        "444>4U4\\4b4g4r4|4",
        "-> CallbackTransportSessionComplete",
        ";O;o;v;",
        "{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}",
        "00070F0W0`0e0j0r0",
        "WdsCliFreeDomainJoinInformation",
        "Microsoft Corporation1200",
        "bEnabled",
        "WdsCliGetImagePath",
        "BusExpansionChassis",
        "9Y:`:",
        "9<9A9",
        "4Y4f4",
        ":;:Y:c:",
        "5(5,5H5L5P5T5h5l5",
        "ar-JO",
        "HeapAlloc",
        "<#=_=",
        "WDS.Client.InstallImage.Path",
        "<- WdsCliRegisterTrace=%x",
        "VPhXE",
        "sr-Latn-ME",
        "j.Xf;F",
        "{aed06655-9679-4b3d-bec2-68eb3234e6a7}",
        "QueryPerformanceCounter",
        "WDS.Device.ID",
        "SleepConditionVariableSRW",
        "D$ ;A(s",
        "$Microsoft Ireland Operations Limited1",
        "Metadata tag [%s] was specified, but it is not allowed when account %s",
        "ug-CN",
        "th-TH",
        "sms-FI",
        ">$>.>P>W>a>",
        "peripheralchassis",
        "j\\Xf9",
        ";(;,;H;L;P;T;h;l;",
        "sd-Deva-IN",
        "WdsCliFilterImageArchitecture",
        "Tower",
        "pt-BR",
        ".CRT$XCZ",
        "PVj h\\;",
        "toupper",
        "D$8;C",
        "C;^(r",
        "en-029",
        "MetadataRS",
        "be-BY",
        "ne-IN",
        "SessionComplete",
        "D$HP3",
        "CreateEventW",
        "6q7{7",
        "de-DE",
        "WdsClientSessionExecute",
        "CurrentMajorVersionNumber",
        ":6;@;i;t;",
        "1U1i1n1",
        "MinorVersion",
        "ti-ET",
        "2(2,20242H2L2h2l2p2t2",
        "es-419",
        "sa-IN",
        "WdsClientApi.dll",
        "WDS.Client.Request.Version",
        "??0exception@@QAE@XZ",
        "PizzaBox",
        "<<<A<m<y<",
        "WDSDDP_DRIVER_PACKAGE",
        "tVV9_",
        "<><L<V<",
        "9^(v:",
        "ar-SY",
        "9C0vc",
        "wPf92tK",
        "mainsystemchassis",
        "WdsCliGetImageSize",
        ".text$yd",
        "HardwareIds",
        "j\\_f9>u",
        ".CRT$XIAA",
        "_get_errno",
        "quc-Latn-GT",
        ">-?7?R?h?",
        "ar-YE",
        "2B2H2V2`2f2l2",
        "j\\Zf;Ty",
        "9(9?9F9\\9c9y9",
        "3&33383=3E3V3]3p3",
        "DeleteFileW",
        "Count",
        "j\\Zf9TA",
        "WdsCliGetImageLanguages",
        "pEntry",
        "1Z1d1",
        "WWWPW",
        "PrivilegeCheck",
        "??0exception@@QAE@ABV0@@Z",
        "RegCloseKey",
        "7'7`7q7",
        "2k2p2",
        "UNATTEND_MODE",
        "6\"6p6|6",
        "ii-CN",
        "3#3.3;3I3O3]3r3",
        "j0Yf;",
        "ro-RO",
        "5,51585=5E5Q5Y5e5o5w5~5",
        "en-AU",
        "GetProcAddress",
        "<D<c<h<|<",
        "<error>",
        "FindClose",
        "CompareFileTime",
        "t$0Sh ",
        "InitializeCriticalSection",
        "9/:G:",
        "DataMgrSetDeleteOnClose",
        "D$$9A",
        "<-<M<",
        "Unable to retrieve the raw SMBIOS table: %d",
        "Microsoft Corporation1&0$",
        "GetModuleFileNameW",
        "wVj.f",
        "j5Xf;E",
        "!F0@9E",
        "3'3N3X3",
        "Failed to deserialize member: %s",
        "qps-ploc",
        "bad allocation",
        "WdsCliSetSupportedFeatures",
        "ReleaseSRWLockExclusive",
        ">0?M?T?^?t?",
        ".CRT$XCU",
        "PeripheralChassis",
        "bs-Latn-BA",
        "M QRSP",
        "MACHINE_NAME",
        "SetupDiGetDeviceInstanceIdW",
        "6O6|6",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\wdsmgmtutil.cpp",
        "8?8I8",
        "zh-Hant",
        "MsgQueueCreate",
        ";2;L;`;",
        "3Q3e3~3",
        "gd-GB",
        ":o:v:|:",
        "210303182929Z0t1",
        "9~ v;",
        ".?AVexception@@",
        "WdsCpParameterAdd",
        ":2:<:|:",
        "CWdsMiDevice::LogW",
        "DeviceQuery.NamePattern",
        "Controller",
        ".data",
        "9':,:G:T:q:",
        "<2=>=H=x=",
        ".?AV?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL@@",
        "MsgQueueNotifySessionStart",
        ";/;E;N;g;",
        " Windows",
        "WDSMachineInfo/SmbiosInfo",
        "9(9,9H9L9P9T9h9l9",
        ";Cpv ",
        "6'7H8R8",
        "9G vi",
        ":3;B;M;_;",
        "6@6S6X6l6",
        "WdsTransportClientRegisterCallback",
        "es-US",
        "CWdsMachineInfo::LogW",
        "Laptop",
        "210121231915Z0",
        "WDS.Client.JoinDomain.Account.Exists",
        "es-AR",
        "SVWt^",
        "5%6S6X6q6",
        "6+7C7[7",
        "InstallationType",
        "=1===G=v={=",
        "3*3s3",
        "WdsCliGetEnumerationFlags",
        "rw-RW",
        "wcsncmp",
        "hu-HU",
        "WdsCpParameterValidate",
        "DeviceList.Offset",
        "WdsImgClose",
        "=H>}>",
        "9*9<9b9w9|9",
        ".?AUIWdsMetadata@@",
        "haw-US",
        "az-Cyrl",
        "\\StringFileInfo\\%04x%04x\\%s",
        "%s=%u/%u/%u:%u:%u:%u.%u",
        "zh-Hans",
        "<;<P<",
        "$SVWj",
        "ff-Latn-NG",
        "ppwszDepFiles",
        "SessionGetClientHandle",
        "Sleep",
        "tg-Cyrl-TJ",
        "?;?Q?",
        "zh-HK",
        "RegEnumValueW",
        "250706205017Z0~1",
        ">'>=>h>",
        "WdsCliTransferImage",
        "sr-Cyrl-CS",
        "GetCurrentProcessId",
        "-> pWdsCliObtainDriverPackages",
        "VerQueryValueW",
        "100706204017Z",
        "9::D:",
        "ru-RU",
        "RegFlushKey",
        "MPR.dll",
        "SessionCreate",
        "lv-LV",
        "8 999f9",
        ">8>B>`>j>",
        "Chassis Type %d = %d",
        "VERSION/MINOR",
        "se-NO",
        "ks-Arab",
        "6.6y6",
        "?\"?-?I?^?d?i?",
        ":J:s:",
        "PRODUCTNAME",
        "<- ConvertMachineInfo=%x",
        ";(;4;@;L;X;d;p;|;",
        "WDS.Client.Property.SMBIOS.Model",
        "br-FR",
        "WDSMachineInfo/Devices",
        "Res.rwm",
        "WdsCliGetTransferSize",
        "WDS.Client.Property.Firmware.Type",
        "subchassis",
        ".idata$4",
        "CurrentMinorVersionNumber",
        "SpaceSaving",
        "\\\\?\\UNC",
        "ga-IE",
        "en-GB",
        "base\\eco\\wds\\wdslib\\xml\\xmlnodelist.cpp",
        "jthXG",
        "ks-Deva-IN",
        "GetFileAttributesExW",
        "bn-BD",
        "ARCHITECTURE",
        "Microsoft Corporation0",
        "SessionInsertMessage",
        "base\\Eco\\WDS\\wdslib\\xml\\XmlNode.h",
        "base\\eco\\wds\\clientapi\\client\\src\\client.cpp",
        "KnILk",
        "hr-BA",
        "Control\\Nls\\Language",
        "el-GR",
        "es-PR",
        "; ;8;<;T;X;p;t;",
        "D$ Ph",
        ".CRT$XIA",
        "5/595]5",
        "8K8X8",
        "IMGSRV_IMAGE",
        "4.434?4",
        "_wcsupr",
        "pap-029",
        "?0F0Z0",
        "ko-KR",
        "zh-CN",
        "2$202<2H2T2`2l2x2",
        "WdsCliClose",
        "D$$;D$0",
        "chr-Cher",
        "8#8o8z8",
        "?what@exception@@UBEPBDXZ",
        "de-AT",
        "es-PE",
        "?\"?K?z?",
        "es-PY",
        "FindFirstFileW",
        ".rdata",
        ";-;O;Y;y;~;",
        "<*<O<T<n<",
        ";G<s<",
        "-> WdsCliTransferFile",
        ".text$di",
        "2 2@2Q2\\2",
        "uExFlags",
        "D$TPQQ",
        "ExFlags",
        "SPBUILD",
        "SetupDiEnumDeviceInfo",
        "OriginalFilename",
        ";*<M<T<^<t<",
        "desktop",
        "smj-SE",
        "quz-EC",
        "Model",
        "az-Latn",
        "_CxxThrowException",
        "= =r=",
        "base\\eco\\wds\\lib\\metadata\\com\\wdscommetadataentry.cpp",
        "0.0<0B0G0u0|0",
        "se-FI",
        "ca-ES",
        "base\\eco\\wds\\lib\\metadata\\com\\wdsdevicecontrollerclient.cpp",
        "ProcessStartMessage",
        "WdsCpPacketGetBuffer",
        ".?AVIWdsDeviceControllerClient@@",
        "ar-LB",
        "ur-IN",
        "pl-PL",
        "@.reloc",
        "~09~8t",
        "WdsCliInitializeLog",
        "moh-CA",
        "t(PhPQ",
        "WDS.Client.QueryImageServer",
        ".?AVCWdsComMetadata@@",
        "pwszModel",
        "t>j.W",
        "829r9",
        "WdsTransportClientShutdown",
        "WdsClientSessionCreate",
        "WorkerThread",
        "RtlFreeHeap",
        "WDS.Client.JoinDomain",
        "DepFiles",
        "D$(9G",
        "si-LK",
        "bin-NG",
        "{bf1a281b-ad7b-4476-ac95-f47682990ce7}",
        " j,WV",
        "tLQQj",
        "WdsCliGetImageArchitecture",
        "_callnewh",
        "?+?>?G?X?{?",
        "TRANSACTION_ID",
        "0123456789",
        "0_1i1",
        "fr-ML",
        "9$909<9H9T9`9l9x9",
        "ThreadPoolEnqueueWorkItem",
        "828;8F8w8",
        "bn-IN",
        "ATL$__z",
        "SOFTWARE",
        "3M3i3",
        "556;6k6",
        "<- pWdsCliObtainDriverPackages=%x",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "tn-ZA",
        "ru-MD",
        "prs-AF",
        "MsgQueueWorkerThread",
        "%s\\ControlSet%03u",
        ":8:?:H:`:",
        "t#;_ s",
        "7.7k7q7",
        "TargetOsInfo",
        "pwszSourceFile",
        "Select",
        "wprintf",
        "MultiByteToWideChar",
        "959:9X9g9",
        "0G0~0",
        "en-NZ",
        "RevertToSelf",
        "@.rsrc",
        "memcmp",
        "az-Latn-AZ",
        "chr-Cher-US",
        "base\\eco\\wds\\lib\\ddp\\wdsmachineinfo\\src\\wdsmidevice.cpp",
        "9^Tt~3",
        "Microsoft Time-Stamp PCA 20100",
        "sl-SI",
        "pwszResourceFilePath",
        "fr-BE",
        "%s\\Select",
        "?5?J?i?s?",
        "CloseThreadpool",
        "w2t,-L",
        "pwszLocaleName",
        "Unable to retrieve the SMBIOS Manufacturer information.",
        "Control\\Windows",
        "Portable",
        ">T>|>",
        "WdsTransportConsumerStartSession",
        ".idata$2",
        "2:3N3",
        ">1><>",
        ".CRT$XCL",
        "8I8v8",
        "DRIVER PACKAGE NAME",
        "EditionID",
        "WdsCliGetDriverQueryXml",
        "WDSDDP_DEVICE",
        ">l?r?",
        "y7Vh`~",
        "9\\$ t",
        "Sending metadata server request; %u entries.",
        "LeaveCriticalSection",
        "en-ZA",
        "LANGUAGE",
        "GetEnvironmentVariableW",
        "SETUPAPI.dll",
        "%s%s%s",
        ">.><>F>y>",
        ";$;-;9;E;};",
        "8-848]8",
        "pwszFriendlyName",
        ".rdata$T$brc",
        "{7ebc3661-e661-4943-95a5-412378cb16d1}",
        "<U=_=",
        "ProductVersion",
        "ThreadPoolCreate",
        "2$2K2c2w2|2",
        "2c2w2",
        "7 8K8U8",
        "1)1/1=1C1H1",
        "9,:S:",
        "<#<p<",
        "kn-IN",
        "base\\eco\\wds\\lib\\ddp\\marshall\\ddpcontrolpacket.cpp",
        "WdsCliResetBootProgram",
        "=H>]>h>",
        "Image SP Build Info = %d",
        "en-ID",
        "dwDetails",
        "VS_VERSION_INFO",
        "3O3r3y3",
        "ms-BN",
        "ar-IQ",
        "af-ZA",
        "OutputDebugStringW",
        "sma-SE",
        "8$8u8",
        "OLEAUT32.dll",
        "O0M0K",
        "DeviceExists",
        "ClassGuid",
        "uz-Cyrl-UZ",
        "WDS.Client.Property.Architecture.Process",
        "mn-MN",
        ";[u_f",
        "00000000000000000000",
        "VERSION.dll",
        ".ResourcePath",
        "LANGUAGES",
        "Build",
        "Default",
        "1(292M2Z2",
        ".rdata$r$brc",
        "!p!q!r!s!t!u!v!w!x!y!z!{!|!}!~!",
        "191023231915Z",
        "tLPPj",
        "6 6,686D6P6\\6h6t6",
        "LANGUAGES/LANGUAGE",
        "WdsCliLog",
        "1!2*22292@2J2h2",
        "4=4`4n4",
        "qps-Latn-x-sh",
        ";G spk",
        "PRODUCTTYPE",
        "base\\eco\\wds\\clientapi\\client\\src\\drivers.cpp",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        ">.?8?R?^?d?u?",
        ";\";2;v;",
        "    %s",
        ":0:D:I:",
        "base\\eco\\wds\\wdscsl\\lib\\controlpacket.cpp",
        "7U7r7",
        "8+959J9Z9e9z9",
        "SYSTEM",
        "PXEv6 Error: DUID-LL truncated at length %Iu, require %Iu",
        "so-SO",
        "mn-Mong",
        "pwszEdition",
        "ChassisType",
        ">(>4>@>L>X>d>p>|>",
        "Thales TSS ESN:8D41-4BF7-B3B71%0#",
        "SHLWAPI.dll",
        "ha-Latn",
        "1,111",
        "pwszManufacturerName",
        "sv-FI",
        "8(8,8H8L8P8T8h8l8",
        "u>9{ u",
        "?!?&?W?\\?",
        "HardwareIds/HWID",
        "LessThanOrEqual",
        ".rsrc$01",
        ">w>}>",
        "5&545H5Z5a5g5l5w5",
        "_vsnprintf",
        "tQPPj",
        "_unlock",
        "5G5Q5",
        "00050\\0a0v0",
        "fr-CH",
        "Version",
        "AllInOne",
        "base\\eco\\wds\\lib\\ddp\\wdsmachineinfo\\src\\wdsmismbiosinfo.cpp",
        "WdsClientFreeLibrary",
        "dwMajorVersion",
        "iu-Cans",
        ".gfids",
        "compactpci",
        "zh-TW",
        "sr-Cyrl-ME",
        "FLAGS",
        ".rsrc$02",
        "9\"919B9X9",
        "GetLastError",
        "5A5F5\\5",
        "WDSDDP_SMBIOS_INFO",
        ";2;[;g;u;|;",
        "GetTempFileNameW",
        "LASTNAME",
        "en-JM",
        "=\">T>[>",
        "20201009085628Z0w0=",
        "Compatible Id [%d]=%s",
        "j/Zf;",
        "WdsOsInfo",
        "se-SE",
        "en-BZ",
        "ntdll.dll",
        "Normaliz.dll",
        "SubmitThreadpoolWork",
        "1-161C1_1d1",
        "_amsg_exit",
        "es-CU",
        "es-GT",
        "da-DK",
        "6$606<6H6T6`6l6x6",
        "WDS_TRACING_CONSOLE_OUTPUT",
        "ta-IN",
        "4*414;4Q4",
        "3*333=3U3}3",
        "Microsoft",
        "MACHINEOU",
        "unknownchassis",
        "CSDVersion",
        "<- WdsClipTransferNextFile=%x",
        "ku-Arab",
        "minitower",
        "4%40474=4G4V4^4j4o4u4",
        "ti-ER",
        "SERVICINGDATA",
        "UnhandledExceptionFilter",
        ";-<7<L<\\<g<",
        "__dllonexit",
        "D$ 9A(",
        "1G1]1h1",
        "en-TT",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\deviceid.cpp",
        "DeviceModificationType",
        "<(<,<H<L<P<T<h<l<",
        "1#1S1i1",
        "busexpansionchassis",
        "EDITIONID",
        "m_uLockCount == 0",
        "uk-UA",
        "WdsCliGetImageHandleFromTransferHandle",
        "ERROR_CODE",
        "PXEv6 Warning: DUID-LL unexpected hardware address length %u",
        "NtQuerySystemInformation",
        "7/797w7|7",
        "DeviceInstanceId",
        "RegUnLoadKeyW",
        "6-737d7",
        "WDS.Client.JoinDomain.Machine.OU",
        "advapi32",
        "3'3}3",
        "Drivers",
        "2W2[2_2c2g2k2o2s2",
        "j-Yf9",
        "kr-Latn-NG",
        "4C4L4g4",
        "pwszDeviceDescription",
        "2#2U2Z2g2q2",
        "2/373B3O3l3u3",
        "TIMEZONE",
        "040:0",
        "GetFullPathNameW",
        "666D6N6o6z6",
        "SYSTEMTIME",
        ".giats",
        "ResPath",
        "DataMgrIoCompletion",
        "qsort_s",
        "en-SG",
        "uz-Cyrl",
        "<%s>%s</%s>",
        "base\\eco\\wds\\wdscsl\\lib\\serialize.cpp",
        "Metadata",
        "ar-BH",
        "G ;_(r",
        "WdsCliFilterImageVersion",
        "0K1n1z1",
        "WdsCliSimulateArchitecture",
        "\\system32\\ntoskrnl.exe",
        "0q0{0",
        "HSVW3",
        "ExpansionChassis",
        ")Microsoft Root Certificate Authority 20100",
        "<Y<|<",
        "WdsImgGetXml",
        "en-IE",
        "sq-AL",
        "========================",
        "AcquireSRWLockExclusive",
        "3J4y4",
        "100701213655Z",
        "iu-Latn-CA",
        "WdsCliAuthorizeSession",
        "es-PA",
        "WaitForSingleObject",
        "MdGuid",
        "WDSDDP_DRIVER",
        "VERSION/SPBUILD",
        "FindNextFileW",
        "465Y5`5j5",
        ":!;(;V;_;~;",
        "<<=v=",
        "pTargetOsInfo",
        "lunchbox",
        "OutputDebugStringA",
        "zh-SG",
        "en-IN",
        "4 4,484D4P4\\4h4t4",
        "RaiseException",
        "Manufacturer",
        "SetEnvironmentVariableW",
        "Desktop",
        "3B4H4x4",
        "647;7j7v7",
        "4)4Z4g4z4",
        "fy-NL",
        "9#:-:",
        "fo-FO",
        "8@8G8Q8g8",
        "Microsoft\\Windows\\CurrentVersion\\Setup\\ImageServicingData",
        ":5:`:",
        "om-ET",
        "base\\eco\\wds\\clientapi\\client\\src\\utils.cpp",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\fileutil.cpp",
        "j._f;",
        "Fonecore\\base\\eco\\wds\\wdslib\\common\\src\\wdsidn.cpp",
        ";G s>k",
        "Architecture",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "D$ Pj",
        "_wcsicmp",
        "Model Info = %s",
        "QQSV3",
        ".idata",
        "GetFileAttributesW",
        "it-CH",
        "fr-LU",
        "PVj h$<",
        "10.0.19041.572 (WinBuild.160101.0800)",
        "T$(;T$8",
        "laptop",
        "=!=7=e=}=",
        ":!:E:`:t:y:",
        "<H<V<w<",
        "9\\$$t",
        "\\system32\\csrss.exe",
        "Windows Deployment Services Client API Library",
        "QSVW3",
        "Edition",
        "ProcessCompleteMessage",
        "smn-FI",
        "es-ES",
        "0123456789ABCDEF",
        "Unable to retrieve the SMBIOS information.",
        "Successfully completed metadata server request; %u entries.",
        "de-LI",
        "SessionRegisterCallback",
        "lb-LU",
        "es-NI",
        "WSAIoctl",
        "5<5C5~5",
        "ReadFile",
        "? ?+?6?e?",
        "WdsCliTransferFile",
        "ChassisTypes/ChassisType",
        "6$6.6J6t6",
        ":Z:r:}:",
        "1S1X1",
        "<- WdsCliTransferImage=%x",
        "WDSInitializeEmptyImageInformation",
        "WNetCancelConnection2W",
        "rm-CH",
        "T$8f;",
        "3#3,393c3h3",
        "WDS.Client.Version",
        "> ?*?`?j?",
        "ar-AE",
        "MsgQueueRegisterCallback",
        "9\\$0t",
        "PXEv6 Error: DUID-EN truncated at length %Iu, require %Iu",
        "Writing data to offset %08x'%08x",
        "7&7p7",
        "ThreadPoolCleanupOutstandingWork",
        "pwszHardwareId",
        "989E9",
        "485=5",
        "<- WdsCliWaitForTransfer=%x",
        "FileTimeToSystemTime",
        "WDS.Client.Property.Architecture.Native",
        "onecore\\base\\Eco\\WDS\\wdslib\\common\\inc\\BufferedFileWriter.h",
        "2 2$2~2",
        "towupper",
        "gu-IN",
        "4 4F4j4",
        "KERNEL32.dll",
        ";1;T;^;",
        ".Display.Name",
        "WdsCliConnectToImageStore",
        "mn-Mong-MN",
        "CLIENT_UUID",
        "Index",
        "-> CallbackTransportProgress",
        "DockingStation",
        "smj-NO",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\trace.cpp",
        " !\"#$%&'()*+,-./0123456789",
        "CopyFileW",
        "<6<@<v<",
        "8(848@8L8X8d8p8|8",
        "SetEvent",
        "DataMgrWriteFile",
        "-> WdsCliRegisterTrace",
        ";\";.;?;G;Z;f;n;",
        "PXEv6 Warning: DUID-LL unrecognized hardware type %u",
        "WDS.Client.QueryDDPServer",
        "SmbiosInfo",
        "PXEv6 Error: Received DUID of length %Iu, minimum size %Iu",
        "u+k_ ",
        "QQSVW",
        "C$jZh",
        "CopyFileExW",
        "WDSTPTC.dll",
        "51696?6Y6",
        "ff-Latn",
        "GetSystemFirmwareTable",
        "base\\eco\\wds\\lib\\metadata\\com\\wdsdevicecontrollerpacket.cpp",
        "RtlAdjustPrivilege",
        "Other",
        "fil-PH",
        ".text$mn",
        "8,8B8^8i8",
        "Image Architecture = %d",
        "RpcStringFreeW",
        "% moa",
        "Total Number of Devices=%d.",
        "WDS.Client.Host.Version",
        "The WDS server does not not support metadata queries.",
        "PXEv6 Error: DUID-LLT truncated at length %Iu; require %Iu",
        "5!5f5t5z5",
        "syr-SY",
        "base\\eco\\wds\\lib\\metadata\\com\\wdscommetadatabuilder.cpp",
        "= =,=8=D=P=\\=h=t=",
        ">\"?)?5?<?t?",
        "es-UY",
        "WDS.Request.Type",
        "2\"24292^2p2}2",
        "base\\eco\\wds\\lib\\metadata\\com\\wdsremotedevicecontrollerclient.cpp",
        "BRANCH",
        "1!1G1U1[1`1",
        "base\\eco\\wds\\wdslib\\xml\\xmlnode.cpp",
        "base\\eco\\wds\\lib\\metadata\\com\\wdscommetadata.cpp",
        "es-CR",
        "Device Information",
        "WdsCliFilterImageVersionMatchingBootImage",
        "es-VE",
        "=F=^=i=z=",
        "6@7r7",
        "sr-Latn-RS",
        "171F1U1`1z1",
        "hr-HR",
        "bSignatureValid",
        "WdsTransportClientInitialize",
        "2b2q2{2",
        "7L7P7p7",
        "PVj ht;",
        "RPCRT4.dll",
        "1O1p1",
        "7%7G7",
        "<+=H=O=Y=o=",
        "T$,SVW",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\winsockinitializer.cpp",
        "G,;G$rHw",
        "MajorVersion",
        "2m3~3",
        "NotMatchesPattern",
        "GetCurrentProcess",
        "WdsCpParameterQuery",
        "61686B6X6",
        "VWj\\_3",
        "en-US",
        "sv-SE",
        "MainSystemChassis",
        "?T?w?~?",
        "Unknown",
        "WDS_TRACING_DEBUGGER_OUTPUT",
        "WdsTransportClientCancelSessionEx",
        ">K>]>k>x>",
        "889<9@9D9P9l9",
        "APPID",
        "3e3{3",
        "WDSFreeImageInformation",
        "[%S:%u] Expression: %S, hr=0x%x",
        "WDS.Client.InstallImage",
        "WdsCliGetImageName",
        " Operating System",
        "SetupDiGetClassDevsW",
        "<9=@=|=",
        "BuildLab",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "_initterm",
        "7(7/797l7s7}7",
        "qps-ploca",
        "MACHINEDOMAIN",
        "MatchingDeviceId",
        "828<8",
        "6(6-6P6_6d6",
        "SetLastError",
        "sah-RU",
        "040V0[0",
        ">http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0",
        "> ?+?7?Z?",
        "202]2",
        "oK0D$\"<",
        "_lock",
        ":7;A;t;~;",
        "9?:\\:c:m:",
        ".rdata$brc",
        "WdsCliObtainDriverPackagesEx",
        "Microsoft Code Signing PCA 2010",
        "DeviceDescription",
        "DEFAULT",
        "it-IT",
        "5&5C5M5",
        "z.9Wv",
        "t]f9Ls",
        "does not exist",
        "364@4f4p4",
        "8#8-828",
        "4#4J4V4c4k4",
        "D$0Pj",
        ".?AVCWdsComMetadataBuilder@@",
        "WDSCSL.dll",
        "=\">->L>",
        "9/:^:k:",
        "5K5d5",
        "Entry %s is of type %s; expected %s",
        "f;L$8t",
        "en-MY",
        "ImpersonateLoggedOnUser",
        "dwMinorVersion",
        "DSVW3",
        "GetProcessAffinityMask",
        "GetFileVersionInfoExW",
        "pwszDeviceInstanceId",
        "WDS.Client.Property.SMBIOS.UUID",
        "ar-OM",
        "6 6q6v6",
        "DataMgrSetFileSize",
        "959<9F9K9",
        "INDEX_%u",
        "3(3,383H3L3P3T3h3l3",
        "onecore\\internal\\base\\inc\\private\\eco\\wds\\locks.h",
        "=X=i=s=",
        "ps-AF",
        "Manufacturer Info = %s",
        "WdsTransportClientAddRefBuffer",
        "?-?y?",
        "NAMESPACE_NAME",
        "! !!!\"!#!$!%!&!'!(!)!*!+!,!-!.!/!0!1!2!3!4!5!6!7!8!9!:!;!<!=!>!?!@!A!B!C!D!E!F!G!H!I!J!K!L!M!N!O!P!Q!R!S!T!U!V!W!X!Y!Z![!\\!]!^!_!p!q!r!s!t!u!v!w!x!y!z!{!|!}!~!",
        "tPPPj",
        "2 2&2.2;2F2S2\\2b2j2w2}2",
        "6W6e6v6|6",
        "9*9F9T9^9r9w9",
        "fr-CM",
        "====================",
        "<0<N<X<f<",
        "4,515D5I5r5",
        "LunchBox",
        "WdsCliGetImageType",
        "vi-VN",
        "subnotebook",
        "f;D$ t>",
        "282M2R2",
        "2O3Y3",
        "D$|W3",
        "kl-GL",
        "EventWrite",
        "WdsTransportClientStartSession",
        "?8?^?",
        ".rdata$sxdata",
        "7.7U7_7{7",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\bufferedfilewriter.cpp",
        "WdsImage.dll",
        "=(=4=>=W=c=m=",
        "iswxdigit",
        "IMAGE LANGUAGE",
        "ne-NP",
        "GetSystemTimeAsFileTime",
        "memset",
        "_TmpHive_",
        "GetTickCount",
        "9^(v_",
        "CoInitializeEx",
        "mn-Cyrl",
        "allinone",
        "<- WdsCliTransferFile=%x",
        "id-ID",
        "pwszPackagePath",
        "PVh0$",
        ".?AVCWdsDeviceControllerClient@@",
        "=&=0=t=~=",
        "=K=U=_=l=",
        "SVWQj",
        "Q&{+w",
        "ProductName",
        "8[9~9",
        "sr-Latn-BA",
        "616:6K6W6",
        "K4;C u(;K$u#",
        "WdsCliGetImageLastModifiedTime",
        "CLSIDFromProgID",
        "%s\\%s",
        "DeviceQuery.Type",
        "151L1]1b1",
        "ExcludeIds",
        "WdsCliGetWimImageReferenceFile",
        "_except_handler4_common",
        "WDS.Client.JoinDomain.Machine.DN",
        "WdsCpPacketInitialize",
        "MAJOR",
        "<\"<)<0<7<><E<L<S<Z<a<h<o<v<}<",
        "6!6E6O6w6",
        ">\">7>T>~>",
        "wo-SN",
        "la-001",
        ";AtLeastOneOf",
        "2.2B2`2t2",
        "fa-IR",
        "4+4Q4[4r4y4",
        "1U1h1",
        "q(9>u",
        "9;:S:k:",
        "_wtoi",
        "ulProcessorArchitecture",
        "_set_errno",
        "u$jZh",
        "~&jW^h",
        "y Whh",
        "3K3U3",
        "1H2S2e2~2",
        "\\system32\\winpeshl.exe",
        "PVj h",
        "WdsCliGetDeploymentMetadataAvailable",
        ":8:L:f:z:",
        "=)=0=:=x=",
        "656;6G6r6{6",
        "I0G1-0+",
        "wcstol",
        "kk-KZ",
        "3 3,353:3@3J3T3d3t3z3",
        "0#070Z0a0v0}0",
        "WdsCliGetImageGroup",
        "080=0x0",
        "<- CallbackTransportProgress=%x",
        "WDS.Client.Request.ResendAuthenticated",
        ";@<$=K=X=^=c=~=",
        "CLIENT_MAC",
        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789.",
        " Microsoft Corporation. All rights reserved.",
        "SealedCaseComputer",
        "?2?F?K?[?`?|?",
        "OSVMn",
        "PVj hD;",
        "8 8+858H8P8W8]8b8m8",
        "2'3]3h3",
        "pwszNamespace",
        "SessionSetClientHandle",
        "%s%s%s%s=%s",
        "!This program cannot be run in DOS mode.",
        ">.?L?",
        "ku-Arab-IQ",
        "DataMgrCreateFile",
        "WdsCliFreeUnattendVariables",
        "zh-MO",
        "Line: %u",
        ";b<g<",
        "6#797X7u7",
        "D$PPhT:",
        "3I4u4",
        "LanguagePack",
        "mn-Mong-CN",
        "lt-LT",
        "687B7x7",
        "6K6]6h6",
        "?&?7???U?]?",
        "OpenThreadToken",
        "j\"Yj'Z",
        "OpenProcessToken",
        "0K0Z0",
        "CloseHandle",
        "6-626E6",
        "notebook",
        "as-IN",
        "4)434Y4c4",
        "WdsClientApi.pdb",
        "u PPP",
        "MiniTower",
        "mni-IN",
        "WriteFile",
        "SSSPS",
        "MatchesPattern",
        "WdsCliCancelTransfer",
        "WdsCliGetImageHalName",
        "T$(9T$8",
        "FileVersion",
        "G(;G r>Q",
        "WdsCliGetImageHandleFromFindHandle",
        "0 0,080D0P0\\0h0t0",
        "20201008073436.699Z0",
        "2+373A3g3s3}3",
        "=A>x>",
        "MACHINENAME",
        ".rdata$zzzdbg",
        "BIOS Version Info = %s",
        "646>6W6c6m6",
        "oc-FR",
        "757:7T7e7j7",
        "Unable to retrieve the BIOS Version information.",
        ".MulticastNamespace",
        ">#>D>Q>r>",
        "CompareStringW",
        ".Display.Description",
        "CreateThread"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "653b88be8d3cf06c7aba3ee0c308d9771d175d61816da523d2cbe5ef155b1495",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/653b88be8d3cf06c7aba3ee0c308d9771d175d61816da523d2cbe5ef155b1495",
              "guest_paths": [
                "overlay"
              ],
              "size": 8648,
              "crc32": "A65249E4",
              "md5": "e160d0d2f5ace6b3a7bc70eaa3e32f07",
              "sha1": "0893a2eaeef5084cfd7379a47f5c502f993bebf8",
              "sha256": "653b88be8d3cf06c7aba3ee0c308d9771d175d61816da523d2cbe5ef155b1495",
              "sha512": "18504d6b953208a3966e723acf74b9eca50a08681551c7b913084fe79c971e6b46635da1fd226408882a970b5d1296bca2ab805cc2d9e3f11712c116fab1a43b",
              "rh_hash": null,
              "ssdeep": "96:DGiiDEs3f0DHDsVBIwgmqvrnDD0ADEs3TDL2L4m2grMWaLNNDEs3r4X9Dm24DfOG:dWf9BvVVWQ4eWaMX+o7qnajOaFV9",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T1C7022AE2DE6C9543FA927D5053C8E9937C3D57D72910A0A612AEF4E82CC73D1EB0186E",
              "sha3_384": "8260093cd3a23500bf164df9f305cb6eea8d6443dd3f259ebea95b13c80a6869d4d100c0cf93265a0f38c7bf91c9b402",
              "data": null
            }
          ],
          "extracted_files_time": 0.000482801999169169,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "setupact.log"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/5852d0a081f42356cff2f1e45a0ab9127f23b0786d6e57353974fe3c6f54f572",
      "guest_paths": [
        "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
      ],
      "size": 6442,
      "crc32": "26E45795",
      "md5": "b61c4278ab2c8c3f0f032a8c9240d637",
      "sha1": "56c24124dbfa23f944c6a8f20848f2de781f1548",
      "sha256": "5852d0a081f42356cff2f1e45a0ab9127f23b0786d6e57353974fe3c6f54f572",
      "sha512": "7b4777c7f8bb152b9546529f71a773e5e4bce6eeef3732770fe027b625a95a7c46aedbf428c004f95a9191b28bab31c73b9e5b8f841fe3e742451ceec391daad",
      "rh_hash": null,
      "ssdeep": "96:WRnQlqNAJXmrBaZugKvecO0+ecKyAecyQAeckpDrRGJzw+0vIMVwVcz7Nw:89Bak3M8ykpDlE",
      "type": "Unicode text, UTF-8 (with BOM) text, with CRLF line terminators",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T116D16916BBBB4C1377A54241E7A4660DAA1774273BEEB23E317DC1566B1326483F83C4",
      "sha3_384": "096304c4817e2a2300a51e1b22426ec9c7b57ccc4ae43b8470817d47f7fd28ad1a7a39bafb590ac7925cbe3fef4f73a8",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": "\\xfeff2026-05-28 15:59:35, Info                  SP     CSetupPlatform::Initialize: Setup log starts:\n2026-05-28 15:59:35, Info                  SP     SEH: Enter CExceptionHandler::CExceptionHandler\n2026-05-28 15:59:35, Info                  SP     SEH: Exit CExceptionHandler::CExceptionHandler\n2026-05-28 15:59:40, Info                  SP     Host system information:\n                                   VM: YES\n                                   Firmware type: PCAT\n                                   Manufacturer: BOCHS_\n                                   Model : BXPC____\n                                   BIOS name : Default System BIOS\n                                   BIOS version : 1.23.1\n                                   BIOS release date : 20140401000000.000000+000\n                                   Total memory : 4294967296\n                                   Number of physical CPUs : 2\n                                   Number of logical CPUs : 4\n                                   Processor manufacturer : GenuineIntel\n                                   Processor name : Intel Core Processor (Skylake, IBRS)\n                                   Processor caption : Intel64 Family 6 Model 94 Stepping 3\n                                   Processor architecture : x64\n                                   Processor clock : 3686\n\n2026-05-28 15:59:40, Info                  SP     Antivirus software information:\n                                   Name: Windows Defender, Path: %ProgramFiles%\\Windows Defender\\MsMpeng.exe, Timestamp: Thu, 28 May 2026 15:30:41 GMT, State: 401664\n\n2026-05-28 15:59:40, Info                         SPGenerateCopyListFromConfigFile: Didn't find file list in C:\\$Windows.~WS\\Sources\\setupplatform.cfg, section Footprint.Basic.x86\n2026-05-28 15:59:40, Info                         SPGetFootprintCapabilities: Starting verification of footprint section Footprint.Basic\n2026-05-28 15:59:40, Info                         SPGetFootprintCapabilities: Could not find footprint file C:\\$Windows.~WS\\Sources\\reagent.admx\n2026-05-28 15:59:40, Warning                      SPGetFootprintCapabilities: Footprint [Footprint.Basic] incomplete; the platform capability will not be available\n2026-05-28 15:59:40, Info                         SPGenerateCopyListFromConfigFile: Didn't find file list in C:\\$Windows.~WS\\Sources\\setupplatform.cfg, section Footprint.Servicing.x86\n2026-05-28 15:59:40, Info                         SPGetFootprintCapabilities: Starting verification of footprint section Footprint.Servicing\n2026-05-28 15:59:40, Info                         SPGetFootprintCapabilities: Could not find footprint file C:\\$Windows.~WS\\Sources\\dismapi.dll\n2026-05-28 15:59:40, Warning                      SPGetFootprintCapabilities: Footprint [Footprint.Servicing] incomplete; the platform capability will not be available\n2026-05-28 15:59:40, Info                         SPGenerateCopyListFromConfigFile: Didn't find file list in C:\\$Windows.~WS\\Sources\\setupplatform.cfg, section Footprint.ICB.x86\n2026-05-28 15:59:40, Info                         SPGetFootprintCapabilities: Starting verification of footprint section Footprint.ICB\n2026-05-28 15:59:40, Info                         SPGetFootprintCapabilities: Could not find footprint file C:\\$Windows.~WS\\Sources\\cmi2migxml.dll\n2026-05-28 15:59:40, Warning                      SPGetFootprintCapabilities: Footprint [Footprint.ICB] incomplete; the platform capability will not be available\n2026-05-28 15:59:40, Info                         SPGenerateCopyListFromConfigFile: Didn't find file list in C:\\$Windows.~WS\\Sources\\setupplatform.cfg, section Footprint.Migration.x86\n2026-05-28 15:59:40, Info                         SPGetFootprintCapabilities: Starting verification of footprint section Footprint.Migration\n2026-05-28 15:59:40, Info                         SPGetFootprintCapabilities: Could not find footprint file C:\\$Windows.~WS\\Sources\\cmi2migxml.dll\n2026-05-28 15:59:40, Warning                      SPGetFootprintCapabilities: Footprint [Footprint.Migration] incomplete; the platform capability will not be available\n2026-05-28 15:59:40, Info                         Initializing diagnostics helper; data file = (NULL)\n2026-05-28 15:59:40, Info                         No existing diagnostics data\n2026-05-28 15:59:40, Info                         Reading onesetting for tracing settings\n2026-05-28 15:59:40, Warning                      Onesettings: Failed to get DeviceId from registry: 0x80070002\n2026-05-28 15:59:40, Warning                      Onesettings: Failed to initialize and query: 0x80070002\n2026-05-28 15:59:40, Warning                      Failed to create OneSettings infrastructure. Error: 0x0880070002\n2026-05-28 15:59:40, Info                         Reading onesetting for tracing settings completed, Error: 0x80070002\n2026-05-28 15:59:40, Warning                      No onesetting configured or error getting onesetting\n2026-05-28 15:59:40, Info                         Key CollectTrace is not available.\n2026-05-28 15:59:40, Warning               SP     CSetupPlatform::Initialize: Failed to initialize tracing\n2026-05-28 15:59:40, Info                         Use Paged memory for telemetry\n2026-05-28 15:59:40, Info                         VDS available\n2026-05-28 15:59:40, Info                         Key CollectTrace is not available.\n2026-05-28 15:59:40, Info                  SP     Releasing the setup platform\n2026-05-28 15:59:40, Info                  SP       StopTelemetry: 0\n2026-05-28 15:59:40, Info                  SP       UploadTelemetryData: 0\n2026-05-28 15:59:40, Info                  SP       CorrelationVector: <NULL>\n2026-05-28 15:59:40, Info                  SP     Try to merge diagnostics data from default new system data file\n2026-05-28 15:59:40, Info                  SP     Skip merge diagnostics data since C:\\$WINDOWS.~BT\\Sources\\Diagnostics\\diagnostics.dat is not exist\n2026-05-28 15:59:40, Info                  SP     Finish merge diagnostics data\n2026-05-28 15:59:40, Info                  SP     Start uploading diagnostics data for setup platform\n2026-05-28 15:59:40, Info                  SP     Not opted-in to SQM. Diagnostics data will NOT be uploaded\n2026-05-28 15:59:40, Info                         Key CollectTrace is not available.\n2026-05-28 15:59:40, Info                  SP     Closing Panther Logging\n",
      "strings": [],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5932
    },
    {
      "name": [
        "Diager.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/ae0f8123d3ef8801961211d7d71780bee76c418ebc8c6893b385d5faba6bb68f",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\Diager.dll"
      ],
      "size": 41792,
      "crc32": "278CD4E0",
      "md5": "4396bdd1707419909f04a92184ad1317",
      "sha1": "eaa238531420dcfbdb864fa31bd95373b53977d7",
      "sha256": "ae0f8123d3ef8801961211d7d71780bee76c418ebc8c6893b385d5faba6bb68f",
      "sha512": "d7e526a1bb8b7d4fb91de5f10dd1cd1a005dd26aec7839b22e66303bada8ecba34e92f2467ea510584c29c93c51a78c4fa36849050f72bfeda456671136aa8ec",
      "rh_hash": null,
      "ssdeep": "768:GjGabdDxVfFrX8khxIWdOghUak3h1PQRVta:G9dDxNFrX80IWdOdaeXP4ta",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T14D133B00A2648AE7D5F729F025AEB133683EA0B41FD493D70A53A7ED6D933D0D9341A6",
      "sha3_384": "3e287ca054351cfdc111298e4c458c1cf4bfecd79409b183f6a55c6e5358279746f4800a313e12dd31e98fdce84e3b97",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x000058b0",
        "ep_bytes": "8bff558bec837d0c017505e865060000",
        "peid_signatures": null,
        "reported_checksum": "0x0000ffe6",
        "actual_checksum": "0x0000ffe6",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "diagER.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x100081e4",
                "name": "malloc"
              },
              {
                "address": "0x100081e8",
                "name": "free"
              },
              {
                "address": "0x100081ec",
                "name": "fwprintf"
              },
              {
                "address": "0x100081f0",
                "name": "_callnewh"
              },
              {
                "address": "0x100081f4",
                "name": "_XcptFilter"
              },
              {
                "address": "0x100081f8",
                "name": "_wfopen"
              },
              {
                "address": "0x100081fc",
                "name": "fclose"
              },
              {
                "address": "0x10008200",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x10008204",
                "name": "_amsg_exit"
              },
              {
                "address": "0x10008208",
                "name": "_initterm"
              },
              {
                "address": "0x1000820c",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x10008210",
                "name": "_lock"
              },
              {
                "address": "0x10008214",
                "name": "_unlock"
              },
              {
                "address": "0x10008218",
                "name": "__dllonexit"
              },
              {
                "address": "0x1000821c",
                "name": "_onexit"
              },
              {
                "address": "0x10008220",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x10008224",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x10008228",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x1000822c",
                "name": "wcsrchr"
              },
              {
                "address": "0x10008230",
                "name": "_purecall"
              },
              {
                "address": "0x10008234",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x10008238",
                "name": "memset"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x10008000",
                "name": "RegCloseKey"
              },
              {
                "address": "0x10008004",
                "name": "RegDeleteKeyExW"
              },
              {
                "address": "0x10008008",
                "name": "RegCreateKeyExW"
              },
              {
                "address": "0x1000800c",
                "name": "RegSetValueExW"
              },
              {
                "address": "0x10008010",
                "name": "RegOpenKeyExW"
              },
              {
                "address": "0x10008014",
                "name": "RegDeleteValueW"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x1000801c",
                "name": "GlobalUnlock"
              },
              {
                "address": "0x10008020",
                "name": "GetTickCount"
              },
              {
                "address": "0x10008024",
                "name": "MapViewOfFile"
              },
              {
                "address": "0x10008028",
                "name": "GetDriveTypeW"
              },
              {
                "address": "0x1000802c",
                "name": "DebugBreak"
              },
              {
                "address": "0x10008030",
                "name": "CopyFileExW"
              },
              {
                "address": "0x10008034",
                "name": "GlobalMemoryStatus"
              },
              {
                "address": "0x10008038",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x1000803c",
                "name": "GetExitCodeProcess"
              },
              {
                "address": "0x10008040",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x10008044",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x10008048",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x1000804c",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x10008050",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x10008054",
                "name": "VirtualQuery"
              },
              {
                "address": "0x10008058",
                "name": "AcquireSRWLockExclusive"
              },
              {
                "address": "0x1000805c",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x10008060",
                "name": "VirtualProtect"
              },
              {
                "address": "0x10008064",
                "name": "CreateFileMappingW"
              },
              {
                "address": "0x10008068",
                "name": "DuplicateHandle"
              },
              {
                "address": "0x1000806c",
                "name": "GetLastError"
              },
              {
                "address": "0x10008070",
                "name": "GetUserDefaultLangID"
              },
              {
                "address": "0x10008074",
                "name": "GetModuleFileNameW"
              },
              {
                "address": "0x10008078",
                "name": "GetTempPathW"
              },
              {
                "address": "0x1000807c",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x10008080",
                "name": "CloseHandle"
              },
              {
                "address": "0x10008084",
                "name": "CopyFileW"
              },
              {
                "address": "0x10008088",
                "name": "CreateDirectoryW"
              },
              {
                "address": "0x1000808c",
                "name": "ReadFile"
              },
              {
                "address": "0x10008090",
                "name": "GetVolumeInformationW"
              },
              {
                "address": "0x10008094",
                "name": "GetLogicalDrives"
              },
              {
                "address": "0x10008098",
                "name": "FindFirstFileW"
              },
              {
                "address": "0x1000809c",
                "name": "HeapCreate"
              },
              {
                "address": "0x100080a0",
                "name": "HeapFree"
              },
              {
                "address": "0x100080a4",
                "name": "SetLastError"
              },
              {
                "address": "0x100080a8",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x100080ac",
                "name": "VirtualFree"
              },
              {
                "address": "0x100080b0",
                "name": "GetCommandLineW"
              },
              {
                "address": "0x100080b4",
                "name": "GetFullPathNameW"
              },
              {
                "address": "0x100080b8",
                "name": "FindNextFileW"
              },
              {
                "address": "0x100080bc",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x100080c0",
                "name": "WriteFile"
              },
              {
                "address": "0x100080c4",
                "name": "ExpandEnvironmentStringsW"
              },
              {
                "address": "0x100080c8",
                "name": "GetShortPathNameW"
              },
              {
                "address": "0x100080cc",
                "name": "GetDiskFreeSpaceW"
              },
              {
                "address": "0x100080d0",
                "name": "VirtualAlloc"
              },
              {
                "address": "0x100080d4",
                "name": "TerminateProcess"
              },
              {
                "address": "0x100080d8",
                "name": "RemoveDirectoryW"
              },
              {
                "address": "0x100080dc",
                "name": "SetFileTime"
              },
              {
                "address": "0x100080e0",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x100080e4",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x100080e8",
                "name": "SetErrorMode"
              },
              {
                "address": "0x100080ec",
                "name": "SetFilePointer"
              },
              {
                "address": "0x100080f0",
                "name": "SetEndOfFile"
              },
              {
                "address": "0x100080f4",
                "name": "WaitForMultipleObjectsEx"
              },
              {
                "address": "0x100080f8",
                "name": "FindClose"
              },
              {
                "address": "0x100080fc",
                "name": "GetLocaleInfoW"
              },
              {
                "address": "0x10008100",
                "name": "CreateFileW"
              },
              {
                "address": "0x10008104",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x10008108",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x1000810c",
                "name": "OpenEventW"
              },
              {
                "address": "0x10008110",
                "name": "GetVersionExW"
              },
              {
                "address": "0x10008114",
                "name": "GetComputerNameExW"
              },
              {
                "address": "0x10008118",
                "name": "HeapWalk"
              },
              {
                "address": "0x1000811c",
                "name": "UnmapViewOfFile"
              },
              {
                "address": "0x10008120",
                "name": "GetFileType"
              },
              {
                "address": "0x10008124",
                "name": "HeapValidate"
              },
              {
                "address": "0x10008128",
                "name": "OpenProcess"
              },
              {
                "address": "0x1000812c",
                "name": "SetFileAttributesW"
              },
              {
                "address": "0x10008130",
                "name": "GetLogicalDriveStringsW"
              },
              {
                "address": "0x10008134",
                "name": "CreateEventW"
              },
              {
                "address": "0x10008138",
                "name": "GetPrivateProfileStringW"
              },
              {
                "address": "0x1000813c",
                "name": "Sleep"
              },
              {
                "address": "0x10008140",
                "name": "GlobalSize"
              },
              {
                "address": "0x10008144",
                "name": "SetEvent"
              },
              {
                "address": "0x10008148",
                "name": "GetDiskFreeSpaceExW"
              },
              {
                "address": "0x1000814c",
                "name": "GetVersionExA"
              },
              {
                "address": "0x10008150",
                "name": "GlobalAlloc"
              },
              {
                "address": "0x10008154",
                "name": "DeleteFileW"
              },
              {
                "address": "0x10008158",
                "name": "GlobalFree"
              },
              {
                "address": "0x1000815c",
                "name": "HeapReAlloc"
              },
              {
                "address": "0x10008160",
                "name": "RaiseException"
              },
              {
                "address": "0x10008164",
                "name": "GetSystemInfo"
              },
              {
                "address": "0x10008168",
                "name": "CreateThread"
              },
              {
                "address": "0x1000816c",
                "name": "ResetEvent"
              },
              {
                "address": "0x10008170",
                "name": "HeapAlloc"
              },
              {
                "address": "0x10008174",
                "name": "GetOverlappedResult"
              },
              {
                "address": "0x10008178",
                "name": "HeapCompact"
              },
              {
                "address": "0x1000817c",
                "name": "HeapDestroy"
              },
              {
                "address": "0x10008180",
                "name": "GetWindowsDirectoryW"
              },
              {
                "address": "0x10008184",
                "name": "GetProcAddress"
              },
              {
                "address": "0x10008188",
                "name": "GlobalLock"
              },
              {
                "address": "0x1000818c",
                "name": "MoveFileExW"
              },
              {
                "address": "0x10008190",
                "name": "GetFileSize"
              },
              {
                "address": "0x10008194",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x10008198",
                "name": "ExitProcess"
              },
              {
                "address": "0x1000819c",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x100081a0",
                "name": "CreateProcessW"
              },
              {
                "address": "0x100081a4",
                "name": "FreeLibrary"
              },
              {
                "address": "0x100081a8",
                "name": "GetTempFileNameW"
              },
              {
                "address": "0x100081ac",
                "name": "CreateProcessA"
              },
              {
                "address": "0x100081b0",
                "name": "LoadLibraryExA"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x10008240",
                "name": "RtlAllocateHeap"
              },
              {
                "address": "0x10008244",
                "name": "RtlFreeHeap"
              }
            ]
          },
          "SHELL32": {
            "dll": "SHELL32.dll",
            "imports": [
              {
                "address": "0x100081b8",
                "name": "ShellExecuteExW"
              },
              {
                "address": "0x100081bc",
                "name": "ExtractIconExW"
              }
            ]
          },
          "USER32": {
            "dll": "USER32.dll",
            "imports": [
              {
                "address": "0x100081c4",
                "name": "CharNextW"
              }
            ]
          },
          "WDSCORE": {
            "dll": "WDSCORE.dll",
            "imports": [
              {
                "address": "0x100081cc",
                "name": "WdsSetupLogMessageW"
              },
              {
                "address": "0x100081d0",
                "name": "ConstructPartialMsgVW"
              },
              {
                "address": "0x100081d4",
                "name": "CurrentIP"
              },
              {
                "address": "0x100081d8",
                "name": "WdsSetupLogInit"
              },
              {
                "address": "0x100081dc",
                "name": "WdsSetupLogDestroy"
              }
            ]
          }
        },
        "exported_dll_name": "diagER.dll",
        "exports": [
          {
            "address": "0x10002930",
            "name": "??0CDwWinER@@QAE@ABV0@@Z",
            "ordinal": 1
          },
          {
            "address": "0x100034a0",
            "name": "??0CDwWinER@@QAE@PBGH@Z",
            "ordinal": 2
          },
          {
            "address": "0x10002840",
            "name": "??0CWfpER@@QAE@ABV0@@Z",
            "ordinal": 3
          },
          {
            "address": "0x10002b40",
            "name": "??0CWfpER@@QAE@PBGW4_DIAG_REPORT_TYPE@@H@Z",
            "ordinal": 4
          },
          {
            "address": "0x100027b0",
            "name": "??0IDiagER@@QAE@ABV0@@Z",
            "ordinal": 5
          },
          {
            "address": "0x100043b0",
            "name": "??0IDiagER@@QAE@PBGH@Z",
            "ordinal": 6
          },
          {
            "address": "0x10003770",
            "name": "??1CDwWinER@@UAE@XZ",
            "ordinal": 7
          },
          {
            "address": "0x10002dc0",
            "name": "??1CWfpER@@UAE@XZ",
            "ordinal": 8
          },
          {
            "address": "0x100047f0",
            "name": "??1IDiagER@@UAE@XZ",
            "ordinal": 9
          },
          {
            "address": "0x10002ac0",
            "name": "??4CDiagERFactory@@QAEAAV0@$$QAV0@@Z",
            "ordinal": 10
          },
          {
            "address": "0x10002ac0",
            "name": "??4CDiagERFactory@@QAEAAV0@ABV0@@Z",
            "ordinal": 11
          },
          {
            "address": "0x100029b0",
            "name": "??4CDwWinER@@QAEAAV0@ABV0@@Z",
            "ordinal": 12
          },
          {
            "address": "0x10002880",
            "name": "??4CWfpER@@QAEAAV0@ABV0@@Z",
            "ordinal": 13
          },
          {
            "address": "0x10002800",
            "name": "??4IDiagER@@QAEAAV0@ABV0@@Z",
            "ordinal": 14
          },
          {
            "address": "0x100010ec",
            "name": "??_7CDwWinER@@6B@",
            "ordinal": 15
          },
          {
            "address": "0x100010d4",
            "name": "??_7CWfpER@@6B@",
            "ordinal": 16
          },
          {
            "address": "0x10001104",
            "name": "??_7IDiagER@@6B@",
            "ordinal": 17
          },
          {
            "address": "0x10003860",
            "name": "?AddBucketingParameters@CDwWinER@@UAEKPAPBGI@Z",
            "ordinal": 18
          },
          {
            "address": "0x10002ff0",
            "name": "?AddBucketingParameters@CWfpER@@UAEKPAPBGI@Z",
            "ordinal": 19
          },
          {
            "address": "0x100044e0",
            "name": "?AddBucketingParameters@IDiagER@@UAEKPAPBGI@Z",
            "ordinal": 20
          },
          {
            "address": "0x10003a90",
            "name": "?AddFiles@CDwWinER@@UAEKPAPBGI@Z",
            "ordinal": 21
          },
          {
            "address": "0x10003100",
            "name": "?AddFiles@CWfpER@@UAEKPAPBGI@Z",
            "ordinal": 22
          },
          {
            "address": "0x10004620",
            "name": "?AddFiles@IDiagER@@UAEKPAPBGI@Z",
            "ordinal": 23
          },
          {
            "address": "0x10004a60",
            "name": "?CreateInstance@CDiagERFactory@@SGKPBGW4_DIAG_REPORT_TYPE@@HPAPAVIDiagER@@@Z",
            "ordinal": 24
          },
          {
            "address": "0x10004a50",
            "name": "?GetErrorReporter@CDiagERFactory@@SGPAVIDiagER@@XZ",
            "ordinal": 32
          },
          {
            "address": "0x10003520",
            "name": "?Initialize@CDwWinER@@UAEKXZ",
            "ordinal": 33
          },
          {
            "address": "0x10002bc0",
            "name": "?Initialize@CWfpER@@UAEKXZ",
            "ordinal": 34
          },
          {
            "address": "0x10004c70",
            "name": "?ReleaseInstance@CDiagERFactory@@SGXXZ",
            "ordinal": 35
          },
          {
            "address": "0x100037a0",
            "name": "?SetHeader@CDwWinER@@UAEKPBG@Z",
            "ordinal": 36
          },
          {
            "address": "0x10002f20",
            "name": "?SetHeader@CWfpER@@UAEKPBG@Z",
            "ordinal": 37
          },
          {
            "address": "0x10004460",
            "name": "?SetHeader@IDiagER@@UAEKPBG@Z",
            "ordinal": 38
          },
          {
            "address": "0x10003c90",
            "name": "?Submit@CDwWinER@@UAEKK@Z",
            "ordinal": 39
          },
          {
            "address": "0x10003270",
            "name": "?Submit@CWfpER@@UAEKK@Z",
            "ordinal": 40
          },
          {
            "address": "0x10007378",
            "name": "?m_diagER@CDiagERFactory@@0PAVIDiagER@@A",
            "ordinal": 44
          },
          {
            "address": "0x10004db0",
            "name": "DiagERAddBucketingParameters",
            "ordinal": 25
          },
          {
            "address": "0x10004e80",
            "name": "DiagERAddFiles",
            "ordinal": 26
          },
          {
            "address": "0x10004ca0",
            "name": "DiagERInitialize",
            "ordinal": 27
          },
          {
            "address": "0x10004d30",
            "name": "DiagERSetHeader",
            "ordinal": 28
          },
          {
            "address": "0x10004f10",
            "name": "DiagERSubmit",
            "ordinal": 29
          },
          {
            "address": "0x10004f70",
            "name": "DiagERSubmitEx",
            "ordinal": 30
          },
          {
            "address": "0x10005000",
            "name": "DiagERTerminate",
            "ordinal": 31
          },
          {
            "address": "0x10007008",
            "name": "g_Kernel32",
            "ordinal": 41
          },
          {
            "address": "0x10007004",
            "name": "g_Shell32",
            "ordinal": 42
          },
          {
            "address": "0x10007000",
            "name": "g_WerApi",
            "ordinal": 43
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x000065c0",
            "size": "0x000006aa"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x00008250",
            "size": "0x000000a0"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x0000a000",
            "size": "0x000003f8"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x00008200",
            "size": "0x00002140"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x0000b000",
            "size": "0x000007b8"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x00002400",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x00001010",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x00008000",
            "size": "0x0000024c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x000064c8",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x00005c6a",
            "size_of_data": "0x00005e00",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "5.94"
          },
          {
            "name": ".data",
            "raw_address": "0x00006200",
            "virtual_address": "0x00007000",
            "virtual_size": "0x000003a8",
            "size_of_data": "0x00000200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "0.73"
          },
          {
            "name": ".idata",
            "raw_address": "0x00006400",
            "virtual_address": "0x00008000",
            "virtual_size": "0x00000f18",
            "size_of_data": "0x00001000",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.19"
          },
          {
            "name": ".didat",
            "raw_address": "0x00007400",
            "virtual_address": "0x00009000",
            "virtual_size": "0x0000001c",
            "size_of_data": "0x00000200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "0.31"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x00007600",
            "virtual_address": "0x0000a000",
            "virtual_size": "0x000003f8",
            "size_of_data": "0x00000400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "3.37"
          },
          {
            "name": ".reloc",
            "raw_address": "0x00007a00",
            "virtual_address": "0x0000b000",
            "virtual_size": "0x000007b8",
            "size_of_data": "0x00000800",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.55"
          }
        ],
        "overlay": {
          "offset": "0x00008200",
          "size": "0x00002140"
        },
        "resources": [
          {
            "name": "RT_VERSION",
            "offset": "0x0000a060",
            "size": "0x00000398",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.51"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Diagnostic ER Module"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "diagER.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "DIAGER.DLL"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "d13ec8d6bd114ce7df8549576c8e140f",
        "timestamp": "2009-02-19 10:49:41",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 7
      },
      "data": null,
      "strings": [
        "DiagERAddFiles:Entry",
        "GlobalMemoryStatus",
        "Microsoft",
        "CDwWinER::Initialize:Entry",
        "?AddFiles@CDwWinER@@UAEKPAPBGI@Z",
        "CWfpER::Submit",
        "UnhandledExceptionFilter",
        ".text$yd",
        "__dllonexit",
        "/StageOne/Generic/%s",
        "WerReportSetParameter",
        "PQSVW",
        "Microsoft Time-Stamp Service",
        ".CRT$XIAA",
        "<$<7<I<P<V<[<c<m<",
        "dwwin.exe",
        "HeaderText=%s",
        "0(080H0X0h0x0",
        "CDwWinER::AddBucketingParameters",
        "Microsoft Corporation",
        "?SetHeader@IDiagER@@UAEKPBG@Z",
        "DeleteFileW",
        "DiagERAddBucketingParameters:Entry",
        "malloc",
        "GlobalLock",
        "IDiagER::IDiagER:Entry",
        ".rsrc",
        ".didat$2",
        "GetFullPathNameW",
        "20201008071931.859Z0",
        "??_7CWfpER@@6B@",
        ".giats",
        ".didat$6",
        "0$0.0A0G0U0z0",
        "2\"2k2z2",
        "?AddBucketingParameters@CDwWinER@@UAEKPAPBGI@Z",
        "?terminate@@YAXXZ",
        "QQVW3",
        "RegCloseKey",
        "GetShortPathNameW",
        "RegCreateKeyExW",
        "DuplicateHandle",
        "UnmapViewOfFile",
        "DataFiles=%s",
        " Microsoft Operations Puerto Rico1&0$",
        "7*737J7S7{7",
        "GetProcessHeap",
        "WerReportCloseHandle",
        ")Microsoft Root Certificate Authority 20100",
        "CDwWinER::SetHeader",
        "LoadLibraryExW",
        "GetProcAddress",
        "FindClose",
        "AcquireSRWLockExclusive",
        "100701213655Z",
        "?Submit@CWfpER@@UAEKK@Z",
        "3&3:3",
        "InitializeCriticalSection",
        "WaitForSingleObject",
        "SetEndOfFile",
        "VirtualProtect",
        "HeapWalk",
        "WdsSetupLogDestroy",
        "Event Name cannot be NULL",
        "Microsoft Corporation1&0$",
        "GetModuleFileNameW",
        "FindNextFileW",
        "ResetEvent",
        "OpenProcess",
        "WerReportCreate",
        "DiagERInitialize:Entry Also Initialized the log",
        "E0C1)0'",
        "GetFileSize",
        "RegSetValueExW",
        "ReleaseSRWLockExclusive",
        "TerminateProcess",
        "B0G0l0u0",
        "RaiseException",
        ".idata$5",
        ".CRT$XCU",
        "&P%d=%s",
        "Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
        "}>3cP",
        "DiagERTerminate:Entry",
        "R!s4Z",
        "ExpandEnvironmentStringsW",
        "IDiagER::SetHeader:Entry",
        "8.83898M8R8^8o8w8",
        "'XD}*",
        "Stage1URL=%s",
        "_purecall",
        "040904B0",
        "Microsoft Time-Stamp Service0",
        "?Initialize@CDwWinER@@UAEKXZ",
        "3.3B3X3h3x3",
        "IDiagER::AddBucketingParameters:Entry",
        "HeapFree",
        "?AddFiles@CWfpER@@UAEKPAPBGI@Z",
        "GetTempPathW",
        ">0?7?=?B?M?]?l?",
        "GetVersionExA",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "DiagERSetHeader",
        "Thales TSS ESN:0A56-E329-4D4D1%0#",
        "IDiagER::~IDiagER:Entry",
        "\"Microsoft Window",
        "OpenEventW",
        ".idata",
        ".data$r$brc",
        "GetFileAttributesW",
        ",yWAVBmA4UR7Lz3ocXyBl0jrhQ2rgZpoLtQtddGN4xaM=0Z",
        ".data",
        "DiagERAddBucketingParameters:ERROR_NOT_READY",
        "Redmond1",
        "10.0.19041.572 (WinBuild.160101.0800)",
        "WaitForMultipleObjectsEx",
        "Consent Value = HKCU\\%s!%s has been cleaned out",
        " Windows",
        ">->8>H>S>y>",
        "QSVW3",
        "??4IDiagER@@QAEAAV0@ABV0@@Z",
        "??4CDiagERFactory@@QAEAAV0@$$QAV0@@Z",
        "??4CDwWinER@@QAEAAV0@ABV0@@Z",
        "1\"1'121<1O1u1|1",
        "??0CDwWinER@@QAE@PBGH@Z",
        ".didat$5",
        "261019185142Z0",
        "??0IDiagER@@QAE@ABV0@@Z",
        "191219011459Z",
        "?ReleaseInstance@CDiagERFactory@@SGXXZ",
        "CWfpER::AddFiles:Failed Adding file=%s, Result=%d",
        "=8>=>O>m>",
        "=(=/=6=>=I=T=Y=m=x=",
        "GetLogicalDrives",
        "_wfopen",
        "ADVAPI32.dll",
        "ReadFile",
        "CharNextW",
        "RegDeleteValueW",
        "USER32.dll",
        "??1IDiagER@@UAE@XZ",
        "EnterCriticalSection",
        "CWfpER::~CWfpER:Entry",
        "MapViewOfFile",
        "GlobalUnlock",
        "959L9a9",
        ";t04u",
        "3B4l4w4",
        "Stage2URL=%s",
        "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a",
        "8'878?8H8p8",
        "Consent Value = HKCU\\%s!%s could NOT been set to %d, Err=%d",
        "TitleName=%s",
        "WdsSetupLogMessageW",
        ")qBI~Z",
        "3*3?3K3R3W3]3i3v3",
        "CWfpER::AddFiles",
        "DiagERSubmitEx:Entry",
        "CurrentIP",
        ".xdata$x",
        "GetOverlappedResult",
        "base\\ntsetup\\diagnostics\\diager\\src\\diager.cpp",
        ".didat$3",
        "Microsoft Corporation1",
        "RtlAllocateHeap",
        "QQSVW3",
        "CreateFileMappingW",
        "0L0P0X0`0x0",
        "20201008050501Z",
        "AhN~%",
        "1/0-0",
        " Microsoft Operations Puerto Rico1",
        "StringFileInfo",
        "KERNEL32.dll",
        "GetDriveTypeW",
        "Sleep",
        "N0L0J",
        "CWfpER::AddBucketingParameters:Entry",
        "r~akow",
        "IDiagER::AddFiles:Entry",
        "?/?H?X?h?x?",
        "GetCurrentProcessId",
        "9%949:9a9o9~9",
        ";p;~;",
        "CopyFileW",
        "SetEvent",
        "sCWfpER::AddBucketingParameters",
        "_onexit",
        "229879+4583610",
        ".idata$4",
        "GetComputerNameExW",
        ";(;`;i;p;v;{;",
        "IDiagER::AddBucketingParameters",
        "CopyFileExW",
        "WdsSetupLogInit",
        "Flags=%d",
        "? ?&?+?6?@?S?}?",
        "g_WerApi",
        "8%858@8F8K8W8a8t8",
        ".didat$7",
        ".text$mn",
        "IDiagER::SetHeader",
        "?GetErrorReporter@CDiagERFactory@@SGPAVIDiagER@@XZ",
        "576G6R6X6]6i6s6",
        "j,hxc",
        "%Microsoft Windows Production PCA 2011",
        "?SetHeader@CWfpER@@UAEKPBG@Z",
        "@.didat",
        ".CRT$XIA",
        "??0CDwWinER@@QAE@ABV0@@Z",
        ".text$x",
        "DiagERSubmit:Entry",
        "210303183038Z0p1",
        "DtCSV",
        "LegalCopyright",
        "dIDiagER::~IDiagER",
        "GetLocaleInfoW",
        "111019184142Z",
        "CreateDirectoryW",
        "HeapCompact",
        "VirtualFree",
        "Y__^[",
        ".idata$3",
        "dCDwWinER::CDwWinER",
        "watson.microsoft.com",
        "FindFirstFileW",
        ".rdata",
        "GetWindowsDirectoryW",
        "727G7T7q7z7",
        "ywer.dll",
        "$`2X`F",
        "CDwWinER::AddBucketingParameters:Entry",
        "M0K0I",
        "WerReportSubmit",
        "=&=.=R=[=",
        ".text$di",
        "uCjW^SS",
        "VarFileInfo",
        "GetCurrentProcess",
        "?SetHeader@CDwWinER@@UAEKPBG@Z",
        ">6?T?c?l?u?",
        "??1type_info@@UAE@XZ",
        "DiagERAddBucketingParameters",
        "ExitProcess",
        "WDSCORE.dll",
        "|hK,_",
        "DeleteCriticalSection",
        "OriginalFilename",
        "1 1*141D1T1Z1e1k1w1",
        "_CxxThrowException",
        "Microsoft Windows0",
        "CDwWinER::Initialize",
        "@.reloc",
        ".edata",
        "CWfpER::Initialize:Entry",
        " Operating System",
        "GlobalSize",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "_initterm",
        "RtlFreeHeap",
        "210317011459Z0",
        "HeapReAlloc",
        "??4CWfpER@@QAEAAV0@ABV0@@Z",
        "U0S0Q",
        "Rich,",
        "RegOpenKeyExW",
        "Microsoft Corporation1)0'",
        "LoadLibraryExA",
        "t$hp7",
        "SetLastError",
        "GetLogicalDriveStringsW",
        ".00cfg",
        "_callnewh",
        "RegDeleteKeyExW",
        "404P4l4p4",
        "oK0D$\"<",
        "_lock",
        "VirtualQuery",
        "IDiagER::AddFiles",
        ".rdata$brc",
        " !\"#$%&'+",
        "DiagERSubmitEx",
        "CDwWinER::SetHeader:Setting header=%s",
        "fwprintf",
        "msvcrt.dll",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "z.9Wv",
        "CDwWinER::SetHeader:Entry",
        "CDwWinER::AddFiles:Adding file=%s",
        "2e~hUb",
        "GetCurrentThreadId",
        "MoveFileExW",
        ".data$brc",
        "Microsoft Time-Stamp PCA 2010",
        "CWfpER::Submit:Entry",
        "CWfpER::AddFiles:Entry",
        "FreeLibrary",
        "`.data",
        "??_7IDiagER@@6B@",
        "dCWfpER::SetHeader",
        "WerReportAddFile",
        "Legal_Policy_Statement",
        "Microsoft Time-Stamp PCA 20100",
        "__CxxFrameHandler3",
        "=$=Q=p=|=",
        "7=7W7a7u7",
        "ExtractIconExW",
        "??1CDwWinER@@UAE@XZ",
        "1(0&0",
        "Consent Value = HKCU\\%s!%s could NOT be cleaned out, Err=%d",
        "?Submit@CDwWinER@@UAEKK@Z",
        "Changing Report Type from Critical To Non Critical to support silent mode",
        ".idata$2",
        "0!0+0>0d0k0t0y0",
        "??0CWfpER@@QAE@PBGW4_DIAG_REPORT_TYPE@@H@Z",
        "Diagnostic ER Module",
        ".CRT$XCA",
        "WerReportSetUIOption",
        "SetUnhandledExceptionFilter",
        "GetCommandLineW",
        "9-:I:R:^:g:",
        "2\"282H2X2h2x2",
        "LeaveCriticalSection",
        "SetFilePointer",
        "TlP0X",
        "wer.dll",
        "_91$[bS",
        ",*~_i",
        "diagERman.txt",
        "HeapCreate",
        "1'1.1",
        "Unable to create manifest file=%s",
        "??4CDiagERFactory@@QAEAAV0@ABV0@@Z",
        "ProductVersion",
        "/dw/GenericTwo.ASP?EventType=%s",
        ".rdata$sxdata",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "GetVolumeInformationW",
        "DiagERSetHeader:Entry",
        "VirtualAlloc",
        "RemoveDirectoryW",
        "GetSystemTimeAsFileTime",
        "memset",
        "GetTickCount",
        ".CRT$XIZ",
        "<!<5<e<n<",
        "1(181H1X1h1x1",
        "CompanyName",
        "CDwWinER::CDwWinER: Manifest Filename=%s",
        "ShellExecuteExW",
        "DiagERTerminate",
        "HeapDestroy",
        "diagER.pdb",
        "8M98:G:f:",
        "InternalName",
        "Microsoft Corporation1.0,",
        "Consent Value = HKCU\\%s!%s has been set to %d",
        "20201009050501Z0w0=",
        "VS_VERSION_INFO",
        "ProductName",
        ".didat$4",
        "Watson Error Report submitted and Result=%d",
        "?AddBucketingParameters@CWfpER@@UAEKPAPBGI@Z",
        "CreateProcessA",
        "250701214655Z0|1",
        "??1CWfpER@@UAE@XZ",
        "GlobalAlloc",
        "Unable to allocate bucketing parameters, dwRet=%d",
        "fM'K^X",
        "CreateFileW",
        "ConstructPartialMsgVW",
        "base\\ntsetup\\diagnostics\\diager\\src\\dwwiner.cpp",
        "base\\ntsetup\\diagnostics\\diager\\src\\diagerapi.cpp",
        "9s t$",
        "200304183038Z",
        "_except_handler4_common",
        "?Initialize@CWfpER@@UAEKXZ",
        "O0M0K",
        "4<4F4j4|4",
        "CDwWinER::AddFiles",
        "3L3l3t3",
        "?m_diagER@CDiagERFactory@@0PAVIDiagER@@A",
        "wcsrchr",
        ".text",
        "6#6,676K6P6W6j6q6w6|6",
        "CreateProcessW",
        "g_Kernel32",
        "Translation",
        "DIAGER.DLL",
        "NULL Event Name specified",
        "??_7CDwWinER@@6B@",
        "Unable to allocate the file Names, dwRet=%d",
        ">#>.>8>K>c>",
        "k`Ee-",
        "-d %s",
        "SetFileTime",
        "GetDiskFreeSpaceW",
        "CWfpER::AddBucketingParameters:Adding bucketing param=%s",
        "Server=%s",
        "%Microsoft Windows Production PCA 20110",
        "GetSystemInfo",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "IDiagER::IDiagER",
        "CWfpER::AddFiles:Adding file=%s",
        "?CreateInstance@CDiagERFactory@@SGKPBGW4_DIAG_REPORT_TYPE@@HPAPAVIDiagER@@@Z",
        "^ Wj<_W",
        "l0yX\"",
        "10.0.19041.572",
        "CWfpER::SetHeader:Setting header=%s",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        "GetPrivateProfileStringW",
        "SetErrorMode",
        "lCWfpER::CWfpER",
        " http://www.microsoft.com/windows0",
        "diagER.dll",
        "?AddBucketingParameters@IDiagER@@UAEKPAPBGI@Z",
        " Microsoft Corporation. All rights reserved.",
        "gDiagERSetHeader",
        "+a,Y?",
        "HeapValidate",
        "SetFileAttributesW",
        "uGjW^WW",
        "_vsnwprintf",
        "!This program cannot be run in DOS mode.",
        "CDwWinER::AddFiles:Entry",
        "GetExitCodeProcess",
        "Washington1",
        ".rsrc$01",
        "GetVersionExW",
        "DiagERInitialize",
        "DebugBreak",
        "??0CWfpER@@QAE@ABV0@@Z",
        "_unlock",
        "CWfpER::Initialize",
        "Microsoft Corporation1200",
        "DiagERSubmit",
        "5-545:5@5H5R5e5u5|5",
        "base\\ntsetup\\diagnostics\\diager\\src\\wfper.cpp",
        ".gfids",
        "GetDiskFreeSpaceExW",
        "HeapAlloc",
        ".rsrc$02",
        "5%5/5B5H5]5l5r5",
        "GetLastError",
        "CloseHandle",
        "GetTempFileNameW",
        "QueryPerformanceCounter",
        "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0",
        ";/<_<u<",
        "WriteFile",
        ":!:Q:f:",
        "??0IDiagER@@QAE@PBGH@Z",
        "RSDS]b",
        "}%w>@[",
        "?AddFiles@IDiagER@@UAEKPAPBGI@Z",
        "CDwWinER::AddBucketingParameters:Adding bucketing param=%s",
        ">(>8>H>X>h>x>",
        "=<=C=I=N=V=`=s=",
        "CDwWinER::CDwWinER:Entry",
        ".CRT$XCZ",
        "dCWfpER::~CWfpER",
        "FileDescription",
        "GetUserDefaultLangID",
        "FileVersion",
        "ntdll.dll",
        "_XcptFilter",
        ".rdata$zzzdbg",
        "fclose",
        "CWfpER::SetHeader:Entry",
        "CreateEventW",
        "_amsg_exit",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "2(262J2",
        "GlobalFree",
        "g_Shell32",
        "GetFileType",
        ".idata$6",
        "6-6@6\\6",
        "5J5Q5^5e5s5",
        "UI_LCID=%d",
        "DiagERAddFiles",
        "SHELL32.dll",
        "CreateThread"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "dbd899ba4380f4dfaac85bbf4b40af6e4c79673fedca3207e1bb5860292bb966",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/dbd899ba4380f4dfaac85bbf4b40af6e4c79673fedca3207e1bb5860292bb966",
              "guest_paths": [
                "overlay"
              ],
              "size": 8512,
              "crc32": "67490188",
              "md5": "c8ed9d48ee08298c37e31049e4c07c7a",
              "sha1": "de85f91f4930a96a276d2b9f2a5f966a255dc2d6",
              "sha256": "dbd899ba4380f4dfaac85bbf4b40af6e4c79673fedca3207e1bb5860292bb966",
              "sha512": "a81f409cb5f8ca38a68585024cc919d941b78e4989c53b41b331accd5213d9245b7d74014c3f668c1cc95d8f91f3c47098a4dd0449e6af7f7f4d7dfa0416fc3a",
              "rh_hash": null,
              "ssdeep": "96:/kDDXBDbz9MekJ3AhNpVtEiJhwDD0pBDXiebs/Am2grWXGueDXREsbJpCBDqh0hr:8qF2q8hDBQABJQECWQ2SkqnajKs9CKb",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T199024CD1DB7C5443DFA679805798E4837C3E53CB28108066556BF9A52CC33C6EB085AD",
              "sha3_384": "7f6832e45041185203946715b194ee7ecd8fdb6b8082c08d7487a7eea907b2787538d0a5a446ed28cf8af7633824eb68",
              "data": null
            }
          ],
          "extracted_files_time": 0.0007216949998110067,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "setupplatform.cfg"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/c40fddbb16853406d12d30e01e170de8474728bb8ec24794db721de0a7f67927",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
      ],
      "size": 10452,
      "crc32": "C9C06D02",
      "md5": "033e7adc314c248cc29a9f14906c21e5",
      "sha1": "6b31f8a23514b4e98217cd05be08e7967eca7048",
      "sha256": "c40fddbb16853406d12d30e01e170de8474728bb8ec24794db721de0a7f67927",
      "sha512": "46b46d548f5a2269e886a9f6873d97549eeb92c7294114c62baf7805ac423e4d3aa3a50cd7b3294be03e22c271f6bef1134adf797d9f838962ef5b42e8ecd19e",
      "rh_hash": null,
      "ssdeep": "192:seqadKxSRlb3dY/e7sxzs7c6i19WO7hD26BV+btnQfz/:sjmTrq/e7s1vpMvoz/",
      "type": "ASCII text, with CRLF line terminators",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1E5228344E47D842382757E86140F0D447C4D528726C27B38A6FD8776E9CAABBE998CE4",
      "sha3_384": "cfbeee5fe807c29941f440c0b6effbd9622bbcfc8452f026fdff06e00440892bb45df5bbfdca20ce31c8133057e8f22b",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": ";\n; This section describes the footprint dependencies\n; of various platform sections\n;\n[Dependencies]\nBasic =\nServicing = Basic\nICB = Basic, Servicing\nMigration = Basic\n\n;\n; Each element in a footprint section can be one of three things:\n; - File name: this must not ending in '\\'.\n; - Folder name: this must end in '\\'.\n; - File pattern pattern: these can contain wild cards.\n;       These pattern should be one of the format\n;       accepted by FindFirstFile().\n;\n\n\n[Footprint.Basic]\ndiager.dll\ndiagtrack.dll\ndiagtrackrunner.exe\nreagent.admx\nreagent.dll\nreagent.xml\nsetupplatform.cfg\nsetupplatform.dll\nsetupplatform.exe\nunbcl.dll\nwdsclientapi.dll\nwdscore.dll\nwdscsl.dll\nwdsimage.dll\nwdstptc.dll\nwdsutil.dll\nWinSetupBoot.sys\nWinSetupBoot.hiv\n\n[Footprint.Basic.Delayed]\n*-*\\reagent.adml\n*-*\\reagent.dll.mui\n*-*\\setupplatform.exe.mui\n*-*\\wdsimage.dll.mui\ndu.dll\nReserveManager.dll\n\n\n[Footprint.Servicing]\ndismapi.dll\ndismcore.dll\ndismcoreps.dll\ndismprov.dll\nfolderprovider.dll\nimagingprovider.dll\nlogprovider.dll\npnppropmig.dll\nvhdprovider.dll\nwimprovider.dll\nunattend.dll\nwpx.dll\n\n[Footprint.Servicing.Delayed]\n*-*\\compatprovider.dll.mui\n*-*\\dismapi.dll.mui\n*-*\\dismcore.dll.mui\n*-*\\dismprov.dll.mui\n*-*\\folderprovider.dll.mui\n*-*\\imagingprovider.dll.mui\n*-*\\logprovider.dll.mui\n*-*\\vhdprovider.dll.mui\n*-*\\wimprovider.dll.mui\n\n[Footprint.Servicing.Delayed.amd64]\nsxs\\\n\n[Footprint.Servicing.Delayed.x86]\nsxs\\\n\n\n[Footprint.ICB]\ncmi2migxml.dll\ncsiagent.dll\ndlmanifests\\\nmxeagent.dll\nmigapp.xml\nmigcore.dll\nmighost.exe\nmigisol.dll\nMigration\\\nmigres.dll\nmigstore.dll\nmigsys.dll\noffline.xml\noscomps.xml\noscomps.woa.xml\nosfilter.inf\nreplacementmanifests\\\nsflistw7.dat\nsflistw8.dat\nsflistw8.woa.dat\nsflistwb.dat\nsflistwb.woa.dat\nsflistwt.dat\nsflistwt.woa.dat\nsflistrs1.dat\nsfcn.dat\nsflcid.dat\nsfpat.inf\nsfpatw7.inf\nsfpatw8.inf\nsfpatwb.inf\nsfpatwt.inf\nsfpatrs1.inf\nupgrade_comp.xml\nupgrade_bulk.xml\nupgrade_data.xml\nupgrade_frmwrk.xml\nupgradeagent.dll\nupgradeagent.xml\nupgWow_bulk.xml\n\n[Footprint.ICB.Delayed]\n*-*\\migres.dll.mui\n\n\n[Footprint.Migration]\ncmi2migxml.dll\ncsiagent.dll\ndlmanifests\\\nhwcompat.dll\nhwcompat.txt\nhwcompatPE.txt\nhwexclude.txt\nhwexcludePE.txt\nmxeagent.dll\nmigapp.xml\nmigcore.dll\nmighost.exe\nmigisol.dll\nMigration\\\nmigres.dll\nmigstore.dll\nmigsys.dll\nOfflineProfileUtils.dll\noffline.xml\noscomps.xml\noscomps.woa.xml\nosfilter.inf\nreplacementmanifests\\\nsflistw7.dat\nsflistw8.dat\nsflistw8.woa.dat\nsflistwb.dat\nsflistwb.woa.dat\nsflistwt.dat\nsflistwt.woa.dat\nsflistrs1.dat\nsfcn.dat\nsflcid.dat\nsfpat.inf\nsfpatw7.inf\nsfpatw8.inf\nsfpatwb.inf\nsfpatwt.inf\nsfpatrs1.inf\nuninstall.xml\nuninstall_data.xml\nupgrade_comp.xml\nupgrade_bulk.xml\nupgrade_data.xml\nupgrade_frmwrk.xml\nupgradeagent.dll\nupgradeagent.xml\nupgWow_bulk.xml\n\n[Footprint.Migration.Delayed]\n*-*\\migres.dll.mui\n\n[Footprint.Migration.arm64]\nupgWowA32_bulk.xml\nmiggac\\\n\n\n[Migration.Services.Deferred]\nWinDefend\nWdNisSvc\nWdFilter\nWSearch\nVSS\nSchedule\nWUAUServ\nUSOSvc\nLanmanWorkstation\nBrowser\nNetlogon\nWHSConnector\nvmms\nVmHostAgent\nDoSvc\nPeerDistSvc\nUALSVC\nwscsvc\nDHCPServer\nwlidsvc\nwbiosrvc\nCDPSvc\nWpnService\nTermServLicensing\nhns\nhvsics\nCmService\nWAS\nftpsvc\nW3SVC\nNetMsmqActivator\nNetPipeActivator\nNetTcpActivator\n\n\n[Migration.Services.NoVersionCheck.ServerAzureCor]\nRDAgent\nRDSRS\n\n\n[Migration.VerbosePatterns]\nRegistry,HKLM\\SYSTEM\\CurrentControlSet\\Services\\MpsSvc\\*[*]\nRegistry,HKLM\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\*[*]\nRegistry,HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\*[*]\nRegistry,HKCU\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\*[*]\nFile,%programdata%\\Microsoft\\Windows\\AppRepository\\Packages\\*[*]\n\n\n[Migration.WatchChanges]\n\n\n[Migration.Ignore.ServerAzureCor]\nMicrosoft-Client-License-Platform-Service-Migration\nMicrosoft-OneCore-TileDataRepository\nMicrosoft-Windows-AppX-Deployment-Server\nMicrosoft-Windows-DeliveryOptimization\nMicrosoft-Windows-DeviceAssociationFramework\nMicrosoft-Windows-Security-SPP\nMicrosoft-Windows-Security-NGC-LocalAccountMigPlugin\nMicrosoft-Windows-ServicingStack\nMicrosoft-Windows-WindowsUpdateClient-Core\n\n\n[Migration.IgnoreSMI]\nMicrosoft-Windows-Application-Experience-Infrastructure\nMicrosoft-Windows-CAPI2-certs\nMicrosoft-Windows-CodeIntegrity\nMicrosoft-Windows-CommandPrompt\nMicrosoft-Windows-Credential-Manager\nMicrosoft-Windows-DataIntegrityScan\nMicrosoft-Windows-EventCollector\nMicrosoft-Windows-FSD\nMicrosoft-Windows-Flighting-Settings\nMicrosoft-Windows-HAL\nMicrosoft-Windows-HelpAndSupport\nMicrosoft-Windows-HTTP\nMicrosoft-Windows-International-Core\nMicrosoft-Windows-International-TimeZones\nMicrosoft-Windows-Kernel-PnP\nMicrosoft-Windows-MUI-Settings\nMicrosoft-Windows-NTFS\nMicrosoft-Windows-Network-Security\nMicrosoft-Windows-Network-Security-Domain-Clients-Svc\nMicrosoft-Windows-NetworkProfile\nMicrosoft-Windows-NlaSvc\nMicrosoft-Windows-OS-Kernel-MinWin\nMicrosoft-Windows-PartitionManager\nMicrosoft-Windows-Power-Policy-Definitions\nMicrosoft-Windows-RasBase-RasSstp\nMicrosoft-Windows-Rasppp-Eap\nMicrosoft-Windows-ReFS\nMicrosoft-Windows-Resource-Exhaustion-Detector-Core\nMicrosoft-Windows-SecureStartup-FilterDriver\nMicrosoft-Windows-Security-CredSSP\nMicrosoft-Windows-Security-Digest\nMicrosoft-Windows-Security-Kerberos\nMicrosoft-Windows-Security-NTLM\nMicrosoft-Windows-Security-Schannel\nMicrosoft-Windows-Services-ServiceController-MinWin\nMicrosoft-Windows-TCPIP\nMicrosoft-Windows-TerminalServices-RDP-WinStationExtensions\nMicrosoft-Windows-TerminalServices-SessionDirectory-Client\nMicrosoft-Windows-Time-Service\nMicrosoft-Windows-UDFS\nMicrosoft-Windows-UserInit\nMicrosoft-Windows-VirtualDiskService\nMicrosoft-Windows-WMI-Core\nMicrosoft-Windows-Web-Services-for-Management-Core\nMicrosoft-Windows-Wininit\nProduct-clientcore__Microsoft-Windows-NlaSvc\nProduct-coresystemserver__Microsoft-Windows-Time-Service\nProduct-onecore__Microsoft-Windows-NlaSvc\nProduct-systemos__Microsoft-Windows-NlaSvc\n\n\n[Servicing.KnownDeviceClasses]\n{6bdd1fc1-810f-11d0-bec7-08002be2092f} ; 1394\n{7ebefbc0-3200-11d2-b4c2-00a0c9697d07} ; 61883\n{c166523c-fe0c-4a94-a586-f1a80cfbbf3e} ; AudioEndpoint\n{5989fce8-9cd0-467d-8a6a-5419e31529d4} ; AudioProcessingObject\n{c06ff265-ae09-48f0-812c-16753d7cba83} ; AVC\n{c243ffbd-3afc-45e9-b3d3-2ba18bc7ebc5} ; BarcodeScanner\n{72631e54-78a4-11d0-bcf7-00aa00b7b32a} ; Battery\n{53d29ef7-377c-4d14-864b-eb3a85769359} ; Biometric\n{e0cbf06c-cd8b-4647-bb8a-263b43f0f974} ; Bluetooth\n{4d36e965-e325-11ce-bfc1-08002be10318} ; CDROM\n{4d36e966-e325-11ce-bfc1-08002be10318} ; Computer\n{14b62f50-3f15-11dd-ae16-0800200c9a66} ; DigitalMediaDevices\n{4d36e967-e325-11ce-bfc1-08002be10318} ; DiskDrive\n{4d36e968-e325-11ce-bfc1-08002be10318} ; Display\n{48721b56-6795-11d2-b1a8-0080c72e74a2} ; Dot4\n{49ce6ac8-6f86-11d2-b1e5-0080c72e74a2} ; Dot4Print\n{9da2b80f-f89f-4a49-a5c2-511b085b9e8a} ; EhStorSilo\n{e2f84ce7-8efa-411c-aa69-97454ca4cb57} ; Extension\n{4d36e969-e325-11ce-bfc1-08002be10318} ; FDC\n{f2e7dd72-6468-4e36-b6f1-6488f42c1b52} ; Firmware\n{4d36e980-e325-11ce-bfc1-08002be10318} ; FloppyDisk\n{4d36e96a-e325-11ce-bfc1-08002be10318} ; HDC\n{772e18f2-8925-4229-a5ac-6453cb482fda} ; HidCashDrawer\n{745a17a0-74d3-11d0-b6fe-00a0c90f57da} ; HIDClass\n{2a9fe532-0cdc-44f9-9827-76192f2ca2fb} ; HidMsr\n{6bdd1fc6-810f-11d0-bec7-08002be2092f} ; Image\n{6bdd1fc5-810f-11d0-bec7-08002be2092f} ; Infrared\n{4d36e96b-e325-11ce-bfc1-08002be10318} ; Keyboard\n{8ecc055d-047f-11d1-a537-0000f8753ed1} ; LegacyDriver\n{4d36e96c-e325-11ce-bfc1-08002be10318} ; MEDIA\n{43675d81-502a-4a82-9f84-b75f418c5dea} ; Media Center Extender\n{ce5939ae-ebde-11d0-b181-0000f8753ec4} ; MediumChanger\n{5099944a-f6b9-4057-a056-8c550228544c} ; Memory\n{d421b08e-6d16-41ca-9c4d-9147e5ac98e0} ; Miracast\n{4d36e96d-e325-11ce-bfc1-08002be10318} ; Modem\n{4d36e96e-e325-11ce-bfc1-08002be10318} ; Monitor\n{4d36e96f-e325-11ce-bfc1-08002be10318} ; Mouse\n{4d36e970-e325-11ce-bfc1-08002be10318} ; MTD\n{4d36e971-e325-11ce-bfc1-08002be10318} ; MultiFunction\n{50906cb8-ba12-11d1-bf5d-0000f805f530} ; MultiPortSerial\n{4d36e972-e325-11ce-bfc1-08002be10318} ; Net\n{4d36e973-e325-11ce-bfc1-08002be10318} ; NetClient\n{4d36e974-e325-11ce-bfc1-08002be10318} ; NetService\n{4d36e975-e325-11ce-bfc1-08002be10318} ; NetTrans\n{4d36e977-e325-11ce-bfc1-08002be10318} ; PCMCIA\n <truncated>",
      "strings": [],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "wdsimage.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/4ed57014301e91b0504e0c2a62f4ee969ccf4c179de9788d1307dbc71186d543",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\wdsimage.dll"
      ],
      "size": 750032,
      "crc32": "7B6CCAF6",
      "md5": "b5d99819cb865c4da4ebe8880f5ada7e",
      "sha1": "5bad51becb913f65acc8b2df912ac76a24f0834d",
      "sha256": "4ed57014301e91b0504e0c2a62f4ee969ccf4c179de9788d1307dbc71186d543",
      "sha512": "5ac313784cb4aa3829ae59770049b27d3d50193b206cad43c2d79bb7674766be5199f4f76be9854df635df2094e763ca61f14699d8538f62393f10c781fccfb7",
      "rh_hash": null,
      "ssdeep": "12288:YuUi9cOIJAeMgC14k1BzD96/am+Bzqx8J8yh7Rb6bbYYcdacXgmr0zZkIvSzfqav:Ai9cOsMgC144vOe7RbibYZMcSsldT",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1EAF46D13A6E841BDF2B37530167D3B7A197BB6306F70D8CF12124C9A75216C29A3A727",
      "sha3_384": "8e700fecfb7849e33b83586ca6ce613be71fb6251b90828378e25f73f14fba7ebfa2245cfdb8da9e41fe73a518785df2",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x000a7850",
        "ep_bytes": "8bff558bec837d0c017505e8e5050000",
        "peid_signatures": null,
        "reported_checksum": "0x000c4b79",
        "actual_checksum": "0x000c4b79",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "WdsImage.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x100ad380",
                "name": "memcpy"
              },
              {
                "address": "0x100ad384",
                "name": "wprintf"
              },
              {
                "address": "0x100ad388",
                "name": "_vscwprintf"
              },
              {
                "address": "0x100ad38c",
                "name": "towupper"
              },
              {
                "address": "0x100ad390",
                "name": "wcscpy_s"
              },
              {
                "address": "0x100ad394",
                "name": "swscanf_s"
              },
              {
                "address": "0x100ad398",
                "name": "wcsncmp"
              },
              {
                "address": "0x100ad39c",
                "name": "_wcstoi64"
              },
              {
                "address": "0x100ad3a0",
                "name": "wcsnlen"
              },
              {
                "address": "0x100ad3a4",
                "name": "wcsstr"
              },
              {
                "address": "0x100ad3a8",
                "name": "strncpy_s"
              },
              {
                "address": "0x100ad3ac",
                "name": "memmove"
              },
              {
                "address": "0x100ad3b0",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x100ad3b4",
                "name": "__RTDynamicCast"
              },
              {
                "address": "0x100ad3b8",
                "name": "__dllonexit"
              },
              {
                "address": "0x100ad3bc",
                "name": "_unlock"
              },
              {
                "address": "0x100ad3c0",
                "name": "_lock"
              },
              {
                "address": "0x100ad3c4",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x100ad3c8",
                "name": "_initterm"
              },
              {
                "address": "0x100ad3cc",
                "name": "_amsg_exit"
              },
              {
                "address": "0x100ad3d0",
                "name": "_XcptFilter"
              },
              {
                "address": "0x100ad3d4",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x100ad3d8",
                "name": "_callnewh"
              },
              {
                "address": "0x100ad3dc",
                "name": "?what@exception@@UBEPBDXZ"
              },
              {
                "address": "0x100ad3e0",
                "name": "??1exception@@UAE@XZ"
              },
              {
                "address": "0x100ad3e4",
                "name": "??0exception@@QAE@ABV0@@Z"
              },
              {
                "address": "0x100ad3e8",
                "name": "??0exception@@QAE@XZ"
              },
              {
                "address": "0x100ad3ec",
                "name": "malloc"
              },
              {
                "address": "0x100ad3f0",
                "name": "free"
              },
              {
                "address": "0x100ad3f4",
                "name": "_wcsicmp"
              },
              {
                "address": "0x100ad3f8",
                "name": "wcschr"
              },
              {
                "address": "0x100ad3fc",
                "name": "_strnicmp"
              },
              {
                "address": "0x100ad400",
                "name": "_wcslwr"
              },
              {
                "address": "0x100ad404",
                "name": "bsearch"
              },
              {
                "address": "0x100ad408",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x100ad40c",
                "name": "_wcsrev"
              },
              {
                "address": "0x100ad410",
                "name": "qsort"
              },
              {
                "address": "0x100ad414",
                "name": "strcpy_s"
              },
              {
                "address": "0x100ad418",
                "name": "memmove_s"
              },
              {
                "address": "0x100ad41c",
                "name": "iswdigit"
              },
              {
                "address": "0x100ad420",
                "name": "_wcstoui64"
              },
              {
                "address": "0x100ad424",
                "name": "vswprintf_s"
              },
              {
                "address": "0x100ad428",
                "name": "iswctype"
              },
              {
                "address": "0x100ad42c",
                "name": "_vsnwprintf_s"
              },
              {
                "address": "0x100ad430",
                "name": "wcsrchr"
              },
              {
                "address": "0x100ad434",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x100ad438",
                "name": "wcstoul"
              },
              {
                "address": "0x100ad43c",
                "name": "memcmp"
              },
              {
                "address": "0x100ad440",
                "name": "_wcsupr"
              },
              {
                "address": "0x100ad444",
                "name": "wcstok_s"
              },
              {
                "address": "0x100ad448",
                "name": "toupper"
              },
              {
                "address": "0x100ad44c",
                "name": "iswspace"
              },
              {
                "address": "0x100ad450",
                "name": "iswxdigit"
              },
              {
                "address": "0x100ad454",
                "name": "wcsncat_s"
              },
              {
                "address": "0x100ad458",
                "name": "_onexit"
              },
              {
                "address": "0x100ad45c",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x100ad460",
                "name": "_ftol2"
              },
              {
                "address": "0x100ad464",
                "name": "memcpy_s"
              },
              {
                "address": "0x100ad468",
                "name": "_wtoi64"
              },
              {
                "address": "0x100ad46c",
                "name": "_wtoi"
              },
              {
                "address": "0x100ad470",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x100ad474",
                "name": "_purecall"
              },
              {
                "address": "0x100ad478",
                "name": "memset"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x100ad480",
                "name": "RtlRaiseStatus"
              },
              {
                "address": "0x100ad484",
                "name": "NtYieldExecution"
              },
              {
                "address": "0x100ad488",
                "name": "RtlInitializeCriticalSection"
              },
              {
                "address": "0x100ad48c",
                "name": "NtQuerySymbolicLinkObject"
              },
              {
                "address": "0x100ad490",
                "name": "NtOpenSymbolicLinkObject"
              },
              {
                "address": "0x100ad494",
                "name": "NtQueryObject"
              },
              {
                "address": "0x100ad498",
                "name": "VerSetConditionMask"
              },
              {
                "address": "0x100ad49c",
                "name": "RtlVerifyVersionInfo"
              },
              {
                "address": "0x100ad4a0",
                "name": "NtQueryDirectoryObject"
              },
              {
                "address": "0x100ad4a4",
                "name": "NtOpenDirectoryObject"
              },
              {
                "address": "0x100ad4a8",
                "name": "RtlGetVersion"
              },
              {
                "address": "0x100ad4ac",
                "name": "RtlReAllocateHeap"
              },
              {
                "address": "0x100ad4b0",
                "name": "RtlNtStatusToDosError"
              },
              {
                "address": "0x100ad4b4",
                "name": "RtlAllocateHeap"
              },
              {
                "address": "0x100ad4b8",
                "name": "RtlFreeHeap"
              },
              {
                "address": "0x100ad4bc",
                "name": "RtlCompareMemory"
              },
              {
                "address": "0x100ad4c0",
                "name": "NtSetInformationFile"
              },
              {
                "address": "0x100ad4c4",
                "name": "RtlDosPathNameToNtPathName_U_WithStatus"
              },
              {
                "address": "0x100ad4c8",
                "name": "RtlGetThreadErrorMode"
              },
              {
                "address": "0x100ad4cc",
                "name": "NtUnloadKey2"
              },
              {
                "address": "0x100ad4d0",
                "name": "NtQuerySecurityObject"
              },
              {
                "address": "0x100ad4d4",
                "name": "RtlAdjustPrivilege"
              },
              {
                "address": "0x100ad4d8",
                "name": "RtlImpersonateSelf"
              },
              {
                "address": "0x100ad4dc",
                "name": "NtSetEaFile"
              },
              {
                "address": "0x100ad4e0",
                "name": "RtlInitUnicodeString"
              },
              {
                "address": "0x100ad4e4",
                "name": "NtQueryDirectoryFile"
              },
              {
                "address": "0x100ad4e8",
                "name": "RtlDeleteResource"
              },
              {
                "address": "0x100ad4ec",
                "name": "RtlReleaseResource"
              },
              {
                "address": "0x100ad4f0",
                "name": "RtlAcquireResourceShared"
              },
              {
                "address": "0x100ad4f4",
                "name": "RtlAcquireResourceExclusive"
              },
              {
                "address": "0x100ad4f8",
                "name": "RtlInitializeResource"
              },
              {
                "address": "0x100ad4fc",
                "name": "NtOpenFile"
              },
              {
                "address": "0x100ad500",
                "name": "NtClose"
              },
              {
                "address": "0x100ad504",
                "name": "NtCreateFile"
              },
              {
                "address": "0x100ad508",
                "name": "RtlDosPathNameToNtPathName_U"
              },
              {
                "address": "0x100ad50c",
                "name": "NtQueryEaFile"
              },
              {
                "address": "0x100ad510",
                "name": "NtSetSecurityObject"
              },
              {
                "address": "0x100ad514",
                "name": "RtlFindAceByType"
              },
              {
                "address": "0x100ad518",
                "name": "RtlSetControlSecurityDescriptor"
              },
              {
                "address": "0x100ad51c",
                "name": "RtlGetLastNtStatus"
              },
              {
                "address": "0x100ad520",
                "name": "NtQueryInformationProcess"
              },
              {
                "address": "0x100ad524",
                "name": "NtQueryVolumeInformationFile"
              },
              {
                "address": "0x100ad528",
                "name": "NtQueryInformationFile"
              },
              {
                "address": "0x100ad52c",
                "name": "RtlSetThreadErrorMode"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x100ad000",
                "name": "RegFlushKey"
              },
              {
                "address": "0x100ad004",
                "name": "SetThreadToken"
              },
              {
                "address": "0x100ad008",
                "name": "DuplicateTokenEx"
              },
              {
                "address": "0x100ad00c",
                "name": "GetKernelObjectSecurity"
              },
              {
                "address": "0x100ad010",
                "name": "AdjustTokenPrivileges"
              },
              {
                "address": "0x100ad014",
                "name": "LookupPrivilegeValueW"
              },
              {
                "address": "0x100ad018",
                "name": "RegLoadKeyW"
              },
              {
                "address": "0x100ad01c",
                "name": "RegUnLoadKeyW"
              },
              {
                "address": "0x100ad020",
                "name": "RegQueryInfoKeyW"
              },
              {
                "address": "0x100ad024",
                "name": "RevertToSelf"
              },
              {
                "address": "0x100ad028",
                "name": "CloseEncryptedFileRaw"
              },
              {
                "address": "0x100ad02c",
                "name": "WriteEncryptedFileRaw"
              },
              {
                "address": "0x100ad030",
                "name": "OpenEncryptedFileRawW"
              },
              {
                "address": "0x100ad034",
                "name": "GetSecurityInfo"
              },
              {
                "address": "0x100ad038",
                "name": "GetAclInformation"
              },
              {
                "address": "0x100ad03c",
                "name": "GetSecurityDescriptorLength"
              },
              {
                "address": "0x100ad040",
                "name": "FreeSid"
              },
              {
                "address": "0x100ad044",
                "name": "SetSecurityDescriptorDacl"
              },
              {
                "address": "0x100ad048",
                "name": "EqualSid"
              },
              {
                "address": "0x100ad04c",
                "name": "ConvertStringSecurityDescriptorToSecurityDescriptorW"
              },
              {
                "address": "0x100ad050",
                "name": "SetNamedSecurityInfoW"
              },
              {
                "address": "0x100ad054",
                "name": "GetFileSecurityW"
              },
              {
                "address": "0x100ad058",
                "name": "ConvertSecurityDescriptorToStringSecurityDescriptorW"
              },
              {
                "address": "0x100ad05c",
                "name": "GetSecurityDescriptorControl"
              },
              {
                "address": "0x100ad060",
                "name": "GetSecurityDescriptorOwner"
              },
              {
                "address": "0x100ad064",
                "name": "GetSecurityDescriptorGroup"
              },
              {
                "address": "0x100ad068",
                "name": "GetSecurityDescriptorDacl"
              },
              {
                "address": "0x100ad06c",
                "name": "GetSecurityDescriptorSacl"
              },
              {
                "address": "0x100ad070",
                "name": "AddAccessAllowedAce"
              },
              {
                "address": "0x100ad074",
                "name": "InitializeAcl"
              },
              {
                "address": "0x100ad078",
                "name": "GetLengthSid"
              },
              {
                "address": "0x100ad07c",
                "name": "GetTokenInformation"
              },
              {
                "address": "0x100ad080",
                "name": "OpenProcessToken"
              },
              {
                "address": "0x100ad084",
                "name": "OpenThreadToken"
              },
              {
                "address": "0x100ad088",
                "name": "AllocateAndInitializeSid"
              },
              {
                "address": "0x100ad08c",
                "name": "InitializeSecurityDescriptor"
              },
              {
                "address": "0x100ad090",
                "name": "RegCloseKey"
              },
              {
                "address": "0x100ad094",
                "name": "RegDeleteKeyExW"
              },
              {
                "address": "0x100ad098",
                "name": "ReadEncryptedFileRaw"
              },
              {
                "address": "0x100ad09c",
                "name": "RegCreateKeyExW"
              },
              {
                "address": "0x100ad0a0",
                "name": "RegEnumKeyExW"
              },
              {
                "address": "0x100ad0a4",
                "name": "RegSetValueExW"
              },
              {
                "address": "0x100ad0a8",
                "name": "RegOpenKeyExW"
              },
              {
                "address": "0x100ad0ac",
                "name": "RegDeleteValueW"
              },
              {
                "address": "0x100ad0b0",
                "name": "RegEnumValueW"
              },
              {
                "address": "0x100ad0b4",
                "name": "RegQueryValueExW"
              },
              {
                "address": "0x100ad0b8",
                "name": "RegGetValueW"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x100ad0dc",
                "name": "GetTempFileNameW"
              },
              {
                "address": "0x100ad0e0",
                "name": "GetFileSize"
              },
              {
                "address": "0x100ad0e4",
                "name": "FindFirstVolumeW"
              },
              {
                "address": "0x100ad0e8",
                "name": "GetLogicalDrives"
              },
              {
                "address": "0x100ad0ec",
                "name": "Wow64DisableWow64FsRedirection"
              },
              {
                "address": "0x100ad0f0",
                "name": "CreateProcessW"
              },
              {
                "address": "0x100ad0f4",
                "name": "Wow64RevertWow64FsRedirection"
              },
              {
                "address": "0x100ad0f8",
                "name": "WaitForSingleObjectEx"
              },
              {
                "address": "0x100ad0fc",
                "name": "FindVolumeClose"
              },
              {
                "address": "0x100ad100",
                "name": "DefineDosDeviceW"
              },
              {
                "address": "0x100ad104",
                "name": "MapViewOfFileEx"
              },
              {
                "address": "0x100ad108",
                "name": "GetDiskFreeSpaceExW"
              },
              {
                "address": "0x100ad10c",
                "name": "RaiseException"
              },
              {
                "address": "0x100ad110",
                "name": "QueryDosDeviceW"
              },
              {
                "address": "0x100ad114",
                "name": "FindNextVolumeW"
              },
              {
                "address": "0x100ad118",
                "name": "TerminateProcess"
              },
              {
                "address": "0x100ad11c",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x100ad120",
                "name": "GetExitCodeProcess"
              },
              {
                "address": "0x100ad124",
                "name": "OutputDebugStringW"
              },
              {
                "address": "0x100ad128",
                "name": "GetFileTime"
              },
              {
                "address": "0x100ad12c",
                "name": "MoveFileWithProgressW"
              },
              {
                "address": "0x100ad130",
                "name": "GetVolumePathNamesForVolumeNameW"
              },
              {
                "address": "0x100ad134",
                "name": "LoadLibraryW"
              },
              {
                "address": "0x100ad138",
                "name": "TlsSetValue"
              },
              {
                "address": "0x100ad13c",
                "name": "TlsGetValue"
              },
              {
                "address": "0x100ad140",
                "name": "TlsFree"
              },
              {
                "address": "0x100ad144",
                "name": "TlsAlloc"
              },
              {
                "address": "0x100ad148",
                "name": "SetFileTime"
              },
              {
                "address": "0x100ad14c",
                "name": "LocalFileTimeToFileTime"
              },
              {
                "address": "0x100ad150",
                "name": "DosDateTimeToFileTime"
              },
              {
                "address": "0x100ad154",
                "name": "MultiByteToWideChar"
              },
              {
                "address": "0x100ad158",
                "name": "WaitForMultipleObjectsEx"
              },
              {
                "address": "0x100ad15c",
                "name": "CreateSemaphoreExW"
              },
              {
                "address": "0x100ad160",
                "name": "GetSystemDirectoryW"
              },
              {
                "address": "0x100ad164",
                "name": "RemoveDirectoryW"
              },
              {
                "address": "0x100ad168",
                "name": "GlobalMemoryStatusEx"
              },
              {
                "address": "0x100ad16c",
                "name": "GetVolumeInformationByHandleW"
              },
              {
                "address": "0x100ad170",
                "name": "UnmapViewOfFile"
              },
              {
                "address": "0x100ad174",
                "name": "MapViewOfFile"
              },
              {
                "address": "0x100ad178",
                "name": "CreateFileMappingW"
              },
              {
                "address": "0x100ad17c",
                "name": "CreateSemaphoreW"
              },
              {
                "address": "0x100ad180",
                "name": "ReleaseSemaphore"
              },
              {
                "address": "0x100ad184",
                "name": "WaitForMultipleObjects"
              },
              {
                "address": "0x100ad188",
                "name": "GetPrivateProfileSectionW"
              },
              {
                "address": "0x100ad18c",
                "name": "SetThreadIdealProcessor"
              },
              {
                "address": "0x100ad190",
                "name": "GetSystemInfo"
              },
              {
                "address": "0x100ad194",
                "name": "DuplicateHandle"
              },
              {
                "address": "0x100ad198",
                "name": "HeapReAlloc"
              },
              {
                "address": "0x100ad19c",
                "name": "OpenProcess"
              },
              {
                "address": "0x100ad1a0",
                "name": "GetCurrentThread"
              },
              {
                "address": "0x100ad1a4",
                "name": "WideCharToMultiByte"
              },
              {
                "address": "0x100ad1a8",
                "name": "ReleaseMutex"
              },
              {
                "address": "0x100ad1ac",
                "name": "GetModuleHandleExW"
              },
              {
                "address": "0x100ad1b0",
                "name": "CreateMutexW"
              },
              {
                "address": "0x100ad1b4",
                "name": "LocalAlloc"
              },
              {
                "address": "0x100ad1b8",
                "name": "UnlockFileEx"
              },
              {
                "address": "0x100ad1bc",
                "name": "VirtualFree"
              },
              {
                "address": "0x100ad1c0",
                "name": "VirtualAlloc"
              },
              {
                "address": "0x100ad1c4",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x100ad1c8",
                "name": "GetTickCount"
              },
              {
                "address": "0x100ad1cc",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x100ad1d0",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x100ad1d4",
                "name": "LockFileEx"
              },
              {
                "address": "0x100ad1d8",
                "name": "SetFilePointer"
              },
              {
                "address": "0x100ad1dc",
                "name": "InitializeCriticalSectionAndSpinCount"
              },
              {
                "address": "0x100ad1e0",
                "name": "CreateEventW"
              },
              {
                "address": "0x100ad1e4",
                "name": "GetVolumeInformationW"
              },
              {
                "address": "0x100ad1e8",
                "name": "WriteFile"
              },
              {
                "address": "0x100ad1ec",
                "name": "GetOverlappedResult"
              },
              {
                "address": "0x100ad1f0",
                "name": "ReadFile"
              },
              {
                "address": "0x100ad1f4",
                "name": "SetEndOfFile"
              },
              {
                "address": "0x100ad1f8",
                "name": "SetFilePointerEx"
              },
              {
                "address": "0x100ad1fc",
                "name": "GetFileSizeEx"
              },
              {
                "address": "0x100ad200",
                "name": "GetHandleInformation"
              },
              {
                "address": "0x100ad204",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x100ad208",
                "name": "FreeLibrary"
              },
              {
                "address": "0x100ad20c",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x100ad210",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x100ad214",
                "name": "Sleep"
              },
              {
                "address": "0x100ad218",
                "name": "LocalFree"
              },
              {
                "address": "0x100ad21c",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x100ad220",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x100ad224",
                "name": "GetFullPathNameW"
              },
              {
                "address": "0x100ad228",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x100ad22c",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x100ad230",
                "name": "DeleteFileW"
              },
              {
                "address": "0x100ad234",
                "name": "CopyFileW"
              },
              {
                "address": "0x100ad238",
                "name": "SetFileAttributesW"
              },
              {
                "address": "0x100ad23c",
                "name": "CloseHandle"
              },
              {
                "address": "0x100ad240",
                "name": "CreateFileW"
              },
              {
                "address": "0x100ad244",
                "name": "SetLastError"
              },
              {
                "address": "0x100ad248",
                "name": "FindClose"
              },
              {
                "address": "0x100ad24c",
                "name": "FindNextFileW"
              },
              {
                "address": "0x100ad250",
                "name": "FindFirstFileW"
              },
              {
                "address": "0x100ad254",
                "name": "MoveFileW"
              },
              {
                "address": "0x100ad258",
                "name": "CreateDirectoryW"
              },
              {
                "address": "0x100ad25c",
                "name": "GetLastError"
              },
              {
                "address": "0x100ad260",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x100ad264",
                "name": "FileTimeToSystemTime"
              },
              {
                "address": "0x100ad268",
                "name": "HeapAlloc"
              },
              {
                "address": "0x100ad26c",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x100ad270",
                "name": "HeapFree"
              },
              {
                "address": "0x100ad274",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x100ad278",
                "name": "ResetEvent"
              },
              {
                "address": "0x100ad27c",
                "name": "CreateThread"
              },
              {
                "address": "0x100ad280",
                "name": "SetEvent"
              },
              {
                "address": "0x100ad284",
                "name": "FormatMessageW"
              },
              {
                "address": "0x100ad288",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x100ad28c",
                "name": "GetEnvironmentVariableW"
              },
              {
                "address": "0x100ad290",
                "name": "SetEnvironmentVariableW"
              },
              {
                "address": "0x100ad294",
                "name": "GetDriveTypeW"
              },
              {
                "address": "0x100ad298",
                "name": "GetCurrentDirectoryW"
              },
              {
                "address": "0x100ad29c",
                "name": "GetVolumeNameForVolumeMountPointW"
              },
              {
                "address": "0x100ad2a0",
                "name": "GetVolumePathNameW"
              },
              {
                "address": "0x100ad2a4",
                "name": "GetModuleFileNameW"
              },
              {
                "address": "0x100ad2a8",
                "name": "GetFinalPathNameByHandleW"
              },
              {
                "address": "0x100ad2ac",
                "name": "GetLongPathNameW"
              },
              {
                "address": "0x100ad2b0",
                "name": "CompareStringW"
              },
              {
                "address": "0x100ad2b4",
                "name": "FlushFileBuffers"
              },
              {
                "address": "0x100ad2b8",
                "name": "CopyFileExW"
              },
              {
                "address": "0x100ad2bc",
                "name": "GetProcAddress"
              },
              {
                "address": "0x100ad2c0",
                "name": "SetFileInformationByHandle"
              },
              {
                "address": "0x100ad2c4",
                "name": "GetFileInformationByHandle"
              },
              {
                "address": "0x100ad2c8",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x100ad2cc",
                "name": "GetTempPathW"
              },
              {
                "address": "0x100ad2d0",
                "name": "DeviceIoControl"
              },
              {
                "address": "0x100ad2d4",
                "name": "GetFileInformationByHandleEx"
              },
              {
                "address": "0x100ad2d8",
                "name": "GetDiskFreeSpaceW"
              }
            ]
          },
          "RPCRT4": {
            "dll": "RPCRT4.dll",
            "imports": [
              {
                "address": "0x100ad308",
                "name": "I_RpcMapWin32Status"
              },
              {
                "address": "0x100ad30c",
                "name": "UuidToStringW"
              },
              {
                "address": "0x100ad310",
                "name": "RpcStringFreeW"
              },
              {
                "address": "0x100ad314",
                "name": "UuidFromStringW"
              },
              {
                "address": "0x100ad318",
                "name": "NdrClientCall2"
              },
              {
                "address": "0x100ad31c",
                "name": "RpcStringBindingComposeW"
              },
              {
                "address": "0x100ad320",
                "name": "RpcBindingFromStringBindingW"
              },
              {
                "address": "0x100ad324",
                "name": "RpcBindingSetAuthInfoW"
              },
              {
                "address": "0x100ad328",
                "name": "RpcBindingFree"
              },
              {
                "address": "0x100ad32c",
                "name": "UuidCreate"
              }
            ]
          },
          "USER32": {
            "dll": "USER32.dll",
            "imports": [
              {
                "address": "0x100ad344",
                "name": "CharUpperW"
              },
              {
                "address": "0x100ad348",
                "name": "CharUpperBuffW"
              }
            ]
          },
          "bcrypt": {
            "dll": "bcrypt.dll",
            "imports": [
              {
                "address": "0x100ad360",
                "name": "BCryptOpenAlgorithmProvider"
              },
              {
                "address": "0x100ad364",
                "name": "BCryptGetProperty"
              },
              {
                "address": "0x100ad368",
                "name": "BCryptCreateHash"
              },
              {
                "address": "0x100ad36c",
                "name": "BCryptFinishHash"
              },
              {
                "address": "0x100ad370",
                "name": "BCryptDestroyHash"
              },
              {
                "address": "0x100ad374",
                "name": "BCryptHashData"
              },
              {
                "address": "0x100ad378",
                "name": "BCryptCloseAlgorithmProvider"
              }
            ]
          },
          "Cabinet": {
            "dll": "Cabinet.dll",
            "imports": []
          },
          "SHLWAPI": {
            "dll": "SHLWAPI.dll",
            "imports": [
              {
                "address": "0x100ad33c",
                "name": "PathIsUNCW"
              }
            ]
          },
          "Normaliz": {
            "dll": "Normaliz.dll",
            "imports": [
              {
                "address": "0x100ad2e0",
                "name": "IdnToAscii"
              }
            ]
          },
          "ole32": {
            "dll": "ole32.dll",
            "imports": [
              {
                "address": "0x100ad534",
                "name": "CLSIDFromString"
              },
              {
                "address": "0x100ad538",
                "name": "StringFromCLSID"
              },
              {
                "address": "0x100ad53c",
                "name": "CoCreateInstance"
              },
              {
                "address": "0x100ad540",
                "name": "CoTaskMemFree"
              },
              {
                "address": "0x100ad544",
                "name": "CoUninitialize"
              },
              {
                "address": "0x100ad548",
                "name": "CoInitializeEx"
              },
              {
                "address": "0x100ad54c",
                "name": "CoSetProxyBlanket"
              },
              {
                "address": "0x100ad550",
                "name": "CoInitializeSecurity"
              }
            ]
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x100ad2e8",
                "name": "VariantClear"
              },
              {
                "address": "0x100ad2ec",
                "name": "SetErrorInfo"
              },
              {
                "address": "0x100ad2f0",
                "name": "GetErrorInfo"
              },
              {
                "address": "0x100ad2f4",
                "name": "SafeArrayGetElement"
              },
              {
                "address": "0x100ad2f8",
                "name": "SysFreeString"
              },
              {
                "address": "0x100ad2fc",
                "name": "SysAllocString"
              },
              {
                "address": "0x100ad300",
                "name": "SysStringLen"
              }
            ]
          },
          "SETUPAPI": {
            "dll": "SETUPAPI.dll",
            "imports": [
              {
                "address": "0x100ad334",
                "name": "CMP_WaitNoPendingInstallEvents"
              }
            ]
          },
          "VERSION": {
            "dll": "VERSION.dll",
            "imports": [
              {
                "address": "0x100ad350",
                "name": "GetFileVersionInfoSizeExW"
              },
              {
                "address": "0x100ad354",
                "name": "GetFileVersionInfoExW"
              },
              {
                "address": "0x100ad358",
                "name": "VerQueryValueW"
              }
            ]
          },
          "FLTLIB": {
            "dll": "FLTLIB.DLL",
            "imports": [
              {
                "address": "0x100ad0d0",
                "name": "FilterAttach"
              },
              {
                "address": "0x100ad0d4",
                "name": "FilterLoad"
              }
            ]
          }
        },
        "exported_dll_name": "WdsImage.dll",
        "exports": [
          {
            "address": "0x100205e0",
            "name": "FindFirstImage",
            "ordinal": 1
          },
          {
            "address": "0x100206b0",
            "name": "FindNextImage",
            "ordinal": 2
          },
          {
            "address": "0x1001c150",
            "name": "WDSFreeImageInformation",
            "ordinal": 3
          },
          {
            "address": "0x1001c480",
            "name": "WDSGetImageInformation",
            "ordinal": 4
          },
          {
            "address": "0x1001c120",
            "name": "WDSInitializeEmptyImageInformation",
            "ordinal": 5
          },
          {
            "address": "0x1001c590",
            "name": "WDSParseImageInformation",
            "ordinal": 6
          },
          {
            "address": "0x1001c350",
            "name": "WDSSetImageInformation",
            "ordinal": 7
          },
          {
            "address": "0x10024760",
            "name": "WdsImgAddReference",
            "ordinal": 8
          },
          {
            "address": "0x1001df70",
            "name": "WdsImgApplyImage",
            "ordinal": 9
          },
          {
            "address": "0x1001ce20",
            "name": "WdsImgAssignImageIdentifier",
            "ordinal": 10
          },
          {
            "address": "0x1001cf20",
            "name": "WdsImgAssignPredefinedImageIdentifier",
            "ordinal": 11
          },
          {
            "address": "0x1001e3d0",
            "name": "WdsImgCaptureImage",
            "ordinal": 12
          },
          {
            "address": "0x1001ce90",
            "name": "WdsImgClearImageIdentifier",
            "ordinal": 13
          },
          {
            "address": "0x100246b0",
            "name": "WdsImgClose",
            "ordinal": 14
          },
          {
            "address": "0x1001ded0",
            "name": "WdsImgCopyImage",
            "ordinal": 15
          },
          {
            "address": "0x1001f000",
            "name": "WdsImgCreateImageGroup",
            "ordinal": 16
          },
          {
            "address": "0x1001e020",
            "name": "WdsImgDeleteImage",
            "ordinal": 17
          },
          {
            "address": "0x1001f3a0",
            "name": "WdsImgDeleteImageGroup",
            "ordinal": 18
          },
          {
            "address": "0x1001db70",
            "name": "WdsImgDeleteUnattendFile",
            "ordinal": 19
          },
          {
            "address": "0x1001ddd0",
            "name": "WdsImgExportImage",
            "ordinal": 20
          },
          {
            "address": "0x1001e510",
            "name": "WdsImgExtractFiles",
            "ordinal": 21
          },
          {
            "address": "0x10020740",
            "name": "WdsImgFindFirstImage",
            "ordinal": 22
          },
          {
            "address": "0x1001fa00",
            "name": "WdsImgFindFirstImageGroup",
            "ordinal": 23
          },
          {
            "address": "0x10020820",
            "name": "WdsImgFindNextImage",
            "ordinal": 24
          },
          {
            "address": "0x1001fac0",
            "name": "WdsImgFindNextImageGroup",
            "ordinal": 25
          },
          {
            "address": "0x1001d660",
            "name": "WdsImgGetArchitecture",
            "ordinal": 26
          },
          {
            "address": "0x1001d220",
            "name": "WdsImgGetBootIndex",
            "ordinal": 27
          },
          {
            "address": "0x100249d0",
            "name": "WdsImgGetCompressionType",
            "ordinal": 28
          },
          {
            "address": "0x1001d760",
            "name": "WdsImgGetCreationTime",
            "ordinal": 29
          },
          {
            "address": "0x1001d8b0",
            "name": "WdsImgGetDependantFiles",
            "ordinal": 30
          },
          {
            "address": "0x1001cfa0",
            "name": "WdsImgGetDescription",
            "ordinal": 31
          },
          {
            "address": "0x1001d4d0",
            "name": "WdsImgGetEnabled",
            "ordinal": 32
          },
          {
            "address": "0x1001d550",
            "name": "WdsImgGetExFlags",
            "ordinal": 33
          },
          {
            "address": "0x1001cfc0",
            "name": "WdsImgGetFlags",
            "ordinal": 34
          },
          {
            "address": "0x1001cca0",
            "name": "WdsImgGetGuid",
            "ordinal": 35
          },
          {
            "address": "0x1001d5e0",
            "name": "WdsImgGetHalName",
            "ordinal": 36
          },
          {
            "address": "0x10024930",
            "name": "WdsImgGetHandleFromFindHandle",
            "ordinal": 37
          },
          {
            "address": "0x1001cba0",
            "name": "WdsImgGetImageFormat",
            "ordinal": 38
          },
          {
            "address": "0x1001cd90",
            "name": "WdsImgGetImageIdentifier",
            "ordinal": 39
          },
          {
            "address": "0x1001cd20",
            "name": "WdsImgGetImageIdentifierPresent",
            "ordinal": 40
          },
          {
            "address": "0x1001d1b0",
            "name": "WdsImgGetIndex",
            "ordinal": 41
          },
          {
            "address": "0x1001d310",
            "name": "WdsImgGetLanguage",
            "ordinal": 42
          },
          {
            "address": "0x1001d930",
            "name": "WdsImgGetLanguages",
            "ordinal": 43
          },
          {
            "address": "0x1001d7d0",
            "name": "WdsImgGetLastModifiedTime",
            "ordinal": 44
          },
          {
            "address": "0x1001cc80",
            "name": "WdsImgGetName",
            "ordinal": 45
          },
          {
            "address": "0x1001d040",
            "name": "WdsImgGetPartitionStyle",
            "ordinal": 46
          },
          {
            "address": "0x10024800",
            "name": "WdsImgGetPath",
            "ordinal": 47
          },
          {
            "address": "0x1001d490",
            "name": "WdsImgGetProductFamily",
            "ordinal": 48
          },
          {
            "address": "0x1001d4b0",
            "name": "WdsImgGetProductName",
            "ordinal": 49
          },
          {
            "address": "0x1001cc10",
            "name": "WdsImgGetResourcePath",
            "ordinal": 50
          },
          {
            "address": "0x1001d0b0",
            "name": "WdsImgGetSecurity",
            "ordinal": 51
          },
          {
            "address": "0x1001d410",
            "name": "WdsImgGetServicePackLevel",
            "ordinal": 52
          },
          {
            "address": "0x1001d130",
            "name": "WdsImgGetSize",
            "ordinal": 53
          },
          {
            "address": "0x1001d5c0",
            "name": "WdsImgGetSystemRoot",
            "ordinal": 54
          },
          {
            "address": "0x1001d840",
            "name": "WdsImgGetUnattendFilePresent",
            "ordinal": 55
          },
          {
            "address": "0x1001d390",
            "name": "WdsImgGetVersion",
            "ordinal": 56
          },
          {
            "address": "0x1001d6e0",
            "name": "WdsImgGetXml",
            "ordinal": 57
          },
          {
            "address": "0x1001f420",
            "name": "WdsImgGroupCanImportImage",
            "ordinal": 58
          },
          {
            "address": "0x1001f530",
            "name": "WdsImgGroupGetImageFormat",
            "ordinal": 59
          },
          {
            "address": "0x1001fb40",
            "name": "WdsImgGroupGetName",
            "ordinal": 60
          },
          {
            "address": "0x1001f2a0",
            "name": "WdsImgGroupGetSecurity",
            "ordinal": 61
          },
          {
            "address": "0x1001f2e0",
            "name": "WdsImgGroupSetName",
            "ordinal": 62
          },
          {
            "address": "0x1001f340",
            "name": "WdsImgGroupSetSecurity",
            "ordinal": 63
          },
          {
            "address": "0x1001dcb0",
            "name": "WdsImgImportImage",
            "ordinal": 64
          },
          {
            "address": "0x10024700",
            "name": "WdsImgIsAccessible",
            "ordinal": 65
          },
          {
            "address": "0x1001d290",
            "name": "WdsImgIsBootImage",
            "ordinal": 66
          },
          {
            "address": "0x1001d9c0",
            "name": "WdsImgIsFoundationImage",
            "ordinal": 67
          },
          {
            "address": "0x100247b0",
            "name": "WdsImgIsValidImageFile",
            "ordinal": 68
          },
          {
            "address": "0x1001f1c0",
            "name": "WdsImgOpenBootImageGroup",
            "ordinal": 69
          },
          {
            "address": "0x1001cac0",
            "name": "WdsImgOpenImage",
            "ordinal": 70
          },
          {
            "address": "0x1001f100",
            "name": "WdsImgOpenImageGroup",
            "ordinal": 71
          },
          {
            "address": "0x1001f680",
            "name": "WdsImgOpenImageStore",
            "ordinal": 72
          },
          {
            "address": "0x1001dfe0",
            "name": "WdsImgRefreshData",
            "ordinal": 73
          },
          {
            "address": "0x1001e160",
            "name": "WdsImgReplaceImage",
            "ordinal": 74
          },
          {
            "address": "0x1001e380",
            "name": "WdsImgSetBootImage",
            "ordinal": 75
          },
          {
            "address": "0x1001da70",
            "name": "WdsImgSetDescription",
            "ordinal": 76
          },
          {
            "address": "0x1001daf0",
            "name": "WdsImgSetEnabled",
            "ordinal": 77
          },
          {
            "address": "0x1001da30",
            "name": "WdsImgSetName",
            "ordinal": 78
          },
          {
            "address": "0x1001dab0",
            "name": "WdsImgSetSecurity",
            "ordinal": 79
          },
          {
            "address": "0x1001dc20",
            "name": "WdsImgSetUnattendFile",
            "ordinal": 80
          },
          {
            "address": "0x1001e070",
            "name": "WdsImgVerifyImageFile",
            "ordinal": 81
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x000a9be0",
            "size": "0x00000a01"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x000ad55c",
            "size": "0x00000140"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x000b0000",
            "size": "0x00001298"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x000b5000",
            "size": "0x000021d0"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x000b2000",
            "size": "0x00006d04"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x0001b330",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x000037ac",
            "size": "0x00000018"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x00003700",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x000ad000",
            "size": "0x00000558"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x000a95e1",
            "size_of_data": "0x000a9600",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.52"
          },
          {
            "name": ".data",
            "raw_address": "0x000a9a00",
            "virtual_address": "0x000ab000",
            "virtual_size": "0x000018a8",
            "size_of_data": "0x00000e00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "4.82"
          },
          {
            "name": ".idata",
            "raw_address": "0x000aa800",
            "virtual_address": "0x000ad000",
            "virtual_size": "0x000024c0",
            "size_of_data": "0x00002600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.65"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x000ace00",
            "virtual_address": "0x000b0000",
            "virtual_size": "0x00001298",
            "size_of_data": "0x00001400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "3.23"
          },
          {
            "name": ".reloc",
            "raw_address": "0x000ae200",
            "virtual_address": "0x000b2000",
            "virtual_size": "0x00006d04",
            "size_of_data": "0x00006e00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.76"
          }
        ],
        "overlay": {
          "offset": "0x000b5000",
          "size": "0x000021d0"
        },
        "resources": [
          {
            "name": "MUI",
            "offset": "0x000b11d0",
            "size": "0x000000c8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.68"
          },
          {
            "name": "RT_MESSAGETABLE",
            "offset": "0x000b04b8",
            "size": "0x00000d14",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.26"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x000b00f0",
            "size": "0x000003c8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.51"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows Deployment Services Image Library"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "WdsImage.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "WdsImage.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "81a88ef33e5f5f68f3ab0bd66cd8f5f3",
        "timestamp": "2037-03-20 07:31:10",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 15
      },
      "data": null,
      "strings": [
        "Wmi::OpenNamespace: Failed to initialize security (0x%08x)",
        "ro-MD",
        "mk-MK",
        "WimImageEnqueueOperation",
        "GetTokenInformation",
        "? ?,?8?D?P?\\?h?t?",
        "Property value is an array; will return the first item.",
        "808A8H8~8",
        ">_>f>q>",
        ".?AV?$CAutoDeleteArray@G@RAII@@",
        "AddReparsePointToImage",
        "sr-Cyrl-RS",
        "es-DO",
        ".CRT$XLA",
        "WdsImgIsFoundationImage",
        "545V5n5w5",
        "<?<H<",
        "RestoreFileMetadata: RestoreFileInfo failed",
        "Microsoft Time-Stamp Service",
        "WimExchangeFiles: Delete failed",
        "StateStoreGetMountedImagePathId",
        "%s: Reconstituting wim at %s.",
        "1<1U1|1",
        "ShouldSuspendBitlocker",
        "Control\\Class\\{4D36E966-E325-11CE-BFC1-08002BE10318}",
        "mi-NZ",
        "5.5k5r5",
        "VDiskOnlineSurfacedDiskUsingVds: Couldn't bring disk online; hr = 0x%X",
        "7 7$7(7,7@7D7H7`7d7|7",
        "\\\\.\\?:",
        "j\\Yuj",
        "3G3M3",
        "\\system32\\ssshim.dll",
        "SetNamedSecurityInfoW",
        "ar-MA",
        "1J2Q2^2e2v2}2",
        "SPLEVEL",
        "QPWSQQh",
        "http://www.w3.org/XML/1998/namespace",
        "RtlNtStatusToDosError",
        "EnableShortnamesOnApplyTarget",
        "%wNtE",
        "RestoreHardlink",
        "ml-IN",
        "Compact",
        "nb-NO",
        "Control\\MUI\\UILanguages",
        "0!0-0X0_0e0",
        "WIMSetFileShortName",
        ".?AVWmiCollection@WMI@@",
        ">A>m>t>",
        "f92u9A",
        "9$9b9",
        "lo-LA",
        "#document",
        "<1<N<d<",
        "586F6i6p6",
        "=,=3=C=W=",
        "?&?V?",
        "CMicrodom_Blob",
        "475>5S5f5",
        "malloc",
        "es-BO",
        "y0Vh[",
        "9sTtr",
        ".?AVIDepWIMImage@@",
        "_wtoi64",
        "3>3O3",
        ">V?]?|?",
        "QQQQj",
        "tFWj;P",
        "UCS-4",
        "6Q6e6",
        ";3;9;E;b;i;u;",
        "SendAbortMessage",
        "9~Xt#",
        "t';z|r\"w",
        "NtQueryInformationProcess",
        "QQVW3",
        "%s: Generated new metadata for %s.",
        "7,838",
        "777>7h7",
        "RegCreateKeyExW",
        "PUBLIC",
        "DuplicateHandle",
        "UnmapViewOfFile",
        "Substitue name string copy failed",
        "2J2x2",
        "Cf9Y*",
        "az-Cyrl-AZ",
        "9t$8tJ",
        "3(343@3L3X3d3p3|3",
        "2;3x3",
        "\\System Volume Information\\FVE2.{e40ad34d-dae9-4bc7-95bd-b16218c10f72}.X",
        "=3>\\>f>~>",
        "686o6x6",
        "InitVDSService:Loading VDS service... ",
        "de-CH",
        "Mount path low",
        "6!666h6",
        "sr-Latn",
        "u%jXh0j",
        "L$D_^[3",
        "VhdSafeReadMetadata: Failed to read file %s [0x%08x]",
        ">6?|?",
        "A(SQSSPSSQ",
        "FveAddAuthMethodInformation",
        "2,383s3",
        "061E1K1",
        "LocalSize failed",
        "WdsImgDeleteUnattendFile",
        "WIM_Chunked_Number_Of_Buffers",
        "3!3)353?3G3N3^3",
        "Image Index",
        "StateStoreGetMountedImageStatus",
        ";X;e;l;w;",
        "WIM_Chunked_Parallel_Decode",
        "TOTALBYTES",
        "ysWhE",
        "WdsImgGetGuid",
        "1 1<1",
        "GetImageErrorCode",
        "wcsstr",
        "system32",
        "en-CA",
        "D$H^f",
        "9\\$Pv",
        ">2>8>O>V>",
        "ts-ZA",
        "WDSSetImageInformation",
        "OpenProcess",
        "CVhdInfoInterface::GetFileParts",
        "t!<(t",
        "DetachVirtualDisk",
        "[ybVhl",
        "Base.VHDX",
        "9d:m:",
        "@(93u",
        "<==D=",
        "2\"3G3^3e3",
        "DefineDosDeviceW",
        "Apparent split WIM file [%s] is part number %u (expected %u)",
        "CommitTransaction",
        "D$0VPhH",
        "TerminateProcess",
        "The image group already contains images of a different type. %n",
        "y6Vhj",
        "SetThreadToken",
        "RestoreSecurityDescriptor failed",
        "s$97t",
        ">,>0>@>D>T>X>\\>t>x>",
        "VW9Y0ty",
        "CreationTime\\HighPart",
        ".idata$5",
        ".?AVCDepVHDImage@@",
        "3%3O3i3o3",
        "3!353<3Q3X3g3n3",
        "t*WPd",
        "NtOpenFile",
        "Group not found. %n",
        "fr-029",
        "IsReadOnly",
        "tn-BW",
        "30B0Z0w0",
        "t0WWj",
        "WIMCommitImageHandle",
        "FileCount",
        "CreatePath: Unable to create parent directory for [%s]; GLE = 0x%x",
        "0!1@1^1k1",
        "D$8PW",
        ";,;3;R;y;",
        "7=7S7",
        ":#:|:",
        "es-CL",
        "file corrupted in block at offset %p",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FveDetect\\Cache",
        "Failed to get create a GUID.",
        "546>7",
        "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\LOWPART",
        "ResNodesSort",
        "8#9/9O9",
        "RestoreAllData",
        "=;>v>",
        "_purecall",
        "WimEnterCriticalSectionWithLazyInitialization",
        "9 9C9':=:\\:f:",
        ";4;<;T;",
        "=y>}>",
        "y VWh",
        "WIMCreateFile",
        "040904B0",
        "Microsoft Time-Stamp Service0",
        "t;j#j",
        "hi-IN",
        "yKVh_",
        "HeapFree",
        "GatherVolumeInfo did not succeed (hr = 0x%X); trying legacy path...",
        "0=0H0T0z0i1u1",
        ";/<@<Y<",
        "sw-KE",
        ".?AV?$CAutoCleanupBase@PAVWmiCollection@WMI@@@RAII@@",
        "swscanf_s",
        "Unknown marshall type %d, length %d",
        "SetSecurityDescriptorDacl",
        "WriteFileImage",
        ".data$r$brc",
        "TlsGetValue",
        "OpenEncryptedFileRawW",
        "VDiskOnlineSurfacedDiskUsingVds: Couldn't clear disk's read-only attribute; hr = 0x%X.",
        "GenerateMetadata: Opening virtual disk to surface it",
        "D$\\Ph",
        "es-MX",
        "\\Windows\\Syswow64\\",
        ";5;D;i;",
        "0x%08X",
        "kok-IN",
        "Redmond1",
        "DequeueWimData",
        "WdsImgOpenImageStore",
        "ReadWimHeader",
        "fr-CA",
        "D$ Pl",
        "ChunkWriterFlush",
        "DOCTYPE",
        "LockFileEx",
        "Local\\SetupVolumeAccessMutex",
        "ole32.dll",
        ";0;s;",
        "AddStreamsToImage",
        ";2;p;y;",
        "SSh @",
        "ENTITIES",
        "StringCchCopyN failed",
        "cy-GB",
        "wcstok_s",
        "t$X9u t",
        "j\\Yf;",
        "am-ET",
        "DWord",
        "FIOGetDriveType",
        "LSVW3",
        "7E7d7s7",
        "__RTDynamicCast",
        "Multithreaded decoding for chunked WIM is enabled!",
        "gn-PY",
        "StringFromCLSID",
        "SetFileStorageTierClass",
        "6 6(606<6\\6d6l6t6|6",
        "7A7x7",
        "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8",
        "D$4_^[",
        "7.7G7j7",
        "1E2^2n2",
        "9,9?9F9S9Z9c9j9",
        "yi-001",
        "<w=t?",
        "<>=V=w=",
        ".?AVCDepCopyManager@@",
        "4&4C4Z4a4",
        "y,Who",
        "8@9K9k9",
        "1 1Y1",
        "hy-AM",
        "\\Windows\\System32\\drivers\\wof.sys",
        "RtlDosPathNameToNtPathName_U",
        "384?4Q4X4t4~4",
        "8r SW",
        "5<LuP",
        "4%4F4Q4",
        "Failed to remove wimboot entry.",
        "2(2,2024282<2D2H2L2P2T2X2\\2p2t2",
        "Languages\\Language",
        "MapViewOfFile",
        "3,333q3",
        "FveDisableAuthenticationW",
        "UncompressFile failed",
        "T$@QQ",
        "7'7k7",
        "RtlSetCurrentTransaction",
        "VerSetConditionMask",
        "2;2z2",
        "8^8l8",
        "0?1u1",
        "j.[SV",
        "CreateSemaphoreExW",
        "CheckProcessFile",
        "DosDateTimeToFileTime",
        "FIOFileOpenById",
        " !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOP",
        "A<Au%",
        "62:9:J:Q:p:~:",
        "PartitionStyle",
        "<'<@<p<u<",
        "$SVWh",
        "pDeleteWimBackedFilesAndWimBootEntries",
        "2*212",
        "zu-ZA",
        "WIMCopyFileEx failed",
        "UnmarshallCallback",
        "ur-PK",
        "L$<_^[3",
        "WmiObject::BeginCall: Couldn't get method %s from type %s (0x%08x)",
        "ar-EG",
        "424<4T4q4",
        "|$4tG",
        "4$4(40484D4L4T4\\4d4l4t4|4",
        "1M1T1",
        ",SVW3",
        ".xdata$x",
        "=s=}=",
        "<VHD><IMAGE TYPE=\"VHD\"><CreationTime /><LastModificationTime /></IMAGE></VHD>",
        "RestoreHardlinks",
        "6>6X6k6y6",
        "D$,W3",
        "fr-SN",
        "en-ZW",
        "The mount entry %s is corrupt.",
        "1&1{1",
        "xM9sdtF",
        "_vscwprintf",
        "T$DQQ",
        "Incorrect filesize. Could be corrupted",
        "Microsoft Corporation1",
        "\\VarFileInfo\\Translation",
        "D$@j(P3",
        "0\"0D0",
        "=&><>a>",
        "en-AE",
        "9h:o:",
        "GetDisk: Finished querying VDS providers.",
        "1h2r2",
        "93:h:",
        "WQhtH",
        ">5>>>H>W>a>",
        ".?AVIDepWIMFile@@",
        "= =(=0=@=H=P=T=X=\\=p=",
        "959c9j9|9",
        "tR<'tN<",
        "ReorderContextInsert",
        "230865+4584940",
        ".?AV?$CAutoCleanupBase@PBG@RAII@@",
        "VERSION",
        "^<9^<v",
        "FveGetStatus",
        "D$ SPhH",
        "StringFileInfo",
        "Invalid",
        "xcShP",
        "NtQueryEaFile",
        "</<A<H<b<h<o<",
        "N0L0J",
        "Wmi::OpenNamespace: Failed to set proxy blanket (0x%08x)",
        "r~akow",
        "FIOEnumerateReparsePoints",
        "base\\eco\\wds\\wdsimage\\src\\enumimages.cpp",
        "VhdSafeWriteMetadata: Attempt %d of %d to open %s failed with ERROR_SHARING_VIOLATION.",
        "ja-JP",
        "::$DATA",
        "[%S:%u] Expression: %S, Win32 Error=0x%x",
        "WriteChunkedRegion",
        "rAh L",
        ":%:2:P:]:g:5;R;e;l;x;H<u<",
        "iswctype",
        "\\\\.\\PHYSICALDRIVE%d",
        "1$161X1e1}1",
        "3f4p4",
        ">A>R>e>",
        "616>6K6g6q6",
        "TotalBytes",
        ">@?r?",
        "EnumHashListCallback",
        "4\"4)4b4",
        "EtwEventWrite",
        "9w0uz",
        "9q\\t7",
        "8$9F9^9v9",
        "Xj\\Yf9",
        ".?AVIDepImageInfo@@",
        "4&4o4",
        ";(;0;7;R;Y;v;",
        "Failed to delete the applied path.",
        "8;8B8O8V8p8.9D9",
        "WdsImgOpenBootImageGroup",
        "L$4PV",
        "|%s|%d|%I64d",
        "t$(QRP",
        "ControlSet???",
        "tOf97tJh",
        ":$WIMMOUNTDATA",
        "t)j\\V",
        "D$8!t$ !t$$",
        ">:>H>",
        "iu-Latn",
        "tzm-Tfng-MA",
        "t9f91t4",
        ";3rU;",
        ".?AVIDepImageSetContainerSplittable@@",
        "WaitForSingleObjectEx",
        "3K3^3",
        "Windows",
        "EnumeratePathEx: Failed search path is >= MAX_PATH!",
        "Version\\Minor",
        "Unable to apply image for WIM boot; could not find recovery folder [%s]",
        ">.>7>@>J>N>_>e>u>",
        "IDREF",
        "8_8s8",
        "ka-GE",
        "3.4K4",
        "WIM\\IMAGE[*]\\TOTALBYTES",
        "AllocateReadChunk",
        ":L:Y:",
        "3O3Y3x3",
        "9)9g9",
        "LastModificationTime\\HighPart",
        "6=6b6t6",
        "Cleanup failed [0x%08x]; some data may not be cleaned up.",
        "RpcCommRemoveImage",
        ">6>i>p>",
        "Failed to build path to ci.dll inside GUID folder.",
        "L$t_^[3",
        "SetSysVolInfoPath",
        "jZhP2",
        ".vhdx",
        "~(9~0t",
        "7/7Q7",
        "~09~$t",
        "=.=Y=",
        "Failed to set SD",
        "424;4m4",
        "WPVhPO",
        "VDiskLoadVirtDiskAPI: Unable to dynamically bind to VirtDisk.dll APIs; hr = 0x%X.",
        "t'j\\W",
        "CDepWIMImage::ResolveDependencies found invalid WIM info: PartNumber = %u, PartCount = %u",
        "=V>t>",
        " Extracting %s...",
        "1H2Z2t2",
        ".?AVCDepXMLData@@",
        "cs-CZ",
        ".text$x",
        "7C7P7",
        "ff-Latn-SN",
        "Unable to find DOS path for volume; found volume GUID instead: [%s]",
        "9%:<:",
        "5!5d5v5",
        ";C<U<c<m<}<",
        "t:9L$",
        "GatherVolumeInfo: Unable to canonicalize path [%s]; hr = 0x%X",
        "L$L_^[3",
        "tk-TM",
        "f;F$u",
        "Failed to set file extended attribute",
        ";A u3",
        "=*=1=L=S=t={=",
        "DeletePath: [%s] doesn't exist as a directory; nothing to delete.",
        "Cleaned up copied piece: %s",
        "fi-FI",
        "ImageUnmarshallHandle",
        "VDiskWaitForSurfacedDiskDiscovery: Timed out waiting to find surfaced disk number; hr = 0x%X.",
        "QQPhP",
        "<2=W=~=",
        "xWj(j",
        "tzm-Tfng",
        "WimAtExitInitialize",
        "0N1U1i1p1",
        "021>1D1K1R1^1o1{1",
        "VDiskSurface: SurfaceVirtualDisk failed; hr = 0x%X.",
        "\\$<hl^",
        "nn-NO",
        "ImageCreate",
        "9F sN",
        "%hs: %s returned an error ( %u )",
        "RestoreStreams",
        "2@3q3x3",
        "es-HN",
        "9t$ u39t$",
        "666S6e6l6}6",
        "7)828`8",
        "failed to extract file from reference extension",
        "BUILD",
        "8-8s8",
        "Wait for work queue failed!",
        "fmalloc failed",
        "InitVDSService: Failed to load VDS service; hr = 0x%x.",
        "ar-DZ",
        "VarFileInfo",
        "Res.RWM",
        "WWh,0",
        "4\"4P4W4",
        "L$,!t$0!t$4",
        "bg-BG",
        "pProcessResFileBackedByWim",
        "ibb-NG",
        "0)1f1",
        "DeleteCriticalSection",
        "L$l_^[3",
        ".?AV?$CAutoRelease@PAUIWbemClassObject@@@RAII@@",
        "<SVW3",
        ":;;Q;",
        "<4=o=",
        "ca-ES-valencia",
        "memmove",
        "122M2Z2r2",
        "7'8i8",
        "D$tRRRRRh",
        "AdjustTokenPrivileges",
        "<WIM><TOTALBYTES>0</TOTALBYTES></WIM>",
        "FIOIsDirectoryEmpty",
        "WimGetPathFromHandle",
        "WimAtExitReserve",
        "encoding",
        "pa-Arab",
        "Failed to get img event",
        "080c0",
        "Unable to apply image; could not find temp folder [%s]",
        ";);>;T;h;s;y;",
        "_WSWf",
        "#wXsA",
        "D$0PQ",
        "0T1[1",
        "SVWj@3",
        "InitVDSServiceNoStatic: Failed to load VDS service; hr = 0x%x.",
        "quz-PE",
        ":9:@:[:b:",
        "t$<P3",
        "WdsImgGroupSetSecurity",
        "3\"3)3M3W3l3s3{3",
        "CI EA is not supported because the host OS and applied image have a signature type mismatch.",
        "UNKNOWN",
        "IsCaptureWIMBootCompliant",
        "Mount path high",
        "ig-NG",
        "FveCheckSuspendBitLockerOnUpgrade",
        "EnumHashTable",
        "HeapReAlloc",
        "919h9~9",
        "UnlockFileEx",
        "QQPQQQQW",
        "VDiskGetSurfacedDiskNumber: Disk number = [%u]",
        "4\"4)4",
        "j Yf;",
        "j:Xf;G",
        "2W3p3",
        "System\\CurrentControlSet\\Services\\Wof",
        "2>2E2X2",
        "l.sys",
        "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5",
        "ProductSuite",
        "EnumeratePathEx: Unable to get reparse tag for persistent reparse point; GLE = 0x%x",
        "es-SV",
        "9':2:F:Q:y:",
        "fr-CD",
        "IdnToAscii",
        "5H6O6p6",
        "5(5F5L5n5",
        "<X=]=o=",
        "3!383>3H3O3e3y3",
        "Fail to read WIM header",
        "WIMMountExtractFileToHandle",
        "t$(VW",
        "?+?9?",
        "Journaling is disabled on the applied volume.",
        "9!9+9",
        "(SVW3",
        "DeleteFileEx: Unable to remove [%s]; GLE = 0x%x",
        "WofMob",
        "PWj@Z",
        "BCryptCloseAlgorithmProvider",
        "StateStoreSetMountedImageWimbootEntries",
        ">%>5>b>",
        "232:2P2W2m2t2",
        ":B;m;",
        "%wLtC",
        "^h9^lt",
        "Failed to remove wim entry when image apply failed.",
        "%s: VHD for metadata ('parent' of metadata) must be given.",
        "msvcrt.dll",
        "7'8:8)909J9r9y9",
        "^[w!QRW",
        "SVh8c",
        "GetCurrentThreadId",
        "^\\9^`t",
        "BBBBPj(",
        "This system's wimmount.sys does not support spare mounting.",
        "gsw-FR",
        "6;6Z6z6",
        "=>=U=i=p=",
        "WdsImgGetProductName",
        "sma-NO",
        "Wait for work queue abandoned!",
        "iswspace",
        "5>5H5c5{5",
        "quc-Latn",
        "Failed to build path to GUID folder.",
        "memmove_s",
        "FreeLibrary",
        "=!>,>Z>",
        ">#?-?8?e?",
        "`.data",
        "VhdPopulateOSMetadata: Calling OsInformationLoadEx...",
        "WofAdk",
        "InitVDSService:Successfully launched service.",
        "en-HK",
        "ELEMENT",
        "Unable to mount image; could not find temp folder [%s]",
        "@\\;B\\t",
        "WVhXo",
        "\\Registry\\Machine",
        "I_RpcMapWin32Status",
        "Failed to query SD",
        "GatherDiskInfo_ThreadFunc:Unable to determine if the Host OS is Server 2003 WinPE.",
        "T$DW3",
        "ReadChunk",
        "%s%u.swm",
        "ChunkWriterEnqueue",
        "WIM_Skip_WIMBoot_Check",
        "sd-Arab",
        "WdsImgAssignPredefinedImageIdentifier",
        "!E\\H4",
        "7$767=7E7N7t7",
        ".?AVIDepObject@@",
        "<F<^<",
        "nOa-Q",
        ".?AV?$CAutoHeapFree@PBG@RAII@@",
        "\\WINDOWS",
        "2-242;2I2T2]2h2",
        "RestoreMountDirectory",
        "bcrypt.dll",
        "= =@?X?",
        "FltCommStubCreateChild",
        "L$(@;E",
        "DuplicateTokenEx",
        "6\\7f7~7",
        "jWX_^[",
        "uw!\\$",
        "5:5g5}5",
        "L$4GR",
        "4W4{4",
        ">G>l>z>",
        ":9:?:",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z",
        "FX;GXu",
        ":3:f:",
        "UuidFromStringW",
        "Parallel chunk decode queue empty; switching to synchronous decode",
        "t=jPj",
        ".?AV?$CAutoCleanupBase@PAUIWbemClassObject@@@RAII@@",
        "km-KH",
        "9/:P:",
        ".CRT$XCA",
        "BCryptOpenAlgorithmProvider",
        "5>5O5",
        "=G>l>",
        "5%606S6",
        "233F3U3",
        "FLTLIB.DLL",
        "FveGetAuthMethodInformation",
        "73888=8B8G8L8Q8W8",
        "9 989>9_9",
        "GetFileSizeEx",
        "CreateVolumeAccessPath: No free drive letters to use!",
        ">&>C>l>x>",
        "WIMGetMountedImageHandle",
        "SetFilePointer",
        "=G>s>",
        "0=1D1j1q1",
        "fr-MA",
        "WdsImgGetHalName",
        ".?AVCDepImageOSXMLInfo@@",
        "or-IN",
        "= =+===J=Q=",
        "SVWjP",
        ".?AVCDepImageSet@@",
        ":&:R:",
        "ExportChunkedRegionWrite",
        "ha-Latn-NG",
        "_91$[bS",
        ",*~_i",
        "SYSTEM\\CurrentControlSet\\Control\\MiniNT",
        "8$898@8",
        ">O?{?",
        "5)5?5",
        "GetSystemDiskNumber: Couldn't query NT dir [%s]; status = 0x%x",
        "ReadDirEntry",
        ".?AVIDepImageResolved@@",
        "9\\$Lt",
        "WdsImgGetSecurity",
        "RegQueryInfoKeyW",
        "XkZu=",
        ";k<}<f=}=",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "3 4;4M4]4m4",
        "j:Xf;F",
        "IsApplyWIMBootCompliant",
        "%s: The metadata file was incorrectly named: %s, should have been %s.",
        "Global\\WIMGAPI-LOGFILE-%c%08x'%08x",
        "Fail to flush file buffers",
        "6!6^6",
        "y0Vh/",
        "0C0]0t0",
        ":$:0:<:H:T:`:l:x:",
        "7\"7Z7",
        "0,0I0e0M1T1`1x1X2a2",
        "200304182929Z",
        "D$<Pj",
        "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\utility.c",
        "9HXu:9H\\u5",
        "9%8YWDQ",
        "{00000000-0000-0000-0000-000000000000}",
        "D$8PS",
        "Cache",
        "sr-Cyrl-BA",
        "u7WVhXb",
        "4&4-4@4G4Z4a4t4{4",
        "CoUninitialize",
        "sT9sXt",
        "RtlCompareMemory",
        "9!9(9",
        "UtilReportProgressTick",
        "PRODUCTSUITE",
        "tt-RU",
        "WdsImgFindFirstImage",
        ".?AVIDepImageResolvedFileBased@@",
        "NtPathToArcPath:Could not canonicalize input NT path: %s",
        "ImageExtractToHandle",
        "SetImpersonationCount",
        "InternalName",
        "tAQh\\i",
        "= =1=G=i=",
        "929R9Y9d9",
        "PWPPP",
        "5&5B5I5",
        "CheckCIEASupport",
        "ExportForCrossFileTarget",
        "5#6*676>6",
        "StateStoreLoadMountEntryFromKey",
        "250701214655Z0|1",
        "6D7}7",
        "WdsImgIsBootImage",
        "GetVolumePathNameW",
        ";3;D;g;",
        "VerifyIntegrityChunk",
        ">?>F>D?_?",
        ":0;X;s;",
        "Failed to convert GUID to string.",
        "PSWVVh",
        "PSSSSSS",
        "2f;0u",
        "bs-Latn",
        "3H3k3q3",
        "0[1q1",
        "\\\\?\\PhysicalDrive%u",
        "4T5^5v5",
        "VhdSafeWriteMetadata: Failed to unlock %s [0x%08x]",
        "7%7,7>7I7~7",
        "FveGetSecureBootBindingState",
        "<)=/=u=",
        "<D<o<",
        "92:9:",
        "3$4+494",
        ":!:::A:`:f:q:x:",
        "NdrClientCall2",
        "1D1P1o1x1",
        ".?AVCDepWIMInfoFormat@@",
        "QueryDosDeviceW",
        "fr-FR",
        "Translation",
        "ImageGetLastModificationTime",
        "DecompressChunkedFile",
        "ve-ZA",
        "nl-BE",
        ".tls$",
        "Failed to query metadata",
        "tzm-Latn",
        "ioctl() failed or returned no data",
        "4/4\\4i4p4",
        "Removed partially copied piece: %s",
        "tr-TR",
        "fr-HT",
        "WQhDH",
        "WimBufferToHexString",
        "9d:r:",
        "mr-IN",
        "FormatMessageW",
        "L$$SP",
        ";,;7;Q;\\;|;",
        "EXFAT   ",
        "memcpy",
        ".?AV?$CAutoCleanupBase@PAUIWbemLocator@@@RAII@@",
        "kernel32.dll",
        "GetModuleHandleW",
        "CI EA is only supported on when image contains OS version info.",
        "y#VSh",
        "L$djo_",
        ".CRT$XLZ",
        "CreateWimQueue",
        "t$$RP",
        "GetSystemInfo",
        "<$<L<",
        "cannot read WIM header",
        "FveDeleteAuthMethod",
        ";C;\\;i;u;",
        "gl-ES",
        "aYd(z_C",
        "?/?=?D?X?_?g?p?x?",
        "#comment",
        "VDiskWaitForSurfacedDiskDiscovery: Timed out waiting to find [%s]; hr = 0x%X.",
        ";U;\\;h;~;",
        "AllocNode",
        "VhdPopulateOSMetadata: Gathering disk info...",
        "Failed to delete external file.",
        "WdsImgGetIndex",
        "6D7^7",
        " http://www.microsoft.com/windows0",
        "WdsImgGetFlags",
        "CreateCaptureInfo",
        "=2=K=e=o=",
        "FveRemoveTrustedWimData",
        "ReadData failed",
        "jWX_^]",
        "GenerateMetadata: Surfacing disk...",
        "%s-%u",
        "2/2`2",
        "RestoreFileDataCallback",
        "HQC!!",
        "5 6&6[6b6x6",
        "version",
        "8)8;8f8",
        "EnumRefExtEntries",
        "GatherDiskInfo_ThreadFunc:Finished gathering disk information.",
        "SetupLog",
        "exFAT",
        "5$54585<5T5X5\\5`5d5h5l5p5t5x5|5",
        " SVW3",
        "#+puW",
        "WIMUnmountImageHandle",
        ">&>?>I>Z>.?",
        "9 919;9J9Q9\\9",
        "WIM\\IMAGE",
        "111E1a1h1o1}1",
        "CompressCaptureNode",
        "Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}",
        "tzm-Arab-MA",
        "bs-Cyrl",
        ".?AVCDepVHDInfoFormat@@",
        "NtOpenDirectoryObject",
        "7%8E8",
        "819u9",
        "T$@Ph@",
        "WdsImgApplyImage",
        "30B0I0[0b0t0{0",
        "Washington1",
        "QPQQQQh$",
        "%hs: Can't set IsReadOnly param ( 0x%08x )",
        "2/292I2S2",
        "=)>?>",
        "WdsImgExtractFiles",
        "T$TSSSSSh",
        "FormArcPathName:Couldn't form NT path for disk %d (part %d)",
        "2/262K2r2",
        "CompressChunk",
        "ci.dll",
        "There are no more images. %n",
        "T$$RPQQ",
        "|$L9M",
        "GatherVolumeInfo: Unable to determine if volume is dynamic; hr = 0x%X.",
        ">C?s?",
        "RegLoadKeyW",
        "ReleaseMutex",
        ";,<Q<[<",
        "CurrentBuildNumber",
        "%ws\\%ws",
        "sX9s\\t",
        "wcstoul",
        "8D9d9",
        "fr-MC",
        "The existing WIM file became corrupted",
        "SOFTWARE\\Microsoft\\WIMMount",
        "8+8A8{8",
        "GetHandleInformation",
        "ReturnValue",
        "jJhP2",
        "y+VhQ",
        "t><+t=<,t9:",
        "_wcsrev",
        "GetModuleHandleExW",
        ">!>c>",
        ".tls$ZZZ",
        "FilterConnectCommunicationPort",
        "F_[Qj",
        "WIM\\IMAGE[*]\\HARDLINKBYTES",
        "pUnattend",
        "wimmount",
        "VDiskUnsurface: Successfully unsurfaced virtual disk",
        "t}j\\V",
        "D$LSP",
        "ScanDirNodeTree",
        "9\\$,t",
        "Pj8QS",
        "WWWVt",
        "Converting to NT filename failed",
        "te-IN",
        "FormArcPathName:Could not find ARC path for disk; NtPath = [%s], GLE = [%d]",
        "header version mismatch",
        "pEnumAndDeleteWimExternalFilesProc",
        "FileDescription",
        "262Z2w2",
        "; hash = ",
        "GetSysDir",
        "9^Xv,",
        "yVWhI",
        "GatherVolumeInfo: Unable to retrieve FS properties; hr = 0x%X",
        "f9XBt",
        "SWj43",
        "_XcptFilter",
        "1+1X1b1x1",
        "zupkfb^ZVSOLIEB@=:7520-+)&$\" ",
        "7,767N7m7}7",
        "yo-NG",
        "1.2D2",
        "<$<d<z<",
        "res.rwm",
        "ar-KW",
        "AllocateAndResize",
        "QPWSQQhP",
        "t3j\\P",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "8.8r8",
        "F8PSj",
        "6!797@7Q7b7",
        "Failed to create GUID folder.",
        "GetFileInformationByHandle",
        "The requested attribute was not found. %n",
        "VDiskGetSurfacedDiskNumber: vdisk's device path = [%s]",
        "SVWjz",
        "9M,tN",
        "r%*U$",
        "restoring folder failed",
        ".idata$6",
        "</%s>",
        "@&0_DM",
        "MSFT_Disk.Online()",
        "WIMMountExtractDirToHandle",
        "PrepopulateList",
        "WDSParseImageInformation",
        "7>8E8m8t8",
        "8F9|9",
        "StateStoreSetMountedImageTime",
        "IMAGE\\LASTMODIFICATIONTIME\\HIGHPART",
        "pWindows Foundation",
        "wcschr",
        "WIM_MetaData_Queue_Length",
        "7?7T7^7g7m7y7",
        "VhdSafeWriteMetadata: Failed to write file %s [0x%08x]",
        "Fd;Ad",
        "D$0PS",
        "8#8>8L8h8",
        ">\">K>R>",
        "PVVh\\@",
        "; ;,;8;D;P;\\;h;t;",
        ">3>a>",
        "9s v5",
        ".?AVIDepImageSetContainerBootable@@",
        "CI EA is only supported on hosts Windows 8 and higher.",
        "Same-volume move failed for source %s dest %s [0x%08x]",
        "3#4k4",
        "6 7*7B7",
        "QjhQQj",
        "FreeSid",
        "9?:X:i:",
        "Local\\wimmount_ready_event_%s",
        "The specified compression type is invalid. %n",
        "SaveOffset failed",
        "545O5",
        "ms-MY",
        "Getting WMI Bool property %s: unexpected VARIANT type %d",
        "%s: Failed to generate new metadata for %s: 0x%08x",
        "9/9Z9",
        "AllocChunkInfo",
        "3)364Z4y4",
        "WdsImgGetCompressionType",
        "RtlRaiseStatus",
        "=\\=c=",
        "4%4B4_4|4",
        "UuidCreate",
        "WimInitXmlInfo",
        "?,?3?Y?",
        "WIMSetBootImage failed; hr = 0x%X.",
        "Control\\ProductOptions",
        "http://www.w3.org/2000/09/xmldsig#",
        "9Z9l9",
        "DuplicateFileNode",
        "\\System Volume Information\\FVE.{e40ad34d-dae9-4bc7-95bd-b16218c10f72}.X",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\strutil.cpp",
        "CreationTime\\LowPart",
        "is-IS",
        "788x8",
        "RpcBindingFree",
        "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;",
        "444Q4",
        "UCS-2",
        "jBh`]",
        "Microsoft Corporation",
        "RollbackTransaction",
        "9&:Q:X:b:i:",
        "4!4C4N4_4",
        ":,:3:T:t:",
        "<&<;<",
        "K{m<KI",
        "6&6F6",
        "0'010",
        "HARDLINKBYTES",
        "EA^Wp",
        "F\\;G\\u",
        "AddResourceToHashTableCallback",
        "dz-BT",
        "595_5",
        ":$WIMMOUNTDATA:$DATA",
        "GlobalMemoryStatusEx",
        "%hs: %s didn't produce a ReturnValue ( 0x%08x )",
        "RegQueryValueExW",
        "?w$tQ",
        "FilterSendMessage",
        "ky-KG",
        "dsb-DE",
        "Failed to clean up copied piece: %s [0x%08x]",
        ":C;a;",
        "RestoreFileMetadata: RecordFileDataLocation failed",
        "9p\\t:",
        "=#>L>q>x>",
        "%s_%s",
        "GWVVP",
        "D$HPj",
        "3$5?5p5z5",
        "RpcCommAddImage",
        ">)>`>",
        "\\Windows\\Microsoft.NET\\",
        "6#7x7",
        "reparse point tag too short in filestream",
        "uS!D$",
        "8,8>8W8l8",
        "ARM64",
        "GetProcessHeap",
        "WofCompressFileWithHandle",
        "=X>n>",
        "FIOGetVolumeFlags",
        "WdsImgGetPath",
        "Unable to open resolved image handle; hr = 0x%X",
        "_ftol2",
        "LoadLibraryExW",
        "848D8K8\\8c8",
        "FIOOpenStreamById",
        "*Q`L]",
        "=4=W=^=",
        "1)101",
        ":/:R:g:}:",
        "StateStoreGetMountedImagePath",
        "3(3=3D3r3",
        "WdsImgGroupCanImportImage",
        ">&?S?",
        "GatherDiskInfo_ThreadFunc:Host OS is Server 2003 WinPE. Not waiting for pending device installs.",
        "Failed to mark image for compact state.",
        "WIM_Chunk_Size",
        "SetEndOfFile",
        "xh-ZA",
        "GetSecurityDescriptorControl",
        "WimCopyStream failed",
        "EtwEventRegister",
        "0Q0[0q0w0",
        "UtilGetMountingEvent",
        "pt-PT",
        ";e;p;|;",
        "ExportChunkedPortion",
        "WIMCommitImageChanges",
        "Failed to enumerate and delete wimboot entries.",
        "Failed to close image handle; GLE = 0x%X",
        "Version\\SPBuild",
        ">;>O>T>^>x>",
        "< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\\<`<d<l<",
        "StateStoreSetMountedImageStatus",
        "8A8P8\\8l8s8",
        "jaYjz^j:Z",
        "2B3T3n3",
        "WriteEncryptedFileRaw",
        "RegSetValueExW",
        "<b<d= >I>",
        "<4<><",
        "SVWj43",
        "=2=u=",
        "MINOR",
        "EtwEventEnabled",
        ":O;^;n;u;",
        "6%6+6E6O6h6p6v6",
        "sL9sPt",
        "=C=J=c=",
        "L$,QP",
        "hSVW3",
        "\\lL\\q",
        "CreateVirtualDisk",
        "yJVhe",
        "GetSecurityDescriptorSacl",
        "4t4}4",
        "6B6I6",
        ">'>0>E>p>",
        "The specified image does not support apply operation. %n",
        "mt-MT",
        "GetMountedPath: Unable to prepare access path for disk [%u] offset [0x%I64x]",
        "UD;UD",
        "??1exception@@UAE@XZ",
        "9\":8:U:`:",
        "2I2w2",
        "<;<F<",
        "ExclusionList",
        "9B\\t\"9C8t",
        "FilterReplyMessage",
        "9X`v^j",
        "<:=A={=",
        "9WHvQ",
        "1)252C2",
        "ProductType",
        "7>7`7F;",
        "GetDisk: Querying unallocated disks...",
        "0!040=0H0o0y0",
        "DeletePath: Failed to obliterate [%s] (GLE = 0x%x); retrying...",
        "bitlocker                       ",
        "WdsLibEnumCallback",
        "+0:0K0R0c0j0",
        "VWj j",
        "^l9^pt",
        "`V@Pj",
        "1,161",
        "7#737P7Y7h7",
        "G;|$(r",
        "1,101H1X1\\1l1p1t1x1|1",
        "Successfully surfaced virtual disk (virtdisk flags = 0x%X)",
        "2I2Y2",
        "ar-SA",
        "GetTempPathW",
        "VWShP",
        "et-EE",
        "my-MM",
        "IMAGE\\LASTMODIFICATIONTIME\\LOWPART",
        "8A9W9^9",
        "ReleaseDataRange",
        "WideCharToMultiByte",
        "C;X`s",
        ":K:[:e:",
        "Thales TSS ESN:0A56-E329-4D4D1%0#",
        "\"Microsoft Window",
        "bo-CN",
        "The image file specified contains invalid data. %n",
        "9_Xtp",
        "021d1k1",
        "RestoreSecurityDescriptor",
        "RegEnumKeyExW",
        "IsSecureBootBound",
        "4\\6t6",
        "1+1[1",
        "<S=l=",
        "?+?2?d?",
        "9r4uC",
        "GetSecurityDescriptorLength",
        "\\system32\\config\\",
        "RpcBindingFromStringBindingW",
        "RestoreFileData",
        "WaitForMultipleObjectsEx",
        "617Q7%808W8b8v8}8",
        "es-ES_tradnl",
        "ValidateBinaryFileAndSetEA failed",
        "4.4B4g4~4",
        "DeleteFileEx: Unable to restore attributes on [%s]; GLE = 0x%x",
        "2,222",
        "%s: Used existing metadata for %s.",
        "=,=8=O=",
        ":':H:i:",
        "Sj RP",
        "y.VjJ",
        "bsearch",
        "Failed to restore wimboot entries",
        "VWQhl",
        "PSh`,",
        "9\\$$v",
        "<Y<v<",
        "5K6R6",
        "GetDisk: Querying VDS providers...",
        "D$$PR",
        "535e5}5",
        "RtlDeleteResource",
        "INSTALLATIONTYPE",
        "0QhDH",
        "5%5J5^5e5",
        "=1===I=l=",
        "%s:(%d)",
        ":k:A;W;",
        "PWhXd",
        "ADVAPI32.dll",
        "tg-Cyrl",
        "SjdPj2j",
        "MergeVirtualDisk",
        "2h3o3",
        "EnterCriticalSection",
        "PathIsUNCW",
        ">@>J>",
        "ExportResourceCallback",
        "CLSIDFromString",
        "9%9,979M9",
        "ImageStubMountDirectory",
        "EventUnregister",
        "3/363B3{3",
        "1$181x1",
        "?\"?D?u?|?",
        "t$ RP",
        "FBf;E",
        "7Y8`8",
        "ExportContextCopy",
        ">;>l>",
        ">'>1>Q>i>",
        "= >_>f>q>",
        ".?AVCDepVHDFile@@",
        "pa-Arab-PK",
        ":::F:",
        "RtlReleaseResource",
        "=0=C=P=c=",
        "CreationTime",
        "\\$4YY",
        "D$@QQPQQQQ",
        "MSFT_Disk.SetAttributes()",
        "sr-Latn-CS",
        "Volume",
        "3,fTidTq ,>gEB;",
        "CDepVHDInfoFormat: image is not unsurfaced: 0x%08x",
        "SYSTEMROOT",
        "fr-RE",
        "Base.VHD",
        "@*93u",
        "D$TVP",
        "9S0vmR",
        ">*?R?Y?l?",
        "Mount Path:  [%s]",
        ".text$mn$01",
        "GetOverlappedResult",
        "An invalid handle type was specified. %n",
        "t4Shh",
        "ControlSet%03u",
        "999Q9r9",
        "9\"9E9V9i9",
        "20272A2T2",
        "RtlAllocateHeap",
        ":#;6;L;h;n;",
        "='=,=3=E=",
        "|d-Vk",
        "QQSVW3",
        "Integer overflow after WriteData",
        "040[0b0u0|0",
        "GetStorageDependencyInformation",
        "20201008050501Z",
        ";6;[;,<",
        "1/0-0",
        "9r t1",
        ")sJUK",
        "t&f;E",
        "WimBoot capture failed because wimbootcompress.ini is not available!",
        "4,4d4|4",
        "System\\CurrentControlSet\\Services\\WofMob",
        "F0C;X",
        "1>2I2q2",
        "8X9y9",
        "NtClose",
        "0\"0)0?0F0Z0a0",
        "9\"9)999@9",
        "ta-LK",
        "Volume{",
        "t$ WV",
        "D$TPRRh",
        "20201008071949.058Z0",
        "879<9A9K9P9U9_9d9i9p9u9z9",
        "TlsSetValue",
        "%wOtF",
        "464B4c4",
        "PPPVh",
        "tb9t$",
        "8$8H8e8o8",
        "InstallLanguage",
        ".?AVbad_alloc@std@@",
        "UuidToStringW",
        ":3:::D:[:b:",
        "<+=8=?=E=L=S=Y=`=g=n=z=",
        "NMTOKENS",
        "RestoreMountStub: error creating destination file",
        "t&jPj",
        "Continue to apply the image without setting CI EA.",
        "GetVolumeRootFromPath",
        "Microsoft\\Windows NT\\CurrentVersion",
        "f9:tD",
        "VDiskOnlineSurfacedDiskUsingVds: Surfaced disk [%u] is marked read-only; changing attributes...",
        "Wmi::OpenNamespace: Too late to initialize COM security (0x%08x)",
        "SVWj2",
        "_onexit",
        "G^{P&a",
        "\\\\?\\GlobalRoot",
        "6(7>7v7",
        ":QVEE",
        "%s: Could not generate metadata file name: 0x%08x",
        "<FALLBACK LANGUAGE=\"%s\">%s</FALLBACK>",
        "L$|_^[3",
        "0.1\\1",
        "RtlGetVersion",
        "WdsImgGroupSetName",
        "7 7A7I7P7V7\\7",
        "<X=n=",
        "GatherVolumeInfo: Found volume with NULL GUID; must use alternate path...",
        "RtlInitUnicodeString",
        "5$6(9_9",
        "@kon|",
        "7 7e7",
        "q@boA",
        "WdsImgSetEnabled",
        "<9<e<",
        "WWWWV",
        "!|$<9}",
        "t;f97t6",
        "0O0Y0",
        "DecompressChunkedFile failed",
        "REQUIRED",
        "L$(Qh$H",
        "9<:M:c:",
        "7$707<7H7T7`7l7x7",
        "SeSecurityPrivilege",
        "=Y>n>",
        "$filehashes$.dat",
        "InitializeCriticalSectionAndSpinCount",
        "2'3.3v3",
        "t$ Sj",
        "vswprintf_s",
        "v PWh",
        "eu-ES",
        "quz-BO",
        "<S=m=",
        "AX;BXu",
        "050Y0~0",
        "FltCommExchangeDirs",
        "bs-Cyrl-BA",
        "WdsImgOpenImage",
        "WinNT",
        "Microsoft Corporation1(0&",
        "2/3C3Q3",
        ">$>@>Z>",
        "LegalCopyright",
        "WdsImgGetDependantFiles",
        "<D<M<Z<o<",
        "ExtractRemainingCallback",
        "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "%hs: Can't find disk %u ( 0x%08x )",
        "jWh4]",
        "FilterLoad",
        "Y__^[",
        ".idata$3",
        "9]:u:",
        "tzm-Latn-DZ",
        "\\Windows\\System32\\config\\SYSTEM",
        "WdsImgGetImageIdentifier",
        "Couldn't get array element 0 (0x%08x)",
        "223<3N3k3r3",
        ";?;F;T;j;",
        "Setting WMI Bool property %s: can't convert to VARIANT type %d",
        "$`2X`F",
        "7K859J9",
        "6b6{6",
        "\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}",
        "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\HIGHPART",
        "%hs: Can't call %s ( 0x%08x )",
        "SetFileInformationByHandle",
        "ReadWriteDataInternal",
        "Failed to get volume root!",
        "4)565",
        "GetFileVersionInfoSizeExW",
        "1.1Q1",
        "ImageWorkerThread",
        "FindFirstChunk",
        ">b>i>",
        "??1type_info@@UAE@XZ",
        "0<0G0",
        "qps-plocm",
        "<8=b=m=",
        "6;7W7e7l7Z8a8",
        "|hK,_",
        ";B;I;",
        "$rGSV",
        "GetMountedPath: Unable to find volume for disk [%u] offset [0x%I64x]",
        "wimserv.exe",
        "IMAGEREFERENCE\\ContainerReference",
        "PVVj@Wh",
        "uz-Latn",
        "\\Device\\HardDisk%d\\Partition%d",
        "EventRegister",
        "RegGetValueW",
        "LookupPrivilegeValueW",
        "wcsncat_s",
        "FIOVolumeOpen",
        "1%252K2p2",
        "G;~Xr",
        "415q5",
        ".rdata$zETW1",
        ".edata",
        "Wow64RevertWow64FsRedirection",
        "8^9c9y9",
        "1:2B2/3C3I3\\3j3",
        "7$7+797@7\\7",
        "7!7E7L7",
        "Wim:         [%s]",
        "PVVhd",
        "=3=:=",
        "PWh g",
        "?2?P?",
        "9*:>:I:",
        "GetFileInformationByHandleEx",
        "7.858;8C8M8V8\\8",
        "5b5n5",
        "7-747<7T7k7",
        "OpenVirtualDisk",
        "-040Y0q0",
        "sd-Arab-PK",
        "FveGetStatusBasicW",
        "es-EC",
        "nso-ZA",
        "Failed to clean up partially copied piece: %s [0x%08x]",
        "394q4",
        "L0S0b0x0",
        "= =K>",
        "RegOpenKeyExW",
        "Microsoft Corporation1)0'",
        "8Q8[8i8x8",
        "3$3<3a3{3",
        "2!21272?2F2K2",
        "setting hardlink failed",
        "j.Xj:f",
        "CDepWIMFile found 0 images in WIM",
        "RestoreMountStub: Could not move hardlink stub to prepopulate location",
        "ResExtractToFile failed",
        "IMAGEREFERENCE\\OriginalContainerPath",
        "6&;.;8;>;I;P;U;[;a;f;m;t;",
        "F4QQS",
        "=\"=G=",
        ".00cfg",
        "9N9f9|9",
        "Current",
        "RegDeleteKeyExW",
        "PPPPW",
        "WIM_FileData_Number_Workers",
        "7&717c7n7",
        "D$L9A",
        "39HPt",
        "0E0d0j0z0",
        "VhdPopulateOSMetadata: Sleeping for 30 sec to let volumes arrive/mount...",
        "he-IL",
        "ar-LY",
        "7<7b8r8",
        "Failed to set CI EA on temporarily extracted ci.dll.",
        "\\system32\\kernel32.dll",
        "PSSSSSSh ",
        "F;w$r",
        "WimStrDupe",
        "1%1,1",
        "QPQPj",
        "yNVjE",
        "GetCurrentThread",
        "WIMCreateFile failed to open [%s]; hr = 0x%X",
        "#Vx\"&6",
        "ar-QA",
        "AddCaptureNodeToImage",
        "WIM\\IMAGE[*]\\CREATIONTIME\\LOWPART",
        ".data$brc",
        "?4?A?}?",
        "CoCreateInstance",
        "RestoreAllFiles",
        "EventWriteTransfer",
        "1 1/1<1C1",
        "PreparePack:Found offline foreign dynamic disk pack [%s].",
        "Microsoft Time-Stamp PCA 2010",
        "j\\Zj:",
        "Fail to update WIM header",
        "VhdSafeWriteMetadata: Failed to write entire buffer. Read %u of %I64u bytes.",
        "D$<PR",
        "tSVW3",
        "WdsImgExportImage",
        "VDiskOnlineSurfacedDiskUsingVds: Surfaced disk [%u] is offline",
        "FindNextImage",
        "2$303>3]3",
        "<9<E<",
        "WmiObject::BeginCall: Couldn't spawn instance of method parameter type for %s.%s (0x%08x)",
        "D$(PQ",
        "8S8s8Q9",
        "Fail to update the WIM header",
        "9t$(tS",
        "WdsImage.pdb",
        "sr-Cyrl",
        "?2?@?O?Z?",
        ":.:B:N:d:",
        "Wmi::OpenNamespace: Failed to create locator instance (0x%08x)",
        "Legal_Policy_Statement",
        "Deleted copied piece: %s",
        "Wimserv process started for guid %s.  Id is %d",
        "FindChunkForOffset",
        "YY_f;",
        "ar-TN",
        "UpdateHardlinkFile",
        ":5;>;E;T;",
        "__CxxFrameHandler3",
        "_wcsnicmp",
        "nl-NL",
        "pa-IN",
        "EnumeratePathEx: Unable to enumerate [%s]; GLE = 0x%x",
        "8O8T8z8",
        "WdsImgGroupGetName",
        "jfh0j",
        "FindVolumeClose",
        "uz-Latn-UZ",
        "dv-MV",
        "6+6@6S6Z6m6{6",
        "9Y<u'",
        "WdsImgGetHandleFromFindHandle",
        ":C;`;g;",
        "FveCloseVolume",
        "3$3,3",
        "8M8S8",
        ".?AVIDepVHDFile@@",
        "CompressionFolderList",
        "858u8",
        "Set data source id failed.",
        "1(0&0",
        "x=[4n",
        "9t$@t",
        "GetKernelObjectSecurity",
        "hsb-DE",
        "LegacyGatherVolumeInfo: Unable to determine FS type for <disk %u offset 0x%I64x>; GLE = 0x%X.",
        ".?AVCDepObject@@",
        "CDepWIMFile found invalid boot image index; BootIndex = %u, ImageCount = %u",
        "WINDOWS",
        "WdsImgFindFirstImageGroup",
        "WriteData failed during NULL block copy",
        "t$<PQQ",
        "GatherVolumeInfo: Couldn't find name for volume!",
        "7'717U7h7",
        "=\"=.=H=V=",
        "0(040@0L0X0d0p0|0",
        "4Q4i4",
        ".?AVWmiObject@WMI@@",
        "InitializeSecurityDescriptor",
        "GetFinalPathNameByHandleW",
        "3c4v4",
        "VDiskOpen: OpenVirtualDisk failed; hr = 0x%X.",
        "D$4WSP",
        "Microsoft Code Signing PCA 20100",
        "Failed to extract ci.dll from the WIM.",
        "LoadLibraryW",
        "SetUnhandledExceptionFilter",
        "D$@PW",
        "<(<6<t<",
        "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%",
        "\\\\?\\GLOBALROOT%s\\",
        "WIM\\IMAGE[*]\\WIMBOOT",
        "Failed to mark image for wimboot state.",
        ";9<h<",
        "LegacyGatherVolumeInfo: Couldn't determine if disk [%d] region [0x%I64x] is writable; hr = 0x%x",
        "\\AMD64",
        "COM Error: '%s'",
        "9B\\t3",
        ":4:D:H:L:P:T:X:`:d:x:|:",
        "8O8e8",
        "7Z>@B1",
        "Failed to get img buf",
        "PreparePack:Found disk pack [%s] with unknown status 0x%x",
        "0\"0,060F0V0\\0g0m0y0",
        "<.=@=[=",
        "1;2N2o2",
        "u.FAB;",
        "0i0v0",
        "%w't%",
        "<%<9<V<m<",
        "4M4h4",
        "6Q7X7",
        "WDS_TRACING_%u",
        "Error setting compression",
        "1]4a4e4i4m4q4u4y4}4",
        "=8>N>Z>h>",
        ";!<j<t<",
        "arn-CL",
        "D$0PQR",
        "D$0SVW",
        "FindFirstVolumeW",
        "6.6A6\\6{6",
        "DequeueNextChunk",
        "L$T_^[3",
        "tNVVVS",
        "0#171E1a1x1",
        "Journaling is enabled successfully on the applied volume.",
        ":.:D:",
        "Encountered file with excess reparse data. Id 0x%08x%08x",
        "EnumImageDataEntries",
        "wH9\\$",
        "SYMBOLICLINK",
        "7\"7)7\\7j7",
        "NtSetEaFile",
        "AMD64",
        "Y4?L8M",
        "WIM_Chunked_Number_Of_Threads",
        "u;9~0t6",
        "yoj@j",
        "Description",
        "Unable to determine size of file %s; hr = 0x%08x.",
        "D$<PW",
        "919R9~9",
        "9\":<:J:y:",
        "iu-Cans-CA",
        "GatherRegionInfo: LegacyGatherVolumeInfo failed, hr = 0x%x",
        "\\$4Sj",
        "3!4>4P4Z4",
        "9$929m9",
        "4'4?4t4",
        "T$@WP",
        "st-ZA",
        "7&8S8",
        "CreateRestoreInfo",
        ".CRT$XIZ",
        "=V=`=",
        "364=4",
        "WdsImgGetImageFormat",
        "4:4X4v4",
        "PWSWWWh",
        ";<;A;T;e;k;",
        "Unable to set reference to dependent file [%s]; hr = 0x%X",
        "HighPart",
        "CompanyName",
        "#D$ P",
        "yHVh]",
        "1\"2-282C2T2",
        "9t$Pt",
        ";&;3;:;b;i;w;",
        "NtUnloadKey2",
        "=#>;>\\>o>",
        " !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~",
        "NtOpenSymbolicLinkObject",
        ":#:=:D:_:f:",
        "EditionId",
        "VVVWh",
        "WdsImgFindNextImage",
        "?'?H?Y?f?r?",
        ";2;T;x;",
        "Getting WMI String property %s: unexpected VARIANT type %d",
        "de-LU",
        ">@?J?f?x?",
        "T$TQQ",
        "D$hPW",
        "20201009050501Z0w0=",
        "0123456789abcdef",
        "7E7L7[7b7o7v7",
        "WIMLoadImage failed to load image [%s :: #%u]; hr = 0x%X",
        "http://www.w3.org/2000/xmlns/",
        "@\\WjdPQ",
        "WimCreateWorkerThreads",
        "virtdisk.dll",
        ".?AV?$CAutoRelease@PAUIWbemServices@@@RAII@@",
        ".?AV?$CAutoRelease@PAUIEnumWbemClassObject@@@RAII@@",
        "9K:f:",
        "ReleaseVolumeAccessPath: Released access path '%c:\\'",
        "4;4J4P4z4",
        "6,6B6",
        "StateStoreGetMountedImageTime",
        "Sparse mount enabled via override",
        "4,4j4",
        "CreateFileW",
        "WimBootCompress.ini",
        "t~j?Yf;",
        "SetFilePointerEx",
        "Unable to create destination WIM [%s]; hr = 0x%X.",
        "3'3q3x3",
        "tcjCj",
        "525k5",
        "ExportInResourceOrder",
        "The specified image already exists at the target location. %n",
        "j\\^f9tB",
        "sk-SK",
        "WIMExtractToHandleFromMountReparseData",
        "WdsImgGetUnattendFilePresent",
        "The image group is empty. %n",
        "8f9v9",
        ".winmd",
        "IMAGE\\WIMBOOTENTRIES",
        "wcsrchr",
        ".text",
        "CreateProcessW",
        ":MdSpt",
        "?O?f?",
        "es-CO",
        "en-PH",
        "LogSharingViolationErrorInfo",
        "RestoreFileMetadata",
        "fr-CI",
        "dSVW3",
        "GetSecInfo failed",
        "?-?;?A?",
        "0f1m1",
        "WIMExportImage",
        "6\\7|7",
        "2@2D3(4g4}4",
        "8 8/8",
        "GetDiskFreeSpaceW",
        "8 9I9",
        "ba-RU",
        "GetVirtualDiskInformation",
        "f=H@=",
        "2]3p3",
        "<marshall data>",
        "9Kdt_",
        "WdsImgSetDescription",
        "N+@:81J",
        "config",
        "</<{<",
        "9>9P9z9",
        "FindNextVolumeW",
        "=I=t=",
        "|$HSQ",
        "7!7(7",
        "9%:=:",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "RtlSetThreadErrorMode",
        "WriteFile() failed or short write",
        ">A>T>b>~>",
        "10.0.19041.572",
        "7,73787K7",
        ";o;u;",
        "IMPLIED",
        "tn8^\\t",
        "Online",
        "RtlReAllocateHeap",
        "8,8B8",
        ";;;J;b;",
        "Couldn't find split WIM part %u (at [%s])",
        "t$T+t$",
        "j:^f9",
        ":%:,:E:",
        "L$$_^[3",
        "6,6f6m6",
        "=7>|>",
        "_9^<t",
        "4V4]4t4{4",
        "PVhh,",
        "4b4z4",
        "PPPPPP",
        "SetVirtualDiskInformation",
        "0:1T1e1x1",
        "SetAttributes",
        "Reset restore hardlinks error because of file redirection.",
        "6#757<7^7",
        "WdsImgIsAccessible",
        "RestoreMountStub: setting reparse point data failed",
        "WdsImgGetBootIndex",
        "SetFileAttributesW",
        "co-FR",
        "6(6S6Z6",
        "iswdigit",
        "<><D<]<d<s<z<",
        "6b7p7x7",
        "_vsnwprintf",
        "3E3V3]3",
        "D$,BP",
        "687x7",
        "WIM\\IMAGE[*]\\FILECOUNT",
        "WdsImgCopyImage",
        "GetSysVolRefNodePath",
        "A;K$r",
        "ImpersonationCountInit",
        "%s: VHD with no parent encountered, no updates necessary.",
        ";#<*<`<g<",
        "{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}",
        "3G4e4",
        "WimImageCreateWorkers",
        "4,4X4",
        "WIMCAPTURE_SPARSE",
        "The image does not belong to the specified image group.",
        "8$84888<8@8D8H8\\8`8d8h8p8",
        "CheckExcludeMetadata",
        "QPQQQQh",
        "VhdSafeReadMetadata: Failed to get the file size for %s [0x%08x]",
        "tu9p0up9p<t",
        "CharUpperW",
        "3A3K3a3",
        "3\"363=3X3c3",
        "6\"6@6O6Z6h6s6",
        "?R?W?n?w?",
        "1^1k1t1~1",
        "0G0U0n0",
        "Microsoft Corporation1200",
        "CreateFile() failed",
        "Image time low",
        "ar-JO",
        "0-0?0S0",
        "HeapAlloc",
        "+D$ ;|$ ",
        "GatherDiskInfoWorker: Unable to gather region info for disk %u (hr = 0x%X); marking disk as unreadable.",
        "This image version does not support adding an unattended setup file using this method. For more information please see the Windows Deployment Services documentation.%n",
        "\\\\.\\PHYSICALDRIVE%u",
        "Error restoring directory metadata - ignoring failure",
        "MaxBytes",
        "T$4;|$$r",
        "\\Windows\\System32\\ci.dll",
        "sr-Latn-ME",
        "2,232G2_2",
        "0R1h1",
        "?-?N?i?",
        "ConvertStringSecurityDescriptorToSecurityDescriptorW",
        "QueryPerformanceCounter",
        "gRich",
        "PQj@Z",
        "~j\\XPW",
        "$Microsoft Ireland Operations Limited1",
        "ug-CN",
        "t{93tw",
        "WIMInitializeWofDriverInternal",
        "ProcDirEntry",
        "5>6r6",
        "th-TH",
        "=Q=w=",
        "sms-FI",
        "jth`]",
        "919R9",
        "VhdSafeReadMetadata: File size invalid: %I64u",
        "j\\Xf9",
        "sd-Deva-IN",
        "WIMSendFileInfoMessage",
        ";\";N;[;b;",
        "pt-BR",
        ".CRT$XCZ",
        "WIM\\IMAGE[*]\\DIRCOUNT",
        "_FC;]",
        "<*<K<",
        "D$ YY",
        "&quot;",
        "9(949@9L9X9d9p9|9",
        "toupper",
        "ImageOpenFile",
        "en-029",
        "q\\98u",
        ":J;Q;];d;",
        "CMicrodom",
        "be-BY",
        "ne-IN",
        "D$$;D$ v",
        "SVh8f",
        "CreateEventW",
        "> >*>",
        "5(606H6_6|6",
        "303L3l3",
        "L$@VP",
        "1M1X1n1",
        "\\Program Files\\WindowsApps\\",
        "3.4J4",
        "8K9_9i9",
        "CurrentMajorVersionNumber",
        "de-DE",
        "49=pG",
        "D$|PQ",
        "WIM %s, offset %.8x%.8x, length %x",
        "~PhXx",
        "A\\;B\\u",
        "0X0j0",
        ":};t=+?",
        "636U6c6r6",
        "Harddisk",
        "D$d9C",
        "ti-ET",
        "InitVDSService:Creating VDS loader...",
        "es-419",
        "sa-IN",
        "<R=p=",
        "GetLengthSid",
        "??0exception@@QAE@XZ",
        "< <L<o<",
        "Failed to create process on [%s], GLE=0x%x",
        "PWPhh{",
        ">N?`?",
        "%I64d",
        "454<4G4z4R5-676t6",
        "9*9o9",
        "[SQVV",
        "Vj.^f;1u",
        "xHj1^",
        ";%;g;",
        "=L=S=v=",
        "wPf92tK",
        "12191>1a1",
        "ar-SY",
        "CacheDisable",
        "GetSecurityDescriptorOwner",
        "RestoreFileInfo",
        "WdsImgGetImageIdentifierPresent",
        ".text$yd",
        "AuthUsesFlags",
        "5X6^6x6",
        "WriteData failed",
        "GetMountEntry",
        ".CRT$XIAA",
        "E$j$Z",
        "select * from MSFT_Disk where Number = %u",
        ">e?l?z?",
        "quc-Latn-GT",
        "ar-YE",
        "DeletePath: Cannot delete <null>.",
        "1F1n1",
        ";%;4;>;N;a;",
        "WdsRemoveDirectory: Unable to remove directory [%s]; GLE = 0x%x",
        "CreateVolumeAccessPath: Successfully assigned (temp) drive letter [%c:] to [%s]",
        "GatherRegionInfo:Found partition matching extent offset but not size; disk [%u] extent <offset [0x%I64x], size [0x%I64x]> ",
        "u+jKh0",
        "tMhH\"",
        "97u\"3",
        "__PATH",
        "j\\Zf;Ty",
        "WdsImgVerifyImageFile",
        "1&1Q1",
        "E|SOCWE",
        "=)=2===J=h=",
        "878M8[8w8",
        "PVVVVh",
        "767f7",
        "WIMCheckExistenceFromMountReparseData",
        "PrepareVolumeAccessPath: Successfully created access path '%c:\\' for volume '%s'",
        "?<?J?T?^?k?r?",
        "NtCreateFile",
        "=3>L>y>",
        "NtQuerySecurityObject",
        "7+7m7",
        "DeleteFileW",
        "7S7Z7j7",
        "2<2H2N2U2\\2h2y2",
        "WmiObject::BeginCall: Couldn't get the class object for %s (0x%08x)",
        "8&8,8]8d8s8z8",
        "j\\Zf9TA",
        "Failed to get the host OS version.",
        "GXhl^",
        "8l9m<",
        "RtlAcquireResourceShared",
        "ApplyReparseFixup",
        "858J8",
        "Languages\\Default",
        "9+959O9U9[9",
        "Could not disable journaling (to restore original state) on the applied volume.",
        "ReleaseSemaphore",
        "435=5S5x5",
        "3/3>3W3l3y3",
        "?$?S?n?u?",
        "<+<2<y<",
        "D$0;|$$",
        "?terminate@@YAXXZ",
        "The specified image cannot be used as a boot image. %n",
        "??0exception@@QAE@ABV0@@Z",
        "RegCloseKey",
        "VSh0J",
        "QPSWQQV",
        "RestoreDirTree",
        "=<=S=Y=",
        "%s (Error = %d)",
        "yBVWh ",
        "ii-CN",
        "VWh K",
        " Microsoft Operations Puerto Rico1&0$",
        "!\\$<3",
        "_wcslwr",
        "ReleaseVolumeAccessPath: Access path '%c:\\' is no longer assigned, skipping release and zeroing reference count.",
        "CI EA is only supported on either WinPE host or one which supports extracted catalog folder.",
        "282g2p2",
        "VhdSafeReadMetadata: Failed to unlock %s [0x%08x]",
        "5c6j6",
        "<,=Q=X=",
        "FveOpenVolumeW",
        "QQSVWj",
        "WdsImgGetDescription",
        "CompressFileBackedByWim",
        "ro-RO",
        "PreparePack:Successfully imported disks in offline pack, but a reboot is required",
        "2f93t-",
        "585X5`5l5",
        "2:2?2",
        "en-AU",
        "GetProcAddress",
        "<:<A<",
        "FindClose",
        "<*<1<}<",
        "FltCommStubRename",
        "@t_9}",
        "030P0^0",
        "InitializeCriticalSection",
        "FveEnableAuthenticationW",
        "8C8`8",
        "Error restoring directory metadata",
        "0A1H1S1Z1u1",
        "4i5p5",
        "4U5k5",
        "BCryptCreateHash",
        "Wmi::OpenNamespace: Failed to connect to namespace '%s' (0x%08x)",
        "4A5H5S5Z5d5p5",
        "Microsoft Corporation1&0$",
        "GetModuleFileNameW",
        ".?AVCDepImageCopyable@@",
        "0A0v0",
        "6 6b6i6",
        "?1?h?o?",
        "CDepVHDImage::Copy: Failed to copy dependent files: 0x%08x",
        ";-<4<",
        "ResetEvent",
        "VPQQQ",
        " J9\\$$u",
        "GatherVolumeDriveLetters: Done querying drive letters.",
        "798a8",
        "qps-ploc",
        "bad allocation",
        "GetFileSize",
        "W93uH3",
        "<Q<^<m<v<}<",
        ":5:C:[:n:",
        "3K4a4",
        ".CRT$XCU",
        "CreateMutexW",
        "909<9p9z9",
        "%s: File part %s a VHD, updating parent if necessary.",
        "0Y0c0l0v0",
        "]._g*",
        "bs-Latn-BA",
        "WdsImgSetSecurity",
        "\\O#]`",
        "Integer overflow after ReadData",
        "M QRSP",
        "9KdtL",
        "<A<H<b<q<",
        "D$pPj",
        ";(<b<i<",
        "181J1S1e1",
        ";(;,;<;L;P;T;X;\\;`;d;x;|;",
        "ExportCopyStream",
        "An image file with the same name already exists. %n",
        "0,00040H0L0P0h0x0|0",
        "D$$PQ",
        "CoSetProxyBlanket",
        ".?AV?$CAutoCleanup@PAG@RAII@@",
        "standalone",
        "w QSW",
        "RtlImpersonateSelf",
        "zh-Hant",
        "NtSetCachedSigningLevel",
        "AddCompressedFileToImage",
        "=$=0=<=H=T=`=l=x=",
        "NTFS    ",
        "WWhd0",
        ">\">8>",
        "FAT32",
        "96:=:L:S:",
        "A group with the same name already exists. %n",
        "EqualSid",
        "4&4=4",
        "6%6;6",
        "VhdSafeReadMetadata: Failed to acquire shared lock on %s [0x%08x]",
        ";(;p;",
        "SWFVh",
        "UTF-16",
        "gd-GB",
        "ImageEndImpersonation",
        ":(:/:=:D:M:z:",
        "Version\\Build",
        "210303182929Z0t1",
        "VhdSafeWriteMetadata: Failed to open %s [0x%08x]",
        "1 1,181D1P1\\1h1t1",
        "L$pWVP",
        ".?AVexception@@",
        "WriteDataCallback",
        "\\pipe\\wimfltr",
        "4%464Z4",
        "? ?p?",
        "ncacn_np",
        ";);?;F;q;x;",
        "CoTaskMemFree",
        ":$;L;b;r;x;~;",
        ".data",
        "?V?f?|?",
        ";B;L;",
        "y'Vj1",
        "5%6l6z6",
        "UncompressFile",
        "RestoreFileMetadata: RestoreFileStorageTierClass failed",
        "?N?X?",
        ".?AVIDepVHDImage@@",
        "<3<=<k<",
        "BB{Qd4",
        "0-0L0S0f0m0",
        "WIM boot pre-apply steps failed; hr = 0x%X",
        ";Y<q<",
        "The specified image type does not support copy operation. %n",
        ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:",
        "NOTATION",
        ":(;?;F;a;k;",
        "BuildFileNodeHashTable",
        "FIXED",
        "WIMMountImageHandle",
        "202<2H2T2`2l2x2",
        " Windows",
        ".050x0",
        "CDepVHDImage::Copy: Post-copy operations failed: (0x%08x). Reverting copy.",
        "RtlGetThreadErrorMode",
        "NtSetCachedSigningLevel2",
        "5h5x5",
        "p!c5Mf",
        "5 5=5D5y5",
        "CompressionExclusionList",
        "9D$$t",
        "x(9\\$<u\"h",
        "2:3m3",
        ",f~|z[WP",
        "The specified compression type does not match the compression type of the image group. %n",
        "WimMount",
        "es-US",
        "191219011459Z",
        "RpcBindingSetAuthInfoW",
        ":b;q;",
        "LegacyGatherVolumeInfo: Couldn't find NT path for disk [%u] region [0x%I64x]; hr = 0x%X.",
        "6*7>7",
        "4&5<5b5~5",
        "0QhdH",
        ":#:0:7:H:O:",
        "j YWPS",
        "7(8F8V8\\8",
        "9$:<:C:",
        "*41;D$<s",
        "8 8$8(8,8084888<8D8H8L8P8T8h8l8|8",
        "WdsImgGetVersion",
        "RegDeleteValueW",
        "=7>p>",
        "919?9[9m9",
        "626]6",
        "es-AR",
        "SetSecurityInfo() failed",
        "InstallationType",
        "xJj&Y",
        "RtlAcquireResourceExclusive",
        "LaunchWimserv",
        "y/VhV",
        "rw-RW",
        "wcsncmp",
        "hu-HU",
        "Cabinet.dll",
        "Failed to set wof data",
        "3$4*40464<4I4P4V4`4f4q4w4",
        ":T;v;",
        "%s[*]",
        "EnumImageFiles",
        "WdsImgClose",
        "NtQueryDirectoryFile",
        "252M2",
        "GetDiskSMARTStatus: Disk does not support SMART failure detection.",
        "2d3z3",
        "[ybVh",
        "7H>U>",
        "IMAGE\\WINDOWS\\VERSION\\MAJOR",
        "GatherVolumeDriveLetters: Querying drive letters...",
        "< =V=r=",
        "Version\\SPLevel",
        "haw-US",
        "Global\\SetupLog",
        "WdsImgGetLastModifiedTime",
        "header type/size mismatch",
        "CDepWIMFile found invalid WIM info: PartNumber = %u, PartCount = %u",
        "5%515>5O5W5]5l5r5",
        "\\StringFileInfo\\%04x%04x\\%s",
        "293q3",
        "az-Cyrl",
        "x8!D$",
        "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7",
        "=&=:=A=",
        ">'>J>w>",
        "6<7@7H7P7h7",
        "1A1O1U1",
        ".?AVIDepSubImageFilePath@@",
        "Unmounting WIM image (%s)...",
        "RestoreFileMetadata: RestoreHardlinks failed",
        "6H6O6l6",
        "WdsImgGetSize",
        "9 9,9",
        "zh-Hans",
        "0f1t1",
        "FIOGetFileId",
        "_^[+P",
        "CreateFileMappingW",
        "8w9(:",
        "1&1G1[1i1",
        "Version\\Major",
        "AhN~%",
        "ff-Latn-NG",
        "=3>a>",
        "CloseEncryptedFileRaw",
        "9 9$9(9,9094989<9@9D9H9\\9`9d9|9",
        "%hs: Can't read MSFT_Disk.IsReadOnly ( 0x%08x )",
        "EnumeratePathEx: FindFirstFile failed for [%s]; GLE = 0x%x",
        "3:3@3U3h3",
        "=;=m=s=x=",
        "3Q5j5",
        "Sleep",
        "2Q2W2",
        ".permission",
        "tg-Cyrl-TJ",
        "EnumeratePathEx: Callback requested enumeration interruption or hit internal enumeration failure on [%s]; GLE = 0x%x",
        "4P5y5",
        "LegacyGatherVolumeInfo: Couldn't determine if disk [%d] region [0x%I64x] is online/offline; hr = 0x%X.",
        "zh-HK",
        "RegEnumValueW",
        "7\"7?7I7_7",
        "An invalid handle was specified. %n",
        "250706205017Z0~1",
        "9X\\t93",
        "MountDeletePathCallback",
        "iscsiprt",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0h0l0p0|0",
        "2%3/3G3^3h3",
        "sr-Cyrl-CS",
        "GetCurrentProcessId",
        "WdsImgGetArchitecture",
        "333S3X3]3b3",
        "WdsCopyFileEx: Failed to delete %s. GLE = 0x%x",
        "565=5J5Q5",
        "Can't apply an unresolved image",
        "VerQueryValueW",
        "100706204017Z",
        "H9D$0t&h",
        "ru-RU",
        "LocalFileTimeToFileTime",
        ";D$<s",
        "RegFlushKey",
        "?(?,?D?T?X?\\?t?",
        "ResNodesLoad",
        "BCryptGetProperty",
        ">g?|?",
        "0 141B1",
        "GetFileSecurityW",
        "676>6N6",
        "0(0M0",
        "Substitute name string copy failed",
        "CDepVHDImage: image is not surfaced",
        "lv-LV",
        "RtlGetLastNtStatus",
        "se-NO",
        "8r ,Y",
        "D$XWPj",
        "ks-Arab",
        "Status",
        "CI EA is not supported due to mismatched versions of host OS and applied image.",
        "081B1",
        "RestoreFileCompression",
        "PRODUCTNAME",
        "br-FR",
        "BCryptDestroyHash",
        ".idata$4",
        "5 5,585D5P5\\5h5t5",
        "CurrentMinorVersionNumber",
        "t$4)D$`",
        "1:2R2q2}2",
        "3g4v7",
        ">)>O>",
        "\\\\?\\UNC",
        "ga-IE",
        "%hs: IEnumWbemClassObject::Next() failed (0x%08x)",
        "j?Xf;",
        "PWhp$",
        "en-GB",
        "RSDS%",
        "D$,90t/",
        "VDiskSurface: Confirmed surfaced disk is online",
        "ks-Deva-IN",
        "bn-BD",
        "ExportDirTree",
        "D$pSV3",
        "Enabling sparse mount.",
        "2.3k3",
        "Mounting new image.",
        "L$0P3",
        "Microsoft Corporation0",
        "PPPhP",
        "KnILk",
        "D2J5A",
        "base\\eco\\wds\\wdslib\\wim\\wdswimfile.cpp",
        "9*:;;^<",
        "Control\\Nls\\Language",
        "hr-BA",
        "There are no more image groups. %n",
        "el-GR",
        "5g6n6",
        "VhdSafeReadMetadata: Failed to allocate buffer for data [0x%08x]",
        "failed transaction commit",
        "FIOFileOpenRelative",
        "D$$hP",
        "es-PR",
        "C\\;G\\u",
        "NtYieldExecution",
        "354<4",
        "GetVolumePathNamesForVolumeNameW",
        ">8???",
        ">2>8>",
        "ImageIsFileOwned",
        "1%212:2A2Z2a2q2",
        "NtQueryInformationFile",
        "NDATA",
        "#,|6d",
        ".CRT$XIA",
        "6 7;7I7R7^7e7l7x7",
        "1 1<1X1x1",
        "WdsImgGetEnabled",
        "5)5@5S5",
        "_wcsupr",
        "NtQueryObject",
        "L$DQh",
        "tIVS3",
        "WdsImgGetCreationTime",
        "pap-029",
        "ko-KR",
        "WIMMOUNT_SPARSE",
        "zh-CN",
        "TlsAlloc",
        ">'>=>y>",
        ">$>0><>H>T>`>l>x>",
        "7B8J8Y8_8r8",
        "InitLZMSDecompression",
        "?K?f?q?x?",
        "<L<[<b<",
        "2$2+2=2",
        "RestoreDirTree: RestoreFileStorageTierClass failed",
        "chr-Cher",
        "GetCurrentDirectoryW",
        "BX;AX",
        "<9<]<",
        "G QQVP",
        "SWVhtw",
        "?what@exception@@UBEPBDXZ",
        "VirtualFree",
        "3.484o4",
        "de-AT",
        "es-PE",
        "768N8z8",
        "[F$d*",
        "%hs: Can't OpenNamespace ( 0x%08x )",
        "es-PY",
        "CreatePath: Unable to create [%s]; GLE = 0x%x",
        "Af;H(s",
        "FindFirstFileW",
        "7&8D8",
        "DeletePathDirectoryCallback: Spoofing detected deleting [%s] -> [%s]",
        ".rdata",
        "FindOtherMountsForWimCallback",
        "D$pSVW",
        "> >8>H>X>h>l>p>x>",
        "9(9>9J9V9b9",
        "=V>]>",
        "4(5c5",
        "base\\eco\\wds\\wdsimage\\src\\enumimagegroups.cpp",
        "%s: Not resolved parent",
        ";D$4uV",
        "WINDOWS\\SystemRoot",
        ".text$di",
        "u6VVh",
        "strcpy_s",
        ".?AVCDepVHDSubImageFilePath@@",
        "GetFileTime",
        "4/5O5Z5k5",
        "&apos;",
        "_wcstoui64",
        "D$<VPhH",
        "DeleteFileEx: hardlink given to us is: %s",
        "SPBUILD",
        "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\sync.c",
        "L$49L$,w}r",
        "tXVWj",
        "C QRRRRR",
        ".w.t,",
        "OriginalFilename",
        "smj-SE",
        "L$$9t$ t",
        "tWVPj",
        "quz-EC",
        "RestoreFilesCallback",
        "az-Latn",
        "_CxxThrowException",
        "6.6L6",
        "465p5",
        "0M1v1",
        "|$ vK;L$0s",
        "LowPart",
        "6^8h8r8",
        "395T5",
        "SSSSSSS",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0t0",
        "ca-ES",
        "se-FI",
        "5)5<5i5o5",
        "lSVW3",
        "7+777_7z7",
        "tRVVj",
        "ar-LB",
        "StorageTiering not supported",
        "ur-IN",
        "pl-PL",
        "@.reloc",
        "8#8N8",
        "=+>A>",
        ";6<<<k<r<",
        "Global\\wimmount_mounting_event_%s",
        "p%s\\*",
        "moh-CA",
        "<0<G<d<@=[=",
        "CreateSemaphoreW",
        "WIMExtractToHandleFromMountReparseDataEx",
        "S,_^[",
        "WdsImgImportImage",
        "\\\\?\\Volume{",
        "LegacyGatherVolumeInfo: Couldn't determine encryption state of disk [%u] offset [0x%I64x]; hrFVE = 0x%X",
        "9O9]9",
        "G$9G t",
        "t>j.W",
        "RtlInitializeCriticalSection",
        "WimSetSecurityDescriptor",
        "RtlFreeHeap",
        "6\\6s6z6",
        "si-LK",
        ":-:9:C:",
        "9(9,9@9D9H9L9P9T9h9l9|9",
        ";x4sz",
        "toj@j",
        "tiPQP",
        "SSh  ",
        "DeleteFileEx: Unable to clear out attributes on [%s]; GLE = 0x%x",
        "728J8k8",
        "4/5@5",
        "bin-NG",
        "<A<u<",
        "5#5*5@5G5X5_5x5",
        "{bf1a281b-ad7b-4476-ac95-f47682990ce7}",
        "FveAddTrustedWimData",
        "sP9sTt",
        "VDiskOnlineSurfacedDisk: Failed to online using Storage Management API [hr = 0x%08x]",
        "<&<C<`<k<~<",
        "050S0q0",
        "WdsImgCreateImageGroup",
        "_callnewh",
        "RtlDosPathNameToNtPathName_U_WithStatus",
        "ExportHash",
        "6N6U6",
        "ReleaseVolumeAccessPath: Failed to undefine access path '%c:\\': 0x%08x",
        "5O5e5",
        "7/8t8",
        "4U4m4",
        "5'6g6",
        "fr-ML",
        "qsort",
        "IWbemClassObject has no __CLASS property",
        "WdsImgAddReference",
        "2%323?3D3q3",
        ">MdSpu",
        "8D8x8",
        "MapViewOfFileEx",
        "bn-IN",
        "3U3k3",
        "<0A0b0",
        "GetDisk: Finished querying unallocated disks",
        "t4f97t",
        "InitializeAcl",
        "Driver",
        "=$=(=,=D=T=d=h=l=p=t=x=",
        "SOFTWARE",
        "ru-MD",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "T$HQQ",
        "tn-ZA",
        "prs-AF",
        "= =>=J=j=",
        "%s\\ControlSet%03u",
        "Calling WIMApplyImage (flags = 0x%X)...",
        ">@.6Y",
        "tmj\\W",
        "The flags specified to an imaging function are invalid. %n",
        "Select",
        "GatherDiskInfo_ThreadFunc:Successfully reenumerated disks...",
        "PQQQQh",
        "wprintf",
        "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port %d",
        "Unable to register WIM callback; hr = 0x%X.",
        "MultiByteToWideChar",
        "en-NZ",
        ">7>o>",
        "828`8v8",
        "RevertToSelf",
        "ValidateFileAndSetEACallback",
        "@.rsrc",
        "memcmp",
        "AddAccessAllowedAce",
        "0(0K0l0",
        "az-Latn-AZ",
        "chr-Cher-US",
        "GetVolumeFileCountCallback",
        "909N9U9p9",
        ";0;G;U;^;e;",
        "SPhXR",
        "6)696C6^6l6v6",
        "Microsoft Time-Stamp PCA 20100",
        "RQRRR",
        "sl-SI",
        "u'QQQ",
        "526H7^7",
        "IVhdInfoInterface::CreateInterface: Win32 VHD API is not available",
        "fr-BE",
        ".?AV_WmiProperties@WMI@@",
        "%s\\Select",
        "3#3+383P3o3w3",
        "D$tHP",
        "5F6X6",
        "3 3$3(3,30343@3L3X3d3p3|3",
        "6]7d7",
        "w2t,-L",
        "wimserv.exe %s",
        "Control\\Windows",
        "DeleteFileEx: Spoofing detected deleting [%s] -> [%s]",
        "333D3K3",
        "445M5]5m5w5",
        ":=:S:x:",
        "Restored moved piece %s to original location %s",
        "9\\$X}",
        ":L;\\;i;p;",
        "%s: Parent for differencing disk %s is NULL.",
        ".idata$2",
        ".?AVIDepImageXMLInfoFormat@@",
        "AttachVirtualDisk",
        "0x%08x",
        "FH;A8",
        "WdsImgIsValidImageFile",
        "GetFileStorageTierClass",
        "%s: Failed to use existing metadata for %s: 0x%08x",
        "WdsImgReplaceImage",
        "384P4",
        "ObjectLength",
        "CDepVHDInfoFormat: failed to release volume access paths: 0x%08x",
        "1e1s1",
        "IMAGE\\WIMBOOT",
        ">-?7?@?F?R?`?k?",
        "EditionID",
        "WIMLoadImageInternal",
        "8#8(8.8D8R8",
        "L$8WW",
        "InitLZMSCompression",
        "Failed to remove directory",
        "Failed to allocate copy data buffer [0x%08x]",
        "2,2P2l2",
        ".?AVIDepImageSet@@",
        "GatherProviderInfo:PreparePack failed; trying to proceed anyway (HRESULT = 0x%x)",
        "LeaveCriticalSection",
        "252m2",
        "en-ZA",
        "LANGUAGE",
        ">j?o?",
        "GetEnvironmentVariableW",
        "SETUPAPI.dll",
        "%s%s%s",
        ">G?N?",
        "CVhdInfoInterface::GetFileInfo",
        ">*>I>Y>",
        ")`yJb",
        "768@8V8",
        "C(;C$",
        "3[3x3",
        ".rdata$T$brc",
        "Could not move source file",
        "{7ebc3661-e661-4943-95a5-412378cb16d1}",
        "y&Sjq",
        ";-;7;L;U;_;y;",
        "ReadEncryptedFileRaw",
        "D$DPj",
        "WIM Path",
        ":l;H<g<C=`=#>;>T>",
        "PrepareVolumeAccessPath: Found existing access path NOT assigned by AccessPaths: '%c:\\' for volume '%s'",
        "The image group contains images that depend on the image being deleted. %n",
        "ProductVersion",
        "=c>z>",
        "WdsRemoveDirectory: Unable to prepare path [%s]; GLE = 0x%x",
        "%s.swm",
        ";4;O;\\;|;",
        "GetVolumeInformationW",
        "6)6O6j6}6",
        "4_4s4",
        "5 6>6Y6`6",
        "<(<4<@<L<X<d<p<|<",
        "%s-%s",
        "wcsnlen",
        "Unable to export image to [%s]; hr = 0x%X.",
        "Copy failed [0x%08x]; cleaning up partial copy.",
        "Image Index: [%d]",
        "0J0T0h0o0}0",
        "FIOReadFileIntoBuffer",
        "kn-IN",
        "VirtualAlloc",
        "1$101<1H1T1`1l1x1",
        "VhdSafeReadMetadata: Failed to open %s [0x%08x]",
        "QQQPQQj",
        "NtQueryVolumeInformationFile",
        "5V6b6l6v6",
        "WdsImgGetSystemRoot",
        "1'111",
        "WdsImgGetLanguages",
        "OlQh<",
        "$SVW3",
        "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9",
        "%wPtG",
        "8@8}8",
        "0123456789abcdefABCDEF",
        "Wofadk failed to attach volume!",
        "8'979G9P9Y9c9g9x9~9",
        "?1?>?Q?",
        "PrepareVolumeAccessPath: Found existing access path assigned by AccessPaths: '%c:\\' for volume '%s'",
        "2A2g2",
        "__CLASS",
        "9*949d9",
        "1#2*2O2V2",
        "u#;H4s",
        "8(8M8u8",
        "80Z0r0;1S1x1",
        "en-ID",
        "?J?Z?d?|?",
        "VhdPopulateOSMetadata: Attempting to use IOCTL to wait for volume arrival",
        "PWhl+",
        "RtlVerifyVersionInfo",
        "IMAGE\\FILECOUNT",
        "Removing surfaced VHD image (disk %u)...",
        "PPPPPPP",
        "tU9q0uPV",
        "134N4",
        ":+:B:]:i:u:",
        "<unavailable>",
        "VWhlC",
        "<^<j<",
        "|%I64u",
        "ms-BN",
        "VS_VERSION_INFO",
        "ar-IQ",
        "3_^[]",
        "af-ZA",
        "tij:V",
        "LocalAlloc",
        "DeleteFileEx: Unable to open [%s]; GLE = 0x%x",
        "OutputDebugStringW",
        ";o<r=",
        "%s: Could not write SXS metadata file %s: 0x%08x",
        "sma-SE",
        "t$h,b",
        "OLEAUT32.dll",
        "#0)0\\0",
        "7 7(70787@7L7l7t7",
        ":2:H:c:",
        "DeleteAndRestoreDirectory",
        "8G9s9",
        "9\\$0t]",
        "O0M0K",
        "?(?4?B?I?[?o?",
        "WIMCloseWIM",
        "WdsImgGetResourcePath",
        "uz-Cyrl-UZ",
        "4)404F4M4\\4c4",
        "GatherDiskInfo_ThreadFunc:Wait for pending device installs timed out.",
        "8 9X9",
        "9!9>9L9h9",
        "6 6$646D6H6X6h6l6|6",
        "=7=>=W=g=n=",
        "2\"2q2x2",
        "60676",
        "%s-%u.%s",
        "mn-MN",
        "WimBoot",
        "RestoreEncryptedFile",
        "CMP_WaitNoPendingInstallEvents",
        "^`9^ht",
        "5D5`5i5q5",
        "=0>D>[>",
        ".?AV?$CAutoHeapFree@PAG@RAII@@",
        "WdsImgAssignImageIdentifier",
        "1N2W2`2y2",
        "9(:l:}:",
        "Multithreaded chunked decoding disabled via environment variable; will skip!",
        "979>9_9f9s9~9q;v;",
        "4<5u5|5",
        "2(323O3u3",
        "?5?@?",
        "VERSION.dll",
        "LANGUAGES",
        "7=7U7",
        "Default",
        ".rdata$r$brc",
        "!p!q!r!s!t!u!v!w!x!y!z!{!|!}!~!",
        "IMAGE",
        "DeviceIoControl",
        "ChunkWriterInit",
        "D$lSP",
        ".?AV?$CAutoCleanupBase@PAUIWbemServices@@@RAII@@",
        "CreateDestinationFileEx",
        "Failed to get decoder context",
        ">)>_?f?",
        "WimCopyResource",
        "PWWWQ",
        "%s: Set cached metadata for %s.",
        "GetMetadataPadding",
        "IsOsPreRS1",
        "<R<X<a<~<",
        "FindNextFileNameW",
        "Unable to clean up pre-existing file: %s",
        "IMAGE\\WINDOWS\\VERSION\\BUILD",
        "StateStoreGetMountedImages",
        "qps-Latn-x-sh",
        "9#:D;^<",
        "Flags",
        "PRODUCTTYPE",
        "WimBoot apply failed because the image is NOT a WIMBoot compliant image!",
        "ConvertSecurityDescriptorToStringSecurityDescriptorW",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        "RtlInitializeResource",
        "[%s:(%d) -> %s] %s",
        "WimExchangeFiles",
        "GatherDiskInfo_ThreadFunc:Querying disk information...",
        "202X2",
        "2p3<4C4",
        "RPRRj",
        "\\IA64",
        "SYSTEM",
        "y2WhE",
        "=*=4=",
        "ProcessDirectory",
        "GUID:%s",
        "Failed to set directory extended attribute",
        "RestoreDirMetadata",
        "so-SO",
        ":[;};",
        "607D7U7\\7x7",
        "WdsImageId",
        "mn-Mong",
        "jaYjz_j:Z",
        "7a7k7",
        "trPWQ",
        "ReadMetaDataFile",
        ";A<H<V<]<m<t<",
        "YY_[^",
        "+a,Y?",
        "SHLWAPI.dll",
        "WIM\\TOTALBYTES",
        "ha-Latn",
        "RestoreDirMetadata: RestoreFileStorageTierClass failed",
        "GatherDiskInfo_ThreadFunc:Successfully waited for pending device installs.",
        "@u)j@j",
        "sv-FI",
        "RecordFileDataLocation",
        "WimParseHexString",
        "BQPQP",
        "Reset setting hardlink failure because of folder redirection",
        "2E2L2[2q2",
        ";<;C;V;",
        "j.Yf;",
        ";O<Y<h<o<",
        "WdsImgRefreshData",
        "\\$89E",
        "GetSystemDirectoryW",
        "7+8n8",
        "1g1X2c2t2{2",
        ":\";J;v;",
        "\\Windows\\WinSxS\\",
        "_strnicmp",
        "3(3]3d3",
        ".rsrc$01",
        "moving folder failed",
        "3-4H4",
        "t{h4[",
        "1p2>3J3",
        "IDREFS",
        "WIMApplyImage failed; hr = 0x%X",
        "_unlock",
        "GatherDiskInfo_ThreadFunc:Reenumerating disk devices...",
        "<1<d<",
        "7U8_8",
        "L$ ;L$0r",
        "fr-CH",
        "?D?K?",
        "5'666g6t6",
        "iu-Cans",
        "\\Mounted Images",
        "0#0;0",
        ".gfids",
        "!t$$Pj",
        "9;9Z9l9u9",
        "818?8i8p8",
        "zh-TW",
        "6O7`7g7{7",
        "sr-Cyrl-ME",
        "base\\eco\\wds\\wdsimage\\src\\imagegroup.cpp",
        "0!1Z1",
        "6)636>6R6f6z6",
        ":;:Q:X:p:",
        ".rsrc$02",
        "NtSetSecurityObject",
        "GetLastError",
        "memcpy_s",
        "DeleteFileEx: Unable to allocate hardlink path buffer",
        "%I64u",
        "2*242E2M2e2~2",
        "x69T$",
        ";\";*;4;E;U;",
        "GetTempFileNameW",
        "en-JM",
        "535=5c5m5",
        "Failed to set wof data for file backed by wim file",
        ">(>a>",
        "4\"5F5",
        "8*868>8",
        "se-SE",
        "en-BZ",
        "1)131C1L1",
        "GetLongPathNameW",
        "=I=`=l=",
        "D$ hx/",
        "CDepCopyManager::AddOperation: Destination %s cannot be changed (user changed to %s).",
        "0L0S0",
        "&040D0K0V0",
        "NMTOKEN",
        "ntdll.dll",
        "Normaliz.dll",
        "WorkerStateDuplicate",
        "WriteDirImage",
        "1(141i1}1",
        ",8LtEl1ZtYqTW+JQYevCwr25g9fzSRFL/x5ZpH/d82g4=0Z",
        "wimgapi.dll",
        "CDepVHDImage::Copy: VHD with associated metadata %s skipped but metadata not skipped.",
        ":S;V<",
        "%s:%s",
        "ReleaseVolumeAccessPath: Access path '%c:\\' is not ref-counted, skipping release.",
        "= =8={=",
        ">+?A?e?",
        "0+0n0",
        "6,6T6",
        "?MdDlu",
        "_amsg_exit",
        "\\Device",
        "Unable to apply image; could not find dest folder [%s]",
        "Failed to restore moved piece %s to original location %s [0x%08x]",
        ">2?H?",
        ";|$@r",
        "506X6",
        "es-CU",
        "WIM_FileData_Queue_Length",
        "The image store is empty. %n",
        "es-GT",
        "9L9b9",
        "da-DK",
        "Wimboot entries",
        "GetDiskSMARTStatus: Disk shows a SMART failure.",
        "WDS_TRACING_CONSOLE_OUTPUT",
        "ta-IN",
        "EstimateProgressForChunkedExport",
        "The specified image type does not support the append operation. %n",
        "base\\eco\\wds\\wdsimage\\src\\DepCopyConnector.h",
        "<!=0=B=I=",
        "344L4i4",
        ".?AVCDepImageXMLInfo@@",
        "CDepVHDImage::Copy: Failed to resolve moved image.",
        "9H9R9\\9l9",
        ";,<J<",
        "GetFileSystemFlags",
        "6I7w7",
        "j.Xf;",
        "1*1B1L1b1j1}1",
        "Microsoft",
        "8\"9C9S9q9",
        "IsOffline",
        "CSDVersion",
        "ku-Arab",
        "uYf9s",
        "WdsCopyFileEx: Failed to copy [%s] to [%s], GLE = 0x%x; will retry in %u ms",
        "FIOGetFileNameByHandle",
        "CDATA",
        "9t$ t",
        "ti-ER",
        "[0b0~0",
        "SERVICINGDATA",
        "t@f90t;",
        "UnhandledExceptionFilter",
        "__dllonexit",
        "InitVDSServiceNoStatic:Loading VDS service... ",
        "FIOReadHandleIntoBuffer",
        ":#;v;%<m<",
        "en-TT",
        "97vhS",
        "InitVDSServiceNoStatic:Successfully launched service.",
        "WIM_Verbose_Logging",
        "L$@QP",
        "EDITIONID",
        "<zf;D9",
        "Failed to enable journaling on the applied volume.",
        "5d6k677",
        "uk-UA",
        "GatherVolumeInfo: Couldn't retrieve volume properties; hr = 0x%X",
        "WimBoot apply failed because there is no wof driver!",
        "]_^[]",
        "\\$ ;E",
        "RegUnLoadKeyW",
        "IWbemClassObject %s has no __PATH property",
        "=hK2/;",
        "=!=5=;=R=Y=",
        "advapi32",
        "VDiskGetSurfacedDiskNumber: GetVirtualDiskPhysicalPath failed; hr = 0x%X",
        "PVhL*",
        "ImageRebuildFromImageHandle",
        "Process %s is accessing file wim %s",
        "?,?3?T?[?l?s?",
        "GetFileNodeFromPath",
        "kr-Latn-NG",
        "RtlFindAceByType",
        "9$949;9H9O9V9",
        "2!2G2t2",
        "4.5y5",
        "0*0B0G0",
        "EnumAndDeleteWimExternalFilesProc",
        "UpdateWIMHeader failed",
        "7O8_9|9",
        "WimImageSetInformationFile",
        "GetFullPathNameW",
        "7a7 8.8Q8[8n8",
        "MarkImage",
        "==?P?f?u?",
        "WdsImgSetBootImage",
        "CreateDirectory failed",
        ".giats",
        "A,;F8u",
        "en-SG",
        "GatherRegionInfo:Found apparent partition at invalid byte offset of 0 on disk %u; skipping...",
        "9>:R:`:",
        "y-Vh ",
        "uz-Cyrl",
        "<%s>%s</%s>",
        "j:Yf9H",
        "CopyFileDataCallback",
        "WdsImgGetPartitionStyle",
        "w|PPP",
        "8D8J8",
        "EnumResourcesForExport",
        "ImageGetFileCount",
        "VRQPh ",
        "3/3G3d3",
        "090D0T0[0",
        "GetAclInfo failed",
        "+T$\\+",
        ";V<h<o<",
        "j\\^f;p",
        "VhdSafeWriteMetadata: Failed to acquire exclusive lock on %s [0x%08x]",
        "failed transaction rollback",
        "ar-BH",
        "Ad;A`szh",
        "AllocateAndInitializeSid",
        ">3>X>",
        "failed",
        "WdsImgGetExFlags",
        "7<7A7q7",
        "PinningFolderList",
        "011;1S1p1",
        "6(646@6L6X6d6p6|6",
        "Unable to set temporary path [%s]; hr = 0x%X.",
        "\\system32\\ntoskrnl.exe",
        "HSVW3",
        "Failed to apply privileges!",
        "t 9X$t",
        "?(?4?@?L?X?d?p?|?",
        "L$4_^[3",
        "?$?(?@?P?T?X?p?",
        ")Microsoft Root Certificate Authority 20100",
        "FilterAttach",
        "PartitionOffset",
        "\\I386",
        "LastModificationTime",
        "EnumeratePathEx: Unable to construct path under [%s]; GLE = 0x%x",
        "Wmi::ExecQuery: Query [%s] failed (0x%08x)",
        "u<Vj@",
        "j?Zf9TH",
        "WdsImgGetXml",
        ":$:(:H:h:p:",
        "en-IE",
        "sq-AL",
        "CVhdInfoInterface::GetImageInfo",
        ".?AVCDepWIMFile@@",
        "100701213655Z",
        "VDiskOnlineSurfacedDiskSmApi",
        "4\\5p5~5",
        "9.9D9",
        "FIOGetFileNameFromId",
        "iu-Latn-CA",
        "4,404P4p4",
        "es-PA",
        "WaitForSingleObject",
        "GetSecurityInfo",
        "ExportFileNode",
        "4@4I4P4v4",
        "Mount Version",
        "7Ph$H",
        "[%d] %s%s%s%s",
        "OpenFilterPort",
        "#rSPo",
        "LegacyGatherVolumeInfo: Couldn't translate path; hr = 0x%X.",
        "PVj@Z",
        "3:3?3I3b3g3q3",
        "D$8h!@",
        "1#1)1.141<1D1P1V1\\1b1k1t1|1",
        "yuWh4",
        "FindNextFileW",
        "Wow64DisableWow64FsRedirection",
        "L$,_^[3",
        "0M0R0",
        "0=0S0\\0c0j0q0x0",
        "CDepVHDImage::Copy: Failed reverting copy: 0x%08x",
        ";+;K;R;];",
        "878R8",
        "DecodeChunk",
        "zh-SG",
        "WdsImgGroupGetImageFormat",
        "WdsRemoveDirectory: Unable to clear attributes on [%s]; GLE = 0x%x",
        "Failed to create temp dir",
        "=&=/=\\=z=",
        "WdsImgFindNextImageGroup",
        ".?AVIDepImageResolvedDiskBased@@",
        "ImageUnattend.xml",
        ">G>}>",
        "WIMExtractImagePathAndGetFileHandle",
        "en-IN",
        "VhdSafeWriteMetadata: Failed to truncate file %s [0x%08x]",
        "T$(94",
        "ENTITY",
        "9$9,949<9D9P9",
        "The image file specified is empty. %n",
        "RaiseException",
        "5.5D5o5",
        "GetVirtualDiskPhysicalPath",
        "t/QSV",
        "MALLOC failed",
        ":S;^;v;",
        "7E7n7",
        "WdsImgGroupGetSecurity",
        "SetEnvironmentVariableW",
        "GatherDiskInfoWorker: Unable to find disk's number.",
        ";&;2;<;I;o;",
        "L$8PW",
        "fy-NL",
        "2.2j2",
        ",SVWj",
        "fo-FO",
        "WdsImgDeleteImage",
        "FindFirstImage",
        "!0K0\\0c0u0|0",
        "445;5P5g5n5",
        "Microsoft\\Windows\\CurrentVersion\\Setup\\ImageServicingData",
        "t'Wj\\V",
        "D$,_^[3",
        "99:Y:p:",
        "=H=R=p=w=",
        "Query %s succeeded, but couldn't enumerate results (0x%08x)",
        "Mount Path",
        "4$4u4",
        "728h8",
        "L$hQS",
        "9K(tV",
        ";\"<,<B<H<S<{<",
        "\\Windows\\System32\\",
        "ReadMetaDataBuffer",
        "om-ET",
        "FormArcPathName:String copy failed; hr = 0x%x",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\fileutil.cpp",
        "Fonecore\\base\\eco\\wds\\wdslib\\common\\src\\wdsidn.cpp",
        "9MdHdu",
        "3:4}4",
        "CreateParallelDecodeInfo",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "CDepVHDImage::Copy: Internal error, metadata file isn't the final file part.",
        "RestoreDirTree: WimImageCreateFile failed",
        "_wcsicmp",
        ":0;D;",
        "StateStoreGetVolumeFileCount",
        ";D<M<T<Y<_<w<",
        "QQSV3",
        "8 9N9",
        "7@7M7",
        "InitVDSServiceNoStatic:Creating VDS loader...",
        "WimApplyPrivileges",
        ".idata",
        "taj=R",
        "GetFileAttributesW",
        "CheckDataAvailableForHash",
        "it-CH",
        "fr-LU",
        "ImageBeginImpersonation",
        "7F7Q7x7",
        "10.0.19041.572 (WinBuild.160101.0800)",
        "7h7~7",
        "8.9A9O9k9",
        "2,232P2Y2v2",
        "CleanupExtractRemainingStubs",
        ":J;Q;x;",
        "\\system32\\csrss.exe",
        "<&=5=<=",
        "WDS Image Library %n",
        "QSVW3",
        "4A4K4a4",
        "=0>y>",
        "-Tz4q",
        "4?4L4_4h4s4",
        "D$(PW3",
        "0,0?0z0",
        "WdsImgGetProductFamily",
        "<:<V<",
        "smn-FI",
        "D$$9E",
        ".?AV?$CAutoCleanupBase@PAG@RAII@@",
        "es-ES",
        "ProcessSecurityData",
        "The imaging operation was canceled. %n",
        "f;D$Pu",
        ".?AVIDepImageBootable@@",
        "de-LI",
        "y Vhe",
        "4 4$4(4@4P4T4d4t4x4|4",
        "2+313J3",
        "<4<8<P<`<d<h<l<t<",
        "8*9N9Y9|9",
        ";\\;r;&<[<",
        "lb-LU",
        "WIMCaptureImageInternal",
        "CoInitializeSecurity",
        "es-NI",
        "t$ h0",
        "Failed to set Wof data for file",
        "GetVolumeInformationByHandleW",
        ";0;4;D;H;X;\\;t;x;",
        "GetLogicalDrives",
        "2 2,282D2P2\\2h2t2",
        "UUUUf",
        "ReadFile",
        "USER32.dll",
        "2B2N2m2v2",
        "=$=2=N=n=u=",
        "FveSetFipsAllowDisabled",
        "WimBoot capture failed because the format of wim file is not compatible!",
        "t*QVjd",
        "f9FHu",
        "9v9&:g:",
        "9|$@vD",
        ">X>i>",
        "WimBoot apply failed because the wim file has to be local!",
        "<^=e=",
        "4!4,434:4e4",
        "WimFindClose",
        "2*3D3",
        ">/???",
        "8P8f8",
        "RestoreDirMetadata: RestoreFileInfo failed",
        "F(QPj",
        "WIM_Enumerate_Directory_Reparse_Point",
        "WDSInitializeEmptyImageInformation",
        "\\\\?\\PhysicalDrive%d",
        "_wcstoi64",
        "oeY<9",
        "2(3/3",
        "rm-CH",
        "VhdSafeWriteMetadata: Failed to write entire buffer. Wrote %u of %I64u bytes.",
        "LegacyGatherVolumeInfo: Couldn't get size of [%s]; hr = 0x%X",
        ".?AV?$CAutoCleanupBase@PAUIEnumWbemClassObject@@@RAII@@",
        "SVh`e",
        "2G3Q3",
        "ar-AE",
        ";);R;n;x;",
        "7&7p7",
        "base\\eco\\wds\\wdsimage\\src\\imageapis.cpp",
        ".?AV?$CAutoRelease@PAUIWbemLocator@@@RAII@@",
        "FileTimeToSystemTime",
        "CountChunkedByteCallback",
        "t$4WV",
        "7\"7,7k7",
        ">'>c>z>",
        "WimbootProcessBeforeApply",
        "RestoreMountStub",
        "towupper",
        "gu-IN",
        ";|$Xt",
        "?2?n?",
        "2'3\\3",
        "KERNEL32.dll",
        "GetDriveTypeW",
        "Insufficient resources for multithreaded chunked decoding; will skip!",
        "mn-Mong-MN",
        "j\\Zf;P",
        "t(9\\$",
        "PPPPP",
        "base\\eco\\wds\\wdsimage\\src\\image.cpp",
        "CharUpperBuffW",
        "tKf9>tF",
        "smj-NO",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\trace.cpp",
        "WdsImgOpenImageGroup",
        "UpdateHardlinkDir",
        "L$8;U",
        "CopyFileW",
        "9x\\tCW",
        "%s: Failed to set cached metadata for %s: 0x%08x",
        "MoveCaptureNode",
        "8U8}8",
        "8G8S8]8c8p8",
        "SetEvent",
        "WimLazyInitialize",
        "= >*?E?`?v?",
        "> >,>8>D>P>\\>h>t>",
        "2)3.3m3w3",
        "Expected [%u] contiguous parts, but missing part number [%u] for [%s]!",
        "GetVolumeNameForVolumeMountPointW",
        "IMAGE\\WINDOWS\\VERSION\\MINOR",
        "7-7K7Q7",
        "!~<9~@t",
        "8=9]9v9\":>:",
        "WIMApplyImageInternal",
        ".rdata$zETW2",
        "\\ArcName",
        "T$PRP",
        "base\\eco\\wds\\wdsimage\\src\\imagestore.cpp",
        "uM9xXu",
        "1C1N1o1",
        "=:>R>X>",
        "QQSVW",
        "CopyFileExW",
        "wof.sys",
        "SVWj8j",
        ".?AV?$CAutoRelease@PAVWmiCollection@WMI@@@RAII@@",
        ":%:.:3:G:O:[:c:|:",
        "ReadData reparse tag from filestream failed",
        "ff-Latn",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FveDetect",
        "DeleteFileEx: Unable to get information on [%s]; GLE = 0x%x",
        "#text",
        "8>8`8x8",
        "5-5Z5e5~5",
        "RtlAdjustPrivilege",
        "y VSh ",
        "GetSystemDiskNumber: Couldn't open NT dir [%s]; status = 0x%x",
        "fil-PH",
        ".text$mn",
        "3\"3g3",
        "uD9pXu",
        ":U;};",
        "7,767",
        "SetThreadIdealProcessor",
        "RpcStringFreeW",
        "Compact apply failed because wof driver doesn't support it!",
        "% moa",
        "j\\Xf9DN",
        "QQQh(h",
        "0$000<0H0T0`0l0x0",
        "292C2}2",
        "FIOSetAttributesByHandle",
        ";K<R<",
        "j$Yf;O",
        "$Extend\\$Reparse:$R:$INDEX_ALLOCATION",
        "syr-SY",
        "6'737A7H7^7j7y7",
        "PWWWWh(",
        "Pj2jl",
        "es-UY",
        "UncompressFileBase",
        "BRANCH",
        "?)?I?",
        "j?h4]",
        "es-CR",
        "CreateDirectoryW",
        "\\Device\\Harddisk%u\\Partition%u",
        "787?7t7",
        "u6hT^",
        "es-VE",
        "9O9f9n9",
        "9\\$`t",
        "GatherVolumeInfo: Couldn't determine encryption state of volume [%s]; hrFVE = 0x%X",
        "= =F=K=U=o=",
        "1C1i1p1",
        "WIM\\IMAGE[*]\\CREATIONTIME\\HIGHPART",
        "VDiskOnlineSurfacedDiskUsingVds: Timed out waiting for VDS to see disk [%u]; hr = 0x%X",
        "LastModificationTime\\LowPart",
        "WdsImgSetUnattendFile",
        "sr-Latn-RS",
        "hr-HR",
        ".?AVIDepVHDImageResolved@@",
        "MSCFu",
        ":.:4:P:a:w:}:",
        "9E;W;",
        "RPCRT4.dll",
        "4_4k4|4",
        "FveCommitChanges",
        "BCryptHashData",
        "UTF-8",
        "T$@j[P",
        "Unable to resolve dependencies for image [%u] in file [%s]",
        "System\\CurrentControlSet\\Services\\WofAdk",
        "base\\eco\\wds\\wdsimage\\src\\wdsimage.cpp",
        "Performing WIM boot pre-apply steps...",
        "NtQueryDirectoryObject",
        "WdsImgDeleteImageGroup",
        "CVhdInfoInterface::SetImageInfo",
        "9t$ u8",
        "GPQQh",
        ":?:F:U:m:",
        "StateStoreRemoveMountedImage",
        "=/=6=_=",
        "6$6<6S6p6",
        "GetCurrentProcess",
        "1,14181<1H1",
        "7*717K7R7l7s7",
        "ioctl: setting reparse point tag failed",
        "PPPPSW",
        "VWj\\_3",
        "FltCommVerifyFilterPresent",
        "4@5]5l5w5",
        "Windows Deployment Services Image Library",
        "_^[Y]",
        "ywVh(",
        "2#313\"4",
        ";y-{e",
        "en-US",
        "u5jLh",
        ".?AVIDepWIMImageResolved@@",
        "3(3,3D3H3L3P3T3X3l3p3",
        "434$5:5",
        "616;6]6s6",
        "j\\Zf9",
        "sv-SE",
        "ry9|$",
        "base\\eco\\wds\\wdsimage\\src\\imagestore2.cpp",
        "CreateTransaction",
        "WDS_TRACING_DEBUGGER_OUTPUT",
        "!D$ BY",
        "PQh p",
        "<)<?<X<i<q<w<",
        "%s: Failed to get dependent file parts for %s: 0x%08x",
        "RestoreFileNodeList",
        "!Sh`z",
        "FindFirstFileNameW",
        "0,00040L0\\0`0p0t0x0",
        "D$XAF",
        "4#585L5j5x5~5",
        "5V5j5",
        "Image not found. %n",
        "WDSFreeImageInformation",
        "<E<L<i<p<",
        "[%S:%u] Expression: %S, hr=0x%x",
        "TlsFree",
        "0,0Z0d0z0",
        ".?AVIDepImageOS@@",
        "\\Windows\\SystemApps\\",
        " Operating System",
        "939G9",
        "PVVh<",
        "= =$=4=8=P=`=d=|=",
        "BuildLab",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "_initterm",
        ":&:3:::G:N:Y:^:h:|:",
        "qps-ploca",
        "ImageRecaptureDirectory",
        "210317011459Z0",
        "4)4/4D4J4`4",
        "MatchingDeviceId",
        "\\FVEAPI.DLL",
        "Setup",
        "DWord:%u",
        "IMAGEREFERENCE\\ImageIndex",
        "FveDetectTelemetry",
        "CDepVHDImage::Copy: Failed to duplicate existing info.",
        "D$4PQ",
        "232P2",
        "p SSW",
        "0a1t1",
        "SetLastError",
        "sah-RU",
        "WdsCopyFileEx: Failed to strip file attributes for %s, will delete. GLE = 0x%x",
        "D$TPh",
        ">MdDtu",
        ">http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0",
        "5S6`6g6}6",
        ">W>e>r>}>",
        "0\"1w1",
        "WimCreateDirectory",
        "oK0D$\"<",
        "_lock",
        "%s: Incompatible flags on input.",
        "$Kernel.",
        "7X8r8",
        ".rdata$brc",
        "3_4|4",
        "ImageGetMountGuid",
        "5;5T5f5",
        ".?AVWmi@WMI@@",
        "1%1N1b1g1",
        "2 3*3P3q3",
        "Found non-null hash in file node",
        "GetMountedImagesKey",
        "Microsoft Code Signing PCA 2010",
        "\\Windows\\Assembly\\",
        "UtilGetReadyEvent",
        "DEFAULT",
        "011v1",
        "BCryptFinishHash",
        "1h1o1",
        "it-IT",
        "z.9Wv",
        "ProcessWimQueueNode",
        "687H7\\7c7",
        "9w9):_:",
        "1$1+181?1",
        ":):N:k:r:",
        "3G4Y4_4",
        "ReleaseVolumeAccessPath: Undefined access path '%c:\\'",
        "t3!D$",
        "D$0;D$(",
        "4<4A4 565y5",
        "3;4\\4X6",
        "293G3",
        "RestoreRefNode",
        "The specified image does not support extraction of files. %n",
        "ImageMarshallHandle",
        "CreateFile failed",
        "1>1E1}192",
        "?<?p?",
        "uVf9S",
        "\\\\.\\Root\\Microsoft\\Windows\\Storage",
        "stat. failed",
        "CreateVolumeAccessPath: DefineDosDevice failed",
        "8 8,888D8P8\\8h8t8",
        "u$j2[h",
        "en-MY",
        "4Y4m4x4",
        ":n;/<-=!>",
        "ValidateAndClearWriteInProgressFlag",
        "=W=c={=",
        "4@5G5[5q5",
        "StateStoreGetMountedImageWimbootEntries",
        "Caller requested sparse mount",
        "pSaveMountedImageWimbootEntries",
        ";_<i<~<",
        "VPiw&",
        "PVh8,",
        "%s|%I64u|%s",
        ".?AVCDepImageOS@@",
        "D$ ;D$",
        "GetFileVersionInfoExW",
        "3@4G4",
        "0.151",
        "=!=u=",
        "ar-OM",
        "0,1S1b1z1",
        "809|9",
        "_vsnwprintf_s",
        "4&4/464]4",
        "CP9C<t",
        "S(_^[",
        "D$PPQ",
        "CDepImageXMLInfo::GetEditionID:EditionID=%s, Flags=%s : Returning %s, hr=0x%X",
        "<:=p=",
        "System Volume Information",
        "SetFileSize failed",
        ":MdLcu",
        "INDEX",
        "Setting WMI Bool property %s: the property does not exist",
        "ps-AF",
        "t=Wj,j",
        "WdsImgGetName",
        "A4;F<t2",
        "! !!!\"!#!$!%!&!'!(!)!*!+!,!-!.!/!0!1!2!3!4!5!6!7!8!9!:!;!<!=!>!?!@!A!B!C!D!E!F!G!H!I!J!K!L!M!N!O!P!Q!R!S!T!U!V!W!X!Y!Z![!\\!]!^!_!p!q!r!s!t!u!v!w!x!y!z!{!|!}!~!",
        "\\Windows\\System32\\WimBootCompress.ini",
        "6#6;6B6H6O6d6n6",
        ";X<p<",
        ": :8:<:T:d:h:x:|:",
        "%hs: Can't read MSFT_Disk.IsOffline ( 0x%08x )",
        "7Q8b8",
        "585=5n5",
        "fltlib.dll",
        "5F5Z5",
        "fr-CM",
        "NtSetInformationFile",
        "<&<~<",
        "UnmarshallImageHandleFromDirectory",
        "0-1x1",
        "WdsImgSetName",
        ">5>j>t>",
        "? ?/?6?E?X?",
        "&amp;",
        "\\\\?\\GLOBALROOT",
        "Source image or destination WIM is not WIMBoot compliant",
        "vi-VN",
        "t49C8u",
        "= =|=",
        "GatherDiskInfoWorker: Found disk with an invalid name.",
        "Failed to get NTFS version on volume [%s]. DOS path is [%s] Error code is [%d]",
        "<4<A<f<",
        "3[3e3",
        "t$PVhP",
        "AddFileNodeToImage",
        "j?Yf97tQ",
        "WimCloseImageFile",
        "62687>7",
        "; ;(;,;4;8;H;l;x;",
        "kl-GL",
        "5$5H5d5",
        "ResAddFromFileAndHandle",
        "93:t:{:",
        "EventWrite",
        "8<8D8L8T8\\8d8l8t8|8",
        ".rdata$sxdata",
        "7C7J7W7m7",
        ":3:=:b:",
        "RestoreReparsePoint",
        "SVWjD",
        "_f9<B",
        "WdsImage.dll",
        "!\\$$!\\$,",
        "9C$t-",
        "wcscpy_s",
        "iswxdigit",
        "B\\;A\\",
        "RemoveDirectoryW",
        "PSSSSSSSj",
        "ne-NP",
        "GetSystemTimeAsFileTime",
        "memset",
        "?,?7?b?",
        "9\":):b:x:(;\\;f;",
        "The mount path %s specified by the state store entry is no longer the mount path of this image.",
        ";$<3<K<s<",
        "_TmpHive_",
        "GetTickCount",
        "? ?1?g?",
        "1<2k2u2",
        "CoInitializeEx",
        ">.>>>",
        ";-<8<",
        "mn-Cyrl",
        "-FVE-FS-",
        "2?2g2",
        ":U:e:",
        " !\"\"\"#$ &&&%%%%%%%",
        "id-ID",
        "5Fz<|",
        "6%7^7",
        ".?AVCDepWIMSubImageFilePath@@",
        "BuildEndpointHandle",
        "\\PFPort",
        "LocalFree",
        "768X8",
        "VhdPopulateOSMetadata: Populating metadata for OS at [%s] (region offset = 0x%I64x)",
        "GetFileInformationByHandle failed",
        "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4",
        "9%:,:",
        "<IMAGEREFERENCE TYPE=\"VHD\" />",
        "9(9I9d9s9",
        "RpcStringBindingComposeW",
        "292n2s2",
        "ParseChunkRegionInternal",
        "ProductName",
        "=-=>=O=j=|=",
        "2'2.2=2D2",
        "> >,>8>D>P>\\>",
        "D$,t V",
        "sr-Latn-BA",
        "^@[Y]",
        "VerifyFileByHandle",
        ";;;_;u;",
        "WIM\\Image[Index=%u]",
        "Xf9ABt",
        "VHD\\IMAGE",
        "=+>2>]>",
        "Failed to load WofAdk!",
        "=\"=L=S=",
        "%s\\%s",
        "_except_handler4_common",
        "9S:Z:k:r:6;g;",
        "WIM\\IMAGE[*]\\WIMBOOTENTRIES",
        "8M8V8",
        "636[6",
        "8B8I8",
        "<IMAGEREFERENCE TYPE=\"WIM\" />",
        "MAJOR",
        "Getting WMI Uint32 property %s: unexpected VARIANT type %d",
        "8$8+8b8{8",
        "VDiskSurface: Virtual disk was successfully discovered. ",
        "? ?7?=?r?",
        ":#;2;U<g<",
        "wo-SN",
        "UpdateHardlinks",
        "GetAclInformation",
        "RestoreDirData",
        "la-001",
        "t#j\\Q",
        "8>8O8",
        "?5?H?",
        "fa-IR",
        "425<5H5L5Q5[5k5r5",
        "GatherDiskInfo_ThreadFunc:Wait for pending device installs failed. Error code is [0x%X]",
        ":H:_:k:",
        "<(=K=|=",
        "\\WINNT",
        "RestoreRefNodeCallback",
        "GetSysVolInfoPathFromMountPath",
        "=h>v>",
        "_wtoi",
        "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6",
        "2(2I2S2k2",
        "LoadFilterLibPointers",
        "j?_f9|B",
        "UnmarshallImageHandleFromId",
        ";@<q<v<",
        "SetFileTime",
        "xmlns",
        "?9?A?M?c?",
        "Failed to remove surfaced VHD image; hr = 0x%X",
        "WIMSetTemporaryPath failed to use [%s]; hr = 0x%X",
        "GetSecurityDescriptorGroup",
        "-eQkU",
        "WdsImgClearImageIdentifier",
        "9-9J9",
        "RtlSetControlSecurityDescriptor",
        "taSh0",
        "GetSecurityDescriptorDacl",
        "KtmW32.dll",
        ".?AVIDepImageSetContainer@@",
        "\\system32\\winpeshl.exe",
        ";](s?",
        "VDiskUnsurface: UnsurfaceVirtualDisk failed; hr = 0x%X.",
        "8Y8^8~8",
        "3!3)303=3",
        "?w<t6",
        "D$8G;}",
        "8$81888C8j8x8",
        "WimbootCleanup",
        "GetThisModuleDirectory",
        "9A0vq",
        "8)8F8^8}8",
        ">(>M>i>",
        ">i?p?y?",
        "=4=;=V=\\=l=s=",
        "Process PID %d is accessing file wim %s",
        ".?AVIDepImage@@",
        "I0G1-0+",
        "kk-KZ",
        "StateStoreInsertMountedImage",
        ",020k0u0,1",
        "9&9K9_9f9",
        "GetPrivateProfileSectionW",
        "DeletePath: Failed to obliterate [%s] after %d tries; GLE = 0x%x",
        "1~3+5#7l7<8",
        " Microsoft Corporation. All rights reserved.",
        "The specified image type is not supported for Boot Image groups. %n",
        "F0M0d0",
        "5'5=5[5e5C8Y8c8i8s8y8",
        ";C;n;",
        "QSVj j",
        "FilterGetMessage",
        "[0x%.8x] ",
        "EtwEventUnregister",
        "uC9XXu",
        "626G6L6Q6x6",
        "WimMoveFile",
        "MoveFileWithProgressW",
        "4K5v5",
        "^j?[;",
        "283E3]3",
        "FlushFileBuffers",
        "0;1/2",
        "< <$<(<,<0<4<8<<<@<D<H<P<`<h<p<",
        "1)2f2",
        "!This program cannot be run in DOS mode.",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\privilege.cpp",
        "T$<QP",
        "WdsImgGetLanguage",
        "021H1",
        "2!3E3T3d3j3q3",
        "7!7N7X7z7",
        "ku-Arab-IQ",
        "zh-MO",
        "GetExitCodeProcess",
        "t1VPQ",
        "WdsImgGetServicePackLevel",
        ";+;C;",
        "Local\\SetupVolumeAccessMapping",
        ":&:,:g:|:",
        "Encountered a reparse point which is also a hard-link",
        "QPWSRh",
        "%u.%u.%u",
        "C<+C(",
        "WMI::WmiCollection::MoveNext",
        "0P0s0",
        "1\"1:1",
        "t%jCY",
        ";0;I;^;s;",
        "%s: File part %s is cached metadata, checking name.",
        "mn-Mong-CN",
        "f@f#E",
        "889E9n9u9",
        "lt-LT",
        "VDiskOnlineSurfacedDisk: Trying again using VDS ...",
        "5]5s5",
        "DeleteFileEx: Unable to delete [%s]; GLE = 0x%x",
        "9r$tL;",
        "DeleteFileEx: Trying to set back attributes on: %s",
        "ResExtract",
        "9/:6:G:]:",
        "windows",
        "PWWVS",
        "GetDiskFreeSpaceExW",
        "=8=B=m=|=",
        "OpenThreadToken",
        "WimGetFileIdByHandle",
        "OpenProcessToken",
        "QQQQQQQW",
        "9P t49P",
        "MoveFileW",
        "8#9L9b9",
        "3G4g4",
        "CloseHandle",
        "SystemRoot",
        ":!:O:Z:a:",
        "0T3t3",
        "DeletePathEngine: Hit %d failure%s during recursive deletion of [%s]; 1st error = 0x%x, cd = [%s]",
        "<'=L=",
        "as-IN",
        " u+SjdWh",
        "mni-IN",
        "VDiskGetSurfacedDiskNumber: Unable to convert path to disk number; hr = 0x%X.",
        "9|$(v5",
        "WDSGetImageInformation",
        "2x2~2",
        "yMWh}",
        "D$0SVW3",
        "WriteFile",
        "4$404<4H4T4`4l4x4",
        "112}2#3",
        "SVWhP",
        "5<5L5p5",
        "WIM\\IMAGE[*]",
        "strncpy_s",
        ".?AVIDepImageOSInfo@@",
        "T$(9GL|X",
        "][YZ_^_^[",
        "WaitForMultipleObjects",
        "091T1",
        "4*414",
        "96:=:\\:",
        "3+3Q3_3f3}3",
        ":&:i:v:",
        "FIOClearAttributes",
        "FileVersion",
        "tESWV",
        "WdsImgCaptureImage",
        "LoadIntegrityInfo",
        "Could not set compression. Invalid cluster size.",
        "NtQuerySymbolicLinkObject",
        "ATTLIST",
        ".rdata$zzzdbg",
        "Failed to unmount WIM image; hr = 0x%X",
        "1:2v2",
        "Image time high",
        "GetFileStorageTierClass failed",
        "<&<3<<<G<S<Y<e<",
        "CVhdInfoInterface::UpdateFilePart",
        "UtilBuildEndpoint",
        "SVWQQ",
        "oc-FR",
        "VWRQSU",
        "uNj03",
        "Printed name string copy failed",
        "5:5R5i5",
        "CompareStringW",
        ".?AVCDepWIMImage@@",
        "yTShI",
        "CreateThread",
        "WDSIMAGE",
        "f;<Ht"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "849bf6a0f5b2a1d445408e9a35bfebe17ea0483732e8d438bbccabb32a4b55ca",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/849bf6a0f5b2a1d445408e9a35bfebe17ea0483732e8d438bbccabb32a4b55ca",
              "guest_paths": [
                "overlay"
              ],
              "size": 8656,
              "crc32": "4BE04CDD",
              "md5": "a620df9f0533439d4108e91cf669746f",
              "sha1": "b9c9ca084a348eda8c8761b5f9af65305c05a092",
              "sha256": "849bf6a0f5b2a1d445408e9a35bfebe17ea0483732e8d438bbccabb32a4b55ca",
              "sha512": "d786ec7d641dd9cabeb1c25f4de3f5d7a041514c2252ce1b5294de19b8467df1151021e12e4288bae72c0e513d46419a6779e323ece4a3d5aaccdc06b45d31b5",
              "rh_hash": null,
              "ssdeep": "96:ZZDEs3f0DHDsVBIwgmqvrnDD0ADEs3TDL2L4m2grMWaLN1DEs3Vi+6hhvBDqh0h6:QWf9BvVVWQ4mWVz6h1Q2SkqnajKs9ffI",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T1990209E29A7C9443EE837C805398E9D3BC3D93D72940916525ADF8E91CC37C2EB0896D",
              "sha3_384": "ea12ded81f5ca482f9161590eccd6b6489adb3dacd1f1d847b77a57a6dcbaf3688aae0a2a4e5b7c2c62c25fd7608f5bc",
              "data": null
            }
          ],
          "extracted_files_time": 0.0006706860003760085,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "unbcl.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/137eca75b268556503e26cd5987dddac5eb0831ed4ce5ea3b0d34b5645a31abd",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\unbcl.dll"
      ],
      "size": 835904,
      "crc32": "1840AC31",
      "md5": "5d52a4efac5b4b7530b388aeb6f9cb67",
      "sha1": "4b5d32a6caecec6e261f5ba7bae392609a6a0f65",
      "sha256": "137eca75b268556503e26cd5987dddac5eb0831ed4ce5ea3b0d34b5645a31abd",
      "sha512": "f7f88c4229c97bf598f995cf31a8adff73089ef8d26143cc839a30d63221fb66b185e12ae20bc17f14712723bb20c34f6e546f6be961164deeae268703322756",
      "rh_hash": null,
      "ssdeep": "12288:tFWowsrRqH5Euwb8naBgOMddILrWER0dDxAbti:tZRqHb1DILrfML",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T148050720625FC933EDBFB235126A217158FE501193FD8AD78BB896BD22632D14B31F49",
      "sha3_384": "bb5cd3ae388674477ffe4afa293ac9129b6eec6ae414972a118713448686ddae0b29863ac89b38d1b2a1d71cbad19567",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x0007ff60",
        "ep_bytes": "8bff558bec837d0c017505e8e5080000",
        "peid_signatures": null,
        "reported_checksum": "0x000cfd37",
        "actual_checksum": "0x000cfd37",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "unbcl.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x100c021c",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x100c0220",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x100c0224",
                "name": "_initterm"
              },
              {
                "address": "0x100c0228",
                "name": "_amsg_exit"
              },
              {
                "address": "0x100c022c",
                "name": "_XcptFilter"
              },
              {
                "address": "0x100c0230",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x100c0234",
                "name": "_callnewh"
              },
              {
                "address": "0x100c0238",
                "name": "?what@exception@@UBEPBDXZ"
              },
              {
                "address": "0x100c023c",
                "name": "??1exception@@UAE@XZ"
              },
              {
                "address": "0x100c0240",
                "name": "??0exception@@QAE@ABV0@@Z"
              },
              {
                "address": "0x100c0244",
                "name": "??0exception@@QAE@XZ"
              },
              {
                "address": "0x100c0248",
                "name": "_isnan"
              },
              {
                "address": "0x100c024c",
                "name": "wcsncmp"
              },
              {
                "address": "0x100c0250",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x100c0254",
                "name": "iswprint"
              },
              {
                "address": "0x100c0258",
                "name": "wcsncpy_s"
              },
              {
                "address": "0x100c025c",
                "name": "towupper"
              },
              {
                "address": "0x100c0260",
                "name": "__RTtypeid"
              },
              {
                "address": "0x100c0264",
                "name": "_lock"
              },
              {
                "address": "0x100c0268",
                "name": "_wtoi64"
              },
              {
                "address": "0x100c026c",
                "name": "printf"
              },
              {
                "address": "0x100c0270",
                "name": "_wcsncoll"
              },
              {
                "address": "0x100c0274",
                "name": "iswalpha"
              },
              {
                "address": "0x100c0278",
                "name": "iswdigit"
              },
              {
                "address": "0x100c027c",
                "name": "towlower"
              },
              {
                "address": "0x100c0280",
                "name": "?name@type_info@@QBEPBDXZ"
              },
              {
                "address": "0x100c0284",
                "name": "calloc"
              },
              {
                "address": "0x100c0288",
                "name": "wcscspn"
              },
              {
                "address": "0x100c028c",
                "name": "malloc"
              },
              {
                "address": "0x100c0290",
                "name": "memmove_s"
              },
              {
                "address": "0x100c0294",
                "name": "wcsrchr"
              },
              {
                "address": "0x100c0298",
                "name": "wcscoll"
              },
              {
                "address": "0x100c029c",
                "name": "free"
              },
              {
                "address": "0x100c02a0",
                "name": "_wcslwr_s"
              },
              {
                "address": "0x100c02a4",
                "name": "wcsspn"
              },
              {
                "address": "0x100c02a8",
                "name": "_wcsupr_s"
              },
              {
                "address": "0x100c02ac",
                "name": "wcsstr"
              },
              {
                "address": "0x100c02b0",
                "name": "wcschr"
              },
              {
                "address": "0x100c02b4",
                "name": "_vscwprintf"
              },
              {
                "address": "0x100c02b8",
                "name": "wcspbrk"
              },
              {
                "address": "0x100c02bc",
                "name": "_purecall"
              },
              {
                "address": "0x100c02c0",
                "name": "vswprintf_s"
              },
              {
                "address": "0x100c02c4",
                "name": "iswspace"
              },
              {
                "address": "0x100c02c8",
                "name": "_wcsrev"
              },
              {
                "address": "0x100c02cc",
                "name": "_wcsicmp"
              },
              {
                "address": "0x100c02d0",
                "name": "memcpy_s"
              },
              {
                "address": "0x100c02d4",
                "name": "_wcsicoll"
              },
              {
                "address": "0x100c02d8",
                "name": "_unlock"
              },
              {
                "address": "0x100c02dc",
                "name": "__dllonexit"
              },
              {
                "address": "0x100c02e0",
                "name": "_onexit"
              },
              {
                "address": "0x100c02e4",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x100c02e8",
                "name": "memmove"
              },
              {
                "address": "0x100c02ec",
                "name": "memcpy"
              },
              {
                "address": "0x100c02f0",
                "name": "_ftol2"
              },
              {
                "address": "0x100c02f4",
                "name": "__RTDynamicCast"
              },
              {
                "address": "0x100c02f8",
                "name": "_vsnprintf"
              },
              {
                "address": "0x100c02fc",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x100c0300",
                "name": "memset"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x100c0308",
                "name": "RtlGetVersion"
              },
              {
                "address": "0x100c030c",
                "name": "NtQuerySystemInformation"
              },
              {
                "address": "0x100c0310",
                "name": "NtSetInformationFile"
              },
              {
                "address": "0x100c0314",
                "name": "RtlNtStatusToDosError"
              }
            ]
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x100c01fc",
                "name": "VariantChangeType"
              },
              {
                "address": "0x100c0200",
                "name": "VariantClear"
              },
              {
                "address": "0x100c0204",
                "name": "SysReAllocStringLen"
              },
              {
                "address": "0x100c0208",
                "name": "SysFreeString"
              },
              {
                "address": "0x100c020c",
                "name": "SysAllocString"
              },
              {
                "address": "0x100c0210",
                "name": "SysAllocStringLen"
              },
              {
                "address": "0x100c0214",
                "name": "VariantInit"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x100c0000",
                "name": "RegQueryInfoKeyW"
              },
              {
                "address": "0x100c0004",
                "name": "RegCreateKeyExW"
              },
              {
                "address": "0x100c0008",
                "name": "RegEnumKeyExW"
              },
              {
                "address": "0x100c000c",
                "name": "RegSetValueExW"
              },
              {
                "address": "0x100c0010",
                "name": "RegDeleteValueW"
              },
              {
                "address": "0x100c0014",
                "name": "RegEnumValueW"
              },
              {
                "address": "0x100c0018",
                "name": "RegCloseKey"
              },
              {
                "address": "0x100c001c",
                "name": "RegOpenKeyExW"
              },
              {
                "address": "0x100c0020",
                "name": "RegQueryValueExW"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x100c0028",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x100c002c",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x100c0030",
                "name": "RaiseException"
              },
              {
                "address": "0x100c0034",
                "name": "HeapDestroy"
              },
              {
                "address": "0x100c0038",
                "name": "HeapSize"
              },
              {
                "address": "0x100c003c",
                "name": "GlobalAlloc"
              },
              {
                "address": "0x100c0040",
                "name": "CreateThread"
              },
              {
                "address": "0x100c0044",
                "name": "Sleep"
              },
              {
                "address": "0x100c0048",
                "name": "DuplicateHandle"
              },
              {
                "address": "0x100c004c",
                "name": "ResumeThread"
              },
              {
                "address": "0x100c0050",
                "name": "VirtualQuery"
              },
              {
                "address": "0x100c0054",
                "name": "CreateProcessW"
              },
              {
                "address": "0x100c0058",
                "name": "ReleaseMutex"
              },
              {
                "address": "0x100c005c",
                "name": "CreateMutexW"
              },
              {
                "address": "0x100c0060",
                "name": "SetEvent"
              },
              {
                "address": "0x100c0064",
                "name": "CreateEventW"
              },
              {
                "address": "0x100c0068",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x100c006c",
                "name": "ReleaseSemaphore"
              },
              {
                "address": "0x100c0070",
                "name": "CreateSemaphoreExW"
              },
              {
                "address": "0x100c0074",
                "name": "DebugBreak"
              },
              {
                "address": "0x100c0078",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x100c007c",
                "name": "HeapCompact"
              },
              {
                "address": "0x100c0080",
                "name": "TerminateProcess"
              },
              {
                "address": "0x100c0084",
                "name": "HeapReAlloc"
              },
              {
                "address": "0x100c0088",
                "name": "GetCurrentThread"
              },
              {
                "address": "0x100c008c",
                "name": "HeapValidate"
              },
              {
                "address": "0x100c0090",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x100c0094",
                "name": "HeapFree"
              },
              {
                "address": "0x100c0098",
                "name": "FlushFileBuffers"
              },
              {
                "address": "0x100c009c",
                "name": "GetFileType"
              },
              {
                "address": "0x100c00a0",
                "name": "GetFileSize"
              },
              {
                "address": "0x100c00a4",
                "name": "SetEndOfFile"
              },
              {
                "address": "0x100c00a8",
                "name": "SetFilePointer"
              },
              {
                "address": "0x100c00ac",
                "name": "WriteFile"
              },
              {
                "address": "0x100c00b0",
                "name": "ReadFile"
              },
              {
                "address": "0x100c00b4",
                "name": "GetFullPathNameW"
              },
              {
                "address": "0x100c00b8",
                "name": "GetTempFileNameW"
              },
              {
                "address": "0x100c00bc",
                "name": "FindNextFileNameW"
              },
              {
                "address": "0x100c00c0",
                "name": "DeleteFileW"
              },
              {
                "address": "0x100c00c4",
                "name": "SetFileInformationByHandle"
              },
              {
                "address": "0x100c00c8",
                "name": "GetFileInformationByHandle"
              },
              {
                "address": "0x100c00cc",
                "name": "FindFirstFileNameW"
              },
              {
                "address": "0x100c00d0",
                "name": "GetFileInformationByHandleEx"
              },
              {
                "address": "0x100c00d4",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x100c00d8",
                "name": "LoadLibraryExA"
              },
              {
                "address": "0x100c00dc",
                "name": "VirtualProtect"
              },
              {
                "address": "0x100c00e0",
                "name": "GetEnvironmentStringsW"
              },
              {
                "address": "0x100c00e4",
                "name": "FreeLibrary"
              },
              {
                "address": "0x100c00e8",
                "name": "GlobalMemoryStatusEx"
              },
              {
                "address": "0x100c00ec",
                "name": "GetComputerNameW"
              },
              {
                "address": "0x100c00f0",
                "name": "GetProcAddress"
              },
              {
                "address": "0x100c00f4",
                "name": "GetSystemInfo"
              },
              {
                "address": "0x100c00f8",
                "name": "GetSystemDefaultLangID"
              },
              {
                "address": "0x100c00fc",
                "name": "FreeEnvironmentStringsW"
              },
              {
                "address": "0x100c0100",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x100c0104",
                "name": "AcquireSRWLockExclusive"
              },
              {
                "address": "0x100c0108",
                "name": "WakeAllConditionVariable"
              },
              {
                "address": "0x100c010c",
                "name": "SleepConditionVariableSRW"
              },
              {
                "address": "0x100c0110",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x100c0114",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x100c0118",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x100c011c",
                "name": "GetTickCount"
              },
              {
                "address": "0x100c0120",
                "name": "HeapAlloc"
              },
              {
                "address": "0x100c0124",
                "name": "SetErrorMode"
              },
              {
                "address": "0x100c0128",
                "name": "SizeofResource"
              },
              {
                "address": "0x100c012c",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x100c0130",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x100c0134",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x100c0138",
                "name": "GetEnvironmentVariableW"
              },
              {
                "address": "0x100c013c",
                "name": "MultiByteToWideChar"
              },
              {
                "address": "0x100c0140",
                "name": "FormatMessageW"
              },
              {
                "address": "0x100c0144",
                "name": "LockResource"
              },
              {
                "address": "0x100c0148",
                "name": "FindResourceExW"
              },
              {
                "address": "0x100c014c",
                "name": "LoadResource"
              },
              {
                "address": "0x100c0150",
                "name": "LocalFree"
              },
              {
                "address": "0x100c0154",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x100c0158",
                "name": "ExitProcess"
              },
              {
                "address": "0x100c015c",
                "name": "OutputDebugStringA"
              },
              {
                "address": "0x100c0160",
                "name": "LocalFileTimeToFileTime"
              },
              {
                "address": "0x100c0164",
                "name": "GetLocalTime"
              },
              {
                "address": "0x100c0168",
                "name": "SystemTimeToFileTime"
              },
              {
                "address": "0x100c016c",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x100c0170",
                "name": "CreateDirectoryW"
              },
              {
                "address": "0x100c0174",
                "name": "FindFirstFileW"
              },
              {
                "address": "0x100c0178",
                "name": "SetLastError"
              },
              {
                "address": "0x100c017c",
                "name": "FindNextFileW"
              },
              {
                "address": "0x100c0180",
                "name": "DeviceIoControl"
              },
              {
                "address": "0x100c0184",
                "name": "RemoveDirectoryW"
              },
              {
                "address": "0x100c0188",
                "name": "SetFileTime"
              },
              {
                "address": "0x100c018c",
                "name": "GetModuleFileNameW"
              },
              {
                "address": "0x100c0190",
                "name": "GetVersionExW"
              },
              {
                "address": "0x100c0194",
                "name": "GetTempPathW"
              },
              {
                "address": "0x100c0198",
                "name": "FindClose"
              },
              {
                "address": "0x100c019c",
                "name": "LocalAlloc"
              },
              {
                "address": "0x100c01a0",
                "name": "CreateFileW"
              },
              {
                "address": "0x100c01a4",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x100c01a8",
                "name": "GetSystemDirectoryW"
              },
              {
                "address": "0x100c01ac",
                "name": "SetFileAttributesW"
              },
              {
                "address": "0x100c01b0",
                "name": "GetLastError"
              },
              {
                "address": "0x100c01b4",
                "name": "GetFileAttributesExW"
              },
              {
                "address": "0x100c01b8",
                "name": "CloseHandle"
              },
              {
                "address": "0x100c01bc",
                "name": "GetCurrentDirectoryW"
              },
              {
                "address": "0x100c01c0",
                "name": "GetWindowsDirectoryW"
              },
              {
                "address": "0x100c01c4",
                "name": "MoveFileExW"
              },
              {
                "address": "0x100c01c8",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x100c01cc",
                "name": "CopyFileExW"
              },
              {
                "address": "0x100c01d0",
                "name": "GetFileTime"
              },
              {
                "address": "0x100c01d4",
                "name": "GetLogicalDrives"
              },
              {
                "address": "0x100c01d8",
                "name": "ExpandEnvironmentStringsW"
              },
              {
                "address": "0x100c01dc",
                "name": "SetEnvironmentVariableW"
              }
            ]
          },
          "OLE32": {
            "dll": "OLE32.dll",
            "imports": [
              {
                "address": "0x100c01e4",
                "name": "CoCreateInstance"
              },
              {
                "address": "0x100c01e8",
                "name": "CoSetProxyBlanket"
              },
              {
                "address": "0x100c01ec",
                "name": "CoInitializeEx"
              },
              {
                "address": "0x100c01f0",
                "name": "CreateStreamOnHGlobal"
              },
              {
                "address": "0x100c01f4",
                "name": "CoUninitialize"
              }
            ]
          }
        },
        "exported_dll_name": "unbcl.dll",
        "exports": [
          {
            "address": "0x10035050",
            "name": "??0?$Array@E@UnBCL@@IAE@XZ",
            "ordinal": 1
          },
          {
            "address": "0x100354e0",
            "name": "??0?$Array@E@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 2
          },
          {
            "address": "0x10035330",
            "name": "??0?$Array@E@UnBCL@@QAE@HH@Z",
            "ordinal": 3
          },
          {
            "address": "0x100351b0",
            "name": "??0?$Array@E@UnBCL@@QAE@PBU?$ICollection@E@1@@Z",
            "ordinal": 4
          },
          {
            "address": "0x10035fe0",
            "name": "??0?$Array@G@UnBCL@@IAE@XZ",
            "ordinal": 5
          },
          {
            "address": "0x10036470",
            "name": "??0?$Array@G@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 6
          },
          {
            "address": "0x100362c0",
            "name": "??0?$Array@G@UnBCL@@QAE@HH@Z",
            "ordinal": 7
          },
          {
            "address": "0x10036140",
            "name": "??0?$Array@G@UnBCL@@QAE@PBU?$ICollection@G@1@@Z",
            "ordinal": 8
          },
          {
            "address": "0x1003aa10",
            "name": "??0?$Array@H@UnBCL@@IAE@XZ",
            "ordinal": 9
          },
          {
            "address": "0x1003aea0",
            "name": "??0?$Array@H@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 10
          },
          {
            "address": "0x1003acf0",
            "name": "??0?$Array@H@UnBCL@@QAE@HH@Z",
            "ordinal": 11
          },
          {
            "address": "0x1003ab70",
            "name": "??0?$Array@H@UnBCL@@QAE@PBU?$ICollection@H@1@@Z",
            "ordinal": 12
          },
          {
            "address": "0x1003a030",
            "name": "??0?$Array@PAVObject@UnBCL@@@UnBCL@@IAE@XZ",
            "ordinal": 13
          },
          {
            "address": "0x1003a340",
            "name": "??0?$Array@PAVObject@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 14
          },
          {
            "address": "0x1003a210",
            "name": "??0?$Array@PAVObject@UnBCL@@@UnBCL@@QAE@HH@Z",
            "ordinal": 15
          },
          {
            "address": "0x1003a110",
            "name": "??0?$Array@PAVObject@UnBCL@@@UnBCL@@QAE@PBU?$ICollection@PAVObject@UnBCL@@@1@@Z",
            "ordinal": 16
          },
          {
            "address": "0x10036cb0",
            "name": "??0?$Array@PAVString@UnBCL@@@UnBCL@@IAE@XZ",
            "ordinal": 17
          },
          {
            "address": "0x10037140",
            "name": "??0?$Array@PAVString@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 18
          },
          {
            "address": "0x10036f90",
            "name": "??0?$Array@PAVString@UnBCL@@@UnBCL@@QAE@HH@Z",
            "ordinal": 19
          },
          {
            "address": "0x10036e10",
            "name": "??0?$Array@PAVString@UnBCL@@@UnBCL@@QAE@PBU?$ICollection@PAVString@UnBCL@@@1@@Z",
            "ordinal": 20
          },
          {
            "address": "0x100378d0",
            "name": "??0?$ArrayList@G@UnBCL@@AAE@ABV01@@Z",
            "ordinal": 21
          },
          {
            "address": "0x10037a90",
            "name": "??0?$ArrayList@G@UnBCL@@QAE@HH@Z",
            "ordinal": 22
          },
          {
            "address": "0x10037c60",
            "name": "??0?$ArrayList@G@UnBCL@@QAE@PBU?$ICollection@G@1@@Z",
            "ordinal": 23
          },
          {
            "address": "0x10037e40",
            "name": "??0?$ArrayList@G@UnBCL@@QAE@XZ",
            "ordinal": 24
          },
          {
            "address": "0x10032cc0",
            "name": "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@AAE@ABV01@@Z",
            "ordinal": 25
          },
          {
            "address": "0x10032e80",
            "name": "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAE@HH@Z",
            "ordinal": 26
          },
          {
            "address": "0x10033050",
            "name": "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAE@PBU?$ICollection@PAVString@UnBCL@@@1@@Z",
            "ordinal": 27
          },
          {
            "address": "0x10033230",
            "name": "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 28
          },
          {
            "address": "0x10030ab0",
            "name": "??0?$CSimpleStringT@G$0A@@ATL@@QAE@ABV01@@Z",
            "ordinal": 29
          },
          {
            "address": "0x10030ab0",
            "name": "??0?$CSimpleStringT@G$0A@@ATL@@QAE@ABV?$CSimpleStringT@G$00@1@@Z",
            "ordinal": 30
          },
          {
            "address": "0x10030ae0",
            "name": "??0?$CSimpleStringT@G$0A@@ATL@@QAE@PAUIAtlStringMgr@1@@Z",
            "ordinal": 31
          },
          {
            "address": "0x100309c0",
            "name": "??0?$CSimpleStringT@G$0A@@ATL@@QAE@PBGHPAUIAtlStringMgr@1@@Z",
            "ordinal": 32
          },
          {
            "address": "0x10030a40",
            "name": "??0?$CSimpleStringT@G$0A@@ATL@@QAE@PBGPAUIAtlStringMgr@1@@Z",
            "ordinal": 33
          },
          {
            "address": "0x10030c40",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@ABUtagVARIANT@@@Z",
            "ordinal": 34
          },
          {
            "address": "0x10030bc0",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@ABUtagVARIANT@@PAUIAtlStringMgr@1@@Z",
            "ordinal": 35
          },
          {
            "address": "0x1002fff0",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@ABV01@@Z",
            "ordinal": 36
          },
          {
            "address": "0x1002fda0",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@DH@Z",
            "ordinal": 37
          },
          {
            "address": "0x1002fc60",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@GH@Z",
            "ordinal": 38
          },
          {
            "address": "0x10030060",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PAUIAtlStringMgr@1@@Z",
            "ordinal": 39
          },
          {
            "address": "0x1002fef0",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBD@Z",
            "ordinal": 40
          },
          {
            "address": "0x1002fb60",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBDH@Z",
            "ordinal": 41
          },
          {
            "address": "0x1002fae0",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBDHPAUIAtlStringMgr@1@@Z",
            "ordinal": 42
          },
          {
            "address": "0x1002ff40",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBDPAUIAtlStringMgr@1@@Z",
            "ordinal": 43
          },
          {
            "address": "0x1002fe50",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBE@Z",
            "ordinal": 44
          },
          {
            "address": "0x1002fe10",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBEPAUIAtlStringMgr@1@@Z",
            "ordinal": 45
          },
          {
            "address": "0x1002ff90",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBG@Z",
            "ordinal": 46
          },
          {
            "address": "0x1002fc20",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBGH@Z",
            "ordinal": 47
          },
          {
            "address": "0x1002fbe0",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBGHPAUIAtlStringMgr@1@@Z",
            "ordinal": 48
          },
          {
            "address": "0x1002fe90",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBGPAUIAtlStringMgr@1@@Z",
            "ordinal": 49
          },
          {
            "address": "0x10030090",
            "name": "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@XZ",
            "ordinal": 50
          },
          {
            "address": "0x100461e0",
            "name": "??0?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@IAE@XZ",
            "ordinal": 51
          },
          {
            "address": "0x10045d90",
            "name": "??0?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 52
          },
          {
            "address": "0x10050600",
            "name": "??0?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 53
          },
          {
            "address": "0x10050400",
            "name": "??0?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@H@Z",
            "ordinal": 54
          },
          {
            "address": "0x10050240",
            "name": "??0?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@HH@Z",
            "ordinal": 55
          },
          {
            "address": "0x10050000",
            "name": "??0?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@PBU?$IDictionary@PAVString@UnBCL@@PAV12@@1@@Z",
            "ordinal": 56
          },
          {
            "address": "0x10050850",
            "name": "??0?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@XZ",
            "ordinal": 57
          },
          {
            "address": "0x1002d800",
            "name": "??0?$ICollection@E@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 58
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$ICollection@E@UnBCL@@QAE@XZ",
            "ordinal": 59
          },
          {
            "address": "0x1002d800",
            "name": "??0?$ICollection@G@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 60
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$ICollection@G@UnBCL@@QAE@XZ",
            "ordinal": 61
          },
          {
            "address": "0x1002d800",
            "name": "??0?$ICollection@H@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 62
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$ICollection@H@UnBCL@@QAE@XZ",
            "ordinal": 63
          },
          {
            "address": "0x1002d800",
            "name": "??0?$ICollection@PAVObject@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 64
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$ICollection@PAVObject@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 65
          },
          {
            "address": "0x1002d800",
            "name": "??0?$ICollection@PAVString@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 66
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$ICollection@PAVString@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 67
          },
          {
            "address": "0x1002d800",
            "name": "??0?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 68
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 69
          },
          {
            "address": "0x1002d800",
            "name": "??0?$IComparer@PAVString@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 70
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$IComparer@PAVString@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 71
          },
          {
            "address": "0x1002d800",
            "name": "??0?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 72
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@XZ",
            "ordinal": 73
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$IEnumerable@E@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 74
          },
          {
            "address": "0x1002dce0",
            "name": "??0?$IEnumerable@E@UnBCL@@QAE@XZ",
            "ordinal": 75
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$IEnumerable@G@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 76
          },
          {
            "address": "0x1002dce0",
            "name": "??0?$IEnumerable@G@UnBCL@@QAE@XZ",
            "ordinal": 77
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$IEnumerable@H@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 78
          },
          {
            "address": "0x1002dce0",
            "name": "??0?$IEnumerable@H@UnBCL@@QAE@XZ",
            "ordinal": 79
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$IEnumerable@PAVObject@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 80
          },
          {
            "address": "0x1002dce0",
            "name": "??0?$IEnumerable@PAVObject@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 81
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$IEnumerable@PAVString@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 82
          },
          {
            "address": "0x1002dce0",
            "name": "??0?$IEnumerable@PAVString@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 83
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$IEnumerable@PBG@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 84
          },
          {
            "address": "0x1002dce0",
            "name": "??0?$IEnumerable@PBG@UnBCL@@QAE@XZ",
            "ordinal": 85
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 86
          },
          {
            "address": "0x1002dce0",
            "name": "??0?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 87
          },
          {
            "address": "0x1002d800",
            "name": "??0?$IEnumerator@PAVString@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 88
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$IEnumerator@PAVString@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 89
          },
          {
            "address": "0x1002d800",
            "name": "??0?$IEnumerator@PBG@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 90
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$IEnumerator@PBG@UnBCL@@QAE@XZ",
            "ordinal": 91
          },
          {
            "address": "0x1002d800",
            "name": "??0?$IList@E@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 92
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$IList@E@UnBCL@@QAE@XZ",
            "ordinal": 93
          },
          {
            "address": "0x1002d800",
            "name": "??0?$IList@G@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 94
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$IList@G@UnBCL@@QAE@XZ",
            "ordinal": 95
          },
          {
            "address": "0x1002d800",
            "name": "??0?$IList@H@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 96
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$IList@H@UnBCL@@QAE@XZ",
            "ordinal": 97
          },
          {
            "address": "0x1002d800",
            "name": "??0?$IList@PAVObject@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 98
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$IList@PAVObject@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 99
          },
          {
            "address": "0x1002d800",
            "name": "??0?$IList@PAVString@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 100
          },
          {
            "address": "0x1002ca50",
            "name": "??0?$IList@PAVString@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 101
          },
          {
            "address": "0x10032770",
            "name": "??0?$SerializableArrayBase@E@_@UnBCL@@QAE@ABV012@@Z",
            "ordinal": 102
          },
          {
            "address": "0x100327c0",
            "name": "??0?$SerializableArrayBase@E@_@UnBCL@@QAE@XZ",
            "ordinal": 103
          },
          {
            "address": "0x100328f0",
            "name": "??0?$SerializableArrayBase@G@_@UnBCL@@QAE@ABV012@@Z",
            "ordinal": 104
          },
          {
            "address": "0x10032940",
            "name": "??0?$SerializableArrayBase@G@_@UnBCL@@QAE@XZ",
            "ordinal": 105
          },
          {
            "address": "0x10032470",
            "name": "??0?$SerializableArrayBase@H@_@UnBCL@@QAE@ABV012@@Z",
            "ordinal": 106
          },
          {
            "address": "0x100324c0",
            "name": "??0?$SerializableArrayBase@H@_@UnBCL@@QAE@XZ",
            "ordinal": 107
          },
          {
            "address": "0x10032a70",
            "name": "??0?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@QAE@ABV012@@Z",
            "ordinal": 108
          },
          {
            "address": "0x10032ac0",
            "name": "??0?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@QAE@XZ",
            "ordinal": 109
          },
          {
            "address": "0x100320e0",
            "name": "??0?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@QAE@ABV012@@Z",
            "ordinal": 110
          },
          {
            "address": "0x10032140",
            "name": "??0?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@QAE@XZ",
            "ordinal": 111
          },
          {
            "address": "0x10031d20",
            "name": "??0?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@QAE@ABV012@@Z",
            "ordinal": 112
          },
          {
            "address": "0x10031d80",
            "name": "??0?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@QAE@XZ",
            "ordinal": 113
          },
          {
            "address": "0x1003b910",
            "name": "??0?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
            "ordinal": 114
          },
          {
            "address": "0x10032730",
            "name": "??0?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 115
          },
          {
            "address": "0x1003ba90",
            "name": "??0?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
            "ordinal": 116
          },
          {
            "address": "0x100328b0",
            "name": "??0?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 117
          },
          {
            "address": "0x1003b790",
            "name": "??0?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
            "ordinal": 118
          },
          {
            "address": "0x10032430",
            "name": "??0?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 119
          },
          {
            "address": "0x1003bc10",
            "name": "??0?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
            "ordinal": 120
          },
          {
            "address": "0x10032a30",
            "name": "??0?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 121
          },
          {
            "address": "0x10039c70",
            "name": "??0?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
            "ordinal": 122
          },
          {
            "address": "0x10031c80",
            "name": "??0?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 123
          },
          {
            "address": "0x10039f30",
            "name": "??0?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
            "ordinal": 124
          },
          {
            "address": "0x100320a0",
            "name": "??0?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 125
          },
          {
            "address": "0x10051720",
            "name": "??0?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
            "ordinal": 126
          },
          {
            "address": "0x1004dd30",
            "name": "??0?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 127
          },
          {
            "address": "0x1006cad0",
            "name": "??0?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
            "ordinal": 128
          },
          {
            "address": "0x1006bbb0",
            "name": "??0?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 129
          },
          {
            "address": "0x1005a8e0",
            "name": "??0?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@IAE@XZ",
            "ordinal": 130
          },
          {
            "address": "0x100594b0",
            "name": "??0?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 131
          },
          {
            "address": "0x10051ae0",
            "name": "??0?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@IAE@XZ",
            "ordinal": 132
          },
          {
            "address": "0x1004e160",
            "name": "??0?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 133
          },
          {
            "address": "0x10051820",
            "name": "??0?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
            "ordinal": 134
          },
          {
            "address": "0x1004dff0",
            "name": "??0?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 135
          },
          {
            "address": "0x1004dd70",
            "name": "??0?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@QAE@ABV012@@Z",
            "ordinal": 136
          },
          {
            "address": "0x1004ddd0",
            "name": "??0?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@QAE@XZ",
            "ordinal": 137
          },
          {
            "address": "0x1006bbf0",
            "name": "??0?$SerializableStackBase@H@_@UnBCL@@QAE@ABV012@@Z",
            "ordinal": 138
          },
          {
            "address": "0x1006bc50",
            "name": "??0?$SerializableStackBase@H@_@UnBCL@@QAE@XZ",
            "ordinal": 139
          },
          {
            "address": "0x1003bc60",
            "name": "??0?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 140
          },
          {
            "address": "0x1003bc90",
            "name": "??0?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAE@PAV?$Array@E@1@@Z",
            "ordinal": 141
          },
          {
            "address": "0x1003bcc0",
            "name": "??0?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 142
          },
          {
            "address": "0x1003bd10",
            "name": "??0?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 143
          },
          {
            "address": "0x1003bd40",
            "name": "??0?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@PAV?$Array@PAVString@UnBCL@@@1@@Z",
            "ordinal": 144
          },
          {
            "address": "0x1003bd70",
            "name": "??0?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 145
          },
          {
            "address": "0x10039f80",
            "name": "??0?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 146
          },
          {
            "address": "0x10039fb0",
            "name": "??0?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@PAV?$ArrayList@PAVString@UnBCL@@@1@@Z",
            "ordinal": 147
          },
          {
            "address": "0x10039fe0",
            "name": "??0?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 148
          },
          {
            "address": "0x10030f60",
            "name": "??0?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 149
          },
          {
            "address": "0x10030f90",
            "name": "??0?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAE@PAVDecoder@1@@Z",
            "ordinal": 150
          },
          {
            "address": "0x10030fc0",
            "name": "??0?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 151
          },
          {
            "address": "0x10031120",
            "name": "??0?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 152
          },
          {
            "address": "0x10031150",
            "name": "??0?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAE@PAVEncoding@1@@Z",
            "ordinal": 153
          },
          {
            "address": "0x10031180",
            "name": "??0?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 154
          },
          {
            "address": "0x1002d1b0",
            "name": "??0?$SmartPtr@VObject@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 155
          },
          {
            "address": "0x1002d1e0",
            "name": "??0?$SmartPtr@VObject@UnBCL@@@UnBCL@@QAE@PAVObject@1@@Z",
            "ordinal": 156
          },
          {
            "address": "0x1002d210",
            "name": "??0?$SmartPtr@VObject@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 157
          },
          {
            "address": "0x10031280",
            "name": "??0?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 158
          },
          {
            "address": "0x100312b0",
            "name": "??0?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAE@PAVSerializationId@1@@Z",
            "ordinal": 159
          },
          {
            "address": "0x100312e0",
            "name": "??0?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 160
          },
          {
            "address": "0x10031330",
            "name": "??0?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 161
          },
          {
            "address": "0x10031360",
            "name": "??0?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAE@PAVSerializationStream@1@@Z",
            "ordinal": 162
          },
          {
            "address": "0x10031390",
            "name": "??0?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 163
          },
          {
            "address": "0x100311d0",
            "name": "??0?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 164
          },
          {
            "address": "0x10031200",
            "name": "??0?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAE@PAVStream@1@@Z",
            "ordinal": 165
          },
          {
            "address": "0x10031230",
            "name": "??0?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 166
          },
          {
            "address": "0x10036c00",
            "name": "??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 167
          },
          {
            "address": "0x10036c30",
            "name": "??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@PAVString@1@@Z",
            "ordinal": 168
          },
          {
            "address": "0x10036c60",
            "name": "??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 169
          },
          {
            "address": "0x10051870",
            "name": "??0?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 170
          },
          {
            "address": "0x100518a0",
            "name": "??0?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAE@PAVVersion@1@@Z",
            "ordinal": 171
          },
          {
            "address": "0x100518d0",
            "name": "??0?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 172
          },
          {
            "address": "0x1007d070",
            "name": "??0?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 173
          },
          {
            "address": "0x1007d0a0",
            "name": "??0?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAE@PAVXmlNamespaceManager@1@@Z",
            "ordinal": 174
          },
          {
            "address": "0x1007d0d0",
            "name": "??0?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 175
          },
          {
            "address": "0x1006c400",
            "name": "??0?$Stack@H@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 176
          },
          {
            "address": "0x1006c570",
            "name": "??0?$Stack@H@UnBCL@@QAE@XZ",
            "ordinal": 177
          },
          {
            "address": "0x1006bec0",
            "name": "??0?$Stack@PAVObject@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 178
          },
          {
            "address": "0x1006bfb0",
            "name": "??0?$Stack@PAVObject@UnBCL@@@UnBCL@@QAE@XZ",
            "ordinal": 179
          },
          {
            "address": "0x100440f0",
            "name": "??0ASCIIEncoding@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 180
          },
          {
            "address": "0x10044020",
            "name": "??0ASCIIEncoding@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 181
          },
          {
            "address": "0x10044280",
            "name": "??0ASCIIEncoding@UnBCL@@QAE@XZ",
            "ordinal": 182
          },
          {
            "address": "0x1002d070",
            "name": "??0AbandonedMutexException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 183
          },
          {
            "address": "0x1002d070",
            "name": "??0AbandonedMutexException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 184
          },
          {
            "address": "0x1002d130",
            "name": "??0AbandonedMutexException@UnBCL@@QAE@PBG@Z",
            "ordinal": 185
          },
          {
            "address": "0x1002d0f0",
            "name": "??0AbandonedMutexException@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 186
          },
          {
            "address": "0x1002d170",
            "name": "??0AbandonedMutexException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
            "ordinal": 187
          },
          {
            "address": "0x1002d0b0",
            "name": "??0AbandonedMutexException@UnBCL@@QAE@XZ",
            "ordinal": 188
          },
          {
            "address": "0x100313e0",
            "name": "??0ApplicationException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 189
          },
          {
            "address": "0x100313e0",
            "name": "??0ApplicationException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 190
          },
          {
            "address": "0x100314e0",
            "name": "??0ApplicationException@UnBCL@@QAE@PAVException@1@PBG@Z",
            "ordinal": 191
          },
          {
            "address": "0x10031460",
            "name": "??0ApplicationException@UnBCL@@QAE@PAVString@1@@Z",
            "ordinal": 192
          },
          {
            "address": "0x100314a0",
            "name": "??0ApplicationException@UnBCL@@QAE@PBG@Z",
            "ordinal": 193
          },
          {
            "address": "0x10031420",
            "name": "??0ApplicationException@UnBCL@@QAE@XZ",
            "ordinal": 194
          },
          {
            "address": "0x1002cdb0",
            "name": "??0ArgumentException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 195
          },
          {
            "address": "0x1002cdb0",
            "name": "??0ArgumentException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 196
          },
          {
            "address": "0x100315a0",
            "name": "??0ArgumentException@UnBCL@@QAE@PBG@Z",
            "ordinal": 197
          },
          {
            "address": "0x10031560",
            "name": "??0ArgumentException@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 198
          },
          {
            "address": "0x100315e0",
            "name": "??0ArgumentException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
            "ordinal": 199
          },
          {
            "address": "0x10031520",
            "name": "??0ArgumentException@UnBCL@@QAE@XZ",
            "ordinal": 200
          },
          {
            "address": "0x1002ced0",
            "name": "??0ArgumentNullException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 201
          },
          {
            "address": "0x1002ced0",
            "name": "??0ArgumentNullException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 202
          },
          {
            "address": "0x100316a0",
            "name": "??0ArgumentNullException@UnBCL@@QAE@PBG@Z",
            "ordinal": 203
          },
          {
            "address": "0x10031660",
            "name": "??0ArgumentNullException@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 204
          },
          {
            "address": "0x100316e0",
            "name": "??0ArgumentNullException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
            "ordinal": 205
          },
          {
            "address": "0x10031620",
            "name": "??0ArgumentNullException@UnBCL@@QAE@XZ",
            "ordinal": 206
          },
          {
            "address": "0x10031720",
            "name": "??0ArgumentOutOfRangeException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 207
          },
          {
            "address": "0x10031720",
            "name": "??0ArgumentOutOfRangeException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 208
          },
          {
            "address": "0x100317e0",
            "name": "??0ArgumentOutOfRangeException@UnBCL@@QAE@PBG@Z",
            "ordinal": 209
          },
          {
            "address": "0x100317a0",
            "name": "??0ArgumentOutOfRangeException@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 210
          },
          {
            "address": "0x10031820",
            "name": "??0ArgumentOutOfRangeException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
            "ordinal": 211
          },
          {
            "address": "0x10031760",
            "name": "??0ArgumentOutOfRangeException@UnBCL@@QAE@XZ",
            "ordinal": 212
          },
          {
            "address": "0x10031860",
            "name": "??0ArithmeticException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 213
          },
          {
            "address": "0x10031860",
            "name": "??0ArithmeticException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 214
          },
          {
            "address": "0x10031920",
            "name": "??0ArithmeticException@UnBCL@@QAE@PBG@Z",
            "ordinal": 215
          },
          {
            "address": "0x100318e0",
            "name": "??0ArithmeticException@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 216
          },
          {
            "address": "0x10031960",
            "name": "??0ArithmeticException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
            "ordinal": 217
          },
          {
            "address": "0x100318a0",
            "name": "??0ArithmeticException@UnBCL@@QAE@XZ",
            "ordinal": 218
          },
          {
            "address": "0x10044db0",
            "name": "??0BufferedStream@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 219
          },
          {
            "address": "0x100450e0",
            "name": "??0BufferedStream@UnBCL@@QAE@PAVStream@1@K@Z",
            "ordinal": 220
          },
          {
            "address": "0x10031ae0",
            "name": "??0CaseInsensitiveStringComparer@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 221
          },
          {
            "address": "0x10031ae0",
            "name": "??0CaseInsensitiveStringComparer@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 222
          },
          {
            "address": "0x10031a60",
            "name": "??0CaseInsensitiveStringComparer@UnBCL@@QAE@XZ",
            "ordinal": 223
          },
          {
            "address": "0x10045bb0",
            "name": "??0Char@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 224
          },
          {
            "address": "0x10045b70",
            "name": "??0Char@UnBCL@@QAE@G@Z",
            "ordinal": 225
          },
          {
            "address": "0x10045b30",
            "name": "??0Char@UnBCL@@QAE@XZ",
            "ordinal": 226
          },
          {
            "address": "0x1002e3c0",
            "name": "??0ConsoleLogHandler@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 227
          },
          {
            "address": "0x1002e3c0",
            "name": "??0ConsoleLogHandler@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 228
          },
          {
            "address": "0x1002e3b0",
            "name": "??0ConsoleLogHandler@UnBCL@@QAE@XZ",
            "ordinal": 229
          },
          {
            "address": "0x10046e10",
            "name": "??0DateTime@UnBCL@@IAE@_JH@Z",
            "ordinal": 230
          },
          {
            "address": "0x100466c0",
            "name": "??0DateTime@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 231
          },
          {
            "address": "0x10046710",
            "name": "??0DateTime@UnBCL@@QAE@HHHHHHH@Z",
            "ordinal": 232
          },
          {
            "address": "0x10046620",
            "name": "??0DateTime@UnBCL@@QAE@_J@Z",
            "ordinal": 233
          },
          {
            "address": "0x1002d520",
            "name": "??0Decoder@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 234
          },
          {
            "address": "0x1002d520",
            "name": "??0Decoder@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 235
          },
          {
            "address": "0x1002d4f0",
            "name": "??0Decoder@UnBCL@@QAE@XZ",
            "ordinal": 236
          },
          {
            "address": "0x10072d40",
            "name": "??0Delegate@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 237
          },
          {
            "address": "0x10072d40",
            "name": "??0Delegate@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 238
          },
          {
            "address": "0x10072ce0",
            "name": "??0Delegate@UnBCL@@QAE@XZ",
            "ordinal": 239
          },
          {
            "address": "0x10044b30",
            "name": "??0DirectoryInfo@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 240
          },
          {
            "address": "0x10044b30",
            "name": "??0DirectoryInfo@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 241
          },
          {
            "address": "0x10044aa0",
            "name": "??0DirectoryInfo@UnBCL@@QAE@XZ",
            "ordinal": 242
          },
          {
            "address": "0x1004da60",
            "name": "??0Encoding@UnBCL@@IAE@H@Z",
            "ordinal": 243
          },
          {
            "address": "0x1002d680",
            "name": "??0Encoding@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 244
          },
          {
            "address": "0x1002d680",
            "name": "??0Encoding@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 245
          },
          {
            "address": "0x1002dce0",
            "name": "??0Environment@UnBCL@@AAE@XZ",
            "ordinal": 246
          },
          {
            "address": "0x1002cb00",
            "name": "??0Exception@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 247
          },
          {
            "address": "0x10053d70",
            "name": "??0Exception@UnBCL@@QAE@PAV01@PBG@Z",
            "ordinal": 248
          },
          {
            "address": "0x10053c40",
            "name": "??0Exception@UnBCL@@QAE@PBG@Z",
            "ordinal": 249
          },
          {
            "address": "0x10053b90",
            "name": "??0Exception@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 250
          },
          {
            "address": "0x10053cc0",
            "name": "??0Exception@UnBCL@@QAE@PBVString@1@PAV01@@Z",
            "ordinal": 251
          },
          {
            "address": "0x10053b20",
            "name": "??0Exception@UnBCL@@QAE@XZ",
            "ordinal": 252
          },
          {
            "address": "0x10044fb0",
            "name": "??0ExternalException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 253
          },
          {
            "address": "0x10044fb0",
            "name": "??0ExternalException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 254
          },
          {
            "address": "0x100545a0",
            "name": "??0ExternalException@UnBCL@@QAE@PBG@Z",
            "ordinal": 255
          },
          {
            "address": "0x10054620",
            "name": "??0ExternalException@UnBCL@@QAE@PBGPAVException@1@@Z",
            "ordinal": 256
          },
          {
            "address": "0x10054560",
            "name": "??0ExternalException@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 257
          },
          {
            "address": "0x100545e0",
            "name": "??0ExternalException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
            "ordinal": 258
          },
          {
            "address": "0x10054520",
            "name": "??0ExternalException@UnBCL@@QAE@XZ",
            "ordinal": 259
          },
          {
            "address": "0x10044c00",
            "name": "??0FileStream@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 260
          },
          {
            "address": "0x10056290",
            "name": "??0FileStream@UnBCL@@QAE@PAXW4FileAccess@1@@Z",
            "ordinal": 261
          },
          {
            "address": "0x100563e0",
            "name": "??0FileStream@UnBCL@@QAE@PBVString@1@W4FileMode@1@W4FileAccess@1@W4FileShare@1@K@Z",
            "ordinal": 262
          },
          {
            "address": "0x100558e0",
            "name": "??0FileSystemEnumerator@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 263
          },
          {
            "address": "0x10055b10",
            "name": "??0FileSystemEnumerator@UnBCL@@QAE@PBG0@Z",
            "ordinal": 264
          },
          {
            "address": "0x100572c0",
            "name": "??0FormatException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 265
          },
          {
            "address": "0x100572c0",
            "name": "??0FormatException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 266
          },
          {
            "address": "0x10057340",
            "name": "??0FormatException@UnBCL@@QAE@PAVString@1@@Z",
            "ordinal": 267
          },
          {
            "address": "0x100573c0",
            "name": "??0FormatException@UnBCL@@QAE@PAVString@1@PAVException@1@@Z",
            "ordinal": 268
          },
          {
            "address": "0x10057380",
            "name": "??0FormatException@UnBCL@@QAE@PBG@Z",
            "ordinal": 269
          },
          {
            "address": "0x10057300",
            "name": "??0FormatException@UnBCL@@QAE@XZ",
            "ordinal": 270
          },
          {
            "address": "0x1002e2a0",
            "name": "??0HeapMemoryManager@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 271
          },
          {
            "address": "0x10057400",
            "name": "??0HeapMemoryManager@UnBCL@@QAE@XZ",
            "ordinal": 272
          },
          {
            "address": "0x1002d800",
            "name": "??0IDisposable@UnBCL@@QAE@$$QAU01@@Z",
            "ordinal": 273
          },
          {
            "address": "0x1002d800",
            "name": "??0IDisposable@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 274
          },
          {
            "address": "0x1002ca50",
            "name": "??0IDisposable@UnBCL@@QAE@XZ",
            "ordinal": 275
          },
          {
            "address": "0x1002ca50",
            "name": "??0IInstanceFactory@UnBCL@@QAE@$$QAU01@@Z",
            "ordinal": 276
          },
          {
            "address": "0x1002ca50",
            "name": "??0IInstanceFactory@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 277
          },
          {
            "address": "0x1002dce0",
            "name": "??0IInstanceFactory@UnBCL@@QAE@XZ",
            "ordinal": 278
          },
          {
            "address": "0x1002d800",
            "name": "??0IPoolable@UnBCL@@QAE@$$QAU01@@Z",
            "ordinal": 279
          },
          {
            "address": "0x1002d800",
            "name": "??0IPoolable@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 280
          },
          {
            "address": "0x1002ca50",
            "name": "??0IPoolable@UnBCL@@QAE@XZ",
            "ordinal": 281
          },
          {
            "address": "0x1002d800",
            "name": "??0ISerializable@UnBCL@@QAE@$$QAU01@@Z",
            "ordinal": 282
          },
          {
            "address": "0x1002d800",
            "name": "??0ISerializable@UnBCL@@QAE@ABU01@@Z",
            "ordinal": 283
          },
          {
            "address": "0x1002ca50",
            "name": "??0ISerializable@UnBCL@@QAE@XZ",
            "ordinal": 284
          },
          {
            "address": "0x100577d0",
            "name": "??0IndexOutOfRangeException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 285
          },
          {
            "address": "0x100577d0",
            "name": "??0IndexOutOfRangeException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 286
          },
          {
            "address": "0x10057850",
            "name": "??0IndexOutOfRangeException@UnBCL@@QAE@PAVString@1@@Z",
            "ordinal": 287
          },
          {
            "address": "0x100578d0",
            "name": "??0IndexOutOfRangeException@UnBCL@@QAE@PAVString@1@PAVException@1@@Z",
            "ordinal": 288
          },
          {
            "address": "0x10057890",
            "name": "??0IndexOutOfRangeException@UnBCL@@QAE@PBG@Z",
            "ordinal": 289
          },
          {
            "address": "0x10057810",
            "name": "??0IndexOutOfRangeException@UnBCL@@QAE@XZ",
            "ordinal": 290
          },
          {
            "address": "0x1002cfa0",
            "name": "??0InvalidCastException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 291
          },
          {
            "address": "0x1002cfa0",
            "name": "??0InvalidCastException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 292
          },
          {
            "address": "0x10057a40",
            "name": "??0InvalidCastException@UnBCL@@QAE@PAVString@1@@Z",
            "ordinal": 293
          },
          {
            "address": "0x10057ac0",
            "name": "??0InvalidCastException@UnBCL@@QAE@PAVString@1@PAVException@1@@Z",
            "ordinal": 294
          },
          {
            "address": "0x10057a80",
            "name": "??0InvalidCastException@UnBCL@@QAE@PBG@Z",
            "ordinal": 295
          },
          {
            "address": "0x10057a00",
            "name": "??0InvalidCastException@UnBCL@@QAE@XZ",
            "ordinal": 296
          },
          {
            "address": "0x10031a00",
            "name": "??0InvalidOperationException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 297
          },
          {
            "address": "0x10031a00",
            "name": "??0InvalidOperationException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 298
          },
          {
            "address": "0x10057b80",
            "name": "??0InvalidOperationException@UnBCL@@QAE@PBG@Z",
            "ordinal": 299
          },
          {
            "address": "0x10057b40",
            "name": "??0InvalidOperationException@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 300
          },
          {
            "address": "0x10057bc0",
            "name": "??0InvalidOperationException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
            "ordinal": 301
          },
          {
            "address": "0x10057b00",
            "name": "??0InvalidOperationException@UnBCL@@QAE@XZ",
            "ordinal": 302
          },
          {
            "address": "0x1002daf0",
            "name": "??0MemoryStream@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 303
          },
          {
            "address": "0x10057d60",
            "name": "??0MemoryStream@UnBCL@@QAE@PAV?$Array@E@1@HH@Z",
            "ordinal": 304
          },
          {
            "address": "0x10057c90",
            "name": "??0MemoryStream@UnBCL@@QAE@XZ",
            "ordinal": 305
          },
          {
            "address": "0x100591c0",
            "name": "??0Monitor@UnBCL@@AAE@XZ",
            "ordinal": 306
          },
          {
            "address": "0x10058be0",
            "name": "??0Monitor@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 307
          },
          {
            "address": "0x10059980",
            "name": "??0MultiSz@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 308
          },
          {
            "address": "0x10059800",
            "name": "??0MultiSz@UnBCL@@QAE@PBEIPAK@Z",
            "ordinal": 309
          },
          {
            "address": "0x100596c0",
            "name": "??0MultiSz@UnBCL@@QAE@PBG@Z",
            "ordinal": 310
          },
          {
            "address": "0x100595f0",
            "name": "??0MultiSz@UnBCL@@QAE@XZ",
            "ordinal": 311
          },
          {
            "address": "0x1002df70",
            "name": "??0MutableString@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 312
          },
          {
            "address": "0x1002df70",
            "name": "??0MutableString@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 313
          },
          {
            "address": "0x1002df70",
            "name": "??0MutableString@UnBCL@@QAE@ABVString@1@@Z",
            "ordinal": 314
          },
          {
            "address": "0x1002e030",
            "name": "??0MutableString@UnBCL@@QAE@GH@Z",
            "ordinal": 315
          },
          {
            "address": "0x1002dfb0",
            "name": "??0MutableString@UnBCL@@QAE@PBG@Z",
            "ordinal": 316
          },
          {
            "address": "0x1002dff0",
            "name": "??0MutableString@UnBCL@@QAE@PBGHH@Z",
            "ordinal": 317
          },
          {
            "address": "0x1002df70",
            "name": "??0MutableString@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 318
          },
          {
            "address": "0x1002df30",
            "name": "??0MutableString@UnBCL@@QAE@XZ",
            "ordinal": 319
          },
          {
            "address": "0x1005de50",
            "name": "??0Mutex@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 320
          },
          {
            "address": "0x1005dd80",
            "name": "??0Mutex@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 321
          },
          {
            "address": "0x1005e000",
            "name": "??0Mutex@UnBCL@@QAE@XZ",
            "ordinal": 322
          },
          {
            "address": "0x100322d0",
            "name": "??0NotSupportedException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 323
          },
          {
            "address": "0x100322d0",
            "name": "??0NotSupportedException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 324
          },
          {
            "address": "0x1005e1f0",
            "name": "??0NotSupportedException@UnBCL@@QAE@PBG@Z",
            "ordinal": 325
          },
          {
            "address": "0x1005e1b0",
            "name": "??0NotSupportedException@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 326
          },
          {
            "address": "0x1005e230",
            "name": "??0NotSupportedException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
            "ordinal": 327
          },
          {
            "address": "0x1005e170",
            "name": "??0NotSupportedException@UnBCL@@QAE@XZ",
            "ordinal": 328
          },
          {
            "address": "0x1005e3a0",
            "name": "??0Object@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 329
          },
          {
            "address": "0x1005e370",
            "name": "??0Object@UnBCL@@QAE@XZ",
            "ordinal": 330
          },
          {
            "address": "0x10044a20",
            "name": "??0ObjectDisposedException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 331
          },
          {
            "address": "0x10044a20",
            "name": "??0ObjectDisposedException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 332
          },
          {
            "address": "0x1005e9a0",
            "name": "??0ObjectDisposedException@UnBCL@@QAE@PBG@Z",
            "ordinal": 333
          },
          {
            "address": "0x1005e960",
            "name": "??0ObjectDisposedException@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 334
          },
          {
            "address": "0x1005e9e0",
            "name": "??0ObjectDisposedException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
            "ordinal": 335
          },
          {
            "address": "0x1005e920",
            "name": "??0ObjectDisposedException@UnBCL@@QAE@XZ",
            "ordinal": 336
          },
          {
            "address": "0x1005eaa0",
            "name": "??0OperatingSystem@UnBCL@@AAE@XZ",
            "ordinal": 337
          },
          {
            "address": "0x1005eb60",
            "name": "??0OperatingSystem@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 338
          },
          {
            "address": "0x1005ecd0",
            "name": "??0OperatingSystem@UnBCL@@QAE@W4PlatformID@1@KPAVVersion@1@@Z",
            "ordinal": 339
          },
          {
            "address": "0x1005edd0",
            "name": "??0OperatingSystem@UnBCL@@QAE@W4PlatformID@1@KW4InstallationType@1@PAVVersion@1@@Z",
            "ordinal": 340
          },
          {
            "address": "0x1005ec50",
            "name": "??0OperatingSystem@UnBCL@@QAE@W4PlatformID@1@PAVVersion@1@@Z",
            "ordinal": 341
          },
          {
            "address": "0x1005ed50",
            "name": "??0OperatingSystem@UnBCL@@QAE@W4PlatformID@1@W4InstallationType@1@PAVVersion@1@@Z",
            "ordinal": 342
          },
          {
            "address": "0x10054670",
            "name": "??0OutOfMemoryException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 343
          },
          {
            "address": "0x10054670",
            "name": "??0OutOfMemoryException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 344
          },
          {
            "address": "0x1005f280",
            "name": "??0OutOfMemoryException@UnBCL@@QAE@PAVString@1@@Z",
            "ordinal": 345
          },
          {
            "address": "0x1005f300",
            "name": "??0OutOfMemoryException@UnBCL@@QAE@PAVString@1@PAVException@1@@Z",
            "ordinal": 346
          },
          {
            "address": "0x1005f2c0",
            "name": "??0OutOfMemoryException@UnBCL@@QAE@PBG@Z",
            "ordinal": 347
          },
          {
            "address": "0x1005f240",
            "name": "??0OutOfMemoryException@UnBCL@@QAE@XZ",
            "ordinal": 348
          },
          {
            "address": "0x10044a60",
            "name": "??0OverflowException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 349
          },
          {
            "address": "0x10044a60",
            "name": "??0OverflowException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 350
          },
          {
            "address": "0x1005f3c0",
            "name": "??0OverflowException@UnBCL@@QAE@PBG@Z",
            "ordinal": 351
          },
          {
            "address": "0x1005f380",
            "name": "??0OverflowException@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 352
          },
          {
            "address": "0x1005f400",
            "name": "??0OverflowException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
            "ordinal": 353
          },
          {
            "address": "0x1005f340",
            "name": "??0OverflowException@UnBCL@@QAE@XZ",
            "ordinal": 354
          },
          {
            "address": "0x100472c0",
            "name": "??0PathTooLongException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 355
          },
          {
            "address": "0x100472c0",
            "name": "??0PathTooLongException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 356
          },
          {
            "address": "0x10061530",
            "name": "??0PathTooLongException@UnBCL@@QAE@PBG@Z",
            "ordinal": 357
          },
          {
            "address": "0x100614f0",
            "name": "??0PathTooLongException@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 358
          },
          {
            "address": "0x100614b0",
            "name": "??0PathTooLongException@UnBCL@@QAE@XZ",
            "ordinal": 359
          },
          {
            "address": "0x10061c80",
            "name": "??0Process@UnBCL@@IAE@PAX0@Z",
            "ordinal": 360
          },
          {
            "address": "0x10061710",
            "name": "??0Process@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 361
          },
          {
            "address": "0x100615e0",
            "name": "??0ProcessStartInfo@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 362
          },
          {
            "address": "0x100615e0",
            "name": "??0ProcessStartInfo@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 363
          },
          {
            "address": "0x10061e60",
            "name": "??0ProcessStartInfo@UnBCL@@QAE@PBVString@1@0@Z",
            "ordinal": 364
          },
          {
            "address": "0x10061dc0",
            "name": "??0ProcessStartInfo@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 365
          },
          {
            "address": "0x10061fe0",
            "name": "??0RegHandle@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 366
          },
          {
            "address": "0x10062140",
            "name": "??0RegHandle@UnBCL@@QAE@XZ",
            "ordinal": 367
          },
          {
            "address": "0x10064b30",
            "name": "??0RegSubkeyEnumerator@UnBCL@@QAE@AAVRegHandle@1@@Z",
            "ordinal": 368
          },
          {
            "address": "0x10064990",
            "name": "??0RegSubkeyEnumerator@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 369
          },
          {
            "address": "0x10062720",
            "name": "??0Registry@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 370
          },
          {
            "address": "0x10062720",
            "name": "??0Registry@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 371
          },
          {
            "address": "0x100626c0",
            "name": "??0Registry@UnBCL@@QAE@XZ",
            "ordinal": 372
          },
          {
            "address": "0x10062510",
            "name": "??0RegistryKey@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 373
          },
          {
            "address": "0x100629d0",
            "name": "??0RegistryKey@UnBCL@@QAE@PAUHKEY__@@H@Z",
            "ordinal": 374
          },
          {
            "address": "0x10064fc0",
            "name": "??0SEHException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 375
          },
          {
            "address": "0x10064fc0",
            "name": "??0SEHException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 376
          },
          {
            "address": "0x10065140",
            "name": "??0SEHException@UnBCL@@QAE@I@Z",
            "ordinal": 377
          },
          {
            "address": "0x1005e8c0",
            "name": "??0ScopedObjectLock@UnBCL@@QAE@PAVSyncObject@1@@Z",
            "ordinal": 378
          },
          {
            "address": "0x10062990",
            "name": "??0SecurityException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 379
          },
          {
            "address": "0x10062990",
            "name": "??0SecurityException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 380
          },
          {
            "address": "0x10064f00",
            "name": "??0SecurityException@UnBCL@@QAE@PAVString@1@@Z",
            "ordinal": 381
          },
          {
            "address": "0x10064f80",
            "name": "??0SecurityException@UnBCL@@QAE@PAVString@1@PAVException@1@@Z",
            "ordinal": 382
          },
          {
            "address": "0x10064f40",
            "name": "??0SecurityException@UnBCL@@QAE@PBG@Z",
            "ordinal": 383
          },
          {
            "address": "0x10064ec0",
            "name": "??0SecurityException@UnBCL@@QAE@XZ",
            "ordinal": 384
          },
          {
            "address": "0x10065280",
            "name": "??0SerializationException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 385
          },
          {
            "address": "0x10065280",
            "name": "??0SerializationException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 386
          },
          {
            "address": "0x10065340",
            "name": "??0SerializationException@UnBCL@@QAE@PBG@Z",
            "ordinal": 387
          },
          {
            "address": "0x10065300",
            "name": "??0SerializationException@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 388
          },
          {
            "address": "0x100652c0",
            "name": "??0SerializationException@UnBCL@@QAE@XZ",
            "ordinal": 389
          },
          {
            "address": "0x1002dcf0",
            "name": "??0SerializationId@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 390
          },
          {
            "address": "0x10067080",
            "name": "??0SerializationId@UnBCL@@QAE@PAVString@1@H@Z",
            "ordinal": 391
          },
          {
            "address": "0x10067030",
            "name": "??0SerializationStream@UnBCL@@AAE@ABV01@@Z",
            "ordinal": 392
          },
          {
            "address": "0x10065400",
            "name": "??0SerializationStream@UnBCL@@QAE@PAVStream@1@W4Mode@01@PAVObject@1@@Z",
            "ordinal": 393
          },
          {
            "address": "0x1002d940",
            "name": "??0Stream@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 394
          },
          {
            "address": "0x1002d940",
            "name": "??0Stream@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 395
          },
          {
            "address": "0x1002d8f0",
            "name": "??0Stream@UnBCL@@QAE@XZ",
            "ordinal": 396
          },
          {
            "address": "0x1002d810",
            "name": "??0StreamCounter@UnBCL@@QAE@XZ",
            "ordinal": 397
          },
          {
            "address": "0x1006cef0",
            "name": "??0StreamReader@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 398
          },
          {
            "address": "0x1006d120",
            "name": "??0StreamReader@UnBCL@@QAE@PAVStream@1@PAVEncoding@1@@Z",
            "ordinal": 399
          },
          {
            "address": "0x1006d280",
            "name": "??0StreamReader@UnBCL@@QAE@PBVString@1@PAVEncoding@1@@Z",
            "ordinal": 400
          },
          {
            "address": "0x1006db40",
            "name": "??0StreamWriter@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 401
          },
          {
            "address": "0x1006dd60",
            "name": "??0StreamWriter@UnBCL@@QAE@PAVStream@1@H@Z",
            "ordinal": 402
          },
          {
            "address": "0x1006de70",
            "name": "??0StreamWriter@UnBCL@@QAE@PAVStream@1@PAVEncoding@1@HHH@Z",
            "ordinal": 403
          },
          {
            "address": "0x1006df90",
            "name": "??0StreamWriter@UnBCL@@QAE@PBVString@1@HPAVEncoding@1@HH@Z",
            "ordinal": 404
          },
          {
            "address": "0x1006e520",
            "name": "??0String@UnBCL@@QAE@AAVSerializationStream@1@@Z",
            "ordinal": 405
          },
          {
            "address": "0x1006e570",
            "name": "??0String@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 406
          },
          {
            "address": "0x1006e730",
            "name": "??0String@UnBCL@@QAE@GH@Z",
            "ordinal": 407
          },
          {
            "address": "0x1006e5c0",
            "name": "??0String@UnBCL@@QAE@PBG@Z",
            "ordinal": 408
          },
          {
            "address": "0x1006e610",
            "name": "??0String@UnBCL@@QAE@PBGHH@Z",
            "ordinal": 409
          },
          {
            "address": "0x1006e570",
            "name": "??0String@UnBCL@@QAE@PBV01@@Z",
            "ordinal": 410
          },
          {
            "address": "0x1006e4d0",
            "name": "??0String@UnBCL@@QAE@XZ",
            "ordinal": 411
          },
          {
            "address": "0x1004dc10",
            "name": "??0StringBuilder@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 412
          },
          {
            "address": "0x10071b50",
            "name": "??0StringBuilder@UnBCL@@QAE@H@Z",
            "ordinal": 413
          },
          {
            "address": "0x10071c10",
            "name": "??0StringBuilder@UnBCL@@QAE@PBG@Z",
            "ordinal": 414
          },
          {
            "address": "0x10071ce0",
            "name": "??0StringBuilder@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 415
          },
          {
            "address": "0x10071ae0",
            "name": "??0StringBuilder@UnBCL@@QAE@XZ",
            "ordinal": 416
          },
          {
            "address": "0x10072600",
            "name": "??0StringPtr@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 417
          },
          {
            "address": "0x100725a0",
            "name": "??0StringPtr@UnBCL@@QAE@PAVString@1@@Z",
            "ordinal": 418
          },
          {
            "address": "0x10072520",
            "name": "??0StringPtr@UnBCL@@QAE@PBG@Z",
            "ordinal": 419
          },
          {
            "address": "0x10072670",
            "name": "??0StringPtr@UnBCL@@QAE@V?$SmartPtr@VString@UnBCL@@@1@@Z",
            "ordinal": 420
          },
          {
            "address": "0x100724c0",
            "name": "??0StringPtr@UnBCL@@QAE@XZ",
            "ordinal": 421
          },
          {
            "address": "0x1005e790",
            "name": "??0SyncObject@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 422
          },
          {
            "address": "0x1005e740",
            "name": "??0SyncObject@UnBCL@@QAE@XZ",
            "ordinal": 423
          },
          {
            "address": "0x1002cc70",
            "name": "??0SystemException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 424
          },
          {
            "address": "0x1002cc70",
            "name": "??0SystemException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 425
          },
          {
            "address": "0x10072830",
            "name": "??0SystemException@UnBCL@@QAE@PBG@Z",
            "ordinal": 426
          },
          {
            "address": "0x100728b0",
            "name": "??0SystemException@UnBCL@@QAE@PBGPAVException@1@@Z",
            "ordinal": 427
          },
          {
            "address": "0x100727f0",
            "name": "??0SystemException@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 428
          },
          {
            "address": "0x10072870",
            "name": "??0SystemException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
            "ordinal": 429
          },
          {
            "address": "0x100727b0",
            "name": "??0SystemException@UnBCL@@QAE@XZ",
            "ordinal": 430
          },
          {
            "address": "0x1004e540",
            "name": "??0SystemInfo@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 431
          },
          {
            "address": "0x1004e540",
            "name": "??0SystemInfo@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 432
          },
          {
            "address": "0x1004e3e0",
            "name": "??0SystemInfo@UnBCL@@QAE@XZ",
            "ordinal": 433
          },
          {
            "address": "0x1006ce10",
            "name": "??0TextReader@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 434
          },
          {
            "address": "0x1006ce10",
            "name": "??0TextReader@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 435
          },
          {
            "address": "0x1006cde0",
            "name": "??0TextReader@UnBCL@@QAE@XZ",
            "ordinal": 436
          },
          {
            "address": "0x10072c30",
            "name": "??0TextWriter@UnBCL@@IAE@XZ",
            "ordinal": 437
          },
          {
            "address": "0x1006d9e0",
            "name": "??0TextWriter@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 438
          },
          {
            "address": "0x1006d970",
            "name": "??0TextWriter@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 439
          },
          {
            "address": "0x100731c0",
            "name": "??0Thread@UnBCL@@AAE@PAX@Z",
            "ordinal": 440
          },
          {
            "address": "0x10072da0",
            "name": "??0Thread@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 441
          },
          {
            "address": "0x10072f20",
            "name": "??0Thread@UnBCL@@QAE@PAVThreadStartDelegate@1@@Z",
            "ordinal": 442
          },
          {
            "address": "0x10072ca0",
            "name": "??0ThreadStateException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 443
          },
          {
            "address": "0x10072ca0",
            "name": "??0ThreadStateException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 444
          },
          {
            "address": "0x100733f0",
            "name": "??0ThreadStateException@UnBCL@@QAE@PBG@Z",
            "ordinal": 445
          },
          {
            "address": "0x100733b0",
            "name": "??0ThreadStateException@UnBCL@@QAE@PBVString@1@@Z",
            "ordinal": 446
          },
          {
            "address": "0x10073430",
            "name": "??0ThreadStateException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
            "ordinal": 447
          },
          {
            "address": "0x10073370",
            "name": "??0ThreadStateException@UnBCL@@QAE@XZ",
            "ordinal": 448
          },
          {
            "address": "0x10073470",
            "name": "??0TimeSpan@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 449
          },
          {
            "address": "0x10073500",
            "name": "??0TimeSpan@UnBCL@@QAE@HHH@Z",
            "ordinal": 450
          },
          {
            "address": "0x10073560",
            "name": "??0TimeSpan@UnBCL@@QAE@HHHH@Z",
            "ordinal": 451
          },
          {
            "address": "0x100735d0",
            "name": "??0TimeSpan@UnBCL@@QAE@HHHHH@Z",
            "ordinal": 452
          },
          {
            "address": "0x100734c0",
            "name": "??0TimeSpan@UnBCL@@QAE@_J@Z",
            "ordinal": 453
          },
          {
            "address": "0x10073d00",
            "name": "??0Type@UnBCL@@IAE@PAVString@1@@Z",
            "ordinal": 454
          },
          {
            "address": "0x10053a60",
            "name": "??0Type@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 455
          },
          {
            "address": "0x1004d550",
            "name": "??0UnicodeEncoding@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 456
          },
          {
            "address": "0x1004d480",
            "name": "??0UnicodeEncoding@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 457
          },
          {
            "address": "0x10073d50",
            "name": "??0UnicodeEncoding@UnBCL@@QAE@XZ",
            "ordinal": 458
          },
          {
            "address": "0x10074630",
            "name": "??0Version@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 459
          },
          {
            "address": "0x10074b70",
            "name": "??0Version@UnBCL@@QAE@HH@Z",
            "ordinal": 460
          },
          {
            "address": "0x10074c80",
            "name": "??0Version@UnBCL@@QAE@HHH@Z",
            "ordinal": 461
          },
          {
            "address": "0x10074da0",
            "name": "??0Version@UnBCL@@QAE@HHHPAVString@1@@Z",
            "ordinal": 462
          },
          {
            "address": "0x10074730",
            "name": "??0Version@UnBCL@@QAE@PBG@Z",
            "ordinal": 463
          },
          {
            "address": "0x10074570",
            "name": "??0Version@UnBCL@@QAE@XZ",
            "ordinal": 464
          },
          {
            "address": "0x10075460",
            "name": "??0WaitHandle@UnBCL@@IAE@XZ",
            "ordinal": 465
          },
          {
            "address": "0x1005dc30",
            "name": "??0WaitHandle@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 466
          },
          {
            "address": "0x10044ff0",
            "name": "??0Win32Exception@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 467
          },
          {
            "address": "0x10044ff0",
            "name": "??0Win32Exception@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 468
          },
          {
            "address": "0x100757a0",
            "name": "??0Win32Exception@UnBCL@@QAE@K@Z",
            "ordinal": 469
          },
          {
            "address": "0x10075840",
            "name": "??0Win32Exception@UnBCL@@QAE@KPBG@Z",
            "ordinal": 470
          },
          {
            "address": "0x10075af0",
            "name": "??0Win32Exception@UnBCL@@QAE@KPBGPAVException@1@@Z",
            "ordinal": 471
          },
          {
            "address": "0x10075990",
            "name": "??0Win32Exception@UnBCL@@QAE@KPBVString@1@@Z",
            "ordinal": 472
          },
          {
            "address": "0x10075a40",
            "name": "??0Win32Exception@UnBCL@@QAE@KPBVString@1@PAVException@1@@Z",
            "ordinal": 473
          },
          {
            "address": "0x100758e0",
            "name": "??0Win32Exception@UnBCL@@QAE@PBG@Z",
            "ordinal": 474
          },
          {
            "address": "0x10075700",
            "name": "??0Win32Exception@UnBCL@@QAE@XZ",
            "ordinal": 475
          },
          {
            "address": "0x10075d90",
            "name": "??0XPathException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 476
          },
          {
            "address": "0x10075d90",
            "name": "??0XPathException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 477
          },
          {
            "address": "0x1007f440",
            "name": "??0XPathException@UnBCL@@QAE@PAVString@1@PAVException@1@J@Z",
            "ordinal": 478
          },
          {
            "address": "0x10079d40",
            "name": "??0XmlAttribute@UnBCL@@IAE@XZ",
            "ordinal": 479
          },
          {
            "address": "0x10076690",
            "name": "??0XmlAttribute@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 480
          },
          {
            "address": "0x10076690",
            "name": "??0XmlAttribute@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 481
          },
          {
            "address": "0x10079d80",
            "name": "??0XmlAttribute@UnBCL@@QAE@PAUIXMLDOMNode@@@Z",
            "ordinal": 482
          },
          {
            "address": "0x10076160",
            "name": "??0XmlAttribute@XmlLite@UnBCL@@QAE@$$QAV012@@Z",
            "ordinal": 483
          },
          {
            "address": "0x10076160",
            "name": "??0XmlAttribute@XmlLite@UnBCL@@QAE@ABV012@@Z",
            "ordinal": 484
          },
          {
            "address": "0x100760c0",
            "name": "??0XmlAttribute@XmlLite@UnBCL@@QAE@PBG000@Z",
            "ordinal": 485
          },
          {
            "address": "0x10079dc0",
            "name": "??0XmlAttributeCollection@UnBCL@@IAE@XZ",
            "ordinal": 486
          },
          {
            "address": "0x10076760",
            "name": "??0XmlAttributeCollection@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 487
          },
          {
            "address": "0x10079e00",
            "name": "??0XmlAttributeCollection@UnBCL@@QAE@PAUIXMLDOMNamedNodeMap@@@Z",
            "ordinal": 488
          },
          {
            "address": "0x10076340",
            "name": "??0XmlAttributeCollection@XmlLite@UnBCL@@QAE@ABV012@@Z",
            "ordinal": 489
          },
          {
            "address": "0x10076250",
            "name": "??0XmlAttributeCollection@XmlLite@UnBCL@@QAE@XZ",
            "ordinal": 490
          },
          {
            "address": "0x10076820",
            "name": "??0XmlDocument@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 491
          },
          {
            "address": "0x1007a0c0",
            "name": "??0XmlDocument@UnBCL@@QAE@PAUIXMLDOMDocument3@@@Z",
            "ordinal": 492
          },
          {
            "address": "0x1007a160",
            "name": "??0XmlDocument@UnBCL@@QAE@XZ",
            "ordinal": 493
          },
          {
            "address": "0x10076400",
            "name": "??0XmlDocument@XmlLite@UnBCL@@QAE@ABV012@@Z",
            "ordinal": 494
          },
          {
            "address": "0x10077bc0",
            "name": "??0XmlDocument@XmlLite@UnBCL@@QAE@XZ",
            "ordinal": 495
          },
          {
            "address": "0x10075c80",
            "name": "??0XmlException@UnBCL@@QAE@$$QAV01@@Z",
            "ordinal": 496
          },
          {
            "address": "0x10075c80",
            "name": "??0XmlException@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 497
          },
          {
            "address": "0x1007f380",
            "name": "??0XmlException@UnBCL@@QAE@PAVString@1@PAVException@1@HHJ@Z",
            "ordinal": 498
          },
          {
            "address": "0x10076920",
            "name": "??0XmlNamespaceManager@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 499
          },
          {
            "address": "0x1007ad40",
            "name": "??0XmlNamespaceManager@UnBCL@@QAE@XZ",
            "ordinal": 500
          },
          {
            "address": "0x10078a60",
            "name": "??0XmlNode@UnBCL@@IAE@PAUIXMLDOMNode@@@Z",
            "ordinal": 501
          },
          {
            "address": "0x10078a20",
            "name": "??0XmlNode@UnBCL@@IAE@XZ",
            "ordinal": 502
          },
          {
            "address": "0x100764c0",
            "name": "??0XmlNode@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 503
          },
          {
            "address": "0x10075dd0",
            "name": "??0XmlNode@XmlLite@UnBCL@@QAE@ABV012@@Z",
            "ordinal": 504
          },
          {
            "address": "0x10076c90",
            "name": "??0XmlNode@XmlLite@UnBCL@@QAE@W4XmlNodeType@2@PBG111@Z",
            "ordinal": 505
          },
          {
            "address": "0x10079bc0",
            "name": "??0XmlNodeList@UnBCL@@IAE@XZ",
            "ordinal": 506
          },
          {
            "address": "0x10076580",
            "name": "??0XmlNodeList@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 507
          },
          {
            "address": "0x10079c00",
            "name": "??0XmlNodeList@UnBCL@@QAE@PAUIXMLDOMNodeList@@@Z",
            "ordinal": 508
          },
          {
            "address": "0x10076000",
            "name": "??0XmlNodeList@XmlLite@UnBCL@@QAE@ABV012@@Z",
            "ordinal": 509
          },
          {
            "address": "0x10075f10",
            "name": "??0XmlNodeList@XmlLite@UnBCL@@QAE@XZ",
            "ordinal": 510
          },
          {
            "address": "0x10076a70",
            "name": "??0XmlSchemaSet@UnBCL@@QAE@ABV01@@Z",
            "ordinal": 511
          },
          {
            "address": "0x1007af60",
            "name": "??0XmlSchemaSet@UnBCL@@QAE@XZ",
            "ordinal": 512
          },
          {
            "address": "0x10035680",
            "name": "??1?$Array@E@UnBCL@@UAE@XZ",
            "ordinal": 513
          },
          {
            "address": "0x10036610",
            "name": "??1?$Array@G@UnBCL@@UAE@XZ",
            "ordinal": 514
          },
          {
            "address": "0x1003b040",
            "name": "??1?$Array@H@UnBCL@@UAE@XZ",
            "ordinal": 515
          },
          {
            "address": "0x1003a460",
            "name": "??1?$Array@PAVObject@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 516
          },
          {
            "address": "0x100372e0",
            "name": "??1?$Array@PAVString@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 517
          },
          {
            "address": "0x10037fb0",
            "name": "??1?$ArrayList@G@UnBCL@@UAE@XZ",
            "ordinal": 518
          },
          {
            "address": "0x100333a0",
            "name": "??1?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 519
          },
          {
            "address": "0x100309b0",
            "name": "??1?$CSimpleStringT@G$0A@@ATL@@QAE@XZ",
            "ordinal": 520
          },
          {
            "address": "0x1002fab0",
            "name": "??1?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@XZ",
            "ordinal": 521
          },
          {
            "address": "0x100462d0",
            "name": "??1?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@MAE@XZ",
            "ordinal": 522
          },
          {
            "address": "0x10050a00",
            "name": "??1?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAE@XZ",
            "ordinal": 523
          },
          {
            "address": "0x1002d510",
            "name": "??1?$ICollection@E@UnBCL@@UAE@XZ",
            "ordinal": 524
          },
          {
            "address": "0x1002d510",
            "name": "??1?$ICollection@G@UnBCL@@UAE@XZ",
            "ordinal": 525
          },
          {
            "address": "0x1002d510",
            "name": "??1?$ICollection@H@UnBCL@@UAE@XZ",
            "ordinal": 526
          },
          {
            "address": "0x1002d510",
            "name": "??1?$ICollection@PAVObject@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 527
          },
          {
            "address": "0x1002d510",
            "name": "??1?$ICollection@PAVString@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 528
          },
          {
            "address": "0x1002d510",
            "name": "??1?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 529
          },
          {
            "address": "0x1002d510",
            "name": "??1?$IComparer@PAVString@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 530
          },
          {
            "address": "0x1002d510",
            "name": "??1?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@UAE@XZ",
            "ordinal": 531
          },
          {
            "address": "0x1002d510",
            "name": "??1?$IEnumerator@PAVString@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 532
          },
          {
            "address": "0x1002d510",
            "name": "??1?$IEnumerator@PBG@UnBCL@@UAE@XZ",
            "ordinal": 533
          },
          {
            "address": "0x1002d510",
            "name": "??1?$IList@E@UnBCL@@UAE@XZ",
            "ordinal": 534
          },
          {
            "address": "0x1002d510",
            "name": "??1?$IList@G@UnBCL@@UAE@XZ",
            "ordinal": 535
          },
          {
            "address": "0x1002d510",
            "name": "??1?$IList@H@UnBCL@@UAE@XZ",
            "ordinal": 536
          },
          {
            "address": "0x1002d510",
            "name": "??1?$IList@PAVObject@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 537
          },
          {
            "address": "0x1002d510",
            "name": "??1?$IList@PAVString@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 538
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableArrayBase@E@_@UnBCL@@UAE@XZ",
            "ordinal": 539
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableArrayBase@G@_@UnBCL@@UAE@XZ",
            "ordinal": 540
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableArrayBase@H@_@UnBCL@@UAE@XZ",
            "ordinal": 541
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@UAE@XZ",
            "ordinal": 542
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@UAE@XZ",
            "ordinal": 543
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@UAE@XZ",
            "ordinal": 544
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
            "ordinal": 545
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
            "ordinal": 546
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
            "ordinal": 547
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
            "ordinal": 548
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
            "ordinal": 549
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
            "ordinal": 550
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
            "ordinal": 551
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
            "ordinal": 552
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@UAE@XZ",
            "ordinal": 553
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@UAE@XZ",
            "ordinal": 554
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
            "ordinal": 555
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@UAE@XZ",
            "ordinal": 556
          },
          {
            "address": "0x1002d510",
            "name": "??1?$SerializableStackBase@H@_@UnBCL@@UAE@XZ",
            "ordinal": 557
          },
          {
            "address": "0x1003bce0",
            "name": "??1?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 558
          },
          {
            "address": "0x1003bd90",
            "name": "??1?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 559
          },
          {
            "address": "0x1003a000",
            "name": "??1?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 560
          },
          {
            "address": "0x10030fe0",
            "name": "??1?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 561
          },
          {
            "address": "0x100311a0",
            "name": "??1?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 562
          },
          {
            "address": "0x1002d230",
            "name": "??1?$SmartPtr@VObject@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 563
          },
          {
            "address": "0x10031300",
            "name": "??1?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 564
          },
          {
            "address": "0x100313b0",
            "name": "??1?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 565
          },
          {
            "address": "0x10031250",
            "name": "??1?$SmartPtr@VStream@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 566
          },
          {
            "address": "0x10036c80",
            "name": "??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 567
          },
          {
            "address": "0x100518f0",
            "name": "??1?$SmartPtr@VVersion@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 568
          },
          {
            "address": "0x1007d0f0",
            "name": "??1?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 569
          },
          {
            "address": "0x1006c6d0",
            "name": "??1?$Stack@H@UnBCL@@UAE@XZ",
            "ordinal": 570
          },
          {
            "address": "0x1006c080",
            "name": "??1?$Stack@PAVObject@UnBCL@@@UnBCL@@UAE@XZ",
            "ordinal": 571
          },
          {
            "address": "0x1002d510",
            "name": "??1ASCIIEncoding@UnBCL@@UAE@XZ",
            "ordinal": 572
          },
          {
            "address": "0x1002cd60",
            "name": "??1AbandonedMutexException@UnBCL@@UAE@XZ",
            "ordinal": 573
          },
          {
            "address": "0x1002cc20",
            "name": "??1ApplicationException@UnBCL@@UAE@XZ",
            "ordinal": 574
          },
          {
            "address": "0x1002cd60",
            "name": "??1ArgumentException@UnBCL@@UAE@XZ",
            "ordinal": 575
          },
          {
            "address": "0x1002ce80",
            "name": "??1ArgumentNullException@UnBCL@@UAE@XZ",
            "ordinal": 576
          },
          {
            "address": "0x1002ce80",
            "name": "??1ArgumentOutOfRangeException@UnBCL@@UAE@XZ",
            "ordinal": 577
          },
          {
            "address": "0x1002cd60",
            "name": "??1ArithmeticException@UnBCL@@UAE@XZ",
            "ordinal": 578
          },
          {
            "address": "0x100451d0",
            "name": "??1BufferedStream@UnBCL@@UAE@XZ",
            "ordinal": 579
          },
          {
            "address": "0x1002d510",
            "name": "??1CaseInsensitiveStringComparer@UnBCL@@UAE@XZ",
            "ordinal": 580
          },
          {
            "address": "0x10044ae0",
            "name": "??1Char@UnBCL@@UAE@XZ",
            "ordinal": 581
          },
          {
            "address": "0x10044ae0",
            "name": "??1DateTime@UnBCL@@UAE@XZ",
            "ordinal": 582
          },
          {
            "address": "0x1002d510",
            "name": "??1Decoder@UnBCL@@UAE@XZ",
            "ordinal": 583
          },
          {
            "address": "0x1002d510",
            "name": "??1Delegate@UnBCL@@UAE@XZ",
            "ordinal": 584
          },
          {
            "address": "0x10044ae0",
            "name": "??1DirectoryInfo@UnBCL@@UAE@XZ",
            "ordinal": 585
          },
          {
            "address": "0x1002d510",
            "name": "??1Encoding@UnBCL@@UAE@XZ",
            "ordinal": 586
          },
          {
            "address": "0x10053df0",
            "name": "??1Exception@UnBCL@@UAE@XZ",
            "ordinal": 587
          },
          {
            "address": "0x1002cd60",
            "name": "??1ExternalException@UnBCL@@UAE@XZ",
            "ordinal": 588
          },
          {
            "address": "0x10056790",
            "name": "??1FileStream@UnBCL@@UAE@XZ",
            "ordinal": 589
          },
          {
            "address": "0x10055dc0",
            "name": "??1FileSystemEnumerator@UnBCL@@UAE@XZ",
            "ordinal": 590
          },
          {
            "address": "0x1002cd60",
            "name": "??1FormatException@UnBCL@@UAE@XZ",
            "ordinal": 591
          },
          {
            "address": "0x10057440",
            "name": "??1HeapMemoryManager@UnBCL@@UAE@XZ",
            "ordinal": 592
          },
          {
            "address": "0x1002d510",
            "name": "??1IDisposable@UnBCL@@UAE@XZ",
            "ordinal": 593
          },
          {
            "address": "0x1002d510",
            "name": "??1IPoolable@UnBCL@@UAE@XZ",
            "ordinal": 594
          },
          {
            "address": "0x1002d510",
            "name": "??1ISerializable@UnBCL@@UAE@XZ",
            "ordinal": 595
          },
          {
            "address": "0x1002cd60",
            "name": "??1IndexOutOfRangeException@UnBCL@@UAE@XZ",
            "ordinal": 596
          },
          {
            "address": "0x1002cd60",
            "name": "??1InvalidCastException@UnBCL@@UAE@XZ",
            "ordinal": 597
          },
          {
            "address": "0x1002cd60",
            "name": "??1InvalidOperationException@UnBCL@@UAE@XZ",
            "ordinal": 598
          },
          {
            "address": "0x10057e70",
            "name": "??1MemoryStream@UnBCL@@UAE@XZ",
            "ordinal": 599
          },
          {
            "address": "0x10059220",
            "name": "??1Monitor@UnBCL@@EAE@XZ",
            "ordinal": 600
          },
          {
            "address": "0x10059a90",
            "name": "??1MultiSz@UnBCL@@UAE@XZ",
            "ordinal": 601
          },
          {
            "address": "0x1002e1a0",
            "name": "??1MutableString@UnBCL@@UAE@XZ",
            "ordinal": 602
          },
          {
            "address": "0x1002d510",
            "name": "??1Mutex@UnBCL@@UAE@XZ",
            "ordinal": 603
          },
          {
            "address": "0x1002cd60",
            "name": "??1NotSupportedException@UnBCL@@UAE@XZ",
            "ordinal": 604
          },
          {
            "address": "0x1005e3d0",
            "name": "??1Object@UnBCL@@UAE@XZ",
            "ordinal": 605
          },
          {
            "address": "0x1002cd60",
            "name": "??1ObjectDisposedException@UnBCL@@UAE@XZ",
            "ordinal": 606
          },
          {
            "address": "0x1004e1a0",
            "name": "??1OperatingSystem@UnBCL@@UAE@XZ",
            "ordinal": 607
          },
          {
            "address": "0x1002cd60",
            "name": "??1OutOfMemoryException@UnBCL@@UAE@XZ",
            "ordinal": 608
          },
          {
            "address": "0x1002ce80",
            "name": "??1OverflowException@UnBCL@@UAE@XZ",
            "ordinal": 609
          },
          {
            "address": "0x1002cd60",
            "name": "??1PathTooLongException@UnBCL@@UAE@XZ",
            "ordinal": 610
          },
          {
            "address": "0x100618b0",
            "name": "??1Process@UnBCL@@UAE@XZ",
            "ordinal": 611
          },
          {
            "address": "0x10061570",
            "name": "??1ProcessStartInfo@UnBCL@@UAE@XZ",
            "ordinal": 612
          },
          {
            "address": "0x100621a0",
            "name": "??1RegHandle@UnBCL@@UAE@XZ",
            "ordinal": 613
          },
          {
            "address": "0x10064bb0",
            "name": "??1RegSubkeyEnumerator@UnBCL@@UAE@XZ",
            "ordinal": 614
          },
          {
            "address": "0x1002d510",
            "name": "??1Registry@UnBCL@@UAE@XZ",
            "ordinal": 615
          },
          {
            "address": "0x10062a80",
            "name": "??1RegistryKey@UnBCL@@UAE@XZ",
            "ordinal": 616
          },
          {
            "address": "0x1002d510",
            "name": "??1SEHException@UnBCL@@UAE@XZ",
            "ordinal": 617
          },
          {
            "address": "0x1005e8e0",
            "name": "??1ScopedObjectLock@UnBCL@@QAE@XZ",
            "ordinal": 618
          },
          {
            "address": "0x1002cd60",
            "name": "??1SecurityException@UnBCL@@UAE@XZ",
            "ordinal": 619
          },
          {
            "address": "0x1002cd60",
            "name": "??1SerializationException@UnBCL@@UAE@XZ",
            "ordinal": 620
          },
          {
            "address": "0x10067110",
            "name": "??1SerializationId@UnBCL@@UAE@XZ",
            "ordinal": 621
          },
          {
            "address": "0x10065540",
            "name": "??1SerializationStream@UnBCL@@UAE@XZ",
            "ordinal": 622
          },
          {
            "address": "0x1002d510",
            "name": "??1Stream@UnBCL@@UAE@XZ",
            "ordinal": 623
          },
          {
            "address": "0x1002d830",
            "name": "??1StreamCounter@UnBCL@@QAE@XZ",
            "ordinal": 624
          },
          {
            "address": "0x1006d410",
            "name": "??1StreamReader@UnBCL@@UAE@XZ",
            "ordinal": 625
          },
          {
            "address": "0x1006e0e0",
            "name": "??1StreamWriter@UnBCL@@UAE@XZ",
            "ordinal": 626
          },
          {
            "address": "0x1006e7d0",
            "name": "??1String@UnBCL@@UAE@XZ",
            "ordinal": 627
          },
          {
            "address": "0x10071d80",
            "name": "??1StringBuilder@UnBCL@@UAE@XZ",
            "ordinal": 628
          },
          {
            "address": "0x1002d510",
            "name": "??1StringPtr@UnBCL@@UAE@XZ",
            "ordinal": 629
          },
          {
            "address": "0x1005e7e0",
            "name": "??1SyncObject@UnBCL@@UAE@XZ",
            "ordinal": 630
          },
          {
            "address": "0x1002cc20",
            "name": "??1SystemException@UnBCL@@UAE@XZ",
            "ordinal": 631
          },
          {
            "address": "0x1004e470",
            "name": "??1SystemInfo@UnBCL@@UAE@XZ",
            "ordinal": 632
          },
          {
            "address": "0x1002d510",
            "name": "??1TextReader@UnBCL@@UAE@XZ",
            "ordinal": 633
          },
          {
            "address": "0x1006d920",
            "name": "??1TextWriter@UnBCL@@UAE@XZ",
            "ordinal": 634
          },
          {
            "address": "0x10072fb0",
            "name": "??1Thread@UnBCL@@UAE@XZ",
            "ordinal": 635
          },
          {
            "address": "0x1002cd60",
            "name": "??1ThreadStateException@UnBCL@@UAE@XZ",
            "ordinal": 636
          },
          {
            "address": "0x10044ae0",
            "name": "??1TimeSpan@UnBCL@@UAE@XZ",
            "ordinal": 637
          },
          {
            "address": "0x10073c50",
            "name": "??1Type@UnBCL@@UAE@XZ",
            "ordinal": 638
          },
          {
            "address": "0x1002d510",
            "name": "??1UnicodeEncoding@UnBCL@@UAE@XZ",
            "ordinal": 639
          },
          {
            "address": "0x10074ed0",
            "name": "??1Version@UnBCL@@UAE@XZ",
            "ordinal": 640
          },
          {
            "address": "0x10075340",
            "name": "??1WaitHandle@UnBCL@@UAE@XZ",
            "ordinal": 641
          },
          {
            "address": "0x1002ce80",
            "name": "??1Win32Exception@UnBCL@@UAE@XZ",
            "ordinal": 642
          },
          {
            "address": "0x1002cd60",
            "name": "??1XPathException@UnBCL@@UAE@XZ",
            "ordinal": 643
          },
          {
            "address": "0x10076640",
            "name": "??1XmlAttribute@UnBCL@@UAE@XZ",
            "ordinal": 644
          },
          {
            "address": "0x10076110",
            "name": "??1XmlAttribute@XmlLite@UnBCL@@UAE@XZ",
            "ordinal": 645
          },
          {
            "address": "0x10079e40",
            "name": "??1XmlAttributeCollection@UnBCL@@UAE@XZ",
            "ordinal": 646
          },
          {
            "address": "0x100762c0",
            "name": "??1XmlAttributeCollection@XmlLite@UnBCL@@UAE@XZ",
            "ordinal": 647
          },
          {
            "address": "0x1007a200",
            "name": "??1XmlDocument@UnBCL@@UAE@XZ",
            "ordinal": 648
          },
          {
            "address": "0x10077c00",
            "name": "??1XmlDocument@XmlLite@UnBCL@@UAE@XZ",
            "ordinal": 649
          },
          {
            "address": "0x1002cd60",
            "name": "??1XmlException@UnBCL@@UAE@XZ",
            "ordinal": 650
          },
          {
            "address": "0x1007ada0",
            "name": "??1XmlNamespaceManager@UnBCL@@UAE@XZ",
            "ordinal": 651
          },
          {
            "address": "0x10078b70",
            "name": "??1XmlNode@UnBCL@@UAE@XZ",
            "ordinal": 652
          },
          {
            "address": "0x10076de0",
            "name": "??1XmlNode@XmlLite@UnBCL@@UAE@XZ",
            "ordinal": 653
          },
          {
            "address": "0x10079c40",
            "name": "??1XmlNodeList@UnBCL@@UAE@XZ",
            "ordinal": 654
          },
          {
            "address": "0x10075f80",
            "name": "??1XmlNodeList@XmlLite@UnBCL@@UAE@XZ",
            "ordinal": 655
          },
          {
            "address": "0x1007afe0",
            "name": "??1XmlSchemaSet@UnBCL@@UAE@XZ",
            "ordinal": 656
          },
          {
            "address": "0x1005e640",
            "name": "??2Object@UnBCL@@SGPAXI@Z",
            "ordinal": 657
          },
          {
            "address": "0x1005e680",
            "name": "??2Object@UnBCL@@SGPAXII@Z",
            "ordinal": 658
          },
          {
            "address": "0x1005e660",
            "name": "??2Object@UnBCL@@SGPAXIPBDH@Z",
            "ordinal": 659
          },
          {
            "address": "0x1005e6c0",
            "name": "??2Object@UnBCL@@SGPAXIPBDHI@Z",
            "ordinal": 660
          },
          {
            "address": "0x1005e700",
            "name": "??3Object@UnBCL@@SGXPAX@Z",
            "ordinal": 661
          },
          {
            "address": "0x1005e720",
            "name": "??3Object@UnBCL@@SGXPAXPBDH@Z",
            "ordinal": 662
          },
          {
            "address": "0x10032570",
            "name": "??4?$Array@E@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 663
          },
          {
            "address": "0x10032570",
            "name": "??4?$Array@G@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 664
          },
          {
            "address": "0x10032570",
            "name": "??4?$Array@H@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 665
          },
          {
            "address": "0x10032310",
            "name": "??4?$Array@PAVObject@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 666
          },
          {
            "address": "0x10032570",
            "name": "??4?$Array@PAVString@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 667
          },
          {
            "address": "0x10031e50",
            "name": "??4?$ArrayList@G@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 668
          },
          {
            "address": "0x10031e50",
            "name": "??4?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 669
          },
          {
            "address": "0x10030950",
            "name": "??4?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@ABV01@@Z",
            "ordinal": 670
          },
          {
            "address": "0x10030950",
            "name": "??4?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@ABV?$CSimpleStringT@G$00@1@@Z",
            "ordinal": 671
          },
          {
            "address": "0x1002fa60",
            "name": "??4?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@PBG@Z",
            "ordinal": 672
          },
          {
            "address": "0x10030cc0",
            "name": "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@ABUtagVARIANT@@@Z",
            "ordinal": 673
          },
          {
            "address": "0x1002fa90",
            "name": "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@ABV01@@Z",
            "ordinal": 674
          },
          {
            "address": "0x1002f9b0",
            "name": "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@D@Z",
            "ordinal": 675
          },
          {
            "address": "0x1002f960",
            "name": "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@G@Z",
            "ordinal": 676
          },
          {
            "address": "0x1002f9f0",
            "name": "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@PBD@Z",
            "ordinal": 677
          },
          {
            "address": "0x1002f9e0",
            "name": "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@PBE@Z",
            "ordinal": 678
          },
          {
            "address": "0x1002fa60",
            "name": "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@PBG@Z",
            "ordinal": 679
          },
          {
            "address": "0x10032310",
            "name": "??4?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 680
          },
          {
            "address": "0x1004de90",
            "name": "??4?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 681
          },
          {
            "address": "0x1002d540",
            "name": "??4?$ICollection@E@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 682
          },
          {
            "address": "0x1002d540",
            "name": "??4?$ICollection@E@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 683
          },
          {
            "address": "0x1002d540",
            "name": "??4?$ICollection@G@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 684
          },
          {
            "address": "0x1002d540",
            "name": "??4?$ICollection@G@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 685
          },
          {
            "address": "0x1002d540",
            "name": "??4?$ICollection@H@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 686
          },
          {
            "address": "0x1002d540",
            "name": "??4?$ICollection@H@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 687
          },
          {
            "address": "0x1002d540",
            "name": "??4?$ICollection@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 688
          },
          {
            "address": "0x1002d540",
            "name": "??4?$ICollection@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 689
          },
          {
            "address": "0x1002d540",
            "name": "??4?$ICollection@PAVString@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 690
          },
          {
            "address": "0x1002d540",
            "name": "??4?$ICollection@PAVString@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 691
          },
          {
            "address": "0x1002d540",
            "name": "??4?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 692
          },
          {
            "address": "0x1002d540",
            "name": "??4?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 693
          },
          {
            "address": "0x1002d540",
            "name": "??4?$IComparer@PAVString@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 694
          },
          {
            "address": "0x1002d540",
            "name": "??4?$IComparer@PAVString@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 695
          },
          {
            "address": "0x1004dcf0",
            "name": "??4?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 696
          },
          {
            "address": "0x1004dcf0",
            "name": "??4?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 697
          },
          {
            "address": "0x1002ca50",
            "name": "??4?$IEnumerable@E@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 698
          },
          {
            "address": "0x1002ca50",
            "name": "??4?$IEnumerable@E@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 699
          },
          {
            "address": "0x1002ca50",
            "name": "??4?$IEnumerable@G@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 700
          },
          {
            "address": "0x1002ca50",
            "name": "??4?$IEnumerable@G@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 701
          },
          {
            "address": "0x1002ca50",
            "name": "??4?$IEnumerable@H@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 702
          },
          {
            "address": "0x1002ca50",
            "name": "??4?$IEnumerable@H@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 703
          },
          {
            "address": "0x1002ca50",
            "name": "??4?$IEnumerable@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 704
          },
          {
            "address": "0x1002ca50",
            "name": "??4?$IEnumerable@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 705
          },
          {
            "address": "0x1002ca50",
            "name": "??4?$IEnumerable@PAVString@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 706
          },
          {
            "address": "0x1002ca50",
            "name": "??4?$IEnumerable@PAVString@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 707
          },
          {
            "address": "0x1002ca50",
            "name": "??4?$IEnumerable@PBG@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 708
          },
          {
            "address": "0x1002ca50",
            "name": "??4?$IEnumerable@PBG@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 709
          },
          {
            "address": "0x1002ca50",
            "name": "??4?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 710
          },
          {
            "address": "0x1002ca50",
            "name": "??4?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 711
          },
          {
            "address": "0x1002d540",
            "name": "??4?$IEnumerator@PAVString@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 712
          },
          {
            "address": "0x1002d540",
            "name": "??4?$IEnumerator@PAVString@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 713
          },
          {
            "address": "0x1002d540",
            "name": "??4?$IEnumerator@PBG@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 714
          },
          {
            "address": "0x1002d540",
            "name": "??4?$IEnumerator@PBG@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 715
          },
          {
            "address": "0x10031c20",
            "name": "??4?$IList@E@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 716
          },
          {
            "address": "0x10031c20",
            "name": "??4?$IList@E@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 717
          },
          {
            "address": "0x10031c20",
            "name": "??4?$IList@G@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 718
          },
          {
            "address": "0x10031c20",
            "name": "??4?$IList@G@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 719
          },
          {
            "address": "0x10031c20",
            "name": "??4?$IList@H@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 720
          },
          {
            "address": "0x10031c20",
            "name": "??4?$IList@H@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 721
          },
          {
            "address": "0x10031c20",
            "name": "??4?$IList@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 722
          },
          {
            "address": "0x10031c20",
            "name": "??4?$IList@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 723
          },
          {
            "address": "0x10031c20",
            "name": "??4?$IList@PAVString@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 724
          },
          {
            "address": "0x10031c20",
            "name": "??4?$IList@PAVString@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 725
          },
          {
            "address": "0x10032510",
            "name": "??4?$SerializableArrayBase@E@_@UnBCL@@QAEAAV012@$$QAV012@@Z",
            "ordinal": 726
          },
          {
            "address": "0x10032510",
            "name": "??4?$SerializableArrayBase@E@_@UnBCL@@QAEAAV012@ABV012@@Z",
            "ordinal": 727
          },
          {
            "address": "0x10032510",
            "name": "??4?$SerializableArrayBase@G@_@UnBCL@@QAEAAV012@$$QAV012@@Z",
            "ordinal": 728
          },
          {
            "address": "0x10032510",
            "name": "??4?$SerializableArrayBase@G@_@UnBCL@@QAEAAV012@ABV012@@Z",
            "ordinal": 729
          },
          {
            "address": "0x10032510",
            "name": "??4?$SerializableArrayBase@H@_@UnBCL@@QAEAAV012@$$QAV012@@Z",
            "ordinal": 730
          },
          {
            "address": "0x10032510",
            "name": "??4?$SerializableArrayBase@H@_@UnBCL@@QAEAAV012@ABV012@@Z",
            "ordinal": 731
          },
          {
            "address": "0x10032510",
            "name": "??4?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@QAEAAV012@$$QAV012@@Z",
            "ordinal": 732
          },
          {
            "address": "0x10032510",
            "name": "??4?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@QAEAAV012@ABV012@@Z",
            "ordinal": 733
          },
          {
            "address": "0x10031de0",
            "name": "??4?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@QAEAAV012@$$QAV012@@Z",
            "ordinal": 734
          },
          {
            "address": "0x10031de0",
            "name": "??4?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@QAEAAV012@ABV012@@Z",
            "ordinal": 735
          },
          {
            "address": "0x10031de0",
            "name": "??4?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@QAEAAV012@$$QAV012@@Z",
            "ordinal": 736
          },
          {
            "address": "0x10031de0",
            "name": "??4?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@QAEAAV012@ABV012@@Z",
            "ordinal": 737
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 738
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 739
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 740
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 741
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 742
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 743
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 744
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 745
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 746
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 747
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 748
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 749
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 750
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 751
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 752
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 753
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 754
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 755
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 756
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 757
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 758
          },
          {
            "address": "0x10031cc0",
            "name": "??4?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 759
          },
          {
            "address": "0x1004de30",
            "name": "??4?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@QAEAAV012@$$QAV012@@Z",
            "ordinal": 760
          },
          {
            "address": "0x1004de30",
            "name": "??4?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@QAEAAV012@ABV012@@Z",
            "ordinal": 761
          },
          {
            "address": "0x1006bcb0",
            "name": "??4?$SerializableStackBase@H@_@UnBCL@@QAEAAV012@$$QAV012@@Z",
            "ordinal": 762
          },
          {
            "address": "0x1006bcb0",
            "name": "??4?$SerializableStackBase@H@_@UnBCL@@QAEAAV012@ABV012@@Z",
            "ordinal": 763
          },
          {
            "address": "0x10031040",
            "name": "??4?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 764
          },
          {
            "address": "0x10031040",
            "name": "??4?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 765
          },
          {
            "address": "0x10031040",
            "name": "??4?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 766
          },
          {
            "address": "0x10031040",
            "name": "??4?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 767
          },
          {
            "address": "0x10031040",
            "name": "??4?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 768
          },
          {
            "address": "0x1002d280",
            "name": "??4?$SmartPtr@VObject@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 769
          },
          {
            "address": "0x1002d280",
            "name": "??4?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 770
          },
          {
            "address": "0x1002d280",
            "name": "??4?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 771
          },
          {
            "address": "0x10031040",
            "name": "??4?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 772
          },
          {
            "address": "0x1002d280",
            "name": "??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 773
          },
          {
            "address": "0x10051950",
            "name": "??4?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 774
          },
          {
            "address": "0x1002d280",
            "name": "??4?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 775
          },
          {
            "address": "0x1006bd20",
            "name": "??4?$Stack@H@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 776
          },
          {
            "address": "0x1006bab0",
            "name": "??4?$Stack@PAVObject@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 777
          },
          {
            "address": "0x100441c0",
            "name": "??4ASCIIEncoding@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 778
          },
          {
            "address": "0x100441c0",
            "name": "??4ASCIIEncoding@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 779
          },
          {
            "address": "0x1002ccb0",
            "name": "??4AbandonedMutexException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 780
          },
          {
            "address": "0x1002ccb0",
            "name": "??4AbandonedMutexException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 781
          },
          {
            "address": "0x1002ca50",
            "name": "??4Allocator@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 782
          },
          {
            "address": "0x1002ca50",
            "name": "??4Allocator@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 783
          },
          {
            "address": "0x1002ccb0",
            "name": "??4ApplicationException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 784
          },
          {
            "address": "0x1002ccb0",
            "name": "??4ApplicationException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 785
          },
          {
            "address": "0x1002ccb0",
            "name": "??4ArgumentException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 786
          },
          {
            "address": "0x1002ccb0",
            "name": "??4ArgumentException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 787
          },
          {
            "address": "0x1002ccb0",
            "name": "??4ArgumentNullException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 788
          },
          {
            "address": "0x1002ccb0",
            "name": "??4ArgumentNullException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 789
          },
          {
            "address": "0x1002ccb0",
            "name": "??4ArgumentOutOfRangeException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 790
          },
          {
            "address": "0x1002ccb0",
            "name": "??4ArgumentOutOfRangeException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 791
          },
          {
            "address": "0x1002ccb0",
            "name": "??4ArithmeticException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 792
          },
          {
            "address": "0x1002ccb0",
            "name": "??4ArithmeticException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 793
          },
          {
            "address": "0x10044eb0",
            "name": "??4BufferedStream@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 794
          },
          {
            "address": "0x10031b70",
            "name": "??4CaseInsensitiveStringComparer@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 795
          },
          {
            "address": "0x10031b70",
            "name": "??4CaseInsensitiveStringComparer@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 796
          },
          {
            "address": "0x10045a70",
            "name": "??4Char@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 797
          },
          {
            "address": "0x1002ca50",
            "name": "??4ConsoleLogHandler@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 798
          },
          {
            "address": "0x1002ca50",
            "name": "??4ConsoleLogHandler@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 799
          },
          {
            "address": "0x10046560",
            "name": "??4DateTime@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 800
          },
          {
            "address": "0x1002d540",
            "name": "??4Decoder@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 801
          },
          {
            "address": "0x1002d540",
            "name": "??4Decoder@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 802
          },
          {
            "address": "0x10058c40",
            "name": "??4Delegate@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 803
          },
          {
            "address": "0x10058c40",
            "name": "??4Delegate@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 804
          },
          {
            "address": "0x1002ca50",
            "name": "??4Directory@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 805
          },
          {
            "address": "0x1002ca50",
            "name": "??4Directory@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 806
          },
          {
            "address": "0x1002ca60",
            "name": "??4DirectoryInfo@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 807
          },
          {
            "address": "0x1002ca60",
            "name": "??4DirectoryInfo@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 808
          },
          {
            "address": "0x1002d6b0",
            "name": "??4Encoding@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 809
          },
          {
            "address": "0x1002d6b0",
            "name": "??4Encoding@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 810
          },
          {
            "address": "0x1002ca50",
            "name": "??4Environment@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 811
          },
          {
            "address": "0x1002ca50",
            "name": "??4Environment@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 812
          },
          {
            "address": "0x1002cb60",
            "name": "??4Exception@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 813
          },
          {
            "address": "0x1002ccb0",
            "name": "??4ExternalException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 814
          },
          {
            "address": "0x1002ccb0",
            "name": "??4ExternalException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 815
          },
          {
            "address": "0x1002ca50",
            "name": "??4File@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 816
          },
          {
            "address": "0x1002ca50",
            "name": "??4File@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 817
          },
          {
            "address": "0x10044cd0",
            "name": "??4FileStream@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 818
          },
          {
            "address": "0x100559d0",
            "name": "??4FileSystemEnumerator@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 819
          },
          {
            "address": "0x1002ccb0",
            "name": "??4FormatException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 820
          },
          {
            "address": "0x1002ccb0",
            "name": "??4FormatException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 821
          },
          {
            "address": "0x1002e2f0",
            "name": "??4HeapMemoryManager@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 822
          },
          {
            "address": "0x1002d540",
            "name": "??4IDisposable@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 823
          },
          {
            "address": "0x1002d540",
            "name": "??4IDisposable@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 824
          },
          {
            "address": "0x1002ca50",
            "name": "??4IInstanceFactory@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 825
          },
          {
            "address": "0x1002ca50",
            "name": "??4IInstanceFactory@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 826
          },
          {
            "address": "0x1002d540",
            "name": "??4IPoolable@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 827
          },
          {
            "address": "0x1002d540",
            "name": "??4IPoolable@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 828
          },
          {
            "address": "0x1002d540",
            "name": "??4ISerializable@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 829
          },
          {
            "address": "0x1002d540",
            "name": "??4ISerializable@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 830
          },
          {
            "address": "0x1002ccb0",
            "name": "??4IndexOutOfRangeException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 831
          },
          {
            "address": "0x1002ccb0",
            "name": "??4IndexOutOfRangeException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 832
          },
          {
            "address": "0x1002ca50",
            "name": "??4Int32Ops@UnBCL@@QAEAAU01@$$QAU01@@Z",
            "ordinal": 833
          },
          {
            "address": "0x1002ca50",
            "name": "??4Int32Ops@UnBCL@@QAEAAU01@ABU01@@Z",
            "ordinal": 834
          },
          {
            "address": "0x1002ccb0",
            "name": "??4InvalidCastException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 835
          },
          {
            "address": "0x1002ccb0",
            "name": "??4InvalidCastException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 836
          },
          {
            "address": "0x1002ccb0",
            "name": "??4InvalidOperationException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 837
          },
          {
            "address": "0x1002ccb0",
            "name": "??4InvalidOperationException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 838
          },
          {
            "address": "0x1002ca50",
            "name": "??4Logging@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 839
          },
          {
            "address": "0x1002ca50",
            "name": "??4Logging@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 840
          },
          {
            "address": "0x1002dbe0",
            "name": "??4MemoryStream@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 841
          },
          {
            "address": "0x10058c40",
            "name": "??4Monitor@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 842
          },
          {
            "address": "0x100594f0",
            "name": "??4MultiSz@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 843
          },
          {
            "address": "0x1002e1f0",
            "name": "??4MutableString@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 844
          },
          {
            "address": "0x1002e1f0",
            "name": "??4MutableString@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 845
          },
          {
            "address": "0x1002e070",
            "name": "??4MutableString@UnBCL@@QAEAAV01@PBG@Z",
            "ordinal": 846
          },
          {
            "address": "0x1005df20",
            "name": "??4Mutex@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 847
          },
          {
            "address": "0x1005df20",
            "name": "??4Mutex@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 848
          },
          {
            "address": "0x1002ccb0",
            "name": "??4NotSupportedException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 849
          },
          {
            "address": "0x1002ccb0",
            "name": "??4NotSupportedException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 850
          },
          {
            "address": "0x1002ca60",
            "name": "??4Object@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 851
          },
          {
            "address": "0x1002ccb0",
            "name": "??4ObjectDisposedException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 852
          },
          {
            "address": "0x1002ccb0",
            "name": "??4ObjectDisposedException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 853
          },
          {
            "address": "0x1004e1f0",
            "name": "??4OperatingSystem@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 854
          },
          {
            "address": "0x1002ccb0",
            "name": "??4OutOfMemoryException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 855
          },
          {
            "address": "0x1002ccb0",
            "name": "??4OutOfMemoryException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 856
          },
          {
            "address": "0x1002ccb0",
            "name": "??4OverflowException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 857
          },
          {
            "address": "0x1002ccb0",
            "name": "??4OverflowException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 858
          },
          {
            "address": "0x1002ca50",
            "name": "??4Path@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 859
          },
          {
            "address": "0x1002ca50",
            "name": "??4Path@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 860
          },
          {
            "address": "0x1002ccb0",
            "name": "??4PathTooLongException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 861
          },
          {
            "address": "0x1002ccb0",
            "name": "??4PathTooLongException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 862
          },
          {
            "address": "0x100617b0",
            "name": "??4Process@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 863
          },
          {
            "address": "0x10061650",
            "name": "??4ProcessStartInfo@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 864
          },
          {
            "address": "0x10061650",
            "name": "??4ProcessStartInfo@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 865
          },
          {
            "address": "0x10062050",
            "name": "??4RegHandle@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 866
          },
          {
            "address": "0x10064a20",
            "name": "??4RegSubkeyEnumerator@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 867
          },
          {
            "address": "0x10058c40",
            "name": "??4Registry@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 868
          },
          {
            "address": "0x10058c40",
            "name": "??4Registry@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 869
          },
          {
            "address": "0x100625b0",
            "name": "??4RegistryKey@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 870
          },
          {
            "address": "0x10065030",
            "name": "??4SEHException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 871
          },
          {
            "address": "0x10065030",
            "name": "??4SEHException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 872
          },
          {
            "address": "0x1002ca50",
            "name": "??4SbRegistrationList@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 873
          },
          {
            "address": "0x1002ca50",
            "name": "??4SbRegistrationList@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 874
          },
          {
            "address": "0x1002cae0",
            "name": "??4ScopedObjectLock@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 875
          },
          {
            "address": "0x1002ccb0",
            "name": "??4SecurityException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 876
          },
          {
            "address": "0x1002ccb0",
            "name": "??4SecurityException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 877
          },
          {
            "address": "0x1002ccb0",
            "name": "??4SerializationException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 878
          },
          {
            "address": "0x1002ccb0",
            "name": "??4SerializationException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 879
          },
          {
            "address": "0x1002dd40",
            "name": "??4SerializationId@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 880
          },
          {
            "address": "0x10067070",
            "name": "??4SerializationStream@UnBCL@@AAEXABV01@@Z",
            "ordinal": 881
          },
          {
            "address": "0x1002d980",
            "name": "??4Stream@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 882
          },
          {
            "address": "0x1002d980",
            "name": "??4Stream@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 883
          },
          {
            "address": "0x1002d8d0",
            "name": "??4StreamCounter@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 884
          },
          {
            "address": "0x1006d000",
            "name": "??4StreamReader@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 885
          },
          {
            "address": "0x1006dc20",
            "name": "??4StreamWriter@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 886
          },
          {
            "address": "0x1002df00",
            "name": "??4String@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 887
          },
          {
            "address": "0x1004dc50",
            "name": "??4StringBuilder@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 888
          },
          {
            "address": "0x100319a0",
            "name": "??4StringPtr@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 889
          },
          {
            "address": "0x1002ca80",
            "name": "??4SyncObject@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 890
          },
          {
            "address": "0x1002ccb0",
            "name": "??4SystemException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 891
          },
          {
            "address": "0x1002ccb0",
            "name": "??4SystemException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 892
          },
          {
            "address": "0x1004e640",
            "name": "??4SystemInfo@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 893
          },
          {
            "address": "0x1004e640",
            "name": "??4SystemInfo@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 894
          },
          {
            "address": "0x1006ce40",
            "name": "??4TextReader@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 895
          },
          {
            "address": "0x1006ce40",
            "name": "??4TextReader@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 896
          },
          {
            "address": "0x1006da50",
            "name": "??4TextWriter@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 897
          },
          {
            "address": "0x1006da50",
            "name": "??4TextWriter@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 898
          },
          {
            "address": "0x10072e20",
            "name": "??4Thread@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 899
          },
          {
            "address": "0x1002ccb0",
            "name": "??4ThreadStateException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 900
          },
          {
            "address": "0x1002ccb0",
            "name": "??4ThreadStateException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 901
          },
          {
            "address": "0x10046560",
            "name": "??4TimeSpan@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 902
          },
          {
            "address": "0x1004dc50",
            "name": "??4Type@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 903
          },
          {
            "address": "0x100441c0",
            "name": "??4UnicodeEncoding@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 904
          },
          {
            "address": "0x100441c0",
            "name": "??4UnicodeEncoding@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 905
          },
          {
            "address": "0x1004e030",
            "name": "??4Version@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 906
          },
          {
            "address": "0x1002d980",
            "name": "??4WaitHandle@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 907
          },
          {
            "address": "0x10045030",
            "name": "??4Win32Exception@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 908
          },
          {
            "address": "0x10045030",
            "name": "??4Win32Exception@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 909
          },
          {
            "address": "0x1002ccb0",
            "name": "??4XPathException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 910
          },
          {
            "address": "0x1002ccb0",
            "name": "??4XPathException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 911
          },
          {
            "address": "0x1004dc50",
            "name": "??4XmlAttribute@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 912
          },
          {
            "address": "0x1004dc50",
            "name": "??4XmlAttribute@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 913
          },
          {
            "address": "0x100761a0",
            "name": "??4XmlAttribute@XmlLite@UnBCL@@QAEAAV012@$$QAV012@@Z",
            "ordinal": 914
          },
          {
            "address": "0x100761a0",
            "name": "??4XmlAttribute@XmlLite@UnBCL@@QAEAAV012@ABV012@@Z",
            "ordinal": 915
          },
          {
            "address": "0x1004dc50",
            "name": "??4XmlAttributeCollection@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 916
          },
          {
            "address": "0x1004dc50",
            "name": "??4XmlAttributeCollection@XmlLite@UnBCL@@QAEAAV012@ABV012@@Z",
            "ordinal": 917
          },
          {
            "address": "0x10076870",
            "name": "??4XmlDocument@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 918
          },
          {
            "address": "0x100761a0",
            "name": "??4XmlDocument@XmlLite@UnBCL@@QAEAAV012@ABV012@@Z",
            "ordinal": 919
          },
          {
            "address": "0x10075cd0",
            "name": "??4XmlException@UnBCL@@QAEAAV01@$$QAV01@@Z",
            "ordinal": 920
          },
          {
            "address": "0x10075cd0",
            "name": "??4XmlException@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 921
          },
          {
            "address": "0x1004dc50",
            "name": "??4XmlNamespaceManager@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 922
          },
          {
            "address": "0x1004dc50",
            "name": "??4XmlNode@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 923
          },
          {
            "address": "0x10075e40",
            "name": "??4XmlNode@XmlLite@UnBCL@@QAEAAV012@ABV012@@Z",
            "ordinal": 924
          },
          {
            "address": "0x1004dc50",
            "name": "??4XmlNodeList@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 925
          },
          {
            "address": "0x1004dc50",
            "name": "??4XmlNodeList@XmlLite@UnBCL@@QAEAAV012@ABV012@@Z",
            "ordinal": 926
          },
          {
            "address": "0x1004dc50",
            "name": "??4XmlSchemaSet@UnBCL@@QAEAAV01@ABV01@@Z",
            "ordinal": 927
          },
          {
            "address": "0x10065f10",
            "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAE@Z",
            "ordinal": 928
          },
          {
            "address": "0x10065e10",
            "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAF@Z",
            "ordinal": 929
          },
          {
            "address": "0x10065e90",
            "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAG@Z",
            "ordinal": 930
          },
          {
            "address": "0x10065d80",
            "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAH@Z",
            "ordinal": 931
          },
          {
            "address": "0x10065d90",
            "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAI@Z",
            "ordinal": 932
          },
          {
            "address": "0x10065f20",
            "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAJ@Z",
            "ordinal": 933
          },
          {
            "address": "0x10065fa0",
            "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAK@Z",
            "ordinal": 934
          },
          {
            "address": "0x10066020",
            "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAM@Z",
            "ordinal": 935
          },
          {
            "address": "0x100660a0",
            "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAN@Z",
            "ordinal": 936
          },
          {
            "address": "0x100662a0",
            "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAPAUISerializable@1@@Z",
            "ordinal": 937
          },
          {
            "address": "0x100661e0",
            "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAPAVString@1@@Z",
            "ordinal": 938
          },
          {
            "address": "0x10066320",
            "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAPBUISerializable@1@@Z",
            "ordinal": 939
          },
          {
            "address": "0x1002ca50",
            "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAUEmptyType@MP@1@@Z",
            "ordinal": 940
          },
          {
            "address": "0x100663a0",
            "name": "??5SerializationStream@UnBCL@@QAEAAV01@AAV?$SmartPtr@UISerializable@UnBCL@@@1@@Z",
            "ordinal": 941
          },
          {
            "address": "0x10066120",
            "name": "??5SerializationStream@UnBCL@@QAEAAV01@AA_J@Z",
            "ordinal": 942
          },
          {
            "address": "0x100661a0",
            "name": "??5SerializationStream@UnBCL@@QAEAAV01@AA_K@Z",
            "ordinal": 943
          },
          {
            "address": "0x10065990",
            "name": "??6SerializationStream@UnBCL@@QAEAAV01@E@Z",
            "ordinal": 944
          },
          {
            "address": "0x10065890",
            "name": "??6SerializationStream@UnBCL@@QAEAAV01@F@Z",
            "ordinal": 945
          },
          {
            "address": "0x10065910",
            "name": "??6SerializationStream@UnBCL@@QAEAAV01@G@Z",
            "ordinal": 946
          },
          {
            "address": "0x10065800",
            "name": "??6SerializationStream@UnBCL@@QAEAAV01@H@Z",
            "ordinal": 947
          },
          {
            "address": "0x10065810",
            "name": "??6SerializationStream@UnBCL@@QAEAAV01@I@Z",
            "ordinal": 948
          },
          {
            "address": "0x100659a0",
            "name": "??6SerializationStream@UnBCL@@QAEAAV01@J@Z",
            "ordinal": 949
          },
          {
            "address": "0x10065a20",
            "name": "??6SerializationStream@UnBCL@@QAEAAV01@K@Z",
            "ordinal": 950
          },
          {
            "address": "0x10065aa0",
            "name": "??6SerializationStream@UnBCL@@QAEAAV01@M@Z",
            "ordinal": 951
          },
          {
            "address": "0x10065b20",
            "name": "??6SerializationStream@UnBCL@@QAEAAV01@N@Z",
            "ordinal": 952
          },
          {
            "address": "0x10065cc0",
            "name": "??6SerializationStream@UnBCL@@QAEAAV01@PBUISerializable@1@@Z",
            "ordinal": 953
          },
          {
            "address": "0x10065c40",
            "name": "??6SerializationStream@UnBCL@@QAEAAV01@PBVString@1@@Z",
            "ordinal": 954
          },
          {
            "address": "0x1002ca50",
            "name": "??6SerializationStream@UnBCL@@QAEAAV01@UEmptyType@MP@1@@Z",
            "ordinal": 955
          },
          {
            "address": "0x10065d40",
            "name": "??6SerializationStream@UnBCL@@QAEAAV01@V?$SmartPtr@UISerializable@UnBCL@@@1@@Z",
            "ordinal": 956
          },
          {
            "address": "0x10065ba0",
            "name": "??6SerializationStream@UnBCL@@QAEAAV01@_J@Z",
            "ordinal": 957
          },
          {
            "address": "0x10065c20",
            "name": "??6SerializationStream@UnBCL@@QAEAAV01@_K@Z",
            "ordinal": 958
          },
          {
            "address": "0x1002d2b0",
            "name": "??7?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBE_NXZ",
            "ordinal": 959
          },
          {
            "address": "0x1002d2b0",
            "name": "??7?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBE_NXZ",
            "ordinal": 960
          },
          {
            "address": "0x1002d2b0",
            "name": "??7?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBE_NXZ",
            "ordinal": 961
          },
          {
            "address": "0x1002d2b0",
            "name": "??7?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QBE_NXZ",
            "ordinal": 962
          },
          {
            "address": "0x1002d2b0",
            "name": "??7?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBE_NXZ",
            "ordinal": 963
          },
          {
            "address": "0x1002d2b0",
            "name": "??7?$SmartPtr@VObject@UnBCL@@@UnBCL@@QBE_NXZ",
            "ordinal": 964
          },
          {
            "address": "0x1002d2b0",
            "name": "??7?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QBE_NXZ",
            "ordinal": 965
          },
          {
            "address": "0x1002d2b0",
            "name": "??7?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QBE_NXZ",
            "ordinal": 966
          },
          {
            "address": "0x1002d2b0",
            "name": "??7?$SmartPtr@VStream@UnBCL@@@UnBCL@@QBE_NXZ",
            "ordinal": 967
          },
          {
            "address": "0x1002d2b0",
            "name": "??7?$SmartPtr@VString@UnBCL@@@UnBCL@@QBE_NXZ",
            "ordinal": 968
          },
          {
            "address": "0x1002d2b0",
            "name": "??7?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBE_NXZ",
            "ordinal": 969
          },
          {
            "address": "0x1002d2b0",
            "name": "??7?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QBE_NXZ",
            "ordinal": 970
          },
          {
            "address": "0x10030760",
            "name": "??A?$CSimpleStringT@G$0A@@ATL@@QBEGH@Z",
            "ordinal": 971
          },
          {
            "address": "0x100726f0",
            "name": "??AStringPtr@UnBCL@@UBEGH@Z",
            "ordinal": 972
          },
          {
            "address": "0x1002dce0",
            "name": "??B?$CSimpleStringT@G$0A@@ATL@@QAEAAV?$CSimpleStringT@G$00@1@XZ",
            "ordinal": 973
          },
          {
            "address": "0x100306c0",
            "name": "??B?$CSimpleStringT@G$0A@@ATL@@QBEPBGXZ",
            "ordinal": 974
          },
          {
            "address": "0x1002dce0",
            "name": "??B?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV?$CSimpleStringT@G$00@1@XZ",
            "ordinal": 975
          },
          {
            "address": "0x1003bcf0",
            "name": "??B?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
            "ordinal": 976
          },
          {
            "address": "0x1003bda0",
            "name": "??B?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
            "ordinal": 977
          },
          {
            "address": "0x1003a010",
            "name": "??B?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
            "ordinal": 978
          },
          {
            "address": "0x10031060",
            "name": "??B?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
            "ordinal": 979
          },
          {
            "address": "0x100311b0",
            "name": "??B?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
            "ordinal": 980
          },
          {
            "address": "0x1002d2c0",
            "name": "??B?$SmartPtr@VObject@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
            "ordinal": 981
          },
          {
            "address": "0x10031310",
            "name": "??B?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
            "ordinal": 982
          },
          {
            "address": "0x100313c0",
            "name": "??B?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
            "ordinal": 983
          },
          {
            "address": "0x10031260",
            "name": "??B?$SmartPtr@VStream@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
            "ordinal": 984
          },
          {
            "address": "0x10036c90",
            "name": "??B?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
            "ordinal": 985
          },
          {
            "address": "0x10051970",
            "name": "??B?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
            "ordinal": 986
          },
          {
            "address": "0x1007d100",
            "name": "??B?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
            "ordinal": 987
          },
          {
            "address": "0x10045c30",
            "name": "??BChar@UnBCL@@QAEGXZ",
            "ordinal": 988
          },
          {
            "address": "0x1002d2a0",
            "name": "??BRegHandle@UnBCL@@QAEPAUHKEY__@@XZ",
            "ordinal": 989
          },
          {
            "address": "0x10072770",
            "name": "??BStringPtr@UnBCL@@QAE?AV?$SmartPtr@VString@UnBCL@@@1@XZ",
            "ordinal": 990
          },
          {
            "address": "0x100739d0",
            "name": "??BTimeSpan@UnBCL@@QBENXZ",
            "ordinal": 991
          },
          {
            "address": "0x1002d2a0",
            "name": "??C?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBEPAV?$Array@E@1@XZ",
            "ordinal": 992
          },
          {
            "address": "0x1002d2a0",
            "name": "??C?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$Array@PAVString@UnBCL@@@1@XZ",
            "ordinal": 993
          },
          {
            "address": "0x1002d2a0",
            "name": "??C?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@1@XZ",
            "ordinal": 994
          },
          {
            "address": "0x1002d2a0",
            "name": "??C?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QBEPAVDecoder@1@XZ",
            "ordinal": 995
          },
          {
            "address": "0x1002d2a0",
            "name": "??C?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBEPAVEncoding@1@XZ",
            "ordinal": 996
          },
          {
            "address": "0x1002d2a0",
            "name": "??C?$SmartPtr@VObject@UnBCL@@@UnBCL@@QBEPAVObject@1@XZ",
            "ordinal": 997
          },
          {
            "address": "0x1002d2a0",
            "name": "??C?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QBEPAVSerializationId@1@XZ",
            "ordinal": 998
          },
          {
            "address": "0x1002d2a0",
            "name": "??C?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QBEPAVSerializationStream@1@XZ",
            "ordinal": 999
          },
          {
            "address": "0x1002d2a0",
            "name": "??C?$SmartPtr@VStream@UnBCL@@@UnBCL@@QBEPAVStream@1@XZ",
            "ordinal": 1000
          },
          {
            "address": "0x1002d2a0",
            "name": "??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEPAVString@1@XZ",
            "ordinal": 1001
          },
          {
            "address": "0x1002d2a0",
            "name": "??C?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBEPAVVersion@1@XZ",
            "ordinal": 1002
          },
          {
            "address": "0x1002d2a0",
            "name": "??C?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QBEPAVXmlNamespaceManager@1@XZ",
            "ordinal": 1003
          },
          {
            "address": "0x1002d2a0",
            "name": "??D?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBEAAV?$Array@E@1@XZ",
            "ordinal": 1004
          },
          {
            "address": "0x1002d2a0",
            "name": "??D?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEAAV?$Array@PAVString@UnBCL@@@1@XZ",
            "ordinal": 1005
          },
          {
            "address": "0x1002d2a0",
            "name": "??D?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEAAV?$ArrayList@PAVString@UnBCL@@@1@XZ",
            "ordinal": 1006
          },
          {
            "address": "0x1002d2a0",
            "name": "??D?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QBEAAVDecoder@1@XZ",
            "ordinal": 1007
          },
          {
            "address": "0x1002d2a0",
            "name": "??D?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBEAAVEncoding@1@XZ",
            "ordinal": 1008
          },
          {
            "address": "0x1002d2a0",
            "name": "??D?$SmartPtr@VObject@UnBCL@@@UnBCL@@QBEAAVObject@1@XZ",
            "ordinal": 1009
          },
          {
            "address": "0x1002d2a0",
            "name": "??D?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QBEAAVSerializationId@1@XZ",
            "ordinal": 1010
          },
          {
            "address": "0x1002d2a0",
            "name": "??D?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QBEAAVSerializationStream@1@XZ",
            "ordinal": 1011
          },
          {
            "address": "0x1002d2a0",
            "name": "??D?$SmartPtr@VStream@UnBCL@@@UnBCL@@QBEAAVStream@1@XZ",
            "ordinal": 1012
          },
          {
            "address": "0x1002d2a0",
            "name": "??D?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEAAVString@1@XZ",
            "ordinal": 1013
          },
          {
            "address": "0x1002d2a0",
            "name": "??D?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBEAAVVersion@1@XZ",
            "ordinal": 1014
          },
          {
            "address": "0x1002d2a0",
            "name": "??D?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QBEAAVXmlNamespaceManager@1@XZ",
            "ordinal": 1015
          },
          {
            "address": "0x1002f930",
            "name": "??Y?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@ABV01@@Z",
            "ordinal": 1016
          },
          {
            "address": "0x1002f880",
            "name": "??Y?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@D@Z",
            "ordinal": 1017
          },
          {
            "address": "0x1002f860",
            "name": "??Y?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@E@Z",
            "ordinal": 1018
          },
          {
            "address": "0x1002f840",
            "name": "??Y?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@G@Z",
            "ordinal": 1019
          },
          {
            "address": "0x1002f900",
            "name": "??Y?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@PBG@Z",
            "ordinal": 1020
          },
          {
            "address": "0x10030d30",
            "name": "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@ABUtagVARIANT@@@Z",
            "ordinal": 1021
          },
          {
            "address": "0x1002f930",
            "name": "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@ABV?$CSimpleStringT@G$0A@@1@@Z",
            "ordinal": 1022
          },
          {
            "address": "0x1002f880",
            "name": "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@D@Z",
            "ordinal": 1023
          },
          {
            "address": "0x1002f860",
            "name": "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@E@Z",
            "ordinal": 1024
          },
          {
            "address": "0x1002f840",
            "name": "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@G@Z",
            "ordinal": 1025
          },
          {
            "address": "0x1002f8b0",
            "name": "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@PBD@Z",
            "ordinal": 1026
          },
          {
            "address": "0x1002f900",
            "name": "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@PBG@Z",
            "ordinal": 1027
          },
          {
            "address": "0x100023d4",
            "name": "??_7?$Array@E@UnBCL@@6B01@@",
            "ordinal": 1028
          },
          {
            "address": "0x10001cbc",
            "name": "??_7?$Array@E@UnBCL@@6B?$ICollection@E@1@@",
            "ordinal": 1029
          },
          {
            "address": "0x10001738",
            "name": "??_7?$Array@E@UnBCL@@6B?$IEnumerable@E@1@@",
            "ordinal": 1030
          },
          {
            "address": "0x10001888",
            "name": "??_7?$Array@E@UnBCL@@6B?$IList@E@1@@",
            "ordinal": 1031
          },
          {
            "address": "0x10001eb4",
            "name": "??_7?$Array@E@UnBCL@@6B?$SerializableArrayBase@E@_@1@@",
            "ordinal": 1032
          },
          {
            "address": "0x10001830",
            "name": "??_7?$Array@E@UnBCL@@6B?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1033
          },
          {
            "address": "0x10001fec",
            "name": "??_7?$Array@E@UnBCL@@6BISerializable@1@@",
            "ordinal": 1034
          },
          {
            "address": "0x10001538",
            "name": "??_7?$Array@E@UnBCL@@6BObject@1@@",
            "ordinal": 1035
          },
          {
            "address": "0x100019e0",
            "name": "??_7?$Array@G@UnBCL@@6B01@@",
            "ordinal": 1036
          },
          {
            "address": "0x10002418",
            "name": "??_7?$Array@G@UnBCL@@6B?$ICollection@G@1@@",
            "ordinal": 1037
          },
          {
            "address": "0x10002140",
            "name": "??_7?$Array@G@UnBCL@@6B?$IEnumerable@G@1@@",
            "ordinal": 1038
          },
          {
            "address": "0x10001854",
            "name": "??_7?$Array@G@UnBCL@@6B?$IList@G@1@@",
            "ordinal": 1039
          },
          {
            "address": "0x10002064",
            "name": "??_7?$Array@G@UnBCL@@6B?$SerializableArrayBase@G@_@1@@",
            "ordinal": 1040
          },
          {
            "address": "0x10001a04",
            "name": "??_7?$Array@G@UnBCL@@6B?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1041
          },
          {
            "address": "0x10002284",
            "name": "??_7?$Array@G@UnBCL@@6BISerializable@1@@",
            "ordinal": 1042
          },
          {
            "address": "0x100015b8",
            "name": "??_7?$Array@G@UnBCL@@6BObject@1@@",
            "ordinal": 1043
          },
          {
            "address": "0x10002040",
            "name": "??_7?$Array@H@UnBCL@@6B01@@",
            "ordinal": 1044
          },
          {
            "address": "0x10001910",
            "name": "??_7?$Array@H@UnBCL@@6B?$ICollection@H@1@@",
            "ordinal": 1045
          },
          {
            "address": "0x10001dbc",
            "name": "??_7?$Array@H@UnBCL@@6B?$IEnumerable@H@1@@",
            "ordinal": 1046
          },
          {
            "address": "0x10001994",
            "name": "??_7?$Array@H@UnBCL@@6B?$IList@H@1@@",
            "ordinal": 1047
          },
          {
            "address": "0x10001a6c",
            "name": "??_7?$Array@H@UnBCL@@6B?$SerializableArrayBase@H@_@1@@",
            "ordinal": 1048
          },
          {
            "address": "0x100017dc",
            "name": "??_7?$Array@H@UnBCL@@6B?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1049
          },
          {
            "address": "0x10001dcc",
            "name": "??_7?$Array@H@UnBCL@@6BISerializable@1@@",
            "ordinal": 1050
          },
          {
            "address": "0x10001944",
            "name": "??_7?$Array@H@UnBCL@@6BObject@1@@",
            "ordinal": 1051
          },
          {
            "address": "0x10001b54",
            "name": "??_7?$Array@PAVObject@UnBCL@@@UnBCL@@6B01@@",
            "ordinal": 1052
          },
          {
            "address": "0x100022b4",
            "name": "??_7?$Array@PAVObject@UnBCL@@@UnBCL@@6B?$ICollection@PAVObject@UnBCL@@@1@@",
            "ordinal": 1053
          },
          {
            "address": "0x10002360",
            "name": "??_7?$Array@PAVObject@UnBCL@@@UnBCL@@6B?$IEnumerable@PAVObject@UnBCL@@@1@@",
            "ordinal": 1054
          },
          {
            "address": "0x10001fa8",
            "name": "??_7?$Array@PAVObject@UnBCL@@@UnBCL@@6B?$IList@PAVObject@UnBCL@@@1@@",
            "ordinal": 1055
          },
          {
            "address": "0x10001e80",
            "name": "??_7?$Array@PAVObject@UnBCL@@@UnBCL@@6BObject@1@@",
            "ordinal": 1056
          },
          {
            "address": "0x10001570",
            "name": "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B01@@",
            "ordinal": 1057
          },
          {
            "address": "0x1000178c",
            "name": "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B?$ICollection@PAVString@UnBCL@@@1@@",
            "ordinal": 1058
          },
          {
            "address": "0x10001b28",
            "name": "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B?$IEnumerable@PAVString@UnBCL@@@1@@",
            "ordinal": 1059
          },
          {
            "address": "0x100017ec",
            "name": "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B?$IList@PAVString@UnBCL@@@1@@",
            "ordinal": 1060
          },
          {
            "address": "0x10001e50",
            "name": "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B?$SerializableArrayBase@PAVString@UnBCL@@@_@1@@",
            "ordinal": 1061
          },
          {
            "address": "0x10001db4",
            "name": "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1062
          },
          {
            "address": "0x10002070",
            "name": "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6BISerializable@1@@",
            "ordinal": 1063
          },
          {
            "address": "0x10002148",
            "name": "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6BObject@1@@",
            "ordinal": 1064
          },
          {
            "address": "0x10002320",
            "name": "??_7?$ArrayList@G@UnBCL@@6B01@@",
            "ordinal": 1065
          },
          {
            "address": "0x1000237c",
            "name": "??_7?$ArrayList@G@UnBCL@@6B?$ICollection@G@1@@",
            "ordinal": 1066
          },
          {
            "address": "0x10001928",
            "name": "??_7?$ArrayList@G@UnBCL@@6B?$IEnumerable@G@1@@",
            "ordinal": 1067
          },
          {
            "address": "0x100020c4",
            "name": "??_7?$ArrayList@G@UnBCL@@6B?$IList@G@1@@",
            "ordinal": 1068
          },
          {
            "address": "0x10001f10",
            "name": "??_7?$ArrayList@G@UnBCL@@6B?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1069
          },
          {
            "address": "0x10001930",
            "name": "??_7?$ArrayList@G@UnBCL@@6BISerializable@1@@",
            "ordinal": 1070
          },
          {
            "address": "0x10001b30",
            "name": "??_7?$ArrayList@G@UnBCL@@6BObject@1@@",
            "ordinal": 1071
          },
          {
            "address": "0x10002000",
            "name": "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6B01@@",
            "ordinal": 1072
          },
          {
            "address": "0x1000197c",
            "name": "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6B?$ICollection@PAVString@UnBCL@@@1@@",
            "ordinal": 1073
          },
          {
            "address": "0x10002368",
            "name": "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6B?$IEnumerable@PAVString@UnBCL@@@1@@",
            "ordinal": 1074
          },
          {
            "address": "0x10001ce8",
            "name": "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6B?$IList@PAVString@UnBCL@@@1@@",
            "ordinal": 1075
          },
          {
            "address": "0x10001740",
            "name": "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6B?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1076
          },
          {
            "address": "0x10001624",
            "name": "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6BISerializable@1@@",
            "ordinal": 1077
          },
          {
            "address": "0x1000222c",
            "name": "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6BObject@1@@",
            "ordinal": 1078
          },
          {
            "address": "0x1000271c",
            "name": "??_7?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@6B01@@",
            "ordinal": 1079
          },
          {
            "address": "0x10002710",
            "name": "??_7?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@6B?$ICollection@PAVObject@UnBCL@@@1@@",
            "ordinal": 1080
          },
          {
            "address": "0x10002728",
            "name": "??_7?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@6B?$IEnumerable@PAVObject@UnBCL@@@1@@",
            "ordinal": 1081
          },
          {
            "address": "0x100026b8",
            "name": "??_7?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@6B?$IList@PAVObject@UnBCL@@@1@@",
            "ordinal": 1082
          },
          {
            "address": "0x100026ec",
            "name": "??_7?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@6BObject@1@@",
            "ordinal": 1083
          },
          {
            "address": "0x10002ab4",
            "name": "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6B01@@",
            "ordinal": 1084
          },
          {
            "address": "0x10002bd0",
            "name": "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6B?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@1@@",
            "ordinal": 1085
          },
          {
            "address": "0x10002d0c",
            "name": "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6B?$IDictionary@PAVString@UnBCL@@PAV12@@1@@",
            "ordinal": 1086
          },
          {
            "address": "0x10002b64",
            "name": "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6B?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@1@@",
            "ordinal": 1087
          },
          {
            "address": "0x10002d04",
            "name": "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6B?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1088
          },
          {
            "address": "0x100029e4",
            "name": "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6BISerializable@1@@",
            "ordinal": 1089
          },
          {
            "address": "0x10002ce0",
            "name": "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6BObject@1@@",
            "ordinal": 1090
          },
          {
            "address": "0x10001758",
            "name": "??_7?$SerializableArrayBase@E@_@UnBCL@@6B?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@",
            "ordinal": 1091
          },
          {
            "address": "0x1000172c",
            "name": "??_7?$SerializableArrayBase@E@_@UnBCL@@6B@",
            "ordinal": 1092
          },
          {
            "address": "0x10001ec8",
            "name": "??_7?$SerializableArrayBase@E@_@UnBCL@@6BISerializable@2@@",
            "ordinal": 1093
          },
          {
            "address": "0x10001a48",
            "name": "??_7?$SerializableArrayBase@E@_@UnBCL@@6BObject@2@@",
            "ordinal": 1094
          },
          {
            "address": "0x10001840",
            "name": "??_7?$SerializableArrayBase@G@_@UnBCL@@6B?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@",
            "ordinal": 1095
          },
          {
            "address": "0x1000191c",
            "name": "??_7?$SerializableArrayBase@G@_@UnBCL@@6B@",
            "ordinal": 1096
          },
          {
            "address": "0x10001b88",
            "name": "??_7?$SerializableArrayBase@G@_@UnBCL@@6BISerializable@2@@",
            "ordinal": 1097
          },
          {
            "address": "0x10001b04",
            "name": "??_7?$SerializableArrayBase@G@_@UnBCL@@6BObject@2@@",
            "ordinal": 1098
          },
          {
            "address": "0x10001d68",
            "name": "??_7?$SerializableArrayBase@H@_@UnBCL@@6B?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@",
            "ordinal": 1099
          },
          {
            "address": "0x10002278",
            "name": "??_7?$SerializableArrayBase@H@_@UnBCL@@6B@",
            "ordinal": 1100
          },
          {
            "address": "0x10002388",
            "name": "??_7?$SerializableArrayBase@H@_@UnBCL@@6BISerializable@2@@",
            "ordinal": 1101
          },
          {
            "address": "0x10001aac",
            "name": "??_7?$SerializableArrayBase@H@_@UnBCL@@6BObject@2@@",
            "ordinal": 1102
          },
          {
            "address": "0x10001530",
            "name": "??_7?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@6B?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@",
            "ordinal": 1103
          },
          {
            "address": "0x100023f8",
            "name": "??_7?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@6B@",
            "ordinal": 1104
          },
          {
            "address": "0x10001968",
            "name": "??_7?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@6BISerializable@2@@",
            "ordinal": 1105
          },
          {
            "address": "0x10001f60",
            "name": "??_7?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@6BObject@2@@",
            "ordinal": 1106
          },
          {
            "address": "0x10001aa0",
            "name": "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6B?$ICollection@PAVString@UnBCL@@@2@@",
            "ordinal": 1107
          },
          {
            "address": "0x10001e14",
            "name": "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6B?$IEnumerable@PAVString@UnBCL@@@2@@",
            "ordinal": 1108
          },
          {
            "address": "0x100016f8",
            "name": "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6B?$IList@PAVString@UnBCL@@@2@@",
            "ordinal": 1109
          },
          {
            "address": "0x10002224",
            "name": "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6B?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@",
            "ordinal": 1110
          },
          {
            "address": "0x10002208",
            "name": "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6BISerializable@2@@",
            "ordinal": 1111
          },
          {
            "address": "0x10001a0c",
            "name": "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6BObject@2@@",
            "ordinal": 1112
          },
          {
            "address": "0x1000240c",
            "name": "??_7?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@6B?$ICollection@G@2@@",
            "ordinal": 1113
          },
          {
            "address": "0x100021f8",
            "name": "??_7?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@6B?$IEnumerable@G@2@@",
            "ordinal": 1114
          },
          {
            "address": "0x10001edc",
            "name": "??_7?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@6B?$IList@G@2@@",
            "ordinal": 1115
          },
          {
            "address": "0x10001bd4",
            "name": "??_7?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@6B?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@",
            "ordinal": 1116
          },
          {
            "address": "0x10001bc0",
            "name": "??_7?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@6BISerializable@2@@",
            "ordinal": 1117
          },
          {
            "address": "0x100016d4",
            "name": "??_7?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@6BObject@2@@",
            "ordinal": 1118
          },
          {
            "address": "0x10002404",
            "name": "??_7?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
            "ordinal": 1119
          },
          {
            "address": "0x1000155c",
            "name": "??_7?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
            "ordinal": 1120
          },
          {
            "address": "0x10001594",
            "name": "??_7?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
            "ordinal": 1121
          },
          {
            "address": "0x10001f58",
            "name": "??_7?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
            "ordinal": 1122
          },
          {
            "address": "0x100018fc",
            "name": "??_7?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
            "ordinal": 1123
          },
          {
            "address": "0x100015dc",
            "name": "??_7?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
            "ordinal": 1124
          },
          {
            "address": "0x10001fdc",
            "name": "??_7?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
            "ordinal": 1125
          },
          {
            "address": "0x10001c48",
            "name": "??_7?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
            "ordinal": 1126
          },
          {
            "address": "0x1000165c",
            "name": "??_7?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
            "ordinal": 1127
          },
          {
            "address": "0x10002200",
            "name": "??_7?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
            "ordinal": 1128
          },
          {
            "address": "0x10001cc8",
            "name": "??_7?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
            "ordinal": 1129
          },
          {
            "address": "0x10001e5c",
            "name": "??_7?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
            "ordinal": 1130
          },
          {
            "address": "0x100021e0",
            "name": "??_7?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
            "ordinal": 1131
          },
          {
            "address": "0x100023c0",
            "name": "??_7?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
            "ordinal": 1132
          },
          {
            "address": "0x100022fc",
            "name": "??_7?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
            "ordinal": 1133
          },
          {
            "address": "0x100022ac",
            "name": "??_7?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
            "ordinal": 1134
          },
          {
            "address": "0x10001c24",
            "name": "??_7?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
            "ordinal": 1135
          },
          {
            "address": "0x10001f18",
            "name": "??_7?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
            "ordinal": 1136
          },
          {
            "address": "0x100029c8",
            "name": "??_7?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
            "ordinal": 1137
          },
          {
            "address": "0x10002978",
            "name": "??_7?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
            "ordinal": 1138
          },
          {
            "address": "0x100029f8",
            "name": "??_7?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
            "ordinal": 1139
          },
          {
            "address": "0x10003938",
            "name": "??_7?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
            "ordinal": 1140
          },
          {
            "address": "0x100039fc",
            "name": "??_7?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
            "ordinal": 1141
          },
          {
            "address": "0x10003960",
            "name": "??_7?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
            "ordinal": 1142
          },
          {
            "address": "0x100030f8",
            "name": "??_7?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@6B01@@",
            "ordinal": 1143
          },
          {
            "address": "0x10002f00",
            "name": "??_7?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@6BISerializable@1@@",
            "ordinal": 1144
          },
          {
            "address": "0x100030cc",
            "name": "??_7?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@6BObject@1@@",
            "ordinal": 1145
          },
          {
            "address": "0x100029c0",
            "name": "??_7?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@6B01@@",
            "ordinal": 1146
          },
          {
            "address": "0x100029d0",
            "name": "??_7?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@6BISerializable@1@@",
            "ordinal": 1147
          },
          {
            "address": "0x10002a6c",
            "name": "??_7?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@6BObject@1@@",
            "ordinal": 1148
          },
          {
            "address": "0x10002bec",
            "name": "??_7?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
            "ordinal": 1149
          },
          {
            "address": "0x10002d68",
            "name": "??_7?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
            "ordinal": 1150
          },
          {
            "address": "0x10002c2c",
            "name": "??_7?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
            "ordinal": 1151
          },
          {
            "address": "0x10002adc",
            "name": "??_7?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@6B?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@2@@",
            "ordinal": 1152
          },
          {
            "address": "0x10002d60",
            "name": "??_7?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@6B?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@2@@",
            "ordinal": 1153
          },
          {
            "address": "0x10002a64",
            "name": "??_7?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@6B?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@",
            "ordinal": 1154
          },
          {
            "address": "0x10002bfc",
            "name": "??_7?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@6B@",
            "ordinal": 1155
          },
          {
            "address": "0x10002af8",
            "name": "??_7?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@6BISerializable@2@@",
            "ordinal": 1156
          },
          {
            "address": "0x10002b88",
            "name": "??_7?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@6BObject@2@@",
            "ordinal": 1157
          },
          {
            "address": "0x1000392c",
            "name": "??_7?$SerializableStackBase@H@_@UnBCL@@6B?$ICollection@H@2@@",
            "ordinal": 1158
          },
          {
            "address": "0x1000398c",
            "name": "??_7?$SerializableStackBase@H@_@UnBCL@@6B?$IEnumerable@H@2@@",
            "ordinal": 1159
          },
          {
            "address": "0x10003958",
            "name": "??_7?$SerializableStackBase@H@_@UnBCL@@6B?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@",
            "ordinal": 1160
          },
          {
            "address": "0x100039c4",
            "name": "??_7?$SerializableStackBase@H@_@UnBCL@@6B@",
            "ordinal": 1161
          },
          {
            "address": "0x10003a1c",
            "name": "??_7?$SerializableStackBase@H@_@UnBCL@@6BISerializable@2@@",
            "ordinal": 1162
          },
          {
            "address": "0x10003908",
            "name": "??_7?$SerializableStackBase@H@_@UnBCL@@6BObject@2@@",
            "ordinal": 1163
          },
          {
            "address": "0x10001cb4",
            "name": "??_7?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@6B@",
            "ordinal": 1164
          },
          {
            "address": "0x10001dc4",
            "name": "??_7?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@6B@",
            "ordinal": 1165
          },
          {
            "address": "0x10001e1c",
            "name": "??_7?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@6B@",
            "ordinal": 1166
          },
          {
            "address": "0x10001420",
            "name": "??_7?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@6B@",
            "ordinal": 1167
          },
          {
            "address": "0x100013ec",
            "name": "??_7?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@6B@",
            "ordinal": 1168
          },
          {
            "address": "0x100011d8",
            "name": "??_7?$SmartPtr@VObject@UnBCL@@@UnBCL@@6B@",
            "ordinal": 1169
          },
          {
            "address": "0x1000128c",
            "name": "??_7?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@6B@",
            "ordinal": 1170
          },
          {
            "address": "0x10001380",
            "name": "??_7?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@6B@",
            "ordinal": 1171
          },
          {
            "address": "0x10001294",
            "name": "??_7?$SmartPtr@VStream@UnBCL@@@UnBCL@@6B@",
            "ordinal": 1172
          },
          {
            "address": "0x10001eac",
            "name": "??_7?$SmartPtr@VString@UnBCL@@@UnBCL@@6B@",
            "ordinal": 1173
          },
          {
            "address": "0x10002a38",
            "name": "??_7?$SmartPtr@VVersion@UnBCL@@@UnBCL@@6B@",
            "ordinal": 1174
          },
          {
            "address": "0x10003e24",
            "name": "??_7?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@6B@",
            "ordinal": 1175
          },
          {
            "address": "0x100038a4",
            "name": "??_7?$Stack@H@UnBCL@@6B01@@",
            "ordinal": 1176
          },
          {
            "address": "0x1000394c",
            "name": "??_7?$Stack@H@UnBCL@@6B?$ICollection@H@1@@",
            "ordinal": 1177
          },
          {
            "address": "0x100038c8",
            "name": "??_7?$Stack@H@UnBCL@@6B?$IEnumerable@H@1@@",
            "ordinal": 1178
          },
          {
            "address": "0x1000389c",
            "name": "??_7?$Stack@H@UnBCL@@6B?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1179
          },
          {
            "address": "0x10003994",
            "name": "??_7?$Stack@H@UnBCL@@6B?$SerializableStackBase@H@_@1@@",
            "ordinal": 1180
          },
          {
            "address": "0x100038f4",
            "name": "??_7?$Stack@H@UnBCL@@6BISerializable@1@@",
            "ordinal": 1181
          },
          {
            "address": "0x100039a0",
            "name": "??_7?$Stack@H@UnBCL@@6BObject@1@@",
            "ordinal": 1182
          },
          {
            "address": "0x100039d0",
            "name": "??_7?$Stack@PAVObject@UnBCL@@@UnBCL@@6B01@@",
            "ordinal": 1183
          },
          {
            "address": "0x10003a10",
            "name": "??_7?$Stack@PAVObject@UnBCL@@@UnBCL@@6B?$ICollection@PAVObject@UnBCL@@@1@@",
            "ordinal": 1184
          },
          {
            "address": "0x10003984",
            "name": "??_7?$Stack@PAVObject@UnBCL@@@UnBCL@@6B?$IEnumerable@PAVObject@UnBCL@@@1@@",
            "ordinal": 1185
          },
          {
            "address": "0x100038d0",
            "name": "??_7?$Stack@PAVObject@UnBCL@@@UnBCL@@6BObject@1@@",
            "ordinal": 1186
          },
          {
            "address": "0x10002478",
            "name": "??_7ASCIIEncoding@UnBCL@@6BEncoding@1@@",
            "ordinal": 1187
          },
          {
            "address": "0x10002454",
            "name": "??_7ASCIIEncoding@UnBCL@@6BObject@1@@",
            "ordinal": 1188
          },
          {
            "address": "0x1000110c",
            "name": "??_7AbandonedMutexException@UnBCL@@6B@",
            "ordinal": 1189
          },
          {
            "address": "0x10001464",
            "name": "??_7ApplicationException@UnBCL@@6B@",
            "ordinal": 1190
          },
          {
            "address": "0x10001150",
            "name": "??_7ArgumentException@UnBCL@@6B@",
            "ordinal": 1191
          },
          {
            "address": "0x100010c8",
            "name": "??_7ArgumentNullException@UnBCL@@6B@",
            "ordinal": 1192
          },
          {
            "address": "0x100014a8",
            "name": "??_7ArgumentOutOfRangeException@UnBCL@@6B@",
            "ordinal": 1193
          },
          {
            "address": "0x100014ec",
            "name": "??_7ArithmeticException@UnBCL@@6B@",
            "ordinal": 1194
          },
          {
            "address": "0x1000268c",
            "name": "??_7BufferedStream@UnBCL@@6BIDisposable@1@@",
            "ordinal": 1195
          },
          {
            "address": "0x100025e0",
            "name": "??_7BufferedStream@UnBCL@@6BObject@1@@",
            "ordinal": 1196
          },
          {
            "address": "0x10002544",
            "name": "??_7BufferedStream@UnBCL@@6BStream@1@@",
            "ordinal": 1197
          },
          {
            "address": "0x100021e8",
            "name": "??_7CaseInsensitiveStringComparer@UnBCL@@6B?$IComparer@PAVString@UnBCL@@@1@@",
            "ordinal": 1198
          },
          {
            "address": "0x10001b9c",
            "name": "??_7CaseInsensitiveStringComparer@UnBCL@@6BObject@1@@",
            "ordinal": 1199
          },
          {
            "address": "0x10002694",
            "name": "??_7Char@UnBCL@@6B@",
            "ordinal": 1200
          },
          {
            "address": "0x100013e4",
            "name": "??_7ConsoleLogHandler@UnBCL@@6B@",
            "ordinal": 1201
          },
          {
            "address": "0x10002730",
            "name": "??_7DateTime@UnBCL@@6B@",
            "ordinal": 1202
          },
          {
            "address": "0x10001388",
            "name": "??_7Decoder@UnBCL@@6B01@@",
            "ordinal": 1203
          },
          {
            "address": "0x10001394",
            "name": "??_7Decoder@UnBCL@@6BObject@1@@",
            "ordinal": 1204
          },
          {
            "address": "0x10003bb8",
            "name": "??_7Delegate@UnBCL@@6B@",
            "ordinal": 1205
          },
          {
            "address": "0x10002570",
            "name": "??_7DirectoryInfo@UnBCL@@6B@",
            "ordinal": 1206
          },
          {
            "address": "0x10001428",
            "name": "??_7Encoding@UnBCL@@6B01@@",
            "ordinal": 1207
          },
          {
            "address": "0x100012f4",
            "name": "??_7Encoding@UnBCL@@6BObject@1@@",
            "ordinal": 1208
          },
          {
            "address": "0x10001224",
            "name": "??_7Exception@UnBCL@@6B@",
            "ordinal": 1209
          },
          {
            "address": "0x10002648",
            "name": "??_7ExternalException@UnBCL@@6B@",
            "ordinal": 1210
          },
          {
            "address": "0x100025d8",
            "name": "??_7FileStream@UnBCL@@6BIDisposable@1@@",
            "ordinal": 1211
          },
          {
            "address": "0x100024ac",
            "name": "??_7FileStream@UnBCL@@6BObject@1@@",
            "ordinal": 1212
          },
          {
            "address": "0x100024d0",
            "name": "??_7FileStream@UnBCL@@6BStream@1@@",
            "ordinal": 1213
          },
          {
            "address": "0x10002df8",
            "name": "??_7FileSystemEnumerator@UnBCL@@6B?$IEnumerator@PAVString@UnBCL@@@1@@",
            "ordinal": 1214
          },
          {
            "address": "0x10002e0c",
            "name": "??_7FileSystemEnumerator@UnBCL@@6BObject@1@@",
            "ordinal": 1215
          },
          {
            "address": "0x10002e30",
            "name": "??_7FormatException@UnBCL@@6B@",
            "ordinal": 1216
          },
          {
            "address": "0x1000129c",
            "name": "??_7HeapMemoryManager@UnBCL@@6B@",
            "ordinal": 1217
          },
          {
            "address": "0x10002e74",
            "name": "??_7IndexOutOfRangeException@UnBCL@@6B@",
            "ordinal": 1218
          },
          {
            "address": "0x100011e0",
            "name": "??_7InvalidCastException@UnBCL@@6B@",
            "ordinal": 1219
          },
          {
            "address": "0x10001d70",
            "name": "??_7InvalidOperationException@UnBCL@@6B@",
            "ordinal": 1220
          },
          {
            "address": "0x1000145c",
            "name": "??_7MemoryStream@UnBCL@@6BIDisposable@1@@",
            "ordinal": 1221
          },
          {
            "address": "0x1000135c",
            "name": "??_7MemoryStream@UnBCL@@6BObject@1@@",
            "ordinal": 1222
          },
          {
            "address": "0x10001318",
            "name": "??_7MemoryStream@UnBCL@@6BStream@1@@",
            "ordinal": 1223
          },
          {
            "address": "0x10002eb8",
            "name": "??_7Monitor@UnBCL@@6B@",
            "ordinal": 1224
          },
          {
            "address": "0x1000300c",
            "name": "??_7MultiSz@UnBCL@@6B?$IEnumerable@PBG@1@@",
            "ordinal": 1225
          },
          {
            "address": "0x100030f0",
            "name": "??_7MultiSz@UnBCL@@6B?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@1@@",
            "ordinal": 1226
          },
          {
            "address": "0x10002ee4",
            "name": "??_7MultiSz@UnBCL@@6BISerializable@1@@",
            "ordinal": 1227
          },
          {
            "address": "0x10003108",
            "name": "??_7MultiSz@UnBCL@@6BObject@1@@",
            "ordinal": 1228
          },
          {
            "address": "0x10001268",
            "name": "??_7MutableString@UnBCL@@6B@",
            "ordinal": 1229
          },
          {
            "address": "0x10003178",
            "name": "??_7Mutex@UnBCL@@6B@",
            "ordinal": 1230
          },
          {
            "address": "0x10003188",
            "name": "??_7Mutex@UnBCL@@6BIDisposable@1@@",
            "ordinal": 1231
          },
          {
            "address": "0x10003144",
            "name": "??_7Mutex@UnBCL@@6BObject@1@@",
            "ordinal": 1232
          },
          {
            "address": "0x10003168",
            "name": "??_7Mutex@UnBCL@@6BWaitHandle@1@@",
            "ordinal": 1233
          },
          {
            "address": "0x10001798",
            "name": "??_7NotSupportedException@UnBCL@@6B@",
            "ordinal": 1234
          },
          {
            "address": "0x100031c4",
            "name": "??_7Object@UnBCL@@6B@",
            "ordinal": 1235
          },
          {
            "address": "0x10002594",
            "name": "??_7ObjectDisposedException@UnBCL@@6B@",
            "ordinal": 1236
          },
          {
            "address": "0x10003230",
            "name": "??_7OperatingSystem@UnBCL@@6B?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@1@@",
            "ordinal": 1237
          },
          {
            "address": "0x1000320c",
            "name": "??_7OperatingSystem@UnBCL@@6B@",
            "ordinal": 1238
          },
          {
            "address": "0x10003238",
            "name": "??_7OperatingSystem@UnBCL@@6BISerializable@1@@",
            "ordinal": 1239
          },
          {
            "address": "0x10002db4",
            "name": "??_7OutOfMemoryException@UnBCL@@6B@",
            "ordinal": 1240
          },
          {
            "address": "0x10002500",
            "name": "??_7OverflowException@UnBCL@@6B@",
            "ordinal": 1241
          },
          {
            "address": "0x100027ac",
            "name": "??_7PathTooLongException@UnBCL@@6B@",
            "ordinal": 1242
          },
          {
            "address": "0x10003278",
            "name": "??_7Process@UnBCL@@6B@",
            "ordinal": 1243
          },
          {
            "address": "0x1000324c",
            "name": "??_7Process@UnBCL@@6BIDisposable@1@@",
            "ordinal": 1244
          },
          {
            "address": "0x10003254",
            "name": "??_7ProcessStartInfo@UnBCL@@6B@",
            "ordinal": 1245
          },
          {
            "address": "0x1000329c",
            "name": "??_7RegHandle@UnBCL@@6B@",
            "ordinal": 1246
          },
          {
            "address": "0x1000335c",
            "name": "??_7RegSubkeyEnumerator@UnBCL@@6B?$IEnumerator@PBG@1@@",
            "ordinal": 1247
          },
          {
            "address": "0x1000336c",
            "name": "??_7RegSubkeyEnumerator@UnBCL@@6B@",
            "ordinal": 1248
          },
          {
            "address": "0x100032c0",
            "name": "??_7Registry@UnBCL@@6B@",
            "ordinal": 1249
          },
          {
            "address": "0x10003308",
            "name": "??_7RegistryKey@UnBCL@@6BIDisposable@1@@",
            "ordinal": 1250
          },
          {
            "address": "0x100032e4",
            "name": "??_7RegistryKey@UnBCL@@6BObject@1@@",
            "ordinal": 1251
          },
          {
            "address": "0x10003390",
            "name": "??_7SEHException@UnBCL@@6B@",
            "ordinal": 1252
          },
          {
            "address": "0x10003310",
            "name": "??_7SecurityException@UnBCL@@6B@",
            "ordinal": 1253
          },
          {
            "address": "0x100033d4",
            "name": "??_7SerializationException@UnBCL@@6B@",
            "ordinal": 1254
          },
          {
            "address": "0x100012d0",
            "name": "??_7SerializationId@UnBCL@@6B@",
            "ordinal": 1255
          },
          {
            "address": "0x1000359c",
            "name": "??_7SerializationStream@UnBCL@@6B@",
            "ordinal": 1256
          },
          {
            "address": "0x100013b8",
            "name": "??_7Stream@UnBCL@@6B01@@",
            "ordinal": 1257
          },
          {
            "address": "0x10001418",
            "name": "??_7Stream@UnBCL@@6BIDisposable@1@@",
            "ordinal": 1258
          },
          {
            "address": "0x100013f4",
            "name": "??_7Stream@UnBCL@@6BObject@1@@",
            "ordinal": 1259
          },
          {
            "address": "0x10003a30",
            "name": "??_7StreamReader@UnBCL@@6B@",
            "ordinal": 1260
          },
          {
            "address": "0x10003a4c",
            "name": "??_7StreamReader@UnBCL@@6BIDisposable@1@@",
            "ordinal": 1261
          },
          {
            "address": "0x10003a54",
            "name": "??_7StreamReader@UnBCL@@6BObject@1@@",
            "ordinal": 1262
          },
          {
            "address": "0x10003b28",
            "name": "??_7StreamWriter@UnBCL@@6B@",
            "ordinal": 1263
          },
          {
            "address": "0x10003b50",
            "name": "??_7StreamWriter@UnBCL@@6BIDisposable@1@@",
            "ordinal": 1264
          },
          {
            "address": "0x10003ad4",
            "name": "??_7StreamWriter@UnBCL@@6BObject@1@@",
            "ordinal": 1265
          },
          {
            "address": "0x10003b58",
            "name": "??_7String@UnBCL@@6B@",
            "ordinal": 1266
          },
          {
            "address": "0x10002c98",
            "name": "??_7StringBuilder@UnBCL@@6B@",
            "ordinal": 1267
          },
          {
            "address": "0x10003b84",
            "name": "??_7StringPtr@UnBCL@@6B01@@",
            "ordinal": 1268
          },
          {
            "address": "0x10003b8c",
            "name": "??_7StringPtr@UnBCL@@6B?$SmartPtr@VString@UnBCL@@@1@@",
            "ordinal": 1269
          },
          {
            "address": "0x100031e8",
            "name": "??_7SyncObject@UnBCL@@6B@",
            "ordinal": 1270
          },
          {
            "address": "0x10001194",
            "name": "??_7SystemException@UnBCL@@6B@",
            "ordinal": 1271
          },
          {
            "address": "0x10002b40",
            "name": "??_7SystemInfo@UnBCL@@6B@",
            "ordinal": 1272
          },
          {
            "address": "0x10003a78",
            "name": "??_7TextReader@UnBCL@@6B@",
            "ordinal": 1273
          },
          {
            "address": "0x10003a44",
            "name": "??_7TextReader@UnBCL@@6BIDisposable@1@@",
            "ordinal": 1274
          },
          {
            "address": "0x10003a8c",
            "name": "??_7TextReader@UnBCL@@6BObject@1@@",
            "ordinal": 1275
          },
          {
            "address": "0x10003af8",
            "name": "??_7TextWriter@UnBCL@@6B@",
            "ordinal": 1276
          },
          {
            "address": "0x10003b20",
            "name": "??_7TextWriter@UnBCL@@6BIDisposable@1@@",
            "ordinal": 1277
          },
          {
            "address": "0x10003ab0",
            "name": "??_7TextWriter@UnBCL@@6BObject@1@@",
            "ordinal": 1278
          },
          {
            "address": "0x10003b94",
            "name": "??_7Thread@UnBCL@@6B@",
            "ordinal": 1279
          },
          {
            "address": "0x10003bdc",
            "name": "??_7ThreadStateException@UnBCL@@6B@",
            "ordinal": 1280
          },
          {
            "address": "0x10003c20",
            "name": "??_7TimeSpan@UnBCL@@6B@",
            "ordinal": 1281
          },
          {
            "address": "0x10002d84",
            "name": "??_7Type@UnBCL@@6B@",
            "ordinal": 1282
          },
          {
            "address": "0x10002944",
            "name": "??_7UnicodeEncoding@UnBCL@@6BEncoding@1@@",
            "ordinal": 1283
          },
          {
            "address": "0x10002920",
            "name": "??_7UnicodeEncoding@UnBCL@@6BObject@1@@",
            "ordinal": 1284
          },
          {
            "address": "0x10003cac",
            "name": "??_7Version@UnBCL@@6B?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1285
          },
          {
            "address": "0x10003c88",
            "name": "??_7Version@UnBCL@@6B@",
            "ordinal": 1286
          },
          {
            "address": "0x10003c74",
            "name": "??_7Version@UnBCL@@6BISerializable@1@@",
            "ordinal": 1287
          },
          {
            "address": "0x100031b4",
            "name": "??_7WaitHandle@UnBCL@@6B01@@",
            "ordinal": 1288
          },
          {
            "address": "0x10003180",
            "name": "??_7WaitHandle@UnBCL@@6BIDisposable@1@@",
            "ordinal": 1289
          },
          {
            "address": "0x10003190",
            "name": "??_7WaitHandle@UnBCL@@6BObject@1@@",
            "ordinal": 1290
          },
          {
            "address": "0x10002604",
            "name": "??_7Win32Exception@UnBCL@@6B@",
            "ordinal": 1291
          },
          {
            "address": "0x10003fe0",
            "name": "??_7XPathException@UnBCL@@6B@",
            "ordinal": 1292
          },
          {
            "address": "0x10004108",
            "name": "??_7XmlAttribute@UnBCL@@6B@",
            "ordinal": 1293
          },
          {
            "address": "0x10003f64",
            "name": "??_7XmlAttribute@XmlLite@UnBCL@@6B@",
            "ordinal": 1294
          },
          {
            "address": "0x10003fac",
            "name": "??_7XmlAttributeCollection@UnBCL@@6B@",
            "ordinal": 1295
          },
          {
            "address": "0x100041f0",
            "name": "??_7XmlAttributeCollection@XmlLite@UnBCL@@6B@",
            "ordinal": 1296
          },
          {
            "address": "0x10003e50",
            "name": "??_7XmlDocument@UnBCL@@6B@",
            "ordinal": 1297
          },
          {
            "address": "0x10003e2c",
            "name": "??_7XmlDocument@XmlLite@UnBCL@@6B@",
            "ordinal": 1298
          },
          {
            "address": "0x10004180",
            "name": "??_7XmlException@UnBCL@@6B@",
            "ordinal": 1299
          },
          {
            "address": "0x10003ea8",
            "name": "??_7XmlNamespaceManager@UnBCL@@6B@",
            "ordinal": 1300
          },
          {
            "address": "0x10004084",
            "name": "??_7XmlNode@UnBCL@@6B@",
            "ordinal": 1301
          },
          {
            "address": "0x10003f88",
            "name": "??_7XmlNode@XmlLite@UnBCL@@6B@",
            "ordinal": 1302
          },
          {
            "address": "0x10003ecc",
            "name": "??_7XmlNodeList@UnBCL@@6B@",
            "ordinal": 1303
          },
          {
            "address": "0x10003e00",
            "name": "??_7XmlNodeList@XmlLite@UnBCL@@6B@",
            "ordinal": 1304
          },
          {
            "address": "0x10003f1c",
            "name": "??_7XmlSchemaSet@UnBCL@@6B@",
            "ordinal": 1305
          },
          {
            "address": "0x10013d58",
            "name": "??_8?$Array@E@UnBCL@@7B?$ICollection@E@1@@",
            "ordinal": 1306
          },
          {
            "address": "0x10013d98",
            "name": "??_8?$Array@E@UnBCL@@7B?$IList@E@1@@",
            "ordinal": 1307
          },
          {
            "address": "0x10013da8",
            "name": "??_8?$Array@E@UnBCL@@7B?$SerializableArrayBase@E@_@1@@",
            "ordinal": 1308
          },
          {
            "address": "0x10013d64",
            "name": "??_8?$Array@E@UnBCL@@7B?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1309
          },
          {
            "address": "0x10013d78",
            "name": "??_8?$Array@E@UnBCL@@7B@",
            "ordinal": 1310
          },
          {
            "address": "0x10013d70",
            "name": "??_8?$Array@E@UnBCL@@7BISerializable@1@@",
            "ordinal": 1311
          },
          {
            "address": "0x10013d58",
            "name": "??_8?$Array@G@UnBCL@@7B?$ICollection@G@1@@",
            "ordinal": 1312
          },
          {
            "address": "0x10013d98",
            "name": "??_8?$Array@G@UnBCL@@7B?$IList@G@1@@",
            "ordinal": 1313
          },
          {
            "address": "0x10013da8",
            "name": "??_8?$Array@G@UnBCL@@7B?$SerializableArrayBase@G@_@1@@",
            "ordinal": 1314
          },
          {
            "address": "0x10013d64",
            "name": "??_8?$Array@G@UnBCL@@7B?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1315
          },
          {
            "address": "0x10013d78",
            "name": "??_8?$Array@G@UnBCL@@7B@",
            "ordinal": 1316
          },
          {
            "address": "0x10013d70",
            "name": "??_8?$Array@G@UnBCL@@7BISerializable@1@@",
            "ordinal": 1317
          },
          {
            "address": "0x10013d58",
            "name": "??_8?$Array@H@UnBCL@@7B?$ICollection@H@1@@",
            "ordinal": 1318
          },
          {
            "address": "0x10013d98",
            "name": "??_8?$Array@H@UnBCL@@7B?$IList@H@1@@",
            "ordinal": 1319
          },
          {
            "address": "0x10013da8",
            "name": "??_8?$Array@H@UnBCL@@7B?$SerializableArrayBase@H@_@1@@",
            "ordinal": 1320
          },
          {
            "address": "0x10013d64",
            "name": "??_8?$Array@H@UnBCL@@7B?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1321
          },
          {
            "address": "0x10013d78",
            "name": "??_8?$Array@H@UnBCL@@7B@",
            "ordinal": 1322
          },
          {
            "address": "0x10013d70",
            "name": "??_8?$Array@H@UnBCL@@7BISerializable@1@@",
            "ordinal": 1323
          },
          {
            "address": "0x10013d58",
            "name": "??_8?$Array@PAVObject@UnBCL@@@UnBCL@@7B?$ICollection@PAVObject@UnBCL@@@1@@",
            "ordinal": 1324
          },
          {
            "address": "0x10013d98",
            "name": "??_8?$Array@PAVObject@UnBCL@@@UnBCL@@7B?$IList@PAVObject@UnBCL@@@1@@",
            "ordinal": 1325
          },
          {
            "address": "0x10013df8",
            "name": "??_8?$Array@PAVObject@UnBCL@@@UnBCL@@7B@",
            "ordinal": 1326
          },
          {
            "address": "0x10013d58",
            "name": "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7B?$ICollection@PAVString@UnBCL@@@1@@",
            "ordinal": 1327
          },
          {
            "address": "0x10013d98",
            "name": "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7B?$IList@PAVString@UnBCL@@@1@@",
            "ordinal": 1328
          },
          {
            "address": "0x10013da8",
            "name": "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7B?$SerializableArrayBase@PAVString@UnBCL@@@_@1@@",
            "ordinal": 1329
          },
          {
            "address": "0x10013d64",
            "name": "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7B?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1330
          },
          {
            "address": "0x10013d78",
            "name": "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7B@",
            "ordinal": 1331
          },
          {
            "address": "0x10013d70",
            "name": "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7BISerializable@1@@",
            "ordinal": 1332
          },
          {
            "address": "0x10013d58",
            "name": "??_8?$ArrayList@G@UnBCL@@7B?$ICollection@G@1@@",
            "ordinal": 1333
          },
          {
            "address": "0x10013d98",
            "name": "??_8?$ArrayList@G@UnBCL@@7B?$IList@G@1@@",
            "ordinal": 1334
          },
          {
            "address": "0x10013d3c",
            "name": "??_8?$ArrayList@G@UnBCL@@7B?$SerializableArrayListPrimitiveBase@G@_@1@@",
            "ordinal": 1335
          },
          {
            "address": "0x10013d64",
            "name": "??_8?$ArrayList@G@UnBCL@@7B?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1336
          },
          {
            "address": "0x10013db8",
            "name": "??_8?$ArrayList@G@UnBCL@@7B@",
            "ordinal": 1337
          },
          {
            "address": "0x10013d70",
            "name": "??_8?$ArrayList@G@UnBCL@@7BISerializable@1@@",
            "ordinal": 1338
          },
          {
            "address": "0x10013d58",
            "name": "??_8?$ArrayList@PAVString@UnBCL@@@UnBCL@@7B?$ICollection@PAVString@UnBCL@@@1@@",
            "ordinal": 1339
          },
          {
            "address": "0x10013d98",
            "name": "??_8?$ArrayList@PAVString@UnBCL@@@UnBCL@@7B?$IList@PAVString@UnBCL@@@1@@",
            "ordinal": 1340
          },
          {
            "address": "0x10013d3c",
            "name": "??_8?$ArrayList@PAVString@UnBCL@@@UnBCL@@7B?$SerializableArrayListBase@PAVString@UnBCL@@@_@1@@",
            "ordinal": 1341
          },
          {
            "address": "0x10013d64",
            "name": "??_8?$ArrayList@PAVString@UnBCL@@@UnBCL@@7B?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1342
          },
          {
            "address": "0x10013db8",
            "name": "??_8?$ArrayList@PAVString@UnBCL@@@UnBCL@@7B@",
            "ordinal": 1343
          },
          {
            "address": "0x10013d70",
            "name": "??_8?$ArrayList@PAVString@UnBCL@@@UnBCL@@7BISerializable@1@@",
            "ordinal": 1344
          },
          {
            "address": "0x10013d58",
            "name": "??_8?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@7B?$ICollection@PAVObject@UnBCL@@@1@@",
            "ordinal": 1345
          },
          {
            "address": "0x10013d98",
            "name": "??_8?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@7B?$IList@PAVObject@UnBCL@@@1@@",
            "ordinal": 1346
          },
          {
            "address": "0x10014a8c",
            "name": "??_8?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@7B@",
            "ordinal": 1347
          },
          {
            "address": "0x10013d58",
            "name": "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7B?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@1@@",
            "ordinal": 1348
          },
          {
            "address": "0x10013d98",
            "name": "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7B?$IDictionary@PAVString@UnBCL@@PAV12@@1@@",
            "ordinal": 1349
          },
          {
            "address": "0x10013d64",
            "name": "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7B?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1350
          },
          {
            "address": "0x10013d3c",
            "name": "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7B?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@1@@",
            "ordinal": 1351
          },
          {
            "address": "0x10019df4",
            "name": "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7B@",
            "ordinal": 1352
          },
          {
            "address": "0x10013d70",
            "name": "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7BISerializable@1@@",
            "ordinal": 1353
          },
          {
            "address": "0x10026a94",
            "name": "??_8?$Stack@H@UnBCL@@7B01@@",
            "ordinal": 1354
          },
          {
            "address": "0x10013d58",
            "name": "??_8?$Stack@H@UnBCL@@7B?$ICollection@H@1@@",
            "ordinal": 1355
          },
          {
            "address": "0x10026ac8",
            "name": "??_8?$Stack@H@UnBCL@@7B?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1356
          },
          {
            "address": "0x10026ab0",
            "name": "??_8?$Stack@H@UnBCL@@7B?$SerializableStackBase@H@_@1@@",
            "ordinal": 1357
          },
          {
            "address": "0x10026a8c",
            "name": "??_8?$Stack@H@UnBCL@@7BISerializable@1@@",
            "ordinal": 1358
          },
          {
            "address": "0x10026a78",
            "name": "??_8?$Stack@PAVObject@UnBCL@@@UnBCL@@7B01@@",
            "ordinal": 1359
          },
          {
            "address": "0x10013d58",
            "name": "??_8?$Stack@PAVObject@UnBCL@@@UnBCL@@7B?$ICollection@PAVObject@UnBCL@@@1@@",
            "ordinal": 1360
          },
          {
            "address": "0x1001452c",
            "name": "??_8ASCIIEncoding@UnBCL@@7B01@@",
            "ordinal": 1361
          },
          {
            "address": "0x1000f0b8",
            "name": "??_8ASCIIEncoding@UnBCL@@7BEncoding@1@@",
            "ordinal": 1362
          },
          {
            "address": "0x1000f0b8",
            "name": "??_8BufferedStream@UnBCL@@7BIDisposable@1@@",
            "ordinal": 1363
          },
          {
            "address": "0x100149f8",
            "name": "??_8BufferedStream@UnBCL@@7BStream@1@@",
            "ordinal": 1364
          },
          {
            "address": "0x10013df0",
            "name": "??_8CaseInsensitiveStringComparer@UnBCL@@7B@",
            "ordinal": 1365
          },
          {
            "address": "0x1001c4a0",
            "name": "??_8Delegate@UnBCL@@7B@",
            "ordinal": 1366
          },
          {
            "address": "0x1000f0b8",
            "name": "??_8FileStream@UnBCL@@7BIDisposable@1@@",
            "ordinal": 1367
          },
          {
            "address": "0x100149ec",
            "name": "??_8FileStream@UnBCL@@7BStream@1@@",
            "ordinal": 1368
          },
          {
            "address": "0x1001a8f8",
            "name": "??_8FileSystemEnumerator@UnBCL@@7B@",
            "ordinal": 1369
          },
          {
            "address": "0x1000f0b8",
            "name": "??_8MemoryStream@UnBCL@@7BIDisposable@1@@",
            "ordinal": 1370
          },
          {
            "address": "0x1000f0ac",
            "name": "??_8MemoryStream@UnBCL@@7BStream@1@@",
            "ordinal": 1371
          },
          {
            "address": "0x1001c4a0",
            "name": "??_8Monitor@UnBCL@@7B@",
            "ordinal": 1372
          },
          {
            "address": "0x1001d140",
            "name": "??_8MultiSz@UnBCL@@7B?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@1@@",
            "ordinal": 1373
          },
          {
            "address": "0x1001d14c",
            "name": "??_8MultiSz@UnBCL@@7B@",
            "ordinal": 1374
          },
          {
            "address": "0x1001d12c",
            "name": "??_8MultiSz@UnBCL@@7BISerializable@1@@",
            "ordinal": 1375
          },
          {
            "address": "0x1001d1cc",
            "name": "??_8Mutex@UnBCL@@7B@",
            "ordinal": 1376
          },
          {
            "address": "0x1000f0b8",
            "name": "??_8Mutex@UnBCL@@7BIDisposable@1@@",
            "ordinal": 1377
          },
          {
            "address": "0x10013d58",
            "name": "??_8Mutex@UnBCL@@7BWaitHandle@1@@",
            "ordinal": 1378
          },
          {
            "address": "0x1001d58c",
            "name": "??_8OperatingSystem@UnBCL@@7B01@@",
            "ordinal": 1379
          },
          {
            "address": "0x10013d58",
            "name": "??_8OperatingSystem@UnBCL@@7B?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@1@@",
            "ordinal": 1380
          },
          {
            "address": "0x1000f0b8",
            "name": "??_8OperatingSystem@UnBCL@@7BISerializable@1@@",
            "ordinal": 1381
          },
          {
            "address": "0x1001d160",
            "name": "??_8Process@UnBCL@@7B01@@",
            "ordinal": 1382
          },
          {
            "address": "0x1000f0b8",
            "name": "??_8Process@UnBCL@@7BIDisposable@1@@",
            "ordinal": 1383
          },
          {
            "address": "0x1001e260",
            "name": "??_8RegHandle@UnBCL@@7B@",
            "ordinal": 1384
          },
          {
            "address": "0x1001f3bc",
            "name": "??_8RegSubkeyEnumerator@UnBCL@@7B@",
            "ordinal": 1385
          },
          {
            "address": "0x1001c4a0",
            "name": "??_8Registry@UnBCL@@7B@",
            "ordinal": 1386
          },
          {
            "address": "0x1001e26c",
            "name": "??_8RegistryKey@UnBCL@@7B01@@",
            "ordinal": 1387
          },
          {
            "address": "0x1000f0b8",
            "name": "??_8RegistryKey@UnBCL@@7BIDisposable@1@@",
            "ordinal": 1388
          },
          {
            "address": "0x1001e260",
            "name": "??_8SEHException@UnBCL@@7B@",
            "ordinal": 1389
          },
          {
            "address": "0x10026e1c",
            "name": "??_8StreamReader@UnBCL@@7B@",
            "ordinal": 1390
          },
          {
            "address": "0x10026e14",
            "name": "??_8StreamReader@UnBCL@@7BIDisposable@1@@",
            "ordinal": 1391
          },
          {
            "address": "0x10026e08",
            "name": "??_8StreamReader@UnBCL@@7BTextReader@1@@",
            "ordinal": 1392
          },
          {
            "address": "0x10027170",
            "name": "??_8StreamWriter@UnBCL@@7B@",
            "ordinal": 1393
          },
          {
            "address": "0x1000f0b8",
            "name": "??_8StreamWriter@UnBCL@@7BIDisposable@1@@",
            "ordinal": 1394
          },
          {
            "address": "0x10027180",
            "name": "??_8StreamWriter@UnBCL@@7BTextWriter@1@@",
            "ordinal": 1395
          },
          {
            "address": "0x10013df0",
            "name": "??_8StringPtr@UnBCL@@7B@",
            "ordinal": 1396
          },
          {
            "address": "0x10028c5c",
            "name": "??_8Thread@UnBCL@@7B@",
            "ordinal": 1397
          },
          {
            "address": "0x1001452c",
            "name": "??_8UnicodeEncoding@UnBCL@@7B01@@",
            "ordinal": 1398
          },
          {
            "address": "0x1000f0b8",
            "name": "??_8UnicodeEncoding@UnBCL@@7BEncoding@1@@",
            "ordinal": 1399
          },
          {
            "address": "0x10019de4",
            "name": "??_8Version@UnBCL@@7B01@@",
            "ordinal": 1400
          },
          {
            "address": "0x10013d58",
            "name": "??_8Version@UnBCL@@7B?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
            "ordinal": 1401
          },
          {
            "address": "0x1000f0b8",
            "name": "??_8Version@UnBCL@@7BISerializable@1@@",
            "ordinal": 1402
          },
          {
            "address": "0x1001d1c0",
            "name": "??_8WaitHandle@UnBCL@@7B01@@",
            "ordinal": 1403
          },
          {
            "address": "0x1000f0b8",
            "name": "??_8WaitHandle@UnBCL@@7BIDisposable@1@@",
            "ordinal": 1404
          },
          {
            "address": "0x10032890",
            "name": "??_D?$Array@E@UnBCL@@QAEXXZ",
            "ordinal": 1405
          },
          {
            "address": "0x10032a10",
            "name": "??_D?$Array@G@UnBCL@@QAEXXZ",
            "ordinal": 1406
          },
          {
            "address": "0x10032690",
            "name": "??_D?$Array@H@UnBCL@@QAEXXZ",
            "ordinal": 1407
          },
          {
            "address": "0x10032410",
            "name": "??_D?$Array@PAVObject@UnBCL@@@UnBCL@@QAEXXZ",
            "ordinal": 1408
          },
          {
            "address": "0x10032b90",
            "name": "??_D?$Array@PAVString@UnBCL@@@UnBCL@@QAEXXZ",
            "ordinal": 1409
          },
          {
            "address": "0x10031f80",
            "name": "??_D?$ArrayList@G@UnBCL@@QAEXXZ",
            "ordinal": 1410
          },
          {
            "address": "0x10032220",
            "name": "??_D?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAEXXZ",
            "ordinal": 1411
          },
          {
            "address": "0x10045ef0",
            "name": "??_D?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@IAEXXZ",
            "ordinal": 1412
          },
          {
            "address": "0x1004dfd0",
            "name": "??_D?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAEXXZ",
            "ordinal": 1413
          },
          {
            "address": "0x1006be20",
            "name": "??_D?$Stack@H@UnBCL@@QAEXXZ",
            "ordinal": 1414
          },
          {
            "address": "0x1006bb90",
            "name": "??_D?$Stack@PAVObject@UnBCL@@@UnBCL@@QAEXXZ",
            "ordinal": 1415
          },
          {
            "address": "0x10044270",
            "name": "??_DASCIIEncoding@UnBCL@@QAEXXZ",
            "ordinal": 1416
          },
          {
            "address": "0x10044f90",
            "name": "??_DBufferedStream@UnBCL@@QAEXXZ",
            "ordinal": 1417
          },
          {
            "address": "0x10031c10",
            "name": "??_DCaseInsensitiveStringComparer@UnBCL@@QAEXXZ",
            "ordinal": 1418
          },
          {
            "address": "0x10044270",
            "name": "??_DDelegate@UnBCL@@QAEXXZ",
            "ordinal": 1419
          },
          {
            "address": "0x10044d90",
            "name": "??_DFileStream@UnBCL@@QAEXXZ",
            "ordinal": 1420
          },
          {
            "address": "0x10055af0",
            "name": "??_DFileSystemEnumerator@UnBCL@@QAEXXZ",
            "ordinal": 1421
          },
          {
            "address": "0x1002dcc0",
            "name": "??_DMemoryStream@UnBCL@@QAEXXZ",
            "ordinal": 1422
          },
          {
            "address": "0x10058d00",
            "name": "??_DMonitor@UnBCL@@AAEXXZ",
            "ordinal": 1423
          },
          {
            "address": "0x100595d0",
            "name": "??_DMultiSz@UnBCL@@QAEXXZ",
            "ordinal": 1424
          },
          {
            "address": "0x1005dfe0",
            "name": "??_DMutex@UnBCL@@QAEXXZ",
            "ordinal": 1425
          },
          {
            "address": "0x1004e270",
            "name": "??_DOperatingSystem@UnBCL@@QAEXXZ",
            "ordinal": 1426
          },
          {
            "address": "0x10061890",
            "name": "??_DProcess@UnBCL@@QAEXXZ",
            "ordinal": 1427
          },
          {
            "address": "0x10062120",
            "name": "??_DRegHandle@UnBCL@@QAEXXZ",
            "ordinal": 1428
          },
          {
            "address": "0x10064b10",
            "name": "??_DRegSubkeyEnumerator@UnBCL@@QAEXXZ",
            "ordinal": 1429
          },
          {
            "address": "0x10044270",
            "name": "??_DRegistry@UnBCL@@QAEXXZ",
            "ordinal": 1430
          },
          {
            "address": "0x100626a0",
            "name": "??_DRegistryKey@UnBCL@@QAEXXZ",
            "ordinal": 1431
          },
          {
            "address": "0x100650f0",
            "name": "??_DSEHException@UnBCL@@QAEXXZ",
            "ordinal": 1432
          },
          {
            "address": "0x1006d100",
            "name": "??_DStreamReader@UnBCL@@QAEXXZ",
            "ordinal": 1433
          },
          {
            "address": "0x1006dcf0",
            "name": "??_DStreamWriter@UnBCL@@QAEXXZ",
            "ordinal": 1434
          },
          {
            "address": "0x100319e0",
            "name": "??_DStringPtr@UnBCL@@QAEXXZ",
            "ordinal": 1435
          },
          {
            "address": "0x10072f00",
            "name": "??_DThread@UnBCL@@QAEXXZ",
            "ordinal": 1436
          },
          {
            "address": "0x10044270",
            "name": "??_DUnicodeEncoding@UnBCL@@QAEXXZ",
            "ordinal": 1437
          },
          {
            "address": "0x1004e0b0",
            "name": "??_DVersion@UnBCL@@QAEXXZ",
            "ordinal": 1438
          },
          {
            "address": "0x1005dd60",
            "name": "??_DWaitHandle@UnBCL@@QAEXXZ",
            "ordinal": 1439
          },
          {
            "address": "0x10014538",
            "name": "?ASCII_CODEPAGE@ASCIIEncoding@UnBCL@@0HB",
            "ordinal": 1440
          },
          {
            "address": "0x100358d0",
            "name": "?Add@?$Array@E@UnBCL@@UAEHE@Z",
            "ordinal": 1441
          },
          {
            "address": "0x100367d0",
            "name": "?Add@?$Array@G@UnBCL@@UAEHG@Z",
            "ordinal": 1442
          },
          {
            "address": "0x1003b200",
            "name": "?Add@?$Array@H@UnBCL@@UAEHH@Z",
            "ordinal": 1443
          },
          {
            "address": "0x1003a5e0",
            "name": "?Add@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEHPAVObject@2@@Z",
            "ordinal": 1444
          },
          {
            "address": "0x100374a0",
            "name": "?Add@?$Array@PAVString@UnBCL@@@UnBCL@@UAEHPAVString@2@@Z",
            "ordinal": 1445
          },
          {
            "address": "0x10038440",
            "name": "?Add@?$ArrayList@G@UnBCL@@UAEHG@Z",
            "ordinal": 1446
          },
          {
            "address": "0x10033850",
            "name": "?Add@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEHPAVString@2@@Z",
            "ordinal": 1447
          },
          {
            "address": "0x10045f90",
            "name": "?Add@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEHPAVObject@2@@Z",
            "ordinal": 1448
          },
          {
            "address": "0x10050cd0",
            "name": "?Add@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXPAVString@2@0@Z",
            "ordinal": 1449
          },
          {
            "address": "0x10046ba0",
            "name": "?Add@DateTime@UnBCL@@QBE?AV12@ABVTimeSpan@2@@Z",
            "ordinal": 1450
          },
          {
            "address": "0x10059c40",
            "name": "?Add@MultiSz@UnBCL@@QAEXPBG@Z",
            "ordinal": 1451
          },
          {
            "address": "0x1002d8a0",
            "name": "?Add@StreamCounter@UnBCL@@QAEX_J@Z",
            "ordinal": 1452
          },
          {
            "address": "0x10073850",
            "name": "?Add@TimeSpan@UnBCL@@QBE?AV12@ABV12@@Z",
            "ordinal": 1453
          },
          {
            "address": "0x10077a50",
            "name": "?Add@XmlAttributeCollection@XmlLite@UnBCL@@IAEXPAVXmlAttribute@23@@Z",
            "ordinal": 1454
          },
          {
            "address": "0x10077a50",
            "name": "?Add@XmlNodeList@XmlLite@UnBCL@@IAEXPAVXmlNode@23@@Z",
            "ordinal": 1455
          },
          {
            "address": "0x1007b050",
            "name": "?Add@XmlSchemaSet@UnBCL@@QAEXPAVString@2@PAVXmlDocument@2@@Z",
            "ordinal": 1456
          },
          {
            "address": "0x10051370",
            "name": "?AddDictionary@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@AAEXPBU?$IDictionary@PAVString@UnBCL@@PAV12@@2@@Z",
            "ordinal": 1457
          },
          {
            "address": "0x1007ae20",
            "name": "?AddNamespace@XmlNamespaceManager@UnBCL@@QAEXPAVString@2@0@Z",
            "ordinal": 1458
          },
          {
            "address": "0x10038de0",
            "name": "?AddRange@?$ArrayList@G@UnBCL@@UAEXPBU?$ICollection@G@2@@Z",
            "ordinal": 1459
          },
          {
            "address": "0x10034420",
            "name": "?AddRange@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXPBU?$ICollection@PAVString@UnBCL@@@2@@Z",
            "ordinal": 1460
          },
          {
            "address": "0x1005e5a0",
            "name": "?AddRef@Object@UnBCL@@QAEXXZ",
            "ordinal": 1461
          },
          {
            "address": "0x10054450",
            "name": "?AddStackTrace@Exception@UnBCL@@QAEXPBD@Z",
            "ordinal": 1462
          },
          {
            "address": "0x1002e530",
            "name": "?Alloc@Allocator@UnBCL@@SGPAXKI@Z",
            "ordinal": 1463
          },
          {
            "address": "0x10057500",
            "name": "?Alloc@HeapMemoryManager@UnBCL@@UAEPAXK@Z",
            "ordinal": 1464
          },
          {
            "address": "0x1002e560",
            "name": "?AllocDbg@Allocator@UnBCL@@SGPAXKPBDHI@Z",
            "ordinal": 1465
          },
          {
            "address": "0x10057530",
            "name": "?AllocDbg@HeapMemoryManager@UnBCL@@UAEPAXPBDHK@Z",
            "ordinal": 1466
          },
          {
            "address": "0x1002e9c0",
            "name": "?AllocSysString@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEPAGXZ",
            "ordinal": 1467
          },
          {
            "address": "0x10030860",
            "name": "?Append@?$CSimpleStringT@G$0A@@ATL@@QAEXABV12@@Z",
            "ordinal": 1468
          },
          {
            "address": "0x10030920",
            "name": "?Append@?$CSimpleStringT@G$0A@@ATL@@QAEXPBG@Z",
            "ordinal": 1469
          },
          {
            "address": "0x100308c0",
            "name": "?Append@?$CSimpleStringT@G$0A@@ATL@@QAEXPBGH@Z",
            "ordinal": 1470
          },
          {
            "address": "0x1002e0a0",
            "name": "?Append@MutableString@UnBCL@@QAEXG@Z",
            "ordinal": 1471
          },
          {
            "address": "0x1002e0c0",
            "name": "?Append@MutableString@UnBCL@@QAEXPBG@Z",
            "ordinal": 1472
          },
          {
            "address": "0x10071f80",
            "name": "?Append@StringBuilder@UnBCL@@QAEPAV12@G@Z",
            "ordinal": 1473
          },
          {
            "address": "0x10071fa0",
            "name": "?Append@StringBuilder@UnBCL@@QAEPAV12@GH@Z",
            "ordinal": 1474
          },
          {
            "address": "0x100720d0",
            "name": "?Append@StringBuilder@UnBCL@@QAEPAV12@H@Z",
            "ordinal": 1475
          },
          {
            "address": "0x10072000",
            "name": "?Append@StringBuilder@UnBCL@@QAEPAV12@PBG@Z",
            "ordinal": 1476
          },
          {
            "address": "0x10072030",
            "name": "?Append@StringBuilder@UnBCL@@QAEPAV12@PBGHH@Z",
            "ordinal": 1477
          },
          {
            "address": "0x10071e70",
            "name": "?Append@StringBuilder@UnBCL@@QAEPAV12@PBVString@2@@Z",
            "ordinal": 1478
          },
          {
            "address": "0x10071ea0",
            "name": "?Append@StringBuilder@UnBCL@@QAEPAV12@PBVString@2@HH@Z",
            "ordinal": 1479
          },
          {
            "address": "0x10072100",
            "name": "?Append@StringBuilder@UnBCL@@QAEPAV12@_J@Z",
            "ordinal": 1480
          },
          {
            "address": "0x10030880",
            "name": "?AppendChar@?$CSimpleStringT@G$0A@@ATL@@QAEXG@Z",
            "ordinal": 1481
          },
          {
            "address": "0x10079540",
            "name": "?AppendChild@XmlNode@UnBCL@@QAEPAV12@PAV12@@Z",
            "ordinal": 1482
          },
          {
            "address": "0x100721c0",
            "name": "?AppendEscapedString@StringBuilder@UnBCL@@QAEPAV12@PBGW4EscapingRules@2@@Z",
            "ordinal": 1483
          },
          {
            "address": "0x10030e40",
            "name": "?AppendFormat@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXIZZ",
            "ordinal": 1484
          },
          {
            "address": "0x10030e20",
            "name": "?AppendFormat@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXPBGZZ",
            "ordinal": 1485
          },
          {
            "address": "0x1002eac0",
            "name": "?AppendFormatV@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEXPBGPAD@Z",
            "ordinal": 1486
          },
          {
            "address": "0x10071fd0",
            "name": "?AppendNewLine@StringBuilder@UnBCL@@QAEPAV12@XZ",
            "ordinal": 1487
          },
          {
            "address": "0x100310b0",
            "name": "?Assign@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@AAEXABV12@@Z",
            "ordinal": 1488
          },
          {
            "address": "0x10031080",
            "name": "?Assign@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@AAEXPAV?$Array@E@2@@Z",
            "ordinal": 1489
          },
          {
            "address": "0x100310b0",
            "name": "?Assign@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@AAEXABV12@@Z",
            "ordinal": 1490
          },
          {
            "address": "0x10031080",
            "name": "?Assign@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@AAEXPAV?$Array@PAVString@UnBCL@@@2@@Z",
            "ordinal": 1491
          },
          {
            "address": "0x100310b0",
            "name": "?Assign@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@AAEXABV12@@Z",
            "ordinal": 1492
          },
          {
            "address": "0x10031080",
            "name": "?Assign@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@AAEXPAV?$ArrayList@PAVString@UnBCL@@@2@@Z",
            "ordinal": 1493
          },
          {
            "address": "0x100310b0",
            "name": "?Assign@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@AAEXABV12@@Z",
            "ordinal": 1494
          },
          {
            "address": "0x10031080",
            "name": "?Assign@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@AAEXPAVDecoder@2@@Z",
            "ordinal": 1495
          },
          {
            "address": "0x100310b0",
            "name": "?Assign@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@AAEXABV12@@Z",
            "ordinal": 1496
          },
          {
            "address": "0x10031080",
            "name": "?Assign@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@AAEXPAVEncoding@2@@Z",
            "ordinal": 1497
          },
          {
            "address": "0x1002d310",
            "name": "?Assign@?$SmartPtr@VObject@UnBCL@@@UnBCL@@AAEXABV12@@Z",
            "ordinal": 1498
          },
          {
            "address": "0x1002d2e0",
            "name": "?Assign@?$SmartPtr@VObject@UnBCL@@@UnBCL@@AAEXPAVObject@2@@Z",
            "ordinal": 1499
          },
          {
            "address": "0x1002d310",
            "name": "?Assign@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@AAEXABV12@@Z",
            "ordinal": 1500
          },
          {
            "address": "0x1002d2e0",
            "name": "?Assign@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@AAEXPAVSerializationId@2@@Z",
            "ordinal": 1501
          },
          {
            "address": "0x1002d310",
            "name": "?Assign@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@AAEXABV12@@Z",
            "ordinal": 1502
          },
          {
            "address": "0x1002d2e0",
            "name": "?Assign@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@AAEXPAVSerializationStream@2@@Z",
            "ordinal": 1503
          },
          {
            "address": "0x100310b0",
            "name": "?Assign@?$SmartPtr@VStream@UnBCL@@@UnBCL@@AAEXABV12@@Z",
            "ordinal": 1504
          },
          {
            "address": "0x10031080",
            "name": "?Assign@?$SmartPtr@VStream@UnBCL@@@UnBCL@@AAEXPAVStream@2@@Z",
            "ordinal": 1505
          },
          {
            "address": "0x1002d310",
            "name": "?Assign@?$SmartPtr@VString@UnBCL@@@UnBCL@@AAEXABV12@@Z",
            "ordinal": 1506
          },
          {
            "address": "0x1002d2e0",
            "name": "?Assign@?$SmartPtr@VString@UnBCL@@@UnBCL@@AAEXPAVString@2@@Z",
            "ordinal": 1507
          },
          {
            "address": "0x100519c0",
            "name": "?Assign@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@AAEXABV12@@Z",
            "ordinal": 1508
          },
          {
            "address": "0x10051990",
            "name": "?Assign@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@AAEXPAVVersion@2@@Z",
            "ordinal": 1509
          },
          {
            "address": "0x1002d310",
            "name": "?Assign@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@AAEXABV12@@Z",
            "ordinal": 1510
          },
          {
            "address": "0x1002d2e0",
            "name": "?Assign@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@AAEXPAVXmlNamespaceManager@2@@Z",
            "ordinal": 1511
          },
          {
            "address": "0x10030320",
            "name": "?Attach@?$CSimpleStringT@G$0A@@ATL@@AAEXPAUCStringData@2@@Z",
            "ordinal": 1512
          },
          {
            "address": "0x10035e20",
            "name": "?BinarySearch@?$Array@E@UnBCL@@SGHPBV12@EPAU?$IComparer@E@2@@Z",
            "ordinal": 1513
          },
          {
            "address": "0x10036a80",
            "name": "?BinarySearch@?$Array@G@UnBCL@@SGHPBV12@GPAU?$IComparer@G@2@@Z",
            "ordinal": 1514
          },
          {
            "address": "0x1003b490",
            "name": "?BinarySearch@?$Array@H@UnBCL@@SGHPBV12@HPAU?$IComparer@H@2@@Z",
            "ordinal": 1515
          },
          {
            "address": "0x1003a870",
            "name": "?BinarySearch@?$Array@PAVObject@UnBCL@@@UnBCL@@SGHPBV12@PAVObject@2@PAU?$IComparer@PAVObject@UnBCL@@@2@@Z",
            "ordinal": 1516
          },
          {
            "address": "0x10037750",
            "name": "?BinarySearch@?$Array@PAVString@UnBCL@@@UnBCL@@SGHPBV12@PAVString@2@PAU?$IComparer@PAVString@UnBCL@@@2@@Z",
            "ordinal": 1517
          },
          {
            "address": "0x10039080",
            "name": "?BinarySearch@?$ArrayList@G@UnBCL@@AAEHHHGPAU?$IComparer@G@2@@Z",
            "ordinal": 1518
          },
          {
            "address": "0x100392b0",
            "name": "?BinarySearch@?$ArrayList@G@UnBCL@@SGHPAV12@GPAU?$IComparer@G@2@@Z",
            "ordinal": 1519
          },
          {
            "address": "0x10039330",
            "name": "?BinarySearch@?$ArrayList@G@UnBCL@@UAEHGPAU?$IComparer@G@2@@Z",
            "ordinal": 1520
          },
          {
            "address": "0x100346a0",
            "name": "?BinarySearch@?$ArrayList@PAVString@UnBCL@@@UnBCL@@AAEHHHPAVString@2@PAU?$IComparer@PAVString@UnBCL@@@2@@Z",
            "ordinal": 1521
          },
          {
            "address": "0x100348d0",
            "name": "?BinarySearch@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGHPAV12@PAVString@2@PAU?$IComparer@PAVString@UnBCL@@@2@@Z",
            "ordinal": 1522
          },
          {
            "address": "0x10034950",
            "name": "?BinarySearch@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEHPAVString@2@PAU?$IComparer@PAVString@UnBCL@@@2@@Z",
            "ordinal": 1523
          },
          {
            "address": "0x1002e6e0",
            "name": "?BlocksAllocated@Allocator@UnBCL@@SGII@Z",
            "ordinal": 1524
          },
          {
            "address": "0x10065640",
            "name": "?CanRegister@SerializationStream@UnBCL@@SGHXZ",
            "ordinal": 1525
          },
          {
            "address": "0x1002eda0",
            "name": "?CharToOemA@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEXXZ",
            "ordinal": 1526
          },
          {
            "address": "0x1002e780",
            "name": "?CheckImplicitLoad@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@AAE_NPBX@Z",
            "ordinal": 1527
          },
          {
            "address": "0x10060630",
            "name": "?CheckInvalidPathChars@Path@UnBCL@@CGXPBVString@2@@Z",
            "ordinal": 1528
          },
          {
            "address": "0x10060360",
            "name": "?CheckPathTooLong@Path@UnBCL@@KGXPBVString@2@@Z",
            "ordinal": 1529
          },
          {
            "address": "0x10035930",
            "name": "?Clear@?$Array@E@UnBCL@@UAEXXZ",
            "ordinal": 1530
          },
          {
            "address": "0x10035930",
            "name": "?Clear@?$Array@G@UnBCL@@UAEXXZ",
            "ordinal": 1531
          },
          {
            "address": "0x10035930",
            "name": "?Clear@?$Array@H@UnBCL@@UAEXXZ",
            "ordinal": 1532
          },
          {
            "address": "0x10035930",
            "name": "?Clear@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXXZ",
            "ordinal": 1533
          },
          {
            "address": "0x10035930",
            "name": "?Clear@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXXZ",
            "ordinal": 1534
          },
          {
            "address": "0x10038490",
            "name": "?Clear@?$ArrayList@G@UnBCL@@UAEXXZ",
            "ordinal": 1535
          },
          {
            "address": "0x100338a0",
            "name": "?Clear@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXXZ",
            "ordinal": 1536
          },
          {
            "address": "0x10045fd0",
            "name": "?Clear@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEXXZ",
            "ordinal": 1537
          },
          {
            "address": "0x10050d80",
            "name": "?Clear@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXXZ",
            "ordinal": 1538
          },
          {
            "address": "0x1006c1b0",
            "name": "?Clear@?$Stack@H@UnBCL@@UAEXXZ",
            "ordinal": 1539
          },
          {
            "address": "0x1006c1b0",
            "name": "?Clear@?$Stack@PAVObject@UnBCL@@@UnBCL@@UAEXXZ",
            "ordinal": 1540
          },
          {
            "address": "0x100357e0",
            "name": "?Clone@?$Array@E@UnBCL@@UBEPAVObject@2@XZ",
            "ordinal": 1541
          },
          {
            "address": "0x10036770",
            "name": "?Clone@?$Array@G@UnBCL@@UBEPAVObject@2@XZ",
            "ordinal": 1542
          },
          {
            "address": "0x1003b1a0",
            "name": "?Clone@?$Array@H@UnBCL@@UBEPAVObject@2@XZ",
            "ordinal": 1543
          },
          {
            "address": "0x1003a580",
            "name": "?Clone@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEPAVObject@2@XZ",
            "ordinal": 1544
          },
          {
            "address": "0x10037440",
            "name": "?Clone@?$Array@PAVString@UnBCL@@@UnBCL@@UBEPAVObject@2@XZ",
            "ordinal": 1545
          },
          {
            "address": "0x100381e0",
            "name": "?Clone@?$ArrayList@G@UnBCL@@UBEPAVObject@2@XZ",
            "ordinal": 1546
          },
          {
            "address": "0x100335e0",
            "name": "?Clone@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEPAVObject@2@XZ",
            "ordinal": 1547
          },
          {
            "address": "0x10050b00",
            "name": "?Clone@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAVObject@2@XZ",
            "ordinal": 1548
          },
          {
            "address": "0x1006c7a0",
            "name": "?Clone@?$Stack@H@UnBCL@@UBEPAVObject@2@XZ",
            "ordinal": 1549
          },
          {
            "address": "0x1006c110",
            "name": "?Clone@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEPAVObject@2@XZ",
            "ordinal": 1550
          },
          {
            "address": "0x1005a210",
            "name": "?Clone@MultiSz@UnBCL@@UBEPAVObject@2@XZ",
            "ordinal": 1551
          },
          {
            "address": "0x1005e540",
            "name": "?Clone@Object@UnBCL@@UBEPAV12@XZ",
            "ordinal": 1552
          },
          {
            "address": "0x1005ef30",
            "name": "?Clone@OperatingSystem@UnBCL@@UBEPAVObject@2@XZ",
            "ordinal": 1553
          },
          {
            "address": "0x1006e910",
            "name": "?Clone@String@UnBCL@@UBEPAVObject@2@XZ",
            "ordinal": 1554
          },
          {
            "address": "0x100750a0",
            "name": "?Clone@Version@UnBCL@@UBEPAVObject@2@XZ",
            "ordinal": 1555
          },
          {
            "address": "0x100300c0",
            "name": "?CloneData@?$CSimpleStringT@G$0A@@ATL@@CAPAUCStringData@2@PAU32@@Z",
            "ordinal": 1556
          },
          {
            "address": "0x10079740",
            "name": "?CloneNode@XmlNode@UnBCL@@QAEPAV12@H@Z",
            "ordinal": 1557
          },
          {
            "address": "0x10045960",
            "name": "?Close@BufferedStream@UnBCL@@UAEXXZ",
            "ordinal": 1558
          },
          {
            "address": "0x10057090",
            "name": "?Close@FileStream@UnBCL@@UAEXXZ",
            "ordinal": 1559
          },
          {
            "address": "0x100586c0",
            "name": "?Close@MemoryStream@UnBCL@@UAEXXZ",
            "ordinal": 1560
          },
          {
            "address": "0x100619d0",
            "name": "?Close@Process@UnBCL@@QAEXXZ",
            "ordinal": 1561
          },
          {
            "address": "0x10062240",
            "name": "?Close@RegHandle@UnBCL@@QAEXXZ",
            "ordinal": 1562
          },
          {
            "address": "0x100646f0",
            "name": "?Close@RegistryKey@UnBCL@@QAEXXZ",
            "ordinal": 1563
          },
          {
            "address": "0x100657e0",
            "name": "?Close@SerializationStream@UnBCL@@QAEXXZ",
            "ordinal": 1564
          },
          {
            "address": "0x1006d810",
            "name": "?Close@StreamReader@UnBCL@@UAEXXZ",
            "ordinal": 1565
          },
          {
            "address": "0x1006e310",
            "name": "?Close@StreamWriter@UnBCL@@IAEXH@Z",
            "ordinal": 1566
          },
          {
            "address": "0x1006e300",
            "name": "?Close@StreamWriter@UnBCL@@UAEXXZ",
            "ordinal": 1567
          },
          {
            "address": "0x1002f780",
            "name": "?Collate@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBG@Z",
            "ordinal": 1568
          },
          {
            "address": "0x1002f760",
            "name": "?CollateNoCase@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBG@Z",
            "ordinal": 1569
          },
          {
            "address": "0x1005fae0",
            "name": "?Combine@Path@UnBCL@@SGPAVString@2@PBV32@0@Z",
            "ordinal": 1570
          },
          {
            "address": "0x1002f7c0",
            "name": "?Compare@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBG@Z",
            "ordinal": 1571
          },
          {
            "address": "0x10031a40",
            "name": "?Compare@CaseInsensitiveStringComparer@UnBCL@@EAEHPAVString@2@0@Z",
            "ordinal": 1572
          },
          {
            "address": "0x1006fdc0",
            "name": "?Compare@String@UnBCL@@SGHPBG0H@Z",
            "ordinal": 1573
          },
          {
            "address": "0x1006fe60",
            "name": "?Compare@String@UnBCL@@SGHPBGPBV12@H@Z",
            "ordinal": 1574
          },
          {
            "address": "0x1006fe90",
            "name": "?Compare@String@UnBCL@@SGHPBV12@0H@Z",
            "ordinal": 1575
          },
          {
            "address": "0x1006fe30",
            "name": "?Compare@String@UnBCL@@SGHPBV12@PBGH@Z",
            "ordinal": 1576
          },
          {
            "address": "0x1002f7a0",
            "name": "?CompareNoCase@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBG@Z",
            "ordinal": 1577
          },
          {
            "address": "0x10045bf0",
            "name": "?CompareTo@Char@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1578
          },
          {
            "address": "0x10046c90",
            "name": "?CompareTo@DateTime@UnBCL@@QBEHABV12@@Z",
            "ordinal": 1579
          },
          {
            "address": "0x100468f0",
            "name": "?CompareTo@DateTime@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1580
          },
          {
            "address": "0x1005e4e0",
            "name": "?CompareTo@Object@UnBCL@@UBEHPBV12@@Z",
            "ordinal": 1581
          },
          {
            "address": "0x1006eb80",
            "name": "?CompareTo@String@UnBCL@@QBEHPBG@Z",
            "ordinal": 1582
          },
          {
            "address": "0x1006eba0",
            "name": "?CompareTo@String@UnBCL@@QBEHPBGH@Z",
            "ordinal": 1583
          },
          {
            "address": "0x1006e930",
            "name": "?CompareTo@String@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1584
          },
          {
            "address": "0x10073690",
            "name": "?CompareTo@TimeSpan@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1585
          },
          {
            "address": "0x10075100",
            "name": "?CompareTo@Version@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1586
          },
          {
            "address": "0x10070090",
            "name": "?Concat@String@UnBCL@@SAPAV12@HZZ",
            "ordinal": 1587
          },
          {
            "address": "0x10070060",
            "name": "?Concat@String@UnBCL@@SGPAV12@PBG000@Z",
            "ordinal": 1588
          },
          {
            "address": "0x1006ffe0",
            "name": "?Concat@String@UnBCL@@SGPAV12@PBG00@Z",
            "ordinal": 1589
          },
          {
            "address": "0x1006ff70",
            "name": "?Concat@String@UnBCL@@SGPAV12@PBG0@Z",
            "ordinal": 1590
          },
          {
            "address": "0x1006ff50",
            "name": "?Concat@String@UnBCL@@SGPAV12@PBG@Z",
            "ordinal": 1591
          },
          {
            "address": "0x10030350",
            "name": "?Concatenate@?$CSimpleStringT@G$0A@@ATL@@KAXAAV12@PBGH1H@Z",
            "ordinal": 1592
          },
          {
            "address": "0x10030030",
            "name": "?Construct@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@SAXPAV12@@Z",
            "ordinal": 1593
          },
          {
            "address": "0x100359a0",
            "name": "?Contains@?$Array@E@UnBCL@@UBEHE@Z",
            "ordinal": 1594
          },
          {
            "address": "0x100359a0",
            "name": "?Contains@?$Array@G@UnBCL@@UBEHG@Z",
            "ordinal": 1595
          },
          {
            "address": "0x100359a0",
            "name": "?Contains@?$Array@H@UnBCL@@UBEHH@Z",
            "ordinal": 1596
          },
          {
            "address": "0x100359a0",
            "name": "?Contains@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHQAVObject@2@@Z",
            "ordinal": 1597
          },
          {
            "address": "0x100359a0",
            "name": "?Contains@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHQAVString@2@@Z",
            "ordinal": 1598
          },
          {
            "address": "0x10033910",
            "name": "?Contains@?$ArrayList@G@UnBCL@@UBEHG@Z",
            "ordinal": 1599
          },
          {
            "address": "0x10033910",
            "name": "?Contains@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHQAVString@2@@Z",
            "ordinal": 1600
          },
          {
            "address": "0x10046000",
            "name": "?Contains@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEHQAVObject@2@@Z",
            "ordinal": 1601
          },
          {
            "address": "0x10050e10",
            "name": "?Contains@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHPAVString@2@@Z",
            "ordinal": 1602
          },
          {
            "address": "0x1006c1e0",
            "name": "?Contains@?$Stack@H@UnBCL@@UBEHH@Z",
            "ordinal": 1603
          },
          {
            "address": "0x1006c1e0",
            "name": "?Contains@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEHPAVObject@2@@Z",
            "ordinal": 1604
          },
          {
            "address": "0x10059db0",
            "name": "?Contains@MultiSz@UnBCL@@QBEHPBGH@Z",
            "ordinal": 1605
          },
          {
            "address": "0x1007b130",
            "name": "?Contains@XmlSchemaSet@UnBCL@@QAEHPAVString@2@@Z",
            "ordinal": 1606
          },
          {
            "address": "0x10051000",
            "name": "?ContainsKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHPAVString@2@@Z",
            "ordinal": 1607
          },
          {
            "address": "0x10051090",
            "name": "?ContainsValue@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHPAVString@2@@Z",
            "ordinal": 1608
          },
          {
            "address": "0x100394c0",
            "name": "?Copy@?$ArrayList@G@UnBCL@@SGXPBV12@HPAV12@HH@Z",
            "ordinal": 1609
          },
          {
            "address": "0x10039620",
            "name": "?Copy@?$ArrayList@G@UnBCL@@SGXPBV12@PAV12@H@Z",
            "ordinal": 1610
          },
          {
            "address": "0x10034ae0",
            "name": "?Copy@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGXPBV12@HPAV12@HH@Z",
            "ordinal": 1611
          },
          {
            "address": "0x10034c70",
            "name": "?Copy@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGXPBV12@PAV12@H@Z",
            "ordinal": 1612
          },
          {
            "address": "0x10049830",
            "name": "?Copy@Directory@UnBCL@@SGXPBVString@2@0HPAUICopyDelegate@12@@Z",
            "ordinal": 1613
          },
          {
            "address": "0x10055360",
            "name": "?Copy@File@UnBCL@@SGPAVString@2@PBV32@0H@Z",
            "ordinal": 1614
          },
          {
            "address": "0x10066430",
            "name": "?Copy@String@UnBCL@@SGPAV12@PBV12@@Z",
            "ordinal": 1615
          },
          {
            "address": "0x10030450",
            "name": "?CopyChars@?$CSimpleStringT@G$0A@@ATL@@SAXPAGIPBGH@Z",
            "ordinal": 1616
          },
          {
            "address": "0x10030480",
            "name": "?CopyChars@?$CSimpleStringT@G$0A@@ATL@@SAXPAGPBGH@Z",
            "ordinal": 1617
          },
          {
            "address": "0x10030400",
            "name": "?CopyCharsOverlapped@?$CSimpleStringT@G$0A@@ATL@@SAXPAGIPBGH@Z",
            "ordinal": 1618
          },
          {
            "address": "0x10030430",
            "name": "?CopyCharsOverlapped@?$CSimpleStringT@G$0A@@ATL@@SAXPAGPBGH@Z",
            "ordinal": 1619
          },
          {
            "address": "0x10035bf0",
            "name": "?CopyTo@?$Array@E@UnBCL@@UBEXPAV12@H@Z",
            "ordinal": 1620
          },
          {
            "address": "0x10035bf0",
            "name": "?CopyTo@?$Array@G@UnBCL@@UBEXPAV12@H@Z",
            "ordinal": 1621
          },
          {
            "address": "0x10035bf0",
            "name": "?CopyTo@?$Array@H@UnBCL@@UBEXPAV12@H@Z",
            "ordinal": 1622
          },
          {
            "address": "0x10035bf0",
            "name": "?CopyTo@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEXPAV12@H@Z",
            "ordinal": 1623
          },
          {
            "address": "0x10035bf0",
            "name": "?CopyTo@?$Array@PAVString@UnBCL@@@UnBCL@@UBEXPAV12@H@Z",
            "ordinal": 1624
          },
          {
            "address": "0x100387c0",
            "name": "?CopyTo@?$ArrayList@G@UnBCL@@UBEXPAV?$Array@G@2@H@Z",
            "ordinal": 1625
          },
          {
            "address": "0x10033d40",
            "name": "?CopyTo@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEXPAV?$Array@PAVString@UnBCL@@@2@H@Z",
            "ordinal": 1626
          },
          {
            "address": "0x10046170",
            "name": "?CopyTo@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEXPAV?$Array@PAVObject@UnBCL@@@2@H@Z",
            "ordinal": 1627
          },
          {
            "address": "0x10050f80",
            "name": "?CopyTo@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEXPAV?$Array@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@2@H@Z",
            "ordinal": 1628
          },
          {
            "address": "0x10035bf0",
            "name": "?CopyTo@?$Stack@H@UnBCL@@UBEXPAV?$Array@H@2@H@Z",
            "ordinal": 1629
          },
          {
            "address": "0x10035bf0",
            "name": "?CopyTo@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEXPAV?$Array@PAVObject@UnBCL@@@2@H@Z",
            "ordinal": 1630
          },
          {
            "address": "0x10070270",
            "name": "?CountChars@String@UnBCL@@SGHPBG@Z",
            "ordinal": 1631
          },
          {
            "address": "0x10054e70",
            "name": "?Create@File@UnBCL@@SGPAVFileStream@2@PBVString@2@@Z",
            "ordinal": 1632
          },
          {
            "address": "0x10047e10",
            "name": "?CreateDir@Directory@UnBCL@@SGPAVDirectoryInfo@2@PBVString@2@@Z",
            "ordinal": 1633
          },
          {
            "address": "0x1007a9a0",
            "name": "?CreateNode@XmlDocument@UnBCL@@QAEPAVXmlNode@2@W4XmlNodeType@2@PAVString@2@1@Z",
            "ordinal": 1634
          },
          {
            "address": "0x10063100",
            "name": "?CreateSubKey@RegistryKey@UnBCL@@QAEPAV12@PBVString@2@@Z",
            "ordinal": 1635
          },
          {
            "address": "0x10049110",
            "name": "?CreateTemporaryDirectory@Directory@UnBCL@@SGPAVString@2@XZ",
            "ordinal": 1636
          },
          {
            "address": "0x10078aa0",
            "name": "?CreateXmlNode@XmlNode@UnBCL@@SGPAV12@PAUIXMLDOMNode@@@Z",
            "ordinal": 1637
          },
          {
            "address": "0x1001502c",
            "name": "?DAYS_PER_100@DateTime@UnBCL@@0HB",
            "ordinal": 1638
          },
          {
            "address": "0x100150f0",
            "name": "?DAYS_PER_1@DateTime@UnBCL@@0HB",
            "ordinal": 1639
          },
          {
            "address": "0x10015028",
            "name": "?DAYS_PER_400@DateTime@UnBCL@@0HB",
            "ordinal": 1640
          },
          {
            "address": "0x10015014",
            "name": "?DAYS_PER_4@DateTime@UnBCL@@0HB",
            "ordinal": 1641
          },
          {
            "address": "0x10015010",
            "name": "?DAYS_TO_10K@DateTime@UnBCL@@0HB",
            "ordinal": 1642
          },
          {
            "address": "0x10015080",
            "name": "?DAYS_TO_1601@DateTime@UnBCL@@0HB",
            "ordinal": 1643
          },
          {
            "address": "0x100150a0",
            "name": "?DAYS_TO_MONTH_365@DateTime@UnBCL@@0QBHB",
            "ordinal": 1644
          },
          {
            "address": "0x10015040",
            "name": "?DAYS_TO_MONTH_366@DateTime@UnBCL@@0QBHB",
            "ordinal": 1645
          },
          {
            "address": "0x100ba004",
            "name": "?DEFAULT_ERROR@Exception@UnBCL@@0PBGB",
            "ordinal": 1646
          },
          {
            "address": "0x10046e50",
            "name": "?DateToTicks@DateTime@UnBCL@@AAE_JHHH@Z",
            "ordinal": 1647
          },
          {
            "address": "0x100310d0",
            "name": "?DeAssign@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@AAEXXZ",
            "ordinal": 1648
          },
          {
            "address": "0x100310d0",
            "name": "?DeAssign@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@AAEXXZ",
            "ordinal": 1649
          },
          {
            "address": "0x100310d0",
            "name": "?DeAssign@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@AAEXXZ",
            "ordinal": 1650
          },
          {
            "address": "0x100310d0",
            "name": "?DeAssign@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@AAEXXZ",
            "ordinal": 1651
          },
          {
            "address": "0x100310d0",
            "name": "?DeAssign@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@AAEXXZ",
            "ordinal": 1652
          },
          {
            "address": "0x1002d330",
            "name": "?DeAssign@?$SmartPtr@VObject@UnBCL@@@UnBCL@@AAEXXZ",
            "ordinal": 1653
          },
          {
            "address": "0x1002d330",
            "name": "?DeAssign@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@AAEXXZ",
            "ordinal": 1654
          },
          {
            "address": "0x1002d330",
            "name": "?DeAssign@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@AAEXXZ",
            "ordinal": 1655
          },
          {
            "address": "0x100310d0",
            "name": "?DeAssign@?$SmartPtr@VStream@UnBCL@@@UnBCL@@AAEXXZ",
            "ordinal": 1656
          },
          {
            "address": "0x1002d330",
            "name": "?DeAssign@?$SmartPtr@VString@UnBCL@@@UnBCL@@AAEXXZ",
            "ordinal": 1657
          },
          {
            "address": "0x100519e0",
            "name": "?DeAssign@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@AAEXXZ",
            "ordinal": 1658
          },
          {
            "address": "0x1002d330",
            "name": "?DeAssign@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@AAEXXZ",
            "ordinal": 1659
          },
          {
            "address": "0x1005e5b0",
            "name": "?DecRef@Object@UnBCL@@QAEHXZ",
            "ordinal": 1660
          },
          {
            "address": "0x10019e48",
            "name": "?DefaultBins@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@0IB",
            "ordinal": 1661
          },
          {
            "address": "0x10019e44",
            "name": "?DefaultHigh@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@0MB",
            "ordinal": 1662
          },
          {
            "address": "0x10019e40",
            "name": "?DefaultLoad@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@0MB",
            "ordinal": 1663
          },
          {
            "address": "0x10019e4c",
            "name": "?DefaultLow@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@0MB",
            "ordinal": 1664
          },
          {
            "address": "0x1002f6c0",
            "name": "?Delete@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHHH@Z",
            "ordinal": 1665
          },
          {
            "address": "0x10047580",
            "name": "?Delete@Directory@UnBCL@@SGXPBVString@2@H@Z",
            "ordinal": 1666
          },
          {
            "address": "0x10054d50",
            "name": "?Delete@File@UnBCL@@SGXPBVString@2@@Z",
            "ordinal": 1667
          },
          {
            "address": "0x100477e0",
            "name": "?DeleteInternal@Directory@UnBCL@@CGXPBVString@2@HH@Z",
            "ordinal": 1668
          },
          {
            "address": "0x100546b0",
            "name": "?DeleteInternal@File@UnBCL@@CGXPBVString@2@@Z",
            "ordinal": 1669
          },
          {
            "address": "0x100475a0",
            "name": "?DeleteNE@Directory@UnBCL@@SGHPBVString@2@H@Z",
            "ordinal": 1670
          },
          {
            "address": "0x100399a0",
            "name": "?DeleteRange@?$ArrayList@G@UnBCL@@AAEXHH@Z",
            "ordinal": 1671
          },
          {
            "address": "0x10034fe0",
            "name": "?DeleteRange@?$ArrayList@PAVString@UnBCL@@@UnBCL@@AAEXHH@Z",
            "ordinal": 1672
          },
          {
            "address": "0x10063520",
            "name": "?DeleteSubKey@RegistryKey@UnBCL@@QAEXPBVString@2@@Z",
            "ordinal": 1673
          },
          {
            "address": "0x10063540",
            "name": "?DeleteSubKey@RegistryKey@UnBCL@@QAEXPBVString@2@H@Z",
            "ordinal": 1674
          },
          {
            "address": "0x10063780",
            "name": "?DeleteSubKeyTree@RegistryKey@UnBCL@@QAEXPBVString@2@@Z",
            "ordinal": 1675
          },
          {
            "address": "0x100640e0",
            "name": "?DeleteValue@RegistryKey@UnBCL@@QAEXPBVString@2@@Z",
            "ordinal": 1676
          },
          {
            "address": "0x100452d0",
            "name": "?Dispose@BufferedStream@UnBCL@@UAEXXZ",
            "ordinal": 1677
          },
          {
            "address": "0x100567e0",
            "name": "?Dispose@FileStream@UnBCL@@UAEXXZ",
            "ordinal": 1678
          },
          {
            "address": "0x10057ee0",
            "name": "?Dispose@MemoryStream@UnBCL@@UAEXXZ",
            "ordinal": 1679
          },
          {
            "address": "0x10061920",
            "name": "?Dispose@Process@UnBCL@@UAEXXZ",
            "ordinal": 1680
          },
          {
            "address": "0x10062ac0",
            "name": "?Dispose@RegistryKey@UnBCL@@UAEXXZ",
            "ordinal": 1681
          },
          {
            "address": "0x100728f0",
            "name": "?Dispose@TextReader@UnBCL@@UAEXXZ",
            "ordinal": 1682
          },
          {
            "address": "0x100729b0",
            "name": "?Dispose@TextWriter@UnBCL@@UAEXXZ",
            "ordinal": 1683
          },
          {
            "address": "0x100754f0",
            "name": "?Dispose@WaitHandle@UnBCL@@AAEXH@Z",
            "ordinal": 1684
          },
          {
            "address": "0x100753c0",
            "name": "?Dispose@WaitHandle@UnBCL@@UAEXXZ",
            "ordinal": 1685
          },
          {
            "address": "0x1004e9c0",
            "name": "?Done@Environment@UnBCL@@SGJXZ",
            "ordinal": 1686
          },
          {
            "address": "0x10070800",
            "name": "?Done@String@UnBCL@@SGXXZ",
            "ordinal": 1687
          },
          {
            "address": "0x1002e650",
            "name": "?Dump@Allocator@UnBCL@@SGIPAUILogHandler@@I@Z",
            "ordinal": 1688
          },
          {
            "address": "0x100577c0",
            "name": "?Dump@HeapMemoryManager@UnBCL@@UAEIPAUILogHandler@@@Z",
            "ordinal": 1689
          },
          {
            "address": "0x1002e6b0",
            "name": "?DumpDelta@Allocator@UnBCL@@SGIPAUILogHandler@@I@Z",
            "ordinal": 1690
          },
          {
            "address": "0x100577c0",
            "name": "?DumpDelta@HeapMemoryManager@UnBCL@@UAEIPAUILogHandler@@@Z",
            "ordinal": 1691
          },
          {
            "address": "0x10030810",
            "name": "?Empty@?$CSimpleStringT@G$0A@@ATL@@QAEXXZ",
            "ordinal": 1692
          },
          {
            "address": "0x1002e740",
            "name": "?EnableDelayedDeallocation@Allocator@UnBCL@@QAEXH@Z",
            "ordinal": 1693
          },
          {
            "address": "0x100575c0",
            "name": "?EnableDelayedDeallocation@HeapMemoryManager@UnBCL@@UAEXH@Z",
            "ordinal": 1694
          },
          {
            "address": "0x1006ed10",
            "name": "?EndsWith@String@UnBCL@@QBEHG@Z",
            "ordinal": 1695
          },
          {
            "address": "0x1006ec60",
            "name": "?EndsWith@String@UnBCL@@QBEHPBGH@Z",
            "ordinal": 1696
          },
          {
            "address": "0x10065220",
            "name": "?EnqueueSbRegistration@SbRegistrationList@UnBCL@@SGXPBDHPAUHINSTANCE__@@PAUIInstanceFactory@2@@Z",
            "ordinal": 1697
          },
          {
            "address": "0x10058d20",
            "name": "?Enter@Monitor@UnBCL@@SGXPAVSyncObject@2@@Z",
            "ordinal": 1698
          },
          {
            "address": "0x1005e880",
            "name": "?EnterSection@SyncObject@UnBCL@@IAEXXZ",
            "ordinal": 1699
          },
          {
            "address": "0x10035770",
            "name": "?Equals@?$Array@E@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1700
          },
          {
            "address": "0x10036700",
            "name": "?Equals@?$Array@G@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1701
          },
          {
            "address": "0x1003b130",
            "name": "?Equals@?$Array@H@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1702
          },
          {
            "address": "0x1003a510",
            "name": "?Equals@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1703
          },
          {
            "address": "0x100373d0",
            "name": "?Equals@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1704
          },
          {
            "address": "0x100380c0",
            "name": "?Equals@?$ArrayList@G@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1705
          },
          {
            "address": "0x100334b0",
            "name": "?Equals@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1706
          },
          {
            "address": "0x10046830",
            "name": "?Equals@DateTime@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1707
          },
          {
            "address": "0x1005e5d0",
            "name": "?Equals@Object@UnBCL@@SGHPBV12@0@Z",
            "ordinal": 1708
          },
          {
            "address": "0x1005e3e0",
            "name": "?Equals@Object@UnBCL@@UBEHPBV12@@Z",
            "ordinal": 1709
          },
          {
            "address": "0x10067180",
            "name": "?Equals@SerializationId@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1710
          },
          {
            "address": "0x1006e840",
            "name": "?Equals@String@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1711
          },
          {
            "address": "0x10073640",
            "name": "?Equals@TimeSpan@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1712
          },
          {
            "address": "0x10074f50",
            "name": "?Equals@Version@UnBCL@@UBEHPBVObject@2@@Z",
            "ordinal": 1713
          },
          {
            "address": "0x10051230",
            "name": "?EqualsFunction@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@IBEHPAVString@2@0@Z",
            "ordinal": 1714
          },
          {
            "address": "0x10072130",
            "name": "?EscapeXMLAndAdd@StringBuilder@UnBCL@@IAEXPBG@Z",
            "ordinal": 1715
          },
          {
            "address": "0x10047300",
            "name": "?Exists@Directory@UnBCL@@SGHPBVString@2@@Z",
            "ordinal": 1716
          },
          {
            "address": "0x10054c50",
            "name": "?Exists@File@UnBCL@@SGHPBVString@2@@Z",
            "ordinal": 1717
          },
          {
            "address": "0x10058d90",
            "name": "?Exit@Monitor@UnBCL@@SGXPAVSyncObject@2@@Z",
            "ordinal": 1718
          },
          {
            "address": "0x1004f940",
            "name": "?ExpandEnvironmentVariables@Environment@UnBCL@@SGPAVString@2@PBV32@@Z",
            "ordinal": 1719
          },
          {
            "address": "0x10015020",
            "name": "?FILETIME_OFFSET@DateTime@UnBCL@@0_JB",
            "ordinal": 1720
          },
          {
            "address": "0x1002f200",
            "name": "?Find@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHGH@Z",
            "ordinal": 1721
          },
          {
            "address": "0x1002f1b0",
            "name": "?Find@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBGH@Z",
            "ordinal": 1722
          },
          {
            "address": "0x1002f180",
            "name": "?FindOneOf@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBG@Z",
            "ordinal": 1723
          },
          {
            "address": "0x10064790",
            "name": "?FixupName@RegistryKey@UnBCL@@AAEPAVString@2@ABV32@@Z",
            "ordinal": 1724
          },
          {
            "address": "0x10064830",
            "name": "?FixupPath@RegistryKey@UnBCL@@AAEXAAVStringBuilder@2@@Z",
            "ordinal": 1725
          },
          {
            "address": "0x100459a0",
            "name": "?Flush@BufferedStream@UnBCL@@UAEXXZ",
            "ordinal": 1726
          },
          {
            "address": "0x100570d0",
            "name": "?Flush@FileStream@UnBCL@@UAEXXZ",
            "ordinal": 1727
          },
          {
            "address": "0x1002d510",
            "name": "?Flush@MemoryStream@UnBCL@@UAEXXZ",
            "ordinal": 1728
          },
          {
            "address": "0x100657c0",
            "name": "?Flush@SerializationStream@UnBCL@@QAEXXZ",
            "ordinal": 1729
          },
          {
            "address": "0x1006e280",
            "name": "?Flush@StreamWriter@UnBCL@@UAEXXZ",
            "ordinal": 1730
          },
          {
            "address": "0x10045290",
            "name": "?FlushBuffer@BufferedStream@UnBCL@@AAEXXZ",
            "ordinal": 1731
          },
          {
            "address": "0x10030280",
            "name": "?Fork@?$CSimpleStringT@G$0A@@ATL@@AAEXH@Z",
            "ordinal": 1732
          },
          {
            "address": "0x10030da0",
            "name": "?Format@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXIZZ",
            "ordinal": 1733
          },
          {
            "address": "0x10030e00",
            "name": "?Format@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXPBGZZ",
            "ordinal": 1734
          },
          {
            "address": "0x1002e170",
            "name": "?Format@MutableString@UnBCL@@QAAAAV12@PBGZZ",
            "ordinal": 1735
          },
          {
            "address": "0x10070200",
            "name": "?Format@String@UnBCL@@SAPAV12@PBGZZ",
            "ordinal": 1736
          },
          {
            "address": "0x1002e9e0",
            "name": "?FormatMessageV@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEXPBGPAPAD@Z",
            "ordinal": 1737
          },
          {
            "address": "0x10030ea0",
            "name": "?FormatMessageW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXIZZ",
            "ordinal": 1738
          },
          {
            "address": "0x10030f20",
            "name": "?FormatMessageW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXPBGZZ",
            "ordinal": 1739
          },
          {
            "address": "0x1002ea50",
            "name": "?FormatV@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEXPBGPAD@Z",
            "ordinal": 1740
          },
          {
            "address": "0x10070220",
            "name": "?FormatV@String@UnBCL@@SGPAV12@PBGPAD@Z",
            "ordinal": 1741
          },
          {
            "address": "0x1002e620",
            "name": "?Free@Allocator@UnBCL@@SGXPAXI@Z",
            "ordinal": 1742
          },
          {
            "address": "0x10057650",
            "name": "?Free@HeapMemoryManager@UnBCL@@UAEXPAX@Z",
            "ordinal": 1743
          },
          {
            "address": "0x100307a0",
            "name": "?FreeExtra@?$CSimpleStringT@G$0A@@ATL@@QAEXXZ",
            "ordinal": 1744
          },
          {
            "address": "0x100511d0",
            "name": "?FreezeHash@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAEXXZ",
            "ordinal": 1745
          },
          {
            "address": "0x10070430",
            "name": "?FromASCII@String@UnBCL@@SGPAV12@PBD@Z",
            "ordinal": 1746
          },
          {
            "address": "0x1005a2c0",
            "name": "?FromMultiSz@MultiSz@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBG@Z",
            "ordinal": 1747
          },
          {
            "address": "0x1005a510",
            "name": "?FromMultiSzEx@MultiSz@UnBCL@@SG?AV?$SmartPtr@V?$Array@VStringPtr@UnBCL@@@UnBCL@@@2@PBG@Z",
            "ordinal": 1748
          },
          {
            "address": "0x10073a30",
            "name": "?FromSeconds@TimeSpan@UnBCL@@SG?AV12@N@Z",
            "ordinal": 1749
          },
          {
            "address": "0x10059f00",
            "name": "?FromString@MultiSz@UnBCL@@SGPAV12@PBGG@Z",
            "ordinal": 1750
          },
          {
            "address": "0x1004d9b0",
            "name": "?GetASCII@Encoding@UnBCL@@SGPAV12@XZ",
            "ordinal": 1751
          },
          {
            "address": "0x10030790",
            "name": "?GetAllocLength@?$CSimpleStringT@G$0A@@ATL@@QBEHXZ",
            "ordinal": 1752
          },
          {
            "address": "0x1005f450",
            "name": "?GetAltDirectorySeparatorChar@Path@UnBCL@@SGGXZ",
            "ordinal": 1753
          },
          {
            "address": "0x10049410",
            "name": "?GetApplicationStartDir@Directory@UnBCL@@SGPAVString@2@XZ",
            "ordinal": 1754
          },
          {
            "address": "0x1005f080",
            "name": "?GetArchitectureString@OperatingSystem@UnBCL@@SGPBGK@Z",
            "ordinal": 1755
          },
          {
            "address": "0x10030760",
            "name": "?GetAt@?$CSimpleStringT@G$0A@@ATL@@QBEGH@Z",
            "ordinal": 1756
          },
          {
            "address": "0x10054380",
            "name": "?GetBaseException@Exception@UnBCL@@UBEPBV12@XZ",
            "ordinal": 1757
          },
          {
            "address": "0x10064740",
            "name": "?GetBaseKey@RegistryKey@UnBCL@@KGPAV12@PAUHKEY__@@@Z",
            "ordinal": 1758
          },
          {
            "address": "0x10064360",
            "name": "?GetBinaryValue@RegistryKey@UnBCL@@QAEPAV?$Array@E@2@PBVString@2@@Z",
            "ordinal": 1759
          },
          {
            "address": "0x10035d60",
            "name": "?GetBuffer@?$Array@E@UnBCL@@UAEPAEH@Z",
            "ordinal": 1760
          },
          {
            "address": "0x10035d60",
            "name": "?GetBuffer@?$Array@E@UnBCL@@UBEPBEH@Z",
            "ordinal": 1761
          },
          {
            "address": "0x10035d60",
            "name": "?GetBuffer@?$Array@G@UnBCL@@UAEPAGH@Z",
            "ordinal": 1762
          },
          {
            "address": "0x10035d60",
            "name": "?GetBuffer@?$Array@G@UnBCL@@UBEPBGH@Z",
            "ordinal": 1763
          },
          {
            "address": "0x10035d60",
            "name": "?GetBuffer@?$Array@H@UnBCL@@UAEPAHH@Z",
            "ordinal": 1764
          },
          {
            "address": "0x10035d60",
            "name": "?GetBuffer@?$Array@H@UnBCL@@UBEPBHH@Z",
            "ordinal": 1765
          },
          {
            "address": "0x10035d60",
            "name": "?GetBuffer@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEPAPAVObject@2@H@Z",
            "ordinal": 1766
          },
          {
            "address": "0x10035d60",
            "name": "?GetBuffer@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEPBQAVObject@2@H@Z",
            "ordinal": 1767
          },
          {
            "address": "0x10035d60",
            "name": "?GetBuffer@?$Array@PAVString@UnBCL@@@UnBCL@@UAEPAPAVString@2@H@Z",
            "ordinal": 1768
          },
          {
            "address": "0x10035d60",
            "name": "?GetBuffer@?$Array@PAVString@UnBCL@@@UnBCL@@UBEPBQAVString@2@H@Z",
            "ordinal": 1769
          },
          {
            "address": "0x10039430",
            "name": "?GetBuffer@?$ArrayList@G@UnBCL@@UAEPAGH@Z",
            "ordinal": 1770
          },
          {
            "address": "0x100393a0",
            "name": "?GetBuffer@?$ArrayList@G@UnBCL@@UBEPBGH@Z",
            "ordinal": 1771
          },
          {
            "address": "0x10034a50",
            "name": "?GetBuffer@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEPAPAVString@2@H@Z",
            "ordinal": 1772
          },
          {
            "address": "0x100349c0",
            "name": "?GetBuffer@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEPBQAVString@2@H@Z",
            "ordinal": 1773
          },
          {
            "address": "0x10030650",
            "name": "?GetBuffer@?$CSimpleStringT@G$0A@@ATL@@QAEPAGH@Z",
            "ordinal": 1774
          },
          {
            "address": "0x10030740",
            "name": "?GetBuffer@?$CSimpleStringT@G$0A@@ATL@@QAEPAGXZ",
            "ordinal": 1775
          },
          {
            "address": "0x1004e2d0",
            "name": "?GetBuffer@MemoryStream@UnBCL@@UAEPAV?$Array@E@2@XZ",
            "ordinal": 1776
          },
          {
            "address": "0x10072200",
            "name": "?GetBuffer@StringBuilder@UnBCL@@QAEPAGH@Z",
            "ordinal": 1777
          },
          {
            "address": "0x10030710",
            "name": "?GetBufferSetLength@?$CSimpleStringT@G$0A@@ATL@@QAEPAGH@Z",
            "ordinal": 1778
          },
          {
            "address": "0x10044390",
            "name": "?GetByteCount@ASCIIEncoding@UnBCL@@UBEHPBVString@2@HH@Z",
            "ordinal": 1779
          },
          {
            "address": "0x1004d620",
            "name": "?GetByteCount@Encoding@UnBCL@@UBEHPBVString@2@@Z",
            "ordinal": 1780
          },
          {
            "address": "0x10073e80",
            "name": "?GetByteCount@UnicodeEncoding@UnBCL@@UBEHPBVString@2@HH@Z",
            "ordinal": 1781
          },
          {
            "address": "0x10044450",
            "name": "?GetBytes@ASCIIEncoding@UnBCL@@UBEHPBVString@2@HHPAV?$Array@E@2@H@Z",
            "ordinal": 1782
          },
          {
            "address": "0x1004d6a0",
            "name": "?GetBytes@Encoding@UnBCL@@UBEPAV?$Array@E@2@PBVString@2@@Z",
            "ordinal": 1783
          },
          {
            "address": "0x1004d720",
            "name": "?GetBytes@Encoding@UnBCL@@UBEPAV?$Array@E@2@PBVString@2@HH@Z",
            "ordinal": 1784
          },
          {
            "address": "0x10073f60",
            "name": "?GetBytes@UnicodeEncoding@UnBCL@@UBEHPBVString@2@HHPAV?$Array@E@2@H@Z",
            "ordinal": 1785
          },
          {
            "address": "0x100667c0",
            "name": "?GetCallingModule@SerializationStream@UnBCL@@SGPAUHINSTANCE__@@XZ",
            "ordinal": 1786
          },
          {
            "address": "0x10044640",
            "name": "?GetCharCount@ASCIIEncoding@UnBCL@@UBEHPBV?$Array@E@2@HH@Z",
            "ordinal": 1787
          },
          {
            "address": "0x100740f0",
            "name": "?GetCharCount@UnicodeEncoding@UnBCL@@UBEHPBV?$Array@E@2@HH@Z",
            "ordinal": 1788
          },
          {
            "address": "0x10044650",
            "name": "?GetChars@ASCIIEncoding@UnBCL@@UBEHPBV?$Array@E@2@HHPAV?$Array@G@2@H@Z",
            "ordinal": 1789
          },
          {
            "address": "0x10074100",
            "name": "?GetChars@UnicodeEncoding@UnBCL@@UBEHPBV?$Array@E@2@HHPAV?$Array@G@2@H@Z",
            "ordinal": 1790
          },
          {
            "address": "0x100492e0",
            "name": "?GetCurrentDir@Directory@UnBCL@@SGPAVString@2@XZ",
            "ordinal": 1791
          },
          {
            "address": "0x10062810",
            "name": "?GetCurrentUser@Registry@UnBCL@@SGPAVRegistryKey@2@XZ",
            "ordinal": 1792
          },
          {
            "address": "0x10030270",
            "name": "?GetData@?$CSimpleStringT@G$0A@@ATL@@ABEPAUCStringData@2@XZ",
            "ordinal": 1793
          },
          {
            "address": "0x10047020",
            "name": "?GetDatePart@DateTime@UnBCL@@ABEHW4DatePart@12@@Z",
            "ordinal": 1794
          },
          {
            "address": "0x10044660",
            "name": "?GetDecoder@ASCIIEncoding@UnBCL@@UBEPAVDecoder@2@XZ",
            "ordinal": 1795
          },
          {
            "address": "0x10074130",
            "name": "?GetDecoder@UnicodeEncoding@UnBCL@@UBEPAVDecoder@2@XZ",
            "ordinal": 1796
          },
          {
            "address": "0x1004da50",
            "name": "?GetDefault@Encoding@UnBCL@@SGPAV12@XZ",
            "ordinal": 1797
          },
          {
            "address": "0x10050f20",
            "name": "?GetDictionaryEnumerator@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAU?$IDictionaryEnumerator@PAVString@UnBCL@@PAV12@@2@XZ",
            "ordinal": 1798
          },
          {
            "address": "0x100485d0",
            "name": "?GetDirectories@Directory@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBVString@2@0H@Z",
            "ordinal": 1799
          },
          {
            "address": "0x10048b40",
            "name": "?GetDirectoriesAndFiles@Directory@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBVString@2@0W4EnumerationType@12@H@Z",
            "ordinal": 1800
          },
          {
            "address": "0x10047420",
            "name": "?GetDirectoryRoot@Directory@UnBCL@@SGPAVString@2@PBV32@@Z",
            "ordinal": 1801
          },
          {
            "address": "0x1005f440",
            "name": "?GetDirectorySeparatorChar@Path@UnBCL@@SGGXZ",
            "ordinal": 1802
          },
          {
            "address": "0x100623e0",
            "name": "?GetDwordValue@RegHandle@UnBCL@@QAEHPBGAAK@Z",
            "ordinal": 1803
          },
          {
            "address": "0x10035c30",
            "name": "?GetEnumerator@?$Array@E@UnBCL@@UBEPAU?$IEnumerator@E@2@XZ",
            "ordinal": 1804
          },
          {
            "address": "0x10035c30",
            "name": "?GetEnumerator@?$Array@G@UnBCL@@UBEPAU?$IEnumerator@G@2@XZ",
            "ordinal": 1805
          },
          {
            "address": "0x10035c30",
            "name": "?GetEnumerator@?$Array@H@UnBCL@@UBEPAU?$IEnumerator@H@2@XZ",
            "ordinal": 1806
          },
          {
            "address": "0x10035c30",
            "name": "?GetEnumerator@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEPAU?$IEnumerator@PAVObject@UnBCL@@@2@XZ",
            "ordinal": 1807
          },
          {
            "address": "0x10035c30",
            "name": "?GetEnumerator@?$Array@PAVString@UnBCL@@@UnBCL@@UBEPAU?$IEnumerator@PAVString@UnBCL@@@2@XZ",
            "ordinal": 1808
          },
          {
            "address": "0x100389e0",
            "name": "?GetEnumerator@?$ArrayList@G@UnBCL@@UBEPAU?$IEnumerator@G@2@XZ",
            "ordinal": 1809
          },
          {
            "address": "0x10033f60",
            "name": "?GetEnumerator@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEPAU?$IEnumerator@PAVString@UnBCL@@@2@XZ",
            "ordinal": 1810
          },
          {
            "address": "0x100461b0",
            "name": "?GetEnumerator@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEPAU?$IEnumerator@PAVObject@UnBCL@@@2@XZ",
            "ordinal": 1811
          },
          {
            "address": "0x10050fa0",
            "name": "?GetEnumerator@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAU?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@2@XZ",
            "ordinal": 1812
          },
          {
            "address": "0x10035c30",
            "name": "?GetEnumerator@?$Stack@H@UnBCL@@UBEPAU?$IEnumerator@H@2@XZ",
            "ordinal": 1813
          },
          {
            "address": "0x10035c30",
            "name": "?GetEnumerator@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEPAU?$IEnumerator@PAVObject@UnBCL@@@2@XZ",
            "ordinal": 1814
          },
          {
            "address": "0x1005a270",
            "name": "?GetEnumerator@MultiSz@UnBCL@@UBEPAU?$IEnumerator@PBG@2@XZ",
            "ordinal": 1815
          },
          {
            "address": "0x1007af30",
            "name": "?GetEnumerator@XmlNamespaceManager@UnBCL@@QBEPAU?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@2@XZ",
            "ordinal": 1816
          },
          {
            "address": "0x1004fa70",
            "name": "?GetEnvironmentVar@Environment@UnBCL@@SGPAVString@2@PBV32@@Z",
            "ordinal": 1817
          },
          {
            "address": "0x1002e930",
            "name": "?GetEnvironmentVariableW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHPBG@Z",
            "ordinal": 1818
          },
          {
            "address": "0x1004fcd0",
            "name": "?GetEnvironmentVars@Environment@UnBCL@@SGPAV?$Hashtable@PAVString@UnBCL@@PAV12@@2@XZ",
            "ordinal": 1819
          },
          {
            "address": "0x10060460",
            "name": "?GetFileName@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
            "ordinal": 1820
          },
          {
            "address": "0x100605b0",
            "name": "?GetFileNameExtension@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
            "ordinal": 1821
          },
          {
            "address": "0x10060510",
            "name": "?GetFileNameWithoutExtension@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
            "ordinal": 1822
          },
          {
            "address": "0x100485f0",
            "name": "?GetFiles@Directory@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBVString@2@0H@Z",
            "ordinal": 1823
          },
          {
            "address": "0x1005f7f0",
            "name": "?GetFullPath@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
            "ordinal": 1824
          },
          {
            "address": "0x10057c00",
            "name": "?GetHandler@Logging@UnBCL@@SGPAUILogHandler@@XZ",
            "ordinal": 1825
          },
          {
            "address": "0x10034060",
            "name": "?GetHashCode@DateTime@UnBCL@@UBEHXZ",
            "ordinal": 1826
          },
          {
            "address": "0x1005e400",
            "name": "?GetHashCode@Object@UnBCL@@UBEHXZ",
            "ordinal": 1827
          },
          {
            "address": "0x100671d0",
            "name": "?GetHashCode@SerializationId@UnBCL@@UBEHXZ",
            "ordinal": 1828
          },
          {
            "address": "0x1006e890",
            "name": "?GetHashCode@String@UnBCL@@UBEHXZ",
            "ordinal": 1829
          },
          {
            "address": "0x10034060",
            "name": "?GetHashCode@TimeSpan@UnBCL@@UBEHXZ",
            "ordinal": 1830
          },
          {
            "address": "0x10074fb0",
            "name": "?GetHashCode@Version@UnBCL@@UBEHXZ",
            "ordinal": 1831
          },
          {
            "address": "0x1005f470",
            "name": "?GetInvalidPathChars@Path@UnBCL@@SGPBVString@2@XZ",
            "ordinal": 1832
          },
          {
            "address": "0x1006fda0",
            "name": "?GetIsEmpty@String@UnBCL@@SGHPBG@Z",
            "ordinal": 1833
          },
          {
            "address": "0x10030700",
            "name": "?GetLength@?$CSimpleStringT@G$0A@@ATL@@QBEHXZ",
            "ordinal": 1834
          },
          {
            "address": "0x10049550",
            "name": "?GetLoadedModuleDir@Directory@UnBCL@@SGPAVString@2@PBV32@@Z",
            "ordinal": 1835
          },
          {
            "address": "0x10062800",
            "name": "?GetLocalMachine@Registry@UnBCL@@SGPAVRegistryKey@2@XZ",
            "ordinal": 1836
          },
          {
            "address": "0x1004fbf0",
            "name": "?GetLogicalDriveNames@Environment@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@XZ",
            "ordinal": 1837
          },
          {
            "address": "0x10060f70",
            "name": "?GetLongName@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
            "ordinal": 1838
          },
          {
            "address": "0x100306d0",
            "name": "?GetManager@?$CSimpleStringT@G$0A@@ATL@@QBEPAUIAtlStringMgr@2@XZ",
            "ordinal": 1839
          },
          {
            "address": "0x1002f810",
            "name": "?GetManager@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEPAUIAtlStringMgr@2@XZ",
            "ordinal": 1840
          },
          {
            "address": "0x10044320",
            "name": "?GetMaxByteCount@ASCIIEncoding@UnBCL@@UBEHH@Z",
            "ordinal": 1841
          },
          {
            "address": "0x10073df0",
            "name": "?GetMaxByteCount@UnicodeEncoding@UnBCL@@UBEHH@Z",
            "ordinal": 1842
          },
          {
            "address": "0x10046d80",
            "name": "?GetMaxValue@DateTime@UnBCL@@SG?AV12@XZ",
            "ordinal": 1843
          },
          {
            "address": "0x10046d40",
            "name": "?GetMinValue@DateTime@UnBCL@@SG?AV12@XZ",
            "ordinal": 1844
          },
          {
            "address": "0x1005a660",
            "name": "?GetNextString@MultiSz@UnBCL@@ABEPBGPBG@Z",
            "ordinal": 1845
          },
          {
            "address": "0x10046cc0",
            "name": "?GetNow@DateTime@UnBCL@@SG?AV12@H@Z",
            "ordinal": 1846
          },
          {
            "address": "0x1002e4b0",
            "name": "?GetOOMHandler@Allocator@UnBCL@@SGPAUIOutOfMemoryHandler@@XZ",
            "ordinal": 1847
          },
          {
            "address": "0x1004f6c0",
            "name": "?GetOSVersion@Environment@UnBCL@@SGPBVOperatingSystem@2@H@Z",
            "ordinal": 1848
          },
          {
            "address": "0x1003aa00",
            "name": "?GetObjectID@Object@UnBCL@@UBEIXZ",
            "ordinal": 1849
          },
          {
            "address": "0x1006ed50",
            "name": "?GetOccurenceCount@String@UnBCL@@QBEHG@Z",
            "ordinal": 1850
          },
          {
            "address": "0x1006ed80",
            "name": "?GetOccurenceIndexOf@String@UnBCL@@QBEHGH@Z",
            "ordinal": 1851
          },
          {
            "address": "0x1006ee10",
            "name": "?GetOccurenceLastIndexOf@String@UnBCL@@QBEHGH@Z",
            "ordinal": 1852
          },
          {
            "address": "0x1005fc00",
            "name": "?GetParentPath@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
            "ordinal": 1853
          },
          {
            "address": "0x1005fc30",
            "name": "?GetPathRoot@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
            "ordinal": 1854
          },
          {
            "address": "0x10058a40",
            "name": "?GetRawBuffer@MemoryStream@UnBCL@@UAEPAEXZ",
            "ordinal": 1855
          },
          {
            "address": "0x10060200",
            "name": "?GetRootLength@Path@UnBCL@@KGHPBVString@2@@Z",
            "ordinal": 1856
          },
          {
            "address": "0x10060de0",
            "name": "?GetShortName@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
            "ordinal": 1857
          },
          {
            "address": "0x10054210",
            "name": "?GetStackTrace@Exception@UnBCL@@QBEPAVString@2@XZ",
            "ordinal": 1858
          },
          {
            "address": "0x100306c0",
            "name": "?GetString@?$CSimpleStringT@G$0A@@ATL@@QBEPBGXZ",
            "ordinal": 1859
          },
          {
            "address": "0x1004d860",
            "name": "?GetString@Encoding@UnBCL@@UBEPAVString@2@PBV?$Array@E@2@@Z",
            "ordinal": 1860
          },
          {
            "address": "0x1004d8f0",
            "name": "?GetString@Encoding@UnBCL@@UBEPAVString@2@PBV?$Array@E@2@HH@Z",
            "ordinal": 1861
          },
          {
            "address": "0x10062260",
            "name": "?GetStringInternal@RegHandle@UnBCL@@AAEHPBGAAPAVString@2@KKK@Z",
            "ordinal": 1862
          },
          {
            "address": "0x100623c0",
            "name": "?GetStringValue@RegHandle@UnBCL@@QAEHPBGAAPAVString@2@@Z",
            "ordinal": 1863
          },
          {
            "address": "0x10064500",
            "name": "?GetStringValue@RegistryKey@UnBCL@@QAEPAVString@2@PBV32@H@Z",
            "ordinal": 1864
          },
          {
            "address": "0x10062c50",
            "name": "?GetSubKeyNames@RegistryKey@UnBCL@@QAEPAV?$Array@PAVString@UnBCL@@@2@XZ",
            "ordinal": 1865
          },
          {
            "address": "0x100497a0",
            "name": "?GetSystemDir@Directory@UnBCL@@SGPAVString@2@XZ",
            "ordinal": 1866
          },
          {
            "address": "0x1004ea20",
            "name": "?GetSystemInfo@Environment@UnBCL@@SGPBVSystemInfo@2@H@Z",
            "ordinal": 1867
          },
          {
            "address": "0x100672b0",
            "name": "?GetTempBuffer@SerializationStream@UnBCL@@QAEAAV?$ArrayList@E@2@H@Z",
            "ordinal": 1868
          },
          {
            "address": "0x10048e90",
            "name": "?GetTempPathName@Directory@UnBCL@@SGPAVString@2@XZ",
            "ordinal": 1869
          },
          {
            "address": "0x10055580",
            "name": "?GetTemporaryFileName@File@UnBCL@@SGPAVString@2@PBV32@@Z",
            "ordinal": 1870
          },
          {
            "address": "0x10073140",
            "name": "?GetThisThread@Thread@UnBCL@@SGPAV12@XZ",
            "ordinal": 1871
          },
          {
            "address": "0x1005e410",
            "name": "?GetType@Object@UnBCL@@UBEPAVType@2@XZ",
            "ordinal": 1872
          },
          {
            "address": "0x1003b860",
            "name": "?GetTypeName@?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
            "ordinal": 1873
          },
          {
            "address": "0x1003b9e0",
            "name": "?GetTypeName@?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
            "ordinal": 1874
          },
          {
            "address": "0x1003b6e0",
            "name": "?GetTypeName@?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
            "ordinal": 1875
          },
          {
            "address": "0x1003bb60",
            "name": "?GetTypeName@?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
            "ordinal": 1876
          },
          {
            "address": "0x10039bc0",
            "name": "?GetTypeName@?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
            "ordinal": 1877
          },
          {
            "address": "0x10039e80",
            "name": "?GetTypeName@?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
            "ordinal": 1878
          },
          {
            "address": "0x10051670",
            "name": "?GetTypeName@?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
            "ordinal": 1879
          },
          {
            "address": "0x1006ca20",
            "name": "?GetTypeName@?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
            "ordinal": 1880
          },
          {
            "address": "0x1005a830",
            "name": "?GetTypeName@?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@UBEPBVString@2@XZ",
            "ordinal": 1881
          },
          {
            "address": "0x10051a30",
            "name": "?GetTypeName@?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@UBEPBVString@2@XZ",
            "ordinal": 1882
          },
          {
            "address": "0x10051770",
            "name": "?GetTypeName@?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
            "ordinal": 1883
          },
          {
            "address": "0x1004da00",
            "name": "?GetUnicode@Encoding@UnBCL@@SGPAV12@XZ",
            "ordinal": 1884
          },
          {
            "address": "0x10035ce0",
            "name": "?GetValue@?$Array@E@UnBCL@@UBEEH@Z",
            "ordinal": 1885
          },
          {
            "address": "0x100369d0",
            "name": "?GetValue@?$Array@G@UnBCL@@UBEGH@Z",
            "ordinal": 1886
          },
          {
            "address": "0x100376a0",
            "name": "?GetValue@?$Array@H@UnBCL@@UBEHH@Z",
            "ordinal": 1887
          },
          {
            "address": "0x100376a0",
            "name": "?GetValue@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEPAVObject@2@H@Z",
            "ordinal": 1888
          },
          {
            "address": "0x100376a0",
            "name": "?GetValue@?$Array@PAVString@UnBCL@@@UnBCL@@UBEPAVString@2@H@Z",
            "ordinal": 1889
          },
          {
            "address": "0x100642c0",
            "name": "?GetValue@RegistryKey@UnBCL@@QAEKPBVString@2@@Z",
            "ordinal": 1890
          },
          {
            "address": "0x100641c0",
            "name": "?GetValueKind@RegistryKey@UnBCL@@QAE?AW4RegistryValueKind@2@PBVString@2@@Z",
            "ordinal": 1891
          },
          {
            "address": "0x10062e70",
            "name": "?GetValueNames@RegistryKey@UnBCL@@QAEPAV?$Array@PAVString@UnBCL@@@2@XZ",
            "ordinal": 1892
          },
          {
            "address": "0x10033640",
            "name": "?GetVersionId@?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
            "ordinal": 1893
          },
          {
            "address": "0x10033640",
            "name": "?GetVersionId@?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
            "ordinal": 1894
          },
          {
            "address": "0x10033640",
            "name": "?GetVersionId@?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
            "ordinal": 1895
          },
          {
            "address": "0x10033640",
            "name": "?GetVersionId@?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
            "ordinal": 1896
          },
          {
            "address": "0x10033640",
            "name": "?GetVersionId@?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
            "ordinal": 1897
          },
          {
            "address": "0x10033640",
            "name": "?GetVersionId@?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
            "ordinal": 1898
          },
          {
            "address": "0x10033640",
            "name": "?GetVersionId@?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
            "ordinal": 1899
          },
          {
            "address": "0x10033640",
            "name": "?GetVersionId@?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
            "ordinal": 1900
          },
          {
            "address": "0x10033640",
            "name": "?GetVersionId@?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@UBEHXZ",
            "ordinal": 1901
          },
          {
            "address": "0x10035840",
            "name": "?GetVersionId@?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@UBEHXZ",
            "ordinal": 1902
          },
          {
            "address": "0x10033640",
            "name": "?GetVersionId@?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
            "ordinal": 1903
          },
          {
            "address": "0x1005f460",
            "name": "?GetVolumeSeparatorChar@Path@UnBCL@@SGGXZ",
            "ordinal": 1904
          },
          {
            "address": "0x10049710",
            "name": "?GetWindowsDir@Directory@UnBCL@@SGPAVString@2@XZ",
            "ordinal": 1905
          },
          {
            "address": "0x100739f0",
            "name": "?GetZero@TimeSpan@UnBCL@@SG?AV12@XZ",
            "ordinal": 1906
          },
          {
            "address": "0x10051200",
            "name": "?HashFunction@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@IBEHPAVString@2@@Z",
            "ordinal": 1907
          },
          {
            "address": "0x100bfcd0",
            "name": "?INVALID_PATH_CHARS@Path@UnBCL@@0VString@2@B",
            "ordinal": 1908
          },
          {
            "address": "0x100359e0",
            "name": "?IndexOf@?$Array@E@UnBCL@@SGHPBV12@EHH@Z",
            "ordinal": 1909
          },
          {
            "address": "0x10035a60",
            "name": "?IndexOf@?$Array@E@UnBCL@@UBEHE@Z",
            "ordinal": 1910
          },
          {
            "address": "0x10036830",
            "name": "?IndexOf@?$Array@G@UnBCL@@SGHPBV12@GHH@Z",
            "ordinal": 1911
          },
          {
            "address": "0x10035a60",
            "name": "?IndexOf@?$Array@G@UnBCL@@UBEHG@Z",
            "ordinal": 1912
          },
          {
            "address": "0x1003b260",
            "name": "?IndexOf@?$Array@H@UnBCL@@SGHPBV12@HHH@Z",
            "ordinal": 1913
          },
          {
            "address": "0x10035a60",
            "name": "?IndexOf@?$Array@H@UnBCL@@UBEHH@Z",
            "ordinal": 1914
          },
          {
            "address": "0x1003a640",
            "name": "?IndexOf@?$Array@PAVObject@UnBCL@@@UnBCL@@SGHPBV12@PAVObject@2@HH@Z",
            "ordinal": 1915
          },
          {
            "address": "0x10035a60",
            "name": "?IndexOf@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHPAVObject@2@@Z",
            "ordinal": 1916
          },
          {
            "address": "0x10037500",
            "name": "?IndexOf@?$Array@PAVString@UnBCL@@@UnBCL@@SGHPBV12@PAVString@2@HH@Z",
            "ordinal": 1917
          },
          {
            "address": "0x10035a60",
            "name": "?IndexOf@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHPAVString@2@@Z",
            "ordinal": 1918
          },
          {
            "address": "0x10038500",
            "name": "?IndexOf@?$ArrayList@G@UnBCL@@SGHPBV12@GHH@Z",
            "ordinal": 1919
          },
          {
            "address": "0x10033ab0",
            "name": "?IndexOf@?$ArrayList@G@UnBCL@@UBEHG@Z",
            "ordinal": 1920
          },
          {
            "address": "0x10038580",
            "name": "?IndexOf@?$ArrayList@G@UnBCL@@UBEHGHH@Z",
            "ordinal": 1921
          },
          {
            "address": "0x10033950",
            "name": "?IndexOf@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGHPBV12@PAVString@2@HH@Z",
            "ordinal": 1922
          },
          {
            "address": "0x10033ab0",
            "name": "?IndexOf@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHPAVString@2@@Z",
            "ordinal": 1923
          },
          {
            "address": "0x100339d0",
            "name": "?IndexOf@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHPAVString@2@HH@Z",
            "ordinal": 1924
          },
          {
            "address": "0x10046040",
            "name": "?IndexOf@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEHPAVObject@2@@Z",
            "ordinal": 1925
          },
          {
            "address": "0x1006eec0",
            "name": "?IndexOf@String@UnBCL@@QBEHG@Z",
            "ordinal": 1926
          },
          {
            "address": "0x1006eee0",
            "name": "?IndexOf@String@UnBCL@@QBEHGH@Z",
            "ordinal": 1927
          },
          {
            "address": "0x1006ef60",
            "name": "?IndexOf@String@UnBCL@@QBEHPBG@Z",
            "ordinal": 1928
          },
          {
            "address": "0x1006ef90",
            "name": "?IndexOf@String@UnBCL@@QBEHPBGH@Z",
            "ordinal": 1929
          },
          {
            "address": "0x1006f060",
            "name": "?IndexOfAny@String@UnBCL@@QBEHPBG@Z",
            "ordinal": 1930
          },
          {
            "address": "0x1006f090",
            "name": "?IndexOfAny@String@UnBCL@@QBEHPBGH@Z",
            "ordinal": 1931
          },
          {
            "address": "0x1006f0c0",
            "name": "?IndexOfAny@String@UnBCL@@QBEHPBGHH@Z",
            "ordinal": 1932
          },
          {
            "address": "0x100702f0",
            "name": "?IndexOfAny@String@UnBCL@@SGHPBG0HH@Z",
            "ordinal": 1933
          },
          {
            "address": "0x10060130",
            "name": "?IndexOfEndOfLongPrefix@Path@UnBCL@@SGHPBVString@2@@Z",
            "ordinal": 1934
          },
          {
            "address": "0x10064bf0",
            "name": "?Init@RegSubkeyEnumerator@UnBCL@@AAEXXZ",
            "ordinal": 1935
          },
          {
            "address": "0x1002d510",
            "name": "?InitInternPool@String@UnBCL@@KGXXZ",
            "ordinal": 1936
          },
          {
            "address": "0x10035f40",
            "name": "?InitLarva@?$Array@E@UnBCL@@MAEXPAV?$ArrayList@E@2@@Z",
            "ordinal": 1937
          },
          {
            "address": "0x10036b90",
            "name": "?InitLarva@?$Array@G@UnBCL@@MAEXPAV?$ArrayList@G@2@@Z",
            "ordinal": 1938
          },
          {
            "address": "0x1003b5b0",
            "name": "?InitLarva@?$Array@H@UnBCL@@MAEXPAV?$ArrayList@H@2@@Z",
            "ordinal": 1939
          },
          {
            "address": "0x1003a990",
            "name": "?InitLarva@?$Array@PAVObject@UnBCL@@@UnBCL@@MAEXPAV?$ArrayList@PAVObject@UnBCL@@@2@@Z",
            "ordinal": 1940
          },
          {
            "address": "0x10037860",
            "name": "?InitLarva@?$Array@PAVString@UnBCL@@@UnBCL@@MAEXPAV?$ArrayList@PAVString@UnBCL@@@2@@Z",
            "ordinal": 1941
          },
          {
            "address": "0x10059240",
            "name": "?InitTarget@Monitor@UnBCL@@CGKPAVSyncObject@2@@Z",
            "ordinal": 1942
          },
          {
            "address": "0x1002e400",
            "name": "?InitTerm@Allocator@UnBCL@@SGXH@Z",
            "ordinal": 1943
          },
          {
            "address": "0x10035fb0",
            "name": "?InnerList@?$Array@E@UnBCL@@MBEPAV?$ArrayList@E@2@XZ",
            "ordinal": 1944
          },
          {
            "address": "0x10035fb0",
            "name": "?InnerList@?$Array@G@UnBCL@@MBEPAV?$ArrayList@G@2@XZ",
            "ordinal": 1945
          },
          {
            "address": "0x10035fb0",
            "name": "?InnerList@?$Array@H@UnBCL@@MBEPAV?$ArrayList@H@2@XZ",
            "ordinal": 1946
          },
          {
            "address": "0x1003aa00",
            "name": "?InnerList@?$Array@PAVObject@UnBCL@@@UnBCL@@MBEPAV?$ArrayList@PAVObject@UnBCL@@@2@XZ",
            "ordinal": 1947
          },
          {
            "address": "0x10035fb0",
            "name": "?InnerList@?$Array@PAVString@UnBCL@@@UnBCL@@MBEPAV?$ArrayList@PAVString@UnBCL@@@2@XZ",
            "ordinal": 1948
          },
          {
            "address": "0x1006c940",
            "name": "?InnerList@?$Stack@H@UnBCL@@MAEAAPAV?$ArrayList@H@2@XZ",
            "ordinal": 1949
          },
          {
            "address": "0x1006c940",
            "name": "?InnerList@?$Stack@H@UnBCL@@MBEABQAV?$ArrayList@H@2@XZ",
            "ordinal": 1950
          },
          {
            "address": "0x1006c3f0",
            "name": "?InnerList@?$Stack@PAVObject@UnBCL@@@UnBCL@@MAEAAPAV?$ArrayList@PAVObject@UnBCL@@@2@XZ",
            "ordinal": 1951
          },
          {
            "address": "0x1006c3f0",
            "name": "?InnerList@?$Stack@PAVObject@UnBCL@@@UnBCL@@MBEABQAV?$ArrayList@PAVObject@UnBCL@@@2@XZ",
            "ordinal": 1952
          },
          {
            "address": "0x10035aa0",
            "name": "?Insert@?$Array@E@UnBCL@@UAEXHE@Z",
            "ordinal": 1953
          },
          {
            "address": "0x100368b0",
            "name": "?Insert@?$Array@G@UnBCL@@UAEXHG@Z",
            "ordinal": 1954
          },
          {
            "address": "0x1003b2e0",
            "name": "?Insert@?$Array@H@UnBCL@@UAEXHH@Z",
            "ordinal": 1955
          },
          {
            "address": "0x1003a6c0",
            "name": "?Insert@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXHPAVObject@2@@Z",
            "ordinal": 1956
          },
          {
            "address": "0x10037580",
            "name": "?Insert@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXHPAVString@2@@Z",
            "ordinal": 1957
          },
          {
            "address": "0x10038650",
            "name": "?Insert@?$ArrayList@G@UnBCL@@UAEXHG@Z",
            "ordinal": 1958
          },
          {
            "address": "0x10033b00",
            "name": "?Insert@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXHPAVString@2@@Z",
            "ordinal": 1959
          },
          {
            "address": "0x1002f660",
            "name": "?Insert@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHHG@Z",
            "ordinal": 1960
          },
          {
            "address": "0x1002f5d0",
            "name": "?Insert@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHHPBG@Z",
            "ordinal": 1961
          },
          {
            "address": "0x10046080",
            "name": "?Insert@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEXHPAVObject@2@@Z",
            "ordinal": 1962
          },
          {
            "address": "0x10070650",
            "name": "?Insert@MutableString@UnBCL@@QAEXHPBGH@Z",
            "ordinal": 1963
          },
          {
            "address": "0x1006f460",
            "name": "?Insert@String@UnBCL@@QBEPAV12@HPBG@Z",
            "ordinal": 1964
          },
          {
            "address": "0x100795d0",
            "name": "?InsertAfter@XmlNode@UnBCL@@QAEPAV12@PAV12@0@Z",
            "ordinal": 1965
          },
          {
            "address": "0x10079670",
            "name": "?InsertBefore@XmlNode@UnBCL@@QAEPAV12@PAV12@0@Z",
            "ordinal": 1966
          },
          {
            "address": "0x10070550",
            "name": "?Intern@String@UnBCL@@SGPBV12@PBV12@@Z",
            "ordinal": 1967
          },
          {
            "address": "0x100576d0",
            "name": "?InternalFree@HeapMemoryManager@UnBCL@@AAEXPAX@Z",
            "ordinal": 1968
          },
          {
            "address": "0x10057750",
            "name": "?InternalValidate@HeapMemoryManager@UnBCL@@AAEXPAX@Z",
            "ordinal": 1969
          },
          {
            "address": "0x10073a70",
            "name": "?Interval@TimeSpan@UnBCL@@CG?AV12@NH@Z",
            "ordinal": 1970
          },
          {
            "address": "0x1002e4e0",
            "name": "?InvokeOOMHandler@Allocator@UnBCL@@SGXK@Z",
            "ordinal": 1971
          },
          {
            "address": "0x10045ce0",
            "name": "?IsDigit@Char@UnBCL@@SGHG@Z",
            "ordinal": 1972
          },
          {
            "address": "0x10048c60",
            "name": "?IsDirectoryEmpty@Directory@UnBCL@@SGHPBVString@2@@Z",
            "ordinal": 1973
          },
          {
            "address": "0x100601d0",
            "name": "?IsDirectorySeparator@Path@UnBCL@@SGHG@Z",
            "ordinal": 1974
          },
          {
            "address": "0x1005f5b0",
            "name": "?IsDriveLetterOrUncPrefix@Path@UnBCL@@SGHPBG@Z",
            "ordinal": 1975
          },
          {
            "address": "0x1005f580",
            "name": "?IsDriveLetterOrUncPrefix@Path@UnBCL@@SGHPBVString@2@@Z",
            "ordinal": 1976
          },
          {
            "address": "0x1005f540",
            "name": "?IsDriveLetterPrefix@Path@UnBCL@@SGHPBG@Z",
            "ordinal": 1977
          },
          {
            "address": "0x1005f510",
            "name": "?IsDriveLetterPrefix@Path@UnBCL@@SGHPBVString@2@@Z",
            "ordinal": 1978
          },
          {
            "address": "0x100306b0",
            "name": "?IsEmpty@?$CSimpleStringT@G$0A@@ATL@@QBE_NXZ",
            "ordinal": 1979
          },
          {
            "address": "0x1004fe10",
            "name": "?IsEnvironmentVarSetTrue@Environment@UnBCL@@SGHPBVString@2@H@Z",
            "ordinal": 1980
          },
          {
            "address": "0x10070750",
            "name": "?IsInterned@String@UnBCL@@SGPBV12@PBV12@@Z",
            "ordinal": 1981
          },
          {
            "address": "0x10046dc0",
            "name": "?IsLeapYear@DateTime@UnBCL@@SGHH@Z",
            "ordinal": 1982
          },
          {
            "address": "0x10045d00",
            "name": "?IsLetter@Char@UnBCL@@SGHG@Z",
            "ordinal": 1983
          },
          {
            "address": "0x10045cb0",
            "name": "?IsLetterOrDigit@Char@UnBCL@@SGHG@Z",
            "ordinal": 1984
          },
          {
            "address": "0x10035840",
            "name": "?IsLittleEndian@SerializationStream@UnBCL@@KGHXZ",
            "ordinal": 1985
          },
          {
            "address": "0x10045ce0",
            "name": "?IsNumber@Char@UnBCL@@SGHG@Z",
            "ordinal": 1986
          },
          {
            "address": "0x1005f480",
            "name": "?IsPathRooted@Path@UnBCL@@SGHPBVString@2@@Z",
            "ordinal": 1987
          },
          {
            "address": "0x10061100",
            "name": "?IsShortCompliant@Path@UnBCL@@SGHPBVString@2@H@Z",
            "ordinal": 1988
          },
          {
            "address": "0x10033640",
            "name": "?IsTrackingEnabled@HeapMemoryManager@UnBCL@@QAEHXZ",
            "ordinal": 1989
          },
          {
            "address": "0x1005f600",
            "name": "?IsValid@Path@UnBCL@@SGHPBG@Z",
            "ordinal": 1990
          },
          {
            "address": "0x10070100",
            "name": "?Join@String@UnBCL@@SGPAV12@PBGPAV?$Array@PAVString@UnBCL@@@2@@Z",
            "ordinal": 1991
          },
          {
            "address": "0x10073040",
            "name": "?Join@Thread@UnBCL@@QAEXXZ",
            "ordinal": 1992
          },
          {
            "address": "0x10051250",
            "name": "?KeyDestroy@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@IBEXPAVString@2@@Z",
            "ordinal": 1993
          },
          {
            "address": "0x10035eb0",
            "name": "?LastIndexOf@?$Array@E@UnBCL@@SGHPBV12@EHH@Z",
            "ordinal": 1994
          },
          {
            "address": "0x10036b00",
            "name": "?LastIndexOf@?$Array@G@UnBCL@@SGHPBV12@GHH@Z",
            "ordinal": 1995
          },
          {
            "address": "0x1003b520",
            "name": "?LastIndexOf@?$Array@H@UnBCL@@SGHPBV12@HHH@Z",
            "ordinal": 1996
          },
          {
            "address": "0x1003a900",
            "name": "?LastIndexOf@?$Array@PAVObject@UnBCL@@@UnBCL@@SGHPBV12@PAVObject@2@HH@Z",
            "ordinal": 1997
          },
          {
            "address": "0x100377d0",
            "name": "?LastIndexOf@?$Array@PAVString@UnBCL@@@UnBCL@@SGHPBV12@PAVString@2@HH@Z",
            "ordinal": 1998
          },
          {
            "address": "0x10038ab0",
            "name": "?LastIndexOf@?$ArrayList@G@UnBCL@@SGHPBV12@GHH@Z",
            "ordinal": 1999
          },
          {
            "address": "0x10038b30",
            "name": "?LastIndexOf@?$ArrayList@G@UnBCL@@UBEHGHH@Z",
            "ordinal": 2000
          },
          {
            "address": "0x100340e0",
            "name": "?LastIndexOf@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGHPBV12@PAVString@2@HH@Z",
            "ordinal": 2001
          },
          {
            "address": "0x10034160",
            "name": "?LastIndexOf@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHPAVString@2@HH@Z",
            "ordinal": 2002
          },
          {
            "address": "0x1006f0e0",
            "name": "?LastIndexOf@String@UnBCL@@QBEHG@Z",
            "ordinal": 2003
          },
          {
            "address": "0x1006f110",
            "name": "?LastIndexOf@String@UnBCL@@QBEHGHH@Z",
            "ordinal": 2004
          },
          {
            "address": "0x1006f1b0",
            "name": "?LastIndexOf@String@UnBCL@@QBEHPBG@Z",
            "ordinal": 2005
          },
          {
            "address": "0x1006f1e0",
            "name": "?LastIndexOf@String@UnBCL@@QBEHPBGHH@Z",
            "ordinal": 2006
          },
          {
            "address": "0x1006f370",
            "name": "?LastIndexOfAny@String@UnBCL@@QBEHPBGHH@Z",
            "ordinal": 2007
          },
          {
            "address": "0x1005e8a0",
            "name": "?LeaveSection@SyncObject@UnBCL@@IAEXXZ",
            "ordinal": 2008
          },
          {
            "address": "0x1002ebf0",
            "name": "?Left@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@H@Z",
            "ordinal": 2009
          },
          {
            "address": "0x10058b20",
            "name": "?LengthAtLeast@MemoryStream@UnBCL@@AAEXH@Z",
            "ordinal": 2010
          },
          {
            "address": "0x1007a450",
            "name": "?Load@XmlDocument@UnBCL@@QAEXPAUIStream@@@Z",
            "ordinal": 2011
          },
          {
            "address": "0x1007a290",
            "name": "?Load@XmlDocument@UnBCL@@QAEXPAVString@2@@Z",
            "ordinal": 2012
          },
          {
            "address": "0x10078920",
            "name": "?Load@XmlDocument@XmlLite@UnBCL@@QAEXPAUIStream@@@Z",
            "ordinal": 2013
          },
          {
            "address": "0x100787b0",
            "name": "?Load@XmlDocument@XmlLite@UnBCL@@QAEXPAVString@3@@Z",
            "ordinal": 2014
          },
          {
            "address": "0x1002e8b0",
            "name": "?LoadStringW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHI@Z",
            "ordinal": 2015
          },
          {
            "address": "0x1002e830",
            "name": "?LoadStringW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHPAUHINSTANCE__@@I@Z",
            "ordinal": 2016
          },
          {
            "address": "0x1002e7b0",
            "name": "?LoadStringW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHPAUHINSTANCE__@@IG@Z",
            "ordinal": 2017
          },
          {
            "address": "0x1007a5c0",
            "name": "?LoadXml@XmlDocument@UnBCL@@QAEXPAVString@2@@Z",
            "ordinal": 2018
          },
          {
            "address": "0x10078930",
            "name": "?LoadXml@XmlDocument@XmlLite@UnBCL@@QAEXPAVString@3@@Z",
            "ordinal": 2019
          },
          {
            "address": "0x10030680",
            "name": "?LockBuffer@?$CSimpleStringT@G$0A@@ATL@@QAEPAGXZ",
            "ordinal": 2020
          },
          {
            "address": "0x10046520",
            "name": "?LogW@ConsoleLogHandler@UnBCL@@UAE?AW4tagLOGRESULT@@KPBDKPBG1K@Z",
            "ordinal": 2021
          },
          {
            "address": "0x1007aef0",
            "name": "?LookupNamespace@XmlNamespaceManager@UnBCL@@QAEPAVString@2@PAV32@@Z",
            "ordinal": 2022
          },
          {
            "address": "0x1001e268",
            "name": "?MAX_KEYNAME_LEN@RegistryKey@UnBCL@@0HB",
            "ordinal": 2023
          },
          {
            "address": "0x10015008",
            "name": "?MAX_MS@TimeSpan@UnBCL@@0_JB",
            "ordinal": 2024
          },
          {
            "address": "0x100150e8",
            "name": "?MAX_SECONDS@TimeSpan@UnBCL@@0_JB",
            "ordinal": 2025
          },
          {
            "address": "0x100150f8",
            "name": "?MAX_TICKS@DateTime@UnBCL@@0_JB",
            "ordinal": 2026
          },
          {
            "address": "0x10015078",
            "name": "?MIN_MS@TimeSpan@UnBCL@@0_JB",
            "ordinal": 2027
          },
          {
            "address": "0x10015038",
            "name": "?MIN_SECONDS@TimeSpan@UnBCL@@0_JB",
            "ordinal": 2028
          },
          {
            "address": "0x10015090",
            "name": "?MIN_TICKS@DateTime@UnBCL@@0_JB",
            "ordinal": 2029
          },
          {
            "address": "0x100150e0",
            "name": "?MS_PER_S@TimeSpan@UnBCL@@0HB",
            "ordinal": 2030
          },
          {
            "address": "0x1002f0f0",
            "name": "?MakeLower@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ",
            "ordinal": 2031
          },
          {
            "address": "0x1002e0f0",
            "name": "?MakeLower@MutableString@UnBCL@@QAEXXZ",
            "ordinal": 2032
          },
          {
            "address": "0x1002f0c0",
            "name": "?MakeReverse@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ",
            "ordinal": 2033
          },
          {
            "address": "0x1004a280",
            "name": "?MakeSureDirectoryExists@Directory@UnBCL@@SGKPBGPAH@Z",
            "ordinal": 2034
          },
          {
            "address": "0x1002e100",
            "name": "?MakeTrim@MutableString@UnBCL@@QAEXPBG@Z",
            "ordinal": 2035
          },
          {
            "address": "0x1002f120",
            "name": "?MakeUpper@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ",
            "ordinal": 2036
          },
          {
            "address": "0x1006fed0",
            "name": "?Match@String@UnBCL@@SGHPBG0@Z",
            "ordinal": 2037
          },
          {
            "address": "0x1006fef0",
            "name": "?Match@String@UnBCL@@SGHPBV12@0@Z",
            "ordinal": 2038
          },
          {
            "address": "0x1006ff10",
            "name": "?MatchI@String@UnBCL@@SGHPBG0@Z",
            "ordinal": 2039
          },
          {
            "address": "0x1006ff30",
            "name": "?MatchI@String@UnBCL@@SGHPBV12@0@Z",
            "ordinal": 2040
          },
          {
            "address": "0x1002e520",
            "name": "?MemAllocFailed@Allocator@UnBCL@@SGHXZ",
            "ordinal": 2041
          },
          {
            "address": "0x10059e40",
            "name": "?Merge@MultiSz@UnBCL@@QAEXABV12@H@Z",
            "ordinal": 2042
          },
          {
            "address": "0x1002ed60",
            "name": "?Mid@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@H@Z",
            "ordinal": 2043
          },
          {
            "address": "0x1002ecc0",
            "name": "?Mid@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@HH@Z",
            "ordinal": 2044
          },
          {
            "address": "0x100481f0",
            "name": "?Move@Directory@UnBCL@@SGXPBVString@2@0@Z",
            "ordinal": 2045
          },
          {
            "address": "0x10054ec0",
            "name": "?Move@File@UnBCL@@SGXPBVString@2@0@Z",
            "ordinal": 2046
          },
          {
            "address": "0x10055110",
            "name": "?MoveEx@File@UnBCL@@SGXPBVString@2@0K@Z",
            "ordinal": 2047
          },
          {
            "address": "0x100560a0",
            "name": "?MoveNext@FileSystemEnumerator@UnBCL@@UAEHXZ",
            "ordinal": 2048
          },
          {
            "address": "0x10064cb0",
            "name": "?MoveNext@RegSubkeyEnumerator@UnBCL@@UAEHXZ",
            "ordinal": 2049
          },
          {
            "address": "0x10030ff0",
            "name": "?Nullify@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAEAAV12@XZ",
            "ordinal": 2050
          },
          {
            "address": "0x10030ff0",
            "name": "?Nullify@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV12@XZ",
            "ordinal": 2051
          },
          {
            "address": "0x10030ff0",
            "name": "?Nullify@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV12@XZ",
            "ordinal": 2052
          },
          {
            "address": "0x10030ff0",
            "name": "?Nullify@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAEAAV12@XZ",
            "ordinal": 2053
          },
          {
            "address": "0x10030ff0",
            "name": "?Nullify@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAEAAV12@XZ",
            "ordinal": 2054
          },
          {
            "address": "0x1002d240",
            "name": "?Nullify@?$SmartPtr@VObject@UnBCL@@@UnBCL@@QAEAAV12@XZ",
            "ordinal": 2055
          },
          {
            "address": "0x1002d240",
            "name": "?Nullify@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAEAAV12@XZ",
            "ordinal": 2056
          },
          {
            "address": "0x1002d240",
            "name": "?Nullify@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAEAAV12@XZ",
            "ordinal": 2057
          },
          {
            "address": "0x10030ff0",
            "name": "?Nullify@?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAEAAV12@XZ",
            "ordinal": 2058
          },
          {
            "address": "0x1002d240",
            "name": "?Nullify@?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEAAV12@XZ",
            "ordinal": 2059
          },
          {
            "address": "0x10051900",
            "name": "?Nullify@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAEAAV12@XZ",
            "ordinal": 2060
          },
          {
            "address": "0x1002d240",
            "name": "?Nullify@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAEAAV12@XZ",
            "ordinal": 2061
          },
          {
            "address": "0x1004e320",
            "name": "?NumBlocksAllocated@HeapMemoryManager@UnBCL@@UAEIXZ",
            "ordinal": 2062
          },
          {
            "address": "0x1002eda0",
            "name": "?OemToCharA@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEXXZ",
            "ordinal": 2063
          },
          {
            "address": "0x100621f0",
            "name": "?Open@RegHandle@UnBCL@@QAEHPAUHKEY__@@PBGK@Z",
            "ordinal": 2064
          },
          {
            "address": "0x10063320",
            "name": "?OpenSubKey@RegistryKey@UnBCL@@QAEPAV12@PBVString@2@@Z",
            "ordinal": 2065
          },
          {
            "address": "0x10063340",
            "name": "?OpenSubKey@RegistryKey@UnBCL@@QAEPAV12@PBVString@2@H@Z",
            "ordinal": 2066
          },
          {
            "address": "0x10057910",
            "name": "?Parse@Int32Ops@UnBCL@@SGHPBG@Z",
            "ordinal": 2067
          },
          {
            "address": "0x10077cc0",
            "name": "?Parse@XmlDocument@XmlLite@UnBCL@@IAEXPAUIStream@@@Z",
            "ordinal": 2068
          },
          {
            "address": "0x1006c800",
            "name": "?Peek@?$Stack@H@UnBCL@@UAEAAHXZ",
            "ordinal": 2069
          },
          {
            "address": "0x1006c8a0",
            "name": "?Peek@?$Stack@H@UnBCL@@UBEABHXZ",
            "ordinal": 2070
          },
          {
            "address": "0x1006c220",
            "name": "?Peek@?$Stack@PAVObject@UnBCL@@@UnBCL@@UAEAAPAVObject@2@XZ",
            "ordinal": 2071
          },
          {
            "address": "0x1006c2c0",
            "name": "?Peek@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEABQAVObject@2@XZ",
            "ordinal": 2072
          },
          {
            "address": "0x1006d550",
            "name": "?Peek@StreamReader@UnBCL@@UAEHXZ",
            "ordinal": 2073
          },
          {
            "address": "0x1006c360",
            "name": "?Pop@?$Stack@H@UnBCL@@UAEHXZ",
            "ordinal": 2074
          },
          {
            "address": "0x1006c360",
            "name": "?Pop@?$Stack@PAVObject@UnBCL@@@UnBCL@@UAEPAVObject@2@XZ",
            "ordinal": 2075
          },
          {
            "address": "0x10030650",
            "name": "?Preallocate@?$CSimpleStringT@G$0A@@ATL@@QAEXH@Z",
            "ordinal": 2076
          },
          {
            "address": "0x100301d0",
            "name": "?PrepareWrite2@?$CSimpleStringT@G$0A@@ATL@@AAEXH@Z",
            "ordinal": 2077
          },
          {
            "address": "0x10030230",
            "name": "?PrepareWrite@?$CSimpleStringT@G$0A@@ATL@@AAEPAGH@Z",
            "ordinal": 2078
          },
          {
            "address": "0x10058f60",
            "name": "?Pulse@Monitor@UnBCL@@SGXPAVSyncObject@2@@Z",
            "ordinal": 2079
          },
          {
            "address": "0x10059080",
            "name": "?PulseAll@Monitor@UnBCL@@SGXPAVSyncObject@2@@Z",
            "ordinal": 2080
          },
          {
            "address": "0x1006c3b0",
            "name": "?Push@?$Stack@H@UnBCL@@UAEXH@Z",
            "ordinal": 2081
          },
          {
            "address": "0x1006c3b0",
            "name": "?Push@?$Stack@PAVObject@UnBCL@@@UnBCL@@UAEXPAVObject@2@@Z",
            "ordinal": 2082
          },
          {
            "address": "0x10039640",
            "name": "?QuickSort@?$ArrayList@G@UnBCL@@AAEXPAV12@0HH@Z",
            "ordinal": 2083
          },
          {
            "address": "0x10034c90",
            "name": "?QuickSort@?$ArrayList@PAVString@UnBCL@@@UnBCL@@AAEXPAV12@0HH@Z",
            "ordinal": 2084
          },
          {
            "address": "0x1002e5a0",
            "name": "?ReAlloc@Allocator@UnBCL@@SGPAXPAXKI@Z",
            "ordinal": 2085
          },
          {
            "address": "0x10057560",
            "name": "?ReAlloc@HeapMemoryManager@UnBCL@@UAEPAXPAXK@Z",
            "ordinal": 2086
          },
          {
            "address": "0x1002e5e0",
            "name": "?ReAllocDbg@Allocator@UnBCL@@SGPAXPAXKPBDHI@Z",
            "ordinal": 2087
          },
          {
            "address": "0x10057590",
            "name": "?ReAllocDbg@HeapMemoryManager@UnBCL@@UAEPAXPBDHPAXK@Z",
            "ordinal": 2088
          },
          {
            "address": "0x100454d0",
            "name": "?Read@BufferedStream@UnBCL@@UAEHPAEHH@Z",
            "ordinal": 2089
          },
          {
            "address": "0x10056b30",
            "name": "?Read@FileStream@UnBCL@@UAEHPAEHH@Z",
            "ordinal": 2090
          },
          {
            "address": "0x10058140",
            "name": "?Read@MemoryStream@UnBCL@@UAEHPAEHH@Z",
            "ordinal": 2091
          },
          {
            "address": "0x1006d770",
            "name": "?Read@StreamReader@UnBCL@@UAEHXZ",
            "ordinal": 2092
          },
          {
            "address": "0x1006cda0",
            "name": "?ReadByte@Stream@UnBCL@@UAEHXZ",
            "ordinal": 2093
          },
          {
            "address": "0x10065750",
            "name": "?ReadBytes@SerializationStream@UnBCL@@QAEAAV?$ArrayList@E@2@H@Z",
            "ordinal": 2094
          },
          {
            "address": "0x10065660",
            "name": "?ReadBytes@SerializationStream@UnBCL@@QAEXPAEH@Z",
            "ordinal": 2095
          },
          {
            "address": "0x10072910",
            "name": "?ReadLine@TextReader@UnBCL@@UAEPAVString@2@XZ",
            "ordinal": 2096
          },
          {
            "address": "0x10066d20",
            "name": "?ReadObject@SerializationStream@UnBCL@@IAEPAUISerializable@2@XZ",
            "ordinal": 2097
          },
          {
            "address": "0x10066b70",
            "name": "?ReadObjectHeader@SerializationStream@UnBCL@@AAEHAAPAVObject@2@@Z",
            "ordinal": 2098
          },
          {
            "address": "0x100668f0",
            "name": "?ReadPhantomObject@SerializationStream@UnBCL@@QAEXAAPAVObject@2@@Z",
            "ordinal": 2099
          },
          {
            "address": "0x10030180",
            "name": "?Reallocate@?$CSimpleStringT@G$0A@@ATL@@AAEXH@Z",
            "ordinal": 2100
          },
          {
            "address": "0x1005e620",
            "name": "?ReferenceEquals@Object@UnBCL@@SGHPBV12@0@Z",
            "ordinal": 2101
          },
          {
            "address": "0x1007a860",
            "name": "?RegisterNamespaces@XmlDocument@UnBCL@@QAEXPAVString@2@@Z",
            "ordinal": 2102
          },
          {
            "address": "0x10079870",
            "name": "?RegisterNamespaces@XmlNode@UnBCL@@AAEXPAVXmlNamespaceManager@2@@Z",
            "ordinal": 2103
          },
          {
            "address": "0x100651a0",
            "name": "?RegisterStaticTypes@SbRegistrationList@UnBCL@@SGXH@Z",
            "ordinal": 2104
          },
          {
            "address": "0x10066470",
            "name": "?RegisterType@SerializationStream@UnBCL@@SGXPBVString@2@HPAUHINSTANCE__@@PAUIInstanceFactory@2@@Z",
            "ordinal": 2105
          },
          {
            "address": "0x1003b950",
            "name": "?RegisterVersion@?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
            "ordinal": 2106
          },
          {
            "address": "0x1003bad0",
            "name": "?RegisterVersion@?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
            "ordinal": 2107
          },
          {
            "address": "0x1003b7d0",
            "name": "?RegisterVersion@?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
            "ordinal": 2108
          },
          {
            "address": "0x1003bc50",
            "name": "?RegisterVersion@?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
            "ordinal": 2109
          },
          {
            "address": "0x10039cb0",
            "name": "?RegisterVersion@?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
            "ordinal": 2110
          },
          {
            "address": "0x10039f70",
            "name": "?RegisterVersion@?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
            "ordinal": 2111
          },
          {
            "address": "0x10051760",
            "name": "?RegisterVersion@?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
            "ordinal": 2112
          },
          {
            "address": "0x1006cb10",
            "name": "?RegisterVersion@?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
            "ordinal": 2113
          },
          {
            "address": "0x1005a920",
            "name": "?RegisterVersion@?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@MBEXH@Z",
            "ordinal": 2114
          },
          {
            "address": "0x10051b20",
            "name": "?RegisterVersion@?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@MBEXH@Z",
            "ordinal": 2115
          },
          {
            "address": "0x10051860",
            "name": "?RegisterVersion@?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
            "ordinal": 2116
          },
          {
            "address": "0x1005e0d0",
            "name": "?Release@Mutex@UnBCL@@UAEXXZ",
            "ordinal": 2117
          },
          {
            "address": "0x10030620",
            "name": "?ReleaseBuffer@?$CSimpleStringT@G$0A@@ATL@@QAEXH@Z",
            "ordinal": 2118
          },
          {
            "address": "0x10072230",
            "name": "?ReleaseBuffer@StringBuilder@UnBCL@@QAEXH@Z",
            "ordinal": 2119
          },
          {
            "address": "0x10030610",
            "name": "?ReleaseBufferSetLength@?$CSimpleStringT@G$0A@@ATL@@QAEXH@Z",
            "ordinal": 2120
          },
          {
            "address": "0x10035b00",
            "name": "?Remove@?$Array@E@UnBCL@@UAEXE@Z",
            "ordinal": 2121
          },
          {
            "address": "0x10036910",
            "name": "?Remove@?$Array@G@UnBCL@@UAEXG@Z",
            "ordinal": 2122
          },
          {
            "address": "0x1003b340",
            "name": "?Remove@?$Array@H@UnBCL@@UAEXH@Z",
            "ordinal": 2123
          },
          {
            "address": "0x1003a720",
            "name": "?Remove@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXPAVObject@2@@Z",
            "ordinal": 2124
          },
          {
            "address": "0x100375e0",
            "name": "?Remove@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXPAVString@2@@Z",
            "ordinal": 2125
          },
          {
            "address": "0x10033ba0",
            "name": "?Remove@?$ArrayList@G@UnBCL@@UAEXG@Z",
            "ordinal": 2126
          },
          {
            "address": "0x10033ba0",
            "name": "?Remove@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXPAVString@2@@Z",
            "ordinal": 2127
          },
          {
            "address": "0x1002f320",
            "name": "?Remove@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHG@Z",
            "ordinal": 2128
          },
          {
            "address": "0x100460c0",
            "name": "?Remove@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEXPAVObject@2@@Z",
            "ordinal": 2129
          },
          {
            "address": "0x10050e40",
            "name": "?Remove@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXPAVString@2@@Z",
            "ordinal": 2130
          },
          {
            "address": "0x1006f550",
            "name": "?Remove@String@UnBCL@@QBEPAV12@HH@Z",
            "ordinal": 2131
          },
          {
            "address": "0x10035b60",
            "name": "?RemoveAt@?$Array@E@UnBCL@@UAEXH@Z",
            "ordinal": 2132
          },
          {
            "address": "0x10036970",
            "name": "?RemoveAt@?$Array@G@UnBCL@@UAEXH@Z",
            "ordinal": 2133
          },
          {
            "address": "0x1003b3a0",
            "name": "?RemoveAt@?$Array@H@UnBCL@@UAEXH@Z",
            "ordinal": 2134
          },
          {
            "address": "0x1003a780",
            "name": "?RemoveAt@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXH@Z",
            "ordinal": 2135
          },
          {
            "address": "0x10037640",
            "name": "?RemoveAt@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXH@Z",
            "ordinal": 2136
          },
          {
            "address": "0x100386f0",
            "name": "?RemoveAt@?$ArrayList@G@UnBCL@@UAEXH@Z",
            "ordinal": 2137
          },
          {
            "address": "0x10033c00",
            "name": "?RemoveAt@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXH@Z",
            "ordinal": 2138
          },
          {
            "address": "0x10046100",
            "name": "?RemoveAt@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEXH@Z",
            "ordinal": 2139
          },
          {
            "address": "0x100797e0",
            "name": "?RemoveChild@XmlNode@UnBCL@@QAEXPAV12@@Z",
            "ordinal": 2140
          },
          {
            "address": "0x1007aeb0",
            "name": "?RemoveNamespace@XmlNamespaceManager@UnBCL@@QAEXPAVString@2@@Z",
            "ordinal": 2141
          },
          {
            "address": "0x10033cd0",
            "name": "?RemoveTail@?$ArrayList@G@UnBCL@@UAEXXZ",
            "ordinal": 2142
          },
          {
            "address": "0x10033cd0",
            "name": "?RemoveTail@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXXZ",
            "ordinal": 2143
          },
          {
            "address": "0x1002f540",
            "name": "?Replace@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHGG@Z",
            "ordinal": 2144
          },
          {
            "address": "0x1002f3b0",
            "name": "?Replace@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHPBG0@Z",
            "ordinal": 2145
          },
          {
            "address": "0x1006f910",
            "name": "?Replace@String@UnBCL@@QBEPAV12@GG@Z",
            "ordinal": 2146
          },
          {
            "address": "0x1006f610",
            "name": "?Replace@String@UnBCL@@QBEPAV12@PAV12@0H@Z",
            "ordinal": 2147
          },
          {
            "address": "0x1006f710",
            "name": "?Replace@String@UnBCL@@QBEPAV12@PBG0W4StringCasing@12@@Z",
            "ordinal": 2148
          },
          {
            "address": "0x10056040",
            "name": "?Reset@FileSystemEnumerator@UnBCL@@UAEXXZ",
            "ordinal": 2149
          },
          {
            "address": "0x10064e00",
            "name": "?Reset@RegSubkeyEnumerator@UnBCL@@UAEXXZ",
            "ordinal": 2150
          },
          {
            "address": "0x10071e00",
            "name": "?Reset@StringBuilder@UnBCL@@QAEXXZ",
            "ordinal": 2151
          },
          {
            "address": "0x10038bf0",
            "name": "?Resize@?$ArrayList@G@UnBCL@@UAEXHH@Z",
            "ordinal": 2152
          },
          {
            "address": "0x10034220",
            "name": "?Resize@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXHH@Z",
            "ordinal": 2153
          },
          {
            "address": "0x10051180",
            "name": "?Retrieve@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHPAVString@2@AAPAV32@@Z",
            "ordinal": 2154
          },
          {
            "address": "0x100512d0",
            "name": "?RetrieveEntry@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@KG?AV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@2@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@PAVString@3@UKeyTraits@23@V?$CElementTraits@PAVString@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z",
            "ordinal": 2155
          },
          {
            "address": "0x10051270",
            "name": "?RetrieveKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@KGPAVString@2@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@PAVString@3@UKeyTraits@23@V?$CElementTraits@PAVString@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z",
            "ordinal": 2156
          },
          {
            "address": "0x100512a0",
            "name": "?RetrieveValue@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@KGPAVString@2@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@PAVString@3@UKeyTraits@23@V?$CElementTraits@PAVString@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z",
            "ordinal": 2157
          },
          {
            "address": "0x10038cc0",
            "name": "?Reverse@?$ArrayList@G@UnBCL@@UAEXXZ",
            "ordinal": 2158
          },
          {
            "address": "0x10034300",
            "name": "?Reverse@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXXZ",
            "ordinal": 2159
          },
          {
            "address": "0x1002f150",
            "name": "?ReverseFind@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHG@Z",
            "ordinal": 2160
          },
          {
            "address": "0x1002ec50",
            "name": "?Right@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@H@Z",
            "ordinal": 2161
          },
          {
            "address": "0x10044750",
            "name": "?SGetCharCount@ASCIIEncoding@UnBCL@@CGHPBV?$Array@E@2@HH@Z",
            "ordinal": 2162
          },
          {
            "address": "0x10074170",
            "name": "?SGetCharCount@UnicodeEncoding@UnBCL@@CGHPBV?$Array@E@2@HH@Z",
            "ordinal": 2163
          },
          {
            "address": "0x10044820",
            "name": "?SGetChars@ASCIIEncoding@UnBCL@@CGHPBV?$Array@E@2@HHPAV?$Array@G@2@H@Z",
            "ordinal": 2164
          },
          {
            "address": "0x10074250",
            "name": "?SGetChars@UnicodeEncoding@UnBCL@@CGHPBV?$Array@E@2@HHPAV?$Array@G@2@HH@Z",
            "ordinal": 2165
          },
          {
            "address": "0x10060900",
            "name": "?Sanitize@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
            "ordinal": 2166
          },
          {
            "address": "0x10066430",
            "name": "?SanitizeTypeName@SerializationStream@UnBCL@@SGPAVString@2@ABV32@@Z",
            "ordinal": 2167
          },
          {
            "address": "0x1007a770",
            "name": "?Save@XmlDocument@UnBCL@@QAEXPAVString@2@@Z",
            "ordinal": 2168
          },
          {
            "address": "0x10045890",
            "name": "?Seek@BufferedStream@UnBCL@@UAE_J_JW4SeekOrigin@2@@Z",
            "ordinal": 2169
          },
          {
            "address": "0x10056e50",
            "name": "?Seek@FileStream@UnBCL@@UAE_J_JW4SeekOrigin@2@@Z",
            "ordinal": 2170
          },
          {
            "address": "0x10058450",
            "name": "?Seek@MemoryStream@UnBCL@@UAE_J_JW4SeekOrigin@2@@Z",
            "ordinal": 2171
          },
          {
            "address": "0x100791d0",
            "name": "?SelectNodes@XmlNode@UnBCL@@QAEPAVXmlNodeList@2@PAVString@2@@Z",
            "ordinal": 2172
          },
          {
            "address": "0x100792e0",
            "name": "?SelectNodes@XmlNode@UnBCL@@QAEPAVXmlNodeList@2@PAVString@2@PAVXmlNamespaceManager@2@@Z",
            "ordinal": 2173
          },
          {
            "address": "0x100775c0",
            "name": "?SelectNodes@XmlNode@XmlLite@UnBCL@@QAEPAVXmlNodeList@23@PAVString@3@@Z",
            "ordinal": 2174
          },
          {
            "address": "0x10079310",
            "name": "?SelectSingleNode@XmlNode@UnBCL@@QAEPAV12@PAVString@2@@Z",
            "ordinal": 2175
          },
          {
            "address": "0x10079400",
            "name": "?SelectSingleNode@XmlNode@UnBCL@@QAEPAV12@PAVString@2@PAVXmlNamespaceManager@2@@Z",
            "ordinal": 2176
          },
          {
            "address": "0x10030590",
            "name": "?SetAt@?$CSimpleStringT@G$0A@@ATL@@QAEXHG@Z",
            "ordinal": 2177
          },
          {
            "address": "0x10055750",
            "name": "?SetCompressionState@File@UnBCL@@SGHPBVString@2@G@Z",
            "ordinal": 2178
          },
          {
            "address": "0x1004fb40",
            "name": "?SetEnvironmentVar@Environment@UnBCL@@SGXPBVString@2@0@Z",
            "ordinal": 2179
          },
          {
            "address": "0x10057c10",
            "name": "?SetHandler@Logging@UnBCL@@SGXPAUILogHandler@@@Z",
            "ordinal": 2180
          },
          {
            "address": "0x10030140",
            "name": "?SetLength@?$CSimpleStringT@G$0A@@ATL@@AAEXH@Z",
            "ordinal": 2181
          },
          {
            "address": "0x10058970",
            "name": "?SetLength@MemoryStream@UnBCL@@UAEX_J@Z",
            "ordinal": 2182
          },
          {
            "address": "0x100716a0",
            "name": "?SetLiteralStorage@_@UnBCL@@YGXPAPBVString@2@PBG@Z",
            "ordinal": 2183
          },
          {
            "address": "0x10030550",
            "name": "?SetManager@?$CSimpleStringT@G$0A@@ATL@@QAEXPAUIAtlStringMgr@2@@Z",
            "ordinal": 2184
          },
          {
            "address": "0x10054410",
            "name": "?SetMessage@Exception@UnBCL@@MAEXPAVString@2@@Z",
            "ordinal": 2185
          },
          {
            "address": "0x1007a030",
            "name": "?SetNamedItem@XmlAttributeCollection@UnBCL@@QAEPAVXmlNode@2@PAV32@@Z",
            "ordinal": 2186
          },
          {
            "address": "0x1002e4c0",
            "name": "?SetOOMHandler@Allocator@UnBCL@@SGXPAUIOutOfMemoryHandler@@@Z",
            "ordinal": 2187
          },
          {
            "address": "0x1002e680",
            "name": "?SetRef@Allocator@UnBCL@@SGXI@Z",
            "ordinal": 2188
          },
          {
            "address": "0x1002d510",
            "name": "?SetRef@HeapMemoryManager@UnBCL@@UAEXXZ",
            "ordinal": 2189
          },
          {
            "address": "0x10057190",
            "name": "?SetSize@FileStream@UnBCL@@UAEX_J@Z",
            "ordinal": 2190
          },
          {
            "address": "0x10030520",
            "name": "?SetString@?$CSimpleStringT@G$0A@@ATL@@QAEXPBG@Z",
            "ordinal": 2191
          },
          {
            "address": "0x100304a0",
            "name": "?SetString@?$CSimpleStringT@G$0A@@ATL@@QAEXPBGH@Z",
            "ordinal": 2192
          },
          {
            "address": "0x1002e990",
            "name": "?SetSysString@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEPAGPAPAG@Z",
            "ordinal": 2193
          },
          {
            "address": "0x10035d20",
            "name": "?SetValue@?$Array@E@UnBCL@@UAEXEH@Z",
            "ordinal": 2194
          },
          {
            "address": "0x10035d20",
            "name": "?SetValue@?$Array@G@UnBCL@@UAEXGH@Z",
            "ordinal": 2195
          },
          {
            "address": "0x10035d20",
            "name": "?SetValue@?$Array@H@UnBCL@@UAEXHH@Z",
            "ordinal": 2196
          },
          {
            "address": "0x10035d20",
            "name": "?SetValue@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXPAVObject@2@H@Z",
            "ordinal": 2197
          },
          {
            "address": "0x10035d20",
            "name": "?SetValue@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXPAVString@2@H@Z",
            "ordinal": 2198
          },
          {
            "address": "0x10063fa0",
            "name": "?SetValue@RegistryKey@UnBCL@@QAEXPBVString@2@0H@Z",
            "ordinal": 2199
          },
          {
            "address": "0x10063a60",
            "name": "?SetValue@RegistryKey@UnBCL@@QAEXPBVString@2@H@Z",
            "ordinal": 2200
          },
          {
            "address": "0x10063b50",
            "name": "?SetValue@RegistryKey@UnBCL@@QAEXPBVString@2@PBV?$Array@E@2@@Z",
            "ordinal": 2201
          },
          {
            "address": "0x10063cd0",
            "name": "?SetValue@RegistryKey@UnBCL@@QAEXPBVString@2@PBV?$Array@PAVString@UnBCL@@@2@@Z",
            "ordinal": 2202
          },
          {
            "address": "0x1004a410",
            "name": "?ShouldEnumerateReparsePoint@Directory@UnBCL@@SGHPBVString@2@@Z",
            "ordinal": 2203
          },
          {
            "address": "0x10073130",
            "name": "?SleepFor@Thread@UnBCL@@SGXI@Z",
            "ordinal": 2204
          },
          {
            "address": "0x10035d90",
            "name": "?Sort@?$Array@E@UnBCL@@SGXPAV12@@Z",
            "ordinal": 2205
          },
          {
            "address": "0x10036a10",
            "name": "?Sort@?$Array@G@UnBCL@@SGXPAV12@@Z",
            "ordinal": 2206
          },
          {
            "address": "0x1003b400",
            "name": "?Sort@?$Array@H@UnBCL@@SGXPAV12@@Z",
            "ordinal": 2207
          },
          {
            "address": "0x1003a7e0",
            "name": "?Sort@?$Array@PAVObject@UnBCL@@@UnBCL@@SGXPAV12@@Z",
            "ordinal": 2208
          },
          {
            "address": "0x100376e0",
            "name": "?Sort@?$Array@PAVString@UnBCL@@@UnBCL@@SGXPAV12@@Z",
            "ordinal": 2209
          },
          {
            "address": "0x10038fa0",
            "name": "?Sort@?$ArrayList@G@UnBCL@@SGXPAV12@@Z",
            "ordinal": 2210
          },
          {
            "address": "0x10039020",
            "name": "?Sort@?$ArrayList@G@UnBCL@@UAEXXZ",
            "ordinal": 2211
          },
          {
            "address": "0x100345c0",
            "name": "?Sort@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGXPAV12@@Z",
            "ordinal": 2212
          },
          {
            "address": "0x10034640",
            "name": "?Sort@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXXZ",
            "ordinal": 2213
          },
          {
            "address": "0x1002eb30",
            "name": "?SpanExcluding@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@PBG@Z",
            "ordinal": 2214
          },
          {
            "address": "0x1002eb90",
            "name": "?SpanIncluding@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@PBG@Z",
            "ordinal": 2215
          },
          {
            "address": "0x1006f960",
            "name": "?Split@String@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@2@PBG@Z",
            "ordinal": 2216
          },
          {
            "address": "0x1006f980",
            "name": "?Split@String@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@2@PBGH@Z",
            "ordinal": 2217
          },
          {
            "address": "0x10061a10",
            "name": "?Start@Process@UnBCL@@SGPAV12@PBVProcessStartInfo@2@@Z",
            "ordinal": 2218
          },
          {
            "address": "0x100730d0",
            "name": "?Start@Thread@UnBCL@@QAEXXZ",
            "ordinal": 2219
          },
          {
            "address": "0x10073220",
            "name": "?StartAddress@Thread@UnBCL@@CGKPAX@Z",
            "ordinal": 2220
          },
          {
            "address": "0x1006ebc0",
            "name": "?StartsWith@String@UnBCL@@QBEHPBGH@Z",
            "ordinal": 2221
          },
          {
            "address": "0x10031010",
            "name": "?Steal@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAEPAV?$Array@E@2@XZ",
            "ordinal": 2222
          },
          {
            "address": "0x10031010",
            "name": "?Steal@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEPAV?$Array@PAVString@UnBCL@@@2@XZ",
            "ordinal": 2223
          },
          {
            "address": "0x10031010",
            "name": "?Steal@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEPAV?$ArrayList@PAVString@UnBCL@@@2@XZ",
            "ordinal": 2224
          },
          {
            "address": "0x10031010",
            "name": "?Steal@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAEPAVDecoder@2@XZ",
            "ordinal": 2225
          },
          {
            "address": "0x10031010",
            "name": "?Steal@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAEPAVEncoding@2@XZ",
            "ordinal": 2226
          },
          {
            "address": "0x1002d260",
            "name": "?Steal@?$SmartPtr@VObject@UnBCL@@@UnBCL@@QAEPAVObject@2@XZ",
            "ordinal": 2227
          },
          {
            "address": "0x1002d260",
            "name": "?Steal@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAEPAVSerializationId@2@XZ",
            "ordinal": 2228
          },
          {
            "address": "0x1002d260",
            "name": "?Steal@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAEPAVSerializationStream@2@XZ",
            "ordinal": 2229
          },
          {
            "address": "0x10031010",
            "name": "?Steal@?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAEPAVStream@2@XZ",
            "ordinal": 2230
          },
          {
            "address": "0x1002d260",
            "name": "?Steal@?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEPAVString@2@XZ",
            "ordinal": 2231
          },
          {
            "address": "0x10051920",
            "name": "?Steal@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAEPAVVersion@2@XZ",
            "ordinal": 2232
          },
          {
            "address": "0x1002d260",
            "name": "?Steal@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAEPAVXmlNamespaceManager@2@XZ",
            "ordinal": 2233
          },
          {
            "address": "0x1003b7e0",
            "name": "?StreamRead@?$SerializableArrayBase@E@_@UnBCL@@UAEXAAVSerializationStream@3@@Z",
            "ordinal": 2234
          },
          {
            "address": "0x1003b960",
            "name": "?StreamRead@?$SerializableArrayBase@G@_@UnBCL@@UAEXAAVSerializationStream@3@@Z",
            "ordinal": 2235
          },
          {
            "address": "0x1003b660",
            "name": "?StreamRead@?$SerializableArrayBase@H@_@UnBCL@@UAEXAAVSerializationStream@3@@Z",
            "ordinal": 2236
          },
          {
            "address": "0x1003bae0",
            "name": "?StreamRead@?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@UAEXAAVSerializationStream@3@@Z",
            "ordinal": 2237
          },
          {
            "address": "0x10039dc0",
            "name": "?StreamRead@?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@UAEXAAVSerializationStream@3@@Z",
            "ordinal": 2238
          },
          {
            "address": "0x10039b00",
            "name": "?StreamRead@?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@UAEXAAVSerializationStream@3@@Z",
            "ordinal": 2239
          },
          {
            "address": "0x10051580",
            "name": "?StreamRead@?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@UAEXAAVSerializationStream@3@@Z",
            "ordinal": 2240
          },
          {
            "address": "0x1006c9a0",
            "name": "?StreamRead@?$SerializableStackBase@H@_@UnBCL@@UAEXAAVSerializationStream@3@@Z",
            "ordinal": 2241
          },
          {
            "address": "0x1005a7d0",
            "name": "?StreamRead@MultiSz@UnBCL@@UAEXAAVSerializationStream@2@@Z",
            "ordinal": 2242
          },
          {
            "address": "0x1005efe0",
            "name": "?StreamRead@OperatingSystem@UnBCL@@UAEXAAVSerializationStream@2@@Z",
            "ordinal": 2243
          },
          {
            "address": "0x1006e9a0",
            "name": "?StreamRead@String@UnBCL@@QAEXAAVSerializationStream@2@@Z",
            "ordinal": 2244
          },
          {
            "address": "0x10075190",
            "name": "?StreamRead@Version@UnBCL@@UAEXAAVSerializationStream@2@@Z",
            "ordinal": 2245
          },
          {
            "address": "0x1003b620",
            "name": "?StreamWrite@?$SerializableArrayBase@E@_@UnBCL@@UBEXAAVSerializationStream@3@@Z",
            "ordinal": 2246
          },
          {
            "address": "0x1003b620",
            "name": "?StreamWrite@?$SerializableArrayBase@G@_@UnBCL@@UBEXAAVSerializationStream@3@@Z",
            "ordinal": 2247
          },
          {
            "address": "0x1003b620",
            "name": "?StreamWrite@?$SerializableArrayBase@H@_@UnBCL@@UBEXAAVSerializationStream@3@@Z",
            "ordinal": 2248
          },
          {
            "address": "0x1003b620",
            "name": "?StreamWrite@?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@UBEXAAVSerializationStream@3@@Z",
            "ordinal": 2249
          },
          {
            "address": "0x10039cc0",
            "name": "?StreamWrite@?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@UBEXAAVSerializationStream@3@@Z",
            "ordinal": 2250
          },
          {
            "address": "0x10039a10",
            "name": "?StreamWrite@?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@UBEXAAVSerializationStream@3@@Z",
            "ordinal": 2251
          },
          {
            "address": "0x10051440",
            "name": "?StreamWrite@?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@UBEXAAVSerializationStream@3@@Z",
            "ordinal": 2252
          },
          {
            "address": "0x1006c950",
            "name": "?StreamWrite@?$SerializableStackBase@H@_@UnBCL@@UBEXAAVSerializationStream@3@@Z",
            "ordinal": 2253
          },
          {
            "address": "0x1005a790",
            "name": "?StreamWrite@MultiSz@UnBCL@@UBEXAAVSerializationStream@2@@Z",
            "ordinal": 2254
          },
          {
            "address": "0x1005ef90",
            "name": "?StreamWrite@OperatingSystem@UnBCL@@UBEXAAVSerializationStream@2@@Z",
            "ordinal": 2255
          },
          {
            "address": "0x1006e960",
            "name": "?StreamWrite@String@UnBCL@@QBEXAAVSerializationStream@2@@Z",
            "ordinal": 2256
          },
          {
            "address": "0x10075150",
            "name": "?StreamWrite@Version@UnBCL@@UBEXAAVSerializationStream@2@@Z",
            "ordinal": 2257
          },
          {
            "address": "0x100303d0",
            "name": "?StringLength@?$CSimpleStringT@G$0A@@ATL@@SAHPBD@Z",
            "ordinal": 2258
          },
          {
            "address": "0x100303a0",
            "name": "?StringLength@?$CSimpleStringT@G$0A@@ATL@@SAHPBG@Z",
            "ordinal": 2259
          },
          {
            "address": "0x1006fb40",
            "name": "?Substring@String@UnBCL@@QBEPAV12@H@Z",
            "ordinal": 2260
          },
          {
            "address": "0x1006fb70",
            "name": "?Substring@String@UnBCL@@QBEPAV12@HH@Z",
            "ordinal": 2261
          },
          {
            "address": "0x10046bf0",
            "name": "?Subtract@DateTime@UnBCL@@QBE?AV12@ABVTimeSpan@2@@Z",
            "ordinal": 2262
          },
          {
            "address": "0x10046c40",
            "name": "?Subtract@DateTime@UnBCL@@QBE?AVTimeSpan@2@ABV12@@Z",
            "ordinal": 2263
          },
          {
            "address": "0x10073910",
            "name": "?Subtract@TimeSpan@UnBCL@@QBE?AV12@ABV12@@Z",
            "ordinal": 2264
          },
          {
            "address": "0x10015030",
            "name": "?TICKS_PER_D@DateTime@UnBCL@@1_JB",
            "ordinal": 2265
          },
          {
            "address": "0x10015088",
            "name": "?TICKS_PER_H@DateTime@UnBCL@@1_JB",
            "ordinal": 2266
          },
          {
            "address": "0x10015018",
            "name": "?TICKS_PER_M@DateTime@UnBCL@@1_JB",
            "ordinal": 2267
          },
          {
            "address": "0x100150d8",
            "name": "?TICKS_PER_MS@DateTime@UnBCL@@1_JB",
            "ordinal": 2268
          },
          {
            "address": "0x10015098",
            "name": "?TICKS_PER_S@DateTime@UnBCL@@1_JB",
            "ordinal": 2269
          },
          {
            "address": "0x100511e0",
            "name": "?ThawHash@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAEXXZ",
            "ordinal": 2270
          },
          {
            "address": "0x10075bb0",
            "name": "?ThrowLastError@Win32Exception@UnBCL@@SGXPBGPBDH@Z",
            "ordinal": 2271
          },
          {
            "address": "0x10075c10",
            "name": "?ThrowLastError@Win32Exception@UnBCL@@SGXPBVString@2@PBDH@Z",
            "ordinal": 2272
          },
          {
            "address": "0x10030340",
            "name": "?ThrowMemoryException@?$CSimpleStringT@G$0A@@ATL@@KAXXZ",
            "ordinal": 2273
          },
          {
            "address": "0x10046f40",
            "name": "?TimeToTicks@DateTime@UnBCL@@AAE_JHHH@Z",
            "ordinal": 2274
          },
          {
            "address": "0x10038a60",
            "name": "?ToArray@?$ArrayList@G@UnBCL@@UBEPAV?$Array@G@2@XZ",
            "ordinal": 2275
          },
          {
            "address": "0x10034090",
            "name": "?ToArray@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEPAV?$Array@PAVString@UnBCL@@@2@XZ",
            "ordinal": 2276
          },
          {
            "address": "0x10058a70",
            "name": "?ToArray@MemoryStream@UnBCL@@UBEPAV?$Array@E@2@XZ",
            "ordinal": 2277
          },
          {
            "address": "0x10059b30",
            "name": "?ToByteArray@MultiSz@UnBCL@@QBEPAV?$Array@E@2@XZ",
            "ordinal": 2278
          },
          {
            "address": "0x10046ac0",
            "name": "?ToFileTime@DateTime@UnBCL@@QBE_JXZ",
            "ordinal": 2279
          },
          {
            "address": "0x10046b20",
            "name": "?ToFileTimeUtc@DateTime@UnBCL@@QBE_JXZ",
            "ordinal": 2280
          },
          {
            "address": "0x10045c40",
            "name": "?ToLower@Char@UnBCL@@SG?AV12@V12@@Z",
            "ordinal": 2281
          },
          {
            "address": "0x10045c90",
            "name": "?ToLower@Char@UnBCL@@SGGG@Z",
            "ordinal": 2282
          },
          {
            "address": "0x1006fbc0",
            "name": "?ToLower@String@UnBCL@@QBEPAV12@XZ",
            "ordinal": 2283
          },
          {
            "address": "0x1005a3d0",
            "name": "?ToMultisz@MultiSz@UnBCL@@SGPAGABU?$ICollection@PAVString@UnBCL@@@2@@Z",
            "ordinal": 2284
          },
          {
            "address": "0x10046880",
            "name": "?ToString@DateTime@UnBCL@@UBEPAVString@2@XZ",
            "ordinal": 2285
          },
          {
            "address": "0x10053ec0",
            "name": "?ToString@Exception@UnBCL@@UBEPAVString@2@XZ",
            "ordinal": 2286
          },
          {
            "address": "0x100579e0",
            "name": "?ToString@Int32Ops@UnBCL@@SGPAVString@2@H@Z",
            "ordinal": 2287
          },
          {
            "address": "0x1005a180",
            "name": "?ToString@MultiSz@UnBCL@@QBEPAVString@2@G@Z",
            "ordinal": 2288
          },
          {
            "address": "0x1005a200",
            "name": "?ToString@MultiSz@UnBCL@@UBEPAVString@2@XZ",
            "ordinal": 2289
          },
          {
            "address": "0x1005e470",
            "name": "?ToString@Object@UnBCL@@UBEPAVString@2@XZ",
            "ordinal": 2290
          },
          {
            "address": "0x1006e8d0",
            "name": "?ToString@String@UnBCL@@UBEPAV12@XZ",
            "ordinal": 2291
          },
          {
            "address": "0x10071e20",
            "name": "?ToString@StringBuilder@UnBCL@@UBEPAVString@2@XZ",
            "ordinal": 2292
          },
          {
            "address": "0x10073cc0",
            "name": "?ToString@Type@UnBCL@@UBEPAVString@2@XZ",
            "ordinal": 2293
          },
          {
            "address": "0x10074ff0",
            "name": "?ToString@Version@UnBCL@@UBEPAVString@2@XZ",
            "ordinal": 2294
          },
          {
            "address": "0x1006fc10",
            "name": "?ToUpper@String@UnBCL@@QBEPAV12@XZ",
            "ordinal": 2295
          },
          {
            "address": "0x1002f240",
            "name": "?Tokenize@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@PBGAAH@Z",
            "ordinal": 2296
          },
          {
            "address": "0x1002efc0",
            "name": "?Trim@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@G@Z",
            "ordinal": 2297
          },
          {
            "address": "0x1002efa0",
            "name": "?Trim@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@PBG@Z",
            "ordinal": 2298
          },
          {
            "address": "0x1002efe0",
            "name": "?Trim@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ",
            "ordinal": 2299
          },
          {
            "address": "0x1006fc70",
            "name": "?Trim@String@UnBCL@@QBEPAV12@PBG@Z",
            "ordinal": 2300
          },
          {
            "address": "0x1006fc60",
            "name": "?Trim@String@UnBCL@@QBEPAV12@XZ",
            "ordinal": 2301
          },
          {
            "address": "0x1006fce0",
            "name": "?TrimEnd@String@UnBCL@@QBEPAV12@PBG@Z",
            "ordinal": 2302
          },
          {
            "address": "0x1002ee50",
            "name": "?TrimLeft@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@G@Z",
            "ordinal": 2303
          },
          {
            "address": "0x1002edc0",
            "name": "?TrimLeft@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@PBG@Z",
            "ordinal": 2304
          },
          {
            "address": "0x1002f000",
            "name": "?TrimLeft@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ",
            "ordinal": 2305
          },
          {
            "address": "0x1002ef40",
            "name": "?TrimRight@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@G@Z",
            "ordinal": 2306
          },
          {
            "address": "0x1002eec0",
            "name": "?TrimRight@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@PBG@Z",
            "ordinal": 2307
          },
          {
            "address": "0x1002f060",
            "name": "?TrimRight@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ",
            "ordinal": 2308
          },
          {
            "address": "0x1002e140",
            "name": "?TrimRight@MutableString@UnBCL@@QAEXPBG@Z",
            "ordinal": 2309
          },
          {
            "address": "0x1006fd40",
            "name": "?TrimStart@String@UnBCL@@QBEPAV12@PBG@Z",
            "ordinal": 2310
          },
          {
            "address": "0x100305e0",
            "name": "?Truncate@?$CSimpleStringT@G$0A@@ATL@@QAEXH@Z",
            "ordinal": 2311
          },
          {
            "address": "0x10016b44",
            "name": "?UNICODE_CODEPAGE@UnicodeEncoding@UnBCL@@0HB",
            "ordinal": 2312
          },
          {
            "address": "0x10030660",
            "name": "?UnlockBuffer@?$CSimpleStringT@G$0A@@ATL@@QAEXXZ",
            "ordinal": 2313
          },
          {
            "address": "0x10066780",
            "name": "?UnregisterAllTypesForDllUnload@SerializationStream@UnBCL@@SGXXZ",
            "ordinal": 2314
          },
          {
            "address": "0x10066660",
            "name": "?UnregisterType@SerializationStream@UnBCL@@SGXPBVString@2@HPAUHINSTANCE__@@@Z",
            "ordinal": 2315
          },
          {
            "address": "0x1002e710",
            "name": "?Validate@Allocator@UnBCL@@SGXI@Z",
            "ordinal": 2316
          },
          {
            "address": "0x10057740",
            "name": "?Validate@HeapMemoryManager@UnBCL@@UAEXXZ",
            "ordinal": 2317
          },
          {
            "address": "0x10051250",
            "name": "?ValueDestroy@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@IBEXPAVString@2@@Z",
            "ordinal": 2318
          },
          {
            "address": "0x10051230",
            "name": "?ValueEquals@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@IBEHPAVString@2@0@Z",
            "ordinal": 2319
          },
          {
            "address": "0x10058e00",
            "name": "?Wait@Monitor@UnBCL@@SGHPAVSyncObject@2@@Z",
            "ordinal": 2320
          },
          {
            "address": "0x10061940",
            "name": "?WaitForExit@Process@UnBCL@@QAEHH@Z",
            "ordinal": 2321
          },
          {
            "address": "0x10061930",
            "name": "?WaitForExit@Process@UnBCL@@QAEXXZ",
            "ordinal": 2322
          },
          {
            "address": "0x100753d0",
            "name": "?WaitOne@WaitHandle@UnBCL@@UAEHXZ",
            "ordinal": 2323
          },
          {
            "address": "0x1005fc60",
            "name": "?WithLongPrefix@Path@UnBCL@@SGPAVString@2@PBV32@H@Z",
            "ordinal": 2324
          },
          {
            "address": "0x1005fd30",
            "name": "?WithLongPrefixStd@Path@UnBCL@@SGPAVString@2@PBV32@H@Z",
            "ordinal": 2325
          },
          {
            "address": "0x1005fe50",
            "name": "?WithLongPrefixUNC@Path@UnBCL@@SGPAVString@2@PBV32@H@Z",
            "ordinal": 2326
          },
          {
            "address": "0x1005ffe0",
            "name": "?WithoutLongPrefix@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
            "ordinal": 2327
          },
          {
            "address": "0x10060000",
            "name": "?WithoutLongPrefix@Path@UnBCL@@SGPAVString@2@PBV32@AAH@Z",
            "ordinal": 2328
          },
          {
            "address": "0x10045640",
            "name": "?Write@BufferedStream@UnBCL@@UAEXPBEHH@Z",
            "ordinal": 2329
          },
          {
            "address": "0x10056cc0",
            "name": "?Write@FileStream@UnBCL@@UAEXPBEHH@Z",
            "ordinal": 2330
          },
          {
            "address": "0x100582d0",
            "name": "?Write@MemoryStream@UnBCL@@UAEXPBEHH@Z",
            "ordinal": 2331
          },
          {
            "address": "0x1006e170",
            "name": "?Write@StreamWriter@UnBCL@@UAEXPBVString@2@HH@Z",
            "ordinal": 2332
          },
          {
            "address": "0x10065790",
            "name": "?WriteBytes@SerializationStream@UnBCL@@QAEXPBEH@Z",
            "ordinal": 2333
          },
          {
            "address": "0x10072aa0",
            "name": "?WriteFormat@TextWriter@UnBCL@@UAAXPBGZZ",
            "ordinal": 2334
          },
          {
            "address": "0x10072b20",
            "name": "?WriteLine@TextWriter@UnBCL@@UAAXPBGZZ",
            "ordinal": 2335
          },
          {
            "address": "0x10072a50",
            "name": "?WriteLine@TextWriter@UnBCL@@UAEXXZ",
            "ordinal": 2336
          },
          {
            "address": "0x10066ae0",
            "name": "?WriteObject@SerializationStream@UnBCL@@IAEXPBUISerializable@2@@Z",
            "ordinal": 2337
          },
          {
            "address": "0x10066a20",
            "name": "?WriteObjectHeader@SerializationStream@UnBCL@@AAEHPBVObject@2@@Z",
            "ordinal": 2338
          },
          {
            "address": "0x10066800",
            "name": "?WritePhantomObject@SerializationStream@UnBCL@@QAEHPBVObject@2@@Z",
            "ordinal": 2339
          },
          {
            "address": "0x10072bb0",
            "name": "?WriteUnformat@TextWriter@UnBCL@@UAEXPBG@Z",
            "ordinal": 2340
          },
          {
            "address": "0x10071380",
            "name": "?_Compare@String@UnBCL@@SGHV?$SmartPtr@VString@UnBCL@@@2@0H@Z",
            "ordinal": 2341
          },
          {
            "address": "0x10070840",
            "name": "?_CompareTo@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@@Z",
            "ordinal": 2342
          },
          {
            "address": "0x10070890",
            "name": "?_CompareTo@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@H@Z",
            "ordinal": 2343
          },
          {
            "address": "0x100715e0",
            "name": "?_Concat@String@UnBCL@@SG?AV?$SmartPtr@VString@UnBCL@@@2@V32@000@Z",
            "ordinal": 2344
          },
          {
            "address": "0x10071540",
            "name": "?_Concat@String@UnBCL@@SG?AV?$SmartPtr@VString@UnBCL@@@2@V32@00@Z",
            "ordinal": 2345
          },
          {
            "address": "0x100714c0",
            "name": "?_Concat@String@UnBCL@@SG?AV?$SmartPtr@VString@UnBCL@@@2@V32@0@Z",
            "ordinal": 2346
          },
          {
            "address": "0x10071460",
            "name": "?_Concat@String@UnBCL@@SG?AV?$SmartPtr@VString@UnBCL@@@2@V32@@Z",
            "ordinal": 2347
          },
          {
            "address": "0x10070970",
            "name": "?_EndsWith@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@@Z",
            "ordinal": 2348
          },
          {
            "address": "0x10070a00",
            "name": "?_IndexOf@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@@Z",
            "ordinal": 2349
          },
          {
            "address": "0x10070a90",
            "name": "?_IndexOf@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@H@Z",
            "ordinal": 2350
          },
          {
            "address": "0x10070b20",
            "name": "?_IndexOfAny@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@H@Z",
            "ordinal": 2351
          },
          {
            "address": "0x10070bb0",
            "name": "?_IndexOfAny@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@HH@Z",
            "ordinal": 2352
          },
          {
            "address": "0x10070df0",
            "name": "?_Insert@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@HV32@@Z",
            "ordinal": 2353
          },
          {
            "address": "0x10070c40",
            "name": "?_LastIndexOf@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@@Z",
            "ordinal": 2354
          },
          {
            "address": "0x10070cd0",
            "name": "?_LastIndexOf@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@HH@Z",
            "ordinal": 2355
          },
          {
            "address": "0x10070d60",
            "name": "?_LastIndexOfAny@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@HH@Z",
            "ordinal": 2356
          },
          {
            "address": "0x100713f0",
            "name": "?_Match@String@UnBCL@@SGHV?$SmartPtr@VString@UnBCL@@@2@0@Z",
            "ordinal": 2357
          },
          {
            "address": "0x10070e90",
            "name": "?_Remove@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@HH@Z",
            "ordinal": 2358
          },
          {
            "address": "0x10070ed0",
            "name": "?_Replace@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@V32@0@Z",
            "ordinal": 2359
          },
          {
            "address": "0x10070f40",
            "name": "?_Split@String@UnBCL@@QBE?AV?$SmartPtr@V?$Array@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@UnBCL@@@2@V?$SmartPtr@VString@UnBCL@@@2@@Z",
            "ordinal": 2360
          },
          {
            "address": "0x100708e0",
            "name": "?_StartsWith@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@@Z",
            "ordinal": 2361
          },
          {
            "address": "0x10071120",
            "name": "?_Substring@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@H@Z",
            "ordinal": 2362
          },
          {
            "address": "0x10071160",
            "name": "?_Substring@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@HH@Z",
            "ordinal": 2363
          },
          {
            "address": "0x100711a0",
            "name": "?_ToLower@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@XZ",
            "ordinal": 2364
          },
          {
            "address": "0x100711e0",
            "name": "?_ToUpper@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@XZ",
            "ordinal": 2365
          },
          {
            "address": "0x10071260",
            "name": "?_Trim@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@V32@@Z",
            "ordinal": 2366
          },
          {
            "address": "0x10071220",
            "name": "?_Trim@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@XZ",
            "ordinal": 2367
          },
          {
            "address": "0x100712c0",
            "name": "?_TrimEnd@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@V32@@Z",
            "ordinal": 2368
          },
          {
            "address": "0x10071320",
            "name": "?_TrimStart@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@V32@@Z",
            "ordinal": 2369
          },
          {
            "address": "0x1003aa00",
            "name": "?get_Architecture@OperatingSystem@UnBCL@@QBEKXZ",
            "ordinal": 2370
          },
          {
            "address": "0x10061f60",
            "name": "?get_Arguments@ProcessStartInfo@UnBCL@@QBEPBVString@2@XZ",
            "ordinal": 2371
          },
          {
            "address": "0x10078be0",
            "name": "?get_Attributes@XmlNode@UnBCL@@QAEPAVXmlAttributeCollection@2@XZ",
            "ordinal": 2372
          },
          {
            "address": "0x10077460",
            "name": "?get_Attributes@XmlNode@XmlLite@UnBCL@@QAEPAVXmlAttributeCollection@23@XZ",
            "ordinal": 2373
          },
          {
            "address": "0x10035c90",
            "name": "?get_AutoDelete@?$Array@E@UnBCL@@UBEHXZ",
            "ordinal": 2374
          },
          {
            "address": "0x10035c90",
            "name": "?get_AutoDelete@?$Array@G@UnBCL@@UBEHXZ",
            "ordinal": 2375
          },
          {
            "address": "0x10035c90",
            "name": "?get_AutoDelete@?$Array@H@UnBCL@@UBEHXZ",
            "ordinal": 2376
          },
          {
            "address": "0x10035c90",
            "name": "?get_AutoDelete@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2377
          },
          {
            "address": "0x10035c90",
            "name": "?get_AutoDelete@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2378
          },
          {
            "address": "0x10034060",
            "name": "?get_AutoDelete@?$ArrayList@G@UnBCL@@UBEHXZ",
            "ordinal": 2379
          },
          {
            "address": "0x10034060",
            "name": "?get_AutoDelete@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2380
          },
          {
            "address": "0x1003aa00",
            "name": "?get_AutoDeleteKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHXZ",
            "ordinal": 2381
          },
          {
            "address": "0x1004e2d0",
            "name": "?get_AutoDeleteValue@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHXZ",
            "ordinal": 2382
          },
          {
            "address": "0x1004e330",
            "name": "?get_BiosName@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
            "ordinal": 2383
          },
          {
            "address": "0x1004e350",
            "name": "?get_BiosReleaseDate@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
            "ordinal": 2384
          },
          {
            "address": "0x1004e340",
            "name": "?get_BiosVersion@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
            "ordinal": 2385
          },
          {
            "address": "0x10059b10",
            "name": "?get_Buffer@MultiSz@UnBCL@@QBEPBGXZ",
            "ordinal": 2386
          },
          {
            "address": "0x1004e2d0",
            "name": "?get_Build@Version@UnBCL@@QBEHXZ",
            "ordinal": 2387
          },
          {
            "address": "0x10034060",
            "name": "?get_CSDVersion@Version@UnBCL@@QBEPAVString@2@XZ",
            "ordinal": 2388
          },
          {
            "address": "0x1004e2d0",
            "name": "?get_CString@String@UnBCL@@QBEPBGXZ",
            "ordinal": 2389
          },
          {
            "address": "0x10072420",
            "name": "?get_CString@StringBuilder@UnBCL@@QBEPBGXZ",
            "ordinal": 2390
          },
          {
            "address": "0x100454a0",
            "name": "?get_CanWrite@BufferedStream@UnBCL@@UBEHXZ",
            "ordinal": 2391
          },
          {
            "address": "0x10056b10",
            "name": "?get_CanWrite@FileStream@UnBCL@@UBEHXZ",
            "ordinal": 2392
          },
          {
            "address": "0x10058120",
            "name": "?get_CanWrite@MemoryStream@UnBCL@@UBEHXZ",
            "ordinal": 2393
          },
          {
            "address": "0x10033fe0",
            "name": "?get_Capacity@?$ArrayList@G@UnBCL@@UBEHXZ",
            "ordinal": 2394
          },
          {
            "address": "0x10033fe0",
            "name": "?get_Capacity@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2395
          },
          {
            "address": "0x100586e0",
            "name": "?get_Capacity@MemoryStream@UnBCL@@UBEHXZ",
            "ordinal": 2396
          },
          {
            "address": "0x1006eab0",
            "name": "?get_Chars@String@UnBCL@@QBEABGH@Z",
            "ordinal": 2397
          },
          {
            "address": "0x10072250",
            "name": "?get_Chars@StringBuilder@UnBCL@@QBEGH@Z",
            "ordinal": 2398
          },
          {
            "address": "0x10079160",
            "name": "?get_ChildNodes@XmlNode@UnBCL@@QAEPAVXmlNodeList@2@XZ",
            "ordinal": 2399
          },
          {
            "address": "0x10077310",
            "name": "?get_ChildNodes@XmlNode@XmlLite@UnBCL@@QAEPAVXmlNodeList@23@XZ",
            "ordinal": 2400
          },
          {
            "address": "0x1003aa00",
            "name": "?get_CodePage@Encoding@UnBCL@@UBEHXZ",
            "ordinal": 2401
          },
          {
            "address": "0x1004e300",
            "name": "?get_ComputerName@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
            "ordinal": 2402
          },
          {
            "address": "0x100543e0",
            "name": "?get_Context@SerializationStream@UnBCL@@QBEPAVObject@2@XZ",
            "ordinal": 2403
          },
          {
            "address": "0x10035bc0",
            "name": "?get_Count@?$Array@E@UnBCL@@UBEHXZ",
            "ordinal": 2404
          },
          {
            "address": "0x10035bc0",
            "name": "?get_Count@?$Array@G@UnBCL@@UBEHXZ",
            "ordinal": 2405
          },
          {
            "address": "0x10035bc0",
            "name": "?get_Count@?$Array@H@UnBCL@@UBEHXZ",
            "ordinal": 2406
          },
          {
            "address": "0x10035bc0",
            "name": "?get_Count@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2407
          },
          {
            "address": "0x10035bc0",
            "name": "?get_Count@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2408
          },
          {
            "address": "0x10033d30",
            "name": "?get_Count@?$ArrayList@G@UnBCL@@UBEHXZ",
            "ordinal": 2409
          },
          {
            "address": "0x10033d30",
            "name": "?get_Count@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2410
          },
          {
            "address": "0x10046140",
            "name": "?get_Count@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2411
          },
          {
            "address": "0x10050f70",
            "name": "?get_Count@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHXZ",
            "ordinal": 2412
          },
          {
            "address": "0x10035bc0",
            "name": "?get_Count@?$Stack@H@UnBCL@@UBEHXZ",
            "ordinal": 2413
          },
          {
            "address": "0x10035bc0",
            "name": "?get_Count@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2414
          },
          {
            "address": "0x1002d870",
            "name": "?get_Count@StreamCounter@UnBCL@@QBE_KXZ",
            "ordinal": 2415
          },
          {
            "address": "0x10079eb0",
            "name": "?get_Count@XmlAttributeCollection@UnBCL@@QAEHXZ",
            "ordinal": 2416
          },
          {
            "address": "0x10077a90",
            "name": "?get_Count@XmlAttributeCollection@XmlLite@UnBCL@@QBEHXZ",
            "ordinal": 2417
          },
          {
            "address": "0x10079cb0",
            "name": "?get_Count@XmlNodeList@UnBCL@@QAEHXZ",
            "ordinal": 2418
          },
          {
            "address": "0x10077a90",
            "name": "?get_Count@XmlNodeList@XmlLite@UnBCL@@QBEHXZ",
            "ordinal": 2419
          },
          {
            "address": "0x10055e70",
            "name": "?get_Current@FileSystemEnumerator@UnBCL@@UBEPAVString@2@XZ",
            "ordinal": 2420
          },
          {
            "address": "0x10064e30",
            "name": "?get_Current@RegSubkeyEnumerator@UnBCL@@UBEPBGXZ",
            "ordinal": 2421
          },
          {
            "address": "0x10055ee0",
            "name": "?get_CurrentFileName@FileSystemEnumerator@UnBCL@@UBEPAVString@2@XZ",
            "ordinal": 2422
          },
          {
            "address": "0x10046920",
            "name": "?get_Date@DateTime@UnBCL@@QBE?AV12@XZ",
            "ordinal": 2423
          },
          {
            "address": "0x10046970",
            "name": "?get_Day@DateTime@UnBCL@@QBEHXZ",
            "ordinal": 2424
          },
          {
            "address": "0x100736d0",
            "name": "?get_Days@TimeSpan@UnBCL@@QBEHXZ",
            "ordinal": 2425
          },
          {
            "address": "0x1004e2e0",
            "name": "?get_DefaultLangID@SystemInfo@UnBCL@@QBEGXZ",
            "ordinal": 2426
          },
          {
            "address": "0x1004e300",
            "name": "?get_EnumError@RegSubkeyEnumerator@UnBCL@@QAEHXZ",
            "ordinal": 2427
          },
          {
            "address": "0x1002d2a0",
            "name": "?get_ExceptionCode@SEHException@UnBCL@@QBEIXZ",
            "ordinal": 2428
          },
          {
            "address": "0x10061f00",
            "name": "?get_FileName@ProcessStartInfo@UnBCL@@QBEPBVString@2@XZ",
            "ordinal": 2429
          },
          {
            "address": "0x10055fd0",
            "name": "?get_FindData@FileSystemEnumerator@UnBCL@@QAEABU_WIN32_FIND_DATAW@@XZ",
            "ordinal": 2430
          },
          {
            "address": "0x1004e2d0",
            "name": "?get_FirmwareType@SystemInfo@UnBCL@@QBE?AW4_FIRMWARE_TYPE@@XZ",
            "ordinal": 2431
          },
          {
            "address": "0x10079020",
            "name": "?get_FirstChild@XmlNode@UnBCL@@QAEPAV12@XZ",
            "ordinal": 2432
          },
          {
            "address": "0x10076f30",
            "name": "?get_FirstChild@XmlNode@XmlLite@UnBCL@@QBEPAV123@XZ",
            "ordinal": 2433
          },
          {
            "address": "0x1004e2d0",
            "name": "?get_FullName@Type@UnBCL@@UBEPBVString@2@XZ",
            "ordinal": 2434
          },
          {
            "address": "0x100543e0",
            "name": "?get_HResult@Exception@UnBCL@@UBEJXZ",
            "ordinal": 2435
          },
          {
            "address": "0x1003aa00",
            "name": "?get_Handle@WaitHandle@UnBCL@@UBEPAXXZ",
            "ordinal": 2436
          },
          {
            "address": "0x10046980",
            "name": "?get_Hour@DateTime@UnBCL@@QBEHXZ",
            "ordinal": 2437
          },
          {
            "address": "0x100736f0",
            "name": "?get_Hours@TimeSpan@UnBCL@@QBEHXZ",
            "ordinal": 2438
          },
          {
            "address": "0x1004e2d0",
            "name": "?get_InnerException@Exception@UnBCL@@UBEPBV12@XZ",
            "ordinal": 2439
          },
          {
            "address": "0x1003aa00",
            "name": "?get_InnerList@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@MAEPAV?$ArrayList@PAVObject@UnBCL@@@2@XZ",
            "ordinal": 2440
          },
          {
            "address": "0x1003aa00",
            "name": "?get_InnerList@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@MBEPBV?$ArrayList@PAVObject@UnBCL@@@2@XZ",
            "ordinal": 2441
          },
          {
            "address": "0x10078ea0",
            "name": "?get_InnerText@XmlNode@UnBCL@@QAEPAVString@2@XZ",
            "ordinal": 2442
          },
          {
            "address": "0x10077250",
            "name": "?get_InnerText@XmlNode@XmlLite@UnBCL@@QBEPAVString@3@XZ",
            "ordinal": 2443
          },
          {
            "address": "0x10073110",
            "name": "?get_IsAlive@Thread@UnBCL@@QAEHXZ",
            "ordinal": 2444
          },
          {
            "address": "0x10055f50",
            "name": "?get_IsDirectory@FileSystemEnumerator@UnBCL@@QAEHXZ",
            "ordinal": 2445
          },
          {
            "address": "0x1006eb20",
            "name": "?get_IsEmpty@String@UnBCL@@QBEHXZ",
            "ordinal": 2446
          },
          {
            "address": "0x10035840",
            "name": "?get_IsFixedSize@?$Array@E@UnBCL@@UBEHXZ",
            "ordinal": 2447
          },
          {
            "address": "0x10035840",
            "name": "?get_IsFixedSize@?$Array@G@UnBCL@@UBEHXZ",
            "ordinal": 2448
          },
          {
            "address": "0x10035840",
            "name": "?get_IsFixedSize@?$Array@H@UnBCL@@UBEHXZ",
            "ordinal": 2449
          },
          {
            "address": "0x10035840",
            "name": "?get_IsFixedSize@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2450
          },
          {
            "address": "0x10035840",
            "name": "?get_IsFixedSize@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2451
          },
          {
            "address": "0x10033640",
            "name": "?get_IsFixedSize@?$ArrayList@G@UnBCL@@UBEHXZ",
            "ordinal": 2452
          },
          {
            "address": "0x10033640",
            "name": "?get_IsFixedSize@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2453
          },
          {
            "address": "0x10033640",
            "name": "?get_IsFixedSize@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2454
          },
          {
            "address": "0x10033640",
            "name": "?get_IsFixedSize@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHXZ",
            "ordinal": 2455
          },
          {
            "address": "0x10065620",
            "name": "?get_IsLoading@SerializationStream@UnBCL@@QBEHXZ",
            "ordinal": 2456
          },
          {
            "address": "0x1006eb40",
            "name": "?get_IsPrintable@String@UnBCL@@QBEHXZ",
            "ordinal": 2457
          },
          {
            "address": "0x10033640",
            "name": "?get_IsReadOnly@?$Array@E@UnBCL@@UBEHXZ",
            "ordinal": 2458
          },
          {
            "address": "0x10033640",
            "name": "?get_IsReadOnly@?$Array@G@UnBCL@@UBEHXZ",
            "ordinal": 2459
          },
          {
            "address": "0x10033640",
            "name": "?get_IsReadOnly@?$Array@H@UnBCL@@UBEHXZ",
            "ordinal": 2460
          },
          {
            "address": "0x10033640",
            "name": "?get_IsReadOnly@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2461
          },
          {
            "address": "0x10033640",
            "name": "?get_IsReadOnly@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2462
          },
          {
            "address": "0x10033640",
            "name": "?get_IsReadOnly@?$ArrayList@G@UnBCL@@UBEHXZ",
            "ordinal": 2463
          },
          {
            "address": "0x10033640",
            "name": "?get_IsReadOnly@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2464
          },
          {
            "address": "0x10033640",
            "name": "?get_IsReadOnly@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2465
          },
          {
            "address": "0x10033640",
            "name": "?get_IsReadOnly@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHXZ",
            "ordinal": 2466
          },
          {
            "address": "0x10065630",
            "name": "?get_IsStoring@SerializationStream@UnBCL@@QBEHXZ",
            "ordinal": 2467
          },
          {
            "address": "0x1004e2f0",
            "name": "?get_IsVM@SystemInfo@UnBCL@@QBEHXZ",
            "ordinal": 2468
          },
          {
            "address": "0x10035850",
            "name": "?get_Item@?$Array@E@UnBCL@@UAEAAEH@Z",
            "ordinal": 2469
          },
          {
            "address": "0x10035850",
            "name": "?get_Item@?$Array@E@UnBCL@@UBEABEH@Z",
            "ordinal": 2470
          },
          {
            "address": "0x10035850",
            "name": "?get_Item@?$Array@G@UnBCL@@UAEAAGH@Z",
            "ordinal": 2471
          },
          {
            "address": "0x10035850",
            "name": "?get_Item@?$Array@G@UnBCL@@UBEABGH@Z",
            "ordinal": 2472
          },
          {
            "address": "0x10035850",
            "name": "?get_Item@?$Array@H@UnBCL@@UAEAAHH@Z",
            "ordinal": 2473
          },
          {
            "address": "0x10035850",
            "name": "?get_Item@?$Array@H@UnBCL@@UBEABHH@Z",
            "ordinal": 2474
          },
          {
            "address": "0x10035850",
            "name": "?get_Item@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEAAPAVObject@2@H@Z",
            "ordinal": 2475
          },
          {
            "address": "0x10035850",
            "name": "?get_Item@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEABQAVObject@2@H@Z",
            "ordinal": 2476
          },
          {
            "address": "0x10035850",
            "name": "?get_Item@?$Array@PAVString@UnBCL@@@UnBCL@@UAEAAPAVString@2@H@Z",
            "ordinal": 2477
          },
          {
            "address": "0x10035850",
            "name": "?get_Item@?$Array@PAVString@UnBCL@@@UnBCL@@UBEABQAVString@2@H@Z",
            "ordinal": 2478
          },
          {
            "address": "0x100382d0",
            "name": "?get_Item@?$ArrayList@G@UnBCL@@UAEAAGH@Z",
            "ordinal": 2479
          },
          {
            "address": "0x10038240",
            "name": "?get_Item@?$ArrayList@G@UnBCL@@UBEABGH@Z",
            "ordinal": 2480
          },
          {
            "address": "0x100336e0",
            "name": "?get_Item@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEAAPAVString@2@H@Z",
            "ordinal": 2481
          },
          {
            "address": "0x10033650",
            "name": "?get_Item@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEABQAVString@2@H@Z",
            "ordinal": 2482
          },
          {
            "address": "0x10045f10",
            "name": "?get_Item@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEAAPAVObject@2@H@Z",
            "ordinal": 2483
          },
          {
            "address": "0x10045f10",
            "name": "?get_Item@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEABQAVObject@2@H@Z",
            "ordinal": 2484
          },
          {
            "address": "0x10050b60",
            "name": "?get_Item@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAVString@2@PAV32@@Z",
            "ordinal": 2485
          },
          {
            "address": "0x1006c170",
            "name": "?get_Item@?$Stack@H@UnBCL@@UAEAAHH@Z",
            "ordinal": 2486
          },
          {
            "address": "0x1006c170",
            "name": "?get_Item@?$Stack@H@UnBCL@@UBEABHH@Z",
            "ordinal": 2487
          },
          {
            "address": "0x1006c170",
            "name": "?get_Item@?$Stack@PAVObject@UnBCL@@@UnBCL@@UAEAAPAVObject@2@H@Z",
            "ordinal": 2488
          },
          {
            "address": "0x1006c170",
            "name": "?get_Item@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEABQAVObject@2@H@Z",
            "ordinal": 2489
          },
          {
            "address": "0x10079fc0",
            "name": "?get_Item@XmlAttributeCollection@UnBCL@@QAEPAVXmlAttribute@2@H@Z",
            "ordinal": 2490
          },
          {
            "address": "0x10079ef0",
            "name": "?get_Item@XmlAttributeCollection@UnBCL@@QAEPAVXmlAttribute@2@PAVString@2@@Z",
            "ordinal": 2491
          },
          {
            "address": "0x10077ac0",
            "name": "?get_Item@XmlAttributeCollection@XmlLite@UnBCL@@QAEPAVXmlAttribute@23@H@Z",
            "ordinal": 2492
          },
          {
            "address": "0x10077b00",
            "name": "?get_Item@XmlAttributeCollection@XmlLite@UnBCL@@QAEPAVXmlAttribute@23@PAVString@3@@Z",
            "ordinal": 2493
          },
          {
            "address": "0x10079cf0",
            "name": "?get_Item@XmlNodeList@UnBCL@@QAEPAVXmlNode@2@H@Z",
            "ordinal": 2494
          },
          {
            "address": "0x10077ac0",
            "name": "?get_Item@XmlNodeList@XmlLite@UnBCL@@QAEPAVXmlNode@23@H@Z",
            "ordinal": 2495
          },
          {
            "address": "0x10050c30",
            "name": "?get_Keys@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAU?$ICollection@PAVString@UnBCL@@@2@XZ",
            "ordinal": 2496
          },
          {
            "address": "0x10079070",
            "name": "?get_LastChild@XmlNode@UnBCL@@QAEPAV12@XZ",
            "ordinal": 2497
          },
          {
            "address": "0x10077190",
            "name": "?get_LastChild@XmlNode@XmlLite@UnBCL@@QBEPAV123@XZ",
            "ordinal": 2498
          },
          {
            "address": "0x10035c60",
            "name": "?get_Length@?$Array@E@UnBCL@@UBEHXZ",
            "ordinal": 2499
          },
          {
            "address": "0x10035c60",
            "name": "?get_Length@?$Array@G@UnBCL@@UBEHXZ",
            "ordinal": 2500
          },
          {
            "address": "0x10035c60",
            "name": "?get_Length@?$Array@H@UnBCL@@UBEHXZ",
            "ordinal": 2501
          },
          {
            "address": "0x10035c60",
            "name": "?get_Length@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2502
          },
          {
            "address": "0x10035c60",
            "name": "?get_Length@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2503
          },
          {
            "address": "0x100452f0",
            "name": "?get_Length@BufferedStream@UnBCL@@UBE_JXZ",
            "ordinal": 2504
          },
          {
            "address": "0x10056800",
            "name": "?get_Length@FileStream@UnBCL@@UBE_JXZ",
            "ordinal": 2505
          },
          {
            "address": "0x10057f30",
            "name": "?get_Length@MemoryStream@UnBCL@@UBE_JXZ",
            "ordinal": 2506
          },
          {
            "address": "0x1006eaa0",
            "name": "?get_Length@String@UnBCL@@QBEHXZ",
            "ordinal": 2507
          },
          {
            "address": "0x10072350",
            "name": "?get_Length@StringBuilder@UnBCL@@QBEHXZ",
            "ordinal": 2508
          },
          {
            "address": "0x10075ba0",
            "name": "?get_LineNumber@XmlException@UnBCL@@UAEHXZ",
            "ordinal": 2509
          },
          {
            "address": "0x1004e310",
            "name": "?get_LinePosition@XmlException@UnBCL@@UAEHXZ",
            "ordinal": 2510
          },
          {
            "address": "0x1002d2a0",
            "name": "?get_Major@Version@UnBCL@@QBEHXZ",
            "ordinal": 2511
          },
          {
            "address": "0x1004e310",
            "name": "?get_Manufacturer@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
            "ordinal": 2512
          },
          {
            "address": "0x10034060",
            "name": "?get_Message@Exception@UnBCL@@UBEPBVString@2@XZ",
            "ordinal": 2513
          },
          {
            "address": "0x100469b0",
            "name": "?get_Millisecond@DateTime@UnBCL@@QBEHXZ",
            "ordinal": 2514
          },
          {
            "address": "0x10073710",
            "name": "?get_Milliseconds@TimeSpan@UnBCL@@QBEHXZ",
            "ordinal": 2515
          },
          {
            "address": "0x1003aa00",
            "name": "?get_Minor@Version@UnBCL@@QBEHXZ",
            "ordinal": 2516
          },
          {
            "address": "0x100469e0",
            "name": "?get_Minute@DateTime@UnBCL@@QBEHXZ",
            "ordinal": 2517
          },
          {
            "address": "0x10073740",
            "name": "?get_Minutes@TimeSpan@UnBCL@@QBEHXZ",
            "ordinal": 2518
          },
          {
            "address": "0x1004e320",
            "name": "?get_Model@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
            "ordinal": 2519
          },
          {
            "address": "0x10046a10",
            "name": "?get_Month@DateTime@UnBCL@@QBEHXZ",
            "ordinal": 2520
          },
          {
            "address": "0x10078e10",
            "name": "?get_Name@XmlNode@UnBCL@@QAEPAVString@2@XZ",
            "ordinal": 2521
          },
          {
            "address": "0x10034060",
            "name": "?get_Name@XmlNode@XmlLite@UnBCL@@QBEPAVString@3@XZ",
            "ordinal": 2522
          },
          {
            "address": "0x10078cf0",
            "name": "?get_NamespaceURI@XmlNode@UnBCL@@QAEPAVString@2@XZ",
            "ordinal": 2523
          },
          {
            "address": "0x100543e0",
            "name": "?get_NamespaceURI@XmlNode@XmlLite@UnBCL@@QBEPAVString@3@XZ",
            "ordinal": 2524
          },
          {
            "address": "0x100729d0",
            "name": "?get_NewLine@TextWriter@UnBCL@@UBEPBVString@2@XZ",
            "ordinal": 2525
          },
          {
            "address": "0x100790c0",
            "name": "?get_NextSibling@XmlNode@UnBCL@@QAEPAV12@XZ",
            "ordinal": 2526
          },
          {
            "address": "0x10077020",
            "name": "?get_NextSibling@XmlNode@XmlLite@UnBCL@@QBEPAV123@XZ",
            "ordinal": 2527
          },
          {
            "address": "0x10078c40",
            "name": "?get_NodeType@XmlNode@UnBCL@@QAE?AW4XmlNodeType@2@XZ",
            "ordinal": 2528
          },
          {
            "address": "0x1004e2d0",
            "name": "?get_NodeType@XmlNode@XmlLite@UnBCL@@QBE?AW4XmlNodeType@3@XZ",
            "ordinal": 2529
          },
          {
            "address": "0x1004e370",
            "name": "?get_NumCPU@SystemInfo@UnBCL@@QBEKXZ",
            "ordinal": 2530
          },
          {
            "address": "0x1004e380",
            "name": "?get_NumLogicalCPU@SystemInfo@UnBCL@@QBEKXZ",
            "ordinal": 2531
          },
          {
            "address": "0x1004e2f0",
            "name": "?get_OSVersion@OperatingSystem@UnBCL@@QBEPBVVersion@2@XZ",
            "ordinal": 2532
          },
          {
            "address": "0x10034060",
            "name": "?get_ObjectID@SerializationStream@UnBCL@@QBEPBVSerializationId@2@XZ",
            "ordinal": 2533
          },
          {
            "address": "0x10079430",
            "name": "?get_OuterXml@XmlNode@UnBCL@@QAEPAVString@2@XZ",
            "ordinal": 2534
          },
          {
            "address": "0x100794a0",
            "name": "?get_OwnerDocument@XmlNode@UnBCL@@QAEPAVXmlDocument@2@XZ",
            "ordinal": 2535
          },
          {
            "address": "0x1002d2a0",
            "name": "?get_P@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBEPAV?$Array@E@2@XZ",
            "ordinal": 2536
          },
          {
            "address": "0x1002d2a0",
            "name": "?get_P@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$Array@PAVString@UnBCL@@@2@XZ",
            "ordinal": 2537
          },
          {
            "address": "0x1002d2a0",
            "name": "?get_P@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@2@XZ",
            "ordinal": 2538
          },
          {
            "address": "0x1002d2a0",
            "name": "?get_P@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QBEPAVDecoder@2@XZ",
            "ordinal": 2539
          },
          {
            "address": "0x1002d2a0",
            "name": "?get_P@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBEPAVEncoding@2@XZ",
            "ordinal": 2540
          },
          {
            "address": "0x1002d2a0",
            "name": "?get_P@?$SmartPtr@VObject@UnBCL@@@UnBCL@@QBEPAVObject@2@XZ",
            "ordinal": 2541
          },
          {
            "address": "0x1002d2a0",
            "name": "?get_P@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QBEPAVSerializationId@2@XZ",
            "ordinal": 2542
          },
          {
            "address": "0x1002d2a0",
            "name": "?get_P@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QBEPAVSerializationStream@2@XZ",
            "ordinal": 2543
          },
          {
            "address": "0x1002d2a0",
            "name": "?get_P@?$SmartPtr@VStream@UnBCL@@@UnBCL@@QBEPAVStream@2@XZ",
            "ordinal": 2544
          },
          {
            "address": "0x1002d2a0",
            "name": "?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEPAVString@2@XZ",
            "ordinal": 2545
          },
          {
            "address": "0x1002d2a0",
            "name": "?get_P@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBEPAVVersion@2@XZ",
            "ordinal": 2546
          },
          {
            "address": "0x1002d2a0",
            "name": "?get_P@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QBEPAVXmlNamespaceManager@2@XZ",
            "ordinal": 2547
          },
          {
            "address": "0x10078fd0",
            "name": "?get_ParentNode@XmlNode@UnBCL@@QAEPAV12@XZ",
            "ordinal": 2548
          },
          {
            "address": "0x10075ba0",
            "name": "?get_ParentNode@XmlNode@XmlLite@UnBCL@@QBEPAV123@XZ",
            "ordinal": 2549
          },
          {
            "address": "0x1002d2a0",
            "name": "?get_Platform@OperatingSystem@UnBCL@@QBE?AW4PlatformID@2@XZ",
            "ordinal": 2550
          },
          {
            "address": "0x10045360",
            "name": "?get_Position@BufferedStream@UnBCL@@UBE_JXZ",
            "ordinal": 2551
          },
          {
            "address": "0x10056920",
            "name": "?get_Position@FileStream@UnBCL@@UBE_JXZ",
            "ordinal": 2552
          },
          {
            "address": "0x10057fa0",
            "name": "?get_Position@MemoryStream@UnBCL@@UBE_JXZ",
            "ordinal": 2553
          },
          {
            "address": "0x10078d80",
            "name": "?get_Prefix@XmlNode@UnBCL@@QAEPAVString@2@XZ",
            "ordinal": 2554
          },
          {
            "address": "0x1004e2f0",
            "name": "?get_Prefix@XmlNode@XmlLite@UnBCL@@QBEPAVString@3@XZ",
            "ordinal": 2555
          },
          {
            "address": "0x10079110",
            "name": "?get_PreviousSibling@XmlNode@UnBCL@@QAEPAV12@XZ",
            "ordinal": 2556
          },
          {
            "address": "0x10077100",
            "name": "?get_PreviousSibling@XmlNode@XmlLite@UnBCL@@QBEPAV123@XZ",
            "ordinal": 2557
          },
          {
            "address": "0x1002d2a0",
            "name": "?get_ProcessHandle@Process@UnBCL@@QBEPAXXZ",
            "ordinal": 2558
          },
          {
            "address": "0x1004e3c0",
            "name": "?get_ProcessorArchitecture@SystemInfo@UnBCL@@QBEKXZ",
            "ordinal": 2559
          },
          {
            "address": "0x1004e3b0",
            "name": "?get_ProcessorCaption@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
            "ordinal": 2560
          },
          {
            "address": "0x1004e390",
            "name": "?get_ProcessorManufacturer@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
            "ordinal": 2561
          },
          {
            "address": "0x1004e3d0",
            "name": "?get_ProcessorMaxClock@SystemInfo@UnBCL@@QBEKXZ",
            "ordinal": 2562
          },
          {
            "address": "0x1004e3a0",
            "name": "?get_ProcessorName@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
            "ordinal": 2563
          },
          {
            "address": "0x10035840",
            "name": "?get_Rank@?$Array@E@UnBCL@@UBEHXZ",
            "ordinal": 2564
          },
          {
            "address": "0x10035840",
            "name": "?get_Rank@?$Array@G@UnBCL@@UBEHXZ",
            "ordinal": 2565
          },
          {
            "address": "0x10035840",
            "name": "?get_Rank@?$Array@H@UnBCL@@UBEHXZ",
            "ordinal": 2566
          },
          {
            "address": "0x10035840",
            "name": "?get_Rank@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2567
          },
          {
            "address": "0x10035840",
            "name": "?get_Rank@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
            "ordinal": 2568
          },
          {
            "address": "0x10077c50",
            "name": "?get_Root@XmlDocument@XmlLite@UnBCL@@QBEPAVXmlNode@23@H@Z",
            "ordinal": 2569
          },
          {
            "address": "0x10046a20",
            "name": "?get_Second@DateTime@UnBCL@@QBEHXZ",
            "ordinal": 2570
          },
          {
            "address": "0x10073760",
            "name": "?get_Seconds@TimeSpan@UnBCL@@QBEHXZ",
            "ordinal": 2571
          },
          {
            "address": "0x1004e2f0",
            "name": "?get_Source@Exception@UnBCL@@UBEPBVString@2@XZ",
            "ordinal": 2572
          },
          {
            "address": "0x10062ad0",
            "name": "?get_SubKeyCount@RegistryKey@UnBCL@@QBEHXZ",
            "ordinal": 2573
          },
          {
            "address": "0x1004e2d0",
            "name": "?get_ThreadHandle@Thread@UnBCL@@QAEPAXXZ",
            "ordinal": 2574
          },
          {
            "address": "0x10034060",
            "name": "?get_ThreadID@Thread@UnBCL@@QAEKXZ",
            "ordinal": 2575
          },
          {
            "address": "0x10046a50",
            "name": "?get_Ticks@DateTime@UnBCL@@QBE_JXZ",
            "ordinal": 2576
          },
          {
            "address": "0x10046a50",
            "name": "?get_Ticks@TimeSpan@UnBCL@@QBE_JXZ",
            "ordinal": 2577
          },
          {
            "address": "0x10046a70",
            "name": "?get_TimeOfDay@DateTime@UnBCL@@QBE?AVTimeSpan@2@XZ",
            "ordinal": 2578
          },
          {
            "address": "0x10073830",
            "name": "?get_TotalDays@TimeSpan@UnBCL@@QBENXZ",
            "ordinal": 2579
          },
          {
            "address": "0x10073810",
            "name": "?get_TotalHours@TimeSpan@UnBCL@@QBENXZ",
            "ordinal": 2580
          },
          {
            "address": "0x1004e360",
            "name": "?get_TotalMemory@SystemInfo@UnBCL@@QBE_KXZ",
            "ordinal": 2581
          },
          {
            "address": "0x10073780",
            "name": "?get_TotalMilliseconds@TimeSpan@UnBCL@@QBENXZ",
            "ordinal": 2582
          },
          {
            "address": "0x100737f0",
            "name": "?get_TotalMinutes@TimeSpan@UnBCL@@QBENXZ",
            "ordinal": 2583
          },
          {
            "address": "0x100737d0",
            "name": "?get_TotalSeconds@TimeSpan@UnBCL@@QBENXZ",
            "ordinal": 2584
          },
          {
            "address": "0x1004e2d0",
            "name": "?get_Type@OperatingSystem@UnBCL@@QBE?AW4InstallationType@2@XZ",
            "ordinal": 2585
          },
          {
            "address": "0x100671f0",
            "name": "?get_TypeName@SerializationId@UnBCL@@QBEPBGXZ",
            "ordinal": 2586
          },
          {
            "address": "0x1004e320",
            "name": "?get_UseShellExecute@ProcessStartInfo@UnBCL@@QBEHXZ",
            "ordinal": 2587
          },
          {
            "address": "0x10078f60",
            "name": "?get_Value@XmlNode@UnBCL@@QAEPAVString@2@XZ",
            "ordinal": 2588
          },
          {
            "address": "0x1004e300",
            "name": "?get_Value@XmlNode@XmlLite@UnBCL@@QBEPAVString@3@XZ",
            "ordinal": 2589
          },
          {
            "address": "0x10062b90",
            "name": "?get_ValueCount@RegistryKey@UnBCL@@QBEHXZ",
            "ordinal": 2590
          },
          {
            "address": "0x10050c80",
            "name": "?get_Values@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAU?$ICollection@PAVString@UnBCL@@@2@XZ",
            "ordinal": 2591
          },
          {
            "address": "0x10034060",
            "name": "?get_Version@SerializationId@UnBCL@@QBEHXZ",
            "ordinal": 2592
          },
          {
            "address": "0x10075ba0",
            "name": "?get_Win32ErrorCode@Win32Exception@UnBCL@@QBEKXZ",
            "ordinal": 2593
          },
          {
            "address": "0x10034060",
            "name": "?get_XMLDOMDocument@XmlDocument@UnBCL@@QAEPAUIXMLDOMDocument3@@XZ",
            "ordinal": 2594
          },
          {
            "address": "0x1004e2d0",
            "name": "?get_XMLDOMNode@XmlNode@UnBCL@@QAEPAUIXMLDOMNode@@XZ",
            "ordinal": 2595
          },
          {
            "address": "0x1004e2d0",
            "name": "?get_XMLDOMSchemaCollection@XmlSchemaSet@UnBCL@@QAEPAUIXMLDOMSchemaCollection2@@XZ",
            "ordinal": 2596
          },
          {
            "address": "0x10046a60",
            "name": "?get_Year@DateTime@UnBCL@@QBEHXZ",
            "ordinal": 2597
          },
          {
            "address": "0x100bfd10",
            "name": "?m_OSVersion@Environment@UnBCL@@0PAVOperatingSystem@2@A",
            "ordinal": 2598
          },
          {
            "address": "0x100bfd14",
            "name": "?m_SystemInfo@Environment@UnBCL@@0PAVSystemInfo@2@A",
            "ordinal": 2599
          },
          {
            "address": "0x100bfd20",
            "name": "?s_Handler@Logging@UnBCL@@0PAUILogHandler@@A",
            "ordinal": 2600
          },
          {
            "address": "0x100bfe10",
            "name": "?s_InternPool@String@UnBCL@@1PAV?$Hashtable@PAVString@UnBCL@@PAV12@@2@A",
            "ordinal": 2601
          },
          {
            "address": "0x100bfcec",
            "name": "?s_Manager@Allocator@UnBCL@@0PAPAUIHeapMemory@@A",
            "ordinal": 2602
          },
          {
            "address": "0x100bfcc4",
            "name": "?s_Manager_Init@Allocator@UnBCL@@0HA",
            "ordinal": 2603
          },
          {
            "address": "0x100bfcc0",
            "name": "?s_OOMHandler@Allocator@UnBCL@@0PAUIOutOfMemoryHandler@@A",
            "ordinal": 2604
          },
          {
            "address": "0x100ba008",
            "name": "?s_PoolLock@String@UnBCL@@1VObject@2@A",
            "ordinal": 2605
          },
          {
            "address": "0x100bfccc",
            "name": "?s_Registered@SerializationStream@UnBCL@@0PAV?$Hashtable@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@2@A",
            "ordinal": 2606
          },
          {
            "address": "0x100bfe54",
            "name": "?s_Registration@?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
            "ordinal": 2607
          },
          {
            "address": "0x100bfe58",
            "name": "?s_Registration@?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
            "ordinal": 2608
          },
          {
            "address": "0x100bfe50",
            "name": "?s_Registration@?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
            "ordinal": 2609
          },
          {
            "address": "0x100bfe64",
            "name": "?s_Registration@?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
            "ordinal": 2610
          },
          {
            "address": "0x100bfe5c",
            "name": "?s_Registration@?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
            "ordinal": 2611
          },
          {
            "address": "0x100bfe60",
            "name": "?s_Registration@?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
            "ordinal": 2612
          },
          {
            "address": "0x100bfe68",
            "name": "?s_Registration@?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
            "ordinal": 2613
          },
          {
            "address": "0x100bfe78",
            "name": "?s_Registration@?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
            "ordinal": 2614
          },
          {
            "address": "0x100bfe74",
            "name": "?s_Registration@?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@0UStaticTypeRegistration@12@A",
            "ordinal": 2615
          },
          {
            "address": "0x100bfe70",
            "name": "?s_Registration@?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@0UStaticTypeRegistration@12@A",
            "ordinal": 2616
          },
          {
            "address": "0x100bfe6c",
            "name": "?s_Registration@?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
            "ordinal": 2617
          },
          {
            "address": "0x100bfda8",
            "name": "?s_RegistrationListHead@SbRegistrationList@UnBCL@@0U_SINGLE_LIST_ENTRY@@A",
            "ordinal": 2618
          },
          {
            "address": "0x10061f70",
            "name": "?set_Arguments@ProcessStartInfo@UnBCL@@QAEXPBVString@2@@Z",
            "ordinal": 2619
          },
          {
            "address": "0x10035cb0",
            "name": "?set_AutoDelete@?$Array@E@UnBCL@@UAEXH@Z",
            "ordinal": 2620
          },
          {
            "address": "0x10035cb0",
            "name": "?set_AutoDelete@?$Array@G@UnBCL@@UAEXH@Z",
            "ordinal": 2621
          },
          {
            "address": "0x10035cb0",
            "name": "?set_AutoDelete@?$Array@H@UnBCL@@UAEXH@Z",
            "ordinal": 2622
          },
          {
            "address": "0x10035cb0",
            "name": "?set_AutoDelete@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXH@Z",
            "ordinal": 2623
          },
          {
            "address": "0x10035cb0",
            "name": "?set_AutoDelete@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXH@Z",
            "ordinal": 2624
          },
          {
            "address": "0x10034070",
            "name": "?set_AutoDelete@?$ArrayList@G@UnBCL@@UAEXH@Z",
            "ordinal": 2625
          },
          {
            "address": "0x10034070",
            "name": "?set_AutoDelete@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXH@Z",
            "ordinal": 2626
          },
          {
            "address": "0x1002d920",
            "name": "?set_AutoDeleteKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXH@Z",
            "ordinal": 2627
          },
          {
            "address": "0x10050fe0",
            "name": "?set_AutoDeleteValue@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXH@Z",
            "ordinal": 2628
          },
          {
            "address": "0x10034010",
            "name": "?set_Capacity@?$ArrayList@G@UnBCL@@UAEXH@Z",
            "ordinal": 2629
          },
          {
            "address": "0x10034010",
            "name": "?set_Capacity@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXH@Z",
            "ordinal": 2630
          },
          {
            "address": "0x10058760",
            "name": "?set_Capacity@MemoryStream@UnBCL@@UAEXH@Z",
            "ordinal": 2631
          },
          {
            "address": "0x100722d0",
            "name": "?set_Chars@StringBuilder@UnBCL@@QAEXHG@Z",
            "ordinal": 2632
          },
          {
            "address": "0x100543f0",
            "name": "?set_Context@SerializationStream@UnBCL@@QAEXPAVObject@2@@Z",
            "ordinal": 2633
          },
          {
            "address": "0x1002d920",
            "name": "?set_Counter@Stream@UnBCL@@QAEXPAVStreamCounter@2@@Z",
            "ordinal": 2634
          },
          {
            "address": "0x10061f10",
            "name": "?set_FileName@ProcessStartInfo@UnBCL@@QAEXPBVString@2@@Z",
            "ordinal": 2635
          },
          {
            "address": "0x100543f0",
            "name": "?set_HResult@Exception@UnBCL@@MAEXJ@Z",
            "ordinal": 2636
          },
          {
            "address": "0x1002d920",
            "name": "?set_Handle@WaitHandle@UnBCL@@UAEXPAX@Z",
            "ordinal": 2637
          },
          {
            "address": "0x10078f10",
            "name": "?set_InnerText@XmlNode@UnBCL@@QAEXPAVString@2@@Z",
            "ordinal": 2638
          },
          {
            "address": "0x10035890",
            "name": "?set_Item@?$Array@E@UnBCL@@UAEXHE@Z",
            "ordinal": 2639
          },
          {
            "address": "0x10035890",
            "name": "?set_Item@?$Array@G@UnBCL@@UAEXHG@Z",
            "ordinal": 2640
          },
          {
            "address": "0x10035890",
            "name": "?set_Item@?$Array@H@UnBCL@@UAEXHH@Z",
            "ordinal": 2641
          },
          {
            "address": "0x10035890",
            "name": "?set_Item@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXHPAVObject@2@@Z",
            "ordinal": 2642
          },
          {
            "address": "0x10035890",
            "name": "?set_Item@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXHPAVString@2@@Z",
            "ordinal": 2643
          },
          {
            "address": "0x10038360",
            "name": "?set_Item@?$ArrayList@G@UnBCL@@UAEXHG@Z",
            "ordinal": 2644
          },
          {
            "address": "0x10033770",
            "name": "?set_Item@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXHPAVString@2@@Z",
            "ordinal": 2645
          },
          {
            "address": "0x10045f50",
            "name": "?set_Item@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEXHPAVObject@2@@Z",
            "ordinal": 2646
          },
          {
            "address": "0x10050bf0",
            "name": "?set_Item@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXPAVString@2@0@Z",
            "ordinal": 2647
          },
          {
            "address": "0x10072360",
            "name": "?set_Length@StringBuilder@UnBCL@@QAEXH@Z",
            "ordinal": 2648
          },
          {
            "address": "0x1007f400",
            "name": "?set_LineNumber@XmlException@UnBCL@@MAEXH@Z",
            "ordinal": 2649
          },
          {
            "address": "0x1007f420",
            "name": "?set_LinePosition@XmlException@UnBCL@@MAEXH@Z",
            "ordinal": 2650
          },
          {
            "address": "0x100729e0",
            "name": "?set_NewLine@TextWriter@UnBCL@@UAEXPBVString@2@@Z",
            "ordinal": 2651
          },
          {
            "address": "0x10076ec0",
            "name": "?set_ParentNode@XmlNode@XmlLite@UnBCL@@IAEXPAV123@@Z",
            "ordinal": 2652
          },
          {
            "address": "0x100453d0",
            "name": "?set_Position@BufferedStream@UnBCL@@UAEX_J@Z",
            "ordinal": 2653
          },
          {
            "address": "0x10056a00",
            "name": "?set_Position@FileStream@UnBCL@@UAEX_J@Z",
            "ordinal": 2654
          },
          {
            "address": "0x10058010",
            "name": "?set_Position@MemoryStream@UnBCL@@UAEX_J@Z",
            "ordinal": 2655
          },
          {
            "address": "0x1007acb0",
            "name": "?set_Schemas@XmlDocument@UnBCL@@QAEXPAVXmlSchemaSet@2@@Z",
            "ordinal": 2656
          },
          {
            "address": "0x100541b0",
            "name": "?set_Source@Exception@UnBCL@@UAEXPBVString@2@@Z",
            "ordinal": 2657
          },
          {
            "address": "0x10061fc0",
            "name": "?set_UseShellExecute@ProcessStartInfo@UnBCL@@QAEXH@Z",
            "ordinal": 2658
          },
          {
            "address": "0x1007ac80",
            "name": "?set_ValidateOnParse@XmlDocument@UnBCL@@QAEXH@Z",
            "ordinal": 2659
          },
          {
            "address": "0x1002e3f0",
            "name": "_IsRunning@0",
            "ordinal": 2660
          },
          {
            "address": "0x1002e3d0",
            "name": "_SetRunningFlag@4",
            "ordinal": 2661
          },
          {
            "address": "0x10073d40",
            "name": "_UnBCLReleaseResources@0",
            "ordinal": 2662
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x0008dd60",
            "size": "0x0002bf2a"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x000c0320",
            "size": "0x0000008c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x000c3000",
            "size": "0x000003e0"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x000ca000",
            "size": "0x00002140"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x000c4000",
            "size": "0x00009854"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x0002bdf0",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x00004254",
            "size": "0x00000018"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x00001018",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x000c0000",
            "size": "0x0000031c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x0008dcbc",
            "size": "0x00000060"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x000b8c8a",
            "size_of_data": "0x000b8e00",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.52"
          },
          {
            "name": ".data",
            "raw_address": "0x000b9200",
            "virtual_address": "0x000ba000",
            "virtual_size": "0x00005eb8",
            "size_of_data": "0x00005a00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "4.97"
          },
          {
            "name": ".idata",
            "raw_address": "0x000bec00",
            "virtual_address": "0x000c0000",
            "virtual_size": "0x000013ca",
            "size_of_data": "0x00001400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.62"
          },
          {
            "name": ".didat",
            "raw_address": "0x000c0000",
            "virtual_address": "0x000c2000",
            "virtual_size": "0x00000010",
            "size_of_data": "0x00000200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "0.15"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x000c0200",
            "virtual_address": "0x000c3000",
            "virtual_size": "0x000003e0",
            "size_of_data": "0x00000400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "3.30"
          },
          {
            "name": ".reloc",
            "raw_address": "0x000c0600",
            "virtual_address": "0x000c4000",
            "virtual_size": "0x00009854",
            "size_of_data": "0x00009a00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.62"
          }
        ],
        "overlay": {
          "offset": "0x000ca000",
          "size": "0x00002140"
        },
        "resources": [
          {
            "name": "RT_VERSION",
            "offset": "0x000c3060",
            "size": "0x00000380",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.51"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Unmanaged BCL"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "unbcl.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "unbcl.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "fabfc3894ea019d267b4d5aa194b0fae",
        "timestamp": "1978-05-02 02:11:47",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 6
      },
      "data": null,
      "strings": [
        "__thiscall UnBCL::StreamReader::StreamReader(const class UnBCL::String *,class UnBCL::Encoding *)",
        "??_7?$Stack@H@UnBCL@@6B01@@",
        "??B?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
        "??0Delegate@UnBCL@@QAE@$$QAV01@@Z",
        "??1XmlSchemaSet@UnBCL@@UAE@XZ",
        "class UnBCL::String *const *__thiscall UnBCL::ArrayList<class UnBCL::String *>::GetBuffer(int) const",
        "9(9,909D9H9`9p9",
        "keyname exceeds maximum name length",
        "?StreamWrite@Version@UnBCL@@UBEXAAVSerializationStream@2@@Z",
        "??_7?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@6B01@@",
        "?Copy@?$ArrayList@G@UnBCL@@SGXPBV12@HPAV12@HH@Z",
        "989P9W9^9e9l9s9",
        "545C5K5n5",
        "??_DDelegate@UnBCL@@QAEXXZ",
        "SystemTimeToFileTime",
        "?Dispose@Process@UnBCL@@UAEXXZ",
        "Invalid offset to MemoryStream#Seek",
        "??_7Char@UnBCL@@6B@",
        "void __stdcall UnBCL::_::HTEnumerator<struct UnBCL::SerializationStream::UniqueObject,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int> *,class UnBCL::Array<int> *,int)",
        "RtlNtStatusToDosError",
        "attempt to set value on key opened read-only",
        "?DefaultLoad@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@0MB",
        "838W8|8",
        "?get_Handle@WaitHandle@UnBCL@@UBEPAXXZ",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive<int>(int &)",
        "??4StringPtr@UnBCL@@QAEAAV01@ABV01@@Z",
        "??_8?$Array@E@UnBCL@@7BISerializable@1@@",
        "uAVj ",
        "989\\9w9",
        "<X<o<",
        "SetEvent() on wake-finished event failed",
        "?EnableDelayedDeallocation@HeapMemoryManager@UnBCL@@UAEXH@Z",
        "??4?$Array@E@UnBCL@@QAEAAV01@ABV01@@Z",
        "int __stdcall UnBCL::Array<class UnBCL::String *>::IndexOf(const class UnBCL::Array<class UnBCL::String *> *,class UnBCL::String *,int,int)",
        "??_7?$SerializableStackBase@H@_@UnBCL@@6BObject@2@@",
        "?GetNextString@MultiSz@UnBCL@@ABEPBGPBG@Z",
        "?AddNamespace@XmlNamespaceManager@UnBCL@@QAEXPAVString@2@0@Z",
        "void __thiscall UnBCL::_::HTEnumerator<struct UnBCL::SerializationStream::UniqueObject,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,class UnBCL::DictionaryEntry<struct UnBCL::SerializationStream::UniqueObject,int>,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<struct UnBCL::SerializationStream::UniqueObject,int> __stdcall UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::Reset(void)",
        "null str to String::IsInterned",
        "DuplicateHandle",
        "516C6U6",
        "??0?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@IAE@XZ",
        "?get_Count@StreamCounter@UnBCL@@QBE_KXZ",
        "1$1H1T1`1l1x1",
        "7 8;8a8s8",
        "?SetRef@HeapMemoryManager@UnBCL@@UAEXXZ",
        "??_8FileStream@UnBCL@@7BIDisposable@1@@",
        "?get_OSVersion@OperatingSystem@UnBCL@@QBEPBVVersion@2@XZ",
        "<unknown>",
        "??4?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "int __thiscall UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> >::IndexOf(class UnBCL::SmartPtr<class UnBCL::String>,int,int) const",
        "?get_Length@BufferedStream@UnBCL@@UBE_JXZ",
        "void __thiscall UnBCL::Array<class UnBCL::SmartPtr<class UnBCL::String> >::InitLarva(class UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> > *)",
        ">$>(>,>0>8>@>X>h>x>|>",
        ":*;Z;",
        "?ContainsValue@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHPAVString@2@@Z",
        "?get_OwnerDocument@XmlNode@UnBCL@@QAEPAVXmlDocument@2@XZ",
        "?IsDigit@Char@UnBCL@@SGHG@Z",
        "VirtualProtect",
        "??0ArgumentException@UnBCL@@QAE@PBG@Z",
        "??_7?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
        ".?AVXmlAttributeCollection@XmlLite@UnBCL@@",
        "u\"Vj 9q",
        "?Nullify@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV12@XZ",
        "too many pieces in string to Version constructor",
        "< <$<(<,<0<4<8<<<@<D<H<L<`<d<t<x<",
        "?GetSystemInfo@Environment@UnBCL@@SGPBVSystemInfo@2@H@Z",
        ".?AV?$Hashtable@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@",
        "__thiscall UnBCL::SerializationStream::SerializationStream(class UnBCL::Stream *,enum UnBCL::SerializationStream::Mode,class UnBCL::Object *)",
        "??0FileStream@UnBCL@@QAE@ABV01@@Z",
        "?set_Handle@WaitHandle@UnBCL@@UAEXPAX@Z",
        "?GetPathRoot@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        "?DeAssign@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@AAEXXZ",
        "??_7?$SerializableStackBase@H@_@UnBCL@@6B?$IEnumerable@H@2@@",
        ".idata$5",
        "?get_Item@XmlAttributeCollection@UnBCL@@QAEPAVXmlAttribute@2@PAVString@2@@Z",
        "??4?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "??_7?$ArrayList@G@UnBCL@@6B?$ICollection@G@1@@",
        "1j2r2w2",
        "??4File@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "?Dispose@TextWriter@UnBCL@@UAEXXZ",
        "uAWj ",
        "?CompareTo@String@UnBCL@@QBEHPBG@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::Object *>::QuickSort(class UnBCL::ArrayList<class UnBCL::Object *> *,class UnBCL::ArrayList<class UnBCL::Object *> *,int,int)",
        "6+7s7",
        "??_7?$Stack@H@UnBCL@@6B?$SerializableStackBase@H@_@1@@",
        "ExpandEnvironmentStringsW",
        "?get_IsReadOnly@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
        "?get_BiosReleaseDate@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
        ">K>]>l>",
        ";*<<<N<c<",
        "MaxClockSpeed",
        "040904B0",
        "?IsEmpty@?$CSimpleStringT@G$0A@@ATL@@QBE_NXZ",
        "Microsoft Time-Stamp Service0",
        "??0StringPtr@UnBCL@@QAE@ABV01@@Z",
        "class UnBCL::XmlNode *__thiscall UnBCL::XmlNode::CloneNode(int)",
        "void __thiscall UnBCL::ArrayList<int>::CopyTo(class UnBCL::Array<int> *,int) const",
        "3M4t4",
        "?Seek@FileStream@UnBCL@@UAE_J_JW4SeekOrigin@2@@Z",
        "??0?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@IAE@XZ",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive<float>(float)",
        "= =0=4=D=H=X=\\=t=",
        "=C=c=",
        ".data$r$brc",
        "5\"5q5",
        "0A0c0}0",
        "saw incorrect type of object for panthom read.",
        "Redmond1",
        "UnBCL::StreamReader::~StreamReader",
        "__thiscall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::Hashtable(int)",
        "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7B?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "int __thiscall UnBCL::ArrayList<unsigned char>::LastIndexOf(unsigned char,int,int) const",
        "?ToArray@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEPAV?$Array@PAVString@UnBCL@@@2@XZ",
        "??0PathTooLongException@UnBCL@@QAE@$$QAV01@@Z",
        "?4?S?w?",
        "5+5M5f5",
        "?Validate@HeapMemoryManager@UnBCL@@UAEXXZ",
        "??_7Encoding@UnBCL@@6B01@@",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *> __stdcall UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,class ATL::CElementTraits<class UnBCL::SerializationStream::TypeFactoryList *> > const *,struct __POSITION * const &)>::Reset(void)",
        "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8",
        "source and destination for move paths must be different",
        "??4Win32Exception@UnBCL@@QAEAAV01@ABV01@@Z",
        "??0AbandonedMutexException@UnBCL@@QAE@PBVString@1@@Z",
        "void __stdcall UnBCL::Environment::SetEnvironmentVar(const class UnBCL::String *,const class UnBCL::String *)",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@ABV01@@Z",
        ":H:Z:l:",
        "??4?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "null path to Path::IsShortCompliant",
        "?IndexOf@String@UnBCL@@QBEHGH@Z",
        "?RemoveAt@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEXH@Z",
        "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7BISerializable@1@@",
        "void __stdcall UnBCL::File::Delete(const class UnBCL::String *)",
        ">4>U>t>",
        "?DeleteRange@?$ArrayList@PAVString@UnBCL@@@UnBCL@@AAEXHH@Z",
        "?get_NodeType@XmlNode@UnBCL@@QAE?AW4XmlNodeType@2@XZ",
        "int __stdcall UnBCL::Array<unsigned char>::LastIndexOf(const class UnBCL::Array<unsigned char> *,unsigned char,int,int)",
        ">#>P>u>",
        "int __stdcall UnBCL::MP::OperatorCompare<__int64>::Compare(__int64,__int64)",
        "??0?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAE@PAVXmlNamespaceManager@1@@Z",
        "?Assign@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@AAEXPAVXmlNamespaceManager@2@@Z",
        "?get_ProcessorArchitecture@SystemInfo@UnBCL@@QBEKXZ",
        "??_8?$Stack@H@UnBCL@@7B?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "?StreamWrite@?$SerializableArrayBase@H@_@UnBCL@@UBEXAAVSerializationStream@3@@Z",
        "8%878E8f8",
        "void __thiscall UnBCL::ArrayList<class UnBCL::String *>::RemoveAt(int)",
        "StringFileInfo",
        "null str to Int32Ops::Parse",
        "3)4]4",
        "N0L0J",
        "??0Mutex@UnBCL@@QAE@$$QAV01@@Z",
        "?get_Rank@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
        "?Nullify@?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEAAV12@XZ",
        "??4HeapMemoryManager@UnBCL@@QAEAAV01@ABV01@@Z",
        "int __thiscall UnBCL::StreamReader::Peek(void)",
        "null array to Array::Sort",
        "??_7?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@6B@",
        "void __thiscall UnBCL::Array<int>::Insert(int,int)",
        "??0InvalidOperationException@UnBCL@@QAE@PBG@Z",
        "t>Wj ",
        "null value to String#Insert",
        "?'?C?",
        ";#;6;b;{;",
        "> >.>x>",
        "??4XmlSchemaSet@UnBCL@@QAEAAV01@ABV01@@Z",
        "int __thiscall UnBCL::String::LastIndexOf(unsigned short,int,int) const",
        "??4?$ArrayList@G@UnBCL@@QAEAAV01@ABV01@@Z",
        "?RetrieveEntry@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@KG?AV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@2@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@PAVString@3@UKeyTraits@23@V?$CElementTraits@PAVString@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z",
        ".?AVFileSystemEnumerator@UnBCL@@",
        ";4;D;H;L;P;T;X;l;|;",
        "t/Vj$",
        "??4?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@QAEAAV012@$$QAV012@@Z",
        "t+Vj$",
        "2J2Y2",
        "?/?>?c?",
        "=L9o<",
        "353<3C3k3q3~3",
        ";4;H;h;p;x;",
        "void __thiscall UnBCL::Array<unsigned short>::Insert(int,unsigned short)",
        "uBSj ",
        "Current retrieved on enumerator before MoveNext()",
        "??C?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBEPAVVersion@1@XZ",
        "??0?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAE@PAVSerializationStream@1@@Z",
        "3$3,343@3`3h3p3x3",
        "??0OutOfMemoryException@UnBCL@@QAE@PBG@Z",
        "3$3,383X3d3",
        "??0OverflowException@UnBCL@@QAE@ABV01@@Z",
        ";?;L;R;[;",
        "??_7?$Stack@PAVObject@UnBCL@@@UnBCL@@6BObject@1@@",
        "?IndexOf@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHPAVString@2@HH@Z",
        "__int64 __thiscall UnBCL::DateTime::TimeToTicks(int,int,int)",
        "??BRegHandle@UnBCL@@QAEPAUHKEY__@@XZ",
        "3H3u3",
        "7(787<7P7`7d7h7|7",
        "?Parse@XmlDocument@XmlLite@UnBCL@@IAEXPAUIStream@@@Z",
        ":,:8:@:t:",
        "?GetBuffer@?$Array@H@UnBCL@@UAEPAHH@Z",
        "?get_IsReadOnly@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHXZ",
        "__int64 __thiscall UnBCL::BufferedStream::Seek(__int64,enum UnBCL::SeekOrigin)",
        "__int64 __thiscall UnBCL::DateTime::DateToTicks(int,int,int)",
        "?Assign@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@AAEXABV12@@Z",
        "void __thiscall UnBCL::RegistryKey::DeleteSubKey(const class UnBCL::String *,int)",
        "?GetLength@?$CSimpleStringT@G$0A@@ATL@@QBEHXZ",
        "memmove",
        "?GetTypeName@?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
        "?$?(?8?<?@?X?h?l?",
        "0+0S0q0x0",
        "4F4c4",
        "??0?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@PAV?$Array@PAVString@UnBCL@@@1@@Z",
        "?get_LastChild@XmlNode@UnBCL@@QAEPAV12@XZ",
        "??_7FileSystemEnumerator@UnBCL@@6B?$IEnumerator@PAVString@UnBCL@@@1@@",
        "const class UnBCL::Char *__stdcall UnBCL::Try_Cast<const classUnBCL::Char*,const class UnBCL::Object>(const class UnBCL::Object *)",
        "??B?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
        "??0?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
        "?Trim@String@UnBCL@@QBEPAV12@XZ",
        "?DeAssign@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@AAEXXZ",
        "void __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *>::Insert(int,class UnBCL::XmlLite::XmlAttribute *)",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBG@Z",
        "?CreateDir@Directory@UnBCL@@SGPAVDirectoryInfo@2@PBVString@2@@Z",
        "=.===h=",
        "void __thiscall UnBCL::Array<class UnBCL::XmlLite::XmlAttribute *>::Insert(int,class UnBCL::XmlLite::XmlAttribute *)",
        "int __thiscall UnBCL::String::_StartsWith(class UnBCL::SmartPtr<class UnBCL::String>) const",
        "<*<w<",
        "void __thiscall UnBCL::Array<class UnBCL::StringPtr>::Remove(class UnBCL::StringPtr)",
        "?Close@StreamWriter@UnBCL@@UAEXXZ",
        "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5",
        "??_D?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAEXXZ",
        "8@9t9",
        "void __thiscall UnBCL::ArrayList<unsigned short>::QuickSort(class UnBCL::ArrayList<unsigned short> *,class UnBCL::ArrayList<unsigned short> *,int,int)",
        ".?AVPathTooLongException@UnBCL@@",
        "??0ArgumentOutOfRangeException@UnBCL@@QAE@XZ",
        "int __thiscall UnBCL::String::_LastIndexOfAny(class UnBCL::SmartPtr<class UnBCL::String>,int,int) const",
        "unable to create subkey",
        "??1SystemException@UnBCL@@UAE@XZ",
        "?Sort@?$ArrayList@G@UnBCL@@UAEXXZ",
        "6$6I6T6s6",
        "?LastIndexOf@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGHPBV12@PAVString@2@HH@Z",
        "8/8A8O8",
        "?G?f?",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAF@Z",
        "8$8K8X8^8g8",
        "??4Object@UnBCL@@QAEAAV01@ABV01@@Z",
        "7$7,747<7D7L7\\7d7l7t7|7",
        ".?AVTimeSpan@UnBCL@@",
        "void __thiscall UnBCL::SerializationStream::ReadBytes(unsigned char *,int)",
        "f98uDWj ",
        "?Assign@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@AAEXABV12@@Z",
        "memmove_s",
        "FreeLibrary",
        "`.data",
        "%s: %s(%S) failed",
        "void __thiscall UnBCL::Array<class UnBCL::XmlLite::XmlNode *>::Remove(class UnBCL::XmlLite::XmlNode *)",
        "??0?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAE@XZ",
        "??1Exception@UnBCL@@UAE@XZ",
        "??4IPoolable@UnBCL@@QAEAAU01@ABU01@@Z",
        "1/2H2W2v2",
        "7S8q8x8",
        "const class UnBCL::SmartPtr<class UnBCL::String> *__thiscall UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> >::GetBuffer(int) const",
        "?GetBuffer@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEPAPAVObject@2@H@Z",
        "__thiscall UnBCL::ArrayList<unsigned short>::ArrayList(const struct UnBCL::ICollection<unsigned short> *)",
        "8R8u8",
        "?ToByteArray@MultiSz@UnBCL@@QBEPAV?$Array@E@2@XZ",
        "?Substring@String@UnBCL@@QBEPAV12@H@Z",
        "??_7Stream@UnBCL@@6BIDisposable@1@@",
        "UnBCL::RegSubkeyEnumerator::Init",
        "=#=j=|=",
        "??_8?$ArrayList@G@UnBCL@@7BISerializable@1@@",
        "int __thiscall UnBCL::ArrayList<int>::BinarySearch(int,int,int,struct UnBCL::IComparer<int> *)",
        "??4?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@QAEAAV012@$$QAV012@@Z",
        "??_8MultiSz@UnBCL@@7BISerializable@1@@",
        "??4RegSubkeyEnumerator@UnBCL@@QAEAAV01@ABV01@@Z",
        "?set_Chars@StringBuilder@UnBCL@@QAEXHG@Z",
        "??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@XZ",
        "tmjA3",
        ":,;<;D;M;];e;o;t;};",
        "?InnerList@?$Array@E@UnBCL@@MBEPAV?$ArrayList@E@2@XZ",
        "?get_Hour@DateTime@UnBCL@@QBEHXZ",
        "??0?$Array@G@UnBCL@@QAE@ABV01@@Z",
        "??4ISerializable@UnBCL@@QAEAAU01@ABU01@@Z",
        "?Contains@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHQAVString@2@@Z",
        "?Assign@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@AAEXABV12@@Z",
        "??6SerializationStream@UnBCL@@QAEAAV01@I@Z",
        "??_7?$Array@G@UnBCL@@6B?$SerializableArrayBase@G@_@1@@",
        ";,;<;L;P;T;l;p;",
        "??0StringPtr@UnBCL@@QAE@PAVString@1@@Z",
        "90949H9L9P9h9x9|9",
        "?CopyTo@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEXPAV?$Array@PAVString@UnBCL@@@2@H@Z",
        "??0ArgumentOutOfRangeException@UnBCL@@QAE@$$QAV01@@Z",
        "<?=v=",
        "626C6^6c6",
        ":C:y:",
        "??0Win32Exception@UnBCL@@QAE@KPBG@Z",
        "null factory to SerializationStream::RegisterType",
        "?CompareTo@Object@UnBCL@@UBEHPBV12@@Z",
        "0$0p0{0",
        "=&=+=?=M=U=Z=n=|=",
        "??_8OperatingSystem@UnBCL@@7B?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@1@@",
        "?StreamRead@OperatingSystem@UnBCL@@UAEXAAVSerializationStream@2@@Z",
        "?Clone@?$Array@G@UnBCL@@UBEPAVObject@2@XZ",
        "??B?$CSimpleStringT@G$0A@@ATL@@QAEAAV?$CSimpleStringT@G$00@1@XZ",
        "??0?$Array@PAVObject@UnBCL@@@UnBCL@@QAE@PBU?$ICollection@PAVObject@UnBCL@@@1@@Z",
        "5,50545H5L5P5h5l5",
        ";.;8;o;z;",
        "<,<<<@<D<H<L<T<X<l<|<",
        "??4SystemInfo@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "printf",
        "?get_Arguments@ProcessStartInfo@UnBCL@@QBEPBVString@2@XZ",
        "000@0P0T0d0h0x0|0",
        "InternalName",
        "Current retrieved on enumerator beyond list end",
        "class UnBCL::Object *&__thiscall UnBCL::ArrayList<class UnBCL::Object *>::get_Item(int)",
        "??0DateTime@UnBCL@@QAE@_J@Z",
        ":P:|:",
        "??D?$SmartPtr@VStream@UnBCL@@@UnBCL@@QBEAAVStream@1@XZ",
        "SVVVV",
        "??0ProcessStartInfo@UnBCL@@QAE@ABV01@@Z",
        "??1OverflowException@UnBCL@@UAE@XZ",
        "??0NotSupportedException@UnBCL@@QAE@ABV01@@Z",
        "?GetBytes@ASCIIEncoding@UnBCL@@UBEHPBVString@2@HHPAV?$Array@E@2@H@Z",
        ".?AVRegHandle@UnBCL@@",
        "1#2c2",
        "222V2z2",
        "Translation",
        "?AppendNewLine@StringBuilder@UnBCL@@QAEPAV12@XZ",
        "?Done@String@UnBCL@@SGXXZ",
        "unable to write to FileStream",
        "5F6T6l6w6",
        "memcpy",
        ".?AV?$Array@PAVString@UnBCL@@@UnBCL@@",
        "?SGetChars@UnicodeEncoding@UnBCL@@CGHPBV?$Array@E@2@HHPAV?$Array@G@2@HH@Z",
        "3+3N3Y3",
        "?CopyTo@?$Array@E@UnBCL@@UBEXPAV12@H@Z",
        "void __thiscall UnBCL::Array<class UnBCL::XmlLite::XmlAttribute *>::Remove(class UnBCL::XmlLite::XmlAttribute *)",
        "u*Sj ",
        "?get_IsReadOnly@?$Array@H@UnBCL@@UBEHXZ",
        "null instance to Monitor::Exit",
        "?RemoveAt@?$Array@E@UnBCL@@UAEXH@Z",
        ".?AVCaseInsensitiveStringComparer@UnBCL@@",
        "??0?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAE@XZ",
        "?LoadStringW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHPAUHINSTANCE__@@IG@Z",
        " http://www.microsoft.com/windows0",
        "?CloneNode@XmlNode@UnBCL@@QAEPAV12@H@Z",
        "ix or count out of range to StringBuilder#Append",
        "??_7WaitHandle@UnBCL@@6BObject@1@@",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAH@Z",
        "?Remove@String@UnBCL@@QBEPAV12@HH@Z",
        ".?AV?$ArrayListEnumerator@PAVObject@UnBCL@@@_@UnBCL@@",
        "??1UnicodeEncoding@UnBCL@@UAE@XZ",
        "??0InvalidCastException@UnBCL@@QAE@ABV01@@Z",
        "??0?$SerializableArrayBase@E@_@UnBCL@@QAE@ABV012@@Z",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *>,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,class ATL::CElementTraits<class UnBCL::String *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "5#6;6B6g6s6",
        "?Trim@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@PBG@Z",
        ".?AVXPathException@UnBCL@@",
        "?s_Registration@?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
        "??0?$Array@PAVObject@UnBCL@@@UnBCL@@QAE@HH@Z",
        "9 :3:E:S:",
        "N;D$ r;",
        "??1XmlNode@XmlLite@UnBCL@@UAE@XZ",
        "7!7*787K7V7\\7d7k7~7",
        "8$8,848D8P8X8",
        "5+5H5X5o5",
        ":`;s;",
        ".?AV?$ArrayList@VStringPtr@UnBCL@@@UnBCL@@",
        "9(9A9c9{9",
        "Can't set a negative size",
        "saw unrecognized type/version pair '%s - %d'",
        "??0?$ICollection@G@UnBCL@@QAE@ABU01@@Z",
        "?get_IsReadOnly@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
        "3?3Q3`3y3",
        "5C6Z6q6",
        "Array doesn't support RemoveAt()",
        "ix or count out of range to UnicodeEncoding::GetString",
        "4G5P5i5x5",
        "4N5]5",
        "?get_P@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QBEPAVDecoder@2@XZ",
        "6\"7.7:7F7",
        "class UnBCL::String *__stdcall UnBCL::Directory::GetTempPathName(void)",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive<__int64>(__int64)",
        "??1?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
        ":3;t;",
        "636J6",
        "??1TextReader@UnBCL@@UAE@XZ",
        "void __thiscall UnBCL::Array<class UnBCL::String *>::InitLarva(class UnBCL::ArrayList<class UnBCL::String *> *)",
        "??_8CaseInsensitiveStringComparer@UnBCL@@7B@",
        "979F9N9q93<Q<[<",
        ".?AVObjectDisposedException@UnBCL@@",
        "?Exit@Monitor@UnBCL@@SGXPAVSyncObject@2@@Z",
        ".?AV?$ValueCollection@UUniqueObject@SerializationStream@UnBCL@@H@_@UnBCL@@",
        "?get_Prefix@XmlNode@UnBCL@@QAEPAVString@2@XZ",
        "??_7?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@6BISerializable@2@@",
        "wcschr",
        "4 4$4(404H4L4d4h4l4p4t4x4",
        "<-<<<S<v<",
        "??C?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QBEPAVDecoder@1@XZ",
        "??_7?$SerializableArrayBase@G@_@UnBCL@@6BISerializable@2@@",
        "??0MultiSz@UnBCL@@QAE@ABV01@@Z",
        ":3;N;s;",
        "6!7i7~7/8",
        "=5>k>",
        "?get_Seconds@TimeSpan@UnBCL@@QBEHXZ",
        "?FromString@MultiSz@UnBCL@@SGPAV12@PBGG@Z",
        "int __thiscall UnBCL::ArrayList<class UnBCL::String *>::LastIndexOf(class UnBCL::String *,int,int) const",
        "?InsertBefore@XmlNode@UnBCL@@QAEPAV12@PAV12@0@Z",
        "?BinarySearch@?$Array@H@UnBCL@@SGHPBV12@HPAU?$IComparer@H@2@@Z",
        "5 5d5",
        "?InnerList@?$Stack@PAVObject@UnBCL@@@UnBCL@@MAEAAPAV?$ArrayList@PAVObject@UnBCL@@@2@XZ",
        "??0Win32Exception@UnBCL@@QAE@K@Z",
        "??0InvalidOperationException@UnBCL@@QAE@ABV01@@Z",
        "?Steal@?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEPAVString@2@XZ",
        "??4Type@UnBCL@@QAEAAV01@ABV01@@Z",
        "#020@0N0\\0j0x0",
        "void __thiscall UnBCL::Array<class UnBCL::String *>::RemoveAt(int)",
        "?Resize@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXHH@Z",
        "??0?$SerializableArrayBase@G@_@UnBCL@@QAE@XZ",
        "??0?$Stack@H@UnBCL@@QAE@ABV01@@Z",
        "?InternalFree@HeapMemoryManager@UnBCL@@AAEXPAX@Z",
        "set_Capacity on nongrowable or read-only MemoryStream",
        "7$7+7T7c7q7",
        "??1?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@UAE@XZ",
        "RegQueryValueExW",
        "??1StringPtr@UnBCL@@UAE@XZ",
        "8c8m8z8",
        "?Flush@MemoryStream@UnBCL@@UAEXXZ",
        ".?AV?$DefaultInstanceFactory@VMultiSz@UnBCL@@@UnBCL@@",
        "GetProcessHeap",
        ";-;s;",
        "??3Object@UnBCL@@SGXPAXPBDH@Z",
        "??0?$SmartPtr@VObject@UnBCL@@@UnBCL@@QAE@PAVObject@1@@Z",
        ".?AVXmlAttribute@XmlLite@UnBCL@@",
        ":Q:c:r:",
        "LoadLibraryExW",
        "class UnBCL::String *__stdcall UnBCL::Environment::GetEnvironmentVar(const class UnBCL::String *)",
        "??0StringBuilder@UnBCL@@QAE@PBG@Z",
        "??4SEHException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "calloc",
        "??4?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??_7?$Array@H@UnBCL@@6B?$IEnumerable@H@1@@",
        "SetEndOfFile",
        " copy to ",
        "??4IndexOutOfRangeException@UnBCL@@QAEAAV01@ABV01@@Z",
        "??_7?$Array@PAVObject@UnBCL@@@UnBCL@@6B?$IEnumerable@PAVObject@UnBCL@@@1@@",
        "SelectionLanguage",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "5 5054585<5@5D5X5\\5`5t5",
        "0#1A1Y1y1",
        "RegSetValueExW",
        "?MIN_TICKS@DateTime@UnBCL@@0_JB",
        "saw incorrect header for panthom read.",
        "attempt to construct DateTime outside of allowed range",
        "void __thiscall UnBCL::Array<class UnBCL::StringPtr>::RemoveAt(int)",
        "?Insert@?$Array@G@UnBCL@@UAEXHG@Z",
        "3&3x3",
        "null buf to BufferedStream#Write",
        "8,8D8",
        ".?AV?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@",
        "byteix or count out of range in ASCIIEncoding#GetBytes",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *> __stdcall UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,class ATL::CElementTraits<class UnBCL::SerializationStream::TypeFactoryList *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        ".?AVInvalidOperationException@UnBCL@@",
        ".?AV?$SmartPtr@U?$ICollection@H@UnBCL@@@UnBCL@@",
        "?get_P@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBEPAV?$Array@E@2@XZ",
        "?get_Count@XmlNodeList@UnBCL@@QAEHXZ",
        "\"Microsoft Window",
        "WWWWj",
        ".?AVProcessStartInfo@UnBCL@@",
        "?GetEnumerator@?$Array@E@UnBCL@@UBEPAU?$IEnumerator@E@2@XZ",
        "1\"242C2g2",
        "131O1s1",
        ".?AU?$IList@PAVObject@UnBCL@@@UnBCL@@",
        "?GetChars@ASCIIEncoding@UnBCL@@UBEHPBV?$Array@E@2@HHPAV?$Array@G@2@H@Z",
        ":#:1:g:y:",
        "??0Thread@UnBCL@@QAE@ABV01@@Z",
        "?get_AutoDelete@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
        "4$4,444<4D4L4T4d4t4|4",
        "??_7?$Array@H@UnBCL@@6BISerializable@1@@",
        "ADVAPI32.dll",
        "?CopyTo@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEXPAV?$Array@PAVObject@UnBCL@@@2@H@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *>::QuickSort(class UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *> *,class UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *> *,int,int)",
        "class UnBCL::XmlLite::XmlNode **__thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *>::GetBuffer(int)",
        ":8:J:Y:s:",
        "?GetBuffer@?$Array@PAVString@UnBCL@@@UnBCL@@UBEPBQAVString@2@H@Z",
        "void __stdcall UnBCL::ArrayList<unsigned short>::Copy(const class UnBCL::ArrayList<unsigned short> *,int,class UnBCL::ArrayList<unsigned short> *,int,int)",
        "??_7XmlAttributeCollection@XmlLite@UnBCL@@6B@",
        "8084888<8@8H8`8d8|8",
        "2P2c2",
        "class UnBCL::SmartPtr<class UnBCL::String> *__thiscall UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> >::GetBuffer(int)",
        "??_7?$SmartPtr@VStream@UnBCL@@@UnBCL@@6B@",
        "??0?$Array@E@UnBCL@@QAE@HH@Z",
        "??1?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@UAE@XZ",
        "?ReleaseBuffer@?$CSimpleStringT@G$0A@@ATL@@QAEXH@Z",
        ")null buf to FileStream#Read",
        "?InnerList@?$Array@PAVString@UnBCL@@@UnBCL@@MBEPAV?$ArrayList@PAVString@UnBCL@@@2@XZ",
        "? ?/?J?\\?k?",
        "?set_Item@?$ArrayList@G@UnBCL@@UAEXHG@Z",
        "?WaitOne@WaitHandle@UnBCL@@UAEHXZ",
        "??_7SyncObject@UnBCL@@6B@",
        "??4PathTooLongException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??1?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@UAE@XZ",
        "t_Wj$",
        "QQSVW3",
        ":3;~;",
        "303X3t3",
        ".?AV?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive<unsigned __int64>(unsigned __int64)",
        "?FormatMessageV@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEXPBGPAPAD@Z",
        "??4Process@UnBCL@@QAEAAV01@ABV01@@Z",
        ":,:<:@:X:h:l:|:",
        "??0?$Array@H@UnBCL@@QAE@PBU?$ICollection@H@1@@Z",
        "void __thiscall UnBCL::ArrayList<unsigned short>::CopyTo(class UnBCL::Array<unsigned short> *,int) const",
        "?CloneData@?$CSimpleStringT@G$0A@@ATL@@CAPAUCStringData@2@PAU32@@Z",
        "??D?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEAAVString@1@XZ",
        "0T0f0x0",
        "class UnBCL::String *__stdcall UnBCL::String::FromASCII(const char *)",
        "??4AbandonedMutexException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "?set_Item@?$Array@H@UnBCL@@UAEXHH@Z",
        "??4?$IComparer@PAVString@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "2 2(202D2L2T2d2p2",
        "??4?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "4*4R4f4z4",
        "4<4h4",
        "??_8?$Stack@H@UnBCL@@7BISerializable@1@@",
        "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6B01@@",
        "9 9'9M9Y9",
        "?LoadStringW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHPAUHINSTANCE__@@I@Z",
        "const int *__thiscall UnBCL::ArrayList<int>::GetBuffer(int) const",
        "4,444<4P4X4`4p4|4",
        "??0MutableString@UnBCL@@QAE@ABVString@1@@Z",
        "?get_Item@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEAAPAVObject@2@H@Z",
        "??4?$SerializableStackBase@H@_@UnBCL@@QAEAAV012@$$QAV012@@Z",
        "negative capacity to StringBuilder constructor",
        "void __thiscall UnBCL::ArrayList<int>::RemoveAt(int)",
        ".idata$3",
        "?Flush@StreamWriter@UnBCL@@UAEXXZ",
        ";(<5<s<",
        "?Flush@SerializationStream@UnBCL@@QAEXXZ",
        ".?AVDirectoryInfo@UnBCL@@",
        "monitor initialization failed",
        "?ToLower@String@UnBCL@@QBEPAV12@XZ",
        "null path to FileStream constructor",
        "?get_Count@?$Array@G@UnBCL@@UBEHXZ",
        ".?AV?$ArrayList@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@UnBCL@@",
        "??1?$IList@E@UnBCL@@UAE@XZ",
        "??4?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
        "negative capacity to ArrayList constructor",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive<unsigned short>(unsigned short &)",
        "??0ArithmeticException@UnBCL@@QAE@ABV01@@Z",
        "?_Substring@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@H@Z",
        "??4Logging@UnBCL@@QAEAAV01@ABV01@@Z",
        "int __thiscall UnBCL::Array<class UnBCL::SmartPtr<class UnBCL::String> >::Add(class UnBCL::SmartPtr<class UnBCL::String>)",
        "?get_Current@RegSubkeyEnumerator@UnBCL@@UBEPBGXZ",
        "??4FileSystemEnumerator@UnBCL@@QAEAAV01@ABV01@@Z",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "7*7<7S7",
        "??0?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
        "??0IDisposable@UnBCL@@QAE@XZ",
        "111a1",
        ".?AVEnumerator@MultiSz@UnBCL@@",
        "?get_ProcessorName@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
        "?Equals@DateTime@UnBCL@@UBEHPBVObject@2@@Z",
        "??4XmlAttribute@UnBCL@@QAEAAV01@ABV01@@Z",
        "_IsRunning@0",
        "??0StringBuilder@UnBCL@@QAE@XZ",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *>,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,class ATL::CElementTraits<class UnBCL::String *> > const *,struct __POSITION * const &)>::Reset(void)",
        "??1WaitHandle@UnBCL@@UAE@XZ",
        "??4ProcessStartInfo@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UAE@XZ",
        "0!090Y0s0",
        "5$6k6",
        "??B?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
        ":$:q:",
        "9(9?9S9i9t9",
        "??4Decoder@UnBCL@@QAEAAV01@$$QAV01@@Z",
        ">3>K>R>Y>`>g>n>",
        "8!939B9W9~9",
        ">9>_>s>",
        "5 6'6F6Z6s6}6",
        ">S>b>",
        "?get_Item@?$Stack@H@UnBCL@@UAEAAHH@Z",
        "??_7FileStream@UnBCL@@6BIDisposable@1@@",
        "?RetrieveValue@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@KGPAVString@2@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@PAVString@3@UKeyTraits@23@V?$CElementTraits@PAVString@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z",
        "??4XmlAttribute@XmlLite@UnBCL@@QAEAAV012@$$QAV012@@Z",
        "??1XmlNodeList@XmlLite@UnBCL@@UAE@XZ",
        "struct UnBCL::SerializationStream::UniqueObject __thiscall UnBCL::_::HTEnumerator<struct UnBCL::SerializationStream::UniqueObject,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,struct UnBCL::SerializationStream::UniqueObject,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,&protected: static struct UnBCL::SerializationStream::UniqueObject __stdcall UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "?StringLength@?$CSimpleStringT@G$0A@@ATL@@SAHPBD@Z",
        "?GetFileNameExtension@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        "?ReadByte@Stream@UnBCL@@UAEHXZ",
        "??4MutableString@UnBCL@@QAEAAV01@PBG@Z",
        "?get_Count@?$Array@E@UnBCL@@UBEHXZ",
        "?CheckInvalidPathChars@Path@UnBCL@@CGXPBVString@2@@Z",
        "=,=0=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=",
        "null srcpath or destpath to File::Move",
        "??_7?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@6B@",
        "?BinarySearch@?$Array@E@UnBCL@@SGHPBV12@EPAU?$IComparer@E@2@@Z",
        "6O6a6t6|6",
        ">V>r>'?",
        "?get_AutoDelete@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
        "t:hX+",
        "VVVQVVVVVV",
        ".?AV?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "??_7?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
        "2'2Z2",
        "20201008051253Z",
        "??6SerializationStream@UnBCL@@QAEAAV01@_J@Z",
        "yuj@j",
        "int __thiscall UnBCL::MemoryStream::get_Capacity(void) const",
        "empty path to Directory::CreateDirectory",
        "?DateToTicks@DateTime@UnBCL@@AAE_JHHH@Z",
        "?Preallocate@?$CSimpleStringT@G$0A@@ATL@@QAEXH@Z",
        "??4?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@ABV01@@Z",
        "?Compare@String@UnBCL@@SGHPBV12@0H@Z",
        "?Release@Mutex@UnBCL@@UAEXXZ",
        "?InitTarget@Monitor@UnBCL@@CGKPAVSyncObject@2@@Z",
        "??4ObjectDisposedException@UnBCL@@QAEAAV01@ABV01@@Z",
        "tBVj$",
        "4(4K4|4",
        "1C2g2",
        "?set_Item@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXHPAVString@2@@Z",
        "<F<v<",
        "??Y?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@ABV01@@Z",
        "?AllocDbg@Allocator@UnBCL@@SGPAXKPBDHI@Z",
        "?GetBuffer@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEPAPAVString@2@H@Z",
        "??0ArgumentNullException@UnBCL@@QAE@PBG@Z",
        "int __stdcall UnBCL::Array<unsigned char>::IndexOf(const class UnBCL::Array<unsigned char> *,unsigned char,int,int)",
        "2!232E2S2",
        "t#Vj ",
        ".?AVSystemInfo@UnBCL@@",
        "757}7",
        "2$2,242<2D2L2T2\\2d2l2t2|2",
        "invalid handle to FileStream constructor",
        "?Read@BufferedStream@UnBCL@@UAEHPAEHH@Z",
        "CreateThread failed in Thread constructor",
        "??4?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@QAEAAV012@$$QAV012@@Z",
        ".?AV?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAE@PBU?$ICollection@PAVString@UnBCL@@@1@@Z",
        "empty path to FileStream constructor",
        "?StartsWith@String@UnBCL@@QBEHPBGH@Z",
        ".PAVObjectDisposedException@UnBCL@@",
        "?GetOccurenceLastIndexOf@String@UnBCL@@QBEHGH@Z",
        ">.?_?z?",
        ".?AV?$SmartPtr@VMultiSz@UnBCL@@@UnBCL@@",
        "2d3w3",
        "1 1(1@1P1T1d1h1x1|1",
        "0!0(0/0d0r0",
        "??_7Encoding@UnBCL@@6BObject@1@@",
        "0'070S0f0s0",
        ".?AV?$SmartPtr@U?$IEnumerator@VStringPtr@UnBCL@@@UnBCL@@@UnBCL@@",
        "??_8WaitHandle@UnBCL@@7BIDisposable@1@@",
        "??7?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QBE_NXZ",
        ".?AU?$IList@PAVString@UnBCL@@@UnBCL@@",
        "void __thiscall UnBCL::MemoryStream::SetLength(__int64)",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive<long>(long &)",
        "f91u.Vj",
        ";@;d;",
        "=0=o=",
        "SetLength on closed MemoryStream",
        "?Contains@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHQAVString@2@@Z",
        "8,888X8d8",
        "??_8Registry@UnBCL@@7B@",
        "?GetEnumerator@MultiSz@UnBCL@@UBEPAU?$IEnumerator@PBG@2@XZ",
        "CompanyName",
        "Yj\\Zf",
        "= >C>U>g>",
        "?get_Chars@String@UnBCL@@QBEABGH@Z",
        ".?AVRegSubkeyEnumerator@UnBCL@@",
        "?Clone@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEPAVObject@2@XZ",
        "class UnBCL::Object *const *__thiscall UnBCL::ArrayList<class UnBCL::Object *>::GetBuffer(int) const",
        "??4IDisposable@UnBCL@@QAEAAU01@$$QAU01@@Z",
        ".?AVXmlException@UnBCL@@",
        ";h<w<",
        "??0SEHException@UnBCL@@QAE@I@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *>::CopyTo(class UnBCL::Array<class UnBCL::XmlLite::XmlAttribute *> *,int) const",
        "??0Object@UnBCL@@QAE@XZ",
        "null bytes to ASCIIEncoding#GetBytes",
        "??_8?$Array@G@UnBCL@@7B?$SerializableArrayBase@G@_@1@@",
        "??0?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAE@PAVEncoding@1@@Z",
        "GlobalAlloc",
        "??_7?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
        "??_7?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
        "ticks out of range to DateTime constructor",
        "Seek() on closed BufferedStream",
        "1(1L1T1\\1d1l1t1|1",
        "?get_Position@BufferedStream@UnBCL@@UBE_JXZ",
        "??_8?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@7B@",
        "?Assign@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@AAEXABV12@@Z",
        "LSELECT * FROM Win32_ComputerSystem",
        "404?4i4{4",
        "<,<><M<w<",
        "base\\ntsetup\\unbcl\\src\\waithandle.cpp",
        "?Create@File@UnBCL@@SGPAVFileStream@2@PBVString@2@@Z",
        "?BinarySearch@?$ArrayList@G@UnBCL@@UAEHGPAU?$IComparer@G@2@@Z",
        "capacity out of range or less than length",
        "??0?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAE@PAVVersion@1@@Z",
        ".?AV?$SerializableBase@V?$ArrayList@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        ".?AV?$KeyCollection@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@_@UnBCL@@",
        "empty srcpath or destpath to Directory::Move",
        "?GetSubKeyNames@RegistryKey@UnBCL@@QAEPAV?$Array@PAVString@UnBCL@@@2@XZ",
        "?get_Length@?$Array@G@UnBCL@@UBEHXZ",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "null bytes to ASCIIEncoding::GetString",
        "?s_Registration@?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@0UStaticTypeRegistration@12@A",
        "?BinarySearch@?$Array@PAVString@UnBCL@@@UnBCL@@SGHPBV12@PAVString@2@PAU?$IComparer@PAVString@UnBCL@@@2@@Z",
        "class UnBCL::String *__stdcall UnBCL::Path::Sanitize(const class UnBCL::String *)",
        ";C;R;\\;",
        "class UnBCL::StringPtr *__thiscall UnBCL::ArrayList<class UnBCL::StringPtr>::GetBuffer(int)",
        "negative offset or count to BufferedStream#Read",
        "??_8BufferedStream@UnBCL@@7BStream@1@@",
        ">:>v>",
        "?Close@MemoryStream@UnBCL@@UAEXXZ",
        "??0IPoolable@UnBCL@@QAE@$$QAU01@@Z",
        "UnBCL::HeapMemoryManager::InternalValidate",
        "MoveToElement",
        ".?AV?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@",
        "2(262",
        "?set_HResult@Exception@UnBCL@@MAEXJ@Z",
        "?QuickSort@?$ArrayList@PAVString@UnBCL@@@UnBCL@@AAEXPAV12@0HH@Z",
        "0#0r0",
        "GetTemporaryFileName: tempPath->Lenght > (MAX_PATH - 14).",
        ")null value to insert constructor",
        "GetVersionExW",
        "u\"Sj 9Y",
        "overflow: count too large in UnicodeEncoding::GetByteCount",
        "?InitLarva@?$Array@G@UnBCL@@MAEXPAV?$ArrayList@G@2@@Z",
        "??0Registry@UnBCL@@QAE@XZ",
        "??_7ASCIIEncoding@UnBCL@@6BEncoding@1@@",
        "int __stdcall UnBCL::ArrayList<unsigned short>::LastIndexOf(const class UnBCL::ArrayList<unsigned short> *,unsigned short,int,int)",
        "?ReadBytes@SerializationStream@UnBCL@@QAEAAV?$ArrayList@E@2@H@Z",
        "969I9",
        "1G1]1",
        "QueryPerformanceCounter",
        "1C1`1|1",
        ".?AV?$SmartPtr@VXmlAttributeCollection@XmlLite@UnBCL@@@UnBCL@@",
        "?TrimRight@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@PBG@Z",
        "??0?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
        "MultiSz value is too large",
        "base\\ntsetup\\unbcl\\src\\monitor.cpp",
        "7#7?7c7|7",
        "??0ObjectDisposedException@UnBCL@@QAE@$$QAV01@@Z",
        "?get_Count@?$Array@H@UnBCL@@UBEHXZ",
        "GetLocalTime",
        "j PjZ",
        "??1?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@UAE@XZ",
        "??0?$ICollection@G@UnBCL@@QAE@XZ",
        "?AddRange@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXPBU?$ICollection@PAVString@UnBCL@@@2@@Z",
        "&quot;",
        "?_IndexOf@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@@Z",
        "null path to Path::Combine",
        "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@D@Z",
        "?SetValue@RegistryKey@UnBCL@@QAEXPBVString@2@PBV?$Array@PAVString@UnBCL@@@2@@Z",
        "??0ThreadStateException@UnBCL@@QAE@XZ",
        "CreateEventW",
        "?get_AutoDelete@?$Array@E@UnBCL@@UBEHXZ",
        "?RemoveNamespace@XmlNamespaceManager@UnBCL@@QAEXPAVString@2@@Z",
        "717C7c7",
        "4M4m4",
        "tZWj$",
        "??0BufferedStream@UnBCL@@QAE@PAVStream@1@K@Z",
        "null old or NEW string to String#Replace",
        ".?AV?$HTDictEnumBase@V?$DictionaryEntry@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@@_@UnBCL@@",
        "?Sort@?$Array@E@UnBCL@@SGXPAV12@@Z",
        ":$:=:D:K:s:~:",
        "?Equals@?$Array@G@UnBCL@@UBEHPBVObject@2@@Z",
        "< =X=",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::Object *>::Reset(void)",
        "1 10141D1H1L1T1l1|1",
        "class UnBCL::Array<class UnBCL::String *> *__stdcall UnBCL::Environment::GetLogicalDriveNames(void)",
        ";#;N;",
        "??0IndexOutOfRangeException@UnBCL@@QAE@PAVString@1@@Z",
        "7 7$7(7<7@7P7T7X7\\7`7t7",
        "FreeEnvironmentStringsW",
        "?Remove@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXPAVString@2@@Z",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBGHPAUIAtlStringMgr@1@@Z",
        "??1?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@UAE@XZ",
        "838O8s8",
        ":!:0:6:",
        "unsigned char &__thiscall UnBCL::ArrayList<unsigned char>::get_Item(int)",
        ":+:=:L:c:",
        "??0SystemInfo@UnBCL@@QAE@$$QAV01@@Z",
        "?IsNumber@Char@UnBCL@@SGHG@Z",
        "?get_Item@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEABQAVObject@2@H@Z",
        "566s6",
        "DeleteFileW",
        ":=:q:",
        "int __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *>::IndexOf(class UnBCL::XmlLite::XmlAttribute *,int,int) const",
        "0-0N0\\0",
        "2+3>3P3c3",
        "= =$=4=D=H=X=\\=`=d=h=l=p=t=x=|=",
        "0<0N0`0",
        "??_8?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@7B?$ICollection@PAVObject@UnBCL@@@1@@",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *> __stdcall UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,class ATL::CElementTraits<class UnBCL::SerializationStream::TypeFactoryList *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *> *,class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *> > *,int)",
        "?GetValue@RegistryKey@UnBCL@@QAEKPBVString@2@@Z",
        "??_8?$Stack@PAVObject@UnBCL@@@UnBCL@@7B01@@",
        "0L1o1~1",
        "??_7ArithmeticException@UnBCL@@6B@",
        "?Assign@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@AAEXPAV?$ArrayList@PAVString@UnBCL@@@2@@Z",
        "??_7SerializationException@UnBCL@@6B@",
        "?GetZero@TimeSpan@UnBCL@@SG?AV12@XZ",
        "??_DMultiSz@UnBCL@@QAEXXZ",
        "class UnBCL::String *__thiscall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::get_Item(class UnBCL::String *) const",
        "??_8?$Array@G@UnBCL@@7B?$ICollection@G@1@@",
        "saw unrecognized object header '0x%x'",
        "?InnerList@?$Stack@PAVObject@UnBCL@@@UnBCL@@MBEABQAV?$ArrayList@PAVObject@UnBCL@@@2@XZ",
        "InitializeCriticalSection",
        "?Replace@String@UnBCL@@QBEPAV12@PAV12@0H@Z",
        "??1IDisposable@UnBCL@@UAE@XZ",
        "?Assign@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@AAEXPAVSerializationId@2@@Z",
        "??_8?$Stack@H@UnBCL@@7B?$SerializableStackBase@H@_@1@@",
        "void __thiscall UnBCL::ArrayList<int>::Insert(int,int)",
        "??_7XmlNode@XmlLite@UnBCL@@6B@",
        "??_7?$Stack@H@UnBCL@@6B?$ICollection@H@1@@",
        "int __stdcall UnBCL::ArrayList<class UnBCL::Object *>::BinarySearch(class UnBCL::ArrayList<class UnBCL::Object *> *,class UnBCL::Object *,struct UnBCL::IComparer<class UnBCL::Object *> *)",
        "??0ObjectDisposedException@UnBCL@@QAE@PBG@Z",
        "5*595S5",
        "?Alloc@Allocator@UnBCL@@SGPAXKI@Z",
        "??_DMemoryStream@UnBCL@@QAEXXZ",
        "<#=C=`=",
        "?get_InnerList@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@MAEPAV?$ArrayList@PAVObject@UnBCL@@@2@XZ",
        "?Insert@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEXHPAVObject@2@@Z",
        "??0?$Array@G@UnBCL@@QAE@HH@Z",
        ">X?g?",
        "738=8J8P8",
        ":+:K:",
        ".CRT$XCU",
        "?Insert@?$ArrayList@G@UnBCL@@UAEXHG@Z",
        "?get_IsFixedSize@?$Array@H@UnBCL@@UBEHXZ",
        "2#2T2]2",
        "?EscapeXMLAndAdd@StringBuilder@UnBCL@@IAEXPBG@Z",
        "??_7?$Array@E@UnBCL@@6B?$ICollection@E@1@@",
        "Wadvapi32.dll",
        "void __stdcall UnBCL::Directory::DeleteInternal(const class UnBCL::String *,int,int)",
        "=<=`=",
        "4 4$4<4L4P4T4l4p4",
        "??0?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
        "?Replace@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHPBG0@Z",
        ".?AU?$ICollection@H@UnBCL@@",
        "=:=N=`=n=",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::operator <<(const class UnBCL::String *)",
        ".?AU?$IEnumerable@V?$DictionaryEntry@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<unsigned char>::AddRange(const struct UnBCL::ICollection<unsigned char> *)",
        "?Trim@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@G@Z",
        "??_8?$Array@E@UnBCL@@7B?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "?set_Item@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXHPAVObject@2@@Z",
        ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:",
        "<\"<1<J<`<",
        "??0ArgumentException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
        "??1Process@UnBCL@@UAE@XZ",
        ") dir copy to ",
        "6#6<6c6",
        "?DumpDelta@Allocator@UnBCL@@SGIPAUILogHandler@@I@Z",
        "0,1c1",
        "?StreamWrite@OperatingSystem@UnBCL@@UBEXAAVSerializationStream@2@@Z",
        "<^=w=",
        "8C9Y9",
        "0'060O0e0",
        "?SetLiteralStorage@_@UnBCL@@YGXPAPBVString@2@PBG@Z",
        "?GetDirectoryRoot@Directory@UnBCL@@SGPAVString@2@PBV32@@Z",
        "??4StreamWriter@UnBCL@@QAEAAV01@ABV01@@Z",
        "657@7N7u7",
        "wcsncmp",
        "void __thiscall UnBCL::Thread::Join(void)",
        "?TICKS_PER_S@DateTime@UnBCL@@1_JB",
        ":8:s:",
        "??0ScopedObjectLock@UnBCL@@QAE@PAVSyncObject@1@@Z",
        "?get_AutoDelete@?$ArrayList@G@UnBCL@@UBEHXZ",
        ":,:>:P:",
        ".?AV?$SmartPtr@VVersion@UnBCL@@@UnBCL@@",
        "3+393A3F3Z3s3",
        "4i4p5",
        ".?AV?$ArrayListEnumerator@PAVXmlAttribute@XmlLite@UnBCL@@@_@UnBCL@@",
        "??0TextWriter@UnBCL@@QAE@ABV01@@Z",
        ":%:8:G:O:r:",
        "?GetTypeName@?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
        "??_7?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@6BObject@2@@",
        "??B?$SmartPtr@VObject@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
        "?Close@BufferedStream@UnBCL@@UAEXXZ",
        "+class UnBCL::String *__stdcall UnBCL::Directory::GetDirectoryRoot(const class UnBCL::String *)",
        "overflow: parsed value too large",
        "??4XmlException@UnBCL@@QAEAAV01@ABV01@@Z",
        ":;;N;];s;",
        "?get_OuterXml@XmlNode@UnBCL@@QAEPAVString@2@XZ",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAPAVString@1@@Z",
        "9&:;:M:",
        "position params out of range to ArrayList::Copy",
        "__thiscall UnBCL::ArrayList<class UnBCL::Object *>::ArrayList(int,int)",
        "?4?8?P?T?l?p?",
        "<(<H<P<\\<|<",
        "383J3Y3s3",
        "??1NotSupportedException@UnBCL@@UAE@XZ",
        "?Equals@?$Array@H@UnBCL@@UBEHPBVObject@2@@Z",
        ".?AU?$IEnumerator@PAVTypeFactoryList@SerializationStream@UnBCL@@@UnBCL@@",
        "__int64 __thiscall UnBCL::DateTime::ToFileTimeUtc(void) const",
        "LocalFileTimeToFileTime",
        "??_7?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@6BISerializable@1@@",
        ".?AV?$SmartPtr@U?$IDictionaryEnumerator@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBGPAUIAtlStringMgr@1@@Z",
        "VWWWW",
        ";];{;",
        "const unsigned short &__thiscall UnBCL::String::get_Chars(int) const",
        ":(:,:D:T:X:\\:`:d:h:p:",
        "??4?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "?DeleteSubKeyTree@RegistryKey@UnBCL@@QAEXPBVString@2@@Z",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationId *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,&protected: static class UnBCL::SerializationId * __stdcall UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,class ATL::CElementTraits<class UnBCL::SerializationStream::TypeFactoryList *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "8(888<8T8d8h8l8",
        "\\\\?\\UNC",
        "??1Delegate@UnBCL@@UAE@XZ",
        "GetFileAttributesExW",
        "4\"444B4t4",
        "?IsPathRooted@Path@UnBCL@@SGHPBVString@2@@Z",
        ".?AVVersion@UnBCL@@",
        "?ThrowLastError@Win32Exception@UnBCL@@SGXPBGPBDH@Z",
        "negative offset or count",
        ".?AU?$IList@VStringPtr@UnBCL@@@UnBCL@@",
        "??4Stream@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "int __thiscall UnBCL::String::GetOccurenceIndexOf(unsigned short,int) const",
        "1<1N1`1s1",
        "??4?$IEnumerator@PBG@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "1#1c1",
        "?RemoveChild@XmlNode@UnBCL@@QAEXPAV12@@Z",
        ".?AVExternalException@UnBCL@@",
        "111019184142Z",
        "__int64 __thiscall UnBCL::FileStream::get_Length(void) const",
        "?,?<?X?`?h?t?",
        "=B=W=\\=a=",
        "?IsDriveLetterOrUncPrefix@Path@UnBCL@@SGHPBG@Z",
        "??_7MemoryStream@UnBCL@@6BObject@1@@",
        "?DecRef@Object@UnBCL@@QAEHXZ",
        "4@4x4",
        ".rdata",
        "8/8A8c8",
        "?Append@?$CSimpleStringT@G$0A@@ATL@@QAEXPBGH@Z",
        "??0RegHandle@UnBCL@@QAE@ABV01@@Z",
        ">H>W>n>",
        "0i0{0",
        "1\"101m1",
        ")null path to File::Delete",
        "void __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *>::RemoveAt(int)",
        "?GetEnumerator@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEPAU?$IEnumerator@PAVObject@UnBCL@@@2@XZ",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,class ATL::CElementTraits<class UnBCL::String *> > const *,struct __POSITION * const &)>::Reset(void)",
        "<-<C<k<",
        ";C;`;j;q;",
        "?m_SystemInfo@Environment@UnBCL@@0PAVSystemInfo@2@A",
        "Flush() on closed FileStream",
        "??4NotSupportedException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "0/1C1`1|1",
        "2R2a2r2",
        "M[)'SP",
        "Zero length root",
        "t:Wj ",
        "?&?4?",
        "? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\\?`?d?h?l?p?t?x?|?",
        "Program execution will be stopped",
        "8(8H8P8\\8|8",
        "6'6L6p6",
        ":.:@:S:w:",
        "505<5\\5d5p5",
        "?StreamWrite@?$SerializableArrayBase@G@_@UnBCL@@UBEXAAVSerializationStream@3@@Z",
        "?Insert@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHHPBG@Z",
        "0&1M1v1",
        ">N?]?",
        "??_7MultiSz@UnBCL@@6B?$IEnumerable@PBG@1@@",
        "class UnBCL::DirectoryInfo *__stdcall UnBCL::Directory::CreateDir(const class UnBCL::String *)",
        ".?AVStreamWriter@UnBCL@@",
        "8&8+8",
        "5'5c5",
        "append mode with access not write-only",
        "t?Sj$",
        "?IndexOf@?$ArrayList@G@UnBCL@@UBEHG@Z",
        "int __stdcall UnBCL::Array<unsigned short>::IndexOf(const class UnBCL::Array<unsigned short> *,unsigned short,int,int)",
        "??4XmlNode@UnBCL@@QAEAAV01@ABV01@@Z",
        "sAVj ",
        "??B?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV?$CSimpleStringT@G$00@1@XZ",
        "??B?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
        "3$3,383X3`3h3x3",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,class ATL::CElementTraits<class UnBCL::String *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "?FindOneOf@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBG@Z",
        "4)4C4i4",
        "?get_FirmwareType@SystemInfo@UnBCL@@QBE?AW4_FIRMWARE_TYPE@@XZ",
        "161i1",
        ">$>(>,>D>H>`>p>t>",
        "??_D?$Array@G@UnBCL@@QAEXXZ",
        "??0?$IEnumerable@G@UnBCL@@QAE@ABU01@@Z",
        "stream closed before read completed",
        "656U6j6{6",
        "?GetValue@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEPAVObject@2@H@Z",
        "null srcpath or destpath to File::Copy",
        "?Equals@SerializationId@UnBCL@@UBEHPBVObject@2@@Z",
        "?InnerList@?$Array@G@UnBCL@@MBEPAV?$ArrayList@G@2@XZ",
        "9I9f9",
        "??_DUnicodeEncoding@UnBCL@@QAEXXZ",
        "base\\ntsetup\\unbcl\\src\\process.cpp",
        "848<8H8h8p8|8",
        "??0?$IList@E@UnBCL@@QAE@XZ",
        "?EnterSection@SyncObject@UnBCL@@IAEXXZ",
        "int __stdcall UnBCL::String::CountChars(const unsigned short *)",
        "6 6$6<6L6P6T6l6|6",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAV12@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@2@PAV12@UKeyTraits@42@$1?RetrieveKey@42@KGPAV12@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@PAVString@3@UKeyTraits@23@V?$CElementTraits@PAVString@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "__thiscall UnBCL::ArrayList<unsigned char>::ArrayList(int,int)",
        "GetEnvironmentVariableW",
        "<*<8<U<`<n<|<",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,&protected: static class UnBCL::SerializationStream::TypeFactoryList * __stdcall UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,class ATL::CElementTraits<class UnBCL::SerializationStream::TypeFactoryList *> > const *,struct __POSITION * const &)>::Reset(void)",
        "30V0q0",
        "??_8?$ArrayList@G@UnBCL@@7B?$SerializableArrayListPrimitiveBase@G@_@1@@",
        "??_DWaitHandle@UnBCL@@QAEXXZ",
        "negative numchars to UnicodeEncoding::GetMaxByteCount",
        "??0?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        "const class UnBCL::TimeSpan *__stdcall UnBCL::Try_Cast<const classUnBCL::TimeSpan*,const class UnBCL::Object>(const class UnBCL::Object *)",
        "<'<x<",
        "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6B?$ICollection@PAVString@UnBCL@@@1@@",
        "?GetShortName@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        "ShellExecuteExW",
        "int __stdcall UnBCL::Environment::IsEnvironmentVarSetTrue(const class UnBCL::String *,int)",
        "??_DASCIIEncoding@UnBCL@@QAEXXZ",
        "??0?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        "?get_ChildNodes@XmlNode@XmlLite@UnBCL@@QAEPAVXmlNodeList@23@XZ",
        "??_7?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
        "?GetDecoder@ASCIIEncoding@UnBCL@@UBEPAVDecoder@2@XZ",
        ";/;N;s;",
        "??4UnicodeEncoding@UnBCL@@QAEAAV01@ABV01@@Z",
        "GetSystemDefaultLangID",
        "8=8B8",
        "7'727@7s7}7",
        "8 8V8h8v8",
        "LocalAlloc",
        ">*?9?I?c?",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAJ@Z",
        "OLEAUT32.dll",
        "null dictionary to Hashtable constructor",
        "?CopyChars@?$CSimpleStringT@G$0A@@ATL@@SAXPAGIPBGH@Z",
        "wcscoll",
        ".?AVASCIIDecoder@ASCIIEncoding@UnBCL@@",
        "int __thiscall UnBCL::FileStream::Read(unsigned char *,int,int)",
        "??1StreamCounter@UnBCL@@QAE@XZ",
        "?Equals@Object@UnBCL@@UBEHPBV12@@Z",
        "?Trim@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ",
        ".?AV?$ArrayListEnumerator@G@_@UnBCL@@",
        "< <$<(<,<0<4<8<<<P<T<d<h<l<",
        "<StD<Xt!3",
        "??6SerializationStream@UnBCL@@QAEAAV01@N@Z",
        ".?AU?$IEnumerable@PBG@UnBCL@@",
        "void __stdcall UnBCL::Monitor::PulseAll(class UnBCL::SyncObject *)",
        ".?AU?$IList@G@UnBCL@@",
        "?InitLarva@?$Array@E@UnBCL@@MAEXPAV?$ArrayList@E@2@@Z",
        "DeviceIoControl",
        ".?AV?$HTDictEnumBase@PAVSerializationId@UnBCL@@@_@UnBCL@@",
        ")null src or dest list to ArrayList<T>::Copy",
        ">(?:?S?",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::operator >>(class UnBCL::String *&)",
        "??1OutOfMemoryException@UnBCL@@UAE@XZ",
        ":>;E;d;",
        "?Clone@MultiSz@UnBCL@@UBEPAVObject@2@XZ",
        "class UnBCL::String *__stdcall UnBCL::Path::WithoutLongPrefix(const class UnBCL::String *,int &)",
        "int __thiscall UnBCL::_::ArrayListEnumerator<unsigned char>::MoveNext(void)",
        "t@Vj$",
        ">$>D>g>",
        "?SetLength@?$CSimpleStringT@G$0A@@ATL@@AAEXH@Z",
        "?ToFileTime@DateTime@UnBCL@@QBE_JXZ",
        "0%0C0U0g0",
        "unable to read on FileStream",
        "?get_TotalMilliseconds@TimeSpan@UnBCL@@QBENXZ",
        "<temp>",
        ".?AV?$SmartPtr@VDirectoryInfo@UnBCL@@@UnBCL@@",
        "RootDir",
        "?LoadXml@XmlDocument@XmlLite@UnBCL@@QAEXPAVString@3@@Z",
        "?IsDirectorySeparator@Path@UnBCL@@SGHG@Z",
        "?Intern@String@UnBCL@@SGPBV12@PBV12@@Z",
        "5?5i5",
        "?get_Length@MemoryStream@UnBCL@@UBE_JXZ",
        "??1Version@UnBCL@@UAE@XZ",
        "??0?$IEnumerable@PAVString@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
        "??0?$IList@H@UnBCL@@QAE@ABU01@@Z",
        "??4ISerializable@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "?3?`?r?",
        "> >(>4>T>`>",
        "??_8?$Array@H@UnBCL@@7BISerializable@1@@",
        "??AStringPtr@UnBCL@@UBEGH@Z",
        "void __thiscall UnBCL::BufferedStream::Write(const unsigned char *,int,int)",
        "??0Object@UnBCL@@QAE@ABV01@@Z",
        "?DAYS_PER_100@DateTime@UnBCL@@0HB",
        ".gfids",
        "struct IXMLDOMDocument3 *__stdcall UnBCL::MSXmlModule::CreateDOMDocument(void)",
        "??4MutableString@UnBCL@@QAEAAV01@ABV01@@Z",
        ".rsrc$02",
        "memcpy_s",
        "GetTempFileNameW",
        "=/=4=f=x=",
        "?set_AutoDelete@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXH@Z",
        "?Delete@File@UnBCL@@SGXPBVString@2@@Z",
        "?FromMultiSz@MultiSz@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBG@Z",
        "707@7P7T7d7h7x7",
        "??0String@UnBCL@@QAE@GH@Z",
        "void __thiscall UnBCL::Array<class UnBCL::SmartPtr<class UnBCL::String> >::Remove(class UnBCL::SmartPtr<class UnBCL::String>)",
        "0$0,080X0`0h0p0|0",
        "?Close@StreamReader@UnBCL@@UAEXXZ",
        "?set_Position@MemoryStream@UnBCL@@UAEX_J@Z",
        "<.=Q=`=q=",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::Object *>::MoveNext(void)",
        ".PAVSecurityException@UnBCL@@",
        "_amsg_exit",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::String *>::MoveNext(void)",
        ".?AU?$IEnumerable@PAVString@UnBCL@@@UnBCL@@",
        "?FormatV@String@UnBCL@@SGPAV12@PBGPAD@Z",
        "?TICKS_PER_D@DateTime@UnBCL@@1_JB",
        "??0AbandonedMutexException@UnBCL@@QAE@XZ",
        "??1?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAE@XZ",
        "??D?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QBEAAVSerializationId@1@XZ",
        "??_7MultiSz@UnBCL@@6BISerializable@1@@",
        "?SetValue@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXPAVObject@2@H@Z",
        "Microsoft",
        "<A<h<",
        ";,;;;\\;n;};",
        "ExpandEnvironmentStrings failed",
        "?GetOSVersion@Environment@UnBCL@@SGPBVOperatingSystem@2@H@Z",
        "??0FormatException@UnBCL@@QAE@XZ",
        "?Steal@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAEPAV?$Array@E@2@XZ",
        "UnhandledExceptionFilter",
        "?Replace@String@UnBCL@@QBEPAV12@GG@Z",
        "__dllonexit",
        "?LastIndexOf@String@UnBCL@@QBEHGHH@Z",
        "1(1e1p1~1",
        ".PAVArgumentException@UnBCL@@",
        "?GetCurrentUser@Registry@UnBCL@@SGPAVRegistryKey@2@XZ",
        "?GetFileName@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        ".?AV?$Hashtable@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@",
        "??1MultiSz@UnBCL@@UAE@XZ",
        "??BStringPtr@UnBCL@@QAE?AV?$SmartPtr@VString@UnBCL@@@1@XZ",
        "??0RegistryKey@UnBCL@@QAE@PAUHKEY__@@H@Z",
        "??0?$IEnumerable@H@UnBCL@@QAE@ABU01@@Z",
        "6'7J7",
        "??_7FileSystemEnumerator@UnBCL@@6BObject@1@@",
        "??_7Decoder@UnBCL@@6BObject@1@@",
        "ix, count, or byteix out of range to UnicodeEncoding#GetBytes",
        "%I64i",
        "class UnBCL::StringBuilder *__thiscall UnBCL::StringBuilder::Append(const class UnBCL::String *,int,int)",
        "?Remove@?$Array@G@UnBCL@@UAEXG@Z",
        "Thales TSS ESN:F7A6-E251-150A1%0#",
        ".giats",
        ")null array to Array::IndexOf",
        "class UnBCL::StringPtr __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::StringPtr>::get_Current(void) const",
        "3#3`3",
        "7 8=8N8a8",
        "969C9j9",
        "?SetValue@RegistryKey@UnBCL@@QAEXPBVString@2@H@Z",
        "222=2K2Y2g2",
        "void __stdcall UnBCL::Array<unsigned char>::Sort(class UnBCL::Array<unsigned char> *)",
        ";J;|;",
        "void __thiscall UnBCL::MutableString::Insert(int,const unsigned short *,int)",
        "??4Encoding@UnBCL@@QAEAAV01@$$QAV01@@Z",
        ".?AUEmptyType@MP@UnBCL@@",
        ">\">;>M>_>s>",
        "??_7?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
        "?get_IsReadOnly@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
        "??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        "??4?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "?RemoveAt@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXH@Z",
        "=4=<=D=L=T=\\=d=l=t=|=",
        "?Clear@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXXZ",
        ";*<U<",
        "?get_TotalMinutes@TimeSpan@UnBCL@@QBENXZ",
        "?IndexOf@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEHPAVObject@2@@Z",
        "?GetMaxValue@DateTime@UnBCL@@SG?AV12@XZ",
        "class UnBCL::TimeSpan __thiscall UnBCL::TimeSpan::Add(const class UnBCL::TimeSpan &) const",
        "FindNextFileW",
        ".?AV?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@",
        "<(<,<D<T<X<h<l<|<",
        "20201009051253Z0w0=",
        "class UnBCL::String *__stdcall UnBCL::Path::WithLongPrefixStd(const class UnBCL::String *,int)",
        "?get_ParentNode@XmlNode@XmlLite@UnBCL@@QBEPAV123@XZ",
        "??4CaseInsensitiveStringComparer@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "?get_Count@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
        "??_7?$SerializableArrayBase@G@_@UnBCL@@6BObject@2@@",
        "?FreezeHash@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAEXXZ",
        "??1TextWriter@UnBCL@@UAE@XZ",
        "Manufacturer",
        "?SelectNodes@XmlNode@UnBCL@@QAEPAVXmlNodeList@2@PAVString@2@@Z",
        "??0?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@ABV01@@Z",
        "8%878E8c8u8",
        "?Init@RegSubkeyEnumerator@UnBCL@@AAEXXZ",
        ".?AVMutableString@UnBCL@@",
        "??_7?$Array@PAVObject@UnBCL@@@UnBCL@@6B?$IList@PAVObject@UnBCL@@@1@@",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::String *>::Reset(void)",
        "??0?$IEnumerable@E@UnBCL@@QAE@ABU01@@Z",
        ".?AVWin32Exception@UnBCL@@",
        "??4OverflowException@UnBCL@@QAEAAV01@ABV01@@Z",
        "?HashFunction@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@IBEHPAVString@2@@Z",
        "?SelectNodes@XmlNode@XmlLite@UnBCL@@QAEPAVXmlNodeList@23@PAVString@3@@Z",
        "negative start index to CopyTo",
        "4(4,404H4X4\\4l4p4",
        ">/?Y?",
        "??0ConsoleLogHandler@UnBCL@@QAE@XZ",
        "9 :Z:}:",
        ";(;H;P;X;`;h;p;x;",
        "QQSV3",
        "??6SerializationStream@UnBCL@@QAEAAV01@PBVString@1@@Z",
        "s8UY(l:wE",
        "?H?Z?o?",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAK@Z",
        ".?AU?$ICollection@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@UnBCL@@",
        "??0TextReader@UnBCL@@QAE@ABV01@@Z",
        "QSVW3",
        "6!6(6/666=6D6",
        "??1SystemInfo@UnBCL@@UAE@XZ",
        "?Steal@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAEPAVVersion@2@XZ",
        "??_DVersion@UnBCL@@QAEXXZ",
        "5(5,5<5@5X5\\5t5x5",
        "7#7A7S7e7",
        "1#1F1P1Z1",
        "??_7?$Array@E@UnBCL@@6B?$IList@E@1@@",
        "??6SerializationStream@UnBCL@@QAEAAV01@PBUISerializable@1@@Z",
        ":-:8:F:T:b:p:~:",
        "?ToArray@MemoryStream@UnBCL@@UBEPAV?$Array@E@2@XZ",
        "unable to close WaitHandle handle",
        "9c9q9",
        "??0SecurityException@UnBCL@@QAE@PAVString@1@PAVException@1@@Z",
        "??_DRegistry@UnBCL@@QAEXXZ",
        ">/?r?",
        "9P9s9",
        "QSVWj",
        "40484@4H4P4\\4|4",
        "__thiscall UnBCL::String::String(const unsigned short *,int,int)",
        "void __thiscall UnBCL::ArrayList<class UnBCL::StringPtr>::Insert(int,class UnBCL::StringPtr)",
        "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6B01@@",
        "unable to retrieve logical drive mask",
        "?(?U?h?",
        "??0?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        "2$2(2@2D2H2L2P2d2t2x2|2",
        "_wcsupr_s",
        "??4SystemException@UnBCL@@QAEAAV01@ABV01@@Z",
        "0 020E0R0j0u0",
        "??_7ApplicationException@UnBCL@@6B@",
        "?CopyTo@?$Array@H@UnBCL@@UBEXPAV12@H@Z",
        "u'j\\Yf9O",
        "void __thiscall UnBCL::MemoryStream::Write(const unsigned char *,int,int)",
        "??_7WaitHandle@UnBCL@@6BIDisposable@1@@",
        "?Assign@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@AAEXABV12@@Z",
        "?GetLocalMachine@Registry@UnBCL@@SGPAVRegistryKey@2@XZ",
        "9/9B9h:w:",
        "int __thiscall UnBCL::RegistryKey::get_ValueCount(void) const",
        ";(;,;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;",
        "?get_Attributes@XmlNode@XmlLite@UnBCL@@QAEPAVXmlAttributeCollection@23@XZ",
        "??1ASCIIEncoding@UnBCL@@UAE@XZ",
        "737s7",
        "8C8s8",
        "?BinarySearch@?$ArrayList@PAVString@UnBCL@@@UnBCL@@AAEHHHPAVString@2@PAU?$IComparer@PAVString@UnBCL@@@2@@Z",
        "?Retrieve@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHPAVString@2@AAPAV32@@Z",
        "909<9H9T9`9l9",
        "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6B?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@",
        "towupper",
        "KERNEL32.dll",
        "??0?$IList@PAVObject@UnBCL@@@UnBCL@@QAE@XZ",
        "??0DateTime@UnBCL@@QAE@HHHHHHH@Z",
        "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6BObject@1@@",
        "?Append@StringBuilder@UnBCL@@QAEPAV12@H@Z",
        "?GetMinValue@DateTime@UnBCL@@SG?AV12@XZ",
        "=U>i>{>",
        "<$<@<v<",
        ":):y:",
        "?AppendFormatV@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEXPBGPAD@Z",
        "int __thiscall UnBCL::_::ArrayListEnumerator<int>::get_Current(void) const",
        "?MoveEx@File@UnBCL@@SGXPBVString@2@0K@Z",
        "5$5r5",
        "?Remove@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXPAVObject@2@@Z",
        "??B?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
        "858`8",
        "CopyFileExW",
        "class UnBCL::String *__thiscall UnBCL::Encoding::GetString(const class UnBCL::Array<unsigned char> *) const",
        "7<7N7`7s7",
        "base\\ntsetup\\unbcl\\src\\regsubkeyenum.cpp",
        "??_8MemoryStream@UnBCL@@7BIDisposable@1@@",
        "4$4+42494@4G4",
        "??0SystemException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
        "9#:5:G:U:v:",
        "?LogW@ConsoleLogHandler@UnBCL@@UAE?AW4tagLOGRESULT@@KPBDKPBG1K@Z",
        "8$8(888<8L8\\8`8p8t8x8",
        "??4XPathException@UnBCL@@QAEAAV01@ABV01@@Z",
        ";3;t;",
        "??4FileStream@UnBCL@@QAEAAV01@ABV01@@Z",
        "CreateDirectoryW",
        ".?AVDecoder@UnBCL@@",
        "041F1c1}1",
        "<(<8<<<@<D<H<L<P<T<X<\\<`<d<h<l<p<t<x<|<",
        "?get_Length@StringBuilder@UnBCL@@QBEHXZ",
        "unable to set FileStream position",
        ";3;Q;k;v;",
        "< <@<L<l<t<",
        "?get_PreviousSibling@XmlNode@XmlLite@UnBCL@@QBEPAV123@XZ",
        "?GetBuffer@?$Array@PAVString@UnBCL@@@UnBCL@@UAEPAPAVString@2@H@Z",
        "?BinarySearch@?$ArrayList@G@UnBCL@@AAEHHHGPAU?$IComparer@G@2@@Z",
        "??4XmlAttribute@XmlLite@UnBCL@@QAEAAV012@ABV012@@Z",
        "index out of range to ArrayList#get_Item",
        "0B0m0",
        "??0MutableString@UnBCL@@QAE@$$QAV01@@Z",
        "(no exception message provided)",
        "??C?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QBEPAVSerializationStream@1@XZ",
        "?get_Buffer@MultiSz@UnBCL@@QBEPBGXZ",
        "1K1w1",
        "invalid mode to FileStream constructor",
        "?GetEnvironmentVariableW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHPBG@Z",
        ".?AVSerializationException@UnBCL@@",
        "??4XmlNode@XmlLite@UnBCL@@QAEAAV012@ABV012@@Z",
        "848V8h8w8",
        "=@=d=",
        ".?AVEncoding@UnBCL@@",
        "?SetValue@?$Array@H@UnBCL@@UAEXHH@Z",
        "__int64 __thiscall UnBCL::MemoryStream::Seek(__int64,enum UnBCL::SeekOrigin)",
        "?Steal@?$SmartPtr@VObject@UnBCL@@@UnBCL@@QAEPAVObject@2@XZ",
        "??1ObjectDisposedException@UnBCL@@UAE@XZ",
        "??4ObjectDisposedException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "?Contains@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHQAVObject@2@@Z",
        "?Insert@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXHPAVString@2@@Z",
        "?get_Item@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEAAPAVString@2@H@Z",
        "??1ArithmeticException@UnBCL@@UAE@XZ",
        "5%5C5a5s5",
        "m_Pos + amt overflowed in MemoryStream#Read",
        "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@PBD@Z",
        "??1?$ICollection@H@UnBCL@@UAE@XZ",
        ".PAVPathTooLongException@UnBCL@@",
        "5,5W5",
        ":]:p:",
        "void __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *>::Resize(int,int)",
        "const class UnBCL::StringPtr *__thiscall UnBCL::ArrayList<class UnBCL::StringPtr>::GetBuffer(int) const",
        "??1MutableString@UnBCL@@UAE@XZ",
        "?GetBuffer@StringBuilder@UnBCL@@QAEPAGH@Z",
        "?GetTypeName@?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
        ":*;q;",
        "??0StreamReader@UnBCL@@QAE@ABV01@@Z",
        "0B1K1k1",
        "startIndex or count out of range to IndexOfAny()",
        "void __thiscall UnBCL::ArrayList<unsigned char>::set_Item(int,unsigned char)",
        "??0?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@QAE@ABV012@@Z",
        "5$5I5[5m5",
        "2'2Q2s2",
        "??0ArgumentOutOfRangeException@UnBCL@@QAE@PBG@Z",
        "?SpanExcluding@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@PBG@Z",
        "unable to query key info",
        "?F?c?|?",
        "?get_Length@?$Array@H@UnBCL@@UBEHXZ",
        "2G2Y2k2",
        "??0?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
        "?InitLarva@?$Array@H@UnBCL@@MAEXPAV?$ArrayList@H@2@@Z",
        "??_7?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@6BObject@2@@",
        "3J3t3",
        "base\\ntsetup\\unbcl\\src\\environment.cpp",
        "??_7RegHandle@UnBCL@@6B@",
        "?Peek@StreamReader@UnBCL@@UAEHXZ",
        "?set_Capacity@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXH@Z",
        "9?9c9u9",
        "null FileName to Process::Start",
        "??0NotSupportedException@UnBCL@@QAE@PBG@Z",
        "API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
        "??4DateTime@UnBCL@@QAEAAV01@ABV01@@Z",
        "?s_Registration@?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
        "?Write@FileStream@UnBCL@@UAEXPBEHH@Z",
        "303@3D3T3X3h3l3p3",
        "class UnBCL::ArrayList<unsigned short> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<unsigned short>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "??4?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@QAEAAV01@ABV01@@Z",
        "?DAYS_PER_1@DateTime@UnBCL@@0HB",
        "??_7XmlSchemaSet@UnBCL@@6B@",
        "??1?$SerializableArrayBase@H@_@UnBCL@@UAE@XZ",
        ":<:N:]:",
        "null bytes to UnicodeEncoding::GetString",
        "4I4Q4]4e4z4",
        "4 4$4(4,4044484L4P4T4l4|4",
        "?LastIndexOf@?$Array@G@UnBCL@@SGHPBV12@GHH@Z",
        "?Replace@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHGG@Z",
        "__thiscall UnBCL::StreamReader::StreamReader(class UnBCL::Stream *,class UnBCL::Encoding *)",
        "??4?$ICollection@G@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "??_7?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
        "??_7?$Stack@PAVObject@UnBCL@@@UnBCL@@6B?$ICollection@PAVObject@UnBCL@@@1@@",
        "?Pop@?$Stack@PAVObject@UnBCL@@@UnBCL@@UAEPAVObject@2@XZ",
        "?GetEnumerator@XmlNamespaceManager@UnBCL@@QBEPAU?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@2@XZ",
        "??_7?$SerializableArrayBase@H@_@UnBCL@@6B@",
        "?DAYS_PER_4@DateTime@UnBCL@@0HB",
        "919C9R9s9",
        "?CompareNoCase@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBG@Z",
        "LockResource",
        "?Concat@String@UnBCL@@SGPAV12@PBG0@Z",
        "??7?$SmartPtr@VStream@UnBCL@@@UnBCL@@QBE_NXZ",
        ":#;@;Y;",
        "RemoveDirectoryW",
        "6%6W6v6",
        "class UnBCL::XmlNodeList *__thiscall UnBCL::XmlNode::SelectNodes(class UnBCL::String *)",
        "9O9U9[9a9h9",
        "?N?z?",
        ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:`:x:|:",
        "??0?$CSimpleStringT@G$0A@@ATL@@QAE@ABV01@@Z",
        ".?AU?$IEnumerator@V?$DictionaryEntry@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@@UnBCL@@",
        "2#2(2<2J2R2W2k2y2",
        "??_7DateTime@UnBCL@@6B@",
        "null chars to String::CountChars",
        "7\"70787=7Q7_7g7l7",
        "??_7NotSupportedException@UnBCL@@6B@",
        "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4",
        "9 9$94989P9T9\\9t9x9",
        "8 8@8L8l8t8",
        "??0?$SerializableArrayBase@E@_@UnBCL@@QAE@XZ",
        "??4?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
        "GetLinePosition",
        "?IndexOf@?$Array@G@UnBCL@@UBEHG@Z",
        "?get_IsFixedSize@?$ArrayList@G@UnBCL@@UBEHXZ",
        ">3?L?s?",
        "?get_P@?$SmartPtr@VStream@UnBCL@@@UnBCL@@QBEPAVStream@2@XZ",
        "_except_handler4_common",
        ";D$ r)",
        "??0Registry@UnBCL@@QAE@$$QAV01@@Z",
        ">\">;>Q>l>v>",
        "int __stdcall UnBCL::Array<int>::LastIndexOf(const class UnBCL::Array<int> *,int,int,int)",
        "VVVVVVQVVV",
        "??4Logging@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??_7StreamReader@UnBCL@@6BIDisposable@1@@",
        "0Shhl",
        "?get_Item@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAVString@2@PAV32@@Z",
        "??0?$Array@PAVString@UnBCL@@@UnBCL@@QAE@PBU?$ICollection@PAVString@UnBCL@@@1@@Z",
        "?InnerList@?$Array@H@UnBCL@@MBEPAV?$ArrayList@H@2@XZ",
        "attempt to delete subkey tree of key opened read-only",
        "1!1S1e1x1",
        "9#:?:c:",
        "? ?(?0?@?d?l?t?|?",
        "null name to Environment::GetEnvironmentVar",
        "1#1r1",
        ";;;_;",
        "??4?$SerializableArrayBase@G@_@UnBCL@@QAEAAV012@$$QAV012@@Z",
        ".?AVMutex@UnBCL@@",
        "778I8[8i8",
        "?RegisterStaticTypes@SbRegistrationList@UnBCL@@SGXH@Z",
        "?Insert@MutableString@UnBCL@@QAEXHPBGH@Z",
        "FlushFileBuffers",
        ":,:>:",
        "?IsEnvironmentVarSetTrue@Environment@UnBCL@@SGHPBVString@2@H@Z",
        "null name to SerializationStream::RegisterType",
        "??4?$Array@G@UnBCL@@QAEAAV01@ABV01@@Z",
        "909C9",
        ".PAVNotSupportedException@UnBCL@@",
        "??0ArgumentException@UnBCL@@QAE@PBVString@1@@Z",
        "&&1J+d",
        "ix or count out of range to ASCIIEncoding::GetCharCount",
        "?get_CString@String@UnBCL@@QBEPBGXZ",
        "?LastIndexOf@String@UnBCL@@QBEHPBG@Z",
        "??0Exception@UnBCL@@QAE@PAV01@PBG@Z",
        "??4ASCIIEncoding@UnBCL@@QAEAAV01@ABV01@@Z",
        "<==O=a=s=",
        "??0XmlException@UnBCL@@QAE@$$QAV01@@Z",
        "?get_Manufacturer@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
        ".?AVXmlSchemaSet@UnBCL@@",
        "null list to ArrayList::IndexOf",
        "WVVVV",
        "?get_Count@?$ArrayList@G@UnBCL@@UBEHXZ",
        "??_7?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@6B?$IEnumerable@PAVObject@UnBCL@@@1@@",
        "?Split@String@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@2@PBGH@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::StringPtr>::RemoveAt(int)",
        "?get_InnerException@Exception@UnBCL@@UBEPBV12@XZ",
        "848Y8e8~8",
        "??0SerializationException@UnBCL@@QAE@ABV01@@Z",
        "??4?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "??4?$ICollection@E@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "?Append@StringBuilder@UnBCL@@QAEPAV12@G@Z",
        "?get_Values@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAU?$ICollection@PAVString@UnBCL@@@2@XZ",
        "??0String@UnBCL@@QAE@ABV01@@Z",
        "??0ArithmeticException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
        "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7B?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@1@@",
        "void __thiscall UnBCL::XmlNode::RegisterNamespaces(class UnBCL::XmlNamespaceManager *)",
        "class UnBCL::StringBuilder *__thiscall UnBCL::StringBuilder::Append(const unsigned short *,int,int)",
        "4,404@4P4`4d4h4p4",
        "1#111?1",
        "??0ISerializable@UnBCL@@QAE@XZ",
        "class UnBCL::SmartPtr<class UnBCL::String> __thiscall UnBCL::String::_Insert(int,class UnBCL::SmartPtr<class UnBCL::String>) const",
        "5#5H5m5",
        "??_8Version@UnBCL@@7B01@@",
        "1s1|1",
        "??4XmlDocument@UnBCL@@QAEAAV01@ABV01@@Z",
        "PSWVh",
        "1*1<1N1c1",
        "int __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *>::IndexOf(class UnBCL::XmlLite::XmlNode *,int,int) const",
        "?IndexOf@?$ArrayList@G@UnBCL@@UBEHGHH@Z",
        "index out of range to String#get_Chars()",
        "7 8I8N8",
        "??_7?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
        "?LastIndexOf@?$ArrayList@G@UnBCL@@SGHPBV12@GHH@Z",
        "?StreamRead@String@UnBCL@@QAEXAAVSerializationStream@2@@Z",
        ".CRT$XLA",
        "??4InvalidOperationException@UnBCL@@QAEAAV01@ABV01@@Z",
        "??_7TextWriter@UnBCL@@6B@",
        "struct IXMLDOMSchemaCollection2 *__stdcall UnBCL::MSXmlModule::CreateDOMSchemaCollection(void)",
        "??4?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@QAEAAV012@ABV012@@Z",
        "??_7StringBuilder@UnBCL@@6B@",
        "8[8n8}8",
        "set_Position() on closed BufferedStream",
        "?Steal@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAEPAVDecoder@2@XZ",
        "848C8c8t8",
        "?s_InternPool@String@UnBCL@@1PAV?$Hashtable@PAVString@UnBCL@@PAV12@@2@A",
        "?Contains@MultiSz@UnBCL@@QBEHPBGH@Z",
        "?Sort@?$Array@G@UnBCL@@SGXPAV12@@Z",
        "1?1Q1`1",
        "?GetHashCode@DateTime@UnBCL@@UBEHXZ",
        ".?AVOutOfMemoryException@UnBCL@@",
        "0\"0C0",
        "?set_AutoDelete@?$ArrayList@G@UnBCL@@UAEXH@Z",
        "malloc",
        "?_ToUpper@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@XZ",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAE@Z",
        "?\"?0?>?L?Z?h?",
        "int __stdcall UnBCL::Path::IsShortCompliant(const class UnBCL::String *,int)",
        ">'>\\>n>",
        "1%1c1",
        "class UnBCL::String *__stdcall UnBCL::Path::WithLongPrefixUNC(const class UnBCL::String *,int)",
        "?_Concat@String@UnBCL@@SG?AV?$SmartPtr@VString@UnBCL@@@2@V32@000@Z",
        "??4ProcessStartInfo@UnBCL@@QAEAAV01@ABV01@@Z",
        "7-8`8",
        "Write() on closed MemoryStream",
        "?_TrimStart@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@V32@@Z",
        "?PrepareWrite@?$CSimpleStringT@G$0A@@ATL@@AAEPAGH@Z",
        "3 3C3`3",
        "?get_Item@?$Stack@PAVObject@UnBCL@@@UnBCL@@UAEAAPAVObject@2@H@Z",
        "1+2=2Z2H3T3l3w3",
        "??_DRegSubkeyEnumerator@UnBCL@@QAEXXZ",
        "6 7F7X7g7",
        "?<?`?",
        "GetSystemDirectoryW failed",
        ".?AV?$Array@VStringPtr@UnBCL@@@UnBCL@@",
        ":&:1:O:",
        "get_Length() on closed BufferedStream",
        "??_7ArgumentOutOfRangeException@UnBCL@@6B@",
        "GetPhysicallyInstalledSystemMemory",
        "t>Sj ",
        "base\\ntsetup\\unbcl\\src\\reghandle.cpp",
        ".?AU?$IList@PAVXmlAttribute@XmlLite@UnBCL@@@UnBCL@@",
        "1$1D1L1X1x1",
        "? ?$?(?,?0?4?H?L?\\?`?t?x?",
        "y@Sj$",
        "4C5f5",
        "??7?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBE_NXZ",
        "Read() on closed FileStream",
        "wcsstr",
        "?get_Second@DateTime@UnBCL@@QBEHXZ",
        "8/9`9r9",
        ";/;6;=;D;K;R;",
        "ms out of range to DateTime constructor",
        "null path to Path::GetFullPath",
        ".?AVArgumentException@UnBCL@@",
        "?StreamWrite@?$SerializableStackBase@H@_@UnBCL@@UBEXAAVSerializationStream@3@@Z",
        "??4?$SmartPtr@VObject@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "??0?$Array@PAVString@UnBCL@@@UnBCL@@IAE@XZ",
        "?DeleteNE@Directory@UnBCL@@SGHPBVString@2@H@Z",
        "class UnBCL::XmlNode *__thiscall UnBCL::XmlNode::InsertBefore(class UnBCL::XmlNode *,class UnBCL::XmlNode *)",
        "null keyname to RegistryKey#DeleteSubKeyTree",
        "?DAYS_TO_10K@DateTime@UnBCL@@0HB",
        ">4>;>b>n>",
        "?get_Value@XmlNode@XmlLite@UnBCL@@QBEPAVString@3@XZ",
        "??4DirectoryInfo@UnBCL@@QAEAAV01@ABV01@@Z",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "??_7ObjectDisposedException@UnBCL@@6B@",
        "?get_InnerText@XmlNode@UnBCL@@QAEPAVString@2@XZ",
        "??4?$Array@PAVString@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "??4FormatException@UnBCL@@QAEAAV01@ABV01@@Z",
        "3,4K4z4",
        "thWh@R",
        "?GetThisThread@Thread@UnBCL@@SGPAV12@XZ",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::StringPtr>::MoveNext(void)",
        "?Dispose@MemoryStream@UnBCL@@UAEXXZ",
        "?Assign@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@AAEXABV12@@Z",
        "TWMN4R",
        "??_8RegSubkeyEnumerator@UnBCL@@7B@",
        ".?AV?$SmartPtr@U?$IEnumerator@E@UnBCL@@@UnBCL@@",
        "HeapFree",
        "??_7StreamReader@UnBCL@@6B@",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::XmlLite::XmlNode *>::Reset(void)",
        "?Copy@Directory@UnBCL@@SGXPBVString@2@0HPAUICopyDelegate@12@@Z",
        "ix or count out of range in ASCIIEncoding#GetBytes",
        "t5Vj$",
        "?RegisterVersion@?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
        "5D6c6",
        "int __thiscall UnBCL::ASCIIEncoding::GetMaxByteCount(int) const",
        "?GetVersionId@?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
        "empty srcpath or destpath to File::MoveEx",
        "?Add@StreamCounter@UnBCL@@QAEX_J@Z",
        "??0StreamWriter@UnBCL@@QAE@ABV01@@Z",
        "class UnBCL::Array<class UnBCL::String *> *__stdcall UnBCL::MultiSz::FromMultiSz(const unsigned short *)",
        "void __thiscall UnBCL::_::ArrayListEnumerator<unsigned short>::Reset(void)",
        "?Substring@String@UnBCL@@QBEPAV12@HH@Z",
        "?RegisterVersion@?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *>::set_Item(int,class UnBCL::XmlLite::XmlAttribute *)",
        "?*?N?",
        "s2Wj$",
        "??_DProcess@UnBCL@@QAEXXZ",
        "?(?H?P?\\?|?",
        "??1XmlAttribute@XmlLite@UnBCL@@UAE@XZ",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive<unsigned int>(unsigned int &)",
        ";6;g;",
        "?%?,?3?_?j?x?",
        ".?AU?$IEnumerator@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@UnBCL@@",
        "Compare failed -- bad comparison routines?",
        "?GetEnumerator@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEPAU?$IEnumerator@PAVString@UnBCL@@@2@XZ",
        "2 2$2<2L2P2T2l2p2t2x2|2",
        "3X4g4",
        ":?;Q;c;q;",
        "?GetArchitectureString@OperatingSystem@UnBCL@@SGPBGK@Z",
        "??4SecurityException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??_7?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@6BISerializable@2@@",
        "??4Win32Exception@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "class UnBCL::DictionaryEntry<struct UnBCL::SerializationStream::UniqueObject,int> __thiscall UnBCL::_::HTEnumerator<struct UnBCL::SerializationStream::UniqueObject,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,class UnBCL::DictionaryEntry<struct UnBCL::SerializationStream::UniqueObject,int>,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<struct UnBCL::SerializationStream::UniqueObject,int> __stdcall UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "?get_FullName@Type@UnBCL@@UBEPBVString@2@XZ",
        "??_7?$ArrayList@G@UnBCL@@6B?$IEnumerable@G@1@@",
        "index out of range to ArrayList#RemoveAt",
        "?GetEnumerator@?$ArrayList@G@UnBCL@@UBEPAU?$IEnumerator@G@2@XZ",
        ".?AU?$IDictionaryEnumerator@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@",
        "<4=G=[=}=",
        "Microsoft Corporation1",
        "??0SEHException@UnBCL@@QAE@ABV01@@Z",
        "=$=,=4=@=`=h=p=|=",
        "wcscspn",
        "?Split@String@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@2@PBG@Z",
        "??_8?$Array@H@UnBCL@@7B?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "ia32/win64",
        "?Nullify@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAEAAV12@XZ",
        "474@4s4",
        "const class UnBCL::String *__stdcall UnBCL::Try_Cast<const classUnBCL::String*,const class UnBCL::Object>(const class UnBCL::Object *)",
        "8,8X8",
        "<M<Z<w<",
        "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@ABV?$CSimpleStringT@G$0A@@1@@Z",
        "??_7TextWriter@UnBCL@@6BIDisposable@1@@",
        "??0FormatException@UnBCL@@QAE@ABV01@@Z",
        "?_LastIndexOf@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@@Z",
        "int __thiscall UnBCL::BufferedStream::Read(unsigned char *,int,int)",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,&protected: static class UnBCL::SerializationStream::TypeFactoryList * __stdcall UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,class ATL::CElementTraits<class UnBCL::SerializationStream::TypeFactoryList *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *> *,class UnBCL::Array<class UnBCL::SerializationStream::TypeFactoryList *> *,int)",
        "?Flush@BufferedStream@UnBCL@@UAEXXZ",
        "int __stdcall UnBCL::ArrayList<class UnBCL::String *>::LastIndexOf(const class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::String *,int,int)",
        "??0OverflowException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
        "5&5.535G5Q5h5p5u5",
        "?_Match@String@UnBCL@@SGHV?$SmartPtr@VString@UnBCL@@@2@0@Z",
        "6,7S7x7",
        "WaitForSingleObject failed in Monitor operation",
        "?get_Item@XmlAttributeCollection@XmlLite@UnBCL@@QAEPAVXmlAttribute@23@PAVString@3@@Z",
        "181D1d1p1",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBD@Z",
        "= =0=4=D=H=L=d=t=x=|=",
        "?Clone@?$Array@E@UnBCL@@UBEPAVObject@2@XZ",
        "??0Version@UnBCL@@QAE@PBG@Z",
        "??4?$SerializableStackBase@H@_@UnBCL@@QAEAAV012@ABV012@@Z",
        "6 6$6(6,6064686<6@6D6H6L6P6X6p6t6x6|6",
        "??0?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
        "??_8?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@7B?$IList@PAVObject@UnBCL@@@1@@",
        "??_DThread@UnBCL@@QAEXXZ",
        "?StringLength@?$CSimpleStringT@G$0A@@ATL@@SAHPBG@Z",
        "SelectionNamespaces",
        ".?AUIInstanceFactory@UnBCL@@",
        "??_7XmlNodeList@XmlLite@UnBCL@@6B@",
        "unable to retrieve subkey count",
        "363M3d3",
        "?Clone@?$Array@PAVString@UnBCL@@@UnBCL@@UBEPAVObject@2@XZ",
        "9/:A:S:a:",
        "?s_Manager@Allocator@UnBCL@@0PAPAUIHeapMemory@@A",
        "?LastIndexOf@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHPAVString@2@HH@Z",
        "f90uAVj ",
        "??_D?$Array@PAVObject@UnBCL@@@UnBCL@@QAEXXZ",
        "?Add@?$Array@H@UnBCL@@UAEHH@Z",
        ">\\>s>z>",
        "1C2\\2",
        "??0XmlException@UnBCL@@QAE@ABV01@@Z",
        "sanity shortfall in comparison operators",
        "int __thiscall UnBCL::String::_IndexOf(class UnBCL::SmartPtr<class UnBCL::String>) const",
        "?Steal@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEPAV?$Array@PAVString@UnBCL@@@2@XZ",
        "??0String@UnBCL@@QAE@PBG@Z",
        "7$747@7H7p7x7",
        ":\";D;",
        "<&=P=",
        "void __stdcall UnBCL::Monitor::Pulse(class UnBCL::SyncObject *)",
        "6+6w6",
        "int __thiscall UnBCL::String::_IndexOfAny(class UnBCL::SmartPtr<class UnBCL::String>,int,int) const",
        "get_Capacity on closed MemoryStream",
        "??1Thread@UnBCL@@UAE@XZ",
        "void __thiscall UnBCL::RegistryKey::DeleteValue(const class UnBCL::String *)",
        "?get_IsAlive@Thread@UnBCL@@QAEHXZ",
        "?get_ProcessorCaption@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
        "??_7?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@6B?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@",
        ";C<`<",
        "??_7BufferedStream@UnBCL@@6BIDisposable@1@@",
        "?LastIndexOf@?$Array@PAVObject@UnBCL@@@UnBCL@@SGHPBV12@PAVObject@2@HH@Z",
        "?get_Month@DateTime@UnBCL@@QBEHXZ",
        "?Right@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@H@Z",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::operator <<(const struct UnBCL::ISerializable *)",
        "??0?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
        "??0DirectoryInfo@UnBCL@@QAE@$$QAV01@@Z",
        "??0ApplicationException@UnBCL@@QAE@ABV01@@Z",
        "??_7?$Array@E@UnBCL@@6B01@@",
        "??4?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
        "int __thiscall UnBCL::Array<class UnBCL::XmlLite::XmlAttribute *>::Add(class UnBCL::XmlLite::XmlAttribute *)",
        "?get_CurrentFileName@FileSystemEnumerator@UnBCL@@UBEPAVString@2@XZ",
        "??0?$Array@G@UnBCL@@IAE@XZ",
        "?RegisterVersion@?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
        "3\"4b4",
        "HeapReAlloc",
        ".?AV?$HTEnumerator@UUniqueObject@SerializationStream@UnBCL@@HUTableKey@?$Hashtable@UUniqueObject@SerializationStream@UnBCL@@H@3@V?$DictionaryEntry@UUniqueObject@SerializationStream@UnBCL@@H@3@UKeyTraits@53@$1?RetrieveEntry@53@KG?AV63@PBV?$CAtlMap@UTableKey@?$Hashtable@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@HUKeyTraits@23@V?$CElementTraits@H@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "void __thiscall UnBCL::XmlNode::RemoveChild(class UnBCL::XmlNode *)",
        "?get_ProcessHandle@Process@UnBCL@@QBEPAXXZ",
        "2&3w3",
        "ix out of range to ArrayList#P",
        "?AllocSysString@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEPAGXZ",
        "?StreamWrite@String@UnBCL@@QBEXAAVSerializationStream@2@@Z",
        "??0?$ICollection@PAVObject@UnBCL@@@UnBCL@@QAE@XZ",
        "??_8?$ArrayList@G@UnBCL@@7B?$IList@G@1@@",
        "?MakeLower@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ",
        ";D;O;",
        "??4XmlAttributeCollection@UnBCL@@QAEAAV01@ABV01@@Z",
        "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7B?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@1@@",
        "startIndex and/or value out of range",
        "??D?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QBEAAVXmlNamespaceManager@1@XZ",
        "808P8X8d8",
        "?get_BiosVersion@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,class ATL::CElementTraits<class UnBCL::String *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "?get_CanWrite@BufferedStream@UnBCL@@UBEHXZ",
        "?Clone@?$Array@H@UnBCL@@UBEPAVObject@2@XZ",
        "GetCurrentThreadId",
        "MoveFileExW",
        "??0?$CSimpleStringT@G$0A@@ATL@@QAE@PBGPAUIAtlStringMgr@1@@Z",
        "iswspace",
        "??_8?$Stack@PAVObject@UnBCL@@@UnBCL@@7B?$ICollection@PAVObject@UnBCL@@@1@@",
        "8#8Z8",
        "void __thiscall UnBCL::ArrayList<class UnBCL::String *>::set_Item(int,class UnBCL::String *)",
        "?WithoutLongPrefix@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B?$IEnumerable@PAVString@UnBCL@@@1@@",
        "void __thiscall UnBCL::Array<unsigned char>::Insert(int,unsigned char)",
        "?BinarySearch@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEHPAVString@2@PAU?$IComparer@PAVString@UnBCL@@@2@@Z",
        ".?AV?$Array@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@UnBCL@@",
        ";%<7<X<h<",
        "?GetHashCode@SerializationId@UnBCL@@UBEHXZ",
        "6(6H6d6h6x6",
        "attempt to create subkey of key opened read-only",
        "= =$=(=,=0=4=8=<=D=H=P=T=X=`=x=|=",
        "??_7StreamReader@UnBCL@@6BObject@1@@",
        ";\";*;/;C;K;V;v;",
        "?_CompareTo@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@H@Z",
        "??0?$ICollection@PAVObject@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
        "int __thiscall UnBCL::String::GetOccurenceLastIndexOf(unsigned short,int) const",
        "1C1Q1b1n1z1",
        "?Contains@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHPAVString@2@@Z",
        "?RegisterVersion@?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
        "??0?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@QAE@XZ",
        ".?AV?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@",
        "?LastIndexOf@?$Array@E@UnBCL@@SGHPBV12@EHH@Z",
        "uBVj$",
        "??_7?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@6B01@@",
        ":4:h:",
        "??4ArgumentOutOfRangeException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??2Object@UnBCL@@SGPAXIPBDH@Z",
        ":,:G:Y:h:y:",
        "long-prefixed path too long on NT/2k+",
        "?RetrieveKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@KGPAVString@2@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@PAVString@3@UKeyTraits@23@V?$CElementTraits@PAVString@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z",
        "?RemoveAt@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXH@Z",
        "SMBIOSBIOSVersion",
        "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B?$IList@PAVString@UnBCL@@@1@@",
        "?Insert@String@UnBCL@@QBEPAV12@HPBG@Z",
        "null path to Directory::GetDirectoryRoot",
        "?IndexOfAny@String@UnBCL@@QBEHPBG@Z",
        "9.959<9d9r9",
        "tnull chars to Encoding#GetByteCount",
        "Yj:Yj\\Z",
        "=&=Q=p=",
        "Microsoft Corporation1.0,",
        "?GetString@?$CSimpleStringT@G$0A@@ATL@@QBEPBGXZ",
        "9<9D9L9T9`9",
        "??5SerializationStream@UnBCL@@QAEAAV01@AA_K@Z",
        ">1>K>d>}>",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::operator >>(const struct UnBCL::ISerializable *&)",
        "unable to create process",
        "tNaN to TimeSpan::Interval",
        ".?AVTextReader@UnBCL@@",
        "??0?$Stack@H@UnBCL@@QAE@XZ",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "?MatchI@String@UnBCL@@SGHPBG0@Z",
        "?Assign@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@AAEXABV12@@Z",
        "bad SeekOrigin to FileStream#Seek",
        "class UnBCL::String *&__thiscall UnBCL::ArrayList<class UnBCL::String *>::get_Item(int)",
        "uPVj$",
        "?WaitForExit@Process@UnBCL@@QAEXXZ",
        "=,=:=H=",
        "??4PathTooLongException@UnBCL@@QAEAAV01@ABV01@@Z",
        "FormatMessageW",
        "kernel32.dll",
        "GetModuleHandleW",
        "0!0(0/060=0D0",
        "?BinarySearch@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGHPAV12@PAVString@2@PAU?$IComparer@PAVString@UnBCL@@@2@@Z",
        "u$Vj ",
        "GetSystemInfo",
        "UnBCL::RegSubkeyEnumerator::MoveNext",
        "??_7?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@6B@",
        "?get_Milliseconds@TimeSpan@UnBCL@@QBEHXZ",
        "?GetDwordValue@RegHandle@UnBCL@@QAEHPBGAAK@Z",
        "??_7?$Array@PAVObject@UnBCL@@@UnBCL@@6BObject@1@@",
        "??0IndexOutOfRangeException@UnBCL@@QAE@$$QAV01@@Z",
        "null collection to ArrayList#AddRange",
        "unbcl.dll",
        "5#5A5{5",
        "?FreeExtra@?$CSimpleStringT@G$0A@@ATL@@QAEXXZ",
        ".?AV?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@",
        "?get_XMLDOMDocument@XmlDocument@UnBCL@@QAEPAUIXMLDOMDocument3@@XZ",
        "??4?$IEnumerable@H@UnBCL@@QAEAAU01@ABU01@@Z",
        "??4?$IList@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
        "alpha64",
        "WakeAllConditionVariable",
        "??_8ASCIIEncoding@UnBCL@@7BEncoding@1@@",
        "??0?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
        "1$1<1@1X1h1l1|1",
        "??0?$IEnumerator@PAVString@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
        "ReleaseMutex",
        "?StreamRead@?$SerializableStackBase@H@_@UnBCL@@UAEXAAVSerializationStream@3@@Z",
        "0&080S0q0x0",
        "??1?$Array@PAVString@UnBCL@@@UnBCL@@UAE@XZ",
        "??4?$ICollection@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "??4OutOfMemoryException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "?get_Item@?$Array@E@UnBCL@@UAEAAEH@Z",
        "< <)<`<r<",
        "_wcsrev",
        ".tls$ZZZ",
        "??_7?$SerializableArrayBase@E@_@UnBCL@@6B@",
        "?set_Item@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXHPAVString@2@@Z",
        "3S3b3p3~3",
        "4Q4c4u4",
        "FileDescription",
        "_XcptFilter",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAM@Z",
        "1@1|1",
        "void __thiscall UnBCL::Array<class UnBCL::XmlLite::XmlAttribute *>::InitLarva(class UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *> *)",
        ";#<2<c<x<",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBGH@Z",
        "int __stdcall UnBCL::MP::OperatorCompare<unsigned short>::Compare(unsigned short,unsigned short)",
        "?KeyDestroy@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@IBEXPAVString@2@@Z",
        "FileStream Seek() failed",
        "2$2(2@2D2\\2l2p2",
        "??0TimeSpan@UnBCL@@QAE@ABV01@@Z",
        "??_7Object@UnBCL@@6B@",
        "class UnBCL::SerializationStream::TypeFactoryList *__thiscall UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::get_Item(class UnBCL::SerializationId *) const",
        "7&757R7e7t7",
        ".?AV?$SmartPtr@UISerializable@UnBCL@@@UnBCL@@",
        "??0?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
        "class UnBCL::Object *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::Object *>::get_Current(void) const",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "040F0U0",
        "?Peek@?$Stack@H@UnBCL@@UAEAAHXZ",
        "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@PBD@Z",
        "?Flush@FileStream@UnBCL@@UAEXXZ",
        "?s_RegistrationListHead@SbRegistrationList@UnBCL@@0U_SINGLE_LIST_ENTRY@@A",
        "=3=~=",
        ">2>]>",
        "6U7}7",
        "=+=R=d=s=",
        "??1?$Array@G@UnBCL@@UAE@XZ",
        ">9?M?\\?",
        "?Load@XmlDocument@UnBCL@@QAEXPAUIStream@@@Z",
        "616S6~6",
        "?s_Manager_Init@Allocator@UnBCL@@0HA",
        ";%;3;A;",
        "7Z7l7",
        "null str to String::IndexOfAny",
        "null list to ArrayList::BinarySearch",
        "??_D?$ArrayList@G@UnBCL@@QAEXXZ",
        "?Load@XmlDocument@UnBCL@@QAEXPAVString@2@@Z",
        "<><H<",
        "?DEFAULT_ERROR@Exception@UnBCL@@0PBGB",
        "GlobalMemoryStatusEx",
        ".didat$6",
        "?Pulse@Monitor@UnBCL@@SGXPAVSyncObject@2@@Z",
        "??0?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAE@PAVSerializationId@1@@Z",
        "??0InvalidOperationException@UnBCL@@QAE@PBVString@1@@Z",
        "9D9V9s9",
        "5(565Z5y5",
        "2,2>2M2o2",
        "?Close@SerializationStream@UnBCL@@QAEXXZ",
        "?ReadObjectHeader@SerializationStream@UnBCL@@AAEHAAPAVObject@2@@Z",
        "?StreamRead@MultiSz@UnBCL@@UAEXAAVSerializationStream@2@@Z",
        "?ThrowMemoryException@?$CSimpleStringT@G$0A@@ATL@@KAXXZ",
        "??0?$CSimpleStringT@G$0A@@ATL@@QAE@PAUIAtlStringMgr@1@@Z",
        "??_7OperatingSystem@UnBCL@@6BISerializable@1@@",
        "=/>>>",
        "?Equals@?$ArrayList@G@UnBCL@@UBEHPBVObject@2@@Z",
        "?Write@MemoryStream@UnBCL@@UAEXPBEHH@Z",
        "?2?A?~?",
        "=/>:>H>",
        "5,545<5D5L5X5x5",
        "??_7?$SmartPtr@VObject@UnBCL@@@UnBCL@@6B@",
        "??0?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        "4'4C4^4",
        "?get_Item@?$Array@G@UnBCL@@UBEABGH@Z",
        "?FormatV@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEXPBGPAD@Z",
        "??0OperatingSystem@UnBCL@@QAE@W4PlatformID@1@KW4InstallationType@1@PAVVersion@1@@Z",
        ".?AVFileStream@UnBCL@@",
        "E0C1)0'",
        ":#;b;t;",
        "2#2G2",
        "wcsncpy_s",
        "PSWVh8L",
        "=$=0=S=",
        "R!s4Z",
        "??4?$IEnumerator@PAVString@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
        "9/9J9k9y9",
        "3&3+3?3M3U3Z3n3w3",
        "void __stdcall UnBCL::Array<int>::Sort(class UnBCL::Array<int> *)",
        "?get_FirstChild@XmlNode@XmlLite@UnBCL@@QBEPAV123@XZ",
        "2&2c2",
        "null bytes to UnicodeEncoding#GetBytes",
        "??0TimeSpan@UnBCL@@QAE@HHHH@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *>::CopyTo(class UnBCL::Array<class UnBCL::XmlLite::XmlNode *> *,int) const",
        "int __stdcall UnBCL::Array<unsigned short>::BinarySearch(const class UnBCL::Array<unsigned short> *,unsigned short,struct UnBCL::IComparer<unsigned short> *)",
        "operator [] on null StringPtr",
        "3+393A3F3Z3h3p3u3",
        "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@PBE@Z",
        "??0SerializationException@UnBCL@@QAE@XZ",
        ".?AV?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "6,606H6L6d6h6|6",
        "7 8T8",
        "?SelectSingleNode@XmlNode@UnBCL@@QAEPAV12@PAVString@2@@Z",
        "2,2a2",
        "??4?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
        "?InitInternPool@String@UnBCL@@KGXXZ",
        "RegEnumKeyExW",
        "??B?$CSimpleStringT@G$0A@@ATL@@QBEPBGXZ",
        "?Copy@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGXPBV12@PAV12@H@Z",
        "5(505H5P5`5|5",
        "?Contains@?$Array@E@UnBCL@@UBEHE@Z",
        "??0Decoder@UnBCL@@QAE@$$QAV01@@Z",
        "Out of memory while allocating XmlAttribute",
        "?TrimRight@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ",
        "?(?G?",
        "?GetBuffer@?$CSimpleStringT@G$0A@@ATL@@QAEPAGXZ",
        ".?AVHeapMemoryManager@UnBCL@@",
        "int __thiscall UnBCL::Array<unsigned short>::Add(unsigned short)",
        "GetCurrentDirectoryW failed",
        "7[7}7",
        "?Close@FileStream@UnBCL@@UAEXXZ",
        "?Assign@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@AAEXPAVSerializationStream@2@@Z",
        "?BinarySearch@?$ArrayList@G@UnBCL@@SGHPAV12@GPAU?$IComparer@G@2@@Z",
        "??1?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
        "3/4Q4c4~4",
        "??4ArgumentException@UnBCL@@QAEAAV01@ABV01@@Z",
        "??0XmlNamespaceManager@UnBCL@@QAE@ABV01@@Z",
        "2'2I2s2",
        "1*191Z1l1{1",
        "__thiscall UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> >::ArrayList(const struct UnBCL::ICollection<class UnBCL::SmartPtr<class UnBCL::String> > *)",
        "??_7?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@6B@",
        "(070W0",
        "??0Delegate@UnBCL@@QAE@XZ",
        "?get_Count@XmlNodeList@XmlLite@UnBCL@@QBEHXZ",
        "index out of range to ArrayList#set_Item",
        "iswprint",
        "??_8MultiSz@UnBCL@@7B@",
        "??1ScopedObjectLock@UnBCL@@QAE@XZ",
        "?%?1?",
        "??_7Decoder@UnBCL@@6B01@@",
        "?get_InnerList@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@MBEPBV?$ArrayList@PAVObject@UnBCL@@@2@XZ",
        "2<2O2^2",
        "?GetVersionId@?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
        "??0ArgumentNullException@UnBCL@@QAE@$$QAV01@@Z",
        "1/0-0",
        "null bytes to UnicodeEncoding::GetCharCount",
        "null version to OperatingSystem constructor",
        "??D?$SmartPtr@VObject@UnBCL@@@UnBCL@@QBEAAVObject@1@XZ",
        "?Assign@?$SmartPtr@VObject@UnBCL@@@UnBCL@@AAEXPAVObject@2@@Z",
        "5G5`5g5n5",
        "Peek() on closed StreamReader",
        "??4XmlException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??0FormatException@UnBCL@@QAE@$$QAV01@@Z",
        "??0XmlNodeList@XmlLite@UnBCL@@QAE@XZ",
        "?get_Item@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEABQAVObject@2@H@Z",
        "??4?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
        "<(<7<D<H<L<P<T<X<\\<`<d<h<l<p<",
        ".?AVbad_alloc@std@@",
        "?get_P@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QBEPAVXmlNamespaceManager@2@XZ",
        "??4XPathException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        ";I;n;",
        "??4IDisposable@UnBCL@@QAEAAU01@ABU01@@Z",
        "??4?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "int __stdcall UnBCL::Array<class UnBCL::String *>::LastIndexOf(const class UnBCL::Array<class UnBCL::String *> *,class UnBCL::String *,int,int)",
        "_onexit",
        "?Empty@?$CSimpleStringT@G$0A@@ATL@@QAEXXZ",
        "5H6U6",
        "2:2Z2",
        ".?AV?$ArrayListEnumerator@VStringPtr@UnBCL@@@_@UnBCL@@",
        "??1Registry@UnBCL@@UAE@XZ",
        ";%<^<",
        "?s_Registration@?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
        "??0IInstanceFactory@UnBCL@@QAE@XZ",
        "=C=u=",
        ".?AV?$HTDictEnumBase@V?$DictionaryEntry@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@@_@UnBCL@@",
        "??0MultiSz@UnBCL@@QAE@XZ",
        "?get_TotalMemory@SystemInfo@UnBCL@@QBE_KXZ",
        "??4ExternalException@UnBCL@@QAEAAV01@ABV01@@Z",
        "5,5=5T5[5",
        "?get_InnerText@XmlNode@XmlLite@UnBCL@@QBEPAVString@3@XZ",
        "?GetTypeName@?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
        "index or count out of range to UnicodeEncoding#GetByteCount",
        "9.9b9",
        "?GetRawBuffer@MemoryStream@UnBCL@@UAEPAEXZ",
        "??0SerializationException@UnBCL@@QAE@PBVString@1@@Z",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAI@Z",
        "9#9/969;9A9M9Z9h9t9{9",
        "??0ExternalException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
        "6#7C7g7",
        "??0SystemException@UnBCL@@QAE@ABV01@@Z",
        "?,?8?X?d?",
        "171O1b1",
        "??4?$SerializableArrayBase@H@_@UnBCL@@QAEAAV012@$$QAV012@@Z",
        ".?AVSystemException@UnBCL@@",
        "$`2X`F",
        "?ToLower@Char@UnBCL@@SG?AV12@V12@@Z",
        "0$0,040<0D0L0T0\\0d0l0t0|0",
        "M0K0I",
        "949<9D9L9T9\\9d9l9t9|9",
        "8(8,8D8T8X8`8d8h8l8p8t8x8|8",
        "??1type_info@@UAE@XZ",
        "5\"5^5",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::operator >>(struct UnBCL::ISerializable *&)",
        "?get_Rank@?$Array@E@UnBCL@@UBEHXZ",
        "??1?$SerializableArrayBase@G@_@UnBCL@@UAE@XZ",
        "8 808@8D8T8X8h8x8|8",
        "?MoveNext@FileSystemEnumerator@UnBCL@@UAEHXZ",
        "??0ProcessStartInfo@UnBCL@@QAE@$$QAV01@@Z",
        "?get_Position@MemoryStream@UnBCL@@UBE_JXZ",
        "void __thiscall UnBCL::Array<class UnBCL::XmlLite::XmlNode *>::InitLarva(class UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *> *)",
        "array of insufficient size to CopyTo",
        ".edata",
        "uASj ",
        "60646L6P6h6x6|6",
        "GetFileInformationByHandleEx",
        ">@>Q>",
        "??_7SystemInfo@UnBCL@@6B@",
        "__int64 __thiscall UnBCL::BufferedStream::get_Position(void) const",
        "void __thiscall UnBCL::Array<class UnBCL::XmlLite::XmlAttribute *>::RemoveAt(int)",
        "?RegisterNamespaces@XmlNode@UnBCL@@AAEXPAVXmlNamespaceManager@2@@Z",
        "??4?$ICollection@G@UnBCL@@QAEAAU01@ABU01@@Z",
        "040A0G0P0u0",
        ".?AVProcess@UnBCL@@",
        ".00cfg",
        "??0InvalidCastException@UnBCL@@QAE@PBG@Z",
        "?InnerList@?$Stack@H@UnBCL@@MAEAAPAV?$ArrayList@H@2@XZ",
        "2'292G2}2",
        "4K4]4l4",
        "?Peek@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEABQAVObject@2@XZ",
        "??1AbandonedMutexException@UnBCL@@UAE@XZ",
        "??1XmlAttributeCollection@XmlLite@UnBCL@@UAE@XZ",
        "737:7b7",
        "?ValueDestroy@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@IBEXPAVString@2@@Z",
        "?Steal@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAEPAVXmlNamespaceManager@2@XZ",
        "4$4(484H4L4P4h4x4|4",
        ":3:=:J:P:",
        "??_7ArgumentException@UnBCL@@6B@",
        "?RemoveAt@?$ArrayList@G@UnBCL@@UAEXH@Z",
        "686\\6",
        "void __thiscall UnBCL::ArrayList<unsigned short>::AddRange(const struct UnBCL::ICollection<unsigned short> *)",
        "??0FormatException@UnBCL@@QAE@PBG@Z",
        "UnBCL::RegHandle::GetDwordValue",
        "?Append@StringBuilder@UnBCL@@QAEPAV12@PBGHH@Z",
        "??_8?$ArrayList@G@UnBCL@@7B?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "argument(s) out of range to DateTime::DateToTicks",
        "030Q0X0_0",
        "??4IInstanceFactory@UnBCL@@QAEAAU01@ABU01@@Z",
        "??0?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@ABU01@@Z",
        "2(2H2P2X2`2h2p2x2",
        "?Append@StringBuilder@UnBCL@@QAEPAV12@PBG@Z",
        "??_8?$Array@H@UnBCL@@7B?$ICollection@H@1@@",
        "void __thiscall UnBCL::XmlLite::XmlDocument::Parse(struct IStream *)",
        "ix or count out of range to ASCIIEncoding::GetString",
        "??_7Mutex@UnBCL@@6BObject@1@@",
        "int __thiscall UnBCL::ArrayList<int>::IndexOf(int,int,int) const",
        "attempt to delete \"\" subkey of hive",
        "int __thiscall UnBCL::String::_LastIndexOf(class UnBCL::SmartPtr<class UnBCL::String>,int,int) const",
        "??0XmlAttribute@UnBCL@@IAE@XZ",
        "??_DStringPtr@UnBCL@@QAEXXZ",
        "=K=_=q=",
        "?_Substring@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@HH@Z",
        ">C>s>",
        "??1IndexOutOfRangeException@UnBCL@@UAE@XZ",
        "void __thiscall UnBCL::XmlDocument::Load(struct IStream *)",
        "??D?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEAAV?$ArrayList@PAVString@UnBCL@@@1@XZ",
        "??A?$CSimpleStringT@G$0A@@ATL@@QBEGH@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::StringPtr>::set_Item(int,class UnBCL::StringPtr)",
        "??Y?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@G@Z",
        "??_8?$ArrayList@PAVString@UnBCL@@@UnBCL@@7B@",
        "?GetAltDirectorySeparatorChar@Path@UnBCL@@SGGXZ",
        "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B?$ICollection@PAVString@UnBCL@@@1@@",
        ".?AVArithmeticException@UnBCL@@",
        "?GetVolumeSeparatorChar@Path@UnBCL@@SGGXZ",
        "??0SerializationStream@UnBCL@@AAE@ABV01@@Z",
        "1=1X1v1",
        "; ;$;(;,;0;4;8;<;@;D;H;L;`;d;h;",
        "?Assign@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@AAEXPAVEncoding@2@@Z",
        "??0?$IComparer@PAVString@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
        "??7?$SmartPtr@VString@UnBCL@@@UnBCL@@QBE_NXZ",
        "int __thiscall UnBCL::Array<class UnBCL::StringPtr>::Add(class UnBCL::StringPtr)",
        ".?AV?$HTEnumerator@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@UTableKey@?$Hashtable@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@2@V?$DictionaryEntry@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@2@UKeyTraits@62@$1?RetrieveEntry@62@KG?AV72@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@PAVTypeFactoryList@SerializationStream@3@UKeyTraits@23@V?$CElementTraits@PAVTypeFactoryList@SerializationStream@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "??_7BufferedStream@UnBCL@@6BStream@1@@",
        "class UnBCL::Array<class UnBCL::String *> *__thiscall UnBCL::RegistryKey::GetSubKeyNames(void)",
        "5M6R6",
        "737h7",
        "6C6z6",
        "?StreamWrite@?$SerializableArrayBase@E@_@UnBCL@@UBEXAAVSerializationStream@3@@Z",
        ".?AV?$SmartPtr@V?$Array@G@UnBCL@@@UnBCL@@",
        "??0FileStream@UnBCL@@QAE@PBVString@1@W4FileMode@1@W4FileAccess@1@W4FileShare@1@K@Z",
        "??1Object@UnBCL@@UAE@XZ",
        "6$6(6@6D6\\6l6p6t6",
        "5$5(5,5054585<5@5D5X5h5l5p5",
        "??0ISerializable@UnBCL@@QAE@$$QAU01@@Z",
        "?Append@StringBuilder@UnBCL@@QAEPAV12@PBVString@2@@Z",
        "151I1X1}1",
        "??_8Mutex@UnBCL@@7BIDisposable@1@@",
        "0\"0P0a0",
        "??1Char@UnBCL@@UAE@XZ",
        "multisz",
        ".CRT$XIZ",
        "?StreamRead@Version@UnBCL@@UAEXAAVSerializationStream@2@@Z",
        "?get_Item@XmlAttributeCollection@XmlLite@UnBCL@@QAEPAVXmlAttribute@23@H@Z",
        "?SetSize@FileStream@UnBCL@@UAEX_J@Z",
        "??1?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
        "class UnBCL::Array<unsigned char> *__thiscall UnBCL::Encoding::GetBytes(const class UnBCL::String *) const",
        "2 2$2<2@2D2H2L2P2T2\\2`2t2x2",
        "6$6,6`6p6|6",
        "??_7?$SerializableStackBase@H@_@UnBCL@@6B?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@",
        "5$5,585X5d5",
        "?get_LastChild@XmlNode@XmlLite@UnBCL@@QBEPAV123@XZ",
        "?Clone@?$Stack@H@UnBCL@@UBEPAVObject@2@XZ",
        "181_1",
        "9/9A9O9s9",
        "?UnregisterType@SerializationStream@UnBCL@@SGXPBVString@2@HPAUHINSTANCE__@@@Z",
        "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6B?$IDictionary@PAVString@UnBCL@@PAV12@@1@@",
        "3$343D3H3L3d3h3p3",
        "??0?$SmartPtr@VObject@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        "??BChar@UnBCL@@QAEGXZ",
        ".?AV?$ArrayList@E@UnBCL@@",
        "?Clear@?$Stack@PAVObject@UnBCL@@@UnBCL@@UAEXXZ",
        "?GetOOMHandler@Allocator@UnBCL@@SGPAUIOutOfMemoryHandler@@XZ",
        "?FormatMessageW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXPBGZZ",
        "0 0H0W0v0",
        "CreateProcessW",
        "const class UnBCL::DateTime *__stdcall UnBCL::Try_Cast<const classUnBCL::DateTime*,const class UnBCL::Object>(const class UnBCL::Object *)",
        "??0RegistryKey@UnBCL@@QAE@ABV01@@Z",
        "Array doesn't support Remove()",
        ":#:@:c:",
        "Invalid SeekOrigin to MemoryStream#Seek",
        "?get_CSDVersion@Version@UnBCL@@QBEPAVString@2@XZ",
        "5#6G6l6~6",
        "9#9F9",
        "?AppendChild@XmlNode@UnBCL@@QAEPAV12@PAV12@@Z",
        "??0SystemInfo@UnBCL@@QAE@XZ",
        "93:s:",
        "??1Stream@UnBCL@@UAE@XZ",
        "?Mid@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@HH@Z",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "?IsLeapYear@DateTime@UnBCL@@SGHH@Z",
        ".?AVException@UnBCL@@",
        "?GetTypeName@?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@UBEPBVString@2@XZ",
        "80848L8\\8`8d8h8l8p8",
        "?Assign@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@AAEXABV12@@Z",
        "576S6t6",
        "<3<F<M<X<f<",
        "0$0D0L0T0`0",
        "? ?,?L?T?\\?h?",
        "void __thiscall UnBCL::Array<unsigned char>::RemoveAt(int)",
        "8K8{8",
        ";$;(;,;D;T;d;h;",
        "??0IndexOutOfRangeException@UnBCL@@QAE@ABV01@@Z",
        ".?AVObject@UnBCL@@",
        "attempt to load on non-loading archive",
        "??1?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@UAE@XZ",
        "int __stdcall UnBCL::Array<int>::IndexOf(const class UnBCL::Array<int> *,int,int,int)",
        "??0StringBuilder@UnBCL@@QAE@PBVString@1@@Z",
        "??0TextWriter@UnBCL@@QAE@$$QAV01@@Z",
        "__thiscall UnBCL::ArrayList<unsigned short>::ArrayList(int,int)",
        "??1?$IEnumerator@PBG@UnBCL@@UAE@XZ",
        "class UnBCL::String *__stdcall UnBCL::Path::Combine(const class UnBCL::String *,const class UnBCL::String *)",
        "GetNamespaceUri",
        "??1Win32Exception@UnBCL@@UAE@XZ",
        "%s [0x%08X]",
        ":$:,:`:p:|:",
        "?AllocDbg@HeapMemoryManager@UnBCL@@UAEPAXPBDHK@Z",
        "7!7G7Y7h7",
        "?Exists@File@UnBCL@@SGHPBVString@2@@Z",
        "negative count to String#Split()",
        "<$<,<4<<<D<L<T<\\<d<p<",
        "class UnBCL::SerializationId *__thiscall UnBCL::_::HTEnumerator<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationId *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,&protected: static class UnBCL::SerializationId * __stdcall UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,class ATL::CElementTraits<class UnBCL::SerializationStream::TypeFactoryList *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=p=t=",
        "void __thiscall UnBCL::ArrayList<unsigned short>::set_Item(int,unsigned short)",
        "??_8?$ArrayList@G@UnBCL@@7B?$ICollection@G@1@@",
        "?GetEnumerator@?$Array@PAVString@UnBCL@@@UnBCL@@UBEPAU?$IEnumerator@PAVString@UnBCL@@@2@XZ",
        "9(909H9P9h9p9x9",
        "??_7IndexOutOfRangeException@UnBCL@@6B@",
        "9T9o9A:b:f:q:",
        "</<E<k<}<",
        "invalid mode to SerializationStream constructor",
        "SleepConditionVariableSRW",
        "505:5h5t5",
        "??0Exception@UnBCL@@QAE@XZ",
        "?InternalValidate@HeapMemoryManager@UnBCL@@AAEXPAX@Z",
        "?GetValueKind@RegistryKey@UnBCL@@QAE?AW4RegistryValueKind@2@PBVString@2@@Z",
        "6R6^6j6v6",
        "3 3$3<3@3D3H3L3T3X3\\3d3|3",
        "6,6W6",
        "2=3x3",
        "3\"3_3t3",
        "??_7RegistryKey@UnBCL@@6BIDisposable@1@@",
        "2.2S2",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationId *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,&protected: static class UnBCL::SerializationId * __stdcall UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,class ATL::CElementTraits<class UnBCL::SerializationStream::TypeFactoryList *> > const *,struct __POSITION * const &)>::Reset(void)",
        "iswalpha",
        "null chars to ASCIIEncoding#GetBytes",
        ";$;4;8;<;@;H;`;p;",
        "233T3[3b3i3p3w3",
        "??1?$SerializableArrayBase@E@_@UnBCL@@UAE@XZ",
        "?Nullify@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAEAAV12@XZ",
        "null instance to Monitor::PulseAll",
        "?ReleaseBuffer@StringBuilder@UnBCL@@QAEXH@Z",
        ".PAVOverflowException@UnBCL@@",
        "?GetBuffer@?$Array@G@UnBCL@@UBEPBGH@Z",
        "??0SyncObject@UnBCL@@QAE@XZ",
        "?GetEnumerator@?$Array@H@UnBCL@@UBEPAU?$IEnumerator@H@2@XZ",
        "int __stdcall UnBCL::Array<class UnBCL::Object *>::BinarySearch(const class UnBCL::Array<class UnBCL::Object *> *,class UnBCL::Object *,struct UnBCL::IComparer<class UnBCL::Object *> *)",
        "?StartAddress@Thread@UnBCL@@CGKPAX@Z",
        "??0?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAE@XZ",
        "<,<0<H<X<h<l<p<",
        "??0?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAE@PAV?$Array@E@1@@Z",
        "struct UnBCL::ISerializable *__thiscall UnBCL::SerializationStream::ReadObject(void)",
        "?Tokenize@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@PBGAAH@Z",
        "int __stdcall UnBCL::Array<class UnBCL::String *>::BinarySearch(const class UnBCL::Array<class UnBCL::String *> *,class UnBCL::String *,struct UnBCL::IComparer<class UnBCL::String *> *)",
        "wcspbrk",
        "??_7Version@UnBCL@@6B@",
        "??D?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBEAAVVersion@1@XZ",
        "class UnBCL::XmlLite::XmlAttribute *const &__thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *>::get_Item(int) const",
        "?WriteBytes@SerializationStream@UnBCL@@QAEXPBEH@Z",
        "??7?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QBE_NXZ",
        "?_Replace@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@V32@0@Z",
        "?terminate@@YAXXZ",
        "void __thiscall UnBCL::ArrayList<class UnBCL::String *>::QuickSort(class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::ArrayList<class UnBCL::String *> *,int,int)",
        "?get_Source@Exception@UnBCL@@UBEPBVString@2@XZ",
        "98:G:q:",
        "= =P=",
        "?Clone@OperatingSystem@UnBCL@@UBEPAVObject@2@XZ",
        "?set_Item@?$Array@G@UnBCL@@UAEXHG@Z",
        "GetProcAddress",
        "?SpanIncluding@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@PBG@Z",
        "?Compare@String@UnBCL@@SGHPBGPBV12@H@Z",
        "FindClose",
        "?WriteLine@TextWriter@UnBCL@@UAEXXZ",
        "class UnBCL::XmlLite::XmlAttribute *&__thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *>::get_Item(int)",
        "?Free@HeapMemoryManager@UnBCL@@UAEXPAX@Z",
        "class UnBCL::XmlNode *__thiscall UnBCL::XmlNode::AppendChild(class UnBCL::XmlNode *)",
        "??_DBufferedStream@UnBCL@@QAEXXZ",
        "0=0`0",
        "RegQueryInfoKey",
        ".?AVASCIIEncoding@UnBCL@@",
        "??0?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@QAE@XZ",
        "1S1a1",
        "void __thiscall UnBCL::ArrayList<unsigned char>::Insert(int,unsigned char)",
        "void __thiscall UnBCL::ArrayList<class UnBCL::Object *>::set_Item(int,class UnBCL::Object *)",
        "2(2C2a2h2o2v2}2",
        "949D9P9p9x9",
        "8\"8F8j8|8",
        "?LockBuffer@?$CSimpleStringT@G$0A@@ATL@@QAEPAGXZ",
        "??0DirectoryInfo@UnBCL@@QAE@ABV01@@Z",
        "?Alloc@HeapMemoryManager@UnBCL@@UAEPAXK@Z",
        "?GetVersionId@?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
        "?CreateNode@XmlDocument@UnBCL@@QAEPAVXmlNode@2@W4XmlNodeType@2@PAVString@2@1@Z",
        "0X0h0",
        "%ws.%03d",
        "alpha",
        "CreateMutexW",
        "??_7RegSubkeyEnumerator@UnBCL@@6B?$IEnumerator@PBG@1@@",
        "int __stdcall UnBCL::ASCIIEncoding::SGetCharCount(const class UnBCL::Array<unsigned char> *,int,int)",
        "<.<Q<c<u<",
        "wcsspn",
        "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6BISerializable@1@@",
        "void __thiscall UnBCL::BufferedStream::set_Position(__int64)",
        "__thiscall UnBCL::StreamWriter::StreamWriter(class UnBCL::Stream *,int)",
        "?Clear@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEXXZ",
        "8M%iB(C",
        "'XD}*",
        "?Format@MutableString@UnBCL@@QAAAAV12@PBGZZ",
        "int __thiscall UnBCL::ASCIIEncoding::GetBytes(const class UnBCL::String *,int,int,class UnBCL::Array<unsigned char> *,int) const",
        "6#7~7",
        "??0ProcessStartInfo@UnBCL@@QAE@PBVString@1@0@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> >::AddRange(const struct UnBCL::ICollection<class UnBCL::SmartPtr<class UnBCL::String> > *)",
        "717S7v7",
        "??1ISerializable@UnBCL@@UAE@XZ",
        "Seek() on closed FileStream",
        "attempt to StreamRead on non-larval string",
        "t#j\\+",
        "?_Trim@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@V32@@Z",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2p2t2x2|2",
        "Read() on closed StreamReader",
        "8#9?9c9",
        "??0Encoding@UnBCL@@IAE@H@Z",
        "??0Char@UnBCL@@QAE@G@Z",
        " Windows",
        "unsigned short __thiscall UnBCL::StringBuilder::get_Chars(int) const",
        "class UnBCL::String *__thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,class ATL::CElementTraits<class UnBCL::String *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "empty srcpath or destpath to File::Move",
        ")attempt to StreamRead on non-larval Array instance",
        ">$>(>@>D>\\>l>p>t>x>|>",
        "void __thiscall UnBCL::Array<class UnBCL::Object *>::Remove(class UnBCL::Object *)",
        "8'8F8s8",
        "??_8Version@UnBCL@@7BISerializable@1@@",
        "null ModuleName to Directory::GetLoadedModuleDir",
        "7N7s7",
        "result of double->TimeSpan conversion too large",
        "??0XmlNamespaceManager@UnBCL@@QAE@XZ",
        "5-6D6K6q6}6",
        "??0OperatingSystem@UnBCL@@QAE@W4PlatformID@1@PAVVersion@1@@Z",
        "RegDeleteValueW",
        "int __stdcall UnBCL::Int32Ops::Parse(const unsigned short *)",
        "??1?$SmartPtr@VObject@UnBCL@@@UnBCL@@UAE@XZ",
        "MoveNext() called on invalidated enumerator",
        "?get_P@?$SmartPtr@VObject@UnBCL@@@UnBCL@@QBEPAVObject@2@XZ",
        "?DeAssign@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@AAEXXZ",
        "?DAYS_TO_MONTH_365@DateTime@UnBCL@@0QBHB",
        "?CreateTemporaryDirectory@Directory@UnBCL@@SGPAVString@2@XZ",
        ";t04u",
        "364Q4",
        "?Equals@TimeSpan@UnBCL@@UBEHPBVObject@2@@Z",
        "?GetByteCount@UnicodeEncoding@UnBCL@@UBEHPBVString@2@HH@Z",
        "=5>A>M>",
        "class UnBCL::RegistryKey *__thiscall UnBCL::RegistryKey::OpenSubKey(const class UnBCL::String *,int)",
        "??_7MemoryStream@UnBCL@@6BStream@1@@",
        "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@G@Z",
        "??4?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "void __stdcall UnBCL::Path::CheckPathTooLong(const class UnBCL::String *)",
        "??0XmlSchemaSet@UnBCL@@QAE@ABV01@@Z",
        "2#3P3b3t3",
        ".?AV?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@",
        "??0XmlNodeList@UnBCL@@QAE@PAUIXMLDOMNodeList@@@Z",
        ":H;Z;x;",
        "?DeAssign@?$SmartPtr@VString@UnBCL@@@UnBCL@@AAEXXZ",
        "?set_AutoDelete@?$Array@H@UnBCL@@UAEXH@Z",
        "?GetBuffer@?$Array@G@UnBCL@@UAEPAGH@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *>::Resize(int,int)",
        "2<2D2L2X2|2",
        "?get_XMLDOMNode@XmlNode@UnBCL@@QAEPAUIXMLDOMNode@@XZ",
        "?TrimEnd@String@UnBCL@@QBEPAV12@PBG@Z",
        "attempt to delete value of key opened read-only",
        "??0?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@PBU?$IDictionary@PAVString@UnBCL@@PAV12@@1@@Z",
        "Sleep",
        "??0WaitHandle@UnBCL@@IAE@XZ",
        "??0Version@UnBCL@@QAE@HHHPAVString@1@@Z",
        "RegEnumValueW",
        "?Clone@?$ArrayList@G@UnBCL@@UBEPAVObject@2@XZ",
        "??0?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *>::AddRange(const struct UnBCL::ICollection<class UnBCL::XmlLite::XmlNode *> *)",
        "void __thiscall UnBCL::Array<class UnBCL::Object *>::Insert(int,class UnBCL::Object *)",
        "?Add@DateTime@UnBCL@@QBE?AV12@ABVTimeSpan@2@@Z",
        ")null key to Hashtable#Add()",
        "0$1@1`1",
        "class UnBCL::XmlLite::XmlNode *const *__thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *>::GetBuffer(int) const",
        "3+4S4",
        "040<0D0L0T0\\0d0l0|0",
        "??_7?$Array@G@UnBCL@@6B?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "??0OverflowException@UnBCL@@QAE@PBG@Z",
        "?get_Count@XmlAttributeCollection@UnBCL@@QAEHXZ",
        "void __stdcall UnBCL::Array<class UnBCL::String *>::Sort(class UnBCL::Array<class UnBCL::String *> *)",
        "5+5=5O5]5",
        "?Remove@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEXPAVObject@2@@Z",
        "??_7?$Array@E@UnBCL@@6BObject@1@@",
        "int __thiscall UnBCL::Array<class UnBCL::String *>::Add(class UnBCL::String *)",
        "=+=N=y=",
        "attempt to create a FileStream on a non-disk file",
        "??1?$Array@H@UnBCL@@UAE@XZ",
        "??0?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
        "@.didat",
        ".CRT$XIA",
        "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6BISerializable@1@@",
        "7B7T7b7",
        ".?AU?$ICollection@V?$DictionaryEntry@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@@UnBCL@@",
        "?GetValue@?$Array@E@UnBCL@@UBEEH@Z",
        "DtCSV",
        "?,?>?M?c?",
        ".?AU?$IEnumerator@PAVSerializationId@UnBCL@@@UnBCL@@",
        "??0XmlAttribute@XmlLite@UnBCL@@QAE@$$QAV012@@Z",
        "void __thiscall UnBCL::ArrayList<unsigned char>::Resize(int,int)",
        "9)9C9Z9p9",
        "FindFirstFileW",
        "272E2S2a2o2",
        "4 4(4-4A4O4W4\\4p4~4",
        "__int64 __thiscall UnBCL::BufferedStream::get_Length(void) const",
        "??0Encoding@UnBCL@@QAE@$$QAV01@@Z",
        "??_7?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
        "9,9E9g9",
        ">8>Q>j>",
        ".text$di",
        "?GetASCII@Encoding@UnBCL@@SGPAV12@XZ",
        "GetFileTime",
        ".?AVStringBuilder@UnBCL@@",
        "&apos;",
        "5$54585H5L5\\5`5d5|5",
        "?GetVersionId@?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@UBEHXZ",
        "??_7Stream@UnBCL@@6BObject@1@@",
        "??4Int32Ops@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "??4ArgumentNullException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::SmartPtr<class UnBCL::String> >::Reset(void)",
        "3 333W3",
        "?TICKS_PER_M@DateTime@UnBCL@@1_JB",
        "??4?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "?IndexOf@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHPAVString@2@@Z",
        "?Peek@?$Stack@H@UnBCL@@UBEABHXZ",
        "?ToFileTimeUtc@DateTime@UnBCL@@QBE_JXZ",
        "?ThawHash@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAEXXZ",
        ".?AV?$HTDictEnumBase@PAVTypeFactoryList@SerializationStream@UnBCL@@@_@UnBCL@@",
        "?Nullify@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEAAV12@XZ",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,class ATL::CElementTraits<class UnBCL::String *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *> *,class UnBCL::Array<class UnBCL::String *> *,int)",
        "void __thiscall UnBCL::Array<class UnBCL::XmlLite::XmlNode *>::RemoveAt(int)",
        "??0?$IEnumerable@PAVObject@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
        "?get_IsStoring@SerializationStream@UnBCL@@QBEHXZ",
        "??0ExternalException@UnBCL@@QAE@PBG@Z",
        "?Sort@?$Array@PAVString@UnBCL@@@UnBCL@@SGXPAV12@@Z",
        "??4ThreadStateException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "9\"909",
        "??0OperatingSystem@UnBCL@@QAE@W4PlatformID@1@KPAVVersion@1@@Z",
        ">4>;>B>I>P>W>",
        "const class UnBCL::Version *__stdcall UnBCL::Try_Cast<const classUnBCL::Version*,const class UnBCL::Object>(const class UnBCL::Object *)",
        "?GetVersionId@?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
        "int __stdcall UnBCL::UnicodeEncoding::SGetCharCount(const class UnBCL::Array<unsigned char> *,int,int)",
        "?Sanitize@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        "??_7?$Stack@PAVObject@UnBCL@@@UnBCL@@6B?$IEnumerable@PAVObject@UnBCL@@@1@@",
        "_callnewh",
        "newCapacity and sizeof(WCHAR) product overflowed in multisz#Add",
        "??4?$IEnumerator@PAVString@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "?GetFileNameWithoutExtension@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        "void __stdcall UnBCL::File::MoveEx(const class UnBCL::String *,const class UnBCL::String *,unsigned long)",
        "??1?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
        "?AppendFormat@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXIZZ",
        "?Validate@Allocator@UnBCL@@SGXI@Z",
        "Unmanaged BCL",
        " 0@0l0",
        ">b>t>",
        "7<7{7",
        "??_7?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
        "505V5|5",
        "?ToArray@?$ArrayList@G@UnBCL@@UBEPAV?$Array@G@2@XZ",
        "unable to flush FileStream",
        ">#?5?G?",
        ".?AVString@UnBCL@@",
        "??0PathTooLongException@UnBCL@@QAE@XZ",
        "?Assign@?$SmartPtr@VObject@UnBCL@@@UnBCL@@AAEXABV12@@Z",
        "??0?$IList@PAVString@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
        ".?AV?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@",
        "system call returned unrecognized OS version",
        "??0SystemException@UnBCL@@QAE@XZ",
        "<H<W<n<",
        "5!5X5h5",
        "iOccurenceCount must be non-negative",
        "?get_UseShellExecute@ProcessStartInfo@UnBCL@@QBEHXZ",
        "??0?$ICollection@E@UnBCL@@QAE@XZ",
        "??_7?$SerializableArrayBase@E@_@UnBCL@@6B?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@",
        "?EqualsFunction@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@IBEHPAVString@2@0@Z",
        "?GetLongName@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        "??4?$IEnumerable@H@UnBCL@@QAEAAU01@$$QAU01@@Z",
        ".idata$2",
        ">0>i>",
        "GetLocalName",
        "??0?$Array@PAVObject@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        "04080D0p0",
        "??0?$IList@G@UnBCL@@QAE@ABU01@@Z",
        ":%:3:W:",
        "??_7?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@6B@",
        "??4?$IList@G@UnBCL@@QAEAAU01@ABU01@@Z",
        "??_DStreamWriter@UnBCL@@QAEXXZ",
        ".?AV?$SmartPtr@VType@UnBCL@@@UnBCL@@",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::Add(class UnBCL::String *,class UnBCL::String *)",
        "??4MemoryStream@UnBCL@@QAEAAV01@ABV01@@Z",
        "2*282F2T2b2p2",
        ".?AU?$IDictionary@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@",
        "??_DRegHandle@UnBCL@@QAEXXZ",
        ".?AV?$SerializableArrayBase@H@_@UnBCL@@",
        "??0XmlNode@UnBCL@@IAE@PAUIXMLDOMNode@@@Z",
        "??1DirectoryInfo@UnBCL@@UAE@XZ",
        "5C7s7y7",
        "424;4",
        "?GetAt@?$CSimpleStringT@G$0A@@ATL@@QBEGH@Z",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "ProductVersion",
        "?_IndexOfAny@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@HH@Z",
        "void __stdcall UnBCL::Win32Exception::ThrowLastError(const unsigned short *,const char *,int)",
        "??0?$IEnumerator@PBG@UnBCL@@QAE@XZ",
        "=C=\\=",
        "??0Char@UnBCL@@QAE@ABV01@@Z",
        "3T3c3|3",
        "Seek() on closed MemoryStream",
        "t@Vh<R",
        ":7;F;v;",
        "??4?$Stack@H@UnBCL@@QAEAAV01@ABV01@@Z",
        "?Equals@String@UnBCL@@UBEHPBVObject@2@@Z",
        "??0FormatException@UnBCL@@QAE@PAVString@1@PAVException@1@@Z",
        "??0?$SmartPtr@VObject@UnBCL@@@UnBCL@@QAE@XZ",
        "??0XPathException@UnBCL@@QAE@$$QAV01@@Z",
        "?DeAssign@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@AAEXXZ",
        "??1?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
        "<(<4<T<`<",
        "int __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *>::LastIndexOf(class UnBCL::XmlLite::XmlAttribute *,int,int) const",
        "??0SystemException@UnBCL@@QAE@PBG@Z",
        "??1SerializationException@UnBCL@@UAE@XZ",
        "?get_Build@Version@UnBCL@@QBEHXZ",
        "void __stdcall UnBCL::File::DeleteInternal(const class UnBCL::String *)",
        "142\\2p2",
        "O0M0K",
        "??0TimeSpan@UnBCL@@QAE@_J@Z",
        "__thiscall UnBCL::String::String(unsigned short,int)",
        ".?AV?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@",
        ".?AV?$SmartPtr@U?$IEnumerator@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        "??0InvalidOperationException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
        "??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@PAVString@1@@Z",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@GH@Z",
        "?Trim@String@UnBCL@@QBEPAV12@PBG@Z",
        "??0ExternalException@UnBCL@@QAE@PBGPAVException@1@@Z",
        "?DumpDelta@HeapMemoryManager@UnBCL@@UAEIPAUILogHandler@@@Z",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBDHPAUIAtlStringMgr@1@@Z",
        "?GetDatePart@DateTime@UnBCL@@ABEHW4DatePart@12@@Z",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        "void __stdcall UnBCL::ArrayList<class UnBCL::Object *>::Sort(class UnBCL::ArrayList<class UnBCL::Object *> *)",
        "?DeleteInternal@Directory@UnBCL@@CGXPBVString@2@HH@Z",
        "?Push@?$Stack@H@UnBCL@@UAEXH@Z",
        "=C>`>q>",
        "??_7?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
        "Deserialized non ISerializable object: %s",
        "?get_FirstChild@XmlNode@UnBCL@@QAEPAV12@XZ",
        "?SetValue@?$Array@E@UnBCL@@UAEXEH@Z",
        "='>9>S>",
        "?GetFullPath@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        "5 5$545D5H5X5h5x5|5",
        "?ThrowLastError@Win32Exception@UnBCL@@SGXPBVString@2@PBDH@Z",
        "7\"888D8Z8}8",
        "class UnBCL::TimeSpan __stdcall UnBCL::TimeSpan::Interval(double,int)",
        "?GetValue@?$Array@H@UnBCL@@UBEHH@Z",
        "?Assign@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@AAEXABV12@@Z",
        "?GetVersionId@?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
        "??_7?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@6BObject@1@@",
        "int __thiscall UnBCL::ArrayList<class UnBCL::StringPtr>::BinarySearch(int,int,class UnBCL::StringPtr,struct UnBCL::IComparer<class UnBCL::StringPtr> *)",
        "<,<:<H<V<d<",
        "7?8E8N8U8a8g8p8w8",
        "GetSystemDirectoryW",
        ".?AV?$SmartPtr@VRegistryKey@UnBCL@@@UnBCL@@",
        ".rsrc$01",
        "?CopyTo@?$Array@PAVString@UnBCL@@@UnBCL@@UBEXPAV12@H@Z",
        "class UnBCL::Array<unsigned char> *__thiscall UnBCL::MultiSz::ToByteArray(void) const",
        "void __thiscall UnBCL::_::ArrayListEnumerator<int>::Reset(void)",
        "??1?$CSimpleStringT@G$0A@@ATL@@QAE@XZ",
        "??0?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAE@XZ",
        "??0?$IEnumerator@PBG@UnBCL@@QAE@ABU01@@Z",
        "??1?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@UAE@XZ",
        "?SetLength@MemoryStream@UnBCL@@UAEX_J@Z",
        "null stream or encoding to StreamWriter constructor",
        "wait handle abandoned",
        "t!hpB",
        "??4SerializationId@UnBCL@@QAEAAV01@ABV01@@Z",
        "unable to retrieve value name",
        "?ASCII_CODEPAGE@ASCIIEncoding@UnBCL@@0HB",
        "3'353=3B3V3d3l3q3",
        "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B01@@",
        "??0Exception@UnBCL@@QAE@ABV01@@Z",
        "unable to retrieve subkey name",
        "??4StringBuilder@UnBCL@@QAEAAV01@ABV01@@Z",
        ")null instance to Monitor::Pulse",
        ".PAVAbandonedMutexException@UnBCL@@",
        "7h7m7",
        "3$3,343H3P3X3h3t3|3",
        "__thiscall UnBCL::FileSystemEnumerator::FileSystemEnumerator(const unsigned short *,const unsigned short *) throw(...)",
        "7#7G7Y7h7",
        "??0OperatingSystem@UnBCL@@QAE@W4PlatformID@1@W4InstallationType@1@PAVVersion@1@@Z",
        ")xmlns:%s=\"%s\"",
        "2 2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        "u Sh ",
        "??1?$Stack@H@UnBCL@@UAE@XZ",
        "int __thiscall UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::ContainsKey(class UnBCL::SerializationId *) const",
        "__thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::XmlLite::XmlAttribute *> *)",
        "??4SecurityException@UnBCL@@QAEAAV01@ABV01@@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> >::set_Item(int,class UnBCL::SmartPtr<class UnBCL::String>)",
        "?set_AutoDeleteValue@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXH@Z",
        ".PAVSerializationException@UnBCL@@",
        "??4?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "<$<A<",
        "??_8?$Array@G@UnBCL@@7B@",
        "index out of range to ArrayList#Insert",
        "?get_Minute@DateTime@UnBCL@@QBEHXZ",
        "??0InvalidCastException@UnBCL@@QAE@PAVString@1@PAVException@1@@Z",
        "?GetRootLength@Path@UnBCL@@KGHPBVString@2@@Z",
        "?Join@String@UnBCL@@SGPAV12@PBGPAV?$Array@PAVString@UnBCL@@@2@@Z",
        "__thiscall UnBCL::SerializationId::SerializationId(class UnBCL::String *,int)",
        "3 4C4y4",
        "?WriteFormat@TextWriter@UnBCL@@UAAXPBGZZ",
        "tBWj$",
        "? ?8?<?T?X?\\?`?d?h?l?p?t?x?|?",
        "?GetBytes@UnicodeEncoding@UnBCL@@UBEHPBVString@2@HHPAV?$Array@E@2@H@Z",
        "?TrimLeft@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@PBG@Z",
        "void __stdcall UnBCL::ArrayList<class UnBCL::String *>::Sort(class UnBCL::ArrayList<class UnBCL::String *> *)",
        "??_7?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
        "u9Vj ",
        "0!131B1S1k1r1",
        "??1ApplicationException@UnBCL@@UAE@XZ",
        "?set_Source@Exception@UnBCL@@UAEXPBVString@2@@Z",
        "void __stdcall UnBCL::Monitor::Exit(class UnBCL::SyncObject *)",
        "7>8W8",
        "void __thiscall UnBCL::ArrayList<class UnBCL::StringPtr>::Resize(int,int)",
        ":%;2;@;N;\\;j;x;\"<6<H<c<",
        "void __thiscall UnBCL::FileStream::set_Position(__int64)",
        "6(606d6t6",
        "3-3u3~3",
        "??0SerializationException@UnBCL@@QAE@PBG@Z",
        "0<0J0X0f0t0",
        "?.?D?g?y?",
        "??0?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@QAE@XZ",
        "3$3(3@3D3H3\\3`3d3h3l3p3t3x3|3",
        "?GetStringInternal@RegHandle@UnBCL@@AAEHPBGAAPAVString@2@KKK@Z",
        "?get_Date@DateTime@UnBCL@@QBE?AV12@XZ",
        "4-4<4S4",
        "?Clone@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAVObject@2@XZ",
        "5$505P5X5d5",
        "?'?E?W?i?",
        "??_7Mutex@UnBCL@@6BWaitHandle@1@@",
        "??0SecurityException@UnBCL@@QAE@PBG@Z",
        "??0XmlNodeList@UnBCL@@QAE@ABV01@@Z",
        "6<6V6|6",
        "6'6C6",
        "?MIN_SECONDS@TimeSpan@UnBCL@@0_JB",
        "??_8?$Stack@H@UnBCL@@7B?$ICollection@H@1@@",
        "??0?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
        "??4Char@UnBCL@@QAEAAV01@ABV01@@Z",
        "??0?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        "??0ArgumentOutOfRangeException@UnBCL@@QAE@ABV01@@Z",
        "??0XmlDocument@UnBCL@@QAE@ABV01@@Z",
        ".?AV?$SerializableArrayBase@E@_@UnBCL@@",
        "??4?$IList@E@UnBCL@@QAEAAU01@ABU01@@Z",
        "AcquireSRWLockExclusive",
        "??0?$CSimpleStringT@G$0A@@ATL@@QAE@ABV?$CSimpleStringT@G$00@1@@Z",
        "7 7$7(7,70747<7T7d7h7x7|7",
        "??4String@UnBCL@@QAEAAV01@ABV01@@Z",
        "??0StreamReader@UnBCL@@QAE@PAVStream@1@PAVEncoding@1@@Z",
        "argument(s) out of range to DateTime::TimeToTicks",
        "startIndex out of range to Insert()",
        ")null instance to Monitor::Enter",
        "3+393G3",
        "?GetIsEmpty@String@UnBCL@@SGHPBG@Z",
        "cannot Join() to non-started thread",
        "5;6c6l6",
        "3-4c4",
        "get_Length() on closed FileStream",
        "int __thiscall UnBCL::String::_LastIndexOf(class UnBCL::SmartPtr<class UnBCL::String>) const",
        "??4?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "RaiseException",
        ">'???e?w?",
        "??0ArgumentOutOfRangeException@UnBCL@@QAE@PBVString@1@@Z",
        "?Contains@?$ArrayList@G@UnBCL@@UBEHG@Z",
        "??0ProcessStartInfo@UnBCL@@QAE@PBVString@1@@Z",
        "position set before beginning of MemoryStream",
        "??_8?$ArrayList@PAVString@UnBCL@@@UnBCL@@7B?$SerializableArrayListBase@PAVString@UnBCL@@@_@1@@",
        "?get_Item@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEAAPAVObject@2@H@Z",
        "?get_DefaultLangID@SystemInfo@UnBCL@@QBEGXZ",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "<C<R<e<z<",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAUEmptyType@MP@1@@Z",
        "??1?$IList@H@UnBCL@@UAE@XZ",
        "class UnBCL::TimeSpan __thiscall UnBCL::TimeSpan::Subtract(const class UnBCL::TimeSpan &) const",
        "HeapFree failure",
        "8-8P8",
        "5 6T6",
        "9_lt3",
        "??4ScopedObjectLock@UnBCL@@QAEAAV01@ABV01@@Z",
        ".PAVInvalidCastException@UnBCL@@",
        "null chars to UnicodeEncoding::GetString",
        ".?AU?$IEnumerable@G@UnBCL@@",
        "?EnableDelayedDeallocation@Allocator@UnBCL@@QAEXH@Z",
        "?Find@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHGH@Z",
        "10.0.19041.572 (WinBuild.160101.0800)",
        "?get_Rank@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
        "0%0:0a0n0t0}0",
        "394K4c4",
        "?GetVersionId@?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
        "__thiscall UnBCL::Version::Version(const unsigned short *)",
        ".?AV?$ArrayList@H@UnBCL@@",
        "??0?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAE@XZ",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::XmlLite::XmlAttribute *>::MoveNext(void)",
        "627D7V7s7",
        "??0PathTooLongException@UnBCL@@QAE@PBVString@1@@Z",
        "261019185142Z0",
        "2;3`3",
        "??4InvalidOperationException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "394P4s4",
        "?Contains@?$Array@H@UnBCL@@UBEHH@Z",
        "?CopyCharsOverlapped@?$CSimpleStringT@G$0A@@ATL@@SAXPAGIPBGH@Z",
        "??4ApplicationException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "6-6?6S6t6",
        "??_7PathTooLongException@UnBCL@@6B@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::Object *>::AddRange(const struct UnBCL::ICollection<class UnBCL::Object *> *)",
        "?Clear@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXXZ",
        ".?AV?$SerializableArrayListPrimitiveBase@E@_@UnBCL@@",
        ".?AU?$IEnumerator@PAVString@UnBCL@@@UnBCL@@",
        "?get_ThreadID@Thread@UnBCL@@QAEKXZ",
        ">!>*>0>Q>Y>`>f>l>",
        "?IndexOfAny@String@UnBCL@@SGHPBG0HH@Z",
        "0%1Q1",
        "?Dump@Allocator@UnBCL@@SGIPAUILogHandler@@I@Z",
        "??0Version@UnBCL@@QAE@ABV01@@Z",
        "??0ObjectDisposedException@UnBCL@@QAE@ABV01@@Z",
        ">&>H>x>",
        "int __thiscall UnBCL::ArrayList<unsigned char>::IndexOf(unsigned char,int,int) const",
        "?CreateSubKey@RegistryKey@UnBCL@@QAEPAV12@PBVString@2@@Z",
        "?IndexOf@?$Array@PAVObject@UnBCL@@@UnBCL@@SGHPBV12@PAVObject@2@HH@Z",
        ".?AV?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        ".?AU?$IComparer@PAVString@UnBCL@@@UnBCL@@",
        "??1?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
        "??0?$IEnumerable@PAVString@UnBCL@@@UnBCL@@QAE@XZ",
        "8(8,8D8T8d8h8l8p8t8x8|8",
        "?get_LineNumber@XmlException@UnBCL@@UAEHXZ",
        "?Add@XmlNodeList@XmlLite@UnBCL@@IAEXPAVXmlNode@23@@Z",
        "??4Thread@UnBCL@@QAEAAV01@ABV01@@Z",
        "??0ApplicationException@UnBCL@@QAE@$$QAV01@@Z",
        ".PAVArithmeticException@UnBCL@@",
        ".?AVSerializationId@UnBCL@@",
        "??1ArgumentException@UnBCL@@UAE@XZ",
        "??_7?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
        "void __thiscall UnBCL::StringBuilder::set_Chars(int,unsigned short)",
        "?UNICODE_CODEPAGE@UnicodeEncoding@UnBCL@@0HB",
        "??0XmlAttribute@XmlLite@UnBCL@@QAE@ABV012@@Z",
        "null path or encoding to StreamReader constructor",
        "??_DOperatingSystem@UnBCL@@QAEXXZ",
        "??1ArgumentNullException@UnBCL@@UAE@XZ",
        "SetEvent",
        "??0?$Array@E@UnBCL@@QAE@PBU?$ICollection@E@1@@Z",
        "?get_Hours@TimeSpan@UnBCL@@QBEHXZ",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::SmartPtr<class UnBCL::String> >::MoveNext(void)",
        "??B?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
        "class UnBCL::Array<class UnBCL::String *> *__thiscall UnBCL::RegistryKey::GetValueNames(void)",
        "Write() on closed FileStream",
        ";';9;G;|;",
        "class UnBCL::XmlNode *__thiscall UnBCL::XmlDocument::CreateNode(enum UnBCL::XmlNodeType,class UnBCL::String *,class UnBCL::String *)",
        "??0XmlNode@UnBCL@@QAE@ABV01@@Z",
        "??_7?$ArrayList@G@UnBCL@@6B?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "?Clear@?$ArrayList@G@UnBCL@@UAEXXZ",
        "void __thiscall UnBCL::StreamWriter::Write(const class UnBCL::String *,int,int)",
        "??B?$SmartPtr@VStream@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
        "??1TimeSpan@UnBCL@@UAE@XZ",
        "?get_NextSibling@XmlNode@XmlLite@UnBCL@@QBEPAV123@XZ",
        "int __stdcall UnBCL::Monitor::Wait(class UnBCL::SyncObject *)",
        "?SelectSingleNode@XmlNode@UnBCL@@QAEPAV12@PAVString@2@PAVXmlNamespaceManager@2@@Z",
        "<(=4=@=L=X=d=",
        "null key to Hashtable#Remove",
        "??4IPoolable@UnBCL@@QAEAAU01@$$QAU01@@Z",
        ":);U;d;",
        ">,><>@>D>H>L>P>d>h>",
        "4\"575O5e5",
        "121D1",
        "?Append@MutableString@UnBCL@@QAEXG@Z",
        "747<7D7P7p7x7",
        "8 8$8(808L8h8l8p8t8x8",
        "??_7XmlAttribute@XmlLite@UnBCL@@6B@",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "??_7StreamWriter@UnBCL@@6B@",
        "??_8?$Array@E@UnBCL@@7B?$SerializableArrayBase@E@_@1@@",
        "?IsDriveLetterPrefix@Path@UnBCL@@SGHPBG@Z",
        "7 8W8",
        "191219011458Z",
        "?ToString@Exception@UnBCL@@UBEPAVString@2@XZ",
        "tBUGBUG method not implemented",
        "??0Stream@UnBCL@@QAE@$$QAV01@@Z",
        "saw header for panthom object, use ReadPhantomObject method.",
        "?ReadLine@TextReader@UnBCL@@UAEPAVString@2@XZ",
        "Canceled: ",
        "??0InvalidCastException@UnBCL@@QAE@PAVString@1@@Z",
        "20D0V0",
        ";$;C;",
        ".?AVWaitHandle@UnBCL@@",
        "int __thiscall UnBCL::Array<class UnBCL::XmlLite::XmlNode *>::Add(class UnBCL::XmlLite::XmlNode *)",
        "??_7?$ArrayList@G@UnBCL@@6B?$IList@G@1@@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::String *>::CopyTo(class UnBCL::Array<class UnBCL::String *> *,int) const",
        "??4XmlAttribute@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??4?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
        "=8=J=c=",
        "?IndexOf@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGHPBV12@PAVString@2@HH@Z",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive<unsigned long>(unsigned long)",
        "?Sort@?$Array@PAVObject@UnBCL@@@UnBCL@@SGXPAV12@@Z",
        ";$;,;<;D;L;T;d;l;t;|;",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive<unsigned int>(unsigned int)",
        "?s_PoolLock@String@UnBCL@@1VObject@2@A",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVXmlAttribute@XmlLite@UnBCL@@@UnBCL@@@UnBCL@@",
        "?GetBytes@Encoding@UnBCL@@UBEPAV?$Array@E@2@PBVString@2@HH@Z",
        "void __thiscall UnBCL::RegistryKey::SetValue(const class UnBCL::String *,int)",
        "5M6T6",
        ".?AV?$ArrayListEnumerator@PAVString@UnBCL@@@_@UnBCL@@",
        "0$0(0,000D0T0X0h0l0",
        "?ReAlloc@Allocator@UnBCL@@SGPAXPAXKI@Z",
        "3-3A3f3",
        "??0NotSupportedException@UnBCL@@QAE@$$QAV01@@Z",
        "void __thiscall UnBCL::ArrayList<unsigned short>::RemoveAt(int)",
        "int __thiscall UnBCL::_::ArrayListEnumerator<unsigned short>::MoveNext(void)",
        ".?AV?$SmartPtr@V?$Array@VStringPtr@UnBCL@@@UnBCL@@@UnBCL@@",
        "??_8?$Array@PAVObject@UnBCL@@@UnBCL@@7B@",
        "_initterm",
        "??4?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
        "0*090U0g0v0",
        "3%3C3a3s3",
        "1'1.151]1j1x1",
        "?GetDirectorySeparatorChar@Path@UnBCL@@SGGXZ",
        "??_7?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@6B@",
        "?get_NamespaceURI@XmlNode@XmlLite@UnBCL@@QBEPAVString@3@XZ",
        "??0String@UnBCL@@QAE@PBGHH@Z",
        "?FlushBuffer@BufferedStream@UnBCL@@AAEXXZ",
        "??_7?$Stack@H@UnBCL@@6BISerializable@1@@",
        "??0DateTime@UnBCL@@IAE@_JH@Z",
        "??_8RegistryKey@UnBCL@@7BIDisposable@1@@",
        "oK0D$\"<",
        ".?AV?$SerializableArrayBase@G@_@UnBCL@@",
        ".rdata$brc",
        ":#:x:",
        "int __thiscall UnBCL::UnicodeEncoding::GetMaxByteCount(int) const",
        "?Dispose@TextReader@UnBCL@@UAEXXZ",
        "??1HeapMemoryManager@UnBCL@@UAE@XZ",
        "?_EndsWith@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@@Z",
        ":):5:A:j:",
        "void __thiscall UnBCL::XmlDocument::Load(class UnBCL::String *)",
        "1$141D1T1d1h1x1",
        "??0InvalidOperationException@UnBCL@@QAE@$$QAV01@@Z",
        "??_7TextReader@UnBCL@@6BIDisposable@1@@",
        "??4RegistryKey@UnBCL@@QAEAAV01@ABV01@@Z",
        "=P=`=l=",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive<double>(double)",
        "??_7?$Array@PAVObject@UnBCL@@@UnBCL@@6B?$ICollection@PAVObject@UnBCL@@@1@@",
        "?,?0?H?X?h?l?p?t?x?|?",
        "?get_NamespaceURI@XmlNode@UnBCL@@QAEPAVString@2@XZ",
        "1=1B1~1",
        "?Contains@?$Stack@H@UnBCL@@UBEHH@Z",
        ":h:w:",
        "<C<U<d<",
        "> >s>",
        ".?AU?$ICollection@VStringPtr@UnBCL@@@UnBCL@@",
        ".?AV?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@",
        "<$<,<4<T<\\<l<x<",
        "int __stdcall UnBCL::Path::GetRootLength(const class UnBCL::String *)",
        "t$f;D$",
        "??0?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
        "?get_PreviousSibling@XmlNode@UnBCL@@QAEPAV12@XZ",
        "?GetApplicationStartDir@Directory@UnBCL@@SGPAVString@2@XZ",
        "< <0<4<8<<<@<T<d<h<x<|<",
        "=.>@>O>s>",
        "?ToString@DateTime@UnBCL@@UBEPAVString@2@XZ",
        "__thiscall UnBCL::ArrayList<int>::ArrayList(const struct UnBCL::ICollection<int> *)",
        "3 383<3@3D3H3L3P3T3h3l3p3t3x3",
        "NtSetInformationFile",
        "0&1U1y1",
        "Exception while moving %s to %s",
        "?GetTypeName@?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
        "?!?C?",
        "&amp;",
        "7*787",
        ";U;v;",
        "?:?W?",
        "?Clear@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXXZ",
        "?GetVersionId@?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
        "?MakeSureDirectoryExists@Directory@UnBCL@@SGKPBGPAH@Z",
        "=1=R=u=",
        "?StreamWrite@?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@UBEXAAVSerializationStream@3@@Z",
        ";C;_;",
        "000:0",
        "unable to set value on key",
        "class UnBCL::SerializationStream::TypeFactoryList *__thiscall UnBCL::_::HTEnumerator<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,&protected: static class UnBCL::SerializationStream::TypeFactoryList * __stdcall UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,class ATL::CElementTraits<class UnBCL::SerializationStream::TypeFactoryList *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "class UnBCL::String *__stdcall UnBCL::Path::WithLongPrefix(const class UnBCL::String *,int)",
        "GetSystemTimeAsFileTime",
        "memset",
        "20201008071948.152Z0",
        "??0MutableString@UnBCL@@QAE@GH@Z",
        "?Dispose@WaitHandle@UnBCL@@AAEXH@Z",
        "?GetMaxByteCount@UnicodeEncoding@UnBCL@@UBEHH@Z",
        "CoInitializeEx",
        "??2Object@UnBCL@@SGPAXII@Z",
        "??4TextReader@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "__RTtypeid",
        "??0MultiSz@UnBCL@@QAE@PBG@Z",
        "6$64686H6L6P6h6l6",
        "0.0C0a0",
        "?LastIndexOf@?$Array@PAVString@UnBCL@@@UnBCL@@SGHPBV12@PAVString@2@HH@Z",
        "??0OperatingSystem@UnBCL@@AAE@XZ",
        "void __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *>::set_Item(int,class UnBCL::XmlLite::XmlNode *)",
        "??_7?$SerializableArrayBase@H@_@UnBCL@@6B?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@",
        "??_7?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
        "?Combine@Path@UnBCL@@SGPAVString@2@PBV32@0@Z",
        "negative bucket count to Hashtable constructor",
        "030R0",
        "MultiSz element value cannot be empty string",
        "?get_Item@?$ArrayList@G@UnBCL@@UAEAAGH@Z",
        "class UnBCL::String *__thiscall UnBCL::String::Insert(int,const unsigned short *) const",
        "?ExpandEnvironmentVariables@Environment@UnBCL@@SGPAVString@2@PBV32@@Z",
        "const int &__thiscall UnBCL::Stack<int>::Peek(void) const",
        "<8<D<d<l<x<",
        "??C?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QBEPAVXmlNamespaceManager@1@XZ",
        "??4?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "?get_TotalHours@TimeSpan@UnBCL@@QBENXZ",
        "2%2M2Z2h2v2",
        "??1StringBuilder@UnBCL@@UAE@XZ",
        ".?AU?$IEnumerator@PAVXmlAttribute@XmlLite@UnBCL@@@UnBCL@@",
        "null chars to UnicodeEncoding#GetBytes",
        "SetFileTime",
        ".?AUIDisposable@UnBCL@@",
        "Type is not cloneable",
        "4&474L4c4j4",
        "??4XmlNodeList@XmlLite@UnBCL@@QAEAAV012@ABV012@@Z",
        "4,5>5S5^5",
        "\\$ YY",
        "?Remove@?$Array@E@UnBCL@@UAEXE@Z",
        "?Peek@?$Stack@PAVObject@UnBCL@@@UnBCL@@UAEAAPAVObject@2@XZ",
        "??1?$Stack@PAVObject@UnBCL@@@UnBCL@@UAE@XZ",
        "?CopyChars@?$CSimpleStringT@G$0A@@ATL@@SAXPAGPBGH@Z",
        "D$(PS",
        "??0MutableString@UnBCL@@QAE@ABV01@@Z",
        "unsigned short __thiscall UnBCL::_::ArrayListEnumerator<unsigned short>::get_Current(void) const",
        " Microsoft Corporation. All rights reserved.",
        "void __thiscall UnBCL::Array<class UnBCL::Object *>::RemoveAt(int)",
        "??0?$ArrayList@G@UnBCL@@QAE@XZ",
        "1'161I1j1",
        "PWWWWWWW",
        "?Reallocate@?$CSimpleStringT@G$0A@@ATL@@AAEXH@Z",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@ABUtagVARIANT@@@Z",
        "?Merge@MultiSz@UnBCL@@QAEXABV12@H@Z",
        "6#616?6M6[6i6w6",
        "\"<>|*?:",
        "5<5s5",
        "??1?$ICollection@PAVObject@UnBCL@@@UnBCL@@UAE@XZ",
        ".?AUISerializable@UnBCL@@",
        "??4?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "9/9`9r9",
        "=E=W=i=&>C>",
        "??6SerializationStream@UnBCL@@QAEAAV01@F@Z",
        ":-:a:s:",
        ";A$uG9w",
        "__thiscall UnBCL::Encoding::Encoding(int)",
        "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6B?$IEnumerable@PAVString@UnBCL@@@2@@",
        "?get_Current@FileSystemEnumerator@UnBCL@@UBEPAVString@2@XZ",
        "?GetEnvironmentVar@Environment@UnBCL@@SGPAVString@2@PBV32@@Z",
        "?T?f?x?",
        "set_Position() on closed MemoryStream",
        "5*5S5",
        "WriteFile",
        "1*2C2f2s2",
        "??4BufferedStream@UnBCL@@QAEAAV01@ABV01@@Z",
        "void __thiscall UnBCL::ArrayList<unsigned short>::Insert(int,unsigned short)",
        "const class UnBCL::OperatingSystem *__stdcall UnBCL::Environment::GetOSVersion(int)",
        "?ReverseFind@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHG@Z",
        "__thiscall UnBCL::DateTime::DateTime(__int64)",
        ".?AU?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@",
        "??0FileSystemEnumerator@UnBCL@@QAE@PBG0@Z",
        "??_D?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@IAEXXZ",
        "FileVersion",
        "??0Process@UnBCL@@QAE@ABV01@@Z",
        "??0OutOfMemoryException@UnBCL@@QAE@PAVString@1@PAVException@1@@Z",
        "__thiscall UnBCL::OperatingSystem::OperatingSystem(enum UnBCL::PlatformID,unsigned long,enum UnBCL::InstallationType,class UnBCL::Version *)",
        "void __thiscall UnBCL::ArrayList<unsigned short>::Resize(int,int)",
        "int __thiscall UnBCL::_::HTEnumerator<struct UnBCL::SerializationStream::UniqueObject,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,class UnBCL::DictionaryEntry<struct UnBCL::SerializationStream::UniqueObject,int>,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<struct UnBCL::SerializationStream::UniqueObject,int> __stdcall UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "9$9<9L9P9T9l9|9",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAN@Z",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVXmlNode@XmlLite@UnBCL@@@UnBCL@@@UnBCL@@",
        "??6SerializationStream@UnBCL@@QAEAAV01@G@Z",
        "void __thiscall UnBCL::RegistryKey::DeleteSubKeyTree(const class UnBCL::String *)",
        "-fQf-",
        "int __stdcall UnBCL::UnicodeEncoding::SGetChars(const class UnBCL::Array<unsigned char> *,int,int,class UnBCL::Array<unsigned short> *,int,int)",
        "??1?$Array@PAVObject@UnBCL@@@UnBCL@@UAE@XZ",
        "??_7RegSubkeyEnumerator@UnBCL@@6B@",
        "2K2i2",
        "int &__thiscall UnBCL::ArrayList<int>::get_Item(int)",
        "?ShouldEnumerateReparsePoint@Directory@UnBCL@@SGHPBVString@2@@Z",
        "?get_ValueCount@RegistryKey@UnBCL@@QBEHXZ",
        "?PulseAll@Monitor@UnBCL@@SGXPAVSyncObject@2@@Z",
        "??_8UnicodeEncoding@UnBCL@@7B01@@",
        "void __thiscall UnBCL::XmlDocument::LoadXml(class UnBCL::String *)",
        "?IndexOf@String@UnBCL@@QBEHPBGH@Z",
        "?ReadPhantomObject@SerializationStream@UnBCL@@QAEXAAPAVObject@2@@Z",
        ".?AV?$SmartPtr@U?$IEnumerator@G@UnBCL@@@UnBCL@@",
        "null buf to BufferedStream#Read",
        "6&646B6",
        "=6=Z={=",
        "??_7?$Array@G@UnBCL@@6B01@@",
        "?get_TypeName@SerializationId@UnBCL@@QBEPBGXZ",
        "??4?$SerializableArrayBase@E@_@UnBCL@@QAEAAV012@$$QAV012@@Z",
        "7&7C7",
        "?Close@Process@UnBCL@@QAEXXZ",
        "454@4N4u4",
        "??_8Delegate@UnBCL@@7B@",
        "?Append@StringBuilder@UnBCL@@QAEPAV12@PBVString@2@HH@Z",
        "??_7UnicodeEncoding@UnBCL@@6BObject@1@@",
        "??_7FileStream@UnBCL@@6BObject@1@@",
        "8 8'8.8g8s8",
        "invalid platform to OperatingSystem constructor",
        ".?AU?$IEnumerable@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@UnBCL@@",
        ".?AV?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::StringPtr>::Reset(void)",
        "RegCreateKeyExW",
        "?MAX_MS@TimeSpan@UnBCL@@0_JB",
        "??_7CaseInsensitiveStringComparer@UnBCL@@6BObject@1@@",
        "304X4",
        "??0RegSubkeyEnumerator@UnBCL@@QAE@AAVRegHandle@1@@Z",
        "??_7Version@UnBCL@@6B?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "?StreamRead@?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@UAEXAAVSerializationStream@3@@Z",
        "3*3<3J3c3j3q3",
        "<G<s<",
        "unsigned char *__thiscall UnBCL::ArrayList<unsigned char>::GetBuffer(int)",
        "_UnBCLReleaseResources@0",
        ".?AVAbandonedMutexException@UnBCL@@",
        "??1?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
        "ix or count out of range to Encoding#GetBytes",
        "Array doesn't support Insert()",
        "?IndexOfEndOfLongPrefix@Path@UnBCL@@SGHPBVString@2@@Z",
        ":!;u;",
        "??0ObjectDisposedException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
        "class UnBCL::String *__stdcall UnBCL::Directory::GetLoadedModuleDir(const class UnBCL::String *)",
        "void __stdcall pGetDirectoriesAndFiles(const class UnBCL::String *,const class UnBCL::String *,enum UnBCL::Directory::EnumerationType,int,class UnBCL::String *,class UnBCL::ArrayList<class UnBCL::String *> *)",
        "?get_ChildNodes@XmlNode@UnBCL@@QAEPAVXmlNodeList@2@XZ",
        "1C1x1",
        "1$1,141<1D1P1p1x1",
        ".?AVXmlNodeList@UnBCL@@",
        "??4?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@QAEAAU01@ABU01@@Z",
        "?get_Days@TimeSpan@UnBCL@@QBEHXZ",
        "373`3i3",
        "?WithLongPrefix@Path@UnBCL@@SGPAVString@2@PBV32@H@Z",
        "??Y?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@PBG@Z",
        ";(;L;T;X;\\;`;d;l;",
        "GetWindowsDirectoryW failed",
        "void __thiscall UnBCL::ArrayList<int>::AddRange(const struct UnBCL::ICollection<int> *)",
        "9(9,9D9T9X9h9x9|9",
        "424C4Q4",
        "??0OutOfMemoryException@UnBCL@@QAE@ABV01@@Z",
        "??_7?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
        "?GetUnicode@Encoding@UnBCL@@SGPAV12@XZ",
        ">D?V?h?v?",
        ":C:_:",
        "434s4",
        ")Failed to allocate hard link file path",
        "??_7?$SerializableArrayBase@E@_@UnBCL@@6BObject@2@@",
        "<'<L<s<",
        ".?AV?$HTEnumerator@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@UTableKey@?$Hashtable@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@2@PAV12@UKeyTraits@62@$1?RetrieveKey@62@KGPAV12@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@PAVTypeFactoryList@SerializationStream@3@UKeyTraits@23@V?$CElementTraits@PAVTypeFactoryList@SerializationStream@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "??0SEHException@UnBCL@@QAE@$$QAV01@@Z",
        "7 7,7L7T7`7",
        "??1XmlNodeList@UnBCL@@UAE@XZ",
        "?B?T?c?",
        "6\"6O6~6",
        "j\\Yf;",
        "?Assign@?$SmartPtr@VString@UnBCL@@@UnBCL@@AAEXPAVString@2@@Z",
        "?SGetChars@ASCIIEncoding@UnBCL@@CGHPBV?$Array@E@2@HHPAV?$Array@G@2@H@Z",
        "__RTDynamicCast",
        "??0?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        "=4=P=",
        "??0IPoolable@UnBCL@@QAE@ABU01@@Z",
        "0,0S0",
        "Reset() called on invalidated enumerator",
        ": :8:<:T:X:\\:`:d:h:l:p:t:x:|:",
        "?get_Length@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
        ".?AU?$IEnumerator@H@UnBCL@@",
        "0,040<0D0L0T0\\0",
        "base\\ntsetup\\unbcl\\src\\mutex.cpp",
        "?get_Item@?$Array@G@UnBCL@@UAEAAGH@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *>::Insert(int,class UnBCL::XmlLite::XmlNode *)",
        ".?AU?$ICollection@PAVTypeFactoryList@SerializationStream@UnBCL@@@UnBCL@@",
        "int __thiscall UnBCL::Array<unsigned char>::Add(unsigned char)",
        "class UnBCL::String *__thiscall UnBCL::String::Remove(int,int) const",
        "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a",
        "null value to String#StartsWith",
        "?Equals@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHPBVObject@2@@Z",
        "?Format@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXPBGZZ",
        ":5:@:N:u:",
        "??_7Type@UnBCL@@6B@",
        "8,9S9t9",
        ".?AVThread@UnBCL@@",
        "|CSj ",
        "__thiscall UnBCL::XmlDocument::XmlDocument(struct IXMLDOMDocument3 *)",
        "0T0X0`0h0",
        ".xdata$x",
        "?Dispose@WaitHandle@UnBCL@@UAEXXZ",
        "40444D4T4X4\\4t4",
        "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6BObject@1@@",
        "?OpenSubKey@RegistryKey@UnBCL@@QAEPAV12@PBVString@2@@Z",
        "??0CaseInsensitiveStringComparer@UnBCL@@QAE@ABV01@@Z",
        "?get_Name@XmlNode@XmlLite@UnBCL@@QBEPAVString@3@XZ",
        "??_DStreamReader@UnBCL@@QAEXXZ",
        "??4SerializationException@UnBCL@@QAEAAV01@ABV01@@Z",
        "class UnBCL::Object *&__thiscall UnBCL::Stack<class UnBCL::Object *>::Peek(void)",
        "??6SerializationStream@UnBCL@@QAEAAV01@H@Z",
        "attempt to store on non-storing archive",
        "??4?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@QAEAAV012@$$QAV012@@Z",
        "?GetCallingModule@SerializationStream@UnBCL@@SGPAUHINSTANCE__@@XZ",
        "??0?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAE@XZ",
        "?GetSystemDir@Directory@UnBCL@@SGPAVString@2@XZ",
        "??0XPathException@UnBCL@@QAE@PAVString@1@PAVException@1@J@Z",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive<short>(short)",
        "??4TextWriter@UnBCL@@QAEAAV01@ABV01@@Z",
        "??D?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QBEAAVDecoder@1@XZ",
        "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@AAE@ABV01@@Z",
        "131F1]1",
        "0,000@0P0T0d0t0",
        "]oB\"y",
        "3A3q3",
        "8E9T9",
        "?ToString@Object@UnBCL@@UBEPAVString@2@XZ",
        "<8<T<x<",
        ".?AVThreadStateException@UnBCL@@",
        "??_8WaitHandle@UnBCL@@7B01@@",
        "??1DateTime@UnBCL@@UAE@XZ",
        "??1Decoder@UnBCL@@UAE@XZ",
        "?_Split@String@UnBCL@@QBE?AV?$SmartPtr@V?$Array@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@UnBCL@@@2@V?$SmartPtr@VString@UnBCL@@@2@@Z",
        "const class UnBCL::String *__stdcall UnBCL::String::IsInterned(const class UnBCL::String *)",
        "??4?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "??4?$Stack@PAVObject@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        ";(;8;<;L;P;`;d;|;",
        "?GetString@Encoding@UnBCL@@UBEPAVString@2@PBV?$Array@E@2@HH@Z",
        "?UnregisterAllTypesForDllUnload@SerializationStream@UnBCL@@SGXXZ",
        "?CopyTo@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEXPAV12@H@Z",
        "?Remove@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXPAVString@2@@Z",
        ":d;s;",
        "??1?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@UAE@XZ",
        "?GetBuffer@?$ArrayList@G@UnBCL@@UBEPBGH@Z",
        "%Microsoft Windows Production PCA 2011",
        "??C?$SmartPtr@VStream@UnBCL@@@UnBCL@@QBEPAVStream@1@XZ",
        "??4ApplicationException@UnBCL@@QAEAAV01@ABV01@@Z",
        ".text$x",
        "tAVj ",
        "5/5>5a5z5",
        "?Match@String@UnBCL@@SGHPBG0@Z",
        "??4ArithmeticException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        ";!;3;E;c;",
        "??_8?$Array@E@UnBCL@@7B@",
        "?MoveNext@RegSubkeyEnumerator@UnBCL@@UAEHXZ",
        "?Close@StreamWriter@UnBCL@@IAEXH@Z",
        " hResult = 0x%x, Line = %d, Position = %d; %s. ",
        ":8:`:q:",
        "??4?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??4StreamCounter@UnBCL@@QAEAAV01@ABV01@@Z",
        ".?AVNotSupportedException@UnBCL@@",
        "?Format@String@UnBCL@@SAPAV12@PBGZZ",
        "VarFileInfo",
        "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@PBG@Z",
        "int __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *>::BinarySearch(int,int,class UnBCL::XmlLite::XmlAttribute *,struct UnBCL::IComparer<class UnBCL::XmlLite::XmlAttribute *> *)",
        "const struct _WIN32_FIND_DATAW &__thiscall UnBCL::FileSystemEnumerator::get_FindData(void) throw(...)",
        "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@ABUtagVARIANT@@@Z",
        "DeleteCriticalSection",
        "767|7",
        ">\">U>",
        "516q6",
        "?SetHandler@Logging@UnBCL@@SGXPAUILogHandler@@@Z",
        "?Reset@FileSystemEnumerator@UnBCL@@UAEXXZ",
        "5;5`5",
        "??1ArgumentOutOfRangeException@UnBCL@@UAE@XZ",
        "??C?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$Array@PAVString@UnBCL@@@1@XZ",
        "?SetMessage@Exception@UnBCL@@MAEXPAVString@2@@Z",
        "?MAX_KEYNAME_LEN@RegistryKey@UnBCL@@0HB",
        "??_7FileStream@UnBCL@@6BStream@1@@",
        "=4>x>",
        "??_7?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@6B01@@",
        "??4?$IList@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "class UnBCL::ArrayList<unsigned char> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<unsigned char>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "??_7?$SerializableArrayBase@G@_@UnBCL@@6B?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@",
        "VirtualQuery",
        "??_8Monitor@UnBCL@@7B@",
        "yEWj$",
        "class UnBCL::String *__thiscall UnBCL::String::Replace(const unsigned short *,const unsigned short *,enum UnBCL::String::StringCasing) const",
        ":1;8;",
        "0 0]0o0~0",
        ".?AVMonitor@UnBCL@@",
        "class UnBCL::String *__stdcall UnBCL::Environment::ExpandEnvironmentVariables(const class UnBCL::String *)",
        "??0StringPtr@UnBCL@@QAE@XZ",
        "int __thiscall UnBCL::String::EndsWith(const unsigned short *,int) const",
        "?get_IsFixedSize@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
        "??_DCaseInsensitiveStringComparer@UnBCL@@QAEXXZ",
        "?get_NumLogicalCPU@SystemInfo@UnBCL@@QBEKXZ",
        "index and count do not denote a valid range of elements in ArrayList#BinarySearch",
        "??0XmlSchemaSet@UnBCL@@QAE@XZ",
        "?WriteLine@TextWriter@UnBCL@@UAAXPBGZZ",
        ".?AVStream@UnBCL@@",
        "?Subtract@DateTime@UnBCL@@QBE?AVTimeSpan@2@ABV12@@Z",
        "void __thiscall UnBCL::Array<class UnBCL::String *>::Remove(class UnBCL::String *)",
        "5%505x5",
        "?Clear@?$Array@G@UnBCL@@UAEXXZ",
        "?Close@RegHandle@UnBCL@@QAEXXZ",
        "; ;%;R;",
        "??0ObjectDisposedException@UnBCL@@QAE@XZ",
        "??_7?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@6B@",
        "??0Win32Exception@UnBCL@@QAE@KPBGPAVException@1@@Z",
        ">)?<?N?\\?",
        "??0OverflowException@UnBCL@@QAE@PBVString@1@@Z",
        "?GetEnumerator@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEPAU?$IEnumerator@PAVObject@UnBCL@@@2@XZ",
        "?EndsWith@String@UnBCL@@QBEHG@Z",
        "int __thiscall UnBCL::MemoryStream::Read(unsigned char *,int,int)",
        "<9<K<Z<j<",
        "??0Win32Exception@UnBCL@@QAE@PBG@Z",
        "?MAX_SECONDS@TimeSpan@UnBCL@@0_JB",
        "class UnBCL::String *__stdcall UnBCL::Path::GetLongName(const class UnBCL::String *)",
        "??_7?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
        "?SetManager@?$CSimpleStringT@G$0A@@ATL@@QAEXPAUIAtlStringMgr@2@@Z",
        ".PAVThreadStateException@UnBCL@@",
        "565H5Z5h5",
        "int __thiscall UnBCL::Encoding::GetByteCount(const class UnBCL::String *) const",
        ";S;o;",
        "7@8O8w8",
        "1&141R1d1v1",
        "SELECT Manufacturer, Name, Caption, Architecture, MaxClockSpeed FROM Win32_Processor",
        ".?AU?$ICollection@PAVObject@UnBCL@@@UnBCL@@",
        "8/8A8S8s8",
        ".CRT$XCA",
        "??4Path@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??_7XmlAttributeCollection@UnBCL@@6B@",
        "t1Sj ",
        "?SetNamedItem@XmlAttributeCollection@UnBCL@@QAEPAVXmlNode@2@PAV32@@Z",
        "??4UnicodeEncoding@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "8+818:8_8p8",
        "??0Win32Exception@UnBCL@@QAE@XZ",
        "757O7'8A8X9B:\\:t:",
        "??4Environment@UnBCL@@QAEAAV01@ABV01@@Z",
        "?C?_?",
        "SetFilePointer",
        "6/6F6",
        "??_7OperatingSystem@UnBCL@@6B?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@1@@",
        "?get_P@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBEPAVEncoding@2@XZ",
        "2 282<2@2T2X2p2",
        "70747H7L7P7h7x7|7",
        "7%747S7^7",
        "Out of memory while allocating XmlNode",
        "void __thiscall UnBCL::FileStream::SetSize(__int64)",
        "??0Mutex@UnBCL@@QAE@ABV01@@Z",
        "?IndexOf@String@UnBCL@@QBEHG@Z",
        "??_8?$ArrayList@PAVString@UnBCL@@@UnBCL@@7B?$IList@PAVString@UnBCL@@@1@@",
        "RegQueryInfoKeyW",
        "path too long on NT/2k+",
        ":1:8:?:F:M:T:",
        "??4?$IEnumerable@G@UnBCL@@QAEAAU01@ABU01@@Z",
        "=/>H>W>w>",
        "??1?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@UAE@XZ",
        "negative value to Version constructor",
        "??4ConsoleLogHandler@UnBCL@@QAEAAV01@ABV01@@Z",
        "4I5l5{5",
        "int __thiscall UnBCL::String::IndexOf(unsigned short,int) const",
        "??4?$ICollection@H@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "u'Sj$",
        "?Steal@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAEPAV?$ArrayList@PAVString@UnBCL@@@2@XZ",
        "class UnBCL::Object *const &__thiscall UnBCL::Stack<class UnBCL::Object *>::Peek(void) const",
        "RegDeleteKeyW",
        ".?AVSyncObject@UnBCL@@",
        ".didat$4",
        "250701214655Z0|1",
        "void __thiscall UnBCL::Array<class UnBCL::Object *>::InitLarva(class UnBCL::ArrayList<class UnBCL::Object *> *)",
        "SerializationId::SerializationId: typeName is NULL.",
        "??1StreamReader@UnBCL@@UAE@XZ",
        "?get_ComputerName@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
        "??0?$Array@H@UnBCL@@QAE@HH@Z",
        "?get_EnumError@RegSubkeyEnumerator@UnBCL@@QAEHXZ",
        "??_7StreamWriter@UnBCL@@6BIDisposable@1@@",
        "??4?$ICollection@PAVString@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "??0ThreadStateException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
        "?DeAssign@?$SmartPtr@VStream@UnBCL@@@UnBCL@@AAEXXZ",
        "??0MemoryStream@UnBCL@@QAE@ABV01@@Z",
        ".?AU?$IEnumerable@V?$DictionaryEntry@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@@UnBCL@@",
        "??0String@UnBCL@@QAE@AAVSerializationStream@1@@Z",
        "3$3,383X3`3h3p3x3",
        "?InitLarva@?$Array@PAVString@UnBCL@@@UnBCL@@MAEXPAV?$ArrayList@PAVString@UnBCL@@@2@@Z",
        ".PAVArgumentNullException@UnBCL@@",
        "void __thiscall UnBCL::_::ArrayListEnumerator<unsigned char>::Reset(void)",
        "?Add@MultiSz@UnBCL@@QAEXPBG@Z",
        "??5SerializationStream@UnBCL@@QAEAAV01@AA_J@Z",
        ".?AV?$KeyCollection@PAVString@UnBCL@@PAV12@@_@UnBCL@@",
        "?Concat@String@UnBCL@@SGPAV12@PBG00@Z",
        "??6SerializationStream@UnBCL@@QAEAAV01@J@Z",
        "?DefaultHigh@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@0MB",
        "??_7String@UnBCL@@6B@",
        "6#6B6b6s6",
        "Seek() before beginning of MemoryStream",
        "??1ProcessStartInfo@UnBCL@@UAE@XZ",
        "??4?$IComparer@PAVString@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
        "??0MutableString@UnBCL@@QAE@PBVString@1@@Z",
        "?MakeLower@MutableString@UnBCL@@QAEXXZ",
        "??4RegHandle@UnBCL@@QAEAAV01@ABV01@@Z",
        "<:=L=[=l=",
        "??0OutOfMemoryException@UnBCL@@QAE@$$QAV01@@Z",
        "??4OutOfMemoryException@UnBCL@@QAEAAV01@ABV01@@Z",
        "Washington1",
        "??6SerializationStream@UnBCL@@QAEAAV01@UEmptyType@MP@1@@Z",
        "5:5W5",
        "7-7j7",
        ";$;D;P;p;|;",
        "class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *>,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,class ATL::CElementTraits<class UnBCL::String *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "??0ArithmeticException@UnBCL@@QAE@XZ",
        "u,Vj$",
        "?GetParentPath@Path@UnBCL@@SGPAVString@2@PBV32@@Z",
        "??0?$ICollection@E@UnBCL@@QAE@ABU01@@Z",
        "??0SystemInfo@UnBCL@@QAE@ABV01@@Z",
        "7(7,707H7X7\\7`7x7|7",
        "?DeAssign@?$SmartPtr@VObject@UnBCL@@@UnBCL@@AAEXXZ",
        ";H<Z<",
        "??_8StreamWriter@UnBCL@@7BIDisposable@1@@",
        "686D6d6p6",
        "232R2x2",
        "?7?B?P?",
        ".?AVType@UnBCL@@",
        "??0ArgumentOutOfRangeException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
        "??0Stream@UnBCL@@QAE@XZ",
        "void __thiscall UnBCL::SerializationStream::ReadPhantomObject(class UnBCL::Object *&)",
        "747P7T7X7\\7`7h7",
        "?Add@XmlSchemaSet@UnBCL@@QAEXPAVString@2@PAVXmlDocument@2@@Z",
        "MoveToNextAttribute",
        "punable to get full path for %s",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "9<9D9L9X9x9",
        "2 24282H2L2d2h2|2",
        "8#8(8<8J8R8W8k8y8",
        "void __thiscall UnBCL::MemoryStream::set_Position(__int64)",
        ".idata$6",
        "?QuickSort@?$ArrayList@G@UnBCL@@AAEXPAV12@0HH@Z",
        "?GetEnumerator@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEPAU?$IEnumerator@PAVObject@UnBCL@@@2@XZ",
        "< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\\<`<d<h<l<p<t<x<|<",
        "??4Allocator@UnBCL@@QAEAAV01@ABV01@@Z",
        "?SetString@?$CSimpleStringT@G$0A@@ATL@@QAEXPBGH@Z",
        "??_8?$ArrayList@G@UnBCL@@7B@",
        "?GetBuffer@?$Array@E@UnBCL@@UAEPAEH@Z",
        "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@ABV01@@Z",
        "??4?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
        "9+:Z:a:",
        "u>Wj ",
        "??0BufferedStream@UnBCL@@QAE@ABV01@@Z",
        "?GetHashCode@Object@UnBCL@@UBEHXZ",
        "attempt to expand buffer in nongrowable MemoryStream",
        "??0DirectoryInfo@UnBCL@@QAE@XZ",
        "PQSVW",
        "??4Registry@UnBCL@@QAEAAV01@ABV01@@Z",
        "%s: unexpected value type: %S=%lu",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@DH@Z",
        "=C=U=g=~=",
        "51585?5g5u5",
        "file too large--length > INT64_MAX",
        "?RegisterNamespaces@XmlDocument@UnBCL@@QAEXPAVString@2@@Z",
        "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;",
        "Microsoft Corporation",
        "5'5L5^5p5",
        "=8>`>",
        "233G3l3",
        "class UnBCL::MultiSz *__stdcall UnBCL::MultiSz::FromString(const unsigned short *,unsigned short)",
        "null key to Hashtable#ContainsKey()",
        "?SleepFor@Thread@UnBCL@@SGXI@Z",
        "2)3*4A4H4n4z4",
        "??0?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@QAE@ABV012@@Z",
        "5D6V6e6",
        "__thiscall UnBCL::ArrayList<class UnBCL::String *>::ArrayList(int,int)",
        "void __thiscall UnBCL::StringBuilder::set_Length(int)",
        "??B?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
        "??1?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@XZ",
        "cannot convert DateTime before 1601 to filetime",
        "?0?P?",
        ".PAVExternalException@UnBCL@@",
        "?get_Capacity@MemoryStream@UnBCL@@UBEHXZ",
        "?get_NextSibling@XmlNode@UnBCL@@QAEPAV12@XZ",
        "??_8?$Array@E@UnBCL@@7B?$ICollection@E@1@@",
        "?<?D?L?T?\\?d?l?t?|?",
        ">$>,>4><>H>h>p>x>",
        "xmlns=\"%s\"",
        "7U7s7",
        "?set_Item@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXPAVString@2@0@Z",
        "??0?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@QAE@ABV012@@Z",
        "negative index or count to ArrayList#BinarySearch",
        "const unsigned char &__thiscall UnBCL::ArrayList<unsigned char>::get_Item(int) const",
        "??4CaseInsensitiveStringComparer@UnBCL@@QAEAAV01@ABV01@@Z",
        "j\\Xf;",
        "int __thiscall UnBCL::ArrayList<int>::LastIndexOf(int,int,int) const",
        ".?AV?$Array@H@UnBCL@@",
        "> >$>(>,>@>P>T>d>h>|>",
        "?set_Item@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEXHPAVObject@2@@Z",
        "0/0>0",
        ">?uVf9V",
        "??4?$ICollection@PAVString@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
        ">O?`?r?",
        "null srcpath or destpath to File::MoveEx",
        "??4FormatException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??1?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAE@XZ",
        "?get_Chars@StringBuilder@UnBCL@@QBEGH@Z",
        "int __thiscall UnBCL::_::HTEnumerator<struct UnBCL::SerializationStream::UniqueObject,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,struct UnBCL::SerializationStream::UniqueObject,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,&protected: static struct UnBCL::SerializationStream::UniqueObject __stdcall UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "??1exception@@UAE@XZ",
        "8!838B8c8",
        "1 1$1(1,101D1H1L1d1t1",
        "??4TextReader@UnBCL@@QAEAAV01@ABV01@@Z",
        "4$4,444<4D4P4p4x4",
        "__thiscall UnBCL::MemoryStream::MemoryStream(class UnBCL::Array<unsigned char> *,int,int)",
        "9J9U9c9",
        "9*989@9E9Y9j9",
        "int __thiscall UnBCL::ArrayList<class UnBCL::Object *>::LastIndexOf(class UnBCL::Object *,int,int) const",
        "GetTempPathW",
        "int __thiscall UnBCL::String::LastIndexOfAny(const unsigned short *,int,int) const",
        "?Sort@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGXPAV12@@Z",
        "set_Position() on closed FileStream",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@XZ",
        "?Start@Thread@UnBCL@@QAEXXZ",
        ".?AV?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@",
        "?set_Item@?$Array@E@UnBCL@@UAEXHE@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> >::Insert(int,class UnBCL::SmartPtr<class UnBCL::String>)",
        "?GetManager@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEPAUIAtlStringMgr@2@XZ",
        "1 1C1d1k1r1y1",
        "void __thiscall UnBCL::XmlDocument::RegisterNamespaces(class UnBCL::String *)",
        ">??N?s?",
        "?StreamRead@?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@UAEXAAVSerializationStream@3@@Z",
        ">P>k>",
        "?GetFiles@Directory@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBVString@2@0H@Z",
        "??_7?$Array@E@UnBCL@@6B?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        ".?AU?$IEnumerable@E@UnBCL@@",
        "9\":_:v:",
        "?RemoveTail@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXXZ",
        "??4?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive<double>(double &)",
        "<3<:<A<i<v<",
        "?GetHashCode@TimeSpan@UnBCL@@UBEHXZ",
        "unable to wait for process termination",
        "void __stdcall UnBCL::_::HTEnumerator<struct UnBCL::SerializationStream::UniqueObject,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,struct UnBCL::SerializationStream::UniqueObject,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,&protected: static struct UnBCL::SerializationStream::UniqueObject __stdcall UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int> *,class UnBCL::Array<struct UnBCL::SerializationStream::UniqueObject> *,int)",
        "?Remove@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXPAVString@2@@Z",
        ";$;d;v;",
        "?CompareTo@DateTime@UnBCL@@QBEHABV12@@Z",
        "1/161^1i1",
        "trj\\Zf;",
        "??1RegHandle@UnBCL@@UAE@XZ",
        "?get_Version@SerializationId@UnBCL@@QBEHXZ",
        "negative length to StringBuilder#Length",
        ":/:p:",
        "??_7Exception@UnBCL@@6B@",
        ";R;p;",
        "void __thiscall UnBCL::RegistryKey::SetValue(const class UnBCL::String *,const class UnBCL::Array<class UnBCL::String *> *)",
        "?StreamRead@?$SerializableArrayBase@G@_@UnBCL@@UAEXAAVSerializationStream@3@@Z",
        "?SetRef@Allocator@UnBCL@@SGXI@Z",
        "?ToString@StringBuilder@UnBCL@@UBEPAVString@2@XZ",
        "??1StreamWriter@UnBCL@@UAE@XZ",
        "??0StreamWriter@UnBCL@@QAE@PAVStream@1@H@Z",
        "int __thiscall UnBCL::Array<int>::Add(int)",
        "int __thiscall UnBCL::ArrayList<unsigned char>::BinarySearch(int,int,unsigned char,struct UnBCL::IComparer<unsigned char> *)",
        ".?AUIHeapMemory@@",
        "2>2U2",
        ".?AV?$ArrayListEnumerator@E@_@UnBCL@@",
        "__thiscall UnBCL::FileStream::FileStream(void *,enum UnBCL::FileAccess)",
        "}&h<R",
        "<&=8=J=X=|=",
        ")SetSize() on closed FileStream",
        "?get_XMLDOMSchemaCollection@XmlSchemaSet@UnBCL@@QAEPAUIXMLDOMSchemaCollection2@@XZ",
        "2(2G2",
        "__thiscall UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> >::ArrayList(int,int)",
        ")null name to SerializationStream::UnregisterType",
        "??1XmlAttributeCollection@UnBCL@@UAE@XZ",
        "?MIN_MS@TimeSpan@UnBCL@@0_JB",
        "??0XmlNodeList@XmlLite@UnBCL@@QAE@ABV012@@Z",
        "?name@type_info@@QBEPBDXZ",
        ".didat$7",
        "??4Encoding@UnBCL@@QAEAAV01@ABV01@@Z",
        "??4DirectoryInfo@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "939[9",
        "<\"=1=;=",
        "?set_AutoDelete@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXH@Z",
        "?SanitizeTypeName@SerializationStream@UnBCL@@SGPAVString@2@ABV32@@Z",
        "?_LastIndexOf@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@HH@Z",
        "class UnBCL::XmlLite::XmlNode *const &__thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *>::get_Item(int) const",
        "int __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::XmlLite::XmlNode *>::MoveNext(void)",
        "??_7SerializationStream@UnBCL@@6B@",
        "??4?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "void __thiscall UnBCL::StreamWriter::Flush(void)",
        "9'9:9n9",
        "9$909<9X9m9",
        ".?AU?$ICollection@UUniqueObject@SerializationStream@UnBCL@@@UnBCL@@",
        "?Construct@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@SAXPAV12@@Z",
        "GetLineNumber",
        "??0?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@XZ",
        "?DefaultBins@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@0IB",
        "??6SerializationStream@UnBCL@@QAEAAV01@K@Z",
        "?s_Handler@Logging@UnBCL@@0PAUILogHandler@@A",
        "void __thiscall UnBCL::ArrayList<class UnBCL::StringPtr>::AddRange(const struct UnBCL::ICollection<class UnBCL::StringPtr> *)",
        "?Assign@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@AAEXPAVVersion@2@@Z",
        "int __thiscall UnBCL::ArrayList<unsigned short>::LastIndexOf(unsigned short,int,int) const",
        "?MemAllocFailed@Allocator@UnBCL@@SGHXZ",
        "?GetVersionId@?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
        "void __thiscall UnBCL::Array<unsigned short>::InitLarva(class UnBCL::ArrayList<unsigned short> *)",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive<unsigned char>(unsigned char)",
        "?MS_PER_S@TimeSpan@UnBCL@@0HB",
        "8%878S8{8",
        "??1?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
        ")null buf to FileStream#Write",
        "?Nullify@?$SmartPtr@VObject@UnBCL@@@UnBCL@@QAEAAV12@XZ",
        "get_Position() on closed FileStream",
        "??_7?$Array@H@UnBCL@@6B?$SerializableArrayBase@H@_@1@@",
        "??1SerializationStream@UnBCL@@UAE@XZ",
        ".?AVInvalidCastException@UnBCL@@",
        "Flush() on closed BufferedStream",
        "?get_Item@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEABQAVObject@2@H@Z",
        ".?AVUnicodeEncoding@UnBCL@@",
        "??_8?$Stack@H@UnBCL@@7B01@@",
        "??4?$IEnumerable@PBG@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "?DefaultLow@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@0MB",
        ".?AVStreamReader@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<unsigned char>::QuickSort(class UnBCL::ArrayList<unsigned char> *,class UnBCL::ArrayList<unsigned char> *,int,int)",
        "void __thiscall UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::Add(class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *)",
        "8(8H8h8",
        "??1FormatException@UnBCL@@UAE@XZ",
        "8O8^8k8z8",
        "??0XmlAttributeCollection@UnBCL@@QAE@PAUIXMLDOMNamedNodeMap@@@Z",
        ".?AU?$IList@E@UnBCL@@",
        "838>8N8Y8z8",
        "??0MutableString@UnBCL@@QAE@XZ",
        "void __thiscall UnBCL::Array<int>::Remove(int)",
        " move to ",
        "?get_IsFixedSize@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHXZ",
        ":4:8:<:@:D:T:\\:x:",
        "null stream or encoding to StreamReader constructor",
        "__CxxFrameHandler3",
        "_wcsnicmp",
        ">$>,>4><>D>L>T>\\>d>l>t>|>",
        "7S7v7",
        "??_7ThreadStateException@UnBCL@@6B@",
        ".?AU?$ICollection@PAVXmlAttribute@XmlLite@UnBCL@@@UnBCL@@",
        "3(3,3<3@3D3H3P3h3x3|3",
        ".?AV?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@",
        "1(0&0",
        "__thiscall UnBCL::ArrayList<class UnBCL::String *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::String *> *)",
        "int __stdcall UnBCL::Directory::IsDirectoryEmpty(const class UnBCL::String *)",
        "6&757r7",
        "tuVj$",
        "??0ObjectDisposedException@UnBCL@@QAE@PBVString@1@@Z",
        "unsigned long __thiscall UnBCL::RegistryKey::GetValue(const class UnBCL::String *)",
        "??0SystemException@UnBCL@@QAE@$$QAV01@@Z",
        ".?AU?$IDictionaryEnumerator@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@",
        ".?AVFormatException@UnBCL@@",
        ".PAVOutOfMemoryException@UnBCL@@",
        "4H4W4v4",
        "?SetString@?$CSimpleStringT@G$0A@@ATL@@QAEXPBG@Z",
        "??_7TextReader@UnBCL@@6B@",
        ".?AV?$Stack@H@UnBCL@@",
        "??D?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEAAV?$Array@PAVString@UnBCL@@@1@XZ",
        "?Assign@?$SmartPtr@VStream@UnBCL@@@UnBCL@@AAEXPAVStream@2@@Z",
        "void __stdcall UnBCL::Monitor::Enter(class UnBCL::SyncObject *)",
        "??_7?$SerializableArrayBase@E@_@UnBCL@@6BISerializable@2@@",
        "uCSj$",
        "?S?t?",
        "class UnBCL::ArrayList<int> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<int>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "void __thiscall UnBCL::Array<class UnBCL::SmartPtr<class UnBCL::String> >::RemoveAt(int)",
        "int __stdcall UnBCL::ArrayList<unsigned short>::IndexOf(const class UnBCL::ArrayList<unsigned short> *,unsigned short,int,int)",
        "?Dispose@RegistryKey@UnBCL@@UAEXXZ",
        "7R7d7v7",
        "?get_Count@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
        "2.2G2b2",
        "??_7Process@UnBCL@@6BIDisposable@1@@",
        "??_7XmlException@UnBCL@@6B@",
        ">(>`>r>",
        "??0UnicodeEncoding@UnBCL@@QAE@XZ",
        "Flush() on closed StreamWriter",
        "void __thiscall UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> >::QuickSort(class UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> > *,class UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> > *,int,int)",
        "?CheckImplicitLoad@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@AAE_NPBX@Z",
        "??4File@UnBCL@@QAEAAV01@ABV01@@Z",
        "void __thiscall UnBCL::Array<class UnBCL::StringPtr>::InitLarva(class UnBCL::ArrayList<class UnBCL::StringPtr> *)",
        "CreateFileW",
        "?get_Type@OperatingSystem@UnBCL@@QBE?AW4InstallationType@2@XZ",
        "null byteArray to MemoryStream constructor",
        ".?AVXmlNode@XmlLite@UnBCL@@",
        "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7B?$ICollection@PAVString@UnBCL@@@1@@",
        ".?AVUnicodeDecoder@UnicodeEncoding@UnBCL@@",
        ".?AVXmlDocument@UnBCL@@",
        "??D?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBEAAVEncoding@1@XZ",
        "empty srcpath or destpath to File::Copy",
        "?Equals@Version@UnBCL@@UBEHPBVObject@2@@Z",
        "8\"848",
        "8E8W8v8",
        "2;2k2",
        "const unsigned char *__thiscall UnBCL::ArrayList<unsigned char>::GetBuffer(int) const",
        "??4Monitor@UnBCL@@QAEAAV01@ABV01@@Z",
        ">0>X>|>",
        "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAE@XZ",
        "=-=Q=t=",
        "const unsigned short &__thiscall UnBCL::ArrayList<unsigned short>::get_Item(int) const",
        "tASj ",
        "5+5:5X5j5y5",
        "??1XmlNode@UnBCL@@UAE@XZ",
        "444<4D4X4`4h4x4",
        "??D?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QBEAAVSerializationStream@1@XZ",
        ".?AV?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "??6SerializationStream@UnBCL@@QAEAAV01@E@Z",
        "null name to Environment::SetEnvironmentVar",
        "4(4:4H4j4~4",
        "CreateXmlReader",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "??_7?$Array@G@UnBCL@@6B?$IList@G@1@@",
        "??0ArgumentNullException@UnBCL@@QAE@XZ",
        "void __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *>::RemoveAt(int)",
        "int __thiscall UnBCL::UnicodeEncoding::GetBytes(const class UnBCL::String *,int,int,class UnBCL::Array<unsigned char> *,int) const",
        "The delimiter argument cannot be null character",
        "??_7ASCIIEncoding@UnBCL@@6BObject@1@@",
        "??4ExternalException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "393d3",
        ">8>@>L>l>t>|>",
        "int __thiscall UnBCL::StreamReader::Read(void)",
        "??_7AbandonedMutexException@UnBCL@@6B@",
        "5$5@5M5p5",
        "??_7?$SmartPtr@VString@UnBCL@@@UnBCL@@6B@",
        "??_8?$Array@H@UnBCL@@7B?$SerializableArrayBase@H@_@1@@",
        "1 191",
        "class UnBCL::String *__thiscall UnBCL::FileSystemEnumerator::get_CurrentFileName(void) throw(...) const",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive<float>(float &)",
        "s>Vj ",
        "??0ArgumentNullException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
        ":9;x;",
        "2.2@2O2`2w2",
        "u<j@^V",
        "int __thiscall UnBCL::FileSystemEnumerator::get_IsDirectory(void) throw(...)",
        "??4XmlAttributeCollection@XmlLite@UnBCL@@QAEAAV012@ABV012@@Z",
        "??_8StringPtr@UnBCL@@7B@",
        "1 1$1(1@1D1\\1`1x1",
        "??_8?$ArrayList@PAVString@UnBCL@@@UnBCL@@7B?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "?get_Prefix@XmlNode@XmlLite@UnBCL@@QBEPAVString@3@XZ",
        "null key to Hashtable#Item",
        "??1?$SmartPtr@VStream@UnBCL@@@UnBCL@@UAE@XZ",
        "?GetTypeName@?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
        "535T5g5v5",
        "?get_Ticks@TimeSpan@UnBCL@@QBE_JXZ",
        ".CRT$XCZ",
        "2=2[2",
        ";/<V<c<i<r<",
        "??0ApplicationException@UnBCL@@QAE@PAVException@1@PBG@Z",
        "??4?$IList@PAVString@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
        "?CopyTo@?$Stack@H@UnBCL@@UBEXPAV?$Array@H@2@H@Z",
        "null value to String constructor",
        "<%=m>{>K?",
        "?Reverse@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXXZ",
        "8)9v9",
        "2<2[2u2",
        ".?AU?$IEnumerable@PAVObject@UnBCL@@@UnBCL@@",
        "?Free@Allocator@UnBCL@@SGXPAXI@Z",
        "??0exception@@QAE@XZ",
        "null list to ArrayList::Sort",
        "??0TimeSpan@UnBCL@@QAE@HHHHH@Z",
        "?CompareTo@DateTime@UnBCL@@UBEHPBVObject@2@@Z",
        ".?AU?$IDictionaryEnumerator@PAVString@UnBCL@@PAV12@@UnBCL@@",
        ".PAVArgumentOutOfRangeException@UnBCL@@",
        "??B?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
        ":>:w:",
        "void __stdcall UnBCL::ArrayList<int>::Sort(class UnBCL::ArrayList<int> *)",
        "?GetTypeName@?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
        "=)=^=",
        ".text$yd",
        "??1Monitor@UnBCL@@EAE@XZ",
        "?CreateXmlNode@XmlNode@UnBCL@@SGPAV12@PAUIXMLDOMNode@@@Z",
        ".CRT$XIAA",
        "??_7?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
        ".?AV?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "??_7XPathException@UnBCL@@6B@",
        "int __stdcall UnBCL::Array<unsigned short>::LastIndexOf(const class UnBCL::Array<unsigned short> *,unsigned short,int,int)",
        "??1?$IList@PAVString@UnBCL@@@UnBCL@@UAE@XZ",
        "?GetHandler@Logging@UnBCL@@SGPAUILogHandler@@XZ",
        "?LastIndexOf@String@UnBCL@@QBEHG@Z",
        "??_7OverflowException@UnBCL@@6B@",
        "??0IDisposable@UnBCL@@QAE@ABU01@@Z",
        ".?AVMemoryStream@UnBCL@@",
        ".?AV?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "??_7?$Array@E@UnBCL@@6BISerializable@1@@",
        "ReleaseSemaphore",
        "??0ArithmeticException@UnBCL@@QAE@$$QAV01@@Z",
        "1?2|2",
        ": ;x;",
        "??0XmlDocument@UnBCL@@QAE@XZ",
        "0(1S1X1",
        "2)2d2}2",
        "?get_Item@?$Stack@H@UnBCL@@UBEABHH@Z",
        "&?)VS",
        "?INVALID_PATH_CHARS@Path@UnBCL@@0VString@2@B",
        ".?AV?$SmartPtr@U?$IEnumerator@H@UnBCL@@@UnBCL@@",
        "Seek() before beginning of FileStream",
        "?IndexOfAny@String@UnBCL@@QBEHPBGH@Z",
        "?set_Arguments@ProcessStartInfo@UnBCL@@QAEXPBVString@2@@Z",
        "??0ExternalException@UnBCL@@QAE@PBVString@1@@Z",
        "??0WaitHandle@UnBCL@@QAE@ABV01@@Z",
        "?get_TotalDays@TimeSpan@UnBCL@@QBENXZ",
        "??0IDisposable@UnBCL@@QAE@$$QAU01@@Z",
        "class UnBCL::",
        "index out of range to ArrayList#CopyTo",
        "Microsoft Corporation1&0$",
        "??_8Mutex@UnBCL@@7BWaitHandle@1@@",
        ".?AVOperatingSystem@UnBCL@@",
        "?get_Architecture@OperatingSystem@UnBCL@@QBEKXZ",
        "?NumBlocksAllocated@HeapMemoryManager@UnBCL@@UAEIXZ",
        "?ReAllocDbg@Allocator@UnBCL@@SGPAXPAXKPBDHI@Z",
        ">->C>a>h>o>v>}>",
        "bad allocation",
        "??4MultiSz@UnBCL@@QAEAAV01@ABV01@@Z",
        "?Steal@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAEPAVEncoding@2@XZ",
        "ReleaseSRWLockExclusive",
        "unable to set environment variable",
        "??_8StreamWriter@UnBCL@@7B@",
        "?Truncate@?$CSimpleStringT@G$0A@@ATL@@QAEXH@Z",
        "?get_Position@FileStream@UnBCL@@UBE_JXZ",
        "?IsValid@Path@UnBCL@@SGHPBG@Z",
        ":$:,:4:<:H:h:p:|:",
        "??4?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "NumberOfProcessors",
        "?get_Item@?$ArrayList@G@UnBCL@@UBEABGH@Z",
        "saw negative index in stream",
        "??1Encoding@UnBCL@@UAE@XZ",
        "??_7?$SerializableArrayBase@G@_@UnBCL@@6B@",
        "??_7WaitHandle@UnBCL@@6B01@@",
        "tb9{pt]Wj,",
        "overflow in SerializationStream#ReadBytes",
        "startIndex or count out of range to Remove()",
        "1@1L1",
        "?Clone@Object@UnBCL@@UBEPAV12@XZ",
        "?get_Count@?$Stack@H@UnBCL@@UBEHXZ",
        "??4?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "??1?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@UAE@XZ",
        "?get_FindData@FileSystemEnumerator@UnBCL@@QAEABU_WIN32_FIND_DATAW@@XZ",
        "?Seek@BufferedStream@UnBCL@@UAE_J_JW4SeekOrigin@2@@Z",
        "??0?$IComparer@PAVString@UnBCL@@@UnBCL@@QAE@XZ",
        ".?AV?$ArrayList@PAVXmlNode@XmlLite@UnBCL@@@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<int>::QuickSort(class UnBCL::ArrayList<int> *,class UnBCL::ArrayList<int> *,int,int)",
        "?Contains@XmlSchemaSet@UnBCL@@QAEHPAVString@2@@Z",
        "??1String@UnBCL@@UAE@XZ",
        "??0String@UnBCL@@QAE@XZ",
        "?GetDictionaryEnumerator@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAU?$IDictionaryEnumerator@PAVString@UnBCL@@PAV12@@2@XZ",
        "??0HeapMemoryManager@UnBCL@@QAE@ABV01@@Z",
        "?$?G?Y?k?y?",
        "6%6C6g6",
        "??C?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QBEPAVSerializationId@1@XZ",
        "?Wait@Monitor@UnBCL@@SGHPAVSyncObject@2@@Z",
        "??0HeapMemoryManager@UnBCL@@QAE@XZ",
        "?set_Counter@Stream@UnBCL@@QAEXPAVStreamCounter@2@@Z",
        "??0?$IList@PAVString@UnBCL@@@UnBCL@@QAE@XZ",
        "??0ArgumentException@UnBCL@@QAE@ABV01@@Z",
        ".?AV?$HTDictEnumBase@H@_@UnBCL@@",
        "class UnBCL::String *__thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,class ATL::CElementTraits<class UnBCL::String *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "??4?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@QAEAAV012@ABV012@@Z",
        "?s_Registration@?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVObject@UnBCL@@@UnBCL@@@UnBCL@@",
        "?SetOOMHandler@Allocator@UnBCL@@SGXPAUIOutOfMemoryHandler@@@Z",
        "??4AbandonedMutexException@UnBCL@@QAEAAV01@ABV01@@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::String *>::AddRange(const struct UnBCL::ICollection<class UnBCL::String *> *)",
        "?IndexOf@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHPAVString@2@@Z",
        "??0Version@UnBCL@@QAE@XZ",
        "J +J$",
        "000S0",
        "2$2,242<2D2L2T2\\2d2p2",
        "6%7d7",
        "null chars to ASCIIEncoding#GetByteCount",
        "637S7Z7a7",
        "startIndex out of range to IndexOf()",
        "1T2|3",
        "??_7?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@6BObject@1@@",
        ")null collection to ArrayList constructor",
        "??1OperatingSystem@UnBCL@@UAE@XZ",
        "0 0(00080D0d0l0x0",
        "??0SecurityException@UnBCL@@QAE@ABV01@@Z",
        "??0OverflowException@UnBCL@@QAE@$$QAV01@@Z",
        "~FVj ",
        "empty path to Path::GetFullPath",
        "?GetLogicalDriveNames@Environment@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@XZ",
        "??0?$Stack@PAVObject@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        "?GetBinaryValue@RegistryKey@UnBCL@@QAEPAV?$Array@E@2@PBVString@2@@Z",
        "source file to File::Move not found",
        "??0?$Array@PAVString@UnBCL@@@UnBCL@@QAE@HH@Z",
        "?get_LinePosition@XmlException@UnBCL@@UAEHXZ",
        "??4Mutex@UnBCL@@QAEAAV01@ABV01@@Z",
        "??_7?$SerializableStackBase@H@_@UnBCL@@6B?$ICollection@H@2@@",
        "1*181",
        "0 0004080@0H0`0p0t0x0|0",
        "717}7",
        "?_LastIndexOfAny@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@HH@Z",
        "null version string to Version constructor",
        "??0?$IList@H@UnBCL@@QAE@XZ",
        "class UnBCL::Object **__thiscall UnBCL::ArrayList<class UnBCL::Object *>::GetBuffer(int)",
        "??0?$Array@PAVString@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        "??0?$ArrayList@G@UnBCL@@QAE@PBU?$ICollection@G@1@@Z",
        "1B2P2^2l2z2",
        "??0?$SerializableArrayBase@H@_@UnBCL@@QAE@XZ",
        ")null stream to StreamWriter constructor",
        "?FromSeconds@TimeSpan@UnBCL@@SG?AV12@N@Z",
        ">J?u?",
        "?GetCurrentDir@Directory@UnBCL@@SGPAVString@2@XZ",
        "int __stdcall UnBCL::MP::OperatorCompare<unsigned char>::Compare(unsigned char,unsigned char)",
        "??4Environment@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??4Directory@UnBCL@@QAEAAV01@ABV01@@Z",
        "??4OverflowException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "6$60686P6X6|6",
        "4P4b4t4",
        "??_7?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
        "?get_Item@?$Array@H@UnBCL@@UAEAAHH@Z",
        "??4Directory@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??0OperatingSystem@UnBCL@@QAE@ABV01@@Z",
        "class UnBCL::String *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::String *>::get_Current(void) const",
        "?GetBuffer@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEPBQAVObject@2@H@Z",
        "int __stdcall UnBCL::ArrayList<int>::BinarySearch(class UnBCL::ArrayList<int> *,int,struct UnBCL::IComparer<int> *)",
        "210303183038Z0p1",
        ">(>S>t>{>",
        "ResumeThread",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive<unsigned char>(unsigned char &)",
        "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "int __thiscall UnBCL::String::StartsWith(const unsigned short *,int) const",
        "t!h@t",
        "??_7?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@6B?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@",
        "__thiscall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::Hashtable(const struct UnBCL::IDictionary<class UnBCL::String *,class UnBCL::String *> *)",
        "??_8?$Array@G@UnBCL@@7BISerializable@1@@",
        "?s_Registration@?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
        "??_7OutOfMemoryException@UnBCL@@6B@",
        "null chars to UnicodeEncoding#GetByteCount",
        "9(9H9a9f9p9",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@ABUtagVARIANT@@PAUIAtlStringMgr@1@@Z",
        "?E?R?X?a?",
        "__thiscall UnBCL::StringBuilder::StringBuilder(int)",
        "?DeleteRange@?$ArrayList@G@UnBCL@@AAEXHH@Z",
        "OriginalFilename",
        "4!4(4/464=4",
        ".?AVBufferedStream@UnBCL@@",
        "Model",
        "98u;;M",
        "6D7x7",
        "<9=B=P=",
        "= =(=\\=l=x=",
        "9(9M9_9q9",
        ".?AVXmlAttributeCollection@UnBCL@@",
        "7$7<7L7P7T7h7l7p7",
        "@.reloc",
        "PPPPPW",
        "<S=u={=",
        "negative count to String constructor",
        "??0?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@IAE@XZ",
        "??0FormatException@UnBCL@@QAE@PAVString@1@@Z",
        "?get_IsFixedSize@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
        "??0StringPtr@UnBCL@@QAE@V?$SmartPtr@VString@UnBCL@@@1@@Z",
        "void __stdcall UnBCL::_::HTEnumerator<struct UnBCL::SerializationStream::UniqueObject,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,class UnBCL::DictionaryEntry<struct UnBCL::SerializationStream::UniqueObject,int>,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<struct UnBCL::SerializationStream::UniqueObject,int> __stdcall UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int> *,class UnBCL::Array<class UnBCL::DictionaryEntry<struct UnBCL::SerializationStream::UniqueObject,int> > *,int)",
        "int __stdcall UnBCL::Path::IndexOfEndOfLongPrefix(const class UnBCL::String *)",
        "?Steal@?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAEPAVStream@2@XZ",
        "get_Position() on closed BufferedStream",
        "?GetBufferSetLength@?$CSimpleStringT@G$0A@@ATL@@QAEPAGH@Z",
        "6#6-6:6@6|6",
        ".?AU?$IEnumerable@UUniqueObject@SerializationStream@UnBCL@@@UnBCL@@",
        "8>8Y8",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAV12@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@2@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@2@UKeyTraits@42@$1?RetrieveEntry@42@KG?AV52@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@PAVString@3@UKeyTraits@23@V?$CElementTraits@PAVString@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "5 5.5<5J5X5f5",
        "?get_Item@?$Array@H@UnBCL@@UBEABHH@Z",
        "??0Mutex@UnBCL@@QAE@XZ",
        "??4?$IEnumerable@PAVString@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "8\\t&j",
        "??0?$SerializableStackBase@H@_@UnBCL@@QAE@XZ",
        "void __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::XmlLite::XmlAttribute *>::Reset(void)",
        "8'8L8]8f8~8",
        "??0?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
        "UnBCL::HeapMemoryManager::InternalFree",
        "3h4s4",
        "=h=u=",
        "?ToMultisz@MultiSz@UnBCL@@SGPAGABU?$ICollection@PAVString@UnBCL@@@2@@Z",
        "MultiByteToWideChar",
        "9E9e9k9",
        "9(:L:l:",
        "??0UnicodeEncoding@UnBCL@@QAE@ABV01@@Z",
        "ix, cout, or byteix out of range to ASCIIEncoding#GetBytes",
        "int __thiscall UnBCL::String::_IndexOf(class UnBCL::SmartPtr<class UnBCL::String>,int) const",
        "null path to Path::WithLongPrefix",
        "Microsoft Time-Stamp PCA 20100",
        ">5>S>",
        "__int64 __thiscall UnBCL::MemoryStream::get_Length(void) const",
        "_SetRunningFlag@4",
        "?SetValue@RegistryKey@UnBCL@@QAEXPBVString@2@0H@Z",
        "<\"<=<^<q<",
        "?Match@String@UnBCL@@SGHPBV12@0@Z",
        "?Write@BufferedStream@UnBCL@@UAEXPBEHH@Z",
        "??0?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
        "int __thiscall UnBCL::_::HTEnumerator<struct UnBCL::SerializationStream::UniqueObject,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::MoveNext(void)",
        "??1XmlDocument@UnBCL@@UAE@XZ",
        "??7?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBE_NXZ",
        "??_7?$Array@H@UnBCL@@6B?$ICollection@H@1@@",
        "?Contains@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEHPAVObject@2@@Z",
        "unable to start thread",
        "j!Yf;",
        "int __stdcall UnBCL::Array<class UnBCL::Object *>::LastIndexOf(const class UnBCL::Array<class UnBCL::Object *> *,class UnBCL::Object *,int,int)",
        ".CRT$XCL",
        "attempt to delete nonexistent subkey tree",
        "=<=H=h=t=",
        "4!5n5",
        "??4ThreadStateException@UnBCL@@QAEAAV01@ABV01@@Z",
        "??_8FileSystemEnumerator@UnBCL@@7B@",
        "??4?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
        "7#7C7k7",
        "0$0,0@0P0\\0|0",
        ".?AU?$IEnumerable@PAVXmlAttribute@XmlLite@UnBCL@@@UnBCL@@",
        "u&Sj ",
        "??0RegHandle@UnBCL@@QAE@XZ",
        "int __thiscall UnBCL::ArrayList<class UnBCL::StringPtr>::LastIndexOf(class UnBCL::StringPtr,int,int) const",
        "Type is not comparable",
        ";$;,;8;@;X;h;",
        ";(;M;_;q;",
        ":!:R:s:",
        "??_7Mutex@UnBCL@@6B@",
        "4\"4q4",
        ">7>n>",
        ".?AVArgumentOutOfRangeException@UnBCL@@",
        "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6B?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "?LoadXml@XmlDocument@UnBCL@@QAEXPAVString@2@@Z",
        "8D8^8",
        "0K0g0",
        "4>5W5",
        "=5=G=b=l=",
        "??7?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QBE_NXZ",
        "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6BISerializable@1@@",
        "?Join@Thread@UnBCL@@QAEXXZ",
        "VS_VERSION_INFO",
        "??0?$Array@H@UnBCL@@IAE@XZ",
        "unable to get DWORD value on key",
        "??0?$CSimpleStringT@G$0A@@ATL@@QAE@PBGHPAUIAtlStringMgr@1@@Z",
        "?LeaveSection@SyncObject@UnBCL@@IAEXXZ",
        "u%f9O",
        "__thiscall UnBCL::Version::Version(int,int)",
        "void __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *>::AddRange(const struct UnBCL::ICollection<class UnBCL::XmlLite::XmlAttribute *> *)",
        "?Equals@?$Array@E@UnBCL@@UBEHPBVObject@2@@Z",
        "null keyname to RegistryKey#CreateSubKey",
        ".?AU?$IEnumerable@PAVSerializationId@UnBCL@@@UnBCL@@",
        "Array doesn't support Add()",
        "?IsDirectoryEmpty@Directory@UnBCL@@SGHPBVString@2@@Z",
        "758w8",
        "?get_Count@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
        "?get_AutoDeleteValue@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHXZ",
        "4R4v4",
        "7#8B8c8",
        "unable to open subkey",
        "?Dispose@BufferedStream@UnBCL@@UAEXXZ",
        "?get_P@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$Array@PAVString@UnBCL@@@2@XZ",
        "int __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *>::LastIndexOf(class UnBCL::XmlLite::XmlNode *,int,int) const",
        "??1RegistryKey@UnBCL@@UAE@XZ",
        "_wcsncoll",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *>,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,class ATL::CElementTraits<class UnBCL::String *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *> *,class UnBCL::Array<class UnBCL::DictionaryEntry<class UnBCL::String *,class UnBCL::String *> > *,int)",
        "?Copy@String@UnBCL@@SGPAV12@PBV12@@Z",
        "1=1`1t1",
        " !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~",
        "?IsDriveLetterOrUncPrefix@Path@UnBCL@@SGHPBVString@2@@Z",
        "0Shtl",
        "?GetWindowsDir@Directory@UnBCL@@SGPAVString@2@XZ",
        "?Nullify@?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAEAAV12@XZ",
        "?Assign@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@AAEXPAVDecoder@2@@Z",
        "??_8StreamWriter@UnBCL@@7BTextWriter@1@@",
        "??_7?$ArrayList@G@UnBCL@@6BObject@1@@",
        "?get_ProcessorMaxClock@SystemInfo@UnBCL@@QBEKXZ",
        "5D5g5",
        "??_8?$ArrayList@PAVString@UnBCL@@@UnBCL@@7B?$ICollection@PAVString@UnBCL@@@1@@",
        "unsigned short __thiscall UnBCL::StringPtr::operator [](int) const",
        "?DeAssign@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@AAEXXZ",
        "7 7(70787H7l7t7|7",
        "j:Xf9F",
        "6\"6E6",
        "=M=w=",
        "?Format@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXIZZ",
        "??1FileStream@UnBCL@@UAE@XZ",
        "DebugBreak",
        "??_8Process@UnBCL@@7B01@@",
        "_unlock",
        "??_7?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@6B?$ICollection@G@2@@",
        "tnull value to String#IndexOf",
        "?StreamWrite@MultiSz@UnBCL@@UBEXAAVSerializationStream@2@@Z",
        "?Move@File@UnBCL@@SGXPBVString@2@0@Z",
        "0(0A0H0O0w0",
        "void __thiscall UnBCL::ArrayList<unsigned char>::RemoveAt(int)",
        ";(;4;T;\\;h;",
        "4;6l7",
        "??_7?$Array@H@UnBCL@@6BObject@1@@",
        "9'929=9I9b9i9p9",
        "const int &__thiscall UnBCL::ArrayList<int>::get_Item(int) const",
        "GetLastError",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@E@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "?get_Year@DateTime@UnBCL@@QBEHXZ",
        ".?AU?$IEnumerator@PAVXmlNode@XmlLite@UnBCL@@@UnBCL@@",
        "?$?4?8?<?T?X?\\?`?d?l?p?x?",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PAUIAtlStringMgr@1@@Z",
        "??0XmlNodeList@UnBCL@@IAE@XZ",
        "?WritePhantomObject@SerializationStream@UnBCL@@QAEHPBVObject@2@@Z",
        ">P>e>{>",
        ":x: ;",
        "void __thiscall UnBCL::MultiSz::Add(const unsigned short *)",
        "?$?2?@?N?",
        "??_7?$Array@G@UnBCL@@6BISerializable@1@@",
        "?LastIndexOfAny@String@UnBCL@@QBEHPBGHH@Z",
        "ntdll.dll",
        "??4Registry@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "?Subtract@DateTime@UnBCL@@QBE?AV12@ABVTimeSpan@2@@Z",
        "attempt to set bad MemoryStream position",
        "7\"7K7",
        "??0ISerializable@UnBCL@@QAE@ABU01@@Z",
        ";c;m;z;",
        "8#9@9h9w9",
        "int __thiscall UnBCL::ArrayList<unsigned short>::BinarySearch(int,int,unsigned short,struct UnBCL::IComparer<unsigned short> *)",
        "nbase\\ntsetup\\unbcl\\src\\streamreader.cpp",
        "?TICKS_PER_H@DateTime@UnBCL@@1_JB",
        "?GetByteCount@Encoding@UnBCL@@UBEHPBVString@2@@Z",
        "?get_IsFixedSize@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
        "7E7Q7",
        ":c:q:|:",
        "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7B?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "?get_Major@Version@UnBCL@@QBEHXZ",
        "?Sort@?$ArrayList@G@UnBCL@@SGXPAV12@@Z",
        "StreamReader::Close throw an Win32Exception",
        "?get_Root@XmlDocument@XmlLite@UnBCL@@QBEPAVXmlNode@23@H@Z",
        "?s_Registration@?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@0UStaticTypeRegistration@12@A",
        "<#<*<R<]<k<y<",
        "W$9W,",
        "NtQuerySystemInformation",
        "? ?$?(?,?0?4?8?<?@?D?H?L?P?d?h?x?|?",
        "??0?$IEnumerable@E@UnBCL@@QAE@XZ",
        "?Compare@CaseInsensitiveStringComparer@UnBCL@@EAEHPAVString@2@0@Z",
        "4#4@4E4r4",
        ".didat$2",
        "GetFullPathNameW",
        "??4ArgumentNullException@UnBCL@@QAEAAV01@ABV01@@Z",
        "u'Vj`",
        ".?AU?$IEnumerable@H@UnBCL@@",
        "??1?$ArrayList@G@UnBCL@@UAE@XZ",
        "??4?$IList@G@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "?get_IsFixedSize@?$Array@E@UnBCL@@UBEHXZ",
        "??_7StringPtr@UnBCL@@6B?$SmartPtr@VString@UnBCL@@@1@@",
        "7'7V7q7",
        "void __thiscall UnBCL::Array<class UnBCL::String *>::Insert(int,class UnBCL::String *)",
        "??0ArgumentException@UnBCL@@QAE@$$QAV01@@Z",
        "363K3k3",
        "?*???^?p?",
        ";4;C;K;n;",
        "?FixupPath@RegistryKey@UnBCL@@AAEXAAVStringBuilder@2@@Z",
        "uCVj$",
        "1(1H1P1X1`1h1t1",
        "303|3",
        "WaitForSingleObject",
        "??0SyncObject@UnBCL@@QAE@ABV01@@Z",
        "5#6B6",
        "?TrimRight@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@G@Z",
        "656P6g6~6",
        "??_7OperatingSystem@UnBCL@@6B@",
        "??1Type@UnBCL@@UAE@XZ",
        ".?AVSEHException@UnBCL@@",
        ";3;w;",
        "3-4<4S4",
        "??0?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@QAE@ABV012@@Z",
        "??4?$IList@E@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "??_DMonitor@UnBCL@@AAEXXZ",
        "?get_Capacity@?$ArrayList@G@UnBCL@@UBEHXZ",
        "index and/or count out of range to ArrayList#IndexOf",
        "??_DSEHException@UnBCL@@QAEXXZ",
        "??0XmlDocument@XmlLite@UnBCL@@QAE@ABV012@@Z",
        "null value to RegistryKey#SetValue",
        "??1?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@UAE@XZ",
        "?Push@?$Stack@PAVObject@UnBCL@@@UnBCL@@UAEXPAVObject@2@@Z",
        "??0XmlAttribute@UnBCL@@QAE@$$QAV01@@Z",
        "?'?:?F?N?",
        "??0Monitor@UnBCL@@QAE@ABV01@@Z",
        "2,3>3P3c3",
        "?get_TotalSeconds@TimeSpan@UnBCL@@QBENXZ",
        "?TrimStart@String@UnBCL@@QBEPAV12@PBG@Z",
        "void __thiscall UnBCL::RegistryKey::SetValue(const class UnBCL::String *,const class UnBCL::String *,int)",
        "null path to Path::IndexOfEndOfLongPrefix",
        "?StreamRead@?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@UAEXAAVSerializationStream@3@@Z",
        "??1?$ICollection@E@UnBCL@@UAE@XZ",
        "??1SecurityException@UnBCL@@UAE@XZ",
        "?DeleteSubKey@RegistryKey@UnBCL@@QAEXPBVString@2@@Z",
        ".?AVXmlAttribute@UnBCL@@",
        "??4StreamReader@UnBCL@@QAEAAV01@ABV01@@Z",
        "?set_NewLine@TextWriter@UnBCL@@UAEXPBVString@2@@Z",
        "9,9<9L9P9X9\\9`9d9h9l9p9t9x9|9",
        "5/6A6c6",
        ")null list to ArrayList::LastIndexOf",
        "?DeleteInternal@File@UnBCL@@CGXPBVString@2@@Z",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "??0Win32Exception@UnBCL@@QAE@$$QAV01@@Z",
        "_wcsicmp",
        "8D8V8h8",
        "0*0<0K0",
        "??_8UnicodeEncoding@UnBCL@@7BEncoding@1@@",
        "??4Stream@UnBCL@@QAEAAV01@ABV01@@Z",
        ":(:J:g:",
        "7$7(787H7L7`7d7|7",
        ".?AV?$SmartPtr@VStringBuilder@UnBCL@@@UnBCL@@",
        "??_8?$Array@H@UnBCL@@7B?$IList@H@1@@",
        "536P6W6^6",
        "??4?$ICollection@E@UnBCL@@QAEAAU01@ABU01@@Z",
        "null path to Directory::CreateDirectory",
        "?WithLongPrefixStd@Path@UnBCL@@SGPAVString@2@PBV32@H@Z",
        ";0;`;",
        "?get_IsFixedSize@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
        "int __thiscall UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> >::LastIndexOf(class UnBCL::SmartPtr<class UnBCL::String>,int,int) const",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBDPAUIAtlStringMgr@1@@Z",
        ".?AV?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@UnBCL@@",
        "?CompareTo@Char@UnBCL@@UBEHPBVObject@2@@Z",
        "??0?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        "FindResourceExW",
        ".?AV?$SmartPtr@U?$IEnumerator@PAVTypeFactoryList@SerializationStream@UnBCL@@@UnBCL@@@UnBCL@@",
        "GetLogicalDrives",
        "?Left@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@H@Z",
        "4 434W4",
        "??_7?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@6B@",
        "?get_NewLine@TextWriter@UnBCL@@UBEPBVString@2@XZ",
        "?InnerList@?$Array@PAVObject@UnBCL@@@UnBCL@@MBEPAV?$ArrayList@PAVObject@UnBCL@@@2@XZ",
        "unable to get current thread's handle",
        "int __thiscall UnBCL::Object::CompareTo(const class UnBCL::Object *) const",
        "?SetEnvironmentVar@Environment@UnBCL@@SGXPBVString@2@0@Z",
        "class UnBCL::Object *const &__thiscall UnBCL::ArrayList<class UnBCL::Object *>::get_Item(int) const",
        "??0ArithmeticException@UnBCL@@QAE@PBG@Z",
        "%s: %s [0x%08X]",
        "int __stdcall UnBCL::ASCIIEncoding::SGetChars(const class UnBCL::Array<unsigned char> *,int,int,class UnBCL::Array<unsigned short> *,int)",
        "?TrimRight@MutableString@UnBCL@@QAEXPBG@Z",
        "?IndexOf@?$Array@G@UnBCL@@SGHPBV12@GHH@Z",
        "?DeAssign@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@AAEXXZ",
        "MoveToFirstAttribute",
        "5)52575=5G5Q5a5q5w5",
        "??1SerializationId@UnBCL@@UAE@XZ",
        "283Z3q3",
        "686[6",
        ">I>d>",
        "?get_Win32ErrorCode@Win32Exception@UnBCL@@QBEKXZ",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::operator >>(class UnBCL::SmartPtr<struct UnBCL::ISerializable> &)",
        ")null array to Array::LastIndexOf",
        " Microsoft Operations Puerto Rico1",
        "??0AbandonedMutexException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
        "??_7CaseInsensitiveStringComparer@UnBCL@@6B?$IComparer@PAVString@UnBCL@@@1@@",
        ">/?o?",
        "5#5<5c5",
        "= =$=(=,=0=8=P=T=l=p=",
        ";#;x;",
        "8*8C8u8",
        "3%373c3",
        "??4?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@ABV01@@Z",
        "source and destination for move must have same root",
        "?FromMultiSzEx@MultiSz@UnBCL@@SG?AV?$SmartPtr@V?$Array@VStringPtr@UnBCL@@@UnBCL@@@2@PBG@Z",
        "?Load@XmlDocument@XmlLite@UnBCL@@QAEXPAUIStream@@@Z",
        "?IndexOf@?$Array@E@UnBCL@@SGHPBV12@EHH@Z",
        "??0FileSystemEnumerator@UnBCL@@QAE@ABV01@@Z",
        "??_7?$Stack@PAVObject@UnBCL@@@UnBCL@@6B01@@",
        ".?AV?$DictionaryEntry@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@",
        "2D2h2",
        "??4SystemInfo@UnBCL@@QAEAAV01@ABV01@@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> >::Resize(int,int)",
        "??4Version@UnBCL@@QAEAAV01@ABV01@@Z",
        "??0ConsoleLogHandler@UnBCL@@QAE@ABV01@@Z",
        "QQSVW",
        "int __stdcall UnBCL::String::IndexOfAny(const unsigned short *,const unsigned short *,int,int)",
        "?Nullify@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QAEAAV12@XZ",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBDH@Z",
        "??0ArgumentNullException@UnBCL@@QAE@PBVString@1@@Z",
        "vMVj ",
        "??0Encoding@UnBCL@@QAE@ABV01@@Z",
        "class UnBCL::SmartPtr<class UnBCL::String> &__thiscall UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> >::get_Item(int)",
        "= =(=0=8=D=L=d=t=",
        ".text$mn",
        "void __thiscall UnBCL::_::HTEnumerator<struct UnBCL::SerializationStream::UniqueObject,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::Reset(void)",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAPBUISerializable@1@@Z",
        "??_8?$Array@H@UnBCL@@7B@",
        "?IsDriveLetterPrefix@Path@UnBCL@@SGHPBVString@2@@Z",
        "4)4/4@4E4c4k4q4v4",
        "??0Version@UnBCL@@QAE@HHH@Z",
        "null path to Path::GetShortName",
        "??0?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@XZ",
        "8,8=8U8g8",
        "??0MutableString@UnBCL@@QAE@PBG@Z",
        ":0:8:@:H:P:\\:|:",
        "9&:P:[:q:",
        "__thiscall UnBCL::ArrayList<int>::ArrayList(int,int)",
        ".?AV?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@",
        "tJhX+",
        "?DAYS_TO_MONTH_366@DateTime@UnBCL@@0QBHB",
        ".?AVSecurityException@UnBCL@@",
        "const unsigned short *__thiscall UnBCL::RegSubkeyEnumerator::get_Current(void) const",
        ";,;<;@;X;h;l;p;",
        "ExitProcess",
        ".?AV?$Array@PAVObject@UnBCL@@@UnBCL@@",
        "__thiscall UnBCL::StreamWriter::StreamWriter(class UnBCL::Stream *,class UnBCL::Encoding *,int,int,int)",
        ".?AVRegistry@UnBCL@@",
        "class UnBCL::String *__stdcall UnBCL::File::Copy(const class UnBCL::String *,const class UnBCL::String *,int)",
        "%s: %s Inner Exception: %s",
        "?GetType@Object@UnBCL@@UBEPAVType@2@XZ",
        "070V0",
        "0L0^0p0",
        ".?AV?$Array@PAVXmlAttribute@XmlLite@UnBCL@@@UnBCL@@",
        "2\"343F3c3",
        "__int64 __thiscall UnBCL::FileStream::Seek(__int64,enum UnBCL::SeekOrigin)",
        ".?AU?$IEnumerable@PAVXmlNode@XmlLite@UnBCL@@@UnBCL@@",
        "?RemoveAt@?$Array@G@UnBCL@@UAEXH@Z",
        "?CompareTo@TimeSpan@UnBCL@@UBEHPBVObject@2@@Z",
        "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6BISerializable@2@@",
        "??4?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@PBG@Z",
        "??_8MemoryStream@UnBCL@@7BStream@1@@",
        "1H1k1z1",
        "6%7+7Z7",
        "??0?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@QAE@ABV01@@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *>::QuickSort(class UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *> *,class UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *> *,int,int)",
        "??4Mutex@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "?s_Registration@?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
        "SetLastError",
        "class UnBCL::Array<unsigned char> *__thiscall UnBCL::Encoding::GetBytes(const class UnBCL::String *,int,int) const",
        "??4XmlNodeList@UnBCL@@QAEAAV01@ABV01@@Z",
        "_lock",
        "void __thiscall UnBCL::String::StreamRead(class UnBCL::SerializationStream &)",
        "3!3C3d3k3r3",
        ")ix or count out of range to UnicodeEncoding::GetCharCount",
        "??_7?$Array@PAVString@UnBCL@@@UnBCL@@6B?$SerializableArrayBase@PAVString@UnBCL@@@_@1@@",
        "??_7?$Array@G@UnBCL@@6BObject@1@@",
        ".?AVXmlNamespaceManager@UnBCL@@",
        "??0Environment@UnBCL@@AAE@XZ",
        "negative offset or count to FileStream#Read",
        "?set_Context@SerializationStream@UnBCL@@QAEXPAVObject@2@@Z",
        "?GetData@?$CSimpleStringT@G$0A@@ATL@@ABEPAUCStringData@2@XZ",
        ".?AV?$SerializableArrayListPrimitiveBase@H@_@UnBCL@@",
        "?get_Count@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
        "??0PathTooLongException@UnBCL@@QAE@ABV01@@Z",
        "__int64 __thiscall UnBCL::FileStream::get_Position(void) const",
        "??_7StringPtr@UnBCL@@6B01@@",
        "?Equals@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHPBVObject@2@@Z",
        "??_7?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@6BObject@1@@",
        "?Clone@Version@UnBCL@@UBEPAVObject@2@XZ",
        "8#9<9c9",
        "index or count out of range to ASCIIEncoding#GetByteCount",
        "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7B?$IDictionary@PAVString@UnBCL@@PAV12@@1@@",
        "?get_CanWrite@FileStream@UnBCL@@UBEHXZ",
        "?get_BiosName@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
        "?get_Capacity@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
        "?get_HResult@Exception@UnBCL@@UBEJXZ",
        "?PrepareWrite2@?$CSimpleStringT@G$0A@@ATL@@AAEXH@Z",
        "1(1?1X1f1",
        "?get_IsPrintable@String@UnBCL@@QBEHXZ",
        "1A2T2f2",
        "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7B?$IList@PAVString@UnBCL@@@1@@",
        ")WaitForExit() on closed Process instance",
        "979l9~9",
        "0N0c0p0",
        ":D:e:",
        "?Nullify@?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAEAAV12@XZ",
        "?set_Capacity@?$ArrayList@G@UnBCL@@UAEXH@Z",
        "??0StreamWriter@UnBCL@@QAE@PAVStream@1@PAVEncoding@1@HHH@Z",
        "tnegative numchars to ASCIIEncoding::GetMaxByteCount",
        "?Nullify@?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAEAAV12@XZ",
        "6#626O6`6o6",
        "?CopyCharsOverlapped@?$CSimpleStringT@G$0A@@ATL@@SAXPAGPBGH@Z",
        "434R4s4",
        "3\"3)303\\3g3u3",
        "base\\ntsetup\\unbcl\\src\\datetime.cpp",
        "0 0.0",
        "TlP0X",
        "??0Process@UnBCL@@IAE@PAX0@Z",
        ":#;1;N;x;",
        "0$0q0~0",
        "?Concat@String@UnBCL@@SGPAV12@PBG@Z",
        "?WriteObject@SerializationStream@UnBCL@@IAEXPBUISerializable@2@@Z",
        "?AddRef@Object@UnBCL@@QAEXXZ",
        "~AVj ",
        "121C1Q1",
        "??0NotSupportedException@UnBCL@@QAE@PBVString@1@@Z",
        "?GetTemporaryFileName@File@UnBCL@@SGPAVString@2@PBV32@@Z",
        "??0?$Array@E@UnBCL@@QAE@ABV01@@Z",
        "??0ExternalException@UnBCL@@QAE@$$QAV01@@Z",
        "?Steal@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAEPAVSerializationStream@2@XZ",
        "??0SecurityException@UnBCL@@QAE@XZ",
        "??4Int32Ops@UnBCL@@QAEAAU01@ABU01@@Z",
        "GetValue",
        "??_7TextWriter@UnBCL@@6BObject@1@@",
        "class UnBCL::XmlNode *__stdcall UnBCL::XmlNode::CreateXmlNode(struct IXMLDOMNode *)",
        "??4ConsoleLogHandler@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "QSSSSSS",
        "?ReleaseBufferSetLength@?$CSimpleStringT@G$0A@@ATL@@QAEXH@Z",
        "??0?$IEnumerable@G@UnBCL@@QAE@XZ",
        "<E=R=`=n=|=",
        "?Sort@?$Array@H@UnBCL@@SGXPAV12@@Z",
        "5F6r6",
        "?Remove@?$ArrayList@G@UnBCL@@UAEXG@Z",
        "?IndexOf@String@UnBCL@@QBEHPBG@Z",
        "0:0]0",
        "ProductName",
        "<8<G<f<",
        "ReleaseDate",
        "??0IndexOutOfRangeException@UnBCL@@QAE@PBG@Z",
        "3C3h3",
        "??4OperatingSystem@UnBCL@@QAEAAV01@ABV01@@Z",
        "??_7?$SerializableArrayBase@H@_@UnBCL@@6BISerializable@2@@",
        ".?AV?$SerializableStackBase@H@_@UnBCL@@",
        "\\\\?\\UNC\\",
        "200304183038Z",
        "?CountChars@String@UnBCL@@SGHPBG@Z",
        "?get_ProcessorManufacturer@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
        "3+50575@5G5",
        "class UnBCL::String *const &__thiscall UnBCL::ArrayList<class UnBCL::String *>::get_Item(int) const",
        "int __thiscall UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> >::BinarySearch(int,int,class UnBCL::SmartPtr<class UnBCL::String>,struct UnBCL::IComparer<class UnBCL::SmartPtr<class UnBCL::String> > *)",
        "??0CaseInsensitiveStringComparer@UnBCL@@QAE@$$QAV01@@Z",
        "4)5;5M5[5|5",
        "7;8M8_8m8",
        "void __thiscall UnBCL::ArrayList<class UnBCL::Object *>::CopyTo(class UnBCL::Array<class UnBCL::Object *> *,int) const",
        "class UnBCL::Version *__stdcall UnBCL::Try_Cast<classUnBCL::Version*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        ".?AVMultiSz@UnBCL@@",
        "??_DRegistryKey@UnBCL@@QAEXXZ",
        "?get_Item@XmlNodeList@XmlLite@UnBCL@@QAEPAVXmlNode@23@H@Z",
        ".?AV?$ArrayList@PAVXmlAttribute@XmlLite@UnBCL@@@UnBCL@@",
        "?ToString@Int32Ops@UnBCL@@SGPAVString@2@H@Z",
        "??0XmlAttributeCollection@XmlLite@UnBCL@@QAE@ABV012@@Z",
        "??1?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@UAE@XZ",
        "?StreamWrite@?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@UBEXAAVSerializationStream@3@@Z",
        "?get_P@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QBEPAVSerializationId@2@XZ",
        "9,949<9D9L9\\9h9p9",
        "??0ThreadStateException@UnBCL@@QAE@PBG@Z",
        "<=<P<b<",
        "unable to retrieve file size",
        "??4?$Array@H@UnBCL@@QAEAAV01@ABV01@@Z",
        "??0ASCIIEncoding@UnBCL@@QAE@ABV01@@Z",
        ".?AVChar@UnBCL@@",
        ".?AVStringPtr@UnBCL@@",
        "??4SbRegistrationList@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "!This program cannot be run in DOS mode.",
        ".?AV?$ValueCollection@PAVString@UnBCL@@PAV12@@_@UnBCL@@",
        "void __thiscall UnBCL::ArrayList<class UnBCL::StringPtr>::CopyTo(class UnBCL::Array<class UnBCL::StringPtr> *,int) const",
        "void __stdcall UnBCL::SerializationStream::RegisterType(const class UnBCL::String *,int,struct HINSTANCE__ *,struct UnBCL::IInstanceFactory *)",
        "?DeAssign@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@AAEXXZ",
        "?get_Message@Exception@UnBCL@@UBEPBVString@2@XZ",
        "??4SbRegistrationList@UnBCL@@QAEAAV01@ABV01@@Z",
        "__thiscall UnBCL::Version::Version(int,int,int,class UnBCL::String *)",
        "?set_ParentNode@XmlNode@XmlLite@UnBCL@@IAEXPAV123@@Z",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAPAUISerializable@1@@Z",
        "?RemoveTail@?$ArrayList@G@UnBCL@@UAEXXZ",
        ".0V0_0",
        "method called on closed RegistryKey",
        "?GetMaxByteCount@ASCIIEncoding@UnBCL@@UBEHH@Z",
        "?get_Length@?$Array@E@UnBCL@@UBEHXZ",
        "??_7?$Array@G@UnBCL@@6B?$IEnumerable@G@1@@",
        "?TICKS_PER_MS@DateTime@UnBCL@@1_JB",
        "8(959Q9s9",
        "??1XPathException@UnBCL@@UAE@XZ",
        "CloseHandle",
        "j\\Xf9D$",
        "??0XmlAttributeCollection@UnBCL@@QAE@ABV01@@Z",
        "void __stdcall UnBCL::File::Move(const class UnBCL::String *,const class UnBCL::String *)",
        ":#:>:P:_:p:",
        "<(<L<x<",
        "int __thiscall UnBCL::ArrayList<class UnBCL::StringPtr>::IndexOf(class UnBCL::StringPtr,int,int) const",
        "<.<@<O<",
        "?_ToLower@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@XZ",
        "6%6C6a6s6",
        "??4TimeSpan@UnBCL@@QAEAAV01@ABV01@@Z",
        "0+0P0",
        "?IsLittleEndian@SerializationStream@UnBCL@@KGHXZ",
        ".?AV?$ArrayListEnumerator@PAVXmlNode@XmlLite@UnBCL@@@_@UnBCL@@",
        "3&3K3]3l3",
        "??1XmlNamespaceManager@UnBCL@@UAE@XZ",
        "??2Object@UnBCL@@SGPAXI@Z",
        "?Close@RegistryKey@UnBCL@@QAEXXZ",
        "??_7?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@6B?$IList@G@2@@",
        ">A>H>g>",
        "GetFileType",
        "??_7?$Array@H@UnBCL@@6B?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "class UnBCL::XmlLite::XmlAttribute *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::XmlLite::XmlAttribute *>::get_Current(void) const",
        "class UnBCL::Array<unsigned char> *__thiscall UnBCL::RegistryKey::GetBinaryValue(const class UnBCL::String *)",
        "??0InvalidCastException@UnBCL@@QAE@XZ",
        "?StreamWrite@?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@UBEXAAVSerializationStream@3@@Z",
        "SHELL32.dll",
        "?get_ParentNode@XmlNode@UnBCL@@QAEPAV12@XZ",
        "??0?$ICollection@H@UnBCL@@QAE@ABU01@@Z",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive<short>(short &)",
        "??_7XmlNamespaceManager@UnBCL@@6B@",
        "?Contains@?$Array@G@UnBCL@@UBEHG@Z",
        "v>Vj ",
        "141;1B1g1u1",
        "Microsoft Time-Stamp Service",
        "??0TextReader@UnBCL@@QAE@XZ",
        "3'353Y3",
        "?IsLetter@Char@UnBCL@@SGHG@Z",
        "?_CompareTo@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@@Z",
        "?GetBaseException@Exception@UnBCL@@UBEPBV12@XZ",
        "?GetEnvironmentVars@Environment@UnBCL@@SGPAV?$Hashtable@PAVString@UnBCL@@PAV12@@2@XZ",
        "4)4\\4i4",
        "<.<=<S<",
        "??0ApplicationException@UnBCL@@QAE@PAVString@1@@Z",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationId *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,&protected: static class UnBCL::SerializationId * __stdcall UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,class ATL::CElementTraits<class UnBCL::SerializationStream::TypeFactoryList *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *> *,class UnBCL::Array<class UnBCL::SerializationId *> *,int)",
        "?Remove@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHG@Z",
        "int __thiscall UnBCL::UnicodeEncoding::GetByteCount(const class UnBCL::String *,int,int) const",
        ".rsrc",
        ".?AVXmlDocument@XmlLite@UnBCL@@",
        "void __thiscall UnBCL::Array<unsigned short>::RemoveAt(int)",
        "t!h@U",
        "_wtoi64",
        "0h0x0",
        "??0TimeSpan@UnBCL@@QAE@HHH@Z",
        "7W8}8",
        ")saw ref to unserialized object",
        "??0XmlNode@XmlLite@UnBCL@@QAE@W4XmlNodeType@2@PBG111@Z",
        "void __thiscall UnBCL::Array<unsigned char>::Remove(unsigned char)",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBEPAUIAtlStringMgr@1@@Z",
        "?get_Item@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEABQAVString@2@H@Z",
        "??0ArithmeticException@UnBCL@@QAE@PBVString@1@@Z",
        "?Add@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXPAVString@2@0@Z",
        ".?AVTextWriter@UnBCL@@",
        "index out of range to StringBuilder#Chars[]",
        ">+>h>w>",
        "HeapSize",
        "?(?X?",
        "class UnBCL::String *__stdcall UnBCL::Path::GetFullPath(const class UnBCL::String *)",
        "??4SerializationException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "void __thiscall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,class ATL::CElementTraits<class UnBCL::String *> > const *,struct __POSITION * const &)>::Reset(void)",
        "??4?$IEnumerable@G@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "void __thiscall UnBCL::ArrayList<int>::set_Item(int,int)",
        "null array to Hashtable#CopyTo",
        ".?AVDateTime@UnBCL@@",
        "?GetBuffer@?$Array@H@UnBCL@@UBEPBHH@Z",
        "5/5:5?5q5",
        "1#2s2",
        "t?Vj$",
        ".?AU?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@",
        "??1SEHException@UnBCL@@UAE@XZ",
        "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@ABUtagVARIANT@@@Z",
        "class UnBCL::Process *__stdcall UnBCL::Process::Start(const class UnBCL::ProcessStartInfo *)",
        "??_7?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@6B?$ICollection@PAVObject@UnBCL@@@1@@",
        "invalid UNC path to Directory::CreateDirectory",
        "?ReAlloc@HeapMemoryManager@UnBCL@@UAEPAXPAXK@Z",
        "ROOT\\CIMV2",
        "??_7TimeSpan@UnBCL@@6B@",
        "?_Insert@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@HV32@@Z",
        "??4?$IEnumerable@E@UnBCL@@QAEAAU01@$$QAU01@@Z",
        ".?AU?$ICollection@V?$DictionaryEntry@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@@UnBCL@@",
        "TerminateProcess",
        "??1Mutex@UnBCL@@UAE@XZ",
        "9)9;9j9",
        "?IndexOf@?$ArrayList@G@UnBCL@@SGHPBV12@GHH@Z",
        " 0T0f0u0",
        "??0Win32Exception@UnBCL@@QAE@KPBVString@1@@Z",
        "2J2j2r2",
        "4-4?4N4",
        "_wcsicoll",
        "int __thiscall UnBCL::ArrayList<unsigned short>::IndexOf(unsigned short,int,int) const",
        "unable to convert local to UTC filetime",
        "unable to delete subkey",
        ">*?>?K?c?t?",
        "??0?$ICollection@H@UnBCL@@QAE@XZ",
        "??4MutableString@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "?DeAssign@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@AAEXXZ",
        "_purecall",
        ";O;z;",
        "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@D@Z",
        "[j\\_f;",
        "WWWWQ",
        "252b2",
        "int __thiscall UnBCL::String::IndexOf(const unsigned short *,int) const",
        "?DeAssign@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@AAEXXZ",
        "?Done@Environment@UnBCL@@SGJXZ",
        ".?AV?$DictionaryEntry@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@",
        "=&=E=c=u=",
        "unable to get String value on key",
        "??0?$Stack@PAVObject@UnBCL@@@UnBCL@@QAE@XZ",
        "void __stdcall UnBCL::ArrayList<class UnBCL::String *>::Copy(const class UnBCL::ArrayList<class UnBCL::String *> *,int,class UnBCL::ArrayList<class UnBCL::String *> *,int,int)",
        "??0?$SerializableArrayBase@H@_@UnBCL@@QAE@ABV012@@Z",
        "??1InvalidOperationException@UnBCL@@UAE@XZ",
        "?get_Count@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
        ".?AVOverflowException@UnBCL@@",
        ";$<h<z<",
        "283G3f3",
        "void __stdcall UnBCL::Directory::Copy(const class UnBCL::String *,const class UnBCL::String *,int,struct UnBCL::Directory::ICopyDelegate *)",
        ")unable to obtain OS version",
        "int __stdcall UnBCL::Array<class UnBCL::Object *>::IndexOf(const class UnBCL::Array<class UnBCL::Object *> *,class UnBCL::Object *,int,int)",
        "?LastIndexOf@?$ArrayList@G@UnBCL@@UBEHGHH@Z",
        "const class UnBCL::StringPtr &__thiscall UnBCL::ArrayList<class UnBCL::StringPtr>::get_Item(int) const",
        ";3;O;",
        "NumberOfLogicalProcessors",
        "t!h@f",
        "===I=",
        ".?AV?$Array@G@UnBCL@@",
        "9 9$9(9,9094989<9@9D9H9L9P9d9h9l9p9",
        "?DeleteValue@RegistryKey@UnBCL@@QAEXPBVString@2@@Z",
        "606=6`6m6",
        "%i/%i/%i %02i:%02i:%02i",
        "?Delete@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHHH@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::Object *>::Resize(int,int)",
        ".?AV?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@UnBCL@@",
        "??0?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@HH@Z",
        "?IsLetterOrDigit@Char@UnBCL@@SGHG@Z",
        "CreateSemaphoreExW",
        "?get_Item@?$Array@PAVString@UnBCL@@@UnBCL@@UBEABQAVString@2@H@Z",
        "SizeofResource",
        ".?AV?$ArrayListEnumerator@H@_@UnBCL@@",
        "__thiscall UnBCL::StreamWriter::StreamWriter(const class UnBCL::String *,int,class UnBCL::Encoding *,int,int)",
        "?get_AutoDelete@?$Array@G@UnBCL@@UBEHXZ",
        ".PAVInvalidOperationException@UnBCL@@",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive<int>(int)",
        "_vscwprintf",
        ".didat$3",
        "3\"3C3\\3",
        ">F>{>",
        "0 0$0<0@0X0\\0t0x0|0",
        "int __thiscall UnBCL::SerializationStream::ReadObjectHeader(class UnBCL::Object *&)",
        "?Steal@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAEPAVSerializationId@2@XZ",
        "??_7?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@6B@",
        "?get_FileName@ProcessStartInfo@UnBCL@@QBEPBVString@2@XZ",
        "r~akow",
        ".?AV?$ArrayList@PAVObject@UnBCL@@@UnBCL@@",
        "??0ExternalException@UnBCL@@QAE@XZ",
        "9'9`9r9",
        "666Y6",
        "Y<a \"",
        "base\\ntsetup\\unbcl\\src\\heapmemorymanager.cpp",
        "1\"1A1",
        "?Pop@?$Stack@H@UnBCL@@UAEHXZ",
        "null anyOf to String::IndexOfAny",
        "??0?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        ".?AU?$IList@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@UnBCL@@",
        "void __stdcall UnBCL::Win32Exception::ThrowLastError(const class UnBCL::String *,const char *,int)",
        ".?AV?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "??4ArgumentException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "?ReadObject@SerializationStream@UnBCL@@IAEPAUISerializable@2@XZ",
        "??0?$IList@E@UnBCL@@QAE@ABU01@@Z",
        "334U4",
        "??_7?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@6B?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@2@@",
        "354R4n4",
        "??C?$SmartPtr@VObject@UnBCL@@@UnBCL@@QBEPAVObject@1@XZ",
        "??0XmlAttributeCollection@XmlLite@UnBCL@@QAE@XZ",
        "<*<=<f<",
        "3C4e4",
        "?get_Length@FileStream@UnBCL@@UBE_JXZ",
        "void __thiscall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::Remove(class UnBCL::String *)",
        "7*7L7_7",
        "0,00040L0\\0`0p0t0x0|0",
        ">#?r?",
        "??1InvalidCastException@UnBCL@@UAE@XZ",
        "?Insert@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHHG@Z",
        "?m_OSVersion@Environment@UnBCL@@0PAVOperatingSystem@2@A",
        "?Add@?$ArrayList@G@UnBCL@@UAEHG@Z",
        "??0?$Array@E@UnBCL@@IAE@XZ",
        "??4?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@ABV?$CSimpleStringT@G$00@1@@Z",
        "t-hX+",
        "GetDepth",
        "void __thiscall UnBCL::ArrayList<class UnBCL::String *>::Resize(int,int)",
        "?Fork@?$CSimpleStringT@G$0A@@ATL@@AAEXH@Z",
        "null buf to MemoryStream#Read",
        ".?AU?$IEnumerable@VStringPtr@UnBCL@@@UnBCL@@",
        "??0?$IList@G@UnBCL@@QAE@XZ",
        "int __thiscall UnBCL::_::ArrayListEnumerator<int>::MoveNext(void)",
        "060E0",
        "?BinarySearch@?$Array@PAVObject@UnBCL@@@UnBCL@@SGHPBV12@PAVObject@2@PAU?$IComparer@PAVObject@UnBCL@@@2@@Z",
        "int __thiscall UnBCL::SerializationStream::WritePhantomObject(const class UnBCL::Object *)",
        "?ToString@String@UnBCL@@UBEPAV12@XZ",
        "?IsTrackingEnabled@HeapMemoryManager@UnBCL@@QAEHXZ",
        "6+6=6L6]6t6",
        "??4Allocator@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??_7Delegate@UnBCL@@6B@",
        "??4SEHException@UnBCL@@QAEAAV01@ABV01@@Z",
        "?FormatMessageW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXIZZ",
        "?Clone@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEPAVObject@2@XZ",
        "0#060N0U0\\0c0j0q0",
        "6)6C6u6",
        "3)3=3O3c3",
        "9E9P9^9l9",
        "??4?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAV?$SmartPtr@UISerializable@UnBCL@@@1@@Z",
        "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6B?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@1@@",
        ".?AU?$IList@H@UnBCL@@",
        "5?5r5",
        "5U5d5",
        "??0?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QAE@XZ",
        "%s: %s",
        "PQQVW",
        "null path to Path::WithLongPrefixUNC",
        ": :$:<:L:P:h:x:|:",
        "?SGetCharCount@ASCIIEncoding@UnBCL@@CGHPBV?$Array@E@2@HH@Z",
        ";-;5;:;N;^;i;",
        "?Seek@MemoryStream@UnBCL@@UAE_J_JW4SeekOrigin@2@@Z",
        "?s_Registered@SerializationStream@UnBCL@@0PAV?$Hashtable@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@2@A",
        "??0InvalidCastException@UnBCL@@QAE@$$QAV01@@Z",
        "?_TrimEnd@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@V32@@Z",
        "??_7ProcessStartInfo@UnBCL@@6B@",
        "??0Type@UnBCL@@QAE@ABV01@@Z",
        ".?AV?$SmartPtr@VString@UnBCL@@@UnBCL@@",
        "j Yf;",
        "??_7StreamWriter@UnBCL@@6BObject@1@@",
        "<\"<4<B<`<r<",
        "8#9s:",
        "get_Position() on closed MemoryStream",
        "_isnan",
        "msvcrt.dll",
        "void __thiscall UnBCL::ArrayList<class UnBCL::Object *>::RemoveAt(int)",
        "?Save@XmlDocument@UnBCL@@QAEXPAVString@2@@Z",
        "< =Y=r=",
        "?RegisterVersion@?$SerializableBase@V?$Array@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@E@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
        ">$>D>L>T>`>",
        "?Concatenate@?$CSimpleStringT@G$0A@@ATL@@KAXAAV12@PBGH1H@Z",
        ".?AU?$ICollection@PAVString@UnBCL@@@UnBCL@@",
        "??0?$ICollection@PAVString@UnBCL@@@UnBCL@@QAE@XZ",
        "?CharToOemA@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEXXZ",
        ":;;Z;h;",
        "> >(>0>8>D>L>d>l>",
        "?GetAllocLength@?$CSimpleStringT@G$0A@@ATL@@QBEHXZ",
        "9!989c9",
        "<3<x<",
        "int __thiscall UnBCL::String::_IndexOfAny(class UnBCL::SmartPtr<class UnBCL::String>,int) const",
        "??5SerializationStream@UnBCL@@QAEAAV01@AAG@Z",
        "9?9j9",
        "??0DateTime@UnBCL@@QAE@ABV01@@Z",
        "??0?$ArrayList@G@UnBCL@@QAE@HH@Z",
        "?TrimLeft@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@G@Z",
        "?RemoveAt@?$Array@H@UnBCL@@UAEXH@Z",
        "?LookupNamespace@XmlNamespaceManager@UnBCL@@QAEPAVString@2@PAV32@@Z",
        "unable to launch process",
        "??1SyncObject@UnBCL@@UAE@XZ",
        "?AppendEscapedString@StringBuilder@UnBCL@@QAEPAV12@PBGW4EscapingRules@2@@Z",
        "??_7?$Array@E@UnBCL@@6B?$SerializableArrayBase@E@_@1@@",
        ".PAVXPathException@UnBCL@@",
        "??0SystemException@UnBCL@@QAE@PBVString@1@@Z",
        "unsigned short *__thiscall UnBCL::ArrayList<unsigned short>::GetBuffer(int)",
        "wOVP9s",
        "??4?$IList@H@UnBCL@@QAEAAU01@ABU01@@Z",
        "void __stdcall UnBCL::ArrayList<unsigned short>::Sort(class UnBCL::ArrayList<unsigned short> *)",
        "??0Version@UnBCL@@QAE@HH@Z",
        "?Remove@?$Array@H@UnBCL@@UAEXH@Z",
        "count out of range in UnicodeEncoding::GetBytes",
        "1.2j2}2",
        "?get_Rank@?$Array@G@UnBCL@@UBEHXZ",
        "9j9|9",
        "void __thiscall UnBCL::XmlDocument::Save(class UnBCL::String *)",
        "1 1$1(1/1^1c1",
        "< =@=p=",
        "?set_LineNumber@XmlException@UnBCL@@MAEXH@Z",
        "3 3(383\\3d3l3t3|3",
        "?CompareTo@String@UnBCL@@UBEHPBVObject@2@@Z",
        "?ReAllocDbg@HeapMemoryManager@UnBCL@@UAEPAXPBDHPAXK@Z",
        "2/3A3c3",
        ":.;5;B;I;W;c;x;",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "??_8Process@UnBCL@@7BIDisposable@1@@",
        "5 5$5(5,5@5D5T5X5\\5t5",
        "negative codepage to Encoding constructor",
        "??4?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@QAEAAV01@ABV01@@Z",
        "?GetCharCount@ASCIIEncoding@UnBCL@@UBEHPBV?$Array@E@2@HH@Z",
        "?CopyTo@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEXPAV?$Array@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@2@H@Z",
        "?Dispose@FileStream@UnBCL@@UAEXXZ",
        "??_8StreamReader@UnBCL@@7B@",
        "??_8StreamReader@UnBCL@@7BTextReader@1@@",
        "CoUninitialize",
        "??_7?$Array@G@UnBCL@@6B?$ICollection@G@1@@",
        "base\\ntsetup\\unbcl\\src\\fileenum.cpp",
        "?get_Name@XmlNode@UnBCL@@QAEPAVString@2@XZ",
        ".?AV?$HTDictEnumBase@PAVString@UnBCL@@@_@UnBCL@@",
        "6O6+7c:",
        "?GetTempBuffer@SerializationStream@UnBCL@@QAEAAV?$ArrayList@E@2@H@Z",
        "?SelectNodes@XmlNode@UnBCL@@QAEPAVXmlNodeList@2@PAVString@2@PAVXmlNamespaceManager@2@@Z",
        "??0ThreadStateException@UnBCL@@QAE@$$QAV01@@Z",
        "?s_Registration@?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
        "??1?$SmartPtr@VVersion@UnBCL@@@UnBCL@@UAE@XZ",
        "??4WaitHandle@UnBCL@@QAEAAV01@ABV01@@Z",
        "int __thiscall UnBCL::ArrayList<class UnBCL::Object *>::IndexOf(class UnBCL::Object *,int,int) const",
        ".?AV?$ValueCollection@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@_@UnBCL@@",
        "=\"=)=0=7=",
        "int __thiscall UnBCL::ArrayList<class UnBCL::String *>::IndexOf(class UnBCL::String *,int,int) const",
        "??4?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@QAEAAV012@ABV012@@Z",
        "null keyname to RegistryKey#DeleteSubKey",
        "??4IndexOutOfRangeException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "3*3<3N3p3",
        "??4Delegate@UnBCL@@QAEAAV01@$$QAV01@@Z",
        ".tls$",
        "5,5:5t5",
        "7 7q7",
        "??_7?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@6BISerializable@2@@",
        "?Equals@?$Array@PAVString@UnBCL@@@UnBCL@@UBEHPBVObject@2@@Z",
        "??0?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        "??4XmlDocument@XmlLite@UnBCL@@QAEAAV012@ABV012@@Z",
        ".CRT$XLZ",
        "??_7?$Array@H@UnBCL@@6B?$IList@H@1@@",
        "?GetDirectoriesAndFiles@Directory@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBVString@2@0W4EnumerationType@12@H@Z",
        "LoadResource",
        "?GetBytes@Encoding@UnBCL@@UBEPAV?$Array@E@2@PBVString@2@@Z",
        "?set_FileName@ProcessStartInfo@UnBCL@@QAEXPBVString@2@@Z",
        "?Attach@?$CSimpleStringT@G$0A@@ATL@@AAEXPAUCStringData@2@@Z",
        "Write() on read-only MemoryStream",
        "?Find@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBGH@Z",
        ".?AU?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@",
        ".?AV?$CSimpleStringT@G$0A@@ATL@@",
        "??0?$ICollection@PAVString@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
        "??7?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBE_NXZ",
        ".PAVObject@UnBCL@@",
        "4J4z4",
        "null path to Path::GetRootLength",
        "void __thiscall UnBCL::XmlLite::XmlDocument::LoadXml(class UnBCL::String *)",
        "XPath",
        ".?AV?$Array@E@UnBCL@@",
        "void __stdcall UnBCL::ArrayList<unsigned char>::Sort(class UnBCL::ArrayList<unsigned char> *)",
        "?GetStringValue@RegHandle@UnBCL@@QAEHPBGAAPAVString@2@@Z",
        "8)888S8e8t8",
        "?GetTempPathName@Directory@UnBCL@@SGPAVString@2@XZ",
        "null chars to ASCIIEncoding::GetString",
        "1 1-1s1",
        "\"%s\" %s",
        ";0;X;",
        "?set_UseShellExecute@ProcessStartInfo@UnBCL@@QAEXH@Z",
        "??0?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
        "5(585<5@5X5h5l5|5",
        "?get_CanWrite@MemoryStream@UnBCL@@UBEHXZ",
        "??_7?$ArrayList@G@UnBCL@@6BISerializable@1@@",
        "<\"<0<q<",
        "??D?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBEAAV?$Array@E@1@XZ",
        "??_7RegistryKey@UnBCL@@6BObject@1@@",
        "?Add@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEHPAVString@2@@Z",
        "3 3$3(3,30383P3T3l3|3",
        "enum UnBCL::RegistryValueKind __thiscall UnBCL::RegistryKey::GetValueKind(const class UnBCL::String *)",
        "?CopyTo@?$Stack@PAVObject@UnBCL@@@UnBCL@@UBEXPAV?$Array@PAVObject@UnBCL@@@2@H@Z",
        ".?AU?$ICollection@G@UnBCL@@",
        "?SetValue@RegistryKey@UnBCL@@QAEXPBVString@2@PBV?$Array@E@2@@Z",
        "?EnqueueSbRegistration@SbRegistrationList@UnBCL@@SGXPBDHPAUHINSTANCE__@@PAUIInstanceFactory@2@@Z",
        "575c5",
        ".?AVXmlNode@UnBCL@@",
        "?Insert@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXHPAVString@2@@Z",
        "??0Char@UnBCL@@QAE@XZ",
        "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6B?$IList@PAVString@UnBCL@@@2@@",
        "102S2y2",
        "??0ThreadStateException@UnBCL@@QAE@ABV01@@Z",
        "??4InvalidCastException@UnBCL@@QAEAAV01@ABV01@@Z",
        "GetFileInformationByHandle",
        ".?AV?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@",
        "??_7?$Stack@H@UnBCL@@6B?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "??_7?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
        "??4?$Array@PAVObject@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "??_8?$Array@G@UnBCL@@7B?$IList@G@1@@",
        "??_7?$ArrayList@G@UnBCL@@6B01@@",
        "1,1=1",
        "class UnBCL::XmlLite::XmlNode *&__thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *>::get_Item(int)",
        ".?AV?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@",
        "3#4<4c4",
        "2!232E2c2",
        "?Insert@?$Array@H@UnBCL@@UAEXHH@Z",
        "attempt to set negative FileStream position",
        ".?AU?$IEnumerator@V?$DictionaryEntry@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@@UnBCL@@",
        ":^:t:",
        "= =,=L=X=|=",
        "??1BufferedStream@UnBCL@@UAE@XZ",
        "?ToUpper@String@UnBCL@@QBEPAV12@XZ",
        "1(161D1R1",
        "3 3034383<3P3`3d3|3",
        ".?AVDelegate@UnBCL@@",
        "?_Compare@String@UnBCL@@SGHV?$SmartPtr@VString@UnBCL@@@2@0H@Z",
        "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@G@Z",
        "8%9O9",
        ".?AV?$ArrayList@PAVString@UnBCL@@@UnBCL@@",
        ".?AV?$ArrayList@G@UnBCL@@",
        "??_8Thread@UnBCL@@7B@",
        "8h8z8",
        "6$666E6V6",
        ">8>\\>s>",
        ";H<[<m<",
        "?Compare@String@UnBCL@@SGHPBV12@PBGH@Z",
        "void __stdcall UnBCL::Array<class UnBCL::Object *>::Sort(class UnBCL::Array<class UnBCL::Object *> *)",
        "?GetByteCount@ASCIIEncoding@UnBCL@@UBEHPBVString@2@HH@Z",
        "??0?$IEnumerable@H@UnBCL@@QAE@XZ",
        "??1PathTooLongException@UnBCL@@UAE@XZ",
        "132P2j2r2w2",
        "<%<j<",
        ".?AV?$HTEnumerator@PAVString@UnBCL@@PAV12@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@2@PAV12@UKeyTraits@42@$1?RetrieveValue@42@KGPAV12@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@PAVString@3@UKeyTraits@23@V?$CElementTraits@PAVString@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        ".?AU?$ICollection@E@UnBCL@@",
        "??0Thread@UnBCL@@QAE@PAVThreadStartDelegate@1@@Z",
        "Current retrieved on enumerator beyond table end",
        "_ftol2",
        "??_7?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
        "5B5T5f5t5",
        "??_7XmlDocument@UnBCL@@6B@",
        "?Add@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEHPAVObject@2@@Z",
        "??0Win32Exception@UnBCL@@QAE@ABV01@@Z",
        "??4ASCIIEncoding@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "unbcl.pdb",
        "??_7?$SerializableArrayListPrimitiveBase@G@_@UnBCL@@6B?$IEnumerable@G@2@@",
        "??4?$ICollection@H@UnBCL@@QAEAAU01@ABU01@@Z",
        "void __thiscall UnBCL::Array<unsigned char>::InitLarva(class UnBCL::ArrayList<unsigned char> *)",
        "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6BObject@1@@",
        "?get_AutoDeleteKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHXZ",
        "WaitForSingleObject failed in Thread::Join",
        "const class UnBCL::Exception *__thiscall UnBCL::Exception::GetBaseException(void) const",
        "?InnerList@?$Stack@H@UnBCL@@MBEABQAV?$ArrayList@H@2@XZ",
        "void __thiscall UnBCL::Array<class UnBCL::XmlLite::XmlNode *>::Insert(int,class UnBCL::XmlLite::XmlNode *)",
        "4l5~5",
        "??1ThreadStateException@UnBCL@@UAE@XZ",
        "??0IInstanceFactory@UnBCL@@QAE@ABU01@@Z",
        "void __thiscall UnBCL::MemoryStream::set_Capacity(int)",
        "%s: %s failed",
        "??3Object@UnBCL@@SGXPAX@Z",
        "?Append@?$CSimpleStringT@G$0A@@ATL@@QAEXPBG@Z",
        "??_7?$SmartPtr@VVersion@UnBCL@@@UnBCL@@6B@",
        "??_7XmlAttribute@UnBCL@@6B@",
        "??_7MultiSz@UnBCL@@6BObject@1@@",
        ">,>0>@>D>T>X>h>l>",
        "??0Monitor@UnBCL@@AAE@XZ",
        "??_7TextReader@UnBCL@@6BObject@1@@",
        "void __thiscall UnBCL::Array<int>::InitLarva(class UnBCL::ArrayList<int> *)",
        "?Open@RegHandle@UnBCL@@QAEHPAUHKEY__@@PBGK@Z",
        ".?AV?$SmartPtr@U?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@@UnBCL@@",
        "??_7SystemException@UnBCL@@6B@",
        "2<3h3",
        ".?AU?$IList@PAVXmlNode@XmlLite@UnBCL@@@UnBCL@@",
        "const class UnBCL::String *__stdcall UnBCL::String::Intern(const class UnBCL::String *)",
        "?get_Count@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHXZ",
        "?OpenSubKey@RegistryKey@UnBCL@@QAEPAV12@PBVString@2@H@Z",
        ".?AV?$SmartPtr@V?$Array@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@UnBCL@@@UnBCL@@",
        ">,?Y?^?",
        ": :0:4:8:L:P:T:l:p:t:|:",
        "null value to String#EndsWith",
        "??_D?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAEXXZ",
        "??4?$IEnumerable@E@UnBCL@@QAEAAU01@ABU01@@Z",
        "?AddRange@?$ArrayList@G@UnBCL@@UAEXPBU?$ICollection@G@2@@Z",
        "?GetStackTrace@Exception@UnBCL@@QBEPAVString@2@XZ",
        "??1IPoolable@UnBCL@@UAE@XZ",
        "?set_Position@FileStream@UnBCL@@UAEX_J@Z",
        ":$:,:4:<:D:P:p:x:",
        "?GetString@Encoding@UnBCL@@UBEPAVString@2@PBV?$Array@E@2@@Z",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive<unsigned __int64>(unsigned __int64 &)",
        "??_8BufferedStream@UnBCL@@7BIDisposable@1@@",
        "=O>b>z>",
        "??0AbandonedMutexException@UnBCL@@QAE@$$QAV01@@Z",
        "?Add@?$Array@G@UnBCL@@UAEHG@Z",
        "??1?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UAE@XZ",
        "EnterCriticalSection",
        ">M?_?q?",
        "??0StreamCounter@UnBCL@@QAE@XZ",
        "path too long on Win9x",
        "void __stdcall UnBCL::Array<unsigned short>::Sort(class UnBCL::Array<unsigned short> *)",
        "7\"7-7_7j7w7",
        "??0FileStream@UnBCL@@QAE@PAXW4FileAccess@1@@Z",
        "class UnBCL::XmlLite::XmlNode *__thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::XmlLite::XmlNode *>::get_Current(void) const",
        "__thiscall UnBCL::ArrayList<class UnBCL::StringPtr>::ArrayList(const struct UnBCL::ICollection<class UnBCL::StringPtr> *)",
        "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6B?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@1@@",
        "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6BObject@2@@",
        "?LoadStringW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEHI@Z",
        "919C9U9s9",
        "void __stdcall UnBCL::Path::CheckInvalidPathChars(const class UnBCL::String *)",
        "??0StringBuilder@UnBCL@@QAE@H@Z",
        "=?=l=",
        "??4?$IEnumerable@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "?GetDecoder@UnicodeEncoding@UnBCL@@UBEPAVDecoder@2@XZ",
        "??1?$IList@G@UnBCL@@UAE@XZ",
        "??C?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@1@XZ",
        ">'>6>S>q>",
        "404<4\\4h4",
        "?get_NumCPU@SystemInfo@UnBCL@@QBEKXZ",
        "YYf90u",
        "?TrimLeft@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ",
        "UnBCL::HeapMemoryManager::InternalValidatefailed",
        "?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEPAVString@2@XZ",
        "??_8?$Array@PAVObject@UnBCL@@@UnBCL@@7B?$ICollection@PAVObject@UnBCL@@@1@@",
        "<!=Q=x=",
        "?get_Value@XmlNode@UnBCL@@QAEPAVString@2@XZ",
        "??4?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??_7XmlNodeList@UnBCL@@6B@",
        "?_Concat@String@UnBCL@@SG?AV?$SmartPtr@VString@UnBCL@@@2@V32@0@Z",
        "void __stdcall UnBCL::_::HTEnumerator<class UnBCL::String *,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,&protected: static class UnBCL::String * __stdcall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::TableKey,class UnBCL::String *,struct UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::KeyTraits,class ATL::CElementTraits<class UnBCL::String *> > const *,struct __POSITION * const &)>::CopyToArray(const class UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *> *,class UnBCL::Array<class UnBCL::String *> *,int)",
        "??0StreamWriter@UnBCL@@QAE@PBVString@1@HPAVEncoding@1@HH@Z",
        ".?AV?$SmartPtr@VObject@UnBCL@@@UnBCL@@",
        "__thiscall UnBCL::ArrayList<class UnBCL::Object *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::Object *> *)",
        "GetEnvironmentStringsW",
        "535O5x5",
        "051M1",
        "?get_AutoDelete@?$Array@H@UnBCL@@UBEHXZ",
        "?BlocksAllocated@Allocator@UnBCL@@SGII@Z",
        "??0Decoder@UnBCL@@QAE@ABV01@@Z",
        "?InitLarva@?$Array@PAVObject@UnBCL@@@UnBCL@@MAEXPAV?$ArrayList@PAVObject@UnBCL@@@2@@Z",
        "tstartIndex or count out of range to LastIndexOf()",
        "RtlGetVersion",
        "??_7Monitor@UnBCL@@6B@",
        "??_8?$ArrayList@PAVString@UnBCL@@@UnBCL@@7BISerializable@1@@",
        "0 121C1X1_1f1m1",
        "?Read@MemoryStream@UnBCL@@UAEHPAEHH@Z",
        "?GetBuffer@MemoryStream@UnBCL@@UAEPAV?$Array@E@2@XZ",
        "semaphore release failed",
        "null ascii to String::FromASCII",
        "?get_Context@SerializationStream@UnBCL@@QBEPAVObject@2@XZ",
        "?get_Length@String@UnBCL@@QBEHXZ",
        "vswprintf_s",
        "?get_IsEmpty@String@UnBCL@@QBEHXZ",
        "??_7DirectoryInfo@UnBCL@@6B@",
        "=S=p=w=",
        "??0NotSupportedException@UnBCL@@QAE@XZ",
        "LegalCopyright",
        "??0XmlAttribute@UnBCL@@QAE@PAUIXMLDOMNode@@@Z",
        "?AppendChar@?$CSimpleStringT@G$0A@@ATL@@QAEXG@Z",
        "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "HeapCompact",
        "??0?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAE@XZ",
        "Y__^[",
        "??_D?$Array@E@UnBCL@@QAEXXZ",
        "?IndexOf@?$Array@H@UnBCL@@SGHPBV12@HHH@Z",
        "??0XmlAttribute@XmlLite@UnBCL@@QAE@PBG000@Z",
        "null value to StringBuilder#Append",
        "??C?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBEPAV?$Array@E@1@XZ",
        "?Resize@?$ArrayList@G@UnBCL@@UAEXHH@Z",
        "towlower",
        "unable to SetSize on FileStream",
        "GetWindowsDirectoryW",
        "??1XmlAttribute@UnBCL@@UAE@XZ",
        "?get_Platform@OperatingSystem@UnBCL@@QBE?AW4PlatformID@2@XZ",
        "?0N0^0",
        "?0?c?",
        ";3;O;x;",
        "??_8SEHException@UnBCL@@7B@",
        "SetFileInformationByHandle",
        "8!8K8]8l8",
        "??0OutOfMemoryException@UnBCL@@QAE@XZ",
        "t,Vj$",
        "int &__thiscall UnBCL::Stack<int>::Peek(void)",
        "|hK,_",
        "5L5^5m5",
        ".?AVIndexOutOfRangeException@UnBCL@@",
        "?set_ValidateOnParse@XmlDocument@UnBCL@@QAEXH@Z",
        "?EndsWith@String@UnBCL@@QBEHPBGH@Z",
        ".?AVCAtlException@ATL@@",
        "??0?$Array@H@UnBCL@@QAE@ABV01@@Z",
        "6#7t7",
        "int __stdcall UnBCL::ArrayList<unsigned short>::BinarySearch(class UnBCL::ArrayList<unsigned short> *,unsigned short,struct UnBCL::IComparer<unsigned short> *)",
        "??_7?$Array@H@UnBCL@@6B01@@",
        ")null path or encoding to StreamWriter constructor",
        "??_7?$SerializableStackBase@H@_@UnBCL@@6B@",
        "5C5u5",
        "null stream to SerializationStream constructor",
        "??0SerializationId@UnBCL@@QAE@PAVString@1@H@Z",
        "2(373a3",
        "??_7?$SerializableStackBase@H@_@UnBCL@@6BISerializable@2@@",
        "?set_AutoDeleteKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UAEXH@Z",
        "__thiscall UnBCL::FileStream::FileStream(const class UnBCL::String *,enum UnBCL::FileMode,enum UnBCL::FileAccess,enum UnBCL::FileShare,unsigned long)",
        "??0?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        "__thiscall UnBCL::Version::Version(int,int,int)",
        "?RegisterVersion@?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
        "source file to File::MoveEx not found",
        "??0ExternalException@UnBCL@@QAE@ABV01@@Z",
        "1$1`1}1",
        "=0=<=c=",
        "606T6",
        "??0ApplicationException@UnBCL@@QAE@PBG@Z",
        "RegOpenKeyExW",
        "Microsoft Corporation1)0'",
        "??_7MultiSz@UnBCL@@6B?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@1@@",
        "?Enter@Monitor@UnBCL@@SGXPAVSyncObject@2@@Z",
        "arm64",
        "LoadLibraryExA",
        "<5=@=N=x=",
        "empty old string to String#Replace",
        "sort failed -- bad comparison routines?",
        "RegDeleteKeyExW",
        "> >/>Y>k>z>",
        "null srcpath or destpath to Directory::Move",
        "int __stdcall UnBCL::ArrayList<class UnBCL::String *>::IndexOf(const class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::String *,int,int)",
        "??_8RegistryKey@UnBCL@@7B01@@",
        ".?AV?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "??B?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
        "GetCurrentThread",
        "??_7HeapMemoryManager@UnBCL@@6B@",
        ".data$brc",
        "4*4O4a4s4",
        "CoCreateInstance",
        "void __thiscall UnBCL::ArrayList<class UnBCL::StringPtr>::QuickSort(class UnBCL::ArrayList<class UnBCL::StringPtr> *,class UnBCL::ArrayList<class UnBCL::StringPtr> *,int,int)",
        "Microsoft Time-Stamp PCA 2010",
        "??0MemoryStream@UnBCL@@QAE@PAV?$Array@E@1@HH@Z",
        "?GetLoadedModuleDir@Directory@UnBCL@@SGPAVString@2@PBV32@@Z",
        ".?AV?$ArrayListEnumerator@V?$SmartPtr@VString@UnBCL@@@UnBCL@@@_@UnBCL@@",
        "Legal_Policy_Statement",
        "?Clear@?$Array@H@UnBCL@@UAEXXZ",
        "__int64 __thiscall UnBCL::MemoryStream::get_Position(void) const",
        "class UnBCL::ArrayList<class UnBCL::String *> *__stdcall UnBCL::Try_Cast<classUnBCL::ArrayList<class UnBCL::String *>*,struct UnBCL::ISerializable>(struct UnBCL::ISerializable *)",
        "?_StartsWith@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@@Z",
        "??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@PBG@Z",
        "?GetDefault@Encoding@UnBCL@@SGPAV12@XZ",
        "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6B?$IList@PAVString@UnBCL@@@1@@",
        ".?AV?$SmartPtr@V?$ArrayList@VStringPtr@UnBCL@@@UnBCL@@@UnBCL@@",
        "?Append@StringBuilder@UnBCL@@QAEPAV12@GH@Z",
        "??1?$IEnumerator@PAVString@UnBCL@@@UnBCL@@UAE@XZ",
        "?IndexOf@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHPAVObject@2@@Z",
        "null value to String#LastIndexOf",
        "?get_Minutes@TimeSpan@UnBCL@@QBEHXZ",
        "class UnBCL::XmlNode *__thiscall UnBCL::XmlNode::SelectSingleNode(class UnBCL::String *)",
        "?Add@?$Array@PAVString@UnBCL@@@UnBCL@@UAEHPAVString@2@@Z",
        "3C3_3",
        "int __thiscall UnBCL::Hashtable<class UnBCL::String *,class UnBCL::String *>::ContainsKey(class UnBCL::String *) const",
        "SetUnhandledExceptionFilter",
        "8$8(888H8L8d8h8l8p8t8x8",
        "??0AbandonedMutexException@UnBCL@@QAE@PBG@Z",
        "??0IInstanceFactory@UnBCL@@QAE@$$QAU01@@Z",
        "4(4,4<4@4P4T4X4\\4`4d4x4|4",
        "class UnBCL::RegistryKey *__thiscall UnBCL::RegistryKey::CreateSubKey(const class UnBCL::String *)",
        "??0ArgumentException@UnBCL@@QAE@XZ",
        "2@2d2",
        ".PAVException@UnBCL@@",
        "?set_AutoDelete@?$Array@E@UnBCL@@UAEXH@Z",
        "??0SerializationStream@UnBCL@@QAE@PAVStream@1@W4Mode@01@PAVObject@1@@Z",
        "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7B?$SerializableArrayBase@PAVString@UnBCL@@@_@1@@",
        "?Reset@StringBuilder@UnBCL@@QAEXXZ",
        "7F8^8s8",
        "?set_Capacity@MemoryStream@UnBCL@@UAEXH@Z",
        "9$9,9094989<9L9T9p9",
        "GetComputerNameW",
        "??0?$IList@PAVObject@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
        "6$6+616;6J6R6^6c6i6x6",
        "??_8RegHandle@UnBCL@@7B@",
        "??0SerializationId@UnBCL@@QAE@ABV01@@Z",
        "?get_IsReadOnly@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
        "0C1d1k1r1y1",
        ".?AV?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "?$?,?8?X?`?l?t?",
        "?get_Keys@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAU?$ICollection@PAVString@UnBCL@@@2@XZ",
        ".?AUILogHandler@@",
        "??0SecurityException@UnBCL@@QAE@PAVString@1@@Z",
        "?InvokeOOMHandler@Allocator@UnBCL@@SGXK@Z",
        "??4XmlNamespaceManager@UnBCL@@QAEAAV01@ABV01@@Z",
        "?GetInvalidPathChars@Path@UnBCL@@SGPBVString@2@XZ",
        "?Clone@String@UnBCL@@UBEPAVObject@2@XZ",
        "wcsrchr",
        "??1XmlException@UnBCL@@UAE@XZ",
        ".text",
        "!w(^_",
        "?set_Length@StringBuilder@UnBCL@@QAEXH@Z",
        "838R8",
        "4(5C5c5",
        "Caption",
        "??0?$ArrayList@PAVString@UnBCL@@@UnBCL@@QAE@HH@Z",
        "null array argument to ArrayList#CopyTo",
        "UnBCL::RegHandle::GetStringInternal",
        "void __thiscall UnBCL::XmlSchemaSet::Add(class UnBCL::String *,class UnBCL::XmlDocument *)",
        "?DAYS_TO_1601@DateTime@UnBCL@@0HB",
        "3(3>3a3",
        "int *__thiscall UnBCL::ArrayList<int>::GetBuffer(int)",
        "??_7XmlNode@UnBCL@@6B@",
        "404G4",
        "t!hP<",
        "??_7?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
        "10.0.19041.572",
        "<C<[<v<",
        "??_7MutableString@UnBCL@@6B@",
        "SetErrorMode",
        "?get_ThreadHandle@Thread@UnBCL@@QAEPAXXZ",
        "?get_Length@?$Array@PAVObject@UnBCL@@@UnBCL@@UBEHXZ",
        "??6SerializationStream@UnBCL@@QAEAAV01@M@Z",
        "5;5S5r5",
        "??4Delegate@UnBCL@@QAEAAV01@ABV01@@Z",
        "null array to Array::BinarySearch",
        "??0SerializationException@UnBCL@@QAE@$$QAV01@@Z",
        "?SGetCharCount@UnicodeEncoding@UnBCL@@CGHPBV?$Array@E@2@HH@Z",
        "SetFileAttributesW",
        "5 6T6x6",
        ".?AV?$SmartPtr@VXmlNodeList@XmlLite@UnBCL@@@UnBCL@@",
        "?IsInterned@String@UnBCL@@SGPBV12@PBV12@@Z",
        "iswdigit",
        "??_7?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@6B?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "class UnBCL::XmlNode *__thiscall UnBCL::XmlAttributeCollection::SetNamedItem(class UnBCL::XmlNode *)",
        "210317011458Z0",
        ".?AV?$SmartPtr@VXmlNode@UnBCL@@@UnBCL@@",
        "3#3=3G3T3Z3",
        "int __thiscall UnBCL::WaitHandle::WaitOne(void)",
        ")invalid access to FileStream constructor",
        ".?AV?$SerializableBase@V?$ArrayList@E@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@E@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "?MatchI@String@UnBCL@@SGHPBV12@0@Z",
        "Microsoft Corporation1200",
        "??4SerializationStream@UnBCL@@AAEXABV01@@Z",
        ">=>U>t>",
        "class UnBCL::StringPtr &__thiscall UnBCL::ArrayList<class UnBCL::StringPtr>::get_Item(int)",
        "??0PathTooLongException@UnBCL@@QAE@PBG@Z",
        "HeapAlloc",
        "const class UnBCL::SmartPtr<class UnBCL::String> &__thiscall UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> >::get_Item(int) const",
        "?ToLower@Char@UnBCL@@SGGG@Z",
        "??_7?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@6B@",
        "??0?$IEnumerator@PAVString@UnBCL@@@UnBCL@@QAE@XZ",
        "??_7UnicodeEncoding@UnBCL@@6BEncoding@1@@",
        "?GetObjectID@Object@UnBCL@@UBEIXZ",
        "=#=2=J=x=",
        "??0?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@QAE@XZ",
        "?GetEnumerator@?$Stack@H@UnBCL@@UBEPAU?$IEnumerator@H@2@XZ",
        "<J={=",
        "??_7BufferedStream@UnBCL@@6BObject@1@@",
        "attempt to set negative BufferedStream position",
        "?get_CString@StringBuilder@UnBCL@@QBEPBGXZ",
        "?DeleteSubKey@RegistryKey@UnBCL@@QAEXPBVString@2@H@Z",
        "attempt to delete subkey with subkeys",
        "?Append@StringBuilder@UnBCL@@QAEPAV12@_J@Z",
        "??_7?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
        ";(;9;>;u;",
        "t0j!Yf;",
        "??B?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QBEPAVNullTest@01@XZ",
        "8'828@8",
        "void __thiscall UnBCL::XmlLite::XmlDocument::Load(class UnBCL::String *)",
        "?InsertAfter@XmlNode@UnBCL@@QAEPAV12@PAV12@0@Z",
        "1 1$1<1L1P1T1l1|1",
        "??4?$SerializableArrayBase@E@_@UnBCL@@QAEAAV012@ABV012@@Z",
        "?set_InnerText@XmlNode@UnBCL@@QAEXPAVString@2@@Z",
        "= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=",
        "??4?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        ".?AU?$IDictionary@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@",
        "QSVWh",
        "?Copy@?$ArrayList@PAVString@UnBCL@@@UnBCL@@SGXPBV12@HPAV12@HH@Z",
        "5<5A5V5o5",
        "WWWSWWWW",
        "??_7Thread@UnBCL@@6B@",
        "??0?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
        "??0?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAE@ABV01@@Z",
        "??4ArithmeticException@UnBCL@@QAEAAV01@ABV01@@Z",
        "?Clear@?$Stack@H@UnBCL@@UAEXXZ",
        "8@8p8",
        ".?AVApplicationException@UnBCL@@",
        "> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>",
        "<,<B<",
        "?Parse@Int32Ops@UnBCL@@SGHPBG@Z",
        "??0NotSupportedException@UnBCL@@QAE@PBVString@1@PAVException@1@@Z",
        "979F9v9",
        "void __thiscall UnBCL::_::HTEnumerator<struct UnBCL::SerializationStream::UniqueObject,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,struct UnBCL::SerializationStream::UniqueObject,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,&protected: static struct UnBCL::SerializationStream::UniqueObject __stdcall UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::RetrieveKey(class ATL::CAtlMap<struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::Reset(void)",
        "??_7?$SerializableArrayBase@H@_@UnBCL@@6BObject@2@@",
        "SELECT * FROM Win32_bios",
        "??_8Mutex@UnBCL@@7B@",
        "??_7?$Array@PAVObject@UnBCL@@@UnBCL@@6B01@@",
        ".PAVXmlException@UnBCL@@",
        "base\\ntsetup\\unbcl\\src\\thread.cpp",
        "??0exception@@QAE@ABV0@@Z",
        "RegCloseKey",
        "root of directory to create not found",
        "int __thiscall UnBCL::ASCIIEncoding::GetByteCount(const class UnBCL::String *,int,int) const",
        "?Reset@RegSubkeyEnumerator@UnBCL@@UAEXXZ",
        "??0AbandonedMutexException@UnBCL@@QAE@ABV01@@Z",
        "?GetBuffer@?$ArrayList@G@UnBCL@@UAEPAGH@Z",
        " Microsoft Operations Puerto Rico1&0$",
        "2(2H2P2X2`2l2",
        "?Assign@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@AAEXPAV?$Array@E@2@@Z",
        "??_DFileSystemEnumerator@UnBCL@@QAEXXZ",
        "?s_OOMHandler@Allocator@UnBCL@@0PAUIOutOfMemoryHandler@@A",
        "?RegisterVersion@?$SerializableBase@V?$ArrayList@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@G@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
        ".?AVSerializationStream@UnBCL@@",
        "?get_SubKeyCount@RegistryKey@UnBCL@@QBEHXZ",
        "??4NotSupportedException@UnBCL@@QAEAAV01@ABV01@@Z",
        "?ReadBytes@SerializationStream@UnBCL@@QAEXPAEH@Z",
        "GetModuleFileNameW",
        "< <6<\\<n<}<",
        "void __thiscall UnBCL::Array<class UnBCL::SmartPtr<class UnBCL::String> >::Insert(int,class UnBCL::SmartPtr<class UnBCL::String>)",
        "int __thiscall UnBCL::Process::WaitForExit(int)",
        "GetFileSize",
        "?get_IsLoading@SerializationStream@UnBCL@@QBEHXZ",
        "??0ThreadStateException@UnBCL@@QAE@PBVString@1@@Z",
        "void __thiscall UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> >::RemoveAt(int)",
        "7'787=7t7",
        "??_7?$Stack@H@UnBCL@@6B?$IEnumerable@H@1@@",
        "null envVarName to Environment::IsEnvironmentVarSetTrue",
        "?set_Schemas@XmlDocument@UnBCL@@QAEXPAVXmlSchemaSet@2@@Z",
        ":(:,:<:@:D:H:P:h:x:|:",
        "??_D?$Array@H@UnBCL@@QAEXXZ",
        "?GetEnumerator@?$Array@G@UnBCL@@UBEPAU?$IEnumerator@G@2@XZ",
        "3-3r3",
        ".?AV?$HTDictEnumBase@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@",
        ">H?Q?d?}?",
        ".?AU?$IEnumerator@PAVObject@UnBCL@@@UnBCL@@",
        "CoSetProxyBlanket",
        "??0?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAE@XZ",
        ">X>|>",
        "?AddDictionary@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@AAEXPBU?$IDictionary@PAVString@UnBCL@@PAV12@@2@@Z",
        "__thiscall UnBCL::ArrayList<unsigned char>::ArrayList(const struct UnBCL::ICollection<unsigned char> *)",
        "??0ASCIIEncoding@UnBCL@@QAE@$$QAV01@@Z",
        "?get_Item@?$Array@PAVString@UnBCL@@@UnBCL@@UAEAAPAVString@2@H@Z",
        "??0?$SmartPtr@VStream@UnBCL@@@UnBCL@@QAE@PAVStream@1@@Z",
        "void __stdcall UnBCL::Directory::Move(const class UnBCL::String *,const class UnBCL::String *)",
        "8+9=9O9~9",
        "insufficient space available in target array",
        ".?AVexception@@",
        "int __stdcall UnBCL::MP::OperatorCompare<int>::Compare(int,int)",
        ".data",
        "XmlLite.dll",
        "?CanRegister@SerializationStream@UnBCL@@SGHXZ",
        "<H=Z=l=z=",
        "_wcslwr_s",
        "??0IndexOutOfRangeException@UnBCL@@QAE@PAVString@1@PAVException@1@@Z",
        "??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAE@PBE@Z",
        "??0SecurityException@UnBCL@@QAE@$$QAV01@@Z",
        "6&6H6",
        "7'7x7",
        "??_7?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@6BISerializable@1@@",
        "0;1o1",
        "void __stdcall UnBCL::SerializationStream::UnregisterType(const class UnBCL::String *,int,struct HINSTANCE__ *)",
        "int __thiscall UnBCL::ArrayList<class UnBCL::String *>::BinarySearch(int,int,class UnBCL::String *,struct UnBCL::IComparer<class UnBCL::String *> *)",
        "232Q2X2_2f2m2t2",
        ".?AV?$HTDictEnumBase@UUniqueObject@SerializationStream@UnBCL@@@_@UnBCL@@",
        "??_7?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
        "??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "?ToString@MultiSz@UnBCL@@UBEPAVString@2@XZ",
        "?Interval@TimeSpan@UnBCL@@CG?AV12@NH@Z",
        "??_8?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@7B@",
        "?GetVersionId@?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEHXZ",
        "root of destination path does not exist",
        "??_8OperatingSystem@UnBCL@@7BISerializable@1@@",
        "?LastIndexOf@?$Array@H@UnBCL@@SGHPBV12@HHH@Z",
        "__thiscall UnBCL::XmlDocument::XmlDocument(void)",
        "void __thiscall UnBCL::ArrayList<class UnBCL::Object *>::Insert(int,class UnBCL::Object *)",
        "8#8>8C8",
        "> >$>(>,>0>8>P>T>l>|>",
        "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7",
        "unable to get file position",
        "overflow: unable to convert time to ticks",
        "??0?$IDictionary@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@XZ",
        "??1MemoryStream@UnBCL@@UAE@XZ",
        "class UnBCL::String *__stdcall UnBCL::Path::GetShortName(const class UnBCL::String *)",
        "const unsigned short *__thiscall UnBCL::ArrayList<unsigned short>::GetBuffer(int) const",
        "?Load@XmlDocument@XmlLite@UnBCL@@QAEXPAVString@3@@Z",
        "=3>a>",
        "(080_0f0",
        "??1?$IList@PAVObject@UnBCL@@@UnBCL@@UAE@XZ",
        "4#5<5c5",
        "?Delete@Directory@UnBCL@@SGXPBVString@2@H@Z",
        "?ToString@Type@UnBCL@@UBEPAVString@2@XZ",
        "GetCurrentProcessId",
        "??0?$IEnumerable@PBG@UnBCL@@QAE@XZ",
        ":#;l;~;",
        "30@0c0",
        "8<8`8",
        "?MakeUpper@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ",
        "??0ASCIIEncoding@UnBCL@@QAE@XZ",
        "int __thiscall UnBCL::_::HTEnumerator<struct UnBCL::SerializationStream::UniqueObject,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,&protected: static int __stdcall UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::TableKey,int,struct UnBCL::Hashtable<struct UnBCL::SerializationStream::UniqueObject,int>::KeyTraits,class ATL::CElementTraits<int> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "229879+4583610",
        "null chars to Encoding#GetBytes",
        "?Contains@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UBEHQAVObject@2@@Z",
        ".idata$4",
        "GetModuleFileNameW failed",
        "?Add@XmlAttributeCollection@XmlLite@UnBCL@@IAEXPAVXmlAttribute@23@@Z",
        "<3<9<@<E<J<d<l<u<z<",
        "?get_Millisecond@DateTime@UnBCL@@QBEHXZ",
        "int __thiscall UnBCL::String::LastIndexOf(const unsigned short *,int,int) const",
        "?(?,?<?@?P?T?X?p?t?",
        "tZSj$",
        "?WriteUnformat@TextWriter@UnBCL@@UAEXPBG@Z",
        "?Equals@Object@UnBCL@@SGHPBV12@0@Z",
        ":$:4:@:`:l:",
        ".?AU?$ICollection@PAVXmlNode@XmlLite@UnBCL@@@UnBCL@@",
        "??_7ExternalException@UnBCL@@6B@",
        "3$3_3",
        "4)4q4",
        "<)<C<",
        "1<1D1L1T1\\1d1l1t1|1",
        "??4?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@QAEAAV012@ABV012@@Z",
        "><>O>^>",
        "??0Exception@UnBCL@@QAE@PBG@Z",
        "t,Vj ",
        "?Compare@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBG@Z",
        "RVVVV",
        "?ToString@Version@UnBCL@@UBEPAVString@2@XZ",
        "?Write@StreamWriter@UnBCL@@UAEXPBVString@2@HH@Z",
        ";c<z<",
        ".?AV?$HTEnumerator@UUniqueObject@SerializationStream@UnBCL@@HUTableKey@?$Hashtable@UUniqueObject@SerializationStream@UnBCL@@H@3@HUKeyTraits@53@$1?RetrieveValue@53@KGHPBV?$CAtlMap@UTableKey@?$Hashtable@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@HUKeyTraits@23@V?$CElementTraits@H@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        "2(2,2<2@2P2T2d2h2p2t2|2",
        "GetCurrentDirectoryW",
        "6(60686H6d6l6t6",
        "?what@exception@@UBEPBDXZ",
        ";';6;S;",
        "??_7?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@6B?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@2@@",
        "int __thiscall UnBCL::RegistryKey::get_SubKeyCount(void) const",
        "?-?a?",
        "??C?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QBEPAVEncoding@1@XZ",
        "void __thiscall UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::Remove(class UnBCL::SerializationId *)",
        "Rich}",
        "??7?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@QBE_NXZ",
        ":';Q;",
        "??1?$SerializableStackBase@H@_@UnBCL@@UAE@XZ",
        "??_8?$Array@PAVObject@UnBCL@@@UnBCL@@7B?$IList@PAVObject@UnBCL@@@1@@",
        "class UnBCL::String **__thiscall UnBCL::ArrayList<class UnBCL::String *>::GetBuffer(int)",
        "??4?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "__thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *>::ArrayList(const struct UnBCL::ICollection<class UnBCL::XmlLite::XmlNode *> *)",
        "??0CaseInsensitiveStringComparer@UnBCL@@QAE@XZ",
        "?GetValue@?$Array@G@UnBCL@@UBEGH@Z",
        "?get_Rank@?$Array@H@UnBCL@@UBEHXZ",
        "_CxxThrowException",
        "?Copy@File@UnBCL@@SGPAVString@2@PBV32@0H@Z",
        "??1RegSubkeyEnumerator@UnBCL@@UAE@XZ",
        "??0XmlAttributeCollection@UnBCL@@IAE@XZ",
        "null buf to MemoryStream#Write",
        "??0Exception@UnBCL@@QAE@PBVString@1@PAV01@@Z",
        "2H2l2",
        "??0Type@UnBCL@@IAE@PAVString@1@@Z",
        "class UnBCL::SmartPtr<class UnBCL::String> __thiscall UnBCL::_::ArrayListEnumerator<class UnBCL::SmartPtr<class UnBCL::String> >::get_Current(void) const",
        "?Append@MutableString@UnBCL@@QAEXPBG@Z",
        "sFVj$",
        "7G7V7s7",
        "?Append@?$CSimpleStringT@G$0A@@ATL@@QAEXABV12@@Z",
        "Current retrieved on enumerator after last MoveNext()",
        "525W5o5",
        "S,_^[",
        "?RegisterVersion@?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@MBEXH@Z",
        "?get_ObjectID@SerializationStream@UnBCL@@QBEPBVSerializationId@2@XZ",
        "??4?$IEnumerable@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
        "?get_Ticks@DateTime@UnBCL@@QBE_JXZ",
        "??0?$SerializableArrayBase@G@_@UnBCL@@QAE@ABV012@@Z",
        "??0TextReader@UnBCL@@QAE@$$QAV01@@Z",
        "??0ArgumentNullException@UnBCL@@QAE@ABV01@@Z",
        "U0S0Q",
        "??0?$ArrayList@G@UnBCL@@AAE@ABV01@@Z",
        "?CompareTo@Version@UnBCL@@UBEHPBVObject@2@@Z",
        "??0StreamReader@UnBCL@@QAE@PBVString@1@PAVEncoding@1@@Z",
        "??_7Process@UnBCL@@6B@",
        "negative size to ArrayList#Resize()",
        "?Dump@HeapMemoryManager@UnBCL@@UAEIPAUILogHandler@@@Z",
        "9H:U:m:x:",
        ".PAVSystemException@UnBCL@@",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive<long>(long)",
        "7<7m7z7",
        "?InitTerm@Allocator@UnBCL@@SGXH@Z",
        "??0?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@PAV?$ArrayList@PAVString@UnBCL@@@1@@Z",
        ".?AU?$IEnumerator@PBG@UnBCL@@",
        "H0S0a0o0}0",
        "??0?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAE@ABV01@@Z",
        "282R2h2",
        "?GetHashCode@String@UnBCL@@UBEHXZ",
        "?get_P@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QBEPAVSerializationStream@2@XZ",
        "4D4d4",
        ":$;J;~;",
        "?Collate@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBG@Z",
        "?GetEnumerator@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEPAU?$IEnumerator@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@2@XZ",
        "353k3",
        "null path to Path::WithoutLongPrefix",
        "??_8Version@UnBCL@@7B?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "4#4H4U4k4z4",
        ".?AU?$ICollection@PAVSerializationId@UnBCL@@@UnBCL@@",
        "?CheckPathTooLong@Path@UnBCL@@KGXPBVString@2@@Z",
        "030L0W0",
        "??4Exception@UnBCL@@QAEAAV01@ABV01@@Z",
        "??0Stream@UnBCL@@QAE@ABV01@@Z",
        "<#=E=c=",
        "??_7?$SerializableBase@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
        "null anyOf to String#IndexOfAny",
        "?GetOccurenceCount@String@UnBCL@@QBEHG@Z",
        "2_3q3",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::WritePrimitive<unsigned short>(unsigned short)",
        ">$>,>4><>D>L>T>\\>d>p>",
        ".?AV?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@",
        "=?>S>e>s>",
        "5 545<5D5L5P5X5l5",
        "?DAYS_PER_400@DateTime@UnBCL@@0HB",
        "484G4g4",
        "9H9Z9i9",
        "?GetBuffer@?$CSimpleStringT@G$0A@@ATL@@QAEPAGH@Z",
        "080`0",
        "??4?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z",
        "6+707Q7g7",
        "6,6<6@6D6H6P6h6x6|6",
        "PQQSVW",
        "??_7Stream@UnBCL@@6B01@@",
        "??0MutableString@UnBCL@@QAE@PBGHH@Z",
        ":#:1:?:",
        "??1?$ICollection@G@UnBCL@@UAE@XZ",
        "LeaveCriticalSection",
        ".?AV?$SmartPtr@U?$IEnumerator@PBG@UnBCL@@@UnBCL@@",
        "??4?$IEnumerable@PAVString@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
        "?_Trim@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@XZ",
        "?OemToCharA@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEXXZ",
        "2=2O2a2",
        "?s_Registration@?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
        "?get_NodeType@XmlNode@XmlLite@UnBCL@@QBE?AW4XmlNodeType@3@XZ",
        "item retrieval on empty stack",
        ".rdata$T$brc",
        "??4SyncObject@UnBCL@@QAEAAV01@ABV01@@Z",
        "??1XmlDocument@XmlLite@UnBCL@@UAE@XZ",
        "?IndexOfAny@String@UnBCL@@QBEHPBGHH@Z",
        "?set_AutoDelete@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXH@Z",
        ">N?y?",
        "void __thiscall UnBCL::Array<int>::RemoveAt(int)",
        "??_7Version@UnBCL@@6BISerializable@1@@",
        "?ContainsKey@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@UBEHPAVString@2@@Z",
        "?GetBuffer@?$Array@E@UnBCL@@UBEPBEH@Z",
        "??Y?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@D@Z",
        "?get_ExceptionCode@SEHException@UnBCL@@QBEIXZ",
        ">,>0>4>8><>P>T>X>p>t>",
        "?Nullify@?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAEAAV12@XZ",
        "0C0\\0y0",
        "D$ f9",
        "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9",
        "?Add@?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@UAEHPAVObject@2@@Z",
        "??4SystemException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??_8MultiSz@UnBCL@@7B?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@1@@",
        "HeapDestroy",
        "?set_AutoDelete@?$Array@G@UnBCL@@UAEXH@Z",
        "0M1o1",
        "?Read@FileStream@UnBCL@@UAEHPAEHH@Z",
        "void __thiscall UnBCL::FileStream::Flush(void)",
        "4#4@4S4b4s4",
        ".?AVXmlNodeList@XmlLite@UnBCL@@",
        "??4?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
        ".?AV?$SmartPtr@VStream@UnBCL@@@UnBCL@@",
        "?GetCharCount@UnicodeEncoding@UnBCL@@UBEHPBV?$Array@E@2@HH@Z",
        "??4?$IEnumerable@PBG@UnBCL@@QAEAAU01@ABU01@@Z",
        "?CollateNoCase@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEHPBG@Z",
        "??1ExternalException@UnBCL@@UAE@XZ",
        "?7?I?X?",
        "null startinfo to Process::Start",
        "?get_Item@XmlNodeList@UnBCL@@QAEPAVXmlNode@2@H@Z",
        "?get_TimeOfDay@DateTime@UnBCL@@QBE?AVTimeSpan@2@XZ",
        ".rdata$r$brc",
        "; ;Y;b;",
        "attempt to delete subkey of key opened read-only",
        "??0?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@IAE@XZ",
        "??0TextWriter@UnBCL@@IAE@XZ",
        "7#8@8",
        "?GetNow@DateTime@UnBCL@@SG?AV12@H@Z",
        "FindNextFileNameW",
        "neutral",
        "unable to retrieve value count",
        "9#:-:::@:|:",
        "4-4?4H4S4",
        "unable to release mutex",
        "overflow: numchars too large in UnicodeEncoding::GetMaxByteCount",
        "??0IPoolable@UnBCL@@QAE@XZ",
        "?StreamRead@?$SerializableArrayBase@H@_@UnBCL@@UAEXAAVSerializationStream@3@@Z",
        "??6SerializationStream@UnBCL@@QAEAAV01@V?$SmartPtr@UISerializable@UnBCL@@@1@@Z",
        "1#2B2f2",
        "??_7?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@6BObject@2@@",
        "??BTimeSpan@UnBCL@@QBENXZ",
        "?IndexOf@?$Array@PAVString@UnBCL@@@UnBCL@@SGHPBV12@PAVString@2@HH@Z",
        "int __thiscall UnBCL::ArrayList<class UnBCL::Object *>::BinarySearch(int,int,class UnBCL::Object *,struct UnBCL::IComparer<class UnBCL::Object *> *)",
        "8\"8B8S8",
        "y?Vj$",
        "0$0T0",
        "?get_AutoDelete@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEHXZ",
        "354G4U4",
        ".?AVRegistryKey@UnBCL@@",
        ".?AU?$IEnumerator@G@UnBCL@@",
        "?GetDirectories@Directory@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBVString@2@0H@Z",
        "=S=a=o=}=",
        "3=3n3",
        "result of TimeSpan subtraction too large",
        "?Nullify@?$SmartPtr@VSerializationId@UnBCL@@@UnBCL@@QAEAAV12@XZ",
        ".?AU?$IEnumerator@UUniqueObject@SerializationStream@UnBCL@@@UnBCL@@",
        "??0Exception@UnBCL@@QAE@PBVString@1@@Z",
        "_vsnprintf",
        "??4?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAEAAV01@ABV01@@Z",
        "??_7Registry@UnBCL@@6B@",
        ";8<G<l<",
        "?WriteObjectHeader@SerializationStream@UnBCL@@AAEHPBVObject@2@@Z",
        "??4?$ICollection@PAVObject@UnBCL@@@UnBCL@@QAEAAU01@ABU01@@Z",
        "??_DMutex@UnBCL@@QAEXXZ",
        "??_8OperatingSystem@UnBCL@@7B01@@",
        "get_Length() on closed MemoryStream",
        "=3=D=Y=",
        "?WithoutLongPrefix@Path@UnBCL@@SGPAVString@2@PBV32@AAH@Z",
        "??0RegSubkeyEnumerator@UnBCL@@QAE@ABV01@@Z",
        "2#212",
        ".?AV?$SmartPtr@U?$ICollection@PAVTypeFactoryList@SerializationStream@UnBCL@@@UnBCL@@@UnBCL@@",
        "??0?$Array@G@UnBCL@@QAE@PBU?$ICollection@G@1@@Z",
        "??0OverflowException@UnBCL@@QAE@XZ",
        "??_7?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@6B?$IList@PAVObject@UnBCL@@@1@@",
        "?get_Model@SystemInfo@UnBCL@@QBEPBVString@2@XZ",
        "?RegisterVersion@?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@MBEXH@Z",
        "??7?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBE_NXZ",
        ".?AV?$SmartPtr@U?$ICollection@PAVString@UnBCL@@@UnBCL@@@UnBCL@@",
        "??2Object@UnBCL@@SGPAXIPBDHI@Z",
        "?C?d?",
        "void __thiscall UnBCL::Array<class UnBCL::StringPtr>::Insert(int,class UnBCL::StringPtr)",
        "int __thiscall UnBCL::_::HTEnumerator<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,&protected: static class UnBCL::SerializationStream::TypeFactoryList * __stdcall UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::RetrieveValue(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,class ATL::CElementTraits<class UnBCL::SerializationStream::TypeFactoryList *> > const *,struct __POSITION * const &)>::MoveNext(void)",
        ".?AU?$IEnumerator@VStringPtr@UnBCL@@@UnBCL@@",
        "4-4e4",
        "1=2O2^2{2",
        "?get_Attributes@XmlNode@UnBCL@@QAEPAVXmlAttributeCollection@2@XZ",
        "?RegisterVersion@?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
        "??1?$SmartPtr@VXmlNamespaceManager@UnBCL@@@UnBCL@@UAE@XZ",
        "4,444<4H4h4p4x4",
        "void __thiscall UnBCL::FileStream::Write(const unsigned char *,int,int)",
        "OLE32.dll",
        "unsigned short &__thiscall UnBCL::ArrayList<unsigned short>::get_Item(int)",
        ".?AV?$KeyCollection@UUniqueObject@SerializationStream@UnBCL@@H@_@UnBCL@@",
        ":3:g:",
        "707:7h7t7",
        "GetTempPathW requires length more than MAX_PATH.",
        "void __thiscall UnBCL::ArrayList<class UnBCL::SmartPtr<class UnBCL::String> >::CopyTo(class UnBCL::Array<class UnBCL::SmartPtr<class UnBCL::String> > *,int) const",
        "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7B@",
        "?CopyTo@?$Array@G@UnBCL@@UBEXPAV12@H@Z",
        "<P<^<p<",
        "?Sort@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UAEXXZ",
        "?UnlockBuffer@?$CSimpleStringT@G$0A@@ATL@@QAEXXZ",
        "?LengthAtLeast@MemoryStream@UnBCL@@AAEXH@Z",
        ".?AV?$Stack@PAVObject@UnBCL@@@UnBCL@@",
        "null input to Environment::ExpandEnvironmentVariables",
        "?GetTypeName@?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
        "??0XmlNode@UnBCL@@IAE@XZ",
        "2,3>3P3^3",
        "result of TimeSpan addition too large",
        "?RemoveAt@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXH@Z",
        "??1?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@UAE@XZ",
        "1\"161s1",
        "545>5W5m5",
        "??0?$IEnumerable@PBG@UnBCL@@QAE@ABU01@@Z",
        "?AppendFormat@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAAXPBGZZ",
        ".?AVConsoleLogHandler@UnBCL@@",
        "?get_Minor@Version@UnBCL@@QBEHXZ",
        "4)4?4b4t4",
        "?SetAt@?$CSimpleStringT@G$0A@@ATL@@QAEXHG@Z",
        "YiaKd",
        "0$0(0,00040H0L0\\0`0d0h0l0",
        "??_D?$Stack@PAVObject@UnBCL@@@UnBCL@@QAEXXZ",
        "??0XmlNode@XmlLite@UnBCL@@QAE@ABV012@@Z",
        "?IndexOf@?$Array@E@UnBCL@@UBEHE@Z",
        "?StreamWrite@?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@UBEXAAVSerializationStream@3@@Z",
        "?get_CodePage@Encoding@UnBCL@@UBEHXZ",
        "3+4=4L4c4",
        "??_7?$Stack@H@UnBCL@@6BObject@1@@",
        "??_7?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@6B?$ICollection@PAVString@UnBCL@@@2@@",
        ".?AV?$HTEnumerator@UUniqueObject@SerializationStream@UnBCL@@HUTableKey@?$Hashtable@UUniqueObject@SerializationStream@UnBCL@@H@3@U123@UKeyTraits@53@$1?RetrieveKey@53@KG?AU123@PBV?$CAtlMap@UTableKey@?$Hashtable@UUniqueObject@SerializationStream@UnBCL@@H@UnBCL@@HUKeyTraits@23@V?$CElementTraits@H@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        ")Microsoft Root Certificate Authority 20100",
        "??_7InvalidOperationException@UnBCL@@6B@",
        "??0?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@QAE@H@Z",
        "<Y<|<",
        "??1FileSystemEnumerator@UnBCL@@UAE@XZ",
        "100701213655Z",
        "void __thiscall UnBCL::Array<unsigned short>::Remove(unsigned short)",
        "4+4:4S4",
        "??_8StreamReader@UnBCL@@7BIDisposable@1@@",
        "080s0",
        "??4ArgumentOutOfRangeException@UnBCL@@QAEAAV01@ABV01@@Z",
        "<^=q=",
        "7(747T7\\7h7",
        "OutputDebugStringA",
        "class UnBCL::String *__thiscall UnBCL::FileSystemEnumerator::get_Current(void) throw(...) const",
        "??0?$SerializableStackBase@H@_@UnBCL@@QAE@ABV012@@Z",
        "8)9K9m9",
        "?Replace@String@UnBCL@@QBEPAV12@PBG0W4StringCasing@12@@Z",
        "?RegisterType@SerializationStream@UnBCL@@SGXPBVString@2@HPAUHINSTANCE__@@PAUIInstanceFactory@2@@Z",
        "SetEnvironmentVariableW",
        "??_8FileStream@UnBCL@@7BStream@1@@",
        "?set_LinePosition@XmlException@UnBCL@@MAEXH@Z",
        ".?AV?$HTEnumerator@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@UTableKey@?$Hashtable@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@2@PAV342@UKeyTraits@62@$1?RetrieveValue@62@KGPAV342@PBV?$CAtlMap@UTableKey@?$Hashtable@PAVSerializationId@UnBCL@@PAVTypeFactoryList@SerializationStream@2@@UnBCL@@PAVTypeFactoryList@SerializationStream@3@UKeyTraits@23@V?$CElementTraits@PAVTypeFactoryList@SerializationStream@UnBCL@@@ATL@@@ATL@@ABQAU__POSITION@@@Z@_@UnBCL@@",
        ";8<Q<V<",
        "3M3_3q3",
        "??0Delegate@UnBCL@@QAE@ABV01@@Z",
        "??_8ASCIIEncoding@UnBCL@@7B01@@",
        "=$=(=8=<=@=D=X=\\=l=p=t=",
        "<Q=m=",
        ".?AU?$IEnumerable@PAVTypeFactoryList@SerializationStream@UnBCL@@@UnBCL@@",
        "61686?6k6v6",
        "9(9,9<9L9\\9`9x9",
        "Write() on closed StreamWriter",
        "null path to Path::GetLongName",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive<unsigned long>(unsigned long &)",
        "?set_Position@BufferedStream@UnBCL@@UAEX_J@Z",
        ":2:o:",
        "??6SerializationStream@UnBCL@@QAEAAV01@_K@Z",
        "Architecture",
        "class UnBCL::ArrayList<class UnBCL::String *> *__thiscall UnBCL::String::Split(const unsigned short *,int) const",
        "?Read@StreamReader@UnBCL@@UAEHXZ",
        "?FixupName@RegistryKey@UnBCL@@AAEPAVString@2@ABV32@@Z",
        ".idata",
        "r(j\\[Ph",
        "??1?$IComparer@PAVString@UnBCL@@@UnBCL@@UAE@XZ",
        "GetFileAttributesW",
        "<!=U=d=",
        "class UnBCL::Object *__thiscall UnBCL::Object::Clone(void) const",
        "?get_IsDirectory@FileSystemEnumerator@UnBCL@@QAEHXZ",
        "??0Win32Exception@UnBCL@@QAE@KPBVString@1@PAVException@1@@Z",
        "?MakeReverse@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV12@XZ",
        "141P1p1|1",
        "?GetChars@UnicodeEncoding@UnBCL@@UBEHPBV?$Array@E@2@HHPAV?$Array@G@2@H@Z",
        "??4Path@UnBCL@@QAEAAV01@ABV01@@Z",
        "unsigned char __thiscall UnBCL::_::ArrayListEnumerator<unsigned char>::get_Current(void) const",
        "4#5>5R5s5",
        ".didat$5",
        ":<:m:z:",
        "?get_Item@?$Array@E@UnBCL@@UBEABEH@Z",
        "??1?$SerializableArrayListBase@PAVString@UnBCL@@@_@UnBCL@@UAE@XZ",
        "[0r0y0",
        "4$4,414E4S4[4`4t4",
        "686@6L6l6t6|6",
        "?get_Count@XmlAttributeCollection@XmlLite@UnBCL@@QBEHXZ",
        "?Reverse@?$ArrayList@G@UnBCL@@UAEXXZ",
        "ReadFile",
        "6-7X7",
        "??_7ArgumentNullException@UnBCL@@6B@",
        "t%Vj$",
        "1;2o2",
        ";1;c;r;",
        "??1?$ICollection@PAVString@UnBCL@@@UnBCL@@UAE@XZ",
        "??_D?$Array@PAVString@UnBCL@@@UnBCL@@QAEXXZ",
        "?Concat@String@UnBCL@@SAPAV12@HZZ",
        "?Assign@?$SmartPtr@VString@UnBCL@@@UnBCL@@AAEXABV12@@Z",
        "?SetSysString@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBEPAGPAPAG@Z",
        "??4?$SerializableArrayBase@H@_@UnBCL@@QAEAAV012@ABV012@@Z",
        "242;2B2h2w2",
        "=*>I>[>m>{>",
        "6+6:6[6t6",
        "??0MultiSz@UnBCL@@QAE@PBEIPAK@Z",
        "??1?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@UAE@XZ",
        "??0?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@XZ",
        "??0Thread@UnBCL@@AAE@PAX@Z",
        "class UnBCL::XmlLite::XmlAttribute **__thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *>::GetBuffer(int)",
        "??0MemoryStream@UnBCL@@QAE@XZ",
        "class UnBCL::DictionaryEntry<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *> __thiscall UnBCL::_::HTEnumerator<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::DictionaryEntry<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,&protected: static class UnBCL::DictionaryEntry<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *> __stdcall UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::RetrieveEntry(class ATL::CAtlMap<struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::TableKey,class UnBCL::SerializationStream::TypeFactoryList *,struct UnBCL::Hashtable<class UnBCL::SerializationId *,class UnBCL::SerializationStream::TypeFactoryList *>::KeyTraits,class ATL::CElementTraits<class UnBCL::SerializationStream::TypeFactoryList *> > const *,struct __POSITION * const &)>::get_Current(void) const",
        "?SetValue@?$Array@G@UnBCL@@UAEXGH@Z",
        "??4?$IList@PAVString@UnBCL@@@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "?0?d?",
        "??7?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBE_NXZ",
        "?Add@TimeSpan@UnBCL@@QBE?AV12@ABV12@@Z",
        "333K3v3",
        "<(<H<T<t<",
        "3#3r3",
        ",ZrQkTOI+volVmh1KLjNzEoyyGHgRHMTCEpEz5SzwVyw=0Z",
        "RegEnumKeyEx",
        "null bytes to ASCIIEncoding::GetCharCount",
        "?_Remove@String@UnBCL@@QBE?AV?$SmartPtr@VString@UnBCL@@@2@HH@Z",
        "index out of range to StringBuilder#Chars[] =",
        "class UnBCL::XmlLite::XmlAttribute *const *__thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlAttribute *>::GetBuffer(int) const",
        "??0Registry@UnBCL@@QAE@ABV01@@Z",
        ">2?@?N?\\?j?x?",
        "?GetTypeName@?$SerializableBase@V?$Array@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@PAVString@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@UBEPBVString@2@XZ",
        "?GetTypeName@?$SerializableBase@VMultiSz@UnBCL@@$0A@V?$DefaultInstanceFactory@VMultiSz@UnBCL@@@2@@UnBCL@@UBEPBVString@2@XZ",
        "?ReferenceEquals@Object@UnBCL@@SGHPBV12@0@Z",
        "8,8S8o8",
        "?RegisterVersion@?$SerializableBase@V?$Array@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@H@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@MBEXH@Z",
        "?get_P@?$SmartPtr@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$ArrayList@PAVString@UnBCL@@@2@XZ",
        "?TimeToTicks@DateTime@UnBCL@@AAE_JHHH@Z",
        "606B6M6[6s6",
        "?#?@?^?j?{?",
        "6J7\\7",
        "int __stdcall UnBCL::Array<int>::BinarySearch(const class UnBCL::Array<int> *,int,struct UnBCL::IComparer<int> *)",
        "??0Decoder@UnBCL@@QAE@XZ",
        "?GetStringValue@RegistryKey@UnBCL@@QAEPAVString@2@PBV32@H@Z",
        "int __stdcall UnBCL::ArrayList<class UnBCL::String *>::BinarySearch(class UnBCL::ArrayList<class UnBCL::String *> *,class UnBCL::String *,struct UnBCL::IComparer<class UnBCL::String *> *)",
        "??1?$Array@E@UnBCL@@UAE@XZ",
        "class UnBCL::XmlAttribute *__thiscall UnBCL::XmlAttributeCollection::get_Item(class UnBCL::String *)",
        "Invalid offset to MemoryStream#SetLength",
        "??0ApplicationException@UnBCL@@QAE@XZ",
        "??_7?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6B01@@",
        "??0StringPtr@UnBCL@@QAE@PBG@Z",
        "?MakeTrim@MutableString@UnBCL@@QAEXPBG@Z",
        "8;8_8",
        "??0UnicodeEncoding@UnBCL@@QAE@$$QAV01@@Z",
        "??4IInstanceFactory@UnBCL@@QAEAAU01@$$QAU01@@Z",
        ".PAVIndexOutOfRangeException@UnBCL@@",
        "1S2p2",
        "(object of class=\"%s\" at {%x})",
        "?ValueEquals@?$Hashtable@PAVString@UnBCL@@PAV12@@UnBCL@@IBEHPAVString@2@0@Z",
        "< <(<,<0<4<<<T<d<h<x<|<",
        "??_7?$SerializableBase@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PAVString@UnBCL@@@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@",
        "??0XPathException@UnBCL@@QAE@ABV01@@Z",
        "?GetVersionId@?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@UBEHXZ",
        "??_7ConsoleLogHandler@UnBCL@@6B@",
        "int __stdcall UnBCL::ArrayList<unsigned char>::BinarySearch(class UnBCL::ArrayList<unsigned char> *,unsigned char,struct UnBCL::IComparer<unsigned char> *)",
        "?GetHashCode@Version@UnBCL@@UBEHXZ",
        "?get_IsReadOnly@?$Array@E@UnBCL@@UBEHXZ",
        "??0StringBuilder@UnBCL@@QAE@ABV01@@Z",
        "?IndexOf@?$Array@H@UnBCL@@UBEHH@Z",
        "<0<x<",
        "GetModuleHandle failed",
        "<null>",
        "?get_IsReadOnly@?$ArrayList@G@UnBCL@@UBEHXZ",
        "null str to String::Intern",
        "?Copy@?$ArrayList@G@UnBCL@@SGXPBV12@PAV12@H@Z",
        "?FILETIME_OFFSET@DateTime@UnBCL@@0_JB",
        "3P3s3",
        "??0?$IEnumerable@PAVObject@UnBCL@@@UnBCL@@QAE@XZ",
        "?IsShortCompliant@Path@UnBCL@@SGHPBVString@2@H@Z",
        "GetCurrentProcess",
        "u\"Vj 9r",
        "?Clear@?$Array@E@UnBCL@@UAEXXZ",
        ">0>D>V>x>",
        "??0SystemException@UnBCL@@QAE@PBGPAVException@1@@Z",
        ";*;C;g;u;",
        ".?AU?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@",
        ".?AU?$IEnumerator@E@UnBCL@@",
        ";.;c;",
        "??_7Mutex@UnBCL@@6BIDisposable@1@@",
        "Microsoft Windows0",
        "??0XmlDocument@UnBCL@@QAE@PAUIXMLDOMDocument3@@@Z",
        "1 1$1(1,1@1D1T1X1p1",
        "unable to query value",
        "void __thiscall UnBCL::RegistryKey::SetValue(const class UnBCL::String *,const class UnBCL::Array<unsigned char> *)",
        "7#7i7",
        "FindFirstFileNameW",
        ": :$:8:<:@:D:X:h:l:p:",
        " Operating System",
        "??1?$CollectionBase@PAVObject@UnBCL@@@UnBCL@@MAE@XZ",
        "S _^[",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "~>Vj ",
        "GetPrefix",
        "??0ConsoleLogHandler@UnBCL@@QAE@$$QAV01@@Z",
        "9!9/9=9",
        "class UnBCL::String *__thiscall UnBCL::RegistryKey::GetStringValue(const class UnBCL::String *,int)",
        "?s_Registration@?$SerializableBase@V?$Stack@H@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$Stack@H@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@0UStaticTypeRegistration@12@A",
        "??Y?$CSimpleStringT@G$0A@@ATL@@QAEAAV01@E@Z",
        "?StreamRead@?$SerializableArrayBase@PAVString@UnBCL@@@_@UnBCL@@UAEXAAVSerializationStream@3@@Z",
        "??0?$SmartPtr@VDecoder@UnBCL@@@UnBCL@@QAE@PAVDecoder@1@@Z",
        "z.9Wv",
        "2$2,242<2D2P2p2|2",
        "void __thiscall UnBCL::BufferedStream::Flush(void)",
        "R$VWS",
        "5G5j5",
        "??_7InvalidCastException@UnBCL@@6B@",
        "?get_Day@DateTime@UnBCL@@QBEHXZ",
        "6.7[7",
        "?_Concat@String@UnBCL@@SG?AV?$SmartPtr@VString@UnBCL@@@2@V32@@Z",
        "8C9c9",
        "?GetBuffer@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEPBQAVString@2@H@Z",
        "??4?$IEnumerator@PBG@UnBCL@@QAEAAU01@ABU01@@Z",
        ";A$uS9w",
        "??1CaseInsensitiveStringComparer@UnBCL@@UAE@XZ",
        "??4Decoder@UnBCL@@QAEAAV01@ABV01@@Z",
        "??0InvalidOperationException@UnBCL@@QAE@XZ",
        "??4TextWriter@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "6$64686H6L6\\6`6d6h6l6p6t6",
        "?LastIndexOf@String@UnBCL@@QBEHPBGHH@Z",
        "?_IndexOfAny@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@H@Z",
        "??0String@UnBCL@@QAE@PBV01@@Z",
        "304B4Q4j4",
        "??0XmlAttribute@UnBCL@@QAE@ABV01@@Z",
        ".PAVWin32Exception@UnBCL@@",
        "?get_IsFixedSize@?$Array@G@UnBCL@@UBEHXZ",
        "031s1",
        "5S6w6",
        "?#?-?{?",
        "?AddStackTrace@Exception@UnBCL@@QAEXPBD@Z",
        "0,000H0X0\\0`0x0",
        "?Concat@String@UnBCL@@SGPAV12@PBG000@Z",
        "?get_IsReadOnly@?$Array@G@UnBCL@@UBEHXZ",
        "??0IndexOutOfRangeException@UnBCL@@QAE@XZ",
        "?Assign@?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@AAEXPAV?$Array@PAVString@UnBCL@@@2@@Z",
        "base\\ntsetup\\unbcl\\src\\directory.cpp",
        "??_7FormatException@UnBCL@@6B@",
        "?GetBaseKey@RegistryKey@UnBCL@@KGPAV12@PAUHKEY__@@@Z",
        "?GetManager@?$CSimpleStringT@G$0A@@ATL@@QBEPAUIAtlStringMgr@2@XZ",
        "??4?$IList@H@UnBCL@@QAEAAU01@$$QAU01@@Z",
        "?Clear@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXXZ",
        "??4?$SerializableArrayBase@G@_@UnBCL@@QAEAAV012@ABV012@@Z",
        "?GetValue@?$Array@PAVString@UnBCL@@@UnBCL@@UBEPAVString@2@H@Z",
        "?get_IsVM@SystemInfo@UnBCL@@QBEHXZ",
        "</<N<",
        ".rdata$sxdata",
        "?SetCompressionState@File@UnBCL@@SGHPBVString@2@G@Z",
        "?Exists@Directory@UnBCL@@SGHPBVString@2@@Z",
        "?StreamRead@?$SerializableArrayBase@E@_@UnBCL@@UAEXAAVSerializationStream@3@@Z",
        "int __thiscall UnBCL::Array<class UnBCL::Object *>::Add(class UnBCL::Object *)",
        "?get_Item@XmlAttributeCollection@UnBCL@@QAEPAVXmlAttribute@2@H@Z",
        "?CopyTo@?$ArrayList@G@UnBCL@@UBEXPAV?$Array@G@2@H@Z",
        "=;>L>^>s>",
        "?Subtract@TimeSpan@UnBCL@@QBE?AV12@ABV12@@Z",
        "?ToString@MultiSz@UnBCL@@QBEPAVString@2@G@Z",
        "??_7?$Array@E@UnBCL@@6B?$IEnumerable@E@1@@",
        "??_7MemoryStream@UnBCL@@6BIDisposable@1@@",
        "545d5",
        "GetTickCount",
        "??0?$Array@PAVObject@UnBCL@@@UnBCL@@IAE@XZ",
        "0L0c0r0",
        "?Insert@?$Array@PAVObject@UnBCL@@@UnBCL@@UAEXHPAVObject@2@@Z",
        ">/>R>d>v>",
        "unable to get binary value on key",
        "??_7SEHException@UnBCL@@6B@",
        "attempt to delete nonexistent subkey",
        "??0?$ICollection@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@UnBCL@@QAE@ABU01@@Z",
        "??0XmlDocument@XmlLite@UnBCL@@QAE@XZ",
        "C(^[]",
        "LocalFree",
        "< <.<",
        "__thiscall UnBCL::DateTime::DateTime(int,int,int,int,int,int,int)",
        "??_7XmlDocument@XmlLite@UnBCL@@6B@",
        "??0OutOfMemoryException@UnBCL@@QAE@PAVString@1@@Z",
        "void __thiscall UnBCL::ArrayList<unsigned char>::CopyTo(class UnBCL::Array<unsigned char> *,int) const",
        "5$505P5\\5|5",
        "3<4{4",
        "sAWj ",
        "?Assign@?$SmartPtr@VStream@UnBCL@@@UnBCL@@AAEXABV12@@Z",
        "<@=K=Y=g=u=",
        "??_7?$SerializableBase@VVersion@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@VVersion@UnBCL@@@_@UnBCL@@SGPAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@",
        "?_IndexOf@String@UnBCL@@QBEHV?$SmartPtr@VString@UnBCL@@@2@H@Z",
        "374D4c4",
        "?FromASCII@String@UnBCL@@SGPAV12@PBD@Z",
        "Read() on closed MemoryStream",
        "CreateStreamOnHGlobal",
        "?GetValueNames@RegistryKey@UnBCL@@QAEPAV?$Array@PAVString@UnBCL@@@2@XZ",
        "??7?$SmartPtr@VObject@UnBCL@@@UnBCL@@QBE_NXZ",
        "class UnBCL::SerializationStream &__thiscall UnBCL::SerializationStream::ReadPrimitive<__int64>(__int64 &)",
        "??_8?$Array@E@UnBCL@@7B?$IList@E@1@@",
        "void __thiscall UnBCL::ArrayList<int>::Resize(int,int)",
        "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6",
        "?get_P@?$SmartPtr@VVersion@UnBCL@@@UnBCL@@QBEPAVVersion@2@XZ",
        "??_8?$Array@G@UnBCL@@7B?$SerializableBase@V?$Array@G@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?NewLarvalArray@?$StaticArrayOps@G@_@UnBCL@@SGPAUISerializable@4@XZ@2@@1@@",
        "=!=C=d=",
        "94:F:",
        "??_D?$Stack@H@UnBCL@@QAEXXZ",
        "??_7SecurityException@UnBCL@@6B@",
        "6-6;6I6",
        "?Clone@?$ArrayList@PAVString@UnBCL@@@UnBCL@@UBEPAVObject@2@XZ",
        ")value",
        "y>Sj ",
        "?MAX_TICKS@DateTime@UnBCL@@0_JB",
        "%Microsoft Windows Production PCA 20110",
        "1&1K1p1",
        "?SetValue@?$Array@PAVString@UnBCL@@@UnBCL@@UAEXPAVString@2@H@Z",
        "8#8K8]8l8",
        "3$3D3P3p3x3",
        "?CompareTo@String@UnBCL@@QBEHPBGH@Z",
        "int __thiscall UnBCL::String::_EndsWith(class UnBCL::SmartPtr<class UnBCL::String>) const",
        "??_7Win32Exception@UnBCL@@6B@",
        "?Insert@?$Array@E@UnBCL@@UAEXHE@Z",
        "__thiscall UnBCL::XmlSchemaSet::XmlSchemaSet(void)",
        "3C3w3",
        "HeapValidate",
        "?Add@?$Array@E@UnBCL@@UAEHE@Z",
        "j Xf;",
        "??_7?$ArrayList@PAVString@UnBCL@@@UnBCL@@6B?$IEnumerable@PAVString@UnBCL@@@1@@",
        "set_Capacity on closed MemoryStream",
        ".?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@",
        "void __thiscall UnBCL::MemoryStream::LengthAtLeast(int)",
        "??_7?$SerializableHashtableBase@PAVString@UnBCL@@PAV12@@_@UnBCL@@6B?$IEnumerable@V?$DictionaryEntry@PAVString@UnBCL@@PAV12@@UnBCL@@@2@@",
        "1/2T2i2{2",
        "int __thiscall UnBCL::ArrayList<class UnBCL::XmlLite::XmlNode *>::BinarySearch(int,int,class UnBCL::XmlLite::XmlNode *,struct UnBCL::IComparer<class UnBCL::XmlLite::XmlNode *> *)",
        "int __stdcall UnBCL::Array<unsigned char>::BinarySearch(const class UnBCL::Array<unsigned char> *,unsigned char,struct UnBCL::IComparer<unsigned char> *)",
        "?Mid@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QBE?AV12@H@Z",
        "??_8?$Array@PAVString@UnBCL@@@UnBCL@@7BISerializable@1@@",
        "?Start@Process@UnBCL@@SGPAV12@PBVProcessStartInfo@2@@Z",
        "?Move@Directory@UnBCL@@SGXPBVString@2@0@Z",
        "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0",
        ": :=:[:{:",
        "??Y?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QAEAAV01@E@Z",
        "=3>h>z>",
        "??0XmlException@UnBCL@@QAE@PAVString@1@PAVException@1@HHJ@Z",
        ".?AV?$Array@PAVXmlNode@XmlLite@UnBCL@@@UnBCL@@",
        "?_Concat@String@UnBCL@@SG?AV?$SmartPtr@VString@UnBCL@@@2@V32@00@Z",
        ";$<R<i<",
        "null instance to Monitor::Wait",
        "??_DFileStream@UnBCL@@QAEXXZ",
        "??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEPAVString@1@XZ",
        ".?AVArgumentNullException@UnBCL@@",
        "??4InvalidCastException@UnBCL@@QAEAAV01@$$QAV01@@Z",
        "??0?$SerializableBase@VOperatingSystem@UnBCL@@$00V?$DefaultInstanceFactory@VOperatingSystem@UnBCL@@@2@@UnBCL@@QAE@ABV01@@Z",
        "?GetOccurenceIndexOf@String@UnBCL@@QBEHGH@Z",
        ".rdata$zzzdbg",
        ";.<k<",
        "?WaitForExit@Process@UnBCL@@QAEHH@Z",
        "?WithLongPrefixUNC@Path@UnBCL@@SGPAVString@2@PBV32@H@Z",
        "u@Vj$",
        "?BinarySearch@?$Array@G@UnBCL@@SGHPBV12@GPAU?$IComparer@G@2@@Z",
        "?Compare@String@UnBCL@@SGHPBG0H@Z",
        "class UnBCL::String *__stdcall UnBCL::File::GetTemporaryFileName(const class UnBCL::String *)",
        "??_7SerializationId@UnBCL@@6B@",
        "VSSSS",
        "void __thiscall UnBCL::ArrayList<class UnBCL::String *>::Insert(int,class UnBCL::String *)",
        "??0?$SmartPtr@VSerializationStream@UnBCL@@@UnBCL@@QAE@XZ",
        "CreateThread",
        "hMYZV"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "7db85e25c08e701dbc4d1a01c7611c89cfb08622415ab3e3b339dc217aa864c1",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/7db85e25c08e701dbc4d1a01c7611c89cfb08622415ab3e3b339dc217aa864c1",
              "guest_paths": [
                "overlay"
              ],
              "size": 8512,
              "crc32": "0D71448B",
              "md5": "dd6af0ed9f9ed2d99cfd1a941ed5b569",
              "sha1": "5d3b2e55b35ba7d51b7570e95bad7f6085b42978",
              "sha256": "7db85e25c08e701dbc4d1a01c7611c89cfb08622415ab3e3b339dc217aa864c1",
              "sha512": "d5a045f9837ca8473ff23475da82ac41b649d01d31f24c067bff974b619cd708a2a85d16a540143c0d98d75188b41243f4160db44786cfc2eea94d7498376b52",
              "rh_hash": null,
              "ssdeep": "96:/MDXBDbz9MekJ3AhNpVtEiJhwDD0pBDXiebs/Am2grWXGueDXT7l+RBDqhBYDfrU:HF2q8hDBQABJgBcr+YVqnajKsk9G8",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T166023BD28E6C5847DEE27C4053A8F957BE3E53CB2850855605AAF9E81C833C6EF0866D",
              "sha3_384": "d7a342efa643e57adcc18779290813072928ef536010a247f62884b84bcc18219fdbf12ecbc611dbebfd641fe182c0b3",
              "data": null
            }
          ],
          "extracted_files_time": 0.0005145140021340922,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "products.xml"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/76fcc8eeacb7da966441a7e0ac8b79cc095f13682abb92ee5a614c52f72ce54c",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\products.xml"
      ],
      "size": 2794793,
      "crc32": "6444C97C",
      "md5": "f9c1df5c8718468b892af250f6d7b78e",
      "sha1": "040da263bc223436f929dbc1f2ab88198e299610",
      "sha256": "76fcc8eeacb7da966441a7e0ac8b79cc095f13682abb92ee5a614c52f72ce54c",
      "sha512": "edeb708e50f815ef022bd9275255dd3644b07597e9a90736364fbb7206b77ba44953d61735def7e2653a12442fd623baff0630793b507eccf4508e772ba02a39",
      "rh_hash": null,
      "ssdeep": "6144:iqm6xDGaol3wdAZNRlKUp9Lq0T/vjXrOo/TpuIexzfDS8/jRCMRNoUosgFTkYKl1:dzfDS8/jRCMRNxyrcL/cGPjOAEg",
      "type": "Unicode text, UTF-8 text, with CRLF line terminators",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T104D5DFB5E4D5B20970335493BCA0A727FC19900B4918E8EDB9CD262F1FF36A931A35B5",
      "sha3_384": "de20707c25dc9483d4de2977b76e79ffc2719123825581346d88788cbc853bc7ddc93a2123f12cb2dfe2cdfb1b223e9d",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": "<MCT>\n  <Catalogs>\n    <Catalog version=\"1.4.1\">\n      <PublishedMedia id=\"\" release=\"\">\n        <Files>\n          <File id=\"\">\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCHINA_RET_x64FRE_zh-cn.esd</FileName>\n            <LanguageCode>zh-cn</LanguageCode>\n            <Language>Chinese (Simplified, China)</Language>\n            <Edition>CoreCountrySpecific</Edition>\n            <Architecture>x64</Architecture>\n            <Size>3945834799</Size>\n            <Sha1>8b49a8943cb3260ce9a8dadcd729f0ac98018245</Sha1>\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/6048ac73-c010-4eaf-ac07-a8672588662e/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCHINA_RET_x64FRE_zh-cn.esd</FilePath>\n            <Key />\n            <Architecture_Loc>%ARCH_64%</Architecture_Loc>\n            <Edition_Loc>%BASE_CHINA%</Edition_Loc>\n            <IsRetailOnly>False</IsRetailOnly>\n          </File>\n          <File id=\"\">\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCHINA_RET_x86FRE_zh-cn.esd</FileName>\n            <LanguageCode>zh-cn</LanguageCode>\n            <Language>Chinese (Simplified, China)</Language>\n            <Edition>CoreCountrySpecific</Edition>\n            <Architecture>x86</Architecture>\n            <Size>2884140025</Size>\n            <Sha1>fbd0b7322af31de59db60b437150080c81451a76</Sha1>\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/927ea937-74a7-4f37-aeaf-14a7cf98acc5/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCHINA_RET_x86FRE_zh-cn.esd</FilePath>\n            <Key />\n            <Architecture_Loc>%ARCH_32%</Architecture_Loc>\n            <Edition_Loc>%BASE_CHINA%</Edition_Loc>\n            <IsRetailOnly>False</IsRetailOnly>\n          </File>\n          <File id=\"\">\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd</FileName>\n            <LanguageCode>ko-kr</LanguageCode>\n            <Language>Korean (Korea)</Language>\n            <Edition>Professional</Edition>\n            <Architecture>x64</Architecture>\n            <Size>3955051946</Size>\n            <Sha1>a39fb6ff19f14ed12f0a274adb4982c7374981ab</Sha1>\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/49b275b7-dcce-4e80-acdf-f925debb0dae/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd</FilePath>\n            <Key />\n            <Architecture_Loc>%ARCH_64%</Architecture_Loc>\n            <Edition_Loc>%CLIENT%</Edition_Loc>\n            <IsRetailOnly>False</IsRetailOnly>\n          </File>\n          <File id=\"\">\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd</FileName>\n            <LanguageCode>ko-kr</LanguageCode>\n            <Language>Korean (Korea)</Language>\n            <Edition>ProfessionalN</Edition>\n            <Architecture>x64</Architecture>\n            <Size>3955051946</Size>\n            <Sha1>a39fb6ff19f14ed12f0a274adb4982c7374981ab</Sha1>\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/49b275b7-dcce-4e80-acdf-f925debb0dae/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd</FilePath>\n            <Key />\n            <Architecture_Loc>%ARCH_64%</Architecture_Loc>\n            <Edition_Loc>%CLIENT%</Edition_Loc>\n            <IsRetailOnly>False</IsRetailOnly>\n          </File>\n          <File id=\"\">\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd</FileName>\n            <LanguageCode>ko-kr</LanguageCode>\n            <Language>Korean (Korea)</Language>\n            <Edition>ProfessionalEducation</Edition>\n            <Architecture>x64</Architecture>\n            <Size>3955051946</Size>\n            <Sha1>a39fb6ff19f14ed12f0a274adb4982c7374981ab</Sha1>\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/49b275b7-dcce-4e80-acdf-f925debb0dae/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd</FilePath>\n            <Key />\n            <Architecture_Loc>%ARCH_64%</Architecture_Loc>\n            <Edition_Loc>%CLIENT%</Edition_Loc>\n            <IsRetailOnly>False</IsRetailOnly>\n          </File>\n          <File id=\"\">\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd</FileName>\n            <LanguageCode>ko-kr</LanguageCode>\n            <Language>Korean (Korea)</Language>\n            <Edition>ProfessionalEducationN</Edition>\n            <Architecture>x64</Architecture>\n            <Size>3955051946</Size>\n            <Sha1>a39fb6ff19f14ed12f0a274adb4982c7374981ab</Sha1>\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/49b275b7-dcce-4e80-acdf-f925debb0dae/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd</FilePath>\n            <Key />\n            <Architecture_Loc>%ARCH_64%</Architecture_Loc>\n            <Edition_Loc>%CLIENT%</Edition_Loc>\n            <IsRetailOnly>False</IsRetailOnly>\n          </File>\n          <File id=\"\">\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd</FileName>\n            <LanguageCode>ko-kr</LanguageCode>\n            <Language>Korean (Korea)</Language>\n            <Edition>ProfessionalWorkstation</Edition>\n            <Architecture>x64</Architecture>\n            <Size>3955051946</Size>\n            <Sha1>a39fb6ff19f14ed12f0a274adb4982c7374981ab</Sha1>\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/49b275b7-dcce-4e80-acdf-f925debb0dae/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd</FilePath>\n            <Key />\n            <Architecture_Loc>%ARCH_64%</Architecture_Loc>\n            <Edition_Loc>%CLIENT%</Edition_Loc>\n            <IsRetailOnly>False</IsRetailOnly>\n          </File>\n          <File id=\"\">\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd</FileName>\n            <LanguageCode>ko-kr</LanguageCode>\n            <Language>Korean (Korea)</Language>\n            <Edition>ProfessionalWorkstationN</Edition>\n            <Architecture>x64</Architecture>\n            <Size>3955051946</Size>\n            <Sha1>a39fb6ff19f14ed12f0a274adb4982c7374981ab</Sha1>\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/49b275b7-dcce-4e80-acdf-f925debb0dae/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd</FilePath>\n            <Key />\n            <Architecture_Loc>%ARCH_64%</Architecture_Loc>\n            <Edition_Loc>%CLIENT%</Edition_Loc>\n            <IsRetailOnly>False</IsRetailOnly>\n          </File>\n          <File id=\"\">\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd</FileName>\n            <LanguageCode>ko-kr</LanguageCode>\n            <Language>Korean (Korea)</Language>\n            <Edition>Core</Edition>\n            <Architecture>x64</Architecture>\n            <Size>3955051946</Size>\n            <Sha1>a39fb6ff19f14ed12f0a274adb4982c7374981ab</Sha1>\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/49b275b7-dcce-4e80-acdf-f925debb0dae/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd</FilePath>\n            <Key />\n            <Architecture_Loc>%ARCH_64%</Architecture_Loc>\n            <Edition_Loc>%CLIENT%</Edition_Loc>\n            <IsRetailOnly>False</IsRetailOnly>\n          </File>\n          <File id=\"\">\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd</FileName>\n            <LanguageCode>ko-kr</LanguageCode>\n            <Language>Korean (Korea)</Language>\n            <Edition>CoreN</Edition>\n            <Architecture>x64</Architecture>\n            <Size>3955051946</Size>\n            <Sha1>a39fb6ff19f14ed12f0a274adb4982c7374981ab</Sha1>\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/fil <truncated>",
      "strings": [],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5932
    },
    {
      "name": [
        "setuperr.log"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/948a87cf54643b2a1caceea44957df93724ec970fc1995bfe09e9d97780144ba",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log"
      ],
      "size": 128,
      "crc32": "A2B446D3",
      "md5": "19975dc231e744f67e7222a2859bd9a9",
      "sha1": "018d5ca2eb655355a0cf64d663de5f095179b436",
      "sha256": "948a87cf54643b2a1caceea44957df93724ec970fc1995bfe09e9d97780144ba",
      "sha512": "8b745574e4b8a9dc03abd035b156774232c34150d711670a39dde7f3a1ee55f79358c6ee2a46264b01892297660863063789d7f7361bbdddfd0af1c98e4de439",
      "rh_hash": null,
      "ssdeep": "3:P6IXULZZX8/FFm1mdXQ+UYlLwX96fizb4t:iIXy+/b6vtyl",
      "type": "Unicode text, UTF-8 (with BOM) text, with CRLF line terminators",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T195B012073A3101B5E0D02630FB00BE1C1657344692C4242A318FA479E7C38F449AD6ED",
      "sha3_384": "07529f584432f4103396926b944fa62b7336d3ff50c51a6e49e9df5bb30c6fdf4a315a36422d75fe83e47d237464fdab",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": "\\xfeff2026-05-28 15:59:35, Error                 MOUPG  CInstallUI::GetDefaultLanguage(2027): Result = 0x80070002[gle=0x00000002]\n",
      "strings": [],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5932
    },
    {
      "name": [
        "DiagTrack.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/b55d66f2943f1c63ea9b39dae88aa2a4f91775cefffefd263bd302866a7bd91c",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
      ],
      "size": 922976,
      "crc32": "D4B75FAE",
      "md5": "6c3f6a6bc5ede978e9dfe1acce386339",
      "sha1": "3b7b51d762c593e92123f9365a896ed64ee26a7a",
      "sha256": "b55d66f2943f1c63ea9b39dae88aa2a4f91775cefffefd263bd302866a7bd91c",
      "sha512": "3f87064354a0f55f36aa272c5918d208b8a77fffb7965e9b50727c06fd8d8db5e6695636a7db37926fe444c91e4a4a7dc892ef5ef57676ba9515216d5e5f94ff",
      "rh_hash": null,
      "ssdeep": "12288:Er+9jUr2TTWLQRPwMRlf+8Kh+fx6gmkwJKdMrtUIHkaMNUEP3g5Qy1Jxb3ArS:A+9jUr2TTr5LlfcwwggUhnNzg5Rbwr",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1EB155C32ABEC8176FAFB16B4362D622550BDF8701F2088CB6250479E6970BD1AF34757",
      "sha3_384": "0fb890b408147aec6a2b35e417bd4006147ec1241b420c8fffb92e00ed817208d33bd42a85df58d8e6d8671e533a6132",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x000ac5d0",
        "ep_bytes": "8bff558bec837d0c017505e86b060000",
        "peid_signatures": null,
        "reported_checksum": "0x000ebf44",
        "actual_checksum": "0x000ebf44",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "diagtrack.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x100cd418",
                "name": "rand_s"
              },
              {
                "address": "0x100cd41c",
                "name": "vswprintf_s"
              },
              {
                "address": "0x100cd420",
                "name": "_snprintf"
              },
              {
                "address": "0x100cd424",
                "name": "_finite"
              },
              {
                "address": "0x100cd428",
                "name": "_vscwprintf"
              },
              {
                "address": "0x100cd42c",
                "name": "realloc"
              },
              {
                "address": "0x100cd430",
                "name": "wcsnlen"
              },
              {
                "address": "0x100cd434",
                "name": "wcsncmp"
              },
              {
                "address": "0x100cd438",
                "name": "towlower"
              },
              {
                "address": "0x100cd43c",
                "name": "strnlen"
              },
              {
                "address": "0x100cd440",
                "name": "srand"
              },
              {
                "address": "0x100cd444",
                "name": "sprintf_s"
              },
              {
                "address": "0x100cd448",
                "name": "wcsstr"
              },
              {
                "address": "0x100cd44c",
                "name": "_wtoi"
              },
              {
                "address": "0x100cd450",
                "name": "_wcstoi64"
              },
              {
                "address": "0x100cd454",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x100cd458",
                "name": "memcpy_s"
              },
              {
                "address": "0x100cd45c",
                "name": "_wcstoui64"
              },
              {
                "address": "0x100cd460",
                "name": "_wtof"
              },
              {
                "address": "0x100cd464",
                "name": "towupper"
              },
              {
                "address": "0x100cd468",
                "name": "swprintf_s"
              },
              {
                "address": "0x100cd46c",
                "name": "_snwscanf_s"
              },
              {
                "address": "0x100cd470",
                "name": "_ftol2"
              },
              {
                "address": "0x100cd474",
                "name": "memcmp"
              },
              {
                "address": "0x100cd478",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x100cd47c",
                "name": "_wcsdup"
              },
              {
                "address": "0x100cd480",
                "name": "_onexit"
              },
              {
                "address": "0x100cd484",
                "name": "__dllonexit"
              },
              {
                "address": "0x100cd488",
                "name": "_unlock"
              },
              {
                "address": "0x100cd48c",
                "name": "_lock"
              },
              {
                "address": "0x100cd490",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x100cd494",
                "name": "_initterm"
              },
              {
                "address": "0x100cd498",
                "name": "_amsg_exit"
              },
              {
                "address": "0x100cd49c",
                "name": "_XcptFilter"
              },
              {
                "address": "0x100cd4a0",
                "name": "_callnewh"
              },
              {
                "address": "0x100cd4a4",
                "name": "?what@exception@@UBEPBDXZ"
              },
              {
                "address": "0x100cd4a8",
                "name": "??1exception@@UAE@XZ"
              },
              {
                "address": "0x100cd4ac",
                "name": "??0exception@@QAE@ABV0@@Z"
              },
              {
                "address": "0x100cd4b0",
                "name": "??0exception@@QAE@ABQBDH@Z"
              },
              {
                "address": "0x100cd4b4",
                "name": "??0exception@@QAE@ABQBD@Z"
              },
              {
                "address": "0x100cd4b8",
                "name": "??0exception@@QAE@XZ"
              },
              {
                "address": "0x100cd4bc",
                "name": "memcpy"
              },
              {
                "address": "0x100cd4c0",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x100cd4c4",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x100cd4c8",
                "name": "_stricmp"
              },
              {
                "address": "0x100cd4cc",
                "name": "_wcsicmp"
              },
              {
                "address": "0x100cd4d0",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x100cd4d4",
                "name": "malloc"
              },
              {
                "address": "0x100cd4d8",
                "name": "_purecall"
              },
              {
                "address": "0x100cd4dc",
                "name": "??_V@YAXPAX@Z"
              },
              {
                "address": "0x100cd4e0",
                "name": "free"
              },
              {
                "address": "0x100cd4e4",
                "name": "memmove"
              },
              {
                "address": "0x100cd4e8",
                "name": "wcschr"
              },
              {
                "address": "0x100cd4ec",
                "name": "??8type_info@@QBEHABV0@@Z"
              },
              {
                "address": "0x100cd4f0",
                "name": "wcscpy_s"
              },
              {
                "address": "0x100cd4f4",
                "name": "swscanf_s"
              },
              {
                "address": "0x100cd4f8",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x100cd4fc",
                "name": "rand"
              },
              {
                "address": "0x100cd500",
                "name": "time"
              },
              {
                "address": "0x100cd504",
                "name": "??3@YAXPAX@Z"
              },
              {
                "address": "0x100cd508",
                "name": "memset"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x100cd118",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x100cd11c",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x100cd120",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x100cd124",
                "name": "GetTickCount64"
              },
              {
                "address": "0x100cd128",
                "name": "WakeConditionVariable"
              },
              {
                "address": "0x100cd12c",
                "name": "AcquireSRWLockExclusive"
              },
              {
                "address": "0x100cd130",
                "name": "SleepConditionVariableSRW"
              },
              {
                "address": "0x100cd134",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x100cd138",
                "name": "MoveFileExW"
              },
              {
                "address": "0x100cd13c",
                "name": "RaiseFailFastException"
              },
              {
                "address": "0x100cd140",
                "name": "UnregisterWaitEx"
              },
              {
                "address": "0x100cd144",
                "name": "DisableThreadLibraryCalls"
              },
              {
                "address": "0x100cd148",
                "name": "Sleep"
              },
              {
                "address": "0x100cd14c",
                "name": "CreateEventW"
              },
              {
                "address": "0x100cd150",
                "name": "InitializeConditionVariable"
              },
              {
                "address": "0x100cd154",
                "name": "CloseThreadpool"
              },
              {
                "address": "0x100cd158",
                "name": "LoadResource"
              },
              {
                "address": "0x100cd15c",
                "name": "FindResourceExW"
              },
              {
                "address": "0x100cd160",
                "name": "FreeResource"
              },
              {
                "address": "0x100cd164",
                "name": "EncodePointer"
              },
              {
                "address": "0x100cd168",
                "name": "LocalAlloc"
              },
              {
                "address": "0x100cd16c",
                "name": "TerminateProcess"
              },
              {
                "address": "0x100cd170",
                "name": "GetVersionExW"
              },
              {
                "address": "0x100cd174",
                "name": "WaitForMultipleObjectsEx"
              },
              {
                "address": "0x100cd178",
                "name": "WaitForThreadpoolWorkCallbacks"
              },
              {
                "address": "0x100cd17c",
                "name": "GetSystemDirectoryW"
              },
              {
                "address": "0x100cd180",
                "name": "InitializeCriticalSectionAndSpinCount"
              },
              {
                "address": "0x100cd184",
                "name": "GetUserGeoID"
              },
              {
                "address": "0x100cd188",
                "name": "GetSystemDefaultLCID"
              },
              {
                "address": "0x100cd18c",
                "name": "GetNativeSystemInfo"
              },
              {
                "address": "0x100cd190",
                "name": "GetThreadPriority"
              },
              {
                "address": "0x100cd194",
                "name": "GlobalFree"
              },
              {
                "address": "0x100cd198",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x100cd19c",
                "name": "HeapFree"
              },
              {
                "address": "0x100cd1a0",
                "name": "HeapAlloc"
              },
              {
                "address": "0x100cd1a4",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x100cd1a8",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x100cd1ac",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x100cd1b0",
                "name": "GetTickCount"
              },
              {
                "address": "0x100cd1b4",
                "name": "CloseThreadpoolWork"
              },
              {
                "address": "0x100cd1b8",
                "name": "WerRegisterMemoryBlock"
              },
              {
                "address": "0x100cd1bc",
                "name": "WriteFile"
              },
              {
                "address": "0x100cd1c0",
                "name": "CreateFileW"
              },
              {
                "address": "0x100cd1c4",
                "name": "WideCharToMultiByte"
              },
              {
                "address": "0x100cd1c8",
                "name": "InitializeCriticalSectionEx"
              },
              {
                "address": "0x100cd1cc",
                "name": "CreateThreadpoolTimer"
              },
              {
                "address": "0x100cd1d0",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x100cd1d4",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x100cd1d8",
                "name": "SetThreadpoolTimer"
              },
              {
                "address": "0x100cd1dc",
                "name": "CloseThreadpoolTimer"
              },
              {
                "address": "0x100cd1e0",
                "name": "WaitForThreadpoolTimerCallbacks"
              },
              {
                "address": "0x100cd1e4",
                "name": "SetThreadPriority"
              },
              {
                "address": "0x100cd1e8",
                "name": "WaitForMultipleObjects"
              },
              {
                "address": "0x100cd1ec",
                "name": "FindNextChangeNotification"
              },
              {
                "address": "0x100cd1f0",
                "name": "FindFirstChangeNotificationW"
              },
              {
                "address": "0x100cd1f4",
                "name": "WTSGetActiveConsoleSessionId"
              },
              {
                "address": "0x100cd1f8",
                "name": "AcquireSRWLockShared"
              },
              {
                "address": "0x100cd1fc",
                "name": "ReleaseSRWLockShared"
              },
              {
                "address": "0x100cd200",
                "name": "LocalFree"
              },
              {
                "address": "0x100cd204",
                "name": "ReadFile"
              },
              {
                "address": "0x100cd208",
                "name": "GetFileSize"
              },
              {
                "address": "0x100cd20c",
                "name": "FindCloseChangeNotification"
              },
              {
                "address": "0x100cd210",
                "name": "CreateThreadpool"
              },
              {
                "address": "0x100cd214",
                "name": "SetThreadpoolThreadMaximum"
              },
              {
                "address": "0x100cd218",
                "name": "CreateThreadpoolWork"
              },
              {
                "address": "0x100cd21c",
                "name": "SubmitThreadpoolWork"
              },
              {
                "address": "0x100cd220",
                "name": "FileTimeToSystemTime"
              },
              {
                "address": "0x100cd224",
                "name": "MultiByteToWideChar"
              },
              {
                "address": "0x100cd228",
                "name": "SetFilePointerEx"
              },
              {
                "address": "0x100cd22c",
                "name": "GetSystemPreferredUILanguages"
              },
              {
                "address": "0x100cd230",
                "name": "GetProductInfo"
              },
              {
                "address": "0x100cd234",
                "name": "SetEndOfFile"
              },
              {
                "address": "0x100cd238",
                "name": "UnmapViewOfFile"
              },
              {
                "address": "0x100cd23c",
                "name": "MapViewOfFile"
              },
              {
                "address": "0x100cd240",
                "name": "CreateFileMappingW"
              },
              {
                "address": "0x100cd244",
                "name": "GetFileSizeEx"
              },
              {
                "address": "0x100cd248",
                "name": "ResetEvent"
              },
              {
                "address": "0x100cd24c",
                "name": "GetTempPathW"
              },
              {
                "address": "0x100cd250",
                "name": "MoveFileW"
              },
              {
                "address": "0x100cd254",
                "name": "VirtualAlloc"
              },
              {
                "address": "0x100cd258",
                "name": "VirtualFree"
              },
              {
                "address": "0x100cd25c",
                "name": "QueryPerformanceFrequency"
              },
              {
                "address": "0x100cd260",
                "name": "GetSystemInfo"
              },
              {
                "address": "0x100cd264",
                "name": "SetThreadPriorityBoost"
              },
              {
                "address": "0x100cd268",
                "name": "FlushViewOfFile"
              },
              {
                "address": "0x100cd26c",
                "name": "GlobalMemoryStatusEx"
              },
              {
                "address": "0x100cd270",
                "name": "OpenProcess"
              },
              {
                "address": "0x100cd274",
                "name": "QueryUnbiasedInterruptTime"
              },
              {
                "address": "0x100cd278",
                "name": "GetTempFileNameW"
              },
              {
                "address": "0x100cd27c",
                "name": "GetSystemPowerStatus"
              },
              {
                "address": "0x100cd280",
                "name": "K32GetPerformanceInfo"
              },
              {
                "address": "0x100cd284",
                "name": "IsWow64Process"
              },
              {
                "address": "0x100cd288",
                "name": "CreateProcessW"
              },
              {
                "address": "0x100cd28c",
                "name": "GetExitCodeProcess"
              },
              {
                "address": "0x100cd290",
                "name": "CreateToolhelp32Snapshot"
              },
              {
                "address": "0x100cd294",
                "name": "Process32FirstW"
              },
              {
                "address": "0x100cd298",
                "name": "Process32NextW"
              },
              {
                "address": "0x100cd29c",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x100cd2a0",
                "name": "UpdateProcThreadAttribute"
              },
              {
                "address": "0x100cd2a4",
                "name": "DeleteProcThreadAttributeList"
              },
              {
                "address": "0x100cd2a8",
                "name": "CreateWaitableTimerExW"
              },
              {
                "address": "0x100cd2ac",
                "name": "SetWaitableTimerEx"
              },
              {
                "address": "0x100cd2b0",
                "name": "SetFilePointer"
              },
              {
                "address": "0x100cd2b4",
                "name": "GetStdHandle"
              },
              {
                "address": "0x100cd2b8",
                "name": "CreateJobObjectW"
              },
              {
                "address": "0x100cd2bc",
                "name": "SetInformationJobObject"
              },
              {
                "address": "0x100cd2c0",
                "name": "AssignProcessToJobObject"
              },
              {
                "address": "0x100cd2c4",
                "name": "SetWaitableTimer"
              },
              {
                "address": "0x100cd2c8",
                "name": "ResumeThread"
              },
              {
                "address": "0x100cd2cc",
                "name": "TerminateJobObject"
              },
              {
                "address": "0x100cd2d0",
                "name": "SystemTimeToFileTime"
              },
              {
                "address": "0x100cd2d4",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x100cd2d8",
                "name": "SetEvent"
              },
              {
                "address": "0x100cd2dc",
                "name": "CreateThread"
              },
              {
                "address": "0x100cd2e0",
                "name": "FindFirstFileExW"
              },
              {
                "address": "0x100cd2e4",
                "name": "CopyFileW"
              },
              {
                "address": "0x100cd2e8",
                "name": "FindFirstFileW"
              },
              {
                "address": "0x100cd2ec",
                "name": "FindClose"
              },
              {
                "address": "0x100cd2f0",
                "name": "DeleteFileW"
              },
              {
                "address": "0x100cd2f4",
                "name": "SetFileAttributesW"
              },
              {
                "address": "0x100cd2f8",
                "name": "RemoveDirectoryW"
              },
              {
                "address": "0x100cd2fc",
                "name": "FindNextFileW"
              },
              {
                "address": "0x100cd300",
                "name": "CreateDirectoryW"
              },
              {
                "address": "0x100cd304",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x100cd308",
                "name": "SetLastError"
              },
              {
                "address": "0x100cd30c",
                "name": "GetCurrentThread"
              },
              {
                "address": "0x100cd310",
                "name": "ExpandEnvironmentStringsW"
              },
              {
                "address": "0x100cd314",
                "name": "SetEnvironmentVariableW"
              },
              {
                "address": "0x100cd318",
                "name": "FormatMessageW"
              },
              {
                "address": "0x100cd31c",
                "name": "OutputDebugStringW"
              },
              {
                "address": "0x100cd320",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x100cd324",
                "name": "CloseHandle"
              },
              {
                "address": "0x100cd328",
                "name": "GetModuleFileNameA"
              },
              {
                "address": "0x100cd32c",
                "name": "GetProcAddress"
              },
              {
                "address": "0x100cd330",
                "name": "GetLastError"
              },
              {
                "address": "0x100cd334",
                "name": "RaiseException"
              },
              {
                "address": "0x100cd338",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x100cd33c",
                "name": "GetModuleHandleExW"
              },
              {
                "address": "0x100cd340",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x100cd344",
                "name": "FreeLibrary"
              },
              {
                "address": "0x100cd348",
                "name": "SizeofResource"
              },
              {
                "address": "0x100cd34c",
                "name": "LockResource"
              },
              {
                "address": "0x100cd350",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x100cd354",
                "name": "LoadLibraryExA"
              },
              {
                "address": "0x100cd358",
                "name": "DelayLoadFailureHook"
              },
              {
                "address": "0x100cd35c",
                "name": "InitializeProcThreadAttributeList"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x100cd000",
                "name": "QueryTraceW"
              },
              {
                "address": "0x100cd004",
                "name": "AdjustTokenPrivileges"
              },
              {
                "address": "0x100cd008",
                "name": "ImpersonateSelf"
              },
              {
                "address": "0x100cd00c",
                "name": "CryptGenRandom"
              },
              {
                "address": "0x100cd010",
                "name": "ImpersonateLoggedOnUser"
              },
              {
                "address": "0x100cd014",
                "name": "RegQueryValueExW"
              },
              {
                "address": "0x100cd018",
                "name": "GetTokenInformation"
              },
              {
                "address": "0x100cd01c",
                "name": "ConvertSidToStringSidW"
              },
              {
                "address": "0x100cd020",
                "name": "CloseTrace"
              },
              {
                "address": "0x100cd024",
                "name": "TraceSetInformation"
              },
              {
                "address": "0x100cd028",
                "name": "EnableTraceEx2"
              },
              {
                "address": "0x100cd02c",
                "name": "ProcessTrace"
              },
              {
                "address": "0x100cd030",
                "name": "OpenTraceW"
              },
              {
                "address": "0x100cd034",
                "name": "StartTraceW"
              },
              {
                "address": "0x100cd038",
                "name": "CryptDestroyHash"
              },
              {
                "address": "0x100cd03c",
                "name": "CryptReleaseContext"
              },
              {
                "address": "0x100cd040",
                "name": "CryptGetHashParam"
              },
              {
                "address": "0x100cd044",
                "name": "CryptHashData"
              },
              {
                "address": "0x100cd048",
                "name": "CryptCreateHash"
              },
              {
                "address": "0x100cd04c",
                "name": "CryptAcquireContextW"
              },
              {
                "address": "0x100cd050",
                "name": "LookupAccountSidW"
              },
              {
                "address": "0x100cd054",
                "name": "ConvertStringSidToSidW"
              },
              {
                "address": "0x100cd058",
                "name": "AllocateLocallyUniqueId"
              },
              {
                "address": "0x100cd05c",
                "name": "GetSecurityDescriptorControl"
              },
              {
                "address": "0x100cd060",
                "name": "GetSecurityDescriptorLength"
              },
              {
                "address": "0x100cd064",
                "name": "MakeSelfRelativeSD"
              },
              {
                "address": "0x100cd068",
                "name": "GetSecurityDescriptorSacl"
              },
              {
                "address": "0x100cd06c",
                "name": "GetSecurityDescriptorDacl"
              },
              {
                "address": "0x100cd070",
                "name": "GetSecurityDescriptorGroup"
              },
              {
                "address": "0x100cd074",
                "name": "GetSecurityDescriptorOwner"
              },
              {
                "address": "0x100cd078",
                "name": "RegEnumKeyExW"
              },
              {
                "address": "0x100cd07c",
                "name": "RegEnumValueW"
              },
              {
                "address": "0x100cd080",
                "name": "RegQueryInfoKeyW"
              },
              {
                "address": "0x100cd084",
                "name": "ControlTraceW"
              },
              {
                "address": "0x100cd088",
                "name": "RevertToSelf"
              },
              {
                "address": "0x100cd08c",
                "name": "ConvertStringSecurityDescriptorToSecurityDescriptorW"
              },
              {
                "address": "0x100cd090",
                "name": "RegDeleteKeyExW"
              },
              {
                "address": "0x100cd094",
                "name": "RegNotifyChangeKeyValue"
              },
              {
                "address": "0x100cd098",
                "name": "EventWrite"
              },
              {
                "address": "0x100cd09c",
                "name": "DuplicateTokenEx"
              },
              {
                "address": "0x100cd0a0",
                "name": "CreateProcessAsUserW"
              },
              {
                "address": "0x100cd0a4",
                "name": "EnumServicesStatusExW"
              },
              {
                "address": "0x100cd0a8",
                "name": "RegDeleteValueW"
              },
              {
                "address": "0x100cd0ac",
                "name": "StopTraceW"
              },
              {
                "address": "0x100cd0b0",
                "name": "OpenSCManagerW"
              },
              {
                "address": "0x100cd0b4",
                "name": "OpenServiceW"
              },
              {
                "address": "0x100cd0b8",
                "name": "CloseServiceHandle"
              },
              {
                "address": "0x100cd0bc",
                "name": "ControlService"
              },
              {
                "address": "0x100cd0c0",
                "name": "QueryServiceStatus"
              },
              {
                "address": "0x100cd0c4",
                "name": "RegisterServiceCtrlHandlerExW"
              },
              {
                "address": "0x100cd0c8",
                "name": "SetServiceStatus"
              },
              {
                "address": "0x100cd0cc",
                "name": "EventUnregister"
              },
              {
                "address": "0x100cd0d0",
                "name": "EventRegister"
              },
              {
                "address": "0x100cd0d4",
                "name": "RegSetValueExW"
              },
              {
                "address": "0x100cd0d8",
                "name": "RegCopyTreeW"
              },
              {
                "address": "0x100cd0dc",
                "name": "RegCreateKeyExW"
              },
              {
                "address": "0x100cd0e0",
                "name": "RegOpenKeyExW"
              },
              {
                "address": "0x100cd0e4",
                "name": "RegDeleteTreeW"
              },
              {
                "address": "0x100cd0e8",
                "name": "RegDeleteKeyW"
              },
              {
                "address": "0x100cd0ec",
                "name": "RegCloseKey"
              },
              {
                "address": "0x100cd0f0",
                "name": "RegGetValueW"
              },
              {
                "address": "0x100cd0f4",
                "name": "OpenThreadToken"
              },
              {
                "address": "0x100cd0f8",
                "name": "EventWriteTransfer"
              }
            ]
          },
          "ole32": {
            "dll": "ole32.dll",
            "imports": [
              {
                "address": "0x100cd538",
                "name": "CoTaskMemFree"
              },
              {
                "address": "0x100cd53c",
                "name": "CreateStreamOnHGlobal"
              },
              {
                "address": "0x100cd540",
                "name": "CoCreateGuid"
              },
              {
                "address": "0x100cd544",
                "name": "StringFromGUID2"
              },
              {
                "address": "0x100cd548",
                "name": "CLSIDFromString"
              },
              {
                "address": "0x100cd54c",
                "name": "CoUninitialize"
              },
              {
                "address": "0x100cd550",
                "name": "CoInitializeEx"
              },
              {
                "address": "0x100cd554",
                "name": "CoCreateInstance"
              }
            ]
          },
          "USER32": {
            "dll": "USER32.dll",
            "imports": [
              {
                "address": "0x100cd394",
                "name": "LoadStringW"
              }
            ]
          },
          "USERENV": {
            "dll": "USERENV.dll",
            "imports": [
              {
                "address": "0x100cd39c",
                "name": "DestroyEnvironmentBlock"
              },
              {
                "address": "0x100cd3a0",
                "name": "CreateEnvironmentBlock"
              },
              {
                "address": "0x100cd3a4",
                "name": "ExpandEnvironmentStringsForUserW"
              }
            ]
          },
          "RPCRT4": {
            "dll": "RPCRT4.dll",
            "imports": [
              {
                "address": "0x100cd374",
                "name": "UuidFromStringW"
              },
              {
                "address": "0x100cd378",
                "name": "RpcStringFreeW"
              },
              {
                "address": "0x100cd37c",
                "name": "UuidToStringW"
              }
            ]
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x100cd364",
                "name": "SysFreeString"
              },
              {
                "address": "0x100cd368",
                "name": "SysStringLen"
              },
              {
                "address": "0x100cd36c",
                "name": "SysAllocString"
              }
            ]
          },
          "bcrypt": {
            "dll": "bcrypt.dll",
            "imports": [
              {
                "address": "0x100cd410",
                "name": "BCryptGenRandom"
              }
            ]
          },
          "SHLWAPI": {
            "dll": "SHLWAPI.dll",
            "imports": [
              {
                "address": "0x100cd384",
                "name": "SHCreateStreamOnFileW"
              },
              {
                "address": "0x100cd388",
                "name": "PathFileExistsW"
              },
              {
                "address": "0x100cd38c",
                "name": "UrlEscapeW"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x100cd510",
                "name": "EtwTraceMessage"
              },
              {
                "address": "0x100cd514",
                "name": "WinSqmIsOptedInEx"
              },
              {
                "address": "0x100cd518",
                "name": "NtSetInformationThread"
              },
              {
                "address": "0x100cd51c",
                "name": "NtQueryInformationThread"
              },
              {
                "address": "0x100cd520",
                "name": "NtQuerySystemInformation"
              },
              {
                "address": "0x100cd524",
                "name": "RtlNtStatusToDosError"
              },
              {
                "address": "0x100cd528",
                "name": "NtQueryInformationProcess"
              },
              {
                "address": "0x100cd52c",
                "name": "NtSetInformationFile"
              },
              {
                "address": "0x100cd530",
                "name": "RtlGetVersion"
              }
            ]
          },
          "XmlLite": {
            "dll": "XmlLite.dll",
            "imports": [
              {
                "address": "0x100cd404",
                "name": "CreateXmlWriter"
              },
              {
                "address": "0x100cd408",
                "name": "CreateXmlReader"
              }
            ]
          },
          "WINHTTP": {
            "dll": "WINHTTP.dll",
            "imports": [
              {
                "address": "0x100cd3ac",
                "name": "WinHttpWriteData"
              },
              {
                "address": "0x100cd3b0",
                "name": "WinHttpQueryHeaders"
              },
              {
                "address": "0x100cd3b4",
                "name": "WinHttpReceiveResponse"
              },
              {
                "address": "0x100cd3b8",
                "name": "WinHttpSetTimeouts"
              },
              {
                "address": "0x100cd3bc",
                "name": "WinHttpConnect"
              },
              {
                "address": "0x100cd3c0",
                "name": "WinHttpCrackUrl"
              },
              {
                "address": "0x100cd3c4",
                "name": "WinHttpCloseHandle"
              },
              {
                "address": "0x100cd3c8",
                "name": "WinHttpOpenRequest"
              },
              {
                "address": "0x100cd3cc",
                "name": "WinHttpAddRequestHeaders"
              },
              {
                "address": "0x100cd3d0",
                "name": "WinHttpSetStatusCallback"
              },
              {
                "address": "0x100cd3d4",
                "name": "WinHttpReadData"
              },
              {
                "address": "0x100cd3d8",
                "name": "WinHttpSetCredentials"
              },
              {
                "address": "0x100cd3dc",
                "name": "WinHttpSetOption"
              },
              {
                "address": "0x100cd3e0",
                "name": "WinHttpGetProxyForUrl"
              },
              {
                "address": "0x100cd3e4",
                "name": "WinHttpSendRequest"
              },
              {
                "address": "0x100cd3e8",
                "name": "WinHttpQueryOption"
              },
              {
                "address": "0x100cd3ec",
                "name": "WinHttpOpen"
              },
              {
                "address": "0x100cd3f0",
                "name": "WinHttpGetIEProxyConfigForCurrentUser"
              },
              {
                "address": "0x100cd3f4",
                "name": "WinHttpGetDefaultProxyConfiguration"
              }
            ]
          },
          "CRYPT32": {
            "dll": "CRYPT32.dll",
            "imports": [
              {
                "address": "0x100cd100",
                "name": "CertFreeCertificateContext"
              },
              {
                "address": "0x100cd104",
                "name": "CertVerifyCertificateChainPolicy"
              },
              {
                "address": "0x100cd108",
                "name": "CertGetCertificateChain"
              },
              {
                "address": "0x100cd10c",
                "name": "CryptStringToBinaryA"
              },
              {
                "address": "0x100cd110",
                "name": "CertFreeCertificateChain"
              }
            ]
          },
          "WTSAPI32": {
            "dll": "WTSAPI32.dll",
            "imports": [
              {
                "address": "0x100cd3fc",
                "name": "WTSQueryUserToken"
              }
            ]
          }
        },
        "exported_dll_name": "diagtrack.dll",
        "exports": [
          {
            "address": "0x100243a0",
            "name": "?_LoadSharedStringResource@@YG?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@K@Z",
            "ordinal": 3
          },
          {
            "address": "0x100cc090",
            "name": "?gs_lifetimeManager@@3VCLifetimeManager@Diagnostics@Microsoft@@A",
            "ordinal": 4
          },
          {
            "address": "0x10022c30",
            "name": "RunDll32Main",
            "ordinal": 5
          },
          {
            "address": "0x10022800",
            "name": "ServiceMain",
            "ordinal": 1
          },
          {
            "address": "0x10022230",
            "name": "SvchostPushServiceGlobals",
            "ordinal": 2
          },
          {
            "address": "0x10022d50",
            "name": "UtcSysprepGeneralize",
            "ordinal": 6
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x000ca120",
            "size": "0x0000015d"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x000cd560",
            "size": "0x00000140"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x000d1000",
            "size": "0x00009070"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x000df400",
            "size": "0x00002160"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x000db000",
            "size": "0x000092e8"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x00014ef0",
            "size": "0x00000038"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x00014f48",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x000cd000",
            "size": "0x0000055c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x000ca008",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x000c927d",
            "size_of_data": "0x000c9400",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.41"
          },
          {
            "name": ".data",
            "raw_address": "0x000c9800",
            "virtual_address": "0x000cb000",
            "virtual_size": "0x0000131c",
            "size_of_data": "0x00000c00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "3.82"
          },
          {
            "name": ".idata",
            "raw_address": "0x000ca400",
            "virtual_address": "0x000cd000",
            "virtual_size": "0x0000260a",
            "size_of_data": "0x00002800",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.58"
          },
          {
            "name": ".didat",
            "raw_address": "0x000ccc00",
            "virtual_address": "0x000d0000",
            "virtual_size": "0x00000020",
            "size_of_data": "0x00000200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "0.45"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x000cce00",
            "virtual_address": "0x000d1000",
            "virtual_size": "0x00009070",
            "size_of_data": "0x00009200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "3.80"
          },
          {
            "name": ".reloc",
            "raw_address": "0x000d6000",
            "virtual_address": "0x000db000",
            "virtual_size": "0x000092e8",
            "size_of_data": "0x00009400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.73"
          }
        ],
        "overlay": {
          "offset": "0x000df400",
          "size": "0x00002160"
        },
        "resources": [
          {
            "name": "MUI",
            "offset": "0x000d9f80",
            "size": "0x000000f0",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.82"
          },
          {
            "name": "WEVT_TEMPLATE",
            "offset": "0x000d17d8",
            "size": "0x000087a2",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.76"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x000d1408",
            "size": "0x000003cc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.44"
          },
          {
            "name": "RT_MANIFEST",
            "offset": "0x000d1160",
            "size": "0x000002a1",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "5.03"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Microsoft Windows Diagnostics Tracking"
          },
          {
            "name": "FileVersion",
            "value": "10.0.10586.0 (th2_release.151029-1700)"
          },
          {
            "name": "InternalName",
            "value": "diagtrack.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "diagtrack.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.10586.0"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "10f41e56254fb4a6c54b71ca3e6dee8e",
        "timestamp": "2015-10-30 02:10:19",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 15
      },
      "data": null,
      "strings": [
        ";{`u#",
        "6SPQVj",
        "9wht<",
        "j=^f90t",
        "2C4B5r5",
        ":$:,:4:<:D:L:T:\\:d:l:x:",
        "4$444@4`4h4t4",
        "keyword",
        "GetTokenInformation",
        "AppInteractivity",
        "001a1",
        "base\\diagnosis\\diagtrack\\engine\\throttlemonitor.cpp",
        "?%?[?",
        "Unable to open manifest file: %s.",
        ">-?\\?",
        "tH9=P",
        "?'?L?n?",
        "4N5c5v5",
        "AsimovUploader_NormalUploadSucceeded",
        "ActualSequenceNumber",
        "InfoString",
        ".?AV<lambda_52eeabc610faf56762c8d179bd021690>@@",
        "OpenServiceW",
        "8&9P9v9",
        "RingBuffer_TooFullToCommitPreCompressBuffer",
        "WerReportSetParameter",
        "6@6P6k6",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\getregkeyaction.cpp",
        "<$<@<K<X<m<y<",
        "escalation",
        "statename",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\etwtrigger.cpp",
        "Microsoft Time-Stamp Service",
        "Metadata_TimeSinceOsInstall",
        "SourceState",
        "ETWConsumer_StartShutdownTrace",
        ";0u,9E",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\snaptraceaction.cpp",
        "base\\diagnosis\\diagtrack\\engine\\settingsjsonparser.cpp",
        "EventKey",
        "IsKernelDebuggerPresent",
        "SystemTimeToFileTime",
        "5#5H5q5",
        "3H3R3^3c3q3w3|3",
        "reporteverynth",
        "7<7D7P7p7|7",
        "CcPinReadNoWaitMiss",
        "MSAUserIdentityProvider_SuccessfulCacheHit",
        "IsACOnMetadata_Update",
        "_9|$4s",
        "808=8p8~8",
        "=$=,=D=P=X=|=",
        "AOT restarted successfully after throttling due to memory constraints",
        "292N2X2^2c2n2",
        "=C=g=y=",
        "8,9W9",
        "Trigger",
        "RtlNtStatusToDosError",
        "3b4B8N8Z8w8",
        "0H0a0k0x0",
        "2+343",
        "_opcode",
        "3#323@3Q3z3",
        "6?7h7",
        "f90um",
        "5A5k5",
        "MSAUserIdentityProvider_InvalidTypeAfterPopulate",
        "747D7P7p7x7",
        "?;?y?",
        "VWuVP",
        "<,=7=t=",
        "8#9=9v9",
        "3,3g3",
        "\\$`8_ ",
        "IoReadTransferCount",
        "malloc",
        "9G:m:",
        "wnfTypeId=",
        ".rsrc",
        "7$81868X8]8",
        "FileInfoFilter",
        "=1=e=",
        ":':g:",
        "base\\diagnosis\\diagtrack\\common\\msauseridentityprovider.cpp",
        "[%hs]",
        "<4<;<j<",
        ";+;:;O;^;e;",
        "&deviceClass=",
        "u>SSj",
        "GetMemoryInfoAction",
        ";sltV",
        "NtQueryInformationProcess",
        "NormalDbLatency",
        "8,8?8S8j8",
        "121V1~1",
        "0h1w1",
        "overBatteryThresholdMs",
        "=<=I=~=",
        "RegCreateKeyExW",
        "Trigger_MSACouldntPopulateWithEventSID_UnableToRetrieveMSA",
        "<.<8<",
        "UnmapViewOfFile",
        "dataitem",
        "0I0{0",
        "5>6m6",
        "VortexHttpAttempts",
        "5$5,545<5D5L5T5`5",
        "ActionType",
        "0%0O0e0",
        "filtername",
        "HKEY_PERFORMANCE_TEXT",
        "wnfStateName=",
        "C`;CXv@",
        "4$4H4T4x4",
        "MetadataEngine_InitializeMetadata",
        "LookupAccountSidW",
        "Utils_SetRegistryKey",
        "running",
        "%d.%d.%s.%s.%s",
        "1!252",
        "PID: ",
        "WriteOperationCount",
        "AlwaysUpload",
        "AuthorizationInfo_RuntimeTransition",
        "AuthorizationInfo_PopulateFromOs",
        "CriticalSettingsDownload",
        "HexInt64Field",
        "base\\diagnosis\\diagtrack\\engine\\action.cpp",
        "233S3c3",
        "VWj{X",
        ":+:R:p:",
        "ServiceMain_HandleStopEvent",
        "GetStdHandle",
        "SOFTWARE\\Microsoft\\SQMClient",
        "maximumDurationSec=",
        "0.070S0b0p0",
        "Metadata_LastLogonTime",
        "wcsstr",
        "VVWPVV",
        "3$444@4H4|4",
        "f9Y6r)",
        "TransitionFromEverythingOff",
        "DiagTrack did not shutdown correctly",
        "FailingFunction",
        "8K u3",
        "ProviderCount",
        "notexists",
        "network reset",
        "0$040@0H0|0",
        "timed out",
        "        <requestedPrivileges>",
        "SettingsManager",
        "datamodel",
        "seqNum",
        "TraceBufferBudgetMaxMB",
        "OpenProcess",
        "=S=Z=",
        "1*2h2",
        "data error",
        "SessionId",
        "<\"<K<",
        "InfoStream_ExceededMaxEscalationDurationMs_0",
        "no-cache",
        "Diagtrack-Listener",
        "5)575|5",
        "JsonBuilder - iterators must be from this container",
        "5S6i798",
        "    version=\"5.1.0.0\"",
        "?'?4?n?",
        "1#2H2X2e2j2",
        "diagtrack",
        "popSample",
        "{@hp`",
        "TerminateProcess",
        "threads",
        "9@9a9j9",
        "IsLastPowerSourceAC",
        "< <0<9<\\<w<",
        "8$9G9U9l9",
        ".idata$5",
        "SetInformationJobObject",
        "8!8-8K8Z8o8",
        "=H=X=d=l=",
        "MSAUserIdentityProvider_SuccessfulCacheHitAfterPopulate",
        "MatchEngine_ScenarioCycled",
        ":L:\\:h:p:",
        "resource deadlock would occur",
        "D$lQP",
        "FXPh(",
        "</scenarios></diagrules>",
        "D$8SVW",
        ";4;l;",
        "no_protocol_option",
        "ProcessStartKey",
        "4'4F4",
        "alpha.telemetry.microsoft.com",
        "Setting not recognized",
        "9L9l9",
        "ExpandEnvironmentStringsW",
        "PPShp",
        "ndualtriggerpropertyfilter",
        ";5;Y;j;o;",
        "12730",
        "DiagTrackPerf",
        "150818171528Z",
        "WERLoggerFactory_CreateWERLogger",
        "AllowAllTelClientSyntheticEvents",
        "NtQueryWnfStateData",
        "GQSSh",
        "SSSVR",
        "7;7t$",
        "_purecall",
        "captureStateProvider=",
        "<$=.=B=L=`=j=~=",
        "5$5,545<5D5L5T5\\5d5l5t5|5",
        "PartA_Tags",
        "<;<D<Y<",
        "040904B0",
        "Microsoft Time-Stamp Service0",
        "7R8j8",
        "7$7=7E7^7m7",
        "1#242i2|2",
        "rangems",
        "HeapFree",
        "SetThreadpoolThreadMaximum",
        "D$\\QP",
        "ScenarioManager_SkipLoadingScenarios_UploadEtlFilesOnly",
        "D$`SVW",
        "gzip, deflate",
        "api-ms-win-core-delayload-l1-1-1.dll",
        "swscanf_s",
        "<&=1=W=\\=s=~=",
        "4E4e4",
        "<d<t<",
        "Wj0Pj",
        ":>:A;l;",
        "9*:J:u:",
        "8CHAN",
        "D$ SVW",
        "5J5p5",
        "proccnt",
        "Win32kTraceLogging",
        "traceProfileScenarioId=",
        "4V5v5g6",
        "-----------------------------------------------",
        "Escalation for scenario couldn't run because the AoT was not running. AoT is currently owned by: %s",
        "MaxEscalations",
        "Redmond1",
        "1,181@1t1",
        ";(;0;<;\\;d;l;t;",
        ";Z<j<",
        "versp",
        ":H:N:W:",
        ";/<b<q<",
        "AppIdMetadata_HasAccountPrefix_PrefixKnownType",
        "PerfTrackScenarioName",
        "Msg:[%ws] ",
        "ole32.dll",
        "_cancel",
        "GetMemoryInfoAction: ",
        "uHSSSS",
        "Critical",
        " type=",
        "Dropping scenario. It is not applicable to this system.",
        "InfoStream_AlternativeTraceSnapped_0",
        "7e7o7S9",
        "242d2",
        "transition",
        "809L9s9::",
        "Int64Field",
        "*.xml",
        "RingBuffer_ReadEntry",
        "2S2{2",
        "stream timeout",
        "3*4M4[4r4",
        "040D0P0X0|0",
        "ScenarioManager_LoadingScenariosStop",
        "3-3B3",
        "6s8#959F9",
        "L$$_^3",
        "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8",
        "6\"6i6",
        "=!=Z=d=r=w=",
        ":+:`:",
        ":*:1:R:Y:z:",
        "WinHttpSetTimeouts",
        "ResidentAvailablePages",
        "t6PQh",
        "no lock available",
        "AccountType",
        "IsKernelDebuggerPresentMetadata_Update",
        "executable format error",
        "GetWNFStateAction_TooManyTypes",
        ";';H;h;",
        ":L;b;",
        "<N<e<",
        "oldest",
        "Triggers",
        "8T8Y8",
        "?4?T?l?",
        "ScenarioManager_UpdateCriticalSettingsTimer",
        "2T2_2r2",
        "InfoStream_EscalationSucceeded_0",
        "ProcessCount",
        "?G?^?",
        "MapViewOfFile",
        "9M:Z:",
        "VVWVh",
        "CTracer::CancelTracing() failed",
        "9\\9x9",
        ".?AV<lambda_d15b2efa8b245413045b16ba83b079b1>@@",
        ": :5:A:M:Y:e:q:}:",
        "base\\diagnosis\\diagtrack\\engine\\systemstatemanager.cpp",
        "5'5?5D5J5^5c5o5~5",
        "041B1S1]1",
        "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a",
        "9,:2:A:R:a:",
        ";J<b<u<",
        "D$\\VW",
        "RingBuffer_ReadFailedDueToInvalidCRC",
        "MatchEngine_StartManifestUpdate",
        "ETWConsumer_StartTrace",
        "5(5H5P5\\5d5",
        "Metadata_IsKernelDebuggerPresent",
        "0\"0'090t0",
        "2=2[2i2|2",
        "?&?+?A?Q?W?\\?q?",
        "; ;,;L;T;\\;d;p;",
        "InitialBackoffSeconds",
        "%windir%\\system32\\wevtutil.exe",
        "6!7-7",
        "ETWConsumer_EtlProcessingThreadProc_NotAuthorizedToProcessAutologgerLoggerETL",
        ".?AVinvalid_argument@std@@",
        "71787m7",
        "CcFastReadNotPossible",
        "CcMapDataNoWait",
        "SizeofResource",
        "<0=d=",
        ";.<u<",
        "L$<_^[3",
        "bitmask",
        ".xdata$x",
        "ASM-WindowsDefault",
        "D$$VPh",
        "ToggleTraceWithCustomFilterAction",
        "IsEscalationInProgressMetadata_Update",
        ":*:>:J:V:j:",
        "FLPQQ",
        "OverrideCopyOutputDirectory",
        "_vscwprintf",
        ".didat$3",
        "wnfstructure",
        "IdentityType",
        "Utils_FailedToWriteFile",
        ">i>y>",
        "Microsoft Corporation1",
        "MaxInitialRandomDelayMs",
        "CanAddMsaToMsTelemetry",
        "181k1",
        "BlackBoxTriggerEventsCapacity",
        ">%>*>0>6><>B>H>N>T>Z>`>f>l>r>x>~>",
        "<&=-=4=;=B=l=",
        "invalid argument",
        "Unsupported consumer TriggerDataType = %d",
        ";+<a<",
        "6*6;6P6",
        "EventStoreCorruptionProbability",
        "Int32Field",
        "sprintf_s",
        "millisecond",
        "s'9>w#",
        "ComponentManifestVersion",
        "7X7j7",
        ".json",
        "ManifestRefreshIntervalMilliseconds",
        "wlan show wlanreport",
        "notlike",
        "101e1j1",
        "initial",
        "989D9L9",
        "12678",
        "6N6\\6u6",
        "SetWaitableTimer",
        "9@9p9",
        "StringFileInfo",
        "greaterthan",
        "ConsumerFactory_CreateConsumer",
        "263d3m3",
        "3>3^3~3",
        "N0L0J",
        "deployment",
        "r~akow",
        "<%=W=",
        "646D6P6p6|6",
        "doesn't exist",
        "*4I4f4",
        "If-None-Match: ",
        "D$0Phd",
        "KernelPaged",
        "uint8",
        "0-03090~0",
        "1'1n1",
        "DelayAction: ",
        "CcDataPages",
        "6!6'626?6[6f6s6",
        "InfoStream_UnableToExpandIdentityString_0",
        "BackoffMultFactor",
        "not connected",
        "L$$9s",
        "2#2'2+2/2",
        "triggers",
        "rAsimov.HashCycleMinutes",
        "p -p ",
        "%windir%\\system32\\ipconfig.exe",
        "sdksz",
        "Utils_EscalationReasonETWTrigger",
        "7.797J7u7",
        "AsimovUploader",
        "wnfmessagesize",
        ">=>t>",
        "pFailed to start ETW Consumer thread",
        "iostream stream error",
        "proclsp",
        ":';I;q;",
        "TdhFacade_ProviderStats_1",
        "777]7z7",
        "7$7K7|7",
        "TriggerFactory_CreateTrigger",
        "1.0,0",
        "portos",
        "001=1",
        "%u.%u.%u.%u",
        "9$90989l9|9",
        "AllocateLocallyUniqueId",
        "Trigger_MSACouldntPopulateWithResolvedSid_UnableToRetrieveMSA",
        "6'6Y6",
        "TimeStamp",
        "edition",
        "WinHttpQueryOption",
        "\"Metadata_LastPowerSourceChangeTime",
        "UInt32Field",
        " 000<0D0x0",
        "1+1R1",
        "    name=\"Microsoft.Windows.base.diagtrack\"",
        "TDH_INT16",
        "WinHttpReadData",
        "8%9w9",
        "ClientId.UniqueProcess",
        "UTC storage creation failed.",
        "8M8b8",
        "8D8]8",
        "Software\\Policies\\Microsoft\\Windows\\DataCollection",
        "Warning: Imposed structure is larger than WNF buffer. Including hex string representation.",
        "[ERROR:InType=%u]",
        "uT9GXuO!E",
        "Windows",
        "Extension module signature mismatch. ",
        "2A2z2",
        "<NULL>",
        "InfoStream_AlternativeTracePreempted_0",
        "sysmfg",
        "5B6V6",
        "6R7v7",
        "j.XVf",
        ";R<|<",
        "CoreTelOptedOutMs",
        "LdrFastFailInLoaderCallout",
        "<C<Q<",
        ";D$HrBP",
        "6(656Q6k6}6",
        "ScenarioManager_SkipRestartingSavedTraces_NotAuthorized",
        "EscalationWorkItem_SkippingCopyOutputDirectory",
        "5G5Y5",
        "=,>S>",
        "EventDroppedDb",
        "WPR_initiated_DiagTrack*.etl*",
        "ETWConsumer_EtlProcessingThreadProcNoSettingsAvailable",
        "no message",
        "PartA",
        "0L0\\0h0p0",
        "setting %s has invalid value: %s.",
        "??8type_info@@QBEHABV0@@Z",
        "ETWConsumer_EnableProvider",
        "Trigger_MSAPopulateWithResolvedSID",
        "InfoStream_UpdateTrace_0",
        "network_down",
        "wrong_protocol_type",
        "J ;H w",
        "L$0Sj",
        "4/5r5h6u6",
        "SoftMaxLoadedScenarios",
        "DiagTrack_*",
        "vector<T> too long",
        "<trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\">",
        "base\\diagnosis\\diagtrack\\include\\CoInitializeWrapper.h",
        "W ^[|",
        "%Microsoft Windows Production PCA 2011",
        "https://settings-win.data.microsoft.com/settings/v2.0/",
        "TransitionCount",
        "SettingsExpirationMinutes",
        "bad_address",
        "EscalationEngine_ExecuteDenied",
        "REG_NONE",
        " 0q0|0",
        "040X0",
        "0,1<1H1P1p1x1",
        "040D0T0_0h0s0",
        "0/1S1X1h1",
        "7>7w7",
        "4.5D5K5D7g7",
        "; ;(;0;8;D;d;l;x;",
        "D$@SVW",
        ".text$x",
        "5(5M5W5r5",
        "PSWh$i",
        "j\\^QQ",
        "?5?k?",
        ":N:v:",
        "TelemetryServiceDisabled",
        "LastQueryResult",
        "EventId",
        ":?:t:",
        "application/json",
        "L$L_^[3",
        "HeartBeatIntervalMS",
        "need dictionary",
        "\\Device\\Mup\\",
        "Alternative trace could not be preempted",
        "SSSSPV",
        "424w4",
        "6&7;7@7",
        "WERLogger_IsConsentLevelEverything",
        ": ;1;I;h;",
        "> >,>L>T>`>",
        "12729",
        "SystemStateManager_TimerWake",
        "J$;H$w",
        "DiskCounters.BytesRead",
        "CompletionReportCount",
        "151007181737Z",
        "V-VW&6)%",
        "MappedWriteIoCount",
        "081v1",
        "SkipTelemetryServiceRules",
        "5.6<6f6",
        "TDH_COUNTEDSTRING",
        "Tracer_UpdateTraceState",
        ";FLu(",
        "303\\3",
        "1f;2u",
        "wn>Jj",
        "WTMDisplaySession",
        "6]6f6{6",
        "1$242@2H2|2",
        "platid",
        "%DiagtrackRegistryRoot%\\SettingsRequests",
        "systemperformanceinfo",
        "3'4|4.5d5~5",
        "7&838U8",
        "=E=o=",
        "QWSj?h",
        "WWWWWWP",
        "?F?L?Q?",
        "6$606T6\\6d6l6t6|6",
        "%hs(%d)\\%hs!%p: ",
        "3\"3<3P3X3p3",
        "VarFileInfo",
        ">J?`?u?",
        "base\\diagnosis\\diagtrack\\engine\\pdcnetworkactivity.cpp",
        "Delay (ms): ",
        "\"Metadata_LastSuccessfulRefreshTime",
        "8*;J;",
        "626m6",
        "3=3]3",
        "Metadata_LastDeviceArrivalTime",
        "ProcessInfo",
        "WaitForThreadpoolTimerCallbacks",
        "CTracer::SaveTraceToFile() failed",
        "QPtMh(e",
        "DeleteCriticalSection",
        "<SVW3",
        "2<3F3f3p3",
        ":':l:L;",
        "scenarioname",
        "< <,<L<T<`<h<",
        "<8<@<\\<l<",
        "DirtyWriteIoCount",
        ":\";9;`;",
        ";$<2<",
        "D$(Pj",
        "memmove",
        "=$=0=P=X=d=",
        "TelemetryProtocolServerRoles",
        "AppVersion",
        "AdjustTokenPrivileges",
        "5@5k5v5",
        "SnapTrace_SnappingScenarioInformation",
        "545<5D5L5X5`5",
        ":WEVTt",
        "ETWConsumer_SetDisallowList",
        ">+?9?B?a?q?",
        "SPSh?",
        "6x7<8p8",
        "20151030033523.477Z0",
        "savetolocalstore",
        "IsACOnMetadata_Query",
        "%windir%\\SysWow64\\dtdump.exe",
        "_lastpowersourcechangetime",
        "Couldn't expand identity string. State model does not have transition with name: %s",
        "Metadata_LastResumeFromHibernateTime",
        "1\"2=2x2",
        "<)=;=L=",
        "1=1Q1",
        "localId",
        "PageReadIoCount",
        "buildflightid",
        "wsdsksc",
        "GetProcessDump successful",
        "%I64x",
        "7'8F8Y8y8",
        "^.*exec.*$",
        "WerpSetIntegratorReportId",
        "getmemoryinfoaction",
        "8(8H8r8",
        "delayMillis=",
        "SettingsHttpAttempts",
        "NextWriteSequenceCounter",
        "<0<@<L<l<t<|<",
        "CurrentReports",
        "wscpudn",
        "CurrentCancelReports",
        "InfoStream_ProcessCreateScriptFailed_0",
        "TDH_BOOLEAN",
        "9O9q9",
        "8 8(80888H8P8t8",
        ">+>L>[>j>",
        "base\\diagnosis\\diagtrack\\engine\\heartbeat.cpp",
        "4H5R5`5e5",
        "CcMapDataNoWaitMiss",
        "NormalSettingsandManifestDueTime",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\buildstringmetadata.cpp",
        "0=0X0^0",
        "InvalidHttpCodeCount",
        "NonPagedPoolFrees",
        "*.etl",
        "DiskCounters.ReadOperationCount",
        "=j>w>",
        "1*1O1t1",
        "9Q:n:",
        "REG_QWORD",
        "ComputerHardwareId",
        "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5",
        "3 3@3L3T3",
        "FilterType",
        "<7=H=Z=",
        "2#2p2",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\singlepropertyfilter.cpp",
        "050H0f0",
        "IsContinuumSessionActiveMetadata_Query",
        "6$6,646<6L6d6p6",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\iskerneldebuggerpresentmetadata.cpp",
        ":9;L;d;w;",
        "TimestampOutputDirectory",
        "CcMapDataWait",
        "traceProfileHash=",
        "393X3}3",
        "tVSSj",
        ">U?Z?r?",
        "8(848T8\\8h8",
        "9,:::b:h:~:",
        "7<7C7]7b7x7",
        "MatchEngine_ManifestUpdateMaintainScenarioList",
        "alternativeTraceProfileHash",
        "ScenarioManagerFactory_CreateScenarioManager",
        "PagedPoolLookasideHits",
        "aotProfileHash",
        "L$ 9\\$4s",
        "msvcrt.dll",
        "deleteonget",
        "8{tHQ",
        "=$=4=<=D=L=T=\\=d=l=",
        "\\Windows.Uif.static",
        "TriggerCount",
        ">$>D>L>T>`>",
        "tWindows.Server",
        "9N:`:",
        "GetCurrentThreadId",
        "TargetAppId",
        "MoveFileExW",
        "G,;0r",
        "<=<F<",
        "<K=Q=}=",
        "CcFastReadResourceMiss",
        "8B9G9",
        "/batteryreport",
        "ScenarioManager_SkippingProviderGroupForwarder",
        "CurrentExpandedPath",
        ">'>4>L>W>d>",
        "<2=D=S=",
        "MatchEngine_CompletedManifestUpdate",
        "InFlightScenario_ExpandPropertyIdentifier",
        "5)606",
        "FreeLibrary",
        "`.data",
        "2H3X3f3",
        "InfoStream_NotImplemented_0",
        "copyoutputdirectory",
        "&deviceId=",
        "iostream",
        "WerReportAddFile",
        "^9t$Ps",
        "L$ _^",
        "ReturnHr",
        "ScenarioPath",
        "CommitTotal",
        "<\"===Z=5>B>d>",
        "7=8L8Z8",
        "pFailed to query Msa. Type: %d, SID: %s",
        "CreateThreadpoolWork",
        "SecondTry",
        "2B3s3",
        "bldchk",
        "aotTracePath",
        "8;8|8",
        "Escalation for scenario failed.",
        "_D_^[",
        "UseDeviceIdBasedSampling",
        "file exists",
        "SYSTEM\\CurrentControlSet\\Control\\SystemInformation",
        "9$9,949<9D9\\9h9",
        " AND ",
        "D$HSVW",
        "PVVj6",
        "StartTraceAction: ",
        "GetProcessDump failed to create output file",
        "0(0D0T0`0",
        ".header",
        "CcPinReadWaitMiss",
        "Flight settings broker failed to get ring name",
        ";1<e<",
        "bcrypt.dll",
        "4 4,444T4\\4x4",
        "y\"VhX",
        "DuplicateTokenEx",
        ">C?p?v?",
        "LineNumber",
        "?,?c?",
        "4 545T5Z5n5",
        ":?:_:",
        "lessthan",
        "3F3K3\\3",
        "9/9E9\\9i9",
        "7*7V7",
        "0'0a0",
        "0;s`u",
        "606@6L6l6t6",
        "destination address required",
        "toggletracewithcustomfilteraction",
        "ProcessTrace",
        "70I0u0",
        "Metadata_LastResumeFromStandbyTime",
        "base\\diagnosis\\diagtrack\\common\\dynamicconfig.cpp",
        "too many links",
        "UuidFromStringW",
        "9{lu&",
        "InstanceStartTime",
        "12737",
        "PPWhp ",
        "%windir%\\system32\\dxdiag.exe",
        ".CRT$XCA",
        "=*=O=T=",
        "0,0<0H0h0t0",
        "D$$PSj",
        "EscalationEngine_Execute",
        "AsimovUploader_TelClientSyntheticSampledOut",
        "D$8SV",
        "GetFileSizeEx",
        "is a directory",
        "GetSystemDefaultLCID",
        "4/5:5S5",
        "1(1Y1v1",
        "NormalSettingsDownload",
        "2?3$4U4{4",
        "D$LVPh0",
        "IoWriteTransferCount",
        "wimbt",
        "0;0u]",
        "4D5S5n5}5",
        "324i4",
        "070[0",
        "Qkkbal",
        "f9y6r",
        "SetFilePointer",
        ":8:H:T:\\:|:",
        "4(5A596",
        "686C6e6",
        "0$0@0P0\\0d0",
        "network unreachable",
        "CacheIoCount",
        "?A?}?",
        "maxfailureescalations",
        "Trigger_XToken_ProviderReturnedEmpty",
        "userId",
        "ComplexData",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Publishers",
        "3?3c3w3",
        "ResidentSystemCodePage",
        "no message available",
        "5+6S6",
        "3$303P3`3h3",
        "SVWjP",
        "0@0b0r0",
        "939C9n9t9",
        "ResolveDelayLoadsFromDll",
        "2V2]2",
        "0<1q1",
        "__DEPRECATED_InfoStream_ScenarioReported_0",
        "TP_SERVER_BASE_NAME",
        "??0exception@@QAE@ABQBDH@Z",
        ">S>}>",
        "SWh<i",
        "EnumServicesStatusExW",
        "t9hD ",
        "RQhL>",
        "Expected ",
        ".?AV<lambda_b9223db177e7e4d5d4db9bf5f370fceb>@@",
        "SSPh0U",
        "0*0P0",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\radaraction.cpp",
        "4!5E5h5",
        "InfoStream_CannotParseValueFromString_0",
        "%windir%\\system32\\bcdedit.exe",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "RegQueryInfoKeyW",
        "AppId",
        "j_ZQf",
        "scenarios",
        "CriticalEventDroppedDb",
        "5'6X6t6",
        "Duration",
        "u/8C5t*",
        "1!1C1",
        "4F4i4",
        "9f:|:",
        "101_1",
        "C(;C(uE",
        "<C<m<",
        "3D4g4",
        "3+363H3g3",
        ";TEMPuk",
        "InfoStream_ExceededMaxEscalationDurationMsOnLastAction_0",
        "UniqueProcessKey",
        "vercsdbld",
        "ExpandedPath",
        "D$<VPh",
        "commandline",
        "N<jdX",
        "InfoStream_AlternativeTraceNotPreempted_0",
        ", found  ",
        "double",
        "Hardware\\Description\\System\\BIOS",
        "Utils_RecursiveFileDelete",
        "InstallDate",
        "\"Metadata_LastResumeFromStandbyTime",
        ".?AV<lambda_815c66ac738834b4b1076b665982aa28>@@",
        "CcLazyWritePages",
        "CoUninitialize",
        "ScenarioManager_SkipLoadingScenarios_NotAuthorized",
        "RegDeleteKeyW",
        "4-4=4M4[4j4z4",
        "1h2z2",
        "Failed to load manifest: %s.",
        " Metadata_IsKernelDebuggerPresent",
        "InternalName",
        ";P;t;",
        "162T2",
        "ReleaseSRWLockShared",
        "Microsoft Corporation1.0,",
        "DiagTrackAuthorization",
        ".didat$4",
        "0!0,0Y0s0H1]1",
        "5]6o6",
        "7K7~7",
        "equal",
        "UploadEnabled",
        ": :<:R:X:_:h:",
        "Accepting scenario.",
        "%windir%\\system32\\netsh.exe",
        "8f99t",
        "6U6^6d6q6~6",
        ":1:=:R:f:{:",
        "250701214655Z0|1",
        "6#6,6C6\\6v6",
        "KeyName",
        ".CRT$XCC",
        "RandomizedBackoffPercentage",
        "aotScenarioId",
        "Kernel dump saved (fake)",
        "7S7n7|7",
        ":-:6:E:N:]:f:",
        "7e8t8~8",
        "050_0",
        ":1:C:U:g:|:",
        "=J=T=b=g=}=",
        "base\\diagnosis\\diagtrack\\main\\serviceglobal.cpp",
        "=;=j=",
        "PSSSSSS",
        "G@#w,",
        ">V>f>",
        ";#;1;=;R;};",
        "RaiseFailFastException",
        "ConsumerDroppedCount",
        "D$ )Gh",
        "PathFileExistsW",
        "4/595",
        "1#1*191M1R1j1",
        "607K7",
        "base\\diagnosis\\diagtrack\\tracing\\tracemanager.cpp",
        "L$ WP",
        "3?3g3",
        "<(=G=",
        "595Y5",
        "=N=_=",
        "0:0`0|0",
        "BuildFlightId",
        ">+?m?",
        "333T3g3t3",
        "3$3,343<3D3L3T3\\3h3p3",
        "8 8N9",
        "3,4^4",
        " -pid ",
        "7B7m7",
        "EscalationWorkItem_ExecutedAction",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\appidmetadata.cpp",
        "Translation",
        "6>6Y6",
        "ReadOperationCount",
        "CTracer::Initialize() failed",
        "3E3Y3",
        "ValueName",
        "0(00080@0H0P0\\0|0",
        "MatchAnyKeyword",
        "D$ PS",
        "base\\diagnosis\\diagtrack\\engine\\scenariodef.cpp",
        "576Y6",
        "6,686X6`6h6p6|6",
        "7;7X7x7",
        "NumberOfThreadsHighWatermark",
        ":3;g;",
        "JsonBuilder - too much data",
        "ServiceMain_RunDll32Main",
        "EncodePointer",
        "HKEY_USERS",
        "^update .* -fd -ets$",
        "svcVersion",
        "MatchEngine_ScenarioAgeOut",
        "FormatMessageW",
        "tCj:[f;",
        "ReturnCode",
        "CanPerformTraceEscalations",
        "XMLParser_SessionEnd",
        "memcpy",
        "Throttled noisiest producer at Trigger Buffer. %s, TLG Name: %s, Hit: %llu, Th: %llu, Bff Size: %u",
        "CcCopyReadNoWait",
        "GetModuleHandleW",
        "ScenarioCancelled_0",
        "9I9P9g9n9",
        ")Cl_^[",
        "1(282D2L2",
        "1?1g1",
        "QSVWj![j",
        "GetSystemInfo",
        "LoadResource",
        "u1SVW",
        "pxmlns",
        "-flush",
        "1(181\\1d1l1t1|1",
        "ignoreFailure=",
        "TelClientSynthetic",
        "<?xml version=\"1.0\" encoding=\"utf-8\" ?><diagrules><scenarios>",
        "LoadSettingsFromFile",
        "Metadata_IsContinuumSessionActive",
        "1+1D1U1",
        "4%4+424A4H4X4j4w4",
        "6$6O6",
        ":K;R;",
        "LastNormalDownloadAttempt",
        "deflate",
        "aThe system does not support NtQueryWnfStateData.",
        "3C3c3",
        "REG_DWORD_BIG_ENDIAN",
        "%windir%\\system32\\powercfg.exe",
        "InfoStream_ExtensionSignatureMismatch_0",
        "skipProcessEnumeration=",
        " http://www.microsoft.com/windows0",
        "Gdf+G\\fH",
        "?$?0?P?\\?|?",
        "TDH_SID",
        "WinHttpCloseHandle",
        "https://v10.vortex-win.data.microsoft.com/collect/v1",
        "nrunexewithargsaction",
        "&0J0O0e0",
        "AppStateChange",
        "%DiagtrackRegistryRoot%\\AsimovUploader",
        ">,>4>P>`>l>",
        "z(PhX",
        "swprintf_s",
        "TraceExpirationTimer",
        "version",
        "FindFirstFileExW",
        "5&6^6",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\getfileaction.cpp",
        ">%>1>A>S>j>I?U?g?s?",
        "RealtimeUploadCount",
        "IsAotExpired",
        "filename",
        "161k1w1",
        "D$ QP",
        "ToggleTraceWithCustomFilterAction_FailedToCreateFilter",
        "2L2v2",
        "FirstLevelTbFills",
        "9~dt\"",
        "SystemCache",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\delayaction.cpp",
        "161Y1s1",
        "j{Yf9",
        "pSetRegKeyAction: ",
        "7.:Q:",
        "MicrosoftWlanTelemetry",
        "Washington1",
        ":?:m:",
        "7)848A8U8[8f8s8",
        "EventStoreSizeMb",
        "TimeToAlternativeExpirationSec",
        ";';4;O;",
        "4+525?5",
        "3$454G4T4^4n4{4",
        "CacheTransitionCount",
        "EscalationWorkItem_EscalationCompleted",
        "base\\diagnosis\\diagtrack\\matchengine\\asimoveventbuffer.cpp",
        "t$LPh",
        "DisableProviderGroups",
        "9-9B9Q9V9h9z9",
        "=.=F=^=v=",
        "HKEY_PERFORMANCE_DATA",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\runexewithargsaction.cpp",
        "SOFTWARE\\Microsoft\\Reliability Analysis\\RAC",
        "IoOtherTransferCount",
        "Cd;C\\rJw",
        "th_9~",
        "capturestate",
        ": ;X;",
        "1\"282[2h2",
        "MetadataEngine_StartEventThread",
        ":::m:",
        "9=9]9",
        "InfoStream_ExceededMaxSetupDurationMsOnLastAction_0",
        "_lastresumefromstandbytime",
        "(type: ",
        "deque<T> too long",
        "4#4K4X4|4",
        "Reserved3",
        "4Q5a5t5@6P6_6",
        "D$<QP",
        "= =(=,=4=8=@=D=L=P=X=\\=d=h=",
        "546Z6",
        "=2=W=c=",
        "IsForceAot",
        "GetModuleHandleExW",
        ";`;r;",
        "ScenarioCompleted_0",
        "7>7G7[7y7~7",
        "2<FPZd",
        "ExpectedChecksum",
        "SetThreadpoolTimer",
        "            <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/>",
        ">&?T?f?",
        ":-;7;t;",
        "0F0k0",
        "0d:l:t:|:",
        "8TASK",
        ":!;S;",
        "tickets",
        "exeName=",
        "resource unavailable try again",
        "8,9d9",
        ":-:7:C:g:u:",
        "999a9",
        "L$\\_^[3",
        ".?AV<lambda_2664244e1f1c1ff0265b78361e9e68fb>@@",
        "ThrottledDroppedCount",
        ";$;,;4;<;D;L;T;\\;d;l;t;|;",
        "[ERROR:ConsumePayload(%u)]",
        "Metadata_LastApplicationInstallTime",
        ":(:0:<:\\:d:p:",
        "E PhP",
        ":_;u;",
        ";$<X<x<",
        "j}XQf",
        "FileDescription",
        "7@7I7^7",
        "PartA_Exts",
        "_XcptFilter",
        "171a1",
        "&locale=",
        "-- Warning: buffer empty --",
        "QuotaNonPagedPoolUsage",
        "</<c<",
        "EventLatency",
        "AsimovUploader_ResponseLog",
        "0>0G0d0}0",
        ">+?}?",
        "010W0q0",
        "UploadEtlSucceeded",
        "SnapAlwaysOnTraceAction",
        "8LEVL",
        "1(222m2",
        "metadata",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "=V>^>",
        "1G1Q1",
        "3+3A3S3q3",
        "RecoveredEntries",
        "9qhu%",
        "GlobalFree",
        ":F;p;",
        "5#616O6]6l6",
        "=2=R=r=",
        "s29>w.+>S",
        "5?5M5R5~5",
        "api-ms-win-eventing-provider-l1-1-0",
        ".idata$6",
        "TEMP@",
        "8\"9)9",
        "WaitResult",
        "\"[ERROR:EventHeader.Flags=%x]",
        "base\\diagnosis\\diagtrack\\include\\WithFileIoPriority.h",
        "InitializeProcThreadAttributeList",
        "BuildLabEx",
        "12738",
        "wcschr",
        "    </security>",
        "=G=}=",
        "2,3Y3d3",
        "ReadOffset",
        "G ^_]",
        "address not available",
        "1(1D1T1`1",
        "<string>",
        "D$0PS",
        "8K8R8n8s8",
        "j{[f9",
        "4+4\\4",
        "CreateWaitableTimerExW",
        "<(<P<x<",
        "p%DiagtrackStorageRoot%\\parse.dat",
        "hexint32",
        "AppIdByPath",
        "555G5y5",
        "\"Custom#%u\"",
        "92:U:_:s:",
        "CommittedPages",
        "t9hP!",
        "3'4M4",
        ":&:?:M:l:",
        "HKEY_CURRENT_USER_LOCAL_SETTINGS",
        "AppIdMetadata_HasAccountPrefix_LsaKnownType",
        "unknown error",
        ">B?|?",
        "InfoStream_UnactionableScenario_0",
        "MetadataEngine_RegistryThreadWaitFailed",
        "505@5w5",
        "ProviderID",
        "__DEPRECATED_InfoStream_ScenarioCompleted_0",
        "PageFaultCount",
        "6#6<6J6}6",
        "D$D@P",
        ";0uA9E",
        "JsonBuilder - cbValue too large",
        "<A=u=",
        "TDH_FILETIME",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\lastboottimemetadata.cpp",
        "7/898",
        "PSRVW",
        ";1<^<",
        "=%>W>",
        "TDH_BINARY",
        "MaxCancelReports",
        "4(404P4l4|4",
        "BufferSize",
        "111W1q1",
        "base\\diagnosis\\diagtrack\\matchengine\\transition.cpp",
        "minute",
        "%windir%\\system32\\RdrLeakDiag.exe",
        "3W3d3",
        "ScenarioDef_ParsingScenario",
        ".rdata$zETW0",
        "NumEvents",
        "<2<A<J<Z<",
        "SettingsManager_SkipETagSinceQueryParametersChanged",
        "_iscontinuumsessionactive",
        "Global\\UTCForceUploadEvent",
        "getfileaction",
        "identifyinginfo",
        "4)4/4G4p4",
        "EventPersistence",
        "7 7@7H7T7\\7",
        "1/1<1K1a1",
        "Microsoft Corporation",
        "invalid random_device value",
        "int64",
        "TDH_HEXINT64",
        "PeakPagefileUsage",
        "444<4D4L4T4p4",
        "7/7>7",
        "GroupId",
        "DTSQMLogger_UploadScenario",
        "<)<><",
        "base\\diagnosis\\diagtrack\\engine\\triggerlistener.cpp",
        "DbDroppedCount",
        "EventDroppedUploader",
        "RingBufferLatency",
        "3!3%3)3-3135393=3A3E3I3M3Q3U3Y3]3a3e3i3m3q3u3y3}3",
        "DiagTrackScenario",
        "GlobalMemoryStatusEx",
        ".didat$6",
        "?_LoadSharedStringResource@@YG?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@K@Z",
        "RegQueryValueExW",
        ":%;/;",
        "RestrictedNetworkTime",
        ":*;h;",
        "mintimebetweenfailureescalationsms",
        "[ERROR:MB2WC=%u]",
        "999f9",
        "97u-W3",
        "FindCloseChangeNotification",
        "t$HPQ",
        "191M1e1",
        "ntoggletraceaction",
        "CcPinReadWait",
        "^wfp show state -$",
        "EventData",
        "DisableCabUpload",
        "changestamp",
        "MatchAllKeyword",
        "aepic.dll",
        "041r2",
        "WEVT|",
        "242G2",
        "959k9",
        "WinHttpCrackUrl",
        "4 404<4\\4d4p4x4",
        ";m;{;",
        "1$1<1H1h1t1",
        "w\\_9~",
        "=B>q>z>",
        "=->Y>f>",
        "AOT started successfully",
        "AOT in registry started successfully",
        "GetProcessHeap",
        "processname",
        "3@4T4",
        "WerReportCloseHandle",
        "%d.%d.%[^.].%[^.].%s",
        "sample",
        "uKPPV",
        ".?AV<lambda_84daebeebca12e644d6690a93ce181bb>@@",
        "nsnaptraceaction",
        "ServiceMain_StandaloneShutdown",
        "1C1Q1m1",
        "SystemProductName",
        "mathoperation",
        "_ftol2",
        "LoadLibraryExW",
        "memoryinfo.xml",
        "1@1r1",
        "WTSAPI32.dll",
        "LaunchCount",
        "Utils_ExpandAndCreateDirectory_SkippingDiskRootPath",
        "9+949K9n9",
        "9!:J:",
        "ProcessorNameString",
        "base\\diagnosis\\diagtrack\\tracing\\tracer.cpp",
        "Failed to parse scenario.",
        "5c6s6",
        "@f94C",
        "bldtm",
        "VortexUrl",
        "1I1P1c1o1v1|1",
        "SetEndOfFile",
        "RtlConvertDeviceFamilyInfoToString",
        "?2?x?",
        "2>2Q2e2r2",
        "NumBytes",
        ":\";L;v;",
        "GetSecurityDescriptorControl",
        "DefaultProviderGroupDefinition",
        "uint16",
        "diagtrack.dll",
        "D$$<)",
        "DiagTrackAotLogger",
        "7 8F8",
        "9!9^9u9",
        "SystemSKU",
        "4M5m5",
        "Win32StartAddress",
        "2!212S2",
        ":4:@:`:l:t:",
        "Failed to set ETW session disallow list",
        ">A?{?",
        "282d2",
        "1=1U1t1",
        "AppIdMetadata_HasAccountPrefix_LsaUnknownType",
        "4.4p4",
        "242]2s2",
        ">G?a?n?",
        "D$(SVW",
        "exists",
        "RegSetValueExW",
        "|$x9y",
        "InfoStream_InvalidScenarioXML_0",
        "2\"2N2u2",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\setregkeyaction.cpp",
        "t9h0!",
        "multiply",
        "L$<^3",
        "BlackBoxErrorEventsCapacity",
        "?$?K?Z?",
        "PointerField",
        "?@?P?\\?d?",
        ".?AV<lambda_9d7076dadc64a1d8d222ff2ff3a2bb4f>@@",
        "GetSecurityDescriptorSacl",
        "9U:f:/;R;`;n;",
        "Metadata_LastAbnormalShutdownTime",
        "1$1D1L1T1\\1x1",
        "9)949A9U9[9f9s9",
        ";F tW",
        "CreateThreadpool",
        "6Y7_7s7",
        "??1exception@@UAE@XZ",
        ">T?q?w?",
        ":@;L;",
        "8EVNT",
        "2$2@2P2\\2d2",
        "R!s4Z",
        "?!?,?1?L?h?",
        "ClientId.UniqueThread",
        "Escalation engine Execute() for scenario failed.",
        "4D4R4|4",
        "FXPhx",
        ":H;X;q;",
        "0%0=0",
        "base\\diagnosis\\diagtrack\\matchengine\\inflightscenario.cpp",
        "2'2-2G2M2j2p2",
        "<assemblyIdentity",
        "&uHj{Xj",
        ":%:6:>:T:\\:",
        "tempDirectory=",
        "415a5",
        "EventPayload",
        ">)>P>",
        "CcFastMdlReadNotPossible",
        "UploadEtlFilesOnly",
        "<@?J?U?a?l?v?",
        "nstarttraceaction",
        "operation_would_block",
        "GetTempPathW",
        "1.1W1s1",
        "SharedCommittedPages",
        "809S9p9}9",
        "5S5]5u5",
        "6'6B6O6",
        "processNameSubstring=",
        "WideCharToMultiByte",
        "\"Microsoft Window",
        "s-9C\\w(+C\\j0^",
        "^wfp show filters -$",
        "606<6D6x6",
        "HeartBeatInterval",
        "RedirectedStorageRoot",
        "RegEnumKeyExW",
        "GetProcessDump: CreateToolhelp32Snapshot failed",
        "8;9[9",
        "OtherTransferCount",
        "D$hSVW",
        "3$343<3D3L3T3\\3d3l3t3|3",
        "GetSecurityDescriptorLength",
        "8_^[]",
        "PicFreeFileInfo",
        "; Wait Time (min): ",
        "SystemCalls",
        "2)222k2",
        "WaitForMultipleObjectsEx",
        "t#9>t",
        ";&<3<A<F<j<",
        "InfoStream_ScriptTerminated_0",
        "int16",
        "OldTime",
        "tOkC|",
        "9!:0:?:T:{:",
        "pLoggerFlushTime",
        "Microsoft-Windows-DiagTrack/Diagnostic",
        "pdtfs",
        "regkeyquery.xml",
        "t.Length",
        "=?>~>",
        "win:Informational",
        " -dumptype ",
        "WinSqmIsOptedInEx",
        ":B;R;",
        "not a stream",
        "SettingsHttpFailures",
        "NextReadSequenceCounter",
        "%.17g",
        "ToggleTraceWithCustomFilterAction_FailedToGetTraceHandle",
        "9CHr4",
        "QQVWQ",
        "pGlobal\\UTCRingBuffer_events",
        "LoggerName",
        "argument out of domain",
        "8OPCO",
        "7B7Z7}7",
        "6*6N6j6",
        "718>8Y8",
        "INVALID_HIVE_NAME",
        "TracePriority",
        "737[7p7",
        "D$ PQ",
        "IoWriteOperationCount",
        "MOPR1'0%",
        "Reserved4",
        "939:9E9J9Z9",
        "verbld",
        "ADVAPI32.dll",
        "f9F.u",
        "AppType",
        "scenarioId=",
        "bad file descriptor",
        "SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\",
        "%hs!%p: ",
        "8 8D8L8T8\\8d8l8t8|8",
        "EnterCriticalSection",
        "%windir%\\system32\\disksnapshot.exe",
        "WorkingSetSize",
        "not enough memory",
        "3/3C3",
        "8$8D8L8T8p8x8",
        ">4>D>P>p>x>",
        "settings",
        "drivers\\*.mrk",
        "CLSIDFromString",
        ":P:`:l:t:",
        "TestEvent_RADARAction",
        "0*080l0",
        "5b5u5",
        "CloseServiceHandle",
        "nCipher DSE ESN:148C-C4B9-20661%0#",
        "EventUnregister",
        "3-3R3",
        "Failed to stop ETW trace",
        "Microsoft.Windows.DiagTrack.XML",
        "base\\diagnosis\\diagtrack\\matchengine\\asimovhttpclient.cpp",
        "2@3o3",
        "2/3u3",
        "verqfe",
        ">?>z>",
        "QSSj SSSPS",
        "HttpRequestCount",
        ";$;+;B;H;N;T;Z;`;g;n;u;|;",
        "1 101@1P1`1p1",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\toggletraceaction.cpp",
        "osVer",
        "7*797G7",
        "> >+>L>m>|>",
        "3%313I3U3`3u3",
        "5,585@5`5h5p5",
        "0K0x0",
        "directory not empty",
        ";@;x;",
        "G<#WL",
        "O:BAD:(A;OICI;GA;;;BA)(A;OICI;GA;;;S-1-15-2-4100369157-1034187050-1364371154-1714612948-1847883727-388702109-1961059416)(A;OICI;GA;;;S-1-15-2-4016783169-893401051-2237370320-274899566-412088533-2398988950-2155762795)(A;OICI;GA;;;S-1-15-2-3926089429-3779096810-139998268-2665160821-3597776985-345016210-467500384)(A;OICI;GR;;;WD)",
        "2/3E3x3",
        "Filter_FilterEvaluated",
        "CHttpRequest Waiting for WinHttp to complete",
        "CcCopyReadWaitMiss",
        ";CltS",
        "7L7m7z7",
        "ReturnHr[PreRelease]",
        "OnCostedNetworkMs",
        "8\"8u8",
        "instanceId",
        "relatedActivity",
        "CcMdlReadWaitMiss",
        ".?AV<lambda_16c95b7e0ee49ec1a09061a1ee773b33>@@",
        "Throttled noisiest producer at Event Store. %s, TLG Name: %s, Hit count in WL: %llu, Th: %f%, Persistence: %d",
        "1&1G1h1",
        "FiletimeField",
        ";>;y;",
        "Int16Field",
        "SequenceNumber",
        "212W2n2",
        "prodsuite",
        "<@<P<\\<d<",
        "><>D>L>T>p>",
        "9(:`:",
        "source",
        "wscpusc",
        "performanceinfo",
        "ToggleTraceWithCustomFilterAction_CreatedFilter",
        "stoptraceaction",
        "operation_in_progress",
        "ResourceFileName",
        "RingBuffer_CopiedHeaderAndFlushedToDisk",
        ";\"<@<M<",
        "MessageFileName",
        "WERLogger_ReadyToSubmit",
        "float",
        "3:4{4",
        "QueryUnbiasedInterruptTime",
        "9*989N9",
        "MSAUserIdentityProvider_SuccessfulCacheHitFreeNetworkUnavailable",
        "=\"=,=3=\\=",
        "6'7C7s7",
        "7#797B7W7z7",
        "t$$;s",
        "1 3/3",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Flighting\\Build",
        "LastConnectivityState",
        "ServiceMain_DiagTrackAlreadyActive",
        "D$$)Gl_^[",
        "CloseThreadpoolWork",
        "D$89^",
        "DiagTrackStatus",
        ".?AVbad_alloc@std@@",
        "base\\diagnosis\\diagtrack\\matchengine\\ringbuffereventstore.cpp",
        "UuidToStringW",
        "1'2P2",
        "f9O4u2",
        "TraceBufferBudgetPermil",
        "Throttle buffer recover at Event Store. Th: %f, Bff: %f, Persistence: %d",
        "false",
        "6&6n6",
        "<K<U<s<x<}<",
        "_snprintf",
        "0*0H0g0x0",
        "484H4T4\\4",
        "0j1o1",
        "HandleCount",
        "242`2",
        "_onexit",
        "233c3",
        "Action failed with error code: ",
        "address_not_available",
        "TDH_UINT16",
        "=#=(=Q=",
        "NormalEventUploadTimer",
        "IoReadOperationCount",
        "L$(QP",
        "r:9;t",
        "979]9b9",
        ">6???",
        "FailureReportCount",
        "%windir%\\system32\\whoami.exe",
        "7-8Q8[8",
        "2.3I3~3",
        "AsimovUploader_AddEvent",
        "9':4:N:\\:",
        "RtlGetVersion",
        "D$ 4?",
        "value",
        "%DiagtrackRegistryRoot%\\TriggerListener",
        "DoubleField",
        "CcDirtyPageThreshold",
        "6.6?6v6",
        "_lastresumefromhibernatetime",
        "CryptHashData",
        "FileSize",
        "/0U0b0n0",
        "=!>0>@>R>",
        ".?AV<lambda_24198816eb39500d8f0658217de01c12>@@",
        "notequal",
        "XMLParser_DebuggingInfo",
        "ETWConsumer_ModernAppProviderLoaded",
        "vLhHT",
        "2M3_3",
        ".didat$7",
        ";(;4;<;\\;d;l;",
        "PeakVirtualSize",
        "< =@=U=i=",
        "NormalSettingsTimer",
        ">=>a>",
        "D$TPh0",
        ";$;D;`;p;|;",
        "pservicename",
        "202l2",
        "8$8,888X8`8l8t8",
        "~H+~@",
        "0!1Y1",
        "Failed to stop ETW tracing session (before starting a fresh session)",
        "InitializeCriticalSectionAndSpinCount",
        "vswprintf_s",
        "787@7H7P7X7t7",
        "TEMP,",
        "3P3`3l3t3",
        "8.8z8",
        "<4<<<D<L<T<\\<d<l<t<|<",
        "D$lVPh",
        "7(8A8N8i8z8",
        "MaximumRefreshIntervalMinutes",
        "keywords",
        "InfoStream_AlternativeTraceStopped_0",
        "/report",
        "illegal byte sequence",
        "5,5F5O5\\5",
        "SIDField",
        "1!222L2Z2",
        ";0;o;",
        "NumberOfThreads",
        "IsGroup",
        "607@7[7k7",
        "FileName",
        "LastNormalUploadTimeOrFirstBoot",
        "LegalCopyright",
        "PSQVWj0h",
        "=6>E>U>m>",
        "maxfailurereports",
        "616=6_6v6",
        "lessthanequal",
        "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "Y__^[",
        "8$8+8",
        "MSAUserIdentityProvider_ExpiredCacheHit",
        ".idata$3",
        "939E9e9",
        "??_V@YAXPAX@Z",
        "_timesinceosinstall",
        "towlower",
        "ProviderPath",
        ";>t+S",
        "uRj;S",
        "=7=D=c=",
        "internal\\Base\\inc\\DeviceTicket.hpp",
        ":0:L:\\:h:",
        "5-6:6J6",
        ":%:u:",
        "ForcePickAOT",
        "t.;:u",
        "%DiagtrackStorageRoot%\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl",
        "%DiagtrackStorageRoot%\\DownloadedScenarios",
        "8U9b9",
        "<<<L<v<",
        "$`2X`F",
        "maxdurationsec",
        "?&?,?=?N?X?",
        "0$0,040<0D0L0T0\\0d0l0t0|0",
        "CopyOnWriteCount",
        "Utils_OpenRegistryKeyFailed",
        "<\"<D<_<",
        "M0K0I",
        "no such process",
        "Value",
        "Trigger_XToken_NoXuidInGameEvent",
        "bad message",
        "222C2j2v2",
        "8!838P8l8",
        "949<9D9L9T9\\9d9l9t9|9",
        "diagrules",
        "Manifest contains invalid scenarios. Number: %d, File: %s",
        "\\summary.txt",
        "DisableAsimovUpload",
        "aotPriority",
        "RADARAction: ",
        "vermaj",
        "747?7N7_7g7v7",
        "t9hH!",
        "546\\6",
        "\\$$PS",
        "=a=_>",
        "??1type_info@@UAE@XZ",
        "ETagQueryParameters",
        "UnicodeStringArrayCountField",
        "0$090L0W0g0",
        "|hK,_",
        "D$@SP",
        "D$DQP",
        "buffer error",
        "HKEY_LOCAL_MACHINE",
        "t9hX ",
        ".?AVCAtlException@ATL@@",
        "+0S0z0",
        "4TP(3",
        "EventRegister",
        ";W<f<w<",
        "9@9E9U9",
        "%DiagtrackStorageRoot%\\SoftLandingStage",
        "aotStopTime",
        "RegGetValueW",
        "explicitscope",
        "J4Y4g4",
        "5W6l6x6",
        "RingBuffer_CommittedPreCompressBuffer",
        "SecondLevelTbFills",
        "9\":':8:i:",
        "?;?A?",
        "5C5u5",
        "filename too long",
        "maxcancelreports",
        "=2=h=r=",
        "9):p:",
        "AOT stopped successfully",
        "[nn&u;",
        "constant",
        "waittimemin",
        "StatusCode",
        "VWh0U",
        "ETWConsumer_EtlProcessingThreadProc_NotAuthorizedToProcessETLLogs",
        "1 1(10181@1H1P1\\1|1",
        "base\\diagnosis\\diagtrack\\engine\\scenariostoragexmlfile.cpp",
        "12676",
        ".rdata$zETW1",
        ".edata",
        "t$<WP",
        "DiagTrackETWLogger",
        "%DiagtrackStorageRoot%\\ETLLogs\\ShutdownLogger",
        "KernelTotal",
        "0+060?0",
        "D$TQP",
        "DelayAction",
        "RtlNtStatusToDosErrorNoTeb",
        ": :V:W;l;",
        "PdcNetworkActivation_Activate",
        "__DEPRECATED_InfoStream_TestRealtimeLatency_0",
        "Alternative trace stopped successfully (not preempted)",
        "303W3q3",
        ":$;q;w;",
        "%windir%\\system32\\route.exe",
        ">&>>>Y>s>",
        "ServiceStatusFilter",
        ";0;R;;=[=l=}=",
        "8 808@8H8l8|8",
        "?gs_lifetimeManager@@3VCLifetimeManager@Diagnostics@Microsoft@@A",
        "9.:E:X:",
        "signature",
        "5#515>5N5",
        "BasePriority",
        "9w(t#",
        "=2=l=",
        "dbghelp.dll",
        "3-4N4W4c4",
        "wpbuildmaj",
        "base\\diagnosis\\diagtrack\\engine\\filelinetracker.cpp",
        "base\\diagnosis\\diagtrack\\engine\\metadataengine.cpp",
        "RingBuffer_ReadFailedDueToInvalidSequenceNumber",
        "RegOpenKeyExW",
        "filePath=",
        "UserSid",
        "L$89\\$Ls",
        "processdump_",
        "s>9>w:+>",
        "LoadLibraryExA",
        "969G9e9u9",
        "InnerText: ",
        "9(909d9l9t9|9",
        "alternativeTraceStartTime",
        "1!21262",
        "<NotSupported>",
        "??0exception@@QAE@ABQBD@Z",
        "Gf9z$u[",
        ".00cfg",
        "RegDeleteKeyExW",
        "=#=`=v=",
        "%windir%\\SysWow64\\RdrLeakDiag.exe",
        "<?=q=",
        "DisableAllUploads",
        "Utils_ExpandAndCreateDirectoryFailed",
        "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\"  xmlns:asmv3=\"urn:schemas-microsoft-com:asm.v3\" manifestVersion=\"1.0\">",
        "0*171W1h1",
        "? ?(?<?D?X?`?h?p?x?",
        "%DiagtrackRegistryRoot%\\ScenarioCache",
        "X-Tickets",
        "GetExtensionList",
        "EntryLatency",
        "7(7H7P7X7`7l7",
        "1I2P2",
        "9,:<:H:P:",
        "Failed to update forwarders from settings",
        "?(?X?m?",
        "BuildBranch",
        "8P9z9",
        "maximumruntimems",
        "WinHttpOpenRequest",
        "Filters: ",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
        "DualPropertyFilter",
        "; ;:;Q;\\;i;x;",
        "OtherOperationCount",
        "7&7<7T7",
        "GetCurrentThread",
        ": ;);A;d;",
        "7<7`7}7",
        ">*>K>g>",
        "no such file or directory",
        "<GetBuildSignature not found>",
        "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>",
        "9:9D9q9",
        "NetworkState",
        "D$dVPh(",
        "<8<H<X<|<",
        "CoCreateInstance",
        "EventWriteTransfer",
        "Microsoft Time-Stamp PCA 2010",
        "Trigger_MSAPopulateWithEventSID",
        "9G|~M",
        "596O6X6m6",
        "QuotaPagedPoolUsage",
        "90D0i0z0^2k2",
        "EtwDroppedCount",
        "containsWindowsRange=",
        "9@9`9",
        "aotStartTime",
        "6C6U7e7",
        "f9F(u",
        "2 2(2H2P2X2`2|2",
        ";\"<O<",
        "operation not permitted",
        "4!4H4c4",
        "TriggerToString",
        "0*0/0F0u0",
        "Legal_Policy_Statement",
        "MinimumTimeToTraceExpirationMillis",
        "606Z6s6",
        "FloatField",
        "ScenarioManager_SkipEnablingForwardersFromSettings",
        "s.Ph8",
        "SSSWh",
        "=9=n={=",
        "__CxxFrameHandler3",
        "_wcsnicmp",
        "RegCopyTreeW",
        "wb_9~",
        ">9?H?V?",
        "7(787D7L7",
        ">$?4?|?",
        "UtcSysprepGeneralize",
        "2\\2o2",
        ">$>,>4><>D>L>T>\\>d>l>t>|>",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\etwforwarder.cpp",
        "<&<7<s<",
        "Failed to start ETW tracing session for Shutdown logger.",
        ".gfids$x",
        "Latency",
        "GetSystemPreferredUILanguages",
        "2F2O2",
        "<J<m<",
        "WinHttpQueryHeaders",
        "appVer",
        "?'?;?",
        "Exception",
        "statenames",
        "9\\04}a",
        "1(0&0",
        "CloseTrace",
        "InfoStream_TraceProfileOverBudget_0",
        "?$?,?4?<?D?L?T?l?x?",
        "ScenarioManager_MismatchedScenarioSchemaVersion",
        "6 6$6(6,6064686<6@6D6H6L6",
        "2!2&272R2i2",
        "Escalation for scenario timed out. Current runtime: %llu ms. Maximum allowed runtime: %llu ms. Escalation type: %d",
        "CBuildStringMetadata_Update",
        "actionname",
        "DiskCounters.WriteOperationCount",
        ";D$0u",
        "u98^ u$Wh",
        "regKey=",
        "Ol;GxwQ",
        "MiniDumpWriteDump",
        "SinglePropertyFilter",
        "pevent",
        "1A1N1d1",
        " name=",
        "525F5Z5n5",
        "runexewithargs_output.txt",
        "^wfp show netevents -$",
        "2:2|2",
        "ntprodtype",
        "[ERROR:ConvertSidToStringSidW=%u]",
        "WriteOffset",
        "REG_SZ",
        "=*=E=M=Z=v=",
        ".Count",
        "6-6<6K6Z6i6",
        "%DiagtrackStorageRoot%\\SoftLanding",
        "UIntArrayField",
        "destination_address_required",
        "809:9",
        "CurrentFileTime",
        ":F:l:",
        "propertyselector",
        "2$2,242<2D2L2T2\\2d2l2t2|2",
        "SetUnhandledExceptionFilter",
        "%DiagtrackStorageRoot%\\",
        "Payload",
        "9.989G9k9u9",
        "Gp_^[",
        "DisableProducerThrottling",
        "6)7r7",
        "MSAUserIdentityProvider_SuccessfulCacheHitWithErrorAfterPopulate",
        ":(;^;};",
        "EscalationWorkItem_CabUploadDisabledThroughTestHook",
        "? ?@?\\?`?l?",
        "AsimovUploader_FailedDeviceTicketQuery",
        "InitializeCriticalSectionEx",
        "9X(tI",
        "host unreachable",
        "WinHttpGetProxyForUrl",
        "CertFreeCertificateContext",
        "626E6N6d6|6",
        ";L<b<w<",
        ":!;p;",
        ">%>K>V>s>",
        "wer.dll",
        ";e<|<",
        "ActualChecksum",
        "file error",
        "5 5d5x5",
        "OnBattery",
        "D$0SVW",
        "070?0[0",
        "3c4q4",
        "L$T_^[3",
        "UTC_ForceEscalationUpload",
        "5!6N6",
        "20151029165758Z",
        "6!778%9S:",
        ":4:<:D:L:T:\\:d:l:t:|:",
        "internal\\sdk\\inc\\wil\\Result.h",
        "f98u+",
        "10p0w1",
        "0(181T1X1d1",
        "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection",
        "ignorefailure",
        "?S?t?",
        "MSAUserIdentityProvider_SuccessfulCacheHitWithErrorRequery",
        "7X7e7",
        ": :T:d:p:x:",
        "AutoLogger-Diagtrack-Listener",
        "12677",
        "#Metadata_LastApplicationInstallTime",
        "=(=E=Z=y=",
        "GetDeviceUniqueID",
        "message_size",
        "already connected",
        "ConvertStringSidToSidW",
        "connection_refused",
        "0Q0y0",
        "3#3N3W3m3",
        ">/?J?Z?g?",
        ":(:-:=:e:",
        "*.json",
        "SetThreadPriorityBoost",
        "TraceSetInformation",
        "TotalSystemCodePages",
        "connection aborted",
        "3\"3Q3F4^4i4",
        "CriticalSettingsDueTime",
        "0&0W0]0z0",
        "RunDll32Main",
        "LastCriticalDownloadAttempt",
        "alwaysontrace",
        "Failed to open ETW trace while processing etl file.",
        "2$2}2",
        "1<1D1L1X1x1",
        ".CRT$XIZ",
        "CoCreateGuid",
        "0'1Y1",
        "=$=<=H=P=p=x=",
        "8#9C9",
        ">+?M?c?o?|?",
        "PreviousHeartBeatTime",
        "?B?`?{?",
        "LatencyDataLastUploadTime",
        "CompanyName",
        "PageReadCount",
        "ScenarioManager_SkipRestartingSavedTraces_UploadEtlFilesOnly",
        "&osVer=",
        "retwtrigger",
        "Phone",
        "9D:K:",
        "091S1x1",
        "6&7j7",
        ";A<P<^<",
        "InfoStream_DroppingScenario_0",
        "6$6,6`6p6|6",
        "CcMapDataWaitMiss",
        "</<o<",
        "NtQueryInformationThread",
        ":!:^:",
        "9$939A9_9o9",
        "0000da39a3ee5e6b4b0d3255bfef95601890afd80709",
        "D$HPh",
        "767T7g7",
        "s\"9>w",
        "NewState",
        "5W5h5~5",
        "181Q1^1",
        "7%8e8",
        "WinHttpSendRequest",
        "InputKeyName",
        "Y9WLw",
        "=.>5>m>q>u>y>}>",
        "network down",
        "<:<^<",
        "base\\diagnosis\\diagtrack\\main\\servicemain.cpp",
        "tQvQk",
        "DiagtrackStorageRoot",
        "\\AsimovEvent_",
        "CreateFileW",
        "L$@WS",
        "DiagTrack_",
        "CcFastReadNoWait",
        "SetFilePointerEx",
        "KernelNonpaged",
        "000I0W0d0",
        "D$ 9\\$4s",
        ">%>0>U>",
        "D$ 0)",
        "windowsperformancerecordercontrol.dll",
        "1J1P1\\1a1n1",
        "OnBatterySaverMs",
        "384x4",
        "isautologger",
        "Message",
        "00a0l0x0",
        "8EVTF",
        "Failed to start ETW tracing session",
        ".text",
        ":/;B;",
        "InfoStream_QueryMsaDeviceTicketFailed_0",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\starttraceaction.cpp",
        "PayloadBytes",
        "CreateProcessW",
        "too many symbolic link levels",
        ";.;C;c;o;",
        "__DEPRECATED_InfoStream_UploadedEventRejectedByBackend_0",
        "2!2=2V2",
        "HttpRequestLatency",
        "CTracer::UpdateTrace() failed",
        "CcFastReadWait",
        "CcDataFlushes",
        "RRRPh@:",
        "8#8n8",
        "=-=<=o=",
        "LastFreeNetworkLossTime",
        "connection_aborted",
        "<!>G?",
        "wpcoreutil.dll",
        "0l1~1Q4g4",
        "SetRegKeyAction",
        "CConditionalTimer_GetTimeToWakeup_Timeout",
        "MaxBuffers",
        "3.3W3n3",
        "CanCollectOsTelemetry",
        "ProviderId",
        "4+4Q4{4",
        "4*4>4U4g4~4",
        "0(1>1]1s1",
        "bssku",
        "<2<d<",
        ":A;N;",
        "1,2j2",
        "DiagTrackSKU",
        ":7;D;];",
        "Invalid registry query",
        "D$\\VPhH",
        "5(5W5b5l5",
        "XMLParser_SessionBegin",
        "AllowTimechangesToAffectEtwTimestamps",
        "4%4<4",
        "747W7r7}7",
        "requiredRunPermission=",
        "EnterNextElementCheckName: ",
        "LifetimeManager_CEIPDisabled",
        "6 6,6L6T6\\6h6",
        "trace.etl",
        "090V0d0",
        "{BADF00DB-ADF0-0DBA-DF00-DBADF00DBADF}",
        "IsEscalationInProgressMetadata_Query",
        "5)5:5V5",
        ";0;8;@;H;P;X;`;l;",
        "1%2H2`2",
        "><>`>}>",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "%ProgramData%\\Microsoft\\Diagnosis\\DownloadedSettings",
        "NonPagedPoolPages",
        "vermin",
        "CreateXmlReader",
        "8#;(;",
        "win:Verbose",
        "base\\diagnosis\\diagtrack\\factories\\consumerfactory.cpp",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "0L0v0",
        "7/7P7q7",
        ".?AVlength_error@std@@",
        ":C;m;",
        "5$5,5`5p5|5",
        "9$9,949<9D9\\9h9p9",
        "$Metadata_LastResumeFromHibernateTime",
        "UIntArrayCountField",
        "MinBuffers",
        "maxdurationms",
        "ScenarioStateModel_SkipAnachronisticTrigger",
        "2T3n3",
        "USERENV.dll",
        "IsWow64Process",
        "< =@=n=",
        "ETWConsumer_OpenOfflineETLFilesTrace",
        "1)2s2",
        "2\"2)2i2",
        "L$$_^[3",
        "7 7N7b7",
        "dword",
        "toleranceMillis=",
        "<@<z<",
        "8A8i8",
        "RunConfigurationClient",
        "?(?6?K?o?",
        "EventSetInformation",
        ">4?q?",
        "WaitForThreadpoolWorkCallbacks",
        "Warning: Additional data available in WNF buffer. Including hex string representation.",
        "TDH_HEXINT32",
        "S-1-12-1-",
        "JsonVector - exceeded maximum capacity",
        "2 2Q2V2",
        "9L$pr/",
        "pThrottle buffer recover at Trigger Buffer. Index: %hu, Th: %llu, Count: %Iu",
        "waitTimeMin = ",
        "797g7",
        "base\\diagnosis\\diagtrack\\main\\lifetimemanager.cpp",
        "DiagTrackReleaseType",
        "PartB_",
        "SetFileAttributesW",
        "ResolveDelayLoadedAPI",
        "_vsnwprintf",
        "EnteringCriticalOverflowDroppedCounter",
        "propertykey",
        "Completion",
        "PeakCommitment",
        "base\\diagnosis\\diagtrack\\include\\LifetimeManager.h",
        "f0(1c1",
        "3L3j3",
        "334`4",
        "InfoStream_AOTStopped_0",
        "valuetype",
        "utc.app.json",
        ">h?u?y?}?",
        ":$:,:`:p:|:",
        "DestroyEnvironmentBlock",
        "=3=[=k=",
        "PhysicalTotal",
        "GetVersionExW",
        "OnAcTimeoutMs",
        "newest",
        "9=:u:",
        "<C=K=o=",
        "maxescalationdurationms",
        "4@5^5",
        "3<4A4Z4",
        "4>5d5s5",
        "ControlService",
        "RingBuffer_ExitingCriticalOverflowMode",
        "FuzzWindowMs",
        "<3<`<",
        "CurrentFailureEscalations",
        "uR9GXuM3",
        "Microsoft Corporation1200",
        "TDH_UINT32",
        "MicrosoftTelemetry",
        "ProviderStats",
        "747o7",
        "3)3W3a3w3",
        "WinHttpAddRequestHeaders",
        "    type=\"win32\"/>",
        "0!0Q0m0",
        "uXSSW",
        "<$=5=S=",
        "374K4",
        "DisableMatchEngine",
        "RealtimeDbLatency",
        ";A;E;I;M;Q;U;Y;];a;e;w;K?",
        "Q2X2|2",
        "575]5j5",
        "HeapAlloc",
        "LogFileMode",
        "WinHttpGetDefaultProxyConfiguration",
        "919L9i9p9~9",
        "WinHttpReceiveResponse",
        "8B8l8",
        "t$0WV",
        ">9?s?",
        "3 303@3P3`3p3",
        "FailureEscalationCount",
        "AppSessionGuid",
        "ConvertStringSecurityDescriptorToSecurityDescriptorW",
        "\\AsimovBuffer_",
        "QueryPerformanceCounter",
        "%DiagtrackRegistryRoot%\\Scenarios",
        "(caller: %p) ",
        "SleepConditionVariableSRW",
        "BuildString",
        "8$8f8",
        "Y9WLr",
        ">$???y?",
        "?6?D?h?",
        "InFlightScenario_TransitionTaken",
        "8&848P8U8a8f8v8",
        "/collect",
        "2$242D2L2T2\\2x2",
        "WWWPh",
        "=$=,=<=D=L=T=\\=t=",
        "ContainsEscalationSection",
        "ETWConsumer_SkippingRealtimeSession_UploadEtlFilesOnly",
        "TransitionName",
        "2/292Z2o2",
        "ExitCode",
        "KEYW8",
        ".CRT$XCZ",
        "__TlgCV__",
        "9pTs=",
        "9O0u*",
        ";U<b<o<|<",
        "SampleRate",
        ";R<Y<",
        "deviceclass",
        "CryptReleaseContext",
        "4C5x5",
        "ETWConsumer_SkipEnableProviderGroup",
        "UserTime",
        "processnamesubstring",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\registrykeyfilter.cpp",
        "NewTime",
        "_lastlogontime",
        "SOFTWARE\\Microsoft\\TelemetryClient\\OEMInfo",
        "V0Z1o1<3",
        ":C;Y;",
        "text file busy",
        "Metadata_LastPowerSourceChangeTime",
        "CreateEventW",
        "Realtime",
        "3/4a4",
        "MappedPagesWriteCount",
        "3B4[4l4",
        "HasValue",
        "2$2,242<2D2L2T2\\2d2l2t2",
        "Microsoft Enhanced RSA and AES Cryptographic Provider",
        ";7u53",
        "7;7t:",
        "QQSVWh",
        "_complete",
        "8+858@8\\8b8g8",
        ":=;Q;",
        "CryptStringToBinaryA",
        "CryptGenRandom",
        "ETWConsumer_SkippingShutdownLogger_NotAuthorized",
        "=(=0=8=@=P=X=|=",
        "u&90u\"",
        "??0exception@@QAE@XZ",
        "CorporateSQMURL",
        "%DiagtrackStorageRoot%\\LocalTraceStore\\",
        "mergewithalwaysontrace",
        "Y9SLwur",
        "action",
        "?'?2?B?K?]?",
        "<)=I=q=",
        "K32GetPerformanceInfo",
        "u6SPQP",
        "SystemStateManager_ServiceControlPowerEvent",
        "%I64d",
        "5&5/5D5k5",
        "5,666v6",
        ": :8:h:u:",
        "4$4,444<4D4L4T4l4x4",
        "http%s://%s/%s",
        "InfoStream_EscalationFailed_0",
        "address_family_not_supported",
        "s$9>w +>",
        ":7:O:`:",
        "3 363e3",
        "protocol not supported",
        "InfoStream_QueryMsaUserTicketFailed_0",
        "8{tVV",
        "GetSecurityDescriptorOwner",
        ">$>,>4>P>`>l>",
        "NormalTimer",
        "_snwscanf_s",
        "UnicodeStringArrayField",
        "WinHttpWriteData",
        "6<6k6",
        "9k:|:",
        "5$5,545<5H5h5p5x5",
        ".text$yd",
        "tLj\\Xj",
        ";s`t+",
        "0N0s0",
        "8$8,848<8D8T8l8t8",
        "VirtualSize",
        "rsingletriggerpropertyfilter",
        "9 9@9H9P9\\9|9",
        "<!-- Copyright (c) Microsoft Corporation -->",
        "HasStrongId",
        ".CRT$XIAA",
        ">+?K?k?",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\lastpowersourcechangetimemetadata.cpp",
        "ProviderDefinition",
        "not_a_socket",
        "787O7",
        "9wDsC",
        "414G4L4j4s4",
        ";&;S;",
        "EventDroppedThrottled",
        ".?AVlogic_error@std@@",
        ";k<u<",
        "> >$>(>,>0>4>8><>P>T>X>\\>`>d>",
        "2$2<2H2P2p2x2",
        "3(303t3",
        "CertVerifyCertificateChainPolicy",
        "8<8L8X8x8",
        "TriggerLatency",
        "12675",
        "UpdateProcThreadAttribute",
        "TestEvent_TestEvent",
        "s(9>w$+>",
        "393q3~3",
        "8D9Q9",
        "8C9~9",
        "system",
        ":=:L:",
        "DeleteFileW",
        "RecoveredBytes",
        "WinHttpGetIEProxyConfigForCurrentUser",
        "5/6s6",
        "SessionCreateTime",
        "        </requestedPrivileges>",
        "UniqueProcessId",
        "^9t$8s",
        "j\\Zf9TA",
        "8+8V8^8",
        "000=0V0}0",
        "7O8l8v8",
        "7 7T7f7v7",
        "0)1L1l1",
        "2\"2?2\\2y2",
        "A\\;A`u",
        "<9=?=K=e=t=",
        "PageSize",
        "2>2o2",
        "8(828;8",
        "9/9D9Y9m9",
        " -wait ",
        " -dumpfile ",
        "diagtracktempdir",
        "wnfExplicitScopeType=",
        "tracepriority",
        "PQj;Z",
        "y!WhH",
        "QueryServiceStatus",
        "domain",
        "PPh (",
        ".?AV<lambda_4a7d1dc04e43149fa168f2dca9659fcc>@@",
        "<(=k=",
        "?terminate@@YAXXZ",
        ";h;u;",
        "fileName",
        "??0exception@@QAE@ABV0@@Z",
        "RegCloseKey",
        "9m9v9|9",
        ">8>T>d>p>x>",
        "__DEPRECATED_InfoStream_FailedToDeleteEscalationDirectory_0",
        ">'?r?",
        "LastDownloadTime",
        "BufferSizeKb",
        "FilterLength",
        "AsimovUploader_RealtimeUploadSucceeded",
        "QueryNumber",
        "Watchlist size too large. Size: %d, Persistence: %d",
        "typeid",
        "213[3b3o3",
        "30383D3d3l3x3",
        ";P(u6;p,u1",
        "IoOtherOperationCount",
        "0;w$u",
        "QPtJh(e",
        "LsaLookupUserAccountType",
        "FreeSystemPtes",
        "CurrentFailureReports",
        "LastQueryFiletime",
        "hive=",
        "142;2W2^2",
        "GetThreadPriority",
        ">e?z?",
        "PrivatePageCount",
        ": :\\:c:z:",
        "IsEscalationInProgress",
        "PSQVWj\\h",
        "3.4=4K4d4",
        "UTCRBES3",
        "0Z0x0",
        "function not supported",
        "20151030165758Z0v0<",
        "SettingsPendingExpirationMinutes",
        "level",
        ";8r%3",
        "?:?^?f?",
        "8&8G8e8u8",
        "GetProcAddress",
        "DiagTrackTestEvent",
        "<\"<T<s<",
        ":n;x;",
        "FindClose",
        "ServiceMain_DllMain_Register",
        "SkipInitialSettingsDownloadDelay",
        "Utils_GetRegistryKey",
        "<#<j<p<y<",
        "? ?@?P?X?|?",
        ";C<y<",
        "041H1p1W2",
        "BooleanField",
        "<*===e=j=o=",
        "no such device",
        "InitializeCriticalSection",
        "5<6X6",
        "6A6h6",
        ":`:t:",
        "valuename",
        "0%191E1Z1m1~1",
        ";h<$=t=",
        "SSSPh",
        ">0>8>T>d>p>",
        "> ?a?",
        "E(SV3",
        "7%9e9",
        "Microsoft Corporation1&0$",
        "TicketExpiryTime",
        "FindNextChangeNotification",
        "Wv#Vh",
        "WWPh0U",
        ".?AV<lambda_27cdd4c5cfe96a776728c9273e6503a4>@@",
        "captureStateLogger=",
        "7c7m7",
        "wpbuildmin",
        "nCipher NTS ESN:4DE9-0C5E-3E091+0)",
        "JsonBuilder - destination must be an array or object",
        "ResetEvent",
        "SkipDeploymentFilters",
        "TEMP8",
        "5!535E5W5i5~5",
        "<+<[<s<",
        "535S5s5",
        "3(3H3P3\\3|3",
        "wlan show d",
        "TraceManager_StartingTrace",
        "CTracer::StartTracing() failed",
        "result out of range",
        "bad allocation",
        "PackageName",
        "OnCostedNetwork",
        "GetFileSize",
        "0$0C0b0w0}0",
        "=->9>I>/?G?",
        ">%>L>]>",
        "ReleaseSRWLockExclusive",
        "HKEY_CURRENT_CONFIG",
        "2 2f2",
        "<7<Q<w<",
        "Persistence",
        "5,5|5",
        "WaitTime",
        "Software\\Microsoft\\Windows NT\\CurrentVersion",
        "TraceEndTime",
        ".CRT$XCU",
        "_stricmp",
        "314t4",
        "Vortex returned non-2XX/non-400 error code. SecondTry: %d",
        "UTC_DB_Corruption",
        "5(575^5",
        "9A;W;~<",
        "=4=D=P=X=x=",
        "D$0SV",
        "=3=@=F=T=Z=a=f=",
        "4K5U5e5",
        "M QRSP",
        ":8:=:U:t:~:",
        "7$7<7H7P7",
        "=\"=-=<=F=a=q=",
        "2,2:2[2~2",
        "InitialUploadDelayMillis",
        "1!2)262<2C2g3m3x3}3",
        "FailureType",
        "EntryPersistence",
        ":C:Z:g:",
        "GetKernelDumpAction",
        "4$4?4X4",
        "TraceManager_StoppingTrace",
        "6U6a6",
        "ExpectedSequenceNumber",
        "CurrentPathIndex",
        "616A6c6",
        "__DEPRECATED_InfoStream_ParsingScenario_0",
        "TriggerTime",
        ":X:w:",
        "\"rej\":",
        "C(Ph ",
        "Copied file: ",
        "metadata_elements",
        "<A<r<",
        "5,6V6g6z6",
        "9$9X9h9t9|9",
        ":-;G;M;V;t;",
        "7A7d7",
        "External",
        "t,;:u",
        "<G<t<",
        ":^:y:",
        "0k0z0",
        "9CHsn",
        "pdelayms",
        ";?;d;",
        "CanCollectAnyTelemetry",
        "InfoStream_ExceededMaxSetupDurationMs_0",
        "too many files open in system",
        "base\\diagnosis\\diagtrack\\common\\parsingerrorinfo.cpp",
        ";0<F<X<",
        "not a socket",
        "PWShpY",
        "D$8QP",
        "RunExeWithArgsAction: Failed to create output file",
        ".?AVexception@@",
        "PerfTrackDurationField",
        "=?>s>~>",
        "CoTaskMemFree",
        "?5?w?",
        "838H8]8r8",
        ".data",
        "Content-Encoding",
        "XmlLite.dll",
        ":E:~:",
        "ETWConsumer_EtlProcessingThreadProc_NotAuthorizedToProcessShutdownLoggerETL",
        "6B7f7",
        "?D?{?",
        "LatencyData_0",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\tdhfacade.cpp",
        "StringFromGUID2",
        "CommitPeak",
        "7(7S7X7h7",
        "/enum all",
        "686E6U6g6p6",
        "0O0}0",
        "t$$WW",
        ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:",
        ">&?k?w?",
        "wpvermin",
        "sQSVj",
        "CreateThreadpoolTimer",
        " Windows",
        ">&?|?",
        "D$TSV",
        "8-898R8]8v8~8",
        ">\">;>A>",
        "?.?N?n?",
        "5#5,5",
        "?]?i?",
        "DemandZeroCount",
        "VortexFailuresTimeout",
        "GUIDField",
        ">*>J>s>",
        "0.0F0X0]0",
        "GetKernelDumpAction: ",
        "001t1",
        "IsSatisfied",
        "wnfExplicitScopeString=",
        "T$,SP",
        "RingBuffer_EventAddedSuccessfully",
        "8^pthh2U",
        "StopTraceAction",
        "GetProcessDumpAction: ",
        "WorkingSetPrivateSize",
        "RunExeWithArgsAction: ",
        "TDH_ANSISTRING",
        "Metadata_IsAcOn",
        "CcTotalDirtyPages",
        "_isacon",
        "RegDeleteValueW",
        "1!2I2j2s2",
        "trigger",
        "<n/a>",
        "=H>h>",
        "MinimumRefreshIntervalMinutes",
        "base\\diagnosis\\diagtrack\\include\\Utils.h",
        "valueType=",
        "windowRangeMillis=",
        "PartAExt_",
        "=]>m>{>",
        "*31612+85cef474-af76-4076-90ff-a35e1e23d7de0",
        "wcsncmp",
        "ClockType",
        "Scenario has an invalid filter.",
        "wsdgsc",
        "<,<:<]<k<",
        "t;hdZ",
        "ScenarioDef_FailedToCreateEscalationAction",
        "EtwTraceMessage",
        "connection refused",
        "666J6",
        "6B6t6",
        "InfoStream_AlternativeTraceStarted_0",
        "string too long",
        "SysprepGeneralize",
        "VortexHttpFailures5xx",
        "3;7tV",
        ";/;M;V;n;",
        "<$<,<D<P<p<x<",
        "skipscenariocompletionreporting",
        "PagedPoolPages",
        "maxcompletionreports",
        "SkipAllMsaCaching",
        "S-1-5-21-",
        "L$D_^",
        "HybridLatencySwapMillis",
        "InfoStream_AOTStarted_0",
        "NormalUploadCount",
        "blddt",
        "scenario",
        "PPPWS",
        "9Q tP9Q$tK",
        "0<0D0L0T0\\0d0l0x0",
        "CommandLine",
        "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7",
        "base\\diagnosis\\diagtrack\\matchengine\\iasimovevent.cpp",
        "StartTraceAction",
        "WinHttpOpen",
        "uint64",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\getkerneldumpaction.cpp",
        "sC9>w?+>",
        "3q4!5",
        "HeartBeat_5",
        "D$$QP",
        "4 4(444T4`4h4",
        "?<?`?u?",
        "t9h !",
        "798L8[8",
        "SnapTraceAction: ",
        "GetSystemPowerStatus",
        "9h:w:",
        "D$,VPhh",
        "CreateFileMappingW",
        "StartedNewAot",
        "MetadataFactory_CreateMetadata",
        "0\"070E0o0",
        "MaxFileSize",
        "Normal",
        "PQVSWj+",
        "MachineId",
        ";G<h<",
        "NonPagedPoolAllocs",
        "7`8k8",
        "owner dead",
        "CompletionEscalationCount",
        "SkipCurrentElementAndDescendants: ",
        "QQQQQ",
        "t9hp ",
        "D$$8X8tz",
        "0 1Y1",
        "1K1Z1h1",
        "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ",
        "OnBatterySaver",
        ":):I:[:l:",
        "8;8[8E9b9",
        "J0j0x0",
        "Sleep",
        "ExpandedKeyName",
        "ResponseText",
        "/sleepstudy",
        ":)<W<",
        "RegEnumValueW",
        "Utils_UrlEscapeStringSucceeded",
        "<1=@=",
        "=M>S>h>",
        "t3h\\Q",
        "DiskCounters.FlushOperationCount",
        "alternativeTraceStopTime",
        "L$ h0C",
        "SKUInfo",
        "< <0<L<\\<h<",
        "?os=windows",
        "TDH_NULL",
        "GetCurrentProcessId",
        "Escalation for scenario couldn't run because the AoT was stopped due to memory constraints.",
        "%DiagtrackRegistryRoot%\\TelemetryNamespaces",
        "<description>Diagnostics Tracking Service</description>",
        "596M6",
        "ETWConsumer_ProcessTrace",
        ">4>:>L>",
        ";$<L<s<*=R=y=",
        "MOPR1301",
        ">A>j>w>",
        "3r4y4",
        "4 4(4H4P4l4|4",
        "%temp%",
        "DiagTrack Extension DLL: ",
        ":-:A:",
        ";\";2;G;",
        "ETWConsumer_SkippingShutdownLogger_UploadEtlFilesOnly",
        "6\"6'6?6D6Z6",
        "F0f0k0{0",
        "L$ 9^",
        "filename_too_long",
        "TargetAppVer",
        "BatteryThresholdExceeded",
        "TerminateJobObject",
        "9=9y9",
        "MaxFailureEscalations",
        "Rich&",
        "7T7a7z7",
        "7/8O8T8",
        "base\\diagnosis\\diagtrack\\include\\RegistryBasedMetadata.h",
        "_lastsuccessfulrefreshtime",
        "InheritedFromUniqueProcessId",
        "address_in_use",
        "RegisterServiceCtrlHandlerExW",
        "ConfigurationClient.dll",
        ";,;8;X;d;",
        "file too large",
        "<0<;<",
        ".idata$4",
        "=3>v>",
        "http://www.w3.org/2005/07/scxml",
        ":C:P:^:c:",
        "5'565H5W5f5u5",
        "wlan show I",
        ";9;a;",
        "353U3u3",
        " rtSV",
        ">,>8>D>P>\\>r>~>",
        "EventSubStoreReset",
        "AOT snapped successfully",
        "D$|Pj@Z",
        "scenarioid",
        ":$ETLUNIQUECVDATA",
        "BackoffIndex",
        "w<WhP?",
        "ngetwnfstateaction",
        "7-767K7r7",
        "1#2i2",
        "< <0<8<T<\\<d<p<",
        "ServiceMain",
        "8G8^8",
        "ptdurationfield",
        "AssignProcessToJobObject",
        "<'=t=B?",
        ":<:D:P:X:|:",
        "%ProgramData%\\Microsoft\\Diagnosis",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\etwconsumer.cpp",
        "9^9u9",
        "<C=f=x=",
        "KERNEL32.DLL",
        "DecodingDroppedProviderCounts_0",
        "permission denied",
        "_lastboottime",
        "InfoStream_AOTUnthrottled_0",
        "CriticalSettingsTimer",
        "_lastdevicearrivalremovaltime",
        "<3=<=a=",
        "161118171528Z0p1",
        ";.;k;",
        "WERLogger_ReportSubmit",
        "QueryPerformanceFrequency",
        "?2?f?",
        "6f9T^",
        "8-8Q8",
        "> ><>D>L>X>`>",
        "Complete",
        "RunExeWithArgsAction was cancelled and the exe was terminated. The service is shutting down.",
        "@.didat",
        "Fhj0SP",
        ".CRT$XIA",
        "D$ Ph",
        "D$$PVQ",
        "0K1l1",
        "F$9F s+",
        "TriggerInfo",
        "MSAUserIdentityProvider_SuccessfulCacheHitWithErrorNoRequery_ActionRequiredFreeNetworkUnavailable",
        "<9<L<Z<k<}<",
        "MaxDurationMs",
        "7+8;8L8g8",
        "6D6l7",
        "ServiceMain_DiagTrackSKUInformation",
        "405r6",
        "1'1Q1",
        "TEMPD",
        "ResultMacro_LogError",
        "RingBuffer_HeaderIsInvalid",
        ";>t&S",
        "83999J9i9z9",
        "CategoryDefinition",
        "s69>w2+>S",
        "category",
        "6)6\\6i6",
        "Error",
        "MetadataEngineBufferSize",
        "ResumeThread",
        "111019184142Z",
        "base\\diagnosis\\diagtrack\\engine\\database.cpp",
        "EventDroppedEtw",
        "<'=Q=`=p=",
        "?what@exception@@UBEPBDXZ",
        "already_connected",
        "VirtualFree",
        "=N=p=",
        "property",
        "GetProcessDumpAction: Dumping 32-bit procees failed",
        "KernelProcess",
        "divide",
        "CurrentCompletionReports",
        "FindFirstFileW",
        "TdhFacade_EventSourceProviderLoadedError",
        "1/1=1Q1n1",
        ":D:T:`:h:",
        "=)=7=U=|=",
        "LastInvalidHttpCode",
        "LifetimeManager_EscalationsDisabled",
        ".rdata",
        "7<7D7L7X7x7",
        "D$pSVW",
        "CcCopyReadWait",
        "Int8Field",
        "5-5i5",
        "=9>L>X>m>",
        "OEMOptionalInfoId",
        "1 1,141h1x1",
        ";Q<m<{<",
        ":(<:<",
        "InfoStream_AOTSnapped_0",
        "NormalTimerSnapMillis",
        ";8;?;Y;`;",
        ";J;S;",
        "1$1g1",
        "6 7Z7",
        "WerReportSubmit",
        "System\\CurrentControlSet\\Control\\SystemInformation",
        ".text$di",
        "diagtrack.pdb",
        "CreateProcessAsUserW",
        "170107181737Z0",
        "VVSVhpD",
        "DbCriticalDroppedCount",
        "TDH_DOUBLE",
        "CurrentEscalations",
        "=9=Z=",
        "ngetprocessdumpaction",
        "_wcstoui64",
        "connection already in progress",
        "= >N>",
        "D$XSVW",
        "incompatible version",
        "telemetry.ASM-WindowsDefault.json",
        "PercentageOfAlwaysOnTraceRunning",
        "regKeyValue=",
        "Disabled",
        "MSAUserIdentityProvider_SuccessfulCacheHitNoApiPresent",
        "MSAUserIdentityProvider_SystemSID",
        "<4=H=",
        "ContextSwitches",
        "TdhLoadManifest",
        ":/;c;p;",
        "686@6H6X6`6",
        "0[1{1",
        "DiagTrackTrace",
        "SOFTWARE\\Microsoft\\Internet Explorer",
        "4/595o5",
        "=&>X>",
        "OriginalFilename",
        "6G6m6",
        "_iskerneldebuggerpresent",
        "InfoStream_DatabaseFailed_0",
        "=E>W>",
        "TicketTarget",
        "_CxxThrowException",
        "=6>C>",
        "7'828",
        "5C6t6",
        "2H3p3",
        ">Z?n?",
        "%windir%\\system32\\msinfo32.exe",
        "SetThreadPriority",
        "WasPreempted",
        "greaterthanequal",
        "7\"777L7a7v7",
        "?3?Z?{?",
        "OnBatteryMs",
        "GetUserGeoID",
        "Live kernel dumps are not currently available. This is a placeholder. Enjoy...",
        ":@;~;",
        "WinHttpSetOption",
        ">-?9?",
        "SystemDefault",
        "read only file system",
        "@.reloc",
        "WTSQueryUserToken",
        "LastBootTime",
        ";7ui3",
        "9W9u9",
        "CHttpRequest async operation",
        "Keyword",
        "0base\\diagnosis\\diagtrack\\include\\Transition.h",
        "EnableProperty",
        "LogHr",
        "2Q3x3",
        "545D5c5p5",
        "G0;0r",
        "8L9e9v9",
        "ScenarioManager_AcceptScenario",
        ".?AV<lambda_66e1ce22362f51c17737ce2e429fabac>@@",
        "HKEY_CLASSES_ROOT",
        "*.rbs",
        "3/4A4",
        "RingBuffer_WroteOverflowData",
        "thread",
        "RacSampleNumber",
        "U0S0Q",
        "L$HSj",
        "=6>n>",
        "escapedString",
        ">#>2>",
        "y}Ph`",
        ">\">'>5>",
        "<+<<<M<^<o<",
        "L$d_^[3",
        "L$0PhXB",
        "'0Q0b0p0",
        ">Q>a>h>",
        "</scenario></scenarios>",
        "CcFastMdlReadResourceMiss",
        "getkerneldumpaction",
        "Checked",
        "%windir%\\system32\\dispdiag.exe",
        ";/<i<",
        "=$=0=P=X=`=h=p=x=",
        "ConnectivityHeartBeat_0",
        "SysprepGeneralizeMain",
        "0 0<0U0p0w0",
        "Alternative trace preempted successfully",
        "uint32",
        "<n<~<",
        "connection_reset",
        "_callnewh",
        "https://vortex-win.data.microsoft.com/collect/v1",
        "94:H:^:",
        "8!9*;",
        "Alternative trace in registry started successfully",
        "9CRIMu6",
        "CBuildStringMetadata_Query",
        "0=1V1l1=2",
        "CryptGetHashParam",
        "2J4q4z4",
        "operation_not_supported",
        "D$,QP",
        "616>6",
        "PagedPoolFrees",
        "Process32NextW",
        "444\\4}4",
        "MatchEngineBufferSize",
        "545<5D5P5p5x5",
        "DiagTrackAlternativeLogger",
        "3&4C4",
        "HKEY_PERFORMANCE_NLSTEXT",
        "GetRegKeyAction: ",
        "4!5<5A5h5m5~5",
        "LastEventSizeOffender",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\toggletracewithcustomfilteraction.cpp",
        "PrefilterThreshold",
        "`021j1",
        "PRAID",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "9F:}=",
        "%04d-%02d-%02dT%02d:%02d:%02d.%07dZ",
        "0a1u1",
        "CreateXmlWriter",
        "848E8R8",
        "ReleaseType",
        "Failed to process ETW trace",
        "InitializeConditionVariable",
        "InfoStream_InitializeTracer_0",
        "SiteCode",
        "operation",
        "COUNT(",
        "InfoStream_ProcessCreationFailed_0",
        ";(<:<f<",
        "8+9]9",
        "FailureCount",
        "EventLostEtwSession",
        "EnterNextElement: ",
        "FD;FHu+",
        "8-8d8k8",
        "=N>^>y>",
        "MultiByteToWideChar",
        "1,1q1w1",
        "616A6X6e6}6",
        "FlushViewOfFile",
        "RevertToSelf",
        "1)1C1X1",
        "5 5(505<5\\5d5l5t5",
        "; ;(;4;T;`;",
        "Alternative trace started successfully",
        "2$2,242<2D2L2T2`2",
        "memcmp",
        "BIOSVersion",
        "AuthorizationInfo_Startup",
        "triggercriterion",
        "ImageTimeDateStamp",
        "4\"404m4w4",
        "Microsoft Time-Stamp PCA 20100",
        "IsContinuumActive",
        "pSnapAlwaysOnTraceAction: ",
        "base\\diagnosis\\diagtrack\\engine\\triggerbuffer.cpp",
        "> >*>E>O>m>",
        "diagtrack_win.dll",
        "TDH_UINT64",
        "1$1,141<1H1h1p1x1",
        "base\\diagnosis\\diagtrack\\include\\MemoryMappedStream.h",
        "CreateJobObjectW",
        "Query values failed: 0x",
        "traceProfile=",
        "CcLazyWriteIos",
        "CloseThreadpool",
        ">(?,?0?4?8?<?@?D?H?L?P?T?X?\\?`?d?h?l?p?t?x?|?",
        "CanPerformScripting",
        "<4=J=",
        "X-AuthMsaDeviceTicket",
        "TDH_SYSTEMTIME",
        "\\DiagTrackOutput.cab",
        "DiagtrackRegistryRoot",
        "RingBuffer_DropNormalEventDueToCriticalOverflowMode",
        "7/8Q8l8z8",
        "7(707T7d7l7t7|7",
        "GetProcessDump failed to write mini dump",
        "444O4m4",
        "TraceProfileHash",
        "656r618S8c8",
        "QuotaPeakPagedPoolUsage",
        "tolerancems",
        ">I>S>g>q>",
        "2)252Q2t2",
        "ScenarioName",
        ".idata$2",
        "8(8D8T8`8",
        "processId = ",
        ";$;4;@;`;l;",
        "message size",
        "3=3W3^3u3",
        "base\\diagnosis\\diagtrack\\matchengine\\scenariostatemodel.cpp",
        "3,4o4",
        "TebBase",
        "9D$4w",
        "SVWj2^",
        "D$89\\$Ls",
        "X-AuthXToken",
        "REG_EXPAND_SZ",
        "8U9e9",
        "REG_MULTI_SZ",
        "FlushTimer",
        "=W>a>",
        "1B1i1",
        "465p5}5",
        "EditionID",
        "2 2T2d2p2",
        "UseMsFlushTimer",
        "FXSPh",
        "api-ms-win-eventing-tdh-l1-1-0.dll",
        "alternativeTracePath",
        "747D7P7X7x7",
        ">8>H>P>t>",
        "argument list too long",
        "ErrorValue",
        "^[\"]?%temp%[\"]?\\\\.+[.]cab[\"]?$",
        "WPRCDisableBuiltinProfiles",
        "3_3f3",
        "0F0y0",
        "LeaveCriticalSection",
        "ServiceMain_Disabled",
        "TDH_FLOAT",
        "D$0QP",
        "4C5e5q5",
        "identifyingInfo",
        "rand_s",
        "5(5D5T5`5",
        "TimeStampInterval",
        "5+5J5i5",
        "ImageName",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\werloggerphone.cpp",
        "D$TVPh",
        "Validator Error: Unable to load error string to decode error.",
        "PagefileUsage",
        "month",
        "D$xSVWj",
        "Alternative trace snapped successfully",
        "161R1i1|1",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\getprocessdumpaction.cpp",
        "SequenceNumberEligibleToBeErased",
        "222S2",
        "Attribute: ",
        "\"Microsoft Time Source Master Clock0",
        "ProductVersion",
        "~(_^]",
        "ScenarioManager_InvalidScenario",
        "<FailedLookup>",
        "8W8`8",
        "ScenarioManager_LoadingScenarioFileStart",
        "WinHttpConnect",
        "SOFTWARE\\Policies\\Microsoft\\SQMClient\\Windows",
        "JsonBuilder - cchName too large",
        "%s-%s",
        "t$dWW",
        "VWj0P",
        "wcsnlen",
        "9;9l9",
        "PeakWorkingSetSize",
        "Gp;GxsL",
        "1U2{2",
        "1?1R1i1}1",
        ">7>n>",
        "traceprofile",
        "PWWWj",
        "VirtualAlloc",
        "4 4.4@4W4",
        "WinHttpSetCredentials",
        "8#898_8",
        "InfoStream_DownloadOneSettingsNamespace_0",
        "systemonly",
        "PagedPoolAllocs",
        ":D:U:d:y:",
        "9 :;:",
        "<?xml version=\"1.0\" encoding=\"UTF-8\"?><scenarios>",
        "alternativeTraceIsAutoLogger",
        "FDPhT",
        "5U5Z5",
        "base\\diagnosis\\diagtrack\\include\\SettingsDownloader.h",
        "Process32FirstW",
        "1$1D1",
        "mintimebetweencompletionescalationsms",
        "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9",
        "WSSPS",
        "D$\\SPj",
        "6\"6C6T6}6",
        "t.;9u",
        "0+0T0Y0k0",
        "Result",
        "5N6a6",
        "_wtof",
        "ConnectivityRestrictedNetworkTime",
        "CcMdlReadNoWait",
        "UnregisterWaitEx",
        "list<T> too long",
        "4M4{4",
        "MSAUserIdentityProvider_NoCacheHitAfterPopulate",
        "6q7v7",
        "categoryid",
        "SnapTraceAction",
        "=%=6=\\=g=",
        "NtStatus",
        "base\\diagnosis\\diagtrack\\matchengine\\asimovsyntheticevent.cpp",
        "CcPinMappedDataCount",
        "?4?@?V?p?",
        "?RRSPQWR",
        "D$tVPhD",
        "CloseThreadpoolTimer",
        ">U>_>",
        "VS_VERSION_INFO",
        "7+8u8",
        "too many files open",
        "TDH_INT32",
        "RealtimeEventUploadTimer",
        "TDH_COUNTEDANSISTRING",
        "7(747<7p7",
        "LocalAlloc",
        "9(909P9X9t9",
        "9,:<:H:P:p:",
        "OutputDebugStringW",
        "nradaraction",
        "ScenarioId",
        "activity",
        "6$6,686X6d6",
        "OLEAUT32.dll",
        "provider",
        "ImageChecksum",
        "interrupted",
        "REG_DWORD",
        "bad address",
        "0;{`u",
        "O0M0K",
        "&ms=1",
        "realloc",
        "HardFaultCount",
        "0O1T1f1",
        "7:8h8",
        "HKEY_CURRENT_USER",
        "FreeResource",
        "_isescalationinprogress",
        "copycab",
        "SystemStateManager_ServiceControlTimeChange",
        "?4?@?`?l?",
        "twSSh",
        "Failed to update settings",
        "application/x-json-stream; charset=utf-8",
        "NonPagedPoolLookasideHits",
        "C(j0j",
        "KernelTime",
        "6(6H6P6X6`6l6",
        "InfoStream_WatchListExceededWarningSize_0",
        ";=;B;H;a;g;",
        "MatchEngine_ScenarioCompleted",
        "L$89^",
        "%DiagtrackRegistryRoot%\\TraceManager",
        "identifier removed",
        "%DiagtrackStorageRoot%\\ETLLogs\\AutoLogger",
        "Default",
        "s0*1:1",
        "s#9>w",
        "PVj@hD;",
        "6!7'767k7w7",
        "ScenarioDef_FailedToCreateTrigger",
        "6+6?6c6",
        "FixedUIntArrayField",
        "5-5T5",
        "5(505d5t5",
        "InfoStream_ExeTerminated_0",
        "base\\diagnosis\\diagtrack\\engine\\setupworkitem.cpp",
        "8>8_8",
        "<!</<g<{<",
        ";D;e;n;",
        "SkipUploadOnNoBackoffPercentage",
        "171C1M1^1d1i1n1u1}1",
        ";,;=;N;",
        "9*989=9s9}9",
        "TelClientSynthetic.__metadata",
        "??3@YAXPAX@Z",
        "1(2=2S2p2",
        "Level",
        "7L7U7e7}7",
        "IsFromTestHook",
        "_wcsdup",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        "3'383",
        "%DiagtrackRegistryRoot%\\TestHooks",
        "WerRegisterMemoryBlock",
        "5:6j6",
        "8;9x9",
        "tw;x`t5hx",
        "<5=U=",
        "5g5|5",
        "6\"626a6~6",
        "O:S-1-5-80-2620808479-2171380039-3191355562-2070425692-3097948119D:(A;;GA;;;S-1-5-80-2620808479-2171380039-3191355562-2070425692-3097948119)(A;;GA;;;BA)",
        "EnableTraceEx2",
        "no such device or address",
        "5#5f5|5",
        "base\\diagnosis\\diagtrack\\engine\\scenariomanager.cpp",
        "=;=R=*>K>b>",
        ":I;l;",
        "2(202@2\\2l2x2",
        "3!3{3",
        "C(j0VP",
        "nsetregkeyaction",
        "1B1r1",
        "~Tu2A",
        "Cache-Control",
        "AsimovUploader_PersistEvent",
        ":#:8:_:",
        "XML written to file: ",
        "9,9W9\\9t9",
        "5V5}5",
        "ptscenarioname",
        "MetadataEngine_EventThreadWaitFailed",
        "9CHrC",
        "F$+F ",
        "GetModuleFileNameA",
        "PackageFullName",
        "SHLWAPI.dll",
        ";$;,;4;<;D;\\;h;",
        "ResetEventStore",
        "%windir%\\system32\\wscollect.exe",
        "TDH_INT8",
        "D2|f#",
        "GetWNFStateAction",
        "TotalSize",
        "bad_file_descriptor",
        "protocol error",
        "state",
        "dLastHeartBeatTime",
        "matchbehavior",
        "CommitLimit",
        "base\\diagnosis\\diagtrack\\engine\\scenariocachelru.cpp",
        "0,0B0",
        "REG_LINK",
        "GetSystemDirectoryW",
        "99:L:",
        "8-8N8",
        ".rsrc$01",
        "5L5\\5h5",
        "1$1,141<1D1L1T1\\1d1l1t1|1",
        "3(30383D3L3d3t3|3",
        "Start",
        "Length",
        "Metadata_LastSuccessfulRefreshTime",
        "?(?:?L?i?",
        "StopTraceAction: ",
        "5\"5w5",
        "5*5W5{5",
        "kernel_dump.dmp",
        "Reserved2",
        "_unlock",
        "6 6(6\\6l6x6",
        ":3:L:e:{:",
        "C`+C\\j0",
        ";=<]<",
        "; Tolerance (ms): ",
        "MaxCompletionReports",
        ":';4;I;",
        ";base\\diagnosis\\diagtrack\\engine\\escalationengine.cpp",
        ".?AVout_of_range@std@@",
        "3U3i3}3",
        "4<4H4P4",
        "DecodingDroppedCount",
        "0;w`u",
        "RefreshInterval",
        "=&=6=G=U=g=",
        "6&6;6P6e6x6",
        "2 202@2P2`2p2",
        "EscalationWorkItem_CopyOutputDirectoryPath",
        "FXPh ",
        "!0A0v0",
        "RedirectedRegistryRoot",
        "UTCReplace_",
        ".rsrc$02",
        "D$ 9^",
        "D$PQP",
        "595S5x5",
        "SOFTWARE\\Microsoft\\SQMClient\\Windows",
        "&sku=",
        "GetLastError",
        "memcpy_s",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\telemetryprotocolfilter.cpp",
        "4.4B4I4N4`4",
        "RealTimeTimerSnapMillis",
        "%I64u",
        "SOFTWARE\\Microsoft\\TelemetryClient",
        "OpenSCManagerW",
        "GetTempFileNameW",
        "PPPQV",
        "6>8S8",
        "Escalation Type: ",
        "commandLine=",
        ":+:V:w:",
        "wrong protocol type",
        "Unable to open manifest string: %s.",
        "pointer",
        "ServiceMain_DllMain_Unregister",
        "MetaDataTypeName",
        "CommandLineHash",
        "InFlightScenario_AddMatchedTrigger",
        "2>2h2q2",
        "SvchostPushServiceGlobals",
        "ServiceMain_ServiceMain",
        "282Z2j2",
        "324o4",
        "2*202I2S2(3F3",
        "/srumutil",
        "maxcompletionescalations",
        "3G3S3b3}3",
        "9CPr,h",
        "4\\4e4",
        "2[2i2",
        "    processorArchitecture=\"x86\"",
        "7*7M7\\7j7",
        ">+?U?d?t?",
        "2!3z3",
        "ConsumerDroppedProviderCounts_0",
        "=)>>>",
        "8H$tj",
        ";#;D;",
        "ETWConsumer_StopTrace",
        "6!7/7S7|7",
        "4$4,444<4D4L4T4\\4d4l4t4|4",
        "CriticalOverflowEntersCounter",
        "SOFTWARE\\Microsoft\\SQMClient\\Windows\\CommonDatapoints",
        "invalid vector<T> subscript",
        "_fail",
        "5 5$5(5,5 6$6@6`6",
        "ntdll.dll",
        "Setup for scenario timed out during final action. Current runtime: %d ms. Maximum allowed runtime: %d ms.",
        "97:}:",
        "__DEPRECATED_InfoStream_ToggleTraceStarted_0",
        "flags",
        "GetNativeSystemInfo",
        "0+1:1H1k1u1",
        "connection reset",
        "CryptDestroyHash",
        "8K9m9|9",
        "UTC_Storage_Error.err",
        ":K;_;v;",
        ";c;3<",
        "-report",
        "FilterFactory_CreateFilter",
        "SubmitThreadpoolWork",
        "1^1g1z1",
        "8+8v8",
        "4-4e4",
        "_amsg_exit",
        "879]9",
        "__DEPRECATED_InfoStream_DownloadedTelemetryManifest_0",
        "TickCountSinceLastWakeup",
        "969c9",
        "7'7H7W7e7",
        "snapalwaysontraceaction",
        "7)7m7%8K8h8",
        "numeric",
        ">Y>s>z>",
        ">\"?P?p?",
        "%hs(%d) tid(%x) %08X %ws",
        "9/9?9S9s9",
        "TDH_UINT8",
        "6X8j8",
        "alternativeTracePriority",
        "telemetryprotocolfilter",
        "9@9P9\\9d9",
        "osver",
        "ScenarioInstanceId",
        "B ;B$w",
        "3/3F3S3k3",
        "_wf9~",
        "RegNotifyChangeKeyValue",
        "stream end",
        ">->8>Q>`>w>",
        "4*5U5}5",
        "676O6`6}6",
        "producerMap",
        "RingPersistence",
        "6L6}6",
        "CanCollectHeartbeats",
        "G@9w@r",
        "Microsoft",
        "D$$9t$8s",
        "D$4VPh",
        "0V1r1",
        ";7uT3",
        "FailFast",
        "G,+G(",
        "8-9_9",
        "__DEPRECATED_InfoStream_NewVersionOldTimestamp_0",
        "alwaysontrace.etl",
        "<4=_=h=",
        "ProducerThrottleTimer",
        "MaxCompletionEscalations",
        "^[\"]?%temp%[\"]?\\\\.*[..|\\\\].*[.]cab[\"]?$",
        "6S6l6",
        "ThreadCount",
        "9 9$9(9,90949",
        "UnhandledExceptionFilter",
        "0@0J0h0",
        "2+2F2",
        "__dllonexit",
        "L$ Qj",
        "Metadata_IsEscalationInProgress",
        "$!|$$",
        "9O9h9",
        "10433",
        "4&4@4",
        "7M8z8",
        "isSetupAction=",
        "SetupCount",
        "TdhGetEventInformation",
        "aotIsAutoLogger",
        "SequenceNumberToErase",
        "4$5C5Y5",
        "Partner: '%s', Feature: '%s', Parameters: '%s', ClientETag: '%s', ServerETag: '%s', Changed: '%d'",
        "\\scenario_data.xml",
        "NtQuerySystemInformation",
        "LastConnectivityHeartBeatTime",
        "8<8L8f8",
        "536u6",
        "=$=4=@=`=h=x=",
        "7,737>7W7^7i7",
        "Failed to open process: access denied",
        "Internal",
        "InstanceId",
        "advapi32",
        "889i9",
        "9U9}9",
        "IdentityString",
        "SetRegKeyAction: module not supported",
        "CompletedTime",
        "2@3O3U3^3t3",
        "7F8_8p8",
        "tracePriority=",
        "CRYPT32.dll",
        "{11D8A17B-F2D8-4733-B41B-6F4959ACD701}",
        "6!7_7",
        "Flight settings broker returned an empty ring name",
        "invalid string position",
        "[ERROR:BadSidLength=%u]",
        ":$:E:R:",
        "Metadata_LastUnlockTime",
        "; <.<4<=<I<",
        "__DEPRECATED_InfoStream_NoSuchProperty_0",
        ".didat$2",
        "MBI_SSL",
        "WWhHm",
        "1.131?1J1g1",
        "9X9a9",
        "LastAOTAttemptedTime",
        "Failure",
        "ScenarioDef_FailedToCreateFilter",
        "CcMdlReadWait",
        "=N>f>",
        "W9F(u.PPVh $",
        "InfoStream_VortexErrorResponse_0",
        "$040@0H0",
        "%DiagtrackStorageRoot%\\Sideload",
        "X-Shed-Non-Critical",
        "expression",
        "SetupWorkItem_ExecutedAction",
        "s\\;s`tG",
        "VVPh0U",
        "DisableThreadLibraryCalls",
        "4<4c4",
        "ImpersonateSelf",
        "InfoStream_StartTracing_0",
        "< <@<H<P<X<`<h<t<|<",
        "endpoint.",
        "BytesUsed",
        "? ?,?4?T?p?",
        "Producer",
        "operation in progress",
        "GetRegKeyAction",
        "UTCCaptureV1",
        "TelemetryProtocolFilter",
        "hresult",
        "MatchEngine_Start",
        "3&333I3",
        "4P5^5",
        "=U=[=q=w=",
        "CertGetCertificateChain",
        "0.1_1",
        ";<;L;X;x;",
        "InfoStream_SaveTrace_0",
        "6E6T6b6",
        "%DiagtrackRegistryRoot%",
        ":&;_;",
        ">5?<?m?y?",
        "4$4,444<4D4L4T4\\4h4",
        "triggername",
        "SystemTimeField",
        "EventDroppedDecoding",
        "1 2-2V2",
        "L$4_^[3",
        "8>:\\:",
        "5@5P5\\5d5",
        "DestinationPath",
        "6,7\\7",
        ")Microsoft Root Certificate Authority 20100",
        "ScenarioManager_InvalidScenarioFileName",
        "RunExeWithArgsAction",
        "gTreatDeviceAsXbox",
        "Microsoft.Windows.Mobile.Shell.Chrome",
        "8&9u9",
        "7W7z7",
        "TraceManager_SnappingTrace",
        "deviceClass",
        "AcquireSRWLockExclusive",
        "100701213655Z",
        "LastBootTimeMetadata_Update",
        "F,+F(",
        "PowerMonitor.BatteryConsumptionThreshold",
        "WaitForSingleObject",
        "4&4G4Y4",
        "cross device link",
        "7,757W7t7",
        "_t#f;U",
        "EventDroppedConsumer",
        "keyname",
        "base\\diagnosis\\diagtrack\\matchengine\\asimovuploader.cpp",
        "WERLogger_AddFileToCAB",
        "pidExpansionString=",
        "4%5M5m5",
        "Gd+Gh=",
        "RingBuffer_RecoveredDataFromDirtyShutdown",
        "?U?p?",
        "PdcNetworkActivation_Deactivate",
        "servicestatusfilter",
        "bad function call",
        ">0?o?",
        "FindNextFileW",
        ":&;,;1;\\;b;g;",
        "8$8,888X8`8h8t8",
        "appId",
        "#0-0:0G0",
        "hexint64",
        "3j=hl",
        "UpdateID",
        "5,6>6L6",
        "\\$4htl",
        "WerReportCreate",
        "LastPowerSourceChangeTimeMetadata_Update",
        "generic",
        "PdcNetworkActivation_2",
        "Failed to stop AutoLogger ETW tracing session (before starting a fresh session)",
        "7\"7t7",
        "alternativeTraceScenarioId",
        "ServiceMain_FinishedInitialize",
        "7$70787\\7d7l7t7|7",
        "ThreadId",
        "RaiseException",
        "=o={=",
        "<,<S<",
        "D$0SVWj",
        "Action: ",
        "626Y6",
        "SetEnvironmentVariableW",
        "Desktop",
        "536>6",
        ":8:_:l:",
        "NoNetworkTime",
        "DirtyPagesWriteCount",
        "TDH_POINTER",
        ";4;D;P;X;",
        "IsContinuumSessionActive",
        "DeleteProcThreadAttributeList",
        "8:9|9",
        "8:8J8O8U8Z8q8}8",
        "242R2a2o2",
        "8_8l8",
        ":&;4;Z;",
        ":$:D:L:T:`:",
        "base\\diagnosis\\diagtrack\\engine\\escalationworkitem.cpp",
        ".temp",
        ":::s:",
        "InputPath",
        "C\\;C`t",
        "ImageFileName",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\getmemoryinfoaction.cpp",
        "2!2N2h2$3",
        "EscalationsDisabled",
        "SinkStateOrdinal",
        "MaxBackoffAttempts",
        "InfoStream_SetupFailed_0",
        "D$<PQh",
        "tE9=P",
        "WriteTransferCount",
        "loggername",
        "= =,=L=X=`=",
        "MakeSelfRelativeSD",
        "Always on trace snapped and saved",
        ";$;0;<;H;T;`;l;p;t;x;|;",
        "EventsUploaded",
        "7.7{7",
        "systemtime",
        "Setup for scenario timed out. Current runtime: %d ms. Maximum allowed runtime: %d ms.",
        "wnfBufferType=",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\dualpropertyfilter.cpp",
        "DiagTrackFeatureSet",
        "CcFastMdlReadWait",
        "ParameterFileName",
        "4 4,4M4Y4l4",
        "8_9t9",
        "ForceRunAOT",
        "TriggersCount",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\snapalwaysontraceaction.cpp",
        "9K9h9",
        ">8>@>L>T>t>",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "D$ Pj",
        "_wcsicmp",
        "3,4q4",
        "HRESULT",
        "ControlTraceW",
        "=$=C=z=",
        "8<8I8",
        "QQSV3",
        "9(9c9",
        "5,585@5t5",
        "<triggerless transition>",
        "MatchEngine_ManifestUpdatePruneScenarioList",
        "0?0E1",
        "<6<E<",
        "7(8<8g8w8",
        ".idata",
        "GetFileAttributesW",
        "6G7s7",
        "GetFileAction",
        "7d7z7",
        "<&<?<K<U<n<",
        "Microsoft Windows Diagnostics Tracking",
        "6+7M7",
        ".?AV<lambda_4b39a284fa6767344177318546fa00b7>@@",
        "no space on device",
        "[%hs(%hs)]",
        "4@4{4",
        "Unactionable scenario (no reports or escalations remain).",
        "2U3b3",
        "=7=F=T=",
        "RingBufferPersistence",
        "?\"?(?9?J?X?f?v?",
        "LastConnectivityLossTime",
        "network_reset",
        "map/set<T> too long",
        "1$1:1J1f1",
        "Global\\UTCUploaderStatsSharedMemory",
        "ScenarioManager_ExpireTraces",
        "MaxFailureReports",
        "= =@=H=P=\\=|=",
        "t$HQP",
        "address in use",
        "505:5Q5",
        "E(SVW",
        "LastPersistedEventTimeOrFirstBoot",
        ">8>V>",
        "2?3R3a3",
        "Scenario has an invalid filter. Filter is: %s.",
        "0123456789ABCDEF",
        "OpenTraceW",
        "6*7D7M7",
        "Alternative trace was not present in manifest and was stopped successfully",
        "Spare",
        "PartA_iKey",
        ".didat$5",
        "9!9j9",
        "4*444D4[4h4}4",
        "SkipScenarioExpiration",
        "<Y=`=",
        "9$9,949<9D9L9T9\\9d9l9t9|9",
        "261019185142Z0",
        "CryptCreateHash",
        "3.363J3O3g3n3s3",
        "InfoStream_End_0",
        "<(<0<<<\\<d<l<t<|<",
        "12728",
        "3<3c3z3",
        "<Z=h=",
        "040D0n0",
        "FindResourceExW",
        "__DEPRECATED_InfoStream_ConditionalTimerWakeup_0",
        "queryToken.c_str()",
        "3L3R3[3h3n3y3~3",
        "ReadFile",
        "; ;@;`;",
        "CacheReadCount",
        ":2:A:Q:^:",
        "USER32.dll",
        "selectioncriteria",
        "Y9SLr;w",
        ">\">A>P>k>q>",
        "Failed to open ETW trace",
        ":/:@:Q:b:u:",
        "|$TVPQ",
        "4+4D4[4",
        "uploadcab",
        "ExitCurrentElement: ",
        "506x6",
        "inappropriate io control operation",
        "SetWaitableTimerEx",
        "invalid seek",
        ">$>@>P>\\>d>",
        "EscalationWorkItem_CopyOutputDirectoryAlreadyExists",
        "2!3^3",
        "D$lPh0",
        "Failed to enable ETW provider: %s",
        " ver=",
        "broken pipe",
        "4&5o5",
        "saveToLocalStore=",
        "baseType",
        "Failed device ticket query.",
        "; <0<<<D<x<",
        "ResponseHeaders",
        "202L2",
        ":1;c;",
        "InfoStream_Invalid_0",
        "506@6L6l6x6",
        "888@8\\8l8x8",
        "_wcstoi64",
        "<D<\\<r<",
        "Escalation for scenario timed out during final action. Current runtime: %llu ms. Maximum allowed runtime: %llu ms. Escalation type: %d",
        "win:Info",
        "bldbrch",
        ":(:.:7:C:f:",
        "^.*add.*$",
        ".?AV<lambda_6de91a272242170ce849664aa35b61d0>@@",
        ".?AV<lambda_39f00223ff3c8705e1ddca3e525df1ee>@@",
        "6e7t7",
        "<'<><N<",
        "8FLTR",
        "89;t%",
        "GetTickCount64",
        "FpPhH",
        "5%505=5Y5d5q5",
        "ActionName",
        "AsimovUploader_DeviceTicketExpired",
        ":%;n;",
        "value too large",
        ";w`t&",
        "=8=T=X=d=",
        "RunExeWithArgsAction: CreateProcess failed",
        "UrlEscapeW",
        "?Z?g?",
        "SampleNumber",
        "<!<1<A<Q<V<`<q<",
        "JsonBuilder - cannot erase end()",
        "4A4Z4g4",
        "=V=k=",
        "(K/V: ",
        "LoadStringW",
        "?+?:?H?P?_?m?",
        "8CTRT",
        "EventCount",
        "FileTimeToSystemTime",
        "1-1F1n1",
        "9!9-999E9Q9]9",
        "CanReportScenarios",
        "t7j X",
        "$SVRh",
        "6$6,646<6D6L6T6\\6d6l6t6|6",
        "12674",
        "7!8e8",
        ";&<G=",
        "IsKernelDebuggerPresentMetadata_Query",
        "towupper",
        "324>4L4",
        "DiagTrackSpew",
        "1%1A1J1b1f1u1",
        "Query value failed: 0x",
        "CreateToolhelp32Snapshot",
        "i*j@P",
        "ThreadState",
        "ras diagnostics set rastracing * enabled",
        "KERNEL32.dll",
        "Severity",
        "0 000@0P0`0p0",
        "TelemetrySampleNumber",
        ";\";:;H;",
        "__DEPRECATED_InfoStream_SideloadedManifestEnumerationFailed_0",
        "error",
        "LastPowerSourceChangeTime",
        "GetBuildSignature",
        "Signature",
        "MSFTInternal",
        "CcMdlReadNoWaitMiss",
        ">-?7?D?W?f?",
        "4$525?5[5g5~5",
        "10.0.10586.0",
        "1c1w1",
        "; ;,;4;h;x;",
        "WINHTTP.dll",
        "CopyFileW",
        "8'9_9",
        "no buffer space",
        "G(9G$u",
        "UInt8Field",
        "SetEvent",
        "3B3p3",
        ":%;/;>;D;U;",
        "WatchlistThrottleThreshold",
        "CreateEnvironmentBlock",
        "IsACOn",
        "base\\diagnosis\\diagtrack\\common\\xmlfacade.cpp",
        "9(9^9",
        "UInt64Field",
        "uISSj",
        "ResidentPagedPoolPage",
        ")Fh)^l_^[",
        "CurrentCompletionEscalations",
        "D$PSVW",
        "2&2A2a2",
        ">;>\\>e>z>",
        "D$hQP",
        ";0;=;q;",
        "invalid map<K, T> key",
        ".rdata$zETW2",
        "Y9~\\t",
        "9^ltG",
        "858`8",
        "svolsz",
        "131]2",
        "QQSVW",
        "ScenarioManager_InitialTraceSetup",
        "1&242I2~2",
        "SettingsBaseUrl",
        "Trigger_MSACouldntPopulate_NoSID",
        "no_buffer_space",
        "ptraceprofilescenarioid",
        "TdhFacade_EventSourceProviderLoaded",
        "containsTolerance=",
        "8*:-;6<L<",
        "StackBase",
        "4,5<5H5P5p5x5",
        "0%0B0",
        "CcCopyReadNoWaitMiss",
        "not running",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\getwnfstateaction.cpp",
        ".text$mn",
        "j\\XQf",
        "%DiagtrackStorageRoot%\\ETLLogs",
        "svcUpdateVersion",
        "UInt16Field",
        "FpPh8",
        "win:Error",
        ";=;n;D<",
        "section",
        "filters",
        "mQkTS!",
        "export-log",
        "no stream resources",
        "RpcStringFreeW",
        "777Z7z7",
        "!Metadata_LastAbnormalShutdownTime",
        "FilterNum",
        "ExpandedString",
        "7/7P7",
        "1(1<1N1d1",
        "Failed to update rules",
        "?$?,?4?<?D?L?T?\\?d?l?t?|?",
        "invalid_argument",
        "D$HSV",
        "processName=",
        "t9hx ",
        "AcquireSRWLockShared",
        "Failed to query DiagTrack status registry key",
        "ETWConsumer_OpenRealTimeTrace",
        "VPSVj",
        "u]!|$$",
        ";>;b;",
        "1#1(1@1E1a1f1",
        "osinsty",
        "VSj?Z",
        "<G<Y<a<g<m<",
        "3B4L4Y4o4",
        "242[2",
        "final",
        "MSAUserIdentityProvider_NoCacheHit",
        "3%3.3C3j3",
        "regex",
        "A 9_d",
        "TargetAppType",
        "898f8",
        "CreateDirectoryW",
        "<!<G<q<",
        "OPCO0",
        "ActionFactory_CreateEscalationAction",
        "6@6Z6",
        "D$tQP",
        "G$;0r",
        "0(000L0\\0h0",
        "MSAUserIdentityProvider_SuccessfulCacheHitWithErrorNoRequery",
        "Timers.",
        "mergeWithAOT=",
        "Timestamp",
        ";>;R;_;",
        "9<9L9X9`9",
        "ScenarioManager_LoadingScenarioFileStop",
        "device",
        "MaxInUseScenarios",
        "4/5\\5",
        "ConnectivityNoNetworkTime",
        "AvailablePages",
        "TEMP4",
        "9<9L9X9`9x9",
        "IsAlternativeExpired",
        "Failed to open process",
        "172O2o2",
        "RPCRT4.dll",
        "srand",
        "?$?0?8?l?|?",
        "custom",
        "GetWNFStateAction_FailedToQueryWNF",
        "Provider",
        "Hardware\\Description\\System\\CentralProcessor\\0",
        "Y9SLrJw",
        "Created directory: ",
        "0,0Y0",
        "operation not supported",
        "s\\;s`t_",
        "_buildstring",
        "Enabled",
        "PreviousTriggerTime",
        "</trustInfo>",
        "network_unreachable",
        "464;4L4q4}4",
        "AsimovEventDumpDirectory",
        "GetCurrentProcess",
        "?0?L?\\?h?p?",
        "ETWConsumer_EndExistingTrace",
        "?8?H?T?\\?",
        "=:=E=n=",
        "not supported",
        "CommitMB",
        "_^[Y]",
        "WerReportAddDump",
        "1(1;1",
        "Content-Type",
        "en-US",
        "baseData",
        "Accept",
        "__BUILDDATE__",
        "SkipDownloadedSettings",
        "TDH_UNICODESTRING",
        "DiagTrackWP",
        "EventName",
        "WinHttpSetStatusCallback",
        "Microsoft Windows0",
        "Unknown",
        "\\events",
        "ScenarioManager_UpdateNormalSettingsTimer",
        "3$3,343<3L3X3`3",
        "9>9W9c9|9",
        "CertFreeCertificateChain",
        "StartedNewAoT",
        "0,080X0`0l0t0",
        "1@1P1\\1|1",
        "InfoStream_StopTracing_0",
        "G<)_h)_d)_T",
        "ScenarioDuration",
        "4)4=4Z4g4",
        "base\\diagnosis\\diagtrack\\main\\extensionmanager.cpp",
        ">!>&>0>A>F>P>a>q>",
        "><>^>p>",
        "InfoStream_AcceptingScenario_0",
        "Couldn't expand identity string. State model does not have matching trigger.",
        "CcReadAheadIos",
        "Microsoft.Windows.DiagTrack",
        "1(1@1R1r1",
        "CryptAcquireContextW",
        "partner",
        "6-7O7",
        "strict",
        "?$?>?K?e?",
        "ConnectivityHeartBeatInterval",
        "TotalSystemDriverPages",
        "4.4W4n4",
        "REG_BINARY",
        " Operating System",
        "1X1i1",
        "Query key failed: 0x",
        "base\\diagnosis\\diagtrack\\matchengine\\asimovsharedpartastate.cpp",
        "no protocol option",
        ";-;3;@;V;",
        ";<=d=",
        "maxinflightinstances",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "_initterm",
        "262<2I2z2",
        "FixedUnicodeStringArrayField",
        "LastPowerSourceChanceTimeMetadata_Query",
        "3(3P3^3z3",
        "SVWj@",
        "base\\diagnosis\\diagtrack\\include\\samplingnumber.hpp",
        "8(8S8X8h8",
        "not_connected",
        "RingBuffer_EnteringCriticalOverflowMode",
        ".?AVbad_function_call@std@@",
        "base\\diagnosis\\diagtrack\\engine\\connectivityheartbeat.cpp",
        ";$;,;4;<;D;P;p;|;",
        "SystemManufacturer",
        "X[_^]",
        ":';A;g;",
        "t$0QP",
        "3K5p5",
        ":D:Z:",
        "expectedtoexist",
        ";L;V;",
        " -handle ",
        "RunExeWithArgsAction_ProcessExitCode",
        "too_many_files_open",
        "0%080L0",
        "849{9",
        "s7+1W",
        "SetLastError",
        "strnlen",
        "<]<o<~<",
        "585w5",
        "<{=;>f>",
        "8::E:",
        "<,<<<H<h<t<",
        "MaxInUseScenarioCounter",
        "t9h0U",
        "CanPerformDiagnosticEscalations",
        "CcFastMdlReadNoWait",
        "ETWConsumer_DisableProvider",
        "ETWConsumer_SkippingRealtimeSession_NotAuthorized",
        "miniDumpType=",
        "int32",
        "oK0D$\"<",
        "_lock",
        "2:3C3i3",
        "RealtimeTimer",
        "CallContext:[%hs] ",
        "__DEPRECATED_InfoStream_WPRInstantiationFailed_0",
        "pregkeyquery",
        "D$|VPhP",
        "6#7S7",
        ":,:v:",
        "TraceManager_ConfiguringExpirationTimer",
        ";<;H;h;p;x;",
        "5/5=5[5i5",
        "DataType",
        "?$?0?8?X?t?",
        "PSWhTi",
        "001<1H1T1i1z1",
        "-LoadAndRunDiagScript \"%temp%\\RoamDiagLogs\"",
        "=P=`=y=",
        "2#3;3",
        "RingLatency",
        "CycleTime",
        "dv!QPh o",
        "0!0i0s0",
        "4'4:4v4",
        "3&4G4|4",
        "6E7m7v8",
        "Failed to disable ETW provider: %s",
        "ScenarioManager_FailedToReadParseStateFile",
        "_lastapplicationinstalltime",
        "z.9Wv",
        "%d.%d.%s",
        "5 5$5(5,5054585<5@5D5H5L5P5T5X5",
        "AsimovBufferDumpDirectory",
        "=:>i>",
        "768@8[8",
        "string",
        "1+2F2Y2`2i2",
        "9):V:",
        "677f7",
        "%DiagtrackStorageRoot%\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl",
        "ProcessStarted",
        "Accept-Encoding",
        "Trace profile needs more memory than the total system budget",
        "r2f;E",
        ".?AV<lambda_4b97697121bdbd291d9cfc1a834d1d55>@@",
        "1Q1p1",
        "8G$t^",
        "9 9@9L9T9t9|9",
        "1$1q1",
        "wnfinfo.xml",
        "%windir%\\system32\\logman.exe",
        "PQRj+",
        "8#8:8",
        "ScenarioMetadata",
        "notregex",
        "vector<bool> too long",
        ".?AVResultException@wil@@",
        "ScenarioManager_RejectScenario",
        "UploadWindowMillis",
        "feature",
        "3$3W3]3n3",
        "sourceString",
        "InFlightScenario_InSinkState",
        "psavedtrace_",
        "Escalation for scenario succeeded. Escalation type: %s",
        "timed_out",
        "t+;~(t",
        "3*30363G3L3Q3Z3t3",
        ";K;Z;h;",
        "GetProcessDumpAction: CreateProcess failed",
        "4,4L4u4",
        "Vj@^Vj",
        "8+838",
        "RingBuffer_TriedToEraseAnIncorrectSequenceNumber",
        "u$WSQ",
        "tdh.dll",
        "171l1",
        "InfoStream_AoTNotRunning_0",
        "ImpersonateLoggedOnUser",
        "VortexHttpFailures4xx",
        "L$(GW",
        "1<1f1",
        "InfoStream_ProducerThrottled_0",
        "UUUUV",
        "address family not supported",
        "TimerName",
        "><>H>P>",
        "yL_^]",
        "4!565E5X5",
        "InvalidHttpCodes",
        "GroupDefinition.",
        "0%0@0",
        "onfailure",
        ":d;~;",
        "f92tZ",
        "8?8l8",
        "C,+C(",
        "TDH_INT64",
        "\\Windows.Uif.xml",
        "FilterData",
        "SkipSoftLandingRuleSignatureValidation",
        "GetProcessName successful",
        "0M1a1",
        ".rdata$zETW9",
        "809|9",
        "<,<R<",
        "9N:~:",
        "D$,GWPS",
        "OriginalString",
        "base\\diagnosis\\diagtrack\\matchengine\\matchengine.cpp",
        "=7=N=w=",
        "UseAlphaWatson",
        "geoid",
        "2\"3E3b3",
        "6-7U7|7",
        "MetadataEngine_StartRegistryThread",
        "PPPSW",
        "syspro",
        "%windir%\\system32\\tracelog.exe",
        "NtSetInformationThread",
        "invalid map/set<T> iterator",
        "Authorization: MsaToken ",
        "3'3-3B3",
        "?0?8?@?H?T?t?|?",
        "state not recoverable",
        ">&?R?\\?r?",
        ":\";a;",
        "TdhFacade_ProviderUnloaded",
        "j.Xf9",
        "    <security>",
        "PicRetrieveFileInfo",
        "Alternative trace exceeded duration and was stopped successfully",
        "NtSetInformationFile",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\fileinfofilter.cpp",
        "2/2J2Y2",
        "Zf;OT",
        "FeatureSetType",
        "2E3b3",
        "TraceManager_SkipConfiguringExpirationTimer",
        "5]6v6",
        "TlP0X",
        "LastTelSettingsRingId",
        "%windir%\\system32\\settingsynchost.exe",
        "connection_already_in_progress",
        "FilterRepresentation",
        "StartTraceW",
        "AppIdMetadata_HasAccountPrefix_PrefixUnknownType",
        "8?8i8",
        "GetWNFStateAction_NotEnoughTypes",
        "3 3,343h3x3",
        "Priority",
        "no child process",
        "MSAUserIdentityProvider_SkippingCacheDueToTestHook",
        "Utils_UrlEscapeStringFailed",
        "InfoStream_Dumping32bitProcessFailed_0",
        "index",
        "7(7p7",
        "9>9b9",
        "2#232S2k2",
        "747l7",
        "io error",
        "7;8A8m8",
        "CreateTime",
        "exename",
        "CanCollectCoreTelemetry",
        "3$343@3H3|3",
        "607@7L7T7t7",
        "AlwaysOnTraceRefreshDurationSec",
        "!Metadata_IsContinuumSessionActive",
        ":WWWj",
        "base\\diagnosis\\diagtrack\\matchengine\\state.cpp",
        ")sh){l",
        "WEVT_TEMPLATE",
        "EventWrite",
        "4)464h4",
        ">A?N?",
        "fileinfofilter",
        "base\\diagnosis\\diagtrack\\matchengine\\ringbuffer.cpp",
        "PhaseShiftTimer",
        "8 8(8H8P8l8|8",
        "7'727?7S7Y7d7q7",
        "ToggleTraceAction: ",
        "Gdf+Gh",
        "RunExeWithArgsAction was cancelled and the exe was terminated. The executable took too long.",
        ".rdata$sxdata",
        "RADARAction",
        "899d9i9",
        ";;;W;k;",
        "PWSjH",
        "2 2.2=2^2n2v2~2",
        "CurrentType",
        "t$0PQ",
        ".?AU?$default_delete@VCScenarioStateModel@Diagnostics@Microsoft@@@std@@",
        "4:5]5",
        "wcscpy_s",
        "=*>W>",
        "DiagTrack Release Type: ",
        "LockResource",
        "484Z4j4",
        "flightid",
        "stream error",
        "TimeToAotExpirationSec",
        "RemoveDirectoryW",
        "5/6;6",
        "272E2f2",
        "3 3(30383D3L3d3l3t3",
        "GetSystemTimeAsFileTime",
        "memset",
        "RingBufferEventStore_FlushingPreCompressBuffers",
        ">P>`>l>",
        "RegistryKeyFilter",
        "Failed to copy file due to sharing violation: ",
        "PhysicalAvailable",
        "BinaryField",
        "protocol_not_supported",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\servicestatusfilter.cpp",
        "base\\diagnosis\\diagtrack\\common\\threadprivilegemanager.cpp",
        "GetTickCount",
        "<#===Z=",
        ":C:{:",
        "LastBootTimeMetadata_Query",
        "CoInitializeEx",
        "ras diagnostics set rastracing * disabled",
        "wpvermaj",
        "operation canceled",
        "?/?M?a?g?",
        "DTSQMLogger_SQMSingleInfoStreamRow",
        "_lastunlocktime",
        "=&>S>",
        "444D4P4t4|4",
        "<$<,<4<<<D<L<T<\\<d<l<t<|<",
        "5\"5C5V5",
        "=Y=`=",
        "=$=,=L=T=\\=d=",
        "5F6M6^6p6",
        ">3>O>",
        "Global\\DiagTrackActiveEvent",
        "LocalFree",
        "permission_denied",
        "ResidentSystemCachePage",
        ">C>N>",
        "1!1>1M1Z1",
        "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4",
        "40474e4",
        "StackLimit",
        "GetKernelDump action executed but not implemented.",
        "TDH_GUID",
        "8 8@8L8l8t8",
        "<0<8<D<L<l<t<|<",
        "%DiagtrackStorageRoot%\\DownloadedSettings",
        "BlackBoxTraceEventsCapacity",
        "pSkipSoftLandingScenariosCheck",
        "filetime",
        "ProductName",
        "scxml",
        "9N,ukj",
        "1.1<1",
        "8S9Y9`9h9",
        "CancelReportCount",
        "91wDB",
        "WakeConditionVariable",
        ";6<H<O<[<y<",
        "4R4`4",
        "HeartBeatTimer",
        "pschemaversion",
        "_timestamp",
        "no link",
        "v$ShdT",
        ";$;d;q;",
        ":Y:|:",
        "G(;0r",
        "processIdExpansionString=",
        "2Q2Y2",
        "ToggleTraceWithCustomFilterAction_FailedToPassCustomFilter",
        "2%262L2*3u3",
        "CHANp",
        "384L4",
        "uploadAsHexString=",
        "8F8K8",
        "ueVVW",
        "666@6I6k6z6",
        "12736",
        "DiagTrack Feature Set: ",
        "_except_handler4_common",
        "5)5E5",
        "8/9O9o9",
        "6 6(6D6T6`6h6",
        "InfoStream_FilterInvalid_0",
        "base\\diagnosis\\diagtrack\\engine\\werloggerbase.cpp",
        "EventSubStoreResetSizeSum",
        "TraceMerge_Default",
        "%windir%\\system32\\licensingdiag.exe",
        "target",
        "8%808T8q8|8",
        ".defl",
        "DiskCounters.BytesWritten",
        "opcode",
        "9Fht@",
        "base\\diagnosis\\diagtrack\\engine\\settingsmanager.cpp",
        "o\\\\?\\GLOBALROOT",
        "CreateStreamOnHGlobal",
        "4;4G4",
        "ToggleTraceAction",
        "IdleProcessTime",
        "__DEPRECATED_InfoStream_CannotPreempt_0",
        "L$<_^3",
        ";!>b>",
        "8U9p9",
        "?;?K?f?|?",
        "4$4D4L4T4`4",
        "969a9j9",
        "SOFTWARE\\Policies\\Microsoft\\SQMClient",
        "9O:t:",
        "878W8w8",
        "PowerSetting",
        "Utils_CreateRegistryKeyFailed",
        "_wtoi",
        "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6",
        "3\"3R3_3",
        "2L2\\2h2p2",
        "6 6@6H6T6t6|6",
        "uVSSh",
        "operation would block",
        "setup",
        "QuotaPeakNonPagedPoolUsage",
        "IsContinuumSessionActiveMetadata_Update",
        "9&969=9",
        "ResidentSystemDriverPage",
        "wnfhex",
        "base\\diagnosis\\diagtrack\\engine\\trigger.cpp",
        ";7u0S",
        "2-2<2b2p2",
        "808L8\\8h8p8",
        "GetSecurityDescriptorGroup",
        "3 3@3H3d3t3",
        "8<8H8h8p8x8",
        "5-5M5R5",
        ";,<<<H<P<p<x<",
        "iever",
        "not a directory",
        "_finite",
        "GetSecurityDescriptorDacl",
        "6N6v6",
        "MaxReports",
        "GetFileAction: ",
        "EventVersion",
        "%programfiles%\\internet explorer\\iediagcmd.exe",
        "10.0.10586.0 (th2_release.151029-1700)",
        "8TTBL",
        "%Microsoft Windows Production PCA 20110",
        "insufficient memory",
        "9D$8w",
        "2 2,2L2X2|2",
        "EnableLevel",
        "BCryptGenRandom",
        "1+1L1j1",
        "ScenarioManager_LoadingScenariosStart",
        "< <(<0<8<D<L<l<t<|<",
        "WPRCCreateInstanceUnderInstanceName",
        "second",
        "WTSGetActiveConsoleSessionId",
        "888j8w8",
        "8KEYW",
        "SetServiceStatus",
        "processid",
        "MatchEngine_ProcessEvent",
        "8C9I9T9i9y9",
        "Key queried successfully",
        "7 7,747h7x7",
        "464F4Z4h4",
        "(D:COUNT(",
        "*.new",
        "s-9>w)+>",
        "GetFileAction succeeded",
        "Metadata_LastBootTime",
        "Fbase\\diagnosis\\diagtrack\\include\\FileWrapStream.h",
        "device or resource busy",
        " Microsoft Corporation. All rights reserved.",
        ">5>S>`>",
        "base\\diagnosis\\diagtrack\\matchengine\\asimovconstanteventbuffer.cpp",
        "t7h0U",
        "9sPr>h",
        "SHCreateStreamOnFileW",
        "4D4U4",
        "p_pid",
        ">(>/>4>?>Q>Y>d>|>",
        "UnicodeStringField",
        "AnsiStringField",
        "EventSubStoreResetCounter",
        "deviceid",
        "process",
        "pdiagtrack_action_output",
        "IsTest",
        "7 7D7L7T7\\7d7l7t7|7",
        "!This program cannot be run in DOS mode.",
        "< <@<`<",
        "3*3n3y3",
        "0.0g0",
        "diagscenario",
        "RegDeleteTreeW",
        "delayaction",
        "%04d/%02d/%02d:%02d:%02d:%02d",
        "PWWWWWWW",
        "X-UploadTime",
        "GetExitCodeProcess",
        "D$4SP",
        "FindFirstChangeNotificationW",
        "=(=I=X=t=",
        "7i8s8",
        "9L9U9e9}9",
        "7!7_7j7",
        "=4=V=l=",
        "presult",
        "0 0@0L0l0t0",
        ">/?K?",
        "=,=B=",
        "Identifier",
        "CcPinReadNoWait",
        "5\"6v6",
        "5<6u6",
        "SSSVh",
        "=2=B=i=",
        "dword64",
        "L$tCS",
        "epoch",
        "ReadTransferCount",
        "9T:4;v;",
        "host_unreachable",
        "m_eventNameWithoutProvider.c_str()",
        "111L1R1k1p1v1",
        "base\\diagnosis\\diagtrack\\extension\\lib\\coreexternal\\stoptraceaction.cpp",
        "TelClientSynthetic.__model",
        "registryfilter",
        "9K0t@9K8t;9K<t6",
        "GetProcessDumpAction",
        "97u/W3",
        "6*6b6",
        "windows",
        "181V1",
        "api-ms-win-security-lsalookup-l1-1-2.dll",
        "OpenThreadToken",
        "GetProductInfo",
        "getregkeyaction",
        "131l1",
        "AvailablePagedPoolPages",
        "Reason",
        "MoveFileW",
        "ConvertSidToStringSidW",
        ">)?[?",
        "CloseHandle",
        "Setup for scenario failed.",
        "D$xQP",
        "7$7;8y8",
        "=1>U>[>h>~>",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Diagnostics\\DiagTrack",
        "9$9,9`9p9|9",
        "=Q>V>",
        "465k5",
        "0$0)0",
        "5u6|6",
        "011;1R1a1",
        "ScenarioDef_FailedToCreateSetupAction",
        "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0",
        "&sampleId=",
        "SkipSoftLandingScenarios",
        "8MAPS",
        "ScenarioFailed_0",
        "ServiceMain_FinishedStopCallback",
        "4!474I4[4k4",
        "CEIPEnable",
        "WriteFile",
        "ProcessId",
        "90:j:",
        "print",
        "SourcePath",
        "_start",
        "> >(>0>8>@>L>l>t>",
        "FailingCode",
        "7t8 9v9):",
        ":#:1:6:_:i:w:|:",
        ", but 'ignorefailure' was specified. Continuing.",
        "AsimovUploader_UploadEventBuffer",
        "<!<[<j<x<",
        "UserMessage",
        "KeywordsAny",
        "=$=,=D=T=\\=x=",
        "2\"2A2L2T2Y2^2u2",
        "InfoStream_FlightSettingsBroker_0",
        "s@9>w<+>S",
        "filter",
        "6-6_6",
        ".?AV<lambda_f487b4271e5fa927956ddaf5f271a1e9>@@",
        "DelayLoadFailureHook",
        "2?2N2",
        ".data$r",
        "WaitForMultipleObjects",
        "4>4W4",
        "FileVersion",
        "NoForceCopyOutputDirAcl",
        "https://vortex-win.data.microsoft.com",
        "session",
        ";,;4;<;L;T;\\;d;l;t;|;",
        "HexInt32Field",
        "expectedtoberunning",
        ".rdata$zzzdbg",
        "QueryTraceW",
        "telemetry",
        "csdbld",
        ";F;d;",
        "ExpandEnvironmentStringsForUserW",
        "appliesto",
        "WaitReason",
        "2n2w2",
        "StopTraceW",
        "3(3L3T3\\3d3l3t3|3",
        "3$3^3",
        "3 404i4",
        "5+6:6H6",
        "_appid",
        "SVWj(",
        "2-2>2",
        "</assembly>",
        "QueryToken",
        "3h3v3",
        "5E5L5n5u5",
        "Modern",
        "1$1D1L1h1x1",
        "UploaderDroppedCount",
        "CreateThread",
        "[MicrosoftTelemetry]"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "84360b9e3abc337e64acc72daa81a4a889726556ec7527ca3ef2274d41aefa7d",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/84360b9e3abc337e64acc72daa81a4a889726556ec7527ca3ef2274d41aefa7d",
              "guest_paths": [
                "overlay"
              ],
              "size": 8544,
              "crc32": "E6719742",
              "md5": "d202461bf04e6f793d342431eab27acf",
              "sha1": "b8269f22b25ab270e0f8386ee691311852154375",
              "sha256": "84360b9e3abc337e64acc72daa81a4a889726556ec7527ca3ef2274d41aefa7d",
              "sha512": "b0a4d07fbd40f6cea3e30742536c51ef028f879e71c250c4642f2b3c530fd8275f791cbe3cc34130d82602cf49de594e13ec3de5933f13877191798bcc97519a",
              "rh_hash": null,
              "ssdeep": "192:ulWt8RDBQABJBP/Vqnaj2Zl7R9ZUFh2m:ulRDBRJBHVlSRzKh2m",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T19E023CD29B789483DE46BC505398EA873C3D53C35C2091A609FEFAD51CD73C6AB08A6D",
              "sha3_384": "d254ad6bf1176428d590341ccc911a21f8d84e13bb7d1825c31f323ec40079394aa0ef45c7abbfab9e1f2d2955d7441a",
              "data": null
            }
          ],
          "extracted_files_time": 0.0005071999985375442,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "wdscore.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/65467bf1fbf10c2a399fe532b780f3604fda5b00db8319787cb6867bede4b90e",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\wdscore.dll"
      ],
      "size": 201528,
      "crc32": "ABCA4F6A",
      "md5": "07f3fac5518c90b22dfb9778ea280d0a",
      "sha1": "6d20ff953a0c5aabc1970e80a5f96aedd830db9b",
      "sha256": "65467bf1fbf10c2a399fe532b780f3604fda5b00db8319787cb6867bede4b90e",
      "sha512": "f86447c3dd0ad11022b208ba04c7b62cddf57b1035f4b1e18aae3e6764b6dce53fbeaa68cb5ce3ab75ba08293474dc18e9a3f5ce6df43a01701abd9180e07ace",
      "rh_hash": null,
      "ssdeep": "6144:yZ3oXN1cvpP/YeJvuBLqAOAWgERCGwDlyxfb2g/4S/IAiN85McisT:KXvSLqAOAWgERCNI6g/4giN8KXsT",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T126145A11F185E47DDA7B3130B63BEA3264BDB5644F6682CB72548F9E38641C0DB392E2",
      "sha3_384": "0064fa53f3e6e704a32ecaad4236e4bdef2e3060d702b62df74a949717c49d516e63498fa1865d2ae0d27b79b134add9",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x00028140",
        "ep_bytes": "8bff558bec837d0c017505e875080000",
        "peid_signatures": null,
        "reported_checksum": "0x000405e3",
        "actual_checksum": "0x000405e3",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "wdscore.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x1002e270",
                "name": "_callnewh"
              },
              {
                "address": "0x1002e274",
                "name": "feof"
              },
              {
                "address": "0x1002e278",
                "name": "fgetws"
              },
              {
                "address": "0x1002e27c",
                "name": "_wfopen"
              },
              {
                "address": "0x1002e280",
                "name": "wcstok_s"
              },
              {
                "address": "0x1002e284",
                "name": "swscanf_s"
              },
              {
                "address": "0x1002e288",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x1002e28c",
                "name": "_lock"
              },
              {
                "address": "0x1002e290",
                "name": "_unlock"
              },
              {
                "address": "0x1002e294",
                "name": "__dllonexit"
              },
              {
                "address": "0x1002e298",
                "name": "_onexit"
              },
              {
                "address": "0x1002e29c",
                "name": "_XcptFilter"
              },
              {
                "address": "0x1002e2a0",
                "name": "_amsg_exit"
              },
              {
                "address": "0x1002e2a4",
                "name": "fclose"
              },
              {
                "address": "0x1002e2a8",
                "name": "_initterm"
              },
              {
                "address": "0x1002e2ac",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x1002e2b0",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x1002e2b4",
                "name": "memcpy"
              },
              {
                "address": "0x1002e2b8",
                "name": "_ftol2"
              },
              {
                "address": "0x1002e2bc",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x1002e2c0",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x1002e2c4",
                "name": "memmove"
              },
              {
                "address": "0x1002e2c8",
                "name": "iswctype"
              },
              {
                "address": "0x1002e2cc",
                "name": "toupper"
              },
              {
                "address": "0x1002e2d0",
                "name": "malloc"
              },
              {
                "address": "0x1002e2d4",
                "name": "memmove_s"
              },
              {
                "address": "0x1002e2d8",
                "name": "free"
              },
              {
                "address": "0x1002e2dc",
                "name": "_wcslwr_s"
              },
              {
                "address": "0x1002e2e0",
                "name": "memcpy_s"
              },
              {
                "address": "0x1002e2e4",
                "name": "calloc"
              },
              {
                "address": "0x1002e2e8",
                "name": "strrchr"
              },
              {
                "address": "0x1002e2ec",
                "name": "towlower"
              },
              {
                "address": "0x1002e2f0",
                "name": "wcschr"
              },
              {
                "address": "0x1002e2f4",
                "name": "_wcslwr"
              },
              {
                "address": "0x1002e2f8",
                "name": "_purecall"
              },
              {
                "address": "0x1002e2fc",
                "name": "_vsnprintf"
              },
              {
                "address": "0x1002e300",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x1002e304",
                "name": "wcsrchr"
              },
              {
                "address": "0x1002e308",
                "name": "wcsncmp"
              },
              {
                "address": "0x1002e30c",
                "name": "_wtoi"
              },
              {
                "address": "0x1002e310",
                "name": "_wcsicmp"
              },
              {
                "address": "0x1002e314",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x1002e318",
                "name": "memset"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x1002e000",
                "name": "EventWriteTransfer"
              },
              {
                "address": "0x1002e004",
                "name": "EventRegister"
              },
              {
                "address": "0x1002e008",
                "name": "EventProviderEnabled"
              },
              {
                "address": "0x1002e00c",
                "name": "EventUnregister"
              },
              {
                "address": "0x1002e010",
                "name": "SetSecurityDescriptorDacl"
              },
              {
                "address": "0x1002e014",
                "name": "EqualSid"
              },
              {
                "address": "0x1002e018",
                "name": "OpenProcessToken"
              },
              {
                "address": "0x1002e01c",
                "name": "InitializeSecurityDescriptor"
              },
              {
                "address": "0x1002e020",
                "name": "InitializeAcl"
              },
              {
                "address": "0x1002e024",
                "name": "GetLengthSid"
              },
              {
                "address": "0x1002e028",
                "name": "AddAccessAllowedAce"
              },
              {
                "address": "0x1002e02c",
                "name": "OpenThreadToken"
              },
              {
                "address": "0x1002e030",
                "name": "GetTokenInformation"
              },
              {
                "address": "0x1002e034",
                "name": "RegOpenKeyExW"
              },
              {
                "address": "0x1002e038",
                "name": "RegCloseKey"
              },
              {
                "address": "0x1002e03c",
                "name": "AllocateAndInitializeSid"
              },
              {
                "address": "0x1002e040",
                "name": "FreeSid"
              },
              {
                "address": "0x1002e044",
                "name": "CheckTokenMembership"
              },
              {
                "address": "0x1002e048",
                "name": "RegQueryValueExW"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x1002e050",
                "name": "AcquireSRWLockExclusive"
              },
              {
                "address": "0x1002e054",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x1002e058",
                "name": "LocalAlloc"
              },
              {
                "address": "0x1002e05c",
                "name": "GetModuleHandleExW"
              },
              {
                "address": "0x1002e060",
                "name": "CreateFileMappingA"
              },
              {
                "address": "0x1002e064",
                "name": "DeleteFileA"
              },
              {
                "address": "0x1002e068",
                "name": "GetFileSizeEx"
              },
              {
                "address": "0x1002e06c",
                "name": "OutputDebugStringA"
              },
              {
                "address": "0x1002e070",
                "name": "MultiByteToWideChar"
              },
              {
                "address": "0x1002e074",
                "name": "WideCharToMultiByte"
              },
              {
                "address": "0x1002e078",
                "name": "IsDebuggerPresent"
              },
              {
                "address": "0x1002e07c",
                "name": "HeapSize"
              },
              {
                "address": "0x1002e080",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x1002e084",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x1002e088",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x1002e08c",
                "name": "DeviceIoControl"
              },
              {
                "address": "0x1002e090",
                "name": "HeapValidate"
              },
              {
                "address": "0x1002e094",
                "name": "HeapFree"
              },
              {
                "address": "0x1002e098",
                "name": "SetLastError"
              },
              {
                "address": "0x1002e09c",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x1002e0a0",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x1002e0a4",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x1002e0a8",
                "name": "WaitForMultipleObjectsEx"
              },
              {
                "address": "0x1002e0ac",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x1002e0b0",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x1002e0b4",
                "name": "CreateEventW"
              },
              {
                "address": "0x1002e0b8",
                "name": "Sleep"
              },
              {
                "address": "0x1002e0bc",
                "name": "GetLastError"
              },
              {
                "address": "0x1002e0c0",
                "name": "SetEvent"
              },
              {
                "address": "0x1002e0c4",
                "name": "CloseHandle"
              },
              {
                "address": "0x1002e0c8",
                "name": "CreateThread"
              },
              {
                "address": "0x1002e0cc",
                "name": "ResetEvent"
              },
              {
                "address": "0x1002e0d0",
                "name": "HeapAlloc"
              },
              {
                "address": "0x1002e0d4",
                "name": "GetProcAddress"
              },
              {
                "address": "0x1002e0d8",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x1002e0dc",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x1002e0e0",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x1002e0e4",
                "name": "FreeLibrary"
              },
              {
                "address": "0x1002e0e8",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x1002e0ec",
                "name": "ReadFile"
              },
              {
                "address": "0x1002e0f0",
                "name": "FindFirstFileW"
              },
              {
                "address": "0x1002e0f4",
                "name": "FindNextFileW"
              },
              {
                "address": "0x1002e0f8",
                "name": "WriteFile"
              },
              {
                "address": "0x1002e0fc",
                "name": "RemoveDirectoryW"
              },
              {
                "address": "0x1002e100",
                "name": "SetFilePointer"
              },
              {
                "address": "0x1002e104",
                "name": "FindClose"
              },
              {
                "address": "0x1002e108",
                "name": "CreateFileW"
              },
              {
                "address": "0x1002e10c",
                "name": "DeleteFileW"
              },
              {
                "address": "0x1002e110",
                "name": "GetTempFileNameW"
              },
              {
                "address": "0x1002e114",
                "name": "CreateDirectoryW"
              },
              {
                "address": "0x1002e118",
                "name": "GetModuleFileNameA"
              },
              {
                "address": "0x1002e11c",
                "name": "GetModuleFileNameW"
              },
              {
                "address": "0x1002e120",
                "name": "HeapReAlloc"
              },
              {
                "address": "0x1002e124",
                "name": "DebugBreak"
              },
              {
                "address": "0x1002e128",
                "name": "GetVolumeInformationW"
              },
              {
                "address": "0x1002e12c",
                "name": "GetLogicalDrives"
              },
              {
                "address": "0x1002e130",
                "name": "HeapCreate"
              },
              {
                "address": "0x1002e134",
                "name": "VirtualFree"
              },
              {
                "address": "0x1002e138",
                "name": "GetCommandLineW"
              },
              {
                "address": "0x1002e13c",
                "name": "GetFullPathNameW"
              },
              {
                "address": "0x1002e140",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x1002e144",
                "name": "ExpandEnvironmentStringsW"
              },
              {
                "address": "0x1002e148",
                "name": "GetShortPathNameW"
              },
              {
                "address": "0x1002e14c",
                "name": "GetDiskFreeSpaceW"
              },
              {
                "address": "0x1002e150",
                "name": "VirtualAlloc"
              },
              {
                "address": "0x1002e154",
                "name": "TerminateProcess"
              },
              {
                "address": "0x1002e158",
                "name": "SetFileTime"
              },
              {
                "address": "0x1002e15c",
                "name": "SetErrorMode"
              },
              {
                "address": "0x1002e160",
                "name": "SetEndOfFile"
              },
              {
                "address": "0x1002e164",
                "name": "GetTempPathW"
              },
              {
                "address": "0x1002e168",
                "name": "GetLocaleInfoW"
              },
              {
                "address": "0x1002e16c",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x1002e170",
                "name": "OpenEventW"
              },
              {
                "address": "0x1002e174",
                "name": "GetVersionExW"
              },
              {
                "address": "0x1002e178",
                "name": "GetComputerNameExW"
              },
              {
                "address": "0x1002e17c",
                "name": "HeapWalk"
              },
              {
                "address": "0x1002e180",
                "name": "UnmapViewOfFile"
              },
              {
                "address": "0x1002e184",
                "name": "DuplicateHandle"
              },
              {
                "address": "0x1002e188",
                "name": "GetCurrentThread"
              },
              {
                "address": "0x1002e18c",
                "name": "OpenProcess"
              },
              {
                "address": "0x1002e190",
                "name": "SetFileAttributesW"
              },
              {
                "address": "0x1002e194",
                "name": "GetLogicalDriveStringsW"
              },
              {
                "address": "0x1002e198",
                "name": "GetPrivateProfileStringW"
              },
              {
                "address": "0x1002e19c",
                "name": "GlobalSize"
              },
              {
                "address": "0x1002e1a0",
                "name": "GetDiskFreeSpaceExW"
              },
              {
                "address": "0x1002e1a4",
                "name": "GetVersionExA"
              },
              {
                "address": "0x1002e1a8",
                "name": "GlobalAlloc"
              },
              {
                "address": "0x1002e1ac",
                "name": "GlobalFree"
              },
              {
                "address": "0x1002e1b0",
                "name": "RaiseException"
              },
              {
                "address": "0x1002e1b4",
                "name": "GetSystemInfo"
              },
              {
                "address": "0x1002e1b8",
                "name": "GetOverlappedResult"
              },
              {
                "address": "0x1002e1bc",
                "name": "HeapCompact"
              },
              {
                "address": "0x1002e1c0",
                "name": "HeapDestroy"
              },
              {
                "address": "0x1002e1c4",
                "name": "GetWindowsDirectoryW"
              },
              {
                "address": "0x1002e1c8",
                "name": "GlobalLock"
              },
              {
                "address": "0x1002e1cc",
                "name": "MoveFileExW"
              },
              {
                "address": "0x1002e1d0",
                "name": "GetFileSize"
              },
              {
                "address": "0x1002e1d4",
                "name": "ExitProcess"
              },
              {
                "address": "0x1002e1d8",
                "name": "CreateProcessW"
              },
              {
                "address": "0x1002e1dc",
                "name": "CreateProcessA"
              },
              {
                "address": "0x1002e1e0",
                "name": "GetFileType"
              },
              {
                "address": "0x1002e1e4",
                "name": "GlobalMemoryStatus"
              },
              {
                "address": "0x1002e1e8",
                "name": "CopyFileExW"
              },
              {
                "address": "0x1002e1ec",
                "name": "CreateFileMappingW"
              },
              {
                "address": "0x1002e1f0",
                "name": "MapViewOfFile"
              },
              {
                "address": "0x1002e1f4",
                "name": "GetTickCount"
              },
              {
                "address": "0x1002e1f8",
                "name": "GlobalUnlock"
              },
              {
                "address": "0x1002e1fc",
                "name": "GetDriveTypeW"
              },
              {
                "address": "0x1002e200",
                "name": "GetExitCodeProcess"
              },
              {
                "address": "0x1002e204",
                "name": "CreateMutexW"
              },
              {
                "address": "0x1002e208",
                "name": "ReleaseMutex"
              },
              {
                "address": "0x1002e20c",
                "name": "FlushFileBuffers"
              },
              {
                "address": "0x1002e210",
                "name": "TlsSetValue"
              },
              {
                "address": "0x1002e214",
                "name": "GetEnvironmentVariableW"
              },
              {
                "address": "0x1002e218",
                "name": "FormatMessageW"
              },
              {
                "address": "0x1002e21c",
                "name": "TlsAlloc"
              },
              {
                "address": "0x1002e220",
                "name": "GetWindowsDirectoryA"
              },
              {
                "address": "0x1002e224",
                "name": "GetLocalTime"
              },
              {
                "address": "0x1002e228",
                "name": "LocalFree"
              },
              {
                "address": "0x1002e22c",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x1002e230",
                "name": "TlsGetValue"
              },
              {
                "address": "0x1002e234",
                "name": "TlsFree"
              },
              {
                "address": "0x1002e238",
                "name": "FormatMessageA"
              },
              {
                "address": "0x1002e23c",
                "name": "VirtualQuery"
              },
              {
                "address": "0x1002e240",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x1002e244",
                "name": "SizeofResource"
              },
              {
                "address": "0x1002e248",
                "name": "LockResource"
              },
              {
                "address": "0x1002e24c",
                "name": "FindResourceExW"
              },
              {
                "address": "0x1002e250",
                "name": "LoadResource"
              },
              {
                "address": "0x1002e254",
                "name": "CreateMutexA"
              },
              {
                "address": "0x1002e258",
                "name": "GetVersion"
              },
              {
                "address": "0x1002e25c",
                "name": "CreateFileA"
              }
            ]
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x1002e264",
                "name": "SystemTimeToVariantTime"
              },
              {
                "address": "0x1002e268",
                "name": "VariantTimeToSystemTime"
              }
            ]
          }
        },
        "exported_dll_name": "WDSCORE.dll",
        "exports": [
          {
            "address": "0x1001fca0",
            "name": "ConstructPartialMsgIfA",
            "ordinal": 4
          },
          {
            "address": "0x1001fcd0",
            "name": "ConstructPartialMsgIfW",
            "ordinal": 5
          },
          {
            "address": "0x1001fa90",
            "name": "ConstructPartialMsgVA",
            "ordinal": 6
          },
          {
            "address": "0x1001fb60",
            "name": "ConstructPartialMsgVW",
            "ordinal": 7
          },
          {
            "address": "0x1001cfc0",
            "name": "CurrentIP",
            "ordinal": 8
          },
          {
            "address": "0x1001fdc0",
            "name": "EndMajorTask",
            "ordinal": 9
          },
          {
            "address": "0x1001fe70",
            "name": "EndMinorTask",
            "ordinal": 10
          },
          {
            "address": "0x1001fec0",
            "name": "GetMajorTask",
            "ordinal": 11
          },
          {
            "address": "0x1001ff00",
            "name": "GetMajorTaskA",
            "ordinal": 12
          },
          {
            "address": "0x1001ff40",
            "name": "GetMinorTask",
            "ordinal": 13
          },
          {
            "address": "0x1001ff90",
            "name": "GetMinorTaskA",
            "ordinal": 14
          },
          {
            "address": "0x1001fd00",
            "name": "StartMajorTask",
            "ordinal": 15
          },
          {
            "address": "0x1001fdf0",
            "name": "StartMinorTask",
            "ordinal": 16
          },
          {
            "address": "0x1001bd70",
            "name": "WdsAbortBlackboardItemEnum",
            "ordinal": 17
          },
          {
            "address": "0x10011ab0",
            "name": "WdsAddModule",
            "ordinal": 18
          },
          {
            "address": "0x1001d870",
            "name": "WdsAddUsmtLogStack",
            "ordinal": 19
          },
          {
            "address": "0x10011fd0",
            "name": "WdsAllocCollection",
            "ordinal": 20
          },
          {
            "address": "0x10012480",
            "name": "WdsCollectionAddValue",
            "ordinal": 21
          },
          {
            "address": "0x10012510",
            "name": "WdsCollectionGetValue",
            "ordinal": 22
          },
          {
            "address": "0x1001c580",
            "name": "WdsCopyBlackboardItems",
            "ordinal": 23
          },
          {
            "address": "0x1001c5b0",
            "name": "WdsCopyBlackboardItemsEx",
            "ordinal": 24
          },
          {
            "address": "0x1001b780",
            "name": "WdsCreateBlackboard",
            "ordinal": 25
          },
          {
            "address": "0x1001be30",
            "name": "WdsDeleteBlackboardValue",
            "ordinal": 26
          },
          {
            "address": "0x10011fb0",
            "name": "WdsDeleteEvent",
            "ordinal": 27
          },
          {
            "address": "0x1001b7e0",
            "name": "WdsDestroyBlackboard",
            "ordinal": 28
          },
          {
            "address": "0x100114b0",
            "name": "WdsDuplicateData",
            "ordinal": 29
          },
          {
            "address": "0x1001ef50",
            "name": "WdsEnableDiagnosticMode",
            "ordinal": 30
          },
          {
            "address": "0x10011da0",
            "name": "WdsEnableExit",
            "ordinal": 31
          },
          {
            "address": "0x10011dc0",
            "name": "WdsEnableExitEx",
            "ordinal": 32
          },
          {
            "address": "0x1001bae0",
            "name": "WdsEnumFirstBlackboardItem",
            "ordinal": 33
          },
          {
            "address": "0x10012590",
            "name": "WdsEnumFirstCollectionValue",
            "ordinal": 34
          },
          {
            "address": "0x1001bce0",
            "name": "WdsEnumNextBlackboardItem",
            "ordinal": 35
          },
          {
            "address": "0x100125c0",
            "name": "WdsEnumNextCollectionValue",
            "ordinal": 36
          },
          {
            "address": "0x100109a0",
            "name": "WdsExecuteWorkQueue",
            "ordinal": 38
          },
          {
            "address": "0x10010ea0",
            "name": "WdsExecuteWorkQueue2",
            "ordinal": 37
          },
          {
            "address": "0x10011430",
            "name": "WdsExecuteWorkQueueEx",
            "ordinal": 39
          },
          {
            "address": "0x10011e40",
            "name": "WdsExitImmediately",
            "ordinal": 40
          },
          {
            "address": "0x10011e60",
            "name": "WdsExitImmediatelyEx",
            "ordinal": 41
          },
          {
            "address": "0x10012000",
            "name": "WdsFreeCollection",
            "ordinal": 42
          },
          {
            "address": "0x10011660",
            "name": "WdsFreeData",
            "ordinal": 43
          },
          {
            "address": "0x1001dde0",
            "name": "WdsGenericSetupLogInit",
            "ordinal": 44
          },
          {
            "address": "0x1001ef40",
            "name": "WdsGetAssertFlags",
            "ordinal": 45
          },
          {
            "address": "0x1001c000",
            "name": "WdsGetBlackboardBinaryData",
            "ordinal": 46
          },
          {
            "address": "0x1001c2c0",
            "name": "WdsGetBlackboardStringA",
            "ordinal": 47
          },
          {
            "address": "0x1001c150",
            "name": "WdsGetBlackboardStringW",
            "ordinal": 48
          },
          {
            "address": "0x1001bee0",
            "name": "WdsGetBlackboardUintPtr",
            "ordinal": 49
          },
          {
            "address": "0x1001ba00",
            "name": "WdsGetBlackboardValue",
            "ordinal": 50
          },
          {
            "address": "0x10011d40",
            "name": "WdsGetCurrentExecutionGroup",
            "ordinal": 51
          },
          {
            "address": "0x100125e0",
            "name": "WdsGetPointer",
            "ordinal": 1
          },
          {
            "address": "0x1001d7c0",
            "name": "WdsGetSetupLog",
            "ordinal": 52
          },
          {
            "address": "0x10011860",
            "name": "WdsGetTempDir",
            "ordinal": 53
          },
          {
            "address": "0x1000f140",
            "name": "WdsInitialize",
            "ordinal": 54
          },
          {
            "address": "0x1000a360",
            "name": "WdsInitializeCallbackArray",
            "ordinal": 55
          },
          {
            "address": "0x10011790",
            "name": "WdsInitializeDataBinary",
            "ordinal": 56
          },
          {
            "address": "0x100116b0",
            "name": "WdsInitializeDataStringA",
            "ordinal": 57
          },
          {
            "address": "0x10011720",
            "name": "WdsInitializeDataStringW",
            "ordinal": 58
          },
          {
            "address": "0x10011800",
            "name": "WdsInitializeDataUInt32",
            "ordinal": 59
          },
          {
            "address": "0x10011830",
            "name": "WdsInitializeDataUInt64",
            "ordinal": 60
          },
          {
            "address": "0x1001ef70",
            "name": "WdsIsDiagnosticModeEnabled",
            "ordinal": 61
          },
          {
            "address": "0x10011f20",
            "name": "WdsIterateOfflineQueue",
            "ordinal": 62
          },
          {
            "address": "0x10011ee0",
            "name": "WdsIterateQueue",
            "ordinal": 63
          },
          {
            "address": "0x1001c490",
            "name": "WdsLockBlackboardValue",
            "ordinal": 64
          },
          {
            "address": "0x10011d20",
            "name": "WdsLockExecutionGroup",
            "ordinal": 65
          },
          {
            "address": "0x10021bf0",
            "name": "WdsLogCreate",
            "ordinal": 66
          },
          {
            "address": "0x10021cf0",
            "name": "WdsLogDestroy",
            "ordinal": 67
          },
          {
            "address": "0x100224d0",
            "name": "WdsLogRegStockProviders",
            "ordinal": 68
          },
          {
            "address": "0x10022200",
            "name": "WdsLogRegisterProvider",
            "ordinal": 69
          },
          {
            "address": "0x1001d350",
            "name": "WdsLogStructuredException",
            "ordinal": 70
          },
          {
            "address": "0x10022560",
            "name": "WdsLogUnRegStockProviders",
            "ordinal": 71
          },
          {
            "address": "0x100222f0",
            "name": "WdsLogUnRegisterProvider",
            "ordinal": 72
          },
          {
            "address": "0x100120b0",
            "name": "WdsPackCollection",
            "ordinal": 73
          },
          {
            "address": "0x10011b30",
            "name": "WdsPublish",
            "ordinal": 74
          },
          {
            "address": "0x10011b70",
            "name": "WdsPublishEx",
            "ordinal": 75
          },
          {
            "address": "0x10011cc0",
            "name": "WdsPublishImmediateAsync",
            "ordinal": 76
          },
          {
            "address": "0x10011c90",
            "name": "WdsPublishImmediateEx",
            "ordinal": 77
          },
          {
            "address": "0x10011bb0",
            "name": "WdsPublishOffline",
            "ordinal": 78
          },
          {
            "address": "0x10011470",
            "name": "WdsSeqAlloc",
            "ordinal": 79
          },
          {
            "address": "0x10009620",
            "name": "WdsSeqFree",
            "ordinal": 80
          },
          {
            "address": "0x1001ef20",
            "name": "WdsSetAssertFlags",
            "ordinal": 81
          },
          {
            "address": "0x1001b830",
            "name": "WdsSetBlackboardValue",
            "ordinal": 82
          },
          {
            "address": "0x10011d70",
            "name": "WdsSetNextExecutionGroup",
            "ordinal": 83
          },
          {
            "address": "0x10011d00",
            "name": "WdsSetUILanguage",
            "ordinal": 84
          },
          {
            "address": "0x1001ee60",
            "name": "WdsSetupLogDestroy",
            "ordinal": 85
          },
          {
            "address": "0x1001e130",
            "name": "WdsSetupLogInit",
            "ordinal": 86
          },
          {
            "address": "0x1001f710",
            "name": "WdsSetupLogMessageA",
            "ordinal": 87
          },
          {
            "address": "0x1001f440",
            "name": "WdsSetupLogMessageW",
            "ordinal": 88
          },
          {
            "address": "0x10011a10",
            "name": "WdsSubscribeEx",
            "ordinal": 89
          },
          {
            "address": "0x1000f2b0",
            "name": "WdsTerminate",
            "ordinal": 90
          },
          {
            "address": "0x10011d30",
            "name": "WdsUnlockExecutionGroup",
            "ordinal": 91
          },
          {
            "address": "0x10012240",
            "name": "WdsUnpackCollection",
            "ordinal": 92
          },
          {
            "address": "0x10011a50",
            "name": "WdsUnsubscribe",
            "ordinal": 93
          },
          {
            "address": "0x10011a80",
            "name": "WdsUnsubscribeEx",
            "ordinal": 94
          },
          {
            "address": "0x1001c820",
            "name": "WdsValidBlackboard",
            "ordinal": 95
          },
          {
            "address": "0x1002c000",
            "name": "g_Kernel32",
            "ordinal": 2
          },
          {
            "address": "0x1002c2b0",
            "name": "g_bEnableDiagnosticMode",
            "ordinal": 3
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x0002ae00",
            "size": "0x00000b3e"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x0002e324",
            "size": "0x00000064"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x00030000",
            "size": "0x000003f8"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x0002f200",
            "size": "0x00002138"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x00031000",
            "size": "0x0000228c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x00008b20",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x00001408",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x0002e000",
            "size": "0x00000320"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x0002a93e",
            "size_of_data": "0x0002aa00",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.23"
          },
          {
            "name": ".data",
            "raw_address": "0x0002ae00",
            "virtual_address": "0x0002c000",
            "virtual_size": "0x00001068",
            "size_of_data": "0x00000800",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "1.86"
          },
          {
            "name": ".idata",
            "raw_address": "0x0002b600",
            "virtual_address": "0x0002e000",
            "virtual_size": "0x000013b2",
            "size_of_data": "0x00001400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.58"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x0002ca00",
            "virtual_address": "0x00030000",
            "virtual_size": "0x000003f8",
            "size_of_data": "0x00000400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "3.37"
          },
          {
            "name": ".reloc",
            "raw_address": "0x0002ce00",
            "virtual_address": "0x00031000",
            "virtual_size": "0x0000228c",
            "size_of_data": "0x00002400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.69"
          }
        ],
        "overlay": {
          "offset": "0x0002f200",
          "size": "0x00002138"
        },
        "resources": [
          {
            "name": "RT_VERSION",
            "offset": "0x00030060",
            "size": "0x00000398",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.52"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Panther Engine Module"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "wdscore.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "WDSCORE.DLL"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "3a214f6dc4499595e8bb7d58e7a636b0",
        "timestamp": "2032-03-07 01:04:14",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 4
      },
      "data": null,
      "strings": [
        "L$$PQ",
        "GetTokenInformation",
        "3]4i4n4y4",
        "WdsSetAssertFlags",
        "4 4O4",
        "MemoryControlBlock",
        "Microsoft Time-Stamp Service",
        "?3?<?A?L?Y?",
        ".?AVCConsistentFileMapping@@",
        "CBlackboard::FindValue: negative lock count.",
        "TelemetryAssert",
        ">G?V?[?a?h?w?}?",
        "6%6,6J6b6n6s6~6",
        "?)?B?H?z?",
        "vXhX*",
        "pSerializeFileVersion",
        "malloc",
        "pWorkerThreadFunc -- WaitForMultipleObjects failed",
        ";GhtA3",
        "WdsIterateQueue",
        "Could not close file for '%s'",
        "229879+4583620",
        "CBlackboard::Close",
        "DuplicateHandle",
        "UnmapViewOfFile",
        "Failed to initialize SEQ",
        "9~,ub",
        "HeapSize",
        "pWorkerThreadFunc -- Stopping",
        "<unknown>",
        "b%9q^",
        "WdsInitializeDataUInt32",
        "IsDebuggerPresent",
        "8`8g8l8",
        "SetThreadPreferredUILanguages",
        "9+999K9",
        "HeapWalk",
        "SeqExecute -- stopping, since termination group# < current group#",
        "[gle=0x%.8x]",
        "WdsLogUnRegisterProvider",
        "OpenProcess",
        "8$8*80868;8N8`8|8",
        "TerminateProcess",
        "D$ Vh0",
        "QPWh ",
        ".idata$5",
        "3A3H3Z3",
        "9w\\tZVVj",
        "WdsExitImmediatelyEx",
        "9 :0:<:D:x:",
        "Couldn't Publish EVENT_SERIALIZE_BEFORE_EXIT",
        "TelemetryAssertDiagTrack",
        "ExpandEnvironmentStringsW",
        "GetModuleFileName failed in engine::pCleanOutTempDir",
        "pUpdateContentsFile StringCchPrintf failed",
        "_purecall",
        "onecore\\base\\ntsetup\\panther\\wdslog\\setuplog.cpp",
        "040904B0",
        "Microsoft Time-Stamp Service0",
        "<-<B<W<l<{<",
        "HeapFree",
        "GetVersionExA",
        "4P5]5",
        "200304183039Z",
        "swscanf_s",
        "SetSecurityDescriptorDacl",
        "The names of all offline queues and offline groups must be unique.  '%s' is already used",
        "=@>G>S>s>z>",
        ".data$r$brc",
        "TlsGetValue",
        "CTypeManager::Open: m_SpinLocks.Create(%s) failed",
        ".?AVCConsistentMapping@@",
        "Redmond1",
        "ConstructPartialMsgIfA",
        "t)j\\P",
        "WdsLogUnRegStockProviders",
        "<S=X>_>u>|>",
        "wcstok_s",
        "j\\Yf;",
        "606_6f6",
        "WdsExitImmediate already called",
        "GetWindowsDirectoryA",
        "2$2E2W2",
        ">0?s?",
        "INVALID_DISPOSITION",
        "<rs:data>",
        "<xml xmlns:s=\"uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882\"",
        "MOUPG",
        "SYSPRP",
        "WdsUnsubscribeEx(%s, %s, %d, %d) called",
        "MapViewOfFile",
        "SeqUnlockExecutionGroup",
        "GlobalUnlock",
        "SeqSerializeToFile OF_Close failed for %s",
        "9 :w:",
        "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a",
        "SizeofResource",
        "8^9i9",
        "CurrentIP",
        ".xdata$x",
        "=6=I=R=W=b=l=",
        "Microsoft Corporation1",
        "Module '%s' did not subscribe to any events, so it was unloaded.",
        ":>;J;O;[;k;",
        "WdsPublishImmediateEx",
        "WdsUnlockExecutionGroup",
        "WdsPackCollection",
        "StringFileInfo",
        "EngineBeginSaveOperation",
        ":';.;9;t;",
        "VSh\\[",
        "Error serializing callback in '%s'",
        "N0L0J",
        "r~akow",
        "1.1Q1t1",
        "Module %s can't subscribe.  Did you call WdsInitializeCallbackArray in your ModuleInit()?",
        "hexBinary",
        "iswctype",
        "pHandleSerialize",
        "9O`tD;",
        "9s8uh",
        "181=1U1;2@2]2g2p2x2",
        "WdsExecuteWorkQueueEx",
        ".?AVCIlKernel32@@",
        "Module Temp Directory %s is not useable",
        "GetComputerNameExW",
        "WdsPublish() by module %s - invalid group name %s",
        "9^Pt?SS",
        "WdsSetupLogInit",
        "9%:@:",
        "WdsEnumNextCollectionValue",
        ".?AUIKernel32Interface@@",
        "9wPt5",
        "WdsSubscribeEx",
        "%Microsoft Windows Production PCA 2011",
        "WdsVectoredExceptionHandler",
        "WdsDuplicateData failed, invalid source data - %s",
        "QSVWj\\",
        "=L9o<",
        "7 777C7H7S7]7h7",
        "InitializeModule",
        ".text$x",
        "GUARD_PAGE",
        "Couldn't create clean panther temp dir",
        "0+1<1I1X1^1q1",
        " !\"#%$&'()*+,-./012",
        "t#VSj",
        "count",
        "GetLocaleInfoW",
        "LogGlobalFilter",
        "%-21S %-6S %S",
        "SEQ EVENT_SERIALIZE Received",
        "Group: %s not found! (SEQ5)",
        ",vHgFM1wA1m9rSmnIHUnIgKeRXF6XE3eLAAVXY00v4oM=0Z",
        "7Y8_8e8k8q8",
        "1f;2u",
        "?(?-?8?E?",
        "VarFileInfo",
        ".?AVCConsistentMemoryMapping@@",
        "</xml>",
        "?/?A?Y?q?",
        "PANTHR",
        "DeleteCriticalSection",
        "QSVWj2^",
        "HZo6m|",
        "D$(Pj",
        "memmove",
        "u+j_Xf;",
        "D$0_^[",
        "71767",
        "9P:W:i:",
        "8%939@9E9Q9a9",
        "364[4",
        "HeapReAlloc",
        "3#3(3.3;3L3R3`3",
        " S>:$",
        "SeqLockExecutionGroup: Initializing ExecQueue->csLock;",
        "3,434O4\\4c4",
        " %S=\"",
        "VirtualQuery",
        "4D4H4P4X4p4",
        "onecore\\base\\ntsetup\\panther\\engine\\bb.cpp",
        "8'81898B8J8S8v8",
        "r%windir%\\system32\\dbghelp.dll",
        "3$4H4d4m4s4~4",
        "CStorage::Open: m_pMapping->Create(%s) failed.",
        "msvcrt.dll",
        ".?AVCSimpleBuffer@@",
        "GetCurrentThreadId",
        "MoveFileExW",
        "2#2-2i2",
        "tdj;^",
        "1!2Y2",
        "WdsEnumFirstBlackboardItem",
        "memmove_s",
        "FreeLibrary",
        "`.data",
        "585X5x5",
        "WdsEnumFirstCollectionValue",
        "eEngineCompleteSaveOperation",
        "GetMajorTaskA",
        "Queue Serialization Failed!",
        ":%:.:3:>:H:o:x:}:",
        "<+<Q<V<[<",
        "InitializeModule - Failed to load %s",
        "WdsDeleteEvent - must pass in a WDS_QUEUE_POSITION from the iteration callback only!",
        "Invalid Major/Minor Event pair given to WdsSubscribe by %s",
        "8:8M8\\8o8{8",
        "Destroying any unreferenced modules! (SEQ6)",
        "<s:datatype dt:type=\"%s\"/>",
        "pUpdateContentsFile",
        ".CRT$XCA",
        "?+?P?k?t?",
        "Log: Failed To Get Msg From ID",
        "GetFileSizeEx",
        "7\"8+80888C8g8p8u8}8",
        "210303183039Z0p1",
        "6v718@9",
        "SetFilePointer",
        " xmlns:rs=\"urn:schemas-microsoft-com:rowset\"",
        "EndMajorTask",
        "WdsGetBlackboardValue",
        "bucketArgument1",
        "%s%-S(%S)",
        "WdsInitialize",
        "Could not save queue '%s' to '%s'",
        "2'2.2",
        "5$5-525=5G5",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "Failed to allocate memory for copy of subscription (SEQ8)",
        "Exception (code 0x%08X: %s) occurred at 0x%p in %s (+%p).  Minidump attached (%d bytes) to diagerr.xml and %s.",
        "hLBSMhDRBKh4O",
        "WdsLogRegStockProviders",
        " xmlns:z=\"#RowsetSchema\">",
        "fgetws",
        "t+PPj",
        "Could not allocate major event (SEQ9)",
        "CStorage::Open: CConsistentMappingFactory::CreateObject failed.",
        "Failed to create online queue name",
        "$Microsoft Ireland Operations Limited1&0$",
        "Could not wait on event queue handle (SEQ7)",
        "CStorage::Open",
        "Assert",
        "pConstructEvent",
        "InternalName",
        "Microsoft Corporation1.0,",
        "250701214655Z0|1",
        "<><E<W<",
        "ConstructPartialMsgVW",
        "<-<3<",
        "0%040;0J0Q0Y0",
        "WdsIterateOfflineQueue",
        "</rs:data>",
        "Translation",
        "303<3\\3h3",
        "WdsLogDestroy",
        "FormatMessageW",
        "memcpy",
        "kernel32.dll",
        "GetModuleHandleW",
        "1&1.1y1",
        "Saving Contents File %s",
        "GetSystemInfo",
        "LoadResource",
        "8N8q8x8",
        "4#T$\\",
        "5!5+505:5?5a5k5u5",
        "6(6,6D6T6X6h6l6p6",
        "8R9X9^9e9l9u9",
        "Failed to initialize setup groups",
        "484X4x4",
        " http://www.microsoft.com/windows0",
        "5 6,6M6Y6",
        "=@=t=",
        "%-20S %-10S [0x%06x] %-6S %S",
        "%u/%u/%u",
        "WdsSetBlackboardValue",
        "%s %[^",
        "L$ Pj",
        "<.=J=e=",
        "SetupLog",
        "=*>S>\\>a>l>v>",
        "CallSubscribers",
        "SeqDeleteEvent",
        "FLT_UNDERFLOW",
        "Washington1",
        "WDS_DATA.Type == RESERVED, which is not available to modules!",
        "5!5,5:5}5",
        "ReleaseMutex",
        "WdsPublishImmediateAsync",
        "0!0'0-030a0g0m0s0y0",
        "CBlackboard::Open: %s succeeded.",
        ";M<Z<r<y<S>w>",
        "Could not allocate group list item (SEQ3)",
        ":$:1:U:c:p:u:",
        "20201009090308Z0w0=",
        "pInitializeWorkQueue",
        "Contents",
        "GetModuleHandleExW",
        "%s*.%s",
        "D$ h8",
        "CMemoryManager::InitializeMemMapsAsForNewFile",
        "Could not duplicate data (SEQ17)",
        "EngineCompleteSaveOperation couldn't create %s",
        "0%0/0o0{0",
        "FileDescription",
        "9E t5",
        "CSpinLockFileMappingArray::Create: m_pMapping->Create(%s) failed.",
        "_XcptFilter",
        ";#;,;1;<;F;t;",
        "Log: Cannot convert ansi->unicode.",
        "WdsEnableExit already called",
        "Windows Setup activity log",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "WdsSetUILanguage",
        "GlobalFree",
        ".idata$6",
        "WdsInitializeDataUInt64",
        "WdsEnableExitEx couldn't duplicate exit data",
        "CMemoryManager::InitializeMemMapsAsForNewFile: pFileMapping->UnmapViewOfFile failed.",
        "Rich*&Z",
        "wcschr",
        "PRIV_INSTRUCTION",
        "assertVersion",
        ";1;8;B;Y;`;",
        "A Module did not subscribe to any events, so it was unloaded.",
        "SeqEnableExit",
        "StartMajorTask",
        "FreeSid",
        "onecore\\base\\ntsetup\\panther\\engine\\seq.c",
        "=,=Y=",
        "CBlackboard::FindNodeByUniqueID",
        "4)4D4K4g4t4",
        "Queue Serialization Succeeded",
        "pGetAllSubscriptions",
        "CreateFileA",
        ";C;O;U;^;w;",
        ".rdata$zETW0",
        "WdsInitializeDataStringW",
        "SUPPRESS",
        "Microsoft Corporation",
        "Could not allocate subscription list (SEQ11)",
        "pConstructEvent() -- invalid WDS_DATA specified: %s",
        "GlobalLock",
        "STACK_OVERFLOW",
        "8.<y<",
        "SeqExitImmediately",
        "RegQueryValueExW",
        "pCreateCleanTempDir",
        "GetShortPathNameW",
        "pSerializeSubscription",
        "won't",
        "SeqUnsubscribeEx",
        "u%h4<",
        "SeqSerializeToFile",
        "GetProcessHeap",
        "EventProviderEnabled",
        "WdsUnsubscribe",
        "WdsPublish() -- MajorEvent and MinorEvent cannot be 0",
        "LoadLibraryExW",
        "_ftol2",
        "calloc",
        "|$ 9=",
        "SetEndOfFile",
        "WdsSetupLogDestroy",
        "CBlackboardFactory::Remove",
        "t19^ uM",
        "Invalid Major/Minor Event pair given to WdsUnsubscribeEx by %s",
        "CMemoryManager::InitializeMemMapsAsForNewFile: pFileMapping->MapViewOfFile failed.",
        "InitializeModule: Initializing ExecQueue->csLock;",
        "DIAGER",
        "=E>K>W>",
        "7H8O8e8n8",
        "j\\Zf;",
        "01090@0F0L0z0",
        "CConsistentFileMapping::Open: CreateFile failed.",
        "0.040N1_1n1t1",
        "Successfully backed up PERMANENT event",
        "j-Xf;",
        "4$404M4W4",
        "20201008033933.375Z0",
        "R!s4Z",
        "WdsInitializeCallbackArray",
        "GetTempPathW",
        "WideCharToMultiByte",
        "\"Microsoft Window",
        "=)=0=6=<=B=G=M=]=g=w=",
        "6#6.686i6",
        "G\\;Ghv",
        "2$2@2P2t2|2",
        "::;\\;o;",
        "<+<G<Q<j<",
        "WaitForMultipleObjectsEx",
        "setuperr.log",
        "The file '%s' couldn't be opened for output",
        "7%8O8h8",
        "ExecQueue->csLock.DebugInfo is NULL.",
        "WdsSetNextExecutionGroup",
        "1(1A1[1d1i1t1~1",
        "Could not allocate event list item",
        "Invalid Group Name '%s' passed to WdsIterateOfflineQueue",
        "<s:ElementType name=\"row\" content=\"eltOnly\" rs:updatable=\"true\">",
        "PQh<<",
        "ADVAPI32.dll",
        "252R2Y2`2h2y2",
        "3h4}4",
        "9,9;9B9H9P9l9t9",
        "EnterCriticalSection",
        "7^7c7",
        "0H1Y1h1n1",
        "2*3M3p3",
        "5#6/6",
        "5b5u5",
        "EventUnregister",
        "WdsExitImmediate called!  Execution will stop, and the queue %s be saved.",
        "8DRBKu",
        "DebugFilter",
        ">?>U>[>b>r>{>",
        "5#676C6T6i6",
        "wdscore.dll",
        "WdsSetupLogMessageW",
        "t0VhdT",
        "9>u:WW",
        "1'2,2",
        "GetOverlappedResult",
        "WdsEnableDiagnosticMode",
        "%-20S %-21S %-6S %s",
        "Invalid Queue Name '%s' specified to WdsPublishOffline",
        "t=j@j",
        "Panther Engine Module",
        "=\"=2=W=",
        ":&;|;}<",
        "Failed to open contents file '%s'",
        "Qj\\^f;",
        "<s:AttributeType name=\"%S\" rs:number=\"%d\">",
        "1/0-0",
        ";D$$u",
        "Could not allocate temporary subscription list (SEQ13)",
        "CSpinLockFileMappingArray::Create",
        "Failed to resolve binary for module '%s'",
        "SeqPublishImmediate() -- MajorEvent and MinorEvent cannot be 0",
        "TlsSetValue",
        "_onexit",
        "G\\;Gh",
        "303A3R3V3a3g3q3",
        "8%8d8",
        "bucketArgument2",
        "3456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^",
        "g_bEnableDiagnosticMode",
        "AddVectoredExceptionHandler",
        ";8;X;x;",
        "WdsPublish",
        ">@>G>P>X>i>u>|>",
        "WDS_DATA.Type == WDS_TYPE_NONE, but the other members of WDS_DATA are non zero!",
        "9ShwW",
        "%d %d",
        "LegalCopyright",
        ";&;5;",
        "debug.log",
        "SeqSerializeFromFile",
        "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3",
        "HeapCompact",
        "Y__^[",
        ".idata$3",
        "4;5E5Q5[5",
        "epLookupContentsFileEntry",
        "6(7F7k7",
        "dateTime",
        "8)8J8S8a8I9R9`9",
        "towlower",
        "GetWindowsDirectoryW",
        "0$0.050=0I0P0X0",
        "SeqPublishImmediateEx",
        "<\"<J<R<g<z<",
        "$`2X`F",
        "M0K0I",
        "\\CONOUT$",
        "7(787[7",
        "??1type_info@@UAE@XZ",
        "WDSCORE.dll",
        "WdsGetBlackboardBinaryData",
        "|hK,_",
        ".?AVCAtlException@ATL@@",
        "4$4[4J5Y5k5",
        "t%SV3",
        "EventRegister",
        "0C1h1n1v1",
        "The file '%s' couldn't be opened for input",
        "FLT_INVALID_OPERATION",
        "IBSLIB",
        "Failed to backup PERMANENT event during SetNextExecutionGroup!!",
        ".rdata$zETW1",
        ".edata",
        "9+929G9T9[9",
        "GlobalSize",
        "NoSeverity",
        "WdsExitImmediately",
        "=K={=",
        "WdsSeqFree",
        "There was a problem creating a PEXEC_QUEUE_LIST_ITEM member",
        "RegOpenKeyExW",
        "t\"hH:",
        "pStartWorkerThreads",
        "GetLogicalDriveStringsW",
        ".00cfg",
        "3=3D3",
        ";\";8;B;X;h;~;",
        "INT_DIVIDE_BY_ZERO",
        "j?Yf;",
        "SVj(j",
        "PSSSSSSh ",
        "7&7C7K7]7",
        "GetCurrentThread",
        "ValidateModule",
        ":):4:<:E:\\:|:",
        ".data$brc",
        "Storage",
        "EventWriteTransfer",
        "Microsoft Time-Stamp PCA 2010",
        "<program name unknown>",
        "&0-080|0",
        "Legal_Policy_Statement",
        ";GhtH",
        ";S;c;",
        ";/;6;F;M;];d;o;+<P<\\<a<l<x<",
        "__CxxFrameHandler3",
        "_wcsnicmp",
        ">$>J>l>",
        "&02070B0L0}0",
        "243=3B3M3Z3z3",
        "1(0&0",
        "ExecutableName: ",
        "MiniDumpWriteDump",
        "The header for '%s' couldn't be written",
        "t: QQ",
        "InitializeSecurityDescriptor",
        "CheckTokenMembership",
        "9D9L9T9`9",
        "SetUnhandledExceptionFilter",
        "DATATYPE_MISALIGNMENT",
        "GetCommandLineW",
        "pCopySubscription",
        ".%I64x",
        "NONCONTINUABLE_EXCEPTION",
        "6Q7X7",
        "advapi32.dll",
        "GetMajorTask",
        "6&6-696u6",
        "7X7y7",
        "=$=D=L=T=\\=h=",
        ".WdsSetupLogInit",
        "4y52696",
        "DebugFormatterAndDevice",
        ".CRT$XIZ",
        "WdsUnPackCollection -- Data->Type != WDS_TYPE_PACKED_COLLECTION",
        "Attempt to use SeqGetCurrentExecutionGroup from another thread",
        "PANTHER_ENABLE_TELASSERT",
        "Global\\WdsSetupLogInit",
        "CompanyName",
        "Couldn't copy pFV->FileName in pLookupContentsFileEntry",
        "Attempt to use SeqLockExecutionGroup from another thread",
        "FLT_OVERFLOW",
        "6K7^7e7",
        "diagerr.mdmp",
        "WdsExecuteWorkQueue2 with WDS_START_EMPTY_QUEUE given 0 modules or 0 groups",
        "pLock",
        ":8:X:x:",
        "GlobalAlloc",
        "CreateFileW",
        "H 9OX",
        ";s s%k",
        "wcsrchr",
        "3)3;3G3",
        ".text",
        "!w(^_",
        "pConstructContentsFile",
        "CreateProcessW",
        "=,=?=W=c=h=s=}=",
        "Could not associate Module name, Major or Minor event with new event",
        "EngineCompleteSaveOperation couldn't save contents file",
        "Microsoft Corporation1-0+",
        "GetDiskFreeSpaceW",
        "%-10S [0x%06x] %-6S %S",
        "FLT_DENORMAL_OPERAND",
        "4?5K5l5x5",
        "989X9x9",
        "9k:r:",
        "WdsIsDiagnosticModeEnabled",
        "EngineCompleteSaveOperation couldn't save %s",
        "Windows Setup error log",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "Saving FileVersion %s%d.%s",
        "10.0.19041.572",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "Online",
        "t$0Pj",
        "1>2J2O2Z2d2",
        "SetErrorMode",
        "EventSetInformation",
        "8%8/8L8X8d8m8|8",
        "<!<?<]<d<s<",
        ">:>v>",
        "SetFileAttributesW",
        "_vsnwprintf",
        "MIGUI",
        "ConstructPartialMsgVW: MALLOC failed",
        "InitializeModule - Failed to find entry point %s",
        ":2:7:A:S:Y:a:h:o:u:",
        "u(VSP",
        "GetVersionExW",
        "2q3x3~3",
        "9':b:",
        "Microsoft Corporation1200",
        "FatalError",
        ">%>?>R>{>",
        "WdsLockBlackboardValue",
        "$@_^[]",
        "HeapAlloc",
        "31464A4L4\\4y4",
        "rSeqDestruct",
        "WdsLogStructuredException",
        "QueryPerformanceCounter",
        "$Microsoft Ireland Operations Limited1",
        "No working dir has been given to panther.  Call WdsInitialize(ReInit=TRUE) to specify one",
        "GetLocalTime",
        "Invalid callback 0x%X given to WdsSubscribe by %s. Did you put this callback in the initial callback table?",
        ".CRT$XCZ",
        "ModuleCollection",
        "&quot;",
        "toupper",
        "WdsAddModule",
        "INT_OVERFLOW",
        "CreateEventW",
        "FLT_STACK_CHECK",
        "\"CBlackboard::Open",
        ";&;>;X;_;",
        "BLaA#X'",
        "GetLengthSid",
        "WdsUnsubscribeEx(%s, %s, %d, %d) removed subscription (%s, %d, Callback:%d)",
        "0_0q0",
        "Section",
        "1I1N1T1",
        "GlobalMemoryStatus",
        "CConsistentFileMapping::Open",
        "WdsCopyBlackboardItems",
        ".text$yd",
        "WdsUnsubscribeEx could not allocate major event",
        "%-20S %-21S [0x%06x] %s",
        "TelemetryAssertList",
        "7 7@7L7l7t7|7",
        ".CRT$XIAA",
        "6(626B6R6b6x6",
        "pSeqConstruct",
        "setupact.log",
        "2\"3+303;3E3",
        "WdsValidBlackboard",
        "Failed to add group to offline queue '%s'",
        "FormatMessageA",
        "1<1J1t1",
        ";H<P<h<",
        ">&?-?V?b?g?r?~?",
        "Failed to read in ContentsFile->FileVersions",
        "WdsSeqAlloc",
        "Blackboard Corruption: %s",
        "9(989J9X9h9x9",
        "WdsExitImmediatelyEx couldn't duplicate exit data",
        "Exception (code 0x%08X: %s) occurred at 0x%p in %s.",
        "DeleteFileW",
        "Could not load SEQ state from '%s'",
        "455E5N5[5d5",
        "686X6x6",
        "Loading Event: EventType(%s,%d) PublishedBy(%s)",
        "pExecuteSEQControlEvent",
        "Unable to load global log filter.",
        "Failed to alloc WorkQueue->OfflineQueuesTable",
        "\\}eU%",
        "Couldn't construct contents file!",
        "?terminate@@YAXXZ",
        "8$8+8B8K8P8[8e8",
        "RegCloseKey",
        "StringCchCopy fails for %s",
        "SACSetupErr",
        "@_^[]",
        "_wcslwr",
        "?:\\wdslog.inf",
        "FLT_DIVIDE_BY_ZERO",
        "GetProcAddress",
        "FindClose",
        "InitializeCriticalSection",
        "PVh05",
        "Microsoft Corporation1&0$",
        "GetModuleFileNameW",
        "ResetEvent",
        "WdsLogCreate",
        "GetFileSize",
        "8+868<8D8K8^8f8w8",
        "ReleaseSRWLockExclusive",
        "EndMinorTask",
        "DEPLOY",
        "pResolveBinaryName",
        ".CRT$XCU",
        "CreateMutexW",
        "%-20S %-21S %-6S %S",
        "SeqExecute -- stopping, since WdsExitImmediate() was called",
        "9w`t ",
        "Warning",
        "=(>5>M>",
        "< <F<",
        "1=2c2l2q2}2",
        "EqualSid",
        "WdsInitializeDataBinary",
        "1&1@1L1Q1\\1f1k1",
        "4&4?4V4",
        "9(9:9@9R9X9a9l9s9x9",
        ";Ght;VV",
        "2 2&2_2}2",
        ":A;+<",
        "OpenEventW",
        ".data",
        ";S s!k",
        "_wcslwr_s",
        "WdsPublishOffline - must provide an actual group name, not NULL or WDS_CURRENT_GROUP",
        "WdsGetCurrentExecutionGroup",
        "7 7-727=7G7y7",
        "SeqPublishImmediateAsync() -- MajorEvent and MinorEvent cannot be 0",
        " Windows",
        "QVQPh",
        "787X7x7",
        "SeqExecute",
        "t<Null>",
        "WdsUnsubscribeEx",
        "WdsGenericSetupLogInit",
        "_wfopen",
        "210121231915Z0",
        "tWdsIterateQueue",
        "GetMinorTaskA",
        "9KHtk",
        "wcsncmp",
        "D$,Pj",
        "WdsUnPackCollection -- couldn't add value",
        "WdsEnumNextBlackboardItem",
        "No working dir has been given to panther.  The temp dir for modules will be unavailable.  Call WdsInitialize(ReInit=TRUE) to specify a working directory",
        "=5>I>U>e>j>u>",
        "SerializeFromFile '%s'",
        "Global\\SetupLog",
        "Could add subscription list item to hash table (SEQ12)",
        "333<3",
        "SeqSetNextExecutionGroup",
        "The version of '%s' is %d, but the required version is %d",
        "SeqLockExecutionGroup",
        "5?5G5",
        "CreateFileMappingW",
        "originatingBinary",
        "VPQhp",
        "3\"3*3:3B3\\3}3",
        "PVVh4\\",
        "CTypeManager::Open",
        "WdsDeleteEvent",
        "strrchr",
        "Sleep",
        "6:6C6",
        ">o>v>~>7?<?A?h?x?}?",
        "%-20S %-10S [0x%06x] %-6S %s",
        "GetCurrentProcessId",
        "Module '%s' with binary '%s' was prevented from loading by negative response to EVENT_LOADING_MODULE",
        ">L?U?Z?f?q?",
        "WdsEnableExit called!  When group #%d is empty, execution will stop, and the queue %s be saved.",
        "5.555q5",
        " || SourceName: ",
        "9^Tt?SS",
        "SYSTEM\\Setup\\Panther",
        "Status",
        "WdsPublishOffline",
        "INVALID_HANDLE",
        " || LogMessage: ",
        "%S(%d) : %S",
        ".idata$4",
        "?,?@?L?Y?^?i?v?",
        "WDSCORE.DLL",
        ":H;O;Y;`;",
        "<f<r<w<",
        "CBlackboard::Close: %s.",
        "8(888H8X8h8x8",
        "WdsPublish() -- The PriorityGroupStr must be null if an actual queue position is given from an iterator",
        "pBlackboard(0x%x)has %d outstanding access reference count. Client probably did not close Enum handle(s).",
        "DeleteFileA",
        "/0i0p0z0",
        ".CRT$XIA",
        "WdsLogRegisterProvider",
        "WdsUnPackCollection -- Invalid type passed",
        "TlsAlloc",
        "6&606r6w6",
        "Error",
        "111019184142Z",
        "Could not allocate subscription list item (SEQ10)",
        "5@6m6",
        "VirtualFree",
        ";#;8;D;I;T;^;",
        "<N=^=k=p={=",
        "</s:ElementType>",
        ";><w<.=",
        "FindFirstFileW",
        ";,;8;X;x;",
        "5%6,616P6Z6a6",
        "<8<X<d<",
        ".rdata",
        "%-10S [0x%06x] %-6S %s",
        "EngineCompleteSaveOperation couldn't obtain new file version!",
        "0\"161k1y1",
        ".text$di",
        ".WdsExitImmediate",
        "=+>r>",
        "&apos;",
        "%S(%d) : ",
        "8$8)848>8V8v9",
        "PWjdZ",
        "OriginalFilename",
        "default",
        "_CxxThrowException",
        "SEQ Control",
        "Undefined",
        "pMergePersistentQueue - processing Perm Event: (%s,%s)  by: %s",
        "lL7Ki\"0",
        "142F2s2",
        "@.reloc",
        "Verbose",
        "6-7S7",
        "U0S0Q",
        "Trace",
        "StandardSetupLogFilter",
        "PPPPf",
        "Unknown SEQ Control Event received %d",
        "SeqSetUILanguage",
        "<unnamed>",
        "WdsDeleteBlackboardValue",
        "SSWh0",
        "606<6X6x6",
        "%-21S %-6S %s",
        "_callnewh",
        "WdsExecuteWorkQueue",
        "BREAKPOINT",
        "InitializeAcl",
        "<0<L<g<l<",
        ";-<3<9<?<b<}<",
        ";5<^<n<",
        "DRBK;T8",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "4B4J4i4",
        "The header for '%s' couldn't be read",
        "1$1,1014181<1T1X1d1",
        "x/j\\Xf;E",
        "t)j?W",
        "1$1A1W1",
        "9-939?9G9P9c9i9o9u9",
        "MultiByteToWideChar",
        "@.rsrc",
        "AddAccessAllowedAce",
        "<.=;=H=p=|=",
        "Microsoft Time-Stamp PCA 20100",
        ">5>S>",
        "ARRAY_BOUNDS_EXCEEDED",
        ":%;.;3;?;L;",
        "Could not allocate event list item (SEQ16a)",
        "D$PWP",
        ":8;V;",
        "WdsCreateBlackboard",
        "OF_Open",
        "20201008090308Z",
        "CBlackboard::~CBlackboard",
        "CreateMutexA",
        ".idata$2",
        "D$,uG;",
        "CBlackboard::Open: m_Storage.CreateType(%s) failed.",
        "757J7[7",
        ".CRT$XCL",
        "PQQSVW",
        "Failed to Merge the Persistent Queue into the Event Queue",
        "D$$Wj",
        "232^2e2",
        "9+:9:G:T:Y:e:o:",
        "LeaveCriticalSection",
        "GetEnvironmentVariableW",
        "131u1",
        "HeapCreate",
        "onecore\\base\\ntsetup\\panther\\engine\\engine.cpp",
        "ProductVersion",
        "GetVolumeInformationW",
        "WdsGetBlackboardStringA",
        "SerializeToFile: %s",
        "VirtualAlloc",
        "292T2w2",
        "imageName",
        "Unable to startup async event processing threads",
        ">,>3>c>m>}>",
        "7P8o8x8",
        "SeqExecute -- stopping, since termination group reached",
        "Module '%s' with binary '%s' was prevented from loading by improper use of EVENT_LOADING_MODULE's associated data",
        "CallSubscribers() -- invalid data given by subscription callback!  The event's data won't be modified! (%s)",
        ")WdsPublish",
        "<1<N<]<f<k<v<",
        "HeapDestroy",
        "3D4K4W4^4",
        "%d-%02d-%02dT%02d:%02d:%02d",
        "%s.%s.spl",
        "0G1o1F2D3{3",
        "VS_VERSION_INFO",
        "LBSM;T8",
        "3_^[]",
        "LocalAlloc",
        "pSerializeEvent",
        "3 3@3",
        "OLEAUT32.dll",
        "0%121~1",
        "u6SSS",
        "O0M0K",
        "4!4'4+41454;4?4E4N4U4^4f4j4p4t4z4~4",
        "9g:u:",
        ".?AUHashtableImpl@@",
        ")pConstructGroup",
        "D%nJW",
        "Failed to load offline queue '%s' from file '%s'",
        "imageSize",
        "=?=E=c=",
        ".rdata$r$brc",
        "DeviceIoControl",
        "GlobalCollection",
        "191023231915Z",
        "4M4Y4^4j4x4",
        "Failed to add to WorkQueue->OfflineQueuesTable",
        "5c5|5",
        "1.161;1P1W1",
        "pMergePersistentQueue",
        ">!?<?W?",
        "<%=4=M=Z=",
        "4<4b4g4",
        "CreateFileMappingA",
        "FLT_INEXACT_RESULT",
        "6,7?7",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        "6-6?6E6g6|6",
        "CBlackboard::m_lAccessSpinLock = %d for BB=\"%s\"",
        "GetModuleFileNameA",
        "Could not locate saved '%s' in working directory",
        "WdsAbortBlackboardItemEnum",
        "P$|*`",
        " || SourceFunction: ",
        "Thales TSS ESN:3BD4-4B80-69C31%0#",
        "AssertWithArgs",
        ")WdsUnsubscribe",
        ".rsrc$01",
        "Failed to write out ContentsFile->FileVersions",
        "1$1,141<1D1L1T1\\1d1l1t1|1",
        "_vsnprintf",
        "DebugBreak",
        "2#272N2",
        "9U9e9l9",
        "_unlock",
        ".gfids",
        "4A4Q4W4\\4q4",
        ".rsrc$02",
        "memcpy_s",
        "GetLastError",
        "5+5k5t5y5",
        "GetTempFileNameW",
        "WdsExecuteWorkQueue2",
        "CStorage::CheckAndRestoreIntegrity",
        "WINPE",
        "WdsPublishEx",
        "4B5K5P5[5h5",
        "%S\\%s",
        "fclose",
        ">:>m>",
        "_amsg_exit",
        "Attempt to use WdsUnlockExecutionGroup from another thread",
        "%s %s \"%[^\"]\"",
        "9 9.9",
        "j.Xf;",
        "Microsoft",
        "pGetHighestNumberedFile",
        "UnhandledExceptionFilter",
        "__dllonexit",
        "5,50545L5P5T5\\5t5",
        "WdsInitializeDataStringA",
        "Could not allocate event list item (SEQ16)",
        "%s\\%s%d.",
        "t;j?Yf;",
        "WdsAllocCollection",
        " xmlns:dt=\"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882\"",
        "Saving Permanent Event Queue",
        "IsWorkQueueAccessible",
        ":1:E:Q:V:a:r:",
        "%s\\%s%d.%s",
        "%s%-20S%S",
        "SINGLE_STEP",
        "GetFullPathNameW",
        "Failed to add all setup modules",
        ".giats",
        "'WdsExecuteWorkQueue2",
        "SeqSubscribeEx",
        "AllocateAndInitializeSid",
        "Function %s was called, but the panther work queue is not running!",
        "?(?0?8?D?d?p?",
        "L$4_^[3",
        ")Microsoft Root Certificate Authority 20100",
        "WdsPublish() -- Invalid event data submitted by '%s': %s",
        "<8<D<P<Y<}<",
        "AcquireSRWLockExclusive",
        "100701213655Z",
        "= >r>x>",
        "WdsSetNextExecutionGroup failed - the queue is currently locked",
        "WaitForSingleObject",
        ">&?F?U?`?e?",
        "FindNextFileW",
        "ConstructPartialMsgIfW",
        "4.4=4P4y4",
        "</s:AttributeType>",
        "L$,_^[3",
        "Trying to unlock queue which is already unlocked! (SEQ4)",
        "<L<o<",
        "OutputDebugStringA",
        "9!9'9",
        "4N4^4",
        "3'3,373A3",
        "9F9v9",
        "IN_PAGE_ERROR",
        "RaiseException",
        "LtG<_",
        "pSetUILanguage",
        "totalHits",
        "Attempt to use SeqSetNextExecutionGroup from another thread",
        "5l6e7",
        "2@2\\2|2",
        "6K6a6",
        "5\"555@5D5J5Q5X5]5e5i5",
        "C9~4u",
        "api-ms-win-eventing-provider-l1-1-0.dll",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "CMemoryManager::InitializeSharedControlBlock: m_pFileMapping->MapViewOfFile failed.",
        "071P1",
        "_wcsicmp",
        ".idata",
        "GetFileAttributesW",
        "t\\9NdtW9N",
        "2n3w3|3",
        "10.0.19041.572 (WinBuild.160101.0800)",
        "9f;:u",
        "='=1=?=X=",
        ">0>P>p>",
        "QSVW3",
        "E(SVW",
        "WdsCollectionGetValue",
        "D$49D$",
        "pGetNewFileName couldn't find next file!",
        ":*:?:N:V:_:e:",
        "7\"9\\9",
        "Failed to open contents file for output '%s'",
        "261019185142Z0",
        "111@1L1i1p1|1",
        "sWdsDuplicateData",
        "FindResourceExW",
        "<8<@<D<\\<`<",
        "ILLEGAL_INSTRUCTION",
        "GetLogicalDrives",
        "WdsFreeData",
        "ReadFile",
        ":9:I:[:d:",
        "</s:Schema>",
        "6+7F7Y7b7g7r7{7",
        "QSVWj",
        "000I0",
        "9*9V9b9g9t9",
        "SeqPublish",
        "<z:row",
        "=#>y>",
        "WdsGetAssertFlags",
        "WdsAddModule given invalid parameters",
        "Saving Main Event Queue",
        "?K?`?p?",
        "1M3T3",
        "9=9Z9|9",
        "011S1i1",
        "%WINDIR%\\Minidump",
        "setuplog.cfg",
        "WdsUnpackCollection",
        "LBSMtwA",
        "WdsEnableExitEx",
        "FM.%I64x",
        "576>6S6X6o6",
        "wdscore.pdb",
        "ConstructPartialMsgVA",
        "thVVVVh",
        "KERNEL32.dll",
        "GetDriveTypeW",
        "diagerr.xml",
        "EngineBegineSaveOperation couldn't create contents file",
        "SetEvent",
        "0(0H0X0|0",
        "Failed to backup PERMANENT event!!",
        ".rdata$zETW2",
        "WdsTerminate",
        "8f;:u",
        "QQSVW",
        "CopyFileExW",
        "SeqPublishImmediateAsync",
        "<%<.<6<><N<]<b<k<q<z<",
        "859 :F:w:",
        "Exception (code 0x%08X: %s) occurred at 0x%p in %s (+%p).",
        "0C2w2",
        "StartMinorTask",
        ".text$mn",
        "WdsEnableExit",
        "fACCESS_VIOLATION",
        "StandardSetupLogFormatter",
        "%s%s%d.%s",
        "kernel32",
        "CreateDirectoryW",
        "1 1K1[1",
        "Could not save save engine state for executing queue '%s'",
        "<null>",
        "?Q?X?",
        "D$,PQRS",
        "W9{HuI",
        "HWARE",
        "/0Q0`0u0",
        "WdsCollectionAddValue",
        "=$=(=H=d=h=",
        "GetCurrentProcess",
        "ExitProcess",
        "=U=^=c=o=y=3>C>L>Q>\\>",
        "ypGetOfflineQueue",
        "WdsCopyBlackboardItemsEx",
        "WdsAddUsmtLogStack",
        "Microsoft Windows0",
        "WdsGetTempDir",
        "PVh|X",
        "InitializedCriticalSection for pExecQueue->csLock;",
        "Could not set ExecQueue->hProcessAsyncEvent",
        "Could not alloc memory in WdsInitializeCallbackArray",
        "Could not start save operation for '%s'",
        "TlsFree",
        " Operating System",
        "CBlackboard::CheckAndRestoreIntegrity(%s) done with Result=%d",
        "%u-%u-%u",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "_initterm",
        ":0:7:C:L:f:m:y:",
        "D$4PQ",
        "> >=>P>Y>^>i>s>",
        "%d-%02d-%02d %02d:%02d:%02d,",
        "CMemoryManager::InitializeSharedControlBlock",
        "SetLastError",
        "1^1j1o1z1",
        "oK0D$\"<",
        "_lock",
        "?O?s?",
        "Successfully backed up PERMANENT event during SetNextExecutionGroup",
        "526O6a6j6o6z6",
        ".rdata$brc",
        "?!???Q?",
        "1#2\\2",
        "VWj(j",
        "WdsGetBlackboardStringW",
        "GetMinorTask",
        "No working dir has been given to panther.  Call WdsInitialize(Reinit=TRUE) to specify one (2nd msg)",
        "z.9Wv",
        "3=4K4",
        "8H8V8c8l8",
        "string",
        ">*>3>B>K>q>z>",
        "pSaveNewContentsFile",
        "WDS_DATA.Type == UINT32 but size != sizeof(UINT32)",
        "WdsLockExecutionGroup",
        "Directory %s is not useable by panther",
        ":!:-:8:Q:V:[:",
        "3H3T3Y3d3n3{3",
        ";FhtE",
        "6%656:6F6T6",
        "u$WSQ",
        "4(444T4\\4x4",
        "7O8W8c8",
        "timestamp",
        "Hbg&~",
        ".rdata$zETW9",
        "9/:6:g:",
        "Y9pe},L`",
        "W ;P ",
        "9[:b:",
        "WdsDestroyBlackboard",
        "WdsPublishImmediateAsync() -- Invalid event data submitted by '%s': %s",
        "TlP0X",
        "7$7>7I7N7Z7g7",
        "&amp;",
        "WdsGetPointer",
        "?X?a?f?q?{?",
        "1+2C2p2",
        "nOF_Close",
        ".rdata$sxdata",
        "(sizeof(SValue) + ((SValue *)Node.GetBuffer())->uiNameSize + ((SValue *)Node.GetBuffer())->uiSize) != uiItemSize",
        "stringcchprintf failed for '%s'",
        "LockResource",
        ":&:H:T:o:v:",
        "RemoveDirectoryW",
        "PSSSSSSSj",
        "Couldn't reset ExecQueue->hStopWorkerThreads",
        "GetSystemTimeAsFileTime",
        "memset",
        "D$0j\\P",
        "GetTickCount",
        "888X8x8",
        "\\\\.\\SAC",
        "onecore\\base\\ntsetup\\panther\\engine\\objectfile.c",
        "8)92979B9M9",
        "SACSetupAct",
        "LocalFree",
        "setuplog.xml",
        "WdsPublishImmediateEx() -- Invalid event data submitted by '%s': %s",
        "pMergePersistentQueue - Prepending Group %d: %s",
        "ProductName",
        "495R5",
        "CreateProcessA",
        "=F=M=U=d=l=",
        "<(</<P<",
        "pWorkerThreadFunc",
        "WdsDuplicateData",
        "_except_handler4_common",
        "ARRRR",
        "WdsGetBlackboardUintPtr",
        "7*878n8",
        "2 20292>2I2S2",
        "040d0l0t0|0",
        "848<8D8P8X8p8",
        "g_Kernel32",
        "WdsExecuteWorkQueue with WDS_START_EMPTY_QUEUE given 0 modules or 0 groups",
        "_wtoi",
        "5%5-595B5G5M5W5a5q5",
        ">+?9?B?K?T?d?r?|?",
        "SetFileTime",
        "tR9N tM9N$tH9N(tC9N,t>9NDt9",
        "diagwrn.xml",
        "<s:Schema id=\"RowsetSchema\">",
        "DeleteCriticalSection for pExecQueue->csLock;",
        "%Microsoft Windows Production PCA 20110",
        "6:7F7K7V7`7",
        "WDS_DATA.Type == UINT64, but size != sizeof(UINT64)",
        "6 7,717<7F7",
        "5 5}5",
        "GetPrivateProfileStringW",
        "I0G1-0+",
        "WdsGetSetupLog",
        " Microsoft Corporation. All rights reserved.",
        "PShL:",
        "WdsFreeCollection",
        "XMLLogFormatter",
        "HeapValidate",
        "7A7G7R7[7p7}7",
        "FlushFileBuffers",
        "SeqGetCurrentExecutionGroup",
        "!This program cannot be run in DOS mode.",
        "9_ht ",
        "D$8j\\P",
        "1A2[2",
        "GetExitCodeProcess",
        ">8>S>o>",
        "=0=?=F=W=^=h=z=",
        "9$939=9_9e9n9}9",
        "Couldn't find queue '%s' in contents file",
        "WDS_DATA.Type == BINARY, STRING, or STRING_ANSI, but other members of WDS_DATA are zero!",
        "GetDiskFreeSpaceExW",
        ";?;N;q;",
        "OpenThreadToken",
        "SEQ EVENT_SERIALIZE_BEFORE_EXIT Received.  Will only save modules with persistent subscriptions!",
        "WdsSetupLogMessageA",
        "3A3U3",
        "OpenProcessToken",
        "PShTO",
        "CloseHandle",
        "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0",
        "<9<B<G<R<\\<",
        ".CBlackboard::FindValue",
        "WriteFile",
        ":/:B:R:b:r:",
        "GetVersion",
        ";&;n;u;",
        "FileVersion",
        ".rdata$zzzdbg",
        "Failed to initialize setup modules",
        "9Klw^r",
        "GetFileType",
        "%-20S %-21S [0x%06x] %S",
        "CreateThread"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "4a62f83c1c3949075bd454be65a0cdd436915312364d6094529bb453fd45a654",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/4a62f83c1c3949075bd454be65a0cdd436915312364d6094529bb453fd45a654",
              "guest_paths": [
                "overlay"
              ],
              "size": 8504,
              "crc32": "D99795F9",
              "md5": "581e472239818b99d4ed41fbad00d2cb",
              "sha1": "a641ce56ebf6dac4f88a21bb69c61346586f665b",
              "sha256": "4a62f83c1c3949075bd454be65a0cdd436915312364d6094529bb453fd45a654",
              "sha512": "64b193ffa00642210789a4cc21d502c1aaffb96c8cdd2940a6f1881c9c4bea18001abe989d1f305d9c4dc9bd4c5184a73fae28dfabfa4b080623864add5f1ddf",
              "rh_hash": null,
              "ssdeep": "192:8r8VHwDDBQABJz9SkyaVAGqnajsH0u+vufux:8r6wDDBRJz9SSlQH0RvuY",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T1BF023BD1CF681403E662BC40539CE9833D3C53DF696584A5258AF9D91CCB3CADF486AE",
              "sha3_384": "ae7586c60608191f211a92cfe6dd643419aa57c5e4b90749f4440408e947cd1b3930bbf33820102eddbe55b8e18fda22",
              "data": null
            }
          ],
          "extracted_files_time": 0.0005025069986004382,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "wdstptc.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/48ee94546c9345fbe5ad1a51f4826b131da554a8e4395e5d22e4cde09b3816d5",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\wdstptc.dll"
      ],
      "size": 516032,
      "crc32": "3285598C",
      "md5": "7a020a931614e1a7ca1db482d1c00ede",
      "sha1": "782fadd14783d0a10520294e4e69036adb556e53",
      "sha256": "48ee94546c9345fbe5ad1a51f4826b131da554a8e4395e5d22e4cde09b3816d5",
      "sha512": "7de656c091c95d91c6a78115beb497afd11fbccb1b47d3f7557d0ab1d3e52eb2a2060e640222d445d6859a7c1813901653cc77bba0d21e1dcb46aaa413a17430",
      "rh_hash": null,
      "ssdeep": "12288:6ZTPK4dHSyYHxUpt3NIqct9awKFaLXDXjjf2Uxg8NcTki1NgLOi7TW/P2PxxQ:6FlJSbkt3yLXDXjjfF+L2nQ",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T155B48E5375D055F5E6B379316A38627A56BDB7600B60C0CF13204FB5BA30AC1EA36B2B",
      "sha3_384": "f226c5e9c229e011e7c1343ac762d68cf9f252fc7cf5cba2fea7539638995e38ab5899cdec50299156ab9548c53942e5",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x00073dc0",
        "ep_bytes": "8bff558bec837d0c017505e8d5050000",
        "peid_signatures": null,
        "reported_checksum": "0x00084c00",
        "actual_checksum": "0x00084c00",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "wdstptc.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x1007738c",
                "name": "memcpy"
              },
              {
                "address": "0x10077390",
                "name": "memcmp"
              },
              {
                "address": "0x10077394",
                "name": "_ftol2"
              },
              {
                "address": "0x10077398",
                "name": "_vsnprintf"
              },
              {
                "address": "0x1007739c",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x100773a0",
                "name": "wprintf"
              },
              {
                "address": "0x100773a4",
                "name": "memmove"
              },
              {
                "address": "0x100773a8",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x100773ac",
                "name": "srand"
              },
              {
                "address": "0x100773b0",
                "name": "rand"
              },
              {
                "address": "0x100773b4",
                "name": "towupper"
              },
              {
                "address": "0x100773b8",
                "name": "wcsstr"
              },
              {
                "address": "0x100773bc",
                "name": "iswspace"
              },
              {
                "address": "0x100773c0",
                "name": "wcschr"
              },
              {
                "address": "0x100773c4",
                "name": "wcsrchr"
              },
              {
                "address": "0x100773c8",
                "name": "_wtoi"
              },
              {
                "address": "0x100773cc",
                "name": "_stricmp"
              },
              {
                "address": "0x100773d0",
                "name": "strtoul"
              },
              {
                "address": "0x100773d4",
                "name": "_strtoui64"
              },
              {
                "address": "0x100773d8",
                "name": "swscanf_s"
              },
              {
                "address": "0x100773dc",
                "name": "wcsnlen"
              },
              {
                "address": "0x100773e0",
                "name": "wcsncmp"
              },
              {
                "address": "0x100773e4",
                "name": "_wcstoi64"
              },
              {
                "address": "0x100773e8",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x100773ec",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x100773f0",
                "name": "_onexit"
              },
              {
                "address": "0x100773f4",
                "name": "__dllonexit"
              },
              {
                "address": "0x100773f8",
                "name": "_unlock"
              },
              {
                "address": "0x100773fc",
                "name": "_lock"
              },
              {
                "address": "0x10077400",
                "name": "_initterm"
              },
              {
                "address": "0x10077404",
                "name": "_amsg_exit"
              },
              {
                "address": "0x10077408",
                "name": "_XcptFilter"
              },
              {
                "address": "0x1007740c",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x10077410",
                "name": "_callnewh"
              },
              {
                "address": "0x10077414",
                "name": "?what@exception@@UBEPBDXZ"
              },
              {
                "address": "0x10077418",
                "name": "??1exception@@UAE@XZ"
              },
              {
                "address": "0x1007741c",
                "name": "??0exception@@QAE@ABV0@@Z"
              },
              {
                "address": "0x10077420",
                "name": "??0exception@@QAE@XZ"
              },
              {
                "address": "0x10077424",
                "name": "malloc"
              },
              {
                "address": "0x10077428",
                "name": "free"
              },
              {
                "address": "0x1007742c",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x10077430",
                "name": "_wcsicmp"
              },
              {
                "address": "0x10077434",
                "name": "memcpy_s"
              },
              {
                "address": "0x10077438",
                "name": "qsort_s"
              },
              {
                "address": "0x1007743c",
                "name": "_vscwprintf"
              },
              {
                "address": "0x10077440",
                "name": "qsort"
              },
              {
                "address": "0x10077444",
                "name": "strcpy_s"
              },
              {
                "address": "0x10077448",
                "name": "memmove_s"
              },
              {
                "address": "0x1007744c",
                "name": "_purecall"
              },
              {
                "address": "0x10077450",
                "name": "memset"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x100770c4",
                "name": "TlsSetValue"
              },
              {
                "address": "0x100770c8",
                "name": "TlsFree"
              },
              {
                "address": "0x100770cc",
                "name": "TlsAlloc"
              },
              {
                "address": "0x100770d0",
                "name": "GetSystemTimes"
              },
              {
                "address": "0x100770d4",
                "name": "GetFileSizeEx"
              },
              {
                "address": "0x100770d8",
                "name": "WriteFile"
              },
              {
                "address": "0x100770dc",
                "name": "SetFileValidData"
              },
              {
                "address": "0x100770e0",
                "name": "SetEndOfFile"
              },
              {
                "address": "0x100770e4",
                "name": "SetFilePointerEx"
              },
              {
                "address": "0x100770e8",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x100770ec",
                "name": "GetCurrentThread"
              },
              {
                "address": "0x100770f0",
                "name": "CreateFileW"
              },
              {
                "address": "0x100770f4",
                "name": "QueueUserWorkItem"
              },
              {
                "address": "0x100770f8",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x100770fc",
                "name": "GetVersionExW"
              },
              {
                "address": "0x10077100",
                "name": "CreateEventW"
              },
              {
                "address": "0x10077104",
                "name": "SetEvent"
              },
              {
                "address": "0x10077108",
                "name": "Sleep"
              },
              {
                "address": "0x1007710c",
                "name": "TlsGetValue"
              },
              {
                "address": "0x10077110",
                "name": "ReadFile"
              },
              {
                "address": "0x10077114",
                "name": "WaitForSingleObjectEx"
              },
              {
                "address": "0x10077118",
                "name": "ChangeTimerQueueTimer"
              },
              {
                "address": "0x1007711c",
                "name": "CreateTimerQueueTimer"
              },
              {
                "address": "0x10077120",
                "name": "GetSystemInfo"
              },
              {
                "address": "0x10077124",
                "name": "SleepEx"
              },
              {
                "address": "0x10077128",
                "name": "GetComputerNameW"
              },
              {
                "address": "0x1007712c",
                "name": "SwitchToThread"
              },
              {
                "address": "0x10077130",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x10077134",
                "name": "DeleteTimerQueueTimer"
              },
              {
                "address": "0x10077138",
                "name": "GetLastError"
              },
              {
                "address": "0x1007713c",
                "name": "GlobalMemoryStatusEx"
              },
              {
                "address": "0x10077140",
                "name": "InterlockedPopEntrySList"
              },
              {
                "address": "0x10077144",
                "name": "InterlockedPushEntrySList"
              },
              {
                "address": "0x10077148",
                "name": "InitializeSListHead"
              },
              {
                "address": "0x1007714c",
                "name": "SetLastError"
              },
              {
                "address": "0x10077150",
                "name": "ResetEvent"
              },
              {
                "address": "0x10077154",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x10077158",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x1007715c",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x10077160",
                "name": "GetTickCount"
              },
              {
                "address": "0x10077164",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x10077168",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x1007716c",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x10077170",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x10077174",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x10077178",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x1007717c",
                "name": "TerminateProcess"
              },
              {
                "address": "0x10077180",
                "name": "CloseHandle"
              },
              {
                "address": "0x10077184",
                "name": "RaiseException"
              },
              {
                "address": "0x10077188",
                "name": "GetLongPathNameW"
              },
              {
                "address": "0x1007718c",
                "name": "GetTempPathW"
              },
              {
                "address": "0x10077190",
                "name": "GetFileInformationByHandleEx"
              },
              {
                "address": "0x10077194",
                "name": "GetFileInformationByHandle"
              },
              {
                "address": "0x10077198",
                "name": "SleepConditionVariableSRW"
              },
              {
                "address": "0x1007719c",
                "name": "WakeAllConditionVariable"
              },
              {
                "address": "0x100771a0",
                "name": "AcquireSRWLockExclusive"
              },
              {
                "address": "0x100771a4",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x100771a8",
                "name": "GetVolumePathNamesForVolumeNameW"
              },
              {
                "address": "0x100771ac",
                "name": "GetVolumeNameForVolumeMountPointW"
              },
              {
                "address": "0x100771b0",
                "name": "SetFileTime"
              },
              {
                "address": "0x100771b4",
                "name": "DosDateTimeToFileTime"
              },
              {
                "address": "0x100771b8",
                "name": "WaitForMultipleObjectsEx"
              },
              {
                "address": "0x100771bc",
                "name": "CreateSemaphoreExW"
              },
              {
                "address": "0x100771c0",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x100771c4",
                "name": "GetVolumeInformationByHandleW"
              },
              {
                "address": "0x100771c8",
                "name": "UnmapViewOfFile"
              },
              {
                "address": "0x100771cc",
                "name": "MapViewOfFile"
              },
              {
                "address": "0x100771d0",
                "name": "OutputDebugStringA"
              },
              {
                "address": "0x100771d4",
                "name": "GetEnvironmentVariableW"
              },
              {
                "address": "0x100771d8",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x100771dc",
                "name": "GetProcAddress"
              },
              {
                "address": "0x100771e0",
                "name": "SetEnvironmentVariableW"
              },
              {
                "address": "0x100771e4",
                "name": "OutputDebugStringW"
              },
              {
                "address": "0x100771e8",
                "name": "QueryPerformanceFrequency"
              },
              {
                "address": "0x100771ec",
                "name": "CreateSemaphoreW"
              },
              {
                "address": "0x100771f0",
                "name": "ReleaseSemaphore"
              },
              {
                "address": "0x100771f4",
                "name": "CreateIoCompletionPort"
              },
              {
                "address": "0x100771f8",
                "name": "CreateThread"
              },
              {
                "address": "0x100771fc",
                "name": "PostQueuedCompletionStatus"
              },
              {
                "address": "0x10077200",
                "name": "WaitForMultipleObjects"
              },
              {
                "address": "0x10077204",
                "name": "GetQueuedCompletionStatus"
              },
              {
                "address": "0x10077208",
                "name": "WideCharToMultiByte"
              },
              {
                "address": "0x1007720c",
                "name": "MultiByteToWideChar"
              },
              {
                "address": "0x10077210",
                "name": "LocalFileTimeToFileTime"
              },
              {
                "address": "0x10077214",
                "name": "GetFullPathNameW"
              },
              {
                "address": "0x10077218",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x1007721c",
                "name": "FindFirstFileW"
              },
              {
                "address": "0x10077220",
                "name": "SetFileAttributesW"
              },
              {
                "address": "0x10077224",
                "name": "FindNextFileW"
              },
              {
                "address": "0x10077228",
                "name": "FindClose"
              },
              {
                "address": "0x1007722c",
                "name": "CreateDirectoryW"
              },
              {
                "address": "0x10077230",
                "name": "LocalFree"
              },
              {
                "address": "0x10077234",
                "name": "GetCurrentDirectoryW"
              },
              {
                "address": "0x10077238",
                "name": "GetSystemDirectoryW"
              },
              {
                "address": "0x1007723c",
                "name": "GetVolumePathNameW"
              },
              {
                "address": "0x10077240",
                "name": "GetVolumeInformationW"
              },
              {
                "address": "0x10077244",
                "name": "DeleteFileW"
              },
              {
                "address": "0x10077248",
                "name": "RemoveDirectoryW"
              },
              {
                "address": "0x1007724c",
                "name": "LoadLibraryW"
              },
              {
                "address": "0x10077250",
                "name": "FreeLibrary"
              },
              {
                "address": "0x10077254",
                "name": "GetHandleInformation"
              },
              {
                "address": "0x10077258",
                "name": "DeviceIoControl"
              },
              {
                "address": "0x1007725c",
                "name": "GetOverlappedResult"
              },
              {
                "address": "0x10077260",
                "name": "SetFileInformationByHandle"
              },
              {
                "address": "0x10077264",
                "name": "CreateFileMappingW"
              },
              {
                "address": "0x10077268",
                "name": "HeapFree"
              },
              {
                "address": "0x1007726c",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x10077270",
                "name": "CompareStringW"
              },
              {
                "address": "0x10077274",
                "name": "HeapAlloc"
              },
              {
                "address": "0x10077278",
                "name": "FlushFileBuffers"
              },
              {
                "address": "0x1007727c",
                "name": "HeapReAlloc"
              },
              {
                "address": "0x10077280",
                "name": "GetDriveTypeW"
              },
              {
                "address": "0x10077284",
                "name": "SetThreadIdealProcessor"
              },
              {
                "address": "0x10077288",
                "name": "GetFinalPathNameByHandleW"
              },
              {
                "address": "0x1007728c",
                "name": "InitializeCriticalSectionAndSpinCount"
              },
              {
                "address": "0x10077290",
                "name": "SetFilePointer"
              },
              {
                "address": "0x10077294",
                "name": "LockFileEx"
              },
              {
                "address": "0x10077298",
                "name": "UnlockFileEx"
              },
              {
                "address": "0x1007729c",
                "name": "LocalAlloc"
              },
              {
                "address": "0x100772a0",
                "name": "OpenProcess"
              },
              {
                "address": "0x100772a4",
                "name": "CopyFileExW"
              },
              {
                "address": "0x100772a8",
                "name": "DuplicateHandle"
              },
              {
                "address": "0x100772ac",
                "name": "GetPrivateProfileSectionW"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x10077000",
                "name": "OpenProcessToken"
              },
              {
                "address": "0x10077004",
                "name": "GetSecurityDescriptorControl"
              },
              {
                "address": "0x10077008",
                "name": "RegCloseKey"
              },
              {
                "address": "0x1007700c",
                "name": "RegOpenKeyExW"
              },
              {
                "address": "0x10077010",
                "name": "RegCreateKeyExW"
              },
              {
                "address": "0x10077014",
                "name": "RegQueryValueExW"
              },
              {
                "address": "0x10077018",
                "name": "RegSetValueExW"
              },
              {
                "address": "0x1007701c",
                "name": "RegDeleteValueW"
              },
              {
                "address": "0x10077020",
                "name": "GetSecurityDescriptorOwner"
              },
              {
                "address": "0x10077024",
                "name": "GetSecurityDescriptorGroup"
              },
              {
                "address": "0x10077028",
                "name": "GetSecurityDescriptorDacl"
              },
              {
                "address": "0x1007702c",
                "name": "GetSecurityDescriptorSacl"
              },
              {
                "address": "0x10077030",
                "name": "GetSecurityDescriptorLength"
              },
              {
                "address": "0x10077034",
                "name": "GetAclInformation"
              },
              {
                "address": "0x10077038",
                "name": "RegLoadKeyW"
              },
              {
                "address": "0x1007703c",
                "name": "RegFlushKey"
              },
              {
                "address": "0x10077040",
                "name": "RegUnLoadKeyW"
              },
              {
                "address": "0x10077044",
                "name": "OpenEncryptedFileRawW"
              },
              {
                "address": "0x10077048",
                "name": "WriteEncryptedFileRaw"
              },
              {
                "address": "0x1007704c",
                "name": "CloseEncryptedFileRaw"
              },
              {
                "address": "0x10077050",
                "name": "CryptReleaseContext"
              },
              {
                "address": "0x10077054",
                "name": "CryptAcquireContextW"
              },
              {
                "address": "0x10077058",
                "name": "CryptImportKey"
              },
              {
                "address": "0x1007705c",
                "name": "CryptDestroyKey"
              },
              {
                "address": "0x10077060",
                "name": "CryptSignHashW"
              },
              {
                "address": "0x10077064",
                "name": "CryptVerifySignatureW"
              },
              {
                "address": "0x10077068",
                "name": "CryptGetHashParam"
              },
              {
                "address": "0x1007706c",
                "name": "CryptDestroyHash"
              },
              {
                "address": "0x10077070",
                "name": "CryptSetHashParam"
              },
              {
                "address": "0x10077074",
                "name": "CryptHashData"
              },
              {
                "address": "0x10077078",
                "name": "CryptCreateHash"
              },
              {
                "address": "0x1007707c",
                "name": "RevertToSelf"
              },
              {
                "address": "0x10077080",
                "name": "ImpersonateLoggedOnUser"
              },
              {
                "address": "0x10077084",
                "name": "AdjustTokenPrivileges"
              },
              {
                "address": "0x10077088",
                "name": "PrivilegeCheck"
              },
              {
                "address": "0x1007708c",
                "name": "LookupPrivilegeValueW"
              },
              {
                "address": "0x10077090",
                "name": "OpenThreadToken"
              }
            ]
          },
          "WS2_32": {
            "dll": "WS2_32.dll",
            "imports": [
              {
                "address": "0x10077320",
                "name": "WSACleanup"
              },
              {
                "address": "0x10077324",
                "name": "GetAddrInfoW"
              },
              {
                "address": "0x10077328",
                "name": "FreeAddrInfoW"
              },
              {
                "address": "0x1007732c",
                "name": "ntohl"
              },
              {
                "address": "0x10077330",
                "name": "htonl"
              },
              {
                "address": "0x10077334",
                "name": "WSAAddressToStringW"
              },
              {
                "address": "0x10077338",
                "name": "WSAIoctl"
              },
              {
                "address": "0x1007733c",
                "name": "WSAStartup"
              },
              {
                "address": "0x10077340",
                "name": "inet_addr"
              },
              {
                "address": "0x10077344",
                "name": "closesocket"
              },
              {
                "address": "0x10077348",
                "name": "setsockopt"
              },
              {
                "address": "0x1007734c",
                "name": "bind"
              },
              {
                "address": "0x10077350",
                "name": "htons"
              },
              {
                "address": "0x10077354",
                "name": "WSASocketW"
              },
              {
                "address": "0x10077358",
                "name": "ntohs"
              },
              {
                "address": "0x1007735c",
                "name": "WSASendTo"
              },
              {
                "address": "0x10077360",
                "name": "WSARecvFrom"
              },
              {
                "address": "0x10077364",
                "name": "WSAGetLastError"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x10077458",
                "name": "RtlImpersonateSelf"
              },
              {
                "address": "0x1007745c",
                "name": "NtSetEaFile"
              },
              {
                "address": "0x10077460",
                "name": "RtlDeleteResource"
              },
              {
                "address": "0x10077464",
                "name": "RtlReleaseResource"
              },
              {
                "address": "0x10077468",
                "name": "RtlAcquireResourceShared"
              },
              {
                "address": "0x1007746c",
                "name": "RtlAcquireResourceExclusive"
              },
              {
                "address": "0x10077470",
                "name": "RtlInitializeResource"
              },
              {
                "address": "0x10077474",
                "name": "RtlFreeHeap"
              },
              {
                "address": "0x10077478",
                "name": "NtClose"
              },
              {
                "address": "0x1007747c",
                "name": "NtCreateFile"
              },
              {
                "address": "0x10077480",
                "name": "RtlDosPathNameToNtPathName_U"
              },
              {
                "address": "0x10077484",
                "name": "NtSetInformationFile"
              },
              {
                "address": "0x10077488",
                "name": "RtlAllocateHeap"
              },
              {
                "address": "0x1007748c",
                "name": "NtQueryVolumeInformationFile"
              },
              {
                "address": "0x10077490",
                "name": "NtSetSecurityObject"
              },
              {
                "address": "0x10077494",
                "name": "RtlFindAceByType"
              },
              {
                "address": "0x10077498",
                "name": "RtlSetControlSecurityDescriptor"
              },
              {
                "address": "0x1007749c",
                "name": "RtlGetLastNtStatus"
              },
              {
                "address": "0x100774a0",
                "name": "RtlGetVersion"
              },
              {
                "address": "0x100774a4",
                "name": "RtlReAllocateHeap"
              },
              {
                "address": "0x100774a8",
                "name": "RtlRaiseStatus"
              },
              {
                "address": "0x100774ac",
                "name": "NtYieldExecution"
              },
              {
                "address": "0x100774b0",
                "name": "NtQueryInformationProcess"
              },
              {
                "address": "0x100774b4",
                "name": "NtQueryInformationFile"
              },
              {
                "address": "0x100774b8",
                "name": "RtlNtStatusToDosError"
              },
              {
                "address": "0x100774bc",
                "name": "RtlAdjustPrivilege"
              },
              {
                "address": "0x100774c0",
                "name": "RtlInitializeCriticalSection"
              }
            ]
          },
          "VERSION": {
            "dll": "VERSION.dll",
            "imports": [
              {
                "address": "0x100772e0",
                "name": "GetFileVersionInfoExW"
              },
              {
                "address": "0x100772e4",
                "name": "VerQueryValueW"
              },
              {
                "address": "0x100772e8",
                "name": "GetFileVersionInfoSizeExW"
              }
            ]
          },
          "WDSCSL": {
            "dll": "WDSCSL.dll",
            "imports": [
              {
                "address": "0x100772f0",
                "name": "WdsClientExecute"
              },
              {
                "address": "0x100772f4",
                "name": "WdsClientInitializeLibrary"
              },
              {
                "address": "0x100772f8",
                "name": "WdsClientFreeLibrary"
              },
              {
                "address": "0x100772fc",
                "name": "WdsCpParameterQuery"
              },
              {
                "address": "0x10077300",
                "name": "WdsCpPacketInitialize"
              },
              {
                "address": "0x10077304",
                "name": "WdsCpParameterValidate"
              },
              {
                "address": "0x10077308",
                "name": "WdsCpRecvPacketInitialize"
              },
              {
                "address": "0x1007730c",
                "name": "WdsCpPacketGetBuffer"
              },
              {
                "address": "0x10077310",
                "name": "WdsCpPacketRelease"
              },
              {
                "address": "0x10077314",
                "name": "WdsClientPacketFree"
              },
              {
                "address": "0x10077318",
                "name": "WdsCpParameterAdd"
              }
            ]
          },
          "bcrypt": {
            "dll": "bcrypt.dll",
            "imports": [
              {
                "address": "0x1007736c",
                "name": "BCryptCloseAlgorithmProvider"
              },
              {
                "address": "0x10077370",
                "name": "BCryptDestroyHash"
              },
              {
                "address": "0x10077374",
                "name": "BCryptFinishHash"
              },
              {
                "address": "0x10077378",
                "name": "BCryptOpenAlgorithmProvider"
              },
              {
                "address": "0x1007737c",
                "name": "BCryptGetProperty"
              },
              {
                "address": "0x10077380",
                "name": "BCryptCreateHash"
              },
              {
                "address": "0x10077384",
                "name": "BCryptHashData"
              }
            ]
          },
          "FLTLIB": {
            "dll": "FLTLIB.DLL",
            "imports": [
              {
                "address": "0x100770a8",
                "name": "FilterAttach"
              },
              {
                "address": "0x100770ac",
                "name": "FilterLoad"
              }
            ]
          },
          "Cabinet": {
            "dll": "Cabinet.dll",
            "imports": []
          },
          "IPHLPAPI": {
            "dll": "IPHLPAPI.DLL",
            "imports": [
              {
                "address": "0x100770b4",
                "name": "AddIPAddress"
              },
              {
                "address": "0x100770b8",
                "name": "GetAdaptersAddresses"
              },
              {
                "address": "0x100770bc",
                "name": "GetIfTable"
              }
            ]
          },
          "RPCRT4": {
            "dll": "RPCRT4.dll",
            "imports": [
              {
                "address": "0x100772c4",
                "name": "I_RpcMapWin32Status"
              },
              {
                "address": "0x100772c8",
                "name": "UuidCreate"
              },
              {
                "address": "0x100772cc",
                "name": "UuidToStringW"
              },
              {
                "address": "0x100772d0",
                "name": "RpcStringFreeW"
              }
            ]
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x100772b4",
                "name": "SysFreeString"
              },
              {
                "address": "0x100772b8",
                "name": "SetErrorInfo"
              },
              {
                "address": "0x100772bc",
                "name": "GetErrorInfo"
              }
            ]
          },
          "USER32": {
            "dll": "USER32.dll",
            "imports": [
              {
                "address": "0x100772d8",
                "name": "CharUpperW"
              }
            ]
          }
        },
        "exported_dll_name": "WDSTPTC.dll",
        "exports": [
          {
            "address": "0x10018550",
            "name": "WdsTptcDownload",
            "ordinal": 1
          },
          {
            "address": "0x1000e7c0",
            "name": "WdsTransportClientAddRefBuffer",
            "ordinal": 7
          },
          {
            "address": "0x1000e8f0",
            "name": "WdsTransportClientApplyImage",
            "ordinal": 2
          },
          {
            "address": "0x1000e6d0",
            "name": "WdsTransportClientCancelSession",
            "ordinal": 8
          },
          {
            "address": "0x1000e6f0",
            "name": "WdsTransportClientCancelSessionEx",
            "ordinal": 9
          },
          {
            "address": "0x1000e5e0",
            "name": "WdsTransportClientCloseSession",
            "ordinal": 10
          },
          {
            "address": "0x1000e860",
            "name": "WdsTransportClientCompleteReceive",
            "ordinal": 11
          },
          {
            "address": "0x1000eaf0",
            "name": "WdsTransportClientElSetLogFunction",
            "ordinal": 3
          },
          {
            "address": "0x1000eb10",
            "name": "WdsTransportClientElSetLogFunctionEx",
            "ordinal": 4
          },
          {
            "address": "0x1000e9d0",
            "name": "WdsTransportClientGetAggressiveBufferSize",
            "ordinal": 5
          },
          {
            "address": "0x1000e510",
            "name": "WdsTransportClientInitialize",
            "ordinal": 12
          },
          {
            "address": "0x1000e5c0",
            "name": "WdsTransportClientInitializeSession",
            "ordinal": 13
          },
          {
            "address": "0x1000e760",
            "name": "WdsTransportClientQueryStatus",
            "ordinal": 14
          },
          {
            "address": "0x1000e600",
            "name": "WdsTransportClientRegisterCallback",
            "ordinal": 15
          },
          {
            "address": "0x1000e8d0",
            "name": "WdsTransportClientRegisterTrace",
            "ordinal": 6
          },
          {
            "address": "0x1000e810",
            "name": "WdsTransportClientReleaseBuffer",
            "ordinal": 16
          },
          {
            "address": "0x1000e5a0",
            "name": "WdsTransportClientShutdown",
            "ordinal": 17
          },
          {
            "address": "0x1000e670",
            "name": "WdsTransportClientStartSession",
            "ordinal": 18
          },
          {
            "address": "0x1000e710",
            "name": "WdsTransportClientWaitForCompletion",
            "ordinal": 19
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x00075a50",
            "size": "0x00000353"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x000774cc",
            "size": "0x0000012c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x0007a000",
            "size": "0x00000428"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x0007be00",
            "size": "0x000021c0"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x0007b000",
            "size": "0x00003f3c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x0000db60",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x0000187c",
            "size": "0x00000018"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x000017d0",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x00077000",
            "size": "0x000004c8"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x00074da3",
            "size_of_data": "0x00074e00",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.58"
          },
          {
            "name": ".data",
            "raw_address": "0x00075200",
            "virtual_address": "0x00076000",
            "virtual_size": "0x00000f44",
            "size_of_data": "0x00000400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "4.43"
          },
          {
            "name": ".idata",
            "raw_address": "0x00075600",
            "virtual_address": "0x00077000",
            "virtual_size": "0x00002060",
            "size_of_data": "0x00002200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.54"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x00077800",
            "virtual_address": "0x0007a000",
            "virtual_size": "0x00000428",
            "size_of_data": "0x00000600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "2.55"
          },
          {
            "name": ".reloc",
            "raw_address": "0x00077e00",
            "virtual_address": "0x0007b000",
            "virtual_size": "0x00003f3c",
            "size_of_data": "0x00004000",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.77"
          }
        ],
        "overlay": {
          "offset": "0x0007be00",
          "size": "0x000021c0"
        },
        "resources": [
          {
            "name": "RT_VERSION",
            "offset": "0x0007a060",
            "size": "0x000003c8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.50"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows Deployment Services Transport Client"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "wdstptc.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "wdstptc.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "3c65f6ec79947836caf6d8cb89f3bacb",
        "timestamp": "1999-06-29 22:16:48",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 14
      },
      "data": null,
      "strings": [
        "MCTPConstruct[ACK]: Session=0x%x, Client=0x%x, Seq#=%I64u, HiOData#=%I64u, LossRate=%.16lf",
        "WimImageEnqueueOperation",
        "s,QQh",
        "6A7H7W7m7",
        "5:6i6s6",
        ".CRT$XLA",
        "jchx\"",
        "RestoreFileMetadata: RestoreFileInfo failed",
        "PQQhl",
        "Microsoft Time-Stamp Service",
        ";~4sj",
        "DeleteTimerQueueTimer",
        "94:?:m:",
        "\\\\.\\?:",
        "xaj&Y",
        "QPWSQQh",
        "http://www.w3.org/XML/1998/namespace",
        "RtlNtStatusToDosError",
        "EnableShortnamesOnApplyTarget",
        "%wNtE",
        "RestoreHardlink",
        "Compact",
        "WIMSetFileShortName",
        ">#>*>w>",
        "f92u9A",
        "#document",
        "?&?V?",
        "8 8N8i8",
        "CMicrodom_Blob",
        "malloc",
        "y0Vh[",
        "9sTtr",
        "QQQQj",
        "UCS-4",
        "WdsTransportClientRegisterTrace",
        "aNDO\\h",
        "NtQueryInformationProcess",
        "QQVW3",
        "<w<8=^=~=",
        "RegCreateKeyExW",
        "PUBLIC",
        "9#:d:|:",
        "DuplicateHandle",
        "UnmapViewOfFile",
        "Substitue name string copy failed",
        ">*>G>",
        "<%<,<7<",
        "Cf9Y*",
        "QQSWj",
        "334L4z4",
        "D$PPhXz",
        "L$D_^[3",
        "9!949B9|9",
        "?-?;?K?g?",
        "WIM_Chunked_Number_Of_Buffers",
        "TFTPParse[Var ACK]: Block#=%u, WindowSize=%u",
        "SetFileValidData",
        "WIM_Chunked_Parallel_Decode",
        "ysWhE",
        "GetImageErrorCode",
        "4!464A4a4",
        "tGWj;P",
        "wcsstr",
        ":):s:",
        "system32",
        "QQQhl",
        "base\\eco\\wds\\transport\\client\\tptc\\tpcntperfinfo.cpp",
        "1`2e2",
        "OpenProcess",
        "SessionId",
        "QueueUserWorkItem",
        "[ybVhl",
        "MCTPParse[LEAVE:%I64x]: Session=0x%x, Client=0x%x, Reason=0x%x",
        "TerminateProcess",
        "2=3N3U3i3",
        "y6Vhj",
        "RestoreSecurityDescriptor failed",
        "s$97t",
        ".idata$5",
        "1(1_1j1",
        "t*WPd",
        "p%s%s%s",
        "CreatePath: Unable to create parent directory for [%s]; GLE = 0x%x",
        "8o8y8",
        "2=2l2",
        "2$2*21272=2Q2n2",
        "JOIN-ACK: ClientId=0x%x, RTT=%u, MinNACKBO=%ums, MaxNACKBO=%ums",
        "N,Ch@",
        "file corrupted in block at offset %p",
        "WDSTPTC",
        "Failed to get create a GUID.",
        "8,8e8{8",
        "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\LOWPART",
        "ResNodesSort",
        "RestoreAllData",
        "_purecall",
        "WIMCreateFile",
        "040904B0",
        "Microsoft Time-Stamp Service0",
        "t;j#j",
        "HeapFree",
        "m_uActiveReaders == 0 && m_ActiveWriter.m_uThreadId == 0 && m_uWaitingReaders == 0 && m_uWaitingWriters == 0",
        "Using backoff time %ums before processing POLL packet.",
        "swscanf_s",
        ".data$r$brc",
        "base\\eco\\wds\\wdslib\\crypt\\lib\\cryptstore.cpp",
        "jd+sX_",
        "TlsGetValue",
        "OpenEncryptedFileRawW",
        "Windows Deployment Services Transport Client",
        "base\\eco\\wds\\transport\\lib\\mcsepacket.cpp",
        "7B7M7",
        "\\Windows\\Syswow64\\",
        "SymKey",
        "0x%08X",
        "Session Details: Multicast Address=[%s:%u], Server Address=[%s:%u], Content Size=[%I64u], Total Blocks=[%I64u], Block Size=[%u], Session Id=[0x%x], Metadata Length=[%u], Security Mode=[0x%x], Sign Key=[%s], Symmetric Key=[%s], HMAC Algorithm=[%u], Hash Algorithm=[%u]",
        "1L2\\2}2F3V3",
        "Redmond1",
        "HashAlgId",
        "WdsTransportClientElSetLogFunctionEx",
        "ReadWimHeader",
        "DequeueWimData",
        ">2>9>r>",
        "DOCTYPE",
        "8[9i9",
        "ChunkWriterFlush",
        "LockFileEx",
        ">/>x>",
        "SSh @",
        "ENTITIES",
        "StringCchCopyN failed",
        "8\"878@8G8[8",
        "<==C>J>v>L?~?",
        "t$X9u t",
        "j\\Yf;",
        "m_ActiveWriter.m_uNestedReaders == 0 && m_ActiveWriter.m_uNestedWriters == 0",
        "364=4I4P4",
        "Multithreaded decoding for chunked WIM is enabled!",
        "<7<q<",
        "SQhhC",
        "SetFileStorageTierClass",
        "D$4_^[",
        "8O9V9\\9l9u9{9",
        ";9;u;",
        "8+828:8g8q8",
        "7(8/8l8v8",
        "\\Windows\\System32\\drivers\\wof.sys",
        "y,Who",
        "base\\eco\\wds\\transport\\client\\tptc\\apcntflowwindow.cpp",
        "RtlDosPathNameToNtPathName_U",
        "base\\eco\\wds\\transport\\client\\tptc\\tpcntjoin.cpp",
        "SQh(B",
        "5<LuP",
        "3\"3P3g3}3",
        "MapViewOfFile",
        "UncompressFile failed",
        "5#5S5]5",
        "t{PQh",
        "f+{ YRP",
        "8(9@9",
        "CreateSemaphoreExW",
        "<0=8=~=",
        "CheckProcessFile",
        "DosDateTimeToFileTime",
        "A<Au%",
        "$SVWh",
        "<G<Q<u<",
        "707P7p7",
        "u!jW^h",
        "WIMCopyFileEx failed",
        "9X9{9",
        "L$<_^[3",
        "8 8*8.8?8E8U8r82:",
        "|$4tG",
        ">8?C?L?W?d?z?",
        "2%2F2Z2h2",
        ",SVW3",
        ".xdata$x",
        "4H4`4",
        "RestoreHardlinks",
        "m_pReaderSlots[uIndex].m_uNestedReaders == 0",
        "D$,W3",
        "6F6j6",
        "xM9sdtF",
        "<&=0=Z=m=",
        "_vscwprintf",
        "Incorrect filesize. Could be corrupted",
        "Microsoft Corporation1",
        "D$@j(P3",
        "<;=N=",
        "WdsTransportClientReleaseBuffer",
        "^VShx",
        "230865+4584940",
        "<\"<9<C<[<r<",
        "StringFileInfo",
        "8T9[9k9",
        "Flow Window initialized - Starting Seq#=%I64u",
        "{L''mU",
        "N0L0J",
        "5%6E6W6y6",
        "r~akow",
        "[%S:%u] Expression: %S, Win32 Error=0x%x",
        "u<Vhx",
        "t$0Sh",
        "EnumHashListCallback",
        "949H9Y9`9",
        "9\":B:",
        "7/747L7t7",
        "Failed to delete the applied path.",
        "$WWWWW",
        "MCTPParse[JOIN-ACK:%I64x]: Session=0x%x, Client=0x%x, ClientTime=0x%I64x, MinNACKBO=%u, MaxNACKBO=%u, RTT=%ums",
        "GetAddrInfoW",
        "2P3~4",
        "|%s|%d|%I64d",
        "769F9S9",
        "tOf97tJh",
        "3%4i5n6-7J7",
        "t)j\\V",
        "t9f91t4",
        ";3rU;",
        "WaitForSingleObjectEx",
        "04080<0@0D0H0L0P0T0\\0`0d0h0l0p0",
        "EnumeratePathEx: Failed search path is >= MAX_PATH!",
        "u,=0u",
        ";6;A;I;",
        ":N:g:#=",
        "IDREF",
        "WSASendTo",
        "6 6@6",
        "WIM\\IMAGE[*]\\TOTALBYTES",
        "AllocateReadChunk",
        "6$696N6c6q6",
        "Failed to build path to ci.dll inside GUID folder.",
        "L$t_^[3",
        "'0.0L0",
        "SetSysVolInfoPath",
        "~(9~0t",
        "msftwindow",
        "L$$RP",
        "GetAdaptersAddresses",
        "818;8q8",
        "t'j\\W",
        "=/=5=a=",
        ".text$x",
        "WdsTransportClientCompleteReceive",
        "=p=t=x=|=",
        "?0?7?B?I?Y?",
        "2%2R2_2u2",
        ";;<B<",
        "L$L_^[3",
        "f;F$u",
        "Failed to set file extended attribute",
        ";A u3",
        "m_ActiveWriter.m_uNestedReaders == 0",
        "DeletePath: [%s] doesn't exist as a directory; nothing to delete.",
        "SVWPQ",
        "WimAtExitInitialize",
        "2-2;2W2",
        "2?2S2",
        "? ?+?g?s?",
        "QueryPerformanceFrequency(&liFrequency)",
        "K9=Tg",
        "IPHLPAPI.DLL",
        "9F sN",
        "101f1}1",
        "base\\eco\\wds\\transport\\client\\tptc\\tftpcntrequest.cpp",
        ";><H<P<",
        "RestoreStreams",
        "5E5P5X5",
        "7>7H7c7y7",
        "9t$ u39t$",
        "failed to extract file from reference extension",
        "9(909>9D9I9t9",
        "VarFileInfo",
        "Wait for work queue failed!",
        "fmalloc failed",
        "1d2{2",
        "3D4K4Q4a4g4o4v4{4",
        "20201009090804Z0t0:",
        "L$,!t$0!t$4",
        "V,9N,r",
        "pProcessResFileBackedByWim",
        "@(97u",
        "8)9M9X9S:f:",
        "MCTPConstruct[POLL-ACK]: Session=0x%x, Client=0x%x, Seq#=%I64u, AppDataLen=%u",
        "DeleteCriticalSection",
        "WSAAddressToStringW",
        "memmove",
        "AdjustTokenPrivileges",
        ";8;?;",
        "<WIM><TOTALBYTES>0</TOTALBYTES></WIM>",
        "base\\eco\\wds\\transport\\client\\tptc\\tpcntlossreport.cpp",
        "90C0y0",
        "91:*;:;E;m;u;",
        "0,02070{0",
        ";!;+;8;S;Y;i;v;",
        "WimAtExitReserve",
        "encoding",
        "Failed to get img event",
        "5;6B6M6",
        "1%1C1P1Z1(2E2X2_2k2",
        "040`0",
        "5d5{5",
        ">C>S>Z>g>n>w>",
        "_WSWf",
        "#wXsA",
        "D$0PQ",
        "181?1f1u1",
        "SVWj@3",
        "PQQVW",
        "CI EA is not supported because the host OS and applied image have a signature type mismatch.",
        "GetReaderSlot(uThreadId, &uIndex) == 0L",
        "=!=n=t=",
        ":(;/;",
        "5X5_5i5",
        "4.4s4}4",
        "?\"?W?|?",
        "EnumHashTable",
        "W950b",
        "HeapReAlloc",
        "UnlockFileEx",
        "QQPQQQQW",
        "TFTPParse[Request]: OpCode=%u, File=%s, Mode=%u, BlkSize=%u, WinSize=%u, Timeout=%u, TSize=%I64u, MsftWindow=%u",
        "j Yf;",
        "8e9b;o;",
        "System\\CurrentControlSet\\Services\\Wof",
        "l.sys",
        "535:5",
        "0\"141N1c1j1~1",
        "EnumeratePathEx: Unable to get reparse tag for persistent reparse point; GLE = 0x%x",
        "=E=P=",
        "Fail to read WIM header",
        "t$(VW",
        "Journaling is disabled on the applied volume.",
        "(SVW3",
        "DeleteFileEx: Unable to remove [%s]; GLE = 0x%x",
        "WofMob",
        "BCryptCloseAlgorithmProvider",
        "All NACKs processed. Wait Time=%ums",
        "<0<H<]<",
        "%wLtC",
        "^h9^lt",
        "Failed to remove wim entry when image apply failed.",
        "msvcrt.dll",
        "9W9]9t9{9",
        "SQhXB",
        "GlPQj",
        "^[w!QRW",
        "5)656",
        "GetCurrentThreadId",
        "3?4p4",
        "9+:s:",
        "A;N4r",
        "ContentMetadata",
        "Wait for work queue abandoned!",
        "iswspace",
        "Failed to build path to GUID folder.",
        "memmove_s",
        "FreeLibrary",
        "=\"=8=f=s=",
        "4>4H4",
        "3i3s3s4}5",
        "`.data",
        "WofAdk",
        "414E4[4",
        "ELEMENT",
        "@\\;B\\t",
        "TFTPConstruct[REQUEST]: File=%s, BlkSize=%u, WinSize=%u, MsftWindow=%u",
        "I_RpcMapWin32Status",
        "ReadChunk",
        "596s6y6",
        "1C2M2^2",
        "=B>Z>z>",
        "uIndex != 0xffffffffUL",
        "=+=5=",
        "t2hl@",
        "8D9b9i9u9|9",
        "ChunkWriterEnqueue",
        "WIM_Skip_WIMBoot_Check",
        "D$8PhXz",
        "!E\\H4",
        ">%>E>",
        "; ;%;Q;\\;b;g;",
        "nOa-Q",
        "bcrypt.dll",
        "FltCommStubCreateChild",
        "Fp<dv",
        "L$(@;E",
        "?$?J?Q?b?i?",
        "jWX_^[",
        "uw!\\$",
        "base\\eco\\wds\\transport\\client\\tptc\\tptapply.cpp",
        "SVWj<h",
        "7)707N7W7",
        "0Y1b1o1",
        "495>5N5",
        "T$ Wj",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z",
        "FX;GXu",
        "Parallel chunk decode queue empty; switching to synchronous decode",
        "t=jPj",
        "base\\eco\\wds\\transport\\client\\tptc\\tftpcntdata.cpp",
        ".CRT$XCA",
        "BCryptOpenAlgorithmProvider",
        "FLTLIB.DLL",
        "GetFileSizeEx",
        "9+9S9i9",
        "=B>S>e>",
        "SetFilePointer",
        "CryptVerifySignatureW",
        "=*>=>K>g>",
        ";$;I;a;r;",
        "WdsCpPacketRelease",
        "3 3E3}3",
        "4X4i4|4",
        "1'2-232E2N2S2g2o2{2",
        "SYSTEM\\CurrentControlSet\\Control\\MiniNT",
        "3 3'383?3X3p3",
        "7V8d8",
        "G@PQQh",
        "ReadDirEntry",
        "v`QPh",
        "9\\$Lt",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "XkZu=",
        "9K:P:",
        "2l3s3",
        "j:Xf;F",
        "IsApplyWIMBootCompliant",
        ">*>H>R>}>",
        "Namespace",
        "Fail to flush file buffers",
        "4>5H5",
        "5C5r5{5",
        "200304182929Z",
        "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\utility.c",
        "D$<Pj",
        "9HXu:9H\\u5",
        "u%SQh",
        "9%8YWDQ",
        "D$8PS",
        "WdsTransportClientApplyImage: Received unexpected file open request from WIMGAPI [%s]",
        "u(95ph",
        "$Microsoft Ireland Operations Limited1&0$",
        "9,9H9P9T9\\9`9h9l9t9x9",
        "???p?",
        "MCTPParse[POLL-ACK:%I64x] Session=0x%x, Client=0x%x, Seq#=%I64u, DataLen=%u",
        "5 5'5.555<5C5J5R5Z5b5n5w5|5",
        "1&262?2R2]2f2{2",
        "InternalName",
        "758:8S8X8|8",
        ",mZptkPJtDcQct83kmHgbnmItKkzOjffqV2/0C7ce7gA=0Z",
        "<<Failed>>",
        "SetImpersonationCount",
        "CheckCIEASupport",
        "TFTPParse[Var ACK]: WindowSize (%u) is out of range",
        ">n?x?",
        "250701214655Z0|1",
        "octet",
        "GetVolumePathNameW",
        "273<3H3`3",
        "VerifyIntegrityChunk",
        "Failed to convert GUID to string.",
        ">P?s?",
        "base\\eco\\wds\\transport\\client\\tptc\\tftpclient.cpp",
        "WdsTransportClientCloseSession",
        "WdsTransportClientCancelSession",
        "WdsCpRecvPacketInitialize",
        "3l3v3",
        "4.464?4E4b4",
        "WdsTransportClientApplyImage: WIM file requires a reference image; none specified",
        "6!7R7Y7_7u7",
        "2%383@3}3",
        "Translation",
        "PRQh@$",
        "DecompressChunkedFile",
        ".tls$",
        "m_pReaderSlots[uIndex].m_uThreadId == uThreadId",
        "9Q9X9t9{9",
        "WimBufferToHexString",
        "9[:b:w:",
        "memcpy",
        "2 3Q4",
        "kernel32.dll",
        "GetModuleHandleW",
        "CI EA is only supported on when image contains OS version info.",
        "L$djo_",
        ".CRT$XLZ",
        "5`6;7A7",
        "CreateWimQueue",
        "GetSystemInfo",
        "cannot read WIM header",
        "9F s1Q",
        "5n6u6",
        "aYd(z_C",
        "#comment",
        "8e8|8",
        ";U;\\;h;~;",
        "t$VQh",
        "Failed to delete external file.",
        " http://www.microsoft.com/windows0",
        "_strtoui64",
        "tPVVPQ",
        "7&7P7r7",
        "MCTPConstruct[QCR]: Session=0x%x, Client=0x%x, QCC#=%I64u, BOTime=%u, HiODATA#=%I64u, LossRate=%.16lf, AppDataLen=%u",
        "ReadData failed",
        "base\\eco\\wds\\transport\\client\\tptc\\tpcntdata.cpp",
        "4+4;4A4O4y4",
        "5#5Q5V5",
        "RestoreFileDataCallback",
        "HQC!!",
        "5O6Y6x6",
        "4@5G5",
        "EnumRefExtEntries",
        "2G3`3",
        "version",
        " SVW3",
        "D$ QP",
        "6'7.7:7Z7",
        "=\">,>",
        "u QQS",
        "WIM\\IMAGE",
        "9w,v)",
        "CompressCaptureNode",
        "Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}",
        ";/<P<^<d<i<",
        "T$@Ph@",
        ";%<M<o<*=b=h=",
        "5/5:5L5Q5",
        "Washington1",
        "WakeAllConditionVariable",
        ";'<I<",
        "CompressChunk",
        "ci.dll",
        "4Z5n5t5y5",
        "T$$RPQQ",
        "1-1w1",
        "@*97u",
        "RegLoadKeyW",
        "; ;';9;@;f;m;~;",
        "3/3N3",
        "onecore\\internal\\base\\inc\\private\\eco\\wds\\ChildCount.h",
        ">Q?]?|?",
        "%ws\\%ws",
        "base\\eco\\wds\\transport\\client\\tptc\\TpCntJoin.h",
        "The existing WIM file became corrupted",
        "yJWhe",
        "1=1D1O1V1r1",
        "4%5/5E5j5|5",
        "<<>c>",
        "GetHandleInformation",
        "y+VhQ",
        "WIM\\IMAGE[*]\\HARDLINKBYTES",
        ".tls$ZZZ",
        "strtoul",
        "2\\3c3",
        "D$LSP",
        "9\\$,t",
        "base\\Eco\\WDS\\wdslib\\net\\UdpSocket.h",
        "WWWVt",
        "Converting to NT filename failed",
        "WdsClientPacketFree",
        "pWdsCopyFileEx: Failed to copy [%s] to [%s], GLE = 0x%x; will retry in %u ms",
        "This client is now the master client.",
        "header version mismatch",
        "FileDescription",
        "; hash = ",
        "WdsTransportClientInitializeSession",
        "Deleting NACK for seq# %I64u-%I64u because all repairs are done.",
        "0+1G1",
        "f9XBt",
        "_XcptFilter",
        "3*383",
        "zupkfb^ZVSOLIEB@=:7520-+)&$\" ",
        "1+1:1\\1",
        "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1",
        "=+=>=C=I=]=b=n=",
        "F8PSj",
        "Failed to create GUID folder.",
        "GetFileInformationByHandle",
        "(0:0T0",
        "9X`t7",
        "9M,tN",
        "r%*U$",
        ".idata$6",
        "@&0_DM",
        "PrepopulateList",
        "0-2D5u5",
        "wcschr",
        "WIM_MetaData_Queue_Length",
        "ry9|$ |s",
        "CryptImportKey",
        "D$0PS",
        "9s v5",
        ";(<B<W<d<",
        "CI EA is only supported on hosts Windows 8 and higher.",
        "3a4r4",
        "SaveOffset failed",
        "u\"Qh N",
        "2'373G3P3Y3c3g3x3~3",
        "AllocChunkInfo",
        ":3:F:r:",
        "CryptSignHashW",
        "7&8C8I8",
        "RtlRaiseStatus",
        "1\"1H1O1",
        "UuidCreate",
        "<)<P<s<",
        ">!>}>",
        "WimInitXmlInfo",
        "8&848;8I8P8l8",
        "WdsTransportClientQueryStatus",
        "http://www.w3.org/2000/09/xmldsig#",
        "127.0.0.1",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\strutil.cpp",
        "?!?'?-?F?",
        "UCS-2",
        "Microsoft Corporation",
        "WS2_32.dll",
        "K{m<KI",
        "PQhpG",
        "9^Hv&Sj",
        "EA^Wp",
        "F\\;G\\u",
        "446O6",
        "<-<4<<<E<Q<",
        "9V(s;;",
        "GlobalMemoryStatusEx",
        "8>8Z8a8",
        "RegQueryValueExW",
        "?w$tQ",
        "9J:`:g:n:u:",
        "pPQQj",
        "0&0A0",
        "8*808",
        "272C2M2a2q2{2",
        "RestoreFileMetadata: RecordFileDataLocation failed",
        "9p\\t:",
        "D$HPj",
        "GWVVP",
        ";-;8;",
        "\\Windows\\Microsoft.NET\\",
        "reparse point tag too short in filestream",
        "10272c2j2w2~2",
        "WVh m",
        "3)343",
        "9':.:",
        "GetProcessHeap",
        "WofCompressFileWithHandle",
        ":(:>:c:",
        "MCTPParse[NACK:%I64x]: Session=0x%x, Client=0x%x, HiODATA#=%I64u, LossRate=%.16lf, RangeCount=%u",
        "747R7p7",
        "InterlockedPushEntrySList",
        "_ftol2",
        "LoadLibraryExW",
        "788P8u8",
        "*Q`L]",
        "WVhxl",
        "0$1L1Z1f1|1",
        "7!7+7;7B7O7U7`7",
        "Failed to mark image for compact state.",
        "SetEndOfFile",
        "2%2.282R2Y2e2l2s2",
        "GetSecurityDescriptorControl",
        "WdsClientExecute",
        "4'464L4[4a4",
        "WIMCommitImageChanges",
        "5m8{8",
        "5C5Q5j5",
        "9^ vf",
        "jaYjz^j:Z",
        "WriteEncryptedFileRaw",
        "RegSetValueExW",
        "8<9F9",
        "SVWj43",
        "InterlockedPopEntrySList",
        "2:2T2Z2",
        "wdstptc.dll",
        "L$,QP",
        "hSVW3",
        "\\lL\\q",
        "GetSecurityDescriptorSacl",
        ";F,s.",
        "WVh0l",
        "UD;UD",
        "??1exception@@UAE@XZ",
        "ExclusionList",
        "9B\\t\"9C8t",
        "9X`v^j",
        "1*1Y1c1",
        "9WHvQ",
        "u7SQh",
        "TFTPConstruct[ACK]: Block#=%u",
        "%s.%s",
        "DeletePath: Failed to obliterate [%s] (GLE = 0x%x); retrying...",
        "`V@Pj",
        ";1;6;",
        "PPSVj",
        "%s[%s:%u] %s",
        "=!=,=v=",
        "GetTempPathW",
        "2D2K2",
        "ReleaseDataRange",
        "WideCharToMultiByte",
        "C;X`s",
        "\"Microsoft Window",
        "Deleting NACK for seq# %I64u-%I64u because no blocks are missing.",
        "RestoreSecurityDescriptor",
        "5 6<6B6d6",
        "9&9K9]9d9t9{9",
        "MCTPConstruct[NACK]: Session=0x%x, Client=0x%x, HiODATA#=%I64u, LossRate=%.16lf, RangeCount=%u",
        "9r4uC",
        "GetSecurityDescriptorLength",
        ">\">j>x>",
        "RestoreFileData",
        "WaitForMultipleObjectsEx",
        "4C4N4v4",
        "ValidateBinaryFileAndSetEA failed",
        "DeleteFileEx: Unable to restore attributes on [%s]; GLE = 0x%x",
        "9-:<:B:G:^:",
        "Failed to restore wimboot entries",
        "9\\$$v",
        "No activity for long time: %I64u ms.",
        "m_uInitCount == 0",
        "D$$PR",
        "=Q>V>s>y>",
        "7,7N7Y7j7",
        "FreeAddrInfoW",
        "RtlDeleteResource",
        "5I6_6",
        "6*6P6k6",
        "%s:(%d)",
        "ADVAPI32.dll",
        "SjdPj2j",
        "4*5\\5c5",
        "EnterCriticalSection",
        "MCTPParse[JOIN:%I64x]: Session=0x%x, Client Name='%s', IP=%s, MAC=%s",
        "9_pt#h",
        "=+=2=X=",
        "EventUnregister",
        "+0I0|0",
        "t$ RP",
        "FBf;E",
        "050<0G0",
        "Delay before sending LEAVE packet: %ums",
        "RtlReleaseResource",
        "\\$4YY",
        "9_puY9",
        "3,fTidTq ,>gEB;",
        ";/;;;S;^;",
        "GetIfTable",
        "Ignoring ODATA Seq#=%I64u because its less than our first ODATA Seq#=%I64u",
        "9S0vmR",
        "tSh`W",
        "6#7^7",
        "GetOverlappedResult",
        ";7<=<B<o<z<",
        "jo^[_",
        "RtlAllocateHeap",
        "2-2=2G2o2y2",
        "|d-Vk",
        "QQSVW3",
        "Integer overflow after WriteData",
        "0!1'1y1",
        "MCAPParse[C-CIR]: Seconds-in-Session=%us, Progress=%u",
        "9r t1",
        "t QPh",
        ":7:X:",
        "t&f;E",
        "System\\CurrentControlSet\\Services\\WofMob",
        "F0C;X",
        "?&?Z?",
        "D$,WP",
        "NtClose",
        "8'818",
        "GetIfTable2",
        "7B8H8M8{8",
        "TlsSetValue",
        "00050V0",
        "%wOtF",
        "tb9t$",
        ">8>M>",
        ";M;x;",
        ".?AVbad_alloc@std@@",
        "D$ 9u",
        "252@2x2",
        "UuidToStringW",
        "2,2w2",
        "NMTOKENS",
        "RestoreMountStub: error creating destination file",
        "t&jPj",
        "Continue to apply the image without setting CI EA.",
        "GetVolumeRootFromPath",
        "=K=c=z=",
        "netascii",
        "f9:tD",
        "2!2I2",
        "9V:e:k:",
        "SVWj2",
        "_onexit",
        "G^{P&a",
        "t1j\\P",
        "AddIPAddress",
        "\\\\?\\GlobalRoot",
        ":QVEE",
        "L$|_^[3",
        "RtlGetVersion",
        "CryptHashData",
        "757\\7",
        "1<2K2[2",
        "q@boA",
        "Address",
        "WWWWV",
        "!|$<9}",
        "t;f97t6",
        "DecompressChunkedFile failed",
        "?3?W?c?v?",
        "REQUIRED",
        "$filehashes$.dat",
        "(SVWj",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\stopwatch.cpp",
        "InitializeCriticalSectionAndSpinCount",
        "; <*<Z<d<",
        "AX;BXu",
        "u7WVh",
        "3,3z3",
        "=)>J>|>",
        "Microsoft Corporation1(0&",
        "GhPQj",
        "LegalCopyright",
        "?G?m?t?",
        "9D9e9o9",
        "FilterLoad",
        "RSDSD,",
        "<B=m=",
        "Y__^[",
        ".idata$3",
        ":2;N;",
        "=^>k>",
        "\\Windows\\System32\\config\\SYSTEM",
        "=&=?>I>g>q>",
        "MCTPConstruct[LEAVE]: Session=0x%x, Client=0x%x, Reason=%u",
        "ReleaseSemaphore(m_hReaderSlots, 1, 0)",
        ">I>a>",
        "$`2X`F",
        "\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}",
        "WIM\\IMAGE[*]\\LASTMODIFICATIONTIME\\HIGHPART",
        "<%<8<K<T<[<h<",
        "SetFileInformationByHandle",
        "WQh0D",
        ">U?c?s?z?",
        "ReadWriteDataInternal",
        "Failed to get volume root!",
        "GetFileVersionInfoSizeExW",
        "ImageWorkerThread",
        "<N=U=_=k=",
        "FindFirstChunk",
        "??1type_info@@UAE@XZ",
        "CreateIoCompletionPort",
        "4$4=4H4f4",
        "pCFileState shutting down; stats: DirectReads=%u CachedReads=%u DirectExtents=%u",
        "|hK,_",
        "879A9",
        "RETAIL ASSERT",
        ">K?R?`?g?w?~?",
        "PVVj@Wh",
        "1.2q2",
        "EventRegister",
        "LookupPrivilegeValueW",
        "6&6K6",
        ";&;B;",
        "txhl>",
        ".edata",
        ">'?1?n?y?",
        "959H9",
        "<7=N=U=v=",
        ":*;N;U;",
        "::;R;e;o;Y<",
        "s(QQh",
        "9^,tkSQ",
        "GetFileInformationByHandleEx",
        "1)171A1_1",
        "9w8t7",
        "2&2J2T2$3.3{3",
        "RegOpenKeyExW",
        ":I;{;",
        "setting hardlink failed",
        "UserSid",
        "8,9i9s9",
        "WdsTransportClientApplyImage: Ending WIM request loop (next=%u)",
        "RestoreMountStub: Could not move hardlink stub to prepopulate location",
        "ResExtractToFile failed",
        "5:5L5n5",
        "F4QQS",
        ".00cfg",
        "747H7R7",
        "WIM_FileData_Number_Workers",
        "D$L9A",
        "39HPt",
        "GetQueuedCompletionStatus",
        "Failed to set CI EA on temporarily extracted ci.dll.",
        "base\\eco\\wds\\transport\\lib\\tftppacket.cpp",
        "F;w$r",
        "WimStrDupe",
        "BlkBitmap: Total %u missing ranges.",
        "base\\eco\\wds\\transport\\client\\tptc\\apcntdata.cpp",
        "QPQPj",
        "GetCurrentThread",
        "8)848U8{8",
        "#Vx\"&6",
        "=.=5===J=V=",
        ";*<a<~<",
        "9?9D9l9v9",
        "AddCaptureNodeToImage",
        "WIM\\IMAGE[*]\\CREATIONTIME\\LOWPART",
        ".data$brc",
        "RestoreAllFiles",
        "EventWriteTransfer",
        "Microsoft Time-Stamp PCA 2010",
        "j\\Zj:",
        "Fail to update WIM header",
        ":&:/:9:Q:X:_:k:",
        ";);G;",
        "D$(PQ",
        "\\$ QP",
        "9t$(tS",
        "4 5u6",
        "Legal_Policy_Statement",
        "WaitForSingleObject(m_hWriterDone, 0xFFFFFFFF) == ((((NTSTATUS)0x00000000L) ) + 0 )",
        "011E1S1Y1^1",
        "6,6W6c6r6~6",
        "FindChunkForOffset",
        "__CxxFrameHandler3",
        "_wcsnicmp",
        "EnumeratePathEx: Unable to enumerate [%s]; GLE = 0x%x",
        "4!4C4`4n4",
        "WSASocketW",
        "272N2q2",
        "Set data source id failed.",
        "CompressionFolderList",
        "uHashLen == (m_uSecHeaderLen - (size_t)(&(((WDSMCTP_SEC_HEADER*)0)->bSecData)))",
        "1(0&0",
        "x=[4n",
        "6C6o6",
        "9*:z:",
        "WriteData failed during NULL block copy",
        "?@?J?",
        "GetFinalPathNameByHandleW",
        "D$4WSP",
        "Microsoft Code Signing PCA 20100",
        "D$H)F<B",
        "Failed to extract ci.dll from the WIM.",
        "LoadLibraryW",
        "SetUnhandledExceptionFilter",
        "D$@PW",
        "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%",
        "WIM\\IMAGE[*]\\WIMBOOT",
        "Failed to mark image for wimboot state.",
        "60767k7r7",
        "WdsTransportClientApplyImage:processed %u extents, max length %I64u",
        "393U3e3",
        "COM Error: '%s'",
        "9B\\t3",
        ":.:5:G:R:",
        "=5>H>^>m>",
        "7Z>@B1",
        "D$L;T$8r",
        "Failed to get img buf",
        "\"9^Dt$S",
        "<,<6<Q<\\<k<u<",
        "?6?L?q?",
        ";&<-<I<P<",
        "blksize",
        "u.FAB;",
        "%w't%",
        "WDS_TRACING_%u",
        "WdsClientInitializeLibrary",
        "Error setting compression",
        "D$0PQR",
        "D$0SVW",
        "<B=J=Y=_=r=",
        "DequeueNextChunk",
        "9^(u&",
        "L$T_^[3",
        "Journaling is enabled successfully on the applied volume.",
        ";?<Z<z<",
        "wH9\\$",
        "EnumImageDataEntries",
        "NtSetEaFile",
        "Y4?L8M",
        "WIM_Chunked_Number_Of_Threads",
        "yoj@j",
        "3,4K4i4v4",
        "\\$4Sj",
        "7Q7|7",
        "RRhd~",
        "5'5=5\\5",
        "CreateRestoreInfo",
        "818;8B8S8Z8~8",
        ".CRT$XIZ",
        ": :1:C:J:d:j:q:",
        "t$<h0<",
        "CompanyName",
        "GPPQQh",
        "#D$ P",
        "9t$Pt",
        "GetComputerNameW",
        "?-?E?L?`?v?",
        "7,7F7N7Z7h7",
        "3=4G4",
        "3/353;3",
        ";b<n<",
        "D$hPW",
        "0123456789abcdef",
        "http://www.w3.org/2000/xmlns/",
        "WimCreateWorkerThreads",
        "8i8v8",
        ":_:v:~:",
        "7 7,787D7P7\\7h7t7",
        "CreateFileW",
        "?&?0?L?Z?d?}?",
        "WimBootCompress.ini",
        "t~j?Yf;",
        "SetFilePointerEx",
        "343:3S3Z3",
        "1/2i2n2",
        "6#6@6K6_6i6",
        "TFTPParse[OACK]: BlkSize=%u, WinSize=%u, Timeout=%u, TSize=%I64u, MsftWindow=%u",
        ".winmd",
        "base\\eco\\wds\\transport\\lib\\blkmisrange.cpp",
        "IMAGE\\WIMBOOTENTRIES",
        "6PQQhl/",
        "wcsrchr",
        "ReleaseSemaphore(m_hReaderDone, 1, 0)",
        "WdsTransportClientApplyImage: Starting WIM request loop",
        ".text",
        ":MdSpt",
        "CryptDestroyKey",
        "LogSharingViolationErrorInfo",
        "RestoreFileMetadata",
        "2:3_3",
        "C0j\\Yf9",
        "6 6C6W6\\6~6",
        "VRSQP",
        "3c4y4",
        "Microsoft Corporation1-0+",
        "u jBh\\ ",
        "m_bCPU <= 100",
        ">&>,>9>N>`>g>}>",
        "<!<H<",
        "9Kdt_",
        "config",
        "N+@:81J",
        "0PQQj",
        "Fonecore\\base\\eco\\wds\\wdslib\\common\\src\\netaddr.cpp",
        "9-9t9",
        "|$HSQ",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "10.0.19041.572",
        "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0",
        "IMPLIED",
        "tn8^\\t",
        "616N6d6",
        "RtlReAllocateHeap",
        "t$T+t$",
        "L$$_^[3",
        "Using Local Interface %s to communicate with server.",
        "_9^<t",
        "uZ9Gpt",
        "5'5V5`5{5",
        "tTf97tO",
        ";E;I;M;Q;U;Y;];a;e;i;m;q;u;y;};",
        "base\\eco\\wds\\wdslib\\crypt\\lib\\crypthash.cpp",
        "jLh\\ ",
        "WaitForSingleObject(m_hReaderSlots, 0xFFFFFFFF) == ((((NTSTATUS)0x00000000L) ) + 0 )",
        "Reset restore hardlinks error because of file redirection.",
        "RestoreMountStub: setting reparse point data failed",
        "5&565=5m5",
        "SetFileAttributesW",
        "MCTPParse[NACK]: Range=%I64u - %I64u",
        "WIM\\IMAGE[*]\\FILECOUNT",
        "ImpersonationCountInit",
        "_vsnwprintf",
        "D$,BP",
        "GetSysVolRefNodePath",
        ";M<W<~<",
        "484I4f4l4",
        ":J:T:h:o:}:",
        "WimImageCreateWorkers",
        "GetVersionExW",
        "767E7L7p7",
        "1-2D2z2",
        " 0'0Z0a0z0",
        "v(VQP",
        "CheckExcludeMetadata",
        "CharUpperW",
        "System\\CurrentControlSet\\Services\\WDSServer\\Providers\\WDSTFTP",
        "Microsoft Corporation1200",
        "HeapAlloc",
        "m_uActiveReaders == 0",
        "Error restoring directory metadata - ignoring failure",
        "jHh`X",
        "9E:R:]:u:",
        "\\Windows\\System32\\ci.dll",
        "0G0[0e0k0{0",
        "6v6}6",
        "u+jKh",
        "QueryPerformanceCounter",
        "PQj@Z",
        "~j\\XPW",
        "SleepConditionVariableSRW",
        ">,>3>A>H>h>o>{>",
        "8/8B8O8V8",
        "$Microsoft Ireland Operations Limited1",
        "MCTPParse[ACK:%I64x]: Session=0x%x, Client=0x%x, Seq#=%I64u, HiODATA#=%I64u, LossRate=%.16lf",
        "t{93tw",
        "WIMInitializeWofDriverInternal",
        ">=?D?X?d?l?",
        "040D0a0o0y0",
        "^d9^ht",
        "<24484<4@4D4H4L4P4T4X4P9",
        "WIMSendFileInfoMessage",
        "<.=k=",
        ".CRT$XCZ",
        "WIM\\IMAGE[*]\\DIRCOUNT",
        "_FC;]",
        "20201008090804Z",
        "&quot;",
        ";(;`;i;p;y;",
        "CryptReleaseContext",
        "CMicrodom",
        "5\"666A6S6X6l6",
        "TFTPConstruct[Var ACK]: Block#=%u, WindowSize=%u",
        "CreateEventW",
        "\\Program Files\\WindowsApps\\",
        "SQh4C",
        "Microsoft Enhanced RSA and AES Cryptographic Provider",
        "D$|PQ",
        "WIM %s, offset %.8x%.8x, length %x",
        "A\\;B\\u",
        "D$d9C",
        "??0exception@@QAE@XZ",
        "0E0L0s0z0",
        "~D+^8",
        "%I64d",
        "5 5&5,595@5F5P5V5a5g5r5y5~5",
        "1T1Y1^1n1",
        "292@2K2~2V314;4x4",
        "GetSecurityDescriptorOwner",
        "RestoreFileInfo",
        ".text$yd",
        "WriteData failed",
        "C +C(",
        ".CRT$XIAA",
        "N4;F4r",
        "E$j$Z",
        "5,565N5U5d5s5",
        "6>8_9g9o9",
        "7y8}8",
        "HMACAlgId",
        "DeletePath: Cannot delete <null>.",
        "t0QQj",
        "=\">,>v>",
        "WdsRemoveDirectory: Unable to remove directory [%s]; GLE = 0x%x",
        "4`4g4h5",
        "97u\"3",
        "WdsTransportClientApplyImage: Starting multicast session",
        "j\\Zf;Ty",
        "5\"6)6",
        " 0T0[0",
        "PVVVVh",
        ";q<{<",
        "NtCreateFile",
        "DeleteFileW",
        "tjj:V",
        "GetSystemTimes",
        "7*848L8Y8_8v8",
        "161D1^1,292E2",
        "Failed to get the host OS version.",
        "m_ActiveWriter.m_uNestedReaders > 0",
        "WWWPW",
        "RtlAcquireResourceShared",
        "ApplyReparseFixup",
        "PrivilegeCheck",
        "Could not disable journaling (to restore original state) on the applied volume.",
        "ReleaseSemaphore",
        "(ULONG) _InterlockedExchangeAdd((LONG volatile*)&(m_uOwnerThread), 0) == GetCurrentThreadId()",
        ": :%:",
        "??0exception@@QAE@ABV0@@Z",
        "RegCloseKey",
        "RestoreDirTree",
        "_InterlockedExchangeAdd((LONG volatile*)&(m_lPendingWriteOperations), 0) == 0",
        ";p<w<",
        "4\"4(4/4D4N4`4x4",
        "9&9V9",
        "CI EA is only supported on either WinPE host or one which supports extracted catalog folder.",
        "MCAPConstruct[C-CIR]: Time-in-Session=%us, Progress=%u, RangeCount=%u",
        "v!WQh",
        "QQSVWj",
        "CompressFileBackedByWim",
        ":3:::J:k:",
        "ContentSize",
        "GetProcAddress",
        "5o6X8",
        "FindClose",
        "FltCommStubRename",
        "InitializeCriticalSection",
        "m_uEndBlock <= uEndBlock",
        "onecore\\internal\\base\\inc\\private\\eco\\wds\\BufferedFileWriter.h",
        "Error restoring directory metadata",
        "BCryptCreateHash",
        "Microsoft Corporation1&0$",
        "WdsTransportClientElSetLogFunction",
        "5%6Q6}6",
        "ResetEvent",
        ";%;2;O;f;m;",
        " J9\\$$u",
        "8\";f<",
        "5F6^6",
        "bad allocation",
        "W93uH3",
        "ReleaseSRWLockExclusive",
        "0v2}2",
        "NACK Setup: HiTracked#=%I64u, Lead#=%I64u, Missing=%I64u-%I64u",
        "8:8D8i8x8",
        ";\";4;E;r;~;",
        ".CRT$XCU",
        "_stricmp",
        "]._g*",
        "D$ htz",
        "9V,wEr",
        "\\O#]`",
        "Integer overflow after ReadData",
        "M QRSP",
        "9KdtL",
        ":6;Z;",
        "D$$PQ",
        "standalone",
        "RtlImpersonateSelf",
        "NtSetCachedSigningLevel",
        "&0V0l0",
        "808V8",
        "X_^[Y]",
        "CryptSetHashParam",
        "0Y1q1D2e2l2",
        "MCTPParse[DEMOTE:%I64x]: Session=0x%x, MAddr=%s:%u, UAddr=%s:%u, ClientCount=%u",
        "2.3:3e3j3",
        "UTF-16",
        "2=2G2",
        "210303182929Z0t1",
        "InitializeSListHead",
        ".?AVexception@@",
        "WdsCpParameterAdd",
        "WriteDataCallback",
        "?\"?5?k?z?",
        "D$$;D$",
        "234:4c4",
        ".data",
        "y'Vj1",
        "UncompressFile",
        "RestoreFileMetadata: RestoreFileStorageTierClass failed",
        "<#=-=V=`=",
        "B1%2@2L2f2t2",
        ";#>/>",
        "BuildFileNodeHashTable",
        "NOTATION",
        "FIXED",
        "474K4R4",
        " Windows",
        "t-j._f;9u",
        "NtSetCachedSigningLevel2",
        "p!c5Mf",
        "CompressionExclusionList",
        "9D$$t",
        "6!6\\7",
        "NACK seq#%I64u-%I64u - Holding off NACK because Fw window is full.",
        "4#5v5%6m6",
        ",f~|z[WP",
        "707k7r7",
        "WimMount",
        "WdsTransportClientRegisterCallback",
        "6$6,646<6D6H6P6X6`6l6t6|6",
        "1!1t1{1",
        "This client is no longer the master client.",
        "*41;D$<s",
        "RegDeleteValueW",
        "5%5n5",
        "FileCacheSize",
        "SetSecurityInfo() failed",
        "SecMode",
        "RtlAcquireResourceExclusive",
        "y/VhV",
        "0g0n0t0",
        "wcsncmp",
        "Cabinet.dll",
        "353@3T3a3",
        "Failed to set wof data",
        "y)Vhy",
        "base\\eco\\wds\\transport\\client\\tptc\\TpCntNACK.h",
        "WdsCpParameterValidate",
        ";;;B;",
        "02070Z0f0}0",
        "[ybVh",
        "IMAGE\\WINDOWS\\VERSION\\MAJOR",
        "header type/size mismatch",
        "QPQPWR",
        "x8!D$",
        "Thales TSS ESN:179E-4BB0-82461%0#",
        "WdsTransportClientApplyImage: directly-measured file size %I64u does not match multicast file size %I64u",
        "8Y8c8",
        "RestoreFileMetadata: RestoreHardlinks failed",
        "base\\eco\\wds\\transport\\client\\tptc\\tptwimapply.cpp",
        ">(?R?g?",
        "2d3K4v4",
        "9/:k:",
        "_^[+P",
        "CreateFileMappingW",
        "9(979q9x9",
        "7G8M8",
        "7N8X8u9",
        ">$?1?C?T?_?t?",
        "base\\eco\\wds\\transport\\client\\tptc\\wdstptc.cpp",
        "CloseEncryptedFileRaw",
        "CChildCount::WaitForChildren failed; %u",
        "EnumeratePathEx: FindFirstFile failed for [%s]; GLE = 0x%x",
        "Sleep",
        "5H6M6",
        "EnumeratePathEx: Callback requested enumeration interruption or hit internal enumeration failure on [%s]; GLE = 0x%x",
        "=\">F>U>v>",
        "=8>^>t>",
        "1+1?1\\1r1|1",
        "250706205017Z0~1",
        "@;F4~",
        "WSARecvFrom",
        "1 1(1L1U1",
        "GetCurrentProcessId",
        "WdsCopyFileEx: Failed to delete %s. GLE = 0x%x",
        "VerQueryValueW",
        "100706204017Z",
        "2'3@3P3",
        "LocalFileTimeToFileTime",
        "SQhh)",
        ": :l:",
        ";D$<s",
        "RegFlushKey",
        "ResNodesLoad",
        "BCryptGetProperty",
        "5\"686?6y6",
        "20353",
        "6>6H6",
        "Substitute name string copy failed",
        "RtlGetLastNtStatus",
        "8r ,Y",
        "CI EA is not supported due to mismatched versions of host OS and applied image.",
        "RestoreFileCompression",
        "BCryptDestroyHash",
        ".idata$4",
        "5 5,585D5P5\\5h5t5",
        ">6>\\>h>",
        "j@h@X",
        "\\\\?\\UNC",
        "j?Xf;",
        "595?5T5Z5p5",
        "Microsoft Corporation0",
        "9):.:q:",
        "KnILk",
        "D2J5A",
        ":M:m:",
        "QueryPerformanceCounter(&liTimeStamp)",
        "G PVQ",
        "G0U0[0`0",
        "QueryPerformanceFrequency",
        "C\\;G\\u",
        "NtYieldExecution",
        "0'0L0",
        "GetVolumePathNamesForVolumeNameW",
        "NtQueryInformationFile",
        "NDATA",
        "#,|6d",
        ".CRT$XIA",
        "4_4f4",
        "base\\eco\\wds\\transport\\client\\tptc\\transportclient.cpp",
        "tIVS3",
        "?]?b?",
        "TlsAlloc",
        "InitLZMSDecompression",
        "WdsTptcDownload",
        "9&9A9g9",
        "RestoreDirTree: RestoreFileStorageTierClass failed",
        "u&Qh N",
        "GetCurrentDirectoryW",
        "=.=5=L=V=e=t=}=",
        "BX;AX",
        "G QQVP",
        "?what@exception@@UBEPBDXZ",
        ">C>M>",
        "[F$d*",
        "WWh >",
        "CreatePath: Unable to create [%s]; GLE = 0x%x",
        "Af;H(s",
        "FindFirstFileW",
        "DeletePathDirectoryCallback: Spoofing detected deleting [%s] -> [%s]",
        ".rdata",
        "D$pSVW",
        "0=0H0x0",
        "WdsTransportClientWaitForCompletion",
        "G ;F\\",
        ";;<J<",
        "4%5,5;5B5O5V5m5t5",
        "=,>W>{>",
        "</=9=P=",
        ";D$4uV",
        ".text$di",
        "strcpy_s",
        "base\\eco\\wds\\transport\\client\\tptc\\tpcntpoll.cpp",
        "&apos;",
        "191023231916Z",
        "DeleteFileEx: hardlink given to us is: %s",
        "Client",
        "0 0%0,01080=0B0",
        "3Z3b3l3",
        "onecore\\base\\ntsetup\\opktools\\osimage\\lib\\utility\\sync.c",
        "L$49L$,w}r",
        "tXVWj",
        ".w.t,",
        ">,?8?y?",
        "OriginalFilename",
        "WDSMCSE[Request]: Namespace=%s, Content=%s, Mac=%s",
        "tWVPj",
        "base\\eco\\wds\\wdslib\\crypt\\lib\\cryptkey.cpp",
        "RestoreFilesCallback",
        "_CxxThrowException",
        "5K5a5",
        "171I1W1w1}1",
        "<)<T<_<",
        "WdsCpPacketGetBuffer",
        "PWWQQ",
        "tRVVj",
        "StorageTiering not supported",
        "=&=4=:=?=O=T=",
        "MCTPParse[ODATA:%I64x]: Session=0x%x, Client=0x%x, Seq#=%I64u, Trail#=%I64u, Data Len=%u",
        "@.reloc",
        "+^@jd",
        "6PQQh|/",
        "CreateSemaphoreW",
        "4 4?4N4n4}4",
        "S,_^[",
        "=+=r=/>6>Q>_>{>",
        "\\\\?\\Volume{",
        "G$9G t",
        "9#9-9>9C9",
        "RtlInitializeCriticalSection",
        "WdsTransportClientShutdown",
        "1T1n1z1",
        "RtlFreeHeap",
        "m_pTpCntData->m_uFirstODataSeqNo > 0",
        "WimSetSecurityDescriptor",
        "D$(9G",
        "9~Ht.V",
        "MCTPConstruct[NACK]: Range=%I64u - %I64u",
        "SSh  ",
        "DeleteFileEx: Unable to clear out attributes on [%s]; GLE = 0x%x",
        "4#414",
        "t[VW3",
        "_callnewh",
        ";D<N<",
        "848G8t8z8",
        "qsort",
        "CryptGetHashParam",
        ">MdSpu",
        "8#8m8",
        "UDP Endpoint[Data] - Local=%s:%u, Multicast:%s:%u, Unicast:%s:%u",
        ">1>N>Z>",
        "t4f97t",
        "CreateTimerQueueTimer",
        ":):6:j:",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        ">@.6Y",
        "tmj\\W",
        "8k9#:",
        "2L3S3(4/4m4t4",
        "base\\eco\\wds\\transport\\client\\tptc\\tftpcnttimeout.cpp",
        "wprintf",
        "3*3F3S3Z3",
        "NH9^,t",
        "MultiByteToWideChar",
        "ValidateFileAndSetEACallback",
        "RevertToSelf",
        "@.rsrc",
        "memcmp",
        "7\\7r7",
        "Microsoft Time-Stamp PCA 20100",
        "C;_,r",
        "8.:';",
        "000P0]0e0k0q0",
        "696D6N6y6",
        "v!jz^hx",
        "PQQh</",
        "D$tHP",
        "061@1R1o1v1",
        ":!:(:B:I:c:j:",
        "DeleteFileEx: Spoofing detected deleting [%s] -> [%s]",
        "4,464P4j4",
        "<3===",
        "WaitForSingleObject(m_hReaderDone, 0xFFFFFFFF) == ((((NTSTATUS)0x00000000L) ) + 0 )",
        ".idata$2",
        "9slu!j",
        "@\\jdPQ",
        ">#?;?t?",
        "FH;A8",
        "6!7)7D7`7",
        "=<>r>",
        "ObjectLength",
        "IMAGE\\WIMBOOT",
        "9K9U9",
        "WIMLoadImageInternal",
        "InitLZMSCompression",
        "Failed to remove directory",
        ":3:M:S:",
        "0!02090y1",
        "LeaveCriticalSection",
        "BlockSize",
        "GetEnvironmentVariableW",
        "7E7h7",
        ")`yJb",
        ">1>W>^>",
        "C(;C$",
        "8$8G8k8u8|8",
        ".rdata$T$brc",
        "Could not move source file",
        "TotalBlocks",
        "60>0b0",
        "D$DPj",
        "ProductVersion",
        "WdsRemoveDirectory: Unable to prepare path [%s]; GLE = 0x%x",
        "=Q=\\=t=",
        "556O6",
        "GetVolumeInformationW",
        "6K6n6x6",
        "wcsnlen",
        "=h=}=",
        "RDATA Repair received - seq#=%I64u",
        "2/3X3",
        "2`2g2",
        "MCAPParse[DATA]: Blk#=%I64u, DataLen=%u",
        "NtQueryVolumeInformationFile",
        "(PWWj",
        "<$<.<^<v<",
        "$SVW3",
        "%wPtG",
        "Wofadk failed to attach volume!",
        "=K=W=",
        "4B4G4",
        "2C3J3[3y3",
        "WdsTransportClientApplyImage: Releasing extent [%I64u, %I64u)",
        "6#6)6/656R6d6s6|6",
        "Ignoring JOIN-ACK packet with Client=0x%x because we already have our Client Id.",
        " ?cy+}",
        ":*;i;",
        "<U=u=",
        "<unavailable>",
        "VWhlC",
        "VS_VERSION_INFO",
        "Content",
        "3_^[]",
        "LocalAlloc",
        "8H8i8",
        "DeleteFileEx: Unable to open [%s]; GLE = 0x%x",
        "OutputDebugStringW",
        "OLEAUT32.dll",
        "5d6n6",
        "0#0*0`0g0",
        "9\\$0t]",
        "j\\Yuk",
        "O0M0K",
        "WIMCloseWIM",
        "0$0-0;0Q0a0n0u0",
        "6y7|9",
        "SWPQh|F",
        "WimBoot",
        "RestoreEncryptedFile",
        "595U5q5",
        "4\"5/595A5K5\\5d5r5|5",
        "Multithreaded chunked decoding disabled via environment variable; will skip!",
        "MCTPParse[QCR:%I64x]: Session=0x%x, Client=0x%x, Seq#=%I64u, BOTime=%u,HiODATA#=%I64u, LossRate=%.16lf, AppDataLen=%u, CPU/Mem/Net=%u/%u/%u",
        "VERSION.dll",
        ":/:::q:",
        "IMAGE",
        "DeviceIoControl",
        "D$lSP",
        "CreateDestinationFileEx",
        "<%=/=L=e=j=",
        "Failed to get decoder context",
        ">7>_>",
        "jOh %",
        "GetMetadataPadding",
        "FindNextFileNameW",
        "IMAGE\\WINDOWS\\VERSION\\BUILD",
        "<K<e<~<",
        "WimBoot apply failed because the image is NOT a WIMBoot compliant image!",
        "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2",
        ">->3>Q>X>c>",
        "Iphlpapi",
        "RtlInitializeResource",
        "[%s:(%d) -> %s] %s",
        "base\\eco\\wds\\transport\\client\\tptc\\tptclientmanager.cpp",
        "base\\eco\\wds\\wdscsl\\lib\\controlpacket.cpp",
        "7!8+8_8",
        "RPRRj",
        "SYSTEM",
        "ProcessDirectory",
        "Failed to set directory extended attribute",
        "RestoreDirMetadata",
        "jaYjz_j:Z",
        "trPWQ",
        "ReadMetaDataFile",
        "YY_[^",
        "WIM\\TOTALBYTES",
        "RestoreDirMetadata: RestoreFileStorageTierClass failed",
        "@u)j@j",
        "RecordFileDataLocation",
        "WimParseHexString",
        "Reset setting hardlink failure because of folder redirection",
        "8,838C8W8",
        "?1?8?T?{?",
        "\\Windows\\WinSxS\\",
        "GetSystemDirectoryW",
        "7A7b7m7",
        "=0=7=X=_=p=w=",
        "?Q?a?",
        ".rsrc$01",
        "ReleaseSemaphore(m_hWriterDone, m_uWaitingReaders, 0)",
        "_vsnprintf",
        "u!jx[h",
        "IDREFS",
        "_unlock",
        "2\"2:2N2S2",
        ":1;8;I;P;",
        "WdsClientFreeLibrary",
        "NACK seq#%I64u-%I64u - not all RDATA received, missing ranges=%u, new NACKBO=%ums.",
        ".gfids",
        "!t$$Pj",
        "(m_uCurrentStatus != 0x0001) && (IsKilled())",
        "0&000",
        ".rsrc$02",
        "WdsTransportClientApplyImage",
        "NtSetSecurityObject",
        "tsize",
        "memcpy_s",
        "5%666q6",
        "GetLastError",
        "030V0d0",
        "%I64u",
        "DeleteFileEx: Unable to allocate hardlink path buffer",
        "x69T$",
        "3O4a576\\6",
        "333~3",
        "MCTPParse[KICK:%I64x]: Session=0x%x, ClientCount=%u",
        "Failed to set wof data for file backed by wim file",
        "MCTPParse[NCF:%I64x]: Session=0x%x, Range Count=%u",
        "1F1z1",
        ";N<W<`<y<",
        "GetLongPathNameW",
        "5J5Q5h5n5x5",
        "3g4x4",
        "NMTOKEN",
        "ntdll.dll",
        "WorkerStateDuplicate",
        "747h7n7",
        "CryptDestroyHash",
        "0 060",
        "%s:%s",
        ":<:@:",
        "?MdDlu",
        "_amsg_exit",
        "\\Device",
        "TFTPParse[DATA]: Block#=%u, Len=%u",
        "7P7_7p7w7",
        "WIM_FileData_Queue_Length",
        "WDS_TRACING_CONSOLE_OUTPUT",
        "9&90999B9L9^9e9l9",
        "u*f9q",
        "3(30383H3P3X3h3p3x3",
        "Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)",
        "GetFileSystemFlags",
        "base\\eco\\wds\\wdslib\\crypt\\lib\\cryptsignkey.cpp",
        "j.Xf;",
        "Microsoft",
        "m_bOACKReceived == 0",
        "3*4;5^6",
        "131>1^1",
        "uYf9s",
        "CDATA",
        "9t$ t",
        "UnhandledExceptionFilter",
        "__dllonexit",
        "97vhS",
        "6)636Y6^6",
        "WIM_Verbose_Logging",
        "=e>4?O?j?",
        "ChangeTimerQueueTimer",
        "<zf;D9",
        "Failed to enable journaling on the applied volume.",
        "m_uLockCount == 0",
        "WimBoot apply failed because there is no wof driver!",
        "(!m_bServerMode) && (((2)>>16)&0xffff)",
        "]_^[]",
        "\\$ ;E",
        "RegUnLoadKeyW",
        "0N1`1i1",
        "=hK2/;",
        "advapi32",
        "Process %s is accessing file wim %s",
        "GetFileNodeFromPath",
        "RtlFindAceByType",
        ";8;J;S;e;",
        "EnumAndDeleteWimExternalFilesProc",
        "UpdateWIMHeader failed",
        "WimImageSetInformationFile",
        "GetFullPathNameW",
        "MarkImage",
        "CreateDirectory failed",
        ".giats",
        "A,;F8u",
        "7(7?7\\7",
        "WdsTransportClientApplyImage: multicast buffers full; downloading extent [%I64u,%I64u) directly",
        "qsort_s",
        "0(0/0A0",
        "PWVVj",
        "j:Yf9H",
        "9(9=9C9b9h9",
        "w|PPP",
        "8 888|8",
        "GetAclInfo failed",
        "+T$\\+",
        ";=;H;N;S;",
        "failed",
        "PinningFolderList",
        "=9=w=",
        "WdsTransportClientApplyImage: applying cached extent [%I64u,%I64u)",
        "t6VVSh0",
        "Failed to apply privileges!",
        "L$4_^[3",
        "uvPSW",
        ")Microsoft Root Certificate Authority 20100",
        "FilterAttach",
        "EnumeratePathEx: Unable to construct path under [%s]; GLE = 0x%x",
        "j?Zf9TH",
        "AcquireSRWLockExclusive",
        "100701213655Z",
        ";7;K;[;j;|;",
        "WaitForSingleObject",
        ">/>=>C>H>|>",
        "<A=S=^=n=w=",
        "SleepEx",
        "#rSPo",
        "PVj@Z",
        "FindNextFileW",
        "-040R0Y0",
        "3<3C3O3z3",
        "OutputDebugStringA",
        "DecodeChunk",
        "WdsRemoveDirectory: Unable to clear attributes on [%s]; GLE = 0x%x",
        "WIMExtractImagePathAndGetFileHandle",
        "5$747;7P7W7i:",
        "ENTITY",
        "T$(94",
        "RaiseException",
        "9!9J9X9^9c9",
        "MALLOC failed",
        "0'0N0",
        "SetEnvironmentVariableW",
        "L$8PW",
        "==>Q>_>",
        "8#8o8",
        "D$,_^[3",
        "SwitchToThread",
        "L$hQS",
        "QPh$2",
        "\\Windows\\System32\\",
        "ReadMetaDataBuffer",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\fileutil.cpp",
        "9MdHdu",
        "6 6(686@6}6",
        "6r7}7",
        "343?3o3",
        "CreateParallelDecodeInfo",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "RestoreDirTree: WimImageCreateFile failed",
        ">1)4+!;",
        "_wcsicmp",
        "base\\eco\\wds\\transport\\client\\tptc\\tptcdownload.cpp",
        "80979K9R9",
        "1&2,212[2w2",
        "QQSV3",
        "WimApplyPrivileges",
        ".idata",
        "taj=R",
        "GetFileAttributesW",
        "CheckDataAvailableForHash",
        "10.0.19041.572 (WinBuild.160101.0800)",
        "T$(;T$8",
        "0,171",
        "TFTPParse[ERROR]: Code=%u(0x%x), Desc=`%s`",
        "TpMcAddress",
        "9{$t|",
        "=%=0=A=G=W=a=",
        "QSVW3",
        "-Tz4q",
        "0$0.0=0D0O0",
        "ProcessSecurityData",
        "0*1A1I1Q1l1{1",
        "f;D$Pu",
        "CryptCreateHash",
        "?#?>?L?V?q?",
        "WVhhm",
        "Failed to set Wof data for file",
        "GetVolumeInformationByHandleW",
        "<S=Q>",
        "WSAIoctl",
        "?,?6?I?{?",
        ">#?/?@?K?~?",
        "UUUUf",
        "848;8T8[8j8q8",
        "ReadFile",
        ";,;7;>;F;O;];n;{;",
        "<:=m=x=U>Z>",
        "<*<R<_<u<",
        "USER32.dll",
        "8/9?9",
        "1?1}1",
        "tLVVVW",
        "QPhx8",
        "4%40474>4o4w4",
        "QSVWj",
        "f9FHu",
        "!G@jEXf",
        "4%4/474>4N4",
        ")MCTPConstruct[JOIN]: Session=0x%x, Client Name='%s', IP=%s, MAC=%s",
        "WimBoot apply failed because the wim file has to be local!",
        "WimFindClose",
        "RestoreDirMetadata: RestoreFileInfo failed",
        "WIM_Enumerate_Directory_Reparse_Point",
        "YRPWWWWW",
        "F(QPj",
        "3N3U3",
        "_wcstoi64",
        ";*;?;f;u;",
        "oeY<9",
        "base\\eco\\wds\\wdslib\\crypt\\lib\\crypthmac.cpp",
        "MCAPParse[PROGRESS]: Time-in-Session=%us, Progress=%u",
        "Multicast Client: Server=[%s], Namespace=[%s], Content=[%s]",
        ">!>2>9>G>s>",
        "252<2",
        ">#>E>\\>q>",
        ":,:2:I:P:r:x:",
        "((((m_uSecurityMode) & 0xffff) == (1)) || ((((m_uSecurityMode)>>16)&0xffff) == (1)))",
        "=f=k=B>L>j>t>",
        ".0B0Y0d0",
        ";,;3;",
        "<L<Z<p<",
        "0L0X0",
        "PPPVhDr",
        ">K>\\>m>x>",
        "> >(>B>H>",
        "WimbootProcessBeforeApply",
        "RestoreMountStub",
        "j,h0Y",
        "towupper",
        "HPWh|z",
        ";|$Xt",
        "2B2I2N2X2",
        "KERNEL32.dll",
        "GetDriveTypeW",
        "Insufficient resources for multithreaded chunked decoding; will skip!",
        "onecore\\internal\\base\\inc\\private\\eco\\wds\\UserWorkItemConnector.h",
        "t(9\\$",
        "8+8q8",
        "TFTPParse[ACK]: Block#=%u",
        "tKf9>tF",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\trace.cpp",
        "L$8;U",
        "9x\\tCW",
        "L%c%s",
        "MoveCaptureNode",
        "SetEvent",
        "848O8",
        "WimLazyInitialize",
        "<>=q=",
        "MCAPParse[S-CIR]",
        "1-141E1L1\\1c1w1",
        "495\\5p5",
        "1'1X1",
        "Expected [%u] contiguous parts, but missing part number [%u] for [%s]!",
        "GetVolumeNameForVolumeMountPointW",
        "0V0`0\"13191>1b1l1|1",
        "IMAGE\\WINDOWS\\VERSION\\MINOR",
        "!~<9~@t",
        "WIMApplyImageInternal",
        ";0;F;[;h;",
        "uM9xXu",
        "QQSVW",
        "FreeMibTable",
        "CopyFileExW",
        "WDSTPTC.dll",
        "=>>H>",
        "wof.sys",
        "ReadData reparse tag from filestream failed",
        "DeleteFileEx: Unable to get information on [%s]; GLE = 0x%x",
        "#text",
        "< <=<I<S<_<",
        "MCAPConstruct[PROGRESS]: Time-in-Session=%us, Progress=%u",
        "RtlAdjustPrivilege",
        "=H=\\=j=",
        ".text$mn",
        "uD9pXu",
        "SetThreadIdealProcessor",
        "RpcStringFreeW",
        ":S;];",
        "Compact apply failed because wof driver doesn't support it!",
        "% moa",
        "NACK Setup for seq# %I64u-%I64u, BO=%ums",
        "j\\Xf9DN",
        "WdsTransportClientGetAggressiveBufferSize",
        "MCTPParse[QCC:%I64x]: Session=0x%x, Seq#=%I64u, QCRBO=%u",
        "u6VVhd~",
        "Pj2jl",
        ">V?[?r?",
        "UncompressFileBase",
        "5U6H7O7O8",
        "CreateDirectoryW",
        "5O5V5",
        "9\\$`t",
        "WIM\\IMAGE[*]\\CREATIONTIME\\HIGHPART",
        "1|2E5",
        "?%?N?X?k?",
        "MSCFu",
        "WdsTransportClientInitialize",
        ";:<?<u<",
        "7E7R7Y7",
        "srand",
        "RPCRT4.dll",
        "BCryptHashData",
        "UTF-8",
        "T$@j[P",
        "System\\CurrentControlSet\\Services\\WofAdk",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\winsockinitializer.cpp",
        "5F5m5",
        "G,;G$rHw",
        "GetCurrentProcess",
        "ioctl: setting reparse point tag failed",
        "WdsCpParameterQuery",
        "PPPPSW",
        "3-3L3m3r3",
        ";2<|<",
        "1%101`1",
        "_^[Y]",
        "1,0*0",
        "ywVh(",
        ";y-{e",
        "j\\Zf9",
        "5$5`5g5|5",
        "MCAPParse[HEARTBEAT]: Time-to-Start=%u",
        ":W:a;",
        "WDS_TRACING_DEBUGGER_OUTPUT",
        "WdsTransportClientCancelSessionEx",
        ";.;L;u;|;",
        "5O6Y6",
        "9w8t]",
        "RestoreFileNodeList",
        "FindFirstFileNameW",
        "D$XAF",
        ":&;A;",
        "base\\eco\\wds\\transport\\client\\tptc\\tpcntnack.cpp",
        "CryptAcquireContextW",
        "7\"8F8O8Y8^8",
        "[%S:%u] Expression: %S, hr=0x%x",
        "TlsFree",
        "?$?h?m?",
        "=7=U=a=o=z=",
        "\\Windows\\SystemApps\\",
        "<J=Y=q=}=",
        " Operating System",
        "3.3G3~3",
        "vPQQh",
        "PVVh<",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "_initterm",
        "8'828",
        "3)333S3a3g3l3",
        "Setup",
        "jWX_]",
        "vXQQh",
        "6$6H6`6e6",
        "8M8c8",
        "SetLastError",
        "6G6]6",
        "base\\eco\\wds\\transport\\client\\tptc\\mcclient.cpp",
        "WdsCopyFileEx: Failed to strip file attributes for %s, will delete. GLE = 0x%x",
        ">MdDtu",
        ">http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0",
        "WimCreateDirectory",
        "WdsTransportClientApplyImage: recovering from multicast session startup failure (0x%08x); using direct apply",
        "9$9@9Z9",
        "oK0D$\"<",
        "_lock",
        "m_ActiveWriter.m_uThreadId == GetCurrentThreadId()",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\mrswlock.cpp",
        ".rdata$brc",
        "s`9s\\t",
        "Microsoft Code Signing PCA 2010",
        "\\Windows\\Assembly\\",
        "8B:J:_:|:",
        "base\\eco\\wds\\transport\\lib\\mctpconstructor.cpp",
        "2:2?2o2",
        "BCryptFinishHash",
        "z.9Wv",
        "base\\eco\\wds\\transport\\client\\tptc\\tpcntqcc.cpp",
        "ProcessWimQueueNode",
        "5!5=5M5S5i5~5",
        "j@Yf;",
        "u;9_0t6",
        "D$0;D$(",
        "9N$w;",
        "9,979m9}9",
        "=^>l>x>",
        "RestoreRefNode",
        "WDSCSL.dll",
        "CreateFile failed",
        "uVf9S",
        "I0i0p0'1",
        "?;?}?",
        "windowsize",
        ";]>a>e>i>m>q>u>y>}>",
        "stat. failed",
        "5@6G6c6j6",
        "5&5A5h5o5",
        "4]4d4",
        "ImpersonateLoggedOnUser",
        "465@5V5v5",
        "VPiw&",
        "D$ ;D$",
        "GetFileVersionInfoExW",
        "j0hXW",
        "m_uStartBlock <= uStartBlock",
        "CP9C<t",
        ">9?]?",
        "onecore\\internal\\base\\inc\\private\\eco\\wds\\locks.h",
        "S(_^[",
        "6/7h7o7y7",
        "D$PPQ",
        "System Volume Information",
        "SetFileSize failed",
        ":MdLcu",
        "INDEX",
        "5/6>6o6'717N7X7y7",
        "WdsTransportClientAddRefBuffer",
        "t=Wj,j",
        "2,3-6a7",
        "A4;F<t2",
        "\\Windows\\System32\\WimBootCompress.ini",
        ";/<`<j<",
        ";>;H;^;d;",
        "fltlib.dll",
        "8V8l8",
        "NtSetInformationFile",
        "<L=X=b=",
        "4%4/4\\4k4",
        ".jW^h",
        "&amp;",
        "\\\\?\\GLOBALROOT",
        "t49C8u",
        "w8VQj",
        "j?Yf97tQ",
        "WimCloseImageFile",
        "5?6J6k6",
        "ResAddFromFileAndHandle",
        "EventWrite",
        "j\\Yf9",
        "WdsTransportClientStartSession",
        ".rdata$sxdata",
        "RestoreReparsePoint",
        "=9>K>",
        "7!7@7Y7^7",
        "1B1L1r1",
        "B\\;A\\",
        "RemoveDirectoryW",
        "7V8]8",
        "GetSystemTimeAsFileTime",
        "memset",
        ">F?a?",
        "=\\>c>",
        "> >'>8>",
        "GetTickCount",
        "888X8x8",
        "MCTPParse[RDATA:%I64x]: Session=0x%x, Client=0x%x, Seq#=%I64u, Trail#=%I64u, Data Len=%u",
        " !\"\"\"#$ &&&%%%%%%%",
        "5Fz<|",
        "New Master Client as reported by server: 0x%x (this client: 0x%x)",
        "pQCR Backoff selected=%ums",
        "Client demoted to MAddr=%s:%u, UAddr=%s:%u",
        "5(6/6\\6c6",
        "LocalFree",
        "MCTPParse[SPM:%I64x]: Session=0x%x, Seq#=%I64u, Client=0x%x, MinNACKBO=%u, MaxNACKBO=%u, Trail#=%I64u, Lead#=%I64u, RTT=%ums",
        ">=?D?",
        "ParseChunkRegionInternal",
        "ProductName",
        "1R1Z1q1",
        "TpUniAddress",
        "VerifyFileByHandle",
        "K4;C u(;K$u#",
        "8!8I8S8",
        "Xf9ABt",
        "8)8E8L8a8,939>9E9",
        "2g3p3",
        "Failed to load WofAdk!",
        "%s\\%s",
        "041;1",
        "_except_handler4_common",
        "PostQueuedCompletionStatus",
        "v!VQhDL",
        ":*:2:{:",
        "WIM\\IMAGE[*]\\WIMBOOTENTRIES",
        "WdsCpPacketInitialize",
        "MCTPParse[POLL:%I64x]: Session=0x%x, Seq#=%I64u, BOTime=%ums, DataLen=%u",
        "=!=Q=[=",
        "GetAclInformation",
        "RestoreDirData",
        "t#j\\Q",
        "RestoreRefNodeCallback",
        "GetSysVolInfoPathFromMountPath",
        "1'232=2C2P2",
        "_wtoi",
        "20201008073425.887Z0",
        "SetFileTime",
        ";4<i<",
        "xmlns",
        "GetSecurityDescriptorGroup",
        "-eQkU",
        "RtlSetControlSecurityDescriptor",
        "GetSecurityDescriptorDacl",
        "base\\eco\\wds\\transport\\lib\\tptmisc.cpp",
        ";](s?",
        "vdQPh(/",
        "< <W<~<",
        "?w<t6",
        "D$8G;}",
        "<V=`=",
        "232W2|2",
        "WimbootCleanup",
        "9A0vq",
        "Process PID %d is accessing file wim %s",
        ";3;X;",
        "I0G1-0+",
        ";$<K<s<",
        "758X8y8",
        "3v3&4g4",
        "979A9W9|9",
        "=?=Q=",
        "GetPrivateProfileSectionW",
        "50?0i0",
        "DeletePath: Failed to obliterate [%s] after %d tries; GLE = 0x%x",
        " Microsoft Corporation. All rights reserved.",
        ";@<T<",
        ";T<[<q<x<",
        "((((m_uSecurityMode) & 0xffff) == (3)) || ((((m_uSecurityMode)>>16)&0xffff) == (3)))",
        "0%000O0Y0",
        "WimMoveFile",
        "^j?[;",
        "FlushFileBuffers",
        "50585Z5d5",
        "timeout",
        "!This program cannot be run in DOS mode.",
        ":,;=;D;\\;u;",
        "t1VPQ",
        "4=547",
        "C<+C(",
        "SRh`]",
        "WdsTransportClientApplyImage: received data block not aligned on block boundary; offset=%I64u, blocksize=%u",
        "7+7a7",
        "f@f#E",
        "3 3P3Z3",
        "DeleteFileEx: Unable to delete [%s]; GLE = 0x%x",
        "9r$tL;",
        "DeleteFileEx: Trying to set back attributes on: %s",
        "ResExtract",
        "windows",
        "SignKey",
        "OpenThreadToken",
        "WimGetFileIdByHandle",
        "OpenProcessToken",
        "9P t49P",
        "QQQQQQQW",
        "D$LVW",
        "CloseHandle",
        "? ?h?r?",
        "DeletePathEngine: Hit %d failure%s during recursive deletion of [%s]; 1st error = 0x%x, cd = [%s]",
        "j<h X",
        "6!6(6/666=6D6K6R6X6d6o6t6y6",
        "u PPP",
        "jSh\\ ",
        "WriteFile",
        "4$404<4H4T4`4l4x4",
        "4a4p4w4",
        "SSSPS",
        "w,_^3",
        "6>6J6Q6]6l6{6",
        "WIM\\IMAGE[*]",
        "wdstptc.pdb",
        "8:9Q9|9",
        "NACK for seq# %I64u-%I64u deleted because trail# is now %I64u.",
        "T$(9T$8",
        "D$ QQQQj",
        "T$(9GL|X",
        "][YZ_^_^[",
        "WaitForMultipleObjects",
        ";&;d<",
        "FileVersion",
        "G(;G r>Q",
        "< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\\<`<d<h<l<p<t<",
        "<&<[<",
        "LoadIntegrityInfo",
        "Could not set compression. Invalid cluster size.",
        "ATTLIST",
        ".rdata$zzzdbg",
        "SeManageVolumePrivilege",
        "PWVhpo",
        "9*949",
        "6PQQh\\/",
        "PPPh`",
        "VWRQSU",
        "uNj03",
        "Printed name string copy failed",
        ">)?3?",
        ":(:@:y:",
        "CompareStringW",
        "SVWh@",
        "3D3d3",
        "CreateThread",
        "210121231916Z0"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "560afe20f035e65836990ab3cc33778a7d2eb74b03ad109a22067763e5764dc2",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/560afe20f035e65836990ab3cc33778a7d2eb74b03ad109a22067763e5764dc2",
              "guest_paths": [
                "overlay"
              ],
              "size": 8640,
              "crc32": "6DF20D1E",
              "md5": "7c0508a2af65e2c1eb353698f5d7983e",
              "sha1": "477bf5c8cf2beb0860b913576cb9a0fb0d3c2302",
              "sha256": "560afe20f035e65836990ab3cc33778a7d2eb74b03ad109a22067763e5764dc2",
              "sha512": "61a8e93149776e10c0a854b3601e6112a6a0ec0141e1a88992403a2c539731b399c4839891251a53f2b15bf9cbbff0521fe2a9bfc67a1769ec0ea0b95cb6c1e0",
              "rh_hash": null,
              "ssdeep": "192:YWf9BvVVWQ4yWfjmFpeLirKqnajlIMDCh:9NVOLIKlmMGh",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T1EF0229A2CE6C9043EA927C5053C8DDD77C3D93C7294090A612AEFAE81DC37C1EB0196E",
              "sha3_384": "08870b1440e51dce6b6d73ef8a6ea8637f8741bfefdc0f9bfc050165006c342106ab63d5fb1c631dabdb44f96e58e171",
              "data": null
            }
          ],
          "extracted_files_time": 0.0008121110004140064,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    },
    {
      "name": [
        "windlp.state-old.xml"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/7f1c86c93da12c1af89a5811c6536b2726a0c4bff04f961ef1f578dc8fbfceb0",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
      ],
      "size": 7042,
      "crc32": "ACB45C89",
      "md5": "ac7fc5e1f99c0cc8e2b68f0712c8be2d",
      "sha1": "eb0a27fa22ad62d7111961825931305fd091d8d7",
      "sha256": "7f1c86c93da12c1af89a5811c6536b2726a0c4bff04f961ef1f578dc8fbfceb0",
      "sha512": "6189dcd02e3ade8ff8f02442e151a42fc4bee038d9592f40abfda6c2c137e0b0979d855f566c9c4fc55a635e40c9b8c911e21fe75da350ff4c503f73891a09ba",
      "rh_hash": null,
      "ssdeep": "48:SghLRdCXl2lPlEBdYXjo66XqmjbxYapaInfnmGWHvG1EoHu2Q+QsKoKt2sBaNQC6:SOLRdCXlyda6apHP1Lu7T5dITRw2+9",
      "type": "Unicode text, UTF-16, little-endian text, with CRLF line terminators",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1A7E1EF03A3FB1048B27B156C5DB254760A6BB91A5B3DC5AE01AC714DCFF3E2289507A7",
      "sha3_384": "d80209c926e715dbc5c652af9a79a3dcc8f3cc5c4f7bc1cc6a4219dd196ead032eaeee85d02948ad68a0d587d5ecfef4",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "data": "ÿþ<\u0000W\u0000I\u0000N\u0000D\u0000L\u0000P\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u00000\u0000<\u0000/\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000T\u0000a\u0000s\u0000k\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u00001\u0000<\u0000/\u0000T\u0000a\u0000s\u0000k\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000W\u0000o\u0000r\u0000k\u0000i\u0000n\u0000g\u0000P\u0000a\u0000t\u0000h\u0000>\u0000C\u0000:\u0000\\\u0000$\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000.\u0000~\u0000W\u0000S\u0000\\\u0000S\u0000o\u0000u\u0000r\u0000c\u0000e\u0000s\u0000\\\u0000P\u0000a\u0000n\u0000t\u0000h\u0000e\u0000r\u0000<\u0000/\u0000W\u0000o\u0000r\u0000k\u0000i\u0000n\u0000g\u0000P\u0000a\u0000t\u0000h\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u00003\u0000<\u0000/\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000W\u0000u\u0000I\u0000d\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00000\u0000e\u00009\u0000c\u0000f\u0000b\u00004\u00000\u0000-\u00000\u0000d\u00006\u00003\u0000-\u00004\u00005\u0000b\u0000e\u0000-\u0000b\u00001\u00006\u00009\u0000-\u00005\u00001\u00005\u0000d\u00003\u00003\u00005\u00003\u00003\u00007\u0000a\u00008\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000H\u0000o\u0000s\u0000t\u0000O\u0000S\u0000B\u0000r\u0000a\u0000n\u0000c\u0000h\u0000N\u0000a\u0000m\u0000e\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000v\u0000b\u0000_\u0000r\u0000e\u0000l\u0000e\u0000a\u0000s\u0000e\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000W\u0000e\u0000b\u0000S\u0000e\u0000t\u0000u\u0000p\u0000O\u0000n\u0000l\u0000i\u0000n\u0000e\u0000S\u0000t\u0000o\u0000r\u0000e\u0000V\u0000e\u0000r\u0000s\u0000i\u0000o\u0000n\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00001\u0000.\u00004\u0000.\u00001\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000S\u0000t\u0000r\u0000i\u0000n\u0000g\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u0000E\u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000N\u0000a\u0000t\u0000i\u0000v\u0000e\u0000P\u0000r\u0000o\u0000c\u0000e\u0000s\u0000s\u0000o\u0000r\u0000A\u0000r\u0000c\u0000h\u0000i\u0000t\u0000e\u0000c\u0000t\u0000u\u0000r\u0000e\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00009\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000S\u0000q\u0000m\u0000\\\u00009\u00003\u00009\u00004\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00009\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000S\u0000e\u0000t\u0000u\u0000p\u00003\u00006\u00000\u0000S\u0000c\u0000e\u0000n\u0000a\u0000r\u0000i\u0000o\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00007\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000S\u0000q\u0000m\u0000\\\u00001\u00002\u00002\u00006\u00007\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00007\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000S\u0000e\u0000t\u0000u\u0000p\u00003\u00006\u00000\u0000M\u0000o\u0000d\u0000e\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00008\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000I\u0000s\u0000W\u0000e\u0000b\u0000S\u0000e\u0000t\u0000u\u0000p\u0000C\u0000r\u0000e\u0000a\u0000t\u0000e\u0000d\u0000M\u0000e\u0000d\u0000i\u0000a\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00000\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000L\u0000e\u0000g\u0000a\u0000c\u0000y\u0000S\u0000e\u0000t\u0000u\u0000p\u0000I\u0000n\u0000t\u0000e\u0000r\u0000r\u0000u\u0000p\u0000t\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00000\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000H\u0000o\u0000s\u0000t\u0000O\u0000S\u0000B\u0000u\u0000i\u0000l\u0000d\u0000N\u0000u\u0000m\u0000b\u0000e\u0000r\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00004\u0000A\u00006\u00005\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000R\u0000e\u0000f\u0000l\u0000e\u0000c\u0000t\u0000D\u0000r\u0000i\u0000v\u0000e\u0000r\u0000s\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00000\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000P\u0000o\u0000s\u0000t\u0000R\u0000o\u0000l\u0000l\u0000b\u0000a\u0000c\u0000k\u0000C\u0000o\u0000n\u0000t\u0000e\u0000x\u0000t\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00000\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000S\u0000e\u0000t\u0000u\u0000p\u0000U\u0000p\u0000g\u0000r\u0000a\u0000d\u0000e\u0000A\u0000t\u0000t\u0000e\u0000m\u0000p\u0000t\u0000s\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00000\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000S\u0000q\u0000m\u0000\\\u00001\u00002\u00002\u00006\u00005\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00000\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000S\u0000e\u0000t\u0000u\u0000p\u0000P\u0000r\u0000i\u0000o\u0000r\u0000i\u0000t\u0000y\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00001\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000M\u0000o\u0000S\u0000e\u0000t\u0000u\u0000p\u0000P\u0000h\u0000a\u0000s\u0000e\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00002\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000D\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000Q\u0000u\u0000a\u0000d\u0000w\u0000o\u0000r\u0000d\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u00001\u0000<\u0000/\u0000Q\u0000u\u0000a\u0000d\u0000w\u0000o\u0000r\u0000d\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000Q\u0000u\u0000a\u0000d\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000T\u0000e\u0000l\u0000#\u0000A\u0000s\u0000m\u0000v\u0000\\\u0000S\u0000e\u0000t\u0000u\u0000p\u0000S\u0000t\u0000a\u0000r\u0000t\u0000T\u0000i\u0000m\u0000e\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u00001\u0000D\u0000C\u0000E\u0000E\u0000F\u00005\u0000A\u0000A\u0000C\u00001\u00008\u0000B\u0000C\u00005\u0000<\u0000/\u0000V\u0000a\u0000l\u0000u\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000Q\u0000u\u0000a\u0000d\u0000w\u0000o\u0000r\u0000d\u0000P\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000y\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000T\u0000A\u0000S\u0000K\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u00003\u0000<\u0000/\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000E\u0000r\u0000r\u0000o\u0000r\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u00003\u0000<\u0000/\u0000E\u0000r\u0000r\u0000o\u0000r\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000E\u0000r\u0000r\u0000o\u0000r\u0000C\u0000o\u0000d\u0000e\u0000>\u00000\u0000<\u0000/\u0000E\u0000r\u0000r\u0000o\u0000r\u0000C\u0000o\u0000d\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000N\u0000a\u0000m\u0000e\u0000>\u0000P\u0000r\u0000e\u0000D\u0000o\u0000w\u0000n\u0000l\u0000o\u0000a\u0000d\u0000<\u0000/\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000W\u0000o\u0000r\u0000k\u0000i\u0000n\u0000g\u0000P\u0000a\u0000t\u0000h\u0000>\u0000C\u0000:\u0000\\\u0000$\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000.\u0000~\u0000W\u0000S\u0000\\\u0000S\u0000o\u0000u\u0000r\u0000c\u0000e\u0000s\u0000<\u0000/\u0000W\u0000o\u0000r\u0000k\u0000i\u0000n\u0000g\u0000P\u0000a\u0000t\u0000h\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000T\u0000r\u0000a\u0000n\u0000s\u0000f\u0000e\u0000r\u0000r\u0000i\u0000n\u0000g\u0000>\u00000\u0000<\u0000/\u0000T\u0000r\u0000a\u0000n\u0000s\u0000f\u0000e\u0000r\u0000r\u0000i\u0000n\u0000g\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000F\u0000i\u0000l\u0000e\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u00000\u0000<\u0000/\u0000F\u0000i\u0000l\u0000e\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u00002\u0000<\u0000/\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000C\u0000o\u0000u\u0000n\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000T\u0000R\u0000A\u0000N\u0000S\u0000P\u0000O\u0000R\u0000T\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000T\u0000r\u0000a\u0000n\u0000s\u0000p\u0000o\u0000r\u0000t\u0000I\u0000d\u0000>\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000<\u0000/\u0000T\u0000r\u0000a\u0000n\u0000s\u0000p\u0000o\u0000r\u0000t\u0000I\u0000d\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000/\u0000T\u0000R\u0000A\u0000N\u0000S\u0000P\u0000O\u0000R\u0000T\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000C\u0000T\u0000I\u0000O\u0000N\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000I\u0000d\u0000>\u00001\u0000c\u00002\u00008\u00000\u00008\u00008\u00009\u0000-\u0000f\u0000d\u00002\u00007\u0000-\u00004\u0000a\u0000a\u00005\u0000-\u00008\u00003\u0000c\u00009\u0000-\u0000d\u0000f\u0000d\u00003\u0000d\u00007\u00004\u0000c\u00002\u00006\u0000b\u0000f\u0000<\u0000/\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000I\u0000d\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000W\u0000e\u0000i\u0000g\u0000h\u0000t\u0000>\u00001\u0000<\u0000/\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000W\u0000e\u0000i\u0000g\u0000h\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000N\u0000a\u0000m\u0000e\u0000>\u0000E\u0000u\u0000l\u0000a\u0000<\u0000/\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u00003\u0000<\u0000/\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000E\u0000r\u0000r\u0000o\u0000r\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u00003\u0000<\u0000/\u0000E\u0000r\u0000r\u0000o\u0000r\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000E\u0000r\u0000r\u0000o\u0000r\u0000C\u0000o\u0000d\u0000e\u0000>\u00000\u0000<\u0000/\u0000E\u0000r\u0000r\u0000o\u0000r\u0000C\u0000o\u0000d\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000P\u0000r\u0000o\u0000g\u0000r\u0000e\u0000s\u0000s\u0000T\u0000o\u0000t\u0000a\u0000l\u0000>\u00006\u00004\u0000<\u0000/\u0000P\u0000r\u0000o\u0000g\u0000r\u0000e\u0000s\u0000s\u0000T\u0000o\u0000t\u0000a\u0000l\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000P\u0000r\u0000o\u0000g\u0000r\u0000e\u0000s\u0000s\u0000C\u0000u\u0000r\u0000r\u0000e\u0000n\u0000t\u0000>\u00000\u0000<\u0000/\u0000P\u0000r\u0000o\u0000g\u0000r\u0000e\u0000s\u0000s\u0000C\u0000u\u0000r\u0000r\u0000e\u0000n\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000E\u0000u\u0000l\u0000a\u0000F\u0000i\u0000l\u0000e\u0000P\u0000a\u0000t\u0000h\u0000>\u0000C\u0000:\u0000\\\u0000$\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000.\u0000~\u0000W\u0000S\u0000\\\u0000S\u0000o\u0000u\u0000r\u0000c\u0000e\u0000s\u0000\\\u0000P\u0000a\u0000n\u0000t\u0000h\u0000e\u0000r\u0000\\\u0000E\u0000u\u0000l\u0000a\u0000.\u0000r\u0000t\u0000f\u0000<\u0000/\u0000E\u0000u\u0000l\u0000a\u0000F\u0000i\u0000l\u0000e\u0000P\u0000a\u0000t\u0000h\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000P\u0000r\u0000o\u0000d\u0000u\u0000c\u0000t\u0000s\u0000X\u0000m\u0000l\u0000F\u0000i\u0000l\u0000e\u0000P\u0000a\u0000t\u0000h\u0000>\u0000C\u0000:\u0000\\\u0000$\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000.\u0000~\u0000W\u0000S\u0000\\\u0000S\u0000o\u0000u\u0000r\u0000c\u0000e\u0000s\u0000\\\u0000p\u0000r\u0000o\u0000d\u0000u\u0000c\u0000t\u0000s\u0000.\u0000x\u0000m\u0000l\u0000<\u0000/\u0000P\u0000r\u0000o\u0000d\u0000u\u0000c\u0000t\u0000s\u0000X\u0000m\u0000l\u0000F\u0000i\u0000l\u0000e\u0000P\u0000a\u0000t\u0000h\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000c\u0000e\u0000p\u0000t\u0000E\u0000u\u0000l\u0000a\u0000D\u0000e\u0000f\u0000a\u0000u\u0000l\u0000t\u0000>\u00000\u0000<\u0000/\u0000A\u0000c\u0000c\u0000e\u0000p\u0000t\u0000E\u0000u\u0000l\u0000a\u0000D\u0000e\u0000f\u0000a\u0000u\u0000l\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000c\u0000e\u0000p\u0000t\u0000E\u0000u\u0000l\u0000a\u0000S\u0000e\u0000l\u0000e\u0000c\u0000t\u0000e\u0000d\u0000>\u00000\u0000<\u0000/\u0000A\u0000c\u0000c\u0000e\u0000p\u0000t\u0000E\u0000u\u0000l\u0000a\u0000S\u0000e\u0000l\u0000e\u0000c\u0000t\u0000e\u0000d\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000/\u0000A\u0000C\u0000T\u0000I\u0000O\u0000N\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000C\u0000T\u0000I\u0000O\u0000N\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000I\u0000d\u0000>\u0000f\u0000d\u00003\u00000\u00009\u00007\u0000a\u0000a\u0000-\u00004\u00006\u00007\u0000b\u0000-\u00004\u0000b\u0000a\u0000a\u0000-\u0000a\u00003\u00002\u00006\u0000-\u00002\u0000e\u00001\u00004\u00005\u00005\u00009\u0000f\u00008\u0000a\u0000b\u0000a\u0000<\u0000/\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000I\u0000d\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000W\u0000e\u0000i\u0000g\u0000h\u0000t\u0000>\u00001\u0000<\u0000/\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000W\u0000e\u0000i\u0000g\u0000h\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000N\u0000a\u0000m\u0000e\u0000>\u0000G\u0000e\u0000t\u0000W\u0000e\u0000b\u0000S\u0000e\u0000t\u0000u\u0000p\u0000U\u0000s\u0000e\u0000r\u0000I\u0000n\u0000p\u0000u\u0000t\u0000<\u0000/\u0000A\u0000c\u0000t\u0000i\u0000o\u0000n\u0000N\u0000a\u0000m\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u0000F\u0000E\u0000B\u0000E\u0000F\u0000E\u0000B\u0000E\u0000<\u0000/\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000E\u0000r\u0000r\u0000o\u0000r\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u0000F\u0000E\u0000B\u0000E\u0000F\u0000E\u0000B\u0000E\u0000<\u0000/\u0000E\u0000r\u0000r\u0000o\u0000r\u0000S\u0000t\u0000a\u0000t\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000E\u0000r\u0000r\u0000o\u0000r\u0000C\u0000o\u0000d\u0000e\u0000>\u00000\u0000<\u0000/\u0000E\u0000r\u0000r\u0000o\u0000r\u0000C\u0000o\u0000d\u0000e\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000P\u0000r\u0000o\u0000g\u0000r\u0000e\u0000s\u0000s\u0000T\u0000o\u0000t\u0000a\u0000l\u0000>\u00000\u0000<\u0000/\u0000P\u0000r\u0000o\u0000g\u0000r\u0000e\u0000s\u0000s\u0000T\u0000o\u0000t\u0000a\u0000l\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000 \u0000 \u0000<\u0000P\u0000r\u0000o\u0000g\u0000r\u0000e\u0000s\u0000s\u0000C\u0000u\u0000r\u0000r\u0000e\u0000n\u0000t\u0000>\u00000\u0000<\u0000/\u0000P\u0000r\u0000o\u0000g\u0000r\u0000e\u0000s\u0000s\u0000C\u0000u\u0000r\u0000r\u0000e\u0000n\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000 \u0000<\u0000/\u0000A\u0000C\u0000T\u0000I\u0000O\u0000N\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000<\u0000/\u0000T\u0000A\u0000S\u0000K\u0000>\u0000\r\u0000\n\u0000<\u0000/\u0000W\u0000I\u0000N\u0000D\u0000L\u0000P\u0000>\u0000\r\u0000\n\u0000",
      "strings": [],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5932
    },
    {
      "name": [
        "wdscsl.dll"
      ],
      "path": "/opt/CAPEv2/storage/analyses/4/files/d5bcfdab29ea1deea22679a4a4473a9cc84871a5d707c006eb99facb4af9081b",
      "guest_paths": [
        "C:\\$Windows.~WS\\Sources\\wdscsl.dll"
      ],
      "size": 50504,
      "crc32": "F1119382",
      "md5": "0b778ad42d5e17ce89936f6d4c42957d",
      "sha1": "dcc971675653547295ac4ee95e139a1cca7a20c5",
      "sha256": "d5bcfdab29ea1deea22679a4a4473a9cc84871a5d707c006eb99facb4af9081b",
      "sha512": "3aaf945a4735bc867ad4c4213ec43079b8b8fef17cbaf3b394365762451e36f51075e7e129fc8dcbc847dc44501536309114b6c54a4d415d21d0459049e51026",
      "rh_hash": null,
      "ssdeep": "1536:bvftzpTPMNBV4VJMZ/MZJ//3swsxsiM9gVP599:7ftNTENBVcMZW/3sjaiM9gVj9",
      "type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T10F335B52A65804E3E7663670B06A97765D7DEF601FA001C71323916A3C627C3AF3A36F",
      "sha3_384": "68ce54945f68f1233b5b9e4e5158bd877638f10a6d5f0de7571220b897bf8b644e8a9e937992fd3793cfed0bc123aa22",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "2cfbfcfaa4386713f46caff3d3492c1befa30fbee2612c3eb9b58fd679acd51f",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": "Thu Oct 08 02:47:12 2020",
          "aux_valid": true,
          "aux_error": null,
          "aux_error_desc": null,
          "aux_signers": [
            {
              "name": "Certificate Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Certificate Chain 2",
              "Issued to": "Microsoft Code Signing PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sun Jul 06 13:50:17 2025",
              "SHA1 hash": "8bfe3107712b3c886b1c96aaec89984914dc9b6b"
            },
            {
              "name": "Certificate Chain 3",
              "Issued to": "Microsoft Corporation",
              "Issued by": "Microsoft Code Signing PCA 2010",
              "Expires": "Wed Mar 03 11:29:21 2021",
              "SHA1 hash": "693258bdb52c85282542d5e1e33b028f9539f388"
            },
            {
              "name": "Timestamp Chain 1",
              "Issued to": "Microsoft Root Certificate Authority 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Sat Jun 23 15:04:01 2035",
              "SHA1 hash": "3b1efd3a66ea28b16697394703a72ca340a05bd5"
            },
            {
              "name": "Timestamp Chain 2",
              "Issued to": "Microsoft Time-Stamp PCA 2010",
              "Issued by": "Microsoft Root Certificate Authority 2010",
              "Expires": "Tue Jul 01 14:46:55 2025",
              "SHA1 hash": "2aa752fe64c49abe82913c463529cf10ff2f04ee"
            },
            {
              "name": "Timestamp Chain 3",
              "Issued to": "Microsoft Time-Stamp Service",
              "Issued by": "Microsoft Time-Stamp PCA 2010",
              "Expires": "Thu Feb 11 14:40:40 2021",
              "SHA1 hash": "39c906e3ede9ab3113fe8e3758baca598ccab0dc"
            }
          ]
        },
        "digital_signers": [],
        "imagebase": "0x10000000",
        "entrypoint": "0x00008340",
        "ep_bytes": "8bff558bec837d0c017505e8f5050000",
        "peid_signatures": null,
        "reported_checksum": "0x00018307",
        "actual_checksum": "0x00018307",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_I386",
        "pdbpath": "wdscsl.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x1000b174",
                "name": "wprintf"
              },
              {
                "address": "0x1000b178",
                "name": "memmove"
              },
              {
                "address": "0x1000b17c",
                "name": "??1type_info@@UAE@XZ"
              },
              {
                "address": "0x1000b180",
                "name": "_onexit"
              },
              {
                "address": "0x1000b184",
                "name": "__dllonexit"
              },
              {
                "address": "0x1000b188",
                "name": "_unlock"
              },
              {
                "address": "0x1000b18c",
                "name": "_lock"
              },
              {
                "address": "0x1000b190",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x1000b194",
                "name": "_except_handler4_common"
              },
              {
                "address": "0x1000b198",
                "name": "_initterm"
              },
              {
                "address": "0x1000b19c",
                "name": "_amsg_exit"
              },
              {
                "address": "0x1000b1a0",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x1000b1a4",
                "name": "_callnewh"
              },
              {
                "address": "0x1000b1a8",
                "name": "?what@exception@@UBEPBDXZ"
              },
              {
                "address": "0x1000b1ac",
                "name": "??1exception@@UAE@XZ"
              },
              {
                "address": "0x1000b1b0",
                "name": "??0exception@@QAE@ABV0@@Z"
              },
              {
                "address": "0x1000b1b4",
                "name": "??0exception@@QAE@XZ"
              },
              {
                "address": "0x1000b1b8",
                "name": "malloc"
              },
              {
                "address": "0x1000b1bc",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x1000b1c0",
                "name": "memcpy"
              },
              {
                "address": "0x1000b1c4",
                "name": "memcmp"
              },
              {
                "address": "0x1000b1c8",
                "name": "_vsnprintf"
              },
              {
                "address": "0x1000b1cc",
                "name": "_XcptFilter"
              },
              {
                "address": "0x1000b1d0",
                "name": "free"
              },
              {
                "address": "0x1000b1d4",
                "name": "_purecall"
              },
              {
                "address": "0x1000b1d8",
                "name": "memset"
              }
            ]
          },
          "KERNEL32": {
            "dll": "KERNEL32.dll",
            "imports": [
              {
                "address": "0x1000b028",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x1000b02c",
                "name": "GetTickCount"
              },
              {
                "address": "0x1000b030",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x1000b034",
                "name": "SetUnhandledExceptionFilter"
              },
              {
                "address": "0x1000b038",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x1000b03c",
                "name": "TerminateProcess"
              },
              {
                "address": "0x1000b040",
                "name": "CancelIo"
              },
              {
                "address": "0x1000b044",
                "name": "GetCurrentProcessId"
              },
              {
                "address": "0x1000b048",
                "name": "QueryPerformanceCounter"
              },
              {
                "address": "0x1000b04c",
                "name": "Sleep"
              },
              {
                "address": "0x1000b050",
                "name": "InterlockedPopEntrySList"
              },
              {
                "address": "0x1000b054",
                "name": "SetLastError"
              },
              {
                "address": "0x1000b058",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x1000b05c",
                "name": "GetModuleHandleExW"
              },
              {
                "address": "0x1000b060",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x1000b064",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x1000b068",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x1000b06c",
                "name": "GetVersionExW"
              },
              {
                "address": "0x1000b070",
                "name": "CreateEventW"
              },
              {
                "address": "0x1000b074",
                "name": "GetLastError"
              },
              {
                "address": "0x1000b078",
                "name": "SetEvent"
              },
              {
                "address": "0x1000b07c",
                "name": "WaitForSingleObjectEx"
              },
              {
                "address": "0x1000b080",
                "name": "CloseHandle"
              },
              {
                "address": "0x1000b084",
                "name": "GetProcAddress"
              },
              {
                "address": "0x1000b088",
                "name": "DeleteCriticalSection"
              },
              {
                "address": "0x1000b08c",
                "name": "SleepConditionVariableSRW"
              },
              {
                "address": "0x1000b090",
                "name": "WakeAllConditionVariable"
              },
              {
                "address": "0x1000b094",
                "name": "AcquireSRWLockExclusive"
              },
              {
                "address": "0x1000b098",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x1000b09c",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x1000b0a0",
                "name": "InitializeSListHead"
              },
              {
                "address": "0x1000b0a4",
                "name": "InterlockedPushEntrySList"
              },
              {
                "address": "0x1000b0a8",
                "name": "OutputDebugStringW"
              },
              {
                "address": "0x1000b0ac",
                "name": "SetEnvironmentVariableW"
              },
              {
                "address": "0x1000b0b0",
                "name": "GetEnvironmentVariableW"
              },
              {
                "address": "0x1000b0b4",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x1000b0b8",
                "name": "ReleaseSemaphore"
              },
              {
                "address": "0x1000b0bc",
                "name": "CreateSemaphoreW"
              },
              {
                "address": "0x1000b0c0",
                "name": "GetQueuedCompletionStatus"
              },
              {
                "address": "0x1000b0c4",
                "name": "WaitForMultipleObjects"
              },
              {
                "address": "0x1000b0c8",
                "name": "PostQueuedCompletionStatus"
              },
              {
                "address": "0x1000b0cc",
                "name": "CreateThread"
              },
              {
                "address": "0x1000b0d0",
                "name": "FreeLibrary"
              },
              {
                "address": "0x1000b0d4",
                "name": "CreateIoCompletionPort"
              },
              {
                "address": "0x1000b0d8",
                "name": "GetSystemInfo"
              },
              {
                "address": "0x1000b0dc",
                "name": "OutputDebugStringA"
              }
            ]
          },
          "ADVAPI32": {
            "dll": "ADVAPI32.dll",
            "imports": [
              {
                "address": "0x1000b000",
                "name": "ImpersonateLoggedOnUser"
              },
              {
                "address": "0x1000b004",
                "name": "LogonUserW"
              },
              {
                "address": "0x1000b008",
                "name": "LsaClose"
              },
              {
                "address": "0x1000b00c",
                "name": "LsaFreeMemory"
              },
              {
                "address": "0x1000b010",
                "name": "LsaQueryInformationPolicy"
              },
              {
                "address": "0x1000b014",
                "name": "LsaOpenPolicy"
              },
              {
                "address": "0x1000b018",
                "name": "RevertToSelf"
              }
            ]
          },
          "WS2_32": {
            "dll": "WS2_32.dll",
            "imports": [
              {
                "address": "0x1000b130",
                "name": "inet_addr"
              },
              {
                "address": "0x1000b134",
                "name": "FreeAddrInfoW"
              },
              {
                "address": "0x1000b138",
                "name": "GetAddrInfoW"
              },
              {
                "address": "0x1000b13c",
                "name": "WSAGetLastError"
              },
              {
                "address": "0x1000b140",
                "name": "setsockopt"
              },
              {
                "address": "0x1000b144",
                "name": "WSAGetOverlappedResult"
              },
              {
                "address": "0x1000b148",
                "name": "htons"
              },
              {
                "address": "0x1000b14c",
                "name": "WSARecvFrom"
              },
              {
                "address": "0x1000b150",
                "name": "ntohs"
              },
              {
                "address": "0x1000b154",
                "name": "WSAStartup"
              },
              {
                "address": "0x1000b158",
                "name": "WSASocketW"
              },
              {
                "address": "0x1000b15c",
                "name": "WSASendTo"
              },
              {
                "address": "0x1000b160",
                "name": "closesocket"
              },
              {
                "address": "0x1000b164",
                "name": "bind"
              },
              {
                "address": "0x1000b168",
                "name": "WSACleanup"
              },
              {
                "address": "0x1000b16c",
                "name": "GetNameInfoW"
              }
            ]
          },
          "RPCRT4": {
            "dll": "RPCRT4.dll",
            "imports": [
              {
                "address": "0x1000b0fc",
                "name": "RpcErrorGetNextRecord"
              },
              {
                "address": "0x1000b100",
                "name": "RpcBindingFree"
              },
              {
                "address": "0x1000b104",
                "name": "RpcErrorStartEnumeration"
              },
              {
                "address": "0x1000b108",
                "name": "RpcAsyncCancelCall"
              },
              {
                "address": "0x1000b10c",
                "name": "RpcStringFreeW"
              },
              {
                "address": "0x1000b110",
                "name": "RpcAsyncCompleteCall"
              },
              {
                "address": "0x1000b114",
                "name": "I_RpcExceptionFilter"
              },
              {
                "address": "0x1000b118",
                "name": "RpcStringBindingComposeW"
              },
              {
                "address": "0x1000b11c",
                "name": "RpcBindingSetAuthInfoW"
              },
              {
                "address": "0x1000b120",
                "name": "RpcBindingFromStringBindingW"
              },
              {
                "address": "0x1000b124",
                "name": "RpcAsyncInitializeHandle"
              },
              {
                "address": "0x1000b128",
                "name": "NdrAsyncClientCall"
              }
            ]
          },
          "NTDSAPI": {
            "dll": "NTDSAPI.dll",
            "imports": [
              {
                "address": "0x1000b0e4",
                "name": "DsMakeSpnW"
              }
            ]
          },
          "OLEAUT32": {
            "dll": "OLEAUT32.dll",
            "imports": [
              {
                "address": "0x1000b0ec",
                "name": "GetErrorInfo"
              },
              {
                "address": "0x1000b0f0",
                "name": "SysFreeString"
              },
              {
                "address": "0x1000b0f4",
                "name": "SetErrorInfo"
              }
            ]
          },
          "IPHLPAPI": {
            "dll": "IPHLPAPI.DLL",
            "imports": [
              {
                "address": "0x1000b020",
                "name": "GetAdaptersAddresses"
              }
            ]
          }
        },
        "exported_dll_name": "WDSCSL.dll",
        "exports": [
          {
            "address": "0x10006030",
            "name": "WdsClientExecute",
            "ordinal": 1
          },
          {
            "address": "0x10005f40",
            "name": "WdsClientFreeLibrary",
            "ordinal": 2
          },
          {
            "address": "0x10005f20",
            "name": "WdsClientInitializeLibrary",
            "ordinal": 3
          },
          {
            "address": "0x10006050",
            "name": "WdsClientPacketAllocate",
            "ordinal": 4
          },
          {
            "address": "0x10006070",
            "name": "WdsClientPacketFree",
            "ordinal": 5
          },
          {
            "address": "0x10005fd0",
            "name": "WdsClientRegisterTrace",
            "ordinal": 6
          },
          {
            "address": "0x10006230",
            "name": "WdsClientSessionCreate",
            "ordinal": 7
          },
          {
            "address": "0x10006270",
            "name": "WdsClientSessionExecute",
            "ordinal": 8
          },
          {
            "address": "0x10006250",
            "name": "WdsClientSessionShutdown",
            "ordinal": 9
          },
          {
            "address": "0x10006210",
            "name": "WdsCpPacketGetBuffer",
            "ordinal": 10
          },
          {
            "address": "0x10006090",
            "name": "WdsCpPacketInitialize",
            "ordinal": 11
          },
          {
            "address": "0x100061f0",
            "name": "WdsCpPacketRelease",
            "ordinal": 12
          },
          {
            "address": "0x100060d0",
            "name": "WdsCpParameterAdd",
            "ordinal": 13
          },
          {
            "address": "0x10006190",
            "name": "WdsCpParameterDelete",
            "ordinal": 14
          },
          {
            "address": "0x10006110",
            "name": "WdsCpParameterQuery",
            "ordinal": 15
          },
          {
            "address": "0x100060f0",
            "name": "WdsCpParameterValidate",
            "ordinal": 16
          },
          {
            "address": "0x100060b0",
            "name": "WdsCpRecvPacketInitialize",
            "ordinal": 17
          }
        ],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x00008ef0",
            "size": "0x00000253"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x0000b1e4",
            "size": "0x000000b4"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x0000c000",
            "size": "0x00000430"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x0000a400",
            "size": "0x00002148"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x0000d000",
            "size": "0x00000750"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x00002150",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x00001144",
            "size": "0x00000018"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x00001098",
            "size": "0x00000040"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x0000b000",
            "size": "0x000001e0"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x00008143",
            "size_of_data": "0x00008200",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.34"
          },
          {
            "name": ".data",
            "raw_address": "0x00008600",
            "virtual_address": "0x0000a000",
            "virtual_size": "0x000004cc",
            "size_of_data": "0x00000200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "1.19"
          },
          {
            "name": ".idata",
            "raw_address": "0x00008800",
            "virtual_address": "0x0000b000",
            "virtual_size": "0x00000c9a",
            "size_of_data": "0x00000e00",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "4.98"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x00009600",
            "virtual_address": "0x0000c000",
            "virtual_size": "0x00000430",
            "size_of_data": "0x00000600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "2.55"
          },
          {
            "name": ".reloc",
            "raw_address": "0x00009c00",
            "virtual_address": "0x0000d000",
            "virtual_size": "0x00000750",
            "size_of_data": "0x00000800",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "6.44"
          }
        ],
        "overlay": {
          "offset": "0x0000a400",
          "size": "0x00002148"
        },
        "resources": [
          {
            "name": "RT_VERSION",
            "offset": "0x0000c060",
            "size": "0x000003cc",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.50"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows Deployment Services Client-side Library"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.572 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "wdscsl.dll"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "wdscsl.dll"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.572"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "4813220b7756d33b9923837a586c65ed",
        "timestamp": "2100-11-25 16:03:48",
        "icon": null,
        "icon_hash": null,
        "icon_fuzzy": null,
        "icon_dhash": null,
        "imported_dll_count": 8
      },
      "data": null,
      "strings": [
        "Microsoft",
        ".CRT$XLA",
        ".text$yd",
        "UnhandledExceptionFilter",
        "__dllonexit",
        "565@5M5_5",
        "Microsoft Time-Stamp Service",
        ".CRT$XIAA",
        "m_uLockCount == 0",
        "Param[%d][Pointer]: %I64u",
        "127.0.0.1",
        "<- WdsClientRegisterTrace=%x",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\strutil.cpp",
        "advapi32",
        "RpcBindingFree",
        "Microsoft Corporation",
        "WS2_32.dll",
        "f;D$$u",
        ":*:::W:n:~:",
        "malloc",
        "m_ActiveWriter.m_uNestedReaders > 0",
        ".giats",
        "ReleaseSemaphore",
        "?%?E?O?d?",
        "010V0q0~0",
        "??0exception@@QAE@ABV0@@Z",
        "j(X9E",
        "229879+4583620",
        "_InterlockedExchangeAdd((LONG volatile*)&(m_lPendingWriteOperations), 0) == 0",
        " Microsoft Operations Puerto Rico1&0$",
        "X9qHu&9YLr!;yLr",
        "Param[%d][Unicode]: %s",
        "=$>3>W>",
        ")Microsoft Root Certificate Authority 20100",
        "InterlockedPushEntrySList",
        "GetNameInfoW",
        "GetProcAddress",
        "AcquireSRWLockExclusive",
        "100701213655Z",
        "InitializeCriticalSection",
        "VWShD",
        "WaitForSingleObject",
        ";F,s)",
        ">\">(>0>M>",
        "WdsClientExecute",
        "Microsoft Corporation1&0$",
        "9w,v$",
        "OutputDebugStringA",
        "jW[_^",
        "bad allocation",
        "Richo",
        ":.:m:w:",
        "ReleaseSRWLockExclusive",
        "TerminateProcess",
        "9^,te",
        "InterlockedPopEntrySList",
        ".idata$5",
        ".CRT$XCU",
        ">#>D>O>U>]>j>u>",
        "L$,QP",
        "SetEnvironmentVariableW",
        ";Y<g<o<w<",
        "??1exception@@UAE@XZ",
        "R!s4Z",
        "060Y0y0",
        "I_RpcExceptionFilter",
        "SVWh~",
        "_purecall",
        "ncacn_ip_tcp",
        "040904B0",
        "Microsoft Time-Stamp Service0",
        "%s[%s:%u] %s",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z",
        "InitializeSListHead",
        "D$ Pj",
        "m_uActiveReaders == 0 && m_ActiveWriter.m_uThreadId == 0 && m_uWaitingReaders == 0 && m_uWaitingWriters == 0",
        "WdsCpParameterAdd",
        ".?AVexception@@",
        "200304183039Z",
        "Thales TSS ESN:0A56-E329-4D4D1%0#",
        "\"Microsoft Window",
        ".idata",
        ".data$r$brc",
        "Param[%d][Ansi]: %S",
        ".data",
        "Redmond1",
        "10.0.19041.572 (WinBuild.160101.0800)",
        "RpcBindingFromStringBindingW",
        "<$<)</<><E<m<u<",
        "Windows Deployment Services Client-side Library",
        "NdrAsyncClientCall",
        "=Z>v>",
        " Windows",
        "QSVW3",
        ";*;:;@;K;Q;];m;v;",
        "m_ActiveWriter.m_uNestedReaders == 0 && m_ActiveWriter.m_uNestedWriters == 0",
        "261019185142Z0",
        "191219011459Z",
        "2*2g2",
        "m_uInitCount == 0",
        "RpcBindingSetAuthInfoW",
        "D$$VP",
        "jWX^_[",
        "FreeAddrInfoW",
        "ADVAPI32.dll",
        "EnterCriticalSection",
        "EventUnregister",
        "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a",
        "WdsCpParameterValidate",
        "base\\eco\\wds\\wdscsl\\client\\controllib.cpp",
        "LsaFreeMemory",
        ".xdata$x",
        "GeneratingComponent=%u",
        "m_pReaderSlots[uIndex].m_uNestedReaders == 0",
        "WdsPacketFree",
        ";~4sg",
        "Microsoft Corporation1",
        ";G<X<^<",
        "Parameters Count=%u",
        "=(=/=:=C=V=t=",
        "20201008050501Z",
        "AhN~%",
        "1D1H1L1P1`1d1h1t1",
        "1/0-0",
        "StringFileInfo",
        "CChildCount::WaitForChildren failed; %u",
        "KERNEL32.dll",
        "Sleep",
        "N0L0J",
        "r~akow",
        "[%S:%u] Expression: %S, Win32 Error=0x%x",
        "WSARecvFrom",
        "GetCurrentProcessId",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\trace.cpp",
        "0 0$080h0l0p0t0x0|0",
        "SetEvent",
        ".?AVbad_alloc@std@@",
        "GetAddrInfoW",
        "303g3",
        "_onexit",
        "Flags=0x%x",
        ".idata$4",
        "Param[%d][Long]: %d",
        "7*737",
        "!m_uInitDone",
        "G0U0[0",
        "WaitForSingleObjectEx",
        "3$4L4m4",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\netaddr.cpp",
        "WSASendTo",
        ".text$mn",
        "G PVQ",
        "RpcStringFreeW",
        "GetAdaptersAddresses",
        "%Microsoft Windows Production PCA 2011",
        ".CRT$XIA",
        "Proces ID=%u",
        ".text$x",
        "LegalCopyright",
        "6#6Z6:7W7u7",
        "Computer Name=%s",
        "tqWh4",
        "111019184142Z",
        "m_ActiveWriter.m_uNestedReaders == 0",
        "?what@exception@@UBEPBDXZ",
        "Y__^[",
        ".idata$3",
        "6<6b6g6",
        "%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X",
        ".rdata",
        "WdsIsServerMode",
        "IPHLPAPI.DLL",
        "WdsClientRegisterTrace",
        "ReleaseSemaphore(m_hReaderSlots, 1, 0)",
        "RPCRT4.dll",
        "$`2X`F",
        "M0K0I",
        "20201008071942.257Z0",
        "CClientLibrary::InitializeRpcSession: Binding String=%s",
        ".text$di",
        ">!>:>C>W>f>o>",
        "VarFileInfo",
        "GetCurrentProcess",
        "WdsCpParameterQuery",
        "??1type_info@@UAE@XZ",
        "CreateIoCompletionPort",
        "0\"171<1A1h1x1}1",
        "|hK,_",
        "RETAIL ASSERT",
        "WdsClientSessionShutdown",
        "DeleteCriticalSection",
        "OriginalFilename",
        "HZo6m|",
        "979M9m9",
        "memmove",
        "EventRegister",
        "_CxxThrowException",
        "Microsoft Windows0",
        "WDS_TRACING_DEBUGGER_OUTPUT",
        "lL7Ki\"0",
        "WdsCpPacketGetBuffer",
        "8,8B8L8Y8`8h8v8",
        "@.reloc",
        ".edata",
        "7X8]8o8",
        "CreateSemaphoreW",
        "u*Wh\\",
        "[%S:%u] Expression: %S, hr=0x%x",
        "262V2v2",
        ";#;4;:;B;",
        " Operating System",
        "GetReaderSlot(uThreadId, &uIndex) == 0L",
        ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0",
        "_initterm",
        "WdsClientSessionCreate",
        "210317011459Z0",
        "U0S0Q",
        "DsMakeSpnW",
        "Microsoft Corporation1)0'",
        "1(1@1Y1",
        "7!8[8",
        "SetLastError",
        ".00cfg",
        "_callnewh",
        "oK0D$\"<",
        "_lock",
        "m_ActiveWriter.m_uThreadId == GetCurrentThreadId()",
        "onecore\\base\\eco\\wds\\wdslib\\common\\src\\mrswlock.cpp",
        ".rdata$brc",
        "GetQueuedCompletionStatus",
        "wdscsl.dll",
        "msvcrt.dll",
        "RpcAsyncCompleteCall",
        ">http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0",
        "z.9Wv",
        "GetCurrentThreadId",
        "RPC Extended Error Info",
        ".data$brc",
        "u9f9X",
        "A;N4r",
        "EventWriteTransfer",
        "APj!Z",
        " SVWj",
        "Microsoft Time-Stamp PCA 2010",
        "wprintf",
        "9D:}:",
        "NH9^,t",
        "WDSCSL.dll",
        "FreeLibrary",
        "`.data",
        "eWDSCSL",
        "RevertToSelf",
        "@.rsrc",
        "memcmp",
        "-----------------------",
        "Legal_Policy_Statement",
        "Invalid type: %d",
        "WaitForSingleObject(m_hWriterDone, 0xFFFFFFFF) == ((((NTSTATUS)0x00000000L) ) + 0 )",
        "Microsoft Time-Stamp PCA 20100",
        "C;_,r",
        "WSAGetOverlappedResult",
        "__CxxFrameHandler3",
        "ImpersonateLoggedOnUser",
        "Status=%u",
        "NTDSAPI.dll",
        "uIndex != 0xffffffffUL",
        "WSASocketW",
        "0>1C1S1x1-2j2y2",
        "Hbg&~",
        "Param[%d][Short]: %d",
        "1(0&0",
        "j|j?h",
        "WaitForSingleObject(m_hReaderDone, 0xFFFFFFFF) == ((((NTSTATUS)0x00000000L) ) + 0 )",
        "onecore\\internal\\base\\inc\\private\\eco\\wds\\locks.h",
        ".idata$2",
        "RpcAsyncInitializeHandle",
        "WdsCpParameterDelete",
        " 9^Dt\"S",
        "t'9s u",
        ".CRT$XCA",
        "SetUnhandledExceptionFilter",
        "WdsPacketAllocate",
        "210303183039Z0p1",
        "COM Error: '%s'",
        "LeaveCriticalSection",
        "TlP0X",
        "8+8?8K8",
        "GetEnvironmentVariableW",
        "> >(>,>4>8>@>D>L>P>`>",
        "WdsCpPacketRelease",
        ",tmiMHeBeBe9k8m0Ots191T0AhkQNR94NUfr7OOdjuoc=0Z",
        "WDS_TRACING_%u",
        "WdsClientInitializeLibrary",
        ".rdata$T$brc",
        ",*~_i",
        "3%4x5",
        "_91$[bS",
        "EventWrite",
        "LsaQueryInformationPolicy",
        "ProductVersion",
        ".rdata$sxdata",
        "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z",
        "GetSystemTimeAsFileTime",
        "memset",
        "9 9&91979B9I9N9T9Z9_9e9k9p9v9|9",
        "GetTickCount",
        ".CRT$XIZ",
        "04080<0@0X0",
        ";L$8u*Q",
        "CompanyName",
        "8V9t9",
        "RpcAsyncCancelCall",
        "X9^`u",
        ":H;*<8<[<i<o<",
        ";-;z;",
        "RpcStringBindingComposeW",
        "InternalName",
        "?#?J?V?d?~?",
        "PPh@v",
        "Microsoft Corporation1.0,",
        "20201009050501Z0w0=",
        "VS_VERSION_INFO",
        "ProductName",
        "RpcErrorGetNextRecord",
        "? ?(?5?;?G?\\?b?s?",
        "250701214655Z0|1",
        "?.?S?",
        "OutputDebugStringW",
        ":>:F:[:n:t:~:",
        ":E:R:[:f:m:",
        "CClientLibrary::InitializeRpcSession: Domain Joined=%s",
        "OLEAUT32.dll",
        "SVWh ",
        "?!?5?H?",
        "O0M0K",
        "_except_handler4_common",
        "PostQueuedCompletionStatus",
        "WdsCpPacketInitialize",
        "WdsCpRecvPacketInitialize",
        "LsaOpenPolicy",
        "7*7=7P7s7}7",
        "ReleaseSemaphore(m_hReaderDone, 1, 0)",
        ".text",
        "Translation",
        ";5;B;",
        ".tls$",
        "9FTt~",
        "m_pReaderSlots[uIndex].m_uThreadId == uThreadId",
        "memcpy",
        "GetModuleHandleW",
        ".CRT$XLZ",
        "%Microsoft Windows Production PCA 20110",
        "GetSystemInfo",
        "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@",
        "Param[%d][Truncated]",
        "10.0.19041.572",
        "9^(u$",
        "<%=,=2=:=D=M=S=",
        "_$j(Yf",
        "I0G1-0+",
        " http://www.microsoft.com/windows0",
        "t 9y u",
        "s15pL",
        "t6VVSh",
        " Microsoft Corporation. All rights reserved.",
        "=!=1=7=A=G=|=",
        "G`jqY",
        "WaitForSingleObject(m_hReaderSlots, 0xFFFFFFFF) == ((((NTSTATUS)0x00000000L) ) + 0 )",
        "+a,Y?",
        "Detection Location=%u",
        "_vsnwprintf",
        "!This program cannot be run in DOS mode.",
        "4'414;4^4",
        ";)<D<g<t<",
        "21292@2F2L2z2",
        "Washington1",
        "WakeAllConditionVariable",
        ".rsrc$01",
        "ReleaseSemaphore(m_hWriterDone, m_uWaitingReaders, 0)",
        "GetVersionExW",
        "_vsnprintf",
        "RpcErrorStartEnumeration",
        "010B0P0r0",
        "_unlock",
        "Microsoft Corporation1200",
        "onecore\\internal\\base\\inc\\private\\eco\\wds\\ChildCount.h",
        "3&3.3y3",
        "WdsClientFreeLibrary",
        ".gfids",
        "WdsClientPacketAllocate",
        "LogonUserW",
        "m_uActiveReaders == 0",
        ".rsrc$02",
        "2%2@2V2d2j2",
        ": ;4;:;M;",
        "GetLastError",
        "CloseHandle",
        "QueryPerformanceCounter",
        "GetModuleHandleExW",
        "=E=L=_=t=",
        ".tls$ZZZ",
        "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0",
        "VPVVVWh",
        "SleepConditionVariableSRW",
        "$Microsoft Ireland Operations Limited1",
        "wdssrv.dll",
        "base\\Eco\\WDS\\wdslib\\net\\UdpSocket.h",
        "LsaClose",
        "WdsClientPacketFree",
        "wdscsl.pdb",
        ".CRT$XCZ",
        "WaitForMultipleObjects",
        "m_uInitDone",
        "FileDescription",
        "FileVersion",
        "_XcptFilter",
        ".rdata$zzzdbg",
        "PVVVWh",
        "CreateEventW",
        "_amsg_exit",
        "WdsClientSessionExecute",
        "base\\eco\\wds\\wdscsl\\client\\clientlib.cpp",
        "-> WdsClientRegisterTrace",
        "?$?-?>?H?m?w?",
        ".idata$6",
        "WDS_TRACING_CONSOLE_OUTPUT",
        "??0exception@@QAE@XZ",
        "6#6?6M6S6o6w6",
        "CancelIo",
        "CreateThread"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "selfextract": {
        "overlay": {
          "extracted_files": [
            {
              "name": "1650937124204bd3744dd84daefce5baae33a1b4c33b4e011ee1c191bcd8e0bc",
              "path": "/opt/CAPEv2/storage/analyses/4/selfextracted/1650937124204bd3744dd84daefce5baae33a1b4c33b4e011ee1c191bcd8e0bc",
              "guest_paths": [
                "overlay"
              ],
              "size": 8520,
              "crc32": "9EFA4358",
              "md5": "85eb704f3ef476e9d180af5a8dd5e1ba",
              "sha1": "3e156a98e4d47553e9a1736bbe5038f9949e1bc3",
              "sha256": "1650937124204bd3744dd84daefce5baae33a1b4c33b4e011ee1c191bcd8e0bc",
              "sha512": "817cd49c53a19d0355f4bf3ac1b00c7f6a12e969d837505a3f39e732eb0acce7d349601fb35287b7077da08dddc0572540bd2c0977ff9c509020ed1edc62f5c9",
              "rh_hash": null,
              "ssdeep": "96:btMDXvDbzC0cr8OAlpVHKzDmowDD0pBDXiebs/Am2grWXGueDXKgDjhhBDqh0hDs:pr8VHwDDBQABJsDj3Q2SkqnajKs9ImG",
              "type": "data",
              "yara": [],
              "cape_yara": [],
              "clamav": [],
              "tlsh": "T1BC024AD1CF785443DBA77C801358E9937D3D53CB186081A5259AF8A82CD73C7EB086AE",
              "sha3_384": "fd1c55b5f9ebf8105a4fc0c5fb90f80e72be36bfe6c903557678a8a80d7fd5ae1c9561d75468a5a9f0210c9778ce7015",
              "data": null
            }
          ],
          "extracted_files_time": 0.0005162939996807836,
          "password": ""
        }
      },
      "cape_type_code": 0,
      "cape_type": "",
      "pid": 5448
    }
  ],
  "CAPE": {
    "payloads": [],
    "configs": []
  },
  "info": {
    "version": "2.5",
    "started": "2026-05-28 15:59:16",
    "ended": "2026-05-28 16:03:01",
    "duration": 225,
    "id": 4,
    "category": "file",
    "custom": "",
    "machine": {
      "id": 2,
      "status": "stopping",
      "name": "cuckoo1",
      "label": "cuckoo1",
      "platform": "windows",
      "manager": "KVM",
      "started_on": "2026-05-28 15:59:16",
      "shutdown_on": "2026-05-28 16:03:00"
    },
    "package": "exe",
    "timeout": true,
    "tlp": null,
    "parent_sample": null,
    "options": {
      "interactive": "1",
      "nohuman": "yes"
    },
    "source_url": null,
    "route": "none",
    "user_id": 0,
    "CAPE_current_commit": "e261551257b77d1ae36b689efcf9b3d0af4476c2"
  },
  "behavior": {
    "processes": [
      {
        "process_id": 3932,
        "process_name": "explorer.exe",
        "parent_id": 3868,
        "module_path": "C:\\Windows\\explorer.exe",
        "first_seen": "2026-05-28 22:59:20,551",
        "calls": [
          {
            "timestamp": "2026-05-28 22:59:20,645",
            "thread_id": "5848",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d07b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:59:25,004",
            "thread_id": "4084",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.UI.Xaml"
              },
              {
                "name": "DllBase",
                "value": "0x7ffce7310000"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:59:25,020",
            "thread_id": "4084",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Windows.UI.Xaml.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce7310000"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:59:25,020",
            "thread_id": "4084",
            "caller": "0x7ffce514f84d",
            "parentcaller": "0x7ffcfb3f38c0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "56F68E55-D114-4C64-996E-6E5F2D5340B2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00BB2761-6A77-11D0-A535-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:59:25,020",
            "thread_id": "4084",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\WindowsInternal.ComposableShell.DesktopHosting"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcef2d0000"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:59:25,020",
            "thread_id": "4084",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WindowsInternal.ComposableShell.DesktopHosting.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcef2d0000"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:59:25,036",
            "thread_id": "4084",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\ShellComponents\\WindowsInternal.ComposableShell.Experiences.Switcher"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd8740000"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:59:25,036",
            "thread_id": "4084",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\ShellComponents\\WindowsInternal.ComposableShell.Experiences.Switcher.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd8740000"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:59:25,036",
            "thread_id": "4084",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\ShellExperiences\\TileControl"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcef250000"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:59:25,036",
            "thread_id": "4084",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\ShellExperiences\\TileControl.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcef250000"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:59:25,036",
            "thread_id": "4084",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\ShellComponents\\TaskFlowUI"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd8520000"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:59:25,036",
            "thread_id": "4084",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\ShellComponents\\TaskFlowUI.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd8520000"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:59:25,036",
            "thread_id": "4084",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcf9ee6d18",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00001fb4",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcf9eebe80"
              },
              {
                "name": "Parameter",
                "value": "0x024beed0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "3872"
              },
              {
                "name": "ProcessId",
                "value": "3932"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:59:25,036",
            "thread_id": "3872",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcf8ab1897",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00001fb0",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcf8ab1b70"
              },
              {
                "name": "Parameter",
                "value": "0x0cc6a6c0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "3920"
              },
              {
                "name": "ProcessId",
                "value": "3932"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:59:25,036",
            "thread_id": "3920",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf5e4a36b",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001f84"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:59:25,036",
            "thread_id": "3920",
            "caller": "0x7ffcfb3bed8a",
            "parentcaller": "0x7ffcfb3ddb07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x093f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:59:25,036",
            "thread_id": "3920",
            "caller": "0x7ffcfb3bed8a",
            "parentcaller": "0x7ffcfb3ddb07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0943e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:59:25,036",
            "thread_id": "3920",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf5e69362",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001e98"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:59:25,036",
            "thread_id": "3920",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf8fce6a1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "user32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfb0b0000"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:59:25,036",
            "thread_id": "3920",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffce7664521",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00001e38",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffce74a8520"
              },
              {
                "name": "Parameter",
                "value": "0x08630f40"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "3940"
              },
              {
                "name": "ProcessId",
                "value": "3932"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:59:25,036",
            "thread_id": "3920",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffce761f628",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00001e4c",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffce7649630"
              },
              {
                "name": "Parameter",
                "value": "0x08996b90"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "3924"
              },
              {
                "name": "ProcessId",
                "value": "3932"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3940",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffce74a90e9",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "dxgi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf7350000"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3940",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf8fce6a1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "gdi32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa010000"
              }
            ],
            "repeated": 2,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\iertutil.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcee940000"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffce75801ed",
            "parentcaller": "0x7ffce757fe43",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DBCE7E40-7345-439D-B12C-114A11819A09"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "130A2F65-2BE7-4309-9A58-A9052FF2B61C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf5e40000"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffce765924a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "windows.ui.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce83d0000"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffce83f4bf9",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001fe0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\UiaManager"
              },
              {
                "name": "DllBase",
                "value": "0x7ffce9640000"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3940",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf7361bd0",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "d3d10warp.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf2090000"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UiaManager.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce9640000"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3940",
            "caller": "0x7ffcfb3bed8a",
            "parentcaller": "0x7ffcfb3ddb07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0ca3d000"
              },
              {
                "name": "RegionSize",
                "value": "0x0002f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffce83e1d49",
            "parentcaller": "0x7ffce83f12ef",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "77CBBBB7-6CD0-48ED-A02B-52FBB0E43ECD"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "94552329-F99E-4F8A-B128-6CC2AE7FE28C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3940",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001ee4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\d3d10warp.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3940",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffce7615932",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "d2d1.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf5020000"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffce9643c85",
            "parentcaller": "0x7ffce83e1d69",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4B7A83D5-CF71-40AD-AB0F-BF6830E95330"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "83140D1C-7E82-4CFB-96E4-F997CEDE7E10"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3940",
            "caller": "0x7ffcfb3bed8a",
            "parentcaller": "0x7ffcfb3ddb07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09419000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffcf9edf55f",
            "parentcaller": "0x7ffcf9ec705e",
            "category": "system",
            "api": "SetWindowsHookExW",
            "status": true,
            "return": "0x00070251",
            "arguments": [
              {
                "name": "HookIdentifier",
                "value": "4",
                "pretty_value": "WH_CALLWNDPROC"
              },
              {
                "name": "ProcedureAddress",
                "value": "0x7ffcf9edfa40"
              },
              {
                "name": "ModuleAddress",
                "value": "0x7ffcf9ec0000"
              },
              {
                "name": "ThreadId",
                "value": "3920"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffce765919c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "windows.ui.core.textinput.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce2bc0000"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3940",
            "caller": "0x7ffcfb3bed8a",
            "parentcaller": "0x7ffcfb3ddb07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0945a000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3940",
            "caller": "0x7ffcfb3bed8a",
            "parentcaller": "0x7ffcfb3ddb07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0946a000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001eb4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3940",
            "caller": "0x7ffcfb3bed8a",
            "parentcaller": "0x7ffcfb3ddb07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0ca80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00030000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3940",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffce74a95c7",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "dwrite.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce6d70000"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3940",
            "caller": "0x7ffcfb3bed8a",
            "parentcaller": "0x7ffcfb3ddb07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09444000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcfb0d2b57",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\SHCore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf9ec0000"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3940",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001f30"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Fonts\\segoeui.ttf"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3940",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001f38"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fcf0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0fc6dd00"
              },
              {
                "name": "ViewSize",
                "value": "0x000ea000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001ff8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07de0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0edae630"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001ff8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07de0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0edaf7e0"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001f20"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07de0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0edaf8a0"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3920",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001f20"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07de0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0edaf8a0"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:59:25,051",
            "thread_id": "3656",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001f6c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07de0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x079df280"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3940",
            "caller": "0x7ffcf8ff4448",
            "parentcaller": "0x7ffcf23d9ad1",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07de0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3940",
            "caller": "0x7ffcf8ff4448",
            "parentcaller": "0x7ffcf23d9ad1",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df40d270000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3940",
            "caller": "0x7ffcf8ff4448",
            "parentcaller": "0x7ffcf23d9db5",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df40d270000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3940",
            "caller": "0x7ffcf8ff4448",
            "parentcaller": "0x7ffcf23d9f77",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df40d270000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "4936",
            "caller": "0x7ffce38be842",
            "parentcaller": "0x7ffcfb4216e9",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000203c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3656",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3940",
            "caller": "0x7ffcf8ff4448",
            "parentcaller": "0x7ffcf23d9f77",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df40d271000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x40000020",
                "pretty_value": "PAGE_EXECUTE_READ|0x40000000"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3920",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3920",
            "caller": "0x7ffcf3bf8bd4",
            "parentcaller": "0x7ffcf3bf8b3e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "228826AF-02E1-4226-A9E0-99A855E455A6"
              },
              {
                "name": "ClsContext",
                "value": "0x00000404",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "9767060C-9476-42E2-8F7B-2F10FD13765C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3656",
            "caller": "0x7ffce3fde605",
            "parentcaller": "0x7ffcf956b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "7ED25D63-48E5-4BE3-8539-3040B0B8991C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "D4351E8C-208E-4C24-88AC-6E2ADD5F4BB1"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3656",
            "caller": "0x7ffce38bd59f",
            "parentcaller": "0x7ffce38fc80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002020"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3920",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf735c5cc",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "gdi32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa010000"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3920",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002024"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Windows.UI.Xaml.Resources.19H1.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3920",
            "caller": "0x7ffcf8fd7786",
            "parentcaller": "0x7ffcf8fd5630",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x40000003",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002020"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fde0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000af000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3920",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d0be000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000a000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3920",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d0c8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3920",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d0d1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3920",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d0d7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3920",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d0dd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:59:25,067",
            "thread_id": "3920",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffce75f0f36",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "dwrite.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce6d70000"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:59:30,067",
            "thread_id": "4252",
            "caller": "0x7ffce38be842",
            "parentcaller": "0x7ffcfb4216e9",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000017d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "3656",
            "caller": "0x7ffce38bd59f",
            "parentcaller": "0x7ffce38fc80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000017d4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "4252",
            "caller": "0x7ff6333e99ca",
            "parentcaller": "0x7ff6333ea869",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "4252",
            "caller": "0x7ff6333ebdd2",
            "parentcaller": "0x7ff6333ea52a",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000017c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "4252",
            "caller": "0x7ff6333ebdd2",
            "parentcaller": "0x7ff6333ea52a",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000017c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "3656",
            "caller": "0x7ffce52ce757",
            "parentcaller": "0x7ffce4f7686e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "4252",
            "caller": "0x7ff6333ebdd2",
            "parentcaller": "0x7ff6333ea52a",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000017b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "4252",
            "caller": "0x7ff6333ebdd2",
            "parentcaller": "0x7ff6333ea52a",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000017b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "4252",
            "caller": "0x7ff6333ebdd2",
            "parentcaller": "0x7ff6333ea52a",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000017b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "4252",
            "caller": "0x7ff6333ea552",
            "parentcaller": "0x7ff6333e9a4f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "4252",
            "caller": "0x7ff6333ea552",
            "parentcaller": "0x7ff6333e9a4f",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000017b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "4252",
            "caller": "0x7ff6333ea552",
            "parentcaller": "0x7ff6333e9a4f",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000017b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "4252",
            "caller": "0x7ff6333ea552",
            "parentcaller": "0x7ff6333e9a4f",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000017b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "4252",
            "caller": "0x7ff6333ea552",
            "parentcaller": "0x7ff6333e9a4f",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000017b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "4252",
            "caller": "0x7ff6333ea552",
            "parentcaller": "0x7ff6333e9a4f",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000017b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "4252",
            "caller": "0x7ff6333ea65f",
            "parentcaller": "0x7ff6333e9a4f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "4252",
            "caller": "0x7ff6333ea65f",
            "parentcaller": "0x7ff6333e9a4f",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4234D49B-0245-4DF3-B780-3893943456E1"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "000214E6-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "4252",
            "caller": "0x7ff6333ea65f",
            "parentcaller": "0x7ff6333e9a4f",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "02C5CCF3-805F-4654-A7B7-340A74335365"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "4084",
            "caller": "0x7ff6333aca89",
            "parentcaller": "0x7ff6333ac93f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000017d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "4084",
            "caller": "0x7ff6333ac67f",
            "parentcaller": "0x7ff6333ac407",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000490"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df40ce80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "3476",
            "caller": "0x7ff6333eb354",
            "parentcaller": "0x7ff6333eb12e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333e8f2b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333e8f2b",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "4084",
            "caller": "0x7ff6333aa878",
            "parentcaller": "0x7ff6333aa7ba",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df40ce80000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "3476",
            "caller": "0x7ff6334035ec",
            "parentcaller": "0x7ff6333bf841",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d0e3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:59:33,207",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:59:33,207",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:59:33,223",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:59:33,223",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:59:33,239",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:59:33,239",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:59:33,254",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:59:33,254",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:59:33,270",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:59:33,270",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:59:33,286",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:59:33,286",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:59:33,301",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:59:33,301",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:59:33,317",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:59:33,317",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:59:33,489",
            "thread_id": "4060",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:59:33,536",
            "thread_id": "3548",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001720"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:59:33,567",
            "thread_id": "3548",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000490"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e00000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:59:33,567",
            "thread_id": "3548",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e00000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:59:33,567",
            "thread_id": "3548",
            "caller": "0x7ffcfabd0571",
            "parentcaller": "0x7ffcfabd0427",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000490"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:59:33,567",
            "thread_id": "3548",
            "caller": "0x7ffcfabd02b3",
            "parentcaller": "0x7ffcfabd003b",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001720"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df40ce80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:59:33,567",
            "thread_id": "3548",
            "caller": "0x7ffcfabd1830",
            "parentcaller": "0x7ffcfabd1772",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df40ce80000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:59:33,629",
            "thread_id": "4084",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:59:33,629",
            "thread_id": "4084",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c01dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "99B29D3B-368A-4BE6-B675-805A69114497"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:59:33,661",
            "thread_id": "4084",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:59:33,661",
            "thread_id": "4084",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d0e6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:59:33,661",
            "thread_id": "4084",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d0e9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:59:33,676",
            "thread_id": "4084",
            "caller": "0x7ffcedbdf105",
            "parentcaller": "0x7ffcedbd5e39",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "A3662812-8138-4A1E-8FAF-49D06E7AED43"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "EFE84C27-AFA6-485D-A70A-AA2AB5CB6C67"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:59:33,676",
            "thread_id": "4084",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d0ee000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:59:33,676",
            "thread_id": "4084",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d0f3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:59:33,692",
            "thread_id": "4084",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d0f8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:59:33,692",
            "thread_id": "4084",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d0fd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:59:33,692",
            "thread_id": "4084",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d102000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:59:33,692",
            "thread_id": "4084",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d107000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:59:33,692",
            "thread_id": "4084",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d10c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:59:33,692",
            "thread_id": "4060",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d115000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:59:33,692",
            "thread_id": "4060",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d11a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:59:33,692",
            "thread_id": "4084",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d11f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:59:33,692",
            "thread_id": "4084",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d124000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:59:33,692",
            "thread_id": "4060",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d12d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:59:33,707",
            "thread_id": "3288",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:59:33,707",
            "thread_id": "4060",
            "caller": "0x7ffcedbdf105",
            "parentcaller": "0x7ffcedbd5e39",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6A602D88-1FC3-47CC-ABC4-D1F9BCBFC569"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "EFE84C27-AFA6-485D-A70A-AA2AB5CB6C67"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:59:33,707",
            "thread_id": "3288",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:59:33,739",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d132000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:59:33,739",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d135000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:59:33,739",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d13a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:59:33,739",
            "thread_id": "3288",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:59:33,754",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d13d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:59:33,754",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d142000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:59:33,754",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d14b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:59:33,770",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d150000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "3288",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c01dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d159000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d15e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d163000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:59:33,801",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d16c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:59:33,801",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d175000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:59:33,832",
            "thread_id": "3288",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c01dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:59:33,832",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d17e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:59:33,832",
            "thread_id": "3288",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c01dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:59:33,832",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d183000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:59:33,848",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d188000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:59:33,848",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d191000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:59:33,848",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d194000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:59:33,848",
            "thread_id": "3288",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c01dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:59:33,864",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d19d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:59:33,864",
            "thread_id": "3288",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c01dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 9,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:59:33,895",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d1a2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 22:59:33,911",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d1ab000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 22:59:33,911",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d1b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 22:59:33,911",
            "thread_id": "3288",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0d1b9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 22:59:33,926",
            "thread_id": "3288",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 179
          },
          {
            "timestamp": "2026-05-28 22:59:33,926",
            "thread_id": "3548",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\execmodelclient"
              },
              {
                "name": "DllBase",
                "value": "0x7ffceb2e0000"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-05-28 22:59:33,926",
            "thread_id": "3548",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\execmodelclient.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffceb2e0000"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-28 22:59:33,926",
            "thread_id": "3548",
            "caller": "0x7ffce38d7741",
            "parentcaller": "0x7ffce38d8661",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "38142214-ED63-4965-9214-1BBC06E130E9"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "8E1BBBB9-B3D5-430D-B276-D0E7454CAAB2"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-28 22:59:33,942",
            "thread_id": "3548",
            "caller": "0x7ffceb2e907d",
            "parentcaller": "0x7ffce38d778e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "D648FEA1-EA00-4FF4-B8BD-034BD2B25A23"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "1D868537-EEA2-4C03-BB99-8A58862F7A59"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-28 22:59:33,942",
            "thread_id": "3548",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-28 22:59:33,942",
            "thread_id": "3548",
            "caller": "0x7ffcf3bec45c",
            "parentcaller": "0x7ffceb2e90c9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6B3B8D23-FA8D-40B9-8DBD-B950333E2C52"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-05-28 22:59:33,942",
            "thread_id": "3548",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 186
          },
          {
            "timestamp": "2026-05-28 22:59:33,942",
            "thread_id": "3548",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffce38d8695",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ploptin"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcef230000"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-05-28 22:59:33,942",
            "thread_id": "3548",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffce38d8695",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00800000"
              },
              {
                "name": "FileName",
                "value": "ploptin.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcef230000"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf8fcacfe",
            "parentcaller": "0x7ffce38d86fd",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ploptin"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcef230000"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcfb420db0",
            "parentcaller": "0x7ffcfb3e0391",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcef230000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001898"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002020"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e00000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e00000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001898"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.StartMenuExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002020"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e00000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1009c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e00000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001ecc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001894"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e00000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e00000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffce38d7741",
            "parentcaller": "0x7ffce38d8661",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "38142214-ED63-4965-9214-1BBC06E130E9"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "8E1BBBB9-B3D5-430D-B276-D0E7454CAAB2"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffceb2e907d",
            "parentcaller": "0x7ffce38d778e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "D648FEA1-EA00-4FF4-B8BD-034BD2B25A23"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "1D868537-EEA2-4C03-BB99-8A58862F7A59"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf3bec45c",
            "parentcaller": "0x7ffceb2e90c9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6B3B8D23-FA8D-40B9-8DBD-B950333E2C52"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 205
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffce38d8695",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ploptin"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcef230000"
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffce38d8695",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00800000"
              },
              {
                "name": "FileName",
                "value": "ploptin.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcef230000"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf8fcacfe",
            "parentcaller": "0x7ffce38d86fd",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ploptin"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcef230000"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcfb420db0",
            "parentcaller": "0x7ffcfb3e0391",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcef230000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001ecc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001890"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e00000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-28 22:59:33,957",
            "thread_id": "3548",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e00000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-28 22:59:34,223",
            "thread_id": "3548",
            "caller": "0x7ffcfaf86aa3",
            "parentcaller": "0x7ffcfb412dc9",
            "category": "threading",
            "api": "NtQueueApcThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessId",
                "value": "3932"
              },
              {
                "name": "ThreadId",
                "value": "3256"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000a5c"
              },
              {
                "name": "ApcRoutine",
                "value": "0x7ffcfaf8ded0"
              },
              {
                "name": "Module",
                "value": "sechost.dll"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-05-28 22:59:37,864",
            "thread_id": "3548",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-28 22:59:40,926",
            "thread_id": "3548",
            "caller": "0x7ffcfb0d93d7",
            "parentcaller": "0x7ffcf88f1e7e",
            "category": "windows",
            "api": "SendNotifyMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000100a0"
              },
              {
                "name": "Message",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-28 22:59:40,926",
            "thread_id": "3548",
            "caller": "0x7ffcfb0d93d7",
            "parentcaller": "0x7ffcf88f1e7e",
            "category": "windows",
            "api": "SendNotifyMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010124"
              },
              {
                "name": "Message",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-28 22:59:40,926",
            "thread_id": "3548",
            "caller": "0x7ffcfb0d93d7",
            "parentcaller": "0x7ffcf88f1e7e",
            "category": "windows",
            "api": "SendNotifyMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010200"
              },
              {
                "name": "Message",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-28 22:59:40,926",
            "thread_id": "3548",
            "caller": "0x7ffcfb0d93d7",
            "parentcaller": "0x7ffcf88f1e7e",
            "category": "windows",
            "api": "SendNotifyMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010204"
              },
              {
                "name": "Message",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-05-28 22:59:40,926",
            "thread_id": "3548",
            "caller": "0x7ffcfb0d93d7",
            "parentcaller": "0x7ffcf88f1e7e",
            "category": "windows",
            "api": "SendNotifyMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0001010c"
              },
              {
                "name": "Message",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-28 22:59:40,942",
            "thread_id": "4924",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-28 22:59:40,942",
            "thread_id": "4924",
            "caller": "0x7ffce8a3aaab",
            "parentcaller": "0x7ffce8a33f31",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "A47979D2-C419-11D9-A5B4-001185AD2B89"
              },
              {
                "name": "ClsContext",
                "value": "0x00000017",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "riid",
                "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-05-28 22:59:42,270",
            "thread_id": "3476",
            "caller": "0x7ff6333eb354",
            "parentcaller": "0x7ff6333eb12e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "3656",
            "caller": "0x7ffce38bd59f",
            "parentcaller": "0x7ffce38fc80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001888"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "4252",
            "caller": "0x7ff6333e99ca",
            "parentcaller": "0x7ff6333ea869",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "4084",
            "caller": "0x7ff6333aca89",
            "parentcaller": "0x7ff6333ac93f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000454"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "4084",
            "caller": "0x7ff6333ac67f",
            "parentcaller": "0x7ff6333ac407",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df40ce80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "4252",
            "caller": "0x7ff6333ebdd2",
            "parentcaller": "0x7ff6333ea52a",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001ecc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "4252",
            "caller": "0x7ff6333ebdd2",
            "parentcaller": "0x7ff6333ea52a",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001ecc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "4252",
            "caller": "0x7ff6333ea552",
            "parentcaller": "0x7ff6333e9a4f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "4252",
            "caller": "0x7ff6333ea552",
            "parentcaller": "0x7ff6333e9a4f",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001ecc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "4252",
            "caller": "0x7ff6333ea552",
            "parentcaller": "0x7ff6333e9a4f",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001ecc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "4084",
            "caller": "0x7ff6333aa878",
            "parentcaller": "0x7ff6333aa7ba",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df40ce80000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333e8f2b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333e8f2b",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "3656",
            "caller": "0x7ffce52ce757",
            "parentcaller": "0x7ffce4f7686e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "3656",
            "caller": "0x7ffcf8fcfcb5",
            "parentcaller": "0x7ffcf9015984",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000454"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "3656",
            "caller": "0x7ffcf8fcfcb5",
            "parentcaller": "0x7ffcf9015984",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000454"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "3656",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcf9ed5341",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000450",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcf9ed53d0"
              },
              {
                "name": "Parameter",
                "value": "0x04222c70"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000004"
              },
              {
                "name": "ThreadId",
                "value": "7536"
              },
              {
                "name": "ProcessId",
                "value": "3932"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-05-28 22:59:42,286",
            "thread_id": "3656",
            "caller": "0x7ffcf901f430",
            "parentcaller": "0x7ffcf9ed5379",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000450"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "7536"
              },
              {
                "name": "ProcessId",
                "value": "3932"
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-05-28 22:59:42,551",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-05-28 22:59:42,551",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-05-28 22:59:42,567",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-05-28 22:59:42,567",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-05-28 22:59:42,582",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-05-28 22:59:42,582",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-05-28 22:59:42,598",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-05-28 22:59:42,598",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-05-28 22:59:42,614",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-05-28 22:59:42,614",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-05-28 22:59:42,629",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-05-28 22:59:42,629",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-05-28 22:59:42,645",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-05-28 22:59:42,645",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-05-28 22:59:42,661",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-05-28 22:59:42,661",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-05-28 22:59:42,676",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-05-28 22:59:42,676",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-05-28 22:59:42,692",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-05-28 22:59:42,692",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-05-28 22:59:42,707",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-05-28 22:59:42,707",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-05-28 22:59:42,723",
            "thread_id": "3476",
            "caller": "0x7ff6333ea06e",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-05-28 22:59:42,723",
            "thread_id": "3476",
            "caller": "0x7ff6333ea0c1",
            "parentcaller": "0x7ff6333d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa1b0000"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-05-28 22:59:47,301",
            "thread_id": "3548",
            "caller": "0x7ffce38be842",
            "parentcaller": "0x7ffcfb4216e9",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000bcc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-05-28 22:59:51,192",
            "thread_id": "3548",
            "caller": "0x7ffcfb0d93d7",
            "parentcaller": "0x7ffcf88f1e7e",
            "category": "windows",
            "api": "SendNotifyMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010124"
              },
              {
                "name": "Message",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-05-28 22:59:54,848",
            "thread_id": "3676",
            "caller": "0x7ffcf9b7f303",
            "parentcaller": "0x7ffcf9b7e7f3",
            "category": "com",
            "api": "CoCreateInstanceEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "ServerName",
                "value": ""
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 266
          },
          {
            "timestamp": "2026-05-28 22:59:56,176",
            "thread_id": "3612",
            "caller": "0x7ffcfb0d93d7",
            "parentcaller": "0x7ffcf88f1e7e",
            "category": "windows",
            "api": "SendNotifyMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000100a0"
              },
              {
                "name": "Message",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-05-28 22:59:56,176",
            "thread_id": "3612",
            "caller": "0x7ffcfb0d93d7",
            "parentcaller": "0x7ffcf88f1e7e",
            "category": "windows",
            "api": "SendNotifyMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010124"
              },
              {
                "name": "Message",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-05-28 22:59:56,176",
            "thread_id": "3612",
            "caller": "0x7ffcfb0d93d7",
            "parentcaller": "0x7ffcf88f1e7e",
            "category": "windows",
            "api": "SendNotifyMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010200"
              },
              {
                "name": "Message",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-05-28 22:59:56,176",
            "thread_id": "3612",
            "caller": "0x7ffcfb0d93d7",
            "parentcaller": "0x7ffcf88f1e7e",
            "category": "windows",
            "api": "SendNotifyMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010204"
              },
              {
                "name": "Message",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-05-28 22:59:56,176",
            "thread_id": "3612",
            "caller": "0x7ffcfb0d93d7",
            "parentcaller": "0x7ffcf88f1e7e",
            "category": "windows",
            "api": "SendNotifyMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0001010c"
              },
              {
                "name": "Message",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-05-28 22:59:56,176",
            "thread_id": "4084",
            "caller": "0x7ffce51407e9",
            "parentcaller": "0x7ffcf9efd492",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "07FC2B94-5285-417E-8AC3-C2CE5240B0FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "C7E40572-C36A-43EA-9A40-F3B168DA5558"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-05-28 22:59:56,176",
            "thread_id": "4084",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf3bc9dab",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001908"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001948"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-05-28 22:59:56,207",
            "thread_id": "3564",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-05-28 22:59:56,207",
            "thread_id": "3656",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-05-28 22:59:56,207",
            "thread_id": "3656",
            "caller": "0x7ffce4e96afa",
            "parentcaller": "0x7ffce502f27e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000404",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-05-28 23:00:55,786",
            "thread_id": "4932",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\wscinterop"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcef1c0000"
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-05-28 23:00:55,801",
            "thread_id": "4932",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wscinterop.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcef1c0000"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-05-28 23:00:55,801",
            "thread_id": "4932",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\WSCAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcdc000000"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-05-28 23:00:55,832",
            "thread_id": "4932",
            "caller": "0x7ffcdd4566f1",
            "parentcaller": "0x7ffcdd4524f4",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9DAC2C1E-7C5C-40EB-833B-323E85A1CE84"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "418EE892-56F0-4C3B-9238-696BA0CEF799"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-05-28 23:00:55,832",
            "thread_id": "4932",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wscui.cpl"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-05-28 23:00:55,832",
            "thread_id": "4932",
            "caller": "0x7ffcf8fd7906",
            "parentcaller": "0x7ffcf8fd5630",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000df8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x02350000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00015000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-05-28 23:00:55,832",
            "thread_id": "4932",
            "caller": "0x7ffcfb3fbb2a",
            "parentcaller": "0x7ffcfb3fb99e",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000df8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\wscui.cpl.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-05-28 23:00:55,832",
            "thread_id": "4932",
            "caller": "0x7ffcfb3fbbcc",
            "parentcaller": "0x7ffcfb3fb99e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000fe0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x02370000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0c79d380"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-05-28 23:00:55,832",
            "thread_id": "4932",
            "caller": "0x7ffcfb40fc9c",
            "parentcaller": "0x7ffcfb40f7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wscui.cpl"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-05-28 23:00:55,832",
            "thread_id": "4932",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000008cc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce8ee0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00019000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-05-28 23:00:55,832",
            "thread_id": "4932",
            "caller": "0x7ffcfabd4db6",
            "parentcaller": "0x7ffcfabd3b55",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000008d0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wscui.cpl"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-05-28 23:00:55,832",
            "thread_id": "4932",
            "caller": "0x7ffcfabd4db6",
            "parentcaller": "0x7ffcfabd3b55",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\wscui.cpl"
              },
              {
                "name": "DllBase",
                "value": "0x7ffce8ee0000"
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-05-28 23:00:55,848",
            "thread_id": "4256",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000008d0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-05-28 23:00:55,879",
            "thread_id": "4932",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\framedynos"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcdd5c0000"
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-05-28 23:00:55,911",
            "thread_id": "4932",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\wer"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf6790000"
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-05-28 23:00:55,942",
            "thread_id": "4932",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\werconcpl"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd8180000"
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-05-28 23:00:55,989",
            "thread_id": "4932",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\werconcpl.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd8180000"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-05-28 23:00:55,989",
            "thread_id": "4932",
            "caller": "0x7ffcdd4566f1",
            "parentcaller": "0x7ffcdd4524f4",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CA236752-2E77-4386-B63B-0E34774A413D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "418EE892-56F0-4C3B-9238-696BA0CEF799"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-05-28 23:00:55,989",
            "thread_id": "4932",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\hcproviders"
              },
              {
                "name": "DllBase",
                "value": "0x7ffce8ec0000"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-05-28 23:00:56,051",
            "thread_id": "4932",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\hcproviders.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce8ec0000"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-05-28 23:00:56,051",
            "thread_id": "4932",
            "caller": "0x7ffcdd4566f1",
            "parentcaller": "0x7ffcdd4524f4",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C8E6F269-B90A-4053-A3BE-499AFCEC98C4"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "418EE892-56F0-4C3B-9238-696BA0CEF799"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-05-28 23:00:56,051",
            "thread_id": "4932",
            "caller": "0x7ffcfb3fbb2a",
            "parentcaller": "0x7ffcfb3fb99e",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000b64"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\Actioncenter.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-05-28 23:00:56,051",
            "thread_id": "4932",
            "caller": "0x7ffcfb3fbbcc",
            "parentcaller": "0x7ffcfb3fb99e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000408"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x02440000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0c79c550"
              },
              {
                "name": "ViewSize",
                "value": "0x0000b000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-05-28 23:00:56,067",
            "thread_id": "4924",
            "caller": "0x7ffcdfcb2263",
            "parentcaller": "0x7ffcdfcb300b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "900C0763-5CAD-4A34-BC1F-40CD513679D5"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "8E282AAE-ACE9-4821-83AD-849C1D08939D"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-05-28 23:00:56,129",
            "thread_id": "4924",
            "caller": "0x7ffce8ec1625",
            "parentcaller": "0x7ffcdfcb22b1",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000323-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000146-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-05-28 23:00:56,129",
            "thread_id": "4932",
            "caller": "0x7ffcfabe607d",
            "parentcaller": "0x7ffcfabd51de",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x001200a9",
                "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Actioncenter.dll.3.Manifest"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-05-28 23:00:56,129",
            "thread_id": "4932",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcdd457339",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "Comctl32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce4aa0000"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-05-28 23:00:56,129",
            "thread_id": "4932",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcdd4570af",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "wscapi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcdc000000"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-05-28 23:00:56,161",
            "thread_id": "3288",
            "caller": "0x7ffce8ec1459",
            "parentcaller": "0x7ffcfb3c0ebc",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000323-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000146-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-05-28 23:00:56,161",
            "thread_id": "4924",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\ieproxy"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd8090000"
              }
            ],
            "repeated": 0,
            "id": 306
          }
        ],
        "threads": [
          "5848",
          "4084",
          "3872",
          "3920",
          "3940",
          "3656",
          "4936",
          "4252",
          "3476",
          "4060",
          "3548",
          "3288",
          "4924",
          "3676",
          "3612",
          "3564",
          "4932",
          "4256"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "DESKTOP-HGH2VBT",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "C:\\Windows\\Explorer.EXE",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff633380000",
          "MainExeSize": "0x00546000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 5448,
        "process_name": "MediaCreationTool_22H2.exe",
        "parent_id": 3932,
        "module_path": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe",
        "first_seen": "2026-05-28 22:59:32,520",
        "calls": [
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "MSVCRT.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x76d70000"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x7798b021",
            "parentcaller": "0x6b4fd90a",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x7798b021",
            "parentcaller": "0x6b4fd916",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b207b3",
            "parentcaller": "0x77999057",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x05560000"
              },
              {
                "name": "RegionSize",
                "value": "0x00080000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b207ed",
            "parentcaller": "0x77999057",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x05560000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x6b544b04",
            "parentcaller": "0x6b4fdd46",
            "category": "misc",
            "api": "GetCursorPos",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "x",
                "value": "0"
              },
              {
                "name": "y",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x7798b021",
            "parentcaller": "0x6b545ee2",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x7798b021",
            "parentcaller": "0x6b545eee",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b11f80",
            "parentcaller": "0x77af8db8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77af931b",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\mfc42u.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77af931b",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000248"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\sysnative\\en-US\\mfc42u.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77af97cc",
            "parentcaller": "0x77af92ae",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000244"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000248"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\sysnative\\en-US\\MFC42u.dll.mui"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77af97f4",
            "parentcaller": "0x77af92ae",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000244"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x037f0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00aed9a0"
              },
              {
                "name": "ViewSize",
                "value": "0x00008000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77af9804",
            "parentcaller": "0x77af92ae",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b2ab9b",
            "parentcaller": "0x77af2f1c",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000240"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\Session Manager"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b2abcd",
            "parentcaller": "0x77af2f1c",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000240"
              },
              {
                "name": "ValueName",
                "value": "SafeDllSearchMode"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\SafeDllSearchMode"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b053db",
            "parentcaller": "0x7798a51e",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\MFC42LOC.DLL"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b05539",
            "parentcaller": "0x7798a51e",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\MFC42LOC.DLL.DLL"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b053db",
            "parentcaller": "0x7798a51e",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\sysnative\\MFC42LOC.DLL"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b05539",
            "parentcaller": "0x7798a51e",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\sysnative\\MFC42LOC.DLL.DLL"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b05539",
            "parentcaller": "0x7798a51e",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\mfc42u"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b4d0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6b4f4d00"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x6b668c37",
            "parentcaller": "0x6b6673e7",
            "category": "misc",
            "api": "HeapCreate",
            "status": true,
            "return": "0x06df0000",
            "arguments": [
              {
                "name": "Options",
                "value": "0"
              },
              {
                "name": "InitialSize",
                "value": "0x00001000"
              },
              {
                "name": "MaximumSize",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x7798917f",
            "parentcaller": "0x6b6684e1",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "KERNELBASE.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77870000"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "kernelbase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77870000"
              },
              {
                "name": "FunctionName",
                "value": "FlsAlloc"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x779ad2c0"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "kernelbase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77870000"
              },
              {
                "name": "FunctionName",
                "value": "FlsGetValue"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7798c970"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "kernelbase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77870000"
              },
              {
                "name": "FunctionName",
                "value": "FlsSetValue"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77995030"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "kernelbase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77870000"
              },
              {
                "name": "FunctionName",
                "value": "FlsFree"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x779b03f0"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x7798917f",
            "parentcaller": "0x6b66b444",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "api-ms-win-core-guard-l1-1-0.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77870000"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "kernelbase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77870000"
              },
              {
                "name": "FunctionName",
                "value": "GuardCheckLongJumpTarget"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77a52160"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x779a7efa",
            "parentcaller": "0x6b66b470",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b676000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x779a7efa",
            "parentcaller": "0x6b66b48a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b676000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x6b667407",
            "parentcaller": "0x6b6675e2",
            "category": "misc",
            "api": "GetCommandLineA",
            "status": true,
            "return": "0x03bc27b8",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\" "
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03be7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06df1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06df2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x7798917f",
            "parentcaller": "0x6b61e285",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "LPK.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6b600000"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x7798917f",
            "parentcaller": "0x6b61e294",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "KERNEL32"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              },
              {
                "name": "FunctionName",
                "value": "ProcessIdToSessionId"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x75d50e30"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x6b606cbc",
            "parentcaller": "0x6b61e2dc",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000068"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b13909",
            "parentcaller": "0x77aed7a4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf4\\xec\\xae\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x008\\xed\\xae\\x00\\x0e\\x8f\\x99w,\\xed\\xae\\x00\\x00\\x00\\x00\\x00\\x90\\x00\\x00\\x00&\\x00'\\x00\\x04@]w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x08\\x01\\x01x\\xed\\xae\\x00"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77aed7d7",
            "parentcaller": "0x779ae3d7",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000234"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x6b606dfb",
            "parentcaller": "0x6b61e2dc",
            "category": "misc",
            "api": "GetSystemMetrics",
            "status": true,
            "return": "0x00000400",
            "arguments": [
              {
                "name": "SystemMetricIndex",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x6b606e08",
            "parentcaller": "0x6b61e2dc",
            "category": "misc",
            "api": "GetSystemMetrics",
            "status": true,
            "return": "0x00000300",
            "arguments": [
              {
                "name": "SystemMetricIndex",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x6b606e3e",
            "parentcaller": "0x6b61e2dc",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000029"
              },
              {
                "name": "uiParam",
                "value": "0x000001f4"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x6b606eaf",
            "parentcaller": "0x6b61e2dc",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000066"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x6b606ec6",
            "parentcaller": "0x6b61e2dc",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000234"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x7798a206",
            "parentcaller": "0x779afb91",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "imm32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x76e30000"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76e30000"
              },
              {
                "name": "FunctionName",
                "value": "ImmCreateContext"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76e37770"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76e30000"
              },
              {
                "name": "FunctionName",
                "value": "ImmDestroyContext"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76e377e0"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76e30000"
              },
              {
                "name": "FunctionName",
                "value": "ImmNotifyIME"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76e3bc30"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76e30000"
              },
              {
                "name": "FunctionName",
                "value": "ImmAssociateContext"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76e35150"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76e30000"
              },
              {
                "name": "FunctionName",
                "value": "ImmReleaseContext"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76e34e80"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76e30000"
              },
              {
                "name": "FunctionName",
                "value": "ImmGetContext"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76e33b30"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76e30000"
              },
              {
                "name": "FunctionName",
                "value": "ImmGetCompositionStringA"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76e384b0"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76e30000"
              },
              {
                "name": "FunctionName",
                "value": "ImmSetCompositionStringA"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76e39050"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76e30000"
              },
              {
                "name": "FunctionName",
                "value": "ImmGetCompositionStringW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76e38550"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76e30000"
              },
              {
                "name": "FunctionName",
                "value": "ImmSetCompositionStringW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76e39080"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76e30000"
              },
              {
                "name": "FunctionName",
                "value": "ImmSetCandidateWindow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76e38d60"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.3636_none_c0df324c38bbc0ce\\comctl32"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b600000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6b667340"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b0dd72",
            "parentcaller": "0x77b11873",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\userenv"
              },
              {
                "name": "BaseAddress",
                "value": "0x74830000"
              },
              {
                "name": "InitRoutine",
                "value": "0x748386d0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b0dd72",
            "parentcaller": "0x77b11873",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\wdscore"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b490000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6b4999a0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x6b477ac2",
            "parentcaller": "0x6b4789d4",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Compression"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Compression"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x6b477ac2",
            "parentcaller": "0x6b4789d4",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\cabinet"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b470000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6b477ec0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b0dd72",
            "parentcaller": "0x77b11873",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\wimgapi"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b3d0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6b454f70"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b01317",
            "parentcaller": "0x779a8f85",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x05710000"
              },
              {
                "name": "RegionSize",
                "value": "0x00050000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b01357",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x05710000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b013b5",
            "parentcaller": "0x779a8f85",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x05750000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b013b5",
            "parentcaller": "0x779a8f85",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\uxtheme"
              },
              {
                "name": "BaseAddress",
                "value": "0x747b0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x747e7390"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5444",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "440",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "440",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "448",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "448",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5556",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03be8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5556",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "5556",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "4584",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03be9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "4584",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:59:32,661",
            "thread_id": "4584",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c92f4b",
            "parentcaller": "0x00c927b7",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x00c92ef0"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c9272a",
            "parentcaller": "0x00c927eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03bea000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c9272a",
            "parentcaller": "0x00c927eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x05603000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c9272a",
            "parentcaller": "0x00c927eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x05604000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c3636e",
            "parentcaller": "0x00c361f5",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c3638d",
            "parentcaller": "0x00c361f5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventRegister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77aee100"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c363a0",
            "parentcaller": "0x00c361f5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventUnregister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b19a30"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c363b3",
            "parentcaller": "0x00c361f5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b26b30"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c363c6",
            "parentcaller": "0x00c361f5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventWrite"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b21320"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c77ae8",
            "parentcaller": "0x00c362b5",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "advapi32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75b50000"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c77b0f",
            "parentcaller": "0x00c362b5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75b50000"
              },
              {
                "name": "FunctionName",
                "value": "EventWrite"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b21320"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c77b24",
            "parentcaller": "0x00c362b5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75b50000"
              },
              {
                "name": "FunctionName",
                "value": "EventRegister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77aee100"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c77b39",
            "parentcaller": "0x00c362b5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75b50000"
              },
              {
                "name": "FunctionName",
                "value": "EventUnregister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b19a30"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c46c02",
            "parentcaller": "0x00c373e2",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\Logs\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c46b27",
            "parentcaller": "0x00c37378",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c46b27",
            "parentcaller": "0x00c37378",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c46b27",
            "parentcaller": "0x00c37378",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\Logs"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c46b27",
            "parentcaller": "0x00c37378",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\Logs\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c46b3f",
            "parentcaller": "0x00c37378",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\Logs\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:59:32,723",
            "thread_id": "5444",
            "caller": "0x00c46b50",
            "parentcaller": "0x00c37378",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\Logs\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c37435",
            "parentcaller": "0x00c374fb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c375dc",
            "parentcaller": "0x00c37936",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c36f6f",
            "parentcaller": "0x00c37936",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000025c"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46c02",
            "parentcaller": "0x00c373e2",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\Logs\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c37435",
            "parentcaller": "0x00c37950",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c37977",
            "parentcaller": "0x00c43fe1",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c37977",
            "parentcaller": "0x00c43fe1",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bac9",
            "parentcaller": "0x00c42e7e",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bb3a",
            "parentcaller": "0x00c4bbef",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bb3a",
            "parentcaller": "0x00c4bbef",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bb3a",
            "parentcaller": "0x00c4bbef",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bb6a",
            "parentcaller": "0x00c4bbef",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bb6a",
            "parentcaller": "0x00c4bbef",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bb6a",
            "parentcaller": "0x00c4bbef",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bc23",
            "parentcaller": "0x00c42e7e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000c0"
              },
              {
                "name": "ValueName",
                "value": "000603xx"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "kernel32.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bc23",
            "parentcaller": "0x00c42e7e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x75d30000"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bc23",
            "parentcaller": "0x00c42e7e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              },
              {
                "name": "FunctionName",
                "value": "SortGetHandle"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x75d4eb20"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bc23",
            "parentcaller": "0x00c42e7e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              },
              {
                "name": "FunctionName",
                "value": "SortCloseHandle"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x75d497e0"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bc23",
            "parentcaller": "0x00c42e7e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000260"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bc23",
            "parentcaller": "0x00c42e7e",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000264"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000260"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bc23",
            "parentcaller": "0x00c42e7e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000264"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06e00000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00aef194"
              },
              {
                "name": "ViewSize",
                "value": "0x00338000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bc23",
            "parentcaller": "0x00c42e7e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000264"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bc23",
            "parentcaller": "0x00c42e7e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000260"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c4bc23",
            "parentcaller": "0x00c42e7e",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000260"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlGetSystemTimeAndBias"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b47160"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tzres.dll"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000264"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tzres.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000268"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000005",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000264"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\tzres.dll"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x40000003",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000268"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03b90000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00003000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000268"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000264"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000264"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\sysnative\\en-US\\tzres.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000268"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000264"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000268"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03ba0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00aee2d0"
              },
              {
                "name": "ViewSize",
                "value": "0x0000c000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000268"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03ba0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000264"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03b90000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tzres.dll"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000264"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tzres.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000268"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000005",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000264"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\tzres.dll"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x40000003",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000268"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03b90000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00003000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000268"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000264"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000264"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\sysnative\\en-US\\tzres.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000268"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000264"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000268"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03ba0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00aee2d0"
              },
              {
                "name": "ViewSize",
                "value": "0x0000c000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000268"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03ba0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000264"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03b90000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c42ea6",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:59:32,739",
            "thread_id": "5444",
            "caller": "0x00c37187",
            "parentcaller": "0x00c42ea6",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "\\xfeff"
              },
              {
                "name": "Length",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c42ea6",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c42ea6",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: BuildInfo: [10.0.19041.572 (vb_release_svc_prod1.201007-1724)]\r\n"
              },
              {
                "name": "Length",
                "value": "85"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c4303a",
            "parentcaller": "0x00c44008",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x03bc1032",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\" "
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c4304c",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "X\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c4304c",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "X\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: CommandLine: [\"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\" ]\r\n"
              },
              {
                "name": "Length",
                "value": "101"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c43073",
            "parentcaller": "0x00c44008",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x03bc1032",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\" "
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c44008",
            "parentcaller": "0x00c92886",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "42"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "5444"
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c44008",
            "parentcaller": "0x00c92886",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000264"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "shcore.dll"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c44008",
            "parentcaller": "0x00c92886",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000264"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76cc0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00087000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c44008",
            "parentcaller": "0x00c92886",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76d3c000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c44008",
            "parentcaller": "0x00c92886",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76d39000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c44008",
            "parentcaller": "0x00c92886",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76d39000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c44008",
            "parentcaller": "0x00c92886",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c44008",
            "parentcaller": "0x00c92886",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c44008",
            "parentcaller": "0x00c92886",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76d39000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c44008",
            "parentcaller": "0x00c92886",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000264"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c44008",
            "parentcaller": "0x00c92886",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76d39000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c44008",
            "parentcaller": "0x00c92886",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\n\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00mand\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00C:\\U\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00in\\A\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00ocal\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00diaC"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c44008",
            "parentcaller": "0x00c92886",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\shcore"
              },
              {
                "name": "DllBase",
                "value": "0x76cc0000"
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c44008",
            "parentcaller": "0x00c92886",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\SHCore"
              },
              {
                "name": "BaseAddress",
                "value": "0x76cc0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x76d02480"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c44008",
            "parentcaller": "0x00c92886",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76497000"
              },
              {
                "name": "ModuleName",
                "value": "SHELL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c44008",
            "parentcaller": "0x00c92886",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76497000"
              },
              {
                "name": "ModuleName",
                "value": "SHELL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c4307a",
            "parentcaller": "0x00c44008",
            "category": "misc",
            "api": "CommandLineToArgvW",
            "status": true,
            "return": "0x03bc8e78",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\" "
              },
              {
                "name": "NumArgs",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c43b26",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 192
          },
          {
            "timestamp": "2026-05-28 22:59:32,754",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c43b26",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xbd\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Opening Box: [C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe]\r\n"
              },
              {
                "name": "Length",
                "value": "98"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c43b4b",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": " \\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 198
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c43b4b",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1f\\x01\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Opening Box Result: [0x0]\r\n"
              },
              {
                "name": "Length",
                "value": "48"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c6b6b0",
            "parentcaller": "0x00c43b5f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000268"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c7c389",
            "parentcaller": "0x00c6bf66",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000268"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c6bf92",
            "parentcaller": "0x00c6b713",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03bec000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c6bfe3",
            "parentcaller": "0x00c6b713",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000268"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\x0e\\x1f\\xba\\x0e\\x00\\xb4\t\\xcd!\\xb8\\x01L\\xcd!This program cannot be run in DOS mode.\r\r\n$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf1L\\x81\\xf6\\xb5-\\xef\\xa5\\xb5-\\xef\\xa5\\xb5-\\xef\\xa5\\xeeE\\xec\\xa4\\xb4-\\xef\\xa5\\xa1F\\xec\\xa4\\xbd-\\xef\\xa5\\xa1F\\xeb\\xa4\\xaf-\\xef\\xa5\\xa1F\\xea\\xa4\\xb9-\\xef\\xa5\\xa1F\\xee\\xa4\\x98-\\xef\\xa5\\xb5-\\xee\\xa5\\xd4/\\xef\\xa5\\xa1F\\xe6\\xa4\\xe9-\\xef\\xa5\\xa1F\\x10\\xa5\\xb4-\\xef\\xa5\\xa1F\\xed\\xa4\\xb4-\\xef\\xa5Rich\\xb5-\\xef\\xa5\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PE\\x00\\x00L\\x01\\x06\\x00\\xb1JJ\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x00\\x02\r"
              },
              {
                "name": "Length",
                "value": "131072"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c6bfbb",
            "parentcaller": "0x00c6b713",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c0d000"
              },
              {
                "name": "RegionSize",
                "value": "0x0007c000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c6bfe3",
            "parentcaller": "0x00c6b713",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000268"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc4\\x10\\x8b\\xcb\\xe8ui\\x00\\x00\\x85\\xf6t\\x07\\x8b\\xce\\xe83g\\x00\\x00\\x8bM\\xe4\\x85\\xc9t\\x05\\xe8'g\\x00\\x00\\x85\\xfft\\x07\\x8b\\xcf\\xe8\\x1cg\\x00\\x00j\\x00\\x8dM\\xd0\\xe8S\\x89\\x00\\x00\\x8dM\\xd8\\xe8\\xeec\\xff\\xff\\x8b\\xc3\\xe8\\x11\"\\x05\\x00\\xc3j\\x14\\xb8u\\G\\x00\\xe8'\"\\x05\\x00\\x8b\\xda3\\xc0\\x89E\\xe0\\x89E\\xe4\\x89E\\xe8\\x8b\\xf0\\x89E\\xfc\\x89u\\xf0\\xc6E\\xfc\\x01\\x85\\xc9u\t\\xb9W\\x00\\x07\\x80\\x8b\\xf9\\xebT\\x85\\xdbt\\xf3\\x8dU\\xe0\\xe8\\xdaJ\\x00\\x00\\x8b\\xf8\\x85\\xffx@\\x8dE\\xf0P\\x8dU\\xec\\x8dM\\xe0\\xe8QM\\x00\\x00\\x8b\\xf8\\x85\\xffy\\x0c\\x8b\\xcf\\xe8\\xc1h\\x00\\x00\\x8bu\\xf0\\xeb&\\x8bU\\xec\\x8bu\\xf0\\x83\\xfa\\x01u\\x03R\\xeb\\x02j\\x00SQ\\x8b\\xce\\xe8\\xc7\\xc4\\x02\\x00\\x8b\\xf8\\x85\\xffy\\x07\\x8b\\xcf\\xe8\\x96h\\x00\\x00\\x8b\\xcf\\xe8\\xa7h\\x00\\x00\\x85\\xf6t\\x10Vj\\x00\\xff\\x150\\xd3G\\x00P\\xff\\x15@\\xd3G\\x00j\\x00\\x8dM\\xe0\\xe8\\x93\\x88\\x00\\x00\\x8dM\\xe8\\xe8.c\\xff\\xff\\x8b\\xc7\\xe8"
              },
              {
                "name": "Length",
                "value": "375296"
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c6bfbb",
            "parentcaller": "0x00c6b713",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07140000"
              },
              {
                "name": "RegionSize",
                "value": "0x00b09000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c6bfbb",
            "parentcaller": "0x00c6b713",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07140000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c6bfbb",
            "parentcaller": "0x00c6b713",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07c48000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c6bfbb",
            "parentcaller": "0x00c6b713",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03bec000"
              },
              {
                "name": "RegionSize",
                "value": "0x000d3000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c6bfe3",
            "parentcaller": "0x00c6b713",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000268"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x01\\x00\\x08\\x00\\xe86\\x00\\x80X\\x00\\x00\\x80\\x02\\x00\\x00\\x00\\x80\\x00\\x00\\x80\\x03\\x00\\x00\\x00 \\x01\\x00\\x80\\x05\\x00\\x00\\x00\\x00\\x02\\x00\\x80\\x06\\x00\\x00\\x008\\x02\\x00\\x80\n\\x00\\x00\\x00\\x88\\x02\\x00\\x80\\x0e\\x00\\x00\\x00\\xa0\\x02\\x00\\x80\\x10\\x00\\x00\\x00\\xc0\\x02\\x00\\x80\\x18\\x00\\x00\\x00\\xd8\\x02\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x03\\x00,N\\x00\\x00\\xf0\\x02\\x00\\x80-N\\x00\\x00\\x08\\x03\\x00\\x80.N\\x00\\x00 \\x03\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\xd2\\x07\\x00\\x008\\x03\\x00\\x80\\xd3\\x07\\x00\\x00P\\x03\\x00\\x80\\xd4\\x07\\x00\\x00h\\x03\\x00\\x80\\xd5\\x07\\x00\\x00\\x80\\x03\\x00\\x80\\xd6\\x07\\x00\\x00\\x98\\x03\\x00\\x80\\xd7\\x07\\x00\\x00\\xb0\\x03\\x00\\x80\\xd8\\x07\\x00\\x00\\xc8\\x03\\x00\\x80\\xd9\\x07\\x00\\x00\\xe0\\x03\\x00\\x80\\xda\\x07\\x00\\x00\\xf8\\x03\\x00\\x80\\xdb\\x07\\x00\\x00\\x10\\x04\\x00\\x80\\xdc\\x07\\x00\\x00(\\x04\\x00\\x80\\xdd\\x07\\x00\\x00@\\x04\\x00\\x80\\xde\\x07\\x00\\x00X\\x04\\x00\\x80\\xdf\\x07\\x00\\x00p\\x04\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "11042360"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c6c0af",
            "parentcaller": "0x00c6b713",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07140000"
              },
              {
                "name": "RegionSize",
                "value": "0x00b09000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c6be51",
            "parentcaller": "0x00c44008",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000268"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c49c56",
            "parentcaller": "0x00c44674",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\MiniNt"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNt"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c40883",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "P\\x01\\x00\\x00\\x00\\x00\\x00\\x00O\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 218
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c40883",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "O\\x01\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-28 22:59:32,770",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Deleting box result...\r\n"
              },
              {
                "name": "Length",
                "value": "45"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "5444",
            "caller": "0x00c49c56",
            "parentcaller": "0x00c44713",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 1,
            "id": 221
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "5444",
            "caller": "0x00c498b9",
            "parentcaller": "0x00c496c2",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03bec000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "5444",
            "caller": "0x00c76914",
            "parentcaller": "0x00c3b28b",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "5444",
            "caller": "0x00c3a5bd",
            "parentcaller": "0x00c3b152",
            "category": "misc",
            "api": "GetCursorPos",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "x",
                "value": "0"
              },
              {
                "name": "y",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "5444",
            "caller": "0x00c3b35d",
            "parentcaller": "0x00c41901",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000274"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x76dd6d60"
              },
              {
                "name": "Parameter",
                "value": "0x05604888"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "1336"
              },
              {
                "name": "ProcessId",
                "value": "5448"
              },
              {
                "name": "Module",
                "value": "msvcrt.dll"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "5444",
            "caller": "0x00c3b35d",
            "parentcaller": "0x00c41901",
            "category": "threading",
            "api": "CreateThread",
            "status": true,
            "return": "0x00000274",
            "arguments": [
              {
                "name": "StartRoutine",
                "value": "0x76dd6d60"
              },
              {
                "name": "ModuleName",
                "value": "msvcrt.dll"
              },
              {
                "name": "Parameter",
                "value": "0x05604888"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000004"
              },
              {
                "name": "ThreadId",
                "value": "1336"
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "5444",
            "caller": "0x00c3b35d",
            "parentcaller": "0x00c41901",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000274"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "1336"
              },
              {
                "name": "ProcessId",
                "value": "5448"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "5444",
            "caller": "0x00c3b35d",
            "parentcaller": "0x00c41901",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "1336",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "1336",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "1336",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "5444",
            "caller": "0x00c3b35d",
            "parentcaller": "0x00c41901",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "5444",
            "caller": "0x00c3b35d",
            "parentcaller": "0x00c41901",
            "category": "threading",
            "api": "NtSuspendThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000274"
              },
              {
                "name": "SuspendCount",
                "value": "0"
              },
              {
                "name": "ThreadId",
                "value": "1336"
              },
              {
                "name": "ProcessId",
                "value": "5448"
              }
            ],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "5444",
            "caller": "0x00c3b35d",
            "parentcaller": "0x00c41901",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000274"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "1336"
              },
              {
                "name": "ProcessId",
                "value": "5448"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "1336",
            "caller": "0x7798ab1a",
            "parentcaller": "0x6b545480",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "5444",
            "caller": "0x00c3a818",
            "parentcaller": "0x00c41901",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "5444",
            "caller": "0x00c3a818",
            "parentcaller": "0x00c41901",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000268"
              },
              {
                "name": "Milliseconds",
                "value": "10000"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "1336",
            "caller": "0x00c3a715",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03bed000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-05-28 22:59:32,786",
            "thread_id": "1336",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\USP10"
              },
              {
                "name": "DllBase",
                "value": "0x6b330000"
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\msls31"
              },
              {
                "name": "DllBase",
                "value": "0x6b2f0000"
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\riched20"
              },
              {
                "name": "DllBase",
                "value": "0x6b350000"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\riched32"
              },
              {
                "name": "DllBase",
                "value": "0x6cd10000"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "RICHED32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x6cd10000"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c498b9",
            "parentcaller": "0x00c496c2",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03bee000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c7d19c",
            "parentcaller": "0x00c75d24",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\Lang.ini"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c7d19c",
            "parentcaller": "0x00c75d24",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\Lang.ini"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c7d19c",
            "parentcaller": "0x00c75d24",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000284"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c7d19c",
            "parentcaller": "0x00c75d24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcb?\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xba\\xd8\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c7d19c",
            "parentcaller": "0x00c75d24",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000284"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c768a2",
            "parentcaller": "0x00c76e71",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c3a79c",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x05605000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c3b39a",
            "parentcaller": "0x00c41901",
            "category": "windows",
            "api": "PostThreadMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessId",
                "value": "5448"
              },
              {
                "name": "ThreadId",
                "value": "1336"
              },
              {
                "name": "Message",
                "value": "33768"
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "COMCTL32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b600000"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6b600000"
              },
              {
                "name": "FunctionName",
                "value": "InitCommonControlsEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6b61e3e0"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b5d4000"
              },
              {
                "name": "ModuleName",
                "value": "mfc42u.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b5d4000"
              },
              {
                "name": "ModuleName",
                "value": "mfc42u.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "COMCTL32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b600000"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c3b3c5",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x80\\x01\\x00\\x00\\x00\\x00\\x00\\x00|\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6b600000"
              },
              {
                "name": "FunctionName",
                "value": "InitCommonControlsEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6b61e3e0"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "COMCTL32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b600000"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6b600000"
              },
              {
                "name": "FunctionName",
                "value": "InitCommonControlsEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6b61e3e0"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "COMCTL32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b600000"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6b600000"
              },
              {
                "name": "FunctionName",
                "value": "InitCommonControlsEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6b61e3e0"
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "COMCTL32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b600000"
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6b600000"
              },
              {
                "name": "FunctionName",
                "value": "InitCommonControlsEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6b61e3e0"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c3b3c5",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x80\\x01\\x00\\x00\\x00\\x00\\x00\\x00|\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\uxtheme.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x747b0000"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Creating path: [C:\\$Windows.~WS\\Sources]...\r\n"
              },
              {
                "name": "Length",
                "value": "66"
              }
            ],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "SetWindowsHookExW",
            "status": true,
            "return": "0x0010020f",
            "arguments": [
              {
                "name": "HookIdentifier",
                "value": "5",
                "pretty_value": "WH_CBT"
              },
              {
                "name": "ProcedureAddress",
                "value": "0x6b50e960"
              },
              {
                "name": "ModuleAddress",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "1336"
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03bef000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03bf4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000027c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "MSCTF.dll"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000027c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75bd0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000d4000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75c98000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75c94000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75c94000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75c94000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000027c"
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75c94000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00e\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x00T\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00D\\x00L\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8by\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00.\\x00d\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\MSCTF"
              },
              {
                "name": "DllBase",
                "value": "0x75bd0000"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\msctf"
              },
              {
                "name": "BaseAddress",
                "value": "0x75bd0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x75c1dbc0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76e4d000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76e4d000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000028c"
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76e4d000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76e4d000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000290"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "\\Sessions\\1\\Windows\\ThemeSection"
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000290"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03b90000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0579e434"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000028c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "\\Windows\\Theme4085422095"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000294"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "\\Sessions\\1\\Windows\\Theme149276106"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03b90000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000028c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06cd0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0579eac0"
              },
              {
                "name": "ViewSize",
                "value": "0x000e2000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000294"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03b90000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0579eac0"
              },
              {
                "name": "ViewSize",
                "value": "0x00004000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af2470"
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b341e0"
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af0700"
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b2c3b0"
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b253f0"
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b1f560"
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5448:168:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              }
            ],
            "repeated": 1,
            "id": 321
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c3b3d0",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc000003a",
            "pretty_return": "OBJECT_PATH_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c6b07b",
            "parentcaller": "0x00c3b3d0",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\$Windows.~WS\\Sources"
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SystemResources\\USER32.dll.mun"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 1,
            "id": 324
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c47b54",
            "parentcaller": "0x00c44524",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000029c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c47b9b",
            "parentcaller": "0x00c44524",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000029c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "64"
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SystemResources\\mfc42u.dll.mun"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 327
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c47bc7",
            "parentcaller": "0x00c44524",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000029c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xe8\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c47bff",
            "parentcaller": "0x00c44524",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000029c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "PE\\x00\\x00L\\x01\\x06\\x00\\xb1JJ\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x00\\x02\r\\x0b\\x01\\x0e\\x14\\x00|\\x07\\x00\\x00\\xb8\\xa8\\x00\\x00\\x00\\x00\\x00\\xb0)\\x07\\x00\\x00\\x10\\x00\\x00\\x00\\x90\\x07\\x00\\x00\\x00@\\x00\\x00\\x10\\x00\\x00\\x00\\x02\\x00\\x00\n\\x00\\x00\\x00\n\\x00\\x00\\x00\\x06\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xb0\\x00\\x00\\x04\\x00\\x00\\x80\\x08)\\x01\\x02\\x00@\\xc1\\x00\\x00\\x04\\x00\\x00 \\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\xd8\\x07\\x00\\xa4\\x01\\x00\\x00\\x00\\x10\\x08\\x00\\x0c\\x15\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xdb(\\x01\\xc0!\\x00\\x00\\x000\\xb0\\x00\\xd4f\\x00\\x00\\xf0[\\x01\\x00T\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe4M\\x00\\x00\\x18\\x00\\x00\\x008M\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x07\\x008\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "248"
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b1f560"
              }
            ],
            "repeated": 0,
            "id": 330
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c48c1a",
            "parentcaller": "0x00c48a58",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000029c"
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c48c69",
            "parentcaller": "0x00c48a58",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c48cdc",
            "parentcaller": "0x00c48a58",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf0\\xd7\\xbd\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c36f6f",
            "parentcaller": "0x00c48a58",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000029c"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5448:168:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c48b38",
            "parentcaller": "0x00c45d30",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000029c"
              },
              {
                "name": "MutexName",
                "value": "Global\\Microsoft.Windows.Websetup"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x0000001e"
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 347
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000109",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000118"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink"
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "KeyInformation",
                "value": "\\xff9a\\x066\\xffe5\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x00\\x00\\x006\\x00\\x00\\x00\\xff84\\x03\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002b0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e90000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0000f000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 355
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03bfb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 356
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e9c000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e99000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 359
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e99000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 360
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e99000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e99000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x74e90000"
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 378
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 382
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 388
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 392
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 394
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 395
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "16"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "16"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "17"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 398
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "17"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "18"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "18"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 401
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "19"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "19"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "20"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "20"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "21"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "21"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 407
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "22"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "22"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "23"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "23"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 411
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "24"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "24"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "25"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "25"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "26"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "26"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "27"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "27"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "28"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 420
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "28"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "29"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "29"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "30"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0xffffffffcb1a5301",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\kernel.appcore"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e90000"
              },
              {
                "name": "InitRoutine",
                "value": "0x74e947e0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "30"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "31"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "32"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "32"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "33"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "bcryptprimitives.dll"
              }
            ],
            "repeated": 0,
            "id": 433
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "33"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "34"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "34"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002b0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76ba0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0005f000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "35"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "35"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76bfa000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "36"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76bfa000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "36"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "37"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 445
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "37"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76bfa000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "38"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 449
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "38"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 451
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "39"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "39"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76bfa000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptprimitives"
              },
              {
                "name": "DllBase",
                "value": "0x76ba0000"
              }
            ],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "40"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "40"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "41"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "41"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "42"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "42"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "43"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "43"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "44"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "44"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "45"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "45"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 467
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "46"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "46"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 469
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "47"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "47"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 471
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "48"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 472
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "48"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 473
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "49"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "49"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "50"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "50"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "51"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "51"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 479
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "52"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "52"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 481
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "53"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "53"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 483
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "54"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 484
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "54"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "55"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "55"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "56"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "56"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "57"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "57"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "58"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "58"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "59"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "59"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "60"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "60"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 497
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "61"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "61"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 499
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "62"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "62"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "63"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 502
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "63"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "64"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 504
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "64"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "65"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "65"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "66"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "66"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "67"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "STE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE"
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000101",
                "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000118"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "ValueName",
                "value": "Disable"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable"
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002bc"
              },
              {
                "name": "ValueName",
                "value": "FipsAlgorithmPolicy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "MDMEnabled"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled"
              }
            ],
            "repeated": 0,
            "id": 521
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002bc"
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\Device\\CNG"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 525
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000002bc"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390008",
                "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x03\\xb5\\x9e#cP\\xbd\\x93\\xfd\\xf3\\xf7j5\\xa6\\xdf\\x84\\xcaS\\xf8\\xe5\\xc8\\xe5\\xd83\\x91O\\x88yEE\\x12\\xcf5\\xda}\\xee\\xf6\\x14i`\\xce\\xc0D\\xdf\\x010\\xf9\\xd4"
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\bcryptprimitives"
              },
              {
                "name": "BaseAddress",
                "value": "0x76ba0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x76bd36c0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76cb2000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76cb2000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-05-28 22:59:32,801",
            "thread_id": "5444",
            "caller": "0x00c44b99",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c04000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 531
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 533
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000298"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Fonts\\StaticCache.dat"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00&\\x01\\x00\\x00\\x00\\x00\\x00\\x00&\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000298"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Fonts\\StaticCache.dat"
              },
              {
                "name": "Buffer",
                "value": "\\x1a\\x83W\\xa5\\x02\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00$\\x01\\x00\\x00$)\\x00\\x00\\x00\\x00\\x02\\x00\\xbe\\x02\\x00\\x00<\\x00\\x00\\x00$!\\x00\\x00L)\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00"
              },
              {
                "name": "Length",
                "value": "60"
              }
            ],
            "repeated": 0,
            "id": 535
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000298"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Fonts\\StaticCache.dat"
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002c0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07140000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0579d530"
              },
              {
                "name": "ViewSize",
                "value": "0x01260000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 537
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c3f7a5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xbe\\x01\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Checking cleanup registry value...\r\n"
              },
              {
                "name": "Length",
                "value": "57"
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c08000"
              },
              {
                "name": "RegionSize",
                "value": "0x00015000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c1d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c49c56",
            "parentcaller": "0x00c48163",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 542
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 543
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 545
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c3f7e4",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xf8\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 546
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c05000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "TextShaping.dll"
              }
            ],
            "repeated": 0,
            "id": 548
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\TextShaping.dll"
              }
            ],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\TextShaping.dll"
              }
            ],
            "repeated": 0,
            "id": 550
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Cleanup value missing... assuming no cleanup.\r\n"
              },
              {
                "name": "Length",
                "value": "68"
              }
            ],
            "repeated": 0,
            "id": 551
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002c4"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\TextShaping.dll"
              }
            ],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 554
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 555
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b250000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00095000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 556
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b2e2000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 557
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b2e2000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 558
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c3f89c",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "@\\x02\\x00\\x00\\x00\\x00\\x00\\x00;\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 559
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 560
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b2e2000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c4"
              }
            ],
            "repeated": 0,
            "id": 564
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b2e2000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\TextShaping"
              },
              {
                "name": "DllBase",
                "value": "0x6b250000"
              }
            ],
            "repeated": 0,
            "id": 566
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c3f89c",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "@\\x02\\x00\\x00\\x00\\x00\\x00\\x00;\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c3f89c",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": ";\\x02\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Skipping cleanup.\r\n"
              },
              {
                "name": "Length",
                "value": "40"
              }
            ],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\TextShaping"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b250000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6b2df2f0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 570
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7784e000"
              },
              {
                "name": "ModuleName",
                "value": "gdi32full.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 571
          },
          {
            "timestamp": "2026-05-28 22:59:32,817",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7784e000"
              },
              {
                "name": "ModuleName",
                "value": "gdi32full.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 572
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c05000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 573
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c3fb18",
            "parentcaller": "0x00c41cd1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              }
            ],
            "repeated": 0,
            "id": 574
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c3fb18",
            "parentcaller": "0x00c41cd1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 575
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c3fb18",
            "parentcaller": "0x00c41cd1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 576
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c3fb18",
            "parentcaller": "0x00c41cd1",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "oleaut32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76e60000"
              }
            ],
            "repeated": 0,
            "id": 577
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c3fb18",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 578
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c3fb18",
            "parentcaller": "0x00c41cd1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 579
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c46c02",
            "parentcaller": "0x00c44024",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              }
            ],
            "repeated": 0,
            "id": 580
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 581
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 582
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c03000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 583
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 584
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c41d91",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "h\\x02\\x00\\x00\\x00\\x00\\x00\\x00c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 585
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c41d91",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "c\\x02\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 586
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Preserve working path: [No]\r\n"
              },
              {
                "name": "Length",
                "value": "50"
              }
            ],
            "repeated": 0,
            "id": 587
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 588
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000101",
                "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000118"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 589
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "Plane1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1"
              }
            ],
            "repeated": 0,
            "id": 590
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "Plane2"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "SimSun-ExtB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2"
              }
            ],
            "repeated": 1,
            "id": 591
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "Plane3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3"
              }
            ],
            "repeated": 0,
            "id": 592
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "Plane4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4"
              }
            ],
            "repeated": 0,
            "id": 593
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "Plane5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5"
              }
            ],
            "repeated": 0,
            "id": 594
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "Plane6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6"
              }
            ],
            "repeated": 0,
            "id": 595
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "Plane7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7"
              }
            ],
            "repeated": 0,
            "id": 596
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "Plane8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8"
              }
            ],
            "repeated": 0,
            "id": 597
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "Plane9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9"
              }
            ],
            "repeated": 0,
            "id": 598
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "Plane10"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10"
              }
            ],
            "repeated": 0,
            "id": 599
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "Plane11"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11"
              }
            ],
            "repeated": 0,
            "id": 600
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "Plane12"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12"
              }
            ],
            "repeated": 0,
            "id": 601
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "Plane13"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13"
              }
            ],
            "repeated": 0,
            "id": 602
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "Plane14"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14"
              }
            ],
            "repeated": 0,
            "id": 603
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "Plane15"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15"
              }
            ],
            "repeated": 0,
            "id": 604
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "Plane16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16"
              }
            ],
            "repeated": 0,
            "id": 605
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              }
            ],
            "repeated": 0,
            "id": 606
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 607
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000109",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000118"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 608
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "KeyInformation",
                "value": "i\\xffb0\\xfffc\\xffbe\\xffe3\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x18\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 609
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 610
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "Index",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 611
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "Index",
                "value": "2"
              }
            ],
            "repeated": 0,
            "id": 612
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "Index",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 613
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000101",
                "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Tahoma"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Tahoma"
              }
            ],
            "repeated": 0,
            "id": 614
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              }
            ],
            "repeated": 0,
            "id": 615
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 616
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 617
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 618
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c41dc2",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x95\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 619
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c41dc2",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x95\\x02\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 620
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Cleaning alternate storage paths...\r\n"
              },
              {
                "name": "Length",
                "value": "58"
              }
            ],
            "repeated": 0,
            "id": 621
          },
          {
            "timestamp": "2026-05-28 22:59:32,832",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c03000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 622
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c70add",
            "parentcaller": "0x00c39ce2",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 0,
            "id": 623
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39eae",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 624
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39eae",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 625
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39eae",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 626
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39eae",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 627
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x05751000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 628
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x05752000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 629
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000009",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager"
              }
            ],
            "repeated": 0,
            "id": 630
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "ResourcePolicies"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies"
              }
            ],
            "repeated": 0,
            "id": 631
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              }
            ],
            "repeated": 0,
            "id": 632
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03bb0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 633
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03bb0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 634
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x05754000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 635
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 636
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              }
            ],
            "repeated": 0,
            "id": 637
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002cc"
              }
            ],
            "repeated": 0,
            "id": 638
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 639
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000118"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\MediaCreationTool_22H2.exe"
              }
            ],
            "repeated": 0,
            "id": 640
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76e4d000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 641
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76e4d000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 642
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 643
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 644
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c46c02",
            "parentcaller": "0x00c3fee9",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~LS"
              }
            ],
            "repeated": 0,
            "id": 645
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "misc",
            "api": "ChangeWindowMessageFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "message",
                "value": "49241"
              },
              {
                "name": "dwFlag",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 646
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 647
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 648
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              }
            ],
            "repeated": 0,
            "id": 649
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 650
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 1,
            "id": 651
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              }
            ],
            "repeated": 0,
            "id": 652
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "synchronization",
            "api": "NtOpenMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              },
              {
                "name": "MutexName",
                "value": "Local\\MSCTF.Asm.MutexDefault1"
              }
            ],
            "repeated": 0,
            "id": 653
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 654
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              },
              {
                "name": "Milliseconds",
                "value": "2000"
              }
            ],
            "repeated": 0,
            "id": 655
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Local\\CTF.AsmListCache.FMPDefault1"
              }
            ],
            "repeated": 0,
            "id": 656
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002b8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x055f0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0579db2c"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 657
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x055f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 658
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 659
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              }
            ],
            "repeated": 1,
            "id": 660
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 661
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c41e15",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xcf\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 662
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 663
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000118"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\MediaCreationTool_22H2.exe"
              }
            ],
            "repeated": 0,
            "id": 664
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 665
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "misc",
            "api": "GetSystemMetrics",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemMetricIndex",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 666
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "synchronization",
            "api": "NtOpenMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              },
              {
                "name": "MutexName",
                "value": "CicLoadWinStaWinSta0"
              }
            ],
            "repeated": 0,
            "id": 667
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              }
            ],
            "repeated": 0,
            "id": 668
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "synchronization",
            "api": "NtOpenMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              },
              {
                "name": "MutexName",
                "value": "Local\\MSCTF.CtfMonitorInstMutexDefault1"
              }
            ],
            "repeated": 0,
            "id": 669
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              }
            ],
            "repeated": 0,
            "id": 670
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c41e15",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xcf\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 671
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 672
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000118"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE"
              }
            ],
            "repeated": 0,
            "id": 673
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002a0"
              },
              {
                "name": "ValueName",
                "value": "LaunchUserOOBE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE"
              }
            ],
            "repeated": 0,
            "id": 674
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              }
            ],
            "repeated": 0,
            "id": 675
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75c98000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 676
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75c98000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 677
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000002b8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 678
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 679
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c41e15",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xcf\\x02\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 680
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Cleaning MoSetup Volatile key...\r\n"
              },
              {
                "name": "Length",
                "value": "55"
              }
            ],
            "repeated": 0,
            "id": 681
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 682
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 683
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 684
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d8"
              }
            ],
            "repeated": 0,
            "id": 685
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d4"
              }
            ],
            "repeated": 1,
            "id": 686
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76eed000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 687
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76eed000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 688
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "EventName",
                "value": "Local\\1ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 0,
            "id": 689
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 690
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "textinputframework.dll"
              }
            ],
            "repeated": 0,
            "id": 691
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\textinputframework.dll"
              }
            ],
            "repeated": 0,
            "id": 692
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\textinputframework.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 693
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002dc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002d8"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\TextInputFramework.dll"
              }
            ],
            "repeated": 0,
            "id": 694
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002dc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fba0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000b9000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 695
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fc4e000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 696
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fc4c000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 697
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fc4c000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 698
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 699
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 700
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fc4c000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 701
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "coreuicomponents.dll"
              }
            ],
            "repeated": 0,
            "id": 702
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "coremessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 703
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002dc"
              }
            ],
            "repeated": 0,
            "id": 704
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d8"
              }
            ],
            "repeated": 0,
            "id": 705
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\coreuicomponents.dll"
              }
            ],
            "repeated": 0,
            "id": 706
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\coreuicomponents.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 707
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002dc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002d8"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\CoreUIComponents.dll"
              }
            ],
            "repeated": 0,
            "id": 708
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002dc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f6a0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0027f000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 709
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f8bb000"
              },
              {
                "name": "ModuleName",
                "value": "coreuicomponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 710
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f80e000"
              },
              {
                "name": "ModuleName",
                "value": "coreuicomponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 711
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f80e000"
              },
              {
                "name": "ModuleName",
                "value": "coreuicomponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 712
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 713
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 714
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f80e000"
              },
              {
                "name": "ModuleName",
                "value": "coreuicomponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 715
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "ntmarta.dll"
              }
            ],
            "repeated": 0,
            "id": 716
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "coremessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 717
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "wintypes.dll"
              }
            ],
            "repeated": 2,
            "id": 718
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002dc"
              }
            ],
            "repeated": 0,
            "id": 719
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d8"
              }
            ],
            "repeated": 0,
            "id": 720
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\coremessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 721
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\coremessaging.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 722
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002dc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002d8"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 723
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002dc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f510000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0009b000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 724
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f594000"
              },
              {
                "name": "ModuleName",
                "value": "coremessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 725
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f576000"
              },
              {
                "name": "ModuleName",
                "value": "coremessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 726
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f576000"
              },
              {
                "name": "ModuleName",
                "value": "coremessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 727
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 728
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 729
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f576000"
              },
              {
                "name": "ModuleName",
                "value": "coremessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 730
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002dc"
              }
            ],
            "repeated": 0,
            "id": 731
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d8"
              }
            ],
            "repeated": 0,
            "id": 732
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ntmarta.dll"
              }
            ],
            "repeated": 0,
            "id": 733
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ntmarta.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 734
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002dc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002d8"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\ntmarta.dll"
              }
            ],
            "repeated": 0,
            "id": 735
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002dc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f4e0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00029000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 736
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c491e3",
            "parentcaller": "0x00c447ed",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 737
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f503000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 738
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 739
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f503000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 740
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 741
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 742
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 743
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f503000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 744
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002dc"
              }
            ],
            "repeated": 0,
            "id": 745
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d8"
              }
            ],
            "repeated": 0,
            "id": 746
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\coremessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 747
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              }
            ],
            "repeated": 0,
            "id": 748
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c41e68",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 749
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 750
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c41e68",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x06\\x03\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 751
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002dc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002d8"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\WinTypes.dll"
              }
            ],
            "repeated": 0,
            "id": 752
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002dc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fac0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000dc000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 753
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fb83000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 754
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fb81000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 755
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fb81000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 756
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 757
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 758
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fb81000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 759
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002dc"
              }
            ],
            "repeated": 0,
            "id": 760
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d8"
              }
            ],
            "repeated": 0,
            "id": 761
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              }
            ],
            "repeated": 1,
            "id": 762
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fc4c000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 763
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f576000"
              },
              {
                "name": "ModuleName",
                "value": "coremessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 764
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f503000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 765
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fb81000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 766
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f80e000"
              },
              {
                "name": "ModuleName",
                "value": "coreuicomponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 767
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\r\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00w\\x00s\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00t\\x00e\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00o\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00s\\x00s\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00g\\x00.\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 768
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ntmarta"
              },
              {
                "name": "DllBase",
                "value": "0x6f4e0000"
              }
            ],
            "repeated": 0,
            "id": 769
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\coremessaging"
              },
              {
                "name": "DllBase",
                "value": "0x6f510000"
              }
            ],
            "repeated": 0,
            "id": 770
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c49c56",
            "parentcaller": "0x00c44713",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 771
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 772
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 773
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 774
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c41ec6",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00I\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 775
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wintypes"
              },
              {
                "name": "DllBase",
                "value": "0x6fac0000"
              }
            ],
            "repeated": 0,
            "id": 776
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c41ec6",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "I\\x03\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 777
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Removing cleanup registry value...\r\n"
              },
              {
                "name": "Length",
                "value": "57"
              }
            ],
            "repeated": 0,
            "id": 778
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\coreuicomponents"
              },
              {
                "name": "DllBase",
                "value": "0x6f6a0000"
              }
            ],
            "repeated": 0,
            "id": 779
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\textinputframework"
              },
              {
                "name": "DllBase",
                "value": "0x6fba0000"
              }
            ],
            "repeated": 0,
            "id": 780
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\ntmarta"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f4e0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6f4e7e90"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 781
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\CoreMessaging"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f510000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6f570f60"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 782
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\WinTypes"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fac0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6fb38ec0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 783
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x05608000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 784
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0560a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 785
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000030c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000009",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager"
              }
            ],
            "repeated": 0,
            "id": 786
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000030c"
              },
              {
                "name": "ValueName",
                "value": "ResourcePolicies"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies"
              }
            ],
            "repeated": 0,
            "id": 787
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              }
            ],
            "repeated": 0,
            "id": 788
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x055f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 789
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x055f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 790
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\CoreUIComponents"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f6a0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6f6feba0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 791
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\TextInputFramework"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fba0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6fbe08c0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 792
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75c98000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 793
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75c98000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 794
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 795
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000318"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000118"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\CTF\\"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\"
              }
            ],
            "repeated": 0,
            "id": 796
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000318"
              },
              {
                "name": "ValueName",
                "value": "EnableAnchorContext"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\CTF\\EnableAnchorContext"
              }
            ],
            "repeated": 0,
            "id": 797
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 798
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 799
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "USER32"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              }
            ],
            "repeated": 0,
            "id": 800
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "1336",
            "caller": "0x00c39f00",
            "parentcaller": "0x00c708db",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 801
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c49c56",
            "parentcaller": "0x00c44713",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 802
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 803
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 804
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 805
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c41f1f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x82\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 806
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c41f1f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x82\\x03\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 807
          },
          {
            "timestamp": "2026-05-28 22:59:32,848",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Flushing MoSetup registry key...\r\n"
              },
              {
                "name": "Length",
                "value": "55"
              }
            ],
            "repeated": 0,
            "id": 808
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c4a0ea",
            "parentcaller": "0x00c461fd",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 809
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 810
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 811
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 812
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c41f77",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xb9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 813
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c41f77",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb9\\x03\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 814
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Cleaning working dir...\r\n"
              },
              {
                "name": "Length",
                "value": "46"
              }
            ],
            "repeated": 0,
            "id": 815
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c10000"
              },
              {
                "name": "RegionSize",
                "value": "0x00014000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 816
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c46c02",
            "parentcaller": "0x00c41fdb",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              }
            ],
            "repeated": 0,
            "id": 817
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 818
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 819
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 820
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c40176",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 821
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c40176",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 822
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Attempting to preserve existing logs...\r\n"
              },
              {
                "name": "Length",
                "value": "62"
              }
            ],
            "repeated": 0,
            "id": 823
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c37000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 824
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c2e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 825
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c2e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 826
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c37000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 827
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c17000"
              },
              {
                "name": "RegionSize",
                "value": "0x0002c000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 828
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c10000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 829
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c10000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 830
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c46c02",
            "parentcaller": "0x00c40180",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther"
              }
            ],
            "repeated": 0,
            "id": 831
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c46c02",
            "parentcaller": "0x00c40180",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Rollback"
              }
            ],
            "repeated": 0,
            "id": 832
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 833
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 834
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 835
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c3fc1f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00%\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 836
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c3fc1f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "%\\x04\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 837
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Nothing to preserve.\r\n"
              },
              {
                "name": "Length",
                "value": "43"
              }
            ],
            "repeated": 0,
            "id": 838
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 839
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000109",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000118"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 840
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000101",
                "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002e0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Segoe UI Light"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI Light"
              }
            ],
            "repeated": 0,
            "id": 841
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c700af",
            "parentcaller": "0x00c6fd17",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 842
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c46c02",
            "parentcaller": "0x00c41fdb",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              }
            ],
            "repeated": 0,
            "id": 843
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 844
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 845
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 846
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c3a011",
            "parentcaller": "0x00c708db",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00c20000"
              }
            ],
            "repeated": 0,
            "id": 847
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c4024c",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00P\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 848
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 849
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "USER32"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              }
            ],
            "repeated": 0,
            "id": 850
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetSystemMetrics"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77604ef0"
              }
            ],
            "repeated": 0,
            "id": 851
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              },
              {
                "name": "FunctionName",
                "value": "MonitorFromWindow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x776096f0"
              }
            ],
            "repeated": 0,
            "id": 852
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              },
              {
                "name": "FunctionName",
                "value": "MonitorFromRect"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x775f92f0"
              }
            ],
            "repeated": 0,
            "id": 853
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              },
              {
                "name": "FunctionName",
                "value": "MonitorFromPoint"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77600be0"
              }
            ],
            "repeated": 0,
            "id": 854
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c4024c",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00P\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 855
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              },
              {
                "name": "FunctionName",
                "value": "EnumDisplayMonitors"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77611a20"
              }
            ],
            "repeated": 0,
            "id": 856
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              },
              {
                "name": "FunctionName",
                "value": "EnumDisplayDevicesW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77610150"
              }
            ],
            "repeated": 0,
            "id": 857
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetMonitorInfoW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77602f50"
              }
            ],
            "repeated": 0,
            "id": 858
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c4024c",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "P\\x04\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 859
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Working path still exists. Cleaning working path: [C:\\$Windows.~WS]...\r\n"
              },
              {
                "name": "Length",
                "value": "93"
              }
            ],
            "repeated": 0,
            "id": 860
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c70aae",
            "parentcaller": "0x00c7404b",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 0,
            "id": 861
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 862
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "1336",
            "caller": "0x00c708db",
            "parentcaller": "0x00c3aeb1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 863
          },
          {
            "timestamp": "2026-05-28 22:59:32,864",
            "thread_id": "5444",
            "caller": "0x00c4ba53",
            "parentcaller": "0x00c3eada",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              }
            ],
            "repeated": 0,
            "id": 864
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4deed",
            "parentcaller": "0x00c4ceea",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000028"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 865
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4df55",
            "parentcaller": "0x00c4ceea",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 866
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4deed",
            "parentcaller": "0x00c4cefc",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000028"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 867
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4df55",
            "parentcaller": "0x00c4cefc",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 868
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a8e4",
            "parentcaller": "0x00c4cd15",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 869
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a8e4",
            "parentcaller": "0x00c4cd15",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              }
            ],
            "repeated": 0,
            "id": 870
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a8e4",
            "parentcaller": "0x00c4cd15",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x03bd8f50",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xa5a9623c"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01dceef5"
              }
            ],
            "repeated": 0,
            "id": 871
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a8e4",
            "parentcaller": "0x00c4cd15",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 872
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a8e4",
            "parentcaller": "0x00c4cd15",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 873
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a90e",
            "parentcaller": "0x00c4cd15",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              }
            ],
            "repeated": 0,
            "id": 874
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a90e",
            "parentcaller": "0x00c4cd15",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x03bd8fd0",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xa5a9623c"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01dceef5"
              }
            ],
            "repeated": 0,
            "id": 875
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a90e",
            "parentcaller": "0x00c4cd15",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 876
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a90e",
            "parentcaller": "0x00c4cd15",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 877
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ab12",
            "parentcaller": "0x00c4cd2a",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 878
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "9",
                "pretty_value": "FileNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00"
              }
            ],
            "repeated": 0,
            "id": 879
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 880
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0030",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH"
              },
              {
                "name": "InputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 881
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 882
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "48",
                "pretty_value": "FileNetworkPhysicalNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00"
              }
            ],
            "repeated": 0,
            "id": 883
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "9",
                "pretty_value": "FileNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00"
              }
            ],
            "repeated": 0,
            "id": 884
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 885
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0030",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH"
              },
              {
                "name": "InputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 886
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 887
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "48",
                "pretty_value": "FileNetworkPhysicalNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00"
              }
            ],
            "repeated": 0,
            "id": 888
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ab42",
            "parentcaller": "0x00c4cd2a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 889
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4c245",
            "parentcaller": "0x00c4c438",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              }
            ],
            "repeated": 0,
            "id": 890
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4c538",
            "parentcaller": "0x00c4cd52",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x03bd8f50",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\*"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xa5a9623c"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01dceef5"
              }
            ],
            "repeated": 0,
            "id": 891
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4c6b0",
            "parentcaller": "0x00c4cd52",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000260"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US"
              }
            ],
            "repeated": 0,
            "id": 892
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4c6b0",
            "parentcaller": "0x00c4cd52",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000260"
              },
              {
                "name": "ValueName",
                "value": "en"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en"
              }
            ],
            "repeated": 0,
            "id": 893
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ab12",
            "parentcaller": "0x00c3e796",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 894
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "9",
                "pretty_value": "FileNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 895
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 896
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0030",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH"
              },
              {
                "name": "InputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 897
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 898
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "48",
                "pretty_value": "FileNetworkPhysicalNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 899
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "9",
                "pretty_value": "FileNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 900
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 901
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0030",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH"
              },
              {
                "name": "InputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00c\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 902
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 903
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "48",
                "pretty_value": "FileNetworkPhysicalNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 904
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ab42",
            "parentcaller": "0x00c3e796",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 905
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ab12",
            "parentcaller": "0x00c3e8bf",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 906
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "9",
                "pretty_value": "FileNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 907
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 908
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0030",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH"
              },
              {
                "name": "InputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00c\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 909
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 910
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "48",
                "pretty_value": "FileNetworkPhysicalNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 911
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "9",
                "pretty_value": "FileNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 912
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 913
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0030",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH"
              },
              {
                "name": "InputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 914
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 915
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "48",
                "pretty_value": "FileNetworkPhysicalNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 916
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ab42",
            "parentcaller": "0x00c3e8bf",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 917
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ab12",
            "parentcaller": "0x00c3e8e4",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 918
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "9",
                "pretty_value": "FileNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00"
              }
            ],
            "repeated": 0,
            "id": 919
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 920
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0030",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH"
              },
              {
                "name": "InputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\xc8}"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 921
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 922
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a99c",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "48",
                "pretty_value": "FileNetworkPhysicalNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00"
              }
            ],
            "repeated": 0,
            "id": 923
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "9",
                "pretty_value": "FileNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00"
              }
            ],
            "repeated": 0,
            "id": 924
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 925
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0030",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH"
              },
              {
                "name": "InputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 926
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 927
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4a9ca",
            "parentcaller": "0x00c4ab23",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "48",
                "pretty_value": "FileNetworkPhysicalNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00"
              }
            ],
            "repeated": 0,
            "id": 928
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ab42",
            "parentcaller": "0x00c3e8e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 929
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4c245",
            "parentcaller": "0x00c4ca5c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              }
            ],
            "repeated": 0,
            "id": 930
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4cae4",
            "parentcaller": "0x00c4c6fd",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 931
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ddfb",
            "parentcaller": "0x00c4cb3b",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "9",
                "pretty_value": "FileNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 932
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ddfb",
            "parentcaller": "0x00c4cb3b",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 933
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ddfb",
            "parentcaller": "0x00c4cb3b",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0030",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH"
              },
              {
                "name": "InputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00c\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 934
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ddfb",
            "parentcaller": "0x00c4cb3b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 935
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ddfb",
            "parentcaller": "0x00c4cb3b",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "48",
                "pretty_value": "FileNetworkPhysicalNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 936
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4de4a",
            "parentcaller": "0x00c4cb3b",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "9",
                "pretty_value": "FileNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 937
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4de4a",
            "parentcaller": "0x00c4cb3b",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 938
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4de4a",
            "parentcaller": "0x00c4cb3b",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0030",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH"
              },
              {
                "name": "InputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 939
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4de4a",
            "parentcaller": "0x00c4cb3b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 940
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4de4a",
            "parentcaller": "0x00c4cb3b",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "48",
                "pretty_value": "FileNetworkPhysicalNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 941
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4cb47",
            "parentcaller": "0x00c4c6fd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 942
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4c245",
            "parentcaller": "0x00c4c438",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              }
            ],
            "repeated": 0,
            "id": 943
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4c538",
            "parentcaller": "0x00c4cbc3",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x03c11978",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\*"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xa5a9623c"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01dceef5"
              }
            ],
            "repeated": 0,
            "id": 944
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4c7fd",
            "parentcaller": "0x00c4cbc3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 945
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4b516",
            "parentcaller": "0x00c4c9d0",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00110180",
                "pretty_value": "FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|DELETE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 946
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ddfb",
            "parentcaller": "0x00c4b564",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "9",
                "pretty_value": "FileNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 947
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ddfb",
            "parentcaller": "0x00c4b564",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 948
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ddfb",
            "parentcaller": "0x00c4b564",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0030",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH"
              },
              {
                "name": "InputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 949
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ddfb",
            "parentcaller": "0x00c4b564",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 950
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ddfb",
            "parentcaller": "0x00c4b564",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "48",
                "pretty_value": "FileNetworkPhysicalNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 951
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4de4a",
            "parentcaller": "0x00c4b564",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "9",
                "pretty_value": "FileNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 952
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4de4a",
            "parentcaller": "0x00c4b564",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 953
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4de4a",
            "parentcaller": "0x00c4b564",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0030",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH"
              },
              {
                "name": "InputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00c\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 954
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4de4a",
            "parentcaller": "0x00c4b564",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 955
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4de4a",
            "parentcaller": "0x00c4b564",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "48",
                "pretty_value": "FileNetworkPhysicalNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 956
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4b5c0",
            "parentcaller": "0x00c4c9d0",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "18",
                "pretty_value": "FileAllInformation"
              },
              {
                "name": "FileInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 957
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4b5d8",
            "parentcaller": "0x00c4c9d0",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "<b\\xa9\\xa5\\xf5\\xee\\xdc\\x01\\xbeR\\xb5\\xa5\\xf5\\xee\\xdc\\x01<b\\xa9\\xa5\\xf5\\xee\\xdc\\x01<b\\xa9\\xa5\\xf5\\xee\\xdc\\x01\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 958
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4b5f8",
            "parentcaller": "0x00c4c9d0",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "<b\\xa9\\xa5\\xf5\\xee\\xdc\\x01\\xbeR\\xb5\\xa5\\xf5\\xee\\xdc\\x01<b\\xa9\\xa5\\xf5\\xee\\xdc\\x01<b\\xa9\\xa5\\xf5\\xee\\xdc\\x01\\x00 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 959
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4b45f",
            "parentcaller": "0x00c4c9d0",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              }
            ],
            "repeated": 0,
            "id": 960
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4b471",
            "parentcaller": "0x00c4c9d0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              },
              {
                "name": "FunctionName",
                "value": "FindFirstFileNameW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x75d534b0"
              }
            ],
            "repeated": 0,
            "id": 961
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4b482",
            "parentcaller": "0x00c4c9d0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              },
              {
                "name": "FunctionName",
                "value": "FindNextFileNameW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x75d53500"
              }
            ],
            "repeated": 0,
            "id": 962
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4b719",
            "parentcaller": "0x00c4c9d0",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "FileInformationClass",
                "value": "13",
                "pretty_value": "FileDispositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01"
              }
            ],
            "repeated": 0,
            "id": 963
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4b8bf",
            "parentcaller": "0x00c4c9d0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 964
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4c7fd",
            "parentcaller": "0x00c4cd52",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 965
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4b516",
            "parentcaller": "0x00c4c9d0",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00110180",
                "pretty_value": "FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|DELETE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 966
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ddfb",
            "parentcaller": "0x00c4b564",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "9",
                "pretty_value": "FileNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00"
              }
            ],
            "repeated": 0,
            "id": 967
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ddfb",
            "parentcaller": "0x00c4b564",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 968
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ddfb",
            "parentcaller": "0x00c4b564",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0030",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH"
              },
              {
                "name": "InputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 969
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ddfb",
            "parentcaller": "0x00c4b564",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 970
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4ddfb",
            "parentcaller": "0x00c4b564",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "48",
                "pretty_value": "FileNetworkPhysicalNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00"
              }
            ],
            "repeated": 0,
            "id": 971
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4de4a",
            "parentcaller": "0x00c4b564",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "9",
                "pretty_value": "FileNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00"
              }
            ],
            "repeated": 0,
            "id": 972
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4de4a",
            "parentcaller": "0x00c4b564",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 973
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4de4a",
            "parentcaller": "0x00c4b564",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0030",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATH"
              },
              {
                "name": "InputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 974
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4de4a",
            "parentcaller": "0x00c4b564",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 975
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4de4a",
            "parentcaller": "0x00c4b564",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "48",
                "pretty_value": "FileNetworkPhysicalNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1a\\x00\\x00\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00"
              }
            ],
            "repeated": 0,
            "id": 976
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4b5c0",
            "parentcaller": "0x00c4c9d0",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "18",
                "pretty_value": "FileAllInformation"
              },
              {
                "name": "FileInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 977
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4b5d8",
            "parentcaller": "0x00c4c9d0",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "<b\\xa9\\xa5\\xf5\\xee\\xdc\\x01\\xbeR\\xb5\\xa5\\xf5\\xee\\xdc\\x01\\xbeR\\xb5\\xa5\\xf5\\xee\\xdc\\x01\\xbeR\\xb5\\xa5\\xf5\\xee\\xdc\\x01\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 978
          },
          {
            "timestamp": "2026-05-28 22:59:32,879",
            "thread_id": "5444",
            "caller": "0x00c4b5f8",
            "parentcaller": "0x00c4c9d0",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "<b\\xa9\\xa5\\xf5\\xee\\xdc\\x01\\xbeR\\xb5\\xa5\\xf5\\xee\\xdc\\x01\\xbeR\\xb5\\xa5\\xf5\\xee\\xdc\\x01\\xbeR\\xb5\\xa5\\xf5\\xee\\xdc\\x01\\x00 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 979
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c4b719",
            "parentcaller": "0x00c4c9d0",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "13",
                "pretty_value": "FileDispositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01"
              }
            ],
            "repeated": 0,
            "id": 980
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c4b8bf",
            "parentcaller": "0x00c4c9d0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 981
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c4deed",
            "parentcaller": "0x00c4cfc4",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000028"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 982
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c4df55",
            "parentcaller": "0x00c4cfc4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 983
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c4deed",
            "parentcaller": "0x00c4cfdc",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000028"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 984
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c4df55",
            "parentcaller": "0x00c4cfdc",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 985
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 986
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 987
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 988
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c42010",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xad\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 989
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c42010",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xad\\x04\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 990
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Creating path (with ACL): [C:\\$Windows.~WS]...\r\n"
              },
              {
                "name": "Length",
                "value": "69"
              }
            ],
            "repeated": 0,
            "id": 991
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c48c1a",
            "parentcaller": "0x00c45df2",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 992
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c48c69",
            "parentcaller": "0x00c45df2",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 993
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c48cdc",
            "parentcaller": "0x00c45df2",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\x96\\xc0\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 994
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c36f6f",
            "parentcaller": "0x00c45df2",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 995
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c44c97",
            "parentcaller": "0x00c45f13",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000028"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 996
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c44c97",
            "parentcaller": "0x00c45f13",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 997
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c44c97",
            "parentcaller": "0x00c45f13",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000028"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 998
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c44c97",
            "parentcaller": "0x00c45f13",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 999
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c46c02",
            "parentcaller": "0x00c4201a",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              }
            ],
            "repeated": 0,
            "id": 1000
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c45fc5",
            "parentcaller": "0x00c4201a",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\$Windows.~WS"
              }
            ],
            "repeated": 0,
            "id": 1001
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c47762",
            "parentcaller": "0x00c47721",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000028"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 1002
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c47762",
            "parentcaller": "0x00c47721",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 1003
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c47762",
            "parentcaller": "0x00c47721",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000028"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 1004
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c47762",
            "parentcaller": "0x00c47721",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 1005
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c42030",
            "parentcaller": "0x00c44024",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100100",
                "pretty_value": "FILE_WRITE_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1006
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c42030",
            "parentcaller": "0x00c44024",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x82 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1007
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c42030",
            "parentcaller": "0x00c44024",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 1008
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c4ba53",
            "parentcaller": "0x00c44024",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              }
            ],
            "repeated": 0,
            "id": 1009
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 1010
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1011
          },
          {
            "timestamp": "2026-05-28 22:59:32,911",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 1012
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c4206f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xf2\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1013
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c4206f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xf2\\x04\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1014
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Creating path: [C:\\$Windows.~WS\\Sources]...\r\n"
              },
              {
                "name": "Length",
                "value": "66"
              }
            ],
            "repeated": 0,
            "id": 1015
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c42079",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              }
            ],
            "repeated": 0,
            "id": 1016
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c6b07b",
            "parentcaller": "0x00c42079",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\$Windows.~WS\\Sources"
              }
            ],
            "repeated": 0,
            "id": 1017
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 1018
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1019
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 1020
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c3b4ea",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x004\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1021
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c3b4ea",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "4\\x05\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1022
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Opening Box: [C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe]\r\n"
              },
              {
                "name": "Length",
                "value": "98"
              }
            ],
            "repeated": 0,
            "id": 1023
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c6b6b0",
            "parentcaller": "0x00c3b4f8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1024
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c7c389",
            "parentcaller": "0x00c6bf66",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1025
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c6bfe3",
            "parentcaller": "0x00c6b713",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\x0e\\x1f\\xba\\x0e\\x00\\xb4\t\\xcd!\\xb8\\x01L\\xcd!This program cannot be run in DOS mode.\r\r\n$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf1L\\x81\\xf6\\xb5-\\xef\\xa5\\xb5-\\xef\\xa5\\xb5-\\xef\\xa5\\xeeE\\xec\\xa4\\xb4-\\xef\\xa5\\xa1F\\xec\\xa4\\xbd-\\xef\\xa5\\xa1F\\xeb\\xa4\\xaf-\\xef\\xa5\\xa1F\\xea\\xa4\\xb9-\\xef\\xa5\\xa1F\\xee\\xa4\\x98-\\xef\\xa5\\xb5-\\xee\\xa5\\xd4/\\xef\\xa5\\xa1F\\xe6\\xa4\\xe9-\\xef\\xa5\\xa1F\\x10\\xa5\\xb4-\\xef\\xa5\\xa1F\\xed\\xa4\\xb4-\\xef\\xa5Rich\\xb5-\\xef\\xa5\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PE\\x00\\x00L\\x01\\x06\\x00\\xb1JJ\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x00\\x02\r"
              },
              {
                "name": "Length",
                "value": "131072"
              }
            ],
            "repeated": 0,
            "id": 1026
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c6bfbb",
            "parentcaller": "0x00c6b713",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x083a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1027
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c6bfbb",
            "parentcaller": "0x00c6b713",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x083a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0007d000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1028
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c6bfe3",
            "parentcaller": "0x00c6b713",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc4\\x10\\x8b\\xcb\\xe8ui\\x00\\x00\\x85\\xf6t\\x07\\x8b\\xce\\xe83g\\x00\\x00\\x8bM\\xe4\\x85\\xc9t\\x05\\xe8'g\\x00\\x00\\x85\\xfft\\x07\\x8b\\xcf\\xe8\\x1cg\\x00\\x00j\\x00\\x8dM\\xd0\\xe8S\\x89\\x00\\x00\\x8dM\\xd8\\xe8\\xeec\\xff\\xff\\x8b\\xc3\\xe8\\x11\"\\x05\\x00\\xc3j\\x14\\xb8u\\G\\x00\\xe8'\"\\x05\\x00\\x8b\\xda3\\xc0\\x89E\\xe0\\x89E\\xe4\\x89E\\xe8\\x8b\\xf0\\x89E\\xfc\\x89u\\xf0\\xc6E\\xfc\\x01\\x85\\xc9u\t\\xb9W\\x00\\x07\\x80\\x8b\\xf9\\xebT\\x85\\xdbt\\xf3\\x8dU\\xe0\\xe8\\xdaJ\\x00\\x00\\x8b\\xf8\\x85\\xffx@\\x8dE\\xf0P\\x8dU\\xec\\x8dM\\xe0\\xe8QM\\x00\\x00\\x8b\\xf8\\x85\\xffy\\x0c\\x8b\\xcf\\xe8\\xc1h\\x00\\x00\\x8bu\\xf0\\xeb&\\x8bU\\xec\\x8bu\\xf0\\x83\\xfa\\x01u\\x03R\\xeb\\x02j\\x00SQ\\x8b\\xce\\xe8\\xc7\\xc4\\x02\\x00\\x8b\\xf8\\x85\\xffy\\x07\\x8b\\xcf\\xe8\\x96h\\x00\\x00\\x8b\\xcf\\xe8\\xa7h\\x00\\x00\\x85\\xf6t\\x10Vj\\x00\\xff\\x150\\xd3G\\x00P\\xff\\x15@\\xd3G\\x00j\\x00\\x8dM\\xe0\\xe8\\x93\\x88\\x00\\x00\\x8dM\\xe8\\xe8.c\\xff\\xff\\x8b\\xc7\\xe8"
              },
              {
                "name": "Length",
                "value": "375296"
              }
            ],
            "repeated": 0,
            "id": 1029
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c6bfbb",
            "parentcaller": "0x00c6b713",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x084a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00b12000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1030
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c6bfbb",
            "parentcaller": "0x00c6b713",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x084a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000d000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1031
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c6bfbb",
            "parentcaller": "0x00c6b713",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08fb1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1032
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c6bfe3",
            "parentcaller": "0x00c6b713",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x01\\x00\\x08\\x00\\xe86\\x00\\x80X\\x00\\x00\\x80\\x02\\x00\\x00\\x00\\x80\\x00\\x00\\x80\\x03\\x00\\x00\\x00 \\x01\\x00\\x80\\x05\\x00\\x00\\x00\\x00\\x02\\x00\\x80\\x06\\x00\\x00\\x008\\x02\\x00\\x80\n\\x00\\x00\\x00\\x88\\x02\\x00\\x80\\x0e\\x00\\x00\\x00\\xa0\\x02\\x00\\x80\\x10\\x00\\x00\\x00\\xc0\\x02\\x00\\x80\\x18\\x00\\x00\\x00\\xd8\\x02\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x03\\x00,N\\x00\\x00\\xf0\\x02\\x00\\x80-N\\x00\\x00\\x08\\x03\\x00\\x80.N\\x00\\x00 \\x03\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\xd2\\x07\\x00\\x008\\x03\\x00\\x80\\xd3\\x07\\x00\\x00P\\x03\\x00\\x80\\xd4\\x07\\x00\\x00h\\x03\\x00\\x80\\xd5\\x07\\x00\\x00\\x80\\x03\\x00\\x80\\xd6\\x07\\x00\\x00\\x98\\x03\\x00\\x80\\xd7\\x07\\x00\\x00\\xb0\\x03\\x00\\x80\\xd8\\x07\\x00\\x00\\xc8\\x03\\x00\\x80\\xd9\\x07\\x00\\x00\\xe0\\x03\\x00\\x80\\xda\\x07\\x00\\x00\\xf8\\x03\\x00\\x80\\xdb\\x07\\x00\\x00\\x10\\x04\\x00\\x80\\xdc\\x07\\x00\\x00(\\x04\\x00\\x80\\xdd\\x07\\x00\\x00@\\x04\\x00\\x80\\xde\\x07\\x00\\x00X\\x04\\x00\\x80\\xdf\\x07\\x00\\x00p\\x04\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "11042360"
              }
            ],
            "repeated": 0,
            "id": 1033
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c6c0af",
            "parentcaller": "0x00c6b713",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x084a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00b12000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1034
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 1035
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1036
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 1037
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c3b52e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x96\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1038
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c3b52e",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x96\\x05\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1039
          },
          {
            "timestamp": "2026-05-28 22:59:32,926",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Reading Box header...\r\n"
              },
              {
                "name": "Length",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 1040
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 1041
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1042
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 1043
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c3b607",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc2\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1044
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c3b607",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc2\\x05\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1045
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Opening Box container: [0]...\r\n"
              },
              {
                "name": "Length",
                "value": "52"
              }
            ],
            "repeated": 0,
            "id": 1046
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c6b85a",
            "parentcaller": "0x00c3b617",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000002e0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000320"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1047
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c7c389",
            "parentcaller": "0x00c6c54a",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000320"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "88\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1048
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c6c5f5",
            "parentcaller": "0x00c6b891",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000320"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x02\\x00\\xc5\\xb0\\x91\\x84\\x06V\\x1br\\xe2M\\x91\\xb4V\\x96)v<\\xb3\\x01\\x00\\x00\\x00|\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "124"
              }
            ],
            "repeated": 0,
            "id": 1049
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 1050
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1051
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 1052
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c3b645",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xf6\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1053
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c3b645",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xf6\\x05\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1054
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Verifying Box container: [0]...\r\n"
              },
              {
                "name": "Length",
                "value": "54"
              }
            ],
            "repeated": 0,
            "id": 1055
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c6ba04",
            "parentcaller": "0x00c3b652",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x084a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00a0f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1056
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c6ba04",
            "parentcaller": "0x00c3b652",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x084a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000d000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1057
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c6ba04",
            "parentcaller": "0x00c3b652",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08eae000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1058
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c6b65a",
            "parentcaller": "0x00c6ba1a",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000001e8"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\KsecDD"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390400"
              },
              {
                "name": "InputBuffer",
                "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xff\\x07\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00S\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00\\x01\\x01"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00A\\x002\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffS\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1059
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c6b65a",
            "parentcaller": "0x00c6ba1a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\bcryptprimitives.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x76ba0000"
              }
            ],
            "repeated": 0,
            "id": 1060
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c6b65a",
            "parentcaller": "0x00c6ba1a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76ba0000"
              },
              {
                "name": "FunctionName",
                "value": "GetHashInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76bb5880"
              }
            ],
            "repeated": 0,
            "id": 1061
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c7c389",
            "parentcaller": "0x00c6ba45",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000320"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "88\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1062
          },
          {
            "timestamp": "2026-05-28 22:59:32,942",
            "thread_id": "5444",
            "caller": "0x00c6ba9e",
            "parentcaller": "0x00c3b652",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000320"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x02\\x00\\xc5\\xb0\\x91\\x84\\x06V\\x1br\\xe2M\\x91\\xb4V\\x96)v<\\xb3\\x01\\x00\\x00\\x00|\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00|\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9d\\xa2x\\x00\\x00\\x00\\x00\\x00b\\x00o\\x00x\\x00t\\x00o\\x00o\\x00l\\x00_\\x00g\\x00e\\x00n\\x00e\\x00r\\x00a\\x00t\\x00e\\x00d\\x000\\x001\\x00.\\x00c\\x00a\\x00b\\x00\\x00\\x00MSCF\\x00\\x00\\x00\\x00\\x9d\\xa2x\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x01\\x01\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\x02\\x00\\x00\\x14\\x04\\x01\\x00@\\xe3\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00HQ\\xe0\\x04  DU.dll\\x00`\\x15\\x0e\\x00@\\xe3\\x01\\x00\\x00\\x00,Q\\x94\\x9a  DiagTrack.dll\\x00\\xc04\\x01\\x00\\xa0\\xf8\\x0f\\x00\\x00\\x00,Q\\x95\\x9a  DiagTrackRunner.exe"
              },
              {
                "name": "Length",
                "value": "7906073"
              }
            ],
            "repeated": 0,
            "id": 1063
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6bb82",
            "parentcaller": "0x00c3b652",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x084a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00a0f000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1064
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 1065
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1066
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 1067
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c3b680",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00,\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1068
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c3b680",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": ",\\x06\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1069
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Reading Box container header: [0]...\r\n"
              },
              {
                "name": "Length",
                "value": "59"
              }
            ],
            "repeated": 0,
            "id": 1070
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 1071
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1072
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 1073
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c3b6bb",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00g\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1074
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c3b6bb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "g\\x06\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1075
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:32: Extracting Box container: [0]...\r\n"
              },
              {
                "name": "Length",
                "value": "55"
              }
            ],
            "repeated": 0,
            "id": 1076
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6c6db",
            "parentcaller": "0x00c6bd23",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1077
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6c6db",
            "parentcaller": "0x00c6bd23",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              }
            ],
            "repeated": 0,
            "id": 1078
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6c6db",
            "parentcaller": "0x00c6bd23",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x03be9c38",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x12e743ac"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01dceef4"
              }
            ],
            "repeated": 0,
            "id": 1079
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6c6db",
            "parentcaller": "0x00c6bd23",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000324"
              }
            ],
            "repeated": 0,
            "id": 1080
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6c6db",
            "parentcaller": "0x00c6bd23",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1081
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cc73",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1082
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c7c389",
            "parentcaller": "0x00c6ccac",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb48\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1083
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cc73",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1084
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c7c389",
            "parentcaller": "0x00c6ccac",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb48\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1085
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "MSCF\\x00\\x00\\x00\\x00\\x9d\\xa2x\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x01\\x01\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "36"
              }
            ],
            "repeated": 0,
            "id": 1086
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd88\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1087
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xe08\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 2,
            "id": 1088
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "@\\xe3\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00HQ\\xe0\\x04  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1089
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xf08\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1090
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "DU.dll\\x00`\\x15\\x0e\\x00@\\xe3\\x01\\x00\\x00\\x00,Q\\x94\\x9a  DiagTrack.dll\\x00\\xc04\\x01\\x00\\xa0\\xf8\\x0f\\x00\\x00\\x00,Q\\x95\\x9a  DiagTrackRunner.exe\\x00@\\xa3\\x00\\x00`-\\x11\\x00\\x00\\x00HQu\\x02  Diager.dll\\x00\\xd4(\\x00\\x00\\xa0\\xd0\\x11\\x00\\x00\\x00AQ\\xf5\\x89  setupplatform.cfg\\x00H\\xe9m\\x00t\\xf9\\x11\\x00\\x00\\x00HQ|\\x02  setupplatform.dll\\x00@\\xc1\\x0c\\x00\\xbc\\xe2\\x7f\\x00\\x00\\x00HQ\\x81\\x02  unbcl.dll\\x00\\xc8\\xcd\\x03\\x00\\xfc\\xa3\\x8c\\x00\\x00\\x00HQ\\\\x04  wdsclientapi.dll\\x008\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4  wdscore.dll\\x00H"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1091
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xf78\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1092
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1093
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\DU.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1094
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DU.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "@\\xe3\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1095
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DU.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "@\\xe3\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1096
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DU.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "@\\xe3\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1097
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DU.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1098
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd88\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1099
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x99\\x02\\x00\\x00\\x14\\x04\\x01\\x00"
              },
              {
                "name": "Length",
                "value": "8"
              }
            ],
            "repeated": 0,
            "id": 1100
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "M;\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1101
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x16\\xc9m\\xf3Q#\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9049"
              }
            ],
            "repeated": 0,
            "id": 1102
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DU.dll"
              },
              {
                "name": "Buffer",
                "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x00\\x00\\x00\\x0e\\x1f\\xba\\x0e\\x00\\xb4\t\\xcd!\\xb8\\x01L\\xcd!This program cannot be run in DOS mode.\r\r\n$\\x00\\x00\\x00\\x00\\x00\\x00\\x003\\x05\\x13#wd}pwd}pwd}pc\\x0f~qud}pc\\x0fyqfd}pwd|p\\xc8d}pc\\x0f|qbd}pc\\x0fxq\\x7fd}pc\\x0f}qvd}pc\\x0ftqld}pc\\x0f\\x82pvd}pc\\x0f\\x7fqvd}pRichwd}p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PE\\x00\\x00L\\x01\\x06\\x00"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1103
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x13Jc\\xef\\xef4\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13559"
              }
            ],
            "repeated": 0,
            "id": 1104
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DU.dll"
              },
              {
                "name": "Buffer",
                "value": "c$02\\x00\\x00\\x00\\x00 \\x00\\x00\\x006,=P\"\\x99>\\x0c\\x1df\\xa9\\xec\\xe8\\xcf\\x9b\\xd9c\\xc6B\\xb7L\\x0f\\xd7\\x1fO\\x8d#\\xd6\\xf0u\\xed\\xc4\\x00\\x00\\x00\\x00\\xb9T\\xa0\\x01\\x10\\xe8\\x97\\x06\\x00\\x00h\\xd0{\\x01\\x10\\xe8$\\xe3\\x00\\x00Y\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xb9\\x0c\\xa0\\x01\\x10\\xe8w\\x06\\x00\\x00h\\xe0{\\x01\\x10\\xe8\\x04\\xe3\\x00\\x00Y\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xb90\\xa0\\x01\\x10\\xe8W\\x06\\x00\\x00h\\xf0{\\x01\\x10\\xe8\\xe4\\xe2\\x00\\x00Y\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcch\\x00|\\x01\\x10\\xe8\\xce\\xe2\\x00\\x00Y\\xc3\\xcc\\xcc\\xcc\\xcch0|\\x01\\x10\\xe8\\xbe\\xe2\\x00\\x00Y\\xc3\\xcc\\xcc\\xcc\\xcch`|\\x01\\x10\\xe8\\xae\\xe2\\x00\\x00Y\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffVW\\xbe\\xd8\\x1b\\x00\\x10\\xbf\\x10\\x90\\x01\\x10\\xa5\\xa5\\xa5\\xa5\\xbe\\xe8\\x1b\\x00\\x10\\xbf$\\x90\\x01\\x10\\xa5\\xa5\\xa5\\xa5\\xbe\\xf8\\x1b\\x00\\x10\\xbf8\\x90\\x01\\x10\\xa5\\xa5\\xa5\\xa5\\xbe\\x08"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1105
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "3\\x87\\x85\\xae\\xb2?\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16314"
              }
            ],
            "repeated": 0,
            "id": 1106
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DU.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x03\\xe8\\xfc\\x86\\xff\\xff\\x83\\xc4\\x10P\\xff\\x15P\\xb1\\x01\\x10\\xc6E\\xfc\\x00\\x8bE\\xe0\\x85\\xc0t\\x10\\x8b\\x08P\\x8bq\\x08\\x8b\\xce\\xff\\x15\\x0c\\xb2\\x01\\x10\\xff\\xd6\\x83M\\xfc\\xff\\x8bE\\xdc\\x85\\xc0\\x0f\\x84\\xa1\\x06\\x00\\x00\\x8b\\x08P\\x8bq\\x08\\xe9\\x8c\\x06\\x00\\x00\\x8b]\\xd0\\x83\\xc8\\xfff9E\\xf0u\\x0b3\\xc0@\\x89E\\xc83\\xc0\\x89E\\xbc\\xc6E\\xfc\\x00\\x8bE\\xe0\\x85\\xc0t\\x10\\x8b\\x08P\\x8bq\\x08\\x8b\\xce\\xff\\x15\\x0c\\xb2\\x01\\x10\\xff\\xd6\\x83\\xc8\\xff\\x89E\\xfc\\x8bE\\xdc\\x85\\xc0t\\x10\\x8b\\x08P\\x8bq\\x08\\x8b\\xce\\xff\\x15\\x0c\\xb2\\x01\\x10\\xff\\xd6\\x83e\\xcc\\x00\\x89}\\xfc\\x8dU\\xcc\\x8bC\\x10RP\\x8b\\x08\\x8bq$\\x8b\\xce\\xff\\x15\\x0c\\xb2\\x01\\x10\\xff\\xd6\\x8b\\xd8\\x85\\xdby7j\\x00j\\x00\\xff\\x158\\xb0\\x01\\x10P\\xff\\x15X\\xb1\\x01\\x10P\\xbf\\x0cv\\x00\\x10Wh(s\\x00\\x10h\\x8a\\x01\\x00\\x00j\\x00h8 \\x00\\x10h\\x00\\x00\\x05\\x00SWh\\xecv\\x00\\x10\\xebR\\x8bE\\xcc\\x8dU\\xc0RP\\x8b\\x08\\x8bq(\\x8b\\xce\\xff\\x15"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1107
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd8\\x807\\\\x10H\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18456"
              }
            ],
            "repeated": 0,
            "id": 1108
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DU.dll"
              },
              {
                "name": "Buffer",
                "value": "uffer\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0u\\xed\\xc4\\x00\\x00\\x00\\x00\\xde\\x8c\\x01\\x00\\x01\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x0f\\x00\\x00\\x00H\\x8c\\x01\\x00\\x84\\x8c\\x01\\x00\\xc0\\x8c\\x01\\x00\\xf0\\x91\\x00\\x00\\xd0\\x91\\x00\\x00P\\x91\\x00\\x00P\\x91\\x00\\x00\\x90\\x91\\x00\\x00p\\x91\\x00\\x00@\\x91\\x00\\x00@\\x91\\x00\\x00\\x90\\x91\\x00\\x00p\\x91\\x00\\x00\\xc0\\x94\\x00\\x00\\x10\\x94\\x00\\x00 \\x93\\x00\\x00\\x80\\x97\\x00\\x00@\\x95\\x00\\x00\\xe5\\x8c\\x01\\x00\\x16\\x8d\\x01\\x00E\\x8d\\x01\\x00p\\x8d\\x01\\x00\\x99\\x8d\\x01\\x00\\xbe\\x8d\\x01\\x00\\xe1\\x8d\\x01\\x00\n\\x8e\\x01\\x001\\x8e\\x01\\x00T\\x8e\\x01\\x00u\\x8e\\x01\\x00~\\x8e\\x01\\x00\\x89\\x8e\\x01\\x00\\x92\\x8e\\x01\\x00\\x9d\\x8e\\x01\\x00\\x00\\x00\\x01\\x00\\x02\\x00\\x03\\x00\\x04\\x00\\x05\\x00\\x06\\x00\\x07\\x00\\x08\\x00\t\\x00\n\\x00\\x0b\\x00\\x0c\\x00\r\\x00\\x0e\\x00du.dll\\x00??4ClientApplicationInfo@DU"
              },
              {
                "name": "Length",
                "value": "25408"
              }
            ],
            "repeated": 0,
            "id": 1109
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DU.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00B7\\x16F\\x9d\\xd6\\x01\\x00B7\\x16F\\x9d\\xd6\\x01\\x00B7\\x16F\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1110
          },
          {
            "timestamp": "2026-05-28 22:59:32,957",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1111
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "`\\x15\\x0e\\x00@\\xe3\\x01\\x00\\x00\\x00,Q\\x94\\x9a  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1112
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x079\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1113
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "DiagTrack.dll\\x00\\xc04\\x01\\x00\\xa0\\xf8\\x0f\\x00\\x00\\x00,Q\\x95\\x9a  DiagTrackRunner.exe\\x00@\\xa3\\x00\\x00`-\\x11\\x00\\x00\\x00HQu\\x02  Diager.dll\\x00\\xd4(\\x00\\x00\\xa0\\xd0\\x11\\x00\\x00\\x00AQ\\xf5\\x89  setupplatform.cfg\\x00H\\xe9m\\x00t\\xf9\\x11\\x00\\x00\\x00HQ|\\x02  setupplatform.dll\\x00@\\xc1\\x0c\\x00\\xbc\\xe2\\x7f\\x00\\x00\\x00HQ\\x81\\x02  unbcl.dll\\x00\\xc8\\xcd\\x03\\x00\\xfc\\xa3\\x8c\\x00\\x00\\x00HQ\\\\x04  wdsclientapi.dll\\x008\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4  wdscore.dll\\x00H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02  wdscsl.d"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1114
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x159\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1115
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1116
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1117
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "`\\x15\\x0e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1118
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "`\\x15\\x0e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1119
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "`\\x15\\x0e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1120
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1121
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x00\\x00\\x00\\x0e\\x1f\\xba\\x0e\\x00\\xb4\t\\xcd!\\xb8\\x01L\\xcd!This program cannot be run in DOS mode.\r\r\n$\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\xb7\\x83\\xc2&\\xd6\\xed\\x91&\\xd6\\xed\\x91&\\xd6\\xed\\x91\\x92J\\x1c\\x91*\\xd6\\xed\\x91&\\xd6\\xec\\x91\\xb2\\xd7\\xed\\x91\\x92J\\x02\\x91\\x07\\xd6\\xed\\x91\\x92J\\x1e\\x91(\\xd6\\xed\\x91\\x92J\\x1f\\x91(\\xd6\\xed\\x91\\x92J\\x03\\x91'\\xd6\\xed\\x91\\x92J\\x1a\\x91\\xb1\\xd6\\xed\\x91\\x92J\\x00\\x91'\\xd6\\xed\\x91\\x92J\\x1d\\x91'\\xd6\\xed\\x91Rich&\\xd6\\xed\\x91\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PE\\x00\\x00L\\x01\\x06\\x00"
              },
              {
                "name": "Length",
                "value": "7360"
              }
            ],
            "repeated": 0,
            "id": 1122
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x90\\xf7 \\xda\\xb3\"\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8891"
              }
            ],
            "repeated": 0,
            "id": 1123
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "I\\x00n\\x00f\\x00o\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00_\\x00I\\x00n\\x00v\\x00a\\x00l\\x00i\\x00d\\x00_\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00_\\x00_\\x00D\\x00E\\x00P\\x00R\\x00E\\x00C\\x00A\\x00T\\x00E\\x00D\\x00_\\x00I\\x00n\\x00f\\x00o\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00_\\x00N\\x00o\\x00S\\x00u\\x00c\\x00h\\x00P\\x00r\\x00o\\x00p\\x00e\\x00r\\x00t\\x00y\\x00_\\x000\\x00\\x00\\x00\\x00\\x00I\\x00n\\x00f\\x00o\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00_\\x00N\\x00o\\x00t\\x00I\\x00m\\x00p\\x00l\\x00e\\x00m\\x00e\\x00n\\x00t\\x00e\\x00d\\x00_\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00I\\x00n\\x00f\\x00o\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00_\\x00P\\x00r\\x00o\\x00c\\x00e\\x00s\\x00s\\x00C\\x00r\\x00e\\x00a\\x00t\\x00e\\x00S\\x00c\\x00r\\x00i\\x00p\\x00t\\x00F\\x00a\\x00"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1124
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x0ei\\xa7\\xa4\\xab\\x1d\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "7603"
              }
            ],
            "repeated": 0,
            "id": 1125
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "U\\x00r\\x00l\\x00\\x00\\x00M\\x00a\\x00x\\x00B\\x00a\\x00c\\x00k\\x00o\\x00f\\x00f\\x00A\\x00t\\x00t\\x00e\\x00m\\x00p\\x00t\\x00s\\x00\\x00\\x00\\x00\\x00I\\x00n\\x00i\\x00t\\x00i\\x00a\\x00l\\x00B\\x00a\\x00c\\x00k\\x00o\\x00f\\x00f\\x00S\\x00e\\x00c\\x00o\\x00n\\x00d\\x00s\\x00\\x00\\x00B\\x00a\\x00c\\x00k\\x00o\\x00f\\x00f\\x00M\\x00u\\x00l\\x00t\\x00F\\x00a\\x00c\\x00t\\x00o\\x00r\\x00\\x00\\x00S\\x00k\\x00i\\x00p\\x00U\\x00p\\x00l\\x00o\\x00a\\x00d\\x00O\\x00n\\x00N\\x00o\\x00B\\x00a\\x00c\\x00k\\x00o\\x00f\\x00f\\x00P\\x00e\\x00r\\x00c\\x00e\\x00n\\x00t\\x00a\\x00g\\x00e\\x00\\x00\\x00R\\x00a\\x00n\\x00d\\x00o\\x00m\\x00i\\x00z\\x00e\\x00d\\x00B\\x00a\\x00c\\x00k\\x00o\\x00f\\x00f\\x00P\\x00e\\x00r\\x00c\\x00e\\x00n\\x00t\\x00a\\x00g\\x00e\\x00\\x00\\x00A\\x00s\\x00i\\x00m\\x00"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1126
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": ":)-\\x85g2\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "12911"
              }
            ],
            "repeated": 0,
            "id": 1127
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "CDEF\\x00\\x00\\x00\\x00%.17g\\x00\\x00\\x00true\\x00\\x00\\x00\\x00false\\x00\\x00\\x00null\\x00\\x00\\x00\\x00\"Custom#%u\"\\x00[\\x00E\\x00R\\x00R\\x00O\\x00R\\x00:\\x00E\\x00v\\x00e\\x00n\\x00t\\x00H\\x00e\\x00a\\x00d\\x00e\\x00r\\x00.\\x00F\\x00l\\x00a\\x00g\\x00s\\x00=\\x00%\\x00x\\x00]\\x00\\x00\\x00\\x00\\x00t\\x00a\\x00s\\x00k\\x00\\x00\\x00\\x00\\x00a\\x00c\\x00t\\x00i\\x00v\\x00i\\x00t\\x00y\\x00\\x00\\x00\\x00\\x00r\\x00e\\x00l\\x00a\\x00t\\x00e\\x00d\\x00A\\x00c\\x00t\\x00i\\x00v\\x00i\\x00t\\x00y\\x00\\x00\\x00o\\x00p\\x00c\\x00o\\x00d\\x00e\\x00\\x00\\x00\\x00\\x00k\\x00e\\x00y\\x00w\\x00o\\x00r\\x00d\\x00\\x00\\x00[\\x00E\\x00R\\x00R\\x00O\\x00R\\x00:\\x00B\\x00a\\x00d\\x00S\\x00i\\x00d\\x00L\\x00e\\x00n\\x00g\\x00t\\x00h\\x00=\\x00%\\x00u\\x00]\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1128
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xb77S\\xf3)D\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17457"
              }
            ],
            "repeated": 0,
            "id": 1129
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x03\\x00\\x00\\x84\\xc0t\\x1c\\x83~\\x14\\x10r\\x04\\x8b\\x06\\xeb\\x02\\x8b\\xc6\\xffu\\x0c+\\xd8\\x8b\\xceSV\\xe8\\xd6\\x01\\x00\\x00\\xebCW\\x8b}\\x0c\\x8b\\xcej\\x00W\\xe8@\\x00\\x00\\x00\\x84\\xc0t.\\x83~\\x14\\x10r\\x04\\x8b\\x06\\xeb\\x02\\x8b\\xc6\\x85\\xfft\\x0bWSP\\xe8)%\t\\x00\\x83\\xc4\\x0c\\x83~\\x14\\x10\\x89~\\x10r\\x04\\x8b\\x06\\xeb\\x02\\x8b\\xc6\\xc6\\x048\\x00\\x8b\\xc6_^[]\\xc2\\x08\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xecV\\x8bu\\x08\\x83\\xfe\\xfewM9q\\x14s\\x0b\\xffq\\x10V\\xe8\\x01\\x02\\x00\\x00\\xeb0\\x80}\\x0c\\x00t\\x18\\x83\\xfe\\x10s\\x13\\x8bA\\x10;\\xf0s\\x02\\x8b\\xc6Pj\\x01\\xe8\\xda\\xfc\\xff\\xff\\xeb\\x12\\x85\\xf6u\\x0e!q\\x10\\x83y\\x14\\x10r\\x02\\x8b\t\\xc6\\x01\\x003\\xc0;\\xc6^\\x1b\\xc0\\xf7\\xd8]\\xc2\\x08\\x00\\xe8\\xc1\\xfe\\xff\\xff\\xcc\\xcc\\xcc\\xcc\\xcc\\xccj\\x10\\xb8e\\xd8\n\\x10\\xe8\\x0e$\t\\x00\\x8b\\xf1\\x89u\\xe8\\x8b}\\x08\\x83\\xcf\\x07\\x81\\xff\\xfe\\xff\\xff\\x7fv\\x05\\x8b}\\x08\\xeb)3\\xd2\\xc7E\\xec"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1130
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x91\\x8f\\xdbTlE\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17780"
              }
            ],
            "repeated": 0,
            "id": 1131
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\xfe\\xff\\xffj\\x04_\\x89E\\xc49=P\\xb4\\x0c\\x10v2Vh\\x00\\x00\\x01\\x00\\x8b\\xcb\\xe8\\x02q\\xff\\xff\\x84\\xc0t!\\x8dE\\xc4\\x89u\\xec\\x89E\\xe8\\x89}\\xf0\\x89u\\xf4\\x8dE\\xc8\\xba\\xd8_\\x01\\x10Pj\\x03QQ\\xe8\\xd6o\\xff\\xff\\x8bM\\xfc_^3\\xcd[\\xe8\\x00\\xa0\\x08\\x00\\x8b\\xe5]\\xc2\\x08\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xec\\x83\\xe4\\xf8\\x83\\xec\\x10\\x83$$\\x00\\x8d\\x04$VW\\x8dT$\\x0c\\x89D$\\x0c\\x8dL$\\x10\\xe8m\\x0f\\x00\\x00\\xe8\\x13\\xf7\\xff\\xff\\x84\\xc0u\n\\xc7D$\\x08\\xb7\\x00\\x00\\x00\\xebs\\xb1\\x01\\xe8t\\xf9\\xff\\xff\\x85\\xc0xh\\xbf\\x90\\xc0\\x0c\\x10\\x8b\\xcf\\xe8\\xc1\\x87\\xff\\xff\\x89D$\\x08\\x85\\xc0y\rPh\\xa0W\\x00\\x10\\xba\\x90\\x02\\x00\\x00\\xeb?\\xa1\\xc0\\xbf\\x0c\\x10\\xbe\\xa0W\\x00\\x10\\x85\\xc0t\\x1bj\\xffP\\xff\\x15\\xd4\\xd2\\x0c\\x10\\x85\\xc0t\\x0e\\x8bM\\x04\\xba;\\x01\\x00\\x00V\\xe8\\xc9\\xdd\\xff\\xff\\x8b\\xcf\\xe8\\x02\\x93\\xff\\xff\\x89D$\\x08\\x85\\xc0y\\x0fPV\\xba\\x99\\x02\\x00\\x00\\x8bM"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1132
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "}\\x9c:\\x1e\\xc4B\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17100"
              }
            ],
            "repeated": 0,
            "id": 1133
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x8b\\xcb\\xe8\\x99\\xfa\\xff\\xff\\xe9M\\x02\\x00\\x00;\\x8b\\xd4\\x01\\x00\\x00u@\\x8b\r$\\xc1\\x0c\\x10\\xe8\\x9c\\xbd\\x00\\x00\\x8b\\xcb\\xe8\\xc7\\xf9\\xff\\xff\\x8b58\\xc1\\x0c\\x10\\x8b\\xce\\x8b=(\\xc1\\x0c\\x10\\xe8\\xc8\\xe3\\xff\\xff\\x0f\\xb6\\xc0\\x8b\\xceP\\xe8\\x9c\\x86\\x00\\x00\\x0f\\xb6\\xc0\\x8b\\xcfP\\xe8)\\xce\\x00\\x00\\xe9\\x05\\x02\\x00\\x00\\x8b\\x83\\xd8\\x01\\x00\\x00\\x85\\xc0t\\x04;\\xc8t\\x0e\\x8b\\x93\\xdc\\x01\\x00\\x00\\x85\\xd2te;\\xcaua\\x85\\xc0t\\x08;\\xc8u\\x043\\xf6\\xeb\\x033\\xf6F\\x8b\r\\xd0\\xc0\\x0c\\x10V\\xe8\\xe8\\xd5\\x00\\x00\\x84\\xc0t\\x10\\xb1\\x03\\xe8\\xaf*\\xff\\xffj\\x00\\x8b\\xcb\\xe8\\x01\\xfa\\xff\\xffj\\x01j\\x01j\\x00\\x8b\\xcb\\xe8\\x9b3\\x00\\x00\\x85\\xf6u\\x08\\x8b\\x83H\\x01\\x00\\x00\\xeb\\x06\\x8b\\x83P\\x01\\x00\\x00\\x8b\r8\\xc1\\x0c\\x10j\\x01P\\xe8\\xcf\\xd3\\xff\\xff\\xe9\\x88\\x01\\x00\\x00\\x8b\\x83\\xe0\\x01\\x00\\x00\\x85\\xc0t\\x08;\\xc8\\x0f\\x84v\\x01\\x00\\x00\\x8b\\x83\\xe4\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84E\\x01\\x00\\x00;\\xc8\\x0f\\x85=\\x01\\x00\\x00j\\x01\\x8d\\x85X\\xff"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1134
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xe8c}\\xa7\\xd5G\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18397"
              }
            ],
            "repeated": 0,
            "id": 1135
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x0c\\xeb\\x023\\xf6\\x897\\x8b\\xc7_^[\\x8b\\xe5]\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xec\\x8b\\xc13\\xc9\\xf7\\xe2V\\x8b\\xf0;\\xd1w\\x0er\\x05\\x83\\xfe\\xffw\\x07\\x8bE\\x08\\x890\\xeb\\x0b\\x8bE\\x08\\xb9\\x16\\x02\\x07\\x80\\x83\\x08\\xff\\x8b\\xc1^]\\xc2\\x04\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\x83y\\x14\\x08r\\x02\\x8b\tj\\x00j\\x00Q\\xff\\x15\\\\xd4\\x0c\\x10\\x83\\xc4\\x0c\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xec\\x83y\\x14\\x08r\\x02\\x8b\tR\\x8b\\xd1\\xb9\\xa0[\\x00\\x10\\xe8\\xcc\\xd2\\xfe\\xff\\x85\\xc0x\\x04\\xb0\\x01]\\xc3=\\x02\\x00\\x07\\x80u\\x042\\xc0]\\xc3\\x8b\\xc8\\xe8\\x8c\\xe0\\xfe\\xff\\x8bM\\x04\\xba\\xe6\\x06\\x00\\x00Ph\\xa0S\\x00\\x10\\xe8\\x81\\xe0\\xfe\\xff\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffVW\\x8b93\\xf6\\x8dW\\x04\\x8b\\x02\\x8b\\xc8\\x0b\\xce\\xf0\\x0f\\xb1\nu\\xf6\\x8b\\xf0\\xff\\x15 \\xd3\\x0c\\x10;\\xf0t\\x07W\\xff\\x15\\xfc\\xd1\\x0c\\x10_^\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xec\\xffu\\x0cj\\x00\\xffu\\x04QQ\\xffu\\x08\\xe8`\\xcd\\xfe\\xff]\\xc2"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1136
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\xf1En\\x91E\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17817"
              }
            ],
            "repeated": 0,
            "id": 1137
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xff\\xff\\xe8\\xe7\\xa7\\xfe\\xff\\x8b\\xf0\\x85\\xf6\\x0f\\x88\\xc4\\x00\\x00\\x00j\\xffj\\x10\\x8d\\x85d\\xfe\\xff\\xffP\\x8d\\x8dp\\xff\\xff\\xff\\xe82=\\xfe\\xff\\x8d\\x95d\\xfe\\xff\\xff\\xc6E\\xfc\\x14\\x8d\\x8d\\x1c\\xfd\\xff\\xff\\xe8\\x08\\x17\\x00\\x00P\\x8d\\x85|\\xfe\\xff\\xff\\xc6E\\xfc\\x15P\\x8dKl\\xe8F\\x19\\x00\\x00P\\x83\\xc0\\x10PQ\\x8d\\x85\\x0c\\xfd\\xff\\xffP\\x8dKl\\xe8\\x13\\x9a\\xff\\xff\\xc6E\\xfc\\x14\\x8b\\x8d \\xfd\\xff\\xff\\x85\\xc9t\\x05\\xe812\\xfe\\xff3\\xc0\\xc6E\\xfc\\x11P@\\x8d\\x8dd\\xfe\\xff\\xffP\\xe8\\xb9\\xfe\\xfd\\xff\\x85\\xf6xE\\x8d\\x85@\\xff\\xff\\xffP\\x8d\\x8d\\xf0\\xfc\\xff\\xff\\xe8_;\\xfe\\xff\\x8d\\x85p\\xff\\xff\\xff\\xc6E\\xfc\\x16P\\x8dKd\\xe8n#\\x00\\x00\\x8d\\x8d\\xf0\\xfc\\xff\\xffQ\\x8b\\xc8\\xe8\\x8fZ\\xfe\\xff\\x8d\\x8d\\xf0\\xfc\\xff\\xff3\\xc0P@P\\xe8r\\xfe\\xfd\\xff\\xeb8\\x83\\xec\\x18\\x8d\\x85@\\xff\\xff\\xff\\x8b\\xcc\\x89\\xa5\\xb4\\xfd\\xff\\xffP\\xe8\\x15;\\xfe\\xff\\x83\\xec\\x18\\xc6E\\xfc\\x17\\x8d\\x85p\\xff\\xff\\xff\\x8b\\xccP\\xe8\\x00;"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1138
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "av]\\xca\\xb6C\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17342"
              }
            ],
            "repeated": 0,
            "id": 1139
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xbe\\x90\\x04\\x07\\x80\\xe9\\x1d\\x03\\x00\\x00\\x8aE\\x97\\x8d\\x8dt\\xff\\xff\\xff\\x88\\x85H\\xff\\xff\\xff\\x8bE\\x88\\x89\\x85L\\xff\\xff\\xff\\x8bE\\x90\\x89\\x85P\\xff\\xff\\xff\\x8dE\\x98P\\xe8\\x87\\x16\\x00\\x00\\x8d\\x8dH\\xff\\xff\\xffQ\\x8b\\xc8\\xe8|\\x17\\x00\\x00j\\x00j\\x01\\x8dM\\x98\\xc6E\\xfc\\x02\\xe8\\xf3~\\xfd\\xff\\x8b\\x8dt\\xff\\xff\\xff\\x8b?\\x89M\\x88\\xe9H\\xff\\xff\\xff\\x8b\\x01\\xbb4?\\x00\\x10\\x89\\x85d\\xff\\xff\\xff;\\xc1\\x0f\\x849\\x02\\x00\\x00\\x8dx\\x10W\\x8dM\\xc8\\xe8~\\xbb\\xfd\\xff\\x8dG\\x18\\xc6E\\xfc\\x04P\\x8dM\\xe0\\xe8\\x80\\x1b\\x00\\x00\\x83}\\xdc\\x08\\x8bE\\xc8s\\x03\\x8dE\\xc8j\\x00h\\x80\\x00\\x00\\x00j\\x03j\\x00j\\x05h\\x00\\x00\\x00\\x80P\\xff\\x15\\xc0\\xd1\\x0c\\x10\\x89\\x85T\\xff\\xff\\xff\\x89]\\x80\\x89E\\x84\\x83\\xf8\\xff\\xc6E\\xfc\\x06\\x0f\\x95\\xc1\\x84\\xc9\\x0f\\x94\\xc0\\x84\\xc0t+\\xe8\\xf4\\xf8\\xfe\\xff\\x8dM\\x80\\x89]\\x80\\x8b\\xf0\\xe8`M\\xfe\\xff\\x8dM\\xe0\\xe8\\xdd\\x96\\xfd\\xffj\\x00j\\x01\\x8dM\\xc8\\xe8H~\\xfd\\xff\\xe9%"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1140
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xee\\x14\\xcd\"c@\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16491"
              }
            ],
            "repeated": 0,
            "id": 1141
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "D\\xc6E\\xfc.P\\x8d\\x85\\xec\\xfa\\xff\\xff\\x8b\\xceP\\x8d\\x85\\x1c\\xfb\\xff\\xffP\\xe8x\\xbf\\x05\\x003\\xdb\\x8d\\x8d\\x1c\\xfb\\xff\\xffj\\x00CS\\xe8\\x1a\\xff\\xfc\\xffj\\x00S\\x8d\\x8d\\xec\\xfa\\xff\\xff\\xc6E\\xfc*\\xe8\\x08\\xff\\xfc\\xffh\\xd0\\x9e\\x00\\x10\\x8d\\x8d\\x8c\\xfa\\xff\\xff\\xe8\\xca\\xfb\\xfc\\xffh0U\\x00\\x10\\x8d\\x8d\\xbc\\xfa\\xff\\xff\\xc6E\\xfc/\\xe8\\xb6\\xfb\\xfc\\xff\\x8dG\\\\xc6E\\xfc0P\\x8d\\x85\\x8c\\xfa\\xff\\xff\\x8b\\xceP\\x8d\\x85\\xbc\\xfa\\xff\\xffP\\xe8\\x14\\xbf\\x05\\x00j\\x00S\\x8d\\x8d\\xbc\\xfa\\xff\\xff\\xe8\\xb9\\xfe\\xfc\\xffj\\x00S\\x8d\\x8d\\x8c\\xfa\\xff\\xff\\xe8\\xab\\xfe\\xfc\\xff\\x83\\xa5\\xa4\\xfe\\xff\\xff\\x003\\xc0\\xc7\\x85\\xa8\\xfe\\xff\\xff\\x07\\x00\\x00\\x00f\\x89\\x85\\x94\\xfe\\xff\\xffh\\xf0\\x9e\\x00\\x10\\x8d\\x8d\\x14\\xfa\\xff\\xff\\xc6E\\xfc1\\xe8O\\xfb\\xfc\\xffh0U\\x00\\x10\\x8d\\x8dD\\xfa\\xff\\xff\\xc6E\\xfc2\\xe8;\\xfb\\xfc\\xff\\x8d\\x85\\x94\\xfe\\xff\\xff\\xc6E\\xfc3P\\x8d\\x85\\x14\\xfa\\xff\\xff\\x8b\\xceP\\x8d\\x85D\\xfa\\xff\\xffP\\xe8\\x96\\xbe\\x05\\x00;\\xc3\\x0f"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1142
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "w\\xad4\\xb0\\xddF\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18149"
              }
            ],
            "repeated": 0,
            "id": 1143
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x8c$P\\x01\\x00\\x00\\xe8\\xda\\xba\\xff\\xff\\x8dL$\\x1f\\xc6\\x84$\\xd8\\x01\\x00\\x00\\x07Qj\\x00\\x8d\\x8c$\\x94\\x00\\x00\\x00Qj\\x01\\xff\\xb4$<\\x01\\x00\\x00\\x8d\\x8c$0\\x01\\x00\\x00QP\\xff\\xb4$\\x1c\\x01\\x00\\x00\\x8b\\xcb\\xe8\\x1c\\x06\\x00\\x00i\\xf0\\xe8\\x03\\x00\\x00\\x8d\\x8c$L\\x01\\x00\\x00j\\x00j\\x01\\xc6\\x84$\\xe0\\x01\\x00\\x00\\x06\\x89t$(\\xe8\\xe2~\\xfc\\xff\\x85\\xf6u?\\x8b\\x83\\x8c\\x16\\x00\\x00\\x83L$ \\xff\\x83\\xc0\\x08P\\xc6D$\\x1a\\x01\\xc6D$\\x18\\x00\\xff\\x15\\xac\\xd1\\x0c\\x10\\x8b\r,\\xc1\\x0c\\x10\\xe8Q\\xd1\\xfe\\xff\\x8b\r\\x04\\xc1\\x0c\\x10\\x8d\\x84$\\xfc\\x00\\x00\\x00P\\xe8\\x13\\xe1\\xff\\xff\\xeb\\x07\\xc6\\x05Q\\xc1\\x0c\\x10\\x00\\x80|$\\x1f\\x00t\\x14QQ\\x8b\r\\x04\\xc1\\x0c\\x10\\xe8\\xe6\\xe1\\xff\\xff\\xeb\\x05\\xc6D$\\x14\\x00\\x8d\\x8c$\\x1c\\x01\\x00\\x00\\xc6\\x84$\\xd8\\x01\\x00\\x00\\x02\\xe8\\xf2\\x96\\xfc\\xffj\\x00j\\x01\\x8d\\x8c$\\x0c\\x01\\x00\\x00\\xe8\\x98|\\xfc\\xff\\x80|$\\x13\\x00\\x0f\\x84\\x87\\x01\\x00\\x00\\x83|$<\\x01\\x0f\\x84|"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1144
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x1eUN\\x1a\\xdfI\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18919"
              }
            ],
            "repeated": 0,
            "id": 1145
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "t.;9u\\x1f\\xffu\\x14\\x8dE\\xe8QWj\\x01P\\x8b\\xcb\\xe8\\xc2\\x05\\x00\\x00\\x8b\\x08\\x8bE\\x08\\x89\\x08\\xc6@\\x04\\x01\\xebI\\x8dM\\xec\\xe8\\xa3i\\xfd\\xff\\x8bu\\xec\\xffu\\x10\\x8dF\\x10P\\xe8\\x9e\\xfc\\xff\\xff\\xffu\\x14\\x84\\xc0t\\x1bQW\\xffu\\xe8\\x8dE\\xec\\xeb\\xc3\\xffu\\x14\\xe88f\\xfd\\xffj\\x00j\\x00\\xe8\\xd4#\\x05\\x00\\xff\\x15\\x04\\xd5\\x0c\\x10\\x8bE\\x08Y\\x890\\xc6@\\x04\\x00\\xe8\\xca#\\x05\\x00\\xc2\\x10\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xecV\\xe8\\xf6q\\xfe\\xff\\x8b\\xf0\\x8dF\\x10f\\xc7F\\x0c\\x00\\x00\\x85\\xc0t\\x12\\x8bM\\x08\\xffu\\x0c\\x8a\t\\x88\\x08\\x8dH\\x04\\xe8\\x18I\\xfd\\xff\\x8b\\xc6^]\\xc2\\x08\\x00\\xcc\\xcc\\xcc\\xcc\\xccj\\x0c\\xb8\\xa1E\\x0b\\x10\\xe82$\\x05\\x00\\x8b\\xd9\\x83e\\xfc\\x00\\xb1\\x01\\x8b\\x13\\x8b\\xfa\\x88M\\xe8\\x8bB\\x04\\x80x\r\\x00u!\\x8bM\\x10\\x8a):h\\x10\\x8b\\xf8\\x0f\\x92\\xc1\\x88M\\xe8\\x84\\xc9t\\x04\\x8b\\x00\\xeb\\x03\\x8b@\\x08\\x80x\r\\x00t\\xe4\\x8b\\xf7\\x89u\\xec\\x84\\xc9t"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1146
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xb2\\x0c\\x1f\\x8cUG\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18269"
              }
            ],
            "repeated": 0,
            "id": 1147
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x89\\x9d(\\xfd\\xff\\xff\\x89\\x85\\x0c\\xfe\\xff\\xff\\x83x\\x14\\x08\\x8bH\\x10r\\x02\\x8b\\x00P\\x8d\\x04\tPh\\xf7\\x00\\x00\\x00\\x8d\\x85$\\xfd\\xff\\xffP\\x8d\\x85\\xb4\\xfc\\xff\\xffPS\\x8d\\x85,\\xfc\\xff\\xffP\\x8dO\\x08\\xe8R*\\x03\\x00\\x8b\\x85\\x0c\\xfe\\xff\\xff\\x83\\xc0\\x18\\x83\\xad \\xfe\\xff\\xff\\x01\\x89\\x85\\x0c\\xfe\\xff\\xffu\\xb5\\x8b\\xb54\\xfe\\xff\\xffh\\x10\\xa5\\x01\\x10j\\x02j\\x18\\x8dE\\xb8\\xc6E\\xfc\\x02P\\xe8\\xf1\\x9f\\x04\\x00\\x8b\\x07\\x8a^\\x01\\x8a>\\x8bp4\\x8b\\xce\\xff\\x15\\\\xd5\\x0c\\x10\\x8b\\xcf\\xff\\xd6\\xf6\\xd8\\x1a\\xc03\\xf6\\xfe\\xc0\\x02\\xc0\n\\xc3\\x02\\xc0\n\\xc7\\x8b\\x9d4\\xfe\\xff\\xff\\x88\\x85/\\xfe\\xff\\xff\\x8dSd\\x8b\\x02\\x8b\\xc8\\x0b\\xce\\xf0\\x0f\\xb1\nu\\xf6\\x8b\\xc8\\x0f\\xb6\\x85/\\xfe\\xff\\xff\\x99\\x8b\\xf0\\xc7\\x85\\xe4\\xfc\\xff\\xff$\\xba\\x00\\x10\\x8b\\xfa\\x0f\\xb6\\xc1\\x8b\\x8d\\x10\\xfe\\xff\\xff\\x0f\\xa4\\xf7\\x08\\x99\\xc1\\xe6\\x08\\x0b\\xfa\\x0b\\xf0\\xc7\\x85\\xe8\\xfc\\xff\\xff\\x05\\x00\\x00\\x00\\x0f\\xb6C\\x02\\x8dI\\x08\\x99\\x0f\\xa4\\xf7\\x08\\xc1\\xe6\\x08\\x0b\\xfa\\x0b\\xf0\\x89"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1148
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "l\\xd9\\xb9r\\x03;\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15115"
              }
            ],
            "repeated": 0,
            "id": 1149
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "2\\xfb\\xff\\xe8b$\\x04\\x00\\xc2\\x08\\x00\\x8bE\\xa4\\x8bM\\xa0\\x83\\xc0\\x18P\\xe8\\x97\\x01\\x00\\x00\\xe84_\\xfb\\xff\\x8bM\\x04\\xba\\xd2\\x02\\x00\\x00Ph`\\xce\\x00\\x10\\xe8\\xd0\\x98\\xfb\\xff\\xb8\\xc3\\xa8\\x06\\x10\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffV\\x8b\\xf1\\xffv0\\xff\\x15\\xdc\\xd4\\x0c\\x10Y\\x8b\\xce^\\xe9m\\x19\\x00\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xec\\x83\\xe4\\xf8j\\xffh!_\\x0b\\x10d\\xa1\\x00\\x00\\x00\\x00P\\x83\\xec0\\xa1\\x00\\xb0\\x0c\\x103\\xc4\\x89D$(SVW\\xa1\\x00\\xb0\\x0c\\x103\\xc4P\\x8dD$@d\\xa3\\x00\\x00\\x00\\x00\\x89L$\\x14\\x8b}\\x08\\x8dD$$\\x8b\r\\xe0\\xc0\\x0c\\x10j\\x01\\xff7P\\xe8\"!\\xfc\\xff\\x8b\r\\xe0\\xc0\\x0c\\x10\\xdd\\x810\\x01\\x00\\x00\\xdcD$$\\xdc\\x1d\\xa0N\\x01\\x10\\xdf\\xe0\\xf6\\xc4Azh\\xff7\\xe8g2\\xfc\\xff\\x84\\xc0u]\\x8b?\\x8b\\x1d\\xe0\\xc0\\x0c\\x10\\x8b\\x07\\x8bpX\\x8b\\xce\\xff\\x15\\\\xd5\\x0c\\x10\\x8b\\xcf\\xff\\xd6P\\x8b\\xcb\\xe8O\\x84\\xfc\\xff\\x84\\xc0t8\\x8b\r\\xe0\\xc0\\x0c\\x10"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1150
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd7\\xf37\\x11\\x05K\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "19213"
              }
            ],
            "repeated": 0,
            "id": 1151
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xe8\\x91#\\x00\\x00\\x8b\\x85\\x14\\xff\\xff\\xffj\\x08[9\\x9d(\\xff\\xff\\xffs\\x06\\x8d\\x85\\x14\\xff\\xff\\xff\\xff\\xb5$\\xff\\xff\\xff\\x8d\\x8dD\\xff\\xff\\xffP\\xe8\\x05\\xb7\\xfa\\xff\\x8bE\\x8c9]\\xa0s\\x03\\x8dE\\x8c\\xffu\\x9c\\x8d\\x8dD\\xff\\xff\\xffP\\xe8\\xeb\\xb6\\xfa\\xffj!\\x8d\\x8dD\\xff\\xff\\xff\\xe8\\xc4\\xdd\\xff\\xff\\x8b\\x85,\\xff\\xff\\xff9\\x9d@\\xff\\xff\\xffs\\x06\\x8d\\x85,\\xff\\xff\\xff\\xff\\xb5<\\xff\\xff\\xff\\x8d\\x8dD\\xff\\xff\\xffP\\xe8\\xb8\\xb6\\xfa\\xff\\x8bE\\xd49]\\xe8s\\x03\\x8dE\\xd4\\xffu\\xe4\\x8d\\x8d\\xc0\\xfe\\xff\\xffP\\xe8\\x9e\\xb6\\xfa\\xffj!\\x8d\\x8d\\xc0\\xfe\\xff\\xff\\xe8w\\xdd\\xff\\xff\\x8b\\x85h\\xff\\xff\\xff9\\x9d|\\xff\\xff\\xffs\\x06\\x8d\\x85h\\xff\\xff\\xff\\xff\\xb5x\\xff\\xff\\xff\\x8d\\x8d\\xc0\\xfe\\xff\\xffP\\xe8k\\xb6\\xfa\\xffj\\x00j\\x01\\x8dM\\xd4\\xe9\n\\x01\\x00\\x003\\xf6F\\x89p03\\xc0\\x83e\\xcc\\x00j\\x07Y\\x89M\\xd0f\\x89E\\xbc!E\\xe4\\x89M\\xe8f\\x89E\\xd4\\x83\\xec\\x18\\xc6E\\xfc\r\\x8b\\xccS\\xe8"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1152
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "zzv\\xe0\\x98:\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15008"
              }
            ],
            "repeated": 0,
            "id": 1153
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x8b\\xfa\\xe8\\xf9\\xf8\\xf9\\xffPS\\x8b\\xcf\\xe8O\\xfc\\xf9\\xff\\x83\\xfe\\x01u\n\\xbeH\\xe1\\x00\\x10\\xe9\\x82\\x00\\x00\\x00\\x83\\xfe\\x02u\\x07\\xbeP\\xe1\\x00\\x10\\xebv\\x83\\xfe\\x03u\\x07\\xbeX\\xe1\\x00\\x10\\xebj\\x83\\xfe\\x04u\\x07\\xbe\\\\xe1\\x00\\x10\\xeb^\\x83\\xfe\\x05u\\x07\\xbe`\\xe1\\x00\\x10\\xebR\\x83\\xfe\\x06u\\x07\\xbeh\\xe1\\x00\\x10\\xebF\\x83\\xfe\\x07u\\x07\\xbe\\xfc\\xe1\\x00\\x10\\xeb:\\x83\\xfe\\x08u\\x07\\xbe\\x08\\xe2\\x00\\x10\\xeb.\\x83\\xfe\tu\\x07\\xbe\\x1c\\xe2\\x00\\x10\\xeb\"\\x83\\xfe\nu\\x07\\xbe(\\xe2\\x00\\x10\\xeb\\x16\\x83\\xfe\\x0bu\\x07\\xbe8\\xe2\\x00\\x10\\xeb\n\\x83\\xfe\\x0cu\\x19\\xbeH\\xe2\\x00\\x10\\x8b\\xce\\xe8X\\xf8\\xf9\\xffPV\\x8b\\xcf\\xe8\\xae\\xfb\\xf9\\xff3\\xc0\\xeb\\x17\\x8bM\\x04\\xba\\xdd\\x01\\x00\\x00h\\x90\\x04\\x00\\x00h\\xa0S\\x00\\x10\\xe8\\xc9M\\xfa\\xff_^[Y]\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xecSVW\\x8b\\xf1\\x8b\\xfaj\\x08[9^\\x14r\\x04\\x8b\\x06\\xeb\\x02\\x8b\\xc6hp\\xe1\\x00\\x10P\\xff\\x15\\xcc\\xd4\\x0c\\x10YY\\x85"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1154
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "6\\xc5&\\xd9\\xff;\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15367"
              }
            ],
            "repeated": 0,
            "id": 1155
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x1e\\x8b\\x9d|\\xff\\xff\\xff\\x8b\\xcb\\xe8t7\\x02\\x00\\x8b\\xf0\\x85\\xf6\\x0f\\x89\\xf5\\xfe\\xff\\xff\\xba\\xe4\\x00\\x00\\x00\\xebV\\x8bu\\x88\\x85\\xf6tE\\x83}\\xe8\\x08\\x8bE\\xd4s\\x03\\x8dE\\xd4\\x8b\\x8d|\\xff\\xff\\xffPh\\x9c\\xd3\\x00\\x10h\\xa0\\x0f\\x00\\x00\\x8d\\x85p\\xff\\xff\\xffP\\xe8\\xb8'\\xfc\\xffQQ\\x8b\\xd4\\x8b\\x08h\\xbc\\x02\\x00\\x00V\\x89\n\\x8b@\\x04\\x89B\\x04\\xe8TF\\x02\\x00\\x83\\xc4\\x1c\\xbeJ\\x06\\x07\\x80\\xba\\xee\\x00\\x00\\x00\\x8bM\\x04Vh\\xb0\\xed\\x00\\x10\\xe8\\xa0\\xc4\\xf9\\xffWj\\x01\\x8dM\\xd4\\xe8\\xb8~\\xf9\\xff\\x8b\\xc6\\xe9\\xdc\\x00\\x00\\x00y\\x0c\\x81\\xfer\\x02\\x07\\x80t\\x043\\xc0\\xeb\\x02\\xb0\\x01\\x84\\xc0\\x0f\\x94\\xc0\\x84\\xc0t\\x19\\x85\\xf6y\\xdc\\xba\\xf2\\x00\\x00\\x00\\x8bM\\x04Vh\\xb0\\xed\\x00\\x10\\xe8^\\xc4\\xf9\\xff\\xeb\\xc7\\x8b\\x8dt\\xff\\xff\\xff\\x8bE\\x80\\x8b}\\x88\\x85\\xc9u)\\x85\\xc0u%\\xeb\\x19\\x8b\\xcb\\xe8\\x9e6\\x02\\x00\\x8b\\xf0\\x85\\xf6y\\x07\\xba\\xf6\\x00\\x00\\x00\\xeb\\xc6\\x8bE\\x80\\x8b\\xc8\\x8bU\\x84\\xc6\\x82\\x88\\x00\\x00\\x00\\x01"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1156
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x03f\\xf7\\xcc\\x1f<\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15399"
              }
            ],
            "repeated": 0,
            "id": 1157
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x03\\xa8\\xfb\\xffQQ\\x8b\\xd4\\x8b\\x08h\\xbc\\x02\\x00\\x00W\\x89\n\\x8b@\\x04\\x89B\\x04\\xe8\\x9f\\xc6\\x01\\x00\\x83\\xc4\\x14\\xba\\xa2\\x00\\x00\\x00\\x8bM\\x04\\xbfJ\\x06\\x07\\x80WhH\\x11\\x01\\x10\\xe8\\xebD\\xf9\\xff\\xe9c\\xff\\xff\\xff\\x83\\xff\\x01v@\\x8b\\xbd@\\xff\\xff\\xff\\x85\\xfft/h\\xee\\x0f\\x00\\x00\\x8d\\x854\\xff\\xff\\xff\\x8b\\xcbP\\xe8\\xa8\\xa7\\xfb\\xffQQ\\x8b\\xd4\\x8b\\x08h\\xbc\\x02\\x00\\x00W\\x89\n\\x8b@\\x04\\x89B\\x04\\xe8D\\xc6\\x01\\x00\\x83\\xc4\\x14\\xba\\xab\\x00\\x00\\x00\\xeb\\xa33\\xc0\\xeb*\\xe8\\xc8^\\xf9\\xff\\x8bM\\x04\\xba\\xb0\\x00\\x00\\x00PhH\\x11\\x01\\x10\\x89\\x85@\\xff\\xff\\xff\\xe8\\x15_\\xf9\\xff\\xb8j\\xa9\\x08\\x10\\xc3\\x8b\\x85@\\xff\\xff\\xff\\xe8\\xb5#\\x02\\x00\\xc2\\x08\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xccjD\\xb8$z\\x0b\\x10\\xe8\\xea#\\x02\\x00\\x8b\\xf1\\x8b}\\x08\\x8dM\\xcc3\\xdb\\x89]\\xb0\\xe8\\xe8.\\xf9\\xff\\x8dE\\xb4\\x89]\\xfcP\\x8b\\xce\\xe8\\xd4K\\xfc\\xff\\xc6E\\xfc\\x01\\x83x\\x14\\x08\\x8bH\\x10r\\x02\\x8b\\x00hP\\xed\\x00\\x10"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1158
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x08\\xc9\\x01\\xefKB\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16979"
              }
            ],
            "repeated": 0,
            "id": 1159
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "L\\xa0\\x01\\x00\\x8b\\xe5]\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xccjD\\xb8$z\\x0b\\x10\\xe8\\x9a\\xa4\\x01\\x00\\x8b\\xf1\\x8b}\\x08\\x8dM\\xcc\\x83e\\xb0\\x00\\xe8\\x99\\xaf\\xf8\\xff\\x83e\\xfc\\x00\\x8dE\\xb4P\\x8b\\xce\\xe8\\x84\\xcc\\xfb\\xff\\xc6E\\xfc\\x01\\x83x\\x14\\x08\\x8bH\\x10r\\x02\\x8b\\x00\\xbbP\\xed\\x00\\x10SQP\\x8dM\\xcc\\xe8\\xd9\\xb6\\xf8\\xff\\x8b\\xc8\\xe8>\\xb7\\xf8\\xffj\\x00j\\x01\\x8dM\\xb4\\xc6E\\xfc\\x00\\xe8\\xd4~\\xf8\\xffh\\xb8$\\x01\\x10\\x8dM\\xcc\\xe8!\\xb7\\xf8\\xffS\\x8dFXPh\\xe8$\\x01\\x10\\x8dM\\xcc\\xe8\\x0f\\xb7\\xf8\\xff\\x8b\\xc8\\xe8y\\xb6\\xf8\\xff\\x8b\\xc8\\xe8\\x01\\xb7\\xf8\\xffS\\x8dFpPh\\xfc$\\x01\\x10\\x8dM\\xcc\\xe8\\xef\\xb6\\xf8\\xff\\x8b\\xc8\\xe8Y\\xb6\\xf8\\xff\\x8b\\xc8\\xe8\\xe1\\xb6\\xf8\\xff\\x8dE\\xcc\\x8b\\xcfP\\xe8\\xba\\xbe\\xf8\\xffj\\x00j\\x01\\x8dM\\xcc\\xe8p~\\xf8\\xff\\x8b\\xc7\\xe8y\\xa3\\x01\\x00\\xc2\\x04\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\xa1\\xd8\\xc1\\x0c\\x10\\xb9\\xd8\\xc1\\x0c\\x10\\xffp\\x04\\xe8\\xbb\\x00\\x00\\x00\\xa1\\xd8\\xc1\\x0c\\x10\\x89@\\x04\\xa1"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1160
          },
          {
            "timestamp": "2026-05-28 22:59:32,973",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x95\\xc5T\\x86\\xf5B\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17149"
              }
            ],
            "repeated": 0,
            "id": 1161
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "]\\x0c\\x0f\\x8e\\x8b\\x00\\x00\\x00\\x8b\\x8f\\xb4\\x16\\x00\\x00\\x0f\\xb6\\x83\\x848\\x01\\x10\\x83\\xf9\r~T\\x0f\\xb7\\xb4\\x87v\n\\x00\\x00\\x8bW\\x14f\\x8b\\xc6f\\xd3\\xe0f\t\\x87\\xb0\\x16\\x00\\x00\\x8bO\\x08\\x8a\\x87\\xb0\\x16\\x00\\x00\\x88\\x04\n\\xffG\\x14\\x8bW\\x14\\x8bO\\x08\\x8a\\x87\\xb1\\x16\\x00\\x00\\x88\\x04\n\\xb1\\x10*\\x8f\\xb4\\x16\\x00\\x00\\xffG\\x14f\\xd3\\xee\\x83\\x87\\xb4\\x16\\x00\\x00\\xf3f\\x89\\xb7\\xb0\\x16\\x00\\x00\\xeb\\x1bf\\x8b\\x84\\x87v\n\\x00\\x00f\\xd3\\xe0f\t\\x87\\xb0\\x16\\x00\\x00\\x8dA\\x03\\x89\\x87\\xb4\\x16\\x00\\x00C;]\\x0c\\x0f\\x8cu\\xff\\xff\\xff\\x8bE\\xfc\\x8d\\x97\\x8c\\x00\\x00\\x00H\\x8b\\xcfP\\xe8\\x9f\\xf8\\xff\\xff\\x8bE\\x08\\x8d\\x97\\x80\t\\x00\\x00H\\x8b\\xcfP\\xe8\\x8d\\xf8\\xff\\xff_^[\\x8b\\xe5]\\xc2\\x08\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xecSW\\x8b\\xf9\\x8b\\xda\\x8b\\x8f\\xb4\\x16\\x00\\x00\\x83\\xf9\r~Q\\x8bW\\x08V\\x8bu\\x0cf\\x8b\\xc6f\\xd3\\xe0f\t\\x87\\xb0\\x16\\x00\\x00\\x8bO\\x14\\x8a\\x87\\xb0\\x16\\x00\\x00\\x88\\x04\n\\xffG\\x14\\x8b"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1162
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc0YS1\\xdbG\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18403"
              }
            ],
            "repeated": 0,
            "id": 1163
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "x\r\\x00t\\x04\\x8b\\xf9\\xeb\n\\x8bU\\x0c\\x8bz\\x08;\\xd3ut\\x80\\x7f\r\\x00\\x8bs\\x04u\\x03\\x89w\\x04\\x8bU\\xfc\\x8b\\x029X\\x04u\\x05\\x89x\\x04\\xeb\\x0b9\\x1eu\\x04\\x89>\\xeb\\x03\\x89~\\x08\\x8b\\x029\\x18u\\x1e\\x80\\x7f\r\\x00t\\x04\\x8b\\xc6\\xeb\\x10\\x8b\\x0f\\x8b\\xc7\\xeb\\x04\\x8b\\xc1\\x8b\\x08\\x80y\r\\x00t\\xf6\\x8b\n\\x89\\x01\\x8b\\x029X\\x08u\\x7f\\x80\\x7f\r\\x00t\\x04\\x8b\\xc6\\xeb\\x12\\x8bO\\x08\\x8b\\xc7\\xeb\\x05\\x8b\\xc1\\x8bH\\x08\\x80y\r\\x00t\\xf5\\x8b\n\\x89A\\x08\\xeb\\\\x89Q\\x04\\x8b\\x03\\x89\\x02;S\\x08u\\x04\\x8b\\xf2\\xeb\\x1a\\x80\\x7f\r\\x00\\x8br\\x04u\\x03\\x89w\\x04\\x89>\\x8bC\\x08\\x89B\\x08\\x8bC\\x08\\x89P\\x04\\x8bM\\xfc\\x8b\\x019X\\x04u\\x05\\x89P\\x04\\xeb\\x0e\\x8bC\\x049\\x18u\\x04\\x89\\x10\\xeb\\x03\\x89P\\x08\\x8bC\\x04\\x89B\\x04\\x8aJ\\x0c\\x8aC\\x0c\\x88B\\x0c\\x8bU\\xfc\\x88K\\x0c\\x80{\\x0c\\x01\\x0f\\x85\\x0b\\x01\\x00\\x00\\xe9\\xbf\\x00\\x00\\x00\\x80\\x7f\\x0c\\x01\\x0f\\x85\\xf8\\x00\\x00\\x00\\x8b\\x0e;\\xf9"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1164
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "8\\x94\\xe2a\\xf8;\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15360"
              }
            ],
            "repeated": 0,
            "id": 1165
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\xf1\\x83\\xea\\x01t8\\x83\\xea\\x01t,\\x83\\xea\\x01t\\x1d\\x83\\xea\\x01u.\\x8bE\\x08\\x0bE\\x0ct&\\xffu\\x0c\\xffu\\x08R\\xff6\\xe8\\x85+\\x00\\x00\\xeb\\x06\\x8b\\x06\\x0f\\xafE\\x08\\x89\\x06\\xeb\\x0c\\x8bE\\x08)\\x06\\xeb\\x05\\x8bE\\x08\\x01\\x06^]\\xc2\\x08\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xecV\\x8b\\xf1\\x83\\xea\\x01tM\\x83\\xea\\x01t;\\x83\\xea\\x01t\\x1f\\x83\\xea\\x01uI\\x8bE\\x08\\x0bE\\x0ctA\\xffu\\x0c\\xffu\\x08\\xffv\\x04\\xff6\\xe8\\x0f-\\x00\\x00\\xeb\\x10\\xffu\\x0c\\xffu\\x08\\xffv\\x04\\xff6\\xe8\\xcd+\\x00\\x00\\x89\\x06\\x89V\\x04\\xeb\\x18\\x8bE\\x08)\\x06\\x8bE\\x0c\\x19F\\x04\\xeb\\x0b\\x8bE\\x08\\x01\\x06\\x8bE\\x0c\\x11F\\x04^]\\xc2\\x08\\x00\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xecV\\x8b\\xf1\\x83\\xea\\x01tA\\x83\\xea\\x01t5\\x83\\xea\\x01t\"\\x83\\xea\\x01u7\\x8bE\\x08\\x0bE\\x0ct/\\xffu\\x0c\\x0f\\xbe\\x06\\xffu\\x08\\x99RP\\xe8\\xbf*\\x00\\x00\\x88\\x06\\xeb\\x1a\\x0f\\xbe\\x0e\\x0f\\xbeE\\x08\\x0f\\xaf\\xc8\\x88"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1166
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xfdm&\\xef\\xbb3\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13251"
              }
            ],
            "repeated": 0,
            "id": 1167
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x8d\\x84\\xfc\\xff\\xff\\xe9F|\\xf6\\xff\\x8d\\x8dt\\xfa\\xff\\xff\\xe9;|\\xf6\\xff\\x8d\\x8dT\\xfc\\xff\\xff\\xe90|\\xf6\\xff\\x8d\\x8d\\x04\\xfb\\xff\\xff\\xe9%|\\xf6\\xff\\x8d\\x8dT\\xff\\xff\\xff\\xe9\\x1a|\\xf6\\xff\\x8d\\x8d$\\xfc\\xff\\xff\\xe9\\x0f|\\xf6\\xff\\x8d\\x8d\\xfc\\xf9\\xff\\xff\\xe9\\x04|\\xf6\\xff\\x8d\\x8d\\xc4\\xfe\\xff\\xff\\xe9\\xf9{\\xf6\\xff\\x8d\\x8d\\xf4\\xfb\\xff\\xff\\xe9\\xee{\\xf6\\xff\\x8d\\x8d\\xd4\\xfa\\xff\\xff\\xe9\\xe3{\\xf6\\xff\\x8d\\x8d\\xf4\\xfe\\xff\\xff\\xe9\\xd8{\\xf6\\xff\\x8d\\x8d\\xc4\\xfb\\xff\\xff\\xe9\\xcd{\\xf6\\xff\\x8d\\x8d,\\xfa\\xff\\xff\\xe9\\xc2{\\xf6\\xff\\x8d\\x8d$\\xff\\xff\\xff\\xe9\\xb7{\\xf6\\xff\\x8d\\x8d\\x94\\xfb\\xff\\xff\\xe9\\xac{\\xf6\\xff\\x8d\\x8d\\xa4\\xfa\\xff\\xff\\xe9\\xa1{\\xf6\\xff\\x8d\\x8d<\\xff\\xff\\xff\\xe9\\x96{\\xf6\\xff\\x8d\\x8d,\\xfd\\xff\\xff\\xe9\\x8b{\\xf6\\xff\\x8d\\x8dD\\xfd\\xff\\xff\\xe9\\x80{\\xf6\\xff\\x8d\\x8d\\xac\\xfe\\xff\\xff\\xe9u{\\xf6\\xff\\x8d\\x8dd\\xfb\\xff\\xff\\xe9j{\\xf6\\xff\\x8d\\x8d\\xcc\\xf9\\xff\\xff\\xe9_{\\xf6\\xff\\x8d\\x8d\\x0c\\xff\\xff\\xff\\xe9T{\\xf6\\xff\\x8d\\x8d\\xfc\\xfc"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1168
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x1b\\x97\\x94\\xe3s \\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8315"
              }
            ],
            "repeated": 0,
            "id": 1169
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xffK\\xda\n\\x10\\x00\\x00\\x00\\x00d\\xda\n\\x10\\x01\\x00\\x00\\x00o\\xda\n\\x10\"\\x05\\x93\\x19\\x01\\x00\\x00\\x00\\x10\\xa9\\x0b\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x9a\\xda\n\\x10\"\\x05\\x93\\x19\\x03\\x00\\x00\\x00<\\xa9\\x0b\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xc5\\xda\n\\x10\\x00\\x00\\x00\\x00\\xcd\\xda\n\\x10\\x01\\x00\\x00\\x00\\xd8\\xda\n\\x10\"\\x05\\x93\\x19\\x03\\x00\\x00\\x00x\\xa9\\x0b\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x06\\xdb\n\\x10\\x00\\x00\\x00\\x00\\x0e\\xdb\n\\x10\\x01\\x00\\x00\\x00\\x19\\xdb\n\\x10\"\\x05\\x93\\x19\\x01\\x00\\x00\\x00\\xb4\\xa9\\x0b\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xffG\\xdb\n\\x10\"\\x05\\x93\\x19"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1170
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x8e\\xa1U\\x878 \\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8256"
              }
            ],
            "repeated": 0,
            "id": 1171
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x02\\x00\\x00\\x00\\xe0(\\x0c\\x10\\x01\\x00\\x00\\x00\\xf0(\\x0c\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04)\\x0c\\x10@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\xa8\\x05\\x10\"\\x05\\x93\\x19\\x02\\x00\\x00\\x008)\\x0c\\x10\\x01\\x00\\x00\\x00H)\\x0c\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\)\\x0c\\x10@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\xa9\\x05\\x10\"\\x05\\x93\\x19\\x02\\x00\\x00\\x00\\x90)\\x0c\\x10\\x01\\x00\\x00\\x00\\xa0)\\x0c\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb4)\\x0c\\x10@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1172
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa1$7B\\xa5\\x1f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8109"
              }
            ],
            "repeated": 0,
            "id": 1173
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x004?\\x00\\x10\\x00\\x00\\x00\\x000\\x8b\\x00\\x10\\x14\\x8b\\x00\\x10\\x04\\x8b\\x00\\x10\\xd4\\x8a\\x00\\x10\\xa0\\x8a\\x00\\x10h\\x8a\\x00\\x100\\x8a\\x00\\x10\\xf8\\x89\\x00\\x10\\xdc\\x89\\x00\\x10\\xbc\\x89\\x00\\x10\\x9c\\x89\\x00\\x10`\\x89\\x00\\x10$\\x89\\x00\\x10\\xec\\x88\\x00\\x10\\xdc\\x88\\x00\\x10\\xa8\\x88\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1174
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xb0\\x10\\xbc\\xf0k?\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16243"
              }
            ],
            "repeated": 0,
            "id": 1175
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "c\\x00e\\x00I\\x00d\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00H\\x00R\\x00E\\x00S\\x00U\\x00L\\x00T\\x00\\x00\\x00TEMP\\x14\\x03\\x00\\x00\\x06\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xfcH\\x00\\x00\\x01\\x00\\x00\\x00\\xbd\\x0c\n\\xaf8\\xb1/\\x8c\\xf3\\xd5'\\x82\\xebw\\xcd\\xda\\x0f\\x01\\x01\\x00\\x01\\xff\\xff\\xc0\\x01\\x00\\x00D\\x82\t\\x00E\\x00v\\x00e\\x00n\\x00t\\x00D\\x00a\\x00t\\x00a\\x00\\x00\\x00\\x02A\\xff\\xff?\\x00\\x00\\x00\\x8ao\\x04\\x00D\\x00a\\x00t\\x00a\\x00\\x00\\x00'\\x00\\x00\\x00\\x06K\\x95\\x04\\x00N\\x00a\\x00m\\x00e\\x00\\x00\\x00\\x05\\x01\n\\x00S\\x00c\\x00e\\x00n\\x00a\\x00r\\x00i\\x00o\\x00I\\x00d\\x00\\x02\r\\x00\\x00\\x0f\\x04A\\xff\\xffO\\x00\\x00\\x00\\x8ao\\x04\\x00D\\x00a\\x00t\\x00a\\x00\\x00\\x007\\x00\\x00\\x00\\x06K\\x95\\x04\\x00N\\x00a\\x00m\\x00e\\x00\\x00\\x00\\x05\\x01\\x12\\x00S\\x00c\\x00e\\x00n\\x00a\\x00r\\x00i\\x00o\\x00I\\x00n\\x00s\\x00t\\x00a\\x00n\\x00c\\x00e\\x00I\\x00"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1176
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x958\\x82\\x0fVV\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "22110"
              }
            ],
            "repeated": 0,
            "id": 1177
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "Buffer",
                "value": "33S3c3\\x903\\xfb374K4\\xc84\\xdd4\\x065W5h5~5\\xb15\\xc55,6V6g6z6\\xd56\\x13717\\x987\\xba7u8\\x878\\xa38\\xe98\\xf38\\x079$939A9_9o9\\x7f9\\x999\\xa69\\xbc9\\xe19!:0:?:T:{:\\x8a:\\x94:\\xa9:\\xd1:\\xe3:\\xf4:\";a;\\x0b<:<\t=j=\\xa4=\\xb3=\\xc1=\\xe0=\\x99>\\xa4>\\xde>\t?\\x14?A?\\x97?\\xad?\\xbf?\\xe2?\\x00\\x00\\x00\\xb0\\x06\\x00\\xdc\\x00\\x00\\x00\\x120\\x1c040D0n0\\xa40\\xcd0\\xef0\\x0c1\\x1e1(1@1R1r1\\x821\\x901\\xc61\\xf41\\x13282Z2j2\\x832\\x942\\xa12\\xc72\t3\\x163/3C3\\x883\\xa23\\xb93\\xd03\\x064\\x1a4A4Z4g4\\x854\\x964\\xb74\\x0b5\\x1a5O5\\xcd5\\xe85\\xf55\\x18676O6`6"
              },
              {
                "name": "Length",
                "value": "30880"
              }
            ],
            "repeated": 0,
            "id": 1178
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xccfyt\\x89\\xd6\\x01\\x00\\xccfyt\\x89\\xd6\\x01\\x00\\xccfyt\\x89\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1179
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1180
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc04\\x01\\x00\\xa0\\xf8\\x0f\\x00\\x00\\x00,Q\\x95\\x9a  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1181
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "%9\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1182
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "DiagTrackRunner.exe\\x00@\\xa3\\x00\\x00`-\\x11\\x00\\x00\\x00HQu\\x02  Diager.dll\\x00\\xd4(\\x00\\x00\\xa0\\xd0\\x11\\x00\\x00\\x00AQ\\xf5\\x89  setupplatform.cfg\\x00H\\xe9m\\x00t\\xf9\\x11\\x00\\x00\\x00HQ|\\x02  setupplatform.dll\\x00@\\xc1\\x0c\\x00\\xbc\\xe2\\x7f\\x00\\x00\\x00HQ\\x81\\x02  unbcl.dll\\x00\\xc8\\xcd\\x03\\x00\\xfc\\xa3\\x8c\\x00\\x00\\x00HQ\\\\x04  wdsclientapi.dll\\x008\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4  wdscore.dll\\x00H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02  wdscsl.dll\\x00\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02  wdsimage.dl"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1183
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "99\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1184
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1185
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1186
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc04\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1187
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc04\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1188
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc04\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1189
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1190
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe"
              },
              {
                "name": "Buffer",
                "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\x0e\\x1f\\xba\\x0e\\x00\\xb4\t\\xcd!\\xb8\\x01L\\xcd!This program cannot be run in DOS mode.\r\r\n$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\xd0\\xba\\xb5S\\xb1\\xd4\\xe6S\\xb1\\xd4\\xe6S\\xb1\\xd4\\xe6\\xe7-%\\xe6P\\xb1\\xd4\\xe6\\xe7-&\\xe6F\\xb1\\xd4\\xe6\\xe7-'\\xe6U\\xb1\\xd4\\xe6\\xe7-;\\xe6X\\xb1\\xd4\\xe6S\\xb1\\xd5\\xe6\\x1b\\xb1\\xd4\\xe6\\xe7-#\\xe6R\\xb1\\xd4\\xe6\\xe7-9\\xe6R\\xb1\\xd4\\xe6\\xe7-$\\xe6R\\xb1\\xd4\\xe6RichS\\xb1\\xd4\\xe6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PE\\x00\\x00L\\x01\\x05\\x00Y\\xd12V\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x00\\x02\r"
              },
              {
                "name": "Length",
                "value": "1888"
              }
            ],
            "repeated": 0,
            "id": 1191
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x90p5\t\\xe25\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13802"
              }
            ],
            "repeated": 0,
            "id": 1192
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00permission denied\\x00\\x00\\x00file exists\\x00no such device\\x00\\x00filename too long\\x00\\x00\\x00device or resource busy\\x00io error\\x00\\x00\\x00\\x00directory not empty\\x00invalid argument\\x00\\x00\\x00\\x00no space on device\\x00\\x00no such file or directory\\x00\\x00\\x00function not supported\\x00\\x00no lock available\\x00\\x00\\x00not enough m"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1193
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x95\\xb8\\x9e/\\xfe\"\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8966"
              }
            ],
            "repeated": 0,
            "id": 1194
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00S\\x00i\\x00n\\x00k\\x00S\\x00t\\x00a\\x00t\\x00e\\x00O\\x00r\\x00d\\x00i\\x00n\\x00a\\x00l\\x00\\x02\r\r\\x00\\x04\\x04A\\xff\\xffU\\x00\\x00\\x00\\x8ao\\x04\\x00D\\x00a\\x00t\\x00a\\x00\\x00\\x00=\\x00\\x00\\x00\\x06K\\x95\\x04\\x00N\\x00a\\x00m\\x00e\\x00\\x00\\x00\\x05\\x01\\x15\\x00P\\x00e\\x00r\\x00f\\x00T\\x00r\\x00a\\x00c\\x00k\\x00S\\x00c\\x00e\\x00n\\x00a\\x00r\\x00i\\x00o\\x00N\\x00a\\x00m\\x00e\\x00\\x02\r\\x0e\\x00\\x01\\x04A\\xff\\xffW\\x00\\x00\\x00\\x8ao\\x04\\x00D\\x00a\\x00t\\x00a\\x00\\x00\\x00?\\x00\\x00\\x00\\x06K\\x95\\x04\\x00N\\x00a\\x00m\\x00e\\x00\\x00\\x00\\x05\\x01\\x16\\x00P\\x00e\\x00r\\x00f\\x00T\\x00r\\x00a\\x00c\\x00k\\x00D\\x00u\\x00r\\x00a\\x00t\\x00i\\x00o\\x00n\\x00F\\x00i\\x00e\\x00l\\x00d\\x00\\x02\r\\x0f\\x00\\x01\\x04A\\xff\\xffE\\x00\\x00\\x00\\x8ao\\x04\\x00D\\x00a\\x00t\\x00a\\x00\\x00\\x00-\\x00\\x00\\x00\\x06K\\x95\\x04\\x00"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1195
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "a\\xa0\\xc9\\x91\\x00>\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15880"
              }
            ],
            "repeated": 0,
            "id": 1196
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x9e\\xac\n\\xfb\\x13'@\\xad\\xe4\\xf9\\xe1\\xa9\\x7fF\\xbb\\x07`Ge`@N\\xb0B\\xecN\\xed\\xb3vy\\xd8\n4\tm\\x1c\\x801\\x1f\\xe2\\x0eT\\xdd\\xe5\\xa1\\xfb\\xe5G\\x10\\xadd\\x98\\xffP\\x16.|\\xbf\\x05!z\\xe2\\x95A'i\\xc3\\x93\\x8f\\x95\\xc9\\x8d\\xd8\\x9b!\\xae\r\\\\x9c\\xf0\\xa2\\xae\\x86h\\x83\\x0cj-\\xbbvk\\x00\\x1d\\x96\\xad\\xf2\\x16{\\xf6\\x16\\x83$\\xb9\\x88\\xcfj\\xa8G1/\\x9a\\xdc\\xe3q=\\xd7\\x00~bG\\xd1\\xce\\x88\\xc9\\xb8\\x18\\xfa\\x0er\\x8d\\xc1\\xa3=\\xaf\\x02@j\\xffi\\x9b\\x96\\xe2\\x10\\xa8\\x10\\xb47P\\x08\\xd6\\xc3=0\\x82\\x06\\x070\\x82\\x03\\xef\\xa0\\x03\\x02\\x01\\x02\\x02\na\\x16h4\\x00\\x00\\x00\\x00\\x00\\x1c0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x05\\x05\\x000_1\\x130\\x11\\x06\n\t\\x92&\\x89\\x93\\xf2,d\\x01\\x19\\x16\\x03com1\\x190\\x17\\x06\n\t\\x92&\\x89\\x93\\xf2,d\\x01\\x19\\x16\tmicrosoft1-0+\\x06\\x03U\\x04\\x03\\x13$Mic"
              },
              {
                "name": "Length",
                "value": "11616"
              }
            ],
            "repeated": 0,
            "id": 1197
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xf9\\x97zt\\x89\\xd6\\x01\\x00\\xf9\\x97zt\\x89\\xd6\\x01\\x00\\xf9\\x97zt\\x89\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1198
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1199
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "@\\xa3\\x00\\x00`-\\x11\\x00\\x00\\x00HQu\\x02  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1200
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "I9\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1201
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "Diager.dll\\x00\\xd4(\\x00\\x00\\xa0\\xd0\\x11\\x00\\x00\\x00AQ\\xf5\\x89  setupplatform.cfg\\x00H\\xe9m\\x00t\\xf9\\x11\\x00\\x00\\x00HQ|\\x02  setupplatform.dll\\x00@\\xc1\\x0c\\x00\\xbc\\xe2\\x7f\\x00\\x00\\x00HQ\\x81\\x02  unbcl.dll\\x00\\xc8\\xcd\\x03\\x00\\xfc\\xa3\\x8c\\x00\\x00\\x00HQ\\\\x04  wdsclientapi.dll\\x008\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4  wdscore.dll\\x00H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02  wdscsl.dll\\x00\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02  wdsimage.dll\\x00\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04  wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1202
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "T9\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1203
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1204
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Diager.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1205
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Diager.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "@\\xa3\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1206
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Diager.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "@\\xa3\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1207
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Diager.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "@\\xa3\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1208
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Diager.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1209
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Diager.dll"
              },
              {
                "name": "Buffer",
                "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x00\\x00\\x00\\x0e\\x1f\\xba\\x0e\\x00\\xb4\t\\xcd!\\xb8\\x01L\\xcd!This program cannot be run in DOS mode.\r\r\n$\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x8fZ\\xc5,\\xee4\\x96,\\xee4\\x96,\\xee4\\x968\\x857\\x97.\\xee4\\x968\\x850\\x97\"\\xee4\\x96,\\xee5\\x96\\x8c\\xee4\\x968\\x855\\x97#\\xee4\\x968\\x851\\x97)\\xee4\\x968\\x854\\x97-\\xee4\\x968\\x85=\\x97%\\xee4\\x968\\x85\\xcb\\x96-\\xee4\\x968\\x856\\x97-\\xee4\\x96Rich,\\xee4\\x96\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PE\\x00\\x00L\\x01\\x06\\x00"
              },
              {
                "name": "Length",
                "value": "21152"
              }
            ],
            "repeated": 0,
            "id": 1210
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xea\\x14\\x9f\\xfec>\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15979"
              }
            ],
            "repeated": 0,
            "id": 1211
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Diager.dll"
              },
              {
                "name": "Buffer",
                "value": "\\xe0\\x01\\xc7E\\xfc\\xfe\\xff\\xff\\xff\\x8bM\\xf0d\\x89\r\\x00\\x00\\x00\\x00Y_^[\\x8b\\xe5]\\xc3\\x8bE\\xec\\x8b\\x003\\xc9\\x818\\x05\\x00\\x00\\xc0\\x0f\\x94\\xc1\\x8b\\xc1\\xc3\\x8be\\xe8\\xc7E\\xfc\\xfe\\xff\\xff\\xff3\\xc0\\x8bM\\xf0d\\x89\r\\x00\\x00\\x00\\x00Y_^[\\x8b\\xe5]\\xc3\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xec\\x8bM\\x08\\xb8MZ\\x00\\x00f9\\x01u\\x1f\\x8bA<\\x03\\xc1\\x818PE\\x00\\x00u\\x12\\xb9\\x0b\\x01\\x00\\x00f9H\\x18u\\x07\\xb8\\x01\\x00\\x00\\x00]\\xc33\\xc0]\\xc3\\x8b\\xffU\\x8b\\xec\\x83\\xec\\x14\\x83e\\xf4\\x00\\x83e\\xf8\\x00\\xa1Dp\\x00\\x10VW\\xbfN\\xe6@\\xbb\\xbe\\x00\\x00\\xff\\xff;\\xc7t\\x04\\x85\\xc6ud\\x8dE\\xf4P\\xff\\x15H\\x80\\x00\\x10\\x8bE\\xf83E\\xf4\\x89E\\xfc\\xff\\x15D\\x80\\x00\\x101E\\xfc\\xff\\x15\\x08\\x81\\x00\\x101E\\xfc\\xff\\x15 \\x80\\x00\\x103E\\xfc\\x8dM\\xfc3\\xc1\\x89E\\xfc\\x8dE\\xecP\\xff\\x15@\\x80\\x00\\x10\\x8bE\\xf03E\\xec3E\\xfc\\x8b\\xc8;\\xc7t\\x08\\x855D"
              },
              {
                "name": "Length",
                "value": "20640"
              }
            ],
            "repeated": 0,
            "id": 1212
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Diager.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00{\\xfecC\\x9d\\xd6\\x01\\x00{\\xfecC\\x9d\\xd6\\x01\\x00{\\xfecC\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1213
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1214
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd4(\\x00\\x00\\xa0\\xd0\\x11\\x00\\x00\\x00AQ\\xf5\\x89  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1215
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "d9\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1216
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "setupplatform.cfg\\x00H\\xe9m\\x00t\\xf9\\x11\\x00\\x00\\x00HQ|\\x02  setupplatform.dll\\x00@\\xc1\\x0c\\x00\\xbc\\xe2\\x7f\\x00\\x00\\x00HQ\\x81\\x02  unbcl.dll\\x00\\xc8\\xcd\\x03\\x00\\xfc\\xa3\\x8c\\x00\\x00\\x00HQ\\\\x04  wdsclientapi.dll\\x008\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4  wdscore.dll\\x00H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02  wdscsl.dll\\x00\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02  wdsimage.dll\\x00\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04  wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02  wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1217
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "v9\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1218
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1219
          },
          {
            "timestamp": "2026-05-28 22:59:32,989",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1220
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1221
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1222
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1223
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1224
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "Buffer",
                "value": ";\r\n; This section describes the footprint dependencies\r\n; of various platform sections\r\n;\r\n[Dependencies]\r\nBasic =\r\nServicing = Basic\r\nICB = Basic, Servicing\r\nMigration = Basic\r\n\r\n;\r\n; Each element in a footprint section can be one of three things:\r\n; - Fi"
              },
              {
                "name": "Length",
                "value": "10452"
              }
            ],
            "repeated": 0,
            "id": 1225
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x0b\\x18*Q\\x98\\xd6\\x01\\x00\\x0b\\x18*Q\\x98\\xd6\\x01\\x00\\x0b\\x18*Q\\x98\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1226
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 1227
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "H\\xe9m\\x00t\\xf9\\x11\\x00\\x00\\x00HQ|\\x02  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1228
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x869\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1229
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "setupplatform.dll\\x00@\\xc1\\x0c\\x00\\xbc\\xe2\\x7f\\x00\\x00\\x00HQ\\x81\\x02  unbcl.dll\\x00\\xc8\\xcd\\x03\\x00\\xfc\\xa3\\x8c\\x00\\x00\\x00HQ\\\\x04  wdsclientapi.dll\\x008\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4  wdscore.dll\\x00H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02  wdscsl.dll\\x00\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02  wdsimage.dll\\x00\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04  wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02  wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3  wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05 "
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1230
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x989\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1231
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1232
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1233
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "H\\xe9m\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1234
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "H\\xe9m\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1235
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "H\\xe9m\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1236
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1237
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "Buffer",
                "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x00\\x00\\x00\\x0e\\x1f\\xba\\x0e\\x00\\xb4\t\\xcd!\\xb8\\x01L\\xcd!This program cannot be run in DOS mode.\r\r\n$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90& \\x94\\xd4GN\\xc7\\xd4GN\\xc7\\xd4GN\\xc7\\xdd?\\xdd\\xc7\\xd6GN\\xc7\\xc0,M\\xc6\\xd9GN\\xc7\\xc0,J\\xc6\\xc0GN\\xc7\\xd4GO\\xc7$BN\\xc7\\xc0,O\\xc6\\xe1GN\\xc7\\xc0,K\\xc6\\xdaGN\\xc7\\xc0,N\\xc6\\xd5GN\\xc7\\xc0,G\\xc6\\xfaEN\\xc7\\xc0,\\xb1\\xc7\\xd5GN\\xc7\\xc0,L\\xc6\\xd5GN\\xc7Rich\\xd4GN\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PE\\x00\\x00L\\x01\\x06\\x00\\x15\\x1d\\x87\\x8e\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "1676"
              }
            ],
            "repeated": 0,
            "id": 1238
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc5\\x15\\xd5\\xdf\\x00*\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "10760"
              }
            ],
            "repeated": 0,
            "id": 1239
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "Buffer",
                "value": " \\xc2V\\x10\\\\xab\\x02\\x10\\xd0\\x0f\\x1f\\x10\\xe8\\xab\\x02\\x10\\xe0\\xe2\\x1f\\x10\\x10\\xa5\\x1f\\x10@\\xbbV\\x10@\\xbbV\\x10\\xfc\\xab\\x02\\x10 \\xc8\\x1b\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10\\x10\\xac\\x02\\x10P\\x0e\\x1f\\x10\\x9c\\xac\\x02\\x10\\x10\\xd1\\x1f\\x10\\x10\\xa5\\x1f\\x10@\\xbbV\\x10@\\xbbV\\x10\\xb0\\xac\\x02\\x10 \\xc8\\x1b\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10\\xc4\\xac\\x02\\x10\\xd0\\x0c\\x1f\\x10P\\xad\\x02\\x10\\x80\\xb7\\x1f\\x10\\x10\\xa5\\x1f\\x10@\\xbbV\\x10@\\xbbV\\x10d\\xad\\x02\\x10 \\xc8\\x1b\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10x\\xad\\x02\\x10P\\x0b\\x1f\\x10\\x04\\xae\\x02\\x10P\\xa6\\x1f\\x10\\x10\\xa5\\x1f\\x10@\\xbbV\\x10@\\xbbV\\x10\\x18\\xae\\x02\\x10 \\xc8\\x1b\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1240
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd6\\xb2^\\xe1\\x9f#\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9127"
              }
            ],
            "repeated": 0,
            "id": 1241
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "Buffer",
                "value": "`y\\x03\\x10\\x80R'\\x10pS'\\x10`S'\\x10ty\\x03\\x10\\x80\\xb8\\x1c\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10\\x88y\\x03\\x10`\\xa5\\x1f\\x10\\x10\\xa5\\x1f\\x10\\xb0\\xa6\\x1f\\x10\\xb0\\xa6\\x1f\\x10\\xa0\\xa3\\x1f\\x10`P'\\x10\\x00\\xa4\\x1f\\x10P\\xa7\\x1f\\x10\\xb0\\xa8\\x1f\\x10\\x00O'\\x10\\x90R'\\x10pW'\\x10\\x9cy\\x03\\x10`\\xa8\\x1f\\x10\\xc0\\xa6\\x1f\\x10\\xb0y\\x03\\x10\\xc0\\xa3\\x1f\\x10\\xc4y\\x03\\x10@U'\\x10\\xb0T'\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10PS'\\x10\\xd8y\\x03\\x10@\\xda\\x1b\\x10@\\xd7\\x1b\\x10p\\xda\\x1b\\x10\\x90\\xda\\x1b\\x10\\xc0\\xda\\x1b\\x10\\xf0\\xda\\x1b\\x10 \\xdb\\x1b\\x10 \\xdb\\x1b\\x10\\xb0A'\\x10\\xe0j\\x1b\\x10\\x00z\\x03\\x10\\x00P'\\x10\\xf0W'\\x10\\xa0O'\\x10\\x14z\\x03\\x10\\x80\\xb8\\x1c\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1242
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "+\\xc8X\\x15\\x81\\x1b\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "7049"
              }
            ],
            "repeated": 0,
            "id": 1243
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "Buffer",
                "value": "0>2\\x10\\x10\\xa5\\x1f\\x10@\\xbbV\\x10@\\xbbV\\x10\\x04\\x7f\\x04\\x10p<2\\x10\\x90\\x7f\\x04\\x10p;2\\x10\\xa4\\x7f\\x04\\x10 \\xc8\\x1b\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10\\x08\\x80\\x04\\x10 \\xc8\\x1b\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10\\x1c\\x80\\x04\\x10\\x10>2\\x10\\x10\\xa5\\x1f\\x10@\\xbbV\\x10@\\xbbV\\x10\\x80\\x80\\x04\\x10\\xd0>2\\x10\\x10\\xa5\\x1f\\x10@\\xbbV\\x10@\\xbbV\\x10D\\x80\\x04\\x10p:2\\x10\\xd0\\x80\\x04\\x10p92\\x10\\xa8\\x80\\x04\\x10 \\xc8\\x1b\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10H\\x81\\x04\\x10 \\xc8\\x1b\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10\\x0c\\x81\\x04\\x10 >2\\x10\\x10\\xa5\\x1f\\x10@\\xbbV\\x10@\\xbbV\\x10\\xac\\x81\\x04\\x10"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1244
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xff9\\xc7\\x8fR-\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "11610"
              }
            ],
            "repeated": 0,
            "id": 1245
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10p\\x87\\x05\\x10@\\xbbV\\x10@\\xbbV\\x10@\\xbbV\\x10(\\x89\\x05\\x10\\xd0\\xa1B\\x10<\\x89\\x05\\x10`\\xb6\\x1f\\x10\\xf0\\x9fB\\x104\\x87\\x05\\x10\\xd0\\x8eB\\x10H\\x87\\x05\\x100\\x8fB\\x10\\x00\\x89\\x05\\x10`\\xb6\\x1f\\x10\\x90\\xa0B\\x10\\x14\\x89\\x05\\x10\\x90\\xbd\\x1c\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10d\\x89\\x05\\x10\\x90\\xbd\\x1c\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10x\\x89\\x05\\x10\\xa0\\xa0B\\x10\\xb4\\x89\\x05\\x100\\xa1B\\x10p\\xa0B\\x10\\xb0\\xa0B\\x10P\\x89\\x05\\x10\\x80\\xa9\\x1f\\x10\\xb0\\xa1B\\x10\\xc0\\xa1B\\x10\\xa0\\x89\\x05\\x100\\x8eB\\x100\\xc2V\\x10\\x90\\xc1V\\x100\\xc1V\\x10\\x80\\xc1V\\x10\\x10\\xc1V\\x10p\\xc1V\\x10 \\xc2V\\x10h\\x8a\\x05\\x10 \\xa2B\\x10|\\x8a\\x05\\x10`\\xb6\\x1f\\x10\\x00\\xa2B\\x10@\\x8a\\x05\\x10`\\xb6\\x1f\\x10\\x00\\xa1B\\x10"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1246
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xb0\\xa2*\\x7fT\\x19\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6492"
              }
            ],
            "repeated": 0,
            "id": 1247
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x18\\x81\\x02\\x10\\x00\\x00\\x00\\x00(a\\x02\\x10\\x18\\x81\\x02\\x10\\x00\\x00\\x00\\x00Da\\x02\\x10\\x18\\x81\\x02\\x10\\x00\\x00\\x00\\x00`a\\x02\\x10\\x18\\x81\\x02\\x10\\x00\\x00\\x00\\x00|a\\x02\\x10\\x18\\x81\\x02\\x10\\x00\\x00\\x00\\x00\\x98a\\x02\\x10\\x18\\x81\\x02\\x10\\x00\\x00\\x00\\x00\\x08b\\x02\\x10\\x1c\\x05\\x03\\x10\\xeca\\x02\\x10\\xccb\\x02\\x10\\x1c\\x05\\x03\\x10\\x04c\\x02\\x10\\x04c\\x02\\x10\\xccb\\x02\\x10\\x1c\\x05\\x03\\x10\\x04c\\x02\\x10\\x04c\\x02\\x10\\xd0a\\x02\\x10\\xeca\\x02\\x10\\xccb\\x02\\x10\\x1c\\x05\\x03\\x10\\x04c\\x02\\x10\\x04c\\x02\\x10\\x00\\x05\\x03\\x10\\x1c\\x05\\x03\\x10\\xb4a\\x02\\x10\\x1c\\x05\\x03\\x10\\x00\\x05\\x03\\x10\\x1c\\x05\\x03\\x10\\x00\\x00\\x00\\x00\\x94b\\x02\\x10xb\\x02\\x10\\b\\x02\\x10$\\x85\\x02\\x10@b\\x02\\x10@b\\x02\\x10\\x9c\\x83\\x02\\x10$\\x85\\x02\\x10$b\\x02\\x10$\\x85\\x02\\x10\\x9c\\x83\\x02\\x10$\\x85\\x02\\x10\\x00\\x00\\x00\\x00\\xb0b\\x02\\x10\\x1c\\x05\\x03\\x10l\\x04\\x03\\x10\\x1c\\x05\\x03\\x10\\x00\\x00\\x00\\x00\\xe8b\\x02\\x10\\xccb\\x02\\x10\\x1c\\x05\\x03\\x10\\x04c\\x02\\x10\\x04c\\x02\\x10"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1248
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "b\\x95\\x13!\\xa0\\x1a\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6824"
              }
            ],
            "repeated": 0,
            "id": 1249
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xd4\\x02\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0\\x02\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\x02\\x02\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xf4\\x02\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00p\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x07\\x00\\x00\\x00P\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x84\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x90\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x98\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xbc\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xa4\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xd0\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xe4\\x03\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00`\\x04\\x02\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x07\\x00\\x00\\x00@\\x04\\x02\\x10\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1250
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "P\\xd5.t\\xa1\\x1a\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6825"
              }
            ],
            "repeated": 0,
            "id": 1251
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00p*\\x03\\x10\\x1c\\x05\\x03\\x10T*\\x03\\x10\\x00\\x00\\x00\\x00\\x8c*\\x03\\x10\\x00\\x00\\x00\\x00\\xa8*\\x03\\x10\\x1c\\x05\\x03\\x10\\x00\\x00\\x00\\x00\\xc4*\\x03\\x10\\x00\\x00\\x00\\x00\\xfc*\\x03\\x10\\x1c\\x05\\x03\\x10\\xe0*\\x03\\x10\\x1c\\x05\\x03\\x10\\x18+\\x03\\x10\\x1c\\x05\\x03\\x10P+\\x03\\x10P+\\x03\\x10\\x18+\\x03\\x10\\x1c\\x05\\x03\\x10P+\\x03\\x10P+\\x03\\x10\\xc8\\x85\\x02\\x10\\x00\\x00\\x00\\x004+\\x03\\x10\\x1c\\x05\\x03\\x10\\x18+\\x03\\x10\\x1c\\x05\\x03\\x10P+\\x03\\x10P+\\x03\\x10\\x00\\x00\\x00\\x00l+\\x03\\x10\\x1c\\x05\\x03\\x10P+\\x03\\x10\\x00\\x00\\x00\\x00\\x88+\\x03\\x10\\x00\\x00\\x00\\x00\\xa4+\\x03\\x10\\x1c\\x05\\x03\\x10\\x00\\x00\\x00\\x00\\xc0+\\x03\\x10\\x1c\\x05\\x03\\x10\\x00\\x00\\x00\\x00\\xf8+\\x03\\x10\\x1c\\x05\\x03\\x10\\xdc+\\x03\\x10\\x1c\\x05\\x03\\x10\\x14,\\x03\\x10\\x1c\\x05\\x03\\x10L,\\x03\\x10L,\\x03\\x10\\x14,\\x03\\x10\\x1c\\x05\\x03\\x10L,\\x03\\x10L,\\x03\\x10\\xc8\\x85\\x02\\x10\\x00\\x00\\x00\\x000,\\x03\\x10\\x1c\\x05\\x03\\x10\\x14,\\x03\\x10\\x1c\\x05\\x03\\x10L,\\x03\\x10"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1252
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xba=\\xc5\\x88\\xad\\x1b\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "7093"
              }
            ],
            "repeated": 0,
            "id": 1253
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x04\\x00\\x00\\x00\\x08\\x00\\x00\\x00P\\x00\\x00\\x00\\x18\\xa1\\x03\\x10\\xd8D`\\x10\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00(\\xa1\\x03\\x10\\x98D`\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x18\\xa1\\x03\\x10\\x08E`\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x008\\xa1\\x03\\x10\\x8cE`\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00H\\xa1\\x03\\x10\\xc0E`\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00X\\xa1\\x03\\x10\\xf8E`\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00h\\xa1\\x03\\x10\\x80F`\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00x\\xa1\\x03\\x10xG`\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x98\\xa1\\x03\\x10\\x00G`\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1254
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x89\\x10\\xff\\x02\\xad\\x1a\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6837"
              }
            ],
            "repeated": 0,
            "id": 1255
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "Buffer",
                "value": "\\xe0\\xc6`\\x10\\x03\\x00\\x00\\x00\\x90\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xd4\\x14\\x04\\x10\\xe0\\xc6`\\x10\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xd4\\x14\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00$\n\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x14\n\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00d\n\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\r\\x00\\x00\\x00,\n\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x80\n\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00x\n\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xe0\n\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x8c\n\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xe8\n\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\r\\x00\\x00\\x00\\xa8\n\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xf8\n\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x08\\x0b\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1256
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xdaV\\x03w.\\x1d\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "7478"
              }
            ],
            "repeated": 0,
            "id": 1257
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00@\\x00\\x00\\x00L\\x94\\x04\\x10,Fa\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00<\\x94\\x04\\x10XHa\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x1c\\x94\\x04\\x10PEa\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xec\\x93\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xac\\x8d\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xbc\\x8d\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x08\\x8e\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb4\\x8d\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\r\\x00\\x00\\x00\\xc4\\x8d\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x10\\x8e\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x008\\x8e\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xfc\\x8d\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x000\\x8e\\x04\\x10\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\r\\x00\\x00\\x00L\\x8e\\x04\\x10"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1258
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x08\\x02\\xfa\\xee\\x9d\\x1c\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "7333"
              }
            ],
            "repeated": 0,
            "id": 1259
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "Buffer",
                "value": "@\\x00\\x00\\x00\\x10,\\x05\\x10\\xe0\\x1db\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xc0+\\x05\\x10@\\x1db\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xf0+\\x05\\x10\\xa0!b\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00 ,\\x05\\x10\\x00!b\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00P,\\x05\\x10` b\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00,\\x05\\x10\\xc0\\x1fb\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x000,\\x05\\x10 $b\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00`,\\x05\\x10\\x80#b\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x90,\\x05\\x10\\xe0\"b\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1260
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "N\\x9d\\x18\\xfaP\"\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8792"
              }
            ],
            "repeated": 0,
            "id": 1261
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xb8\\x96\\x05\\x10\\xecdc\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xa8\\x96\\x05\\x10\\xd0cc\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x98\\x96\\x05\\x10\\x94ec\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x18\\x97\\x05\\x10(ec\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xf8\\x96\\x05\\x10\\xbcec\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xe8\\x96\\x05\\x10\\xb8dc\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xd8\\x96\\x05\\x10\\xd8gc\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00h\\x97\\x05\\x10Lfc\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00@\\x00\\x00\\x00(\\x97\\x05\\x10\\xf4ec\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 1262
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x9e\\x9b\\xce\\xc6\\x9a,\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "11426"
              }
            ],
            "repeated": 0,
            "id": 1263
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xed\\x8e\\x8c\\xb3\\\\x0e\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "3684"
              }
            ],
            "repeated": 0,
            "id": 1264
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa2\\xa1\\xd6\\xb3\\xec\\x08\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2292"
              }
            ],
            "repeated": 0,
            "id": 1265
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\n\\xda#r\\x8d\\x14\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "5269"
              }
            ],
            "repeated": 0,
            "id": 1266
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xf0\\xb0\\xbbs\\xbb\\x1d\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "7619"
              }
            ],
            "repeated": 0,
            "id": 1267
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xbb\\xa1#\\x12'\\x10\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4143"
              }
            ],
            "repeated": 0,
            "id": 1268
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x89\\xf6\\x82\\xa32\\x10\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4154"
              }
            ],
            "repeated": 0,
            "id": 1269
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x8c\\xdb\\xab\\xbf\\x8e\\x18\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6294"
              }
            ],
            "repeated": 0,
            "id": 1270
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x8b\\xca\\xb1\\xc1\\x1e\\x18\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6182"
              }
            ],
            "repeated": 0,
            "id": 1271
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "%'J~$\\x18\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6188"
              }
            ],
            "repeated": 0,
            "id": 1272
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "7\\xe0\\x9e\\xd3\\x80\\x14\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "5256"
              }
            ],
            "repeated": 0,
            "id": 1273
          },
          {
            "timestamp": "2026-05-28 22:59:33,004",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "D\\xba\\x8f\\xd9-\\x04\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "1077"
              }
            ],
            "repeated": 0,
            "id": 1274
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "|\\x18\\xe1Q\\x97\\x1b\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "7071"
              }
            ],
            "repeated": 0,
            "id": 1275
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "Q;\\x124\\xd4\\x1a\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6876"
              }
            ],
            "repeated": 0,
            "id": 1276
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa1G OJ\\x18\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6226"
              }
            ],
            "repeated": 0,
            "id": 1277
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xec\\xb6kAE\\x18\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6221"
              }
            ],
            "repeated": 0,
            "id": 1278
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x96I1\\xee_\\x16\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "5735"
              }
            ],
            "repeated": 0,
            "id": 1279
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "W\\x8aD\\x07D\\x1c\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "7244"
              }
            ],
            "repeated": 0,
            "id": 1280
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x96\\xb5\\x01\\xfat\\x18\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6268"
              }
            ],
            "repeated": 0,
            "id": 1281
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "`\\xc2\\xba\\xb6\\x0b\\x1f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "7955"
              }
            ],
            "repeated": 0,
            "id": 1282
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x0c\\x93\\x12\\xc0Q\\x17\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "5977"
              }
            ],
            "repeated": 0,
            "id": 1283
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc4\\xffG\\xb3&\\x16\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "5678"
              }
            ],
            "repeated": 0,
            "id": 1284
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc5$qq\\x0f\\x08\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2071"
              }
            ],
            "repeated": 0,
            "id": 1285
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x90\\xbd\\xf2\\x8cO\\x19\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6487"
              }
            ],
            "repeated": 0,
            "id": 1286
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xb2b\\xb7\\xb9$\\x1a\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6700"
              }
            ],
            "repeated": 0,
            "id": 1287
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xdb6)|\\xaf\r\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "3511"
              }
            ],
            "repeated": 0,
            "id": 1288
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "]\\x98\\xb8\\x1e\\x1a\\x18\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6178"
              }
            ],
            "repeated": 0,
            "id": 1289
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xdc\\xc2\\x95\\xf02\\x15\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "5434"
              }
            ],
            "repeated": 0,
            "id": 1290
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "B\\xdd)\\xec\\xa4 \\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8364"
              }
            ],
            "repeated": 0,
            "id": 1291
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xe3z\\xb1\\x15C\\x1d\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "7499"
              }
            ],
            "repeated": 0,
            "id": 1292
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "E \\xba\\x95\\xc8#\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9168"
              }
            ],
            "repeated": 0,
            "id": 1293
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x8d\\xd1?\\xbb\\x8e\\x18\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6294"
              }
            ],
            "repeated": 0,
            "id": 1294
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "/1\\xfc\\x1dJ&\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9810"
              }
            ],
            "repeated": 0,
            "id": 1295
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd4\\xd3iX$\\x19\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6444"
              }
            ],
            "repeated": 0,
            "id": 1296
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x11\\xd2?\\xa7q\\x0f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "3961"
              }
            ],
            "repeated": 0,
            "id": 1297
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x898\\xff\\xb7N\\x17\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "5974"
              }
            ],
            "repeated": 0,
            "id": 1298
          },
          {
            "timestamp": "2026-05-28 22:59:33,020",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "}\\x16r\\x1dM%\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9557"
              }
            ],
            "repeated": 0,
            "id": 1299
          },
          {
            "timestamp": "2026-05-28 22:59:33,098",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "&\\xf3\\x92\\xfe/\\x1f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2097469"
              }
            ],
            "repeated": 0,
            "id": 1300
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xb6VlC\\x9d\\xd6\\x01\\x00\\xb6VlC\\x9d\\xd6\\x01\\x00\\xb6VlC\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1301
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 1302
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "@\\xc1\\x0c\\x00\\xbc\\xe2\\x7f\\x00\\x00\\x00HQ\\x81\\x02  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1303
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xa89\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1304
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "unbcl.dll\\x00\\xc8\\xcd\\x03\\x00\\xfc\\xa3\\x8c\\x00\\x00\\x00HQ\\\\x04  wdsclientapi.dll\\x008\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4  wdscore.dll\\x00H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02  wdscsl.dll\\x00\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02  wdsimage.dll\\x00\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04  wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02  wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3  wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05  MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1305
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb29\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1306
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1307
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\unbcl.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1308
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\unbcl.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "@\\xc1\\x0c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1309
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\unbcl.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "@\\xc1\\x0c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1310
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\unbcl.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "@\\xc1\\x0c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1311
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\unbcl.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1312
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xee\\x84nZg#\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9071"
              }
            ],
            "repeated": 0,
            "id": 1313
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "s\\x15,t\\x1c!\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8484"
              }
            ],
            "repeated": 0,
            "id": 1314
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xe4?\\x03[\\x19\\x11\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4385"
              }
            ],
            "repeated": 0,
            "id": 1315
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa0D\\xcdX=\\x10\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4165"
              }
            ],
            "repeated": 0,
            "id": 1316
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xcb\\xc2y\\x025\\x0c\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "3133"
              }
            ],
            "repeated": 0,
            "id": 1317
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "O\\xd9.\\xe0#,\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "11307"
              }
            ],
            "repeated": 0,
            "id": 1318
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xee\\x97S\\xd7L%\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9556"
              }
            ],
            "repeated": 0,
            "id": 1319
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\xd5\\xc2\\x1fG#\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9039"
              }
            ],
            "repeated": 0,
            "id": 1320
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "8\\xf0\\xea\\x92B7\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14154"
              }
            ],
            "repeated": 0,
            "id": 1321
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xbf\\x96K\\x86z:\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14978"
              }
            ],
            "repeated": 0,
            "id": 1322
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x82K\\xc3c\\x92:\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15002"
              }
            ],
            "repeated": 0,
            "id": 1323
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xdc\\xf5\\x8e\\x1c\\x15;\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15133"
              }
            ],
            "repeated": 0,
            "id": 1324
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "R\\xd8\\xb5\\x84J8\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14418"
              }
            ],
            "repeated": 0,
            "id": 1325
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xcd\\xb3\\xf0bu4\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13437"
              }
            ],
            "repeated": 0,
            "id": 1326
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa5Fp\\x19\\x8d3\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13205"
              }
            ],
            "repeated": 0,
            "id": 1327
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xbf\\x9f\\x80\\xd9)3\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13105"
              }
            ],
            "repeated": 0,
            "id": 1328
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa7\\xc2i['*\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "10799"
              }
            ],
            "repeated": 0,
            "id": 1329
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xcb\\xb22j\\xd01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "12760"
              }
            ],
            "repeated": 0,
            "id": 1330
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\r\\xee(p\\xd9\"\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8929"
              }
            ],
            "repeated": 0,
            "id": 1331
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xbf \\xc7E\"\n\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2602"
              }
            ],
            "repeated": 0,
            "id": 1332
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x1d \\xcc\\xf8\\xad\\x0b\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2997"
              }
            ],
            "repeated": 0,
            "id": 1333
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "D.\\xcbf\\x98\\x10\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4256"
              }
            ],
            "repeated": 0,
            "id": 1334
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x11\\xc2\\x85\\xf5j\\x10\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4210"
              }
            ],
            "repeated": 0,
            "id": 1335
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x1c\\xfb\\xe3]\\xd6\\x18\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6366"
              }
            ],
            "repeated": 0,
            "id": 1336
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xf3\\xedK\\xb4\\x80V\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "22152"
              }
            ],
            "repeated": 0,
            "id": 1337
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc1\\x03\\x9e\\xe1\\x996\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13985"
              }
            ],
            "repeated": 0,
            "id": 1338
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\unbcl.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x10303X3t3\\x943\\xb43\\xd43\\xfc304X4\\x804\\xa44\\xd04\\x1c5`5\\xc85\\xf45 6\\x906\\xe06P7\\xa87\\x188d8\\x908\\xe09H:\\xb0: ;x;\\xe8;8<\\xa0<\\x08=\\x8c=\\xc8=P>\\xa0>\\xf8>\\x00\\x00\\x00\\xe0\\x0b\\x00H\\x00\\x00\\x00\\xf80`1\\xb81\\x102h2\\xfc384\\x904\\x886\\xc86 7\\xa87\\xf07@:\\x98:\\xf0;X<\\xe0< =@=p=\\xec= >\\xc8>\\xec>\\x0c?0?P?\\xa4?\\xd4?\\xf4?\\x00\\x00\\x00\\xf0\\x0b\\x00`\\x00\\x00\\x00 0@0l0\\x880\\xa80\\xdc0\\x141@1|1\\xb81\\xd41\\xf81@2\\x882\\xc42\\xf82<3h3\\x903\\xb83\\x044@4x4\\xcc4\\x105h5\\xa05\\xe05\\x0c606T6\\x806\\xc86\\x087H7\\x887\\xb07\\x1c8@8p8\\xb48\\xd48\\xf88 9\\x00\\x00\\x0c\\x00\\x0c\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "9212"
              }
            ],
            "repeated": 0,
            "id": 1339
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000031c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\unbcl.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00=\\xeaoC\\x9d\\xd6\\x01\\x00=\\xeaoC\\x9d\\xd6\\x01\\x00=\\xeaoC\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1340
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 1341
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc8\\xcd\\x03\\x00\\xfc\\xa3\\x8c\\x00\\x00\\x00HQ\\\\x04  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1342
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc29\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1343
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "wdsclientapi.dll\\x008\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4  wdscore.dll\\x00H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02  wdscsl.dll\\x00\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02  wdsimage.dll\\x00\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04  wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02  wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3  wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05  MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl\\x05  SetupCore.dll\\x008\\xab\n\\x00\\xd4x\\xcb\\x01\\x00"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1344
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd39\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1345
          },
          {
            "timestamp": "2026-05-28 22:59:33,114",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1346
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1347
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc8\\xcd\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1348
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc8\\xcd\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1349
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc8\\xcd\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1350
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1351
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xbeH7\\x1d\\x943\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13212"
              }
            ],
            "repeated": 0,
            "id": 1352
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "bZ\\x19DK5\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13651"
              }
            ],
            "repeated": 0,
            "id": 1353
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa9\\xf9\\xab\\x113F\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17979"
              }
            ],
            "repeated": 0,
            "id": 1354
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "&\\x07\\x00T=A\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16709"
              }
            ],
            "repeated": 0,
            "id": 1355
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x9cx\\xdd;3<\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15419"
              }
            ],
            "repeated": 0,
            "id": 1356
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "e\\x84\\x87~.?\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16182"
              }
            ],
            "repeated": 0,
            "id": 1357
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xb4\\x19nN<P\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "20548"
              }
            ],
            "repeated": 0,
            "id": 1358
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll"
              },
              {
                "name": "Buffer",
                "value": "\\xa4\\x83\\x03\\x00\\xa8\\x86\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x8d\\x03\\x00t\\x81\\x03\\x00\\xb8\\x88\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xea\\x8d\\x03\\x00\\x84\\x83\\x03\\x00\\xa4\\x87\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00D\\x8e\\x03\\x00p\\x82\\x03\\x00\\xe4\\x86\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00^\\x8e\\x03\\x00\\xb0\\x81\\x03\\x00\\xf4\\x86\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00j\\x8e\\x03\\x00\\xc0\\x81\\x03\\x00\\x0c\\x87\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\x8e\\x03\\x00\\xd8\\x81\\x03\\x00\\x14\\x87\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd4\\x8e\\x03\\x00\\xe0\\x81\\x03\\x00\\xbc\\x86\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x8e\\x03\\x00\\x88\\x81\\x03\\x00\\xb4\\x86\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x8e\\x03\\x00\\x80\\x81\\x03\\x00\\xd4\\x87\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x96\\x8f\\x03\\x00\\xa0\\x82\\x03\\x00t\\x87\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x91\\x03\\x00@\\x82\\x03\\x00,\\x87\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00f\\x91\\x03\\x00\\xf8\\x81\\x03\\x00<\\x87\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "29124"
              }
            ],
            "repeated": 0,
            "id": 1359
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xd0\\xc7\\x84E\\x9d\\xd6\\x01\\x00\\xd0\\xc7\\x84E\\x9d\\xd6\\x01\\x00\\xd0\\xc7\\x84E\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1360
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 1361
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "8\\x13\\x03\\x00\\xc4q\\x90\\x00\\x00\\x00GQ\\xf5\\xa4  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1362
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xe39\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1363
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "wdscore.dll\\x00H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02  wdscsl.dll\\x00\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02  wdsimage.dll\\x00\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04  wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02  wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3  wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05  MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl\\x05  SetupCore.dll\\x008\\xab\n\\x00\\xd4x\\xcb\\x01\\x00\\x00HQh\\x05  SetupHost.exe\\x008g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQ"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1364
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xef9\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1365
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1366
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\wdscore.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1367
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdscore.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\x13\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1368
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdscore.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\x13\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1369
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdscore.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\x13\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1370
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdscore.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1371
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "{\\xd0\\xa9\\x03\\x8e&\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9878"
              }
            ],
            "repeated": 0,
            "id": 1372
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "Q\\xbc\\x01\\x9e\\x17A\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16671"
              }
            ],
            "repeated": 0,
            "id": 1373
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x04\\x94\\x89\\xf9lE\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17780"
              }
            ],
            "repeated": 0,
            "id": 1374
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa2\\x8f\\xc5\\x14%C\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17197"
              }
            ],
            "repeated": 0,
            "id": 1375
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xdc\\xbc\\x8dZ\\x0bC\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17171"
              }
            ],
            "repeated": 0,
            "id": 1376
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\t\\x9f(UCD\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17483"
              }
            ],
            "repeated": 0,
            "id": 1377
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x93 &1\\xf5G\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18429"
              }
            ],
            "repeated": 0,
            "id": 1378
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdscore.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x06\\x05+\\x0e\\x03\\x02\\x1a\\x03\\x15\\x00\\xf1\\xfd\\xf9\\x1d1jS\\xdc\\xf0\\x8a\\x12=\\x92\\xd9\\xac>\np0R\\xa0\\x81\\x830\\x81\\x80\\xa4~0|1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dMicrosoft Time-Stamp PCA 20100\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x05\\x05\\x00\\x02\\x05\\x00\\xe3(\\xe3\\xcc0\"\\x18\\x0f20201008090308Z\\x18\\x0f20201009090308Z0w0=\\x06\n+\\x06\\x01\\x04\\x01\\x84Y\n\\x04\\x011/0-0\n\\x02\\x05\\x00\\xe3(\\xe3\\xcc\\x02\\x01\\x000\n"
              },
              {
                "name": "Length",
                "value": "1276"
              }
            ],
            "repeated": 0,
            "id": 1379
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdscore.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00S.\\xa8$\\x9d\\xd6\\x01\\x00S.\\xa8$\\x9d\\xd6\\x01\\x00S.\\xa8$\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1380
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1381
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "H\\xc5\\x00\\x00\\xfc\\x84\\x93\\x00\\x00\\x00HQ{\\x02  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1382
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xff9\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1383
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "wdscsl.dll\\x00\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02  wdsimage.dll\\x00\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04  wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02  wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3  wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05  MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl\\x05  SetupCore.dll\\x008\\xab\n\\x00\\xd4x\\xcb\\x01\\x00\\x00HQh\\x05  SetupHost.exe\\x008g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05  SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00H"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1384
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\n:\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1385
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1386
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\wdscsl.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1387
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdscsl.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "H\\xc5\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1388
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdscsl.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "H\\xc5\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1389
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdscsl.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "H\\xc5\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1390
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdscsl.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1391
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc2\\x19E\\xfa7>\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15935"
              }
            ],
            "repeated": 0,
            "id": 1392
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdscsl.dll"
              },
              {
                "name": "Buffer",
                "value": "\\xe4\\xa1\\xbc\\xa4\\x00\\x10\\x89E\\xe0\\x8dE\\xe0P\\x8dE\\xe4P\\xffu\\x08\\xe8\\xc0\\x04\\x00\\x00\\x83\\xc4\\x0c\\x8b\\xf0\\x89u\\xdc\\x8bM\\xe4\\x89\r\\xc0\\xa4\\x00\\x10\\x8bM\\xe0\\x89\r\\xbc\\xa4\\x00\\x10\\xc7E\\xfc\\xfe\\xff\\xff\\xff\\xe8\\x15\\x00\\x00\\x00\\x8b\\xc6\\x8bM\\xf0d\\x89\r\\x00\\x00\\x00\\x00Y_^[\\xc9\\xc3\\x8bu\\xdcj\\x08\\xe8x\\x04\\x00\\x00Y\\xc3\\x8b\\xffU\\x8b\\xec\\xffu\\x08\\xe8P\\xff\\xff\\xff\\xf7\\xd8Y\\x1b\\xc0\\xf7\\xd8H]\\xc3\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xff%\\xd4\\xb1\\x00\\x10\\x8b\\xffU\\x8b\\xec]\\xe9\\xff\\xfe\\xff\\xff\\xff%\\xb4\\xb1\\x00\\x10\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xff%\\xb0\\xb1\\x00\\x10\\xff%\\xac\\xb1\\x00\\x10\\xcc\\xcc\\xcc\\xcc\\xff%\\xa8\\xb1\\x00\\x10\\xff%\\xa4\\xb1\\x00\\x10\\xff%\\xa0\\xb1\\x00\\x10\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\xcc\\x8b\\xffU\\x8b\\xecV\\x8b\\xf1\\xff\\x15|\\xb1\\x00\\x10\\xf6E\\x08\\x01t\\x07V\\xe8\\xef\\xf8\\xff\\xffY\\x8b\\xc6^]\\xc2\\x04\\x00\\xff%\\xcc\\xb1\\x00\\x10\\xff%\\x9c\\xb1\\x00\\x10\\xcc\\xcc\\x8b\\xffU\\x8b"
              },
              {
                "name": "Length",
                "value": "19012"
              }
            ],
            "repeated": 0,
            "id": 1393
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdscsl.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x89%kC\\x9d\\xd6\\x01\\x00\\x89%kC\\x9d\\xd6\\x01\\x00\\x89%kC\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1394
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1395
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd0q\\x0b\\x00DJ\\x94\\x00\\x00\\x00HQ\\x83\\x02  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1396
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1a:\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1397
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "wdsimage.dll\\x00\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04  wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02  wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3  wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05  MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl\\x05  SetupCore.dll\\x008\\xab\n\\x00\\xd4x\\xcb\\x01\\x00\\x00HQh\\x05  SetupHost.exe\\x008g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05  SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05  WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00H"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1398
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "':\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1399
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1400
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsimage.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1401
          },
          {
            "timestamp": "2026-05-28 22:59:33,129",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsimage.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd0q\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1402
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsimage.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd0q\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1403
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsimage.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd0q\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1404
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsimage.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1405
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xe3\\xd6\\xab8\\xb5'\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "10173"
              }
            ],
            "repeated": 0,
            "id": 1406
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xe1\\x13\\xe6\\xc0\\xce#\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9174"
              }
            ],
            "repeated": 0,
            "id": 1407
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc9\\x8a3\\x15<*\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "10820"
              }
            ],
            "repeated": 0,
            "id": 1408
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xea\\xdb\\x03\\xcc\\xa4<\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15532"
              }
            ],
            "repeated": 0,
            "id": 1409
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "eI4\\x92\\xa3D\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17579"
              }
            ],
            "repeated": 0,
            "id": 1410
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x16\\xa8\\xa7\\xa5IF\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18001"
              }
            ],
            "repeated": 0,
            "id": 1411
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "qm\\xa4a\\xa5H\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18605"
              }
            ],
            "repeated": 0,
            "id": 1412
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xaaB\\x1a\\xef\\xddG\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18405"
              }
            ],
            "repeated": 0,
            "id": 1413
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "q&\\xbb\\x03CE\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17739"
              }
            ],
            "repeated": 0,
            "id": 1414
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xf0*Z\\xb4\\x9bF\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18083"
              }
            ],
            "repeated": 0,
            "id": 1415
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "j\\xa2a\\x1awK\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "19327"
              }
            ],
            "repeated": 0,
            "id": 1416
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x87\\xceZ\\xa4\\x97H\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18591"
              }
            ],
            "repeated": 0,
            "id": 1417
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "8\\xb5R{\\x8a:\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14994"
              }
            ],
            "repeated": 0,
            "id": 1418
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xac\"\\xa2\\x1c\\xdc<\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15588"
              }
            ],
            "repeated": 0,
            "id": 1419
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xebd\\xd2\\xcagG\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18287"
              }
            ],
            "repeated": 0,
            "id": 1420
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc7\\x90(\\x13\\x19F\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17953"
              }
            ],
            "repeated": 0,
            "id": 1421
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "(\\xa2\\x9a\\xa6HG\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18256"
              }
            ],
            "repeated": 0,
            "id": 1422
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xf1\\xa7\\x1d\\xb3E\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17851"
              }
            ],
            "repeated": 0,
            "id": 1423
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa8\\xbe\\xf4fEB\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16973"
              }
            ],
            "repeated": 0,
            "id": 1424
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xe4\\xf0C\\xd7\\xb8D\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17600"
              }
            ],
            "repeated": 0,
            "id": 1425
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xe4\\xb7\\xbc\\xf65<\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15421"
              }
            ],
            "repeated": 0,
            "id": 1426
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "_\\x18\\x11T\\xf4Q\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "20988"
              }
            ],
            "repeated": 0,
            "id": 1427
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa2\\x14\\x03\\xc0K@\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16467"
              }
            ],
            "repeated": 0,
            "id": 1428
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsimage.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x918L9\n:B:\\xb7:\\xfb;\\x85=\\xb8=\\xc3=\r>;>l>\\xec>6?\\xf0?\\x00\\x00\\x00\\x00\\x08\\x008\\x00\\x00\\x00\\xaa0\\x7f1\\x06202X2\\x982\\xc02H3\\x054\\xac5\\xd45\\x006\\x846\t7/8t8\\x998\\xda8\\xff8s9\\xcc9i:\\x7f<D?\\x00\\x10\\x08\\x008\\x00\\x00\\x00\\x8a1\\x9a1\\xaa1\\xd51\\xf11\r2,222\\xd02\\xde2\\xf02\\xc57\\xa49\\xa89\\xac9\\xb09\\xb49\\xb89\\xbc9\\xc09\\xc49\\x9f:\\x0c<R<\\x00 \\x08\\x00<\\x00\\x00\\x00\\xe6002\\x972\\xa22\\xb22\\x143\\x076\\x8f6\\xc86\\xf47\\x038\\x8c8):\t;\\x1f;*;\\x14<8=b=m=\\xcc=\\x11>2>8>\\xb2?\\x00\\x00\\x000\\x08\\x00<\\x00\\x00\\x00\\x110+0n0\\x870C3\\xb33#4\\x934\\x035s5\\xcc546\\x1b757\\xbc7\\xec7.8\\xb08\\xdd8<9\\xdc9\\xcc;"
              },
              {
                "name": "Length",
                "value": "15380"
              }
            ],
            "repeated": 0,
            "id": 1429
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsimage.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x97LrC\\x9d\\xd6\\x01\\x00\\x97LrC\\x9d\\xd6\\x01\\x00\\x97LrC\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1430
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1431
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc0\\xdf\\x07\\x00\\x14\\xbc\\x9f\\x00\\x00\\x00HQS\\x04  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1432
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "7:\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1433
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "wdstptc.dll\\x00H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02  wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3  wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05  MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl\\x05  SetupCore.dll\\x008\\xab\n\\x00\\xd4x\\xcb\\x01\\x00\\x00HQh\\x05  SetupHost.exe\\x008g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05  SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05  WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03  pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1434
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "C:\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1435
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1436
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\wdstptc.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1437
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdstptc.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc0\\xdf\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1438
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdstptc.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc0\\xdf\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1439
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdstptc.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc0\\xdf\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1440
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdstptc.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1441
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "|\\xeew\\x9b]$\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9317"
              }
            ],
            "repeated": 0,
            "id": 1442
          },
          {
            "timestamp": "2026-05-28 22:59:33,145",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xf90\\x93\\x87\\xd6E\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17886"
              }
            ],
            "repeated": 0,
            "id": 1443
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "f\\xb4\\xfc\\xd3gE\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17775"
              }
            ],
            "repeated": 0,
            "id": 1444
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "D\\xde\\xfc\\x92\\xe4F\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18156"
              }
            ],
            "repeated": 0,
            "id": 1445
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "H\\x00\\x9ar\\xd4I\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18908"
              }
            ],
            "repeated": 0,
            "id": 1446
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x0f\\x9dyQ\\x1bE\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17699"
              }
            ],
            "repeated": 0,
            "id": 1447
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xef\\xa7\\xb6a^I\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18790"
              }
            ],
            "repeated": 0,
            "id": 1448
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\t\\xddnC\\xdaD\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17634"
              }
            ],
            "repeated": 0,
            "id": 1449
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x9b^\\x08d\\xe9J\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "19185"
              }
            ],
            "repeated": 0,
            "id": 1450
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xe8\\xf0P\\xcd\\xc2K\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "19402"
              }
            ],
            "repeated": 0,
            "id": 1451
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "m\\xbc\\xd1\\xe3pF\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18040"
              }
            ],
            "repeated": 0,
            "id": 1452
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xb5\\x92\\xe7cH\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18539"
              }
            ],
            "repeated": 0,
            "id": 1453
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "$\\[!\\x0bF\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17939"
              }
            ],
            "repeated": 0,
            "id": 1454
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "M\\x7f\\xb2Z\\xffC\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17415"
              }
            ],
            "repeated": 0,
            "id": 1455
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x97\\xee\\x90\\xc8\\x96P\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "20638"
              }
            ],
            "repeated": 0,
            "id": 1456
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x15U\\x82\\x7f\\xce6\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14038"
              }
            ],
            "repeated": 0,
            "id": 1457
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdstptc.dll"
              },
              {
                "name": "Buffer",
                "value": "\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1200\\x06\\x03U\\x04\\x03\\x13)Microsoft Root Certificate Authority 20100\\x1e\\x17\r100706204017Z\\x17\r250706205017Z0~1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft Code Signing PCA 20100\\x82"
              },
              {
                "name": "Length",
                "value": "7124"
              }
            ],
            "repeated": 0,
            "id": 1458
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdstptc.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00;\rzE\\x9d\\xd6\\x01\\x00;\rzE\\x9d\\xd6\\x01\\x00;\rzE\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1459
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000330"
              }
            ],
            "repeated": 0,
            "id": 1460
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "H\\x9f\\x03\\x00\\xd4\\x9b\\xa7\\x00\\x00\\x00HQ{\\x02  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1461
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "S:\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1462
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "wdsutil.dll\\x00H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3  wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05  MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl\\x05  SetupCore.dll\\x008\\xab\n\\x00\\xd4x\\xcb\\x01\\x00\\x00HQh\\x05  SetupHost.exe\\x008g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05  SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05  WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03  pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4  pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1463
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "_:\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1464
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1465
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsutil.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1466
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsutil.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "H\\x9f\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1467
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsutil.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "H\\x9f\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1468
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsutil.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "H\\x9f\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1469
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsutil.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1470
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xca0U\\xe1\\xe9;\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15345"
              }
            ],
            "repeated": 0,
            "id": 1471
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x7fZ\\xb9\\xc6\\xf4C\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17404"
              }
            ],
            "repeated": 0,
            "id": 1472
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xe3\\xab\\xf2\\x10@I\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18760"
              }
            ],
            "repeated": 0,
            "id": 1473
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\n\\xb7\\xa9\\xa6VA\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16734"
              }
            ],
            "repeated": 0,
            "id": 1474
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x06\\xe9\\x7f#\\xbb3\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13251"
              }
            ],
            "repeated": 0,
            "id": 1475
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x12\\xfa\\xb9\\xa8>-\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "11590"
              }
            ],
            "repeated": 0,
            "id": 1476
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xcc\\xffm\\xa0\\xf4<\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15612"
              }
            ],
            "repeated": 0,
            "id": 1477
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsutil.dll"
              },
              {
                "name": "Buffer",
                "value": "@5V5\\x845\\x905\\xbe5\\xcd5\\xe95\\x8a6\\xa06-7\\xa17\\x088N8\\x898\\x978\\xf58a:\\x9d:\t;\\x14;\\xc9;\\x0f<\\x18<,<7<o<\\xb5<\\xbc<\\xd8<\\xe1<\\x000\\x01\\x00X\\x00\\x00\\x00\\xd21\\xde1\\xe42R3\\x194 4\\xb74\\x175\\xe75E6\\xd06\\xda6\\xec6\\xf46\\x977\\xed7m8\\xc88\\xdf8\\xe58\\xf98\\x169$9\\xd69\\xde9O:\\x87:\\xb2:\\x19;`;\\xcc;\\xd3;'<E<[<\\xa2<\\xe9<\\x86=E>\\x00\\x00\\x00@\\x01\\x00\\xac\\x00\\x00\\x00s0\\x890\\xc30\\xe90\\xfe0@1\\xf11\\x042#2/2R2f2\\x912\\xbb2\\xe22\\xe82-3O3\\xef3\n4!4\\x854\\x9c7\\xf37\\xea8\\x1c9&9*9.92969:9>9B9F9J9N9R9V9Z9^9b9f9j9n9r9v9z9~9\\x829"
              },
              {
                "name": "Length",
                "value": "15132"
              }
            ],
            "repeated": 0,
            "id": 1478
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wdsutil.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x89%kC\\x9d\\xd6\\x01\\x00\\x89%kC\\x9d\\xd6\\x01\\x00\\x89%kC\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1479
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 1480
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "H\\x85\\x10\\x00\\x1c;\\xab\\x00\\x00\\x00GQ\\x87\\xa3  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1481
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "o:\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1482
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "wpx.dll\\x008\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05  MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl\\x05  SetupCore.dll\\x008\\xab\n\\x00\\xd4x\\xcb\\x01\\x00\\x00HQh\\x05  SetupHost.exe\\x008g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05  SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05  WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03  pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4  pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#\\x00\\x80CK\\xe4\\}t\\x1c\\xd5u\\x7fk\\x1bj\\x83\\x81\\x15\\x9f>\\x07\\x17\\xc6\\xa7\\x08\\x08A\\xaa"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1483
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "w:\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1484
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1485
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\wpx.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1486
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wpx.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "H\\x85\\x10\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1487
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wpx.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "H\\x85\\x10\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1488
          },
          {
            "timestamp": "2026-05-28 22:59:33,161",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wpx.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "H\\x85\\x10\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1489
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wpx.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1490
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd6\\x00\\xe9\\xe3\\xa8!\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8624"
              }
            ],
            "repeated": 0,
            "id": 1491
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x9a\\x93\\x07\\xb2R\\x13\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4954"
              }
            ],
            "repeated": 0,
            "id": 1492
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x88\\xfb=\\x90H\\x16\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "5712"
              }
            ],
            "repeated": 0,
            "id": 1493
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xb4<\\x1f\\xf4e\\x10\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4205"
              }
            ],
            "repeated": 0,
            "id": 1494
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc7\\xeb\\xa2\\x94X\\x12\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4704"
              }
            ],
            "repeated": 0,
            "id": 1495
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x8e/f4\\xf3\\x0f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4091"
              }
            ],
            "repeated": 0,
            "id": 1496
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\ne\\xfa$\\x8e\\x1b\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "7062"
              }
            ],
            "repeated": 0,
            "id": 1497
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "MH\\xe9\\xaa)>\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15921"
              }
            ],
            "repeated": 0,
            "id": 1498
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc8\\xd7\\x17\nx4\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13440"
              }
            ],
            "repeated": 0,
            "id": 1499
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xfb\\xfa\\xf1p\\xcb7\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14291"
              }
            ],
            "repeated": 0,
            "id": 1500
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x17\\x1d\\xe7\rn4\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13430"
              }
            ],
            "repeated": 0,
            "id": 1501
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x81\\xd4LL\\xc53\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13261"
              }
            ],
            "repeated": 0,
            "id": 1502
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xb4\\x8b\\x98\\xc2?B\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16967"
              }
            ],
            "repeated": 0,
            "id": 1503
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xb6\\xe4\\x0e\\xfc\\x94;\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15260"
              }
            ],
            "repeated": 0,
            "id": 1504
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x82&\\x8a\\x01\\xdb4\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13539"
              }
            ],
            "repeated": 0,
            "id": 1505
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "p\\xef\\xbc\\x8eN0\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "12374"
              }
            ],
            "repeated": 0,
            "id": 1506
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "Ox\\x87e\\x90O\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "20376"
              }
            ],
            "repeated": 0,
            "id": 1507
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x0b\\x8en\\xcb\\xd24\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13530"
              }
            ],
            "repeated": 0,
            "id": 1508
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "j&&\\xaa^+\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "11110"
              }
            ],
            "repeated": 0,
            "id": 1509
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xe6\\xbem\\xe7\\xc62\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13006"
              }
            ],
            "repeated": 0,
            "id": 1510
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x9f\\xc3\\x1d?\\xec.\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "12020"
              }
            ],
            "repeated": 0,
            "id": 1511
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "O\\x156\\xc2\\x9b;\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15267"
              }
            ],
            "repeated": 0,
            "id": 1512
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd6\\x7fl\\xfa&\\x1e\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "7726"
              }
            ],
            "repeated": 0,
            "id": 1513
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x01DC\\xaf\\xab+\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "11187"
              }
            ],
            "repeated": 0,
            "id": 1514
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x08)\\x02j\\xc0\t\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2504"
              }
            ],
            "repeated": 0,
            "id": 1515
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "[\\xf6\\x85Rs\\x06\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "1659"
              }
            ],
            "repeated": 0,
            "id": 1516
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xee$\\xa1}\\x90\\x06\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "1688"
              }
            ],
            "repeated": 0,
            "id": 1517
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "O\"P\\xf04\\x07\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "1852"
              }
            ],
            "repeated": 0,
            "id": 1518
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x87q]\\xee\\x13\\x04\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "1051"
              }
            ],
            "repeated": 0,
            "id": 1519
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc8\\xf5\\xd8U\\xdd\\x05\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "1509"
              }
            ],
            "repeated": 0,
            "id": 1520
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "/\\xc4\\xcc\\xd5q*\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "10873"
              }
            ],
            "repeated": 0,
            "id": 1521
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x01\\x13\\x03\\xc1#a\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "24875"
              }
            ],
            "repeated": 0,
            "id": 1522
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa2\\x91\\xedb\\xa44\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13484"
              }
            ],
            "repeated": 0,
            "id": 1523
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wpx.dll"
              },
              {
                "name": "Buffer",
                "value": "$9g9\\x949\\xbf9\\xf093:`:\\x8b:\\xbc:\\xdf:\n;-;b;\\x95;\\xb8;\\xe3;\\x0e<1<T<\\x97<\\xc2<\\xfd<0=k=\\x96=\\xc1=\\xe4=\\x07>*>]>\\x80>\\xa3>\\xce>\\xf9>$?G?b?\\x8d?\\xb8?\\xf3?\\x00\\x10\\x0b\\x00\\x90\\x00\\x00\\x00.0\\xbc0\\xdf0\\x021%1h1\\x951\\xb01\\xcb1\\xe61\t2\\x1b2L2w2\\xac2\\xe82\\x0b3>3\\xd63n4\\x994\\x1b5\\xb35\\xf85\\x1b6\\xc66\\xfb6d8\\x8f8\\xce8\\xf18\\x0c979R9m9\\xab9\\xfe9]:g:\\x88:\\xab:\\xd6:\\xf9:,;O;j;\\xd9;\\x1c<G<\\x8a<\\xb5<\\xe0<\\x03=F=s=\\xa6=\\xd1=\\x0c><>_>\\x8c>\\xb7>\\xda>Y?\\x84?\\xbf?\\xf2?\\x00\\x00\\x00 \\x0b\\x00\\x9c\\x00\\x00\\x00\r0@0c0\\x860\\xa90\\xfd0(1S1~1\\xb91\\xf41'2"
              },
              {
                "name": "Length",
                "value": "16484"
              }
            ],
            "repeated": 0,
            "id": 1524
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\wpx.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xdb\\x19\\x0e#\\x9d\\xd6\\x01\\x00\\xdb\\x19\\x0e#\\x9d\\xd6\\x01\\x00\\xdb\\x19\\x0e#\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1525
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 1526
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "8\\x91\\xee\\x00d\\xc0\\xbb\\x00\\x00\\x00HQ\\x96\\x05  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1527
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x87:\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1528
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "MediaSetupUIMgr.dll\\x008'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl\\x05  SetupCore.dll\\x008\\xab\n\\x00\\xd4x\\xcb\\x01\\x00\\x00HQh\\x05  SetupHost.exe\\x008g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05  SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05  WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03  pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4  pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#\\x00\\x80CK\\xe4\\}t\\x1c\\xd5u\\x7fk\\x1bj\\x83\\x81\\x15\\x9f>\\x07\\x17\\xc6\\xa7\\x08\\x08A\\xaal\\x8c\t_\\xadd\\xad,/\\xe8c\\xd1J\\xfe\\x08\\xa6x\\xb4;\\x92\\xc6\\x1e\\xcd\\xae"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1529
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x9b:\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1530
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1531
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1532
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\x91\\xee\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1533
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\x91\\xee\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1534
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\x91\\xee\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1535
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1536
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "j\\xadt\\x86\\x07'\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9999"
              }
            ],
            "repeated": 0,
            "id": 1537
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "^D\\xdc).\\x19\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6454"
              }
            ],
            "repeated": 0,
            "id": 1538
          },
          {
            "timestamp": "2026-05-28 22:59:33,176",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\0\\xd9IX\\x16\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "5728"
              }
            ],
            "repeated": 0,
            "id": 1539
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "T\\x82\\xf6\\xcd\\xa18\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14505"
              }
            ],
            "repeated": 0,
            "id": 1540
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc4\\xa6\\xdcR\\xf7:\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15103"
              }
            ],
            "repeated": 0,
            "id": 1541
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "y@\\xf5\\x9b\\x0fA\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16663"
              }
            ],
            "repeated": 0,
            "id": 1542
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xf4\\xfa\\x16\\x9e\\x99;\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15265"
              }
            ],
            "repeated": 0,
            "id": 1543
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xfe%\\xc3\\xcb~#\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9094"
              }
            ],
            "repeated": 0,
            "id": 1544
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xf7\\xe1\\x82k\\xe4;\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15340"
              }
            ],
            "repeated": 0,
            "id": 1545
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x81\\xfe\\xb6\\xac\\xa4>\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16044"
              }
            ],
            "repeated": 0,
            "id": 1546
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "3\\xcf%\\x1ev?\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16254"
              }
            ],
            "repeated": 0,
            "id": 1547
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x1bL\\xc5w%\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9599"
              }
            ],
            "repeated": 0,
            "id": 1548
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd9\\x7fO\\xf9\\xd6.\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "11998"
              }
            ],
            "repeated": 0,
            "id": 1549
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\J<zK)\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "10579"
              }
            ],
            "repeated": 0,
            "id": 1550
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "F\\x8f\\xa2d\\x9eX\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "22694"
              }
            ],
            "repeated": 0,
            "id": 1551
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x91\\x08\\xfc\\xe8\\xa0-\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "11688"
              }
            ],
            "repeated": 0,
            "id": 1552
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xdc\\x9c\\xf1\\xe7B\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1553
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd2\\xe9\\xf1\\xc2B\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1554
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd0\\xef\\xf1\\xbdB\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1555
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x07\\xd77\\xcbB\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1556
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xb2\\xefq\\xdbB\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1557
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xb0\\xe9\\x97\\xbdB\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1558
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x7f/\\xceSC\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "75"
              }
            ],
            "repeated": 0,
            "id": 1559
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xb4\\x89w\\xbdB\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1560
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd0\\x8f\\xf7\\xdbB\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1561
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x07\\xd77\\xadB\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1562
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd2\\xe9q\\xdbB\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1563
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "p\\xe0\\xf3]B\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1564
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa5\\xbfS\\xf2C\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "75"
              }
            ],
            "repeated": 0,
            "id": 1565
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xe7\\xe0\\x16\\xb2C\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "75"
              }
            ],
            "repeated": 0,
            "id": 1566
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "b\\x8f\\x17\\xd1C\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "75"
              }
            ],
            "repeated": 0,
            "id": 1567
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "8\\xa3\\x9b\\xcbC\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "75"
              }
            ],
            "repeated": 0,
            "id": 1568
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "{4\\xddCC\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "75"
              }
            ],
            "repeated": 0,
            "id": 1569
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "~G^<C\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "75"
              }
            ],
            "repeated": 0,
            "id": 1570
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x9c\\x9f7<B\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1571
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xf5M\\x95gA\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "73"
              }
            ],
            "repeated": 0,
            "id": 1572
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "K\\x9d\\x19+?\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "71"
              }
            ],
            "repeated": 0,
            "id": 1573
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "J\\xee\\x98N?\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "71"
              }
            ],
            "repeated": 0,
            "id": 1574
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "r\\xea\\xde\\xae?\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "71"
              }
            ],
            "repeated": 0,
            "id": 1575
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "]\\xf9\\xef\\B\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1576
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "&\\x8e\\x1bX?\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "71"
              }
            ],
            "repeated": 0,
            "id": 1577
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc6\\x8a\\xdd\\xb5?\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "71"
              }
            ],
            "repeated": 0,
            "id": 1578
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xffM\\x9b=?\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "71"
              }
            ],
            "repeated": 0,
            "id": 1579
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd0w\\xf0\\xbdB\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1580
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x07O\\xb6\\xd2B\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1581
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "Jp\\xf0\\xc2B\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1582
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "H\\xf6i\\xa4B\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1583
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x9e\\xce\\xafJB\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1584
          },
          {
            "timestamp": "2026-05-28 22:59:33,192",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xcb\\xe9q[B\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 1585
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd0\\xef\\xf1\\xbdB\\x00\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "676455"
              }
            ],
            "repeated": 0,
            "id": 1586
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00~A\\xe3F\\x9d\\xd6\\x01\\x00~A\\xe3F\\x9d\\xd6\\x01\\x00~A\\xe3F\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1587
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 1588
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "8'!\\x00\\x9cQ\\xaa\\x01\\x00\\x00HQl\\x05  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1589
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xab:\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1590
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "SetupCore.dll\\x008\\xab\n\\x00\\xd4x\\xcb\\x01\\x00\\x00HQh\\x05  SetupHost.exe\\x008g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05  SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05  WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03  pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4  pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#\\x00\\x80CK\\xe4\\}t\\x1c\\xd5u\\x7fk\\x1bj\\x83\\x81\\x15\\x9f>\\x07\\x17\\xc6\\xa7\\x08\\x08A\\xaal\\x8c\t_\\xadd\\xad,/\\xe8c\\xd1J\\xfe\\x08\\xa6x\\xb4;\\x92\\xc6\\x1e\\xcd\\xaeff-\tl\\x10\\x84&>\\xc4\\xa1\"\\xb1\\xc3\\x97\\xeb\\xa8\\x14\\x08\\xe1\\xd0T\\x84\\x94:\\xb4\\x05\\x05\\x9c\\x86\\x14Cd\\xe0\\xf4\\xb4"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1591
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb9:\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1592
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1593
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupCore.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1594
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupCore.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "8'!\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1595
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupCore.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "8'!\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1596
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupCore.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "8'!\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1597
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupCore.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1598
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "w\\x13\\x8c\\xd1\r:\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14869"
              }
            ],
            "repeated": 0,
            "id": 1599
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x7f1B\\xd7\\xbd$\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9413"
              }
            ],
            "repeated": 0,
            "id": 1600
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc9\\x98\\xcd\\xec\\xa5\\x10\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4269"
              }
            ],
            "repeated": 0,
            "id": 1601
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd4I\\xa3dz\\x0e\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "3714"
              }
            ],
            "repeated": 0,
            "id": 1602
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": ",\\xc6=\\xb9\\x08\\x10\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4112"
              }
            ],
            "repeated": 0,
            "id": 1603
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xfcy\\xda\\xa8\\xa6\\x0f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4014"
              }
            ],
            "repeated": 0,
            "id": 1604
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "j\\xbe\\xf4\\x10z\\x0b\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2946"
              }
            ],
            "repeated": 0,
            "id": 1605
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "m`\\xcc \\xdc\\x03\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "996"
              }
            ],
            "repeated": 0,
            "id": 1606
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x038K8\\xf8\\x07\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2048"
              }
            ],
            "repeated": 0,
            "id": 1607
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc9>\\xec\\x96\\xe9\\x1d\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "7665"
              }
            ],
            "repeated": 0,
            "id": 1608
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd65\\xe6\\x85\\x1d\\x1f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "7973"
              }
            ],
            "repeated": 0,
            "id": 1609
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x99\\x95{\\xe9\\x92,\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "11418"
              }
            ],
            "repeated": 0,
            "id": 1610
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x11\\x8es\"q \\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8313"
              }
            ],
            "repeated": 0,
            "id": 1611
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x81q5\\x1c\\x1e \\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8230"
              }
            ],
            "repeated": 0,
            "id": 1612
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xbc\\x8c\\x12L\\xe7\\x1e\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "7919"
              }
            ],
            "repeated": 0,
            "id": 1613
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xfe\\xea\\xda \\x8e\\x1f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8086"
              }
            ],
            "repeated": 0,
            "id": 1614
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": ".\\x1f\\xbb*\\x7f \\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8327"
              }
            ],
            "repeated": 0,
            "id": 1615
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x99\\xbe\\x84\\xdc\\xe0\\x1f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8168"
              }
            ],
            "repeated": 0,
            "id": 1616
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x1bN\\xee\"\\xa8\\x1f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8112"
              }
            ],
            "repeated": 0,
            "id": 1617
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\"D\\x1d\\xb9|\\x1f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8068"
              }
            ],
            "repeated": 0,
            "id": 1618
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "#\\x1d6Qj \\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8306"
              }
            ],
            "repeated": 0,
            "id": 1619
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd5{f\\x87\\xfd\\x1f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8197"
              }
            ],
            "repeated": 0,
            "id": 1620
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa8E\\x80\\xc3\\x0c!\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8468"
              }
            ],
            "repeated": 0,
            "id": 1621
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "u_u\\xa1\\xa5<\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15533"
              }
            ],
            "repeated": 0,
            "id": 1622
          },
          {
            "timestamp": "2026-05-28 22:59:33,332",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x05D\\xcb\\x8e]9\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14693"
              }
            ],
            "repeated": 0,
            "id": 1623
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xb8\\xb9O\\xff\\xd08\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14552"
              }
            ],
            "repeated": 0,
            "id": 1624
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xffW\\xd6\\xbb\\xba:\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15042"
              }
            ],
            "repeated": 0,
            "id": 1625
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xec\\x83\\xa8\\xce\\x94<\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15516"
              }
            ],
            "repeated": 0,
            "id": 1626
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa2t\\x0b\\xbbJ@\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16466"
              }
            ],
            "repeated": 0,
            "id": 1627
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xed\\xdd\\x98e\\x9f8\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14503"
              }
            ],
            "repeated": 0,
            "id": 1628
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "*#Y\\xc5-8\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14389"
              }
            ],
            "repeated": 0,
            "id": 1629
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": ">\\xfc\\xf2\\x9aq7\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14201"
              }
            ],
            "repeated": 0,
            "id": 1630
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x00fc\\xef\\x042\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "12812"
              }
            ],
            "repeated": 0,
            "id": 1631
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "@\\xc2U%\\xe4\\x17\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6124"
              }
            ],
            "repeated": 0,
            "id": 1632
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "s\\xf6\\xda\\x0e\\xd5=\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15837"
              }
            ],
            "repeated": 0,
            "id": 1633
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x8f\\xba]\\x10\\xc73\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13263"
              }
            ],
            "repeated": 0,
            "id": 1634
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa8\\x04}\\x84\\x93B\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17051"
              }
            ],
            "repeated": 0,
            "id": 1635
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "VD\\x11\\x99\\xe8H\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18672"
              }
            ],
            "repeated": 0,
            "id": 1636
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": ",\\xa0e\\xd3\\x8fB\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17047"
              }
            ],
            "repeated": 0,
            "id": 1637
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "1CE\\x06\\xb1D\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17593"
              }
            ],
            "repeated": 0,
            "id": 1638
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "?1\\x7f\\xef\\x9fD\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17575"
              }
            ],
            "repeated": 0,
            "id": 1639
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x0f\\xaa\\xc0\\xee\\xceG\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18390"
              }
            ],
            "repeated": 0,
            "id": 1640
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x1c\\x05\\xb9F\\x1bE\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17699"
              }
            ],
            "repeated": 0,
            "id": 1641
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc7P\\x15\\xdd{I\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18819"
              }
            ],
            "repeated": 0,
            "id": 1642
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x0b\\xda\\x8a\\xb2OH\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18519"
              }
            ],
            "repeated": 0,
            "id": 1643
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xdfq\\xe1\\xf9\\xe4H\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18668"
              }
            ],
            "repeated": 0,
            "id": 1644
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd4\\xa4*_\\x88L\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "19600"
              }
            ],
            "repeated": 0,
            "id": 1645
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "/\\xe3]bAE\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17737"
              }
            ],
            "repeated": 0,
            "id": 1646
          },
          {
            "timestamp": "2026-05-28 22:59:33,348",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "St:\\xee\\x05E\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17677"
              }
            ],
            "repeated": 0,
            "id": 1647
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xael\\xf6`\\xd7F\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "164620"
              }
            ],
            "repeated": 0,
            "id": 1648
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupCore.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00v\\x92\\xb3F\\x9d\\xd6\\x01\\x00v\\x92\\xb3F\\x9d\\xd6\\x01\\x00v\\x92\\xb3F\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1649
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 1650
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "8\\xab\n\\x00\\xd4x\\xcb\\x01\\x00\\x00HQh\\x05  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1651
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc9:\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1652
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "SetupHost.exe\\x008g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05  SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05  WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03  pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4  pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#\\x00\\x80CK\\xe4\\}t\\x1c\\xd5u\\x7fk\\x1bj\\x83\\x81\\x15\\x9f>\\x07\\x17\\xc6\\xa7\\x08\\x08A\\xaal\\x8c\t_\\xadd\\xad,/\\xe8c\\xd1J\\xfe\\x08\\xa6x\\xb4;\\x92\\xc6\\x1e\\xcd\\xaeff-\tl\\x10\\x84&>\\xc4\\xa1\"\\xb1\\xc3\\x97\\xeb\\xa8\\x14\\x08\\xe1\\xd0T\\x84\\x94:\\xb4\\x05\\x05\\x9c\\x86\\x14Cd\\xe0\\xf4\\xb4\t\\xa4\\x02\\x9a\\x03=\\xe1C\\xd0\\x96@J\\xa1\\xbf\\xfb\\xde\\x8cvvvfg$\\x1b\\xfe\\xa9|\\xde\\x9d\\xf7"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1653
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd7:\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1654
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1655
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1656
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\xab\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1657
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\xab\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1658
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\xab\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1659
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1660
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xfbjZ\\x8f\\x9d%\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9637"
              }
            ],
            "repeated": 0,
            "id": 1661
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": " \\x0c\\x1c\\x96\\x95\\x19\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6557"
              }
            ],
            "repeated": 0,
            "id": 1662
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x11\\xc6\\x7f\\x13E)\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "10573"
              }
            ],
            "repeated": 0,
            "id": 1663
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "3~-\\x1c\\x1c!\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8484"
              }
            ],
            "repeated": 0,
            "id": 1664
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x98I\\x1fOG:\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14927"
              }
            ],
            "repeated": 0,
            "id": 1665
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "i\\xb6\\x9f\\xb1\\xbe9\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14790"
              }
            ],
            "repeated": 0,
            "id": 1666
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "K\\xb1C_\\xb0>\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16056"
              }
            ],
            "repeated": 0,
            "id": 1667
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x87\\xaf\\x86d]C\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17253"
              }
            ],
            "repeated": 0,
            "id": 1668
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "!\\xd6hF\\xb1E\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17849"
              }
            ],
            "repeated": 0,
            "id": 1669
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xee\\xc7\\xc6\\xaa\\xd0A\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16856"
              }
            ],
            "repeated": 0,
            "id": 1670
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x16<\\xee\\x9aPH\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18520"
              }
            ],
            "repeated": 0,
            "id": 1671
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x0f\\x1b\\xaa>\\xdcG\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18404"
              }
            ],
            "repeated": 0,
            "id": 1672
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xf84'\\xf2\\x9dF\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18085"
              }
            ],
            "repeated": 0,
            "id": 1673
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "C\\x18C\\xb5\\x18I\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18720"
              }
            ],
            "repeated": 0,
            "id": 1674
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xdd\\xa8\\x1e\\xe2\\xf5K\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "19453"
              }
            ],
            "repeated": 0,
            "id": 1675
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x8b\\xffO\\x1b\\xb1J\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "19129"
              }
            ],
            "repeated": 0,
            "id": 1676
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "-7\\xf7\\xe5+D\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17459"
              }
            ],
            "repeated": 0,
            "id": 1677
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x04 D\\x94\\x17A\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16671"
              }
            ],
            "repeated": 0,
            "id": 1678
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x81\\x8e\\xfe\\xef\\xc3,\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "11467"
              }
            ],
            "repeated": 0,
            "id": 1679
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa0^\\x90\\x9bKQ\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "20819"
              }
            ],
            "repeated": 0,
            "id": 1680
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "s\\xf871oY\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "22903"
              }
            ],
            "repeated": 0,
            "id": 1681
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "&\\x99\\xc7T\\x1e.\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "11814"
              }
            ],
            "repeated": 0,
            "id": 1682
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.exe"
              },
              {
                "name": "Buffer",
                "value": "`0l0\\x8c0\\x940\\x9c0\\xa80\\xc80\\xd40\\xf40\\xfc0\\x041\\x0c1\\x141 1@1L1l1x1\\x981\\xa01\\xac1\\xcc1\\xd41\\xe01\\x002\\x082\\x102 2D2L2T2\\2d2l2t2|2\\x842\\x8c2\\x942\\x9c2\\xa42\\xac2\\xb42\\xbc2\\xc42\\xcc2\\xd42\\xdc2\\xe42\\xec2\\xf82\\x183 3,3L3X3x3\\x803\\x883\\x903\\x9c3\\xbc3\\xc83\\xe83\\xf03\\xfc3\\x1c4$4<4@4`4|4\\x804\\xa04\\xc04\\xe04\\x005\\x085\\x0c5(545T5`5\\x805\\x885\\xa85\\xc85\\xe85\\x046\\x086$6(6H6h6t6\\x946\\xb06\\xd06\\xdc6\\xfc6\\x047\\x1070787X7d7\\x847\\x907\\xb07\\xbc7\\xdc7\\xe87\\x088\\x108\\x188 8(80888D8d8\\x808\\xa08\\xc08\\xcc8\\xe88\\x089\\x149"
              },
              {
                "name": "Length",
                "value": "9228"
              }
            ],
            "repeated": 0,
            "id": 1683
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000334"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc2\\xcd\\xaeF\\x9d\\xd6\\x01\\x00\\xc2\\xcd\\xaeF\\x9d\\xd6\\x01\\x00\\xc2\\xcd\\xaeF\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1684
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 1685
          },
          {
            "timestamp": "2026-05-28 22:59:33,364",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "8g\\x0b\\x00\\x0c$\\xd6\\x01\\x00\\x00HQd\\x05  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1686
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xe7:\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1687
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "SetupMgr.dll\\x008\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05  WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03  pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4  pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#\\x00\\x80CK\\xe4\\}t\\x1c\\xd5u\\x7fk\\x1bj\\x83\\x81\\x15\\x9f>\\x07\\x17\\xc6\\xa7\\x08\\x08A\\xaal\\x8c\t_\\xadd\\xad,/\\xe8c\\xd1J\\xfe\\x08\\xa6x\\xb4;\\x92\\xc6\\x1e\\xcd\\xaeff-\tl\\x10\\x84&>\\xc4\\xa1\"\\xb1\\xc3\\x97\\xeb\\xa8\\x14\\x08\\xe1\\xd0T\\x84\\x94:\\xb4\\x05\\x05\\x9c\\x86\\x14Cd\\xe0\\xf4\\xb4\t\\xa4\\x02\\x9a\\x03=\\xe1C\\xd0\\x96@J\\xa1\\xbf\\xfb\\xde\\x8cvvvfg$\\x1b\\xfe\\xa9|\\xde\\x9d\\xf7q\\xdf}\\xf7\\xddw\\xdf\\xbd\\xf7\\xbd\\x99u\\xeb\\x97G\\xd9|\\xc6\\xd8\\x02\\xa4O?el?\\x13\\x7f\\xf5,"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1688
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xf4:\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1689
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1690
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1691
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "8g\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1692
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "8g\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1693
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "8g\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1694
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1695
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x0f[\\xdf\\x96\\x13\\x11\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4379"
              }
            ],
            "repeated": 0,
            "id": 1696
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xec\r$\\xf4\\x0e'\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "10006"
              }
            ],
            "repeated": 0,
            "id": 1697
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x9a\\x04\\x8e\\xa18%\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9536"
              }
            ],
            "repeated": 0,
            "id": 1698
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "*\\xcf~\\xd0\\xd4:\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15068"
              }
            ],
            "repeated": 0,
            "id": 1699
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "r6f\\xd2\\x956\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13981"
              }
            ],
            "repeated": 0,
            "id": 1700
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "*\\x9b\\xea\\xdfZ1\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "12642"
              }
            ],
            "repeated": 0,
            "id": 1701
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x12t\\x8c\\x04_9\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14695"
              }
            ],
            "repeated": 0,
            "id": 1702
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "T\\xca]\\xed\\xd0@\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16600"
              }
            ],
            "repeated": 0,
            "id": 1703
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xcc\\xcf\\xbe\t\\xb7D\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17599"
              }
            ],
            "repeated": 0,
            "id": 1704
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xf1\\xd7r\\x8e\\x84A\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16780"
              }
            ],
            "repeated": 0,
            "id": 1705
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x03\\x10\\xd8\\xd9\\xd1G\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18393"
              }
            ],
            "repeated": 0,
            "id": 1706
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xb2WL\\x1c\\xadE\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17845"
              }
            ],
            "repeated": 0,
            "id": 1707
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x87\\xd1\\xe7\\x9a\\xa6C\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17326"
              }
            ],
            "repeated": 0,
            "id": 1708
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "eH\\x94\\xb0\\xdfF\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18151"
              }
            ],
            "repeated": 0,
            "id": 1709
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\r'\\x1b\\x85\\x1dG\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18213"
              }
            ],
            "repeated": 0,
            "id": 1710
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "}\\xeeH3\\x0bH\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18451"
              }
            ],
            "repeated": 0,
            "id": 1711
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x14\\xdf\\xc9$;F\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17987"
              }
            ],
            "repeated": 0,
            "id": 1712
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xe046GrL\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "19578"
              }
            ],
            "repeated": 0,
            "id": 1713
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc1\\xd0\\x13\\xa1]K\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "19301"
              }
            ],
            "repeated": 0,
            "id": 1714
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x83\\xabb]U=\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15709"
              }
            ],
            "repeated": 0,
            "id": 1715
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd7\\xa0\\x04W\\xda(\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "10466"
              }
            ],
            "repeated": 0,
            "id": 1716
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": " \\xb1\\xc6\\xcbYa\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "24929"
              }
            ],
            "repeated": 0,
            "id": 1717
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": ";H\\xdc\\xfd6*\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "10814"
              }
            ],
            "repeated": 0,
            "id": 1718
          },
          {
            "timestamp": "2026-05-28 22:59:33,379",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll"
              },
              {
                "name": "Buffer",
                "value": "soft Corporation1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dMicrosoft Time-Stamp PCA 20100\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\xa9\\x1d\r\\xbcw\\x11\\x8a: \\xec\\xfc\\x13\\x97\\xf5\\xfa\\x7fi\\x94ktT\\x10\\xd5\\xa5\n\\x00\\x82\\x85\\xfb\\xed|hK,_\\xc5\\xc3\\xe5a\\xc2v\\xb7>f+[\\xf0\\x15S'\\x041\\x1fA\\x1b\\x1a\\x95\\x1d\\xce\t\\x13\\x8e|a0Y\\xb10D\\x0f\\xf1`\\x88\\x84TC\\x0c\\xd7M\\xb88\\x08\\xb3B\\xdd\\x93\\xac\\xd6s0W&\\x82\\xa3E\r\\xd0\\xea\\xf5G\\x81\\xcd\\xbf$`2X`F\\xf2XG\\x862\\x84\\x1etag\\x91_\\x81T\\xb1\\xcf\\x93L\\x92\\xc1\\xc4\\xa6]\\xd1a\\x13n(\\xc6\\x1a\\xf9\\x86\\x80\\xbb\\xdfa\\xfcF\\xc1'\\x1d$g\\x12r\\x1a!\\x8a\\xafKd\\x89Pb\\xb1]\\xfdw"
              },
              {
                "name": "Length",
                "value": "2884"
              }
            ],
            "repeated": 0,
            "id": 1719
          },
          {
            "timestamp": "2026-05-28 22:59:33,395",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x0e\t\\xaaF\\x9d\\xd6\\x01\\x00\\x0e\t\\xaaF\\x9d\\xd6\\x01\\x00\\x0e\t\\xaaF\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1720
          },
          {
            "timestamp": "2026-05-28 22:59:33,395",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000330"
              }
            ],
            "repeated": 0,
            "id": 1721
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "8\\xc9\\x11\\x00D\\x8b\\xe1\\x01\\x00\\x00HQl\\x05  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1722
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x04;\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1723
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "WinDlp.dll\\x008\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03  pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4  pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#\\x00\\x80CK\\xe4\\}t\\x1c\\xd5u\\x7fk\\x1bj\\x83\\x81\\x15\\x9f>\\x07\\x17\\xc6\\xa7\\x08\\x08A\\xaal\\x8c\t_\\xadd\\xad,/\\xe8c\\xd1J\\xfe\\x08\\xa6x\\xb4;\\x92\\xc6\\x1e\\xcd\\xaeff-\tl\\x10\\x84&>\\xc4\\xa1\"\\xb1\\xc3\\x97\\xeb\\xa8\\x14\\x08\\xe1\\xd0T\\x84\\x94:\\xb4\\x05\\x05\\x9c\\x86\\x14Cd\\xe0\\xf4\\xb4\t\\xa4\\x02\\x9a\\x03=\\xe1C\\xd0\\x96@J\\xa1\\xbf\\xfb\\xde\\x8cvvvfg$\\x1b\\xfe\\xa9|\\xde\\x9d\\xf7q\\xdf}\\xf7\\xddw\\xdf\\xbd\\xf7\\xbd\\x99u\\xeb\\x97G\\xd9|\\xc6\\xd8\\x02\\xa4O?el?\\x13\\x7f\\xf5,\\xfc\\xefC\\xa4\\xe3\\xcf|\\xfcx\\xf6\\xc3E\\xcf-\\xdb\\x1fkynYg\\x9fjJy#\\xd7k\\xc8"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1724
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x0f;\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1725
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1726
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\WinDlp.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1727
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\WinDlp.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\xc9\\x11\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1728
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\WinDlp.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\xc9\\x11\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1729
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\WinDlp.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\xc9\\x11\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1730
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\WinDlp.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1731
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xbd\\x83\\x1d\\x8a\\xea\\x0f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4082"
              }
            ],
            "repeated": 0,
            "id": 1732
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x1e,\n\\xd3a\r\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "3433"
              }
            ],
            "repeated": 0,
            "id": 1733
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "b)\\xe8\\xc5\\\\x19\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "6500"
              }
            ],
            "repeated": 0,
            "id": 1734
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": ".c\\x89\\x0e\\xc5\\x1f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8141"
              }
            ],
            "repeated": 0,
            "id": 1735
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xf0\\x97s\\x8f4.\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "11836"
              }
            ],
            "repeated": 0,
            "id": 1736
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x07U\\xca\\xed\\x8d9\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14741"
              }
            ],
            "repeated": 0,
            "id": 1737
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "}ez\\x94\n1\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "12562"
              }
            ],
            "repeated": 0,
            "id": 1738
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "G\\x11\\xdc>l4\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13428"
              }
            ],
            "repeated": 0,
            "id": 1739
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "(\\x03\\x9a\\x15\\x1f9\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14631"
              }
            ],
            "repeated": 0,
            "id": 1740
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd3\nL\\xb9<2\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "12868"
              }
            ],
            "repeated": 0,
            "id": 1741
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xae\\x16\\x1a\\x9b\\x84>\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16012"
              }
            ],
            "repeated": 0,
            "id": 1742
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xe4V\\xc2\\xb7Q;\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15193"
              }
            ],
            "repeated": 0,
            "id": 1743
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x8aH<c\\x10>\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15896"
              }
            ],
            "repeated": 0,
            "id": 1744
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xfc\\xddj\\xc3*?\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16178"
              }
            ],
            "repeated": 0,
            "id": 1745
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd7)ji\\xe9E\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17905"
              }
            ],
            "repeated": 0,
            "id": 1746
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": ",m\\xc3v\\x08D\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17424"
              }
            ],
            "repeated": 0,
            "id": 1747
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x1aX\\xa6\\x86:G\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18242"
              }
            ],
            "repeated": 0,
            "id": 1748
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "=\\xad\\xdb&\\x04E\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17676"
              }
            ],
            "repeated": 0,
            "id": 1749
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "lO\\xd3rzF\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18050"
              }
            ],
            "repeated": 0,
            "id": 1750
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\"\\xde\\xb1\\xac\\x84@\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16524"
              }
            ],
            "repeated": 0,
            "id": 1751
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x07qB\\xe2\\xbfG\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18375"
              }
            ],
            "repeated": 0,
            "id": 1752
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\n(\\xd0\\xc1\\xb2K\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "19386"
              }
            ],
            "repeated": 0,
            "id": 1753
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "P\\xd5\\xf9\\x80\\x11F\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17945"
              }
            ],
            "repeated": 0,
            "id": 1754
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "r\\xcc\\x92F\\xa8B\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17072"
              }
            ],
            "repeated": 0,
            "id": 1755
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xedn\\xaf\\x1cqF\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18041"
              }
            ],
            "repeated": 0,
            "id": 1756
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa4\\xb0\\xf2\\x9a\\xb6H\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18622"
              }
            ],
            "repeated": 0,
            "id": 1757
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xcah\\x07*jD\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "17522"
              }
            ],
            "repeated": 0,
            "id": 1758
          },
          {
            "timestamp": "2026-05-28 22:59:33,411",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "X\\x0ebG\\xd2J\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "19162"
              }
            ],
            "repeated": 0,
            "id": 1759
          },
          {
            "timestamp": "2026-05-28 22:59:33,426",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "P\\x98R\\xferL\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "19578"
              }
            ],
            "repeated": 0,
            "id": 1760
          },
          {
            "timestamp": "2026-05-28 22:59:33,426",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "^\\xd3/nu7\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14205"
              }
            ],
            "repeated": 0,
            "id": 1761
          },
          {
            "timestamp": "2026-05-28 22:59:33,426",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "b\\xc1u[\\xb0)\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "10680"
              }
            ],
            "repeated": 0,
            "id": 1762
          },
          {
            "timestamp": "2026-05-28 22:59:33,426",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x0b\\xe2\\xb4x\\x89\\x1d\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "7569"
              }
            ],
            "repeated": 0,
            "id": 1763
          },
          {
            "timestamp": "2026-05-28 22:59:33,426",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x96\\x19!\\x90\\x8a\\x16\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "5778"
              }
            ],
            "repeated": 0,
            "id": 1764
          },
          {
            "timestamp": "2026-05-28 22:59:33,426",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "e\\x9d\\xc7S\\xd0Q\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "20952"
              }
            ],
            "repeated": 0,
            "id": 1765
          },
          {
            "timestamp": "2026-05-28 22:59:33,426",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": ")\\x03\\xfdq4O\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "20284"
              }
            ],
            "repeated": 0,
            "id": 1766
          },
          {
            "timestamp": "2026-05-28 22:59:33,426",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\WinDlp.dll"
              },
              {
                "name": "Buffer",
                "value": "t\\x00\\x00\\x00\\x000\\x0e0\\xc40\\xcf0\\xdd0\\xf30k1r1\\x801\\x961\\xe71\\xee1\\x032\\x1a2\\x882\\x932\\x9a2\\xac2\\xb32N3U3r5|5\\xa3526Q6X6\\xce6>8I8W8\\xd58\\xe08\\xee8s9\\xd89\\xee9\\x0b:!:\\x85:\\xa6:\\xb2:\\xbd:\\xdb<\\x15=:>A>3?P?W?\\x93?\\x9e?\\xac?\\x00\\x00\\x00\\xb0\n\\x00|\\x00\\x00\\x00 0o0z0\\x880R1n1y1\\x801\\xaa1\\x7f2\\x8a2\\x982\\xc03\\xcb3\\xd93j4\\xa84\\xb34\\xba4\n5S6\\xa96\\xad6\\xb16\\xb56\\xb96\\xbd6\\xc16\\xc56\\xc96\\xcd6\\xfc6\\x077\\x157\\x8d7\\xa47\\xaf7\\xbd7\\xb38\\xbe8\\xcc8\\x86:\\x8d:`;d;\\x89<\\x90<\\x9e<\\xbe<\\xee=\\xf8=\\x0c>5>u>\\xea>\\x04?\\x17?\\x8e?\\x00\\xc0\n\\x00\\x84\\x00\\x00\\x00\\xe80{1\\x8a3\\x943\\xa83\\xfe3"
              },
              {
                "name": "Length",
                "value": "21628"
              }
            ],
            "repeated": 0,
            "id": 1767
          },
          {
            "timestamp": "2026-05-28 22:59:33,426",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000330"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\WinDlp.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00v\\x92\\xb3F\\x9d\\xd6\\x01\\x00v\\x92\\xb3F\\x9d\\xd6\\x01\\x00v\\x92\\xb3F\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1768
          },
          {
            "timestamp": "2026-05-28 22:59:33,426",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000330"
              }
            ],
            "repeated": 0,
            "id": 1769
          },
          {
            "timestamp": "2026-05-28 22:59:33,426",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "8\\x8f\r\\x00|T\\xf3\\x01\\x00\\x00HQ$\\x03  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1770
          },
          {
            "timestamp": "2026-05-28 22:59:33,426",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1f;\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1771
          },
          {
            "timestamp": "2026-05-28 22:59:33,426",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "pidgenx.dll\\x00(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4  pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#\\x00\\x80CK\\xe4\\}t\\x1c\\xd5u\\x7fk\\x1bj\\x83\\x81\\x15\\x9f>\\x07\\x17\\xc6\\xa7\\x08\\x08A\\xaal\\x8c\t_\\xadd\\xad,/\\xe8c\\xd1J\\xfe\\x08\\xa6x\\xb4;\\x92\\xc6\\x1e\\xcd\\xaeff-\tl\\x10\\x84&>\\xc4\\xa1\"\\xb1\\xc3\\x97\\xeb\\xa8\\x14\\x08\\xe1\\xd0T\\x84\\x94:\\xb4\\x05\\x05\\x9c\\x86\\x14Cd\\xe0\\xf4\\xb4\t\\xa4\\x02\\x9a\\x03=\\xe1C\\xd0\\x96@J\\xa1\\xbf\\xfb\\xde\\x8cvvvfg$\\x1b\\xfe\\xa9|\\xde\\x9d\\xf7q\\xdf}\\xf7\\xddw\\xdf\\xbd\\xf7\\xbd\\x99u\\xeb\\x97G\\xd9|\\xc6\\xd8\\x02\\xa4O?el?\\x13\\x7f\\xf5,\\xfc\\xefC\\xa4\\xe3\\xcf|\\xfcx\\xf6\\xc3E\\xcf-\\xdb\\x1fkynYg\\x9fjJy#\\xd7k\\xc8\\xfdRF\\xd6\\xf5\\x9c%u+\\x92Q\\xd0%U\\x97\\x12\\xedi\\xa9?\\x97Uj\\x8f;\\xee\\x98"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1772
          },
          {
            "timestamp": "2026-05-28 22:59:33,426",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "+;\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1773
          },
          {
            "timestamp": "2026-05-28 22:59:33,426",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1774
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\pidgenx.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1775
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\pidgenx.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\x8f\r\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1776
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\pidgenx.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\x8f\r\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1777
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\pidgenx.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\x8f\r\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1778
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\pidgenx.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1779
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "OZth\\xecJ\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "19188"
              }
            ],
            "repeated": 0,
            "id": 1780
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x81\\x02$M\\x85g\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "26509"
              }
            ],
            "repeated": 0,
            "id": 1781
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": ":\\xdc\\x96\\x97\\xe5>\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16109"
              }
            ],
            "repeated": 0,
            "id": 1782
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa2\\xb7\\x84\\x0f\\xf67\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "14334"
              }
            ],
            "repeated": 0,
            "id": 1783
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": ",\\xc3\\x9eq f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "26152"
              }
            ],
            "repeated": 0,
            "id": 1784
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x9cdX\\xe5\\x01f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "26121"
              }
            ],
            "repeated": 0,
            "id": 1785
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "Fz\\x1f\\xcc6`\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "24638"
              }
            ],
            "repeated": 0,
            "id": 1786
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x839C\n\\xcd1\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "12757"
              }
            ],
            "repeated": 0,
            "id": 1787
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x8e\\xaa\\xf5eS+\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "11099"
              }
            ],
            "repeated": 0,
            "id": 1788
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x81\\x9b*\\x92\\x105\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13592"
              }
            ],
            "repeated": 0,
            "id": 1789
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x85\\xd6|\\xeb4A\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "16700"
              }
            ],
            "repeated": 0,
            "id": 1790
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc7\\x0b\\xba\\xc3\\xef<\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "15607"
              }
            ],
            "repeated": 0,
            "id": 1791
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "k\\x92\\xff\\x1e?3\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13127"
              }
            ],
            "repeated": 0,
            "id": 1792
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x1f\\xe3\\xf0\\x88\\x882\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "12944"
              }
            ],
            "repeated": 0,
            "id": 1793
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x1e\\x83`\\xcdr(\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "10362"
              }
            ],
            "repeated": 0,
            "id": 1794
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd1\\x82\\xe1\\x98\\xc72\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13007"
              }
            ],
            "repeated": 0,
            "id": 1795
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "x\\xa0\\xbe\\xb4\\xa5!\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8621"
              }
            ],
            "repeated": 0,
            "id": 1796
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "(u\\xa7\\xa5\\x01.\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "11785"
              }
            ],
            "repeated": 0,
            "id": 1797
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa4\\xc0\\xd1\\xdb\\xd5#\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9181"
              }
            ],
            "repeated": 0,
            "id": 1798
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "R\\x90\\xa3h\\x19'\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "10017"
              }
            ],
            "repeated": 0,
            "id": 1799
          },
          {
            "timestamp": "2026-05-28 22:59:33,442",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xae\\xccF\\x9e\\xf7%\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "9727"
              }
            ],
            "repeated": 0,
            "id": 1800
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xd9\\xe0\\xe6!\\xa6*\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "10926"
              }
            ],
            "repeated": 0,
            "id": 1801
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": ">T\\x03\\xe1\\xd72\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "13023"
              }
            ],
            "repeated": 0,
            "id": 1802
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "!(\\xee\\xa0\\xbeS\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "21446"
              }
            ],
            "repeated": 0,
            "id": 1803
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\"\\xac\\x8aBIK\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "19281"
              }
            ],
            "repeated": 0,
            "id": 1804
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc6y\\xb4\\x91\\x84H\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "18572"
              }
            ],
            "repeated": 0,
            "id": 1805
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "Xc\\x99n\\xc6T\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "21710"
              }
            ],
            "repeated": 0,
            "id": 1806
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\pidgenx.dll"
              },
              {
                "name": "Buffer",
                "value": "&:4:h:\\xa0:\\xa7:\\xc6:\\xd1:\\xdf:\\x17;\\x1e;=;H;V;\\x8e;\\x95;\\xb4;\\xbf;\\xcd;\t<\\x10<\\x1f<&<p<{<\\x89<\\xc1<\\xc8<\\xe7<\\xf2<\\x00=8=?=^=i=w=\\xaf=\\xb6=\\xd5=\\xe0=\\xee=*>1>F>K>a>h>\\xa3>\\xae>\\xbc>\\xf4>\\xfb>\n?\\x15?+?2?R?]?k?\\xa3?\\xaa?\\xd3?\\xde?\\xef?\\x00\\x00\\x00`\\x07\\x00\\x10\\x01\\x00\\x00'0.0W0b0p0\\xa80\\xaf0\\xce0\\xd90\\xe70!1(171B1X1_1f1\\x891\\x941\\xc91\\xe41\\xff1\\x17222M2h2\\x832\\x9e2\\xb92\\xd42\\xef2\n3%3@3[3r3\\x893\\xa03\\xb73\\xce3\\xe53!4W4a4\\x974\\xa14\\xd74\\xe14\\x175!5W5a5\\x975\\xa15\\xd75\\xe15\\x176!6[6\\x956"
              },
              {
                "name": "Length",
                "value": "25524"
              }
            ],
            "repeated": 0,
            "id": 1807
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\pidgenx.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\"N&D\\x9d\\xd6\\x01\\x00\"N&D\\x9d\\xd6\\x01\\x00\"N&D\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1808
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1809
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "(\\xe4\\x08\\x00\\xb4\\xe3\\x00\\x02\\x00\\x00GQ)\\xa4  "
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1810
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": ";;\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1811
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "pkeyconfig.xrm-ms\\x00\\x16\\xc9m\\xf3Q#\\x00\\x80CK\\xe4\\}t\\x1c\\xd5u\\x7fk\\x1bj\\x83\\x81\\x15\\x9f>\\x07\\x17\\xc6\\xa7\\x08\\x08A\\xaal\\x8c\t_\\xadd\\xad,/\\xe8c\\xd1J\\xfe\\x08\\xa6x\\xb4;\\x92\\xc6\\x1e\\xcd\\xaeff-\tl\\x10\\x84&>\\xc4\\xa1\"\\xb1\\xc3\\x97\\xeb\\xa8\\x14\\x08\\xe1\\xd0T\\x84\\x94:\\xb4\\x05\\x05\\x9c\\x86\\x14Cd\\xe0\\xf4\\xb4\t\\xa4\\x02\\x9a\\x03=\\xe1C\\xd0\\x96@J\\xa1\\xbf\\xfb\\xde\\x8cvvvfg$\\x1b\\xfe\\xa9|\\xde\\x9d\\xf7q\\xdf}\\xf7\\xddw\\xdf\\xbd\\xf7\\xbd\\x99u\\xeb\\x97G\\xd9|\\xc6\\xd8\\x02\\xa4O?el?\\x13\\x7f\\xf5,\\xfc\\xefC\\xa4\\xe3\\xcf|\\xfcx\\xf6\\xc3E\\xcf-\\xdb\\x1fkynYg\\x9fjJy#\\xd7k\\xc8\\xfdRF\\xd6\\xf5\\x9c%u+\\x92Q\\xd0%U\\x97\\x12\\xedi\\xa9?\\x97Uj\\x8f;\\xee\\x98\\xb3l\\x1a\\x17\\x1cu\\xd2\\x1f\\x0cfw\\xe4\\x9d\\x949\\xe1\\x86\\x81\\x02\\x7f\\x0e\\x0f\\xf4\\xf0\\xba\\xed\\xf9g"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 1812
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "M;\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1813
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6b065",
            "parentcaller": "0x00c6cb60",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1814
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cb95",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1815
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cba7",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "(\\xe4\\x08\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1816
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "(\\xe4\\x08\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1817
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cbb2",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "(\\xe4\\x08\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1818
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cc07",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1819
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "}\\x9bPsT\\x0f\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "3932"
              }
            ],
            "repeated": 0,
            "id": 1820
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xee^^\\xcc\\xf2\r\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "3578"
              }
            ],
            "repeated": 0,
            "id": 1821
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x18\\xa6\\xe5\\xe6\\xfb\\x11\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4611"
              }
            ],
            "repeated": 0,
            "id": 1822
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc5\\xae\\xd8\\xbb\\xed\\x0e\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "3829"
              }
            ],
            "repeated": 0,
            "id": 1823
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "c>fd\\xed\t\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2549"
              }
            ],
            "repeated": 0,
            "id": 1824
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "`0\\xb7Q\\xd2\\x07\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2010"
              }
            ],
            "repeated": 0,
            "id": 1825
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x827I\\xea~\t\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2438"
              }
            ],
            "repeated": 0,
            "id": 1826
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xcdv\\x96tD\t\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2380"
              }
            ],
            "repeated": 0,
            "id": 1827
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x9c`T\\xf2@\t\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2376"
              }
            ],
            "repeated": 0,
            "id": 1828
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xa1C\\x14\\xfc\\x91\n\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2713"
              }
            ],
            "repeated": 0,
            "id": 1829
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "j\\xc2\\xe0\\xac\\x96\\x06\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "1694"
              }
            ],
            "repeated": 0,
            "id": 1830
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xeb\\xe3\\xe3\\xdd\\\\x0b\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2916"
              }
            ],
            "repeated": 0,
            "id": 1831
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "h\\x03\\x16\\xdc\\xa8\\x0b\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2992"
              }
            ],
            "repeated": 0,
            "id": 1832
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "#\\xf023\\x07\n\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "2575"
              }
            ],
            "repeated": 0,
            "id": 1833
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "RZ\\x85\\x016\\x11\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "4414"
              }
            ],
            "repeated": 0,
            "id": 1834
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\xc1\\xff_:,\\x17\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "5940"
              }
            ],
            "repeated": 0,
            "id": 1835
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x82\\x19\\xfa\\xc9N\\x02\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "598"
              }
            ],
            "repeated": 0,
            "id": 1836
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ccef",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000328"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "Buffer",
                "value": "\\x9b1\r\\xab\\xb3\\x01\\xdcG"
              },
              {
                "name": "Length",
                "value": "443"
              }
            ],
            "repeated": 0,
            "id": 1837
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cd2f",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms"
              },
              {
                "name": "Buffer",
                "value": "JZD5tc2Z0OnJtL2FsZ29yaXRobS9wa2V5LzIwMDk8L0FsZ29yaXRobUlkPg0KPFB1YmxpY0tleVZhbHVlPmJYTm1kRHB3YTJWNUx6SXdNRGt2WTNKNWNIUnZjSEp2Wm1sc1pTOW9iV0ZqTDNOb1lUSTFOZz09PC9QdWJsaWNLZXlWYWx1ZT4NCjwvUHVibGljS2V5Pg0KPFB1YmxpY0tleT4NCjxHcm91cElkPjM5ODg8L0dyb3VwSWQ+DQo8QWx"
              },
              {
                "name": "Length",
                "value": "18396"
              }
            ],
            "repeated": 0,
            "id": 1838
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ca72",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x93L\\xc3#\\x9d\\xd6\\x01\\x00\\x93L\\xc3#\\x9d\\xd6\\x01\\x00\\x93L\\xc3#\\x9d\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1839
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6ca7b",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1840
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cda0",
            "parentcaller": "0x00c6c7c9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "M;\\xb0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1841
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cddd",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000324"
              }
            ],
            "repeated": 0,
            "id": 1842
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cddd",
            "parentcaller": "0x00c6c7c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000328"
              }
            ],
            "repeated": 0,
            "id": 1843
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cc37",
            "parentcaller": "0x00c6c806",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x083a1000"
              },
              {
                "name": "RegionSize",
                "value": "0x0007b000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1844
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cc37",
            "parentcaller": "0x00c6c806",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c27000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001c000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1845
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cc37",
            "parentcaller": "0x00c6c806",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c17000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1846
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cc37",
            "parentcaller": "0x00c6c806",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c17000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1847
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cc37",
            "parentcaller": "0x00c6c806",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c27000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001c000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1848
          },
          {
            "timestamp": "2026-05-28 22:59:33,457",
            "thread_id": "5444",
            "caller": "0x00c6cc37",
            "parentcaller": "0x00c6c806",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c17000"
              },
              {
                "name": "RegionSize",
                "value": "0x0002c000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1849
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "5444",
            "caller": "0x00c46bd1",
            "parentcaller": "0x00c3b6eb",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\products.cab"
              }
            ],
            "repeated": 0,
            "id": 1850
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "5444",
            "caller": "0x00c3b71d",
            "parentcaller": "0x00c42263",
            "category": "windows",
            "api": "PostThreadMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessId",
                "value": "5448"
              },
              {
                "name": "ThreadId",
                "value": "1336"
              },
              {
                "name": "Message",
                "value": "33769"
              }
            ],
            "repeated": 0,
            "id": 1851
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "5444",
            "caller": "0x00c6beab",
            "parentcaller": "0x00c42263",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 1852
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "5444",
            "caller": "0x00c6be51",
            "parentcaller": "0x00c42263",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 1853
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "5444",
            "caller": "0x00c4ba53",
            "parentcaller": "0x00c44024",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Temp\\DUDownload"
              }
            ],
            "repeated": 0,
            "id": 1854
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "5444",
            "caller": "0x00c4ba53",
            "parentcaller": "0x00c44024",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc000003a",
            "pretty_return": "OBJECT_PATH_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\DUDownload\\Cab"
              }
            ],
            "repeated": 0,
            "id": 1855
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "5444",
            "caller": "0x00c4ba53",
            "parentcaller": "0x00c44024",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc000003a",
            "pretty_return": "OBJECT_PATH_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\DUDownload\\Setup"
              }
            ],
            "repeated": 0,
            "id": 1856
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "1336",
            "caller": "0x00c3aefe",
            "parentcaller": "0x00000000",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 1857
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "1336",
            "caller": "0x00c3aefe",
            "parentcaller": "0x00000000",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1858
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "5444",
            "caller": "0x00c49f75",
            "parentcaller": "0x00c48265",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "1",
                "pretty_value": "REG_CREATED_NEW_KEY"
              }
            ],
            "repeated": 0,
            "id": 1859
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "5444",
            "caller": "0x00c482de",
            "parentcaller": "0x00c447af",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1860
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "1336",
            "caller": "0x00c3aefe",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000328"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000118"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE"
              }
            ],
            "repeated": 0,
            "id": 1861
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "5444",
            "caller": "0x00c4475a",
            "parentcaller": "0x00c42754",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1862
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "1336",
            "caller": "0x00c3aefe",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000328"
              },
              {
                "name": "ValueName",
                "value": "LaunchUserOOBE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE"
              }
            ],
            "repeated": 0,
            "id": 1863
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "1336",
            "caller": "0x00c3aefe",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000328"
              }
            ],
            "repeated": 0,
            "id": 1864
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "5444",
            "caller": "0x00c49c56",
            "parentcaller": "0x00c47dc6",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 1865
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "5444",
            "caller": "0x00c47dee",
            "parentcaller": "0x00c44772",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "ValueName",
                "value": "ActionableCompat"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\ActionableCompat"
              }
            ],
            "repeated": 0,
            "id": 1866
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "5444",
            "caller": "0x00c47e2b",
            "parentcaller": "0x00c44772",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1867
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "5444",
            "caller": "0x00c4a0ea",
            "parentcaller": "0x00c461fd",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 1868
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "5444",
            "caller": "0x00c4623f",
            "parentcaller": "0x00c42768",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1869
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "5444",
            "caller": "0x00c4a045",
            "parentcaller": "0x00c4830d",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00000101",
                "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY"
              },
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 1870
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "1336",
            "caller": "0x00c3aefe",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d0"
              }
            ],
            "repeated": 0,
            "id": 1871
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "1336",
            "caller": "0x00c3aefe",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75c98000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1872
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "1336",
            "caller": "0x00c3aefe",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75c98000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1873
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "1336",
            "caller": "0x00c3aefe",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 1874
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "1336",
            "caller": "0x00c3aefe",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1875
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "1336",
            "caller": "0x00c3aefe",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1876
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "1336",
            "caller": "0x00c3aefe",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03c04000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1877
          },
          {
            "timestamp": "2026-05-28 22:59:33,473",
            "thread_id": "1336",
            "caller": "0x00c3aefe",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "oleaut32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76e60000"
              }
            ],
            "repeated": 0,
            "id": 1878
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c462a5",
            "parentcaller": "0x00c42768",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1879
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 1880
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1881
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 1882
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c427a8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9e\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1883
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c427a8",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x9e\\x06\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1884
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:33: Launching process: [C:\\$Windows.~WS\\Sources\\SetupHost.Exe] with command-line [/Download /Web  ] in Session: [-1]\r\n"
              },
              {
                "name": "Length",
                "value": "135"
              }
            ],
            "repeated": 0,
            "id": 1885
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c49c56",
            "parentcaller": "0x00c44713",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 1886
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c4475a",
            "parentcaller": "0x00c4280d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1887
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c49c56",
            "parentcaller": "0x00c47dc6",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 1888
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c47dee",
            "parentcaller": "0x00c44772",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "ValueName",
                "value": "SetupHostResult"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupHostResult"
              }
            ],
            "repeated": 0,
            "id": 1889
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c47e2b",
            "parentcaller": "0x00c44772",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1890
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c4a0ea",
            "parentcaller": "0x00c461fd",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 1891
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c4623f",
            "parentcaller": "0x00c42821",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1892
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c4a045",
            "parentcaller": "0x00c4830d",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00000101",
                "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY"
              },
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 1893
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c462a5",
            "parentcaller": "0x00c42821",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 1894
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c3e00a",
            "parentcaller": "0x00c42865",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000032c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\Device\\NamedPipe\\"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1895
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c3e00a",
            "parentcaller": "0x00c42865",
            "category": "synchronization",
            "api": "NtCreateNamedPipeFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NamedPipeHandle",
                "value": "0x00000328"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100100"
              },
              {
                "name": "PipeName",
                "value": "\\Device\\NamedPipe\\"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1896
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c3e00a",
            "parentcaller": "0x00c42865",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": ""
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1897
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 1898
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1899
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 1900
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c3e09b",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00%\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1901
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c3e09b",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "%\\x07\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1902
          },
          {
            "timestamp": "2026-05-28 22:59:33,786",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:33: Launching: [C:\\$Windows.~WS\\Sources\\SetupHost.Exe] [/Download /Web  ] from [C:\\$Windows.~WS\\Sources]!\r\n"
              },
              {
                "name": "Length",
                "value": "124"
              }
            ],
            "repeated": 0,
            "id": 1903
          },
          {
            "timestamp": "2026-05-28 22:59:33,817",
            "thread_id": "5444",
            "caller": "0x00c3e0c4",
            "parentcaller": "0x00c42865",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000324"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000002d0"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web  "
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "5932"
              }
            ],
            "repeated": 0,
            "id": 1904
          },
          {
            "timestamp": "2026-05-28 22:59:33,817",
            "thread_id": "5444",
            "caller": "0x00c3e0c4",
            "parentcaller": "0x00c42865",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\Wldp"
              },
              {
                "name": "DllBase",
                "value": "0x75310000"
              }
            ],
            "repeated": 0,
            "id": 1905
          },
          {
            "timestamp": "2026-05-28 22:59:33,817",
            "thread_id": "5444",
            "caller": "0x00c3e0c4",
            "parentcaller": "0x00c42865",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\windows.storage"
              },
              {
                "name": "DllBase",
                "value": "0x75340000"
              }
            ],
            "repeated": 0,
            "id": 1906
          },
          {
            "timestamp": "2026-05-28 22:59:33,817",
            "thread_id": "5444",
            "caller": "0x00c3e0c4",
            "parentcaller": "0x00c42865",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1907
          },
          {
            "timestamp": "2026-05-28 22:59:34,036",
            "thread_id": "5444",
            "caller": "0x00c3e0c4",
            "parentcaller": "0x00c42865",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 1908
          },
          {
            "timestamp": "2026-05-28 22:59:34,036",
            "thread_id": "5444",
            "caller": "0x00c3e0c4",
            "parentcaller": "0x00c42865",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\apphelp"
              },
              {
                "name": "DllBase",
                "value": "0x74cf0000"
              }
            ],
            "repeated": 0,
            "id": 1909
          },
          {
            "timestamp": "2026-05-28 22:59:34,036",
            "thread_id": "5444",
            "caller": "0x00c3e0c4",
            "parentcaller": "0x00c42865",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 1910
          },
          {
            "timestamp": "2026-05-28 22:59:34,036",
            "thread_id": "5444",
            "caller": "0x00c3e0c4",
            "parentcaller": "0x00c42865",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\apphelp.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x74cf0000"
              }
            ],
            "repeated": 0,
            "id": 1911
          },
          {
            "timestamp": "2026-05-28 22:59:34,036",
            "thread_id": "5444",
            "caller": "0x00c3e0c4",
            "parentcaller": "0x00c42865",
            "category": "process",
            "api": "CreateProcessW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web  "
              },
              {
                "name": "CreationFlags",
                "value": "0x00000400"
              },
              {
                "name": "ProcessId",
                "value": "5932"
              },
              {
                "name": "ThreadId",
                "value": "4312"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000324"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000002d0"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1912
          },
          {
            "timestamp": "2026-05-28 22:59:34,036",
            "thread_id": "5444",
            "caller": "0x00c3e10e",
            "parentcaller": "0x00c42865",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 1913
          },
          {
            "timestamp": "2026-05-28 22:59:34,036",
            "thread_id": "5444",
            "caller": "0x00c46136",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 1914
          },
          {
            "timestamp": "2026-05-28 22:59:34,036",
            "thread_id": "5444",
            "caller": "0x00c46161",
            "parentcaller": "0x00c370ad",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1915
          },
          {
            "timestamp": "2026-05-28 22:59:34,036",
            "thread_id": "5444",
            "caller": "0x00c46176",
            "parentcaller": "0x00c370ad",
            "category": "misc",
            "api": "SystemTimeToTzSpecificLocalTime",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 1916
          },
          {
            "timestamp": "2026-05-28 22:59:34,036",
            "thread_id": "5444",
            "caller": "0x00c3715d",
            "parentcaller": "0x00c3e1d6",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa1\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1917
          },
          {
            "timestamp": "2026-05-28 22:59:34,036",
            "thread_id": "5444",
            "caller": "0x00c371aa",
            "parentcaller": "0x00c3e1d6",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xa1\\x07\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1918
          },
          {
            "timestamp": "2026-05-28 22:59:34,036",
            "thread_id": "5444",
            "caller": "0x00c36ffa",
            "parentcaller": "0x00c37267",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34: Waiting for process events...\r\n"
              },
              {
                "name": "Length",
                "value": "52"
              }
            ],
            "repeated": 0,
            "id": 1919
          },
          {
            "timestamp": "2026-05-28 22:59:34,082",
            "thread_id": "5444",
            "caller": "0x00c45491",
            "parentcaller": "0x00c3e1e7",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 1920
          },
          {
            "timestamp": "2026-05-28 23:00:02,848",
            "thread_id": "8540",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1921
          },
          {
            "timestamp": "2026-05-28 23:00:02,848",
            "thread_id": "8540",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1922
          },
          {
            "timestamp": "2026-05-28 23:00:02,848",
            "thread_id": "8540",
            "caller": "0x77999924",
            "parentcaller": "0x76c1c2f8",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000334"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1923
          },
          {
            "timestamp": "2026-05-28 23:00:02,848",
            "thread_id": "8540",
            "caller": "0x76c1fc08",
            "parentcaller": "0x76c1fabd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c4"
              }
            ],
            "repeated": 0,
            "id": 1924
          },
          {
            "timestamp": "2026-05-28 23:00:02,848",
            "thread_id": "8544",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1925
          },
          {
            "timestamp": "2026-05-28 23:00:02,848",
            "thread_id": "8544",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1926
          },
          {
            "timestamp": "2026-05-28 23:00:32,520",
            "thread_id": "5220",
            "caller": "0x77b2b6b6",
            "parentcaller": "0x77af607c",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "12"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "5220"
              }
            ],
            "repeated": 0,
            "id": 1927
          },
          {
            "timestamp": "2026-05-28 23:00:32,520",
            "thread_id": "5220",
            "caller": "0x77b2b6d9",
            "parentcaller": "0x77af607c",
            "category": "threading",
            "api": "NtTerminateThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitStatus",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "0"
              },
              {
                "name": "ProcessId",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1928
          },
          {
            "timestamp": "2026-05-28 23:00:32,520",
            "thread_id": "5440",
            "caller": "0x77b2b6b6",
            "parentcaller": "0x77af607c",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "12"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "5440"
              }
            ],
            "repeated": 0,
            "id": 1929
          },
          {
            "timestamp": "2026-05-28 23:00:32,520",
            "thread_id": "5440",
            "caller": "0x77b2b6d9",
            "parentcaller": "0x77af607c",
            "category": "threading",
            "api": "NtTerminateThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitStatus",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "0"
              },
              {
                "name": "ProcessId",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1930
          },
          {
            "timestamp": "2026-05-28 23:01:46,536",
            "thread_id": "8544",
            "caller": "0x77b2b6b6",
            "parentcaller": "0x77af607c",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "12"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "8544"
              }
            ],
            "repeated": 0,
            "id": 1931
          },
          {
            "timestamp": "2026-05-28 23:01:46,536",
            "thread_id": "8544",
            "caller": "0x77b2b6d9",
            "parentcaller": "0x77af607c",
            "category": "threading",
            "api": "NtTerminateThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitStatus",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "0"
              },
              {
                "name": "ProcessId",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1932
          },
          {
            "timestamp": "2026-05-28 23:01:46,536",
            "thread_id": "8540",
            "caller": "0x77b2b6b6",
            "parentcaller": "0x77af607c",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "12"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "8540"
              }
            ],
            "repeated": 0,
            "id": 1933
          },
          {
            "timestamp": "2026-05-28 23:01:46,536",
            "thread_id": "8540",
            "caller": "0x7798ab1a",
            "parentcaller": "0x76c3d5f4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 1934
          },
          {
            "timestamp": "2026-05-28 23:01:46,536",
            "thread_id": "8540",
            "caller": "0x7798ab1a",
            "parentcaller": "0x76c3d676",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 1935
          },
          {
            "timestamp": "2026-05-28 23:01:46,536",
            "thread_id": "8540",
            "caller": "0x77b2b6d9",
            "parentcaller": "0x77af607c",
            "category": "threading",
            "api": "NtTerminateThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitStatus",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "0"
              },
              {
                "name": "ProcessId",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1936
          }
        ],
        "threads": [
          "5444",
          "440",
          "448",
          "5556",
          "4584",
          "1336",
          "8540",
          "8544",
          "5220",
          "5440"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "DESKTOP-HGH2VBT",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "\"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\" ",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x00c20000",
          "MainExeSize": "0x00b0a000",
          "Bitness": "32-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 5932,
        "process_name": "SetupHost.Exe",
        "parent_id": 5448,
        "module_path": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe",
        "first_seen": "2026-05-28 22:59:34,066",
        "calls": [
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x6b477ac2",
            "parentcaller": "0x6b4789d4",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Compression"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Compression"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x6b477ac2",
            "parentcaller": "0x6b4789d4",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\cabinet"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b470000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6b477ec0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4136",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4136",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4152",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4152",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "3884",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "3884",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "5096",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "5096",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00faf03b",
            "parentcaller": "0x00fae857",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x00faefe0"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00fae7ca",
            "parentcaller": "0x00fae88b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0309d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00fae7ca",
            "parentcaller": "0x00fae88b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03323000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00fae7ca",
            "parentcaller": "0x00fae88b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03324000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f5d325",
            "parentcaller": "0x00f41655",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f5d344",
            "parentcaller": "0x00f41655",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventRegister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77aee100"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f5d357",
            "parentcaller": "0x00f41655",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventUnregister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b19a30"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f5d36a",
            "parentcaller": "0x00f41655",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b26b30"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f5d37d",
            "parentcaller": "0x00f41655",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventWrite"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b21320"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00fae568",
            "parentcaller": "0x00f41785",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "advapi32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75b50000"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00fae58f",
            "parentcaller": "0x00f41785",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75b50000"
              },
              {
                "name": "FunctionName",
                "value": "EventWrite"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b21320"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00fae5a4",
            "parentcaller": "0x00f41785",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75b50000"
              },
              {
                "name": "FunctionName",
                "value": "EventRegister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77aee100"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00fae5b9",
            "parentcaller": "0x00f41785",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75b50000"
              },
              {
                "name": "FunctionName",
                "value": "EventUnregister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b19a30"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f53dd7",
            "parentcaller": "0x00f5424b",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x03071d14",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web  "
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f5424b",
            "parentcaller": "0x00fae926",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76497000"
              },
              {
                "name": "ModuleName",
                "value": "SHELL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f5424b",
            "parentcaller": "0x00fae926",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76497000"
              },
              {
                "name": "ModuleName",
                "value": "SHELL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f53dde",
            "parentcaller": "0x00f5424b",
            "category": "misc",
            "api": "CommandLineToArgvW",
            "status": true,
            "return": "0x03097238",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web  "
              },
              {
                "name": "NumArgs",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f506ef",
            "parentcaller": "0x00f53e09",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0309e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000dc"
              },
              {
                "name": "ValueName",
                "value": "000603xx"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "kernel32.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x75d30000"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              },
              {
                "name": "FunctionName",
                "value": "SortGetHandle"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x75d4eb20"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              },
              {
                "name": "FunctionName",
                "value": "SortCloseHandle"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x75d497e0"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002b8"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002b4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x063d0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00e3f244"
              },
              {
                "name": "ViewSize",
                "value": "0x00338000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b4"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f50754",
            "parentcaller": "0x00f53e09",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "en"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b1f4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Handle",
                "value": "0x000002b4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00f53e27",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b4"
              },
              {
                "name": "ValueName",
                "value": "CmdLine"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CmdLine"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f5b2ba",
            "parentcaller": "0x00f53e27",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b4"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f53f5a",
            "parentcaller": "0x00f5424b",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x03071d14",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web  "
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f53f61",
            "parentcaller": "0x00f5424b",
            "category": "misc",
            "api": "CommandLineToArgvW",
            "status": true,
            "return": "0x0308cee8",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web  "
              },
              {
                "name": "NumArgs",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x0000001e"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "42"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "4312"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002ac"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002a4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e90000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0000f000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e9c000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e99000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e99000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e99000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e99000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x74e90000"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0xfffffffffb47e101",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\kernel.appcore"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e90000"
              },
              {
                "name": "InitRoutine",
                "value": "0x74e947e0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "bcryptPrimitives.dll"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002a4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76ba0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0005f000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76bfa000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76bfa000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76bfa000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76bfa000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\Windows\\System32\\bcryptPrimitives.dll"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\bcryptPrimitives.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptPrimitives"
              },
              {
                "name": "DllBase",
                "value": "0x76ba0000"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002d0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002d0"
              },
              {
                "name": "ValueName",
                "value": "STE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d0"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002d0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002d0"
              },
              {
                "name": "ValueName",
                "value": "Enabled"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002d4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002d4"
              },
              {
                "name": "ValueName",
                "value": "FipsAlgorithmPolicy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002d0"
              },
              {
                "name": "ValueName",
                "value": "MDMEnabled"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d0"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d4"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002d4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\Device\\CNG"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000002d4"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390008",
                "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x0eB\\xc3\\\\x13\\xcb\\x13\\xa9\\xa4M\\x86[\\x9a\\xad\\xd85\\xbf\\xb6gR\\x94\\x9b\\x00?\\x06\\xe8\\x11\\xf3\\x91)\\xb9l\\xfc4@\\xd8e\\xbe}\\xfc\\x1b\\x16KZ\\xa7\\x88hG"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\bcryptprimitives"
              },
              {
                "name": "BaseAddress",
                "value": "0x76ba0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x76bd36c0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76cb2000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76cb2000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f8f5",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0309f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af2470"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b341e0"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af0700"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b253f0"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "164"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030a3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030a4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\OLE\\AppCompat"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "RaiseActivationAuthenticationLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002c8"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "20"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "18"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xf0\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xf4\\xf0\\xe3\\x00\\x00\\x00\\x00\\x00\\xa8\\xf0\\xe3\\x00\\xa3\\x86<w\\xc8\\x02\\x00\\x00\\x12\\x00\\x00\\x00\\xc0\\xf0\\xe3\\x00\\x04\\x00\\x00\\x00\\xa4\\xf0\\xe3\\x00\\xc8\\x02\\x00\\x00\\x04\\x00\\x00\\x00\\xd0\\xf0\\xe3\\x00\\x0f\\x86<w(\\xf1\\xe3\\x00\\x00\\x00\\x00\\x00\\x18\\xf1\\xe3\\x00"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\User\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e6"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e6"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002e6"
              },
              {
                "name": "ObjectAttributesName",
                "value": "AppID\\SetupHost.Exe"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\AppID\\SetupHost.Exe"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\AppID\\SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e6"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002e6"
              },
              {
                "name": "ObjectAttributesName",
                "value": "AppID\\SetupHost.Exe"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\AppID\\SetupHost.Exe"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\AppID\\SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\xf4\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x98w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xf5\\xe3\\x00\\x0b\\x04\\x98w\\xc8\\x02\\x00\\x00\\xfd\nEc\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f4f932",
            "parentcaller": "0x00f542f3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f58f29",
            "parentcaller": "0x00f542f3",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              }
            ],
            "repeated": 1,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f58e4e",
            "parentcaller": "0x00f4fb22",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f58e4e",
            "parentcaller": "0x00f4fb22",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f58e4e",
            "parentcaller": "0x00f4fb22",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f58e66",
            "parentcaller": "0x00f4fb22",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:59:34,113",
            "thread_id": "4312",
            "caller": "0x00f58e77",
            "parentcaller": "0x00f4fb22",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5e40b",
            "parentcaller": "0x00f4fb33",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5e436",
            "parentcaller": "0x00f4fb33",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000002ec"
              },
              {
                "name": "IoControlCode",
                "value": "0x0009c040"
              },
              {
                "name": "InBuffer",
                "value": "\\x02\\x00"
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5e452",
            "parentcaller": "0x00f4fb33",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f4f5de",
            "parentcaller": "0x00f4fb72",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc000003a",
            "pretty_return": "OBJECT_PATH_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\inf\\setup.cfg"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f436c9",
            "parentcaller": "0x00f4fb81",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03325000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b1f4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate"
              },
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00f4297a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "ValueName",
                "value": "SusClientId"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00f4297a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "ValueName",
                "value": "SusClientId"
              },
              {
                "name": "Data",
                "value": "0e9cfb40-0d63-45be-b169-515d335337a8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5b2ba",
            "parentcaller": "0x00f4297a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b1f4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00f4298e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "ValueName",
                "value": "TestId"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\TestId"
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5b2ba",
            "parentcaller": "0x00f4298e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f42999",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\winbrand"
              },
              {
                "name": "DllBase",
                "value": "0x6af00000"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f42999",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "winbrand.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x6af00000"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429b1",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "winbrand.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6af00000"
              },
              {
                "name": "FunctionName",
                "value": "BrandingFormatString"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6af11210"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b32f00"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc000003a",
            "pretty_return": "OBJECT_PATH_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Branding\\Basebrd\\Basebrd.dll"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002ec"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06710000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0016a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06710000"
              },
              {
                "name": "RegionSize",
                "value": "0x0016a000"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc000003a",
            "pretty_return": "OBJECT_PATH_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Branding\\Basebrd\\Basebrd.dll"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002f0"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002ec"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06710000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0016a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\en-US\\Basebrd.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002ec"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\en-US\\basebrd.dll.mui"
              }
            ],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00f00000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00e3b528"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wldp"
              },
              {
                "name": "DllBase",
                "value": "0x75310000"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "wldp.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x75310000"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "wldp.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75310000"
              },
              {
                "name": "FunctionName",
                "value": "WldpQueryWindowsLockdownMode"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x75317dd0"
              }
            ],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "164"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b1f560"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wldp"
              },
              {
                "name": "DllBase",
                "value": "0x75310000"
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75310000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af2470"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b341e0"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af0700"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b2c3b0"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b253f0"
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b1f560"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5932:168:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 1,
            "id": 213
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00f00000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06710000"
              },
              {
                "name": "RegionSize",
                "value": "0x0016a000"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030a7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b32f00"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00J\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ec"
              },
              {
                "name": "ValueName",
                "value": "en-AU"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU"
              }
            ],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ec"
              },
              {
                "name": "ValueName",
                "value": "en-AU"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU"
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "en-AU"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f429ce",
            "parentcaller": "0x00f4fd15",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "en"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f42a11",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f9e91a",
            "parentcaller": "0x00f9e880",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f9e91a",
            "parentcaller": "0x00f9e880",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f9e91a",
            "parentcaller": "0x00f9e880",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f9e95b",
            "parentcaller": "0x00f9e880",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f9e95b",
            "parentcaller": "0x00f9e880",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f9e95b",
            "parentcaller": "0x00f9e880",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5d1db",
            "parentcaller": "0x00f5b2e9",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5b362",
            "parentcaller": "0x00f42fe5",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b0da",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5b104",
            "parentcaller": "0x00f43009",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "ValueName",
                "value": "CorrelationVector"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CorrelationVector"
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5b141",
            "parentcaller": "0x00f43009",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b170",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5b197",
            "parentcaller": "0x00f58b97",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "ValueName",
                "value": "CorrelationVector"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Buffer",
                "value": "Q9F6wPhP0U6xT2M8.0"
              },
              {
                "name": "BufferLength",
                "value": "38"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CorrelationVector"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f5b1cc",
            "parentcaller": "0x00f58b97",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f40927",
            "parentcaller": "0x00f408f7",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "api-ms-win-eventing-provider-l1-1-0.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77870000"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f4094e",
            "parentcaller": "0x00f408f7",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77870000"
              },
              {
                "name": "FunctionName",
                "value": "EventSetInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af0b00"
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f42abb",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlUnregisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77aeb500"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f42abb",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlUnsubscribeWnfNotificationWaitForCompletion"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b1ea80"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f42abb",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000008c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f42abb",
            "parentcaller": "0x00f4fd15",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000008c"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f42abb",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f42abb",
            "parentcaller": "0x00f4fd15",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\winbrand"
              },
              {
                "name": "DllBase",
                "value": "0x6af00000"
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f42abb",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f42abb",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f42abb",
            "parentcaller": "0x00f4fd15",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6af00000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa29c9",
            "parentcaller": "0x00f9f72e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "kernel32"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa29d9",
            "parentcaller": "0x00f9f72e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              },
              {
                "name": "FunctionName",
                "value": "AddVectoredExceptionHandler"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77aeb0e0"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2ab9",
            "parentcaller": "0x00f9f72e",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\dbghelp"
              },
              {
                "name": "DllBase",
                "value": "0x6ada0000"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2ab9",
            "parentcaller": "0x00f9f72e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-processthreads-l1-1-2.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x75d30000"
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2ab9",
            "parentcaller": "0x00f9f72e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-file-l1-2-1.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77870000"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2ab9",
            "parentcaller": "0x00f9f72e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\dbghelp.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x6ada0000"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2ab9",
            "parentcaller": "0x00f9f72e",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x6ada0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\dbghelp.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2adc",
            "parentcaller": "0x00f9f72e",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\dbgcore"
              },
              {
                "name": "DllBase",
                "value": "0x6ad70000"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2adc",
            "parentcaller": "0x00f9f72e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-processthreads-l1-1-2.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x75d30000"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2adc",
            "parentcaller": "0x00f9f72e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "dbghelp.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6ada0000"
              },
              {
                "name": "FunctionName",
                "value": "MiniDumpWriteDump"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6ad7b910"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f611a6",
            "parentcaller": "0x00f9eda3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00f611a6",
            "parentcaller": "0x00f9eda3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa207c",
            "parentcaller": "0x00fa27b4",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa209e",
            "parentcaller": "0x00fa27b4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa20e7",
            "parentcaller": "0x00fa27b4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\x1d\t\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa224c",
            "parentcaller": "0x00fa27b4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa27d9",
            "parentcaller": "0x00f9f761",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "MutexName",
                "value": "Global\\WdsSetupLogInit"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa27ee",
            "parentcaller": "0x00f9f761",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2dce",
            "parentcaller": "0x00fa45ef",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030a9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa207c",
            "parentcaller": "0x00fa27b4",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa209e",
            "parentcaller": "0x00fa27b4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa20e7",
            "parentcaller": "0x00fa27b4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "P\\x1c\t\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa224c",
            "parentcaller": "0x00fa27b4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa27d9",
            "parentcaller": "0x00fa2f53",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "MutexName",
                "value": "Global\\SetupLog"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa27ee",
            "parentcaller": "0x00fa2f53",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa207c",
            "parentcaller": "0x00fa2815",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000300"
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa209e",
            "parentcaller": "0x00fa2815",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa20e7",
            "parentcaller": "0x00fa2815",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe0\\x19\t\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa224c",
            "parentcaller": "0x00fa2815",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2844",
            "parentcaller": "0x00fa51fe",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000300"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0007",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE"
              },
              {
                "name": "ObjectAttributes",
                "value": "Global\\SetupLogSection"
              },
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa22f8",
            "parentcaller": "0x00fa5219",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000300"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00f00000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00e3e5f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00008000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2f9d",
            "parentcaller": "0x00fa45ff",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030aa000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa52a1",
            "parentcaller": "0x00fa2cca",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030ad000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00f9fd50",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa207c",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000304"
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa209e",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa20e7",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x1b\t\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa224c",
            "parentcaller": "0x00fa289b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000304"
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa28ce",
            "parentcaller": "0x00fa5369",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa207c",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000304"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa209e",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa20e7",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x1b\t\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa224c",
            "parentcaller": "0x00fa289b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000304"
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa28ce",
            "parentcaller": "0x00fa53d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000304"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000304"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000304"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa6293",
            "parentcaller": "0x00fa36bc",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000304"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa52a1",
            "parentcaller": "0x00fa2b83",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030ae000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00f9fe51",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00f9ff2f",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa207c",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000308"
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa209e",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa20e7",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\x1a\t\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa224c",
            "parentcaller": "0x00fa289b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000308"
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa28ce",
            "parentcaller": "0x00fa5369",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa207c",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000308"
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa209e",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa20e7",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x1b\t\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa224c",
            "parentcaller": "0x00fa289b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000308"
              }
            ],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa28ce",
            "parentcaller": "0x00fa53d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000308"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000308"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000308"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa6293",
            "parentcaller": "0x00fa36bc",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000308"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 321
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000308"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000308"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xfeff"
              },
              {
                "name": "Length",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-05-28 22:59:34,128",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000308"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000308"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000308"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "Buffer",
                "value": "<xml xmlns:s=\"uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882\"\n xmlns:dt=\"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882\"\n xmlns:rs=\"urn:schemas-microsoft-com:rowset\"\n xmlns:z=\"#RowsetSchema\">\n<s:Schema id=\"RowsetSchema\">\n<s:ElementType name=\"row\" content=\"eltOnly\" r"
              },
              {
                "name": "Length",
                "value": "1887"
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 327
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00f9ff65",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa207c",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000030c"
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa209e",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 330
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa20e7",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x1b\t\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa224c",
            "parentcaller": "0x00fa289b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              }
            ],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa28ce",
            "parentcaller": "0x00fa5369",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa207c",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000030c"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa209e",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa20e7",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x90\\x1e\t\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa224c",
            "parentcaller": "0x00fa289b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa28ce",
            "parentcaller": "0x00fa53d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa6293",
            "parentcaller": "0x00fa36bc",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 341
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xfeff"
              },
              {
                "name": "Length",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "<xml xmlns:s=\"uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882\"\n xmlns:dt=\"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882\"\n xmlns:rs=\"urn:schemas-microsoft-com:rowset\"\n xmlns:z=\"#RowsetSchema\">\n<s:Schema id=\"RowsetSchema\">\n<s:ElementType name=\"row\" content=\"eltOnly\" r"
              },
              {
                "name": "Length",
                "value": "1887"
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 347
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00f9fffa",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa783b",
            "parentcaller": "0x00fa72a2",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuplog.cfg"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa0c12",
            "parentcaller": "0x00fa0cdd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030b3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 355
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa00fb",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 2,
            "id": 356
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00f611a6",
            "parentcaller": "0x00f9eda3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000310"
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa207c",
            "parentcaller": "0x00fa27b4",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000310"
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa209e",
            "parentcaller": "0x00fa27b4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 359
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa20e7",
            "parentcaller": "0x00fa27b4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe0\\x19\t\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 360
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa224c",
            "parentcaller": "0x00fa27b4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000310"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa27d9",
            "parentcaller": "0x00f9f761",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000310"
              },
              {
                "name": "MutexName",
                "value": "Global\\WdsSetupLogInit"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa27ee",
            "parentcaller": "0x00f9f761",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000310"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00f9fc9c",
            "parentcaller": "0x00f9eb5a",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x00f9f3e0"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00f9fcf9",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa207c",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa209e",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa20e7",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x90\\x1e\t\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa224c",
            "parentcaller": "0x00fa289b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa28ce",
            "parentcaller": "0x00fa5369",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa207c",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa209e",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa20e7",
            "parentcaller": "0x00fa289b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\x1a\t\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa224c",
            "parentcaller": "0x00fa289b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa28ce",
            "parentcaller": "0x00fa53d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa6293",
            "parentcaller": "0x00fa36bc",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 378
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa00fb",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000310"
              }
            ],
            "repeated": 1,
            "id": 380
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 382
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "\\xfeff"
              },
              {
                "name": "Length",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 388
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG  *************** SetupHost Logging Begin ***************\r\n"
              },
              {
                "name": "Length",
                "value": "107"
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\OSUpgrade"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\OSUpgrade"
              }
            ],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00f58f29",
            "parentcaller": "0x00f500f1",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther"
              }
            ],
            "repeated": 0,
            "id": 392
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 394
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 395
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "p\\x00\\x00\\x00\\x00\\x00\\x00\\x00n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "n\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize\r\n"
              },
              {
                "name": "Length",
                "value": "73"
              }
            ],
            "repeated": 0,
            "id": 398
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 401
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb7\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: ModulePath             = [C:\\$Windows.~WS\\Sources]\r\n"
              },
              {
                "name": "Length",
                "value": "125"
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 407
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\x01\\x00\\x00\\x00\\x00\\x00\\x004\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "4\\x01\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 411
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: WorkingPath            = [C:\\$Windows.~WS\\Sources]\r\n"
              },
              {
                "name": "Length",
                "value": "125"
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb8\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xb1\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb1\\x01\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: LoggingPath            = [C:\\$Windows.~WS\\Sources\\Panther]\r\n"
              },
              {
                "name": "Length",
                "value": "133"
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 420
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\x02\\x00\\x00\\x00\\x00\\x00\\x006\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "6\\x02\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: MediaPath              = []\r\n"
              },
              {
                "name": "Length",
                "value": "102"
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xa0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-05-28 22:59:34,144",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x9c\\x02\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: InstallFilePath        = []\r\n"
              },
              {
                "name": "Length",
                "value": "102"
              }
            ],
            "repeated": 0,
            "id": 433
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x03\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: ActionListFilePath     = []\r\n"
              },
              {
                "name": "Length",
                "value": "102"
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00h\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 445
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "h\\x03\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: CmdLine                = [/Download /Web  ]\r\n"
              },
              {
                "name": "Length",
                "value": "118"
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 449
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 451
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xde\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xde\\x03\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: Mode                   = [0x8]\r\n"
              },
              {
                "name": "Length",
                "value": "105"
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00G\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "G\\x04\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: Scenario               = [0x7]\r\n"
              },
              {
                "name": "Length",
                "value": "105"
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb0\\x04\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 467
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG  SetupHost::Initialize: Flags                  = [0x800]\r\n"
              },
              {
                "name": "Length",
                "value": "107"
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 469
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5e36d",
            "parentcaller": "0x00f4c844",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5f4b6",
            "parentcaller": "0x00f5f56b",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 471
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5f4b6",
            "parentcaller": "0x00f5f56b",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 472
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5f4b6",
            "parentcaller": "0x00f5f56b",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 473
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5f4e6",
            "parentcaller": "0x00f5f56b",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5f4e6",
            "parentcaller": "0x00f5f56b",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5f4e6",
            "parentcaller": "0x00f5f56b",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 479
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x1b\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1b\\x05\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 481
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG  SetupHost: Setup build version is: 10.0.19041.572 (vb_release_svc_prod1.201007-1724)\r\n"
              },
              {
                "name": "Length",
                "value": "136"
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 483
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e4f4",
            "parentcaller": "0x00f9deb0",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 1,
            "id": 484
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9dae3",
            "parentcaller": "0x00f9e52d",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              },
              {
                "name": "Handle",
                "value": "0x00000310"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9db7d",
            "parentcaller": "0x00f9e52d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000310"
              },
              {
                "name": "ValueName",
                "value": "CSDBuildNumber"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber"
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9db8b",
            "parentcaller": "0x00f9e52d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000310"
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa3\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xa3\\x05\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  CONX   pGetHostCSDBuildNumber: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber' does not exist. Assume 0\r\n"
              },
              {
                "name": "Length",
                "value": "167"
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 497
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00J\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "J\\x06\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 499
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  CONX   Host OS version: 10.0.19045.0  (0.0) Platform 0x2, SuiteMask 0x100, ProdType 0x1\r\n"
              },
              {
                "name": "Length",
                "value": "132"
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9dd3a",
            "parentcaller": "0x00f9e5c0",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 1,
            "id": 502
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9dca7",
            "parentcaller": "0x00f9df3b",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9dcae",
            "parentcaller": "0x00f9df3b",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              },
              {
                "name": "FunctionName",
                "value": "GetNativeSystemInfo"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x75d52150"
              }
            ],
            "repeated": 0,
            "id": 504
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9dd3a",
            "parentcaller": "0x00f9df46",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9df6d",
            "parentcaller": "0x00f4c8bb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              },
              {
                "name": "Handle",
                "value": "0x00000310"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9dfaf",
            "parentcaller": "0x00f4c8bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000310"
              },
              {
                "name": "ValueName",
                "value": "InstallationType"
              },
              {
                "name": "Data",
                "value": "Client"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType"
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e004",
            "parentcaller": "0x00f4c8bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000310"
              },
              {
                "name": "ValueName",
                "value": "EditionId"
              },
              {
                "name": "Data",
                "value": "Professional"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId"
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e0bd",
            "parentcaller": "0x00f4c8bb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000310"
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e166",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\winbrand"
              },
              {
                "name": "DllBase",
                "value": "0x6ad40000"
              }
            ],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e166",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "winbrand.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x6ad40000"
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e178",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "winbrand.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6ad40000"
              },
              {
                "name": "FunctionName",
                "value": "BrandingFormatString"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6ad51210"
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b32f00"
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc000003a",
            "pretty_return": "OBJECT_PATH_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Branding\\Basebrd\\Basebrd.dll"
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000314"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000318"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000314"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000318"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06710000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0016a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              }
            ],
            "repeated": 0,
            "id": 521
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06710000"
              },
              {
                "name": "RegionSize",
                "value": "0x0016a000"
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc000003a",
            "pretty_return": "OBJECT_PATH_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Branding\\Basebrd\\Basebrd.dll"
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              }
            ],
            "repeated": 0,
            "id": 525
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000314"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000318"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000314"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06710000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0016a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 531
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000314"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\en-US\\Basebrd.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000318"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000314"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\en-US\\basebrd.dll.mui"
              }
            ],
            "repeated": 0,
            "id": 533
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000318"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00f10000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00e3a340"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 535
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wldp"
              },
              {
                "name": "DllBase",
                "value": "0x75310000"
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "wldp.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x75310000"
              }
            ],
            "repeated": 0,
            "id": 537
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "wldp.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75310000"
              },
              {
                "name": "FunctionName",
                "value": "WldpQueryWindowsLockdownMode"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x75317dd0"
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "164"
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 542
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b1f560"
              }
            ],
            "repeated": 0,
            "id": 543
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wldp"
              },
              {
                "name": "DllBase",
                "value": "0x75310000"
              }
            ],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 545
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 546
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75310000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 548
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af2470"
              }
            ],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b341e0"
              }
            ],
            "repeated": 0,
            "id": 550
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af0700"
              }
            ],
            "repeated": 0,
            "id": 551
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b2c3b0"
              }
            ],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b253f0"
              }
            ],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b1f560"
              }
            ],
            "repeated": 0,
            "id": 554
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5932:168:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 555
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 556
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 557
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 558
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 559
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 1,
            "id": 560
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00f10000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              }
            ],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06710000"
              },
              {
                "name": "RegionSize",
                "value": "0x0016a000"
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 564
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b32f00"
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e18d",
            "parentcaller": "0x00f4c8bb",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 566
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e263",
            "parentcaller": "0x00f4c8bb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Sysprep"
              },
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Sysprep"
              }
            ],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e27a",
            "parentcaller": "0x00f4c8bb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fad671",
            "parentcaller": "0x00fadda5",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b1f4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion"
              },
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion"
              }
            ],
            "repeated": 0,
            "id": 570
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00fad6b1",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "ValueName",
                "value": "EditionId"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId"
              }
            ],
            "repeated": 0,
            "id": 571
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00fad6b1",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "ValueName",
                "value": "EditionId"
              },
              {
                "name": "Data",
                "value": "Professional"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId"
              }
            ],
            "repeated": 0,
            "id": 572
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5b2ba",
            "parentcaller": "0x00fad6b1",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              }
            ],
            "repeated": 0,
            "id": 573
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fad4c0",
            "parentcaller": "0x00fad716",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 574
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b1f4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion"
              },
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion"
              }
            ],
            "repeated": 0,
            "id": 575
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00fad5bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "ValueName",
                "value": "InstallationType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType"
              }
            ],
            "repeated": 0,
            "id": 576
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00fad5bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "ValueName",
                "value": "InstallationType"
              },
              {
                "name": "Data",
                "value": "Client"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType"
              }
            ],
            "repeated": 0,
            "id": 577
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5b2ba",
            "parentcaller": "0x00fad5bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              }
            ],
            "repeated": 0,
            "id": 578
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fad4c0",
            "parentcaller": "0x00fad933",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 579
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b1f4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion"
              },
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion"
              }
            ],
            "repeated": 0,
            "id": 580
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00fad5bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "ValueName",
                "value": "InstallationType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType"
              }
            ],
            "repeated": 0,
            "id": 581
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00fad5bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "ValueName",
                "value": "InstallationType"
              },
              {
                "name": "Data",
                "value": "Client"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType"
              }
            ],
            "repeated": 0,
            "id": 582
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5b2ba",
            "parentcaller": "0x00fad5bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              }
            ],
            "repeated": 0,
            "id": 583
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fad671",
            "parentcaller": "0x00fad975",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 584
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b1f4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion"
              },
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion"
              }
            ],
            "repeated": 0,
            "id": 585
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00fad6b1",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "ValueName",
                "value": "EditionId"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId"
              }
            ],
            "repeated": 0,
            "id": 586
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00fad6b1",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "ValueName",
                "value": "EditionId"
              },
              {
                "name": "Data",
                "value": "Professional"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId"
              }
            ],
            "repeated": 0,
            "id": 587
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5b2ba",
            "parentcaller": "0x00fad6b1",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              }
            ],
            "repeated": 0,
            "id": 588
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fad4c0",
            "parentcaller": "0x00fad716",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 589
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b1f4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion"
              },
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion"
              }
            ],
            "repeated": 0,
            "id": 590
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00fad5bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "ValueName",
                "value": "InstallationType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType"
              }
            ],
            "repeated": 0,
            "id": 591
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00fad5bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "ValueName",
                "value": "InstallationType"
              },
              {
                "name": "Data",
                "value": "Client"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType"
              }
            ],
            "repeated": 0,
            "id": 592
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f5b2ba",
            "parentcaller": "0x00fad5bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              }
            ],
            "repeated": 0,
            "id": 593
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fad36d",
            "parentcaller": "0x00faddd6",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 2,
            "id": 594
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 595
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 596
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 597
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xce\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 598
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xce\\x06\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 599
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  CONX   Source OS: Host SKU Info: Edition = 'Professional', Edition Type = 'Client', Installation Type = 'Complete', Product Name = 'Windows 10 Pro', Arch = amd64, StationType = Client Workstation, Stage type = Sta"
              },
              {
                "name": "Length",
                "value": "267"
              }
            ],
            "repeated": 0,
            "id": 600
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 601
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e47f",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlUnregisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77aeb500"
              }
            ],
            "repeated": 0,
            "id": 602
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e47f",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlUnsubscribeWnfNotificationWaitForCompletion"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b1ea80"
              }
            ],
            "repeated": 0,
            "id": 603
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e47f",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000008c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 604
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e47f",
            "parentcaller": "0x00f4c8bb",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000008c"
              }
            ],
            "repeated": 0,
            "id": 605
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e47f",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000310"
              }
            ],
            "repeated": 0,
            "id": 606
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e47f",
            "parentcaller": "0x00f4c8bb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\winbrand"
              },
              {
                "name": "DllBase",
                "value": "0x6ad40000"
              }
            ],
            "repeated": 0,
            "id": 607
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e47f",
            "parentcaller": "0x00f4c8bb",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 608
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e47f",
            "parentcaller": "0x00f4c8bb",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 609
          },
          {
            "timestamp": "2026-05-28 22:59:34,160",
            "thread_id": "4312",
            "caller": "0x00f9e47f",
            "parentcaller": "0x00f4c8bb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6ad40000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 610
          },
          {
            "timestamp": "2026-05-28 22:59:34,175",
            "thread_id": "4312",
            "caller": "0x00f9d7d2",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\sppc"
              },
              {
                "name": "DllBase",
                "value": "0x6bb80000"
              }
            ],
            "repeated": 0,
            "id": 611
          },
          {
            "timestamp": "2026-05-28 22:59:34,175",
            "thread_id": "4312",
            "caller": "0x00f9d7d2",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\SLC"
              },
              {
                "name": "DllBase",
                "value": "0x6bba0000"
              }
            ],
            "repeated": 0,
            "id": 612
          },
          {
            "timestamp": "2026-05-28 22:59:34,175",
            "thread_id": "4312",
            "caller": "0x00f9d7d2",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "SLC.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x6bba0000"
              }
            ],
            "repeated": 0,
            "id": 613
          },
          {
            "timestamp": "2026-05-28 22:59:34,175",
            "thread_id": "4312",
            "caller": "0x00f9d7d2",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x6bba0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "SLC.DLL"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 614
          },
          {
            "timestamp": "2026-05-28 22:59:34,175",
            "thread_id": "4312",
            "caller": "0x00f9d7f8",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "SLC.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6bba0000"
              },
              {
                "name": "FunctionName",
                "value": "SLOpen"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6bb93d10"
              }
            ],
            "repeated": 0,
            "id": 615
          },
          {
            "timestamp": "2026-05-28 22:59:34,175",
            "thread_id": "4312",
            "caller": "0x00f9d81e",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "SLC.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6bba0000"
              },
              {
                "name": "FunctionName",
                "value": "SLClose"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6bb92270"
              }
            ],
            "repeated": 0,
            "id": 616
          },
          {
            "timestamp": "2026-05-28 22:59:34,175",
            "thread_id": "4312",
            "caller": "0x00f9d831",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "SLC.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6bba0000"
              },
              {
                "name": "FunctionName",
                "value": "SLGetLicensingStatusInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6bb933e0"
              }
            ],
            "repeated": 0,
            "id": 617
          },
          {
            "timestamp": "2026-05-28 22:59:34,175",
            "thread_id": "4312",
            "caller": "0x00f9d844",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "SLC.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6bba0000"
              },
              {
                "name": "FunctionName",
                "value": "SLGetProductSkuInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6bb93720"
              }
            ],
            "repeated": 0,
            "id": 618
          },
          {
            "timestamp": "2026-05-28 22:59:34,175",
            "thread_id": "4312",
            "caller": "0x00f9d857",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "SLC.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6bba0000"
              },
              {
                "name": "FunctionName",
                "value": "SLGetSLIDList"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6bb93760"
              }
            ],
            "repeated": 0,
            "id": 619
          },
          {
            "timestamp": "2026-05-28 22:59:34,175",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 620
          },
          {
            "timestamp": "2026-05-28 22:59:34,175",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000324"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform"
              }
            ],
            "repeated": 0,
            "id": 621
          },
          {
            "timestamp": "2026-05-28 22:59:34,175",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000324"
              },
              {
                "name": "ValueName",
                "value": "UseHVSocket"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform\\UseHVSocket"
              }
            ],
            "repeated": 0,
            "id": 622
          },
          {
            "timestamp": "2026-05-28 22:59:34,175",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000324"
              }
            ],
            "repeated": 0,
            "id": 623
          },
          {
            "timestamp": "2026-05-28 22:59:34,222",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 624
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00cbc00c"
              },
              {
                "name": "Size",
                "value": "0x00000004"
              },
              {
                "name": "Buffer",
                "value": "\\x80]\\xbew"
              }
            ],
            "repeated": 0,
            "id": 625
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be5d94"
              },
              {
                "name": "Size",
                "value": "0x00000004"
              },
              {
                "name": "Buffer",
                "value": "\\xe8,\\x07\\x03"
              }
            ],
            "repeated": 0,
            "id": 626
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03072ce0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xf8+\\x07\\x03\\x8c]\\xbew\\x00,\\x07\\x03\\x94]\\xbew\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf2\\x00P\\xea\\xfa\\x00\\x00\\xe0\n\\x00J\\x00L\\x00\\xc8\\x1c\\x07\\x03\\x1a\\x00\\x1c\\x00\\xf8\\x1c\\x07\\x03\\xcc\\xaa\\x00\\x00\\xff\\xff\\xff\\xff\\\\xcc\\x07\\x03\\xc8[\\xbew\\xac\n\\e"
              }
            ],
            "repeated": 0,
            "id": 627
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03072bf8"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x001\\x07\\x03\\xe0,\\x07\\x03\\x081\\x07\\x03\\xe8,\\x07\\x03\\x804\\x07\\x03\\x9c]\\xbew\\x00\\x00\\xacw\\x00\\x00\\x00\\x00\\x00@\\x1a\\x00:\\x00<\\x00\\x08+\\x07\\x03\\x12\\x00\\x14\\x00 \\x84\\xacw\\xc4\\xaa\\x00\\x00\\xff\\xff\\x00\\x00 \\\\xbew \\\\xbew\\xd5\\xe7\\xb9:"
              }
            ],
            "repeated": 0,
            "id": 628
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03073100"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "p4\\x07\\x03\\xf8+\\x07\\x03x4\\x07\\x03\\x00,\\x07\\x03(@\\x07\\x03\\x804\\x07\\x03\\x00\\x00\\xd3u\\xe0\\xf8\\xd4u\\x00\\x00\\x0f\\x00@\\x00B\\x00\\xe81\\x07\\x03\\x18\\x00\\x1a\\x00\\x102\\x07\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\x10\\\\xbew\\x10\\\\xbew\\xcf(`\\xf5"
              }
            ],
            "repeated": 0,
            "id": 629
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03073470"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x18@\\x07\\x03\\x001\\x07\\x03 @\\x07\\x03\\x081\\x07\\x03\\x101\\x07\\x03\\x08,\\x07\\x03\\x00\\x00\\x87w\\xb0\\xf7\\x98w\\x00\\xa0#\\x00D\\x00F\\x00X5\\x07\\x03\\x1c\\x00\\x1e\\x00\\x805\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xa0[\\xbew\\xa0[\\xbew\\xbfl\\x19O"
              }
            ],
            "repeated": 0,
            "id": 630
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03074018"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xa0\\xba\\x07\\x03p4\\x07\\x03\\xa8\\xba\\x07\\x03x4\\x07\\x03\\xb0\\xba\\x07\\x03\\x101\\x07\\x03\\x00\\x00\\xcft\\xe0\\x88\\xd2t\\x00\\xf0\t\\x00>\\x00@\\x00\\xa80\\x07\\x03\\x16\\x00\\x18\\x00\\xd00\\x07\\x03\\xcc\\xab\\x0c\\x00\\xff\\xff\\x00\\x00@\\\\xbew@\\\\xbew\\xdfY_\\xf9"
              }
            ],
            "repeated": 0,
            "id": 631
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307baa0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xb0\\xbc\\x07\\x03\\x18@\\x07\\x03\\xb8\\xbc\\x07\\x03 @\\x07\\x03\\xc0\\xbc\\x07\\x03(@\\x07\\x03\\x00\\x00\\xfcj\\xc0\\xd5\\xfdj\\x00P(\\x00@\\x00B\\x00\\xd0\\xbb\\x07\\x03\\x18\\x00\\x1a\\x00\\xf8\\xbb\\x07\\x03\\xcc\\xab\\x08\\x00\\xff\\xff\\x00\\x00\\\\xb1\\x08\\x03P\\\\xbew\r\\xe17f"
              }
            ],
            "repeated": 0,
            "id": 632
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307bcb0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xf0\\xbe\\x07\\x03\\xa0\\xba\\x07\\x03\\xf8\\xbe\\x07\\x03\\xa8\\xba\\x07\\x03\\xa0`\\x07\\x03\\xb0\\xba\\x07\\x03\\x00\\x00\\xd7v\\xc0Z\\xdav\\x00\\xf0\\x0b\\x00<\\x00>\\x00\\x98\\xbd\\x07\\x03\\x14\\x00\\x16\\x00\\xc0\\xbd\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xd8[\\xbew\\xd8[\\xbew/V'~"
              }
            ],
            "repeated": 0,
            "id": 633
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307bef0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x90`\\x07\\x03\\xb0\\xbc\\x07\\x03\\x98`\\x07\\x03\\xb8\\xbc\\x07\\x03\\xd0\\xca\\x07\\x03pb\\x07\\x03\\x00\\x00]w`\\xcf`w\\x00\\xc0\\x19\\x00<\\x00>\\x00\\xf0^\\x07\\x03\\x14\\x00\\x16\\x00\\x18_\\x07\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\xbc\\xb2\\x08\\x03\\x80[\\xbew\\xf0\\xb9\\x94\\x0c"
              }
            ],
            "repeated": 0,
            "id": 634
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03076090"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "`b\\x07\\x03\\xf0\\xbe\\x07\\x03hb\\x07\\x03\\xf8\\xbe\\x07\\x03\\xb0\\xc2\\x07\\x03\\xc0\\xbc\\x07\\x03\\x00\\x00\\xd5v\\x00\\x00\\x00\\x00\\x00\\x80\\x01\\x00<\\x00>\\x00xa\\x07\\x03\\x14\\x00\\x16\\x00\\xa0a\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x00\\x04e\\x07\\x03\\x00\\\\xbew\\xd19\\x17p"
              }
            ],
            "repeated": 0,
            "id": 635
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03076260"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xc8d\\x07\\x03\\x90`\\x07\\x03\\xd0d\\x07\\x03\\x98`\\x07\\x03\\x00\\xbf\\x07\\x03\\xd8d\\x07\\x03\\x00\\x00\\xb1v\\xd0u\\xb1v\\x00@\\x02\\x00:\\x00<\\x00Hc\\x07\\x03\\x12\\x00\\x14\\x00pc\\x07\\x03\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\x88[\\xbew\\x88[\\xbew$\\xf3\\x19\\x07"
              }
            ],
            "repeated": 0,
            "id": 636
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030764c8"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "x\\xc0\\x07\\x03`b\\x07\\x03\\x80\\xc0\\x07\\x03hb\\x07\\x03pb\\x07\\x03\\x88\\xc0\\x07\\x03\\x00\\x00xw\\xa0:~w\\x00\\x80\\x0e\\x00B\\x00D\\x00\\xb0e\\x07\\x03\\x1a\\x00\\x1c\\x00\\xd8e\\x07\\x03\\xcc\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\xb4\\xc0\\x07\\x03\\xcc`\\x07\\x03g\\x10$\\x04"
              }
            ],
            "repeated": 0,
            "id": 637
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307c078"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xa0\\xc2\\x07\\x03\\xc8d\\x07\\x03\\xa8\\xc2\\x07\\x03\\xd0d\\x07\\x03\\xd8d\\x07\\x03\\xb0\\xc2\\x07\\x03\\x00\\x00\\xf4v\\x00x\\xf5v\\x00\\xb0\\x07\\x00B\\x00D\\x00(\\xc1\\x07\\x03\\x1a\\x00\\x1c\\x00P\\xc1\\x07\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\xbc\\xcd\\x07\\x03\\x04e\\x07\\x03RDR\\xfd"
              }
            ],
            "repeated": 0,
            "id": 638
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307c2a0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xe0\\xc6\\x07\\x03x\\xc0\\x07\\x03\\xe8\\xc6\\x07\\x03\\x80\\xc0\\x07\\x03\\x88\\xc0\\x07\\x03\\xa0`\\x07\\x03\\x00\\x00\\x9fv0\\xba\\xa1v\\x00\\x00\\x12\\x00@\\x00B\\x00\\x88\\xc3\\x07\\x03\\x18\\x00\\x1a\\x00\\xb0\\xc3\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x008\\\\xbew8\\\\xbew\\xa2\\xd3cg"
              }
            ],
            "repeated": 0,
            "id": 639
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307c6e0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x80\\xcd\\x07\\x03\\xa0\\xc2\\x07\\x03\\x88\\xcd\\x07\\x03\\xa8\\xc2\\x07\\x03\\x90\\xcd\\x07\\x03\\xd0\\xca\\x07\\x03\\x00\\x00\\xf4u\\xa0\\xbf\\x0bv\\x00p[\\x00>\\x00@\\x00\\xc8\\xc7\\x07\\x03\\x16\\x00\\x18\\x00\\xf0\\xc7\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\x1c\\xcf\\x07\\x03\\xa8[\\xbew\\xf8\\xbc\\xed\\xac"
              }
            ],
            "repeated": 0,
            "id": 640
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307cd80"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "P\\xd2\\x07\\x03\\xe0\\xc6\\x07\\x03X\\xd2\\x07\\x03\\xe8\\xc6\\x07\\x03\\x00\\xd1\\x07\\x03\\xf0\\xc6\\x07\\x03\\x00\\x00Pv\\x90xQv\\x00P\\x04\\x00>\\x00@\\x00\\xf8\\xdd\\x07\\x03\\x16\\x00\\x18\\x00 \\xde\\x07\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\x00\\\\xbew\\xb4\\xc0\\x07\\x03NV\\xc3\\x03"
              }
            ],
            "repeated": 0,
            "id": 641
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d250"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xb0\\xd3\\x07\\x03\\x80\\xcd\\x07\\x03\\xb8\\xd3\\x07\\x03\\x88\\xcd\\x07\\x03\\xf0\\xce\\x07\\x03\\xc0\\xd3\\x07\\x03\\x00\\x00\\xe6v `\\xe9v\\x00`\t\\x00@\\x00B\\x00\\x88\\xdf\\x07\\x03\\x18\\x00\\x1a\\x00\\xb0\\xdf\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xfc\\xd5\\x07\\x03\\xe8[\\xbewU\\x89C\\x99"
              }
            ],
            "repeated": 0,
            "id": 642
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d3b0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xf0\\xd0\\x07\\x03P\\xd2\\x07\\x03\\xf8\\xd0\\x07\\x03X\\xd2\\x07\\x03`\\xd2\\x07\\x03\\x00\\xd1\\x07\\x03\\x00\\x003w\\x10\\xb8Fw\\x00\\x00(\\x00>\\x00@\\x00\\x08\\xe1\\x07\\x03\\x16\\x00\\x18\\x000\\xe1\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xc0[\\xbew\\xc0[\\xbew\\x83p\\x1a\\xa1"
              }
            ],
            "repeated": 0,
            "id": 643
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d0f0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "`\\xd4\\x07\\x03\\xb0\\xd3\\x07\\x03h\\xd4\\x07\\x03\\xb8\\xd3\\x07\\x03\\xc0\\xd3\\x07\\x03\\x90\\xcd\\x07\\x03\\x00\\x00\\xc0v\\x80\\xd3\\xc3v\\x00\\xf0\\x0b\\x00<\\x00>\\x00\\xc0\\xe2\\x07\\x03\\x14\\x00\\x16\\x00\\xe8\\xe2\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x00|\\xd0\\x07\\x03\\x98[\\xbew\\xb5ly\\xae"
              }
            ],
            "repeated": 0,
            "id": 644
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d460"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": " \\xcc\\x07\\x03\\xf0\\xd0\\x07\\x03(\\xcc\\x07\\x03\\xf8\\xd0\\x07\\x03\\xb0\\xd1\\x07\\x030\\xd7\\x07\\x03\\x00\\x00Uv\\x90\\xf7Wv\\x00\\x80C\\x00@\\x00B\\x00\\xa0\\xe4\\x07\\x03\\x18\\x00\\x1a\\x00\\xc8\\xe4\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x00\\x18\\\\xbew\\x18\\\\xbewe\\x94\\x9c\\xfa"
              }
            ],
            "repeated": 0,
            "id": 645
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307cc20"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": " \\xd7\\x07\\x03`\\xd4\\x07\\x03(\\xd7\\x07\\x03h\\xd4\\x07\\x030\\xd7\\x07\\x03\\xf0\\xce\\x07\\x03\\x00\\x00\\xf0v\\x10\\xcc\\xf0v\\x00\\xb0\\x03\\x00@\\x00B\\x00p\\xea\\x07\\x03\\x18\\x00\\x1a\\x00\\x98\\xea\\x07\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00L\\xca\\x07\\x03\\x1c-\\x07\\x03\\x13\\xc0\\x9eE"
              }
            ],
            "repeated": 0,
            "id": 646
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d720"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xe0\\xce\\x07\\x03 \\xcc\\x07\\x03\\xe8\\xce\\x07\\x03(\\xcc\\x07\\x03p\\xd4\\x07\\x030\\xcc\\x07\\x03\\x00\\x00[w\\xe0\\x93[w\\x00\\x90\\x01\\x00<\\x00>\\x00\\xd0\\xeb\\x07\\x03\\x14\\x00\\x16\\x00\\xf8\\xeb\\x07\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\x90[\\xbew\\x90[\\xbewp\\xa4\\xcbw"
              }
            ],
            "repeated": 0,
            "id": 647
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307cee0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xa0\\xd1\\x07\\x03 \\xd7\\x07\\x03\\xa8\\xd1\\x07\\x03(\\xd7\\x07\\x030\\xcc\\x07\\x03`\\xd2\\x07\\x03\\x00\\x00\\x90p@5\\x90p\\x00\\x90\\x01\\x006\\x008\\x00x\\xee\\x07\\x03\\x0e\\x00\\x10\\x00\\xa0\\xee\\x07\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00,\\xc1\\x08\\x03\\x1c\\xc7\\x07\\x03EI\\xdeg"
              }
            ],
            "repeated": 0,
            "id": 648
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d1a0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xc0\\xd5\\x07\\x03\\xe0\\xce\\x07\\x03\\xc8\\xd5\\x07\\x03\\xe8\\xce\\x07\\x03@\\xce\\x07\\x03p\\xd4\\x07\\x03\\x00\\x00\\xb9\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x006\\x008\\x00\\x18\\xef\\x07\\x03\\x0e\\x00\\x10\\x00@\\xef\\x07\\x03\\xcc*\\x08\\x00\\xff\\xff\\x00\\x00\\xcc\\xbf\\x08\\x03\\xb0[\\xbew-\\x94'\\xa8"
              }
            ],
            "repeated": 0,
            "id": 649
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d5c0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "0\\xce\\x07\\x03\\xa0\\xd1\\x07\\x038\\xce\\x07\\x03\\xa8\\xd1\\x07\\x03 \\xca\\x07\\x03@\\xce\\x07\\x03\\x00\\x00\\xf4j\\xe0\\x9e\\xf5j\\x00\\xd0\\x07\\x00@\\x00B\\x00\\xa8\\xef\\x07\\x03\\x18\\x00\\x1a\\x00\\xd0\\xef\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xe8[\\xbew\\x8c\\xd2\\x07\\x03\\xd0,\\x13\\xb9"
              }
            ],
            "repeated": 0,
            "id": 650
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307ce30"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\xca\\x07\\x03\\xc0\\xd5\\x07\\x03\\x18\\xca\\x07\\x03\\xc8\\xd5\\x07\\x03\\xd0\\xd5\\x07\\x03\\xb0\\xd1\\x07\\x03\\x00\\x00\\xccv\\x80$\\xd0v\\x00p\\x08\\x00<\\x00>\\x00\\xd8\\xf0\\x07\\x03\\x14\\x00\\x16\\x00\\x00\\xf1\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xd0[\\xbew\\xd0[\\xbew\\xa1\\xe8\\xef\\xc5"
              }
            ],
            "repeated": 0,
            "id": 651
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307ca10"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xc0\\xca\\x07\\x030\\xce\\x07\\x03\\xc8\\xca\\x07\\x038\\xce\\x07\\x03P\\xd0\\x07\\x03\\xd0\\xd5\\x07\\x03\\x00\\x00\\xf3j\\xd0]\\xf3j\\x00\\x00\\x01\\x00<\\x00>\\x00x\\xf6\\x07\\x03\\x14\\x00\\x16\\x00\\xa0\\xf6\\x07\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\xc8[\\xbew\\\\xcc\\x07\\x035s\\xbc\\xd2"
              }
            ],
            "repeated": 0,
            "id": 652
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307cac0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "@\\xd0\\x07\\x03\\x10\\xca\\x07\\x03H\\xd0\\x07\\x03\\x18\\xca\\x07\\x03\\xf0\\xc6\\x07\\x03\\x00\\xbf\\x07\\x03\\x00\\x00\\xe3v\\x10D\\xe3v\\x00P\\x02\\x00:\\x00<\\x00@\\xf2\\x07\\x03\\x12\\x00\\x14\\x00h\\xf2\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x00<\\xd3\\x07\\x03p\\\\xbew\\x8f6\\x80\\x93"
              }
            ],
            "repeated": 0,
            "id": 653
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d040"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\xd3\\x07\\x03\\xc0\\xca\\x07\\x03\\x08\\xd3\\x07\\x03\\xc8\\xca\\x07\\x03\\x10\\xd3\\x07\\x03 \\xca\\x07\\x03\\x00\\x00\\xfcv\\xf0X\\x01w\\x00\\xf0\\x0f\\x00>\\x00@\\x00\\xb0\\xf1\\x07\\x03\\x16\\x00\\x18\\x00\\xd8\\xf1\\x07\\x03\\xec\\xaa\\x08\\x00\\x06\\x00\\xff\\xff\\x98[\\xbew,\\xd1\\x07\\x03\\xfcN\\xe3\\x96"
              }
            ],
            "repeated": 0,
            "id": 654
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d300"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x80\\xd8\\x07\\x03@\\xd0\\x07\\x03\\x88\\xd8\\x07\\x03H\\xd0\\x07\\x03\\x80\\xcb\\x07\\x03P\\xd0\\x07\\x03\\x00\\x00\\xcbu@K\\xcbu\\x000\\x06\\x00<\\x00>\\x00P\\xf7\\x07\\x03\\x14\\x00\\x16\\x00x\\xf7\\x07\\x03\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\xec\\xc3\\x08\\x03\\xfc\\xca\\x07\\x03\\x1c\\x9c&\\x03"
              }
            ],
            "repeated": 0,
            "id": 655
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d880"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "p\\xcb\\x07\\x03\\x00\\xd3\\x07\\x03x\\xcb\\x07\\x03\\x08\\xd3\\x07\\x03@\\xd9\\x07\\x03\\x80\\xcb\\x07\\x03\\x00\\x00\\xb5uP$\\xb6u\\x00\\xc0\\x07\\x00@\\x00B\\x00`\\xa8\\x08\\x03\\x18\\x00\\x1a\\x00\\x88\\xa8\\x08\\x03\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00`\\\\xbew`\\\\xbew\\xc8Z\\xae\\xae"
              }
            ],
            "repeated": 0,
            "id": 656
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307cb70"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "0\\xd9\\x07\\x03\\x80\\xd8\\x07\\x038\\xd9\\x07\\x03\\x88\\xd8\\x07\\x03\\x90\\xd8\\x07\\x03\\x10\\xd3\\x07\\x03\\x00\\x00\\xa5up\r\\xa7u\\x00`\\x07\\x00>\\x00@\\x00\\xf8\\xf1\\x07\\x03\\x16\\x00\\x18\\x00 \\xf2\\x07\\x03\\xec\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\xf8[\\xbew\\xf8[\\xbew%\\x9c\\xbe\\xd4"
              }
            ],
            "repeated": 0,
            "id": 657
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d930"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xd0\\xcc\\x07\\x03p\\xcb\\x07\\x03\\xd8\\xcc\\x07\\x03x\\xcb\\x07\\x03\\xe0\\xbc\\x08\\x03\\x90\\xd8\\x07\\x03\\x00\\x00$w\\xe0\\xc9&w\\x000\\x0e\\x00:\\x00<\\x00\\x80\\xf4\\x07\\x03\\x12\\x00\\x14\\x00\\xa8\\xf4\\x07\\x03\\xec\\xaa\\x08\\x00\\x06\\x00\\xff\\xff\\x0c\\xb2\\x08\\x03h\\\\xbew\\xd0\\xef\\xb5H"
              }
            ],
            "repeated": 0,
            "id": 658
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307ccd0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "p\\xbb\\x08\\x030\\xd9\\x07\\x03x\\xbb\\x08\\x038\\xd9\\x07\\x030\\xb1\\x08\\x03 \\xba\\x08\\x03\\x00\\x00\nu\\x00\\x18\nu\\x00\\x80\\x00\\x00>\\x00@\\x00X\\xf5\\x07\\x03\\x16\\x00\\x18\\x00\\x80\\xf5\\x07\\x03\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\xac\\xbb\\x08\\x03\\xf0[\\xbew\\x0c\\xf7\\x87*"
              }
            ],
            "repeated": 0,
            "id": 659
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308bb70"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\xba\\x08\\x03\\xd0\\xcc\\x07\\x03\\x18\\xba\\x08\\x03\\xd8\\xcc\\x07\\x03\\x00\\xc1\\x08\\x030\\xb1\\x08\\x03\\x00\\x00Gk\\xc0~Gk\\x00\\x00\\x02\\x00>\\x00@\\x00\\x88\\xf2\\x07\\x03\\x16\\x00\\x18\\x00\\xb0\\xf2\\x07\\x03\\xec\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\xec\\xb8\\x08\\x03\\x0c\\xcd\\x07\\x03\\xe0\\x15`>"
              }
            ],
            "repeated": 0,
            "id": 660
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308ba10"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": " \\xb1\\x08\\x03p\\xbb\\x08\\x03(\\xb1\\x08\\x03x\\xbb\\x08\\x03\\xe0\\xcc\\x07\\x03\\xe0\\xb1\\x08\\x03\\x00\\x00\tup,\tu\\x00\\xf0\\x00\\x00@\\x00B\\x00\\xe0\\xd5\\x08\\x03\\x18\\x00\\x1a\\x00\\x08\\xd6\\x08\\x03\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00H\\\\xbewH\\\\xbew\\x1fX\\x01\\x88"
              }
            ],
            "repeated": 0,
            "id": 661
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308b120"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xd0\\xbc\\x08\\x03\\x10\\xba\\x08\\x03\\xd8\\xbc\\x08\\x03\\x18\\xba\\x08\\x03\\x80\\xbb\\x08\\x03\\xe0\\xcc\\x07\\x03\\x00\\x00xrp\\xf1|r\\x00\\xa0\\x0c\\x00>\\x00@\\x00 \\xf1\\x07\\x03\\x16\\x00\\x18\\x00H\\xf1\\x07\\x03\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00P\\\\xbew\\xdc\\xba\\x07\\x03\\x18\\x1f>\\xba"
              }
            ],
            "repeated": 0,
            "id": 662
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308bcd0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xd0\\xb1\\x08\\x03 \\xb1\\x08\\x03\\xd8\\xb1\\x08\\x03(\\xb1\\x08\\x03\\xe0\\xb1\\x08\\x03@\\xd9\\x07\\x03\\x00\\x00\\xcet`*\\xcet\\x00\\xa0\\x00\\x00B\\x00D\\x00\\xa0\\xd9\\x08\\x03\\x1a\\x00\\x1c\\x00\\xc8\\xd9\\x08\\x03\\xcc\\xaa\\x08\\x00\\x06\\x00\\x00\\x00(\\\\xbew(\\\\xbewh\\xbd\\x90\\xa7"
              }
            ],
            "repeated": 0,
            "id": 663
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308b1d0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xf0\\xc0\\x08\\x03\\xd0\\xbc\\x08\\x03\\xf8\\xc0\\x08\\x03\\xd8\\xbc\\x08\\x03 \\xba\\x08\\x03\\xe0\\xbc\\x08\\x03\\x00\\x00\\xd9t\\xd0\\xcc\\xd9t\\x00\\x10\\x02\\x00>\\x00@\\x00\\x18\\xf1\\x08\\x03\\x16\\x00\\x18\\x00@\\xf1\\x08\\x03\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00h\\\\xbewl\\xd9\\x07\\x03\\xacF\\x9d~"
              }
            ],
            "repeated": 0,
            "id": 664
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308c0f0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xb0\\xb8\\x08\\x03\\xd0\\xb1\\x08\\x03\\xb8\\xb8\\x08\\x03\\xd8\\xb1\\x08\\x03\\xc0\\xb8\\x08\\x03\\x80\\xbb\\x08\\x03\\x00\\x00\\xe9t\\xe0G\\xe9t\\x00\\xf0\\x00\\x00L\\x00N\\x00`;\t\\x03$\\x00&\\x00\\x88;\t\\x03\\xcc\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\xa8[\\xbew\\x1c\\xcf\\x07\\x03\\xc5\\xea\\xab6"
              }
            ],
            "repeated": 0,
            "id": 665
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308b8b0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x80\\xb2\\x08\\x03\\xf0\\xc0\\x08\\x03\\x88\\xb2\\x08\\x03\\xf8\\xc0\\x08\\x03\\x90\\xb2\\x08\\x03\\x00\\xc1\\x08\\x03\\x00\\x00\\xbav\\xc06\\xbdv\\x00\\xf0\\x05\\x00P\\x00R\\x00\\x90A\t\\x03(\\x00*\\x00\\xb8A\t\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\xf0[\\xbew\\xac\\xbb\\x08\\x03\\x1e\\x8a\\xca\\xed"
              }
            ],
            "repeated": 0,
            "id": 666
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308b280"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xb0\\xc3\\x08\\x03\\xb0\\xb8\\x08\\x03\\xb8\\xc3\\x08\\x03\\xb8\\xb8\\x08\\x03\\xc0\\xc3\\x08\\x03\\xc0\\xb8\\x08\\x03\\x00\\x00\\xdajp\\x8b\\xddj\\x00\\x80\\x18\\x00>\\x00@\\x00\\xf8\\xef\\x08\\x03\\x16\\x00\\x18\\x00 \\xf0\\x08\\x03\\xcc\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\x9c\\xb9\\x08\\x03,\\xbf\\x07\\x03\\xa1\\x07]\\xdc"
              }
            ],
            "repeated": 0,
            "id": 667
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308c3b0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "`\\xb9\\x08\\x03\\x80\\xb2\\x08\\x03h\\xb9\\x08\\x03\\x88\\xb2\\x08\\x03\\xa0\\xbf\\x08\\x03\\x90\\xb2\\x08\\x03\\x00\\x00\\xd7j\\xf0\\x17\\xd9j\\x00\\xb0\\x02\\x00>\\x00@\\x00@\\xf0\\x08\\x03\\x16\\x00\\x18\\x00h\\xf0\\x08\\x03\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00p\\\\xbew<\\xd3\\x07\\x03\n\\x16\\xd0!"
              }
            ],
            "repeated": 0,
            "id": 668
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308b960"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x90\\xbf\\x08\\x03\\xb0\\xc3\\x08\\x03\\x98\\xbf\\x08\\x03\\xb8\\xc3\\x08\\x03\\x9c]\\xbew\\xa0\\xbf\\x08\\x03\\x00\\x00\\xbak\\x00\"\\xbak\\x00\\xf0\\x01\\x006\\x008\\x00\\xf0p\\x08\\x03\\x0e\\x00\\x10\\x00\\x18q\\x08\\x03\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\x80[\\xbew\\xbc\\xb2\\x08\\x03v\\x9aYa"
              }
            ],
            "repeated": 0,
            "id": 669
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308bf90"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x8c]\\xbew`\\xb9\\x08\\x03\\x94]\\xbewh\\xb9\\x08\\x03p\\xb9\\x08\\x03\\xc0\\xc3\\x08\\x03\\x00\\x00\\xb8kpy\\xb8k\\x00\\xc0\\x01\\x008\\x00:\\x00`\\xf1\\x08\\x03\\x10\\x00\\x12\\x00\\x88\\xf1\\x08\\x03\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\xb0[\\xbew\\xdc\\xd1\\x07\\x03\\x81T\\xe4<"
              }
            ],
            "repeated": 0,
            "id": 670
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00cbc00c"
              },
              {
                "name": "Size",
                "value": "0x00000004"
              },
              {
                "name": "Buffer",
                "value": "\\x80]\\xbew"
              }
            ],
            "repeated": 0,
            "id": 671
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be5d94"
              },
              {
                "name": "Size",
                "value": "0x00000004"
              },
              {
                "name": "Buffer",
                "value": "\\xe8,\\x07\\x03"
              }
            ],
            "repeated": 0,
            "id": 672
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03072ce0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xf8+\\x07\\x03\\x8c]\\xbew\\x00,\\x07\\x03\\x94]\\xbew\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf2\\x00P\\xea\\xfa\\x00\\x00\\xe0\n\\x00J\\x00L\\x00\\xc8\\x1c\\x07\\x03\\x1a\\x00\\x1c\\x00\\xf8\\x1c\\x07\\x03\\xcc\\xaa\\x00\\x00\\xff\\xff\\xff\\xff\\\\xcc\\x07\\x03\\xc8[\\xbew\\xac\n\\e"
              }
            ],
            "repeated": 0,
            "id": 673
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03072bf8"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x001\\x07\\x03\\xe0,\\x07\\x03\\x081\\x07\\x03\\xe8,\\x07\\x03\\x804\\x07\\x03\\x9c]\\xbew\\x00\\x00\\xacw\\x00\\x00\\x00\\x00\\x00@\\x1a\\x00:\\x00<\\x00\\x08+\\x07\\x03\\x12\\x00\\x14\\x00 \\x84\\xacw\\xc4\\xaa\\x00\\x00\\xff\\xff\\x00\\x00 \\\\xbew \\\\xbew\\xd5\\xe7\\xb9:"
              }
            ],
            "repeated": 0,
            "id": 674
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03073100"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "p4\\x07\\x03\\xf8+\\x07\\x03x4\\x07\\x03\\x00,\\x07\\x03(@\\x07\\x03\\x804\\x07\\x03\\x00\\x00\\xd3u\\xe0\\xf8\\xd4u\\x00\\x00\\x0f\\x00@\\x00B\\x00\\xe81\\x07\\x03\\x18\\x00\\x1a\\x00\\x102\\x07\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\x10\\\\xbew\\x10\\\\xbew\\xcf(`\\xf5"
              }
            ],
            "repeated": 0,
            "id": 675
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03073470"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x18@\\x07\\x03\\x001\\x07\\x03 @\\x07\\x03\\x081\\x07\\x03\\x101\\x07\\x03\\x08,\\x07\\x03\\x00\\x00\\x87w\\xb0\\xf7\\x98w\\x00\\xa0#\\x00D\\x00F\\x00X5\\x07\\x03\\x1c\\x00\\x1e\\x00\\x805\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xa0[\\xbew\\xa0[\\xbew\\xbfl\\x19O"
              }
            ],
            "repeated": 0,
            "id": 676
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03074018"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xa0\\xba\\x07\\x03p4\\x07\\x03\\xa8\\xba\\x07\\x03x4\\x07\\x03\\xb0\\xba\\x07\\x03\\x101\\x07\\x03\\x00\\x00\\xcft\\xe0\\x88\\xd2t\\x00\\xf0\t\\x00>\\x00@\\x00\\xa80\\x07\\x03\\x16\\x00\\x18\\x00\\xd00\\x07\\x03\\xcc\\xab\\x0c\\x00\\xff\\xff\\x00\\x00@\\\\xbew@\\\\xbew\\xdfY_\\xf9"
              }
            ],
            "repeated": 0,
            "id": 677
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307baa0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xb0\\xbc\\x07\\x03\\x18@\\x07\\x03\\xb8\\xbc\\x07\\x03 @\\x07\\x03\\xc0\\xbc\\x07\\x03(@\\x07\\x03\\x00\\x00\\xfcj\\xc0\\xd5\\xfdj\\x00P(\\x00@\\x00B\\x00\\xd0\\xbb\\x07\\x03\\x18\\x00\\x1a\\x00\\xf8\\xbb\\x07\\x03\\xcc\\xab\\x08\\x00\\xff\\xff\\x00\\x00\\\\xb1\\x08\\x03P\\\\xbew\r\\xe17f"
              }
            ],
            "repeated": 0,
            "id": 678
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307bcb0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xf0\\xbe\\x07\\x03\\xa0\\xba\\x07\\x03\\xf8\\xbe\\x07\\x03\\xa8\\xba\\x07\\x03\\xa0`\\x07\\x03\\xb0\\xba\\x07\\x03\\x00\\x00\\xd7v\\xc0Z\\xdav\\x00\\xf0\\x0b\\x00<\\x00>\\x00\\x98\\xbd\\x07\\x03\\x14\\x00\\x16\\x00\\xc0\\xbd\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xd8[\\xbew\\xd8[\\xbew/V'~"
              }
            ],
            "repeated": 0,
            "id": 679
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307bef0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x90`\\x07\\x03\\xb0\\xbc\\x07\\x03\\x98`\\x07\\x03\\xb8\\xbc\\x07\\x03\\xd0\\xca\\x07\\x03pb\\x07\\x03\\x00\\x00]w`\\xcf`w\\x00\\xc0\\x19\\x00<\\x00>\\x00\\xf0^\\x07\\x03\\x14\\x00\\x16\\x00\\x18_\\x07\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\xbc\\xb2\\x08\\x03\\x80[\\xbew\\xf0\\xb9\\x94\\x0c"
              }
            ],
            "repeated": 0,
            "id": 680
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03076090"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "`b\\x07\\x03\\xf0\\xbe\\x07\\x03hb\\x07\\x03\\xf8\\xbe\\x07\\x03\\xb0\\xc2\\x07\\x03\\xc0\\xbc\\x07\\x03\\x00\\x00\\xd5v\\x00\\x00\\x00\\x00\\x00\\x80\\x01\\x00<\\x00>\\x00xa\\x07\\x03\\x14\\x00\\x16\\x00\\xa0a\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x00\\x04e\\x07\\x03\\x00\\\\xbew\\xd19\\x17p"
              }
            ],
            "repeated": 0,
            "id": 681
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03076260"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xc8d\\x07\\x03\\x90`\\x07\\x03\\xd0d\\x07\\x03\\x98`\\x07\\x03\\x00\\xbf\\x07\\x03\\xd8d\\x07\\x03\\x00\\x00\\xb1v\\xd0u\\xb1v\\x00@\\x02\\x00:\\x00<\\x00Hc\\x07\\x03\\x12\\x00\\x14\\x00pc\\x07\\x03\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\x88[\\xbew\\x88[\\xbew$\\xf3\\x19\\x07"
              }
            ],
            "repeated": 0,
            "id": 682
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030764c8"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "x\\xc0\\x07\\x03`b\\x07\\x03\\x80\\xc0\\x07\\x03hb\\x07\\x03pb\\x07\\x03\\x88\\xc0\\x07\\x03\\x00\\x00xw\\xa0:~w\\x00\\x80\\x0e\\x00B\\x00D\\x00\\xb0e\\x07\\x03\\x1a\\x00\\x1c\\x00\\xd8e\\x07\\x03\\xcc\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\xb4\\xc0\\x07\\x03\\xcc`\\x07\\x03g\\x10$\\x04"
              }
            ],
            "repeated": 0,
            "id": 683
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307c078"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xa0\\xc2\\x07\\x03\\xc8d\\x07\\x03\\xa8\\xc2\\x07\\x03\\xd0d\\x07\\x03\\xd8d\\x07\\x03\\xb0\\xc2\\x07\\x03\\x00\\x00\\xf4v\\x00x\\xf5v\\x00\\xb0\\x07\\x00B\\x00D\\x00(\\xc1\\x07\\x03\\x1a\\x00\\x1c\\x00P\\xc1\\x07\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\xbc\\xcd\\x07\\x03\\x04e\\x07\\x03RDR\\xfd"
              }
            ],
            "repeated": 0,
            "id": 684
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307c2a0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xe0\\xc6\\x07\\x03x\\xc0\\x07\\x03\\xe8\\xc6\\x07\\x03\\x80\\xc0\\x07\\x03\\x88\\xc0\\x07\\x03\\xa0`\\x07\\x03\\x00\\x00\\x9fv0\\xba\\xa1v\\x00\\x00\\x12\\x00@\\x00B\\x00\\x88\\xc3\\x07\\x03\\x18\\x00\\x1a\\x00\\xb0\\xc3\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x008\\\\xbew8\\\\xbew\\xa2\\xd3cg"
              }
            ],
            "repeated": 0,
            "id": 685
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307c6e0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x80\\xcd\\x07\\x03\\xa0\\xc2\\x07\\x03\\x88\\xcd\\x07\\x03\\xa8\\xc2\\x07\\x03\\x90\\xcd\\x07\\x03\\xd0\\xca\\x07\\x03\\x00\\x00\\xf4u\\xa0\\xbf\\x0bv\\x00p[\\x00>\\x00@\\x00\\xc8\\xc7\\x07\\x03\\x16\\x00\\x18\\x00\\xf0\\xc7\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\x1c\\xcf\\x07\\x03\\xa8[\\xbew\\xf8\\xbc\\xed\\xac"
              }
            ],
            "repeated": 0,
            "id": 686
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307cd80"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "P\\xd2\\x07\\x03\\xe0\\xc6\\x07\\x03X\\xd2\\x07\\x03\\xe8\\xc6\\x07\\x03\\x00\\xd1\\x07\\x03\\xf0\\xc6\\x07\\x03\\x00\\x00Pv\\x90xQv\\x00P\\x04\\x00>\\x00@\\x00\\xf8\\xdd\\x07\\x03\\x16\\x00\\x18\\x00 \\xde\\x07\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\x00\\\\xbew\\xb4\\xc0\\x07\\x03NV\\xc3\\x03"
              }
            ],
            "repeated": 0,
            "id": 687
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d250"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xb0\\xd3\\x07\\x03\\x80\\xcd\\x07\\x03\\xb8\\xd3\\x07\\x03\\x88\\xcd\\x07\\x03\\xf0\\xce\\x07\\x03\\xc0\\xd3\\x07\\x03\\x00\\x00\\xe6v `\\xe9v\\x00`\t\\x00@\\x00B\\x00\\x88\\xdf\\x07\\x03\\x18\\x00\\x1a\\x00\\xb0\\xdf\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xfc\\xd5\\x07\\x03\\xe8[\\xbewU\\x89C\\x99"
              }
            ],
            "repeated": 0,
            "id": 688
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d3b0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xf0\\xd0\\x07\\x03P\\xd2\\x07\\x03\\xf8\\xd0\\x07\\x03X\\xd2\\x07\\x03`\\xd2\\x07\\x03\\x00\\xd1\\x07\\x03\\x00\\x003w\\x10\\xb8Fw\\x00\\x00(\\x00>\\x00@\\x00\\x08\\xe1\\x07\\x03\\x16\\x00\\x18\\x000\\xe1\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xc0[\\xbew\\xc0[\\xbew\\x83p\\x1a\\xa1"
              }
            ],
            "repeated": 0,
            "id": 689
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d0f0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "`\\xd4\\x07\\x03\\xb0\\xd3\\x07\\x03h\\xd4\\x07\\x03\\xb8\\xd3\\x07\\x03\\xc0\\xd3\\x07\\x03\\x90\\xcd\\x07\\x03\\x00\\x00\\xc0v\\x80\\xd3\\xc3v\\x00\\xf0\\x0b\\x00<\\x00>\\x00\\xc0\\xe2\\x07\\x03\\x14\\x00\\x16\\x00\\xe8\\xe2\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x00|\\xd0\\x07\\x03\\x98[\\xbew\\xb5ly\\xae"
              }
            ],
            "repeated": 0,
            "id": 690
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d460"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": " \\xcc\\x07\\x03\\xf0\\xd0\\x07\\x03(\\xcc\\x07\\x03\\xf8\\xd0\\x07\\x03\\xb0\\xd1\\x07\\x030\\xd7\\x07\\x03\\x00\\x00Uv\\x90\\xf7Wv\\x00\\x80C\\x00@\\x00B\\x00\\xa0\\xe4\\x07\\x03\\x18\\x00\\x1a\\x00\\xc8\\xe4\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x00\\x18\\\\xbew\\x18\\\\xbewe\\x94\\x9c\\xfa"
              }
            ],
            "repeated": 0,
            "id": 691
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307cc20"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": " \\xd7\\x07\\x03`\\xd4\\x07\\x03(\\xd7\\x07\\x03h\\xd4\\x07\\x030\\xd7\\x07\\x03\\xf0\\xce\\x07\\x03\\x00\\x00\\xf0v\\x10\\xcc\\xf0v\\x00\\xb0\\x03\\x00@\\x00B\\x00p\\xea\\x07\\x03\\x18\\x00\\x1a\\x00\\x98\\xea\\x07\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00L\\xca\\x07\\x03\\x1c-\\x07\\x03\\x13\\xc0\\x9eE"
              }
            ],
            "repeated": 0,
            "id": 692
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d720"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xe0\\xce\\x07\\x03 \\xcc\\x07\\x03\\xe8\\xce\\x07\\x03(\\xcc\\x07\\x03p\\xd4\\x07\\x030\\xcc\\x07\\x03\\x00\\x00[w\\xe0\\x93[w\\x00\\x90\\x01\\x00<\\x00>\\x00\\xd0\\xeb\\x07\\x03\\x14\\x00\\x16\\x00\\xf8\\xeb\\x07\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\x90[\\xbew\\x90[\\xbewp\\xa4\\xcbw"
              }
            ],
            "repeated": 0,
            "id": 693
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307cee0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xa0\\xd1\\x07\\x03 \\xd7\\x07\\x03\\xa8\\xd1\\x07\\x03(\\xd7\\x07\\x030\\xcc\\x07\\x03`\\xd2\\x07\\x03\\x00\\x00\\x90p@5\\x90p\\x00\\x90\\x01\\x006\\x008\\x00x\\xee\\x07\\x03\\x0e\\x00\\x10\\x00\\xa0\\xee\\x07\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00,\\xc1\\x08\\x03\\x1c\\xc7\\x07\\x03EI\\xdeg"
              }
            ],
            "repeated": 0,
            "id": 694
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d1a0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xc0\\xd5\\x07\\x03\\xe0\\xce\\x07\\x03\\xc8\\xd5\\x07\\x03\\xe8\\xce\\x07\\x03@\\xce\\x07\\x03p\\xd4\\x07\\x03\\x00\\x00\\xb9\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x006\\x008\\x00\\x18\\xef\\x07\\x03\\x0e\\x00\\x10\\x00@\\xef\\x07\\x03\\xcc*\\x08\\x00\\xff\\xff\\x00\\x00\\xcc\\xbf\\x08\\x03\\xb0[\\xbew-\\x94'\\xa8"
              }
            ],
            "repeated": 0,
            "id": 695
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d5c0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "0\\xce\\x07\\x03\\xa0\\xd1\\x07\\x038\\xce\\x07\\x03\\xa8\\xd1\\x07\\x03 \\xca\\x07\\x03@\\xce\\x07\\x03\\x00\\x00\\xf4j\\xe0\\x9e\\xf5j\\x00\\xd0\\x07\\x00@\\x00B\\x00\\xa8\\xef\\x07\\x03\\x18\\x00\\x1a\\x00\\xd0\\xef\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xe8[\\xbew\\x8c\\xd2\\x07\\x03\\xd0,\\x13\\xb9"
              }
            ],
            "repeated": 0,
            "id": 696
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307ce30"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\xca\\x07\\x03\\xc0\\xd5\\x07\\x03\\x18\\xca\\x07\\x03\\xc8\\xd5\\x07\\x03\\xd0\\xd5\\x07\\x03\\xb0\\xd1\\x07\\x03\\x00\\x00\\xccv\\x80$\\xd0v\\x00p\\x08\\x00<\\x00>\\x00\\xd8\\xf0\\x07\\x03\\x14\\x00\\x16\\x00\\x00\\xf1\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\xff\\xff\\xd0[\\xbew\\xd0[\\xbew\\xa1\\xe8\\xef\\xc5"
              }
            ],
            "repeated": 0,
            "id": 697
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307ca10"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xc0\\xca\\x07\\x030\\xce\\x07\\x03\\xc8\\xca\\x07\\x038\\xce\\x07\\x03P\\xd0\\x07\\x03\\xd0\\xd5\\x07\\x03\\x00\\x00\\xf3j\\xd0]\\xf3j\\x00\\x00\\x01\\x00<\\x00>\\x00x\\xf6\\x07\\x03\\x14\\x00\\x16\\x00\\xa0\\xf6\\x07\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\xc8[\\xbew\\\\xcc\\x07\\x035s\\xbc\\xd2"
              }
            ],
            "repeated": 0,
            "id": 698
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307cac0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "@\\xd0\\x07\\x03\\x10\\xca\\x07\\x03H\\xd0\\x07\\x03\\x18\\xca\\x07\\x03\\xf0\\xc6\\x07\\x03\\x00\\xbf\\x07\\x03\\x00\\x00\\xe3v\\x10D\\xe3v\\x00P\\x02\\x00:\\x00<\\x00@\\xf2\\x07\\x03\\x12\\x00\\x14\\x00h\\xf2\\x07\\x03\\xcc\\xaa\\x08\\x00\\xff\\xff\\x00\\x00<\\xd3\\x07\\x03p\\\\xbew\\x8f6\\x80\\x93"
              }
            ],
            "repeated": 0,
            "id": 699
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d040"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\xd3\\x07\\x03\\xc0\\xca\\x07\\x03\\x08\\xd3\\x07\\x03\\xc8\\xca\\x07\\x03\\x10\\xd3\\x07\\x03 \\xca\\x07\\x03\\x00\\x00\\xfcv\\xf0X\\x01w\\x00\\xf0\\x0f\\x00>\\x00@\\x00\\xb0\\xf1\\x07\\x03\\x16\\x00\\x18\\x00\\xd8\\xf1\\x07\\x03\\xec\\xaa\\x08\\x00\\x06\\x00\\xff\\xff\\x98[\\xbew,\\xd1\\x07\\x03\\xfcN\\xe3\\x96"
              }
            ],
            "repeated": 0,
            "id": 700
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d300"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x80\\xd8\\x07\\x03@\\xd0\\x07\\x03\\x88\\xd8\\x07\\x03H\\xd0\\x07\\x03\\x80\\xcb\\x07\\x03P\\xd0\\x07\\x03\\x00\\x00\\xcbu@K\\xcbu\\x000\\x06\\x00<\\x00>\\x00P\\xf7\\x07\\x03\\x14\\x00\\x16\\x00x\\xf7\\x07\\x03\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\xec\\xc3\\x08\\x03\\xfc\\xca\\x07\\x03\\x1c\\x9c&\\x03"
              }
            ],
            "repeated": 0,
            "id": 701
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d880"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "p\\xcb\\x07\\x03\\x00\\xd3\\x07\\x03x\\xcb\\x07\\x03\\x08\\xd3\\x07\\x03@\\xd9\\x07\\x03\\x80\\xcb\\x07\\x03\\x00\\x00\\xb5uP$\\xb6u\\x00\\xc0\\x07\\x00@\\x00B\\x00`\\xa8\\x08\\x03\\x18\\x00\\x1a\\x00\\x88\\xa8\\x08\\x03\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00`\\\\xbew`\\\\xbew\\xc8Z\\xae\\xae"
              }
            ],
            "repeated": 0,
            "id": 702
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307cb70"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "0\\xd9\\x07\\x03\\x80\\xd8\\x07\\x038\\xd9\\x07\\x03\\x88\\xd8\\x07\\x03\\x90\\xd8\\x07\\x03\\x10\\xd3\\x07\\x03\\x00\\x00\\xa5up\r\\xa7u\\x00`\\x07\\x00>\\x00@\\x00\\xf8\\xf1\\x07\\x03\\x16\\x00\\x18\\x00 \\xf2\\x07\\x03\\xec\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\xf8[\\xbew\\xf8[\\xbew%\\x9c\\xbe\\xd4"
              }
            ],
            "repeated": 0,
            "id": 703
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307d930"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xd0\\xcc\\x07\\x03p\\xcb\\x07\\x03\\xd8\\xcc\\x07\\x03x\\xcb\\x07\\x03\\xe0\\xbc\\x08\\x03\\x90\\xd8\\x07\\x03\\x00\\x00$w\\xe0\\xc9&w\\x000\\x0e\\x00:\\x00<\\x00\\x80\\xf4\\x07\\x03\\x12\\x00\\x14\\x00\\xa8\\xf4\\x07\\x03\\xec\\xaa\\x08\\x00\\x06\\x00\\xff\\xff\\x0c\\xb2\\x08\\x03h\\\\xbew\\xd0\\xef\\xb5H"
              }
            ],
            "repeated": 0,
            "id": 704
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0307ccd0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "p\\xbb\\x08\\x030\\xd9\\x07\\x03x\\xbb\\x08\\x038\\xd9\\x07\\x030\\xb1\\x08\\x03 \\xba\\x08\\x03\\x00\\x00\nu\\x00\\x18\nu\\x00\\x80\\x00\\x00>\\x00@\\x00X\\xf5\\x07\\x03\\x16\\x00\\x18\\x00\\x80\\xf5\\x07\\x03\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\xac\\xbb\\x08\\x03\\xf0[\\xbew\\x0c\\xf7\\x87*"
              }
            ],
            "repeated": 0,
            "id": 705
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308bb70"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\xba\\x08\\x03\\xd0\\xcc\\x07\\x03\\x18\\xba\\x08\\x03\\xd8\\xcc\\x07\\x03\\x00\\xc1\\x08\\x030\\xb1\\x08\\x03\\x00\\x00Gk\\xc0~Gk\\x00\\x00\\x02\\x00>\\x00@\\x00\\x88\\xf2\\x07\\x03\\x16\\x00\\x18\\x00\\xb0\\xf2\\x07\\x03\\xec\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\xec\\xb8\\x08\\x03\\x0c\\xcd\\x07\\x03\\xe0\\x15`>"
              }
            ],
            "repeated": 0,
            "id": 706
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308ba10"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": " \\xb1\\x08\\x03p\\xbb\\x08\\x03(\\xb1\\x08\\x03x\\xbb\\x08\\x03\\xe0\\xcc\\x07\\x03\\xe0\\xb1\\x08\\x03\\x00\\x00\tup,\tu\\x00\\xf0\\x00\\x00@\\x00B\\x00\\xe0\\xd5\\x08\\x03\\x18\\x00\\x1a\\x00\\x08\\xd6\\x08\\x03\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00H\\\\xbewH\\\\xbew\\x1fX\\x01\\x88"
              }
            ],
            "repeated": 0,
            "id": 707
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308b120"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xd0\\xbc\\x08\\x03\\x10\\xba\\x08\\x03\\xd8\\xbc\\x08\\x03\\x18\\xba\\x08\\x03\\x80\\xbb\\x08\\x03\\xe0\\xcc\\x07\\x03\\x00\\x00xrp\\xf1|r\\x00\\xa0\\x0c\\x00>\\x00@\\x00 \\xf1\\x07\\x03\\x16\\x00\\x18\\x00H\\xf1\\x07\\x03\\xec\\xaa\\x08\\x00\\x06\\x00\\x00\\x00P\\\\xbew\\xdc\\xba\\x07\\x03\\x18\\x1f>\\xba"
              }
            ],
            "repeated": 0,
            "id": 708
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308bcd0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xd0\\xb1\\x08\\x03 \\xb1\\x08\\x03\\xd8\\xb1\\x08\\x03(\\xb1\\x08\\x03\\xe0\\xb1\\x08\\x03@\\xd9\\x07\\x03\\x00\\x00\\xcet`*\\xcet\\x00\\xa0\\x00\\x00B\\x00D\\x00\\xa0\\xd9\\x08\\x03\\x1a\\x00\\x1c\\x00\\xc8\\xd9\\x08\\x03\\xcc\\xaa\\x08\\x00\\x06\\x00\\x00\\x00(\\\\xbew(\\\\xbewh\\xbd\\x90\\xa7"
              }
            ],
            "repeated": 0,
            "id": 709
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308b1d0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xf0\\xc0\\x08\\x03\\xd0\\xbc\\x08\\x03\\xf8\\xc0\\x08\\x03\\xd8\\xbc\\x08\\x03 \\xba\\x08\\x03\\xe0\\xbc\\x08\\x03\\x00\\x00\\xd9t\\xd0\\xcc\\xd9t\\x00\\x10\\x02\\x00>\\x00@\\x00\\x18\\xf1\\x08\\x03\\x16\\x00\\x18\\x00@\\xf1\\x08\\x03\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00h\\\\xbewl\\xd9\\x07\\x03\\xacF\\x9d~"
              }
            ],
            "repeated": 0,
            "id": 710
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308c0f0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xb0\\xb8\\x08\\x03\\xd0\\xb1\\x08\\x03\\xb8\\xb8\\x08\\x03\\xd8\\xb1\\x08\\x03\\xc0\\xb8\\x08\\x03\\x80\\xbb\\x08\\x03\\x00\\x00\\xe9t\\xe0G\\xe9t\\x00\\xf0\\x00\\x00L\\x00N\\x00`;\t\\x03$\\x00&\\x00\\x88;\t\\x03\\xcc\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\xa8[\\xbew\\x1c\\xcf\\x07\\x03\\xc5\\xea\\xab6"
              }
            ],
            "repeated": 0,
            "id": 711
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308b8b0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x80\\xb2\\x08\\x03\\xf0\\xc0\\x08\\x03\\x88\\xb2\\x08\\x03\\xf8\\xc0\\x08\\x03\\x90\\xb2\\x08\\x03\\x00\\xc1\\x08\\x03\\x00\\x00\\xbav\\xc06\\xbdv\\x00\\xf0\\x05\\x00P\\x00R\\x00\\x90A\t\\x03(\\x00*\\x00\\xb8A\t\\x03\\xcc\\xaa\\x0c\\x00\\xff\\xff\\x00\\x00\\xf0[\\xbew\\xac\\xbb\\x08\\x03\\x1e\\x8a\\xca\\xed"
              }
            ],
            "repeated": 0,
            "id": 712
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308b280"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xb0\\xc3\\x08\\x03\\xb0\\xb8\\x08\\x03\\xb8\\xc3\\x08\\x03\\xb8\\xb8\\x08\\x03\\xc0\\xc3\\x08\\x03\\xc0\\xb8\\x08\\x03\\x00\\x00\\xdajp\\x8b\\xddj\\x00\\x80\\x18\\x00>\\x00@\\x00\\xf8\\xef\\x08\\x03\\x16\\x00\\x18\\x00 \\xf0\\x08\\x03\\xcc\\xaa\\x08\\x00\\x06\\x00\\x00\\x00\\x9c\\xb9\\x08\\x03,\\xbf\\x07\\x03\\xa1\\x07]\\xdc"
              }
            ],
            "repeated": 0,
            "id": 713
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308c3b0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "`\\xb9\\x08\\x03\\x80\\xb2\\x08\\x03h\\xb9\\x08\\x03\\x88\\xb2\\x08\\x03\\xa0\\xbf\\x08\\x03\\x90\\xb2\\x08\\x03\\x00\\x00\\xd7j\\xf0\\x17\\xd9j\\x00\\xb0\\x02\\x00>\\x00@\\x00@\\xf0\\x08\\x03\\x16\\x00\\x18\\x00h\\xf0\\x08\\x03\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00p\\\\xbew<\\xd3\\x07\\x03\n\\x16\\xd0!"
              }
            ],
            "repeated": 0,
            "id": 714
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308b960"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x90\\xbf\\x08\\x03\\xb0\\xc3\\x08\\x03\\x98\\xbf\\x08\\x03\\xb8\\xc3\\x08\\x03\\x9c]\\xbew\\xa0\\xbf\\x08\\x03\\x00\\x00\\xbak\\x00\"\\xbak\\x00\\xf0\\x01\\x006\\x008\\x00\\xf0p\\x08\\x03\\x0e\\x00\\x10\\x00\\x18q\\x08\\x03\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\x80[\\xbew\\xbc\\xb2\\x08\\x03v\\x9aYa"
              }
            ],
            "repeated": 0,
            "id": 715
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0308bf90"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\x8c]\\xbew`\\xb9\\x08\\x03\\x94]\\xbewh\\xb9\\x08\\x03p\\xb9\\x08\\x03\\xc0\\xc3\\x08\\x03\\x00\\x00\\xb8kpy\\xb8k\\x00\\xc0\\x01\\x008\\x00:\\x00`\\xf1\\x08\\x03\\x10\\x00\\x12\\x00\\x88\\xf1\\x08\\x03\\xcc\\xaa\\x0c\\x00\\x06\\x00\\x00\\x00\\xb0[\\xbew\\xdc\\xd1\\x07\\x03\\x81T\\xe4<"
              }
            ],
            "repeated": 0,
            "id": 716
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00cbc00c"
              },
              {
                "name": "Size",
                "value": "0x00000004"
              },
              {
                "name": "Buffer",
                "value": "\\x80]\\xbew"
              }
            ],
            "repeated": 0,
            "id": 717
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be5d94"
              },
              {
                "name": "Size",
                "value": "0x00000004"
              },
              {
                "name": "Buffer",
                "value": "\\xe8,\\x07\\x03"
              }
            ],
            "repeated": 0,
            "id": 718
          },
          {
            "timestamp": "2026-05-28 22:59:34,316",
            "thread_id": "4312",
            "caller": "0x00f9d86c",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtReadVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03072ce0"
              },
              {
                "name": "Size",
                "value": "0x00000048"
              },
              {
                "name": "Buffer",
                "value": "\\xf8+\\x07\\x03\\x8c]\\xbew\\x00,\\x07\\x03\\x94]\\xbew\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf2\\x00P\\xea\\xfa\\x00\\x00\\xe0\n\\x00J\\x00L\\x00\\xc8\\x1c\\x07\\x03\\x1a\\x00\\x1c\\x00\\xf8\\x1c\\x07\\x03\\xcc\\xaa\\x00\\x00\\xff\\xff\\xff\\xff\\\\xcc\\x07\\x03\\xc8[\\xbew\\xac\n\\e"
              }
            ],
            "repeated": 0,
            "id": 719
          },
          {
            "timestamp": "2026-05-28 22:59:34,378",
            "thread_id": "4312",
            "caller": "0x00f9d897",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030bd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 720
          },
          {
            "timestamp": "2026-05-28 22:59:34,378",
            "thread_id": "4312",
            "caller": "0x00f9d8ee",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 100,
            "id": 721
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00f9da0a",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 722
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00f9da0a",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\SLC"
              },
              {
                "name": "DllBase",
                "value": "0x6bba0000"
              }
            ],
            "repeated": 0,
            "id": 723
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00f9da0a",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 724
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00f9da0a",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              }
            ],
            "repeated": 0,
            "id": 725
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00f9da0a",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000310"
              }
            ],
            "repeated": 0,
            "id": 726
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00f9da0a",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 727
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00f9da0a",
            "parentcaller": "0x00f9d74d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\sppc"
              },
              {
                "name": "DllBase",
                "value": "0x6bb80000"
              }
            ],
            "repeated": 0,
            "id": 728
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00f9da0a",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 729
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00f9da0a",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 730
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00f9da0a",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6bb80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 731
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00f9da0a",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 732
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00f9da0a",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 733
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00f9da0a",
            "parentcaller": "0x00f9d74d",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6bba0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 734
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 735
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 736
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 737
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 738
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd9\\x07\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 739
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG      Host OS License State   [ Not-Genuine ]\r\n"
              },
              {
                "name": "Length",
                "value": "95"
              }
            ],
            "repeated": 0,
            "id": 740
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 741
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 742
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 743
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 744
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x008\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 745
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\x08\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 746
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG      Host OS Architecture    [ x64 ]\r\n"
              },
              {
                "name": "Length",
                "value": "87"
              }
            ],
            "repeated": 0,
            "id": 747
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 748
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 749
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 750
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa6478",
            "parentcaller": "0x00fa4115",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Status",
                "value": "Log limit reached"
              }
            ],
            "repeated": 0,
            "id": 751
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x8f\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 752
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x8f\\x08\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 753
          },
          {
            "timestamp": "2026-05-28 22:59:34,394",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG      Host OS Language Id     [ 1033 ]\r\n"
              },
              {
                "name": "Length",
                "value": "88"
              }
            ],
            "repeated": 0,
            "id": 754
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 755
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 756
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 757
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe7\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 758
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xe7\\x08\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 759
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG      User UI Language Id     [ 1033 ]\r\n"
              },
              {
                "name": "Length",
                "value": "88"
              }
            ],
            "repeated": 0,
            "id": 760
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 761
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 762
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 763
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00?\t\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 764
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "?\t\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 765
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG      Host OS Edition         [ Professional ]\r\n"
              },
              {
                "name": "Length",
                "value": "96"
              }
            ],
            "repeated": 0,
            "id": 766
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 767
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 768
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 769
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9f\t\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 770
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x9f\t\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 771
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG      Host OS Version         [ 10.0.19045 ]\r\n"
              },
              {
                "name": "Length",
                "value": "94"
              }
            ],
            "repeated": 0,
            "id": 772
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 773
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00f5c6f6",
            "parentcaller": "0x00f5b5a2",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              },
              {
                "name": "Handle",
                "value": "0x00000318"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              }
            ],
            "repeated": 0,
            "id": 774
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00f5b5cc",
            "parentcaller": "0x00f4cae1",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              },
              {
                "name": "ValueName",
                "value": "BuildLabEx"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx"
              }
            ],
            "repeated": 0,
            "id": 775
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00f5b5cc",
            "parentcaller": "0x00f4cae1",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              },
              {
                "name": "ValueName",
                "value": "BuildLabEx"
              },
              {
                "name": "Data",
                "value": "19041.1.amd64fre.vb_release.191206-1406"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx"
              }
            ],
            "repeated": 0,
            "id": 776
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00f5b66a",
            "parentcaller": "0x00f4cae1",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 777
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 778
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 779
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xfd\t\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 780
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xfd\t\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 781
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG      Host OS Build String    [ 19041.1.amd64fre.vb_release.191206-1406 ]\r\n"
              },
              {
                "name": "Length",
                "value": "123"
              }
            ],
            "repeated": 0,
            "id": 782
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 783
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 784
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 785
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00x\n\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 786
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "x\n\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 787
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG  SetupHost::InitializeComponents\r\n"
              },
              {
                "name": "Length",
                "value": "83"
              }
            ],
            "repeated": 0,
            "id": 788
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 789
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 790
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 791
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xcb\n\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 792
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xcb\n\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 793
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:34, Info                  MOUPG  SetupHost: Loading ID: [c7b6e4de-b741-42d8-ac05-16738c9e0bc5] from [C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll]...\r\n"
              },
              {
                "name": "Length",
                "value": "167"
              }
            ],
            "repeated": 0,
            "id": 794
          },
          {
            "timestamp": "2026-05-28 22:59:34,410",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 795
          },
          {
            "timestamp": "2026-05-28 22:59:35,160",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\MFC42u"
              },
              {
                "name": "DllBase",
                "value": "0x6b4d0000"
              }
            ],
            "repeated": 0,
            "id": 796
          },
          {
            "timestamp": "2026-05-28 22:59:35,160",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_a863d714867441db\\COMCTL32"
              },
              {
                "name": "DllBase",
                "value": "0x72970000"
              }
            ],
            "repeated": 0,
            "id": 797
          },
          {
            "timestamp": "2026-05-28 22:59:35,160",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\COMDLG32"
              },
              {
                "name": "DllBase",
                "value": "0x75e20000"
              }
            ],
            "repeated": 0,
            "id": 798
          },
          {
            "timestamp": "2026-05-28 22:59:35,175",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WMsgAPI"
              },
              {
                "name": "DllBase",
                "value": "0x69e70000"
              }
            ],
            "repeated": 0,
            "id": 799
          },
          {
            "timestamp": "2026-05-28 22:59:35,175",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\$Windows.~WS\\Sources\\WDSCORE"
              },
              {
                "name": "DllBase",
                "value": "0x69e30000"
              }
            ],
            "repeated": 0,
            "id": 800
          },
          {
            "timestamp": "2026-05-28 22:59:35,175",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\UxTheme"
              },
              {
                "name": "DllBase",
                "value": "0x747b0000"
              }
            ],
            "repeated": 0,
            "id": 801
          },
          {
            "timestamp": "2026-05-28 22:59:35,175",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr"
              },
              {
                "name": "DllBase",
                "value": "0x69e80000"
              }
            ],
            "repeated": 0,
            "id": 802
          },
          {
            "timestamp": "2026-05-28 22:59:35,175",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "MSVCRT.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x76d70000"
              }
            ],
            "repeated": 0,
            "id": 803
          },
          {
            "timestamp": "2026-05-28 22:59:35,175",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "__notification__",
            "api": "sysenter",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadIdentifier",
                "value": "4312"
              },
              {
                "name": "Module",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "Return Address",
                "value": "0x75d5274c"
              }
            ],
            "repeated": 0,
            "id": 804
          },
          {
            "timestamp": "2026-05-28 22:59:35,175",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x69e80000"
              }
            ],
            "repeated": 0,
            "id": 805
          },
          {
            "timestamp": "2026-05-28 22:59:35,175",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x69e80000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 806
          },
          {
            "timestamp": "2026-05-28 22:59:35,175",
            "thread_id": "4312",
            "caller": "0x00f5897a",
            "parentcaller": "0x00f4cd31",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "MediaSetupUIMgr.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69e80000"
              },
              {
                "name": "FunctionName",
                "value": "CreateSetupObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x69ebf4a0"
              }
            ],
            "repeated": 0,
            "id": 807
          },
          {
            "timestamp": "2026-05-28 22:59:35,175",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 808
          },
          {
            "timestamp": "2026-05-28 22:59:35,175",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 809
          },
          {
            "timestamp": "2026-05-28 22:59:35,175",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00r\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 810
          },
          {
            "timestamp": "2026-05-28 22:59:35,175",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "r\\x0b\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 811
          },
          {
            "timestamp": "2026-05-28 22:59:35,175",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:35, Info                  MOUPG  SetupHost: Loading complete.\r\n"
              },
              {
                "name": "Length",
                "value": "80"
              }
            ],
            "repeated": 0,
            "id": 812
          },
          {
            "timestamp": "2026-05-28 22:59:35,175",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 813
          },
          {
            "timestamp": "2026-05-28 22:59:35,175",
            "thread_id": "4312",
            "caller": "0x00f4bcc6",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "GetCursorPos",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "x",
                "value": "0"
              },
              {
                "name": "y",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 814
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00f4bcc6",
            "parentcaller": "0x00f49129",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x0000034c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x76dd6d60"
              },
              {
                "name": "Parameter",
                "value": "0x03323298"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "4316"
              },
              {
                "name": "ProcessId",
                "value": "5932"
              },
              {
                "name": "Module",
                "value": "msvcrt.dll"
              }
            ],
            "repeated": 0,
            "id": 815
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00f4bcc6",
            "parentcaller": "0x00f49129",
            "category": "threading",
            "api": "CreateThread",
            "status": true,
            "return": "0x0000034c",
            "arguments": [
              {
                "name": "StartRoutine",
                "value": "0x76dd6d60"
              },
              {
                "name": "ModuleName",
                "value": "msvcrt.dll"
              },
              {
                "name": "Parameter",
                "value": "0x03323298"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000004"
              },
              {
                "name": "ThreadId",
                "value": "4316"
              }
            ],
            "repeated": 0,
            "id": 816
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00f4bcc6",
            "parentcaller": "0x00f49129",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x0000034c"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "4316"
              },
              {
                "name": "ProcessId",
                "value": "5932"
              }
            ],
            "repeated": 0,
            "id": 817
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00f4bcc6",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 818
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 819
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 820
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00f4bcc6",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 821
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00f4bcc6",
            "parentcaller": "0x00f49129",
            "category": "threading",
            "api": "NtSuspendThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x0000034c"
              },
              {
                "name": "SuspendCount",
                "value": "0"
              },
              {
                "name": "ThreadId",
                "value": "4316"
              },
              {
                "name": "ProcessId",
                "value": "5932"
              }
            ],
            "repeated": 0,
            "id": 822
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 823
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 824
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc2\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 825
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc2\\x0b\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 826
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:35, Info                  MOUPG  CInstallUI::Initialize\r\n"
              },
              {
                "name": "Length",
                "value": "74"
              }
            ],
            "repeated": 0,
            "id": 827
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 828
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00f4bcc6",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000340"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000344"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 829
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00f4bcc6",
            "parentcaller": "0x00f49129",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x0000034c"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "4316"
              },
              {
                "name": "ProcessId",
                "value": "5932"
              }
            ],
            "repeated": 0,
            "id": 830
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000348"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 831
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00f4bcc6",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 832
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 833
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 834
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 835
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x0c\\x0c\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 836
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:35, Info                  MOUPG  SetupHost: Loading ID: [3d3ad714-f8d8-4c84-ad5f-10938c2f3339] from [C:\\$Windows.~WS\\Sources\\SetupCore.dll]...\r\n"
              },
              {
                "name": "Length",
                "value": "161"
              }
            ],
            "repeated": 0,
            "id": 837
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 838
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\USP10"
              },
              {
                "name": "DllBase",
                "value": "0x6b330000"
              }
            ],
            "repeated": 0,
            "id": 839
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msls31"
              },
              {
                "name": "DllBase",
                "value": "0x6b2f0000"
              }
            ],
            "repeated": 0,
            "id": 840
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\RICHED20"
              },
              {
                "name": "DllBase",
                "value": "0x6b350000"
              }
            ],
            "repeated": 0,
            "id": 841
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\RICHED32"
              },
              {
                "name": "DllBase",
                "value": "0x6cd10000"
              }
            ],
            "repeated": 0,
            "id": 842
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "RICHED32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x6cd10000"
              }
            ],
            "repeated": 0,
            "id": 843
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x7798917f",
            "parentcaller": "0x69eb8835",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "MediaSetupUIMgr.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69e80000"
              }
            ],
            "repeated": 0,
            "id": 844
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x75d4069b",
            "parentcaller": "0x75d404d5",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\Lang.ini"
              }
            ],
            "repeated": 0,
            "id": 845
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x75d4076e",
            "parentcaller": "0x75d404d5",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Lang.ini"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 846
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x75d40c12",
            "parentcaller": "0x75d40ba2",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002c8"
              }
            ],
            "repeated": 0,
            "id": 847
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x75d40c2c",
            "parentcaller": "0x75d40ba2",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00J\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 848
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x75d40c37",
            "parentcaller": "0x75d40ba2",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              }
            ],
            "repeated": 0,
            "id": 849
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa0c12",
            "parentcaller": "0x00fa0cdd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030c1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 850
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa0501",
            "parentcaller": "0x00fa057d",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\Panther"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\Panther"
              }
            ],
            "repeated": 0,
            "id": 851
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 852
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 853
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000304"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 854
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000304"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 855
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000304"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log"
              },
              {
                "name": "Buffer",
                "value": "\\xfeff"
              },
              {
                "name": "Length",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 856
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000304"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 857
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000304"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 858
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000304"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:35, Error                 MOUPG  CInstallUI::GetDefaultLanguage(2027): Result = 0x80070002[gle=0x00000002]\r\n"
              },
              {
                "name": "Length",
                "value": "125"
              }
            ],
            "repeated": 0,
            "id": 859
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000308"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00b\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 860
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000308"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "b\\x07\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 861
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000308"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "Buffer",
                "value": "<z:row Cls=\"D\" Sev=\"33554432\" Maj=\"Def\" Min=\"Def\" LN=\"663\" Fil=\"\" Fun=\"CSetupDiagnostics::LogString\" Uid=\"34242560\" Msg=\"CInstallUI::GetDefaultLanguage(2027): Result = 0x80070002\" PID=\"5932\" TID=\"4316\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod"
              },
              {
                "name": "Length",
                "value": "320"
              }
            ],
            "repeated": 0,
            "id": 862
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xad\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 863
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xad\\x0c\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 864
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:35, Error                 MOUPG  CInstallUI::GetDefaultLanguage(2027): Result = 0x80070002[gle=0x00000002]\r\n"
              },
              {
                "name": "Length",
                "value": "125"
              }
            ],
            "repeated": 0,
            "id": 865
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 866
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x77af003d",
            "parentcaller": "0x69ed5930",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 867
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03327000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 868
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x6b50adf5",
            "parentcaller": "0x6b50b661",
            "category": "system",
            "api": "SetWindowsHookExW",
            "status": true,
            "return": "0x0003018b",
            "arguments": [
              {
                "name": "HookIdentifier",
                "value": "5",
                "pretty_value": "WH_CBT"
              },
              {
                "name": "ProcedureAddress",
                "value": "0x6b50e960"
              },
              {
                "name": "ModuleAddress",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "4316"
              }
            ],
            "repeated": 0,
            "id": 869
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x7760f8d1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\uxtheme.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x747b0000"
              }
            ],
            "repeated": 0,
            "id": 870
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x7760f911",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "UxTheme.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x747b0000"
              },
              {
                "name": "FunctionName",
                "value": "ThemeInitApiHook"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x747e4120"
              }
            ],
            "repeated": 0,
            "id": 871
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x77aed7a4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "X\\xec|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbd<~t\\xfe\\x8c\\x12\\xc0\\xf0\\xec|\\x06\\xce<~t"
              }
            ],
            "repeated": 0,
            "id": 872
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x77aed7d7",
            "parentcaller": "0x779ae3d7",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000340"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 873
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000350"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000340"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize"
              }
            ],
            "repeated": 0,
            "id": 874
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000350"
              },
              {
                "name": "ValueName",
                "value": "AppsUseLightTheme"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme"
              }
            ],
            "repeated": 0,
            "id": 875
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x7797ecfa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              }
            ],
            "repeated": 0,
            "id": 876
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x747e430b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 877
          },
          {
            "timestamp": "2026-05-28 22:59:35,191",
            "thread_id": "4316",
            "caller": "0x77b11b7e",
            "parentcaller": "0x77b0e20d",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000007c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 878
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\WINTRUST"
              },
              {
                "name": "DllBase",
                "value": "0x75ed0000"
              }
            ],
            "repeated": 0,
            "id": 879
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NETAPI32"
              },
              {
                "name": "DllBase",
                "value": "0x750b0000"
              }
            ],
            "repeated": 0,
            "id": 880
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\sppc"
              },
              {
                "name": "DllBase",
                "value": "0x6bb80000"
              }
            ],
            "repeated": 0,
            "id": 881
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\SLC"
              },
              {
                "name": "DllBase",
                "value": "0x6bba0000"
              }
            ],
            "repeated": 0,
            "id": 882
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WKSCLI"
              },
              {
                "name": "DllBase",
                "value": "0x75060000"
              }
            ],
            "repeated": 0,
            "id": 883
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NETUTILS"
              },
              {
                "name": "DllBase",
                "value": "0x75080000"
              }
            ],
            "repeated": 0,
            "id": 884
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupCore"
              },
              {
                "name": "DllBase",
                "value": "0x69c10000"
              }
            ],
            "repeated": 0,
            "id": 885
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\MSASN1"
              },
              {
                "name": "DllBase",
                "value": "0x70290000"
              }
            ],
            "repeated": 0,
            "id": 886
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupCore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x69c10000"
              }
            ],
            "repeated": 0,
            "id": 887
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x69c10000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupCore.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 888
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x77b0f0b9",
            "parentcaller": "0x77b12338",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 0,
            "id": 889
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f5897a",
            "parentcaller": "0x00f4cd31",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "SetupCore.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69c10000"
              },
              {
                "name": "FunctionName",
                "value": "CreateSetupObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x69d16130"
              }
            ],
            "repeated": 0,
            "id": 890
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 891
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 892
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x77b10d10",
            "parentcaller": "0x77afe4a3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75c94000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 893
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x77b10eea",
            "parentcaller": "0x77b10d32",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\xd0\\x08\\x03\\xd8\\x10\\x00\\x00\\x02\\x00\\x00\\x00\\xa07\t\\x03\\xe8\\x13\\x00\\x00\\x02\\x00\\x00\\x00H7\t\\x03,\\x0f\\x00\\x00\\x02\\x00\\x00\\x00\\xf06\t\\x038\\x10\\x00\\x00\\x02\\x00\\x00\\x00(>\t\\x03(\\x10\\x00\\x00\\x02\\x00\\x00\\x00\\xf87\t\\x03\\xdc\\x10\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 894
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x74d198b1",
            "parentcaller": "0x74d18c82",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\Windows\\System32\\MSCTF.dll"
              }
            ],
            "repeated": 0,
            "id": 895
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x74d198f0",
            "parentcaller": "0x74d18c82",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000388"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msctf.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 896
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x74d19991",
            "parentcaller": "0x74d18c82",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 0,
            "id": 897
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x74d19991",
            "parentcaller": "0x74d18c82",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\MSCTF"
              },
              {
                "name": "DllBase",
                "value": "0x75bd0000"
              }
            ],
            "repeated": 0,
            "id": 898
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\r\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 899
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:35, Info                  MOUPG  SetupHost: Loading complete.\r\n"
              },
              {
                "name": "Length",
                "value": "80"
              }
            ],
            "repeated": 0,
            "id": 900
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 901
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 902
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 903
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00z\r\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 904
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "z\r\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 905
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:35, Info                  MOUPG  SetupHost: Loading AutomationManager manager...\r\n"
              },
              {
                "name": "Length",
                "value": "99"
              }
            ],
            "repeated": 0,
            "id": 906
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76e4d000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 907
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 908
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76e4d000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 909
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 910
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 911
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x77b1621a",
            "parentcaller": "0x779af2ba",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 912
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x77b16241",
            "parentcaller": "0x779af2ba",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 913
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76e4d000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 914
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76e4d000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 915
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 916
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 917
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x69ed3781",
            "parentcaller": "0x69eb89a5",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x6ad44754",
            "arguments": [
              {
                "name": "Module",
                "value": "0x69e80000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x69ef99a8"
              }
            ],
            "repeated": 0,
            "id": 918
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x69ed3790",
            "parentcaller": "0x69eb89a5",
            "category": "misc",
            "api": "SizeofResource",
            "status": true,
            "return": "0x0000ded0",
            "arguments": [
              {
                "name": "ModuleHandle",
                "value": "0x69e80000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x69ef99a8"
              }
            ],
            "repeated": 0,
            "id": 919
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x69ed379f",
            "parentcaller": "0x69eb89a5",
            "category": "misc",
            "api": "LockResource",
            "status": true,
            "return": "0x6ad44754",
            "arguments": [
              {
                "name": "ResourceData",
                "value": "0x6ad44754"
              }
            ],
            "repeated": 0,
            "id": 920
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 921
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xdd\r\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 922
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 923
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:35, Info                  MOUPG  SetupHost: Loading ID: [edac948b-844e-4a51-9ba9-34520bd9ff9f] from [C:\\$Windows.~WS\\Sources\\SetupCore.dll]...\r\n"
              },
              {
                "name": "Length",
                "value": "161"
              }
            ],
            "repeated": 0,
            "id": 924
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 925
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupCore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x69c10000"
              }
            ],
            "repeated": 0,
            "id": 926
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x69c10000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupCore.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 927
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f5897a",
            "parentcaller": "0x00f4cd31",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "SetupCore.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69c10000"
              },
              {
                "name": "FunctionName",
                "value": "CreateSetupObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x69d16130"
              }
            ],
            "repeated": 0,
            "id": 928
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 929
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 930
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00~\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 931
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "~\\x0e\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 932
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:35, Info                  MOUPG  SetupHost: Loading complete.\r\n"
              },
              {
                "name": "Length",
                "value": "80"
              }
            ],
            "repeated": 0,
            "id": 933
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 934
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 935
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 936
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xce\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 937
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xce\\x0e\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 938
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:35, Info                  MOUPG  SetupHost: Initializing automation...\r\n"
              },
              {
                "name": "Length",
                "value": "89"
              }
            ],
            "repeated": 0,
            "id": 939
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 940
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther"
              }
            ],
            "repeated": 0,
            "id": 941
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000028"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 942
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 943
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000028"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 944
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 945
          },
          {
            "timestamp": "2026-05-28 22:59:35,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030ca000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 946
          },
          {
            "timestamp": "2026-05-28 22:59:35,519",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\$Windows.~WS\\Sources\\unbcl"
              },
              {
                "name": "DllBase",
                "value": "0x69450000"
              }
            ],
            "repeated": 0,
            "id": 947
          },
          {
            "timestamp": "2026-05-28 22:59:35,519",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x75f20000"
              }
            ],
            "repeated": 0,
            "id": 948
          },
          {
            "timestamp": "2026-05-28 22:59:35,519",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\FLTLIB"
              },
              {
                "name": "DllBase",
                "value": "0x70260000"
              }
            ],
            "repeated": 0,
            "id": 949
          },
          {
            "timestamp": "2026-05-28 22:59:35,519",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\VirtDisk"
              },
              {
                "name": "DllBase",
                "value": "0x69440000"
              }
            ],
            "repeated": 0,
            "id": 950
          },
          {
            "timestamp": "2026-05-28 22:59:35,519",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\profapi"
              },
              {
                "name": "DllBase",
                "value": "0x74ea0000"
              }
            ],
            "repeated": 0,
            "id": 951
          },
          {
            "timestamp": "2026-05-28 22:59:35,519",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\XmlLite"
              },
              {
                "name": "DllBase",
                "value": "0x72850000"
              }
            ],
            "repeated": 0,
            "id": 952
          },
          {
            "timestamp": "2026-05-28 22:59:35,519",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupPlatform"
              },
              {
                "name": "DllBase",
                "value": "0x69520000"
              }
            ],
            "repeated": 0,
            "id": 953
          },
          {
            "timestamp": "2026-05-28 22:59:35,519",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-processthreads-l1-1-2.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x75d30000"
              }
            ],
            "repeated": 0,
            "id": 954
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupPlatform.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x69520000"
              }
            ],
            "repeated": 0,
            "id": 955
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x69520000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupPlatform.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 956
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "SetupPlatform.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69520000"
              },
              {
                "name": "FunctionName",
                "value": "GetSetupPlatformVersion"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x696cf310"
              }
            ],
            "repeated": 0,
            "id": 957
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "SetupPlatform.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69520000"
              },
              {
                "name": "FunctionName",
                "value": "ResurrectSetupPlatform"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x696ceee0"
              }
            ],
            "repeated": 0,
            "id": 958
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 959
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SYSTEM\\Setup\\SetupPlatform"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupPlatform"
              }
            ],
            "repeated": 0,
            "id": 960
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a0"
              }
            ],
            "repeated": 0,
            "id": 961
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 962
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 963
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 964
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b1f560"
              }
            ],
            "repeated": 0,
            "id": 965
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupPlatform"
              },
              {
                "name": "DllBase",
                "value": "0x69520000"
              }
            ],
            "repeated": 0,
            "id": 966
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030d5000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000a000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 967
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030cc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 968
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030d2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 969
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030cc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 970
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030d2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 971
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\$Windows.~WS\\Sources\\unbcl"
              },
              {
                "name": "DllBase",
                "value": "0x69450000"
              }
            ],
            "repeated": 0,
            "id": 972
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 973
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 974
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69450000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 975
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x75f20000"
              }
            ],
            "repeated": 0,
            "id": 976
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 977
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 978
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75f20000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 979
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 980
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 981
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\VirtDisk"
              },
              {
                "name": "DllBase",
                "value": "0x69440000"
              }
            ],
            "repeated": 0,
            "id": 982
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\FLTLIB"
              },
              {
                "name": "DllBase",
                "value": "0x70260000"
              }
            ],
            "repeated": 0,
            "id": 983
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 984
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 985
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x70260000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 986
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 987
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 988
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69440000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 989
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 990
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b1f560"
              }
            ],
            "repeated": 0,
            "id": 991
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\profapi"
              },
              {
                "name": "DllBase",
                "value": "0x74ea0000"
              }
            ],
            "repeated": 0,
            "id": 992
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 993
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 994
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74ea0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 995
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\XmlLite"
              },
              {
                "name": "DllBase",
                "value": "0x72850000"
              }
            ],
            "repeated": 0,
            "id": 996
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 997
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 998
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x72850000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 999
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1000
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1001
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69520000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 1002
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\$Windows.~WS\\Sources\\unbcl"
              },
              {
                "name": "DllBase",
                "value": "0x69450000"
              }
            ],
            "repeated": 0,
            "id": 1003
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x75f20000"
              }
            ],
            "repeated": 0,
            "id": 1004
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\FLTLIB"
              },
              {
                "name": "DllBase",
                "value": "0x70260000"
              }
            ],
            "repeated": 0,
            "id": 1005
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\VirtDisk"
              },
              {
                "name": "DllBase",
                "value": "0x69440000"
              }
            ],
            "repeated": 0,
            "id": 1006
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\profapi"
              },
              {
                "name": "DllBase",
                "value": "0x74ea0000"
              }
            ],
            "repeated": 0,
            "id": 1007
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\XmlLite"
              },
              {
                "name": "DllBase",
                "value": "0x72850000"
              }
            ],
            "repeated": 0,
            "id": 1008
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupPlatform"
              },
              {
                "name": "DllBase",
                "value": "0x69520000"
              }
            ],
            "repeated": 0,
            "id": 1009
          },
          {
            "timestamp": "2026-05-28 22:59:35,535",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-processthreads-l1-1-2.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x75d30000"
              }
            ],
            "repeated": 0,
            "id": 1010
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupPlatform.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x69520000"
              }
            ],
            "repeated": 0,
            "id": 1011
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x69520000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupPlatform.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1012
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "SetupPlatform.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69520000"
              },
              {
                "name": "FunctionName",
                "value": "GetSetupPlatformVersion"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x696cf310"
              }
            ],
            "repeated": 0,
            "id": 1013
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "SetupPlatform.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69520000"
              },
              {
                "name": "FunctionName",
                "value": "ResurrectSetupPlatform"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x696ceee0"
              }
            ],
            "repeated": 0,
            "id": 1014
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1015
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SYSTEM\\Setup\\SetupPlatform"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupPlatform"
              }
            ],
            "repeated": 0,
            "id": 1016
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "SetupPlatform.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69520000"
              },
              {
                "name": "FunctionName",
                "value": "CreateSetupPlatform"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x696cee50"
              }
            ],
            "repeated": 0,
            "id": 1017
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 1,
            "id": 1018
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1019
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc000003a",
            "pretty_return": "OBJECT_PATH_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\SetupAct.log"
              }
            ],
            "repeated": 0,
            "id": 1020
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "kernel32"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              }
            ],
            "repeated": 0,
            "id": 1021
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              },
              {
                "name": "FunctionName",
                "value": "AddVectoredExceptionHandler"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77aeb0e0"
              }
            ],
            "repeated": 0,
            "id": 1022
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\dbghelp.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x6ada0000"
              }
            ],
            "repeated": 0,
            "id": 1023
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x6ada0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\dbghelp.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1024
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "dbghelp.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6ada0000"
              },
              {
                "name": "FunctionName",
                "value": "MiniDumpWriteDump"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6ad7b910"
              }
            ],
            "repeated": 0,
            "id": 1025
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1026
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 0,
            "id": 1027
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 0,
            "id": 1028
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1029
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0\\x1e\t\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1030
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 0,
            "id": 1031
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              },
              {
                "name": "MutexName",
                "value": "Global\\WdsSetupLogInit"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1032
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1033
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1034
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1035
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0\\x1e\t\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1036
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1037
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "MutexName",
                "value": "Global\\SetupLog"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1038
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1039
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000003ac"
              }
            ],
            "repeated": 0,
            "id": 1040
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1041
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\x1e\t\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1042
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ac"
              }
            ],
            "repeated": 0,
            "id": 1043
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0007",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE"
              },
              {
                "name": "ObjectAttributes",
                "value": "Global\\SetupLogSection"
              },
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1044
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003ac"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03310000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00e3e16c"
              },
              {
                "name": "ViewSize",
                "value": "0x00008000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1045
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030e6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1046
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030e9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1047
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1048
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1049
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030ee000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1050
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1051
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1052
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\setuplog.cfg"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1053
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1054
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030f3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1055
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1056
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1057
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1058
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1059
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1060
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 1,
            "id": 1061
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1062
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1063
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1064
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1065
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1066
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1067
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x69844640"
              }
            ],
            "repeated": 0,
            "id": 1068
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1069
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1070
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1071
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "90"
              }
            ],
            "repeated": 0,
            "id": 1072
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetSystemDefaultLangID",
            "status": true,
            "return": "0x03080409",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x03080409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 1073
          },
          {
            "timestamp": "2026-05-28 22:59:35,550",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "GetComputerNameW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ComputerName",
                "value": "DESKTOP-HGH2VBT"
              }
            ],
            "repeated": 0,
            "id": 1074
          },
          {
            "timestamp": "2026-05-28 22:59:39,660",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\clbcatq"
              },
              {
                "name": "DllBase",
                "value": "0x75ad0000"
              }
            ],
            "repeated": 0,
            "id": 1075
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wbemcomn"
              },
              {
                "name": "DllBase",
                "value": "0x693c0000"
              }
            ],
            "repeated": 0,
            "id": 1076
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemprox"
              },
              {
                "name": "DllBase",
                "value": "0x69430000"
              }
            ],
            "repeated": 0,
            "id": 1077
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "API-MS-Win-Core-LocalRegistry-L1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77870000"
              }
            ],
            "repeated": 0,
            "id": 1078
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemprox.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x69430000"
              }
            ],
            "repeated": 0,
            "id": 1079
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F811-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DC12A687-737F-11CF-884D-00AA004B2E24"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1080
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76eed000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1081
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76eed000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1082
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000003fc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7745c5b0"
              },
              {
                "name": "Parameter",
                "value": "0x030a3618"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "6320"
              },
              {
                "name": "ProcessId",
                "value": "5932"
              },
              {
                "name": "Module",
                "value": "combase.dll"
              }
            ],
            "repeated": 0,
            "id": 1083
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "6320",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030fd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1084
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "6320",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1085
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "6320",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1086
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "6324",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1087
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "6324",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1088
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "6324",
            "caller": "0x77999924",
            "parentcaller": "0x76c1c2f8",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000414"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1089
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "6324",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03102000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1090
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "6328",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1091
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "6328",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1092
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000032A-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000149-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1093
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1094
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemsvc"
              },
              {
                "name": "DllBase",
                "value": "0x693b0000"
              }
            ],
            "repeated": 0,
            "id": 1095
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemsvc.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x693b0000"
              }
            ],
            "repeated": 0,
            "id": 1096
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1097
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\fastprox"
              },
              {
                "name": "DllBase",
                "value": "0x692e0000"
              }
            ],
            "repeated": 0,
            "id": 1098
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\fastprox.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x692e0000"
              }
            ],
            "repeated": 0,
            "id": 1099
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1100
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-l1-2-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77870000"
              }
            ],
            "repeated": 0,
            "id": 1101
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-obsolete-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77870000"
              }
            ],
            "repeated": 0,
            "id": 1102
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\amsi"
              },
              {
                "name": "DllBase",
                "value": "0x692c0000"
              }
            ],
            "repeated": 0,
            "id": 1103
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "amsi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x692c0000"
              }
            ],
            "repeated": 0,
            "id": 1104
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\USERENV"
              },
              {
                "name": "DllBase",
                "value": "0x74830000"
              }
            ],
            "repeated": 0,
            "id": 1105
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files (x86)\\Windows Defender\\MpOav"
              },
              {
                "name": "DllBase",
                "value": "0x69280000"
              }
            ],
            "repeated": 0,
            "id": 1106
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x77870000"
              }
            ],
            "repeated": 0,
            "id": 1107
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-fibers-l1-1-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x77870000"
              }
            ],
            "repeated": 0,
            "id": 1108
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x77870000"
              }
            ],
            "repeated": 0,
            "id": 1109
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-fibers-l1-1-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x77870000"
              }
            ],
            "repeated": 0,
            "id": 1110
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-l1-2-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x77870000"
              }
            ],
            "repeated": 0,
            "id": 1111
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\version.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x750a0000"
              }
            ],
            "repeated": 0,
            "id": 1112
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Windows Defender\\MpOAV.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x69280000"
              }
            ],
            "repeated": 0,
            "id": 1113
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1114
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1115
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "WbemLocator_ConnectServer",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NetworkResource",
                "value": "ROOT\\CIMV2"
              },
              {
                "name": "User",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1116
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1117
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT * FROM Win32_ComputerSystem"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1118
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x693bc000"
              },
              {
                "name": "ModuleName",
                "value": "wbemsvc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1119
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x693bc000"
              },
              {
                "name": "ModuleName",
                "value": "wbemsvc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1120
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e6"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1121
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e6"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1122
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002e6"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Interface\\{027947E1-D731-11CE-A357-000000000001}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}"
              }
            ],
            "repeated": 0,
            "id": 1123
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}"
              }
            ],
            "repeated": 0,
            "id": 1124
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1125
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1126
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "x\\xdb\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x04\\xdc\\xb4\\xdb\\xa8\\xdbR\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00P\\xde\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1127
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1128
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000454"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000452"
              },
              {
                "name": "ObjectAttributesName",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1129
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1130
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1131
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xdb\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xdb\\x84\\xdbx\\xdbV\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xde\\xe3\\x00\\xdc\\xfc\\x97wV\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1132
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1133
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1134
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              }
            ],
            "repeated": 0,
            "id": 1135
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000452"
              }
            ],
            "repeated": 0,
            "id": 1136
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003b6"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1137
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003b6"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1138
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000003b6"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1139
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1140
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1141
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1142
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf0\\xcf\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00|\\xd0,\\xd0 \\xd0R\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xc8\\xd2\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1143
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1144
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000452"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1145
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 1,
            "id": 1146
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1147
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd0\\xce\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\\\xcf\\x0c\\xcf\\x00\\xcfR\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa8\\xd1\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1148
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1149
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 1150
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1151
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1152
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8\\xce\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x004\\xcf\\xe4\\xce\\xd8\\xceR\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x80\\xd1\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1153
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1154
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1155
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1156
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1157
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8\\xce\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x004\\xcf\\xe4\\xce\\xd8\\xceR\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x80\\xd1\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1158
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1159
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1160
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1161
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1162
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xcf\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xcc\\xcf|\\xcfp\\xcfR\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\x18\\xd2\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1163
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1164
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000454"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000452"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1165
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1166
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1167
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "P\\xce\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xdc\\xce\\x8c\\xce\\x80\\xceV\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02(\\xd1\\xe3\\x00\\xdc\\xfc\\x97wV\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1168
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1169
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1170
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1171
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1172
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "x\\xce\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x04\\xcf\\xb4\\xce\\xa8\\xceV\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02P\\xd1\\xe3\\x00\\xdc\\xfc\\x97wV\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1173
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1174
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1175
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1176
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1177
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "(\\xce\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xced\\xceX\\xceV\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xd1\\xe3\\x00\\xdc\\xfc\\x97wV\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1178
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1179
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "2",
                "pretty_value": "REG_EXPAND_SZ"
              },
              {
                "name": "Information",
                "value": "%systemroot%\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1180
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1181
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1182
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "x\\xce\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x04\\xcf\\xb4\\xce\\xa8\\xceV\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02P\\xd1\\xe3\\x00\\xdc\\xfc\\x97wV\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1183
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1184
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "2",
                "pretty_value": "REG_EXPAND_SZ"
              },
              {
                "name": "Information",
                "value": "%systemroot%\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1185
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1186
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1187
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xce\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xbc\\xcel\\xce`\\xceV\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x08\\xd1\\xe3\\x00\\xdc\\xfc\\x97wV\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1188
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1189
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 1190
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              }
            ],
            "repeated": 0,
            "id": 1191
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1192
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1193
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xce\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00d\\xcf\\x14\\xcf\\x08\\xcfR\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb0\\xd1\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1194
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1195
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000452"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1196
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1197
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1198
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xce\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00d\\xcf\\x14\\xcf\\x08\\xcfR\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb0\\xd1\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1199
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1200
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000452"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1201
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000452"
              }
            ],
            "repeated": 0,
            "id": 1202
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1203
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1204
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003b6"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1205
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003b6"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1206
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000003b6"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1207
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1208
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1209
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1210
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xcb\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xcc\\xd4\\xcb\\xc8\\xcbR\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00p\\xce\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1211
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1212
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000452"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1213
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 1,
            "id": 1214
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1215
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "x\\xca\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x04\\xcb\\xb4\\xca\\xa8\\xcaR\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02P\\xcd\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1216
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1217
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 1218
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1219
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1220
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "P\\xca\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xdc\\xca\\x8c\\xca\\x80\\xcaR\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02(\\xcd\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1221
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1222
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1223
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1224
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1225
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "P\\xca\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xdc\\xca\\x8c\\xca\\x80\\xcaR\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02(\\xcd\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1226
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1227
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1228
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1229
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1230
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8\\xca\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00t\\xcb$\\xcb\\x18\\xcbR\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xc0\\xcd\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1231
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1232
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000452"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1233
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1234
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1235
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xc9\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xca4\\xca(\\xcaB\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xcc\\xe3\\x00\\xdc\\xfc\\x97wB\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1236
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1237
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1238
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1239
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1240
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": " \\xca\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xca\\\\xcaP\\xcaB\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xcc\\xe3\\x00\\xdc\\xfc\\x97wB\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1241
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1242
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1243
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1244
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1245
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd0\\xc9\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\\\xca\\x0c\\xca\\x00\\xcaB\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa8\\xcc\\xe3\\x00\\xdc\\xfc\\x97wB\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1246
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1247
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "2",
                "pretty_value": "REG_EXPAND_SZ"
              },
              {
                "name": "Information",
                "value": "%systemroot%\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1248
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1249
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1250
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": " \\xca\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xca\\\\xcaP\\xcaB\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xcc\\xe3\\x00\\xdc\\xfc\\x97wB\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1251
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1252
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "2",
                "pretty_value": "REG_EXPAND_SZ"
              },
              {
                "name": "Information",
                "value": "%systemroot%\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1253
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1254
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1255
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xc9\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00d\\xca\\x14\\xca\\x08\\xcaB\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xb0\\xcc\\xe3\\x00\\xdc\\xfc\\x97wB\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1256
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1257
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 1258
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000442"
              }
            ],
            "repeated": 0,
            "id": 1259
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1260
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1261
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x80\\xca\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xcb\\xbc\\xca\\xb0\\xcaR\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00X\\xcd\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1262
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1263
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000452"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1264
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1265
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1266
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x80\\xca\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xcb\\xbc\\xca\\xb0\\xcaR\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00X\\xcd\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1267
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1268
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000452"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1269
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1270
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1271
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xca\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xbc\\xcal\\xca`\\xcaR\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\x08\\xcd\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1272
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 1273
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000452"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 1274
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1275
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1276
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8\\xc9\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x004\\xca\\xe4\\xc9\\xd8\\xc9R\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x80\\xcc\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1277
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1278
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 1279
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1280
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1281
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8\\xc9\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00t\\xca$\\xca\\x18\\xcaR\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xc0\\xcc\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1282
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 1283
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000452"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 1284
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003b6"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1285
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003b6"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1286
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000003b6"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1287
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000454"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1288
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1289
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1290
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8\\xca\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00t\\xcb$\\xcb\\x18\\xcbV\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xc0\\xcd\\xe3\\x00\\xdc\\xfc\\x97wV\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1291
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Elevation"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 1292
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000456"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Elevation"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 1293
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              }
            ],
            "repeated": 0,
            "id": 1294
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000452"
              }
            ],
            "repeated": 0,
            "id": 1295
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e6"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1296
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e6"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1297
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002e6"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1298
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1299
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1300
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000452"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1301
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\xd9\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xa4\\xd9T\\xd9H\\xd9R\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xf0\\xdb\\xe3\\x00\\xdc\\xfc\\x97wR\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1302
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1303
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000452"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1304
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000452"
              }
            ],
            "repeated": 0,
            "id": 1305
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1306
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1307
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1308
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1309
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e6"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1310
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e6"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1311
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002e6"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1312
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1313
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1314
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1315
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xe2\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xe2\\xac\\xe2\\xa0\\xe2B\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00H\\xe5\\xe3\\x00\\xdc\\xfc\\x97wB\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1316
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1317
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000442"
              },
              {
                "name": "ObjectAttributesName",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1318
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1319
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1320
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xe2\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xcc\\xe2|\\xe2p\\xe2N\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x18\\xe5\\xe3\\x00\\xdc\\xfc\\x97wN\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1321
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1322
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1323
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044e"
              }
            ],
            "repeated": 0,
            "id": 1324
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000442"
              }
            ],
            "repeated": 0,
            "id": 1325
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1326
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1327
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03116000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1328
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1329
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03118000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1330
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e6"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1331
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e6"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1332
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002e6"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1333
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1334
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1335
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000442"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1336
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xda\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xdb4\\xdb(\\xdbB\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdd\\xe3\\x00\\xdc\\xfc\\x97wB\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1337
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1338
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000442"
              },
              {
                "name": "ObjectAttributesName",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1339
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1340
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1341
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\\xda\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00T\\xdb\\x04\\xdb\\xf8\\xdaN\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa0\\xdd\\xe3\\x00\\xdc\\xfc\\x97wN\\x04\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1342
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1343
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1344
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044e"
              }
            ],
            "repeated": 0,
            "id": 1345
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000442"
              }
            ],
            "repeated": 0,
            "id": 1346
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1347
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1348
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1349
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 1350
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03119000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1351
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1352
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000009",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\AMSI\\Providers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\AMSI\\Providers"
              }
            ],
            "repeated": 0,
            "id": 1353
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044c"
              },
              {
                "name": "KeyInformation",
                "value": "*\"\\xffdc\\xffc2\\xfff0\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 1354
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044c"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1355
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "MpOav.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69280000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x69289ec0"
              }
            ],
            "repeated": 0,
            "id": 1356
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044c"
              },
              {
                "name": "Index",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1357
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 1358
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1359
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "srand",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "seed",
                "value": "0x6a18c8dc"
              }
            ],
            "repeated": 0,
            "id": 1360
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0311c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1361
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0311f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1362
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Manufacturer"
              },
              {
                "name": "Value",
                "value": "BOCHS_"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1363
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Model"
              },
              {
                "name": "Value",
                "value": "BXPC____"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1364
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "NumberOfProcessors"
              },
              {
                "name": "Value",
                "value": "2"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1365
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "NumberOfLogicalProcessors"
              },
              {
                "name": "Value",
                "value": "4"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1366
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F811-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DC12A687-737F-11CF-884D-00AA004B2E24"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1367
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1368
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1369
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1370
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "WbemLocator_ConnectServer",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NetworkResource",
                "value": "ROOT\\CIMV2"
              },
              {
                "name": "User",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1371
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1372
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT * FROM Win32_bios"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1373
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1374
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1375
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1376
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 2,
            "id": 1377
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Name"
              },
              {
                "name": "Value",
                "value": "Default System BIOS"
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1378
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SMBIOSBIOSVersion"
              },
              {
                "name": "Value",
                "value": "1.23.1"
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1379
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ReleaseDate"
              },
              {
                "name": "Value",
                "value": "20140401000000.000000+000"
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1380
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x75d30000"
              }
            ],
            "repeated": 0,
            "id": 1381
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x75d30000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "kernel32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1382
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              },
              {
                "name": "FunctionName",
                "value": "GetPhysicallyInstalledSystemMemory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x75d636b0"
              }
            ],
            "repeated": 0,
            "id": 1383
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "GetPhysicallyInstalledSystemMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TotalMemoryInKilobytes",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1384
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "GlobalMemoryStatusEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MemoryLoad",
                "value": "63"
              },
              {
                "name": "TotalPhysicalMB",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 1385
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F811-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DC12A687-737F-11CF-884D-00AA004B2E24"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1386
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1387
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1388
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1389
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "WbemLocator_ConnectServer",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NetworkResource",
                "value": "ROOT\\CIMV2"
              },
              {
                "name": "User",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1390
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1391
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT Manufacturer, Name, Caption, Architecture, MaxClockSpeed FROM Win32_Processor"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1392
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1393
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1394
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1395
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 2,
            "id": 1396
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Manufacturer"
              },
              {
                "name": "Value",
                "value": "GenuineIntel"
              },
              {
                "name": "Class",
                "value": "Win32_Processor"
              }
            ],
            "repeated": 0,
            "id": 1397
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Name"
              },
              {
                "name": "Value",
                "value": "Intel Core Processor (Skylake, IBRS)"
              },
              {
                "name": "Class",
                "value": "Win32_Processor"
              }
            ],
            "repeated": 0,
            "id": 1398
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Caption"
              },
              {
                "name": "Value",
                "value": "Intel64 Family 6 Model 94 Stepping 3"
              },
              {
                "name": "Class",
                "value": "Win32_Processor"
              }
            ],
            "repeated": 0,
            "id": 1399
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Architecture"
              },
              {
                "name": "Value",
                "value": "9"
              },
              {
                "name": "Class",
                "value": "Win32_Processor"
              }
            ],
            "repeated": 0,
            "id": 1400
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "MaxClockSpeed"
              },
              {
                "name": "Value",
                "value": "3686"
              },
              {
                "name": "Class",
                "value": "Win32_Processor"
              }
            ],
            "repeated": 0,
            "id": 1401
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1402
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1403
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1404
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1405
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CB8555CC-9128-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000017",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "riid",
                "value": "DC12A687-737F-11CF-884D-00AA004B2E24"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1406
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1407
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8BC3F05E-D86B-11D0-A075-00C04FB68820"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "F309AD18-D86A-11D0-A075-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1408
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              }
            ],
            "repeated": 0,
            "id": 1409
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000440"
              },
              {
                "name": "ValueName",
                "value": "Hostname"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "DESKTOP-HGH2VBT"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname"
              }
            ],
            "repeated": 0,
            "id": 1410
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1411
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Policies\\Microsoft\\System\\DNSClient"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\System\\DNSClient"
              }
            ],
            "repeated": 1,
            "id": 1412
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              }
            ],
            "repeated": 0,
            "id": 1413
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000440"
              },
              {
                "name": "ValueName",
                "value": "Domain"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain"
              }
            ],
            "repeated": 0,
            "id": 1414
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1415
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              }
            ],
            "repeated": 0,
            "id": 1416
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000440"
              },
              {
                "name": "ValueName",
                "value": "Hostname"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "DESKTOP-HGH2VBT"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname"
              }
            ],
            "repeated": 0,
            "id": 1417
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1418
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Policies\\Microsoft\\System\\DNSClient"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\System\\DNSClient"
              }
            ],
            "repeated": 1,
            "id": 1419
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              }
            ],
            "repeated": 0,
            "id": 1420
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000440"
              },
              {
                "name": "ValueName",
                "value": "Domain"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain"
              }
            ],
            "repeated": 0,
            "id": 1421
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1422
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1423
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstanceEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8BC3F05E-D86B-11D0-A075-00C04FB68820"
              },
              {
                "name": "ClsContext",
                "value": "0x00000014",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "ServerName",
                "value": ""
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1424
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              }
            ],
            "repeated": 0,
            "id": 1425
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000440"
              },
              {
                "name": "ValueName",
                "value": "Hostname"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "DESKTOP-HGH2VBT"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname"
              }
            ],
            "repeated": 0,
            "id": 1426
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1427
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Policies\\Microsoft\\System\\DNSClient"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\System\\DNSClient"
              }
            ],
            "repeated": 1,
            "id": 1428
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              }
            ],
            "repeated": 0,
            "id": 1429
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000440"
              },
              {
                "name": "ValueName",
                "value": "Domain"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain"
              }
            ],
            "repeated": 0,
            "id": 1430
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1431
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1432
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1433
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1434
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1435
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000009",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\AMSI\\Providers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\AMSI\\Providers"
              }
            ],
            "repeated": 0,
            "id": 1436
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044c"
              },
              {
                "name": "KeyInformation",
                "value": "*\"\\xffdc\\xffc2\\xfff0\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00L\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 1437
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044c"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1438
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "MpOav.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69280000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x69289ec0"
              }
            ],
            "repeated": 0,
            "id": 1439
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044c"
              },
              {
                "name": "Index",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1440
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 1441
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1442
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "srand",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "seed",
                "value": "0x6a18c8dc"
              }
            ],
            "repeated": 0,
            "id": 1443
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1444
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_CreateInstanceEnum",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "QueryClass",
                "value": "AntiVirusProduct"
              }
            ],
            "repeated": 0,
            "id": 1445
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1446
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1447
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1448
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "displayName"
              },
              {
                "name": "Value",
                "value": "Windows Defender"
              },
              {
                "name": "Class",
                "value": "AntiVirusProduct"
              }
            ],
            "repeated": 0,
            "id": 1449
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "timestamp"
              },
              {
                "name": "Value",
                "value": "Thu, 28 May 2026 15:30:41 GMT"
              },
              {
                "name": "Class",
                "value": "AntiVirusProduct"
              }
            ],
            "repeated": 0,
            "id": 1450
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "productState"
              },
              {
                "name": "Value",
                "value": "401664"
              },
              {
                "name": "Class",
                "value": "AntiVirusProduct"
              }
            ],
            "repeated": 0,
            "id": 1451
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "pathToSignedReportingExe"
              },
              {
                "name": "Value",
                "value": "%ProgramFiles%\\Windows Defender\\MsMpeng.exe"
              },
              {
                "name": "Class",
                "value": "AntiVirusProduct"
              }
            ],
            "repeated": 0,
            "id": 1452
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1453
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1454
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1455
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1456
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "SetupPlatform.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69520000"
              }
            ],
            "repeated": 0,
            "id": 1457
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupPlatform.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1458
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "Buffer",
                "value": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "64"
              }
            ],
            "repeated": 0,
            "id": 1459
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1460
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
              },
              {
                "name": "Buffer",
                "value": "PE\\x00\\x00L\\x01\\x06\\x00\\x15\\x1d\\x87\\x8e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x00\\x02-\\x0b\\x01\\x0e\\x14\\x00\\xd4^\\x00\\x00,\\x0f\\x00\\x00\\x00\\x00\\x00\\x10\\xb7V\\x00\\x00\\x10\\x00\\x00\\x00\\xf0^\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x00\\x02\\x00\\x00\n\\x00\\x00\\x00\n\\x00\\x00\\x00\\x06\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00Pn\\x00\\x00\\x04\\x00\\x00\\x08\\x08n\\x00\\x03\\x00@A\\x00\\x00\\x04\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00 \\xe1^\\x00\\x9f\\x01\\x00\\x00\\xec@d\\x00\\xf4\\x01\\x00\\x00\\x00\\xf0d\\x00\\x10\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8m\\x00H!\\x00\\x00\\x00\\x00e\\x00\\xc0E\t\\x000\\xe0\\x19\\x00T\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xf4\\x01\\x00\\x18\\x00\\x00\\x00\\x10\\x10\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000d\\x00\\xe8\\x10\\x00\\x00`\\xc5^\\x00`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "248"
              }
            ],
            "repeated": 0,
            "id": 1461
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1462
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              }
            ],
            "repeated": 0,
            "id": 1463
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1464
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1465
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1466
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1467
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "Buffer",
                "value": ";\r\n; This section describes the footprint dependencies\r\n; of various platform sections\r\n;\r\n[Dependencies]\r\nBasic =\r\nServicing = Basic\r\nICB = Basic, Servicing\r\nMigration = Basic\r\n\r\n;\r\n; Each element in a footprint section can be one of three things:\r\n; - Fi"
              },
              {
                "name": "Length",
                "value": "10452"
              }
            ],
            "repeated": 0,
            "id": 1468
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1469
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1470
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1471
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1472
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1473
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1474
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1475
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1476
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              }
            ],
            "repeated": 0,
            "id": 1477
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1478
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1479
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1480
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1481
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "Buffer",
                "value": ";\r\n; This section describes the footprint dependencies\r\n; of various platform sections\r\n;\r\n[Dependencies]\r\nBasic =\r\nServicing = Basic\r\nICB = Basic, Servicing\r\nMigration = Basic\r\n\r\n;\r\n; Each element in a footprint section can be one of three things:\r\n; - Fi"
              },
              {
                "name": "Length",
                "value": "10452"
              }
            ],
            "repeated": 0,
            "id": 1482
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1483
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1484
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1485
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1486
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1487
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              }
            ],
            "repeated": 0,
            "id": 1488
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1489
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1490
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1491
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1492
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "Buffer",
                "value": ";\r\n; This section describes the footprint dependencies\r\n; of various platform sections\r\n;\r\n[Dependencies]\r\nBasic =\r\nServicing = Basic\r\nICB = Basic, Servicing\r\nMigration = Basic\r\n\r\n;\r\n; Each element in a footprint section can be one of three things:\r\n; - Fi"
              },
              {
                "name": "Length",
                "value": "10452"
              }
            ],
            "repeated": 0,
            "id": 1493
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1494
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1495
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1496
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1497
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1498
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Diager.dll"
              }
            ],
            "repeated": 0,
            "id": 1499
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\diagtrack.dll"
              }
            ],
            "repeated": 0,
            "id": 1500
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\diagtrackrunner.exe"
              }
            ],
            "repeated": 0,
            "id": 1501
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\reagent.admx"
              }
            ],
            "repeated": 0,
            "id": 1502
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1503
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1504
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1505
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1506
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1507
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1508
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              }
            ],
            "repeated": 0,
            "id": 1509
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1510
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1511
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1512
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1513
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "Buffer",
                "value": ";\r\n; This section describes the footprint dependencies\r\n; of various platform sections\r\n;\r\n[Dependencies]\r\nBasic =\r\nServicing = Basic\r\nICB = Basic, Servicing\r\nMigration = Basic\r\n\r\n;\r\n; Each element in a footprint section can be one of three things:\r\n; - Fi"
              },
              {
                "name": "Length",
                "value": "10452"
              }
            ],
            "repeated": 0,
            "id": 1514
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1515
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1516
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1517
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1518
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1519
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1520
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1521
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1522
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              }
            ],
            "repeated": 0,
            "id": 1523
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1524
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1525
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1526
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1527
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "Buffer",
                "value": ";\r\n; This section describes the footprint dependencies\r\n; of various platform sections\r\n;\r\n[Dependencies]\r\nBasic =\r\nServicing = Basic\r\nICB = Basic, Servicing\r\nMigration = Basic\r\n\r\n;\r\n; Each element in a footprint section can be one of three things:\r\n; - Fi"
              },
              {
                "name": "Length",
                "value": "10452"
              }
            ],
            "repeated": 0,
            "id": 1528
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1529
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1530
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1531
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1532
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1533
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\dismapi.dll"
              }
            ],
            "repeated": 0,
            "id": 1534
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1535
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1536
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1537
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1538
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1539
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1540
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              }
            ],
            "repeated": 0,
            "id": 1541
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1542
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1543
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1544
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1545
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "Buffer",
                "value": ";\r\n; This section describes the footprint dependencies\r\n; of various platform sections\r\n;\r\n[Dependencies]\r\nBasic =\r\nServicing = Basic\r\nICB = Basic, Servicing\r\nMigration = Basic\r\n\r\n;\r\n; Each element in a footprint section can be one of three things:\r\n; - Fi"
              },
              {
                "name": "Length",
                "value": "10452"
              }
            ],
            "repeated": 0,
            "id": 1546
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1547
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1548
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1549
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1550
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1551
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1552
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1553
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1554
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              }
            ],
            "repeated": 0,
            "id": 1555
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1556
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1557
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1558
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1559
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "Buffer",
                "value": ";\r\n; This section describes the footprint dependencies\r\n; of various platform sections\r\n;\r\n[Dependencies]\r\nBasic =\r\nServicing = Basic\r\nICB = Basic, Servicing\r\nMigration = Basic\r\n\r\n;\r\n; Each element in a footprint section can be one of three things:\r\n; - Fi"
              },
              {
                "name": "Length",
                "value": "10452"
              }
            ],
            "repeated": 0,
            "id": 1560
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1561
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1562
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1563
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1564
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1565
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              }
            ],
            "repeated": 0,
            "id": 1566
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1567
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1568
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1569
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1570
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "Buffer",
                "value": ";\r\n; This section describes the footprint dependencies\r\n; of various platform sections\r\n;\r\n[Dependencies]\r\nBasic =\r\nServicing = Basic\r\nICB = Basic, Servicing\r\nMigration = Basic\r\n\r\n;\r\n; Each element in a footprint section can be one of three things:\r\n; - Fi"
              },
              {
                "name": "Length",
                "value": "10452"
              }
            ],
            "repeated": 0,
            "id": 1571
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1572
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1573
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1574
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1575
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1576
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03122000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1577
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              }
            ],
            "repeated": 0,
            "id": 1578
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1579
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1580
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1581
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1582
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "Buffer",
                "value": ";\r\n; This section describes the footprint dependencies\r\n; of various platform sections\r\n;\r\n[Dependencies]\r\nBasic =\r\nServicing = Basic\r\nICB = Basic, Servicing\r\nMigration = Basic\r\n\r\n;\r\n; Each element in a footprint section can be one of three things:\r\n; - Fi"
              },
              {
                "name": "Length",
                "value": "10452"
              }
            ],
            "repeated": 0,
            "id": 1583
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1584
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1585
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1586
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1587
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1588
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\cmi2migxml.dll"
              }
            ],
            "repeated": 0,
            "id": 1589
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1590
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1591
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1592
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1593
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1594
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1595
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              }
            ],
            "repeated": 0,
            "id": 1596
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1597
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1598
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1599
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1600
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "Buffer",
                "value": ";\r\n; This section describes the footprint dependencies\r\n; of various platform sections\r\n;\r\n[Dependencies]\r\nBasic =\r\nServicing = Basic\r\nICB = Basic, Servicing\r\nMigration = Basic\r\n\r\n;\r\n; Each element in a footprint section can be one of three things:\r\n; - Fi"
              },
              {
                "name": "Length",
                "value": "10452"
              }
            ],
            "repeated": 0,
            "id": 1601
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1602
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1603
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1604
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1605
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1606
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1607
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1608
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1609
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              }
            ],
            "repeated": 0,
            "id": 1610
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1611
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1612
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1613
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1614
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "Buffer",
                "value": ";\r\n; This section describes the footprint dependencies\r\n; of various platform sections\r\n;\r\n[Dependencies]\r\nBasic =\r\nServicing = Basic\r\nICB = Basic, Servicing\r\nMigration = Basic\r\n\r\n;\r\n; Each element in a footprint section can be one of three things:\r\n; - Fi"
              },
              {
                "name": "Length",
                "value": "10452"
              }
            ],
            "repeated": 0,
            "id": 1615
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1616
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1617
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1618
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1619
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1620
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              }
            ],
            "repeated": 0,
            "id": 1621
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1622
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1623
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1624
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1625
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "Buffer",
                "value": ";\r\n; This section describes the footprint dependencies\r\n; of various platform sections\r\n;\r\n[Dependencies]\r\nBasic =\r\nServicing = Basic\r\nICB = Basic, Servicing\r\nMigration = Basic\r\n\r\n;\r\n; Each element in a footprint section can be one of three things:\r\n; - Fi"
              },
              {
                "name": "Length",
                "value": "10452"
              }
            ],
            "repeated": 0,
            "id": 1626
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1627
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1628
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1629
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1630
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1631
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              }
            ],
            "repeated": 0,
            "id": 1632
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1633
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\xd4(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1634
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1635
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1636
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
              },
              {
                "name": "Buffer",
                "value": ";\r\n; This section describes the footprint dependencies\r\n; of various platform sections\r\n;\r\n[Dependencies]\r\nBasic =\r\nServicing = Basic\r\nICB = Basic, Servicing\r\nMigration = Basic\r\n\r\n;\r\n; Each element in a footprint section can be one of three things:\r\n; - Fi"
              },
              {
                "name": "Length",
                "value": "10452"
              }
            ],
            "repeated": 0,
            "id": 1637
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00103000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1638
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1639
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1640
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1641
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1642
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\cmi2migxml.dll"
              }
            ],
            "repeated": 0,
            "id": 1643
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1644
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1645
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1646
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1647
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1648
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1649
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\migcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1650
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\$Windows.~WS\\Sources\\migcore.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1651
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1652
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1653
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1654
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1655
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1656
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1657
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1658
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "api-ms-win-eventing-provider-l1-1-0.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77870000"
              }
            ],
            "repeated": 0,
            "id": 1659
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77870000"
              },
              {
                "name": "FunctionName",
                "value": "EventSetInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af0b00"
              }
            ],
            "repeated": 0,
            "id": 1660
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1661
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1662
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1663
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 1664
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x77ac0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ntdll.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 1665
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlGetPersistedStateLocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b25dd0"
              }
            ],
            "repeated": 0,
            "id": 1666
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 1667
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x77ac0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ntdll.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 1668
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySecurityPolicy"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b34170"
              }
            ],
            "repeated": 0,
            "id": 1669
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Kernel-ProductInfo"
              },
              {
                "name": "Type",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1670
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1671
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000101",
                "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection"
              }
            ],
            "repeated": 0,
            "id": 1672
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "AllowTelemetry"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry"
              }
            ],
            "repeated": 0,
            "id": 1673
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 1674
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 1675
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x77ac0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ntdll.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 1676
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlIsStateSeparationEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b262c0"
              }
            ],
            "repeated": 0,
            "id": 1677
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users"
              },
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users"
              }
            ],
            "repeated": 0,
            "id": 1678
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000450"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1679
          },
          {
            "timestamp": "2026-05-28 22:59:40,097",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 1680
          },
          {
            "timestamp": "2026-05-28 22:59:40,128",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x74ee0000"
              }
            ],
            "repeated": 0,
            "id": 1681
          },
          {
            "timestamp": "2026-05-28 22:59:40,128",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x691f0000"
              }
            ],
            "repeated": 0,
            "id": 1682
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "policymanager.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x691f0000"
              }
            ],
            "repeated": 0,
            "id": 1683
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x691f0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "policymanager.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 1684
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x691f0000"
              },
              {
                "name": "FunctionName",
                "value": "PolicyManager_GetPolicy"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x692024c0"
              }
            ],
            "repeated": 0,
            "id": 1685
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x691f0000"
              },
              {
                "name": "FunctionName",
                "value": "PolicyManager_FreeGetPolicyData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x692046d0"
              }
            ],
            "repeated": 0,
            "id": 1686
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6926b000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1687
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6926b000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1688
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1689
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry"
              }
            ],
            "repeated": 0,
            "id": 1690
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "PolicyType"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType"
              }
            ],
            "repeated": 0,
            "id": 1691
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "73777"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 1692
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "MergeAlgorithm"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm"
              }
            ],
            "repeated": 0,
            "id": 1693
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirectMapped"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped"
              }
            ],
            "repeated": 0,
            "id": 1694
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirect"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect"
              }
            ],
            "repeated": 0,
            "id": 1695
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6926b000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1696
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6926b000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1697
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirect"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect"
              }
            ],
            "repeated": 0,
            "id": 1698
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "RegValueNameRedirect"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect"
              }
            ],
            "repeated": 0,
            "id": 1699
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "RegValueNameRedirect"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "AllowTelemetry_PolicyManager"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect"
              }
            ],
            "repeated": 0,
            "id": 1700
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 1701
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser"
              }
            ],
            "repeated": 0,
            "id": 1702
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataDevice"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice"
              }
            ],
            "repeated": 0,
            "id": 1703
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataBoth"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth"
              }
            ],
            "repeated": 0,
            "id": 1704
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 1705
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Kernel-ProductInfo"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 1706
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Kernel-ProductInfoLegacyMapping"
              },
              {
                "name": "Type",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 1707
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "30Value"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value"
              }
            ],
            "repeated": 0,
            "id": 1708
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "Value"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value"
              }
            ],
            "repeated": 0,
            "id": 1709
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1710
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1711
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection"
              }
            ],
            "repeated": 0,
            "id": 1712
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "AllowTelemetry_PolicyManager"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager"
              }
            ],
            "repeated": 0,
            "id": 1713
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1714
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1715
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System"
              }
            ],
            "repeated": 0,
            "id": 1716
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1717
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection"
              }
            ],
            "repeated": 0,
            "id": 1718
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "AllowTelemetry_PolicyManager"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager"
              }
            ],
            "repeated": 0,
            "id": 1719
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1720
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 1721
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1722
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 1723
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b1f560"
              }
            ],
            "repeated": 0,
            "id": 1724
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x691f0000"
              }
            ],
            "repeated": 0,
            "id": 1725
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x74ee0000"
              }
            ],
            "repeated": 0,
            "id": 1726
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1727
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1728
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74ee0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 1729
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1730
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1731
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x691f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 1732
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 1733
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x77ac0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ntdll.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 1734
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlIsStateSeparationEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b262c0"
              }
            ],
            "repeated": 0,
            "id": 1735
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users"
              },
              {
                "name": "Handle",
                "value": "0x00000454"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users"
              }
            ],
            "repeated": 0,
            "id": 1736
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000454"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1737
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1738
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 1739
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x77ac0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ntdll.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 1740
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlIsStateSeparationEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b262c0"
              }
            ],
            "repeated": 0,
            "id": 1741
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1742
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000454"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000101",
                "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection"
              }
            ],
            "repeated": 0,
            "id": 1743
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000454"
              },
              {
                "name": "ValueName",
                "value": "AllowTelemetry"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry"
              }
            ],
            "repeated": 0,
            "id": 1744
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1745
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1746
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000454"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              }
            ],
            "repeated": 0,
            "id": 1747
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000454"
              },
              {
                "name": "ValueName",
                "value": "BuildLabEx"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "19041.1.amd64fre.vb_release.191206-1406"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx"
              }
            ],
            "repeated": 0,
            "id": 1748
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1749
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel32.dll"
              }
            ],
            "repeated": 0,
            "id": 1750
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "GetFileVersionInfoSizeW",
            "status": true,
            "return": "0x00000744",
            "arguments": [
              {
                "name": "PathName",
                "value": "C:\\Windows\\System32\\kernel32.dll"
              }
            ],
            "repeated": 0,
            "id": 1751
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "GetFileVersionInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "PathName",
                "value": "C:\\Windows\\System32\\kernel32.dll"
              }
            ],
            "repeated": 0,
            "id": 1752
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\MiniNT"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT"
              }
            ],
            "repeated": 0,
            "id": 1753
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\SQMClient"
              },
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient"
              }
            ],
            "repeated": 0,
            "id": 1754
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "MachineId"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\SQMClient\\MachineId"
              }
            ],
            "repeated": 0,
            "id": 1755
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 1756
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1757
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1758
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1759
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1760
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1761
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1762
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1763
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1764
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1765
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1766
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1767
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1768
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1769
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1770
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1771
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1772
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "System\\Setup"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\Setup"
              }
            ],
            "repeated": 0,
            "id": 1773
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "CollectTrace"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\CollectTrace"
              }
            ],
            "repeated": 0,
            "id": 1774
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 1775
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1776
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1777
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1778
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1779
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1780
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1781
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\Panther"
              }
            ],
            "repeated": 1,
            "id": 1782
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x067e4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00042000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1783
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\MiniNT"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT"
              }
            ],
            "repeated": 0,
            "id": 1784
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1785
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1786
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1787
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MiniNT"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\MiniNT"
              }
            ],
            "repeated": 0,
            "id": 1788
          },
          {
            "timestamp": "2026-05-28 22:59:40,144",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\Panther"
              }
            ],
            "repeated": 0,
            "id": 1789
          },
          {
            "timestamp": "2026-05-28 22:59:40,160",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "SetupPlatform.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69520000"
              }
            ],
            "repeated": 0,
            "id": 1790
          },
          {
            "timestamp": "2026-05-28 22:59:40,160",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupPlatform.dll"
              }
            ],
            "repeated": 0,
            "id": 1791
          },
          {
            "timestamp": "2026-05-28 22:59:40,160",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1792
          },
          {
            "timestamp": "2026-05-28 22:59:40,160",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupPlatform.dll"
              }
            ],
            "repeated": 0,
            "id": 1793
          },
          {
            "timestamp": "2026-05-28 22:59:40,160",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1794
          },
          {
            "timestamp": "2026-05-28 22:59:40,160",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1795
          },
          {
            "timestamp": "2026-05-28 22:59:40,160",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupPlatform.dll"
              }
            ],
            "repeated": 0,
            "id": 1796
          },
          {
            "timestamp": "2026-05-28 22:59:40,160",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1797
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1798
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\vds_ps"
              },
              {
                "name": "DllBase",
                "value": "0x69270000"
              }
            ],
            "repeated": 0,
            "id": 1799
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\vds_ps.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x69270000"
              }
            ],
            "repeated": 0,
            "id": 1800
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9C38ED61-D565-4728-AEEE-C80952F0ECDE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "E0393303-90D4-4A97-AB71-E9B671EE2729"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1801
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1802
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1803
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1804
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1805
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76cb2000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1806
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76cb2000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1807
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1808
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1809
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\SetupPlatform"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupPlatform"
              }
            ],
            "repeated": 0,
            "id": 1810
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1811
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "System\\Setup"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\Setup"
              }
            ],
            "repeated": 0,
            "id": 1812
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "CollectTrace"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\CollectTrace"
              }
            ],
            "repeated": 0,
            "id": 1813
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1814
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1815
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1816
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1817
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x067e5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1818
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Autounattend.xml"
              }
            ],
            "repeated": 0,
            "id": 1819
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000028"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1820
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1821
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000028"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1822
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1823
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1824
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1825
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1826
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1827
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1828
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1829
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1830
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1831
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1832
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1833
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1834
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1835
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1836
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1837
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1838
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "SetupPlatform.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69520000"
              }
            ],
            "repeated": 0,
            "id": 1839
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x067e5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1840
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc000003a",
            "pretty_return": "OBJECT_PATH_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Diagnostics\\diagnostics.dat"
              }
            ],
            "repeated": 0,
            "id": 1841
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1842
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1843
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1844
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1845
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1846
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1847
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1848
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1849
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1850
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              }
            ],
            "repeated": 0,
            "id": 1851
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1852
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1853
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1854
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1855
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "System\\Setup"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\Setup"
              }
            ],
            "repeated": 0,
            "id": 1856
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000458"
              },
              {
                "name": "ValueName",
                "value": "CollectTrace"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\CollectTrace"
              }
            ],
            "repeated": 0,
            "id": 1857
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1858
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1859
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1860
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1861
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\SetupPlatform"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupPlatform"
              }
            ],
            "repeated": 0,
            "id": 1862
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              }
            ],
            "repeated": 0,
            "id": 1863
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "SetupPlatform.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69520000"
              }
            ],
            "repeated": 0,
            "id": 1864
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0312b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1865
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1866
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1867
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1868
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1869
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1870
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1871
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1872
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1873
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc000000d",
            "pretty_return": "INVALID_PARAMETER",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1874
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1875
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1876
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1877
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\"
              }
            ],
            "repeated": 0,
            "id": 1878
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1879
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1880
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1881
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1882
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1883
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\"
              }
            ],
            "repeated": 0,
            "id": 1884
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1885
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc000000d",
            "pretty_return": "INVALID_PARAMETER",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1886
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1887
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1888
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1889
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\"
              }
            ],
            "repeated": 0,
            "id": 1890
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1891
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\HarddiskVolume2"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              }
            ],
            "repeated": 0,
            "id": 1892
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1893
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1894
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1895
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00"
              }
            ],
            "repeated": 0,
            "id": 1896
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1897
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\"
              }
            ],
            "repeated": 0,
            "id": 1898
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1899
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1900
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1901
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1902
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1903
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\"
              }
            ],
            "repeated": 0,
            "id": 1904
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1905
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc000000d",
            "pretty_return": "INVALID_PARAMETER",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1906
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1907
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1908
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1909
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\"
              }
            ],
            "repeated": 0,
            "id": 1910
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1911
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\HarddiskVolume2"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              }
            ],
            "repeated": 0,
            "id": 1912
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1913
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1914
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1915
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00"
              }
            ],
            "repeated": 0,
            "id": 1916
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1917
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1918
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1919
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1920
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1921
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1922
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1923
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1924
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1925
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc000000d",
            "pretty_return": "INVALID_PARAMETER",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1926
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1927
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1928
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1929
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\"
              }
            ],
            "repeated": 0,
            "id": 1930
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1931
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1932
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1933
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1934
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1935
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\"
              }
            ],
            "repeated": 0,
            "id": 1936
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1937
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc000000d",
            "pretty_return": "INVALID_PARAMETER",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1938
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1939
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1940
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1941
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\"
              }
            ],
            "repeated": 0,
            "id": 1942
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1943
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\HarddiskVolume2"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              }
            ],
            "repeated": 0,
            "id": 1944
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1945
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1946
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1947
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00"
              }
            ],
            "repeated": 0,
            "id": 1948
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1949
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1950
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1951
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1952
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1953
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1954
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1955
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1956
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1957
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc000000d",
            "pretty_return": "INVALID_PARAMETER",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1958
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1959
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1960
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1961
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\"
              }
            ],
            "repeated": 0,
            "id": 1962
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1963
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1964
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1965
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1966
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1967
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\"
              }
            ],
            "repeated": 0,
            "id": 1968
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1969
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc000000d",
            "pretty_return": "INVALID_PARAMETER",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1970
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1971
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1972
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1973
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\"
              }
            ],
            "repeated": 0,
            "id": 1974
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1975
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\HarddiskVolume2"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              }
            ],
            "repeated": 0,
            "id": 1976
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1977
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1978
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1979
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00"
              }
            ],
            "repeated": 0,
            "id": 1980
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1981
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "C:\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 1982
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$WINDOWS.~BT\\"
              }
            ],
            "repeated": 0,
            "id": 1983
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 1,
            "id": 1984
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$WINDOWS.~BT\\"
              }
            ],
            "repeated": 0,
            "id": 1985
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1986
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1987
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\"
              }
            ],
            "repeated": 0,
            "id": 1988
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1989
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\HarddiskVolume2"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              }
            ],
            "repeated": 0,
            "id": 1990
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1991
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1992
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1993
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00"
              }
            ],
            "repeated": 0,
            "id": 1994
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1995
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 1996
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 1997
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1998
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1999
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 2000
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2001
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 2002
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 2003
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc000000d",
            "pretty_return": "INVALID_PARAMETER",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2004
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2005
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2006
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2007
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\"
              }
            ],
            "repeated": 0,
            "id": 2008
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 2009
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2010
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2011
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 2012
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2013
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\"
              }
            ],
            "repeated": 0,
            "id": 2014
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 2015
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc000000d",
            "pretty_return": "INVALID_PARAMETER",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2016
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2017
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2018
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2019
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\"
              }
            ],
            "repeated": 0,
            "id": 2020
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 2021
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\HarddiskVolume2"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              }
            ],
            "repeated": 0,
            "id": 2022
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2023
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2024
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2025
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00"
              }
            ],
            "repeated": 0,
            "id": 2026
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2027
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 2028
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 2029
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2030
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2031
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 2032
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2033
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 2034
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 2035
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc000000d",
            "pretty_return": "INVALID_PARAMETER",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2036
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2037
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2038
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2039
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\"
              }
            ],
            "repeated": 0,
            "id": 2040
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 2041
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2042
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2043
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 2044
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2045
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\$Windows.~WS\\"
              }
            ],
            "repeated": 0,
            "id": 2046
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 2047
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc000000d",
            "pretty_return": "INVALID_PARAMETER",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2048
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2049
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2050
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2051
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\"
              }
            ],
            "repeated": 0,
            "id": 2052
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 2053
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\HarddiskVolume2"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              }
            ],
            "repeated": 0,
            "id": 2054
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2055
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2056
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2057
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\MountPointManager"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00"
              }
            ],
            "repeated": 0,
            "id": 2058
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2059
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "C:\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 2060
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT"
              }
            ],
            "repeated": 0,
            "id": 2061
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\"
              }
            ],
            "repeated": 0,
            "id": 2062
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT"
              }
            ],
            "repeated": 0,
            "id": 2063
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              }
            ],
            "repeated": 0,
            "id": 2064
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\$WINDOWS.~BT"
              }
            ],
            "repeated": 0,
            "id": 2065
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT\\Sources"
              }
            ],
            "repeated": 0,
            "id": 2066
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\"
              }
            ],
            "repeated": 0,
            "id": 2067
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT\\Sources"
              }
            ],
            "repeated": 0,
            "id": 2068
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT"
              }
            ],
            "repeated": 0,
            "id": 2069
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\$WINDOWS.~BT\\Sources"
              }
            ],
            "repeated": 0,
            "id": 2070
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther"
              }
            ],
            "repeated": 0,
            "id": 2071
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\"
              }
            ],
            "repeated": 0,
            "id": 2072
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther"
              }
            ],
            "repeated": 0,
            "id": 2073
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT\\Sources"
              }
            ],
            "repeated": 0,
            "id": 2074
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther"
              }
            ],
            "repeated": 0,
            "id": 2075
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2076
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 2077
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 2078
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2079
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\x14\\x12\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2080
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 2081
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "MutexName",
                "value": "Global\\WdsSetupLogInit"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2082
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2083
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2084
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2085
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2086
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\x14\\x12\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2087
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2088
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setuperr.log"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2089
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2090
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2091
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "x\\x14\\x12\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2092
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2093
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000460"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setuperr.log"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2094
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000460"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setuperr.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2095
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000460"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setuperr.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2096
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000460"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setuperr.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2097
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 2098
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2099
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 2100
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2101
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8\\x14\\x12\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2102
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 2103
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2104
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 2105
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2106
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\x14\\x12\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2107
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 2108
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000464"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2109
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000464"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2110
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000464"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2111
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000464"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 2112
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000464"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2113
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000464"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xfeff"
              },
              {
                "name": "Length",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 2114
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000464"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2115
          },
          {
            "timestamp": "2026-05-28 22:59:40,300",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000464"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2116
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000464"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "Buffer",
                "value": "<xml xmlns:s=\"uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882\"\n xmlns:dt=\"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882\"\n xmlns:rs=\"urn:schemas-microsoft-com:rowset\"\n xmlns:z=\"#RowsetSchema\">\n<s:Schema id=\"RowsetSchema\">\n<s:ElementType name=\"row\" content=\"eltOnly\" r"
              },
              {
                "name": "Length",
                "value": "1887"
              }
            ],
            "repeated": 0,
            "id": 2117
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 2118
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2119
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2120
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2121
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\x14\\x12\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2122
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2123
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2124
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2125
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2126
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\x13\\x12\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2127
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2128
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2129
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2130
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2131
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 2132
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2133
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xfeff"
              },
              {
                "name": "Length",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 2134
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2135
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2136
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "<xml xmlns:s=\"uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882\"\n xmlns:dt=\"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882\"\n xmlns:rs=\"urn:schemas-microsoft-com:rowset\"\n xmlns:z=\"#RowsetSchema\">\n<s:Schema id=\"RowsetSchema\">\n<s:ElementType name=\"row\" content=\"eltOnly\" r"
              },
              {
                "name": "Length",
                "value": "1887"
              }
            ],
            "repeated": 0,
            "id": 2137
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 2138
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 2,
            "id": 2139
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 2140
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 2141
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2142
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\x14\\x12\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2143
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 2144
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "MutexName",
                "value": "Global\\WdsSetupLogInit"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2145
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2146
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x69e4d580"
              }
            ],
            "repeated": 0,
            "id": 2147
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2148
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 2149
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2150
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\x14\\x12\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2151
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 2152
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2153
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 2154
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2155
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\x14\\x12\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2156
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 2157
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2158
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2159
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2160
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2161
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 2162
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2163
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2164
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2165
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "\\xfeff"
              },
              {
                "name": "Length",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 2166
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2167
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2168
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:35, Info                  SP     CSetupPlatform::Initialize: Setup log starts:\r\n"
              },
              {
                "name": "Length",
                "value": "97"
              }
            ],
            "repeated": 0,
            "id": 2169
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "h\\x00\\x00\\x00\\x00\\x00\\x00\\x00d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2170
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "d\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2171
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:35, Info                  SP     SEH: Enter CExceptionHandler::CExceptionHandler\r\n"
              },
              {
                "name": "Length",
                "value": "99"
              }
            ],
            "repeated": 0,
            "id": 2172
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2173
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2174
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:35, Info                  SP     SEH: Exit CExceptionHandler::CExceptionHandler\r\n"
              },
              {
                "name": "Length",
                "value": "98"
              }
            ],
            "repeated": 0,
            "id": 2175
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "0\\x01\\x00\\x00\\x00\\x00\\x00\\x00)\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2176
          },
          {
            "timestamp": "2026-05-28 22:59:40,316",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": ")\\x01\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2177
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  SP     Host system information:\r\n                                   VM: YES\r\n                                   Firmware type: PCAT\r\n                                   Manufacturer: BOCHS_\r\n                       "
              },
              {
                "name": "Length",
                "value": "1066"
              }
            ],
            "repeated": 0,
            "id": 2178
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00S\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2179
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "S\\x05\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2180
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  SP     Antivirus software information:\r\n                                   Name: Windows Defender, Path: %ProgramFiles%\\Windows Defender\\MsMpeng.exe, Timestamp: Thu, 28 May 2026 15:30:41 GMT, State: 401664\r\n\r\n"
              },
              {
                "name": "Length",
                "value": "252"
              }
            ],
            "repeated": 0,
            "id": 2181
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00O\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2182
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "O\\x06\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2183
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         SPGenerateCopyListFromConfigFile: Didn't find file list in C:\\$Windows.~WS\\Sources\\setupplatform.cfg, section Footprint.Basic.x86\r\n"
              },
              {
                "name": "Length",
                "value": "181"
              }
            ],
            "repeated": 0,
            "id": 2184
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2185
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x04\\x07\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2186
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         SPGetFootprintCapabilities: Starting verification of footprint section Footprint.Basic\r\n"
              },
              {
                "name": "Length",
                "value": "138"
              }
            ],
            "repeated": 0,
            "id": 2187
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x8e\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2188
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x8e\\x07\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2189
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         SPGetFootprintCapabilities: Could not find footprint file C:\\$Windows.~WS\\Sources\\reagent.admx\r\n"
              },
              {
                "name": "Length",
                "value": "146"
              }
            ],
            "repeated": 0,
            "id": 2190
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00b\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2191
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "b\\x07\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2192
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"565\" Fil=\"\" Fun=\"SPGetFootprintCapabilities\" Uid=\"50331648\" Msg=\"SPGetFootprintCapabilities: Footprint [Footprint.Basic] incomplete; the platform capability will not be available\" PID=\"5932\" TID=\"4312\" "
              },
              {
                "name": "Length",
                "value": "372"
              }
            ],
            "repeated": 0,
            "id": 2193
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00 \\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2194
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": " \\x08\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2195
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Warning                      SPGetFootprintCapabilities: Footprint [Footprint.Basic] incomplete; the platform capability will not be available\r\n"
              },
              {
                "name": "Length",
                "value": "165"
              }
            ],
            "repeated": 0,
            "id": 2196
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc5\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2197
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc5\\x08\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2198
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         SPGenerateCopyListFromConfigFile: Didn't find file list in C:\\$Windows.~WS\\Sources\\setupplatform.cfg, section Footprint.Servicing.x86\r\n"
              },
              {
                "name": "Length",
                "value": "185"
              }
            ],
            "repeated": 0,
            "id": 2199
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00~\t\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2200
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "~\t\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2201
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         SPGetFootprintCapabilities: Starting verification of footprint section Footprint.Servicing\r\n"
              },
              {
                "name": "Length",
                "value": "142"
              }
            ],
            "repeated": 0,
            "id": 2202
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\n\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2203
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x0c\n\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2204
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         SPGetFootprintCapabilities: Could not find footprint file C:\\$Windows.~WS\\Sources\\dismapi.dll\r\n"
              },
              {
                "name": "Length",
                "value": "145"
              }
            ],
            "repeated": 0,
            "id": 2205
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd6\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2206
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd6\\x08\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2207
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"565\" Fil=\"\" Fun=\"SPGetFootprintCapabilities\" Uid=\"50331648\" Msg=\"SPGetFootprintCapabilities: Footprint [Footprint.Servicing] incomplete; the platform capability will not be available\" PID=\"5932\" TID=\"43"
              },
              {
                "name": "Length",
                "value": "376"
              }
            ],
            "repeated": 0,
            "id": 2208
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9d\n\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2209
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x9d\n\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2210
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Warning                      SPGetFootprintCapabilities: Footprint [Footprint.Servicing] incomplete; the platform capability will not be available\r\n"
              },
              {
                "name": "Length",
                "value": "169"
              }
            ],
            "repeated": 0,
            "id": 2211
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00F\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2212
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "F\\x0b\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2213
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         SPGenerateCopyListFromConfigFile: Didn't find file list in C:\\$Windows.~WS\\Sources\\setupplatform.cfg, section Footprint.ICB.x86\r\n"
              },
              {
                "name": "Length",
                "value": "179"
              }
            ],
            "repeated": 0,
            "id": 2214
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2215
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xf9\\x0b\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2216
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         SPGetFootprintCapabilities: Starting verification of footprint section Footprint.ICB\r\n"
              },
              {
                "name": "Length",
                "value": "136"
              }
            ],
            "repeated": 0,
            "id": 2217
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x81\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2218
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x81\\x0c\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2219
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         SPGetFootprintCapabilities: Could not find footprint file C:\\$Windows.~WS\\Sources\\cmi2migxml.dll\r\n"
              },
              {
                "name": "Length",
                "value": "148"
              }
            ],
            "repeated": 0,
            "id": 2220
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00N\n\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2221
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "N\n\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2222
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"565\" Fil=\"\" Fun=\"SPGetFootprintCapabilities\" Uid=\"50331648\" Msg=\"SPGetFootprintCapabilities: Footprint [Footprint.ICB] incomplete; the platform capability will not be available\" PID=\"5932\" TID=\"4312\" Co"
              },
              {
                "name": "Length",
                "value": "370"
              }
            ],
            "repeated": 0,
            "id": 2223
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x15\r\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2224
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x15\r\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2225
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Warning                      SPGetFootprintCapabilities: Footprint [Footprint.ICB] incomplete; the platform capability will not be available\r\n"
              },
              {
                "name": "Length",
                "value": "163"
              }
            ],
            "repeated": 0,
            "id": 2226
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\r\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2227
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb8\r\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2228
          },
          {
            "timestamp": "2026-05-28 22:59:40,331",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         SPGenerateCopyListFromConfigFile: Didn't find file list in C:\\$Windows.~WS\\Sources\\setupplatform.cfg, section Footprint.Migration.x86\r\n"
              },
              {
                "name": "Length",
                "value": "185"
              }
            ],
            "repeated": 0,
            "id": 2229
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00q\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2230
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "q\\x0e\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2231
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         SPGetFootprintCapabilities: Starting verification of footprint section Footprint.Migration\r\n"
              },
              {
                "name": "Length",
                "value": "142"
              }
            ],
            "repeated": 0,
            "id": 2232
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2233
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xff\\x0e\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2234
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         SPGetFootprintCapabilities: Could not find footprint file C:\\$Windows.~WS\\Sources\\cmi2migxml.dll\r\n"
              },
              {
                "name": "Length",
                "value": "148"
              }
            ],
            "repeated": 0,
            "id": 2235
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2236
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc0\\x0b\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2237
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"565\" Fil=\"\" Fun=\"SPGetFootprintCapabilities\" Uid=\"50331648\" Msg=\"SPGetFootprintCapabilities: Footprint [Footprint.Migration] incomplete; the platform capability will not be available\" PID=\"5932\" TID=\"43"
              },
              {
                "name": "Length",
                "value": "376"
              }
            ],
            "repeated": 0,
            "id": 2238
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x93\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2239
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x93\\x0f\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2240
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Warning                      SPGetFootprintCapabilities: Footprint [Footprint.Migration] incomplete; the platform capability will not be available\r\n"
              },
              {
                "name": "Length",
                "value": "169"
              }
            ],
            "repeated": 0,
            "id": 2241
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00<\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2242
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "<\\x10\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2243
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         Initializing diagnostics helper; data file = (NULL)\r\n"
              },
              {
                "name": "Length",
                "value": "103"
              }
            ],
            "repeated": 0,
            "id": 2244
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xa3\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2245
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xa3\\x10\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2246
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         No existing diagnostics data\r\n"
              },
              {
                "name": "Length",
                "value": "80"
              }
            ],
            "repeated": 0,
            "id": 2247
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xf3\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2248
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xf3\\x10\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2249
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         Reading onesetting for tracing settings\r\n"
              },
              {
                "name": "Length",
                "value": "91"
              }
            ],
            "repeated": 0,
            "id": 2250
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x008\r\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2251
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\r\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2252
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"274\" Fil=\"\" Fun=\"CSetupOneSetting::InitializeAndQuery\" Uid=\"50331648\" Msg=\"Onesettings: Failed to get DeviceId from registry: 0x80070002\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupH"
              },
              {
                "name": "Length",
                "value": "330"
              }
            ],
            "repeated": 0,
            "id": 2253
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00N\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2254
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "N\\x11\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2255
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Warning                      Onesettings: Failed to get DeviceId from registry: 0x80070002\r\n"
              },
              {
                "name": "Length",
                "value": "113"
              }
            ],
            "repeated": 0,
            "id": 2256
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x82\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2257
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x82\\x0e\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2258
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"119\" Fil=\"\" Fun=\"CreateSetupOneSettings\" Uid=\"50331648\" Msg=\"Onesettings: Failed to initialize and query: 0x80070002\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod=\"SetupP"
              },
              {
                "name": "Length",
                "value": "310"
              }
            ],
            "repeated": 0,
            "id": 2259
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbf\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2260
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xbf\\x11\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2261
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Warning                      Onesettings: Failed to initialize and query: 0x80070002\r\n"
              },
              {
                "name": "Length",
                "value": "107"
              }
            ],
            "repeated": 0,
            "id": 2262
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2263
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb8\\x0f\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2264
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"398\" Fil=\"\" Fun=\"CSetupPlatformTracing::ReadTracingOneSettings\" Uid=\"50331648\" Msg=\"Failed to create OneSettings infrastructure. Error: 0x0880070002\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\So"
              },
              {
                "name": "Length",
                "value": "342"
              }
            ],
            "repeated": 0,
            "id": 2265
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00*\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2266
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "*\\x12\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2267
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Warning                      Failed to create OneSettings infrastructure. Error: 0x0880070002\r\n"
              },
              {
                "name": "Length",
                "value": "116"
              }
            ],
            "repeated": 0,
            "id": 2268
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x9e\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2269
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x9e\\x12\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2270
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         Reading onesetting for tracing settings completed, Error: 0x80070002\r\n"
              },
              {
                "name": "Length",
                "value": "120"
              }
            ],
            "repeated": 0,
            "id": 2271
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2272
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x0e\\x11\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2273
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"520\" Fil=\"\" Fun=\"CSetupPlatformTracing::Initialize\" Uid=\"50331648\" Msg=\"No onesetting configured or error getting onesetting\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod"
              },
              {
                "name": "Length",
                "value": "318"
              }
            ],
            "repeated": 0,
            "id": 2274
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x16\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2275
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x16\\x13\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2276
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Warning                      No onesetting configured or error getting onesetting\r\n"
              },
              {
                "name": "Length",
                "value": "104"
              }
            ],
            "repeated": 0,
            "id": 2277
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00~\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2278
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "~\\x13\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2279
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         Key CollectTrace is not available.\r\n"
              },
              {
                "name": "Length",
                "value": "86"
              }
            ],
            "repeated": 0,
            "id": 2280
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00L\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2281
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "L\\x12\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2282
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"13030\" Fil=\"\" Fun=\"CSetupPlatform::Initialize\" Uid=\"51150848\" Msg=\"CSetupPlatform::Initialize: Failed to initialize tracing\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" Mod="
              },
              {
                "name": "Length",
                "value": "319"
              }
            ],
            "repeated": 0,
            "id": 2283
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xd4\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2284
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd4\\x13\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2285
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Warning               SP     CSetupPlatform::Initialize: Failed to initialize tracing\r\n"
              },
              {
                "name": "Length",
                "value": "108"
              }
            ],
            "repeated": 0,
            "id": 2286
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00@\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2287
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "@\\x14\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2288
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         Use Paged memory for telemetry\r\n"
              },
              {
                "name": "Length",
                "value": "82"
              }
            ],
            "repeated": 0,
            "id": 2289
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x92\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2290
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x92\\x14\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2291
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         VDS available\r\n"
              },
              {
                "name": "Length",
                "value": "65"
              }
            ],
            "repeated": 0,
            "id": 2292
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xd3\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2293
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd3\\x14\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2294
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         Key CollectTrace is not available.\r\n"
              },
              {
                "name": "Length",
                "value": "86"
              }
            ],
            "repeated": 0,
            "id": 2295
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00)\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2296
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": ")\\x15\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2297
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  SP     Releasing the setup platform\r\n"
              },
              {
                "name": "Length",
                "value": "80"
              }
            ],
            "repeated": 0,
            "id": 2298
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00y\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2299
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "y\\x15\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2300
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  SP       StopTelemetry: 0\r\n"
              },
              {
                "name": "Length",
                "value": "70"
              }
            ],
            "repeated": 0,
            "id": 2301
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbf\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2302
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xbf\\x15\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2303
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  SP       UploadTelemetryData: 0\r\n"
              },
              {
                "name": "Length",
                "value": "76"
              }
            ],
            "repeated": 0,
            "id": 2304
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2305
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x0b\\x16\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2306
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  SP       CorrelationVector: <NULL>\r\n"
              },
              {
                "name": "Length",
                "value": "79"
              }
            ],
            "repeated": 0,
            "id": 2307
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00Z\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2308
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "Z\\x16\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2309
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  SP     Try to merge diagnostics data from default new system data file\r\n"
              },
              {
                "name": "Length",
                "value": "115"
              }
            ],
            "repeated": 0,
            "id": 2310
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xcd\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2311
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xcd\\x16\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2312
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  SP     Skip merge diagnostics data since C:\\$WINDOWS.~BT\\Sources\\Diagnostics\\diagnostics.dat is not exist\r\n"
              },
              {
                "name": "Length",
                "value": "150"
              }
            ],
            "repeated": 0,
            "id": 2313
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00c\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2314
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "c\\x17\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2315
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  SP     Finish merge diagnostics data\r\n"
              },
              {
                "name": "Length",
                "value": "81"
              }
            ],
            "repeated": 0,
            "id": 2316
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xb4\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2317
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb4\\x17\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2318
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  SP     Start uploading diagnostics data for setup platform\r\n"
              },
              {
                "name": "Length",
                "value": "103"
              }
            ],
            "repeated": 0,
            "id": 2319
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x1b\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2320
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1b\\x18\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2321
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  SP     Not opted-in to SQM. Diagnostics data will NOT be uploaded\r\n"
              },
              {
                "name": "Length",
                "value": "110"
              }
            ],
            "repeated": 0,
            "id": 2322
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x89\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2323
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x89\\x18\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2324
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                         Key CollectTrace is not available.\r\n"
              },
              {
                "name": "Length",
                "value": "86"
              }
            ],
            "repeated": 0,
            "id": 2325
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 2326
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 1,
            "id": 2327
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2328
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2329
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xdf\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2330
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xdf\\x18\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2331
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  SP     Closing Panther Logging\r\n"
              },
              {
                "name": "Length",
                "value": "75"
              }
            ],
            "repeated": 0,
            "id": 2332
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 2333
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 2334
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 2335
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 2336
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2337
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x08\\x15\\x12\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2338
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 2339
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "MutexName",
                "value": "Global\\WdsSetupLogInit"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2340
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2341
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x69e4d580"
              }
            ],
            "repeated": 0,
            "id": 2342
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x69844640"
              }
            ],
            "repeated": 0,
            "id": 2343
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030f1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 2344
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0312b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 2345
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0311f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 2346
          },
          {
            "timestamp": "2026-05-28 22:59:40,347",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2347
          },
          {
            "timestamp": "2026-05-28 22:59:40,363",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 2348
          },
          {
            "timestamp": "2026-05-28 22:59:40,363",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000464"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00b\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2349
          },
          {
            "timestamp": "2026-05-28 22:59:40,363",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000464"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "b\\x07\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2350
          },
          {
            "timestamp": "2026-05-28 22:59:40,363",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000464"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
              },
              {
                "name": "Buffer",
                "value": "</rs:data>\n</xml>\n"
              },
              {
                "name": "Length",
                "value": "18"
              }
            ],
            "repeated": 0,
            "id": 2351
          },
          {
            "timestamp": "2026-05-28 22:59:40,363",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 2352
          },
          {
            "timestamp": "2026-05-28 22:59:40,363",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x8b\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2353
          },
          {
            "timestamp": "2026-05-28 22:59:40,363",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x8b\\x13\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2354
          },
          {
            "timestamp": "2026-05-28 22:59:40,363",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "</rs:data>\n</xml>\n"
              },
              {
                "name": "Length",
                "value": "18"
              }
            ],
            "repeated": 0,
            "id": 2355
          },
          {
            "timestamp": "2026-05-28 22:59:40,363",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2356
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 2357
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 2358
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03310000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2359
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ac"
              }
            ],
            "repeated": 0,
            "id": 2360
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 2361
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030f1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2362
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 1,
            "id": 2363
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 2364
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2365
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a0"
              }
            ],
            "repeated": 0,
            "id": 2366
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 2367
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030ed000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 2368
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030d6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 2369
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030e6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 2370
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030dc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 2371
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030d6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2372
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 2373
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 2374
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b1f560"
              }
            ],
            "repeated": 0,
            "id": 2375
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupPlatform"
              },
              {
                "name": "DllBase",
                "value": "0x69520000"
              }
            ],
            "repeated": 0,
            "id": 2376
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0311f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2377
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\$Windows.~WS\\Sources\\unbcl"
              },
              {
                "name": "DllBase",
                "value": "0x69450000"
              }
            ],
            "repeated": 0,
            "id": 2378
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2379
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2380
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69450000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 2381
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x75f20000"
              }
            ],
            "repeated": 0,
            "id": 2382
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2383
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2384
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75f20000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 2385
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 2386
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 2387
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\VirtDisk"
              },
              {
                "name": "DllBase",
                "value": "0x69440000"
              }
            ],
            "repeated": 0,
            "id": 2388
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\FLTLIB"
              },
              {
                "name": "DllBase",
                "value": "0x70260000"
              }
            ],
            "repeated": 0,
            "id": 2389
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2390
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2391
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x70260000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 2392
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2393
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2394
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69440000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 2395
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\XmlLite"
              },
              {
                "name": "DllBase",
                "value": "0x72850000"
              }
            ],
            "repeated": 0,
            "id": 2396
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2397
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2398
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x72850000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 2399
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2400
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2401
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f4be98",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69520000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 2402
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2403
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2404
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00'\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2405
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "'\\x0f\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2406
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  MOUPG  SetupHost: Automation information not found. Releasing automation object.\r\n"
              },
              {
                "name": "Length",
                "value": "125"
              }
            ],
            "repeated": 0,
            "id": 2407
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 2408
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2409
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2410
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa4\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2411
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xa4\\x0f\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2412
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  MOUPG  SetupHost: Attempting to initialize OneSettings values\r\n"
              },
              {
                "name": "Length",
                "value": "106"
              }
            ],
            "repeated": 0,
            "id": 2413
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 2414
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faae93",
            "parentcaller": "0x00fab1ce",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 2415
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faae93",
            "parentcaller": "0x00fab1ce",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x77ac0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ntdll.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 2416
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaea5",
            "parentcaller": "0x00fab1ce",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySecurityPolicy"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b34170"
              }
            ],
            "repeated": 0,
            "id": 2417
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaec6",
            "parentcaller": "0x00fab1ce",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Kernel-ProductInfo"
              },
              {
                "name": "Type",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 2418
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaa84",
            "parentcaller": "0x00faad43",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2419
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaa84",
            "parentcaller": "0x00faad43",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000394"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000101",
                "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection"
              }
            ],
            "repeated": 0,
            "id": 2420
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaa84",
            "parentcaller": "0x00faad43",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "AllowTelemetry"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry"
              }
            ],
            "repeated": 0,
            "id": 2421
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaa84",
            "parentcaller": "0x00faad43",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 2422
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaaa9",
            "parentcaller": "0x00faad6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 2423
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaaa9",
            "parentcaller": "0x00faad6d",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x77ac0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ntdll.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 2424
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaab9",
            "parentcaller": "0x00faad6d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlIsStateSeparationEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b262c0"
              }
            ],
            "repeated": 0,
            "id": 2425
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaffb",
            "parentcaller": "0x00faad6d",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users"
              },
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users"
              }
            ],
            "repeated": 0,
            "id": 2426
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fab043",
            "parentcaller": "0x00faad6d",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000394"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2427
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fab19e",
            "parentcaller": "0x00faad6d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 2428
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab08",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x74ee0000"
              }
            ],
            "repeated": 0,
            "id": 2429
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab08",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x69b80000"
              }
            ],
            "repeated": 0,
            "id": 2430
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab08",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "policymanager.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x69b80000"
              }
            ],
            "repeated": 0,
            "id": 2431
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab08",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x69b80000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "policymanager.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 2432
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab1d",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69b80000"
              },
              {
                "name": "FunctionName",
                "value": "PolicyManager_GetPolicy"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x69b924c0"
              }
            ],
            "repeated": 0,
            "id": 2433
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab2c",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69b80000"
              },
              {
                "name": "FunctionName",
                "value": "PolicyManager_FreeGetPolicyData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x69b946d0"
              }
            ],
            "repeated": 0,
            "id": 2434
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69bfb000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2435
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69bfb000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2436
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2437
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry"
              }
            ],
            "repeated": 0,
            "id": 2438
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "PolicyType"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType"
              }
            ],
            "repeated": 0,
            "id": 2439
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "73777"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 2440
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "MergeAlgorithm"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm"
              }
            ],
            "repeated": 0,
            "id": 2441
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirectMapped"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped"
              }
            ],
            "repeated": 0,
            "id": 2442
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirect"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect"
              }
            ],
            "repeated": 0,
            "id": 2443
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69bfb000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2444
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69bfb000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2445
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirect"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect"
              }
            ],
            "repeated": 0,
            "id": 2446
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "RegValueNameRedirect"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect"
              }
            ],
            "repeated": 0,
            "id": 2447
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "RegValueNameRedirect"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "AllowTelemetry_PolicyManager"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect"
              }
            ],
            "repeated": 0,
            "id": 2448
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 2449
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser"
              }
            ],
            "repeated": 0,
            "id": 2450
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataDevice"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice"
              }
            ],
            "repeated": 0,
            "id": 2451
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataBoth"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth"
              }
            ],
            "repeated": 0,
            "id": 2452
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 2453
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Kernel-ProductInfo"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 2454
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Kernel-ProductInfoLegacyMapping"
              },
              {
                "name": "Type",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 2455
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "30Value"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value"
              }
            ],
            "repeated": 0,
            "id": 2456
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "Value"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value"
              }
            ],
            "repeated": 0,
            "id": 2457
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 2458
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2459
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection"
              }
            ],
            "repeated": 0,
            "id": 2460
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "AllowTelemetry_PolicyManager"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager"
              }
            ],
            "repeated": 0,
            "id": 2461
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 2462
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2463
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System"
              }
            ],
            "repeated": 0,
            "id": 2464
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2465
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\Windows\\DataCollection"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection"
              }
            ],
            "repeated": 0,
            "id": 2466
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "AllowTelemetry_PolicyManager"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager"
              }
            ],
            "repeated": 0,
            "id": 2467
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faab70",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 2468
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faacc4",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 2469
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faacc4",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 2470
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faacc4",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 2471
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faacc4",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b1f560"
              }
            ],
            "repeated": 0,
            "id": 2472
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faacc4",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x69b80000"
              }
            ],
            "repeated": 0,
            "id": 2473
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faacc4",
            "parentcaller": "0x00faadcd",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x74ee0000"
              }
            ],
            "repeated": 0,
            "id": 2474
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faacc4",
            "parentcaller": "0x00faadcd",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2475
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faacc4",
            "parentcaller": "0x00faadcd",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2476
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faacc4",
            "parentcaller": "0x00faadcd",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74ee0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 2477
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faacc4",
            "parentcaller": "0x00faadcd",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2478
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faacc4",
            "parentcaller": "0x00faadcd",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2479
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faacc4",
            "parentcaller": "0x00faadcd",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69b80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 2480
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaaa9",
            "parentcaller": "0x00faadf9",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 2481
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaaa9",
            "parentcaller": "0x00faadf9",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x77ac0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ntdll.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 2482
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaab9",
            "parentcaller": "0x00faadf9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlIsStateSeparationEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b262c0"
              }
            ],
            "repeated": 0,
            "id": 2483
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaffb",
            "parentcaller": "0x00faadf9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users"
              },
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users"
              }
            ],
            "repeated": 0,
            "id": 2484
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fab043",
            "parentcaller": "0x00faadf9",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000394"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2485
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fab19e",
            "parentcaller": "0x00faadf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 2486
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaaa9",
            "parentcaller": "0x00fab28b",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 2487
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaaa9",
            "parentcaller": "0x00fab28b",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x77ac0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ntdll.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 2488
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaab9",
            "parentcaller": "0x00fab28b",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlIsStateSeparationEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b262c0"
              }
            ],
            "repeated": 0,
            "id": 2489
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaa84",
            "parentcaller": "0x00faacfa",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2490
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaa84",
            "parentcaller": "0x00faacfa",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000394"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000101",
                "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection"
              }
            ],
            "repeated": 0,
            "id": 2491
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaa84",
            "parentcaller": "0x00faacfa",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "AllowTelemetry"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry"
              }
            ],
            "repeated": 0,
            "id": 2492
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faaa84",
            "parentcaller": "0x00faacfa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 2493
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faa5b1",
            "parentcaller": "0x00fa88bb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 2494
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faa5b1",
            "parentcaller": "0x00fa88bb",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x77ac0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ntdll.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 2495
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00faa5cd",
            "parentcaller": "0x00fa88bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlGetPersistedStateLocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b25dd0"
              }
            ],
            "repeated": 0,
            "id": 2496
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 2497
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f5afc4",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "TestMode"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\TestMode"
              }
            ],
            "repeated": 0,
            "id": 2498
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f5afc4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 2499
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2500
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2501
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2502
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x0e\\x10\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2503
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  MOUPG  OneSettings: OS [windows]\r\n"
              },
              {
                "name": "Length",
                "value": "77"
              }
            ],
            "repeated": 0,
            "id": 2504
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 2505
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b1f4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              },
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              }
            ],
            "repeated": 0,
            "id": 2506
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00f5cc27",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "BuildLabEx"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx"
              }
            ],
            "repeated": 0,
            "id": 2507
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00f5cc27",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "BuildLabEx"
              },
              {
                "name": "Data",
                "value": "19041.1.amd64fre.vb_release.191206-1406"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx"
              }
            ],
            "repeated": 0,
            "id": 2508
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b2ba",
            "parentcaller": "0x00f5cc27",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 2509
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5e4e2",
            "parentcaller": "0x00f5c239",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 2510
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              },
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              }
            ],
            "repeated": 0,
            "id": 2511
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f5c2e3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "UBR"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR"
              }
            ],
            "repeated": 0,
            "id": 2512
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f5c2e3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "UBR"
              },
              {
                "name": "Data",
                "value": "3803"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR"
              }
            ],
            "repeated": 0,
            "id": 2513
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f5c2e3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 2514
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2515
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2516
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00[\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2517
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "[\\x10\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2518
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  MOUPG  OneSettings: OsVer [10.0.19041.3803.amd64fre.vb_release.191206-1406]\r\n"
              },
              {
                "name": "Length",
                "value": "120"
              }
            ],
            "repeated": 0,
            "id": 2519
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 2520
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2521
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2522
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd3\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2523
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd3\\x10\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2524
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  MOUPG  OneSettings: ScenarioId [7]\r\n"
              },
              {
                "name": "Length",
                "value": "79"
              }
            ],
            "repeated": 0,
            "id": 2525
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 2526
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b1f4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              },
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              }
            ],
            "repeated": 0,
            "id": 2527
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00f5a92e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "EditionId"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId"
              }
            ],
            "repeated": 0,
            "id": 2528
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00f5a92e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "EditionId"
              },
              {
                "name": "Data",
                "value": "Professional"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId"
              }
            ],
            "repeated": 0,
            "id": 2529
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b2ba",
            "parentcaller": "0x00f5a92e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 2530
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2531
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2532
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\"\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2533
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\"\\x11\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2534
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  MOUPG  OneSettings: EditionId [Professional]\r\n"
              },
              {
                "name": "Length",
                "value": "89"
              }
            ],
            "repeated": 0,
            "id": 2535
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 2536
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b1f4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              },
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              }
            ],
            "repeated": 0,
            "id": 2537
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00f5a992",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "InstallationType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType"
              }
            ],
            "repeated": 0,
            "id": 2538
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00f5a992",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "InstallationType"
              },
              {
                "name": "Data",
                "value": "Client"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType"
              }
            ],
            "repeated": 0,
            "id": 2539
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b2ba",
            "parentcaller": "0x00f5a992",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 2540
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2541
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2542
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00{\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2543
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "{\\x11\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2544
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  MOUPG  OneSettings: InstallationType [Client]\r\n"
              },
              {
                "name": "Length",
                "value": "90"
              }
            ],
            "repeated": 0,
            "id": 2545
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 2546
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5aa10",
            "parentcaller": "0x00f58103",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 2547
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5aa54",
            "parentcaller": "0x00f58103",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Kernel-ProductInfo"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 2548
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5aa54",
            "parentcaller": "0x00f58103",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Kernel-ProductInfoLegacyMapping"
              },
              {
                "name": "Type",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 2549
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2550
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2551
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd5\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2552
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd5\\x11\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2553
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  MOUPG  OneSettings: Sku [48]\r\n"
              },
              {
                "name": "Length",
                "value": "73"
              }
            ],
            "repeated": 0,
            "id": 2554
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 2555
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b1f4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\SQMClient"
              },
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient"
              }
            ],
            "repeated": 0,
            "id": 2556
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00f5aaf6",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "MachineId"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId"
              }
            ],
            "repeated": 0,
            "id": 2557
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00f5aaf6",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "MachineId"
              },
              {
                "name": "Data",
                "value": "{088B0758-31C5-47D8-9C4B-32E98EB1AB80}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId"
              }
            ],
            "repeated": 0,
            "id": 2558
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b2ba",
            "parentcaller": "0x00f5aaf6",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 2559
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2560
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2561
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2562
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1e\\x12\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2563
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  MOUPG  OneSettings: DeviceId [{088B0758-31C5-47D8-9C4B-32E98EB1AB80}]\r\n"
              },
              {
                "name": "Length",
                "value": "114"
              }
            ],
            "repeated": 0,
            "id": 2564
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 2565
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b1f4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability"
              },
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability"
              }
            ],
            "repeated": 0,
            "id": 2566
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00f5ab57",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "Ring"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\Ring"
              }
            ],
            "repeated": 0,
            "id": 2567
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f5b2ba",
            "parentcaller": "0x00f5ab57",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 2568
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f9e91a",
            "parentcaller": "0x00f9e880",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2569
          },
          {
            "timestamp": "2026-05-28 22:59:40,378",
            "thread_id": "4312",
            "caller": "0x00f9e91a",
            "parentcaller": "0x00f9e880",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 2570
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f9e91a",
            "parentcaller": "0x00f9e880",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2571
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f9e95b",
            "parentcaller": "0x00f9e880",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2572
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f9e95b",
            "parentcaller": "0x00f9e880",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 2573
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f9e95b",
            "parentcaller": "0x00f9e880",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2574
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2575
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2576
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2577
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x90\\x12\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2578
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  CONX   Target OS version: 10.0.19041.572\r\n"
              },
              {
                "name": "Length",
                "value": "85"
              }
            ],
            "repeated": 0,
            "id": 2579
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 2580
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b1f4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 2581
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00f5ac35",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "OneSettingsVersion"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\OneSettingsVersion"
              }
            ],
            "repeated": 0,
            "id": 2582
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f5b2ba",
            "parentcaller": "0x00f5ac35",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 2583
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2584
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2585
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe5\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2586
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xe5\\x12\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2587
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  MOUPG  OneSettings: AppVer [10.0.19041.572]\r\n"
              },
              {
                "name": "Length",
                "value": "88"
              }
            ],
            "repeated": 0,
            "id": 2588
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 2589
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f5e36d",
            "parentcaller": "0x00f9e816",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 2590
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f5f4b6",
            "parentcaller": "0x00f5f56b",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2591
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f5f4b6",
            "parentcaller": "0x00f5f56b",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 2592
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f5f4b6",
            "parentcaller": "0x00f5f56b",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2593
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f5f4e6",
            "parentcaller": "0x00f5f56b",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2594
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f5f4e6",
            "parentcaller": "0x00f5f56b",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 2595
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f5f4e6",
            "parentcaller": "0x00f5f56b",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2596
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b1f4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 2597
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f5b21c",
            "parentcaller": "0x00f5ad71",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "OneSettingsBranch"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\OneSettingsBranch"
              }
            ],
            "repeated": 0,
            "id": 2598
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00f5b2ba",
            "parentcaller": "0x00f5ad71",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 2599
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2600
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2601
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00=\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2602
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "=\\x13\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2603
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:40, Info                  MOUPG  OneSettings: Branch [vb_release_svc_prod1]\r\n"
              },
              {
                "name": "Length",
                "value": "94"
              }
            ],
            "repeated": 0,
            "id": 2604
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 2605
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00faa670",
            "parentcaller": "0x00fa8a14",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "MutexName",
                "value": "Global\\OneSettingQueryMutex+WSD+Setup360"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2606
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00faa682",
            "parentcaller": "0x00fa8a14",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2607
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00faa682",
            "parentcaller": "0x00fa8a14",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "Milliseconds",
                "value": "60000"
              }
            ],
            "repeated": 0,
            "id": 2608
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa9d47",
            "parentcaller": "0x00fa8a1b",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2609
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa9d47",
            "parentcaller": "0x00fa8a1b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360"
              }
            ],
            "repeated": 0,
            "id": 2610
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8ea0",
            "parentcaller": "0x00fa8a82",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "winhttp.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x72780000"
              }
            ],
            "repeated": 0,
            "id": 2611
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8ea0",
            "parentcaller": "0x00fa8a82",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\OnDemandConnRouteHelper"
              },
              {
                "name": "DllBase",
                "value": "0x6e670000"
              }
            ],
            "repeated": 0,
            "id": 2612
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8ea0",
            "parentcaller": "0x00fa8a82",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OnDemandConnRouteHelper.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e670000"
              }
            ],
            "repeated": 0,
            "id": 2613
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8ea0",
            "parentcaller": "0x00fa8a82",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\OnDemandConnRouteHelper"
              },
              {
                "name": "DllBase",
                "value": "0x6e670000"
              }
            ],
            "repeated": 0,
            "id": 2614
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "6328",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000478"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000010",
                "pretty_value": "KEY_NOTIFY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000470"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TenantRestrictions\\Payload"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TenantRestrictions\\Payload"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 2615
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8ea0",
            "parentcaller": "0x00fa8a82",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "winhttp.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x72780000"
              }
            ],
            "repeated": 0,
            "id": 2616
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "6328",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2617
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8ea0",
            "parentcaller": "0x00fa8a82",
            "category": "network",
            "api": "WinHttpOpen",
            "status": true,
            "return": "0x031198e0",
            "arguments": [
              {
                "name": "UserAgent",
                "value": "OneSettingsQuery"
              },
              {
                "name": "ProxyName",
                "value": ""
              },
              {
                "name": "ProxyBypass",
                "value": ""
              },
              {
                "name": "AccessType",
                "value": "0x00000000"
              },
              {
                "name": "Flags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 2618
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "6328",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\TenantRestrictions\\Payload"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TenantRestrictions\\Payload"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 2619
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "6328",
            "caller": "0x7796b853",
            "parentcaller": "0x779ce66a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000480"
              },
              {
                "name": "KeyInformation",
                "value": ";#\\x05x]&\\xffda\\x01\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 2620
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8ec9",
            "parentcaller": "0x00fa8a82",
            "category": "network",
            "api": "WinHttpConnect",
            "status": true,
            "return": "0x0311c2a0",
            "arguments": [
              {
                "name": "SessionHandle",
                "value": "0x031198e0"
              },
              {
                "name": "ServerName",
                "value": "settings-win.data.microsoft.com"
              },
              {
                "name": "ServerPort",
                "value": "443"
              }
            ],
            "repeated": 0,
            "id": 2621
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f69",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2622
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f69",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7509c000"
              },
              {
                "name": "ModuleName",
                "value": "WTSAPI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2623
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f69",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7509c000"
              },
              {
                "name": "ModuleName",
                "value": "WTSAPI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2624
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f69",
            "parentcaller": "0x00fa905c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2625
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "WINSTA.dll"
              }
            ],
            "repeated": 0,
            "id": 2626
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\WINSTA.dll"
              }
            ],
            "repeated": 0,
            "id": 2627
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\winsta.dll"
              }
            ],
            "repeated": 0,
            "id": 2628
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\winsta.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 2629
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\winsta.dll"
              }
            ],
            "repeated": 0,
            "id": 2630
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e40000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00047000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2631
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e82000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2632
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e80000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2633
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e80000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2634
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2635
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2636
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e80000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2637
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 2638
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2639
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e80000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2640
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\Windows\\SYSTEM32\\WINSTA.dll"
              }
            ],
            "repeated": 0,
            "id": 2641
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\winsta.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 2642
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2643
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WINSTA"
              },
              {
                "name": "DllBase",
                "value": "0x74e40000"
              }
            ],
            "repeated": 0,
            "id": 2644
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\winsta"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e40000"
              },
              {
                "name": "InitRoutine",
                "value": "0x74e59300"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 2645
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7509c000"
              },
              {
                "name": "ModuleName",
                "value": "WTSAPI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2646
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7509c000"
              },
              {
                "name": "ModuleName",
                "value": "WTSAPI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2647
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e82000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2648
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e82000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2649
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 2650
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlGetSuiteMask"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af06d0"
              }
            ],
            "repeated": 0,
            "id": 2651
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e82000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2652
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x74e82000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2653
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              },
              {
                "name": "EventName",
                "value": "Global\\TermSrvReadyEvent"
              }
            ],
            "repeated": 0,
            "id": 2654
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2655
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 2656
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 2657
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2658
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 2659
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2660
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 2661
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2662
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f7f",
            "parentcaller": "0x00fa905c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 2663
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8fce",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000494"
              }
            ],
            "repeated": 0,
            "id": 2664
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8fce",
            "parentcaller": "0x00fa905c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000494"
              }
            ],
            "repeated": 0,
            "id": 2665
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8fce",
            "parentcaller": "0x00fa905c",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000494"
              }
            ],
            "repeated": 0,
            "id": 2666
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8fce",
            "parentcaller": "0x00fa905c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000494"
              }
            ],
            "repeated": 0,
            "id": 2667
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa90aa",
            "parentcaller": "0x00fa8ee3",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\IPHLPAPI"
              },
              {
                "name": "DllBase",
                "value": "0x74370000"
              }
            ],
            "repeated": 0,
            "id": 2668
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa90aa",
            "parentcaller": "0x00fa8ee3",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2669
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa90aa",
            "parentcaller": "0x00fa8ee3",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\NSI"
              },
              {
                "name": "DllBase",
                "value": "0x75d20000"
              }
            ],
            "repeated": 0,
            "id": 2670
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa90aa",
            "parentcaller": "0x00fa8ee3",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc6"
              },
              {
                "name": "DllBase",
                "value": "0x6be40000"
              }
            ],
            "repeated": 0,
            "id": 2671
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa90aa",
            "parentcaller": "0x00fa8ee3",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc"
              },
              {
                "name": "DllBase",
                "value": "0x74350000"
              }
            ],
            "repeated": 0,
            "id": 2672
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa90aa",
            "parentcaller": "0x00fa8ee3",
            "category": "network",
            "api": "WinHttpGetIEProxyConfigForCurrentUser",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 2673
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa915e",
            "parentcaller": "0x00fa8ee3",
            "category": "network",
            "api": "WinHttpGetProxyForUrl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SessionHandle",
                "value": "0x031198e0"
              },
              {
                "name": "Url",
                "value": "settings-win.data.microsoft.com"
              }
            ],
            "repeated": 0,
            "id": 2674
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa92bd",
            "parentcaller": "0x00fa8ee3",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000004a8"
              }
            ],
            "repeated": 0,
            "id": 2675
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa92bd",
            "parentcaller": "0x00fa8ee3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x88\\xec\\xe3\\x00`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2676
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa92bd",
            "parentcaller": "0x00fa8ee3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              }
            ],
            "repeated": 0,
            "id": 2677
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa92bd",
            "parentcaller": "0x00fa8ee3",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2678
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa92bd",
            "parentcaller": "0x00fa8ee3",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 2679
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa92bd",
            "parentcaller": "0x00fa8ee3",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "WinHttpSettings"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings"
              }
            ],
            "repeated": 0,
            "id": 2680
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa92bd",
            "parentcaller": "0x00fa8ee3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              }
            ],
            "repeated": 0,
            "id": 2681
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa8f15",
            "parentcaller": "0x00fa8a82",
            "category": "network",
            "api": "WinHttpOpenRequest",
            "status": true,
            "return": "0x030cbf60",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x0311c2a0"
              },
              {
                "name": "Verb",
                "value": "GET"
              },
              {
                "name": "ObjectName",
                "value": "settings/v2.0/WSD/Setup360?os=windows&osver=10.0.19041.3803.amd64fre.vb_release.191206-1406&scenarioId=7&platformEdition=Professional&platformInstallationType=Client&sku=48&deviceId={088B0758-31C5-47D8-9C4B-32E98EB1AB80}&appver=10.0.19041.572&appBuildLab=vb_release_svc_prod1"
              },
              {
                "name": "Version",
                "value": ""
              },
              {
                "name": "Referrer",
                "value": ""
              },
              {
                "name": "Flags",
                "value": "0x00800000"
              }
            ],
            "repeated": 0,
            "id": 2682
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00faa266",
            "parentcaller": "0x00fa9453",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2683
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00faa266",
            "parentcaller": "0x00fa9453",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360"
              }
            ],
            "repeated": 0,
            "id": 2684
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa9500",
            "parentcaller": "0x00fa8a90",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\webio"
              },
              {
                "name": "DllBase",
                "value": "0x69b90000"
              }
            ],
            "repeated": 0,
            "id": 2685
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa9500",
            "parentcaller": "0x00fa8a90",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\mswsock"
              },
              {
                "name": "DllBase",
                "value": "0x6e610000"
              }
            ],
            "repeated": 0,
            "id": 2686
          },
          {
            "timestamp": "2026-05-28 22:59:40,394",
            "thread_id": "4312",
            "caller": "0x00fa9500",
            "parentcaller": "0x00fa8a90",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\mswsock.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e610000"
              }
            ],
            "repeated": 0,
            "id": 2687
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "4312",
            "caller": "0x00fa9500",
            "parentcaller": "0x00fa8a90",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WINNSI"
              },
              {
                "name": "DllBase",
                "value": "0x6e5b0000"
              }
            ],
            "repeated": 0,
            "id": 2688
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77999924",
            "parentcaller": "0x76c1c2f8",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004c4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 2689
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b27bb9",
            "parentcaller": "0x76c222d7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2690
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x72838000"
              },
              {
                "name": "ModuleName",
                "value": "WINHTTP.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2691
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x72838000"
              },
              {
                "name": "ModuleName",
                "value": "WINHTTP.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2692
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x727bed9e",
            "parentcaller": "0x727a3e84",
            "category": "services",
            "api": "OpenSCManagerW",
            "status": true,
            "return": "0x03112158",
            "arguments": [
              {
                "name": "MachineName",
                "value": ""
              },
              {
                "name": "DatabaseName",
                "value": ""
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "SC_MANAGER_CONNECT"
              }
            ],
            "repeated": 0,
            "id": 2693
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x727bedb9",
            "parentcaller": "0x727a3e84",
            "category": "services",
            "api": "OpenServiceW",
            "status": true,
            "return": "0x03112360",
            "arguments": [
              {
                "name": "ServiceControlManager",
                "value": "0x03112158"
              },
              {
                "name": "ServiceName",
                "value": "WinHttpAutoProxySvc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000094",
                "pretty_value": "SERVICE_QUERY_STATUS|SERVICE_START|SERVICE_INTERROGATE"
              }
            ],
            "repeated": 0,
            "id": 2694
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x72838000"
              },
              {
                "name": "ModuleName",
                "value": "WINHTTP.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2695
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x72838000"
              },
              {
                "name": "ModuleName",
                "value": "WINHTTP.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2696
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798b088",
            "parentcaller": "0x75a66ff4",
            "category": "threading",
            "api": "NtOpenThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000538"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100010",
                "pretty_value": "THREAD_SET_CONTEXT|0x00100000"
              },
              {
                "name": "ProcessId",
                "value": "5932"
              },
              {
                "name": "ThreadId",
                "value": "18446744073541517328"
              }
            ],
            "repeated": 0,
            "id": 2697
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x72838000"
              },
              {
                "name": "ModuleName",
                "value": "WINHTTP.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2698
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x72838000"
              },
              {
                "name": "ModuleName",
                "value": "WINHTTP.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2699
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x75a668c8",
            "parentcaller": "0x77b1f0fa",
            "category": "threading",
            "api": "NtQueueApcThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessId",
                "value": "5932"
              },
              {
                "name": "ThreadId",
                "value": "6328"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000538"
              },
              {
                "name": "ApcRoutine",
                "value": "0x75a72550"
              },
              {
                "name": "Module",
                "value": "sechost.dll"
              }
            ],
            "repeated": 0,
            "id": 2700
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798ac59",
            "parentcaller": "0x75a67f8c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2701
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798ac59",
            "parentcaller": "0x75a67f8c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000538"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2702
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779a906b",
            "parentcaller": "0x75a67fa8",
            "category": "system",
            "api": "NtDelayExecution",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Milliseconds",
                "value": "250"
              }
            ],
            "repeated": 0,
            "id": 2703
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x75a72570",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000538"
              }
            ],
            "repeated": 0,
            "id": 2704
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x76c1fc08",
            "parentcaller": "0x76c1fabd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 2705
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727becf3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000534"
              }
            ],
            "repeated": 0,
            "id": 2706
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b27bb9",
            "parentcaller": "0x76c222d7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2707
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x76c20f20",
            "parentcaller": "0x76c1e30f",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2708
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x77b27bb9",
            "parentcaller": "0x76c222d7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2709
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798ac59",
            "parentcaller": "0x7279cb7a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000534"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2710
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000538"
              }
            ],
            "repeated": 0,
            "id": 2711
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000053c"
              }
            ],
            "repeated": 0,
            "id": 2712
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e5097",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000052c"
              }
            ],
            "repeated": 0,
            "id": 2713
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727a2629",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              }
            ],
            "repeated": 0,
            "id": 2714
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e50ec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000534"
              }
            ],
            "repeated": 0,
            "id": 2715
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77af2586",
            "parentcaller": "0x77af6986",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 2716
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x7798a206",
            "parentcaller": "0x75cbab4f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\mswsock.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e610000"
              }
            ],
            "repeated": 1,
            "id": 2717
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x7798a206",
            "parentcaller": "0x75cb5580",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DNSAPI"
              },
              {
                "name": "DllBase",
                "value": "0x703a0000"
              }
            ],
            "repeated": 0,
            "id": 2718
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x7798a206",
            "parentcaller": "0x75cb5580",
            "category": "network",
            "api": "GetAddrInfoExW",
            "status": false,
            "return": "0x000003e5",
            "arguments": [
              {
                "name": "Name",
                "value": "settings-win.data.microsoft.com"
              },
              {
                "name": "ServiceName",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2719
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2720
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x7798c134",
            "parentcaller": "0x75cb92fe",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000568"
              }
            ],
            "repeated": 0,
            "id": 2721
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x77989e76",
            "parentcaller": "0x75cb9325",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2722
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x7798ab1a",
            "parentcaller": "0x75cb9339",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              }
            ],
            "repeated": 0,
            "id": 2723
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2724
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000568"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f003f",
                "pretty_value": "KEY_ALL_ACCESS"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "System\\CurrentControlSet\\Services\\WinSock2\\Parameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\WinSock2\\Parameters"
              }
            ],
            "repeated": 0,
            "id": 2725
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              },
              {
                "name": "Class",
                "value": "Class"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 2726
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2727
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f094",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "WinSock_Registry_Version"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "2.0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\WinSock_Registry_Version"
              }
            ],
            "repeated": 0,
            "id": 2728
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters"
              }
            ],
            "repeated": 0,
            "id": 2729
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2730
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "AutodialDLL"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "C:\\Windows\\System32\\rasadhlp.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\AutodialDLL"
              }
            ],
            "repeated": 0,
            "id": 2731
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\Windows NT\\DnsClient"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient"
              }
            ],
            "repeated": 0,
            "id": 2732
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2733
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f094",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "AutodialDLL"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "C:\\Windows\\System32\\rasadhlp.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\AutodialDLL"
              }
            ],
            "repeated": 0,
            "id": 2734
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x75cb6193",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              }
            ],
            "repeated": 0,
            "id": 2735
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "System\\CurrentControlSet\\Services\\DNS"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\DNS"
              }
            ],
            "repeated": 0,
            "id": 2736
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "QueryAdapterName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryAdapterName"
              }
            ],
            "repeated": 0,
            "id": 2737
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "ValueName",
                "value": "DisableAdapterDomainName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableAdapterDomainName"
              }
            ],
            "repeated": 0,
            "id": 2738
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "UseDomainNameDevolution"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseDomainNameDevolution"
              }
            ],
            "repeated": 0,
            "id": 2739
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "ValueName",
                "value": "UseDomainNameDevolution"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UseDomainNameDevolution"
              }
            ],
            "repeated": 0,
            "id": 2740
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "DomainNameDevolutionLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DomainNameDevolutionLevel"
              }
            ],
            "repeated": 0,
            "id": 2741
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\rasadhlp"
              },
              {
                "name": "DllBase",
                "value": "0x6d2a0000"
              }
            ],
            "repeated": 0,
            "id": 2742
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "ValueName",
                "value": "PrioritizeRecordData"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\PrioritizeRecordData"
              }
            ],
            "repeated": 0,
            "id": 2743
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "AllowUnqualifiedQuery"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AllowUnqualifiedQuery"
              }
            ],
            "repeated": 0,
            "id": 2744
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "ValueName",
                "value": "AllowUnqualifiedQuery"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\AllowUnqualifiedQuery"
              }
            ],
            "repeated": 0,
            "id": 2745
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "AppendToMultiLabelName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AppendToMultiLabelName"
              }
            ],
            "repeated": 0,
            "id": 2746
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "ScreenBadTlds"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenBadTlds"
              }
            ],
            "repeated": 0,
            "id": 2747
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "ScreenUnreachableServers"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenUnreachableServers"
              }
            ],
            "repeated": 0,
            "id": 2748
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "ScreenDefaultServers"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenDefaultServers"
              }
            ],
            "repeated": 0,
            "id": 2749
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "DynamicServerQueryOrder"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DynamicServerQueryOrder"
              }
            ],
            "repeated": 0,
            "id": 2750
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "FilterClusterIp"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterClusterIp"
              }
            ],
            "repeated": 0,
            "id": 2751
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "WaitForNameErrorOnAll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\WaitForNameErrorOnAll"
              }
            ],
            "repeated": 0,
            "id": 2752
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "UseEdns"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseEdns"
              }
            ],
            "repeated": 0,
            "id": 2753
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "DnsSecureNameQueryFallback"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsSecureNameQueryFallback"
              }
            ],
            "repeated": 0,
            "id": 2754
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "EnableDAForAllNetworks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableDAForAllNetworks"
              }
            ],
            "repeated": 0,
            "id": 2755
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "DirectAccessQueryOrder"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessQueryOrder"
              }
            ],
            "repeated": 0,
            "id": 2756
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "QueryIpMatching"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryIpMatching"
              }
            ],
            "repeated": 0,
            "id": 2757
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "UseHostsFile"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseHostsFile"
              }
            ],
            "repeated": 0,
            "id": 2758
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "AddrConfigControl"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AddrConfigControl"
              }
            ],
            "repeated": 0,
            "id": 2759
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "DisableSmartNameResolution"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartNameResolution"
              }
            ],
            "repeated": 0,
            "id": 2760
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "PreferLocalOverLowerBindingDNS"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PreferLocalOverLowerBindingDNS"
              }
            ],
            "repeated": 0,
            "id": 2761
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "QueryNetBTFQDN"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryNetBTFQDN"
              }
            ],
            "repeated": 0,
            "id": 2762
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "DisableSmartProtocolReordering"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartProtocolReordering"
              }
            ],
            "repeated": 0,
            "id": 2763
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "UdpRecvBufferSize"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UdpRecvBufferSize"
              }
            ],
            "repeated": 0,
            "id": 2764
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "DisableParallelAandAAAA"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableParallelAandAAAA"
              }
            ],
            "repeated": 0,
            "id": 2765
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "DisableCoalescing"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableCoalescing"
              }
            ],
            "repeated": 0,
            "id": 2766
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "FilterVPNTrigger"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterVPNTrigger"
              }
            ],
            "repeated": 0,
            "id": 2767
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "EnableMultiHomedRouteConflicts"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMultiHomedRouteConflicts"
              }
            ],
            "repeated": 0,
            "id": 2768
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "ForceQueriesOverTcp"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ForceQueriesOverTcp"
              }
            ],
            "repeated": 0,
            "id": 2769
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "ShareTcpConnections"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShareTcpConnections"
              }
            ],
            "repeated": 0,
            "id": 2770
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "RegistrationEnabled"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationEnabled"
              }
            ],
            "repeated": 0,
            "id": 2771
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "ValueName",
                "value": "DisableDynamicUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableDynamicUpdate"
              }
            ],
            "repeated": 0,
            "id": 2772
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "RegisterPrimaryName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterPrimaryName"
              }
            ],
            "repeated": 0,
            "id": 2773
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x77991b7a",
            "parentcaller": "0x75cbfb5d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "rasadhlp.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6d2a0000"
              },
              {
                "name": "FunctionName",
                "value": "WSAttemptAutodialAddr"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6d2a25a0"
              }
            ],
            "repeated": 0,
            "id": 2774
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "RegisterAdapterName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterAdapterName"
              }
            ],
            "repeated": 0,
            "id": 2775
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6324",
            "caller": "0x77991b7a",
            "parentcaller": "0x75cbfb73",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "rasadhlp.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6d2a0000"
              },
              {
                "name": "FunctionName",
                "value": "WSAttemptAutodialName"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6d2a1570"
              }
            ],
            "repeated": 0,
            "id": 2776
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "ValueName",
                "value": "EnableAdapterDomainNameRegistration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\EnableAdapterDomainNameRegistration"
              }
            ],
            "repeated": 0,
            "id": 2777
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "RegisterReverseLookup"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterReverseLookup"
              }
            ],
            "repeated": 0,
            "id": 2778
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "ValueName",
                "value": "DisableReverseAddressRegistrations"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableReverseAddressRegistrations"
              }
            ],
            "repeated": 0,
            "id": 2779
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "RegisterWanAdapters"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterWanAdapters"
              }
            ],
            "repeated": 0,
            "id": 2780
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "ValueName",
                "value": "DisableWanDynamicUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableWanDynamicUpdate"
              }
            ],
            "repeated": 0,
            "id": 2781
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "RegistrationTtl"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationTtl"
              }
            ],
            "repeated": 0,
            "id": 2782
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "ValueName",
                "value": "DefaultRegistrationTTL"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationTTL"
              }
            ],
            "repeated": 0,
            "id": 2783
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "RegistrationRefreshInterval"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationRefreshInterval"
              }
            ],
            "repeated": 0,
            "id": 2784
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "ValueName",
                "value": "DefaultRegistrationRefreshInterval"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationRefreshInterval"
              }
            ],
            "repeated": 0,
            "id": 2785
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "RegistrationMaxAddressCount"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationMaxAddressCount"
              }
            ],
            "repeated": 0,
            "id": 2786
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "ValueName",
                "value": "MaxNumberOfAddressesToRegister"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\MaxNumberOfAddressesToRegister"
              }
            ],
            "repeated": 0,
            "id": 2787
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "UpdateSecurityLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateSecurityLevel"
              }
            ],
            "repeated": 0,
            "id": 2788
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "ValueName",
                "value": "UpdateSecurityLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UpdateSecurityLevel"
              }
            ],
            "repeated": 0,
            "id": 2789
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "UpdateTopLevelDomainZones"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateTopLevelDomainZones"
              }
            ],
            "repeated": 0,
            "id": 2790
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "DowncaseSpnCauseApiOwnerIsTooLazy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DowncaseSpnCauseApiOwnerIsTooLazy"
              }
            ],
            "repeated": 0,
            "id": 2791
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "RegistrationOverwrite"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationOverwrite"
              }
            ],
            "repeated": 0,
            "id": 2792
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "MaxCacheSize"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheSize"
              }
            ],
            "repeated": 0,
            "id": 2793
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "MaxCacheTtl"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheTtl"
              }
            ],
            "repeated": 0,
            "id": 2794
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "MaxNegativeCacheTtl"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxNegativeCacheTtl"
              }
            ],
            "repeated": 0,
            "id": 2795
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "AdapterTimeoutLimit"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AdapterTimeoutLimit"
              }
            ],
            "repeated": 0,
            "id": 2796
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "ServerPriorityTimeLimit"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ServerPriorityTimeLimit"
              }
            ],
            "repeated": 0,
            "id": 2797
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "MaxCachedSockets"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCachedSockets"
              }
            ],
            "repeated": 0,
            "id": 2798
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "DisableServerUnreachability"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableServerUnreachability"
              }
            ],
            "repeated": 0,
            "id": 2799
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "EnableMulticast"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMulticast"
              }
            ],
            "repeated": 0,
            "id": 2800
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "MulticastResponderFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastResponderFlags"
              }
            ],
            "repeated": 0,
            "id": 2801
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "MulticastSenderFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderFlags"
              }
            ],
            "repeated": 0,
            "id": 2802
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "MulticastSenderMaxTimeout"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderMaxTimeout"
              }
            ],
            "repeated": 0,
            "id": 2803
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "EnableMDNS"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMDNS"
              }
            ],
            "repeated": 0,
            "id": 2804
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "DnsTest"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsTest"
              }
            ],
            "repeated": 0,
            "id": 2805
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "UseCompartments"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseCompartments"
              }
            ],
            "repeated": 0,
            "id": 2806
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "CacheAllCompartments"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\CacheAllCompartments"
              }
            ],
            "repeated": 0,
            "id": 2807
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "UseNewRegistration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseNewRegistration"
              }
            ],
            "repeated": 0,
            "id": 2808
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "ResolverRegistration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistration"
              }
            ],
            "repeated": 0,
            "id": 2809
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "ResolverRegistrationOnly"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistrationOnly"
              }
            ],
            "repeated": 0,
            "id": 2810
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "NewDhcpSrvRegistration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\NewDhcpSrvRegistration"
              }
            ],
            "repeated": 0,
            "id": 2811
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "DirectAccessPreferLocal"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessPreferLocal"
              }
            ],
            "repeated": 0,
            "id": 2812
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "DisableIdnEncoding"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableIdnEncoding"
              }
            ],
            "repeated": 0,
            "id": 2813
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "EnableIdnMapping"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableIdnMapping"
              }
            ],
            "repeated": 0,
            "id": 2814
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "ShortnameProxyDefault"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShortnameProxyDefault"
              }
            ],
            "repeated": 0,
            "id": 2815
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "DisableNRPTForAdapterRegistration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableNRPTForAdapterRegistration"
              }
            ],
            "repeated": 0,
            "id": 2816
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "TestMode_AdaptiveTimeoutHistoryLength"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutHistoryLength"
              }
            ],
            "repeated": 0,
            "id": 2817
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "TestMode_AdaptiveTimeoutRecalculationInterval"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutRecalculationInterval"
              }
            ],
            "repeated": 0,
            "id": 2818
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "DnsQueryTimeouts"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQueryTimeouts"
              }
            ],
            "repeated": 0,
            "id": 2819
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "ValueName",
                "value": "DnsQueryTimeouts"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQueryTimeouts"
              }
            ],
            "repeated": 0,
            "id": 2820
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "DnsQuickQueryTimeouts"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQuickQueryTimeouts"
              }
            ],
            "repeated": 0,
            "id": 2821
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "ValueName",
                "value": "DnsQuickQueryTimeouts"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQuickQueryTimeouts"
              }
            ],
            "repeated": 0,
            "id": 2822
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798040b",
            "parentcaller": "0x703cb166",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000544"
              }
            ],
            "repeated": 0,
            "id": 2823
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798040b",
            "parentcaller": "0x703cb175",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000564"
              }
            ],
            "repeated": 0,
            "id": 2824
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2825
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              },
              {
                "name": "Class",
                "value": "Class"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 2826
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2827
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters"
              }
            ],
            "repeated": 0,
            "id": 2828
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2829
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\Windows NT\\DnsClient"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient"
              }
            ],
            "repeated": 0,
            "id": 2830
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "Hostname"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname"
              }
            ],
            "repeated": 0,
            "id": 2831
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "Hostname"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "DESKTOP-HGH2VBT"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname"
              }
            ],
            "repeated": 0,
            "id": 2832
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798040b",
            "parentcaller": "0x703cb166",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000564"
              }
            ],
            "repeated": 0,
            "id": 2833
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798040b",
            "parentcaller": "0x703cb175",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000544"
              }
            ],
            "repeated": 0,
            "id": 2834
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2835
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              },
              {
                "name": "Class",
                "value": "Class"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 2836
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2837
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters"
              }
            ],
            "repeated": 0,
            "id": 2838
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2839
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\Windows NT\\DnsClient"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient"
              }
            ],
            "repeated": 0,
            "id": 2840
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2841
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\System\\DNSClient"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\System\\DNSClient"
              }
            ],
            "repeated": 0,
            "id": 2842
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "ValueName",
                "value": "Domain"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain"
              }
            ],
            "repeated": 0,
            "id": 2843
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "ValueName",
                "value": "Domain"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain"
              }
            ],
            "repeated": 0,
            "id": 2844
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798040b",
            "parentcaller": "0x703cb166",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000544"
              }
            ],
            "repeated": 0,
            "id": 2845
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798040b",
            "parentcaller": "0x703cb175",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000564"
              }
            ],
            "repeated": 0,
            "id": 2846
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2847
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters"
              },
              {
                "name": "Class",
                "value": "Class"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 2848
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2849
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000544"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters"
              }
            ],
            "repeated": 0,
            "id": 2850
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2851
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\Windows NT\\DnsClient"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient"
              }
            ],
            "repeated": 0,
            "id": 2852
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "Hostname"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname"
              }
            ],
            "repeated": 0,
            "id": 2853
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "ValueName",
                "value": "Hostname"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "DESKTOP-HGH2VBT"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname"
              }
            ],
            "repeated": 0,
            "id": 2854
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798040b",
            "parentcaller": "0x703cb166",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000564"
              }
            ],
            "repeated": 0,
            "id": 2855
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798040b",
            "parentcaller": "0x703cb175",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000544"
              }
            ],
            "repeated": 0,
            "id": 2856
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x75d21941",
            "parentcaller": "0x743770b3",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000494"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\Nsi"
              },
              {
                "name": "IoControlCode",
                "value": "0x00120007"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1b7t\\x08\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\xf2\\xa6\\x06\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1b7t\\x08\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\xf2\\xa6\\x06\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x18\\xf2\\xa6\\x06\\xb3p7t\\x01\\x00\\x00\\x000\\x1b7t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2857
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x75d21966",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000544"
              }
            ],
            "repeated": 0,
            "id": 2858
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x70420000"
              },
              {
                "name": "ModuleName",
                "value": "DNSAPI.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2859
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x70420000"
              },
              {
                "name": "ModuleName",
                "value": "DNSAPI.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2860
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b27bb9",
            "parentcaller": "0x76c222d7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2861
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x76c212f8",
            "parentcaller": "0x76c1ea12",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000544"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 2862
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798c134",
            "parentcaller": "0x76c21389",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000564"
              }
            ],
            "repeated": 0,
            "id": 2863
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b16a20",
            "parentcaller": "0x77b19456",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x03\\x10\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2864
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b190c4",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "d\\x8a\\x0c\\x03\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00r\\x00a\\x00s\\x00a\\x00d\\x00h\\x00l\\x00p\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00l\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2865
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b19103",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\xa3\\x10\\x03`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00r\\x00a\\x00s\\x00a\\x00d\\x00h\\x00l\\x00p\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2866
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b19120",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2867
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b1915f",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x14#\\x11\\x03\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2868
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b19178",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2869
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b191b3",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb4\\xeb\\x11\\x03\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 2870
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b19240",
            "parentcaller": "0x77b191c3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\x8bk|_\\x8bk\\x06\\x00\\x00\\x00h_\\x8bkT\\x00\\x00\\x00\\xb0\\xeb\\x11\\x03\\x00\\x00#\\x00D\\xec8\\xecd\\x05\\x00\\x00$\\xf0\\x00\\x00\\x00\\x00\\x07\\x03#\\x00\\x00\\xc0d\\x05\\x00\\x00\\x8c\\xec\\xa6\\x06\\xb3\\x91\\xb1wd\\x05\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2871
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b1926e",
            "parentcaller": "0x77b191c3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\x93k\\x8c\\xfa\\xf6\\x04$\\xf0\\xf0\\x04#\\x00\\x00\\xc0\\xec\\xa8ik\\xbd\\x81W\\xab4\\xe7\\xa6\\x06d\\x05\\x00\\x00\\x84\\xf1\\xa6\\x06\\xa0\\xe6\\x80ka\\xcb}\\xc6\\xfe\\xff\\xff\\xffD\\xec\\xa6\\x06\\x96\\x19mk2\\x00\\x00\\x00\\x04:\\x8bk\\x98_\\x8bk"
              }
            ],
            "repeated": 0,
            "id": 2872
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b16a20",
            "parentcaller": "0x77b17151",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x03\\x10\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2873
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b190c4",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "T\\x8b\\x0c\\x03\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00m\\x00s\\x00w\\x00s\\x00o\\x00c\\x00k\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2874
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b19103",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "x\\xa4\\x10\\x03`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00[z2\\xaa\\xf5\\xee\\xdc\\x01\\x02\\x00\\x00\\x00\\x05\\x00\\x00\\x00\n\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00r\\x00n\\x00\"\\x00\\x00\\xc0d\\x00l\\x00\\x02\\x00\\x00\\x00-\\x001\\x002\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2875
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b19120",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2876
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b1915f",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb4#\\x11\\x03\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2877
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b19178",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2878
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b191b3",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf4\\xea\\x11\\x03\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 2879
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b19240",
            "parentcaller": "0x77b191c3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\x8bk|_\\x8bk\\x06\\x00\\x00\\x00h_\\x8bkT\\x00\\x00\\x00\\xf0\\xea\\x11\\x03\\x00\\x00#\\x00,\\xea \\xead\\x05\\x00\\x00$\\xf0\\x00\\x00\\x00\\x00\\x07\\x03#\\x00\\x00\\xc0d\\x05\\x00\\x00t\\xea\\xa6\\x06\\xb3\\x91\\xb1wd\\x05\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2880
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b1926e",
            "parentcaller": "0x77b191c3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\x93k\\x8c\\xfa\\xf6\\x04$\\xf0\\xf0\\x04#\\x00\\x00\\xc0\\xec\\xa8ik\\x95\\x83W\\xab\\x1c\\xe5\\xa6\\x06d\\x05\\x00\\x00\\x84\\xf1\\xa6\\x06\\xa0\\xe6\\x80ka\\xcb}\\xc6\\xfe\\xff\\xff\\xff,\\xea\\xa6\\x06\\x96\\x19mk2\\x00\\x00\\x00\\x04:\\x8bk\\x98_\\x8bk"
              }
            ],
            "repeated": 0,
            "id": 2881
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x76c213d9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000544"
              }
            ],
            "repeated": 0,
            "id": 2882
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x76c213f2",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000564"
              }
            ],
            "repeated": 0,
            "id": 2883
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b27bb9",
            "parentcaller": "0x76c222d7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2884
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x76c212f8",
            "parentcaller": "0x76c2624d",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000564"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 2885
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798c134",
            "parentcaller": "0x76c21389",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000544"
              }
            ],
            "repeated": 0,
            "id": 2886
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b16a20",
            "parentcaller": "0x77b19456",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x03\\x10\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2887
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b190c4",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "d\\x8a\\x0c\\x03\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00r\\x00a\\x00s\\x00a\\x00d\\x00h\\x00l\\x00p\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00l\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2888
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b19103",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "8\\x9c\\x10\\x03`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00b\\x000\\x005\\x00-\\x004\\x000\\x00e\\x00d\\x00-\\x009\\x004\\x00c\\x008\\x00-\\x00b\\x005\\x00c\\x00e\\x005\\x006\\x00a\\x005\\x000\\x00a\\x00c\\x008\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2889
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b19120",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2890
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b1915f",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x0c!\\x11\\x03\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2891
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b19178",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2892
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b191b3",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb4\\xe2\\x11\\x03\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 2893
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b19240",
            "parentcaller": "0x77b191c3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\x8bk|_\\x8bk\\x06\\x00\\x00\\x00h_\\x8bkT\\x00\\x00\\x00\\xb0\\xe2\\x11\\x03\\x00\\x00#\\x00\\x0c\\xeb\\x00\\xebD\\x05\\x00\\x00$\\xf0\\x00\\x00\\x00\\x00\\x07\\x03#\\x00\\x00\\xc0D\\x05\\x00\\x00T\\xeb\\xa6\\x06\\xb3\\x91\\xb1wD\\x05\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2894
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b1926e",
            "parentcaller": "0x77b191c3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\x93k\\x8c\\xfa\\xf6\\x04$\\xf0\\xf0\\x04#\\x00\\x00\\xc0\\xec\\xa8ik\\xf5\\x80W\\xab\\xfc\\xe5\\xa6\\x06D\\x05\\x00\\x00\\x84\\xf1\\xa6\\x06\\xa0\\xe6\\x80ka\\xcb}\\xc6\\xfe\\xff\\xff\\xff\\x0c\\xeb\\xa6\\x06\\x96\\x19mk2\\x00\\x00\\x00\\x04:\\x8bk\\x98_\\x8bk"
              }
            ],
            "repeated": 0,
            "id": 2895
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b16a20",
            "parentcaller": "0x77b17151",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x03\\x10\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2896
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b190c4",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "T\\x8b\\x0c\\x03\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00m\\x00s\\x00w\\x00s\\x00o\\x00c\\x00k\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2897
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b19103",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\xa3\\x10\\x03`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00r\\x00a\\x00s\\x00a\\x00d\\x00h\\x00l\\x00p\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2898
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b19120",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2899
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b1915f",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xac!\\x11\\x03\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2900
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b19178",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2901
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b191b3",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x14\\xe6\\x11\\x03\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 2902
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b19240",
            "parentcaller": "0x77b191c3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\x8bk|_\\x8bk\\x06\\x00\\x00\\x00h_\\x8bkT\\x00\\x00\\x00\\x10\\xe6\\x11\\x03\\x00\\x00#\\x00\\xf4\\xe8\\xe8\\xe8D\\x05\\x00\\x00$\\xf0\\x00\\x00\\x00\\x00\\x07\\x03#\\x00\\x00\\xc0D\\x05\\x00\\x00<\\xe9\\xa6\\x06\\xb3\\x91\\xb1wD\\x05\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2903
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b1926e",
            "parentcaller": "0x77b191c3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\x93k\\x8c\\xfa\\xf6\\x04$\\xf0\\xf0\\x04#\\x00\\x00\\xc0\\xec\\xa8ik\\xed\\x82W\\xab\\xe4\\xe3\\xa6\\x06D\\x05\\x00\\x00\\x84\\xf1\\xa6\\x06\\xa0\\xe6\\x80ka\\xcb}\\xc6\\xfe\\xff\\xff\\xff\\xf4\\xe8\\xa6\\x06\\x96\\x19mk2\\x00\\x00\\x00\\x04:\\x8bk\\x98_\\x8bk"
              }
            ],
            "repeated": 0,
            "id": 2904
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b195ab",
            "parentcaller": "0x77b176fc",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\xeb\\xa6\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x0c\\x00\\x00\\x00p\\xeb\\xa6\\x06t\\x88\\xb1w\\xbcz\\x10\\x03`\\xeb\\xa6\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x96\\x88\\xb1w\\x00\\x00\\x00\\x00\\x00\\x03\\xa6\\x06"
              }
            ],
            "repeated": 0,
            "id": 2905
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b195f2",
            "parentcaller": "0x77b176fc",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "2"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2906
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b1962c",
            "parentcaller": "0x77b176fc",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "2"
              },
              {
                "name": "TokenInformation",
                "value": "\\x0e\\x00\\x00\\x00LP\\x0f\\x03\\x07\\x00\\x00\\x00hP\\x0f\\x03\\x07\\x00\\x00\\x00tP\\x0f\\x03\\x07\\x00\\x00\\x00\\x80P\\x0f\\x03\\x0f\\x00\\x00\\x00\\x90P\\x0f\\x03\\x07\\x00\\x00\\x00\\xa0P\\x0f\\x03\\x07\\x00\\x00\\x00\\xacP\\x0f\\x03\\x07\\x00\\x00\\x00\\xb8P\\x0f\\x03\\x07\\x00\\x00\\x00\\xc4P\\x0f\\x03\\x07\\x00\\x00\\x00\\xd0P\\x0f\\x03\\x07\\x00\\x00\\x00\\xdcP\\x0f\\x03\\x07\\x00\\x00\\xc0\\xf0P\\x0f\\x03\\x07\\x00\\x00\\x00\\xfcP\\x0f\\x03\\x07\\x00\\x00\\x00\\x0cQ\\x0f\\x03`\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05r\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x01\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x0f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05"
              }
            ],
            "repeated": 0,
            "id": 2907
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x76c213d9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000564"
              }
            ],
            "repeated": 0,
            "id": 2908
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x76c213f2",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000544"
              }
            ],
            "repeated": 0,
            "id": 2909
          },
          {
            "timestamp": "2026-05-28 22:59:40,410",
            "thread_id": "6328",
            "caller": "0x77b27bb9",
            "parentcaller": "0x76c222d7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2910
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6328",
            "caller": "0x77999924",
            "parentcaller": "0x75cbd80d",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000568"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 2911
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6328",
            "caller": "0x7798a206",
            "parentcaller": "0x75cbb489",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\fwpuclnt"
              },
              {
                "name": "DllBase",
                "value": "0x6d200000"
              }
            ],
            "repeated": 0,
            "id": 2912
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6328",
            "caller": "0x7798a206",
            "parentcaller": "0x75cbb489",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\FWPUCLNT.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x6d200000"
              }
            ],
            "repeated": 0,
            "id": 2913
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6328",
            "caller": "0x77991b7a",
            "parentcaller": "0x75cbb4ab",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "fwpuclnt.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6d200000"
              },
              {
                "name": "FunctionName",
                "value": "NamespaceCallout"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6d215770"
              }
            ],
            "repeated": 0,
            "id": 2914
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6328",
            "caller": "0x7798c134",
            "parentcaller": "0x6d215d64",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000057c"
              }
            ],
            "repeated": 0,
            "id": 2915
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6328",
            "caller": "0x6d215d7e",
            "parentcaller": "0x6d215b55",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2916
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x6d215d94",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000057c"
              }
            ],
            "repeated": 0,
            "id": 2917
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6328",
            "caller": "0x77b27bb9",
            "parentcaller": "0x76c222d7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2918
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6328",
            "caller": "0x7798964f",
            "parentcaller": "0x6d21623c",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000580"
              },
              {
                "name": "EventName",
                "value": "Global\\BFE_Notify_Event_{80fc7231-085a-4301-8993-1b13132ee74d}"
              }
            ],
            "repeated": 0,
            "id": 2919
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x6d215ca4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000580"
              }
            ],
            "repeated": 0,
            "id": 2920
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6328",
            "caller": "0x76c1fc08",
            "parentcaller": "0x76c1fabd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 2921
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6328",
            "caller": "0x75cbdc64",
            "parentcaller": "0x75cc4f9e",
            "category": "network",
            "api": "WSASocketW",
            "status": true,
            "return": "0x00000530",
            "arguments": [
              {
                "name": "af",
                "value": "23",
                "pretty_value": "AF_INET6"
              },
              {
                "name": "type",
                "value": "2",
                "pretty_value": "SOCK_DGRAM"
              },
              {
                "name": "protocol",
                "value": "0"
              },
              {
                "name": "socket",
                "value": "1328"
              }
            ],
            "repeated": 0,
            "id": 2922
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6328",
            "caller": "0x6e61a714",
            "parentcaller": "0x75cbdd57",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000103",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000530"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\Afd"
              },
              {
                "name": "IoControlCode",
                "value": "0x000120bf",
                "pretty_value": "IOCTL_AFD_DEFER_ACCEPT"
              },
              {
                "name": "InputBuffer",
                "value": "\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\xc8\\x01\\x00\\x00\\x00\\x18\\xfb\\x0c\\x03\\x0c\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\xb0#\\x11\\x03\\x1c\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2923
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6328",
            "caller": "0x6e61a9c5",
            "parentcaller": "0x6e61a75c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000538"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2924
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6328",
            "caller": "0x6e61ac73",
            "parentcaller": "0x6e61aa9e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 2925
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x69baf7b6",
            "parentcaller": "0x69bafd35",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2926
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x69bbb752",
            "parentcaller": "0x69bc1f5c",
            "category": "network",
            "api": "WSASocketW",
            "status": true,
            "return": "0x00000530",
            "arguments": [
              {
                "name": "af",
                "value": "2",
                "pretty_value": "AF_INET"
              },
              {
                "name": "type",
                "value": "1",
                "pretty_value": "SOCK_STREAM"
              },
              {
                "name": "protocol",
                "value": "6",
                "pretty_value": "IPPROTO_TCP"
              },
              {
                "name": "socket",
                "value": "1328"
              }
            ],
            "repeated": 0,
            "id": 2927
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x69bbb827",
            "parentcaller": "0x69bc1f5c",
            "category": "network",
            "api": "setsockopt",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1328"
              },
              {
                "name": "level",
                "value": "0x0000ffff"
              },
              {
                "name": "optname",
                "value": "0x00003007"
              },
              {
                "name": "optval",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2928
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x69bbb878",
            "parentcaller": "0x69bc1f5c",
            "category": "network",
            "api": "bind",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1328"
              },
              {
                "name": "ip",
                "value": "0.0.0.0"
              },
              {
                "name": "port",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2929
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x69bbb8dc",
            "parentcaller": "0x69bc1f5c",
            "category": "network",
            "api": "setsockopt",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1328"
              },
              {
                "name": "level",
                "value": "0x00000006"
              },
              {
                "name": "optname",
                "value": "0x00000001"
              },
              {
                "name": "optval",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2930
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2931
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ac"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2932
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2933
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ac"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2934
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77b053db",
            "parentcaller": "0x7798a51e",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\mswsock.dll"
              }
            ],
            "repeated": 0,
            "id": 2935
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77b11f80",
            "parentcaller": "0x77af8db8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2936
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77af931b",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\mswsock.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 2937
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77af931b",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000580"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\sysnative\\en-US\\mswsock.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 2938
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77af97cc",
            "parentcaller": "0x77af92ae",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000584"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000580"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\sysnative\\en-US\\mswsock.dll.mui"
              }
            ],
            "repeated": 0,
            "id": 2939
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77af97f4",
            "parentcaller": "0x77af92ae",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000584"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x069edf08"
              },
              {
                "name": "ViewSize",
                "value": "0x00003000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2940
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77af9804",
            "parentcaller": "0x77af92ae",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000584"
              }
            ],
            "repeated": 0,
            "id": 2941
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77b053db",
            "parentcaller": "0x7798a51e",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\mswsock.dll"
              }
            ],
            "repeated": 4,
            "id": 2942
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77b053db",
            "parentcaller": "0x7798a51e",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wshqos.dll"
              }
            ],
            "repeated": 0,
            "id": 2943
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77988f9b",
            "parentcaller": "0x77988a9e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000584"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wshqos.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2944
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798a5ca",
            "parentcaller": "0x7798a277",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000588"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000005",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000584"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\wshqos.dll"
              }
            ],
            "repeated": 0,
            "id": 2945
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798a613",
            "parentcaller": "0x7798a277",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x40000003",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000588"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00007000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2946
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798a66b",
            "parentcaller": "0x7798a277",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000588"
              }
            ],
            "repeated": 0,
            "id": 2947
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798a672",
            "parentcaller": "0x7798a277",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000584"
              }
            ],
            "repeated": 0,
            "id": 2948
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77b11f80",
            "parentcaller": "0x77af8db8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2949
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77af931b",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\wshqos.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 2950
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77af93ac",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000584"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\sysnative\\en-US\\wshqos.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 2951
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77af97cc",
            "parentcaller": "0x77af92ae",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000588"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000584"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\wshqos.dll.mui"
              }
            ],
            "repeated": 0,
            "id": 2952
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77af97f4",
            "parentcaller": "0x77af92ae",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000588"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b90000"
              },
              {
                "name": "SectionOffset",
                "value": "0x069edf08"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2953
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77af9804",
            "parentcaller": "0x77af92ae",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000588"
              }
            ],
            "repeated": 0,
            "id": 2954
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77b1a49a",
            "parentcaller": "0x77b1a3d0",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b90000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 2955
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77b1a4a8",
            "parentcaller": "0x77b1a3d0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000584"
              }
            ],
            "repeated": 0,
            "id": 2956
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798893c",
            "parentcaller": "0x75cb904d",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              }
            ],
            "repeated": 0,
            "id": 2957
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77b053db",
            "parentcaller": "0x7798a51e",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wshqos.dll"
              }
            ],
            "repeated": 0,
            "id": 2958
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77988f9b",
            "parentcaller": "0x77988a9e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000584"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wshqos.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2959
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798a5ca",
            "parentcaller": "0x7798a277",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000588"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000005",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000584"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\wshqos.dll"
              }
            ],
            "repeated": 0,
            "id": 2960
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798a613",
            "parentcaller": "0x7798a277",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x40000003",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000588"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00007000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2961
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798a66b",
            "parentcaller": "0x7798a277",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000588"
              }
            ],
            "repeated": 0,
            "id": 2962
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798a672",
            "parentcaller": "0x7798a277",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000584"
              }
            ],
            "repeated": 0,
            "id": 2963
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77b11f80",
            "parentcaller": "0x77af8db8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2964
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77af931b",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\wshqos.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 2965
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77af93ac",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000584"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\sysnative\\en-US\\wshqos.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 2966
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77af97cc",
            "parentcaller": "0x77af92ae",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000588"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000584"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\wshqos.dll.mui"
              }
            ],
            "repeated": 0,
            "id": 2967
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77af97f4",
            "parentcaller": "0x77af92ae",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000588"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b90000"
              },
              {
                "name": "SectionOffset",
                "value": "0x069edf08"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2968
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77af9804",
            "parentcaller": "0x77af92ae",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000588"
              }
            ],
            "repeated": 0,
            "id": 2969
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77b1a49a",
            "parentcaller": "0x77b1a3d0",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b90000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 2970
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77b1a4a8",
            "parentcaller": "0x77b1a3d0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000584"
              }
            ],
            "repeated": 0,
            "id": 2971
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798893c",
            "parentcaller": "0x75cb904d",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              }
            ],
            "repeated": 0,
            "id": 2972
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77b053db",
            "parentcaller": "0x7798a51e",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wshqos.dll"
              }
            ],
            "repeated": 0,
            "id": 2973
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77988f9b",
            "parentcaller": "0x77988a9e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000584"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wshqos.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2974
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798a5ca",
            "parentcaller": "0x7798a277",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000588"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000005",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000584"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\wshqos.dll"
              }
            ],
            "repeated": 0,
            "id": 2975
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798a613",
            "parentcaller": "0x7798a277",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x40000003",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000588"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00007000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2976
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798a66b",
            "parentcaller": "0x7798a277",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000588"
              }
            ],
            "repeated": 0,
            "id": 2977
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x7798a672",
            "parentcaller": "0x7798a277",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000584"
              }
            ],
            "repeated": 0,
            "id": 2978
          },
          {
            "timestamp": "2026-05-28 22:59:40,441",
            "thread_id": "6324",
            "caller": "0x77b11f80",
            "parentcaller": "0x77af8db8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2979
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77af931b",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\wshqos.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 2980
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77af93ac",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000584"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\sysnative\\en-US\\wshqos.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 2981
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77af97cc",
            "parentcaller": "0x77af92ae",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000056c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000584"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\wshqos.dll.mui"
              }
            ],
            "repeated": 0,
            "id": 2982
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77af97f4",
            "parentcaller": "0x77af92ae",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000056c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b90000"
              },
              {
                "name": "SectionOffset",
                "value": "0x069edf08"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2983
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77af9804",
            "parentcaller": "0x77af92ae",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 2984
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77b1a49a",
            "parentcaller": "0x77b1a3d0",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b90000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 2985
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77b1a4a8",
            "parentcaller": "0x77b1a3d0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000584"
              }
            ],
            "repeated": 0,
            "id": 2986
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x7798893c",
            "parentcaller": "0x75cb904d",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              }
            ],
            "repeated": 0,
            "id": 2987
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77b053db",
            "parentcaller": "0x7798a51e",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wshqos.dll"
              }
            ],
            "repeated": 0,
            "id": 2988
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77988f9b",
            "parentcaller": "0x77988a9e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000584"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wshqos.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2989
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x7798a5ca",
            "parentcaller": "0x7798a277",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000056c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000005",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000584"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\wshqos.dll"
              }
            ],
            "repeated": 0,
            "id": 2990
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x7798a613",
            "parentcaller": "0x7798a277",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x40000003",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000056c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00007000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2991
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x7798a66b",
            "parentcaller": "0x7798a277",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 2992
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x7798a672",
            "parentcaller": "0x7798a277",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000584"
              }
            ],
            "repeated": 0,
            "id": 2993
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77b11f80",
            "parentcaller": "0x77af8db8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2994
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77af931b",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\wshqos.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 2995
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77af93ac",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000584"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\sysnative\\en-US\\wshqos.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 2996
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77af97cc",
            "parentcaller": "0x77af92ae",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000056c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000584"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\wshqos.dll.mui"
              }
            ],
            "repeated": 0,
            "id": 2997
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77af97f4",
            "parentcaller": "0x77af92ae",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000056c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b90000"
              },
              {
                "name": "SectionOffset",
                "value": "0x069edf08"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2998
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77af9804",
            "parentcaller": "0x77af92ae",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 2999
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77b1a49a",
            "parentcaller": "0x77b1a3d0",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b90000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 3000
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77b1a4a8",
            "parentcaller": "0x77b1a3d0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000584"
              }
            ],
            "repeated": 0,
            "id": 3001
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x7798893c",
            "parentcaller": "0x75cb904d",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              }
            ],
            "repeated": 0,
            "id": 3002
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03134000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3003
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x75d52066",
            "parentcaller": "0x69bbba78",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000530"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\Afd"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3004
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77b2739f",
            "parentcaller": "0x77b271b6",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000530"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\Afd"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "T\\x00\\x00\\x00\\xc0)\r\\x03"
              }
            ],
            "repeated": 0,
            "id": 3005
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x69baee81",
            "parentcaller": "0x69bc1fa6",
            "category": "network",
            "api": "ConnectEx",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1328"
              },
              {
                "name": "SendBuffer",
                "value": ""
              },
              {
                "name": "ip",
                "value": "20.42.179.192"
              },
              {
                "name": "port",
                "value": "443"
              }
            ],
            "repeated": 0,
            "id": 3006
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x7798ab1a",
            "parentcaller": "0x75cb5ad9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000534"
              }
            ],
            "repeated": 0,
            "id": 3007
          },
          {
            "timestamp": "2026-05-28 22:59:40,456",
            "thread_id": "6324",
            "caller": "0x77af2586",
            "parentcaller": "0x77af6986",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              }
            ],
            "repeated": 0,
            "id": 3008
          },
          {
            "timestamp": "2026-05-28 22:59:40,644",
            "thread_id": "6324",
            "caller": "0x69bc2329",
            "parentcaller": "0x69bae296",
            "category": "network",
            "api": "setsockopt",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1328"
              },
              {
                "name": "level",
                "value": "0x0000ffff"
              },
              {
                "name": "optname",
                "value": "0x00007010"
              },
              {
                "name": "optval",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3009
          },
          {
            "timestamp": "2026-05-28 22:59:40,644",
            "thread_id": "6324",
            "caller": "0x6e62ac5d",
            "parentcaller": "0x75cc234d",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000530"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\Afd"
              },
              {
                "name": "IoControlCode",
                "value": "0x0001202f",
                "pretty_value": "IOCTL_AFD_GET_SOCK_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x02\\x00\\xc2&\\xc0\\xa8\\x01i\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3010
          },
          {
            "timestamp": "2026-05-28 22:59:40,644",
            "thread_id": "6324",
            "caller": "0x7798a206",
            "parentcaller": "0x74d9f15e",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\schannel"
              },
              {
                "name": "DllBase",
                "value": "0x6d180000"
              }
            ],
            "repeated": 0,
            "id": 3011
          },
          {
            "timestamp": "2026-05-28 22:59:40,644",
            "thread_id": "6324",
            "caller": "0x7798a206",
            "parentcaller": "0x74d9f15e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\schannel.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x6d180000"
              }
            ],
            "repeated": 0,
            "id": 3012
          },
          {
            "timestamp": "2026-05-28 22:59:40,660",
            "thread_id": "6324",
            "caller": "0x77991b7a",
            "parentcaller": "0x74d9effb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "schannel.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6d180000"
              },
              {
                "name": "FunctionName",
                "value": "SpUserModeInitialize"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6d188f40"
              }
            ],
            "repeated": 0,
            "id": 3013
          },
          {
            "timestamp": "2026-05-28 22:59:40,660",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3014
          },
          {
            "timestamp": "2026-05-28 22:59:40,660",
            "thread_id": "6324",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000058c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "System\\CurrentControlSet\\Control\\SecurityProviders\\Schannel"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders\\Schannel"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 3015
          },
          {
            "timestamp": "2026-05-28 22:59:40,660",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000058c"
              },
              {
                "name": "ValueName",
                "value": "UserContextLockCount"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextLockCount"
              }
            ],
            "repeated": 0,
            "id": 3016
          },
          {
            "timestamp": "2026-05-28 22:59:40,660",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000058c"
              },
              {
                "name": "ValueName",
                "value": "UserContextListCount"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextListCount"
              }
            ],
            "repeated": 0,
            "id": 3017
          },
          {
            "timestamp": "2026-05-28 22:59:40,660",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x6d1890a0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000058c"
              }
            ],
            "repeated": 0,
            "id": 3018
          },
          {
            "timestamp": "2026-05-28 22:59:40,660",
            "thread_id": "6324",
            "caller": "0x74d97592",
            "parentcaller": "0x74da158b",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xd0\\xcd\\x00,\\x17\\x00\\x00\\xb4\\x18\\x00\\x00\\x03\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "6324"
              }
            ],
            "repeated": 0,
            "id": 3019
          },
          {
            "timestamp": "2026-05-28 22:59:40,660",
            "thread_id": "6324",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xd0\\xcd\\x00,\\x17\\x00\\x00\\xb4\\x18\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "6324"
              }
            ],
            "repeated": 0,
            "id": 3020
          },
          {
            "timestamp": "2026-05-28 22:59:40,660",
            "thread_id": "6324",
            "caller": "0x69bab419",
            "parentcaller": "0x69bc2d0d",
            "category": "network",
            "api": "WSASend",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Socket",
                "value": "1328"
              },
              {
                "name": "Buffer",
                "value": "\\x16\\x03\\x03\\x00\\xc1\\x01\\x00\\x00\\xbd\\x03\\x03j\\x18\\xc8\\xdc\\x17\\xda#|r>\\x0f`\\x12!\\x97N\\xef\\xf3\\xb0\\xc7F\\xb29\\x7f\\x19\\xfb\\x1e z\\xd0\\xbb\\xf0\\x00\\x00&\\xc0,\\xc0+\\xc00\\xc0/\\xc0$\\xc0#\\xc0(\\xc0'\\xc0\n\\xc0\t\\xc0\\x14\\xc0\\x13\\x00\\x9d\\x00\\x9c\\x00=\\x00<\\x005\\x00/\\x00\n\\x01\\x00\\x00n\\x00\\x00\\x00$\\x00\"\\x00\\x00\\x1fsettings-win.data.microsoft.com\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\n\\x00\\x08\\x00\\x06\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00\r\\x00\\x1a\\x00\\x18\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x02\\x01\\x04\\x03\\x05\\x03\\x02\\x03\\x02\\x02\\x06\\x01\\x06\\x03\\x00#\\x00\\x00\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 3021
          },
          {
            "timestamp": "2026-05-28 22:59:40,660",
            "thread_id": "6324",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1328"
              }
            ],
            "repeated": 0,
            "id": 3022
          },
          {
            "timestamp": "2026-05-28 22:59:40,847",
            "thread_id": "6324",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xd0\\xcd\\x00,\\x17\\x00\\x00\\xb4\\x18\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "6324"
              }
            ],
            "repeated": 0,
            "id": 3023
          },
          {
            "timestamp": "2026-05-28 22:59:40,863",
            "thread_id": "6324",
            "caller": "0x69bab419",
            "parentcaller": "0x69bc2d0d",
            "category": "network",
            "api": "WSASend",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Socket",
                "value": "1328"
              },
              {
                "name": "Buffer",
                "value": "\\x16\\x03\\x03\\x00f\\x10\\x00\\x00ba\\x04\\x0b\\xe9\\x9d\\x90\\xbb=(\\xf7\\xdb\\xae\\x8f\\xd2\\xfb\\x9a\\x1e\\xb9&\\xcc\\x16e\\xb5\\xe3\\xc4\\x98\\xaa\\x8f\\x11\\x15\\x86\\x91\\x99\\xc0;>\\xafm\\x15+9\\xb9%\\xf2\\x99n]x\\x08\\xa9BtMA\\x03\\x83\\x1c<\\xe3B\\xcc\\xea<\\x17\\xdb\\xf6N\\xecB\\x0b\\x8d\\x10\\xcaH\\xa5\\xc0\\x910\\xc3\\xc7\\xb8O\\xf1\\x82\\xae\\xce\\xb9\\xe6xbo\\xb6\\xe6\\xde\\x12\\x12~\\xa2\\x14\\x03\\x03\\x00\\x01\\x01\\x16\\x03\\x03\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00WN\\xe9\\xa6\\x89p{8\\xae\"9\\xa9l\\x8d%\\xf25\\xc2h\\xecx\\xaf\\xacWr\\xc8Y_W\\xf4\\x1b\\x92"
              }
            ],
            "repeated": 0,
            "id": 3024
          },
          {
            "timestamp": "2026-05-28 22:59:40,863",
            "thread_id": "6324",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1328"
              }
            ],
            "repeated": 0,
            "id": 3025
          },
          {
            "timestamp": "2026-05-28 22:59:41,050",
            "thread_id": "6324",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xd0\\xcd\\x00,\\x17\\x00\\x00\\xb4\\x18\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "6324"
              }
            ],
            "repeated": 0,
            "id": 3026
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03139000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3027
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x7798a206",
            "parentcaller": "0x6d198079",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "sspicli.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x74d90000"
              }
            ],
            "repeated": 0,
            "id": 3028
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77991b7a",
            "parentcaller": "0x6d19808e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "SspiCli.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x74d90000"
              },
              {
                "name": "FunctionName",
                "value": "FreeContextBuffer"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x74d9ca70"
              }
            ],
            "repeated": 0,
            "id": 3029
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x7798a206",
            "parentcaller": "0x6d1980a5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\mskeyprotect"
              },
              {
                "name": "DllBase",
                "value": "0x6d170000"
              }
            ],
            "repeated": 0,
            "id": 3030
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x7798a206",
            "parentcaller": "0x6d1980a5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NTASN1"
              },
              {
                "name": "DllBase",
                "value": "0x702e0000"
              }
            ],
            "repeated": 0,
            "id": 3031
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x7798a206",
            "parentcaller": "0x6d1980a5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "mskeyprotect.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x6d170000"
              }
            ],
            "repeated": 0,
            "id": 3032
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77991b7a",
            "parentcaller": "0x6d1980ba",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "mskeyprotect.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6d170000"
              },
              {
                "name": "FunctionName",
                "value": "KeyFileProtectSessionTicket"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6d1769c0"
              }
            ],
            "repeated": 0,
            "id": 3033
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77991b7a",
            "parentcaller": "0x6d1980d0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "mskeyprotect.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6d170000"
              },
              {
                "name": "FunctionName",
                "value": "KeyFileUnprotectSessionTicket"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6d176d60"
              }
            ],
            "repeated": 0,
            "id": 3034
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77b1109f",
            "parentcaller": "0x77b0f039",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "ncrypt.dll"
              }
            ],
            "repeated": 0,
            "id": 3035
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77b1213c",
            "parentcaller": "0x77b12046",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\ncrypt.dll"
              }
            ],
            "repeated": 0,
            "id": 3036
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77b1213c",
            "parentcaller": "0x77b12046",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ncrypt.dll"
              }
            ],
            "repeated": 0,
            "id": 3037
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77b1e65c",
            "parentcaller": "0x77b1e3a8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000005e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ncrypt.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 3038
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77b1e699",
            "parentcaller": "0x77b1e3a8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000005e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000005e0"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\ncrypt.dll"
              }
            ],
            "repeated": 0,
            "id": 3039
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77b1122c",
            "parentcaller": "0x77b11397",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000005e4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x70dd0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00021000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3040
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77b1000f",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x70deb000"
              },
              {
                "name": "ModuleName",
                "value": "ncrypt.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3041
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77b100b7",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x70dea000"
              },
              {
                "name": "ModuleName",
                "value": "ncrypt.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3042
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77b100e5",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x70dea000"
              },
              {
                "name": "ModuleName",
                "value": "ncrypt.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3043
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77b21ea8",
            "parentcaller": "0x77b21e31",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3044
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77b21ea8",
            "parentcaller": "0x77b21e61",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3045
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77af9d5b",
            "parentcaller": "0x77b0b4a0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x70dea000"
              },
              {
                "name": "ModuleName",
                "value": "ncrypt.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3046
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77b1e6ed",
            "parentcaller": "0x77b1e3a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              }
            ],
            "repeated": 0,
            "id": 3047
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77b1e6f5",
            "parentcaller": "0x77b1e3a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e0"
              }
            ],
            "repeated": 0,
            "id": 3048
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x77b10d10",
            "parentcaller": "0x77afe4a3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x70dea000"
              },
              {
                "name": "ModuleName",
                "value": "ncrypt.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3049
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x74d198b1",
            "parentcaller": "0x74d18c82",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\Windows\\SYSTEM32\\ncrypt.dll"
              }
            ],
            "repeated": 0,
            "id": 3050
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x74d198f0",
            "parentcaller": "0x74d18c82",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000005e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ncrypt.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 3051
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x74d19991",
            "parentcaller": "0x74d18c82",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e0"
              }
            ],
            "repeated": 0,
            "id": 3052
          },
          {
            "timestamp": "2026-05-28 22:59:41,066",
            "thread_id": "6324",
            "caller": "0x74d19991",
            "parentcaller": "0x74d18c82",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ncrypt"
              },
              {
                "name": "DllBase",
                "value": "0x70dd0000"
              }
            ],
            "repeated": 0,
            "id": 3053
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x70deb000"
              },
              {
                "name": "ModuleName",
                "value": "ncrypt.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3054
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x70deb000"
              },
              {
                "name": "ModuleName",
                "value": "ncrypt.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3055
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\ncrypt"
              },
              {
                "name": "BaseAddress",
                "value": "0x70dd0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x70dd8730"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3056
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6d1f3000"
              },
              {
                "name": "ModuleName",
                "value": "schannel.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3057
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6d1f3000"
              },
              {
                "name": "ModuleName",
                "value": "schannel.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3058
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x70deb000"
              },
              {
                "name": "ModuleName",
                "value": "ncrypt.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3059
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x70deb000"
              },
              {
                "name": "ModuleName",
                "value": "ncrypt.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3060
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x775c09b0",
            "parentcaller": "0x775c0ab4",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000001d0"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\KsecDD"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390400"
              },
              {
                "name": "InputBuffer",
                "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x02\\x00\\x01\\x00\\x082\\x1fm\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00S\\x00S\\x00L\\x00 \\x00P\\x00r\\x00o\\x00t\\x00o\\x00c\\x00o\\x00l\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x01\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffP\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00r\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffM\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00S\\x00S\\x00L\\x00 \\x00P\\x00r\\x00o\\x00t\\x00o\\x00c\\x00o\\x00l\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00n\\x00c\\x00r\\x00y\\x00p\\x00t\\x00s\\x00s\\x00l\\x00p\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3061
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798a206",
            "parentcaller": "0x70dd62b8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\ncryptsslp"
              },
              {
                "name": "DllBase",
                "value": "0x6d120000"
              }
            ],
            "repeated": 0,
            "id": 3062
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798a206",
            "parentcaller": "0x70dd62b8",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ncryptsslp.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x6d120000"
              }
            ],
            "repeated": 0,
            "id": 3063
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77991b7a",
            "parentcaller": "0x70dd55f3",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ncryptsslp.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6d120000"
              },
              {
                "name": "FunctionName",
                "value": "GetSChannelInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x6d1284e0"
              }
            ],
            "repeated": 0,
            "id": 3064
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x775c09b0",
            "parentcaller": "0x775c0ab4",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000001d0"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\KsecDD"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390400"
              },
              {
                "name": "InputBuffer",
                "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x1c\\xd3\\xb0w0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00S\\x00H\\x00A\\x001\\x00\\x00\\x00\\x00\\x00UG\\xddp"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00A\\x001\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffS\\x00H\\x00A\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3065
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798a206",
            "parentcaller": "0x775c1181",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\bcryptprimitives.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x76ba0000"
              }
            ],
            "repeated": 0,
            "id": 3066
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77991b7a",
            "parentcaller": "0x775c12a6",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76ba0000"
              },
              {
                "name": "FunctionName",
                "value": "GetHashInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76bb5880"
              }
            ],
            "repeated": 1,
            "id": 3067
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x775c09b0",
            "parentcaller": "0x775c0ab4",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000001d0"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\KsecDD"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390400"
              },
              {
                "name": "InputBuffer",
                "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xa6\\x12\\w0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00M\\x00D\\x005\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x005\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffM\\x00D\\x005\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3068
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77991b7a",
            "parentcaller": "0x775c12a6",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76ba0000"
              },
              {
                "name": "FunctionName",
                "value": "GetHashInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76bb5880"
              }
            ],
            "repeated": 1,
            "id": 3069
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x775c09b0",
            "parentcaller": "0x775c0ab4",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000001d0"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\KsecDD"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390400"
              },
              {
                "name": "InputBuffer",
                "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xf7M\\x19m0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00A\\x00E\\x00S\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00S\\x00\\x00\\x00\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffA\\x00E\\x00S\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x00\\x00\\x00\\x00\\x00\\x00\\x00K\\x00e\\x00y\\x00L\\x00e\\x00n\\x00g\\x00t\\x00h\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00"
              }
            ],
            "repeated": 0,
            "id": 3070
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77991b7a",
            "parentcaller": "0x775c12a6",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76ba0000"
              },
              {
                "name": "FunctionName",
                "value": "GetCipherInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76bca8d0"
              }
            ],
            "repeated": 0,
            "id": 3071
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x6d125d74",
            "parentcaller": "0x70dd3f73",
            "category": "crypto",
            "api": "BCryptImportKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyBlob",
                "value": "0\\x02\\x00\\x00KSSM\\x02\\x00\\x01\\x00\\x05\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x01\\x00\\x00 \\x00\\x00\\x00\\x0c:\\x93\\xba\\xe5\\xddz\\x9d\\x0f\\x95G\\xd8q\\xa8\\x8c\\x15\\x96S\\x82\\x94\\xb0\\x8d/\\xea\\xee\\xe1\\xec\\xb6\\xa98\\x1f\\xdc\\x00\\x00\\x00\\x00\\x0c:\\x93\\xba\\xe5\\xddz\\x9d\\x0f\\x95G\\xd8q\\xa8\\x8c\\x15\\x96S\\x82\\x94\\xb0\\x8d/\\xea\\xee\\xe1\\xec\\xb6\\xa98\\x1f\\xdc\n\\xfa\\x15i\\xef'o\\xf4\\xe0\\xb2(,\\x91\\x1a\\xa49\\x17\\xf1\\xcb\\x86\\xa7|\\xe4lI\\x9d\\x08\\xda\\xe0\\xa5\\x17\\x06\\x0e\nz\\x88\\xe1-\\x15|\\x01\\x9f=P\\x90\\x85\\x99iwf%\\x7f\\xd0\\x1a\\xc1\\x13\\x99\\x87\\xc9\\xc9y\"\\xde\\xcf\\x99\\x17\\xf0>x:\\xe5By\\xa5\\xd8\\x12\\xe9 A{i\\xd1\\xa6^\\xb9\\xcbgM L\\xae\\x84YnpK\\x0eFC\\xf5v|\\xa6\\xb7\\x0f\\xd9~\\xa5\\xe6\\xf9?\\xde\\xe7H\\xd3C^\\x83\\xb4\\x0e~\\xcf\\x1a\\x8a'\\xa1j\\xc1,D;9Z8\\x9d\\x8eU\\xe1\\xe3+\\xb3\\x18\\xdc\\xf5\\x8a\\xe5U\\xa5\\xd4f\\xe1\\xab\\xaa\\xa9\\xfb!\\x8d\\x08\\x91\\xe0"
              },
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "CryptKey",
                "value": "0x0313ba30"
              },
              {
                "name": "Length",
                "value": "560"
              }
            ],
            "repeated": 0,
            "id": 3072
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0313d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3073
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x6d125d74",
            "parentcaller": "0x70dd3f73",
            "category": "crypto",
            "api": "BCryptImportKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyBlob",
                "value": "0\\x02\\x00\\x00KSSM\\x02\\x00\\x01\\x00\\x05\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x01\\x00\\x00 \\x00\\x00\\x00SD\\x1b\\x15+s\\xc2\\x05\\xfc\\x8a,F\\x1c\\xf9G\\xe3\\xff\\x1c\\xc3xvAc\\xccIS\\xb3\\x0fr5%\\x90\\x00\\x00\\x00\\x00SD\\x1b\\x15+s\\xc2\\x05\\xfc\\x8a,F\\x1c\\xf9G\\xe3\\xff\\x1c\\xc3xvAc\\xccIS\\xb3\\x0fr5%\\x90\\xc4{{U\\xef\\x08\\xb9P\\x13\\x82\\x95\\x16\\x0f{\\xd2\\xf5\\x89=v\\x9e\\xff|\\x15R\\xb6/\\xa6]\\xc4\\x1a\\x83\\xcdd\\x97\\xc6I\\x8b\\x9f\\x7f\\x19\\x98\\x1d\\xea\\x0f\\x97f8\\xfa\\x01\\x0eq\\xb3\\xferd\\xe1H]\\xc2\\xbc\\x8cGAq\\xc0\\x14e-K\\x8b\\x1a4\\xd3\\x96\\xf0;D\\xf0\\xc8\\xc1\\x1a\\x82\\x99\\xcb\\xe4\\xf0\\xfd*\\xac\\xad?\\x96 \\xea~\\xe7O\\xe7\\xf1\\x9a\\x04l\\xeb\\xae\\xd7\\xfa\\x1b\\x95\\x93\n\\xd3T\\xc6\\xe5\\xff\\xeb\"\\x15\\x02\\xc1\\x8e\\xb8=W\\xaeRC\\xb0_\\xfd\\x16~[\\x91\\xfd\\xd0\\x8ck\\xe6E\\x1fa5\\x11\\x06\nii$\\x1fk\\xa8\\xaa\\xa7V\\xff\\x04\\xf5\\x15O"
              },
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "CryptKey",
                "value": "0x0313c730"
              },
              {
                "name": "Length",
                "value": "560"
              }
            ],
            "repeated": 0,
            "id": 3074
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6d1f3000"
              },
              {
                "name": "ModuleName",
                "value": "schannel.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3075
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6d1f3000"
              },
              {
                "name": "ModuleName",
                "value": "schannel.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3076
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff6118",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x05\\xe90\\x82\\x03\\xd1\\xa0\\x03\\x02\\x01\\x02\\x02\\x133\\x00\\x00\\x04\\x13\\xa6]\\x07\\xe7AEk\\xff\\x00\\x00\\x00\\x00\\x04\\x130\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000~1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft Secure Server CA 20110\\x1e\\x17\r251023205606Z\\x17\r261017205606Z0x1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x0b0\t\\x06\\x03U\\x04\\x08\\x13\\x02WA1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3077
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff6118",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x06\\xd80\\x82\\x04\\xc0\\xa0\\x03\\x02\\x01\\x02\\x02\na?\\xb7\\x18\\x00\\x00\\x00\\x00\\x00\\x040\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1200\\x06\\x03U\\x04\\x03\\x13)Microsoft Root Certificate Authority 20110\\x1e\\x17\r111018225519Z\\x17\r261018230519Z0~1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3078
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797e94b",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3079
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000604"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Cryptography\\OID"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID"
              }
            ],
            "repeated": 0,
            "id": 3080
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000608"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000604"
              },
              {
                "name": "ObjectAttributesName",
                "value": "EncodingType 0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0"
              }
            ],
            "repeated": 0,
            "id": 3081
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000060c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000608"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CryptDllFindOIDInfo"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo"
              }
            ],
            "repeated": 0,
            "id": 3082
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797cdae",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000060c"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3083
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000060c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "1.3.6.1.4.1.311.64.1.1!7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7"
              }
            ],
            "repeated": 0,
            "id": 3084
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7796b853",
            "parentcaller": "0x779ce66a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000610"
              },
              {
                "name": "KeyInformation",
                "value": "\\xff8b1p'\\xffdf\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00N\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 3085
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000610"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3086
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797e94b",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3087
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000614"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7"
              }
            ],
            "repeated": 0,
            "id": 3088
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000614"
              },
              {
                "name": "ValueName",
                "value": "Name"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "@%SystemRoot%\\system32\\dnsapi.dll,-103"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name"
              }
            ],
            "repeated": 0,
            "id": 3089
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77992972",
            "parentcaller": "0x779925fa",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000618"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings"
              }
            ],
            "repeated": 0,
            "id": 3090
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779929b2",
            "parentcaller": "0x779925fa",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000618"
              },
              {
                "name": "ValueName",
                "value": "StringCacheGeneration"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration"
              }
            ],
            "repeated": 0,
            "id": 3091
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779929e0",
            "parentcaller": "0x779925fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000618"
              }
            ],
            "repeated": 0,
            "id": 3092
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b13909",
            "parentcaller": "0x77aed7a4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xe6\\x9e\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00zP\\xb0w\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00P\\xeb\\x9e\\x06\\x00\\x00\\x00\\x003\\x00\\x00\\x00\\x1a\\xf6\\xff\\xff\\x00\\x00\\x00\\x00%\\x00\\x00\\x00\\x02\\x00\\x00\\x02\\x00\\x81\\xf6\\x04"
              }
            ],
            "repeated": 0,
            "id": 3093
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77aed7d7",
            "parentcaller": "0x7798ee2f",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000618"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 3094
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798edea",
            "parentcaller": "0x7799204b",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000061c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0002001f",
                "pretty_value": "KEY_READ|KEY_WRITE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000618"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E"
              }
            ],
            "repeated": 0,
            "id": 3095
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798ee1d",
            "parentcaller": "0x7799204b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000618"
              }
            ],
            "repeated": 0,
            "id": 3096
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798c899",
            "parentcaller": "0x779926ef",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\dnsapi.dll"
              }
            ],
            "repeated": 0,
            "id": 3097
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798f01c",
            "parentcaller": "0x77991ef7",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000061c"
              },
              {
                "name": "ValueName",
                "value": "@%SystemRoot%\\system32\\dnsapi.dll,-103"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Domain Name System (DNS) Server Trust"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103"
              }
            ],
            "repeated": 0,
            "id": 3098
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779926df",
            "parentcaller": "0x77993069",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000061c"
              }
            ],
            "repeated": 0,
            "id": 3099
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000614"
              },
              {
                "name": "ValueName",
                "value": "Name"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "@%SystemRoot%\\system32\\dnsapi.dll,-103"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name"
              }
            ],
            "repeated": 0,
            "id": 3100
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77992972",
            "parentcaller": "0x779925fa",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000061c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings"
              }
            ],
            "repeated": 0,
            "id": 3101
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779929b2",
            "parentcaller": "0x779925fa",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000061c"
              },
              {
                "name": "ValueName",
                "value": "StringCacheGeneration"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration"
              }
            ],
            "repeated": 0,
            "id": 3102
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779929e0",
            "parentcaller": "0x779925fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000061c"
              }
            ],
            "repeated": 0,
            "id": 3103
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b13909",
            "parentcaller": "0x77aed7a4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xe6\\x9e\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00zP\\xb0w\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00P\\xeb\\x9e\\x06\\x00\\x00\\x00\\x003\\x00\\x00\\x00\\x1a\\xf6\\xff\\xff\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x02\\x00\\x00\\x02\\x00\\x81\\xf6\\x04"
              }
            ],
            "repeated": 0,
            "id": 3104
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77aed7d7",
            "parentcaller": "0x7798ee2f",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000061c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 3105
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798edea",
            "parentcaller": "0x7799204b",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000618"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0002001f",
                "pretty_value": "KEY_READ|KEY_WRITE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000061c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E"
              }
            ],
            "repeated": 0,
            "id": 3106
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798ee1d",
            "parentcaller": "0x7799204b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000061c"
              }
            ],
            "repeated": 0,
            "id": 3107
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798c899",
            "parentcaller": "0x779926ef",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\dnsapi.dll"
              }
            ],
            "repeated": 0,
            "id": 3108
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798f01c",
            "parentcaller": "0x77991ef7",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000618"
              },
              {
                "name": "ValueName",
                "value": "@%SystemRoot%\\system32\\dnsapi.dll,-103"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Domain Name System (DNS) Server Trust"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103"
              }
            ],
            "repeated": 0,
            "id": 3109
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779926df",
            "parentcaller": "0x77993069",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000618"
              }
            ],
            "repeated": 0,
            "id": 3110
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8148",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000614"
              }
            ],
            "repeated": 0,
            "id": 3111
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff151c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000610"
              }
            ],
            "repeated": 0,
            "id": 3112
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797cdae",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000060c"
              },
              {
                "name": "Index",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3113
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000060c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "1.3.6.1.4.1.311.80.1!7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7"
              }
            ],
            "repeated": 0,
            "id": 3114
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7796b853",
            "parentcaller": "0x779ce66a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000610"
              },
              {
                "name": "KeyInformation",
                "value": "\\xff8b1p'\\xffdf\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xff84\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 3115
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000610"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3116
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797e94b",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3117
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000614"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7"
              }
            ],
            "repeated": 0,
            "id": 3118
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000614"
              },
              {
                "name": "ValueName",
                "value": "Name"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\\Name"
              }
            ],
            "repeated": 0,
            "id": 3119
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77992972",
            "parentcaller": "0x779925fa",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000618"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings"
              }
            ],
            "repeated": 0,
            "id": 3120
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779929b2",
            "parentcaller": "0x779925fa",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000618"
              },
              {
                "name": "ValueName",
                "value": "StringCacheGeneration"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration"
              }
            ],
            "repeated": 0,
            "id": 3121
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779929e0",
            "parentcaller": "0x779925fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000618"
              }
            ],
            "repeated": 0,
            "id": 3122
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b13909",
            "parentcaller": "0x77aed7a4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xe6\\x9e\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00zP\\xb0w\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00P\\xeb\\x9e\\x06\\x00\\x00\\x00\\x003\\x00\\x00\\x00\\x1a\\xf6\\xff\\xff\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x02\\x00\\x00\\x02\\x00\\x81\\xf6\\x04"
              }
            ],
            "repeated": 0,
            "id": 3123
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77aed7d7",
            "parentcaller": "0x7798ee2f",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000618"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 3124
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798edea",
            "parentcaller": "0x7799204b",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000061c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0002001f",
                "pretty_value": "KEY_READ|KEY_WRITE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000618"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E"
              }
            ],
            "repeated": 0,
            "id": 3125
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798ee1d",
            "parentcaller": "0x7799204b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000618"
              }
            ],
            "repeated": 0,
            "id": 3126
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798c899",
            "parentcaller": "0x779926ef",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
              }
            ],
            "repeated": 0,
            "id": 3127
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798f01c",
            "parentcaller": "0x77991ef7",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000061c"
              },
              {
                "name": "ValueName",
                "value": "@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Document Encryption"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124"
              }
            ],
            "repeated": 0,
            "id": 3128
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779926df",
            "parentcaller": "0x77993069",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000061c"
              }
            ],
            "repeated": 0,
            "id": 3129
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000614"
              },
              {
                "name": "ValueName",
                "value": "Name"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\\Name"
              }
            ],
            "repeated": 0,
            "id": 3130
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77992972",
            "parentcaller": "0x779925fa",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000061c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings"
              }
            ],
            "repeated": 0,
            "id": 3131
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779929b2",
            "parentcaller": "0x779925fa",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000061c"
              },
              {
                "name": "ValueName",
                "value": "StringCacheGeneration"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration"
              }
            ],
            "repeated": 0,
            "id": 3132
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779929e0",
            "parentcaller": "0x779925fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000061c"
              }
            ],
            "repeated": 0,
            "id": 3133
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b13909",
            "parentcaller": "0x77aed7a4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xe6\\x9e\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00zP\\xb0w\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00P\\xeb\\x9e\\x06\\x00\\x00\\x00\\x003\\x00\\x00\\x00\\x1c\\xf9\\xff\\xff\\x00\\x00\\x00\\x00\\xa9\\x00\\x00\\x00\\x02\\x00\\x00\\x02\\x00\\x81\\xf6\\x04"
              }
            ],
            "repeated": 0,
            "id": 3134
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77aed7d7",
            "parentcaller": "0x7798ee2f",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000061c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 3135
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798edea",
            "parentcaller": "0x7799204b",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000618"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0002001f",
                "pretty_value": "KEY_READ|KEY_WRITE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000061c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E"
              }
            ],
            "repeated": 0,
            "id": 3136
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798ee1d",
            "parentcaller": "0x7799204b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000061c"
              }
            ],
            "repeated": 0,
            "id": 3137
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798c899",
            "parentcaller": "0x779926ef",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
              }
            ],
            "repeated": 0,
            "id": 3138
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798f01c",
            "parentcaller": "0x77991ef7",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000618"
              },
              {
                "name": "ValueName",
                "value": "@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Document Encryption"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124"
              }
            ],
            "repeated": 0,
            "id": 3139
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779926df",
            "parentcaller": "0x77993069",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000618"
              }
            ],
            "repeated": 0,
            "id": 3140
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8148",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000614"
              }
            ],
            "repeated": 0,
            "id": 3141
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff151c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000610"
              }
            ],
            "repeated": 0,
            "id": 3142
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797cdae",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000060c"
              },
              {
                "name": "Index",
                "value": "2"
              }
            ],
            "repeated": 0,
            "id": 3143
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff15b2",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000060c"
              }
            ],
            "repeated": 0,
            "id": 3144
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff13ba",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000608"
              }
            ],
            "repeated": 0,
            "id": 3145
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff13cb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000604"
              }
            ],
            "repeated": 0,
            "id": 3146
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3147
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000604"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SYSTEM\\CurrentControlSet\\Control\\Cryptography\\ECCParameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Cryptography\\ECCParameters"
              }
            ],
            "repeated": 0,
            "id": 3148
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797e6db",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000604"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3149
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8148",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000604"
              }
            ],
            "repeated": 0,
            "id": 3150
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0313e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3151
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03141000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3152
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03144000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3153
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b11f80",
            "parentcaller": "0x77af8db8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 3154
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77af931b",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\CRYPT32.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 3155
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77af931b",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000604"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\sysnative\\en-US\\CRYPT32.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 3156
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77af97cc",
            "parentcaller": "0x77af92ae",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000608"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000604"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\sysnative\\en-US\\crypt32.dll.mui"
              }
            ],
            "repeated": 0,
            "id": 3157
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77af97f4",
            "parentcaller": "0x77af92ae",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000608"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06b80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x069ee520"
              },
              {
                "name": "ViewSize",
                "value": "0x0000a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3158
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77af9804",
            "parentcaller": "0x77af92ae",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000608"
              }
            ],
            "repeated": 0,
            "id": 3159
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x770b3000"
              },
              {
                "name": "ModuleName",
                "value": "CRYPT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3160
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x770b3000"
              },
              {
                "name": "ModuleName",
                "value": "CRYPT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3161
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x775c09b0",
            "parentcaller": "0x775c0ab4",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000001d0"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\KsecDD"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390400"
              },
              {
                "name": "InputBuffer",
                "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00S\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00m\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00A\\x002\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffS\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3162
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77991b7a",
            "parentcaller": "0x775c12a6",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76ba0000"
              },
              {
                "name": "FunctionName",
                "value": "GetHashInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76bb5880"
              }
            ],
            "repeated": 0,
            "id": 3163
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff6118",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x05\\xe90\\x82\\x03\\xd1\\xa0\\x03\\x02\\x01\\x02\\x02\\x133\\x00\\x00\\x04\\x13\\xa6]\\x07\\xe7AEk\\xff\\x00\\x00\\x00\\x00\\x04\\x130\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000~1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft Secure Server CA 20110\\x1e\\x17\r251023205606Z\\x17\r261017205606Z0x1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x0b0\t\\x06\\x03U\\x04\\x08\\x13\\x02WA1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3164
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff6118",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x06\\xd80\\x82\\x04\\xc0\\xa0\\x03\\x02\\x01\\x02\\x02\na?\\xb7\\x18\\x00\\x00\\x00\\x00\\x00\\x040\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1200\\x06\\x03U\\x04\\x03\\x13)Microsoft Root Certificate Authority 20110\\x1e\\x17\r111018225519Z\\x17\r261018230519Z0~1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3165
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03146000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3166
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69bee000"
              },
              {
                "name": "ModuleName",
                "value": "webio.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3167
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69bee000"
              },
              {
                "name": "ModuleName",
                "value": "webio.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3168
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3169
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000060c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SYSTEM\\CurrentControlSet\\Services\\crypt32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\crypt32"
              }
            ],
            "repeated": 0,
            "id": 3170
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000060c"
              },
              {
                "name": "ValueName",
                "value": "DiagLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagLevel"
              }
            ],
            "repeated": 0,
            "id": 3171
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000060c"
              },
              {
                "name": "ValueName",
                "value": "DiagMatchAnyMask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagMatchAnyMask"
              }
            ],
            "repeated": 0,
            "id": 3172
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x7700722e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000060c"
              }
            ],
            "repeated": 0,
            "id": 3173
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3174
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000060c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SYSTEM\\CurrentControlSet\\Services\\crypt32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\crypt32"
              }
            ],
            "repeated": 0,
            "id": 3175
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x770b3000"
              },
              {
                "name": "ModuleName",
                "value": "CRYPT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3176
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x770b3000"
              },
              {
                "name": "ModuleName",
                "value": "CRYPT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3177
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b2c23d",
            "parentcaller": "0x77b2c181",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3178
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b2c245",
            "parentcaller": "0x77b2c181",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000630"
              }
            ],
            "repeated": 0,
            "id": 3179
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77989e76",
            "parentcaller": "0x76fe85fb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3180
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798ab1a",
            "parentcaller": "0x76fe8618",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000630"
              }
            ],
            "repeated": 0,
            "id": 3181
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3182
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config"
              }
            ],
            "repeated": 0,
            "id": 3183
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "ValueName",
                "value": "DisableSerialChain"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableSerialChain"
              }
            ],
            "repeated": 0,
            "id": 3184
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe492e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000630"
              }
            ],
            "repeated": 0,
            "id": 3185
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x76fe8798",
            "parentcaller": "0x76fe8278",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3186
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3187
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config"
              }
            ],
            "repeated": 0,
            "id": 3188
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "ValueName",
                "value": "CryptnetPreFetchTriggerPeriodSeconds"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetPreFetchTriggerPeriodSeconds"
              }
            ],
            "repeated": 0,
            "id": 3189
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "ValueName",
                "value": "MaxUrlRetrievalByteCount"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxUrlRetrievalByteCount"
              }
            ],
            "repeated": 0,
            "id": 3190
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3191
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 3192
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "ValueName",
                "value": "DisallowedCertSyncDeltaTime"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\DisallowedCertSyncDeltaTime"
              }
            ],
            "repeated": 0,
            "id": 3193
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8148",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3194
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797e94b",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3195
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Cryptography\\OID"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID"
              }
            ],
            "repeated": 0,
            "id": 3196
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797cdae",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3197
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000638"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000634"
              },
              {
                "name": "ObjectAttributesName",
                "value": "EncodingType 0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0"
              }
            ],
            "repeated": 0,
            "id": 3198
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "7420",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3199
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000063c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000638"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CertDllOpenStoreProv"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv"
              }
            ],
            "repeated": 0,
            "id": 3200
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797cdae",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000063c"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3201
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000640"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000063c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "#16"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv\\#16"
              }
            ],
            "repeated": 0,
            "id": 3202
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7796b853",
            "parentcaller": "0x779ce66a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000640"
              },
              {
                "name": "KeyInformation",
                "value": "[\\xff86\\xfff1\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00B\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 3203
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000640"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3204
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000640"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3205
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff151c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000640"
              }
            ],
            "repeated": 0,
            "id": 3206
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797cdae",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000063c"
              },
              {
                "name": "Index",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3207
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000640"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000063c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Ldap"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv\\Ldap"
              }
            ],
            "repeated": 0,
            "id": 3208
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7796b853",
            "parentcaller": "0x779ce66a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000640"
              },
              {
                "name": "KeyInformation",
                "value": "[\\xff86\\xfff1\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00B\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 3209
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000640"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3210
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000640"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3211
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff151c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000640"
              }
            ],
            "repeated": 0,
            "id": 3212
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797cdae",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000063c"
              },
              {
                "name": "Index",
                "value": "2"
              }
            ],
            "repeated": 0,
            "id": 3213
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff15b2",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000063c"
              }
            ],
            "repeated": 0,
            "id": 3214
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff13ba",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000638"
              }
            ],
            "repeated": 0,
            "id": 3215
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797cdae",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "Index",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3216
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000638"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000634"
              },
              {
                "name": "ObjectAttributesName",
                "value": "EncodingType 1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1"
              }
            ],
            "repeated": 0,
            "id": 3217
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000638"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CertDllOpenStoreProv"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CertDllOpenStoreProv"
              }
            ],
            "repeated": 0,
            "id": 3218
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff13ba",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000638"
              }
            ],
            "repeated": 0,
            "id": 3219
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797cdae",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "Index",
                "value": "2"
              }
            ],
            "repeated": 0,
            "id": 3220
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff13cb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3221
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0314a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3222
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3223
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\SystemCertificates\\Root\\PhysicalStores"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\Root\\PhysicalStores"
              }
            ],
            "repeated": 0,
            "id": 3224
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3225
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\SystemCertificates\\Root"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\Root"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 3226
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ffa507",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3227
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3228
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots"
              }
            ],
            "repeated": 0,
            "id": 3229
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7700eaa3",
            "parentcaller": "0x76ffaaeb",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "103"
              }
            ],
            "repeated": 1,
            "id": 3230
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3231
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\SystemCertificates\\Root"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\Root"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 3232
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000638"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000634"
              },
              {
                "name": "ObjectAttributesName",
                "value": ""
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\"
              }
            ],
            "repeated": 0,
            "id": 3233
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ffb7f0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3234
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3235
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 3236
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000063c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000634"
              },
              {
                "name": "ObjectAttributesName",
                "value": ""
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\"
              }
            ],
            "repeated": 0,
            "id": 3237
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ffb7f0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3238
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3239
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\EnterpriseCertificates\\Root\\PhysicalStores"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\Root\\PhysicalStores"
              }
            ],
            "repeated": 0,
            "id": 3240
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3241
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\EnterpriseCertificates\\Root"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\Root"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 3242
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ffa507",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3243
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3244
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\EnterpriseCertificates\\Root"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\Root"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 3245
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000640"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000634"
              },
              {
                "name": "ObjectAttributesName",
                "value": ""
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\"
              }
            ],
            "repeated": 0,
            "id": 3246
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ffb7f0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3247
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3248
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\SystemCertificates\\SmartCardRoot"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\SmartCardRoot"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 3249
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ffb7f0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3250
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3251
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\SystemCertificates\\SmartCardRoot"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\SmartCardRoot"
              }
            ],
            "repeated": 0,
            "id": 3252
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ffb7f0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3253
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3254
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\SystemCertificates\\CA\\PhysicalStores"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\CA\\PhysicalStores"
              }
            ],
            "repeated": 0,
            "id": 3255
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3256
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\SystemCertificates\\CA"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\CA"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 3257
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ffa507",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3258
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3259
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\SystemCertificates\\CA"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\CA"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 3260
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000644"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000634"
              },
              {
                "name": "ObjectAttributesName",
                "value": ""
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\"
              }
            ],
            "repeated": 0,
            "id": 3261
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ffb7f0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3262
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3263
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\EnterpriseCertificates\\CA\\PhysicalStores"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\CA\\PhysicalStores"
              }
            ],
            "repeated": 0,
            "id": 3264
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3265
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\EnterpriseCertificates\\CA"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\CA"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 3266
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ffa507",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3267
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3268
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\EnterpriseCertificates\\CA"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\CA"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 3269
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000648"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000634"
              },
              {
                "name": "ObjectAttributesName",
                "value": ""
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\"
              }
            ],
            "repeated": 0,
            "id": 3270
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ffb7f0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3271
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "ValueName",
                "value": "AutoFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlags"
              }
            ],
            "repeated": 0,
            "id": 3272
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0314d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3273
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "ValueName",
                "value": "DisableAutoFlushProcessNameList"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableAutoFlushProcessNameList"
              }
            ],
            "repeated": 0,
            "id": 3274
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "ValueName",
                "value": "AutoFlushFirstDeltaSeconds"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushFirstDeltaSeconds"
              }
            ],
            "repeated": 0,
            "id": 3275
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "ValueName",
                "value": "AutoFlushNextDeltaSeconds"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushNextDeltaSeconds"
              }
            ],
            "repeated": 0,
            "id": 3276
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8bcc",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000630"
              }
            ],
            "repeated": 0,
            "id": 3277
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000638"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 3278
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "ValueName",
                "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              }
            ],
            "repeated": 0,
            "id": 3279
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000630"
              },
              {
                "name": "ObjectAttributesName",
                "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              }
            ],
            "repeated": 0,
            "id": 3280
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000630"
              }
            ],
            "repeated": 0,
            "id": 3281
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000063c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 3282
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "ValueName",
                "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              }
            ],
            "repeated": 0,
            "id": 3283
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000630"
              },
              {
                "name": "ObjectAttributesName",
                "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              }
            ],
            "repeated": 0,
            "id": 3284
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000630"
              }
            ],
            "repeated": 0,
            "id": 3285
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3286
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\SystemCertificates\\Root"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 3287
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000630"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 3288
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "ValueName",
                "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              }
            ],
            "repeated": 0,
            "id": 3289
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000634"
              },
              {
                "name": "ObjectAttributesName",
                "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              }
            ],
            "repeated": 0,
            "id": 3290
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3291
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8148",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000630"
              }
            ],
            "repeated": 0,
            "id": 3292
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000640"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 3293
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "ValueName",
                "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              }
            ],
            "repeated": 0,
            "id": 3294
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000630"
              },
              {
                "name": "ObjectAttributesName",
                "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              }
            ],
            "repeated": 0,
            "id": 3295
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000630"
              }
            ],
            "repeated": 0,
            "id": 3296
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000644"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 3297
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "ValueName",
                "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              }
            ],
            "repeated": 0,
            "id": 3298
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000630"
              },
              {
                "name": "ObjectAttributesName",
                "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              }
            ],
            "repeated": 0,
            "id": 3299
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000630"
              }
            ],
            "repeated": 0,
            "id": 3300
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3301
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\SystemCertificates\\CA"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\CA"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 3302
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000630"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 3303
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "ValueName",
                "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              }
            ],
            "repeated": 0,
            "id": 3304
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000634"
              },
              {
                "name": "ObjectAttributesName",
                "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              }
            ],
            "repeated": 0,
            "id": 3305
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3306
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8148",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000630"
              }
            ],
            "repeated": 0,
            "id": 3307
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000648"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 3308
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "ValueName",
                "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              }
            ],
            "repeated": 0,
            "id": 3309
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000630"
              },
              {
                "name": "ObjectAttributesName",
                "value": "83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"
              }
            ],
            "repeated": 0,
            "id": 3310
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000630"
              }
            ],
            "repeated": 0,
            "id": 3311
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000638"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 3312
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "ValueName",
                "value": "8F43288AD272F3103B6FB1428485EA3014C0BCFE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE"
              }
            ],
            "repeated": 0,
            "id": 3313
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000630"
              },
              {
                "name": "ObjectAttributesName",
                "value": "8F43288AD272F3103B6FB1428485EA3014C0BCFE"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE"
              }
            ],
            "repeated": 0,
            "id": 3314
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "ValueName",
                "value": "Blob"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob"
              }
            ],
            "repeated": 1,
            "id": 3315
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cecbb",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "ValueName",
                "value": "Blob"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00'\\x9c\\xd6R\\xc4\\xe2R\\xbf\\xbeR\\x17\\xacr\"\\x05\\xd7r\\x9b\\xa4\t\\x14\\x8c\\xfa\\x9em\\x9e[\\x1c\\xb9N\\xaf\\xf1\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x00T\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00R\\x00o\\x00o\\x00t\\x00 \\x00C\\x00e\\x00r\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00e\\x00 \\x00A\\x00u\\x00t\\x00h\\x00o\\x00r\\x00i\\x00t\\x00y\\x00 \\x002\\x000\\x001\\x001\\x00\\x00\\x00i\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0e\\x00\\x00\\x000\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x03\\x02\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x8fC(\\x8a\\xd2r\\xf3\\x10;o\\xb1B\\x84\\x85\\xea0\\x14\\xc0\\xbc\\xfe\\x14\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00r-:\\x021\\x90C\\xb9\\x14\\x05N\\xe1\\xea\\xa7\\xc71\\xd1#\\x894\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xce\\x04\\x90\\xd5\\xe5l4\\xa5\\xae\\x0b\\xe9\\x8b\\xe5\\x81\\x18] \\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xf1\\x05\\x00\\x000\\x82\\x05\\xed0\\x82\\x03\\xd5\\xa0\\x03\\x02\\x01\\x02\\x02\\x10?\\x8b\\xc8\\xb5\\xfc\\x9f\\xb2\\x96C\\xb5i\\xd6lB\\xe1D0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1200\\x06\\x03U\\x04\\x03\\x13)Microsoft Root Certificate Authority 20110\\x1e\\x17\r110322220"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob"
              }
            ],
            "repeated": 0,
            "id": 3316
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff2a67",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3317
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000630"
              }
            ],
            "repeated": 0,
            "id": 3318
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff69bd",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x05\\xed0\\x82\\x03\\xd5\\xa0\\x03\\x02\\x01\\x02\\x02\\x10?\\x8b\\xc8\\xb5\\xfc\\x9f\\xb2\\x96C\\xb5i\\xd6lB\\xe1D0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1200\\x06\\x03U\\x04\\x03\\x13)Microsoft Root Certificate Authority 20110\\x1e\\x17\r110322220528Z\\x17\r360322221304Z0\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x10"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3319
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797e94b",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3320
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Cryptography\\OID"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID"
              }
            ],
            "repeated": 0,
            "id": 3321
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797cdae",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3322
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000630"
              },
              {
                "name": "ObjectAttributesName",
                "value": "EncodingType 0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0"
              }
            ],
            "repeated": 0,
            "id": 3323
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000634"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CertDllVerifyCertificateChainPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllVerifyCertificateChainPolicy"
              }
            ],
            "repeated": 0,
            "id": 3324
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff13ba",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3325
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797cdae",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "Index",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3326
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000630"
              },
              {
                "name": "ObjectAttributesName",
                "value": "EncodingType 1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1"
              }
            ],
            "repeated": 0,
            "id": 3327
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797e99b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000634"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CertDllVerifyCertificateChainPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CertDllVerifyCertificateChainPolicy"
              }
            ],
            "repeated": 0,
            "id": 3328
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff13ba",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000634"
              }
            ],
            "repeated": 0,
            "id": 3329
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797cdae",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "Index",
                "value": "2"
              }
            ],
            "repeated": 0,
            "id": 3330
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff13cb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000630"
              }
            ],
            "repeated": 0,
            "id": 3331
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x76fe9148",
            "parentcaller": "0x76fe90fd",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0!\\x82\\x1fsettings-win.data.microsoft.com"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3332
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3333
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config"
              }
            ],
            "repeated": 0,
            "id": 3334
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3335
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot"
              }
            ],
            "repeated": 0,
            "id": 3336
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3337
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots"
              }
            ],
            "repeated": 0,
            "id": 3338
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3339
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot"
              }
            ],
            "repeated": 0,
            "id": 3340
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3341
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000650"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 3342
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "ValueName",
                "value": "PinRulesLogDir"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRulesLogDir"
              }
            ],
            "repeated": 0,
            "id": 3343
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000630"
              },
              {
                "name": "ValueName",
                "value": "PinRules"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRules"
              }
            ],
            "repeated": 0,
            "id": 3344
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3345
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000065c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 3346
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000065c"
              },
              {
                "name": "ValueName",
                "value": "PinRulesLastSyncTime"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "?\\xc2x|\\xb6\\xee\\xdc\\x01"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesLastSyncTime"
              }
            ],
            "repeated": 0,
            "id": 3347
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x76fe80d7",
            "parentcaller": "0x76fe8043",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3348
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8148",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000065c"
              }
            ],
            "repeated": 0,
            "id": 3349
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b2c23d",
            "parentcaller": "0x77b2c181",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000660"
              }
            ],
            "repeated": 0,
            "id": 3350
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b2c245",
            "parentcaller": "0x77b2c181",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000065c"
              }
            ],
            "repeated": 0,
            "id": 3351
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77989e76",
            "parentcaller": "0x76fe8665",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3352
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798ab1a",
            "parentcaller": "0x76fe867d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000065c"
              }
            ],
            "repeated": 0,
            "id": 3353
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798c134",
            "parentcaller": "0x770086e5",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000065c"
              }
            ],
            "repeated": 0,
            "id": 3354
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77989e76",
            "parentcaller": "0x770089b9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x80\\xef\\x9e\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x91\\x85o\\xab4\\xc1\\x98w\\x00\\x00\\x00\\x00\\xe5\\x86\\x00w-\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x9f\\x06\\x00\\x00\\x00\\x00\\xa0\\xef\\x9e\\x06\\x1f\\xddkk\\xa0\\xfb\\x9e\\x064\\xc1\\x98w\\xc8K\\x8dk\\xe5\\x86\\x00w\\x18\\xf0\\x9e\\x06\\x96\\xe3kk\\xf0\\xf5\\x8ak\\x8c\\xae\\x93kT\\xfa\\xf6\\x04\\xc8K\\x8dkE\\x9ao\\xabL\\xeb\\x9e\\x06\\xec\\xa8ik\\xa0\\xfb\\x9e\\x06\\xa0\\xe6\\x80ka\\xcb}\\xc6\\xfe\\xff\\xff\\xffd\\xf0\\x9e\\x06\\x06\\x19mk5\\x00\\x00\\x00\\x04:\\x8bkT_\\x8bk\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00O_\\x8bk\\x0c]\\x8bk\\xff\\xff\\xff\\xffP%\\x8bk\\x08\\x00\\x00\\x00@_\\x8bk\\xa4\\xf0\\x9e\\x06\\x00\\xf3\\xc4\\xf0d\\xf0T\\xf0\\xc8\\xf0\\x00\\x00L\\xf2\\x00\\x00\\x00\\xf3\\x9e\\x06\\xc4\\xf0\\x9e\\x06\\xc8\\xf0\\x9e\\x06\\x00\\x00\\x00\\x00x\\xf0\\x9e\\x064\\xc1\\x98w\\xff\\xff\\xff\\xff\\x08\\x00\\x00\\x00\\xa4\\xf0\\x9e\\x06"
              }
            ],
            "repeated": 0,
            "id": 3355
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798ab1a",
            "parentcaller": "0x7700870c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000065c"
              }
            ],
            "repeated": 0,
            "id": 3356
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3357
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000065c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000049c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 3358
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000065c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 3359
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe81e2",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000065c"
              }
            ],
            "repeated": 0,
            "id": 3360
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3361
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000065c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 3362
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000065c"
              },
              {
                "name": "ValueName",
                "value": "PinRulesEncodedCtl"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl"
              }
            ],
            "repeated": 0,
            "id": 3363
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03150000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3364
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000065c"
              },
              {
                "name": "ValueName",
                "value": "PinRulesEncodedCtl"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl"
              }
            ],
            "repeated": 0,
            "id": 3365
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x779cecbb",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000065c"
              },
              {
                "name": "ValueName",
                "value": "PinRulesEncodedCtl"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "0\\x82E\\x94\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x07\\x02\\xa0\\x82E\\x850\\x82E\\x81\\x02\\x01\\x011\\x0b0\t\\x06\\x05+\\x0e\\x03\\x02\\x1a\\x05\\x000\\x82'\\xee\\x06\t+\\x06\\x01\\x04\\x01\\x827\n\\x01\\xa0\\x82'\\xdf0\\x82'\\xdb0\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03 \\x04,P\\x00i\\x00n\\x00R\\x00u\\x00l\\x00e\\x00s\\x00_\\x00A\\x00u\\x00t\\x00o\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00_\\x001\\x00\\x00\\x00\\x02\\x08\\x01\\xd2\\xdae\\xad\\xdb@7\\x17\r170531232859Z\\x17\r180601232859Z0\\x0e\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03\"\\x05\\x000\\x82\\x1f\\xa30)\\x04\\x12.files-df.1drv.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000&\\x04\\x0f.files.1drv.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x0004\\x04\n.aadrm.com1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x0101\\x04\\x07.afx.ms1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x0105\\x04\\x0b.akadns.net1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x010%\\x04\\x0e.aspnetcdn.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x0008\\x04\\x0e.azure-int.net1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl"
              }
            ],
            "repeated": 0,
            "id": 3366
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x76ff75fe",
            "parentcaller": "0x77000615",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x800\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03 \\x04,P\\x00i\\x00n\\x00R\\x00u\\x00l\\x00e\\x00s\\x00_\\x00A\\x00u\\x00t\\x00o\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00_\\x001\\x00\\x00\\x00\\x02\\x08\\x01\\xd2\\xdae\\xad\\xdb@7\\x17\r170531232859Z\\x17\r180601232859Z0\\x0e\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03\"\\x05\\x00\\x00\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008004"
              }
            ],
            "repeated": 0,
            "id": 3367
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x76ff75fe",
            "parentcaller": "0x770007c2",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x07\\xb80\\x82\\x07\\x95\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03!\\x01\\x01\\xff\\x04\\x82\\x07\\x820\\x82\\x07~0\\x82\\x03\\x1a\\x02\\x01\\x00\\x02\\x01\\x010\\x82\\x03\\x1006\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*"
              },
              {
                "name": "Flags",
                "value": "0x00008004"
              }
            ],
            "repeated": 0,
            "id": 3368
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8148",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000065c"
              }
            ],
            "repeated": 0,
            "id": 3369
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77003ca9",
            "parentcaller": "0x76fe3f13",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x07~0\\x82\\x03\\x1a\\x02\\x01\\x00\\x02\\x01\\x010\\x82\\x03\\x1006\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3370
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000c62",
            "parentcaller": "0x77003d04",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x03\\x1a\\x02\\x01\\x00\\x02\\x01\\x010\\x82\\x03\\x1006\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3371
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000cd7",
            "parentcaller": "0x77003d04",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x03\\x1006\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0\\x92i\\x04 `\\xbd\\xedu\\xc5\\xfd"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3372
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\x0f:\\x05'\\xd2B\\xde-\\xc9\\x8e\\\\xfc\\xb1\\xe9\\x91\\xee\\x04 \\x94\\xa7T\\xd4F\\xd0\\xb9\\xbcr\\x0c9\\xb6\\xabs|)\\xc9Y\\xd8/x6\\xe9\\xb7\\xc5x\\xc6\\xd2\\x99>\\xdd\\xe2\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3373
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3374
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3375
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3376
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0\\x92i\\x04 `\\xbd\\xedu\\xc5\\xfd\\x11\\x90\\x10\\xd6\\x83/v\\xde\\xfc94s\\xd7\\xa0\\xced\\xfb\\xd6\\x8d\\xab\\xa2\\x9b\\xfd\\x0b/|\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3377
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xa8#\\xb4\\xa2\\x01\\x80\\xbe\\xb4`\\xca\\xb9U\\xc2M~!\\x04 =\\xde2\\xff\\xc4p\\x9b\\xb1\\xa3\\xffv\\xd3TA\\xf4\\xae\\x7f\\xe0^\\xe2\\x8a\\xe5\\xd6\\x17\\xa7[\\xd3n\\xeek\\xf5\\xca\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3378
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xa8\\x82z<\\xbd-\\x87\\xd7\\x83\\xb5\\x9b\\x80b\\xc8~\\x9a\\x04 %\\x88%;\\x9aAR$\\x14\\xad\\xc3\\xab\\xa2\\xf0\\xb8\\x17\\xbf;\\xaa\\x0cz\\x0c\\x19diO\\x7f^\\xff\\xc4\\xb9`\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3379
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xadmo\\xf3\\x1b$\\x011Q\\xf2y\\xe2j\\x8c3$\\x04 \\xd61\\xb2F\\x02|\\xa8\\x8e\\x9b\\x03BO#\\x0c\\x9f53R\\xb4\\x9a_\\x9as\\x15Vm\\xc2\\xach\\xd0X\\x16\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3380
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xbaO9r\\xe7\\xae\\xd9\\xdc\\xcd\\xc2\\x10\\xdbY\\xda\\x13\\xc9\\x04 \\xe5\\xd4\\x7f\\x02\\xf2t\\x97\\x81\\xc1\\x84\\xab<\\x0fT\\x9eqk\\xb21BJr\\x1f\\xec;\\xdf\\xa17G\\x9e\\x1e\\x15\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3381
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3382
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xd0\\xfd<\\x9c8\r{e\\xe2k\\x9a?\\xed\\xd3\\x9b\\x8f\\x04 9\\xa4u\\x87\\x0b\\xf2\\xb4\\x8cR\\x03\\xa0\\x8e\\xa5\"y\\xbc\\xe7\\x1a\\xbb\\x8d>7\\xe0k\\x89\\x07\\xa2g\\xec\\xd7\\xdaj\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3383
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xd6`0\\xcd\\xb7\\x92\\x86\\xc9\\xcb\\xee\\x93\\xc1O\\xa3\\x99\\xcc\\x04 E\\xbaB\\xfe\\xb2v\\x9a\\x95c\\xfaQ\\xcc'\\xdd\\x14\\x96\\xef\\xd0\\xe4\\xc5\\xd1\\x96\\x89\\x803\\x17\\x8c\\xc8u\\x8fP\\xca\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3384
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3385
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xfaF\\xce|\\xbb\\x85\\xcf\\xb41\\x00u1:\t\\xee\\x05\\x04 H\\xa0:\\xf5\\x0b\\xc5\\xa1\\xf9q\\xc0\\xc1\\x93\\x8b\n\\xb2\\xd5\\x9bT\\x86\\x9e\\x18\\x01\\xf3x\\x1d^\\x1c\\xd2\\xf7\\xe3\\x93\\x91\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3386
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000c62",
            "parentcaller": "0x77003d04",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "0\\x81\\xb1\\x02\\x01\\x00\\x02\\x01\\x010\\x81\\xa806\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x0006\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3387
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000cd7",
            "parentcaller": "0x77003d04",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "0\\x81\\xa806\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x0006\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3388
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3389
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3390
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3391
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000c62",
            "parentcaller": "0x77003d04",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "0@\\x02\\x01\\x00\\x02\\x01\\x010806\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3392
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000cd7",
            "parentcaller": "0x77003d04",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "0806\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3393
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3394
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000c62",
            "parentcaller": "0x77003d04",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "0@\\x02\\x01\\x00\\x02\\x01\\x010806\\x04\\x10\\x02\\x87v\\xeb\\x1e}\\xaeb\\xa5+\\xd5\n\\xa1[\\x9a]\\x04 \\x05\\xbe\\xf6\\xeb\\xdd\\xa8\\x0f=\\x15\\x07>K\\xde\\x9e\\x9f\\x9d\\xaau\\xf0\\xa5\\xa7p:c\\xaca<\\xf4>\\x14\\x08\\xc4\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3395
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000cd7",
            "parentcaller": "0x77003d04",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "0806\\x04\\x10\\x02\\x87v\\xeb\\x1e}\\xaeb\\xa5+\\xd5\n\\xa1[\\x9a]\\x04 \\x05\\xbe\\xf6\\xeb\\xdd\\xa8\\x0f=\\x15\\x07>K\\xde\\x9e\\x9f\\x9d\\xaau\\xf0\\xa5\\xa7p:c\\xaca<\\xf4>\\x14\\x08\\xc4\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3396
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\x02\\x87v\\xeb\\x1e}\\xaeb\\xa5+\\xd5\n\\xa1[\\x9a]\\x04 \\x05\\xbe\\xf6\\xeb\\xdd\\xa8\\x0f=\\x15\\x07>K\\xde\\x9e\\x9f\\x9d\\xaau\\xf0\\xa5\\xa7p:c\\xaca<\\xf4>\\x14\\x08\\xc4\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3397
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000c62",
            "parentcaller": "0x77003d04",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "0\\x08\\x02\\x01\\x00\\x02\\x01\\x010\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3398
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000cd7",
            "parentcaller": "0x77003d04",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "0\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3399
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000c62",
            "parentcaller": "0x77003d04",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x03\\x1a\\x02\\x01\\x00\\x02\\x01\\x010\\x82\\x03\\x1006\\x04\\x10V\\x8f\\x1c\\xb8\\xa3\t\\xda\\x17\\xf1\\x15\\x02\\xff\n\\xebp\\x80\\x04 \re(Gp#\\xc1o\\xb1\\x1e\\xe6\\xc3ZRPLND\\x1bY\\x19I\\x1f_5\\x9e\\xd5\\x0e\\xb3\\x05\\x9b\\x8a\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3400
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000cd7",
            "parentcaller": "0x77003d04",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x03\\x1006\\x04\\x10V\\x8f\\x1c\\xb8\\xa3\t\\xda\\x17\\xf1\\x15\\x02\\xff\n\\xebp\\x80\\x04 \re(Gp#\\xc1o\\xb1\\x1e\\xe6\\xc3ZRPLND\\x1bY\\x19I\\x1f_5\\x9e\\xd5\\x0e\\xb3\\x05\\x9b\\x8a\\x05\\x0006\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x0006\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x0006\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x0006\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0\\x92i\\x04 `\\xbd\\xedu\\xc5\\xfd"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3401
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10V\\x8f\\x1c\\xb8\\xa3\t\\xda\\x17\\xf1\\x15\\x02\\xff\n\\xebp\\x80\\x04 \re(Gp#\\xc1o\\xb1\\x1e\\xe6\\xc3ZRPLND\\x1bY\\x19I\\x1f_5\\x9e\\xd5\\x0e\\xb3\\x05\\x9b\\x8a\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3402
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10h\\xcbB\\xb05\\xeaw>R\\xefP\\xec\\xf5\\x0e\\xc5)\\x04 \\xa6\\x7f\\xe2\\xa9\\xaf\\x96|\\xb5\\xbf\\xfd\\xc9\\xeb\\xda\\x8f\\x1a\\xb5\\xea\\xbc\\xa2T\\xf1\\x03\\x96Rw\\xfdK\\xa3>'\\xa1\\x87\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3403
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\x91\\x16\\x1b\\x89K\\x11~\\xcd\\xc2Wb\\x8d\\xb4`\\xcc\\x04\\x04 \\xd4\\xc6z\\xd5\\x0e\\x19;\\x9du\\xa2!\\xd2`3\t\\x17\\x15t\\xaex,f\\xdb\\xa6D\\xa6\\x8a\\xffu\\xc0\\x7fP\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3404
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\x91\\xfa\\xd4\\x83\\xf1HH\\xa8\\xa6\\x9b\\x18\\xb8\\x05\\xcd\\xbb:\\x04 \\x064\\x8c\\xa9\r\\x7f\\xe0\\xf9\\x0cv\\xab\\x9d\\xe8\"\\xab\\xf5{\\x9a\\xb4B*\\xb4\\xf8>\\x9b\\x86\\x83\\xacQ\\xdf7\\x95\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3405
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\x98;\\x13&5\\xb7\\xe9\\x1d\\xee\\xf5Jg\\x80\\xc0\\x92i\\x04 `\\xbd\\xedu\\xc5\\xfd\\x11\\x90\\x10\\xd6\\x83/v\\xde\\xfc94s\\xd7\\xa0\\xced\\xfb\\xd6\\x8d\\xab\\xa2\\x9b\\xfd\\x0b/|\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3406
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xa8#\\xb4\\xa2\\x01\\x80\\xbe\\xb4`\\xca\\xb9U\\xc2M~!\\x04 =\\xde2\\xff\\xc4p\\x9b\\xb1\\xa3\\xffv\\xd3TA\\xf4\\xae\\x7f\\xe0^\\xe2\\x8a\\xe5\\xd6\\x17\\xa7[\\xd3n\\xeek\\xf5\\xca\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3407
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xa8\\x82z<\\xbd-\\x87\\xd7\\x83\\xb5\\x9b\\x80b\\xc8~\\x9a\\x04 %\\x88%;\\x9aAR$\\x14\\xad\\xc3\\xab\\xa2\\xf0\\xb8\\x17\\xbf;\\xaa\\x0cz\\x0c\\x19diO\\x7f^\\xff\\xc4\\xb9`\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3408
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xadmo\\xf3\\x1b$\\x011Q\\xf2y\\xe2j\\x8c3$\\x04 \\xd61\\xb2F\\x02|\\xa8\\x8e\\x9b\\x03BO#\\x0c\\x9f53R\\xb4\\x9a_\\x9as\\x15Vm\\xc2\\xach\\xd0X\\x16\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3409
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xbaO9r\\xe7\\xae\\xd9\\xdc\\xcd\\xc2\\x10\\xdbY\\xda\\x13\\xc9\\x04 \\xe5\\xd4\\x7f\\x02\\xf2t\\x97\\x81\\xc1\\x84\\xab<\\x0fT\\x9eqk\\xb21BJr\\x1f\\xec;\\xdf\\xa17G\\x9e\\x1e\\x15\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3410
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x04 J\\xbb\\x05\\x94\\xd3\\x03\\xefpw\\x13\\x884\\xab1^\\x94\\x1e\\x960\\x93\\xe0[K\\x14\\xaf]\\xcbRw\\x12\\xc0\n\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3411
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xd0\\xfd<\\x9c8\r{e\\xe2k\\x9a?\\xed\\xd3\\x9b\\x8f\\x04 9\\xa4u\\x87\\x0b\\xf2\\xb4\\x8cR\\x03\\xa0\\x8e\\xa5\"y\\xbc\\xe7\\x1a\\xbb\\x8d>7\\xe0k\\x89\\x07\\xa2g\\xec\\xd7\\xdaj\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3412
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xd6`0\\xcd\\xb7\\x92\\x86\\xc9\\xcb\\xee\\x93\\xc1O\\xa3\\x99\\xcc\\x04 E\\xbaB\\xfe\\xb2v\\x9a\\x95c\\xfaQ\\xcc'\\xdd\\x14\\x96\\xef\\xd0\\xe4\\xc5\\xd1\\x96\\x89\\x803\\x17\\x8c\\xc8u\\x8fP\\xca\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3413
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xd8\\xb5\\xfb6\\x84hb\\x02u\\xd1B\\xff\\xd2\\xaa\\xde7\\x04 p\\x8f\\x94en\\xadw\\x16k\\xe938[7\\xb7\\xd5\\x8f\\x7f\\x10\\xb2\\x8c\\x12ld\\xa7\\x86\\x1b\\xc6k\\xb6g\\xc4\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3414
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77000b98",
            "parentcaller": "0x77000d17",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "06\\x04\\x10\\xfaF\\xce|\\xbb\\x85\\xcf\\xb41\\x00u1:\t\\xee\\x05\\x04 H\\xa0:\\xf5\\x0b\\xc5\\xa1\\xf9q\\xc0\\xc1\\x93\\x8b\n\\xb2\\xd5\\x9bT\\x86\\x9e\\x18\\x01\\xf3x\\x1d^\\x1c\\xd2\\xf7\\xe3\\x93\\x91\\x05\\x00"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3415
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77003d6d",
            "parentcaller": "0x76fe3f13",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "\\x17\r180601232859Z"
              },
              {
                "name": "Flags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3416
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77003ac2",
            "parentcaller": "0x76febd4a",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x01"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 3417
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x76fea2a6",
            "parentcaller": "0x76fe9622",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3418
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3419
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x69bb46bc",
            "parentcaller": "0x69bb463b",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3420
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03157000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3421
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x6d196967",
            "parentcaller": "0x6d194f89",
            "category": "network",
            "api": "SslEncryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "GET /settings/v2.0/WSD/Setup360?os=windows&osver=10.0.19041.3803.amd64fre.vb_release.191206-1406&scenarioId=7&platformEdition=Professional&platformInstallationType=Client&sku=48&deviceId=%7B088B0758-31C5-47D8-9C4B-32E98EB1AB80%7D&appver=10.0.19041.572&appBuildLab=vb_release_svc_prod1 HTTP/1.1\r\nConnection: Keep-Alive\r\nUser-Agent: OneSettingsQuery\r\nHost: settings-win.data.microsoft.com\r\n\r\n"
              },
              {
                "name": "SequenceNumber",
                "value": "1"
              },
              {
                "name": "BufferSize",
                "value": "390"
              }
            ],
            "repeated": 0,
            "id": 3422
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x69bab419",
            "parentcaller": "0x69baae23",
            "category": "network",
            "api": "WSASend",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Socket",
                "value": "1328"
              },
              {
                "name": "Buffer",
                "value": "\\x17\\x03\\x03\\x01\\x9e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x97\\xce?g\\xff\\xbet\\xf7\\xe7\\xd6\\xb4\\xbc\\x05\\xe1\\x02\\x99,\\xf7\\x02q@\\x9e+\\x9fe\\xfe\\xd2\\xf3p\\x8d\\x17\\x99\\xe4j6\\xaaen\\x17\\x0b\\xe1C\\xf7\\xe3M\\xb8\\x0b@=\\xdb\\x0ceO\\xd8%\r\\x80e\\xa0U\\x0e\\xd8'\\xac,\\x95=\\xa9a!}h\\xe4\\xe1\\x9b\\xea\\x92\\x8c\\xe9\\xfeDy\\x88\\xaf_>\\xe7\\x13E\\x9a\\xac\\xab(Q\\x98o^b\\x0e\\xac\\xa7\\xc2\\\\xa0\\xff\\xb6\\xa7\\xdd\\x93\\xbdr\\xb71\nMwO\\xe1t\\xbb\\xe7g\\x16}\\xa68\\xc6s/\\x03\\x0e\\xab|0\\xd0\\xd3\\xf3\\xdb\\xa8IZ\\x90w\\xc07\\x86my\\xe7\\xdb<4\\x12=R<\\x7fg\\x1b\\xb0\\x7f\\xd7WV\\xdc \\xa6\\x05\\x0b\\xd8\\x7f\\xa9\\x97\\x0eE\\x10\\xa97\\x80t'\\x91f&8\\xcf\\xf1\\xaa\\xd7\\x8c\\x0bhk\\xc0\\xd8R\\xc8?;\\x9a\\xfe1,B\\x9aC\\xd6}\\xd5\\x80\\x88\\xd2]\\x87S\\xb2\\xa0\\xee\\x11m<0ht\\x96\\xfcS\\xa1\\xf1\\xe6\\xcbk;S\\xad@\\xea\\x84\\xf7C\\xadT\\x1d\\xa5>\\xd3\\x8a\\xa9\\xad9\\xcdn\\x9f\\xbc\\xdc`\\x03\\x18\\xa6\\x15\\xe3\\xf0\\xfde\\xd1q\\xcec\\x91\\x9c\\xb8\\x06M?\\xa08\\xc9Q\\xe1\\xd7H\\x02\\xda\\xf2%\\x10/N[\\x86!\\x04\\xdc\\xf3\\xa8*h\\x08?\\xfb\\xba\\xff\\x8c\\x03\\xc6\\xb35af\\x1c\\xd7\t\\x1956\\xcdK\\x9b\\xcd\\xc4\\x80D\\xc5D\\xb1\\xd7\\x9e-\\xeeX\t\\xa7\\x93N\\x07\\xd6\\xd2h\\xe3\\x0f\\xc5\\xbeh\\xdf\\x9a\\x83E\\x065X\\x0fu\\x0b\\x7fIo\\xc0u\\xc7D\\xbc\\x8a\\x05\\xe2\\x8f\\xf6T\\x87%g\\xd6\\xc6\\x8bv\\xec\r\\xac`\\xd5\\xdd\\xc3e\\x02M\\x86\\xfc\\xf9\\xf5L\\xea\\xc1\\xcc\\xe0P\\x0b\\xda\\xff+\\x1b\\x90\\xdbID\\xed\\xa2\\x97"
              }
            ],
            "repeated": 0,
            "id": 3423
          },
          {
            "timestamp": "2026-05-28 22:59:41,081",
            "thread_id": "6324",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1328"
              }
            ],
            "repeated": 0,
            "id": 3424
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "6324",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "HTTP/1.1 200 OK\r\nCache-Control: no-cache,no-store\r\nContent-Length: 67\r\nContent-Type: application/json;charset=utf-8\r\nETag: 1192:66A2A386\r\nServer: Microsoft-HTTPAPI/2.0\r\nX-Content-Type-Options: nosniff\r\nContent-Security-Policy: script-src https://settings-sandbox.data.microsoft.com https://settings-ppe.data.microsoft.com https://settings.data.microsoft.com http://onesettings-xbox-rp.com https://settings-win.data.microsoft.com\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nDate: Thu, 28 May 2026 15:59:44 GMT\r\n\r\n{\"refreshInterval\":\"1192\",\"queryUrl\":\"/settings/v2.0/WSD/Setup360\"}"
              },
              {
                "name": "SequenceNumber",
                "value": "1"
              },
              {
                "name": "BufferSize",
                "value": "600"
              }
            ],
            "repeated": 0,
            "id": 3425
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "6324",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1328"
              }
            ],
            "repeated": 0,
            "id": 3426
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa9500",
            "parentcaller": "0x00fa8a90",
            "category": "network",
            "api": "WinHttpSendRequest",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x030cbf60"
              },
              {
                "name": "Headers",
                "value": ""
              },
              {
                "name": "Optional",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3427
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa952d",
            "parentcaller": "0x00fa8a90",
            "category": "network",
            "api": "WinHttpReceiveResponse",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x030cbf60"
              }
            ],
            "repeated": 1,
            "id": 3428
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa957b",
            "parentcaller": "0x00fa8a90",
            "category": "network",
            "api": "WinHttpQueryHeaders",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x030cbf60"
              }
            ],
            "repeated": 0,
            "id": 3429
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa95c5",
            "parentcaller": "0x00fa8a90",
            "category": "network",
            "api": "WinHttpQueryHeaders",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x030cbf60"
              }
            ],
            "repeated": 0,
            "id": 3430
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa95da",
            "parentcaller": "0x00fa8a90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000051c"
              }
            ],
            "repeated": 0,
            "id": 3431
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa95da",
            "parentcaller": "0x00fa8a90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d4"
              }
            ],
            "repeated": 1,
            "id": 3432
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa960d",
            "parentcaller": "0x00fa8a90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000051c"
              }
            ],
            "repeated": 0,
            "id": 3433
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa9acd",
            "parentcaller": "0x00fa8b08",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x000f003f",
                "pretty_value": "KEY_ALL_ACCESS"
              },
              {
                "name": "Handle",
                "value": "0x0000051c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings"
              },
              {
                "name": "Disposition",
                "value": "1",
                "pretty_value": "REG_CREATED_NEW_KEY"
              }
            ],
            "repeated": 0,
            "id": 3434
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa9b02",
            "parentcaller": "0x00fa8b08",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000051c"
              },
              {
                "name": "SubKey",
                "value": "WSD"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x000f003f",
                "pretty_value": "KEY_ALL_ACCESS"
              },
              {
                "name": "Handle",
                "value": "0x000005d4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD"
              },
              {
                "name": "Disposition",
                "value": "1",
                "pretty_value": "REG_CREATED_NEW_KEY"
              }
            ],
            "repeated": 0,
            "id": 3435
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa9b26",
            "parentcaller": "0x00fa8b08",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005d4"
              },
              {
                "name": "SubKey",
                "value": "Setup360"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x000f003f",
                "pretty_value": "KEY_ALL_ACCESS"
              },
              {
                "name": "Handle",
                "value": "0x000004c0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360"
              },
              {
                "name": "Disposition",
                "value": "1",
                "pretty_value": "REG_CREATED_NEW_KEY"
              }
            ],
            "repeated": 0,
            "id": 3436
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa9b5d",
            "parentcaller": "0x00fa8b08",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004c0"
              },
              {
                "name": "ValueName",
                "value": "ETag"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Buffer",
                "value": "1192:66A2A386"
              },
              {
                "name": "BufferLength",
                "value": "28"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\ETag"
              }
            ],
            "repeated": 0,
            "id": 3437
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa9b7e",
            "parentcaller": "0x00fa8b08",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004c0"
              },
              {
                "name": "ValueName",
                "value": "RefreshInterval"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "1192"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\RefreshInterval"
              }
            ],
            "repeated": 0,
            "id": 3438
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa9b96",
            "parentcaller": "0x00fa8b08",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000004c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\Settings"
              }
            ],
            "repeated": 0,
            "id": 3439
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa9bc4",
            "parentcaller": "0x00fa8b08",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004c0"
              },
              {
                "name": "SubKey",
                "value": "Settings"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x000f003f",
                "pretty_value": "KEY_ALL_ACCESS"
              },
              {
                "name": "Handle",
                "value": "0x00000660"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\Settings"
              },
              {
                "name": "Disposition",
                "value": "1",
                "pretty_value": "REG_CREATED_NEW_KEY"
              }
            ],
            "repeated": 0,
            "id": 3440
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa9bf0",
            "parentcaller": "0x00fa8b08",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000004c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "QueryParameters"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters"
              }
            ],
            "repeated": 0,
            "id": 3441
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa9c17",
            "parentcaller": "0x00fa8b08",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004c0"
              },
              {
                "name": "SubKey",
                "value": "QueryParameters"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x000f003f",
                "pretty_value": "KEY_ALL_ACCESS"
              },
              {
                "name": "Handle",
                "value": "0x00000664"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters"
              },
              {
                "name": "Disposition",
                "value": "1",
                "pretty_value": "REG_CREATED_NEW_KEY"
              }
            ],
            "repeated": 0,
            "id": 3442
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa8d36",
            "parentcaller": "0x00fa9c2f",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000664"
              },
              {
                "name": "ValueName",
                "value": "os"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Buffer",
                "value": "windows"
              },
              {
                "name": "BufferLength",
                "value": "16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\os"
              }
            ],
            "repeated": 0,
            "id": 3443
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa8d36",
            "parentcaller": "0x00fa9c2f",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000664"
              },
              {
                "name": "ValueName",
                "value": "osver"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Buffer",
                "value": "10.0.19041.3803.amd64fre.vb_release.191206-1406"
              },
              {
                "name": "BufferLength",
                "value": "96"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\osver"
              }
            ],
            "repeated": 0,
            "id": 3444
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa8d36",
            "parentcaller": "0x00fa9c2f",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000664"
              },
              {
                "name": "ValueName",
                "value": "scenarioId"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Buffer",
                "value": "7"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\scenarioId"
              }
            ],
            "repeated": 0,
            "id": 3445
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa8d36",
            "parentcaller": "0x00fa9c2f",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000664"
              },
              {
                "name": "ValueName",
                "value": "platformEdition"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Buffer",
                "value": "Professional"
              },
              {
                "name": "BufferLength",
                "value": "26"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\platformEdition"
              }
            ],
            "repeated": 0,
            "id": 3446
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa8d36",
            "parentcaller": "0x00fa9c2f",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000664"
              },
              {
                "name": "ValueName",
                "value": "platformInstallationType"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Buffer",
                "value": "Client"
              },
              {
                "name": "BufferLength",
                "value": "14"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\platformInstallationType"
              }
            ],
            "repeated": 0,
            "id": 3447
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa8d36",
            "parentcaller": "0x00fa9c2f",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000664"
              },
              {
                "name": "ValueName",
                "value": "sku"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Buffer",
                "value": "48"
              },
              {
                "name": "BufferLength",
                "value": "6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\sku"
              }
            ],
            "repeated": 0,
            "id": 3448
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa8d36",
            "parentcaller": "0x00fa9c2f",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000664"
              },
              {
                "name": "ValueName",
                "value": "deviceId"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Buffer",
                "value": "{088B0758-31C5-47D8-9C4B-32E98EB1AB80}"
              },
              {
                "name": "BufferLength",
                "value": "78"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\deviceId"
              }
            ],
            "repeated": 0,
            "id": 3449
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa8d36",
            "parentcaller": "0x00fa9c2f",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000664"
              },
              {
                "name": "ValueName",
                "value": "appver"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Buffer",
                "value": "10.0.19041.572"
              },
              {
                "name": "BufferLength",
                "value": "30"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\appver"
              }
            ],
            "repeated": 0,
            "id": 3450
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa8d36",
            "parentcaller": "0x00fa9c2f",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000664"
              },
              {
                "name": "ValueName",
                "value": "appBuildLab"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Buffer",
                "value": "vb_release_svc_prod1"
              },
              {
                "name": "BufferLength",
                "value": "42"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\appBuildLab"
              }
            ],
            "repeated": 0,
            "id": 3451
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa9c59",
            "parentcaller": "0x00fa8b08",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000664"
              }
            ],
            "repeated": 0,
            "id": 3452
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa9c67",
            "parentcaller": "0x00fa8b08",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000660"
              }
            ],
            "repeated": 0,
            "id": 3453
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa9c75",
            "parentcaller": "0x00fa8b08",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004c0"
              }
            ],
            "repeated": 0,
            "id": 3454
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa9c83",
            "parentcaller": "0x00fa8b08",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d4"
              }
            ],
            "repeated": 0,
            "id": 3455
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa9c91",
            "parentcaller": "0x00fa8b08",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000051c"
              }
            ],
            "repeated": 0,
            "id": 3456
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00faa373",
            "parentcaller": "0x00fa8b0f",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3457
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00faa3f5",
            "parentcaller": "0x00fa8b0f",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360"
              },
              {
                "name": "Handle",
                "value": "0x0000051c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360"
              }
            ],
            "repeated": 0,
            "id": 3458
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00faa425",
            "parentcaller": "0x00fa8b0f",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000051c"
              },
              {
                "name": "ValueName",
                "value": "RefreshAfter"
              },
              {
                "name": "Type",
                "value": "11"
              },
              {
                "name": "Buffer",
                "value": "\"\\x06\\xf6/\\x9c\\xef\\xdc\\x01"
              },
              {
                "name": "BufferLength",
                "value": "8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\RefreshAfter"
              }
            ],
            "repeated": 0,
            "id": 3459
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00faa441",
            "parentcaller": "0x00fa8b0f",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000051c"
              }
            ],
            "repeated": 0,
            "id": 3460
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa8b96",
            "parentcaller": "0x00f58120",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 1,
            "id": 3461
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3462
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3463
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9b\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3464
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x9b\\x13\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3465
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:41, Info                  MOUPG  OneSettings: Initialization succeeded, but no values found.\r\n"
              },
              {
                "name": "Length",
                "value": "111"
              }
            ],
            "repeated": 0,
            "id": 3466
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3467
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3468
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3469
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\n\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3470
          },
          {
            "timestamp": "2026-05-28 22:59:41,285",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\n\\x14\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3471
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:41, Info                  MOUPG  SetupHost: OneSettings Initialized -> [No]\r\n"
              },
              {
                "name": "Length",
                "value": "94"
              }
            ],
            "repeated": 0,
            "id": 3472
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3473
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "DPAPI.DLL"
              }
            ],
            "repeated": 0,
            "id": 3474
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\DPAPI.DLL"
              }
            ],
            "repeated": 0,
            "id": 3475
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\dpapi.dll"
              }
            ],
            "repeated": 0,
            "id": 3476
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\dpapi.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 3477
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000051c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\dpapi.dll"
              }
            ],
            "repeated": 0,
            "id": 3478
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000051c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e510000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00008000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3479
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e515000"
              },
              {
                "name": "ModuleName",
                "value": "DPAPI.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3480
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e514000"
              },
              {
                "name": "ModuleName",
                "value": "DPAPI.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3481
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e514000"
              },
              {
                "name": "ModuleName",
                "value": "DPAPI.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3482
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3483
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3484
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e514000"
              },
              {
                "name": "ModuleName",
                "value": "DPAPI.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3485
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000051c"
              }
            ],
            "repeated": 0,
            "id": 3486
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 3487
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e514000"
              },
              {
                "name": "ModuleName",
                "value": "DPAPI.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3488
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\Windows\\SYSTEM32\\DPAPI.DLL"
              }
            ],
            "repeated": 0,
            "id": 3489
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\dpapi.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 3490
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 3491
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DPAPI"
              },
              {
                "name": "DllBase",
                "value": "0x6e510000"
              }
            ],
            "repeated": 0,
            "id": 3492
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\dpapi"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e510000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6e511dc0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3493
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x72838000"
              },
              {
                "name": "ModuleName",
                "value": "WINHTTP.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3494
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88db",
            "parentcaller": "0x00f4bf2c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x72838000"
              },
              {
                "name": "ModuleName",
                "value": "WINHTTP.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3495
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa88fb",
            "parentcaller": "0x00f4bf2c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 3496
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3497
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3498
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00h\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3499
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "6328",
            "caller": "0x76c1fc08",
            "parentcaller": "0x76c1fabd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000057c"
              }
            ],
            "repeated": 0,
            "id": 3500
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "6328",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 3501
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "6328",
            "caller": "0x7798040b",
            "parentcaller": "0x727dbb8b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 3502
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727dbb9c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 3503
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "6328",
            "caller": "0x7798040b",
            "parentcaller": "0x727dbbab",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3504
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "6324",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727d8afe",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 3505
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "6324",
            "caller": "0x779a906b",
            "parentcaller": "0x779a900f",
            "category": "system",
            "api": "NtDelayExecution",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Milliseconds",
                "value": "30000"
              }
            ],
            "repeated": 0,
            "id": 3506
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727a2629",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000524"
              }
            ],
            "repeated": 0,
            "id": 3507
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "h\\x14\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3508
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "Buffer",
                "value": "2026-05-28 15:59:41, Info                  MOUPG  SetupHost: Loading ID: [c7b6e4de-b741-42d8-ac05-16738c9e0bc5] from [C:\\$Windows.~WS\\Sources\\SetupMgr.dll]...\r\n"
              },
              {
                "name": "Length",
                "value": "160"
              },
              {
                "name": "Status",
                "value": "Maximum logged writes reached for this file"
              }
            ],
            "repeated": 0,
            "id": 3509
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3510
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x75f20000"
              }
            ],
            "repeated": 0,
            "id": 3511
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\$Windows.~WS\\Sources\\WINDLP"
              },
              {
                "name": "DllBase",
                "value": "0x699b0000"
              }
            ],
            "repeated": 0,
            "id": 3512
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupMgr"
              },
              {
                "name": "DllBase",
                "value": "0x69ad0000"
              }
            ],
            "repeated": 0,
            "id": 3513
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-processthreads-l1-1-2.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x75d30000"
              }
            ],
            "repeated": 0,
            "id": 3514
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x69ad0000"
              }
            ],
            "repeated": 0,
            "id": 3515
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00f5b070",
            "parentcaller": "0x00f58959",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x69ad0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3516
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00f5897a",
            "parentcaller": "0x00f4cd31",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "SetupMgr.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69ad0000"
              },
              {
                "name": "FunctionName",
                "value": "CreateSetupObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x69b106b0"
              }
            ],
            "repeated": 0,
            "id": 3517
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3518
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3519
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3520
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x08\\x15\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3521
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3522
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3523
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3524
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00X\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3525
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "X\\x15\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3526
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3527
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3528
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3529
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3530
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd8\\x15\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3531
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3532
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3533
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3534
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00A\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3535
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "A\\x16\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3536
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3537
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3538
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3539
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xaa\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3540
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xaa\\x16\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3541
          },
          {
            "timestamp": "2026-05-28 22:59:41,300",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3542
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3543
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3544
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x13\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3545
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x13\\x17\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3546
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3547
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3548
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3549
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x7f\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3550
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x7f\\x17\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3551
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3552
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3553
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3554
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xeb\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3555
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xeb\\x17\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3556
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3557
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              }
            ],
            "repeated": 0,
            "id": 3558
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS"
              }
            ],
            "repeated": 0,
            "id": 3559
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              }
            ],
            "repeated": 0,
            "id": 3560
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther"
              }
            ],
            "repeated": 0,
            "id": 3561
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3562
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3563
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00Y\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3564
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "Y\\x18\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3565
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3566
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3567
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3568
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3569
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc8\\x18\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3570
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3571
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3572
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3573
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00/\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3574
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "/\\x19\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3575
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3576
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3577
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3578
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3579
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xa6\\x19\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3580
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3581
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3582
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3583
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\r\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3584
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\r\\x1a\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3585
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3586
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3587
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3588
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00e\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3589
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "e\\x1a\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3590
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3591
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3592
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3593
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd4\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3594
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd4\\x1a\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3595
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3596
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3597
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3598
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00E\\x1b\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3599
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "E\\x1b\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3600
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3601
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3602
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3603
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x8e\\x1b\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3604
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x8e\\x1b\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3605
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3606
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3607
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3608
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe1\\x1b\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3609
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xe1\\x1b\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3610
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3611
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3612
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3613
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00<\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3614
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "<\\x1c\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3615
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3616
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3617
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3618
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x95\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3619
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x95\\x1c\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3620
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3621
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3622
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3623
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xee\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3624
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xee\\x1c\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3625
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3626
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3627
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3628
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00L\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3629
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "L\\x1d\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3630
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3631
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3632
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3633
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa9\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3634
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xa9\\x1d\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3635
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3636
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3637
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3638
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3639
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x0c\\x1e\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3640
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3641
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3642
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3643
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00r\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3644
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "r\\x1e\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3645
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3646
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3647
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3648
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd7\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3649
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd7\\x1e\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3650
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3651
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3652
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3653
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x008\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3654
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "8\\x1f\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3655
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3656
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3657
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3658
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x96\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3659
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x96\\x1f\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3660
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3661
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3662
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3663
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xeb\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3664
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xeb\\x1f\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3665
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3666
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3667
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3668
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00M \\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3669
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "M \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3670
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3671
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3672
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3673
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xb0 \\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3674
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb0 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3675
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3676
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3677
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3678
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x0f!\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3679
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x0f!\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3680
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3681
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3682
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3683
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00r!\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3684
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "r!\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3685
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3686
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3687
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3688
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xcd!\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3689
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xcd!\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3690
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3691
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3692
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3693
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00%\"\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3694
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "%\"\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3695
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3696
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3697
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3698
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x82\"\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3699
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x82\"\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3700
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3701
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3702
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3703
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xdf\"\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3704
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xdf\"\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3705
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3706
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3707
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3708
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00?#\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3709
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "?#\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3710
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3711
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3712
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3713
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa0#\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3714
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xa0#\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3715
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3716
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3717
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3718
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xfd#\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3719
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xfd#\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3720
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3721
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3722
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3723
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\$\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3724
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\$\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3725
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3726
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3727
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3728
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xba$\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3729
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xba$\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3730
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3731
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3732
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3733
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x14%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3734
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x14%\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3735
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3736
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3737
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3738
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x84%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3739
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x84%\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3740
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3741
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3742
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3743
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe9%\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3744
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xe9%\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3745
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3746
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3747
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3748
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00J&\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3749
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "J&\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3750
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3751
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther"
              }
            ],
            "repeated": 0,
            "id": 3752
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3753
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3754
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa6&\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3755
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xa6&\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3756
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3757
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 3758
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3759
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xd1\\x0f\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3760
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 3761
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0140080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|WRITE_DAC|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3762
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "ntmarta.dll"
              }
            ],
            "repeated": 0,
            "id": 3763
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ntmarta.dll"
              }
            ],
            "repeated": 0,
            "id": 3764
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000051c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ntmarta.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 3765
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000005d4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000051c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\ntmarta.dll"
              }
            ],
            "repeated": 0,
            "id": 3766
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000005d4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f4e0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00029000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3767
          },
          {
            "timestamp": "2026-05-28 22:59:41,316",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f505000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3768
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f503000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3769
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f503000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3770
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3771
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3772
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f503000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3773
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d4"
              }
            ],
            "repeated": 0,
            "id": 3774
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000051c"
              }
            ],
            "repeated": 0,
            "id": 3775
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f503000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3776
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\Windows\\SYSTEM32\\ntmarta.dll"
              }
            ],
            "repeated": 0,
            "id": 3777
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000051c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ntmarta.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 3778
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000051c"
              }
            ],
            "repeated": 0,
            "id": 3779
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ntmarta"
              },
              {
                "name": "DllBase",
                "value": "0x6f4e0000"
              }
            ],
            "repeated": 0,
            "id": 3780
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\ntmarta"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f4e0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6f4e7e90"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3781
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75bc5000"
              },
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3782
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75bc5000"
              },
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3783
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000394"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000468"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3784
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "X\\xc7\\xbc\\xaa\\xf5\\xee\\xdc\\x01X\\xc7\\xbc\\xaa\\xf5\\xee\\xdc\\x01X\\xc7\\xbc\\xaa\\xf5\\xee\\xdc\\x01X\\xc7\\xbc\\xaa\\xf5\\xee\\xdc\\x01 (\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3785
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000a"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000057c"
              }
            ],
            "repeated": 0,
            "id": 3786
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": false,
            "return": "0xffffffffc000000d",
            "pretty_return": "INVALID_PARAMETER",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "55",
                "pretty_value": "FileReplaceCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3787
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x03\\x10\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3788
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xbc\\xac\\x13\\x03\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3789
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\x96\\x10\\x03`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3790
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3791
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x1c\\xff\\x13\\x03\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3792
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3793
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x94\\xea\\x11\\x03\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 3794
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\x8bk|_\\x8bk\\x06\\x00\\x00\\x00h_\\x8bkT\\x00\\x00\\x00\\x90\\xea\\x11\\x03\\x00\\x00#\\x00d\\xefX\\xef|\\x05\\x00\\x00$\\xf0\\x00\\x00\\x00\\x00\\x07\\x03#\\x00\\x00\\xc0|\\x05\\x00\\x00\\xac\\xef\\xe3\\x00\\xb3\\x91\\xb1w|\\x05\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3795
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\x93k|\\x92\\xef\\x04$\\xf0\\xf0\\x04#\\x00\\x00\\xc0\\xec\\xa8ik]\\x85\\x12\\xadT\\xea\\xe3\\x00|\\x05\\x00\\x00\\x08\\xf4\\xe3\\x00\\xa0\\xe6\\x80ka\\xcb}\\xc6\\xfe\\xff\\xff\\xffd\\xef\\xe3\\x00\\x96\\x19mk2\\x00\\x00\\x00\\x04:\\x8bk\\x98_\\x8bk"
              }
            ],
            "repeated": 0,
            "id": 3796
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000057c"
              }
            ],
            "repeated": 0,
            "id": 3797
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 3798
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 3799
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3800
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xd1\\x0f\\x03\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3801
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 3802
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0140080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|WRITE_DAC|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3803
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000468"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000057c"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3804
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000057c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x9e)\\xbf\\xaa\\xf5\\xee\\xdc\\x01\\x9e)\\xbf\\xaa\\xf5\\xee\\xdc\\x01\\x9e)\\xbf\\xaa\\xf5\\xee\\xdc\\x01\\x9e)\\xbf\\xaa\\xf5\\xee\\xdc\\x01 (\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3805
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000a"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000668"
              }
            ],
            "repeated": 0,
            "id": 3806
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": false,
            "return": "0xffffffffc000000d",
            "pretty_return": "INVALID_PARAMETER",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000057c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "55",
                "pretty_value": "FileReplaceCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3807
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x03\\x10\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3808
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "l\\xac\\x13\\x03\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3809
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "P\\x94\\x10\\x03`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3810
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3811
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x0c\\x00\\x14\\x03\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3812
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3813
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd4\\xec\\x11\\x03\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 3814
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\x8bk|_\\x8bk\\x06\\x00\\x00\\x00h_\\x8bkT\\x00\\x00\\x00\\xd0\\xec\\x11\\x03\\x00\\x00#\\x00d\\xefX\\xefh\\x06\\x00\\x00$\\xf0\\x00\\x00\\x00\\x00\\x07\\x03#\\x00\\x00\\xc0h\\x06\\x00\\x00\\xac\\xef\\xe3\\x00\\xb3\\x91\\xb1wh\\x06\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3815
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\x93k|\\x92\\xef\\x04$\\xf0\\xf0\\x04#\\x00\\x00\\xc0\\xec\\xa8ik]\\x85\\x12\\xadT\\xea\\xe3\\x00h\\x06\\x00\\x00\\x08\\xf4\\xe3\\x00\\xa0\\xe6\\x80ka\\xcb}\\xc6\\xfe\\xff\\xff\\xffd\\xef\\xe3\\x00\\x96\\x19mk2\\x00\\x00\\x00\\x04:\\x8bk\\x98_\\x8bk"
              }
            ],
            "repeated": 0,
            "id": 3816
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000668"
              }
            ],
            "repeated": 0,
            "id": 3817
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000057c"
              }
            ],
            "repeated": 0,
            "id": 3818
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0315b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00014000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3819
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3820
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3821
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3822
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3823
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3824
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3825
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3826
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3827
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3828
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3829
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3830
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3831
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3832
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030e6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3833
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 3834
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3835
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3836
          },
          {
            "timestamp": "2026-05-28 22:59:41,331",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "460"
              }
            ],
            "repeated": 0,
            "id": 3837
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 3838
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3839
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3840
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "460"
              }
            ],
            "repeated": 0,
            "id": 3841
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x0000057c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x699ff6e0"
              },
              {
                "name": "Parameter",
                "value": "0x031354ac"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "7456"
              },
              {
                "name": "ProcessId",
                "value": "5932"
              },
              {
                "name": "Module",
                "value": "WINDLP.DLL"
              }
            ],
            "repeated": 0,
            "id": 3842
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "threading",
            "api": "CreateThread",
            "status": true,
            "return": "0x0000057c",
            "arguments": [
              {
                "name": "StartRoutine",
                "value": "0x699ff6e0"
              },
              {
                "name": "ModuleName",
                "value": "WINDLP.DLL"
              },
              {
                "name": "Parameter",
                "value": "0x031354ac"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "7456"
              }
            ],
            "repeated": 0,
            "id": 3843
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd0\\xec\\xe3\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x03\\x00\\x00\\x06\\x02\\x00\\x00\\x18\\xed\\xe3\\x00\\x88\\x9f\\xf5\\x04\\xa0\\xe7\\xafwl\\x04\\x00\\x00F\\x02\\x00\\x00\\x88\\x9f\\xf5\\x04l\\x04\\x00\\x00\\xa0\\xe7\\xafw"
              }
            ],
            "repeated": 0,
            "id": 3844
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000674"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 3845
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000678"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000674"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Control Panel\\International\\Geo"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Control Panel\\International\\Geo"
              }
            ],
            "repeated": 0,
            "id": 3846
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000674"
              }
            ],
            "repeated": 0,
            "id": 3847
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000678"
              },
              {
                "name": "ValueName",
                "value": "Nation"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "12"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Control Panel\\International\\Geo\\Nation"
              }
            ],
            "repeated": 0,
            "id": 3848
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000678"
              }
            ],
            "repeated": 0,
            "id": 3849
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3850
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3851
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "7456",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3852
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "7456",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3853
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x80'\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3854
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x80'\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3855
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3856
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 3857
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3858
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd6'\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3859
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd6'\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3860
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3861
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3862
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3863
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00B(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3864
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "B(\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3865
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3866
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3867
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3868
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xae(\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3869
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xae(\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3870
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3871
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3872
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3873
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x1a)\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3874
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1a)\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3875
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3876
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc000003a",
            "pretty_return": "OBJECT_PATH_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Sources\\ws.dat"
              }
            ],
            "repeated": 0,
            "id": 3877
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3878
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3879
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x98)\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3880
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x98)\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3881
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3882
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000678"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 3883
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000678"
              },
              {
                "name": "ValueName",
                "value": "SusClientId"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId"
              }
            ],
            "repeated": 0,
            "id": 3884
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000678"
              },
              {
                "name": "ValueName",
                "value": "SusClientId"
              },
              {
                "name": "Data",
                "value": "0e9cfb40-0d63-45be-b169-515d335337a8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId"
              }
            ],
            "repeated": 0,
            "id": 3885
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000678"
              }
            ],
            "repeated": 0,
            "id": 3886
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3887
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3888
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x04*\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3889
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x04*\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3890
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3891
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\LegacyInterrupt.dat"
              }
            ],
            "repeated": 0,
            "id": 3892
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3893
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3894
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x94*\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3895
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x94*\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3896
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3897
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 1,
            "id": 3898
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              },
              {
                "name": "Handle",
                "value": "0x00000678"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              }
            ],
            "repeated": 0,
            "id": 3899
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000678"
              },
              {
                "name": "ValueName",
                "value": "CSDBuildNumber"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber"
              }
            ],
            "repeated": 0,
            "id": 3900
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000678"
              }
            ],
            "repeated": 0,
            "id": 3901
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 3902
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              },
              {
                "name": "Handle",
                "value": "0x00000678"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              }
            ],
            "repeated": 0,
            "id": 3903
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000678"
              },
              {
                "name": "ValueName",
                "value": "BuildBranch"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildBranch"
              }
            ],
            "repeated": 0,
            "id": 3904
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000678"
              },
              {
                "name": "ValueName",
                "value": "BuildBranch"
              },
              {
                "name": "Data",
                "value": "vb_release"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildBranch"
              }
            ],
            "repeated": 0,
            "id": 3905
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000678"
              }
            ],
            "repeated": 0,
            "id": 3906
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4bff0",
            "parentcaller": "0x00f49129",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc000003a",
            "pretty_return": "OBJECT_PATH_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Sources\\ws.dat"
              }
            ],
            "repeated": 0,
            "id": 3907
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3908
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3909
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x01+\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3910
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01+\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3911
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3912
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4c020",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup"
              },
              {
                "name": "Handle",
                "value": "0x00000678"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup"
              }
            ],
            "repeated": 0,
            "id": 3913
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4c020",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000678"
              },
              {
                "name": "ValueName",
                "value": "Compact"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\Compact"
              }
            ],
            "repeated": 0,
            "id": 3914
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4c020",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000678"
              }
            ],
            "repeated": 0,
            "id": 3915
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4c020",
            "parentcaller": "0x00f49129",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 3916
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4c020",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability"
              },
              {
                "name": "Handle",
                "value": "0x00000678"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability"
              }
            ],
            "repeated": 0,
            "id": 3917
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4c020",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000678"
              },
              {
                "name": "ValueName",
                "value": "EnablePreviewBuilds"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\EnablePreviewBuilds"
              }
            ],
            "repeated": 0,
            "id": 3918
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4c020",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000678"
              }
            ],
            "repeated": 0,
            "id": 3919
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3920
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3921
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00_+\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3922
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "_+\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3923
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3924
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3925
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3926
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc9+\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3927
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc9+\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3928
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3929
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4c020",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System\\CurrentControlSet\\Control\\ProductOptions"
              },
              {
                "name": "Handle",
                "value": "0x00000678"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\ProductOptions"
              }
            ],
            "repeated": 0,
            "id": 3930
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4c020",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000678"
              },
              {
                "name": "ValueName",
                "value": "ProductType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ProductOptions\\ProductType"
              }
            ],
            "repeated": 0,
            "id": 3931
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4c020",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000678"
              },
              {
                "name": "ValueName",
                "value": "ProductType"
              },
              {
                "name": "Data",
                "value": "WinNT"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ProductOptions\\ProductType"
              }
            ],
            "repeated": 0,
            "id": 3932
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00f4c020",
            "parentcaller": "0x00f49129",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000678"
              }
            ],
            "repeated": 0,
            "id": 3933
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3934
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3935
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00.,\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3936
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": ".,\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3937
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3938
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3939
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3940
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9b,\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3941
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x9b,\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3942
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3943
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3944
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3945
          },
          {
            "timestamp": "2026-05-28 22:59:41,347",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xf6,\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3946
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xf6,\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3947
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3948
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3949
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3950
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00T-\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3951
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "T-\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3952
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3953
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3954
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3955
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00b\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3956
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "b\\x07\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3957
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"663\" Fil=\"\" Fun=\"CSetupDiagnostics::LogString\" Uid=\"51019776\" Msg=\"SetupHost: Unexpected scenario - defaulting postoobe/rollback commands!\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\Setu"
              },
              {
                "name": "Length",
                "value": "328"
              }
            ],
            "repeated": 0,
            "id": 3958
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xb1-\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3959
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb1-\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3960
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3961
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3962
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3963
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00,.\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3964
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": ",.\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3965
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3966
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3967
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3968
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x99.\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3969
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x99.\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3970
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3971
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\SQMClient\\Windows"
              },
              {
                "name": "Handle",
                "value": "0x0000067c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows"
              }
            ],
            "repeated": 0,
            "id": 3972
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f9e9d2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000067c"
              },
              {
                "name": "ValueName",
                "value": "StudyID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\StudyID"
              }
            ],
            "repeated": 0,
            "id": 3973
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f9e9d2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000067c"
              }
            ],
            "repeated": 0,
            "id": 3974
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3975
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3976
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xdf.\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3977
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xdf.\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3978
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3979
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3980
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3981
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x000/\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3982
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "0/\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3983
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3984
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f46adb",
            "parentcaller": "0x00f50327",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000680"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x00f46650"
              },
              {
                "name": "Parameter",
                "value": "0x0307fa80"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "7460"
              },
              {
                "name": "ProcessId",
                "value": "5932"
              },
              {
                "name": "Module",
                "value": "SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 3985
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f46adb",
            "parentcaller": "0x00f50327",
            "category": "threading",
            "api": "CreateThread",
            "status": true,
            "return": "0x00000680",
            "arguments": [
              {
                "name": "StartRoutine",
                "value": "0x00f46650"
              },
              {
                "name": "ModuleName",
                "value": "SetupHost.Exe"
              },
              {
                "name": "Parameter",
                "value": "0x0307fa80"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "7460"
              }
            ],
            "repeated": 0,
            "id": 3986
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f46b13",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000067c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3987
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3988
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3989
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f47c55",
            "parentcaller": "0x00f46985",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3990
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f47c55",
            "parentcaller": "0x00f46985",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3991
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f47c55",
            "parentcaller": "0x00f46985",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3992
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f47c55",
            "parentcaller": "0x00f46985",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3993
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f47c55",
            "parentcaller": "0x00f46985",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3994
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f47c55",
            "parentcaller": "0x00f46985",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3995
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f47c55",
            "parentcaller": "0x00f46985",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3996
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f47c55",
            "parentcaller": "0x00f46985",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3997
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f47c55",
            "parentcaller": "0x00f46985",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3998
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f47c55",
            "parentcaller": "0x00f46985",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3999
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f47d89",
            "parentcaller": "0x00f46985",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00f20000"
              }
            ],
            "repeated": 0,
            "id": 4000
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f47d89",
            "parentcaller": "0x00f46985",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030e6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4001
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f47d89",
            "parentcaller": "0x00f46985",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000688"
              }
            ],
            "repeated": 0,
            "id": 4002
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f47d89",
            "parentcaller": "0x00f46985",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000068c"
              }
            ],
            "repeated": 0,
            "id": 4003
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x00000690"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 4004
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000690"
              }
            ],
            "repeated": 0,
            "id": 4005
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000690"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 4006
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f58843",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000690"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 4007
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f58843",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000690"
              }
            ],
            "repeated": 0,
            "id": 4008
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000690"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 4009
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000690"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "0"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 4010
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000690"
              }
            ],
            "repeated": 0,
            "id": 4011
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4012
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4013
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x89/\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4014
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x89/\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4015
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4016
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4017
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4018
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xf6/\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4019
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xf6/\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4020
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4021
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000068c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 4022
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000068c"
              }
            ],
            "repeated": 0,
            "id": 4023
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Handle",
                "value": "0x0000068c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 4024
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000068c"
              },
              {
                "name": "ValueName",
                "value": "Cleanup"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Cleanup"
              }
            ],
            "repeated": 0,
            "id": 4025
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000068c"
              }
            ],
            "repeated": 0,
            "id": 4026
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Tracking"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Tracking"
              }
            ],
            "repeated": 0,
            "id": 4027
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4028
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4029
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00F0\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4030
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "F0\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4031
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4032
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup"
              },
              {
                "name": "Handle",
                "value": "0x0000068c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
              }
            ],
            "repeated": 0,
            "id": 4033
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000068c"
              },
              {
                "name": "ValueName",
                "value": "Priority"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Priority"
              }
            ],
            "repeated": 0,
            "id": 4034
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000068c"
              }
            ],
            "repeated": 0,
            "id": 4035
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4036
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4037
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xb20\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4038
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb20\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4039
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4040
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4041
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4042
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x1f1\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4043
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1f1\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4044
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4045
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f47b52",
            "parentcaller": "0x00f46f90",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "66"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x00"
              }
            ],
            "repeated": 0,
            "id": 4046
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4047
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4048
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x851\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4049
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x851\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4050
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4051
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4052
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4053
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd91\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4054
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd91\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4055
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4056
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f47047",
            "parentcaller": "0x00f493a0",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "43"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80l\\x00#\\x00S\\x00q\\x00m\\x00\\\\x001\\x002\\x002\\x006\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x8c\\x06\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4057
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4058
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4059
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00/2\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4060
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "/2\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4061
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4062
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f470b2",
            "parentcaller": "0x00f493a0",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "44"
              },
              {
                "name": "InputBuffer",
                "value": "\\x8c\\x06\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x8a\\xf5\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4063
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4064
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4065
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x962\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4066
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x962\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4067
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4068
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4069
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4070
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe92\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4071
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xe92\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4072
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4073
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4074
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4075
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00i3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4076
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "i3\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4077
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4078
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4079
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4080
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4081
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4082
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "winhttp.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x72780000"
              }
            ],
            "repeated": 0,
            "id": 4083
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x00019000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4084
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77b0058c",
            "parentcaller": "0x77b07ac3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d20000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4085
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77b005eb",
            "parentcaller": "0x77b07ac3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d20000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4086
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\OnDemandConnRouteHelper"
              },
              {
                "name": "DllBase",
                "value": "0x6e670000"
              }
            ],
            "repeated": 0,
            "id": 4087
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4088
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03165000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4089
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4090
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03165000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4091
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4092
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03166000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4093
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4094
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03166000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4095
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4096
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03167000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4097
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4098
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b046e3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03167000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4099
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4100
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03166000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4101
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4102
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03166000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4103
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4104
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03165000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4105
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OnDemandConnRouteHelper.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e670000"
              }
            ],
            "repeated": 0,
            "id": 4106
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\OnDemandConnRouteHelper"
              },
              {
                "name": "DllBase",
                "value": "0x6e670000"
              }
            ],
            "repeated": 0,
            "id": 4107
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4108
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03167000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4109
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "winhttp.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x72780000"
              }
            ],
            "repeated": 0,
            "id": 4110
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03167000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4111
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WinHttpOpen",
            "status": true,
            "return": "0x0312fd00",
            "arguments": [
              {
                "name": "UserAgent",
                "value": "Windows Dlp Manager"
              },
              {
                "name": "ProxyName",
                "value": ""
              },
              {
                "name": "ProxyBypass",
                "value": ""
              },
              {
                "name": "AccessType",
                "value": "0x00000000"
              },
              {
                "name": "Flags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 4112
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4113
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4114
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4115
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0316b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4116
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03165000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4117
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4118
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03165000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4119
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b046e3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0316b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4120
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4121
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03169000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4122
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xdf3\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4123
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4124
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03169000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4125
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4126
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0316b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4127
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03165000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4128
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4129
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xdf3\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4130
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4131
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              }
            ],
            "repeated": 0,
            "id": 4132
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03169000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4133
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4134
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4135
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x8c4\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4136
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4137
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0316c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4138
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03169000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4139
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03166000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4140
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4141
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x8c4\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4142
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4143
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03166000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4144
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03169000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4145
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b046e3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0316c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4146
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4147
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0316a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4148
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WinHttpOpen",
            "status": true,
            "return": "0x03117698",
            "arguments": [
              {
                "name": "UserAgent",
                "value": "Windows Dlp Manager"
              },
              {
                "name": "ProxyName",
                "value": ""
              },
              {
                "name": "ProxyBypass",
                "value": ""
              },
              {
                "name": "AccessType",
                "value": "0x00000001"
              },
              {
                "name": "Flags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 4149
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d31000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4150
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d41000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4151
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "6328",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000010",
                "pretty_value": "KEY_NOTIFY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000690"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TenantRestrictions\\Payload"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TenantRestrictions\\Payload"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 4152
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "6328",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 4153
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "6328",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\TenantRestrictions\\Payload"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TenantRestrictions\\Payload"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 4154
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "6328",
            "caller": "0x7796b853",
            "parentcaller": "0x779ce66a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "KeyInformation",
                "value": ";#\\x05x]&\\xffda\\x01\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 4155
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "6328",
            "caller": "0x7798040b",
            "parentcaller": "0x727dbc7b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b4"
              }
            ],
            "repeated": 0,
            "id": 4156
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4157
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0316a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4158
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4159
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4160
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b04218",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0316a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4161
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4162
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WinHttpGetIEProxyConfigForCurrentUser",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 4163
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4164
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0316a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4165
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4166
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4167
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4168
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4169
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4170
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4171
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4172
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xf14\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4173
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0316a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4174
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xf14\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4175
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4176
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4177
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4178
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4179
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4180
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4181
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00R5\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4182
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4183
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "R5\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4184
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4185
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4186
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4187
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0316b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4188
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "6328",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0316b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4189
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4190
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4191
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "6328",
            "caller": "0x77b27bb9",
            "parentcaller": "0x76c222d7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4192
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "6328",
            "caller": "0x76c20f20",
            "parentcaller": "0x76c1e30f",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4193
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "6328",
            "caller": "0x77b27bb9",
            "parentcaller": "0x76c222d7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4194
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4195
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4196
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0316d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4197
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0316d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4198
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4199
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4200
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4201
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 4202
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x77999924",
            "parentcaller": "0x76c1c2f8",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006d4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 4203
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x7798ac59",
            "parentcaller": "0x7279cb7a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006bc"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4204
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c4"
              }
            ],
            "repeated": 0,
            "id": 4205
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c8"
              }
            ],
            "repeated": 0,
            "id": 4206
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WinHttpGetProxyForUrl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SessionHandle",
                "value": "0x0312fd00"
              },
              {
                "name": "Url",
                "value": "https://go.microsoft.com/fwlink/?LinkId=841361"
              }
            ],
            "repeated": 0,
            "id": 4207
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4208
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4209
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4210
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4211
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4212
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xaa\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4213
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4214
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xaa\\x08\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4215
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d23000"
              },
              {
                "name": "RegionSize",
                "value": "0x00014000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4216
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4217
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"663\" Fil=\"\" Fun=\"CSetupDiagnostics::LogString\" Uid=\"51019776\" Msg=\"ConnectToSourceUrl: Unable to retrieve proxy info for URL -&gt; [0x2f94].\" PID=\"5932\" TID=\"4312\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\Se"
              },
              {
                "name": "Length",
                "value": "334"
              }
            ],
            "repeated": 0,
            "id": 4218
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d23000"
              },
              {
                "name": "RegionSize",
                "value": "0x00014000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4219
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4220
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xaf5\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4221
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xaf5\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4222
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4223
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WinHttpConnect",
            "status": true,
            "return": "0x030e6608",
            "arguments": [
              {
                "name": "SessionHandle",
                "value": "0x03117698"
              },
              {
                "name": "ServerName",
                "value": "go.microsoft.com"
              },
              {
                "name": "ServerPort",
                "value": "443"
              }
            ],
            "repeated": 0,
            "id": 4224
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WinHttpOpenRequest",
            "status": true,
            "return": "0x030ceca8",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x030e6608"
              },
              {
                "name": "Verb",
                "value": "HEAD"
              },
              {
                "name": "ObjectName",
                "value": "/fwlink/?LinkId=841361"
              },
              {
                "name": "Version",
                "value": ""
              },
              {
                "name": "Referrer",
                "value": ""
              },
              {
                "name": "Flags",
                "value": "0x00800000"
              }
            ],
            "repeated": 0,
            "id": 4225
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WinHttpSetTimeouts",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x030ceca8"
              },
              {
                "name": "ResolveTimeout",
                "value": "120000"
              },
              {
                "name": "ConnectTimeout",
                "value": "120000"
              },
              {
                "name": "SendTimeout",
                "value": "120000"
              },
              {
                "name": "ReceiveTimeout",
                "value": "120000"
              }
            ],
            "repeated": 0,
            "id": 4226
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d23000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4227
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d52000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4228
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4229
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e5097",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b8"
              }
            ],
            "repeated": 0,
            "id": 4230
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x7279af1f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b4"
              }
            ],
            "repeated": 0,
            "id": 4231
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727a2629",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4232
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e50ec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006bc"
              }
            ],
            "repeated": 0,
            "id": 4233
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x77af2586",
            "parentcaller": "0x77af6986",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4234
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e40c8",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4235
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x7798ac59",
            "parentcaller": "0x7279cb7a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006e8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4236
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006f0"
              }
            ],
            "repeated": 0,
            "id": 4237
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006f4"
              }
            ],
            "repeated": 0,
            "id": 4238
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "6328",
            "caller": "0x69bb00dc",
            "parentcaller": "0x69bafb17",
            "category": "network",
            "api": "GetAddrInfoExW",
            "status": false,
            "return": "0x000003e5",
            "arguments": [
              {
                "name": "Name",
                "value": "go.microsoft.com"
              },
              {
                "name": "ServiceName",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4239
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x7797498d",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4240
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "6328",
            "caller": "0x75d21941",
            "parentcaller": "0x743770b3",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000494"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\Nsi"
              },
              {
                "name": "IoControlCode",
                "value": "0x00120007"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1b7t\\x08\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\xf2\\xa6\\x06\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1b7t\\x08\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\xf2\\xa6\\x06\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x18\\xf2\\xa6\\x06\\xb3p7t\\x01\\x00\\x00\\x000\\x1b7t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4241
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x75d21966",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4242
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4243
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e5097",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006e4"
              }
            ],
            "repeated": 0,
            "id": 4244
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727a2629",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006e0"
              }
            ],
            "repeated": 0,
            "id": 4245
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e50ec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006e8"
              }
            ],
            "repeated": 0,
            "id": 4246
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x77af2586",
            "parentcaller": "0x77af6986",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ec"
              }
            ],
            "repeated": 0,
            "id": 4247
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x6d2a16b1",
            "parentcaller": "0x75cc148c",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000003",
                "pretty_value": "FILE_READ_ACCESS|FILE_WRITE_ACCESS"
              },
              {
                "name": "FileName",
                "value": "\\Device\\RasAcd"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4248
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7468",
            "caller": "0x77999924",
            "parentcaller": "0x75cbf81d",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006e8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 4249
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e410c",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "4048"
              }
            ],
            "repeated": 0,
            "id": 4250
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7472",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4251
          },
          {
            "timestamp": "2026-05-28 22:59:41,363",
            "thread_id": "7472",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 4252
          },
          {
            "timestamp": "2026-05-28 22:59:41,378",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e414a",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 4253
          },
          {
            "timestamp": "2026-05-28 22:59:41,378",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4254
          },
          {
            "timestamp": "2026-05-28 22:59:41,378",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4255
          },
          {
            "timestamp": "2026-05-28 22:59:41,378",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e4186",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "4048"
              }
            ],
            "repeated": 0,
            "id": 4256
          },
          {
            "timestamp": "2026-05-28 22:59:41,378",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b04218",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4257
          },
          {
            "timestamp": "2026-05-28 22:59:41,378",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b046e3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d23000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4258
          },
          {
            "timestamp": "2026-05-28 22:59:41,378",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b046e3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d52000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4259
          },
          {
            "timestamp": "2026-05-28 22:59:41,378",
            "thread_id": "7456",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d55000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4260
          },
          {
            "timestamp": "2026-05-28 22:59:41,378",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d53000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4261
          },
          {
            "timestamp": "2026-05-28 22:59:41,378",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4262
          },
          {
            "timestamp": "2026-05-28 22:59:41,378",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d22000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4263
          },
          {
            "timestamp": "2026-05-28 22:59:41,378",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d22000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4264
          },
          {
            "timestamp": "2026-05-28 22:59:41,378",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4265
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4266
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4267
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d2c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4268
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03155000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4269
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d2c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4270
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4271
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d53000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4272
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e40c8",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 4273
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4274
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4275
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e410c",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "4048"
              }
            ],
            "repeated": 0,
            "id": 4276
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e414a",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 4277
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4278
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4279
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e4186",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "4048"
              }
            ],
            "repeated": 0,
            "id": 4280
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "6328",
            "caller": "0x75cbdc64",
            "parentcaller": "0x75cc4f9e",
            "category": "network",
            "api": "WSASocketW",
            "status": true,
            "return": "0x00000694",
            "arguments": [
              {
                "name": "af",
                "value": "23",
                "pretty_value": "AF_INET6"
              },
              {
                "name": "type",
                "value": "2",
                "pretty_value": "SOCK_DGRAM"
              },
              {
                "name": "protocol",
                "value": "0"
              },
              {
                "name": "socket",
                "value": "1684"
              }
            ],
            "repeated": 0,
            "id": 4281
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "6328",
            "caller": "0x6e61a714",
            "parentcaller": "0x75cbdd57",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000103",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000694"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\Afd"
              },
              {
                "name": "IoControlCode",
                "value": "0x000120bf",
                "pretty_value": "IOCTL_AFD_DEFER_ACCEPT"
              },
              {
                "name": "InputBuffer",
                "value": "\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\xc8\\x01\\x00\\x00\\x00h\\x94\\x11\\x03\\x0c\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x10\\x96\\x16\\x03\\x1c\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4282
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "6328",
            "caller": "0x6e61a9c5",
            "parentcaller": "0x6e61a75c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000538"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4283
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "6328",
            "caller": "0x6e61ac73",
            "parentcaller": "0x6e61aa9e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000694"
              }
            ],
            "repeated": 0,
            "id": 4284
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x69baf7b6",
            "parentcaller": "0x69bafd35",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4285
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x69bbb752",
            "parentcaller": "0x69bc1f5c",
            "category": "network",
            "api": "WSASocketW",
            "status": true,
            "return": "0x000006e4",
            "arguments": [
              {
                "name": "af",
                "value": "2",
                "pretty_value": "AF_INET"
              },
              {
                "name": "type",
                "value": "1",
                "pretty_value": "SOCK_STREAM"
              },
              {
                "name": "protocol",
                "value": "6",
                "pretty_value": "IPPROTO_TCP"
              },
              {
                "name": "socket",
                "value": "1764"
              }
            ],
            "repeated": 0,
            "id": 4286
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x69bbb827",
            "parentcaller": "0x69bc1f5c",
            "category": "network",
            "api": "setsockopt",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1764"
              },
              {
                "name": "level",
                "value": "0x0000ffff"
              },
              {
                "name": "optname",
                "value": "0x00003007"
              },
              {
                "name": "optval",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4287
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x69bbb878",
            "parentcaller": "0x69bc1f5c",
            "category": "network",
            "api": "bind",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1764"
              },
              {
                "name": "ip",
                "value": "0.0.0.0"
              },
              {
                "name": "port",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4288
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x69bbb8dc",
            "parentcaller": "0x69bc1f5c",
            "category": "network",
            "api": "setsockopt",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1764"
              },
              {
                "name": "level",
                "value": "0x00000006"
              },
              {
                "name": "optname",
                "value": "0x00000001"
              },
              {
                "name": "optval",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4289
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x75d52066",
            "parentcaller": "0x69bbba78",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006e4"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\Afd"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4290
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x77b2739f",
            "parentcaller": "0x77b271b6",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006e4"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\Afd"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "T\\x00\\x00\\x00\\x90h\\x16\\x03"
              }
            ],
            "repeated": 0,
            "id": 4291
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x69baee81",
            "parentcaller": "0x69bc1fa6",
            "category": "network",
            "api": "ConnectEx",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1764"
              },
              {
                "name": "SendBuffer",
                "value": ""
              },
              {
                "name": "ip",
                "value": "23.202.166.58"
              },
              {
                "name": "port",
                "value": "443"
              }
            ],
            "repeated": 0,
            "id": 4292
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x7798ab1a",
            "parentcaller": "0x75cb5ad9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006f4"
              }
            ],
            "repeated": 0,
            "id": 4293
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x77af2586",
            "parentcaller": "0x77af6986",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006f0"
              }
            ],
            "repeated": 0,
            "id": 4294
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x69bc2329",
            "parentcaller": "0x69bae296",
            "category": "network",
            "api": "setsockopt",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1764"
              },
              {
                "name": "level",
                "value": "0x0000ffff"
              },
              {
                "name": "optname",
                "value": "0x00007010"
              },
              {
                "name": "optval",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4295
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x6e62ac5d",
            "parentcaller": "0x75cc234d",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006e4"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\Afd"
              },
              {
                "name": "IoControlCode",
                "value": "0x0001202f",
                "pretty_value": "IOCTL_AFD_GET_SOCK_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x02\\x00\\xc2'\\xc0\\xa8\\x01i\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4296
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x74d97592",
            "parentcaller": "0x74da158b",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xf0\\xce\\x00,\\x17\\x00\\x000\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7472"
              }
            ],
            "repeated": 0,
            "id": 4297
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x77999924",
            "parentcaller": "0x76c1c2f8",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006f4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 4298
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xf0\\xce\\x00,\\x17\\x00\\x000\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7472"
              }
            ],
            "repeated": 0,
            "id": 4299
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x69bab419",
            "parentcaller": "0x69bc2d0d",
            "category": "network",
            "api": "WSASend",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Socket",
                "value": "1764"
              },
              {
                "name": "Buffer",
                "value": "\\x16\\x03\\x03\\x00\\xb2\\x01\\x00\\x00\\xae\\x03\\x03j\\x18\\xc8\\xdd\\xcc\\x0c\\x06\\xad\\x19\\xb4\\xd9w-%\\x19\\x122)\\xbb\\xa1%\\xa2\\xec\\3p\\xdf\\xcd\\xc7\\xe4J}\\x00\\x00&\\xc0,\\xc0+\\xc00\\xc0/\\xc0$\\xc0#\\xc0(\\xc0'\\xc0\n\\xc0\t\\xc0\\x14\\xc0\\x13\\x00\\x9d\\x00\\x9c\\x00=\\x00<\\x005\\x00/\\x00\n\\x01\\x00\\x00_\\x00\\x00\\x00\\x15\\x00\\x13\\x00\\x00\\x10go.microsoft.com\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\n\\x00\\x08\\x00\\x06\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00\r\\x00\\x1a\\x00\\x18\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x02\\x01\\x04\\x03\\x05\\x03\\x02\\x03\\x02\\x02\\x06\\x01\\x06\\x03\\x00#\\x00\\x00\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 4300
          },
          {
            "timestamp": "2026-05-28 22:59:41,394",
            "thread_id": "7472",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1764"
              }
            ],
            "repeated": 0,
            "id": 4301
          },
          {
            "timestamp": "2026-05-28 22:59:41,410",
            "thread_id": "7472",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xf0\\xce\\x00,\\x17\\x00\\x000\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7472"
              }
            ],
            "repeated": 0,
            "id": 4302
          },
          {
            "timestamp": "2026-05-28 22:59:41,410",
            "thread_id": "7472",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xf0\\xce\\x00,\\x17\\x00\\x000\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7472"
              }
            ],
            "repeated": 0,
            "id": 4303
          },
          {
            "timestamp": "2026-05-28 22:59:41,410",
            "thread_id": "7472",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1764"
              }
            ],
            "repeated": 0,
            "id": 4304
          },
          {
            "timestamp": "2026-05-28 22:59:41,410",
            "thread_id": "7472",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xf0\\xce\\x00,\\x17\\x00\\x000\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7472"
              }
            ],
            "repeated": 0,
            "id": 4305
          },
          {
            "timestamp": "2026-05-28 22:59:41,410",
            "thread_id": "7472",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1764"
              }
            ],
            "repeated": 0,
            "id": 4306
          },
          {
            "timestamp": "2026-05-28 22:59:41,410",
            "thread_id": "7472",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xf0\\xce\\x00,\\x17\\x00\\x000\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7472"
              }
            ],
            "repeated": 0,
            "id": 4307
          },
          {
            "timestamp": "2026-05-28 22:59:41,410",
            "thread_id": "7472",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1764"
              }
            ],
            "repeated": 0,
            "id": 4308
          },
          {
            "timestamp": "2026-05-28 22:59:41,410",
            "thread_id": "7472",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xf0\\xce\\x00,\\x17\\x00\\x000\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7472"
              }
            ],
            "repeated": 0,
            "id": 4309
          },
          {
            "timestamp": "2026-05-28 22:59:41,410",
            "thread_id": "7472",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1764"
              }
            ],
            "repeated": 0,
            "id": 4310
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xf0\\xce\\x00,\\x17\\x00\\x000\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7472"
              }
            ],
            "repeated": 0,
            "id": 4311
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x69bab419",
            "parentcaller": "0x69bc2d0d",
            "category": "network",
            "api": "WSASend",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Socket",
                "value": "1764"
              },
              {
                "name": "Buffer",
                "value": "\\x16\\x03\\x03\\x00F\\x10\\x00\\x00BA\\x04\\x92\\xfb\\xe0\\xfd\\xbd\\x80\\x10\\xbf\\xfag\\x84\\xd4\\x99\\x90\\\\x8fD\\x9d\\xa9\\xfc\\x9b\\x9e\\xca\\xfd\\x08\\xcc\\x9d^\\x8f\\xc9p\\x81<S\\xb4|\\xcft\\xd0-\\xcd*i;>4\\xdb\\xb7I\\x1d\\xd4!%\\xcfT\\xd2\\xfbl\\xf5\\xff\\xe8\\xb0\\xad\\xcb\\x14\\x03\\x03\\x00\\x01\\x01\\x16\\x03\\x03\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08]\\xe1\\xa4[<\\x7fY\\xea\\xb3s\\xa0?\\x12]\\x05\\xc6\\x079L^\\x80q#\\x11Y\\xac\\x16\\x96\\xc1}\\x80"
              }
            ],
            "repeated": 0,
            "id": 4312
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1764"
              }
            ],
            "repeated": 0,
            "id": 4313
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xf0\\xce\\x00,\\x17\\x00\\x000\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7472"
              }
            ],
            "repeated": 0,
            "id": 4314
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x6d125d74",
            "parentcaller": "0x70dd3f73",
            "category": "crypto",
            "api": "BCryptImportKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyBlob",
                "value": "0\\x02\\x00\\x00KSSM\\x02\\x00\\x01\\x00\\x05\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x01\\x00\\x00 \\x00\\x00\\x00\\x01\\x8d\\xb1\\xe0M\\xf4\\xbe\\xd9\\xcc\\xe0\\xf4\\xae\\xc5?\\x980\\xa9\\xc88Od\\xe1\\xef\\x04h\\xf5\\xb8'\\xf0\\x91\\x1eM\\x00\\x00\\x00\\x00\\x01\\x8d\\xb1\\xe0M\\xf4\\xbe\\xd9\\xcc\\xe0\\xf4\\xae\\xc5?\\x980\\xa9\\xc88Od\\xe1\\xef\\x04h\\xf5\\xb8'\\xf0\\x91\\x1eM\\x81\\xffRl\\xcc\\x0b\\xec\\xb5\\x00\\xeb\\x18\\x1b\\xc5\\xd4\\x80+\\x0f\\x80\\xf5\\xbeka\\x1a\\xba\\x03\\x94\\xa2\\x9d\\xf3\\x05\\xbc\\xd0\\xe8\\x9a\"a$\\x91\\xce\\xd4$z\\xd6\\xcf\\xe1\\xaeV\\xe4\\xf7dD\\xd7\\x9c\\x05^m\\x9f\\x91\\xfc\\xf0l\\x94@ \\xce\\x93\\x951\\xea\\x02[\\xe5\\xcex\\x8d*/\\xd6\\xdb\\xce\\xe2\\x92\\xfd\\~\\x97\\xa31\\xe1\\x06_\\xc1\\x8d\\x92\\x1f\\xe1\\x89SmlcQ6\\x89\\xad)\\xbb\\xa3\\x82\\xff`m\\xf1\\x84-`\\x8f\\x13\\x8eQn\\x15\\xd1\\x90\\xe3\\x87\\xceq\\x8e\\xd8\\xce}\\xed\\x89\\xf8\\xf4@\\xa0CW\\xc2_#:\\xd4K\\x0b\\xe0[X\\x85\\xb15MT!\\xd6\\xca\\x9aP"
              },
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "CryptKey",
                "value": "0x06d498b0"
              },
              {
                "name": "Length",
                "value": "560"
              }
            ],
            "repeated": 0,
            "id": 4315
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x6d125d74",
            "parentcaller": "0x70dd3f73",
            "category": "crypto",
            "api": "BCryptImportKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyBlob",
                "value": "0\\x02\\x00\\x00KSSM\\x02\\x00\\x01\\x00\\x05\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x01\\x00\\x00 \\x00\\x00\\x00\\xd0l\\x0eq\\x9c\\x9c\\xfa\\xf1\\xa7\\x1cr]\\x8d~6\\x85\\x1d\\xd1Mf\\xa9\\xf9\\x0fF\\xf0\\xb5O\\xdd'\\xe3!\\xf6\\x00\\x00\\x00\\x00\\xd0l\\x0eq\\x9c\\x9c\\xfa\\xf1\\xa7\\x1cr]\\x8d~6\\x85\\x1d\\xd1Mf\\xa9\\xf9\\x0fF\\xf0\\xb5O\\xdd'\\xe3!\\xf6\\xc0\\x91L\\xbd\\\r\\xb6L\\xfb\\x11\\xc4\\x11vo\\xf2\\x94%y\\xc4D\\x8c\\x80\\xcb\\x02|5\\x84\\xdf[\\xd6\\xa5)4\\x97\\xe9\\x84h\\x9a_\\xc8\\x93\\x8b\\x9b\\xd9\\xe5\\xe4iM\\xfc\\x10=\\xa7p\\x90\\xf6\\xa5\\x0c\\xa5rzWs\\xd7S\\xbf\\x99\\x04\\xdf\\xd7\\x03[\\x17D\\x88\\xc0\\xce\\xa1l\\xa9\\x83\\xce@\\xeeK\\xbe\\xd0\\x18\\xee\\xb2uj\\x94\\xe5\\x06\\xbd\\xc7\\xd8\\xe3\\xc2\\x06\\x0f\\xe0\\x99\\x11KhY\\xdf\\xea\\x04\\xf0\\I\\xb2b\\x01\\xf7bz\\xefE\\x17\\x10{\\xa0\\x11\\xad\\xbcJv\\xa7\\xe6E\\x96>\\xf7\\x0e\\xfeg(\\xe4\\xfa\\x97t \\x9f\\xea\\x93\\xd7\\xfd\\x90|\\x92\\xea\\x80\\x072\\xfb-\\xbb"
              },
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "CryptKey",
                "value": "0x03168190"
              },
              {
                "name": "Length",
                "value": "560"
              }
            ],
            "repeated": 0,
            "id": 4316
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff6118",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\tf0\\x82\\x07N\\xa0\\x03\\x02\\x01\\x02\\x02\\x13U\\x00\\x03\\x8cJa-\\xb3K\\xd8a\\xfb\\x95\\x00\\x00\\x00\\x03\\x8cJ0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0c\\x05\\x000W1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft TLS G2 RSA CA OCSP 160\\x1e\\x17\r260123160305Z\\x17\r270118160305Z0g1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x0b0\t\\x06\\x03U\\x04\\x08\\x13\\x02WA1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1\\x190\\x17\\x06\\x03U\\x04"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4317
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff6118",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x07\\xb80\\x82\\x05\\xa0\\xa0\\x03\\x02\\x01\\x02\\x02\\x133\\x00\\x00\\x00\\x0eB\\x93\\x8f%\\xdcQ\\xa9\\x9b\\x00\\x00\\x00\\x00\\x00\\x0e0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0c\\x05\\x000Q1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1\"0 \\x06\\x03U\\x04\\x03\\x13\\x19Microsoft TLS RSA Root G20\\x1e\\x17\r250801200302Z\\x17\r290603200302Z0W1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft TLS G2 RSA CA OCSP 160\\x82\\x02"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4318
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff6118",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x05\\x890\\x82\\x04q\\xa0\\x03\\x02\\x01\\x02\\x02\\x10\\x0b\\x0ck,Fi\\x17\\xb0Gs\\xc6G\\xd4\\xaf\\xc0\\xc80\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0c\\x05\\x000a1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cDigiCert Inc1\\x190\\x17\\x06\\x03U\\x04\\x0b\\x13\\x10www.digicert.com1 0\\x1e\\x06\\x03U\\x04\\x03\\x13\\x17DigiCert Global Root G20\\x1e\\x17\r250521000000Z\\x17\r290619235959Z0Q1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1\"0 \\x06\\x03U\\x04\\x03\\x13\\x19Microsoft TLS RSA Roo"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4319
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x775c09b0",
            "parentcaller": "0x775c0ab4",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000001d0"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\KsecDD"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390400"
              },
              {
                "name": "InputBuffer",
                "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00S\\x00H\\x00A\\x003\\x008\\x004\\x00\\x00\\x00\\xa2\\x89"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00A\\x003\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffS\\x00H\\x00A\\x003\\x008\\x004\\x00\\x00\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4320
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x77991b7a",
            "parentcaller": "0x775c12a6",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76ba0000"
              },
              {
                "name": "FunctionName",
                "value": "GetHashInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x76bb5880"
              }
            ],
            "repeated": 0,
            "id": 4321
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff6118",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\tf0\\x82\\x07N\\xa0\\x03\\x02\\x01\\x02\\x02\\x13U\\x00\\x03\\x8cJa-\\xb3K\\xd8a\\xfb\\x95\\x00\\x00\\x00\\x03\\x8cJ0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0c\\x05\\x000W1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft TLS G2 RSA CA OCSP 160\\x1e\\x17\r260123160305Z\\x17\r270118160305Z0g1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x0b0\t\\x06\\x03U\\x04\\x08\\x13\\x02WA1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1\\x190\\x17\\x06\\x03U\\x04"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4322
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff6118",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x07\\xb80\\x82\\x05\\xa0\\xa0\\x03\\x02\\x01\\x02\\x02\\x133\\x00\\x00\\x00\\x0eB\\x93\\x8f%\\xdcQ\\xa9\\x9b\\x00\\x00\\x00\\x00\\x00\\x0e0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0c\\x05\\x000Q1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1\"0 \\x06\\x03U\\x04\\x03\\x13\\x19Microsoft TLS RSA Root G20\\x1e\\x17\r250801200302Z\\x17\r290603200302Z0W1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft TLS G2 RSA CA OCSP 160\\x82\\x02"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4323
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff6118",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x05\\x890\\x82\\x04q\\xa0\\x03\\x02\\x01\\x02\\x02\\x10\\x0b\\x0ck,Fi\\x17\\xb0Gs\\xc6G\\xd4\\xaf\\xc0\\xc80\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0c\\x05\\x000a1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cDigiCert Inc1\\x190\\x17\\x06\\x03U\\x04\\x0b\\x13\\x10www.digicert.com1 0\\x1e\\x06\\x03U\\x04\\x03\\x13\\x17DigiCert Global Root G20\\x1e\\x17\r250521000000Z\\x17\r290619235959Z0Q1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1\"0 \\x06\\x03U\\x04\\x03\\x13\\x19Microsoft TLS RSA Roo"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4324
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x77b2c23d",
            "parentcaller": "0x77b2c181",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006bc"
              }
            ],
            "repeated": 0,
            "id": 4325
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x77b2c245",
            "parentcaller": "0x77b2c181",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4326
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x77989e76",
            "parentcaller": "0x76fe85fb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4327
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x7798ab1a",
            "parentcaller": "0x76fe8618",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4328
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x76fe8798",
            "parentcaller": "0x76fe8278",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4329
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000638"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4330
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ValueName",
                "value": "27E6663299D340DFE54571CECCEC01BE74495DC6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6"
              }
            ],
            "repeated": 0,
            "id": 4331
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "27E6663299D340DFE54571CECCEC01BE74495DC6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6"
              }
            ],
            "repeated": 0,
            "id": 4332
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4333
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000063c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4334
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ValueName",
                "value": "27E6663299D340DFE54571CECCEC01BE74495DC6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6"
              }
            ],
            "repeated": 0,
            "id": 4335
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "27E6663299D340DFE54571CECCEC01BE74495DC6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6"
              }
            ],
            "repeated": 0,
            "id": 4336
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4337
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 4338
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\SystemCertificates\\Root"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 4339
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4340
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006bc"
              },
              {
                "name": "ValueName",
                "value": "27E6663299D340DFE54571CECCEC01BE74495DC6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6"
              }
            ],
            "repeated": 0,
            "id": 4341
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006bc"
              },
              {
                "name": "ObjectAttributesName",
                "value": "27E6663299D340DFE54571CECCEC01BE74495DC6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6"
              }
            ],
            "repeated": 0,
            "id": 4342
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006bc"
              }
            ],
            "repeated": 0,
            "id": 4343
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8148",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4344
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000640"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4345
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ValueName",
                "value": "27E6663299D340DFE54571CECCEC01BE74495DC6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6"
              }
            ],
            "repeated": 0,
            "id": 4346
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "27E6663299D340DFE54571CECCEC01BE74495DC6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6"
              }
            ],
            "repeated": 0,
            "id": 4347
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4348
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000644"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4349
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ValueName",
                "value": "27E6663299D340DFE54571CECCEC01BE74495DC6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6"
              }
            ],
            "repeated": 0,
            "id": 4350
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "27E6663299D340DFE54571CECCEC01BE74495DC6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6"
              }
            ],
            "repeated": 0,
            "id": 4351
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4352
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 4353
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\SystemCertificates\\CA"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\CA"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 4354
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4355
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006bc"
              },
              {
                "name": "ValueName",
                "value": "27E6663299D340DFE54571CECCEC01BE74495DC6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6"
              }
            ],
            "repeated": 0,
            "id": 4356
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006bc"
              },
              {
                "name": "ObjectAttributesName",
                "value": "27E6663299D340DFE54571CECCEC01BE74495DC6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6"
              }
            ],
            "repeated": 0,
            "id": 4357
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006bc"
              }
            ],
            "repeated": 0,
            "id": 4358
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8148",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4359
          },
          {
            "timestamp": "2026-05-28 22:59:41,425",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000648"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4360
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ValueName",
                "value": "27E6663299D340DFE54571CECCEC01BE74495DC6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6"
              }
            ],
            "repeated": 0,
            "id": 4361
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "27E6663299D340DFE54571CECCEC01BE74495DC6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6"
              }
            ],
            "repeated": 0,
            "id": 4362
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4363
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000638"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4364
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ValueName",
                "value": "B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              }
            ],
            "repeated": 0,
            "id": 4365
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              }
            ],
            "repeated": 0,
            "id": 4366
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4367
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000063c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4368
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ValueName",
                "value": "B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              }
            ],
            "repeated": 0,
            "id": 4369
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              }
            ],
            "repeated": 0,
            "id": 4370
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4371
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 4372
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\SystemCertificates\\Root"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 4373
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4374
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006bc"
              },
              {
                "name": "ValueName",
                "value": "B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              }
            ],
            "repeated": 0,
            "id": 4375
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006bc"
              },
              {
                "name": "ObjectAttributesName",
                "value": "B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              }
            ],
            "repeated": 0,
            "id": 4376
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006bc"
              }
            ],
            "repeated": 0,
            "id": 4377
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8148",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4378
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000640"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4379
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ValueName",
                "value": "B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              }
            ],
            "repeated": 0,
            "id": 4380
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              }
            ],
            "repeated": 0,
            "id": 4381
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4382
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000644"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4383
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ValueName",
                "value": "B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              }
            ],
            "repeated": 0,
            "id": 4384
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              }
            ],
            "repeated": 0,
            "id": 4385
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4386
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 4387
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\SystemCertificates\\CA"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\CA"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 4388
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4389
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006bc"
              },
              {
                "name": "ValueName",
                "value": "B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              }
            ],
            "repeated": 0,
            "id": 4390
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006bc"
              },
              {
                "name": "ObjectAttributesName",
                "value": "B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              }
            ],
            "repeated": 0,
            "id": 4391
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006bc"
              }
            ],
            "repeated": 0,
            "id": 4392
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8148",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4393
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000648"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4394
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ValueName",
                "value": "B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              }
            ],
            "repeated": 0,
            "id": 4395
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184"
              }
            ],
            "repeated": 0,
            "id": 4396
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4397
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000638"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4398
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ValueName",
                "value": "DF3C24F9BFD666761B268073FE06D1CC8D4F82A4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4"
              }
            ],
            "repeated": 0,
            "id": 4399
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "DF3C24F9BFD666761B268073FE06D1CC8D4F82A4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4"
              }
            ],
            "repeated": 0,
            "id": 4400
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4401
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000063c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4402
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ValueName",
                "value": "DF3C24F9BFD666761B268073FE06D1CC8D4F82A4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4"
              }
            ],
            "repeated": 0,
            "id": 4403
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "DF3C24F9BFD666761B268073FE06D1CC8D4F82A4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4"
              }
            ],
            "repeated": 0,
            "id": 4404
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006bc"
              },
              {
                "name": "ValueName",
                "value": "Blob"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\\Blob"
              }
            ],
            "repeated": 1,
            "id": 4405
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x779cecbb",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006bc"
              },
              {
                "name": "ValueName",
                "value": "Blob"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x14\\xc3\\xbd5I\\xee\"Z\\xec\\xe174\\xad\\x8c\\xa0\\xb8\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xdf<$\\xf9\\xbf\\xd6fv\\x1b&\\x80s\\xfe\\x06\\xd1\\xcc\\x8dO\\x82\\xa4~\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x80\\xc8+h\\x86\\xd7\\x01\\x7f\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x000\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x03\\x1d\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00}\\xc3\\x0b\\xc9tiU`\\xa2\\xf0\t\neEUl\\x14\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00N\"T \\x18\\x95\\xe6\\xe3n\\xe6\\x0f\\xfa\\xfa\\xb9\\x12\\xed\\x06\\x17\\x8f9b\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00\\xcb<\\xcb\\xb7`1\\xe5\\xe0\\x13\\x8f\\x8d\\xd3\\x9a#\\xf9\\xdeG\\xff\\xc3^C\\xc1\\x14L\\xea'\\xd4jZ\\xb1\\xcb_\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00D\\x00i\\x00g\\x00i\\x00C\\x00e\\x00r\\x00t\\x00 \\x00G\\x00l\\x00o\\x00b\\x00a\\x00l\\x00 \\x00R\\x00o\\x00o\\x00t\\x00 \\x00G\\x002\\x00\\x00\\x00\t\\x00\\x00\\x00\\x01\\x00\\x00\\x004\\x00\\x00\\x0002\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x03\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x04\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x08S\\x00\\x00\\x00\\x01\\x00\\x00\\x00@\\x00\\x00\\x000>0\\x1f\\x06\t`\\x86H\\x01\\x86\\xfdl\\x02\\x010\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc00\\x1b\\x06\\x05g\\x81\\x0c\\x01\\x030\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc0\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00KN\\xb4\\xb0t)\\x8b\\x82\\x8b\\\\x000\\x95\\xa1\\x0bE#\\xfb\\x95\\x1c\\x0c\\x884\\x8b\t\\xc5>[\\xab\\xa4\\x08\\xa3\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xe4\\xa6\\x8a\\xc8T\\xacRBF\n\\xfdrH\\x1b*D \\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x92\\x03\\x00\\x000\\x82\\x03\\x8e"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\\Blob"
              }
            ],
            "repeated": 0,
            "id": 4406
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff2a67",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006bc"
              }
            ],
            "repeated": 0,
            "id": 4407
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4408
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff69bd",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x03\\x8e0\\x82\\x02v\\xa0\\x03\\x02\\x01\\x02\\x02\\x10\\x03:\\xf1\\xe6\\xa7\\x11\\xa9\\xa0\\xbb(d\\xb1\\x1d\t\\xfa\\xe50\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000a1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cDigiCert Inc1\\x190\\x17\\x06\\x03U\\x04\\x0b\\x13\\x10www.digicert.com1 0\\x1e\\x06\\x03U\\x04\\x03\\x13\\x17DigiCert Global Root G20\\x1e\\x17\r130801120000Z\\x17\r380115120000Z0a1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cDigiCert Inc1\\x190\\x17\\x06\\x03U\\x04\\x0b\\x13\\x10www.digicert.com1 0\\x1e\\x06\\x03U\\x04\\x03\\x13\\x17Dig"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4409
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x76fe9148",
            "parentcaller": "0x76fe90fd",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0P\\x82\\x11go2.microsoft.com\\x82\\x10go.microsoft.com\\x82\nwww.aka.ms\\x82\\x06aka.ms\\x82\\x15fast.go.microsoft.com"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4410
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x77003ac2",
            "parentcaller": "0x76febd4a",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00010001"
              },
              {
                "name": "Encoded",
                "value": "1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x01"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4411
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x76fea2a6",
            "parentcaller": "0x76fe9622",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 4412
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x6d196967",
            "parentcaller": "0x6d194f89",
            "category": "network",
            "api": "SslEncryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "HEAD /fwlink/?LinkId=841361 HTTP/1.1\r\nConnection: Keep-Alive\r\nUser-Agent: Windows Dlp Manager\r\nHost: go.microsoft.com\r\n\r\n"
              },
              {
                "name": "SequenceNumber",
                "value": "1"
              },
              {
                "name": "BufferSize",
                "value": "121"
              }
            ],
            "repeated": 0,
            "id": 4413
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x69bab419",
            "parentcaller": "0x69baae23",
            "category": "network",
            "api": "WSASend",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Socket",
                "value": "1764"
              },
              {
                "name": "Buffer",
                "value": "\\x17\\x03\\x03\\x00\\x91\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01WT\\xb6\\xee\\xa7\\xac\\xf9<\\xfc$\\xd644\\x99U\\xa5\\xe0\\xb4\\xba\\xa3\\xa8\\xb5,\\x1d\\xad\\xca\\x9e\\x12JT=xb\\xa1\\xfd\\x82\\x80b\\xf2\\x89\\xf5h\\x01D\\xfe\\xf7\\xe3\\xa6\\xef\\xb8q\\xb7\\x05\\xd7\\x9a\\x99\\xa3\\xf5s\\x06\\xfa\\x83$9\\xb3D\\x14,*gvW\\xab4\\xcfc\\xaar\\x00Q\\xb5\\x97K\\xb5\\xe3\\xeb\\x84\\x1e\\x0f\\x05\\x835M\\xbc\\xd6\\xcb\\x874\\x14]\\x81Mcc\\xf0\\xf5\\xed\\xc3\\xbdlTW:\\x06\\x000\\x8e\\x9e\\xff2P\\x19\\xb7pDl\\xe7\\x8d\\xd2z+\\xd2l\\x08cZ\\xe6"
              }
            ],
            "repeated": 0,
            "id": 4414
          },
          {
            "timestamp": "2026-05-28 22:59:41,441",
            "thread_id": "7472",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1764"
              }
            ],
            "repeated": 0,
            "id": 4415
          },
          {
            "timestamp": "2026-05-28 22:59:41,691",
            "thread_id": "7472",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "HTTP/1.1 302 Moved Temporarily\r\nServer: Kestrel\r\nLocation: https://download.microsoft.com/download/7/9/c/79cbc22a-0eea-4a0d-89c0-054a1b3aa8e0/products.cab\r\nRequest-Context: appId=cid-v1:d94c0f68-64bf-4036-8409-a0e761bb7ee1\r\nX-Response-Cache-Status: True\r\nContent-Length: 0\r\nExpires: Thu, 28 May 2026 15:59:45 GMT\r\nCache-Control: max-age=0, no-cache, no-store\r\nPragma: no-cache\r\nDate: Thu, 28 May 2026 15:59:45 GMT\r\nConnection: keep-alive\r\nStrict-Transport-Security: max-age=31536000 ; includeSubDomains\r\n\r\n"
              },
              {
                "name": "SequenceNumber",
                "value": "1"
              },
              {
                "name": "BufferSize",
                "value": "506"
              }
            ],
            "repeated": 0,
            "id": 4416
          },
          {
            "timestamp": "2026-05-28 22:59:41,691",
            "thread_id": "7472",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1764"
              }
            ],
            "repeated": 0,
            "id": 4417
          },
          {
            "timestamp": "2026-05-28 22:59:41,691",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WinHttpSendRequest",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x030ceca8"
              },
              {
                "name": "Headers",
                "value": ""
              },
              {
                "name": "Optional",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4418
          },
          {
            "timestamp": "2026-05-28 22:59:41,691",
            "thread_id": "6328",
            "caller": "0x7798ac59",
            "parentcaller": "0x7279cb7a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4419
          },
          {
            "timestamp": "2026-05-28 22:59:41,691",
            "thread_id": "6328",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b8"
              }
            ],
            "repeated": 0,
            "id": 4420
          },
          {
            "timestamp": "2026-05-28 22:59:41,691",
            "thread_id": "6328",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006f8"
              }
            ],
            "repeated": 0,
            "id": 4421
          },
          {
            "timestamp": "2026-05-28 22:59:41,691",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e5097",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006bc"
              }
            ],
            "repeated": 0,
            "id": 4422
          },
          {
            "timestamp": "2026-05-28 22:59:41,691",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727a2629",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4423
          },
          {
            "timestamp": "2026-05-28 22:59:41,691",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e50ec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4424
          },
          {
            "timestamp": "2026-05-28 22:59:41,691",
            "thread_id": "6328",
            "caller": "0x77af2586",
            "parentcaller": "0x77af6986",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b4"
              }
            ],
            "repeated": 0,
            "id": 4425
          },
          {
            "timestamp": "2026-05-28 22:59:41,691",
            "thread_id": "7472",
            "caller": "0x69bb00dc",
            "parentcaller": "0x69bafb17",
            "category": "network",
            "api": "GetAddrInfoExW",
            "status": false,
            "return": "0x000003e5",
            "arguments": [
              {
                "name": "Name",
                "value": "download.microsoft.com"
              },
              {
                "name": "ServiceName",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4426
          },
          {
            "timestamp": "2026-05-28 22:59:41,691",
            "thread_id": "7468",
            "caller": "0x6d2a16b1",
            "parentcaller": "0x75cc148c",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000003",
                "pretty_value": "FILE_READ_ACCESS|FILE_WRITE_ACCESS"
              },
              {
                "name": "FileName",
                "value": "\\Device\\RasAcd"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4427
          },
          {
            "timestamp": "2026-05-28 22:59:41,691",
            "thread_id": "6328",
            "caller": "0x75d21941",
            "parentcaller": "0x743770b3",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000494"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\Nsi"
              },
              {
                "name": "IoControlCode",
                "value": "0x00120007"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1b7t\\x08\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\xf2\\xa6\\x06\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x1b7t\\x08\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\xf2\\xa6\\x06\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x18\\xf2\\xa6\\x06\\xb3p7t\\x01\\x00\\x00\\x000\\x1b7t\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4428
          },
          {
            "timestamp": "2026-05-28 22:59:41,691",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x75d21966",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4429
          },
          {
            "timestamp": "2026-05-28 22:59:41,816",
            "thread_id": "6328",
            "caller": "0x75cbdc64",
            "parentcaller": "0x75cc4f9e",
            "category": "network",
            "api": "WSASocketW",
            "status": true,
            "return": "0x000006c0",
            "arguments": [
              {
                "name": "af",
                "value": "23",
                "pretty_value": "AF_INET6"
              },
              {
                "name": "type",
                "value": "2",
                "pretty_value": "SOCK_DGRAM"
              },
              {
                "name": "protocol",
                "value": "0"
              },
              {
                "name": "socket",
                "value": "1728"
              }
            ],
            "repeated": 0,
            "id": 4430
          },
          {
            "timestamp": "2026-05-28 22:59:41,816",
            "thread_id": "6328",
            "caller": "0x6e61a714",
            "parentcaller": "0x75cbdd57",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000103",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c0"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\Afd"
              },
              {
                "name": "IoControlCode",
                "value": "0x000120bf",
                "pretty_value": "IOCTL_AFD_DEFER_ACCEPT"
              },
              {
                "name": "InputBuffer",
                "value": "\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\xc8\\x01\\x00\\x00\\x00(\\x95\\x11\\x03\\x0c\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x611\\x16\\x03\\x1c\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4431
          },
          {
            "timestamp": "2026-05-28 22:59:41,816",
            "thread_id": "6328",
            "caller": "0x6e61a9c5",
            "parentcaller": "0x6e61a75c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000538"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4432
          },
          {
            "timestamp": "2026-05-28 22:59:41,816",
            "thread_id": "6328",
            "caller": "0x6e61ac73",
            "parentcaller": "0x6e61aa9e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4433
          },
          {
            "timestamp": "2026-05-28 22:59:41,816",
            "thread_id": "7468",
            "caller": "0x69baf7b6",
            "parentcaller": "0x69bafd35",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4434
          },
          {
            "timestamp": "2026-05-28 22:59:41,816",
            "thread_id": "7468",
            "caller": "0x69bbb752",
            "parentcaller": "0x69bc1f5c",
            "category": "network",
            "api": "WSASocketW",
            "status": true,
            "return": "0x000006bc",
            "arguments": [
              {
                "name": "af",
                "value": "2",
                "pretty_value": "AF_INET"
              },
              {
                "name": "type",
                "value": "1",
                "pretty_value": "SOCK_STREAM"
              },
              {
                "name": "protocol",
                "value": "6",
                "pretty_value": "IPPROTO_TCP"
              },
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 4435
          },
          {
            "timestamp": "2026-05-28 22:59:41,816",
            "thread_id": "7468",
            "caller": "0x69bbb827",
            "parentcaller": "0x69bc1f5c",
            "category": "network",
            "api": "setsockopt",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              },
              {
                "name": "level",
                "value": "0x0000ffff"
              },
              {
                "name": "optname",
                "value": "0x00003007"
              },
              {
                "name": "optval",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4436
          },
          {
            "timestamp": "2026-05-28 22:59:41,816",
            "thread_id": "7468",
            "caller": "0x69bbb878",
            "parentcaller": "0x69bc1f5c",
            "category": "network",
            "api": "bind",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              },
              {
                "name": "ip",
                "value": "0.0.0.0"
              },
              {
                "name": "port",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4437
          },
          {
            "timestamp": "2026-05-28 22:59:41,816",
            "thread_id": "7468",
            "caller": "0x69bbb8dc",
            "parentcaller": "0x69bc1f5c",
            "category": "network",
            "api": "setsockopt",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              },
              {
                "name": "level",
                "value": "0x00000006"
              },
              {
                "name": "optname",
                "value": "0x00000001"
              },
              {
                "name": "optval",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4438
          },
          {
            "timestamp": "2026-05-28 22:59:41,816",
            "thread_id": "7468",
            "caller": "0x75d52066",
            "parentcaller": "0x69bbba78",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006bc"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\Afd"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4439
          },
          {
            "timestamp": "2026-05-28 22:59:41,816",
            "thread_id": "7468",
            "caller": "0x77b2739f",
            "parentcaller": "0x77b271b6",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006bc"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\Afd"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "T\\x00\\x00\\x00\\xc0c\\xd2\\x06"
              }
            ],
            "repeated": 0,
            "id": 4440
          },
          {
            "timestamp": "2026-05-28 22:59:41,816",
            "thread_id": "7468",
            "caller": "0x69baee81",
            "parentcaller": "0x69bc1fa6",
            "category": "network",
            "api": "ConnectEx",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              },
              {
                "name": "SendBuffer",
                "value": ""
              },
              {
                "name": "ip",
                "value": "23.202.165.103"
              },
              {
                "name": "port",
                "value": "443"
              }
            ],
            "repeated": 0,
            "id": 4441
          },
          {
            "timestamp": "2026-05-28 22:59:41,816",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x75cb5ad9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b4"
              }
            ],
            "repeated": 0,
            "id": 4442
          },
          {
            "timestamp": "2026-05-28 22:59:41,816",
            "thread_id": "7468",
            "caller": "0x77af2586",
            "parentcaller": "0x77af6986",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4443
          },
          {
            "timestamp": "2026-05-28 22:59:41,831",
            "thread_id": "7468",
            "caller": "0x69bc2329",
            "parentcaller": "0x69bae296",
            "category": "network",
            "api": "setsockopt",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              },
              {
                "name": "level",
                "value": "0x0000ffff"
              },
              {
                "name": "optname",
                "value": "0x00007010"
              },
              {
                "name": "optval",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4444
          },
          {
            "timestamp": "2026-05-28 22:59:41,831",
            "thread_id": "7468",
            "caller": "0x6e62ac5d",
            "parentcaller": "0x75cc234d",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006bc"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\Afd"
              },
              {
                "name": "IoControlCode",
                "value": "0x0001202f",
                "pretty_value": "IOCTL_AFD_GET_SOCK_NAME"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x02\\x00\\xc2(\\xc0\\xa8\\x01i\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4445
          },
          {
            "timestamp": "2026-05-28 22:59:41,831",
            "thread_id": "7468",
            "caller": "0x74d97592",
            "parentcaller": "0x74da158b",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xc0\\xce\\x00,\\x17\\x00\\x00,\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7468"
              }
            ],
            "repeated": 0,
            "id": 4446
          },
          {
            "timestamp": "2026-05-28 22:59:41,831",
            "thread_id": "7468",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xc0\\xce\\x00,\\x17\\x00\\x00,\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7468"
              }
            ],
            "repeated": 0,
            "id": 4447
          },
          {
            "timestamp": "2026-05-28 22:59:41,831",
            "thread_id": "7468",
            "caller": "0x69bab419",
            "parentcaller": "0x69bc2d0d",
            "category": "network",
            "api": "WSASend",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Socket",
                "value": "1724"
              },
              {
                "name": "Buffer",
                "value": "\\x16\\x03\\x03\\x00\\xb8\\x01\\x00\\x00\\xb4\\x03\\x03j\\x18\\xc8\\xddA\\x83\\xbf(Fj\\x04\\xea\\x1a\\x1f\\x0c\\x16\\xf9\\xd3\\xa1\\xf2Kc\\xdd\\xa6\\xa0\\x18y\\xcd\\xb7]\\x02\\xd6\\x00\\x00&\\xc0,\\xc0+\\xc00\\xc0/\\xc0$\\xc0#\\xc0(\\xc0'\\xc0\n\\xc0\t\\xc0\\x14\\xc0\\x13\\x00\\x9d\\x00\\x9c\\x00=\\x00<\\x005\\x00/\\x00\n\\x01\\x00\\x00e\\x00\\x00\\x00\\x1b\\x00\\x19\\x00\\x00\\x16download.microsoft.com\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\n\\x00\\x08\\x00\\x06\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00\r\\x00\\x1a\\x00\\x18\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x02\\x01\\x04\\x03\\x05\\x03\\x02\\x03\\x02\\x02\\x06\\x01\\x06\\x03\\x00#\\x00\\x00\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 4448
          },
          {
            "timestamp": "2026-05-28 22:59:41,831",
            "thread_id": "7468",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 4449
          },
          {
            "timestamp": "2026-05-28 22:59:41,831",
            "thread_id": "7468",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xc0\\xce\\x00,\\x17\\x00\\x00,\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7468"
              }
            ],
            "repeated": 0,
            "id": 4450
          },
          {
            "timestamp": "2026-05-28 22:59:41,831",
            "thread_id": "7468",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xc0\\xce\\x00,\\x17\\x00\\x00,\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7468"
              }
            ],
            "repeated": 0,
            "id": 4451
          },
          {
            "timestamp": "2026-05-28 22:59:41,847",
            "thread_id": "7468",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 4452
          },
          {
            "timestamp": "2026-05-28 22:59:41,847",
            "thread_id": "7468",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xc0\\xce\\x00,\\x17\\x00\\x00,\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7468"
              }
            ],
            "repeated": 1,
            "id": 4453
          },
          {
            "timestamp": "2026-05-28 22:59:41,847",
            "thread_id": "7468",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 4454
          },
          {
            "timestamp": "2026-05-28 22:59:41,847",
            "thread_id": "7468",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xc0\\xce\\x00,\\x17\\x00\\x00,\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7468"
              }
            ],
            "repeated": 0,
            "id": 4455
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x69bab419",
            "parentcaller": "0x69bc2d0d",
            "category": "network",
            "api": "WSASend",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Socket",
                "value": "1724"
              },
              {
                "name": "Buffer",
                "value": "\\x16\\x03\\x03\\x00F\\x10\\x00\\x00BA\\x04\\xa1\\xbf\\xa8\\x80\\xac\\x90\\x91iM\\xd6\\xc1\\xcb\\x1f\\xc6\\xf0fh\\x1e\\xd2\\xc6y\\x8c\\xc9@\\xb3=5\\xcd\\x08P\\x7f\\xd8T\\xc0\\xb2D\\x9a?\\xee\\x82\\xde\\xe0\\x9b\\x82\\xd5T\\x07\\x8f\\xb6u\\xaa\\xf0\\xf7\\x91\\xb2\\x86\\xb6\\xfd\\x04\\xe6'\\xcb\\x7f\\xc3\\x14\\x03\\x03\\x00\\x01\\x01\\x16\\x03\\x03\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"V\\xb7l$Ia@\\x0b\\x96\\xdfAd\\xba\\xb6r7\\x9b\\x1d<\\xa4\\xa7h\\xae\\xbe\\x8c7W\\x0f\\xf3\\xdeR"
              }
            ],
            "repeated": 0,
            "id": 4456
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 4457
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x74d97dba",
            "parentcaller": "0x74da25ac",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xc0\\xce\\x00,\\x17\\x00\\x00,\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7468"
              }
            ],
            "repeated": 0,
            "id": 4458
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x6d125d74",
            "parentcaller": "0x70dd3f73",
            "category": "crypto",
            "api": "BCryptImportKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyBlob",
                "value": "0\\x02\\x00\\x00KSSM\\x02\\x00\\x01\\x00\\x05\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x01\\x00\\x00 \\x00\\x00\\x001\\xfe\\xca;\\xf3\\xe7H\\xf3\\x03\\x14\\xcf\\xc0n\\xff&`\\xcf'S\\x18\\x06\\x94Uz\\x96\\xfen\\xb3\\xc5\\xfb{\\xb5\\x00\\x00\\x00\\x001\\xfe\\xca;\\xf3\\xe7H\\xf3\\x03\\x14\\xcf\\xc0n\\xff&`\\xcf'S\\x18\\x06\\x94Uz\\x96\\xfen\\xb3\\xc5\\xfb{\\xb5?\\xdf\\x1f\\x9d\\xcc8Wn\\xcf,\\x98\\xae\\xa1\\xd3\\xbe\\xce\\xfdA\\xfd\\x93\\xfb\\xd5\\xa8\\xe9m+\\xc6Z\\xa8\\xd0\\xbd\\xefM\\xa5\\xc0_\\x81\\x9d\\x971N\\xb1\\x0f\\x9f\\xefb\\xb1Q\"\\xeb5B\\xd9>\\x9d\\xab\\xb4\\x15[\\xf1\\x1c\\xc5\\xe6\\x1e\\xef+\\xb2\\xc3n\\xb6%\\xf2 \\x07*m\\xcfe\\x9b<\\xa8\\xa6!\\xa9q\\x98\\xbc\\x02\\xc5\\x8d\\xe7\\xf3\\xd9H\\x01\\xed\\xb5W\\xe7\\xf6\\xdb\\xe1\\xc2\\x04\\xfb\\xe6\\xe8i4\\x83sU\\xb0J\\xaeU\\xc1\\xd2\\x12W\\x04_\\xf5\\xa4\\xdd\\x17\\xf4IU\\xe8\\xdc7\\x8e\t\\x1e3u\\xef\\xf6ZAl\\x85\\x0f3\\x1a9#\\xf2\\xc8+t\\xf6\\x97\\xde\\xd0+\\x80*\\x99"
              },
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "CryptKey",
                "value": "0x06d35ea0"
              },
              {
                "name": "Length",
                "value": "560"
              }
            ],
            "repeated": 0,
            "id": 4459
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x6d125d74",
            "parentcaller": "0x70dd3f73",
            "category": "crypto",
            "api": "BCryptImportKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyBlob",
                "value": "0\\x02\\x00\\x00KSSM\\x02\\x00\\x01\\x00\\x05\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x01\\x00\\x00 \\x00\\x00\\x00\\xcf\\xa5\\xce\\xb4\\xe4\\x0b\\xd7\\xa5\\x03\\x945S\\x97\\xd3y\\xb0f\\xb1$\\xde\\xbdf\\x0f\\xdf\\xba\\x94:\\xa9U\\xd9\\xff.\\x00\\x00\\x00\\x00\\xcf\\xa5\\xce\\xb4\\xe4\\x0b\\xd7\\xa5\\x03\\x945S\\x97\\xd3y\\xb0f\\xb1$\\xde\\xbdf\\x0f\\xdf\\xba\\x94:\\xa9U\\xd9\\xff.\\xfb\\xb3\\xffH\\x1f\\xb8(\\xed\\x1c,\\x1d\\xbe\\x8b\\xffd\\x0e[\\xa7gu\\xe6\\xc1h\\xaa\\UR\\x03\t\\x8c\\xad-\\x9d&'I\\x82\\x9e\\x0f\\xa4\\x9e\\xb2\\x12\\x1a\\x15Mv\\x14\\x02D_\\x8f\\xe4\\x857%\\xb8\\xd0e&\\xb1\\\\xc8\\x0b\\xd3\\xce\\x0c\\x81QP\\x03%\\xcf\\xe2\\x11?\\xda\\xafg+U=\\xda~\\xb1\\xb8\\xed[\th\\x88}\\xb84@v\\xc3\\xc74\\xed\\x92\\x977\\xc8]u&\\xf7\\x87\\xdaA\\xdcBjY\\xf8\\xf3\\xd2\\xb4\\xa3\\xfa\\xba<\\xdeB\\x8e|\\xa8\\xca\\xd7\\xf6\\xc1X@\\xc1\t\\x055\\xe7\\xfe\\x82\\xef\\xa6\"Q\\xb5}k\\xa2g\\xc9\\xc8X\\xdd\\xf5\\x16\\x1aS\\x89\\xbe"
              },
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "CryptKey",
                "value": "0x06d2ef60"
              },
              {
                "name": "Length",
                "value": "560"
              }
            ],
            "repeated": 0,
            "id": 4460
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff6118",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x06\\xef0\\x82\\x06u\\xa0\\x03\\x02\\x01\\x02\\x02\\x13a\\x00\\x01Hy~\\xb3V\\xb6.!\\xd5\\x1c\\x00\\x00\\x00\\x01Hy0\n\\x06\\x08*\\x86H\\xce=\\x04\\x03\\x030W1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft TLS G2 ECC CA OCSP 060\\x1e\\x17\r260511021540Z\\x17\r261125021540Z0t1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x0b0\t\\x06\\x03U\\x04\\x08\\x13\\x02WA1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1&0$\\x06\\x03U\\x04\\x03\\x13\\x1d"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4461
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff6118",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x04j0\\x82\\x03\\xef\\xa0\\x03\\x02\\x01\\x02\\x02\\x133\\x00\\x00\\x00\\x06o\\xa2L1\\xc3\\x95o\\xab\\x00\\x00\\x00\\x00\\x00\\x060\n\\x06\\x08*\\x86H\\xce=\\x04\\x03\\x030Q1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1\"0 \\x06\\x03U\\x04\\x03\\x13\\x19Microsoft TLS ECC Root G20\\x1e\\x17\r250801200203Z\\x17\r290603200203Z0W1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft TLS G2 ECC CA OCSP 060v0\\x10\\x06\\x07"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4462
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff6118",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x03;0\\x82\\x02\\xc0\\xa0\\x03\\x02\\x01\\x02\\x02\\x10\\x08\\xd3\\xc6\\xd0\\x01\\xf2l\\xb5\\xa2?\\x0c}js\\xff\\xb60\n\\x06\\x08*\\x86H\\xce=\\x04\\x03\\x030a1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cDigiCert Inc1\\x190\\x17\\x06\\x03U\\x04\\x0b\\x13\\x10www.digicert.com1 0\\x1e\\x06\\x03U\\x04\\x03\\x13\\x17DigiCert Global Root G30\\x1e\\x17\r250521000000Z\\x17\r290619235959Z0Q1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1\"0 \\x06\\x03U\\x04\\x03\\x13\\x19Microsoft TLS ECC Root G"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4463
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff6118",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x06\\xef0\\x82\\x06u\\xa0\\x03\\x02\\x01\\x02\\x02\\x13a\\x00\\x01Hy~\\xb3V\\xb6.!\\xd5\\x1c\\x00\\x00\\x00\\x01Hy0\n\\x06\\x08*\\x86H\\xce=\\x04\\x03\\x030W1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft TLS G2 ECC CA OCSP 060\\x1e\\x17\r260511021540Z\\x17\r261125021540Z0t1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x0b0\t\\x06\\x03U\\x04\\x08\\x13\\x02WA1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1&0$\\x06\\x03U\\x04\\x03\\x13\\x1d"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4464
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff6118",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x04j0\\x82\\x03\\xef\\xa0\\x03\\x02\\x01\\x02\\x02\\x133\\x00\\x00\\x00\\x06o\\xa2L1\\xc3\\x95o\\xab\\x00\\x00\\x00\\x00\\x00\\x060\n\\x06\\x08*\\x86H\\xce=\\x04\\x03\\x030Q1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1\"0 \\x06\\x03U\\x04\\x03\\x13\\x19Microsoft TLS ECC Root G20\\x1e\\x17\r250801200203Z\\x17\r290603200203Z0W1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1(0&\\x06\\x03U\\x04\\x03\\x13\\x1fMicrosoft TLS G2 ECC CA OCSP 060v0\\x10\\x06\\x07"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4465
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff6118",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x03;0\\x82\\x02\\xc0\\xa0\\x03\\x02\\x01\\x02\\x02\\x10\\x08\\xd3\\xc6\\xd0\\x01\\xf2l\\xb5\\xa2?\\x0c}js\\xff\\xb60\n\\x06\\x08*\\x86H\\xce=\\x04\\x03\\x030a1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cDigiCert Inc1\\x190\\x17\\x06\\x03U\\x04\\x0b\\x13\\x10www.digicert.com1 0\\x1e\\x06\\x03U\\x04\\x03\\x13\\x17DigiCert Global Root G30\\x1e\\x17\r250521000000Z\\x17\r290619235959Z0Q1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1\"0 \\x06\\x03U\\x04\\x03\\x13\\x19Microsoft TLS ECC Root G"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4466
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x77b2c23d",
            "parentcaller": "0x77b2c181",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b4"
              }
            ],
            "repeated": 0,
            "id": 4467
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x77b2c245",
            "parentcaller": "0x77b2c181",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4468
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x77989e76",
            "parentcaller": "0x76fe85fb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4469
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x76fe8618",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4470
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x76fe8798",
            "parentcaller": "0x76fe8278",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4471
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000638"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4472
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ValueName",
                "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              }
            ],
            "repeated": 0,
            "id": 4473
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ObjectAttributesName",
                "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              }
            ],
            "repeated": 0,
            "id": 4474
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4475
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000063c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4476
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ValueName",
                "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              }
            ],
            "repeated": 0,
            "id": 4477
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ObjectAttributesName",
                "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              }
            ],
            "repeated": 0,
            "id": 4478
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4479
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 4480
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\SystemCertificates\\Root"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 4481
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4482
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "ValueName",
                "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              }
            ],
            "repeated": 0,
            "id": 4483
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006b4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              }
            ],
            "repeated": 0,
            "id": 4484
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b4"
              }
            ],
            "repeated": 0,
            "id": 4485
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8148",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4486
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000640"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4487
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ValueName",
                "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              }
            ],
            "repeated": 0,
            "id": 4488
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ObjectAttributesName",
                "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              }
            ],
            "repeated": 0,
            "id": 4489
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4490
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000644"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4491
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ValueName",
                "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              }
            ],
            "repeated": 0,
            "id": 4492
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ObjectAttributesName",
                "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              }
            ],
            "repeated": 0,
            "id": 4493
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4494
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 4495
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\SystemCertificates\\CA"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\CA"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 4496
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4497
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "ValueName",
                "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              }
            ],
            "repeated": 0,
            "id": 4498
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006b4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              }
            ],
            "repeated": 0,
            "id": 4499
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b4"
              }
            ],
            "repeated": 0,
            "id": 4500
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8148",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4501
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000648"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4502
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ValueName",
                "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              }
            ],
            "repeated": 0,
            "id": 4503
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ObjectAttributesName",
                "value": "9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B"
              }
            ],
            "repeated": 0,
            "id": 4504
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4505
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000638"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4506
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ValueName",
                "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              }
            ],
            "repeated": 0,
            "id": 4507
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ObjectAttributesName",
                "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              }
            ],
            "repeated": 0,
            "id": 4508
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4509
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000063c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4510
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ValueName",
                "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              }
            ],
            "repeated": 0,
            "id": 4511
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ObjectAttributesName",
                "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              }
            ],
            "repeated": 0,
            "id": 4512
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4513
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 4514
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\SystemCertificates\\Root"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 4515
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4516
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "ValueName",
                "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              }
            ],
            "repeated": 0,
            "id": 4517
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006b4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              }
            ],
            "repeated": 0,
            "id": 4518
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b4"
              }
            ],
            "repeated": 0,
            "id": 4519
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8148",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4520
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000640"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4521
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ValueName",
                "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              }
            ],
            "repeated": 0,
            "id": 4522
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ObjectAttributesName",
                "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              }
            ],
            "repeated": 0,
            "id": 4523
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4524
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000644"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4525
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ValueName",
                "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              }
            ],
            "repeated": 0,
            "id": 4526
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ObjectAttributesName",
                "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              }
            ],
            "repeated": 0,
            "id": 4527
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4528
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797d638",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 4529
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf320",
            "parentcaller": "0x7797d6dd",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0003001f",
                "pretty_value": "KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\SystemCertificates\\CA"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\CA"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 4530
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4531
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "ValueName",
                "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              }
            ],
            "repeated": 0,
            "id": 4532
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006b4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              }
            ],
            "repeated": 0,
            "id": 4533
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b4"
              }
            ],
            "repeated": 0,
            "id": 4534
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76fe8148",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4535
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000648"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4536
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ValueName",
                "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              }
            ],
            "repeated": 0,
            "id": 4537
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ObjectAttributesName",
                "value": "7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5"
              }
            ],
            "repeated": 0,
            "id": 4538
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4539
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000638"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4540
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ValueName",
                "value": "7E04DE896A3E666D00E687D33FFAD93BE83D349E"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E"
              }
            ],
            "repeated": 0,
            "id": 4541
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ObjectAttributesName",
                "value": "7E04DE896A3E666D00E687D33FFAD93BE83D349E"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E"
              }
            ],
            "repeated": 0,
            "id": 4542
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4543
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000063c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Certificates"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates"
              }
            ],
            "repeated": 0,
            "id": 4544
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ValueName",
                "value": "7E04DE896A3E666D00E687D33FFAD93BE83D349E"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E"
              }
            ],
            "repeated": 0,
            "id": 4545
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006ac"
              },
              {
                "name": "ObjectAttributesName",
                "value": "7E04DE896A3E666D00E687D33FFAD93BE83D349E"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E"
              }
            ],
            "repeated": 0,
            "id": 4546
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "ValueName",
                "value": "Blob"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E\\Blob"
              }
            ],
            "repeated": 1,
            "id": 4547
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x779cecbb",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "ValueName",
                "value": "Blob"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x80\\x01\\x00\\x00\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xb0\t\\xe9\\x9a\\\\xfc\\x92\\x8a\\x171\\x90\\x10m\\xbb2\\xa9\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00~\\x04\\xde\\x89j>fm\\x00\\xe6\\x87\\xd3?\\xfa\\xd9;\\xe8=4\\x9e\\x1d\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xd0\\xab9\\xed\\xd1\\xa4\\xd8\\x9aU\\x12\\x88-\\xeb\t\\xcb\\x13\\x14\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xb3\\xdbH\\xa4\\xf9\\xa1\\xc5\\xd8\\xae6A\\xcc\\x11cib)\\xbcK\\xc6b\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x001\\xadfH\\xf8\\x10A8\\xc78\\xf3\\x9e\\xa42\\x0139>:\\x18\\xcc\\x02)n\\xf9|*\\xc9\\xefg1\\xd0\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00D\\x00i\\x00g\\x00i\\x00C\\x00e\\x00r\\x00t\\x00 \\x00G\\x00l\\x00o\\x00b\\x00a\\x00l\\x00 \\x00R\\x00o\\x00o\\x00t\\x00 \\x00G\\x003\\x00\\x00\\x00\t\\x00\\x00\\x00\\x01\\x00\\x00\\x004\\x00\\x00\\x0002\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x03\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x04\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x08S\\x00\\x00\\x00\\x01\\x00\\x00\\x00@\\x00\\x00\\x000>0\\x1f\\x06\t`\\x86H\\x01\\x86\\xfdl\\x02\\x010\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc00\\x1b\\x06\\x05g\\x81\\x0c\\x01\\x030\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc0\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00\\x82\\xc8\\x01\\x999w\"\\xb5z\\xd4s\\xea&k\\x93\\xd4\\x7f\\xfcw\\xfe\\x07\\xf0\\x93\\x884_ \\xda\\xb6\\xad\\xdd\\x08vr\\xf9\\x88\\xb4\\xbb\\xfd\\x15LK\\x13<p\\xc9\\xec\\xff\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xf5]\\xa4P\\xa5\\xfb(~\\x1e\\x0f\r\\xcc\\x96WV\\xca \\x00\\x00\\x00\\x01\\x00\\x00\\x00C\\x02\\x00\\x000\\x82\\x02?0\\x82\\x01\\xc5\\xa0\\x03\\x02\\x01\\x02\\x02\\x10\\x05UV\\xbc\\xf2^\\xa455\\xc3\\xa4\\x0f\\xd5\\xabEr0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E\\Blob"
              }
            ],
            "repeated": 0,
            "id": 4548
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff2a67",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b4"
              }
            ],
            "repeated": 0,
            "id": 4549
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x7798040b",
            "parentcaller": "0x76ff0eec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4550
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x76ff71d3",
            "parentcaller": "0x76ff69bd",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "0\\x82\\x02?0\\x82\\x01\\xc5\\xa0\\x03\\x02\\x01\\x02\\x02\\x10\\x05UV\\xbc\\xf2^\\xa455\\xc3\\xa4\\x0f\\xd5\\xabEr0\n\\x06\\x08*\\x86H\\xce=\\x04\\x03\\x030a1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cDigiCert Inc1\\x190\\x17\\x06\\x03U\\x04\\x0b\\x13\\x10www.digicert.com1 0\\x1e\\x06\\x03U\\x04\\x03\\x13\\x17DigiCert Global Root G30\\x1e\\x17\r130801120000Z\\x17\r380115120000Z0a1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cDigiCert Inc1\\x190\\x17\\x06\\x03U\\x04\\x0b\\x13\\x10www.digicert.com1 0\\x1e\\x06\\x03U\\x04\\x03\\x13\\x17DigiCe"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4551
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x76fe9148",
            "parentcaller": "0x76fe90fd",
            "category": "crypto",
            "api": "CryptDecodeObjectEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "CertEncodingType",
                "value": "0x00000001"
              },
              {
                "name": "Encoded",
                "value": "07\\x82\\x1dakamai.download.microsoft.com\\x82\\x16download.microsoft.com"
              },
              {
                "name": "Flags",
                "value": "0x00008005"
              }
            ],
            "repeated": 0,
            "id": 4552
          },
          {
            "timestamp": "2026-05-28 22:59:41,863",
            "thread_id": "7468",
            "caller": "0x76fea2a6",
            "parentcaller": "0x76fe9622",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 4553
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "7468",
            "caller": "0x6d196967",
            "parentcaller": "0x6d194f89",
            "category": "network",
            "api": "SslEncryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "HEAD /download/7/9/c/79cbc22a-0eea-4a0d-89c0-054a1b3aa8e0/products.cab HTTP/1.1\r\nConnection: Keep-Alive\r\nUser-Agent: Windows Dlp Manager\r\nHost: download.microsoft.com\r\n\r\n"
              },
              {
                "name": "SequenceNumber",
                "value": "1"
              },
              {
                "name": "BufferSize",
                "value": "170"
              }
            ],
            "repeated": 0,
            "id": 4554
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "7468",
            "caller": "0x69bab419",
            "parentcaller": "0x69baae23",
            "category": "network",
            "api": "WSASend",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Socket",
                "value": "1724"
              },
              {
                "name": "Buffer",
                "value": "\\x17\\x03\\x03\\x00\\xc2\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01G/\\x1bt\\xe1\\x04\\xcb\\x0e~\\x98\\x07\\xc3\\xa12\\xcc\\xea2\\x070\\x04\r\\xa6\\x9aQp\\xce\\x08\\x87\\xea\\xc0\\x00\\xdbJ\\x9f\\xb5\\x1e\\x80V\\xf6\\xa6\\x0f\\x08\\xe7^?\\x1b\\x07\\x01\\x98=\\xf5\\xa8\\xfb\\xd1\\xb1\\xfa\\xf4\n\\x90e{\\x91\\xbb\\xd9\\xab\\xcf/\\xc2k\\x99\\xff\\xf8X\\xfaETd\\x96\\x8c2N\\xc5q6\\x9c\\x17\\xbb\\x98d\\x08\\xf5\\xd7\\xcen.\\xab\\xd5\\x01\\xac\\xd6*j\\xa7\\xc9\\x00\\xff<\\x02N\\xfe\\x8d\r\\xdc\\xce\\xdcr\\xb3W\\xed\\x05\\x102\\xd4t\\xa3)\\xa9\\xc7\\xfe\\x0c\\x05\\xa1a\\x17#\\x99\\xc0\\x88v\\x122-\\x8d2\\x89\\x9an\\x0f\\xb3\\xa2V\\x9a\\xad\\xa0.tO\\x0f<\\x13\\x1eD3\\xce\\xcc\\xb4[t\\x05\\x08\\x98a\\xfa\\xfa,\\xa3\\x98\\x07W\\xf6~)1b\\xdc\\xd1"
              }
            ],
            "repeated": 0,
            "id": 4555
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "7468",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 4556
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "7468",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "HTTP/1.1 200 OK\r\nContent-Length: 44045\r\nContent-Type: application/octet-stream\r\nServer: Kestrel\r\nAccept-Ranges: bytes\r\nETag: \"0xED7060958DCC33B9BB33125E0E56E9A6F930E6D7A79B41608B77AAAEBE0A9D40\"\r\nLast-Modified: Mon, 03 Mar 2025 22:20:35 GMT\r\nX-Ms-ApiVersion: Distribute 1.2\r\nX-Ms-Region: prod-neu-z1\r\nContent-Disposition: attachment; filename=products.cab; filename*=UTF-8''products.cab\r\nCache-Control: public, max-age=900\r\nExpires: Thu, 28 May 2026 16:14:45 GMT\r\nDate: Thu, 28 May 2026 15:59:45 GMT\r\nConnection: keep-alive\r\n\r\n"
              },
              {
                "name": "SequenceNumber",
                "value": "1"
              },
              {
                "name": "BufferSize",
                "value": "526"
              }
            ],
            "repeated": 0,
            "id": 4557
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "7468",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 4558
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WinHttpReceiveResponse",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x030ceca8"
              }
            ],
            "repeated": 1,
            "id": 4559
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4560
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4561
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00)6\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4562
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": ")6\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4563
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4564
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WinHttpQueryHeaders",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x030ceca8"
              }
            ],
            "repeated": 0,
            "id": 4565
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4566
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4567
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x986\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4568
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x986\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4569
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4570
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4571
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4572
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "7456",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d65000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4573
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xf76\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4574
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xf76\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4575
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4576
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WinHttpConnect",
            "status": true,
            "return": "0x06d2ea98",
            "arguments": [
              {
                "name": "SessionHandle",
                "value": "0x03117698"
              },
              {
                "name": "ServerName",
                "value": "go.microsoft.com"
              },
              {
                "name": "ServerPort",
                "value": "443"
              }
            ],
            "repeated": 0,
            "id": 4577
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WinHttpOpenRequest",
            "status": true,
            "return": "0x030ceca8",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x06d2ea98"
              },
              {
                "name": "Verb",
                "value": "GET"
              },
              {
                "name": "ObjectName",
                "value": "/fwlink/?LinkId=841361"
              },
              {
                "name": "Version",
                "value": ""
              },
              {
                "name": "Referrer",
                "value": ""
              },
              {
                "name": "Flags",
                "value": "0x00800000"
              }
            ],
            "repeated": 0,
            "id": 4578
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4579
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4580
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\7\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4581
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\7\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4582
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4583
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WinHttpSetTimeouts",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x030ceca8"
              },
              {
                "name": "ResolveTimeout",
                "value": "120000"
              },
              {
                "name": "ConnectTimeout",
                "value": "120000"
              },
              {
                "name": "SendTimeout",
                "value": "120000"
              },
              {
                "name": "ReceiveTimeout",
                "value": "120000"
              }
            ],
            "repeated": 0,
            "id": 4584
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "6328",
            "caller": "0x7798ac59",
            "parentcaller": "0x7279cb7a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4585
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "6328",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006fc"
              }
            ],
            "repeated": 0,
            "id": 4586
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "6328",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000700"
              }
            ],
            "repeated": 0,
            "id": 4587
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "7468",
            "caller": "0x69bb46bc",
            "parentcaller": "0x69bb463b",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4588
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "7468",
            "caller": "0x6d196967",
            "parentcaller": "0x6d194f89",
            "category": "network",
            "api": "SslEncryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "GET /fwlink/?LinkId=841361 HTTP/1.1\r\nConnection: Keep-Alive\r\nRange: bytes=0-44044\r\nUser-Agent: Windows Dlp Manager\r\nHost: go.microsoft.com\r\n\r\n"
              },
              {
                "name": "SequenceNumber",
                "value": "2"
              },
              {
                "name": "BufferSize",
                "value": "142"
              }
            ],
            "repeated": 0,
            "id": 4589
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "7468",
            "caller": "0x69bab419",
            "parentcaller": "0x69baae23",
            "category": "network",
            "api": "WSASend",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Socket",
                "value": "1764"
              },
              {
                "name": "Buffer",
                "value": "\\x17\\x03\\x03\\x00\\xa6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x025f\\x1a\\xea\\xab<B\\xc3\\xa3\\xc9\\xfbZ\\xaah7\\x94N2ME\\x1f\\x0e\\x1d\\xd7\\xd7I\\x90\\xb6N\\x0b\\xb8\\x83\\xe3\\xd5\\x12H\\xc6[ \\xc0\\xd3\\x0f\\xffT\\xbc\\xf7\\xb39u\\xef\\x84\\xd9\\xd1s[%i\\x84\\xa3*)`:x?\\xa5\\x17\\x93\\xe3\\xc2\\xf1\\xb0\\xfa\n-\\xb4\\x98\\xcc\\xc5B\\x94\\x8fH\\xb2\\x08\\xa6\\xf5\\xf9?\\xcd]c=\\x86\\x1f2>\\xaeu\\x87\t6\\xd3X\\xcfx\\x1f\\xb4a\\x82\\x81W\\x03\\xa8\\xa3p\\xb5\\x06\\x85Dy\\x89c\\x8bw\\x8e,\\x03\\x9c9\\xf4\\x8d\"\\xb7\\x1b\\xde6F]\\xf4c\\xa7\\x91\\xbf+\\x1c\\xc34\\x93\\x90U.W\\xae\\x93\\xe4\\x11="
              }
            ],
            "repeated": 0,
            "id": 4590
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e5097",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b4"
              }
            ],
            "repeated": 0,
            "id": 4591
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727a2629",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4592
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e50ec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006f8"
              }
            ],
            "repeated": 0,
            "id": 4593
          },
          {
            "timestamp": "2026-05-28 22:59:41,878",
            "thread_id": "6328",
            "caller": "0x77af2586",
            "parentcaller": "0x77af6986",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b8"
              }
            ],
            "repeated": 0,
            "id": 4594
          },
          {
            "timestamp": "2026-05-28 22:59:41,894",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d65000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4595
          },
          {
            "timestamp": "2026-05-28 22:59:41,894",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4596
          },
          {
            "timestamp": "2026-05-28 22:59:41,894",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03162000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4597
          },
          {
            "timestamp": "2026-05-28 22:59:41,894",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d65000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4598
          },
          {
            "timestamp": "2026-05-28 22:59:41,894",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b04218",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03162000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4599
          },
          {
            "timestamp": "2026-05-28 22:59:41,894",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4600
          },
          {
            "timestamp": "2026-05-28 22:59:41,894",
            "thread_id": "7456",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d75000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4601
          },
          {
            "timestamp": "2026-05-28 22:59:41,894",
            "thread_id": "7456",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d85000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4602
          },
          {
            "timestamp": "2026-05-28 22:59:41,894",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e40c8",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 4603
          },
          {
            "timestamp": "2026-05-28 22:59:41,894",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4604
          },
          {
            "timestamp": "2026-05-28 22:59:41,894",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4605
          },
          {
            "timestamp": "2026-05-28 22:59:41,894",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e410c",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "4048"
              }
            ],
            "repeated": 0,
            "id": 4606
          },
          {
            "timestamp": "2026-05-28 22:59:41,910",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e414a",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 4607
          },
          {
            "timestamp": "2026-05-28 22:59:41,910",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4608
          },
          {
            "timestamp": "2026-05-28 22:59:41,910",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4609
          },
          {
            "timestamp": "2026-05-28 22:59:41,910",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e4186",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "4048"
              }
            ],
            "repeated": 0,
            "id": 4610
          },
          {
            "timestamp": "2026-05-28 22:59:41,925",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d75000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4611
          },
          {
            "timestamp": "2026-05-28 22:59:41,925",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4612
          },
          {
            "timestamp": "2026-05-28 22:59:41,925",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d75000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4613
          },
          {
            "timestamp": "2026-05-28 22:59:41,925",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d75000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4614
          },
          {
            "timestamp": "2026-05-28 22:59:41,925",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030e9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4615
          },
          {
            "timestamp": "2026-05-28 22:59:41,925",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d28000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4616
          },
          {
            "timestamp": "2026-05-28 22:59:41,925",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d30000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4617
          },
          {
            "timestamp": "2026-05-28 22:59:41,925",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d75000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4618
          },
          {
            "timestamp": "2026-05-28 22:59:41,925",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d30000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4619
          },
          {
            "timestamp": "2026-05-28 22:59:41,925",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d28000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4620
          },
          {
            "timestamp": "2026-05-28 22:59:41,925",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030e9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4621
          },
          {
            "timestamp": "2026-05-28 22:59:41,941",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4622
          },
          {
            "timestamp": "2026-05-28 22:59:41,941",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d77000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001d000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4623
          },
          {
            "timestamp": "2026-05-28 22:59:41,941",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d3a000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4624
          },
          {
            "timestamp": "2026-05-28 22:59:41,941",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030e9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4625
          },
          {
            "timestamp": "2026-05-28 22:59:41,941",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030e9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4626
          },
          {
            "timestamp": "2026-05-28 22:59:41,941",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b046e3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d77000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001d000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4627
          },
          {
            "timestamp": "2026-05-28 22:59:41,941",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d3a000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4628
          },
          {
            "timestamp": "2026-05-28 22:59:41,941",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e40c8",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 4629
          },
          {
            "timestamp": "2026-05-28 22:59:41,941",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4630
          },
          {
            "timestamp": "2026-05-28 22:59:41,941",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4631
          },
          {
            "timestamp": "2026-05-28 22:59:41,941",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e410c",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "4048"
              }
            ],
            "repeated": 0,
            "id": 4632
          },
          {
            "timestamp": "2026-05-28 22:59:41,956",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e414a",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 4633
          },
          {
            "timestamp": "2026-05-28 22:59:41,956",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4634
          },
          {
            "timestamp": "2026-05-28 22:59:41,956",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4635
          },
          {
            "timestamp": "2026-05-28 22:59:41,956",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e4186",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "4048"
              }
            ],
            "repeated": 0,
            "id": 4636
          },
          {
            "timestamp": "2026-05-28 22:59:42,144",
            "thread_id": "6328",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "HTTP/1.1 302 Moved Temporarily\r\nContent-Length: 0\r\nServer: Kestrel\r\nLocation: https://download.microsoft.com/download/7/9/c/79cbc22a-0eea-4a0d-89c0-054a1b3aa8e0/products.cab\r\nRequest-Context: appId=cid-v1:d94c0f68-64bf-4036-8409-a0e761bb7ee1\r\nX-Response-Ca"
              },
              {
                "name": "SequenceNumber",
                "value": "2"
              },
              {
                "name": "BufferSize",
                "value": "506"
              }
            ],
            "repeated": 0,
            "id": 4637
          },
          {
            "timestamp": "2026-05-28 22:59:42,144",
            "thread_id": "6328",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1764"
              }
            ],
            "repeated": 0,
            "id": 4638
          },
          {
            "timestamp": "2026-05-28 22:59:42,144",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WinHttpSendRequest",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x030ceca8"
              },
              {
                "name": "Headers",
                "value": ""
              },
              {
                "name": "Optional",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4639
          },
          {
            "timestamp": "2026-05-28 22:59:42,144",
            "thread_id": "7468",
            "caller": "0x7798ac59",
            "parentcaller": "0x7279cb7a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4640
          },
          {
            "timestamp": "2026-05-28 22:59:42,144",
            "thread_id": "7468",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b4"
              }
            ],
            "repeated": 0,
            "id": 4641
          },
          {
            "timestamp": "2026-05-28 22:59:42,144",
            "thread_id": "7468",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000700"
              }
            ],
            "repeated": 0,
            "id": 4642
          },
          {
            "timestamp": "2026-05-28 22:59:42,144",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e5097",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b8"
              }
            ],
            "repeated": 0,
            "id": 4643
          },
          {
            "timestamp": "2026-05-28 22:59:42,144",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727a2629",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4644
          },
          {
            "timestamp": "2026-05-28 22:59:42,144",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e50ec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006f8"
              }
            ],
            "repeated": 0,
            "id": 4645
          },
          {
            "timestamp": "2026-05-28 22:59:42,144",
            "thread_id": "7468",
            "caller": "0x77af2586",
            "parentcaller": "0x77af6986",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 0,
            "id": 4646
          },
          {
            "timestamp": "2026-05-28 22:59:42,144",
            "thread_id": "6328",
            "caller": "0x69bb46bc",
            "parentcaller": "0x69bb463b",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4647
          },
          {
            "timestamp": "2026-05-28 22:59:42,144",
            "thread_id": "6328",
            "caller": "0x6d196967",
            "parentcaller": "0x6d194f89",
            "category": "network",
            "api": "SslEncryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "GET /download/7/9/c/79cbc22a-0eea-4a0d-89c0-054a1b3aa8e0/products.cab HTTP/1.1\r\nConnection: Keep-Alive\r\nRange: bytes=0-44044\r\nUser-Agent: Windows Dlp Manager\r\nHost: download.microsoft.com\r\n\r\n"
              },
              {
                "name": "SequenceNumber",
                "value": "2"
              },
              {
                "name": "BufferSize",
                "value": "191"
              }
            ],
            "repeated": 0,
            "id": 4648
          },
          {
            "timestamp": "2026-05-28 22:59:42,144",
            "thread_id": "6328",
            "caller": "0x69bab419",
            "parentcaller": "0x69baae23",
            "category": "network",
            "api": "WSASend",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Socket",
                "value": "1724"
              },
              {
                "name": "Buffer",
                "value": "\\x17\\x03\\x03\\x00\\xd7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x81!\\x12\\x0eE\\xbf\\xd7\\xcf\\x91\\xaa4H+U\\xea\\xd0K\\x1f=V\\xbaT\tNj\\x0f\\xd2]LB\\x1a\\xef\\xb4\\xe6\\x0el\\x8d\\xea:\\xee\\x89\\xe3q\\xb0&U\"\\xc9\\xf5U\\xdc\\xd3\\x91\\xcd\\x84\\xbdLce\\x82\\xec\\xf0\\x06u\"%\\xe0\\x0b\\x96k\\x1d\\xc4\\xe4\\xb1\\xddE\\xc9\\xe2\\xaal\\x84|iu_\\xa4\\xad\\xcc\\xbd\\xeb\\xea;\\xd4^zm\\xaa\\xcd\\x03\\xb7XKn\\xfaa\\x01\\x03\\xcee\\x92\\x907\r\\xf8D~\\xd6\\xa1\\xa3\\xdf\\x9f\\xc6:Z\\x8fa\\xdb\\xf1\\xbc\\xd2\\x94\\xe59\\xe7\\xac\\x93\\xc3\\xb6\\x1a\\x97\\xb1\\xa6,,\\xfc\\xd4k\\x06\\xfaM\\x15\\xd0\\xe5\\x9dF>\\x97n\\x05\\xdb\\xf9;\\xfd\\xd5@\\x86S\\xa4\\xa5\\x0fA\\xcf\\x0c9\\x00\\xfe\\xc8\"\\xe3LG\\xbb\\x91\\xe9_\\x03\\xab\\xa8\\xf9\\xe0\\xbd\\x19&\\x0e\\x84\\xea\\xae'\\xeb\\x8e\\x8a\\x1a\\xf3\\xbfo\\xbe\\xea"
              }
            ],
            "repeated": 0,
            "id": 4649
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "6328",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 3,
            "id": 4650
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "6328",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "HTTP/1.1 206 Partial Content\r\nContent-Type: application/octet-stream\r\nServer: Kestrel\r\nAccept-Ranges: bytes\r\nETag: \"0xED7060958DCC33B9BB33125E0E56E9A6F930E6D7A79B41608B77AAAEBE0A9D40\"\r\nLast-Modified: Mon, 03 Mar 2025 22:20:35 GMT\r\nX-Ms-ApiVersion: Distribu"
              },
              {
                "name": "SequenceNumber",
                "value": "2"
              },
              {
                "name": "BufferSize",
                "value": "16384"
              }
            ],
            "repeated": 0,
            "id": 4651
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WinHttpReceiveResponse",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x030ceca8"
              }
            ],
            "repeated": 0,
            "id": 4652
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4653
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c4"
              }
            ],
            "repeated": 0,
            "id": 4654
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WinHttpQueryHeaders",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x030ceca8"
              }
            ],
            "repeated": 0,
            "id": 4655
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4656
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4657
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc87\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4658
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc87\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4659
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4660
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4661
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\r\\xac\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 4662
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\r\\xac\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4663
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\r\\xac\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4664
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4665
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 1,
            "id": 4666
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4667
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "MSCF\\x00\\x00\\x00\\x00\r\\xac\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x01\\x01\\x00\\x01\\x00\\x00\\x00\\x08\\x84\\x00\\x00I\\x00\\x00\\x00V\\x00\\x03\\x15)\\xa5*\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87W\\xf2\\xb0 \\x00products.xml\\x00\\xf9]\\x06\\xe2\\xee\\x05\\x00\\x80[\\x80\\x80\\x8d\\xaa\\x12\\x92R3\\x03F4U\\x00\\x00\\x00oP\\x98 i/\\x01\\xf1A\\x83o9\\xfe\\xfeQ\\xef\\x06V\\\\xe6\\xd9\\xb6v\\x99\\x9b\\xe1\"\\x99\\x06\\x18\\xef\\x1d\\xce9\\xc9\\\\xeevw\\xd3\\xddr\\xc0\\x93\\xc41\\x1b\\xc7\\x08jqC\\xb4!\\x98\\x00\\x10\\x88\\x89B\\xe4\\xc6FQl\\xd2\\x1c\\x05\\xe2\\x05x2\\xfc\\x08\\x04Bl\\xe3\\xbd\\x10\\x01\\xa1\\xa2\\x19\\xab\\xaa@<48\\x9bG\\xa4\\xae\\xdd\\xfb\\x97-2\\xe7{\\xd4\\xd1\\xb7\\x9e;\\xdd\\x89'z\\x8cu\\xba\\x03\\xa1\\x92\\xb6\\xdc\\xf3XJ\"c\\xf1f.\\xe3M\\x8au\\xdb\\xc8[\\xa5\\xbaun\\xcb\\x06Y\\xb6\\xe6\\xc9\\xdc\\xcc\\xfe\\xcd$\\x00n]s\\x81\\xd5\\x02\\xfb\\xd7d\\x02"
              },
              {
                "name": "Length",
                "value": "2967"
              }
            ],
            "repeated": 0,
            "id": 4668
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4669
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4670
          },
          {
            "timestamp": "2026-05-28 22:59:42,160",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 1,
            "id": 4671
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4672
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "N%\\xd7\"\\x87/\\xa2\\x83\\x9f\\xbc\\x8f\\xbb\\x14\\xf7\\xfe\\xb3M~\\xe97j;H\\xbaB\\xa8\\x16\\xb0q\\xb5^\\xa8\\xd6\\x02\\x19\\xee\\xe0\\x0b&[\\xd0\\xdf\\x05\\xc0\\xad\\xb2\\x0c\\xe1\\xbd \\xadi\t\\xc5\\xde\\xa0\\x99\\xd0\\xe4\\x00&\\xdb\\xd0\\xd8\\x0b\\xb6\\xae\\xdc\\x02\\xb8\\xa5P\\x7f\\xc8+\\x00\\x16Z\\x84\\x9cb\\xe3\\xfb\\xc7\\x89J\\x13\\xba>A\\xef$\\xdd\\x03\\xfe\\xf8\\xde5\\xc3\\x1f\\xe2\\x91\\xe3]\\xeb[\\xfft\\x9f\\xeapR<V|,\\xffj,\\x96\\xc4\\xf7\\xfcFK?\\xab\\xf4!e\\xf3*\\xb8_\\xc9\\xd6\\xad\\xc5\\xc8\\x94\\xd4\\xb8\\xec\\xd4Z)\\xf0=\\xe7t\\x95\\x94#\\xc5[\\x83\\xe4\\xc6\\xab\\xe72,\\xdb\\xaaeF\\xe5\\xb6\\xb8\\xf1\\xa4\\xf9tI\\xd4\\x8d\\x15k\\x1b\\xb9\\xa9\\xdb\\xe1\\xb0Y!\\xacpf]S\\xb6\\x17w\\xf4\\xadlE\\x14\\xeb\\xd9\\xbcb\\xb2\\x90E\\x05\\xda\\xae\\xb1\\x0e\\x19\\xe0\\xa4\\xf8\\xa0:4?@\\xb3\\xaf\\xe0&;4n\\x81\\xe5M\\xe0\\xa1\\x14\\x9c\\x1d\\x1d.\\x96C/\\x16 \\xaf\\xf3\\x0c\\xe5\\xe7\\xa4\\xf6\\xd8\\x00\\xc0\\x1e\\xb03\\xae"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 4673
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WSARecv",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 4674
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "!s\\x0b\\x80\\xda`\\x18R\\x01I\\x9d\\x03k\\xae!h\\x1b4\\x13\\xda\\x1c U\\x9b\\xa4\\xb4\\x92-\\x07\\x02\\x95;\\x00\\xd7\\x14J\\x0f\\xb9\\x05\\xe0pm\\xca\\xb4\\x8d\\x13\\x1f\\x8b*\\xed\\xe8&\\x04M\\xc9\\xfcz\\xdb\\xf5ln\\xad\\x19\\xd2\\xc95{\\xf1\\x9fH\\xbf*5\t\\xde\\x91]a\\x1f\\xfb\\xfc\\x94I\\xb9\\x17\\xbc\\x9e\\x9d\\xdf\\x18/\\x8e*\\xdf\\xab\\xbdf\\x98(\\xe1\\xeb`\\xa9\\xe3\\xbdo\\xa4\\xba\\xf5\\xab\\xcdd\\x94J\\x92!E\\x99\\x0euq\\xccvm3\\xe4\\xcf\\xdc\\x937\\xedQ\\xdaN\\x99\\xb6\\xa4\n\\x83+~\\xfc\\x00\\x10\\xa1\\xb8\\x92\\x08\\xbe\\x01\\x00\\x80\\xbf>/-\\x0b\\xc1[\\xe0\\xd2&\\xc0\\xd0\\xb2\\x051\\xad \\x0c\\x97[\\xa8i\\x05bB\\xeb\\x90\\xd3\r\\x9c\t\\xed\\x0e\\xb0\\xb2UA\\xad\\x80\\x0b\\xca\\xbd`\\xec*%\\x87|\\x03\\xfc\\xd5\\x1aM\\xed\\xe6\t\\x90\\xbd\\x98\\x0e\\xda\t\\x81\\x13$>\\x03\\xff\\xa5\\xbfOmK\\xb5\\xe7ZK\\xbf/\\xc8\\xb9\\xf7n\\xf81q*xm,|a\\x95\\xb1\\x8cqkqJY\\xd79\\xb7\\xf0"
              },
              {
                "name": "SequenceNumber",
                "value": "3"
              },
              {
                "name": "BufferSize",
                "value": "16384"
              }
            ],
            "repeated": 0,
            "id": 4675
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4676
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4677
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 1,
            "id": 4678
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4679
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xb6\\xc0\\xa6M\\x80\\xa1e\\x0brZ@\\x18.\\xb7\\xd0\\xd3\\x0b\\xc4\\xaf\\xb6\\x08j\\x06N\\x84\\xee\\x07\\xd8\\xdc*R\\xbb\\xe0B>;\\x00\\xb0[\\x11\\x9c\\x10\\xda\\x01\\x00\\x80\\xf92\\x8c]\\xa5\\x04\\x90O\\x80\\xffZc\\xaa\\xc5<\\xa1\\xda\\x1b\\xa0\\x13\\xfd\\xfc\\x9d\\xae\\x1b\\xf8\\xedrqZ\\xa6z\\x81\\xd3AWd\\x95\\x96\\x9bU8\\xc9\\xb3\\x9f\\xac\\xf9\\x0ejFM\\xbd\\xf0]!\\xa4b7g\\xd5\\xf6r\\xb6\\xf9\\x0c\\xe1\\xbe.\\x8eQ\\xf1\\xe4\\xac\\x96\\xca0\\xe5\\xe9\\xc6\\xc0\\xc2t\\xe7\\xae\\xfa\\xc6\\xf8G\\xa5\\x1d\\x94\\xf8\\x9a\\xff\\x90\\xb6\\xa1U\\x0e\\o[\\x0b\\xd5r\\xe0\\xc0\\xe40\\x14l\\x01V\\xab\\x08C\\xf2\\x19\\xc4\\xd0\\x9c\rB\\xe76p&\\xf49\\xc0\\xb7[\\xb8\\x10\\x9e\rcW)\\x01\\xe4S\\xe0?\\xd6\\x18\\xd5\\xa2\\x9e\\x90\\xcd\r\\xd0\t\\x9f|\\xdd\\xe5\\xb9\\x15\\xce\\xbd\\xcc\\xff|-\\xfb,\\x9f\\xfb\\xfd\\x13k\\x16\\xe9\\xbf\\x94\\x1dyZ\\xe6\\xcf'\\xfd\\xe5\\xe6\\x9b\\xf18\\xc3\n\\xa9\\xf8J1\\xd2)\\xc3,\\xf0\\x88\\xc7P\\xcd/\\xad\\xf0\\xaa\\xdfS"
              },
              {
                "name": "Length",
                "value": "4650"
              }
            ],
            "repeated": 0,
            "id": 4680
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4681
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4682
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 1,
            "id": 4683
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4684
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "!s\\x0b\\x80\\xda`\\x18R\\x01I\\x9d\\x03k\\xae!h\\x1b4\\x13\\xda\\x1c U\\x9b\\xa4\\xb4\\x92-\\x07\\x02\\x95;\\x00\\xd7\\x14J\\x0f\\xb9\\x05\\xe0pm\\xca\\xb4\\x8d\\x13\\x1f\\x8b*\\xed\\xe8&\\x04M\\xc9\\xfcz\\xdb\\xf5ln\\xad\\x19\\xd2\\xc95{\\xf1\\x9fH\\xbf*5\t\\xde\\x91]a\\x1f\\xfb\\xfc\\x94I\\xb9\\x17\\xbc\\x9e\\x9d\\xdf\\x18/\\x8e*\\xdf\\xab\\xbdf\\x98(\\xe1\\xeb`\\xa9\\xe3\\xbdo\\xa4\\xba\\xf5\\xab\\xcdd\\x94J\\x92!E\\x99\\x0euq\\xccvm3\\xe4\\xcf\\xdc\\x937\\xedQ\\xdaN\\x99\\xb6\\xa4\n\\x83+~\\xfc\\x00\\x10\\xa1\\xb8\\x92\\x08\\xbe\\x01\\x00\\x80\\xbf>/-\\x0b\\xc1[\\xe0\\xd2&\\xc0\\xd0\\xb2\\x051\\xad \\x0c\\x97[\\xa8i\\x05bB\\xeb\\x90\\xd3\r\\x9c\t\\xed\\x0e\\xb0\\xb2UA\\xad\\x80\\x0b\\xca\\xbd`\\xec*%\\x87|\\x03\\xfc\\xd5\\x1aM\\xed\\xe6\t\\x90\\xbd\\x98\\x0e\\xda\t\\x81\\x13$>\\x03\\xff\\xa5\\xbfOmK\\xb5\\xe7ZK\\xbf/\\xc8\\xb9\\xf7n\\xf81q*xm,|a\\x95\\xb1\\x8cqkqJY\\xd79\\xb7\\xf0"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 4685
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "\\xd9\\x19\\xdd\\x04\\xb6V\\x9b\\x15\\x84\\xa1\\x13\\x94\\xbe\\x1e6\\xbbB{7\\xb8\\x87m\\xa8h%b\\xc7\\x04\\xae\\xafB\\x8bT\\xa1\\xba\\x1b\\xda\\xec\n)\\xf1\\xe0\\xa2\\xeb\\xe8\\xd1\\x06Y\\xb0\\xed\\x85-d\\x0b\\x98\\xa0\\xf5\\xf5i\\xd3+\\x94w\\x03\\xab]!O\\x1e`t=\\x8d\\xda@\\x0b\\xb5\\xdd}[\\xe1B&(\r?\\xdc\\xaa\\x1a\"AI\\xcf\\x89\n\\xa2\\xd7\\x80\\xd5b\\x01\\xdd\\xb1\\x9f\\xcf\\xde\\x9a\\xb6\\x16*\\xb7\\xc2-\\xa4\\x02\\x92v\\x06\\xed\\xb9\\x85`^\\x10\\x1d\\xb6!\\xb7\\x90p3\\x10\\xd7\\xb5\\x92\\xb5\\xc1\\x13\\{\\xb3\\xf6\\x88B\\xb57\\xb5\\xd7\\x14\\xa2z\\xc1\\x16\\xd8\\x85\\xac@R\\xce@b\\xd7\\xc8\\xd6\\x05Pt\\xed\\xddZ@\n\\xd7\\xde\\xd7bT\\x08\\xeb\\x05\\xb3U+\\xe4\\x02\\x12F\\x07l\\xd5\\x0c\\xe1\\x80ds\\xe3\\xde\\xf4[-z\\xb6>\\x03\\xe6s\\x8fB\\x86\\xab'\\x066\\xb5\\x85rl\\xc0\\xd5\\xda!\\x9d\\x1bH\\xff6\\xce\\xae@\\xfa\\x0b\\x88tP*\\x01\\x00\\x80\\xe8BK\\x05gSP\\x88\\xcd\\x06Y\\xad\\x14\\xea\\xb7\\x81lj"
              },
              {
                "name": "SequenceNumber",
                "value": "4"
              },
              {
                "name": "BufferSize",
                "value": "1684"
              }
            ],
            "repeated": 0,
            "id": 4686
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4687
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4688
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 1,
            "id": 4689
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4690
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "f\\xf3!N\\xbd:\\xc5\\xad|\\x9f\\x98GR7C\\xbe]O\"\\xfc\r\\xbd#\\x83\\xde\\xd3+\\xc1w,\\x02\\xfa]\\xf4\n<\\xee\\xf4v\\xab\\x152+\\xc4\\x9a\\x9a\\xd5w\\xdd\\xbco\\xabE\\xd2\\xb2\\x97\\x97,,\\x03j\\xe2}\\x9f\\xa40\\xc9p\\x9a\\x8fG\\xe5Q\\xb2\\x0f\\xa7=\\x08wm\\xc5P\\xbf\\xcc\\xc7\\x86`n<\\xf2)#\\xffCE\\xd7\\xd2\\xd1\\xbc\\xf7\\xdb\\x9a^\\xa5\\x856H\\xfa\\xd7O\\x8a\\x84\\xf8\\xbb\\xeaP\\xb5\\x1e\\x0f\\xf0A\\x7f\\xf7\\x18\\x85\\xa7\\x9d\\}\\xa5\\x152X\\xe835\\xf5\\xd6\r>\\x7f\\x1a\\xa8-\\x17)\\xac\\xa9\\x9f\\x97\\x9cE\\xda[lI\\x0c\\xbf\\x85\\xa3\\x9b0\\xb7\\xdc=c\\xb5\\xe3m)/|\\xdb\\xbd\\xca\\x90s\\x1b\\x9f\\x11\\x1e2Oh\\xf7\\xc3]\\x84\\x9b.\\xbe\\xaa\\xd7\\x11\\x7f\\xd7\">\\xe4\\xda\\xb7\\xf9ads_\\xfe\\xf3\\x9a\\xcb\\x17x\\xfdi>\\xc6`Y\\x19\\xfa\\\r\\xbe\\xf5TWK\\xd9\\xa5\\xd8\\xffqPJ\\xe868\\xc76\\xa7\\xfc`(c\\x10\\xbeU\\xbe8do\\xb4Ts\\xe6\\xcd"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 4691
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "\\x1elvM~\\xaf\\xd0\\x85\\xdb5R\\xbe\\xc1\\x17\\xb6\\xe4\\xfd\\x05\\x84!\\x13\\x94\\x1a\\x1a\\xdf\\xec\\x0b\\x81\\xf2\\x80\\xb7k\\xb4~\\x01/&\\xaf\\xc8\\xfe\\x07`\\xd5\\x92ioD\\x0c\\x98\\xa0\\xda\\xeb\\xe9\\xadf%\\x90\\xfe\\xc2\\xf2x\\xf3\\x16\\x01\\x00\\x80\\xad\\x00\\xea\\xdd?\\xdc\\xcfu~\\x7f\\xcf\\x80\\xd8 \\xb6\\xcfT\\x9da\\xfb\\xd2]\\x89\\x16\\x03\\x01\\xd7\\xd5\\xf3E\\xa0P\\xab\r\\xdda\\x16\\x02\\x01\\xc9\\xd5\\x03b\\xd7h\\xf4\\x06N\\xba\\xd6\\x1c/\\x00\\x85knw\\xb1)\\x94j\\x03\\x16\\xd8\\x85\\xd8@B\\xf5@\\xcfu\\xf4t\\x83']k:7\\x88B57r\\xcf)Tj\\x83l\\xd5\n\\xe1\\x80\\xa4\\xf8\\x81V-\\xd0\\xcaH\\xc47\\x0e\\x8d>\\xf6\\xcdY\\xd4@\\x97\\xcaf\\xa1k\\xab\\en!\\x9d\\x1b\\x88\\xa6\\xf6\\x90\\xd0\r\\xb0s\\xfb)m`\\x0c\\xb4\\xdf\\xa4\\xf6`\\x85\\xdaoZ\\x9b\\xc0B\\x9e\\x16\\x90\\xd8\r\\xb4d\\xfbR\\xdb\\x01\\x17j\\xbf\\xc9-\\xe0\n\\xb5\\xdfz\\x9b\\xc8B\\xa2\\x16\\x90\\xe0\r\\xb6e\\xfbR\\@\\x17\\xa9\\xb7Hr"
              },
              {
                "name": "SequenceNumber",
                "value": "5"
              },
              {
                "name": "BufferSize",
                "value": "10168"
              }
            ],
            "repeated": 0,
            "id": 4692
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4693
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4694
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 1,
            "id": 4695
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4696
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xd9\\x19\\xdd\\x04\\xb6V\\x9b\\x15\\x84\\xa1\\x13\\x94\\xbe\\x1e6\\xbbB{7\\xb8\\x87m\\xa8h%b\\xc7\\x04\\xae\\xafB\\x8bT\\xa1\\xba\\x1b\\xda\\xec\n)\\xf1\\xe0\\xa2\\xeb\\xe8\\xd1\\x06Y\\xb0\\xed\\x85-d\\x0b\\x98\\xa0\\xf5\\xf5i\\xd3+\\x94w\\x03\\xab]!O\\x1e`t=\\x8d\\xda@\\x0b\\xb5\\xdd}[\\xe1B&(\r?\\xdc\\xaa\\x1a\"AI\\xcf\\x89\n\\xa2\\xd7\\x80\\xd5b\\x01\\xdd\\xb1\\x9f\\xcf\\xde\\x9a\\xb6\\x16*\\xb7\\xc2-\\xa4\\x02\\x92v\\x06\\xed\\xb9\\x85`^\\x10\\x1d\\xb6!\\xb7\\x90p3\\x10\\xd7\\xb5\\x92\\xb5\\xc1\\x13\\{\\xb3\\xf6\\x88B\\xb57\\xb5\\xd7\\x14\\xa2z\\xc1\\x16\\xd8\\x85\\xac@R\\xce@b\\xd7\\xc8\\xd6\\x05Pt\\xed\\xddZ@\n\\xd7\\xde\\xd7bT\\x08\\xeb\\x05\\xb3U+\\xe4\\x02\\x12F\\x07l\\xd5\\x0c\\xe1\\x80ds\\xe3\\xde\\xf4[-z\\xb6>\\x03\\xe6s\\x8fB\\x86\\xab'\\x066\\xb5\\x85rl\\xc0\\xd5\\xda!\\x9d\\x1bH\\xff6\\xce\\xae@\\xfa\\x0b\\x88tP*\\x01\\x00\\x80\\xe8BK\\x05gSP\\x88\\xcd\\x06Y\\xad\\x14\\xea\\xb7\\x81lj"
              },
              {
                "name": "Length",
                "value": "1684"
              }
            ],
            "repeated": 0,
            "id": 4697
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4698
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4699
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 1,
            "id": 4700
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4701
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\x1elvM~\\xaf\\xd0\\x85\\xdb5R\\xbe\\xc1\\x17\\xb6\\xe4\\xfd\\x05\\x84!\\x13\\x94\\x1a\\x1a\\xdf\\xec\\x0b\\x81\\xf2\\x80\\xb7k\\xb4~\\x01/&\\xaf\\xc8\\xfe\\x07`\\xd5\\x92ioD\\x0c\\x98\\xa0\\xda\\xeb\\xe9\\xadf%\\x90\\xfe\\xc2\\xf2x\\xf3\\x16\\x01\\x00\\x80\\xad\\x00\\xea\\xdd?\\xdc\\xcfu~\\x7f\\xcf\\x80\\xd8 \\xb6\\xcfT\\x9da\\xfb\\xd2]\\x89\\x16\\x03\\x01\\xd7\\xd5\\xf3E\\xa0P\\xab\r\\xdda\\x16\\x02\\x01\\xc9\\xd5\\x03b\\xd7h\\xf4\\x06N\\xba\\xd6\\x1c/\\x00\\x85knw\\xb1)\\x94j\\x03\\x16\\xd8\\x85\\xd8@B\\xf5@\\xcfu\\xf4t\\x83']k:7\\x88B57r\\xcf)Tj\\x83l\\xd5\n\\xe1\\x80\\xa4\\xf8\\x81V-\\xd0\\xcaH\\xc47\\x0e\\x8d>\\xf6\\xcdY\\xd4@\\x97\\xcaf\\xa1k\\xab\\en!\\x9d\\x1b\\x88\\xa6\\xf6\\x90\\xd0\r\\xb0s\\xfb)m`\\x0c\\xb4\\xdf\\xa4\\xf6`\\x85\\xdaoZ\\x9b\\xc0B\\x9e\\x16\\x90\\xd8\r\\xb4d\\xfbR\\xdb\\x01\\x17j\\xbf\\xc9-\\xe0\n\\xb5\\xdfz\\x9b\\xc8B\\xa2\\x16\\x90\\xe0\r\\xb6e\\xfbR\\@\\x17\\xa9\\xb7Hr"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 4702
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 4703
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4704
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4705
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006ac"
              }
            ],
            "repeated": 1,
            "id": 4706
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006d8"
              }
            ],
            "repeated": 0,
            "id": 4707
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xfe\\xf7`\\x12=\\xfa\\xc0|\\xc7w\\x1et_g~\\xec\\xf1zzr\t\\xf1\\xce~\t\\xf7\\x1d\\xfa\\xbd\\xce\\x1evp\\x9e\\xaf\\xeb\\xb7\\xf4q:\\xdf\\x02\\xf2\\x1d\\x9dyC~\\xaf\\x1bYR?\\xba\\xf8\\xdfV/\\xe2\\x9c{\\xe9\\xe7\\xaf\\xd7}\\x7f\\xe6\\xfc9\\xba\\x8f\\xaf\\xfc\\xfc\\\\xfb(Z<\\xe8\\xba\\x07\\x00\\xfc\\xdc\\x1a\\x15|\\x9e\\xfb\\x0f\\xef\\x85\\xff\\xe6\\xeb\\x9c\\xa5\\x9f\\xb5?\\xd7\\xbf\\x80>\\xe7>\\x07\\xf1\\xffO\\xcb\r<\\xc4s]\\xf3\\xe0\\xf2\\xee\\xe7\\xba\\x07\\xb0\\xc7\\xdd'V\\xd6\\x03\\xd7\\x82\\x00\\xad{\\x1f\\xd5\\xfclp\\xe9\\xe2\\x1er\\xd7\\xa2\\x01H\\xfe\\xd7\\xb7\\x17\\xaa\\x89\\x85\\xbd\\x7f\\xbc\\x01h\\xfe\\xd7\\xdb\\xdb\\xf8\\xdc\\x00\\xe0\\xf9\\x7f\\xdd\\xe3\\x17\\x89O\\xfc\\xae\\x1f\\x94{\\xd6~\\\\xf7\\x00\\xf8\\xd7\\xfey\\xd1\\x00 \\xc3\\x7f9\\xd28\\xc7\\xf2\\xae\\x10\\xbe\\xf5\\xd8\\xa2\\xcf\\xb3\\x8f\\xd7\\xc1\\x00?\\xe7>\\\\xff\\x0e\\xbcO\\x7fO\\xe3\\x9d\\xf8\\xf8s\\xfb\\xb7]\\\\x00t\\xee\\x03\\xd7\\xf8B_\\xf7/\\xec\\x9f\\x18\\xfb\\x8f7\\x7f\\xcd\\x14\\xe4\\x87W\\xf4\\xe1"
              },
              {
                "name": "Length",
                "value": "1976"
              }
            ],
            "repeated": 0,
            "id": 4708
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c4"
              }
            ],
            "repeated": 0,
            "id": 4709
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4710
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4711
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x0078\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4712
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "78\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4713
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4714
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d76000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001e000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4715
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03158000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000a000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4716
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d65000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4717
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d29000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4718
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b04218",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03158000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000a000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4719
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d76000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001e000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4720
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76629000"
              },
              {
                "name": "ModuleName",
                "value": "SETUPAPI.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4721
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76629000"
              },
              {
                "name": "ModuleName",
                "value": "SETUPAPI.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4722
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4723
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              }
            ],
            "repeated": 0,
            "id": 4724
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 4725
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d76000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001e000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4726
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03158000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000a000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4727
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4728
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\"
              }
            ],
            "repeated": 0,
            "id": 4729
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "12"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x80\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4730
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d76000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001e000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4731
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4732
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4733
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4734
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "MSCF\\x00\\x00\\x00\\x00\r\\xac\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x01\\x01\\x00\\x01\\x00\\x00\\x00\\x08\\x84\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "36"
              }
            ],
            "repeated": 0,
            "id": 4735
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "$\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 4736
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d29000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4737
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": ",\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4738
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "DEVRTL.dll"
              }
            ],
            "repeated": 0,
            "id": 4739
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\devrtl.dll"
              }
            ],
            "repeated": 0,
            "id": 4740
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\devrtl.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 4741
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000006b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000006c0"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\devrtl.dll"
              }
            ],
            "repeated": 0,
            "id": 4742
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000006b8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69990000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4743
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6999e000"
              },
              {
                "name": "ModuleName",
                "value": "DEVRTL.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4744
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6999e000"
              },
              {
                "name": "ModuleName",
                "value": "DEVRTL.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4745
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4746
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4747
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6999e000"
              },
              {
                "name": "ModuleName",
                "value": "DEVRTL.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4748
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b8"
              }
            ],
            "repeated": 0,
            "id": 4749
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4750
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6999e000"
              },
              {
                "name": "ModuleName",
                "value": "DEVRTL.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4751
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\Windows\\SYSTEM32\\DEVRTL.dll"
              }
            ],
            "repeated": 0,
            "id": 4752
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\devrtl.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 4753
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c0"
              }
            ],
            "repeated": 0,
            "id": 4754
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DEVRTL"
              },
              {
                "name": "DllBase",
                "value": "0x69990000"
              }
            ],
            "repeated": 0,
            "id": 4755
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d76000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001e000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4756
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d65000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4757
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d30000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4758
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4759
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d76000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001e000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4760
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4761
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d30000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4762
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d95000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4763
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b8"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4764
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\devrtl"
              },
              {
                "name": "BaseAddress",
                "value": "0x69990000"
              },
              {
                "name": "InitRoutine",
                "value": "0x69995950"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 4765
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76629000"
              },
              {
                "name": "ModuleName",
                "value": "SETUPAPI.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4766
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76629000"
              },
              {
                "name": "ModuleName",
                "value": "SETUPAPI.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4767
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b8"
              }
            ],
            "repeated": 0,
            "id": 4768
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d65000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4769
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000700"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\MACHINE"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE"
              }
            ],
            "repeated": 0,
            "id": 4770
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000700"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Setup"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup"
              }
            ],
            "repeated": 0,
            "id": 4771
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000700"
              }
            ],
            "repeated": 0,
            "id": 4772
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "ValueName",
                "value": "SetupOverride"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SetupOverride"
              }
            ],
            "repeated": 0,
            "id": 4773
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "ValueName",
                "value": "LogPath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogPath"
              }
            ],
            "repeated": 0,
            "id": 4774
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b4"
              }
            ],
            "repeated": 0,
            "id": 4775
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\"
              }
            ],
            "repeated": 0,
            "id": 4776
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000006b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\MACHINE"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE"
              }
            ],
            "repeated": 0,
            "id": 4777
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000700"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000006b4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Setup"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup"
              }
            ],
            "repeated": 0,
            "id": 4778
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006b4"
              }
            ],
            "repeated": 0,
            "id": 4779
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000700"
              },
              {
                "name": "ValueName",
                "value": "SetupOverride"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SetupOverride"
              }
            ],
            "repeated": 0,
            "id": 4780
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000700"
              },
              {
                "name": "ValueName",
                "value": "LogLevel"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "536887297"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogLevel"
              }
            ],
            "repeated": 0,
            "id": 4781
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000700"
              },
              {
                "name": "ValueName",
                "value": "LogMask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMask"
              }
            ],
            "repeated": 0,
            "id": 4782
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000700"
              },
              {
                "name": "ValueName",
                "value": "LogMaxFileSize"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMaxFileSize"
              }
            ],
            "repeated": 0,
            "id": 4783
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000700"
              }
            ],
            "repeated": 0,
            "id": 4784
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": ",\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 4785
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": ")\\xa5*\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87W\\xf2\\xb0 \\x00"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 4786
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b04218",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03158000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000a000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4787
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "<\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 4788
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "products.xml\\x00\\xf9]\\x06\\xe2\\xee\\x05\\x00\\x80[\\x80\\x80\\x8d\\xaa\\x12\\x92R3\\x03F4U\\x00\\x00\\x00oP\\x98 i/\\x01\\xf1A\\x83o9\\xfe\\xfeQ\\xef\\x06V\\\\xe6\\xd9\\xb6v\\x99\\x9b\\xe1\"\\x99\\x06\\x18\\xef\\x1d\\xce9\\xc9\\\\xeevw\\xd3\\xddr\\xc0\\x93\\xc41\\x1b\\xc7\\x08jqC\\xb4!\\x98\\x00\\x10\\x88\\x89B\\xe4\\xc6FQl\\xd2\\x1c\\x05\\xe2\\x05x2\\xfc\\x08\\x04Bl\\xe3\\xbd\\x10\\x01\\xa1\\xa2\\x19\\xab\\xaa@<48\\x9bG\\xa4\\xae\\xdd\\xfb\\x97-2\\xe7{\\xd4\\xd1\\xb7\\x9e;\\xdd\\x89'z\\x8cu\\xba\\x03\\xa1\\x92\\xb6\\xdc\\xf3XJ\"c\\xf1f.\\xe3M\\x8au\\xdb\\xc8[\\xa5\\xbaun\\xcb\\x06Y\\xb6\\xe6\\xc9\\xdc\\xcc\\xfe\\xcd$\\x00n]s\\x81\\xd5\\x02\\xfb\\xd7d\\x02=\t\\x1f\\x1d 2\\x10jpT\\x07vLr\\xdb\\xc0\\xcf\\x07\\xcaU\\x07\\x81'\\x9bh\\xf2.\\xe0\\xc9=\\xaaA\t\n\\xf0\\x07\\x07\\x1e-\\x10\\x01\\xcc\\xe0\\xd0\\x81\\xce\"\\x82\t\\x04l\\x00N\\xc0\\x89\\x1b\\x18\\x03\\x01\\xa0"
              },
              {
                "name": "Length",
                "value": "256"
              }
            ],
            "repeated": 0,
            "id": 4789
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "I\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4790
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4791
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "$\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4792
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "I\\x00\\x00\\x00V\\x00\\x03\\x15"
              },
              {
                "name": "Length",
                "value": "8"
              }
            ],
            "repeated": 0,
            "id": 4793
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "I\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4794
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06f20000"
              },
              {
                "name": "RegionSize",
                "value": "0x0020a000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4795
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06f20000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4796
          },
          {
            "timestamp": "2026-05-28 22:59:42,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07129000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4797
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xf9]\\x06\\xe2\\xee\\x05\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "1526"
              }
            ],
            "repeated": 0,
            "id": 4798
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "<MCT>\r\n  <Catalogs>\r\n    <Catalog version=\"1.4.1\">\r\n      <PublishedMedia id=\"\" release=\"\">\r\n        <Files>\r\n          <File id=\"\">\r\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCHINA_RET_x64FRE_zh-cn.esd</FileName>\r\n       "
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4799
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\x9d\\xb4\\x1b\\x8a\\x1e\\x02\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "550"
              }
            ],
            "repeated": 0,
            "id": 4800
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "\r\n            <LanguageCode>ar-sa</LanguageCode>\r\n            <Language>Arabic (Saudi Arabia)</Language>\r\n            <Edition>EducationN</Edition>\r\n            <Architecture>x64</Architecture>\r\n            <Size>3978057283</Size>\r\n            <Sha1>2119ef"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4801
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "Y\\xeb\\x01\\xc8\\x06\\x02\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "526"
              }
            ],
            "repeated": 0,
            "id": 4802
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e40c8",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4803
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "       <Architecture>ARM64</Architecture>\r\n            <Size>3557644558</Size>\r\n            <Sha1>7b87e44d4e11e5891feeaf350ed94eab9fcb78e7</Sha1>\r\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/661a66b4-966c-46f3-b1e7-"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4804
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "7456",
            "caller": "0x7797498d",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4805
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\x8e\\xbc\\x1b|\\x18\\x02\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8"
              }
            ],
            "repeated": 0,
            "id": 4806
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\x95\\x03\\x80\\xda*K\\x88\\x9c\\x03\\x08\\xcd\\x8f\\x91]($\\xf6\\x1a\\x9a@OU\\x9e\\xd0\\xf1\tA\\xa8\\xf0\\xdfK\\xbc\\xcf\\xbd_\\x8e\\x85\\xf9\\x0b\\x9f\\xfe\\x82\\xad\\x08\\xd7\\xfe\\xf3\\xc4\\xe1\\xb1\\xf0\\xd2\\x18\\xbe\\x07^\\xaag*\\x11\\xe5\\xe03F\\xc8kk\\xb1t\\xf2\\x8c\\xeb\\xbaz`\\xb5b\\xc6\\xe5\\xba\\x0b>)&\\xbaX7Y\\xe5(\\xa9\\x82\\x98\\xcd\\x1e\\xe3\\xc1Q\\xbd\\xd2\\xb1\\x9a/\\xab\\x92\\xd5t\\xdb\\x8a\\xe3G\\xf8]\\xd15E\\xfcV\\xe3\\xb66\\xdf\\x8b\\xfb\\xf29\\xde\\x8c'M?\\xdd\\xe6\\x1a:\\xb9\\x85\\xd2-\\xd0n\\x87e\\x08\\x04#-\r\\x90\\x0c6\\x0bo\\xa9gH\\x04#\\x7f\\x0f4C\\x1f\\x03\\xc1d\\xa1\\x1e\rP\\x84\\x92\\x85\\x82-P\\xdc\\xe7\\x18r\\xc1\\x88\\xd9\\x03x\\xe5\\x13\\xd0\\xb3\\x96\\x84\\xc81@@\\xf6\\x14%\\x9b*B\\x16azh*\\x04TU\\xf9\\xa5p}\\xd8\\x7f\t\\x16\\xe6\\x1f|\\xe0\\x99l\\xff\\xf3\\xa9j?\\xe8\\xe7\\xe3\\xa9\r}\\x8a\\xbf\\xd5\\xe6\\xc2\\x08\\x83RE\\x98<~\\xb1f\\xbdlI!;x(\\xe5"
              },
              {
                "name": "Length",
                "value": "536"
              }
            ],
            "repeated": 0,
            "id": 4807
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4808
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "resh_CLIENTCONSUMER_RET_x86FRE_et-ee.esd</FilePath>\r\n            <Key />\r\n            <Architecture_Loc>%ARCH_32%</Architecture_Loc>\r\n            <Edition_Loc>%CLIENT%</Edition_Loc>\r\n            <IsRetailOnly>False</IsRetailOnly>\r\n          </File>\r\n      "
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4809
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\x1e\\xb03\\xae\"\\x02\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "554"
              }
            ],
            "repeated": 0,
            "id": 4810
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "64%</Architecture_Loc>\r\n            <Edition_Loc>%CLIENT%</Edition_Loc>\r\n            <IsRetailOnly>True</IsRetailOnly>\r\n          </File>\r\n          <File id=\"\">\r\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_A64F"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4811
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "4\\xa4\\xafc\\x02\\x02\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "522"
              }
            ],
            "repeated": 0,
            "id": 4812
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "64%</Architecture_Loc>\r\n            <Edition_Loc>%CLIENT%</Edition_Loc>\r\n            <IsRetailOnly>False</IsRetailOnly>\r\n          </File>\r\n          <File id=\"\">\r\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4813
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\x95\\xd9a\\xbf\\xfa\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "514"
              }
            ],
            "repeated": 0,
            "id": 4814
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "\r\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_A64FRE_fr-ca.esd</FileName>\r\n            <LanguageCode>fr-ca</LanguageCode>\r\n            <Language>French (Canada)</Language>\r\n            <Edition>Core</Edition>\r\n "
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4815
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "-\\xfe\\x07\\x04\\xf8\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "512"
              }
            ],
            "repeated": 0,
            "id": 4816
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "        <Sha1>d035018417af686fc854850966e22cc89b4f1336</Sha1>\r\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/ba9f4677-1dff-4286-bf73-8b03476cf5d8/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64F"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4817
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xd9\\x84\\xcc\\xec\\x02\\x02\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "522"
              }
            ],
            "repeated": 0,
            "id": 4818
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "rchitecture_Loc>\r\n            <Edition_Loc>%CLIENT%</Edition_Loc>\r\n            <IsRetailOnly>False</IsRetailOnly>\r\n          </File>\r\n          <File id=\"\">\r\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_nb"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4819
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xe5\\xf4\\xdc\\xda\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "482"
              }
            ],
            "repeated": 0,
            "id": 4820
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "ame>\r\n            <LanguageCode>ro-ro</LanguageCode>\r\n            <Language>Romanian (Romania)</Language>\r\n            <Edition>ProfessionalWorkstation</Edition>\r\n            <Architecture>x86</Architecture>\r\n            <Size>2825172084</Size>\r\n          "
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4821
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xb9\\xd1\\x9a\\x88\\x1e\\x02\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "550"
              }
            ],
            "repeated": 0,
            "id": 4822
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "ion>ProfessionalEducationN</Edition>\r\n            <Architecture>x86</Architecture>\r\n            <Size>2866872688</Size>\r\n            <Sha1>0c100bff127c72c09e4943e42babb7aea6f0b1b5</Sha1>\r\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestream"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4823
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\"g\\xcey\\xe4\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "492"
              }
            ],
            "repeated": 0,
            "id": 4824
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_zh-tw.esd</FilePath>\r\n            <Key />\r\n            <Architecture_Loc>%ARCH_64%</Architecture_Loc>\r\n            <Edition_Loc>%CLIENT%</Edition_Loc>\r\n            <IsRetailOnly>False</IsRetailOnly>\r"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4825
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\t\\xe2\\xbb\\x9f\\xda\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "482"
              }
            ],
            "repeated": 0,
            "id": 4826
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "31204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_A64FRE_nb-no.esd</FilePath>\r\n            <Key />\r\n            <Architecture_Loc>%ARCH_64%</Architecture_Loc>\r\n            <Edition_Loc>%CLIENT%</Edition_Loc>\r\n            <IsRetailOnly>True</IsRetailOn"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4827
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "4o\\x1ew\\x9c\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "420"
              }
            ],
            "repeated": 0,
            "id": 4828
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "c>\r\n            <IsRetailOnly>False</IsRetailOnly>\r\n          </File>\r\n          <File id=\"\">\r\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x86FRE_pt-pt.esd</FileName>\r\n            <LanguageCode>pt-pt</LanguageCo"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4829
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "i\\x0e_3\\xdc\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "484"
              }
            ],
            "repeated": 0,
            "id": 4830
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "onal</Edition>\r\n            <Architecture>x86</Architecture>\r\n            <Size>2828812256</Size>\r\n            <Sha1>170c123ceb0f4d240dd644a9c6d3bd4aa428689a</Sha1>\r\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/16cf0"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4831
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xb7\\xb7\\xd4\\xca\\xca\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "466"
              }
            ],
            "repeated": 0,
            "id": 4832
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "ONSUMER_RET_x86FRE_sr-latn-rs.esd</FileName>\r\n            <LanguageCode>sr-latn-rs</LanguageCode>\r\n            <Language>Serbian (Latin, Serbia)</Language>\r\n            <Edition>CloudN</Edition>\r\n            <Architecture>x86</Architecture>\r\n            <S"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4833
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xe0\\x90\\x01n\\xda\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "482"
              }
            ],
            "repeated": 0,
            "id": 4834
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "1>f0a6fdbd471f13b009aa03d4e2d95da8d25d6a8a</Sha1>\r\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/9c1da917-dc7f-47a8-81fe-97344d254de8/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_fi-fi.esd"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4835
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xa3ffJ\n\\x02\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "530"
              }
            ],
            "repeated": 0,
            "id": 4836
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "n_Loc>\r\n            <IsRetailOnly>False</IsRetailOnly>\r\n          </File>\r\n          <File id=\"\">\r\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x86FRE_cs-cz.esd</FileName>\r\n            <LanguageCode>cs-cz</Langua"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4837
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\x05D9\\x94\\xe8\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "496"
              }
            ],
            "repeated": 0,
            "id": 4838
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "<Architecture>x86</Architecture>\r\n            <Size>2956184919</Size>\r\n            <Sha1>e1566a1cbe23de0f133f9920fa29b7ff74dfc38e</Sha1>\r\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/6657c195-f60e-41dc-a25e-f205d78de"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4839
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "1wk\\xd7\\xce\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "470"
              }
            ],
            "repeated": 0,
            "id": 4840
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "ilePath>\r\n            <Key />\r\n            <Architecture_Loc>%ARCH_32%</Architecture_Loc>\r\n            <Edition_Loc>%CLIENT%</Edition_Loc>\r\n            <IsRetailOnly>False</IsRetailOnly>\r\n          </File>\r\n          <File id=\"\">\r\n            <FileName>190"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4841
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "[\\x11\\x9c\\x10\\xda\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "482"
              }
            ],
            "repeated": 0,
            "id": 4842
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "es-mx</LanguageCode>\r\n            <Language>Spanish (Mexico)</Language>\r\n            <Edition>Education</Edition>\r\n            <Architecture>ARM64</Architecture>\r\n            <Size>3615174250</Size>\r\n            <Sha1>fdce6cee7f656c96b61966a3505bda7e45ea62"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4843
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xc9Q\\xae\\x8e\\xe4\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "492"
              }
            ],
            "repeated": 0,
            "id": 4844
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "</Architecture>\r\n            <Size>3669966055</Size>\r\n            <Sha1>d56d895f1cd6cfc2f78cf8b2df85a405db160d7e</Sha1>\r\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/a0f9a4c1-f2b4-4f9d-8598-ca0afeb81ebd/19045.3803.23"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4845
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xe3\\x1a!\\xa2\\xda\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "482"
              }
            ],
            "repeated": 0,
            "id": 4846
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "04.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_hu-hu.esd</FilePath>\r\n            <Key />\r\n            <Architecture_Loc>%ARCH_64%</Architecture_Loc>\r\n            <Edition_Loc>%CLIENT%</Edition_Loc>\r\n            <IsRetailOnly>False</IsRetailOnly>\r\n  "
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4847
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xd9\\x9d\\xdd\\xd3\\xd6\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "478"
              }
            ],
            "repeated": 0,
            "id": 4848
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "e id=\"\">\r\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x86FRE_zh-cn.esd</FileName>\r\n            <LanguageCode>zh-cn</LanguageCode>\r\n            <Language>Chinese (Simplified, China)</Language>\r\n            <Editi"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4849
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xf23\\x84\\x83\\xcc\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "468"
              }
            ],
            "repeated": 0,
            "id": 4850
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "(Lithuania)</Language>\r\n            <Edition>Core</Edition>\r\n            <Architecture>x64</Architecture>\r\n            <Size>4016207526</Size>\r\n            <Sha1>daaf51acc44e13894e91c7914564c092bc379ef7</Sha1>\r\n            <FilePath>http://dl.delivery.mp.m"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4851
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xc7h9U\\xc4\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "460"
              }
            ],
            "repeated": 0,
            "id": 4852
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_th-th.esd</FilePath>\r\n            <Key />\r\n            <Architecture_Loc>%ARCH_64%</Architecture_Loc>\r\n            <Edition_Loc>%CLIENT%</Edition_Loc>\r\n            <IsRetailOnly>False</IsRetailOnly>\r"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4853
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e4186",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x000\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "4048"
              }
            ],
            "repeated": 0,
            "id": 4854
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "_refresh_CLIENTCONSUMER_RET_A64FRE_da-dk.esd</FileName>\r\n            <LanguageCode>da-dk</LanguageCode>\r\n            <Language>Danish (Denmark)</Language>\r\n            <Edition>ProfessionalWorkstationN</Edition>\r\n            <Architecture>ARM64</Architectu"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4855
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\x89C\\x10\\xbb\\xd0\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "472"
              }
            ],
            "repeated": 0,
            "id": 4856
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "/Size>\r\n            <Sha1>b271403ab23826708f626f671b2115e6f96c166d</Sha1>\r\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/91c7756c-5b20-4342-8651-e5186d978951/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSU"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4857
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xe7\\x96\\xa3D\\xde\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "486"
              }
            ],
            "repeated": 0,
            "id": 4858
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "Path>\r\n            <Key />\r\n            <Architecture_Loc>%ARCH_64%</Architecture_Loc>\r\n            <Edition_Loc>%CLIENT%</Edition_Loc>\r\n            <IsRetailOnly>True</IsRetailOnly>\r\n          </File>\r\n          <File id=\"\">\r\n            <FileName>19045.3"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4859
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\x96\\xb9HC\\xc8\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "464"
              }
            ],
            "repeated": 0,
            "id": 4860
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": ">\r\n            <IsRetailOnly>False</IsRetailOnly>\r\n          </File>\r\n          <File id=\"\">\r\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_zh-cn.esd</FileName>\r\n            <LanguageCode>zh-cn</LanguageCod"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4861
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xa1\\xb8\\x92\\x08\\xbe\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "454"
              }
            ],
            "repeated": 0,
            "id": 4862
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "lovak (Slovakia)</Language>\r\n            <Edition>ProfessionalEducation</Edition>\r\n            <Architecture>x64</Architecture>\r\n            <Size>4029185753</Size>\r\n            <Sha1>58b5d832727db7225f9998835f2316ecee5ce0bc</Sha1>\r\n            <FilePath>h"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4863
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xbe\\xee\\xfb\\x98\\xe8\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "496"
              }
            ],
            "repeated": 0,
            "id": 4864
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "5970</Size>\r\n            <Sha1>e1c14e3e70fc8d14f683245ed9a33aec51dcb77b</Sha1>\r\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/1ccdf6b6-f9d9-4a6f-b0bd-0baffc051025/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENT"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4865
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "/,\\x1f\\xa0~\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "390"
              }
            ],
            "repeated": 0,
            "id": 4866
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "           <Architecture_Loc>%ARCH_32%</Architecture_Loc>\r\n            <Edition_Loc>%CLIENT%</Edition_Loc>\r\n            <IsRetailOnly>False</IsRetailOnly>\r\n          </File>\r\n          <File id=\"\">\r\n            <FileName>19045.3803.231204-0204.22h2_release"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4867
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "e+6\"\\xe2\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "490"
              }
            ],
            "repeated": 0,
            "id": 4868
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "        <Language>Chinese (Traditional, Taiwan)</Language>\r\n            <Edition>Professional</Edition>\r\n            <Architecture>x86</Architecture>\r\n            <Size>2983288179</Size>\r\n            <Sha1>c5a58604b5912d13e9cfaf7e3380ea324aa9b6d8</Sha1>\r\n "
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4869
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "/i\\xc3f\\xcc\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "468"
              }
            ],
            "repeated": 0,
            "id": 4870
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": ">bfc2015c5b40b52fffe8d117223e2f6a146cc64e</Sha1>\r\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/26a80973-49ac-4fde-9f86-fbb072abfb84/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_uk-ua.esd<"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4871
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xba\\xb3q\\x8d\\xd8\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "480"
              }
            ],
            "repeated": 0,
            "id": 4872
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": ">%ARCH_64%</Architecture_Loc>\r\n            <Edition_Loc>%CLIENT%</Edition_Loc>\r\n            <IsRetailOnly>True</IsRetailOnly>\r\n          </File>\r\n          <File id=\"\">\r\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_R"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4873
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xdb\\xed<6\\xd6\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "478"
              }
            ],
            "repeated": 0,
            "id": 4874
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "  <LanguageCode>fr-fr</LanguageCode>\r\n            <Language>French (France)</Language>\r\n            <Edition>Cloud</Edition>\r\n            <Architecture>ARM64</Architecture>\r\n            <Size>3668803448</Size>\r\n            <Sha1>4702f40db9c76cb5a25241ca4fa"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4875
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\yi%\\xd2\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "474"
              }
            ],
            "repeated": 0,
            "id": 4876
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "/Sha1>\r\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/a122c262-ba72-4db6-8112-efe1000ae31f/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_A64FRE_uk-ua.esd</FilePath>\r\n            <Key />\r\n         "
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4877
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xd6\\xdf\\xe79(\\x03\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "816"
              }
            ],
            "repeated": 0,
            "id": 4878
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "sRetailOnly>False</IsRetailOnly>\r\n          </File>\r\n          <File id=\"\">\r\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_et-ee.esd</FileName>\r\n            <LanguageCode>et-ee</LanguageCode>\r\n            <"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4879
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\x99\\xfb|\\xb9\\x98\\x06\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "1696"
              }
            ],
            "repeated": 0,
            "id": 4880
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "ithuania)</Language>\r\n            <Edition>EnterpriseN</Edition>\r\n            <Architecture>x86</Architecture>\r\n            <Size>2771838649</Size>\r\n            <Sha1>86d8510e84a79f5041cb0d5509b8d204f66c5b47</Sha1>\r\n            <FilePath>http://dl.delivery"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4881
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "_a\\xb8\\xd0|\\x06\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "1668"
              }
            ],
            "repeated": 0,
            "id": 4882
          },
          {
            "timestamp": "2026-05-28 22:59:42,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "Path>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/b081c583-39e7-455e-9097-a360a30a145d/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTBUSINESS_VOL_x64FRE_ro-ro.esd</FilePath>\r\n            <Key />\r\n            <Architecture_Loc>%ARC"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4883
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "g\\xf2\\xbfuj\\x06\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "1650"
              }
            ],
            "repeated": 0,
            "id": 4884
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "_VOL_x64FRE_nl-nl.esd</FilePath>\r\n            <Key />\r\n            <Architecture_Loc>%ARCH_64%</Architecture_Loc>\r\n            <Edition_Loc>%ENTERPRISE_N%</Edition_Loc>\r\n            <IsRetailOnly>True</IsRetailOnly>\r\n          </File>\r\n          <File id=\""
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4885
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d8e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4886
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d28000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4887
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d6b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4888
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d4b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4889
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03161000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4890
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d65000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4891
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d30000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4892
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\x9cp--\\x92\\x06\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "8"
              }
            ],
            "repeated": 0,
            "id": 4893
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xc2N\\xa3\\xcf\\xde\\xd9d\\xfay,\\xed\\xf2_\\x84Q\\x9c\\xae\\xc9\\xabz\\xab\nzy\\x85\\xf87i\\xb3V\\x19e\\xcb)\\x9e\\x8d\\x93\\x11\\xcbow\r\\x81\\x0c\\x96\\xc7N\\xc8\\xbbO\\xe5\\x16\\xe6\\x96g\\x10X\\xc6\\xfd\\xdfS\\xf1\\xac\\xb6Tv\\xc2\\xe7\\xb6W\\xaf\\xf5;\\x80\\x1d\\xfa\\xad\\x93*<\\xec\\xd4g\\xab\\x15*<\\xcd\\xb9\\xf5\\xfc\\xfd\\x1fw\\xa8-\\xf9\\x1cn*\\xe2\\x9a(\\xd2X\\xba\\x0b3E\\xe1\\xb4*+~N\\xbdq\\'\\x8bS\\xc0\\xb6(\\xe2\\x92p\\xd9\\xae\\x9e\\xccg\\x18J4\\xca\\xee\\xc5X\\xe3\\x1b\\xc2{\\x92Fu\\xba\\x11\\xa3T\\xc3W\\x0c\\xbb\\xe3\\xb6DR\\xe8\\xe7\\xb9c\\xf0\\xf4\\xd3-\\xb0\\xf1\\xcbr\\xd0\\x05j\\xc2\\xad\\xe7u\\xea\\xefW\\x8b=SK\\x93\\xf7\\x1b\\N\\x9co\\xac\\xa1\\x94\\xe5%S\\x8e7Uj\\xaf\\x0c\\xdd\\x8c\\x17\\xaa\\xdf[\\x0eu\\xf2Tr7;\\x9e\\x08b\\xf5\\xb5\\xa9\\xbb\\xd5\\xf6\r\\x8d\\x1b5e\\x8d+/\\x82\\x18\\xcb\\xf56_\\xba\\x08'\\xfd\\xf7}\\xbbh\\xea\\xdf/\\xf0tS-T\\xdf"
              },
              {
                "name": "Length",
                "value": "1682"
              }
            ],
            "repeated": 0,
            "id": 4894
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d8e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4895
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030e9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4896
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4897
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d66000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4898
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d8e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4899
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "etailOnly>\r\n          </File>\r\n          <File id=\"\">\r\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTBUSINESS_VOL_x86FRE_es-mx.esd</FileName>\r\n            <LanguageCode>es-mx</LanguageCode>\r\n            <Language>Spanish (Mexi"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4900
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "'I0G\\x84\\x06\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "1676"
              }
            ],
            "repeated": 0,
            "id": 4901
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d66000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4902
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "-jp.esd</FileName>\r\n            <LanguageCode>ja-jp</LanguageCode>\r\n            <Language>Japanese (Japan)</Language>\r\n            <Edition>Enterprise</Edition>\r\n            <Architecture>ARM64</Architecture>\r\n            <Size>3713870165</Size>\r\n         "
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4903
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xb2I>\\x9cJ\\x05\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "1362"
              }
            ],
            "repeated": 0,
            "id": 4904
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aee39c",
            "parentcaller": "0x77aee328",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00b82000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4905
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4906
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "ze>4029086170</Size>\r\n            <Sha1>caa24a06d73531b5b588ed717a185a72d57f128b</Sha1>\r\n            <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/b4fe2c14-0069-421d-a78d-64f75c2828f0/19045.3803.231204-0204.22h2_release_svc_refre"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4907
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\x88v\\xb8\\xbc:\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "322"
              }
            ],
            "repeated": 0,
            "id": 4908
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "f925debb0dae/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_ko-kr.esd</FilePath>\r\n            <Key />\r\n            <Architecture_Loc>%ARCH_64%</Architecture_Loc>\r\n            <Edition_Loc>%CLIENT%</Edition_Loc>\r\n            <IsRe"
              },
              {
                "name": "Length",
                "value": "32768"
              }
            ],
            "repeated": 0,
            "id": 4909
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\x0eb\\xebd*\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "306"
              }
            ],
            "repeated": 0,
            "id": 4910
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xf5P\\xd7\\x036\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "318"
              }
            ],
            "repeated": 0,
            "id": 4911
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d8e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4912
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d3a000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4913
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4914
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d6c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4915
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d6c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4916
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "R\\xc9\\x91P&\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "302"
              }
            ],
            "repeated": 0,
            "id": 4917
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d28000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4918
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\xc0C\\xc4a.\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "310"
              }
            ],
            "repeated": 0,
            "id": 4919
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\x9c\\x81\\xc3\\xad0\\x01\\x00\\x80"
              },
              {
                "name": "Length",
                "value": "624"
              }
            ],
            "repeated": 0,
            "id": 4920
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4921
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4922
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e414a",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4923
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006f8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "Buffer",
                "value": "\\x80B\\xd7\\x07=\\xd9\\xc8\\xbc\\x06R\\xca\\xfe\\xed\\xf6P\\xa1v\\x1bl\\xabVH\\x04#v\\x0e\\x16\\xcb\\xa1\\xe2\\x1bD({\\xe9\\xb6`\n\\xd9\\xdf\\xdab*\\xf4n\\x836\\xd8\\x85\\x940r\\xe9@\\x06[\\x10\\xd1F\\xc87\\x0e\\xa7sM%?\\xbbf@l\\G!\\xe8\\xb9\\xee\\xd9p!\\x16\\x03Z\\xd4\\x14\"{\\x81b>A\\x17;{P\\x08\\xec\\x05B\\xe87\\x90\\xb0\\xb3@\\x85\\xce^\\x15\\xda{\\x81\\xd09\\x0b\\xa2\\xd2\\xd90\\x85go\\x15:{A\\x94<\\x81+\\xc4\\x9d\\x032\\xee\\xd3T\\xf5\\xbb6\\x04,\\xd0\\x1f\\x9b\\x19\\xe4\\x9dm(*\\xfbPN\\x01\\xb6\\xd9\\xc6@8Q(\\xeb\\x05Zb\\x17\\x02\\xc1\\x08;\\x03pe\\xd0|\\x0b\\x9e'\\xdb\\xb1\\x07 \n\\xd9\\xde\\x1e\\)T\\xf5\\x82\\xd9\\xaa\\x15\\xe2\\xc1H;\\x03\\x80e\\xd0u\\x0b\\xa0(\\xdbA\\x07@\n\\xd9\\xde\\x1c`*\\x94\\xf5\\x02l\\xb0\n\\xe1`\\xc4\\xd1\\x81\r\\xb6\\xa1\\x9b\\x8c\\x8cn\\x1cP\\xe7b\\xef,\\xd6\\xa0\\xf3\\xf82\\xc8;*U\\xe5Z\\xa1\\xa0\\x1b\\x80"
              },
              {
                "name": "Length",
                "value": "6632"
              }
            ],
            "repeated": 0,
            "id": 4924
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000700"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdcAu\\x94)\\xda\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4925
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000700"
              }
            ],
            "repeated": 0,
            "id": 4926
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.cab"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "I\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 4927
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006c4"
              }
            ],
            "repeated": 0,
            "id": 4928
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006f8"
              }
            ],
            "repeated": 0,
            "id": 4929
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              }
            ],
            "repeated": 0,
            "id": 4930
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4931
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4932
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc78\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4933
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc78\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4934
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4935
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4936
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4937
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00;9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4938
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": ";9\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4939
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4940
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources"
              }
            ],
            "repeated": 1,
            "id": 4941
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000006fc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x699e7340"
              },
              {
                "name": "Parameter",
                "value": "0x06d35a40"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "7496"
              },
              {
                "name": "ProcessId",
                "value": "5932"
              },
              {
                "name": "Module",
                "value": "WINDLP.DLL"
              }
            ],
            "repeated": 0,
            "id": 4942
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "threading",
            "api": "CreateThread",
            "status": true,
            "return": "0x000006fc",
            "arguments": [
              {
                "name": "StartRoutine",
                "value": "0x699e7340"
              },
              {
                "name": "ModuleName",
                "value": "WINDLP.DLL"
              },
              {
                "name": "Parameter",
                "value": "0x06d35a40"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "7496"
              }
            ],
            "repeated": 0,
            "id": 4943
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000708"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x699e7340"
              },
              {
                "name": "Parameter",
                "value": "0x06d35a54"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "7500"
              },
              {
                "name": "ProcessId",
                "value": "5932"
              },
              {
                "name": "Module",
                "value": "WINDLP.DLL"
              }
            ],
            "repeated": 0,
            "id": 4944
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "threading",
            "api": "CreateThread",
            "status": true,
            "return": "0x00000708",
            "arguments": [
              {
                "name": "StartRoutine",
                "value": "0x699e7340"
              },
              {
                "name": "ModuleName",
                "value": "WINDLP.DLL"
              },
              {
                "name": "Parameter",
                "value": "0x06d35a54"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "7500"
              }
            ],
            "repeated": 0,
            "id": 4945
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4946
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4947
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d8e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4948
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d3a000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4949
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d6b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4950
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d30000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4951
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d65000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4952
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03161000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4953
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d3a000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4954
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xfd9\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4955
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xfd9\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4956
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4957
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4958
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4959
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03161000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4960
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d65000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4961
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00N:\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4962
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d30000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4963
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "N:\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4964
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4965
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4966
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4967
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9e:\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4968
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x9e:\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4969
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4970
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4971
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4972
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xff:\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4973
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d6b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4974
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xff:\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4975
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4976
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4977
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4978
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00_;\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4979
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "_;\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4980
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4981
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4982
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4983
          },
          {
            "timestamp": "2026-05-28 22:59:42,206",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xb3;\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4984
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb3;\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4985
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4986
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4987
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4988
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d8e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4989
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x1b<\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4990
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d8e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4991
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d3a000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4992
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030e9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4993
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4994
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d6c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4995
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d3a000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4996
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x1b<\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4997
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4998
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 4999
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d6c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5000
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000710"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x699e6f90"
              },
              {
                "name": "Parameter",
                "value": "0x06d35720"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "7504"
              },
              {
                "name": "ProcessId",
                "value": "5932"
              },
              {
                "name": "Module",
                "value": "WINDLP.DLL"
              }
            ],
            "repeated": 0,
            "id": 5001
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "threading",
            "api": "CreateThread",
            "status": true,
            "return": "0x00000710",
            "arguments": [
              {
                "name": "StartRoutine",
                "value": "0x699e6f90"
              },
              {
                "name": "ModuleName",
                "value": "WINDLP.DLL"
              },
              {
                "name": "Parameter",
                "value": "0x06d35720"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "7504"
              }
            ],
            "repeated": 0,
            "id": 5002
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5003
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5004
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5005
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00l<\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5006
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "l<\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5007
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 5008
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7496",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5009
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5010
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7500",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5011
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7500",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5012
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d8e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5013
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030e9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5014
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x77b265e6",
            "parentcaller": "0x77b264f1",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5015
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x00000000"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5016
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5017
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5018
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06da5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5019
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd1<\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5020
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd1<\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5021
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 5022
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5023
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5024
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x001=\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5025
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "1=\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5026
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 5027
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5028
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5029
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x96=\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5030
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x96=\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5031
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 5032
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5033
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000006f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5034
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x699e7163",
            "parentcaller": "0x75d4fcc9",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 2,
            "id": 5035
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5036
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\t\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5037
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xf8\t\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5038
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"663\" Fil=\"\" Fun=\"CSetupDiagnostics::LogString\" Uid=\"51019776\" Msg=\"CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x2002]\" PID=\"5932\" TID=\"7504\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\Set"
              },
              {
                "name": "Length",
                "value": "329"
              }
            ],
            "repeated": 0,
            "id": 5039
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x11>\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5040
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x11>\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5041
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 5042
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5043
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5044
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x8d>\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5045
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x8d>\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5046
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 5047
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00f4d5ae",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5048
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798917f",
            "parentcaller": "0x69ebb4b3",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "MediaSetupUIMgr.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69e80000"
              }
            ],
            "repeated": 0,
            "id": 5049
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "COMCTL32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x72970000"
              }
            ],
            "repeated": 0,
            "id": 5050
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x6b50ed62",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "InitCommonControlsEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x729c33e0"
              }
            ],
            "repeated": 0,
            "id": 5051
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b5d4000"
              },
              {
                "name": "ModuleName",
                "value": "MFC42u.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5052
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b5d4000"
              },
              {
                "name": "ModuleName",
                "value": "MFC42u.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5053
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "COMCTL32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x72970000"
              }
            ],
            "repeated": 0,
            "id": 5054
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x6b50ed62",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "InitCommonControlsEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x729c33e0"
              }
            ],
            "repeated": 0,
            "id": 5055
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "COMCTL32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x72970000"
              }
            ],
            "repeated": 0,
            "id": 5056
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x6b50ed62",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "InitCommonControlsEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x729c33e0"
              }
            ],
            "repeated": 0,
            "id": 5057
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "COMCTL32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x72970000"
              }
            ],
            "repeated": 0,
            "id": 5058
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x6b50ed62",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "InitCommonControlsEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x729c33e0"
              }
            ],
            "repeated": 0,
            "id": 5059
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x7798e5e6",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "COMCTL32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x72970000"
              }
            ],
            "repeated": 0,
            "id": 5060
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x6b50ed62",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "InitCommonControlsEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x729c33e0"
              }
            ],
            "repeated": 0,
            "id": 5061
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00f4d5ae",
            "parentcaller": "0x00000000",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 5062
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5063
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5064
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x777e2ee4",
            "parentcaller": "0x777dbe71",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 5065
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06db5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5066
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77b00349",
            "parentcaller": "0x77b037d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06df4000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5067
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x747e43c2",
            "parentcaller": "0x747e45a1",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000720"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "\\Sessions\\1\\Windows\\ThemeSection"
              }
            ],
            "repeated": 0,
            "id": 5068
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7799762b",
            "parentcaller": "0x747e4413",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000720"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x072b0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x067ce1a4"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5069
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x747e43c2",
            "parentcaller": "0x747e4668",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000724"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "\\Windows\\Theme4085422095"
              }
            ],
            "repeated": 0,
            "id": 5070
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x747e43c2",
            "parentcaller": "0x747e467a",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000728"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "\\Sessions\\1\\Windows\\Theme149276106"
              }
            ],
            "repeated": 0,
            "id": 5071
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77999145",
            "parentcaller": "0x747e4721",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x072b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5072
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x747e472a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000720"
              }
            ],
            "repeated": 0,
            "id": 5073
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7799762b",
            "parentcaller": "0x747e49c2",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000724"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x072b0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x067ce830"
              },
              {
                "name": "ViewSize",
                "value": "0x000e2000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5074
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7799762b",
            "parentcaller": "0x747e49db",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000728"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x073a0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x067ce830"
              },
              {
                "name": "ViewSize",
                "value": "0x00004000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5075
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798917f",
            "parentcaller": "0x747e51bf",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 5076
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747e51d0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af2470"
              }
            ],
            "repeated": 0,
            "id": 5077
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747e569c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b341e0"
              }
            ],
            "repeated": 0,
            "id": 5078
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747e561b",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af0700"
              }
            ],
            "repeated": 0,
            "id": 5079
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747e631e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b2c3b0"
              }
            ],
            "repeated": 0,
            "id": 5080
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747e575b",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b253f0"
              }
            ],
            "repeated": 0,
            "id": 5081
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747e526e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b1f560"
              }
            ],
            "repeated": 0,
            "id": 5082
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77989b67",
            "parentcaller": "0x747e584c",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000720"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5932:168:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5083
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798ac59",
            "parentcaller": "0x747e592b",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000720"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5084
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5085
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000072c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5086
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x747e5a20",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000072c"
              }
            ],
            "repeated": 0,
            "id": 5087
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798dd70",
            "parentcaller": "0x747e590a",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000720"
              }
            ],
            "repeated": 1,
            "id": 5088
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77b11f80",
            "parentcaller": "0x77af8db8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 5089
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77af931b",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000072c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\USER32.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 5090
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77af97cc",
            "parentcaller": "0x77af92ae",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000730"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000072c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\en-US\\user32.dll.mui"
              }
            ],
            "repeated": 0,
            "id": 5091
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77af97f4",
            "parentcaller": "0x77af92ae",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000730"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x073b0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x067ce3d0"
              },
              {
                "name": "ViewSize",
                "value": "0x00005000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5092
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77af9804",
            "parentcaller": "0x77af92ae",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000730"
              }
            ],
            "repeated": 0,
            "id": 5093
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x775fe27c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "comctl32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x72970000"
              }
            ],
            "repeated": 0,
            "id": 5094
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x775fe294",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "RegisterClassNameW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x729c3530"
              }
            ],
            "repeated": 0,
            "id": 5095
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x7798ad32",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "user32"
              },
              {
                "name": "BaseAddress",
                "value": "0x775d0000"
              }
            ],
            "repeated": 0,
            "id": 5096
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xdc>\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5097
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xdc>\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5098
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 5099
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5100
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5101
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x72b20000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5102
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x72b20000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5103
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x747dcadd",
            "parentcaller": "0x747dca5a",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 2,
            "id": 5104
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77af931b",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SystemResources\\USER32.dll.mun"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 5105
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06e08000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5106
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77af931b",
            "parentcaller": "0x77af9782",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SystemResources\\USER32.dll.mun"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 5107
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00Q?\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5108
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "Q?\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5109
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 5110
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x775fe27c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "comctl32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x72970000"
              }
            ],
            "repeated": 0,
            "id": 5111
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x775fe294",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "RegisterClassNameW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x729c3530"
              }
            ],
            "repeated": 0,
            "id": 5112
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5113
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5114
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa2?\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5115
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x747dcadd",
            "parentcaller": "0x747dc9dd",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 2,
            "id": 5116
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x068e1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5117
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x068e2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5118
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x068e4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5119
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77af130f",
            "parentcaller": "0x77af108a",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000009",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager"
              }
            ],
            "repeated": 0,
            "id": 5120
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77af132c",
            "parentcaller": "0x77af108a",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "ValueName",
                "value": "ResourcePolicies"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies"
              }
            ],
            "repeated": 0,
            "id": 5121
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77af1342",
            "parentcaller": "0x77af108a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000730"
              }
            ],
            "repeated": 0,
            "id": 5122
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77aef00b",
            "parentcaller": "0x77aeef00",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x073c0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5123
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77aef052",
            "parentcaller": "0x77aeef00",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x073c0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5124
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xa2?\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5125
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 5126
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x7798917f",
            "parentcaller": "0x69cec56b",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              }
            ],
            "repeated": 0,
            "id": 5127
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              },
              {
                "name": "FunctionName",
                "value": "GetUILanguageInfo"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x75d639e0"
              }
            ],
            "repeated": 0,
            "id": 5128
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x75d30000"
              },
              {
                "name": "FunctionName",
                "value": "GetUserPreferredUILanguages"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x75d493e0"
              }
            ],
            "repeated": 0,
            "id": 5129
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x7798c899",
            "parentcaller": "0x69cec168",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              }
            ],
            "repeated": 0,
            "id": 5130
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x69d48bda",
            "parentcaller": "0x69d4afa1",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000738"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 5131
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x69d48bf4",
            "parentcaller": "0x69d4afa1",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000738"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xb0*\\x00\\x00\\x00\\x00\\x00)\\xa5*\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5132
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x77b47b75",
            "parentcaller": "0x77b08aa0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x073e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x002ad000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5133
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47b90",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x073e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 5134
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47bb5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0768c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 5135
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7504",
            "caller": "0x69d48cd4",
            "parentcaller": "0x69d5326f",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000738"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "Buffer",
                "value": "<MCT>\r\n  <Catalogs>\r\n    <Catalog version=\"1.4.1\">\r\n      <PublishedMedia id=\"\" release=\"\">\r\n        <Files>\r\n          <File id=\"\">\r\n            <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCHINA_RET_x64FRE_zh-cn.esd</FileName>\r\n       "
              },
              {
                "name": "Length",
                "value": "2794793"
              }
            ],
            "repeated": 0,
            "id": 5136
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e40c8",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 5137
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5138
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5139
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e410c",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "6646"
              }
            ],
            "repeated": 0,
            "id": 5140
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77b0dd72",
            "parentcaller": "0x77b11873",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\TextShaping"
              },
              {
                "name": "BaseAddress",
                "value": "0x6b250000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6b2df2f0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5141
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7784e000"
              },
              {
                "name": "ModuleName",
                "value": "gdi32full.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5142
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7784e000"
              },
              {
                "name": "ModuleName",
                "value": "gdi32full.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5143
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5144
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5145
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 5146
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000109",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink"
              }
            ],
            "repeated": 0,
            "id": 5147
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7796b853",
            "parentcaller": "0x779ce66a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "KeyInformation",
                "value": "\\xff9a\\x066\\xffe5\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x00\\x00\\x006\\x00\\x00\\x00\\xff84\\x03\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 5148
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5149
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5150
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5151
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5152
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5153
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5154
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5155
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5156
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5157
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5158
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5159
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5160
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5161
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5162
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5163
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5164
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5165
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5166
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5167
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5168
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5169
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5170
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5171
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5172
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5173
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5174
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5175
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5176
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5177
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5178
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5179
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5180
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "16"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5181
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "16"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5182
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "17"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5183
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "17"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5184
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "18"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5185
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "18"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5186
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "19"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5187
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "19"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5188
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "20"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5189
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "20"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5190
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "21"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5191
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "21"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5192
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "22"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5193
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "22"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5194
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "23"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5195
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "23"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5196
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "24"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5197
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "24"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5198
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "25"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5199
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "25"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5200
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "26"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5201
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "26"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5202
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "27"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5203
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "27"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5204
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "28"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5205
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "28"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5206
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "29"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5207
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "29"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5208
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "30"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5209
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "30"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5210
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "31"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5211
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "31"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5212
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "32"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5213
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "32"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5214
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "33"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5215
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "33"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5216
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "34"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5217
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "34"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5218
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "35"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5219
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "35"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5220
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "36"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5221
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "36"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5222
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "37"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5223
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "37"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5224
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "38"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5225
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "38"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5226
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "39"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5227
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "39"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5228
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "40"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5229
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "40"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5230
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "41"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5231
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "41"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5232
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "42"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5233
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "42"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5234
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "43"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5235
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "43"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5236
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "44"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5237
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "44"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5238
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "45"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5239
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "45"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5240
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "46"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5241
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "46"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5242
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "47"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5243
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "47"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5244
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "48"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5245
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "48"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5246
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "49"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5247
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "49"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5248
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "50"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5249
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "50"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5250
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "51"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5251
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "51"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5252
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "52"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5253
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "52"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5254
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "53"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5255
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "53"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5256
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "54"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5257
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "54"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5258
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "55"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5259
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "55"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5260
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "56"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5261
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "56"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5262
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "57"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5263
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "57"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5264
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "58"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5265
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "58"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5266
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "59"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5267
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "59"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5268
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "60"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5269
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "60"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5270
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "61"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5271
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "61"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5272
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "62"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5273
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "62"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5274
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "63"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5275
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "63"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5276
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "64"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5277
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "64"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5278
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "65"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5279
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "65"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5280
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "66"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5281
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfe05",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "66"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5282
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cfd73",
            "parentcaller": "0x7797d052",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "Index",
                "value": "67"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5283
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x777d530f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000730"
              }
            ],
            "repeated": 0,
            "id": 5284
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x777dec67",
            "parentcaller": "0x777d33cc",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 5285
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 5286
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000101",
                "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"
              }
            ],
            "repeated": 0,
            "id": 5287
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "ValueName",
                "value": "Disable"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable"
              }
            ],
            "repeated": 0,
            "id": 5288
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000730"
              },
              {
                "name": "ValueName",
                "value": "DataFilePath"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "C:\\Windows\\Fonts\\staticcache.dat"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath"
              }
            ],
            "repeated": 0,
            "id": 5289
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x777dfc31",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000730"
              }
            ],
            "repeated": 0,
            "id": 5290
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77988f9b",
            "parentcaller": "0x77988a9e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000730"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Fonts\\staticcache.dat"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5291
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x779aecdc",
            "parentcaller": "0x777dfd24",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000730"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Fonts\\StaticCache.dat"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00&\\x01\\x00\\x00\\x00\\x00\\x00\\x00&\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5292
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7798a90c",
            "parentcaller": "0x777dfd7d",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000730"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Fonts\\StaticCache.dat"
              },
              {
                "name": "Buffer",
                "value": "\\x1a\\x83W\\xa5\\x02\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00$\\x01\\x00\\x00$)\\x00\\x00\\x00\\x00\\x02\\x00\\xbe\\x02\\x00\\x00<\\x00\\x00\\x00$!\\x00\\x00L)\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00"
              },
              {
                "name": "Length",
                "value": "60"
              }
            ],
            "repeated": 0,
            "id": 5293
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x77989888",
            "parentcaller": "0x779894ee",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000734"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000730"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Fonts\\StaticCache.dat"
              }
            ],
            "repeated": 0,
            "id": 5294
          },
          {
            "timestamp": "2026-05-28 22:59:42,222",
            "thread_id": "4316",
            "caller": "0x7799762b",
            "parentcaller": "0x777dff85",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000734"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07690000"
              },
              {
                "name": "SectionOffset",
                "value": "0x067cd0f0"
              },
              {
                "name": "ViewSize",
                "value": "0x01260000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5295
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 5296
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000101",
                "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 5297
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "ValueName",
                "value": "Plane1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1"
              }
            ],
            "repeated": 0,
            "id": 5298
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "ValueName",
                "value": "Plane2"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "SimSun-ExtB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2"
              }
            ],
            "repeated": 1,
            "id": 5299
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "ValueName",
                "value": "Plane3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3"
              }
            ],
            "repeated": 0,
            "id": 5300
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "ValueName",
                "value": "Plane4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4"
              }
            ],
            "repeated": 0,
            "id": 5301
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "ValueName",
                "value": "Plane5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5"
              }
            ],
            "repeated": 0,
            "id": 5302
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "ValueName",
                "value": "Plane6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6"
              }
            ],
            "repeated": 0,
            "id": 5303
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "ValueName",
                "value": "Plane7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7"
              }
            ],
            "repeated": 0,
            "id": 5304
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "ValueName",
                "value": "Plane8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8"
              }
            ],
            "repeated": 0,
            "id": 5305
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "ValueName",
                "value": "Plane9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9"
              }
            ],
            "repeated": 0,
            "id": 5306
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "ValueName",
                "value": "Plane10"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10"
              }
            ],
            "repeated": 0,
            "id": 5307
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "ValueName",
                "value": "Plane11"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11"
              }
            ],
            "repeated": 0,
            "id": 5308
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "ValueName",
                "value": "Plane12"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12"
              }
            ],
            "repeated": 0,
            "id": 5309
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7504",
            "caller": "0x77b47b75",
            "parentcaller": "0x77b08aa0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x088f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x002b4000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5310
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "ValueName",
                "value": "Plane13"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13"
              }
            ],
            "repeated": 0,
            "id": 5311
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47bb5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08ba3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 5312
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "ValueName",
                "value": "Plane14"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14"
              }
            ],
            "repeated": 0,
            "id": 5313
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "ValueName",
                "value": "Plane15"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15"
              }
            ],
            "repeated": 0,
            "id": 5314
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797ef5e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "ValueName",
                "value": "Plane16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16"
              }
            ],
            "repeated": 0,
            "id": 5315
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x777e2764",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000740"
              }
            ],
            "repeated": 0,
            "id": 5316
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 5317
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000109",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 5318
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b853",
            "parentcaller": "0x779ce66a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "KeyInformation",
                "value": "i\\xffb0\\xfffc\\xffbe\\xffe3\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x18\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 5319
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797e6db",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5320
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797e6db",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "Index",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5321
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797e6db",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "Index",
                "value": "2"
              }
            ],
            "repeated": 0,
            "id": 5322
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cf8eb",
            "parentcaller": "0x7797e6db",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000740"
              },
              {
                "name": "Index",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5323
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7504",
            "caller": "0x69d48e3f",
            "parentcaller": "0x69d5409c",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000738"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\products.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5324
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000101",
                "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000740"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Tahoma"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Tahoma"
              }
            ],
            "repeated": 0,
            "id": 5325
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x777e26fb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000740"
              }
            ],
            "repeated": 0,
            "id": 5326
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5327
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5328
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5329
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5330
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5331
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5332
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5333
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5334
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5335
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5336
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5337
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5338
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5339
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5340
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5341
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5342
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5343
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5344
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5345
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5346
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5347
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5348
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798917f",
            "parentcaller": "0x77601426",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x69e80000"
              }
            ],
            "repeated": 0,
            "id": 5349
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecfe2c",
            "parentcaller": "0x6b52753f",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000401a8"
              },
              {
                "name": "Message",
                "value": "0x00008002"
              }
            ],
            "repeated": 0,
            "id": 5350
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ecf69c",
            "parentcaller": "0x69ecfcea",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 0,
            "id": 5351
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ec9d45",
            "parentcaller": "0x69ec5af0",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x69ef10f8",
            "arguments": [
              {
                "name": "Module",
                "value": "0x69e80000"
              },
              {
                "name": "Type",
                "value": "IMAGE"
              },
              {
                "name": "Name",
                "value": "#20012"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5352
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ec9d64",
            "parentcaller": "0x69ec5af0",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x69f02fdc",
            "arguments": [
              {
                "name": "Module",
                "value": "0x69e80000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x69ef10f8"
              }
            ],
            "repeated": 0,
            "id": 5353
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ec9d6f",
            "parentcaller": "0x69ec5af0",
            "category": "misc",
            "api": "LockResource",
            "status": true,
            "return": "0x69f02fdc",
            "arguments": [
              {
                "name": "ResourceData",
                "value": "0x69f02fdc"
              }
            ],
            "repeated": 0,
            "id": 5354
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ec9d7e",
            "parentcaller": "0x69ec5af0",
            "category": "misc",
            "api": "SizeofResource",
            "status": true,
            "return": "0x000007e5",
            "arguments": [
              {
                "name": "ModuleHandle",
                "value": "0x69e80000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x69ef10f8"
              }
            ],
            "repeated": 0,
            "id": 5355
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x773f10d6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\windowscodecs"
              },
              {
                "name": "DllBase",
                "value": "0x6be60000"
              }
            ],
            "repeated": 0,
            "id": 5356
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x773f10d6",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\windowscodecs.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x6be60000"
              }
            ],
            "repeated": 0,
            "id": 5357
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e414a",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 5358
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5359
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5360
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x69ec5b24",
            "parentcaller": "0x69ed19a7",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CACAF262-9370-4615-A13B-9F5539DA4C0A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 5361
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e4186",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "6646"
              }
            ],
            "repeated": 0,
            "id": 5362
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance"
              }
            ],
            "repeated": 0,
            "id": 5363
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797c29f",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000746"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5364
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000746"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5365
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xa4\\xd7T\\xd7H\\xd7F\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf0\\xd9|\\x06\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5366
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance"
              }
            ],
            "repeated": 0,
            "id": 5367
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000746"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5368
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000746"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5369
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000746"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5370
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xa4\\xdaT\\xdaH\\xdaF\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xf0\\xdc|\\x06\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5371
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5372
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5373
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5374
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5375
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00t\\xda$\\xda\\x18\\xdaJ\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xc0\\xdc|\\x06\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5376
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5377
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "ValueName",
                "value": "CLSID"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}\\CLSID"
              }
            ],
            "repeated": 0,
            "id": 5378
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 5379
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000073e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5380
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000073e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5381
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5382
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5383
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5384
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5385
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xd9\\x84\\xd9x\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5386
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5387
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "Author"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Author"
              }
            ],
            "repeated": 0,
            "id": 5388
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5389
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5390
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xd9\\x84\\xd9x\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5391
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5392
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "Author"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Microsoft Corporation"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Author"
              }
            ],
            "repeated": 0,
            "id": 5393
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5394
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5395
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xd9\\x84\\xd9x\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5396
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5397
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "FriendlyName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FriendlyName"
              }
            ],
            "repeated": 0,
            "id": 5398
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5399
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5400
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xd9\\x84\\xd9x\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5401
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5402
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "FriendlyName"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Microsoft Raw Image Decoder"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FriendlyName"
              }
            ],
            "repeated": 0,
            "id": 5403
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5404
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5405
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xd9\\x84\\xd9x\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5406
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5407
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Version"
              }
            ],
            "repeated": 0,
            "id": 5408
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5409
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5410
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xd9\\x84\\xd9x\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5411
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5412
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "10.0.19041.3636"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Version"
              }
            ],
            "repeated": 0,
            "id": 5413
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5414
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5415
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xd9\\x84\\xd9x\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5416
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5417
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "SpecVersion"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SpecVersion"
              }
            ],
            "repeated": 0,
            "id": 5418
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5419
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5420
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xd9\\x84\\xd9x\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5421
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5422
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "SpecVersion"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "1.0.0.0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SpecVersion"
              }
            ],
            "repeated": 0,
            "id": 5423
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5424
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5425
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "(\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xd9d\\xd9X\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5426
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5427
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "Vendor"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Vendor"
              }
            ],
            "repeated": 0,
            "id": 5428
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5429
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5430
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "(\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xd9d\\xd9X\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5431
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5432
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "Vendor"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "{F0E749CA-EDEF-4589-A73A-EE0E626A2A2B}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Vendor"
              }
            ],
            "repeated": 0,
            "id": 5433
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5434
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5435
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x004\\xda\\xe4\\xd9\\xd8\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\x80\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5436
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InProcServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 5437
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000750"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InProcServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 5438
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5439
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5440
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xd9\\x84\\xd9x\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xdc|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5441
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 5442
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 5443
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5444
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5445
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xd9\\x84\\xd9x\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xdc|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5446
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 5447
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "2",
                "pretty_value": "REG_EXPAND_SZ"
              },
              {
                "name": "Information",
                "value": "%SystemRoot%\\system32\\MSRAWImage.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 5448
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed0502",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000752"
              }
            ],
            "repeated": 0,
            "id": 5449
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5450
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5451
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xd9\\x84\\xd9x\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5452
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5453
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "ContainerFormat"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ContainerFormat"
              }
            ],
            "repeated": 0,
            "id": 5454
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5455
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5456
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xd9\\x84\\xd9x\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5457
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5458
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "ContainerFormat"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "{FE99CE60-F19C-433C-A3AE-00ACEFA9CA21}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ContainerFormat"
              }
            ],
            "repeated": 0,
            "id": 5459
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5460
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5461
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xd9\\xac\\xd9\\xa0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02H\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5462
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5463
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "DeviceManufacturer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\DeviceManufacturer"
              }
            ],
            "repeated": 0,
            "id": 5464
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5465
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5466
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xd9\\xac\\xd9\\xa0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02H\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5467
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5468
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "DeviceModels"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\DeviceModels"
              }
            ],
            "repeated": 0,
            "id": 5469
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5470
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5471
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xd9\\xac\\xd9\\xa0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02H\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5472
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5473
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "ColorManagementVersion"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ColorManagementVersion"
              }
            ],
            "repeated": 0,
            "id": 5474
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5475
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5476
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xd9\\xac\\xd9\\xa0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02H\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5477
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5478
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "ColorManagementVersion"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "1.0.0.0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ColorManagementVersion"
              }
            ],
            "repeated": 0,
            "id": 5479
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5480
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5481
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xd9\\xac\\xd9\\xa0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02H\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5482
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5483
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "MimeTypes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\MimeTypes"
              }
            ],
            "repeated": 0,
            "id": 5484
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5485
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5486
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xd9\\xac\\xd9\\xa0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02H\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5487
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5488
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "MimeTypes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\MimeTypes"
              }
            ],
            "repeated": 0,
            "id": 5489
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cecbb",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "MimeTypes"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "image/3FR,image/ARI,image/ARW,image/BAY,image/CAP,image/CR2,image/CR3,image/CRW,image/DCS,image/DCR,image/DRF,image/EIP,image/ERF,image/FFF,image/IIQ,image/K25,image/KDC,image/MEF,image/MOS,image/MRW,image/NEF,image/NRW,image/ORF,image/ORI,image/PEF,image/"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\MimeTypes"
              }
            ],
            "repeated": 0,
            "id": 5490
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5491
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5492
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xd9\\xac\\xd9\\xa0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02H\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5493
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5494
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "FileExtensions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FileExtensions"
              }
            ],
            "repeated": 0,
            "id": 5495
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5496
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5497
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xd9\\xac\\xd9\\xa0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02H\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5498
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5499
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "FileExtensions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FileExtensions"
              }
            ],
            "repeated": 0,
            "id": 5500
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cecbb",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "FileExtensions"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": ".3FR,.ARI,.ARW,.BAY,.CAP,.CR2,.CR3,.CRW,.DCS,.DCR,.DRF,.EIP,.ERF,.FFF,.IIQ,.K25,.KDC,.MEF,.MOS,.MRW,.NEF,.NRW,.ORF,.ORI,.PEF,.PTX,.PXN,.RAF,.RAW,.RW2,.RWL,.SR2,.SRF,.SRW,.X3F,.DNG"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FileExtensions"
              }
            ],
            "repeated": 0,
            "id": 5501
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5502
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5503
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00D\\xda\\xf4\\xd9\\xe8\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x90\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5504
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5505
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "SupportAnimation"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportAnimation"
              }
            ],
            "repeated": 0,
            "id": 5506
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5507
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5508
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00D\\xda\\xf4\\xd9\\xe8\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x90\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5509
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5510
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "SupportChromakey"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportChromakey"
              }
            ],
            "repeated": 0,
            "id": 5511
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5512
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5513
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00D\\xda\\xf4\\xd9\\xe8\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x90\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5514
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5515
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "SupportLossless"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportLossless"
              }
            ],
            "repeated": 0,
            "id": 5516
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5517
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5518
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00D\\xda\\xf4\\xd9\\xe8\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x90\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5519
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5520
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "SupportMultiframe"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportMultiframe"
              }
            ],
            "repeated": 0,
            "id": 5521
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5522
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5523
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00D\\xda\\xf4\\xd9\\xe8\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x90\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5524
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              }
            ],
            "repeated": 0,
            "id": 5525
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "ArbitrationPriority"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "10"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ArbitrationPriority"
              }
            ],
            "repeated": 0,
            "id": 5526
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5527
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5528
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xbc\\xd9l\\xd9`\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\x08\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5529
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Formats"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Formats"
              }
            ],
            "repeated": 0,
            "id": 5530
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000750"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Formats"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Formats"
              }
            ],
            "repeated": 0,
            "id": 5531
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797c29f",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Formats"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5532
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5533
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xd6|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xbc\\xd6l\\xd6`\\xd6R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x08\\xd9|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5534
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Formats"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Formats"
              }
            ],
            "repeated": 0,
            "id": 5535
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5536
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5537
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed0af1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000752"
              }
            ],
            "repeated": 0,
            "id": 5538
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5539
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5540
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00<\\xda\\xec\\xd9\\xe0\\xd9N\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\x88\\xdc|\\x06\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5541
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              }
            ],
            "repeated": 0,
            "id": 5542
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000750"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Patterns"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              }
            ],
            "repeated": 0,
            "id": 5543
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797c29f",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5544
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5545
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd5|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd64\\xd6(\\xd6R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xd8|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5546
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              }
            ],
            "repeated": 0,
            "id": 5547
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5548
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5549
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5550
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5551
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 5552
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 5553
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5554
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5555
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5556
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 5557
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5558
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5559
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5560
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5561
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5562
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5563
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 5564
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 5565
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5566
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5567
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5568
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 5569
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5570
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5571
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "2"
              }
            ],
            "repeated": 0,
            "id": 5572
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5573
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5574
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5575
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 5576
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 5577
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5578
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5579
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5580
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 5581
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5582
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5583
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5584
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5585
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5586
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5587
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 5588
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 5589
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5590
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5591
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5592
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 5593
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5594
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5595
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 5596
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5597
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5598
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5599
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 5600
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 5601
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5602
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5603
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5604
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 5605
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5606
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5607
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "5"
              }
            ],
            "repeated": 0,
            "id": 5608
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5609
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5610
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5611
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              }
            ],
            "repeated": 0,
            "id": 5612
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "13"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              }
            ],
            "repeated": 0,
            "id": 5613
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5614
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5615
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5616
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              }
            ],
            "repeated": 0,
            "id": 5617
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5618
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5619
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "6"
              }
            ],
            "repeated": 0,
            "id": 5620
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5621
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5622
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5623
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              }
            ],
            "repeated": 0,
            "id": 5624
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "14"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              }
            ],
            "repeated": 0,
            "id": 5625
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5626
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5627
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5628
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              }
            ],
            "repeated": 0,
            "id": 5629
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5630
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5631
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5632
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5633
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5634
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5635
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 5636
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 5637
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5638
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5639
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5640
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 5641
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5642
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5643
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "8"
              }
            ],
            "repeated": 0,
            "id": 5644
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5645
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5646
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5647
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 5648
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 5649
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5650
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5651
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5652
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 5653
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5654
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5655
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "9"
              }
            ],
            "repeated": 0,
            "id": 5656
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5657
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5658
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5659
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 5660
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 5661
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5662
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5663
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5664
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 5665
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5666
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5667
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "10"
              }
            ],
            "repeated": 0,
            "id": 5668
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5669
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5670
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5671
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 5672
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 5673
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5674
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5675
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5676
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 5677
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5678
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5679
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "11"
              }
            ],
            "repeated": 0,
            "id": 5680
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5681
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5682
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5683
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06df6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 5684
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030e9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 5685
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 5686
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 5687
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7456",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 5688
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5689
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5690
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5691
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06df6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5692
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 5693
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5694
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5695
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "12"
              }
            ],
            "repeated": 0,
            "id": 5696
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5697
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5698
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5699
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 5700
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 5701
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5702
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5703
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5704
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 5705
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5706
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5707
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "13"
              }
            ],
            "repeated": 0,
            "id": 5708
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5709
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5710
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5711
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 5712
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 5713
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5714
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5715
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5716
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 5717
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5718
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5719
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d30000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5720
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "14"
              }
            ],
            "repeated": 0,
            "id": 5721
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5722
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5723
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5724
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 5725
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 5726
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5727
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5728
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5729
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 5730
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5731
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5732
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "15"
              }
            ],
            "repeated": 0,
            "id": 5733
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797c29f",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5734
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5735
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd5|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd64\\xd6(\\xd6R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xd8|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5736
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              }
            ],
            "repeated": 0,
            "id": 5737
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5738
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5739
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5740
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5741
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 5742
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 5743
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5744
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5745
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5746
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 5747
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Position"
              }
            ],
            "repeated": 0,
            "id": 5748
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5749
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5750
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5751
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 5752
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 5753
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5754
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5755
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00,\\xd9\\xdc\\xd8\\xd0\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02x\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5756
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 5757
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "MM\\x00*"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5758
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5759
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5760
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5761
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 5762
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Mask"
              }
            ],
            "repeated": 0,
            "id": 5763
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5764
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5765
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5766
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 5767
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Mask"
              }
            ],
            "repeated": 0,
            "id": 5768
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5769
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5770
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5771
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5772
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5773
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 5774
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 5775
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5776
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5777
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5778
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 5779
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Position"
              }
            ],
            "repeated": 0,
            "id": 5780
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5781
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5782
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5783
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 5784
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5785
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 5786
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5787
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5788
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00,\\xd9\\xdc\\xd8\\xd0\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02x\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5789
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 5790
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "II*\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5791
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5792
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5793
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5794
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 5795
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Mask"
              }
            ],
            "repeated": 0,
            "id": 5796
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5797
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5798
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5799
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 5800
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Mask"
              }
            ],
            "repeated": 0,
            "id": 5801
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5802
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "2"
              }
            ],
            "repeated": 0,
            "id": 5803
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5804
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5805
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5806
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 5807
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 5808
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5809
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5810
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5811
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 5812
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Position"
              }
            ],
            "repeated": 0,
            "id": 5813
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5814
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5815
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5816
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 5817
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 5818
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5819
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5820
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00,\\xd9\\xdc\\xd8\\xd0\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02x\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5821
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 5822
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "MMMMRaw\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5823
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5824
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x030e9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5825
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5826
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5827
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 5828
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Mask"
              }
            ],
            "repeated": 0,
            "id": 5829
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5830
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5831
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5832
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 5833
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff\\x00\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Mask"
              }
            ],
            "repeated": 0,
            "id": 5834
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5835
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5836
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5837
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5838
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5839
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 5840
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 5841
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5842
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5843
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5844
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 5845
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Position"
              }
            ],
            "repeated": 0,
            "id": 5846
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5847
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5848
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5849
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 5850
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 5851
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5852
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5853
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00,\\xd9\\xdc\\xd8\\xd0\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02x\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5854
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 5855
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "IIU\\x00\\x08\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5856
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5857
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5858
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5859
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 5860
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Mask"
              }
            ],
            "repeated": 0,
            "id": 5861
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5862
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5863
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5864
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 5865
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Mask"
              }
            ],
            "repeated": 0,
            "id": 5866
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5867
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 5868
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5869
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5870
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5871
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 5872
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 5873
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5874
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5875
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5876
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 5877
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Position"
              }
            ],
            "repeated": 0,
            "id": 5878
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5879
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5880
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5881
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 5882
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 5883
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5884
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5885
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00,\\xd9\\xdc\\xd8\\xd0\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02x\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5886
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 5887
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "IIU\\x00\\x18\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5888
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5889
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5890
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5891
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 5892
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Mask"
              }
            ],
            "repeated": 0,
            "id": 5893
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5894
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5895
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5896
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 5897
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Mask"
              }
            ],
            "repeated": 0,
            "id": 5898
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5899
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "5"
              }
            ],
            "repeated": 0,
            "id": 5900
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5901
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5902
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5903
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              }
            ],
            "repeated": 0,
            "id": 5904
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "13"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              }
            ],
            "repeated": 0,
            "id": 5905
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5906
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5907
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5908
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              }
            ],
            "repeated": 0,
            "id": 5909
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Position"
              }
            ],
            "repeated": 0,
            "id": 5910
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5911
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5912
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5913
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              }
            ],
            "repeated": 0,
            "id": 5914
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 5915
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5916
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5917
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00,\\xd9\\xdc\\xd8\\xd0\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02x\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5918
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              }
            ],
            "repeated": 0,
            "id": 5919
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "FOVb"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5920
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5921
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5922
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5923
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              }
            ],
            "repeated": 0,
            "id": 5924
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Mask"
              }
            ],
            "repeated": 0,
            "id": 5925
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5926
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5927
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5928
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13"
              }
            ],
            "repeated": 0,
            "id": 5929
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Mask"
              }
            ],
            "repeated": 0,
            "id": 5930
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5931
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "6"
              }
            ],
            "repeated": 0,
            "id": 5932
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5933
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5934
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5935
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              }
            ],
            "repeated": 0,
            "id": 5936
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "14"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              }
            ],
            "repeated": 0,
            "id": 5937
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5938
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5939
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5940
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              }
            ],
            "repeated": 0,
            "id": 5941
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Position"
              }
            ],
            "repeated": 0,
            "id": 5942
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5943
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5944
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5945
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              }
            ],
            "repeated": 0,
            "id": 5946
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 5947
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5948
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5949
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00,\\xd9\\xdc\\xd8\\xd0\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02x\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5950
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              }
            ],
            "repeated": 0,
            "id": 5951
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "ftypcrx "
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5952
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5953
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5954
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5955
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              }
            ],
            "repeated": 0,
            "id": 5956
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Mask"
              }
            ],
            "repeated": 0,
            "id": 5957
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5958
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5959
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5960
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14"
              }
            ],
            "repeated": 0,
            "id": 5961
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Mask"
              }
            ],
            "repeated": 0,
            "id": 5962
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5963
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5964
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5965
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5966
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5967
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 5968
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 5969
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5970
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5971
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5972
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 5973
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Position"
              }
            ],
            "repeated": 0,
            "id": 5974
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5975
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5976
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5977
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 5978
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 5979
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5980
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5981
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00,\\xd9\\xdc\\xd8\\xd0\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02x\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5982
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 5983
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "IIRO"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 5984
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5985
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5986
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5987
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 5988
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Mask"
              }
            ],
            "repeated": 0,
            "id": 5989
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5990
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5991
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5992
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 5993
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Mask"
              }
            ],
            "repeated": 0,
            "id": 5994
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 5995
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "8"
              }
            ],
            "repeated": 0,
            "id": 5996
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 5997
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5998
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5999
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6000
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6001
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 6002
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 6003
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6004
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6005
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Position"
              }
            ],
            "repeated": 0,
            "id": 6006
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 6007
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 6008
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6009
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6010
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6011
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 6012
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 6013
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00,\\xd9\\xdc\\xd8\\xd0\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02x\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6014
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6015
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "IIRS"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6016
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 6017
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 6018
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6019
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6020
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6021
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 6022
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 6023
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6024
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6025
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6026
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6027
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "9"
              }
            ],
            "repeated": 0,
            "id": 6028
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7797fbbd",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 6029
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 6030
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xd94\\xd9(\\xd9R\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd0\\xdb|\\x06\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6031
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6032
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6033
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 6034
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 6035
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6036
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6037
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Position"
              }
            ],
            "repeated": 0,
            "id": 6038
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 6039
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 6040
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6041
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6042
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6043
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 6044
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 6045
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00,\\xd9\\xdc\\xd8\\xd0\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02x\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6046
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6047
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "MMOR"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6048
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 6049
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 6050
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6051
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6052
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6053
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798005b",
            "parentcaller": "0x7796a8fe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 6054
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fcdc",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "KeyInformation",
                "value": "\\x01\\x04\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 6055
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xd9\\xd4\\xd8\\xc8\\xd8V\\x07\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xdb|\\x06\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6056
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6057
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6058
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6059
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "10"
              }
            ],
            "repeated": 0,
            "id": 6060
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7456",
            "caller": "0x77b0058c",
            "parentcaller": "0x77b07ac3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08bb0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00200000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6061
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7456",
            "caller": "0x77b005eb",
            "parentcaller": "0x77b07ac3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08bb0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6062
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08bc1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6063
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08bd1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00020000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6064
          },
          {
            "timestamp": "2026-05-28 22:59:42,238",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08bf1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6065
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7504",
            "caller": "0x77b47b75",
            "parentcaller": "0x77b08aa0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08db0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0008b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6066
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47b90",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08db0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000a000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 6067
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47bb5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08e3a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 6068
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7504",
            "caller": "0x77b47b75",
            "parentcaller": "0x77b08aa0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08e40000"
              },
              {
                "name": "RegionSize",
                "value": "0x00105000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6069
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47b90",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08e40000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 6070
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47bb5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08f44000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 6071
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7504",
            "caller": "0x77b47b75",
            "parentcaller": "0x77b08aa0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08f50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00210000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6072
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47b90",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08f50000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 6073
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47bb5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0915f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 6074
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7456",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c31000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6075
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e40c8",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 6076
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6077
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6078
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e410c",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "6888"
              }
            ],
            "repeated": 0,
            "id": 6079
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6080
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6081
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6082
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6083
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6084
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Position"
              }
            ],
            "repeated": 0,
            "id": 6085
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6086
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6087
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6088
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6089
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6090
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "MMSR"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6091
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6092
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6093
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6094
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6095
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6096
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6097
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6098
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "11"
              }
            ],
            "repeated": 0,
            "id": 6099
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6100
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6101
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6102
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6103
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6104
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Position"
              }
            ],
            "repeated": 0,
            "id": 6105
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6106
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6107
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6108
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6109
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6110
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "II\\x1a\\x00\\x00\\x00HE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6111
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6112
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6113
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6114
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6115
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6116
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6117
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6118
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "12"
              }
            ],
            "repeated": 0,
            "id": 6119
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6120
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6121
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6122
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6123
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6124
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Position"
              }
            ],
            "repeated": 0,
            "id": 6125
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6126
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6127
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6128
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6129
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6130
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "FUJIFILM"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6131
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6132
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6133
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6134
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6135
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6136
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6137
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6138
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "13"
              }
            ],
            "repeated": 0,
            "id": 6139
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6140
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6141
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6142
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6143
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6144
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Position"
              }
            ],
            "repeated": 0,
            "id": 6145
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6146
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6147
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6148
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6149
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6150
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\x00MRM"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6151
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6152
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6153
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6154
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6155
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6156
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6157
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6158
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "14"
              }
            ],
            "repeated": 0,
            "id": 6159
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6160
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6161
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6162
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6163
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6164
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Position"
              }
            ],
            "repeated": 0,
            "id": 6165
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6166
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e414a",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6167
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6168
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6169
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6170
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6171
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "IIII\\x00waR"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6172
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6173
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6174
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6175
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6176
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6177
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff\\x00\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6178
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6179
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "15"
              }
            ],
            "repeated": 0,
            "id": 6180
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed09aa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000752"
              }
            ],
            "repeated": 0,
            "id": 6181
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed0089",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074e"
              }
            ],
            "repeated": 0,
            "id": 6182
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6becf7ff",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6183
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000746"
              },
              {
                "name": "Index",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 6184
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf0\\xdc|\\x06X\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6185
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6186
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6187
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xc0\\xdc|\\x06(\\xda|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6188
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6189
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "ValueName",
                "value": "CLSID"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\CLSID"
              }
            ],
            "repeated": 0,
            "id": 6190
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6191
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6192
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6193
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6194
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00 \\xdc|\\x06\\x88\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6195
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6196
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "Author"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Author"
              }
            ],
            "repeated": 0,
            "id": 6197
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00 \\xdc|\\x06\\x88\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6198
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6199
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e4186",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "6888"
              }
            ],
            "repeated": 0,
            "id": 6200
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6201
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "FriendlyName"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Microsoft Camera Raw Decoder"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FriendlyName"
              }
            ],
            "repeated": 0,
            "id": 6202
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00 \\xdc|\\x06\\x88\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6203
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6204
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Version"
              }
            ],
            "repeated": 0,
            "id": 6205
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00 \\xdc|\\x06\\x88\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6206
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6207
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "10.0.19041.3636"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Version"
              }
            ],
            "repeated": 0,
            "id": 6208
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00 \\xdc|\\x06\\x88\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6209
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6210
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "SpecVersion"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SpecVersion"
              }
            ],
            "repeated": 0,
            "id": 6211
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00 \\xdc|\\x06\\x88\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6212
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6213
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "SpecVersion"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "1.0.0.0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SpecVersion"
              }
            ],
            "repeated": 0,
            "id": 6214
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "(\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc|\\x06h\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6215
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6216
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "Vendor"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Vendor"
              }
            ],
            "repeated": 0,
            "id": 6217
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "(\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\xdc|\\x06h\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6218
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6219
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "Vendor"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "{F0E749CA-EDEF-4589-A73A-EE0E626A2A2B}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Vendor"
              }
            ],
            "repeated": 0,
            "id": 6220
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x80\\xdc|\\x06\\xe8\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6221
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InProcServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 6222
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000750"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InProcServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 6223
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00 \\xdc|\\x06\\x88\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6224
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 6225
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 6226
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00 \\xdc|\\x06\\x88\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6227
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 6228
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "C:\\Windows\\SysWOW64\\WindowsCodecsRaw.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 6229
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed0502",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000752"
              }
            ],
            "repeated": 0,
            "id": 6230
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00 \\xdc|\\x06\\x88\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6231
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6232
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "ContainerFormat"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ContainerFormat"
              }
            ],
            "repeated": 0,
            "id": 6233
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00 \\xdc|\\x06\\x88\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6234
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6235
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "ContainerFormat"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "{C1FC85CB-D64F-478B-A4EC-69ADC9EE1392}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ContainerFormat"
              }
            ],
            "repeated": 0,
            "id": 6236
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xdc|\\x06\\xb0\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6237
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6238
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "DeviceManufacturer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\DeviceManufacturer"
              }
            ],
            "repeated": 0,
            "id": 6239
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xdc|\\x06\\xb0\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6240
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6241
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "DeviceModels"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\DeviceModels"
              }
            ],
            "repeated": 0,
            "id": 6242
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xdc|\\x06\\xb0\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6243
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6244
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "ColorManagementVersion"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ColorManagementVersion"
              }
            ],
            "repeated": 0,
            "id": 6245
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xdc|\\x06\\xb0\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6246
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6247
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "ColorManagementVersion"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "1.0.0.0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ColorManagementVersion"
              }
            ],
            "repeated": 0,
            "id": 6248
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xdc|\\x06\\xb0\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6249
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6250
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "MimeTypes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\MimeTypes"
              }
            ],
            "repeated": 0,
            "id": 6251
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47bb5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0956a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 6252
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xdc|\\x06\\xb0\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6253
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6254
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "MimeTypes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\MimeTypes"
              }
            ],
            "repeated": 0,
            "id": 6255
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cecbb",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "MimeTypes"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "image/ARW,image/CR2,image/CRW,image/ERF,image/KDC,image/MRW,image/NEF,image/NRW,image/ORF,image/PEF,image/RAF,image/RAW,image/RW2,image/RWL,image/SR2,image/SRW,image/DNG"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\MimeTypes"
              }
            ],
            "repeated": 0,
            "id": 6256
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xdc|\\x06\\xb0\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6257
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6258
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "FileExtensions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FileExtensions"
              }
            ],
            "repeated": 0,
            "id": 6259
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xdc|\\x06\\xb0\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6260
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6261
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "FileExtensions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FileExtensions"
              }
            ],
            "repeated": 0,
            "id": 6262
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cecbb",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "FileExtensions"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": ".ARW,.CR2,.CRW,.ERF,.KDC,.MRW,.NEF,.NRW,.ORF,.PEF,.RAF,.RAW,.RW2,.RWL,.SR2,.SRW,.DNG"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FileExtensions"
              }
            ],
            "repeated": 0,
            "id": 6263
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x90\\xdc|\\x06\\xf8\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6264
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6265
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "SupportAnimation"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportAnimation"
              }
            ],
            "repeated": 0,
            "id": 6266
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x90\\xdc|\\x06\\xf8\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6267
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6268
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "SupportChromakey"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportChromakey"
              }
            ],
            "repeated": 0,
            "id": 6269
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x90\\xdc|\\x06\\xf8\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6270
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6271
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "SupportLossless"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportLossless"
              }
            ],
            "repeated": 0,
            "id": 6272
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x90\\xdc|\\x06\\xf8\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6273
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6274
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "SupportMultiframe"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportMultiframe"
              }
            ],
            "repeated": 0,
            "id": 6275
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x90\\xdc|\\x06\\xf8\\xd9|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6276
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
              }
            ],
            "repeated": 0,
            "id": 6277
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ValueName",
                "value": "ArbitrationPriority"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ArbitrationPriority"
              }
            ],
            "repeated": 0,
            "id": 6278
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x08\\xdc|\\x06p\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6279
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Formats"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Formats"
              }
            ],
            "repeated": 0,
            "id": 6280
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000750"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Formats"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Formats"
              }
            ],
            "repeated": 0,
            "id": 6281
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xd6|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x08\\xd9|\\x06p\\xd6|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6282
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Formats"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Formats"
              }
            ],
            "repeated": 0,
            "id": 6283
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6284
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 6285
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "2"
              }
            ],
            "repeated": 0,
            "id": 6286
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 6287
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 6288
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "5"
              }
            ],
            "repeated": 0,
            "id": 6289
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "6"
              }
            ],
            "repeated": 0,
            "id": 6290
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 6291
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "8"
              }
            ],
            "repeated": 0,
            "id": 6292
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed0af1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000752"
              }
            ],
            "repeated": 0,
            "id": 6293
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xd9|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xdc|\\x06\\xf0\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wN\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6294
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns"
              }
            ],
            "repeated": 0,
            "id": 6295
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000750"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000074e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Patterns"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns"
              }
            ],
            "repeated": 0,
            "id": 6296
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd5|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xd8|\\x068\\xd6|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6297
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns"
              }
            ],
            "repeated": 0,
            "id": 6298
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6299
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6300
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 6301
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 6302
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6303
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 6304
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6305
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6306
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 6307
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6308
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 6309
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 6310
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6311
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 6312
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6313
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6314
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "2"
              }
            ],
            "repeated": 0,
            "id": 6315
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6316
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 6317
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 6318
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6319
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 6320
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6321
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6322
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 6323
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6324
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 6325
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 6326
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6327
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 6328
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6329
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6330
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 6331
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6332
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 6333
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 6334
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6335
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 6336
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6337
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6338
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "5"
              }
            ],
            "repeated": 0,
            "id": 6339
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6340
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 6341
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 6342
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6343
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 6344
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6345
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6346
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "6"
              }
            ],
            "repeated": 0,
            "id": 6347
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6348
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6349
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6350
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6351
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6352
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6353
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6354
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 6355
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6356
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6357
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6358
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6359
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6360
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6361
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6362
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "8"
              }
            ],
            "repeated": 0,
            "id": 6363
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6364
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6365
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6366
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6367
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6368
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6369
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6370
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "9"
              }
            ],
            "repeated": 0,
            "id": 6371
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6372
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6373
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6374
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6375
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6376
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6377
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6378
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "10"
              }
            ],
            "repeated": 0,
            "id": 6379
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6380
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6381
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6382
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6383
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6384
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6385
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6386
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "11"
              }
            ],
            "repeated": 0,
            "id": 6387
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6388
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6389
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6390
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6391
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6392
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6393
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6394
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "12"
              }
            ],
            "repeated": 0,
            "id": 6395
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6396
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6397
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6398
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6399
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6400
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6401
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6402
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "13"
              }
            ],
            "repeated": 0,
            "id": 6403
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd5|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xd8|\\x068\\xd6|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6404
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns"
              }
            ],
            "repeated": 0,
            "id": 6405
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6406
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6407
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 6408
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 6409
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6410
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 6411
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Position"
              }
            ],
            "repeated": 0,
            "id": 6412
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6413
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 6414
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6415
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6416
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 6417
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "MM\\x00*"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6418
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6419
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 6420
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6421
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6422
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0"
              }
            ],
            "repeated": 0,
            "id": 6423
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6424
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6425
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 6426
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6427
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 6428
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 6429
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6430
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 6431
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Position"
              }
            ],
            "repeated": 0,
            "id": 6432
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6433
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 6434
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6435
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6436
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 6437
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "II*\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6438
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6439
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 6440
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6441
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6442
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1"
              }
            ],
            "repeated": 0,
            "id": 6443
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6444
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6445
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "2"
              }
            ],
            "repeated": 0,
            "id": 6446
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6447
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 6448
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 6449
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6450
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 6451
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Position"
              }
            ],
            "repeated": 0,
            "id": 6452
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6453
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 6454
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6455
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6456
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 6457
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "MMMMRaw\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6458
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6459
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 6460
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6461
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6462
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10"
              }
            ],
            "repeated": 0,
            "id": 6463
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff\\x00\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6464
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6465
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 6466
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6467
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 6468
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 6469
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6470
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 6471
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Position"
              }
            ],
            "repeated": 0,
            "id": 6472
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6473
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 6474
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6475
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6476
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 6477
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "IIU\\x00\\x08\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6478
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6479
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 6480
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6481
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6482
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11"
              }
            ],
            "repeated": 0,
            "id": 6483
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6484
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6485
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 6486
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6487
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 6488
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 6489
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6490
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 6491
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Position"
              }
            ],
            "repeated": 0,
            "id": 6492
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6493
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 6494
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6495
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6496
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 6497
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "IIU\\x00\\x18\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6498
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6499
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 6500
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6501
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6502
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12"
              }
            ],
            "repeated": 0,
            "id": 6503
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6504
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6505
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "5"
              }
            ],
            "repeated": 0,
            "id": 6506
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6507
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 6508
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 6509
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6510
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 6511
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Position"
              }
            ],
            "repeated": 0,
            "id": 6512
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6513
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 6514
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6515
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6516
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 6517
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "IIRO"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6518
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6519
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 6520
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6521
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6522
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2"
              }
            ],
            "repeated": 0,
            "id": 6523
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6524
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6525
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "6"
              }
            ],
            "repeated": 0,
            "id": 6526
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6527
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6528
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6529
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6530
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6531
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Position"
              }
            ],
            "repeated": 0,
            "id": 6532
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6533
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6534
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6535
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6536
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6537
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "IIRS"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6538
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6539
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6540
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6541
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6542
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3"
              }
            ],
            "repeated": 0,
            "id": 6543
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6544
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6545
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 6546
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6547
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6548
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6549
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6550
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6551
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Position"
              }
            ],
            "repeated": 0,
            "id": 6552
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6553
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6554
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6555
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6556
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6557
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "MMOR"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6558
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6559
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6560
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6561
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6562
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4"
              }
            ],
            "repeated": 0,
            "id": 6563
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6564
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6565
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "8"
              }
            ],
            "repeated": 0,
            "id": 6566
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6567
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6568
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6569
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6570
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6571
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Position"
              }
            ],
            "repeated": 0,
            "id": 6572
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6573
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6574
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6575
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6576
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6577
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "MMSR"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6578
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6579
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6580
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6581
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6582
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5"
              }
            ],
            "repeated": 0,
            "id": 6583
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6584
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6585
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "9"
              }
            ],
            "repeated": 0,
            "id": 6586
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6587
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6588
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6589
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6590
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6591
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Position"
              }
            ],
            "repeated": 0,
            "id": 6592
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6593
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6594
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6595
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6596
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6597
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "II\\x1a\\x00\\x00\\x00HE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6598
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6599
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6600
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6601
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6602
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6"
              }
            ],
            "repeated": 0,
            "id": 6603
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6604
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6605
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "10"
              }
            ],
            "repeated": 0,
            "id": 6606
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6607
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6608
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6609
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6610
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6611
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Position"
              }
            ],
            "repeated": 0,
            "id": 6612
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6613
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6614
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6615
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6616
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6617
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "FUJIFILM"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6618
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6619
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6620
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6621
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6622
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7"
              }
            ],
            "repeated": 0,
            "id": 6623
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6624
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6625
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "11"
              }
            ],
            "repeated": 0,
            "id": 6626
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6627
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6628
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6629
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6630
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6631
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Position"
              }
            ],
            "repeated": 0,
            "id": 6632
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6633
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6634
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6635
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6636
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6637
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\x00MRM"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6638
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6639
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6640
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6641
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6642
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8"
              }
            ],
            "repeated": 0,
            "id": 6643
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6644
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6645
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "12"
              }
            ],
            "repeated": 0,
            "id": 6646
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x02\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd0\\xdb|\\x068\\xd9|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wR\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6647
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6648
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000752"
              },
              {
                "name": "ObjectAttributesName",
                "value": "9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6649
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6650
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6651
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Position"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Position"
              }
            ],
            "repeated": 0,
            "id": 6652
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6653
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6654
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "EndOfStream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\EndOfStream"
              }
            ],
            "repeated": 0,
            "id": 6655
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xdb|\\x06\\xe0\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6656
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6657
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Pattern"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "IIII\\x00waR"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Pattern"
              }
            ],
            "repeated": 0,
            "id": 6658
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6659
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6660
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6661
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xd8|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x06\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00p\\xdb|\\x06\\xd8\\xd8|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wV\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6662
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9"
              }
            ],
            "repeated": 0,
            "id": 6663
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000756"
              },
              {
                "name": "ValueName",
                "value": "Mask"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\xff\\xff\\xff\\xff\\x00\\xff\\xff\\xff"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Mask"
              }
            ],
            "repeated": 0,
            "id": 6664
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bebf891",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000756"
              }
            ],
            "repeated": 0,
            "id": 6665
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000752"
              },
              {
                "name": "Index",
                "value": "13"
              }
            ],
            "repeated": 0,
            "id": 6666
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed09aa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000752"
              }
            ],
            "repeated": 0,
            "id": 6667
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed0089",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074e"
              }
            ],
            "repeated": 0,
            "id": 6668
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6becf7ff",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6669
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000746"
              },
              {
                "name": "Index",
                "value": "2"
              }
            ],
            "repeated": 0,
            "id": 6670
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6becf829",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6671
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6672
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}"
              }
            ],
            "repeated": 0,
            "id": 6673
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}"
              }
            ],
            "repeated": 0,
            "id": 6674
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6675
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6676
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6677
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6678
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6679
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6680
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6681
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6682
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6683
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}"
              }
            ],
            "repeated": 0,
            "id": 6684
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}"
              }
            ],
            "repeated": 0,
            "id": 6685
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6686
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6687
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6688
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6689
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6690
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6691
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6692
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6693
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6694
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}"
              }
            ],
            "repeated": 0,
            "id": 6695
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}"
              }
            ],
            "repeated": 0,
            "id": 6696
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6697
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6698
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6699
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6700
          },
          {
            "timestamp": "2026-05-28 22:59:42,253",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6701
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6702
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6703
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6704
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6705
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}"
              }
            ],
            "repeated": 0,
            "id": 6706
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}"
              }
            ],
            "repeated": 0,
            "id": 6707
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6708
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6709
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6710
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6711
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6712
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6713
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6714
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6715
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6716
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}"
              }
            ],
            "repeated": 0,
            "id": 6717
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}"
              }
            ],
            "repeated": 0,
            "id": 6718
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6719
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6720
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6721
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6722
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6723
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6724
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6725
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6726
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6727
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}"
              }
            ],
            "repeated": 0,
            "id": 6728
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}"
              }
            ],
            "repeated": 0,
            "id": 6729
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6730
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6731
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6732
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6733
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6734
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6735
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6736
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6737
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6738
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}"
              }
            ],
            "repeated": 0,
            "id": 6739
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}"
              }
            ],
            "repeated": 0,
            "id": 6740
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6741
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6742
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6743
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6744
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6745
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6746
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6747
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6748
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6749
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{3697790B-223B-484E-9925-C4869218F17A}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}"
              }
            ],
            "repeated": 0,
            "id": 6750
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}"
              }
            ],
            "repeated": 0,
            "id": 6751
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6752
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6753
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6754
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6755
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6756
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6757
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6758
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6759
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6760
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}"
              }
            ],
            "repeated": 0,
            "id": 6761
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}"
              }
            ],
            "repeated": 0,
            "id": 6762
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6763
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6764
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6765
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6766
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6767
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6768
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6769
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6770
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6771
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}"
              }
            ],
            "repeated": 0,
            "id": 6772
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}"
              }
            ],
            "repeated": 0,
            "id": 6773
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6774
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6775
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6776
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6777
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6778
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6779
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6780
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6781
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6782
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}"
              }
            ],
            "repeated": 0,
            "id": 6783
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}"
              }
            ],
            "repeated": 0,
            "id": 6784
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6785
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6786
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6787
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6788
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6789
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6790
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6791
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6792
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6793
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}"
              }
            ],
            "repeated": 0,
            "id": 6794
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}"
              }
            ],
            "repeated": 0,
            "id": 6795
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6796
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6797
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6798
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6799
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6800
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6801
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6802
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6803
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6804
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}"
              }
            ],
            "repeated": 0,
            "id": 6805
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}"
              }
            ],
            "repeated": 0,
            "id": 6806
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6807
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6808
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6809
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6810
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6811
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6812
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6813
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6814
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6815
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}"
              }
            ],
            "repeated": 0,
            "id": 6816
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}"
              }
            ],
            "repeated": 0,
            "id": 6817
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6818
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6819
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6820
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6821
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6822
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6823
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6824
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6825
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6826
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}"
              }
            ],
            "repeated": 0,
            "id": 6827
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}"
              }
            ],
            "repeated": 0,
            "id": 6828
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6829
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6830
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6831
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6832
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6833
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6834
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6835
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6836
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6837
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}"
              }
            ],
            "repeated": 0,
            "id": 6838
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}"
              }
            ],
            "repeated": 0,
            "id": 6839
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6840
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6841
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6842
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6843
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6844
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6845
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6846
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6847
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6848
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}"
              }
            ],
            "repeated": 0,
            "id": 6849
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}"
              }
            ],
            "repeated": 0,
            "id": 6850
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6851
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6852
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6853
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6854
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6855
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6856
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6857
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6858
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6859
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}"
              }
            ],
            "repeated": 0,
            "id": 6860
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}"
              }
            ],
            "repeated": 0,
            "id": 6861
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6862
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6863
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6864
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6865
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6866
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6867
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6868
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6869
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6870
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}"
              }
            ],
            "repeated": 0,
            "id": 6871
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}"
              }
            ],
            "repeated": 0,
            "id": 6872
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6873
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6874
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6875
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6876
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6877
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6878
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6879
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6880
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6881
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}"
              }
            ],
            "repeated": 0,
            "id": 6882
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}"
              }
            ],
            "repeated": 0,
            "id": 6883
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6884
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6885
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6886
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6887
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6888
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6889
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6890
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6891
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6892
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}"
              }
            ],
            "repeated": 0,
            "id": 6893
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}"
              }
            ],
            "repeated": 0,
            "id": 6894
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6895
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6896
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6897
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6898
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6899
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6900
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6901
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6902
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6903
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}"
              }
            ],
            "repeated": 0,
            "id": 6904
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}"
              }
            ],
            "repeated": 0,
            "id": 6905
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6906
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6907
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6908
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6909
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6910
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6911
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6912
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6913
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6914
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}"
              }
            ],
            "repeated": 0,
            "id": 6915
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}"
              }
            ],
            "repeated": 0,
            "id": 6916
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6917
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6918
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6919
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6920
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6921
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6922
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6923
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6924
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6925
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}"
              }
            ],
            "repeated": 0,
            "id": 6926
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}"
              }
            ],
            "repeated": 0,
            "id": 6927
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6928
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6929
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6930
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6931
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6932
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6933
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6934
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6935
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6936
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}"
              }
            ],
            "repeated": 0,
            "id": 6937
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}"
              }
            ],
            "repeated": 0,
            "id": 6938
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6939
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6940
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6941
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6942
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6943
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6944
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6945
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6946
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6947
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}"
              }
            ],
            "repeated": 0,
            "id": 6948
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}"
              }
            ],
            "repeated": 0,
            "id": 6949
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6950
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6951
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6952
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6953
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6954
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6955
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6956
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6957
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6958
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}"
              }
            ],
            "repeated": 0,
            "id": 6959
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}"
              }
            ],
            "repeated": 0,
            "id": 6960
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6961
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6962
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6963
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6964
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6965
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6966
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6967
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6968
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6969
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}"
              }
            ],
            "repeated": 0,
            "id": 6970
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}"
              }
            ],
            "repeated": 0,
            "id": 6971
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6972
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6973
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6974
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6975
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6976
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6977
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6978
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6979
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6980
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}"
              }
            ],
            "repeated": 0,
            "id": 6981
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}"
              }
            ],
            "repeated": 0,
            "id": 6982
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6983
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6984
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6985
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6986
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6987
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6988
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 6989
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 6990
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 6991
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}"
              }
            ],
            "repeated": 0,
            "id": 6992
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}"
              }
            ],
            "repeated": 0,
            "id": 6993
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6994
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6995
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6996
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6997
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 6998
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 6999
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 7000
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 7001
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7002
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}"
              }
            ],
            "repeated": 0,
            "id": 7003
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}"
              }
            ],
            "repeated": 0,
            "id": 7004
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7005
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7006
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7007
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7008
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7009
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 7010
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 7011
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 7012
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7013
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{AABFB2FA-3E1E-4A8F-8977-5556FB94EA23}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AABFB2FA-3E1E-4A8F-8977-5556FB94EA23}"
              }
            ],
            "repeated": 0,
            "id": 7014
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{AABFB2FA-3E1E-4A8F-8977-5556FB94EA23}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{AABFB2FA-3E1E-4A8F-8977-5556FB94EA23}"
              }
            ],
            "repeated": 0,
            "id": 7015
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7016
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{AABFB2FA-3E1E-4A8f-8977-5556FB94EA23}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AABFB2FA-3E1E-4A8f-8977-5556FB94EA23}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7017
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{AABFB2FA-3E1E-4A8f-8977-5556FB94EA23}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7018
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7019
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{AABFB2FA-3E1E-4A8f-8977-5556FB94EA23}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AABFB2FA-3E1E-4A8f-8977-5556FB94EA23}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7020
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 7021
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 7022
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 7023
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7024
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}"
              }
            ],
            "repeated": 0,
            "id": 7025
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}"
              }
            ],
            "repeated": 0,
            "id": 7026
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7027
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7028
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7029
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7030
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7031
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 7032
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 7033
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 7034
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7035
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}"
              }
            ],
            "repeated": 0,
            "id": 7036
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}"
              }
            ],
            "repeated": 0,
            "id": 7037
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7038
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7039
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7040
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7041
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7042
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 7043
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 7044
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 7045
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7046
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}"
              }
            ],
            "repeated": 0,
            "id": 7047
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}"
              }
            ],
            "repeated": 0,
            "id": 7048
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7049
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7050
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7051
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7052
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7053
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 7054
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 7055
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 7056
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7057
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}"
              }
            ],
            "repeated": 0,
            "id": 7058
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}"
              }
            ],
            "repeated": 0,
            "id": 7059
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7060
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7061
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7062
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7063
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7064
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 7065
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 7066
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 7067
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7068
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}"
              }
            ],
            "repeated": 0,
            "id": 7069
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}"
              }
            ],
            "repeated": 0,
            "id": 7070
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7071
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7072
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7073
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7074
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7075
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 7076
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 7077
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 7078
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7079
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}"
              }
            ],
            "repeated": 0,
            "id": 7080
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}"
              }
            ],
            "repeated": 0,
            "id": 7081
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xda|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xdc|\\x06P\\xda|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wF\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7082
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7083
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000746"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7084
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x16\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd9|\\x06P\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97wJ\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7085
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}\\Containers"
              }
            ],
            "repeated": 0,
            "id": 7086
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7796b7c5",
            "parentcaller": "0x7797bee8",
            "category": "registry",
            "api": "NtEnumerateKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000074a"
              },
              {
                "name": "Index",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 7087
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6bed8691",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074a"
              }
            ],
            "repeated": 0,
            "id": 7088
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x6beb8292",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000746"
              }
            ],
            "repeated": 0,
            "id": 7089
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7090
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{ACDDFC3F-85EC-41BC-BDEF-1BC262E4DB05}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{ACDDFC3F-85EC-41BC-BDEF-1BC262E4DB05}"
              }
            ],
            "repeated": 0,
            "id": 7091
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{ACDDFC3F-85EC-41BC-BDEF-1BC262E4DB05}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{ACDDFC3F-85EC-41BC-BDEF-1BC262E4DB05}"
              }
            ],
            "repeated": 0,
            "id": 7092
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7093
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{2438DE3D-94D9-4BE8-84A8-4DE95A575E75}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{2438DE3D-94D9-4BE8-84A8-4DE95A575E75}"
              }
            ],
            "repeated": 0,
            "id": 7094
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{2438DE3D-94D9-4BE8-84A8-4DE95A575E75}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{2438DE3D-94D9-4BE8-84A8-4DE95A575E75}"
              }
            ],
            "repeated": 0,
            "id": 7095
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7096
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{076F9911-A348-465C-A807-A252F3F2D3DE}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{076F9911-A348-465C-A807-A252F3F2D3DE}"
              }
            ],
            "repeated": 0,
            "id": 7097
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{076F9911-A348-465C-A807-A252F3F2D3DE}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{076F9911-A348-465C-A807-A252F3F2D3DE}"
              }
            ],
            "repeated": 0,
            "id": 7098
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7099
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{85A10B03-C9F6-439F-BE5E-C0FBEF67807C}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{85A10B03-C9F6-439F-BE5E-C0FBEF67807C}"
              }
            ],
            "repeated": 0,
            "id": 7100
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{85A10B03-C9F6-439F-BE5E-C0FBEF67807C}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{85A10B03-C9F6-439F-BE5E-C0FBEF67807C}"
              }
            ],
            "repeated": 0,
            "id": 7101
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x6becf90f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0xfffffffc"
              }
            ],
            "repeated": 0,
            "id": 7102
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7103
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000073e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CLSID\\{05AF94D8-7174-4CD2-BE4A-4124B80EE4B8}\\Instance"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{05AF94D8-7174-4CD2-BE4A-4124B80EE4B8}\\Instance"
              }
            ],
            "repeated": 0,
            "id": 7104
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{05AF94D8-7174-4CD2-BE4A-4124B80EE4B8}\\Instance"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{05AF94D8-7174-4CD2-BE4A-4124B80EE4B8}\\Instance"
              }
            ],
            "repeated": 0,
            "id": 7105
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77989888",
            "parentcaller": "0x75d41713",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000744"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0007",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 7106
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x779a9141",
            "parentcaller": "0x6bed9603",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09580000"
              },
              {
                "name": "RegionSize",
                "value": "0x00030000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7107
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x779a8de2",
            "parentcaller": "0x779a8da5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09580000"
              },
              {
                "name": "RegionSize",
                "value": "0x00030000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7108
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x779a96ab",
            "parentcaller": "0x779a95ee",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000744"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09580000"
              },
              {
                "name": "SectionOffset",
                "value": "0x067ce39c"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7109
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x779a96ab",
            "parentcaller": "0x779a95ee",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000744"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09590000"
              },
              {
                "name": "SectionOffset",
                "value": "0x067ce39c"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7110
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x779a96ab",
            "parentcaller": "0x779a95ee",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000744"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x095a0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x067ce39c"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7111
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798917f",
            "parentcaller": "0x773d6a20",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "oleaut32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x76e60000"
              }
            ],
            "repeated": 0,
            "id": 7112
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7113
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7114
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7115
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7116
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7117
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7118
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7119
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7120
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7121
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7122
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7123
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7124
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7125
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7126
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7127
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7128
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7129
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7130
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77af003d",
            "parentcaller": "0x7798e8fd",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 7131
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798917f",
            "parentcaller": "0x6b50ef7c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "USER32"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              }
            ],
            "repeated": 0,
            "id": 7132
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x6b50ef92",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetSystemMetrics"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77604ef0"
              }
            ],
            "repeated": 0,
            "id": 7133
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x6b50efab",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              },
              {
                "name": "FunctionName",
                "value": "MonitorFromWindow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x776096f0"
              }
            ],
            "repeated": 0,
            "id": 7134
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x6b50efc0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              },
              {
                "name": "FunctionName",
                "value": "MonitorFromRect"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x775f92f0"
              }
            ],
            "repeated": 0,
            "id": 7135
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x6b50efd5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              },
              {
                "name": "FunctionName",
                "value": "MonitorFromPoint"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77600be0"
              }
            ],
            "repeated": 0,
            "id": 7136
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x6b50efea",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              },
              {
                "name": "FunctionName",
                "value": "EnumDisplayMonitors"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77611a20"
              }
            ],
            "repeated": 0,
            "id": 7137
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x6b50efff",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              },
              {
                "name": "FunctionName",
                "value": "EnumDisplayDevicesW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77610150"
              }
            ],
            "repeated": 0,
            "id": 7138
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x6b50f024",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetMonitorInfoW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77602f50"
              }
            ],
            "repeated": 0,
            "id": 7139
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x76e331ca",
            "parentcaller": "0x76e32e5f",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 7140
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1621a",
            "parentcaller": "0x779af2ba",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000748"
              }
            ],
            "repeated": 0,
            "id": 7141
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b16241",
            "parentcaller": "0x779af2ba",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074c"
              }
            ],
            "repeated": 0,
            "id": 7142
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7143
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\SetupHost.Exe"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 7144
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76e4d000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7145
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76e4d000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7146
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7147
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77577000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7148
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76e4d000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7149
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76e4d000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7150
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1621a",
            "parentcaller": "0x779ad839",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074c"
              }
            ],
            "repeated": 0,
            "id": 7151
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b16241",
            "parentcaller": "0x779ad839",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000748"
              }
            ],
            "repeated": 0,
            "id": 7152
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x75c05e85",
            "parentcaller": "0x75bff661",
            "category": "misc",
            "api": "ChangeWindowMessageFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "message",
                "value": "49240"
              },
              {
                "name": "dwFlag",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 7153
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x75c05eab",
            "parentcaller": "0x75bff661",
            "category": "misc",
            "api": "ChangeWindowMessageFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "message",
                "value": "49241"
              },
              {
                "name": "dwFlag",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 7154
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1621a",
            "parentcaller": "0x779ad839",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000748"
              }
            ],
            "repeated": 0,
            "id": 7155
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b16241",
            "parentcaller": "0x779ad839",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074c"
              }
            ],
            "repeated": 1,
            "id": 7156
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b16241",
            "parentcaller": "0x779af2ba",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000748"
              }
            ],
            "repeated": 0,
            "id": 7157
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77989595",
            "parentcaller": "0x75c040ac",
            "category": "synchronization",
            "api": "NtOpenMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000748"
              },
              {
                "name": "MutexName",
                "value": "Local\\MSCTF.Asm.MutexDefault1"
              }
            ],
            "repeated": 0,
            "id": 7158
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7159
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000748"
              },
              {
                "name": "Milliseconds",
                "value": "2000"
              }
            ],
            "repeated": 0,
            "id": 7160
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798c34d",
            "parentcaller": "0x75c041d5",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000074c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Local\\CTF.AsmListCache.FMPDefault1"
              }
            ],
            "repeated": 0,
            "id": 7161
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7799762b",
            "parentcaller": "0x75c041f2",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000074c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x095b0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x067cdf3c"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7162
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77999145",
            "parentcaller": "0x75c0460a",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x095b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 7163
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x75c0461b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000074c"
              }
            ],
            "repeated": 0,
            "id": 7164
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798dd70",
            "parentcaller": "0x75c04654",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000748"
              }
            ],
            "repeated": 1,
            "id": 7165
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7166
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\SetupHost.Exe"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\SetupHost.Exe"
              }
            ],
            "repeated": 0,
            "id": 7167
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x75c0940e",
            "parentcaller": "0x75c0aa46",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 7168
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x75c08e01",
            "parentcaller": "0x75c06a54",
            "category": "misc",
            "api": "GetSystemMetrics",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemMetricIndex",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 7169
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77989595",
            "parentcaller": "0x75c0924b",
            "category": "synchronization",
            "api": "NtOpenMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000748"
              },
              {
                "name": "MutexName",
                "value": "CicLoadWinStaWinSta0"
              }
            ],
            "repeated": 0,
            "id": 7170
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x75c09258",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000748"
              }
            ],
            "repeated": 0,
            "id": 7171
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77989595",
            "parentcaller": "0x75c08ed9",
            "category": "synchronization",
            "api": "NtOpenMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000748"
              },
              {
                "name": "MutexName",
                "value": "Local\\MSCTF.CtfMonitorInstMutexDefault1"
              }
            ],
            "repeated": 0,
            "id": 7172
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x75c08ee4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000748"
              }
            ],
            "repeated": 0,
            "id": 7173
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7174
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE"
              }
            ],
            "repeated": 0,
            "id": 7175
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000748"
              },
              {
                "name": "ValueName",
                "value": "LaunchUserOOBE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE"
              }
            ],
            "repeated": 0,
            "id": 7176
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x7797ecfa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000748"
              }
            ],
            "repeated": 0,
            "id": 7177
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75c98000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7178
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75c98000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7179
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77999924",
            "parentcaller": "0x76c1c2f8",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000074c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 7180
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798917f",
            "parentcaller": "0x75c2c42c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 7181
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x75c20248",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af2470"
              }
            ],
            "repeated": 0,
            "id": 7182
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x75c2aef1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b341e0"
              }
            ],
            "repeated": 0,
            "id": 7183
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x75befbbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af0700"
              }
            ],
            "repeated": 0,
            "id": 7184
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x75c1e911",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b2c3b0"
              }
            ],
            "repeated": 0,
            "id": 7185
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x75c201f5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b253f0"
              }
            ],
            "repeated": 0,
            "id": 7186
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x75be85de",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b1f560"
              }
            ],
            "repeated": 0,
            "id": 7187
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77989b67",
            "parentcaller": "0x75be96fb",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000075c"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5932:168:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 7188
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798ac59",
            "parentcaller": "0x75be99e3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000075c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7189
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7190
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000760"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 7191
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x75bf049e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000760"
              }
            ],
            "repeated": 0,
            "id": 7192
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798dd70",
            "parentcaller": "0x75bf046e",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000075c"
              }
            ],
            "repeated": 1,
            "id": 7193
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798964f",
            "parentcaller": "0x75c0508d",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "EventName",
                "value": "Local\\1ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 0,
            "id": 7194
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x76e33224",
            "parentcaller": "0x76e32e5f",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 7195
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1109f",
            "parentcaller": "0x77b0f039",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "textinputframework.dll"
              }
            ],
            "repeated": 0,
            "id": 7196
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1213c",
            "parentcaller": "0x77b12046",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\textinputframework.dll"
              }
            ],
            "repeated": 0,
            "id": 7197
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1e65c",
            "parentcaller": "0x77b1e1d2",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000760"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\textinputframework.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 7198
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1e699",
            "parentcaller": "0x77b1e1d2",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000764"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000760"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\TextInputFramework.dll"
              }
            ],
            "repeated": 0,
            "id": 7199
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1122c",
            "parentcaller": "0x77b11397",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000764"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fba0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000b9000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7200
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1000f",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fc4e000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7201
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "7504",
            "caller": "0x77b47b75",
            "parentcaller": "0x77b08aa0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x095b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0040a000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7202
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b100b7",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fc4c000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7203
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47bb5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x099b9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7204
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b100e5",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fc4c000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7205
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b21ea8",
            "parentcaller": "0x77b21e31",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7206
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b21ea8",
            "parentcaller": "0x77b21e61",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7207
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77af9d5b",
            "parentcaller": "0x77b0b4a0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fc4c000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7208
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1109f",
            "parentcaller": "0x77b0f039",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "CoreUIComponents.dll"
              }
            ],
            "repeated": 0,
            "id": 7209
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1109f",
            "parentcaller": "0x77b0f039",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 7210
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1e6ed",
            "parentcaller": "0x77b1e1d2",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000764"
              }
            ],
            "repeated": 0,
            "id": 7211
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1e6f5",
            "parentcaller": "0x77b1e1d2",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000760"
              }
            ],
            "repeated": 0,
            "id": 7212
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1213c",
            "parentcaller": "0x77b12046",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreUIComponents.dll"
              }
            ],
            "repeated": 0,
            "id": 7213
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1e65c",
            "parentcaller": "0x77b1e3a8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000760"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreUIComponents.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 7214
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1e699",
            "parentcaller": "0x77b1e3a8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000764"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000760"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\CoreUIComponents.dll"
              }
            ],
            "repeated": 0,
            "id": 7215
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1122c",
            "parentcaller": "0x77b11397",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000764"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f6a0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0027f000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7216
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1000f",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f8bb000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7217
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b100b7",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f80e000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7218
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b100e5",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f80e000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7219
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b21ea8",
            "parentcaller": "0x77b21e31",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7220
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b21ea8",
            "parentcaller": "0x77b21e61",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7221
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77af9d5b",
            "parentcaller": "0x77b0b4a0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f80e000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7222
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1109f",
            "parentcaller": "0x77b0f039",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 7223
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1109f",
            "parentcaller": "0x77b0f039",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "wintypes.dll"
              }
            ],
            "repeated": 2,
            "id": 7224
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1e6ed",
            "parentcaller": "0x77b1e3a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000764"
              }
            ],
            "repeated": 0,
            "id": 7225
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1e6f5",
            "parentcaller": "0x77b1e3a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000760"
              }
            ],
            "repeated": 0,
            "id": 7226
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1213c",
            "parentcaller": "0x77b12046",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 7227
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1e65c",
            "parentcaller": "0x77b1e3a8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000760"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 7228
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1e699",
            "parentcaller": "0x77b1e3a8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000764"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000760"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 7229
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1122c",
            "parentcaller": "0x77b11397",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000764"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f510000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0009b000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7230
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1000f",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f594000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7231
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b100b7",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f576000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7232
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b100e5",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f576000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7233
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b21ea8",
            "parentcaller": "0x77b21e31",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7234
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b21ea8",
            "parentcaller": "0x77b21e61",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7235
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77af9d5b",
            "parentcaller": "0x77b0b4a0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f576000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7236
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1e6ed",
            "parentcaller": "0x77b1e3a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000764"
              }
            ],
            "repeated": 0,
            "id": 7237
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1e6f5",
            "parentcaller": "0x77b1e3a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000760"
              }
            ],
            "repeated": 0,
            "id": 7238
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1213c",
            "parentcaller": "0x77b12046",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 7239
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1213c",
            "parentcaller": "0x77b12046",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              }
            ],
            "repeated": 0,
            "id": 7240
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1e65c",
            "parentcaller": "0x77b1e1d2",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000760"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 7241
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1e699",
            "parentcaller": "0x77b1e1d2",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000764"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000760"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\WinTypes.dll"
              }
            ],
            "repeated": 0,
            "id": 7242
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1122c",
            "parentcaller": "0x77b11397",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000764"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fac0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000dc000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7243
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1000f",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fb83000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7244
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b100b7",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fb81000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7245
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b100e5",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fb81000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7246
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b21ea8",
            "parentcaller": "0x77b21e31",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7247
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b21ea8",
            "parentcaller": "0x77b21e61",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7248
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77af9d5b",
            "parentcaller": "0x77b0b4a0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fb81000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7249
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1e6ed",
            "parentcaller": "0x77b1e1d2",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000764"
              }
            ],
            "repeated": 0,
            "id": 7250
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1e6f5",
            "parentcaller": "0x77b1e1d2",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000760"
              }
            ],
            "repeated": 0,
            "id": 7251
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b1213c",
            "parentcaller": "0x77b12046",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              }
            ],
            "repeated": 1,
            "id": 7252
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b10d10",
            "parentcaller": "0x77afe4a3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fc4c000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7253
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b10d10",
            "parentcaller": "0x77afe4a3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f576000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7254
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b10d10",
            "parentcaller": "0x77afe4a3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fb81000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7255
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b10d10",
            "parentcaller": "0x77afe4a3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f80e000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7256
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b10eea",
            "parentcaller": "0x77b10d32",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7257
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x74d198b1",
            "parentcaller": "0x74d18c82",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 7258
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x74d198f0",
            "parentcaller": "0x74d18c82",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000760"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 7259
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x74d19991",
            "parentcaller": "0x74d18c82",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000760"
              }
            ],
            "repeated": 0,
            "id": 7260
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x74d19991",
            "parentcaller": "0x74d18c82",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CoreMessaging"
              },
              {
                "name": "DllBase",
                "value": "0x6f510000"
              }
            ],
            "repeated": 0,
            "id": 7261
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x74d198b1",
            "parentcaller": "0x74d18c82",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\Windows\\SYSTEM32\\wintypes.dll"
              }
            ],
            "repeated": 0,
            "id": 7262
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x74d198f0",
            "parentcaller": "0x74d18c82",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 7263
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x74d19991",
            "parentcaller": "0x74d18c82",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000754"
              }
            ],
            "repeated": 0,
            "id": 7264
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x74d19991",
            "parentcaller": "0x74d18c82",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wintypes"
              },
              {
                "name": "DllBase",
                "value": "0x6fac0000"
              }
            ],
            "repeated": 0,
            "id": 7265
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x74d198b1",
            "parentcaller": "0x74d18c82",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\Windows\\System32\\CoreUIComponents.dll"
              }
            ],
            "repeated": 0,
            "id": 7266
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x74d198f0",
            "parentcaller": "0x74d18c82",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreUIComponents.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 7267
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x74d19991",
            "parentcaller": "0x74d18c82",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000754"
              }
            ],
            "repeated": 0,
            "id": 7268
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x74d19991",
            "parentcaller": "0x74d18c82",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CoreUIComponents"
              },
              {
                "name": "DllBase",
                "value": "0x6f6a0000"
              }
            ],
            "repeated": 0,
            "id": 7269
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x74d198b1",
            "parentcaller": "0x74d18c82",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\Windows\\SYSTEM32\\textinputframework.dll"
              }
            ],
            "repeated": 0,
            "id": 7270
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x74d198f0",
            "parentcaller": "0x74d18c82",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\textinputframework.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 7271
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x74d19991",
            "parentcaller": "0x74d18c82",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000754"
              }
            ],
            "repeated": 0,
            "id": 7272
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x74d19991",
            "parentcaller": "0x74d18c82",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\textinputframework"
              },
              {
                "name": "DllBase",
                "value": "0x6fba0000"
              }
            ],
            "repeated": 0,
            "id": 7273
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b0dd72",
            "parentcaller": "0x77b11873",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\CoreMessaging"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f510000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6f570f60"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 7274
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b0dd72",
            "parentcaller": "0x77b11873",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\WinTypes"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fac0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6fb38ec0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 7275
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b0dd72",
            "parentcaller": "0x77b11873",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\CoreUIComponents"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f6a0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6f6feba0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 7276
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b0dd72",
            "parentcaller": "0x77b11873",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\TextInputFramework"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fba0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6fbe08c0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 7277
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75c98000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7278
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x75c98000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7279
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7280
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000774"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\CTF\\"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\"
              }
            ],
            "repeated": 0,
            "id": 7281
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000774"
              },
              {
                "name": "ValueName",
                "value": "EnableAnchorContext"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\CTF\\EnableAnchorContext"
              }
            ],
            "repeated": 0,
            "id": 7282
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x75c21321",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000774"
              }
            ],
            "repeated": 0,
            "id": 7283
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x76e32cb5",
            "parentcaller": "0x7760a5a6",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 7284
          },
          {
            "timestamp": "2026-05-28 22:59:42,269",
            "thread_id": "4316",
            "caller": "0x7798917f",
            "parentcaller": "0x77601426",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "USER32"
              },
              {
                "name": "ModuleHandle",
                "value": "0x775d0000"
              }
            ],
            "repeated": 0,
            "id": 7285
          },
          {
            "timestamp": "2026-05-28 22:59:42,285",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed27c8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 0,
            "id": 7286
          },
          {
            "timestamp": "2026-05-28 22:59:42,285",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ebb03c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00000000"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 7287
          },
          {
            "timestamp": "2026-05-28 22:59:42,285",
            "thread_id": "4316",
            "caller": "0x747dcadd",
            "parentcaller": "0x747dca5a",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 11,
            "id": 7288
          },
          {
            "timestamp": "2026-05-28 22:59:42,285",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7289
          },
          {
            "timestamp": "2026-05-28 22:59:42,285",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000774"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000109",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 7290
          },
          {
            "timestamp": "2026-05-28 22:59:42,285",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000101",
                "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000774"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Setup"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Setup"
              }
            ],
            "repeated": 0,
            "id": 7291
          },
          {
            "timestamp": "2026-05-28 22:59:42,285",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x777e26fb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000774"
              }
            ],
            "repeated": 0,
            "id": 7292
          },
          {
            "timestamp": "2026-05-28 22:59:42,285",
            "thread_id": "4316",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c41000"
              },
              {
                "name": "RegionSize",
                "value": "0x00015000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7293
          },
          {
            "timestamp": "2026-05-28 22:59:42,285",
            "thread_id": "7504",
            "caller": "0x77b47b75",
            "parentcaller": "0x77b08aa0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09b50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00408000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7294
          },
          {
            "timestamp": "2026-05-28 22:59:42,285",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47b90",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09b50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7295
          },
          {
            "timestamp": "2026-05-28 22:59:42,285",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47bb5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09f57000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7296
          },
          {
            "timestamp": "2026-05-28 22:59:42,285",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x773f10d6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\oleacc"
              },
              {
                "name": "DllBase",
                "value": "0x69930000"
              }
            ],
            "repeated": 0,
            "id": 7297
          },
          {
            "timestamp": "2026-05-28 22:59:42,300",
            "thread_id": "7504",
            "caller": "0x77b47b75",
            "parentcaller": "0x77b08aa0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09f70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00391000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7298
          },
          {
            "timestamp": "2026-05-28 22:59:42,300",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47b90",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09f70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7299
          },
          {
            "timestamp": "2026-05-28 22:59:42,300",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47bb5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0a300000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7300
          },
          {
            "timestamp": "2026-05-28 22:59:42,300",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x773f10d6",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\oleacc.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x69930000"
              }
            ],
            "repeated": 0,
            "id": 7301
          },
          {
            "timestamp": "2026-05-28 22:59:42,300",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x779afb91",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "OLEAUT32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x76e60000"
              }
            ],
            "repeated": 0,
            "id": 7302
          },
          {
            "timestamp": "2026-05-28 22:59:42,300",
            "thread_id": "4316",
            "caller": "0x69ecf33b",
            "parentcaller": "0x69ecf5b0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "B5F8350B-0548-48B1-A6EE-88BD00B4A5E7"
              },
              {
                "name": "ClsContext",
                "value": "0x00000015",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "riid",
                "value": "6E26E776-04F0-495D-80E4-3330352E3169"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 7303
          },
          {
            "timestamp": "2026-05-28 22:59:42,300",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69977000"
              },
              {
                "name": "ModuleName",
                "value": "oleacc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7304
          },
          {
            "timestamp": "2026-05-28 22:59:42,300",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69977000"
              },
              {
                "name": "ModuleName",
                "value": "oleacc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7305
          },
          {
            "timestamp": "2026-05-28 22:59:42,300",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69977000"
              },
              {
                "name": "ModuleName",
                "value": "oleacc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7306
          },
          {
            "timestamp": "2026-05-28 22:59:42,300",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x69977000"
              },
              {
                "name": "ModuleName",
                "value": "oleacc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7307
          },
          {
            "timestamp": "2026-05-28 22:59:42,300",
            "thread_id": "4316",
            "caller": "0x75d4bc42",
            "parentcaller": "0x75d4ba23",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "MSAA_*FCFFFFFF00000000"
              },
              {
                "name": "Atom",
                "value": "0x0000c043"
              }
            ],
            "repeated": 0,
            "id": 7308
          },
          {
            "timestamp": "2026-05-28 22:59:42,300",
            "thread_id": "4316",
            "caller": "0x69ecf505",
            "parentcaller": "0x69ed3927",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "B5F8350B-0548-48B1-A6EE-88BD00B4A5E7"
              },
              {
                "name": "ClsContext",
                "value": "0x00000015",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "riid",
                "value": "6E26E776-04F0-495D-80E4-3330352E3169"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 7309
          },
          {
            "timestamp": "2026-05-28 22:59:42,300",
            "thread_id": "4316",
            "caller": "0x75d4bc42",
            "parentcaller": "0x75d4ba23",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "MSAA_*FCFFFFFF00000000"
              },
              {
                "name": "Atom",
                "value": "0x0000c043"
              }
            ],
            "repeated": 0,
            "id": 7310
          },
          {
            "timestamp": "2026-05-28 22:59:42,300",
            "thread_id": "4316",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c56000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7311
          },
          {
            "timestamp": "2026-05-28 22:59:42,300",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7312
          },
          {
            "timestamp": "2026-05-28 22:59:42,300",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b04f7e",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09b50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00408000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7313
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000784"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000109",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 7314
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000101",
                "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000784"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Segoe UI Light"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI Light"
              }
            ],
            "repeated": 0,
            "id": 7315
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x777e26fb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              }
            ],
            "repeated": 0,
            "id": 7316
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b04f7e",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x095b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0040a000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7317
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b04f7e",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09160000"
              },
              {
                "name": "RegionSize",
                "value": "0x0040b000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7318
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b04f7e",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08f50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00210000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7319
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b04f7e",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08e40000"
              },
              {
                "name": "RegionSize",
                "value": "0x00105000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7320
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b04f7e",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08db0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0008b000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7321
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08be5000"
              },
              {
                "name": "RegionSize",
                "value": "0x0003f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7322
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c41000"
              },
              {
                "name": "RegionSize",
                "value": "0x00033000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7323
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c37000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7324
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aef655",
            "parentcaller": "0x77b046e3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08be5000"
              },
              {
                "name": "RegionSize",
                "value": "0x0003f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7325
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08bb5000"
              },
              {
                "name": "RegionSize",
                "value": "0x0006f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7326
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b04f7e",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x088f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x002b4000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7327
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77b47b75",
            "parentcaller": "0x77b08aa0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08db0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00341000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7328
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47b90",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08db0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7329
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47bb5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x090f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7330
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7331
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000780"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000109",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 7332
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000101",
                "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000780"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Segoe UI"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 7333
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x777e26fb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000780"
              }
            ],
            "repeated": 0,
            "id": 7334
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77b47b75",
            "parentcaller": "0x77b08aa0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09100000"
              },
              {
                "name": "RegionSize",
                "value": "0x002f4000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7335
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47b90",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09100000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7336
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47bb5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x093f3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7337
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77b47b75",
            "parentcaller": "0x77b08aa0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x088f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00152000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7338
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47b90",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x088f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7339
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47bb5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08a41000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7340
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77b47b75",
            "parentcaller": "0x77b08aa0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0a320000"
              },
              {
                "name": "RegionSize",
                "value": "0x00bc8000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7341
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47b90",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0a320000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7342
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b47bb5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aee7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7343
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x69ecf505",
            "parentcaller": "0x69ecf636",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "B5F8350B-0548-48B1-A6EE-88BD00B4A5E7"
              },
              {
                "name": "ClsContext",
                "value": "0x00000015",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "riid",
                "value": "6E26E776-04F0-495D-80E4-3330352E3169"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 7344
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x75d4bc42",
            "parentcaller": "0x75d4ba23",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "MSAA_*FCFFFFFF00000000"
              },
              {
                "name": "Atom",
                "value": "0x0000c043"
              }
            ],
            "repeated": 0,
            "id": 7345
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x76e32cb5",
            "parentcaller": "0x7760a5a6",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 7346
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ed10e9",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00020180"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 7347
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed27c8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7348
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b04f7e",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09f70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00391000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7349
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x69d48b3d",
            "parentcaller": "0x69cec1d9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000738"
              }
            ],
            "repeated": 0,
            "id": 7350
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed27c8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 0,
            "id": 7351
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b04f7e",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x073e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x002ad000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7352
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 1,
            "id": 7353
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x7798917f",
            "parentcaller": "0x76b1c5c4",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 7354
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x76b1c728",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b253f0"
              }
            ],
            "repeated": 0,
            "id": 7355
          },
          {
            "timestamp": "2026-05-28 22:59:42,316",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x76b1c68e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b341e0"
              }
            ],
            "repeated": 0,
            "id": 7356
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed258e",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 2,
            "id": 7357
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "7504",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c41000"
              },
              {
                "name": "RegionSize",
                "value": "0x00033000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7358
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed258e",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 8,
            "id": 7359
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7360
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7361
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed27c8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 2,
            "id": 7362
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7363
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7364
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x729efe0d",
            "parentcaller": "0x729900f3",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000068"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7365
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x729efe1c",
            "parentcaller": "0x729900f3",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000006c"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7366
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x729efe27",
            "parentcaller": "0x729900f3",
            "category": "misc",
            "api": "GetSystemMetrics",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemMetricIndex",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 7367
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x729efe3b",
            "parentcaller": "0x729900f3",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000026"
              },
              {
                "name": "uiParam",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 7368
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x729efe4d",
            "parentcaller": "0x729900f3",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000103e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7369
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x729efe5f",
            "parentcaller": "0x729900f3",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00001042"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7370
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x729efe6e",
            "parentcaller": "0x729900f3",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000001b"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7371
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x72b20000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7372
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x72b20000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7373
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x7798917f",
            "parentcaller": "0x76cd45c6",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              }
            ],
            "repeated": 0,
            "id": 7374
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x76d0443f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af2470"
              }
            ],
            "repeated": 0,
            "id": 7375
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x76cd6bb6",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b341e0"
              }
            ],
            "repeated": 0,
            "id": 7376
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x76cd457a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77af0700"
              }
            ],
            "repeated": 0,
            "id": 7377
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x76d03661",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b2c3b0"
              }
            ],
            "repeated": 0,
            "id": 7378
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x76d043ec",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b253f0"
              }
            ],
            "repeated": 0,
            "id": 7379
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x76cd5eee",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77ac0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77b1f560"
              }
            ],
            "repeated": 0,
            "id": 7380
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x77989b67",
            "parentcaller": "0x76cd6c5d",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000738"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5932:168:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 7381
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x7798ac59",
            "parentcaller": "0x76cd8bb8",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000738"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7382
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7383
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000780"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 7384
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x76ce9b0e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000780"
              }
            ],
            "repeated": 0,
            "id": 7385
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x7798dd70",
            "parentcaller": "0x76ce9aae",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000738"
              }
            ],
            "repeated": 1,
            "id": 7386
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x77989b67",
            "parentcaller": "0x76cd6f55",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000738"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5932:64:WilError_03"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 7387
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x7798ac59",
            "parentcaller": "0x76cd8bb8",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000738"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7388
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7389
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000780"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 7390
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x76ce9b0e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000780"
              }
            ],
            "repeated": 0,
            "id": 7391
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x7798dd70",
            "parentcaller": "0x76ce9aae",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000738"
              }
            ],
            "repeated": 1,
            "id": 7392
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x7798c34d",
            "parentcaller": "0x76cd85a9",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000738"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000006"
              },
              {
                "name": "ObjectAttributes",
                "value": "windows_shell_global_counters"
              }
            ],
            "repeated": 0,
            "id": 7393
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x7799762b",
            "parentcaller": "0x76cd8457",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000738"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x073e0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x067ced54"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7394
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7395
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000780"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 7396
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000780"
              },
              {
                "name": "ValueName",
                "value": "TurnOffSPIAnimations"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations"
              }
            ],
            "repeated": 0,
            "id": 7397
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x76cd7bb5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000780"
              }
            ],
            "repeated": 0,
            "id": 7398
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 7399
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000046c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 7400
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x068e6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7401
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed27c8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 12,
            "id": 7402
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "7504",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c37000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7403
          },
          {
            "timestamp": "2026-05-28 22:59:42,331",
            "thread_id": "7504",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08bb5000"
              },
              {
                "name": "RegionSize",
                "value": "0x0006f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7404
          },
          {
            "timestamp": "2026-05-28 22:59:42,363",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7405
          },
          {
            "timestamp": "2026-05-28 22:59:42,425",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06e18000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7406
          },
          {
            "timestamp": "2026-05-28 22:59:42,441",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c75000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7407
          },
          {
            "timestamp": "2026-05-28 22:59:42,441",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c7a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7408
          },
          {
            "timestamp": "2026-05-28 22:59:42,441",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c7f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7409
          },
          {
            "timestamp": "2026-05-28 22:59:42,441",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c84000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7410
          },
          {
            "timestamp": "2026-05-28 22:59:42,456",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7411
          },
          {
            "timestamp": "2026-05-28 22:59:42,456",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c89000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7412
          },
          {
            "timestamp": "2026-05-28 22:59:42,472",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c8c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7413
          },
          {
            "timestamp": "2026-05-28 22:59:42,472",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c91000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7414
          },
          {
            "timestamp": "2026-05-28 22:59:42,472",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c9a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7415
          },
          {
            "timestamp": "2026-05-28 22:59:42,488",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7416
          },
          {
            "timestamp": "2026-05-28 22:59:42,488",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c9f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7417
          },
          {
            "timestamp": "2026-05-28 22:59:42,488",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08ca4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7418
          },
          {
            "timestamp": "2026-05-28 22:59:42,503",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08ca9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7419
          },
          {
            "timestamp": "2026-05-28 22:59:42,503",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08caa000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7420
          },
          {
            "timestamp": "2026-05-28 22:59:42,519",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7421
          },
          {
            "timestamp": "2026-05-28 22:59:42,519",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08cad000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7422
          },
          {
            "timestamp": "2026-05-28 22:59:42,519",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08cb2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7423
          },
          {
            "timestamp": "2026-05-28 22:59:42,535",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08cbb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7424
          },
          {
            "timestamp": "2026-05-28 22:59:42,550",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7425
          },
          {
            "timestamp": "2026-05-28 22:59:42,550",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08cc4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7426
          },
          {
            "timestamp": "2026-05-28 22:59:42,550",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08cc9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7427
          },
          {
            "timestamp": "2026-05-28 22:59:42,566",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08cd2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7428
          },
          {
            "timestamp": "2026-05-28 22:59:42,566",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08cd7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7429
          },
          {
            "timestamp": "2026-05-28 22:59:42,581",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7430
          },
          {
            "timestamp": "2026-05-28 22:59:42,581",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08ce0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7431
          },
          {
            "timestamp": "2026-05-28 22:59:42,613",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7432
          },
          {
            "timestamp": "2026-05-28 22:59:42,628",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08ce5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7433
          },
          {
            "timestamp": "2026-05-28 22:59:42,644",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7434
          },
          {
            "timestamp": "2026-05-28 22:59:42,644",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08cee000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7435
          },
          {
            "timestamp": "2026-05-28 22:59:42,660",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08cf7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7436
          },
          {
            "timestamp": "2026-05-28 22:59:42,660",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d00000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7437
          },
          {
            "timestamp": "2026-05-28 22:59:42,675",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7438
          },
          {
            "timestamp": "2026-05-28 22:59:42,675",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d05000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7439
          },
          {
            "timestamp": "2026-05-28 22:59:42,675",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d07000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7440
          },
          {
            "timestamp": "2026-05-28 22:59:42,675",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d10000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7441
          },
          {
            "timestamp": "2026-05-28 22:59:42,691",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d15000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7442
          },
          {
            "timestamp": "2026-05-28 22:59:42,706",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7443
          },
          {
            "timestamp": "2026-05-28 22:59:42,738",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d1a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7444
          },
          {
            "timestamp": "2026-05-28 22:59:42,753",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d23000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7445
          },
          {
            "timestamp": "2026-05-28 22:59:42,769",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7446
          },
          {
            "timestamp": "2026-05-28 22:59:42,800",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d2c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7447
          },
          {
            "timestamp": "2026-05-28 22:59:42,800",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d2e000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7448
          },
          {
            "timestamp": "2026-05-28 22:59:42,800",
            "thread_id": "7504",
            "caller": "0x77b00349",
            "parentcaller": "0x77b037d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d35000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7449
          },
          {
            "timestamp": "2026-05-28 22:59:42,816",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d39000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7450
          },
          {
            "timestamp": "2026-05-28 22:59:42,831",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7451
          },
          {
            "timestamp": "2026-05-28 22:59:42,831",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d3e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7452
          },
          {
            "timestamp": "2026-05-28 22:59:42,831",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d47000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7453
          },
          {
            "timestamp": "2026-05-28 22:59:42,847",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d4c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7454
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7455
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d55000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7456
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7457
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d5a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7458
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7459
          },
          {
            "timestamp": "2026-05-28 22:59:43,003",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d63000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7460
          },
          {
            "timestamp": "2026-05-28 22:59:43,003",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d6c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7461
          },
          {
            "timestamp": "2026-05-28 22:59:43,019",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7462
          },
          {
            "timestamp": "2026-05-28 22:59:43,019",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d7d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7463
          },
          {
            "timestamp": "2026-05-28 22:59:43,019",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d82000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7464
          },
          {
            "timestamp": "2026-05-28 22:59:43,035",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d8b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7465
          },
          {
            "timestamp": "2026-05-28 22:59:43,050",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7466
          },
          {
            "timestamp": "2026-05-28 22:59:43,066",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d94000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7467
          },
          {
            "timestamp": "2026-05-28 22:59:43,066",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08da5000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000a000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7468
          },
          {
            "timestamp": "2026-05-28 22:59:43,081",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7469
          },
          {
            "timestamp": "2026-05-28 22:59:43,128",
            "thread_id": "7504",
            "caller": "0x77b0058c",
            "parentcaller": "0x77b07ac3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x095b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00400000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7470
          },
          {
            "timestamp": "2026-05-28 22:59:43,128",
            "thread_id": "7504",
            "caller": "0x77b005eb",
            "parentcaller": "0x77b07ac3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x095b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7471
          },
          {
            "timestamp": "2026-05-28 22:59:43,144",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7472
          },
          {
            "timestamp": "2026-05-28 22:59:43,222",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x095b6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7473
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 7474
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7475
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 1,
            "id": 7476
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x01@\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7477
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed1660",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 3,
            "id": 7478
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01@\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7479
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7480
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7481
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7482
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00J@\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7483
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "J@\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7484
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7485
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7486
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7487
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x91@\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7488
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x91@\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7489
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7490
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000780"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 7491
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000780"
              },
              {
                "name": "ValueName",
                "value": "SetupProgress"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "0"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupProgress"
              }
            ],
            "repeated": 0,
            "id": 7492
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000780"
              }
            ],
            "repeated": 0,
            "id": 7493
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7494
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7495
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xdb@\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7496
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xdb@\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7497
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7498
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7499
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7500
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00+A\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7501
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "+A\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7502
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7503
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000780"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 7504
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000780"
              },
              {
                "name": "ValueName",
                "value": "SetupPhase"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "2"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupPhase"
              }
            ],
            "repeated": 0,
            "id": 7505
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000780"
              }
            ],
            "repeated": 0,
            "id": 7506
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7507
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7508
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00oA\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7509
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "oA\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7510
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7511
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000780"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 7512
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000780"
              },
              {
                "name": "ValueName",
                "value": "SetupSubPhase"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "24"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupSubPhase"
              }
            ],
            "repeated": 0,
            "id": 7513
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000780"
              }
            ],
            "repeated": 0,
            "id": 7514
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7515
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 7516
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ebb03c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00020180"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 7517
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x095bf000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7518
          },
          {
            "timestamp": "2026-05-28 22:59:43,238",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x095d0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7519
          },
          {
            "timestamp": "2026-05-28 22:59:43,269",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 41,
            "id": 7520
          },
          {
            "timestamp": "2026-05-28 22:59:43,441",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x095d9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7521
          },
          {
            "timestamp": "2026-05-28 22:59:43,441",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x095ea000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7522
          },
          {
            "timestamp": "2026-05-28 22:59:43,456",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7523
          },
          {
            "timestamp": "2026-05-28 22:59:43,488",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x095f3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7524
          },
          {
            "timestamp": "2026-05-28 22:59:43,519",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7525
          },
          {
            "timestamp": "2026-05-28 22:59:43,535",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09604000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7526
          },
          {
            "timestamp": "2026-05-28 22:59:43,535",
            "thread_id": "7504",
            "caller": "0x77b00349",
            "parentcaller": "0x77b037d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0960a000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7527
          },
          {
            "timestamp": "2026-05-28 22:59:43,550",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7528
          },
          {
            "timestamp": "2026-05-28 22:59:43,566",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0960f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7529
          },
          {
            "timestamp": "2026-05-28 22:59:43,581",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 34,
            "id": 7530
          },
          {
            "timestamp": "2026-05-28 22:59:43,722",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09618000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7531
          },
          {
            "timestamp": "2026-05-28 22:59:43,722",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0961d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7532
          },
          {
            "timestamp": "2026-05-28 22:59:43,738",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7533
          },
          {
            "timestamp": "2026-05-28 22:59:43,738",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09626000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7534
          },
          {
            "timestamp": "2026-05-28 22:59:43,769",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7535
          },
          {
            "timestamp": "2026-05-28 22:59:43,769",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09637000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7536
          },
          {
            "timestamp": "2026-05-28 22:59:43,800",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7537
          },
          {
            "timestamp": "2026-05-28 22:59:43,831",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09640000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7538
          },
          {
            "timestamp": "2026-05-28 22:59:43,863",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7539
          },
          {
            "timestamp": "2026-05-28 22:59:43,910",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09649000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7540
          },
          {
            "timestamp": "2026-05-28 22:59:43,910",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0965a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7541
          },
          {
            "timestamp": "2026-05-28 22:59:43,925",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7542
          },
          {
            "timestamp": "2026-05-28 22:59:43,925",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0966b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7543
          },
          {
            "timestamp": "2026-05-28 22:59:43,956",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 41,
            "id": 7544
          },
          {
            "timestamp": "2026-05-28 22:59:44,128",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09674000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7545
          },
          {
            "timestamp": "2026-05-28 22:59:44,144",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7546
          },
          {
            "timestamp": "2026-05-28 22:59:44,144",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0967d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7547
          },
          {
            "timestamp": "2026-05-28 22:59:44,175",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7548
          },
          {
            "timestamp": "2026-05-28 22:59:44,253",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7549
          },
          {
            "timestamp": "2026-05-28 22:59:44,253",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7550
          },
          {
            "timestamp": "2026-05-28 22:59:44,253",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 7551
          },
          {
            "timestamp": "2026-05-28 22:59:44,253",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ebb03c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00020180"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 7552
          },
          {
            "timestamp": "2026-05-28 22:59:44,269",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7553
          },
          {
            "timestamp": "2026-05-28 22:59:44,285",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09686000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7554
          },
          {
            "timestamp": "2026-05-28 22:59:44,300",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7555
          },
          {
            "timestamp": "2026-05-28 22:59:44,300",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0968f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7556
          },
          {
            "timestamp": "2026-05-28 22:59:44,331",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 27,
            "id": 7557
          },
          {
            "timestamp": "2026-05-28 22:59:44,425",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x096a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7558
          },
          {
            "timestamp": "2026-05-28 22:59:44,456",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7559
          },
          {
            "timestamp": "2026-05-28 22:59:44,456",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x096b1000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7560
          },
          {
            "timestamp": "2026-05-28 22:59:44,456",
            "thread_id": "7504",
            "caller": "0x77b00349",
            "parentcaller": "0x77b037d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x096b7000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7561
          },
          {
            "timestamp": "2026-05-28 22:59:44,472",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x096bc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7562
          },
          {
            "timestamp": "2026-05-28 22:59:44,488",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7563
          },
          {
            "timestamp": "2026-05-28 22:59:44,488",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x096cd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7564
          },
          {
            "timestamp": "2026-05-28 22:59:44,519",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7565
          },
          {
            "timestamp": "2026-05-28 22:59:44,550",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x096d6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7566
          },
          {
            "timestamp": "2026-05-28 22:59:44,581",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 41,
            "id": 7567
          },
          {
            "timestamp": "2026-05-28 22:59:44,753",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x096df000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7568
          },
          {
            "timestamp": "2026-05-28 22:59:44,769",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7569
          },
          {
            "timestamp": "2026-05-28 22:59:44,800",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x096e8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7570
          },
          {
            "timestamp": "2026-05-28 22:59:44,831",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7571
          },
          {
            "timestamp": "2026-05-28 22:59:44,894",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x096f1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7572
          },
          {
            "timestamp": "2026-05-28 22:59:44,894",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x096fa000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7573
          },
          {
            "timestamp": "2026-05-28 22:59:44,925",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7574
          },
          {
            "timestamp": "2026-05-28 22:59:44,956",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0970b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7575
          },
          {
            "timestamp": "2026-05-28 22:59:44,988",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7576
          },
          {
            "timestamp": "2026-05-28 22:59:45,050",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0972c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7577
          },
          {
            "timestamp": "2026-05-28 22:59:45,081",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7578
          },
          {
            "timestamp": "2026-05-28 22:59:45,097",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0974d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7579
          },
          {
            "timestamp": "2026-05-28 22:59:45,113",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7580
          },
          {
            "timestamp": "2026-05-28 22:59:45,160",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0975e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7581
          },
          {
            "timestamp": "2026-05-28 22:59:45,175",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7582
          },
          {
            "timestamp": "2026-05-28 22:59:45,253",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7583
          },
          {
            "timestamp": "2026-05-28 22:59:45,253",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7584
          },
          {
            "timestamp": "2026-05-28 22:59:45,253",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 7585
          },
          {
            "timestamp": "2026-05-28 22:59:45,253",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ebb03c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00020180"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 7586
          },
          {
            "timestamp": "2026-05-28 22:59:45,269",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 41,
            "id": 7587
          },
          {
            "timestamp": "2026-05-28 22:59:45,425",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09767000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7588
          },
          {
            "timestamp": "2026-05-28 22:59:45,425",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09770000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7589
          },
          {
            "timestamp": "2026-05-28 22:59:45,456",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 27,
            "id": 7590
          },
          {
            "timestamp": "2026-05-28 22:59:45,550",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09781000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7591
          },
          {
            "timestamp": "2026-05-28 22:59:45,566",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0978a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7592
          },
          {
            "timestamp": "2026-05-28 22:59:45,566",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x097ab000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7593
          },
          {
            "timestamp": "2026-05-28 22:59:45,581",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 90,
            "id": 7594
          },
          {
            "timestamp": "2026-05-28 22:59:45,988",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x097bc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7595
          },
          {
            "timestamp": "2026-05-28 22:59:46,019",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7596
          },
          {
            "timestamp": "2026-05-28 22:59:46,144",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x097c5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7597
          },
          {
            "timestamp": "2026-05-28 22:59:46,222",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x097ce000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7598
          },
          {
            "timestamp": "2026-05-28 22:59:46,253",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7599
          },
          {
            "timestamp": "2026-05-28 22:59:46,253",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x097ef000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7600
          },
          {
            "timestamp": "2026-05-28 22:59:46,269",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7601
          },
          {
            "timestamp": "2026-05-28 22:59:46,269",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7602
          },
          {
            "timestamp": "2026-05-28 22:59:46,269",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 7603
          },
          {
            "timestamp": "2026-05-28 22:59:46,269",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ebb03c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00020180"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 7604
          },
          {
            "timestamp": "2026-05-28 22:59:46,285",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7605
          },
          {
            "timestamp": "2026-05-28 22:59:46,378",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 7606
          },
          {
            "timestamp": "2026-05-28 22:59:46,378",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed1660",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 0,
            "id": 7607
          },
          {
            "timestamp": "2026-05-28 22:59:46,378",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              }
            ],
            "repeated": 0,
            "id": 7608
          },
          {
            "timestamp": "2026-05-28 22:59:46,378",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 7609
          },
          {
            "timestamp": "2026-05-28 22:59:46,378",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 7610
          },
          {
            "timestamp": "2026-05-28 22:59:46,378",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              }
            ],
            "repeated": 0,
            "id": 7611
          },
          {
            "timestamp": "2026-05-28 22:59:46,378",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 7612
          },
          {
            "timestamp": "2026-05-28 22:59:46,378",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 7613
          },
          {
            "timestamp": "2026-05-28 22:59:46,378",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 7614
          },
          {
            "timestamp": "2026-05-28 22:59:46,378",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              }
            ],
            "repeated": 0,
            "id": 7615
          },
          {
            "timestamp": "2026-05-28 22:59:46,378",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 7616
          },
          {
            "timestamp": "2026-05-28 22:59:46,378",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed1660",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 0,
            "id": 7617
          },
          {
            "timestamp": "2026-05-28 22:59:46,378",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "1"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 7618
          },
          {
            "timestamp": "2026-05-28 22:59:46,378",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed258e",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 0,
            "id": 7619
          },
          {
            "timestamp": "2026-05-28 22:59:46,378",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              }
            ],
            "repeated": 0,
            "id": 7620
          },
          {
            "timestamp": "2026-05-28 22:59:46,378",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed25d7",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 9,
            "id": 7621
          },
          {
            "timestamp": "2026-05-28 22:59:46,441",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x097f8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7622
          },
          {
            "timestamp": "2026-05-28 22:59:46,456",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7623
          },
          {
            "timestamp": "2026-05-28 22:59:46,535",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09819000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7624
          },
          {
            "timestamp": "2026-05-28 22:59:46,535",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0981a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7625
          },
          {
            "timestamp": "2026-05-28 22:59:46,581",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7626
          },
          {
            "timestamp": "2026-05-28 22:59:46,597",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0982b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7627
          },
          {
            "timestamp": "2026-05-28 22:59:46,613",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7628
          },
          {
            "timestamp": "2026-05-28 22:59:46,675",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0982d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7629
          },
          {
            "timestamp": "2026-05-28 22:59:46,706",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7630
          },
          {
            "timestamp": "2026-05-28 22:59:46,785",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09830000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7631
          },
          {
            "timestamp": "2026-05-28 22:59:46,800",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7632
          },
          {
            "timestamp": "2026-05-28 22:59:46,800",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09831000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7633
          },
          {
            "timestamp": "2026-05-28 22:59:46,831",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 27,
            "id": 7634
          },
          {
            "timestamp": "2026-05-28 22:59:46,941",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09834000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7635
          },
          {
            "timestamp": "2026-05-28 22:59:46,972",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7636
          },
          {
            "timestamp": "2026-05-28 22:59:47,019",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09837000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7637
          },
          {
            "timestamp": "2026-05-28 22:59:47,035",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7638
          },
          {
            "timestamp": "2026-05-28 22:59:47,081",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0983a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7639
          },
          {
            "timestamp": "2026-05-28 22:59:47,097",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7640
          },
          {
            "timestamp": "2026-05-28 22:59:47,160",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0983c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7641
          },
          {
            "timestamp": "2026-05-28 22:59:47,175",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0984d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7642
          },
          {
            "timestamp": "2026-05-28 22:59:47,191",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7643
          },
          {
            "timestamp": "2026-05-28 22:59:47,191",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09852000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7644
          },
          {
            "timestamp": "2026-05-28 22:59:47,222",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7645
          },
          {
            "timestamp": "2026-05-28 22:59:47,269",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09873000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7646
          },
          {
            "timestamp": "2026-05-28 22:59:47,285",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7647
          },
          {
            "timestamp": "2026-05-28 22:59:47,285",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7648
          },
          {
            "timestamp": "2026-05-28 22:59:47,285",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 7649
          },
          {
            "timestamp": "2026-05-28 22:59:47,285",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ebb03c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00020180"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 7650
          },
          {
            "timestamp": "2026-05-28 22:59:47,300",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 27,
            "id": 7651
          },
          {
            "timestamp": "2026-05-28 22:59:47,410",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09884000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7652
          },
          {
            "timestamp": "2026-05-28 22:59:47,425",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7653
          },
          {
            "timestamp": "2026-05-28 22:59:47,456",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09886000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7654
          },
          {
            "timestamp": "2026-05-28 22:59:47,503",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7655
          },
          {
            "timestamp": "2026-05-28 22:59:47,581",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0988b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7656
          },
          {
            "timestamp": "2026-05-28 22:59:47,613",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 27,
            "id": 7657
          },
          {
            "timestamp": "2026-05-28 22:59:47,722",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0988e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7658
          },
          {
            "timestamp": "2026-05-28 22:59:47,753",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7659
          },
          {
            "timestamp": "2026-05-28 22:59:47,753",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09893000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7660
          },
          {
            "timestamp": "2026-05-28 22:59:47,785",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 41,
            "id": 7661
          },
          {
            "timestamp": "2026-05-28 22:59:47,988",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x098b4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7662
          },
          {
            "timestamp": "2026-05-28 22:59:48,019",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7663
          },
          {
            "timestamp": "2026-05-28 22:59:48,097",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x098b9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7664
          },
          {
            "timestamp": "2026-05-28 22:59:48,113",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 27,
            "id": 7665
          },
          {
            "timestamp": "2026-05-28 22:59:48,206",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x098da000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7666
          },
          {
            "timestamp": "2026-05-28 22:59:48,238",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7667
          },
          {
            "timestamp": "2026-05-28 22:59:48,285",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7668
          },
          {
            "timestamp": "2026-05-28 22:59:48,285",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7669
          },
          {
            "timestamp": "2026-05-28 22:59:48,285",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 7670
          },
          {
            "timestamp": "2026-05-28 22:59:48,285",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ebb03c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00020180"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 7671
          },
          {
            "timestamp": "2026-05-28 22:59:48,285",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x098df000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7672
          },
          {
            "timestamp": "2026-05-28 22:59:48,300",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7673
          },
          {
            "timestamp": "2026-05-28 22:59:48,331",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x098e8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7674
          },
          {
            "timestamp": "2026-05-28 22:59:48,363",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 76,
            "id": 7675
          },
          {
            "timestamp": "2026-05-28 22:59:48,706",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x098f9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7676
          },
          {
            "timestamp": "2026-05-28 22:59:48,738",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 34,
            "id": 7677
          },
          {
            "timestamp": "2026-05-28 22:59:48,878",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09902000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7678
          },
          {
            "timestamp": "2026-05-28 22:59:48,894",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7679
          },
          {
            "timestamp": "2026-05-28 22:59:48,894",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0990b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7680
          },
          {
            "timestamp": "2026-05-28 22:59:48,925",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 69,
            "id": 7681
          },
          {
            "timestamp": "2026-05-28 22:59:49,238",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09910000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7682
          },
          {
            "timestamp": "2026-05-28 22:59:49,253",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7683
          },
          {
            "timestamp": "2026-05-28 22:59:49,300",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7684
          },
          {
            "timestamp": "2026-05-28 22:59:49,300",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7685
          },
          {
            "timestamp": "2026-05-28 22:59:49,300",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 7686
          },
          {
            "timestamp": "2026-05-28 22:59:49,300",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ebb03c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00020180"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 7687
          },
          {
            "timestamp": "2026-05-28 22:59:49,316",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7688
          },
          {
            "timestamp": "2026-05-28 22:59:49,331",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09931000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7689
          },
          {
            "timestamp": "2026-05-28 22:59:49,347",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 8,
            "id": 7690
          },
          {
            "timestamp": "2026-05-28 22:59:49,378",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09942000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7691
          },
          {
            "timestamp": "2026-05-28 22:59:49,378",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed1660",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 25,
            "id": 7692
          },
          {
            "timestamp": "2026-05-28 22:59:49,519",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09953000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7693
          },
          {
            "timestamp": "2026-05-28 22:59:49,519",
            "thread_id": "7504",
            "caller": "0x77b00349",
            "parentcaller": "0x77b037d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09958000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7694
          },
          {
            "timestamp": "2026-05-28 22:59:49,535",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7695
          },
          {
            "timestamp": "2026-05-28 22:59:49,581",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0995e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7696
          },
          {
            "timestamp": "2026-05-28 22:59:49,613",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7697
          },
          {
            "timestamp": "2026-05-28 22:59:49,628",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0997f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7698
          },
          {
            "timestamp": "2026-05-28 22:59:49,644",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 62,
            "id": 7699
          },
          {
            "timestamp": "2026-05-28 22:59:49,972",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09982000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7700
          },
          {
            "timestamp": "2026-05-28 22:59:49,988",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 41,
            "id": 7701
          },
          {
            "timestamp": "2026-05-28 22:59:50,144",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x099a3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7702
          },
          {
            "timestamp": "2026-05-28 22:59:50,175",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7703
          },
          {
            "timestamp": "2026-05-28 22:59:50,238",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x099a6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7704
          },
          {
            "timestamp": "2026-05-28 22:59:50,269",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 13,
            "id": 7705
          },
          {
            "timestamp": "2026-05-28 22:59:50,300",
            "thread_id": "7504",
            "caller": "0x77b0058c",
            "parentcaller": "0x77b07ac3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aef0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00800000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7706
          },
          {
            "timestamp": "2026-05-28 22:59:50,300",
            "thread_id": "7504",
            "caller": "0x77b005eb",
            "parentcaller": "0x77b07ac3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aef0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7707
          },
          {
            "timestamp": "2026-05-28 22:59:50,331",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7708
          },
          {
            "timestamp": "2026-05-28 22:59:50,331",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7709
          },
          {
            "timestamp": "2026-05-28 22:59:50,331",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 7710
          },
          {
            "timestamp": "2026-05-28 22:59:50,331",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ebb03c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00020180"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 7711
          },
          {
            "timestamp": "2026-05-28 22:59:50,441",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aef6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7712
          },
          {
            "timestamp": "2026-05-28 22:59:50,503",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 90,
            "id": 7713
          },
          {
            "timestamp": "2026-05-28 22:59:50,925",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0af07000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7714
          },
          {
            "timestamp": "2026-05-28 22:59:50,956",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 27,
            "id": 7715
          },
          {
            "timestamp": "2026-05-28 22:59:51,081",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0af10000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7716
          },
          {
            "timestamp": "2026-05-28 22:59:51,097",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 55,
            "id": 7717
          },
          {
            "timestamp": "2026-05-28 22:59:51,331",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7718
          },
          {
            "timestamp": "2026-05-28 22:59:51,331",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7719
          },
          {
            "timestamp": "2026-05-28 22:59:51,331",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 7720
          },
          {
            "timestamp": "2026-05-28 22:59:51,331",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ebb03c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00020180"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 7721
          },
          {
            "timestamp": "2026-05-28 22:59:51,347",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7722
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 7723
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 0,
            "id": 7724
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              }
            ],
            "repeated": 0,
            "id": 7725
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed1660",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 0,
            "id": 7726
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 7727
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 7728
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              }
            ],
            "repeated": 0,
            "id": 7729
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 7730
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 7731
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 7732
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              }
            ],
            "repeated": 0,
            "id": 7733
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed1660",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 0,
            "id": 7734
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 7735
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "2"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 7736
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed25d7",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 0,
            "id": 7737
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              }
            ],
            "repeated": 0,
            "id": 7738
          },
          {
            "timestamp": "2026-05-28 22:59:51,378",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 29,
            "id": 7739
          },
          {
            "timestamp": "2026-05-28 22:59:51,519",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0af19000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7740
          },
          {
            "timestamp": "2026-05-28 22:59:51,535",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 34,
            "id": 7741
          },
          {
            "timestamp": "2026-05-28 22:59:51,675",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0af22000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7742
          },
          {
            "timestamp": "2026-05-28 22:59:51,675",
            "thread_id": "7504",
            "caller": "0x77b00349",
            "parentcaller": "0x77b037d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0af5f000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7743
          },
          {
            "timestamp": "2026-05-28 22:59:51,691",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7744
          },
          {
            "timestamp": "2026-05-28 22:59:51,769",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0af65000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7745
          },
          {
            "timestamp": "2026-05-28 22:59:51,785",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7746
          },
          {
            "timestamp": "2026-05-28 22:59:51,863",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0af86000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7747
          },
          {
            "timestamp": "2026-05-28 22:59:51,878",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7748
          },
          {
            "timestamp": "2026-05-28 22:59:51,956",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0af8f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7749
          },
          {
            "timestamp": "2026-05-28 22:59:51,972",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7750
          },
          {
            "timestamp": "2026-05-28 22:59:52,050",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0afa0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7751
          },
          {
            "timestamp": "2026-05-28 22:59:52,066",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 62,
            "id": 7752
          },
          {
            "timestamp": "2026-05-28 22:59:52,316",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0afb1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7753
          },
          {
            "timestamp": "2026-05-28 22:59:52,316",
            "thread_id": "7504",
            "caller": "0x77b00349",
            "parentcaller": "0x77b037d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aff1000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7754
          },
          {
            "timestamp": "2026-05-28 22:59:52,347",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7755
          },
          {
            "timestamp": "2026-05-28 22:59:52,347",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7756
          },
          {
            "timestamp": "2026-05-28 22:59:52,347",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7757
          },
          {
            "timestamp": "2026-05-28 22:59:52,347",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 7758
          },
          {
            "timestamp": "2026-05-28 22:59:52,347",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ebb03c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00020180"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 7759
          },
          {
            "timestamp": "2026-05-28 22:59:52,378",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 55,
            "id": 7760
          },
          {
            "timestamp": "2026-05-28 22:59:52,597",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aff4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7761
          },
          {
            "timestamp": "2026-05-28 22:59:52,628",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 62,
            "id": 7762
          },
          {
            "timestamp": "2026-05-28 22:59:52,894",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aff9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7763
          },
          {
            "timestamp": "2026-05-28 22:59:52,910",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7764
          },
          {
            "timestamp": "2026-05-28 22:59:52,925",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b00a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7765
          },
          {
            "timestamp": "2026-05-28 22:59:52,941",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 20,
            "id": 7766
          },
          {
            "timestamp": "2026-05-28 22:59:53,019",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b02b000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7767
          },
          {
            "timestamp": "2026-05-28 22:59:53,019",
            "thread_id": "7504",
            "caller": "0x77b00349",
            "parentcaller": "0x77b037d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b02f000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7768
          },
          {
            "timestamp": "2026-05-28 22:59:53,035",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 76,
            "id": 7769
          },
          {
            "timestamp": "2026-05-28 22:59:53,347",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7770
          },
          {
            "timestamp": "2026-05-28 22:59:53,347",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7771
          },
          {
            "timestamp": "2026-05-28 22:59:53,347",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 7772
          },
          {
            "timestamp": "2026-05-28 22:59:53,347",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ebb03c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00020180"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 7773
          },
          {
            "timestamp": "2026-05-28 22:59:53,378",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 132,
            "id": 7774
          },
          {
            "timestamp": "2026-05-28 22:59:53,941",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b036000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7775
          },
          {
            "timestamp": "2026-05-28 22:59:53,972",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 76,
            "id": 7776
          },
          {
            "timestamp": "2026-05-28 22:59:54,378",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7777
          },
          {
            "timestamp": "2026-05-28 22:59:54,378",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7778
          },
          {
            "timestamp": "2026-05-28 22:59:54,378",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 7779
          },
          {
            "timestamp": "2026-05-28 22:59:54,378",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ebb03c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00020180"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 7780
          },
          {
            "timestamp": "2026-05-28 22:59:54,472",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7781
          },
          {
            "timestamp": "2026-05-28 22:59:54,488",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b03f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7782
          },
          {
            "timestamp": "2026-05-28 22:59:54,488",
            "thread_id": "7504",
            "caller": "0x77b00349",
            "parentcaller": "0x77b037d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b07e000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7783
          },
          {
            "timestamp": "2026-05-28 22:59:54,503",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 62,
            "id": 7784
          },
          {
            "timestamp": "2026-05-28 22:59:54,769",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b082000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7785
          },
          {
            "timestamp": "2026-05-28 22:59:54,769",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b08b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7786
          },
          {
            "timestamp": "2026-05-28 22:59:54,785",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 48,
            "id": 7787
          },
          {
            "timestamp": "2026-05-28 22:59:54,988",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b0ac000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7788
          },
          {
            "timestamp": "2026-05-28 22:59:55,003",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 97,
            "id": 7789
          },
          {
            "timestamp": "2026-05-28 22:59:55,410",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7790
          },
          {
            "timestamp": "2026-05-28 22:59:55,410",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7791
          },
          {
            "timestamp": "2026-05-28 22:59:55,410",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 7792
          },
          {
            "timestamp": "2026-05-28 22:59:55,410",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ebb03c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00020180"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 7793
          },
          {
            "timestamp": "2026-05-28 22:59:55,441",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 41,
            "id": 7794
          },
          {
            "timestamp": "2026-05-28 22:59:55,597",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b0cd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7795
          },
          {
            "timestamp": "2026-05-28 22:59:55,613",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b0d6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7796
          },
          {
            "timestamp": "2026-05-28 22:59:55,628",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 167,
            "id": 7797
          },
          {
            "timestamp": "2026-05-28 22:59:56,378",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 7798
          },
          {
            "timestamp": "2026-05-28 22:59:56,378",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              }
            ],
            "repeated": 0,
            "id": 7799
          },
          {
            "timestamp": "2026-05-28 22:59:56,378",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 7800
          },
          {
            "timestamp": "2026-05-28 22:59:56,378",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 7801
          },
          {
            "timestamp": "2026-05-28 22:59:56,378",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              }
            ],
            "repeated": 0,
            "id": 7802
          },
          {
            "timestamp": "2026-05-28 22:59:56,378",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 7803
          },
          {
            "timestamp": "2026-05-28 22:59:56,378",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 7804
          },
          {
            "timestamp": "2026-05-28 22:59:56,378",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 7805
          },
          {
            "timestamp": "2026-05-28 22:59:56,378",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              }
            ],
            "repeated": 0,
            "id": 7806
          },
          {
            "timestamp": "2026-05-28 22:59:56,378",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 7807
          },
          {
            "timestamp": "2026-05-28 22:59:56,378",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "3"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 7808
          },
          {
            "timestamp": "2026-05-28 22:59:56,378",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000784"
              }
            ],
            "repeated": 0,
            "id": 7809
          },
          {
            "timestamp": "2026-05-28 22:59:56,378",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed1660",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 11,
            "id": 7810
          },
          {
            "timestamp": "2026-05-28 22:59:56,425",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7811
          },
          {
            "timestamp": "2026-05-28 22:59:56,425",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7812
          },
          {
            "timestamp": "2026-05-28 22:59:56,425",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 7813
          },
          {
            "timestamp": "2026-05-28 22:59:56,425",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ebb03c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00020180"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 7814
          },
          {
            "timestamp": "2026-05-28 22:59:56,441",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7815
          },
          {
            "timestamp": "2026-05-28 22:59:56,456",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b0df000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7816
          },
          {
            "timestamp": "2026-05-28 22:59:56,456",
            "thread_id": "7504",
            "caller": "0x77b00349",
            "parentcaller": "0x77b037d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b0e4000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7817
          },
          {
            "timestamp": "2026-05-28 22:59:56,472",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 55,
            "id": 7818
          },
          {
            "timestamp": "2026-05-28 22:59:56,691",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b0ea000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7819
          },
          {
            "timestamp": "2026-05-28 22:59:56,722",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7820
          },
          {
            "timestamp": "2026-05-28 22:59:56,722",
            "thread_id": "7504",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b0fb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7821
          },
          {
            "timestamp": "2026-05-28 22:59:56,722",
            "thread_id": "7504",
            "caller": "0x77b00349",
            "parentcaller": "0x77b037d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b13a000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7822
          },
          {
            "timestamp": "2026-05-28 22:59:56,753",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 48,
            "id": 7823
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b04f7e",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08db0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00341000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7824
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aeddce",
            "parentcaller": "0x77b02691",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0af5f000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7825
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aeddce",
            "parentcaller": "0x77b02702",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b13a000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7826
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0b0fa000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7827
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0af1f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7828
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09891000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7829
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0995a000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001e000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7830
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09704000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7831
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x097cc000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7832
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c41000"
              },
              {
                "name": "RegionSize",
                "value": "0x00018000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7833
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09644000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7834
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0969f000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7835
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d91000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7836
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x095f1000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7837
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7838
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d58000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7839
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08cc7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7840
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08ced000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7841
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06e01000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7842
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c7d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7843
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08bfe000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7844
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c18000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7845
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08bc4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7846
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08bd0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7847
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c6d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7848
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08bba000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7849
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7850
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77aef7db",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c64000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7851
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b04f7e",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0a320000"
              },
              {
                "name": "RegionSize",
                "value": "0x00bc8000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7852
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b04f7e",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x088f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00152000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7853
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x77aefaf4",
            "parentcaller": "0x77b04f7e",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09100000"
              },
              {
                "name": "RegionSize",
                "value": "0x002f4000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7854
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7855
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7856
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xb7A\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7857
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xb7A\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7858
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7859
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7860
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7861
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x13B\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7862
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x13B\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7863
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7864
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x7798c899",
            "parentcaller": "0x69d2aca9",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              }
            ],
            "repeated": 0,
            "id": 7865
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x699fcce4",
            "parentcaller": "0x699ff20b",
            "category": "network",
            "api": "WinHttpOpen",
            "status": true,
            "return": "0x08daecb8",
            "arguments": [
              {
                "name": "UserAgent",
                "value": "Windows Dlp Manager"
              },
              {
                "name": "ProxyName",
                "value": ""
              },
              {
                "name": "ProxyBypass",
                "value": ""
              },
              {
                "name": "AccessType",
                "value": "0x00000000"
              },
              {
                "name": "Flags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7866
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7867
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7868
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xe0B\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7869
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xe0B\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7870
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7871
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7504",
            "caller": "0x7798c899",
            "parentcaller": "0x69a0935c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther"
              }
            ],
            "repeated": 0,
            "id": 7872
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x095f1000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7873
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b046e3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x06e01000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7874
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c64000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7875
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7876
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08bba000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7877
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c6d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7878
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08bd0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7879
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c18000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7880
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d91000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7881
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08ced000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7882
          },
          {
            "timestamp": "2026-05-28 22:59:56,941",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08bc4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7883
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0969f000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7884
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x097cc000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7885
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08bfe000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7886
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e40c8",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 7887
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7888
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7889
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e410c",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "6888"
              }
            ],
            "repeated": 0,
            "id": 7890
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7891
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7892
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xd3C\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7893
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xd3C\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7894
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7895
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x699fd7fc",
            "parentcaller": "0x699fdea2",
            "category": "network",
            "api": "WinHttpOpen",
            "status": true,
            "return": "0x08c01838",
            "arguments": [
              {
                "name": "UserAgent",
                "value": "Windows Dlp Manager"
              },
              {
                "name": "ProxyName",
                "value": ""
              },
              {
                "name": "ProxyBypass",
                "value": ""
              },
              {
                "name": "AccessType",
                "value": "0x00000001"
              },
              {
                "name": "Flags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7896
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x699fd87f",
            "parentcaller": "0x699fdea2",
            "category": "network",
            "api": "WinHttpGetIEProxyConfigForCurrentUser",
            "status": true,
            "return": "0x00000001",
            "arguments": [],
            "repeated": 0,
            "id": 7897
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7898
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7899
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x008D\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7900
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "8D\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7901
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7902
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7903
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7904
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x99D\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7905
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x99D\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7906
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7907
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7468",
            "caller": "0x7798ac59",
            "parentcaller": "0x7279cb7a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7908
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7468",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 7909
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7468",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 0,
            "id": 7910
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x699fd9a7",
            "parentcaller": "0x699fdea2",
            "category": "network",
            "api": "WinHttpGetProxyForUrl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SessionHandle",
                "value": "0x08daecb8"
              },
              {
                "name": "Url",
                "value": "https://download.microsoft.com/download/C/0/3/C036B882-9F99-4BC9-A4B5-69370C4E17E9/EULA_MCTool_EN-US_6.27.16.rtf"
              }
            ],
            "repeated": 0,
            "id": 7911
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7912
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7913
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00A\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7914
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "A\\x0b\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7915
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa2389",
            "parentcaller": "0x00fa54aa",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
              },
              {
                "name": "Buffer",
                "value": "<z:row Cls=\"D\" Sev=\"50331648\" Maj=\"Def\" Min=\"Def\" LN=\"663\" Fil=\"\" Fun=\"CSetupDiagnostics::LogString\" Uid=\"51019776\" Msg=\"ConnectToSourceUrl: Unable to retrieve proxy info for URL -&gt; [0x2f94].\" PID=\"5932\" TID=\"7504\" Con=\"\" Exe=\"C:\\$Windows.~WS\\Sources\\Se"
              },
              {
                "name": "Length",
                "value": "334"
              }
            ],
            "repeated": 0,
            "id": 7916
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xf6D\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7917
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e414a",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7918
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xf6D\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7919
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7920
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7456",
            "caller": "0x7797498d",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7921
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x699fdabb",
            "parentcaller": "0x699fdea2",
            "category": "network",
            "api": "WinHttpConnect",
            "status": true,
            "return": "0x03163260",
            "arguments": [
              {
                "name": "SessionHandle",
                "value": "0x08c01838"
              },
              {
                "name": "ServerName",
                "value": "download.microsoft.com"
              },
              {
                "name": "ServerPort",
                "value": "443"
              }
            ],
            "repeated": 0,
            "id": 7922
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x699fdb05",
            "parentcaller": "0x699fdea2",
            "category": "network",
            "api": "WinHttpOpenRequest",
            "status": true,
            "return": "0x031664d0",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x03163260"
              },
              {
                "name": "Verb",
                "value": "HEAD"
              },
              {
                "name": "ObjectName",
                "value": "/download/C/0/3/C036B882-9F99-4BC9-A4B5-69370C4E17E9/EULA_MCTool_EN-US_6.27.16.rtf"
              },
              {
                "name": "Version",
                "value": ""
              },
              {
                "name": "Referrer",
                "value": ""
              },
              {
                "name": "Flags",
                "value": "0x00800000"
              }
            ],
            "repeated": 0,
            "id": 7923
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7504",
            "caller": "0x699fdc9b",
            "parentcaller": "0x699fdea2",
            "category": "network",
            "api": "WinHttpSetTimeouts",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x031664d0"
              },
              {
                "name": "ResolveTimeout",
                "value": "120000"
              },
              {
                "name": "ConnectTimeout",
                "value": "120000"
              },
              {
                "name": "SendTimeout",
                "value": "120000"
              },
              {
                "name": "ReceiveTimeout",
                "value": "120000"
              }
            ],
            "repeated": 0,
            "id": 7924
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7925
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7926
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e4186",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "6888"
              }
            ],
            "repeated": 0,
            "id": 7927
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e5097",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000790"
              }
            ],
            "repeated": 0,
            "id": 7928
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x7279af1f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000078c"
              }
            ],
            "repeated": 0,
            "id": 7929
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727a2629",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000788"
              }
            ],
            "repeated": 0,
            "id": 7930
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e50ec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 7931
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "7468",
            "caller": "0x77af2586",
            "parentcaller": "0x77af6986",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000798"
              }
            ],
            "repeated": 0,
            "id": 7932
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "6328",
            "caller": "0x7798ac59",
            "parentcaller": "0x7279cb7a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000798"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7933
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "6328",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000788"
              }
            ],
            "repeated": 0,
            "id": 7934
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "6328",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000078c"
              }
            ],
            "repeated": 0,
            "id": 7935
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e5097",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 7936
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727a2629",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a8"
              }
            ],
            "repeated": 0,
            "id": 7937
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e50ec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000798"
              }
            ],
            "repeated": 0,
            "id": 7938
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "6328",
            "caller": "0x77af2586",
            "parentcaller": "0x77af6986",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 7939
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "6328",
            "caller": "0x69bb46bc",
            "parentcaller": "0x69bb463b",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7940
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "6328",
            "caller": "0x6d196967",
            "parentcaller": "0x6d194f89",
            "category": "network",
            "api": "SslEncryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "HEAD /download/C/0/3/C036B882-9F99-4BC9-A4B5-69370C4E17E9/EULA_MCTool_EN-US_6.27.16.rtf HTTP/1.1\r\nConnection: Keep-Alive\r\nUser-Agent: Windows Dlp Manager\r\nHost: download.microsoft.com\r\n\r\n"
              },
              {
                "name": "SequenceNumber",
                "value": "3"
              },
              {
                "name": "BufferSize",
                "value": "187"
              }
            ],
            "repeated": 0,
            "id": 7941
          },
          {
            "timestamp": "2026-05-28 22:59:56,956",
            "thread_id": "6328",
            "caller": "0x69bab419",
            "parentcaller": "0x69baae23",
            "category": "network",
            "api": "WSASend",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Socket",
                "value": "1724"
              },
              {
                "name": "Buffer",
                "value": "\\x17\\x03\\x03\\x00\\xd3\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\xd2@)B?;\\xf9\\x16\\xa8\\xe1\\x8cD\\xfaS\\x10\\xc8\\xe1\\xcfb\\xd8\\xa8\\x06-z;s`\\x99\\xa3\\xf1\\xdbc\\xdc\\xa2K\\x0c.v\\xf3z8\\x82\\xba\\x88ME\\xaa\\xe9\t!\\xb1\\xfah\\x0e\\x96k\\xc7:q6!\\xda\\xd3\\x9e\\x80\\xb4\\xad\\x8fb<g\\x1fp\\xd5\\xba\\xacj\\xd7:\\x8e\\xee\\xe8\\x7f\\xf4\r\\x9e\\xb3\\xc63\\xf0\\xe8\\xe9\\xcc\\x83\\x1f\\x8d\\xb1.\\xc5\r\\x91%X\\xbav*\\xe3k\\xa5D\\xe9U\\xe3\\xba\\xa3x\"H\\xe4[uR#\\xda\\xe4\\xb4\\x9d\\xd5\\xc4\\xc3\\xdc\\xec\\xce7\\xe2\\xa6\\x10|\\xe5\\x04\\x11*?\\xf6\\xea\\xbd>\\xdb0$\\xd9\\xa3\\x1c!4\\xc0\\x1d\\xbc\\xc4\\x87y\\x14g\\x14\\x93IQu\\x10\\xcd\\xf8B\\x0f\\xe1i\\x16\\xdb\\xf1\\xb98\\x1e\\xbb\\x00\\xe05\\x91\\xf2\\xaf\\xdeX\\xe2\\xf3\\xc0\\xa7\\xbe\\x0f\\x9ca\\xd4Bq\\xd4Q"
              }
            ],
            "repeated": 0,
            "id": 7942
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ece3d5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 6,
            "id": 7943
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7468",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "HTTP/1.1 200 OK\r\nContent-Length: 204389\r\nContent-Type: application/octet-stream\r\nServer: Kestrel\r\nAccept-Ranges: bytes\r\nETag: \"0x4DDA95C546645F2B8EC20AF3698B217910E4FEC21EC1745B5299F496641250E9\"\r\nLast-Modified: Mon, 27 Jan 2025 16:03:46 GMT\r\nX-Ms-ApiVersio"
              },
              {
                "name": "SequenceNumber",
                "value": "6"
              },
              {
                "name": "BufferSize",
                "value": "561"
              }
            ],
            "repeated": 0,
            "id": 7944
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7468",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 7945
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x699fdcd2",
            "parentcaller": "0x699fdea2",
            "category": "network",
            "api": "WinHttpSendRequest",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x031664d0"
              },
              {
                "name": "Headers",
                "value": ""
              },
              {
                "name": "Optional",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 7946
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x699fdd06",
            "parentcaller": "0x699fdea2",
            "category": "network",
            "api": "WinHttpReceiveResponse",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x031664d0"
              }
            ],
            "repeated": 1,
            "id": 7947
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7948
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7949
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00pE\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7950
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "pE\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7951
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7952
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x699fdf02",
            "parentcaller": "0x699fe4eb",
            "category": "network",
            "api": "WinHttpQueryHeaders",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x031664d0"
              }
            ],
            "repeated": 0,
            "id": 7953
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7954
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7955
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xdfE\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7956
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xdfE\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7957
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7958
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7959
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7960
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00?F\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7961
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "?F\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7962
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7963
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x699fdabb",
            "parentcaller": "0x699fe7e6",
            "category": "network",
            "api": "WinHttpConnect",
            "status": true,
            "return": "0x03163260",
            "arguments": [
              {
                "name": "SessionHandle",
                "value": "0x08c01838"
              },
              {
                "name": "ServerName",
                "value": "download.microsoft.com"
              },
              {
                "name": "ServerPort",
                "value": "443"
              }
            ],
            "repeated": 0,
            "id": 7964
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x699fdb05",
            "parentcaller": "0x699fe7e6",
            "category": "network",
            "api": "WinHttpOpenRequest",
            "status": true,
            "return": "0x08bb31f8",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x03163260"
              },
              {
                "name": "Verb",
                "value": "GET"
              },
              {
                "name": "ObjectName",
                "value": "/download/C/0/3/C036B882-9F99-4BC9-A4B5-69370C4E17E9/EULA_MCTool_EN-US_6.27.16.rtf"
              },
              {
                "name": "Version",
                "value": ""
              },
              {
                "name": "Referrer",
                "value": ""
              },
              {
                "name": "Flags",
                "value": "0x00800000"
              }
            ],
            "repeated": 0,
            "id": 7965
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7966
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7967
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa4F\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7968
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xa4F\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7969
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 7970
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7504",
            "caller": "0x699fdc9b",
            "parentcaller": "0x699fe7e6",
            "category": "network",
            "api": "WinHttpSetTimeouts",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x08bb31f8"
              },
              {
                "name": "ResolveTimeout",
                "value": "120000"
              },
              {
                "name": "ConnectTimeout",
                "value": "120000"
              },
              {
                "name": "SendTimeout",
                "value": "120000"
              },
              {
                "name": "ReceiveTimeout",
                "value": "120000"
              }
            ],
            "repeated": 0,
            "id": 7971
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08cc7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7972
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7456",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08d58000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7973
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e40c8",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 7974
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7975
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7976
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e410c",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "6888"
              }
            ],
            "repeated": 0,
            "id": 7977
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "6328",
            "caller": "0x7798ac59",
            "parentcaller": "0x7279cb7a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7978
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "6328",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000078c"
              }
            ],
            "repeated": 0,
            "id": 7979
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "6328",
            "caller": "0x77af2586",
            "parentcaller": "0x77af1f90",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000788"
              }
            ],
            "repeated": 0,
            "id": 7980
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e5097",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000798"
              }
            ],
            "repeated": 0,
            "id": 7981
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727a2629",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 7982
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727e50ec",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a8"
              }
            ],
            "repeated": 0,
            "id": 7983
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "6328",
            "caller": "0x77af2586",
            "parentcaller": "0x77af6986",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 7984
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "6328",
            "caller": "0x69bb46bc",
            "parentcaller": "0x69bb463b",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7985
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "6328",
            "caller": "0x6d196967",
            "parentcaller": "0x6d194f89",
            "category": "network",
            "api": "SslEncryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "GET /download/C/0/3/C036B882-9F99-4BC9-A4B5-69370C4E17E9/EULA_MCTool_EN-US_6.27.16.rtf HTTP/1.1\r\nConnection: Keep-Alive\r\nRange: bytes=0-204388\r\nUser-Agent: Windows Dlp Manager\r\nHost: download.microsoft.com\r\n\r\n"
              },
              {
                "name": "SequenceNumber",
                "value": "4"
              },
              {
                "name": "BufferSize",
                "value": "209"
              }
            ],
            "repeated": 0,
            "id": 7986
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "6328",
            "caller": "0x69bab419",
            "parentcaller": "0x69baae23",
            "category": "network",
            "api": "WSASend",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Socket",
                "value": "1724"
              },
              {
                "name": "Buffer",
                "value": "\\x17\\x03\\x03\\x00\\xe9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\xbc&FQ\\xb3<\\x96z\\xf0\\x96P;\\x8bC\\xad-\\x99E\\xed\\xd1\\xe6\\xf4\\xe4\\x00\\xdb\\xbd\\xf1/\\xf1\\xca\\xbcp\\xbf\\x8a\\xdb\\xb2\\x19\\x14r\\xa7{\\xbd\\xe5BWAxUHk\\x02\\xdf3j\\x91\\xdfb\\x08\\xc1$k\\xacd\\x16y\\xab\\xc2*\\x86W\\x85\\xfe\\xbaZl|\\xd7I\\xcd\\x9e\\xda^\\x0cV\\xb1,#\\xec\\xf5M\\x8eZI\\x07\\x98\r\\x95~\\x17\\x87\\xfaKb\\xd2H]o\\xac\\x8f\\xefu\\xd5\\xfd\\xa9\\x89?W\\xf0\\xf8\\xdbhm#\\xbdg\\x088>Z\\xad\\xd3d\\xdda\\x9e\\x1b\\x82F\\xc4\\x1e\\x0b+\\xfd\\x1f\\xea\\xa2\\x07U\\xa5jX\\x12\\x0c\\x8cK_;\\xe0\\xc7\"\\x81I\\x059\\x80\\\\xb7{G\\x9b\\x88\\xfe\\x87\\xa7\\xaf\n\\x828\\xe1\\xb1j\\xd2\\xd9o\\xaf\\xcb\\x9c\\xa1i\\x93\\xc6\\xe7Bm\\xea\\xa6\\xa5\\x19\\x94z{b\\xde\\x10R\\x9c\\xe2\\x8e\\x19_9\\xa4Ep\\x0f\\xf9\\xdf\\x99\\xf5-\\x9by\\xa1\\xb9\\xf4"
              }
            ],
            "repeated": 0,
            "id": 7987
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e414a",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 7988
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7989
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7990
          },
          {
            "timestamp": "2026-05-28 22:59:56,972",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e4186",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "6888"
              }
            ],
            "repeated": 0,
            "id": 7991
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7468",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 7992
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7468",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "HTTP/1.1 206 Partial Content\r\nContent-Type: application/octet-stream\r\nServer: Kestrel\r\nAccept-Ranges: bytes\r\nETag: \"0x4DDA95C546645F2B8EC20AF3698B217910E4FEC21EC1745B5299F496641250E9\"\r\nLast-Modified: Mon, 27 Jan 2025 16:03:46 GMT\r\nX-Ms-ApiVersion: Distribu"
              },
              {
                "name": "SequenceNumber",
                "value": "7"
              },
              {
                "name": "BufferSize",
                "value": "16384"
              }
            ],
            "repeated": 0,
            "id": 7993
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x699fdcd2",
            "parentcaller": "0x699fe7e6",
            "category": "network",
            "api": "WinHttpSendRequest",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x08bb31f8"
              },
              {
                "name": "Headers",
                "value": ""
              },
              {
                "name": "Optional",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 7994
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x699fdd06",
            "parentcaller": "0x699fe7e6",
            "category": "network",
            "api": "WinHttpReceiveResponse",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "InternetHandle",
                "value": "0x08bb31f8"
              }
            ],
            "repeated": 1,
            "id": 7995
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7996
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 7997
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x11G\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7998
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x11G\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7999
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 8000
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x77988f9b",
            "parentcaller": "0x77988a9e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40100080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8001
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x779ac253",
            "parentcaller": "0x699fe892",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "e\\x1e\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 8002
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x779749b2",
            "parentcaller": "0x699fe8c7",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "e\\x1e\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8003
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x779749d7",
            "parentcaller": "0x699fe8c7",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "e\\x1e\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8004
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8005
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 1,
            "id": 8006
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8007
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "{\\rtf1\\adeflang1025\\ansi\\ansicpg1252\\uc1\\adeff40\\deff0\\stshfdbch11\\stshfloch0\\stshfhich0\\stshfbi0\\deflang1033\\deflangfe1033\\themelang1033\\themelangfe2052\\themelangcs1025{\\fonttbl{\\f0\\fbidi \\froman\\fcharset0\\fprq2{\\*\\panose 02020603050405020304}Times New Ro"
              },
              {
                "name": "Length",
                "value": "2895"
              }
            ],
            "repeated": 0,
            "id": 8008
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8009
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 0,
            "id": 8010
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 1,
            "id": 8011
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 0,
            "id": 8012
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "ma Tur;}{\\f449\\fbidi \\fswiss\\fcharset177\\fprq2 Tahoma (Hebrew);}\r\n{\\f450\\fbidi \\fswiss\\fcharset178\\fprq2 Tahoma (Arabic);}{\\f451\\fbidi \\fswiss\\fcharset186\\fprq2 Tahoma Baltic;}{\\f452\\fbidi \\fswiss\\fcharset163\\fprq2 Tahoma (Vietnamese);}{\\f453\\fbidi \\fswiss"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8013
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 8014
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 8015
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8016
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8017
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 1,
            "id": 8018
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8019
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "0\\itap0 \\rtlch\\fcs1 \\af0\\afs22\\alang1025 \\ltrch\\fcs0 \\fs22\\lang1033\\langfe1033\\loch\\f0\\hich\\af0\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\snext11 \\ssemihidden \\sunhideused Normal Table;}{\\*\r\n\\cs15 \\additive \\rtlch\\fcs1 \\ab\\af40\\afs19 \\ltrch\\fcs0 \\f40\\fs19 \\"
              },
              {
                "name": "Length",
                "value": "4685"
              }
            ],
            "repeated": 0,
            "id": 8020
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8021
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 0,
            "id": 8022
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8023
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "6328",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "af40\\afs19\\alang1025 \\ltrch\\fcs0 \r\n\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext36 Bullet 4;}{\\s37\\ql \\fi-357\\li1792\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx1795\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls"
              },
              {
                "name": "SequenceNumber",
                "value": "8"
              },
              {
                "name": "BufferSize",
                "value": "16384"
              }
            ],
            "repeated": 0,
            "id": 8024
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8025
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 0,
            "id": 8026
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "af40\\afs19\\alang1025 \\ltrch\\fcs0 \r\n\\b\\fs19\\lang1033\\langfe1033\\loch\\f40\\hich\\af40\\dbch\\af11\\cgrid\\langnp1033\\langfenp1033 \\sbasedon0 \\snext36 Bullet 4;}{\\s37\\ql \\fi-357\\li1792\\ri0\\sb120\\sa120\\widctlpar\\jclisttab\\tx1795\\wrapdefault\\aspalpha\\aspnum\\faauto\\ls"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8027
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 8028
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8029
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8030
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 1,
            "id": 8031
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8032
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": " \\additive \\rtlch\\fcs1 \\af40\\afs20 \\ltrch\\fcs0 \\f40\\fs20 \r\n\\sbasedon10 \\slink68 \\slocked \\ssemihidden Comment Text Char;}{\\*\\cs70 \\additive \\rtlch\\fcs1 \\af0\\afs16 \\ltrch\\fcs0 \\fs16 \\sbasedon10 \\ssemihidden annotation reference;}{\\s71\\ql \\li0\\ri0\\sa160\\sl-2"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8033
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8034
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 0,
            "id": 8035
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8036
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7468",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": " \\sqformat \\spriority34 List Paragraph;}{\r\n\\s114\\ql \\li0\\ri0\\sb100\\sa100\\sbauto1\\saauto1\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af0\\afs24\\alang1025 \\ltrch\\fcs0 \\b\\fs24\\lang1033\\langfe1033\\loch\\f0\\hich\\af0\\dbch"
              },
              {
                "name": "SequenceNumber",
                "value": "9"
              },
              {
                "name": "BufferSize",
                "value": "3257"
              }
            ],
            "repeated": 0,
            "id": 8037
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7468",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 8038
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8039
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 0,
            "id": 8040
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": " \\sqformat \\spriority34 List Paragraph;}{\r\n\\s114\\ql \\li0\\ri0\\sb100\\sa100\\sbauto1\\saauto1\\widctlpar\\wrapdefault\\aspalpha\\aspnum\\faauto\\adjustright\\rin0\\lin0\\itap0 \\rtlch\\fcs1 \\af0\\afs24\\alang1025 \\ltrch\\fcs0 \\b\\fs24\\lang1033\\langfe1033\\loch\\f0\\hich\\af0\\dbch"
              },
              {
                "name": "Length",
                "value": "3257"
              }
            ],
            "repeated": 0,
            "id": 8041
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8042
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8043
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8044
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "6328",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 8045
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "6328",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "ive\\levelspace0\\levelindent0\r\n{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li4320\\lin4320 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\leve"
              },
              {
                "name": "SequenceNumber",
                "value": "10"
              },
              {
                "name": "BufferSize",
                "value": "16384"
              }
            ],
            "repeated": 0,
            "id": 8046
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8047
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8048
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "ive\\levelspace0\\levelindent0\r\n{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li4320\\lin4320 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\leve"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8049
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 8050
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8051
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 0,
            "id": 8052
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 1,
            "id": 8053
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 0,
            "id": 8054
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "lnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \r\n\\fi-360\\li2160\\lin2160 }{\\listlevel\\levelnfc23\\levelnfcn23\\l"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8055
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8056
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8057
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8058
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7468",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "0 \\fi-360\\li5760\\jclisttab\\tx5760\\lin5760 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\r\n\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480"
              },
              {
                "name": "SequenceNumber",
                "value": "11"
              },
              {
                "name": "BufferSize",
                "value": "16384"
              }
            ],
            "repeated": 0,
            "id": 8059
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8060
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8061
          },
          {
            "timestamp": "2026-05-28 22:59:56,988",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "0 \\fi-360\\li5760\\jclisttab\\tx5760\\lin5760 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\r\n\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8062
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 8063
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "in1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\r\n\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\lin2160 }{\\listlevel\\levelnfc23\\le"
              },
              {
                "name": "SequenceNumber",
                "value": "12"
              },
              {
                "name": "BufferSize",
                "value": "7952"
              }
            ],
            "repeated": 0,
            "id": 8064
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8065
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8066
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8067
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "res0 \\s4\\fi-358\\li1435\\jclisttab\\tx1437\\lin1435 }{\\listlevel\\levelnfc1\\levelnfcn1\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\r\n\\levelspace0\\levelindent0{\\leveltext\\'02\\'04.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\ab0\\ai0\\af41\\afs20 \\ltrch\\fcs0 \\b0\\i0\\strike0\\f"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8068
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "s0 \\fi-360\\li5760\\lin5760 }\r\n{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\li"
              },
              {
                "name": "SequenceNumber",
                "value": "13"
              },
              {
                "name": "BufferSize",
                "value": "16384"
              }
            ],
            "repeated": 0,
            "id": 8069
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8070
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8071
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 1,
            "id": 8072
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8073
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "in1440 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\levelspace0\r\n\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li2160\\lin2160 }{\\listlevel\\levelnfc23\\le"
              },
              {
                "name": "Length",
                "value": "7952"
              }
            ],
            "repeated": 0,
            "id": 8074
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8075
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8076
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 1,
            "id": 8077
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8078
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "s0 \\fi-360\\li5760\\lin5760 }\r\n{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698693\\'01\\u-3929 ?;}{\\levelnumbers;}\\f10\\fbias0\\hres0\\chhres0 \\fi-360\\li6480\\li"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8079
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 8080
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "2160\\lin2160 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\r\n\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698703\\'02\\'03.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li2880\\jclisttab\\tx"
              },
              {
                "name": "SequenceNumber",
                "value": "14"
              },
              {
                "name": "BufferSize",
                "value": "16384"
              }
            ],
            "repeated": 0,
            "id": 8081
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8082
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8083
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 1,
            "id": 8084
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8085
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "ve\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698691\\'01o;}{\\levelnumbers\r\n;}\\f2\\fbias0\\hres0\\chhres0 \\fi-360\\li3600\\lin3600 }{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\\lvltentative\\levelspace0\\levelindent0{\\"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8086
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8087
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8088
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 1,
            "id": 8089
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8090
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "2160\\lin2160 }{\\listlevel\\levelnfc0\\levelnfcn0\\leveljc0\\leveljcn0\r\n\\levelfollow0\\levelstartat1\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid67698703\\'02\\'03.;}{\\levelnumbers\\'01;}\\rtlch\\fcs1 \\af0 \\ltrch\\fcs0 \\hres0\\chhres0 \\fi-360\\li2880\\jclisttab\\tx"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8091
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "istid760681750\\listoverridecount0\\ls29}\r\n{\\listoverride\\listid2091727482\\listoverridecount0\\ls30}{\\listoverride\\listid1182742101\\listoverridecount0\\ls31}{\\listoverride\\listid14618468\\listoverridecount0\\ls32}{\\listoverride\\listid14618468\\listoverridecount0\\"
              },
              {
                "name": "SequenceNumber",
                "value": "15"
              },
              {
                "name": "BufferSize",
                "value": "7952"
              }
            ],
            "repeated": 0,
            "id": 8092
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8093
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8094
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 1,
            "id": 8095
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8096
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "rid{\\listlevel\\levelnfc23\\levelnfcn23\\leveljc0\\leveljcn0\\levelfollow0\\levelstartat1\r\n\\levelspace0\\levelindent0{\\leveltext\\leveltemplateid1637229796\\'01\\u-3913 ?;}{\\levelnumbers;}\\f3\\fbias0\\hres0\\chhres0 \\s33\\fi-357\\li357\\jclisttab\\tx360\\lin357 }{\\listlevel"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8097
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 8098
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "{\\sp{\\sn fFilled}{\\sv 1}}{\\sp{\\sn fLine}{\\sv 0}}{\\sp{\\sn alignHR}{\\sv 1}}{\\sp{\\sn dxHeightHR}{\\sv 30}}{\\sp{\\sn fStandardHR}{\\sv 1}}{\\sp{\\sn fHorizRule}{\\sv 1}}{\\sp{\\sn fLayoutInCell}{\\sv 1}}}\r\n\\picscalex1\\picscaley1\\piccropl0\\piccropr0\\piccropt0\\piccropb0\\"
              },
              {
                "name": "SequenceNumber",
                "value": "16"
              },
              {
                "name": "BufferSize",
                "value": "12216"
              }
            ],
            "repeated": 0,
            "id": 8099
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8100
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8101
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 1,
            "id": 8102
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8103
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "istid760681750\\listoverridecount0\\ls29}\r\n{\\listoverride\\listid2091727482\\listoverridecount0\\ls30}{\\listoverride\\listid1182742101\\listoverridecount0\\ls31}{\\listoverride\\listid14618468\\listoverridecount0\\ls32}{\\listoverride\\listid14618468\\listoverridecount0\\"
              },
              {
                "name": "Length",
                "value": "7952"
              }
            ],
            "repeated": 0,
            "id": 8104
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8105
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8106
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 1,
            "id": 8107
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8108
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "{\\sp{\\sn fFilled}{\\sv 1}}{\\sp{\\sn fLine}{\\sv 0}}{\\sp{\\sn alignHR}{\\sv 1}}{\\sp{\\sn dxHeightHR}{\\sv 30}}{\\sp{\\sn fStandardHR}{\\sv 1}}{\\sp{\\sn fHorizRule}{\\sv 1}}{\\sp{\\sn fLayoutInCell}{\\sv 1}}}\r\n\\picscalex1\\picscaley1\\piccropl0\\piccropr0\\piccropt0\\piccropb0\\"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8109
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "f11\\loch\\f40  The software may include third party applications that Microsoft, not the third party, licenses to you under this agr\\hich\\af40\\dbch\\af11\\loch\\f40 eement. }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \r\n\\insrsid7406168 \\hich\\af40\\dbch\\af11\\loch\\f40 Any inc"
              },
              {
                "name": "SequenceNumber",
                "value": "17"
              },
              {
                "name": "BufferSize",
                "value": "16384"
              }
            ],
            "repeated": 0,
            "id": 8110
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8111
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8112
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 1,
            "id": 8113
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8114
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "9\\langfe1033\\langnp9\\insrsid14971392\\charrsid2110843 \\hich\\af40\\dbch\\af11\\loch\\f40 RIGHTS BELOW.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4067708\\charrsid4067708 \r\n\\hich\\af40\\dbch\\af11\\loch\\f40  }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid4067708 \\hich\\af40\\dbch"
              },
              {
                "name": "Length",
                "value": "4024"
              }
            ],
            "repeated": 0,
            "id": 8115
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8116
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8117
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 1,
            "id": 8118
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8119
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "f11\\loch\\f40  The software may include third party applications that Microsoft, not the third party, licenses to you under this agr\\hich\\af40\\dbch\\af11\\loch\\f40 eement. }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \r\n\\insrsid7406168 \\hich\\af40\\dbch\\af11\\loch\\f40 Any inc"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8120
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 8121
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "tlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935\\charrsid14122191 \r\n\\hich\\af40\\dbch\\af11\\loch\\f40 BINDING ARBITRATION AND CLASS ACTION WAIVER}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935 .}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\in"
              },
              {
                "name": "SequenceNumber",
                "value": "18"
              },
              {
                "name": "BufferSize",
                "value": "16384"
              }
            ],
            "repeated": 0,
            "id": 8122
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8123
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8124
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 1,
            "id": 8125
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8126
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "eer, decompile or disassemble the software;}{\\rtlch\\fcs1 \\ab\\af40 \\ltrch\\fcs0 \\b0\\insrsid15818407\\charrsid12455646 \r\n\\par {\\listtext\\pard\\plain\\ltrpar \\s34 \\rtlch\\fcs1 \\ab\\af40\\afs19 \\ltrch\\fcs0 \\b\\f40\\fs19\\insrsid16591162\\charrsid12455646 \\hich\\af40\\dbch\\"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8127
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8128
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8129
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 1,
            "id": 8130
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8131
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "tlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935\\charrsid14122191 \r\n\\hich\\af40\\dbch\\af11\\loch\\f40 BINDING ARBITRATION AND CLASS ACTION WAIVER}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\insrsid4879935 .}{\\rtlch\\fcs1 \\ab0\\af40 \\ltrch\\fcs0 \\cs118\\b\\in"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8132
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "ctual guarantee in relation \r\n\\hich\\af40\\dbch\\af11\\loch\\f40 to the licensed software.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 \r\n\\par \\hich\\af40\\dbch\\af11\\loch\\f40 (ii)\\tab Limitation of Liability.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b0\\i"
              },
              {
                "name": "SequenceNumber",
                "value": "19"
              },
              {
                "name": "BufferSize",
                "value": "7952"
              }
            ],
            "repeated": 0,
            "id": 8133
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8134
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8135
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 1,
            "id": 8136
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8137
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "h\\af40\\dbch\\af11\\loch\\f40 , except that the }{\r\n\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid8743060 \\hich\\af40\\dbch\\af11\\loch\\f40 FAA }{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid11996719\\charrsid9003929 \\hich\\af40\\dbch\\af11\\loch\\f40 governs everything related to arb"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8138
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 8139
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "d6596cbcdd8eb28e7c365ecc4ec1ff1460f53fe813d3cc7f5b7f020000ffff0300504b030414000600080000002100a5d6\r\na7e7c0000000360100000b0000005f72656c732f2e72656c73848fcf6ac3300c87ef85bd83d17d51d2c31825762fa590432fa37d00e1287f68221bdb1bebdb4f\r\nc7060abb0884a4eff7a93dfeae"
              },
              {
                "name": "SequenceNumber",
                "value": "20"
              },
              {
                "name": "BufferSize",
                "value": "16384"
              }
            ],
            "repeated": 0,
            "id": 8140
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8141
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8142
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 1,
            "id": 8143
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8144
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "ctual guarantee in relation \r\n\\hich\\af40\\dbch\\af11\\loch\\f40 to the licensed software.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\insrsid7227263\\charrsid9003929 \r\n\\par \\hich\\af40\\dbch\\af11\\loch\\f40 (ii)\\tab Limitation of Liability.}{\\rtlch\\fcs1 \\af40 \\ltrch\\fcs0 \\b0\\i"
              },
              {
                "name": "Length",
                "value": "7952"
              }
            ],
            "repeated": 0,
            "id": 8145
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8146
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8147
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 1,
            "id": 8148
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8149
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "d6596cbcdd8eb28e7c365ecc4ec1ff1460f53fe813d3cc7f5b7f020000ffff0300504b030414000600080000002100a5d6\r\na7e7c0000000360100000b0000005f72656c732f2e72656c73848fcf6ac3300c87ef85bd83d17d51d2c31825762fa590432fa37d00e1287f68221bdb1bebdb4f\r\nc7060abb0884a4eff7a93dfeae"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8150
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 8151
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "0 \\lsdlocked0 Intense Quote;\\lsdpriority66 \\lsdlocked0 Medium List 2 Accent 1;\r\n\\lsdpriority67 \\lsdlocked0 Medium Grid 1 Accent 1;\\lsdpriority68 \\lsdlocked0 Medium Grid 2 Accent 1;\\lsdpriority69 \\lsdlocked0 Medium Grid 3 Accent 1;\\lsdpriority70 \\lsdlocked0"
              },
              {
                "name": "SequenceNumber",
                "value": "21"
              },
              {
                "name": "BufferSize",
                "value": "16384"
              }
            ],
            "repeated": 0,
            "id": 8152
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8153
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8154
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 1,
            "id": 8155
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8156
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "d1 \\lsdlocked0 footer;\r\n\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 index heading;\\lsdsemihidden1 \\lsdunhideused1 \\lsdqformat1 \\lsdpriority35 \\lsdlocked0 caption;\\lsdsemihidden1 \\lsdunhideused1 \\lsdlocked0 table of figures;\r\n\\lsdsemihidden1 \\lsdunhideused1"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8157
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8158
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8159
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 1,
            "id": 8160
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8161
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "0 \\lsdlocked0 Intense Quote;\\lsdpriority66 \\lsdlocked0 Medium List 2 Accent 1;\r\n\\lsdpriority67 \\lsdlocked0 Medium Grid 1 Accent 1;\\lsdpriority68 \\lsdlocked0 Medium Grid 2 Accent 1;\\lsdpriority69 \\lsdlocked0 Medium Grid 3 Accent 1;\\lsdpriority70 \\lsdlocked0"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8162
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x6d196159",
            "parentcaller": "0x6d19600a",
            "category": "network",
            "api": "SslDecryptPacket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Buffer",
                "value": "000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d227574662d3822207374616e64616c6f6e653d22796573223f3e3c53657373696f6e20786d6c6e733d22687474703a\r\n2f2f736368656d61732e627573696e6573732d696e746567726974792e636f6d2f6465616c6275696c6465722f3230"
              },
              {
                "name": "SequenceNumber",
                "value": "22"
              },
              {
                "name": "BufferSize",
                "value": "1832"
              }
            ],
            "repeated": 0,
            "id": 8163
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8164
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8165
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 1,
            "id": 8166
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8167
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "e 6 Colorful Accent 2;\\lsdpriority52 \\lsdlocked0 List Table 7 Colorful Accent 2;\\lsdpriority46 \\lsdlocked0 List Table 1 Light Accent 3;\r\n\\lsdpriority47 \\lsdlocked0 List Table 2 Accent 3;\\lsdpriority48 \\lsdlocked0 List Table 3 Accent 3;\\lsdpriority49 \\lsdlo"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8168
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x69bace77",
            "parentcaller": "0x69bac83e",
            "category": "network",
            "api": "WSARecv",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 8169
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x72796c2c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8170
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8171
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 1,
            "id": 8172
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8173
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798944c",
            "parentcaller": "0x699fea34",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d227574662d3822207374616e64616c6f6e653d22796573223f3e3c53657373696f6e20786d6c6e733d22687474703a\r\n2f2f736368656d61732e627573696e6573732d696e746567726974792e636f6d2f6465616c6275696c6465722f3230"
              },
              {
                "name": "Length",
                "value": "1832"
              }
            ],
            "repeated": 0,
            "id": 8174
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ab1a",
            "parentcaller": "0x699e496b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a8"
              }
            ],
            "repeated": 0,
            "id": 8175
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b591d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000079c"
              }
            ],
            "repeated": 0,
            "id": 8176
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "6328",
            "caller": "0x7798ab1a",
            "parentcaller": "0x727b5932",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007a0"
              }
            ],
            "repeated": 0,
            "id": 8177
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8178
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8179
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x80G\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8180
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x80G\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8181
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 8182
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798c899",
            "parentcaller": "0x69d32711",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              }
            ],
            "repeated": 0,
            "id": 8183
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8184
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8185
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xf4G\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8186
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xf4G\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8187
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 8188
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8189
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x69eb9c86",
            "parentcaller": "0x69ea02e9",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083ea"
              }
            ],
            "repeated": 0,
            "id": 8190
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8191
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8192
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "4316",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8193
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "4316",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8194
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00NH\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8195
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "NH\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8196
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 8197
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "7504",
            "caller": "0x69ecf822",
            "parentcaller": "0x69e9fe38",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00000000"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 8198
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "4316",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xc4H\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8199
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "4316",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc4H\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8200
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "4316",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 8201
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "4316",
            "caller": "0x00fa03e1",
            "parentcaller": "0x00fa0a7c",
            "category": "system",
            "api": "GetLocalTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8202
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "4316",
            "caller": "0x00fa51b9",
            "parentcaller": "0x00fa0ad6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8203
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "4316",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x001I\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8204
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "4316",
            "caller": "0x00fa2338",
            "parentcaller": "0x00fa542f",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002fc"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "1I\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8205
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "4316",
            "caller": "0x00fa229e",
            "parentcaller": "0x00fa51d3",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 8206
          },
          {
            "timestamp": "2026-05-28 22:59:57,003",
            "thread_id": "4316",
            "caller": "0x69ed118b",
            "parentcaller": "0x69ed027c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000401a8"
              },
              {
                "name": "Message",
                "value": "0x00008002"
              }
            ],
            "repeated": 0,
            "id": 8207
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x747dcadd",
            "parentcaller": "0x747dca5a",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 5,
            "id": 8208
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "7456",
            "caller": "0x779ac253",
            "parentcaller": "0x699e40c8",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 8209
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "7456",
            "caller": "0x779749b2",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "20",
                "pretty_value": "FileEndOfFileInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8210
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e40e5",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8211
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e410c",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "7042"
              }
            ],
            "repeated": 0,
            "id": 8212
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x6b3b112a",
            "parentcaller": "0x6b3b3337",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 8213
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x75d4c23a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x18\\xd8|\\x06\\xd8\\xfd\\xbc\\x08\\x00\\x00\\x00\\x00L\\xa1\\xec\\x9c\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00a\\x00:\\x00\\x00\\x00\\x00\\x00\\xb8\\x00\\xa0#\\xb8\\x00 \\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8214
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c274",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000794"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 8215
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c287",
            "parentcaller": "0x75d4c065",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8216
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000794"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
              }
            ],
            "repeated": 0,
            "id": 8217
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d4ca32",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000794"
              },
              {
                "name": "ValueName",
                "value": "ScrollInset"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInset"
              }
            ],
            "repeated": 0,
            "id": 8218
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c0a0",
            "parentcaller": "0x75d4ca32",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8219
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x75d4c23a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xcd\\xbd\\x8d\\xab\\x98\\xd7|\\x06d\\xffkk\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd1\\xbd\\x8d\\xab\\xa0\\xc0\\xd4u\\x00\\x00\\x00\\x002\\xca\\xd4u%\\x00\\x00\\x00 \\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8220
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c274",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000794"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 8221
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c287",
            "parentcaller": "0x75d4c065",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8222
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000794"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
              }
            ],
            "repeated": 0,
            "id": 8223
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d4ca32",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000794"
              },
              {
                "name": "ValueName",
                "value": "DragDelay"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragDelay"
              }
            ],
            "repeated": 0,
            "id": 8224
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c0a0",
            "parentcaller": "0x75d4ca32",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8225
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x75d4c23a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xcd\\xbd\\x8d\\xab\\x98\\xd7|\\x06d\\xffkk\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd1\\xbd\\x8d\\xab\\xa0\\xc0\\xd4u\\x00\\x00\\x00\\x002\\xca\\xd4u%\\x00\\x00\\x00 \\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8226
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c274",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000794"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 8227
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c287",
            "parentcaller": "0x75d4c065",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8228
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000794"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
              }
            ],
            "repeated": 0,
            "id": 8229
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d4ca32",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000794"
              },
              {
                "name": "ValueName",
                "value": "DragMinDist"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragMinDist"
              }
            ],
            "repeated": 0,
            "id": 8230
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c0a0",
            "parentcaller": "0x75d4ca32",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8231
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x75d4c23a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xcd\\xbd\\x8d\\xab\\x98\\xd7|\\x06d\\xffkk\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd1\\xbd\\x8d\\xab\\xa0\\xc0\\xd4u\\x00\\x00\\x00\\x002\\xca\\xd4u%\\x00\\x00\\x00 \\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8232
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c274",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000794"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 8233
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c287",
            "parentcaller": "0x75d4c065",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8234
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000794"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
              }
            ],
            "repeated": 0,
            "id": 8235
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d4ca32",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000794"
              },
              {
                "name": "ValueName",
                "value": "ScrollDelay"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollDelay"
              }
            ],
            "repeated": 0,
            "id": 8236
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c0a0",
            "parentcaller": "0x75d4ca32",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8237
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x75d4c23a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xcd\\xbd\\x8d\\x00\\x08\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00p\\x02\\x07\\x03\\xcfd\\x16\\x03\\xa0\\xc0\\xd4u\\x00\\x00\\x00\\x000\\xee|\\x060\\xaf\\xb3w\\xe5\\xecM\\xbe"
              }
            ],
            "repeated": 0,
            "id": 8238
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c274",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000794"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 8239
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c287",
            "parentcaller": "0x75d4c065",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8240
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000794"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
              }
            ],
            "repeated": 0,
            "id": 8241
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d4ca32",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000794"
              },
              {
                "name": "ValueName",
                "value": "ScrollInterval"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInterval"
              }
            ],
            "repeated": 0,
            "id": 8242
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4c0a0",
            "parentcaller": "0x75d4ca32",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8243
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4069b",
            "parentcaller": "0x75d404d5",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\Windows\\win.ini"
              }
            ],
            "repeated": 0,
            "id": 8244
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4076e",
            "parentcaller": "0x75d404d5",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000794"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\win.ini"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 8245
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d407e2",
            "parentcaller": "0x75d404d5",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000794"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\win.ini"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8246
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4082e",
            "parentcaller": "0x75d404d5",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x073f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00101000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8247
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d40850",
            "parentcaller": "0x75d404d5",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x073f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8248
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "7456",
            "caller": "0x7797498d",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8249
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d40879",
            "parentcaller": "0x75d404d5",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000794"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\win.ini"
              },
              {
                "name": "Buffer",
                "value": "; for 16-bit app support\r\n[fonts]\r\n[extensions]\r\n[mci extensions]\r\n[files]\r\n[Mail]\r\nMAPI=1\r\n"
              },
              {
                "name": "Length",
                "value": "92"
              }
            ],
            "repeated": 0,
            "id": 8250
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d40a44",
            "parentcaller": "0x75d40601",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x073f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00101000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 8251
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d40a86",
            "parentcaller": "0x75d40601",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8252
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d40c12",
            "parentcaller": "0x75d40ba2",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8253
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d40c2c",
            "parentcaller": "0x75d40ba2",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x03\\x10\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8254
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d40c37",
            "parentcaller": "0x75d40ba2",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8255
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "7456",
            "caller": "0x779749d7",
            "parentcaller": "0x699e4163",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "19",
                "pretty_value": "FileAllocationInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8256
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x6b3b4827",
            "parentcaller": "0x6b3a5fee",
            "category": "system",
            "api": "GetSystemDefaultLangID",
            "status": true,
            "return": "0x03080409",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x03080409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 8257
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "7456",
            "caller": "0x7798948c",
            "parentcaller": "0x699e4186",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xff\\xfe<\\x00W\\x00I\\x00N\\x00D\\x00L\\x00P\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x000\\x00<\\x00/\\x00S\\x00t\\x00a\\x00t\\x00e\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x001\\x00<\\x00/\\x00T\\x00a\\x00s\\x00k\\x00C\\x00o\\x00u\\x00n\\x00t\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00C\\x00:\\x00\\\\x00$\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00<\\x00/\\x00W\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00P\\x00a\\x00t\\x00h\\x00>\\x00\r\\x00\n\\x00 \\x00 \\x00<\\x00S\\x00t\\x00r\\x00i\\x00"
              },
              {
                "name": "Length",
                "value": "7042"
              }
            ],
            "repeated": 0,
            "id": 8258
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x6b3b112a",
            "parentcaller": "0x6b36a72c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 8259
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8260
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b30000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8261
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4b284",
            "parentcaller": "0x75d4b0f4",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide"
              }
            ],
            "repeated": 0,
            "id": 8262
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4b2b6",
            "parentcaller": "0x75d4b0f4",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007ac"
              },
              {
                "name": "ValueName",
                "value": "PreferExternalManifest"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest"
              }
            ],
            "repeated": 0,
            "id": 8263
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4b2d9",
            "parentcaller": "0x75d4b0f4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8264
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d5440c",
            "parentcaller": "0x75d4b1ef",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x001200a9",
                "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UxTheme.dll.Config"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 8265
          },
          {
            "timestamp": "2026-05-28 22:59:57,019",
            "thread_id": "4316",
            "caller": "0x75d4af7f",
            "parentcaller": "0x75d49db4",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\uxtheme.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 8266
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x75d4af7f",
            "parentcaller": "0x75d49db4",
            "category": "__notification__",
            "api": "sysenter",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadIdentifier",
                "value": "4316"
              },
              {
                "name": "Module",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "Return Address",
                "value": "0x75d5274c"
              }
            ],
            "repeated": 0,
            "id": 8267
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x75d4a59b",
            "parentcaller": "0x75d49db4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8268
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77b22f3f",
            "parentcaller": "0x77b22b04",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008",
                "pretty_value": "KEY_ENUMERATE_SUB_KEYS"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\AssemblyStorageRoots"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\AssemblyStorageRoots"
              }
            ],
            "repeated": 0,
            "id": 8269
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77b2329d",
            "parentcaller": "0x77b22beb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100020",
                "pretty_value": "FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_a863d714867441db"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 8270
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x75d517c0",
            "parentcaller": "0x77ae92fd",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x073f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 8271
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77ae9372",
            "parentcaller": "0x77af2765",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8272
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747d82a5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "HIMAGELIST_QueryInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x729cee70"
              }
            ],
            "repeated": 0,
            "id": 8273
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747d82a5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "DrawShadowText"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x72a38740"
              }
            ],
            "repeated": 0,
            "id": 8274
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747d82a5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "DrawSizeBox"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x729e6db0"
              }
            ],
            "repeated": 0,
            "id": 8275
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747d82a5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "DrawScrollBar"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x729e7780"
              }
            ],
            "repeated": 0,
            "id": 8276
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747d82a5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "SizeBoxHwnd"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x729ea240"
              }
            ],
            "repeated": 0,
            "id": 8277
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747d82a5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "ScrollBar_MouseMove"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x72a31020"
              }
            ],
            "repeated": 0,
            "id": 8278
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747d82a5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "ScrollBar_Menu"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x72a30e60"
              }
            ],
            "repeated": 0,
            "id": 8279
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747d82a5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "HandleScrollCmd"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x72a30dd0"
              }
            ],
            "repeated": 0,
            "id": 8280
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747d82a5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "DetachScrollBars"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x729e6f40"
              }
            ],
            "repeated": 0,
            "id": 8281
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747d82a5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "AttachScrollBars"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x729e6f20"
              }
            ],
            "repeated": 0,
            "id": 8282
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747d82a5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "CCSetScrollInfo"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x729e8190"
              }
            ],
            "repeated": 0,
            "id": 8283
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747d82a5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "CCGetScrollInfo"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x729ec220"
              }
            ],
            "repeated": 0,
            "id": 8284
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747d82a5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "CCEnableScrollBar"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x729a55f0"
              }
            ],
            "repeated": 0,
            "id": 8285
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77991b7a",
            "parentcaller": "0x747d82a5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x72970000"
              },
              {
                "name": "FunctionName",
                "value": "QuerySystemGestureStatus"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x72a30e10"
              }
            ],
            "repeated": 0,
            "id": 8286
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x747dcadd",
            "parentcaller": "0x747da66a",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 10,
            "id": 8287
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8288
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8289
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8290
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8291
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8292
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8293
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8294
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8295
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8296
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8297
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8298
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8299
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8300
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8301
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8302
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8303
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8304
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8305
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8306
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8307
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8308
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8309
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8310
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8311
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8312
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8313
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8314
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8315
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8316
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8317
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8318
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8319
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x77af003d",
            "parentcaller": "0x69ea4d77",
            "category": "system",
            "api": "NtQueryLicenseValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode"
              },
              {
                "name": "Type",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 8320
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8321
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8322
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8323
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8324
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8325
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8326
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8327
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1da1",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8328
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed2d00",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 2,
            "id": 8329
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x69ecf33b",
            "parentcaller": "0x69ecf5b0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "B5F8350B-0548-48B1-A6EE-88BD00B4A5E7"
              },
              {
                "name": "ClsContext",
                "value": "0x00000015",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "riid",
                "value": "6E26E776-04F0-495D-80E4-3330352E3169"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8330
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x75d4bc42",
            "parentcaller": "0x75d4ba23",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "MSAA_*FCFFFFFF00000000"
              },
              {
                "name": "Atom",
                "value": "0x0000c043"
              }
            ],
            "repeated": 0,
            "id": 8331
          },
          {
            "timestamp": "2026-05-28 22:59:57,035",
            "thread_id": "4316",
            "caller": "0x76e32cb5",
            "parentcaller": "0x7760a5a6",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 2,
            "id": 8332
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x69ecf822",
            "parentcaller": "0x69ed10e9",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00020132"
              },
              {
                "name": "Message",
                "value": "0x00008001"
              }
            ],
            "repeated": 0,
            "id": 8333
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed27c8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 3,
            "id": 8334
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7796e3f2",
            "parentcaller": "0x6b500d61",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\"
              }
            ],
            "repeated": 0,
            "id": 8335
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7796e455",
            "parentcaller": "0x6b500d61",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100000",
                "pretty_value": "SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 8336
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x779ad3de",
            "parentcaller": "0x7796e474",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007ac"
              },
              {
                "name": "HandleName",
                "value": "C:\\"
              },
              {
                "name": "FileInformationClass",
                "value": "9",
                "pretty_value": "FileNameInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00\\\\x00"
              }
            ],
            "repeated": 0,
            "id": 8337
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7796e4aa",
            "parentcaller": "0x6b500d61",
            "category": "filesystem",
            "api": "GetVolumeInformationByHandleW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "VolumeName",
                "value": ""
              },
              {
                "name": "VolumeSerial",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8338
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7796e4b5",
            "parentcaller": "0x6b500d61",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8339
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77988f9b",
            "parentcaller": "0x77988a9e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8340
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x779afb91",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ole32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x77240000"
              }
            ],
            "repeated": 0,
            "id": 8341
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ole32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77240000"
              },
              {
                "name": "FunctionName",
                "value": "OleInitialize"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77263b10"
              }
            ],
            "repeated": 0,
            "id": 8342
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798c134",
            "parentcaller": "0x77269929",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8343
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77989e76",
            "parentcaller": "0x7726994a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8344
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x7726996d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8345
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4bc42",
            "parentcaller": "0x75d4ba23",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "OleDropTargetInterface"
              },
              {
                "name": "Atom",
                "value": "0x0000c020"
              }
            ],
            "repeated": 0,
            "id": 8346
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4bc42",
            "parentcaller": "0x75d4ba23",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "OleDropTargetMarshalHwnd"
              },
              {
                "name": "Atom",
                "value": "0x0000c021"
              }
            ],
            "repeated": 0,
            "id": 8347
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ole32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77240000"
              },
              {
                "name": "FunctionName",
                "value": "RegisterDragDrop"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77263c50"
              }
            ],
            "repeated": 0,
            "id": 8348
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4bc42",
            "parentcaller": "0x75d4ba23",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "OleEndPointID"
              },
              {
                "name": "Atom",
                "value": "0x0000c044"
              }
            ],
            "repeated": 0,
            "id": 8349
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77302000"
              },
              {
                "name": "ModuleName",
                "value": "ole32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8350
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77302000"
              },
              {
                "name": "ModuleName",
                "value": "ole32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8351
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002e6"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Interface\\{00000160-0000-0000-C000-000000000046}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000160-0000-0000-C000-000000000046}"
              }
            ],
            "repeated": 0,
            "id": 8352
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000794"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\Interface\\{00000160-0000-0000-C000-000000000046}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{00000160-0000-0000-C000-000000000046}"
              }
            ],
            "repeated": 0,
            "id": 8353
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd0\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xda|\\x06\\x10\\xd8|\\x06\\x19\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\x96\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8354
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 8355
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7797fe88",
            "parentcaller": "0x7797fbda",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000078c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000796"
              },
              {
                "name": "ObjectAttributesName",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 8356
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b13909",
            "parentcaller": "0x7797ff24",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xd7|\\x06\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x12\\x02 \\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xda|\\x06\\xe0\\xd7|\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x04\"\\xf3\\x04\\x00\\x00\\x00\\x00\\xdc\\xfc\\x97w\\x8e\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8357
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7797fd75",
            "parentcaller": "0x7796a934",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 8358
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000078e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "{00000320-0000-0000-C000-000000000046}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 8359
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x773dfea5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000078e"
              }
            ],
            "repeated": 0,
            "id": 8360
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x773dfeb1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000796"
              }
            ],
            "repeated": 0,
            "id": 8361
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b27bb9",
            "parentcaller": "0x76c222d7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8362
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x76c212f8",
            "parentcaller": "0x76c20561",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000794"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 8363
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798c134",
            "parentcaller": "0x76c21389",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000078c"
              }
            ],
            "repeated": 0,
            "id": 8364
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b16a20",
            "parentcaller": "0x77b19456",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x03\\x10\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8365
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b190c4",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "<6\\x16\\x03\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00U\\x00x\\x00T\\x00h\\x00e\\x00m\\x00e\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8366
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b19103",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "h\\xec\\x16\\x03`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00-\\x00c\\x00o\\x00r\\x00e\\x00-\\x00w\\x00i\\x00n\\x003\\x002\\x00k\\x00-\\x00f\\x00u\\x00l\\x00l\\x00u\\x00s\\x00e\\x00r\\x00-\\x00l\\x001\\x00-\\x001\\x00-\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 8367
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b19120",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8368
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b1915f",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x84\\xa0\\x0e\\x0b\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8369
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b19178",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8370
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b191b3",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xac\\xdb\\x01\\x0b\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 8371
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b19240",
            "parentcaller": "0x77b191c3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\x8bk|_\\x8bk\\x06\\x00\\x00\\x00h_\\x8bkT\\x00\\x00\\x00\\xa8\\xdb\\x01\\x0b\\x00\\x00#\\x00\\xdc\\xdb\\xd0\\xdb\\x8c\\x07\\x00\\x00$\\xf0\\x00\\x00\\x00\\x00\\x07\\x03#\\x00\\x00\\xc0\\x8c\\x07\\x00\\x00$\\xdc|\\x06\\xb3\\x91\\xb1w\\x8c\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8372
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b1926e",
            "parentcaller": "0x77b191c3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\x93k\\x1c\\xff\\xf6\\x04$\\xf0\\xf0\\x04#\\x00\\x00\\xc0\\xec\\xa8ik\\xc5\\xb1\\x8d\\xab\\xcc\\xd6|\\x06\\x8c\\x07\\x00\\x00\\x80\\xe5|\\x06\\xa0\\xe6\\x80ka\\xcb}\\xc6\\xfe\\xff\\xff\\xff\\xdc\\xdb|\\x06\\x96\\x19mk2\\x00\\x00\\x00\\x04:\\x8bk\\x98_\\x8bk"
              }
            ],
            "repeated": 0,
            "id": 8373
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b16a20",
            "parentcaller": "0x77b17151",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\r\\x94\\x06\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x03\\x10\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8374
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b190c4",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "l8\\x16\\x03\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00~\\x00W\\x00S\\x00\\\\x00S\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00\\\\x00P\\x00a\\x00n\\x00t\\x00h\\x00e\\x00r\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8375
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b19103",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\xed\\x16\\x03`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00-\\x00c\\x00o\\x00r\\x00e\\x00-\\x00w\\x00i\\x00n\\x003\\x002\\x00k\\x00-\\x00m\\x00i\\x00n\\x00u\\x00s\\x00e\\x00r\\x00-\\x00l\\x001\\x00-\\x001\\x00-\\x000\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8376
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b19120",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8377
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b1915f",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "l\\xa4\\x0e\\x0b\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8378
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b19178",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8379
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b191b3",
            "parentcaller": "0x77b16ac5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x0c\\xdc\\x01\\x0b\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 8380
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b19240",
            "parentcaller": "0x77b191c3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfaB\\x8bk|_\\x8bk\\x06\\x00\\x00\\x00h_\\x8bkT\\x00\\x00\\x00\\x08\\xdc\\x01\\x0b\\x00\\x00#\\x00\\xc4\\xd9\\xb8\\xd9\\x8c\\x07\\x00\\x00$\\xf0\\x00\\x00\\x00\\x00\\x07\\x03#\\x00\\x00\\xc0\\x8c\\x07\\x00\\x00\\x0c\\xda|\\x06\\xb3\\x91\\xb1w\\x8c\\x07\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8381
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b1926e",
            "parentcaller": "0x77b191c3",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x8c\\xae\\x93k\\x1c\\xff\\xf6\\x04$\\xf0\\xf0\\x04#\\x00\\x00\\xc0\\xec\\xa8ik=\\xb3\\x8d\\xab\\xb4\\xd4|\\x06\\x8c\\x07\\x00\\x00\\x80\\xe5|\\x06\\xa0\\xe6\\x80ka\\xcb}\\xc6\\xfe\\xff\\xff\\xff\\xc4\\xd9|\\x06\\x96\\x19mk2\\x00\\x00\\x00\\x04:\\x8bk\\x98_\\x8bk"
              }
            ],
            "repeated": 0,
            "id": 8382
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x76c213d9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000794"
              }
            ],
            "repeated": 0,
            "id": 8383
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x76c213f2",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000078c"
              }
            ],
            "repeated": 0,
            "id": 8384
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4bc42",
            "parentcaller": "0x75d4ba23",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "OleEndPointID"
              },
              {
                "name": "Atom",
                "value": "0x0000c044"
              }
            ],
            "repeated": 0,
            "id": 8385
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8386
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000078c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Ole\\Extensions"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\Extensions"
              }
            ],
            "repeated": 0,
            "id": 8387
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000078c"
              },
              {
                "name": "ValueName",
                "value": "DragDropExtension"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\Extensions\\DragDropExtension"
              }
            ],
            "repeated": 0,
            "id": 8388
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x773f10d6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\dxgi"
              },
              {
                "name": "DllBase",
                "value": "0x70790000"
              }
            ],
            "repeated": 0,
            "id": 8389
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x773f10d6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\d3d11"
              },
              {
                "name": "DllBase",
                "value": "0x705b0000"
              }
            ],
            "repeated": 0,
            "id": 8390
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x773f10d6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\dcomp"
              },
              {
                "name": "DllBase",
                "value": "0x6e690000"
              }
            ],
            "repeated": 0,
            "id": 8391
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x773f10d6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\dataexchange"
              },
              {
                "name": "DllBase",
                "value": "0x6e800000"
              }
            ],
            "repeated": 0,
            "id": 8392
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x779afb91",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "gdi32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x76b10000"
              }
            ],
            "repeated": 0,
            "id": 8393
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798a206",
            "parentcaller": "0x773f10d6",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\dataexchange.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e800000"
              }
            ],
            "repeated": 0,
            "id": 8394
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77263ec7",
            "parentcaller": "0x77263dd0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9FC8E510-A27C-4B3B-B9A3-BF65F00256A8"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "043250DB-3B6A-4141-8F21-AA2ED2BE3355"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8395
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x77263ed5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000078c"
              }
            ],
            "repeated": 0,
            "id": 8396
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e82c000"
              },
              {
                "name": "ModuleName",
                "value": "dataexchange.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8397
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e82c000"
              },
              {
                "name": "ModuleName",
                "value": "dataexchange.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8398
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b1109f",
            "parentcaller": "0x77b0f039",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "twinapi.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 8399
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b1213c",
            "parentcaller": "0x77b12046",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\twinapi.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 8400
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b1e65c",
            "parentcaller": "0x77b1e3a8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000078c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\twinapi.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 8401
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b1e699",
            "parentcaller": "0x77b1e3a8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000007c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000078c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\twinapi.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 8402
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b1122c",
            "parentcaller": "0x77b11397",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000007c4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f920000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00191000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8403
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b1000f",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fa94000"
              },
              {
                "name": "ModuleName",
                "value": "twinapi.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8404
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b100b7",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fa90000"
              },
              {
                "name": "ModuleName",
                "value": "twinapi.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8405
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b100e5",
            "parentcaller": "0x77b10794",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fa90000"
              },
              {
                "name": "ModuleName",
                "value": "twinapi.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8406
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b21ea8",
            "parentcaller": "0x77b21e31",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8407
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b21ea8",
            "parentcaller": "0x77b21e61",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x77be9000"
              },
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8408
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77af9d5b",
            "parentcaller": "0x77b0b4a0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fa90000"
              },
              {
                "name": "ModuleName",
                "value": "twinapi.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8409
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b1e6ed",
            "parentcaller": "0x77b1e3a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007c4"
              }
            ],
            "repeated": 0,
            "id": 8410
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b1e6f5",
            "parentcaller": "0x77b1e3a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000078c"
              }
            ],
            "repeated": 0,
            "id": 8411
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b10d10",
            "parentcaller": "0x77afe4a3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fa90000"
              },
              {
                "name": "ModuleName",
                "value": "twinapi.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8412
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b10eea",
            "parentcaller": "0x77b10d32",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x80\\xb7\\x0b\\x03\\xd8\\x10\\x00\\x00\\x02\\x00\\x00\\x00p\\xb2\\x0b\\x03\\xe8\\x13\\x00\\x00\\x02\\x00\\x00\\x000\\xb9\\x0b\\x03,\\x0f\\x00\\x00\\x02\\x00\\x00\\x00\\xb8\\xc5\\x0b\\x038\\x10\\x00\\x00\\x02\\x00\\x00\\x000\\xc6\\x0b\\x03(\\x10\\x00\\x00\\x02\\x00\\x00\\x00 {\\x0c\\x03\\xdc\\x10\\x00\\x00\\x02\\x00\\x00\\x00\\xb0\\xe2\\x0c\\x03\\xb0\\x18\\x00\\x00\\x02\\x00\\x00\\x00\\xa0\\xe3\\x0c\\x03\\xb4\\x18\\x00\\x00\\x02\\x00\\x00\\x00\\x18\\xe4\\x0c\\x03\\xb8\\x18\\x00\\x00\\x02\\x00\\x00\\x00\\xd8\\xd8\\x0c\\x03\\xfc\\x1c\\x00\\x00\\x02\\x00\\x00\\x00\\x08\\xaf\\x14\\x03 \\x1d\\x00\\x00\\x02\\x00\\x00\\x00\\xf8\\xa0\\x14\\x03$\\x1d\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xa8\\x14\\x03,\\x1d\\x00\\x00\\x02\\x00\\x00\\x00\\x90\\xae\\x14\\x030\\x1d\\x00\\x00\\x02\\x00\\x00\\x00\\xf0\\xa8\\x14\\x03H\\x1d\\x00\\x00\\x02\\x00\\x00\\x00\\x18\\xae\\x14\\x03L\\x1d\\x00\\x00\\x02\\x00\\x00\\x00`\\xa2\\x14\\x03P\\x1d\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8413
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x74d198b1",
            "parentcaller": "0x74d18c82",
            "category": "misc",
            "api": "RtlDosPathNameToNtPathName_U",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DosFileName",
                "value": "C:\\Windows\\system32\\twinapi.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 8414
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x74d198f0",
            "parentcaller": "0x74d18c82",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000078c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\twinapi.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 8415
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x74d19991",
            "parentcaller": "0x74d18c82",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000078c"
              }
            ],
            "repeated": 0,
            "id": 8416
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x74d19991",
            "parentcaller": "0x74d18c82",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\twinapi.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x6f920000"
              }
            ],
            "repeated": 0,
            "id": 8417
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b0dd72",
            "parentcaller": "0x77b11873",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\twinapi.appcore"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f920000"
              },
              {
                "name": "InitRoutine",
                "value": "0x6f9a3fb0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 8418
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e82c000"
              },
              {
                "name": "ModuleName",
                "value": "dataexchange.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8419
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e82c000"
              },
              {
                "name": "ModuleName",
                "value": "dataexchange.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8420
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fa94000"
              },
              {
                "name": "ModuleName",
                "value": "twinapi.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8421
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fa94000"
              },
              {
                "name": "ModuleName",
                "value": "twinapi.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8422
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fa94000"
              },
              {
                "name": "ModuleName",
                "value": "twinapi.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8423
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fa94000"
              },
              {
                "name": "ModuleName",
                "value": "twinapi.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8424
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798c34d",
            "parentcaller": "0x6f96b024",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "172cHWNDInterface:302a8"
              }
            ],
            "repeated": 0,
            "id": 8425
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798c134",
            "parentcaller": "0x6f96d19e",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000007dc"
              }
            ],
            "repeated": 0,
            "id": 8426
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77989e76",
            "parentcaller": "0x6f96d21e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "P]\\xd7\\x06`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8427
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x6f9a614a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007dc"
              }
            ],
            "repeated": 0,
            "id": 8428
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798c34d",
            "parentcaller": "0x6f96f39f",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "172cHWNDInterface:302a8"
              }
            ],
            "repeated": 0,
            "id": 8429
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77989888",
            "parentcaller": "0x779894ee",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000007dc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0007",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE"
              },
              {
                "name": "ObjectAttributes",
                "value": "172cHWNDInterface:302a8"
              },
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8430
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7799762b",
            "parentcaller": "0x6f96f63f",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000007dc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07410000"
              },
              {
                "name": "SectionOffset",
                "value": "0x067ce55c"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8431
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77999145",
            "parentcaller": "0x6f96f744",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07410000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8432
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b0fecf",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fa94000"
              },
              {
                "name": "ModuleName",
                "value": "twinapi.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8433
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77b0ff04",
            "parentcaller": "0x77b0fdc4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6fa94000"
              },
              {
                "name": "ModuleName",
                "value": "twinapi.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8434
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798db61",
            "parentcaller": "0x7760ae0f",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\twinapi.appcore.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x6f920000"
              }
            ],
            "repeated": 0,
            "id": 8435
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798c134",
            "parentcaller": "0x6f96d19e",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8436
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77989e76",
            "parentcaller": "0x6f96d21e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xbd\\xd7\\x06`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8437
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x6f9a614a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8438
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798c34d",
            "parentcaller": "0x6f96f39f",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "172cHWNDInterface:302a8"
              }
            ],
            "repeated": 0,
            "id": 8439
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x779a96ab",
            "parentcaller": "0x779a95ee",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07410000"
              },
              {
                "name": "SectionOffset",
                "value": "0x067ce584"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8440
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77999145",
            "parentcaller": "0x6f96f5fb",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07410000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8441
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x6f96f602",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8442
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77989888",
            "parentcaller": "0x779894ee",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0007",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE"
              },
              {
                "name": "ObjectAttributes",
                "value": "172cHWNDInterface:302a8"
              },
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8443
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7799762b",
            "parentcaller": "0x6f96f63f",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07410000"
              },
              {
                "name": "SectionOffset",
                "value": "0x067ce5ac"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8444
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77999145",
            "parentcaller": "0x6f96f744",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07410000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8445
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x6f96ceeb",
            "parentcaller": "0x6f96f781",
            "category": "windows",
            "api": "FindWindowW",
            "status": true,
            "return": "0x00010128",
            "arguments": [
              {
                "name": "ClassName",
                "value": "ApplicationManager_DesktopShellWindow"
              },
              {
                "name": "WindowName",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8446
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4bc42",
            "parentcaller": "0x75d4ba23",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "{DADEF92C-227E-46C0-93C0-9FFFA4DC07D9}"
              },
              {
                "name": "Atom",
                "value": "0x0000c01f"
              }
            ],
            "repeated": 0,
            "id": 8447
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x6f96cf27",
            "parentcaller": "0x6f96f781",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010128"
              },
              {
                "name": "Message",
                "value": "0x0000c0c1"
              }
            ],
            "repeated": 0,
            "id": 8448
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77991c1d",
            "parentcaller": "0x75d4f804",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ole32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x77240000"
              },
              {
                "name": "FunctionName",
                "value": "RevokeDragDrop"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x77263960"
              }
            ],
            "repeated": 0,
            "id": 8449
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7797f8f1",
            "parentcaller": "0x7797f6cb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8450
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x779cf5cb",
            "parentcaller": "0x7797f71e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000010c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Ole\\Extensions"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\Extensions"
              }
            ],
            "repeated": 0,
            "id": 8451
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x779cec2a",
            "parentcaller": "0x7797f370",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "ValueName",
                "value": "DragDropExtension"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\Extensions\\DragDropExtension"
              }
            ],
            "repeated": 0,
            "id": 8452
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77263ec7",
            "parentcaller": "0x77263a36",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9FC8E510-A27C-4B3B-B9A3-BF65F00256A8"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "043250DB-3B6A-4141-8F21-AA2ED2BE3355"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8453
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798040b",
            "parentcaller": "0x77263ed5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              }
            ],
            "repeated": 0,
            "id": 8454
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798c34d",
            "parentcaller": "0x6f972c08",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000007e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000002"
              },
              {
                "name": "ObjectAttributes",
                "value": "172cHWNDInterface:302a8"
              }
            ],
            "repeated": 0,
            "id": 8455
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x779a96ab",
            "parentcaller": "0x779a95ee",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000007e4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07410000"
              },
              {
                "name": "SectionOffset",
                "value": "0x067ce63c"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8456
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x6f972e18",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8457
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x77999145",
            "parentcaller": "0x6f972e39",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07410000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8458
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x6f96ae71",
            "parentcaller": "0x6f96ae45",
            "category": "windows",
            "api": "FindWindowW",
            "status": true,
            "return": "0x00010128",
            "arguments": [
              {
                "name": "ClassName",
                "value": "ApplicationManager_DesktopShellWindow"
              },
              {
                "name": "WindowName",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8459
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4bc42",
            "parentcaller": "0x75d4ba23",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "{DADEF92C-227E-46C0-93C0-9FFFA4DC07D9}"
              },
              {
                "name": "Atom",
                "value": "0x0000c01f"
              }
            ],
            "repeated": 0,
            "id": 8460
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x6f96aebf",
            "parentcaller": "0x6f96ae45",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010128"
              },
              {
                "name": "Message",
                "value": "0x0000c0c2"
              }
            ],
            "repeated": 0,
            "id": 8461
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x6f972edb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              }
            ],
            "repeated": 0,
            "id": 8462
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d51165",
            "parentcaller": "0x75d5113f",
            "category": "synchronization",
            "api": "NtDeleteAtom",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Atom",
                "value": "0x0000c044"
              }
            ],
            "repeated": 0,
            "id": 8463
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d86d61",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8464
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8465
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8466
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arabic Transparent"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent"
              }
            ],
            "repeated": 0,
            "id": 8467
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arabic Transparent"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent"
              }
            ],
            "repeated": 0,
            "id": 8468
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8469
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8470
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8471
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arabic Transparent Bold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold"
              }
            ],
            "repeated": 0,
            "id": 8472
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arabic Transparent Bold"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial Bold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold"
              }
            ],
            "repeated": 0,
            "id": 8473
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8474
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8475
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8476
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arabic Transparent Bold,0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold,0"
              }
            ],
            "repeated": 0,
            "id": 8477
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arabic Transparent Bold,0"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial Bold,178"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold,0"
              }
            ],
            "repeated": 0,
            "id": 8478
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8479
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8480
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8481
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arabic Transparent,0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent,0"
              }
            ],
            "repeated": 0,
            "id": 8482
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arabic Transparent,0"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial,178"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent,0"
              }
            ],
            "repeated": 0,
            "id": 8483
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8484
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8485
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8486
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial Baltic,186"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Baltic,186"
              }
            ],
            "repeated": 0,
            "id": 8487
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial Baltic,186"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial,186"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Baltic,186"
              }
            ],
            "repeated": 0,
            "id": 8488
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8489
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8490
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8491
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial CE,238"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CE,238"
              }
            ],
            "repeated": 0,
            "id": 8492
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial CE,238"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial,238"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CE,238"
              }
            ],
            "repeated": 0,
            "id": 8493
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8494
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8495
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8496
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial CYR,204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CYR,204"
              }
            ],
            "repeated": 0,
            "id": 8497
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial CYR,204"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial,204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CYR,204"
              }
            ],
            "repeated": 0,
            "id": 8498
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8499
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8500
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8501
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial Greek,161"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Greek,161"
              }
            ],
            "repeated": 0,
            "id": 8502
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial Greek,161"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial,161"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Greek,161"
              }
            ],
            "repeated": 0,
            "id": 8503
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8504
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8505
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8506
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial TUR,162"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial TUR,162"
              }
            ],
            "repeated": 0,
            "id": 8507
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial TUR,162"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial,162"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial TUR,162"
              }
            ],
            "repeated": 0,
            "id": 8508
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8509
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8510
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8511
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New Baltic,186"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Baltic,186"
              }
            ],
            "repeated": 0,
            "id": 8512
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New Baltic,186"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Courier New,186"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Baltic,186"
              }
            ],
            "repeated": 0,
            "id": 8513
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8514
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8515
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8516
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New CE,238"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CE,238"
              }
            ],
            "repeated": 0,
            "id": 8517
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New CE,238"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Courier New,238"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CE,238"
              }
            ],
            "repeated": 0,
            "id": 8518
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8519
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8520
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8521
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New CYR,204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CYR,204"
              }
            ],
            "repeated": 0,
            "id": 8522
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New CYR,204"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Courier New,204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CYR,204"
              }
            ],
            "repeated": 0,
            "id": 8523
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8524
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8525
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8526
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New Greek,161"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Greek,161"
              }
            ],
            "repeated": 0,
            "id": 8527
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New Greek,161"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Courier New,161"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Greek,161"
              }
            ],
            "repeated": 0,
            "id": 8528
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8529
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8530
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8531
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New TUR,162"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New TUR,162"
              }
            ],
            "repeated": 0,
            "id": 8532
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New TUR,162"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Courier New,162"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New TUR,162"
              }
            ],
            "repeated": 0,
            "id": 8533
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8534
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8535
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8536
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Helv"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helv"
              }
            ],
            "repeated": 0,
            "id": 8537
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Helv"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "MS Sans Serif"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helv"
              }
            ],
            "repeated": 0,
            "id": 8538
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8539
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8540
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8541
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Helvetica"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helvetica"
              }
            ],
            "repeated": 0,
            "id": 8542
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Helvetica"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helvetica"
              }
            ],
            "repeated": 0,
            "id": 8543
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8544
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "16"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8545
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8546
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "MS Shell Dlg 2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2"
              }
            ],
            "repeated": 0,
            "id": 8547
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "MS Shell Dlg 2"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Tahoma"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2"
              }
            ],
            "repeated": 0,
            "id": 8548
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8549
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "17"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8550
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8551
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Tahoma Armenian"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tahoma Armenian"
              }
            ],
            "repeated": 0,
            "id": 8552
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Tahoma Armenian"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Tahoma"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tahoma Armenian"
              }
            ],
            "repeated": 0,
            "id": 8553
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8554
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "18"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8555
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8556
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times"
              }
            ],
            "repeated": 0,
            "id": 8557
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Times New Roman"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times"
              }
            ],
            "repeated": 0,
            "id": 8558
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8559
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "19"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8560
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8561
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times New Roman Baltic,186"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Baltic,186"
              }
            ],
            "repeated": 0,
            "id": 8562
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times New Roman Baltic,186"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Times New Roman,186"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Baltic,186"
              }
            ],
            "repeated": 0,
            "id": 8563
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8564
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "20"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8565
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8566
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times New Roman CE,238"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CE,238"
              }
            ],
            "repeated": 0,
            "id": 8567
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times New Roman CE,238"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Times New Roman,238"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CE,238"
              }
            ],
            "repeated": 0,
            "id": 8568
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8569
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e31",
            "parentcaller": "0x75d56d86",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              }
            ],
            "repeated": 0,
            "id": 8570
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d86d61",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8571
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8572
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8573
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arabic Transparent"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent"
              }
            ],
            "repeated": 0,
            "id": 8574
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arabic Transparent"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent"
              }
            ],
            "repeated": 0,
            "id": 8575
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8576
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8577
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8578
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arabic Transparent Bold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold"
              }
            ],
            "repeated": 0,
            "id": 8579
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arabic Transparent Bold"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial Bold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold"
              }
            ],
            "repeated": 0,
            "id": 8580
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8581
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8582
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8583
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arabic Transparent Bold,0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold,0"
              }
            ],
            "repeated": 0,
            "id": 8584
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arabic Transparent Bold,0"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial Bold,178"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold,0"
              }
            ],
            "repeated": 0,
            "id": 8585
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8586
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8587
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8588
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arabic Transparent,0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent,0"
              }
            ],
            "repeated": 0,
            "id": 8589
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arabic Transparent,0"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial,178"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent,0"
              }
            ],
            "repeated": 0,
            "id": 8590
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8591
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8592
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8593
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial Baltic,186"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Baltic,186"
              }
            ],
            "repeated": 0,
            "id": 8594
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial Baltic,186"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial,186"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Baltic,186"
              }
            ],
            "repeated": 0,
            "id": 8595
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8596
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8597
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8598
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial CE,238"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CE,238"
              }
            ],
            "repeated": 0,
            "id": 8599
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial CE,238"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial,238"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CE,238"
              }
            ],
            "repeated": 0,
            "id": 8600
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8601
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8602
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8603
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial CYR,204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CYR,204"
              }
            ],
            "repeated": 0,
            "id": 8604
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial CYR,204"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial,204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CYR,204"
              }
            ],
            "repeated": 0,
            "id": 8605
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8606
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8607
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8608
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial Greek,161"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Greek,161"
              }
            ],
            "repeated": 0,
            "id": 8609
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial Greek,161"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial,161"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Greek,161"
              }
            ],
            "repeated": 0,
            "id": 8610
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8611
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8612
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8613
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial TUR,162"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial TUR,162"
              }
            ],
            "repeated": 0,
            "id": 8614
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Arial TUR,162"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial,162"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial TUR,162"
              }
            ],
            "repeated": 0,
            "id": 8615
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8616
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8617
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8618
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New Baltic,186"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Baltic,186"
              }
            ],
            "repeated": 0,
            "id": 8619
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New Baltic,186"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Courier New,186"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Baltic,186"
              }
            ],
            "repeated": 0,
            "id": 8620
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8621
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8622
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8623
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New CE,238"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CE,238"
              }
            ],
            "repeated": 0,
            "id": 8624
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New CE,238"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Courier New,238"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CE,238"
              }
            ],
            "repeated": 0,
            "id": 8625
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8626
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8627
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8628
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New CYR,204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CYR,204"
              }
            ],
            "repeated": 0,
            "id": 8629
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New CYR,204"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Courier New,204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CYR,204"
              }
            ],
            "repeated": 0,
            "id": 8630
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8631
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8632
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8633
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New Greek,161"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Greek,161"
              }
            ],
            "repeated": 0,
            "id": 8634
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New Greek,161"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Courier New,161"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Greek,161"
              }
            ],
            "repeated": 0,
            "id": 8635
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8636
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8637
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8638
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New TUR,162"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New TUR,162"
              }
            ],
            "repeated": 0,
            "id": 8639
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Courier New TUR,162"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Courier New,162"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New TUR,162"
              }
            ],
            "repeated": 0,
            "id": 8640
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8641
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8642
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8643
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Helv"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helv"
              }
            ],
            "repeated": 0,
            "id": 8644
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Helv"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "MS Sans Serif"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helv"
              }
            ],
            "repeated": 0,
            "id": 8645
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8646
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8647
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8648
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Helvetica"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helvetica"
              }
            ],
            "repeated": 0,
            "id": 8649
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Helvetica"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Arial"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helvetica"
              }
            ],
            "repeated": 0,
            "id": 8650
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8651
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "16"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8652
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8653
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "MS Shell Dlg 2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2"
              }
            ],
            "repeated": 0,
            "id": 8654
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "MS Shell Dlg 2"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Tahoma"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2"
              }
            ],
            "repeated": 0,
            "id": 8655
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8656
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "17"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8657
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8658
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Tahoma Armenian"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tahoma Armenian"
              }
            ],
            "repeated": 0,
            "id": 8659
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Tahoma Armenian"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Tahoma"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tahoma Armenian"
              }
            ],
            "repeated": 0,
            "id": 8660
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8661
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "18"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8662
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8663
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times"
              }
            ],
            "repeated": 0,
            "id": 8664
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Times New Roman"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times"
              }
            ],
            "repeated": 0,
            "id": 8665
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8666
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "19"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8667
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8668
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times New Roman Baltic,186"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Baltic,186"
              }
            ],
            "repeated": 0,
            "id": 8669
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times New Roman Baltic,186"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Times New Roman,186"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Baltic,186"
              }
            ],
            "repeated": 0,
            "id": 8670
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8671
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "20"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8672
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8673
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times New Roman CE,238"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CE,238"
              }
            ],
            "repeated": 0,
            "id": 8674
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times New Roman CE,238"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Times New Roman,238"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CE,238"
              }
            ],
            "repeated": 0,
            "id": 8675
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8676
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "21"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8677
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8678
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times New Roman CYR,204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CYR,204"
              }
            ],
            "repeated": 0,
            "id": 8679
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times New Roman CYR,204"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Times New Roman,204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CYR,204"
              }
            ],
            "repeated": 0,
            "id": 8680
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8681
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "22"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8682
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8683
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times New Roman Greek,161"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Greek,161"
              }
            ],
            "repeated": 0,
            "id": 8684
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times New Roman Greek,161"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Times New Roman,161"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Greek,161"
              }
            ],
            "repeated": 0,
            "id": 8685
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8686
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "23"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8687
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8688
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times New Roman TUR,162"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman TUR,162"
              }
            ],
            "repeated": 0,
            "id": 8689
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Times New Roman TUR,162"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Times New Roman,162"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman TUR,162"
              }
            ],
            "repeated": 0,
            "id": 8690
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8691
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "24"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8692
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8693
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Tms Rmn"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tms Rmn"
              }
            ],
            "repeated": 0,
            "id": 8694
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "Tms Rmn"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "MS Serif"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tms Rmn"
              }
            ],
            "repeated": 0,
            "id": 8695
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8696
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "25"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8697
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c37c",
            "parentcaller": "0x75d4c065",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 8698
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c085",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "MS Shell Dlg"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg"
              }
            ],
            "repeated": 0,
            "id": 8699
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0ee",
            "parentcaller": "0x75d86dce",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e0"
              },
              {
                "name": "ValueName",
                "value": "MS Shell Dlg"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Microsoft Sans Serif"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg"
              }
            ],
            "repeated": 0,
            "id": 8700
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d4c0f9",
            "parentcaller": "0x75d86dce",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e0"
              }
            ],
            "repeated": 0,
            "id": 8701
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e07",
            "parentcaller": "0x75d56d86",
            "category": "registry",
            "api": "NtEnumerateValueKey",
            "status": false,
            "return": "0xffffffff8000001a",
            "pretty_return": "NO_MORE_ENTRIES",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000007e4"
              },
              {
                "name": "Index",
                "value": "26"
              },
              {
                "name": "KeyValueInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8702
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "4316",
            "caller": "0x75d86e21",
            "parentcaller": "0x75d56d86",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              }
            ],
            "repeated": 0,
            "id": 8703
          },
          {
            "timestamp": "2026-05-28 22:59:57,066",
            "thread_id": "4316",
            "caller": "0x7798a90c",
            "parentcaller": "0x6b501895",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007ac"
              },
              {
                "name": "HandleName",
                "value": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
              },
              {
                "name": "Buffer",
                "value": "{\\rtf1\\adeflang1025\\ansi\\ansicpg1252\\uc1\\adeff40\\deff0\\stshfdbch11\\stshfloch0\\stshfhich0\\stshfbi0\\deflang1033\\deflangfe1033\\themelang1033\\themelangfe2052\\themelangcs1025{\\fonttbl{\\f0\\fbidi \\froman\\fcharset0\\fprq2{\\*\\panose 02020603050405020304}Times New Ro"
              },
              {
                "name": "Length",
                "value": "204389"
              }
            ],
            "repeated": 0,
            "id": 8704
          },
          {
            "timestamp": "2026-05-28 22:59:57,066",
            "thread_id": "4316",
            "caller": "0x77aef655",
            "parentcaller": "0x77b07a14",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08c41000"
              },
              {
                "name": "RegionSize",
                "value": "0x00018000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8705
          },
          {
            "timestamp": "2026-05-28 22:59:57,066",
            "thread_id": "4316",
            "caller": "0x7798ab1a",
            "parentcaller": "0x6b501398",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8706
          },
          {
            "timestamp": "2026-05-28 22:59:57,066",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed2d00",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 17,
            "id": 8707
          },
          {
            "timestamp": "2026-05-28 22:59:57,097",
            "thread_id": "4316",
            "caller": "0x77b007c7",
            "parentcaller": "0x77b004cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x068e7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8708
          },
          {
            "timestamp": "2026-05-28 22:59:57,097",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed27c8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 19,
            "id": 8709
          },
          {
            "timestamp": "2026-05-28 22:59:57,113",
            "thread_id": "4316",
            "caller": "0x69ecea37",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000200e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8710
          },
          {
            "timestamp": "2026-05-28 22:59:57,113",
            "thread_id": "4316",
            "caller": "0x69ecea48",
            "parentcaller": "0x69ed1cab",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002010"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8711
          },
          {
            "timestamp": "2026-05-28 22:59:57,113",
            "thread_id": "4316",
            "caller": "0x69ecf66d",
            "parentcaller": "0x69ed27c8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x0000000c"
              }
            ],
            "repeated": 7,
            "id": 8712
          },
          {
            "timestamp": "2026-05-28 22:59:57,441",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8713
          },
          {
            "timestamp": "2026-05-28 22:59:57,441",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8714
          },
          {
            "timestamp": "2026-05-28 22:59:57,441",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8715
          },
          {
            "timestamp": "2026-05-28 22:59:58,441",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8716
          },
          {
            "timestamp": "2026-05-28 22:59:58,441",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8717
          },
          {
            "timestamp": "2026-05-28 22:59:58,441",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8718
          },
          {
            "timestamp": "2026-05-28 22:59:59,441",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8719
          },
          {
            "timestamp": "2026-05-28 22:59:59,441",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8720
          },
          {
            "timestamp": "2026-05-28 22:59:59,441",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8721
          },
          {
            "timestamp": "2026-05-28 23:00:00,456",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8722
          },
          {
            "timestamp": "2026-05-28 23:00:00,456",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8723
          },
          {
            "timestamp": "2026-05-28 23:00:00,456",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8724
          },
          {
            "timestamp": "2026-05-28 23:00:01,378",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 8725
          },
          {
            "timestamp": "2026-05-28 23:00:01,378",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8726
          },
          {
            "timestamp": "2026-05-28 23:00:01,378",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8727
          },
          {
            "timestamp": "2026-05-28 23:00:01,378",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8728
          },
          {
            "timestamp": "2026-05-28 23:00:01,378",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8729
          },
          {
            "timestamp": "2026-05-28 23:00:01,378",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8730
          },
          {
            "timestamp": "2026-05-28 23:00:01,378",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8731
          },
          {
            "timestamp": "2026-05-28 23:00:01,378",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8732
          },
          {
            "timestamp": "2026-05-28 23:00:01,378",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8733
          },
          {
            "timestamp": "2026-05-28 23:00:01,378",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8734
          },
          {
            "timestamp": "2026-05-28 23:00:01,378",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "4"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8735
          },
          {
            "timestamp": "2026-05-28 23:00:01,378",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8736
          },
          {
            "timestamp": "2026-05-28 23:00:01,472",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8737
          },
          {
            "timestamp": "2026-05-28 23:00:01,472",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8738
          },
          {
            "timestamp": "2026-05-28 23:00:01,472",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8739
          },
          {
            "timestamp": "2026-05-28 23:00:02,488",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8740
          },
          {
            "timestamp": "2026-05-28 23:00:02,488",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8741
          },
          {
            "timestamp": "2026-05-28 23:00:02,488",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8742
          },
          {
            "timestamp": "2026-05-28 23:00:03,503",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8743
          },
          {
            "timestamp": "2026-05-28 23:00:03,503",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8744
          },
          {
            "timestamp": "2026-05-28 23:00:03,503",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8745
          },
          {
            "timestamp": "2026-05-28 23:00:04,503",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8746
          },
          {
            "timestamp": "2026-05-28 23:00:04,503",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8747
          },
          {
            "timestamp": "2026-05-28 23:00:04,503",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8748
          },
          {
            "timestamp": "2026-05-28 23:00:05,519",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8749
          },
          {
            "timestamp": "2026-05-28 23:00:05,519",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8750
          },
          {
            "timestamp": "2026-05-28 23:00:05,519",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8751
          },
          {
            "timestamp": "2026-05-28 23:00:06,394",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 8752
          },
          {
            "timestamp": "2026-05-28 23:00:06,394",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8753
          },
          {
            "timestamp": "2026-05-28 23:00:06,394",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8754
          },
          {
            "timestamp": "2026-05-28 23:00:06,394",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8755
          },
          {
            "timestamp": "2026-05-28 23:00:06,394",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8756
          },
          {
            "timestamp": "2026-05-28 23:00:06,394",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8757
          },
          {
            "timestamp": "2026-05-28 23:00:06,394",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8758
          },
          {
            "timestamp": "2026-05-28 23:00:06,394",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8759
          },
          {
            "timestamp": "2026-05-28 23:00:06,394",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8760
          },
          {
            "timestamp": "2026-05-28 23:00:06,394",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8761
          },
          {
            "timestamp": "2026-05-28 23:00:06,394",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "5"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8762
          },
          {
            "timestamp": "2026-05-28 23:00:06,394",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007ac"
              }
            ],
            "repeated": 0,
            "id": 8763
          },
          {
            "timestamp": "2026-05-28 23:00:06,519",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8764
          },
          {
            "timestamp": "2026-05-28 23:00:06,519",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8765
          },
          {
            "timestamp": "2026-05-28 23:00:06,519",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8766
          },
          {
            "timestamp": "2026-05-28 23:00:07,535",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8767
          },
          {
            "timestamp": "2026-05-28 23:00:07,535",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8768
          },
          {
            "timestamp": "2026-05-28 23:00:07,535",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8769
          },
          {
            "timestamp": "2026-05-28 23:00:08,535",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8770
          },
          {
            "timestamp": "2026-05-28 23:00:08,535",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8771
          },
          {
            "timestamp": "2026-05-28 23:00:08,535",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8772
          },
          {
            "timestamp": "2026-05-28 23:00:09,535",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8773
          },
          {
            "timestamp": "2026-05-28 23:00:09,535",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8774
          },
          {
            "timestamp": "2026-05-28 23:00:09,535",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8775
          },
          {
            "timestamp": "2026-05-28 23:00:10,550",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8776
          },
          {
            "timestamp": "2026-05-28 23:00:10,550",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8777
          },
          {
            "timestamp": "2026-05-28 23:00:10,550",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8778
          },
          {
            "timestamp": "2026-05-28 23:00:11,316",
            "thread_id": "6324",
            "caller": "0x77af2586",
            "parentcaller": "0x77af6986",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 8779
          },
          {
            "timestamp": "2026-05-28 23:00:11,425",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 8780
          },
          {
            "timestamp": "2026-05-28 23:00:11,425",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              }
            ],
            "repeated": 0,
            "id": 8781
          },
          {
            "timestamp": "2026-05-28 23:00:11,425",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8782
          },
          {
            "timestamp": "2026-05-28 23:00:11,425",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8783
          },
          {
            "timestamp": "2026-05-28 23:00:11,425",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              }
            ],
            "repeated": 0,
            "id": 8784
          },
          {
            "timestamp": "2026-05-28 23:00:11,425",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8785
          },
          {
            "timestamp": "2026-05-28 23:00:11,425",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8786
          },
          {
            "timestamp": "2026-05-28 23:00:11,425",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8787
          },
          {
            "timestamp": "2026-05-28 23:00:11,425",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              }
            ],
            "repeated": 0,
            "id": 8788
          },
          {
            "timestamp": "2026-05-28 23:00:11,425",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8789
          },
          {
            "timestamp": "2026-05-28 23:00:11,425",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "6"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8790
          },
          {
            "timestamp": "2026-05-28 23:00:11,425",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              }
            ],
            "repeated": 0,
            "id": 8791
          },
          {
            "timestamp": "2026-05-28 23:00:11,566",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8792
          },
          {
            "timestamp": "2026-05-28 23:00:11,566",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8793
          },
          {
            "timestamp": "2026-05-28 23:00:11,566",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8794
          },
          {
            "timestamp": "2026-05-28 23:00:12,581",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8795
          },
          {
            "timestamp": "2026-05-28 23:00:12,581",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8796
          },
          {
            "timestamp": "2026-05-28 23:00:12,581",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8797
          },
          {
            "timestamp": "2026-05-28 23:00:13,581",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8798
          },
          {
            "timestamp": "2026-05-28 23:00:13,581",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8799
          },
          {
            "timestamp": "2026-05-28 23:00:13,581",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8800
          },
          {
            "timestamp": "2026-05-28 23:00:14,597",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8801
          },
          {
            "timestamp": "2026-05-28 23:00:14,597",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8802
          },
          {
            "timestamp": "2026-05-28 23:00:14,597",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8803
          },
          {
            "timestamp": "2026-05-28 23:00:15,613",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8804
          },
          {
            "timestamp": "2026-05-28 23:00:15,613",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8805
          },
          {
            "timestamp": "2026-05-28 23:00:15,613",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8806
          },
          {
            "timestamp": "2026-05-28 23:00:16,472",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 8807
          },
          {
            "timestamp": "2026-05-28 23:00:16,472",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 8808
          },
          {
            "timestamp": "2026-05-28 23:00:16,472",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8809
          },
          {
            "timestamp": "2026-05-28 23:00:16,472",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8810
          },
          {
            "timestamp": "2026-05-28 23:00:16,472",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 8811
          },
          {
            "timestamp": "2026-05-28 23:00:16,472",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8812
          },
          {
            "timestamp": "2026-05-28 23:00:16,472",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8813
          },
          {
            "timestamp": "2026-05-28 23:00:16,472",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8814
          },
          {
            "timestamp": "2026-05-28 23:00:16,472",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 8815
          },
          {
            "timestamp": "2026-05-28 23:00:16,472",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8816
          },
          {
            "timestamp": "2026-05-28 23:00:16,472",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "7"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8817
          },
          {
            "timestamp": "2026-05-28 23:00:16,472",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 8818
          },
          {
            "timestamp": "2026-05-28 23:00:16,613",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8819
          },
          {
            "timestamp": "2026-05-28 23:00:16,613",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8820
          },
          {
            "timestamp": "2026-05-28 23:00:16,613",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8821
          },
          {
            "timestamp": "2026-05-28 23:00:17,628",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8822
          },
          {
            "timestamp": "2026-05-28 23:00:17,628",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8823
          },
          {
            "timestamp": "2026-05-28 23:00:17,628",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8824
          },
          {
            "timestamp": "2026-05-28 23:00:18,644",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8825
          },
          {
            "timestamp": "2026-05-28 23:00:18,644",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8826
          },
          {
            "timestamp": "2026-05-28 23:00:18,644",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8827
          },
          {
            "timestamp": "2026-05-28 23:00:19,660",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8828
          },
          {
            "timestamp": "2026-05-28 23:00:19,660",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8829
          },
          {
            "timestamp": "2026-05-28 23:00:19,660",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8830
          },
          {
            "timestamp": "2026-05-28 23:00:20,660",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8831
          },
          {
            "timestamp": "2026-05-28 23:00:20,660",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8832
          },
          {
            "timestamp": "2026-05-28 23:00:20,660",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8833
          },
          {
            "timestamp": "2026-05-28 23:00:21,472",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 8834
          },
          {
            "timestamp": "2026-05-28 23:00:21,472",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              }
            ],
            "repeated": 0,
            "id": 8835
          },
          {
            "timestamp": "2026-05-28 23:00:21,472",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8836
          },
          {
            "timestamp": "2026-05-28 23:00:21,472",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8837
          },
          {
            "timestamp": "2026-05-28 23:00:21,472",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              }
            ],
            "repeated": 0,
            "id": 8838
          },
          {
            "timestamp": "2026-05-28 23:00:21,472",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8839
          },
          {
            "timestamp": "2026-05-28 23:00:21,472",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8840
          },
          {
            "timestamp": "2026-05-28 23:00:21,472",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8841
          },
          {
            "timestamp": "2026-05-28 23:00:21,472",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              }
            ],
            "repeated": 0,
            "id": 8842
          },
          {
            "timestamp": "2026-05-28 23:00:21,472",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8843
          },
          {
            "timestamp": "2026-05-28 23:00:21,472",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "8"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8844
          },
          {
            "timestamp": "2026-05-28 23:00:21,472",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              }
            ],
            "repeated": 0,
            "id": 8845
          },
          {
            "timestamp": "2026-05-28 23:00:21,660",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8846
          },
          {
            "timestamp": "2026-05-28 23:00:21,660",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8847
          },
          {
            "timestamp": "2026-05-28 23:00:21,660",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8848
          },
          {
            "timestamp": "2026-05-28 23:00:22,675",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8849
          },
          {
            "timestamp": "2026-05-28 23:00:22,675",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8850
          },
          {
            "timestamp": "2026-05-28 23:00:22,675",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8851
          },
          {
            "timestamp": "2026-05-28 23:00:23,675",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8852
          },
          {
            "timestamp": "2026-05-28 23:00:23,675",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8853
          },
          {
            "timestamp": "2026-05-28 23:00:23,675",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8854
          },
          {
            "timestamp": "2026-05-28 23:00:24,675",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8855
          },
          {
            "timestamp": "2026-05-28 23:00:24,675",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8856
          },
          {
            "timestamp": "2026-05-28 23:00:24,675",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8857
          },
          {
            "timestamp": "2026-05-28 23:00:25,691",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8858
          },
          {
            "timestamp": "2026-05-28 23:00:25,691",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8859
          },
          {
            "timestamp": "2026-05-28 23:00:25,691",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8860
          },
          {
            "timestamp": "2026-05-28 23:00:26,503",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 8861
          },
          {
            "timestamp": "2026-05-28 23:00:26,503",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              }
            ],
            "repeated": 0,
            "id": 8862
          },
          {
            "timestamp": "2026-05-28 23:00:26,503",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8863
          },
          {
            "timestamp": "2026-05-28 23:00:26,503",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8864
          },
          {
            "timestamp": "2026-05-28 23:00:26,503",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              }
            ],
            "repeated": 0,
            "id": 8865
          },
          {
            "timestamp": "2026-05-28 23:00:26,503",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8866
          },
          {
            "timestamp": "2026-05-28 23:00:26,503",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8867
          },
          {
            "timestamp": "2026-05-28 23:00:26,503",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8868
          },
          {
            "timestamp": "2026-05-28 23:00:26,503",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              }
            ],
            "repeated": 0,
            "id": 8869
          },
          {
            "timestamp": "2026-05-28 23:00:26,503",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8870
          },
          {
            "timestamp": "2026-05-28 23:00:26,503",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "9"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8871
          },
          {
            "timestamp": "2026-05-28 23:00:26,503",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000007e4"
              }
            ],
            "repeated": 0,
            "id": 8872
          },
          {
            "timestamp": "2026-05-28 23:00:26,691",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8873
          },
          {
            "timestamp": "2026-05-28 23:00:26,691",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8874
          },
          {
            "timestamp": "2026-05-28 23:00:26,691",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8875
          },
          {
            "timestamp": "2026-05-28 23:00:27,706",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8876
          },
          {
            "timestamp": "2026-05-28 23:00:27,706",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8877
          },
          {
            "timestamp": "2026-05-28 23:00:27,706",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8878
          },
          {
            "timestamp": "2026-05-28 23:00:28,706",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8879
          },
          {
            "timestamp": "2026-05-28 23:00:28,706",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8880
          },
          {
            "timestamp": "2026-05-28 23:00:28,706",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8881
          },
          {
            "timestamp": "2026-05-28 23:00:29,722",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8882
          },
          {
            "timestamp": "2026-05-28 23:00:29,722",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8883
          },
          {
            "timestamp": "2026-05-28 23:00:29,722",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8884
          },
          {
            "timestamp": "2026-05-28 23:00:30,738",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8885
          },
          {
            "timestamp": "2026-05-28 23:00:30,738",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8886
          },
          {
            "timestamp": "2026-05-28 23:00:30,738",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8887
          },
          {
            "timestamp": "2026-05-28 23:00:31,363",
            "thread_id": "7468",
            "caller": "0x69b9ec3a",
            "parentcaller": "0x69b9ebfd",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8888
          },
          {
            "timestamp": "2026-05-28 23:00:31,503",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 8889
          },
          {
            "timestamp": "2026-05-28 23:00:31,503",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 8890
          },
          {
            "timestamp": "2026-05-28 23:00:31,503",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8891
          },
          {
            "timestamp": "2026-05-28 23:00:31,503",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8892
          },
          {
            "timestamp": "2026-05-28 23:00:31,503",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 8893
          },
          {
            "timestamp": "2026-05-28 23:00:31,503",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8894
          },
          {
            "timestamp": "2026-05-28 23:00:31,503",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8895
          },
          {
            "timestamp": "2026-05-28 23:00:31,503",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8896
          },
          {
            "timestamp": "2026-05-28 23:00:31,503",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 8897
          },
          {
            "timestamp": "2026-05-28 23:00:31,503",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8898
          },
          {
            "timestamp": "2026-05-28 23:00:31,503",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "10"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8899
          },
          {
            "timestamp": "2026-05-28 23:00:31,503",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 8900
          },
          {
            "timestamp": "2026-05-28 23:00:31,738",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8901
          },
          {
            "timestamp": "2026-05-28 23:00:31,738",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8902
          },
          {
            "timestamp": "2026-05-28 23:00:31,738",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8903
          },
          {
            "timestamp": "2026-05-28 23:00:32,738",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8904
          },
          {
            "timestamp": "2026-05-28 23:00:32,738",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8905
          },
          {
            "timestamp": "2026-05-28 23:00:32,738",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8906
          },
          {
            "timestamp": "2026-05-28 23:00:33,753",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8907
          },
          {
            "timestamp": "2026-05-28 23:00:33,753",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8908
          },
          {
            "timestamp": "2026-05-28 23:00:33,753",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8909
          },
          {
            "timestamp": "2026-05-28 23:00:34,066",
            "thread_id": "4144",
            "caller": "0x77b2b6b6",
            "parentcaller": "0x77af607c",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "12"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "4144"
              }
            ],
            "repeated": 0,
            "id": 8910
          },
          {
            "timestamp": "2026-05-28 23:00:34,066",
            "thread_id": "4144",
            "caller": "0x77b2b6d9",
            "parentcaller": "0x77af607c",
            "category": "threading",
            "api": "NtTerminateThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitStatus",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "0"
              },
              {
                "name": "ProcessId",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8911
          },
          {
            "timestamp": "2026-05-28 23:00:34,066",
            "thread_id": "5060",
            "caller": "0x77b2b6b6",
            "parentcaller": "0x77af607c",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "12"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "5060"
              }
            ],
            "repeated": 0,
            "id": 8912
          },
          {
            "timestamp": "2026-05-28 23:00:34,066",
            "thread_id": "5060",
            "caller": "0x77b2b6d9",
            "parentcaller": "0x77af607c",
            "category": "threading",
            "api": "NtTerminateThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitStatus",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "0"
              },
              {
                "name": "ProcessId",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8913
          },
          {
            "timestamp": "2026-05-28 23:00:34,066",
            "thread_id": "3744",
            "caller": "0x77b2b6b6",
            "parentcaller": "0x77af607c",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "12"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "3744"
              }
            ],
            "repeated": 0,
            "id": 8914
          },
          {
            "timestamp": "2026-05-28 23:00:34,066",
            "thread_id": "3744",
            "caller": "0x77b2b6d9",
            "parentcaller": "0x77af607c",
            "category": "threading",
            "api": "NtTerminateThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitStatus",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "0"
              },
              {
                "name": "ProcessId",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8915
          },
          {
            "timestamp": "2026-05-28 23:00:34,113",
            "thread_id": "7468",
            "caller": "0x76c1fc08",
            "parentcaller": "0x76c1fabd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000540"
              }
            ],
            "repeated": 0,
            "id": 8916
          },
          {
            "timestamp": "2026-05-28 23:00:34,113",
            "thread_id": "7468",
            "caller": "0x76c1fc08",
            "parentcaller": "0x76c1fabd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 8917
          },
          {
            "timestamp": "2026-05-28 23:00:34,113",
            "thread_id": "7468",
            "caller": "0x76c1fc08",
            "parentcaller": "0x76c1fabd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 8918
          },
          {
            "timestamp": "2026-05-28 23:00:34,113",
            "thread_id": "7468",
            "caller": "0x76c1fc08",
            "parentcaller": "0x76c1fabd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 8919
          },
          {
            "timestamp": "2026-05-28 23:00:34,769",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8920
          },
          {
            "timestamp": "2026-05-28 23:00:34,769",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8921
          },
          {
            "timestamp": "2026-05-28 23:00:34,769",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8922
          },
          {
            "timestamp": "2026-05-28 23:00:35,769",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8923
          },
          {
            "timestamp": "2026-05-28 23:00:35,769",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8924
          },
          {
            "timestamp": "2026-05-28 23:00:35,769",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8925
          },
          {
            "timestamp": "2026-05-28 23:00:36,519",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x000002e8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 8926
          },
          {
            "timestamp": "2026-05-28 23:00:36,519",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 8927
          },
          {
            "timestamp": "2026-05-28 23:00:36,519",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002e8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8928
          },
          {
            "timestamp": "2026-05-28 23:00:36,519",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8929
          },
          {
            "timestamp": "2026-05-28 23:00:36,519",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 8930
          },
          {
            "timestamp": "2026-05-28 23:00:36,519",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002e8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8931
          },
          {
            "timestamp": "2026-05-28 23:00:36,519",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8932
          },
          {
            "timestamp": "2026-05-28 23:00:36,519",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "10"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8933
          },
          {
            "timestamp": "2026-05-28 23:00:36,519",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 8934
          },
          {
            "timestamp": "2026-05-28 23:00:36,519",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002e8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8935
          },
          {
            "timestamp": "2026-05-28 23:00:36,519",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "11"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8936
          },
          {
            "timestamp": "2026-05-28 23:00:36,519",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 8937
          },
          {
            "timestamp": "2026-05-28 23:00:36,769",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8938
          },
          {
            "timestamp": "2026-05-28 23:00:36,769",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8939
          },
          {
            "timestamp": "2026-05-28 23:00:36,769",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8940
          },
          {
            "timestamp": "2026-05-28 23:00:37,785",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8941
          },
          {
            "timestamp": "2026-05-28 23:00:37,785",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8942
          },
          {
            "timestamp": "2026-05-28 23:00:37,785",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8943
          },
          {
            "timestamp": "2026-05-28 23:00:38,785",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8944
          },
          {
            "timestamp": "2026-05-28 23:00:38,785",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8945
          },
          {
            "timestamp": "2026-05-28 23:00:38,785",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8946
          },
          {
            "timestamp": "2026-05-28 23:00:39,800",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8947
          },
          {
            "timestamp": "2026-05-28 23:00:39,800",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8948
          },
          {
            "timestamp": "2026-05-28 23:00:39,800",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8949
          },
          {
            "timestamp": "2026-05-28 23:00:40,800",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8950
          },
          {
            "timestamp": "2026-05-28 23:00:40,800",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8951
          },
          {
            "timestamp": "2026-05-28 23:00:40,800",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8952
          },
          {
            "timestamp": "2026-05-28 23:00:41,300",
            "thread_id": "7468",
            "caller": "0x7798ac59",
            "parentcaller": "0x7798abb2",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000518"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8953
          },
          {
            "timestamp": "2026-05-28 23:00:41,300",
            "thread_id": "7468",
            "caller": "0x7798ab1a",
            "parentcaller": "0x69b9e5e1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000518"
              }
            ],
            "repeated": 0,
            "id": 8954
          },
          {
            "timestamp": "2026-05-28 23:00:41,535",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x00000518"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 8955
          },
          {
            "timestamp": "2026-05-28 23:00:41,535",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000518"
              }
            ],
            "repeated": 0,
            "id": 8956
          },
          {
            "timestamp": "2026-05-28 23:00:41,535",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000518"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8957
          },
          {
            "timestamp": "2026-05-28 23:00:41,535",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000518"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8958
          },
          {
            "timestamp": "2026-05-28 23:00:41,535",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000518"
              }
            ],
            "repeated": 0,
            "id": 8959
          },
          {
            "timestamp": "2026-05-28 23:00:41,535",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000518"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8960
          },
          {
            "timestamp": "2026-05-28 23:00:41,535",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000518"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8961
          },
          {
            "timestamp": "2026-05-28 23:00:41,535",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000518"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "11"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8962
          },
          {
            "timestamp": "2026-05-28 23:00:41,535",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000518"
              }
            ],
            "repeated": 0,
            "id": 8963
          },
          {
            "timestamp": "2026-05-28 23:00:41,535",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000518"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8964
          },
          {
            "timestamp": "2026-05-28 23:00:41,535",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000518"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "12"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8965
          },
          {
            "timestamp": "2026-05-28 23:00:41,535",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000518"
              }
            ],
            "repeated": 0,
            "id": 8966
          },
          {
            "timestamp": "2026-05-28 23:00:41,816",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8967
          },
          {
            "timestamp": "2026-05-28 23:00:41,816",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8968
          },
          {
            "timestamp": "2026-05-28 23:00:41,816",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8969
          },
          {
            "timestamp": "2026-05-28 23:00:42,831",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8970
          },
          {
            "timestamp": "2026-05-28 23:00:42,831",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8971
          },
          {
            "timestamp": "2026-05-28 23:00:42,831",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8972
          },
          {
            "timestamp": "2026-05-28 23:00:43,050",
            "thread_id": "6320",
            "caller": "0x77999924",
            "parentcaller": "0x76c1c2f8",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000002e8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 8973
          },
          {
            "timestamp": "2026-05-28 23:00:43,847",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8974
          },
          {
            "timestamp": "2026-05-28 23:00:43,847",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8975
          },
          {
            "timestamp": "2026-05-28 23:00:43,847",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8976
          },
          {
            "timestamp": "2026-05-28 23:00:44,863",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8977
          },
          {
            "timestamp": "2026-05-28 23:00:44,863",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8978
          },
          {
            "timestamp": "2026-05-28 23:00:44,863",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8979
          },
          {
            "timestamp": "2026-05-28 23:00:45,878",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8980
          },
          {
            "timestamp": "2026-05-28 23:00:45,878",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8981
          },
          {
            "timestamp": "2026-05-28 23:00:45,878",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8982
          },
          {
            "timestamp": "2026-05-28 23:00:46,550",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 8983
          },
          {
            "timestamp": "2026-05-28 23:00:46,550",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 8984
          },
          {
            "timestamp": "2026-05-28 23:00:46,550",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8985
          },
          {
            "timestamp": "2026-05-28 23:00:46,550",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8986
          },
          {
            "timestamp": "2026-05-28 23:00:46,550",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 8987
          },
          {
            "timestamp": "2026-05-28 23:00:46,550",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8988
          },
          {
            "timestamp": "2026-05-28 23:00:46,550",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8989
          },
          {
            "timestamp": "2026-05-28 23:00:46,550",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "12"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8990
          },
          {
            "timestamp": "2026-05-28 23:00:46,550",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 8991
          },
          {
            "timestamp": "2026-05-28 23:00:46,550",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 8992
          },
          {
            "timestamp": "2026-05-28 23:00:46,550",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "13"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 8993
          },
          {
            "timestamp": "2026-05-28 23:00:46,550",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 8994
          },
          {
            "timestamp": "2026-05-28 23:00:46,894",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8995
          },
          {
            "timestamp": "2026-05-28 23:00:46,910",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8996
          },
          {
            "timestamp": "2026-05-28 23:00:46,910",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 8997
          },
          {
            "timestamp": "2026-05-28 23:00:46,972",
            "thread_id": "7468",
            "caller": "0x69b9ec3a",
            "parentcaller": "0x69b9ebfd",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 8998
          },
          {
            "timestamp": "2026-05-28 23:00:47,910",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8999
          },
          {
            "timestamp": "2026-05-28 23:00:47,925",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9000
          },
          {
            "timestamp": "2026-05-28 23:00:48,925",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9001
          },
          {
            "timestamp": "2026-05-28 23:00:48,925",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9002
          },
          {
            "timestamp": "2026-05-28 23:00:48,925",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9003
          },
          {
            "timestamp": "2026-05-28 23:00:49,941",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9004
          },
          {
            "timestamp": "2026-05-28 23:00:49,941",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9005
          },
          {
            "timestamp": "2026-05-28 23:00:49,941",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9006
          },
          {
            "timestamp": "2026-05-28 23:00:50,956",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9007
          },
          {
            "timestamp": "2026-05-28 23:00:50,956",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9008
          },
          {
            "timestamp": "2026-05-28 23:00:50,972",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9009
          },
          {
            "timestamp": "2026-05-28 23:00:51,550",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9010
          },
          {
            "timestamp": "2026-05-28 23:00:51,550",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 9011
          },
          {
            "timestamp": "2026-05-28 23:00:51,550",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9012
          },
          {
            "timestamp": "2026-05-28 23:00:51,550",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9013
          },
          {
            "timestamp": "2026-05-28 23:00:51,550",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 9014
          },
          {
            "timestamp": "2026-05-28 23:00:51,550",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9015
          },
          {
            "timestamp": "2026-05-28 23:00:51,550",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9016
          },
          {
            "timestamp": "2026-05-28 23:00:51,550",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "13"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9017
          },
          {
            "timestamp": "2026-05-28 23:00:51,550",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 9018
          },
          {
            "timestamp": "2026-05-28 23:00:51,550",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9019
          },
          {
            "timestamp": "2026-05-28 23:00:51,550",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "14"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9020
          },
          {
            "timestamp": "2026-05-28 23:00:51,550",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 9021
          },
          {
            "timestamp": "2026-05-28 23:00:51,988",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9022
          },
          {
            "timestamp": "2026-05-28 23:00:51,988",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9023
          },
          {
            "timestamp": "2026-05-28 23:00:51,988",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9024
          },
          {
            "timestamp": "2026-05-28 23:00:53,003",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9025
          },
          {
            "timestamp": "2026-05-28 23:00:53,019",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9026
          },
          {
            "timestamp": "2026-05-28 23:00:53,019",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9027
          },
          {
            "timestamp": "2026-05-28 23:00:54,019",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9028
          },
          {
            "timestamp": "2026-05-28 23:00:54,019",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9029
          },
          {
            "timestamp": "2026-05-28 23:00:54,019",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9030
          },
          {
            "timestamp": "2026-05-28 23:00:55,035",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9031
          },
          {
            "timestamp": "2026-05-28 23:00:55,035",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9032
          },
          {
            "timestamp": "2026-05-28 23:00:55,035",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9033
          },
          {
            "timestamp": "2026-05-28 23:00:56,035",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9034
          },
          {
            "timestamp": "2026-05-28 23:00:56,035",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9035
          },
          {
            "timestamp": "2026-05-28 23:00:56,035",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9036
          },
          {
            "timestamp": "2026-05-28 23:00:56,566",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9037
          },
          {
            "timestamp": "2026-05-28 23:00:56,566",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 9038
          },
          {
            "timestamp": "2026-05-28 23:00:56,566",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9039
          },
          {
            "timestamp": "2026-05-28 23:00:56,566",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9040
          },
          {
            "timestamp": "2026-05-28 23:00:56,566",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 9041
          },
          {
            "timestamp": "2026-05-28 23:00:56,566",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9042
          },
          {
            "timestamp": "2026-05-28 23:00:56,566",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9043
          },
          {
            "timestamp": "2026-05-28 23:00:56,566",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "14"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9044
          },
          {
            "timestamp": "2026-05-28 23:00:56,566",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 9045
          },
          {
            "timestamp": "2026-05-28 23:00:56,566",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9046
          },
          {
            "timestamp": "2026-05-28 23:00:56,566",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "15"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9047
          },
          {
            "timestamp": "2026-05-28 23:00:56,566",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 9048
          },
          {
            "timestamp": "2026-05-28 23:00:57,050",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9049
          },
          {
            "timestamp": "2026-05-28 23:00:57,050",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9050
          },
          {
            "timestamp": "2026-05-28 23:00:57,050",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9051
          },
          {
            "timestamp": "2026-05-28 23:00:58,066",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9052
          },
          {
            "timestamp": "2026-05-28 23:00:58,066",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9053
          },
          {
            "timestamp": "2026-05-28 23:00:58,066",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9054
          },
          {
            "timestamp": "2026-05-28 23:00:59,066",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9055
          },
          {
            "timestamp": "2026-05-28 23:00:59,066",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9056
          },
          {
            "timestamp": "2026-05-28 23:00:59,066",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9057
          },
          {
            "timestamp": "2026-05-28 23:01:00,066",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9058
          },
          {
            "timestamp": "2026-05-28 23:01:00,066",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9059
          },
          {
            "timestamp": "2026-05-28 23:01:00,066",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9060
          },
          {
            "timestamp": "2026-05-28 23:01:01,066",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9061
          },
          {
            "timestamp": "2026-05-28 23:01:01,066",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9062
          },
          {
            "timestamp": "2026-05-28 23:01:01,066",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9063
          },
          {
            "timestamp": "2026-05-28 23:01:01,581",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9064
          },
          {
            "timestamp": "2026-05-28 23:01:01,581",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 9065
          },
          {
            "timestamp": "2026-05-28 23:01:01,581",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9066
          },
          {
            "timestamp": "2026-05-28 23:01:01,581",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9067
          },
          {
            "timestamp": "2026-05-28 23:01:01,581",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 9068
          },
          {
            "timestamp": "2026-05-28 23:01:01,581",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9069
          },
          {
            "timestamp": "2026-05-28 23:01:01,581",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9070
          },
          {
            "timestamp": "2026-05-28 23:01:01,581",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "15"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9071
          },
          {
            "timestamp": "2026-05-28 23:01:01,581",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 9072
          },
          {
            "timestamp": "2026-05-28 23:01:01,581",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9073
          },
          {
            "timestamp": "2026-05-28 23:01:01,581",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "16"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9074
          },
          {
            "timestamp": "2026-05-28 23:01:01,581",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 9075
          },
          {
            "timestamp": "2026-05-28 23:01:02,066",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9076
          },
          {
            "timestamp": "2026-05-28 23:01:02,066",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9077
          },
          {
            "timestamp": "2026-05-28 23:01:02,066",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9078
          },
          {
            "timestamp": "2026-05-28 23:01:03,081",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9079
          },
          {
            "timestamp": "2026-05-28 23:01:03,081",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9080
          },
          {
            "timestamp": "2026-05-28 23:01:03,081",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9081
          },
          {
            "timestamp": "2026-05-28 23:01:04,081",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9082
          },
          {
            "timestamp": "2026-05-28 23:01:04,081",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9083
          },
          {
            "timestamp": "2026-05-28 23:01:04,081",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9084
          },
          {
            "timestamp": "2026-05-28 23:01:05,081",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9085
          },
          {
            "timestamp": "2026-05-28 23:01:05,081",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9086
          },
          {
            "timestamp": "2026-05-28 23:01:05,081",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9087
          },
          {
            "timestamp": "2026-05-28 23:01:06,097",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9088
          },
          {
            "timestamp": "2026-05-28 23:01:06,097",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9089
          },
          {
            "timestamp": "2026-05-28 23:01:06,113",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9090
          },
          {
            "timestamp": "2026-05-28 23:01:06,581",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9091
          },
          {
            "timestamp": "2026-05-28 23:01:06,581",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 9092
          },
          {
            "timestamp": "2026-05-28 23:01:06,581",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9093
          },
          {
            "timestamp": "2026-05-28 23:01:06,581",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9094
          },
          {
            "timestamp": "2026-05-28 23:01:06,581",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 9095
          },
          {
            "timestamp": "2026-05-28 23:01:06,581",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9096
          },
          {
            "timestamp": "2026-05-28 23:01:06,581",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9097
          },
          {
            "timestamp": "2026-05-28 23:01:06,581",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9098
          },
          {
            "timestamp": "2026-05-28 23:01:06,581",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 9099
          },
          {
            "timestamp": "2026-05-28 23:01:06,581",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9100
          },
          {
            "timestamp": "2026-05-28 23:01:06,581",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "17"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9101
          },
          {
            "timestamp": "2026-05-28 23:01:06,581",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 9102
          },
          {
            "timestamp": "2026-05-28 23:01:07,113",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9103
          },
          {
            "timestamp": "2026-05-28 23:01:07,113",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9104
          },
          {
            "timestamp": "2026-05-28 23:01:07,113",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9105
          },
          {
            "timestamp": "2026-05-28 23:01:08,113",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9106
          },
          {
            "timestamp": "2026-05-28 23:01:08,113",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9107
          },
          {
            "timestamp": "2026-05-28 23:01:08,113",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9108
          },
          {
            "timestamp": "2026-05-28 23:01:09,128",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9109
          },
          {
            "timestamp": "2026-05-28 23:01:09,128",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9110
          },
          {
            "timestamp": "2026-05-28 23:01:09,128",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9111
          },
          {
            "timestamp": "2026-05-28 23:01:10,160",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9112
          },
          {
            "timestamp": "2026-05-28 23:01:10,160",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9113
          },
          {
            "timestamp": "2026-05-28 23:01:10,160",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9114
          },
          {
            "timestamp": "2026-05-28 23:01:11,175",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9115
          },
          {
            "timestamp": "2026-05-28 23:01:11,175",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9116
          },
          {
            "timestamp": "2026-05-28 23:01:11,191",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9117
          },
          {
            "timestamp": "2026-05-28 23:01:11,581",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9118
          },
          {
            "timestamp": "2026-05-28 23:01:11,581",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9119
          },
          {
            "timestamp": "2026-05-28 23:01:11,581",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9120
          },
          {
            "timestamp": "2026-05-28 23:01:11,581",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9121
          },
          {
            "timestamp": "2026-05-28 23:01:11,581",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9122
          },
          {
            "timestamp": "2026-05-28 23:01:11,581",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9123
          },
          {
            "timestamp": "2026-05-28 23:01:11,581",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9124
          },
          {
            "timestamp": "2026-05-28 23:01:11,581",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "17"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9125
          },
          {
            "timestamp": "2026-05-28 23:01:11,581",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9126
          },
          {
            "timestamp": "2026-05-28 23:01:11,581",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9127
          },
          {
            "timestamp": "2026-05-28 23:01:11,581",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "18"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9128
          },
          {
            "timestamp": "2026-05-28 23:01:11,581",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9129
          },
          {
            "timestamp": "2026-05-28 23:01:12,206",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9130
          },
          {
            "timestamp": "2026-05-28 23:01:12,222",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9131
          },
          {
            "timestamp": "2026-05-28 23:01:12,222",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9132
          },
          {
            "timestamp": "2026-05-28 23:01:13,066",
            "thread_id": "7468",
            "caller": "0x76c1fc08",
            "parentcaller": "0x76c1fabd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 9133
          },
          {
            "timestamp": "2026-05-28 23:01:13,066",
            "thread_id": "7468",
            "caller": "0x76c1fc08",
            "parentcaller": "0x76c1fabd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 9134
          },
          {
            "timestamp": "2026-05-28 23:01:13,238",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9135
          },
          {
            "timestamp": "2026-05-28 23:01:13,238",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9136
          },
          {
            "timestamp": "2026-05-28 23:01:13,253",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9137
          },
          {
            "timestamp": "2026-05-28 23:01:14,269",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9138
          },
          {
            "timestamp": "2026-05-28 23:01:14,269",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9139
          },
          {
            "timestamp": "2026-05-28 23:01:14,269",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9140
          },
          {
            "timestamp": "2026-05-28 23:01:15,269",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9141
          },
          {
            "timestamp": "2026-05-28 23:01:15,269",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9142
          },
          {
            "timestamp": "2026-05-28 23:01:15,285",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9143
          },
          {
            "timestamp": "2026-05-28 23:01:16,285",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9144
          },
          {
            "timestamp": "2026-05-28 23:01:16,285",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9145
          },
          {
            "timestamp": "2026-05-28 23:01:16,285",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9146
          },
          {
            "timestamp": "2026-05-28 23:01:16,581",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9147
          },
          {
            "timestamp": "2026-05-28 23:01:16,581",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 9148
          },
          {
            "timestamp": "2026-05-28 23:01:16,581",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9149
          },
          {
            "timestamp": "2026-05-28 23:01:16,581",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9150
          },
          {
            "timestamp": "2026-05-28 23:01:16,581",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 9151
          },
          {
            "timestamp": "2026-05-28 23:01:16,581",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9152
          },
          {
            "timestamp": "2026-05-28 23:01:16,581",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9153
          },
          {
            "timestamp": "2026-05-28 23:01:16,581",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "18"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9154
          },
          {
            "timestamp": "2026-05-28 23:01:16,581",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 9155
          },
          {
            "timestamp": "2026-05-28 23:01:16,581",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9156
          },
          {
            "timestamp": "2026-05-28 23:01:16,581",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "19"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9157
          },
          {
            "timestamp": "2026-05-28 23:01:16,581",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 9158
          },
          {
            "timestamp": "2026-05-28 23:01:17,285",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9159
          },
          {
            "timestamp": "2026-05-28 23:01:17,300",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9160
          },
          {
            "timestamp": "2026-05-28 23:01:17,300",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9161
          },
          {
            "timestamp": "2026-05-28 23:01:18,316",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9162
          },
          {
            "timestamp": "2026-05-28 23:01:18,316",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9163
          },
          {
            "timestamp": "2026-05-28 23:01:18,316",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9164
          },
          {
            "timestamp": "2026-05-28 23:01:19,331",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9165
          },
          {
            "timestamp": "2026-05-28 23:01:19,331",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9166
          },
          {
            "timestamp": "2026-05-28 23:01:19,347",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9167
          },
          {
            "timestamp": "2026-05-28 23:01:20,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9168
          },
          {
            "timestamp": "2026-05-28 23:01:20,363",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9169
          },
          {
            "timestamp": "2026-05-28 23:01:20,363",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9170
          },
          {
            "timestamp": "2026-05-28 23:01:21,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9171
          },
          {
            "timestamp": "2026-05-28 23:01:21,363",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9172
          },
          {
            "timestamp": "2026-05-28 23:01:21,363",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9173
          },
          {
            "timestamp": "2026-05-28 23:01:21,363",
            "thread_id": "7468",
            "caller": "0x69b9ec3a",
            "parentcaller": "0x69b9ebfd",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9174
          },
          {
            "timestamp": "2026-05-28 23:01:21,597",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9175
          },
          {
            "timestamp": "2026-05-28 23:01:21,597",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9176
          },
          {
            "timestamp": "2026-05-28 23:01:21,597",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9177
          },
          {
            "timestamp": "2026-05-28 23:01:21,597",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9178
          },
          {
            "timestamp": "2026-05-28 23:01:21,597",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9179
          },
          {
            "timestamp": "2026-05-28 23:01:21,597",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9180
          },
          {
            "timestamp": "2026-05-28 23:01:21,597",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9181
          },
          {
            "timestamp": "2026-05-28 23:01:21,597",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "19"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9182
          },
          {
            "timestamp": "2026-05-28 23:01:21,597",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9183
          },
          {
            "timestamp": "2026-05-28 23:01:21,597",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9184
          },
          {
            "timestamp": "2026-05-28 23:01:21,597",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "20"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9185
          },
          {
            "timestamp": "2026-05-28 23:01:21,597",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9186
          },
          {
            "timestamp": "2026-05-28 23:01:22,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9187
          },
          {
            "timestamp": "2026-05-28 23:01:22,363",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9188
          },
          {
            "timestamp": "2026-05-28 23:01:22,363",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9189
          },
          {
            "timestamp": "2026-05-28 23:01:23,378",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9190
          },
          {
            "timestamp": "2026-05-28 23:01:23,378",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9191
          },
          {
            "timestamp": "2026-05-28 23:01:23,378",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9192
          },
          {
            "timestamp": "2026-05-28 23:01:24,378",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9193
          },
          {
            "timestamp": "2026-05-28 23:01:24,378",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9194
          },
          {
            "timestamp": "2026-05-28 23:01:24,378",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9195
          },
          {
            "timestamp": "2026-05-28 23:01:25,378",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9196
          },
          {
            "timestamp": "2026-05-28 23:01:25,378",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9197
          },
          {
            "timestamp": "2026-05-28 23:01:25,378",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9198
          },
          {
            "timestamp": "2026-05-28 23:01:26,394",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9199
          },
          {
            "timestamp": "2026-05-28 23:01:26,394",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9200
          },
          {
            "timestamp": "2026-05-28 23:01:26,394",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9201
          },
          {
            "timestamp": "2026-05-28 23:01:26,597",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9202
          },
          {
            "timestamp": "2026-05-28 23:01:26,597",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 9203
          },
          {
            "timestamp": "2026-05-28 23:01:26,597",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9204
          },
          {
            "timestamp": "2026-05-28 23:01:26,597",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9205
          },
          {
            "timestamp": "2026-05-28 23:01:26,597",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 9206
          },
          {
            "timestamp": "2026-05-28 23:01:26,597",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9207
          },
          {
            "timestamp": "2026-05-28 23:01:26,597",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9208
          },
          {
            "timestamp": "2026-05-28 23:01:26,597",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "20"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9209
          },
          {
            "timestamp": "2026-05-28 23:01:26,597",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 9210
          },
          {
            "timestamp": "2026-05-28 23:01:26,597",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9211
          },
          {
            "timestamp": "2026-05-28 23:01:26,597",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "21"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9212
          },
          {
            "timestamp": "2026-05-28 23:01:26,597",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 9213
          },
          {
            "timestamp": "2026-05-28 23:01:27,394",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9214
          },
          {
            "timestamp": "2026-05-28 23:01:27,394",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9215
          },
          {
            "timestamp": "2026-05-28 23:01:27,394",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9216
          },
          {
            "timestamp": "2026-05-28 23:01:28,394",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9217
          },
          {
            "timestamp": "2026-05-28 23:01:28,394",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9218
          },
          {
            "timestamp": "2026-05-28 23:01:28,394",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9219
          },
          {
            "timestamp": "2026-05-28 23:01:29,410",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9220
          },
          {
            "timestamp": "2026-05-28 23:01:29,410",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9221
          },
          {
            "timestamp": "2026-05-28 23:01:29,410",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9222
          },
          {
            "timestamp": "2026-05-28 23:01:30,410",
            "thread_id": "7468",
            "caller": "0x69b9b181",
            "parentcaller": "0x69b9b062",
            "category": "network",
            "api": "shutdown",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1764"
              },
              {
                "name": "how",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 9223
          },
          {
            "timestamp": "2026-05-28 23:01:30,410",
            "thread_id": "7468",
            "caller": "0x69b9b188",
            "parentcaller": "0x69b9b062",
            "category": "network",
            "api": "closesocket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1764"
              }
            ],
            "repeated": 0,
            "id": 9224
          },
          {
            "timestamp": "2026-05-28 23:01:30,410",
            "thread_id": "7468",
            "caller": "0x69b9b181",
            "parentcaller": "0x69b9b062",
            "category": "network",
            "api": "shutdown",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              },
              {
                "name": "how",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 9225
          },
          {
            "timestamp": "2026-05-28 23:01:30,410",
            "thread_id": "7468",
            "caller": "0x69b9b188",
            "parentcaller": "0x69b9b062",
            "category": "network",
            "api": "closesocket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1724"
              }
            ],
            "repeated": 0,
            "id": 9226
          },
          {
            "timestamp": "2026-05-28 23:01:30,410",
            "thread_id": "7468",
            "caller": "0x69b9b181",
            "parentcaller": "0x69b9b062",
            "category": "network",
            "api": "shutdown",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1328"
              },
              {
                "name": "how",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 9227
          },
          {
            "timestamp": "2026-05-28 23:01:30,410",
            "thread_id": "7468",
            "caller": "0x69b9b188",
            "parentcaller": "0x69b9b062",
            "category": "network",
            "api": "closesocket",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "socket",
                "value": "1328"
              }
            ],
            "repeated": 0,
            "id": 9228
          },
          {
            "timestamp": "2026-05-28 23:01:30,410",
            "thread_id": "6324",
            "caller": "0x74d98526",
            "parentcaller": "0x74da2dca",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xd0\\xcd\\x00,\\x17\\x00\\x00\\xb4\\x18\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "6324"
              }
            ],
            "repeated": 0,
            "id": 9229
          },
          {
            "timestamp": "2026-05-28 23:01:30,410",
            "thread_id": "6328",
            "caller": "0x74d98526",
            "parentcaller": "0x74da2dca",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\xce\\x00,\\x17\\x00\\x00\\xb8\\x18\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "6328"
              }
            ],
            "repeated": 0,
            "id": 9230
          },
          {
            "timestamp": "2026-05-28 23:01:30,410",
            "thread_id": "7472",
            "caller": "0x74d9788f",
            "parentcaller": "0x74da1c3f",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xf0\\xce\\x00,\\x17\\x00\\x000\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7472"
              }
            ],
            "repeated": 0,
            "id": 9231
          },
          {
            "timestamp": "2026-05-28 23:01:30,410",
            "thread_id": "7472",
            "caller": "0x74d98526",
            "parentcaller": "0x74da2dca",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\xf0\\xce\\x00,\\x17\\x00\\x000\\x1d\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7472"
              }
            ],
            "repeated": 0,
            "id": 9232
          },
          {
            "timestamp": "2026-05-28 23:01:30,425",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9233
          },
          {
            "timestamp": "2026-05-28 23:01:30,425",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9234
          },
          {
            "timestamp": "2026-05-28 23:01:30,441",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9235
          },
          {
            "timestamp": "2026-05-28 23:01:31,441",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9236
          },
          {
            "timestamp": "2026-05-28 23:01:31,441",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9237
          },
          {
            "timestamp": "2026-05-28 23:01:31,441",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9238
          },
          {
            "timestamp": "2026-05-28 23:01:31,613",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9239
          },
          {
            "timestamp": "2026-05-28 23:01:31,613",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9240
          },
          {
            "timestamp": "2026-05-28 23:01:31,613",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9241
          },
          {
            "timestamp": "2026-05-28 23:01:31,613",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9242
          },
          {
            "timestamp": "2026-05-28 23:01:31,613",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9243
          },
          {
            "timestamp": "2026-05-28 23:01:31,613",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9244
          },
          {
            "timestamp": "2026-05-28 23:01:31,613",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9245
          },
          {
            "timestamp": "2026-05-28 23:01:31,613",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "21"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9246
          },
          {
            "timestamp": "2026-05-28 23:01:31,613",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9247
          },
          {
            "timestamp": "2026-05-28 23:01:31,613",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9248
          },
          {
            "timestamp": "2026-05-28 23:01:31,613",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "22"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9249
          },
          {
            "timestamp": "2026-05-28 23:01:31,613",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9250
          },
          {
            "timestamp": "2026-05-28 23:01:32,456",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9251
          },
          {
            "timestamp": "2026-05-28 23:01:32,456",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9252
          },
          {
            "timestamp": "2026-05-28 23:01:32,456",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9253
          },
          {
            "timestamp": "2026-05-28 23:01:33,456",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9254
          },
          {
            "timestamp": "2026-05-28 23:01:33,456",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9255
          },
          {
            "timestamp": "2026-05-28 23:01:33,456",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9256
          },
          {
            "timestamp": "2026-05-28 23:01:34,456",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9257
          },
          {
            "timestamp": "2026-05-28 23:01:34,456",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9258
          },
          {
            "timestamp": "2026-05-28 23:01:34,456",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9259
          },
          {
            "timestamp": "2026-05-28 23:01:35,472",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9260
          },
          {
            "timestamp": "2026-05-28 23:01:35,472",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9261
          },
          {
            "timestamp": "2026-05-28 23:01:35,472",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9262
          },
          {
            "timestamp": "2026-05-28 23:01:36,472",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9263
          },
          {
            "timestamp": "2026-05-28 23:01:36,472",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9264
          },
          {
            "timestamp": "2026-05-28 23:01:36,472",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9265
          },
          {
            "timestamp": "2026-05-28 23:01:36,628",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9266
          },
          {
            "timestamp": "2026-05-28 23:01:36,628",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9267
          },
          {
            "timestamp": "2026-05-28 23:01:36,628",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9268
          },
          {
            "timestamp": "2026-05-28 23:01:36,628",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9269
          },
          {
            "timestamp": "2026-05-28 23:01:36,628",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9270
          },
          {
            "timestamp": "2026-05-28 23:01:36,628",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9271
          },
          {
            "timestamp": "2026-05-28 23:01:36,628",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9272
          },
          {
            "timestamp": "2026-05-28 23:01:36,628",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "22"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9273
          },
          {
            "timestamp": "2026-05-28 23:01:36,628",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9274
          },
          {
            "timestamp": "2026-05-28 23:01:36,628",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9275
          },
          {
            "timestamp": "2026-05-28 23:01:36,628",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "23"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9276
          },
          {
            "timestamp": "2026-05-28 23:01:36,628",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9277
          },
          {
            "timestamp": "2026-05-28 23:01:36,972",
            "thread_id": "7472",
            "caller": "0x69b9ec3a",
            "parentcaller": "0x69b9ebfd",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 9278
          },
          {
            "timestamp": "2026-05-28 23:01:37,488",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9279
          },
          {
            "timestamp": "2026-05-28 23:01:37,488",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9280
          },
          {
            "timestamp": "2026-05-28 23:01:38,503",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9281
          },
          {
            "timestamp": "2026-05-28 23:01:38,503",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9282
          },
          {
            "timestamp": "2026-05-28 23:01:38,503",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9283
          },
          {
            "timestamp": "2026-05-28 23:01:39,519",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9284
          },
          {
            "timestamp": "2026-05-28 23:01:39,519",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9285
          },
          {
            "timestamp": "2026-05-28 23:01:39,519",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9286
          },
          {
            "timestamp": "2026-05-28 23:01:40,519",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9287
          },
          {
            "timestamp": "2026-05-28 23:01:40,519",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9288
          },
          {
            "timestamp": "2026-05-28 23:01:40,535",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9289
          },
          {
            "timestamp": "2026-05-28 23:01:41,550",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9290
          },
          {
            "timestamp": "2026-05-28 23:01:41,550",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9291
          },
          {
            "timestamp": "2026-05-28 23:01:41,550",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9292
          },
          {
            "timestamp": "2026-05-28 23:01:41,644",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9293
          },
          {
            "timestamp": "2026-05-28 23:01:41,644",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9294
          },
          {
            "timestamp": "2026-05-28 23:01:41,644",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9295
          },
          {
            "timestamp": "2026-05-28 23:01:41,644",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9296
          },
          {
            "timestamp": "2026-05-28 23:01:41,644",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9297
          },
          {
            "timestamp": "2026-05-28 23:01:41,644",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9298
          },
          {
            "timestamp": "2026-05-28 23:01:41,644",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9299
          },
          {
            "timestamp": "2026-05-28 23:01:41,644",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "23"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9300
          },
          {
            "timestamp": "2026-05-28 23:01:41,644",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9301
          },
          {
            "timestamp": "2026-05-28 23:01:41,644",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9302
          },
          {
            "timestamp": "2026-05-28 23:01:41,644",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "24"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9303
          },
          {
            "timestamp": "2026-05-28 23:01:41,644",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9304
          },
          {
            "timestamp": "2026-05-28 23:01:42,566",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9305
          },
          {
            "timestamp": "2026-05-28 23:01:42,566",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9306
          },
          {
            "timestamp": "2026-05-28 23:01:42,566",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9307
          },
          {
            "timestamp": "2026-05-28 23:01:43,581",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9308
          },
          {
            "timestamp": "2026-05-28 23:01:43,581",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9309
          },
          {
            "timestamp": "2026-05-28 23:01:43,581",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9310
          },
          {
            "timestamp": "2026-05-28 23:01:44,581",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9311
          },
          {
            "timestamp": "2026-05-28 23:01:44,581",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9312
          },
          {
            "timestamp": "2026-05-28 23:01:44,581",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9313
          },
          {
            "timestamp": "2026-05-28 23:01:45,597",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9314
          },
          {
            "timestamp": "2026-05-28 23:01:45,597",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9315
          },
          {
            "timestamp": "2026-05-28 23:01:45,597",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9316
          },
          {
            "timestamp": "2026-05-28 23:01:46,597",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9317
          },
          {
            "timestamp": "2026-05-28 23:01:46,597",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9318
          },
          {
            "timestamp": "2026-05-28 23:01:46,597",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9319
          },
          {
            "timestamp": "2026-05-28 23:01:46,660",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9320
          },
          {
            "timestamp": "2026-05-28 23:01:46,660",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9321
          },
          {
            "timestamp": "2026-05-28 23:01:46,660",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9322
          },
          {
            "timestamp": "2026-05-28 23:01:46,660",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9323
          },
          {
            "timestamp": "2026-05-28 23:01:46,660",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9324
          },
          {
            "timestamp": "2026-05-28 23:01:46,660",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9325
          },
          {
            "timestamp": "2026-05-28 23:01:46,660",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9326
          },
          {
            "timestamp": "2026-05-28 23:01:46,660",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "24"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9327
          },
          {
            "timestamp": "2026-05-28 23:01:46,660",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9328
          },
          {
            "timestamp": "2026-05-28 23:01:46,660",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9329
          },
          {
            "timestamp": "2026-05-28 23:01:46,660",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "25"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9330
          },
          {
            "timestamp": "2026-05-28 23:01:46,660",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9331
          },
          {
            "timestamp": "2026-05-28 23:01:47,613",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9332
          },
          {
            "timestamp": "2026-05-28 23:01:47,613",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9333
          },
          {
            "timestamp": "2026-05-28 23:01:47,613",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9334
          },
          {
            "timestamp": "2026-05-28 23:01:48,613",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9335
          },
          {
            "timestamp": "2026-05-28 23:01:48,613",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9336
          },
          {
            "timestamp": "2026-05-28 23:01:48,613",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9337
          },
          {
            "timestamp": "2026-05-28 23:01:49,628",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9338
          },
          {
            "timestamp": "2026-05-28 23:01:49,628",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9339
          },
          {
            "timestamp": "2026-05-28 23:01:49,628",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9340
          },
          {
            "timestamp": "2026-05-28 23:01:50,644",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9341
          },
          {
            "timestamp": "2026-05-28 23:01:50,644",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9342
          },
          {
            "timestamp": "2026-05-28 23:01:50,644",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9343
          },
          {
            "timestamp": "2026-05-28 23:01:51,644",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9344
          },
          {
            "timestamp": "2026-05-28 23:01:51,644",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9345
          },
          {
            "timestamp": "2026-05-28 23:01:51,644",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9346
          },
          {
            "timestamp": "2026-05-28 23:01:51,675",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9347
          },
          {
            "timestamp": "2026-05-28 23:01:51,675",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9348
          },
          {
            "timestamp": "2026-05-28 23:01:51,675",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9349
          },
          {
            "timestamp": "2026-05-28 23:01:51,675",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9350
          },
          {
            "timestamp": "2026-05-28 23:01:51,675",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9351
          },
          {
            "timestamp": "2026-05-28 23:01:51,675",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9352
          },
          {
            "timestamp": "2026-05-28 23:01:51,675",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9353
          },
          {
            "timestamp": "2026-05-28 23:01:51,675",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "25"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9354
          },
          {
            "timestamp": "2026-05-28 23:01:51,675",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9355
          },
          {
            "timestamp": "2026-05-28 23:01:51,675",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9356
          },
          {
            "timestamp": "2026-05-28 23:01:51,675",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "26"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9357
          },
          {
            "timestamp": "2026-05-28 23:01:51,675",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9358
          },
          {
            "timestamp": "2026-05-28 23:01:52,644",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9359
          },
          {
            "timestamp": "2026-05-28 23:01:52,644",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9360
          },
          {
            "timestamp": "2026-05-28 23:01:52,644",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9361
          },
          {
            "timestamp": "2026-05-28 23:01:53,660",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9362
          },
          {
            "timestamp": "2026-05-28 23:01:53,660",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9363
          },
          {
            "timestamp": "2026-05-28 23:01:53,660",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9364
          },
          {
            "timestamp": "2026-05-28 23:01:54,675",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9365
          },
          {
            "timestamp": "2026-05-28 23:01:54,675",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9366
          },
          {
            "timestamp": "2026-05-28 23:01:54,675",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9367
          },
          {
            "timestamp": "2026-05-28 23:01:55,675",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9368
          },
          {
            "timestamp": "2026-05-28 23:01:55,675",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9369
          },
          {
            "timestamp": "2026-05-28 23:01:55,675",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9370
          },
          {
            "timestamp": "2026-05-28 23:01:56,675",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9371
          },
          {
            "timestamp": "2026-05-28 23:01:56,675",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9372
          },
          {
            "timestamp": "2026-05-28 23:01:56,675",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9373
          },
          {
            "timestamp": "2026-05-28 23:01:56,675",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9374
          },
          {
            "timestamp": "2026-05-28 23:01:56,675",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9375
          },
          {
            "timestamp": "2026-05-28 23:01:56,675",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9376
          },
          {
            "timestamp": "2026-05-28 23:01:56,675",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9377
          },
          {
            "timestamp": "2026-05-28 23:01:56,675",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "26"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9378
          },
          {
            "timestamp": "2026-05-28 23:01:56,675",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9379
          },
          {
            "timestamp": "2026-05-28 23:01:56,675",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9380
          },
          {
            "timestamp": "2026-05-28 23:01:56,675",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "27"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9381
          },
          {
            "timestamp": "2026-05-28 23:01:56,675",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9382
          },
          {
            "timestamp": "2026-05-28 23:01:56,691",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9383
          },
          {
            "timestamp": "2026-05-28 23:01:56,691",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9384
          },
          {
            "timestamp": "2026-05-28 23:01:56,691",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9385
          },
          {
            "timestamp": "2026-05-28 23:01:57,706",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9386
          },
          {
            "timestamp": "2026-05-28 23:01:57,706",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9387
          },
          {
            "timestamp": "2026-05-28 23:01:57,722",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9388
          },
          {
            "timestamp": "2026-05-28 23:01:58,722",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9389
          },
          {
            "timestamp": "2026-05-28 23:01:58,722",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9390
          },
          {
            "timestamp": "2026-05-28 23:01:58,722",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9391
          },
          {
            "timestamp": "2026-05-28 23:01:59,738",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9392
          },
          {
            "timestamp": "2026-05-28 23:01:59,738",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9393
          },
          {
            "timestamp": "2026-05-28 23:01:59,738",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9394
          },
          {
            "timestamp": "2026-05-28 23:02:00,753",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9395
          },
          {
            "timestamp": "2026-05-28 23:02:00,753",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9396
          },
          {
            "timestamp": "2026-05-28 23:02:00,753",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9397
          },
          {
            "timestamp": "2026-05-28 23:02:01,691",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9398
          },
          {
            "timestamp": "2026-05-28 23:02:01,691",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9399
          },
          {
            "timestamp": "2026-05-28 23:02:01,691",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9400
          },
          {
            "timestamp": "2026-05-28 23:02:01,691",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9401
          },
          {
            "timestamp": "2026-05-28 23:02:01,691",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9402
          },
          {
            "timestamp": "2026-05-28 23:02:01,691",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9403
          },
          {
            "timestamp": "2026-05-28 23:02:01,691",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9404
          },
          {
            "timestamp": "2026-05-28 23:02:01,691",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "27"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9405
          },
          {
            "timestamp": "2026-05-28 23:02:01,691",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9406
          },
          {
            "timestamp": "2026-05-28 23:02:01,691",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9407
          },
          {
            "timestamp": "2026-05-28 23:02:01,691",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "28"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9408
          },
          {
            "timestamp": "2026-05-28 23:02:01,691",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9409
          },
          {
            "timestamp": "2026-05-28 23:02:01,769",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9410
          },
          {
            "timestamp": "2026-05-28 23:02:01,769",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9411
          },
          {
            "timestamp": "2026-05-28 23:02:01,785",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9412
          },
          {
            "timestamp": "2026-05-28 23:02:02,800",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9413
          },
          {
            "timestamp": "2026-05-28 23:02:02,800",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9414
          },
          {
            "timestamp": "2026-05-28 23:02:02,816",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9415
          },
          {
            "timestamp": "2026-05-28 23:02:03,831",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9416
          },
          {
            "timestamp": "2026-05-28 23:02:03,831",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9417
          },
          {
            "timestamp": "2026-05-28 23:02:03,831",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9418
          },
          {
            "timestamp": "2026-05-28 23:02:04,831",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9419
          },
          {
            "timestamp": "2026-05-28 23:02:04,831",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9420
          },
          {
            "timestamp": "2026-05-28 23:02:04,831",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9421
          },
          {
            "timestamp": "2026-05-28 23:02:05,847",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9422
          },
          {
            "timestamp": "2026-05-28 23:02:05,847",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9423
          },
          {
            "timestamp": "2026-05-28 23:02:05,847",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9424
          },
          {
            "timestamp": "2026-05-28 23:02:06,706",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9425
          },
          {
            "timestamp": "2026-05-28 23:02:06,706",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9426
          },
          {
            "timestamp": "2026-05-28 23:02:06,706",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9427
          },
          {
            "timestamp": "2026-05-28 23:02:06,706",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9428
          },
          {
            "timestamp": "2026-05-28 23:02:06,706",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9429
          },
          {
            "timestamp": "2026-05-28 23:02:06,706",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9430
          },
          {
            "timestamp": "2026-05-28 23:02:06,706",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9431
          },
          {
            "timestamp": "2026-05-28 23:02:06,706",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "28"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9432
          },
          {
            "timestamp": "2026-05-28 23:02:06,706",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9433
          },
          {
            "timestamp": "2026-05-28 23:02:06,706",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9434
          },
          {
            "timestamp": "2026-05-28 23:02:06,706",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "29"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9435
          },
          {
            "timestamp": "2026-05-28 23:02:06,706",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9436
          },
          {
            "timestamp": "2026-05-28 23:02:06,863",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9437
          },
          {
            "timestamp": "2026-05-28 23:02:06,863",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9438
          },
          {
            "timestamp": "2026-05-28 23:02:06,863",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9439
          },
          {
            "timestamp": "2026-05-28 23:02:07,894",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9440
          },
          {
            "timestamp": "2026-05-28 23:02:07,894",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9441
          },
          {
            "timestamp": "2026-05-28 23:02:07,894",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9442
          },
          {
            "timestamp": "2026-05-28 23:02:08,910",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9443
          },
          {
            "timestamp": "2026-05-28 23:02:08,910",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9444
          },
          {
            "timestamp": "2026-05-28 23:02:08,910",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9445
          },
          {
            "timestamp": "2026-05-28 23:02:09,941",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9446
          },
          {
            "timestamp": "2026-05-28 23:02:09,941",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9447
          },
          {
            "timestamp": "2026-05-28 23:02:09,941",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9448
          },
          {
            "timestamp": "2026-05-28 23:02:10,941",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9449
          },
          {
            "timestamp": "2026-05-28 23:02:10,941",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9450
          },
          {
            "timestamp": "2026-05-28 23:02:10,941",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9451
          },
          {
            "timestamp": "2026-05-28 23:02:11,363",
            "thread_id": "7472",
            "caller": "0x69b9ec3a",
            "parentcaller": "0x69b9ebfd",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9452
          },
          {
            "timestamp": "2026-05-28 23:02:11,706",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9453
          },
          {
            "timestamp": "2026-05-28 23:02:11,706",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9454
          },
          {
            "timestamp": "2026-05-28 23:02:11,706",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9455
          },
          {
            "timestamp": "2026-05-28 23:02:11,706",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9456
          },
          {
            "timestamp": "2026-05-28 23:02:11,706",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9457
          },
          {
            "timestamp": "2026-05-28 23:02:11,706",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9458
          },
          {
            "timestamp": "2026-05-28 23:02:11,706",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9459
          },
          {
            "timestamp": "2026-05-28 23:02:11,706",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "29"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9460
          },
          {
            "timestamp": "2026-05-28 23:02:11,706",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9461
          },
          {
            "timestamp": "2026-05-28 23:02:11,706",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9462
          },
          {
            "timestamp": "2026-05-28 23:02:11,706",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "30"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9463
          },
          {
            "timestamp": "2026-05-28 23:02:11,706",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9464
          },
          {
            "timestamp": "2026-05-28 23:02:11,956",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9465
          },
          {
            "timestamp": "2026-05-28 23:02:11,956",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9466
          },
          {
            "timestamp": "2026-05-28 23:02:11,956",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9467
          },
          {
            "timestamp": "2026-05-28 23:02:12,956",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9468
          },
          {
            "timestamp": "2026-05-28 23:02:12,956",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9469
          },
          {
            "timestamp": "2026-05-28 23:02:12,972",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9470
          },
          {
            "timestamp": "2026-05-28 23:02:13,988",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9471
          },
          {
            "timestamp": "2026-05-28 23:02:13,988",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9472
          },
          {
            "timestamp": "2026-05-28 23:02:13,988",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9473
          },
          {
            "timestamp": "2026-05-28 23:02:14,988",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9474
          },
          {
            "timestamp": "2026-05-28 23:02:14,988",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9475
          },
          {
            "timestamp": "2026-05-28 23:02:15,003",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9476
          },
          {
            "timestamp": "2026-05-28 23:02:16,019",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9477
          },
          {
            "timestamp": "2026-05-28 23:02:16,019",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9478
          },
          {
            "timestamp": "2026-05-28 23:02:16,019",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9479
          },
          {
            "timestamp": "2026-05-28 23:02:16,706",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9480
          },
          {
            "timestamp": "2026-05-28 23:02:16,706",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9481
          },
          {
            "timestamp": "2026-05-28 23:02:16,706",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9482
          },
          {
            "timestamp": "2026-05-28 23:02:16,706",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9483
          },
          {
            "timestamp": "2026-05-28 23:02:16,706",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9484
          },
          {
            "timestamp": "2026-05-28 23:02:16,706",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9485
          },
          {
            "timestamp": "2026-05-28 23:02:16,706",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9486
          },
          {
            "timestamp": "2026-05-28 23:02:16,706",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "30"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9487
          },
          {
            "timestamp": "2026-05-28 23:02:16,706",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9488
          },
          {
            "timestamp": "2026-05-28 23:02:16,706",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9489
          },
          {
            "timestamp": "2026-05-28 23:02:16,706",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "31"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9490
          },
          {
            "timestamp": "2026-05-28 23:02:16,706",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9491
          },
          {
            "timestamp": "2026-05-28 23:02:17,019",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9492
          },
          {
            "timestamp": "2026-05-28 23:02:17,019",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9493
          },
          {
            "timestamp": "2026-05-28 23:02:17,019",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9494
          },
          {
            "timestamp": "2026-05-28 23:02:18,019",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9495
          },
          {
            "timestamp": "2026-05-28 23:02:18,019",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9496
          },
          {
            "timestamp": "2026-05-28 23:02:18,019",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9497
          },
          {
            "timestamp": "2026-05-28 23:02:19,019",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9498
          },
          {
            "timestamp": "2026-05-28 23:02:19,019",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9499
          },
          {
            "timestamp": "2026-05-28 23:02:19,019",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9500
          },
          {
            "timestamp": "2026-05-28 23:02:20,035",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9501
          },
          {
            "timestamp": "2026-05-28 23:02:20,035",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9502
          },
          {
            "timestamp": "2026-05-28 23:02:20,035",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9503
          },
          {
            "timestamp": "2026-05-28 23:02:21,035",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9504
          },
          {
            "timestamp": "2026-05-28 23:02:21,035",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9505
          },
          {
            "timestamp": "2026-05-28 23:02:21,035",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9506
          },
          {
            "timestamp": "2026-05-28 23:02:21,706",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9507
          },
          {
            "timestamp": "2026-05-28 23:02:21,706",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9508
          },
          {
            "timestamp": "2026-05-28 23:02:21,706",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9509
          },
          {
            "timestamp": "2026-05-28 23:02:21,706",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9510
          },
          {
            "timestamp": "2026-05-28 23:02:21,706",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9511
          },
          {
            "timestamp": "2026-05-28 23:02:21,706",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9512
          },
          {
            "timestamp": "2026-05-28 23:02:21,706",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9513
          },
          {
            "timestamp": "2026-05-28 23:02:21,706",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "31"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9514
          },
          {
            "timestamp": "2026-05-28 23:02:21,706",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9515
          },
          {
            "timestamp": "2026-05-28 23:02:21,706",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9516
          },
          {
            "timestamp": "2026-05-28 23:02:21,706",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "32"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9517
          },
          {
            "timestamp": "2026-05-28 23:02:21,706",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9518
          },
          {
            "timestamp": "2026-05-28 23:02:22,050",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9519
          },
          {
            "timestamp": "2026-05-28 23:02:22,050",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9520
          },
          {
            "timestamp": "2026-05-28 23:02:22,050",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9521
          },
          {
            "timestamp": "2026-05-28 23:02:23,050",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9522
          },
          {
            "timestamp": "2026-05-28 23:02:23,050",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9523
          },
          {
            "timestamp": "2026-05-28 23:02:23,050",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9524
          },
          {
            "timestamp": "2026-05-28 23:02:24,050",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9525
          },
          {
            "timestamp": "2026-05-28 23:02:24,050",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9526
          },
          {
            "timestamp": "2026-05-28 23:02:24,050",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9527
          },
          {
            "timestamp": "2026-05-28 23:02:25,066",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9528
          },
          {
            "timestamp": "2026-05-28 23:02:25,066",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9529
          },
          {
            "timestamp": "2026-05-28 23:02:25,066",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9530
          },
          {
            "timestamp": "2026-05-28 23:02:26,081",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9531
          },
          {
            "timestamp": "2026-05-28 23:02:26,081",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9532
          },
          {
            "timestamp": "2026-05-28 23:02:26,081",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9533
          },
          {
            "timestamp": "2026-05-28 23:02:26,706",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9534
          },
          {
            "timestamp": "2026-05-28 23:02:26,706",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9535
          },
          {
            "timestamp": "2026-05-28 23:02:26,706",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9536
          },
          {
            "timestamp": "2026-05-28 23:02:26,706",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9537
          },
          {
            "timestamp": "2026-05-28 23:02:26,706",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9538
          },
          {
            "timestamp": "2026-05-28 23:02:26,706",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9539
          },
          {
            "timestamp": "2026-05-28 23:02:26,706",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9540
          },
          {
            "timestamp": "2026-05-28 23:02:26,706",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9541
          },
          {
            "timestamp": "2026-05-28 23:02:26,706",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9542
          },
          {
            "timestamp": "2026-05-28 23:02:26,706",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9543
          },
          {
            "timestamp": "2026-05-28 23:02:26,706",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "33"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9544
          },
          {
            "timestamp": "2026-05-28 23:02:26,706",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9545
          },
          {
            "timestamp": "2026-05-28 23:02:26,972",
            "thread_id": "7472",
            "caller": "0x69b9ec3a",
            "parentcaller": "0x69b9ebfd",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 9546
          },
          {
            "timestamp": "2026-05-28 23:02:27,097",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9547
          },
          {
            "timestamp": "2026-05-28 23:02:27,097",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9548
          },
          {
            "timestamp": "2026-05-28 23:02:28,113",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9549
          },
          {
            "timestamp": "2026-05-28 23:02:28,113",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9550
          },
          {
            "timestamp": "2026-05-28 23:02:28,113",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9551
          },
          {
            "timestamp": "2026-05-28 23:02:29,113",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9552
          },
          {
            "timestamp": "2026-05-28 23:02:29,113",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9553
          },
          {
            "timestamp": "2026-05-28 23:02:29,128",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9554
          },
          {
            "timestamp": "2026-05-28 23:02:30,128",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9555
          },
          {
            "timestamp": "2026-05-28 23:02:30,128",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9556
          },
          {
            "timestamp": "2026-05-28 23:02:30,128",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9557
          },
          {
            "timestamp": "2026-05-28 23:02:31,144",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9558
          },
          {
            "timestamp": "2026-05-28 23:02:31,144",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9559
          },
          {
            "timestamp": "2026-05-28 23:02:31,144",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9560
          },
          {
            "timestamp": "2026-05-28 23:02:31,722",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9561
          },
          {
            "timestamp": "2026-05-28 23:02:31,722",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9562
          },
          {
            "timestamp": "2026-05-28 23:02:31,722",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9563
          },
          {
            "timestamp": "2026-05-28 23:02:31,722",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9564
          },
          {
            "timestamp": "2026-05-28 23:02:31,722",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9565
          },
          {
            "timestamp": "2026-05-28 23:02:31,722",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9566
          },
          {
            "timestamp": "2026-05-28 23:02:31,722",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9567
          },
          {
            "timestamp": "2026-05-28 23:02:31,722",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "33"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9568
          },
          {
            "timestamp": "2026-05-28 23:02:31,722",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9569
          },
          {
            "timestamp": "2026-05-28 23:02:31,722",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9570
          },
          {
            "timestamp": "2026-05-28 23:02:31,722",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "34"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9571
          },
          {
            "timestamp": "2026-05-28 23:02:31,722",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 9572
          },
          {
            "timestamp": "2026-05-28 23:02:32,144",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9573
          },
          {
            "timestamp": "2026-05-28 23:02:32,144",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9574
          },
          {
            "timestamp": "2026-05-28 23:02:32,144",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9575
          },
          {
            "timestamp": "2026-05-28 23:02:33,160",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9576
          },
          {
            "timestamp": "2026-05-28 23:02:33,160",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9577
          },
          {
            "timestamp": "2026-05-28 23:02:33,175",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9578
          },
          {
            "timestamp": "2026-05-28 23:02:34,191",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9579
          },
          {
            "timestamp": "2026-05-28 23:02:34,191",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9580
          },
          {
            "timestamp": "2026-05-28 23:02:34,191",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9581
          },
          {
            "timestamp": "2026-05-28 23:02:35,222",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9582
          },
          {
            "timestamp": "2026-05-28 23:02:35,222",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9583
          },
          {
            "timestamp": "2026-05-28 23:02:35,222",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9584
          },
          {
            "timestamp": "2026-05-28 23:02:36,222",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9585
          },
          {
            "timestamp": "2026-05-28 23:02:36,222",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9586
          },
          {
            "timestamp": "2026-05-28 23:02:36,222",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9587
          },
          {
            "timestamp": "2026-05-28 23:02:36,722",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9588
          },
          {
            "timestamp": "2026-05-28 23:02:36,722",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9589
          },
          {
            "timestamp": "2026-05-28 23:02:36,722",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9590
          },
          {
            "timestamp": "2026-05-28 23:02:36,722",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9591
          },
          {
            "timestamp": "2026-05-28 23:02:36,722",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9592
          },
          {
            "timestamp": "2026-05-28 23:02:36,722",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9593
          },
          {
            "timestamp": "2026-05-28 23:02:36,722",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9594
          },
          {
            "timestamp": "2026-05-28 23:02:36,722",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "34"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9595
          },
          {
            "timestamp": "2026-05-28 23:02:36,722",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9596
          },
          {
            "timestamp": "2026-05-28 23:02:36,722",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9597
          },
          {
            "timestamp": "2026-05-28 23:02:36,722",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "35"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9598
          },
          {
            "timestamp": "2026-05-28 23:02:36,722",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9599
          },
          {
            "timestamp": "2026-05-28 23:02:37,238",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9600
          },
          {
            "timestamp": "2026-05-28 23:02:37,238",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9601
          },
          {
            "timestamp": "2026-05-28 23:02:37,238",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9602
          },
          {
            "timestamp": "2026-05-28 23:02:38,253",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9603
          },
          {
            "timestamp": "2026-05-28 23:02:38,253",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9604
          },
          {
            "timestamp": "2026-05-28 23:02:38,253",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9605
          },
          {
            "timestamp": "2026-05-28 23:02:39,269",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9606
          },
          {
            "timestamp": "2026-05-28 23:02:39,269",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9607
          },
          {
            "timestamp": "2026-05-28 23:02:39,269",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9608
          },
          {
            "timestamp": "2026-05-28 23:02:40,269",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9609
          },
          {
            "timestamp": "2026-05-28 23:02:40,285",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9610
          },
          {
            "timestamp": "2026-05-28 23:02:40,285",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9611
          },
          {
            "timestamp": "2026-05-28 23:02:41,300",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9612
          },
          {
            "timestamp": "2026-05-28 23:02:41,300",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9613
          },
          {
            "timestamp": "2026-05-28 23:02:41,300",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9614
          },
          {
            "timestamp": "2026-05-28 23:02:41,722",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9615
          },
          {
            "timestamp": "2026-05-28 23:02:41,722",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9616
          },
          {
            "timestamp": "2026-05-28 23:02:41,722",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9617
          },
          {
            "timestamp": "2026-05-28 23:02:41,722",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9618
          },
          {
            "timestamp": "2026-05-28 23:02:41,722",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9619
          },
          {
            "timestamp": "2026-05-28 23:02:41,722",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9620
          },
          {
            "timestamp": "2026-05-28 23:02:41,722",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9621
          },
          {
            "timestamp": "2026-05-28 23:02:41,722",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "35"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9622
          },
          {
            "timestamp": "2026-05-28 23:02:41,722",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9623
          },
          {
            "timestamp": "2026-05-28 23:02:41,722",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9624
          },
          {
            "timestamp": "2026-05-28 23:02:41,722",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "36"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9625
          },
          {
            "timestamp": "2026-05-28 23:02:41,722",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9626
          },
          {
            "timestamp": "2026-05-28 23:02:42,300",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9627
          },
          {
            "timestamp": "2026-05-28 23:02:42,316",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9628
          },
          {
            "timestamp": "2026-05-28 23:02:42,316",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9629
          },
          {
            "timestamp": "2026-05-28 23:02:43,331",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9630
          },
          {
            "timestamp": "2026-05-28 23:02:43,331",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9631
          },
          {
            "timestamp": "2026-05-28 23:02:43,331",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9632
          },
          {
            "timestamp": "2026-05-28 23:02:44,347",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9633
          },
          {
            "timestamp": "2026-05-28 23:02:44,347",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9634
          },
          {
            "timestamp": "2026-05-28 23:02:44,347",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9635
          },
          {
            "timestamp": "2026-05-28 23:02:45,347",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9636
          },
          {
            "timestamp": "2026-05-28 23:02:45,347",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9637
          },
          {
            "timestamp": "2026-05-28 23:02:45,347",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9638
          },
          {
            "timestamp": "2026-05-28 23:02:46,363",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9639
          },
          {
            "timestamp": "2026-05-28 23:02:46,363",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9640
          },
          {
            "timestamp": "2026-05-28 23:02:46,378",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9641
          },
          {
            "timestamp": "2026-05-28 23:02:46,722",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9642
          },
          {
            "timestamp": "2026-05-28 23:02:46,722",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9643
          },
          {
            "timestamp": "2026-05-28 23:02:46,722",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9644
          },
          {
            "timestamp": "2026-05-28 23:02:46,722",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9645
          },
          {
            "timestamp": "2026-05-28 23:02:46,722",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9646
          },
          {
            "timestamp": "2026-05-28 23:02:46,722",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9647
          },
          {
            "timestamp": "2026-05-28 23:02:46,722",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9648
          },
          {
            "timestamp": "2026-05-28 23:02:46,722",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "36"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9649
          },
          {
            "timestamp": "2026-05-28 23:02:46,722",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9650
          },
          {
            "timestamp": "2026-05-28 23:02:46,722",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9651
          },
          {
            "timestamp": "2026-05-28 23:02:46,722",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "37"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9652
          },
          {
            "timestamp": "2026-05-28 23:02:46,722",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9653
          },
          {
            "timestamp": "2026-05-28 23:02:47,378",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9654
          },
          {
            "timestamp": "2026-05-28 23:02:47,378",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9655
          },
          {
            "timestamp": "2026-05-28 23:02:47,378",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9656
          },
          {
            "timestamp": "2026-05-28 23:02:48,394",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9657
          },
          {
            "timestamp": "2026-05-28 23:02:48,394",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9658
          },
          {
            "timestamp": "2026-05-28 23:02:48,394",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9659
          },
          {
            "timestamp": "2026-05-28 23:02:49,394",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9660
          },
          {
            "timestamp": "2026-05-28 23:02:49,394",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9661
          },
          {
            "timestamp": "2026-05-28 23:02:49,394",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9662
          },
          {
            "timestamp": "2026-05-28 23:02:50,394",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9663
          },
          {
            "timestamp": "2026-05-28 23:02:50,394",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9664
          },
          {
            "timestamp": "2026-05-28 23:02:50,394",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9665
          },
          {
            "timestamp": "2026-05-28 23:02:51,410",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9666
          },
          {
            "timestamp": "2026-05-28 23:02:51,410",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9667
          },
          {
            "timestamp": "2026-05-28 23:02:51,410",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9668
          },
          {
            "timestamp": "2026-05-28 23:02:51,722",
            "thread_id": "7460",
            "caller": "0x00f5d2ac",
            "parentcaller": "0x00f5b503",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 9669
          },
          {
            "timestamp": "2026-05-28 23:02:51,722",
            "thread_id": "7460",
            "caller": "0x00f5b57c",
            "parentcaller": "0x00f58bf9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9670
          },
          {
            "timestamp": "2026-05-28 23:02:51,722",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5c664",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9671
          },
          {
            "timestamp": "2026-05-28 23:02:51,722",
            "thread_id": "7460",
            "caller": "0x00f5c68e",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9672
          },
          {
            "timestamp": "2026-05-28 23:02:51,722",
            "thread_id": "7460",
            "caller": "0x00f5c6cb",
            "parentcaller": "0x00f588ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9673
          },
          {
            "timestamp": "2026-05-28 23:02:51,722",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b40e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9674
          },
          {
            "timestamp": "2026-05-28 23:02:51,722",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9675
          },
          {
            "timestamp": "2026-05-28 23:02:51,722",
            "thread_id": "7460",
            "caller": "0x00f5b436",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Data",
                "value": "37"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9676
          },
          {
            "timestamp": "2026-05-28 23:02:51,722",
            "thread_id": "7460",
            "caller": "0x00f5b4d4",
            "parentcaller": "0x00f588c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9677
          },
          {
            "timestamp": "2026-05-28 23:02:51,722",
            "thread_id": "7460",
            "caller": "0x00f5d114",
            "parentcaller": "0x00f5b38b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup\\MoSetup\\Volatile"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
              }
            ],
            "repeated": 0,
            "id": 9678
          },
          {
            "timestamp": "2026-05-28 23:02:51,722",
            "thread_id": "7460",
            "caller": "0x00f5b3b1",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "InstallTicks"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "38"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks"
              }
            ],
            "repeated": 0,
            "id": 9679
          },
          {
            "timestamp": "2026-05-28 23:02:51,722",
            "thread_id": "7460",
            "caller": "0x00f5b3e6",
            "parentcaller": "0x00f58bd2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 9680
          },
          {
            "timestamp": "2026-05-28 23:02:52,410",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9681
          },
          {
            "timestamp": "2026-05-28 23:02:52,410",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9682
          },
          {
            "timestamp": "2026-05-28 23:02:52,410",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9683
          },
          {
            "timestamp": "2026-05-28 23:02:53,425",
            "thread_id": "4312",
            "caller": "0x00f493a0",
            "parentcaller": "0x00f50327",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9684
          },
          {
            "timestamp": "2026-05-28 23:02:53,425",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9685
          },
          {
            "timestamp": "2026-05-28 23:02:53,425",
            "thread_id": "4312",
            "caller": "0x00f4d8d5",
            "parentcaller": "0x00f493a0",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x0003006e"
              },
              {
                "name": "Message",
                "value": "0x000083e8"
              }
            ],
            "repeated": 0,
            "id": 9686
          }
        ],
        "threads": [
          "4312",
          "4136",
          "4152",
          "3884",
          "5096",
          "4316",
          "6320",
          "6324",
          "6328",
          "7420",
          "7456",
          "7460",
          "7468",
          "7472",
          "7496",
          "7500",
          "7504",
          "4144",
          "5060",
          "3744"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "DESKTOP-HGH2VBT",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web  ",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x00f20000",
          "MainExeSize": "0x000ae000",
          "Bitness": "32-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 760,
        "process_name": "svchost.exe",
        "parent_id": 616,
        "module_path": "C:\\Windows\\System32\\svchost.exe",
        "first_seen": "2026-05-28 22:59:35,566",
        "calls": [
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001420"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "972",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001424"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x7b62cfe0f0"
              },
              {
                "name": "ViewSize",
                "value": "0x0007a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "972",
            "caller": "0x7ffcf8ffc5f2",
            "parentcaller": "0x7ffcf8ff89f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00001424"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000014c0"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe"
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "140720308492792"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:59:39,972",
            "thread_id": "972",
            "caller": "0x7ffcf8ff89f3",
            "parentcaller": "0x7ffcfabdde30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe"
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000010",
                "pretty_value": "CREATE_NEW_CONSOLE"
              },
              {
                "name": "ProcessId",
                "value": "6648"
              },
              {
                "name": "ThreadId",
                "value": "6652"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00001424"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000014c0"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:59:40,160",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014e8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\vdsldr.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:59:40,160",
            "thread_id": "972",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014e4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x7b62cfe0f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00007000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:59:40,160",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\vdsldr.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:59:40,160",
            "thread_id": "972",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014e8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x7b62cfe0f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00007000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:59:40,160",
            "thread_id": "972",
            "caller": "0x7ffcf8ffc5f2",
            "parentcaller": "0x7ffcf8ff89f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000014d4"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000014c0"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\System32\\vdsldr.exe"
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\System32\\vdsldr.exe -Embedding"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "140720308492348"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:59:40,191",
            "thread_id": "972",
            "caller": "0x7ffcf8ff89f3",
            "parentcaller": "0x7ffcfabdde30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": ""
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\System32\\vdsldr.exe -Embedding"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000410",
                "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT"
              },
              {
                "name": "ProcessId",
                "value": "6204"
              },
              {
                "name": "ThreadId",
                "value": "6200"
              },
              {
                "name": "ProcessHandle",
                "value": "0x000014d4"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000014c0"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:59:42,816",
            "thread_id": "856",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014d4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:59:42,847",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:59:42,847",
            "thread_id": "972",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014c4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:59:42,847",
            "thread_id": "972",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014d4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001424"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014d4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001424"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014d4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001424"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014c8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014c4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "852",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000014d8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000014bc"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "972",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:59:42,863",
            "thread_id": "972",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "972",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "972",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "972",
            "caller": "0x7ffcfabd0571",
            "parentcaller": "0x7ffcfabd0427",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "972",
            "caller": "0x7ffcfabd02b3",
            "parentcaller": "0x7ffcfabd003b",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014c4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "972",
            "caller": "0x7ffcfabd1830",
            "parentcaller": "0x7ffcfabd1772",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18dd7d60000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-18.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "972",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "972",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "972",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "972",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014c4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014c4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014c4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014ac"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:59:42,878",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014ac"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "972",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000014a8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000014a4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001498"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014a0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcfabd0571",
            "parentcaller": "0x7ffcfabd0427",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcfabd02b3",
            "parentcaller": "0x7ffcfabd003b",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001498"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcfabd1830",
            "parentcaller": "0x7ffcfabd1772",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001498"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014a0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcfabd0571",
            "parentcaller": "0x7ffcfabd0427",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcfabd02b3",
            "parentcaller": "0x7ffcfabd003b",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001498"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcfabd1830",
            "parentcaller": "0x7ffcfabd1772",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001498"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcfabd0571",
            "parentcaller": "0x7ffcfabd0427",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001498"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcfabd02b3",
            "parentcaller": "0x7ffcfabd003b",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014a0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcfabd1830",
            "parentcaller": "0x7ffcfabd1772",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001498"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcfabd0571",
            "parentcaller": "0x7ffcfabd0427",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001498"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcfabd02b3",
            "parentcaller": "0x7ffcfabd003b",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014a0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcfabd1830",
            "parentcaller": "0x7ffcfabd1772",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001498"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcfabd0571",
            "parentcaller": "0x7ffcfabd0427",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001498"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcfabd02b3",
            "parentcaller": "0x7ffcfabd003b",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014a0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcfabd1830",
            "parentcaller": "0x7ffcfabd1772",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "1160",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001494"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001490"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "1160",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001494"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000148c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "1160",
            "caller": "0x7ffcf68a7024",
            "parentcaller": "0x7ffcf68a7125",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000148c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001488"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000148c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014c8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014c8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000148c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000148c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001480"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:59:42,894",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014c8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014c8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014c8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001480"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014c8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "1160",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000148c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000147c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001478"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001478"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001478"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014c4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "856",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000014c0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000014e4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001478"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001478"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001478"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001478"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001478"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001478"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000146c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000146c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000146c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000146c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000146c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000146c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001468"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000146c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001468"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000146c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000146c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001468"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001468"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000146c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000146c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001468"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001468"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000146c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "7544",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000014d0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-05-28 22:59:42,910",
            "thread_id": "7544",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf9b76d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000014f0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014e8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014e8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014e8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014ec"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014e8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014e8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014ec"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014e8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "7548",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000014f8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "7548",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf9b76d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000014fc"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001504"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001500"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001504"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001500"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001500"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001504"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001504"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001500"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001500"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001504"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001504"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001500"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "7552",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000150c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "7552",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf9b76d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001510"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001518"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001514"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "7556",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000151c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "7556",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf9b76d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001520"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001528"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001524"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001524"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001528"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001528"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001524"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001524"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001528"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001528"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001524"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-05-28 22:59:42,925",
            "thread_id": "856",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf6a11c70",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000cbc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001544"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "7564",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001540"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "7564",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf9b76d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001530"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001578"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 321
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001574"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd0571",
            "parentcaller": "0x7ffcfabd0427",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001574"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd02b3",
            "parentcaller": "0x7ffcfabd003b",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001578"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd1830",
            "parentcaller": "0x7ffcfabd1772",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001574"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 327
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001578"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd0571",
            "parentcaller": "0x7ffcfabd0427",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001578"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 330
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd02b3",
            "parentcaller": "0x7ffcfabd003b",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001574"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd1830",
            "parentcaller": "0x7ffcfabd1772",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001574"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001578"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd0571",
            "parentcaller": "0x7ffcfabd0427",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001578"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd02b3",
            "parentcaller": "0x7ffcfabd003b",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001574"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd1830",
            "parentcaller": "0x7ffcfabd1772",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001538"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001548"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd0571",
            "parentcaller": "0x7ffcfabd0427",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001548"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd02b3",
            "parentcaller": "0x7ffcfabd003b",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001538"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd1830",
            "parentcaller": "0x7ffcfabd1772",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001538"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001548"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 347
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd0571",
            "parentcaller": "0x7ffcfabd0427",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001548"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd02b3",
            "parentcaller": "0x7ffcfabd003b",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001538"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd1830",
            "parentcaller": "0x7ffcfabd1772",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001538"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001548"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd0571",
            "parentcaller": "0x7ffcfabd0427",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001548"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd02b3",
            "parentcaller": "0x7ffcfabd003b",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001538"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 355
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcfabd1830",
            "parentcaller": "0x7ffcfabd1772",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 356
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "856",
            "caller": "0x7ffcf8ffc5f2",
            "parentcaller": "0x7ffcf8ff89f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00001578"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001574"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca"
              },
              {
                "name": "DllPath",
                "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy;"
              },
              {
                "name": "ProcessId",
                "value": "140720308493732"
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "972",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf6a11c70",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000cbc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000157c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "7600",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001598"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 359
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "7600",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf9b76d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000159c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 360
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015ac"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015a0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015a4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015a0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015bc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015a0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-05-28 22:59:42,941",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 378
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "7636",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001588"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "7636",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf9b76d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001580"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000155c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000154c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 382
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000155c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000154c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000154c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000155c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 388
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "1160",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf6a11c70",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000cbc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000015dc"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015c4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 392
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 394
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015d8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 395
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015e8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015e4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 398
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015ec"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 401
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "1160",
            "caller": "0x7ffcf8ffc5f2",
            "parentcaller": "0x7ffcf8ff89f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000015e0"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000015b8"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\SkypeApp.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\SkypeApp.exe\" -ServerName:App.AppXffn3yxqvgawq9fpmnhy90fr3y01d1t5b.mca"
              },
              {
                "name": "DllPath",
                "value": "C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c;C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe;C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe;C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe;"
              },
              {
                "name": "ProcessId",
                "value": "140720308493812"
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015c8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 407
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015d8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015c8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 411
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015d8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015c8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-05-28 22:59:42,956",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-05-28 22:59:43,081",
            "thread_id": "972",
            "caller": "0x7ffcf8ff89f3",
            "parentcaller": "0x7ffcfabdde30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080414",
                "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "7624"
              },
              {
                "name": "ThreadId",
                "value": "7628"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x000015a8"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000015ac"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-05-28 22:59:43,144",
            "thread_id": "856",
            "caller": "0x7ffcf8ff89f3",
            "parentcaller": "0x7ffcfabdde30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080414",
                "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "7588"
              },
              {
                "name": "ThreadId",
                "value": "7592"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00001578"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001574"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 420
          },
          {
            "timestamp": "2026-05-28 22:59:43,160",
            "thread_id": "1160",
            "caller": "0x7ffcf8ff89f3",
            "parentcaller": "0x7ffcfabdde30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\SkypeApp.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\SkypeApp.exe\" -ServerName:App.AppXffn3yxqvgawq9fpmnhy90fr3y01d1t5b.mca"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080414",
                "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "7668"
              },
              {
                "name": "ThreadId",
                "value": "7672"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x000015e0"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000015b8"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-05-28 22:59:43,253",
            "thread_id": "972",
            "caller": "0x7ffcf6a33391",
            "parentcaller": "0x7ffcf69f1704",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000015ac"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "7628"
              },
              {
                "name": "ProcessId",
                "value": "7624"
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-05-28 22:59:43,253",
            "thread_id": "856",
            "caller": "0x7ffcf6a33391",
            "parentcaller": "0x7ffcf69f1704",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00001574"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "7592"
              },
              {
                "name": "ProcessId",
                "value": "7588"
              }
            ],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-05-28 22:59:43,253",
            "thread_id": "1160",
            "caller": "0x7ffcf6a33391",
            "parentcaller": "0x7ffcf69f1704",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000015b8"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "7672"
              },
              {
                "name": "ProcessId",
                "value": "7668"
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-05-28 22:59:43,269",
            "thread_id": "852",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf6a11c70",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000cbc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000153c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-05-28 22:59:43,269",
            "thread_id": "972",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf6a11c70",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000cbc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000015c0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-05-28 22:59:43,269",
            "thread_id": "972",
            "caller": "0x7ffcf8ffc5f2",
            "parentcaller": "0x7ffcf8ff89f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000015d0"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001578"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca"
              },
              {
                "name": "DllPath",
                "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy;"
              },
              {
                "name": "ProcessId",
                "value": "140720308494164"
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-05-28 22:59:43,269",
            "thread_id": "4368",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9bcaff0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000352-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-05-28 22:59:43,269",
            "thread_id": "4368",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001424"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-05-28 22:59:43,269",
            "thread_id": "4368",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015e4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-05-28 22:59:43,269",
            "thread_id": "4368",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "4368",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "4368",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001544"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 433
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "4368",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7564",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9bcaff0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000352-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7564",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7564",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015e4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7564",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7564",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7564",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7564",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7600",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9bcaff0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000352-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7600",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001524"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7600",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015e4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7600",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 445
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7600",
            "caller": "0x7ffcfabd0571",
            "parentcaller": "0x7ffcfabd0427",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7600",
            "caller": "0x7ffcfabd02b3",
            "parentcaller": "0x7ffcfabd003b",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001524"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7600",
            "caller": "0x7ffcfabd1830",
            "parentcaller": "0x7ffcfabd1772",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7600",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001524"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 449
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7600",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015e4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7600",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 451
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7600",
            "caller": "0x7ffcfabd0571",
            "parentcaller": "0x7ffcfabd0427",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7600",
            "caller": "0x7ffcfabd02b3",
            "parentcaller": "0x7ffcfabd003b",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001524"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "7600",
            "caller": "0x7ffcfabd1830",
            "parentcaller": "0x7ffcfabd1772",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df441df0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "1160",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf6a11c70",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000cbc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000014d4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-05-28 22:59:43,285",
            "thread_id": "1636",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf6a11c70",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000cbc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000015e0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-05-28 22:59:43,331",
            "thread_id": "1636",
            "caller": "0x7ffcf8ffc5f2",
            "parentcaller": "0x7ffcf8ff89f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000015b0"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001424"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca"
              },
              {
                "name": "DllPath",
                "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy;"
              },
              {
                "name": "ProcessId",
                "value": "140720308494236"
              }
            ],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-05-28 22:59:43,378",
            "thread_id": "852",
            "caller": "0x7ffcf8ff89f3",
            "parentcaller": "0x7ffcfabdde30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080414",
                "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "8028"
              },
              {
                "name": "ThreadId",
                "value": "8032"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x0000157c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001538"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-05-28 22:59:43,378",
            "thread_id": "856",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000014a8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000015ac"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-05-28 22:59:43,378",
            "thread_id": "852",
            "caller": "0x7ffcf6abf3ed",
            "parentcaller": "0x7ffcf69f18f8",
            "category": "process",
            "api": "NtTerminateProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x0000157c"
              },
              {
                "name": "ExitCode",
                "value": "0x80070bf7"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "972",
            "caller": "0x7ffcf8ff89f3",
            "parentcaller": "0x7ffcfabdde30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080414",
                "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "8020"
              },
              {
                "name": "ThreadId",
                "value": "8024"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x000015d0"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001578"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "856",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000014d8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000015e4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "972",
            "caller": "0x7ffcf6abf3ed",
            "parentcaller": "0x7ffcf69f18f8",
            "category": "process",
            "api": "NtTerminateProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000015d0"
              },
              {
                "name": "ExitCode",
                "value": "0x80070bf7"
              }
            ],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "7636",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9bcaff0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000352-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "7636",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "7636",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015cc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "7636",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 467
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "7636",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015cc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "7636",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015e4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 469
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "7636",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "972",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015d0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x7b62cfeb80"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 471
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "7544",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9bcaff0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000352-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 472
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "972",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf6a11c70",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000cbc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001488"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 473
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "7544",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000153c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "7544",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001550"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "7544",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "7544",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001550"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "7544",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000153c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-05-28 22:59:43,394",
            "thread_id": "7544",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 479
          },
          {
            "timestamp": "2026-05-28 22:59:43,410",
            "thread_id": "972",
            "caller": "0x7ffcf8ffc5f2",
            "parentcaller": "0x7ffcf8ff89f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000d6c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000d68"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca"
              },
              {
                "name": "DllPath",
                "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy;"
              },
              {
                "name": "ProcessId",
                "value": "140720308493728"
              }
            ],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-05-28 22:59:43,410",
            "thread_id": "1160",
            "caller": "0x7ffcf8ff89f3",
            "parentcaller": "0x7ffcfabdde30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXsqpbawq1jx69hhfyy1dr9y35whgstkrr.mca"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080414",
                "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "8100"
              },
              {
                "name": "ThreadId",
                "value": "8104"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00001548"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000015d8"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 481
          },
          {
            "timestamp": "2026-05-28 22:59:43,425",
            "thread_id": "1636",
            "caller": "0x7ffcf8ff89f3",
            "parentcaller": "0x7ffcfabdde30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080414",
                "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "8092"
              },
              {
                "name": "ThreadId",
                "value": "8096"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x000015b0"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001424"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-05-28 22:59:43,441",
            "thread_id": "972",
            "caller": "0x7ffcf8ff89f3",
            "parentcaller": "0x7ffcfabdde30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080414",
                "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "7584"
              },
              {
                "name": "ThreadId",
                "value": "7576"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000d6c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000d68"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 483
          },
          {
            "timestamp": "2026-05-28 22:59:43,441",
            "thread_id": "856",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000014d8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000157c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 484
          },
          {
            "timestamp": "2026-05-28 22:59:43,441",
            "thread_id": "972",
            "caller": "0x7ffcf6abf3ed",
            "parentcaller": "0x7ffcf69f18f8",
            "category": "process",
            "api": "NtTerminateProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000d6c"
              },
              {
                "name": "ExitCode",
                "value": "0x80070bf7"
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-05-28 22:59:43,441",
            "thread_id": "972",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000d6c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x7b62cfeb80"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-05-28 22:59:43,441",
            "thread_id": "7548",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9bcaff0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000352-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-05-28 22:59:43,441",
            "thread_id": "7548",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-05-28 22:59:43,441",
            "thread_id": "7548",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001564"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-05-28 22:59:43,441",
            "thread_id": "7548",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-05-28 22:59:43,441",
            "thread_id": "972",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf6a11c70",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000cbc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000157c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-05-28 22:59:43,441",
            "thread_id": "7548",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001564"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-05-28 22:59:43,441",
            "thread_id": "7548",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015a8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-05-28 22:59:43,441",
            "thread_id": "7548",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-05-28 22:59:43,441",
            "thread_id": "7588",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000ca0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-05-28 22:59:43,441",
            "thread_id": "972",
            "caller": "0x7ffcf8ffc5f2",
            "parentcaller": "0x7ffcf8ff89f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000e54"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000e50"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca"
              },
              {
                "name": "DllPath",
                "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy;"
              },
              {
                "name": "ProcessId",
                "value": "140720308493752"
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-05-28 22:59:43,472",
            "thread_id": "972",
            "caller": "0x7ffcf8ff89f3",
            "parentcaller": "0x7ffcfabdde30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080414",
                "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "7608"
              },
              {
                "name": "ThreadId",
                "value": "8024"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000e54"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000e50"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 497
          },
          {
            "timestamp": "2026-05-28 22:59:43,472",
            "thread_id": "856",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000014d8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000d68"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-05-28 22:59:43,472",
            "thread_id": "972",
            "caller": "0x7ffcf6abf3ed",
            "parentcaller": "0x7ffcf69f18f8",
            "category": "process",
            "api": "NtTerminateProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000e54"
              },
              {
                "name": "ExitCode",
                "value": "0x80070bf7"
              }
            ],
            "repeated": 0,
            "id": 499
          },
          {
            "timestamp": "2026-05-28 22:59:43,472",
            "thread_id": "972",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000e54"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x7b62cfeb80"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-05-28 22:59:43,472",
            "thread_id": "7552",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9bcaff0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000352-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-05-28 22:59:43,472",
            "thread_id": "7552",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 502
          },
          {
            "timestamp": "2026-05-28 22:59:43,472",
            "thread_id": "972",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf6a11c70",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000cbc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000015c4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-05-28 22:59:43,472",
            "thread_id": "7552",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000146c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 504
          },
          {
            "timestamp": "2026-05-28 22:59:43,472",
            "thread_id": "7552",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-05-28 22:59:43,472",
            "thread_id": "7552",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000146c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-05-28 22:59:43,472",
            "thread_id": "7552",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015a0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-05-28 22:59:43,472",
            "thread_id": "7552",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-05-28 22:59:43,472",
            "thread_id": "972",
            "caller": "0x7ffcf8ffc5f2",
            "parentcaller": "0x7ffcf8ff89f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x0000146c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000014e8"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca"
              },
              {
                "name": "DllPath",
                "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy;"
              },
              {
                "name": "ProcessId",
                "value": "140720308494412"
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-05-28 22:59:43,488",
            "thread_id": "972",
            "caller": "0x7ffcf8ff89f3",
            "parentcaller": "0x7ffcfabdde30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080414",
                "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "8268"
              },
              {
                "name": "ThreadId",
                "value": "8272"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x0000146c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000014e8"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-05-28 22:59:43,488",
            "thread_id": "856",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000014d8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000157c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-05-28 22:59:43,488",
            "thread_id": "972",
            "caller": "0x7ffcf6abf3ed",
            "parentcaller": "0x7ffcf69f18f8",
            "category": "process",
            "api": "NtTerminateProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x0000146c"
              },
              {
                "name": "ExitCode",
                "value": "0x80070bf7"
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-05-28 22:59:43,488",
            "thread_id": "972",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000146c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x7b62cfeb80"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-05-28 22:59:43,488",
            "thread_id": "7556",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9bcaff0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000352-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-05-28 22:59:43,488",
            "thread_id": "7556",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000d44"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-05-28 22:59:43,488",
            "thread_id": "7556",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000146c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-05-28 22:59:43,488",
            "thread_id": "7556",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-05-28 22:59:43,488",
            "thread_id": "7556",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000146c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-05-28 22:59:43,488",
            "thread_id": "7556",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000d44"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-05-28 22:59:43,488",
            "thread_id": "7556",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-05-28 22:59:43,503",
            "thread_id": "1160",
            "caller": "0x7ffcf6a33391",
            "parentcaller": "0x7ffcf69f1704",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000015d8"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "8104"
              },
              {
                "name": "ProcessId",
                "value": "8100"
              }
            ],
            "repeated": 0,
            "id": 521
          },
          {
            "timestamp": "2026-05-28 22:59:43,503",
            "thread_id": "1636",
            "caller": "0x7ffcf6a33391",
            "parentcaller": "0x7ffcf69f1704",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00001424"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "8096"
              },
              {
                "name": "ProcessId",
                "value": "8092"
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-05-28 22:59:43,503",
            "thread_id": "7564",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9bcaff0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000352-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-05-28 22:59:43,503",
            "thread_id": "7564",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-05-28 22:59:43,503",
            "thread_id": "7564",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001558"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 525
          },
          {
            "timestamp": "2026-05-28 22:59:43,503",
            "thread_id": "7564",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-05-28 22:59:43,503",
            "thread_id": "7564",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001558"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-05-28 22:59:43,503",
            "thread_id": "7564",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015b0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-05-28 22:59:43,503",
            "thread_id": "7564",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-05-28 22:59:43,503",
            "thread_id": "4368",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9bcaff0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000352-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-05-28 22:59:43,503",
            "thread_id": "4368",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 531
          },
          {
            "timestamp": "2026-05-28 22:59:43,503",
            "thread_id": "4368",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014b0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-05-28 22:59:43,503",
            "thread_id": "4368",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 533
          },
          {
            "timestamp": "2026-05-28 22:59:43,503",
            "thread_id": "4368",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-05-28 22:59:43,503",
            "thread_id": "4368",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014e4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 535
          },
          {
            "timestamp": "2026-05-28 22:59:43,503",
            "thread_id": "4368",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-05-28 22:59:51,238",
            "thread_id": "1160",
            "caller": "0x7ffcf93c50aa",
            "parentcaller": "0x7ffcf93c52e2",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000062c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\DeviceApi\\Dev\\Query"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 537
          },
          {
            "timestamp": "2026-05-28 22:59:51,238",
            "thread_id": "1160",
            "caller": "0x7ffcfb425ebd",
            "parentcaller": "0x7ffcfb425dd8",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000062c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\DeviceApi"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\x8f\\xf3\\xd8\\x8d\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-05-28 22:59:52,816",
            "thread_id": "1636",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000001bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-05-28 22:59:56,160",
            "thread_id": "944",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000e7c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-05-28 22:59:56,175",
            "thread_id": "972",
            "caller": "0x7ffcf68a999a",
            "parentcaller": "0x7ffcf68a975c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001010"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000fb0"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-05-28 22:59:57,050",
            "thread_id": "856",
            "caller": "0x7ffcf68a999a",
            "parentcaller": "0x7ffcf68a975c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006c8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001010"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 542
          },
          {
            "timestamp": "2026-05-28 23:00:02,800",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000065c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 543
          },
          {
            "timestamp": "2026-05-28 23:00:22,800",
            "thread_id": "1636",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000694"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-05-28 23:00:32,816",
            "thread_id": "1636",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000754"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 545
          },
          {
            "timestamp": "2026-05-28 23:00:52,800",
            "thread_id": "1636",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000001bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 546
          },
          {
            "timestamp": "2026-05-28 23:00:53,394",
            "thread_id": "1160",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000158c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000065c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-05-28 23:00:53,831",
            "thread_id": "972",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000690"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000147c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 548
          },
          {
            "timestamp": "2026-05-28 23:00:53,941",
            "thread_id": "856",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006c4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000654"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-05-28 23:00:58,519",
            "thread_id": "856",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000013f0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000014a0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 550
          },
          {
            "timestamp": "2026-05-28 23:01:02,800",
            "thread_id": "856",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000a6c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 551
          },
          {
            "timestamp": "2026-05-28 23:01:06,238",
            "thread_id": "1636",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000156c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001568"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-05-28 23:01:07,785",
            "thread_id": "856",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000012d8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001340"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-05-28 23:01:12,816",
            "thread_id": "856",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000152c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 554
          },
          {
            "timestamp": "2026-05-28 23:01:22,800",
            "thread_id": "856",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000153c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 555
          },
          {
            "timestamp": "2026-05-28 23:01:32,816",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001594"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 556
          },
          {
            "timestamp": "2026-05-28 23:01:52,800",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000153c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 557
          },
          {
            "timestamp": "2026-05-28 23:02:02,816",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000e7c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 558
          },
          {
            "timestamp": "2026-05-28 23:02:22,800",
            "thread_id": "1636",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000116c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 559
          },
          {
            "timestamp": "2026-05-28 23:02:32,816",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001098"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 560
          },
          {
            "timestamp": "2026-05-28 23:02:51,050",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001098"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-05-28 23:02:51,050",
            "thread_id": "972",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000116c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-05-28 23:02:51,050",
            "thread_id": "972",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-05-28 23:02:51,050",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000116c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 564
          },
          {
            "timestamp": "2026-05-28 23:02:51,050",
            "thread_id": "972",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001098"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-05-28 23:02:51,050",
            "thread_id": "972",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 566
          },
          {
            "timestamp": "2026-05-28 23:02:51,050",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-05-28 23:02:51,050",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001594"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-05-28 23:02:51,050",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 570
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001594"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 571
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 572
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 573
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001594"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 574
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 575
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001594"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 576
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000006c8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 577
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 578
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000006c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 579
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001594"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 580
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 581
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "972",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000116c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001170"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 582
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001088"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 583
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000007e4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 584
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 585
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001088"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 586
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000007e4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 587
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 588
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001088"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 589
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000007e4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 590
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 591
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001598"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 592
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000159c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 593
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 594
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000159c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 595
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001598"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 596
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 597
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007e8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 598
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001088"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 599
          },
          {
            "timestamp": "2026-05-28 23:02:51,081",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 600
          },
          {
            "timestamp": "2026-05-28 23:02:51,128",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001088"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 601
          },
          {
            "timestamp": "2026-05-28 23:02:51,128",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000007e8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 602
          },
          {
            "timestamp": "2026-05-28 23:02:51,128",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 603
          },
          {
            "timestamp": "2026-05-28 23:02:51,128",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001088"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 604
          },
          {
            "timestamp": "2026-05-28 23:02:51,128",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000007e8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 605
          },
          {
            "timestamp": "2026-05-28 23:02:51,128",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 606
          },
          {
            "timestamp": "2026-05-28 23:02:51,128",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000007e8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 607
          },
          {
            "timestamp": "2026-05-28 23:02:51,128",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001088"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 608
          },
          {
            "timestamp": "2026-05-28 23:02:51,128",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 609
          },
          {
            "timestamp": "2026-05-28 23:02:51,128",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001088"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 610
          },
          {
            "timestamp": "2026-05-28 23:02:51,128",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000007e8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 611
          },
          {
            "timestamp": "2026-05-28 23:02:51,128",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 612
          },
          {
            "timestamp": "2026-05-28 23:02:51,128",
            "thread_id": "856",
            "caller": "0x7ffcf69a22bd",
            "parentcaller": "0x7ffcf68ace49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000e7c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004d4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 613
          },
          {
            "timestamp": "2026-05-28 23:02:51,128",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 614
          },
          {
            "timestamp": "2026-05-28 23:02:51,128",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000013f0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 615
          },
          {
            "timestamp": "2026-05-28 23:02:51,128",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 616
          },
          {
            "timestamp": "2026-05-28 23:02:51,160",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000159c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 617
          },
          {
            "timestamp": "2026-05-28 23:02:51,160",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000004f0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 618
          },
          {
            "timestamp": "2026-05-28 23:02:51,160",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 619
          },
          {
            "timestamp": "2026-05-28 23:02:51,160",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 620
          },
          {
            "timestamp": "2026-05-28 23:02:51,160",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000159c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 621
          },
          {
            "timestamp": "2026-05-28 23:02:51,160",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 622
          },
          {
            "timestamp": "2026-05-28 23:02:51,160",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001584"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 623
          },
          {
            "timestamp": "2026-05-28 23:02:51,160",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001588"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 624
          },
          {
            "timestamp": "2026-05-28 23:02:51,160",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 625
          },
          {
            "timestamp": "2026-05-28 23:02:51,160",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001588"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 626
          },
          {
            "timestamp": "2026-05-28 23:02:51,160",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001584"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 627
          },
          {
            "timestamp": "2026-05-28 23:02:51,160",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 628
          },
          {
            "timestamp": "2026-05-28 23:02:51,160",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001584"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 629
          },
          {
            "timestamp": "2026-05-28 23:02:51,160",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001588"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 630
          },
          {
            "timestamp": "2026-05-28 23:02:51,160",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 631
          },
          {
            "timestamp": "2026-05-28 23:02:51,175",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001464"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 632
          },
          {
            "timestamp": "2026-05-28 23:02:51,175",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001580"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 633
          },
          {
            "timestamp": "2026-05-28 23:02:51,175",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 634
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "5412",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000159c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 635
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "5412",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf9b76d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000153c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 636
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000062c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 637
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014a0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 638
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 639
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 640
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000062c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 641
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 642
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001580"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 643
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001464"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 644
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 645
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001464"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 646
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001580"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 647
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 648
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001580"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 649
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001464"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 650
          },
          {
            "timestamp": "2026-05-28 23:02:51,191",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 651
          },
          {
            "timestamp": "2026-05-28 23:02:51,222",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 652
          },
          {
            "timestamp": "2026-05-28 23:02:51,222",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000014a0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 653
          },
          {
            "timestamp": "2026-05-28 23:02:51,222",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 654
          },
          {
            "timestamp": "2026-05-28 23:02:51,222",
            "thread_id": "8680",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000015a0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 655
          },
          {
            "timestamp": "2026-05-28 23:02:51,222",
            "thread_id": "8680",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf9b76d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000152c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 656
          },
          {
            "timestamp": "2026-05-28 23:02:51,238",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001580"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 657
          },
          {
            "timestamp": "2026-05-28 23:02:51,238",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001464"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 658
          },
          {
            "timestamp": "2026-05-28 23:02:51,238",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 659
          },
          {
            "timestamp": "2026-05-28 23:02:51,238",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001464"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 660
          },
          {
            "timestamp": "2026-05-28 23:02:51,238",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001580"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 661
          },
          {
            "timestamp": "2026-05-28 23:02:51,238",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 662
          },
          {
            "timestamp": "2026-05-28 23:02:51,238",
            "thread_id": "856",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf6a11c70",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000cbc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000c48"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 663
          },
          {
            "timestamp": "2026-05-28 23:02:51,269",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 664
          },
          {
            "timestamp": "2026-05-28 23:02:51,269",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015fc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 665
          },
          {
            "timestamp": "2026-05-28 23:02:51,269",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 666
          },
          {
            "timestamp": "2026-05-28 23:02:51,269",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 667
          },
          {
            "timestamp": "2026-05-28 23:02:51,269",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015f8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 668
          },
          {
            "timestamp": "2026-05-28 23:02:51,269",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 669
          },
          {
            "timestamp": "2026-05-28 23:02:51,269",
            "thread_id": "3604",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 670
          },
          {
            "timestamp": "2026-05-28 23:02:51,269",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3d8e",
            "parentcaller": "0x7ffcf8fb3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015fc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 671
          },
          {
            "timestamp": "2026-05-28 23:02:51,269",
            "thread_id": "3604",
            "caller": "0x7ffcf8fb3395",
            "parentcaller": "0x7ffcf8fb3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 672
          },
          {
            "timestamp": "2026-05-28 23:02:51,269",
            "thread_id": "3744",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000014d0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 673
          },
          {
            "timestamp": "2026-05-28 23:02:51,269",
            "thread_id": "3744",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf9b76d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000014f0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 674
          },
          {
            "timestamp": "2026-05-28 23:02:51,269",
            "thread_id": "856",
            "caller": "0x7ffcf8ffc5f2",
            "parentcaller": "0x7ffcf8ff89f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000015f8"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000015fc"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca"
              },
              {
                "name": "DllPath",
                "value": "C:\\Program Files\\WindowsApps\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe;C:\\Program Files\\WindowsApps\\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe;C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe;"
              },
              {
                "name": "ProcessId",
                "value": "140720308494840"
              }
            ],
            "repeated": 0,
            "id": 675
          },
          {
            "timestamp": "2026-05-28 23:02:51,300",
            "thread_id": "5060",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000688"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 676
          },
          {
            "timestamp": "2026-05-28 23:02:51,300",
            "thread_id": "5060",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf6a11c70",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000cbc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001610"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 677
          },
          {
            "timestamp": "2026-05-28 23:02:51,300",
            "thread_id": "5060",
            "caller": "0x7ffcf8ffc5f2",
            "parentcaller": "0x7ffcf8ff89f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000014f8"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000014f4"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXsqpbawq1jx69hhfyy1dr9y35whgstkrr.mca"
              },
              {
                "name": "DllPath",
                "value": "C:\\Program Files\\WindowsApps\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe;C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe;"
              },
              {
                "name": "ProcessId",
                "value": "140720308492916"
              }
            ],
            "repeated": 0,
            "id": 678
          },
          {
            "timestamp": "2026-05-28 23:02:52,113",
            "thread_id": "856",
            "caller": "0x7ffcf8ff89f3",
            "parentcaller": "0x7ffcfabdde30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080414",
                "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "8696"
              },
              {
                "name": "ThreadId",
                "value": "8700"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x000015f8"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000015fc"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 679
          },
          {
            "timestamp": "2026-05-28 23:02:52,113",
            "thread_id": "2424",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001554"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 680
          },
          {
            "timestamp": "2026-05-28 23:02:52,128",
            "thread_id": "5060",
            "caller": "0x7ffcf8ff89f3",
            "parentcaller": "0x7ffcfabdde30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\backgroundTaskHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXsqpbawq1jx69hhfyy1dr9y35whgstkrr.mca"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080414",
                "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "6772"
              },
              {
                "name": "ThreadId",
                "value": "6776"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x000014f8"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000014f4"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 681
          },
          {
            "timestamp": "2026-05-28 23:02:52,800",
            "thread_id": "972",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000160c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 682
          },
          {
            "timestamp": "2026-05-28 23:02:54,769",
            "thread_id": "1636",
            "caller": "0x7ffcf8fcacfe",
            "parentcaller": "0x7ffcfaf99f03",
            "category": "services",
            "api": "StartServiceW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ServiceHandle",
                "value": "0x18dd8876120"
              },
              {
                "name": "ServiceName",
                "value": "TrustedInstaller"
              },
              {
                "name": "Arguments",
                "value": []
              }
            ],
            "repeated": 0,
            "id": 683
          },
          {
            "timestamp": "2026-05-28 23:02:54,894",
            "thread_id": "1636",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000130c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3745_none_7ded3f327ca60a41\\TiWorker.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 684
          },
          {
            "timestamp": "2026-05-28 23:02:54,894",
            "thread_id": "1636",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001314"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x7b6307e1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00042000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 685
          },
          {
            "timestamp": "2026-05-28 23:02:54,894",
            "thread_id": "1636",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001314"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\WinSxS\\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3745_none_21cea3aec448990b\\TiWorker.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 686
          },
          {
            "timestamp": "2026-05-28 23:02:54,894",
            "thread_id": "1636",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000130c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x7b6307e1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x0003d000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 687
          },
          {
            "timestamp": "2026-05-28 23:02:54,894",
            "thread_id": "1636",
            "caller": "0x7ffcf8ffc5f2",
            "parentcaller": "0x7ffcf8ff89f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x0000130c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001310"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3745_none_7ded3f327ca60a41\\TiWorker.exe"
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3745_none_7ded3f327ca60a41\\TiWorker.exe -Embedding"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "140720308487612"
              }
            ],
            "repeated": 0,
            "id": 688
          },
          {
            "timestamp": "2026-05-28 23:02:54,988",
            "thread_id": "1636",
            "caller": "0x7ffcf8ff89f3",
            "parentcaller": "0x7ffcfabdde30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": ""
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3745_none_7ded3f327ca60a41\\TiWorker.exe -Embedding"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000010",
                "pretty_value": "CREATE_NEW_CONSOLE"
              },
              {
                "name": "ProcessId",
                "value": "1468"
              },
              {
                "name": "ThreadId",
                "value": "1448"
              },
              {
                "name": "ProcessHandle",
                "value": "0x0000130c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001310"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 689
          },
          {
            "timestamp": "2026-05-28 23:02:55,910",
            "thread_id": "1636",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000162c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\FodHelper.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 690
          },
          {
            "timestamp": "2026-05-28 23:02:55,910",
            "thread_id": "1636",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001620"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18dd8d50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x7b6307e1f0"
              },
              {
                "name": "ViewSize",
                "value": "0x0000d000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 691
          },
          {
            "timestamp": "2026-05-28 23:02:55,910",
            "thread_id": "1636",
            "caller": "0x7ffcf8ffc5f2",
            "parentcaller": "0x7ffcf8ff89f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000011cc"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001608"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\System32\\FodHelper.exe"
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\System32\\FodHelper.exe -Embedding"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "140720308489084"
              }
            ],
            "repeated": 0,
            "id": 692
          }
        ],
        "threads": [
          "972",
          "856",
          "3604",
          "852",
          "1160",
          "7544",
          "7548",
          "7552",
          "7556",
          "7564",
          "7600",
          "7636",
          "4368",
          "1636",
          "7588",
          "944",
          "5412",
          "8680",
          "3744",
          "5060",
          "2424"
        ],
        "environ": {
          "UserName": "SYSTEM",
          "ComputerName": "DESKTOP-HGH2VBT",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Windows\\TEMP\\",
          "CommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff6cca40000",
          "MainExeSize": "0x00010000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 4344,
        "process_name": "svchost.exe",
        "parent_id": 616,
        "module_path": "C:\\Windows\\System32\\svchost.exe",
        "first_seen": "2026-05-28 22:59:37,613",
        "calls": [
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000031c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcf9c241cf",
            "parentcaller": "0x7ffcfb3f38c0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000032A-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000149-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb40fc9c",
            "parentcaller": "0x7ffcfb40fa80",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000310"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\vssapi.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000030c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcef6a0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0019e000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb40fc9c",
            "parentcaller": "0x7ffcfb40f7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000310"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\vsstrace.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000030c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcefab0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00018000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\VssTrace"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcefab0000"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\vssapi"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcef6a0000"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb3fbb2a",
            "parentcaller": "0x7ffcfb3fb99e",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\VssTrace.DLL.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb3fbbcc",
            "parentcaller": "0x7ffcfb3fb99e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000304"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1d092b60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x851b9fa0f0"
              },
              {
                "name": "ViewSize",
                "value": "0x00008000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb40fc9c",
            "parentcaller": "0x7ffcfb40f7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000304"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\samcli.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000300"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcefa90000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00019000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\samcli"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcefa90000"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb40fc9c",
            "parentcaller": "0x7ffcfb40f7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000304"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\netutils.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000032c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf7e90000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0000c000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\netutils"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf7e90000"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb40fc9c",
            "parentcaller": "0x7ffcfb40f7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000304"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\samlib.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000300"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf5dc0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00028000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:59:39,675",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\SAMLIB"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf5dc0000"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\ES"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf1520000"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\es.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf1520000"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\es.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf1520000"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcf152adf6",
            "parentcaller": "0x7ffcf152ad6e",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1BE1F766-5536-11D1-B726-00C04FB926AF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "64B8F404-A4AE-11D1-B7B6-00C04FB926AF"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcef6b3890",
            "parentcaller": "0x7ffcefc46629",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "FAF53CC4-BD73-4E36-83F1-2B23F46E513E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000015",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcf152adf6",
            "parentcaller": "0x7ffcf152ad6e",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1BE1F766-5536-11D1-B726-00C04FB926AF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "64B8F404-A4AE-11D1-B7B6-00C04FB926AF"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcef6ad980",
            "parentcaller": "0x7ffcef6b3907",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4E14FBA2-2E22-11D1-9964-00C04FBBB345"
              },
              {
                "name": "ClsContext",
                "value": "0x00000015",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "riid",
                "value": "4E14FB9F-2E22-11D1-9964-00C04FBBB345"
              },
              {
                "name": "ProgID",
                "value": "EventSystem.EventSystem.1"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcef6ade75",
            "parentcaller": "0x7ffcef6b3907",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "7542E960-79C7-11D1-88F9-0080C7D771BF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000015",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "riid",
                "value": "4A6B0E15-2E38-11D1-9965-00C04FBBB345"
              },
              {
                "name": "ProgID",
                "value": "EventSystem.EventSubscription"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcf153aa0e",
            "parentcaller": "0x7ffcef6ae248",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000323-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000017",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "riid",
                "value": "00000146-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcfb40fc9c",
            "parentcaller": "0x7ffcfb40f7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000034c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\propsys.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000350"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf5940000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000f6000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\PROPSYS"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf5940000"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcfb3fcb1e",
            "parentcaller": "0x7ffcf8ff3958",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1d094300000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcfb3fcb70",
            "parentcaller": "0x7ffcf8ff3958",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1d094300000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefc4359f",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\FastProx"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd9360000"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefc4359f",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\esscli"
              },
              {
                "name": "DllBase",
                "value": "0x7ffce2640000"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefc4359f",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemcore"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd9470000"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffce2650a6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "API-MS-Win-Security-Base-L1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8fa0000"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefc4359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd9470000"
              }
            ],
            "repeated": 1,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcefc435f7",
            "parentcaller": "0x7ffcf9b8b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemsvc"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcef1a0000"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:59:39,691",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemsvc.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcef1a0000"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\fastprox.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd9360000"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcd9520a6f",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\authZ"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf7830000"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcd9520a6f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "authZ.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf7830000"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcf78393bb",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000380",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcf7839160"
              },
              {
                "name": "Parameter",
                "value": "0x1d09245d680"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "6392"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcefbfc227",
            "parentcaller": "0x7ffcd9517739",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wmiutils"
              },
              {
                "name": "DllBase",
                "value": "0x7ffceadd0000"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wmiutils.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffceadd0000"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcefbfc227",
            "parentcaller": "0x7ffcd9517811",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcefbfc227",
            "parentcaller": "0x7ffcd95178e3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "EAC8A024-21E2-4523-AD73-A71A0AA2F56A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcd94ea53c",
            "parentcaller": "0x7ffcd9516f2d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "5839FCA9-774D-42A1-ACDA-D6A79037F57F"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "6963B029-B969-40AA-9180-2B2F84075973"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\repdrvfs"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd92e0000"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repdrvfs.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd92e0000"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd94e00c2",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "7998DC37-D3FE-487C-A60A-7701FCC70CC6"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "2AF77343-DD7B-11D2-9217-00AA001F98B5"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd9dd2",
            "parentcaller": "0x7ffcd92f9e57",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000035",
            "pretty_return": "OBJECT_NAME_COLLISION",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000173"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repository"
              },
              {
                "name": "CreateDisposition",
                "value": "2",
                "pretty_value": "FILE_CREATE"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf901f15c",
            "parentcaller": "0x7ffcd92f9e17",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100100",
                "pretty_value": "FILE_WRITE_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repository"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf901f1d6",
            "parentcaller": "0x7ffcd92f9e17",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003c4"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40110080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repository\\WRITABLE.TST"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefc45f65",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\Wevtapi"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf2c50000"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefc45f65",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "Wevtapi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf2c50000"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fcacfe",
            "parentcaller": "0x7ffcefc461fd",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\Wevtapi"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf2c50000"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcfb420db0",
            "parentcaller": "0x7ffcfb3e0391",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf2c50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003cc"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repository\\MAPPING1.MAP"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repository\\MAPPING2.MAP"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repository\\MAPPING3.MAP"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repository\\OBJECTS.DATA"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repository\\INDEX.BTR"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:59:39,706",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92fb27e",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003cc"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\MAPPING1.MAP"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92fb27e",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003c8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\MAPPING2.MAP"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92fb27e",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\MAPPING3.MAP"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0?\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe08\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80'\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 @\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x9c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x1d\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x85\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x9b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x12\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x87\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0'\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 )\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x05\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x93\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0.\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`<\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0>\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\t\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x02\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@@\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\xbf\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\xea\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\xec\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\xf9\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\xfb\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0D\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 ?\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\xe3\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00@\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@$\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 /\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`?\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80?\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@G\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@]\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@6\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0,\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`5\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 4\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@ \\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x17\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x807\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 6\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x006\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x0c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x19\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00 \\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80>\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00>\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 >\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x1f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x0c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x1f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x1f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@=\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@-\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`*\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0=\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@>\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`=\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0>\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`>\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 ?\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:59:39,722",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0(\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0>\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00  \\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80=\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00+\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`3\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x005\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0*\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00$\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`+\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@5\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x800\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80!\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0/\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0.\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0#\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80*\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x003\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x803\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@3\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 3\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00)\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`,\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`-\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@/\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 /\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x804\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x004\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 #\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 -\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0*\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0)\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 5\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80.\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0.\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00-\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0/\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00/\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80,\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0+\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 +\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80+\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0)\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@+\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0-\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0=\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00?\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x802\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@7\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x16\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x1b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x17\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x1b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0+\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 ?\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92fb3c0",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003cc"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\MAPPING1.MAP"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92fb410",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003cc"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\MAPPING1.MAP"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xc4+\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92fb485",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003cc"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\MAPPING1.MAP"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@]\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 ?\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`2\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcefbfc227",
            "parentcaller": "0x7ffcd92fa0ff",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1860E246-E924-4F73-B2C5-93E0577E3AA1"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcefbfc227",
            "parentcaller": "0x7ffcd92fa14c",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9A653086-174F-11D2-B5F9-00104B703EFD"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003c4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfaf00000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00079000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\coml2"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcfaf00000"
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf8fcacfe",
            "parentcaller": "0x7ffcd94d2069",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\coml2"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcfaf00000"
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcfb420db0",
            "parentcaller": "0x7ffcfb3e0391",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfaf00000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcd94d20c8",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000003e0",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcd951faa0"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "6420"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-05-28 22:59:39,738",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd94dfb69",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "7998DC37-D3FE-487C-A60A-7701FCC70CC6"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "2AF77343-DD7B-11D2-9217-00AA001F98B5"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcd938e314",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\amsi"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd91d0000"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcd938e314",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "amsi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd91d0000"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcfb40fc9c",
            "parentcaller": "0x7ffcfb40f7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000414"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\userenv.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000040c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8980000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0002e000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\USERENV"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf8980000"
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcfb40fc9c",
            "parentcaller": "0x7ffcfb40f7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000040c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\profapi.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000418"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf89c0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00025000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\profapi"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf89c0000"
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000418"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files\\Windows Defender\\MpOAV.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcd91d59a1",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files\\Windows Defender\\MpOav"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd9180000"
              }
            ],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcd91a2dd5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8fa0000"
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcd91a2dd5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-fibers-l1-1-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8fa0000"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcd919a2cd",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8fa0000"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcd919a2cd",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-fibers-l1-1-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8fa0000"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcd919a2cd",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-l1-2-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8fa0000"
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcd918e4e9",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\version"
              },
              {
                "name": "DllBase",
                "value": "0x7ffce1be0000"
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcd918e4e9",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\version.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce1be0000"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcd91d59a1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files\\Windows Defender\\MpOAV.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd9180000"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\"\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe08\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@*\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x1f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 ]\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NCObjAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7ffce8f00000"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-05-28 22:59:39,753",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvsd"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd9200000"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\WmiPrvSD.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd9200000"
              }
            ],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcd923af6c",
            "parentcaller": "0x7ffcd92298ab",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1860E246-E924-4F73-B2C5-93E0577E3AA1"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "5FC92893-A9BE-475F-BF9E-CF50EEA1C958"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefc00db5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "API-MS-Win-Security-Base-L1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8fa0000"
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefbbab11",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-l1-2-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8fa0000"
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefbbab2c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-obsolete-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8fa0000"
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefc00ea9",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-processsecurity-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfabc0000"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcd949d607",
            "parentcaller": "0x7ffcd9516b2c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4DE225BF-CF59-4CFC-85F7-68B90F185355"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "E8107BDF-BAAF-4C7C-BB5F-9D732E8D8F07"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemess"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd90f0000"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemess.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd90f0000"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcd95168f1",
            "parentcaller": "0x7ffcd95171a5",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "C0E3EEB3-B2CE-4A6A-9284-F38475CEE099"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcd913aa96",
            "parentcaller": "0x7ffcd951699d",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcfb40fc9c",
            "parentcaller": "0x7ffcfb40fa80",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000460"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\cryptsp.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000464"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8350000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00018000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcfb3c4d42",
            "parentcaller": "0x7ffcfb3c4aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\cryptsp"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf8350000"
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf8fce6a1",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\rsaenh"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf7a90000"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf8fce6a1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\rsaenh.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf7a90000"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf8fde188",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfabc0000"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf900c386",
            "parentcaller": "0x7ffcf900c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000478"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1d094600000"
              },
              {
                "name": "SectionOffset",
                "value": "0x851b9fc820"
              },
              {
                "name": "ViewSize",
                "value": "0x00338000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffce8f0147c",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000490",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffce8f04f50"
              },
              {
                "name": "Parameter",
                "value": "0x1d0924f2470"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "6472"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcd913b01f",
            "parentcaller": "0x7ffcd951699d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\esscli.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce2640000"
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcd91368f5",
            "parentcaller": "0x7ffcd913b0a1",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DC923725-0FDD-45E1-AE74-EA09182E739B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "B1EB126B-4A5E-4848-9E6A-5A513DC7F57A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x13\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x10\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x1b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x15\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 320
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 321
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd913677f",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x11\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x08\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 326
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 327
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd913677f",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 330
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd913677f",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 ?\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-05-28 22:59:39,769",
            "thread_id": "3680",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd938a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "3680",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcd949c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000004d8",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcd949d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x1d0945363c0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "6560"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "3680",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd936d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6560",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6560",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6560",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6560",
            "caller": "0x7ffcd9486b2d",
            "parentcaller": "0x7ffcd920f3e9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 343
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6560",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcd949c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000004f4",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcd949d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x1d094535b00"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "6568"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x11\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 347
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6568",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004f0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000504"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 6\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 @\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6560",
            "caller": "0x7ffcd920dd6a",
            "parentcaller": "0x7ffcd920d989",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\r\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x0c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0 \\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6568",
            "caller": "0x7ffceadd2508",
            "parentcaller": "0x7ffceadd4a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 355
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 356
          },
          {
            "timestamp": "2026-05-28 22:59:39,785",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x11\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "3680",
            "caller": "0x7ffcd9488250",
            "parentcaller": "0x7ffcf956b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6568",
            "caller": "0x7ffceadd2508",
            "parentcaller": "0x7ffceadd4a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 359
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x19\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 360
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6568",
            "caller": "0x7ffceadd2508",
            "parentcaller": "0x7ffceadd4a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 361
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x10\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x14\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x19\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x13\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6568",
            "caller": "0x7ffceadd2508",
            "parentcaller": "0x7ffceadd4a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 368
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@6\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6568",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6560",
            "caller": "0x7ffcd9217e1d",
            "parentcaller": "0x7ffcd9217a50",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "EAC8A024-21E2-4523-AD73-A71A0AA2F56A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "81166F58-DD98-11D3-A120-00105A1F515A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6560",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6560",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6560",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6560",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6560",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x14\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6560",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x0e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6560",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 378
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6560",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6560",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6568",
            "caller": "0x7ffceadd2508",
            "parentcaller": "0x7ffceadd4a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 381
          },
          {
            "timestamp": "2026-05-28 22:59:39,800",
            "thread_id": "6560",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000052c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 382
          },
          {
            "timestamp": "2026-05-28 22:59:40,003",
            "thread_id": "6592",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000508"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-05-28 22:59:40,003",
            "thread_id": "6592",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-05-28 22:59:40,003",
            "thread_id": "6592",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefc4359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd9470000"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-05-28 22:59:40,003",
            "thread_id": "6592",
            "caller": "0x7ffcefc435f7",
            "parentcaller": "0x7ffcf9b8b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-05-28 22:59:40,003",
            "thread_id": "6592",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-05-28 22:59:40,003",
            "thread_id": "6592",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 388
          },
          {
            "timestamp": "2026-05-28 22:59:40,003",
            "thread_id": "6592",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd938a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6852",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000450"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6560",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6560",
            "caller": "0x7ffcd9219ec9",
            "parentcaller": "0x7ffcd920b42b",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1F87137D-0E7C-44D5-8C73-4EFFB68962F2"
              },
              {
                "name": "ClsContext",
                "value": "0x00090004",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_ENABLE_AAA|CLSCTX_ACTIVATE_64_BIT_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 392
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6560",
            "caller": "0x7ffcd9214e9b",
            "parentcaller": "0x7ffcd9216a2f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 393
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6560",
            "caller": "0x7ffcd9486b2d",
            "parentcaller": "0x7ffcd920cae0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 394
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6560",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd938a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 395
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6560",
            "caller": "0x7ffcd9214e9b",
            "parentcaller": "0x7ffcd9216a2f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 396
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6852",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 397
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6568",
            "caller": "0x7ffceadd2508",
            "parentcaller": "0x7ffceadd4a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 398
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6852",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd936d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6852",
            "caller": "0x7ffcd9488250",
            "parentcaller": "0x7ffcf956b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6560",
            "caller": "0x7ffcd9214e9b",
            "parentcaller": "0x7ffcd9216a2f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 401
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6560",
            "caller": "0x7ffcd938addd",
            "parentcaller": "0x7ffcd938a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 402
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6560",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004d0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000554"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6560",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004d0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000514"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6568",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6568",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-05-28 22:59:40,019",
            "thread_id": "6568",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 407
          },
          {
            "timestamp": "2026-05-28 22:59:40,035",
            "thread_id": "6560",
            "caller": "0x7ffceadd2508",
            "parentcaller": "0x7ffceadd4a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 408
          },
          {
            "timestamp": "2026-05-28 22:59:40,035",
            "thread_id": "6568",
            "caller": "0x7ffcd9212823",
            "parentcaller": "0x7ffcd921978f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-05-28 22:59:40,035",
            "thread_id": "6568",
            "caller": "0x7ffcd938addd",
            "parentcaller": "0x7ffcd938a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-05-28 22:59:40,035",
            "thread_id": "6568",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000568"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 411
          },
          {
            "timestamp": "2026-05-28 22:59:40,035",
            "thread_id": "6568",
            "caller": "0x7ffcd938a85f",
            "parentcaller": "0x7ffcd938a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-05-28 22:59:40,035",
            "thread_id": "6568",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf9b76d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000564"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-05-28 22:59:40,035",
            "thread_id": "6852",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6852",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6852",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6852",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefc4359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd9470000"
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6852",
            "caller": "0x7ffcefc435f7",
            "parentcaller": "0x7ffcf9b8b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6852",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6852",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 420
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6852",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6852",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd938a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 422
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6560",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x0c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6852",
            "caller": "0x7ffcd9488250",
            "parentcaller": "0x7ffcf956b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6560",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6560",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6560",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6560",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6560",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6568",
            "caller": "0x7ffceadd2508",
            "parentcaller": "0x7ffceadd4a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 430
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6560",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd938a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6560",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6560",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004f0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000560"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 433
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6560",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004f0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000054c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6568",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6568",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6568",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-05-28 22:59:40,050",
            "thread_id": "6560",
            "caller": "0x7ffceadd2508",
            "parentcaller": "0x7ffceadd4a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 438
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6568",
            "caller": "0x7ffcd9212823",
            "parentcaller": "0x7ffcd921978f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6568",
            "caller": "0x7ffcd938a85f",
            "parentcaller": "0x7ffcd938a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4376",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4376",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6852",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6852",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefc4359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd9470000"
              }
            ],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6852",
            "caller": "0x7ffcefc435f7",
            "parentcaller": "0x7ffcf9b8b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 445
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6852",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6852",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6852",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6852",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd938a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 449
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6560",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6852",
            "caller": "0x7ffcd9488250",
            "parentcaller": "0x7ffcf956b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 451
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6560",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6560",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6560",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6560",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6560",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6568",
            "caller": "0x7ffceadd2508",
            "parentcaller": "0x7ffceadd4a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 457
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6560",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd938a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6560",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6560",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000588"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000594"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6560",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000588"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000544"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6568",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6568",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6568",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6560",
            "caller": "0x7ffceadd2508",
            "parentcaller": "0x7ffceadd4a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 465
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6568",
            "caller": "0x7ffcd9212823",
            "parentcaller": "0x7ffcd920ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "6568",
            "caller": "0x7ffcd938a85f",
            "parentcaller": "0x7ffcd938a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 467
          },
          {
            "timestamp": "2026-05-28 22:59:40,066",
            "thread_id": "4376",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4376",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 469
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "6560",
            "caller": "0x7ffcd9212823",
            "parentcaller": "0x7ffcd92373be",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "6560",
            "caller": "0x7ffcd938addd",
            "parentcaller": "0x7ffcd938a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 471
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4376",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 472
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4376",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefc4359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd9470000"
              }
            ],
            "repeated": 0,
            "id": 473
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4376",
            "caller": "0x7ffcefc435f7",
            "parentcaller": "0x7ffcf9b8b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4376",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4376",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefc4359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd9470000"
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4376",
            "caller": "0x7ffcefc435f7",
            "parentcaller": "0x7ffcf9b8b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4376",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4376",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x8b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 479
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4376",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 480
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4376",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 481
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4376",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4376",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd938a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 483
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "6560",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 484
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "6560",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "6560",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "6560",
            "caller": "0x7ffcd9486b2d",
            "parentcaller": "0x7ffcd920f3e9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 487
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "6568",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000055c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004bc"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "6560",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x9a\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "6560",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004d4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000544"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "6560",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@@\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4376",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd936d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-05-28 22:59:40,081",
            "thread_id": "4376",
            "caller": "0x7ffcd9488250",
            "parentcaller": "0x7ffcf956b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-05-28 23:00:10,081",
            "thread_id": "4376",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf9b76d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000046c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-05-28 23:00:28,081",
            "thread_id": "5380",
            "caller": "0x7ff6cca44340",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-05-28 23:00:28,081",
            "thread_id": "5380",
            "caller": "0x7ff6cca44340",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-05-28 23:00:28,081",
            "thread_id": "5380",
            "caller": "0x7ff6cca44340",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 497
          },
          {
            "timestamp": "2026-05-28 23:00:31,456",
            "thread_id": "5328",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000548"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-05-28 23:00:40,097",
            "thread_id": "5380",
            "caller": "0x7ff6cca44340",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\ES"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf1520000"
              }
            ],
            "repeated": 0,
            "id": 499
          },
          {
            "timestamp": "2026-05-28 23:00:40,097",
            "thread_id": "5380",
            "caller": "0x7ff6cca44340",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf1520000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-05-28 23:00:50,050",
            "thread_id": "6424",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcefbc46f4",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000510",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcefbc4a00"
              },
              {
                "name": "Parameter",
                "value": "0x1d0945357e0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8780"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-05-28 23:00:50,066",
            "thread_id": "6424",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcefbc46f4",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000348",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcefbc4a00"
              },
              {
                "name": "Parameter",
                "value": "0x1d094535970"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8784"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 502
          },
          {
            "timestamp": "2026-05-28 23:00:50,066",
            "thread_id": "8780",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-05-28 23:00:50,066",
            "thread_id": "8780",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0 \\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 504
          },
          {
            "timestamp": "2026-05-28 23:00:50,066",
            "thread_id": "8780",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x1d\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-05-28 23:00:50,066",
            "thread_id": "8780",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-05-28 23:00:50,066",
            "thread_id": "8780",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x14\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-05-28 23:00:50,066",
            "thread_id": "8780",
            "caller": "0x7ffcf8ff4448",
            "parentcaller": "0x7ffce265041d",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1d092b90000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-05-28 23:00:50,066",
            "thread_id": "8780",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x93\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-05-28 23:00:50,066",
            "thread_id": "8780",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 ;\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-05-28 23:00:50,066",
            "thread_id": "8780",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x0f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-05-28 23:00:50,066",
            "thread_id": "8780",
            "caller": "0x7ffcd9114e5e",
            "parentcaller": "0x7ffcd90f8ca7",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "A57BE31E-EFE3-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-05-28 23:00:50,066",
            "thread_id": "8780",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcefbc46f4",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000558",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcefbc4a00"
              },
              {
                "name": "Parameter",
                "value": "0x1d094535060"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8788"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-05-28 23:00:50,066",
            "thread_id": "8780",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcefbc46f4",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000544",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcefbc4a00"
              },
              {
                "name": "Parameter",
                "value": "0x1d094527b90"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8792"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-05-28 23:00:50,066",
            "thread_id": "8780",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcd949c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x0000054c",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcd949d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x1d0945b9fb0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8796"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-05-28 23:00:50,066",
            "thread_id": "8784",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcd949c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000560",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcd949d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x1d0945ba050"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8800"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-05-28 23:00:50,066",
            "thread_id": "8788",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcd949c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000004dc",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcd949d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x1d0945bacd0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8804"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-05-28 23:00:50,097",
            "thread_id": "8796",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000580"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004cc"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-05-28 23:00:50,113",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-05-28 23:00:50,113",
            "thread_id": "8804",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004c4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004c8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-05-28 23:00:50,113",
            "thread_id": "8800",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000588"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004e4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 521
          },
          {
            "timestamp": "2026-05-28 23:00:50,113",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-05-28 23:00:50,113",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x11\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-05-28 23:00:50,113",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\xf8\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-05-28 23:00:50,128",
            "thread_id": "8788",
            "caller": "0x7ffcd91085a4",
            "parentcaller": "0x7ffcd910829c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 4,
            "id": 525
          },
          {
            "timestamp": "2026-05-28 23:00:50,128",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x0f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-05-28 23:00:50,128",
            "thread_id": "8804",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004f4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000550"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-05-28 23:00:50,128",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\"\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-05-28 23:00:50,128",
            "thread_id": "8788",
            "caller": "0x7ffcd91085a4",
            "parentcaller": "0x7ffcd910829c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-05-28 23:00:50,128",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x96\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-05-28 23:00:50,128",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x14\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 531
          },
          {
            "timestamp": "2026-05-28 23:00:50,128",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x91\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 (\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 533
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\xbb\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00!\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 535
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\xcb\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x10\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 537
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x17\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x1d\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 '\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x84\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@%\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 542
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 543
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x0e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 545
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 546
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc06\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x87\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 548
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x02\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x15\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 550
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0%\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 551
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x98\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8800",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000554"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000530"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@%\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 554
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000055c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000064c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 555
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8784",
            "caller": "0x7ffcd91085a4",
            "parentcaller": "0x7ffcd910829c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 556
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 557
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@!\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 558
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x16\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 559
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80)\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 560
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8784",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x11\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-05-28 23:00:50,144",
            "thread_id": "8780",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-05-28 23:00:50,160",
            "thread_id": "8788",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 564
          },
          {
            "timestamp": "2026-05-28 23:00:50,160",
            "thread_id": "8788",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-05-28 23:00:50,160",
            "thread_id": "8788",
            "caller": "0x7ffcd9486b2d",
            "parentcaller": "0x7ffcd920f3e9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 566
          },
          {
            "timestamp": "2026-05-28 23:00:50,160",
            "thread_id": "8796",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000674"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000678"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-05-28 23:00:50,160",
            "thread_id": "8796",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000668"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000674"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-05-28 23:00:50,160",
            "thread_id": "8796",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000668"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000678"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-05-28 23:00:50,160",
            "thread_id": "8796",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000668"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000067c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 570
          },
          {
            "timestamp": "2026-05-28 23:00:50,160",
            "thread_id": "8796",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000668"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000680"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 571
          },
          {
            "timestamp": "2026-05-28 23:00:50,160",
            "thread_id": "8788",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcefbbfcc4",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000670",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcefbbf6d0"
              },
              {
                "name": "Parameter",
                "value": "0x1d0924f20c0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8820"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 572
          },
          {
            "timestamp": "2026-05-28 23:00:50,191",
            "thread_id": "8784",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 573
          },
          {
            "timestamp": "2026-05-28 23:00:50,191",
            "thread_id": "8784",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 574
          },
          {
            "timestamp": "2026-05-28 23:00:50,191",
            "thread_id": "8784",
            "caller": "0x7ffcd9486b2d",
            "parentcaller": "0x7ffcd920f3e9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 575
          },
          {
            "timestamp": "2026-05-28 23:00:50,191",
            "thread_id": "8796",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000064c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000530"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 576
          },
          {
            "timestamp": "2026-05-28 23:00:50,191",
            "thread_id": "8800",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000680"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000064c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 577
          },
          {
            "timestamp": "2026-05-28 23:00:50,191",
            "thread_id": "8800",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000680"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000648"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 578
          },
          {
            "timestamp": "2026-05-28 23:00:50,191",
            "thread_id": "8800",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000680"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004c4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 579
          },
          {
            "timestamp": "2026-05-28 23:00:50,191",
            "thread_id": "8800",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000680"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000066c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 580
          },
          {
            "timestamp": "2026-05-28 23:00:50,222",
            "thread_id": "8780",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 581
          },
          {
            "timestamp": "2026-05-28 23:00:50,222",
            "thread_id": "8780",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 582
          },
          {
            "timestamp": "2026-05-28 23:00:50,222",
            "thread_id": "8780",
            "caller": "0x7ffcd9486b2d",
            "parentcaller": "0x7ffcd920f3e9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 583
          },
          {
            "timestamp": "2026-05-28 23:00:50,222",
            "thread_id": "8796",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000064c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000674"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 584
          },
          {
            "timestamp": "2026-05-28 23:00:50,238",
            "thread_id": "8780",
            "caller": "0x7ffcd920dd6a",
            "parentcaller": "0x7ffcd920d989",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 8,
            "id": 585
          },
          {
            "timestamp": "2026-05-28 23:00:50,363",
            "thread_id": "8780",
            "caller": "0x7ffcd9217e1d",
            "parentcaller": "0x7ffcd9217a50",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "EAC8A024-21E2-4523-AD73-A71A0AA2F56A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "81166F58-DD98-11D3-A120-00105A1F515A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 586
          },
          {
            "timestamp": "2026-05-28 23:00:50,363",
            "thread_id": "8780",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x08\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 587
          },
          {
            "timestamp": "2026-05-28 23:00:50,363",
            "thread_id": "8780",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x8f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 588
          },
          {
            "timestamp": "2026-05-28 23:00:50,363",
            "thread_id": "8780",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 589
          },
          {
            "timestamp": "2026-05-28 23:00:50,363",
            "thread_id": "8780",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x0e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 590
          },
          {
            "timestamp": "2026-05-28 23:00:50,363",
            "thread_id": "8780",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x86\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 591
          },
          {
            "timestamp": "2026-05-28 23:00:50,363",
            "thread_id": "8780",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0?\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 592
          },
          {
            "timestamp": "2026-05-28 23:00:50,363",
            "thread_id": "8780",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x94\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 593
          },
          {
            "timestamp": "2026-05-28 23:00:50,363",
            "thread_id": "8780",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80&\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 594
          },
          {
            "timestamp": "2026-05-28 23:00:50,363",
            "thread_id": "8780",
            "caller": "0x7ffcd91085a4",
            "parentcaller": "0x7ffcd910829c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 595
          },
          {
            "timestamp": "2026-05-28 23:00:50,363",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 596
          },
          {
            "timestamp": "2026-05-28 23:00:50,363",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 597
          },
          {
            "timestamp": "2026-05-28 23:00:50,363",
            "thread_id": "8796",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000648"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000680"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 598
          },
          {
            "timestamp": "2026-05-28 23:00:50,363",
            "thread_id": "8796",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000648"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000650"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 599
          },
          {
            "timestamp": "2026-05-28 23:00:50,363",
            "thread_id": "8796",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000648"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004c4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 600
          },
          {
            "timestamp": "2026-05-28 23:00:50,363",
            "thread_id": "8796",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000648"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000660"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 601
          },
          {
            "timestamp": "2026-05-28 23:00:50,378",
            "thread_id": "8780",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 602
          },
          {
            "timestamp": "2026-05-28 23:00:50,394",
            "thread_id": "8780",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 603
          },
          {
            "timestamp": "2026-05-28 23:00:50,394",
            "thread_id": "8780",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 604
          },
          {
            "timestamp": "2026-05-28 23:00:50,394",
            "thread_id": "8796",
            "caller": "0x7ffceadd2508",
            "parentcaller": "0x7ffceadd4a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 605
          },
          {
            "timestamp": "2026-05-28 23:00:50,503",
            "thread_id": "8780",
            "caller": "0x7ffcd9219ec9",
            "parentcaller": "0x7ffcd9209afd",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8BEBCE8B-1AF0-4323-8B4D-36994567CAE1"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 606
          },
          {
            "timestamp": "2026-05-28 23:00:50,503",
            "thread_id": "8780",
            "caller": "0x7ffcd9486b2d",
            "parentcaller": "0x7ffcd920cae0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 607
          },
          {
            "timestamp": "2026-05-28 23:00:50,503",
            "thread_id": "8780",
            "caller": "0x7ffcd920410f",
            "parentcaller": "0x7ffcd920cc36",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 608
          },
          {
            "timestamp": "2026-05-28 23:00:50,503",
            "thread_id": "8780",
            "caller": "0x7ffcd9219ec9",
            "parentcaller": "0x7ffcd9219d5b",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 609
          },
          {
            "timestamp": "2026-05-28 23:00:50,519",
            "thread_id": "8796",
            "caller": "0x7ffceadd2508",
            "parentcaller": "0x7ffceadd4a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 610
          },
          {
            "timestamp": "2026-05-28 23:00:50,628",
            "thread_id": "8780",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\ncprov"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf4570000"
              }
            ],
            "repeated": 0,
            "id": 611
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8780",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\NCProv.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf4570000"
              }
            ],
            "repeated": 0,
            "id": 612
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8780",
            "caller": "0x7ffcd9202b67",
            "parentcaller": "0x7ffcd92029af",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "29F06F0C-FB7F-44A5-83CD-D41705D5C525"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": "NCProv.NCProvider.1"
              }
            ],
            "repeated": 0,
            "id": 613
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8780",
            "caller": "0x7ffcd9219ec9",
            "parentcaller": "0x7ffcd9219d5b",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 614
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8780",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcd9388cba",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000066c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000650"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 615
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8780",
            "caller": "0x7ffcd9219ec9",
            "parentcaller": "0x7ffcd9219d5b",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 616
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8780",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcd9388cba",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000066c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000660"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 617
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8780",
            "caller": "0x7ffcd9212823",
            "parentcaller": "0x7ffcd921a647",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 618
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8780",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcd9388cba",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000066c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000658"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 619
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8780",
            "caller": "0x7ffcd9212823",
            "parentcaller": "0x7ffcd9203e1c",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 620
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8780",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcd9388cba",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000658"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000066c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 621
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x15\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 622
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x8b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 623
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x0f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 624
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 625
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x11\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 626
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 627
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x10\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 628
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 %\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 629
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x18\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 630
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x12\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 631
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x89\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 632
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x12\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 633
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 634
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8796",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 635
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8780",
            "caller": "0x7ffcd9212823",
            "parentcaller": "0x7ffcd9203c7c",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 636
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8780",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcd9388cba",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000658"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000584"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 637
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "8780",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcf4574423",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x0000066c",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcf4572e40"
              },
              {
                "name": "Parameter",
                "value": "0x1d094afe740"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8940"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 638
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "6472",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x1001f001f0000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 9,
            "id": 639
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "6472",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffce8f0488a",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000584",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffce8f03ca0"
              },
              {
                "name": "Parameter",
                "value": "0x1d0924653c0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8944"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 640
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "6456",
            "caller": "0x7ffcf8fd6579",
            "parentcaller": "0x7ffcf8fd5fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x1007000700000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 9,
            "id": 641
          },
          {
            "timestamp": "2026-05-28 23:00:50,660",
            "thread_id": "6456",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffce8f0488a",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x0000065c",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffce8f03ca0"
              },
              {
                "name": "Parameter",
                "value": "0x1d0924f2e20"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8948"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 642
          },
          {
            "timestamp": "2026-05-28 23:01:10,050",
            "thread_id": "4376",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 643
          },
          {
            "timestamp": "2026-05-28 23:01:10,050",
            "thread_id": "4376",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefc4359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd9470000"
              }
            ],
            "repeated": 0,
            "id": 644
          },
          {
            "timestamp": "2026-05-28 23:01:10,050",
            "thread_id": "4376",
            "caller": "0x7ffcefc435f7",
            "parentcaller": "0x7ffcf9b8b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 645
          },
          {
            "timestamp": "2026-05-28 23:01:10,066",
            "thread_id": "1788",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000054c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 646
          },
          {
            "timestamp": "2026-05-28 23:01:10,066",
            "thread_id": "1788",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 647
          },
          {
            "timestamp": "2026-05-28 23:01:10,081",
            "thread_id": "1788",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 648
          },
          {
            "timestamp": "2026-05-28 23:01:10,081",
            "thread_id": "1788",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd938a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 649
          },
          {
            "timestamp": "2026-05-28 23:01:10,097",
            "thread_id": "4376",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcd949c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000544",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcd949d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x1d094b0c460"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "1928"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 650
          },
          {
            "timestamp": "2026-05-28 23:01:10,128",
            "thread_id": "1928",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 651
          },
          {
            "timestamp": "2026-05-28 23:01:10,128",
            "thread_id": "1928",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 652
          },
          {
            "timestamp": "2026-05-28 23:01:10,128",
            "thread_id": "1928",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 653
          },
          {
            "timestamp": "2026-05-28 23:01:10,128",
            "thread_id": "1928",
            "caller": "0x7ffcd9486b2d",
            "parentcaller": "0x7ffcd920f3e9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 654
          },
          {
            "timestamp": "2026-05-28 23:01:10,128",
            "thread_id": "1928",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcd949c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x0000069c",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcd949d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x1d094b0cdc0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "2052"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 655
          },
          {
            "timestamp": "2026-05-28 23:01:10,160",
            "thread_id": "2052",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000694"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006a4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 656
          },
          {
            "timestamp": "2026-05-28 23:01:10,160",
            "thread_id": "1928",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000039c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80@\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 657
          },
          {
            "timestamp": "2026-05-28 23:01:10,160",
            "thread_id": "4376",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd936d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 658
          },
          {
            "timestamp": "2026-05-28 23:01:10,160",
            "thread_id": "1788",
            "caller": "0x7ffcd9488250",
            "parentcaller": "0x7ffcf956b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 659
          },
          {
            "timestamp": "2026-05-28 23:01:10,175",
            "thread_id": "3680",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd936d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 660
          },
          {
            "timestamp": "2026-05-28 23:01:10,175",
            "thread_id": "3680",
            "caller": "0x7ffcd9488250",
            "parentcaller": "0x7ffcf956b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 661
          },
          {
            "timestamp": "2026-05-28 23:01:10,175",
            "thread_id": "4376",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd936d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 662
          },
          {
            "timestamp": "2026-05-28 23:01:10,175",
            "thread_id": "4376",
            "caller": "0x7ffcd9488250",
            "parentcaller": "0x7ffcf956b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 663
          },
          {
            "timestamp": "2026-05-28 23:01:10,269",
            "thread_id": "4376",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd936d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 664
          },
          {
            "timestamp": "2026-05-28 23:01:10,269",
            "thread_id": "4376",
            "caller": "0x7ffcd9488250",
            "parentcaller": "0x7ffcf956b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 665
          },
          {
            "timestamp": "2026-05-28 23:01:10,285",
            "thread_id": "4376",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 666
          },
          {
            "timestamp": "2026-05-28 23:01:10,285",
            "thread_id": "4376",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefc4359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd9470000"
              }
            ],
            "repeated": 0,
            "id": 667
          },
          {
            "timestamp": "2026-05-28 23:01:10,285",
            "thread_id": "4376",
            "caller": "0x7ffcefc435f7",
            "parentcaller": "0x7ffcf9b8b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 668
          },
          {
            "timestamp": "2026-05-28 23:01:10,300",
            "thread_id": "4376",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 669
          },
          {
            "timestamp": "2026-05-28 23:01:10,331",
            "thread_id": "4376",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80(\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 670
          },
          {
            "timestamp": "2026-05-28 23:01:10,331",
            "thread_id": "4376",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 671
          },
          {
            "timestamp": "2026-05-28 23:01:10,331",
            "thread_id": "4376",
            "caller": "0x7ffcf900befb",
            "parentcaller": "0x7ffcd92ea158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 672
          },
          {
            "timestamp": "2026-05-28 23:01:10,331",
            "thread_id": "4376",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 673
          },
          {
            "timestamp": "2026-05-28 23:01:10,331",
            "thread_id": "4376",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd938a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 674
          },
          {
            "timestamp": "2026-05-28 23:01:10,331",
            "thread_id": "1928",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 675
          },
          {
            "timestamp": "2026-05-28 23:01:10,363",
            "thread_id": "1928",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 676
          },
          {
            "timestamp": "2026-05-28 23:01:10,363",
            "thread_id": "1928",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 677
          },
          {
            "timestamp": "2026-05-28 23:01:10,394",
            "thread_id": "1928",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd913677f",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 678
          },
          {
            "timestamp": "2026-05-28 23:01:10,394",
            "thread_id": "1928",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcefbc46f4",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000334",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcefbc4a00"
              },
              {
                "name": "Parameter",
                "value": "0x1d094aa5bd0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "2116"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 679
          },
          {
            "timestamp": "2026-05-28 23:01:10,410",
            "thread_id": "2052",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006b4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006b8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 680
          },
          {
            "timestamp": "2026-05-28 23:01:10,410",
            "thread_id": "2052",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006a4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006b8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 681
          },
          {
            "timestamp": "2026-05-28 23:01:10,410",
            "thread_id": "2116",
            "caller": "0x7ffcd91085a4",
            "parentcaller": "0x7ffcd910829c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 682
          },
          {
            "timestamp": "2026-05-28 23:01:10,410",
            "thread_id": "2116",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 683
          },
          {
            "timestamp": "2026-05-28 23:01:10,425",
            "thread_id": "2116",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 684
          },
          {
            "timestamp": "2026-05-28 23:01:10,425",
            "thread_id": "2116",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 685
          },
          {
            "timestamp": "2026-05-28 23:01:10,425",
            "thread_id": "2116",
            "caller": "0x7ffcd9486b2d",
            "parentcaller": "0x7ffcd920f3e9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 686
          },
          {
            "timestamp": "2026-05-28 23:01:10,425",
            "thread_id": "2052",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006cc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006d0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 687
          },
          {
            "timestamp": "2026-05-28 23:01:10,425",
            "thread_id": "2052",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006c0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006d0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 688
          },
          {
            "timestamp": "2026-05-28 23:01:10,425",
            "thread_id": "2052",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006c0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006d4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 689
          },
          {
            "timestamp": "2026-05-28 23:01:10,425",
            "thread_id": "2052",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006c0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006d8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 690
          },
          {
            "timestamp": "2026-05-28 23:01:10,425",
            "thread_id": "2052",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcd949c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000006e0",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcd949d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x1d094b50090"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "2236"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 691
          },
          {
            "timestamp": "2026-05-28 23:01:10,425",
            "thread_id": "2052",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006c0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006e8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 692
          },
          {
            "timestamp": "2026-05-28 23:01:10,425",
            "thread_id": "2052",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcd949c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000006f0",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcd949d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x1d094b505e0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "2244"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 693
          },
          {
            "timestamp": "2026-05-28 23:01:10,425",
            "thread_id": "1928",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000690"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006e8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 694
          },
          {
            "timestamp": "2026-05-28 23:01:10,441",
            "thread_id": "4376",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd936d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 695
          },
          {
            "timestamp": "2026-05-28 23:01:10,441",
            "thread_id": "1928",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcefbbb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006d4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000348"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 696
          },
          {
            "timestamp": "2026-05-28 23:01:10,441",
            "thread_id": "4376",
            "caller": "0x7ffcd9488250",
            "parentcaller": "0x7ffcf956b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 697
          },
          {
            "timestamp": "2026-05-28 23:02:56,316",
            "thread_id": "4376",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 698
          },
          {
            "timestamp": "2026-05-28 23:02:56,316",
            "thread_id": "4376",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcefc4359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd9470000"
              }
            ],
            "repeated": 0,
            "id": 699
          },
          {
            "timestamp": "2026-05-28 23:02:56,316",
            "thread_id": "4376",
            "caller": "0x7ffcefc435f7",
            "parentcaller": "0x7ffcf9b8b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 700
          },
          {
            "timestamp": "2026-05-28 23:02:56,316",
            "thread_id": "2232",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000054c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 701
          },
          {
            "timestamp": "2026-05-28 23:02:56,316",
            "thread_id": "2268",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000002f4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 702
          },
          {
            "timestamp": "2026-05-28 23:02:56,472",
            "thread_id": "2268",
            "caller": "0x7ffcd9213a1a",
            "parentcaller": "0x7ffcd9488f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 703
          },
          {
            "timestamp": "2026-05-28 23:02:56,488",
            "thread_id": "2268",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 704
          },
          {
            "timestamp": "2026-05-28 23:02:56,488",
            "thread_id": "2268",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd938a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 705
          },
          {
            "timestamp": "2026-05-28 23:02:56,503",
            "thread_id": "2276",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006f8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 706
          },
          {
            "timestamp": "2026-05-28 23:02:56,503",
            "thread_id": "2276",
            "caller": "0x7ffcfabdb8ed",
            "parentcaller": "0x7ffcd949c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000320",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcd949d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x1d094b4e7e0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "7620"
              },
              {
                "name": "ProcessId",
                "value": "4344"
              }
            ],
            "repeated": 0,
            "id": 707
          },
          {
            "timestamp": "2026-05-28 23:02:56,503",
            "thread_id": "2276",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd936d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 708
          },
          {
            "timestamp": "2026-05-28 23:02:56,503",
            "thread_id": "2232",
            "caller": "0x7ffcd9488250",
            "parentcaller": "0x7ffcf956b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 709
          },
          {
            "timestamp": "2026-05-28 23:02:56,519",
            "thread_id": "7620",
            "caller": "0x7ffcefbc2c1e",
            "parentcaller": "0x7ffcd9489057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 710
          }
        ],
        "threads": [
          "3680",
          "6560",
          "6568",
          "6592",
          "6852",
          "4376",
          "5380",
          "5328",
          "6424",
          "8780",
          "8784",
          "8788",
          "8796",
          "8804",
          "8800",
          "6472",
          "6456",
          "1788",
          "1928",
          "2052",
          "2116",
          "2232",
          "2268",
          "2276",
          "7620"
        ],
        "environ": {
          "UserName": "SYSTEM",
          "ComputerName": "DESKTOP-HGH2VBT",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Windows\\TEMP\\",
          "CommandLine": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff6cca40000",
          "MainExeSize": "0x00010000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 6648,
        "process_name": "WmiPrvSE.exe",
        "parent_id": 760,
        "module_path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
        "first_seen": "2026-05-28 22:59:39,973",
        "calls": [
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b162cd1",
            "parentcaller": "0x7ff61b16264a",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc09000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6768",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc0a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15ca74",
            "parentcaller": "0x7ff61b15c74d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfabc0000"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15ca74",
            "parentcaller": "0x7ff61b15c74d",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000022c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15ca74",
            "parentcaller": "0x7ff61b15c74d",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000230"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691f9d0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x5f4f78f240"
              },
              {
                "name": "ViewSize",
                "value": "0x00338000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c96b",
            "parentcaller": "0x7ff61b15c762",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SystemResources\\USER32.dll.mun"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c96b",
            "parentcaller": "0x7ff61b15c762",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc0f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c99f",
            "parentcaller": "0x7ff61b15c762",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000230"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\USER32.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c99f",
            "parentcaller": "0x7ff61b15c762",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000234"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691e310000"
              },
              {
                "name": "SectionOffset",
                "value": "0x5f4f78e6c0"
              },
              {
                "name": "ViewSize",
                "value": "0x00005000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c378",
            "parentcaller": "0x7ff61b15b501",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000234"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\rpcss.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c378",
            "parentcaller": "0x7ff61b15b501",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000238"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691fd10000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00143000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c378",
            "parentcaller": "0x7ff61b15b501",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691fd10000"
              },
              {
                "name": "RegionSize",
                "value": "0x00143000"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c378",
            "parentcaller": "0x7ff61b15b501",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000023c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c378",
            "parentcaller": "0x7ff61b15b501",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000240"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf6970000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c378",
            "parentcaller": "0x7ff61b15b501",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf6970000"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c378",
            "parentcaller": "0x7ff61b15b501",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000001f8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8d60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00082000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c378",
            "parentcaller": "0x7ff61b15b501",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptPrimitives"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf8d60000"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c378",
            "parentcaller": "0x7ff61b15b501",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000001f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\Device\\CNG"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c378",
            "parentcaller": "0x7ff61b15b501",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc10000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c5a5",
            "parentcaller": "0x7ff61b15b501",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc16000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c5a5",
            "parentcaller": "0x7ff61b15b501",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc19000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c60b",
            "parentcaller": "0x7ff61b15b501",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\clbcatq"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcfab10000"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c60b",
            "parentcaller": "0x7ff61b15b501",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000034B-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "0000015B-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c2ca",
            "parentcaller": "0x7ff61b15b513",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000270"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691e340000"
              },
              {
                "name": "SectionOffset",
                "value": "0x5f4f78f670"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c1b9",
            "parentcaller": "0x7ff61b15b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691e1c7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c1b9",
            "parentcaller": "0x7ff61b15b518",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000288",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffce8f04f50"
              },
              {
                "name": "Parameter",
                "value": "0x1691dc1cfe0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "6820"
              },
              {
                "name": "ProcessId",
                "value": "6648"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c1ff",
            "parentcaller": "0x7ff61b15b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691fd10000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c1ff",
            "parentcaller": "0x7ff61b15b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691fd10000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c1ff",
            "parentcaller": "0x7ff61b15b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691fd12000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c1ff",
            "parentcaller": "0x7ff61b15b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691fd13000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c1ff",
            "parentcaller": "0x7ff61b15b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc1f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c1ff",
            "parentcaller": "0x7ff61b15b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc20000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c1ff",
            "parentcaller": "0x7ff61b15b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691fd16000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c1ff",
            "parentcaller": "0x7ff61b15b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c1ff",
            "parentcaller": "0x7ff61b15b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc24000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c1ff",
            "parentcaller": "0x7ff61b15b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc25000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15c1ff",
            "parentcaller": "0x7ff61b15b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691fd1b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15b555",
            "parentcaller": "0x7ff61b15c77a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemprox"
              },
              {
                "name": "DllBase",
                "value": "0x7ffce8ee0000"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15b555",
            "parentcaller": "0x7ff61b15c77a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemprox.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce8ee0000"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15b555",
            "parentcaller": "0x7ff61b15c77a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F811-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6836",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000002c4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6836",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc31000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6836",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc32000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15b5bc",
            "parentcaller": "0x7ff61b15c77a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000032A-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000149-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15b5bc",
            "parentcaller": "0x7ff61b15c77a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15b5bc",
            "parentcaller": "0x7ff61b15c77a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemsvc"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcef1a0000"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15b5bc",
            "parentcaller": "0x7ff61b15c77a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemsvc.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcef1a0000"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:59:40,004",
            "thread_id": "6652",
            "caller": "0x7ff61b15b5bc",
            "parentcaller": "0x7ff61b15c77a",
            "category": "com",
            "api": "CoCreateInstanceEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8BC3F05E-D86B-11D0-A075-00C04FB68820"
              },
              {
                "name": "ClsContext",
                "value": "0x00000014",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "ServerName",
                "value": ""
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6652",
            "caller": "0x7ff61b15b5bc",
            "parentcaller": "0x7ff61b15c77a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\fastprox.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd9360000"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6652",
            "caller": "0x7ff61b15b5bc",
            "parentcaller": "0x7ff61b15c77a",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc37000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6652",
            "caller": "0x7ff61b15b5bc",
            "parentcaller": "0x7ff61b15c77a",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc39000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6652",
            "caller": "0x7ff61b15b5bc",
            "parentcaller": "0x7ff61b15c77a",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6652",
            "caller": "0x7ff61b15dafb",
            "parentcaller": "0x7ff61b15b615",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6652",
            "caller": "0x7ff61b15b1d8",
            "parentcaller": "0x7ff61b15b33c",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000002d4",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ff61b15b120"
              },
              {
                "name": "Parameter",
                "value": "0x1691dc38fd0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "6868"
              },
              {
                "name": "ProcessId",
                "value": "6648"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000310"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc3c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc3f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ffcd938addd",
            "parentcaller": "0x7ffcd938a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b15f038",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wmiutils"
              },
              {
                "name": "DllBase",
                "value": "0x7ffceadd0000"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b15f038",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wmiutils.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffceadd0000"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b15f038",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf9b76d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000031c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b158469",
            "parentcaller": "0x7ff61b1519c9",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc46000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b151cb2",
            "parentcaller": "0x7ff61b151a68",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc47000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b151cb2",
            "parentcaller": "0x7ff61b151a68",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b154e98",
            "parentcaller": "0x7ff61b151ab3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b154e98",
            "parentcaller": "0x7ff61b151ab3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc49000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b154ef3",
            "parentcaller": "0x7ff61b151ab3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc4b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b1556cb",
            "parentcaller": "0x7ff61b155514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\powrprof"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf88f0000"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b1556cb",
            "parentcaller": "0x7ff61b155514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\framedynos"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd8e80000"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b1556cb",
            "parentcaller": "0x7ff61b155514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\cimwin32"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd8ee0000"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b1556cb",
            "parentcaller": "0x7ff61b155514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\UMPDC"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf88d0000"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b1556cb",
            "parentcaller": "0x7ff61b155514",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\cimwin32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd8ee0000"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b1556cb",
            "parentcaller": "0x7ff61b155514",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "D63A5850-8F16-11CF-9F47-00AA00BF345C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b15998d",
            "parentcaller": "0x7ff61b15899b",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ff61b157ab2",
            "parentcaller": "0x7ff61b155b48",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ffcd938a4f0",
            "parentcaller": "0x7ffcd938a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc4f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ffcd938addd",
            "parentcaller": "0x7ffcd938a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:59:40,020",
            "thread_id": "6840",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ffcd938addd",
            "parentcaller": "0x7ffcf9bd0030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc52000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc58000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc5a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfad50000"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000348"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wtsapi32.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000344"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf5df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00014000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wtsapi32"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf5df0000"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000348"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\winsta.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000340"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf87c0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0005b000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WINSTA"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf87c0000"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfb3b0000"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc5d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000034c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tzres.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x40000003",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000350"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691e370000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00003000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000034c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000350"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691e380000"
              },
              {
                "name": "SectionOffset",
                "value": "0x5f4fefb8e0"
              },
              {
                "name": "ViewSize",
                "value": "0x0000c000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691e380000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691e370000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000034c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tzres.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x40000003",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000350"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691e370000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00003000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000034c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000350"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691e380000"
              },
              {
                "name": "SectionOffset",
                "value": "0x5f4fefb8e0"
              },
              {
                "name": "ViewSize",
                "value": "0x0000c000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691e380000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691e370000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\cfgmgr32"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf93c0000"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DEVOBJ"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf85a0000"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "DEVOBJ.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf85a0000"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc69000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WMI"
              },
              {
                "name": "DllBase",
                "value": "0x1691e370000"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "WMI.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691e370000"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000358"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wmiclnt.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000360"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf2f60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00011000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wmiclnt"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf2f60000"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000358"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\WMIDataDevice"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691fd33000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x0000035c",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcd8eed930"
              },
              {
                "name": "Parameter",
                "value": "0x7ffcd90d4460"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "7000"
              },
              {
                "name": "ProcessId",
                "value": "6648"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NETAPI32"
              },
              {
                "name": "DllBase",
                "value": "0x7ffce8c90000"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "NETAPI32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce8c90000"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000368"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\samcli.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000370"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcefa90000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00019000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\SAMCLI"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcefa90000"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000368"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\srvcli.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000036c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcee910000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00028000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\SRVCLI"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcee910000"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000378"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\netutils.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000037c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf7e90000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0000c000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NETUTILS"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf7e90000"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000378"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\logoncli.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000380"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf7f70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00043000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:59:40,036",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\LOGONCLI"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf7f70000"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000388"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\schedcli.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000038c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce8ed0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0000c000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\SCHEDCLI"
              },
              {
                "name": "DllBase",
                "value": "0x7ffce8ed0000"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000388"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wkscli.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000038c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf7bf0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00019000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WKSCLI"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf7bf0000"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000038c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\dsrole.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000390"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf6520000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0000a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DSROLE"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf6520000"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000398"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\lsarpc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000398"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000398"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000398"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\xbf\\xc1\\x1di\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000038c"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\srvsvc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000038c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000038c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000038c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xc0\\xc1\\x1di\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\lsarpc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003a4"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003a4"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003a4"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\xbf\\xc1\\x1di\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OemInfo.Ini"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OemLogo.Bmp"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ffcd938addd",
            "parentcaller": "0x7ffcd938a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:59:40,051",
            "thread_id": "6840",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:59:40,067",
            "thread_id": "6840",
            "caller": "0x7ffcd938addd",
            "parentcaller": "0x7ffcf9bd0030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:59:40,067",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:59:40,067",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc5d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:59:40,067",
            "thread_id": "6840",
            "caller": "0x7ff61b16158d",
            "parentcaller": "0x7ff61b1611eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:59:40,067",
            "thread_id": "6840",
            "caller": "0x7ffcd938addd",
            "parentcaller": "0x7ffcd938a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:59:40,067",
            "thread_id": "6840",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:59:40,067",
            "thread_id": "6840",
            "caller": "0x7ffcd938addd",
            "parentcaller": "0x7ffcf9bd0030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:59:40,067",
            "thread_id": "6840",
            "caller": "0x7ff61b15906c",
            "parentcaller": "0x7ff61b158cc3",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:59:40,067",
            "thread_id": "6840",
            "caller": "0x7ff61b15906c",
            "parentcaller": "0x7ff61b158cc3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691fd35000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:59:40,067",
            "thread_id": "6840",
            "caller": "0x7ff61b15906c",
            "parentcaller": "0x7ff61b158cc3",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:59:40,067",
            "thread_id": "6840",
            "caller": "0x7ff61b15906c",
            "parentcaller": "0x7ff61b158cc3",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003b0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691fe10000"
              },
              {
                "name": "SectionOffset",
                "value": "0x5f4fefbab0"
              },
              {
                "name": "ViewSize",
                "value": "0x00003000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:59:40,082",
            "thread_id": "6840",
            "caller": "0x7ff61b15456f",
            "parentcaller": "0x7ff61b153ff4",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc72000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:59:40,082",
            "thread_id": "6840",
            "caller": "0x7ff61b15456f",
            "parentcaller": "0x7ff61b153ff4",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc75000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:59:40,082",
            "thread_id": "6836",
            "caller": "0x7ff61b16396c",
            "parentcaller": "0x7ff61b19205b",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000039c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:59:40,082",
            "thread_id": "6184",
            "caller": "0x7ffcfb3bed8a",
            "parentcaller": "0x7ffcfb3ddb07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc6a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6836",
            "caller": "0x7ff61b156c89",
            "parentcaller": "0x7ff61b156a62",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc51000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6836",
            "caller": "0x7ff61b156c89",
            "parentcaller": "0x7ff61b156a62",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc57000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6836",
            "caller": "0x7ff61b156c89",
            "parentcaller": "0x7ff61b156a62",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NETAPI32"
              },
              {
                "name": "DllBase",
                "value": "0x7ffce8c90000"
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\SAMCLI"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcefa90000"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcefa90000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\SRVCLI"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcee910000"
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcee910000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NETUTILS"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf7e90000"
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf7e90000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\LOGONCLI"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf7f70000"
              }
            ],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf7f70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\SCHEDCLI"
              },
              {
                "name": "DllBase",
                "value": "0x7ffce8ed0000"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce8ed0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WKSCLI"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf7bf0000"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf7bf0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DSROLE"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf6520000"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf6520000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce8c90000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WMI"
              },
              {
                "name": "DllBase",
                "value": "0x1691e370000"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wmiclnt"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf2f60000"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf2f60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-05-28 23:00:10,082",
            "thread_id": "6868",
            "caller": "0x7ff61b15fdc2",
            "parentcaller": "0x7ff61b15ab73",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691e370000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-05-28 23:00:40,004",
            "thread_id": "6836",
            "caller": "0x7ffcfb3bed8a",
            "parentcaller": "0x7ffcfb3d64ab",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc5d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b15cedd",
            "parentcaller": "0x7ff61b159d3e",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000003b0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemsvc"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcef1a0000"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcef1a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemprox"
              },
              {
                "name": "DllBase",
                "value": "0x7ffce8ee0000"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce8ee0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691fd22000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691fd29000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\cimwin32"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd8ee0000"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691fe10000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\powrprof"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf88f0000"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\UMPDC"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf88d0000"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf88d0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf88f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\framedynos"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd8e80000"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd8e80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd8ee0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wmiutils"
              },
              {
                "name": "DllBase",
                "value": "0x7ffceadd0000"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6868",
            "caller": "0x7ff61b159d51",
            "parentcaller": "0x7ff61b15cf09",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffceadd0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6652",
            "caller": "0x7ff61b15b7e8",
            "parentcaller": "0x7ff61b15c77a",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000002d4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000032c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6652",
            "caller": "0x7ff61b16274f",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtTerminateProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitCode",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6652",
            "caller": "0x7ff61b16274f",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691e1c7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6652",
            "caller": "0x7ff61b16274f",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1691dc0f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-05-28 23:00:40,098",
            "thread_id": "6652",
            "caller": "0x7ff61b16274f",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtTerminateProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ExitCode",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 222
          }
        ],
        "threads": [
          "6652",
          "6768",
          "6836",
          "6840",
          "6184",
          "6868"
        ],
        "environ": {
          "UserName": "DESKTOP-HGH2VBT$",
          "ComputerName": "DESKTOP-HGH2VBT",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Windows\\TEMP\\",
          "CommandLine": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff61b150000",
          "MainExeSize": "0x0007e000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 6204,
        "process_name": "vdsldr.exe",
        "parent_id": 760,
        "module_path": "C:\\Windows\\System32\\vdsldr.exe",
        "first_seen": "2026-05-28 22:59:40,191",
        "calls": [
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ffcfb41c2c7",
            "parentcaller": "0x7ffcfb41c05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\atl"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce2620000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ffce2621d50"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ffcfb41c2c7",
            "parentcaller": "0x7ffcfb41c05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcd"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd8e20000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ffcd8e34cd0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ffcd8e51dbe",
            "parentcaller": "0x7ffcf9faa553",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Services\\vds\\DebugLog"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\vds\\DebugLog"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ffcd8e51dbe",
            "parentcaller": "0x7ffcf9faa553",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\vdsutil"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd8e50000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ffcd8e62070"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ffcfb42507d",
            "parentcaller": "0x7ffcfb424c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff733aa3c60"
              },
              {
                "name": "Parameter",
                "value": "0xc655343000"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "7220",
            "caller": "0x7ffcfb42507d",
            "parentcaller": "0x7ffcfb424c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "7220",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ffcd8a91ed0"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "7212",
            "caller": "0x7ffcfb40eb32",
            "parentcaller": "0x7ffcfb3c77c3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000038"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 2,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "7216",
            "caller": "0x7ffcfb42507d",
            "parentcaller": "0x7ffcfb424c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "7216",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ffcd8a92030"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "7212",
            "caller": "0x7ffcfb42507d",
            "parentcaller": "0x7ffcfb424c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "7212",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ffcd8a91e10"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "7208",
            "caller": "0x7ffcfb42507d",
            "parentcaller": "0x7ffcfb424c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "7208",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ffcd8a91a00"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa3d41",
            "parentcaller": "0x7ff733aa3ab8",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x7ff733aa3cf0"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa39de",
            "parentcaller": "0x7ff733aa3afd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a5f7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa144c",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x2168a672376",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\System32\\vdsldr.exe -Embedding"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa14af",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "52"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x08\\x00\\x00\\x00\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa14ca",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "52"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa14e5",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "52"
              },
              {
                "name": "ProcessInformation",
                "value": "\t\\x00\\x00\\x00\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1503",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "52"
              },
              {
                "name": "ProcessInformation",
                "value": "\n\\x00\\x00\\x00\\x03\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "42"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "6200"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000001fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000204"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000001fc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf6970000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf697f000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf6975000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf6975000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf6975000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf6975000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf6975000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001fc"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf6975000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf6970000"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf6970000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ffcf6973f10"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf9e81000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf9e81000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000023c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "bcryptPrimitives.dll"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000023c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8d60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00082000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8dc7000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8dc7000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8dc7000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8dc7000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8dc7000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000023c"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8dc7000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptPrimitives"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcf8d60000"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000244"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000244"
              },
              {
                "name": "ValueName",
                "value": "STE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000244"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000244"
              },
              {
                "name": "ValueName",
                "value": "Enabled"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000248"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000248"
              },
              {
                "name": "ValueName",
                "value": "FipsAlgorithmPolicy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000244"
              },
              {
                "name": "ValueName",
                "value": "MDMEnabled"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000248"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\Device\\CNG"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000248"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390008",
                "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x1b\\x1f\\xbeg\\xa0B\\xe7q\\x83w\\xe5\\x98\\x8a~\\xf8\\xd7A\\xb6\\x9f4.\\xe6\\xbe1bA4Cp\\x8d\\xfb\\xb55\\xbfjX\\xcf\\xdc~\\x0cA\\xe8je\\x7f\\x98\\xb7~"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf8d60000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ffcf8d98b60"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf960e000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf960e000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1513",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a69e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1626",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000254"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7ff733aa1070"
              },
              {
                "name": "Parameter",
                "value": "0x7ff733aa7680"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "7292"
              },
              {
                "name": "ProcessId",
                "value": "6204"
              },
              {
                "name": "Module",
                "value": "vdsldr.exe"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1626",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000254",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ff733aa1070"
              },
              {
                "name": "Parameter",
                "value": "0x7ff733aa7680"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "7292"
              },
              {
                "name": "ProcessId",
                "value": "6204"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa163d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000254"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1232",
            "parentcaller": "0x7ff733aa165c",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf9e81000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf9e81000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "7292",
            "caller": "0x7ffcfb42507d",
            "parentcaller": "0x7ffcfb424c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a6a4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "7292",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff733aa1070"
              },
              {
                "name": "Parameter",
                "value": "0x7ff733aa7680"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "7292",
            "caller": "0x7ff733aa108a",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a6a5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcfb3b93b0"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcfb44fc40"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcfb3f2460"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcfb40cbd0"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "164"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000001fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000001fc"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001fc"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000001fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000001fc"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001fc"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcfb3b93b0"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcfb44fc40"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcfb3f2460"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcfb42fa30"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcfb40cbd0"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a6a7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE\\AppCompat"
              },
              {
                "name": "Handle",
                "value": "0x000001fc"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001fc"
              },
              {
                "name": "ValueName",
                "value": "RaiseActivationAuthenticationLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001fc"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000001fc"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "20"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "18"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf0\\xf0\\x12U\\xc6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\xc0\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\xa0\\xbd\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xa0\\xf1\\x12U\\xc6\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\xc7\\xd8"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000001f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\User\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001fc"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000001fa"
              },
              {
                "name": "SubKey",
                "value": "AppID\\vdsldr.exe"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\vdsldr.exe"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetProcedureAddress",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlWow64GetCurrentMachine"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcfb400d90"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetProcedureAddress",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlWow64IsWowGuestMachineSupported"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcfb42c670"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000001fa"
              },
              {
                "name": "SubKey",
                "value": "AppID\\vdsldr.exe"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\vdsldr.exe"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf0\\xf5\\x12U\\xc6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6C\\xfd\\xf8\\xfc\\x7f\\x00\\x00@m8Tn\\xcc\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf9e81000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf9e81000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa172d",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001f4"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1743",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\clbcatq"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcfab10000"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1743",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000034B-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "0000015B-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce2638000"
              },
              {
                "name": "ModuleName",
                "value": "ATL.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffce2638000"
              },
              {
                "name": "ModuleName",
                "value": "ATL.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000025e"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}"
              },
              {
                "name": "Handle",
                "value": "0x00000286"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000286"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000286"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0\\xe7\\x12U\\xc6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\x86\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xc6\\x00\\x00\\x00\\xc0\\xe8\\x12U\\xc6\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000286"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000286"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000286"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000286"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000286"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000286"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Virtual Disk Service Loader"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:59:40,253",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000286"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000286"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000286"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "P\\xe6\\x12U\\xc6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\x86\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xc6\\x00\\x00\\x00P\\xe7\\x12U\\xc6\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000286"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000286"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000286"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000286"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "P\\xe6\\x12U\\xc6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\x86\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xc6\\x00\\x00\\x00P\\xe7\\x12U\\xc6\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000286"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000286"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000286"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf9e81000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf9e81000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x2168a470000"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000183c"
              },
              {
                "name": "EventName",
                "value": "MSFT.VSA.COM.DISABLE.6204"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "EventName",
                "value": "MSFT.VSA.IEC.STATUS.6c736db0"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a6ab000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000001fa"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{00000134-0000-0000-C000-000000000046}"
              },
              {
                "name": "Handle",
                "value": "0x00000292"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000292"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000296"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000296"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{00000320-0000-0000-C000-000000000046}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000296"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000292"
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000290"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000294"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x94\n\\x07\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xcbh\\x8a\\x16\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xceh\\x8a\\x16\\x02\\x00\\x00`\\x00\\x00\\x00\\xadU?\\xac\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00.\\x00a\\x000\\xd7h\\x8a\\x16\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\x84j\\x8a\\x16\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "X\\xc9h\\x8a\\x16\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xcb\\xd8\\xfc\\x7f\\x00\\x00\\xebP\\xa3\\xd8\\xfc\\x7f\\x00\\x00p}8Tn\\xcc\\x00\\x00(N\\xc7\\xd8\\xfc\\x7f\\x00\\x00p\\xe9\\x12U\\xc6\\x00\\x00\\x00h\\xe9\\x12U\\xc6\\x00\\x00\\x008\\xe9\\x12U\\xc6\\x00\\x00\\x00X\\xe9\\x12U"
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xc9h\\x8a\\x16\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xa4\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xe7\\x12U\\xc6\\x00\\x00\\x00\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xc7\\xd8"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x94\n\\x07\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "x\\xcah\\x8a\\x16\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe0\\xcah\\x8a\\x16\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "X\\x80j\\x8a\\x16\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xcbh\\x8a\\x16\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xcb\\xd8\\xfc\\x7f\\x00\\x00\\xebP\\xa3\\xd8\\xfc\\x7f\\x00\\x00\\xd0@8Tn\\xcc\\x00\\x00(N\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\xd0\\xe5\\x12U\\xc6\\x00\\x00\\x00\\xc8\\xe5\\x12U\\xc6\\x00\\x00\\x00\\x98\\xe5\\x12U\\xc6\\x00\\x00\\x00\\xb8\\xe5\\x12U"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xcbh\\x8a\\x16\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xa4\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xb8\\xe3\\x12U\\xc6\\x00\\x00\\x00\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xc7\\xd8"
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a6ad000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcf9b50000"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000298"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7ffcf9bf2d30"
              },
              {
                "name": "Parameter",
                "value": "0x2168a697d10"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "7300"
              },
              {
                "name": "ProcessId",
                "value": "6204"
              },
              {
                "name": "Module",
                "value": "combase.dll"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000298",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ffcf9bf2d30"
              },
              {
                "name": "Parameter",
                "value": "0x2168a697d10"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "7300"
              },
              {
                "name": "ProcessId",
                "value": "6204"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000298"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x94\n\\x07\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xcbh\\x8a\\x16\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xceh\\x8a\\x16\\x02\\x00\\x00`\\x00\\x00\\x00\\xadU?\\xac\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00.\\x00a\\x000\\xd7h\\x8a\\x16\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "x\\x81j\\x8a\\x16\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xceh\\x8a\\x16\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xcb\\xd8\\xfc\\x7f\\x00\\x00\\xebP\\xa3\\xd8\\xfc\\x7f\\x00\\x00@y8Tn\\xcc\\x00\\x00(N\\xc7\\xd8\\xfc\\x7f\\x00\\x00@\\xed\\x12U\\xc6\\x00\\x00\\x008\\xed\\x12U\\xc6\\x00\\x00\\x00\\x08\\xed\\x12U\\xc6\\x00\\x00\\x00(\\xed\\x12U"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xceh\\x8a\\x16\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xa4\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xeb\\x12U\\xc6\\x00\\x00\\x00\\xac\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xc7\\xd8"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x94\n\\x07\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xcbh\\x8a\\x16\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a6af000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xf9j\\x8a\\x16\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "H\\x81j\\x8a\\x16\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "h\\xf3j\\x8a\\x16\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xcb\\xd8\\xfc\\x7f\\x00\\x00\\xebP\\xa3\\xd8\\xfc\\x7f\\x00\\x00\\xa0|8Tn\\xcc\\x00\\x00(N\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\xa0\\xe9\\x12U\\xc6\\x00\\x00\\x00\\x98\\xe9\\x12U\\xc6\\x00\\x00\\x00h\\xe9\\x12U\\xc6\\x00\\x00\\x00\\x88\\xe9\\x12U"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xf3j\\x8a\\x16\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xa4\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xe7\\x12U\\xc6\\x00\\x00\\x00\\xac\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xc7\\xd8"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000002ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x94\n\\x07\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xcbh\\x8a\\x16\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xcch\\x8a\\x16\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8\\x83j\\x8a\\x16\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "8\\xceh\\x8a\\x16\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xcb\\xd8\\xfc\\x7f\\x00\\x00\\xebP\\xa3\\xd8\\xfc\\x7f\\x00\\x00@y8Tn\\xcc\\x00\\x00(N\\xc7\\xd8\\xfc\\x7f\\x00\\x00@\\xed\\x12U\\xc6\\x00\\x00\\x008\\xed\\x12U\\xc6\\x00\\x00\\x00\\x08\\xed\\x12U\\xc6\\x00\\x00\\x00(\\xed\\x12U"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xceh\\x8a\\x16\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xa4\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xeb\\x12U\\xc6\\x00\\x00\\x00\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xc7\\xd8"
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x94\n\\x07\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xceh\\x8a\\x16\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd0\\xf3j\\x8a\\x16\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "x\\x81j\\x8a\\x16\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8\\xf1j\\x8a\\x16\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xcb\\xd8\\xfc\\x7f\\x00\\x00\\xebP\\xa3\\xd8\\xfc\\x7f\\x00\\x00\\xa0|8Tn\\xcc\\x00\\x00(N\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\xa0\\xe9\\x12U\\xc6\\x00\\x00\\x00\\x98\\xe9\\x12U\\xc6\\x00\\x00\\x00h\\xe9\\x12U\\xc6\\x00\\x00\\x00\\x88\\xe9\\x12U"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xf1j\\x8a\\x16\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xa4\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xe7\\x12U\\xc6\\x00\\x00\\x00\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xc7\\xd8"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000298"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x94\n\\x07\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xcbh\\x8a\\x16\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xcch\\x8a\\x16\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\\x82j\\x8a\\x16\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "8\\xceh\\x8a\\x16\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xcb\\xd8\\xfc\\x7f\\x00\\x00\\xebP\\xa3\\xd8\\xfc\\x7f\\x00\\x00@y8Tn\\xcc\\x00\\x00(N\\xc7\\xd8\\xfc\\x7f\\x00\\x00@\\xed\\x12U\\xc6\\x00\\x00\\x008\\xed\\x12U\\xc6\\x00\\x00\\x00\\x08\\xed\\x12U\\xc6\\x00\\x00\\x00(\\xed\\x12U"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xceh\\x8a\\x16\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xa4\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xeb\\x12U\\xc6\\x00\\x00\\x00\\xac\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xc7\\xd8"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x94\n\\x07\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xceh\\x8a\\x16\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xf5j\\x8a\\x16\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8\\x80j\\x8a\\x16\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8\\xf4j\\x8a\\x16\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xcb\\xd8\\xfc\\x7f\\x00\\x00\\xebP\\xa3\\xd8\\xfc\\x7f\\x00\\x00\\xa0|8Tn\\xcc\\x00\\x00(N\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\xa0\\xe9\\x12U\\xc6\\x00\\x00\\x00\\x98\\xe9\\x12U\\xc6\\x00\\x00\\x00h\\xe9\\x12U\\xc6\\x00\\x00\\x00\\x88\\xe9\\x12U"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xf4j\\x8a\\x16\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xa4\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xe7\\x12U\\xc6\\x00\\x00\\x00\\xac\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xc7\\xd8"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000002ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x94\n\\x07\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xcbh\\x8a\\x16\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xcch\\x8a\\x16\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "h\\x85j\\x8a\\x16\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "8\\xceh\\x8a\\x16\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xcb\\xd8\\xfc\\x7f\\x00\\x00\\xebP\\xa3\\xd8\\xfc\\x7f\\x00\\x00@y8Tn\\xcc\\x00\\x00(N\\xc7\\xd8\\xfc\\x7f\\x00\\x00@\\xed\\x12U\\xc6\\x00\\x00\\x008\\xed\\x12U\\xc6\\x00\\x00\\x00\\x08\\xed\\x12U\\xc6\\x00\\x00\\x00(\\xed\\x12U"
              }
            ],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xceh\\x8a\\x16\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xa4\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xeb\\x12U\\xc6\\x00\\x00\\x00\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xc7\\xd8"
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x94\n\\x07\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xceh\\x8a\\x16\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a6b1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x80\\x0fk\\x8a\\x16\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "X\\x80j\\x8a\\x16\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\x07k\\x8a\\x16\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xcb\\xd8\\xfc\\x7f\\x00\\x00\\xebP\\xa3\\xd8\\xfc\\x7f\\x00\\x00\\xa0|8Tn\\xcc\\x00\\x00(N\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\xa0\\xe9\\x12U\\xc6\\x00\\x00\\x00\\x98\\xe9\\x12U\\xc6\\x00\\x00\\x00h\\xe9\\x12U\\xc6\\x00\\x00\\x00\\x88\\xe9\\x12U"
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x07k\\x8a\\x16\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xa4\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xe7\\x12U\\xc6\\x00\\x00\\x00\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xc7\\xd8"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a6b3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb42507d",
            "parentcaller": "0x7ffcfb424c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ffcfb402b30"
              },
              {
                "name": "Parameter",
                "value": "0x2168a670b50"
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9006f4c",
            "parentcaller": "0x7ffcf951ef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000002ac"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a6b5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000002b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x94\n\\x07\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\tk\\x8a\\x16\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0\\x08k\\x8a\\x16\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "(\\x86j\\x8a\\x16\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\x0ck\\x8a\\x16\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xcb\\xd8\\xfc\\x7f\\x00\\x00\\xebP\\xa3\\xd8\\xfc\\x7f\\x00\\x00P\\x7f8Tn\\xcc\\x00\\x00(N\\xc7\\xd8\\xfc\\x7f\\x00\\x00P\\xeb\\x12U\\xc6\\x00\\x00\\x00H\\xeb\\x12U\\xc6\\x00\\x00\\x00\\x18\\xeb\\x12U\\xc6\\x00\\x00\\x008\\xeb\\x12U"
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x0ck\\x8a\\x16\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xa4\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xe9\\x12U\\xc6\\x00\\x00\\x00\\xb8\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xc7\\xd8"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x94\n\\x07\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "x\\x0ck\\x8a\\x16\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "@\nk\\x8a\\x16\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\x83j\\x8a\\x16\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "X\\x11k\\x8a\\x16\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xcb\\xd8\\xfc\\x7f\\x00\\x00\\xebP\\xa3\\xd8\\xfc\\x7f\\x00\\x00\\xb0B8Tn\\xcc\\x00\\x00(N\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\xb0\\xe7\\x12U\\xc6\\x00\\x00\\x00\\xa8\\xe7\\x12U\\xc6\\x00\\x00\\x00x\\xe7\\x12U\\xc6\\x00\\x00\\x00\\x98\\xe7\\x12U"
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x11k\\x8a\\x16\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xa4\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xe5\\x12U\\xc6\\x00\\x00\\x00\\xb8\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xc7\\xd8"
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b4"
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE"
              },
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE"
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "MaxSxSHashCount"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount"
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "6200",
            "caller": "0x7ff733aa1765",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a6b7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd54eb",
            "parentcaller": "0x7ffcf9b78ce0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "B\\x0f\\x07\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd6785",
            "parentcaller": "0x7ffcf9b78c8a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 321
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a6b8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fdac31",
            "parentcaller": "0x7ffcf9c242bf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcf9b50000"
              },
              {
                "name": "FunctionName",
                "value": "CoMarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcf9bcb0b0"
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fdac31",
            "parentcaller": "0x7ffcf9c242e9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcf9b50000"
              },
              {
                "name": "FunctionName",
                "value": "CoUnmarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcf9bc8b50"
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fdac31",
            "parentcaller": "0x7ffcf9c24313",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcf9b50000"
              },
              {
                "name": "FunctionName",
                "value": "StringFromIID"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcf9bf9780"
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fdac31",
            "parentcaller": "0x7ffcf9c2433d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcf9b50000"
              },
              {
                "name": "FunctionName",
                "value": "CoTaskMemAlloc"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcf9c02e80"
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fdac31",
            "parentcaller": "0x7ffcf9c24367",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcf9b50000"
              },
              {
                "name": "FunctionName",
                "value": "CoTaskMemFree"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcf9c01b70"
              }
            ],
            "repeated": 0,
            "id": 327
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fdac31",
            "parentcaller": "0x7ffcf9c24391",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcf9b50000"
              },
              {
                "name": "FunctionName",
                "value": "CoCreateInstance"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcf9b7a420"
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fdac31",
            "parentcaller": "0x7ffcf9c243bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcf9b50000"
              },
              {
                "name": "FunctionName",
                "value": "CoReleaseMarshalData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcf9b7e790"
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9c241cf",
            "parentcaller": "0x7ffcfb3f38c0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000032A-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000149-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 330
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd54eb",
            "parentcaller": "0x7ffcf9bab0ca",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9bc92b9",
            "parentcaller": "0x7ffcf9c0224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fc30ce",
            "parentcaller": "0x7ffcf9c02cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fc30ce",
            "parentcaller": "0x7ffcf9c02cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a6bb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ff733aa1a25",
            "parentcaller": "0x7ff733aa1cd8",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 336
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9b822bf",
            "parentcaller": "0x7ffcf9bffbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000001fa"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              },
              {
                "name": "Handle",
                "value": "0x000002ba"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9bffa51",
            "parentcaller": "0x7ffcf9bc42ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002ba"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000002b6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9bffa8c",
            "parentcaller": "0x7ffcf9bc42ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b6"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9bffad3",
            "parentcaller": "0x7ffcf9bc42ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b6"
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9bffae4",
            "parentcaller": "0x7ffcf9bc42ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ba"
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9b87b74",
            "parentcaller": "0x7ffcf9b853d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000025e"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              },
              {
                "name": "Handle",
                "value": "0x000002ba"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd45a7",
            "parentcaller": "0x7ffcf8fd0705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2314",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb3e6c8b",
            "parentcaller": "0x7ffcf8fd23a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe0\\xb9\\x87U\\xc6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\xba\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xc6\\x00\\x00\\x00\\xe0\\xba\\x87U\\xc6\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd24a8",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd40c4",
            "parentcaller": "0x7ffcf8fd25c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 347
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd25e2",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002ba"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9c122e1",
            "parentcaller": "0x7ffcf9b87c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2e92",
            "parentcaller": "0x7ffcf9b881f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ba"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2e92",
            "parentcaller": "0x7ffcf9b8870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ba"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2e92",
            "parentcaller": "0x7ffcf9b887bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ba"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "VDS ProxyStub"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9b88485",
            "parentcaller": "0x7ffcf9b8829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002ba"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x000002b6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2e92",
            "parentcaller": "0x7ffcf9b8870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b6"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2e92",
            "parentcaller": "0x7ffcf9b8870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b6"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 355
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8ff4aa9",
            "parentcaller": "0x7ffcf8fd31c6",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b6"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%SystemRoot%\\System32\\vds_ps.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 1,
            "id": 356
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2e92",
            "parentcaller": "0x7ffcf9b88d32",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b6"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9b8855f",
            "parentcaller": "0x7ffcf9b8829e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b6"
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd45a7",
            "parentcaller": "0x7ffcf8fd0705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 359
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2314",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 360
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb3e6c8b",
            "parentcaller": "0x7ffcf8fd23a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xb8\\x87U\\xc6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\xba\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xc6\\x00\\x00\\x00p\\xb9\\x87U\\xc6\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd24a8",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd40c4",
            "parentcaller": "0x7ffcf8fd25c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd25e2",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002ba"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd45a7",
            "parentcaller": "0x7ffcf8fd0705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2314",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb3e6c8b",
            "parentcaller": "0x7ffcf8fd23a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xb8\\x87U\\xc6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\xba\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xc6\\x00\\x00\\x00p\\xb9\\x87U\\xc6\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd24a8",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd40c4",
            "parentcaller": "0x7ffcf8fd25c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd25e2",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002ba"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9b88010",
            "parentcaller": "0x7ffcf9b853d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ba"
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fc30ce",
            "parentcaller": "0x7ffcf9c02cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fc30ce",
            "parentcaller": "0x7ffcf9c02cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9b87b74",
            "parentcaller": "0x7ffcf9b853d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000025e"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              },
              {
                "name": "Handle",
                "value": "0x000002ba"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd45a7",
            "parentcaller": "0x7ffcf8fd0705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2314",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb3e6c8b",
            "parentcaller": "0x7ffcf8fd23a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xb6\\x87U\\xc6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\xba\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xc6\\x00\\x00\\x00\\xa0\\xb7\\x87U\\xc6\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd24a8",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 378
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd40c4",
            "parentcaller": "0x7ffcf8fd25c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd25e2",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002ba"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9c122e1",
            "parentcaller": "0x7ffcf9b87c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2e92",
            "parentcaller": "0x7ffcf9b881f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ba"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 382
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2e92",
            "parentcaller": "0x7ffcf9b8870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ba"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2e92",
            "parentcaller": "0x7ffcf9b887bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ba"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "VDS ProxyStub"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9b88485",
            "parentcaller": "0x7ffcf9b8829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002ba"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x000002b6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2e92",
            "parentcaller": "0x7ffcf9b8870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b6"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2e92",
            "parentcaller": "0x7ffcf9b8870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b6"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8ff4aa9",
            "parentcaller": "0x7ffcf8fd31c6",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b6"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%SystemRoot%\\System32\\vds_ps.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 1,
            "id": 388
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2e92",
            "parentcaller": "0x7ffcf9b88d32",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b6"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9b8855f",
            "parentcaller": "0x7ffcf9b8829e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b6"
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd45a7",
            "parentcaller": "0x7ffcf8fd0705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2314",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 392
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb3e6c8b",
            "parentcaller": "0x7ffcf8fd23a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xb5\\x87U\\xc6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\xba\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xc6\\x00\\x00\\x000\\xb6\\x87U\\xc6\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd24a8",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 394
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd40c4",
            "parentcaller": "0x7ffcf8fd25c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 395
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd25e2",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002ba"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd45a7",
            "parentcaller": "0x7ffcf8fd0705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2314",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 398
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb3e6c8b",
            "parentcaller": "0x7ffcf8fd23a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xb5\\x87U\\xc6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\xba\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xc6\\x00\\x00\\x000\\xb6\\x87U\\xc6\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd24a8",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd40c4",
            "parentcaller": "0x7ffcf8fd25c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 401
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd25e2",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002ba"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9b8ab08",
            "parentcaller": "0x7ffcf9b8a7d9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002ba"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2e92",
            "parentcaller": "0x7ffcf9b8a825",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ba"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd45a7",
            "parentcaller": "0x7ffcf8fd0705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd2314",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb3e6c8b",
            "parentcaller": "0x7ffcf8fd23a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xb4\\x87U\\xc6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfc\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfc\\x7f\\x00\\x00\\xb8\\xcf\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\xba\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xc6\\x00\\x00\\x00p\\xb5\\x87U\\xc6\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 407
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd24a8",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd40c4",
            "parentcaller": "0x7ffcf8fd25c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ba"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd25e2",
            "parentcaller": "0x7ffcf8fd0732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002ba"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9b8ad16",
            "parentcaller": "0x7ffcf9b883b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000025e"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              },
              {
                "name": "Handle",
                "value": "0x000002b6"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              }
            ],
            "repeated": 0,
            "id": 411
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9b8ad4d",
            "parentcaller": "0x7ffcf9b883b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002b6"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9b8adb1",
            "parentcaller": "0x7ffcf9b883b8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b6"
              }
            ],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9b88010",
            "parentcaller": "0x7ffcf9b853d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ba"
              }
            ],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9b822bf",
            "parentcaller": "0x7ffcf9b825e9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000001fa"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              },
              {
                "name": "Handle",
                "value": "0x000002ba"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}"
              }
            ],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9bff8f8",
            "parentcaller": "0x7ffcf9b8213b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002ba"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9b82160",
            "parentcaller": "0x7ffcf9b79277",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ba"
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fc30ce",
            "parentcaller": "0x7ffcf9c02cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fc30ce",
            "parentcaller": "0x7ffcf9c02cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\vds_ps"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd8e00000"
              }
            ],
            "repeated": 0,
            "id": 420
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\vds_ps.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd8e00000"
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd56b2",
            "parentcaller": "0x7ffcf9ba6b6d",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ffcd8e00000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\vds_ps.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fdac31",
            "parentcaller": "0x7ffcf9ba6acf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "vds_ps.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcd8e00000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcd8e011d0"
              }
            ],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fdac31",
            "parentcaller": "0x7ffcf9ba6ae8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": false,
            "return": "0xffffffffc0000139",
            "pretty_return": "ENTRYPOINT_NOT_FOUND",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "vds_ps.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcd8e00000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fdac31",
            "parentcaller": "0x7ffcf9ba6b08",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "vds_ps.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcd8e00000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcd8e01220"
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb3f3f7a",
            "parentcaller": "0x7ffcf9500ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf9500cd1",
            "parentcaller": "0x7ffcf94ff28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000002b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf901026b",
            "parentcaller": "0x7ffcf9500daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002b4"
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb3e8cde",
            "parentcaller": "0x7ffcfb429c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x94\n\\x07\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb416e46",
            "parentcaller": "0x7ffcfb3e8d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\x07k\\x8a\\x16\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05"
              }
            ],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb416e9b",
            "parentcaller": "0x7ffcfb3e8d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0\\x08k\\x8a\\x16\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb416ec0",
            "parentcaller": "0x7ffcfb3e8d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb416f0e",
            "parentcaller": "0x7ffcfb3e8d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\\x82j\\x8a\\x16\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 433
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb416f37",
            "parentcaller": "0x7ffcfb3e8d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb416f8f",
            "parentcaller": "0x7ffcfb3e8d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "x\\x0ck\\x8a\\x16\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb417048",
            "parentcaller": "0x7ffcfb416fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xcb\\xd8\\xfc\\x7f\\x00\\x00\\xebP\\xa3\\xd8\\xfc\\x7f\\x00\\x000\"\\xadTn\\xcc\\x00\\x00(N\\xc7\\xd8\\xfc\\x7f\\x00\\x000\\xc8\\x87U\\xc6\\x00\\x00\\x00(\\xc8\\x87U\\xc6\\x00\\x00\\x00\\xf8\\xc7\\x87U\\xc6\\x00\\x00\\x00\\x18\\xc8\\x87U"
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb41707b",
            "parentcaller": "0x7ffcfb416fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x0ck\\x8a\\x16\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xa4\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xc6\\x87U\\xc6\\x00\\x00\\x00\\xb4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xc7\\xd8"
              }
            ],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb3e8cde",
            "parentcaller": "0x7ffcfb3e953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x94\n\\x07\\x00\\x00\\x00\\x00\\x00\\x85\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xce\\xbb\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb416e46",
            "parentcaller": "0x7ffcfb3e8d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\x0ek\\x8a\\x16\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb416e9b",
            "parentcaller": "0x7ffcfb3e8d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": " \\x0ck\\x8a\\x16\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb416ec0",
            "parentcaller": "0x7ffcfb3e8d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb416f0e",
            "parentcaller": "0x7ffcfb3e8d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\x83j\\x8a\\x16\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb416f37",
            "parentcaller": "0x7ffcfb3e8d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb416f8f",
            "parentcaller": "0x7ffcfb3e8d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\x0ck\\x8a\\x16\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xd4\\x01\\x00"
              }
            ],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb417048",
            "parentcaller": "0x7ffcfb416fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xcb\\xd8\\xfc\\x7f\\x00\\x00\\xebP\\xa3\\xd8\\xfc\\x7f\\x00\\x00\\x90!\\xadTn\\xcc\\x00\\x00(N\\xc7\\xd8\\xfc\\x7f\\x00\\x00\\x90\\xc4\\x87U\\xc6\\x00\\x00\\x00\\x88\\xc4\\x87U\\xc6\\x00\\x00\\x00X\\xc4\\x87U\\xc6\\x00\\x00\\x00x\\xc4\\x87U"
              }
            ],
            "repeated": 0,
            "id": 445
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb41707b",
            "parentcaller": "0x7ffcfb416fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x0ck\\x8a\\x16\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xa4\\xd8\\xfc\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xc2\\x87U\\xc6\\x00\\x00\\x00\\xb4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00]\\xbb\\xfc\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xc7\\xd8"
              }
            ],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd6785",
            "parentcaller": "0x7ffcf9500e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fd6785",
            "parentcaller": "0x7ffcf9500e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b4"
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fce76a",
            "parentcaller": "0x7ffcf9b90e64",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcf9b50000"
              }
            ],
            "repeated": 0,
            "id": 449
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fdac31",
            "parentcaller": "0x7ffcf9b90e82",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcf9b50000"
              },
              {
                "name": "FunctionName",
                "value": "CoGetMarshalSizeMax"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcf9bbc590"
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fdac31",
            "parentcaller": "0x7ffcf9b90e9f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcf9b50000"
              },
              {
                "name": "FunctionName",
                "value": "CoMarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcf9bcb0b0"
              }
            ],
            "repeated": 0,
            "id": 451
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fdac31",
            "parentcaller": "0x7ffcf9b90ebc",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcf9b50000"
              },
              {
                "name": "FunctionName",
                "value": "CoUnmarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcf9bc8b50"
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcf8fdac31",
            "parentcaller": "0x7ffcf9b90ed9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcf9b50000"
              },
              {
                "name": "FunctionName",
                "value": "CoReleaseMarshalData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcf9b7e790"
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-05-28 22:59:40,269",
            "thread_id": "7304",
            "caller": "0x7ffcfb3be715",
            "parentcaller": "0x7ffcfb3be37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a6be000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "7304",
            "caller": "0x7ff733aa1f15",
            "parentcaller": "0x7ff733aa1c2d",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 455
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "7292",
            "caller": "0x7ff733aa10a9",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-05-28 22:59:40,285",
            "thread_id": "7292",
            "caller": "0x7ff733aa10a9",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              },
              {
                "name": "Milliseconds",
                "value": "5000"
              }
            ],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-05-28 22:59:45,285",
            "thread_id": "7292",
            "caller": "0x7ff733aa10ea",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              }
            ],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-05-28 22:59:45,285",
            "thread_id": "7292",
            "caller": "0x7ff733aa1106",
            "parentcaller": "0x00000000",
            "category": "windows",
            "api": "PostThreadMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessId",
                "value": "6204"
              },
              {
                "name": "ThreadId",
                "value": "6200"
              },
              {
                "name": "Message",
                "value": "18"
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-05-28 22:59:45,285",
            "thread_id": "7292",
            "caller": "0x7ffcfb40467e",
            "parentcaller": "0x7ffcfabd734d",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "12"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "7292"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-05-28 22:59:45,285",
            "thread_id": "7292",
            "caller": "0x7ffcfa0415b8",
            "parentcaller": "0x7ffcfb3c9a1d",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-05-28 22:59:45,285",
            "thread_id": "7292",
            "caller": "0x7ffcfb40469e",
            "parentcaller": "0x7ffcfabd734d",
            "category": "threading",
            "api": "NtTerminateThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitStatus",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "0"
              },
              {
                "name": "ProcessId",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa1815",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              }
            ],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa1815",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000024c"
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa1815",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa1815",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000028c"
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa1815",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              }
            ],
            "repeated": 0,
            "id": 467
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa1815",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtDelayExecution",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa1815",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000254"
              }
            ],
            "repeated": 0,
            "id": 469
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa1815",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a640000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa1815",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001f4"
              }
            ],
            "repeated": 0,
            "id": 471
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa1815",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000025e"
              }
            ],
            "repeated": 0,
            "id": 472
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa1815",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\vds_ps"
              },
              {
                "name": "DllBase",
                "value": "0x7ffcd8e00000"
              }
            ],
            "repeated": 0,
            "id": 473
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa1815",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcd8e00000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa1815",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "oleaut32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfad50000"
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa1815",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf9e81000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa1815",
            "parentcaller": "0x7ff733aa3bb9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcf9e81000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "mscoree.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x100001c7c"
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtTerminateProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitCode",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 479
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000260"
              }
            ],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2168a650000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 481
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000268"
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 0,
            "id": 483
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000240"
              }
            ],
            "repeated": 0,
            "id": 484
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000023c"
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000210"
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000228"
              }
            ],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000234"
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000230"
              }
            ],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000220"
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000224"
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000021c"
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              }
            ],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcfb413410"
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000214"
              }
            ],
            "repeated": 0,
            "id": 497
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001bc"
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001c0"
              }
            ],
            "repeated": 0,
            "id": 499
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001b8"
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001ac"
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000190"
              }
            ],
            "repeated": 0,
            "id": 502
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000194"
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000018c"
              }
            ],
            "repeated": 0,
            "id": 504
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000174"
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000178"
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000017c"
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000180"
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000184"
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000188"
              }
            ],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa191000"
              },
              {
                "name": "ModuleName",
                "value": "ole32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ffcfa191000"
              },
              {
                "name": "ModuleName",
                "value": "ole32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000016c"
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000170"
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000168"
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcfb413410"
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000014c"
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000150"
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000154"
              }
            ],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000158"
              }
            ],
            "repeated": 0,
            "id": 521
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000015c"
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000164"
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000160"
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000012c"
              }
            ],
            "repeated": 0,
            "id": 525
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000130"
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000128"
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000280"
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000124"
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000011c"
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000120"
              }
            ],
            "repeated": 0,
            "id": 531
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000118"
              }
            ],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000114"
              }
            ],
            "repeated": 0,
            "id": 533
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000104"
              }
            ],
            "repeated": 0,
            "id": 535
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000ec"
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000f0"
              }
            ],
            "repeated": 0,
            "id": 537
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000f4"
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000f8"
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000fc"
              }
            ],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000100"
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000010c"
              }
            ],
            "repeated": 0,
            "id": 542
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000108"
              }
            ],
            "repeated": 0,
            "id": 543
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000e8"
              }
            ],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000e0"
              }
            ],
            "repeated": 0,
            "id": 545
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000e4"
              }
            ],
            "repeated": 0,
            "id": 546
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000090"
              }
            ],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000084"
              }
            ],
            "repeated": 0,
            "id": 548
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000ac"
              }
            ],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000b0"
              }
            ],
            "repeated": 0,
            "id": 550
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000b4"
              }
            ],
            "repeated": 0,
            "id": 551
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize"
              }
            ],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000b4"
              },
              {
                "name": "ValueName",
                "value": "DisableMetaFiles"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
              }
            ],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000b4"
              }
            ],
            "repeated": 0,
            "id": 554
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize"
              }
            ],
            "repeated": 0,
            "id": 555
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000b4"
              },
              {
                "name": "ValueName",
                "value": "DisableUmpdBufferSizeCheck"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck"
              }
            ],
            "repeated": 0,
            "id": 556
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000b4"
              }
            ],
            "repeated": 0,
            "id": 557
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcfb413410"
              }
            ],
            "repeated": 0,
            "id": 558
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000a0"
              }
            ],
            "repeated": 0,
            "id": 559
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000009c"
              }
            ],
            "repeated": 0,
            "id": 560
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000098"
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcfb413410"
              }
            ],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001cc"
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000094"
              }
            ],
            "repeated": 0,
            "id": 564
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ffcfb3b0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ffcfb413410"
              }
            ],
            "repeated": 0,
            "id": 566
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000064"
              }
            ],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000044"
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000005c"
              }
            ],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 570
          },
          {
            "timestamp": "2026-05-28 22:59:46,300",
            "thread_id": "6200",
            "caller": "0x7ff733aa3bd0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtTerminateProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ExitCode",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 571
          }
        ],
        "threads": [
          "6200",
          "7220",
          "7212",
          "7216",
          "7208",
          "7292",
          "7304"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "DESKTOP-HGH2VBT",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "C:\\Windows\\System32\\vdsldr.exe -Embedding",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff733aa0000",
          "MainExeSize": "0x0000b000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      }
    ],
    "anomaly": [],
    "processtree": [
      {
        "name": "explorer.exe",
        "pid": 3932,
        "parent_id": 3868,
        "module_path": "C:\\Windows\\explorer.exe",
        "children": [
          {
            "name": "MediaCreationTool_22H2.exe",
            "pid": 5448,
            "parent_id": 3932,
            "module_path": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe",
            "children": [
              {
                "name": "SetupHost.Exe",
                "pid": 5932,
                "parent_id": 5448,
                "module_path": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe",
                "children": [],
                "threads": [
                  "4312",
                  "4136",
                  "4152",
                  "3884",
                  "5096",
                  "4316",
                  "6320",
                  "6324",
                  "6328",
                  "7420",
                  "7456",
                  "7460",
                  "7468",
                  "7472",
                  "7496",
                  "7500",
                  "7504",
                  "4144",
                  "5060",
                  "3744"
                ],
                "environ": {
                  "UserName": "admin",
                  "ComputerName": "DESKTOP-HGH2VBT",
                  "WindowsPath": "C:\\Windows",
                  "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
                  "CommandLine": "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web  ",
                  "RegisteredOwner": "",
                  "RegisteredOrganization": "",
                  "ProductName": "",
                  "SystemVolumeSerialNumber": "12bc-0026",
                  "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
                  "MachineGUID": "",
                  "MainExeBase": "0x00f20000",
                  "MainExeSize": "0x000ae000",
                  "Bitness": "32-bit"
                }
              }
            ],
            "threads": [
              "5444",
              "440",
              "448",
              "5556",
              "4584",
              "1336",
              "8540",
              "8544",
              "5220",
              "5440"
            ],
            "environ": {
              "UserName": "admin",
              "ComputerName": "DESKTOP-HGH2VBT",
              "WindowsPath": "C:\\Windows",
              "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
              "CommandLine": "\"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\" ",
              "RegisteredOwner": "",
              "RegisteredOrganization": "",
              "ProductName": "",
              "SystemVolumeSerialNumber": "12bc-0026",
              "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
              "MachineGUID": "",
              "MainExeBase": "0x00c20000",
              "MainExeSize": "0x00b0a000",
              "Bitness": "32-bit"
            }
          }
        ],
        "threads": [
          "5848",
          "4084",
          "3872",
          "3920",
          "3940",
          "3656",
          "4936",
          "4252",
          "3476",
          "4060",
          "3548",
          "3288",
          "4924",
          "3676",
          "3612",
          "3564",
          "4932",
          "4256"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "DESKTOP-HGH2VBT",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "C:\\Windows\\Explorer.EXE",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff633380000",
          "MainExeSize": "0x00546000",
          "Bitness": "64-bit"
        }
      },
      {
        "name": "svchost.exe",
        "pid": 760,
        "parent_id": 616,
        "module_path": "C:\\Windows\\System32\\svchost.exe",
        "children": [
          {
            "name": "WmiPrvSE.exe",
            "pid": 6648,
            "parent_id": 760,
            "module_path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
            "children": [],
            "threads": [
              "6652",
              "6768",
              "6836",
              "6840",
              "6184",
              "6868"
            ],
            "environ": {
              "UserName": "DESKTOP-HGH2VBT$",
              "ComputerName": "DESKTOP-HGH2VBT",
              "WindowsPath": "C:\\Windows",
              "TempPath": "C:\\Windows\\TEMP\\",
              "CommandLine": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
              "RegisteredOwner": "",
              "RegisteredOrganization": "",
              "ProductName": "",
              "SystemVolumeSerialNumber": "12bc-0026",
              "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
              "MachineGUID": "",
              "MainExeBase": "0x7ff61b150000",
              "MainExeSize": "0x0007e000",
              "Bitness": "64-bit"
            }
          },
          {
            "name": "vdsldr.exe",
            "pid": 6204,
            "parent_id": 760,
            "module_path": "C:\\Windows\\System32\\vdsldr.exe",
            "children": [],
            "threads": [
              "6200",
              "7220",
              "7212",
              "7216",
              "7208",
              "7292",
              "7304"
            ],
            "environ": {
              "UserName": "admin",
              "ComputerName": "DESKTOP-HGH2VBT",
              "WindowsPath": "C:\\Windows",
              "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
              "CommandLine": "C:\\Windows\\System32\\vdsldr.exe -Embedding",
              "RegisteredOwner": "",
              "RegisteredOrganization": "",
              "ProductName": "",
              "SystemVolumeSerialNumber": "12bc-0026",
              "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
              "MachineGUID": "",
              "MainExeBase": "0x7ff733aa0000",
              "MainExeSize": "0x0000b000",
              "Bitness": "64-bit"
            }
          }
        ],
        "threads": [
          "972",
          "856",
          "3604",
          "852",
          "1160",
          "7544",
          "7548",
          "7552",
          "7556",
          "7564",
          "7600",
          "7636",
          "4368",
          "1636",
          "7588",
          "944",
          "5412",
          "8680",
          "3744",
          "5060",
          "2424"
        ],
        "environ": {
          "UserName": "SYSTEM",
          "ComputerName": "DESKTOP-HGH2VBT",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Windows\\TEMP\\",
          "CommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff6cca40000",
          "MainExeSize": "0x00010000",
          "Bitness": "64-bit"
        }
      },
      {
        "name": "svchost.exe",
        "pid": 4344,
        "parent_id": 616,
        "module_path": "C:\\Windows\\System32\\svchost.exe",
        "children": [],
        "threads": [
          "3680",
          "6560",
          "6568",
          "6592",
          "6852",
          "4376",
          "5380",
          "5328",
          "6424",
          "8780",
          "8784",
          "8788",
          "8796",
          "8804",
          "8800",
          "6472",
          "6456",
          "1788",
          "1928",
          "2052",
          "2116",
          "2232",
          "2268",
          "2276",
          "7620"
        ],
        "environ": {
          "UserName": "SYSTEM",
          "ComputerName": "DESKTOP-HGH2VBT",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Windows\\TEMP\\",
          "CommandLine": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff6cca40000",
          "MainExeSize": "0x00010000",
          "Bitness": "64-bit"
        }
      }
    ],
    "summary": {
      "files": [
        "C:\\Windows\\System32\\d3d10warp.dll",
        "C:\\Windows\\Fonts\\segoeui.ttf",
        "\\Device\\Bam",
        "C:\\Windows\\System32\\Windows.UI.Xaml.Resources.19H1.dll",
        "C:\\",
        "C:\\Users\\",
        "C:\\Users\\admin\\",
        "C:\\Users\\admin\\AppData\\",
        "C:\\Users\\admin\\AppData\\Local\\",
        "C:\\Windows\\apppatch\\sysmain.sdb",
        "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep",
        "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep",
        "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.StartMenuExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep",
        "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep",
        "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep",
        "C:\\$Windows.~WS\\",
        "C:\\Windows\\System32\\wscui.cpl",
        "C:\\Windows\\System32\\en-US\\wscui.cpl.mui",
        "C:\\Windows\\System32\\en-US\\Actioncenter.dll.mui",
        "C:\\Windows\\System32\\Actioncenter.dll.3.Manifest",
        "C:\\Windows\\System32\\en-US\\mfc42u.dll.mui",
        "C:\\Windows\\sysnative\\en-US\\mfc42u.dll.mui",
        "C:\\Windows\\System32\\MFC42LOC.DLL",
        "C:\\Windows\\System32\\MFC42LOC.DLL.DLL",
        "C:\\Windows\\sysnative\\MFC42LOC.DLL",
        "C:\\Windows\\sysnative\\MFC42LOC.DLL.DLL",
        "C:\\Windows\\Logs\\MoSetup",
        "C:\\Users\\admin\\AppData\\Local\\Temp",
        "C:\\Windows",
        "C:\\Windows\\Logs",
        "C:\\Windows\\Logs\\MoSetup\\BlueBox.log",
        "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe",
        "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
        "C:\\Windows\\System32\\tzres.dll",
        "C:\\Windows\\System32\\en-US\\tzres.dll.mui",
        "C:\\Windows\\sysnative\\en-US\\tzres.dll.mui",
        "C:\\Users\\admin\\AppData\\Local\\Temp\\Lang.ini",
        "C:\\$Windows.~WS\\Sources",
        "C:\\Windows\\SystemResources\\USER32.dll.mun",
        "C:\\Windows\\SystemResources\\mfc42u.dll.mun",
        "C:\\Windows\\System32\\kernel.appcore.dll",
        "\\Device\\CNG",
        "C:\\Users\\admin\\AppData\\Local\\Temp\\TextShaping.dll",
        "C:\\Windows\\System32\\TextShaping.dll",
        "C:\\$Windows.~WS",
        "C:\\$Windows.~LS",
        "C:\\Windows\\System32\\textinputframework.dll",
        "C:\\Windows\\System32\\coreuicomponents.dll",
        "C:\\Windows\\System32\\coremessaging.dll",
        "C:\\Windows\\System32\\ntmarta.dll",
        "C:\\Windows\\System32\\WinTypes.dll",
        "C:\\$Windows.~WS\\Sources\\Panther",
        "C:\\$Windows.~WS\\Sources\\Rollback",
        "\\??\\MountPointManager",
        "C:\\$Windows.~WS\\*",
        "C:\\$Windows.~WS\\Sources\\*",
        "C:\\$Windows.~WS\\Sources\\",
        "C:\\$Windows.~WS\\Sources\\DU.dll",
        "C:\\$Windows.~WS\\Sources\\DiagTrack.dll",
        "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe",
        "C:\\$Windows.~WS\\Sources\\Diager.dll",
        "C:\\$Windows.~WS\\Sources\\setupplatform.cfg",
        "C:\\$Windows.~WS\\Sources\\setupplatform.dll",
        "C:\\$Windows.~WS\\Sources\\unbcl.dll",
        "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll",
        "C:\\$Windows.~WS\\Sources\\wdscore.dll",
        "C:\\$Windows.~WS\\Sources\\wdscsl.dll",
        "C:\\$Windows.~WS\\Sources\\wdsimage.dll",
        "C:\\$Windows.~WS\\Sources\\wdstptc.dll",
        "C:\\$Windows.~WS\\Sources\\wdsutil.dll",
        "C:\\$Windows.~WS\\Sources\\wpx.dll",
        "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll",
        "C:\\$Windows.~WS\\Sources\\SetupCore.dll",
        "C:\\$Windows.~WS\\Sources\\SetupHost.exe",
        "C:\\$Windows.~WS\\Sources\\SetupMgr.dll",
        "C:\\$Windows.~WS\\Sources\\WinDlp.dll",
        "C:\\$Windows.~WS\\Sources\\pidgenx.dll",
        "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms",
        "C:\\Users\\admin\\AppData\\Local\\Temp\\products.cab",
        "C:\\Users\\admin\\AppData\\Local\\Temp\\DUDownload",
        "C:\\$Windows.~WS\\DUDownload\\Cab",
        "C:\\$Windows.~WS\\DUDownload\\Setup",
        "\\Device\\NamedPipe\\",
        "C:\\Windows\\System32\\bcryptPrimitives.dll",
        "C:\\$Windows.~WS\\Sources\\inf\\setup.cfg",
        "C:\\Windows\\System32\\Branding\\Basebrd\\Basebrd.dll",
        "C:\\Windows\\Branding\\Basebrd\\basebrd.dll",
        "C:\\Windows\\Branding\\Basebrd\\en-US\\Basebrd.dll.mui",
        "C:\\$Windows.~WS\\Sources\\SetupHost.Exe",
        "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log",
        "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml",
        "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml",
        "C:\\$Windows.~WS\\Sources\\Panther\\setuplog.cfg",
        "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log",
        "C:\\$Windows.~WS\\Sources\\Lang.ini",
        "C:\\Windows\\System32\\msctf.dll",
        "C:\\$WINDOWS.~BT\\Sources\\Panther\\SetupAct.log",
        "C:\\Windows\\setuplog.cfg",
        "C:\\$Windows.~WS\\Sources\\SetupPlatform.dll",
        "C:\\$Windows.~WS\\Sources\\diagtrack.dll",
        "C:\\$Windows.~WS\\Sources\\diagtrackrunner.exe",
        "C:\\$Windows.~WS\\Sources\\reagent.admx",
        "C:\\$Windows.~WS\\Sources\\dismapi.dll",
        "C:\\$Windows.~WS\\Sources\\cmi2migxml.dll",
        "C:\\Windows\\System32\\kernel32.dll",
        "C:\\Windows\\Panther",
        "C:\\$Windows.~WS\\Sources\\Autounattend.xml",
        "C:\\$WINDOWS.~BT\\Sources\\Diagnostics\\diagnostics.dat",
        "C:",
        "C:\\$WINDOWS.~BT",
        "C:\\$WINDOWS.~BT\\",
        "C:\\$WINDOWS.~BT\\Sources",
        "C:\\$WINDOWS.~BT\\Sources\\Panther",
        "C:\\$WINDOWS.~BT\\Sources\\Panther\\setuperr.log",
        "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml",
        "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml",
        "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log",
        "C:\\$Windows.~WS\\Sources\\WINSTA.dll",
        "C:\\Windows\\System32\\winsta.dll",
        "C:\\Windows\\System32\\mswsock.dll",
        "C:\\Windows\\System32\\en-US\\mswsock.dll.mui",
        "C:\\Windows\\sysnative\\en-US\\mswsock.dll.mui",
        "C:\\Windows\\System32\\wshqos.dll",
        "C:\\Windows\\System32\\en-US\\wshqos.dll.mui",
        "C:\\Windows\\sysnative\\en-US\\wshqos.dll.mui",
        "C:\\$Windows.~WS\\Sources\\ncrypt.dll",
        "C:\\Windows\\System32\\ncrypt.dll",
        "C:\\Windows\\System32\\dnsapi.dll",
        "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
        "C:\\Windows\\System32\\en-US\\CRYPT32.dll.mui",
        "C:\\Windows\\sysnative\\en-US\\CRYPT32.dll.mui",
        "C:\\$Windows.~WS\\Sources\\DPAPI.DLL",
        "C:\\Windows\\System32\\dpapi.dll",
        "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml",
        "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml",
        "C:\\$Windows.~WS\\Sources\\Sources\\ws.dat",
        "C:\\$Windows.~WS\\Sources\\Panther\\LegacyInterrupt.dat",
        "\\Device\\RasAcd",
        "C:\\$Windows.~WS\\Sources\\products.cab",
        "C:\\Windows\\System32\\devrtl.dll",
        "C:\\Windows\\INF\\",
        "C:\\$Windows.~WS\\Sources\\products.xml",
        "C:\\Windows\\System32\\en-US\\USER32.dll.mui",
        "C:\\Windows\\Fonts\\staticcache.dat",
        "C:\\Windows\\System32\\CoreUIComponents.dll",
        "C:\\Windows\\System32\\CoreMessaging.dll",
        "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf",
        "C:\\Windows\\win.ini",
        "C:\\Windows\\System32\\UxTheme.dll.Config",
        "C:\\Windows\\System32\\uxtheme.dll",
        "C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_a863d714867441db",
        "C:\\Windows\\System32\\twinapi.appcore.dll",
        "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
        "C:\\Windows\\System32\\vdsldr.exe",
        "\\??\\PhysicalDrive0",
        "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep",
        "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep",
        "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep",
        "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\S-1-5-18.pckgdep",
        "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep",
        "\\Device\\DeviceApi\\Dev\\Query",
        "C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3745_none_7ded3f327ca60a41\\TiWorker.exe",
        "C:\\Windows\\WinSxS\\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3745_none_21cea3aec448990b\\TiWorker.exe",
        "C:\\Windows\\System32\\FodHelper.exe",
        "C:\\Windows\\System32\\vssapi.dll",
        "C:\\Windows\\System32\\vsstrace.dll",
        "C:\\Windows\\System32\\en-US\\VssTrace.DLL.mui",
        "C:\\Windows\\System32\\samcli.dll",
        "C:\\Windows\\System32\\netutils.dll",
        "C:\\Windows\\System32\\samlib.dll",
        "C:\\Windows\\System32\\propsys.dll",
        "C:\\Windows\\System32\\wbem\\repository",
        "C:\\Windows\\System32\\wbem\\repository\\WRITABLE.TST",
        "C:\\Windows\\System32\\wbem\\repository\\MAPPING1.MAP",
        "C:\\Windows\\System32\\wbem\\repository\\MAPPING2.MAP",
        "C:\\Windows\\System32\\wbem\\repository\\MAPPING3.MAP",
        "C:\\Windows\\System32\\wbem\\repository\\OBJECTS.DATA",
        "C:\\Windows\\System32\\wbem\\repository\\INDEX.BTR",
        "C:\\Windows\\System32\\userenv.dll",
        "C:\\Windows\\System32\\profapi.dll",
        "C:\\Program Files\\Windows Defender\\MpOAV.dll",
        "C:\\Windows\\System32\\cryptsp.dll",
        "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
        "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
        "C:\\Windows\\System32\\rpcss.dll",
        "C:\\Windows\\System32\\wtsapi32.dll",
        "C:\\Windows\\System32\\wmiclnt.dll",
        "\\??\\WMIDataDevice",
        "C:\\Windows\\System32\\srvcli.dll",
        "C:\\Windows\\System32\\logoncli.dll",
        "C:\\Windows\\System32\\schedcli.dll",
        "C:\\Windows\\System32\\wkscli.dll",
        "C:\\Windows\\System32\\dsrole.dll",
        "\\??\\PIPE\\lsarpc",
        "\\??\\PIPE\\srvsvc",
        "C:\\Windows\\System32\\OemInfo.Ini",
        "C:\\Windows\\System32\\OemLogo.Bmp",
        "C:\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui"
      ],
      "read_files": [],
      "write_files": [
        "C:\\Windows\\Logs\\MoSetup\\BlueBox.log",
        "C:\\$Windows.~WS\\Sources\\DU.dll",
        "C:\\$Windows.~WS\\Sources\\DiagTrack.dll",
        "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe",
        "C:\\$Windows.~WS\\Sources\\Diager.dll",
        "C:\\$Windows.~WS\\Sources\\setupplatform.cfg",
        "C:\\$Windows.~WS\\Sources\\setupplatform.dll",
        "C:\\$Windows.~WS\\Sources\\unbcl.dll",
        "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll",
        "C:\\$Windows.~WS\\Sources\\wdscore.dll",
        "C:\\$Windows.~WS\\Sources\\wdscsl.dll",
        "C:\\$Windows.~WS\\Sources\\wdsimage.dll",
        "C:\\$Windows.~WS\\Sources\\wdstptc.dll",
        "C:\\$Windows.~WS\\Sources\\wdsutil.dll",
        "C:\\$Windows.~WS\\Sources\\wpx.dll",
        "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll",
        "C:\\$Windows.~WS\\Sources\\SetupCore.dll",
        "C:\\$Windows.~WS\\Sources\\SetupHost.exe",
        "C:\\$Windows.~WS\\Sources\\SetupMgr.dll",
        "C:\\$Windows.~WS\\Sources\\WinDlp.dll",
        "C:\\$Windows.~WS\\Sources\\pidgenx.dll",
        "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms",
        "C:\\$Windows.~WS\\Sources\\Panther",
        "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log",
        "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml",
        "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml",
        "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log",
        "C:\\$WINDOWS.~BT\\Sources\\Panther\\setuperr.log",
        "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml",
        "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml",
        "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log",
        "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml",
        "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml",
        "\\Device\\RasAcd",
        "C:\\$Windows.~WS\\Sources\\products.cab",
        "C:\\$Windows.~WS\\Sources\\products.xml",
        "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf",
        "C:\\Windows\\System32\\wbem\\repository\\WRITABLE.TST",
        "C:\\Windows\\System32\\wbem\\repository\\MAPPING1.MAP",
        "C:\\Windows\\System32\\wbem\\repository\\MAPPING2.MAP",
        "C:\\Windows\\System32\\wbem\\repository\\MAPPING3.MAP",
        "C:\\Windows\\System32\\wbem\\repository\\OBJECTS.DATA",
        "C:\\Windows\\System32\\wbem\\repository\\INDEX.BTR",
        "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
        "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
        "\\??\\WMIDataDevice",
        "\\??\\PIPE\\lsarpc",
        "\\??\\PIPE\\srvsvc"
      ],
      "delete_files": [
        "C:\\$Windows.~WS\\Sources",
        "C:\\$Windows.~WS"
      ],
      "keys": [
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\SafeDllSearchMode",
        "HKEY_CURRENT_USER",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Compression",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNt",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Tahoma",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\MediaCreationTool_22H2.exe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\CTF\\EnableAnchorContext",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI Light",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\ActionableCompat",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupHostResult",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CmdLine",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel",
        "HKEY_CURRENT_USER\\Software\\Classes",
        "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\SetupHost.Exe",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\AppID\\SetupHost.Exe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\TestId",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CorrelationVector",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\OSUpgrade",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Sysprep",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform\\UseHVSocket",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\Panther",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupPlatform",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Elevation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Elevation",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\AMSI\\Providers",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\System\\DNSClient",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\SQMClient\\MachineId",
        "HKEY_LOCAL_MACHINE\\System\\Setup",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\CollectTrace",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\MiniNT",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\TestMode",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\Ring",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\OneSettingsVersion",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\OneSettingsBranch",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TenantRestrictions\\Payload",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\WinSock2\\Parameters",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\WinSock_Registry_Version",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\AutodialDLL",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DnsClient",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\DNS",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryAdapterName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableAdapterDomainName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseDomainNameDevolution",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UseDomainNameDevolution",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DomainNameDevolutionLevel",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\PrioritizeRecordData",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AllowUnqualifiedQuery",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\AllowUnqualifiedQuery",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AppendToMultiLabelName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenBadTlds",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenUnreachableServers",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenDefaultServers",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DynamicServerQueryOrder",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterClusterIp",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\WaitForNameErrorOnAll",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseEdns",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsSecureNameQueryFallback",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableDAForAllNetworks",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessQueryOrder",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryIpMatching",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseHostsFile",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AddrConfigControl",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartNameResolution",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PreferLocalOverLowerBindingDNS",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryNetBTFQDN",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartProtocolReordering",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UdpRecvBufferSize",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableParallelAandAAAA",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableCoalescing",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterVPNTrigger",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMultiHomedRouteConflicts",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ForceQueriesOverTcp",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShareTcpConnections",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationEnabled",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableDynamicUpdate",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterPrimaryName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterAdapterName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\EnableAdapterDomainNameRegistration",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterReverseLookup",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableReverseAddressRegistrations",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterWanAdapters",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableWanDynamicUpdate",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationTtl",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationTTL",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationRefreshInterval",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationRefreshInterval",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationMaxAddressCount",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\MaxNumberOfAddressesToRegister",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateSecurityLevel",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UpdateSecurityLevel",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateTopLevelDomainZones",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DowncaseSpnCauseApiOwnerIsTooLazy",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationOverwrite",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheSize",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheTtl",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxNegativeCacheTtl",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AdapterTimeoutLimit",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ServerPriorityTimeLimit",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCachedSockets",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableServerUnreachability",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMulticast",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastResponderFlags",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderFlags",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderMaxTimeout",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMDNS",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsTest",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseCompartments",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\CacheAllCompartments",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseNewRegistration",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistration",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistrationOnly",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\NewDhcpSrvRegistration",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessPreferLocal",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableIdnEncoding",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableIdnMapping",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShortnameProxyDefault",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableNRPTForAdapterRegistration",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutHistoryLength",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutRecalculationInterval",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQueryTimeouts",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQueryTimeouts",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQuickQueryTimeouts",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQuickQueryTimeouts",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders\\Schannel",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextLockCount",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextListCount",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration",
        "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E",
        "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\\Name",
        "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Cryptography\\ECCParameters",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\crypt32",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagLevel",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagMatchAnyMask",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableSerialChain",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetPreFetchTriggerPeriodSeconds",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxUrlRetrievalByteCount",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\DisallowedCertSyncDeltaTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv\\#16",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllOpenStoreProv\\Ldap",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CertDllOpenStoreProv",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\Root\\PhysicalStores",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\Root",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\ProtectedRoots",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\Root\\PhysicalStores",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\Root",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\SmartCardRoot",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\CA\\PhysicalStores",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\CA",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\CA\\PhysicalStores",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\EnterpriseCertificates\\CA",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableAutoFlushProcessNameList",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushFirstDeltaSeconds",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushNextDeltaSeconds",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\CA",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllVerifyCertificateChainPolicy",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 1\\CertDllVerifyCertificateChainPolicy",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRulesLogDir",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRules",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesLastSyncTime",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\ETag",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\RefreshInterval",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\Settings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\os",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\osver",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\scenarioId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\platformEdition",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\platformInstallationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\sku",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\deviceId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\appver",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\appBuildLab",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\RefreshAfter",
        "HKEY_CURRENT_USER\\Control Panel\\International\\Geo",
        "HKEY_CURRENT_USER\\Control Panel\\International\\Geo\\Nation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildBranch",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\Compact",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\EnablePreviewBuilds",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\ProductOptions",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ProductOptions\\ProductType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\StudyID",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Cleanup",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Tracking",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Priority",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\\Blob",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E\\Blob",
        "HKEY_LOCAL_MACHINE",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SetupOverride",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMaxFileSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}\\CLSID",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Author",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FriendlyName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SpecVersion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Vendor",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InProcServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InProcServer32",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ContainerFormat",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\DeviceManufacturer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\DeviceModels",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ColorManagementVersion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\MimeTypes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FileExtensions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportAnimation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportChromakey",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportLossless",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportMultiframe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ArbitrationPriority",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Formats",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Formats",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Mask",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\CLSID",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Author",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FriendlyName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SpecVersion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Vendor",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InProcServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InProcServer32",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ContainerFormat",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\DeviceManufacturer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\DeviceModels",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ColorManagementVersion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\MimeTypes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FileExtensions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportAnimation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportChromakey",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportLossless",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportMultiframe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ArbitrationPriority",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Formats",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Formats",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Pattern",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Mask",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{699745C2-5066-4B82-A8E3-D40478DBEC8C}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{43324B33-A78F-480F-9111-9638AACCC832}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{DDE33513-774E-4BCD-AE79-02F4ADFE62FC}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{AA7E3C50-864C-4604-BC04-8B0B76E637F6}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{8F914656-9D0A-4EB2-9019-0BF96D8A9EE6}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{50D42F09-ECD1-4B41-B65D-DA1FDAA75663}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{D9403860-297F-4A49-BF9B-77898150A442}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{3697790B-223B-484E-9925-C4869218F17A}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{B5C8B898-0074-459F-B700-860D4651EA14}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{FB012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{03012959-F4F6-44D7-9D09-DAA087A9DB57}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{D4DCD3D7-B4C2-47D9-A6BF-B89BA396A4A3}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{0010668C-0801-4DA6-A4A4-826522B6D28F}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5805137A-E348-4F7C-B3CC-6DB9965A0599}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{02805F1E-D5AA-415B-82C5-61C033A988A6}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{4B59AFCC-B8C3-408A-B670-89E5FAB6FDA7}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{72B624DF-AE11-4948-A65C-351EB0829419}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{01B90D9A-8209-47F7-9C52-E1244BF50CED}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{E7E79A30-4F2C-4FAB-8D00-394F2D6BBEBE}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7F12E753-FC71-43D7-A51D-92F35977ABB5}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{AA94DCC2-B8B0-4898-B835-000AABD74393}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41070793-59E4-479A-A1F7-954ADC2EF5FC}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{B92E345D-F52D-41F3-B562-081BC772E3B9}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7447A267-0015-42C8-A8F1-FB3B94C68361}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1767B93A-B021-44EA-920F-863C11F4F768}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{9F66347C-60C4-4C4D-AB58-D2358685F607}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{50B1904B-F28F-4574-93F4-0BADE82C69E9}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{356F2F88-05A6-4728-B9A4-1BFBCE04D838}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{32557D3B-69DC-4F95-836E-F5972B2F6159}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{3692CA39-E082-4350-9E1F-3704CB083CD5}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{0CE7A4A6-03E8-4A60-9D15-282EF32EE7DA}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AABFB2FA-3E1E-4A8F-8977-5556FB94EA23}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{AABFB2FA-3E1E-4A8F-8977-5556FB94EA23}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{AABFB2FA-3E1E-4A8f-8977-5556FB94EA23}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{AABFB2FA-3E1E-4A8f-8977-5556FB94EA23}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{F90B5F36-367B-402A-9DD1-BC0FD59D8F62}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{877A0BB7-A313-4491-87B5-2E6D0594F520}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{F5D3E63B-CB0F-4628-A478-6D8244BE36B1}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{FB40360C-547E-4956-A3B9-D4418859BA66}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{D94EDF02-EFE5-4F0D-85C8-F5A68B3000B1}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{276C88CA-7533-4A86-B676-66B36080D484}\\Containers",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{ACDDFC3F-85EC-41BC-BDEF-1BC262E4DB05}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{ACDDFC3F-85EC-41BC-BDEF-1BC262E4DB05}",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{2438DE3D-94D9-4BE8-84A8-4DE95A575E75}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{2438DE3D-94D9-4BE8-84A8-4DE95A575E75}",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{076F9911-A348-465C-A807-A252F3F2D3DE}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{076F9911-A348-465C-A807-A252F3F2D3DE}",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{85A10B03-C9F6-439F-BE5E-C0FBEF67807C}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{85A10B03-C9F6-439F-BE5E-C0FBEF67807C}",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{05AF94D8-7174-4CD2-BE4A-4124B80EE4B8}\\Instance",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{05AF94D8-7174-4CD2-BE4A-4124B80EE4B8}\\Instance",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\SetupHost.Exe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Setup",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupProgress",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupPhase",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupSubPhase",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInset",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragDelay",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragMinDist",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollDelay",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInterval",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\AssemblyStorageRoots",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000160-0000-0000-C000-000000000046}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{00000160-0000-0000-C000-000000000046}",
        "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\Extensions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\Extensions\\DragDropExtension",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold,0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent,0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Baltic,186",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CE,238",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CYR,204",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Greek,161",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial TUR,162",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Baltic,186",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CE,238",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CYR,204",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Greek,161",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New TUR,162",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helv",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helvetica",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tahoma Armenian",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Baltic,186",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CE,238",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CYR,204",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Greek,161",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman TUR,162",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tms Rmn",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\vds\\DebugLog",
        "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\vdsldr.exe",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocServer32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\InprocHandler",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\ThreadingModel",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\AppID",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\Elevation",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck"
      ],
      "read_keys": [
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\SafeDllSearchMode",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\CTF\\EnableAnchorContext",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\ActionableCompat",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupHostResult",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CmdLine",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\TestId",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CorrelationVector",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform\\UseHVSocket",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\SQMClient\\MachineId",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\CollectTrace",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\TestMode",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\Ring",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\OneSettingsVersion",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\OneSettingsBranch",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\WinSock_Registry_Version",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\AutodialDLL",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryAdapterName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableAdapterDomainName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseDomainNameDevolution",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UseDomainNameDevolution",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DomainNameDevolutionLevel",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\PrioritizeRecordData",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AllowUnqualifiedQuery",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\AllowUnqualifiedQuery",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AppendToMultiLabelName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenBadTlds",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenUnreachableServers",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenDefaultServers",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DynamicServerQueryOrder",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterClusterIp",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\WaitForNameErrorOnAll",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseEdns",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsSecureNameQueryFallback",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableDAForAllNetworks",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessQueryOrder",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryIpMatching",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseHostsFile",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AddrConfigControl",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartNameResolution",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PreferLocalOverLowerBindingDNS",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryNetBTFQDN",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartProtocolReordering",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UdpRecvBufferSize",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableParallelAandAAAA",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableCoalescing",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterVPNTrigger",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMultiHomedRouteConflicts",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ForceQueriesOverTcp",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShareTcpConnections",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationEnabled",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableDynamicUpdate",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterPrimaryName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterAdapterName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\EnableAdapterDomainNameRegistration",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterReverseLookup",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableReverseAddressRegistrations",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterWanAdapters",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableWanDynamicUpdate",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationTtl",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationTTL",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationRefreshInterval",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationRefreshInterval",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationMaxAddressCount",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\MaxNumberOfAddressesToRegister",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateSecurityLevel",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UpdateSecurityLevel",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateTopLevelDomainZones",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DowncaseSpnCauseApiOwnerIsTooLazy",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationOverwrite",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheSize",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheTtl",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxNegativeCacheTtl",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AdapterTimeoutLimit",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ServerPriorityTimeLimit",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCachedSockets",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableServerUnreachability",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMulticast",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastResponderFlags",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderFlags",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderMaxTimeout",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMDNS",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsTest",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseCompartments",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\CacheAllCompartments",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseNewRegistration",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistration",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistrationOnly",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\NewDhcpSrvRegistration",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessPreferLocal",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableIdnEncoding",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableIdnMapping",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShortnameProxyDefault",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableNRPTForAdapterRegistration",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutHistoryLength",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutRecalculationInterval",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQueryTimeouts",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQueryTimeouts",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQuickQueryTimeouts",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQuickQueryTimeouts",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextLockCount",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextListCount",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration",
        "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\\Name",
        "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagLevel",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagMatchAnyMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableSerialChain",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetPreFetchTriggerPeriodSeconds",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxUrlRetrievalByteCount",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\DisallowedCertSyncDeltaTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableAutoFlushProcessNameList",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushFirstDeltaSeconds",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushNextDeltaSeconds",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRulesLogDir",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRules",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesLastSyncTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl",
        "HKEY_CURRENT_USER\\Control Panel\\International\\Geo\\Nation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildBranch",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\Compact",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\EnablePreviewBuilds",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ProductOptions\\ProductType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\StudyID",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Cleanup",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Priority",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\\Blob",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E\\Blob",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SetupOverride",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMaxFileSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Author",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FriendlyName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SpecVersion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Vendor",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ContainerFormat",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\DeviceManufacturer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\DeviceModels",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ColorManagementVersion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\MimeTypes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FileExtensions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportAnimation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportChromakey",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportLossless",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportMultiframe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ArbitrationPriority",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Author",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FriendlyName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SpecVersion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Vendor",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ContainerFormat",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\DeviceManufacturer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\DeviceModels",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ColorManagementVersion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\MimeTypes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FileExtensions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportAnimation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportChromakey",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportLossless",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportMultiframe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ArbitrationPriority",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Pattern",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Position",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\EndOfStream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Mask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInset",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragDelay",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragMinDist",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollDelay",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInterval",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\Extensions\\DragDropExtension",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold,0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent,0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Baltic,186",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CE,238",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CYR,204",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Greek,161",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial TUR,162",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Baltic,186",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CE,238",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CYR,204",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Greek,161",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New TUR,162",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helv",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helvetica",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tahoma Armenian",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Baltic,186",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CE,238",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CYR,204",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Greek,161",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman TUR,162",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tms Rmn",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck"
      ],
      "write_keys": [
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CorrelationVector",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\ETag",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\RefreshInterval",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\Settings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\os",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\osver",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\scenarioId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\platformEdition",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\platformInstallationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\sku",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\deviceId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\appver",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\appBuildLab",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\RefreshAfter",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupProgress",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupPhase",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupSubPhase"
      ],
      "delete_keys": [],
      "executed_commands": [
        "\"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web",
        "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
        "C:\\Windows\\System32\\vdsldr.exe -Embedding",
        "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca",
        "\"C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\SkypeApp.exe\" -ServerName:App.AppXffn3yxqvgawq9fpmnhy90fr3y01d1t5b.mca",
        "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca",
        "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca",
        "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXsqpbawq1jx69hhfyy1dr9y35whgstkrr.mca",
        "C:\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3745_none_7ded3f327ca60a41\\TiWorker.exe -Embedding",
        "C:\\Windows\\System32\\FodHelper.exe -Embedding"
      ],
      "resolved_apis": [
        "ntdll.dll.RtlWow64GetCurrentMachine",
        "ntdll.dll.RtlWow64IsWowGuestMachineSupported"
      ],
      "mutexes": [
        "Local\\SM0:5448:168:WilStaging_02",
        "Global\\Microsoft.Windows.Websetup",
        "Local\\MSCTF.Asm.MutexDefault1",
        "CicLoadWinStaWinSta0",
        "Local\\MSCTF.CtfMonitorInstMutexDefault1",
        "Local\\SM0:5932:168:WilStaging_02",
        "Global\\WdsSetupLogInit",
        "Global\\SetupLog",
        "Global\\OneSettingQueryMutex+WSD+Setup360",
        "Local\\SM0:5932:64:WilError_03"
      ],
      "created_services": [],
      "started_services": [
        "TrustedInstaller"
      ]
    },
    "enhanced": [
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,020",
        "eid": 1,
        "data": {
          "file": "C:\\Windows\\System32\\Windows.UI.Xaml.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffce7310000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,020",
        "eid": 2,
        "data": {
          "file": "C:\\Windows\\System32\\WindowsInternal.ComposableShell.DesktopHosting.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcef2d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,036",
        "eid": 3,
        "data": {
          "file": "C:\\Windows\\ShellComponents\\WindowsInternal.ComposableShell.Experiences.Switcher.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd8740000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,036",
        "eid": 4,
        "data": {
          "file": "C:\\Windows\\ShellExperiences\\TileControl.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcef250000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,036",
        "eid": 5,
        "data": {
          "file": "C:\\Windows\\ShellComponents\\TaskFlowUI.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd8520000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,036",
        "eid": 6,
        "data": {
          "file": "user32",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfb0b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,051",
        "eid": 7,
        "data": {
          "file": "dxgi.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf7350000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,051",
        "eid": 8,
        "data": {
          "file": "gdi32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa010000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,051",
        "eid": 9,
        "data": {
          "file": "C:\\Windows\\System32\\iertutil.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcee940000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,051",
        "eid": 10,
        "data": {
          "file": "C:\\Windows\\System32\\CoreMessaging.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf5e40000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,051",
        "eid": 11,
        "data": {
          "file": "windows.ui.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffce83d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,051",
        "eid": 12,
        "data": {
          "file": "d3d10warp.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf2090000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,051",
        "eid": 13,
        "data": {
          "file": "C:\\Windows\\System32\\UiaManager.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffce9640000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,051",
        "eid": 14,
        "data": {
          "file": "d2d1.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf5020000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,051",
        "eid": 15,
        "data": {
          "file": "windows.ui.core.textinput.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffce2bc0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,051",
        "eid": 16,
        "data": {
          "file": "dwrite.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffce6d70000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,051",
        "eid": 17,
        "data": {
          "file": "C:\\Windows\\System32\\SHCore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf9ec0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,067",
        "eid": 18,
        "data": {
          "file": "gdi32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa010000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:25,067",
        "eid": 19,
        "data": {
          "file": "dwrite.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffce6d70000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,879",
        "eid": 20,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,879",
        "eid": 21,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,911",
        "eid": 22,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,911",
        "eid": 23,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 24,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 25,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:33,207",
        "eid": 26,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:33,223",
        "eid": 27,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:33,239",
        "eid": 28,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:33,254",
        "eid": 29,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:33,270",
        "eid": 30,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:33,286",
        "eid": 31,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:33,301",
        "eid": 32,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:33,317",
        "eid": 33,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 34,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 35,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:33,926",
        "eid": 36,
        "data": {
          "file": "C:\\Windows\\System32\\execmodelclient.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffceb2e0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:33,942",
        "eid": 37,
        "data": {
          "file": "ploptin.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcef230000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:33,957",
        "eid": 38,
        "data": {
          "file": "ploptin.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcef230000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,270",
        "eid": 39,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,286",
        "eid": 40,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,286",
        "eid": 41,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,551",
        "eid": 42,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,567",
        "eid": 43,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,582",
        "eid": 44,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,598",
        "eid": 45,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,614",
        "eid": 46,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,629",
        "eid": 47,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,645",
        "eid": 48,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,661",
        "eid": 49,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,676",
        "eid": 50,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,692",
        "eid": 51,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,707",
        "eid": 52,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,723",
        "eid": 53,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfa1b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 23:00:55,801",
        "eid": 54,
        "data": {
          "file": "C:\\Windows\\System32\\wscinterop.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcef1c0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 23:00:55,989",
        "eid": 55,
        "data": {
          "file": "C:\\Windows\\System32\\werconcpl.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd8180000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 23:00:56,051",
        "eid": 56,
        "data": {
          "file": "C:\\Windows\\System32\\hcproviders.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffce8ec0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 23:00:56,129",
        "eid": 57,
        "data": {
          "file": "Comctl32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffce4aa0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 23:00:56,129",
        "eid": 58,
        "data": {
          "file": "wscapi.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcdc000000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,661",
        "eid": 59,
        "data": {
          "file": "MSVCRT.DLL",
          "pathtofile": null,
          "moduleaddress": "0x76d70000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,661",
        "eid": 60,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\SafeDllSearchMode",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,661",
        "eid": 61,
        "data": {
          "file": "KERNELBASE.DLL",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,661",
        "eid": 62,
        "data": {
          "file": "api-ms-win-core-guard-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,661",
        "eid": 63,
        "data": {
          "file": "LPK.DLL",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,661",
        "eid": 64,
        "data": {
          "file": "KERNEL32",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,661",
        "eid": 65,
        "data": {
          "file": "imm32.dll",
          "pathtofile": null,
          "moduleaddress": "0x76e30000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,723",
        "eid": 66,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,723",
        "eid": 67,
        "data": {
          "file": "advapi32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:59:32,723",
        "eid": 68,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,739",
        "eid": 69,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx",
          "content": "kernel32.dll"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,739",
        "eid": 70,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": "0x75d30000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,739",
        "eid": 71,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,739",
        "eid": 72,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,754",
        "eid": 73,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,754",
        "eid": 74,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,770",
        "eid": 75,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,770",
        "eid": 76,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,770",
        "eid": 77,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,770",
        "eid": 78,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,770",
        "eid": 79,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,770",
        "eid": 80,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 81,
        "data": {
          "file": "RICHED32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x6cd10000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 82,
        "data": {
          "file": "COMCTL32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x6b600000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 83,
        "data": {
          "file": "COMCTL32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x6b600000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 84,
        "data": {
          "file": "COMCTL32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x6b600000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 85,
        "data": {
          "file": "COMCTL32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x6b600000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 86,
        "data": {
          "file": "COMCTL32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x6b600000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 87,
        "data": {
          "file": "C:\\Windows\\System32\\uxtheme.dll",
          "pathtofile": null,
          "moduleaddress": "0x747b0000"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 88,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 89,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 90,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 91,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 92,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 93,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 94,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 95,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 96,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,801",
        "eid": 97,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,817",
        "eid": 98,
        "data": {
          "file": "C:\\Windows\\Fonts\\StaticCache.dat"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,817",
        "eid": 99,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,817",
        "eid": 100,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,817",
        "eid": 101,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 102,
        "data": {
          "file": "oleaut32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 103,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 104,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 105,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2",
          "content": "SimSun-ExtB"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 106,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 107,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 108,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 109,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 110,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 111,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 112,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 113,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 114,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 115,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 116,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 117,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 118,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 119,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,832",
        "eid": 120,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,848",
        "eid": 121,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,848",
        "eid": 122,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,848",
        "eid": 123,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,848",
        "eid": 124,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,848",
        "eid": 125,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,848",
        "eid": 126,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\CTF\\EnableAnchorContext",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,848",
        "eid": 127,
        "data": {
          "file": "USER32",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,848",
        "eid": 128,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,864",
        "eid": 129,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,864",
        "eid": 130,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,864",
        "eid": 131,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,864",
        "eid": 132,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,864",
        "eid": 133,
        "data": {
          "file": "USER32",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,864",
        "eid": 134,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,879",
        "eid": 135,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:32,879",
        "eid": 136,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,879",
        "eid": 137,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,911",
        "eid": 138,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:59:32,911",
        "eid": 139,
        "data": {
          "file": "C:\\$Windows.~WS"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,926",
        "eid": 140,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:59:32,926",
        "eid": 141,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,926",
        "eid": 142,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,926",
        "eid": 143,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,926",
        "eid": 144,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,926",
        "eid": 145,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,926",
        "eid": 146,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,942",
        "eid": 147,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,942",
        "eid": 148,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,942",
        "eid": 149,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:32,942",
        "eid": 150,
        "data": {
          "file": "C:\\Windows\\System32\\bcryptprimitives.dll",
          "pathtofile": null,
          "moduleaddress": "0x76ba0000"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,942",
        "eid": 151,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,957",
        "eid": 152,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,957",
        "eid": 153,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,957",
        "eid": 154,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,957",
        "eid": 155,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,957",
        "eid": 156,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,957",
        "eid": 157,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,957",
        "eid": 158,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,957",
        "eid": 159,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DU.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,957",
        "eid": 160,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,957",
        "eid": 161,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DU.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,957",
        "eid": 162,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,957",
        "eid": 163,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DU.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,957",
        "eid": 164,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,957",
        "eid": 165,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DU.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 166,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 167,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 168,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 169,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 170,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 171,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 172,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 173,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 174,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 175,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 176,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 177,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 178,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 179,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 180,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 181,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 182,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 183,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 184,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 185,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 186,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 187,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 188,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 189,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 190,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 191,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 192,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 193,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 194,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 195,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 196,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 197,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 198,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 199,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 200,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 201,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 202,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 203,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 204,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 205,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 206,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,973",
        "eid": 207,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 208,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 209,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 210,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 211,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 212,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 213,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 214,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 215,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 216,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 217,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 218,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 219,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 220,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 221,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 222,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 223,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 224,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrack.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 225,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 226,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 227,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 228,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 229,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 230,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 231,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 232,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 233,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 234,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 235,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 236,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Diager.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 237,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 238,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Diager.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 239,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:32,989",
        "eid": 240,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 241,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 242,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 243,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 244,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 245,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 246,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 247,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 248,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 249,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 250,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 251,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 252,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 253,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 254,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 255,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 256,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 257,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 258,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 259,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 260,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 261,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 262,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 263,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 264,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 265,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 266,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 267,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 268,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 269,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 270,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 271,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 272,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 273,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 274,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 275,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 276,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 277,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 278,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 279,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,004",
        "eid": 280,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 281,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 282,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 283,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 284,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 285,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 286,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 287,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 288,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 289,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 290,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 291,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 292,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 293,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 294,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 295,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 296,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 297,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 298,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 299,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 300,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 301,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 302,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 303,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 304,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,020",
        "eid": 305,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,098",
        "eid": 306,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 307,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 308,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 309,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 310,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 311,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 312,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 313,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 314,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 315,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 316,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 317,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 318,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 319,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 320,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 321,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 322,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 323,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 324,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 325,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 326,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 327,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 328,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 329,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 330,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 331,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 332,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 333,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 334,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 335,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\unbcl.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 336,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,114",
        "eid": 337,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 338,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 339,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 340,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 341,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 342,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 343,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 344,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 345,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\wdsclientapi.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 346,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 347,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 348,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 349,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 350,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 351,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 352,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 353,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 354,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 355,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\wdscore.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 356,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 357,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 358,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 359,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\wdscsl.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 360,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,129",
        "eid": 361,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 362,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 363,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 364,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 365,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 366,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 367,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 368,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 369,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 370,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 371,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 372,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 373,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 374,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 375,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 376,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 377,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 378,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 379,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 380,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 381,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 382,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 383,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 384,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 385,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\wdsimage.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 386,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 387,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 388,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,145",
        "eid": 389,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 390,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 391,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 392,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 393,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 394,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 395,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 396,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 397,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 398,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 399,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 400,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 401,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 402,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 403,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 404,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\wdstptc.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 405,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 406,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 407,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 408,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 409,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 410,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 411,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 412,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 413,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 414,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\wdsutil.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 415,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,161",
        "eid": 416,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 417,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 418,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 419,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 420,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 421,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 422,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 423,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 424,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 425,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 426,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 427,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 428,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 429,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 430,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 431,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 432,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 433,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 434,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 435,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 436,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 437,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 438,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 439,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 440,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 441,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 442,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 443,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 444,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 445,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 446,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 447,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 448,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 449,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 450,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\wpx.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 451,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 452,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 453,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 454,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,176",
        "eid": 455,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 456,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 457,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 458,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 459,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 460,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 461,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 462,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 463,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 464,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 465,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 466,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 467,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 468,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 469,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 470,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 471,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 472,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 473,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 474,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 475,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 476,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 477,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 478,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 479,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 480,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 481,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 482,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 483,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 484,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 485,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 486,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 487,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 488,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 489,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 490,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 491,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 492,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 493,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 494,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 495,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 496,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 497,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 498,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 499,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 500,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,192",
        "eid": 501,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 502,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 503,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 504,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 505,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 506,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 507,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 508,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 509,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 510,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 511,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 512,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 513,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 514,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 515,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 516,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 517,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 518,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 519,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 520,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 521,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 522,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 523,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 524,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 525,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 526,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 527,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 528,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,332",
        "eid": 529,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 530,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 531,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 532,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 533,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 534,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 535,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 536,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 537,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 538,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 539,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 540,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 541,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 542,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 543,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 544,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 545,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 546,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 547,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 548,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 549,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 550,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 551,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 552,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,348",
        "eid": 553,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 554,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 555,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 556,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 557,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 558,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 559,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 560,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 561,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 562,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 563,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 564,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 565,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 566,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 567,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 568,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 569,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 570,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 571,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 572,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 573,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 574,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 575,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 576,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 577,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 578,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 579,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\SetupHost.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,364",
        "eid": 580,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 581,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 582,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 583,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 584,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 585,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 586,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 587,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 588,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 589,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 590,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 591,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 592,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 593,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 594,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 595,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 596,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 597,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 598,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 599,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 600,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 601,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 602,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 603,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 604,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,379",
        "eid": 605,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 606,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 607,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 608,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 609,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 610,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 611,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 612,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 613,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 614,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 615,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 616,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 617,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 618,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 619,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 620,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 621,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 622,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 623,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 624,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 625,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 626,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 627,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 628,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 629,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 630,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 631,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 632,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 633,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 634,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,411",
        "eid": 635,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,426",
        "eid": 636,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,426",
        "eid": 637,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,426",
        "eid": 638,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,426",
        "eid": 639,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,426",
        "eid": 640,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,426",
        "eid": 641,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,426",
        "eid": 642,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,426",
        "eid": 643,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\WinDlp.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,426",
        "eid": 644,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,426",
        "eid": 645,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 646,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 647,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 648,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 649,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 650,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 651,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 652,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 653,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 654,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 655,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 656,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 657,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 658,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 659,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 660,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 661,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 662,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 663,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 664,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 665,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,442",
        "eid": 666,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 667,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 668,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 669,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 670,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 671,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 672,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 673,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\pidgenx.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 674,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 675,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 676,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 677,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 678,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 679,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 680,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 681,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 682,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 683,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 684,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 685,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 686,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 687,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 688,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 689,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 690,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 691,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 692,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 693,
        "data": {
          "file": "C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,457",
        "eid": 694,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:33,473",
        "eid": 695,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:33,473",
        "eid": 696,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:33,473",
        "eid": 697,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\ActionableCompat",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:33,473",
        "eid": 698,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:33,473",
        "eid": 699,
        "data": {
          "file": "oleaut32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,786",
        "eid": 700,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:33,786",
        "eid": 701,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupHostResult",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:33,786",
        "eid": 702,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:33,786",
        "eid": 703,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,036",
        "eid": 704,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x77ac0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,036",
        "eid": 705,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x77ac0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,036",
        "eid": 706,
        "data": {
          "file": "C:\\Windows\\System32\\apphelp.dll",
          "pathtofile": null,
          "moduleaddress": "0x74cf0000"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,036",
        "eid": 707,
        "data": {
          "file": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,036",
        "eid": 708,
        "data": {
          "file": "C:\\Windows\\Logs\\MoSetup\\BlueBox.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 709,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 710,
        "data": {
          "file": "advapi32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 711,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 712,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 713,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx",
          "content": "kernel32.dll"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 714,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": "0x75d30000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 715,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 716,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 717,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CmdLine",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 718,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 719,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 720,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 721,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 722,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 723,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 724,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 725,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel",
          "content": null
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:59:34,113",
        "eid": 726,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 727,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 728,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId",
          "content": "0e9cfb40-0d63-45be-b169-515d335337a8"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 729,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\TestId",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 730,
        "data": {
          "file": "winbrand.dll",
          "pathtofile": null,
          "moduleaddress": "0x6af00000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 731,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 732,
        "data": {
          "file": "wldp.dll",
          "pathtofile": null,
          "moduleaddress": "0x75310000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 733,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 734,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 735,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 736,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 737,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 738,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 739,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 740,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 741,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CorrelationVector",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 742,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\CorrelationVector",
          "content": "Q9F6wPhP0U6xT2M8.0"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 743,
        "data": {
          "file": "api-ms-win-eventing-provider-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 744,
        "data": {
          "file": "kernel32",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 745,
        "data": {
          "file": "api-ms-win-core-processthreads-l1-1-2.dll",
          "pathtofile": null,
          "moduleaddress": "0x75d30000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 746,
        "data": {
          "file": "api-ms-win-core-file-l1-2-1.dll",
          "pathtofile": null,
          "moduleaddress": "0x77870000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 747,
        "data": {
          "file": "C:\\Windows\\System32\\dbghelp.dll",
          "pathtofile": null,
          "moduleaddress": "0x6ada0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 748,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 749,
        "data": {
          "file": "api-ms-win-core-processthreads-l1-1-2.dll",
          "pathtofile": null,
          "moduleaddress": "0x75d30000"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,128",
        "eid": 750,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,144",
        "eid": 751,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,144",
        "eid": 752,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,144",
        "eid": 753,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,144",
        "eid": 754,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,144",
        "eid": 755,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,144",
        "eid": 756,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,144",
        "eid": 757,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,144",
        "eid": 758,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,144",
        "eid": 759,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,144",
        "eid": 760,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 761,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 762,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 763,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 764,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 765,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 766,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 767,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 768,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 769,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 770,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 771,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 772,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType",
          "content": "Client"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 773,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId",
          "content": "Professional"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 774,
        "data": {
          "file": "winbrand.dll",
          "pathtofile": null,
          "moduleaddress": "0x6ad40000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 775,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 776,
        "data": {
          "file": "wldp.dll",
          "pathtofile": null,
          "moduleaddress": "0x75310000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 777,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 778,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 779,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 780,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 781,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId",
          "content": "Professional"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 782,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 783,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType",
          "content": "Client"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 784,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 785,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType",
          "content": "Client"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 786,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 787,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId",
          "content": "Professional"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 788,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 789,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType",
          "content": "Client"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,160",
        "eid": 790,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,175",
        "eid": 791,
        "data": {
          "file": "SLC.DLL",
          "pathtofile": null,
          "moduleaddress": "0x6bba0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:34,175",
        "eid": 792,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,175",
        "eid": 793,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform\\UseHVSocket",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,394",
        "eid": 794,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,394",
        "eid": 795,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,394",
        "eid": 796,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,410",
        "eid": 797,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,410",
        "eid": 798,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,410",
        "eid": 799,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,410",
        "eid": 800,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:34,410",
        "eid": 801,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx",
          "content": "19041.1.amd64fre.vb_release.191206-1406"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,410",
        "eid": 802,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,410",
        "eid": 803,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:34,410",
        "eid": 804,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,175",
        "eid": 805,
        "data": {
          "file": "MSVCRT.DLL",
          "pathtofile": null,
          "moduleaddress": "0x76d70000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,175",
        "eid": 806,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll",
          "pathtofile": null,
          "moduleaddress": "0x69e80000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,175",
        "eid": 807,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:35,175",
        "eid": 808,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:35,191",
        "eid": 809,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:35,191",
        "eid": 810,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,191",
        "eid": 811,
        "data": {
          "file": "RICHED32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x6cd10000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,191",
        "eid": 812,
        "data": {
          "file": "MediaSetupUIMgr.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:35,191",
        "eid": 813,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:35,191",
        "eid": 814,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:35,191",
        "eid": 815,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:35,191",
        "eid": 816,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,191",
        "eid": 817,
        "data": {
          "file": "C:\\Windows\\System32\\uxtheme.dll",
          "pathtofile": null,
          "moduleaddress": "0x747b0000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:35,191",
        "eid": 818,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme",
          "content": "1"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,285",
        "eid": 819,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\SetupCore.dll",
          "pathtofile": null,
          "moduleaddress": "0x69c10000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,285",
        "eid": 820,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:35,285",
        "eid": 821,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:35,285",
        "eid": 822,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:35,285",
        "eid": 823,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,285",
        "eid": 824,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\SetupCore.dll",
          "pathtofile": null,
          "moduleaddress": "0x69c10000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,285",
        "eid": 825,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:35,285",
        "eid": 826,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:35,285",
        "eid": 827,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,519",
        "eid": 828,
        "data": {
          "file": "api-ms-win-core-processthreads-l1-1-2.dll",
          "pathtofile": null,
          "moduleaddress": "0x75d30000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,535",
        "eid": 829,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\SetupPlatform.dll",
          "pathtofile": null,
          "moduleaddress": "0x69520000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,535",
        "eid": 830,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,535",
        "eid": 831,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,535",
        "eid": 832,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,535",
        "eid": 833,
        "data": {
          "file": "api-ms-win-core-processthreads-l1-1-2.dll",
          "pathtofile": null,
          "moduleaddress": "0x75d30000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,550",
        "eid": 834,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\SetupPlatform.dll",
          "pathtofile": null,
          "moduleaddress": "0x69520000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,550",
        "eid": 835,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,550",
        "eid": 836,
        "data": {
          "file": "kernel32",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,550",
        "eid": 837,
        "data": {
          "file": "C:\\Windows\\System32\\dbghelp.dll",
          "pathtofile": null,
          "moduleaddress": "0x6ada0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:35,550",
        "eid": 838,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,675",
        "eid": 839,
        "data": {
          "file": "API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x77870000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,675",
        "eid": 840,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemprox.dll",
          "pathtofile": null,
          "moduleaddress": "0x69430000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,706",
        "eid": 841,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemsvc.dll",
          "pathtofile": null,
          "moduleaddress": "0x693b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,706",
        "eid": 842,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\fastprox.dll",
          "pathtofile": null,
          "moduleaddress": "0x692e0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,706",
        "eid": 843,
        "data": {
          "file": "api-ms-win-core-localization-l1-2-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x77870000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,706",
        "eid": 844,
        "data": {
          "file": "api-ms-win-core-localization-obsolete-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x77870000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 845,
        "data": {
          "file": "amsi.dll",
          "pathtofile": null,
          "moduleaddress": "0x692c0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 846,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0",
          "pathtofile": null,
          "moduleaddress": "0x77870000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 847,
        "data": {
          "file": "api-ms-win-core-fibers-l1-1-1",
          "pathtofile": null,
          "moduleaddress": "0x77870000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 848,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0",
          "pathtofile": null,
          "moduleaddress": "0x77870000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 849,
        "data": {
          "file": "api-ms-win-core-fibers-l1-1-1",
          "pathtofile": null,
          "moduleaddress": "0x77870000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 850,
        "data": {
          "file": "api-ms-win-core-localization-l1-2-1",
          "pathtofile": null,
          "moduleaddress": "0x77870000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 851,
        "data": {
          "file": "C:\\Windows\\System32\\version.dll",
          "pathtofile": null,
          "moduleaddress": "0x750a0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 852,
        "data": {
          "file": "C:\\Program Files (x86)\\Windows Defender\\MpOAV.dll",
          "pathtofile": null,
          "moduleaddress": "0x69280000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 853,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)",
          "content": "{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 854,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 855,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 856,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 857,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 858,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 859,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\wbem\\fastprox.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 860,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\wbem\\fastprox.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 861,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 862,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 863,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 864,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 865,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 866,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 867,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\wbem\\fastprox.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 868,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\wbem\\fastprox.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 869,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 870,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,785",
        "eid": 871,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:39,800",
        "eid": 872,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,066",
        "eid": 873,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": "0x75d30000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,066",
        "eid": 874,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 875,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname",
          "content": "DESKTOP-HGH2VBT"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 876,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain",
          "content": ""
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 877,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname",
          "content": "DESKTOP-HGH2VBT"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 878,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain",
          "content": ""
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 879,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname",
          "content": "DESKTOP-HGH2VBT"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 880,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain",
          "content": ""
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 881,
        "data": {
          "file": "SetupPlatform.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 882,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 883,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.dll"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 884,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 885,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 886,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 887,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 888,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 889,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 890,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 891,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 892,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 893,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,097",
        "eid": 894,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,097",
        "eid": 895,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,097",
        "eid": 896,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\setupplatform.cfg"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,097",
        "eid": 897,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\migcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x00000000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,097",
        "eid": 898,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,097",
        "eid": 899,
        "data": {
          "file": "api-ms-win-eventing-provider-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,097",
        "eid": 900,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x77ac0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,097",
        "eid": 901,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,097",
        "eid": 902,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x77ac0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,097",
        "eid": 903,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,097",
        "eid": 904,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,097",
        "eid": 905,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x77ac0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,097",
        "eid": 906,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 907,
        "data": {
          "file": "policymanager.dll",
          "pathtofile": null,
          "moduleaddress": "0x691f0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 908,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 909,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType",
          "content": "4"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 910,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior",
          "content": "73777"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 911,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 912,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 913,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 914,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect",
          "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 915,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 916,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect",
          "content": "AllowTelemetry_PolicyManager"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 917,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 918,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 919,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 920,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 921,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 922,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value",
          "content": "3"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 923,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 924,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 925,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 926,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x77ac0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 927,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 928,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x77ac0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 929,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 930,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 931,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx",
          "content": "19041.1.amd64fre.vb_release.191206-1406"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 932,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\SQMClient\\MachineId",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,144",
        "eid": 933,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\CollectTrace",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,160",
        "eid": 934,
        "data": {
          "file": "SetupPlatform.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,285",
        "eid": 935,
        "data": {
          "file": "C:\\Windows\\System32\\vds_ps.dll",
          "pathtofile": null,
          "moduleaddress": "0x69270000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,285",
        "eid": 936,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\CollectTrace",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,285",
        "eid": 937,
        "data": {
          "file": "SetupPlatform.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,285",
        "eid": 938,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\CollectTrace",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,285",
        "eid": 939,
        "data": {
          "file": "SetupPlatform.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:59:40,300",
        "eid": 940,
        "data": {
          "file": "C:\\$WINDOWS.~BT"
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:59:40,300",
        "eid": 941,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources"
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:59:40,300",
        "eid": 942,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,300",
        "eid": 943,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,316",
        "eid": 944,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,316",
        "eid": 945,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,316",
        "eid": 946,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,316",
        "eid": 947,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,316",
        "eid": 948,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,316",
        "eid": 949,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,316",
        "eid": 950,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 951,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 952,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 953,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 954,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 955,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 956,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 957,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 958,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 959,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 960,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 961,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 962,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 963,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 964,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 965,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 966,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 967,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,331",
        "eid": 968,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 969,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 970,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 971,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 972,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 973,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 974,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 975,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 976,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 977,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 978,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 979,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 980,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 981,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 982,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 983,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 984,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 985,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 986,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 987,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 988,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 989,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 990,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 991,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 992,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 993,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 994,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 995,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 996,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 997,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 998,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 999,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 1000,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,347",
        "eid": 1001,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,363",
        "eid": 1002,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,363",
        "eid": 1003,
        "data": {
          "file": "C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1004,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1005,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1006,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1007,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x77ac0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1008,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1009,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1010,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x77ac0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1011,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1012,
        "data": {
          "file": "policymanager.dll",
          "pathtofile": null,
          "moduleaddress": "0x69b80000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1013,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1014,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\PolicyType",
          "content": "4"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1015,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Behavior",
          "content": "73777"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1016,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\MergeAlgorithm",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1017,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirectMapped",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1018,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1019,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegKeyPathRedirect",
          "content": "Software\\Policies\\Microsoft\\Windows\\DataCollection"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1020,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1021,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\RegValueNameRedirect",
          "content": "AllowTelemetry_PolicyManager"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1022,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\grouppolicyname",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1023,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1024,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataDevice",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1025,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\ADMXMetadataBoth",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1026,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\30Value",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1027,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowTelemetry\\Value",
          "content": "3"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1028,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1029,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry_PolicyManager",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1030,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1031,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x77ac0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1032,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1033,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x77ac0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1034,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1035,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\AllowTelemetry",
          "content": "1"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1036,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x77ac0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1037,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1038,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\TestMode",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1039,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1040,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1041,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\BuildLabEx",
          "content": "19041.1.amd64fre.vb_release.191206-1406"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1042,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1043,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR",
          "content": "3803"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1044,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1045,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1046,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1047,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\EditionId",
          "content": "Professional"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1048,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1049,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1050,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\InstallationType",
          "content": "Client"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1051,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1052,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1053,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1054,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\MachineId",
          "content": "{088B0758-31C5-47D8-9C4B-32E98EB1AB80}"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1055,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,378",
        "eid": 1056,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\Ring",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,394",
        "eid": 1057,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,394",
        "eid": 1058,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\OneSettingsVersion",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,394",
        "eid": 1059,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,394",
        "eid": 1060,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\OneSettingsBranch",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,394",
        "eid": 1061,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,394",
        "eid": 1062,
        "data": {
          "file": "winhttp.dll",
          "pathtofile": null,
          "moduleaddress": "0x72780000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,394",
        "eid": 1063,
        "data": {
          "file": "C:\\Windows\\System32\\OnDemandConnRouteHelper.dll",
          "pathtofile": null,
          "moduleaddress": "0x6e670000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,394",
        "eid": 1064,
        "data": {
          "file": "winhttp.dll",
          "pathtofile": null,
          "moduleaddress": "0x72780000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,394",
        "eid": 1065,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x77ac0000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,394",
        "eid": 1066,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,394",
        "eid": 1067,
        "data": {
          "file": "C:\\Windows\\System32\\mswsock.dll",
          "pathtofile": null,
          "moduleaddress": "0x6e610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1068,
        "data": {
          "file": "C:\\Windows\\System32\\mswsock.dll",
          "pathtofile": null,
          "moduleaddress": "0x6e610000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1069,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\WinSock_Registry_Version",
          "content": "2.0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1070,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\AutodialDLL",
          "content": "C:\\Windows\\System32\\rasadhlp.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1071,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\AutodialDLL",
          "content": "C:\\Windows\\System32\\rasadhlp.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1072,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryAdapterName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1073,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableAdapterDomainName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1074,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseDomainNameDevolution",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1075,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UseDomainNameDevolution",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1076,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DomainNameDevolutionLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1077,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\PrioritizeRecordData",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1078,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AllowUnqualifiedQuery",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1079,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\AllowUnqualifiedQuery",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1080,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AppendToMultiLabelName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1081,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenBadTlds",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1082,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenUnreachableServers",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1083,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ScreenDefaultServers",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1084,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DynamicServerQueryOrder",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1085,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterClusterIp",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1086,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\WaitForNameErrorOnAll",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1087,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseEdns",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1088,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsSecureNameQueryFallback",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1089,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableDAForAllNetworks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1090,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessQueryOrder",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1091,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryIpMatching",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1092,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseHostsFile",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1093,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AddrConfigControl",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1094,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartNameResolution",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1095,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\PreferLocalOverLowerBindingDNS",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1096,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\QueryNetBTFQDN",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1097,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableSmartProtocolReordering",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1098,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UdpRecvBufferSize",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1099,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableParallelAandAAAA",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1100,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableCoalescing",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1101,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\FilterVPNTrigger",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1102,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMultiHomedRouteConflicts",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1103,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ForceQueriesOverTcp",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1104,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShareTcpConnections",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1105,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationEnabled",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1106,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableDynamicUpdate",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1107,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterPrimaryName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1108,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterAdapterName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1109,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\EnableAdapterDomainNameRegistration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1110,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterReverseLookup",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1111,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableReverseAddressRegistrations",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1112,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegisterWanAdapters",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1113,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DisableWanDynamicUpdate",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1114,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationTtl",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1115,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationTTL",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1116,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationRefreshInterval",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1117,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DefaultRegistrationRefreshInterval",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1118,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationMaxAddressCount",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1119,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\MaxNumberOfAddressesToRegister",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1120,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateSecurityLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1121,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\UpdateSecurityLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1122,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UpdateTopLevelDomainZones",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1123,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DowncaseSpnCauseApiOwnerIsTooLazy",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1124,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\RegistrationOverwrite",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1125,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheSize",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1126,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCacheTtl",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1127,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxNegativeCacheTtl",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1128,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\AdapterTimeoutLimit",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1129,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ServerPriorityTimeLimit",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1130,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MaxCachedSockets",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1131,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableServerUnreachability",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1132,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMulticast",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1133,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastResponderFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1134,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1135,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\MulticastSenderMaxTimeout",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1136,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableMDNS",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1137,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsTest",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1138,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseCompartments",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1139,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\CacheAllCompartments",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1140,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\UseNewRegistration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1141,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1142,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ResolverRegistrationOnly",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1143,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\NewDhcpSrvRegistration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1144,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DirectAccessPreferLocal",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1145,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableIdnEncoding",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1146,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\EnableIdnMapping",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1147,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\ShortnameProxyDefault",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1148,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DisableNRPTForAdapterRegistration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1149,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutHistoryLength",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1150,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\TestMode_AdaptiveTimeoutRecalculationInterval",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1151,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQueryTimeouts",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1152,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQueryTimeouts",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1153,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Dnscache\\Parameters\\DnsQuickQueryTimeouts",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1154,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\DnsQuickQueryTimeouts",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1155,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1156,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname",
          "content": "DESKTOP-HGH2VBT"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1157,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1158,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Domain",
          "content": ""
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1159,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,410",
        "eid": 1160,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\Tcpip\\Parameters\\Hostname",
          "content": "DESKTOP-HGH2VBT"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,441",
        "eid": 1161,
        "data": {
          "file": "C:\\Windows\\System32\\FWPUCLNT.DLL",
          "pathtofile": null,
          "moduleaddress": "0x6d200000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,644",
        "eid": 1162,
        "data": {
          "file": "C:\\Windows\\SysWOW64\\schannel.dll",
          "pathtofile": null,
          "moduleaddress": "0x6d180000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,660",
        "eid": 1163,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextLockCount",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,660",
        "eid": 1164,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SCHANNEL\\UserContextListCount",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:41,066",
        "eid": 1165,
        "data": {
          "file": "sspicli.dll",
          "pathtofile": null,
          "moduleaddress": "0x74d90000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:41,066",
        "eid": 1166,
        "data": {
          "file": "mskeyprotect.dll",
          "pathtofile": null,
          "moduleaddress": "0x6d170000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1167,
        "data": {
          "file": "C:\\Windows\\System32\\ncryptsslp.dll",
          "pathtofile": null,
          "moduleaddress": "0x6d120000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1168,
        "data": {
          "file": "C:\\Windows\\System32\\bcryptprimitives.dll",
          "pathtofile": null,
          "moduleaddress": "0x76ba0000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1169,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name",
          "content": "@%SystemRoot%\\system32\\dnsapi.dll,-103"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1170,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1171,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103",
          "content": "Domain Name System (DNS) Server Trust"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1172,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\\Name",
          "content": "@%SystemRoot%\\system32\\dnsapi.dll,-103"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1173,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1174,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\dnsapi.dll,-103",
          "content": "Domain Name System (DNS) Server Trust"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1175,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\\Name",
          "content": "@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1176,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1177,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124",
          "content": "Document Encryption"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1178,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\\Name",
          "content": "@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1179,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1180,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\1\\52C64B7E\\@%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-124",
          "content": "Document Encryption"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1181,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1182,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\crypt32\\DiagMatchAnyMask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1183,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableSerialChain",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1184,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\CryptnetPreFetchTriggerPeriodSeconds",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1185,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\MaxUrlRetrievalByteCount",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1186,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\DisallowedCertSyncDeltaTime",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1187,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1188,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\DisableAutoFlushProcessNameList",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1189,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushFirstDeltaSeconds",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1190,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\AutoFlushNextDeltaSeconds",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1191,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1192,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1193,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1194,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1195,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1196,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1197,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1198,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1199,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1200,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\8F43288AD272F3103B6FB1428485EA3014C0BCFE\\Blob",
          "content": "\\\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xbb\\x04\\x8f\\x1889_o\\xc3\\xa1\\xf3\\xd2\\xb7\\xe9vT\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00'\\x9c\\xd6R\\xc4\\xe2R\\xbf\\xbeR\\x17\\xacr\"\\x05\\xd7r\\x9b\\xa4\t\\x14\\x8c\\xfa\\x9em\\x9e[\\x1c\\xb9N\\xaf\\xf1\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x00T\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00R\\x00o\\x00o\\x00t\\x00 \\x00C\\x00e\\x00r\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00e\\x00 \\x00A\\x00u\\x00t\\x00h\\x00o\\x00r\\x00i\\x00t\\x00y\\x00 \\x002\\x000\\x001\\x001\\x00\\x00\\x00i\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0e\\x00\\x00\\x000\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x03\\x02\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x8fC(\\x8a\\xd2r\\xf3\\x10;o\\xb1B\\x84\\x85\\xea0\\x14\\xc0\\xbc\\xfe\\x14\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00r-:\\x021\\x90C\\xb9\\x14\\x05N\\xe1\\xea\\xa7\\xc71\\xd1#\\x894\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xce\\x04\\x90\\xd5\\xe5l4\\xa5\\xae\\x0b\\xe9\\x8b\\xe5\\x81\\x18] \\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xf1\\x05\\x00\\x000\\x82\\x05\\xed0\\x82\\x03\\xd5\\xa0\\x03\\x02\\x01\\x02\\x02\\x10?\\x8b\\xc8\\xb5\\xfc\\x9f\\xb2\\x96C\\xb5i\\xd6lB\\xe1D0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\x881\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x130\\x11\\x06\\x03U\\x04\\x08\\x13\nWashington1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x13\\x07Redmond1\\x1e0\\x1c\\x06\\x03U\\x04\n\\x13\\x15Microsoft Corporation1200\\x06\\x03U\\x04\\x03\\x13)Microsoft Root Certificate Authority 20110\\x1e\\x17\r110322220"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1201,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRulesLogDir",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1202,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\\PinRules",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1203,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesLastSyncTime",
          "content": "?\\xc2x|\\xb6\\xee\\xdc\\x01"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1204,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1205,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,081",
        "eid": 1206,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\\PinRulesEncodedCtl",
          "content": "0\\x82E\\x94\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x07\\x02\\xa0\\x82E\\x850\\x82E\\x81\\x02\\x01\\x011\\x0b0\t\\x06\\x05+\\x0e\\x03\\x02\\x1a\\x05\\x000\\x82'\\xee\\x06\t+\\x06\\x01\\x04\\x01\\x827\n\\x01\\xa0\\x82'\\xdf0\\x82'\\xdb0\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03 \\x04,P\\x00i\\x00n\\x00R\\x00u\\x00l\\x00e\\x00s\\x00_\\x00A\\x00u\\x00t\\x00o\\x00U\\x00p\\x00d\\x00a\\x00t\\x00e\\x00_\\x001\\x00\\x00\\x00\\x02\\x08\\x01\\xd2\\xdae\\xad\\xdb@7\\x17\r170531232859Z\\x17\r180601232859Z0\\x0e\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x03\"\\x05\\x000\\x82\\x1f\\xa30)\\x04\\x12.files-df.1drv.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000&\\x04\\x0f.files.1drv.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x0004\\x04\n.aadrm.com1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x0101\\x04\\x07.afx.ms1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x0105\\x04\\x0b.akadns.net1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x031\\x03\\x02\\x01\\x010%\\x04\\x0e.aspnetcdn.com1\\x130\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x0008\\x04\\x0e.azure-int.net1&0\\x11\\x06\n+\\x06\\x01\\x04\\x01\\x827\n\\x04\\x021\\x03\\x02\\x01\\x000\\x11\\x06\n+\\x06\\x01\\x04\\x01"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1207,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OneSettings"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1208,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1209,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1210,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\ETag",
          "content": "1192:66A2A386"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1211,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\RefreshInterval",
          "content": "1192"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1212,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\Settings"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1213,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1214,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\os",
          "content": "windows"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1215,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\osver",
          "content": "10.0.19041.3803.amd64fre.vb_release.191206-1406"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1216,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\scenarioId",
          "content": "7"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1217,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\platformEdition",
          "content": "Professional"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1218,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\platformInstallationType",
          "content": "Client"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1219,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\sku",
          "content": "48"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1220,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\deviceId",
          "content": "{088B0758-31C5-47D8-9C4B-32E98EB1AB80}"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1221,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\appver",
          "content": "10.0.19041.572"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1222,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\QueryParameters\\appBuildLab",
          "content": "vb_release_svc_prod1"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1223,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OneSettings\\WSD\\Setup360\\RefreshAfter",
          "content": "\"\\x06\\xf6/\\x9c\\xef\\xdc\\x01"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:41,285",
        "eid": 1224,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:41,300",
        "eid": 1225,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:41,300",
        "eid": 1226,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\setupact.log"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:41,300",
        "eid": 1227,
        "data": {
          "file": "api-ms-win-core-processthreads-l1-1-2.dll",
          "pathtofile": null,
          "moduleaddress": "0x75d30000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:41,300",
        "eid": 1228,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\SetupMgr.dll",
          "pathtofile": null,
          "moduleaddress": "0x69ad0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:41,300",
        "eid": 1229,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:41,331",
        "eid": 1230,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:41,347",
        "eid": 1231,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,347",
        "eid": 1232,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\Control Panel\\International\\Geo\\Nation",
          "content": "12"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,347",
        "eid": 1233,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,347",
        "eid": 1234,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\SusClientId",
          "content": "0e9cfb40-0d63-45be-b169-515d335337a8"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,347",
        "eid": 1235,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\CSDBuildNumber",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,347",
        "eid": 1236,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildBranch",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,347",
        "eid": 1237,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\BuildBranch",
          "content": "vb_release"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,347",
        "eid": 1238,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\Compact",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,347",
        "eid": 1239,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\EnablePreviewBuilds",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,347",
        "eid": 1240,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ProductOptions\\ProductType",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,347",
        "eid": 1241,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ProductOptions\\ProductType",
          "content": "WinNT"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:41,363",
        "eid": 1242,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,363",
        "eid": 1243,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\StudyID",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:41,363",
        "eid": 1244,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\SetupHost.Exe",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,363",
        "eid": 1245,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,363",
        "eid": 1246,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,363",
        "eid": 1247,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "0"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,363",
        "eid": 1248,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,363",
        "eid": 1249,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Cleanup",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,363",
        "eid": 1250,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Priority",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:41,363",
        "eid": 1251,
        "data": {
          "file": "winhttp.dll",
          "pathtofile": null,
          "moduleaddress": "0x72780000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:41,363",
        "eid": 1252,
        "data": {
          "file": "C:\\Windows\\System32\\OnDemandConnRouteHelper.dll",
          "pathtofile": null,
          "moduleaddress": "0x6e670000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:41,363",
        "eid": 1253,
        "data": {
          "file": "winhttp.dll",
          "pathtofile": null,
          "moduleaddress": "0x72780000"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:41,363",
        "eid": 1254,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:41,363",
        "eid": 1255,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:41,378",
        "eid": 1256,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:41,394",
        "eid": 1257,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:41,394",
        "eid": 1258,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,425",
        "eid": 1259,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,425",
        "eid": 1260,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,425",
        "eid": 1261,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,425",
        "eid": 1262,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,425",
        "eid": 1263,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,425",
        "eid": 1264,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,441",
        "eid": 1265,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\27E6663299D340DFE54571CECCEC01BE74495DC6",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,441",
        "eid": 1266,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,441",
        "eid": 1267,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,441",
        "eid": 1268,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,441",
        "eid": 1269,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,441",
        "eid": 1270,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,441",
        "eid": 1271,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,441",
        "eid": 1272,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\B5EE89E77326AB2BF1775BD99C19A28947FF8184",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,441",
        "eid": 1273,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,441",
        "eid": 1274,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,441",
        "eid": 1275,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\\Blob",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,441",
        "eid": 1276,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\\Blob",
          "content": "\\\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x14\\xc3\\xbd5I\\xee\"Z\\xec\\xe174\\xad\\x8c\\xa0\\xb8\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xdf<$\\xf9\\xbf\\xd6fv\\x1b&\\x80s\\xfe\\x06\\xd1\\xcc\\x8dO\\x82\\xa4~\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x80\\xc8+h\\x86\\xd7\\x01\\x7f\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x000\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x03\\x1d\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00}\\xc3\\x0b\\xc9tiU`\\xa2\\xf0\t\neEUl\\x14\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00N\"T \\x18\\x95\\xe6\\xe3n\\xe6\\x0f\\xfa\\xfa\\xb9\\x12\\xed\\x06\\x17\\x8f9b\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00\\xcb<\\xcb\\xb7`1\\xe5\\xe0\\x13\\x8f\\x8d\\xd3\\x9a#\\xf9\\xdeG\\xff\\xc3^C\\xc1\\x14L\\xea'\\xd4jZ\\xb1\\xcb_\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00D\\x00i\\x00g\\x00i\\x00C\\x00e\\x00r\\x00t\\x00 \\x00G\\x00l\\x00o\\x00b\\x00a\\x00l\\x00 \\x00R\\x00o\\x00o\\x00t\\x00 \\x00G\\x002\\x00\\x00\\x00\t\\x00\\x00\\x00\\x01\\x00\\x00\\x004\\x00\\x00\\x0002\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x03\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x04\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x08S\\x00\\x00\\x00\\x01\\x00\\x00\\x00@\\x00\\x00\\x000>0\\x1f\\x06\t`\\x86H\\x01\\x86\\xfdl\\x02\\x010\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc00\\x1b\\x06\\x05g\\x81\\x0c\\x01\\x030\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc0\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00KN\\xb4\\xb0t)\\x8b\\x82\\x8b\\\\x000\\x95\\xa1\\x0bE#\\xfb\\x95\\x1c\\x0c\\x884\\x8b\t\\xc5>[\\xab\\xa4\\x08\\xa3\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xe4\\xa6\\x8a\\xc8T\\xacRBF\n\\xfdrH\\x1b*D \\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x92\\x03\\x00\\x000\\x82\\x03\\x8e"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1277,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1278,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1279,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1280,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1281,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1282,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1283,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\9BC57546ACBDB29E388CD1791B43DE4F659B844B",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1284,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1285,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1286,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1287,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1288,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1289,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1290,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\CA\\Certificates\\7FA05ACF9B4AABB0DE0CFAFA297DDF92FDC5F3F5",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1291,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\ROOT\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1292,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1293,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E\\Blob",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:41,863",
        "eid": 1294,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\7E04DE896A3E666D00E687D33FFAD93BE83D349E\\Blob",
          "content": "\\\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x80\\x01\\x00\\x00\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xb0\t\\xe9\\x9a\\\\xfc\\x92\\x8a\\x171\\x90\\x10m\\xbb2\\xa9\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00~\\x04\\xde\\x89j>fm\\x00\\xe6\\x87\\xd3?\\xfa\\xd9;\\xe8=4\\x9e\\x1d\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xd0\\xab9\\xed\\xd1\\xa4\\xd8\\x9aU\\x12\\x88-\\xeb\t\\xcb\\x13\\x14\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xb3\\xdbH\\xa4\\xf9\\xa1\\xc5\\xd8\\xae6A\\xcc\\x11cib)\\xbcK\\xc6b\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x001\\xadfH\\xf8\\x10A8\\xc78\\xf3\\x9e\\xa42\\x0139>:\\x18\\xcc\\x02)n\\xf9|*\\xc9\\xefg1\\xd0\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00D\\x00i\\x00g\\x00i\\x00C\\x00e\\x00r\\x00t\\x00 \\x00G\\x00l\\x00o\\x00b\\x00a\\x00l\\x00 \\x00R\\x00o\\x00o\\x00t\\x00 \\x00G\\x003\\x00\\x00\\x00\t\\x00\\x00\\x00\\x01\\x00\\x00\\x004\\x00\\x00\\x0002\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x03\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x04\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x08S\\x00\\x00\\x00\\x01\\x00\\x00\\x00@\\x00\\x00\\x000>0\\x1f\\x06\t`\\x86H\\x01\\x86\\xfdl\\x02\\x010\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc00\\x1b\\x06\\x05g\\x81\\x0c\\x01\\x030\\x120\\x10\\x06\n+\\x06\\x01\\x04\\x01\\x827<\\x01\\x01\\x03\\x02\\x00\\xc0\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00\\x82\\xc8\\x01\\x999w\"\\xb5z\\xd4s\\xea&k\\x93\\xd4\\x7f\\xfcw\\xfe\\x07\\xf0\\x93\\x884_ \\xda\\xb6\\xad\\xdd\\x08vr\\xf9\\x88\\xb4\\xbb\\xfd\\x15LK\\x13<p\\xc9\\xec\\xff\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xf5]\\xa4P\\xa5\\xfb(~\\x1e\\x0f\r\\xcc\\x96WV\\xca \\x00\\x00\\x00\\x01\\x00\\x00\\x00C\\x02\\x00\\x000\\x82\\x02?0\\x82\\x01\\xc5\\xa0\\x03\\x02\\x01\\x02\\x02\\x10\\x05UV\\xbc\\xf2^\\xa455\\xc3\\xa4\\x0f\\xd5\\xabEr0"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:41,894",
        "eid": 1295,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:41,910",
        "eid": 1296,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:41,941",
        "eid": 1297,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:41,956",
        "eid": 1298,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,160",
        "eid": 1299,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1300,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1301,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1302,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1303,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1304,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1305,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1306,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1307,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1308,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SetupOverride",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1309,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogPath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1310,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SetupOverride",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1311,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogLevel",
          "content": "536887297"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1312,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1313,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMaxFileSize",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1314,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1315,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,175",
        "eid": 1316,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1317,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1318,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1319,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1320,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1321,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1322,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1323,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1324,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1325,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1326,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1327,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1328,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1329,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1330,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1331,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1332,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1333,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1334,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1335,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1336,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1337,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1338,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1339,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1340,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1341,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1342,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1343,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1344,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1345,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1346,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1347,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1348,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1349,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1350,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1351,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1352,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1353,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1354,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1355,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1356,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1357,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1358,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1359,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1360,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1361,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1362,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1363,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1364,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1365,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1366,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1367,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1368,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1369,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1370,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1371,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1372,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1373,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1374,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1375,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1376,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1377,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1378,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1379,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1380,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1381,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1382,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1383,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1384,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1385,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1386,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1387,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1388,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1389,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1390,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1391,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1392,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1393,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1394,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1395,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1396,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1397,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1398,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,191",
        "eid": 1399,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1400,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1401,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1402,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1403,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1404,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1405,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1406,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1407,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1408,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1409,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1410,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1411,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1412,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1413,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1414,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1415,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,206",
        "eid": 1416,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.cab"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1417,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1418,
        "data": {
          "file": "MediaSetupUIMgr.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1419,
        "data": {
          "file": "COMCTL32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x72970000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1420,
        "data": {
          "file": "COMCTL32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x72970000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1421,
        "data": {
          "file": "COMCTL32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x72970000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1422,
        "data": {
          "file": "COMCTL32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x72970000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1423,
        "data": {
          "file": "COMCTL32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x72970000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1424,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1425,
        "data": {
          "file": "comctl32.dll",
          "pathtofile": null,
          "moduleaddress": "0x72970000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1426,
        "data": {
          "file": "user32",
          "pathtofile": null,
          "moduleaddress": "0x775d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1427,
        "data": {
          "file": "comctl32.dll",
          "pathtofile": null,
          "moduleaddress": "0x72970000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1428,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1429,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1430,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\products.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1431,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1432,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1433,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath",
          "content": "C:\\Windows\\Fonts\\staticcache.dat"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,222",
        "eid": 1434,
        "data": {
          "file": "C:\\Windows\\Fonts\\StaticCache.dat"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1435,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1436,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2",
          "content": "SimSun-ExtB"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1437,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1438,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1439,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1440,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1441,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1442,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1443,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1444,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1445,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1446,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1447,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1448,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1449,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1450,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1451,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1452,
        "data": {
          "file": "C:\\Windows\\System32\\windowscodecs.dll",
          "pathtofile": null,
          "moduleaddress": "0x6be60000"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1453,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1454,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{41945702-8302-44A6-9445-AC98E8AFA086}\\CLSID",
          "content": "{41945702-8302-44A6-9445-AC98E8AFA086}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1455,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Author",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1456,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Author",
          "content": "Microsoft Corporation"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1457,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FriendlyName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1458,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FriendlyName",
          "content": "Microsoft Raw Image Decoder"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1459,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1460,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Version",
          "content": "10.0.19041.3636"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1461,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SpecVersion",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1462,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SpecVersion",
          "content": "1.0.0.0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1463,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Vendor",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1464,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Vendor",
          "content": "{F0E749CA-EDEF-4589-A73A-EE0E626A2A2B}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1465,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1466,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\InprocServer32\\(Default)",
          "content": "%SystemRoot%\\system32\\MSRAWImage.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1467,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ContainerFormat",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1468,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ContainerFormat",
          "content": "{FE99CE60-F19C-433C-A3AE-00ACEFA9CA21}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1469,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\DeviceManufacturer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1470,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\DeviceModels",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1471,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ColorManagementVersion",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1472,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ColorManagementVersion",
          "content": "1.0.0.0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1473,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\MimeTypes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1474,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\MimeTypes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1475,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\MimeTypes",
          "content": "image/3FR,image/ARI,image/ARW,image/BAY,image/CAP,image/CR2,image/CR3,image/CRW,image/DCS,image/DCR,image/DRF,image/EIP,image/ERF,image/FFF,image/IIQ,image/K25,image/KDC,image/MEF,image/MOS,image/MRW,image/NEF,image/NRW,image/ORF,image/ORI,image/PEF,image/"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1476,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FileExtensions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1477,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FileExtensions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1478,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\FileExtensions",
          "content": ".3FR,.ARI,.ARW,.BAY,.CAP,.CR2,.CR3,.CRW,.DCS,.DCR,.DRF,.EIP,.ERF,.FFF,.IIQ,.K25,.KDC,.MEF,.MOS,.MRW,.NEF,.NRW,.ORF,.ORI,.PEF,.PTX,.PXN,.RAF,.RAW,.RW2,.RWL,.SR2,.SRF,.SRW,.X3F,.DNG"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1479,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportAnimation",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1480,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportChromakey",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1481,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportLossless",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1482,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\SupportMultiframe",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1483,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\ArbitrationPriority",
          "content": "10"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1484,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1485,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1486,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1487,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1488,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1489,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1490,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1491,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1492,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1493,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1494,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1495,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1496,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1497,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1498,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1499,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1500,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1501,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Pattern",
          "content": "MM\\x00*"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1502,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1503,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\0\\Mask",
          "content": "\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1504,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1505,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1506,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Pattern",
          "content": "II*\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1507,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1508,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\1\\Mask",
          "content": "\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1509,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Position",
          "content": "8"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1510,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1511,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Pattern",
          "content": "MMMMRaw\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1512,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1513,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\10\\Mask",
          "content": "\\xff\\xff\\xff\\xff\\x00\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1514,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1515,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1516,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Pattern",
          "content": "IIU\\x00\\x08\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1517,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1518,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\11\\Mask",
          "content": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1519,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1520,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1521,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Pattern",
          "content": "IIU\\x00\\x18\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1522,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1523,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\12\\Mask",
          "content": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1524,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1525,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1526,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Pattern",
          "content": "FOVb"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1527,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1528,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\13\\Mask",
          "content": "\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1529,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Position",
          "content": "4"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1530,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1531,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Pattern",
          "content": "ftypcrx "
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1532,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1533,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\14\\Mask",
          "content": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1534,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1535,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1536,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Pattern",
          "content": "IIRO"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1537,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1538,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\2\\Mask",
          "content": "\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1539,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1540,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1541,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Pattern",
          "content": "IIRS"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1542,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1543,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\3\\Mask",
          "content": "\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1544,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1545,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1546,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Pattern",
          "content": "MMOR"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1547,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,238",
        "eid": 1548,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\4\\Mask",
          "content": "\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1549,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1550,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1551,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1552,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Pattern",
          "content": "MMSR"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1553,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1554,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\5\\Mask",
          "content": "\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1555,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1556,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1557,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Pattern",
          "content": "II\\x1a\\x00\\x00\\x00HE"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1558,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1559,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\6\\Mask",
          "content": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1560,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1561,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1562,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Pattern",
          "content": "FUJIFILM"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1563,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1564,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\7\\Mask",
          "content": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1565,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1566,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1567,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Pattern",
          "content": "\\x00MRM"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1568,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1569,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\8\\Mask",
          "content": "\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1570,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Position",
          "content": "8"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1571,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1572,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Pattern",
          "content": "IIII\\x00waR"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1573,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1574,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{41945702-8302-44A6-9445-AC98E8AFA086}\\Patterns\\9\\Mask",
          "content": "\\xff\\xff\\xff\\xff\\x00\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1575,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{7ED96837-96F0-4812-B211-F13C24117ED3}\\Instance\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\CLSID",
          "content": "{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1576,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Author",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1577,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1578,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FriendlyName",
          "content": "Microsoft Camera Raw Decoder"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1579,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1580,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Version",
          "content": "10.0.19041.3636"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1581,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SpecVersion",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1582,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SpecVersion",
          "content": "1.0.0.0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1583,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Vendor",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1584,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Vendor",
          "content": "{F0E749CA-EDEF-4589-A73A-EE0E626A2A2B}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1585,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1586,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\InprocServer32\\(Default)",
          "content": "C:\\Windows\\SysWOW64\\WindowsCodecsRaw.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1587,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ContainerFormat",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1588,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ContainerFormat",
          "content": "{C1FC85CB-D64F-478B-A4EC-69ADC9EE1392}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1589,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\DeviceManufacturer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1590,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\DeviceModels",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1591,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ColorManagementVersion",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1592,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ColorManagementVersion",
          "content": "1.0.0.0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1593,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\MimeTypes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1594,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\MimeTypes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1595,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\MimeTypes",
          "content": "image/ARW,image/CR2,image/CRW,image/ERF,image/KDC,image/MRW,image/NEF,image/NRW,image/ORF,image/PEF,image/RAF,image/RAW,image/RW2,image/RWL,image/SR2,image/SRW,image/DNG"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1596,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FileExtensions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1597,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FileExtensions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1598,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\FileExtensions",
          "content": ".ARW,.CR2,.CRW,.ERF,.KDC,.MRW,.NEF,.NRW,.ORF,.PEF,.RAF,.RAW,.RW2,.RWL,.SR2,.SRW,.DNG"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1599,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportAnimation",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1600,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportChromakey",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1601,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportLossless",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1602,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\SupportMultiframe",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1603,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\ArbitrationPriority",
          "content": "9"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1604,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1605,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1606,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1607,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1608,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1609,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1610,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1611,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1612,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1613,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1614,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1615,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1616,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Pattern",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1617,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1618,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1619,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Pattern",
          "content": "MM\\x00*"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1620,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1621,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\0\\Mask",
          "content": "\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1622,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1623,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1624,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Pattern",
          "content": "II*\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1625,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1626,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\1\\Mask",
          "content": "\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1627,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Position",
          "content": "8"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1628,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1629,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Pattern",
          "content": "MMMMRaw\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1630,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1631,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\10\\Mask",
          "content": "\\xff\\xff\\xff\\xff\\x00\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1632,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1633,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1634,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Pattern",
          "content": "IIU\\x00\\x08\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1635,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1636,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\11\\Mask",
          "content": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1637,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1638,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1639,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Pattern",
          "content": "IIU\\x00\\x18\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1640,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1641,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\12\\Mask",
          "content": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1642,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1643,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1644,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Pattern",
          "content": "IIRO"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1645,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1646,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\2\\Mask",
          "content": "\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1647,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1648,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1649,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Pattern",
          "content": "IIRS"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1650,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1651,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\3\\Mask",
          "content": "\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1652,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1653,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1654,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Pattern",
          "content": "MMOR"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1655,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1656,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\4\\Mask",
          "content": "\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1657,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1658,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1659,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Pattern",
          "content": "MMSR"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1660,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1661,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\5\\Mask",
          "content": "\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1662,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1663,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1664,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Pattern",
          "content": "II\\x1a\\x00\\x00\\x00HE"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1665,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1666,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\6\\Mask",
          "content": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1667,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1668,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1669,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Pattern",
          "content": "FUJIFILM"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1670,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1671,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\7\\Mask",
          "content": "\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1672,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Position",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1673,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1674,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Pattern",
          "content": "\\x00MRM"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1675,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1676,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\8\\Mask",
          "content": "\\xff\\xff\\xff\\xff"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1677,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Position",
          "content": "8"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1678,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\EndOfStream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1679,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Pattern",
          "content": "IIII\\x00waR"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1680,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Mask",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,253",
        "eid": 1681,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\\Patterns\\9\\Mask",
          "content": "\\xff\\xff\\xff\\xff\\x00\\xff\\xff\\xff"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,269",
        "eid": 1682,
        "data": {
          "file": "oleaut32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,269",
        "eid": 1683,
        "data": {
          "file": "USER32",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,269",
        "eid": 1684,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,269",
        "eid": 1685,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,269",
        "eid": 1686,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\CTF\\EnableAnchorContext",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,269",
        "eid": 1687,
        "data": {
          "file": "USER32",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,300",
        "eid": 1688,
        "data": {
          "file": "C:\\Windows\\SysWOW64\\oleacc.dll",
          "pathtofile": null,
          "moduleaddress": "0x69930000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,300",
        "eid": 1689,
        "data": {
          "file": "OLEAUT32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x76e60000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,316",
        "eid": 1690,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:42,331",
        "eid": 1691,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:42,331",
        "eid": 1692,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:43,238",
        "eid": 1693,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupProgress",
          "content": "0"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:43,238",
        "eid": 1694,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupPhase",
          "content": "2"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:43,238",
        "eid": 1695,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\SetupSubPhase",
          "content": "24"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:46,378",
        "eid": 1696,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:46,378",
        "eid": 1697,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:46,378",
        "eid": 1698,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:46,378",
        "eid": 1699,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "0"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:46,378",
        "eid": 1700,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "1"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:51,378",
        "eid": 1701,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:51,378",
        "eid": 1702,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:51,378",
        "eid": 1703,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:51,378",
        "eid": 1704,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "1"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:51,378",
        "eid": 1705,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "2"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:56,378",
        "eid": 1706,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:56,378",
        "eid": 1707,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:56,378",
        "eid": 1708,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:56,378",
        "eid": 1709,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "2"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:56,378",
        "eid": 1710,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "3"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:56,956",
        "eid": 1711,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:56,956",
        "eid": 1712,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:56,956",
        "eid": 1713,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:56,972",
        "eid": 1714,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:56,972",
        "eid": 1715,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:56,988",
        "eid": 1716,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:56,988",
        "eid": 1717,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:56,988",
        "eid": 1718,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:56,988",
        "eid": 1719,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:56,988",
        "eid": 1720,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:56,988",
        "eid": 1721,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:56,988",
        "eid": 1722,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:56,988",
        "eid": 1723,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:56,988",
        "eid": 1724,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1725,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1726,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1727,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1728,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1729,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1730,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1731,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1732,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1733,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1734,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1735,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1736,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1737,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1738,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1739,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1740,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1741,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1742,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,003",
        "eid": 1743,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,019",
        "eid": 1744,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,019",
        "eid": 1745,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInset",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,019",
        "eid": 1746,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragDelay",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,019",
        "eid": 1747,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragMinDist",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,019",
        "eid": 1748,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollDelay",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,019",
        "eid": 1749,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\ScrollInterval",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,019",
        "eid": 1750,
        "data": {
          "file": "C:\\Windows\\win.ini"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,019",
        "eid": 1751,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,019",
        "eid": 1752,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1753,
        "data": {
          "file": "ole32.dll",
          "pathtofile": null,
          "moduleaddress": "0x77240000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1754,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{00000160-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
          "content": "{00000320-0000-0000-C000-000000000046}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1755,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\Extensions\\DragDropExtension",
          "content": "{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1756,
        "data": {
          "file": "gdi32.dll",
          "pathtofile": null,
          "moduleaddress": "0x76b10000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1757,
        "data": {
          "file": "C:\\Windows\\System32\\dataexchange.dll",
          "pathtofile": null,
          "moduleaddress": "0x6e800000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1758,
        "data": {
          "file": "C:\\Windows\\system32\\twinapi.appcore.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "findwindow",
        "object": "windowname",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1759,
        "data": {
          "classname": "ApplicationManager_DesktopShellWindow",
          "windowname": ""
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1760,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\Extensions\\DragDropExtension",
          "content": "{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}"
        }
      },
      {
        "event": "findwindow",
        "object": "windowname",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1761,
        "data": {
          "classname": "ApplicationManager_DesktopShellWindow",
          "windowname": ""
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1762,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1763,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent",
          "content": "Arial"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1764,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1765,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold",
          "content": "Arial Bold"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1766,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold,0",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1767,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold,0",
          "content": "Arial Bold,178"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1768,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent,0",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1769,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent,0",
          "content": "Arial,178"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1770,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Baltic,186",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1771,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Baltic,186",
          "content": "Arial,186"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1772,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CE,238",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1773,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CE,238",
          "content": "Arial,238"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1774,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CYR,204",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1775,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CYR,204",
          "content": "Arial,204"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1776,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Greek,161",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1777,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Greek,161",
          "content": "Arial,161"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1778,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial TUR,162",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1779,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial TUR,162",
          "content": "Arial,162"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1780,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Baltic,186",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1781,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Baltic,186",
          "content": "Courier New,186"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1782,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CE,238",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1783,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CE,238",
          "content": "Courier New,238"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1784,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CYR,204",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1785,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CYR,204",
          "content": "Courier New,204"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1786,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Greek,161",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1787,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Greek,161",
          "content": "Courier New,161"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1788,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New TUR,162",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1789,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New TUR,162",
          "content": "Courier New,162"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1790,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helv",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1791,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helv",
          "content": "MS Sans Serif"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1792,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helvetica",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1793,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helvetica",
          "content": "Arial"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1794,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1795,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2",
          "content": "Tahoma"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1796,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tahoma Armenian",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1797,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tahoma Armenian",
          "content": "Tahoma"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1798,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1799,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times",
          "content": "Times New Roman"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1800,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Baltic,186",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1801,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Baltic,186",
          "content": "Times New Roman,186"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1802,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CE,238",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1803,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CE,238",
          "content": "Times New Roman,238"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1804,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1805,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent",
          "content": "Arial"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1806,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1807,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold",
          "content": "Arial Bold"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1808,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold,0",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1809,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent Bold,0",
          "content": "Arial Bold,178"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1810,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent,0",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1811,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arabic Transparent,0",
          "content": "Arial,178"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1812,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Baltic,186",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1813,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Baltic,186",
          "content": "Arial,186"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1814,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CE,238",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1815,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CE,238",
          "content": "Arial,238"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1816,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CYR,204",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1817,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial CYR,204",
          "content": "Arial,204"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1818,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Greek,161",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1819,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial Greek,161",
          "content": "Arial,161"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1820,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial TUR,162",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1821,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Arial TUR,162",
          "content": "Arial,162"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1822,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Baltic,186",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1823,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Baltic,186",
          "content": "Courier New,186"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1824,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CE,238",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1825,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CE,238",
          "content": "Courier New,238"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1826,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CYR,204",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1827,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New CYR,204",
          "content": "Courier New,204"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1828,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Greek,161",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1829,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New Greek,161",
          "content": "Courier New,161"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1830,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New TUR,162",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1831,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Courier New TUR,162",
          "content": "Courier New,162"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1832,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helv",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1833,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helv",
          "content": "MS Sans Serif"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1834,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helvetica",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1835,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Helvetica",
          "content": "Arial"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1836,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1837,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg 2",
          "content": "Tahoma"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1838,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tahoma Armenian",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1839,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tahoma Armenian",
          "content": "Tahoma"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1840,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1841,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times",
          "content": "Times New Roman"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1842,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Baltic,186",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1843,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Baltic,186",
          "content": "Times New Roman,186"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1844,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CE,238",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1845,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CE,238",
          "content": "Times New Roman,238"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1846,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CYR,204",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1847,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman CYR,204",
          "content": "Times New Roman,204"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1848,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Greek,161",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1849,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman Greek,161",
          "content": "Times New Roman,161"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1850,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman TUR,162",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1851,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Times New Roman TUR,162",
          "content": "Times New Roman,162"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1852,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tms Rmn",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1853,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Tms Rmn",
          "content": "MS Serif"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1854,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:57,050",
        "eid": 1855,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\MS Shell Dlg",
          "content": "Microsoft Sans Serif"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:59:57,066",
        "eid": 1856,
        "data": {
          "file": "C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:01,378",
        "eid": 1857,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:01,378",
        "eid": 1858,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:01,378",
        "eid": 1859,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:01,378",
        "eid": 1860,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "3"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:01,378",
        "eid": 1861,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "4"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:06,394",
        "eid": 1862,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:06,394",
        "eid": 1863,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:06,394",
        "eid": 1864,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:06,394",
        "eid": 1865,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "4"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:06,394",
        "eid": 1866,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "5"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:11,425",
        "eid": 1867,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:11,425",
        "eid": 1868,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:11,425",
        "eid": 1869,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:11,425",
        "eid": 1870,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "5"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:11,425",
        "eid": 1871,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "6"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:16,472",
        "eid": 1872,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:16,472",
        "eid": 1873,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:16,472",
        "eid": 1874,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:16,472",
        "eid": 1875,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "6"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:16,472",
        "eid": 1876,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "7"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:21,472",
        "eid": 1877,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:21,472",
        "eid": 1878,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:21,472",
        "eid": 1879,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:21,472",
        "eid": 1880,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "7"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:21,472",
        "eid": 1881,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "8"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:26,503",
        "eid": 1882,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:26,503",
        "eid": 1883,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:26,503",
        "eid": 1884,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:26,503",
        "eid": 1885,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "8"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:26,503",
        "eid": 1886,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "9"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:31,503",
        "eid": 1887,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:31,503",
        "eid": 1888,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:31,503",
        "eid": 1889,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:31,503",
        "eid": 1890,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "9"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:31,503",
        "eid": 1891,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "10"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:36,519",
        "eid": 1892,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:36,519",
        "eid": 1893,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:36,519",
        "eid": 1894,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:36,519",
        "eid": 1895,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "10"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:36,519",
        "eid": 1896,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "11"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:41,535",
        "eid": 1897,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:41,535",
        "eid": 1898,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:41,535",
        "eid": 1899,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:41,535",
        "eid": 1900,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "11"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:41,535",
        "eid": 1901,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "12"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:46,550",
        "eid": 1902,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:46,550",
        "eid": 1903,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:46,550",
        "eid": 1904,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:46,550",
        "eid": 1905,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "12"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:46,550",
        "eid": 1906,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "13"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:51,550",
        "eid": 1907,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:51,550",
        "eid": 1908,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:51,550",
        "eid": 1909,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:51,550",
        "eid": 1910,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "13"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:51,550",
        "eid": 1911,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "14"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:56,566",
        "eid": 1912,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:56,566",
        "eid": 1913,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:56,566",
        "eid": 1914,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:56,566",
        "eid": 1915,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "14"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:00:56,566",
        "eid": 1916,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "15"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:01,581",
        "eid": 1917,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:01,581",
        "eid": 1918,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:01,581",
        "eid": 1919,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:01,581",
        "eid": 1920,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "15"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:01,581",
        "eid": 1921,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "16"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:06,581",
        "eid": 1922,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:06,581",
        "eid": 1923,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:06,581",
        "eid": 1924,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:06,581",
        "eid": 1925,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "16"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:06,581",
        "eid": 1926,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "17"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:11,581",
        "eid": 1927,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:11,581",
        "eid": 1928,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:11,581",
        "eid": 1929,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:11,581",
        "eid": 1930,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "17"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:11,581",
        "eid": 1931,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "18"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:16,581",
        "eid": 1932,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:16,581",
        "eid": 1933,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:16,581",
        "eid": 1934,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:16,581",
        "eid": 1935,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "18"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:16,581",
        "eid": 1936,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "19"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:21,597",
        "eid": 1937,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:21,597",
        "eid": 1938,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:21,597",
        "eid": 1939,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:21,597",
        "eid": 1940,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "19"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:21,597",
        "eid": 1941,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "20"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:26,597",
        "eid": 1942,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:26,597",
        "eid": 1943,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:26,597",
        "eid": 1944,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:26,597",
        "eid": 1945,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "20"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:26,597",
        "eid": 1946,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "21"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:31,613",
        "eid": 1947,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:31,613",
        "eid": 1948,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:31,613",
        "eid": 1949,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:31,613",
        "eid": 1950,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "21"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:31,613",
        "eid": 1951,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "22"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:36,628",
        "eid": 1952,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:36,628",
        "eid": 1953,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:36,628",
        "eid": 1954,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:36,628",
        "eid": 1955,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "22"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:36,628",
        "eid": 1956,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "23"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:41,644",
        "eid": 1957,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:41,644",
        "eid": 1958,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:41,644",
        "eid": 1959,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:41,644",
        "eid": 1960,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "23"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:41,644",
        "eid": 1961,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "24"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:46,660",
        "eid": 1962,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:46,660",
        "eid": 1963,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:46,660",
        "eid": 1964,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:46,660",
        "eid": 1965,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "24"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:46,660",
        "eid": 1966,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "25"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:51,675",
        "eid": 1967,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:51,675",
        "eid": 1968,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:51,675",
        "eid": 1969,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:51,675",
        "eid": 1970,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "25"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:51,675",
        "eid": 1971,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "26"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:56,675",
        "eid": 1972,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:56,675",
        "eid": 1973,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:56,675",
        "eid": 1974,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:56,675",
        "eid": 1975,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "26"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:01:56,675",
        "eid": 1976,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "27"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:01,691",
        "eid": 1977,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:01,691",
        "eid": 1978,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:01,691",
        "eid": 1979,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:01,691",
        "eid": 1980,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "27"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:01,691",
        "eid": 1981,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "28"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:06,706",
        "eid": 1982,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:06,706",
        "eid": 1983,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:06,706",
        "eid": 1984,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:06,706",
        "eid": 1985,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "28"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:06,706",
        "eid": 1986,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "29"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:11,706",
        "eid": 1987,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:11,706",
        "eid": 1988,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:11,706",
        "eid": 1989,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:11,706",
        "eid": 1990,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "29"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:11,706",
        "eid": 1991,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "30"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:16,706",
        "eid": 1992,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:16,706",
        "eid": 1993,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:16,706",
        "eid": 1994,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:16,706",
        "eid": 1995,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "30"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:16,706",
        "eid": 1996,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "31"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:21,706",
        "eid": 1997,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:21,706",
        "eid": 1998,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:21,706",
        "eid": 1999,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:21,706",
        "eid": 2000,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "31"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:21,706",
        "eid": 2001,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "32"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:26,706",
        "eid": 2002,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:26,706",
        "eid": 2003,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:26,706",
        "eid": 2004,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:26,706",
        "eid": 2005,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "32"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:26,706",
        "eid": 2006,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "33"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:31,722",
        "eid": 2007,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:31,722",
        "eid": 2008,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:31,722",
        "eid": 2009,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:31,722",
        "eid": 2010,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "33"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:31,722",
        "eid": 2011,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "34"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:36,722",
        "eid": 2012,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:36,722",
        "eid": 2013,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:36,722",
        "eid": 2014,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:36,722",
        "eid": 2015,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "34"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:36,722",
        "eid": 2016,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "35"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:41,722",
        "eid": 2017,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:41,722",
        "eid": 2018,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:41,722",
        "eid": 2019,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:41,722",
        "eid": 2020,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "35"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:41,722",
        "eid": 2021,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "36"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:46,722",
        "eid": 2022,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:46,722",
        "eid": 2023,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:46,722",
        "eid": 2024,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:46,722",
        "eid": 2025,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "36"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:46,722",
        "eid": 2026,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "37"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:51,722",
        "eid": 2027,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:51,722",
        "eid": 2028,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:51,722",
        "eid": 2029,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:51,722",
        "eid": 2030,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "37"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 23:02:51,722",
        "eid": 2031,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\MoSetup\\Volatile\\InstallTicks",
          "content": "38"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:59:39,972",
        "eid": 2032,
        "data": {
          "file": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:59:40,191",
        "eid": 2033,
        "data": {
          "file": "C:\\Windows\\System32\\vdsldr.exe -Embedding"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:59:43,081",
        "eid": 2034,
        "data": {
          "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:59:43,144",
        "eid": 2035,
        "data": {
          "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:59:43,160",
        "eid": 2036,
        "data": {
          "file": "\"C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\SkypeApp.exe\" -ServerName:App.AppXffn3yxqvgawq9fpmnhy90fr3y01d1t5b.mca"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:59:43,378",
        "eid": 2037,
        "data": {
          "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:59:43,394",
        "eid": 2038,
        "data": {
          "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:59:43,410",
        "eid": 2039,
        "data": {
          "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXsqpbawq1jx69hhfyy1dr9y35whgstkrr.mca"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:59:43,425",
        "eid": 2040,
        "data": {
          "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:59:43,441",
        "eid": 2041,
        "data": {
          "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:59:43,472",
        "eid": 2042,
        "data": {
          "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:59:43,488",
        "eid": 2043,
        "data": {
          "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 23:02:52,113",
        "eid": 2044,
        "data": {
          "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 23:02:52,128",
        "eid": 2045,
        "data": {
          "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXsqpbawq1jx69hhfyy1dr9y35whgstkrr.mca"
        }
      },
      {
        "event": "start",
        "object": "service",
        "timestamp": "2026-05-28 23:02:54,769",
        "eid": 2046,
        "data": {
          "service": "TrustedInstaller"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 23:02:54,988",
        "eid": 2047,
        "data": {
          "file": "C:\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3745_none_7ded3f327ca60a41\\TiWorker.exe -Embedding"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,691",
        "eid": 2048,
        "data": {
          "file": "C:\\Windows\\System32\\es.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf1520000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,691",
        "eid": 2049,
        "data": {
          "file": "C:\\Windows\\System32\\es.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf1520000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,691",
        "eid": 2050,
        "data": {
          "file": "API-MS-Win-Security-Base-L1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf8fa0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,691",
        "eid": 2051,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd9470000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,691",
        "eid": 2052,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemsvc.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcef1a0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,706",
        "eid": 2053,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\fastprox.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd9360000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,706",
        "eid": 2054,
        "data": {
          "file": "authZ.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf7830000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,706",
        "eid": 2055,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wmiutils.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffceadd0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,706",
        "eid": 2056,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\repdrvfs.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd92e0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,706",
        "eid": 2057,
        "data": {
          "file": "Wevtapi.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf2c50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,753",
        "eid": 2058,
        "data": {
          "file": "amsi.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd91d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,753",
        "eid": 2059,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf8fa0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,753",
        "eid": 2060,
        "data": {
          "file": "api-ms-win-core-fibers-l1-1-1",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf8fa0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,753",
        "eid": 2061,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf8fa0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,753",
        "eid": 2062,
        "data": {
          "file": "api-ms-win-core-fibers-l1-1-1",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf8fa0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,753",
        "eid": 2063,
        "data": {
          "file": "api-ms-win-core-localization-l1-2-1",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf8fa0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,753",
        "eid": 2064,
        "data": {
          "file": "C:\\Windows\\System32\\version.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffce1be0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,753",
        "eid": 2065,
        "data": {
          "file": "C:\\Program Files\\Windows Defender\\MpOAV.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd9180000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,769",
        "eid": 2066,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\WmiPrvSD.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd9200000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,769",
        "eid": 2067,
        "data": {
          "file": "API-MS-Win-Security-Base-L1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf8fa0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,769",
        "eid": 2068,
        "data": {
          "file": "api-ms-win-core-localization-l1-2-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf8fa0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,769",
        "eid": 2069,
        "data": {
          "file": "api-ms-win-core-localization-obsolete-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf8fa0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,769",
        "eid": 2070,
        "data": {
          "file": "api-ms-win-core-processsecurity-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfabc0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,769",
        "eid": 2071,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemess.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd90f0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,769",
        "eid": 2072,
        "data": {
          "file": "C:\\Windows\\System32\\rsaenh.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf7a90000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,769",
        "eid": 2073,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfabc0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:39,769",
        "eid": 2074,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\esscli.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffce2640000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,003",
        "eid": 2075,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd9470000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,050",
        "eid": 2076,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd9470000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,066",
        "eid": 2077,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd9470000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 2078,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd9470000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,081",
        "eid": 2079,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd9470000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 23:00:50,660",
        "eid": 2080,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\NCProv.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf4570000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 23:01:10,050",
        "eid": 2081,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd9470000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 23:01:10,285",
        "eid": 2082,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd9470000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 23:02:56,316",
        "eid": 2083,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd9470000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,004",
        "eid": 2084,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfabc0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,004",
        "eid": 2085,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemprox.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffce8ee0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,004",
        "eid": 2086,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemsvc.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcef1a0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,020",
        "eid": 2087,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\fastprox.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd9360000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,020",
        "eid": 2088,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wmiutils.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffceadd0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,020",
        "eid": 2089,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\cimwin32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd8ee0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,036",
        "eid": 2090,
        "data": {
          "file": "OLEAUT32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfad50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,036",
        "eid": 2091,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcfb3b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,036",
        "eid": 2092,
        "data": {
          "file": "DEVOBJ.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcf85a0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,036",
        "eid": 2093,
        "data": {
          "file": "WMI.DLL",
          "pathtofile": null,
          "moduleaddress": "0x1691e370000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,036",
        "eid": 2094,
        "data": {
          "file": "NETAPI32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x7ffce8c90000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,253",
        "eid": 2095,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,253",
        "eid": 2096,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,253",
        "eid": 2097,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,253",
        "eid": 2098,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,253",
        "eid": 2099,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,253",
        "eid": 2100,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,253",
        "eid": 2101,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,253",
        "eid": 2102,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,253",
        "eid": 2103,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,253",
        "eid": 2104,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,253",
        "eid": 2105,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,253",
        "eid": 2106,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,253",
        "eid": 2107,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9C38ED61-D565-4728-AEEE-C80952F0ECDE}\\(Default)",
          "content": "Virtual Disk Service Loader"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2108,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2109,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
          "content": "{00000320-0000-0000-C000-000000000046}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2110,
        "data": {
          "file": "combase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2111,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2112,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ProxyStubClsid32\\(Default)",
          "content": "{E0393303-90D4-4A97-AB71-E9B671EE2729}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2113,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2114,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2115,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\(Default)",
          "content": "VDS ProxyStub"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2116,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2117,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2118,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\(Default)",
          "content": "%SystemRoot%\\System32\\vds_ps.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2119,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2120,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2121,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2122,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\(Default)",
          "content": "VDS ProxyStub"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2123,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2124,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2125,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\(Default)",
          "content": "%SystemRoot%\\System32\\vds_ps.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2126,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2127,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E0393303-90D4-4A97-AB71-E9B671EE2729}\\AppID",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2128,
        "data": {
          "file": "C:\\Windows\\System32\\vds_ps.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ffcd8e00000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2129,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:40,269",
        "eid": 2130,
        "data": {
          "file": "combase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:46,300",
        "eid": 2131,
        "data": {
          "file": "oleaut32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:46,300",
        "eid": 2132,
        "data": {
          "file": "mscoree.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:46,300",
        "eid": 2133,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:46,300",
        "eid": 2134,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:46,300",
        "eid": 2135,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:59:46,300",
        "eid": 2136,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:59:46,300",
        "eid": 2137,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      }
    ],
    "encryptedbuffers": [
      {
        "process_name": "SetupHost.Exe",
        "pid": 5932,
        "api_call": "SslEncryptPacket",
        "buffer": "GET /settings/v2.0/WSD/Setup360?os=windows&osver=10.0.19041.3803.amd64fre.vb_release.191206-1406&scenarioId=7&platformEdition=Professional&platformInstallationType=Client&sku=48&deviceId=%7B088B0758-31C5-47D8-9C4B-32E98EB1AB80%7D&appver=10.0.19041.572&appBuildLab=vb_release_svc_prod1 HTTP/1.1\r\nConnection: Keep-Alive\r\nUser-Agent: OneSettingsQuery\r\nHost: settings-win.data.microsoft.com",
        "buffer_size": "390"
      },
      {
        "process_name": "SetupHost.Exe",
        "pid": 5932,
        "api_call": "SslEncryptPacket",
        "buffer": "HEAD /fwlink/?LinkId=841361 HTTP/1.1\r\nConnection: Keep-Alive\r\nUser-Agent: Windows Dlp Manager\r\nHost: go.microsoft.com",
        "buffer_size": "121"
      },
      {
        "process_name": "SetupHost.Exe",
        "pid": 5932,
        "api_call": "SslEncryptPacket",
        "buffer": "HEAD /download/7/9/c/79cbc22a-0eea-4a0d-89c0-054a1b3aa8e0/products.cab HTTP/1.1\r\nConnection: Keep-Alive\r\nUser-Agent: Windows Dlp Manager\r\nHost: download.microsoft.com",
        "buffer_size": "170"
      },
      {
        "process_name": "SetupHost.Exe",
        "pid": 5932,
        "api_call": "SslEncryptPacket",
        "buffer": "GET /fwlink/?LinkId=841361 HTTP/1.1\r\nConnection: Keep-Alive\r\nRange: bytes=0-44044\r\nUser-Agent: Windows Dlp Manager\r\nHost: go.microsoft.com",
        "buffer_size": "142"
      },
      {
        "process_name": "SetupHost.Exe",
        "pid": 5932,
        "api_call": "SslEncryptPacket",
        "buffer": "GET /download/7/9/c/79cbc22a-0eea-4a0d-89c0-054a1b3aa8e0/products.cab HTTP/1.1\r\nConnection: Keep-Alive\r\nRange: bytes=0-44044\r\nUser-Agent: Windows Dlp Manager\r\nHost: download.microsoft.com",
        "buffer_size": "191"
      },
      {
        "process_name": "SetupHost.Exe",
        "pid": 5932,
        "api_call": "SslEncryptPacket",
        "buffer": "HEAD /download/C/0/3/C036B882-9F99-4BC9-A4B5-69370C4E17E9/EULA_MCTool_EN-US_6.27.16.rtf HTTP/1.1\r\nConnection: Keep-Alive\r\nUser-Agent: Windows Dlp Manager\r\nHost: download.microsoft.com",
        "buffer_size": "187"
      },
      {
        "process_name": "SetupHost.Exe",
        "pid": 5932,
        "api_call": "SslEncryptPacket",
        "buffer": "GET /download/C/0/3/C036B882-9F99-4BC9-A4B5-69370C4E17E9/EULA_MCTool_EN-US_6.27.16.rtf HTTP/1.1\r\nConnection: Keep-Alive\r\nRange: bytes=0-204388\r\nUser-Agent: Windows Dlp Manager\r\nHost: download.microsoft.com",
        "buffer_size": "209"
      }
    ],
    "network_map": {
      "endpoint_map": {},
      "http_host_map": {},
      "dns_intents": {},
      "http_requests": [],
      "winhttp_sessions": [],
      "com_activations": []
    }
  },
  "debug": {
    "log": "2026-05-28 15:48:17,333 [root] INFO: Date set to: 20260528T15:59:20, timeout set to: 200\n2026-05-28 15:59:20,008 [root] DEBUG: Starting analyzer from: C:\\sl_8s73e\n2026-05-28 15:59:20,009 [root] DEBUG: Storing results at: C:\\tCeWxwA\n2026-05-28 15:59:20,009 [root] DEBUG: Pipe server name: \\\\.\\PIPE\\pBeReCzX\n2026-05-28 15:59:20,009 [root] DEBUG: Python path: C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64\n2026-05-28 15:59:20,009 [root] INFO: analysis running as an admin\n2026-05-28 15:59:20,010 [root] INFO: analysis package specified: \"exe\"\n2026-05-28 15:59:20,010 [root] DEBUG: importing analysis package module: \"modules.packages.exe\"...\n2026-05-28 15:59:20,011 [root] DEBUG: imported analysis package \"exe\"\n2026-05-28 15:59:20,012 [root] DEBUG: initializing analysis package \"exe\"...\n2026-05-28 15:59:20,012 [lib.common.common] INFO: no wrapping\n2026-05-28 15:59:20,012 [lib.core.compound] INFO: C:\\Users\\admin\\AppData\\Local\\Temp already exists, skipping creation\n2026-05-28 15:59:20,013 [root] DEBUG: New location of moved file: C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\n2026-05-28 15:59:20,013 [root] INFO: Analyzer: Package modules.packages.exe does not specify a dll option\n2026-05-28 15:59:20,014 [root] INFO: Analyzer: Package modules.packages.exe does not specify a dll_64 option\n2026-05-28 15:59:20,014 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option\n2026-05-28 15:59:20,015 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option\n2026-05-28 15:59:20,026 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.browser\"\n2026-05-28 15:59:20,045 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.digisig\"\n2026-05-28 15:59:20,055 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.disguise\"\n2026-05-28 15:59:20,060 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.human\"\n2026-05-28 15:59:20,063 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'\n2026-05-28 15:59:20,063 [lib.api.screenshot] ERROR: No module named 'PIL'\n2026-05-28 15:59:20,063 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.screenshots\"\n2026-05-28 15:59:20,065 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.tlsdump\"\n2026-05-28 15:59:20,065 [root] DEBUG: Initialized auxiliary module \"Browser\"\n2026-05-28 15:59:20,065 [root] DEBUG: attempting to configure 'Browser' from data\n2026-05-28 15:59:20,065 [root] DEBUG: module Browser does not support data configuration, ignoring\n2026-05-28 15:59:20,066 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.browser\"...\n2026-05-28 15:59:20,066 [root] DEBUG: Started auxiliary module modules.auxiliary.browser\n2026-05-28 15:59:20,066 [root] DEBUG: Initialized auxiliary module \"DigiSig\"\n2026-05-28 15:59:20,066 [root] DEBUG: attempting to configure 'DigiSig' from data\n2026-05-28 15:59:20,067 [root] DEBUG: module DigiSig does not support data configuration, ignoring\n2026-05-28 15:59:20,068 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.digisig\"...\n2026-05-28 15:59:20,068 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature\n2026-05-28 15:59:20,201 [modules.auxiliary.digisig] DEBUG: File has a valid signature\n2026-05-28 15:59:20,202 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json\n2026-05-28 15:59:20,203 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig\n2026-05-28 15:59:20,203 [root] DEBUG: Initialized auxiliary module \"Disguise\"\n2026-05-28 15:59:20,203 [root] DEBUG: attempting to configure 'Disguise' from data\n2026-05-28 15:59:20,204 [root] DEBUG: module Disguise does not support data configuration, ignoring\n2026-05-28 15:59:20,204 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.disguise\"...\n2026-05-28 15:59:20,206 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 5252)\n2026-05-28 15:59:20,207 [modules.auxiliary.disguise] INFO: Disguising GUID to c7406fee-7fb2-42ef-9904-a977453e1654\n2026-05-28 15:59:20,207 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise\n2026-05-28 15:59:20,208 [root] DEBUG: Initialized auxiliary module \"Human\"\n2026-05-28 15:59:20,208 [root] DEBUG: attempting to configure 'Human' from data\n2026-05-28 15:59:20,208 [root] DEBUG: module Human does not support data configuration, ignoring\n2026-05-28 15:59:20,209 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.human\"...\n2026-05-28 15:59:20,210 [root] DEBUG: Started auxiliary module modules.auxiliary.human\n2026-05-28 15:59:20,211 [root] DEBUG: Initialized auxiliary module \"Screenshots\"\n2026-05-28 15:59:20,211 [root] DEBUG: attempting to configure 'Screenshots' from data\n2026-05-28 15:59:20,211 [root] DEBUG: module Screenshots does not support data configuration, ignoring\n2026-05-28 15:59:20,211 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.screenshots\"...\n2026-05-28 15:59:20,213 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled\n2026-05-28 15:59:20,213 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots\n2026-05-28 15:59:20,214 [root] DEBUG: Initialized auxiliary module \"TLSDumpMasterSecrets\"\n2026-05-28 15:59:20,214 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data\n2026-05-28 15:59:20,214 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring\n2026-05-28 15:59:20,215 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.tlsdump\"...\n2026-05-28 15:59:20,216 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process\n2026-05-28 15:59:20,216 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump\n2026-05-28 15:59:20,217 [root] INFO: Interactive mode enabled - injecting into explorer shell\n2026-05-28 15:59:20,297 [lib.api.process] INFO: Monitor config for process 3932: C:\\sl_8s73e\\dll\\3932.ini\n2026-05-28 15:59:20,298 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:20,300 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:20,368 [root] DEBUG: Loader: Injecting process 3932 with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:20,556 [root] DEBUG: 3932: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 15:59:20,556 [root] DEBUG: 3932: Disabling sleep skipping.\n2026-05-28 15:59:20,557 [root] DEBUG: 3932: Interactive desktop enabled.\n2026-05-28 15:59:20,557 [root] DEBUG: 3932: Dropped file limit defaulting to 100.\n2026-05-28 15:59:20,558 [root] DEBUG: 3932: Interactive desktop - injecting Explorer Shell\n2026-05-28 15:59:20,562 [root] DEBUG: 3932: YaraInit: Compiled 44 rule files\n2026-05-28 15:59:20,563 [root] DEBUG: 3932: YaraInit: Compiled rules saved to file C:\\sl_8s73e\\data\\yara\\capemon.yac\n2026-05-28 15:59:20,578 [root] DEBUG: 3932: RtlInsertInvertedFunctionTable 0x00007FFCFB3C090E, LdrpInvertedFunctionTableSRWLock 0x00007FFCFB51D4F0\n2026-05-28 15:59:20,579 [root] DEBUG: 3932: YaraScan: Scanning 0x00007FF633380000, size 0x545316\n2026-05-28 15:59:20,616 [root] DEBUG: 3932: Monitor initialised: 64-bit capemon loaded in process 3932 at 0x00007FFCD8990000, thread 4840, image base 0x00007FF633380000, stack from 0x0000000008041000-0x0000000008050000\n2026-05-28 15:59:20,616 [root] DEBUG: 3932: Commandline: C:\\Windows\\Explorer.EXE\n2026-05-28 15:59:20,624 [root] DEBUG: 3932: Hooked 69 out of 69 functions\n2026-05-28 15:59:20,652 [root] DEBUG: 3932: Syscall hook installed, syscall logging level 1\n2026-05-28 15:59:20,658 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-05-28 15:59:20,658 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:20,659 [lib.api.process] INFO: Injected into 64-bit <Process 3932 explorer.exe>\n2026-05-28 15:59:25,016 [root] DEBUG: 3932: DLL loaded at 0x00007FFCE7310000: C:\\Windows\\System32\\Windows.UI.Xaml (0x10c0000 bytes).\n2026-05-28 15:59:25,027 [root] DEBUG: 3932: DLL loaded at 0x00007FFCEF2D0000: C:\\Windows\\system32\\WindowsInternal.ComposableShell.DesktopHosting (0x2e000 bytes).\n2026-05-28 15:59:25,038 [root] DEBUG: 3932: DLL loaded at 0x00007FFCD8740000: C:\\Windows\\ShellComponents\\WindowsInternal.ComposableShell.Experiences.Switcher (0x24d000 bytes).\n2026-05-28 15:59:25,045 [root] DEBUG: 3932: DLL loaded at 0x00007FFCEF250000: C:\\Windows\\ShellExperiences\\TileControl (0x7d000 bytes).\n2026-05-28 15:59:25,047 [root] DEBUG: 3932: DLL loaded at 0x00007FFCD8520000: C:\\Windows\\ShellComponents\\TaskFlowUI (0x215000 bytes).\n2026-05-28 15:59:25,055 [root] DEBUG: 3932: DLL loaded at 0x00007FFCE9640000: C:\\Windows\\System32\\UiaManager (0xa1000 bytes).\n2026-05-28 15:59:25,070 [root] DEBUG: 3932: AllocationHandler: Adding allocation to tracked region list: 0x00007DF40D271000, size: 0x1000.\n2026-05-28 15:59:28,078 [root] INFO: Restarting WMI Service\n2026-05-28 15:59:30,111 [root] DEBUG: package modules.packages.exe does not support configure, ignoring\n2026-05-28 15:59:30,114 [root] WARNING: configuration error for package modules.packages.exe: error importing data.packages.exe: No module named 'data.packages'\n2026-05-28 15:59:30,116 [lib.core.compound] INFO: C:\\Users\\admin\\AppData\\Local\\Temp already exists, skipping creation\n2026-05-28 15:59:30,478 [lib.api.process] INFO: Successfully executed process from path \"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\" with arguments \"\" with pid 5448\n2026-05-28 15:59:30,479 [lib.api.process] INFO: Monitor config for process 5448: C:\\sl_8s73e\\dll\\5448.ini\n2026-05-28 15:59:30,480 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:30,482 [lib.api.process] INFO: 32-bit DLL to inject is C:\\sl_8s73e\\dll\\OTvgpxwO.dll, loader C:\\sl_8s73e\\bin\\UdkovOz.exe\n2026-05-28 15:59:30,489 [root] DEBUG: Loader: Injecting process 5448 (thread 5444) with C:\\sl_8s73e\\dll\\OTvgpxwO.dll.\n2026-05-28 15:59:30,490 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 15:59:30,490 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\OTvgpxwO.dll.\n2026-05-28 15:59:30,491 [lib.api.process] INFO: Injected into 32-bit <Process 5448 MediaCreationTool_22H2.exe>\n2026-05-28 15:59:32,506 [lib.api.process] INFO: Successfully resumed process with pid 5448\n2026-05-28 15:59:32,532 [root] DEBUG: 5448: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 15:59:32,532 [root] DEBUG: 5448: Disabling sleep skipping.\n2026-05-28 15:59:32,533 [root] DEBUG: 5448: Interactive desktop enabled.\n2026-05-28 15:59:32,533 [root] DEBUG: 5448: Dropped file limit defaulting to 100.\n2026-05-28 15:59:32,536 [root] DEBUG: 5448: YaraInit: Compiled rules loaded from existing file C:\\sl_8s73e\\data\\yara\\capemon.yac\n2026-05-28 15:59:32,536 [root] DEBUG: 5448: YaraScan: Scanning 0x00C20000, size 0xb096d2\n2026-05-28 15:59:32,581 [root] DEBUG: 5448: Monitor initialised: 32-bit capemon loaded in process 5448 at 0x6b690000, thread 5444, image base 0xc20000, stack from 0xae4000-0xaf0000\n2026-05-28 15:59:32,582 [root] DEBUG: 5448: Commandline: \"C:\\Users\\admin\\AppData\\Local\\Temp\\MediaCreationTool_22H2.exe\"\n2026-05-28 15:59:32,601 [root] DEBUG: 5448: hook_api: LdrpCallInitRoutine export address 0x77B32B50 obtained via GetFunctionAddress\n2026-05-28 15:59:32,615 [root] DEBUG: 5448: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST\n2026-05-28 15:59:32,615 [root] DEBUG: 5448: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST\n2026-05-28 15:59:32,619 [root] DEBUG: 5448: Hooked 632 out of 632 functions\n2026-05-28 15:59:32,656 [root] DEBUG: 5448: Syscall hook installed, syscall logging level 1\n2026-05-28 15:59:32,659 [root] DEBUG: 5448: RestoreHeaders: Restored original import table.\n2026-05-28 15:59:32,660 [root] INFO: Loaded monitor into process with pid 5448\n2026-05-28 15:59:32,681 [root] DEBUG: 5448: caller_dispatch: Added region at 0x00C20000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00C92F4B, thread 5444).\n2026-05-28 15:59:32,682 [root] DEBUG: 5448: YaraScan: Scanning 0x00C20000, size 0xb096d2\n2026-05-28 15:59:32,736 [root] DEBUG: 5448: ProcessImageBase: Main module image at 0x00C20000 unmodified (entropy change 0.000000e+00)\n2026-05-28 15:59:32,768 [root] DEBUG: 5448: DLL loaded at 0x76CC0000: C:\\Windows\\System32\\shcore (0x87000 bytes).\n2026-05-28 15:59:32,801 [root] DEBUG: 5448: DLL loaded at 0x6B330000: C:\\Windows\\SYSTEM32\\USP10 (0x17000 bytes).\n2026-05-28 15:59:32,802 [root] DEBUG: 5448: DLL loaded at 0x6B2F0000: C:\\Windows\\system32\\msls31 (0x31000 bytes).\n2026-05-28 15:59:32,802 [root] DEBUG: 5448: DLL loaded at 0x6B350000: C:\\Windows\\system32\\riched20 (0x7a000 bytes).\n2026-05-28 15:59:32,802 [root] DEBUG: 5448: DLL loaded at 0x6CD10000: C:\\Windows\\system32\\riched32 (0x6000 bytes).\n2026-05-28 15:59:32,809 [root] DEBUG: 5448: DLL loaded at 0x75BD0000: C:\\Windows\\System32\\MSCTF (0xd4000 bytes).\n2026-05-28 15:59:32,814 [root] DEBUG: 5448: DLL loaded at 0x74E90000: C:\\Windows\\SYSTEM32\\kernel.appcore (0xf000 bytes).\n2026-05-28 15:59:32,815 [root] DEBUG: 5448: DLL loaded at 0x76BA0000: C:\\Windows\\System32\\bcryptprimitives (0x5f000 bytes).\n2026-05-28 15:59:32,830 [root] DEBUG: 5448: DLL loaded at 0x6B250000: C:\\Windows\\SYSTEM32\\TextShaping (0x95000 bytes).\n2026-05-28 15:59:32,856 [root] DEBUG: 5448: DLL loaded at 0x6F4E0000: C:\\Windows\\SYSTEM32\\ntmarta (0x29000 bytes).\n2026-05-28 15:59:32,857 [root] DEBUG: 5448: DLL loaded at 0x6F510000: C:\\Windows\\system32\\coremessaging (0x9b000 bytes).\n2026-05-28 15:59:32,858 [root] DEBUG: 5448: DLL loaded at 0x6FAC0000: C:\\Windows\\SYSTEM32\\wintypes (0xdc000 bytes).\n2026-05-28 15:59:32,858 [root] DEBUG: 5448: DLL loaded at 0x6F6A0000: C:\\Windows\\system32\\coreuicomponents (0x27f000 bytes).\n2026-05-28 15:59:32,859 [root] DEBUG: 5448: DLL loaded at 0x6FBA0000: C:\\Windows\\SYSTEM32\\textinputframework (0xb9000 bytes).\n2026-05-28 15:59:32,886 [root] DEBUG: 3932: YaraScan: Scanning 0x00007FF633380000, size 0x545316\n2026-05-28 15:59:32,887 [root] DEBUG: 3932: caller_dispatch: Added region at 0x00007FF633380000 to tracked regions list (ntdll::LdrLoadDll returns to 0x00007FF6333EB354, thread 3476).\n2026-05-28 15:59:32,888 [root] WARNING: File at path C:\\$Windows.~WS\\Sources does not exist, skipping\n2026-05-28 15:59:32,890 [root] DEBUG: 3932: YaraScan: Scanning 0x00007FF633380000, size 0x545316\n2026-05-28 15:59:32,920 [root] WARNING: File at path C:\\$Windows.~WS does not exist, skipping\n2026-05-28 15:59:32,923 [root] DEBUG: 3932: ProcessImageBase: Main module image at 0x00007FF633380000 unmodified (entropy change 0.000000e+00)\n2026-05-28 15:59:32,923 [root] DEBUG: 3932: ProcessImageBase: Main module image at 0x00007FF633380000 unmodified (entropy change 0.000000e+00)\n2026-05-28 15:59:32,973 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\DU.dll\n2026-05-28 15:59:32,994 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\DiagTrack.dll\n2026-05-28 15:59:32,999 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe\n2026-05-28 15:59:33,002 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\Diager.dll\n2026-05-28 15:59:33,006 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\setupplatform.cfg\n2026-05-28 15:59:33,114 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\setupplatform.dll\n2026-05-28 15:59:33,128 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\unbcl.dll\n2026-05-28 15:59:33,134 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\wdsclientapi.dll\n2026-05-28 15:59:33,140 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\wdscore.dll\n2026-05-28 15:59:33,143 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\wdscsl.dll\n2026-05-28 15:59:33,157 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\wdsimage.dll\n2026-05-28 15:59:33,168 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\wdstptc.dll\n2026-05-28 15:59:33,174 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\wdsutil.dll\n2026-05-28 15:59:33,189 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\wpx.dll\n2026-05-28 15:59:33,337 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll\n2026-05-28 15:59:33,365 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\SetupCore.dll\n2026-05-28 15:59:33,378 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\SetupHost.exe\n2026-05-28 15:59:33,411 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\SetupMgr.dll\n2026-05-28 15:59:33,429 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\WinDlp.dll\n2026-05-28 15:59:33,460 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\pidgenx.dll\n2026-05-28 15:59:33,468 [root] INFO: Added new file to list with pid 5448 and path C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms\n2026-05-28 15:59:33,823 [root] DEBUG: 5448: DLL loaded at 0x75310000: C:\\Windows\\SYSTEM32\\Wldp (0x24000 bytes).\n2026-05-28 15:59:33,824 [root] DEBUG: 5448: DLL loaded at 0x75340000: C:\\Windows\\SYSTEM32\\windows.storage (0x613000 bytes).\n2026-05-28 15:59:33,825 [root] DEBUG: 5448: CreateProcessHandler: Injection info set for new process 5932: C:\\$Windows.~WS\\Sources\\SetupHost.Exe, ImageBase: 0x00F20000\n2026-05-28 15:59:33,826 [root] INFO: Announced 32-bit process name: SetupHost.exe pid: 5932\n2026-05-28 15:59:33,827 [lib.api.process] INFO: Monitor config for process 5932: C:\\sl_8s73e\\dll\\5932.ini\n2026-05-28 15:59:33,827 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:33,938 [root] DEBUG: 3932: DLL loaded at 0x00007FFCEB2E0000: C:\\Windows\\System32\\execmodelclient (0x63000 bytes).\n2026-05-28 15:59:33,956 [root] DEBUG: 3932: DLL loaded at 0x00007FFCEF230000: C:\\Windows\\SYSTEM32\\ploptin (0x13000 bytes).\n2026-05-28 15:59:33,964 [root] DEBUG: 3932: DLL loaded at 0x00007FFCEF230000: C:\\Windows\\SYSTEM32\\ploptin (0x13000 bytes).\n2026-05-28 15:59:34,029 [lib.api.process] INFO: Potential dll side-loading detected in local directory: diagtrack.dll\n2026-05-28 15:59:34,029 [lib.api.process] INFO: Potential dll side-loading detected in local directory: wdscore.dll\n2026-05-28 15:59:34,030 [lib.api.process] INFO: Potential dll side-loading detected in local directory: pidgenx.dll\n2026-05-28 15:59:34,030 [lib.api.process] INFO: Potential dll side-loading detected in local directory: wpx.dll\n2026-05-28 15:59:34,030 [lib.api.process] INFO: 32-bit DLL to inject is C:\\sl_8s73e\\dll\\OTvgpxwO.dll, loader C:\\sl_8s73e\\bin\\UdkovOz.exe\n2026-05-28 15:59:34,035 [root] DEBUG: Loader: Injecting process 5932 (thread 4312) with C:\\sl_8s73e\\dll\\OTvgpxwO.dll.\n2026-05-28 15:59:34,036 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 15:59:34,036 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\OTvgpxwO.dll.\n2026-05-28 15:59:34,037 [lib.api.process] INFO: Injected into 32-bit <Process 5932 SetupHost.exe>\n2026-05-28 15:59:34,042 [root] DEBUG: 5448: DLL loaded at 0x74CF0000: C:\\Windows\\system32\\apphelp (0x9f000 bytes).\n2026-05-28 15:59:34,066 [root] DEBUG: 5932: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 15:59:34,066 [root] DEBUG: 5932: Interactive desktop enabled.\n2026-05-28 15:59:34,067 [root] DEBUG: 5932: Dropped file limit defaulting to 100.\n2026-05-28 15:59:34,068 [root] DEBUG: 5932: Disabling sleep skipping.\n2026-05-28 15:59:34,069 [root] DEBUG: 5932: YaraInit: Compiled rules loaded from existing file C:\\sl_8s73e\\data\\yara\\capemon.yac\n2026-05-28 15:59:34,070 [root] DEBUG: 5932: YaraScan: Scanning 0x00F20000, size 0xad57a\n2026-05-28 15:59:34,074 [root] DEBUG: 5932: Monitor initialised: 32-bit capemon loaded in process 5932 at 0x6b690000, thread 4312, image base 0xf20000, stack from 0xe34000-0xe40000\n2026-05-28 15:59:34,074 [root] DEBUG: 5932: Commandline: \"C:\\$Windows.~WS\\Sources\\SetupHost.Exe\" /Download /Web\n2026-05-28 15:59:34,090 [root] DEBUG: 5932: hook_api: LdrpCallInitRoutine export address 0x77B32B50 obtained via GetFunctionAddress\n2026-05-28 15:59:34,104 [root] DEBUG: 5932: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST\n2026-05-28 15:59:34,104 [root] DEBUG: 5932: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST\n2026-05-28 15:59:34,109 [root] DEBUG: 5932: Hooked 632 out of 632 functions\n2026-05-28 15:59:34,113 [root] DEBUG: 5932: Syscall hook installed, syscall logging level 1\n2026-05-28 15:59:34,115 [root] DEBUG: 5932: RestoreHeaders: Restored original import table.\n2026-05-28 15:59:34,116 [root] INFO: Loaded monitor into process with pid 5932\n2026-05-28 15:59:34,117 [root] DEBUG: 5932: caller_dispatch: Added region at 0x00F20000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00FAF03B, thread 4312).\n2026-05-28 15:59:34,117 [root] DEBUG: 5932: YaraScan: Scanning 0x00F20000, size 0xad57a\n2026-05-28 15:59:34,122 [root] DEBUG: 5932: ProcessImageBase: Main module image at 0x00F20000 unmodified (entropy change 0.000000e+00)\n2026-05-28 15:59:34,124 [root] DEBUG: 5932: DLL loaded at 0x74E90000: C:\\Windows\\SYSTEM32\\kernel.appcore (0xf000 bytes).\n2026-05-28 15:59:34,125 [root] DEBUG: 5932: DLL loaded at 0x76BA0000: C:\\Windows\\System32\\bcryptPrimitives (0x5f000 bytes).\n2026-05-28 15:59:34,131 [root] DEBUG: 5932: DLL loaded at 0x6AF00000: C:\\Windows\\SYSTEM32\\winbrand (0x28000 bytes).\n2026-05-28 15:59:34,134 [root] DEBUG: 5932: DLL loaded at 0x75310000: C:\\Windows\\SYSTEM32\\wldp (0x24000 bytes).\n2026-05-28 15:59:34,137 [root] DEBUG: 5932: DLL loaded at 0x6ADA0000: C:\\Windows\\system32\\dbghelp (0x188000 bytes).\n2026-05-28 15:59:34,140 [root] DEBUG: 5932: DLL loaded at 0x6AD70000: C:\\Windows\\SYSTEM32\\dbgcore (0x2b000 bytes).\n2026-05-28 15:59:34,170 [root] DEBUG: 5932: DLL loaded at 0x6AD40000: C:\\Windows\\SYSTEM32\\winbrand (0x28000 bytes).\n2026-05-28 15:59:34,173 [root] DEBUG: 5932: DLL loaded at 0x75310000: C:\\Windows\\SYSTEM32\\wldp (0x24000 bytes).\n2026-05-28 15:59:34,176 [root] DEBUG: 5932: DLL loaded at 0x6BB80000: C:\\Windows\\SYSTEM32\\sppc (0x1c000 bytes).\n2026-05-28 15:59:34,177 [root] DEBUG: 5932: DLL loaded at 0x6BBA0000: C:\\Windows\\SYSTEM32\\SLC (0x1f000 bytes).\n2026-05-28 15:59:35,175 [root] DEBUG: 5932: DLL loaded at 0x6B4D0000: C:\\Windows\\SYSTEM32\\MFC42u (0x122000 bytes).\n2026-05-28 15:59:35,176 [root] DEBUG: 5932: DLL loaded at 0x72970000: C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_a863d714867441db\\COMCTL32 (0x210000 bytes).\n2026-05-28 15:59:35,176 [root] DEBUG: 5932: DLL loaded at 0x75E20000: C:\\Windows\\System32\\COMDLG32 (0xaf000 bytes).\n2026-05-28 15:59:35,177 [root] DEBUG: 5932: DLL loaded at 0x69E70000: C:\\Windows\\SYSTEM32\\WMsgAPI (0x8000 bytes).\n2026-05-28 15:59:35,177 [root] DEBUG: 5932: DLL loaded at 0x69E30000: C:\\$Windows.~WS\\Sources\\WDSCORE (0x34000 bytes).\n2026-05-28 15:59:35,177 [root] DEBUG: 5932: DLL loaded at 0x747B0000: C:\\Windows\\SYSTEM32\\UxTheme (0x74000 bytes).\n2026-05-28 15:59:35,178 [root] DEBUG: 5932: DLL loaded at 0x69E80000: C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr (0xeec000 bytes).\n2026-05-28 15:59:35,182 [root] DEBUG: 5932: InstrumentationCallback: Added region at 0x75D5274C (base 0x75D30000) to tracked regions list (thread 4312).\n2026-05-28 15:59:35,183 [root] DEBUG: 5932: ProcessTrackedRegion: Region at 0x75D30000 mapped as \\Device\\HarddiskVolume2\\Windows\\SysWOW64\\kernel32.dll is in known range, skipping\n2026-05-28 15:59:35,195 [root] DEBUG: 5932: DLL loaded at 0x6B330000: C:\\Windows\\SYSTEM32\\USP10 (0x17000 bytes).\n2026-05-28 15:59:35,195 [root] DEBUG: 5932: DLL loaded at 0x6B2F0000: C:\\Windows\\SYSTEM32\\msls31 (0x31000 bytes).\n2026-05-28 15:59:35,196 [root] DEBUG: 5932: DLL loaded at 0x6B350000: C:\\Windows\\SYSTEM32\\RICHED20 (0x7a000 bytes).\n2026-05-28 15:59:35,196 [root] DEBUG: 5932: DLL loaded at 0x6CD10000: C:\\Windows\\SYSTEM32\\RICHED32 (0x6000 bytes).\n2026-05-28 15:59:35,291 [root] DEBUG: 5932: DLL loaded at 0x75ED0000: C:\\Windows\\System32\\WINTRUST (0x4c000 bytes).\n2026-05-28 15:59:35,292 [root] DEBUG: 5932: DLL loaded at 0x750B0000: C:\\Windows\\SYSTEM32\\NETAPI32 (0x14000 bytes).\n2026-05-28 15:59:35,293 [root] DEBUG: 5932: DLL loaded at 0x6BB80000: C:\\Windows\\SYSTEM32\\sppc (0x1c000 bytes).\n2026-05-28 15:59:35,293 [root] DEBUG: 5932: DLL loaded at 0x6BBA0000: C:\\Windows\\SYSTEM32\\SLC (0x1f000 bytes).\n2026-05-28 15:59:35,294 [root] DEBUG: 5932: DLL loaded at 0x75060000: C:\\Windows\\SYSTEM32\\WKSCLI (0x11000 bytes).\n2026-05-28 15:59:35,295 [root] DEBUG: 5932: DLL loaded at 0x75080000: C:\\Windows\\SYSTEM32\\NETUTILS (0xb000 bytes).\n2026-05-28 15:59:35,295 [root] DEBUG: 5932: DLL loaded at 0x69C10000: C:\\$Windows.~WS\\Sources\\SetupCore (0x214000 bytes).\n2026-05-28 15:59:35,296 [root] DEBUG: 5932: DLL loaded at 0x70290000: C:\\Windows\\SYSTEM32\\MSASN1 (0xe000 bytes).\n2026-05-28 15:59:35,297 [root] DEBUG: 5932: DLL loaded at 0x75BD0000: C:\\Windows\\System32\\MSCTF (0xd4000 bytes).\n2026-05-28 15:59:35,524 [root] DEBUG: 5932: DLL loaded at 0x69450000: C:\\$Windows.~WS\\Sources\\unbcl (0xce000 bytes).\n2026-05-28 15:59:35,527 [root] DEBUG: 5932: DLL loaded at 0x75F20000: C:\\Windows\\System32\\imagehlp (0x19000 bytes).\n2026-05-28 15:59:35,528 [root] DEBUG: 5932: DLL loaded at 0x70260000: C:\\Windows\\SYSTEM32\\FLTLIB (0x8000 bytes).\n2026-05-28 15:59:35,529 [root] DEBUG: 5932: DLL loaded at 0x69440000: C:\\Windows\\SYSTEM32\\VirtDisk (0xf000 bytes).\n2026-05-28 15:59:35,530 [root] DEBUG: 5932: DLL loaded at 0x74EA0000: C:\\Windows\\SYSTEM32\\profapi (0x1c000 bytes).\n2026-05-28 15:59:35,531 [root] DEBUG: 5932: DLL loaded at 0x72850000: C:\\Windows\\SYSTEM32\\XmlLite (0x2b000 bytes).\n2026-05-28 15:59:35,531 [root] DEBUG: 5932: DLL loaded at 0x69520000: C:\\$Windows.~WS\\Sources\\SetupPlatform (0x6e5000 bytes).\n2026-05-28 15:59:35,546 [root] DEBUG: 5932: DLL loaded at 0x69450000: C:\\$Windows.~WS\\Sources\\unbcl (0xce000 bytes).\n2026-05-28 15:59:35,547 [root] DEBUG: 5932: DLL loaded at 0x75F20000: C:\\Windows\\System32\\imagehlp (0x19000 bytes).\n2026-05-28 15:59:35,547 [root] DEBUG: 5932: DLL loaded at 0x70260000: C:\\Windows\\SYSTEM32\\FLTLIB (0x8000 bytes).\n2026-05-28 15:59:35,548 [root] DEBUG: 5932: DLL loaded at 0x69440000: C:\\Windows\\SYSTEM32\\VirtDisk (0xf000 bytes).\n2026-05-28 15:59:35,548 [root] DEBUG: 5932: DLL loaded at 0x74EA0000: C:\\Windows\\SYSTEM32\\profapi (0x1c000 bytes).\n2026-05-28 15:59:35,549 [root] DEBUG: 5932: DLL loaded at 0x72850000: C:\\Windows\\SYSTEM32\\XmlLite (0x2b000 bytes).\n2026-05-28 15:59:35,549 [root] DEBUG: 5932: DLL loaded at 0x69520000: C:\\$Windows.~WS\\Sources\\SetupPlatform (0x6e5000 bytes).\n2026-05-28 15:59:35,557 [lib.api.process] INFO: Monitor config for process 760: C:\\sl_8s73e\\dll\\760.ini\n2026-05-28 15:59:35,558 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:35,559 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:35,563 [root] DEBUG: Loader: Injecting process 760 with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:35,564 [root] DEBUG: 760: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 15:59:35,565 [root] DEBUG: 760: Disabling sleep skipping.\n2026-05-28 15:59:35,565 [root] DEBUG: 760: Interactive desktop enabled.\n2026-05-28 15:59:35,566 [root] DEBUG: 760: Dropped file limit defaulting to 100.\n2026-05-28 15:59:35,566 [root] DEBUG: 760: Services hook set enabled\n2026-05-28 15:59:35,568 [root] DEBUG: 760: YaraInit: Compiled rules loaded from existing file C:\\sl_8s73e\\data\\yara\\capemon.yac\n2026-05-28 15:59:35,580 [root] DEBUG: 760: RtlInsertInvertedFunctionTable 0x00007FFCFB3C090E, LdrpInvertedFunctionTableSRWLock 0x00007FFCFB51D4F0\n2026-05-28 15:59:35,580 [root] DEBUG: 760: Monitor initialised: 64-bit capemon loaded in process 760 at 0x00007FFCD8990000, thread 4660, image base 0x00007FF6CCA40000, stack from 0x0000007B63474000-0x0000007B63480000\n2026-05-28 15:59:35,580 [root] DEBUG: 760: Commandline: C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p\n2026-05-28 15:59:35,589 [root] DEBUG: 760: Hooked 69 out of 69 functions\n2026-05-28 15:59:35,589 [root] INFO: Loaded monitor into process with pid 760\n2026-05-28 15:59:35,590 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-05-28 15:59:35,590 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:35,591 [lib.api.process] INFO: Injected into 64-bit <Process 760 svchost.exe>\n2026-05-28 15:59:37,599 [lib.api.process] INFO: Monitor config for process 4344: C:\\sl_8s73e\\dll\\4344.ini\n2026-05-28 15:59:37,605 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:37,610 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:37,623 [root] DEBUG: Loader: Injecting process 4344 with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:37,627 [root] DEBUG: 4344: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 15:59:37,627 [root] DEBUG: 4344: Disabling sleep skipping.\n2026-05-28 15:59:37,627 [root] DEBUG: 4344: Interactive desktop enabled.\n2026-05-28 15:59:37,628 [root] DEBUG: 4344: Dropped file limit defaulting to 100.\n2026-05-28 15:59:37,628 [root] DEBUG: 4344: Services hook set enabled\n2026-05-28 15:59:37,630 [root] DEBUG: 4344: YaraInit: Compiled rules loaded from existing file C:\\sl_8s73e\\data\\yara\\capemon.yac\n2026-05-28 15:59:37,641 [root] DEBUG: 4344: RtlInsertInvertedFunctionTable 0x00007FFCFB3C090E, LdrpInvertedFunctionTableSRWLock 0x00007FFCFB51D4F0\n2026-05-28 15:59:37,641 [root] DEBUG: 4344: Monitor initialised: 64-bit capemon loaded in process 4344 at 0x00007FFCD8990000, thread 6220, image base 0x00007FF6CCA40000, stack from 0x000000851BAF4000-0x000000851BB00000\n2026-05-28 15:59:37,642 [root] DEBUG: 4344: Commandline: C:\\Windows\\system32\\svchost.exe -k netsvcs -p\n2026-05-28 15:59:37,650 [root] DEBUG: 4344: Hooked 69 out of 69 functions\n2026-05-28 15:59:37,650 [root] INFO: Loaded monitor into process with pid 4344\n2026-05-28 15:59:37,651 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-05-28 15:59:37,651 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:37,652 [lib.api.process] INFO: Injected into 64-bit <Process 4344 svchost.exe>\n2026-05-28 15:59:39,665 [root] DEBUG: 5932: DLL loaded at 0x75AD0000: C:\\Windows\\System32\\clbcatq (0x7e000 bytes).\n2026-05-28 15:59:39,680 [root] DEBUG: 5932: DLL loaded at 0x693C0000: C:\\Windows\\SYSTEM32\\wbemcomn (0x70000 bytes).\n2026-05-28 15:59:39,680 [root] DEBUG: 5932: DLL loaded at 0x69430000: C:\\Windows\\system32\\wbem\\wbemprox (0xd000 bytes).\n2026-05-28 15:59:39,682 [root] DEBUG: 5932: Successfully installed hook on COM Object function WbemLocator_ConnectServer\n2026-05-28 15:59:39,688 [root] DEBUG: 4344: DLL loaded at 0x00007FFCEFAB0000: C:\\Windows\\SYSTEM32\\VssTrace (0x18000 bytes).\n2026-05-28 15:59:39,688 [root] DEBUG: 4344: DLL loaded at 0x00007FFCEF6A0000: C:\\Windows\\SYSTEM32\\vssapi (0x19e000 bytes).\n2026-05-28 15:59:39,690 [root] DEBUG: 4344: DLL loaded at 0x00007FFCEFA90000: C:\\Windows\\SYSTEM32\\samcli (0x19000 bytes).\n2026-05-28 15:59:39,691 [root] DEBUG: 4344: DLL loaded at 0x00007FFCF7E90000: C:\\Windows\\SYSTEM32\\netutils (0xc000 bytes).\n2026-05-28 15:59:39,692 [root] DEBUG: 4344: DLL loaded at 0x00007FFCF5DC0000: C:\\Windows\\SYSTEM32\\SAMLIB (0x28000 bytes).\n2026-05-28 15:59:39,693 [root] DEBUG: 4344: DLL loaded at 0x00007FFCF1520000: C:\\Windows\\System32\\ES (0x6c000 bytes).\n2026-05-28 15:59:39,700 [root] DEBUG: 4344: DLL loaded at 0x00007FFCF5940000: C:\\Windows\\System32\\PROPSYS (0xf6000 bytes).\n2026-05-28 15:59:39,702 [root] DEBUG: 4344: DLL loaded at 0x00007FFCD9360000: C:\\Windows\\system32\\wbem\\FastProx (0x10b000 bytes).\n2026-05-28 15:59:39,703 [root] DEBUG: 4344: DLL loaded at 0x00007FFCE2640000: C:\\Windows\\system32\\wbem\\esscli (0x7d000 bytes).\n2026-05-28 15:59:39,703 [root] DEBUG: 4344: DLL loaded at 0x00007FFCD9470000: C:\\Windows\\system32\\wbem\\wbemcore (0x1e9000 bytes).\n2026-05-28 15:59:39,705 [root] DEBUG: 4344: DLL loaded at 0x00007FFCEF1A0000: C:\\Windows\\system32\\wbem\\wbemsvc (0x14000 bytes).\n2026-05-28 15:59:39,708 [root] DEBUG: 5932: DLL loaded at 0x693B0000: C:\\Windows\\system32\\wbem\\wbemsvc (0x10000 bytes).\n2026-05-28 15:59:39,712 [root] DEBUG: 5932: DLL loaded at 0x692E0000: C:\\Windows\\system32\\wbem\\fastprox (0xc9000 bytes).\n2026-05-28 15:59:39,714 [root] DEBUG: 4344: DLL loaded at 0x00007FFCF7830000: C:\\Windows\\system32\\authZ (0x4f000 bytes).\n2026-05-28 15:59:39,716 [root] DEBUG: 4344: DLL loaded at 0x00007FFCEADD0000: C:\\Windows\\system32\\wbem\\wmiutils (0x28000 bytes).\n2026-05-28 15:59:39,718 [root] DEBUG: 4344: DLL loaded at 0x00007FFCD92E0000: C:\\Windows\\system32\\wbem\\repdrvfs (0x71000 bytes).\n2026-05-28 15:59:39,720 [root] DEBUG: 4344: DLL loaded at 0x00007FFCF2C50000: C:\\Windows\\system32\\Wevtapi (0x65000 bytes).\n2026-05-28 15:59:39,751 [root] DEBUG: 4344: DLL loaded at 0x00007FFCFAF00000: C:\\Windows\\System32\\coml2 (0x79000 bytes).\n2026-05-28 15:59:39,762 [root] DEBUG: 4344: DLL loaded at 0x00007FFCD91D0000: C:\\Windows\\SYSTEM32\\amsi (0x1f000 bytes).\n2026-05-28 15:59:39,763 [root] DEBUG: 4344: DLL loaded at 0x00007FFCF8980000: C:\\Windows\\SYSTEM32\\USERENV (0x2e000 bytes).\n2026-05-28 15:59:39,764 [root] DEBUG: 4344: DLL loaded at 0x00007FFCF89C0000: C:\\Windows\\SYSTEM32\\profapi (0x25000 bytes).\n2026-05-28 15:59:39,765 [root] DEBUG: 4344: DLL loaded at 0x00007FFCD9180000: C:\\Program Files\\Windows Defender\\MpOav (0x44000 bytes).\n2026-05-28 15:59:39,766 [root] DEBUG: 4344: DLL loaded at 0x00007FFCE1BE0000: C:\\Windows\\system32\\version (0xa000 bytes).\n2026-05-28 15:59:39,769 [root] DEBUG: 4344: DLL loaded at 0x00007FFCE8F00000: C:\\Windows\\SYSTEM32\\NCObjAPI (0x18000 bytes).\n2026-05-28 15:59:39,770 [root] DEBUG: 4344: DLL loaded at 0x00007FFCD9200000: C:\\Windows\\system32\\wbem\\wmiprvsd (0xd7000 bytes).\n2026-05-28 15:59:39,773 [root] DEBUG: 4344: DLL loaded at 0x00007FFCD90F0000: C:\\Windows\\system32\\wbem\\wbemess (0x83000 bytes).\n2026-05-28 15:59:39,774 [root] DEBUG: 4344: DLL loaded at 0x00007FFCF8350000: C:\\Windows\\SYSTEM32\\cryptsp (0x18000 bytes).\n2026-05-28 15:59:39,775 [root] DEBUG: 4344: DLL loaded at 0x00007FFCF7A90000: C:\\Windows\\system32\\rsaenh (0x34000 bytes).\n2026-05-28 15:59:39,786 [root] DEBUG: 5932: DLL loaded at 0x692C0000: C:\\Windows\\SYSTEM32\\amsi (0x18000 bytes).\n2026-05-28 15:59:39,787 [root] DEBUG: 5932: DLL loaded at 0x74830000: C:\\Windows\\SYSTEM32\\USERENV (0x25000 bytes).\n2026-05-28 15:59:39,791 [root] DEBUG: 5932: DLL loaded at 0x69280000: C:\\Program Files (x86)\\Windows Defender\\MpOav (0x38000 bytes).\n2026-05-28 15:59:39,792 [root] DEBUG: 5932: Successfully installed hook on COM Object function IWbemServices_ExecQuery\n2026-05-28 15:59:39,793 [root] DEBUG: 5932: Successfully installed hook on COM Object function IWbemServices_ExecQueryAsync\n2026-05-28 15:59:39,793 [root] DEBUG: 5932: Successfully installed hook on COM Object function IWbemServices_CreateInstanceEnum\n2026-05-28 15:59:39,794 [root] DEBUG: 5932: Successfully installed hook on COM Object function IWbemServices_CreateInstanceEnumAsync\n2026-05-28 15:59:39,794 [root] DEBUG: 5932: Successfully installed hook on COM Object function IWbemServices_GetObjectW\n2026-05-28 15:59:39,794 [root] DEBUG: 5932: Successfully installed hook on COM Object function IWbemServices_GetObjectAsync\n2026-05-28 15:59:39,795 [root] DEBUG: 5932: Successfully installed hook on COM Object function IWbemServices_ExecMethod\n2026-05-28 15:59:39,795 [root] DEBUG: 5932: Successfully installed hook on COM Object function IWbemServices_ExecMethodAsync\n2026-05-28 15:59:39,812 [root] DEBUG: 760: CreateProcessHandler: Injection info set for new process 6648: C:\\Windows\\system32\\wbem\\wmiprvse.exe, ImageBase: 0x00007FF61B150000\n2026-05-28 15:59:39,812 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 6648\n2026-05-28 15:59:39,813 [lib.api.process] INFO: Monitor config for process 6648: C:\\sl_8s73e\\dll\\6648.ini\n2026-05-28 15:59:39,813 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:39,882 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:39,888 [root] DEBUG: Loader: Injecting process 6648 (thread 6652) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:39,888 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 15:59:39,889 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:39,890 [lib.api.process] INFO: Injected into 64-bit <Process 6648 WmiPrvSE.exe>\n2026-05-28 15:59:39,891 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 6648\n2026-05-28 15:59:39,892 [lib.api.process] INFO: Monitor config for process 6648: C:\\sl_8s73e\\dll\\6648.ini\n2026-05-28 15:59:39,892 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:39,971 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:39,976 [root] DEBUG: Loader: Injecting process 6648 (thread 6652) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:39,977 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 15:59:39,977 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:39,978 [lib.api.process] INFO: Injected into 64-bit <Process 6648 WmiPrvSE.exe>\n2026-05-28 15:59:39,983 [root] DEBUG: 6648: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 15:59:39,984 [root] DEBUG: 6648: Interactive desktop enabled.\n2026-05-28 15:59:39,984 [root] DEBUG: 6648: Dropped file limit defaulting to 100.\n2026-05-28 15:59:39,985 [root] DEBUG: 6648: Disabling sleep skipping.\n2026-05-28 15:59:39,985 [root] DEBUG: 6648: Services hook set enabled\n2026-05-28 15:59:39,987 [root] DEBUG: 6648: YaraInit: Compiled rules loaded from existing file C:\\sl_8s73e\\data\\yara\\capemon.yac\n2026-05-28 15:59:39,998 [root] DEBUG: 6648: RtlInsertInvertedFunctionTable 0x00007FFCFB3C090E, LdrpInvertedFunctionTableSRWLock 0x00007FFCFB51D4F0\n2026-05-28 15:59:39,998 [root] DEBUG: 6648: Monitor initialised: 64-bit capemon loaded in process 6648 at 0x00007FFCD8990000, thread 6652, image base 0x00007FF61B150000, stack from 0x0000005F4F780000-0x0000005F4F790000\n2026-05-28 15:59:39,999 [root] DEBUG: 6648: Commandline: C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding\n2026-05-28 15:59:40,007 [root] DEBUG: 6648: Hooked 69 out of 69 functions\n2026-05-28 15:59:40,010 [root] DEBUG: 6648: RestoreHeaders: Restored original import table.\n2026-05-28 15:59:40,010 [root] INFO: Loaded monitor into process with pid 6648\n2026-05-28 15:59:40,013 [root] DEBUG: 6648: DLL loaded at 0x00007FFCF6970000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 15:59:40,013 [root] DEBUG: 6648: DLL loaded at 0x00007FFCF8D60000: C:\\Windows\\System32\\bcryptPrimitives (0x82000 bytes).\n2026-05-28 15:59:40,015 [root] DEBUG: 6648: DLL loaded at 0x00007FFCFAB10000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 15:59:40,016 [root] DEBUG: 6648: DLL loaded at 0x00007FFCE8EE0000: C:\\Windows\\system32\\wbem\\wbemprox (0x11000 bytes).\n2026-05-28 15:59:40,018 [root] DEBUG: 6648: DLL loaded at 0x00007FFCEF1A0000: C:\\Windows\\system32\\wbem\\wbemsvc (0x14000 bytes).\n2026-05-28 15:59:40,024 [root] DEBUG: 6648: DLL loaded at 0x00007FFCEADD0000: C:\\Windows\\system32\\wbem\\wmiutils (0x28000 bytes).\n2026-05-28 15:59:40,029 [root] DEBUG: 6648: DLL loaded at 0x00007FFCF88F0000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-28 15:59:40,030 [root] DEBUG: 6648: DLL loaded at 0x00007FFCD8E80000: C:\\Windows\\SYSTEM32\\framedynos (0x52000 bytes).\n2026-05-28 15:59:40,030 [root] DEBUG: 6648: DLL loaded at 0x00007FFCD8EE0000: C:\\Windows\\system32\\wbem\\cimwin32 (0x20c000 bytes).\n2026-05-28 15:59:40,031 [root] DEBUG: 6648: DLL loaded at 0x00007FFCF88D0000: C:\\Windows\\SYSTEM32\\UMPDC (0x12000 bytes).\n2026-05-28 15:59:40,041 [root] DEBUG: 6648: DLL loaded at 0x00007FFCF5DF0000: C:\\Windows\\SYSTEM32\\wtsapi32 (0x14000 bytes).\n2026-05-28 15:59:40,042 [root] DEBUG: 6648: DLL loaded at 0x00007FFCF87C0000: C:\\Windows\\SYSTEM32\\WINSTA (0x5b000 bytes).\n2026-05-28 15:59:40,044 [root] DEBUG: 6648: DLL loaded at 0x00007FFCF93C0000: C:\\Windows\\System32\\cfgmgr32 (0x4e000 bytes).\n2026-05-28 15:59:40,045 [root] DEBUG: 6648: DLL loaded at 0x00007FFCF85A0000: C:\\Windows\\SYSTEM32\\DEVOBJ (0x33000 bytes).\n2026-05-28 15:59:40,046 [root] DEBUG: 6648: DLL loaded at 0x000001691E370000: C:\\Windows\\SYSTEM32\\WMI (0x3000 bytes).\n2026-05-28 15:59:40,046 [root] DEBUG: 6648: DLL loaded at 0x00007FFCF2F60000: C:\\Windows\\SYSTEM32\\wmiclnt (0x11000 bytes).\n2026-05-28 15:59:40,047 [root] DEBUG: 6648: CreateThreadBreakpoints: Failed to open thread and get a handle.\n2026-05-28 15:59:40,048 [root] DEBUG: 6648: DLL loaded at 0x00007FFCE8C90000: C:\\Windows\\SYSTEM32\\NETAPI32 (0x19000 bytes).\n2026-05-28 15:59:40,049 [root] DEBUG: 6648: DLL loaded at 0x00007FFCEFA90000: C:\\Windows\\SYSTEM32\\SAMCLI (0x19000 bytes).\n2026-05-28 15:59:40,049 [root] DEBUG: 6648: DLL loaded at 0x00007FFCEE910000: C:\\Windows\\SYSTEM32\\SRVCLI (0x28000 bytes).\n2026-05-28 15:59:40,050 [root] DEBUG: 6648: DLL loaded at 0x00007FFCF7E90000: C:\\Windows\\SYSTEM32\\NETUTILS (0xc000 bytes).\n2026-05-28 15:59:40,051 [root] DEBUG: 6648: DLL loaded at 0x00007FFCF7F70000: C:\\Windows\\SYSTEM32\\LOGONCLI (0x43000 bytes).\n2026-05-28 15:59:40,053 [root] DEBUG: 6648: DLL loaded at 0x00007FFCE8ED0000: C:\\Windows\\SYSTEM32\\SCHEDCLI (0xc000 bytes).\n2026-05-28 15:59:40,053 [root] DEBUG: 6648: DLL loaded at 0x00007FFCF7BF0000: C:\\Windows\\SYSTEM32\\WKSCLI (0x19000 bytes).\n2026-05-28 15:59:40,054 [root] DEBUG: 6648: DLL loaded at 0x00007FFCF6520000: C:\\Windows\\SYSTEM32\\DSROLE (0xa000 bytes).\n2026-05-28 15:59:40,143 [root] DEBUG: 5932: DLL loaded at 0x74EE0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x65000 bytes).\n2026-05-28 15:59:40,144 [root] DEBUG: 5932: DLL loaded at 0x691F0000: C:\\Windows\\SYSTEM32\\policymanager (0x83000 bytes).\n2026-05-28 15:59:40,175 [root] DEBUG: 760: CreateProcessHandler: Injection info set for new process 6204: C:\\Windows\\System32\\vdsldr.exe, ImageBase: 0x00007FF733AA0000\n2026-05-28 15:59:40,177 [root] INFO: Announced 64-bit process name: vdsldr.exe pid: 6204\n2026-05-28 15:59:40,178 [lib.api.process] INFO: Monitor config for process 6204: C:\\sl_8s73e\\dll\\6204.ini\n2026-05-28 15:59:40,180 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:40,181 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:40,186 [root] DEBUG: Loader: Injecting process 6204 (thread 6200) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:40,187 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 15:59:40,187 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:40,188 [lib.api.process] INFO: Injected into 64-bit <Process 6204 vdsldr.exe>\n2026-05-28 15:59:40,189 [root] INFO: Announced 64-bit process name: vdsldr.exe pid: 6204\n2026-05-28 15:59:40,189 [lib.api.process] INFO: Monitor config for process 6204: C:\\sl_8s73e\\dll\\6204.ini\n2026-05-28 15:59:40,189 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:40,190 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:40,194 [root] DEBUG: Loader: Injecting process 6204 (thread 6200) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:40,194 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 15:59:40,195 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:40,196 [lib.api.process] INFO: Injected into 64-bit <Process 6204 vdsldr.exe>\n2026-05-28 15:59:40,202 [root] DEBUG: 6204: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 15:59:40,202 [root] DEBUG: 6204: Interactive desktop enabled.\n2026-05-28 15:59:40,203 [root] DEBUG: 6204: Dropped file limit defaulting to 100.\n2026-05-28 15:59:40,204 [root] DEBUG: 6204: Disabling sleep skipping.\n2026-05-28 15:59:40,205 [root] DEBUG: 6204: YaraInit: Compiled rules loaded from existing file C:\\sl_8s73e\\data\\yara\\capemon.yac\n2026-05-28 15:59:40,216 [root] DEBUG: 6204: RtlInsertInvertedFunctionTable 0x00007FFCFB3C090E, LdrpInvertedFunctionTableSRWLock 0x00007FFCFB51D4F0\n2026-05-28 15:59:40,216 [root] DEBUG: 6204: YaraScan: Scanning 0x00007FF733AA0000, size 0xa0c6\n2026-05-28 15:59:40,217 [root] DEBUG: 6204: Monitor initialised: 64-bit capemon loaded in process 6204 at 0x00007FFCD8990000, thread 6200, image base 0x00007FF733AA0000, stack from 0x000000C655124000-0x000000C655130000\n2026-05-28 15:59:40,218 [root] DEBUG: 6204: Commandline: C:\\Windows\\System32\\vdsldr.exe -Embedding\n2026-05-28 15:59:40,225 [root] DEBUG: 6204: hook_api: LdrpCallInitRoutine export address 0x00007FFCFB3C99BC obtained via GetFunctionAddress\n2026-05-28 15:59:40,246 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-05-28 15:59:40,246 [root] DEBUG: 6204: set_hooks: Unable to hook LockResource\n2026-05-28 15:59:40,251 [root] DEBUG: 6204: Hooked 627 out of 628 functions\n2026-05-28 15:59:40,252 [root] DEBUG: 6204: Syscall hook installed, syscall logging level 1\n2026-05-28 15:59:40,256 [root] DEBUG: 6204: RestoreHeaders: Restored original import table.\n2026-05-28 15:59:40,256 [root] INFO: Loaded monitor into process with pid 6204\n2026-05-28 15:59:40,258 [root] DEBUG: 6204: caller_dispatch: Added region at 0x00007FF733AA0000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF733AA3D41, thread 6200).\n2026-05-28 15:59:40,258 [root] DEBUG: 6204: YaraScan: Scanning 0x00007FF733AA0000, size 0xa0c6\n2026-05-28 15:59:40,259 [root] DEBUG: 6204: ProcessImageBase: Main module image at 0x00007FF733AA0000 unmodified (entropy change 0.000000e+00)\n2026-05-28 15:59:40,262 [root] DEBUG: 6204: DLL loaded at 0x00007FFCF6970000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 15:59:40,263 [root] DEBUG: 6204: DLL loaded at 0x00007FFCF8D60000: C:\\Windows\\System32\\bcryptPrimitives (0x82000 bytes).\n2026-05-28 15:59:40,267 [root] DEBUG: 6204: DLL loaded at 0x00007FFCFAB10000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 15:59:40,283 [root] DEBUG: 6204: DLL loaded at 0x00007FFCD8E00000: C:\\Windows\\System32\\vds_ps (0x20000 bytes).\n2026-05-28 15:59:40,287 [root] DEBUG: 5932: DLL loaded at 0x69270000: C:\\Windows\\System32\\vds_ps (0x10000 bytes).\n2026-05-28 15:59:40,369 [root] INFO: Added new file to list with pid 5932 and path C:\\$WINDOWS.~BT\\Sources\\Panther\\setuperr.log\n2026-05-28 15:59:40,374 [root] INFO: Added new file to list with pid 5932 and path C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml\n2026-05-28 15:59:40,378 [root] INFO: Added new file to list with pid 5932 and path C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml\n2026-05-28 15:59:40,381 [root] INFO: Added new file to list with pid 5932 and path C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log\n2026-05-28 15:59:40,388 [root] DEBUG: 5932: DLL loaded at 0x74EE0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x65000 bytes).\n2026-05-28 15:59:40,388 [root] DEBUG: 5932: DLL loaded at 0x69B80000: C:\\Windows\\SYSTEM32\\policymanager (0x83000 bytes).\n2026-05-28 15:59:40,398 [root] DEBUG: 5932: DLL loaded at 0x6E670000: C:\\Windows\\system32\\OnDemandConnRouteHelper (0x12000 bytes).\n2026-05-28 15:59:40,400 [root] DEBUG: 5932: DLL loaded at 0x74E40000: C:\\Windows\\SYSTEM32\\WINSTA (0x47000 bytes).\n2026-05-28 15:59:40,402 [root] DEBUG: 5932: DLL loaded at 0x74370000: C:\\Windows\\SYSTEM32\\IPHLPAPI (0x32000 bytes).\n2026-05-28 15:59:40,403 [root] DEBUG: 5932: DLL loaded at 0x75D20000: C:\\Windows\\System32\\NSI (0x7000 bytes).\n2026-05-28 15:59:40,404 [root] DEBUG: 5932: DLL loaded at 0x6BE40000: C:\\Windows\\SYSTEM32\\dhcpcsvc6 (0x14000 bytes).\n2026-05-28 15:59:40,406 [root] DEBUG: 5932: DLL loaded at 0x74350000: C:\\Windows\\SYSTEM32\\dhcpcsvc (0x16000 bytes).\n2026-05-28 15:59:40,408 [root] DEBUG: 5932: DLL loaded at 0x69B90000: C:\\Windows\\SYSTEM32\\webio (0x73000 bytes).\n2026-05-28 15:59:40,409 [root] DEBUG: 5932: DLL loaded at 0x6E610000: C:\\Windows\\system32\\mswsock (0x52000 bytes).\n2026-05-28 15:59:40,411 [root] DEBUG: 5932: DLL loaded at 0x6E5B0000: C:\\Windows\\SYSTEM32\\WINNSI (0x8000 bytes).\n2026-05-28 15:59:40,419 [root] DEBUG: 5932: DLL loaded at 0x703A0000: C:\\Windows\\SYSTEM32\\DNSAPI (0x90000 bytes).\n2026-05-28 15:59:40,421 [root] DEBUG: 5932: DLL loaded at 0x6D2A0000: C:\\Windows\\System32\\rasadhlp (0x8000 bytes).\n2026-05-28 15:59:40,452 [root] DEBUG: 5932: DLL loaded at 0x6D200000: C:\\Windows\\System32\\fwpuclnt (0x58000 bytes).\n2026-05-28 15:59:40,658 [root] DEBUG: 5932: DLL loaded at 0x6D180000: C:\\Windows\\System32\\schannel (0x7c000 bytes).\n2026-05-28 15:59:41,070 [root] DEBUG: 5932: DLL loaded at 0x6D170000: C:\\Windows\\SYSTEM32\\mskeyprotect (0x10000 bytes).\n2026-05-28 15:59:41,074 [root] DEBUG: 5932: DLL loaded at 0x702E0000: C:\\Windows\\SYSTEM32\\NTASN1 (0x28000 bytes).\n2026-05-28 15:59:41,083 [root] DEBUG: 5932: DLL loaded at 0x70DD0000: C:\\Windows\\SYSTEM32\\ncrypt (0x21000 bytes).\n2026-05-28 15:59:41,086 [root] DEBUG: 5932: DLL loaded at 0x6D120000: C:\\Windows\\system32\\ncryptsslp (0x1f000 bytes).\n2026-05-28 15:59:41,304 [root] DEBUG: 5932: DLL loaded at 0x6E510000: C:\\Windows\\SYSTEM32\\DPAPI (0x8000 bytes).\n2026-05-28 15:59:41,313 [root] DEBUG: 5932: DLL loaded at 0x75F20000: C:\\Windows\\System32\\imagehlp (0x19000 bytes).\n2026-05-28 15:59:41,313 [root] DEBUG: 5932: DLL loaded at 0x699B0000: C:\\$Windows.~WS\\Sources\\WINDLP (0x11e000 bytes).\n2026-05-28 15:59:41,314 [root] DEBUG: 5932: DLL loaded at 0x69AD0000: C:\\$Windows.~WS\\Sources\\SetupMgr (0xbb000 bytes).\n2026-05-28 15:59:41,333 [root] DEBUG: 5932: DLL loaded at 0x6F4E0000: C:\\Windows\\SYSTEM32\\ntmarta (0x29000 bytes).\n2026-05-28 15:59:41,334 [root] INFO: Added new file to list with pid 5932 and path C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml\n2026-05-28 15:59:41,336 [root] INFO: Added new file to list with pid 5932 and path C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml\n2026-05-28 15:59:41,372 [root] DEBUG: 5932: DLL loaded at 0x6E670000: C:\\Windows\\system32\\OnDemandConnRouteHelper (0x12000 bytes).\n2026-05-28 15:59:42,184 [root] INFO: Added new file to list with pid 5932 and path C:\\$Windows.~WS\\Sources\\products.cab\n2026-05-28 15:59:42,189 [root] DEBUG: 5932: DLL loaded at 0x69990000: C:\\Windows\\SYSTEM32\\DEVRTL (0x12000 bytes).\n2026-05-28 15:59:42,220 [root] INFO: Added new file to list with pid 5932 and path C:\\$Windows.~WS\\Sources\\products.xml\n2026-05-28 15:59:42,235 [root] DEBUG: 5932: DLL loaded at 0x6B250000: C:\\Windows\\SYSTEM32\\TextShaping (0x95000 bytes).\n2026-05-28 15:59:42,243 [root] DEBUG: 5932: DLL loaded at 0x6BE60000: C:\\Windows\\system32\\windowscodecs (0x171000 bytes).\n2026-05-28 15:59:42,262 [root] DEBUG: 5932: api-rate-cap: NtQueryKey hook disabled due to rate\n2026-05-28 15:59:42,280 [root] DEBUG: 5932: DLL loaded at 0x6F510000: C:\\Windows\\System32\\CoreMessaging (0x9b000 bytes).\n2026-05-28 15:59:42,281 [root] DEBUG: 5932: DLL loaded at 0x6FAC0000: C:\\Windows\\SYSTEM32\\wintypes (0xdc000 bytes).\n2026-05-28 15:59:42,282 [root] DEBUG: 5932: DLL loaded at 0x6F6A0000: C:\\Windows\\System32\\CoreUIComponents (0x27f000 bytes).\n2026-05-28 15:59:42,283 [root] DEBUG: 5932: DLL loaded at 0x6FBA0000: C:\\Windows\\SYSTEM32\\textinputframework (0xb9000 bytes).\n2026-05-28 15:59:42,302 [root] DEBUG: 5932: DLL loaded at 0x69930000: C:\\Windows\\System32\\oleacc (0x53000 bytes).\n2026-05-28 15:59:42,955 [root] DEBUG: 760: CreateProcessHandler: Injection info set for new process 7588: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF6B1C80000\n2026-05-28 15:59:42,961 [root] DEBUG: 760: CreateProcessHandler: Injection info set for new process 7624: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF6B1C80000\n2026-05-28 15:59:42,967 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7588\n2026-05-28 15:59:42,968 [lib.api.process] INFO: Monitor config for process 7588: C:\\sl_8s73e\\dll\\7588.ini\n2026-05-28 15:59:42,969 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7624\n2026-05-28 15:59:42,970 [lib.api.process] INFO: Monitor config for process 7624: C:\\sl_8s73e\\dll\\7624.ini\n2026-05-28 15:59:42,973 [root] DEBUG: 760: CreateProcessHandler: Injection info set for new process 7668: C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\\SkypeApp.exe, ImageBase: 0x00007FF66B1C0000\n2026-05-28 15:59:42,973 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:42,973 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:42,976 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:42,976 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:42,981 [root] INFO: Announced 64-bit process name: SkypeApp.exe pid: 7668\n2026-05-28 15:59:42,982 [lib.api.process] INFO: Monitor config for process 7668: C:\\sl_8s73e\\dll\\7668.ini\n2026-05-28 15:59:42,982 [root] DEBUG: Loader: Injecting process 7624 (thread 7628) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:42,983 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:42,983 [root] DEBUG: Loader: Injecting process 7588 (thread 7592) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:42,985 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 15:59:43,052 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 15:59:43,057 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,056 [lib.api.process] INFO: Potential dll side-loading detected in local directory: rtmcodecs.dll\n2026-05-28 15:59:43,058 [lib.api.process] INFO: Potential dll side-loading detected in local directory: rtmpal.dll\n2026-05-28 15:59:43,058 [lib.api.process] INFO: Potential dll side-loading detected in local directory: rtmpltfm.dll\n2026-05-28 15:59:43,059 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,060 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,061 [lib.api.process] INFO: Injected into 64-bit <Process 7624 backgroundTaskHost.exe>\n2026-05-28 15:59:43,066 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7624\n2026-05-28 15:59:43,067 [lib.api.process] INFO: Injected into 64-bit <Process 7588 backgroundTaskHost.exe>\n2026-05-28 15:59:43,068 [lib.api.process] INFO: Monitor config for process 7624: C:\\sl_8s73e\\dll\\7624.ini\n2026-05-28 15:59:43,069 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,070 [root] DEBUG: Loader: Injecting process 7668 (thread 7672) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,070 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,072 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7588\n2026-05-28 15:59:43,075 [lib.api.process] INFO: Monitor config for process 7588: C:\\sl_8s73e\\dll\\7588.ini\n2026-05-28 15:59:43,075 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 15:59:43,076 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,076 [root] DEBUG: Loader: Injecting process 7624 (thread 7628) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,077 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,078 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,079 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 15:59:43,082 [lib.api.process] INFO: Injected into 64-bit <Process 7668 SkypeApp.exe>\n2026-05-28 15:59:43,084 [root] DEBUG: Loader: Injecting process 7588 (thread 7592) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,085 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,085 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 15:59:43,086 [root] INFO: Announced 64-bit process name: SkypeApp.exe pid: 7668\n2026-05-28 15:59:43,086 [lib.api.process] INFO: Monitor config for process 7668: C:\\sl_8s73e\\dll\\7668.ini\n2026-05-28 15:59:43,087 [lib.api.process] INFO: Injected into 64-bit <Process 7624 backgroundTaskHost.exe>\n2026-05-28 15:59:43,087 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,088 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,129 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7624\n2026-05-28 15:59:43,129 [lib.api.process] INFO: Injected into 64-bit <Process 7588 backgroundTaskHost.exe>\n2026-05-28 15:59:43,158 [lib.api.process] INFO: Potential dll side-loading detected in local directory: rtmcodecs.dll\n2026-05-28 15:59:43,159 [lib.api.process] INFO: Potential dll side-loading detected in local directory: rtmpal.dll\n2026-05-28 15:59:43,158 [lib.api.process] INFO: Monitor config for process 7624: C:\\sl_8s73e\\dll\\7624.ini\n2026-05-28 15:59:43,159 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,160 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7588\n2026-05-28 15:59:43,160 [lib.api.process] INFO: Monitor config for process 7588: C:\\sl_8s73e\\dll\\7588.ini\n2026-05-28 15:59:43,161 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,159 [lib.api.process] INFO: Potential dll side-loading detected in local directory: rtmpltfm.dll\n2026-05-28 15:59:43,161 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,163 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,163 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,171 [root] DEBUG: Loader: Injecting process 7624 with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,172 [root] DEBUG: Loader: Injecting process 7668 (thread 7672) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,172 [root] DEBUG: Loader: Injecting process 7588 with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,173 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 7628, handle 0xb4\n2026-05-28 15:59:43,173 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 15:59:43,174 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 7592, handle 0x124\n2026-05-28 15:59:43,174 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,175 [lib.api.process] INFO: Injected into 64-bit <Process 7668 SkypeApp.exe>\n2026-05-28 15:59:43,177 [root] INFO: Announced 64-bit process name: SkypeApp.exe pid: 7668\n2026-05-28 15:59:43,178 [lib.api.process] INFO: Monitor config for process 7668: C:\\sl_8s73e\\dll\\7668.ini\n2026-05-28 15:59:43,178 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,247 [lib.api.process] INFO: Potential dll side-loading detected in local directory: rtmcodecs.dll\n2026-05-28 15:59:43,248 [lib.api.process] INFO: Potential dll side-loading detected in local directory: rtmpal.dll\n2026-05-28 15:59:43,248 [lib.api.process] INFO: Potential dll side-loading detected in local directory: rtmpltfm.dll\n2026-05-28 15:59:43,249 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,254 [root] DEBUG: Loader: Injecting process 7668 with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,255 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 7672, handle 0x124\n2026-05-28 15:59:43,260 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 15:59:43,261 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 15:59:43,261 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,262 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,264 [lib.api.process] INFO: Injected into 64-bit <Process 7624 backgroundTaskHost.exe>\n2026-05-28 15:59:43,265 [lib.api.process] INFO: Injected into 64-bit <Process 7588 backgroundTaskHost.exe>\n2026-05-28 15:59:43,266 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 15:59:43,267 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,268 [lib.api.process] INFO: Injected into 64-bit <Process 7668 SkypeApp.exe>\n2026-05-28 15:59:43,284 [root] DEBUG: 760: CreateProcessHandler: Injection info set for new process 8020: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF6B1C80000\n2026-05-28 15:59:43,285 [root] DEBUG: 760: CreateProcessHandler: Injection info set for new process 8020: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF6B1C80000\n2026-05-28 15:59:43,293 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8028\n2026-05-28 15:59:43,293 [lib.api.process] INFO: Monitor config for process 8028: C:\\sl_8s73e\\dll\\8028.ini\n2026-05-28 15:59:43,294 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8020\n2026-05-28 15:59:43,295 [lib.api.process] INFO: Monitor config for process 8020: C:\\sl_8s73e\\dll\\8020.ini\n2026-05-28 15:59:43,301 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,301 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,348 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,348 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,350 [root] DEBUG: 760: CreateProcessHandler: Injection info set for new process 8092: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF6B1C80000\n2026-05-28 15:59:43,355 [root] DEBUG: 760: CreateProcessHandler: Injection info set for new process 8092: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF6B1C80000\n2026-05-28 15:59:43,356 [root] DEBUG: Loader: Injecting process 8028 (thread 8032) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,357 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8100\n2026-05-28 15:59:43,357 [lib.api.process] INFO: Monitor config for process 8100: C:\\sl_8s73e\\dll\\8100.ini\n2026-05-28 15:59:43,357 [root] DEBUG: Loader: Injecting process 8020 (thread 8024) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,358 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 15:59:43,358 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,359 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 15:59:43,360 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,361 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,365 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,366 [lib.api.process] INFO: Injected into 64-bit <Process 8028 backgroundTaskHost.exe>\n2026-05-28 15:59:43,367 [root] DEBUG: Loader: Injecting process 8100 (thread 8104) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,368 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8092\n2026-05-28 15:59:43,369 [lib.api.process] INFO: Injected into 64-bit <Process 8020 backgroundTaskHost.exe>\n2026-05-28 15:59:43,370 [lib.api.process] INFO: Monitor config for process 8092: C:\\sl_8s73e\\dll\\8092.ini\n2026-05-28 15:59:43,370 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 15:59:43,371 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,372 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8028\n2026-05-28 15:59:43,372 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,373 [lib.api.process] INFO: Monitor config for process 8028: C:\\sl_8s73e\\dll\\8028.ini\n2026-05-28 15:59:43,374 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,375 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,377 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,377 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8020\n2026-05-28 15:59:43,378 [lib.api.process] INFO: Monitor config for process 8020: C:\\sl_8s73e\\dll\\8020.ini\n2026-05-28 15:59:43,378 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,379 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,383 [lib.api.process] INFO: Injected into 64-bit <Process 8100 backgroundTaskHost.exe>\n2026-05-28 15:59:43,383 [root] DEBUG: Loader: Injecting process 8092 (thread 8096) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,385 [root] DEBUG: Loader: Injecting process 8028 (thread 8032) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,386 [root] DEBUG: Loader: Injecting process 8020 (thread 8024) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,386 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 15:59:43,387 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 15:59:43,387 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 15:59:43,388 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,388 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8100\n2026-05-28 15:59:43,389 [lib.api.process] INFO: Monitor config for process 8100: C:\\sl_8s73e\\dll\\8100.ini\n2026-05-28 15:59:43,389 [lib.api.process] INFO: Injected into 64-bit <Process 8092 backgroundTaskHost.exe>\n2026-05-28 15:59:43,389 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,390 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,391 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,391 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,392 [lib.api.process] INFO: Injected into 64-bit <Process 8028 backgroundTaskHost.exe>\n2026-05-28 15:59:43,394 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8092\n2026-05-28 15:59:43,396 [lib.api.process] INFO: Monitor config for process 8092: C:\\sl_8s73e\\dll\\8092.ini\n2026-05-28 15:59:43,398 [lib.api.process] INFO: Injected into 64-bit <Process 8020 backgroundTaskHost.exe>\n2026-05-28 15:59:43,399 [root] INFO: Process with pid 8028 has terminated\n2026-05-28 15:59:43,400 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,401 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,401 [root] DEBUG: Loader: Injecting process 8100 (thread 8104) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,403 [root] INFO: Process with pid 8020 has terminated\n2026-05-28 15:59:43,416 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 15:59:43,418 [root] DEBUG: Loader: Injecting process 8092 (thread 8096) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,418 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,419 [root] DEBUG: 760: CreateProcessHandler: Injection info set for new process 7584: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF6B1C80000\n2026-05-28 15:59:43,420 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 15:59:43,421 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7584\n2026-05-28 15:59:43,421 [lib.api.process] INFO: Injected into 64-bit <Process 8100 backgroundTaskHost.exe>\n2026-05-28 15:59:43,421 [lib.api.process] INFO: Monitor config for process 7584: C:\\sl_8s73e\\dll\\7584.ini\n2026-05-28 15:59:43,422 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,423 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,423 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8100\n2026-05-28 15:59:43,423 [lib.api.process] INFO: Monitor config for process 8100: C:\\sl_8s73e\\dll\\8100.ini\n2026-05-28 15:59:43,424 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,424 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,425 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,431 [lib.api.process] INFO: Injected into 64-bit <Process 8092 backgroundTaskHost.exe>\n2026-05-28 15:59:43,432 [root] DEBUG: Loader: Injecting process 7584 (thread 7576) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,433 [root] DEBUG: Loader: Injecting process 8100 with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,433 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 15:59:43,434 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 8104, handle 0x120\n2026-05-28 15:59:43,434 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,435 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8092\n2026-05-28 15:59:43,435 [lib.api.process] INFO: Monitor config for process 8092: C:\\sl_8s73e\\dll\\8092.ini\n2026-05-28 15:59:43,436 [lib.api.process] INFO: Injected into 64-bit <Process 7584 backgroundTaskHost.exe>\n2026-05-28 15:59:43,436 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,437 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,438 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7584\n2026-05-28 15:59:43,440 [lib.api.process] INFO: Monitor config for process 7584: C:\\sl_8s73e\\dll\\7584.ini\n2026-05-28 15:59:43,441 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,443 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,443 [root] DEBUG: Loader: Injecting process 8092 with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,445 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 8096, handle 0x124\n2026-05-28 15:59:43,448 [root] DEBUG: Loader: Injecting process 7584 (thread 7576) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,448 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 15:59:43,449 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,450 [lib.api.process] INFO: Injected into 64-bit <Process 7584 backgroundTaskHost.exe>\n2026-05-28 15:59:43,451 [root] INFO: Process with pid 7584 has terminated\n2026-05-28 15:59:43,455 [root] DEBUG: 760: CreateProcessHandler: Injection info set for new process 7608: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF6B1C80000\n2026-05-28 15:59:43,455 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7608\n2026-05-28 15:59:43,456 [lib.api.process] INFO: Monitor config for process 7608: C:\\sl_8s73e\\dll\\7608.ini\n2026-05-28 15:59:43,457 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,457 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,462 [root] DEBUG: Loader: Injecting process 7608 (thread 8024) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,463 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 15:59:43,463 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,465 [lib.api.process] INFO: Injected into 64-bit <Process 7608 backgroundTaskHost.exe>\n2026-05-28 15:59:43,466 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7608\n2026-05-28 15:59:43,466 [lib.api.process] INFO: Monitor config for process 7608: C:\\sl_8s73e\\dll\\7608.ini\n2026-05-28 15:59:43,467 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,467 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,471 [root] DEBUG: Loader: Injecting process 7608 (thread 8024) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,472 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 15:59:43,472 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,475 [lib.api.process] INFO: Injected into 64-bit <Process 7608 backgroundTaskHost.exe>\n2026-05-28 15:59:43,475 [root] INFO: Process with pid 7608 has terminated\n2026-05-28 15:59:43,479 [root] DEBUG: 760: CreateProcessHandler: Injection info set for new process 8268: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF6B1C80000\n2026-05-28 15:59:43,480 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8268\n2026-05-28 15:59:43,480 [lib.api.process] INFO: Monitor config for process 8268: C:\\sl_8s73e\\dll\\8268.ini\n2026-05-28 15:59:43,481 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,482 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,486 [root] DEBUG: Loader: Injecting process 8268 (thread 8272) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,486 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 15:59:43,487 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,488 [lib.api.process] INFO: Injected into 64-bit <Process 8268 backgroundTaskHost.exe>\n2026-05-28 15:59:43,490 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8268\n2026-05-28 15:59:43,491 [lib.api.process] INFO: Monitor config for process 8268: C:\\sl_8s73e\\dll\\8268.ini\n2026-05-28 15:59:43,491 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 15:59:43,492 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 15:59:43,496 [root] DEBUG: Loader: Injecting process 8268 (thread 8272) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,496 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 15:59:43,497 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,498 [lib.api.process] INFO: Injected into 64-bit <Process 8268 backgroundTaskHost.exe>\n2026-05-28 15:59:43,499 [root] INFO: Process with pid 8268 has terminated\n2026-05-28 15:59:43,505 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 15:59:43,506 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,507 [lib.api.process] INFO: Injected into 64-bit <Process 8100 backgroundTaskHost.exe>\n2026-05-28 15:59:43,508 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 15:59:43,509 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 15:59:43,510 [lib.api.process] INFO: Injected into 64-bit <Process 8092 backgroundTaskHost.exe>\n2026-05-28 15:59:46,303 [root] DEBUG: 6204: NtTerminateProcess hook: Attempting to dump process 6204\n2026-05-28 15:59:46,304 [root] DEBUG: 6204: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-28 15:59:46,442 [root] INFO: Process with pid 6204 has terminated\n2026-05-28 15:59:57,010 [root] INFO: Added new file to list with pid 5932 and path C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf\n2026-05-28 15:59:57,038 [root] DEBUG: 5932: ProcessTrackedRegion: Region at 0x75D30000 mapped as \\Device\\HarddiskVolume2\\Windows\\SysWOW64\\kernel32.dll is in known range, skipping\n2026-05-28 15:59:57,056 [root] DEBUG: 5932: DLL loaded at 0x70790000: C:\\Windows\\system32\\dxgi (0xc2000 bytes).\n2026-05-28 15:59:57,056 [root] DEBUG: 5932: DLL loaded at 0x705B0000: C:\\Windows\\system32\\d3d11 (0x1e0000 bytes).\n2026-05-28 15:59:57,057 [root] DEBUG: 5932: DLL loaded at 0x6E690000: C:\\Windows\\system32\\dcomp (0x164000 bytes).\n2026-05-28 15:59:57,058 [root] DEBUG: 5932: DLL loaded at 0x6E800000: C:\\Windows\\system32\\dataexchange (0x31000 bytes).\n2026-05-28 15:59:57,060 [root] DEBUG: 5932: DLL loaded at 0x6F920000: C:\\Windows\\system32\\twinapi.appcore (0x191000 bytes).\n2026-05-28 16:00:40,103 [root] DEBUG: 6648: NtTerminateProcess hook: Attempting to dump process 6648\n2026-05-28 16:00:40,104 [root] DEBUG: 6648: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-28 16:00:40,129 [root] INFO: Process with pid 6648 has terminated\n2026-05-28 16:00:50,645 [root] DEBUG: 4344: DLL loaded at 0x00007FFCF4570000: C:\\Windows\\system32\\wbem\\ncprov (0x21000 bytes).\n2026-05-28 16:00:55,799 [root] DEBUG: 3932: DLL loaded at 0x00007FFCEF1C0000: C:\\Windows\\System32\\wscinterop (0x3d000 bytes).\n2026-05-28 16:00:55,823 [root] DEBUG: 3932: DLL loaded at 0x00007FFCDC000000: C:\\Windows\\System32\\WSCAPI (0x4d000 bytes).\n2026-05-28 16:00:55,870 [root] DEBUG: 3932: DLL loaded at 0x00007FFCE8EE0000: C:\\Windows\\System32\\wscui.cpl (0x19000 bytes).\n2026-05-28 16:00:55,913 [root] DEBUG: 3932: DLL loaded at 0x00007FFCDD5C0000: C:\\Windows\\System32\\framedynos (0x52000 bytes).\n2026-05-28 16:00:55,952 [root] DEBUG: 3932: DLL loaded at 0x00007FFCF6790000: C:\\Windows\\System32\\wer (0xde000 bytes).\n2026-05-28 16:00:55,985 [root] DEBUG: 3932: DLL loaded at 0x00007FFCD8180000: C:\\Windows\\System32\\werconcpl (0xde000 bytes).\n2026-05-28 16:00:56,022 [root] DEBUG: 3932: DLL loaded at 0x00007FFCE8EC0000: C:\\Windows\\System32\\hcproviders (0x14000 bytes).\n2026-05-28 16:00:56,218 [root] DEBUG: 3932: DLL loaded at 0x00007FFCD8090000: C:\\Windows\\System32\\ieproxy (0xee000 bytes).\n2026-05-28 16:02:51,277 [root] INFO: Announced starting service \"b'TrustedInstaller'\"\n2026-05-28 16:02:51,298 [lib.api.process] INFO: Monitor config for process 616: C:\\sl_8s73e\\dll\\616.ini\n2026-05-28 16:02:51,314 [root] DEBUG: 760: CreateProcessHandler: Injection info set for new process 8696: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF6B1C80000\n2026-05-28 16:02:51,348 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 16:02:51,352 [root] DEBUG: 760: CreateProcessHandler: Injection info set for new process 6772: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF6B1C80000\n2026-05-28 16:02:51,354 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 16:02:51,355 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8696\n2026-05-28 16:02:51,384 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 6772\n2026-05-28 16:02:51,403 [lib.api.process] INFO: Monitor config for process 8696: C:\\sl_8s73e\\dll\\8696.ini\n2026-05-28 16:02:51,420 [lib.api.process] INFO: Monitor config for process 6772: C:\\sl_8s73e\\dll\\6772.ini\n2026-05-28 16:02:51,428 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 16:02:51,428 [root] DEBUG: Loader: Injecting process 616 with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 16:02:51,432 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 16:02:51,436 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 16:02:51,450 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 16:02:51,463 [root] DEBUG: Loader: Copied config file C:\\sl_8s73e\\dll\\616.ini to system path C:\\616.ini\n2026-05-28 16:02:51,535 [root] DEBUG: Loader: Injecting process 8696 (thread 8700) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 16:02:51,575 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 616 C:\\sl_8s73e\\dll\\QrhOdoxx.dll\n2026-05-28 16:02:51,604 [root] DEBUG: Loader: Injecting process 6772 (thread 6776) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 16:02:51,655 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 16:02:51,675 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 16:02:51,694 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 16:02:51,710 [lib.api.process] INFO: Injected into 64-bit <Process 616 services.exe>\n2026-05-28 16:02:51,711 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 16:02:51,745 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 16:02:51,800 [lib.api.process] INFO: Injected into 64-bit <Process 6772 backgroundTaskHost.exe>\n2026-05-28 16:02:51,804 [lib.api.process] INFO: Injected into 64-bit <Process 8696 backgroundTaskHost.exe>\n2026-05-28 16:02:51,821 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 6772\n2026-05-28 16:02:51,821 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8696\n2026-05-28 16:02:51,862 [lib.api.process] INFO: Monitor config for process 8696: C:\\sl_8s73e\\dll\\8696.ini\n2026-05-28 16:02:51,862 [lib.api.process] INFO: Monitor config for process 6772: C:\\sl_8s73e\\dll\\6772.ini\n2026-05-28 16:02:51,868 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 16:02:51,869 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 16:02:51,880 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 16:02:51,881 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 16:02:51,969 [root] DEBUG: Loader: Injecting process 8696 (thread 8700) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 16:02:51,989 [root] DEBUG: Loader: Injecting process 6772 (thread 6776) with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 16:02:52,000 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 16:02:52,002 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 16:02:52,029 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 16:02:52,049 [root] DEBUG: Successfully injected DLL C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 16:02:52,091 [lib.api.process] INFO: Injected into 64-bit <Process 8696 backgroundTaskHost.exe>\n2026-05-28 16:02:52,126 [lib.api.process] INFO: Injected into 64-bit <Process 6772 backgroundTaskHost.exe>\n2026-05-28 16:02:52,133 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8696\n2026-05-28 16:02:52,140 [lib.api.process] INFO: Monitor config for process 8696: C:\\sl_8s73e\\dll\\8696.ini\n2026-05-28 16:02:52,148 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 6772\n2026-05-28 16:02:52,153 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 16:02:52,153 [lib.api.process] INFO: Monitor config for process 6772: C:\\sl_8s73e\\dll\\6772.ini\n2026-05-28 16:02:52,154 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 16:02:52,158 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 16:02:52,162 [lib.api.process] INFO: 64-bit DLL to inject is C:\\sl_8s73e\\dll\\QrhOdoxx.dll, loader C:\\sl_8s73e\\bin\\quhVjisR.exe\n2026-05-28 16:02:52,229 [root] DEBUG: Loader: Injecting process 8696 with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 16:02:52,266 [root] DEBUG: Loader: Injecting process 6772 with C:\\sl_8s73e\\dll\\QrhOdoxx.dll.\n2026-05-28 16:02:52,267 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 8700, handle 0x124\n2026-05-28 16:02:52,334 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 6776, handle 0xec\n2026-05-28 16:02:53,460 [root] INFO: Analysis timeout hit, terminating analysis\n2026-05-28 16:02:53,490 [lib.api.process] INFO: Terminate event set for process 5448\n2026-05-28 16:02:53,522 [root] DEBUG: 5448: Terminate Event: Attempting to dump process 5448\n2026-05-28 16:02:53,539 [root] DEBUG: 5448: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-28 16:02:53,567 [root] INFO: Added new file to list with pid 5448 and path C:\\Windows\\Logs\\MoSetup\\BlueBox.log\n2026-05-28 16:02:53,574 [lib.api.process] INFO: Termination confirmed for process 5448\n2026-05-28 16:02:53,586 [root] INFO: Terminate event set for process 5448\n2026-05-28 16:02:53,588 [root] DEBUG: 5448: Terminate Event: monitor shutdown complete for process 5448\n2026-05-28 16:02:53,591 [lib.api.process] INFO: Terminate event set for process 5932\n2026-05-28 16:02:53,609 [root] DEBUG: 5932: Terminate Event: Attempting to dump process 5932\n2026-05-28 16:02:53,641 [root] DEBUG: 5932: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-28 16:02:53,745 [root] INFO: Added new file to list with pid 5932 and path C:\\$Windows.~WS\\Sources\\Panther\\setupact.log\n2026-05-28 16:02:53,791 [root] INFO: Added new file to list with pid 5932 and path C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml\n2026-05-28 16:02:53,803 [root] INFO: Added new file to list with pid 5932 and path C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml\n2026-05-28 16:02:53,859 [root] INFO: Added new file to list with pid 5932 and path C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log\n2026-05-28 16:02:53,862 [lib.api.process] INFO: Termination confirmed for process 5932\n2026-05-28 16:02:53,866 [root] INFO: Terminate event set for process 5932\n2026-05-28 16:02:53,869 [root] DEBUG: 5932: Terminate Event: monitor shutdown complete for process 5932\n2026-05-28 16:02:53,870 [lib.api.process] INFO: Terminate event set for process 760\n2026-05-28 16:02:53,891 [root] DEBUG: 760: Terminate Event: Attempting to dump process 760\n2026-05-28 16:02:53,927 [root] DEBUG: 760: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-28 16:02:53,957 [lib.api.process] INFO: Termination confirmed for process 760\n2026-05-28 16:02:53,964 [root] INFO: Terminate event set for process 760\n2026-05-28 16:02:53,964 [lib.api.process] INFO: Terminate event set for process 4344\n2026-05-28 16:02:53,964 [root] DEBUG: 760: Terminate Event: monitor shutdown complete for process 760\n2026-05-28 16:02:53,996 [root] DEBUG: 4344: Terminate Event: Attempting to dump process 4344\n2026-05-28 16:02:54,026 [root] DEBUG: 4344: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-28 16:02:54,053 [root] INFO: Added new file to list with pid 4344 and path C:\\Windows\\System32\\wbem\\repository\\INDEX.BTR\n2026-05-28 16:02:54,100 [root] INFO: Added new file to list with pid 4344 and path C:\\Windows\\System32\\wbem\\repository\\OBJECTS.DATA\n2026-05-28 16:02:54,145 [root] INFO: Added new file to list with pid 4344 and path C:\\Windows\\System32\\wbem\\repository\\MAPPING3.MAP\n2026-05-28 16:02:54,181 [root] INFO: Added new file to list with pid 4344 and path C:\\Windows\\System32\\wbem\\repository\\MAPPING1.MAP\n2026-05-28 16:02:54,201 [lib.api.process] INFO: Termination confirmed for process 4344\n2026-05-28 16:02:54,217 [root] INFO: Terminate event set for process 4344\n2026-05-28 16:02:54,218 [root] DEBUG: 4344: Terminate Event: monitor shutdown complete for process 4344\n2026-05-28 16:02:54,218 [root] INFO: Created shutdown mutex\n2026-05-28 16:02:54,941 [root] DEBUG: 760: CreateProcessHandler: Injection info set for new process 1468: C:\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3745_none_7ded3f327ca60a41\\TiWorker.exe, ImageBase: 0x00007FF65B4F0000\n2026-05-28 16:02:55,239 [root] INFO: Shutting down package\n2026-05-28 16:02:55,245 [root] INFO: Stopping auxiliary modules\n2026-05-28 16:02:55,251 [root] INFO: Stopping auxiliary module: Browser\n2026-05-28 16:02:55,262 [root] INFO: Stopping auxiliary module: Human\n2026-05-28 16:02:55,279 [root] INFO: Stopping auxiliary module: Screenshots\n2026-05-28 16:02:55,280 [root] INFO: Finishing auxiliary modules\n2026-05-28 16:02:55,282 [root] INFO: Shutting down pipe server and dumping dropped files\n2026-05-28 16:02:55,285 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\DU.dll to files\\4912abc0a250dfaf63a48e4165e94ab701505f14bcc7a1464d5588fa2d434564; Size is 123712; Max size: 100000000\n2026-05-28 16:02:55,293 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\DiagTrack.dll to files\\b55d66f2943f1c63ea9b39dae88aa2a4f91775cefffefd263bd302866a7bd91c; Size is 922976; Max size: 100000000\n2026-05-28 16:02:55,318 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\DiagTrackRunner.exe to files\\488cbc8330952dd13b797bb40e4e30610ed03483c25919c39555f7b334a3c159; Size is 79040; Max size: 100000000\n2026-05-28 16:02:55,349 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\Diager.dll to files\\ae0f8123d3ef8801961211d7d71780bee76c418ebc8c6893b385d5faba6bb68f; Size is 41792; Max size: 100000000\n2026-05-28 16:02:55,359 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\setupplatform.cfg to files\\c40fddbb16853406d12d30e01e170de8474728bb8ec24794db721de0a7f67927; Size is 10452; Max size: 100000000\n2026-05-28 16:02:55,396 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\setupplatform.dll to files\\cbeec25c578f4e8eae81bb8829c3b7bc81648da6f63eeb4a606b9a66660d6d91; Size is 7203144; Max size: 100000000\n2026-05-28 16:02:55,411 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\unbcl.dll to files\\137eca75b268556503e26cd5987dddac5eb0831ed4ce5ea3b0d34b5645a31abd; Size is 835904; Max size: 100000000\n2026-05-28 16:02:55,419 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\wdsclientapi.dll to files\\00436605b013e26f39b3ff6aab1e5577fe6e4950c4c803d534d0bbd912b3f7e0; Size is 249288; Max size: 100000000\n2026-05-28 16:02:55,444 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\wdscore.dll to files\\65467bf1fbf10c2a399fe532b780f3604fda5b00db8319787cb6867bede4b90e; Size is 201528; Max size: 100000000\n2026-05-28 16:02:55,461 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\wdscsl.dll to files\\d5bcfdab29ea1deea22679a4a4473a9cc84871a5d707c006eb99facb4af9081b; Size is 50504; Max size: 100000000\n2026-05-28 16:02:55,505 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\wdsimage.dll to files\\4ed57014301e91b0504e0c2a62f4ee969ccf4c179de9788d1307dbc71186d543; Size is 750032; Max size: 100000000\n2026-05-28 16:02:55,530 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\wdstptc.dll to files\\48ee94546c9345fbe5ad1a51f4826b131da554a8e4395e5d22e4cde09b3816d5; Size is 516032; Max size: 100000000\n2026-05-28 16:02:55,537 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\wdsutil.dll to files\\eab16299b69323fca094f2d214a5bc5fbf973040b7ccd187415edf985f46b21d; Size is 237384; Max size: 100000000\n2026-05-28 16:02:55,553 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\wpx.dll to files\\08c8a6b2f76f9d9152e01ff3118990fdcdbb0d2e8c57dbfe43568367493187d4; Size is 1082696; Max size: 100000000\n2026-05-28 16:02:55,571 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\MediaSetupUIMgr.dll to files\\a2679d717db07f43d81f895e508520e01cd0262f1be5870333d12ce71fe02db4; Size is 15634744; Max size: 100000000\n2026-05-28 16:02:55,630 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\SetupCore.dll to files\\a9ac64ec515d04589dfc38b25d68d01f281bbb794d0df9ec4205fe473703aef5; Size is 2172728; Max size: 100000000\n2026-05-28 16:02:55,663 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\SetupHost.exe to files\\f33e7bce0ca712baac95557823096f929f78927e521c0448ed237f429141efd9; Size is 699192; Max size: 100000000\n2026-05-28 16:02:55,667 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\SetupMgr.dll to files\\45c2ee2387026a50f0c6b9c9119f39b6d2b6505312dbdf352399fd41e8deb78f; Size is 747320; Max size: 100000000\n2026-05-28 16:02:55,671 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\WinDlp.dll to files\\26b66b81267dfda7a78890f20a4ed0d104db1cd350d2d9f649fdb496b6c11333; Size is 1165624; Max size: 100000000\n2026-05-28 16:02:55,680 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\pidgenx.dll to files\\40a97484ce8e06658ea02af3e3b0077c47ba8d71c2d991eb69b94f221c78478f; Size is 888632; Max size: 100000000\n2026-05-28 16:02:55,688 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\pkeyconfig.xrm-ms to files\\a3471eb8dc2c3045e33eb48abaef4046eeebbe30161a52f7056f68e479400823; Size is 582696; Max size: 100000000\n2026-05-28 16:02:55,690 [lib.common.results] INFO: Uploading file C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml to files\\6c06bf950d0fe3476e020cd363ec0c8c9d4ee0fc89a24c50780c44e6453995c6; Size is 1908; Max size: 100000000\n2026-05-28 16:02:55,692 [lib.common.results] INFO: Uploading file C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml to files\\d56c2cf5d46b8fca32e2d040e45e0385e3c8bd53d7b1edb9a478e46c7dc45a4c; Size is 5021; Max size: 100000000\n2026-05-28 16:02:55,708 [lib.common.results] INFO: Uploading file C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log to files\\5852d0a081f42356cff2f1e45a0ab9127f23b0786d6e57353974fe3c6f54f572; Size is 6442; Max size: 100000000\n2026-05-28 16:02:55,724 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\Panther\\windlp.state.xml to files\\7f1c86c93da12c1af89a5811c6536b2726a0c4bff04f961ef1f578dc8fbfceb0; Size is 7042; Max size: 100000000\n2026-05-28 16:02:55,743 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\Panther\\windlp.state-old.xml to files\\7f1c86c93da12c1af89a5811c6536b2726a0c4bff04f961ef1f578dc8fbfceb0; Size is 7042; Max size: 100000000\n2026-05-28 16:02:55,744 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\products.cab to files\\7677dd6247c5768737b643911894374939aac5ae2dea158c272511fdd2ac52bf; Size is 44045; Max size: 100000000\n2026-05-28 16:02:55,748 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\products.xml to files\\76fcc8eeacb7da966441a7e0ac8b79cc095f13682abb92ee5a614c52f72ce54c; Size is 2794793; Max size: 100000000\n2026-05-28 16:02:55,753 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\Panther\\Eula.rtf to files\\7fbf900fdd0eabe63def6c5b432b5d3ff51f8ec9af7d9e9ab3a9d7441d032c22; Size is 204389; Max size: 100000000\n2026-05-28 16:02:55,755 [lib.common.results] INFO: Uploading file C:\\Windows\\Logs\\MoSetup\\BlueBox.log to files\\dc841755420a445321e88a5e6b6f6f012d5724c7d829ae7662bc081621b0f8d1; Size is 2005; Max size: 100000000\n2026-05-28 16:02:55,789 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\Panther\\setupact.log to files\\1edb1bb26ec6ca3a1d6f6e308aa838b4e5bb90f6d5f6f2f19416b524b41ef20b; Size is 18821; Max size: 100000000\n2026-05-28 16:02:55,793 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\Panther\\diagwrn.xml to files\\5caec7fc4e8cd26d37f83034123f319a5935167cd1f9045d93dbd16ddafec2b1; Size is 3215; Max size: 100000000\n2026-05-28 16:02:55,795 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\Panther\\diagerr.xml to files\\a97207c2f87481b56fa4cc3d29e72e970397af596b52afb88f8239550d0161ee; Size is 2210; Max size: 100000000\n2026-05-28 16:02:55,796 [lib.common.results] INFO: Uploading file C:\\$Windows.~WS\\Sources\\Panther\\setuperr.log to files\\948a87cf54643b2a1caceea44957df93724ec970fc1995bfe09e9d97780144ba; Size is 128; Max size: 100000000\n2026-05-28 16:02:55,806 [lib.common.results] INFO: Uploading file C:\\Windows\\System32\\wbem\\repository\\INDEX.BTR to files\\dceaf8aa74443e3ff2ec368302b74220a64a632d792d661276dd0c0b02545bce; Size is 4341760; Max size: 100000000\n2026-05-28 16:02:55,859 [lib.common.results] INFO: Uploading file C:\\Windows\\System32\\wbem\\repository\\OBJECTS.DATA to files\\0461d993fb0c8f4a5379828a8e4c98e646ab4de6f498409e0faef53f231f5a73; Size is 22913024; Max size: 100000000\n2026-05-28 16:02:55,926 [root] DEBUG: 760: CreateProcessHandler: Injection info set for new process 2940: C:\\Windows\\System32\\FodHelper.exe, ImageBase: 0x00007FF7CE640000\n2026-05-28 16:02:55,930 [lib.common.results] INFO: Uploading file C:\\Windows\\System32\\wbem\\repository\\MAPPING3.MAP to files\\89bfc82a0fefaa759d06ea13ba0d703e1f7399cec191c7ff8564767d9cc43afe; Size is 76744; Max size: 100000000\n2026-05-28 16:02:55,958 [lib.common.results] INFO: Uploading file C:\\Windows\\System32\\wbem\\repository\\MAPPING1.MAP to files\\f7aa1f9a250c5fad8d89cbc3960e779bf77a60661496181ea4c19be2e6964a4b; Size is 76744; Max size: 100000000\n2026-05-28 16:02:55,968 [root] WARNING: Folder at path \"C:\\tCeWxwA\\debugger\" does not exist, skipping\n2026-05-28 16:02:55,985 [root] WARNING: Folder at path \"C:\\tCeWxwA\\tlsdump\" does not exist, skipping\n2026-05-28 16:02:56,003 [root] WARNING: Monitor injection attempted but failed for process 7588\n2026-05-28 16:02:56,020 [root] WARNING: Monitor injection attempted but failed for process 7624\n2026-05-28 16:02:56,035 [root] WARNING: Monitor injection attempted but failed for process 7668\n2026-05-28 16:02:56,044 [root] WARNING: Monitor injection attempted but failed for process 8028\n2026-05-28 16:02:56,047 [root] WARNING: Monitor injection attempted but failed for process 8020\n2026-05-28 16:02:56,055 [root] WARNING: Monitor injection attempted but failed for process 8100\n2026-05-28 16:02:56,060 [root] WARNING: Monitor injection attempted but failed for process 8092\n2026-05-28 16:02:56,070 [root] WARNING: Monitor injection attempted but failed for process 7584\n2026-05-28 16:02:56,073 [root] WARNING: Monitor injection attempted but failed for process 7608\n2026-05-28 16:02:56,073 [root] WARNING: Monitor injection attempted but failed for process 8268\n2026-05-28 16:02:56,105 [root] WARNING: Monitor injection attempted but failed for process 8696\n2026-05-28 16:02:56,116 [root] WARNING: Monitor injection attempted but failed for process 6772\n2026-05-28 16:02:56,185 [root] INFO: Analysis completed\n",
    "errors": []
  },
  "network": {},
  "url_analysis": {},
  "procmemory": [],
  "signatures": [
    {
      "name": "antivm_checks_available_memory",
      "description": "Checks available memory",
      "categories": [
        "antivm"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 5932,
          "cid": 1385
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "queries_computer_name",
      "description": "Queries computer hostname",
      "categories": [
        "system_discovery"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 5932,
          "cid": 1074
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "dead_connect",
      "description": "Attempts to connect to a dead IP:Port (3 unique times)",
      "categories": [
        "network"
      ],
      "severity": 1,
      "weight": 0,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 5932,
          "cid": 3006
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 4292
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 4441
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "queries_keyboard_layout",
      "description": "Queries the keyboard layout",
      "categories": [
        "location_discovery"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 5448,
          "cid": 636
        },
        {
          "type": "call",
          "pid": 5448,
          "cid": 665
        },
        {
          "type": "call",
          "pid": 5448,
          "cid": 690
        },
        {
          "type": "call",
          "pid": 5448,
          "cid": 799
        },
        {
          "type": "call",
          "pid": 5448,
          "cid": 801
        },
        {
          "type": "call",
          "pid": 5448,
          "cid": 1857
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 7140
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 7168
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 7195
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 7284
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 7346
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 8213
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 8259
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 8332
        },
        {
          "type": "call",
          "pid": 6204,
          "cid": 461
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "queries_locale_api",
      "description": "Queries the computer locale (possible geofencing)",
      "categories": [
        "location_discovery",
        "geofence"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 5448,
          "cid": 277
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 5065
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 5285
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "static_pe_pdbpath",
      "description": "The PE file contains a PDB path",
      "categories": [
        "static"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 80,
      "references": [
        "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html"
      ],
      "data": [
        {
          "pdbpath": "SetupPrep.pdb"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "antidebug_setunhandledexceptionfilter",
      "description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
      "categories": [
        "anti-debug"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 40,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 5448,
          "cid": 80
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "language_check_registry",
      "description": "Checks system language via registry key (possible geofencing)",
      "categories": [
        "location_discovery",
        "geofence"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US"
        },
        {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "privilege_elevation_check",
      "description": "Queries process token information to check for Administrator privileges or UAC elevation status",
      "categories": [
        "discovery",
        "privilege_escalation"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 80,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 5932,
          "cid": 128
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 129
        },
        {
          "type": "call",
          "pid": 6204,
          "cid": 106
        },
        {
          "type": "call",
          "pid": 6204,
          "cid": 107
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "query_fips_reconnaissance",
      "description": "Queried the FIPS cryptography policy, can be used to adapt C2 network encryption or by legitimate encryption software",
      "categories": [
        "discovery",
        "c2"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 50,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 5448,
          "cid": 512
        },
        {
          "type": "call",
          "pid": 5448,
          "cid": 513
        },
        {
          "type": "call",
          "pid": 5448,
          "cid": 520
        },
        {
          "type": "call",
          "pid": 5448,
          "cid": 521
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 90
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 91
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 94
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 96
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 97
        },
        {
          "type": "call",
          "pid": 6204,
          "cid": 55
        },
        {
          "type": "call",
          "pid": 6204,
          "cid": 56
        },
        {
          "type": "call",
          "pid": 6204,
          "cid": 59
        },
        {
          "type": "call",
          "pid": 6204,
          "cid": 61
        },
        {
          "type": "call",
          "pid": 6204,
          "cid": 62
        },
        {
          "behavioral_fips_reconnaissance": [
            "SetupHost.Exe (PID: 5932) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'",
            "MediaCreationTool_22H2.exe (PID: 5448) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'",
            "SetupHost.Exe (PID: 5932) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "SetupHost.Exe (PID: 5932) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'",
            "SetupHost.Exe (PID: 5932) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "MediaCreationTool_22H2.exe (PID: 5448) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'",
            "vdsldr.exe (PID: 6204) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'",
            "MediaCreationTool_22H2.exe (PID: 5448) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "SetupHost.Exe (PID: 5932) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'",
            "vdsldr.exe (PID: 6204) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'",
            "vdsldr.exe (PID: 6204) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "vdsldr.exe (PID: 6204) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "MediaCreationTool_22H2.exe (PID: 5448) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "vdsldr.exe (PID: 6204) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'"
          ]
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "dllload_suspicious_directory",
      "description": "A DLL was loaded from a suspicious directory",
      "categories": [
        "side loading"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 50,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 5932,
          "cid": 800
        },
        {
          "suspicious_dll_load": "Process setuphost.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking"
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 802
        },
        {
          "suspicious_dll_load": "Process setuphost.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking"
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 885
        },
        {
          "suspicious_dll_load": "Process setuphost.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking"
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 947
        },
        {
          "suspicious_dll_load": "Process setuphost.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking"
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 953
        },
        {
          "suspicious_dll_load": "Process setuphost.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking"
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 1003
        },
        {
          "suspicious_dll_load": "Process setuphost.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking"
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 1009
        },
        {
          "suspicious_dll_load": "Process setuphost.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking"
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 3512
        },
        {
          "suspicious_dll_load": "Process setuphost.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking"
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 3513
        },
        {
          "suspicious_dll_load": "Process setuphost.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "creates_suspended_process",
      "description": "Creates a process in a suspended state, likely for injection",
      "categories": [
        "injection",
        "process hollowing"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 50,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 760,
          "cid": 419
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 420
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 421
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 458
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 461
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 481
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 482
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 483
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 497
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 510
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 679
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 681
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "resumethread_remote_process",
      "description": "Resumed a thread in another process",
      "categories": [
        "injection",
        "unpacking"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "thread_resumed": "Process svchost.exe with process ID 760 resumed a thread in another process with the process ID 7624"
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 422
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 423
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 424
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 521
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 522
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "network_cnc_https_generic",
      "description": "Establishes an encrypted HTTPS connection",
      "categories": [
        "network",
        "encryption"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "http_request": "GET /settings/v2.0/WSD/Setup360?os=windows&osver=10.0.19041.3803.amd64fre.vb_release.191206-1406&scenarioId=7&platformEdition=Professional&platformInstallationType=Client&sku=48&deviceId=%7B088B0758-31C5-47D8-9C4B-32E98EB1AB80%7D&appver=10.0.19041.572&appBuildLab=vb_release_svc_prod1 HTTP/1.1\r\nConnection: Keep-Alive\r\nUser-Agent: OneSettingsQuery\r\nHost: settings-win.data.microsoft.com\r\n\r\n"
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 3422
        },
        {
          "http_request": "GET /fwlink/?LinkId=841361 HTTP/1.1\r\nConnection: Keep-Alive\r\nRange: bytes=0-44044\r\nUser-Agent: Windows Dlp Manager\r\nHost: go.microsoft.com\r\n\r\n"
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 4589
        },
        {
          "http_request": "GET /download/7/9/c/79cbc22a-0eea-4a0d-89c0-054a1b3aa8e0/products.cab HTTP/1.1\r\nConnection: Keep-Alive\r\nRange: bytes=0-44044\r\nUser-Agent: Windows Dlp Manager\r\nHost: download.microsoft.com\r\n\r\n"
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 4648
        },
        {
          "http_request": "GET /download/C/0/3/C036B882-9F99-4BC9-A4B5-69370C4E17E9/EULA_MCTool_EN-US_6.27.16.rtf HTTP/1.1\r\nConnection: Keep-Alive\r\nRange: bytes=0-204388\r\nUser-Agent: Windows Dlp Manager\r\nHost: download.microsoft.com\r\n\r\n"
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 7986
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "reads_self",
      "description": "Reads data out of its own binary image",
      "categories": [
        "generic"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 30,
      "references": [],
      "data": [
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x00000000, length: 0x00000040"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x3030785c3030785c, length: 0x00b03838"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x3030785c3865785c, length: 0x000000f8"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x62785c383065785c, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x62785c383462785c, length: 0x00000024"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x62785c383766785c, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x62785c383864785c, length: 0x00000008"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x62785c393262785c, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x62785c393364785c, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x62785c393531785c, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x62785c393839785c, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x62785c396665785c, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x62785c3a3466785c, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x62785c3a3764785c, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x62785c3a3962785c, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x62785c3a6239785c, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x62785c3b6630785c, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x785c3062785c3939, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x785c3062785c3954, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x785c3062785c3976, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x785c3062785c3a0a, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x785c3062785c3a27, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x785c3062785c3a43, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x785c3062785c3a5f, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x785c3062785c3a77, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x785c3062785c3b2b, length: 0x00000110"
        },
        {
          "self_read": "process: MediaCreationTool_22H2.exe, pid: 5448, offset: 0x785c3062785c3b4d, length: 0x0078a004"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "terminates_remote_process",
      "description": "Terminates another process",
      "categories": [
        "persistence",
        "stealth"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 760,
          "cid": 460
        },
        {
          "process": "svchost.exe"
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 463
        },
        {
          "process": "svchost.exe"
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 485
        },
        {
          "process": "svchost.exe"
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 499
        },
        {
          "process": "svchost.exe"
        },
        {
          "type": "call",
          "pid": 760,
          "cid": 512
        },
        {
          "process": "svchost.exe"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "pe_deep_entrypoint",
      "description": "The PE entry point is located unusually far into section, indicative of an appended packer stub that jumps to the original entry point (OEP)",
      "categories": [
        "static",
        "packer",
        "evasion",
        "anomaly"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "anomaly_description": "The PE entry point (0x729b0) is located 94.9% deep into the '.text' section. Normal compilers place the EP near the beginning. This strongly indicates an appended packer stub or shellcode.",
          "entry_point": "0x729b0",
          "section_name": ".text",
          "section_virtual_address": "0x1000",
          "section_virtual_size": "0x77b30",
          "offset_bytes": "0x719b0",
          "depth_percentage": 94.91,
          "section_entropy": 6.36
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "packer_unknown_pe_section_name",
      "description": "The binary contains an unknown PE section name indicative of packing",
      "categories": [
        "packer"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "unknown section": {
            "name": ".boxload",
            "raw_address": "0x0007b800",
            "virtual_address": "0x00080000",
            "virtual_size": "0x00000040",
            "size_of_data": "0x00000200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "0.73"
          }
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "contains_pe_overlay",
      "description": "The PE file contains an overlay",
      "categories": [
        "static"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "overlay": "Contains overlay at offset 0x00b03800 with size: 7914776 bytes"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "dropper",
      "description": "Drops a binary and executes it",
      "categories": [
        "dropper"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 50,
      "references": [],
      "data": [
        {
          "binary": "C:\\$Windows.~WS\\Sources\\SetupHost.exe"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "hardware_id_profiling",
      "description": "Queries the Volume Serial Number or Physical Hardware ID, possibly for anti-sandbox, victim profiling or environmental keying",
      "categories": [
        "evasion",
        "recon",
        "anti-sandbox"
      ],
      "severity": 3,
      "weight": 4,
      "confidence": 80,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 5932,
          "cid": 8338
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "antivm_wmi",
      "description": "Executes WMI queries that can be used for anti-virtualization",
      "categories": [
        "anti-vm"
      ],
      "severity": 3,
      "weight": 1,
      "confidence": 80,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 5932,
          "cid": 1118
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 1373
        },
        {
          "type": "call",
          "pid": 5932,
          "cid": 1392
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "amsi_enumeration",
      "description": "Enumerated Anti-Malware Scan Interface (AMSI) providers, a potential precursor to AMSI bypass or EDR unhooking",
      "categories": [
        "discovery",
        "defense_evasion"
      ],
      "severity": 3,
      "weight": 1,
      "confidence": 40,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 5932,
          "cid": 1353
        },
        {
          "amsi_enumeration": [
            "SetupHost.Exe (PID: 5932) probed AMSI registry 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\AMSI\\Providers'"
          ]
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "deletes_executed_files",
      "description": "Deletes executed files from disk",
      "categories": [
        "persistence",
        "stealth"
      ],
      "severity": 3,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "file": "C:\\$Windows.~WS\\Sources"
        },
        {
          "file": "C:\\$Windows.~WS"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    }
  ],
  "malscore": 7.0,
  "ttps": [
    {
      "signature": "hardware_id_profiling",
      "ttps": [
        "T1082"
      ],
      "mbcs": [
        "E1082",
        "E1480.001"
      ]
    },
    {
      "signature": "antivm_checks_available_memory",
      "ttps": [
        "T1082"
      ],
      "mbcs": []
    },
    {
      "signature": "antivm_wmi",
      "ttps": [
        "T1497",
        "T1082",
        "T1047"
      ],
      "mbcs": [
        "B0001.002",
        "B0007",
        "OB0001"
      ]
    },
    {
      "signature": "amsi_enumeration",
      "ttps": [
        "T1518",
        "T1562"
      ],
      "mbcs": []
    },
    {
      "signature": "privilege_elevation_check",
      "ttps": [
        "T1033",
        "T1082"
      ],
      "mbcs": []
    },
    {
      "signature": "query_fips_reconnaissance",
      "ttps": [
        "T1082"
      ],
      "mbcs": []
    },
    {
      "signature": "dllload_suspicious_directory",
      "ttps": [
        "T1574"
      ],
      "mbcs": [
        "F0015"
      ]
    },
    {
      "signature": "creates_suspended_process",
      "ttps": [
        "T1055"
      ],
      "mbcs": []
    },
    {
      "signature": "resumethread_remote_process",
      "ttps": [
        "T1055"
      ],
      "mbcs": []
    },
    {
      "signature": "network_cnc_https_generic",
      "ttps": [
        "T1573"
      ],
      "mbcs": []
    },
    {
      "signature": "pe_deep_entrypoint",
      "ttps": [
        "T1027"
      ],
      "mbcs": [
        "E1027"
      ]
    },
    {
      "signature": "packer_unknown_pe_section_name",
      "ttps": [
        "T1027.002",
        "T1027"
      ],
      "mbcs": [
        "OB0001",
        "OB0002",
        "OB0006",
        "F0001"
      ]
    },
    {
      "signature": "deletes_executed_files",
      "ttps": [
        "T1070"
      ],
      "mbcs": [
        "F0007"
      ]
    },
    {
      "signature": "dropper",
      "ttps": [
        "T1129"
      ],
      "mbcs": [
        "OB0009",
        "B0023"
      ]
    }
  ],
  "malstatus": "Malicious"
}